Project import generated by Copybara.

GitOrigin-RevId: 7e783ad0537317a2a80360e867c30b63244bd1bd
Change-Id: Idb5660232a403d48f02c474680cb3db6d8eddee5
diff --git a/build_nxp.sh b/build_nxp.sh
new file mode 100755
index 0000000..80d4c4e
--- /dev/null
+++ b/build_nxp.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+
+exec_name=$0
+cpu_num=$(grep -c processor /proc/cpuinfo)
+
+set -o errtrace
+trap 'echo Fatal error: script ${exec_name} aborting at line $LINENO, command \"$BASH_COMMAND\" returned $?; exit 1' ERR
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+function usage(){
+  echo "Usage: ${exec_name} <kernel_ver> <board> [workspace path]"
+  echo "supported boards: lumia-proto lumia-p0 lumia-x2-p0 swift-p1 swift-p2"
+}
+
+if (( $# < 2 ))
+then
+    usage
+    exit 2
+fi
+
+kernel_version=$1
+board=$2
+readonly workspace_path=$3
+
+if [ "$board" == "lumia-proto" ]; then
+    board="longan-p0"
+elif [ "$board" == "lumia-x2-p0" ]; then
+    board="lumia-p0"
+fi
+
+readonly product=`echo ${board} | cut -d "-" -f1`
+
+case $product in
+    longan | lumia | swift)
+        echo "product: $product"
+        ;;
+    *)
+        echo "unknown product: $product"
+        exit 1
+esac
+
+wifi_drv_path=${DIR}/wlan_src
+
+if [ "$kernel_version"x == "6.6"x ]; then
+KERNELDIR=${DIR}/../kernel-6.6
+kernel_out_dir=kernel_6.6
+else
+KERNELDIR=${DIR}/../kernel
+kernel_out_dir=kernel
+fi
+CROSS_COMPILE=${DIR}/../prebuilt/toolchain/aarch64/bin/aarch64-cros-linux-gnu-
+make_options="KERNELDIR=${KERNELDIR} CROSS_COMPILE=${CROSS_COMPILE} CC=${CROSS_COMPILE}gcc LD=${CROSS_COMPILE}ld"
+
+pushd ${DIR}
+cd ${wifi_drv_path}
+make clean
+make ${make_options} -j${cpu_num}
+
+popd
+
+if [ ! -z $workspace_path ]; then
+	product_prebuilt_path=${workspace_path}/vendor/amlogic/${product}/prebuilt
+
+	wifi_drv_out_dir=${product_prebuilt_path}/${kernel_out_dir}/modules
+	fct_wifi_drv_out_dir=${product_prebuilt_path}/factory/${kernel_out_dir}/modules
+	mkdir -p ${wifi_drv_out_dir}
+	rm -rf ${wifi_drv_out_dir}/mlan.${board}.ko
+	rm -rf ${wifi_drv_out_dir}/moal.${board}.ko
+	mkdir -p ${fct_wifi_drv_out_dir}
+	rm -rf ${fct_wifi_drv_out_dir}/mlan.${board}.ko
+	rm -rf ${fct_wifi_drv_out_dir}/moal.${board}.ko
+
+	cp -v ${wifi_drv_path}/mlan.ko ${wifi_drv_out_dir}/mlan.${board}.ko
+	cp -v ${wifi_drv_path}/moal.ko ${wifi_drv_out_dir}/moal.${board}.ko
+	cp -v ${wifi_drv_path}/mlan.ko ${fct_wifi_drv_out_dir}/mlan.${board}.ko
+	cp -v ${wifi_drv_path}/moal.ko ${fct_wifi_drv_out_dir}/moal.${board}.ko
+fi
diff --git a/wlan_sd8987/BUILD.bazel b/wlan_sd8987/BUILD.bazel
deleted file mode 100644
index 4d9eb5b..0000000
--- a/wlan_sd8987/BUILD.bazel
+++ /dev/null
@@ -1,17 +0,0 @@
-# NXP driver is a Wi-Fi driver used for ATV products.
-load("//build/kernel/kleaf:kernel.bzl", "kernel_module")
-
-kernel_module(
-    name = "nxp-driver",
-    srcs = glob([
-        "**/*.c",
-        "**/*.h",
-    ]),
-    outs = [
-        "moal.ko",
-        "mlan.ko",
-    ],
-    kernel_build = "//common:amlogic",
-    visibility = ["//visibility:public"],
-)
-
diff --git a/wlan_sd8987/mlan/mlan.h b/wlan_sd8987/mlan/mlan.h
deleted file mode 100755
index 4d48ce8..0000000
--- a/wlan_sd8987/mlan/mlan.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/** @file mlan.h
- *
- *  @brief This file declares all APIs that will be called from MOAL module.
- *  It also defines the data structures used for APIs between MLAN and MOAL.
- *
- *
- *  Copyright 2008-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/******************************************************
-Change log:
-    10/13/2008: initial version
-    11/07/2008: split mlan.h into mlan_decl.h & mlan_ioctl.h
-******************************************************/
-
-#ifndef _MLAN_H_
-#define _MLAN_H_
-
-#include "mlan_decl.h"
-#include "mlan_ioctl.h"
-#include "mlan_ieee.h"
-
-#endif /* !_MLAN_H_ */
diff --git a/wlan_sd8987/mlan/mlan_11ac.h b/wlan_sd8987/mlan/mlan_11ac.h
deleted file mode 100755
index 9db5f9c..0000000
--- a/wlan_sd8987/mlan/mlan_11ac.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/** @file mlan_11ac.h
- *
- *  @brief This file contains the functions for station ioctl.
- *
- *
- *  Copyright 2011-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-#ifndef _MLAN_11AC_H_
-#define _MLAN_11AC_H_
-
-#include "mlan_11n_aggr.h"
-#include "mlan_11n_rxreorder.h"
-#include "mlan_wmm.h"
-
-void wlan_show_dot11acdevcap(pmlan_adapter pmadapter, t_u32 cap);
-void wlan_show_dot11acmcssupport(pmlan_adapter pmadapter, t_u32 support);
-t_u16 wlan_convert_mcsmap_to_maxrate(mlan_private *priv, t_u16 bands,
-				     t_u16 mcs_map);
-void wlan_fill_vht_cap_tlv(mlan_private *priv, MrvlIETypes_VHTCap_t *pvht_cap,
-			   t_u16 bands, t_u8 flag, t_u8 bw_80p80);
-void wlan_fill_vht_cap_ie(mlan_private *priv, IEEEtypes_VHTCap_t *pvht_cap,
-			  t_u16 bands);
-void wlan_fill_tdls_vht_oprat_ie(mlan_private *priv,
-				 IEEEtypes_VHTOprat_t *vht_oprat,
-				 sta_node *sta_ptr);
-t_u8 wlan_is_ap_in_11ac_mode(mlan_private *priv);
-int wlan_cmd_append_11ac_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
-			     t_u8 **ppbuffer);
-mlan_status wlan_11ac_cfg_ioctl(pmlan_adapter pmadapter,
-				pmlan_ioctl_req pioctl_req);
-void wlan_update_11ac_cap(mlan_private *pmpriv);
-t_u8 wlan_11ac_bandconfig_allowed(mlan_private *pmpriv, t_u16 bss_band);
-t_u8 wlan_is_80_80_support(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc);
-
-mlan_status wlan_cmd_11ac_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
-			      t_u16 cmd_action, t_void *pdata_buf);
-
-mlan_status wlan_ret_11ac_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
-			      mlan_ioctl_req *pioctl_buf);
-
-#endif /* _MLAN_11AC_H_ */
diff --git a/wlan_sd8987/mlan/mlan_11n_aggr.c b/wlan_sd8987/mlan/mlan_11n_aggr.c
deleted file mode 100755
index 53e8543..0000000
--- a/wlan_sd8987/mlan/mlan_11n_aggr.c
+++ /dev/null
@@ -1,674 +0,0 @@
-/** @file mlan_11n_aggr.c
- *
- *  @brief This file contains functions for 11n Aggregation.
- *
- *
- *  Copyright 2008-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/********************************************************
-Change log:
-    11/10/2008: initial version
-********************************************************/
-
-#include "mlan.h"
-#include "mlan_join.h"
-#include "mlan_util.h"
-#include "mlan_fw.h"
-#include "mlan_main.h"
-#include "mlan_wmm.h"
-#include "mlan_11n.h"
-#include "mlan_11n_aggr.h"
-
-/********************************************************
-			Local Variables
-********************************************************/
-
-/********************************************************
-			Global Variables
-********************************************************/
-
-/********************************************************
-			Local Functions
-********************************************************/
-/**
- *  @brief Aggregate individual packets into one AMSDU packet
- *
- *  @param pmadapter A pointer to mlan_adapter structure
- *  @param amsdu_buf A pointer to packet buffer
- *  @param data      A pointer to aggregated data packet being formed
- *  @param pkt_len   Length of current packet to aggregate
- *  @param pad       Pad
- *
- *  @return         Final packet size
- */
-static int wlan_11n_form_amsdu_pkt(pmlan_adapter pmadapter, t_u8 *amsdu_buf,
-				   t_u8 *data, int pkt_len, int *pad)
-{
-	int dt_offset, amsdu_buf_offset;
-	Rfc1042Hdr_t snap = {
-		0xaa, /* LLC DSAP */
-		0xaa, /* LLC SSAP */
-		0x03, /* LLC CTRL */
-		{0x00, 0x00, 0x00}, /* SNAP OUI */
-		0x0000 /* SNAP type */
-		/*
-		 * This field will be overwritten
-		 * later with ethertype
-		 */
-	};
-
-	ENTER();
-
-	memcpy_ext(pmadapter, amsdu_buf, data, (MLAN_MAC_ADDR_LENGTH)*2,
-		   (MLAN_MAC_ADDR_LENGTH)*2);
-	dt_offset = amsdu_buf_offset = (MLAN_MAC_ADDR_LENGTH)*2;
-
-	snap.snap_type = *(t_u16 *)(data + dt_offset);
-	dt_offset += sizeof(t_u16);
-	*(t_u16 *)(amsdu_buf + amsdu_buf_offset) =
-		mlan_htons(pkt_len + LLC_SNAP_LEN -
-			   ((2 * MLAN_MAC_ADDR_LENGTH) + sizeof(t_u16)));
-	amsdu_buf_offset += sizeof(t_u16);
-	memcpy_ext(pmadapter, amsdu_buf + amsdu_buf_offset, &snap, LLC_SNAP_LEN,
-		   LLC_SNAP_LEN);
-	amsdu_buf_offset += LLC_SNAP_LEN;
-
-	memcpy_ext(pmadapter, amsdu_buf + amsdu_buf_offset, data + dt_offset,
-		   pkt_len - dt_offset, pkt_len - dt_offset);
-	*pad = (((pkt_len + LLC_SNAP_LEN) & 3)) ?
-		       (4 - (((pkt_len + LLC_SNAP_LEN)) & 3)) :
-		       0;
-
-	LEAVE();
-	return pkt_len + LLC_SNAP_LEN + *pad;
-}
-
-/**
- *  @brief Add TxPD to AMSDU header
- *
- *  @param priv     A pointer to mlan_private structure
- *  @param mbuf		Pointer to buffer where the TxPD will be formed
- *
- *  @return		N/A
- */
-static void wlan_11n_form_amsdu_txpd(mlan_private *priv, mlan_buffer *mbuf)
-{
-	TxPD *ptx_pd;
-	mlan_adapter *pmadapter = priv->adapter;
-
-	ENTER();
-
-	ptx_pd = (TxPD *)mbuf->pbuf;
-	memset(pmadapter, ptx_pd, 0, sizeof(TxPD));
-
-	/*
-	 * Original priority has been overwritten
-	 */
-	ptx_pd->priority = (t_u8)mbuf->priority;
-	ptx_pd->pkt_delay_2ms =
-		wlan_wmm_compute_driver_packet_delay(priv, mbuf);
-	ptx_pd->bss_num = GET_BSS_NUM(priv);
-	ptx_pd->bss_type = priv->bss_type;
-	/* Always zero as the data is followed by TxPD */
-	ptx_pd->tx_pkt_offset = sizeof(TxPD);
-	ptx_pd->tx_pkt_type = PKT_TYPE_AMSDU;
-	if (mbuf->flags & MLAN_BUF_FLAG_TDLS)
-		ptx_pd->flags = MRVDRV_TxPD_FLAGS_TDLS_PACKET;
-	if (ptx_pd->tx_control == 0)
-		/* TxCtrl set by user or default */
-		ptx_pd->tx_control = priv->pkt_tx_ctrl;
-
-	endian_convert_TxPD(ptx_pd);
-
-	LEAVE();
-}
-
-/**
- *  @brief Update the TxPktLength field in TxPD after the complete AMSDU
- *  packet is formed
- *
- *  @param priv     A pointer to mlan_private structure
- *  @param mbuf     TxPD buffer
- *
- *  @return         N/A
- */
-static INLINE void wlan_11n_update_pktlen_amsdu_txpd(mlan_private *priv,
-						     pmlan_buffer mbuf)
-{
-	TxPD *ptx_pd;
-	ENTER();
-
-	ptx_pd = (TxPD *)mbuf->pbuf;
-	ptx_pd->tx_pkt_length =
-		(t_u16)wlan_cpu_to_le16(mbuf->data_len - sizeof(TxPD));
-#ifdef STA_SUPPORT
-	if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) &&
-	    (priv->adapter->pps_uapsd_mode)) {
-		if (MTRUE == wlan_check_last_packet_indication(priv)) {
-			priv->adapter->tx_lock_flag = MTRUE;
-			ptx_pd->flags |= MRVDRV_TxPD_POWER_MGMT_LAST_PACKET;
-		}
-	}
-#endif /* STA_SUPPORT */
-	LEAVE();
-}
-
-/**
- *  @brief Get number of aggregated packets
- *
- *  @param data			A pointer to packet data
- *  @param total_pkt_len	Total packet length
- *
- *  @return			Number of packets
- */
-static int wlan_11n_get_num_aggrpkts(t_u8 *data, int total_pkt_len)
-{
-	int pkt_count = 0, pkt_len, pad;
-	t_u8 hdr_len = sizeof(Eth803Hdr_t);
-
-	ENTER();
-	while (total_pkt_len >= hdr_len) {
-		/* Length will be in network format, change it to host */
-		pkt_len = mlan_ntohs(
-			(*(t_u16 *)(data + (2 * MLAN_MAC_ADDR_LENGTH))));
-		if (pkt_len > total_pkt_len) {
-			PRINTM(MERROR, "Error in packet length.\n");
-			break;
-		}
-
-		pad = (((pkt_len + sizeof(Eth803Hdr_t)) & 3)) ?
-			      (4 - ((pkt_len + sizeof(Eth803Hdr_t)) & 3)) :
-			      0;
-		data += pkt_len + pad + sizeof(Eth803Hdr_t);
-		total_pkt_len -= pkt_len + pad + sizeof(Eth803Hdr_t);
-		++pkt_count;
-	}
-	LEAVE();
-	return pkt_count;
-}
-
-/********************************************************
-			Global Functions
-********************************************************/
-
-/**
- *  @brief Deaggregate the received AMSDU packet
- *
- *  @param priv		A pointer to mlan_private structure
- *  @param pmbuf	A pointer to aggregated data packet
- *
- *  @return		MLAN_STATUS_SUCCESS --success, otherwise fail
- */
-mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
-{
-	t_u16 pkt_len;
-	int total_pkt_len;
-	t_u8 *data;
-	mlan_adapter *pmadapter = priv->adapter;
-	t_u32 max_rx_data_size = MLAN_RX_DATA_BUF_SIZE;
-	int pad;
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	RxPacketHdr_t *prx_pkt;
-	mlan_buffer *daggr_mbuf = MNULL;
-	t_u8 rfc1042_eth_hdr[MLAN_MAC_ADDR_LENGTH] = {0xaa, 0xaa, 0x03,
-						      0x00, 0x00, 0x00};
-	t_u8 hdr_len = sizeof(Eth803Hdr_t);
-	t_u8 eapol_type[2] = {0x88, 0x8e};
-	t_u8 tdls_action_type[2] = {0x89, 0x0d};
-	t_u32 in_ts_sec, in_ts_usec;
-	t_u32 out_ts_sec, out_ts_usec;
-	t_u32 in_copy_ts_sec, in_copy_ts_usec;
-	t_u32 out_copy_ts_sec, out_copy_ts_usec;
-	t_u32 copy_delay = 0;
-	t_u32 delay = 0;
-
-	ENTER();
-
-	data = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
-	total_pkt_len = pmbuf->data_len;
-
-	/* Sanity test */
-#if defined(USB)
-	if (IS_USB(pmadapter->card_type) &&
-	    pmadapter->pcard_usb->usb_rx_deaggr.aggr_ctrl.enable) {
-		max_rx_data_size =
-			pmadapter->pcard_usb->usb_rx_deaggr.aggr_ctrl.aggr_max;
-		if (pmadapter->pcard_usb->usb_rx_deaggr.aggr_ctrl.aggr_mode ==
-		    MLAN_USB_AGGR_MODE_NUM) {
-			max_rx_data_size *=
-				MAX(MLAN_USB_MAX_PKT_SIZE,
-				    pmadapter->pcard_usb->usb_rx_deaggr
-					    .aggr_ctrl.aggr_align);
-			max_rx_data_size =
-				MAX(max_rx_data_size, MLAN_RX_DATA_BUF_SIZE);
-		}
-	}
-#endif
-	if (total_pkt_len > (int)max_rx_data_size) {
-		PRINTM(MERROR,
-		       "Total packet length greater than tx buffer"
-		       " size %d\n",
-		       total_pkt_len);
-		goto done;
-	}
-	if (pmadapter->tp_state_on)
-		pmadapter->callbacks.moal_get_system_time(
-			pmadapter->pmoal_handle, &in_ts_sec, &in_ts_usec);
-	pmbuf->use_count = wlan_11n_get_num_aggrpkts(data, total_pkt_len);
-
-	// rx_trace 7
-	if (pmadapter->tp_state_on) {
-		pmadapter->callbacks.moal_tp_accounting(
-			pmadapter->pmoal_handle, pmbuf, 7 /*RX_DROP_P3*/);
-		pmadapter->callbacks.moal_tp_accounting_rx_param(
-			pmadapter->pmoal_handle, 4, pmbuf->use_count);
-	}
-	if (pmadapter->tp_state_drop_point == 7 /*RX_DROP_P3*/)
-		goto done;
-	prx_pkt = (RxPacketHdr_t *)data;
-	if (pmbuf->pdesc && !memcmp(pmadapter, prx_pkt->eth803_hdr.dest_addr,
-				    priv->curr_addr, MLAN_MAC_ADDR_LENGTH)) {
-		if (pmadapter->callbacks.moal_recv_amsdu_packet) {
-			ret = pmadapter->callbacks.moal_recv_amsdu_packet(
-				pmadapter->pmoal_handle, pmbuf);
-			if (ret == MLAN_STATUS_PENDING) {
-				priv->msdu_in_rx_amsdu_cnt += pmbuf->use_count;
-				priv->amsdu_rx_cnt++;
-				return ret;
-			}
-			goto done;
-		}
-	}
-	while (total_pkt_len >= hdr_len) {
-		prx_pkt = (RxPacketHdr_t *)data;
-		/* Length will be in network format, change it to host */
-		pkt_len = mlan_ntohs(
-			(*(t_u16 *)(data + (2 * MLAN_MAC_ADDR_LENGTH))));
-		if (pkt_len > total_pkt_len) {
-			PRINTM(MERROR,
-			       "Error in packet length: total_pkt_len = %d, pkt_len = %d\n",
-			       total_pkt_len, pkt_len);
-			ret = MLAN_STATUS_FAILURE;
-			break;
-		}
-
-		pad = (((pkt_len + sizeof(Eth803Hdr_t)) & 3)) ?
-			      (4 - ((pkt_len + sizeof(Eth803Hdr_t)) & 3)) :
-			      0;
-
-		total_pkt_len -= pkt_len + pad + sizeof(Eth803Hdr_t);
-
-		if (memcmp(pmadapter, &prx_pkt->rfc1042_hdr, rfc1042_eth_hdr,
-			   sizeof(rfc1042_eth_hdr)) == 0) {
-			memmove(pmadapter, data + LLC_SNAP_LEN, data,
-				(2 * MLAN_MAC_ADDR_LENGTH));
-			data += LLC_SNAP_LEN;
-			pkt_len += sizeof(Eth803Hdr_t) - LLC_SNAP_LEN;
-		} else {
-			*(t_u16 *)(data + (2 * MLAN_MAC_ADDR_LENGTH)) =
-				(t_u16)0;
-			pkt_len += sizeof(Eth803Hdr_t);
-		}
-		daggr_mbuf = wlan_alloc_mlan_buffer(pmadapter,
-						    pkt_len + MLAN_NET_IP_ALIGN,
-						    0, MOAL_ALLOC_MLAN_BUFFER);
-		if (daggr_mbuf == MNULL) {
-			PRINTM(MERROR, "Error allocating daggr mlan_buffer\n");
-			ret = MLAN_STATUS_FAILURE;
-			break;
-		}
-		daggr_mbuf->data_offset += MLAN_NET_IP_ALIGN;
-		daggr_mbuf->bss_index = pmbuf->bss_index;
-		daggr_mbuf->buf_type = pmbuf->buf_type;
-		daggr_mbuf->data_len = pkt_len;
-		daggr_mbuf->in_ts_sec = pmbuf->in_ts_sec;
-		daggr_mbuf->in_ts_usec = pmbuf->in_ts_usec;
-		daggr_mbuf->extra_ts_sec = pmbuf->extra_ts_sec;
-		daggr_mbuf->extra_ts_usec = pmbuf->extra_ts_usec;
-		daggr_mbuf->pparent = pmbuf;
-		daggr_mbuf->priority = pmbuf->priority;
-		if (pmadapter->tp_state_on)
-			pmadapter->callbacks.moal_get_system_time(
-				pmadapter->pmoal_handle, &in_copy_ts_sec,
-				&in_copy_ts_usec);
-		memcpy_ext(pmadapter,
-			   daggr_mbuf->pbuf + daggr_mbuf->data_offset, data,
-			   pkt_len, daggr_mbuf->data_len);
-		if (pmadapter->tp_state_on) {
-			pmadapter->callbacks.moal_get_system_time(
-				pmadapter->pmoal_handle, &out_copy_ts_sec,
-				&out_copy_ts_usec);
-			copy_delay +=
-				(t_s32)(out_copy_ts_sec - in_copy_ts_sec) *
-				1000000;
-			copy_delay +=
-				(t_s32)(out_copy_ts_usec - in_copy_ts_usec);
-		}
-#ifdef UAP_SUPPORT
-		if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
-			ret = wlan_uap_recv_packet(priv, daggr_mbuf);
-		} else {
-#endif /* UAP_SUPPORT */
-			/** send EAPOL from AMSDU pkt to firmware */
-			if (priv->sec_info.ewpa_enabled &&
-			    (!memcmp(pmadapter,
-				     daggr_mbuf->pbuf +
-					     daggr_mbuf->data_offset +
-					     MLAN_ETHER_PKT_TYPE_OFFSET,
-				     eapol_type, sizeof(eapol_type)))) {
-				ret = wlan_prepare_cmd(
-					priv, HostCmd_CMD_802_11_EAPOL_PKT, 0,
-					0, MNULL, daggr_mbuf);
-				if (ret == MLAN_STATUS_SUCCESS)
-					wlan_recv_event(
-						priv,
-						MLAN_EVENT_ID_DRV_DEFER_HANDLING,
-						MNULL);
-				wlan_free_mlan_buffer(pmadapter, daggr_mbuf);
-				data += pkt_len + pad;
-				continue;
-			}
-			/**process tdls packet*/
-			if (!memcmp(pmadapter,
-				    daggr_mbuf->pbuf + daggr_mbuf->data_offset +
-					    MLAN_ETHER_PKT_TYPE_OFFSET,
-				    tdls_action_type,
-				    sizeof(tdls_action_type))) {
-				PRINTM(MEVENT,
-				       "Recevie AMSDU TDLS action frame\n");
-				wlan_process_tdls_action_frame(
-					priv,
-					daggr_mbuf->pbuf +
-						daggr_mbuf->data_offset,
-					daggr_mbuf->data_len);
-			}
-
-			ret = pmadapter->callbacks.moal_recv_packet(
-				pmadapter->pmoal_handle, daggr_mbuf);
-#ifdef UAP_SUPPORT
-		}
-#endif /* UAP_SUPPORT */
-		switch (ret) {
-		case MLAN_STATUS_PENDING:
-			break;
-		case MLAN_STATUS_FAILURE:
-			PRINTM(MERROR, "Deaggr, send to moal failed\n");
-			daggr_mbuf->status_code = MLAN_ERROR_PKT_INVALID;
-			/* fall through */
-		case MLAN_STATUS_SUCCESS:
-			wlan_recv_packet_complete(pmadapter, daggr_mbuf, ret);
-			break;
-		default:
-			break;
-		}
-
-		data += pkt_len + pad;
-	}
-	if (pmadapter->tp_state_on) {
-		pmadapter->callbacks.moal_get_system_time(
-			pmadapter->pmoal_handle, &out_ts_sec, &out_ts_usec);
-		delay += (t_s32)(out_ts_sec - in_ts_sec) * 1000000;
-		delay += (t_s32)(out_ts_usec - in_ts_usec);
-		pmadapter->callbacks.moal_amsdu_tp_accounting(
-			pmadapter->pmoal_handle, delay, copy_delay);
-	}
-
-done:
-	priv->msdu_in_rx_amsdu_cnt += pmbuf->use_count;
-	priv->amsdu_rx_cnt++;
-	/** we should free the aggr buffer after deaggr */
-	pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief Aggregate multiple packets into one single AMSDU packet
- *
- *  @param priv     A pointer to mlan_private structure
- *  @param pra_list Pointer to the RA List table containing the pointers
- *                  to packets.
- *  @param headroom Any interface specific headroom that may be need. TxPD
- *                  will be formed leaving this headroom.
- *  @param ptrindex Pointer index
- *
- *  @return     Final packet size or MLAN_STATUS_FAILURE
- */
-int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
-			   int headroom, int ptrindex)
-{
-	int pkt_size = 0;
-	pmlan_adapter pmadapter = priv->adapter;
-	mlan_buffer *pmbuf_aggr, *pmbuf_src;
-	t_u8 *data;
-	int pad = 0;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-#ifdef DEBUG_LEVEL1
-	t_u32 sec = 0, usec = 0;
-#endif
-	mlan_tx_param tx_param;
-#ifdef STA_SUPPORT
-	TxPD *ptx_pd = MNULL;
-#endif
-	t_u32 max_amsdu_size = MIN(pra_list->max_amsdu, pmadapter->tx_buf_size);
-	t_u32 msdu_in_tx_amsdu_cnt = 0;
-	ENTER();
-
-	PRINTM(MDAT_D, "Handling Aggr packet\n");
-
-	pmbuf_src = (pmlan_buffer)util_peek_list(
-		pmadapter->pmoal_handle, &pra_list->buf_head, MNULL, MNULL);
-	if (pmbuf_src) {
-		pmbuf_aggr = wlan_alloc_mlan_buffer(
-			pmadapter, pmadapter->tx_buf_size, 0,
-			MOAL_MALLOC_BUFFER | MOAL_MEM_FLAG_ATOMIC);
-		if (!pmbuf_aggr) {
-			PRINTM(MERROR, "Error allocating mlan_buffer\n");
-			pmadapter->callbacks.moal_spin_unlock(
-				pmadapter->pmoal_handle,
-				priv->wmm.ra_list_spinlock);
-			LEAVE();
-			return MLAN_STATUS_FAILURE;
-		}
-
-		data = pmbuf_aggr->pbuf + headroom;
-		pmbuf_aggr->bss_index = pmbuf_src->bss_index;
-		pmbuf_aggr->buf_type = pmbuf_src->buf_type;
-		pmbuf_aggr->priority = pmbuf_src->priority;
-		pmbuf_aggr->pbuf = data;
-		pmbuf_aggr->data_offset = 0;
-		pmbuf_aggr->in_ts_sec = pmbuf_src->in_ts_sec;
-		pmbuf_aggr->in_ts_usec = pmbuf_src->in_ts_usec;
-		if (pmbuf_src->flags & MLAN_BUF_FLAG_TDLS)
-			pmbuf_aggr->flags |= MLAN_BUF_FLAG_TDLS;
-		if (pmbuf_src->flags & MLAN_BUF_FLAG_TCP_ACK)
-			pmbuf_aggr->flags |= MLAN_BUF_FLAG_TCP_ACK;
-
-		/* Form AMSDU */
-		wlan_11n_form_amsdu_txpd(priv, pmbuf_aggr);
-		pkt_size = sizeof(TxPD);
-#ifdef STA_SUPPORT
-		if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA)
-			ptx_pd = (TxPD *)pmbuf_aggr->pbuf;
-#endif
-		priv->msdu_in_tx_amsdu_cnt++;
-	} else {
-		pmadapter->callbacks.moal_spin_unlock(
-			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
-		goto exit;
-	}
-
-	while (pmbuf_src && ((pkt_size + (pmbuf_src->data_len + LLC_SNAP_LEN) +
-			      headroom) <= max_amsdu_size)) {
-		pmbuf_src =
-			(pmlan_buffer)util_dequeue_list(pmadapter->pmoal_handle,
-							&pra_list->buf_head,
-							MNULL, MNULL);
-		/* Collects TP statistics */
-		if (pmadapter->tp_state_on && (pkt_size > sizeof(TxPD)))
-			pmadapter->callbacks.moal_tp_accounting(
-				pmadapter->pmoal_handle, pmbuf_src->pdesc, 3);
-		pra_list->total_pkts--;
-
-		/* decrement for every PDU taken from the list */
-		priv->wmm.pkts_queued[ptrindex]--;
-		util_scalar_decrement(pmadapter->pmoal_handle,
-				      &priv->wmm.tx_pkts_queued, MNULL, MNULL);
-
-		pmadapter->callbacks.moal_spin_unlock(
-			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
-
-		if (pmbuf_src) {
-			pkt_size += wlan_11n_form_amsdu_pkt(
-				pmadapter, (data + pkt_size),
-				pmbuf_src->pbuf + pmbuf_src->data_offset,
-				pmbuf_src->data_len, &pad);
-
-			DBG_HEXDUMP(MDAT_D, "pmbuf_src", pmbuf_src,
-				    sizeof(mlan_buffer));
-			wlan_write_data_complete(pmadapter, pmbuf_src,
-						 MLAN_STATUS_SUCCESS);
-		}
-
-		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
-						    priv->wmm.ra_list_spinlock);
-
-		if (!wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
-			pmadapter->callbacks.moal_spin_unlock(
-				pmadapter->pmoal_handle,
-				priv->wmm.ra_list_spinlock);
-			LEAVE();
-			return MLAN_STATUS_FAILURE;
-		}
-
-		pmbuf_src =
-			(pmlan_buffer)util_peek_list(pmadapter->pmoal_handle,
-						     &pra_list->buf_head, MNULL,
-						     MNULL);
-		priv->msdu_in_tx_amsdu_cnt++;
-		msdu_in_tx_amsdu_cnt++;
-	}
-
-	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
-					      priv->wmm.ra_list_spinlock);
-
-	/* Last AMSDU packet does not need padding */
-	pkt_size -= pad;
-	pmbuf_aggr->data_len = pkt_size;
-	wlan_11n_update_pktlen_amsdu_txpd(priv, pmbuf_aggr);
-	pmbuf_aggr->data_len += headroom;
-	pmbuf_aggr->pbuf = data - headroom;
-	tx_param.next_pkt_len =
-		((pmbuf_src) ? pmbuf_src->data_len + sizeof(TxPD) : 0);
-	/* Collects TP statistics */
-	if (pmadapter->tp_state_on) {
-		pmadapter->callbacks.moal_tp_accounting(pmadapter->pmoal_handle,
-							pmbuf_aggr, 4);
-		pmadapter->callbacks.moal_tp_accounting_rx_param(
-			pmadapter->pmoal_handle, 5, msdu_in_tx_amsdu_cnt);
-	}
-
-	/* Drop Tx packets at drop point 4 */
-	if (pmadapter->tp_state_drop_point == 4) {
-		wlan_write_data_complete(pmadapter, pmbuf_aggr, ret);
-		goto exit;
-	} else
-		ret = pmadapter->ops.host_to_card(priv, MLAN_TYPE_DATA,
-						  pmbuf_aggr, &tx_param);
-	switch (ret) {
-#ifdef USB
-	case MLAN_STATUS_PRESOURCE:
-		PRINTM(MINFO, "MLAN_STATUS_PRESOURCE is returned\n");
-		break;
-#endif
-	case MLAN_STATUS_RESOURCE:
-		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
-						    priv->wmm.ra_list_spinlock);
-
-		if (!wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
-			pmadapter->callbacks.moal_spin_unlock(
-				pmadapter->pmoal_handle,
-				priv->wmm.ra_list_spinlock);
-			pmbuf_aggr->status_code = MLAN_ERROR_PKT_INVALID;
-			wlan_write_data_complete(pmadapter, pmbuf_aggr,
-						 MLAN_STATUS_FAILURE);
-			LEAVE();
-			return MLAN_STATUS_FAILURE;
-		}
-#ifdef STA_SUPPORT
-		/* reset tx_lock_flag */
-		if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) &&
-		    pmadapter->pps_uapsd_mode &&
-		    (pmadapter->tx_lock_flag == MTRUE)) {
-			pmadapter->tx_lock_flag = MFALSE;
-			if (ptx_pd != MNULL)
-				ptx_pd->flags = 0;
-		}
-#endif
-		util_enqueue_list_head(pmadapter->pmoal_handle,
-				       &pra_list->buf_head,
-				       (pmlan_linked_list)pmbuf_aggr, MNULL,
-				       MNULL);
-
-		pra_list->total_pkts++;
-
-		/* add back only one: aggregated packet is requeued as one */
-		priv->wmm.pkts_queued[ptrindex]++;
-		util_scalar_increment(pmadapter->pmoal_handle,
-				      &priv->wmm.tx_pkts_queued, MNULL, MNULL);
-		pmbuf_aggr->flags |= MLAN_BUF_FLAG_REQUEUED_PKT;
-		pmadapter->callbacks.moal_spin_unlock(
-			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
-		PRINTM(MINFO, "MLAN_STATUS_RESOURCE is returned\n");
-		pmbuf_aggr->status_code = MLAN_ERROR_PKT_INVALID;
-		break;
-	case MLAN_STATUS_FAILURE:
-		pmbuf_aggr->status_code = MLAN_ERROR_DATA_TX_FAIL;
-		pmadapter->dbg.num_tx_host_to_card_failure++;
-		wlan_write_data_complete(pmadapter, pmbuf_aggr, ret);
-		goto exit;
-	case MLAN_STATUS_PENDING:
-		break;
-	case MLAN_STATUS_SUCCESS:
-		wlan_write_data_complete(pmadapter, pmbuf_aggr, ret);
-		break;
-	default:
-		break;
-	}
-	if (ret != MLAN_STATUS_RESOURCE) {
-		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
-						    priv->wmm.ra_list_spinlock);
-		if (wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
-			priv->wmm.packets_out[ptrindex]++;
-			priv->wmm.tid_tbl_ptr[ptrindex].ra_list_curr = pra_list;
-		}
-		pmadapter->bssprio_tbl[priv->bss_priority].bssprio_cur =
-			pmadapter->bssprio_tbl[priv->bss_priority]
-				.bssprio_cur->pnext;
-		pmadapter->callbacks.moal_spin_unlock(
-			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
-	}
-	PRINTM_GET_SYS_TIME(MDATA, &sec, &usec);
-	PRINTM_NETINTF(MDATA, priv);
-	PRINTM(MDATA, "%lu.%06lu : Data => FW\n", sec, usec);
-	priv->amsdu_tx_cnt++;
-
-exit:
-	LEAVE();
-	return pkt_size + headroom;
-}
diff --git a/wlan_sd8987/mlan/mlan_11n_aggr.h b/wlan_sd8987/mlan/mlan_11n_aggr.h
deleted file mode 100755
index 922d4a8..0000000
--- a/wlan_sd8987/mlan/mlan_11n_aggr.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/** @file mlan_11n_aggr.h
- *
- *  @brief This file contains related macros, enum, and struct
- *  of 11n aggregation functionalities
- *
- *
- *  Copyright 2008-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/********************************************************
-Change log:
-    11/10/2008: initial version
-********************************************************/
-
-#ifndef _MLAN_11N_AGGR_H_
-#define _MLAN_11N_AGGR_H_
-
-/** Aggregate 11N packets */
-mlan_status wlan_11n_deaggregate_pkt(pmlan_private priv, pmlan_buffer pmbuf);
-/** Deaggregate 11N packets */
-int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *ptr, int headroom,
-			   int ptrindex);
-
-#endif /* !_MLAN_11N_AGGR_H_ */
diff --git a/wlan_sd8987/mlan/mlan_join.h b/wlan_sd8987/mlan/mlan_join.h
deleted file mode 100755
index 5a90761..0000000
--- a/wlan_sd8987/mlan/mlan_join.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/** @file mlan_join.h
- *
- *  @brief This file defines the interface for the WLAN infrastructure
- *  and adhoc join routines.
- *
- *  Driver interface functions and type declarations for the join module
- *  implemented in mlan_join.c.  Process all start/join requests for
- *  both adhoc and infrastructure networks
- *
- *
- *  Copyright 2008-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/******************************************************
-Change log:
-    10/13/2008: initial version
-******************************************************/
-
-#ifndef _MLAN_JOIN_H_
-#define _MLAN_JOIN_H_
-
-/** Size of buffer allocated to store the association response from firmware */
-#define MRVDRV_ASSOC_RSP_BUF_SIZE 500
-
-/** Size of buffer allocated to store IEs passed to firmware in the assoc req */
-#define MRVDRV_GENIE_BUF_SIZE 256
-
-#endif /* _MLAN_JOIN_H_ */
diff --git a/wlan_sd8987/mlan/mlan_meas.h b/wlan_sd8987/mlan/mlan_meas.h
deleted file mode 100755
index 2106391..0000000
--- a/wlan_sd8987/mlan/mlan_meas.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- *  @file mlan_meas.h
- *
- *  @brief Interface for the measurement module implemented in mlan_meas.c
- *
- *  Driver interface functions and type declarations for the measurement module
- *    implemented in mlan_meas.c
- *
- *  @sa mlan_meas.c
- *
- *
- *  Copyright 2008-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/*************************************************************
-Change Log:
-    03/25/2009: initial version
-************************************************************/
-
-#ifndef _MLAN_MEAS_H_
-#define _MLAN_MEAS_H_
-
-#include "mlan_fw.h"
-
-/* Send a given measurement request to the firmware, report back the result */
-extern int wlan_meas_util_send_req(pmlan_private pmpriv,
-				   pHostCmd_DS_MEASUREMENT_REQUEST pmeas_req,
-				   t_u32 wait_for_resp_timeout,
-				   pmlan_ioctl_req pioctl_req,
-				   pHostCmd_DS_MEASUREMENT_REPORT pmeas_rpt);
-
-/* Setup a measurement command before it is sent to the firmware */
-extern int wlan_meas_cmd_process(mlan_private *pmpriv,
-				 HostCmd_DS_COMMAND *pcmd_ptr,
-				 const t_void *pinfo_buf);
-
-/* Handle a given measurement command response from the firmware */
-extern int wlan_meas_cmdresp_process(mlan_private *pmpriv,
-				     const HostCmd_DS_COMMAND *resp);
-
-#endif /* _MLAN_MEAS_H_ */
diff --git a/wlan_sd8987/mlan/mlan_module.c b/wlan_sd8987/mlan/mlan_module.c
deleted file mode 100755
index 2281d45..0000000
--- a/wlan_sd8987/mlan/mlan_module.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/** @file mlan_module.c
- *
- *  @brief This file declares the exported symbols from MLAN.
- *
- *
- *  Copyright 2008-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/******************************************************
-Change log:
-    12/08/2008: initial version
-******************************************************/
-
-#ifdef LINUX
-#include <linux/module.h>
-#include "mlan_decl.h"
-#include "mlan_ioctl.h"
-
-EXPORT_SYMBOL(mlan_register);
-EXPORT_SYMBOL(mlan_unregister);
-EXPORT_SYMBOL(mlan_init_fw);
-EXPORT_SYMBOL(mlan_set_init_param);
-EXPORT_SYMBOL(mlan_dnld_fw);
-EXPORT_SYMBOL(mlan_shutdown_fw);
-#ifdef USB
-EXPORT_SYMBOL(mlan_write_data_async_complete);
-EXPORT_SYMBOL(mlan_recv);
-#endif
-EXPORT_SYMBOL(mlan_send_packet);
-EXPORT_SYMBOL(mlan_ioctl);
-EXPORT_SYMBOL(mlan_main_process);
-EXPORT_SYMBOL(mlan_rx_process);
-EXPORT_SYMBOL(mlan_select_wmm_queue);
-EXPORT_SYMBOL(mlan_process_deaggr_pkt);
-#if defined(SDIO) || defined(PCIE)
-EXPORT_SYMBOL(mlan_interrupt);
-#if defined(SYSKT)
-EXPORT_SYMBOL(mlan_hs_callback);
-#endif /* SYSKT_MULTI || SYSKT */
-#endif /* SDIO || PCIE */
-
-EXPORT_SYMBOL(mlan_pm_wakeup_card);
-EXPORT_SYMBOL(mlan_is_main_process_running);
-#ifdef PCIE
-EXPORT_SYMBOL(mlan_set_int_mode);
-#endif
-EXPORT_SYMBOL(mlan_disable_host_int);
-EXPORT_SYMBOL(mlan_enable_host_int);
-
-MODULE_DESCRIPTION("M-WLAN MLAN Driver");
-MODULE_AUTHOR("NXP");
-MODULE_VERSION(MLAN_RELEASE_VERSION);
-MODULE_LICENSE("GPL");
-#endif /* LINUX */
diff --git a/wlan_sd8987/mlan/mlan_uap.h b/wlan_sd8987/mlan/mlan_uap.h
deleted file mode 100755
index 2425ebc..0000000
--- a/wlan_sd8987/mlan/mlan_uap.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/** @file mlan_uap.h
- *
- *  @brief This file contains related macros, enum, and struct
- *  of uap functionalities
- *
- *
- *  Copyright 2009-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/********************************************************
-Change log:
-    02/05/2009: initial version
-********************************************************/
-
-#ifndef _MLAN_UAP_H_
-#define _MLAN_UAP_H_
-
-mlan_status wlan_uap_get_channel(pmlan_private pmpriv);
-
-mlan_status wlan_uap_set_channel(pmlan_private pmpriv,
-				 Band_Config_t uap_band_cfg, t_u8 channel);
-
-mlan_status wlan_uap_get_beacon_dtim(pmlan_private pmpriv);
-
-mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req);
-
-mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
-				     t_u16 cmd_action, t_u32 cmd_oid,
-				     t_void *pioctl_buf, t_void *pdata_buf,
-				     t_void *pcmd_buf);
-
-mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
-					 t_void *pcmd_buf, t_void *pioctl);
-
-mlan_status wlan_ops_uap_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf);
-
-mlan_status wlan_ops_uap_process_event(t_void *priv);
-
-t_void *wlan_ops_uap_process_txpd(t_void *priv, pmlan_buffer pmbuf);
-
-mlan_status wlan_ops_uap_init_cmd(t_void *priv, t_u8 first_bss);
-
-#endif /* _MLAN_UAP_H_ */
diff --git a/wlan_sd8987/mlinux/mlan.h b/wlan_sd8987/mlinux/mlan.h
deleted file mode 100755
index 4d48ce8..0000000
--- a/wlan_sd8987/mlinux/mlan.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/** @file mlan.h
- *
- *  @brief This file declares all APIs that will be called from MOAL module.
- *  It also defines the data structures used for APIs between MLAN and MOAL.
- *
- *
- *  Copyright 2008-2021 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/******************************************************
-Change log:
-    10/13/2008: initial version
-    11/07/2008: split mlan.h into mlan_decl.h & mlan_ioctl.h
-******************************************************/
-
-#ifndef _MLAN_H_
-#define _MLAN_H_
-
-#include "mlan_decl.h"
-#include "mlan_ioctl.h"
-#include "mlan_ieee.h"
-
-#endif /* !_MLAN_H_ */
diff --git a/wlan_sd8987/mlinux/mlan_decl.h b/wlan_sd8987/mlinux/mlan_decl.h
deleted file mode 100755
index 3f43ae7..0000000
--- a/wlan_sd8987/mlinux/mlan_decl.h
+++ /dev/null
@@ -1,2442 +0,0 @@
-/** @file mlan_decl.h
- *
- *  @brief This file declares the generic data structures and APIs.
- *
- *
- *  Copyright 2008-2022 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-#ifndef _MLAN_DECL_H_
-#define _MLAN_DECL_H_
-
-/** MLAN release version */
-#define MLAN_RELEASE_VERSION "368.p3"
-
-/** Re-define generic data types for MLAN/MOAL */
-/** Signed char (1-byte) */
-typedef signed char t_s8, *t_ps8;
-/** Unsigned char (1-byte) */
-typedef unsigned char t_u8, *t_pu8;
-/** Signed short (2-bytes) */
-typedef short t_s16, *t_ps16;
-/** Unsigned short (2-bytes) */
-typedef unsigned short t_u16, *t_pu16;
-/** Signed long (4-bytes) */
-typedef int t_s32, *t_ps32;
-/** Unsigned long (4-bytes) */
-typedef unsigned int t_u32, *t_pu32;
-/** Signed long long 8-bytes) */
-typedef long long t_s64, *t_ps64;
-/** Unsigned long long 8-bytes) */
-typedef unsigned long long t_u64, *t_pu64;
-/** Void pointer (4-bytes) */
-typedef void t_void, *t_pvoid;
-/** Size type */
-typedef t_u32 t_size;
-/** Boolean type */
-typedef t_u8 t_bool;
-
-#ifdef MLAN_64BIT
-/** Pointer type (64-bit) */
-typedef t_u64 t_ptr;
-/** Signed value (64-bit) */
-typedef t_s64 t_sval;
-#else
-/** Pointer type (32-bit) */
-typedef t_u32 t_ptr;
-/** Signed value (32-bit) */
-typedef t_s32 t_sval;
-#endif
-
-/** Constants below */
-
-#ifdef __GNUC__
-/** Structure packing begins */
-#define MLAN_PACK_START
-/** Structure packeing end */
-#define MLAN_PACK_END __attribute__((packed))
-#else /* !__GNUC__ */
-#ifdef PRAGMA_PACK
-/** Structure packing begins */
-#define MLAN_PACK_START
-/** Structure packeing end */
-#define MLAN_PACK_END
-#else /* !PRAGMA_PACK */
-/** Structure packing begins */
-#define MLAN_PACK_START __packed
-/** Structure packing end */
-#define MLAN_PACK_END
-#endif /* PRAGMA_PACK */
-#endif /* __GNUC__ */
-
-#ifndef INLINE
-#ifdef __GNUC__
-/** inline directive */
-#define INLINE inline
-#else
-/** inline directive */
-#define INLINE __inline
-#endif
-#endif
-
-/** MLAN TRUE */
-#define MTRUE (1)
-/** MLAN FALSE */
-#define MFALSE (0)
-
-#define CHANNEL_SPEC_SNIFFER_MODE 1
-
-#ifndef MACSTR
-/** MAC address security format */
-#define MACSTR "%02x:XX:XX:XX:%02x:%02x"
-#endif
-
-#ifndef MAC2STR
-/** MAC address security print arguments */
-#define MAC2STR(a) (a)[0], (a)[4], (a)[5]
-#endif
-
-#ifndef FULL_MACSTR
-#define FULL_MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
-#endif
-#ifndef FULL_MAC2STR
-#define FULL_MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
-#endif
-
-/** Macros for Data Alignment : size */
-#define ALIGN_SZ(p, a) (((p) + ((a)-1)) & ~((a)-1))
-
-/** Macros for Data Alignment : address */
-#define ALIGN_ADDR(p, a)                                                       \
-	((((t_ptr)(p)) + (((t_ptr)(a)) - 1)) & ~(((t_ptr)(a)) - 1))
-
-/** Return the byte offset of a field in the given structure */
-#define MLAN_FIELD_OFFSET(type, field) ((t_u32)(t_ptr) & (((type *)0)->field))
-/** Return aligned offset */
-#define OFFSET_ALIGN_ADDR(p, a) (t_u32)(ALIGN_ADDR(p, a) - (t_ptr)p)
-
-/** Maximum BSS numbers */
-#define MLAN_MAX_BSS_NUM (16)
-
-/** NET IP alignment */
-#define MLAN_NET_IP_ALIGN 2
-
-/** US country code */
-#define COUNTRY_CODE_US 0x10
-
-/** DMA alignment */
-/* SDIO3.0 Inrevium Adapter require 32 bit DMA alignment */
-#define DMA_ALIGNMENT 32
-
-/** max size of TxPD */
-#define MAX_TXPD_SIZE 32
-
-/** Minimum data header length */
-#define MLAN_MIN_DATA_HEADER_LEN (DMA_ALIGNMENT + MAX_TXPD_SIZE)
-
-/** rx data header length */
-#define MLAN_RX_HEADER_LEN MLAN_MIN_DATA_HEADER_LEN
-
-/** This is current limit on Maximum Tx AMPDU allowed */
-#define MLAN_MAX_TX_BASTREAM_SUPPORTED 16
-#define MLAN_MAX_TX_BASTREAM_DEFAULT 2
-/** This is current limit on Maximum Rx AMPDU allowed */
-#define MLAN_MAX_RX_BASTREAM_SUPPORTED 16
-
-#ifdef STA_SUPPORT
-/** Default Win size attached during ADDBA request */
-#define MLAN_STA_AMPDU_DEF_TXWINSIZE 64
-/** Default Win size attached during ADDBA response */
-#define MLAN_STA_AMPDU_DEF_RXWINSIZE 64
-/** RX winsize for COEX */
-#define MLAN_STA_COEX_AMPDU_DEF_RXWINSIZE 16
-#endif /* STA_SUPPORT */
-#ifdef UAP_SUPPORT
-/** Default Win size attached during ADDBA request */
-#define MLAN_UAP_AMPDU_DEF_TXWINSIZE 64
-/** Default Win size attached during ADDBA response */
-#define MLAN_UAP_AMPDU_DEF_RXWINSIZE 64
-/** RX winsize for COEX */
-#define MLAN_UAP_COEX_AMPDU_DEF_RXWINSIZE 16
-#endif /* UAP_SUPPORT */
-
-#ifdef WIFI_DIRECT_SUPPORT
-/** WFD use the same window size for tx/rx */
-#define MLAN_WFD_AMPDU_DEF_TXRXWINSIZE 64
-/** RX winsize for COEX */
-#define MLAN_WFD_COEX_AMPDU_DEF_RXWINSIZE 16
-#endif
-
-/** Block ack timeout value */
-#define MLAN_DEFAULT_BLOCK_ACK_TIMEOUT 0xffff
-/** Maximum Tx Win size configured for ADDBA request [10 bits] */
-#define MLAN_AMPDU_MAX_TXWINSIZE 0x3ff
-/** Maximum Rx Win size configured for ADDBA request [10 bits] */
-#define MLAN_AMPDU_MAX_RXWINSIZE 0x3ff
-
-/** Rate index for HR/DSSS 0 */
-#define MLAN_RATE_INDEX_HRDSSS0 0
-/** Rate index for HR/DSSS 3 */
-#define MLAN_RATE_INDEX_HRDSSS3 3
-/** Rate index for OFDM 0 */
-#define MLAN_RATE_INDEX_OFDM0 4
-/** Rate index for OFDM 7 */
-#define MLAN_RATE_INDEX_OFDM7 11
-/** Rate index for MCS 0 */
-#define MLAN_RATE_INDEX_MCS0 0
-/** Rate index for MCS 2 */
-#define MLAN_RATE_INDEX_MCS2 2
-/** Rate index for MCS 4 */
-#define MLAN_RATE_INDEX_MCS4 4
-/** Rate index for MCS 7 */
-#define MLAN_RATE_INDEX_MCS7 7
-/** Rate index for MCS 9 */
-#define MLAN_RATE_INDEX_MCS9 9
-/** Rate index for MCS11 */
-#define MLAN_RATE_INDEX_MCS11 11
-/** Rate index for MCS15 */
-#define MLAN_RATE_INDEX_MCS15 15
-/** Rate index for MCS 32 */
-#define MLAN_RATE_INDEX_MCS32 32
-/** Rate index for MCS 127 */
-#define MLAN_RATE_INDEX_MCS127 127
-#define MLAN_RATE_NSS1 1
-#define MLAN_RATE_NSS2 2
-
-/** Rate bitmap for OFDM 0 */
-#define MLAN_RATE_BITMAP_OFDM0 16
-/** Rate bitmap for OFDM 7 */
-#define MLAN_RATE_BITMAP_OFDM7 23
-/** Rate bitmap for MCS 0 */
-#define MLAN_RATE_BITMAP_MCS0 32
-/** Rate bitmap for MCS 127 */
-#define MLAN_RATE_BITMAP_MCS127 159
-#define MLAN_RATE_BITMAP_NSS1_MCS0 160
-#define MLAN_RATE_BITMAP_NSS1_MCS9 169
-#define MLAN_RATE_BITMAP_NSS2_MCS0 176
-#define MLAN_RATE_BITMAP_NSS2_MCS9 185
-
-/** MU beamformer */
-#define DEFALUT_11AC_CAP_BEAMFORMING_RESET_MASK (MBIT(19))
-
-/** Size of rx data buffer 3839+256 */
-#define MLAN_RX_DATA_BUF_SIZE 4096
-
-/** Size of command buffer */
-/** because cal_data_size 2.4 k */
-#define MRVDRV_SIZE_OF_CMD_BUFFER (3 * 1024)
-/** Size of rx command buffer */
-#define MLAN_RX_CMD_BUF_SIZE MRVDRV_SIZE_OF_CMD_BUFFER
-/** Upload size */
-#define WLAN_UPLD_SIZE MRVDRV_SIZE_OF_CMD_BUFFER
-
-#if defined(PCIE)
-#define MLAN_SSU_MAX_PKT_SIZE (283 * 4)
-#define MLAN_SSU_HEADER_SIZE 256
-/**
- * Size of DMA buffer to collect 10ms SSU data:
- * 2500 spectral packets, plus header
- */
-#define MLAN_SSU_BUF_SIZE_1MS (MLAN_SSU_MAX_PKT_SIZE * 250)
-#define MLAN_SSU_BUF_SIZE (MLAN_SSU_HEADER_SIZE + MLAN_SSU_BUF_SIZE_1MS * 10)
-#define MLAN_SSU_BUF_SIZE_HOST (MLAN_SSU_BUF_SIZE)
-#endif
-
-/** driver initial the fw reset */
-#define FW_RELOAD_SDIO_INBAND_RESET 1
-/** out band reset trigger reset, no interface re-emulation */
-#define FW_RELOAD_NO_EMULATION 2
-/** out band reset with interface re-emulation */
-#define FW_RELOAD_WITH_EMULATION 3
-#ifdef PCIE
-/** pcie card reset */
-#define FW_RELOAD_PCIE_RESET 4
-#endif
-#define FW_RELOAD_SDIO_HW_RESET 5
-
-#ifdef USB
-#define MLAN_USB_BLOCK_SIZE (512)
-#define MLAN_USB_AGGR_MODE_NUM (0)
-#define MLAN_USB_AGGR_MODE_LEN (1)
-#define MLAN_USB_AGGR_MODE_LEN_V2 (2)
-#define MLAN_USB_TX_AGGR_MAX_LEN (16000)
-#define MLAN_USB_TX_AGGR_MAX_NUM 10
-#define MLAN_USB_TX_AGGR_V2_ALIGN 4
-#define MLAN_USB_TX_AGGR_HEADER 4
-#define MLAN_USB_MAX_PKT_SIZE (MLAN_USB_BLOCK_SIZE * 4)
-
-#define MLAN_USB_RX_ALIGN_SIZE MLAN_USB_BLOCK_SIZE
-#define MLAN_USB_RX_MAX_AGGR_NUM (8)
-#define MLAN_USB_RX_DEAGGR_TIMEOUT_USEC (200)
-
-#define MLAN_USB_TX_AGGR_ALIGN (MLAN_USB_BLOCK_SIZE * 4)
-#define MLAN_USB_TX_MAX_AGGR_NUM (8)
-#define MLAN_USB_TX_MAX_AGGR_SIZE                                              \
-	(MLAN_USB_BLOCK_SIZE * 4 * MLAN_USB_TX_MAX_AGGR_NUM)
-#define MLAN_USB_TX_MIN_AGGR_TIMEOUT (1)
-#define MLAN_USB_TX_MAX_AGGR_TIMEOUT (4)
-#define MLAN_USB_TX_AGGR_TIMEOUT_MSEC MLAN_USB_TX_MIN_AGGR_TIMEOUT
-#define MLAN_USB_TX_AGGR_TIMEOUT_DYN (0xFFFF)
-#endif /*USB*/
-
-/** MLAN MAC Address Length */
-#define MLAN_MAC_ADDR_LENGTH (6)
-/** MLAN 802.11 MAC Address */
-typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
-
-/** MLAN Maximum SSID Length */
-#define MLAN_MAX_SSID_LENGTH (32)
-
-/** RTS/FRAG related defines */
-/** Minimum RTS value */
-#define MLAN_RTS_MIN_VALUE (0)
-/** Maximum RTS value */
-#define MLAN_RTS_MAX_VALUE (2347)
-/** Minimum FRAG value */
-#define MLAN_FRAG_MIN_VALUE (256)
-/** Maximum FRAG value */
-#define MLAN_FRAG_MAX_VALUE (2346)
-
-/** Minimum tx retry count */
-#define MLAN_TX_RETRY_MIN (0)
-/** Maximum tx retry count */
-#define MLAN_TX_RETRY_MAX (14)
-
-/** max Wmm AC queues */
-#define MAX_AC_QUEUES 4
-
-#ifdef SDIO
-/** define SDIO block size for data Tx/Rx */
-/* We support up to 480-byte block size due to FW buffer limitation. */
-#define MLAN_SDIO_BLOCK_SIZE 256
-
-/** define SDIO block size for firmware download */
-#define MLAN_SDIO_BLOCK_SIZE_FW_DNLD MLAN_SDIO_BLOCK_SIZE
-
-/** define allocated buffer size */
-#define ALLOC_BUF_SIZE MLAN_RX_DATA_BUF_SIZE
-/** SDIO MP aggr pkt limit */
-#define SDIO_MP_AGGR_DEF_PKT_LIMIT (16)
-/** SDIO MP aggr pkt limit 8 */
-#define SDIO_MP_AGGR_DEF_PKT_LIMIT_8 (8)
-/** max SDIO MP aggr pkt limit */
-#define SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX (16)
-
-/** SDIO IO Port mask */
-#define MLAN_SDIO_IO_PORT_MASK 0xfffff
-/** SDIO Block/Byte mode mask */
-#define MLAN_SDIO_BYTE_MODE_MASK 0x80000000
-#endif /* SDIO */
-
-/** SD Interface */
-#define INTF_SD MBIT(0)
-#define IS_SD(ct) (ct & (INTF_SD << 8))
-/** PCIE Interface */
-#define INTF_PCIE MBIT(1)
-#define IS_PCIE(ct) (ct & (INTF_PCIE << 8))
-/** USB Interface */
-#define INTF_USB MBIT(2)
-#define IS_USB(ct) (ct & (INTF_USB << 8))
-
-/** 8887 card type */
-#define CARD_TYPE_8887 0x01
-/** 8897 card type */
-#define CARD_TYPE_8897 0x02
-/** 8977 card type */
-#define CARD_TYPE_8977 0x03
-/** 8997 card type */
-#define CARD_TYPE_8997 0x04
-/** 8987 card type */
-#define CARD_TYPE_8987 0x05
-/** 9098 card type */
-#define CARD_TYPE_9098 0x06
-/** 9097 card type */
-#define CARD_TYPE_9097 0x07
-/** 8978 card type */
-#define CARD_TYPE_8978 0x08
-/** 9177 card type */
-#define CARD_TYPE_9177 0x09
-/** 8801 card type */
-#define CARD_TYPE_8801 0x0a
-/** OWL card type */
-#define CARD_TYPE_NW62X 0x0b
-
-/** 9098 A0 reverion num */
-#define CHIP_9098_REV_A0 1
-#define CHIP_9098_REV_A1 2
-/** 9097 CHIP REV */
-#define CHIP_9097_REV_B0 1
-
-#define INTF_MASK 0xff
-#define CARD_TYPE_MASK 0xff
-
-#ifdef SDIO
-/** SD8887 card type */
-#define CARD_TYPE_SD8887 (CARD_TYPE_8887 | (INTF_SD << 8))
-/** SD8897 card type */
-#define CARD_TYPE_SD8897 (CARD_TYPE_8897 | (INTF_SD << 8))
-/** SD8977 card type */
-#define CARD_TYPE_SD8977 (CARD_TYPE_8977 | (INTF_SD << 8))
-/** SD8978 card type */
-#define CARD_TYPE_SD8978 (CARD_TYPE_8978 | (INTF_SD << 8))
-/** SD8997 card type */
-#define CARD_TYPE_SD8997 (CARD_TYPE_8997 | (INTF_SD << 8))
-/** SD8987 card type */
-#define CARD_TYPE_SD8987 (CARD_TYPE_8987 | (INTF_SD << 8))
-/** SD9097 card type */
-#define CARD_TYPE_SD9097 (CARD_TYPE_9097 | (INTF_SD << 8))
-/** SD9098 card type */
-#define CARD_TYPE_SD9098 (CARD_TYPE_9098 | (INTF_SD << 8))
-/** SD9177 card type */
-#define CARD_TYPE_SD9177 (CARD_TYPE_9177 | (INTF_SD << 8))
-/** SD8801 card type */
-#define CARD_TYPE_SD8801 (CARD_TYPE_8801 | (INTF_SD << 8))
-/** SD_NW62X card type */
-#define CARD_TYPE_SDNW62X (CARD_TYPE_NW62X | (INTF_SD << 8))
-
-#define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
-#define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
-#define IS_SD8977(ct) (CARD_TYPE_SD8977 == (ct))
-#define IS_SD8978(ct) (CARD_TYPE_SD8978 == (ct))
-#define IS_SD8997(ct) (CARD_TYPE_SD8997 == (ct))
-#define IS_SD8987(ct) (CARD_TYPE_SD8987 == (ct))
-#define IS_SD9097(ct) (CARD_TYPE_SD9097 == (ct))
-#define IS_SD9098(ct) (CARD_TYPE_SD9098 == (ct))
-#define IS_SD9177(ct) (CARD_TYPE_SD9177 == (ct))
-#define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
-#define IS_SDNW62X(ct) (CARD_TYPE_SDNW62X == (ct))
-
-/** SD8887 Card */
-#define CARD_SD8887 "SD8887"
-/** SD8897 Card */
-#define CARD_SD8897 "SD8897"
-/** SD8977 Card */
-#define CARD_SD8977 "SD8977"
-/** SD8978 Card */
-#define CARD_SD8978 "SDIW416"
-/** SD8997 Card */
-#define CARD_SD8997 "SD8997"
-/** SD8987 Card */
-#define CARD_SD8987 "SD8987"
-/** SD9097 Card */
-#define CARD_SD9097 "SDIW620"
-/** SD9098 Card */
-#define CARD_SD9098 "SD9098"
-/** SD9177 Card */
-#define CARD_SD9177 "SDIW612"
-/** SD8801 Card */
-#define CARD_SD8801 "SD8801"
-/** SDNW62X Card */
-#define CARD_SDNW62X "SDNW62X"
-#endif
-
-#ifdef PCIE
-/** PCIE8897 card type */
-#define CARD_TYPE_PCIE8897 (CARD_TYPE_8897 | (INTF_PCIE << 8))
-/** PCIE8997 card type */
-#define CARD_TYPE_PCIE8997 (CARD_TYPE_8997 | (INTF_PCIE << 8))
-/** PCIE9097 card type */
-#define CARD_TYPE_PCIE9097 (CARD_TYPE_9097 | (INTF_PCIE << 8))
-/** PCIE9098 card type */
-#define CARD_TYPE_PCIE9098 (CARD_TYPE_9098 | (INTF_PCIE << 8))
-/** PCIENW62X card type */
-#define CARD_TYPE_PCIENW62X (CARD_TYPE_NW62X | (INTF_PCIE << 8))
-
-#define IS_PCIE8897(ct) (CARD_TYPE_PCIE8897 == (ct))
-#define IS_PCIE8997(ct) (CARD_TYPE_PCIE8997 == (ct))
-#define IS_PCIE9097(ct) (CARD_TYPE_PCIE9097 == (ct))
-#define IS_PCIE9098(ct) (CARD_TYPE_PCIE9098 == (ct))
-#define IS_PCIENW62X(ct) (CARD_TYPE_PCIENW62X == (ct))
-
-/** PCIE8897 Card */
-#define CARD_PCIE8897 "PCIE8897"
-/** PCIE8997 Card */
-#define CARD_PCIE8997 "PCIE8997"
-/** PCIE9097 Card */
-#define CARD_PCIE9097 "PCIEIW620"
-/** PCIE9000S Card */
-#define CARD_PCIE9000S "PCIE9000S"
-/** PCIE9098 Card */
-#define CARD_PCIE9098 "PCIE9098"
-/** PCIEAW690 Card */
-#define CARD_PCIEAW690 "PCIEAW690"
-/** PCIENW62X Card */
-#define CARD_PCIENW62X "PCIENW62X"
-/** PCIEIW629 Card */
-#define CARD_PCIEIW629 "PCIEIW629"
-#endif
-
-#ifdef USB
-/** USB8801 card type */
-#define CARD_TYPE_USB8801 (CARD_TYPE_8801 | (INTF_USB << 8))
-/** USB8897 card type */
-#define CARD_TYPE_USB8897 (CARD_TYPE_8897 | (INTF_USB << 8))
-/** USB8997 card type */
-#define CARD_TYPE_USB8997 (CARD_TYPE_8997 | (INTF_USB << 8))
-/** USB8978 card type */
-#define CARD_TYPE_USB8978 (CARD_TYPE_8978 | (INTF_USB << 8))
-/** USB9098 card type */
-#define CARD_TYPE_USB9098 (CARD_TYPE_9098 | (INTF_USB << 8))
-/** USB9097 card type */
-#define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
-/** USBNW62X card type */
-#define CARD_TYPE_USBNW62X (CARD_TYPE_NW62X | (INTF_USB << 8))
-
-#define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
-#define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
-#define IS_USB8997(ct) (CARD_TYPE_USB8997 == (ct))
-#define IS_USB8978(ct) (CARD_TYPE_USB8978 == (ct))
-#define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
-#define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
-#define IS_USBNW62X(ct) (CARD_TYPE_USBNW62X == (ct))
-
-/** USB8801 Card */
-#define CARD_USB8801 "USB8801"
-/** USB8897 Card */
-#define CARD_USB8897 "USB8897"
-/** USB8997 Card */
-#define CARD_USB8997 "USB8997"
-/** USB8978 Card */
-#define CARD_USB8978 "USBIW416"
-/** USB9098 Card */
-#define CARD_USB9098 "USB9098"
-/** USB9097 Card */
-#define CARD_USB9097 "USBIW620"
-/** USBNW62X Card */
-#define CARD_USBNW62X "USBNW62X"
-#endif
-
-#define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
-#define IS_CARD8887(ct) (CARD_TYPE_8887 == ((ct)&0xf))
-#define IS_CARD8897(ct) (CARD_TYPE_8897 == ((ct)&0xf))
-#define IS_CARD8977(ct) (CARD_TYPE_8977 == ((ct)&0xf))
-#define IS_CARD8997(ct) (CARD_TYPE_8997 == ((ct)&0xf))
-#define IS_CARD8987(ct) (CARD_TYPE_8987 == ((ct)&0xf))
-#define IS_CARD9098(ct) (CARD_TYPE_9098 == ((ct)&0xf))
-#define IS_CARD9097(ct) (CARD_TYPE_9097 == ((ct)&0xf))
-#define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
-#define IS_CARDNW62X(ct) (CARD_TYPE_NW62X == ((ct)&0xf))
-
-typedef struct _card_type_entry {
-	t_u16 card_type;
-	t_u16 func_id;
-	char *name;
-} card_type_entry;
-
-#if defined(SDIO) || defined(PCIE)
-/** Max retry number of IO write */
-#define MAX_WRITE_IOMEM_RETRY 2
-#endif /* SDIO || PCIE */
-
-#ifdef PCIE
-typedef enum {
-	PCIE_INT_MODE_LEGACY = 0,
-	PCIE_INT_MODE_MSI,
-	PCIE_INT_MODE_MSIX,
-	PCIE_INT_MODE_MAX,
-} PCIE_INT_MODE;
-#endif /* PCIE */
-
-/** IN parameter */
-#define IN
-/** OUT parameter */
-#define OUT
-
-/** BIT value */
-#define MBIT(x) (((t_u32)1) << (x))
-
-/** Buffer flag for requeued packet */
-#define MLAN_BUF_FLAG_REQUEUED_PKT MBIT(0)
-/** Buffer flag for transmit buf from moal */
-#define MLAN_BUF_FLAG_MOAL_TX_BUF MBIT(1)
-/** Buffer flag for malloc mlan_buffer */
-#define MLAN_BUF_FLAG_MALLOC_BUF MBIT(2)
-
-/** Buffer flag for bridge packet */
-#define MLAN_BUF_FLAG_BRIDGE_BUF MBIT(3)
-
-#ifdef USB
-/** Buffer flag for deaggregated rx packet */
-#define MLAN_BUF_FLAG_RX_DEAGGR MBIT(5)
-
-/** Buffer flag for sleep confirm resp packet */
-#define MLAN_BUF_FLAG_SLEEPCFM_RESP MBIT(6)
-
-/** Buffer flag for USB TX AGGR */
-#define MLAN_BUF_FLAG_USB_TX_AGGR MBIT(7)
-#endif
-
-/** Buffer flag for TDLS */
-#define MLAN_BUF_FLAG_TDLS MBIT(8)
-
-/** Buffer flag for TCP_ACK */
-#define MLAN_BUF_FLAG_TCP_ACK MBIT(9)
-
-/** Buffer flag for TX_STATUS */
-#define MLAN_BUF_FLAG_TX_STATUS MBIT(10)
-
-/** Buffer flag for NET_MONITOR */
-#define MLAN_BUF_FLAG_NET_MONITOR MBIT(11)
-
-/** Buffer flag for NULL data packet */
-#define MLAN_BUF_FLAG_NULL_PKT MBIT(12)
-/** Buffer flag for Diag pkt */
-#define MLAN_BUF_FLAG_DIAG_BUF MBIT(13)
-
-#define MLAN_BUF_FLAG_TX_CTRL MBIT(14)
-
-#define MLAN_BUF_FLAG_MC_AGGR_PKT MBIT(17)
-
-#ifdef DEBUG_LEVEL1
-/** Debug level bit definition */
-#define MMSG MBIT(0)
-#define MFATAL MBIT(1)
-#define MERROR MBIT(2)
-#define MDATA MBIT(3)
-#define MCMND MBIT(4)
-#define MEVENT MBIT(5)
-#define MINTR MBIT(6)
-#define MIOCTL MBIT(7)
-
-#define MREG_D MBIT(9)
-
-#define MMPA_D MBIT(15)
-#define MDAT_D MBIT(16)
-#define MCMD_D MBIT(17)
-#define MEVT_D MBIT(18)
-#define MFW_D MBIT(19)
-#define MIF_D MBIT(20)
-
-#define MENTRY MBIT(28)
-#define MWARN MBIT(29)
-#define MINFO MBIT(30)
-#define MHEX_DUMP MBIT(31)
-#endif /* DEBUG_LEVEL1 */
-
-/** Memory allocation type: DMA */
-#define MLAN_MEM_DMA MBIT(0)
-/** Memory allocation flag: ATOMIC */
-#define MLAN_MEM_FLAG_ATOMIC MBIT(1)
-
-/** Default memory allocation flag */
-#define MLAN_MEM_DEF 0
-
-/** mlan_status */
-typedef enum _mlan_status {
-	MLAN_STATUS_FAILURE = 0xffffffff,
-	MLAN_STATUS_SUCCESS = 0,
-	MLAN_STATUS_PENDING,
-	MLAN_STATUS_RESOURCE,
-#ifdef USB
-	/* Status pending and no resource */
-	MLAN_STATUS_PRESOURCE,
-#endif
-	MLAN_STATUS_COMPLETE,
-	MLAN_STATUS_FILE_ERR,
-} mlan_status;
-
-/** mlan_error_code */
-typedef enum _mlan_error_code {
-	/** No error */
-	MLAN_ERROR_NO_ERROR = 0,
-	/** Firmware/device errors below (MSB=0) */
-	MLAN_ERROR_FW_NOT_READY = 0x00000001,
-	MLAN_ERROR_FW_BUSY = 0x00000002,
-	MLAN_ERROR_FW_CMDRESP = 0x00000003,
-	MLAN_ERROR_DATA_TX_FAIL = 0x00000004,
-	MLAN_ERROR_DATA_RX_FAIL = 0x00000005,
-	/** Driver errors below (MSB=1) */
-	MLAN_ERROR_PKT_SIZE_INVALID = 0x80000001,
-	MLAN_ERROR_PKT_TIMEOUT = 0x80000002,
-	MLAN_ERROR_PKT_INVALID = 0x80000003,
-	MLAN_ERROR_CMD_INVALID = 0x80000004,
-	MLAN_ERROR_CMD_TIMEOUT = 0x80000005,
-	MLAN_ERROR_CMD_DNLD_FAIL = 0x80000006,
-	MLAN_ERROR_CMD_CANCEL = 0x80000007,
-	MLAN_ERROR_CMD_RESP_FAIL = 0x80000008,
-	MLAN_ERROR_CMD_ASSOC_FAIL = 0x80000009,
-	MLAN_ERROR_CMD_SCAN_FAIL = 0x8000000A,
-	MLAN_ERROR_IOCTL_INVALID = 0x8000000B,
-	MLAN_ERROR_IOCTL_FAIL = 0x8000000C,
-	MLAN_ERROR_EVENT_UNKNOWN = 0x8000000D,
-	MLAN_ERROR_INVALID_PARAMETER = 0x8000000E,
-	MLAN_ERROR_NO_MEM = 0x8000000F,
-	/** More to add */
-} mlan_error_code;
-
-/** mlan_buf_type */
-typedef enum _mlan_buf_type {
-	MLAN_BUF_TYPE_CMD = 1,
-	MLAN_BUF_TYPE_DATA,
-	MLAN_BUF_TYPE_EVENT,
-	MLAN_BUF_TYPE_RAW_DATA,
-#ifdef SDIO
-	MLAN_BUF_TYPE_SPA_DATA,
-#endif
-} mlan_buf_type;
-
-#define SCAN_STATE_SCAN_START MBIT(0)
-#define SCAN_STATE_EXT_SCAN MBIT(1)
-#define SCAN_STATE_EXT_SCAN_ENH MBIT(2)
-#define SCAN_STATE_EXT_SCAN_CANCEL MBIT(3)
-#define SCAN_STATE_EXT_SCAN_CMDRESP MBIT(4)
-#define SCAN_STATE_EXT_SCAN_ENH_CMDRESP MBIT(5)
-#define SCAN_STATE_EXT_SCAN_CANCEL_CMDRESP MBIT(6)
-#define SCAN_STATE_EXT_SCAN_RESULT MBIT(7)
-#define SCAN_STATE_LAST_EXT_SCAN_RESULT MBIT(8)
-#define SCAN_STATE_EXT_SCAN_STATUS MBIT(9)
-#define SCAN_STATE_SCAN_COMPLETE MBIT(10)
-
-#ifdef USB
-/** mlan_usb_ep */
-typedef enum _mlan_usb_ep {
-	MLAN_USB_EP_CTRL = 0,
-	MLAN_USB_EP_CMD_EVENT = 1,
-	MLAN_USB_EP_DATA = 2,
-	MLAN_USB_EP_DATA_CH2 = 3,
-	MLAN_USB_EP_CMD_EVENT_IF2 = 4,
-	MLAN_USB_EP_DATA_IF2 = 5,
-	MLAN_USB_EP_DATA_CH2_IF2 = 6,
-} mlan_usb_ep;
-
-/** Timeout in milliseconds for usb_bulk_msg function */
-#define MLAN_USB_BULK_MSG_TIMEOUT 100
-#endif /* USB */
-
-/** MLAN BSS type */
-typedef enum _mlan_bss_type {
-	MLAN_BSS_TYPE_STA = 0,
-	MLAN_BSS_TYPE_UAP = 1,
-#ifdef WIFI_DIRECT_SUPPORT
-	MLAN_BSS_TYPE_WIFIDIRECT = 2,
-#endif
-	MLAN_BSS_TYPE_DFS = 8,
-	MLAN_BSS_TYPE_ANY = 0xff,
-} mlan_bss_type;
-
-/** MLAN BSS role */
-typedef enum _mlan_bss_role {
-	MLAN_BSS_ROLE_STA = 0,
-	MLAN_BSS_ROLE_UAP = 1,
-	MLAN_BSS_ROLE_ANY = 0xff,
-} mlan_bss_role;
-
-/** BSS role mask */
-#define BSS_ROLE_MASK (MBIT(0) | MBIT(1))
-
-/** Get BSS role */
-#define GET_BSS_ROLE(priv) ((priv)->bss_role & BSS_ROLE_MASK)
-
-/** mlan_data_frame_type */
-typedef enum _mlan_data_frame_type {
-	MLAN_DATA_FRAME_TYPE_ETH_II = 0,
-	MLAN_DATA_FRAME_TYPE_802_11,
-} mlan_data_frame_type;
-
-/** mlan_event_id */
-typedef enum _mlan_event_id {
-	/* Event generated by firmware (MSB=0) */
-	MLAN_EVENT_ID_FW_UNKNOWN = 0x00000001,
-	MLAN_EVENT_ID_FW_ADHOC_LINK_SENSED = 0x00000002,
-	MLAN_EVENT_ID_FW_ADHOC_LINK_LOST = 0x00000003,
-	MLAN_EVENT_ID_FW_DISCONNECTED = 0x00000004,
-	MLAN_EVENT_ID_FW_MIC_ERR_UNI = 0x00000005,
-	MLAN_EVENT_ID_FW_MIC_ERR_MUL = 0x00000006,
-	MLAN_EVENT_ID_FW_BCN_RSSI_LOW = 0x00000007,
-	MLAN_EVENT_ID_FW_BCN_RSSI_HIGH = 0x00000008,
-	MLAN_EVENT_ID_FW_BCN_SNR_LOW = 0x00000009,
-	MLAN_EVENT_ID_FW_BCN_SNR_HIGH = 0x0000000A,
-	MLAN_EVENT_ID_FW_MAX_FAIL = 0x0000000B,
-	MLAN_EVENT_ID_FW_DATA_RSSI_LOW = 0x0000000C,
-	MLAN_EVENT_ID_FW_DATA_RSSI_HIGH = 0x0000000D,
-	MLAN_EVENT_ID_FW_DATA_SNR_LOW = 0x0000000E,
-	MLAN_EVENT_ID_FW_DATA_SNR_HIGH = 0x0000000F,
-	MLAN_EVENT_ID_FW_LINK_QUALITY = 0x00000010,
-	MLAN_EVENT_ID_FW_PORT_RELEASE = 0x00000011,
-	MLAN_EVENT_ID_FW_PRE_BCN_LOST = 0x00000012,
-	MLAN_EVENT_ID_FW_DEBUG_INFO = 0x00000013,
-	MLAN_EVENT_ID_FW_WMM_CONFIG_CHANGE = 0x0000001A,
-	MLAN_EVENT_ID_FW_HS_WAKEUP = 0x0000001B,
-	MLAN_EVENT_ID_FW_BG_SCAN = 0x0000001D,
-	MLAN_EVENT_ID_FW_BG_SCAN_STOPPED = 0x0000001E,
-	MLAN_EVENT_ID_FW_WEP_ICV_ERR = 0x00000020,
-	MLAN_EVENT_ID_FW_STOP_TX = 0x00000021,
-	MLAN_EVENT_ID_FW_START_TX = 0x00000022,
-	MLAN_EVENT_ID_FW_CHANNEL_SWITCH_ANN = 0x00000023,
-	MLAN_EVENT_ID_FW_RADAR_DETECTED = 0x00000024,
-	MLAN_EVENT_ID_FW_CHANNEL_REPORT_RDY = 0x00000025,
-	MLAN_EVENT_ID_FW_BW_CHANGED = 0x00000026,
-	MLAN_EVENT_ID_FW_REMAIN_ON_CHAN_EXPIRED = 0x0000002B,
-
-#ifdef UAP_SUPPORT
-	MLAN_EVENT_ID_UAP_FW_BSS_START = 0x0000002C,
-	MLAN_EVENT_ID_UAP_FW_BSS_ACTIVE = 0x0000002D,
-	MLAN_EVENT_ID_UAP_FW_BSS_IDLE = 0x0000002E,
-	MLAN_EVENT_ID_UAP_FW_MIC_COUNTERMEASURES = 0x0000002F,
-	MLAN_EVENT_ID_UAP_FW_STA_CONNECT = 0x00000030,
-	MLAN_EVENT_ID_UAP_FW_STA_DISCONNECT = 0x00000031,
-#endif
-
-	MLAN_EVENT_ID_FW_DUMP_INFO = 0x00000033,
-
-	MLAN_EVENT_ID_FW_TX_STATUS = 0x00000034,
-	MLAN_EVENT_ID_FW_CHAN_SWITCH_COMPLETE = 0x00000036,
-#if defined(PCIE)
-	MLAN_EVENT_ID_SSU_DUMP_FILE = 0x00000039,
-#endif /* SSU_SUPPORT */
-	MLAN_EVENT_ID_CSI = 0x00000040,
-	/* Event generated by MLAN driver (MSB=1) */
-	MLAN_EVENT_ID_DRV_CONNECTED = 0x80000001,
-	MLAN_EVENT_ID_DRV_DEFER_HANDLING = 0x80000002,
-	MLAN_EVENT_ID_DRV_HS_ACTIVATED = 0x80000003,
-	MLAN_EVENT_ID_DRV_HS_DEACTIVATED = 0x80000004,
-	MLAN_EVENT_ID_DRV_MGMT_FRAME = 0x80000005,
-	MLAN_EVENT_ID_DRV_OBSS_SCAN_PARAM = 0x80000006,
-	MLAN_EVENT_ID_DRV_PASSTHRU = 0x80000007,
-	MLAN_EVENT_ID_DRV_SCAN_REPORT = 0x80000009,
-	MLAN_EVENT_ID_DRV_MEAS_REPORT = 0x8000000A,
-	MLAN_EVENT_ID_DRV_ASSOC_FAILURE_REPORT = 0x8000000B,
-	MLAN_EVENT_ID_DRV_REPORT_STRING = 0x8000000F,
-	MLAN_EVENT_ID_DRV_DBG_DUMP = 0x80000012,
-	MLAN_EVENT_ID_DRV_BGSCAN_RESULT = 0x80000013,
-	MLAN_EVENT_ID_DRV_FLUSH_RX_WORK = 0x80000015,
-	MLAN_EVENT_ID_DRV_DEFER_RX_WORK = 0x80000016,
-	MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ = 0x80000017,
-	MLAN_EVENT_ID_DRV_FT_RESPONSE = 0x80000018,
-	MLAN_EVENT_ID_DRV_FLUSH_MAIN_WORK = 0x80000019,
-#ifdef UAP_SUPPORT
-	MLAN_EVENT_ID_DRV_UAP_CHAN_INFO = 0x80000020,
-#endif
-	MLAN_EVENT_ID_FW_ROAM_OFFLOAD_RESULT = 0x80000023,
-	MLAN_EVENT_ID_DRV_ASSOC_FAILURE_LOGGER = 0x80000026,
-	MLAN_EVENT_ID_DRV_ASSOC_SUCC_LOGGER = 0x80000027,
-	MLAN_EVENT_ID_DRV_DISCONNECT_LOGGER = 0x80000028,
-	MLAN_EVENT_ID_DRV_WIFI_STATUS = 0x80000029,
-	MLAN_EVENT_ID_STORE_HOST_CMD_RESP = 0x80000030,
-} mlan_event_id;
-
-/** Data Structures */
-/** mlan_image data structure */
-typedef struct _mlan_fw_image {
-	/** Firmware image buffer pointer */
-	t_u8 *pfw_buf;
-	/** Firmware image length */
-	t_u32 fw_len;
-	/** Firmware reload flag */
-	t_u8 fw_reload;
-} mlan_fw_image, *pmlan_fw_image;
-
-/** MrvlIEtypesHeader_t */
-typedef MLAN_PACK_START struct _MrvlIEtypesHeader {
-	/** Header type */
-	t_u16 type;
-	/** Header length */
-	t_u16 len;
-} MLAN_PACK_END MrvlIEtypesHeader_t;
-
-/** MrvlExtIEtypesHeader_t */
-typedef MLAN_PACK_START struct _MrvlExtIEtypesHeader {
-	/** Header type */
-	t_u16 type;
-	/** Header length */
-	t_u16 len;
-	/** ext id */
-	t_u8 ext_id;
-} MLAN_PACK_END MrvlExtIEtypesHeader_t;
-
-/** MrvlIEtypes_Data_t */
-typedef MLAN_PACK_START struct _MrvlExtIEtypes_Data_t {
-	/** Header */
-	MrvlExtIEtypesHeader_t header;
-	/** Data */
-	t_u8 data[];
-} MLAN_PACK_END MrvlExtIEtypes_Data_t;
-
-/** MrvlIEtypes_Data_t */
-typedef MLAN_PACK_START struct _MrvlIEtypes_Data_t {
-	/** Header */
-	MrvlIEtypesHeader_t header;
-	/** Data */
-	t_u8 data[];
-} MLAN_PACK_END MrvlIEtypes_Data_t;
-
-#define OID_TYPE_CAL 0x2
-#define OID_TYPE_DPD 0xa
-#define UNKNOW_DPD_LENGTH 0xffffffff
-
-/** Custom data structure */
-typedef struct _mlan_init_param {
-	/** DPD data buffer pointer */
-	t_u8 *pdpd_data_buf;
-	/** DPD data length */
-	t_u32 dpd_data_len;
-	/** region txpowerlimit cfg data buffer pointer */
-	t_u8 *ptxpwr_data_buf;
-	/** region txpowerlimit cfg data length */
-	t_u32 txpwr_data_len;
-	/** Cal data buffer pointer */
-	t_u8 *pcal_data_buf;
-	/** Cal data length */
-	t_u32 cal_data_len;
-	/** Other custom data */
-} mlan_init_param, *pmlan_init_param;
-
-/** channel type */
-enum mlan_channel_type {
-	CHAN_NO_HT,
-	CHAN_HT20,
-	CHAN_HT40MINUS,
-	CHAN_HT40PLUS,
-	CHAN_VHT80
-};
-
-/** channel band */
-enum {
-	BAND_2GHZ = 0,
-	BAND_5GHZ = 1,
-	BAND_6GHZ = 2,
-	BAND_4GHZ = 3,
-};
-
-/** channel offset */
-enum {
-	SEC_CHAN_NONE = 0,
-	SEC_CHAN_ABOVE = 1,
-	SEC_CHAN_5MHZ = 2,
-	SEC_CHAN_BELOW = 3
-};
-
-/** channel bandwidth */
-enum {
-	CHAN_BW_20MHZ = 0,
-	CHAN_BW_10MHZ,
-	CHAN_BW_40MHZ,
-	CHAN_BW_80MHZ,
-};
-
-/** scan mode */
-enum {
-	SCAN_MODE_MANUAL = 0,
-	SCAN_MODE_ACS,
-	SCAN_MODE_USER,
-};
-
-/** DFS state */
-typedef enum _dfs_state_t {
-	/** Channel can be used, CAC (Channel Availability Check) must be done
-	   before using it */
-	DFS_USABLE = 0,
-	/** Channel is not available, radar was detected */
-	DFS_UNAVAILABLE = 1,
-	/** Channel is Available, CAC is done and is free of radar */
-	DFS_AVAILABLE = 2,
-} dfs_state_t;
-
-/** max cac time 10 minutes */
-#define MAX_CAC_DWELL_TIME 600000
-/** default cac time 60 seconds */
-#define DEF_CAC_DWELL_TIME 60000
-/** start freq for 5G */
-#define START_FREQ_11A_BAND 5000
-
-typedef enum _dfs_w53_cfg_t {
-	/** DFS W53 Default Fw Value */
-	DFS_W53_DEFAULT_FW = 0,
-	/** DFS W53 New W53 Rules/Standard */
-	DFS_W53_NEW = 1,
-	/** DFS W53 Old W53 Rules/Standard */
-	DFS_W53_OLD = 2
-} dfs_w53_cfg_t;
-
-typedef enum _dfs_moe_t {
-	/** driver default DFS behavior */
-	DFS_MODE_DEFAULT = 0,
-	/* disable DFS master when uap and station operate in same DFS channel
-	 */
-	DFS_MODE_ENH = 1,
-} dfs_mode_t;
-
-/** Band_Config_t */
-typedef MLAN_PACK_START struct _Band_Config_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Channel Selection Mode - (00)=manual, (01)=ACS,  (02)=user*/
-	t_u8 scanMode : 2;
-	/** Secondary Channel Offset - (00)=None, (01)=Above, (11)=Below */
-	t_u8 chan2Offset : 2;
-	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
-	t_u8 chanWidth : 2;
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
-	t_u8 chanBand : 2;
-#else
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
-	t_u8 chanBand : 2;
-	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
-	t_u8 chanWidth : 2;
-	/** Secondary Channel Offset - (00)=None, (01)=Above, (11)=Below */
-	t_u8 chan2Offset : 2;
-	/** Channel Selection Mode - (00)=manual, (01)=ACS, (02)=Adoption mode*/
-	t_u8 scanMode : 2;
-#endif
-} MLAN_PACK_END Band_Config_t;
-
-/** channel_band_t */
-typedef MLAN_PACK_START struct _chan_band_info {
-	/** Band Configuration */
-	Band_Config_t bandcfg;
-	/** channel */
-	t_u8 channel;
-	/** 11n flag */
-	t_u8 is_11n_enabled;
-	/** center channel */
-	t_u8 center_chan;
-	/** dfs channel flag */
-	t_u8 is_dfs_chan;
-} MLAN_PACK_END chan_band_info;
-
-/** Channel usability flags */
-#define NXP_CHANNEL_NO_OFDM MBIT(9)
-#define NXP_CHANNEL_NO_CCK MBIT(8)
-#define NXP_CHANNEL_DISABLED MBIT(7)
-/* BIT 5/6 resevered for FW */
-#define NXP_CHANNEL_NOHT160 MBIT(4)
-#define NXP_CHANNEL_NOHT80 MBIT(3)
-#define NXP_CHANNEL_NOHT40 MBIT(2)
-#define NXP_CHANNEL_DFS MBIT(1)
-#define NXP_CHANNEL_PASSIVE MBIT(0)
-
-/** CFP dynamic (non-const) elements */
-typedef struct _cfp_dyn_t {
-	/** extra flags to specify channel usability
-	 *  bit 9 : if set, channel is non-OFDM
-	 *  bit 8 : if set, channel is non-CCK
-	 *  bit 7 : if set, channel is disabled
-	 *  bit  5/6 resevered for FW
-	 *  bit 4 : if set, 160MHz on channel is disabled
-	 *  bit 3 : if set, 80MHz on channel is disabled
-	 *  bit 2 : if set, 40MHz on channel is disabled
-	 *  bit 1 : if set, channel is DFS channel
-	 *  bit 0 : if set, channel is passive
-	 */
-	t_u16 flags;
-	/** TRUE: Channel is blacklisted (do not use) */
-	t_bool blacklist;
-	/** DFS state of the channel
-	 * 0:DFS_USABLE  1:DFS_AVAILABLE  2:DFS_UNAVAILABLE */
-	dfs_state_t dfs_state;
-} cfp_dyn_t;
-
-/** Chan-Freq-TxPower mapping table*/
-typedef struct _chan_freq_power_t {
-	/** Channel Number */
-	t_u16 channel;
-	/** Frequency of this Channel */
-	t_u32 freq;
-	/** Max allowed Tx power level */
-	t_u16 max_tx_power;
-	/** TRUE:radar detect required for BAND A or passive scan for BAND B/G;
-	 * FALSE:radar detect not required for BAND A or active scan for BAND
-	 * B/G*/
-	t_bool passive_scan_or_radar_detect;
-	/** Elements associated to cfp that change at run-time */
-	cfp_dyn_t dynamic;
-} chan_freq_power_t;
-
-/** mlan_event data structure */
-typedef struct _mlan_event {
-	/** BSS index number for multiple BSS support */
-	t_u32 bss_index;
-	/** Event ID */
-	mlan_event_id event_id;
-	/** Event length */
-	t_u32 event_len;
-	/** Event buffer */
-	t_u8 event_buf[];
-} mlan_event, *pmlan_event;
-
-/** mlan_cmdresp_event data structure */
-typedef struct _mlan_cmdresp_event {
-	/** BSS index number for multiple BSS support */
-	t_u32 bss_index;
-	/** Event ID */
-	mlan_event_id event_id;
-	/** Event length */
-	t_u32 event_len;
-	/** resp buffer pointer */
-	t_u8 *resp;
-} mlan_cmdresp_event, *pmlan_cmdresp_event;
-
-/** csi event data structure */
-typedef MLAN_PACK_START struct _csi_record_ds {
-	/** Length in DWORDS, including header */
-	t_u16 Len;
-	/** CSI signature. 0xABCD fixed */
-	t_u16 CSI_Sign;
-	/** User defined HeaderID  */
-	t_u32 CSI_HeaderID;
-	/** Packet info field */
-	t_u16 PKT_info;
-	/** Frame control field for the received packet*/
-	t_u16 FCF;
-	/** Timestamp when packet received */
-	t_u64 TSF;
-	/** Received Packet Destination MAC Address */
-	t_u8 Dst_MAC[6];
-	/** Received Packet Source MAC Address */
-	t_u8 Src_MAC[6];
-	/** RSSI for antenna A */
-	t_u8 Rx_RSSI_A;
-	/** RSSI for antenna B */
-	t_u8 Rx_RSSI_B;
-	/** Noise floor for antenna A */
-	t_u8 Rx_NF_A;
-	/** Noise floor for antenna A */
-	t_u8 Rx_NF_B;
-	/** Rx signal strength above noise floor */
-	t_u8 Rx_SINR;
-	/** Channel */
-	t_u8 channel;
-	/** user defined Chip ID */
-	t_u16 chip_id;
-	/** Reserved */
-	t_u32 rsvd;
-	/** CSI data length in DWORDs */
-	t_u32 CSI_Data_Length;
-	/** Start of CSI data */
-	t_u8 CSI_Data[0];
-	/** At the end of CSI raw data, user defined TailID of 4 bytes*/
-} MLAN_PACK_END csi_record_ds, *pcsi_record_ds;
-
-/** mlan_ioctl_req data structure */
-typedef struct _mlan_ioctl_req {
-	/** Pointer to previous mlan_ioctl_req */
-	struct _mlan_ioctl_req *pprev;
-	/** Pointer to next mlan_ioctl_req */
-	struct _mlan_ioctl_req *pnext;
-	/** Status code from firmware/driver */
-	t_u32 status_code;
-	/** BSS index number for multiple BSS support */
-	t_u32 bss_index;
-	/** Request id */
-	t_u32 req_id;
-	/** Action: set or get */
-	t_u32 action;
-	/** Pointer to buffer */
-	t_u8 *pbuf;
-	/** Length of buffer */
-	t_u32 buf_len;
-	/** Length of the data read/written in buffer */
-	t_u32 data_read_written;
-	/** Length of buffer needed */
-	t_u32 buf_len_needed;
-	/** Reserved for MOAL module */
-	t_ptr reserved_1;
-} mlan_ioctl_req, *pmlan_ioctl_req;
-
-typedef MLAN_PACK_START struct _mix_rate_info {
-	/**  bit0: LGI: gi=0, SGI: gi= 1 */
-	/**  bit1-2: 20M: bw=0, 40M: bw=1, 80M: bw=2, 160M: bw=3  */
-	/**  bit3-4: LG: format=0, HT: format=1, VHT: format=2 */
-	/**  bit5: LDPC: 0-not support,  1-support */
-	/**  bit6-7:reserved */
-	t_u8 rate_info;
-	/** MCS index */
-	t_u8 mcs_index;
-	/** bitrate, in 500Kbps */
-	t_u16 bitrate;
-} MLAN_PACK_END mix_rate_info, *pmix_rate_info;
-
-typedef MLAN_PACK_START struct _rxpd_extra_info {
-	/** flags */
-	t_u8 flags;
-	/** channel.flags */
-	t_u16 channel_flags;
-	/** mcs.known */
-	t_u8 mcs_known;
-	/** mcs.flags */
-	t_u8 mcs_flags;
-	/** vht sig1 */
-	t_u32 vht_sig1;
-	/** vht sig2 */
-	t_u32 vht_sig2;
-} MLAN_PACK_END rxpd_extra_info, *prxpd_extra_info;
-
-typedef MLAN_PACK_START struct _radiotap_info {
-	/** Rate Info */
-	mix_rate_info rate_info;
-	/** SNR */
-	t_s8 snr;
-	/** Noise Floor */
-	t_s8 nf;
-	/** band config */
-	t_u8 band_config;
-	/** chan number */
-	t_u8 chan_num;
-	t_u8 antenna;
-	/** extra rxpd info from FW */
-	rxpd_extra_info extra_info;
-} MLAN_PACK_END radiotap_info, *pradiotap_info;
-
-/** txpower structure */
-typedef MLAN_PACK_START struct {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Host tx power ctrl:
-	     0x0: use fw setting for TX power
-	     0x1: value specified in bit[6] and bit[5:0] are valid */
-	t_u8 hostctl : 1;
-	/** Sign of the power specified in bit[5:0] */
-	t_u8 sign : 1;
-	/** Power to be used for transmission(in dBm) */
-	t_u8 abs_val : 6;
-#else
-	/** Power to be used for transmission(in dBm) */
-	t_u8 abs_val : 6;
-	/** Sign of the power specified in bit[5:0] */
-	t_u8 sign : 1;
-	/** Host tx power ctrl:
-	     0x0: use fw setting for TX power
-	     0x1: value specified in bit[6] and bit[5:0] are valid */
-	t_u8 hostctl : 1;
-#endif
-} MLAN_PACK_END tx_power_t;
-/* pkt_txctrl */
-typedef MLAN_PACK_START struct _pkt_txctrl {
-	/**Data rate in unit of 0.5Mbps */
-	t_u16 data_rate;
-	/*Channel number to transmit the frame */
-	t_u8 channel;
-	/** Bandwidth to transmit the frame*/
-	t_u8 bw;
-	/** Power to be used for transmission*/
-	union {
-		tx_power_t tp;
-		t_u8 val;
-	} tx_power;
-	/** Retry time of tx transmission*/
-	t_u8 retry_limit;
-} MLAN_PACK_END pkt_txctrl, *ppkt_txctrl;
-
-/** pkt_rxinfo */
-typedef MLAN_PACK_START struct _pkt_rxinfo {
-	/** Data rate of received paccket*/
-	t_u16 data_rate;
-	/** Channel on which packet was received*/
-	t_u8 channel;
-	/** Rx antenna*/
-	t_u8 antenna;
-	/** Rx Rssi*/
-	t_u8 rssi;
-} MLAN_PACK_END pkt_rxinfo, *ppkt_rxinfo;
-
-#define MC_FLAG_RETRY MBIT(0)
-#define MC_FLAG_START_CYCLE MBIT(1)
-#define MC_FLAG_END_CYCLE MBIT(2)
-#define MC_FLAG_START_AMPDU MBIT(3)
-#define MC_FLAG_END_AMPDU MBIT(4)
-/* mc pkt txcontrol */
-typedef MLAN_PACK_START struct _mc_txcontrol {
-	/** Data rate in mcs index, 0-7 */
-	t_u8 mcs_index;
-	/** band width 0-20Mhz, 1-40Mhz */
-	t_u8 bandwidth;
-	/** seq_num */
-	t_u16 seq_num;
-	/** packet expiry time */
-	t_u32 pkt_expiry;
-	/** mc_pkt_flags */
-	t_u8 mc_pkt_flags;
-} MLAN_PACK_END mc_txcontrol, *pmc_txcontrol;
-
-/** mlan_buffer data structure */
-typedef struct _mlan_buffer {
-	/** Pointer to previous mlan_buffer */
-	struct _mlan_buffer *pprev;
-	/** Pointer to next mlan_buffer */
-	struct _mlan_buffer *pnext;
-	/** Status code from firmware/driver */
-	t_u32 status_code;
-	/** Flags for this buffer */
-	t_u32 flags;
-	/** BSS index number for multiple BSS support */
-	t_u32 bss_index;
-	/** Buffer descriptor, e.g. skb in Linux */
-	t_void *pdesc;
-	/** Pointer to buffer */
-	t_u8 *pbuf;
-#ifdef PCIE
-	/** Physical address of the pbuf pointer */
-	t_u64 buf_pa;
-	t_u32 total_pcie_buf_len;
-#endif
-	/** Offset to data */
-	t_u32 data_offset;
-	/** Data length */
-	t_u32 data_len;
-	/** Buffer type: data, cmd, event etc. */
-	mlan_buf_type buf_type;
-
-	/** Fields below are valid for data packet only */
-	/** QoS priority */
-	t_u32 priority;
-	/** Time stamp when packet is received (seconds) */
-	t_u32 in_ts_sec;
-	/** Time stamp when packet is received (micro seconds) */
-	t_u32 in_ts_usec;
-	/** Time stamp when packet is processed (seconds) */
-	t_u32 out_ts_sec;
-	/** Time stamp when packet is processed (micro seconds) */
-	t_u32 out_ts_usec;
-	/** tx_seq_num */
-	t_u32 tx_seq_num;
-	/** Time stamp when packet is deque from rx_q(seconds) */
-	t_u32 extra_ts_sec;
-	/** Time stamp when packet is dequed from rx_q(micro seconds) */
-	t_u32 extra_ts_usec;
-	/** Fields below are valid for MLAN module only */
-	/** Pointer to parent mlan_buffer */
-	struct _mlan_buffer *pparent;
-	/** Use count for this buffer */
-	t_u32 use_count;
-	union {
-		mc_txcontrol mc_tx_info;
-		pkt_txctrl tx_info;
-		pkt_rxinfo rx_info;
-	} u;
-} mlan_buffer, *pmlan_buffer, **ppmlan_buffer;
-
-/** mlan_hw_info data structure */
-typedef struct _mlan_hw_info {
-	t_u32 fw_cap;
-	t_u32 fw_cap_ext;
-} mlan_hw_info, *pmlan_hw_info;
-
-/** mlan_bss_attr data structure */
-typedef struct _mlan_bss_attr {
-	/** BSS type */
-	t_u32 bss_type;
-	/** Data frame type: Ethernet II, 802.11, etc. */
-	t_u32 frame_type;
-	/** The BSS is active (non-0) or not (0). */
-	t_u32 active;
-	/** BSS Priority */
-	t_u32 bss_priority;
-	/** BSS number */
-	t_u32 bss_num;
-	/** The BSS is virtual */
-	t_u32 bss_virtual;
-} mlan_bss_attr, *pmlan_bss_attr;
-
-/** bss tbl data structure */
-typedef struct _mlan_bss_tbl {
-	/** BSS Attributes */
-	mlan_bss_attr bss_attr[MLAN_MAX_BSS_NUM];
-} mlan_bss_tbl, *pmlan_bss_tbl;
-
-#ifdef PRAGMA_PACK
-#pragma pack(push, 1)
-#endif
-
-/** Type enumeration for the command result */
-typedef MLAN_PACK_START enum _mlan_cmd_result_e {
-	MLAN_CMD_RESULT_SUCCESS = 0,
-	MLAN_CMD_RESULT_FAILURE = 1,
-	MLAN_CMD_RESULT_TIMEOUT = 2,
-	MLAN_CMD_RESULT_INVALID_DATA = 3
-} MLAN_PACK_END mlan_cmd_result_e;
-
-/** Type enumeration of WMM AC_QUEUES */
-typedef MLAN_PACK_START enum _mlan_wmm_ac_e {
-	WMM_AC_BK,
-	WMM_AC_BE,
-	WMM_AC_VI,
-	WMM_AC_VO
-} MLAN_PACK_END mlan_wmm_ac_e;
-
-/** Type enumeration for the action field in the Queue Config command */
-typedef MLAN_PACK_START enum _mlan_wmm_queue_config_action_e {
-	MLAN_WMM_QUEUE_CONFIG_ACTION_GET = 0,
-	MLAN_WMM_QUEUE_CONFIG_ACTION_SET = 1,
-	MLAN_WMM_QUEUE_CONFIG_ACTION_DEFAULT = 2,
-	MLAN_WMM_QUEUE_CONFIG_ACTION_MAX
-} MLAN_PACK_END mlan_wmm_queue_config_action_e;
-
-/** Type enumeration for the action field in the queue stats command */
-typedef MLAN_PACK_START enum _mlan_wmm_queue_stats_action_e {
-	MLAN_WMM_STATS_ACTION_START = 0,
-	MLAN_WMM_STATS_ACTION_STOP = 1,
-	MLAN_WMM_STATS_ACTION_GET_CLR = 2,
-	MLAN_WMM_STATS_ACTION_SET_CFG = 3, /* Not currently used */
-	MLAN_WMM_STATS_ACTION_GET_CFG = 4, /* Not currently used */
-	MLAN_WMM_STATS_ACTION_MAX
-} MLAN_PACK_END mlan_wmm_queue_stats_action_e;
-
-/**
- *  @brief IOCTL structure for a Traffic stream status.
- *
- */
-typedef MLAN_PACK_START struct {
-	/** TSID: Range: 0->7 */
-	t_u8 tid;
-	/** TSID specified is valid */
-	t_u8 valid;
-	/** AC TSID is active on */
-	t_u8 access_category;
-	/** UP specified for the TSID */
-	t_u8 user_priority;
-	/** Power save mode for TSID: 0 (legacy), 1 (UAPSD) */
-	t_u8 psb;
-	/** Upstream(0), Downlink(1), Bidirectional(3) */
-	t_u8 flow_dir;
-	/** Medium time granted for the TSID */
-	t_u16 medium_time;
-} MLAN_PACK_END wlan_ioctl_wmm_ts_status_t,
-	/** Type definition of mlan_ds_wmm_ts_status for
-	   MLAN_OID_WMM_CFG_TS_STATUS */
-	mlan_ds_wmm_ts_status, *pmlan_ds_wmm_ts_status;
-
-/** Max Ie length */
-#define MAX_IE_SIZE 256
-
-/** custom IE */
-typedef MLAN_PACK_START struct _custom_ie {
-	/** IE Index */
-	t_u16 ie_index;
-	/** Mgmt Subtype Mask */
-	t_u16 mgmt_subtype_mask;
-	/** IE Length */
-	t_u16 ie_length;
-	/** IE buffer */
-	t_u8 ie_buffer[MAX_IE_SIZE];
-} MLAN_PACK_END custom_ie;
-
-/** Max IE index to FW */
-#define MAX_MGMT_IE_INDEX_TO_FW 4
-/** Max IE index per BSS */
-#define MAX_MGMT_IE_INDEX 26
-
-/** custom IE info */
-typedef MLAN_PACK_START struct _custom_ie_info {
-	/** size of buffer */
-	t_u16 buf_size;
-	/** no of buffers of buf_size */
-	t_u16 buf_count;
-} MLAN_PACK_END custom_ie_info;
-
-/** TLV buffer : Max Mgmt IE */
-typedef MLAN_PACK_START struct _tlvbuf_max_mgmt_ie {
-	/** Type */
-	t_u16 type;
-	/** Length */
-	t_u16 len;
-	/** No of tuples */
-	t_u16 count;
-	/** custom IE info tuples */
-	custom_ie_info info[MAX_MGMT_IE_INDEX];
-} MLAN_PACK_END tlvbuf_max_mgmt_ie;
-
-/** TLV buffer : custom IE */
-typedef MLAN_PACK_START struct _tlvbuf_custom_ie {
-	/** Type */
-	t_u16 type;
-	/** Length */
-	t_u16 len;
-	/** IE data */
-	custom_ie ie_data_list[MAX_MGMT_IE_INDEX_TO_FW];
-	/** Max mgmt IE TLV */
-	tlvbuf_max_mgmt_ie max_mgmt_ie;
-} MLAN_PACK_END mlan_ds_misc_custom_ie;
-
-/** Max TDLS config data length */
-#define MAX_TDLS_DATA_LEN 1024
-
-/** Action commands for TDLS enable/disable */
-#define WLAN_TDLS_CONFIG 0x00
-/** Action commands for TDLS configuration :Set */
-#define WLAN_TDLS_SET_INFO 0x01
-/** Action commands for TDLS configuration :Discovery Request */
-#define WLAN_TDLS_DISCOVERY_REQ 0x02
-/** Action commands for TDLS configuration :Setup Request */
-#define WLAN_TDLS_SETUP_REQ 0x03
-/** Action commands for TDLS configuration :Tear down Request */
-#define WLAN_TDLS_TEAR_DOWN_REQ 0x04
-/** Action ID for TDLS power mode */
-#define WLAN_TDLS_POWER_MODE 0x05
-/**Action ID for init TDLS Channel Switch*/
-#define WLAN_TDLS_INIT_CHAN_SWITCH 0x06
-/** Action ID for stop TDLS Channel Switch */
-#define WLAN_TDLS_STOP_CHAN_SWITCH 0x07
-/** Action ID for configure CS related parameters */
-#define WLAN_TDLS_CS_PARAMS 0x08
-/** Action ID for Disable CS */
-#define WLAN_TDLS_CS_DISABLE 0x09
-/** Action ID for TDLS link status */
-#define WLAN_TDLS_LINK_STATUS 0x0A
-/** Action ID for Host TDLS config uapsd and CS */
-#define WLAN_HOST_TDLS_CONFIG 0x0D
-/** Action ID for TDLS CS immediate return */
-#define WLAN_TDLS_DEBUG_CS_RET_IM 0xFFF7
-/** Action ID for TDLS Stop RX */
-#define WLAN_TDLS_DEBUG_STOP_RX 0xFFF8
-/** Action ID for TDLS Allow weak security for links establish */
-#define WLAN_TDLS_DEBUG_ALLOW_WEAK_SECURITY 0xFFF9
-/** Action ID for TDLS Ignore key lifetime expiry */
-#define WLAN_TDLS_DEBUG_IGNORE_KEY_EXPIRY 0xFFFA
-/** Action ID for TDLS Higher/Lower mac Test */
-#define WLAN_TDLS_DEBUG_HIGHER_LOWER_MAC 0xFFFB
-/** Action ID for TDLS Prohibited Test */
-#define WLAN_TDLS_DEBUG_SETUP_PROHIBITED 0xFFFC
-/** Action ID for TDLS Existing link Test */
-#define WLAN_TDLS_DEBUG_SETUP_SAME_LINK 0xFFFD
-/** Action ID for TDLS Fail Setup Confirm */
-#define WLAN_TDLS_DEBUG_FAIL_SETUP_CONFIRM 0xFFFE
-/** Action commands for TDLS debug: Wrong BSS Request */
-#define WLAN_TDLS_DEBUG_WRONG_BSS 0xFFFF
-
-/** tdls each link rate information */
-typedef MLAN_PACK_START struct _tdls_link_rate_info {
-	/** Tx Data Rate */
-	t_u8 tx_data_rate;
-	/** Tx Rate HT info*/
-	t_u8 tx_rate_htinfo;
-} MLAN_PACK_END tdls_link_rate_info;
-
-/** tdls each link status */
-typedef MLAN_PACK_START struct _tdls_each_link_status {
-	/** peer mac Address */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Link Flags */
-	t_u8 link_flags;
-	/** Traffic Status */
-	t_u8 traffic_status;
-	/** Tx Failure Count */
-	t_u8 tx_fail_count;
-	/** Channel Number */
-	t_u32 active_channel;
-	/** Last Data RSSI in dBm */
-	t_s16 data_rssi_last;
-	/** Last Data NF in dBm */
-	t_s16 data_nf_last;
-	/** AVG DATA RSSI in dBm */
-	t_s16 data_rssi_avg;
-	/** AVG DATA NF in dBm */
-	t_s16 data_nf_avg;
-	union {
-		/** tdls rate info */
-		tdls_link_rate_info rate_info;
-		/** tdls link final rate*/
-		t_u16 final_data_rate;
-	} u;
-	/** Security Method */
-	t_u8 security_method;
-	/** Key Lifetime in milliseconds */
-	t_u32 key_lifetime;
-	/** Key Length */
-	t_u8 key_length;
-	/** actual key */
-	t_u8 key[1];
-} MLAN_PACK_END tdls_each_link_status;
-
-/** TDLS configuration data */
-typedef MLAN_PACK_START struct _tdls_all_config {
-	union {
-		/** TDLS state enable disable */
-		MLAN_PACK_START struct _tdls_config {
-			/** enable or disable */
-			t_u16 enable;
-		} MLAN_PACK_END tdls_config;
-		/** Host tdls config */
-		MLAN_PACK_START struct _host_tdls_cfg {
-			/** support uapsd */
-			t_u8 uapsd_support;
-			/** channel_switch */
-			t_u8 cs_support;
-			/** TLV  length */
-			t_u16 tlv_len;
-			/** tdls info */
-			t_u8 tlv_buffer[];
-		} MLAN_PACK_END host_tdls_cfg;
-		/** TDLS set info */
-		MLAN_PACK_START struct _tdls_set_data {
-			/** (tlv + capInfo) length */
-			t_u16 tlv_length;
-			/** Cap Info */
-			t_u16 cap_info;
-			/** TLV buffer */
-			t_u8 tlv_buffer[];
-		} MLAN_PACK_END tdls_set;
-
-		/** TDLS discovery and others having mac argument */
-		MLAN_PACK_START struct _tdls_discovery_data {
-			/** peer mac Address */
-			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-		} MLAN_PACK_END tdls_discovery, tdls_stop_chan_switch,
-			tdls_link_status_req;
-
-		/** TDLS discovery Response */
-		MLAN_PACK_START struct _tdls_discovery_resp {
-			/** payload length */
-			t_u16 payload_len;
-			/** peer mac Address */
-			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-			/** RSSI */
-			t_s8 rssi;
-			/** Cap Info */
-			t_u16 cap_info;
-			/** TLV buffer */
-			t_u8 tlv_buffer[];
-		} MLAN_PACK_END tdls_discovery_resp;
-
-		/** TDLS setup request */
-		MLAN_PACK_START struct _tdls_setup_data {
-			/** peer mac Address */
-			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-			/** timeout value in milliseconds */
-			t_u32 setup_timeout;
-			/** key lifetime in milliseconds */
-			t_u32 key_lifetime;
-		} MLAN_PACK_END tdls_setup;
-
-		/** TDLS tear down info */
-		MLAN_PACK_START struct _tdls_tear_down_data {
-			/** peer mac Address */
-			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-			/** reason code */
-			t_u16 reason_code;
-		} MLAN_PACK_END tdls_tear_down, tdls_cmd_resp;
-
-		/** TDLS power mode info */
-		MLAN_PACK_START struct _tdls_power_mode_data {
-			/** peer mac Address */
-			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-			/** Power Mode */
-			t_u16 power_mode;
-		} MLAN_PACK_END tdls_power_mode;
-
-		/** TDLS channel switch info */
-		MLAN_PACK_START struct _tdls_chan_switch {
-			/** peer mac Address */
-			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-			/** Channel Switch primary channel no */
-			t_u8 primary_channel;
-			/** Channel Switch secondary channel offset */
-			t_u8 secondary_channel_offset;
-			/** Channel Switch Band */
-			t_u8 band;
-			/** Channel Switch time in milliseconds */
-			t_u16 switch_time;
-			/** Channel Switch timeout in milliseconds */
-			t_u16 switch_timeout;
-			/** Channel Regulatory class*/
-			t_u8 regulatory_class;
-			/** peridicity flag*/
-			t_u8 periodicity;
-		} MLAN_PACK_END tdls_chan_switch;
-
-		/** TDLS channel switch paramters */
-		MLAN_PACK_START struct _tdls_cs_params {
-			/** unit time, multiples of 10ms */
-			t_u8 unit_time;
-			/** threshold for other link */
-			t_u8 threshold_otherlink;
-			/** threshold for direct link */
-			t_u8 threshold_directlink;
-		} MLAN_PACK_END tdls_cs_params;
-
-		/** tdls disable channel switch */
-		MLAN_PACK_START struct _tdls_disable_cs {
-			/** Data*/
-			t_u16 data;
-		} MLAN_PACK_END tdls_disable_cs;
-		/** TDLS debug data */
-		MLAN_PACK_START struct _tdls_debug_data {
-			/** debug data */
-			t_u16 debug_data;
-		} MLAN_PACK_END tdls_debug_data;
-
-		/** TDLS link status Response */
-		MLAN_PACK_START struct _tdls_link_status_resp {
-			/** payload length */
-			t_u16 payload_len;
-			/** number of links */
-			t_u8 active_links;
-			/** structure for link status */
-			tdls_each_link_status link_stats[1];
-		} MLAN_PACK_END tdls_link_status_resp;
-
-	} u;
-} MLAN_PACK_END tdls_all_config;
-
-/** TDLS configuration buffer */
-typedef MLAN_PACK_START struct _buf_tdls_config {
-	/** TDLS Action */
-	t_u16 tdls_action;
-	/** TDLS data */
-	t_u8 tdls_data[MAX_TDLS_DATA_LEN];
-} MLAN_PACK_END mlan_ds_misc_tdls_config;
-
-/** Event structure for tear down */
-typedef struct _tdls_tear_down_event {
-	/** Peer mac address */
-	t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-	/** Reason code */
-	t_u16 reason_code;
-} tdls_tear_down_event;
-
-/** channel width */
-typedef enum wifi_channel_width {
-	WIFI_CHAN_WIDTH_20 = 0,
-	WIFI_CHAN_WIDTH_40 = 1,
-	WIFI_CHAN_WIDTH_80 = 2,
-	WIFI_CHAN_WIDTH_160 = 3,
-	WIFI_CHAN_WIDTH_80P80 = 4,
-	WIFI_CHAN_WIDTH_5 = 5,
-	WIFI_CHAN_WIDTH_10 = 6,
-	WIFI_CHAN_WIDTH_INVALID = -1
-} wifi_channel_width_t;
-
-/** channel information */
-typedef struct {
-	/** channel width (20, 40, 80, 80+80, 160) */
-	wifi_channel_width_t width;
-	/** primary 20 MHz channel */
-	int center_freq;
-	/** center frequency (MHz) first segment */
-	int center_freq0;
-	/** center frequency (MHz) second segment */
-	int center_freq1;
-} wifi_channel_info;
-
-/** wifi rate */
-typedef struct {
-	/** 0: OFDM, 1:CCK, 2:HT 3:VHT 4..7 reserved */
-	t_u32 preamble : 3;
-	/** 0:1x1, 1:2x2, 3:3x3, 4:4x4 */
-	t_u32 nss : 2;
-	/** 0:20MHz, 1:40Mhz, 2:80Mhz, 3:160Mhz */
-	t_u32 bw : 3;
-	/** OFDM/CCK rate code would be as per ieee std in the units of 0.5mbps
-	 */
-	/** HT/VHT it would be mcs index */
-	t_u32 rateMcsIdx : 8;
-	/** reserved */
-	t_u32 reserved : 16;
-	/** units of 100 Kbps */
-	t_u32 bitrate;
-} wifi_rate;
-
-/** wifi Preamble type */
-typedef enum {
-	WIFI_PREAMBLE_LEGACY = 0x1,
-	WIFI_PREAMBLE_HT = 0x2,
-	WIFI_PREAMBLE_VHT = 0x4
-} wifi_preamble;
-
-/** timeval */
-typedef struct {
-	/** Time (seconds) */
-	t_u32 time_sec;
-	/** Time (micro seconds) */
-	t_u32 time_usec;
-} wifi_timeval;
-
-#define timeval_to_msec(timeval)                                               \
-	(t_u64)((t_u64)(timeval.time_sec) * 1000 +                             \
-		(t_u64)(timeval.time_usec) / 1000)
-#define timeval_to_usec(timeval)                                               \
-	(t_u64)((t_u64)(timeval.time_sec) * 1000 * 1000 +                      \
-		(t_u64)(timeval.time_usec))
-#define is_zero_timeval(timeval)                                               \
-	((timeval.time_sec == 0) && (timeval.time_usec == 0))
-
-#define MAX_NUM_RATE 32
-#define MAX_RADIO 2
-#define MAX_NUM_CHAN 1
-#define VHT_NUM_SUPPORT_MCS 10
-#define MCS_NUM_SUPP 16
-
-#define BUF_MAXLEN 4096
-/** connection state */
-typedef enum {
-	MLAN_DISCONNECTED = 0,
-	MLAN_AUTHENTICATING = 1,
-	MLAN_ASSOCIATING = 2,
-	MLAN_ASSOCIATED = 3,
-	/** if done by firmware/driver */
-	MLAN_EAPOL_STARTED = 4,
-	/** if done by firmware/driver */
-	MLAN_EAPOL_COMPLETED = 5,
-} mlan_connection_state;
-/** roam state */
-typedef enum {
-	MLAN_ROAMING_IDLE = 0,
-	MLAN_ROAMING_ACTIVE = 1,
-} mlan_roam_state;
-/** interface mode */
-typedef enum {
-	MLAN_INTERFACE_STA = 0,
-	MLAN_INTERFACE_SOFTAP = 1,
-	MLAN_INTERFACE_IBSS = 2,
-	MLAN_INTERFACE_P2P_CLIENT = 3,
-	MLAN_INTERFACE_P2P_GO = 4,
-	MLAN_INTERFACE_NAN = 5,
-	MLAN_INTERFACE_MESH = 6,
-} mlan_interface_mode;
-
-/** set for QOS association */
-#define MLAN_CAPABILITY_QOS 0x00000001
-/** set for protected association (802.11 beacon frame control protected bit
- * set) */
-#define MLAN_CAPABILITY_PROTECTED 0x00000002
-/** set if 802.11 Extended Capabilities element interworking bit is set */
-#define MLAN_CAPABILITY_INTERWORKING 0x00000004
-/** set for HS20 association */
-#define MLAN_CAPABILITY_HS20 0x00000008
-/** set is 802.11 Extended Capabilities element UTF-8 SSID bit is set */
-#define MLAN_CAPABILITY_SSID_UTF8 0x00000010
-/** set is 802.11 Country Element is present */
-#define MLAN_CAPABILITY_COUNTRY 0x00000020
-
-/** link layer status */
-typedef struct {
-	/** interface mode */
-	mlan_interface_mode mode;
-	/** interface mac address (self) */
-	t_u8 mac_addr[6];
-	/** connection state (valid for STA, CLI only) */
-	mlan_connection_state state;
-	/** roaming state */
-	mlan_roam_state roaming;
-	/** WIFI_CAPABILITY_XXX (self) */
-	t_u32 capabilities;
-	/** null terminated SSID */
-	t_u8 ssid[33];
-	/** bssid */
-	t_u8 bssid[6];
-	/** country string advertised by AP */
-	t_u8 ap_country_str[3];
-	/** country string for this association */
-	t_u8 country_str[3];
-} mlan_interface_link_layer_info, *mlan_interface_handle;
-
-/** channel statistics */
-typedef struct {
-	/** channel */
-	wifi_channel_info channel;
-	/** msecs the radio is awake (32 bits number accruing over time) */
-	t_u32 on_time;
-	/** msecs the CCA register is busy (32 bits number accruing over time)
-	 */
-	t_u32 cca_busy_time;
-} wifi_channel_stat;
-
-/** radio statistics */
-typedef struct {
-	/** wifi radio (if multiple radio supported) */
-	int radio;
-	/** msecs the radio is awake (32 bits number accruing over time) */
-	t_u32 on_time;
-	/** msecs the radio is transmitting (32 bits number accruing over time)
-	 */
-	t_u32 tx_time;
-	/**  TBD: num_tx_levels: number of radio transmit power levels */
-	t_u32 reserved0;
-	/** TBD: tx_time_per_levels: pointer to an array of radio transmit per
-	 * power levels in msecs accured over time */
-	/* t_u32 *reserved1;*/
-	/** msecs the radio is in active receive (32 bits number accruing over
-	 * time) */
-	t_u32 rx_time;
-	/** msecs the radio is awake due to all scan (32 bits number accruing
-	 * over time) */
-	t_u32 on_time_scan;
-	/** msecs the radio is awake due to NAN (32 bits number accruing over
-	 * time) */
-	t_u32 on_time_nbd;
-	/** msecs the radio is awake due to G?scan (32 bits number accruing over
-	 * time) */
-	t_u32 on_time_gscan;
-	/** msecs the radio is awake due to roam?scan (32 bits number accruing
-	 * over time) */
-	t_u32 on_time_roam_scan;
-	/** msecs the radio is awake due to PNO scan (32 bits number accruing
-	 * over time) */
-	t_u32 on_time_pno_scan;
-	/** msecs the radio is awake due to HS2.0 scans and GAS exchange (32
-	 * bits number accruing over time) */
-	t_u32 on_time_hs20;
-	/** number of channels */
-	t_u32 num_channels;
-	/** channel statistics */
-	wifi_channel_stat channels[MAX_NUM_CHAN];
-} wifi_radio_stat;
-
-/** per rate statistics */
-typedef struct {
-	/** rate information */
-	wifi_rate rate;
-	/** number of successfully transmitted data pkts (ACK rcvd) */
-	t_u32 tx_mpdu;
-	/** number of received data pkts */
-	t_u32 rx_mpdu;
-	/** number of data packet losses (no ACK) */
-	t_u32 mpdu_lost;
-	/** total number of data pkt retries */
-	t_u32 retries;
-	/** number of short data pkt retries */
-	t_u32 retries_short;
-	/** number of long data pkt retries */
-	t_u32 retries_long;
-} wifi_rate_stat;
-
-/** wifi peer type */
-typedef enum {
-	WIFI_PEER_STA,
-	WIFI_PEER_AP,
-	WIFI_PEER_P2P_GO,
-	WIFI_PEER_P2P_CLIENT,
-	WIFI_PEER_NAN,
-	WIFI_PEER_TDLS,
-	WIFI_PEER_INVALID,
-} wifi_peer_type;
-
-/** per peer statistics */
-typedef struct {
-	/** peer type (AP, TDLS, GO etc.) */
-	wifi_peer_type type;
-	/** mac address */
-	t_u8 peer_mac_address[6];
-	/** peer WIFI_CAPABILITY_XXX */
-	t_u32 capabilities;
-	/** number of rates */
-	t_u32 num_rate;
-	/** per rate statistics, number of entries  = num_rate */
-	wifi_rate_stat rate_stats[];
-} wifi_peer_info;
-
-/** per access category statistics */
-typedef struct {
-	/** access category (VI, VO, BE, BK) */
-	mlan_wmm_ac_e ac;
-	/** number of successfully transmitted unicast data pkts (ACK rcvd) */
-	t_u32 tx_mpdu;
-	/** number of received unicast mpdus */
-	t_u32 rx_mpdu;
-	/** number of succesfully transmitted multicast data packets */
-	/** STA case: implies ACK received from AP for the unicast packet in
-	 * which mcast pkt was sent */
-	t_u32 tx_mcast;
-	/** number of received multicast data packets */
-	t_u32 rx_mcast;
-	/** number of received unicast a-mpdus */
-	t_u32 rx_ampdu;
-	/** number of transmitted unicast a-mpdus */
-	t_u32 tx_ampdu;
-	/** number of data pkt losses (no ACK) */
-	t_u32 mpdu_lost;
-	/** total number of data pkt retries */
-	t_u32 retries;
-	/** number of short data pkt retries */
-	t_u32 retries_short;
-	/** number of long data pkt retries */
-	t_u32 retries_long;
-	/** data pkt min contention time (usecs) */
-	t_u32 contention_time_min;
-	/** data pkt max contention time (usecs) */
-	t_u32 contention_time_max;
-	/** data pkt avg contention time (usecs) */
-	t_u32 contention_time_avg;
-	/** num of data pkts used for contention statistics */
-	t_u32 contention_num_samples;
-} wifi_wmm_ac_stat;
-
-/** interface statistics */
-typedef struct {
-	/** wifi interface */
-	/* wifi_interface_handle iface;*/
-	/** current state of the interface */
-	mlan_interface_link_layer_info info;
-	/** access point beacon received count from connected AP */
-	t_u32 beacon_rx;
-	/** Average beacon offset encountered (beacon_TSF - TBTT)
-	 *    the average_tsf_offset field is used so as to calculate the
-	 *    typical beacon contention time on the channel as well may be
-	 *    used to debug beacon synchronization and related power consumption
-	 * issue
-	 */
-	t_u64 average_tsf_offset;
-	/** indicate that this AP typically leaks packets beyond the driver
-	 * guard time */
-	t_u32 leaky_ap_detected;
-	/** average number of frame leaked by AP after frame with PM bit set was
-	 * ACK'ed by AP */
-	t_u32 leaky_ap_avg_num_frames_leaked;
-	/** Guard time currently in force (when implementing IEEE power
-	 * management based on frame control PM bit), How long driver waits
-	 * before shutting down the radio and after receiving an ACK for a data
-	 * frame with PM bit set)
-	 */
-	t_u32 leaky_ap_guard_time;
-	/** access point mgmt frames received count from connected AP (including
-	 * Beacon) */
-	t_u32 mgmt_rx;
-	/** action frames received count */
-	t_u32 mgmt_action_rx;
-	/** action frames transmit count */
-	t_u32 mgmt_action_tx;
-	/** access Point Beacon and Management frames RSSI (averaged) */
-	t_s32 rssi_mgmt;
-	/** access Point Data Frames RSSI (averaged) from connected AP */
-	t_s32 rssi_data;
-	/** access Point ACK RSSI (averaged) from connected AP */
-	t_s32 rssi_ack;
-	/** per ac data packet statistics */
-	wifi_wmm_ac_stat ac[MAX_AC_QUEUES];
-	/** number of peers */
-	t_u32 num_peers;
-	/** per peer statistics */
-	wifi_peer_info peer_info[];
-} wifi_iface_stat;
-
-/** link layer stat configuration params */
-typedef struct {
-	/** threshold to classify the pkts as short or long */
-	t_u32 mpdu_size_threshold;
-	/** wifi statistics bitmap */
-	t_u32 aggressive_statistics_gathering;
-} wifi_link_layer_params;
-
-/** wifi statistics bitmap  */
-#define WIFI_STATS_RADIO 0x00000001 /** all radio statistics */
-#define WIFI_STATS_RADIO_CCA                                                   \
-	0x00000002 /** cca_busy_time (within radio statistics) */
-#define WIFI_STATS_RADIO_CHANNELS                                              \
-	0x00000004 /** all channel statistics (within radio statistics) */
-#define WIFI_STATS_RADIO_SCAN                                                  \
-	0x00000008 /** all scan statistics (within radio statistics) */
-#define WIFI_STATS_IFACE 0x00000010 /** all interface statistics */
-#define WIFI_STATS_IFACE_TXRATE                                                \
-	0x00000020 /** all tx rate statistics (within interface statistics) */
-#define WIFI_STATS_IFACE_AC                                                    \
-	0x00000040 /** all ac statistics (within interface statistics) */
-#define WIFI_STATS_IFACE_CONTENTION                                            \
-	0x00000080 /** all contention (min, max, avg) statistics (within ac    \
-		      statisctics) */
-
-/** station stats */
-typedef struct _sta_stats {
-	/** last_rx_in_msec */
-	t_u64 last_rx_in_msec;
-	/** rx_packets */
-	t_u32 rx_packets;
-	/** tx packets */
-	t_u32 tx_packets;
-	/** rx bytes */
-	t_u32 rx_bytes;
-	/** tx bytes */
-	t_u32 tx_bytes;
-} sta_stats;
-
-#ifdef PRAGMA_PACK
-#pragma pack(pop)
-#endif
-
-/** mlan_callbacks data structure */
-typedef struct _mlan_callbacks {
-	/** moal_get_fw_data */
-	mlan_status (*moal_get_fw_data)(t_void *pmoal, t_u32 offset, t_u32 len,
-					t_u8 *pbuf);
-	mlan_status (*moal_get_vdll_data)(t_void *pmoal, t_u32 len, t_u8 *pbuf);
-	/** moal_get_hw_spec_complete */
-	mlan_status (*moal_get_hw_spec_complete)(t_void *pmoal,
-						 mlan_status status,
-						 pmlan_hw_info phw,
-						 pmlan_bss_tbl ptbl);
-	/** moal_init_fw_complete */
-	mlan_status (*moal_init_fw_complete)(t_void *pmoal, mlan_status status);
-	/** moal_shutdown_fw_complete */
-	mlan_status (*moal_shutdown_fw_complete)(t_void *pmoal,
-						 mlan_status status);
-	/** moal_send_packet_complete */
-	mlan_status (*moal_send_packet_complete)(t_void *pmoal,
-						 pmlan_buffer pmbuf,
-						 mlan_status status);
-	/** moal_recv_complete */
-	mlan_status (*moal_recv_complete)(t_void *pmoal, pmlan_buffer pmbuf,
-					  t_u32 port, mlan_status status);
-	/** moal_recv_packet */
-	mlan_status (*moal_recv_packet)(t_void *pmoal, pmlan_buffer pmbuf);
-	/** moal_recv_amsdu_packet */
-	mlan_status (*moal_recv_amsdu_packet)(t_void *pmoal,
-					      pmlan_buffer pmbuf);
-	/** moal_recv_event */
-	mlan_status (*moal_recv_event)(t_void *pmoal, pmlan_event pmevent);
-	/** moal_ioctl_complete */
-	mlan_status (*moal_ioctl_complete)(t_void *pmoal,
-					   pmlan_ioctl_req pioctl_req,
-					   mlan_status status);
-
-	/** moal_alloc_mlan_buffer */
-	mlan_status (*moal_alloc_mlan_buffer)(t_void *pmoal, t_u32 size,
-					      ppmlan_buffer pmbuf);
-	/** moal_free_mlan_buffer */
-	mlan_status (*moal_free_mlan_buffer)(t_void *pmoal, pmlan_buffer pmbuf);
-
-#ifdef USB
-	/** moal_write_data_async */
-	mlan_status (*moal_write_data_async)(t_void *pmoal, pmlan_buffer pmbuf,
-					     t_u32 port);
-#endif /* USB */
-#if defined(SDIO) || defined(PCIE)
-	/** moal_write_reg */
-	mlan_status (*moal_write_reg)(t_void *pmoal, t_u32 reg, t_u32 data);
-	/** moal_read_reg */
-	mlan_status (*moal_read_reg)(t_void *pmoal, t_u32 reg, t_u32 *data);
-#endif /* SDIO || PCIE */
-	/** moal_write_data_sync */
-	mlan_status (*moal_write_data_sync)(t_void *pmoal, pmlan_buffer pmbuf,
-					    t_u32 port, t_u32 timeout);
-	/** moal_read_data_sync */
-	mlan_status (*moal_read_data_sync)(t_void *pmoal, pmlan_buffer pmbuf,
-					   t_u32 port, t_u32 timeout);
-	/** moal_malloc */
-	mlan_status (*moal_malloc)(t_void *pmoal, t_u32 size, t_u32 flag,
-				   t_u8 **ppbuf);
-	/** moal_mfree */
-	mlan_status (*moal_mfree)(t_void *pmoal, t_u8 *pbuf);
-	/** moal_vmalloc */
-	mlan_status (*moal_vmalloc)(t_void *pmoal, t_u32 size, t_u8 **ppbuf);
-	/** moal_vfree */
-	mlan_status (*moal_vfree)(t_void *pmoal, t_u8 *pbuf);
-#ifdef PCIE
-	/** moal_malloc_consistent */
-	mlan_status (*moal_malloc_consistent)(t_void *pmoal, t_u32 size,
-					      t_u8 **ppbuf, t_u64 *pbuf_pa);
-	/** moal_mfree_consistent */
-	mlan_status (*moal_mfree_consistent)(t_void *pmoal, t_u32 size,
-					     t_u8 *pbuf, t_u64 buf_pa);
-	/** moal_map_memory */
-	mlan_status (*moal_map_memory)(t_void *pmoal, t_u8 *pbuf,
-				       t_u64 *pbuf_pa, t_u32 size, t_u32 flag);
-	/** moal_unmap_memory */
-	mlan_status (*moal_unmap_memory)(t_void *pmoal, t_u8 *pbuf,
-					 t_u64 buf_pa, t_u32 size, t_u32 flag);
-#endif /* PCIE */
-	/** moal_memset */
-	t_void *(*moal_memset)(t_void *pmoal, t_void *pmem, t_u8 byte,
-			       t_u32 num);
-	/** moal_memcpy */
-	t_void *(*moal_memcpy)(t_void *pmoal, t_void *pdest, const t_void *psrc,
-			       t_u32 num);
-	/** moal_memcpy_ext */
-	t_void *(*moal_memcpy_ext)(t_void *pmoal, t_void *pdest,
-				   const t_void *psrc, t_u32 num,
-				   t_u32 dest_size);
-	/** moal_memmove */
-	t_void *(*moal_memmove)(t_void *pmoal, t_void *pdest,
-				const t_void *psrc, t_u32 num);
-	/** moal_memcmp */
-	t_s32 (*moal_memcmp)(t_void *pmoal, const t_void *pmem1,
-			     const t_void *pmem2, t_u32 num);
-	/** moal_udelay */
-	t_void (*moal_udelay)(t_void *pmoal, t_u32 udelay);
-	/** moal_usleep_range */
-	t_void (*moal_usleep_range)(t_void *pmoal, t_u32 min_delay,
-				    t_u32 max_delay);
-	/** moal_get_boot_ktime */
-	mlan_status (*moal_get_boot_ktime)(t_void *pmoal, t_u64 *pnsec);
-	/** moal_get_system_time */
-	mlan_status (*moal_get_system_time)(t_void *pmoal, t_u32 *psec,
-					    t_u32 *pusec);
-	/** moal_init_timer*/
-	mlan_status (*moal_init_timer)(t_void *pmoal, t_void **pptimer,
-				       IN t_void (*callback)(t_void *pcontext),
-				       t_void *pcontext);
-	/** moal_free_timer */
-	mlan_status (*moal_free_timer)(t_void *pmoal, t_void *ptimer);
-	/** moal_start_timer*/
-	mlan_status (*moal_start_timer)(t_void *pmoal, t_void *ptimer,
-					t_u8 periodic, t_u32 msec);
-	/** moal_stop_timer*/
-	mlan_status (*moal_stop_timer)(t_void *pmoal, t_void *ptimer);
-	/** moal_init_lock */
-	mlan_status (*moal_init_lock)(t_void *pmoal, t_void **pplock);
-	/** moal_free_lock */
-	mlan_status (*moal_free_lock)(t_void *pmoal, t_void *plock);
-	/** moal_spin_lock */
-	mlan_status (*moal_spin_lock)(t_void *pmoal, t_void *plock);
-	/** moal_spin_unlock */
-	mlan_status (*moal_spin_unlock)(t_void *pmoal, t_void *plock);
-	/** moal_print */
-	t_void (*moal_print)(t_void *pmoal, t_u32 level, char *pformat, IN...);
-	/** moal_print_netintf */
-	t_void (*moal_print_netintf)(t_void *pmoal, t_u32 bss_index,
-				     t_u32 level);
-	/** moal_assert */
-	t_void (*moal_assert)(t_void *pmoal, t_u32 cond);
-
-	/** moal_hist_data_add */
-	t_void (*moal_hist_data_add)(t_void *pmoal, t_u32 bss_index,
-				     t_u16 rx_rate, t_s8 snr, t_s8 nflr,
-				     t_u8 antenna);
-	t_void (*moal_updata_peer_signal)(t_void *pmoal, t_u32 bss_index,
-					  t_u8 *peer_addr, t_s8 snr, t_s8 nflr);
-	t_u64 (*moal_do_div)(t_u64 num, t_u32 base);
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal,
-						  t_u32 bss_index);
-	mlan_status (*moal_notify_hostcmd_complete)(t_void *pmoal,
-						    t_u32 bss_index);
-#endif
-	void (*moal_tp_accounting)(t_void *pmoal, t_void *buf,
-				   t_u32 drop_point);
-	void (*moal_tp_accounting_rx_param)(t_void *pmoal, unsigned int type,
-					    unsigned int rsvd1);
-	void (*moal_amsdu_tp_accounting)(t_void *pmoal, t_s32 delay,
-					 t_s32 copy_delay);
-} mlan_callbacks, *pmlan_callbacks;
-
-/** Parameter unchanged, use MLAN default setting */
-#define ROBUSTCOEX_GPIO_UNCHANGED 0
-/** Parameter enabled, override MLAN default setting */
-#define ROBUSTCOEX_GPIO_CFG 1
-
-#if defined(SDIO)
-/** Interrupt Mode SDIO */
-#define INT_MODE_SDIO 0
-/** Interrupt Mode GPIO */
-#define INT_MODE_GPIO 1
-/** New mode: GPIO-1 as a duplicated signal of interrupt as appear of SDIO_DAT1
- */
-#define GPIO_INT_NEW_MODE 255
-#endif
-
-/** Parameter unchanged, use MLAN default setting */
-#define MLAN_INIT_PARA_UNCHANGED 0
-/** Parameter enabled, override MLAN default setting */
-#define MLAN_INIT_PARA_ENABLED 1
-/** Parameter disabled, override MLAN default setting */
-#define MLAN_INIT_PARA_DISABLED 2
-
-/** Control bit for stream 2X2 */
-#define FEATURE_CTRL_STREAM_2X2 MBIT(0)
-/** Control bit for DFS support */
-#define FEATURE_CTRL_DFS_SUPPORT MBIT(1)
-#ifdef USB
-/** Control bit for winner check & not wait for FW ready event */
-#define FEATURE_CTRL_USB_NEW_INIT MBIT(2)
-#endif
-/** Default feature control */
-#define FEATURE_CTRL_DEFAULT 0xffffffff
-/** Check if stream 2X2 enabled */
-#define IS_STREAM_2X2(x) ((x)&FEATURE_CTRL_STREAM_2X2)
-/** Check if DFS support enabled */
-#define IS_DFS_SUPPORT(x) ((x)&FEATURE_CTRL_DFS_SUPPORT)
-#ifdef USB
-/** Check if winner check & not wait for FW ready event */
-#define IS_USB_NEW_INIT(x) ((x)&FEATURE_CTRL_USB_NEW_INIT)
-#endif
-
-/*
-#define DRV_MODE_NAN                 MBIT(4)
-#define DRV_MODE_11P                 MBIT(5)
-#define DRV_MODE_MAC80211            MBIT(6)
-#define DRV_MODE_DFS                 MBIT(7)*/
-#define DRV_MODE_MASK (MBIT(4) | MBIT(5) | MBIT(6) | MBIT(7))
-
-/** mlan_device data structure */
-typedef struct _mlan_device {
-	/** MOAL Handle */
-	t_void *pmoal_handle;
-	/** BSS Attributes */
-	mlan_bss_attr bss_attr[MLAN_MAX_BSS_NUM];
-	/** Callbacks */
-	mlan_callbacks callbacks;
-#ifdef MFG_CMD_SUPPORT
-	/** MFG mode */
-	t_u32 mfg_mode;
-#endif
-#ifdef PCIE
-	t_u16 ring_size;
-#endif
-#if defined(SDIO)
-	/** SDIO interrupt mode (0: INT_MODE_SDIO, 1: INT_MODE_GPIO) */
-	t_u32 int_mode;
-	/** GPIO interrupt pin number */
-	t_u32 gpio_pin;
-#endif
-#ifdef DEBUG_LEVEL1
-	/** Driver debug bit masks */
-	t_u32 drvdbg;
-#endif
-	/** allocate fixed buffer size for scan beacon buffer*/
-	t_u32 fixed_beacon_buffer;
-	/** SDIO MPA Tx */
-	t_u32 mpa_tx_cfg;
-	/** SDIO MPA Rx */
-	t_u32 mpa_rx_cfg;
-#ifdef SDIO
-	/** SDIO Single port rx aggr */
-	t_u8 sdio_rx_aggr_enable;
-	/* see blk_queue_max_segment_size */
-	t_u32 max_seg_size;
-	/* see blk_queue_max_segments */
-	t_u16 max_segs;
-#endif
-	/** Auto deep sleep */
-	t_u32 auto_ds;
-	/** IEEE PS mode */
-	t_u32 ps_mode;
-	/** Max Tx buffer size */
-	t_u32 max_tx_buf;
-#if defined(STA_SUPPORT)
-	/** 802.11d configuration */
-	t_u32 cfg_11d;
-#endif
-	/** Feature control bitmask */
-	t_u32 feature_control;
-	/** enable/disable rx work */
-	t_u8 rx_work;
-	/** dev cap mask */
-	t_u32 dev_cap_mask;
-	/** oob independent reset */
-	t_u32 indrstcfg;
-	/** dtim interval */
-	t_u16 multi_dtim;
-	/** IEEE ps inactivity timeout value */
-	t_u16 inact_tmo;
-	/** card type */
-	t_u16 card_type;
-	/** card rev */
-	t_u8 card_rev;
-	/** Host sleep wakeup interval */
-	t_u32 hs_wake_interval;
-	/** GPIO to indicate wakeup source */
-	t_u8 indication_gpio;
-	/** Dynamic MIMO-SISO switch for hscfg*/
-	t_u8 hs_mimo_switch;
-	/** channel time and mode for DRCS*/
-	t_u32 drcs_chantime_mode;
-#ifdef USB
-	/** Tx CMD endpoint address */
-	t_u8 tx_cmd_ep;
-	/** Rx CMD/EVT endpoint address */
-	t_u8 rx_cmd_ep;
-
-	/** Rx data endpoint address */
-	t_u8 rx_data_ep;
-	/** Tx data endpoint address */
-	t_u8 tx_data_ep;
-	/** Tx data second endpoint address */
-	t_u8 tx_data2_ep;
-#endif
-	/** passive to active scan */
-	t_u8 passive_to_active_scan;
-	/** uap max supported station per chip */
-	t_u8 uap_max_sta;
-	/** drv mode */
-	t_u32 drv_mode;
-	/** dfs w53 cfg */
-	t_u8 dfs53cfg;
-	/** dfs_offload */
-	t_u8 dfs_offload;
-	/** extend enhance scan */
-	t_u8 ext_scan;
-	/* mcs32 setting */
-	t_u8 mcs32;
-} mlan_device, *pmlan_device;
-
-/** MLAN API function prototype */
-#define MLAN_API
-
-/** Registration */
-MLAN_API mlan_status mlan_register(pmlan_device pmdevice,
-				   t_void **ppmlan_adapter);
-
-/** Un-registration */
-MLAN_API mlan_status mlan_unregister(t_void *padapter);
-
-/** Firmware Downloading */
-MLAN_API mlan_status mlan_dnld_fw(t_void *padapter, pmlan_fw_image pmfw);
-
-/** Custom data pass API */
-MLAN_API mlan_status mlan_set_init_param(t_void *padapter,
-					 pmlan_init_param pparam);
-
-/** Firmware Initialization */
-MLAN_API mlan_status mlan_init_fw(t_void *padapter);
-
-/** Firmware Shutdown */
-MLAN_API mlan_status mlan_shutdown_fw(t_void *padapter);
-
-/** Main Process */
-MLAN_API mlan_status mlan_main_process(t_void *padapter);
-
-/** Rx process */
-mlan_status mlan_rx_process(t_void *padapter, t_u8 *rx_pkts);
-
-/** Packet Transmission */
-MLAN_API mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf);
-
-#ifdef USB
-/** mlan_write_data_async_complete */
-MLAN_API mlan_status mlan_write_data_async_complete(t_void *padapter,
-						    pmlan_buffer pmbuf,
-						    t_u32 port,
-						    mlan_status status);
-
-/** Packet Reception */
-MLAN_API mlan_status mlan_recv(t_void *padapter, pmlan_buffer pmbuf,
-			       t_u32 port);
-#endif /* USB */
-
-/** Packet Reception complete callback */
-MLAN_API mlan_status mlan_recv_packet_complete(t_void *padapter,
-					       pmlan_buffer pmbuf,
-					       mlan_status status);
-
-/** handle amsdu deaggregated packet */
-void mlan_process_deaggr_pkt(t_void *padapter, pmlan_buffer pmbuf, t_u8 *drop);
-
-#if defined(SDIO) || defined(PCIE)
-/** interrupt handler */
-MLAN_API mlan_status mlan_interrupt(t_u16 msg_id, t_void *padapter);
-
-#if defined(SYSKT)
-/** GPIO IRQ callback function */
-MLAN_API t_void mlan_hs_callback(t_void *pctx);
-#endif /* SYSKT_MULTI || SYSKT */
-#endif /* SDIO || PCIE */
-
-MLAN_API t_void mlan_pm_wakeup_card(t_void *padapter, t_u8 keep_wakeup);
-
-MLAN_API t_u8 mlan_is_main_process_running(t_void *adapter);
-#ifdef PCIE
-MLAN_API t_void mlan_set_int_mode(t_void *adapter, t_u32 int_mode,
-				  t_u8 func_num);
-#endif
-/** mlan ioctl */
-MLAN_API mlan_status mlan_ioctl(t_void *padapter, pmlan_ioctl_req pioctl_req);
-/** mlan select wmm queue */
-MLAN_API t_u8 mlan_select_wmm_queue(t_void *padapter, t_u8 bss_num, t_u8 tid);
-
-/** mlan mask host interrupt */
-MLAN_API mlan_status mlan_disable_host_int(t_void *padapter);
-/** mlan unmask host interrupt */
-MLAN_API mlan_status mlan_enable_host_int(t_void *padapter);
-
-#define CSI_SIGNATURE 0xABCD
-
-#endif /* !_MLAN_DECL_H_ */
diff --git a/wlan_sd8987/mlinux/mlan_ieee.h b/wlan_sd8987/mlinux/mlan_ieee.h
deleted file mode 100755
index cf2ef85..0000000
--- a/wlan_sd8987/mlinux/mlan_ieee.h
+++ /dev/null
@@ -1,2146 +0,0 @@
-/** @file mlan_ieee.h
- *
- *  @brief This file contains IEEE information element related
- *  definitions used in MLAN and MOAL module.
- *
- *
- *  Copyright 2008-2022 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/******************************************************
-Change log:
-    11/03/2008: initial version
-******************************************************/
-
-#ifndef _MLAN_IEEE_H_
-#define _MLAN_IEEE_H_
-
-/** FIX IES size in beacon buffer */
-#define WLAN_802_11_FIXED_IE_SIZE 12
-/** WLAN supported rates */
-#define WLAN_SUPPORTED_RATES 14
-
-/** WLAN supported rates extension */
-#define WLAN_SUPPORTED_RATES_EXT 60
-
-/** Enumeration definition*/
-/** WLAN_802_11_NETWORK_TYPE */
-typedef enum _WLAN_802_11_NETWORK_TYPE {
-	Wlan802_11FH,
-	Wlan802_11DS,
-	/* Defined as upper bound*/
-	Wlan802_11NetworkTypeMax
-} WLAN_802_11_NETWORK_TYPE;
-
-#ifdef BIG_ENDIAN_SUPPORT
-/** Frame control: Type Mgmt frame */
-#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x3000
-/** Frame control: SubType Mgmt frame */
-#define IEEE80211_GET_FC_MGMT_FRAME_SUBTYPE(fc) (((fc)&0xF000) >> 12)
-#else
-/** Frame control: Type Mgmt frame */
-#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x000C
-/** Frame control: SubType Mgmt frame */
-#define IEEE80211_GET_FC_MGMT_FRAME_SUBTYPE(fc) (((fc)&0x00F0) >> 4)
-#endif
-
-#ifdef PRAGMA_PACK
-#pragma pack(push, 1)
-#endif
-
-/* Reason codes */
-#define IEEE_80211_REASONCODE_UNSPECIFIED 1
-
-typedef enum _IEEEtypes_Ext_ElementId_e {
-	HE_CAPABILITY = 35,
-	HE_OPERATION = 36,
-	HE_6G_CAPABILITY = 59
-} IEEEtypes_Ext_ElementId_e;
-
-/** IEEE Type definitions  */
-typedef MLAN_PACK_START enum _IEEEtypes_ElementId_e {
-	SSID = 0,
-	SUPPORTED_RATES = 1,
-
-	FH_PARAM_SET = 2,
-	DS_PARAM_SET = 3,
-	CF_PARAM_SET = 4,
-
-	IBSS_PARAM_SET = 6,
-	COUNTRY_INFO = 7,
-	POWER_CONSTRAINT = 32,
-	POWER_CAPABILITY = 33,
-	TPC_REQUEST = 34,
-	TPC_REPORT = 35,
-	CHANNEL_SWITCH_ANN = 37,
-	EXTEND_CHANNEL_SWITCH_ANN = 60,
-	QUIET = 40,
-	IBSS_DFS = 41,
-	SUPPORTED_CHANNELS = 36,
-	REGULATORY_CLASS = 59,
-	HT_CAPABILITY = 45,
-	QOS_INFO = 46,
-	HT_OPERATION = 61,
-	MULTI_BSSID = 71,
-	BSSCO_2040 = 72,
-	OVERLAPBSSSCANPARAM = 74,
-	NONTX_BSSID_CAP = 83,
-	MBSSID_INDEX = 85,
-	EXT_CAPABILITY = 127,
-	LINK_ID = 101,
-	/*IEEE802.11r*/
-	MOBILITY_DOMAIN = 54,
-	FAST_BSS_TRANSITION = 55,
-	TIMEOUT_INTERVAL = 56,
-	RIC = 57,
-	QOS_MAPPING = 110,
-	VHT_CAPABILITY = 191,
-	VHT_OPERATION = 192,
-	EXT_BSS_LOAD = 193,
-	BW_CHANNEL_SWITCH = 194,
-	VHT_TX_POWER_ENV = 195,
-	EXT_POWER_CONSTR = 196,
-	AID_INFO = 197,
-	QUIET_CHAN = 198,
-	OPER_MODE_NTF = 199,
-
-	ERP_INFO = 42,
-
-	EXTENDED_SUPPORTED_RATES = 50,
-
-	VENDOR_SPECIFIC_221 = 221,
-	WMM_IE = VENDOR_SPECIFIC_221,
-
-	WPS_IE = VENDOR_SPECIFIC_221,
-	/* WPA */
-	WPA_IE = VENDOR_SPECIFIC_221,
-	/* WPA2 */
-	RSN_IE = 48,
-	VS_IE = VENDOR_SPECIFIC_221,
-	WAPI_IE = 68,
-	FRAGMENT = 242,
-	RSNX_IE = 244,
-	EXTENSION = 255
-} MLAN_PACK_END IEEEtypes_ElementId_e;
-
-/** IEEE IE header */
-typedef MLAN_PACK_START struct _IEEEtypes_Header_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-} MLAN_PACK_END IEEEtypes_Header_t, *pIEEEtypes_Header_t;
-
-/** Vendor specific IE header */
-typedef MLAN_PACK_START struct _IEEEtypes_VendorHeader_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** OUI */
-	t_u8 oui[3];
-	/** OUI type */
-	t_u8 oui_type;
-	/** OUI subtype */
-	t_u8 oui_subtype;
-	/** Version */
-	t_u8 version;
-} MLAN_PACK_END IEEEtypes_VendorHeader_t, *pIEEEtypes_VendorHeader_t;
-
-/** Vendor specific IE */
-typedef MLAN_PACK_START struct _IEEEtypes_VendorSpecific_t {
-	/** Vendor specific IE header */
-	IEEEtypes_VendorHeader_t vend_hdr;
-	/** IE Max - size of previous fields */
-	t_u8 data[IEEE_MAX_IE_SIZE - sizeof(IEEEtypes_VendorHeader_t)];
-} MLAN_PACK_END IEEEtypes_VendorSpecific_t, *pIEEEtypes_VendorSpecific_t;
-
-/** IEEE IE */
-typedef MLAN_PACK_START struct _IEEEtypes_Generic_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** IE Max - size of previous fields */
-	t_u8 data[IEEE_MAX_IE_SIZE - sizeof(IEEEtypes_Header_t)];
-} MLAN_PACK_END IEEEtypes_Generic_t, *pIEEEtypes_Generic_t;
-
-/**ft capability policy*/
-typedef MLAN_PACK_START struct _IEEEtypes_FtCapPolicy_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Reserved */
-	t_u8 reserved : 6;
-	/** RIC support */
-	t_u8 ric : 1;
-	/** FT over the DS capable */
-	t_u8 ft_over_ds : 1;
-#else
-	/** FT over the DS capable */
-	t_u8 ft_over_ds : 1;
-	/** RIC support */
-	t_u8 ric : 1;
-	/** Reserved */
-	t_u8 reserved : 6;
-#endif
-} MLAN_PACK_END IEEEtypes_FtCapPolicy_t;
-
-/** Mobility domain IE */
-typedef MLAN_PACK_START struct _IEEEtypes_MobilityDomain_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** Mobility Domain ID */
-	t_u16 mdid;
-	/** FT Capability policy */
-	t_u8 ft_cap;
-} MLAN_PACK_END IEEEtypes_MobilityDomain_t;
-
-/**FT MIC Control*/
-typedef MLAN_PACK_START struct _IEEEtypes_FT_MICControl_t {
-	/** reserved */
-	t_u8 reserved;
-	/** element count */
-	t_u8 element_count;
-} MLAN_PACK_END IEEEtypes_FT_MICControl_t;
-
-/** FTIE MIC LEN */
-#define FTIE_MIC_LEN 16
-
-/**FT IE*/
-typedef MLAN_PACK_START struct _IEEEtypes_FastBssTransElement_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** mic control */
-	IEEEtypes_FT_MICControl_t mic_control;
-	/** mic */
-	t_u8 mic[FTIE_MIC_LEN];
-	/** ANonce */
-	t_u8 a_nonce[32];
-	/** SNonce */
-	t_u8 s_nonce[32];
-	/** sub element */
-	t_u8 sub_element[1];
-} MLAN_PACK_END IEEEtypes_FastBssTransElement_t;
-
-/*Category for FT*/
-#define FT_CATEGORY 6
-/** FT ACTION request */
-#define FT_ACTION_REQUEST 1
-/** FT ACTION response */
-#define FT_ACTION_RESPONSE 2
-
-/*FT response and FT ack*/
-typedef MLAN_PACK_START struct {
-	/** category */
-	t_u8 category;
-	/** action */
-	t_u8 action;
-	/** sta address */
-	t_u8 sta_addr[MLAN_MAC_ADDR_LENGTH];
-	/** target ap address */
-	t_u8 target_ap_addr[MLAN_MAC_ADDR_LENGTH];
-	/** status code */
-	t_u16 status_code;
-	/** varible */
-	t_u8 variable[];
-} MLAN_PACK_END IEEEtypes_Ft_action_response;
-
-/**FT request */
-typedef MLAN_PACK_START struct {
-	/** category */
-	t_u8 category;
-	/** action */
-	t_u8 action;
-	/** sta address */
-	t_u8 sta_addr[MLAN_MAC_ADDR_LENGTH];
-	/** target ap address */
-	t_u8 target_ap_addr[MLAN_MAC_ADDR_LENGTH];
-	/** varible */
-	t_u8 variable[];
-} MLAN_PACK_END IEEEtypes_Ft_action_request;
-
-/** auth frame body*/
-typedef MLAN_PACK_START struct {
-	/** auth alg */
-	t_u16 auth_alg;
-	/** auth transaction */
-	t_u16 auth_transaction;
-	/** status code */
-	t_u16 status_code;
-	/** variable */
-	t_u8 variable[];
-} MLAN_PACK_END IEEEtypes_Auth_framebody;
-
-/** associate request frame */
-typedef MLAN_PACK_START struct {
-	t_u16 capab_info;
-	t_u16 listen_interval;
-	/** followed by SSID and Supported rates */
-	t_u8 variablep[];
-} MLAN_PACK_END IEEEtypes_assoc_req;
-
-/*Mgmt frame*/
-typedef MLAN_PACK_START struct {
-	/** frame control */
-	t_u16 frame_control;
-	/** duration */
-	t_u16 duration;
-	/** dest address */
-	t_u8 da[MLAN_MAC_ADDR_LENGTH];
-	/** source address */
-	t_u8 sa[MLAN_MAC_ADDR_LENGTH];
-	/** bssid */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** seq control */
-	t_u16 seq_ctrl;
-	/** address 4 */
-	t_u8 addr4[MLAN_MAC_ADDR_LENGTH];
-	union {
-		IEEEtypes_Auth_framebody auth;
-		IEEEtypes_assoc_req assoc_req;
-		IEEEtypes_Ft_action_response ft_resp;
-		IEEEtypes_Ft_action_request ft_req;
-	} u;
-} MLAN_PACK_END IEEE80211_MGMT;
-
-/** TLV header */
-typedef MLAN_PACK_START struct _TLV_Generic_t {
-	/** Type */
-	t_u16 type;
-	/** Length */
-	t_u16 len;
-} MLAN_PACK_END TLV_Generic_t, *pTLV_Generic_t;
-
-/** Capability information mask */
-#define CAPINFO_MASK (~(MBIT(15) | MBIT(14) | MBIT(11) | MBIT(9)))
-
-/** Capability Bit Map*/
-#ifdef BIG_ENDIAN_SUPPORT
-typedef MLAN_PACK_START struct _IEEEtypes_CapInfo_t {
-	t_u8 rsrvd1 : 2;
-	t_u8 dsss_ofdm : 1;
-	t_u8 radio_measurement : 1;
-	t_u8 rsvrd2 : 1;
-	t_u8 short_slot_time : 1;
-	t_u8 rsrvd3 : 1;
-	t_u8 spectrum_mgmt : 1;
-	t_u8 chan_agility : 1;
-	t_u8 pbcc : 1;
-	t_u8 short_preamble : 1;
-	t_u8 privacy : 1;
-	t_u8 cf_poll_rqst : 1;
-	t_u8 cf_pollable : 1;
-	t_u8 ibss : 1;
-	t_u8 ess : 1;
-} MLAN_PACK_END IEEEtypes_CapInfo_t, *pIEEEtypes_CapInfo_t;
-#else
-typedef MLAN_PACK_START struct _IEEEtypes_CapInfo_t {
-	/** Capability Bit Map : ESS */
-	t_u8 ess : 1;
-	/** Capability Bit Map : IBSS */
-	t_u8 ibss : 1;
-	/** Capability Bit Map : CF pollable */
-	t_u8 cf_pollable : 1;
-	/** Capability Bit Map : CF poll request */
-	t_u8 cf_poll_rqst : 1;
-	/** Capability Bit Map : privacy */
-	t_u8 privacy : 1;
-	/** Capability Bit Map : Short preamble */
-	t_u8 short_preamble : 1;
-	/** Capability Bit Map : PBCC */
-	t_u8 pbcc : 1;
-	/** Capability Bit Map : Channel agility */
-	t_u8 chan_agility : 1;
-	/** Capability Bit Map : Spectrum management */
-	t_u8 spectrum_mgmt : 1;
-	/** Capability Bit Map : Reserved */
-	t_u8 rsrvd3 : 1;
-	/** Capability Bit Map : Short slot time */
-	t_u8 short_slot_time : 1;
-	/** Capability Bit Map : APSD */
-	t_u8 Apsd : 1;
-	/** Capability Bit Map : Reserved */
-	t_u8 rsvrd2 : 1;
-	/** Capability Bit Map : DSS OFDM */
-	t_u8 dsss_ofdm : 1;
-	/** Capability Bit Map : Reserved */
-	t_u8 rsrvd1 : 2;
-} MLAN_PACK_END IEEEtypes_CapInfo_t, *pIEEEtypes_CapInfo_t;
-#endif /* BIG_ENDIAN_SUPPORT */
-
-/** IEEEtypes_Ssid_t */
-typedef MLAN_PACK_START struct _IEEEtypes_Ssid_t {
-	/** SSID: Element ID */
-	t_u8 element_id;
-	/** SSID : Length */
-	t_u8 len;
-	/** ssid */
-	t_u8 ssid[MLAN_MAX_SSID_LENGTH];
-} MLAN_PACK_END IEEEtypes_Ssid_t, *pIEEEtypes_Ssid_t;
-
-/** IEEEtypes_CfParamSet_t */
-typedef MLAN_PACK_START struct _IEEEtypes_CfParamSet_t {
-	/** CF peremeter : Element ID */
-	t_u8 element_id;
-	/** CF peremeter : Length */
-	t_u8 len;
-	/** CF peremeter : Count */
-	t_u8 cfp_cnt;
-	/** CF peremeter : Period */
-	t_u8 cfp_period;
-	/** CF peremeter : Maximum duration */
-	t_u16 cfp_max_duration;
-	/** CF peremeter : Remaining duration */
-	t_u16 cfp_duration_remaining;
-} MLAN_PACK_END IEEEtypes_CfParamSet_t, *pIEEEtypes_CfParamSet_t;
-
-/** IEEEtypes_IbssParamSet_t */
-typedef MLAN_PACK_START struct _IEEEtypes_IbssParamSet_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** ATIM window value in milliseconds */
-	t_u16 atim_window;
-} MLAN_PACK_END IEEEtypes_IbssParamSet_t, *pIEEEtypes_IbssParamSet_t;
-
-/** IEEEtypes_SsParamSet_t */
-typedef MLAN_PACK_START union _IEEEtypes_SsParamSet_t {
-	/** SS parameter : CF parameter set */
-	IEEEtypes_CfParamSet_t cf_param_set;
-	/** SS parameter : IBSS parameter set */
-	IEEEtypes_IbssParamSet_t ibss_param_set;
-} MLAN_PACK_END IEEEtypes_SsParamSet_t, *pIEEEtypes_SsParamSet_t;
-
-/** IEEEtypes_FhParamSet_t */
-typedef MLAN_PACK_START struct _IEEEtypes_FhParamSet_t {
-	/** FH parameter : Element ID */
-	t_u8 element_id;
-	/** FH parameter : Length */
-	t_u8 len;
-	/** FH parameter : Dwell time in milliseconds */
-	t_u16 dwell_time;
-	/** FH parameter : Hop set */
-	t_u8 hop_set;
-	/** FH parameter : Hop pattern */
-	t_u8 hop_pattern;
-	/** FH parameter : Hop index */
-	t_u8 hop_index;
-} MLAN_PACK_END IEEEtypes_FhParamSet_t, *pIEEEtypes_FhParamSet_t;
-
-/** IEEEtypes_DsParamSet_t */
-typedef MLAN_PACK_START struct _IEEEtypes_DsParamSet_t {
-	/** DS parameter : Element ID */
-	t_u8 element_id;
-	/** DS parameter : Length */
-	t_u8 len;
-	/** DS parameter : Current channel */
-	t_u8 current_chan;
-} MLAN_PACK_END IEEEtypes_DsParamSet_t, *pIEEEtypes_DsParamSet_t;
-
-/** IEEEtypes_PhyParamSet_t */
-typedef MLAN_PACK_START union _IEEEtypes_PhyParamSet_t {
-	/** FH parameter set */
-	IEEEtypes_FhParamSet_t fh_param_set;
-	/** DS parameter set */
-	IEEEtypes_DsParamSet_t ds_param_set;
-} MLAN_PACK_END IEEEtypes_PhyParamSet_t, *pIEEEtypes_PhyParamSet_t;
-
-/** IEEEtypes_ERPInfo_t */
-typedef MLAN_PACK_START struct _IEEEtypes_ERPInfo_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** ERP flags */
-	t_u8 erp_flags;
-} MLAN_PACK_END IEEEtypes_ERPInfo_t, *pIEEEtypes_ERPInfo_t;
-
-/** IEEEtypes_AId_t */
-typedef t_u16 IEEEtypes_AId_t;
-
-/** IEEEtypes_StatusCode_t */
-typedef t_u16 IEEEtypes_StatusCode_t;
-
-/** Fixed size in assoc_resp */
-#define ASSOC_RESP_FIXED_SIZE 6
-
-/** IEEEtypes_SeqCtl_t */
-typedef MLAN_PACK_START struct _IEEEtypes_SeqCtl_t {
-	/** Fragment Number */
-	t_u16 FragNum : 4;
-	/** Sequence Number */
-	t_u16 SeqNum : 12;
-} MLAN_PACK_END IEEEtypes_SeqCtl_t;
-
-/** IEEEtypes_MgmtHdr_t */
-typedef MLAN_PACK_START struct _IEEEtypes_MgmtHdr_t {
-	/** FrmCtl*/
-	t_u16 FrmCtl;
-	/** Duration*/
-	t_u16 Duration;
-	/** Destination Addr*/
-	t_u8 DestAddr[6];
-	/** Source Addr*/
-	t_u8 SrcAddr[6];
-	/** BSSID */
-	t_u8 BssId[6];
-	/** IEEEtypes_SeqCtl_t */
-	IEEEtypes_SeqCtl_t SeqCtl;
-} MLAN_PACK_END IEEEtypes_MgmtHdr_t;
-
-/** IEEEtypes_AssocRsp_t */
-typedef MLAN_PACK_START struct _IEEEtypes_AssocRsp_t {
-	/** Capability information */
-	IEEEtypes_CapInfo_t capability;
-	/** Association response status code */
-	IEEEtypes_StatusCode_t status_code;
-	/** Association ID */
-	IEEEtypes_AId_t a_id;
-	/** IE data buffer */
-	t_u8 ie_buffer[1];
-} MLAN_PACK_END IEEEtypes_AssocRsp_t, *pIEEEtypes_AssocRsp_t;
-
-/** 802.11 supported rates */
-typedef t_u8 WLAN_802_11_RATES[WLAN_SUPPORTED_RATES];
-
-/** cipher TKIP */
-#define WPA_CIPHER_TKIP 2
-/** cipher AES */
-#define WPA_CIPHER_AES_CCM 4
-/** AKM: 8021x */
-#define RSN_AKM_8021X 1
-/** AKM: PSK */
-#define RSN_AKM_PSK 2
-/** AKM: PSK SHA256 */
-#define RSN_AKM_PSK_SHA256 6
-
-/** AKM: PSK SHA256 */
-#define RSN_AKM_SAE 8
-/** AKM: PSK SHA256 */
-#define RSN_AKM_OWE 18
-
-#if defined(STA_SUPPORT)
-/** Pairwise Cipher Suite length */
-#define PAIRWISE_CIPHER_SUITE_LEN 4
-/** AKM Suite length */
-#define AKM_SUITE_LEN 4
-/** MFPC bit in RSN capability */
-#define MFPC_BIT 7
-/** MFPR bit in RSN capability */
-#define MFPR_BIT 6
-/** PMF ORing mask */
-#define PMF_MASK 0x00c0
-#endif
-
-/** wpa_suite_t */
-typedef MLAN_PACK_START struct _wpa_suite_t {
-	/** OUI */
-	t_u8 oui[3];
-	/** tyep */
-	t_u8 type;
-} MLAN_PACK_END wpa_suite, wpa_suite_mcast_t;
-
-/** wpa_suite_ucast_t */
-typedef MLAN_PACK_START struct {
-	/* count */
-	t_u16 count;
-	/** wpa_suite list */
-	wpa_suite list[1];
-} MLAN_PACK_END wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
-
-/** IEEEtypes_Rsn_t */
-typedef MLAN_PACK_START struct _IEEEtypes_Rsn_t {
-	/** Rsn : Element ID */
-	t_u8 element_id;
-	/** Rsn : Length */
-	t_u8 len;
-	/** Rsn : version */
-	t_u16 version;
-	/** Rsn : group cipher */
-	wpa_suite_mcast_t group_cipher;
-	/** Rsn : pairwise cipher */
-	wpa_suite_ucast_t pairwise_cipher;
-} MLAN_PACK_END IEEEtypes_Rsn_t, *pIEEEtypes_Rsn_t;
-
-/** IEEEtypes_Wpa_t */
-typedef MLAN_PACK_START struct _IEEEtypes_Wpa_t {
-	/** Wpa : Element ID */
-	t_u8 element_id;
-	/** Wpa : Length */
-	t_u8 len;
-	/** Wpa : oui */
-	t_u8 oui[4];
-	/** version */
-	t_u16 version;
-	/** Wpa : group cipher */
-	wpa_suite_mcast_t group_cipher;
-	/** Wpa : pairwise cipher */
-	wpa_suite_ucast_t pairwise_cipher;
-} MLAN_PACK_END IEEEtypes_Wpa_t, *pIEEEtypes_Wpa_t;
-
-/** Data structure of WMM QoS information */
-typedef MLAN_PACK_START struct _IEEEtypes_WmmQosInfo_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** QoS UAPSD */
-	t_u8 qos_uapsd : 1;
-	/** Reserved */
-	t_u8 reserved : 3;
-	/** Parameter set count */
-	t_u8 para_set_count : 4;
-#else
-	/** Parameter set count */
-	t_u8 para_set_count : 4;
-	/** Reserved */
-	t_u8 reserved : 3;
-	/** QoS UAPSD */
-	t_u8 qos_uapsd : 1;
-#endif /* BIG_ENDIAN_SUPPORT */
-} MLAN_PACK_END IEEEtypes_WmmQosInfo_t, *pIEEEtypes_WmmQosInfo_t;
-
-/** Data structure of WMM Aci/Aifsn */
-typedef MLAN_PACK_START struct _IEEEtypes_WmmAciAifsn_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Reserved */
-	t_u8 reserved : 1;
-	/** Aci */
-	t_u8 aci : 2;
-	/** Acm */
-	t_u8 acm : 1;
-	/** Aifsn */
-	t_u8 aifsn : 4;
-#else
-	/** Aifsn */
-	t_u8 aifsn : 4;
-	/** Acm */
-	t_u8 acm : 1;
-	/** Aci */
-	t_u8 aci : 2;
-	/** Reserved */
-	t_u8 reserved : 1;
-#endif /* BIG_ENDIAN_SUPPORT */
-} MLAN_PACK_END IEEEtypes_WmmAciAifsn_t, *pIEEEtypes_WmmAciAifsn_t;
-
-/** Data structure of WMM ECW */
-typedef MLAN_PACK_START struct _IEEEtypes_WmmEcw_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Maximum Ecw */
-	t_u8 ecw_max : 4;
-	/** Minimum Ecw */
-	t_u8 ecw_min : 4;
-#else
-	/** Minimum Ecw */
-	t_u8 ecw_min : 4;
-	/** Maximum Ecw */
-	t_u8 ecw_max : 4;
-#endif /* BIG_ENDIAN_SUPPORT */
-} MLAN_PACK_END IEEEtypes_WmmEcw_t, *pIEEEtypes_WmmEcw_t;
-
-/** Data structure of WMM AC parameters  */
-typedef MLAN_PACK_START struct _IEEEtypes_WmmAcParameters_t {
-	IEEEtypes_WmmAciAifsn_t aci_aifsn; /**< AciAifSn */
-	IEEEtypes_WmmEcw_t ecw; /**< Ecw */
-	t_u16 tx_op_limit; /**< Tx op limit */
-} MLAN_PACK_END IEEEtypes_WmmAcParameters_t, *pIEEEtypes_WmmAcParameters_t;
-
-/** Data structure of WMM Info IE  */
-typedef MLAN_PACK_START struct _IEEEtypes_WmmInfo_t {
-	/**
-	 * WMM Info IE - Vendor Specific Header:
-	 *   element_id  [221/0xdd]
-	 *   Len         [7]
-	 *   Oui         [00:50:f2]
-	 *   OuiType     [2]
-	 *   OuiSubType  [0]
-	 *   Version     [1]
-	 */
-	IEEEtypes_VendorHeader_t vend_hdr;
-
-	/** QoS information */
-	IEEEtypes_WmmQosInfo_t qos_info;
-
-} MLAN_PACK_END IEEEtypes_WmmInfo_t, *pIEEEtypes_WmmInfo_t;
-
-/** Data structure of WMM parameter IE  */
-typedef MLAN_PACK_START struct _IEEEtypes_WmmParameter_t {
-	/**
-	 * WMM Parameter IE - Vendor Specific Header:
-	 *   element_id  [221/0xdd]
-	 *   Len         [24]
-	 *   Oui         [00:50:f2]
-	 *   OuiType     [2]
-	 *   OuiSubType  [1]
-	 *   Version     [1]
-	 */
-	IEEEtypes_VendorHeader_t vend_hdr;
-
-	/** QoS information */
-	IEEEtypes_WmmQosInfo_t qos_info;
-	/** Reserved */
-	t_u8 reserved;
-
-	/** AC Parameters Record WMM_AC_BE, WMM_AC_BK, WMM_AC_VI, WMM_AC_VO */
-	IEEEtypes_WmmAcParameters_t ac_params[MAX_AC_QUEUES];
-} MLAN_PACK_END IEEEtypes_WmmParameter_t, *pIEEEtypes_WmmParameter_t;
-
-/** Enumerator for TSPEC direction */
-typedef MLAN_PACK_START enum _IEEEtypes_WMM_TSPEC_TS_Info_Direction_e {
-
-	TSPEC_DIR_UPLINK = 0,
-	TSPEC_DIR_DOWNLINK = 1,
-	/* 2 is a reserved value */
-	TSPEC_DIR_BIDIRECT = 3,
-
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_TS_Info_Direction_e;
-
-/** Enumerator for TSPEC PSB */
-typedef MLAN_PACK_START enum _IEEEtypes_WMM_TSPEC_TS_Info_PSB_e {
-
-	TSPEC_PSB_LEGACY = 0,
-	TSPEC_PSB_TRIG = 1,
-
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_TS_Info_PSB_e;
-
-/** Enumerator for TSPEC Ack Policy */
-typedef MLAN_PACK_START enum _IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e {
-
-	TSPEC_ACKPOLICY_NORMAL = 0,
-	TSPEC_ACKPOLICY_NOACK = 1,
-	/* 2 is reserved */
-	TSPEC_ACKPOLICY_BLOCKACK = 3,
-
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e;
-
-/** Enumerator for TSPEC Trafffice type */
-typedef MLAN_PACK_START enum _IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e {
-
-	TSPEC_TRAFFIC_APERIODIC = 0,
-	TSPEC_TRAFFIC_PERIODIC = 1,
-
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e;
-
-/** Data structure of WMM TSPEC information */
-typedef MLAN_PACK_START struct {
-#ifdef BIG_ENDIAN_SUPPORT
-	t_u8 Reserved17_23 : 7; /* ! Reserved */
-	t_u8 Schedule : 1;
-	IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e AckPolicy : 2;
-	t_u8 UserPri : 3; /* ! 802.1d User Priority */
-	// IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /*
-	// !Legacy/Trigg*/
-	t_u8 PowerSaveBehavior : 1;
-	t_u8 Aggregation : 1; /* ! Reserved */
-	t_u8 AccessPolicy2 : 1; /* ! */
-	t_u8 AccessPolicy1 : 1; /* ! */
-	IEEEtypes_WMM_TSPEC_TS_Info_Direction_e Direction : 2;
-	t_u8 TID : 4; /* ! Unique identifier */
-	// IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
-	t_u8 TrafficType : 1;
-#else
-	// IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
-	t_u8 TrafficType : 1;
-	t_u8 TID : 4; /* ! Unique identifier */
-	IEEEtypes_WMM_TSPEC_TS_Info_Direction_e Direction : 2;
-	t_u8 AccessPolicy1 : 1; /* ! */
-	t_u8 AccessPolicy2 : 1; /* ! */
-	t_u8 Aggregation : 1; /* ! Reserved */
-	// IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /* !
-	// Legacy/Trigg*/
-	t_u8 PowerSaveBehavior : 1;
-	t_u8 UserPri : 3; /* ! 802.1d User Priority */
-	IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e AckPolicy : 2;
-	t_u8 Schedule : 1;
-	t_u8 Reserved17_23 : 7; /* ! Reserved */
-#endif
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_TS_Info_t;
-
-/** Data structure of WMM TSPEC Nominal Size */
-typedef MLAN_PACK_START struct {
-#ifdef BIG_ENDIAN_SUPPORT
-	t_u16 Fixed : 1; /* ! 1: Fixed size given in Size, 0: Var, size is
-			    nominal */
-	t_u16 Size : 15; /* ! Nominal size in octets */
-#else
-	t_u16 Size : 15; /* ! Nominal size in octets */
-	t_u16 Fixed : 1; /* ! 1: Fixed size given in Size, 0: Var, size is
-			    nominal */
-#endif
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_NomMSDUSize_t;
-
-/** Data structure of WMM TSPEC SBWA */
-typedef MLAN_PACK_START struct {
-#ifdef BIG_ENDIAN_SUPPORT
-	t_u16 Whole : 3; /* ! Whole portion */
-	t_u16 Fractional : 13; /* ! Fractional portion */
-#else
-	t_u16 Fractional : 13; /* ! Fractional portion */
-	t_u16 Whole : 3; /* ! Whole portion */
-#endif
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_SBWA;
-
-/** Data structure of WMM TSPEC Body */
-typedef MLAN_PACK_START struct {
-	IEEEtypes_WMM_TSPEC_TS_Info_t TSInfo;
-	IEEEtypes_WMM_TSPEC_NomMSDUSize_t NomMSDUSize;
-	t_u16 MaximumMSDUSize;
-	t_u32 MinServiceInterval;
-	t_u32 MaxServiceInterval;
-	t_u32 InactivityInterval;
-	t_u32 SuspensionInterval;
-	t_u32 ServiceStartTime;
-	t_u32 MinimumDataRate;
-	t_u32 MeanDataRate;
-	t_u32 PeakDataRate;
-	t_u32 MaxBurstSize;
-	t_u32 DelayBound;
-	t_u32 MinPHYRate;
-	IEEEtypes_WMM_TSPEC_SBWA SurplusBWAllowance;
-	t_u16 MediumTime;
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_Body_t;
-
-/** Data structure of WMM TSPEC all elements */
-typedef MLAN_PACK_START struct {
-	t_u8 ElementId;
-	t_u8 Len;
-	t_u8 OuiType[4]; /* 00:50:f2:02 */
-	t_u8 OuiSubType; /* 01 */
-	t_u8 Version;
-
-	IEEEtypes_WMM_TSPEC_Body_t TspecBody;
-
-} MLAN_PACK_END IEEEtypes_WMM_TSPEC_t;
-
-/** WMM Action Category values */
-typedef MLAN_PACK_START enum _IEEEtypes_ActionCategory_e {
-
-	IEEE_MGMT_ACTION_CATEGORY_SPECTRUM_MGMT = 0,
-	IEEE_MGMT_ACTION_CATEGORY_QOS = 1,
-	IEEE_MGMT_ACTION_CATEGORY_DLS = 2,
-	IEEE_MGMT_ACTION_CATEGORY_BLOCK_ACK = 3,
-	IEEE_MGMT_ACTION_CATEGORY_PUBLIC = 4,
-	IEEE_MGMT_ACTION_CATEGORY_RADIO_RSRC = 5,
-	IEEE_MGMT_ACTION_CATEGORY_FAST_BSS_TRANS = 6,
-	IEEE_MGMT_ACTION_CATEGORY_HT = 7,
-
-	IEEE_MGMT_ACTION_CATEGORY_WNM = 10,
-	IEEE_MGMT_ACTION_CATEGORY_UNPROTECT_WNM = 11,
-
-	IEEE_MGMT_ACTION_CATEGORY_WMM_TSPEC = 17
-
-} MLAN_PACK_END IEEEtypes_ActionCategory_e;
-
-/** WMM TSPEC operations */
-typedef MLAN_PACK_START enum _IEEEtypes_WMM_Tspec_Action_e {
-
-	TSPEC_ACTION_CODE_ADDTS_REQ = 0,
-	TSPEC_ACTION_CODE_ADDTS_RSP = 1,
-	TSPEC_ACTION_CODE_DELTS = 2,
-
-} MLAN_PACK_END IEEEtypes_WMM_Tspec_Action_e;
-
-/** WMM TSPEC Category Action Base */
-typedef MLAN_PACK_START struct {
-	IEEEtypes_ActionCategory_e category;
-	IEEEtypes_WMM_Tspec_Action_e action;
-	t_u8 dialogToken;
-
-} MLAN_PACK_END IEEEtypes_WMM_Tspec_Action_Base_Tspec_t;
-
-/** WMM TSPEC AddTS request structure */
-typedef MLAN_PACK_START struct {
-	IEEEtypes_WMM_Tspec_Action_Base_Tspec_t tspecAct;
-	t_u8 statusCode;
-	IEEEtypes_WMM_TSPEC_t tspecIE;
-
-	/* Place holder for additional elements after the TSPEC */
-	t_u8 subElem[256];
-
-} MLAN_PACK_END IEEEtypes_Action_WMM_AddTsReq_t;
-
-/** WMM TSPEC AddTS response structure */
-typedef MLAN_PACK_START struct {
-	IEEEtypes_WMM_Tspec_Action_Base_Tspec_t tspecAct;
-	t_u8 statusCode;
-	IEEEtypes_WMM_TSPEC_t tspecIE;
-
-	/* Place holder for additional elements after the TSPEC */
-	t_u8 subElem[256];
-
-} MLAN_PACK_END IEEEtypes_Action_WMM_AddTsRsp_t;
-
-/** WMM TSPEC DelTS structure */
-typedef MLAN_PACK_START struct {
-	IEEEtypes_WMM_Tspec_Action_Base_Tspec_t tspecAct;
-	t_u8 reasonCode;
-	IEEEtypes_WMM_TSPEC_t tspecIE;
-
-} MLAN_PACK_END IEEEtypes_Action_WMM_DelTs_t;
-
-/** union of WMM TSPEC structures */
-typedef MLAN_PACK_START union {
-	IEEEtypes_WMM_Tspec_Action_Base_Tspec_t tspecAct;
-
-	IEEEtypes_Action_WMM_AddTsReq_t addTsReq;
-	IEEEtypes_Action_WMM_AddTsRsp_t addTsRsp;
-	IEEEtypes_Action_WMM_DelTs_t delTs;
-
-} MLAN_PACK_END IEEEtypes_Action_WMMAC_t;
-
-/** union of WMM TSPEC & Action category */
-typedef MLAN_PACK_START union {
-	IEEEtypes_ActionCategory_e category;
-
-	IEEEtypes_Action_WMMAC_t wmmAc;
-
-} MLAN_PACK_END IEEEtypes_ActionFrame_t;
-
-/** Data structure for subband set */
-typedef MLAN_PACK_START struct _IEEEtypes_SubbandSet_t {
-	/** First channel */
-	t_u8 first_chan;
-	/** Number of channels */
-	t_u8 no_of_chan;
-	/** Maximum Tx power in dBm */
-	t_u8 max_tx_pwr;
-} MLAN_PACK_END IEEEtypes_SubbandSet_t, *pIEEEtypes_SubbandSet_t;
-
-#ifdef STA_SUPPORT
-/** Data structure for Country IE */
-typedef MLAN_PACK_START struct _IEEEtypes_CountryInfoSet_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** Country code */
-	t_u8 country_code[COUNTRY_CODE_LEN];
-	/** Set of subbands */
-	IEEEtypes_SubbandSet_t sub_band[1];
-} MLAN_PACK_END IEEEtypes_CountryInfoSet_t, *pIEEEtypes_CountryInfoSet_t;
-
-/** Data structure for Country IE full set */
-typedef MLAN_PACK_START struct _IEEEtypes_CountryInfoFullSet_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** Country code */
-	t_u8 country_code[COUNTRY_CODE_LEN];
-	/** Set of subbands */
-	IEEEtypes_SubbandSet_t sub_band[MRVDRV_MAX_SUBBAND_802_11D];
-} MLAN_PACK_END IEEEtypes_CountryInfoFullSet_t,
-	*pIEEEtypes_CountryInfoFullSet_t;
-
-#endif /* STA_SUPPORT */
-
-/** Data structure for Link ID */
-typedef MLAN_PACK_START struct _IEEEtypes_LinkIDElement_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** bssid */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** initial sta address */
-	t_u8 init_sta[MLAN_MAC_ADDR_LENGTH];
-	/** respose sta address */
-	t_u8 resp_sta[MLAN_MAC_ADDR_LENGTH];
-} MLAN_PACK_END IEEEtypes_LinkIDElement_t, *pIEEEtypes_LinkIDElement_t;
-
-/** HT Capabilities Data */
-typedef struct MLAN_PACK_START _HTCap_t {
-	/** HT Capabilities Info field */
-	t_u16 ht_cap_info;
-	/** A-MPDU Parameters field */
-	t_u8 ampdu_param;
-	/** Supported MCS Set field */
-	t_u8 supported_mcs_set[16];
-	/** HT Extended Capabilities field */
-	t_u16 ht_ext_cap;
-	/** Transmit Beamforming Capabilities field */
-	t_u32 tx_bf_cap;
-	/** Antenna Selection Capability field */
-	t_u8 asel;
-} MLAN_PACK_END HTCap_t, *pHTCap_t;
-
-/** HT Information Data */
-typedef struct MLAN_PACK_START _HTInfo_t {
-	/** Primary channel */
-	t_u8 pri_chan;
-	/** Field 2 */
-	t_u8 field2;
-	/** Field 3 */
-	t_u16 field3;
-	/** Field 4 */
-	t_u16 field4;
-	/** Bitmap indicating MCSs supported by all HT STAs in the BSS */
-	t_u8 basic_mcs_set[16];
-} MLAN_PACK_END HTInfo_t, *pHTInfo_t;
-
-/** 20/40 BSS Coexistence Data */
-typedef struct MLAN_PACK_START _BSSCo2040_t {
-	/** 20/40 BSS Coexistence value */
-	t_u8 bss_co_2040_value;
-} MLAN_PACK_END BSSCo2040_t, *pBSSCo2040_t;
-
-#define MAX_DSCP_EXCEPTION_NUM 21
-/** DSCP Range */
-typedef struct MLAN_PACK_START _DSCP_Exception_t {
-	/* DSCP value 0 to 63 or ff */
-	t_u8 dscp_value;
-	/* user priority 0-7*/
-	t_u8 user_priority;
-} MLAN_PACK_END DSCP_Exception_t, *pDSCP_Exception_t;
-
-/** DSCP Range */
-typedef struct MLAN_PACK_START _DSCP_Range_t {
-	/* DSCP low value */
-	t_u8 dscp_low_value;
-	/* DSCP high value */
-	t_u8 dscp_high_value;
-} MLAN_PACK_END DSCP_Range_t, *pDSCP_Range_t;
-
-/** Overlapping BSS Scan Parameters Data */
-typedef struct MLAN_PACK_START _OverlapBSSScanParam_t {
-	/** OBSS Scan Passive Dwell in milliseconds */
-	t_u16 obss_scan_passive_dwell;
-	/** OBSS Scan Active Dwell in milliseconds */
-	t_u16 obss_scan_active_dwell;
-	/** BSS Channel Width Trigger Scan Interval in seconds */
-	t_u16 bss_chan_width_trigger_scan_int;
-	/** OBSS Scan Passive Total Per Channel */
-	t_u16 obss_scan_passive_total;
-	/** OBSS Scan Active Total Per Channel */
-	t_u16 obss_scan_active_total;
-	/** BSS Width Channel Transition Delay Factor */
-	t_u16 bss_width_chan_trans_delay;
-	/** OBSS Scan Activity Threshold */
-	t_u16 obss_scan_active_threshold;
-} MLAN_PACK_END OBSSScanParam_t, *pOBSSScanParam_t;
-
-/** HT Capabilities IE */
-typedef MLAN_PACK_START struct _IEEEtypes_HTCap_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** HTCap struct */
-	HTCap_t ht_cap;
-} MLAN_PACK_END IEEEtypes_HTCap_t, *pIEEEtypes_HTCap_t;
-
-/** HT Information IE */
-typedef MLAN_PACK_START struct _IEEEtypes_HTInfo_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** HTInfo struct */
-	HTInfo_t ht_info;
-} MLAN_PACK_END IEEEtypes_HTInfo_t, *pIEEEtypes_HTInfo_t;
-
-/** the AP which send the multi_bssid IE */
-#define MULTI_BSSID_AP 1
-/** the AP which don't send beacon */
-#define MULTI_BSSID_SUB_AP 2
-/** IEEEtypes_NotxBssCap_t */
-typedef MLAN_PACK_START struct _IEEEtypes_NotxBssCap_t {
-	/** Nontransmitted BSSID Capability: Element ID */
-	t_u8 element_id;
-	/** Nontransmitted BSSID Capability : Length */
-	t_u8 len;
-	/** capability */
-	t_u16 cap;
-} MLAN_PACK_END IEEEtypes_NotxBssCap_t, *pIEEEtypes_NotxBssCap_t;
-
-/** Multi BSSID IE */
-typedef MLAN_PACK_START struct _IEEEtypes_MultiBSSIDIndex_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** BSSID Index */
-	t_u8 bssid_index;
-	/** DTIM Period (Optional, not Present in ProbeRsp) */
-	t_u8 dtim_period;
-	/** DTIM Count (Optional, not Present in ProbeRsp) */
-	t_u8 dtim_count;
-} MLAN_PACK_END IEEEtypes_MultiBSSIDIndex_t, *pIEEEtypes_MultiBSSIDIndex_t;
-
-/** NonTransmitted BSSID Profile Subelement IE */
-/** SUBID for IEEEtypes_NonTransBSSIDCap_t */
-#define NONTRANS_BSSID_PROFILE_SUBELEM_ID 0
-
-/** NonTransmitted BSSID Capability IE */
-typedef MLAN_PACK_START struct _IEEEtypes_NonTransBSSIDProfile_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 profile_data[];
-} MLAN_PACK_END IEEEtypes_NonTransBSSIDProfile_t,
-	*pIEEEtypes_NonTransBSSIDProfile_t;
-
-/** Multi BSSID IE */
-typedef MLAN_PACK_START struct _IEEEtypes_MultiBSSID_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** Max BSSID Indicator */
-	t_u8 max_bssid_indicator;
-	/** Optional Subelement data*/
-	t_u8 sub_elem_data[];
-} MLAN_PACK_END IEEEtypes_MultiBSSID_t, *pIEEEtypes_MultiBSSID_t;
-/** 20/40 BSS Coexistence IE */
-typedef MLAN_PACK_START struct _IEEEtypes_2040BSSCo_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** BSSCo2040_t struct */
-	BSSCo2040_t bss_co_2040;
-} MLAN_PACK_END IEEEtypes_2040BSSCo_t, *pIEEEtypes_2040BSSCo_t;
-
-/** Extended Capabilities IE */
-typedef MLAN_PACK_START struct _IEEEtypes_ExtCap_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** ExtCap_t struct */
-	ExtCap_t ext_cap;
-} MLAN_PACK_END IEEEtypes_ExtCap_t, *pIEEEtypes_ExtCap_t;
-
-/** Overlapping BSS Scan Parameters IE */
-typedef MLAN_PACK_START struct _IEEEtypes_OverlapBSSScanParam_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** OBSSScanParam_t struct */
-	OBSSScanParam_t obss_scan_param;
-} MLAN_PACK_END IEEEtypes_OverlapBSSScanParam_t,
-	*pIEEEtypes_OverlapBSSScanParam_t;
-
-/** VHT MCS rate set field, refer to 802.11ac */
-typedef MLAN_PACK_START struct _VHT_MCS_set {
-	t_u16 rx_mcs_map;
-	t_u16 rx_max_rate; /* bit 29-31 reserved */
-	t_u16 tx_mcs_map;
-	t_u16 tx_max_rate; /* bit 61-63 reserved */
-} MLAN_PACK_END VHT_MCS_set_t, *pVHT_MCS_set_t;
-
-/** VHT Capabilities info field, reference 802.11ac D1.4 p89 */
-typedef MLAN_PACK_START struct _VHT_capa {
-#if 0
-#ifdef BIG_ENDIAN_SUPPORT
-    t_u8 mpdu_max_len:2;
-    t_u8 chan_width:2;
-    t_u8 rx_LDPC:1;
-    t_u8 sgi_80:1;
-    t_u8 sgi_160:1;
-    t_u8 tx_STBC:1;
-    t_u8 rx_STBC:3;
-    t_u8 SU_beamformer_capa:1;
-    t_u8 SU_beamformee_capa:1;
-    t_u8 beamformer_ante_num:3;
-    t_u8 sounding_dim_num:3;
-    t_u8 MU_beamformer_capa:1;
-    t_u8 MU_beamformee_capa:1;
-    t_u8 VHT_TXOP_ps:1;
-    t_u8 HTC_VHT_capa:1;
-    t_u8 max_ampdu_len:3;
-    t_u8 link_apapt_capa:2;
-    t_u8 reserved_1:4;
-#else
-    t_u8 reserved_1:4;
-    t_u8 link_apapt_capa:2;
-    t_u8 max_ampdu_len:3;
-    t_u8 HTC_VHT_capa:1;
-    t_u8 VHT_TXOP_ps:1;
-    t_u8 MU_beamformee_capa:1;
-    t_u8 MU_beamformer_capa:1;
-    t_u8 sounding_dim_num:3;
-    t_u8 beamformer_ante_num:3;
-    t_u8 SU_beamformee_capa:1;
-    t_u8 SU_beamformer_capa:1;
-    t_u8 rx_STBC:3;
-    t_u8 tx_STBC:1;
-    t_u8 sgi_160:1;
-    t_u8 sgi_80:1;
-    t_u8 rx_LDPC:1;
-    t_u8 chan_width:2;
-    t_u8 mpdu_max_len:2;
-#endif /* BIG_ENDIAN_SUPPORT */
-#endif
-	t_u32 vht_cap_info;
-	VHT_MCS_set_t mcs_sets;
-} MLAN_PACK_END VHT_capa_t, *pVHT_capa_t;
-
-/** VHT Capabilities IE */
-typedef MLAN_PACK_START struct _IEEEtypes_VHTCap_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	VHT_capa_t vht_cap;
-} MLAN_PACK_END IEEEtypes_VHTCap_t, *pIEEEtypes_VHTCap_t;
-
-#define VHT_CAP_CHWD_80MHZ 0
-#define VHT_CAP_CHWD_160MHZ 1
-#define VHT_CAP_CHWD_80_80MHZ 2
-
-/** VHT Operations IE */
-typedef MLAN_PACK_START struct _IEEEtypes_VHTOprat_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 chan_width;
-	t_u8 chan_center_freq_1;
-	t_u8 chan_center_freq_2;
-	/** Basic MCS set map, each 2 bits stands for a Nss */
-	t_u16 basic_MCS_map;
-} MLAN_PACK_END IEEEtypes_VHTOprat_t, *pIEEEtypes_VHTOprat_t;
-
-#define VHT_OPER_CHWD_20_40MHZ 0
-#define VHT_OPER_CHWD_80MHZ 1
-#define VHT_OPER_CHWD_160MHZ 2
-#define VHT_OPER_CHWD_80_80MHZ 3
-
-/** VHT Transmit Power Envelope IE */
-typedef MLAN_PACK_START struct _IEEEtypes_VHTtxpower_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 max_tx_power;
-	t_u8 chan_center_freq;
-	t_u8 chan_width;
-} MLAN_PACK_END IEEEtypes_VHTtxpower_t, *pIEEEtypes_VHTtxpower_t;
-
-/** Extended Power Constraint IE */
-typedef MLAN_PACK_START struct _IEEEtypes_ExtPwerCons_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** channel width */
-	t_u8 chan_width;
-	/** local power constraint */
-	t_u8 local_power_cons;
-} MLAN_PACK_END IEEEtypes_ExtPwerCons_t, *pIEEEtypes_ExtPwerCons_t;
-
-/** Extended BSS Load IE */
-typedef MLAN_PACK_START struct _IEEEtypes_ExtBSSload_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 MU_MIMO_capa_count;
-	t_u8 stream_underutilization;
-	t_u8 VHT40_util;
-	t_u8 VHT80_util;
-	t_u8 VHT160_util;
-} MLAN_PACK_END IEEEtypes_ExtBSSload_t, *pIEEEtypes_ExtBSSload_t;
-
-/** Quiet Channel IE */
-typedef MLAN_PACK_START struct _IEEEtypes_QuietChan_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 AP_quiet_mode;
-	t_u8 quiet_count;
-	t_u8 quiet_period;
-	t_u16 quiet_dur;
-	t_u16 quiet_offset;
-} MLAN_PACK_END IEEEtypes_QuietChan_t, *pIEEEtypes_QuietChan_t;
-
-/** Wide Bandwidth Channel Switch IE */
-typedef MLAN_PACK_START struct _IEEEtypes_BWSwitch_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 new_chan_width;
-	t_u8 new_chan_center_freq_1;
-	t_u8 new_chan_center_freq_2;
-} MLAN_PACK_END IEEEtypes_BWSwitch_t, *pIEEEtypes_BWSwitch_t;
-
-/** AID IE */
-typedef MLAN_PACK_START struct _IEEEtypes_AID_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** AID number */
-	t_u16 AID;
-} MLAN_PACK_END IEEEtypes_AID_t, *pIEEEtypes_AID_t;
-
-/** Operating Mode Notificaton IE */
-typedef MLAN_PACK_START struct _IEEEtypes_OperModeNtf_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** Operating Mode */
-	t_u8 oper_mode;
-} MLAN_PACK_END IEEEtypes_OperModeNtf_t, *pIEEEtypes_OperModeNtf_t;
-
-typedef MLAN_PACK_START struct _IEEEtypes_Extension_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** Element id extension */
-	t_u8 ext_id;
-	/** payload */
-	t_u8 data[];
-} MLAN_PACK_END IEEEtypes_Extension_t, *pIEEEtypes_Extension_t;
-
-typedef MLAN_PACK_START struct _IEEEtypes_HeMcsMap_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Max HE-MAC for 8 SS */
-	t_u8 max_mcs_8ss : 2;
-	/** Max HE-MAC for 7 SS */
-	t_u8 max_mcs_7ss : 2;
-	/** Max HE-MAC for 6 SS */
-	t_u8 max_mcs_6ss : 2;
-	/** Max HE-MAC for 5 SS */
-	t_u8 max_mcs_5ss : 2;
-	/** Max HE-MAC for 4 SS */
-	t_u8 max_mcs_4ss : 2;
-	/** Max HE-MAC for 3 SS */
-	t_u8 max_mcs_3ss : 2;
-	/** Max HE-MAC for 2 SS */
-	t_u8 max_mcs_2ss : 2;
-	/** Max HE-MAC for 1 SS */
-	t_u8 max_mcs_1ss : 2;
-#else
-	/** Max HE-MAC for 1 SS */
-	t_u8 max_mcs_1ss : 2;
-	/** Max HE-MAC for 2 SS */
-	t_u8 max_mcs_2ss : 2;
-	/** Max HE-MAC for 3 SS */
-	t_u8 max_mcs_3ss : 2;
-	/** Max HE-MAC for 4 SS */
-	t_u8 max_mcs_4ss : 2;
-	/** Max HE-MAC for 5 SS */
-	t_u8 max_mcs_5ss : 2;
-	/** Max HE-MAC for 6 SS */
-	t_u8 max_mcs_6ss : 2;
-	/** Max HE-MAC for 7 SS */
-	t_u8 max_mcs_7ss : 2;
-	/** Max HE-MAC for 8 SS */
-	t_u8 max_mcs_8ss : 2;
-#endif
-} MLAN_PACK_END IEEEtypes_HeMcsMap_t, *pIEEEtypes_HeMcsMap_t;
-
-typedef MLAN_PACK_START struct _IEEEtypes_HeMcsNss_t {
-	/** HE Rx MCS and NSS Set */
-	t_u16 rx_mcs;
-	/** HE Tx MCS and NSS Set*/
-	t_u16 tx_mcs;
-} MLAN_PACK_END IEEEtypes_HeMcsNss_t, *pIEEEtypes_HeMcsNss_t;
-
-typedef MLAN_PACK_START struct _IEEEtypes_HECap_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** Element id extension */
-	t_u8 ext_id;
-	/** he mac capability info */
-	t_u8 he_mac_cap[6];
-	/** he phy capability info */
-	t_u8 he_phy_cap[11];
-	/** he txrx mcs support (for 80 MHz) */
-	t_u8 he_txrx_mcs_support[4];
-	/** Optional Field, including he_txrx_mcs_support for 160 and 80+80 MHz,
-	 * and PPE Thresholds */
-	t_u8 option[28];
-} MLAN_PACK_END IEEEtypes_HECap_t, *pIEEEtypes_HECap_t;
-
-typedef MLAN_PACK_START struct _IEEEtypes_HeOpParam_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Reserved, including 6G Operation Info Pressent (bit17) */
-	t_u8 reserved : 6; /* bit 18-23 */
-	/* 6g operation info present */
-	t_u8 he_6g_op_info_present : 1; /* bit 17 */
-	/** ER SU Disable */
-	t_u8 er_su_disable : 1; /* bit 16 */
-	/** Co-Hosted BSS */
-	t_u16 co_located_bss : 1; /* bit 15 */
-	/** VHT Operation Info Present */
-	t_u16 vht_op_info_present : 1; /* bit 14 */
-	/** TXOP Duration RTS Threshold */
-	t_u16 txop_dur_rts_threshold : 10; /* bit 4-13 */
-	/** TWT Required */
-	t_u16 twt_req : 1; /* bit 3 */
-	/** Default PE Duration */
-	t_u16 default_pe_dur : 3; /* bit 0-2 */
-#else
-	/** Default PE Duration */
-	t_u16 default_pe_dur : 3; /* bit 0-2 */
-	/** TWT Required */
-	t_u16 twt_req : 1; /* bit 3 */
-	/** TXOP Duration RTS Threshold */
-	t_u16 txop_dur_rts_threshold : 10; /* bit 4-13 */
-	/** VHT Operation Info Present */
-	t_u16 vht_op_info_present : 1; /* bit 14 */
-	/** Co-Hosted BSS */
-	t_u16 co_located_bss : 1; /* bit 15 */
-	/** ER SU Disable */
-	t_u8 er_su_disable : 1; /* bit 16 */
-	/* 6g operation info present */
-	t_u8 he_6g_op_info_present : 1; /* bit 17 */
-	/** Reserved bit 18-23 */
-	t_u8 reserved : 6; /* bit 18-23 */
-#endif
-} MLAN_PACK_END IEEEtypes_HeOpParam_t;
-
-typedef MLAN_PACK_START struct _IEEEtypes_HeBssColorInfo_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** BSS Color Disabled */
-	t_u8 bss_color_disabled : 1; /* bit 7 */
-	/** Partial BSS Color */
-	t_u8 partial_bss_color : 1; /* bit 6 */
-	/** BSS Color */
-	t_u8 bss_color : 6; /* bit 0-5 */
-#else
-	/** BSS Color */
-	t_u8 bss_color : 6; /* bit 0-5 */
-	/** Partial BSS Color */
-	t_u8 partial_bss_color : 1; /* bit 6 */
-	/** BSS Color Disabled */
-	t_u8 bss_color_disabled : 1; /* bit 7 */
-#endif
-} MLAN_PACK_END IEEEtypes_HeBssColorInfo_t;
-
-typedef MLAN_PACK_START struct _IEEEtypes_HeOp_t {
-	/** Generic IE header */
-	IEEEtypes_Header_t ieee_hdr;
-	/** Element id extension */
-	t_u8 ext_id;
-	/** HE Operation Parameters */
-	IEEEtypes_HeOpParam_t he_op_param;
-	/** BSS Color Info */
-	IEEEtypes_HeBssColorInfo_t bss_color_info;
-	/** Basic HE-MCS and NSS Set */
-	IEEEtypes_HeMcsMap_t basic_he_mcs_nss;
-	/** Optional Field, including VHT Operation Info Max Co-Hosted BSSID
-	 * Indicator, and 6Ghz Operation Info  */
-	t_u8 option[9];
-} MLAN_PACK_END IEEEtypes_HeOp_t;
-
-/** default channel switch count */
-#define DEF_CHAN_SWITCH_COUNT 5
-
-/*  IEEE Channel Switch Announcement Element (7.3.2.20) */
-/**
- *  Provided in beacons and probe responses.  Used to advertise when
- *    and to which channel it is changing to.  Only starting STAs in
- *    an IBSS and APs are allowed to originate a chan switch element.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 37 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 chan_switch_mode; /**< STA should not transmit any frames if 1 */
-	t_u8 new_channel_num; /**< Channel # that AP/IBSS is moving to */
-	t_u8 chan_switch_count; /**< # of TBTTs before channel switch */
-
-} MLAN_PACK_END IEEEtypes_ChanSwitchAnn_t;
-
-/** data structure for extended channel switch */
-typedef MLAN_PACK_START struct {
-	/** IEEE element ID = 60 */
-	t_u8 element_id;
-	/** Element length after id and len, set to 4 */
-	t_u8 len;
-	/** STA should not transmit any frames if 1 */
-	t_u8 chan_switch_mode;
-	/** Operate class # that AP/IBSS is moving to */
-	t_u8 new_oper_class;
-	/** Channel # that AP/IBSS is moving to */
-	t_u8 new_channel_num;
-	/** of TBTTs before channel switch */
-	t_u8 chan_switch_count;
-} MLAN_PACK_END IEEEtypes_ExtChanSwitchAnn_t;
-
-/** Maximum number of subbands in the IEEEtypes_SupportedChannels_t structure */
-#define WLAN_11H_MAX_SUBBANDS 6
-/** Maximum number of DFS channels configured in IEEEtypes_IBSS_DFS_t */
-#define WLAN_11H_MAX_IBSS_DFS_CHANNELS 25
-
-/**  IEEE Power Constraint element (7.3.2.15) */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 32 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 local_constraint; /**< Local power constraint applied to 11d
-				chan info */
-} MLAN_PACK_END IEEEtypes_PowerConstraint_t;
-
-/**  IEEE Power Capability element (7.3.2.16) */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 33 */
-	t_u8 len; /**< Element length after id and len */
-	t_s8 min_tx_power_capability; /**< Minimum Transmit power (dBm) */
-	t_s8 max_tx_power_capability; /**< Maximum Transmit power (dBm) */
-} MLAN_PACK_END IEEEtypes_PowerCapability_t;
-
-/**  IEEE TPC Report element (7.3.2.18) */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 35 */
-	t_u8 len; /**< Element length after id and len */
-	t_s8 tx_power; /**< Max power used to transmit the TPC Report frame
-			  (dBm) */
-	t_s8 link_margin; /**< Link margin when TPC Request received (dB) */
-} MLAN_PACK_END IEEEtypes_TPCReport_t;
-
-/*  IEEE Supported Channel sub-band description (7.3.2.19) */
-/**
- *  Sub-band description used in the supported channels element.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 start_chan; /**< Starting channel in the subband */
-	t_u8 num_chans; /**< Number of channels in the subband */
-
-} MLAN_PACK_END IEEEtypes_SupportChan_Subband_t;
-
-/*  IEEE Supported Channel element (7.3.2.19) */
-/**
- *  Sent in association requests. Details the sub-bands and number
- *    of channels supported in each subband
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 36 */
-	t_u8 len; /**< Element length after id and len */
-
-	/** Configured sub-bands information in the element */
-	IEEEtypes_SupportChan_Subband_t subband[WLAN_11H_MAX_SUBBANDS];
-
-} MLAN_PACK_END IEEEtypes_SupportedChannels_t;
-
-/*  IEEE Wide Bandwidth Channel Switch Element */
-/**
- *  Provided in beacons and probe responses.  Used to advertise when
- *    and to which channel it is changing to.  Only starting STAs in
- *    an IBSS and APs are allowed to originate a wide bandwidth chan
- *    switch element.
- */
-typedef MLAN_PACK_START struct {
-	/** Generic IE header IEEE Element ID = 194*/
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 new_channel_width;
-	t_u8 new_channel_center_freq0;
-	t_u8 new_channel_center_freq1;
-} MLAN_PACK_END IEEEtypes_WideBWChanSwitch_t;
-
-/*  IEEE VHT Transmit Power Envelope Element */
-/**
- *  Provided in beacons and probe responses.  Used to advertise the max
- *    TX power in sepeate bandwidth and as a sub element of Channel Switch
- *    Wrapper IE.
- */
-typedef MLAN_PACK_START struct {
-	/** Generic IE header IEEE Element ID = 195*/
-	IEEEtypes_Header_t ieee_hdr;
-	t_u8 tpc_info; /**< Transmit Power Information>*/
-	t_u8 local_max_tp_20mhz; /**< Local Maximum Transmit Power for 20 MHZ>*/
-	t_u8 local_max_tp_40mhz; /**< Local Maximum Transmit Power for 40 MHZ>*/
-	t_u8 local_max_tp_80mhz; /**< Local Maximum Transmit Power for 80 MHZ>*/
-	t_u8 local_max_tp_160mhz_80_80mhz; /**< Local Maximum Transmit Power for
-					      160/80+80 MHZ>*/
-} MLAN_PACK_END IEEEtypes_VhtTpcEnvelope_t;
-
-/*  IEEE Quiet Period Element (7.3.2.23) */
-/**
- *  Provided in beacons and probe responses.  Indicates times during
- *    which the STA should not be transmitting data.  Only starting STAs in
- *    an IBSS and APs are allowed to originate a quiet element.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 40 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 quiet_count; /**< Number of TBTTs until beacon with the quiet
-			     period */
-	t_u8 quiet_period; /**< Regular quiet period, # of TBTTS between periods
-			    */
-	t_u16 quiet_duration; /**< Duration of the quiet period in TUs */
-	t_u16 quiet_offset; /**< Offset in TUs from the TBTT for the quiet
-			       period */
-
-} MLAN_PACK_END IEEEtypes_Quiet_t;
-
-/**
-***  @brief Map octet of the basic measurement report (7.3.2.22.1)
-**/
-typedef MLAN_PACK_START struct {
-#ifdef BIG_ENDIAN_SUPPORT
-	/**< Reserved */
-	t_u8 rsvd5_7 : 3;
-	/**< Channel is unmeasured */
-	t_u8 unmeasured : 1;
-	/**< Radar detected on channel */
-	t_u8 radar : 1;
-	/**< Unidentified signal found on channel */
-	t_u8 unidentified_sig : 1;
-	/**< OFDM preamble detected on channel */
-	t_u8 ofdm_preamble : 1;
-	/**< At least one valid MPDU received on channel */
-	t_u8 bss : 1;
-#else
-	/**< At least one valid MPDU received on channel */
-	t_u8 bss : 1;
-	/**< OFDM preamble detected on channel */
-	t_u8 ofdm_preamble : 1;
-	/**< Unidentified signal found on channel */
-	t_u8 unidentified_sig : 1;
-	/**< Radar detected on channel */
-	t_u8 radar : 1;
-	/**< Channel is unmeasured */
-	t_u8 unmeasured : 1;
-	/**< Reserved */
-	t_u8 rsvd5_7 : 3;
-#endif /* BIG_ENDIAN_SUPPORT */
-
-} MLAN_PACK_END MeasRptBasicMap_t;
-
-/*  IEEE DFS Channel Map field (7.3.2.24) */
-/**
- *  Used to list supported channels and provide a octet "map" field which
- *    contains a basic measurement report for that channel in the
- *    IEEEtypes_IBSS_DFS_t element
- */
-typedef MLAN_PACK_START struct {
-	t_u8 channel_number; /**< Channel number */
-	MeasRptBasicMap_t rpt_map; /**< Basic measurement report for the channel
-				    */
-
-} MLAN_PACK_END IEEEtypes_ChannelMap_t;
-
-/*  IEEE IBSS DFS Element (7.3.2.24) */
-/**
- *  IBSS DFS element included in ad hoc beacons and probe responses.
- *    Provides information regarding the IBSS DFS Owner as well as the
- *    originating STAs supported channels and basic measurement results.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 41 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 dfs_owner[MLAN_MAC_ADDR_LENGTH]; /**< DFS Owner STA Address */
-	t_u8 dfs_recovery_interval; /**< DFS Recovery time in TBTTs */
-
-	/** Variable length map field, one Map entry for each supported channel
-	 */
-	IEEEtypes_ChannelMap_t channel_map[WLAN_11H_MAX_IBSS_DFS_CHANNELS];
-
-} MLAN_PACK_END IEEEtypes_IBSS_DFS_t;
-
-/* 802.11h BSS information kept for each BSSID received in scan results */
-/**
- * IEEE BSS information needed from scan results for later processing in
- *    join commands
- */
-typedef struct {
-	t_u8 sensed_11h; /**< Capability bit set or 11h IE found in this BSS */
-
-	IEEEtypes_PowerConstraint_t power_constraint; /**< Power Constraint IE
-						       */
-	IEEEtypes_PowerCapability_t power_capability; /**< Power Capability IE
-						       */
-	IEEEtypes_TPCReport_t tpc_report; /**< TPC Report IE */
-	IEEEtypes_ChanSwitchAnn_t chan_switch_ann; /**< Channel Switch
-						      Announcement IE */
-	IEEEtypes_Quiet_t quiet; /**< Quiet IE */
-	IEEEtypes_IBSS_DFS_t ibss_dfs; /**< IBSS DFS Element IE */
-
-} wlan_11h_bss_info_t;
-
-/** Ethernet packet type for TDLS */
-#define MLAN_ETHER_PKT_TYPE_TDLS_ACTION (0x890D)
-
-/*802.11z  TDLS action frame type and strcuct */
-typedef MLAN_PACK_START struct {
-	/*link indentifier ie =101*/
-	t_u8 element_id;
-	/*len = 18*/
-	t_u8 len;
-	/** bssid */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** init sta mac address */
-	t_u8 init_sta[MLAN_MAC_ADDR_LENGTH];
-	/** resp sta mac address */
-	t_u8 resp_sta[MLAN_MAC_ADDR_LENGTH];
-} MLAN_PACK_END IEEEtypes_tdls_linkie;
-
-/** action code for tdls setup request */
-#define TDLS_SETUP_REQUEST 0
-/** action code for tdls setup response */
-#define TDLS_SETUP_RESPONSE 1
-/** action code for tdls setup confirm */
-#define TDLS_SETUP_CONFIRM 2
-/** action code for tdls tear down */
-#define TDLS_TEARDOWN 3
-/** action code for tdls traffic indication */
-#define TDLS_PEER_TRAFFIC_INDICATION 4
-/** action code for tdls channel switch request */
-#define TDLS_CHANNEL_SWITCH_REQUEST 5
-/** action code for tdls channel switch response */
-#define TDLS_CHANNEL_SWITCH_RESPONSE 6
-/** action code for tdls psm request */
-#define TDLS_PEER_PSM_REQUEST 7
-/** action code for tdls psm response */
-#define TDLS_PEER_PSM_RESPONSE 8
-/** action code for tdls traffic response */
-#define TDLS_PEER_TRAFFIC_RESPONSE 9
-/** action code for tdls discovery request */
-#define TDLS_DISCOVERY_REQUEST 10
-/** action code for TDLS discovery response */
-#define TDLS_DISCOVERY_RESPONSE 14
-/** category public */
-#define CATEGORY_PUBLIC 4
-
-/** action code for 20/40 BSS Coexsitence Management frame */
-#define BSS_20_40_COEX 0
-
-#ifdef STA_SUPPORT
-/** Macro for maximum size of scan response buffer */
-#define MAX_SCAN_RSP_BUF (16 * 1024)
-
-/** Maximum number of channels that can be sent in user scan config */
-#define WLAN_USER_SCAN_CHAN_MAX 50
-/** Maximum length of SSID list */
-#define MRVDRV_MAX_SSID_LIST_LENGTH 10
-
-/** Maximum length of BSSID list */
-#define MAX_BSSID_FILTER_LIST 5
-
-/** Scan all the channels in specified band */
-#define BAND_SPECIFIED 0x80
-
-/**
- *  IOCTL SSID List sub-structure sent in wlan_ioctl_user_scan_cfg
- *
- *  Used to specify SSID specific filters as well as SSID pattern matching
- *    filters for scan result processing in firmware.
- */
-typedef MLAN_PACK_START struct _wlan_user_scan_ssid {
-	/** SSID */
-	t_u8 ssid[MLAN_MAX_SSID_LENGTH + 1];
-	/** Maximum length of SSID */
-	t_u8 max_len;
-} MLAN_PACK_END wlan_user_scan_ssid;
-
-/**
- *  @brief IOCTL channel sub-structure sent in wlan_ioctl_user_scan_cfg
- *
- *  Multiple instances of this structure are included in the IOCTL command
- *   to configure a instance of a scan on the specific channel.
- */
-typedef MLAN_PACK_START struct _wlan_user_scan_chan {
-	/** Channel Number to scan */
-	t_u8 chan_number;
-	/** Radio type: 'B/G' Band = 0, 'A' Band = 1 */
-	t_u8 radio_type;
-	/** Scan type: Active = 1, Passive = 2 */
-	t_u8 scan_type;
-	/** Reserved */
-	t_u8 reserved;
-	/** Scan duration in milliseconds; if 0 default used */
-	t_u32 scan_time;
-} MLAN_PACK_END wlan_user_scan_chan;
-
-/** channel statictics */
-typedef MLAN_PACK_START struct _ChanStatistics_t {
-	/** channle number */
-	t_u8 chan_num;
-	/** band info */
-	Band_Config_t bandcfg;
-	/** flags */
-	t_u8 flags;
-	/** noise */
-	t_s8 noise;
-	/** total network */
-	t_u16 total_networks;
-	/** scan duration */
-	t_u16 cca_scan_duration;
-	/** busy duration */
-	t_u16 cca_busy_duration;
-	/** min rss */
-	t_u8 min_rss;
-	/** max rssi */
-	t_u8 max_rss;
-} MLAN_PACK_END ChanStatistics_t;
-
-/** Enhance ext scan type defination */
-typedef enum _MLAN_EXT_SCAN_TYPE {
-	EXT_SCAN_DEFAULT,
-	EXT_SCAN_ENHANCE,
-	EXT_SCAN_CANCEL,
-} MLAN_EXT_SCAN_TYPE;
-
-/**
- *  Input structure to configure an immediate scan cmd to firmware
- *
- *  Specifies a number of parameters to be used in general for the scan
- *    as well as a channel list (wlan_user_scan_chan) for each scan period
- *    desired.
- */
-typedef MLAN_PACK_START struct {
-	/**
-	 *  Flag set to keep the previous scan table intact
-	 *
-	 *  If set, the scan results will accumulate, replacing any previous
-	 *   matched entries for a BSS with the new scan data
-	 */
-	t_u8 keep_previous_scan;
-	/**
-	 *  BSS mode to be sent in the firmware command
-	 *
-	 *  Field can be used to restrict the types of networks returned in the
-	 *    scan.  Valid settings are:
-	 *
-	 *   - MLAN_SCAN_MODE_BSS  (infrastructure)
-	 *   - MLAN_SCAN_MODE_IBSS (adhoc)
-	 *   - MLAN_SCAN_MODE_ANY  (unrestricted, adhoc and infrastructure)
-	 */
-	t_u8 bss_mode;
-	/**
-	 *  Configure the number of probe requests for active chan scans
-	 */
-	t_u8 num_probes;
-	/**
-	 *  @brief ssid filter flag
-	 */
-	t_u8 ssid_filter;
-	/**
-	 *  @brief BSSID filter sent in the firmware command to limit the
-	 * results
-	 */
-	t_u8 specific_bssid[MLAN_MAC_ADDR_LENGTH];
-	/**
-	 *  SSID filter list used in the to limit the scan results
-	 */
-	wlan_user_scan_ssid ssid_list[MRVDRV_MAX_SSID_LIST_LENGTH];
-	/**
-	 *  Variable number (fixed maximum) of channels to scan up
-	 */
-	wlan_user_scan_chan chan_list[WLAN_USER_SCAN_CHAN_MAX];
-	/** scan channel gap */
-	t_u16 scan_chan_gap;
-	/** scan type: 0 legacy, 1: enhance scan*/
-	t_u8 ext_scan_type;
-	/** flag to filer only probe response */
-	t_u8 proberesp_only;
-	t_u8 random_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Number of BSSIDs to be filtered */
-	t_u8 bssid_num;
-	/** BSSID filter list used in the to limit the scan results */
-	mlan_802_11_mac_addr bssid_list[MAX_BSSID_FILTER_LIST];
-	/** use scan setting from scan_cfg only  */
-	t_u8 scan_cfg_only;
-} MLAN_PACK_END wlan_user_scan_cfg;
-
-/** Default scan interval in millisecond*/
-#define DEFAULT_BGSCAN_INTERVAL 30000
-
-/** action get all, except pps/uapsd config */
-#define BG_SCAN_ACT_GET 0x0000
-/** action set all, except pps/uapsd config */
-#define BG_SCAN_ACT_SET 0x0001
-/** action get pps/uapsd config */
-#define BG_SCAN_ACT_GET_PPS_UAPSD 0x0100
-/** action set pps/uapsd config */
-#define BG_SCAN_ACT_SET_PPS_UAPSD 0x0101
-/** action set all */
-#define BG_SCAN_ACT_SET_ALL 0xff01
-/** ssid match */
-#define BG_SCAN_SSID_MATCH 0x0001
-/** ssid match and RSSI exceeded */
-#define BG_SCAN_SSID_RSSI_MATCH 0x0004
-/**wait for all channel scan to complete to report scan result*/
-#define BG_SCAN_WAIT_ALL_CHAN_DONE 0x80000000
-/** Maximum number of channels that can be sent in bg scan config */
-#define CHAN_MAX_24G 14
-#define CHAN_MAX_5G 24
-#define CHAN_MAX_UNII4 3
-#define WLAN_BG_SCAN_CHAN_MAX (CHAN_MAX_24G + CHAN_MAX_5G + CHAN_MAX_UNII4)
-
-/** Enumeration definition */
-/** EES MODE */
-typedef enum {
-	/** EES MODE: LOW */
-	EES_MODE_LOW = 0,
-	/** EES MODE: MID */
-	EES_MODE_MID,
-	/** EES MODE: HIGH */
-	EES_MODE_HIGH,
-	/** EES MODE: OFF */
-	EES_MODE_OFF,
-	/** EES MODE: LOOP */
-	EES_MODE_LOOP = 15,
-} ees_modes;
-
-/** EES Maximum SSID */
-#define EES_MAX_SSIDS 2
-
-/** ees_ssid_config */
-typedef MLAN_PACK_START struct {
-	/** SSID */
-	t_u8 ssid[MLAN_MAX_SSID_LENGTH + 1];
-	/** Maximum length of SSID */
-	t_u8 max_len;
-	/** PairCipher */
-	t_u8 pair_cipher;
-	/** GroupCipher */
-	t_u8 group_cipher;
-} MLAN_PACK_END ees_ssid_config;
-
-/**
- *  Input structure to configure bs scan cmd to firmware
- */
-typedef MLAN_PACK_START struct {
-	/** action */
-	t_u16 action;
-	/** enable/disable */
-	t_u8 enable;
-	/**  BSS type:
-	 *   MLAN_SCAN_MODE_BSS  (infrastructure)
-	 *   MLAN_SCAN_MODE_IBSS (adhoc)
-	 *   MLAN_SCAN_MODE_ANY  (unrestricted, adhoc and infrastructure)
-	 */
-	t_u8 bss_type;
-	/** number of channel scanned during each scan */
-	t_u8 chan_per_scan;
-	/** interval between consecutive scan */
-	t_u32 scan_interval;
-	/** bit 0: ssid match bit 1: ssid match and SNR exceeded
-	 *  bit 2: ssid match and RSSI exceeded
-	 *  bit 31: wait for all channel scan to complete to report scan result
-	 */
-	t_u32 report_condition;
-	/*  Configure the number of probe requests for active chan scans */
-	t_u8 num_probes;
-	/** RSSI threshold */
-	t_u8 rssi_threshold;
-	/** SNR threshold */
-	t_u8 snr_threshold;
-	/** repeat count */
-	t_u16 repeat_count;
-	/** start later flag */
-	t_u16 start_later;
-	/** SSID filter list used in the to limit the scan results */
-	wlan_user_scan_ssid ssid_list[MRVDRV_MAX_SSID_LIST_LENGTH];
-	/** Variable number (fixed maximum) of channels to scan up */
-	wlan_user_scan_chan chan_list[WLAN_BG_SCAN_CHAN_MAX];
-	/** scan channel gap */
-	t_u16 scan_chan_gap;
-	/** Enable EES configuration */
-	t_u8 config_ees;
-	/** EES scan mode */
-	t_u16 ees_mode;
-	/** EES report condition */
-	t_u16 report_cond;
-	/** EES High Period scan interval */
-	t_u16 high_period;
-	/** EES High Period scan count */
-	t_u16 high_period_count;
-	/** EES Medium Period scan interval */
-	t_u16 mid_period;
-	/** EES Medium Period scan count */
-	t_u16 mid_period_count;
-	/** EES Low Period scan interval */
-	t_u16 low_period;
-	/** EES Low Period scan count */
-	t_u16 low_period_count;
-	/** Number of networks in the list */
-	t_u8 network_count;
-	/** Maximum number of connection count */
-	t_u8 max_conn_count;
-	/** Black List Exp */
-	t_u8 black_list_exp;
-	/** Array of ees config struct */
-	ees_ssid_config ees_ssid_cfg[EES_MAX_SSIDS];
-	t_u8 random_mac[MLAN_MAC_ADDR_LENGTH];
-} MLAN_PACK_END wlan_bgscan_cfg;
-#endif /* STA_SUPPORT */
-
-/** The open AP in OWE transmition Mode */
-#define OWE_TRANS_MODE_OPEN 1
-/** The security AP in OWE trsnsition Mode */
-#define OWE_TRANS_MODE_OWE 2
-
-#ifdef PRAGMA_PACK
-#pragma pack(pop)
-#endif
-
-/** BSSDescriptor_t
- *    Structure used to store information for beacon/probe response
- */
-typedef struct _BSSDescriptor_t {
-	/** MAC address */
-	mlan_802_11_mac_addr mac_address;
-
-	/** SSID */
-	mlan_802_11_ssid ssid;
-
-	/** Transition MAC address */
-	mlan_802_11_mac_addr trans_mac_address;
-
-	/** Transition SSID */
-	mlan_802_11_ssid trans_ssid;
-
-	/** OWE Transition mode */
-	t_u8 owe_transition_mode;
-
-	/** WEP encryption requirement */
-	t_u32 privacy;
-
-	/** Receive signal strength in dBm */
-	t_s32 rssi;
-	/** channel load */
-	t_u8 chan_load;
-	/** Channel */
-	t_u32 channel;
-
-	/** Freq */
-	t_u32 freq;
-
-	/** Beacon period */
-	t_u16 beacon_period;
-
-	/** ATIM window */
-	t_u32 atim_window;
-
-	/** ERP flags */
-	t_u8 erp_flags;
-
-	/** Type of network in use */
-	WLAN_802_11_NETWORK_TYPE network_type_use;
-
-	/** Network infrastructure mode */
-	t_u32 bss_mode;
-
-	/** Network supported rates */
-	WLAN_802_11_RATES supported_rates;
-
-	/** Supported data rates */
-	t_u8 data_rates[WLAN_SUPPORTED_RATES];
-
-	/** Current channel bandwidth
-	 *  0 : 20MHZ
-	 *  1 : 40MHZ
-	 *  2 : 80MHZ
-	 *  3 : 160MHZ
-	 */
-	t_u8 curr_bandwidth;
-
-	/** Network band.
-	 * BAND_B(0x01): 'b' band
-	 * BAND_G(0x02): 'g' band
-	 * BAND_A(0X04): 'a' band
-	 */
-	t_u16 bss_band;
-
-	/** TSF timestamp from the current firmware TSF */
-	t_u64 network_tsf;
-
-	/** TSF value included in the beacon/probe response */
-	t_u8 time_stamp[8];
-
-	/** PHY parameter set */
-	IEEEtypes_PhyParamSet_t phy_param_set;
-
-	/** SS parameter set */
-	IEEEtypes_SsParamSet_t ss_param_set;
-
-	/** Capability information */
-	IEEEtypes_CapInfo_t cap_info;
-
-	/** WMM IE */
-	IEEEtypes_WmmParameter_t wmm_ie;
-
-	/** 802.11h BSS information */
-	wlan_11h_bss_info_t wlan_11h_bss_info;
-
-	/** Indicate disabling 11n when associate with AP */
-	t_u8 disable_11n;
-	/** 802.11n BSS information */
-	/** HT Capabilities IE */
-	IEEEtypes_HTCap_t *pht_cap;
-	/** HT Capabilities Offset */
-	t_u16 ht_cap_offset;
-	/** HT Information IE */
-	IEEEtypes_HTInfo_t *pht_info;
-	/** HT Information Offset */
-	t_u16 ht_info_offset;
-	/** Flag to indicate this is multi_bssid_ap */
-	t_u8 multi_bssid_ap;
-	/** the mac address of multi-bssid AP */
-	mlan_802_11_mac_addr multi_bssid_ap_addr;
-	/** 20/40 BSS Coexistence IE */
-	IEEEtypes_2040BSSCo_t *pbss_co_2040;
-	/** 20/40 BSS Coexistence Offset */
-	t_u16 bss_co_2040_offset;
-	/** Extended Capabilities IE */
-	IEEEtypes_ExtCap_t *pext_cap;
-	/** Extended Capabilities Offset */
-	t_u16 ext_cap_offset;
-	/** Overlapping BSS Scan Parameters IE */
-	IEEEtypes_OverlapBSSScanParam_t *poverlap_bss_scan_param;
-	/** Overlapping BSS Scan Parameters Offset */
-	t_u16 overlap_bss_offset;
-
-	/** VHT Capabilities IE */
-	IEEEtypes_VHTCap_t *pvht_cap;
-	/** VHT Capabilities IE offset */
-	t_u16 vht_cap_offset;
-	/** VHT Operations IE */
-	IEEEtypes_VHTOprat_t *pvht_oprat;
-	/** VHT Operations IE offset */
-	t_u16 vht_oprat_offset;
-	/** VHT Transmit Power Envelope IE */
-	IEEEtypes_VHTtxpower_t *pvht_txpower;
-	/** VHT Transmit Power Envelope IE offset */
-	t_u16 vht_txpower_offset;
-	/** Extended Power Constraint IE */
-	IEEEtypes_ExtPwerCons_t *pext_pwer;
-	/** Extended Power Constraint IE offset */
-	t_u16 ext_pwer_offset;
-	/** Extended BSS Load IE  */
-	IEEEtypes_ExtBSSload_t *pext_bssload;
-	/** Extended BSS Load IE offset */
-	t_u16 ext_bssload_offset;
-	/** Quiet Channel IE */
-	IEEEtypes_QuietChan_t *pquiet_chan;
-	/** Quiet Channel IE offset */
-	t_u16 quiet_chan_offset;
-	/** Operating Mode Notification IE */
-	IEEEtypes_OperModeNtf_t *poper_mode;
-	/** Operating Mode Notification IE offset */
-	t_u16 oper_mode_offset;
-	/** HE Capability IE */
-	IEEEtypes_HECap_t *phe_cap;
-	/** HE Capability IE offset */
-	t_u16 he_cap_offset;
-	/** HE operation IE */
-	IEEEtypes_Extension_t *phe_oprat;
-	/** HE operation IE offset */
-	t_u16 he_oprat_offset;
-#ifdef STA_SUPPORT
-	/** Country information set */
-	IEEEtypes_CountryInfoFullSet_t country_info;
-#endif /* STA_SUPPORT */
-
-	/** WPA IE */
-	IEEEtypes_VendorSpecific_t *pwpa_ie;
-	/** WPA IE offset in the beacon buffer */
-	t_u16 wpa_offset;
-	/** RSN IE */
-	IEEEtypes_Generic_t *prsn_ie;
-	/** RSN IE offset in the beacon buffer */
-	t_u16 rsn_offset;
-	/** RSNX IE */
-	IEEEtypes_Generic_t *prsnx_ie;
-	/** RSNX IE offset in the beacon buffer */
-	t_u16 rsnx_offset;
-#ifdef STA_SUPPORT
-	/** WAPI IE */
-	IEEEtypes_Generic_t *pwapi_ie;
-	/** WAPI IE offset in the beacon buffer */
-	t_u16 wapi_offset;
-#endif
-	/* Hotspot 2.0 OSEN AKM  IE*/
-	IEEEtypes_Generic_t *posen_ie;
-	/** osen IE offset in the beacon buffer */
-	t_u16 osen_offset;
-	/* Mobility domain IE */
-	IEEEtypes_MobilityDomain_t *pmd_ie;
-	/** Mobility domain IE offset in the beacon buffer */
-	t_u16 md_offset;
-
-	/** Pointer to the returned scan response */
-	t_u8 *pbeacon_buf;
-	/** Length of the stored scan response */
-	t_u32 beacon_buf_size;
-	/** Max allocated size for updated scan response */
-	t_u32 beacon_buf_size_max;
-	/** scan age in secs */
-	t_u32 age_in_secs;
-} BSSDescriptor_t, *pBSSDescriptor_t;
-
-#endif /* !_MLAN_IEEE_H_ */
diff --git a/wlan_sd8987/mlinux/mlan_ioctl.h b/wlan_sd8987/mlinux/mlan_ioctl.h
deleted file mode 100755
index 7790db9..0000000
--- a/wlan_sd8987/mlinux/mlan_ioctl.h
+++ /dev/null
@@ -1,6066 +0,0 @@
-/** @file mlan_ioctl.h
- *
- *  @brief This file declares the IOCTL data structures and APIs.
- *
- *
- *  Copyright 2008-2022 NXP
- *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
- *
- */
-
-/******************************************************
-Change log:
-    11/07/2008: initial version
-******************************************************/
-
-#ifndef _MLAN_IOCTL_H_
-#define _MLAN_IOCTL_H_
-
-/** Enumeration for IOCTL request ID */
-enum _mlan_ioctl_req_id {
-	/* Scan Group */
-	MLAN_IOCTL_SCAN = 0x00010000,
-	MLAN_OID_SCAN_NORMAL = 0x00010001,
-	MLAN_OID_SCAN_SPECIFIC_SSID = 0x00010002,
-	MLAN_OID_SCAN_USER_CONFIG = 0x00010003,
-	MLAN_OID_SCAN_CONFIG = 0x00010004,
-	MLAN_OID_SCAN_GET_CURRENT_BSS = 0x00010005,
-	MLAN_OID_SCAN_CANCEL = 0x00010006,
-	MLAN_OID_SCAN_TABLE_FLUSH = 0x0001000A,
-	MLAN_OID_SCAN_BGSCAN_CONFIG = 0x0001000B,
-	/* BSS Configuration Group */
-	MLAN_IOCTL_BSS = 0x00020000,
-	MLAN_OID_BSS_START = 0x00020001,
-	MLAN_OID_BSS_STOP = 0x00020002,
-	MLAN_OID_BSS_MODE = 0x00020003,
-	MLAN_OID_BSS_CHANNEL = 0x00020004,
-	MLAN_OID_BSS_CHANNEL_LIST = 0x00020005,
-	MLAN_OID_BSS_MAC_ADDR = 0x00020006,
-	MLAN_OID_BSS_MULTICAST_LIST = 0x00020007,
-	MLAN_OID_BSS_FIND_BSS = 0x00020008,
-	MLAN_OID_IBSS_BCN_INTERVAL = 0x00020009,
-	MLAN_OID_IBSS_ATIM_WINDOW = 0x0002000A,
-	MLAN_OID_IBSS_CHANNEL = 0x0002000B,
-#ifdef UAP_SUPPORT
-	MLAN_OID_UAP_BSS_CONFIG = 0x0002000C,
-	MLAN_OID_UAP_DEAUTH_STA = 0x0002000D,
-	MLAN_OID_UAP_BSS_RESET = 0x0002000E,
-#endif
-#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
-	MLAN_OID_BSS_ROLE = 0x0002000F,
-#endif
-#ifdef WIFI_DIRECT_SUPPORT
-	MLAN_OID_WIFI_DIRECT_MODE = 0x00020010,
-#endif
-#ifdef STA_SUPPORT
-	MLAN_OID_BSS_LISTEN_INTERVAL = 0x00020011,
-#endif
-	MLAN_OID_BSS_REMOVE = 0x00020014,
-#ifdef UAP_SUPPORT
-	MLAN_OID_UAP_CFG_WMM_PARAM = 0x00020015,
-#endif
-	MLAN_OID_BSS_11D_CHECK_CHANNEL = 0x00020016,
-#ifdef UAP_SUPPORT
-	MLAN_OID_UAP_ACS_SCAN = 0x00020017,
-	MLAN_OID_UAP_SCAN_CHANNELS = 0x00020018,
-	MLAN_OID_UAP_CHANNEL = 0x00020019,
-	MLAN_OID_UAP_OPER_CTRL = 0x0002001A,
-#endif
-#ifdef STA_SUPPORT
-	MLAN_OID_BSS_CHAN_INFO = 0x0002001B,
-#endif
-#ifdef UAP_SUPPORT
-	MLAN_OID_UAP_ADD_STATION = 0x0002001C,
-#endif
-
-	MLAN_OID_BSS_FIND_BSSID = 0x0002001D,
-#ifdef UAP_SUPPORT
-	MLAN_OID_ACTION_CHAN_SWITCH = 0x0002001E,
-#endif
-
-	/* Radio Configuration Group */
-	MLAN_IOCTL_RADIO_CFG = 0x00030000,
-	MLAN_OID_RADIO_CTRL = 0x00030001,
-	MLAN_OID_BAND_CFG = 0x00030002,
-	MLAN_OID_ANT_CFG = 0x00030003,
-	MLAN_OID_REMAIN_CHAN_CFG = 0x00030004,
-	MLAN_OID_MIMO_SWITCH = 0x00030005,
-
-	/* SNMP MIB Group */
-	MLAN_IOCTL_SNMP_MIB = 0x00040000,
-	MLAN_OID_SNMP_MIB_RTS_THRESHOLD = 0x00040001,
-	MLAN_OID_SNMP_MIB_FRAG_THRESHOLD = 0x00040002,
-	MLAN_OID_SNMP_MIB_RETRY_COUNT = 0x00040003,
-	MLAN_OID_SNMP_MIB_DOT11D = 0x00040004,
-#if defined(UAP_SUPPORT)
-	MLAN_OID_SNMP_MIB_DOT11H = 0x00040005,
-#endif
-	MLAN_OID_SNMP_MIB_DTIM_PERIOD = 0x00040006,
-	MLAN_OID_SNMP_MIB_SIGNALEXT_ENABLE = 0x00040007,
-	MLAN_OID_SNMP_MIB_CTRL_DEAUTH = 0x00040008,
-	MLAN_OID_SNMP_MIB_DOT11H_FAKERADAR = 0x00040009,
-	MLAN_OID_SNMP_MIB_CHAN_TRACK = 0x0004000A,
-
-	/* Status Information Group */
-	MLAN_IOCTL_GET_INFO = 0x00050000,
-	MLAN_OID_GET_STATS = 0x00050001,
-	MLAN_OID_GET_SIGNAL = 0x00050002,
-	MLAN_OID_GET_FW_INFO = 0x00050003,
-	MLAN_OID_GET_VER_EXT = 0x00050004,
-	MLAN_OID_GET_BSS_INFO = 0x00050005,
-	MLAN_OID_GET_DEBUG_INFO = 0x00050006,
-#ifdef UAP_SUPPORT
-	MLAN_OID_UAP_STA_LIST = 0x00050007,
-#endif
-	MLAN_OID_GET_SIGNAL_EXT = 0x00050008,
-	MLAN_OID_LINK_STATS = 0x00050009,
-	MLAN_OID_GET_UAP_STATS_LOG = 0x0005000A,
-	/* Security Configuration Group */
-	MLAN_IOCTL_SEC_CFG = 0x00060000,
-	MLAN_OID_SEC_CFG_AUTH_MODE = 0x00060001,
-	MLAN_OID_SEC_CFG_ENCRYPT_MODE = 0x00060002,
-	MLAN_OID_SEC_CFG_WPA_ENABLED = 0x00060003,
-	MLAN_OID_SEC_CFG_ENCRYPT_KEY = 0x00060004,
-	MLAN_OID_SEC_CFG_PASSPHRASE = 0x00060005,
-	MLAN_OID_SEC_CFG_EWPA_ENABLED = 0x00060006,
-	MLAN_OID_SEC_CFG_ESUPP_MODE = 0x00060007,
-	MLAN_OID_SEC_CFG_WAPI_ENABLED = 0x00060009,
-	MLAN_OID_SEC_CFG_PORT_CTRL_ENABLED = 0x0006000A,
-#ifdef UAP_SUPPORT
-	MLAN_OID_SEC_CFG_REPORT_MIC_ERR = 0x0006000B,
-#endif
-	MLAN_OID_SEC_QUERY_KEY = 0x0006000C,
-
-	/* Rate Group */
-	MLAN_IOCTL_RATE = 0x00070000,
-	MLAN_OID_RATE_CFG = 0x00070001,
-	MLAN_OID_GET_DATA_RATE = 0x00070002,
-	MLAN_OID_SUPPORTED_RATES = 0x00070003,
-
-	/* Power Configuration Group */
-	MLAN_IOCTL_POWER_CFG = 0x00080000,
-	MLAN_OID_POWER_CFG = 0x00080001,
-	MLAN_OID_POWER_CFG_EXT = 0x00080002,
-	MLAN_OID_POWER_LOW_POWER_MODE = 0x00080003,
-
-	/* Power Management Configuration Group */
-	MLAN_IOCTL_PM_CFG = 0x00090000,
-	MLAN_OID_PM_CFG_IEEE_PS = 0x00090001,
-	MLAN_OID_PM_CFG_HS_CFG = 0x00090002,
-	MLAN_OID_PM_CFG_INACTIVITY_TO = 0x00090003,
-	MLAN_OID_PM_CFG_DEEP_SLEEP = 0x00090004,
-	MLAN_OID_PM_CFG_SLEEP_PD = 0x00090005,
-	MLAN_OID_PM_CFG_PS_CFG = 0x00090006,
-	MLAN_OID_PM_CFG_SLEEP_PARAMS = 0x00090008,
-#ifdef UAP_SUPPORT
-	MLAN_OID_PM_CFG_PS_MODE = 0x00090009,
-#endif /* UAP_SUPPORT */
-	MLAN_OID_PM_INFO = 0x0009000A,
-	MLAN_OID_PM_HS_WAKEUP_REASON = 0x0009000B,
-	MLAN_OID_PM_MGMT_FILTER = 0x0009000C,
-	MLAN_OID_PM_CFG_BCN_TIMEOUT = 0x0009000D,
-
-	/* WMM Configuration Group */
-	MLAN_IOCTL_WMM_CFG = 0x000A0000,
-	MLAN_OID_WMM_CFG_ENABLE = 0x000A0001,
-	MLAN_OID_WMM_CFG_QOS = 0x000A0002,
-	MLAN_OID_WMM_CFG_ADDTS = 0x000A0003,
-	MLAN_OID_WMM_CFG_DELTS = 0x000A0004,
-	MLAN_OID_WMM_CFG_QUEUE_CONFIG = 0x000A0005,
-	MLAN_OID_WMM_CFG_QUEUE_STATS = 0x000A0006,
-	MLAN_OID_WMM_CFG_QUEUE_STATUS = 0x000A0007,
-	MLAN_OID_WMM_CFG_TS_STATUS = 0x000A0008,
-
-	/* WPS Configuration Group */
-	MLAN_IOCTL_WPS_CFG = 0x000B0000,
-	MLAN_OID_WPS_CFG_SESSION = 0x000B0001,
-
-	/* 802.11n Configuration Group */
-	MLAN_IOCTL_11N_CFG = 0x000C0000,
-	MLAN_OID_11N_CFG_TX = 0x000C0001,
-	MLAN_OID_11N_HTCAP_CFG = 0x000C0002,
-	MLAN_OID_11N_CFG_ADDBA_REJECT = 0x000C0003,
-	MLAN_OID_11N_CFG_AGGR_PRIO_TBL = 0x000C0004,
-	MLAN_OID_11N_CFG_ADDBA_PARAM = 0x000C0005,
-	MLAN_OID_11N_CFG_MAX_TX_BUF_SIZE = 0x000C0006,
-	MLAN_OID_11N_CFG_AMSDU_AGGR_CTRL = 0x000C0007,
-	MLAN_OID_11N_CFG_SUPPORTED_MCS_SET = 0x000C0008,
-	MLAN_OID_11N_CFG_TX_BF_CAP = 0x000C0009,
-	MLAN_OID_11N_CFG_TX_BF_CFG = 0x000C000A,
-	MLAN_OID_11N_CFG_STREAM_CFG = 0x000C000B,
-	MLAN_OID_11N_CFG_DELBA = 0x000C000C,
-	MLAN_OID_11N_CFG_REJECT_ADDBA_REQ = 0x000C000D,
-	MLAN_OID_11N_CFG_COEX_RX_WINSIZE = 0x000C000E,
-	MLAN_OID_11N_CFG_TX_AGGR_CTRL = 0x000C000F,
-	MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM = 0x000C0010,
-	MLAN_OID_11N_CFG_MIN_BA_THRESHOLD = 0x000C0011,
-
-	/* 802.11d Configuration Group */
-	MLAN_IOCTL_11D_CFG = 0x000D0000,
-#ifdef STA_SUPPORT
-	MLAN_OID_11D_CFG_ENABLE = 0x000D0001,
-	MLAN_OID_11D_CLR_CHAN_TABLE = 0x000D0002,
-#endif /* STA_SUPPORT */
-#ifdef UAP_SUPPORT
-	MLAN_OID_11D_DOMAIN_INFO = 0x000D0003,
-#endif
-	MLAN_OID_11D_DOMAIN_INFO_EXT = 0x000D0004,
-
-	/* Register Memory Access Group */
-	MLAN_IOCTL_REG_MEM = 0x000E0000,
-	MLAN_OID_REG_RW = 0x000E0001,
-	MLAN_OID_EEPROM_RD = 0x000E0002,
-	MLAN_OID_MEM_RW = 0x000E0003,
-
-	/* Multi-Radio Configuration Group */
-	MLAN_IOCTL_MFR_CFG = 0x00100000,
-	/* 802.11h Configuration Group */
-	MLAN_IOCTL_11H_CFG = 0x00110000,
-	MLAN_OID_11H_CHANNEL_CHECK = 0x00110001,
-	MLAN_OID_11H_LOCAL_POWER_CONSTRAINT = 0x00110002,
-	MLAN_OID_11H_DFS_TESTING = 0x00110003,
-	MLAN_OID_11H_CHAN_REPORT_REQUEST = 0x00110004,
-	MLAN_OID_11H_CHAN_SWITCH_COUNT = 0x00110005,
-	MLAN_OID_11H_CHAN_NOP_INFO = 0x00110006,
-	MLAN_OID_11H_CHAN_DFS_STATE = 0x00110007,
-	MLAN_OID_11H_DFS_W53_CFG = 0x00110008,
-	MLAN_OID_11H_DFS_MODE = 0x00110009,
-	MLAN_OID_11H_NOP_CHAN_LIST = 0x0011000A,
-
-	/* 802.11n Configuration Group RANDYTODO for value assign */
-	MLAN_IOCTL_11AC_CFG = 0x00120000,
-	MLAN_OID_11AC_VHT_CFG = 0x00120001,
-	MLAN_OID_11AC_CFG_SUPPORTED_MCS_SET = 0x00120002,
-	MLAN_OID_11AC_OPERMODE_CFG = 0x00120003,
-
-	/* 802.11ax Configuration Group  */
-	MLAN_IOCTL_11AX_CFG = 0x00170000,
-	MLAN_OID_11AX_HE_CFG = 0x00170001,
-	MLAN_OID_11AX_CMD_CFG = 0x00170002,
-	MLAN_OID_11AX_TWT_CFG = 0x00170003,
-
-	/* Miscellaneous Configuration Group */
-	MLAN_IOCTL_MISC_CFG = 0x00200000,
-	MLAN_OID_MISC_GEN_IE = 0x00200001,
-	MLAN_OID_MISC_REGION = 0x00200002,
-	MLAN_OID_MISC_WARM_RESET = 0x00200003,
-#ifdef SDIO
-	MLAN_OID_MISC_SDIO_MPA_CTRL = 0x00200006,
-#endif
-	MLAN_OID_MISC_HOST_CMD = 0x00200007,
-	MLAN_OID_MISC_SYS_CLOCK = 0x00200009,
-	MLAN_OID_MISC_SOFT_RESET = 0x0020000A,
-	MLAN_OID_MISC_WWS = 0x0020000B,
-	MLAN_OID_MISC_ASSOC_RSP = 0x0020000C,
-	MLAN_OID_MISC_INIT_SHUTDOWN = 0x0020000D,
-	MLAN_OID_MISC_CUSTOM_IE = 0x0020000F,
-	MLAN_OID_MISC_TDLS_CONFIG = 0x00200010,
-	MLAN_OID_MISC_NET_MONITOR = 0x00200011,
-	MLAN_OID_MISC_TX_DATAPAUSE = 0x00200012,
-	MLAN_OID_MISC_IP_ADDR = 0x00200013,
-	MLAN_OID_MISC_MAC_CONTROL = 0x00200014,
-	MLAN_OID_MISC_MEF_CFG = 0x00200015,
-	MLAN_OID_MISC_CFP_CODE = 0x00200016,
-	MLAN_OID_MISC_COUNTRY_CODE = 0x00200017,
-	MLAN_OID_MISC_THERMAL = 0x00200018,
-	MLAN_OID_MISC_RX_MGMT_IND = 0x00200019,
-	MLAN_OID_MISC_SUBSCRIBE_EVENT = 0x0020001A,
-#ifdef DEBUG_LEVEL1
-	MLAN_OID_MISC_DRVDBG = 0x0020001B,
-#endif
-	MLAN_OID_MISC_HOTSPOT_CFG = 0x0020001C,
-	MLAN_OID_MISC_OTP_USER_DATA = 0x0020001D,
-	MLAN_OID_MISC_AUTO_ASSOC = 0x0020001E,
-#ifdef USB
-	MLAN_OID_MISC_USB_AGGR_CTRL = 0x0020001F,
-#endif
-	MLAN_OID_MISC_TXCONTROL = 0x00200020,
-#ifdef STA_SUPPORT
-	MLAN_OID_MISC_EXT_CAP_CFG = 0x00200021,
-#endif
-#if defined(STA_SUPPORT)
-	MLAN_OID_MISC_PMFCFG = 0x00200022,
-#endif
-	MLAN_OID_MISC_MULTI_CHAN_CFG = 0x00200023,
-	MLAN_OID_MISC_MULTI_CHAN_POLICY = 0x00200024,
-#ifdef WIFI_DIRECT_SUPPORT
-	MLAN_OID_MISC_WIFI_DIRECT_CONFIG = 0x00200025,
-#endif
-	MLAN_OID_MISC_TDLS_OPER = 0x00200026,
-	MLAN_OID_MISC_GET_TDLS_IES = 0x00200027,
-	MLAN_OID_MISC_LOW_PWR_MODE = 0x00200029,
-	MLAN_OID_MISC_MEF_FLT_CFG = 0x0020002A,
-	MLAN_OID_MISC_DFS_REAPTER_MODE = 0x0020002B,
-	MLAN_OID_MISC_TDLS_CS_CHANNEL = 0x0020002D,
-	MLAN_OID_MISC_COALESCE_CFG = 0x0020002E,
-	MLAN_OID_MISC_TDLS_IDLE_TIME = 0x0020002F,
-	MLAN_OID_MISC_GET_SENSOR_TEMP = 0x00200030,
-	MLAN_OID_MISC_IPV6_RA_OFFLOAD = 0x00200036,
-	MLAN_OID_MISC_GTK_REKEY_OFFLOAD = 0x00200037,
-	MLAN_OID_MISC_OPER_CLASS = 0x00200038,
-	MLAN_OID_MISC_PMIC_CFG = 0x00200039,
-	MLAN_OID_MISC_IND_RST_CFG = 0x00200040,
-	MLAN_OID_MISC_ROAM_OFFLOAD = 0x00200042,
-	MLAN_OID_MISC_ROAM_OFFLOAD_APLIST = 0x00200043,
-	MLAN_OID_MISC_GET_TSF = 0x00200045,
-	MLAN_OID_MISC_GET_CHAN_REGION_CFG = 0x00200046,
-	MLAN_OID_MISC_CLOUD_KEEP_ALIVE = 0x00200048,
-	MLAN_OID_MISC_OPER_CLASS_CHECK = 0x00200049,
-	MLAN_OID_MISC_DRCS_CFG = 0x00200050,
-
-	MLAN_OID_MISC_CWMODE_CTRL = 0x00200051,
-	MLAN_OID_MISC_AGGR_CTRL = 0x00200052,
-	MLAN_OID_MISC_DYN_BW = 0x00200053,
-	MLAN_OID_MISC_FW_DUMP_EVENT = 0x00200054,
-	MLAN_OID_MISC_PER_PKT_CFG = 0x00200055,
-
-	MLAN_OID_MISC_ROBUSTCOEX = 0x00200056,
-	MLAN_OID_MISC_GET_TX_RX_HISTOGRAM = 0x00200057,
-	MLAN_OID_MISC_CFP_INFO = 0x00200060,
-	MLAN_OID_MISC_BOOT_SLEEP = 0x00200061,
-#if defined(PCIE)
-	MLAN_OID_MISC_SSU = 0x00200062,
-#endif
-	MLAN_OID_MISC_CSI = 0x00200064,
-	MLAN_OID_MISC_DMCS_CONFIG = 0x00200065,
-	MLAN_OID_MISC_RX_ABORT_CFG = 0x00200066,
-	MLAN_OID_MISC_RX_ABORT_CFG_EXT = 0x00200067,
-	MLAN_OID_MISC_TX_AMPDU_PROT_MODE = 0x00200068,
-	MLAN_OID_MISC_RATE_ADAPT_CFG = 0x00200069,
-	MLAN_OID_MISC_CCK_DESENSE_CFG = 0x00200070,
-	MLAN_OID_MISC_GET_CHAN_TRPC_CFG = 0x00200072,
-	MLAN_OID_MISC_BAND_STEERING = 0x00200073,
-	MLAN_OID_MISC_GET_REGIONPWR_CFG = 0x00200074,
-	MLAN_OID_MISC_RF_TEST_GENERIC = 0x00200075,
-	MLAN_OID_MISC_RF_TEST_TX_CONT = 0x00200076,
-	MLAN_OID_MISC_RF_TEST_TX_FRAME = 0x00200077,
-	MLAN_OID_MISC_ARB_CONFIG = 0x00200078,
-	MLAN_OID_MISC_BEACON_STUCK = 0x00200079,
-	MLAN_OID_MISC_CFP_TABLE = 0x0020007A,
-	MLAN_OID_MISC_RANGE_EXT = 0x0020007B,
-	MLAN_OID_MISC_DOT11MC_UNASSOC_FTM_CFG = 0x0020007C,
-	MLAN_OID_MISC_TP_STATE = 0x0020007D,
-	MLAN_OID_MISC_HAL_PHY_CFG = 0x0020007E,
-	MLAN_OID_MISC_RF_TEST_HE_POWER = 0X0020007F,
-#ifdef UAP_SUPPORT
-	MLAN_OID_MISC_WACP_MODE = 0x00200081,
-#endif
-	MLAN_OID_MISC_GPIO_TSF_LATCH = 0x00200082,
-	MLAN_OID_MISC_GET_TSF_INFO = 0x00200083,
-	MLAN_OID_MISC_ASSOC_REQ = 0x00200084,
-	MLAN_OID_MISC_IPS_CFG = 0x00200085,
-	MLAN_OID_MISC_MC_AGGR_CFG = 0x00200086,
-	MLAN_OID_MISC_CH_LOAD = 0x00200087,
-	MLAN_OID_MISC_STATS = 0x00200088,
-	MLAN_OID_MISC_CH_LOAD_RESULTS = 0x00200089,
-};
-
-/** Sub command size */
-#define MLAN_SUB_COMMAND_SIZE 4
-
-/** Enumeration for the action of IOCTL request */
-enum _mlan_act_ioctl {
-	MLAN_ACT_SET = 1,
-	MLAN_ACT_GET,
-	MLAN_ACT_CANCEL,
-	MLAN_ACT_CLEAR,
-	MLAN_ACT_RESET,
-	MLAN_ACT_DEFAULT
-};
-
-/** Enumeration for generic enable/disable */
-enum _mlan_act_generic { MLAN_ACT_DISABLE = 0, MLAN_ACT_ENABLE = 1 };
-
-/** Enumeration for scan mode */
-enum _mlan_scan_mode {
-	MLAN_SCAN_MODE_UNCHANGED = 0,
-	MLAN_SCAN_MODE_BSS,
-	MLAN_SCAN_MODE_IBSS,
-	MLAN_SCAN_MODE_ANY
-};
-
-/** Enumeration for scan type */
-enum _mlan_scan_type {
-	MLAN_SCAN_TYPE_UNCHANGED = 0,
-	MLAN_SCAN_TYPE_ACTIVE,
-	MLAN_SCAN_TYPE_PASSIVE,
-	MLAN_SCAN_TYPE_PASSIVE_TO_ACTIVE
-};
-
-/** Enumeration for passive to active scan */
-enum _mlan_pass_to_act_scan {
-	MLAN_PASS_TO_ACT_SCAN_UNCHANGED = 0,
-	MLAN_PASS_TO_ACT_SCAN_EN,
-	MLAN_PASS_TO_ACT_SCAN_DIS
-};
-
-/** Enumeration for passive to active scan */
-enum _mlan_ext_scan {
-	MLAN_EXTENDED_SCAN_UNCHANGED = 0,
-	MLAN_LEGACY_SCAN,
-	MLAN_EXT_SCAN,
-	MLAN_EXT_SCAN_ENH
-};
-
-/** Max number of supported rates */
-#define MLAN_SUPPORTED_RATES 32
-
-/** Mrvl Proprietary Tlv base */
-#define PROPRIETARY_TLV_BASE_ID 0x100
-
-/** RSSI scan */
-#define SCAN_RSSI(RSSI) (0x100 - ((t_u8)(RSSI)))
-
-/** Max passive scan time for each channel in milliseconds */
-#define MRVDRV_MAX_PASSIVE_SCAN_CHAN_TIME 2000
-
-/** Max active scan time for each channel in milliseconds  */
-#define MRVDRV_MAX_ACTIVE_SCAN_CHAN_TIME 500
-/** Max gap time between 2 scan in milliseconds  */
-#define MRVDRV_MAX_SCAN_CHAN_GAP_TIME 500
-
-/** Maximum number of probes to send on each channel */
-#define MAX_PROBES 5
-
-/** Default number of probes to send on each channel */
-#define DEFAULT_PROBES 4
-
-/**
- *  @brief Sub-structure passed in wlan_ioctl_get_scan_table_entry for each BSS
- *
- *  Fixed field information returned for the scan response in the IOCTL
- *    response.
- */
-typedef struct _wlan_get_scan_table_fixed {
-	/** BSSID of this network */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** Channel this beacon/probe response was detected */
-	t_u8 channel;
-	/** RSSI for the received packet */
-	t_u8 rssi;
-	/** channel load */
-	t_u8 chan_load;
-	/** TSF value in microseconds from the firmware at packet reception */
-	t_u64 network_tsf;
-} wlan_get_scan_table_fixed;
-
-/** mlan_802_11_ssid data structure */
-typedef struct _mlan_802_11_ssid {
-	/** SSID Length */
-	t_u32 ssid_len;
-	/** SSID information field */
-	t_u8 ssid[MLAN_MAX_SSID_LENGTH];
-} mlan_802_11_ssid, *pmlan_802_11_ssid;
-
-typedef MLAN_PACK_START struct _tx_status_event {
-	/** packet type */
-	t_u8 packet_type;
-	/** tx_token_id */
-	t_u8 tx_token_id;
-	/** 0--success, 1--fail, 2--watchdogtimeout */
-	t_u8 status;
-} MLAN_PACK_END tx_status_event;
-
-/**
- *  Sructure to retrieve the scan table
- */
-typedef struct {
-	/**
-	 *  - Zero based scan entry to start retrieval in command request
-	 *  - Number of scans entries returned in command response
-	 */
-	t_u32 scan_number;
-	/**
-	 * Buffer marker for multiple wlan_ioctl_get_scan_table_entry
-	 * structures. Each struct is padded to the nearest 32 bit boundary.
-	 */
-	t_u8 scan_table_entry_buf[1];
-} wlan_ioctl_get_scan_table_info;
-
-/**
- *  Structure passed in the wlan_ioctl_get_scan_table_info for each
- *    BSS returned in the WLAN_GET_SCAN_RESP IOCTL
- */
-typedef struct _wlan_ioctl_get_scan_table_entry {
-	/**
-	 *  Fixed field length included in the response.
-	 *
-	 *  Length value is included so future fixed fields can be added to the
-	 *   response without breaking backwards compatibility.  Use the length
-	 *   to find the offset for the bssInfoLength field, not a sizeof()
-	 * calc.
-	 */
-	t_u32 fixed_field_length;
-
-	/**
-	 *  Length of the BSS Information (probe resp or beacon) that
-	 *    follows after the fixed_field_length
-	 */
-	t_u32 bss_info_length;
-
-	/**
-	 *  Always present, fixed length data fields for the BSS
-	 */
-	wlan_get_scan_table_fixed fixed_fields;
-
-	/*
-	 * Probe response or beacon scanned for the BSS.
-	 *
-	 * Field layout:
-	 *  - TSF              8 octets
-	 *  - Beacon Interval  2 octets
-	 *  - Capability Info  2 octets
-	 *
-	 *  - IEEE Infomation Elements; variable number & length per 802.11 spec
-	 */
-	/* t_u8  bss_info_buffer[]; */
-} wlan_ioctl_get_scan_table_entry;
-
-/** Type definition of mlan_scan_time_params */
-typedef struct _mlan_scan_time_params {
-	/** Scan channel time for specific scan in milliseconds */
-	t_u32 specific_scan_time;
-	/** Scan channel time for active scan in milliseconds */
-	t_u32 active_scan_time;
-	/** Scan channel time for passive scan in milliseconds */
-	t_u32 passive_scan_time;
-} mlan_scan_time_params, *pmlan_scan_time_params;
-
-/** Type definition of mlan_user_scan */
-typedef struct _mlan_user_scan {
-	/** Length of scan_cfg_buf */
-	t_u32 scan_cfg_len;
-	/** Buffer of scan config */
-	t_u8 scan_cfg_buf[1];
-} mlan_user_scan, *pmlan_user_scan;
-
-/** Type definition of mlan_scan_req */
-typedef struct _mlan_scan_req {
-	/** BSS mode for scanning */
-	t_u32 scan_mode;
-	/** Scan type */
-	t_u32 scan_type;
-	/** SSID */
-	mlan_802_11_ssid scan_ssid;
-	/** Scan time parameters */
-	mlan_scan_time_params scan_time;
-	/** Scan config parameters in user scan */
-	mlan_user_scan user_scan;
-} mlan_scan_req, *pmlan_scan_req;
-
-/** Type defnition of mlan_scan_resp */
-typedef struct _mlan_scan_resp {
-	/** Number of scan result */
-	t_u32 num_in_scan_table;
-	/** Scan table */
-	t_u8 *pscan_table;
-	/* Age in seconds */
-	t_u32 age_in_secs;
-	/** channel statstics */
-	t_u8 *pchan_stats;
-	/** Number of records in the chan_stats */
-	t_u32 num_in_chan_stats;
-} mlan_scan_resp, *pmlan_scan_resp;
-
-#define EXT_SCAN_TYPE_ENH 2
-/** Type definition of mlan_scan_cfg */
-typedef struct _mlan_scan_cfg {
-	/** Scan type */
-	t_u32 scan_type;
-	/** BSS mode for scanning */
-	t_u32 scan_mode;
-	/** Scan probe */
-	t_u32 scan_probe;
-	/** Scan time parameters */
-	mlan_scan_time_params scan_time;
-	/** First passive scan then active scan */
-	t_u8 passive_to_active_scan;
-	/** Ext_scan:  0 disable, 1: enable, 2: enhance scan*/
-	t_u32 ext_scan;
-	/** scan channel gap */
-	t_u32 scan_chan_gap;
-} mlan_scan_cfg, *pmlan_scan_cfg;
-
-/** Type defnition of mlan_ds_scan for MLAN_IOCTL_SCAN */
-typedef struct _mlan_ds_scan {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Scan request/response */
-	union {
-		/** Scan request */
-		mlan_scan_req scan_req;
-		/** Scan response */
-		mlan_scan_resp scan_resp;
-		/** Scan config parameters in user scan */
-		mlan_user_scan user_scan;
-		/** Scan config parameters */
-		mlan_scan_cfg scan_cfg;
-	} param;
-} mlan_ds_scan, *pmlan_ds_scan;
-
-/*-----------------------------------------------------------------*/
-/** BSS Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Enumeration for BSS mode */
-enum _mlan_bss_mode {
-	MLAN_BSS_MODE_INFRA = 1,
-	MLAN_BSS_MODE_IBSS,
-	MLAN_BSS_MODE_AUTO
-};
-
-/** Maximum key length */
-#define MLAN_MAX_KEY_LENGTH 32
-/** Maximum PMK R0 NAME key length */
-#define MLAN_MAX_PMKR0_NAME_LENGTH 16
-
-/** Maximum atim window in milliseconds */
-#define MLAN_MAX_ATIM_WINDOW 50
-
-/** Minimum beacon interval */
-#define MLAN_MIN_BEACON_INTERVAL 20
-/** Maximum beacon interval */
-#define MLAN_MAX_BEACON_INTERVAL 1000
-/** Default beacon interval */
-#define MLAN_BEACON_INTERVAL 100
-
-/** Receive all packets */
-#define MLAN_PROMISC_MODE 1
-/** Receive multicast packets in multicast list */
-#define MLAN_MULTICAST_MODE 2
-/** Receive all multicast packets */
-#define MLAN_ALL_MULTI_MODE 4
-
-/** Maximum size of multicast list */
-#define MLAN_MAX_MULTICAST_LIST_SIZE 32
-
-/** mlan_multicast_list data structure for MLAN_OID_BSS_MULTICAST_LIST */
-typedef struct _mlan_multicast_list {
-	/** Multicast mode */
-	t_u32 mode;
-	/** Number of multicast addresses in the list */
-	t_u32 num_multicast_addr;
-	/** Multicast address list */
-	mlan_802_11_mac_addr mac_list[MLAN_MAX_MULTICAST_LIST_SIZE];
-} mlan_multicast_list, *pmlan_multicast_list;
-
-/** Max channel */
-#define MLAN_MAX_CHANNEL 177
-/** Maximum number of channels in table */
-#define MLAN_MAX_CHANNEL_NUM 128
-
-/** Channel/frequence for MLAN_OID_BSS_CHANNEL */
-typedef struct _chan_freq {
-	/** Channel Number */
-	t_u32 channel;
-	/** Frequency of this Channel */
-	t_u32 freq;
-} chan_freq;
-
-/** mlan_chan_list data structure for MLAN_OID_BSS_CHANNEL_LIST */
-typedef struct _mlan_chan_list {
-	/** Number of channel */
-	t_u32 num_of_chan;
-	/** Channel-Frequency table */
-	chan_freq cf[MLAN_MAX_CHANNEL_NUM];
-} mlan_chan_list;
-
-/* This channel is disabled.*/
-#define CHAN_FLAGS_DISABLED MBIT(0)
-/* do not initiate radiation, this includes sending probe requests or beaconing
- */
-#define CHAN_FLAGS_NO_IR MBIT(1)
-/* Radar detection is required on this channel */
-#define CHAN_FLAGS_RADAR MBIT(3)
-/* extension channel above this channel is not permitted */
-#define CHAN_FLAGS_NO_HT40PLUS MBIT(4)
-/* extension channel below this channel is not permitted */
-#define CHAN_FLAGS_NO_HT40MINUS MBIT(5)
-/* OFDM is not allowed on this channel */
-#define CHAN_FLAGS_NO_OFDM MBIT(6)
-/** 80Mhz can not used on this channel */
-#define CHAN_FLAGS_NO_80MHZ MBIT(7)
-/** 180Mhz can not used on this channel */
-#define CHAN_FLAGS_NO_160MHZ MBIT(8)
-/* Only indoor use is permitted on this channel */
-#define CHAN_FLAGS_INDOOR_ONLY MBIT(9)
-/* IR operation is allowed on this channel if it's
- * connected concurrently to a BSS on the same channel on
- * the 2 GHz band or to a channel in the same UNII band (on the 5 GHz
- * band), and IEEE80211_CHAN_RADAR is not set */
-#define CHAN_FLAGS_IR_CONCURRENT MBIT(10)
-/* 20 MHz operation is not allowed on this channel */
-#define CHAN_FLAGS_20MHZ MBIT(11)
-/* 10 MHz operation is not allowed on this channel */
-#define CHAN_FLAGS_NO_10MHZ MBIT(12)
-/** This channel's flag is valid */
-#define CHAN_FLAGS_MAX MBIT(31)
-
-/** Maximum response buffer length */
-#define ASSOC_RSP_BUF_SIZE 500
-
-/** Type definition of mlan_ds_misc_assoc_rsp for MLAN_OID_MISC_ASSOC_RSP */
-typedef struct _mlan_ds_misc_assoc_rsp {
-	/** Associate response buffer */
-	t_u8 assoc_resp_buf[ASSOC_RSP_BUF_SIZE];
-	/** Response buffer length */
-	t_u32 assoc_resp_len;
-} mlan_ds_misc_assoc_rsp, *pmlan_ds_misc_assoc_rsp;
-
-/** Type definition of mlan_ds_misc_assoc_req for MLAN_OID_MISC_ASSOC_REQ */
-typedef struct _mlan_ds_misc_assoc_req {
-	/** Associate req buffer */
-	t_u8 assoc_req_buf[ASSOC_RSP_BUF_SIZE];
-	/** Response buffer length */
-	t_u32 assoc_req_len;
-} mlan_ds_misc_assoc_req, *pmlan_ds_misc_assoc_req;
-
-/** mlan_ds_assoc_info */
-typedef struct _mlan_ds_assoc_info {
-	/** Associate req buffer */
-	t_u8 assoc_resp_buf[ASSOC_RSP_BUF_SIZE];
-	/** Response buffer length */
-	t_u32 assoc_resp_len;
-	/** Associate req buffer */
-	t_u8 assoc_req_buf[ASSOC_RSP_BUF_SIZE];
-	/** Response buffer length */
-	t_u32 assoc_req_len;
-} mlan_ds_assoc_info, *pmlan_ds_assoc_info;
-
-/** mlan_ssid_bssid  data structure for
- *  MLAN_OID_BSS_START and MLAN_OID_BSS_FIND_BSS
- */
-typedef struct _mlan_ssid_bssid {
-	/** SSID */
-	mlan_802_11_ssid ssid;
-	/** BSSID */
-	mlan_802_11_mac_addr bssid;
-	/** index in BSSID list, start from 1 */
-	t_u32 idx;
-	/** Receive signal strength in dBm */
-	t_s32 rssi;
-	/* previous bssid */
-	mlan_802_11_mac_addr prev_bssid;
-	/**channel*/
-	t_u16 channel;
-	/**mobility domain value*/
-	t_u16 ft_md;
-	/**ft capability*/
-	t_u8 ft_cap;
-	/**band*/
-	t_u16 bss_band;
-	/** channel flag */
-	t_u32 channel_flags;
-	/** host mlme flag*/
-	t_u8 host_mlme;
-	/** assoicate resp frame/ie from firmware */
-	mlan_ds_misc_assoc_rsp assoc_rsp;
-	t_u8 owe_transition_mode;
-	/** Transition SSID */
-	mlan_802_11_ssid trans_ssid;
-	/** Transition BSSID */
-	mlan_802_11_mac_addr trans_bssid;
-} mlan_ssid_bssid, *pmlan_ssid_bssid;
-
-/** Data structure of WMM ECW */
-typedef struct _wmm_ecw_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Maximum Ecw */
-	t_u8 ecw_max : 4;
-	/** Minimum Ecw */
-	t_u8 ecw_min : 4;
-#else
-	/** Minimum Ecw */
-	t_u8 ecw_min : 4;
-	/** Maximum Ecw */
-	t_u8 ecw_max : 4;
-#endif /* BIG_ENDIAN_SUPPORT */
-} wmm_ecw_t, *pwmm_ecw_t;
-
-/** Data structure of WMM Aci/Aifsn */
-typedef struct _wmm_aci_aifsn_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** Reserved */
-	t_u8 reserved : 1;
-	/** Aci */
-	t_u8 aci : 2;
-	/** Acm */
-	t_u8 acm : 1;
-	/** Aifsn */
-	t_u8 aifsn : 4;
-#else
-	/** Aifsn */
-	t_u8 aifsn : 4;
-	/** Acm */
-	t_u8 acm : 1;
-	/** Aci */
-	t_u8 aci : 2;
-	/** Reserved */
-	t_u8 reserved : 1;
-#endif /* BIG_ENDIAN_SUPPORT */
-} wmm_aci_aifsn_t, *pwmm_aci_aifsn_t;
-
-/** Data structure of WMM AC parameters  */
-typedef struct _wmm_ac_parameters_t {
-	wmm_aci_aifsn_t aci_aifsn; /**< AciAifSn */
-	wmm_ecw_t ecw; /**< Ecw */
-	t_u16 tx_op_limit; /**< Tx op limit */
-} wmm_ac_parameters_t, *pwmm_ac_parameters_t;
-
-/** mlan_deauth_param */
-typedef struct _mlan_deauth_param {
-	/** STA mac addr */
-	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
-	/** deauth reason */
-	t_u16 reason_code;
-} mlan_deauth_param;
-
-#ifdef UAP_SUPPORT
-/** UAP FLAG: Host based */
-#define UAP_FLAG_HOST_BASED MBIT(0)
-/** UAP FLAG: Host mlme */
-#define UAP_FLAG_HOST_MLME MBIT(1)
-
-/** Maximum packet forward control value */
-#define MAX_PKT_FWD_CTRL 15
-/** Maximum BEACON period */
-#define MAX_BEACON_PERIOD 4000
-/** Minimum BEACON period */
-#define MIN_BEACON_PERIOD 50
-/** Maximum DTIM period */
-#define MAX_DTIM_PERIOD 100
-/** Minimum DTIM period */
-#define MIN_DTIM_PERIOD 1
-/** Maximum TX Power Limit */
-#define MAX_TX_POWER 20
-/** Minimum TX Power Limit */
-#define MIN_TX_POWER 0
-/** MAX station count */
-#define MAX_STA_COUNT 64
-/** Maximum RTS threshold */
-#define MAX_RTS_THRESHOLD 2347
-/** Maximum fragmentation threshold */
-#define MAX_FRAG_THRESHOLD 2346
-/** Minimum fragmentation threshold */
-#define MIN_FRAG_THRESHOLD 256
-/** data rate 54 M */
-#define DATA_RATE_54M 108
-/** Maximum value of bcast_ssid_ctl */
-#define MAX_BCAST_SSID_CTL 2
-/** antenna A */
-#define ANTENNA_MODE_A 0
-/** antenna B */
-#define ANTENNA_MODE_B 1
-/** transmit antenna */
-#define TX_ANTENNA 1
-/** receive antenna */
-#define RX_ANTENNA 0
-/** Maximum stage out time */
-#define MAX_STAGE_OUT_TIME 864000
-/** Minimum stage out time */
-#define MIN_STAGE_OUT_TIME 50
-/** Maximum Retry Limit */
-#define MAX_RETRY_LIMIT 14
-
-/** Maximum group key timer in seconds */
-#define MAX_GRP_TIMER 86400
-
-/** Maximum value of 4 byte configuration */
-#define MAX_VALID_DWORD 0x7FFFFFFF /*  (1 << 31) - 1 */
-
-/** default UAP BAND 2.4G */
-#define DEFAULT_UAP_BAND 0
-/** default UAP channel 6 */
-#define DEFAULT_UAP_CHANNEL 6
-
-/** Maximum data rates */
-#define MAX_DATA_RATES 14
-
-/** auto data rate */
-#define DATA_RATE_AUTO 0
-
-/**filter mode: disable */
-#define MAC_FILTER_MODE_DISABLE 0
-/**filter mode: block mac address */
-#define MAC_FILTER_MODE_ALLOW_MAC 1
-/**filter mode: block mac address */
-#define MAC_FILTER_MODE_BLOCK_MAC 2
-/** Maximum mac filter num */
-#define MAX_MAC_FILTER_NUM 64
-
-/* Bitmap for protocol to use */
-/** No security */
-#define PROTOCOL_NO_SECURITY 0x01
-/** Static WEP */
-#define PROTOCOL_STATIC_WEP 0x02
-/** WPA */
-#define PROTOCOL_WPA 0x08
-/** WPA2 */
-#define PROTOCOL_WPA2 0x20
-/** WP2 Mixed */
-#define PROTOCOL_WPA2_MIXED 0x28
-/** EAP */
-#define PROTOCOL_EAP 0x40
-/** WAPI */
-#define PROTOCOL_WAPI 0x80
-/** WPA3 SAE */
-#define PROTOCOL_WPA3_SAE 0x100
-/** OWE */
-#define PROTOCOL_OWE 0x200
-
-/** Key_mgmt_psk */
-#define KEY_MGMT_NONE 0x04
-/** Key_mgmt_none */
-#define KEY_MGMT_PSK 0x02
-/** Key_mgmt_eap  */
-#define KEY_MGMT_EAP 0x01
-/** Key_mgmt_psk_sha256 */
-#define KEY_MGMT_PSK_SHA256 0x100
-/** Key_mgmt_sae */
-#define KEY_MGMT_SAE 0x400
-/** Key_mgmt_owe */
-#define KEY_MGMT_OWE 0x200
-
-/** TKIP */
-#define CIPHER_TKIP 0x04
-/** AES CCMP */
-#define CIPHER_AES_CCMP 0x08
-
-/** Valid cipher bitmap */
-#define VALID_CIPHER_BITMAP 0x0c
-
-/** Packet forwarding to be done by FW or host */
-#define PKT_FWD_FW_BIT 0x01
-/** Intra-BSS broadcast packet forwarding allow bit */
-#define PKT_FWD_INTRA_BCAST 0x02
-/** Intra-BSS unicast packet forwarding allow bit */
-#define PKT_FWD_INTRA_UCAST 0x04
-/** Inter-BSS unicast packet forwarding allow bit */
-#define PKT_FWD_INTER_UCAST 0x08
-/** Intra-BSS unicast packet */
-#define PKT_INTRA_UCAST 0x01
-/** Inter-BSS unicast packet */
-#define PKT_INTER_UCAST 0x02
-/** Enable Host PKT forwarding */
-#define PKT_FWD_ENABLE_BIT 0x01
-
-/** Channel List Entry */
-typedef struct _channel_list {
-	/** Channel Number */
-	t_u8 chan_number;
-	/** Band Config */
-	Band_Config_t bandcfg;
-} scan_chan_list;
-
-/** mac_filter data structure */
-typedef struct _mac_filter {
-	/** mac filter mode */
-	t_u16 filter_mode;
-	/** mac adress count */
-	t_u16 mac_count;
-	/** mac address list */
-	mlan_802_11_mac_addr mac_list[MAX_MAC_FILTER_NUM];
-} mac_filter;
-
-/** wpa parameter */
-typedef struct _wpa_param {
-	/** Pairwise cipher WPA */
-	t_u8 pairwise_cipher_wpa;
-	/** Pairwise cipher WPA2 */
-	t_u8 pairwise_cipher_wpa2;
-	/** group cipher */
-	t_u8 group_cipher;
-	/** RSN replay protection */
-	t_u8 rsn_protection;
-	/** passphrase length */
-	t_u32 length;
-	/** passphrase */
-	t_u8 passphrase[64];
-	/**group key rekey time in seconds */
-	t_u32 gk_rekey_time;
-} wpa_param;
-
-/** wep key */
-typedef struct _wep_key {
-	/** key index 0-3 */
-	t_u8 key_index;
-	/** is default */
-	t_u8 is_default;
-	/** length */
-	t_u16 length;
-	/** key data */
-	t_u8 key[26];
-} wep_key;
-
-/** wep param */
-typedef struct _wep_param {
-	/** key 0 */
-	wep_key key0;
-	/** key 1 */
-	wep_key key1;
-	/** key 2 */
-	wep_key key2;
-	/** key 3 */
-	wep_key key3;
-} wep_param;
-
-/** Data structure of WMM QoS information */
-typedef struct _wmm_qos_info_t {
-#ifdef BIG_ENDIAN_SUPPORT
-	/** QoS UAPSD */
-	t_u8 qos_uapsd : 1;
-	/** Reserved */
-	t_u8 reserved : 3;
-	/** Parameter set count */
-	t_u8 para_set_count : 4;
-#else
-	/** Parameter set count */
-	t_u8 para_set_count : 4;
-	/** Reserved */
-	t_u8 reserved : 3;
-	/** QoS UAPSD */
-	t_u8 qos_uapsd : 1;
-#endif /* BIG_ENDIAN_SUPPORT */
-} wmm_qos_info_t, *pwmm_qos_info_t;
-
-/** Data structure of WMM parameter IE  */
-typedef struct _wmm_parameter_t {
-	/** OuiType:  00:50:f2:02 */
-	t_u8 ouitype[4];
-	/** Oui subtype: 01 */
-	t_u8 ouisubtype;
-	/** version: 01 */
-	t_u8 version;
-	/** QoS information */
-	t_u8 qos_info;
-	/** Reserved */
-	t_u8 reserved;
-	/** AC Parameters Record WMM_AC_BE, WMM_AC_BK, WMM_AC_VI, WMM_AC_VO */
-	wmm_ac_parameters_t ac_params[MAX_AC_QUEUES];
-} wmm_parameter_t, *pwmm_parameter_t;
-
-/** MAX BG channel */
-#define MAX_BG_CHANNEL 14
-/** mlan_bss_param
- * Note: For each entry you must enter an invalid value
- * in the MOAL function woal_set_sys_config_invalid_data().
- * Otherwise for a valid data an unwanted TLV will be
- * added to that command.
- */
-typedef struct _mlan_uap_bss_param {
-	/** AP mac addr */
-	mlan_802_11_mac_addr mac_addr;
-	/** SSID */
-	mlan_802_11_ssid ssid;
-	/** Broadcast ssid control */
-	t_u8 bcast_ssid_ctl;
-	/** Radio control: on/off */
-	t_u8 radio_ctl;
-	/** dtim period */
-	t_u8 dtim_period;
-	/** beacon period */
-	t_u16 beacon_period;
-	/** rates */
-	t_u8 rates[MAX_DATA_RATES];
-	/** Tx data rate */
-	t_u16 tx_data_rate;
-	/** Tx beacon rate */
-	t_u16 tx_beacon_rate;
-	/** multicast/broadcast data rate */
-	t_u16 mcbc_data_rate;
-	/** Tx power level in dBm */
-	t_u8 tx_power_level;
-	/** Tx antenna */
-	t_u8 tx_antenna;
-	/** Rx antenna */
-	t_u8 rx_antenna;
-	/** packet forward control */
-	t_u8 pkt_forward_ctl;
-	/** max station count */
-	t_u16 max_sta_count;
-	/** mac filter */
-	mac_filter filter;
-	/** station ageout timer in unit of 100ms  */
-	t_u32 sta_ageout_timer;
-	/** PS station ageout timer in unit of 100ms  */
-	t_u32 ps_sta_ageout_timer;
-	/** RTS threshold */
-	t_u16 rts_threshold;
-	/** fragmentation threshold */
-	t_u16 frag_threshold;
-	/**  retry_limit */
-	t_u16 retry_limit;
-	/**  pairwise update timeout in milliseconds */
-	t_u32 pairwise_update_timeout;
-	/** pairwise handshake retries */
-	t_u32 pwk_retries;
-	/**  groupwise update timeout in milliseconds */
-	t_u32 groupwise_update_timeout;
-	/** groupwise handshake retries */
-	t_u32 gwk_retries;
-	/** preamble type */
-	t_u8 preamble_type;
-	/** band cfg */
-	Band_Config_t bandcfg;
-	/** channel */
-	t_u8 channel;
-	/** auth mode */
-	t_u16 auth_mode;
-	/** PWE derivation */
-	t_u8 pwe_derivation;
-	/** transition disable */
-	t_u8 transition_disable;
-	/** encryption protocol */
-	t_u16 protocol;
-	/** key managment type */
-	t_u16 key_mgmt;
-	/** wep param */
-	wep_param wep_cfg;
-	/** wpa param */
-	wpa_param wpa_cfg;
-	/** Mgmt IE passthru mask */
-	t_u32 mgmt_ie_passthru_mask;
-	/*
-	 * 11n HT Cap  HTCap_t  ht_cap
-	 */
-	/** HT Capabilities Info field */
-	t_u16 ht_cap_info;
-	/** A-MPDU Parameters field */
-	t_u8 ampdu_param;
-	/** Supported MCS Set field */
-	t_u8 supported_mcs_set[16];
-	/** HT Extended Capabilities field */
-	t_u16 ht_ext_cap;
-	/** Transmit Beamforming Capabilities field */
-	t_u32 tx_bf_cap;
-	/** Antenna Selection Capability field */
-	t_u8 asel;
-	/** Enable 2040 Coex */
-	t_u8 enable_2040coex;
-	/** key management operation */
-	t_u16 key_mgmt_operation;
-	/** BSS status */
-	t_u16 bss_status;
-#ifdef WIFI_DIRECT_SUPPORT
-	/* pre shared key */
-	t_u8 psk[MLAN_MAX_KEY_LENGTH];
-#endif /* WIFI_DIRECT_SUPPORT */
-	/** Number of channels in scan_channel_list */
-	t_u32 num_of_chan;
-	/** scan channel list in ACS mode */
-	scan_chan_list chan_list[MLAN_MAX_CHANNEL];
-	/** Wmm parameters */
-	wmm_parameter_t wmm_para;
-
-	/** uap host based config */
-	t_u32 uap_host_based_config;
-} mlan_uap_bss_param, *pmlan_uap_bss_param;
-
-/** mlan_uap_scan_channels */
-typedef struct _mlan_uap_scan_channels {
-	/** flag for remove nop channel*/
-	t_u8 remove_nop_channel;
-	/** num of removed channel */
-	t_u8 num_remvoed_channel;
-	/** Number of channels in scan_channel_list */
-	t_u32 num_of_chan;
-	/** scan channel list in ACS mode */
-	scan_chan_list chan_list[MLAN_MAX_CHANNEL];
-} mlan_uap_scan_channels;
-
-#define MAX_NUM_PKTS 9
-#define DEF_NUM_PKTS 3
-/** mlan_chan_switch_param */
-typedef struct _mlan_action_chan_switch {
-	/** mode*/
-	t_u8 mode;
-	/** switch mode*/
-	t_u8 chan_switch_mode;
-	/** oper class*/
-	t_u8 new_oper_class;
-	/** new channel */
-	t_u8 new_channel_num;
-	/** chan_switch_count */
-	t_u8 chan_switch_count;
-} mlan_action_chan_switch;
-
-/** mlan_uap_oper_ctrl */
-typedef struct _mlan_uap_oper_ctrl {
-	/** control value
-	 *  0: do nothing,
-	 *  2: uap stops and restarts automaticaly
-	 */
-	t_u16 ctrl_value;
-	/** channel opt
-	 *  1: uap restart on default 2.4G/channel 6
-	 *  2: uap restart on the band/channel configured by driver previously
-	 *  3: uap restart on the band/channel specified by band_cfg and channel
-	 */
-	t_u16 chan_opt;
-	/** band cfg   0
-	 *  0: 20Mhz  2: 40 Mhz  3: 80Mhz
-	 */
-	t_u8 band_cfg;
-	/** channel */
-	t_u8 channel;
-} mlan_uap_oper_ctrl;
-
-/** mlan_uap_acs_scan */
-typedef struct _mlan_uap_acs_scan {
-	/** band */
-	Band_Config_t bandcfg;
-	/** channel */
-	t_u8 chan;
-} mlan_uap_acs_scan;
-
-/** station is authorized (802.1X) */
-#define STA_FLAG_AUTHORIZED MBIT(1)
-/** Station is capable of receiving frames with short barker preamble */
-#define STA_FLAG_SHORT_PREAMBLE MBIT(2)
-/** station is WME/QoS capable */
-#define STA_FLAG_WME MBIT(3)
-/** station uses management frame protection */
-#define STA_FLAG_MFP MBIT(4)
-/** station is authenticated */
-#define STA_FLAG_AUTHENTICATED MBIT(5)
-/** station is a TDLS peer */
-#define STA_FLAG_TDLS_PEER MBIT(6)
-/** station is associated */
-#define STA_FLAG_ASSOCIATED MBIT(7)
-/** mlan_ds_sta_info */
-typedef struct _mlan_ds_sta_info {
-	/** aid */
-	t_u16 aid;
-	/** peer_mac */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Listen Interval */
-	int listen_interval;
-	/** Capability Info */
-	t_u16 cap_info;
-	/** station flag */
-	t_u32 sta_flags;
-	/** tlv len */
-	t_u16 tlv_len;
-	/** tlv start */
-	t_u8 tlv[];
-} mlan_ds_sta_info;
-#endif
-
-#ifdef WIFI_DIRECT_SUPPORT
-/** mode: disable wifi direct */
-#define WIFI_DIRECT_MODE_DISABLE 0
-/** mode: listen */
-#define WIFI_DIRECT_MODE_LISTEN 1
-/** mode: GO */
-#define WIFI_DIRECT_MODE_GO 2
-/** mode: client */
-#define WIFI_DIRECT_MODE_CLIENT 3
-/** mode: find */
-#define WIFI_DIRECT_MODE_FIND 4
-/** mode: stop find */
-#define WIFI_DIRECT_MODE_STOP_FIND 5
-#endif
-
-/** Type definition of mlan_ds_bss for MLAN_IOCTL_BSS */
-typedef struct _mlan_ds_bss {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** BSS parameter */
-	union {
-		/** SSID-BSSID for MLAN_OID_BSS_START */
-		mlan_ssid_bssid ssid_bssid;
-		/** BSSID for MLAN_OID_BSS_STOP */
-		mlan_802_11_mac_addr bssid;
-		/** BSS mode for MLAN_OID_BSS_MODE */
-		t_u32 bss_mode;
-		/** BSS channel/frequency for MLAN_OID_BSS_CHANNEL */
-		chan_freq bss_chan;
-		/** BSS channel list for MLAN_OID_BSS_CHANNEL_LIST */
-		mlan_chan_list chanlist;
-		/** MAC address for MLAN_OID_BSS_MAC_ADDR */
-		mlan_802_11_mac_addr mac_addr;
-		/** Multicast list for MLAN_OID_BSS_MULTICAST_LIST */
-		mlan_multicast_list multicast_list;
-		/** Beacon interval for MLAN_OID_IBSS_BCN_INTERVAL */
-		t_u32 bcn_interval;
-		/** ATIM window for MLAN_OID_IBSS_ATIM_WINDOW */
-		t_u32 atim_window;
-		/** deauth param for MLAN_OID_BSS_STOP & MLAN_OID_UAP_DEAUTH_STA
-		 */
-		mlan_deauth_param deauth_param;
-#ifdef UAP_SUPPORT
-		/** host based flag for MLAN_OID_BSS_START */
-		t_u8 host_based;
-		/** BSS param for AP mode for MLAN_OID_UAP_BSS_CONFIG */
-		mlan_uap_bss_param bss_config;
-		/** AP Wmm parameters for MLAN_OID_UAP_CFG_WMM_PARAM */
-		wmm_parameter_t ap_wmm_para;
-		/** ap scan channels for MLAN_OID_UAP_SCAN_CHANNELS*/
-		mlan_uap_scan_channels ap_scan_channels;
-		/** channel switch for MLAN_OID_UAP_CHAN_SWITCH */
-		mlan_action_chan_switch chanswitch;
-		/** ap channel for MLAN_OID_UAP_CHANNEL*/
-		chan_band_info ap_channel;
-		/** ap operation control for MLAN_OID_UAP_OPER_CTRL*/
-		mlan_uap_oper_ctrl ap_oper_ctrl;
-		/** AP acs scan 	    MLAN_OID_UAP_ACS_SCAN */
-		mlan_uap_acs_scan ap_acs_scan;
-#endif
-#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
-		/** BSS role for MLAN_OID_BSS_ROLE */
-		t_u8 bss_role;
-#endif
-#ifdef WIFI_DIRECT_SUPPORT
-		/** wifi direct mode for MLAN_OID_WIFI_DIRECT_MODE */
-		t_u16 wfd_mode;
-#endif
-#ifdef STA_SUPPORT
-		/** Listen interval for MLAN_OID_BSS_LISTEN_INTERVAL */
-		t_u16 listen_interval;
-		/** STA channel info for MLAN_OID_BSS_CHAN_INFO */
-		chan_band_info sta_channel;
-#endif
-#ifdef UAP_SUPPORT
-		/** STA info for MLAN_OID_UAP_ADD_STATION */
-		mlan_ds_sta_info sta_info;
-#endif
-	} param;
-} mlan_ds_bss, *pmlan_ds_bss;
-
-/* OTP Region info */
-typedef MLAN_PACK_START struct _otp_region_info {
-	t_u8 country_code[2];
-	t_u8 region_code;
-	t_u8 environment;
-	t_u8 force_reg : 1;
-	t_u8 reserved : 7;
-	t_u8 dfs_region;
-} MLAN_PACK_END otp_region_info_t;
-
-/** Type definition of mlan_ds_custom_reg_domain */
-typedef struct _mlan_ds_custom_reg_domain {
-	otp_region_info_t region;
-	/** num of 2g channels in custom_reg_domain */
-	t_u8 num_bg_chan;
-	/** num of 5g channels in custom_reg_domain */
-	t_u8 num_a_chan;
-	/** cfp table */
-	chan_freq_power_t cfp_tbl[];
-} mlan_ds_custom_reg_domain;
-/*-----------------------------------------------------------------*/
-/** Radio Control Group */
-/*-----------------------------------------------------------------*/
-/** Enumeration for band */
-enum _mlan_band_def {
-	BAND_B = 1,
-	BAND_G = 2,
-	BAND_A = 4,
-	BAND_GN = 8,
-	BAND_AN = 16,
-	BAND_GAC = 32,
-	BAND_AAC = 64,
-	BAND_GAX = 256,
-	BAND_AAX = 512,
-	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
-
-};
-
-/** Channel bandwidth */
-#define CHANNEL_BW_20MHZ 0
-#define CHANNEL_BW_40MHZ_ABOVE 1
-#define CHANNEL_BW_40MHZ_BELOW 3
-/** secondary channel is 80Mhz bandwidth for 11ac */
-#define CHANNEL_BW_80MHZ 4
-#define CHANNEL_BW_160MHZ 5
-
-/** RF antenna selection */
-#define RF_ANTENNA_MASK(n) ((1 << (n)) - 1)
-/** RF antenna auto select */
-#define RF_ANTENNA_AUTO 0xFFFF
-
-/** Type definition of mlan_ds_band_cfg for MLAN_OID_BAND_CFG */
-typedef struct _mlan_ds_band_cfg {
-	/** Infra band */
-	t_u32 config_bands;
-	/** Ad-hoc start band */
-	t_u32 adhoc_start_band;
-	/** Ad-hoc start channel */
-	t_u32 adhoc_channel;
-	/** fw supported band */
-	t_u32 fw_bands;
-} mlan_ds_band_cfg;
-
-/** Type definition of mlan_ds_ant_cfg for MLAN_OID_ANT_CFG */
-typedef struct _mlan_ds_ant_cfg {
-	/** Tx antenna mode */
-	t_u32 tx_antenna;
-	/** Rx antenna mode */
-	t_u32 rx_antenna;
-} mlan_ds_ant_cfg, *pmlan_ds_ant_cfg;
-/** Type definition of mlan_ds_mimo_switch for MLAN_OID_MIMO_SWITCH */
-typedef struct _mlan_ds_mimo_switch {
-	/** Tx antenna mode */
-	t_u8 txpath_antmode;
-	/** Rx antenna mode */
-	t_u8 rxpath_antmode;
-} mlan_ds_mimo_switch, *pmlan_ds_mimo_switch;
-/** Type definition of mlan_ds_ant_cfg_1x1 for MLAN_OID_ANT_CFG */
-typedef struct _mlan_ds_ant_cfg_1x1 {
-	/** Antenna mode */
-	t_u32 antenna;
-	/** Evaluate time */
-	t_u16 evaluate_time;
-	/** Current antenna */
-	t_u16 current_antenna;
-} mlan_ds_ant_cfg_1x1, *pmlan_ds_ant_cfg_1x1;
-
-/** Type definition of mlan_ds_remain_chan for MLAN_OID_REMAIN_CHAN_CFG */
-typedef struct _mlan_ds_remain_chan {
-	/** remove flag */
-	t_u16 remove;
-	/** status */
-	t_u8 status;
-	/** Band cfg */
-	Band_Config_t bandcfg;
-	/** channel */
-	t_u8 channel;
-	/** remain time: Unit ms*/
-	t_u32 remain_period;
-} mlan_ds_remain_chan, *pmlan_ds_remain_chan;
-
-/** Type definition of mlan_ds_radio_cfg for MLAN_IOCTL_RADIO_CFG */
-typedef struct _mlan_ds_radio_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Radio control parameter */
-	union {
-		/** Radio on/off for MLAN_OID_RADIO_CTRL */
-		t_u32 radio_on_off;
-		/** Band info for MLAN_OID_BAND_CFG */
-		mlan_ds_band_cfg band_cfg;
-		/** Antenna info for MLAN_OID_ANT_CFG */
-		mlan_ds_ant_cfg ant_cfg;
-		/** Antenna mode for MLAN_OID_MIMO_SWITCH */
-		mlan_ds_mimo_switch mimo_switch_cfg;
-		/** Antenna info for MLAN_OID_ANT_CFG */
-		mlan_ds_ant_cfg_1x1 ant_cfg_1x1;
-		/** remain on channel for MLAN_OID_REMAIN_CHAN_CFG */
-		mlan_ds_remain_chan remain_chan;
-	} param;
-} mlan_ds_radio_cfg, *pmlan_ds_radio_cfg;
-
-enum COALESCE_OPERATION {
-	RECV_FILTER_MATCH_TYPE_EQ = 0x80,
-	RECV_FILTER_MATCH_TYPE_NE,
-};
-
-enum COALESCE_PACKET_TYPE {
-	PACKET_TYPE_UNICAST = 1,
-	PACKET_TYPE_MULTICAST = 2,
-	PACKET_TYPE_BROADCAST = 3
-};
-
-#define COALESCE_MAX_RULES 8
-#define COALESCE_MAX_BYTESEQ 4 /* non-adjustable */
-#define COALESCE_MAX_FILTERS 4
-#define MAX_COALESCING_DELAY 100 /* in msecs */
-#define MAX_PATTERN_LEN 20
-#define MAX_OFFSET_LEN 100
-
-struct filt_field_param {
-	t_u8 operation;
-	t_u8 operand_len;
-	t_u16 offset;
-	t_u8 operand_byte_stream[COALESCE_MAX_BYTESEQ];
-};
-
-struct coalesce_rule {
-	t_u16 max_coalescing_delay;
-	t_u8 num_of_fields;
-	t_u8 pkt_type;
-	struct filt_field_param params[COALESCE_MAX_FILTERS];
-};
-
-typedef struct _mlan_ds_coalesce_cfg {
-	t_u16 num_of_rules;
-	struct coalesce_rule rule[COALESCE_MAX_RULES];
-} mlan_ds_coalesce_cfg;
-
-/*-----------------------------------------------------------------*/
-/** SNMP MIB Group */
-/*-----------------------------------------------------------------*/
-/** Type definition of mlan_ds_snmp_mib for MLAN_IOCTL_SNMP_MIB */
-typedef struct _mlan_ds_snmp_mib {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** SNMP MIB parameter */
-	union {
-		/** RTS threshold for MLAN_OID_SNMP_MIB_RTS_THRESHOLD */
-		t_u32 rts_threshold;
-		/** Fragment threshold for MLAN_OID_SNMP_MIB_FRAG_THRESHOLD */
-		t_u32 frag_threshold;
-		/** Retry count for MLAN_OID_SNMP_MIB_RETRY_COUNT */
-		t_u32 retry_count;
-		/** OID value for MLAN_OID_SNMP_MIB_DOT11D/H */
-		t_u32 oid_value;
-		/** DTIM period for MLAN_OID_SNMP_MIB_DTIM_PERIOD */
-		t_u32 dtim_period;
-		/** Singal_ext Enable for MLAN_OID_SNMP_MIB_SIGNALEXT_ENABLE */
-		t_u8 signalext_enable;
-		/** Control deauth when uap switch channel */
-		t_u8 deauthctrl;
-		t_u8 chan_track;
-	} param;
-} mlan_ds_snmp_mib, *pmlan_ds_snmp_mib;
-
-/*-----------------------------------------------------------------*/
-/** Status Information Group */
-/*-----------------------------------------------------------------*/
-/** Enumeration for ad-hoc status */
-enum _mlan_adhoc_status {
-	ADHOC_IDLE,
-	ADHOC_STARTED,
-	ADHOC_JOINED,
-	ADHOC_COALESCED,
-	ADHOC_STARTING
-};
-
-typedef struct _mlan_ds_get_stats_org {
-	/** Statistics counter */
-	/** Multicast transmitted frame count */
-	t_u32 mcast_tx_frame;
-	/** Failure count */
-	t_u32 failed;
-	/** Retry count */
-	t_u32 retry;
-	/** Multi entry count */
-	t_u32 multi_retry;
-	/** Duplicate frame count */
-	t_u32 frame_dup;
-	/** RTS success count */
-	t_u32 rts_success;
-	/** RTS failure count */
-	t_u32 rts_failure;
-	/** Ack failure count */
-	t_u32 ack_failure;
-	/** Rx fragmentation count */
-	t_u32 rx_frag;
-	/** Multicast Tx frame count */
-	t_u32 mcast_rx_frame;
-	/** FCS error count */
-	t_u32 fcs_error;
-	/** Tx frame count */
-	t_u32 tx_frame;
-	/** WEP ICV error count */
-	t_u32 wep_icv_error[4];
-	/** beacon recv count */
-	t_u32 bcn_rcv_cnt;
-	/** beacon miss count */
-	t_u32 bcn_miss_cnt;
-	/** received amsdu count*/
-	t_u32 amsdu_rx_cnt;
-	/** received msdu count in amsdu*/
-	t_u32 msdu_in_rx_amsdu_cnt;
-	/** tx amsdu count*/
-	t_u32 amsdu_tx_cnt;
-	/** tx msdu count in amsdu*/
-	t_u32 msdu_in_tx_amsdu_cnt;
-} mlan_ds_get_stats_org;
-
-/** Type definition of mlan_ds_get_stats for MLAN_OID_GET_STATS */
-typedef struct _mlan_ds_get_stats {
-	/** Statistics counter */
-	/** Multicast transmitted frame count */
-	t_u32 mcast_tx_frame;
-	/** Failure count */
-	t_u32 failed;
-	/** Retry count */
-	t_u32 retry;
-	/** Multi entry count */
-	t_u32 multi_retry;
-	/** Duplicate frame count */
-	t_u32 frame_dup;
-	/** RTS success count */
-	t_u32 rts_success;
-	/** RTS failure count */
-	t_u32 rts_failure;
-	/** Ack failure count */
-	t_u32 ack_failure;
-	/** Rx fragmentation count */
-	t_u32 rx_frag;
-	/** Multicast Tx frame count */
-	t_u32 mcast_rx_frame;
-	/** FCS error count */
-	t_u32 fcs_error;
-	/** Tx frame count */
-	t_u32 tx_frame;
-	/** WEP ICV error count */
-	t_u32 wep_icv_error[4];
-	/** beacon recv count */
-	t_u32 bcn_rcv_cnt;
-	/** beacon miss count */
-	t_u32 bcn_miss_cnt;
-	/** received amsdu count*/
-	t_u32 amsdu_rx_cnt;
-	/** received msdu count in amsdu*/
-	t_u32 msdu_in_rx_amsdu_cnt;
-	/** tx amsdu count*/
-	t_u32 amsdu_tx_cnt;
-	/** tx msdu count in amsdu*/
-	t_u32 msdu_in_tx_amsdu_cnt;
-
-	/** Tx frag count */
-	t_u32 tx_frag_cnt;
-	/** Qos Tx frag count */
-	t_u32 qos_tx_frag_cnt[8];
-	/** Qos failed count */
-	t_u32 qos_failed_cnt[8];
-	/** Qos retry count */
-	t_u32 qos_retry_cnt[8];
-	/** Qos multi retry count */
-	t_u32 qos_multi_retry_cnt[8];
-	/** Qos frame dup count */
-	t_u32 qos_frm_dup_cnt[8];
-	/** Qos rts success count */
-	t_u32 qos_rts_suc_cnt[8];
-	/** Qos rts failure count */
-	t_u32 qos_rts_failure_cnt[8];
-	/** Qos ack failure count */
-	t_u32 qos_ack_failure_cnt[8];
-	/** Qos Rx frag count */
-	t_u32 qos_rx_frag_cnt[8];
-	/** Qos Tx frame count */
-	t_u32 qos_tx_frm_cnt[8];
-	/** Qos discarded frame count */
-	t_u32 qos_discarded_frm_cnt[8];
-	/** Qos mpdus Rx count */
-	t_u32 qos_mpdus_rx_cnt[8];
-	/** Qos retry rx count */
-	t_u32 qos_retries_rx_cnt[8];
-	/** CMAC ICV errors count */
-	t_u32 cmacicv_errors;
-	/** CMAC replays count */
-	t_u32 cmac_replays;
-	/** mgmt CCMP replays count */
-	t_u32 mgmt_ccmp_replays;
-	/** TKIP ICV errors count */
-	t_u32 tkipicv_errors;
-	/** TKIP replays count */
-	t_u32 tkip_replays;
-	/** CCMP decrypt errors count */
-	t_u32 ccmp_decrypt_errors;
-	/** CCMP replays count */
-	t_u32 ccmp_replays;
-	/** Tx amsdu count */
-	t_u32 tx_amsdu_cnt;
-	/** failed amsdu count */
-	t_u32 failed_amsdu_cnt;
-	/** retry amsdu count */
-	t_u32 retry_amsdu_cnt;
-	/** multi-retry amsdu count */
-	t_u32 multi_retry_amsdu_cnt;
-	/** Tx octets in amsdu count */
-	t_u64 tx_octets_in_amsdu_cnt;
-	/** amsdu ack failure count */
-	t_u32 amsdu_ack_failure_cnt;
-	/** Rx amsdu count */
-	t_u32 rx_amsdu_cnt;
-	/** Rx octets in amsdu count */
-	t_u64 rx_octets_in_amsdu_cnt;
-	/** Tx ampdu count */
-	t_u32 tx_ampdu_cnt;
-	/** tx mpdus in ampdu count */
-	t_u32 tx_mpdus_in_ampdu_cnt;
-	/** tx octets in ampdu count */
-	t_u64 tx_octets_in_ampdu_cnt;
-	/** ampdu Rx count */
-	t_u32 ampdu_rx_cnt;
-	/** mpdu in Rx ampdu count */
-	t_u32 mpdu_in_rx_ampdu_cnt;
-	/** Rx octets ampdu count */
-	t_u64 rx_octets_in_ampdu_cnt;
-	/** ampdu delimiter CRC error count */
-	t_u32 ampdu_delimiter_crc_error_cnt;
-	/** Rx Stuck Related Info*/
-	/** Rx Stuck Issue count */
-	t_u32 rx_stuck_issue_cnt[2];
-	/** Rx Stuck Recovery count */
-	t_u32 rx_stuck_recovery_cnt;
-	/** Rx Stuck TSF */
-	t_u64 rx_stuck_tsf[2];
-	/** Tx Watchdog Recovery Related Info */
-	/** Tx Watchdog Recovery count */
-	t_u32 tx_watchdog_recovery_cnt;
-	/** Tx Watchdog TSF */
-	t_u64 tx_watchdog_tsf[2];
-	/** Channel Switch Related Info */
-	/** Channel Switch Announcement Sent */
-	t_u32 channel_switch_ann_sent;
-	/** Channel Switch State */
-	t_u32 channel_switch_state;
-	/** Register Class */
-	t_u32 reg_class;
-	/** Channel Number */
-	t_u32 channel_number;
-	/** Channel Switch Mode */
-	t_u32 channel_switch_mode;
-	/** Reset Rx Mac Count */
-	t_u32 rx_reset_mac_recovery_cnt;
-	/** ISR2 Not Done Count*/
-	t_u32 rx_Isr2_NotDone_Cnt;
-	/** GDMA Abort Count */
-	t_u32 gdma_abort_cnt;
-	/** Rx Reset MAC Count */
-	t_u32 g_reset_rx_mac_cnt;
-	// Ownership error counters
-	/*Error Ownership error count*/
-	t_u32 dwCtlErrCnt;
-	/*Control Ownership error count*/
-	t_u32 dwBcnErrCnt;
-	/*Control Ownership error count*/
-	t_u32 dwMgtErrCnt;
-	/*Control Ownership error count*/
-	t_u32 dwDatErrCnt;
-	/*BIGTK MME good count*/
-	t_u32 bigtk_mmeGoodCnt;
-	/*BIGTK Replay error count*/
-	t_u32 bigtk_replayErrCnt;
-	/*BIGTK MIC error count*/
-	t_u32 bigtk_micErrCnt;
-	/*BIGTK MME not included count*/
-	t_u32 bigtk_mmeNotFoundCnt;
-} mlan_ds_get_stats, *pmlan_ds_get_stats;
-
-/** Type definition of mlan_ds_uap_stats for MLAN_OID_GET_STATS */
-typedef struct _mlan_ds_uap_stats {
-	/** tkip mic failures */
-	t_u32 tkip_mic_failures;
-	/** ccmp decrypt errors */
-	t_u32 ccmp_decrypt_errors;
-	/** wep undecryptable count */
-	t_u32 wep_undecryptable_count;
-	/** wep icv error count */
-	t_u32 wep_icv_error_count;
-	/** decrypt failure count */
-	t_u32 decrypt_failure_count;
-	/** dot11 multicast tx count */
-	t_u32 mcast_tx_count;
-	/** dot11 failed count */
-	t_u32 failed_count;
-	/** dot11 retry count */
-	t_u32 retry_count;
-	/** dot11 multi retry count */
-	t_u32 multi_retry_count;
-	/** dot11 frame duplicate count */
-	t_u32 frame_dup_count;
-	/** dot11 rts success count */
-	t_u32 rts_success_count;
-	/** dot11 rts failure count */
-	t_u32 rts_failure_count;
-	/** dot11 ack failure count */
-	t_u32 ack_failure_count;
-	/** dot11 rx ragment count */
-	t_u32 rx_fragment_count;
-	/** dot11 mcast rx frame count */
-	t_u32 mcast_rx_frame_count;
-	/** dot11 fcs error count */
-	t_u32 fcs_error_count;
-	/** dot11 tx frame count */
-	t_u32 tx_frame_count;
-	/** dot11 rsna tkip cm invoked */
-	t_u32 rsna_tkip_cm_invoked;
-	/** dot11 rsna 4way handshake failures */
-	t_u32 rsna_4way_hshk_failures;
-} mlan_ds_uap_stats, *pmlan_ds_uap_stats;
-
-/** Mask of last beacon RSSI */
-#define BCN_RSSI_LAST_MASK 0x00000001
-/** Mask of average beacon RSSI */
-#define BCN_RSSI_AVG_MASK 0x00000002
-/** Mask of last data RSSI */
-#define DATA_RSSI_LAST_MASK 0x00000004
-/** Mask of average data RSSI */
-#define DATA_RSSI_AVG_MASK 0x00000008
-/** Mask of last beacon SNR */
-#define BCN_SNR_LAST_MASK 0x00000010
-/** Mask of average beacon SNR */
-#define BCN_SNR_AVG_MASK 0x00000020
-/** Mask of last data SNR */
-#define DATA_SNR_LAST_MASK 0x00000040
-/** Mask of average data SNR */
-#define DATA_SNR_AVG_MASK 0x00000080
-/** Mask of last beacon NF */
-#define BCN_NF_LAST_MASK 0x00000100
-/** Mask of average beacon NF */
-#define BCN_NF_AVG_MASK 0x00000200
-/** Mask of last data NF */
-#define DATA_NF_LAST_MASK 0x00000400
-/** Mask of average data NF */
-#define DATA_NF_AVG_MASK 0x00000800
-/** Mask of all RSSI_INFO */
-#define ALL_RSSI_INFO_MASK 0x00000fff
-#define MAX_PATH_NUM 3
-/** path A */
-#define PATH_A 0x01
-/** path B */
-#define PATH_B 0x02
-/** path AB */
-#define PATH_AB 0x03
-/** ALL the path */
-#define PATH_ALL 0
-/** Type definition of mlan_ds_get_signal for MLAN_OID_GET_SIGNAL */
-typedef struct _mlan_ds_get_signal {
-	/** Selector of get operation */
-	/*
-	 * Bit0:  Last Beacon RSSI,  Bit1:  Average Beacon RSSI,
-	 * Bit2:  Last Data RSSI,    Bit3:  Average Data RSSI,
-	 * Bit4:  Last Beacon SNR,   Bit5:  Average Beacon SNR,
-	 * Bit6:  Last Data SNR,     Bit7:  Average Data SNR,
-	 * Bit8:  Last Beacon NF,    Bit9:  Average Beacon NF,
-	 * Bit10: Last Data NF,      Bit11: Average Data NF
-	 *
-	 * Bit0: PATH A
-	 * Bit1: PATH B
-	 */
-	t_u16 selector;
-
-	/** RSSI */
-	/** RSSI of last beacon */
-	t_s16 bcn_rssi_last;
-	/** RSSI of beacon average */
-	t_s16 bcn_rssi_avg;
-	/** RSSI of last data packet */
-	t_s16 data_rssi_last;
-	/** RSSI of data packet average */
-	t_s16 data_rssi_avg;
-
-	/** SNR */
-	/** SNR of last beacon */
-	t_s16 bcn_snr_last;
-	/** SNR of beacon average */
-	t_s16 bcn_snr_avg;
-	/** SNR of last data packet */
-	t_s16 data_snr_last;
-	/** SNR of data packet average */
-	t_s16 data_snr_avg;
-
-	/** NF */
-	/** NF of last beacon */
-	t_s16 bcn_nf_last;
-	/** NF of beacon average */
-	t_s16 bcn_nf_avg;
-	/** NF of last data packet */
-	t_s16 data_nf_last;
-	/** NF of data packet average */
-	t_s16 data_nf_avg;
-} mlan_ds_get_signal, *pmlan_ds_get_signal;
-
-/** bit for 2.4 G antenna diversity */
-#define ANT_DIVERSITY_2G MBIT(3)
-/** bit for 5 G antenna diversity */
-#define ANT_DIVERSITY_5G MBIT(7)
-
-/** mlan_fw_info data structure for MLAN_OID_GET_FW_INFO */
-typedef struct _mlan_fw_info {
-	/** Firmware version */
-	t_u32 fw_ver;
-	/** Firmware Hotfix version */
-	t_u8 hotfix_version;
-	/** tx buf size */
-	t_u16 tx_buf_size;
-	/** MAC address */
-	mlan_802_11_mac_addr mac_addr;
-	/** 802.11n device capabilities */
-	t_u32 hw_dot_11n_dev_cap;
-	/** Device support for MIMO abstraction of MCSs */
-	t_u8 hw_dev_mcs_support;
-	/** user's MCS setting */
-	t_u8 usr_dev_mcs_support;
-	/** 802.11ac device capabilities */
-	t_u32 hw_dot_11ac_dev_cap;
-	/** 802.11ac device Capabilities for 2.4GHz */
-	t_u32 usr_dot_11ac_dev_cap_bg;
-	/** 802.11ac device Capabilities for 5GHz */
-	t_u32 usr_dot_11ac_dev_cap_a;
-	/** length of hw he capability */
-	t_u8 hw_hecap_len;
-	/** 802.11ax HE capability */
-	t_u8 hw_he_cap[54];
-	/** length of hw 2.4G he capability */
-	t_u8 hw_2g_hecap_len;
-	/** 802.11ax 2.4G HE capability */
-	t_u8 hw_2g_he_cap[54];
-	/** 802.11ac device support for MIMO abstraction of MCSs */
-	t_u32 hw_dot_11ac_mcs_support;
-	/** User conf 802.11ac device support for MIMO abstraction of MCSs */
-	t_u32 usr_dot_11ac_mcs_support;
-	/** fw supported band */
-	t_u16 fw_bands;
-	/** region code */
-	t_u16 region_code;
-	/** force_reg */
-	t_u8 force_reg;
-	/** ECSA support */
-	t_u8 ecsa_enable;
-	/** Get log support */
-	t_u8 getlog_enable;
-	/** FW support for embedded supplicant */
-	t_u8 fw_supplicant_support;
-	/** ant info */
-	t_u8 antinfo;
-	/** max AP associated sta count supported by fw */
-	t_u8 max_ap_assoc_sta;
-	/** FW support roaming offload */
-	t_u8 fw_roaming_support;
-	/** Bandwidth not support 80Mhz */
-	t_u8 prohibit_80mhz;
-	/** FW support beacon protection */
-	t_u8 fw_beacon_prot;
-
-	/* lower 8 bytes of uuid */
-	t_u64 uuid_lo;
-
-	/* higher 8 bytes of uuid */
-	t_u64 uuid_hi;
-} mlan_fw_info, *pmlan_fw_info;
-
-/** Version string buffer length */
-#define MLAN_MAX_VER_STR_LEN 128
-
-/** Maximum length of secure boot uuid */
-#define MLAN_MAX_UUID_LEN 32
-
-/** mlan_ver_ext data structure for MLAN_OID_GET_VER_EXT */
-typedef struct _mlan_ver_ext {
-	/** Selected version string */
-	t_u32 version_str_sel;
-	/** Version string */
-	char version_str[MLAN_MAX_VER_STR_LEN];
-} mlan_ver_ext, *pmlan_ver_ext;
-
-#ifdef BIG_ENDIAN_SUPPORT
-/** Extended Capabilities Data */
-typedef struct MLAN_PACK_START _ExtCap_t {
-	/** Extended Capabilities value */
-	t_u8 rsvdBit87 : 1; /* bit 87 */
-	t_u8 rsvdBit86 : 1; /* bit 86 */
-	t_u8 rsvdBit85 : 1; /* bit 85 */
-	t_u8 beacon_prot : 1; /* bit 84 */
-	t_u8 rsvdBit83 : 1; /* bit 83 */
-	t_u8 rsvdBit82 : 1; /* bit 82 */
-	t_u8 rsvdBit81 : 1; /* bit 81 */
-	t_u8 rsvdBit80 : 1; /* bit 80 */
-	t_u8 rsvdBit79 : 1; /* bit 79 */
-	t_u8 TWTResp : 1; /* bit 78 */
-	t_u8 TWTReq : 1; /* bit 77 */
-	t_u8 rsvdBit76 : 1; /* bit 76 */
-	t_u8 rsvdBit75 : 1; /* bit 75 */
-	t_u8 rsvdBit74 : 1; /* bit 74 */
-	t_u8 rsvdBit73 : 1; /* bit 73 */
-	t_u8 FILS : 1; /* bit 72 */
-	t_u8 FTMI : 1; /* bit 71 */
-	t_u8 FTMR : 1; /* bit 70 */
-	t_u8 CAQ : 1; /* bit 69 */
-	t_u8 rsvdBit68 : 1; /* bit 68 */
-	t_u8 NCC : 1; /* bit 67 */
-	t_u8 rsvdBit66 : 1; /* bit 66 */
-	t_u8 chanSchedMgnt : 1; /* bit 65 */
-	t_u8 MaxAMSDU1 : 1; /* bit 64 */
-	t_u8 MaxAMSDU0 : 1; /* bit 63 */
-	t_u8 OperModeNtf : 1; /* bit 62 */
-	t_u8 TDLSWildBandwidth : 1; /* bit 61 */
-	t_u8 rsvdBit60 : 1; /* bit 60 */
-	t_u8 rsvdBit59 : 1; /* bit 59 */
-	t_u8 rsvdBit58 : 1; /* bit 58 */
-	t_u8 rsvdBit57 : 1; /* bit 57 */
-	t_u8 rsvdBit56 : 1; /* bit 56 */
-	t_u8 rsvdBit55 : 1; /* bit 55 */
-	t_u8 rsvdBit54 : 1; /* bit 54 */
-	t_u8 rsvdBit53 : 1; /* bit 53 */
-	t_u8 rsvdBit52 : 1; /* bit 52 */
-	t_u8 rsvdBit51 : 1; /* bit 51 */
-	t_u8 rsvdBit50 : 1; /* bit 50 */
-	t_u8 rsvdBit49 : 1; /* bit 49 */
-	t_u8 rsvdBit48 : 1; /* bit 48 */
-	t_u8 rsvdBit47 : 1; /* bit 47 */
-	t_u8 rsvdBit46 : 1; /* bit 46 */
-	t_u8 rsvdBit45 : 1; /* bit 45 */
-	t_u8 rsvdBit44 : 1; /* bit 44 */
-	t_u8 rsvdBit43 : 1; /* bit 43 */
-	t_u8 rsvdBit42 : 1; /* bit 42 */
-	t_u8 rsvdBit41 : 1; /* bit 41 */
-	t_u8 rsvdBit40 : 1; /* bit 40 */
-	t_u8 TDLSChlSwitchProhib : 1; /* bit 39 */
-	t_u8 TDLSProhibited : 1; /* bit 38 */
-	t_u8 TDLSSupport : 1; /* bit 37 */
-	t_u8 MSGCF_Capa : 1; /* bit 36 */
-	t_u8 Reserved35 : 1; /* bit 35 */
-	t_u8 SSPN_Interface : 1; /* bit 34 */
-	t_u8 EBR : 1; /* bit 33 */
-	t_u8 Qos_Map : 1; /* bit 32 */
-	t_u8 Interworking : 1; /* bit 31 */
-	t_u8 TDLSChannelSwitching : 1; /* bit 30 */
-	t_u8 TDLSPeerPSMSupport : 1; /* bit 29 */
-	t_u8 TDLSPeerUAPSDSupport : 1; /* bit 28 */
-	t_u8 UTC : 1; /* bit 27 */
-	t_u8 DMS : 1; /* bit 26 */
-	t_u8 SSID_List : 1; /* bit 25 */
-	t_u8 ChannelUsage : 1; /* bit 24 */
-	t_u8 TimingMeasurement : 1; /* bit 23 */
-	t_u8 MultipleBSSID : 1; /* bit 22 */
-	t_u8 AC_StationCount : 1; /* bit 21 */
-	t_u8 QoSTrafficCap : 1; /* bit 20 */
-	t_u8 BSS_Transition : 1; /* bit 19 */
-	t_u8 TIM_Broadcast : 1; /* bit 18 */
-	t_u8 WNM_Sleep : 1; /* bit 17 */
-	t_u8 TFS : 1; /* bit 16 */
-	t_u8 GeospatialLocation : 1; /* bit 15 */
-	t_u8 CivicLocation : 1; /* bit 14 */
-	t_u8 CollocatedIntf : 1; /* bit 13 */
-	t_u8 ProxyARPService : 1; /* bit 12 */
-	t_u8 FMS : 1; /* bit 11 */
-	t_u8 LocationTracking : 1; /* bit 10 */
-	t_u8 MulticastDiagnostics : 1; /* bit 9  */
-	t_u8 Diagnostics : 1; /* bit 8  */
-	t_u8 Event : 1; /* bit 7  */
-	t_u8 SPSMP_Support : 1; /* bit 6 */
-	t_u8 Reserved5 : 1; /* bit 5 */
-	t_u8 PSMP_Capable : 1; /* bit 4 */
-	t_u8 RejectUnadmFrame : 1; /* bit 3 */
-	t_u8 ExtChanSwitching : 1; /* bit 2 */
-	t_u8 Reserved1 : 1; /* bit 1 */
-	t_u8 BSS_CoexistSupport : 1; /* bit 0 */
-} MLAN_PACK_END ExtCap_t, *pExtCap_t;
-#else
-/** Extended Capabilities Data */
-typedef struct MLAN_PACK_START _ExtCap_t {
-	/** Extended Capabilities value */
-	t_u8 BSS_CoexistSupport : 1; /* bit 0 */
-	t_u8 Reserved1 : 1; /* bit 1 */
-	t_u8 ExtChanSwitching : 1; /* bit 2 */
-	t_u8 RejectUnadmFrame : 1; /* bit 3 */
-	t_u8 PSMP_Capable : 1; /* bit 4 */
-	t_u8 Reserved5 : 1; /* bit 5 */
-	t_u8 SPSMP_Support : 1; /* bit 6 */
-	t_u8 Event : 1; /* bit 7  */
-	t_u8 Diagnostics : 1; /* bit 8  */
-	t_u8 MulticastDiagnostics : 1; /* bit 9  */
-	t_u8 LocationTracking : 1; /* bit 10 */
-	t_u8 FMS : 1; /* bit 11 */
-	t_u8 ProxyARPService : 1; /* bit 12 */
-	t_u8 CollocatedIntf : 1; /* bit 13 */
-	t_u8 CivicLocation : 1; /* bit 14 */
-	t_u8 GeospatialLocation : 1; /* bit 15 */
-	t_u8 TFS : 1; /* bit 16 */
-	t_u8 WNM_Sleep : 1; /* bit 17 */
-	t_u8 TIM_Broadcast : 1; /* bit 18 */
-	t_u8 BSS_Transition : 1; /* bit 19 */
-	t_u8 QoSTrafficCap : 1; /* bit 20 */
-	t_u8 AC_StationCount : 1; /* bit 21 */
-	t_u8 MultipleBSSID : 1; /* bit 22 */
-	t_u8 TimingMeasurement : 1; /* bit 23 */
-	t_u8 ChannelUsage : 1; /* bit 24 */
-	t_u8 SSID_List : 1; /* bit 25 */
-	t_u8 DMS : 1; /* bit 26 */
-	t_u8 UTC : 1; /* bit 27 */
-	t_u8 TDLSPeerUAPSDSupport : 1; /* bit 28 */
-	t_u8 TDLSPeerPSMSupport : 1; /* bit 29 */
-	t_u8 TDLSChannelSwitching : 1; /* bit 30 */
-	t_u8 Interworking : 1; /* bit 31 */
-	t_u8 Qos_Map : 1; /* bit 32 */
-	t_u8 EBR : 1; /* bit 33 */
-	t_u8 SSPN_Interface : 1; /* bit 34 */
-	t_u8 Reserved35 : 1; /* bit 35 */
-	t_u8 MSGCF_Capa : 1; /* bit 36 */
-	t_u8 TDLSSupport : 1; /* bit 37 */
-	t_u8 TDLSProhibited : 1; /* bit 38 */
-	t_u8 TDLSChlSwitchProhib : 1; /* bit 39 */
-	t_u8 rsvdBit40 : 1; /* bit 40 */
-	t_u8 rsvdBit41 : 1; /* bit 41 */
-	t_u8 rsvdBit42 : 1; /* bit 42 */
-	t_u8 rsvdBit43 : 1; /* bit 43 */
-	t_u8 rsvdBit44 : 1; /* bit 44 */
-	t_u8 rsvdBit45 : 1; /* bit 45 */
-	t_u8 rsvdBit46 : 1; /* bit 46 */
-	t_u8 rsvdBit47 : 1; /* bit 47 */
-	t_u8 rsvdBit48 : 1; /* bit 48 */
-	t_u8 rsvdBit49 : 1; /* bit 49 */
-	t_u8 rsvdBit50 : 1; /* bit 50 */
-	t_u8 rsvdBit51 : 1; /* bit 51 */
-	t_u8 rsvdBit52 : 1; /* bit 52 */
-	t_u8 rsvdBit53 : 1; /* bit 53 */
-	t_u8 rsvdBit54 : 1; /* bit 54 */
-	t_u8 rsvdBit55 : 1; /* bit 55 */
-	t_u8 rsvdBit56 : 1; /* bit 56 */
-	t_u8 rsvdBit57 : 1; /* bit 57 */
-	t_u8 rsvdBit58 : 1; /* bit 58 */
-	t_u8 rsvdBit59 : 1; /* bit 59 */
-	t_u8 rsvdBit60 : 1; /* bit 60 */
-	t_u8 TDLSWildBandwidth : 1; /* bit 61 */
-	t_u8 OperModeNtf : 1; /* bit 62 */
-	t_u8 MaxAMSDU0 : 1; /* bit 63 */
-	t_u8 MaxAMSDU1 : 1; /* bit 64 */
-	t_u8 chanSchedMgnt : 1; /* bit 65 */
-	t_u8 rsvdBit66 : 1; /* bit 66 */
-	t_u8 NCC : 1; /* bit 67 */
-	t_u8 rsvdBit68 : 1; /* bit 68 */
-	t_u8 CAQ : 1; /* bit 69 */
-	t_u8 FTMR : 1; /* bit 70 */
-	t_u8 FTMI : 1; /* bit 71 */
-	t_u8 FILS : 1; /* bit 72 */
-	t_u8 rsvdBit73 : 1; /* bit 73 */
-	t_u8 rsvdBit74 : 1; /* bit 74 */
-	t_u8 rsvdBit75 : 1; /* bit 75 */
-	t_u8 rsvdBit76 : 1; /* bit 76 */
-	t_u8 TWTReq : 1; /* bit 77 */
-	t_u8 TWTResp : 1; /* bit 78 */
-	t_u8 rsvdBit79 : 1; /* bit 79 */
-	t_u8 rsvdBit80 : 1; /* bit 80 */
-	t_u8 rsvdBit81 : 1; /* bit 81 */
-	t_u8 rsvdBit82 : 1; /* bit 82 */
-	t_u8 rsvdBit83 : 1; /* bit 83 */
-	t_u8 beacon_prot : 1; /* bit 84 */
-	t_u8 rsvdBit85 : 1; /* bit 85 */
-	t_u8 rsvdBit86 : 1; /* bit 86 */
-	t_u8 rsvdBit87 : 1; /* bit 87 */
-} MLAN_PACK_END ExtCap_t, *pExtCap_t;
-#endif
-
-/** ExtCap : TDLS prohibited */
-#define IS_EXTCAP_TDLS_PROHIBITED(ext_cap) (ext_cap.TDLSProhibited)
-/** ExtCap : TDLS channel switch prohibited */
-#define IS_EXTCAP_TDLS_CHLSWITCHPROHIB(ext_cap) (ext_cap.TDLSChlSwitchProhib)
-
-/** mlan_bss_info data structure for MLAN_OID_GET_BSS_INFO */
-typedef struct _mlan_bss_info {
-	/** BSS mode */
-	t_u32 bss_mode;
-	/** SSID */
-	mlan_802_11_ssid ssid;
-	/** Table index */
-	t_u32 scan_table_idx;
-	/** Channel */
-	t_u32 bss_chan;
-	/** Band */
-	t_u16 bss_band;
-	/** Region code */
-	t_u32 region_code;
-	/** Connection status */
-	t_u32 media_connected;
-	/** Radio on */
-	t_u32 radio_on;
-	/** Max power level in dBm */
-	t_s32 max_power_level;
-	/** Min power level in dBm */
-	t_s32 min_power_level;
-	/** Adhoc state */
-	t_u32 adhoc_state;
-	/** NF of last beacon */
-	t_s32 bcn_nf_last;
-	/** wep status */
-	t_u32 wep_status;
-	/** scan block status */
-	t_u8 scan_block;
-	/** Host Sleep configured flag */
-	t_u32 is_hs_configured;
-	/** Deep Sleep flag */
-	t_u32 is_deep_sleep;
-	/** BSSID */
-	mlan_802_11_mac_addr bssid;
-#ifdef STA_SUPPORT
-	/** Capability Info */
-	t_u16 capability_info;
-	/** Beacon Interval */
-	t_u16 beacon_interval;
-	/** Listen Interval */
-	t_u16 listen_interval;
-	/** Association Id  */
-	t_u16 assoc_id;
-	/** AP/Peer supported rates */
-	t_u8 peer_supp_rates[MLAN_SUPPORTED_RATES];
-	/** extend capability for AP */
-	ExtCap_t ext_cap;
-#endif /* STA_SUPPORT */
-	/** Mobility Domain ID */
-	t_u16 mdid;
-	/** FT Capability policy */
-	t_u8 ft_cap;
-	/** 11h active */
-	t_bool is_11h_active;
-	/** dfs check channel */
-	t_u8 dfs_check_channel;
-} mlan_bss_info, *pmlan_bss_info;
-
-/** MAXIMUM number of TID */
-#define MAX_NUM_TID 8
-
-/** Max RX Win size */
-#define MAX_RX_WINSIZE 64
-
-/** rx_reorder_tbl */
-typedef struct {
-	/** TID */
-	t_u16 tid;
-	/** TA */
-	t_u8 ta[MLAN_MAC_ADDR_LENGTH];
-	/** Start window */
-	t_u32 start_win;
-	/** Window size */
-	t_u32 win_size;
-	/** amsdu flag */
-	t_u8 amsdu;
-	/** buffer status */
-	t_u32 buffer[MAX_RX_WINSIZE];
-} rx_reorder_tbl;
-
-/** tx_ba_stream_tbl */
-typedef struct {
-	/** TID */
-	t_u16 tid;
-	/** RA */
-	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
-	/** amsdu flag */
-	t_u8 amsdu;
-} tx_ba_stream_tbl;
-
-/** Debug command number */
-#define DBG_CMD_NUM 10
-
-#ifdef SDIO
-/** sdio mp debug number */
-#define SDIO_MP_DBG_NUM 10
-#endif
-
-/** Maximum size of IEEE Information Elements */
-#define IEEE_MAX_IE_SIZE 256
-
-/** support up to 8 TDLS peer */
-#define MLAN_MAX_TDLS_PEER_SUPPORTED 8
-/** TDLS peer info */
-typedef struct _tdls_peer_info {
-	/** station mac address */
-	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
-	/** SNR */
-	t_s8 snr;
-	/** Noise Floor */
-	t_s8 nf;
-	/** Extended Capabilities IE */
-	t_u8 ext_cap[IEEE_MAX_IE_SIZE];
-	/** HT Capabilities IE */
-	t_u8 ht_cap[IEEE_MAX_IE_SIZE];
-	/** VHT Capabilities IE */
-	t_u8 vht_cap[IEEE_MAX_IE_SIZE];
-	/** HE Capabilities IE */
-	t_u8 he_cap[IEEE_MAX_IE_SIZE];
-} tdls_peer_info;
-
-/** max ralist num */
-#define MLAN_MAX_RALIST_NUM 8
-/** ralist info */
-typedef struct _ralist_info {
-	/** RA list buffer */
-	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
-	/** total packets in RA list */
-	t_u16 total_pkts;
-	/** tid num */
-	t_u8 tid;
-	/** tx_pause flag */
-	t_u8 tx_pause;
-} ralist_info, *pralist_info;
-
-/** mlan_debug_info data structure for MLAN_OID_GET_DEBUG_INFO */
-typedef struct _mlan_debug_info {
-	/* WMM AC_BK count */
-	t_u32 wmm_ac_bk;
-	/* WMM AC_BE count */
-	t_u32 wmm_ac_be;
-	/* WMM AC_VI count */
-	t_u32 wmm_ac_vi;
-	/* WMM AC_VO count */
-	t_u32 wmm_ac_vo;
-	/** Corresponds to max_tx_buf_size member of mlan_adapter*/
-	t_u32 max_tx_buf_size;
-	/** Corresponds to tx_buf_size member of mlan_adapter*/
-	t_u32 tx_buf_size;
-	/** Corresponds to curr_tx_buf_size member of mlan_adapter*/
-	t_u32 curr_tx_buf_size;
-	/** Tx table num */
-	t_u32 tx_tbl_num;
-	/** Tx ba stream table */
-	tx_ba_stream_tbl tx_tbl[MLAN_MAX_TX_BASTREAM_SUPPORTED];
-	/** Rx table num */
-	t_u32 rx_tbl_num;
-	/** Rx reorder table*/
-	rx_reorder_tbl rx_tbl[MLAN_MAX_RX_BASTREAM_SUPPORTED];
-	/** TDLS peer number */
-	t_u32 tdls_peer_num;
-	/** TDLS peer list*/
-	tdls_peer_info tdls_peer_list[MLAN_MAX_TDLS_PEER_SUPPORTED];
-	/** ralist num */
-	t_u32 ralist_num;
-	/** ralist info */
-	ralist_info ralist[MLAN_MAX_RALIST_NUM];
-	/** Corresponds to ps_mode member of mlan_adapter */
-	t_u16 ps_mode;
-	/** Corresponds to ps_state member of mlan_adapter */
-	t_u32 ps_state;
-#ifdef STA_SUPPORT
-	/** Corresponds to is_deep_sleep member of mlan_adapter */
-	t_u8 is_deep_sleep;
-#endif /** STA_SUPPORT */
-	/** Corresponds to pm_wakeup_card_req member of mlan_adapter */
-	t_u8 pm_wakeup_card_req;
-	/** Corresponds to pm_wakeup_fw_try member of mlan_adapter */
-	t_u32 pm_wakeup_fw_try;
-	/** time stamp when host try to wake up firmware */
-	t_u32 pm_wakeup_in_secs;
-	/** wake up timeout happened */
-	t_u32 pm_wakeup_timeout;
-	/** Corresponds to is_hs_configured member of mlan_adapter */
-	t_u8 is_hs_configured;
-	/** Corresponds to hs_activated member of mlan_adapter */
-	t_u8 hs_activated;
-	/** Corresponds to pps_uapsd_mode member of mlan_adapter */
-	t_u16 pps_uapsd_mode;
-	/** Corresponds to sleep_period.period member of mlan_adapter */
-	t_u16 sleep_pd;
-	/** Corresponds to wmm_qosinfo member of mlan_private */
-	t_u8 qos_cfg;
-	/** Corresponds to tx_lock_flag member of mlan_adapter */
-	t_u8 tx_lock_flag;
-	/** Corresponds to port_open member of mlan_private */
-	t_u8 port_open;
-	/** bypass pkt count */
-	t_u32 bypass_pkt_count;
-	/** Corresponds to scan_processing member of mlan_adapter */
-	t_u32 scan_processing;
-	/** Corresponds to scan_state member of mlan_adapter */
-	t_u32 scan_state;
-	/** Corresponds to mlan_processing member of mlan_adapter */
-	t_u32 mlan_processing;
-	/** Corresponds to main_lock_flag member of mlan_adapter */
-	t_u32 main_lock_flag;
-	/** Corresponds to main_process_cnt member of mlan_adapter */
-	t_u32 main_process_cnt;
-	/** Corresponds to delay_task_flag member of mlan_adapter */
-	t_u32 delay_task_flag;
-	/** mlan_rx_processing */
-	t_u32 mlan_rx_processing;
-	/** rx pkts queued */
-	t_u32 rx_pkts_queued;
-	/** Number of host to card command failures */
-	t_u32 num_cmd_host_to_card_failure;
-	/** Number of host to card sleep confirm failures */
-	t_u32 num_cmd_sleep_cfm_host_to_card_failure;
-	/** Number of host to card Tx failures */
-	t_u32 num_tx_host_to_card_failure;
-	/** Number of allocate buffer failure */
-	t_u32 num_alloc_buffer_failure;
-	/** Number of pkt dropped */
-	t_u32 num_pkt_dropped;
-#ifdef SDIO
-	/** Number of card to host command/event failures */
-	t_u32 num_cmdevt_card_to_host_failure;
-	/** Number of card to host Rx failures */
-	t_u32 num_rx_card_to_host_failure;
-	/** Number of interrupt read failures */
-	t_u32 num_int_read_failure;
-	/** Last interrupt status */
-	t_u32 last_int_status;
-	/** number of interrupt receive */
-	t_u32 num_of_irq;
-	/** flag for sdio rx aggr */
-	t_u8 sdio_rx_aggr;
-	/** FW update port number */
-	t_u32 mp_update[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX * 2];
-	/** Invalid port update count */
-	t_u32 mp_invalid_update;
-	/** Number of packets tx aggr */
-	t_u32 mpa_tx_count[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX];
-	/** no more packets count*/
-	t_u32 mpa_sent_last_pkt;
-	/** no write_ports count */
-	t_u32 mpa_sent_no_ports;
-	/** last recv wr_bitmap */
-	t_u32 last_recv_wr_bitmap;
-	/** last recv rd_bitmap */
-	t_u32 last_recv_rd_bitmap;
-	/** mp_data_port_mask */
-	t_u32 mp_data_port_mask;
-	/** last mp_wr_bitmap */
-	t_u32 last_mp_wr_bitmap[SDIO_MP_DBG_NUM];
-	/** last ports for cmd53 write data */
-	t_u32 last_mp_wr_ports[SDIO_MP_DBG_NUM];
-	/** last len for cmd53 write data */
-	t_u32 last_mp_wr_len[SDIO_MP_DBG_NUM];
-	/** last curr_wr_port */
-	t_u8 last_curr_wr_port[SDIO_MP_DBG_NUM];
-	/** length info for cmd53 write data */
-	t_u16 last_mp_wr_info[SDIO_MP_DBG_NUM * SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX];
-	/** last mp_index */
-	t_u8 last_mp_index;
-	/** buffer for mp debug */
-	t_u8 *mpa_buf;
-	/** length info for mp buf size */
-	t_u32 mpa_buf_size;
-	/** Number of packets rx aggr */
-	t_u32 mpa_rx_count[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX];
-	/** mp aggr_pkt limit */
-	t_u8 mp_aggr_pkt_limit;
-#endif
-	/** Number of deauthentication events */
-	t_u32 num_event_deauth;
-	/** Number of disassosiation events */
-	t_u32 num_event_disassoc;
-	/** Number of link lost events */
-	t_u32 num_event_link_lost;
-	/** Number of deauthentication commands */
-	t_u32 num_cmd_deauth;
-	/** Number of association comamnd successes */
-	t_u32 num_cmd_assoc_success;
-	/** Number of association command failures */
-	t_u32 num_cmd_assoc_failure;
-	/** Number of consecutive association failures */
-	t_u32 num_cons_assoc_failure;
-
-	/** Number of command timeouts */
-	t_u32 num_cmd_timeout;
-	/** Timeout command ID */
-	t_u16 timeout_cmd_id;
-	/** Timeout command action */
-	t_u16 timeout_cmd_act;
-	/** List of last command IDs */
-	t_u16 last_cmd_id[DBG_CMD_NUM];
-	/** List of last command actions */
-	t_u16 last_cmd_act[DBG_CMD_NUM];
-	/** Last command index */
-	t_u16 last_cmd_index;
-	/** List of last command response IDs */
-	t_u16 last_cmd_resp_id[DBG_CMD_NUM];
-	/** Last command response index */
-	t_u16 last_cmd_resp_index;
-	/** List of last events */
-	t_u16 last_event[DBG_CMD_NUM];
-	/** Last event index */
-	t_u16 last_event_index;
-	/** Number of no free command node */
-	t_u16 num_no_cmd_node;
-	/** pending command id */
-	t_u16 pending_cmd;
-	/** time stamp for dnld last cmd */
-	t_u32 dnld_cmd_in_secs;
-	/** Corresponds to data_sent member of mlan_adapter */
-	t_u8 data_sent;
-	/** Corresponds to data_sent_cnt member of mlan_adapter */
-	t_u32 data_sent_cnt;
-	/** Corresponds to cmd_sent member of mlan_adapter */
-	t_u8 cmd_sent;
-	/** SDIO multiple port read bitmap */
-	t_u32 mp_rd_bitmap;
-	/** SDIO multiple port write bitmap */
-	t_u32 mp_wr_bitmap;
-	/** Current available port for read */
-	t_u8 curr_rd_port;
-	/** Current available port for write */
-	t_u8 curr_wr_port;
-#ifdef PCIE
-	/** PCIE txbd read pointer */
-	t_u32 txbd_rdptr;
-	/** PCIE txbd write pointer */
-	t_u32 txbd_wrptr;
-	/** PCIE rxbd read pointer */
-	t_u32 rxbd_rdptr;
-	/** PCIE rxbd write pointer */
-	t_u32 rxbd_wrptr;
-	/** PCIE eventbd read pointer */
-	t_u32 eventbd_rdptr;
-	/** PCIE eventbd write pointer */
-	t_u32 eventbd_wrptr;
-	/** txrx_bd_size */
-	t_u16 txrx_bd_size;
-	/** txbd ring vbase */
-	t_u8 *txbd_ring_vbase;
-	/** txbd ring size */
-	t_u32 txbd_ring_size;
-	/** rxbd ring vbase */
-	t_u8 *rxbd_ring_vbase;
-	/** rxbd ring size */
-	t_u32 rxbd_ring_size;
-	/** evtbd ring vbase */
-	t_u8 *evtbd_ring_vbase;
-	/** evtbd ring size */
-	t_u32 evtbd_ring_size;
-#endif
-	/** Corresponds to cmdresp_received member of mlan_adapter */
-	t_u8 cmd_resp_received;
-	/** Corresponds to event_received member of mlan_adapter */
-	t_u8 event_received;
-	/**  pendig tx pkts */
-	t_u32 tx_pkts_queued;
-#ifdef UAP_SUPPORT
-	/**  pending bridge pkts */
-	t_u16 num_bridge_pkts;
-	/**  dropped pkts */
-	t_u32 num_drop_pkts;
-#endif
-	/** FW hang report */
-	t_u8 fw_hang_report;
-	/** mlan_adapter pointer */
-	t_void *mlan_adapter;
-	/** mlan_adapter_size */
-	t_u32 mlan_adapter_size;
-	/** mlan_priv vector */
-	t_void *mlan_priv[MLAN_MAX_BSS_NUM];
-	/** mlan_priv_size */
-	t_u32 mlan_priv_size[MLAN_MAX_BSS_NUM];
-	/** mlan_priv_num */
-	t_u8 mlan_priv_num;
-} mlan_debug_info, *pmlan_debug_info;
-
-#ifdef UAP_SUPPORT
-/** Maximum number of clients supported by AP */
-#define MAX_NUM_CLIENTS MAX_STA_COUNT
-
-/** station info */
-typedef struct _sta_info_data {
-	/** STA MAC address */
-	t_u8 mac_address[MLAN_MAC_ADDR_LENGTH];
-	/** Power mgmt status */
-	t_u8 power_mgmt_status;
-	/** RSSI */
-	t_s8 rssi;
-	/** station bandmode */
-	t_u16 bandmode;
-	/** station stats */
-	sta_stats stats;
-	/** ie length */
-	t_u16 ie_len;
-} sta_info_data;
-
-/** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
-typedef struct _mlan_ds_sta_list {
-	/** station count */
-	t_u16 sta_count;
-	/** station list */
-	sta_info_data info[MAX_NUM_CLIENTS];
-	/* ie_buf will be append at the end */
-} mlan_ds_sta_list, *pmlan_ds_sta_list;
-#endif
-
-/** Type definition of mlan_ds_get_info for MLAN_IOCTL_GET_INFO */
-typedef struct _mlan_ds_get_info {
-	/** Sub-command */
-	t_u32 sub_command;
-
-	/** Status information parameter */
-	union {
-		/** Signal information for MLAN_OID_GET_SIGNAL */
-		mlan_ds_get_signal signal;
-		/** Signal path id for MLAN_OID_GET_SIGNAL_EXT */
-		t_u16 path_id;
-		/** Signal information for MLAN_OID_GET_SIGNAL_EXT */
-		mlan_ds_get_signal signal_ext[MAX_PATH_NUM];
-		/** Statistics information for MLAN_OID_GET_STATS */
-		mlan_ds_get_stats stats;
-		/** Statistics information for MLAN_OID_LINK_STATS*/
-		t_u8 link_statistic[1];
-		/** Firmware information for MLAN_OID_GET_FW_INFO */
-		mlan_fw_info fw_info;
-		/** Extended version information for MLAN_OID_GET_VER_EXT */
-		mlan_ver_ext ver_ext;
-		/** BSS information for MLAN_OID_GET_BSS_INFO */
-		mlan_bss_info bss_info;
-		/** Debug information for MLAN_OID_GET_DEBUG_INFO */
-		t_u8 debug_info[1];
-#ifdef UAP_SUPPORT
-		/** UAP Statistics information for MLAN_OID_GET_STATS */
-		mlan_ds_uap_stats ustats;
-		/** UAP station list for MLAN_OID_UAP_STA_LIST */
-		mlan_ds_sta_list sta_list;
-#endif
-	} param;
-} mlan_ds_get_info, *pmlan_ds_get_info;
-
-/*-----------------------------------------------------------------*/
-/** Security Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Enumeration for authentication mode */
-enum _mlan_auth_mode {
-	MLAN_AUTH_MODE_OPEN = 0x00,
-	MLAN_AUTH_MODE_SHARED = 0x01,
-	MLAN_AUTH_MODE_FT = 0x02,
-	MLAN_AUTH_MODE_SAE = 0x03,
-	MLAN_AUTH_MODE_OWE = 0x04,
-	MLAN_AUTH_MODE_NETWORKEAP = 0x80,
-	MLAN_AUTH_MODE_AUTO = 0xFF,
-};
-
-/**Enumeration for AssocAgent authentication mode, sync from FW.*/
-typedef enum {
-	AssocAgentAuth_Open,
-	AssocAgentAuth_Shared,
-	AssocAgentAuth_FastBss,
-	AssocAgentAuth_FastBss_Skip,
-	AssocAgentAuth_Network_EAP,
-	AssocAgentAuth_Wpa3Sae = 6,
-	AssocAgentAuth_Owe = 7,
-	AssocAgentAuth_Auto,
-} AssocAgentAuthType_e;
-
-/** Enumeration for encryption mode */
-enum _mlan_encryption_mode {
-	MLAN_ENCRYPTION_MODE_NONE = 0,
-	MLAN_ENCRYPTION_MODE_WEP40 = 1,
-	MLAN_ENCRYPTION_MODE_TKIP = 2,
-	MLAN_ENCRYPTION_MODE_CCMP = 3,
-	MLAN_ENCRYPTION_MODE_WEP104 = 4,
-	MLAN_ENCRYPTION_MODE_GCMP = 5,
-	MLAN_ENCRYPTION_MODE_GCMP_256 = 6,
-	MLAN_ENCRYPTION_MODE_CCMP_256 = 7,
-};
-
-/** Enumeration for PSK */
-enum _mlan_psk_type {
-	MLAN_PSK_PASSPHRASE = 1,
-	MLAN_PSK_PMK,
-	MLAN_PSK_CLEAR,
-	MLAN_PSK_QUERY,
-	MLAN_PSK_SAE_PASSWORD,
-};
-
-/** The bit to indicate the key is for unicast */
-#define MLAN_KEY_INDEX_UNICAST 0x40000000
-/** The key index to indicate default key */
-#define MLAN_KEY_INDEX_DEFAULT 0x000000ff
-/** Maximum key length */
-/* #define MLAN_MAX_KEY_LENGTH        32 */
-/** Minimum passphrase length */
-#define MLAN_MIN_PASSPHRASE_LENGTH 8
-/** Maximum passphrase length */
-#define MLAN_MAX_PASSPHRASE_LENGTH 63
-/** Minimum sae_password length */
-#define MLAN_MIN_SAE_PASSWORD_LENGTH 8
-/** Maximum sae_password length */
-#define MLAN_MAX_SAE_PASSWORD_LENGTH 255
-/** PMK length */
-#define MLAN_PMK_HEXSTR_LENGTH 64
-/* A few details needed for WEP (Wireless Equivalent Privacy) */
-/** 104 bits */
-#define MAX_WEP_KEY_SIZE 13
-/** 40 bits RC4 - WEP */
-#define MIN_WEP_KEY_SIZE 5
-/** packet number size */
-#define PN_SIZE 16
-/** max seq size of wpa/wpa2 key */
-#define SEQ_MAX_SIZE 8
-
-/** key flag for tx_seq */
-#define KEY_FLAG_TX_SEQ_VALID 0x00000001
-/** key flag for rx_seq */
-#define KEY_FLAG_RX_SEQ_VALID 0x00000002
-/** key flag for group key */
-#define KEY_FLAG_GROUP_KEY 0x00000004
-/** key flag for tx */
-#define KEY_FLAG_SET_TX_KEY 0x00000008
-/** key flag for mcast IGTK */
-#define KEY_FLAG_AES_MCAST_IGTK 0x00000010
-/** key flag for remove key */
-#define KEY_FLAG_REMOVE_KEY 0x80000000
-/** key flag for GCMP */
-#define KEY_FLAG_GCMP 0x00000020
-/** key flag for GCMP_256 */
-#define KEY_FLAG_GCMP_256 0x00000040
-/** key flag for ccmp 256 */
-#define KEY_FLAG_CCMP_256 0x00000080
-/** key flag for GMAC_128 */
-#define KEY_FLAG_GMAC_128 0x00000100
-/** key flag for GMAC_256 */
-#define KEY_FLAG_GMAC_256 0x00000200
-
-/** Type definition of mlan_ds_encrypt_key for MLAN_OID_SEC_CFG_ENCRYPT_KEY */
-typedef struct _mlan_ds_encrypt_key {
-	/** Key disabled, all other fields will be
-	 *  ignore when this flag set to MTRUE
-	 */
-	t_u32 key_disable;
-	/** key removed flag, when this flag is set
-	 *  to MTRUE, only key_index will be check
-	 */
-	t_u32 key_remove;
-	/** Key index, used as current tx key index
-	 *  when is_current_wep_key is set to MTRUE
-	 */
-	t_u32 key_index;
-	/** Current Tx key flag */
-	t_u32 is_current_wep_key;
-	/** Key length */
-	t_u32 key_len;
-	/** Key */
-	t_u8 key_material[MLAN_MAX_KEY_LENGTH];
-	/** mac address */
-	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
-	/** wapi key flag */
-	t_u32 is_wapi_key;
-	/** Initial packet number */
-	t_u8 pn[PN_SIZE];
-	/** key flags */
-	t_u32 key_flags;
-} mlan_ds_encrypt_key, *pmlan_ds_encrypt_key;
-
-/** Type definition of mlan_passphrase_t */
-typedef struct _mlan_passphrase_t {
-	/** Length of passphrase */
-	t_u32 passphrase_len;
-	/** Passphrase */
-	t_u8 passphrase[MLAN_MAX_PASSPHRASE_LENGTH];
-} mlan_passphrase_t;
-
-/** Type definition of mlan_sae_password_t */
-typedef struct _mlan_sae_password_t {
-	/** Length of SAE Password */
-	t_u32 sae_password_len;
-	/** SAE Password */
-	t_u8 sae_password[MLAN_MAX_SAE_PASSWORD_LENGTH];
-} mlan_sae_password_t;
-
-/** Type defnition of mlan_pmk_t */
-typedef struct _mlan_pmk_t {
-	/** PMK */
-	t_u8 pmk[MLAN_MAX_KEY_LENGTH];
-	t_u8 pmk_r0[MLAN_MAX_KEY_LENGTH];
-	t_u8 pmk_r0_name[MLAN_MAX_PMKR0_NAME_LENGTH];
-} mlan_pmk_t;
-
-/** Embedded supplicant RSN type: No RSN */
-#define RSN_TYPE_NO_RSN MBIT(0)
-/** Embedded supplicant RSN type: WPA */
-#define RSN_TYPE_WPA MBIT(3)
-/** Embedded supplicant RSN type: WPA-NONE */
-#define RSN_TYPE_WPANONE MBIT(4)
-/** Embedded supplicant RSN type: WPA2 */
-#define RSN_TYPE_WPA2 MBIT(5)
-/** Embedded supplicant RSN type: RFU */
-#define RSN_TYPE_VALID_BITS                                                    \
-	(RSN_TYPE_NO_RSN | RSN_TYPE_WPA | RSN_TYPE_WPANONE | RSN_TYPE_WPA2)
-
-/** Embedded supplicant cipher type: TKIP */
-#define EMBED_CIPHER_TKIP MBIT(2)
-/** Embedded supplicant cipher type: AES */
-#define EMBED_CIPHER_AES MBIT(3)
-/** Embedded supplicant cipher type: RFU */
-#define EMBED_CIPHER_VALID_BITS (EMBED_CIPHER_TKIP | EMBED_CIPHER_AES)
-
-/** Type definition of mlan_ds_passphrase for MLAN_OID_SEC_CFG_PASSPHRASE */
-typedef struct _mlan_ds_passphrase {
-	/** SSID may be used */
-	mlan_802_11_ssid ssid;
-	/** BSSID may be used */
-	mlan_802_11_mac_addr bssid;
-	/** Flag for passphrase or pmk used */
-	t_u16 psk_type;
-	/** Passphrase or PMK */
-	union {
-		/** Passphrase */
-		mlan_passphrase_t passphrase;
-		/** SAE Password */
-		mlan_sae_password_t sae_password;
-		/** PMK */
-		mlan_pmk_t pmk;
-	} psk;
-} mlan_ds_passphrase, *pmlan_ds_passphrase;
-
-/** Type definition of mlan_ds_esupp_mode for MLAN_OID_SEC_CFG_ESUPP_MODE */
-typedef struct _mlan_ds_ewpa_mode {
-	/** RSN mode */
-	t_u32 rsn_mode;
-	/** Active pairwise cipher */
-	t_u32 act_paircipher;
-	/** Active pairwise cipher */
-	t_u32 act_groupcipher;
-} mlan_ds_esupp_mode, *pmlan_ds_esupp_mode;
-
-/* Security SSID MAX number support by firmware*/
-#define MAX_SEC_SSID_NUM 6
-
-/** Type definition of mlan_ds_sec_cfg for MLAN_IOCTL_SEC_CFG */
-typedef struct _mlan_ds_sec_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Flag to extend some structures to support multiple values.
-	 ** For example, mlan_ds_passphrase can only contain one value,
-	 ** if need use mlan_ds_passphrase[N], just set this flag and
-	 ** use mlan_ds_passphrase[] instead to avoid modify
-	 ** more already exist code.
-	 */
-	t_u8 multi_passphrase;
-	/** Security configuration parameter */
-	union {
-		/** Authentication mode for MLAN_OID_SEC_CFG_AUTH_MODE */
-		t_u32 auth_mode;
-		/** Encryption mode for MLAN_OID_SEC_CFG_ENCRYPT_MODE */
-		t_u32 encrypt_mode;
-		/** WPA enabled flag for MLAN_OID_SEC_CFG_WPA_ENABLED */
-		t_u32 wpa_enabled;
-		/** WAPI enabled flag for MLAN_OID_SEC_CFG_WAPI_ENABLED */
-		t_u32 wapi_enabled;
-		/** Port Control enabled flag for MLAN_OID_SEC_CFG_PORT_CTRL */
-		t_u32 port_ctrl_enabled;
-		/** Encryption key for MLAN_OID_SEC_CFG_ENCRYPT_KEY */
-		mlan_ds_encrypt_key encrypt_key;
-		/** Passphrase for MLAN_OID_SEC_CFG_PASSPHRASE */
-		mlan_ds_passphrase passphrase;
-		/** Embedded supplicant WPA enabled flag for
-		 *  MLAN_OID_SEC_CFG_EWPA_ENABLED
-		 */
-		t_u32 ewpa_enabled;
-		/** Embedded supplicant mode for MLAN_OID_SEC_CFG_ESUPP_MODE */
-		mlan_ds_esupp_mode esupp_mode;
-#ifdef UAP_SUPPORT
-		t_u8 sta_mac[MLAN_MAC_ADDR_LENGTH];
-#endif
-		mlan_ds_passphrase roam_passphrase[MAX_SEC_SSID_NUM];
-	} param;
-} mlan_ds_sec_cfg, *pmlan_ds_sec_cfg;
-
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-#define BIT_TLV_TYPE_CRYPTO_KEY (1 << 0)
-#define BIT_TLV_TYPE_CRYPTO_KEY_IV (1 << 1)
-#define BIT_TLV_TYPE_CRYPTO_KEY_PREFIX (1 << 2)
-#define BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK (1 << 3)
-
-/** Type definition of mlan_ds_sup_cfg */
-typedef struct _mlan_ds_sup_cfg {
-	/** Sub-command */
-	t_u8 sub_command;
-	/** output length */
-	t_u16 output_len;
-	/** number of data blks */
-	t_u16 data_blks_nr;
-	/** sub action code */
-	t_u8 sub_action_code;
-	/** skip bytes */
-	t_u16 skip_bytes;
-	/** iteration */
-	t_u32 iteration;
-	/** count */
-	t_u32 count;
-	/** pointer to output */
-	t_u8 *output;
-	/** key length  */
-	t_u16 key_len;
-	/** pointer to key */
-	t_u8 *key;
-	/** key iv length  */
-	t_u16 key_iv_len;
-	/** pointer to key iv */
-	t_u8 *key_iv;
-	/** key prefix length */
-	t_u16 key_prefix_len;
-	/** pointer to key prefix */
-	t_u8 *key_prefix;
-	/** pointer to data blk length array */
-	t_u32 *key_data_blk_len;
-	/** pointer to key data blk pointer array */
-	t_u8 **key_data_blk;
-	/** callback */
-	t_u8 call_back;
-} mlan_ds_sup_cfg, *pmlan_ds_sup_cfg;
-#endif
-
-/*-----------------------------------------------------------------*/
-/** Rate Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Enumeration for rate type */
-enum _mlan_rate_type { MLAN_RATE_INDEX, MLAN_RATE_VALUE, MLAN_RATE_BITMAP };
-
-/** Enumeration for rate format */
-enum _mlan_rate_format {
-	MLAN_RATE_FORMAT_LG = 0,
-	MLAN_RATE_FORMAT_HT,
-	MLAN_RATE_FORMAT_VHT,
-	MLAN_RATE_FORMAT_HE,
-	MLAN_RATE_FORMAT_AUTO = 0xFF,
-};
-
-/** Max bitmap rates size */
-#define MAX_BITMAP_RATES_SIZE 26
-
-/** Type definition of mlan_rate_cfg_t for MLAN_OID_RATE_CFG */
-typedef struct _mlan_rate_cfg_t {
-	/** Fixed rate: 0, auto rate: 1 */
-	t_u32 is_rate_auto;
-	/** Rate type. 0: index; 1: value; 2: bitmap */
-	t_u32 rate_type;
-	/** Rate/MCS index or rate value if fixed rate */
-	t_u32 rate;
-	/** Rate Bitmap */
-	t_u16 bitmap_rates[MAX_BITMAP_RATES_SIZE];
-	/** NSS */
-	t_u32 nss;
-	/* LG rate: 0, HT rate: 1, VHT rate: 2 */
-	t_u32 rate_format;
-	/** Rate Setting */
-	t_u16 rate_setting;
-} mlan_rate_cfg_t;
-
-/** HT channel bandwidth */
-typedef enum _mlan_ht_bw {
-	MLAN_HT_BW20,
-	MLAN_HT_BW40,
-	/** VHT channel bandwidth */
-	MLAN_VHT_BW80,
-	MLAN_VHT_BW160,
-} mlan_ht_bw;
-
-/** HT guard interval */
-typedef enum _mlan_ht_gi {
-	MLAN_HT_LGI,
-	MLAN_HT_SGI,
-} mlan_ht_gi;
-
-typedef enum _mlan_vht_stbc {
-	MLAN_VHT_STBC,
-	MLAN_VHT_NO_STBC,
-} mlan_vht_stbc;
-
-typedef enum _mlan_vht_ldpc {
-	MLAN_VHT_LDPC,
-	MLAN_VHT_NO_LDPC,
-} mlan_vht_ldpc;
-
-/** Band and BSS mode */
-typedef struct _mlan_band_data_rate {
-	/** Band configuration */
-	t_u8 config_bands;
-	/** BSS mode (Infra or IBSS) */
-	t_u8 bss_mode;
-} mlan_band_data_rate;
-
-/** Type definition of mlan_data_rate for MLAN_OID_GET_DATA_RATE */
-typedef struct _mlan_data_rate {
-	/** Tx data rate */
-	t_u32 tx_data_rate;
-	/** Rx data rate */
-	t_u32 rx_data_rate;
-
-	/** Tx channel bandwidth */
-	t_u32 tx_ht_bw;
-	/** Tx guard interval */
-	t_u32 tx_ht_gi;
-	/** Rx channel bandwidth */
-	t_u32 rx_ht_bw;
-	/** Rx guard interval */
-	t_u32 rx_ht_gi;
-	/** MCS index */
-	t_u32 tx_mcs_index;
-	t_u32 rx_mcs_index;
-	/** NSS */
-	t_u32 tx_nss;
-	t_u32 rx_nss;
-	/* LG rate: 0, HT rate: 1, VHT rate: 2 */
-	t_u32 tx_rate_format;
-	t_u32 rx_rate_format;
-} mlan_data_rate;
-
-/** Type definition of mlan_ds_rate for MLAN_IOCTL_RATE */
-typedef struct _mlan_ds_rate {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Rate configuration parameter */
-	union {
-		/** Rate configuration for MLAN_OID_RATE_CFG */
-		mlan_rate_cfg_t rate_cfg;
-		/** Data rate for MLAN_OID_GET_DATA_RATE */
-		mlan_data_rate data_rate;
-		/** Supported rates for MLAN_OID_SUPPORTED_RATES */
-		t_u8 rates[MLAN_SUPPORTED_RATES];
-		/** Band/BSS mode for getting supported rates */
-		mlan_band_data_rate rate_band_cfg;
-	} param;
-} mlan_ds_rate, *pmlan_ds_rate;
-
-/*-----------------------------------------------------------------*/
-/** Power Configuration Group */
-/*-----------------------------------------------------------------*/
-
-/** Type definition of mlan_power_cfg_t for MLAN_OID_POWER_CFG */
-typedef struct _mlan_power_cfg_t {
-	/** Is power auto */
-	t_u32 is_power_auto;
-	/** Power level in dBm */
-	t_s32 power_level;
-} mlan_power_cfg_t;
-
-/** max power table size */
-#define MAX_POWER_TABLE_SIZE 128
-#define TX_PWR_CFG_AUTO_CTRL_OFF 0xFF
-#define MAX_POWER_GROUP 64
-/** Type definition of mlan_power group info */
-typedef struct mlan_power_group {
-	/** rate format (LG: 0, HT: 1, VHT: 2, no auto ctrl: 0xFF) */
-	t_u32 rate_format;
-	/** bandwidth (LG: 20 MHz, HT: 20/40 MHz, VHT: 80/160/80+80 MHz) */
-	t_u8 bandwidth;
-	/** NSS */
-	t_u32 nss;
-	/** LG: first rate index, HT/VHT: first MCS */
-	t_u8 first_rate_ind;
-	/** LG: last rate index, HT/VHT: last MCS */
-	t_u8 last_rate_ind;
-	/** minmum tx power (dBm) */
-	t_s8 power_min;
-	/** maximum tx power (dBm) */
-	t_s8 power_max;
-	/** tx power step (dB) */
-	t_s8 power_step;
-} mlan_power_group;
-
-/** Type definition of mlan_power_cfg_ext for MLAN_OID_POWER_CFG_EXT */
-typedef struct _mlan_power_cfg_ext {
-	/** number of power_groups */
-	t_u32 num_pwr_grp;
-	/** array of power groups */
-	mlan_power_group power_group[MAX_POWER_GROUP];
-} mlan_power_cfg_ext;
-
-/** Type definition of mlan_ds_power_cfg for MLAN_IOCTL_POWER_CFG */
-typedef struct _mlan_ds_power_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Power configuration parameter */
-	union {
-		/** Power configuration for MLAN_OID_POWER_CFG */
-		mlan_power_cfg_t power_cfg;
-		/** Extended power configuration for MLAN_OID_POWER_CFG_EXT */
-		mlan_power_cfg_ext power_ext;
-		/** Low power mode for MLAN_OID_POWER_LOW_POWER_MODE */
-		t_u16 lpm;
-	} param;
-} mlan_ds_power_cfg, *pmlan_ds_power_cfg;
-
-/** Type definition of mlan_ds_band_steer_cfg for MLAN_IOCTL_POWER_CFG */
-typedef struct _mlan_ds_band_steer_cfg {
-	/** Set/Get */
-	t_u8 action;
-	/** enable/disable band steering*/
-	t_u8 state;
-	/** Probe Response will be blocked to 2G channel for first
-	 * block_2g_prb_req probe requests*/
-	t_u8 block_2g_prb_req;
-	/** When band steering is enabled, limit the btm request sent to STA at
-	 * <max_btm_req_allowed>*/
-	t_u8 max_btm_req_allowed;
-} mlan_ds_band_steer_cfg, *pmlan_ds_band_steer_cfg;
-
-/** Type definition of mlan_ds_beacon_stuck_param_cfg for MLAN_IOCTL_POWER_CFG
- */
-typedef struct _mlan_ds_beacon_stuck_param_cfg {
-	/** subcmd */
-	t_u32 subcmd;
-	/** Set/Get */
-	t_u8 action;
-	/** No of beacon interval after which firmware will check if beacon Tx
-	 * is going fine */
-	t_u8 beacon_stuck_detect_count;
-	/** Upon performing MAC reset, no of beacon interval after which
-	 * firmware will check if recovery was successful */
-	t_u8 recovery_confirm_count;
-} mlan_ds_beacon_stuck_param_cfg, *pmlan_ds_beacon_stuck_param_cfg;
-
-/*-----------------------------------------------------------------*/
-/** Power Management Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Host sleep config conditions : Cancel */
-#define HOST_SLEEP_CFG_CANCEL 0xffffffff
-
-/** Host sleep config condition: broadcast data */
-#define HOST_SLEEP_COND_BROADCAST_DATA MBIT(0)
-/** Host sleep config condition: unicast data */
-#define HOST_SLEEP_COND_UNICAST_DATA MBIT(1)
-/** Host sleep config condition: mac event */
-#define HOST_SLEEP_COND_MAC_EVENT MBIT(2)
-/** Host sleep config condition: multicast data */
-#define HOST_SLEEP_COND_MULTICAST_DATA MBIT(3)
-/** Host sleep config condition: IPV6 packet */
-#define HOST_SLEEP_COND_IPV6_PACKET MBIT(31)
-
-/** Host sleep config conditions: Default */
-#define HOST_SLEEP_DEF_COND                                                    \
-	(HOST_SLEEP_COND_BROADCAST_DATA | HOST_SLEEP_COND_UNICAST_DATA |       \
-	 HOST_SLEEP_COND_MAC_EVENT)
-
-/** Host sleep config GPIO : Default */
-#define HOST_SLEEP_DEF_GPIO 0xff
-/** Host sleep config gap : Default */
-#define HOST_SLEEP_DEF_GAP 200
-/** Host sleep config min wake holdoff */
-#define HOST_SLEEP_DEF_WAKE_HOLDOFF 0;
-/** Host sleep config inactivity timeout */
-#define HOST_SLEEP_DEF_INACTIVITY_TIMEOUT 10;
-
-/** Type definition of mlan_ds_hs_cfg for MLAN_OID_PM_CFG_HS_CFG */
-typedef struct _mlan_ds_hs_cfg {
-	/** MTRUE to invoke the HostCmd, MFALSE otherwise */
-	t_u32 is_invoke_hostcmd;
-	/** Host sleep config condition */
-	/** Bit0: broadcast data
-	 *  Bit1: unicast data
-	 *  Bit2: mac event
-	 *  Bit3: multicast data
-	 */
-	t_u32 conditions;
-	/** GPIO pin or 0xff for interface */
-	t_u32 gpio;
-	/** Gap in milliseconds or or 0xff for special
-	 *  setting when GPIO is used to wakeup host
-	 */
-	t_u32 gap;
-	/** Host sleep wake interval */
-	t_u32 hs_wake_interval;
-	/** Parameter type for indication gpio*/
-	t_u8 param_type_ind;
-	/** GPIO pin for indication wakeup source */
-	t_u32 ind_gpio;
-	/** Level on ind_gpio pin for indication normal wakeup source */
-	t_u32 level;
-	/** Parameter type for extend hscfg*/
-	t_u8 param_type_ext;
-	/** Events that will be forced ignore*/
-	t_u32 event_force_ignore;
-	/** Events that will use extend gap to inform host*/
-	t_u32 event_use_ext_gap;
-	/** Ext gap*/
-	t_u8 ext_gap;
-	/** GPIO wave level for extend hscfg*/
-	t_u8 gpio_wave;
-	/** Minimum delay between HsActive and HostWake (in msec) */
-	t_u16 min_wake_holdoff;
-} mlan_ds_hs_cfg, *pmlan_ds_hs_cfg;
-
-#define MAX_MGMT_FRAME_FILTER 2
-typedef struct _mlan_mgmt_frame_wakeup {
-	/** action - bitmap
-	 ** On matching rx'd pkt and filter during NON_HOSTSLEEP mode:
-	 **   Action[1]=0  Discard
-	 **   Action[1]=1  Allow
-	 ** Note that default action on non-match is "Allow".
-	 **
-	 ** On matching rx'd pkt and filter during HOSTSLEEP mode:
-	 **   Action[1:0]=00  Discard and Not Wake host
-	 **   Action[1:0]=01  Discard and Wake host
-	 **   Action[1:0]=10  Invalid
-	 ** Note that default action on non-match is "Discard and Not Wake
-	 *host".
-	 **/
-	t_u32 action;
-	/** Frame type(p2p, tdls...)
-	 ** type=0: invalid
-	 ** type=1: p2p
-	 ** type=others: reserved
-	 **/
-	t_u32 type;
-	/** Frame mask according to each type
-	 ** When type=1 for p2p, frame-mask have following define:
-	 **    Bit      Frame
-	 **     0       GO Negotiation Request
-	 **     1       GO Negotiation Response
-	 **     2       GO Negotiation Confirmation
-	 **     3       P2P Invitation Request
-	 **     4       P2P Invitation Response
-	 **     5       Device Discoverability Request
-	 **     6       Device Discoverability Response
-	 **     7       Provision Discovery Request
-	 **     8       Provision Discovery Response
-	 **     9       Notice of Absence
-	 **     10      P2P Presence Request
-	 **     11      P2P Presence Response
-	 **     12      GO Discoverability Request
-	 **     13-31   Reserved
-	 **
-	 ** When type=others, frame-mask is reserved.
-	 **/
-	t_u32 frame_mask;
-} mlan_mgmt_frame_wakeup, *pmlan_mgmt_frame_wakeup;
-
-/** Enable deep sleep mode */
-#define DEEP_SLEEP_ON 1
-/** Disable deep sleep mode */
-#define DEEP_SLEEP_OFF 0
-
-/** Default idle time in milliseconds for auto deep sleep */
-#define DEEP_SLEEP_IDLE_TIME 100
-
-typedef struct _mlan_ds_auto_ds {
-	/** auto ds mode, 0 - disable, 1 - enable */
-	t_u16 auto_ds;
-	/** auto ds idle time in milliseconds */
-	t_u16 idletime;
-} mlan_ds_auto_ds;
-
-/** Type definition of mlan_ds_inactivity_to
- *  for MLAN_OID_PM_CFG_INACTIVITY_TO
- */
-typedef struct _mlan_ds_inactivity_to {
-	/** Timeout unit in microsecond, 0 means 1000us (1ms) */
-	t_u32 timeout_unit;
-	/** Inactivity timeout for unicast data */
-	t_u32 unicast_timeout;
-	/** Inactivity timeout for multicast data */
-	t_u32 mcast_timeout;
-	/** Timeout for additional Rx traffic after Null PM1 packet exchange */
-	t_u32 ps_entry_timeout;
-} mlan_ds_inactivity_to, *pmlan_ds_inactivity_to;
-
-/** Minimum sleep period in milliseconds */
-#define MIN_SLEEP_PERIOD 10
-/** Maximum sleep period in milliseconds */
-#define MAX_SLEEP_PERIOD 60
-/** Special setting for UPSD certification tests */
-#define SLEEP_PERIOD_RESERVED_FF 0xFF
-
-/** PS null interval disable */
-#define PS_NULL_DISABLE (-1)
-
-/** Local listen interval disable */
-#define MRVDRV_LISTEN_INTERVAL_DISABLE (-1)
-/** Minimum listen interval */
-#define MRVDRV_MIN_LISTEN_INTERVAL 0
-
-/** Minimum multiple DTIM */
-#define MRVDRV_MIN_MULTIPLE_DTIM 0
-/** Maximum multiple DTIM */
-#define MRVDRV_MAX_MULTIPLE_DTIM 5
-/** Ignore multiple DTIM */
-#define MRVDRV_IGNORE_MULTIPLE_DTIM 0xfffe
-/** Match listen interval to closest DTIM */
-#define MRVDRV_MATCH_CLOSEST_DTIM 0xfffd
-
-/** Minimum beacon miss timeout in milliseconds */
-#define MIN_BCN_MISS_TO 0
-/** Maximum beacon miss timeout in milliseconds */
-#define MAX_BCN_MISS_TO 50
-/** Disable beacon miss timeout */
-#define DISABLE_BCN_MISS_TO 65535
-
-/** Minimum delay to PS in milliseconds */
-#define MIN_DELAY_TO_PS 0
-/** Maximum delay to PS in milliseconds */
-#define MAX_DELAY_TO_PS 65535
-/** Delay to PS unchanged */
-#define DELAY_TO_PS_UNCHANGED (-1)
-/** Default delay to PS in milliseconds */
-#define DELAY_TO_PS_DEFAULT 1000
-
-/** PS mode: Unchanged */
-#define PS_MODE_UNCHANGED 0
-/** PS mode: Auto */
-#define PS_MODE_AUTO 1
-/** PS mode: Poll */
-#define PS_MODE_POLL 2
-/** PS mode: Null */
-#define PS_MODE_NULL 3
-
-/** Type definition of mlan_ds_ps_cfg for MLAN_OID_PM_CFG_PS_CFG */
-typedef struct _mlan_ds_ps_cfg {
-	/** PS null interval in seconds */
-	t_u32 ps_null_interval;
-	/** Multiple DTIM interval */
-	t_u32 multiple_dtim_interval;
-	/** Listen interval */
-	t_u32 listen_interval;
-	/** Beacon miss timeout in milliseconds */
-	t_u32 bcn_miss_timeout;
-	/** Delay to PS in milliseconds */
-	t_s32 delay_to_ps;
-	/** PS mode */
-	t_u32 ps_mode;
-} mlan_ds_ps_cfg, *pmlan_ds_ps_cfg;
-
-/** Type definition of mlan_ds_sleep_params for MLAN_OID_PM_CFG_SLEEP_PARAMS */
-typedef struct _mlan_ds_sleep_params {
-	/** Error */
-	t_u32 error;
-	/** Offset in microseconds */
-	t_u32 offset;
-	/** Stable time in microseconds */
-	t_u32 stable_time;
-	/** Calibration control */
-	t_u32 cal_control;
-	/** External sleep clock */
-	t_u32 ext_sleep_clk;
-	/** Reserved */
-	t_u32 reserved;
-} mlan_ds_sleep_params, *pmlan_ds_sleep_params;
-
-/** sleep_param */
-typedef struct _ps_sleep_param {
-	/** control bitmap */
-	t_u32 ctrl_bitmap;
-	/** minimum sleep period (micro second) */
-	t_u32 min_sleep;
-	/** maximum sleep period (micro second) */
-	t_u32 max_sleep;
-} ps_sleep_param;
-
-/** inactivity sleep_param */
-typedef struct _inact_sleep_param {
-	/** inactivity timeout (micro second) */
-	t_u32 inactivity_to;
-	/** miniumu awake period (micro second) */
-	t_u32 min_awake;
-	/** maximum awake period (micro second) */
-	t_u32 max_awake;
-} inact_sleep_param;
-
-/** flag for ps mode */
-#define PS_FLAG_PS_MODE 1
-/** flag for sleep param */
-#define PS_FLAG_SLEEP_PARAM 2
-/** flag for inactivity sleep param */
-#define PS_FLAG_INACT_SLEEP_PARAM 4
-
-/** Enable Robust Coex mode */
-#define ROBUSTCOEX_GPIOCFG_ENABLE 1
-/** Disable Robust Coex mode */
-#define ROBUSTCOEX_GPIOCFG_DISABLE 0
-
-/** Disable power mode */
-#define PS_MODE_DISABLE 0
-/** Enable periodic dtim ps */
-#define PS_MODE_PERIODIC_DTIM 1
-/** Enable inactivity ps */
-#define PS_MODE_INACTIVITY 2
-/** FW wake up method interface */
-#define FW_WAKEUP_METHOD_INTERFACE 1
-/** FW wake up method gpio */
-#define FW_WAKEUP_METHOD_GPIO 2
-/** mlan_ds_ps_mgmt */
-typedef struct _mlan_ds_ps_mgmt {
-	/** flags for valid field */
-	t_u16 flags;
-	/** power mode */
-	t_u16 ps_mode;
-	/** sleep param */
-	ps_sleep_param sleep_param;
-	/** inactivity sleep param */
-	inact_sleep_param inact_param;
-} mlan_ds_ps_mgmt;
-
-/** mlan_ds_ps_info */
-typedef struct _mlan_ds_ps_info {
-	/** suspend allowed flag */
-	t_u32 is_suspend_allowed;
-} mlan_ds_ps_info;
-
-/** Type definition of mlan_ds_wakeup_reason for MLAN_OID_PM_HS_WAKEUP_REASON */
-typedef struct _mlan_ds_hs_wakeup_reason {
-	t_u16 hs_wakeup_reason;
-} mlan_ds_hs_wakeup_reason;
-
-/** Type definition of mlan_ds_ps_cfg for MLAN_OID_PM_CFG_PS_CFG */
-typedef struct _mlan_ds_bcn_timeout {
-	/** Beacon miss timeout period window */
-	t_u16 bcn_miss_tmo_window;
-	/** Beacon miss timeout period */
-	t_u16 bcn_miss_tmo_period;
-	/** Beacon reacquire timeout period window */
-	t_u16 bcn_rq_tmo_window;
-	/** Beacon reacquire timeout period */
-	t_u16 bcn_rq_tmo_period;
-} mlan_ds_bcn_timeout, *pmlan_ds_bcn_timeout;
-
-/** Type definition of mlan_ds_pm_cfg for MLAN_IOCTL_PM_CFG */
-typedef struct _mlan_ds_pm_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Power management parameter */
-	union {
-		/** Power saving mode for MLAN_OID_PM_CFG_IEEE_PS */
-		t_u32 ps_mode;
-		/** Host Sleep configuration for MLAN_OID_PM_CFG_HS_CFG */
-		mlan_ds_hs_cfg hs_cfg;
-		/** Deep sleep mode for MLAN_OID_PM_CFG_DEEP_SLEEP */
-		mlan_ds_auto_ds auto_deep_sleep;
-		/** Inactivity timeout for MLAN_OID_PM_CFG_INACTIVITY_TO */
-		mlan_ds_inactivity_to inactivity_to;
-		/** Sleep period for MLAN_OID_PM_CFG_SLEEP_PD */
-		t_u32 sleep_period;
-		/** PS configuration parameters for MLAN_OID_PM_CFG_PS_CFG */
-		mlan_ds_ps_cfg ps_cfg;
-		/** PS configuration parameters for MLAN_OID_PM_CFG_SLEEP_PARAMS
-		 */
-		mlan_ds_sleep_params sleep_params;
-		/** PS configuration parameters for MLAN_OID_PM_CFG_PS_MODE */
-		mlan_ds_ps_mgmt ps_mgmt;
-		/** power info for MLAN_OID_PM_INFO */
-		mlan_ds_ps_info ps_info;
-		/** hs wakeup reason for MLAN_OID_PM_HS_WAKEUP_REASON */
-		mlan_ds_hs_wakeup_reason wakeup_reason;
-		/** config manamgement frame for hs wakeup */
-		mlan_mgmt_frame_wakeup mgmt_filter[MAX_MGMT_FRAME_FILTER];
-		/** Beacon timout parameters for MLAN_OID_PM_CFG_BCN_TIMEOUT */
-		mlan_ds_bcn_timeout bcn_timeout;
-	} param;
-} mlan_ds_pm_cfg, *pmlan_ds_pm_cfg;
-
-/*-----------------------------------------------------------------*/
-/** WMM Configuration Group */
-/*-----------------------------------------------------------------*/
-
-/** WMM TSpec size */
-#define MLAN_WMM_TSPEC_SIZE 63
-/** WMM Add TS extra IE bytes */
-#define MLAN_WMM_ADDTS_EXTRA_IE_BYTES 256
-/** WMM statistics for packets hist bins */
-#define MLAN_WMM_STATS_PKTS_HIST_BINS 7
-/** Maximum number of AC QOS queues available */
-#define MLAN_WMM_MAX_AC_QUEUES 4
-
-/**
- *  @brief IOCTL structure to send an ADDTS request and retrieve the response.
- *
- *  IOCTL structure from the application layer relayed to firmware to
- *    instigate an ADDTS management frame with an appropriate TSPEC IE as well
- *    as any additional IEs appended in the ADDTS Action frame.
- *
- *  @sa woal_wmm_addts_req_ioctl
- */
-typedef struct {
-	mlan_cmd_result_e cmd_result; /**< Firmware execution result */
-
-	t_u32 timeout_ms; /**< Timeout value in milliseconds */
-	t_u8 ieee_status_code; /**< IEEE status code */
-
-	t_u32 ie_data_len; /**< Length of ie block in ie_data */
-	t_u8 ie_data[MLAN_WMM_TSPEC_SIZE /**< TSPEC to send in the ADDTS */
-		     + MLAN_WMM_ADDTS_EXTRA_IE_BYTES]; /**< Extra IE buf*/
-} wlan_ioctl_wmm_addts_req_t;
-
-/**
- *  @brief IOCTL structure to send a DELTS request.
- *
- *  IOCTL structure from the application layer relayed to firmware to
- *    instigate an DELTS management frame with an appropriate TSPEC IE.
- *
- *  @sa woal_wmm_delts_req_ioctl
- */
-typedef struct {
-	mlan_cmd_result_e cmd_result; /**< Firmware execution result */
-	t_u8 ieee_reason_code; /**< IEEE reason code sent, unused for WMM */
-	t_u32 ie_data_len; /**< Length of ie block in ie_data */
-	t_u8 ie_data[MLAN_WMM_TSPEC_SIZE]; /**< TSPEC to send in the DELTS */
-} wlan_ioctl_wmm_delts_req_t;
-
-/**
- *  @brief IOCTL structure to configure a specific AC Queue's parameters
- *
- *  IOCTL structure from the application layer relayed to firmware to
- *    get, set, or default the WMM AC queue parameters.
- *
- *  - msdu_lifetime_expiry is ignored if set to 0 on a set command
- *
- *  @sa woal_wmm_queue_config_ioctl
- */
-typedef struct {
-	mlan_wmm_queue_config_action_e action; /**< Set, Get, or Default */
-	mlan_wmm_ac_e access_category; /**< WMM_AC_BK(0) to WMM_AC_VO(3) */
-	t_u16 msdu_lifetime_expiry; /**< lifetime expiry in TUs */
-	t_u8 supported_rates[10]; /**< Not supported yet */
-} wlan_ioctl_wmm_queue_config_t;
-
-/**
- *  @brief IOCTL structure to start, stop, and get statistics for a WMM AC
- *
- *  IOCTL structure from the application layer relayed to firmware to
- *    start or stop statistical collection for a given AC.  Also used to
- *    retrieve and clear the collected stats on a given AC.
- *
- *  @sa woal_wmm_queue_stats_ioctl
- */
-typedef struct {
-	/** Action of Queue Config : Start, Stop, or Get */
-	mlan_wmm_queue_stats_action_e action;
-	/** User Priority */
-	t_u8 user_priority;
-	/** Number of successful packets transmitted */
-	t_u16 pkt_count;
-	/** Packets lost; not included in pkt_count */
-	t_u16 pkt_loss;
-	/** Average Queue delay in microseconds */
-	t_u32 avg_queue_delay;
-	/** Average Transmission delay in microseconds */
-	t_u32 avg_tx_delay;
-	/** Calculated used time in units of 32 microseconds */
-	t_u16 used_time;
-	/** Calculated policed time in units of 32 microseconds */
-	t_u16 policed_time;
-	/** Queue Delay Histogram; number of packets per queue delay range
-	 *
-	 *  [0] -  0ms <= delay < 5ms
-	 *  [1] -  5ms <= delay < 10ms
-	 *  [2] - 10ms <= delay < 20ms
-	 *  [3] - 20ms <= delay < 30ms
-	 *  [4] - 30ms <= delay < 40ms
-	 *  [5] - 40ms <= delay < 50ms
-	 *  [6] - 50ms <= delay < msduLifetime (TUs)
-	 */
-	t_u16 delay_histogram[MLAN_WMM_STATS_PKTS_HIST_BINS];
-} wlan_ioctl_wmm_queue_stats_t,
-	/** Type definition of mlan_ds_wmm_queue_stats
-	 *  for MLAN_OID_WMM_CFG_QUEUE_STATS
-	 */
-	mlan_ds_wmm_queue_stats, *pmlan_ds_wmm_queue_stats;
-
-/**
- *  @brief IOCTL sub structure for a specific WMM AC Status
- */
-typedef struct {
-	/** WMM Acm */
-	t_u8 wmm_acm;
-	/** Flow required flag */
-	t_u8 flow_required;
-	/** Flow created flag */
-	t_u8 flow_created;
-	/** Disabled flag */
-	t_u8 disabled;
-} wlan_ioctl_wmm_queue_status_ac_t;
-
-/**
- *  @brief IOCTL structure to retrieve the WMM AC Queue status
- *
- *  IOCTL structure from the application layer to retrieve:
- *     - ACM bit setting for the AC
- *     - Firmware status (flow required, flow created, flow disabled)
- *
- *  @sa woal_wmm_queue_status_ioctl
- */
-typedef struct {
-	/** WMM AC queue status */
-	wlan_ioctl_wmm_queue_status_ac_t ac_status[MLAN_WMM_MAX_AC_QUEUES];
-} wlan_ioctl_wmm_queue_status_t,
-	/** Type definition of mlan_ds_wmm_queue_status
-	 *  for MLAN_OID_WMM_CFG_QUEUE_STATUS
-	 */
-	mlan_ds_wmm_queue_status, *pmlan_ds_wmm_queue_status;
-
-/** Type definition of mlan_ds_wmm_addts for MLAN_OID_WMM_CFG_ADDTS */
-typedef struct _mlan_ds_wmm_addts {
-	/** Result of ADDTS request */
-	mlan_cmd_result_e result;
-	/** Timeout value in milliseconds */
-	t_u32 timeout;
-	/** IEEE status code */
-	t_u32 status_code;
-	/** Dialog token */
-	t_u8 dialog_tok;
-	/** TSPEC data length */
-	t_u32 ie_data_len;
-	/** TSPEC to send in the ADDTS + buffering for any extra IEs */
-	t_u8 ie_data[MLAN_WMM_TSPEC_SIZE + MLAN_WMM_ADDTS_EXTRA_IE_BYTES];
-} mlan_ds_wmm_addts, *pmlan_ds_wmm_addts;
-
-/** Type definition of mlan_ds_wmm_delts for MLAN_OID_WMM_CFG_DELTS */
-typedef struct _mlan_ds_wmm_delts {
-	/** Result of DELTS request */
-	mlan_cmd_result_e result;
-	/** IEEE status code */
-	t_u32 status_code;
-	/** TSPEC data length */
-	t_u8 ie_data_len;
-	/** TSPEC to send in the DELTS */
-	t_u8 ie_data[MLAN_WMM_TSPEC_SIZE];
-} mlan_ds_wmm_delts, *pmlan_ds_wmm_delts;
-
-/** Type definition of mlan_ds_wmm_queue_config
- *  for MLAN_OID_WMM_CFG_QUEUE_CONFIG
- */
-typedef struct _mlan_ds_wmm_queue_config {
-	/** Action of Queue Config : Set, Get, or Default */
-	mlan_wmm_queue_config_action_e action;
-	/** WMM Access Category: WMM_AC_BK(0) to WMM_AC_VO(3) */
-	mlan_wmm_ac_e access_category;
-	/** Lifetime expiry in TUs */
-	t_u16 msdu_lifetime_expiry;
-	/** Reserve for future use */
-	t_u8 reserved[10];
-} mlan_ds_wmm_queue_config, *pmlan_ds_wmm_queue_config;
-
-/** Type definition of mlan_ds_wmm_cfg for MLAN_IOCTL_WMM_CFG */
-typedef struct _mlan_ds_wmm_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** WMM configuration parameter */
-	union {
-		/** WMM enable for MLAN_OID_WMM_CFG_ENABLE */
-		t_u32 wmm_enable;
-		/** QoS configuration for MLAN_OID_WMM_CFG_QOS */
-		t_u8 qos_cfg;
-		/** WMM add TS for MLAN_OID_WMM_CFG_ADDTS */
-		mlan_ds_wmm_addts addts;
-		/** WMM delete TS for MLAN_OID_WMM_CFG_DELTS */
-		mlan_ds_wmm_delts delts;
-		/** WMM queue configuration for MLAN_OID_WMM_CFG_QUEUE_CONFIG */
-		mlan_ds_wmm_queue_config q_cfg;
-		/** AC Parameters Record WMM_AC_BE, WMM_AC_BK, WMM_AC_VI,
-		 * WMM_AC_VO */
-		wmm_ac_parameters_t ac_params[MAX_AC_QUEUES];
-		/** WMM queue status for MLAN_OID_WMM_CFG_QUEUE_STATS */
-		mlan_ds_wmm_queue_stats q_stats;
-		/** WMM queue status for MLAN_OID_WMM_CFG_QUEUE_STATUS */
-		mlan_ds_wmm_queue_status q_status;
-		/** WMM TS status for MLAN_OID_WMM_CFG_TS_STATUS */
-		mlan_ds_wmm_ts_status ts_status;
-	} param;
-} mlan_ds_wmm_cfg, *pmlan_ds_wmm_cfg;
-
-/*-----------------------------------------------------------------*/
-/** WPS Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Enumeration for WPS session */
-enum _mlan_wps_status {
-	MLAN_WPS_CFG_SESSION_START = 1,
-	MLAN_WPS_CFG_SESSION_END = 0
-};
-
-/** Type definition of mlan_ds_wps_cfg for MLAN_IOCTL_WPS_CFG */
-typedef struct _mlan_ds_wps_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** WPS configuration parameter */
-	union {
-		/** WPS session for MLAN_OID_WPS_CFG_SESSION */
-		t_u32 wps_session;
-	} param;
-} mlan_ds_wps_cfg, *pmlan_ds_wps_cfg;
-
-/*-----------------------------------------------------------------*/
-/** 802.11n Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Maximum MCS */
-#define NUM_MCS_FIELD 16
-
-/** Supported stream modes */
-#define HT_STREAM_MODE_1X1 0x11
-#define HT_STREAM_MODE_2X2 0x22
-
-/* Both 2.4G and 5G band selected */
-#define BAND_SELECT_BOTH 0
-/* Band 2.4G selected */
-#define BAND_SELECT_BG 1
-/* Band 5G selected */
-#define BAND_SELECT_A 2
-
-/** Type definition of mlan_ds_11n_htcap_cfg for MLAN_OID_11N_HTCAP_CFG */
-typedef struct _mlan_ds_11n_htcap_cfg {
-	/** HT Capability information */
-	t_u32 htcap;
-	/** Band selection */
-	t_u32 misc_cfg;
-	/** Hardware HT cap information required */
-	t_u32 hw_cap_req;
-} mlan_ds_11n_htcap_cfg, *pmlan_ds_11n_htcap_cfg;
-
-/** Type definition of mlan_ds_11n_addba_param
- * for MLAN_OID_11N_CFG_ADDBA_PARAM
- */
-typedef struct _mlan_ds_11n_addba_param {
-	/** Timeout */
-	t_u32 timeout;
-	/** Buffer size for ADDBA request */
-	t_u32 txwinsize;
-	/** Buffer size for ADDBA response */
-	t_u32 rxwinsize;
-	/** amsdu for ADDBA request */
-	t_u8 txamsdu;
-	/** amsdu for ADDBA response */
-	t_u8 rxamsdu;
-} mlan_ds_11n_addba_param, *pmlan_ds_11n_addba_param;
-
-/** Type definition of mlan_ds_11n_tx_cfg for MLAN_OID_11N_CFG_TX */
-typedef struct _mlan_ds_11n_tx_cfg {
-	/** HTTxCap */
-	t_u16 httxcap;
-	/** HTTxInfo */
-	t_u16 httxinfo;
-	/** Band selection */
-	t_u32 misc_cfg;
-} mlan_ds_11n_tx_cfg, *pmlan_ds_11n_tx_cfg;
-
-/** BF Global Configuration */
-#define BF_GLOBAL_CONFIGURATION 0x00
-/** Performs NDP sounding for PEER specified */
-#define TRIGGER_SOUNDING_FOR_PEER 0x01
-/** TX BF interval for channel sounding */
-#define SET_GET_BF_PERIODICITY 0x02
-/** Tell FW not to perform any sounding for peer */
-#define TX_BF_FOR_PEER_ENBL 0x03
-/** TX BF SNR threshold for peer */
-#define SET_SNR_THR_PEER 0x04
-/** TX Sounding*/
-#define TX_SOUNDING_CFG 0x05
-
-/* Maximum number of peer MAC and status/SNR tuples */
-#define MAX_PEER_MAC_TUPLES 10
-
-/** Any new subcommand structure should be declare here */
-
-/** bf global cfg args */
-typedef struct _mlan_bf_global_cfg_args {
-	/** Global enable/disable bf */
-	t_u8 bf_enbl;
-	/** Global enable/disable sounding */
-	t_u8 sounding_enbl;
-	/** FB Type */
-	t_u8 fb_type;
-	/** SNR Threshold */
-	t_u8 snr_threshold;
-	/** Sounding interval in milliseconds */
-	t_u16 sounding_interval;
-	/** BF mode */
-	t_u8 bf_mode;
-	/** Reserved */
-	t_u8 reserved;
-} mlan_bf_global_cfg_args;
-
-/** trigger sounding args */
-typedef struct _mlan_trigger_sound_args {
-	/** Peer MAC address */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Status */
-	t_u8 status;
-} mlan_trigger_sound_args;
-
-/** bf periodicity args */
-typedef struct _mlan_bf_periodicity_args {
-	/** Peer MAC address */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Current Tx BF Interval in milliseconds */
-	t_u16 interval;
-	/** Status */
-	t_u8 status;
-} mlan_bf_periodicity_args;
-
-/** tx bf peer args */
-typedef struct _mlan_tx_bf_peer_args {
-	/** Peer MAC address */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Reserved */
-	t_u16 reserved;
-	/** Enable/Disable Beamforming */
-	t_u8 bf_enbl;
-	/** Enable/Disable sounding */
-	t_u8 sounding_enbl;
-	/** FB Type */
-	t_u8 fb_type;
-} mlan_tx_bf_peer_args;
-
-/** SNR threshold args */
-typedef struct _mlan_snr_thr_args {
-	/** Peer MAC address */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** SNR for peer */
-	t_u8 snr;
-} mlan_snr_thr_args;
-
-/** Type definition of mlan_ds_11n_tx_bf_cfg for MLAN_OID_11N_CFG_TX_BF_CFG */
-typedef struct _mlan_ds_11n_tx_bf_cfg {
-	/** BF Action */
-	t_u16 bf_action;
-	/** Action */
-	t_u16 action;
-	/** Number of peers */
-	t_u32 no_of_peers;
-	union {
-		mlan_bf_global_cfg_args bf_global_cfg;
-		mlan_trigger_sound_args bf_sound[MAX_PEER_MAC_TUPLES];
-		mlan_bf_periodicity_args bf_periodicity[MAX_PEER_MAC_TUPLES];
-		mlan_tx_bf_peer_args tx_bf_peer[MAX_PEER_MAC_TUPLES];
-		mlan_snr_thr_args bf_snr[MAX_PEER_MAC_TUPLES];
-	} body;
-} mlan_ds_11n_tx_bf_cfg, *pmlan_ds_11n_tx_bf_cfg;
-
-/** Type definition of mlan_ds_11n_amsdu_aggr_ctrl for
- * MLAN_OID_11N_AMSDU_AGGR_CTRL*/
-typedef struct _mlan_ds_11n_amsdu_aggr_ctrl {
-	/** Enable/Disable */
-	t_u16 enable;
-	/** Current AMSDU size valid */
-	t_u16 curr_buf_size;
-} mlan_ds_11n_amsdu_aggr_ctrl, *pmlan_ds_11n_amsdu_aggr_ctrl;
-
-/** Type definition of mlan_ds_11n_aggr_prio_tbl
- *  for MLAN_OID_11N_CFG_AGGR_PRIO_TBL
- */
-typedef struct _mlan_ds_11n_aggr_prio_tbl {
-	/** ampdu priority table */
-	t_u8 ampdu[MAX_NUM_TID];
-	/** amsdu priority table */
-	t_u8 amsdu[MAX_NUM_TID];
-} mlan_ds_11n_aggr_prio_tbl, *pmlan_ds_11n_aggr_prio_tbl;
-
-/** DelBA All TIDs */
-#define DELBA_ALL_TIDS 0xff
-/** DelBA Tx */
-#define DELBA_TX MBIT(0)
-/** DelBA Rx */
-#define DELBA_RX MBIT(1)
-
-/** Type definition of mlan_ds_11n_delba for MLAN_OID_11N_CFG_DELBA */
-typedef struct _mlan_ds_11n_delba {
-	/** TID */
-	t_u8 tid;
-	/** Peer MAC address */
-	t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
-	/** Direction (Tx: bit 0, Rx: bit 1) */
-	t_u8 direction;
-} mlan_ds_11n_delba, *pmlan_ds_11n_delba;
-
-/** Type definition of mlan_ds_delba for MLAN_OID_11N_CFG_REJECT_ADDBA_REQ */
-typedef struct _mlan_ds_reject_addba_req {
-	/** Bit0    : host sleep activated
-	 *  Bit1    : auto reconnect enabled
-	 *  Others  : reserved
-	 */
-	t_u32 conditions;
-} mlan_ds_reject_addba_req, *pmlan_ds_reject_addba_req;
-
-/** Type definition of mlan_ds_ibss_ampdu_param */
-typedef struct _mlan_ds_ibss_ampdu_param {
-	/** ampdu priority table */
-	t_u8 ampdu[MAX_NUM_TID];
-	/** rx amdpdu setting */
-	t_u8 addba_reject[MAX_NUM_TID];
-} mlan_ds_ibss_ampdu_param, *pmlan_ds_ibss_ampdu_param;
-
-/** Type definition of mlan_ds_11n_cfg for MLAN_IOCTL_11N_CFG */
-typedef struct _mlan_ds_11n_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** 802.11n configuration parameter */
-	union {
-		/** Tx param for 11n for MLAN_OID_11N_CFG_TX */
-		mlan_ds_11n_tx_cfg tx_cfg;
-		/** Aggr priority table for MLAN_OID_11N_CFG_AGGR_PRIO_TBL */
-		mlan_ds_11n_aggr_prio_tbl aggr_prio_tbl;
-		/** Add BA param for MLAN_OID_11N_CFG_ADDBA_PARAM */
-		mlan_ds_11n_addba_param addba_param;
-		/** Add BA Reject paramters for MLAN_OID_11N_CFG_ADDBA_REJECT */
-		t_u8 addba_reject[MAX_NUM_TID];
-		/** Tx buf size for MLAN_OID_11N_CFG_MAX_TX_BUF_SIZE */
-		t_u32 tx_buf_size;
-		/** HT cap info configuration for MLAN_OID_11N_HTCAP_CFG */
-		mlan_ds_11n_htcap_cfg htcap_cfg;
-		/** Tx param for 11n for MLAN_OID_11N_AMSDU_AGGR_CTRL */
-		mlan_ds_11n_amsdu_aggr_ctrl amsdu_aggr_ctrl;
-		/** Supported MCS Set field */
-		t_u8 supported_mcs_set[NUM_MCS_FIELD];
-		/** Transmit Beamforming Capabilities field */
-		t_u32 tx_bf_cap;
-		/** Transmit Beamforming configuration */
-		mlan_ds_11n_tx_bf_cfg tx_bf;
-		/** HT stream configuration */
-		t_u32 stream_cfg;
-		/** DelBA for MLAN_OID_11N_CFG_DELBA */
-		mlan_ds_11n_delba del_ba;
-		/** Reject Addba Req for MLAN_OID_11N_CFG_REJECT_ADDBA_REQ */
-		mlan_ds_reject_addba_req reject_addba_req;
-		/** Control coex RX window size configuration */
-		t_u32 coex_rx_winsize;
-		/** Control TX AMPDU configuration */
-		t_u32 txaggrctrl;
-		/** aggrprirotity table for MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM */
-		mlan_ds_ibss_ampdu_param ibss_ampdu;
-		/** Minimum BA Threshold for MLAN_OID_11N_CFG_MIN_BA_THRESHOLD
-		 */
-		t_u8 min_ba_threshold;
-	} param;
-} mlan_ds_11n_cfg, *pmlan_ds_11n_cfg;
-
-#define NUM_MCS_SUPP 20
-#define VHT_MCS_SET_LEN 8
-
-/** Type definition of mlan_ds_11ac_vhtcap_cfg for MLAN_OID_11AC_VHTCAP_CFG */
-typedef struct _mlan_ds_11ac_vhtcap_cfg {
-	/** HT Capability information */
-	t_u32 vhtcap;
-	/** Band selection */
-	t_u32 misc_cfg;
-	/** Hardware HT cap information required */
-	t_u32 hw_cap_req;
-} mlan_ds_11ac_vhtcap_cfg, *pmlan_ds_11ac_vhtcap_cfg;
-
-/** Type definition of mlan_ds_11ac_tx_cfg for MLAN_OID_11AC_CFG_TX */
-typedef struct _mlan_ds_11ac_tx_cfg {
-	/** Band selection */
-	t_u8 band_cfg;
-	/** misc configuration */
-	t_u8 misc_cfg;
-	/** HTTxCap */
-	t_u16 vhttxcap;
-	/** HTTxInfo */
-	t_u16 vhttxinfo;
-} mlan_ds_11ac_tx_cfg, *pmlan_ds_11ac_tx_cfg;
-
-/** Tx */
-#define MLAN_RADIO_TX MBIT(0)
-/** Rx */
-#define MLAN_RADIO_RX MBIT(1)
-/** Tx & Rx */
-#define MLAN_RADIO_TXRX (MLAN_RADIO_TX | MLAN_RADIO_RX)
-
-/** Type definition of mlan_ds_11ac_tx_cfg for MLAN_OID_11AC_CFG */
-typedef struct _mlan_ds_11ac_vht_cfg {
-	/** Band selection (1: 2.4G, 2: 5 G, 3: both 2.4G and 5G) */
-	t_u32 band;
-	/** TxRx (1: Tx, 2: Rx, 3: both Tx and Rx) */
-	t_u32 txrx;
-	/** BW CFG (0: 11N CFG, 1: vhtcap) */
-	t_u32 bwcfg;
-	/** VHT capabilities. */
-	t_u32 vht_cap_info;
-	/** VHT Tx mcs */
-	t_u32 vht_tx_mcs;
-	/** VHT Rx mcs */
-	t_u32 vht_rx_mcs;
-	/** VHT rx max rate */
-	t_u16 vht_rx_max_rate;
-	/** VHT max tx rate */
-	t_u16 vht_tx_max_rate;
-	/** Skip usr 11ac mcs cfg */
-	t_bool skip_usr_11ac_mcs_cfg;
-} mlan_ds_11ac_vht_cfg, *pmlan_ds_11ac_vht_cfg;
-
-/** Type definition of mlan_ds_11ac_tx_cfg for MLAN_OID_11AC_CFG */
-typedef struct _mlan_ds_11ac_opermode_cfg {
-	/** channel width: 1-20MHz, 2-40MHz, 3-80MHz, 4-160MHz or 80+80MHz */
-	t_u8 bw;
-	/** Rx NSS */
-	t_u8 nss;
-} mlan_ds_11ac_opermode_cfg, *pmlan_ds_11ac_opermode_cfg;
-
-/** Type definition of mlan_ds_11ac_cfg for MLAN_IOCTL_11AC_CFG */
-typedef struct _mlan_ds_11ac_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** 802.11n configuration parameter */
-	union {
-		/** VHT configuration for MLAN_OID_11AC_VHT_CFG */
-		mlan_ds_11ac_vht_cfg vht_cfg;
-		/** Supported MCS Set field */
-		t_u8 supported_mcs_set[NUM_MCS_SUPP];
-		/** Oper mode configuration for MLAN_OID_11AC_OPERMODE_CFG */
-		mlan_ds_11ac_opermode_cfg opermode_cfg;
-	} param;
-} mlan_ds_11ac_cfg, *pmlan_ds_11ac_cfg;
-
-/** Type definition of mlan_ds_11ax_he_capa for MLAN_OID_11AX_HE_CFG */
-typedef MLAN_PACK_START struct _mlan_ds_11ax_he_capa {
-	/** tlv id of he capability */
-	t_u16 id;
-	/** length of the payload */
-	t_u16 len;
-	/** extension id */
-	t_u8 ext_id;
-	/** he mac capability info */
-	t_u8 he_mac_cap[6];
-	/** he phy capability info */
-	t_u8 he_phy_cap[11];
-	/** he txrx mcs support for 80MHz */
-	t_u8 he_txrx_mcs_support[4];
-	/** val for txrx mcs 160Mhz or 80+80, and PPE thresholds */
-	t_u8 val[28];
-} MLAN_PACK_END mlan_ds_11ax_he_capa, *pmlan_ds_11ax_he_capa;
-
-/** Type definition of mlan_ds_11ax_he_cfg for MLAN_OID_11AX_HE_CFG */
-typedef struct _mlan_ds_11ax_he_cfg {
-	/** band, BIT0:2.4G, BIT1:5G BIT2:6G*/
-	t_u8 band;
-	/** mlan_ds_11ax_he_capa */
-	mlan_ds_11ax_he_capa he_cap;
-} mlan_ds_11ax_he_cfg, *pmlan_ds_11ax_he_cfg;
-/** Type definition of mlan_ds_11as_cfg for MLAN_IOCTL_11AX_CFG */
-typedef struct _mlan_ds_11ax_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** 802.11n configuration parameter */
-	union {
-		/** HE configuration for MLAN_OID_11AX_HE_CFG */
-		mlan_ds_11ax_he_cfg he_cfg;
-	} param;
-} mlan_ds_11ax_cfg, *pmlan_ds_11ax_cfg;
-
-#define MLAN_11AXCMD_CFG_ID_SR_OBSS_PD_OFFSET 1
-#define MLAN_11AXCMD_CFG_ID_SR_ENABLE 2
-#define MLAN_11AXCMD_CFG_ID_BEAM_CHANGE 3
-#define MLAN_11AXCMD_CFG_ID_HTC_ENABLE 4
-#define MLAN_11AXCMD_CFG_ID_TXOP_RTS 5
-#define MLAN_11AXCMD_CFG_ID_TX_OMI 6
-#define MLAN_11AXCMD_CFG_ID_OBSSNBRU_TOLTIME 7
-
-#define MLAN_11AXCMD_SR_SUBID 0x102
-#define MLAN_11AXCMD_BEAM_SUBID 0x103
-#define MLAN_11AXCMD_HTC_SUBID 0x104
-#define MLAN_11AXCMD_TXOMI_SUBID 0x105
-#define MLAN_11AXCMD_OBSS_TOLTIME_SUBID 0x106
-#define MLAN_11AXCMD_TXOPRTS_SUBID 0x108
-
-#define MLAN_11AX_TWT_SETUP_SUBID 0x114
-#define MLAN_11AX_TWT_TEARDOWN_SUBID 0x115
-
-#define MRVL_DOT11AX_ENABLE_SR_TLV_ID (PROPRIETARY_TLV_BASE_ID + 322)
-#define MRVL_DOT11AX_OBSS_PD_OFFSET_TLV_ID (PROPRIETARY_TLV_BASE_ID + 323)
-
-/** Type definition of mlan_11axcmdcfg_obss_pd_offset for MLAN_OID_11AX_CMD_CFG
- */
-typedef struct MLAN_PACK_START _mlan_11axcmdcfg_obss_pd_offset {
-	/** <NON_SRG_OffSET, SRG_OFFSET> */
-	t_u8 offset[2];
-} MLAN_PACK_END mlan_11axcmdcfg_obss_pd_offset;
-
-/** Type definition of mlan_11axcmdcfg_sr_control for MLAN_OID_11AX_CMD_CFG */
-typedef struct MLAN_PACK_START _mlan_11axcmdcfg_sr_control {
-	/** 1 enable, 0 disable */
-	t_u8 control;
-} MLAN_PACK_END mlan_11axcmdcfg_sr_control;
-
-/** Type definition of mlan_ds_11ax_sr_cmd for MLAN_OID_11AX_CMD_CFG */
-typedef struct MLAN_PACK_START _mlan_ds_11ax_sr_cmd {
-	/** type*/
-	t_u16 type;
-	/** length of TLV */
-	t_u16 len;
-	/** value */
-	union {
-		mlan_11axcmdcfg_obss_pd_offset obss_pd_offset;
-		mlan_11axcmdcfg_sr_control sr_control;
-	} param;
-} MLAN_PACK_END mlan_ds_11ax_sr_cmd, *pmlan_ds_11ax_sr_cmd;
-
-/** Type definition of mlan_ds_11ax_beam_cmd for MLAN_OID_11AX_CMD_CFG */
-typedef struct _mlan_ds_11ax_beam_cmd {
-	/** command value: 1 is disable, 0 is enable*/
-	t_u8 value;
-} mlan_ds_11ax_beam_cmd, *pmlan_ds_11ax_beam_cmd;
-
-/** Type definition of mlan_ds_11ax_htc_cmd for MLAN_OID_11AX_CMD_CFG */
-typedef struct _mlan_ds_11ax_htc_cmd {
-	/** command value: 1 is enable, 0 is disable*/
-	t_u8 value;
-} mlan_ds_11ax_htc_cmd, *pmlan_ds_11ax_htc_cmd;
-
-/** Type definition of mlan_ds_11ax_htc_cmd for MLAN_OID_11AX_CMD_CFG */
-typedef struct _mlan_ds_11ax_txop_cmd {
-	/** Two byte rts threshold value of which only 10 bits, bit 0 to bit 9
-	 * are valid */
-	t_u16 rts_thres;
-} mlan_ds_11ax_txop_cmd, *pmlan_ds_11ax_txop_cmd;
-
-/** Type definition of mlan_ds_11ax_htc_cmd for MLAN_OID_11AX_CMD_CFG */
-typedef struct MLAN_PACK_START_mlan_ds_11ax_txomi_cmd {
-	/* 11ax spec 9.2.4.6a.2 OM Control 12 bits. Bit 0 to bit 11 */
-	t_u16 omi;
-	/* tx option
-	 * 0: send OMI in QoS NULL; 1: send OMI in QoS data; 0xFF: set OMI in
-	 * both
-	 */
-	t_u8 tx_option;
-	/* if OMI is sent in QoS data, specify the number of consecutive data
-	 * packets containing the OMI
-	 */
-	t_u8 num_data_pkts;
-} MLAN_PACK_END mlan_ds_11ax_txomi_cmd, *pmlan_ds_11ax_txomi_cmd;
-
-/** Type definition of mlan_ds_11ax_toltime_cmd for MLAN_OID_11AX_CMD_CFG */
-typedef struct _mlan_ds_11ax_toltime_cmd {
-	/* OBSS Narrow Bandwidth RU Tolerance Time */
-	t_u32 tol_time;
-} mlan_ds_11ax_toltime_cmd, *pmlan_ds_11ax_toltime_cmd;
-
-/** Type definition of mlan_ds_11ax_cmd_cfg for MLAN_OID_11AX_CMD_CFG */
-typedef struct _mlan_ds_11ax_cmd_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Sub-id */
-	t_u32 sub_id;
-	/** 802.11n configuration parameter */
-	union {
-		/** SR configuration for MLAN_11AXCMD_SR_SUBID */
-		mlan_ds_11ax_sr_cmd sr_cfg;
-		/** Beam configuration for MLAN_11AXCMD_BEAM_SUBID */
-		mlan_ds_11ax_beam_cmd beam_cfg;
-		/** HTC configuration for MLAN_11AXCMD_HTC_SUBID */
-		mlan_ds_11ax_htc_cmd htc_cfg;
-		/** txop RTS configuration for MLAN_11AXCMD_TXOPRTS_SUBID */
-		mlan_ds_11ax_txop_cmd txop_cfg;
-		/** tx omi configuration for MLAN_11AXCMD_TXOMI_SUBID */
-		mlan_ds_11ax_txomi_cmd txomi_cfg;
-		/** OBSS tolerance time configuration for
-		 * MLAN_11AXCMD_TOLTIME_SUBID */
-		mlan_ds_11ax_toltime_cmd toltime_cfg;
-	} param;
-} mlan_ds_11ax_cmd_cfg, *pmlan_ds_11ax_cmd_cfg;
-
-/** Type definition of mlan_ds_twt_setup for MLAN_OID_11AX_TWT_CFG */
-typedef struct MLAN_PACK_START _mlan_ds_twt_setup {
-	/** Implicit, 0: TWT session is explicit, 1: Session is implicit */
-	t_u8 implicit;
-	/** Announced, 0: Unannounced, 1: Announced TWT */
-	t_u8 announced;
-	/** Trigger Enabled, 0: Non-Trigger enabled, 1: Trigger enabled TWT */
-	t_u8 trigger_enabled;
-	/** TWT Information Disabled, 0: TWT info enabled, 1: TWT info disabled
-	 */
-	t_u8 twt_info_disabled;
-	/** Negotiation Type, 0: Future Individual TWT SP start time, 1: Next
-	 * Wake TBTT time */
-	t_u8 negotiation_type;
-	/** TWT Wakeup Duration, time after which the TWT requesting STA can
-	 * transition to doze state */
-	t_u8 twt_wakeup_duration;
-	/** Flow Identifier. Range: [0-7]*/
-	t_u8 flow_identifier;
-	/** Hard Constraint, 0: FW can tweak the TWT setup parameters if it is
-	 *rejected by AP.
-	 ** 1: Firmware should not tweak any parameters. */
-	t_u8 hard_constraint;
-	/** TWT Exponent, Range: [0-63] */
-	t_u8 twt_exponent;
-	/** TWT Mantissa Range: [0-sizeof(UINT16)] */
-	t_u16 twt_mantissa;
-	/** TWT Request Type, 0: REQUEST_TWT, 1: SUGGEST_TWT*/
-	t_u8 twt_request;
-} MLAN_PACK_END mlan_ds_twt_setup, *pmlan_ds_twt_setup;
-
-/** Type definition of mlan_ds_twt_teardown for MLAN_OID_11AX_TWT_CFG */
-typedef struct MLAN_PACK_START _mlan_ds_twt_teardown {
-	/** TWT Flow Identifier. Range: [0-7] */
-	t_u8 flow_identifier;
-	/** Negotiation Type. 0: Future Individual TWT SP start time, 1: Next
-	 * Wake TBTT time */
-	t_u8 negotiation_type;
-	/** Tear down all TWT. 1: To teardown all TWT, 0 otherwise */
-	t_u8 teardown_all_twt;
-} MLAN_PACK_END mlan_ds_twt_teardown, *pmlan_ds_twt_teardown;
-
-/** Type definition of mlan_ds_twtcfg for MLAN_OID_11AX_TWT_CFG */
-typedef struct MLAN_PACK_START _mlan_ds_twtcfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Sub-id */
-	t_u32 sub_id;
-	/** TWT Setup/Teardown configuration parameter */
-	union {
-		/** TWT Setup config for Sub ID: MLAN_11AX_TWT_SETUP_SUBID */
-		mlan_ds_twt_setup twt_setup;
-		/** TWT Teardown config for Sub ID: MLAN_11AX_TWT_TEARDOWN_SUBID
-		 */
-		mlan_ds_twt_teardown twt_teardown;
-	} param;
-} MLAN_PACK_END mlan_ds_twtcfg, *pmlan_ds_twtcfg;
-
-/** Country code length */
-#define COUNTRY_CODE_LEN 3
-
-/*-----------------------------------------------------------------*/
-/** 802.11d Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Maximum subbands for 11d */
-#define MRVDRV_MAX_SUBBAND_802_11D 83
-
-/** Data structure for subband set */
-typedef struct _mlan_ds_subband_set_t {
-	/** First channel */
-	t_u8 first_chan;
-	/** Number of channels */
-	t_u8 no_of_chan;
-	/** Maximum Tx power in dBm */
-	t_u8 max_tx_pwr;
-} mlan_ds_subband_set_t;
-
-#define NXP_DFS_UNSET 0
-#define NXP_DFS_FCC 1
-#define NXP_DFS_ETSI 2
-#define NXP_DFS_JP 3
-#define NXP_DFS_UNKNOWN 0xFF
-/** Domain regulatory information */
-typedef struct _mlan_ds_11d_domain_info {
-	/** DFS region code */
-	t_u8 dfs_region;
-	/** Country Code */
-	t_u8 country_code[COUNTRY_CODE_LEN];
-	/** Band that channels in sub_band belong to */
-	t_u16 band;
-	/** No. of subband in below */
-	t_u8 no_of_sub_band;
-	/** Subband data to send/last sent */
-	mlan_ds_subband_set_t sub_band[MRVDRV_MAX_SUBBAND_802_11D];
-} mlan_ds_11d_domain_info;
-
-/** Type definition of mlan_ds_11d_cfg for MLAN_IOCTL_11D_CFG */
-typedef struct _mlan_ds_11d_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** 802.11d configuration parameter */
-	union {
-#ifdef STA_SUPPORT
-		/** Enable for MLAN_OID_11D_CFG_ENABLE */
-		t_u32 enable_11d;
-#endif /* STA_SUPPORT */
-		/** Domain info for MLAN_OID_11D_DOMAIN_INFO_EXT */
-		mlan_ds_11d_domain_info domain_info;
-#ifdef UAP_SUPPORT
-		/** tlv data for MLAN_OID_11D_DOMAIN_INFO */
-		t_u8 domain_tlv[MAX_IE_SIZE];
-#endif /* UAP_SUPPORT */
-	} param;
-} mlan_ds_11d_cfg, *pmlan_ds_11d_cfg;
-
-/*-----------------------------------------------------------------*/
-/** Register Memory Access Group */
-/*-----------------------------------------------------------------*/
-/** Enumeration for CSU target device type */
-enum _mlan_csu_target_type {
-	MLAN_CSU_TARGET_CAU = 1,
-	MLAN_CSU_TARGET_PSU,
-};
-
-/** Enumeration for register type */
-enum _mlan_reg_type {
-	MLAN_REG_MAC = 1,
-	MLAN_REG_BBP,
-	MLAN_REG_RF,
-	MLAN_REG_CAU = 5,
-	MLAN_REG_PSU = 6,
-	MLAN_REG_BCA = 7,
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097) ||          \
-	defined(SD9177)
-	MLAN_REG_CIU = 8,
-#endif
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
-	MLAN_REG_MAC2 = 0x81,
-	MLAN_REG_BBP2 = 0x82,
-	MLAN_REG_RF2 = 0x83,
-	MLAN_REG_BCA2 = 0x87
-#endif
-};
-
-/** Type definition of mlan_ds_reg_rw for MLAN_OID_REG_RW */
-typedef struct _mlan_ds_reg_rw {
-	/** Register type */
-	t_u32 type;
-	/** Offset */
-	t_u32 offset;
-	/** Value */
-	t_u32 value;
-} mlan_ds_reg_rw;
-
-/** Maximum EEPROM data */
-#define MAX_EEPROM_DATA 256
-
-/** Type definition of mlan_ds_read_eeprom for MLAN_OID_EEPROM_RD */
-typedef struct _mlan_ds_read_eeprom {
-	/** Multiples of 4 */
-	t_u16 offset;
-	/** Number of bytes */
-	t_u16 byte_count;
-	/** Value */
-	t_u8 value[MAX_EEPROM_DATA];
-} mlan_ds_read_eeprom;
-
-/** Type definition of mlan_ds_mem_rw for MLAN_OID_MEM_RW */
-typedef struct _mlan_ds_mem_rw {
-	/** Address */
-	t_u32 addr;
-	/** Value */
-	t_u32 value;
-} mlan_ds_mem_rw;
-
-/** Type definition of mlan_ds_reg_mem for MLAN_IOCTL_REG_MEM */
-typedef struct _mlan_ds_reg_mem {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Register memory access parameter */
-	union {
-		/** Register access for MLAN_OID_REG_RW */
-		mlan_ds_reg_rw reg_rw;
-		/** EEPROM access for MLAN_OID_EEPROM_RD */
-		mlan_ds_read_eeprom rd_eeprom;
-		/** Memory access for MLAN_OID_MEM_RW */
-		mlan_ds_mem_rw mem_rw;
-	} param;
-} mlan_ds_reg_mem, *pmlan_ds_reg_mem;
-
-/*-----------------------------------------------------------------*/
-/** Multi-Radio Configuration Group */
-/*-----------------------------------------------------------------*/
-/*-----------------------------------------------------------------*/
-/** 802.11h Configuration Group */
-/*-----------------------------------------------------------------*/
-/** Type definition of mlan_ds_11h_dfs_testing for MLAN_OID_11H_DFS_TESTING */
-typedef struct _mlan_ds_11h_dfs_testing {
-	/** User-configured CAC period in milliseconds, 0 to use default */
-	t_u32 usr_cac_period_msec;
-	/** User-configured NOP period in seconds, 0 to use default */
-	t_u16 usr_nop_period_sec;
-	/** User-configured skip channel change, 0 to disable */
-	t_u8 usr_no_chan_change;
-	/** User-configured fixed channel to change to, 0 to use random channel
-	 */
-	t_u8 usr_fixed_new_chan;
-	/** User-configured cac restart */
-	t_u8 usr_cac_restart;
-} mlan_ds_11h_dfs_testing, *pmlan_ds_11h_dfs_testing;
-
-/** Type definition of mlan_ds_11h_dfs_testing for MLAN_OID_11H_CHAN_NOP_INFO */
-typedef struct _mlan_ds_11h_chan_nop_info {
-	/** current channel */
-	t_u8 curr_chan;
-	/** channel_width */
-	t_u8 chan_width;
-	/** check new channel flag */
-	t_u8 check_new_chan;
-	/** flag for chan under nop */
-	t_bool chan_under_nop;
-	/** chan_ban_info for new channel */
-	chan_band_info new_chan;
-} mlan_ds_11h_chan_nop_info, *pmlan_ds_11h_chan_nop_info;
-
-/** Type definition of mlan_ds_11h_nop_chan_list for MLAN_OID_11H_NOP_CHAN_LIST
- */
-typedef struct _mlan_ds_11h_nop_chan_list {
-	/** number of nop channel */
-	t_u8 num_chan;
-	/** chan list array */
-	t_u8 chan_list[20];
-} mlan_ds_11h_nop_chan_list, *pmlan_ds_11h_nop_chan_list;
-
-typedef struct _mlan_ds_11h_chan_rep_req {
-	t_u16 startFreq;
-	Band_Config_t bandcfg;
-	t_u8 chanNum;
-	t_u32 millisec_dwell_time; /**< Channel dwell time in milliseconds */
-	t_u8 host_based;
-} mlan_ds_11h_chan_rep_req;
-
-/** channel dfs state for MLAN_OID_11H_CHAN_DFS_STATE */
-typedef struct _mlan_ds_11h_chan_dfs_state {
-	/** channel */
-	t_u8 channel;
-	/** is dfs channel */
-	t_u8 dfs_required;
-	/** dfs state */
-	dfs_state_t dfs_state;
-} mlan_ds_11h_chan_dfs_state;
-
-typedef struct _mlan_ds_11h_dfs_w53_cfg {
-	/** dfs w53 cfg */
-	t_u8 dfs53cfg;
-} mlan_ds_11h_dfs_w53_cfg;
-
-/** Type definition of mlan_ds_11h_cfg for MLAN_IOCTL_11H_CFG */
-typedef struct _mlan_ds_11h_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	union {
-		/** Local power constraint for
-		 * MLAN_OID_11H_LOCAL_POWER_CONSTRAINT */
-		t_s8 usr_local_power_constraint;
-		/** User-configuation for MLAN_OID_11H_DFS_TESTING */
-		mlan_ds_11h_dfs_testing dfs_testing;
-		/** channel NOP information for MLAN_OID_11H_CHAN_NOP_INFO */
-		mlan_ds_11h_chan_nop_info ch_nop_info;
-		/** NOP channel list for MLAN_OID_11H_NOP_CHAN_LIST */
-		mlan_ds_11h_nop_chan_list nop_chan_list;
-		/** channel report req for MLAN_OID_11H_CHAN_REPORT_REQUEST */
-		mlan_ds_11h_chan_rep_req chan_rpt_req;
-		/** channel switch count for MLAN_OID_11H_CHAN_SWITCH_COUNT*/
-		t_s8 cs_count;
-		/** channel dfs state for MLAN_OID_11H_CHAN_DFS_STATE */
-		mlan_ds_11h_chan_dfs_state ch_dfs_state;
-		mlan_ds_11h_dfs_w53_cfg dfs_w53_cfg;
-		/** dfs_mode for MLAN_OID_11H_DFS_MODE */
-		t_u8 dfs_mode;
-	} param;
-} mlan_ds_11h_cfg, *pmlan_ds_11h_cfg;
-
-/*-----------------------------------------------------------------*/
-/** Miscellaneous Configuration Group */
-/*-----------------------------------------------------------------*/
-
-/** CMD buffer size */
-#define MLAN_SIZE_OF_CMD_BUFFER (3 * 1024)
-
-/** LDO Internal */
-#define LDO_INTERNAL 0
-/** LDO External */
-#define LDO_EXTERNAL 1
-
-/** Enumeration for IE type */
-enum _mlan_ie_type {
-	MLAN_IE_TYPE_GEN_IE = 0,
-#ifdef STA_SUPPORT
-	MLAN_IE_TYPE_ARP_FILTER,
-#endif /* STA_SUPPORT */
-};
-
-/** Type definition of mlan_ds_misc_gen_ie for MLAN_OID_MISC_GEN_IE */
-typedef struct _mlan_ds_misc_gen_ie {
-	/** IE type */
-	t_u32 type;
-	/** IE length */
-	t_u32 len;
-	/** IE buffer */
-	t_u8 ie_data[MAX_IE_SIZE];
-} mlan_ds_misc_gen_ie;
-
-#ifdef SDIO
-/** Type definition of mlan_ds_misc_sdio_mpa_ctrl
- *  for MLAN_OID_MISC_SDIO_MPA_CTRL
- */
-typedef struct _mlan_ds_misc_sdio_mpa_ctrl {
-	/** SDIO MP-A TX enable/disable */
-	t_u16 tx_enable;
-	/** SDIO MP-A RX enable/disable */
-	t_u16 rx_enable;
-	/** SDIO MP-A TX buf size */
-	t_u16 tx_buf_size;
-	/** SDIO MP-A RX buf size */
-	t_u16 rx_buf_size;
-	/** SDIO MP-A TX Max Ports */
-	t_u16 tx_max_ports;
-	/** SDIO MP-A RX Max Ports */
-	t_u16 rx_max_ports;
-} mlan_ds_misc_sdio_mpa_ctrl;
-#endif
-
-/** Type definition of mlan_ds_misc_cmd for MLAN_OID_MISC_HOST_CMD */
-typedef struct _mlan_ds_misc_cmd {
-	/** Command length */
-	t_u32 len;
-	/** Command buffer */
-	t_u8 cmd[MRVDRV_SIZE_OF_CMD_BUFFER];
-} mlan_ds_misc_cmd;
-
-/** Maximum number of system clocks */
-#define MLAN_MAX_CLK_NUM 16
-
-/** Clock type : Configurable */
-#define MLAN_CLK_CONFIGURABLE 0
-/** Clock type : Supported */
-#define MLAN_CLK_SUPPORTED 1
-
-/** Type definition of mlan_ds_misc_sys_clock for MLAN_OID_MISC_SYS_CLOCK */
-typedef struct _mlan_ds_misc_sys_clock {
-	/** Current system clock */
-	t_u16 cur_sys_clk;
-	/** Clock type */
-	t_u16 sys_clk_type;
-	/** Number of clocks */
-	t_u16 sys_clk_num;
-	/** System clocks */
-	t_u16 sys_clk[MLAN_MAX_CLK_NUM];
-} mlan_ds_misc_sys_clock;
-
-/** Enumeration for function init/shutdown */
-enum _mlan_func_cmd {
-	MLAN_FUNC_INIT = 1,
-	MLAN_FUNC_SHUTDOWN,
-};
-
-/* Net monitor filters: */
-/* management frame */
-#define MLAN_NETMON_MANAGEMENT MBIT(0)
-/* control frame */
-#define MLAN_NETMON_CONTROL MBIT(1)
-/* data frame */
-#define MLAN_NETMON_DATA MBIT(2)
-
-typedef struct _mlan_ds_misc_net_monitor {
-	/** Enable/disable network monitor */
-	t_u32 enable_net_mon;
-	/** Set net monitor filer flag */
-	t_u32 filter_flag;
-	/** Radio type */
-	t_u32 band;
-	/** Channel */
-	t_u32 channel;
-	/** Secondary channel bandwidth */
-	t_u32 chan_bandwidth;
-} mlan_ds_misc_net_monitor;
-
-/** Type definition of mlan_ds_misc_tx_datapause
- * for MLAN_OID_MISC_TX_DATAPAUSE
- */
-typedef struct _mlan_ds_misc_tx_datapause {
-	/** Tx data pause flag */
-	t_u16 tx_pause;
-	/** Max number of Tx buffers for all PS clients */
-	t_u16 tx_buf_cnt;
-} mlan_ds_misc_tx_datapause;
-
-/** Type definition of mlan_ds_misc_rx_abort_cfg
- * for MLAN_OID_MISC_RX_ABORT_CFG
- */
-typedef struct _mlan_ds_misc_rx_abort_cfg {
-	/** enable/disable rx abort */
-	t_u8 enable;
-	/** Rx weak RSSI pkt threshold */
-	t_s8 rssi_threshold;
-} mlan_ds_misc_rx_abort_cfg;
-
-/** Type definition of mlan_ds_misc_rx_abort_cfg_ext
- * for MLAN_OID_MISC_RX_ABORT_CFG_EXT
- */
-typedef struct _mlan_ds_misc_rx_abort_cfg_ext {
-	/** enable/disable dynamic rx abort */
-	t_u8 enable;
-	/** rssi margin */
-	t_s8 rssi_margin;
-	/** specify ceil rssi threshold */
-	t_s8 ceil_rssi_threshold;
-} mlan_ds_misc_rx_abort_cfg_ext;
-
-/** Type definition of mlan_ds_misc_rx_abort_cfg_ext
- * for MLAN_OID_MISC_TX_AMDPU_PROT_MODE
- */
-typedef struct _mlan_ds_misc_tx_ampdu_prot_mode {
-	/** set prot mode */
-	t_u16 mode;
-} mlan_ds_misc_tx_ampdu_prot_mode;
-
-/** Type definition of mlan_ds_misc_dot11mc_unassoc_ftm_cfg
- * for MLAN_OID_MISC_DOT11MC_UNASSOC_FTM_CFG
- */
-typedef struct _mlan_ds_misc_dot11mc_unassoc_ftm_cfg {
-	/** set the state */
-	t_u16 state;
-} mlan_ds_misc_dot11mc_unassoc_ftm_cfg;
-
-#define RATEADAPT_ALGO_LEGACY 0
-#define RATEADAPT_ALGO_SR 1
-
-/** Type definition of mlan_ds_misc_rate_adapt_cfg
- * for MLAN_OID_MISC_RATE_ADAPT_CFG
- */
-typedef struct _mlan_ds_misc_rate_adapt_cfg {
-	/** SR Rateadapt */
-	t_u8 sr_rateadapt;
-	/** set low threshold */
-	t_u8 ra_low_thresh;
-	/** set high threshold */
-	t_u8 ra_high_thresh;
-	/** set interval */
-	t_u16 ra_interval;
-} mlan_ds_misc_rate_adapt_cfg;
-
-/** Type definition of mlan_ds_misc_cck_desense_cfg
- * for MLAN_OID_MISC_CCK_DESENSE_CFG
- */
-typedef struct _mlan_ds_misc_cck_desense_cfg {
-	/** cck desense mode: 0:disable 1:normal 2:dynamic */
-	t_u16 mode;
-	/** specify rssi margin */
-	t_s8 margin;
-	/** specify ceil rssi threshold */
-	t_s8 ceil_thresh;
-	/** cck desense "on" interval count */
-	t_u8 num_on_intervals;
-	/** cck desense "off" interval count */
-	t_u8 num_off_intervals;
-} mlan_ds_misc_cck_desense_cfg;
-
-/** IP address length */
-#define IPADDR_LEN (16)
-/** Max number of ip */
-#define MAX_IPADDR (4)
-/** IP address type - NONE*/
-#define IPADDR_TYPE_NONE (0)
-/** IP address type - IPv4*/
-#define IPADDR_TYPE_IPV4 (1)
-/** IP operation remove */
-#define MLAN_IPADDR_OP_IP_REMOVE (0)
-/** IP operation ARP filter */
-#define MLAN_IPADDR_OP_ARP_FILTER MBIT(0)
-/** IP operation ARP response */
-#define MLAN_IPADDR_OP_AUTO_ARP_RESP MBIT(1)
-/** Enable opcode bit for MDNS & NS when device enter into suspend **/
-#define MLAN_OP_ADD_MDNS MBIT(2)
-#define MLAN_OP_ADD_IPV6_NS MBIT(3)
-
-/** Type definition of mlan_ds_misc_ipaddr_cfg for MLAN_OID_MISC_IP_ADDR */
-typedef struct _mlan_ds_misc_ipaddr_cfg {
-	/** Operation code */
-	t_u32 op_code;
-	/** IP address type */
-	t_u32 ip_addr_type;
-	/** Number of IP */
-	t_u32 ip_addr_num;
-	/** IP address */
-	t_u8 ip_addr[MAX_IPADDR][IPADDR_LEN];
-} mlan_ds_misc_ipaddr_cfg;
-
-/** Type definnition of mlan_ds_misc_ipv6_ra_offload for
- * MLAN_OID_MISC_IPV6_RA_OFFLOAD*/
-typedef struct _mlan_ds_misc_ipv6_ra_offload {
-	/** 0: disable; 1: enable*/
-	t_u8 enable;
-	t_u8 ipv6_addr[16];
-} mlan_ds_misc_ipv6_ra_offload;
-
-/* MEF configuration disable */
-#define MEF_CFG_DISABLE 0
-/* MEF configuration Rx filter enable */
-#define MEF_CFG_RX_FILTER_ENABLE 1
-/* MEF configuration auto ARP response */
-#define MEF_CFG_AUTO_ARP_RESP 2
-/* MEF configuration host command */
-#define MEF_CFG_HOSTCMD 0xFFFF
-
-/** Type definition of mlan_ds_misc_mef_cfg for MLAN_OID_MISC_MEF_CFG */
-typedef struct _mlan_ds_misc_mef_cfg {
-	/** Sub-ID for operation */
-	t_u32 sub_id;
-	/** Parameter according to sub-ID */
-	union {
-		/** MEF command buffer for MEF_CFG_HOSTCMD */
-		mlan_ds_misc_cmd cmd_buf;
-	} param;
-} mlan_ds_misc_mef_cfg;
-
-/** Type definition of mlan_ds_misc_cfp_code for MLAN_OID_MISC_CFP_CODE */
-typedef struct _mlan_ds_misc_cfp_code {
-	/** CFP table code for 2.4GHz */
-	t_u32 cfp_code_bg;
-	/** CFP table code for 5GHz */
-	t_u32 cfp_code_a;
-} mlan_ds_misc_cfp_code;
-
-/** Type definition of mlan_ds_misc_arb_cfg
- * for MLAN_OID_MISC_ARB_CFG
- */
-typedef struct _mlan_ds_misc_arb_cfg {
-	/** arb mode 0-4 */
-	t_u32 arb_mode;
-} mlan_ds_misc_arb_cfg;
-
-/** Type definition of mlan_ds_misc_tp_state
- *  for MLAN_OID_MISC_TP_STATE
- */
-typedef struct _mlan_ds_misc_tp_state {
-	/** TP account mode 0-disable 1-enable */
-	t_u32 on;
-	/** Packet drop point */
-	t_u32 drop_point;
-} mlan_ds_misc_tp_state;
-
-/** Type definition of mlan_ds_misc_country_code
- *  for MLAN_OID_MISC_COUNTRY_CODE
- */
-typedef struct _mlan_ds_misc_country_code {
-	/** Country Code */
-	t_u8 country_code[COUNTRY_CODE_LEN];
-} mlan_ds_misc_country_code;
-
-/** action for set */
-#define SUBSCRIBE_EVT_ACT_BITWISE_SET 0x0002
-/** action for clear */
-#define SUBSCRIBE_EVT_ACT_BITWISE_CLR 0x0003
-/** BITMAP for subscribe event rssi low */
-#define SUBSCRIBE_EVT_RSSI_LOW MBIT(0)
-/** BITMAP for subscribe event snr low */
-#define SUBSCRIBE_EVT_SNR_LOW MBIT(1)
-/** BITMAP for subscribe event max fail */
-#define SUBSCRIBE_EVT_MAX_FAIL MBIT(2)
-/** BITMAP for subscribe event beacon missed */
-#define SUBSCRIBE_EVT_BEACON_MISSED MBIT(3)
-/** BITMAP for subscribe event rssi high */
-#define SUBSCRIBE_EVT_RSSI_HIGH MBIT(4)
-/** BITMAP for subscribe event snr high */
-#define SUBSCRIBE_EVT_SNR_HIGH MBIT(5)
-/** BITMAP for subscribe event data rssi low */
-#define SUBSCRIBE_EVT_DATA_RSSI_LOW MBIT(6)
-/** BITMAP for subscribe event data snr low */
-#define SUBSCRIBE_EVT_DATA_SNR_LOW MBIT(7)
-/** BITMAP for subscribe event data rssi high */
-#define SUBSCRIBE_EVT_DATA_RSSI_HIGH MBIT(8)
-/** BITMAP for subscribe event data snr high */
-#define SUBSCRIBE_EVT_DATA_SNR_HIGH MBIT(9)
-/** BITMAP for subscribe event link quality */
-#define SUBSCRIBE_EVT_LINK_QUALITY MBIT(10)
-/** BITMAP for subscribe event pre_beacon_lost */
-#define SUBSCRIBE_EVT_PRE_BEACON_LOST MBIT(11)
-/** default PRE_BEACON_MISS_COUNT */
-#define DEFAULT_PRE_BEACON_MISS 30
-
-/** Type definition of mlan_ds_subscribe_evt for MLAN_OID_MISC_CFP_CODE */
-typedef struct _mlan_ds_subscribe_evt {
-	/** evt action */
-	t_u16 evt_action;
-	/** bitmap for subscribe event */
-	t_u16 evt_bitmap;
-	/** Absolute value of RSSI threshold value (dBm) */
-	t_u8 low_rssi;
-	/** 0--report once, 1--report everytime happen,
-	 * N -- report only happend > N consecutive times
-	 */
-	t_u8 low_rssi_freq;
-	/** SNR threshold value (dB) */
-	t_u8 low_snr;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 low_snr_freq;
-	/** Failure count threshold */
-	t_u8 failure_count;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 failure_count_freq;
-	/** num of missed beacons */
-	t_u8 beacon_miss;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 beacon_miss_freq;
-	/** Absolute value of RSSI threshold value (dBm) */
-	t_u8 high_rssi;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 high_rssi_freq;
-	/** SNR threshold value (dB) */
-	t_u8 high_snr;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 high_snr_freq;
-	/** Absolute value of data RSSI threshold value (dBm) */
-	t_u8 data_low_rssi;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 data_low_rssi_freq;
-	/** Absolute value of data SNR threshold value (dBm) */
-	t_u8 data_low_snr;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 data_low_snr_freq;
-	/** Absolute value of data RSSI threshold value (dBm) */
-	t_u8 data_high_rssi;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 data_high_rssi_freq;
-	/** Absolute value of data SNR threshold value (dBm) */
-	t_u8 data_high_snr;
-	/** 0--report once, 1--report everytime happen,
-	 *  N -- report only happend > N consecutive times
-	 */
-	t_u8 data_high_snr_freq;
-	/* Link SNR threshold (dB)*/
-	t_u16 link_snr;
-	/* Link SNR frequency */
-	t_u16 link_snr_freq;
-	/* Second minimum rate value as per the rate table below */
-	t_u16 link_rate;
-	/* Second minimum rate frequency */
-	t_u16 link_rate_freq;
-	/* Tx latency value (us) */
-	t_u16 link_tx_latency;
-	/* Tx latency frequency */
-	t_u16 link_tx_lantency_freq;
-	/* Number of pre missed beacons */
-	t_u8 pre_beacon_miss;
-} mlan_ds_subscribe_evt;
-
-/** Max OTP user data length */
-#define MAX_OTP_USER_DATA_LEN 252
-
-/** Type definition of mlan_ds_misc_otp_user_data
- * for MLAN_OID_MISC_OTP_USER_DATA
- */
-typedef struct _mlan_ds_misc_otp_user_data {
-	/** Reserved */
-	t_u16 reserved;
-	/** OTP user data length */
-	t_u16 user_data_length;
-	/** User data buffer */
-	t_u8 user_data[MAX_OTP_USER_DATA_LEN];
-} mlan_ds_misc_otp_user_data;
-
-/** Type definition of mlan_ds_fw_reconnect for MLAN_OID_MISC_AUTO_ASSOC */
-typedef struct _mlan_ds_fw_reconnect {
-	/* fw auto re-connect counter */
-	t_u8 fw_reconn_counter;
-	/* fw auto re-connect interval */
-	t_u8 fw_reconn_interval;
-	/* fw auto re-connect flags */
-	t_u16 fw_reconn_flags;
-} mlan_ds_fw_reconnect;
-
-typedef struct _aggr_ctrl_cfg {
-	/** Enable */
-	t_u16 enable;
-	/** Aggregation alignment */
-	t_u16 aggr_align;
-	/** Aggregation max size */
-	t_u16 aggr_max_size;
-	/** Aggregation max packet number */
-	t_u16 aggr_max_num;
-	/** Aggrgation timeout, in microseconds */
-	t_u16 aggr_tmo;
-} aggr_ctrl_cfg;
-
-/** Type definition of mlan_ds_misc_aggr_ctrl
- *  for MLAN_OID_MISC_AGGR_CTRL
- */
-typedef struct _mlan_ds_misc_aggr_ctrl {
-	/** Tx aggregation control */
-	aggr_ctrl_cfg tx;
-} mlan_ds_misc_aggr_ctrl;
-
-#ifdef USB
-typedef struct _usb_aggr_ctrl_cfg {
-	/** Enable */
-	t_u16 enable;
-	/** Aggregation mode */
-	t_u16 aggr_mode;
-	/** Aggregation alignment */
-	t_u16 aggr_align;
-	/** Aggregation max packet/size */
-	t_u16 aggr_max;
-	/** Aggrgation timeout, in microseconds */
-	t_u16 aggr_tmo;
-} usb_aggr_ctrl_cfg;
-
-/** Type definition of mlan_ds_misc_usb_aggr_ctrl
- *  for MLAN_OID_MISC_USB_AGGR_CTRL
- */
-typedef struct _mlan_ds_misc_usb_aggr_ctrl {
-	/** Tx aggregation control */
-	usb_aggr_ctrl_cfg tx_aggr_ctrl;
-	/** Rx deaggregation control */
-	usb_aggr_ctrl_cfg rx_deaggr_ctrl;
-} mlan_ds_misc_usb_aggr_ctrl;
-#endif
-
-#ifdef WIFI_DIRECT_SUPPORT
-/** flag for NOA */
-#define WIFI_DIRECT_NOA 1
-/** flag for OPP_PS */
-#define WIFI_DIRECT_OPP_PS 2
-/** Type definition of mlan_ds_wifi_direct_config
- *  for MLAN_OID_MISC_WIFI_DIRECT_CONFIG
- */
-typedef struct _mlan_ds_wifi_direct_config {
-	/** flags for NOA/OPP_PS */
-	t_u8 flags;
-	/** NoA enable/disable */
-	t_u8 noa_enable;
-	/** index */
-	t_u16 index;
-	/** NoA count */
-	t_u8 noa_count;
-	/** NoA duration */
-	t_u32 noa_duration;
-	/** NoA interval */
-	t_u32 noa_interval;
-	/** opp ps enable/disable */
-	t_u8 opp_ps_enable;
-	/** CT window value */
-	t_u8 ct_window;
-} mlan_ds_wifi_direct_config;
-#endif
-
-/** Type definition of mlan_ds_gpio_tsf_latch */
-typedef struct _mlan_ds_gpio_tsf_latch {
-	/**clock sync Mode */
-	t_u8 clock_sync_mode;
-	/**clock sync Role */
-	t_u8 clock_sync_Role;
-	/**clock sync GPIO Pin Number */
-	t_u8 clock_sync_gpio_pin_number;
-	/**clock sync GPIO Level or Toggle */
-	t_u8 clock_sync_gpio_level_toggle;
-	/**clock sync GPIO Pulse Width */
-	t_u16 clock_sync_gpio_pulse_width;
-} mlan_ds_gpio_tsf_latch;
-
-/** Type definition of mlan_ds_tsf_info */
-typedef struct _mlan_ds_tsf_info {
-	/**get tsf info format */
-	t_u16 tsf_format;
-	/**tsf info */
-	t_u16 tsf_info;
-	/**tsf */
-	t_u64 tsf;
-	/**Positive or negative offset in microsecond from Beacon TSF to GPIO
-	 * toggle TSF  */
-	t_s32 tsf_offset;
-} mlan_ds_tsf_info;
-
-#if defined(STA_SUPPORT)
-typedef struct _mlan_ds_misc_pmfcfg {
-	/** Management Frame Protection Capable */
-	t_u8 mfpc;
-	/** Management Frame Protection Required */
-	t_u8 mfpr;
-} mlan_ds_misc_pmfcfg;
-#endif
-
-typedef MLAN_PACK_START struct _mlan_ds_multi_chan_cfg {
-	/** Channel Time */
-	t_u32 channel_time;
-	/** Buffer Weight */
-	t_u8 buffer_weight;
-	/** tlv len */
-	t_u16 tlv_len;
-	/** TLV buffer */
-	t_u8 tlv_buf[];
-} MLAN_PACK_END mlan_ds_multi_chan_cfg;
-
-typedef MLAN_PACK_START struct _mlan_ds_drcs_cfg {
-	/** Channel Index*/
-	t_u16 chan_idx;
-	/** Channel time (in TU) for chan_idx */
-	t_u8 chantime;
-	/** Channel swith time (in TU) for chan_idx */
-	t_u8 switchtime;
-	/** Undoze time (in TU) for chan_idx */
-	t_u8 undozetime;
-	/** Rx traffic control scheme when channel switch*/
-	/** only valid for GC/STA interface*/
-	t_u8 mode;
-} MLAN_PACK_END mlan_ds_drcs_cfg;
-
-#define MAX_SSID_NUM 16
-#define MAX_AP_LIST 8
-#define RETRY_UNLIMITED_TIME 0xFF
-
-#define FW_ROAM_ENABLE MBIT(0)
-#define FW_ROAM_TRIGGER_COND MBIT(1)
-#define FW_ROAM_BSSID MBIT(2)
-#define FW_ROAM_SSID MBIT(3)
-#define FW_ROAM_RETRY_COUNT MBIT(4)
-#define FW_ROAM_RSSI_PARA MBIT(5)
-#define FW_ROAM_BAND_RSSI MBIT(6)
-#define FW_ROAM_BGSCAN_PARAM MBIT(7)
-#define FW_ROAM_EES_PARAM MBIT(8)
-#define FW_ROAM_BCN_MISS_THRESHOLD MBIT(9)
-#define FW_ROAM_PRE_BCN_MISS_THRESHOLD MBIT(10)
-#define FW_ROAM_BLACKLIST MBIT(11)
-#define FW_ROAM_REPEAT_CNT MBIT(12)
-
-/*Roam offload configuration for auto reconnection when suspend and resume*/
-typedef enum _roam_offload_config_mode {
-	ROAM_OFFLOAD_ENABLE = 1,
-	ROAM_OFFLOAD_SUSPEND_CFG,
-	ROAM_OFFLOAD_RESUME_CFG,
-	ROAM_OFFLOAD_PARAM_CFG,
-} roam_offload_config_mode;
-
-typedef enum _roam_offload_set_mode {
-	ROAM_OFFLOAD_DISABLE = 0,
-	ROAM_OFFLOAD_WITH_APLIST,
-	ROAM_OFFLOAD_WITHOUT_APLIST,
-	ROAM_OFFLOAD_WITH_BSSID,
-	ROAM_OFFLOAD_WITH_SSID,
-	AUTO_RECONNECT,
-} roam_offload_set_mode;
-
-typedef enum _roam_offload_trigger_mode {
-	NO_TRIGGER = 0x00,
-	RSSI_LOW_TRIGGER = 0x01,
-	PRE_BEACON_LOST_TRIGGER = 0x02,
-	LINK_LOST_TRIGGER = 0x04,
-	DEAUTH_WITH_EXT_AP_TRIGGER = 0x08,
-} roam_offload_trigger_mode;
-
-/** mlan_ds_misc_ees_cfg structure */
-typedef MLAN_PACK_START struct _mlan_ds_misc_ees_cfg {
-	/* EES mode*/
-	t_u16 ees_mode;
-	/* EES report condition*/
-	t_u16 ees_rpt_condition;
-	/* High scan period(milliseconds)*/
-	t_u16 high_scan_period;
-	/* High scan count*/
-	t_u16 high_scan_count;
-	/* Middle scan period(milliseconds)*/
-	t_u16 mid_scan_period;
-	/* Middle scan count*/
-	t_u16 mid_scan_count;
-	/* Low scan period(milliseconds)*/
-	t_u16 low_scan_period;
-	/* Low scan count*/
-	t_u16 low_scan_count;
-} MLAN_PACK_END mlan_ds_misc_ees_cfg;
-
-/** mlan_ds_misc_bgscan_cfg structure */
-typedef MLAN_PACK_START struct _mlan_ds_misc_bgscan_cfg {
-	/* BSS Type  0x1-bss independent, 0x2-bss infrastructure, 0x3-bss any*/
-	t_u8 bss_type;
-	/* Number of channels scanned for each scan*/
-	t_u8 channels_per_scan;
-	/* Interval between consective scans*/
-	t_u32 scan_interval;
-	/* Conditons to trigger report to host*/
-	t_u32 bg_rpt_condition;
-} MLAN_PACK_END mlan_ds_misc_bgscan_cfg;
-
-/** mlan_ds_misc_band_rssi structure */
-typedef MLAN_PACK_START struct _mlan_ds_misc_band_rssi {
-	/* RSSI hysteresis*/
-	t_u8 rssi_hysteresis;
-	/*  Preferred channel band for fw roaming
-	 *  0:2.4G band; 1: 5G band; 2:4G band; 0xFF:band not set(invalid)
-	 */
-	t_u8 band_preferred;
-} MLAN_PACK_END mlan_ds_misc_band_rssi;
-
-/** mlan_ds_misc_ssid_list structure */
-typedef MLAN_PACK_START struct _mlan_ds_misc_ssid_list {
-	/* SSID number*/
-	t_u8 ssid_num;
-	/* SSID for fw roaming/auto_reconnect*/
-	mlan_802_11_ssid ssids[MAX_SSID_NUM];
-} MLAN_PACK_END mlan_ds_misc_ssid_list;
-
-typedef MLAN_PACK_START struct _mlan_ds_misc_roam_offload_aplist {
-	/** Number of AP**/
-	t_u8 ap_num;
-	/** AP mac addrs**/
-	t_u8 ap_mac[MAX_AP_LIST][MLAN_MAC_ADDR_LENGTH];
-} MLAN_PACK_END mlan_ds_misc_roam_offload_aplist;
-
-typedef MLAN_PACK_START struct _mlan_ds_misc_roam_offload_para_rssi {
-	/** Setting flag**/
-	t_u8 set_flag;
-	/** Max value of RSSI threshold**/
-	t_u8 max_rssi;
-	/** Min value of RSSI threshold**/
-	t_u8 min_rssi;
-	/** Adjusting step value of RSSI threshold**/
-	t_u8 step_rssi;
-} MLAN_PACK_END mlan_ds_misc_roam_offload_para_rssi;
-
-typedef MLAN_PACK_START struct _mlan_ds_misc_roam_offload {
-	/** Enable roam offload**/
-	t_u8 enable;
-	/** User set passphrase**/
-	t_u8 userset_passphrase;
-	/* Condition to trigger roaming
-	 * Bit0 : RSSI low trigger
-	 * Bit1 : Pre-beacon lost trigger
-	 * Bit2 : Link Lost trigger
-	 * Bit3 : Deauth by ext-AP trigger
-	 * Bit4 ~ Bit15 : Reserved
-	 * value 0 : no trigger
-	 * value 0xff : invalid
-	 */
-	t_u16 trigger_condition;
-	/** AP list**/
-	mlan_ds_misc_roam_offload_aplist aplist;
-	/*Roam offload configuration mode for auto connection when suspend and
-	 * resume*/
-	roam_offload_config_mode config_mode;
-	/** Retry count**/
-	t_u8 retry_count;
-	/** RSSI para**/
-	mlan_ds_misc_roam_offload_para_rssi para_rssi;
-	/** BSSID of reconnection**/
-	mlan_802_11_mac_addr bssid_reconnect;
-	/* SSID List(White list)*/
-	mlan_ds_misc_ssid_list ssid_list;
-	/* Black list(BSSID list)*/
-	mlan_ds_misc_roam_offload_aplist black_list;
-	/* BAND and RSSI_HYSTERESIS set flag*/
-	t_u8 band_rssi_flag;
-	mlan_ds_misc_band_rssi band_rssi;
-
-	/* BGSCAN params set flag*/
-	t_u8 bgscan_set_flag;
-	mlan_ds_misc_bgscan_cfg bgscan_cfg;
-
-	/* EES mode params set flag*/
-	t_u8 ees_param_set_flag;
-	mlan_ds_misc_ees_cfg ees_cfg;
-
-	/* Beacon miss threshold*/
-	t_u8 bcn_miss_threshold;
-
-	/* Beacon miss threshold*/
-	t_u8 pre_bcn_miss_threshold;
-
-	/* Scan repeat count*/
-	t_u16 repeat_count;
-} MLAN_PACK_END mlan_ds_misc_roam_offload;
-
-/**Action ID for TDLS disable link*/
-#define WLAN_TDLS_DISABLE_LINK 0x00
-/**Action ID for TDLS enable link*/
-#define WLAN_TDLS_ENABLE_LINK 0x01
-/**Action ID for TDLS create link*/
-#define WLAN_TDLS_CREATE_LINK 0x02
-/**Action ID for TDLS config link*/
-#define WLAN_TDLS_CONFIG_LINK 0x03
-/*reason code*/
-#define MLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED 26
-/** TDLS operation buffer */
-typedef struct _mlan_ds_misc_tdls_oper {
-	/** TDLS Action */
-	t_u16 tdls_action;
-	/** TDLS peer address */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** peer capability */
-	t_u16 capability;
-	/** peer qos info */
-	t_u8 qos_info;
-	/** peer extend capability */
-	t_u8 *ext_capab;
-	/** extend capability len */
-	t_u8 ext_capab_len;
-	/** support rates */
-	t_u8 *supported_rates;
-	/** supported rates len */
-	t_u8 supported_rates_len;
-	/** peer ht_cap */
-	t_u8 *ht_capa;
-	/** peer vht capability */
-	t_u8 *vht_cap;
-} mlan_ds_misc_tdls_oper;
-
-/** flag for TDLS extcap */
-#define TDLS_IE_FLAGS_EXTCAP 0x0001
-/** flag for TDLS HTCAP */
-#define TDLS_IE_FLAGS_HTCAP 0x0002
-/** flag for TDLS HTINFO */
-#define TDLS_IE_FLAGS_HTINFO 0x0004
-/** flag for TDLS VHTCAP */
-#define TDLS_IE_FLAGS_VHTCAP 0x0008
-/** flag for TDLS VHTOPRAT */
-#define TDLS_IE_FLAGS_VHTOPRAT 0x0010
-/** flag for TDLS AID inof */
-#define TDLS_IE_FLAGS_AID 0x0020
-/** flag for TDLS Supported channels and regulatory class IE*/
-#define TDLS_IE_FLAGS_SUPP_CS_IE 0x0040
-/** flag for TDLS Qos info */
-#define TDLS_IE_FLAGS_QOS_INFO 0x0080
-/** flag for TDLS SETUP */
-#define TDLS_IE_FLAGS_SETUP 0x0100
-#define TDLS_IE_FLAGS_HECAP 0x0200
-#define TDLS_IE_FLAGS_HEOP 0x0400
-
-/** TDLS ie buffer */
-typedef struct _mlan_ds_misc_tdls_ies {
-	/** TDLS peer address */
-	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
-	/** flags for request IEs */
-	t_u16 flags;
-	/** Qos info */
-	t_u8 QosInfo;
-	/** Extended Capabilities IE */
-	t_u8 ext_cap[IEEE_MAX_IE_SIZE];
-	/** HT Capabilities IE */
-	t_u8 ht_cap[IEEE_MAX_IE_SIZE];
-	/** HT Information IE */
-	t_u8 ht_info[IEEE_MAX_IE_SIZE];
-	/** VHT Capabilities IE */
-	t_u8 vht_cap[IEEE_MAX_IE_SIZE];
-	/** VHT Operations IE */
-	t_u8 vht_oprat[IEEE_MAX_IE_SIZE];
-	/** aid Info */
-	t_u8 aid_info[IEEE_MAX_IE_SIZE];
-	/** HE Capabilities IE */
-	t_u8 he_cap[IEEE_MAX_IE_SIZE];
-	/** HE Operation IE */
-	t_u8 he_op[IEEE_MAX_IE_SIZE];
-	/** supported channels */
-	t_u8 supp_chan[IEEE_MAX_IE_SIZE];
-	/** supported regulatory class */
-	t_u8 regulatory_class[IEEE_MAX_IE_SIZE];
-} mlan_ds_misc_tdls_ies;
-
-typedef struct _mlan_ds_misc_dfs_repeater {
-	/** Set or Get */
-	t_u16 action;
-	/** 1 on or 0 off */
-	t_u16 mode;
-} mlan_ds_misc_dfs_repeater;
-
-#define WOWLAN_MAX_PATTERN_LEN 20
-#define WOWLAN_MAX_OFFSET_LEN 50
-#define MAX_NUM_FILTERS 10
-#define MEF_MODE_HOST_SLEEP (1 << 0)
-#define MEF_MODE_NON_HOST_SLEEP (1 << 1)
-#define MEF_ACTION_WAKE (1 << 0)
-#define MEF_ACTION_ALLOW (1 << 1)
-#define MEF_ACTION_ALLOW_AND_WAKEUP_HOST 3
-#define MEF_AUTO_ARP 0x10
-#define MEF_AUTO_PING 0x20
-#define MEF_NS_RESP 0x40
-#define MEF_MAGIC_PKT 0x80
-#define CRITERIA_BROADCAST BIT(0)
-#define CRITERIA_UNICAST BIT(1)
-#define CRITERIA_MULTICAST BIT(3)
-
-#define MAX_NUM_ENTRIES 8
-#define MAX_NUM_BYTE_SEQ 6
-#define MAX_NUM_MASK_SEQ 6
-
-#define OPERAND_DNUM 1
-#define OPERAND_BYTE_SEQ 2
-
-#define MAX_OPERAND 0x40
-#define TYPE_BYTE_EQ (MAX_OPERAND + 1)
-#define TYPE_DNUM_EQ (MAX_OPERAND + 2)
-#define TYPE_BIT_EQ (MAX_OPERAND + 3)
-
-#define RPN_TYPE_AND (MAX_OPERAND + 4)
-#define RPN_TYPE_OR (MAX_OPERAND + 5)
-
-#define ICMP_OF_IP_PROTOCOL 0x01
-#define TCP_OF_IP_PROTOCOL 0x06
-#define UDP_OF_IP_PROTOCOL 0x11
-
-#define IPV4_PKT_OFFSET 20
-#define IP_PROTOCOL_OFFSET 31
-#define PORT_PROTOCOL_OFFSET 44
-
-#define FILLING_TYPE MBIT(0)
-#define FILLING_PATTERN MBIT(1)
-#define FILLING_OFFSET MBIT(2)
-#define FILLING_NUM_BYTES MBIT(3)
-#define FILLING_REPEAT MBIT(4)
-#define FILLING_BYTE_SEQ MBIT(5)
-#define FILLING_MASK_SEQ MBIT(6)
-
-/** Type definition of filter_item
- *  Support three match methods:
- *  <1>Byte comparison type=0x41
- *  <2>Decimal comparison type=0x42
- *  <3>Bit comparison type=0x43
- */
-typedef struct _mef_filter_t {
-	/** flag*/
-	t_u32 fill_flag;
-	/** BYTE 0X41; Decimal 0X42; Bit 0x43*/
-	t_u16 type;
-	/** value*/
-	t_u32 pattern;
-	/** offset*/
-	t_u16 offset;
-	/** number of bytes*/
-	t_u16 num_bytes;
-	/** repeat*/
-	t_u16 repeat;
-	/** byte number*/
-	t_u8 num_byte_seq;
-	/** array*/
-	t_u8 byte_seq[MAX_NUM_BYTE_SEQ];
-	/** mask numbers*/
-	t_u8 num_mask_seq;
-	/** array*/
-	t_u8 mask_seq[MAX_NUM_MASK_SEQ];
-} mef_filter_t;
-
-typedef struct _mef_entry_t {
-	/** mode: bit0--hostsleep mode; bit1--non hostsleep mode */
-	t_u8 mode;
-	/** action: 0--discard and not wake host;
-		    1--discard and wake host;
-		    3--allow and wake host;*/
-	t_u8 action;
-	/** filter number */
-	t_u8 filter_num;
-	/** filter array*/
-	mef_filter_t filter_item[MAX_NUM_FILTERS];
-	/** rpn array*/
-	t_u8 rpn[MAX_NUM_FILTERS];
-} mef_entry_t;
-
-/** Type definition of mlan_ds_nvflt_mef_entry
- *for MLAN_OID_MISC_MEF_FLT_CFG
- */
-typedef struct _mlan_ds_misc_mef_flt_cfg {
-	/** Type of action*/
-	int mef_act_type;
-	/** Operation code*/
-	t_u32 op_code;
-	/** NV Filter Criteria*/
-	t_u32 criteria;
-	/** NV MEF entry*/
-	mef_entry_t mef_entry;
-} mlan_ds_misc_mef_flt_cfg;
-
-/** Enumeration for action type*/
-enum _mlan_act_mef_act_type {
-	MEF_ACT_ADD = 1,
-	MEF_ACT_ENABLE,
-	MEF_ACT_DISABLE,
-	MEF_ACT_CANCEL,
-	MEF_ACT_AUTOARP,
-	MEF_ACT_WOWLAN,
-	MEF_ACT_IPV6_NS,
-};
-
-typedef struct _mlan_ds_sensor_temp {
-	t_u32 temperature;
-} mlan_ds_sensor_temp;
-
-#define MLAN_KCK_LEN 16
-#define MLAN_KEK_LEN 16
-#define MLAN_REPLAY_CTR_LEN 8
-/** mlan_ds_misc_gtk_rekey_data */
-typedef struct _mlan_ds_misc_gtk_rekey_data {
-	/** key encryption key */
-	t_u8 kek[MLAN_KEK_LEN];
-	/** key confirmation key */
-	t_u8 kck[MLAN_KCK_LEN];
-	/** replay counter */
-	t_u8 replay_ctr[MLAN_REPLAY_CTR_LEN];
-} mlan_ds_misc_gtk_rekey_data;
-typedef struct _mlan_ds_bw_chan_oper {
-	/* bandwidth 20:20M 40:40M 80:80M*/
-	t_u8 bandwidth;
-	/* channel number */
-	t_u8 channel;
-	/* Non-global operating class */
-	t_u8 oper_class;
-} mlan_ds_bw_chan_oper;
-
-typedef struct _mlan_ds_ind_rst_cfg {
-	/** Set or Get */
-	t_u16 action;
-	/** oob mode enable/ disable */
-	t_u8 ir_mode;
-	/** gpio pin */
-	t_u8 gpio_pin;
-} mlan_ds_ind_rst_cfg;
-
-#define MKEEP_ALIVE_IP_PKT_MAX 256
-typedef struct _mlan_ds_misc_keep_alive {
-	t_u8 mkeep_alive_id;
-	t_u8 enable;
-	/** enable/disable tcp reset*/
-	t_u8 reset;
-	/**True means saved in driver, false means not saved or download*/
-	t_u8 cached;
-	t_u32 send_interval;
-	t_u16 retry_interval;
-	t_u16 retry_count;
-	t_u8 dst_mac[MLAN_MAC_ADDR_LENGTH];
-	t_u8 src_mac[MLAN_MAC_ADDR_LENGTH];
-	t_u16 pkt_len;
-	t_u8 packet[MKEEP_ALIVE_IP_PKT_MAX];
-	/** Ethernet type */
-	t_u16 ether_type;
-} mlan_ds_misc_keep_alive, *pmlan_ds_misc_keep_alive;
-
-/** TX and RX histogram statistic parameters*/
-typedef MLAN_PACK_START struct _mlan_ds_misc_tx_rx_histogram {
-	/** Enable or disable get tx/rx histogram statistic */
-	t_u8 enable;
-	/** Choose to get TX, RX or both histogram statistic */
-	t_u16 action;
-	/** Size of Tx/Rx info */
-	t_u16 size;
-	/** Store Tx/Rx info */
-	t_u8 value[1];
-} MLAN_PACK_END mlan_ds_misc_tx_rx_histogram;
-
-typedef MLAN_PACK_START struct _mlan_ds_cw_mode_ctrl {
-	/** Mode of Operation 0: Disable 1: Tx Continuous Packet 2: Tx
-	 * Continuous Wave */
-	t_u8 mode;
-	/*channel*/
-	t_u8 channel;
-	/* channel info*/
-	t_u8 chanInfo;
-	/** Tx Power level in dBm */
-	t_u16 txPower;
-	/** Packet Length */
-	t_u16 pktLength;
-	/** bit rate Info */
-	t_u32 rateInfo;
-} MLAN_PACK_END mlan_ds_cw_mode_ctrl;
-
-#define RX_PKT_INFO MBIT(1)
-/** Struct for per-packet configuration */
-typedef struct _mlan_per_pkt_cfg {
-	/** Type ID*/
-	t_u16 type;
-	/** Length of payload*/
-	t_u16 len;
-	/**  Tx/Rx per-packet control */
-	t_u8 tx_rx_control;
-	/** Number of ethernet types in ether_type array */
-	t_u8 proto_type_num;
-	/** Array of ether_type for per-packet control */
-	t_u16 ether_type[];
-} mlan_per_pkt_cfg;
-
-/** Type definition of mlan_ds_misc_robustcoex_params for MLAN_IOCTL_MISC_CFG */
-typedef struct _mlan_ds_misc_robustcoex_params {
-	t_u16 method;
-	/** enable/disable robustcoex gpio cfg */
-	t_u8 enable;
-	/** Number of GPIO */
-	t_u8 gpio_num;
-	/** Polarity of GPIO */
-	t_u8 gpio_polarity;
-} mlan_ds_misc_robustcoex_params;
-
-#if defined(PCIE)
-typedef struct _mlan_ds_ssu_params {
-	t_u32 nskip;
-	t_u32 nsel;
-	t_u32 adcdownsample;
-	t_u32 mask_adc_pkt;
-	t_u32 out_16bits;
-	t_u32 spec_pwr_enable;
-	t_u32 rate_deduction;
-	t_u32 n_pkt_avg;
-} mlan_ds_ssu_params;
-#endif
-
-#define CSI_FILTER_MAX 16
-/** Structure of CSI filters */
-typedef MLAN_PACK_START struct _mlan_csi_filter_t {
-	/** Source address of the packet to receive */
-	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
-	/** Pakcet type of the interested CSI */
-	t_u8 pkt_type;
-	/* Packet subtype of the interested CSI */
-	t_u8 subtype;
-	/* Other filter flags */
-	t_u8 flags;
-} MLAN_PACK_END mlan_csi_filter_t;
-/** Structure of CSI parameters */
-typedef MLAN_PACK_START struct _mlan_ds_csi_params {
-	/** CSI enable flag. 1: enable, 0: disable */
-	t_u16 csi_enable;
-	/** Header ID*/
-	t_u32 head_id;
-	/** Tail ID */
-	t_u32 tail_id;
-	/** Number of CSI filters */
-	t_u8 csi_filter_cnt;
-	/** Chip ID */
-	t_u8 chip_id;
-	/** CSI filters */
-	mlan_csi_filter_t csi_filter[CSI_FILTER_MAX];
-} MLAN_PACK_END mlan_ds_csi_params;
-
-typedef MLAN_PACK_START struct _mlan_ds_hal_phy_cfg_params {
-	/** 11b pwr spectral density mask enable/disable */
-	t_u8 dot11b_psd_mask_cfg;
-	/** reserved fields for future hal/phy cfg use */
-	t_u8 reserved[7];
-} MLAN_PACK_END mlan_ds_hal_phy_cfg_params;
-
-#define MAX_NUM_MAC 2
-/** Type definition of mlan_ds_misc_mapping_policy */
-typedef struct _mlan_ds_misc_mapping_policy {
-	/** Enable/disable dynamic mapping */
-	t_u16 subcmd;
-	/** Mapping policy */
-	t_u8 mapping_policy;
-} mlan_ds_misc_mapping_policy, *pmlan_ds_misc_mapping_policy;
-
-typedef struct _dmcsChanStatus_t {
-	/** Channel number */
-	t_u8 channel;
-	/** Number of ap on this channel */
-	t_u8 ap_count;
-	/** Number of sta on this channel */
-	t_u8 sta_count;
-} dmcsChanStatus_t, *pdmcsChanStatus_t;
-
-typedef struct _dmcsStatus_t {
-	/** Radio ID */
-	t_u8 radio_id;
-	/** Running mode
-	** 0 - Idle
-	** 1 - DBC
-	** 2 - DRCS
-	*/
-	t_u8 running_mode;
-	/** Current channel status */
-	dmcsChanStatus_t chan_status[2];
-} dmcsStatus_t, *pdmcsStatus_t;
-
-/** Type definition of mlan_ds_misc_dmcs_status */
-typedef struct _mlan_ds_misc_dmcs_status {
-	t_u8 mapping_policy;
-	dmcsStatus_t radio_status[MAX_NUM_MAC];
-} mlan_ds_misc_dmcs_status, *pmlan_ds_misc_dmcs_status;
-
-/** Type definition of mlan_ds_misc_chan_trpc_cfg for
- * MLAN_OID_MISC_GET_CHAN_TRPC_CFG */
-typedef struct _mlan_ds_misc_chan_trpc_cfg {
-	/** sub_band */
-	t_u16 sub_band;
-	/** length */
-	t_u16 length;
-	/** buf */
-	t_u8 trpc_buf[2048];
-} mlan_ds_misc_chan_trpc_cfg;
-
-#define MFG_CMD_SET_TEST_MODE 1
-#define MFG_CMD_UNSET_TEST_MODE 0
-#define MFG_CMD_TX_ANT 0x1004
-#define MFG_CMD_RX_ANT 0x1005
-#define MFG_CMD_TX_CONT 0x1009
-#define MFG_CMD_RF_CHAN 0x100A
-#define MFG_CMD_CLR_RX_ERR 0x1010
-#define MFG_CMD_TX_FRAME 0x1021
-#define MFG_CMD_RFPWR 0x1033
-#define MFG_CMD_RF_BAND_AG 0x1034
-#define MFG_CMD_RF_CHANNELBW 0x1044
-#define MFG_CMD_RADIO_MODE_CFG 0x1211
-#define MFG_CMD_CONFIG_MAC_HE_TB_TX 0x110A
-#define MFG_CMD_CONFIG_TRIGGER_FRAME 0x110C
-/** MFG CMD generic cfg */
-struct MLAN_PACK_START mfg_cmd_generic_cfg {
-	/** MFG command code */
-	t_u32 mfg_cmd;
-	/** Action */
-	t_u16 action;
-	/** Device ID */
-	t_u16 device_id;
-	/** MFG Error code */
-	t_u32 error;
-	/** value 1 */
-	t_u32 data1;
-	/** value 2 */
-	t_u32 data2;
-	/** value 3 */
-	t_u32 data3;
-} MLAN_PACK_END;
-
-/** MFG CMD Tx Frame 2 */
-struct MLAN_PACK_START mfg_cmd_tx_frame2 {
-	/** MFG command code */
-	t_u32 mfg_cmd;
-	/** Action */
-	t_u16 action;
-	/** Device ID */
-	t_u16 device_id;
-	/** MFG Error code */
-	t_u32 error;
-	/** enable */
-	t_u32 enable;
-	/** data_rate */
-	t_u32 data_rate;
-	/** frame pattern */
-	t_u32 frame_pattern;
-	/** frame length */
-	t_u32 frame_length;
-	/** BSSID */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** Adjust burst sifs */
-	t_u16 adjust_burst_sifs;
-	/** Burst sifs in us*/
-	t_u32 burst_sifs_in_us;
-	/** short preamble */
-	t_u32 short_preamble;
-	/** active sub channel */
-	t_u32 act_sub_ch;
-	/** short GI */
-	t_u32 short_gi;
-	/** Adv coding */
-	t_u32 adv_coding;
-	/** Tx beamforming */
-	t_u32 tx_bf;
-	/** HT Greenfield Mode*/
-	t_u32 gf_mode;
-	/** STBC */
-	t_u32 stbc;
-	/** power id */
-	t_u32 rsvd[2];
-	/** NumPkt */
-	t_u32 NumPkt;
-	/** MaxPE */
-	t_u32 MaxPE;
-	/** BeamChange */
-	t_u32 BeamChange;
-	/** Dcm */
-	t_u32 Dcm;
-	/** Doppler */
-	t_u32 Doppler;
-	/** MidP */
-	t_u32 MidP;
-	/** QNum */
-	t_u32 QNum;
-
-} MLAN_PACK_END;
-
-/* MFG CMD Tx Continuous */
-struct MLAN_PACK_START mfg_cmd_tx_cont {
-	/** MFG command code */
-	t_u32 mfg_cmd;
-	/** Action */
-	t_u16 action;
-	/** Device ID */
-	t_u16 device_id;
-	/** MFG Error code */
-	t_u32 error;
-	/** enable Tx*/
-	t_u32 enable_tx;
-	/** Continuous Wave mode */
-	t_u32 cw_mode;
-	/** payload pattern */
-	t_u32 payload_pattern;
-	/** CS Mode */
-	t_u32 cs_mode;
-	/** active sub channel */
-	t_u32 act_sub_ch;
-	/** Tx rate */
-	t_u32 tx_rate;
-	/** power id */
-	t_u32 rsvd;
-} MLAN_PACK_END;
-
-struct MLAN_PACK_START mfg_Cmd_HE_TBTx_t {
-	/** MFG command code */
-	t_u32 mfg_cmd;
-	/** Action */
-	t_u16 action;
-	/** Device ID */
-	t_u16 device_id;
-	/** MFG Error code */
-	t_u32 error;
-	/** Enable Tx */
-	t_u16 enable;
-	/** Q num */
-	t_u16 qnum;
-	/** AID */
-	t_u16 aid;
-	/** AXQ Mu Timer */
-	t_u16 axq_mu_timer;
-	/** Tx Power */
-	t_s16 tx_power;
-} MLAN_PACK_END;
-
-#ifdef BIG_ENDIAN_SUPPORT
-typedef MLAN_PACK_START struct _mfg_cmd_IEEEtypes_HETrigComInfo_t {
-	t_u64 reserved : 1;
-	t_u64 he_sig2 : 9;
-	t_u64 doppler : 1;
-	t_u64 spatial_reuse : 16;
-	t_u64 pe_disambig : 1;
-	t_u64 pre_fec_pad_fct : 2;
-	t_u64 ap_tx_pwr : 6;
-
-	t_u64 ldpc_ess : 1;
-	t_u64 ul_stbc : 1;
-	t_u64 ltf_symbol : 3;
-	t_u64 ltf_mode : 1;
-	t_u64 ltf_type : 2;
-
-	t_u64 ul_bw : 2;
-	t_u64 cs_required : 1;
-	t_u64 more_tf : 1;
-	t_u64 ul_len : 12;
-	t_u64 trigger_type : 4;
-
-} MLAN_PACK_END mfg_cmd_IEEEtypes_HETrigComInfo_t;
-#else
-typedef MLAN_PACK_START struct _mfg_cmd_IEEEtypes_HETrigComInfo_t {
-	t_u64 trigger_type : 4;
-	t_u64 ul_len : 12;
-	t_u64 more_tf : 1;
-	t_u64 cs_required : 1;
-	t_u64 ul_bw : 2;
-
-	t_u64 ltf_type : 2;
-	t_u64 ltf_mode : 1;
-	t_u64 ltf_symbol : 3;
-	t_u64 ul_stbc : 1;
-	t_u64 ldpc_ess : 1;
-
-	t_u64 ap_tx_pwr : 6;
-	t_u64 pre_fec_pad_fct : 2;
-	t_u64 pe_disambig : 1;
-	t_u64 spatial_reuse : 16;
-	t_u64 doppler : 1;
-	t_u64 he_sig2 : 9;
-	t_u64 reserved : 1;
-
-} MLAN_PACK_END mfg_cmd_IEEEtypes_HETrigComInfo_t;
-#endif
-
-#ifdef BIG_ENDIAN_SUPPORT
-typedef MLAN_PACK_START struct _mfg_cmd_IEEEtypes_HETrigUserInfo_t {
-	t_u8 reserved : 1;
-	t_u8 ul_target_rssi : 7;
-	t_u32 ss_alloc : 6;
-	t_u32 ul_dcm : 1;
-	t_u32 ul_mcs : 4;
-	t_u32 ul_coding_type : 1;
-	t_u32 ru_alloc : 7;
-	t_u32 ru_alloc_reg : 1;
-	t_u32 aid12 : 12;
-
-} MLAN_PACK_END mfg_cmd_IEEEtypes_HETrigUserInfo_t;
-#else
-typedef MLAN_PACK_START struct _mfg_cmd_IEEEtypes_HETrigUserInfo_t {
-	t_u32 aid12 : 12;
-	t_u32 ru_alloc_reg : 1;
-	t_u32 ru_alloc : 7;
-	t_u32 ul_coding_type : 1;
-	t_u32 ul_mcs : 4;
-	t_u32 ul_dcm : 1;
-	t_u32 ss_alloc : 6;
-	t_u8 ul_target_rssi : 7;
-	t_u8 reserved : 1;
-} MLAN_PACK_END mfg_cmd_IEEEtypes_HETrigUserInfo_t;
-#endif
-
-#ifdef BIG_ENDIAN_SUPPORT
-typedef MLAN_PACK_START struct _mfg_cmd_IEEETypes_BasicHETrigUserInfo_t {
-	t_u8 pref_ac : 2;
-	t_u8 ac_pl : 1;
-	t_u8 tid_al : 3;
-	t_u8 mpdu_mu_sf : 2;
-} MLAN_PACK_END mfg_cmd_IEEETypes_BasicHETrigUserInfo_t;
-#else
-typedef MLAN_PACK_START struct _mfg_cmd_IEEETypes_BasicHETrigUserInfo_t {
-	t_u8 mpdu_mu_sf : 2;
-	t_u8 tid_al : 3;
-	t_u8 ac_pl : 1;
-	t_u8 pref_ac : 2;
-} MLAN_PACK_END mfg_cmd_IEEETypes_BasicHETrigUserInfo_t;
-#endif
-
-#ifdef BIG_ENDIAN_SUPPORT
-typedef MLAN_PACK_START struct _mfg_cmd_IEEEtypes_FrameCtrl_t {
-	/** Order */
-	t_u8 order : 1;
-	/** Wep */
-	t_u8 wep : 1;
-	/** More Data */
-	t_u8 more_data : 1;
-	/** Power Mgmt */
-	t_u8 pwr_mgmt : 1;
-	/** Retry */
-	t_u8 retry : 1;
-	/** More Frag */
-	t_u8 more_frag : 1;
-	/** From DS */
-	t_u8 from_ds : 1;
-	/** To DS */
-	t_u8 to_ds : 1;
-	/** Sub Type */
-	t_u8 sub_type : 4;
-	/** Type */
-	t_u8 type : 2;
-	/** Protocol Version */
-	t_u8 protocol_version : 2;
-} MLAN_PACK_END mfg_cmd_IEEEtypes_FrameCtrl_t;
-#else
-typedef MLAN_PACK_START struct _mfg_cmd_IEEEtypes_FrameCtrl_t {
-	/** Protocol Version */
-	t_u8 protocol_version : 2;
-	/** Type */
-	t_u8 type : 2;
-	/** Sub Type */
-	t_u8 sub_type : 4;
-	/** To DS */
-	t_u8 to_ds : 1;
-	/** From DS */
-	t_u8 from_ds : 1;
-	/** More Frag */
-	t_u8 more_frag : 1;
-	/** Retry */
-	t_u8 retry : 1;
-	/** Power Mgmt */
-	t_u8 pwr_mgmt : 1;
-	/** More Data */
-	t_u8 more_data : 1;
-	/** Wep */
-	t_u8 wep : 1;
-	/** Order */
-	t_u8 order : 1;
-} MLAN_PACK_END mfg_cmd_IEEEtypes_FrameCtrl_t;
-#endif
-
-typedef MLAN_PACK_START struct _mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t {
-	/** MFG command code */
-	t_u32 mfg_cmd;
-	/** Action */
-	t_u16 action;
-	/** Device ID */
-	t_u16 device_id;
-	/** MFG Error code */
-	t_u32 error;
-	/** enable Tx*/
-	t_u32 enable_tx;
-	/** enable Stand Alone HE TB */
-	t_u32 standalone_hetb;
-	/** Frame Control */
-	mfg_cmd_IEEEtypes_FrameCtrl_t frmCtl;
-	/** Duration */
-	t_u16 duration;
-	/** Destination MAC Address */
-	t_u8 dest_addr[MLAN_MAC_ADDR_LENGTH];
-	/** Source MAC Address */
-	t_u8 src_addr[MLAN_MAC_ADDR_LENGTH];
-	/** Common Info Field **/
-	mfg_cmd_IEEEtypes_HETrigComInfo_t trig_common_field;
-	/** User Info Field **/
-	mfg_cmd_IEEEtypes_HETrigUserInfo_t trig_user_info_field;
-	/** Trigger Dependent User Info Field **/
-	mfg_cmd_IEEETypes_BasicHETrigUserInfo_t basic_trig_user_info;
-} MLAN_PACK_END mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t;
-
-typedef struct _mlan_ds_misc_chnrgpwr_cfg {
-	/** length */
-	t_u16 length;
-	/** chnrgpwr buf */
-	t_u8 chnrgpwr_buf[2048];
-} mlan_ds_misc_chnrgpwr_cfg;
-
-/** dfs chan list for MLAN_OID_MISC_CFP_TABLE */
-typedef struct _mlan_ds_misc_cfp_tbl {
-	/** band */
-	t_u8 band;
-	/** num chan */
-	t_u8 num_chan;
-	/** cfp table */
-	chan_freq_power_t cfp_tbl[];
-} mlan_ds_misc_cfp_tbl;
-
-/** mlan_ds_mc_aggr_cfg for MLAN_OID_MISC_MC_AGGR_CFG */
-typedef struct _mlan_ds_mc_aggr_cfg {
-	/** action */
-	t_u8 action;
-	/* 1 enable, 0 disable
-	 * bit 0 MC aggregation
-	 * bit 1 packet expiry
-	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
-	t_u8 enable_bitmap;
-	/* 1 valid, 0 invalid
-	 * bit 0 MC aggregation
-	 * bit 1 packet expiry
-	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
-	t_u8 mask_bitmap;
-	/** CTS2Self duration offset */
-	t_u16 cts2self_offset;
-} mlan_ds_mc_aggr_cfg;
-
-/** mlan_ds_stats */
-typedef struct _mlan_ds_stats {
-	/** action */
-	t_u16 action;
-	/** tlv len */
-	t_u16 tlv_len;
-	/** TLV buffer */
-	t_u8 tlv_buf[1];
-} mlan_ds_stats;
-
-typedef struct _mlan_ds_ch_load {
-	/** action */
-	t_u8 action;
-	t_u16 ch_load_param;
-	t_s16 noise;
-	t_u16 rx_quality;
-	t_u16 duration;
-	t_u16 cca_th;
-} mlan_ds_ch_load;
-
-/** Type definition of mlan_ds_misc_cfg for MLAN_IOCTL_MISC_CFG */
-typedef struct _mlan_ds_misc_cfg {
-	/** Sub-command */
-	t_u32 sub_command;
-	/** Miscellaneous configuration parameter */
-	union {
-		/** Generic IE for MLAN_OID_MISC_GEN_IE */
-		mlan_ds_misc_gen_ie gen_ie;
-		/** Region code for MLAN_OID_MISC_REGION */
-		t_u32 region_code;
-#ifdef SDIO
-		/** SDIO MP-A Ctrl command for MLAN_OID_MISC_SDIO_MPA_CTRL */
-		mlan_ds_misc_sdio_mpa_ctrl mpa_ctrl;
-#endif
-		/** Hostcmd for MLAN_OID_MISC_HOST_CMD */
-		mlan_ds_misc_cmd hostcmd;
-		/** System clock for MLAN_OID_MISC_SYS_CLOCK */
-		mlan_ds_misc_sys_clock sys_clock;
-		/** WWS set/get for MLAN_OID_MISC_WWS */
-		t_u32 wws_cfg;
-		/** Get associate response for MLAN_OID_MISC_ASSOC_RSP */
-		mlan_ds_misc_assoc_rsp assoc_resp;
-		/** Get associate request for MLAN_OID_MISC_ASSOC_REQ */
-		mlan_ds_misc_assoc_req assoc_req;
-		/** Function init/shutdown for MLAN_OID_MISC_INIT_SHUTDOWN */
-		t_u32 func_init_shutdown;
-		/** Custom IE for MLAN_OID_MISC_CUSTOM_IE */
-		mlan_ds_misc_custom_ie cust_ie;
-		t_u16 tdls_idle_time;
-		/** Config dynamic bandwidth*/
-		t_u16 dyn_bw;
-		/** TDLS configuration for MLAN_OID_MISC_TDLS_CONFIG */
-		mlan_ds_misc_tdls_config tdls_config;
-		/** TDLS operation for MLAN_OID_MISC_TDLS_OPER */
-		mlan_ds_misc_tdls_oper tdls_oper;
-		/** TDLS ies for  MLAN_OID_MISC_GET_TDLS_IES */
-		mlan_ds_misc_tdls_ies tdls_ies;
-		/**tdls cs off channel*/
-		t_u8 tdls_cs_channel;
-		/** Net monitor for MLAN_OID_MISC_NET_MONITOR */
-		mlan_ds_misc_net_monitor net_mon;
-		/** Tx data pause for MLAN_OID_MISC_TX_DATAPAUSE */
-		mlan_ds_misc_tx_datapause tx_datapause;
-		/** IP address configuration */
-		mlan_ds_misc_ipaddr_cfg ipaddr_cfg;
-		/** IPv6 Router Advertisement offload configuration */
-		mlan_ds_misc_ipv6_ra_offload ipv6_ra_offload;
-		/** MAC control for MLAN_OID_MISC_MAC_CONTROL */
-		t_u32 mac_ctrl;
-		/** MEF configuration for MLAN_OID_MISC_MEF_CFG */
-		mlan_ds_misc_mef_cfg mef_cfg;
-		/** CFP code for MLAN_OID_MISC_CFP_CODE */
-		mlan_ds_misc_cfp_code cfp_code;
-		/** Country code for MLAN_OID_MISC_COUNTRY_CODE */
-		mlan_ds_misc_country_code country_code;
-		/** Thermal reading for MLAN_OID_MISC_THERMAL */
-		t_u32 thermal;
-		/** Mgmt subtype mask for MLAN_OID_MISC_RX_MGMT_IND */
-		t_u32 mgmt_subtype_mask;
-		/** subscribe event for MLAN_OID_MISC_SUBSCRIBE_EVENT */
-		mlan_ds_subscribe_evt subscribe_event;
-#ifdef DEBUG_LEVEL1
-		/** Driver debug bit masks */
-		t_u32 drvdbg;
-#endif
-		/** Hotspot config param set */
-		t_u32 hotspot_cfg;
-#ifdef STA_SUPPORT
-		ExtCap_t ext_cap;
-#endif
-		mlan_ds_misc_otp_user_data otp_user_data;
-		/** fw re-connect cfg param set */
-		mlan_ds_fw_reconnect fw_auto_reconnect;
-#ifdef USB
-		/** USB aggregation parameters for MLAN_OID_MISC_USB_AGGR_CTRL
-		 */
-		mlan_ds_misc_usb_aggr_ctrl usb_aggr_params;
-#endif
-		mlan_ds_misc_aggr_ctrl aggr_params;
-		/** Tx control */
-		t_u32 tx_control;
-#if defined(STA_SUPPORT)
-		mlan_ds_misc_pmfcfg pmfcfg;
-#endif
-		/** Multi-channel config for MLAN_OID_MISC_MULTI_CHAN_CFG */
-		mlan_ds_multi_chan_cfg multi_chan_cfg;
-		/** Multi-channel policy for MLAN_OID_MISC_MULTI_CHAN_POLICY */
-		t_u16 multi_chan_policy;
-		/** channel drcs time slicing config for MLAN_OID_MISC_DRCS_CFG
-		 */
-		mlan_ds_drcs_cfg drcs_cfg[2];
-#ifdef WIFI_DIRECT_SUPPORT
-		mlan_ds_wifi_direct_config p2p_config;
-#endif
-		mlan_ds_gpio_tsf_latch gpio_tsf_latch_config;
-		mlan_ds_tsf_info tsf_info;
-		mlan_ds_coalesce_cfg coalesce_cfg;
-		t_u8 low_pwr_mode;
-		/** MEF-FLT-CONFIG for MLAN_OID_MISC_NV_FLT_CFG */
-		mlan_ds_misc_mef_flt_cfg mef_flt_cfg;
-		mlan_ds_misc_dfs_repeater dfs_repeater;
-		/** FW reload flag */
-		t_u8 fw_reload;
-		mlan_ds_sensor_temp sensor_temp;
-		/** GTK rekey data */
-		mlan_ds_misc_gtk_rekey_data gtk_rekey;
-		mlan_ds_bw_chan_oper bw_chan_oper;
-		mlan_ds_ind_rst_cfg ind_rst_cfg;
-		/** Roam offload */
-		mlan_ds_misc_roam_offload roam_offload;
-		t_u64 misc_tsf;
-		mlan_ds_custom_reg_domain custom_reg_domain;
-		mlan_ds_misc_keep_alive keep_alive;
-		mlan_ds_misc_tx_rx_histogram tx_rx_histogram;
-		mlan_ds_cw_mode_ctrl cwmode;
-		/**  Tx/Rx per-packet control */
-		t_u8 txrx_pkt_ctrl;
-		mlan_ds_misc_robustcoex_params robustcoexparams;
-#if defined(PCIE)
-		mlan_ds_ssu_params ssu_params;
-#endif
-		mlan_ds_csi_params csi_params;
-		/** boot sleep enable or disable */
-		t_u16 boot_sleep;
-		/** Mapping Policy */
-		mlan_ds_misc_mapping_policy dmcs_policy;
-		mlan_ds_misc_dmcs_status dmcs_status;
-		mlan_ds_misc_rx_abort_cfg rx_abort_cfg;
-		mlan_ds_misc_rx_abort_cfg_ext rx_abort_cfg_ext;
-		mlan_ds_misc_tx_ampdu_prot_mode tx_ampdu_prot_mode;
-		mlan_ds_misc_rate_adapt_cfg rate_adapt_cfg;
-		mlan_ds_misc_cck_desense_cfg cck_desense_cfg;
-		mlan_ds_misc_chan_trpc_cfg trpc_cfg;
-		mlan_ds_misc_chnrgpwr_cfg rgchnpwr_cfg;
-
-		mlan_ds_band_steer_cfg band_steer_cfg;
-		mlan_ds_beacon_stuck_param_cfg beacon_stuck_cfg;
-		struct mfg_cmd_generic_cfg mfg_generic_cfg;
-		struct mfg_cmd_tx_cont mfg_tx_cont;
-		struct mfg_cmd_tx_frame2 mfg_tx_frame2;
-		struct mfg_Cmd_HE_TBTx_t mfg_he_power;
-		mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t mfg_tx_trigger_config;
-		mlan_ds_misc_arb_cfg arb_cfg;
-		mlan_ds_misc_cfp_tbl cfp;
-		t_u8 range_ext_mode;
-		mlan_ds_misc_dot11mc_unassoc_ftm_cfg dot11mc_unassoc_ftm_cfg;
-		mlan_ds_misc_tp_state tp_state;
-		mlan_ds_hal_phy_cfg_params hal_phy_cfg_params;
-		mlan_ds_mc_aggr_cfg mc_aggr_cfg;
-		mlan_ds_stats stats;
-#ifdef UAP_SUPPORT
-		t_u8 wacp_mode;
-#endif
-		t_u32 ips_ctrl;
-		mlan_ds_ch_load ch_load;
-	} param;
-} mlan_ds_misc_cfg, *pmlan_ds_misc_cfg;
-
-/** Hotspot status enable */
-#define HOTSPOT_ENABLED MBIT(0)
-/** Hotspot status disable */
-#define HOTSPOT_DISABLED MFALSE
-/** Keep Hotspot2.0 compatible in mwu and wpa_supplicant */
-#define HOTSPOT_BY_SUPPLICANT MBIT(1)
-
-/** Reason codes */
-#define MLAN_REASON_UNSPECIFIED 1
-#define MLAN_REASON_PREV_AUTH_NOT_VALID 2
-#define MLAN_REASON_DEAUTH_LEAVING 3
-#define MLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 4
-#define MLAN_REASON_DISASSOC_AP_BUSY 5
-#define MLAN_REASON_CLASS2_FRAME_FROM_NOAUTH_STA 6
-#define MLAN_REASON_CLASS3_FRAME_FROM_NOASSOC_STA 7
-#define MLAN_REASON_DISASSOC_STA_HAS_LEFT 8
-#define MLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH 9
-#endif /* !_MLAN_IOCTL_H_ */
diff --git a/wlan_sd8987/mlinux/moal_pcie.h b/wlan_sd8987/mlinux/moal_pcie.h
deleted file mode 100755
index dfa1e2e..0000000
--- a/wlan_sd8987/mlinux/moal_pcie.h
+++ /dev/null
@@ -1,157 +0,0 @@
-/** @file moal_pcie.h
- *
- *  @brief This file contains definitions for PCIE interface.
- *  driver.
- *
- *
- * Copyright 2014-2021 NXP
- *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
- *
- */
-
-/********************************************************
-Change log:
-    02/01/2012: initial version
-********************************************************/
-
-#ifndef _MOAL_PCIE_H_
-#define _MOAL_PCIE_H_
-
-#define PCIE_VENDOR_ID_MRVL (0x11ab)
-#define PCIE_VENDOR_ID_V2_MRVL (0x1b4b)
-#define PCIE_VENDOR_ID_NXP (0x1131)
-
-#ifdef PCIE8997
-/** PCIE device ID for 8997 card */
-#define PCIE_DEVICE_ID_88W8997P (0x2b42)
-#endif
-#ifdef PCIE8897
-/** PCIE device ID for 8897 card */
-#define PCIE_DEVICE_ID_88W8897P (0x2b38)
-#endif
-
-#ifdef PCIE9097
-/** PCIE device ID for 9097 card */
-#define PCIE_DEVICE_ID_88W9097 (0x2b56)
-#endif
-
-#ifdef PCIE9098
-/** PCIE device ID for 9098 card FN0 */
-#define PCIE_DEVICE_ID_88W9098P_FN0 (0x2b43)
-/** PCIE device ID for 9098 card FN1 */
-#define PCIE_DEVICE_ID_88W9098P_FN1 (0x2b44)
-#endif
-
-#ifdef PCIENW62X
-/** PCIE device ID for NW62X card FN0 */
-#define PCIE_DEVICE_ID_88WNW62X (0x3000)
-#endif
-
-#include <linux/version.h>
-#include <linux/pci.h>
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
-#include <linux/pcieport_if.h>
-#endif
-#include <linux/interrupt.h>
-
-#include "moal_main.h"
-
-/** Default firmware name */
-#ifdef PCIE8997
-#define PCIE8997_DEFAULT_COMBO_FW_NAME "nxp/pcieusb8997_combo_v4.bin"
-#define PCIEUART8997_DEFAULT_COMBO_FW_NAME "nxp/pcieuart8997_combo_v4.bin"
-#define PCIEUSB8997_DEFAULT_COMBO_FW_NAME "nxp/pcieusb8997_combo_v4.bin"
-#define PCIE8997_DEFAULT_WLAN_FW_NAME "nxp/pcie8997_wlan_v4.bin"
-/** PCIE8997 chip revision ID */
-#define PCIE8997_A0 0x10
-#define PCIE8997_A1 0x11
-#endif /* PCIE8997 */
-
-#ifdef PCIE8897
-#define PCIE8897_DEFAULT_COMBO_FW_NAME "nxp/pcie8897_uapsta.bin"
-#define PCIE8897_DEFAULT_WLAN_FW_NAME "nxp/pcie8897_wlan.bin"
-#endif /* PCIE8897*/
-
-#ifdef PCIE9098
-#define PCIE9098_Z1Z2 0x00
-#define PCIE9098_A0 0x01
-#define PCIE9098_A1 0x02
-#define PCIE9098_A2 0x03
-#define PCIE9098_DEFAULT_COMBO_FW_NAME "nxp/pcieusb9098_combo.bin"
-#define PCIEUART9098_DEFAULT_COMBO_FW_NAME "nxp/pcieuart9098_combo.bin"
-#define PCIEUSB9098_DEFAULT_COMBO_FW_NAME "nxp/pcieusb9098_combo.bin"
-#define PCIEPCIE9098_DEFAULT_COMBO_FW_NAME "nxp/pciepcie9098_combo.bin"
-#define PCIEUART9098_COMBO_V1_FW_NAME "nxp/pcieuart9098_combo_v1.bin"
-#define PCIEUSB9098_COMBO_V1_FW_NAME "nxp/pcieusb9098_combo_v1.bin"
-#define PCIEPCIE9098_COMBO_V1_FW_NAME "nxp/pciepcie9098_combo_v1.bin"
-#define PCIE9098_DEFAULT_WLAN_FW_NAME "nxp/pcie9098_wlan.bin"
-#define PCIE9098_WLAN_V1_FW_NAME "nxp/pcie9098_wlan_v1.bin"
-#endif /* PCIE9098 */
-
-#ifdef PCIE9097
-#define PCIE9097_A0 0x00
-#define PCIE9097_B0 0x01
-#define PCIE9097_B1 0x02
-#define PCIE9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw620_combo.bin"
-#define PCIEUART9097_DEFAULT_COMBO_FW_NAME "nxp/pcieuartiw620_combo.bin"
-#define PCIEUSB9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw620_combo.bin"
-#define PCIEUART9097_COMBO_V1_FW_NAME "nxp/pcieuartiw620_combo_v1.bin"
-#define PCIEUSB9097_COMBO_V1_FW_NAME "nxp/pcieusbiw620_combo_v1.bin"
-#define PCIE9097_DEFAULT_WLAN_FW_NAME "nxp/pcieiw620_wlan.bin"
-#define PCIE9097_WLAN_V1_FW_NAME "nxp/pcieiw620_wlan_v1.bin"
-#endif /* PCIE9097 */
-
-#ifdef PCIENW62X
-#define PCIENW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieusbnw62x_combo.bin"
-#define PCIEUARTNW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieuartnw62x_combo.bin"
-#define PCIEUSBNW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieusbnw62x_combo.bin"
-#define PCIENW62X_DEFAULT_WLAN_FW_NAME "nxp/pcienw62x_wlan.bin"
-#endif /* PCIENW62X */
-
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
-#define PCIE_NUM_MSIX_VECTORS 32
-#else
-#define PCIE_NUM_MSIX_VECTORS 4
-#endif
-
-typedef struct _msix_context {
-	/** pci_dev structure pointer */
-	struct pci_dev *dev;
-	/** message id related to msix vector */
-	t_u16 msg_id;
-} msix_context;
-
-/** Structure: PCIE service card */
-typedef struct _pcie_service_card {
-	/** pci_dev structure pointer */
-	struct pci_dev *dev;
-	/** moal_handle structure pointer */
-	moal_handle *handle;
-	/** I/O memory regions pointer to the bus */
-	void __iomem *pci_mmap;
-	/** I/O memory regions pointer to the bus */
-	void __iomem *pci_mmap1;
-#if defined(PCIE)
-	struct msix_entry msix_entries[PCIE_NUM_MSIX_VECTORS];
-	msix_context msix_contexts[PCIE_NUM_MSIX_VECTORS];
-#endif
-} pcie_service_card, *ppcie_service_card;
-
-/** Register to bus driver function */
-mlan_status woal_pcie_bus_register(void);
-/** Unregister from bus driver function */
-void woal_pcie_bus_unregister(void);
-
-#endif /* _MOAL_PCIE_H_ */
diff --git a/wlan_sd8987/mlinux/moal_sdio.h b/wlan_sd8987/mlinux/moal_sdio.h
deleted file mode 100755
index 139a45e..0000000
--- a/wlan_sd8987/mlinux/moal_sdio.h
+++ /dev/null
@@ -1,202 +0,0 @@
-/** @file moal_sdio.h
- *
- * @brief This file contains definitions for SDIO interface.
- * driver.
- *
- *
- * Copyright 2008-2022 NXP
- *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
- *
- */
-/****************************************************
-Change log:
-****************************************************/
-
-#ifndef _MOAL_SDIO_H
-#define _MOAL_SDIO_H
-
-#include <linux/mmc/sdio.h>
-#include <linux/mmc/sdio_ids.h>
-#include <linux/mmc/sdio_func.h>
-#include <linux/mmc/card.h>
-#include <linux/mmc/host.h>
-
-#include "moal_main.h"
-
-#ifndef BLOCK_MODE
-/** Block mode */
-#define BLOCK_MODE 1
-#endif
-
-#ifndef BYTE_MODE
-/** Byte Mode */
-#define BYTE_MODE 0
-#endif
-
-#ifndef FIXED_ADDRESS
-/** Fixed address mode */
-#define FIXED_ADDRESS 0
-#endif
-
-#if defined(SD8977)
-#define SD8977_V0 0x0
-#define SD8977_V1 0x8
-#define SD8977_V2 0x9
-#define SD8977_V0_FW_NAME "nxp/sdsd8977_combo.bin"
-#define SD8977_V1_FW_NAME "nxp/sdsd8977_combo_v1.bin"
-#define SD8977_V2_FW_NAME "nxp/sdsd8977_combo_v2.bin"
-#define SD8977_WLAN_V2_FW_NAME "nxp/sd8977_wlan_v2.bin"
-#define SD8977_WLAN_V1_FW_NAME "nxp/sd8977_wlan_v1.bin"
-#define SD8977_WLAN_V0_FW_NAME "nxp/sd8977_wlan.bin"
-#endif /* SD8977_MULTI_FW */
-
-#if defined(SD8887)
-/** SD8887 chip revision ID */
-#define SD8887_A0 0x0
-#define SD8887_A2 0x2
-
-#define SD8887_A0_FW_NAME "nxp/sd8887_uapsta.bin"
-#define SD8887_A2_FW_NAME "nxp/sd8887_uapsta_a2.bin"
-#define SD8887_WLAN_A2_FW_NAME "nxp/sd8887_wlan_a2.bin"
-#define SD8887_WLAN_A0_FW_NAME "nxp/sd8887_wlan.bin"
-#endif /* SD8887_MULTI_FW */
-
-#ifdef SD8801
-#define SD8801_DEFAULT_WLAN_FW_NAME "nxp/sd8801_uapsta.bin"
-#endif /* SD8801 */
-
-/** Default firmware name */
-#ifdef SD8887
-#define SD8887_DEFAULT_COMBO_FW_NAME "nxp/sd8887_uapsta_a2.bin"
-#define SD8887_DEFAULT_WLAN_FW_NAME "nxp/sd8887_wlan_a2.bin"
-#endif /* SD8887 */
-
-#ifdef SD8977
-#define SD8977_DEFAULT_COMBO_FW_NAME "nxp/sdsd8977_combo_v2.bin"
-#define SD8977_DEFAULT_WLAN_FW_NAME "nxp/sd8977_wlan_v2.bin"
-#endif /* SD8977 */
-
-#ifdef SD8997
-#define SD8997_DEFAULT_COMBO_FW_NAME "nxp/sdsd8997_combo_v4.bin"
-#define SDUART8997_DEFAULT_COMBO_FW_NAME "nxp/sduart8997_combo_v4.bin"
-#define SDSD8997_DEFAULT_COMBO_FW_NAME "nxp/sdsd8997_combo_v4.bin"
-#define SD8997_DEFAULT_WLAN_FW_NAME "nxp/sd8997_wlan_v4.bin"
-#endif /* SD8997 */
-
-#ifdef SD8987
-#define SD8987_DEFAULT_COMBO_FW_NAME "nxp/sdsd8987_combo.bin"
-#define SDUART8987_DEFAULT_COMBO_FW_NAME "nxp/sduart8987_combo.bin"
-#define SDSD8987_DEFAULT_COMBO_FW_NAME "nxp/sdsd8987_combo.bin"
-#define SD8987_DEFAULT_WLAN_FW_NAME "nxp/sd8987_wlan.bin"
-#endif /* SD8987 */
-
-#ifdef SD8897
-#define SD8897_DEFAULT_COMBO_FW_NAME "nxp/sdsd8897_uapsta.bin"
-#define SD8897_DEFAULT_WLAN_FW_NAME "nxp/sd8897_wlan.bin"
-#endif /* SD8897 */
-
-#ifdef SD8978
-#define SD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw416_combo.bin"
-#define SDUART8978_DEFAULT_COMBO_FW_NAME "nxp/sduartiw416_combo.bin"
-#define SDSD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw416_combo.bin"
-#define SD8978_DEFAULT_WLAN_FW_NAME "nxp/sdiw416_wlan.bin"
-#endif /* SD8978 */
-
-#ifdef SD9098
-#define SD9098_Z1Z2 0x00
-#define SD9098_A0 0x01
-#define SD9098_A1 0x02
-#define SD9098_A2 0x03
-#define SD9098_DEFAULT_COMBO_FW_NAME "nxp/sdsd9098_combo.bin"
-#define SDUART9098_DEFAULT_COMBO_FW_NAME "nxp/sduart9098_combo.bin"
-#define SDSD9098_DEFAULT_COMBO_FW_NAME "nxp/sdsd9098_combo.bin"
-#define SD9098_DEFAULT_WLAN_FW_NAME "nxp/sd9098_wlan.bin"
-#define SDUART9098_COMBO_V1_FW_NAME "nxp/sduart9098_combo_v1.bin"
-#define SDSD9098_COMBO_V1_FW_NAME "nxp/sdsd9098_combo_v1.bin"
-#define SD9098_WLAN_V1_FW_NAME "nxp/sd9098_wlan_v1.bin"
-#endif /* SD9098 */
-
-#ifdef SD9097
-#define SD9097_B0 0x01
-#define SD9097_B1 0x02
-#define SD9097_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw620_combo_v1.bin"
-
-#define SD9097_DEFAULT_WLAN_FW_NAME "nxp/sdiw620_wlan_v1.bin"
-#define SDUART9097_COMBO_V1_FW_NAME "nxp/sduartiw620_combo_v1.bin"
-#define SDSD9097_COMBO_V1_FW_NAME "nxp/sdsdiw620_combo_v1.bin"
-#define SD9097_WLAN_V1_FW_NAME "nxp/sdiw620_wlan_v1.bin"
-#endif /* SD9097 */
-
-#ifdef SDNW62X
-#define SDNW62X_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw62x.bin"
-#define SDUARTNW62X_COMBO_FW_NAME "nxp/sduart_nw62x.bin"
-#define SDSDNW62X_COMBO_FW_NAME "sdsd_nw62x.bin"
-#define SDNW62X_DEFAULT_WLAN_FW_NAME "nxp/sd_nw62x.bin"
-#endif /* SDNW62X */
-
-#ifdef SD9177
-#define SD9177_A0 0x00
-#define SD9177_A1 0x01
-#define SD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin"
-#define SD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin"
-#define SDUART9177_DEFAULT_COMBO_FW_NAME "nxp/sduart_nw61x.bin"
-#define SDSD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin"
-#define SD9177_DEFAULT_WLAN_FW_NAME "nxp/sd_w61x.bin"
-#define SDUART9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin"
-#define SDSD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_v1.bin"
-#define SD9177_DEFAULT_WLAN_V1_FW_NAME "nxp/sd_w61x_v1.bin"
-#define SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME "nxp/sduart_nw61x_rftm_v1.bin"
-#define SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_rftm_v1.bin"
-#define SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME "nxp/sd_w61x_rftm_v1.bin"
-#endif /* SD9177 */
-
-/********************************************************
-		Global Functions
-********************************************************/
-
-/** Register to bus driver function */
-mlan_status woal_sdiommc_bus_register(void);
-/** Unregister from bus driver function */
-void woal_sdiommc_bus_unregister(void);
-
-int woal_sdio_set_bus_clock(moal_handle *handle, t_u8 option);
-
-#ifdef SDIO_SUSPEND_RESUME
-#ifdef MMC_PM_FUNC_SUSPENDED
-/** Notify SDIO bus driver that WLAN is suspended */
-void woal_wlan_is_suspended(moal_handle *handle);
-#endif
-/** SDIO Suspend */
-int woal_sdio_suspend(struct device *dev);
-/** SDIO Resume */
-int woal_sdio_resume(struct device *dev);
-#endif /* SDIO_SUSPEND_RESUME */
-
-#ifdef SDIO_MMC
-/** Structure: SDIO MMC card */
-struct sdio_mmc_card {
-	/** sdio_func structure pointer */
-	struct sdio_func *func;
-	/** moal_handle structure pointer */
-	moal_handle *handle;
-	/** saved host clock value */
-	unsigned int host_clock;
-};
-void woal_sdio_reset_hw(moal_handle *handle);
-#endif /* SDIO_MMC */
-
-/** cmd52 read write */
-int woal_sdio_read_write_cmd52(moal_handle *handle, int func, int reg, int val);
-#endif /* _MOAL_SDIO_H */
diff --git a/wlan_sd8987/mlinux/moal_sdio_mmc.c b/wlan_sd8987/mlinux/moal_sdio_mmc.c
deleted file mode 100755
index 0e9cd4a..0000000
--- a/wlan_sd8987/mlinux/moal_sdio_mmc.c
+++ /dev/null
@@ -1,2544 +0,0 @@
-/** @file moal_sdio_mmc.c
- *
- *  @brief This file contains SDIO MMC IF (interface) module
- *  related functions.
- *
- *
- * Copyright 2008-2022 NXP
- *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
- *
- */
-/****************************************************
-Change log:
-	02/25/09: Initial creation -
-		  This file supports SDIO MMC only
-****************************************************/
-
-#include <linux/firmware.h>
-
-#include "moal_sdio.h"
-
-/** define nxp vendor id */
-#define NXP_VENDOR_ID 0x0471
-#define MRVL_VENDOR_ID 0x02df
-
-/********************************************************
-		Local Variables
-********************************************************/
-/* moal interface ops */
-static moal_if_ops sdiommc_ops;
-/********************************************************
-		Global Variables
-********************************************************/
-
-#ifdef SD8887
-/** Device ID for SD8887 */
-#define SD_DEVICE_ID_8887 (0x9135)
-#endif
-#ifdef SD8801
-/** Device ID for SD8801 FN1 */
-#define SD_DEVICE_ID_8801 (0x9139)
-#endif
-#ifdef SD8897
-/** Device ID for SD8897 */
-#define SD_DEVICE_ID_8897 (0x912d)
-#endif
-#ifdef SD8977
-/** Device ID for SD8977 */
-#define SD_DEVICE_ID_8977 (0x9145)
-#endif
-#ifdef SD8978
-/** Device ID for SD8978 */
-#define SD_DEVICE_ID_8978 (0x9159)
-#endif
-#ifdef SD8997
-/** Device ID for SD8997 */
-#define SD_DEVICE_ID_8997 (0x9141)
-#endif
-#ifdef SD8987
-/** Device ID for SD8987 */
-#define SD_DEVICE_ID_8987 (0x9149)
-#endif
-#ifdef SD9098
-/** Device ID for SD9098 */
-#define SD_DEVICE_ID_9098_FN1 (0x914D)
-/** Device ID for SD9098 */
-#define SD_DEVICE_ID_9098_FN2 (0x914E)
-#endif
-#ifdef SD9097
-/** Device ID for SD9097 */
-#define SD_DEVICE_ID_9097 (0x9155)
-#endif
-#ifdef SD9177
-/** Device ID for SD9177 */
-#define SD_DEVICE_ID_9177 (0x0205)
-#endif
-#ifdef SDNW62X
-/** Device ID for SDNW62X */
-#define SD_DEVICE_ID_NW62X (0x020D)
-#endif
-
-/** WLAN IDs */
-static const struct sdio_device_id wlan_ids[] = {
-#ifdef SD8887
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8887)},
-#endif
-#ifdef SD8801
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8801)},
-#endif
-#ifdef SD8897
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8897)},
-#endif
-#ifdef SD8977
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8977)},
-#endif
-#ifdef SD8978
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8978)},
-#endif
-#ifdef SD8997
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8997)},
-#endif
-#ifdef SD8987
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8987)},
-#endif
-#ifdef SD9098
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN1)},
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN2)},
-#endif
-#ifdef SD9097
-	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9097)},
-#endif
-#ifdef SD9177
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_9177)},
-#endif
-#ifdef SDNW62X
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_NW62X)},
-#endif
-	{},
-};
-
-MODULE_DEVICE_TABLE(sdio, wlan_ids);
-
-int woal_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id);
-void woal_sdio_remove(struct sdio_func *func);
-#ifdef SDIO
-static void woal_sdiommc_reg_dbg(pmoal_handle handle);
-#endif
-
-#ifdef SDIO_SUSPEND_RESUME
-#ifdef MMC_PM_KEEP_POWER
-int woal_sdio_suspend(struct device *dev);
-int woal_sdio_resume(struct device *dev);
-
-static struct dev_pm_ops wlan_sdio_pm_ops = {
-	.suspend = woal_sdio_suspend,
-	.resume = woal_sdio_resume,
-};
-
-void woal_sdio_shutdown(struct device *dev);
-#endif
-#endif
-
-// clang-format off
-static struct sdio_driver REFDATA wlan_sdio = {
-	.name = "wlan_sdio",
-	.id_table = wlan_ids,
-	.probe = woal_sdio_probe,
-	.remove = woal_sdio_remove,
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
-	.drv = {
-		.owner = THIS_MODULE,
-#ifdef SDIO_SUSPEND_RESUME
-#ifdef MMC_PM_KEEP_POWER
-		.pm = &wlan_sdio_pm_ops,
-		.shutdown = woal_sdio_shutdown,
-#endif
-#endif
-
-	}
-#else
-#ifdef SDIO_SUSPEND_RESUME
-#ifdef MMC_PM_KEEP_POWER
-	.drv = {
-		.pm = &wlan_sdio_pm_ops,
-		.shutdown = woal_sdio_shutdown,
-	}
-#endif
-#endif
-#endif
-};
-// clang-format on
-
-/********************************************************
-		Local Functions
-********************************************************/
-static void woal_sdiommc_dump_fw_info(moal_handle *phandle);
-#if 0
-/**  @brief This function dump the sdio register
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @return         N/A
- */
-static void woal_dump_sdio_reg(moal_handle *handle)
-{
-	int ret = 0;
-	t_u8 data, i;
-	int fun0_reg[] = {0x05, 0x04};
-	t_u8 array_size = 0;
-#ifdef SD8897
-	int fun1_reg_8897[] = {0x03, 0x04, 0x05, 0x06, 0x07, 0xC0, 0xC1};
-#endif
-	int fun1_reg_other[] = {0x03, 0x04, 0x05, 0x60, 0x61};
-	int *fun1_reg = NULL;
-
-	for (i = 0; i < ARRAY_SIZE(fun0_reg); i++) {
-		data = sdio_f0_readb(
-			((struct sdio_mmc_card *)handle->card)->func,
-			fun0_reg[i], &ret);
-		PRINTM(MMSG, "fun0: reg 0x%02x=0x%02x ret=%d\n", fun0_reg[i],
-		       data, ret);
-	}
-
-#ifdef SD8897
-	if (IS_SD8897(handle->card_type)) {
-		fun1_reg = fun1_reg_8897;
-		array_size = sizeof(fun1_reg_8897) / sizeof(int);
-	} else {
-#endif
-		fun1_reg = fun1_reg_other;
-		array_size = sizeof(fun1_reg_other) / sizeof(int);
-#ifdef SD8897
-	}
-#endif
-	for (i = 0; i < array_size; i++) {
-		data = sdio_readb(((struct sdio_mmc_card *)handle->card)->func,
-				  fun1_reg[i], &ret);
-		PRINTM(MMSG, "fun1: reg 0x%02x=0x%02x ret=%d\n", fun1_reg[i],
-		       data, ret);
-	}
-	return;
-}
-#endif
-/********************************************************
-		Global Functions
-********************************************************/
-/**
- *  @brief This function handles the interrupt.
- *
- *  @param func     A pointer to the sdio_func structure
- *  @return         N/A
- */
-static void woal_sdio_interrupt(struct sdio_func *func)
-{
-	moal_handle *handle;
-	struct sdio_mmc_card *card;
-
-	ENTER();
-
-	card = sdio_get_drvdata(func);
-	if (!card || !card->handle) {
-		PRINTM(MINFO,
-		       "sdio_mmc_interrupt(func = %p) card or handle is NULL, card=%p\n",
-		       func, card);
-		LEAVE();
-		return;
-	}
-	handle = card->handle;
-	if (handle->surprise_removed == MTRUE) {
-		LEAVE();
-		return;
-	}
-	handle->main_state = MOAL_RECV_INT;
-	PRINTM(MINFO, "*** IN SDIO IRQ ***\n");
-	PRINTM(MINTR, "*\n");
-
-	/* call mlan_interrupt to read int status */
-	mlan_interrupt(0, handle->pmlan_adapter);
-#ifdef SDIO_SUSPEND_RESUME
-	if (handle->is_suspended) {
-		PRINTM(MINTR, "Receive interrupt in hs_suspended\n");
-		LEAVE();
-		return;
-	}
-#endif
-	handle->main_state = MOAL_START_MAIN_PROCESS;
-	/* Call MLAN main process */
-	mlan_main_process(handle->pmlan_adapter);
-	handle->main_state = MOAL_END_MAIN_PROCESS;
-	LEAVE();
-}
-
-/**  @brief This function updates the card types
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param card     A Pointer to card
- *
- *  @return         N/A
- */
-static t_u16 woal_update_card_type(t_void *card)
-{
-	struct sdio_mmc_card *cardp_sd = (struct sdio_mmc_card *)card;
-	t_u16 card_type = 0;
-
-	/* Update card type */
-#ifdef SD8887
-	if (cardp_sd->func->device == SD_DEVICE_ID_8887) {
-		card_type = CARD_TYPE_SD8887;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD8887,
-				strlen(CARD_SD8887), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V15, strlen(V15),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD8801
-	if (cardp_sd->func->device == SD_DEVICE_ID_8801) {
-		card_type = CARD_TYPE_SD8801;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD8801,
-				strlen(CARD_SD8801), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V14, strlen(V14),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-
-#ifdef SD8897
-	if (cardp_sd->func->device == SD_DEVICE_ID_8897) {
-		card_type = CARD_TYPE_SD8897;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD8897,
-				strlen(CARD_SD8897), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V15, strlen(V15),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD8977
-	if (cardp_sd->func->device == SD_DEVICE_ID_8977) {
-		card_type = CARD_TYPE_SD8977;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD8977,
-				strlen(CARD_SD8977), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V16, strlen(V16),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD8978
-	if (cardp_sd->func->device == SD_DEVICE_ID_8978) {
-		card_type = CARD_TYPE_SD8978;
-		moal_memcpy_ext(NULL, driver_version, "SDIW416",
-				strlen("SDIW416"), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V16, strlen(V16),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD8997
-	if (cardp_sd->func->device == SD_DEVICE_ID_8997) {
-		card_type = CARD_TYPE_SD8997;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD8997,
-				strlen(CARD_SD8997), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V16, strlen(V16),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD8987
-	if (cardp_sd->func->device == SD_DEVICE_ID_8987) {
-		card_type = CARD_TYPE_SD8987;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD8987,
-				strlen(CARD_SD8987), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V16, strlen(V16),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SDNW62X
-	if (cardp_sd->func->device == SD_DEVICE_ID_NW62X) {
-		card_type = CARD_TYPE_SDNW62X;
-		moal_memcpy_ext(NULL, driver_version, CARD_SDNW62X,
-				strlen(CARD_SDNW62X), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V17, strlen(V17),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD9097
-	if (cardp_sd->func->device == SD_DEVICE_ID_9097) {
-		card_type = CARD_TYPE_SD9097;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD9097,
-				strlen(CARD_SD9097), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V17, strlen(V17),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD9098
-	if (cardp_sd->func->device == SD_DEVICE_ID_9098_FN1 ||
-	    cardp_sd->func->device == SD_DEVICE_ID_9098_FN2) {
-		card_type = CARD_TYPE_SD9098;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD9098,
-				strlen(CARD_SD9098), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V17, strlen(V17),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-#ifdef SD9177
-	if (cardp_sd->func->device == SD_DEVICE_ID_9177) {
-		card_type = CARD_TYPE_SD9177;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD9177,
-				strlen(CARD_SD9177), strlen(driver_version));
-		moal_memcpy_ext(
-			NULL,
-			driver_version + strlen(INTF_CARDTYPE) +
-				strlen(KERN_VERSION),
-			V18, strlen(V18),
-			strlen(driver_version) -
-				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
-	}
-#endif
-	return card_type;
-}
-
-/**  @brief This function handles client driver probe.
- *
- *  @param func     A pointer to sdio_func structure.
- *  @param id       A pointer to sdio_device_id structure.
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE/error code
- */
-int woal_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
-{
-	int ret = MLAN_STATUS_SUCCESS;
-	struct sdio_mmc_card *card = NULL;
-	t_u16 card_type = 0;
-
-	ENTER();
-
-	PRINTM(MMSG, "vendor=0x%4.04X device=0x%4.04X class=%d function=%d\n",
-	       func->vendor, func->device, func->class, func->num);
-
-	card = kzalloc(sizeof(struct sdio_mmc_card), GFP_KERNEL);
-	if (!card) {
-		PRINTM(MFATAL,
-		       "Failed to allocate memory in probe function!\n");
-		LEAVE();
-		return -ENOMEM;
-	}
-
-	card->func = func;
-
-#ifdef MMC_QUIRK_BLKSZ_FOR_BYTE_MODE
-	/* The byte mode patch is available in kernel MMC driver
-	 * which fixes one issue in MP-A transfer.
-	 * bit1: use func->cur_blksize for byte mode
-	 */
-	func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
-#endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
-	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
-#endif
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-	/* wait for chip fully wake up */
-	if (!func->enable_timeout)
-		func->enable_timeout = 200;
-#endif
-	sdio_claim_host(func);
-	ret = sdio_enable_func(func);
-	if (ret) {
-		sdio_release_host(func);
-		PRINTM(MFATAL, "sdio_enable_func() failed: ret=%d\n", ret);
-		ret = -EIO;
-		goto err;
-	}
-	sdio_release_host(func);
-
-	card_type = woal_update_card_type(card);
-	if (!card_type) {
-		PRINTM(MERROR, "sdmmc probe: woal_update_card_type() failed\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto err;
-	}
-
-	if (NULL ==
-	    woal_add_card(card, &card->func->dev, &sdiommc_ops, card_type)) {
-		PRINTM(MMSG, "woal_add_card failed\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto err;
-	}
-
-#ifdef IMX_SUPPORT
-	woal_regist_oob_wakeup_irq(card->handle);
-#endif /* IMX_SUPPORT */
-
-	LEAVE();
-	return ret;
-err:
-	kfree(card);
-	sdio_claim_host(func);
-	sdio_disable_func(func);
-	sdio_release_host(func);
-
-	LEAVE();
-	return ret;
-}
-
-/**  @brief This function handles client driver remove.
- *
- *  @param func     A pointer to sdio_func structure.
- *  @return         N/A
- */
-void woal_sdio_remove(struct sdio_func *func)
-{
-	struct sdio_mmc_card *card;
-
-	ENTER();
-
-	if (func) {
-		PRINTM(MINFO, "SDIO func=%d\n", func->num);
-		card = sdio_get_drvdata(func);
-		if (card) {
-#ifdef IMX_SUPPORT
-			woal_unregist_oob_wakeup_irq(card->handle);
-#endif /* IMX_SUPPORT */
-			woal_remove_card(card);
-			kfree(card);
-		}
-	}
-
-	LEAVE();
-}
-
-#ifdef SDIO_SUSPEND_RESUME
-#ifdef MMC_PM_KEEP_POWER
-#ifdef MMC_PM_FUNC_SUSPENDED
-/**  @brief This function tells lower driver that WLAN is suspended
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @return         N/A
- */
-void woal_wlan_is_suspended(moal_handle *handle)
-{
-	ENTER();
-	if (handle->suspend_notify_req == MTRUE) {
-		handle->is_suspended = MTRUE;
-		sdio_func_suspended(
-			((struct sdio_mmc_card *)handle->card)->func);
-	}
-	LEAVE();
-}
-#endif
-
-/**  @brief This function handles client driver shutdown
- *
- *  @param dev      A pointer to device structure
- *  @return         N/A
- */
-void woal_sdio_shutdown(struct device *dev)
-{
-	struct sdio_func *func = dev_to_sdio_func(dev);
-	moal_handle *handle = NULL;
-	struct sdio_mmc_card *cardp;
-	mlan_ds_ps_info pm_info;
-	int i, retry_num = 8;
-
-	ENTER();
-	PRINTM(MCMND, "<--- Enter woal_sdio_shutdown --->\n");
-	cardp = sdio_get_drvdata(func);
-	if (!cardp || !cardp->handle) {
-		PRINTM(MERROR, "Card or moal_handle structure is not valid\n");
-		LEAVE();
-		return;
-	}
-	handle = cardp->handle;
-	for (i = 0; i < handle->priv_num; i++)
-		netif_device_detach(handle->priv[i]->netdev);
-
-	if (moal_extflg_isset(handle, EXT_SHUTDOWN_HS)) {
-		handle->shutdown_hs_in_process = MTRUE;
-		memset(&pm_info, 0, sizeof(pm_info));
-		for (i = 0; i < retry_num; i++) {
-			if (MLAN_STATUS_SUCCESS ==
-			    woal_get_pm_info(woal_get_priv(handle,
-							   MLAN_BSS_ROLE_ANY),
-					     &pm_info)) {
-				if (pm_info.is_suspend_allowed == MTRUE)
-					break;
-				else
-					PRINTM(MMSG,
-					       "Shutdown not allowed and retry again\n");
-			}
-			woal_sched_timeout(100);
-		}
-		if (pm_info.is_suspend_allowed == MFALSE) {
-			PRINTM(MMSG, "Shutdown not allowed\n");
-			goto done;
-		}
-		woal_enable_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
-
-		wait_event_interruptible_timeout(
-			handle->hs_activate_wait_q,
-			handle->hs_activate_wait_q_woken, HS_ACTIVE_TIMEOUT);
-		if (handle->hs_activated == MTRUE)
-			PRINTM(MMSG, "HS actived in shutdown\n");
-		else
-			PRINTM(MMSG, "Fail to enable HS in shutdown\n");
-	} else {
-		for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
-			if (handle->priv[i]) {
-				if (handle->priv[i]->media_connected == MTRUE
-#ifdef UAP_SUPPORT
-				    || (GET_BSS_ROLE(handle->priv[i]) ==
-					MLAN_BSS_ROLE_UAP)
-#endif
-				) {
-					PRINTM(MIOCTL,
-					       "disconnect on suspend\n");
-					woal_disconnect(handle->priv[i],
-							MOAL_NO_WAIT, NULL,
-							DEF_DEAUTH_REASON_CODE);
-				}
-			}
-		}
-	}
-
-done:
-	PRINTM(MCMND, "<--- Leave woal_sdio_shutdown --->\n");
-	LEAVE();
-	return;
-}
-
-/**  @brief This function handles client driver suspend
- *
- *  @param dev      A pointer to device structure
- *  @return         MLAN_STATUS_SUCCESS or error code
- */
-int woal_sdio_suspend(struct device *dev)
-{
-	struct sdio_func *func = dev_to_sdio_func(dev);
-	mmc_pm_flag_t pm_flags = 0;
-	moal_handle *handle = NULL;
-	struct sdio_mmc_card *cardp;
-	int i, retry_num = 8;
-	int ret = MLAN_STATUS_SUCCESS;
-	int hs_actived = 0;
-	mlan_ds_ps_info pm_info;
-
-	ENTER();
-	PRINTM(MCMND, "<--- Enter woal_sdio_suspend --->\n");
-	pm_flags = sdio_get_host_pm_caps(func);
-	PRINTM(MCMND, "%s: suspend: PM flags = 0x%x\n", sdio_func_id(func),
-	       pm_flags);
-	cardp = sdio_get_drvdata(func);
-	if (!cardp || !cardp->handle) {
-		PRINTM(MERROR, "Card or moal_handle structure is not valid\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-
-	handle = cardp->handle;
-
-	if (moal_extflg_isset(handle, EXT_PM_KEEP_POWER) &&
-	    !(pm_flags & MMC_PM_KEEP_POWER)) {
-		PRINTM(MERROR,
-		       "%s: cannot remain alive while host is suspended\n",
-		       sdio_func_id(func));
-		LEAVE();
-		return -ENOSYS;
-	}
-	if (handle->is_suspended == MTRUE) {
-		PRINTM(MWARN, "Device already suspended\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-	if (handle->fw_dump) {
-		PRINTM(MMSG, "suspend not allowed while FW dump!");
-		ret = -EBUSY;
-		goto done;
-	}
-#ifdef STA_SUPPORT
-	for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
-		if (handle->priv[i] &&
-		    (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA))
-			woal_cancel_scan(handle->priv[i], MOAL_IOCTL_WAIT);
-	}
-#endif
-	handle->suspend_fail = MFALSE;
-	memset(&pm_info, 0, sizeof(pm_info));
-	for (i = 0; i < retry_num; i++) {
-		if (MLAN_STATUS_SUCCESS ==
-		    woal_get_pm_info(woal_get_priv(handle, MLAN_BSS_ROLE_ANY),
-				     &pm_info)) {
-			if (pm_info.is_suspend_allowed == MTRUE)
-				break;
-			else
-				PRINTM(MMSG,
-				       "Suspend not allowed and retry again\n");
-		}
-		woal_sched_timeout(100);
-	}
-	if (pm_info.is_suspend_allowed == MFALSE) {
-		PRINTM(MMSG, "Suspend not allowed\n");
-		ret = -EBUSY;
-		goto done;
-	}
-
-	for (i = 0; i < handle->priv_num; i++)
-		netif_device_detach(handle->priv[i]->netdev);
-
-	if (moal_extflg_isset(handle, EXT_PM_KEEP_POWER)) {
-		/* Enable the Host Sleep */
-#ifdef MMC_PM_FUNC_SUSPENDED
-		handle->suspend_notify_req = MTRUE;
-#endif
-		hs_actived = woal_enable_hs(
-			woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
-#ifdef MMC_PM_FUNC_SUSPENDED
-		handle->suspend_notify_req = MFALSE;
-#endif
-		if (hs_actived) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 3, 4)
-			if (pm_flags & MMC_PM_WAKE_SDIO_IRQ) {
-				ret = sdio_set_host_pm_flags(
-					func, MMC_PM_WAKE_SDIO_IRQ);
-				PRINTM(MCMND,
-				       "suspend with MMC_PM_WAKE_SDIO_IRQ ret=%d\n",
-				       ret);
-			}
-#endif
-#ifdef MMC_PM_SKIP_RESUME_PROBE
-			PRINTM(MCMND,
-			       "suspend with MMC_PM_KEEP_POWER and MMC_PM_SKIP_RESUME_PROBE\n");
-			ret = sdio_set_host_pm_flags(
-				func,
-				MMC_PM_KEEP_POWER | MMC_PM_SKIP_RESUME_PROBE);
-#else
-			PRINTM(MCMND, "suspend with MMC_PM_KEEP_POWER\n");
-			ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
-#endif
-		} else {
-			PRINTM(MMSG, "HS not actived, suspend fail!");
-			handle->suspend_fail = MTRUE;
-			for (i = 0; i < handle->priv_num; i++)
-				netif_device_attach(handle->priv[i]->netdev);
-			ret = -EBUSY;
-			goto done;
-		}
-	}
-
-	/* Indicate device suspended */
-	handle->is_suspended = MTRUE;
-#ifdef IMX_SUPPORT
-	woal_enable_oob_wakeup_irq(handle);
-#endif /* IMX_SUPPORT */
-done:
-	PRINTM(MCMND, "<--- Leave woal_sdio_suspend --->\n");
-	LEAVE();
-	return ret;
-}
-
-/**  @brief This function handles client driver resume
- *
- *  @param dev      A pointer to device structure
- *  @return         MLAN_STATUS_SUCCESS
- */
-int woal_sdio_resume(struct device *dev)
-{
-	struct sdio_func *func = dev_to_sdio_func(dev);
-	mmc_pm_flag_t pm_flags = 0;
-	moal_handle *handle = NULL;
-	struct sdio_mmc_card *cardp;
-	int i;
-
-	ENTER();
-	PRINTM(MCMND, "<--- Enter woal_sdio_resume --->\n");
-	pm_flags = sdio_get_host_pm_caps(func);
-	PRINTM(MCMND, "%s: resume: PM flags = 0x%x\n", sdio_func_id(func),
-	       pm_flags);
-	cardp = sdio_get_drvdata(func);
-	if (!cardp || !cardp->handle) {
-		PRINTM(MERROR, "Card or moal_handle structure is not valid\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-	handle = cardp->handle;
-
-	if (handle->is_suspended == MFALSE) {
-		PRINTM(MWARN, "Device already resumed\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-	handle->is_suspended = MFALSE;
-	if (woal_check_driver_status(handle)) {
-		PRINTM(MERROR, "Resuem, device is in hang state\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-	for (i = 0; i < handle->priv_num; i++)
-		netif_device_attach(handle->priv[i]->netdev);
-
-	/* Disable Host Sleep */
-	woal_cancel_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY), MOAL_NO_WAIT);
-#ifdef IMX_SUPPORT
-	woal_disable_oob_wakeup_irq(handle);
-#endif /* IMX_SUPPORT */
-	PRINTM(MCMND, "<--- Leave woal_sdio_resume --->\n");
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-#endif
-#endif /* SDIO_SUSPEND_RESUME */
-
-/**
- *  @brief This function writes data into card register
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param reg      Register offset
- *  @param data     Value
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdiommc_write_reg(moal_handle *handle, t_u32 reg,
-					  t_u32 data)
-{
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	sdio_writeb(((struct sdio_mmc_card *)handle->card)->func, (t_u8)data,
-		    reg, (int *)&ret);
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-	return ret;
-}
-
-/**
- *  @brief This function reads data from card register
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param reg      Register offset
- *  @param data     Value
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdiommc_read_reg(moal_handle *handle, t_u32 reg,
-					 t_u32 *data)
-{
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	t_u8 val;
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	val = sdio_readb(((struct sdio_mmc_card *)handle->card)->func, reg,
-			 (int *)&ret);
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-	*data = val;
-
-	return ret;
-}
-
-/**
- *  @brief This function writes data into card register
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param reg      Register offset
- *  @param data     Value
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdio_writeb(moal_handle *handle, t_u32 reg, t_u8 data)
-{
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	sdio_writeb(((struct sdio_mmc_card *)handle->card)->func, (t_u8)data,
-		    reg, (int *)&ret);
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-	return ret;
-}
-
-/**
- *  @brief This function reads data from card register
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param reg      Register offset
- *  @param data     Value
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdio_readb(moal_handle *handle, t_u32 reg, t_u8 *data)
-{
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	t_u8 val;
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	val = sdio_readb(((struct sdio_mmc_card *)handle->card)->func, reg,
-			 (int *)&ret);
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-	*data = val;
-
-	return ret;
-}
-
-/**
- *  @brief This function reads data from card register FN0
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param reg      Register offset
- *  @param data     Value
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdio_f0_readb(moal_handle *handle, t_u32 reg,
-				      t_u8 *data)
-{
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	t_u8 val;
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	val = sdio_f0_readb(((struct sdio_mmc_card *)handle->card)->func, reg,
-			    (int *)&ret);
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-	*data = val;
-
-	return ret;
-}
-
-/**
- *  @brief This function use SG mode to read/write data into card memory
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param pmbuf_list   Pointer to a linked list of mlan_buffer structure
- *  @param port     Port
- *  @param write    write flag
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdio_rw_mb(moal_handle *handle, pmlan_buffer pmbuf_list,
-				   t_u32 port, t_u8 write)
-{
-	struct scatterlist sg_list[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX];
-	int num_sg = pmbuf_list->use_count;
-	int i = 0;
-	mlan_buffer *pmbuf = NULL;
-	struct mmc_request mmc_req;
-	struct mmc_command mmc_cmd;
-	struct mmc_data mmc_dat;
-	struct sdio_func *func = ((struct sdio_mmc_card *)handle->card)->func;
-	t_u32 ioport = (port & MLAN_SDIO_IO_PORT_MASK);
-	t_u32 blkcnt = pmbuf_list->data_len / MLAN_SDIO_BLOCK_SIZE;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
-	int status;
-#endif
-
-	if (num_sg > SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX) {
-		PRINTM(MERROR, "ERROR: num_sg=%d", num_sg);
-		return MLAN_STATUS_FAILURE;
-	}
-	sg_init_table(sg_list, num_sg);
-	pmbuf = pmbuf_list->pnext;
-	for (i = 0; i < num_sg; i++) {
-		if (pmbuf == pmbuf_list)
-			break;
-		sg_set_buf(&sg_list[i], pmbuf->pbuf + pmbuf->data_offset,
-			   pmbuf->data_len);
-		pmbuf = pmbuf->pnext;
-	}
-	memset(&mmc_req, 0, sizeof(struct mmc_request));
-	memset(&mmc_cmd, 0, sizeof(struct mmc_command));
-	memset(&mmc_dat, 0, sizeof(struct mmc_data));
-
-	mmc_dat.sg = sg_list;
-	mmc_dat.sg_len = num_sg;
-	mmc_dat.blksz = MLAN_SDIO_BLOCK_SIZE;
-	mmc_dat.blocks = blkcnt;
-	mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
-
-	mmc_cmd.opcode = SD_IO_RW_EXTENDED;
-	mmc_cmd.arg = write ? 1 << 31 : 0;
-	mmc_cmd.arg |= (func->num & 0x7) << 28;
-	mmc_cmd.arg |= 1 << 27; /* block basic */
-	mmc_cmd.arg |= 0; /* fix address */
-	mmc_cmd.arg |= (ioport & 0x1FFFF) << 9;
-	mmc_cmd.arg |= blkcnt & 0x1FF;
-	mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
-
-	mmc_req.cmd = &mmc_cmd;
-	mmc_req.data = &mmc_dat;
-
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	mmc_set_data_timeout(
-		&mmc_dat, ((struct sdio_mmc_card *)handle->card)->func->card);
-	mmc_wait_for_req(
-		((struct sdio_mmc_card *)handle->card)->func->card->host,
-		&mmc_req);
-
-	if (mmc_cmd.error || mmc_dat.error) {
-		PRINTM(MERROR, "CMD53 %s cmd_error = %d data_error=%d\n",
-		       write ? "write" : "read", mmc_cmd.error, mmc_dat.error);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
-		/* issue abort cmd52 command through F0*/
-		sdio_f0_writeb(((struct sdio_mmc_card *)handle->card)->func,
-			       0x01, SDIO_CCCR_ABORT, &status);
-#endif
-		sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-		return MLAN_STATUS_FAILURE;
-	}
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-	return MLAN_STATUS_SUCCESS;
-}
-
-/**
- *  @brief This function writes multiple bytes into card memory
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param pmbuf    Pointer to mlan_buffer structure
- *  @param port     Port
- *  @param timeout  Time out value
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdiommc_write_data_sync(moal_handle *handle,
-						mlan_buffer *pmbuf, t_u32 port,
-						t_u32 timeout)
-{
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	t_u8 *buffer = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
-	t_u8 blkmode =
-		(port & MLAN_SDIO_BYTE_MODE_MASK) ? BYTE_MODE : BLOCK_MODE;
-	t_u32 blksz = (blkmode == BLOCK_MODE) ? MLAN_SDIO_BLOCK_SIZE : 1;
-	t_u32 blkcnt = (blkmode == BLOCK_MODE) ?
-			       (pmbuf->data_len / MLAN_SDIO_BLOCK_SIZE) :
-			       pmbuf->data_len;
-	t_u32 ioport = (port & MLAN_SDIO_IO_PORT_MASK);
-	int status = 0;
-	if (pmbuf->use_count > 1)
-		return woal_sdio_rw_mb(handle, pmbuf, port, MTRUE);
-#ifdef SDIO_MMC_DEBUG
-	handle->cmd53w = 1;
-#endif
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	status = sdio_writesb(((struct sdio_mmc_card *)handle->card)->func,
-			      ioport, buffer, blkcnt * blksz);
-	if (!status)
-		ret = MLAN_STATUS_SUCCESS;
-	else {
-		PRINTM(MERROR, "cmd53 write error=%d\n", status);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
-		/* issue abort cmd52 command through F0*/
-		sdio_f0_writeb(((struct sdio_mmc_card *)handle->card)->func,
-			       0x01, SDIO_CCCR_ABORT, &status);
-#endif
-	}
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-#ifdef SDIO_MMC_DEBUG
-	handle->cmd53w = 2;
-#endif
-	return ret;
-}
-
-/**
- *  @brief This function reads multiple bytes from card memory
- *
- *  @param handle   A Pointer to the moal_handle structure
- *  @param pmbuf    Pointer to mlan_buffer structure
- *  @param port     Port
- *  @param timeout  Time out value
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdiommc_read_data_sync(moal_handle *handle,
-					       mlan_buffer *pmbuf, t_u32 port,
-					       t_u32 timeout)
-{
-	mlan_status ret = MLAN_STATUS_FAILURE;
-	t_u8 *buffer = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
-	t_u8 blkmode =
-		(port & MLAN_SDIO_BYTE_MODE_MASK) ? BYTE_MODE : BLOCK_MODE;
-	t_u32 blksz = (blkmode == BLOCK_MODE) ? MLAN_SDIO_BLOCK_SIZE : 1;
-	t_u32 blkcnt = (blkmode == BLOCK_MODE) ?
-			       (pmbuf->data_len / MLAN_SDIO_BLOCK_SIZE) :
-			       pmbuf->data_len;
-	t_u32 ioport = (port & MLAN_SDIO_IO_PORT_MASK);
-	int status = 0;
-	if (pmbuf->use_count > 1)
-		return woal_sdio_rw_mb(handle, pmbuf, port, MFALSE);
-#ifdef SDIO_MMC_DEBUG
-	handle->cmd53r = 1;
-#endif
-	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
-	status = sdio_readsb(((struct sdio_mmc_card *)handle->card)->func,
-			     buffer, ioport, blkcnt * blksz);
-	if (!status) {
-		ret = MLAN_STATUS_SUCCESS;
-	} else {
-		PRINTM(MERROR, "cmd53 read error=%d\n", status);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
-		/* issue abort cmd52 command through F0*/
-		sdio_f0_writeb(((struct sdio_mmc_card *)handle->card)->func,
-			       0x01, SDIO_CCCR_ABORT, &status);
-#endif
-	}
-	sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
-#ifdef SDIO_MMC_DEBUG
-	handle->cmd53r = 2;
-#endif
-	return ret;
-}
-
-/**
- *  @brief This function registers the IF module in bus driver
- *
- *  @return    MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-mlan_status woal_sdiommc_bus_register(void)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-
-	ENTER();
-
-	/* SDIO Driver Registration */
-	if (sdio_register_driver(&wlan_sdio)) {
-		PRINTM(MFATAL, "SDIO Driver Registration Failed \n");
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief This function de-registers the IF module in bus driver
- *
- *  @return         N/A
- */
-void woal_sdiommc_bus_unregister(void)
-{
-	ENTER();
-
-	/* SDIO Driver Unregistration */
-	sdio_unregister_driver(&wlan_sdio);
-
-	LEAVE();
-}
-
-/**
- *  @brief This function de-registers the device
- *
- *  @param handle A pointer to moal_handle structure
- *  @return         N/A
- */
-static void woal_sdiommc_unregister_dev(moal_handle *handle)
-{
-	ENTER();
-	if (handle->card) {
-		struct sdio_mmc_card *card = handle->card;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
-		struct sdio_func *func = card->func;
-#endif
-		/* Release the SDIO IRQ */
-		sdio_claim_host(card->func);
-		sdio_release_irq(card->func);
-		sdio_disable_func(card->func);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
-		if (handle->driver_status)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
-			mmc_hw_reset(func->card);
-#else
-			mmc_hw_reset(func->card->host);
-#endif
-#endif
-		sdio_release_host(card->func);
-
-		sdio_set_drvdata(card->func, NULL);
-
-		PRINTM(MWARN, "Making the sdio dev card as NULL\n");
-		card->handle = NULL;
-	}
-
-	LEAVE();
-}
-
-/**
- *  @brief This function registers the device
- *
- *  @param handle  A pointer to moal_handle structure
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_sdiommc_register_dev(moal_handle *handle)
-{
-	int ret = MLAN_STATUS_SUCCESS;
-	struct sdio_mmc_card *card = handle->card;
-	struct sdio_func *func;
-
-	ENTER();
-
-	/* save adapter pointer in card */
-	card->handle = handle;
-	func = card->func;
-	sdio_claim_host(func);
-	/* Request the SDIO IRQ */
-	ret = sdio_claim_irq(func, woal_sdio_interrupt);
-	if (ret) {
-		PRINTM(MFATAL, "sdio_claim_irq failed: ret=%d\n", ret);
-		goto release_host;
-	}
-
-	/* Set block size */
-	ret = sdio_set_block_size(card->func, MLAN_SDIO_BLOCK_SIZE);
-	if (ret) {
-		PRINTM(MERROR,
-		       "sdio_set_block_seize(): cannot set SDIO block size\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto release_irq;
-	}
-
-	sdio_release_host(func);
-	sdio_set_drvdata(func, card);
-
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-
-release_irq:
-	sdio_release_irq(func);
-release_host:
-	sdio_release_host(func);
-	handle->card = NULL;
-
-	LEAVE();
-	return MLAN_STATUS_FAILURE;
-}
-
-/**
- *  @brief This function set bus clock on/off
- *
- *  @param handle   A pointer to moal_handle structure
- *  @param option   TRUE--on , FALSE--off
- *  @return         MLAN_STATUS_SUCCESS
- */
-int woal_sdio_set_bus_clock(moal_handle *handle, t_u8 option)
-{
-	struct sdio_mmc_card *cardp = (struct sdio_mmc_card *)handle->card;
-	struct mmc_host *host = cardp->func->card->host;
-
-	ENTER();
-	if (option == MTRUE) {
-		/* restore value if non-zero */
-		if (cardp->host_clock)
-			host->ios.clock = cardp->host_clock;
-	} else {
-		/* backup value if non-zero, then clear */
-		if (host->ios.clock)
-			cardp->host_clock = host->ios.clock;
-		host->ios.clock = 0;
-	}
-
-	host->ops->set_ios(host, &host->ios);
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
-/**
- *  @brief This function updates card reg based on the Cmd52 value in dev
- * structure
- *
- *  @param handle   A pointer to moal_handle structure
- *  @param func     A pointer to store func variable
- *  @param reg      A pointer to store reg variable
- *  @param val      A pointer to store val variable
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-int woal_sdio_read_write_cmd52(moal_handle *handle, int func, int reg, int val)
-{
-	int ret = MLAN_STATUS_SUCCESS;
-	struct sdio_mmc_card *card = (struct sdio_mmc_card *)handle->card;
-
-	ENTER();
-	/* Save current func and reg for read */
-	handle->cmd52_func = func;
-	handle->cmd52_reg = reg;
-	sdio_claim_host(card->func);
-	if (val >= 0) {
-		/* Perform actual write only if val is provided */
-		if (func)
-			sdio_writeb(card->func, val, reg, &ret);
-		else
-			sdio_f0_writeb(card->func, val, reg, &ret);
-		if (ret) {
-			PRINTM(MERROR,
-			       "Cannot write value (0x%x) to func %d reg 0x%x\n",
-			       val, func, reg);
-		} else {
-			PRINTM(MMSG, "write value (0x%x) to func %d reg 0x%x\n",
-			       (u8)val, func, reg);
-			handle->cmd52_val = val;
-		}
-	} else {
-		if (func)
-			val = sdio_readb(card->func, reg, &ret);
-		else
-			val = sdio_f0_readb(card->func, reg, &ret);
-		if (ret) {
-			PRINTM(MERROR,
-			       "Cannot read value from func %d reg 0x%x\n",
-			       func, reg);
-		} else {
-			PRINTM(MMSG,
-			       "read value (0x%x) from func %d reg 0x%x\n",
-			       (u8)val, func, reg);
-			handle->cmd52_val = val;
-		}
-	}
-	sdio_release_host(card->func);
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief This function check if this is second mac
- *
- *  @param handle   A pointer to moal_handle structure
- *  @return         MTRUE/MFALSE
- *
- */
-static t_u8 woal_sdiommc_is_second_mac(moal_handle *handle)
-{
-#ifdef SD9098
-	struct sdio_mmc_card *card = (struct sdio_mmc_card *)handle->card;
-	if (card->func->device == SD_DEVICE_ID_9098_FN2)
-		return MTRUE;
-#endif
-	return MFALSE;
-}
-
-static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-#ifdef SD9098
-	struct sdio_mmc_card *card = (struct sdio_mmc_card *)handle->card;
-#endif
-	t_u32 revision_id = 0;
-	t_u32 rev_id_reg = handle->card_info->rev_id_reg;
-
-#if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
-	defined(SD9097) || defined(SDNW62X) || defined(SD8978) ||              \
-	defined(SD9177)
-	t_u32 magic_reg = handle->card_info->magic_reg;
-	t_u32 magic = 0;
-	t_u32 host_strap_reg = handle->card_info->host_strap_reg;
-	t_u32 strap = 0;
-#endif
-
-	ENTER();
-
-	if (handle->params.fw_name)
-		goto done;
-#ifdef SD8801
-	if (IS_SD8801(handle->card_type))
-		goto done;
-#endif
-	/** Revision ID register */
-	woal_sdiommc_read_reg(handle, rev_id_reg, &revision_id);
-	PRINTM(MCMND, "revision_id=0x%x\n", revision_id);
-
-#if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
-	defined(SD9097) || defined(SDNW62X) || defined(SD8978) ||              \
-	defined(SD9177)
-	/** Revision ID register */
-	woal_sdiommc_read_reg(handle, magic_reg, &magic);
-	/** Revision ID register */
-	woal_sdiommc_read_reg(handle, host_strap_reg, &strap);
-	strap &= 0x1;
-	magic &= 0xFF;
-	/* 1 = SDSD, 0 --SD UART */
-	PRINTM(MCMND, "magic=0x%x strap=0x%x\n", magic, strap);
-#endif
-#if defined(SD8977)
-	if (IS_SD8977(handle->card_type)) {
-		switch (revision_id) {
-		case SD8977_V0:
-			strcpy(handle->card_info->fw_name, SD8977_V0_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8977_WLAN_V0_FW_NAME);
-			break;
-		case SD8977_V1:
-			strcpy(handle->card_info->fw_name, SD8977_V1_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8977_WLAN_V1_FW_NAME);
-			break;
-		case SD8977_V2:
-			strcpy(handle->card_info->fw_name, SD8977_V2_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8977_WLAN_V2_FW_NAME);
-			break;
-		default:
-			break;
-		}
-	}
-#endif
-#if defined(SD8887)
-	if (IS_SD8887(handle->card_type)) {
-		/* Check revision ID */
-		switch (revision_id) {
-		case SD8887_A0:
-			strcpy(handle->card_info->fw_name, SD8887_A0_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8887_WLAN_A0_FW_NAME);
-			break;
-		case SD8887_A2:
-			strcpy(handle->card_info->fw_name, SD8887_A2_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8887_WLAN_A2_FW_NAME);
-			break;
-		default:
-			break;
-		}
-	}
-#endif
-
-#ifdef SD8997
-	if (IS_SD8997(handle->card_type)) {
-		if (magic == CHIP_MAGIC_VALUE) {
-			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUART8997_DEFAULT_COMBO_FW_NAME);
-			else
-				strcpy(handle->card_info->fw_name,
-				       SDSD8997_DEFAULT_COMBO_FW_NAME);
-		}
-	}
-#endif
-
-#ifdef SD8987
-	if (IS_SD8987(handle->card_type)) {
-		if (magic == CHIP_MAGIC_VALUE) {
-			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUART8987_DEFAULT_COMBO_FW_NAME);
-			else
-				strcpy(handle->card_info->fw_name,
-				       SDSD8987_DEFAULT_COMBO_FW_NAME);
-		}
-	}
-#endif
-
-#ifdef SD8978
-	if (IS_SD8978(handle->card_type)) {
-		if (magic == CHIP_MAGIC_VALUE) {
-			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUART8978_DEFAULT_COMBO_FW_NAME);
-			else
-				strcpy(handle->card_info->fw_name,
-				       SDSD8978_DEFAULT_COMBO_FW_NAME);
-		}
-	}
-#endif
-
-#ifdef SD9098
-	if (IS_SD9098(handle->card_type) &&
-	    (card->func->device == SD_DEVICE_ID_9098_FN1)) {
-		switch (revision_id) {
-		case SD9098_Z1Z2:
-			if (magic == CHIP_MAGIC_VALUE) {
-				if (strap == CARD_TYPE_SD_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9098_DEFAULT_COMBO_FW_NAME);
-				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9098_DEFAULT_COMBO_FW_NAME);
-			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9098_DEFAULT_WLAN_FW_NAME);
-			break;
-		case SD9098_A0:
-		case SD9098_A1:
-		case SD9098_A2:
-			if (magic == CHIP_MAGIC_VALUE) {
-				if (strap == CARD_TYPE_SD_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9098_COMBO_V1_FW_NAME);
-				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9098_COMBO_V1_FW_NAME);
-			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9098_WLAN_V1_FW_NAME);
-			break;
-		default:
-			break;
-		}
-	}
-#endif
-#ifdef SD9097
-	if (IS_SD9097(handle->card_type)) {
-		switch (revision_id) {
-		case SD9097_B0:
-		case SD9097_B1:
-			if (magic == CHIP_MAGIC_VALUE) {
-				if (strap == CARD_TYPE_SD_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9097_COMBO_V1_FW_NAME);
-				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9097_COMBO_V1_FW_NAME);
-			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9097_WLAN_V1_FW_NAME);
-			break;
-		default:
-			break;
-		}
-	}
-#endif
-#ifdef SDNW62X
-	if (IS_SDNW62X(handle->card_type)) {
-		if (magic == CHIP_MAGIC_VALUE) {
-			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUARTNW62X_COMBO_FW_NAME);
-			else
-				strcpy(handle->card_info->fw_name,
-				       SDSDNW62X_COMBO_FW_NAME);
-		}
-	}
-#endif
-
-#ifdef SD9177
-	if (IS_SD9177(handle->card_type)) {
-		switch (revision_id) {
-		case SD9177_A0:
-			if (magic == CHIP_MAGIC_VALUE) {
-				if (strap == CARD_TYPE_SD9177_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9177_DEFAULT_COMBO_FW_NAME);
-				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9177_DEFAULT_COMBO_FW_NAME);
-			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9177_DEFAULT_WLAN_FW_NAME);
-			break;
-		case SD9177_A1:
-			if (magic == CHIP_MAGIC_VALUE) {
-				if (strap == CARD_TYPE_SD9177_UART) {
-					if (handle->params.rf_test_mode)
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME);
-					else
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDUART9177_DEFAULT_COMBO_V1_FW_NAME);
-				} else {
-					if (handle->params.rf_test_mode)
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME);
-					else
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDSD9177_DEFAULT_COMBO_V1_FW_NAME);
-				}
-			}
-			if (handle->params.rf_test_mode)
-				strcpy(handle->card_info->fw_name,
-				       SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME);
-			else
-				strcpy(handle->card_info->fw_name_wlan,
-				       SD9177_DEFAULT_WLAN_V1_FW_NAME);
-			break;
-		default:
-			break;
-		}
-	}
-#endif
-done:
-	PRINTM(MCMND, "combo fw:%s wlan fw:%s \n", handle->card_info->fw_name,
-	       handle->card_info->fw_name_wlan);
-	LEAVE();
-	return ret;
-}
-
-#define DEBUG_FW_DONE 0xFF
-#define DEBUG_MEMDUMP_FINISH 0xFE
-#define MAX_POLL_TRIES 100
-
-typedef enum {
-	DUMP_TYPE_ITCM = 0,
-	DUMP_TYPE_DTCM = 1,
-	DUMP_TYPE_SQRAM = 2,
-	DUMP_TYPE_APU_REGS = 3,
-	DUMP_TYPE_CIU_REGS = 4,
-	DUMP_TYPE_ICU_REGS = 5,
-	DUMP_TYPE_MAC_REGS = 6,
-	DUMP_TYPE_EXTEND_7 = 7,
-	DUMP_TYPE_EXTEND_8 = 8,
-	DUMP_TYPE_EXTEND_9 = 9,
-	DUMP_TYPE_EXTEND_10 = 10,
-	DUMP_TYPE_EXTEND_11 = 11,
-	DUMP_TYPE_EXTEND_12 = 12,
-	DUMP_TYPE_EXTEND_13 = 13,
-	DUMP_TYPE_EXTEND_LAST = 14
-} dumped_mem_type;
-
-#define MAX_NAME_LEN 8
-
-typedef struct {
-	t_u8 mem_name[MAX_NAME_LEN];
-	t_u8 *mem_Ptr;
-	struct file *pfile_mem;
-	t_u8 done_flag;
-	t_u8 type;
-} memory_type_mapping;
-
-static memory_type_mapping mem_type_mapping_tbl[] = {
-	{"ITCM", NULL, NULL, 0xF0, FW_DUMP_TYPE_MEM_ITCM},
-	{"DTCM", NULL, NULL, 0xF1, FW_DUMP_TYPE_MEM_DTCM},
-	{"SQRAM", NULL, NULL, 0xF2, FW_DUMP_TYPE_MEM_SQRAM},
-	{"APU", NULL, NULL, 0xF3, FW_DUMP_TYPE_REG_APU},
-	{"CIU", NULL, NULL, 0xF4, FW_DUMP_TYPE_REG_CIU},
-	{"ICU", NULL, NULL, 0xF5, FW_DUMP_TYPE_REG_ICU},
-	{"MAC", NULL, NULL, 0xF6, FW_DUMP_TYPE_REG_MAC},
-	{"EXT7", NULL, NULL, 0xF7, 0},
-	{"EXT8", NULL, NULL, 0xF8, 0},
-	{"EXT9", NULL, NULL, 0xF9, 0},
-	{"EXT10", NULL, NULL, 0xFA, 0},
-	{"EXT11", NULL, NULL, 0xFB, 0},
-	{"EXT12", NULL, NULL, 0xFC, 0},
-	{"EXT13", NULL, NULL, 0xFD, 0},
-	{"EXTLAST", NULL, NULL, 0xFE, 0},
-};
-static memory_type_mapping mem_type_mapping_tbl_8977_8997 = {"DUMP", NULL, NULL,
-							     0xDD, 0};
-/**
- *  @brief This function read/write firmware via cmd52
- *
- *  @param phandle   A pointer to moal_handle
- *  @param doneflag  A flag
- *
- *  @return         MLAN_STATUS_SUCCESS
- */
-static rdwr_status woal_cmd52_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
-{
-	int ret = 0;
-	int tries = 0;
-	t_u8 ctrl_data = 0;
-	t_u8 dbg_dump_ctrl_reg = phandle->card_info->dump_fw_ctrl_reg;
-	t_u8 debug_host_ready = phandle->card_info->dump_fw_host_ready;
-
-#ifdef SD9177
-	if (IS_SD9177(phandle->card_type)) {
-		if (phandle->event_fw_dump)
-			debug_host_ready = 0xAA;
-	}
-#endif
-	ret = woal_sdio_writeb(phandle, dbg_dump_ctrl_reg, debug_host_ready);
-	if (ret) {
-		PRINTM(MERROR, "SDIO Write ERR\n");
-		return RDWR_STATUS_FAILURE;
-	}
-#ifdef SD9177
-	if (IS_SD9177(phandle->card_type)) {
-		if (phandle->event_fw_dump)
-			return RDWR_STATUS_SUCCESS;
-	}
-#endif
-	for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
-		ret = woal_sdio_readb(phandle, dbg_dump_ctrl_reg, &ctrl_data);
-		if (ret) {
-			PRINTM(MERROR, "SDIO READ ERR\n");
-			return RDWR_STATUS_FAILURE;
-		}
-		if (ctrl_data == DEBUG_FW_DONE)
-			break;
-		if (doneflag && ctrl_data == doneflag)
-			return RDWR_STATUS_DONE;
-		if (ctrl_data != debug_host_ready) {
-			PRINTM(MMSG,
-			       "The ctrl reg was changed, re-try again!\n");
-			ret = woal_sdio_writeb(phandle, dbg_dump_ctrl_reg,
-					       debug_host_ready);
-			if (ret) {
-				PRINTM(MERROR, "SDIO Write ERR\n");
-				return RDWR_STATUS_FAILURE;
-			}
-		}
-		udelay(100);
-	}
-	if (ctrl_data == debug_host_ready || tries == MAX_POLL_TRIES) {
-		PRINTM(MERROR, "Fail to pull ctrl_data\n");
-		return RDWR_STATUS_FAILURE;
-	}
-	return RDWR_STATUS_SUCCESS;
-}
-
-#ifdef SD8801
-#define DEBUG_HOST_READY 0xEE
-#define DEBUG_FW_DONE 0xFF
-#define DEBUG_MEMDUMP_FINISH 0xFE
-#define MAX_POLL_TRIES 100
-#define DEBUG_ITCM_DONE 0xaa
-#define DEBUG_DTCM_DONE 0xbb
-#define DEBUG_SQRAM_DONE 0xcc
-
-#define DEBUG_DUMP_CTRL_REG 0x63
-#define DEBUG_DUMP_FIRST_REG 0x62
-#define DEBUG_DUMP_START_REG 0x64
-#define DEBUG_DUMP_END_REG 0x6a
-#define ITCM_SIZE 0x60000
-#define SQRAM_SIZE 0x33500
-#define DTCM_SIZE 0x14000
-
-/**
- *  @brief This function dump firmware memory to file
- *
- *  @param phandle   A pointer to moal_handle
- *
- *  @return         N/A
- */
-void woal_dump_firmware_info(moal_handle *phandle)
-{
-	int ret = 0;
-	unsigned int reg, reg_start, reg_end;
-	t_u8 *ITCM_Ptr = NULL;
-	t_u8 *DTCM_Ptr = NULL;
-	t_u8 *SQRAM_Ptr = NULL;
-	t_u8 *dbg_ptr = NULL;
-	t_u32 sec, usec;
-	t_u8 ctrl_data = 0;
-	t_u32 dtcm_size = DTCM_SIZE;
-	t_u32 sqram_size = SQRAM_SIZE;
-	t_u8 *end_ptr = NULL;
-	int tries;
-
-	if (!phandle) {
-		PRINTM(MERROR, "Could not dump firmwware info\n");
-		return;
-	}
-	if (!phandle->fw_dump_buf) {
-		ret = moal_vmalloc(phandle, FW_DUMP_INFO_LEN,
-				   &(phandle->fw_dump_buf));
-		if (ret != MLAN_STATUS_SUCCESS || !phandle->fw_dump_buf) {
-			PRINTM(MERROR, "Failed to vmalloc fw dump bufffer\n");
-			return;
-		}
-	} else {
-		memset(phandle->fw_dump_buf, 0x00, FW_DUMP_INFO_LEN);
-	}
-	phandle->fw_dump_len = 0;
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-	sdio_claim_host(((struct sdio_mmc_card *)phandle->card)->func);
-#endif
-	/* start dump fw memory	*/
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "==== DEBUG MODE OUTPUT START: %u.%06u ====\n", sec, usec);
-	ret = moal_vmalloc(phandle, ITCM_SIZE + 1, (t_u8 **)&ITCM_Ptr);
-	if ((ret != MLAN_STATUS_SUCCESS) || !ITCM_Ptr) {
-		PRINTM(MERROR, "Error: vmalloc ITCM buffer failed!!!\n");
-		goto done;
-	}
-
-	PRINTM(MMSG, "DTCM_SIZE=0x%x\n", dtcm_size);
-	ret = moal_vmalloc(phandle, dtcm_size + 1, (t_u8 **)&DTCM_Ptr);
-	if ((ret != MLAN_STATUS_SUCCESS) || !DTCM_Ptr) {
-		PRINTM(MERROR, "Error: vmalloc DTCM buffer failed!!!\n");
-		goto done;
-	}
-	ret = moal_vmalloc(phandle, sqram_size + 1, (t_u8 **)&SQRAM_Ptr);
-	if ((ret != MLAN_STATUS_SUCCESS) || !SQRAM_Ptr) {
-		PRINTM(MERROR, "Error: vmalloc SQRAM buffer failed!!!\n");
-		goto done;
-	}
-	dbg_ptr = ITCM_Ptr;
-	end_ptr = ITCM_Ptr + ITCM_SIZE;
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "Start ITCM output %u.%06u, please wait...\n", sec, usec);
-	reg_start = DEBUG_DUMP_START_REG;
-	reg_end = DEBUG_DUMP_END_REG;
-	do {
-		ret = woal_sdio_writeb(phandle, DEBUG_DUMP_CTRL_REG,
-				       DEBUG_HOST_READY);
-		if (ret) {
-			PRINTM(MERROR, "SDIO Write ERR\n");
-			goto done;
-		}
-		for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
-			ret = woal_sdio_readb(phandle, DEBUG_DUMP_CTRL_REG,
-					      &ctrl_data);
-			if (ret) {
-				PRINTM(MERROR, "SDIO READ ERR\n");
-				goto done;
-			}
-			if ((ctrl_data == DEBUG_FW_DONE) ||
-			    (ctrl_data == DEBUG_ITCM_DONE) ||
-			    (ctrl_data == DEBUG_DTCM_DONE) ||
-			    (ctrl_data == DEBUG_SQRAM_DONE))
-				break;
-			if (ctrl_data != DEBUG_HOST_READY) {
-				ret = woal_sdio_writeb(phandle,
-						       DEBUG_DUMP_CTRL_REG,
-						       DEBUG_HOST_READY);
-				if (ret) {
-					PRINTM(MERROR, "SDIO Write ERR\n");
-					goto done;
-				}
-			}
-			udelay(100);
-		}
-		if (ctrl_data == DEBUG_HOST_READY) {
-			PRINTM(MERROR, "Fail to pull ctrl_data\n");
-			goto done;
-		}
-		reg = DEBUG_DUMP_FIRST_REG;
-		ret = woal_sdio_readb(phandle, reg, dbg_ptr);
-		if (ret) {
-			PRINTM(MMSG, "SDIO READ ERR\n");
-			goto done;
-		}
-		if (dbg_ptr < end_ptr)
-			dbg_ptr++;
-		else {
-			PRINTM(MINFO, "pre-allocced buf is not enough\n");
-			goto done;
-		}
-		for (reg = reg_start; reg <= reg_end; reg++) {
-			ret = woal_sdio_readb(phandle, reg, dbg_ptr);
-			if (ret) {
-				PRINTM(MMSG, "SDIO READ ERR\n");
-				goto done;
-			}
-			if (dbg_ptr < end_ptr)
-				dbg_ptr++;
-			else
-				PRINTM(MINFO,
-				       "pre-allocced buf is not enough\n");
-		}
-		switch (ctrl_data) {
-		case DEBUG_ITCM_DONE:
-#ifdef MLAN_64BIT
-			PRINTM(MMSG, "ITCM done: size=0x%lx\n",
-			       dbg_ptr - ITCM_Ptr);
-#else
-			PRINTM(MMSG, "ITCM done: size=0x%x\n",
-			       dbg_ptr - ITCM_Ptr);
-#endif
-			woal_save_dump_info_to_buf(phandle, ITCM_Ptr, ITCM_SIZE,
-						   FW_DUMP_TYPE_MEM_ITCM);
-			dbg_ptr = DTCM_Ptr;
-			end_ptr = DTCM_Ptr + dtcm_size;
-			moal_get_system_time(phandle, &sec, &usec);
-			PRINTM(MMSG,
-			       "Start DTCM output %u.%06u, please wait...\n",
-			       sec, usec);
-			break;
-		case DEBUG_DTCM_DONE:
-#ifdef MLAN_64BIT
-			PRINTM(MMSG, "DTCM done: size=0x%lx\n",
-			       dbg_ptr - DTCM_Ptr);
-#else
-			PRINTM(MMSG, "DTCM done: size=0x%x\n",
-			       dbg_ptr - DTCM_Ptr);
-#endif
-			woal_save_dump_info_to_buf(phandle, ITCM_Ptr, dtcm_size,
-						   FW_DUMP_TYPE_MEM_DTCM);
-			dbg_ptr = SQRAM_Ptr;
-			end_ptr = SQRAM_Ptr + sqram_size;
-			moal_get_system_time(phandle, &sec, &usec);
-			PRINTM(MMSG,
-			       "Start SQRAM output %u.%06u, please wait...\n",
-			       sec, usec);
-			break;
-		case DEBUG_SQRAM_DONE:
-#ifdef MLAN_64BIT
-			PRINTM(MMSG, "SQRAM done: size=0x%lx\n",
-			       dbg_ptr - SQRAM_Ptr);
-#else
-			PRINTM(MMSG, "SQRAM done: size=0x%x\n",
-			       dbg_ptr - SQRAM_Ptr);
-#endif
-			woal_save_dump_info_to_buf(phandle, SQRAM_Ptr,
-						   sqram_size,
-						   FW_DUMP_TYPE_MEM_SQRAM);
-			PRINTM(MMSG, "End output!\n");
-			break;
-		default:
-			break;
-		}
-	} while (ctrl_data != DEBUG_SQRAM_DONE);
-
-	woal_append_end_block(phandle);
-	PRINTM(MMSG,
-	       "The output ITCM/DTCM/SQRAM have been saved to files successfully!\n");
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "==== DEBUG MODE OUTPUT END: %u.%06u ====\n", sec, usec);
-	/* end dump fw memory */
-done:
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-	sdio_release_host(((struct sdio_mmc_card *)phandle->card)->func);
-#endif
-	if (ITCM_Ptr)
-		moal_vfree(phandle, ITCM_Ptr);
-	if (DTCM_Ptr)
-		moal_vfree(phandle, DTCM_Ptr);
-	if (SQRAM_Ptr)
-		moal_vfree(phandle, SQRAM_Ptr);
-	PRINTM(MMSG, "==== DEBUG MODE END ====\n");
-	return;
-}
-#endif
-
-/**
- *  @brief This function dump firmware memory to file
- *
- *  @param phandle   A pointer to moal_handle
- *
- *  @return         N/A
- */
-void woal_dump_firmware_info_v2(moal_handle *phandle)
-{
-	int ret = 0;
-	unsigned int reg, reg_start, reg_end;
-	t_u8 *dbg_ptr = NULL;
-	t_u32 sec, usec;
-	t_u8 dump_num = 0;
-	t_u8 idx = 0;
-	t_u8 doneflag = 0;
-	rdwr_status stat;
-	t_u8 i = 0;
-	t_u8 read_reg = 0;
-	t_u32 memory_size = 0;
-	t_u8 *end_ptr = NULL;
-	t_u8 dbg_dump_start_reg = 0;
-	t_u8 dbg_dump_end_reg = 0;
-	t_u8 dbg_dump_ctrl_reg = 0;
-
-	if (!phandle) {
-		PRINTM(MERROR, "Could not dump firmwware info\n");
-		return;
-	}
-
-	dbg_dump_start_reg = phandle->card_info->dump_fw_start_reg;
-	dbg_dump_end_reg = phandle->card_info->dump_fw_end_reg;
-	dbg_dump_ctrl_reg = phandle->card_info->dump_fw_ctrl_reg;
-
-	if (!phandle->fw_dump_buf) {
-		ret = moal_vmalloc(phandle, FW_DUMP_INFO_LEN,
-				   &(phandle->fw_dump_buf));
-		if (ret != MLAN_STATUS_SUCCESS || !phandle->fw_dump_buf) {
-			PRINTM(MERROR, "Failed to vmalloc fw dump bufffer\n");
-			return;
-		}
-	} else {
-		memset(phandle->fw_dump_buf, 0x00, FW_DUMP_INFO_LEN);
-	}
-	phandle->fw_dump_len = 0;
-
-	/* start dump fw memory */
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "==== DEBUG MODE OUTPUT START: %u.%06u ====\n", sec, usec);
-	/* read the number of the memories which will dump */
-	if (RDWR_STATUS_FAILURE == woal_cmd52_rdwr_firmware(phandle, doneflag))
-		goto done;
-	reg = dbg_dump_start_reg;
-	ret = woal_sdio_readb(phandle, reg, &dump_num);
-	if (ret) {
-		PRINTM(MMSG, "SDIO READ MEM NUM ERR\n");
-		goto done;
-	}
-
-	/* read the length of every memory which will dump */
-	for (idx = 0; idx < dump_num; idx++) {
-		if (RDWR_STATUS_FAILURE ==
-		    woal_cmd52_rdwr_firmware(phandle, doneflag))
-			goto done;
-		memory_size = 0;
-		reg = dbg_dump_start_reg;
-		for (i = 0; i < 4; i++) {
-			ret = woal_sdio_readb(phandle, reg, &read_reg);
-			if (ret) {
-				PRINTM(MMSG, "SDIO READ ERR\n");
-				goto done;
-			}
-			memory_size |= (read_reg << i * 8);
-			reg++;
-		}
-		if (memory_size == 0) {
-			PRINTM(MMSG, "Firmware Dump Finished!\n");
-			ret = woal_sdiommc_write_reg(phandle, dbg_dump_ctrl_reg,
-						     DEBUG_MEMDUMP_FINISH);
-			if (ret) {
-				PRINTM(MERROR,
-				       "SDIO Write MEMDUMP_FINISH ERR\n");
-				goto done;
-			}
-			break;
-		} else {
-			PRINTM(MMSG, "%s_SIZE=0x%x\n",
-			       mem_type_mapping_tbl[idx].mem_name, memory_size);
-			ret = moal_vmalloc(
-				phandle, memory_size + 1,
-				(t_u8 **)&mem_type_mapping_tbl[idx].mem_Ptr);
-			if ((ret != MLAN_STATUS_SUCCESS) ||
-			    !mem_type_mapping_tbl[idx].mem_Ptr) {
-				PRINTM(MERROR,
-				       "Error: vmalloc %s buffer failed!!!\n",
-				       mem_type_mapping_tbl[idx].mem_name);
-				goto done;
-			}
-			dbg_ptr = mem_type_mapping_tbl[idx].mem_Ptr;
-			end_ptr = dbg_ptr + memory_size;
-		}
-		doneflag = mem_type_mapping_tbl[idx].done_flag;
-		moal_get_system_time(phandle, &sec, &usec);
-		PRINTM(MMSG, "Start %s output %u.%06u, please wait...\n",
-		       mem_type_mapping_tbl[idx].mem_name, sec, usec);
-		do {
-			stat = woal_cmd52_rdwr_firmware(phandle, doneflag);
-			if (RDWR_STATUS_FAILURE == stat)
-				goto done;
-			reg_start = dbg_dump_start_reg;
-			reg_end = dbg_dump_end_reg;
-			for (reg = reg_start; reg <= reg_end; reg++) {
-				ret = woal_sdio_readb(phandle, reg, dbg_ptr);
-				if (ret) {
-					PRINTM(MMSG, "SDIO READ ERR\n");
-					goto done;
-				}
-				if (dbg_ptr < end_ptr)
-					dbg_ptr++;
-				else
-					PRINTM(MINFO,
-					       "pre-allocced buf is not enough\n");
-			}
-			if (RDWR_STATUS_DONE == stat) {
-#ifdef MLAN_64BIT
-				PRINTM(MMSG,
-				       "%s done:"
-				       "size = 0x%lx\n",
-				       mem_type_mapping_tbl[idx].mem_name,
-				       dbg_ptr - mem_type_mapping_tbl[idx]
-							 .mem_Ptr);
-#else
-				PRINTM(MMSG,
-				       "%s done:"
-				       "size = 0x%x\n",
-				       mem_type_mapping_tbl[idx].mem_name,
-				       dbg_ptr - mem_type_mapping_tbl[idx]
-							 .mem_Ptr);
-#endif
-				woal_save_dump_info_to_buf(
-					phandle,
-					mem_type_mapping_tbl[idx].mem_Ptr,
-					memory_size,
-					mem_type_mapping_tbl[idx].type);
-				moal_vfree(phandle,
-					   mem_type_mapping_tbl[idx].mem_Ptr);
-				mem_type_mapping_tbl[idx].mem_Ptr = NULL;
-				break;
-			}
-		} while (1);
-	}
-	woal_append_end_block(phandle);
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "==== DEBUG MODE OUTPUT END: %u.%06u ====\n", sec, usec);
-	/* end dump fw memory */
-done:
-	for (idx = 0; idx < dump_num; idx++) {
-		if (mem_type_mapping_tbl[idx].mem_Ptr) {
-			moal_vfree(phandle, mem_type_mapping_tbl[idx].mem_Ptr);
-			mem_type_mapping_tbl[idx].mem_Ptr = NULL;
-		}
-	}
-	PRINTM(MMSG, "==== DEBUG MODE END ====\n");
-	return;
-}
-
-/**
- *  @brief This function dump firmware memory to file
- *
- *  @param phandle   A pointer to moal_handle
- *
- *  @return         N/A
- */
-void woal_dump_firmware_info_v3(moal_handle *phandle)
-{
-	int ret = 0;
-	int tries = 0;
-	unsigned int reg, reg_start, reg_end;
-	t_u8 *dbg_ptr = NULL;
-	t_u8 *temp_Ptr = NULL;
-	t_u32 sec, usec;
-	t_u8 start_flag = 0;
-	t_u8 doneflag = 0;
-	rdwr_status stat;
-	t_u32 memory_size = 0;
-	t_u8 *end_ptr = NULL;
-	t_u8 dbg_dump_start_reg = 0;
-	t_u8 dbg_dump_end_reg = 0;
-	memory_type_mapping *pmem_type_mapping_tbl =
-		&mem_type_mapping_tbl_8977_8997;
-
-	if (!phandle) {
-		PRINTM(MERROR, "Could not dump firmwware info\n");
-		return;
-	}
-#ifdef SD9177
-	if (IS_SD9177(phandle->card_type)) {
-		if (phandle->event_fw_dump) {
-			if (RDWR_STATUS_FAILURE !=
-			    woal_cmd52_rdwr_firmware(phandle, doneflag)) {
-				PRINTM(MMSG,
-				       "====SDIO FW DUMP EVENT MODE START ====\n");
-				return;
-			}
-		}
-	}
-#endif
-
-	dbg_dump_start_reg = phandle->card_info->dump_fw_start_reg;
-	dbg_dump_end_reg = phandle->card_info->dump_fw_end_reg;
-
-	/* start dump fw memory */
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "==== DEBUG MODE OUTPUT START: %u.%06u ====\n", sec, usec);
-	/* read the number of the memories which will dump */
-	if (RDWR_STATUS_FAILURE == woal_cmd52_rdwr_firmware(phandle, doneflag))
-		goto done;
-
-	/** check the reg which indicate dump starting */
-	for (reg = dbg_dump_start_reg; reg <= dbg_dump_end_reg; reg++) {
-		for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
-			ret = woal_sdio_readb(phandle, reg, &start_flag);
-			if (ret) {
-				PRINTM(MMSG, "SDIO READ ERR\n");
-				goto done;
-			}
-			/** 0 means dump starting*/
-			if (start_flag == 0)
-				break;
-			udelay(100);
-		}
-		if (tries == MAX_POLL_TRIES) {
-			PRINTM(MMSG, "FW not ready to dump\n");
-			goto done;
-		}
-	}
-	memory_size = 0xF0000;
-	PRINTM(MMSG, "%s_SIZE=0x%x\n", pmem_type_mapping_tbl->mem_name,
-	       memory_size);
-	ret = moal_vmalloc(phandle, memory_size + 1,
-			   (t_u8 **)&pmem_type_mapping_tbl->mem_Ptr);
-	if ((ret != MLAN_STATUS_SUCCESS) || !pmem_type_mapping_tbl->mem_Ptr) {
-		PRINTM(MERROR, "Error: vmalloc %s buffer failed!!!\n",
-		       pmem_type_mapping_tbl->mem_name);
-		goto done;
-	}
-	dbg_ptr = pmem_type_mapping_tbl->mem_Ptr;
-	end_ptr = dbg_ptr + memory_size;
-	doneflag = pmem_type_mapping_tbl->done_flag;
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "Start %s output %u.%06u, please wait...\n",
-	       pmem_type_mapping_tbl->mem_name, sec, usec);
-	do {
-		stat = woal_cmd52_rdwr_firmware(phandle, doneflag);
-		if (RDWR_STATUS_FAILURE == stat)
-			goto done;
-		reg_start = dbg_dump_start_reg;
-		reg_end = dbg_dump_end_reg;
-		for (reg = reg_start; reg <= reg_end; reg++) {
-			ret = woal_sdio_readb(phandle, reg, dbg_ptr);
-			if (ret) {
-				PRINTM(MMSG, "SDIO READ ERR\n");
-				goto done;
-			}
-			dbg_ptr++;
-			if (dbg_ptr >= end_ptr) {
-				PRINTM(MINFO,
-				       "pre-allocced buf is not enough\n");
-
-				ret = moal_vmalloc(phandle,
-						   memory_size + 0x2000 + 1,
-						   (t_u8 **)&temp_Ptr);
-				if ((ret != MLAN_STATUS_SUCCESS) || !temp_Ptr) {
-					PRINTM(MERROR,
-					       "Error: vmalloc  buffer failed!!!\n");
-					goto done;
-				}
-
-				moal_memcpy_ext(phandle, temp_Ptr,
-						pmem_type_mapping_tbl->mem_Ptr,
-						memory_size,
-						memory_size + 0x2000);
-				moal_vfree(phandle,
-					   pmem_type_mapping_tbl->mem_Ptr);
-				pmem_type_mapping_tbl->mem_Ptr = temp_Ptr;
-				temp_Ptr = NULL;
-				dbg_ptr = pmem_type_mapping_tbl->mem_Ptr +
-					  memory_size;
-
-				memory_size += 0x2000;
-				end_ptr = pmem_type_mapping_tbl->mem_Ptr +
-					  memory_size;
-			}
-		}
-		if (RDWR_STATUS_DONE == stat) {
-#ifdef MLAN_64BIT
-			PRINTM(MMSG,
-			       "%s done:"
-			       "size = 0x%lx\n",
-			       pmem_type_mapping_tbl->mem_name,
-			       dbg_ptr - pmem_type_mapping_tbl->mem_Ptr);
-#else
-			PRINTM(MMSG,
-			       "%s done:"
-			       "size = 0x%x\n",
-			       pmem_type_mapping_tbl->mem_name,
-			       dbg_ptr - pmem_type_mapping_tbl->mem_Ptr);
-
-#endif
-			if (phandle->fw_dump_buf) {
-				moal_vfree(phandle, phandle->fw_dump_buf);
-				phandle->fw_dump_buf = NULL;
-				phandle->fw_dump_len = 0;
-			}
-			phandle->fw_dump_buf = pmem_type_mapping_tbl->mem_Ptr;
-			phandle->fw_dump_len =
-				dbg_ptr - pmem_type_mapping_tbl->mem_Ptr;
-			pmem_type_mapping_tbl->mem_Ptr = NULL;
-			break;
-		}
-	} while (1);
-	moal_get_system_time(phandle, &sec, &usec);
-	PRINTM(MMSG, "==== DEBUG MODE OUTPUT END: %u.%06u ====\n", sec, usec);
-	/* end dump fw memory */
-done:
-	if (pmem_type_mapping_tbl->mem_Ptr) {
-		moal_vfree(phandle, pmem_type_mapping_tbl->mem_Ptr);
-		pmem_type_mapping_tbl->mem_Ptr = NULL;
-	}
-	PRINTM(MMSG, "==== DEBUG MODE END ====\n");
-	return;
-}
-
-/**
- *  @brief This function reads and displays SDIO registers for debugging
- *
- *  @param phandle  A pointer to moal_handle
- *
- *  @return         N/A
- */
-static void woal_sdiommc_reg_dbg(moal_handle *phandle)
-{
-	int ret = 0;
-	t_u8 loop, index = 0, func, data;
-	unsigned int reg, reg_start, reg_end;
-	unsigned int scratch_reg = phandle->card_info->scratch_reg;
-	t_u8 *reg_table = phandle->card_info->dump_reg.reg_table;
-	t_u8 reg_table_size = phandle->card_info->dump_reg.reg_table_size;
-	char buf[256], *ptr;
-
-	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
-	for (loop = 0; loop < 5; loop++) {
-		memset(buf, 0, sizeof(buf));
-		ptr = buf;
-		if (loop == 0) {
-			/* Read the registers of SDIO function0 */
-			func = loop;
-			reg_start = 0;
-			reg_end = 9;
-		} else if (loop == 1) {
-			/* Read the registers of SDIO function1 */
-			func = loop;
-			reg_start = phandle->card_info->func1_reg_start;
-			reg_end = phandle->card_info->func1_reg_end;
-		} else if (loop == 2) {
-			/* Read specific registers of SDIO function1 */
-			index = 0;
-			func = 1;
-			reg_start = reg_table[index++];
-			reg_end = reg_table[reg_table_size - 1];
-		} else {
-			/* Read the scratch registers of SDIO function1 */
-			if (loop == 4)
-				mdelay(100);
-			func = 1;
-			reg_start = scratch_reg;
-			reg_end = scratch_reg + 10;
-		}
-		if (loop != 2)
-			ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ", func,
-				       reg_start, reg_end);
-		else
-			ptr += sprintf(ptr, "SDIO Func%d: ", func);
-		for (reg = reg_start; reg <= reg_end;) {
-			if (func == 0)
-				ret = woal_sdio_f0_readb(phandle, reg, &data);
-			else
-				ret = woal_sdio_readb(phandle, reg, &data);
-			if (loop == 2)
-				ptr += sprintf(ptr, "(%#x) ", reg);
-			if (!ret)
-				ptr += sprintf(ptr, "%02x ", data);
-			else {
-				ptr += sprintf(ptr, "ERR");
-				break;
-			}
-			if (loop == 2 && reg < reg_end)
-				reg = reg_table[index++];
-			else
-				reg++;
-		}
-		PRINTM(MMSG, "%s\n", buf);
-	}
-	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
-}
-
-/**
- *  @brief This function dump firmware memory to file
- *
- *  @param phandle   A pointer to moal_handle
- *
- *  @return         N/A
- */
-static void woal_sdiommc_dump_fw_info(moal_handle *phandle)
-{
-	if (!phandle) {
-		PRINTM(MERROR, "Could not dump firmwware info\n");
-		return;
-	}
-	/** cancel all pending commands */
-	mlan_ioctl(phandle->pmlan_adapter, NULL);
-
-	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
-	phandle->fw_dump = MTRUE;
-	if (phandle->card_info->dump_fw_info == DUMP_FW_SDIO_V2) {
-		woal_dump_firmware_info_v2(phandle);
-	} else if (phandle->card_info->dump_fw_info == DUMP_FW_SDIO_V3) {
-		woal_dump_firmware_info_v3(phandle);
-		if (phandle->event_fw_dump) {
-			phandle->event_fw_dump = MFALSE;
-			queue_work(phandle->workqueue, &phandle->main_work);
-			phandle->is_fw_dump_timer_set = MTRUE;
-			woal_mod_timer(&phandle->fw_dump_timer, MOAL_TIMER_5S);
-			return;
-		}
-	}
-#ifdef SD8801
-	else {
-		woal_dump_firmware_info(phandle);
-	}
-#endif
-	phandle->fw_dump = MFALSE;
-	if (!phandle->priv_num)
-		return;
-	woal_send_fw_dump_complete_event(
-		woal_get_priv(phandle, MLAN_BSS_ROLE_ANY));
-	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
-	queue_work(phandle->workqueue, &phandle->main_work);
-	woal_process_hang(phandle);
-	return;
-}
-
-/**
- *  @brief This function save sdio reg info
- *
- *  @param phandle   A pointer to moal_handle
- *  @param buf       A pointer buffer saving log
- *
- *  @return          The length of this log
- */
-static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)
-{
-	char *drv_ptr = (char *)drv_buf;
-	int ret = 0;
-	t_u8 loop, index = 0, func, data;
-	unsigned int reg, reg_start, reg_end;
-	unsigned int scratch_reg = 0;
-	t_u8 *reg_table = NULL;
-	t_u8 reg_table_size = 0;
-	char buf[256], *ptr;
-
-	ENTER();
-
-	if (!phandle || !drv_buf) {
-		PRINTM(MMSG, "%s: can't retreive info\n", __func__);
-		LEAVE();
-		return 0;
-	}
-
-	scratch_reg = phandle->card_info->scratch_reg;
-	reg_table = phandle->card_info->dump_reg.reg_table;
-	reg_table_size = phandle->card_info->dump_reg.reg_table_size;
-
-	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
-
-	drv_ptr += sprintf(drv_ptr, "--------sdio_reg_debug_info---------\n");
-	for (loop = 0; loop < 5; loop++) {
-		memset(buf, 0, sizeof(buf));
-		ptr = buf;
-		if (loop == 0) {
-			/* Read the registers of SDIO function0 */
-			func = loop;
-			reg_start = 0;
-			reg_end = 9;
-
-		} else if (loop == 1) {
-			/* Read the registers of SDIO function1 */
-			func = loop;
-			reg_start = phandle->card_info->func1_reg_start;
-			reg_end = phandle->card_info->func1_reg_end;
-		} else if (loop == 2) {
-			/* Read specific registers of SDIO function1 */
-			index = 0;
-			func = 1;
-			reg_start = reg_table[index++];
-			reg_end = reg_table[reg_table_size - 1];
-		} else {
-			/* Read the scratch registers of SDIO function1 */
-			if (loop == 4)
-				mdelay(100);
-			func = 1;
-			reg_start = scratch_reg;
-			reg_end = scratch_reg + 10;
-		}
-		if (loop != 2)
-			ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ", func,
-				       reg_start, reg_end);
-		else
-			ptr += sprintf(ptr, "SDIO Func%d: ", func);
-		for (reg = reg_start; reg <= reg_end;) {
-			if (func == 0)
-				ret = woal_sdio_f0_readb(phandle, reg, &data);
-			else
-				ret = woal_sdio_readb(phandle, reg, &data);
-
-			if (loop == 2)
-				ptr += sprintf(ptr, "(%#x) ", reg);
-			if (!ret)
-				ptr += sprintf(ptr, "%02x ", data);
-			else {
-				ptr += sprintf(ptr, "ERR");
-				break;
-			}
-			if (loop == 2 && reg < reg_end)
-				reg = reg_table[index++];
-			else
-				reg++;
-		}
-		drv_ptr += sprintf(drv_ptr, "%s\n", buf);
-	}
-
-	drv_ptr +=
-		sprintf(drv_ptr, "--------sdio_reg_debug_info End---------\n");
-	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
-
-	LEAVE();
-	return drv_ptr - (char *)drv_buf;
-}
-
-/**
- *  @brief This function reset sdio through sdio bus driver
- *
- *  @param phandle   A pointer to moal_handle
- *
- *  @return          N/A
- */
-void woal_sdio_reset_hw(moal_handle *handle)
-{
-	struct sdio_mmc_card *card = handle->card;
-	struct sdio_func *func = card->func;
-	ENTER();
-	sdio_claim_host(func);
-	sdio_release_irq(card->func);
-	sdio_disable_func(card->func);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
-	mmc_hw_reset(func->card);
-#else
-	mmc_hw_reset(func->card->host);
-#endif
-#endif
-
-#ifdef MMC_QUIRK_BLKSZ_FOR_BYTE_MODE
-	/* The byte mode patch is available in kernel MMC driver
-	 * which fixes one issue in MP-A transfer.
-	 * bit1: use func->cur_blksize for byte mode
-	 */
-	func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
-#endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
-	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
-#endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-	/* wait for chip fully wake up */
-	if (!func->enable_timeout)
-		func->enable_timeout = 200;
-#endif
-	sdio_enable_func(func);
-	sdio_claim_irq(func, woal_sdio_interrupt);
-	sdio_set_block_size(card->func, MLAN_SDIO_BLOCK_SIZE);
-	sdio_release_host(func);
-	LEAVE();
-	return;
-}
-
-static moal_if_ops sdiommc_ops = {
-	.register_dev = woal_sdiommc_register_dev,
-	.unregister_dev = woal_sdiommc_unregister_dev,
-	.read_reg = woal_sdiommc_read_reg,
-	.write_reg = woal_sdiommc_write_reg,
-	.read_data_sync = woal_sdiommc_read_data_sync,
-	.write_data_sync = woal_sdiommc_write_data_sync,
-	.get_fw_name = woal_sdiommc_get_fw_name,
-	.dump_fw_info = woal_sdiommc_dump_fw_info,
-	.dump_reg_info = woal_sdiommc_dump_reg_info,
-	.reg_dbg = woal_sdiommc_reg_dbg,
-	.is_second_mac = woal_sdiommc_is_second_mac,
-};
diff --git a/wlan_sd8987/mlinux/moal_sta_cfg80211.h b/wlan_sd8987/mlinux/moal_sta_cfg80211.h
deleted file mode 100755
index 193c64e..0000000
--- a/wlan_sd8987/mlinux/moal_sta_cfg80211.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/** @file moal_sta_cfg80211.h
- *
- * @brief This file contains the STA CFG80211 specific defines.
- *
- *
- * Copyright 2011-2021 NXP
- *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
- *
- */
-
-#ifndef _MOAL_STA_CFG80211_H_
-#define _MOAL_STA_CFG80211_H_
-
-/** Convert RSSI signal strength from dBm to mBm (100*dBm) */
-#define RSSI_DBM_TO_MDM(x) ((x)*100)
-
-mlan_status woal_register_sta_cfg80211(struct net_device *dev, t_u8 bss_type);
-
-#endif /* _MOAL_STA_CFG80211_H_ */
diff --git a/wlan_sd8987/mlinux/moal_uap_cfg80211.h b/wlan_sd8987/mlinux/moal_uap_cfg80211.h
deleted file mode 100755
index 7d6c805..0000000
--- a/wlan_sd8987/mlinux/moal_uap_cfg80211.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/** @file moal_uap_cfg80211.h
- *
- * @brief This file contains the uAP CFG80211 specific defines.
- *
- *
- * Copyright 2011-2021 NXP
- *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
- *
- */
-
-#ifndef _MOAL_UAP_CFG80211_H_
-#define _MOAL_UAP_CFG80211_H_
-
-#include "moal_uap.h"
-
-mlan_status woal_register_uap_cfg80211(struct net_device *dev, t_u8 bss_type);
-
-#endif /* _MOAL_UAP_CFG80211_H_ */
diff --git a/wlan_sd8987/mlinux/moal_wext.h b/wlan_sd8987/mlinux/moal_wext.h
deleted file mode 100755
index af13eff..0000000
--- a/wlan_sd8987/mlinux/moal_wext.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/** @file moal_wext.h
- *
- * @brief This file contains definition for wireless extension IOCTL call.
- *
- *
- * Copyright 2008-2021 NXP
- *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
- *
- */
-
-/********************************************************
-Change log:
-    10/21/2008: initial version
-********************************************************/
-
-#ifndef _WOAL_WEXT_H_
-#define _WOAL_WEXT_H_
-
-/** NF value for default scan */
-#define MRVDRV_NF_DEFAULT_SCAN_VALUE (-96)
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-/** Add event */
-#define IWE_STREAM_ADD_EVENT(i, c, e, w, l)                                    \
-	iwe_stream_add_event((i), (c), (e), (w), (l))
-/** Add point */
-#define IWE_STREAM_ADD_POINT(i, c, e, w, p)                                    \
-	iwe_stream_add_point((i), (c), (e), (w), (p))
-/** Add value */
-#define IWE_STREAM_ADD_VALUE(i, c, v, e, w, l)                                 \
-	iwe_stream_add_value((i), (c), (v), (e), (w), (l))
-#else
-/** Add event */
-#define IWE_STREAM_ADD_EVENT(i, c, e, w, l)                                    \
-	iwe_stream_add_event((c), (e), (w), (l))
-/** Add point */
-#define IWE_STREAM_ADD_POINT(i, c, e, w, p)                                    \
-	iwe_stream_add_point((c), (e), (w), (p))
-/** Add value */
-#define IWE_STREAM_ADD_VALUE(i, c, v, e, w, l)                                 \
-	iwe_stream_add_value((c), (v), (e), (w), (l))
-#endif
-
-extern struct iw_handler_def woal_handler_def;
-struct iw_statistics *woal_get_wireless_stats(struct net_device *dev);
-#endif /* _WOAL_WEXT_H_ */
diff --git a/wlan_src/.gitignore b/wlan_src/.gitignore
new file mode 100644
index 0000000..83120a9
--- /dev/null
+++ b/wlan_src/.gitignore
@@ -0,0 +1,9 @@
+*.mod
+*.d
+*.o
+*.cmd
+*.ko
+*.mod.c
+Module.symvers
+modules.order
+config
diff --git a/wlan_sd8987/Makefile b/wlan_src/Makefile
old mode 100755
new mode 100644
similarity index 67%
rename from wlan_sd8987/Makefile
rename to wlan_src/Makefile
index 69a199b..357c7b0
--- a/wlan_sd8987/Makefile
+++ b/wlan_src/Makefile
@@ -1,31 +1,39 @@
 #  File: Makefile
 #
-#  Copyright 2008-2021 NXP
+#  Copyright 2014-2024 NXP
 #
-#  This software file (the File) is distributed by NXP
-#  under the terms of the GNU General Public License Version 2, June 1991
-#  (the License).  You may use, redistribute and/or modify the File in
-#  accordance with the terms and conditions of the License, a copy of which
-#  is available by writing to the Free Software Foundation, Inc.,
-#  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
-#  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+#  NXP CONFIDENTIAL
+#  The source code contained or described herein and all documents related to
+#  the source code (Materials) are owned by NXP, its
+#  suppliers and/or its licensors. Title to the Materials remains with NXP,
+#  its suppliers and/or its licensors. The Materials contain
+#  trade secrets and proprietary and confidential information of NXP, its
+#  suppliers and/or its licensors. The Materials are protected by worldwide copyright
+#  and trade secret laws and treaty provisions. No part of the Materials may be
+#  used, copied, reproduced, modified, published, uploaded, posted,
+#  transmitted, distributed, or disclosed in any way without NXP's prior
+#  express written permission.
 #
-#  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
-#  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
-#  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
-#  this warranty disclaimer.
+#  No license under any patent, copyright, trade secret or other intellectual
+#  property right is granted to or conferred upon you by disclosure or delivery
+#  of the Materials, either expressly, by implication, inducement, estoppel or
+#  otherwise. Any license under such intellectual property rights must be
+#  express and approved by NXP in writing.
 #
+#  Alternatively, this software may be distributed under the terms of GPL v2.
+#  SPDX-License-Identifier:    GPL-2.0
+#
+
 CONFIG_COMPATDIR=n
 ifeq ($(CONFIG_COMPATDIR), y)
 COMPATDIR=/lib/modules/$(KERNELVERSION_X86)/build/compat-wireless-3.2-rc1-1/include
 CC ?=		$(CROSS_COMPILE)gcc -I$(COMPATDIR)
-else
-CC ?=		$(CROSS_COMPILE)gcc
 endif
+
 LD ?=		$(CROSS_COMPILE)ld
-STRIP ?= 	$(CROSS_COMPILE)strip
 BACKUP=		/root/backup
 YMD=		`date +%Y%m%d%H%M`
+
 #############################################################################
 # Configuration Options
 #############################################################################
@@ -40,86 +48,159 @@
 CONFIG_SD8997=n
 CONFIG_USB8997=n
 CONFIG_PCIE8997=n
-CONFIG_SD8987=y
+CONFIG_SD8987=n
 CONFIG_SD9097=n
+CONFIG_SD9177=y
+CONFIG_SD8801=n
+CONFIG_USB8801=n
 CONFIG_USB9097=n
 CONFIG_PCIE9097=n
 CONFIG_SD9098=n
 CONFIG_USB9098=n
 CONFIG_PCIE9098=n
+CONFIG_SDIW610=n
+CONFIG_USBIW610=n
+CONFIG_SDIW624=n
+CONFIG_SDAW693=n
+CONFIG_PCIEIW624=n
+CONFIG_USBIW624=n
+CONFIG_PCIEAW693=n
+
+
 # Debug Option
 # DEBUG LEVEL n/1/2:
 # n: NO DEBUG
 # 1: Only PRINTM(MMSG,...), PRINTM(MFATAL,...), ...
 # 2: All PRINTM()
 CONFIG_DEBUG=1
+
 # Enable STA mode support
 CONFIG_STA_SUPPORT=y
+
 # Enable uAP mode support
 CONFIG_UAP_SUPPORT=y
+
 # Enable WIFIDIRECT support
 CONFIG_WIFI_DIRECT_SUPPORT=y
-# Enable Wi-Fi Latency mode setting support
-CONFIG_WIFI_SET_LATENCY_MODE=y
+
+
 # Re-association in driver
 CONFIG_REASSOCIATION=y
+
+
 # Manufacturing firmware support
 CONFIG_MFG_CMD_SUPPORT=y
+
 # OpenWrt support
 CONFIG_OPENWRT_SUPPORT=n
+
 # Big-endian platform
 CONFIG_BIG_ENDIAN=n
-ifeq ($(CONFIG_DRV_EMBEDDED_SUPPLICANT), y)
-CONFIG_EMBEDDED_SUPP_AUTH=y
-else
-ifeq ($(CONFIG_DRV_EMBEDDED_AUTHENTICATOR), y)
-CONFIG_EMBEDDED_SUPP_AUTH=y
-endif
-endif
-#ifdef SDIO_MMC
+
+
+
+
 # SDIO suspend/resume
 CONFIG_SDIO_SUSPEND_RESUME=y
-#endif
+
 # DFS testing support
 CONFIG_DFS_TESTING_SUPPORT=y
-# Use static link for app build
-export CONFIG_STATIC_LINK=y
-CONFIG_ANDROID_KERNEL=y
+
+# Multi-channel support
+CONFIG_MULTI_CHAN_SUPPORT=y
+
+
+
+CONFIG_DUMP_TO_PROC=y
+
+CONFIG_TASKLET_SUPPORT=n
+
+
+
 #32bit app over 64bit kernel support
-CONFIG_USERSPACE_32BIT_OVER_KERNEL_64BIT=y
+CONFIG_USERSPACE_32BIT_OVER_KERNEL_64BIT=n
+
+GCC_VERSION := $(shell echo `gcc -dumpversion | cut -f1-2 -d.` \>= 4.4 | sed -e 's/\./*100+/g' | bc )
+ifeq ($(GCC_VERSION),1)
+	ccflags-y += -Wno-packed-bitfield-compat
+endif
+WimpGCC_VERSION := $(shell echo `gcc -dumpversion | cut -f1 -d.`| bc )
+ifeq ($(shell test $(WimpGCC_VERSION) -ge 7; echo $$?),0)
+ccflags-y += -Wimplicit-fallthrough=3
+endif
+#ccflags-y += -Wunused-but-set-variable
+#ccflags-y += -Wmissing-prototypes
+#ccflags-y += -Wold-style-definition
+#ccflags-y += -Wtype-limits
+#ccflags-y += -Wsuggest-attribute=format
+#ccflags-y += -Wmissing-include-dirs
+#ccflags-y += -Wshadow
+#ccflags-y += -Wsign-compare
+#ccflags-y += -Wunused-macros
+#ccflags-y += -Wmissing-field-initializers
+#ccflags-y += -Wstringop-truncation
+#ccflags-y += -Wmisleading-indentation
+#ccflags-y += -Wunused-const-variable
+
 #############################################################################
 # Select Platform Tools
 #############################################################################
+
+ifeq ($(ANDROID_BUILD), 1)
+    KERNEL_CFLAGS += -DANDROID
+    PWD := $(shell pwd)
+    KERNELDIR ?= $(KERNEL_SRC)
+    ccflags-y += -DANDROID_SDK_VERSION=$(ANDROID_SDK_VERSION)
+endif
+
 MODEXT = ko
-ccflags-y += -Wno-unknown-warning-option -Wno-typedef-redefinition -Wno-pointer-bool-conversion -Wno-self-assign -Wno-parentheses-equality
 ccflags-y += -I$(PWD)/mlan
 ccflags-y += -DLINUX
+
+
+
+
+
+
 ARCH ?= arm64
-CONFIG_IMX_SUPPORT=n
+CONFIG_IMX_SUPPORT=y
 ifeq ($(CONFIG_IMX_SUPPORT),y)
 ccflags-y += -DIMX_SUPPORT
+ifneq ($(ANDROID_PRODUCT_OUT),)
+ccflags-y += -DIMX_ANDROID
+ccflags-y += -Wno-implicit-fallthrough
+CONFIG_ANDROID_KERNEL=y
 endif
-KERNELDIR ?= $(KERNEL_SRC)
-CROSS_COMPILE ?= /usr/local/arm/androidQ_toolchain/aarch64-linux-android-4.9/bin/aarch64-linux-android-
+endif
+
 LD += -S
+
 BINDIR = ../bin_wlan
 APPDIR= $(shell if test -d "mapp"; then echo mapp; fi)
+
 #############################################################################
 # Compiler Flags
 #############################################################################
+
 	ccflags-y += -I$(KERNELDIR)/include
+	ccflags-y += -DMLAN_RELEASE_VERSION='"505.p7a"'
+
 	ccflags-y += -DFPNUM='"92"'
+
 ifeq ($(CONFIG_DEBUG),1)
 	ccflags-y += -DDEBUG_LEVEL1
 endif
+
 ifeq ($(CONFIG_DEBUG),2)
 	ccflags-y += -DDEBUG_LEVEL1
 	ccflags-y += -DDEBUG_LEVEL2
 	DBG=	-dbg
 endif
+
 ifeq ($(CONFIG_64BIT), y)
 	ccflags-y += -DMLAN_64BIT
 endif
+
 ifeq ($(CONFIG_STA_SUPPORT),y)
 	ccflags-y += -DSTA_SUPPORT
 ifeq ($(CONFIG_REASSOCIATION),y)
@@ -130,6 +211,7 @@
 CONFIG_STA_WEXT=n
 CONFIG_STA_CFG80211=n
 endif
+
 ifeq ($(CONFIG_UAP_SUPPORT),y)
 	ccflags-y += -DUAP_SUPPORT
 else
@@ -137,41 +219,59 @@
 CONFIG_UAP_WEXT=n
 CONFIG_UAP_CFG80211=n
 endif
+
 ifeq ($(CONFIG_WIFI_DIRECT_SUPPORT),y)
 	ccflags-y += -DWIFI_DIRECT_SUPPORT
 endif
-# Enables setting WiFi low-latency mode feature.
-ifeq ($(CONFIG_WIFI_SET_LATENCY_MODE), y)
-  ccflags-y += -DWIFI_LATENCY_MODE_SUPPORT
-endif
+
 ifeq ($(CONFIG_MFG_CMD_SUPPORT),y)
 	ccflags-y += -DMFG_CMD_SUPPORT
 endif
+
 ifeq ($(CONFIG_BIG_ENDIAN),y)
 	ccflags-y += -DBIG_ENDIAN_SUPPORT
 endif
+
 ifeq ($(CONFIG_USERSPACE_32BIT_OVER_KERNEL_64BIT),y)
 	ccflags-y += -DUSERSPACE_32BIT_OVER_KERNEL_64BIT
 endif
-#ifdef SDIO_MMC
+
 ifeq ($(CONFIG_SDIO_SUSPEND_RESUME),y)
 	ccflags-y += -DSDIO_SUSPEND_RESUME
 endif
-#endif
+
+ifeq ($(CONFIG_MULTI_CHAN_SUPPORT),y)
+	ccflags-y += -DMULTI_CHAN_SUPPORT
+endif
+
 ifeq ($(CONFIG_DFS_TESTING_SUPPORT),y)
 	ccflags-y += -DDFS_TESTING_SUPPORT
 endif
+
+
 ifeq ($(CONFIG_ANDROID_KERNEL), y)
 	ccflags-y += -DANDROID_KERNEL
+	CONFIG_DUMP_TO_PROC=y
 endif
+
+ifeq ($(CONFIG_DUMP_TO_PROC), y)
+	ccflags-y += -DDUMP_TO_PROC
+endif
+
+ifeq ($(CONFIG_TASKLET_SUPPORT), y)
+	ccflags-y += -DTASKLET_SUPPORT
+endif
+
 ifeq ($(CONFIG_OPENWRT_SUPPORT), y)
 	ccflags-y += -DOPENWRT
 endif
+
 ifeq ($(CONFIG_T50), y)
 	ccflags-y += -DT50
 	ccflags-y += -DT40
 	ccflags-y += -DT3T
 endif
+
 ifeq ($(CONFIG_SD8887),y)
 	CONFIG_SDIO=y
 	ccflags-y += -DSD8887
@@ -200,10 +300,34 @@
 	CONFIG_SDIO=y
 	ccflags-y += -DSD9097
 endif
+ifeq ($(CONFIG_SDIW610),y)
+	CONFIG_SDIO=y
+	ccflags-y += -DSDIW610
+endif
+ifeq ($(CONFIG_SDIW624),y)
+	CONFIG_SDIO=y
+	ccflags-y += -DSDIW624
+endif
+ifeq ($(CONFIG_SDAW693),y)
+	CONFIG_SDIO=y
+	ccflags-y += -DSDAW693
+endif
+ifeq ($(CONFIG_SD9177),y)
+	CONFIG_SDIO=y
+	ccflags-y += -DSD9177
+endif
+ifeq ($(CONFIG_SD8801),y)
+	CONFIG_SDIO=y
+	ccflags-y += -DSD8801
+endif
 ifeq ($(CONFIG_SD9098),y)
 	CONFIG_SDIO=y
 	ccflags-y += -DSD9098
 endif
+ifeq ($(CONFIG_USB8801),y)
+	CONFIG_MUSB=y
+	ccflags-y += -DUSB8801
+endif
 ifeq ($(CONFIG_USB8897),y)
 	CONFIG_MUSB=y
 	ccflags-y += -DUSB8897
@@ -220,6 +344,14 @@
 	CONFIG_MUSB=y
 	ccflags-y += -DUSB9097
 endif
+ifeq ($(CONFIG_USBIW610),y)
+	CONFIG_MUSB=y
+	ccflags-y += -DUSBIW610
+endif
+ifeq ($(CONFIG_USBIW624),y)
+	CONFIG_MUSB=y
+	ccflags-y += -DUSBIW624
+endif
 ifeq ($(CONFIG_USB9098),y)
 	CONFIG_MUSB=y
 	ccflags-y += -DUSB9098
@@ -240,6 +372,14 @@
 	CONFIG_PCIE=y
 	ccflags-y += -DPCIE9098
 endif
+ifeq ($(CONFIG_PCIEIW624),y)
+	CONFIG_PCIE=y
+	ccflags-y += -DPCIEIW624
+endif
+ifeq ($(CONFIG_PCIEAW693),y)
+	CONFIG_PCIE=y
+	ccflags-y += -DPCIEAW693
+endif
 ifeq ($(CONFIG_SDIO),y)
 	ccflags-y += -DSDIO
 	ccflags-y += -DSDIO_MMC
@@ -250,6 +390,7 @@
 ifeq ($(CONFIG_PCIE),y)
 	ccflags-y += -DPCIE
 endif
+
 ifeq ($(CONFIG_MAC80211_SUPPORT),y)
 	ccflags-y += -DMAC80211_SUPPORT
 endif
@@ -259,25 +400,13 @@
 ifeq ($(CONFIG_MAC80211_SUPPORT_MESH),y)
 	ccflags-y += -DMAC80211_SUPPORT_MESH
 endif
-# add -Wno-packed-bitfield-compat when GCC version greater than 4.4
-GCC_VERSION := $(shell echo `gcc -dumpversion | cut -f1-2 -d.` \>= 4.4 | sed -e 's/\./*100+/g' | bc )
-ifeq ($(GCC_VERSION),1)
-	ccflags-y += -Wno-packed-bitfield-compat
-endif
-WimpGCC_VERSION := $(shell echo `gcc -dumpversion | cut -f1 -d.`| bc )
-ifeq ($(shell test $(WimpGCC_VERSION) -ge 7; echo $$?),0)
-ccflags-y += -Wimplicit-fallthrough=3
-endif
-#ccflags-y += -Wunused-but-set-variable
-#ccflags-y += -Wmissing-prototypes
-#ccflags-y += -Wold-style-definition
-#ccflags-y += -Wtype-limits
-#ccflags-y += -Wsuggest-attribute=format
-#ccflags-y += -Wmissing-include-dirs
+
 #############################################################################
 # Make Targets
 #############################################################################
+
 ifneq ($(KERNELRELEASE),)
+
 ifeq ($(CONFIG_WIRELESS_EXT),y)
 ifeq ($(CONFIG_WEXT_PRIV),y)
 	# Enable WEXT for STA
@@ -291,6 +420,7 @@
 	CONFIG_UAP_WEXT=n
 endif
 endif
+
 # Enable CFG80211 for STA
 ifeq ($(CONFIG_CFG80211),y)
 	CONFIG_STA_CFG80211=y
@@ -301,6 +431,7 @@
 	CONFIG_STA_CFG80211=n
 endif
 endif
+
 # OpenWrt
 ifeq ($(CONFIG_OPENWRT_SUPPORT), y)
 ifeq ($(CPTCFG_CFG80211),y)
@@ -313,6 +444,7 @@
 endif
 endif
 endif
+
 # Enable CFG80211 for uAP
 ifeq ($(CONFIG_CFG80211),y)
 	CONFIG_UAP_CFG80211=y
@@ -323,6 +455,7 @@
 	CONFIG_UAP_CFG80211=n
 endif
 endif
+
 # OpenWrt
 ifeq ($(CONFIG_OPENWRT_SUPPORT), y)
 ifeq ($(CPTCFG_CFG80211),y)
@@ -335,16 +468,19 @@
 endif
 endif
 endif
+
 ifneq ($(CONFIG_STA_SUPPORT),y)
 	CONFIG_WIFI_DIRECT_SUPPORT=n
 	CONFIG_STA_WEXT=n
 	CONFIG_STA_CFG80211=n
 endif
+
 ifneq ($(CONFIG_UAP_SUPPORT),y)
 	CONFIG_WIFI_DIRECT_SUPPORT=n
 	CONFIG_UAP_WEXT=n
 	CONFIG_UAP_CFG80211=n
 endif
+
 ifeq ($(CONFIG_STA_SUPPORT),y)
 ifeq ($(CONFIG_STA_WEXT),y)
 	ccflags-y += -DSTA_WEXT
@@ -361,6 +497,7 @@
 	ccflags-y += -DUAP_CFG80211
 endif
 endif
+
 print:
 ifeq ($(CONFIG_STA_SUPPORT),y)
 ifeq ($(CONFIG_STA_WEXT),n)
@@ -378,16 +515,23 @@
 endif
 endif
 endif
+
+
+
+
+
 MOALOBJS =	mlinux/moal_main.o \
 		mlinux/moal_ioctl.o \
 		mlinux/moal_shim.o \
 		mlinux/moal_eth_ioctl.o \
 		mlinux/moal_init.o
+
 MLANOBJS =	mlan/mlan_shim.o mlan/mlan_init.o \
 		mlan/mlan_txrx.o \
 		mlan/mlan_cmdevt.o mlan/mlan_misc.o \
 		mlan/mlan_cfp.o \
 		mlan/mlan_module.o
+
 MLANOBJS += mlan/mlan_wmm.o
 ifeq ($(CONFIG_MUSB),y)
 MLANOBJS += mlan/mlan_usb.o
@@ -440,16 +584,26 @@
 MOALOBJS += mlinux/moal_cfg80211_util.o
 MOALOBJS += mlinux/moal_uap_cfg80211.o
 endif
+
 ifdef CONFIG_PROC_FS
 MOALOBJS += mlinux/moal_proc.o
 MOALOBJS += mlinux/moal_debug.o
 endif
+
 ifeq ($(CONFIG_MAC80211_SUPPORT),y)
 MOALOBJS += mlinux/moal_mac80211.o
 MLANOBJS += mlan/mlan_mac80211.o
 endif
+
+
+
+
+
+
+
 obj-m := mlan.o
 mlan-objs := $(MLANOBJS)
+
 ifeq ($(CONFIG_MUSB),y)
 MOALOBJS += mlinux/moal_usb.o
 endif
@@ -461,39 +615,122 @@
 endif
 obj-m += moal.o
 moal-objs := $(MOALOBJS)
+
 # Otherwise we were called directly from the command line; invoke the kernel build system.
 else
-EXTRA_SYMBOLS += ${OUT_DIR}/../nxp-driver/wlan_sd8987/Module.symvers
+
 default:
-	$(MAKE) -C $(KERNELDIR) M=$(M) ARCH=$(ARCH) KBUILD_EXTRA_SYMBOLS="$(EXTRA_SYMBOLS)" modules
-modules_install:
-	$(MAKE) INSTALL_MOD_STRIP=1 M=$(M) -C $(KERNELDIR) modules_install
-	mkdir -p ${OUT_DIR}/../vendor_lib/modules
-	cd ${OUT_DIR}/$(M)/; find -name mlan.ko -exec cp {} ${OUT_DIR}/../vendor_lib/modules/mlan.ko \;
-	cd ${OUT_DIR}/$(M)/; find -name moal.ko -exec cp {} ${OUT_DIR}/../vendor_lib/modules/moal.ko \;
+	$(MAKE) -C $(KERNELDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+
 endif
+
 ###############################################################
+
 export		CC LD ccflags-y KERNELDIR
-.PHONY: mapp/mlanconfig mapp/mlanutl clean distclean
+
+ifeq ($(CONFIG_STA_SUPPORT),y)
+ifeq ($(CONFIG_UAP_SUPPORT),y)
+.PHONY: mapp/mlanconfig mapp/mlan2040coex mapp/mlanevent mapp/uaputl mapp/mlanutl clean distclean
+else
+.PHONY: mapp/mlanconfig mapp/mlanevent mapp/mlan2040coex mapp/mlanutl mapp/mlanwls mapp/nanapp clean distclean
+endif
+else
+ifeq ($(CONFIG_UAP_SUPPORT),y)
+.PHONY: mapp/mlanevent mapp/uaputl clean distclean
+endif
+endif
 	@echo "Finished Making NXP Wlan Linux Driver"
+
+ifeq ($(CONFIG_STA_SUPPORT),y)
 mapp/mlanconfig:
-	$(MAKE) -C $@
 mapp/mlanutl:
 	$(MAKE) -C $@
+mapp/mlan2040coex:
+	$(MAKE) -C $@
+endif
+ifeq ($(CONFIG_UAP_SUPPORT),y)
+mapp/uaputl:
+	$(MAKE) -C $@
+endif
+mapp/mlanwls:
+	$(MAKE) -C $@
+mapp/mlanevent:
+	$(MAKE) -C $@
+mapp/nanapp:
+	$(MAKE) -C $@
+
 echo:
-build:		echo default
+
+appsbuild:
+
 	@if [ ! -d $(BINDIR) ]; then \
 		mkdir $(BINDIR); \
 	fi
+
+ifeq ($(CONFIG_STA_SUPPORT),y)
+	cp -f README_MLAN $(BINDIR)
+	cp -f README $(BINDIR)
+	cp -f README_RBC $(BINDIR)
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/mlanutl $@ INSTALLDIR=$(BINDIR)
+	$(MAKE) -C mapp/mlan2040coex $@ INSTALLDIR=$(BINDIR)
+endif
+endif
+ifeq ($(CONFIG_UAP_SUPPORT),y)
+	cp -f README_UAP $(BINDIR)
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/uaputl $@ INSTALLDIR=$(BINDIR)
+endif
+endif
+	cp -f README_MLANWLS $(BINDIR)
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/mlanwls $@ INSTALLDIR=$(BINDIR)
+endif
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/mlanevent $@ INSTALLDIR=$(BINDIR)
+endif
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/nanapp $@ INSTALLDIR=$(BINDIR)
+endif
+
+build:		echo default
+
+	@if [ ! -d $(BINDIR) ]; then \
+		mkdir $(BINDIR); \
+	fi
+
 	cp -f mlan.$(MODEXT) $(BINDIR)/mlan$(DBG).$(MODEXT)
+
 	cp -f moal.$(MODEXT) $(BINDIR)/moal$(DBG).$(MODEXT)
 	cp -rpf script/load $(BINDIR)/
 	cp -rpf script/unload $(BINDIR)/
+
+ifeq ($(CONFIG_STA_SUPPORT),y)
 	cp -f README_MLAN $(BINDIR)
+	cp -f README $(BINDIR)
+	cp -f README_RBC $(BINDIR)
 ifneq ($(APPDIR),)
-	$(MAKE) -C mapp/mlanconfig $@ INSTALLDIR=$(BINDIR)
 	$(MAKE) -C mapp/mlanutl $@ INSTALLDIR=$(BINDIR)
+	$(MAKE) -C mapp/mlan2040coex $@ INSTALLDIR=$(BINDIR)
 endif
+endif
+ifeq ($(CONFIG_UAP_SUPPORT),y)
+	cp -f README_UAP $(BINDIR)
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/uaputl $@ INSTALLDIR=$(BINDIR)
+endif
+endif
+	cp -f README_MLANWLS $(BINDIR)
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/mlanwls $@ INSTALLDIR=$(BINDIR)
+endif
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/mlanevent $@ INSTALLDIR=$(BINDIR)
+endif
+ifneq ($(APPDIR),)
+	$(MAKE) -C mapp/nanapp $@ INSTALLDIR=$(BINDIR)
+endif
+
 clean:
 	-find . -name "*.o" -exec rm {} \;
 	-find . -name "*.ko" -exec rm {} \;
@@ -506,34 +743,23 @@
 	-find . -name "*dwo" -exec rm {} \;
 	-rm -rf .tmp_versions
 ifneq ($(APPDIR),)
-	$(MAKE) -C mapp/mlanconfig $@
+ifeq ($(CONFIG_STA_SUPPORT),y)
 	$(MAKE) -C mapp/mlanutl $@
+	$(MAKE) -C mapp/mlan2040coex $@
+endif
+ifeq ($(CONFIG_UAP_SUPPORT),y)
+	$(MAKE) -C mapp/uaputl $@
+endif
+	$(MAKE) -C mapp/mlanwls $@
+	$(MAKE) -C mapp/mlanevent $@
+	$(MAKE) -C mapp/nanapp $@
 endif
 #ifdef SDIO
 #endif // SDIO
+
 install: default
+
 	cp -f mlan.$(MODEXT) $(INSTALLDIR)/mlan$(DBG).$(MODEXT)
 	cp -f moal.$(MODEXT) $(INSTALLDIR)/moal$(DBG).$(MODEXT)
 	echo $(INSTALLDIR)
 	echo "MX Driver Installed"
-distclean:
-	-find . -name "*.o" -exec rm {} \;
-	-find . -name "*.orig" -exec rm {} \;
-	-find . -name "*.swp" -exec rm {} \;
-	-find . -name "*.*~" -exec rm {} \;
-	-find . -name "*~" -exec rm {} \;
-	-find . -name "*.d" -exec rm {} \;
-	-find . -name "*.a" -exec rm {} \;
-	-find . -name "tags" -exec rm {} \;
-	-find . -name ".*" -exec rm -rf 2> /dev/null \;
-	-find . -name "*.ko" -exec rm {} \;
-	-find . -name ".*.cmd" -exec rm {} \;
-	-find . -name "*.mod.c" -exec rm {} \;
-	-find . -name ".*.dwo" -exec rm {} \;
-	-find . -name "*dwo" -exec rm {} \;
-	-rm -rf .tmp_versions
-ifneq ($(APPDIR),)
-	$(MAKE) -C mapp/mlanconfig $@
-	$(MAKE) -C mapp/mlanutl $@
-endif
-# End of file
diff --git a/wlan_src/README b/wlan_src/README
new file mode 100644
index 0000000..9aea77f
--- /dev/null
+++ b/wlan_src/README
@@ -0,0 +1,635 @@
+# MXM Wi-Fi Driver
+
+===============================================================================
+			U S E R  M A N U A L
+
+ Copyright 2008-2024 NXP
+
+
+1) FOR DRIVER BUILD
+
+	Goto source code directory wlan_src/.
+	make [clean] build
+	The driver and utility binaries can be found in ../bin_xxxx directory.
+	The driver code supports Linux kernel from 2.6.32 to 6.9.10.
+
+2) FOR DRIVER INSTALL
+
+	a) Copy firmware image to /lib/firmware/nxp/, copy wifi_mod_para.conf to /lib/firmware/nxp/.
+	b) Install WLAN driver
+	   There are drv_mode, max_sta_bss, max_uap_bss etc. module parameters.
+		The bit settings of drv_mode are,
+			Bit 0 :  STA
+			Bit 1 :  uAP
+			Bit 2 :  WIFIDIRECT
+			Bit 4 :  NAN
+
+		max_sta_bss: Maximum number of STA BSS (default 1, max 1)
+		sta_name: Name of the STA interface (default: "mlan")
+		max_uap_bss: Maximum number of uAP BSS (default 1, max 2)
+		uap_name: Name of the uAP interface (default: "uap")
+		max_wfd_bss: Maximum number of WIFIDIRECT BSS (default 1, max 1)
+		wfd_name: Name of the WIFIDIRECT interface (default: "wfd")
+		max_vir_bss: Number of Virtual interfaces (default 0)
+		nan_name: Name of the NAN interface (default: "nan")
+		max_nan_bss: Number of NAN interfaces (default 1)
+		uap_oper_ctrl: uAP operation control when in-STA disconnect with ext-AP
+                               0: default do nothing, 2: uAP stops and restarts automatically
+	   For example, to install multi-chip driver,
+		insmod mlan.ko
+		insmod moal.ko mod_para=nxp/wifi_mod_para.conf [drvdbg=0x7]
+	   wifi_mod_para.conf is used to support multi-chips which has different load module parameters. It contains
+           the module parameters for different chips.
+	c) Uninstall WLAN driver,
+		ifconfig mlanX down
+		ifconfig uapX down
+		rmmod moal
+		rmmod mlan
+
+	pref_dbc
+	This load time parameter is used to config preferred DBC mode and takes effect when dmcs is enabled
+	This parameter only used for AW693(BB)
+
+	Usage:
+		pref_dbc=[value]
+		insmod mlan.ko; insmod pcieaw693.ko fw_name=aw693w.bin dmcs=1 pref_dbc=1
+		<value = 0> : default preferred DBC mode
+		<value = 1> : Enable preferred DBC mode
+		<value = 2> : Disable preferred DBC mode
+
+	Example :
+		insmod mlan.ko; insmod pcieaw693.ko fw_name=aw693w.bin dmcs=1 pref_dbc=1 : Enable preferred DBC mode
+		insmod mlan.ko; insmod pcieaw693.ko fw_name=aw693w.bin dmcs=1 pref_dbc=2 : Disable preferred DBC mode
+
+	To load driver with MFG firmware file, use mfg_mode=1 when insmod WLAN driver and
+	specify MFG firmware name if needed.
+
+	To load driver with rf_test firmware file, use rf_test_mode=1 when insmod WLAN driver.
+	This parameter only used for 9177(FC)
+
+	There are some other parameters for debugging purpose etc. Use modinfo to check details.
+	drvdbg=<bit mask of driver debug message control>
+	dev_cap_mask=<Bit mask of the device capability>
+	This load parameter is uses to configure device features support
+	Usage:
+		dev_cap_mask=<value to be configured>
+		<BIT0-BIT15> : Represents features supported
+		<BIT16>: Indicates support for 11AX
+		<BIT17>: Indicates support for 6G
+	Example:
+		To disable 11AX and 6G support: dev_cap_mask=0xfffcffff
+
+	mac_addr=xx:xx:xx:xx:xx:xx <override the MAC address (in hex)>
+	auto_ds=0|1|2 <use MLAN default | enable auto deepsleep | disable auto deepsleep>
+	ext_scan=0|1|2 <use MLAN default | Enable Extended Scan| Enable Enhanced Extended Scan>
+	p2a_scan=0|1|2 <MLAN default | Enable passive to active scan for DFS channel | Disable passive to active scan for DFS channel>
+	scan_chan_gap=x <Time gap between two scans in milliseconds when connected to AP (max value 500ms)>
+	net_rx=0|1 <use netif_rx/netif_rx_ni in rx | use netif_receive_skb in rx (default)>
+	amsdu_deaggr=0|1 <buf copy in amsud deaggregation | avoid buf copy in amsud deaggregation (default)>
+	bootup_cal_ctrl=0|1 <disable boot time config default | enable boot time config>
+	ps_mode=0|1|2 <use MLAN default | enable IEEE PS mode | disable IEEE PS mode>
+	sched_scan=0|1 <disable sched_scan | enable sched_scan default>
+	max_tx_buf=2048|4096|8192 <maximum AMSDU Tx buffer size>
+	pm_keep_power=1|0 <PM keep power in suspend (default) | PM no power in suspend>
+	shutdown_hs=1|0 <Enable HS when shutdown | No HS when shutdown (default)>
+	cfg_11d=0|1|2 <use MLAN default | enable 11d | disable 11d>
+	dts_enable=0|1 <Disable DTS | Enable DTS (default)>
+	fw_name = <FW file name>
+		e.g. copy pcieuart9098_combo_v1.bin to firmware directory, fw_name=nxp/pcieuart9098_combo_v1.bin
+	hw_name = <hardware name>
+	reg_work=0|1 <Disable register work queue| Enable register work queue>
+	hw_test=0|1 <Disable hardware test (default) | Enable hardware test>
+	fw_serial=0|1 <support parallel download FW | support serial download FW (default)>
+	req_fw_nowait=0|1 <use request_firmware API (default) | use request_firmware_nowait API>
+	dfs53cfg=0|1|2 <use Fw Default | New W53 | Old W53>
+	mcs32=0|1 <disable HT MCS32 support | enable HT MCS32 (default)>
+	For 9097/9098/IW624/AW693: antcfg=0x101|0x303|.. <Bit0: Tx/Rx Path A for 2G, Bit1: Tx/Rx Path B for 2G, Bit8: Tx/Rx Path A for 5G, Bit9: Tx/Rx Path B for 5G>
+		For AW693, it's recommended to use mod_para configuration file for antcfg as MAC1 supports 2x2 and MAC2 supports only 1x1.
+	For 8897/8997: antcfg=0x11|0x13|0x33 <Bit0:Rx Path A, Bit1:Rx Path B, Bit 4:Tx Path A, Bit 5:Tx Path B>
+	For others: antcfg=0|1|2|0xffff <default | Tx/Rx antenna 1 | Tx/Rx antenna 2 | enable antenna diversity>
+	slew_rate: Slew Rate Control value = 0|1|2|3 (0 is the slowest slew rate and 03 has the highest slew rate (default))
+	init_cfg=<init config (MAC addresses, registers etc.) file name>
+		e.g. copy init_cfg.conf to firmware directory, init_cfg=nxp/init_cfg.conf
+	cal_data_cfg=<CAL data config file name>
+		e.g. copy cal_data.conf to firmware directory, cal_data_cfg=nxp/cal_data.conf
+		Note: Loading driver with 8887 must include correct cal_data_cfg parameter.
+	dpd_data_cfg=<DPD data config file name>
+		e.g. copy dpd_data.conf to firmware directory, dpd_data_cfg=nxp/dpd_data.conf
+	txpwrlimit_cfg=<Tx power limit config file name>
+		e.g. copy txpwrlimit_cfg_set.conf to firmware directory, txpwrlimit_cfg=nxp/txpwrlimit_cfg_set.conf
+		txpwrlimit_cfg_set.conf file should be the binary format file generate by mlanutl application
+	cntry_txpwr=0|1|2
+                  0: Disable setting tx power table of country (default)
+                  1: Enable setting tx power table of country
+                  2: Enable setting rgpower table of country
+	init_hostcmd_cfg=<init hostcmd config file name>
+		e.g. copy init_hostcmd_cfg.conf to firmware directory, init_hostcmd_cfg=nxp/init_hostcmd_cfg.conf
+	band_steer_cfg=<band steer config file name>
+		e.g. generate bscfg.conf by band_steer_cfg.conf, then copy bscfg.conf to firmware directory, band_steer_cfg=nxp/bscfg.conf
+	sdio_rx_aggr=1|0 <Enable SDIO rx aggr (default) | Disable SDIO rx aggr>
+	cfg80211_wext=<bit mask of CFG80211 and WEXT control>
+		Bit 0: STA WEXT
+		Bit 1: uAP WEXT
+		Bit 2: STA CFG80211
+		Bit 3: uAP CFG80211
+	cfg80211_drcs=1|0 <Enable DRCS support (default) | Disable DRCS support>
+	skip_fwdnld=0|1 <enable FW download support (default) | disable FW download support>
+	wq_sched_prio: Priority for work queue
+	wq_sched_policy: Scheduling policy for work queue
+		(0: SCHED_NORMAL, 1: SCHED_FIFO, 2: SCHED_RR, 3: SCHED_BATCH, 5: SCHED_IDLE)
+		Please note that, both wq_sched_prio and wq_sched_policy should be provided
+		as module parameters. If wq_sched_policy is (0, 3 or 5), then wq_sched_prio
+		must be 0. wq_sched_prio should be 1 to 99 otherwise.
+	rx_work=0|1|2 <default (enabled for multi-core) | Enable rx_work_queue | Disable rx_work_queue>
+	tx_work=0|1 <Disable tx_work_queue | Enable tx_work_queue (default on iMX)>
+	tx_skb_clone=0|1 <Disable tx_skb_clone | Enable tx_skb_clone (default on iMX)>
+	pmqos=0|1 <Disable pmqos | Enable pmqos (default on iMX)>
+	rps=0|x <Disables rps (default) | bit0-bit4 (0x1-0xf) Enables rps on specific cpu>
+	intmode=0|1 <SDIO Interrupt Mode (default) | GPIO Interrupt Mode>
+	gpiopin=0|x <GPIO pin number when intmode=1 (default 0, HW mapped intr on GPIO-21)>
+	pcie_int_mode=0|1 <Legacy mode, MSI mode (default)>
+	ring_size=32|64|128|256|512 <adma ring size for 9097/9098>
+	aggrctrl=1|0 <enable Tx aggr | disable Tx aggr>
+	usb_aggr=0|1|2 <use MLAN default (disabled) | enable USB aggr | disable USB aggr>
+	low_power_mode_enable=0|1 <disable low power mode (default)| enable low power mode>
+	  When low power mode is enabled, the output power will be clipped at ~+10dBm and the
+	  expected PA current is expected to be in the 80-90 mA range for b/g/n modes
+	wakelock_timeout=<set wakelock_timeout value (ms)>
+	pmic=0|1 <No pmic configure cmd sent to firmware | Send pmic configure cmd to firmware>
+	indication_gpio=0xXY <GPIO to indicate wakeup source and its level; high four bits X:
+                  level(0/1) for normal wakeup; low four bits Y: GPIO pin number. This parameter
+                  only works with specific board and firmware.>
+	hs_wake_interval=<Host sleep wakeup interval,it will round to nearest multiple dtim*beacon_period in fw>
+	disconnect_on_suspend=0|1 <Disable disconnect wifi on suspend (default) | Enable disconnect wifi on suspend>
+	hs_mimo_switch=0|1 <Disable dynamic MIMO-SISO switch during host sleep (default) | Enable dynamic MIMO-SISO switch during host sleep>
+	hs_auto_arp=0|1 <disable hs_auto_arp (default) | enable hs_auto_arp>
+	gtk_rekey_offload=0|1|2 <disable gtk_rekey_offload|enable gtk_rekey_offload (default) | enable gtk_rekey_offload in suspend mode only>
+	napi=0|1 <disable napi | enable napi>
+	fixed_beacon_buffer=0|1 <allocate default buffer size (default) | allocate max buffer size>
+	GoAgeoutTime=0|x <use default ageout time (default) | set Go age out time xTU(TU 100ms)>
+	multi_dtim=0|x <use default DTIM interval(default) | set x*beacon_period as DTIM interval>
+	inact_tmo=0|x <use default IEEE ps inactivity timout value (default) | use IEEE ps inactivity timeout value x ms>
+	drcs_chantime_mode=0|x <channel time and mode for DRCS, use default value (default) | use setting value>
+	  Bit31~Bit24:Channel time for channel index0;
+	  Bit23~Bit16:mode for channel index0; 0|1 <PM1 | Null2Self>
+	  Bit15~Bit8:Channel time for channel index1;
+	  Bit7~Bit0:mode for channel index1; 0|1 <PM1 | Null2Self>
+	roamoffload_in_hs=0|1 <always enable fw roaming (default) | enable fw roaming only when host suspend>
+	uap_max_sta: Maximum number of STA for UAP/GO (default 0, max STA number for UAP/GO supported in FW)
+	wacp_mode=0|1|2 <disable WACP (default) | WACP mode 1 | WACP mode 2>
+	dfs_offload=0|1 <disable dfs offload (default) | enable dfs offload>
+	indrstcfg=x <high byte: GPIO pin number (255 default); low byte: IR mode (0: disable, 1: out-of-band, 2: in band)>
+	auto_fw_reload=0|1|3 <disable|enable PCIE FLR|enable PCIE InBand Reset (default)>
+	auto_fw_reload=0|1 <disable|enable InBand Reset (default)>
+	dmcs=0|1|2 <firmware default (default) | enable dynamic mapping | disable dynamic mapping>
+	host_mlme=0|1 <Operate in non-host_mlme mode | Operate in host_mlme mode (default)>
+		for supplicant/authenticator running on host side, WPA3 support is available only in host_mlme mode
+		for chipset 89xx FP-92, 90xx and later, host_mlme restricted to 1
+	disable_regd_by_driver=0|1 <reg domain set by driver enable | reg domain set by driver disable (default)>
+	reg_alpha2=<Regulatory alpha2 (default NULL)>
+	country_ie_ignore=0|1 <Follow countryIE from AP and beacon hint enable | Ignore countryIE from AP and beacon hint disable (default)>
+	beacon_hints=0|1 <enable beacon hints | disable beacon hints (default)>
+	mon_filter=x <Bit6:TX frames excluding control; Bit5:non-bss beacons; Bit3:unicast destined non-promiscuous frames only; Bit2:data frames; Bit1:control frames; Bit0:management frames>
+	edmac_ctrl=0|1 <Disable edmac EU adaptivity (default) | Enable edmac EU adaptivity>
+	chan_track=0|1 <restore channel tracking parameters(default) | set channel tracking new parameters> for 9098 only
+	keep_previous_scan=0|1, <Flush previous scan result before start scan | Keep previous scan result(default)>
+	auto_11ax=0|1, <disable auto_11ax | enable auto_11ax(default)>
+	dual_nb=0|1, <default combo FW name - single narrowband (default) | default combo FW name - dual narrowband>
+	fw_data_cfg=0|x <disable configuration for custom Fw data(default) | set configuration for custom Fw data>
+		Configurations for fw_data_cfg:
+		Bit 0: Configuration for Fw remapping addr
+		Bit 1: Configuration for USB endpoint
+		BIT 2: Configuration for DPD current optimizations
+	mclient_scheduling=0|1 <disable multi-client scheduling | enable multi-client scheduling (default)>
+	tx_budget=xxx <airtime tx budget for multi-client scheduling in usec, 0 - disable, 2600 - default>
+	reject_addba_req=0(default)|1|2|3 <set the conditions of rejecting addba request>
+		The conditions are:
+		Bit 0 : 1   -- reject the addba request when host sleep activated
+		Bit 1 : 1   -- reject the addba request when FW auto re-connect enabled
+		               this bit is only used with STA BSS
+		others      -- reserved
+
+	Note: On some platforms (e.g. PXA910/920) double quotation marks ("") need to used
+	for module parameters.
+		insmod sdxxx.ko "<para1> <para2> ..."
+
+3) FOR DRIVER PROC & DEBUG
+
+	The following info are provided in /proc/net/mwlan/adapterX/mlanY|uapY|wfdY/info,
+	on kernel 2.6.24 or later, the entry is /proc/mwlan/adapterX/mlanY|uapY|wfdY/info.
+
+	driver_name = "wlan" or "uap"
+	driver_version = <chip id, firmware version and driver version>
+	interface_name = "mlanX", "uapX" or "wfdX"
+	bss_mode = "Ad-hoc" | "Managed" | "Auto" | "Unknown"
+	media_state = "Disconnected" | "Connected"
+	mac_address = <6-byte adapter MAC address>
+	multicase_count = <multicast address count>     // Only for STA
+	essid = <current SSID>                          // Only for STA
+	bssid = <current BSSID>                         // Only for STA
+	channel = <current channel>                     // Only for STA
+	region_code = <current region code>             // Only for STA
+	multicast_address[n] = <multicast address>      // Only for STA
+	num_tx_bytes = <number of bytes sent to device>
+	num_rx_bytes = <number of bytes received from device and sent to kernel>
+	num_tx_pkts = <number of packets sent to device>
+	num_rx_pkts = <number of packets received from device and sent to kernel>
+	num_tx_pkts_dropped = <number of Tx packets dropped by driver>
+	num_rx_pkts_dropped = <number of Rx packets dropped by driver>
+	num_tx_pkts_err = <number of Tx packets failed to send to device>
+	num_rx_pkts_err = <number of Rx packets failed to receive from device>
+	carrier "on" | "off"
+	tx queue "stopped" | "started"
+	tkip_mic_failures = 0                           // Only for uAP (use of WEP/TKIP is not recommended anymore)
+	ccmp_decrypt_errors = 0                         // Only for uAP
+	wep_undecryptable_count = 0                     // Only for uAP  (use of WEP/TKIP is not recommended anymore)
+	wep_icv_error_count = 0                         // Only for uAP  (use of WEP/TKIP is not recommended anymore)
+	decrypt_failure_count = 0                       // Only for uAP
+	mcast_tx_count = 0                              // Only for uAP
+	failed_count = 0                                // Only for uAP
+	retry_count = 0                                 // Only for uAP
+	multiple_retry_count = 0                        // Only for uAP
+	frame_duplicate_count = 0                       // Only for uAP
+	rts_success_count = 0                           // Only for uAP
+	rts_failure_count = 0                           // Only for uAP
+	ack_failure_count = 0                           // Only for uAP
+	rx_fragment_count = 0                           // Only for uAP
+	mcast_rx_frame_count = 0                        // Only for uAP
+	fcs_error_count = 0                             // Only for uAP
+	tx_frame_count = 0                              // Only for uAP
+	rsna_tkip_cm_invoked = 0                        // Only for uAP  (use of WEP/TKIP is not recommended anymore)
+	rsna_4way_hshk_failures = 0                     // Only for uAP
+
+	The following debug info are provided in /proc/net/mwlan/adapterX/mlanY|uapY|wfdY/debug,
+	on kernel 2.6.24 or later, the entry is /proc/mwlan/adapterX/mlanY|uapY|wfdY/debug.
+
+	drvdbg = <bit mask of driver debug message control>
+	wmm_ac_vo = <number of packets sent to device from WMM AcVo queue>
+	wmm_ac_vi = <number of packets sent to device from WMM AcVi queue>
+	wmm_ac_be = <number of packets sent to device from WMM AcBE queue>
+	wmm_ac_bk = <number of packets sent to device from WMM AcBK queue>
+	max_tx_buf_size = <maximum Tx buffer size>
+	tx_buf_size = <current Tx buffer size>
+	curr_tx_buf_size = <current Tx buffer size in FW>
+	ps_mode = <0/1, CAM mode/PS mode>
+	ps_state = <0/1/2/3, awake state/pre-sleep state/sleep-confirm state/sleep state>
+	is_deep_sleep = <0/1, not deep sleep state/deep sleep state>    // Only for STA
+	wakeup_dev_req = <0/1, wakeup device not required/required>
+	wakeup_tries = <wakeup device count, cleared when device awake>
+	hs_configured = <0/1, host sleep not configured/configured>
+	hs_activated = <0/1, extended host sleep not activated/activated>
+	tx_pkts_queued = <number of Tx packets queued>
+	pps_uapsd_mode = <0/1, PPS/UAPSD mode disabled/enabled>     // Only for STA
+	sleep_pd = <sleep period in milliseconds>                   // Only for STA
+	qos_cfg = <WMM QoS info>                                    // Only for STA
+	tx_lock_flag = <0/1, Tx lock flag>                          // Only for STA
+	port_open = <0/1, port open flag>                           // Only for STA
+	scan_processing = <0/1, scan processing flag>               // Only for STA
+	num_bridge_pkts = <number of bridged packets>               // Only for uAP
+	num_drop_pkts = <number of dropped packets>                 // Only for uAP
+	num_tx_timeout = <number of Tx timeout>
+	num_cmd_timeout = <number of timeout commands>
+	timeout_cmd_id = <command id of the last timeout command>
+	timeout_cmd_act = <command action of the last timeout command>
+	last_cmd_id = <command id of the last several commands sent to device>
+	last_cmd_act = <command action of the last several commands sent to device>
+	last_cmd_index = <0 based last command index>
+	last_cmd_resp_id = <command id of the last several command responses received from device>
+	last_cmd_resp_index = <0 based last command response index>
+	last_event = <event id of the last several events received from device>
+	last_event_index = <0 based last event index>
+	num_cmd_h2c_fail = <number of commands failed to send to device>
+	num_cmd_sleep_cfm_fail = <number of sleep confirm failed to send to device>
+	num_tx_h2c_fail = <number of data packets failed to send to device>
+	num_cmdevt_c2h_fail = <number of commands/events failed to receive from device>
+	num_rx_c2h_fail = <number of data packets failed to receive from device>
+	num_int_read_fail = <number of interrupt read failures>
+	last_int_status = <last interrupt status>
+	num_evt_deauth = <number of deauthenticated events received from device>        // Only for STA
+	num_evt_disassoc = <number of disassociated events received from device>        // Only for STA
+	num_evt_link_lost = <number of link lost events received from device>           // Only for STA
+	num_cmd_deauth = <number of deauthenticate commands sent to device>             // Only for STA
+	num_cmd_assoc_ok = <number of associate commands with success return>           // Only for STA
+	num_cmd_assoc_fail = <number of associate commands with failure return>         // Only for STA
+	cmd_sent = <0/1, send command resources available/sending command to device>
+	data_sent = <0/1, send data resources available/sending data to device>
+	mp_rd_bitmap = <SDIO multi-port read bitmap>
+	curr_rd_port = <SDIO multi-port current read port>
+	mp_wr_bitmap = <SDIO multi-port write bitmap>
+	curr_wr_port = <SDIO multi-port current write port>
+	txbd_rdptr = <PCIE transmit read pointer>
+	txbd_wrptr = <PCIE transmit write pointer>
+	rxbd_rdptr = <PCIE recieve read pointer>
+	rxbd_wrptr = <PCIE recieve write pointer>
+	eventbd_rdptr = <PCIE event read pointer>
+	eventbd_wrptr = <PCIE event write pointer>
+	cmd_resp_received = <0/1, no cmd response to process/response received and yet to process>
+	event_received = <0/1, no event to process/event received and yet to process>
+	tx_cmd_urb_pending = <number of URB pending for cmd transmit>
+	tx_data_urb_pending = <number of URB pending for data transmit>
+	rx_cmd_urb_pending = <number of URB pending for cmd receive>
+	rx_data_urb_pending = <number of URB pending for data receive>
+	ioctl_pending = <number of ioctl pending>
+	tx_pending = <number of Tx packet pending>
+	rx_pending = <number of Rx packet pending>
+	lock_count = <number of lock used>
+	malloc_count = <number of malloc done>
+	mbufalloc_count = <number of mlan_buffer allocated>
+	malloc_cons_count = <number of consistent malloc done>
+	main_state = <current state of the main process>
+	sdiocmd53w = <SDIO Cmd53 write status>
+	sdiocmd53r = <SDIO Cmd52 read status>
+	hs_skip_count = <number of skipped suspends>
+	hs_force_count = <number of forced suspends>
+
+	Issue SDIO cmd52 read/write through proc.
+	Usage:
+		echo "sdcmd52rw=<func> <reg> [data]" > /proc/mwlan/adapterX/config
+	where the parameters:
+		func: The function number to use (0-7)
+		reg:  The address of the register
+		data: The value to write, read if the value is absent
+		For SDIO MMC driver, only function 0 and WLAN function access is allowed.
+		And there is a limitation for function 0 write, only vendor specific CCCR
+		registers (0xf0 -0xff) are permiited.
+	Examples:
+		echo "sdcmd52rw= 0 4" > /proc/mwlan/adapterX/config      # read func 0 address 4
+		cat /proc/mwlan/adapterX/config                          # display the register value
+		echo "sdcmd52rw= 1 3 0xf" > /proc/mwlan/adapterX/config  # write 0xf to func 1 address 3
+
+	Issue debug_dump command through proc.
+	Usage:
+		echo "debug_dump" > /proc/mwlan/adapterX/config
+
+	Examples:
+		echo "debug_dump" > /proc/mwlan/adapterX/config      # dump driver internal debug status.
+	To obtain fw dump or driver dump, use command:
+	        cat /proc/mwlan/adapter0/drv_dump > file_drv_dump     #save the drv dump to file_drv_dump
+	        cat /proc/mwlan/adapter0/fw_dump > file_fw_dump       #save the fw dump to file_fw_dump
+            cat /proc/mwlan/adapter1/drv_dump > file_drv_dump_2   #save the adapter1 drv dump to file_drv_dump_2
+
+	Use dmesg or cat /var/log/debug to check driver debug messages.
+
+	Update /proc/sys/kernel/printk to change message log levels.
+	For example,
+	echo 6 > /proc/sys/kernel/printk    (messages with a higher priority than 6
+	                                     will be printed to the console)
+	echo 15 > /proc/sys/kernel/printk   (all messages will be printed to console)
+
+4) FOR FW RELOAD
+    a) Enable parallel firmware download in driver parameter
+       insmod sdxxx.ko fw_serial=0
+
+    b) default fw name for parallel firmware download
+       sd8887_wlan_a2.bin
+
+    c) Trigger FW reload
+       echo "fw_reload=1" > /proc/mwlan/adapterX/config   trigger SDIO inband firmware reset and reload firmware
+       echo "fw_reload=2" > /proc/mwlan/adapterX/config   trigger firmware reload
+       echo "fw_reload=3" > /proc/mwlan/adapterX/config   set firmware reload flag in driver.
+       echo "fw_reload=4" > /proc/mwlan/config   trigger PCIe FLR and reload firmware.
+       echo "fw_reload=6" > /proc/mwlan/config   trigger PCIe inband firmware reset and reload firmware.
+
+    (Note: This feature will be supported on Robin3 and KF2.
+           For CAC-A2, it only work with the board which supports parallel fw download)
+
+5) FOR RF test mode commands:
+
+    Following commands are used to perform RF testing of the wifi chipset.
+    Please not that these test mode commands can only be issued while the
+    device is in disconnected state and the uAP BSS is inactive.
+    Normal wifi operations cannot be used on entering RF Test Mode.
+
+    Enter RF Test Mode:
+	echo "rf_test_mode=1" > /proc/mwlan/adapterX/config
+
+    Exit RF Test Mode:
+	echo "rf_test_mode=0" > /proc/mwlan/adapterX/config
+    Please note that after exiting the RF Test Mode, the FW needs to be
+    reset in order to use normal wifi connectivity.
+
+    To get the set of available RF Test Mode commands, currently set
+    parameters values for each command and the output,
+	cat /proc/mwlan/adapterX/config
+
+  Set Radio Mode
+    echo "radio_mode=<radioMode0> <radioMode1>"
+
+    Example: 2.4G[1x1]
+    echo "radio_mode=11 0" > /proc/mwlan/adapterX/config
+    5G[1x1]
+    echo "radio_mode=3 0" > /proc/mwlan/adapterX/config
+
+    Set Tx Antenna
+	For 1x1 chipsets, 1:Main, 2:Aux when antenna diversity is supported
+	For 2x2 chipsets, 1:Path A, 2: Path B, 3: Path A+B
+			  Both Tx and Rx must be set to same antenna path
+	echo "tx_antenna=1" > /proc/mwlan/adapterX/config
+
+    Set Rx Antenna
+	For 1x1 chipsets, 1:Main, 2:Aux when antenna diversity is supported
+	For 2x2 chipsets, 1:Path A, 2:Path B, 3:Path A+B
+			  Both Tx and Rx must be set to same antenna path
+	echo "rx_antenna=1" > /proc/mwlan/adapterX/config
+
+    Set RF band  (0:2G, 1:5G)
+	For 2G, channel will be reset to 6, while for 5G, to channel 36
+	echo "band=0" > /proc/mwlan/adapterX/config
+
+    Set RF bandwidth  (0:20MHz, 1:40MHz, 4:80MHz)
+	echo "bw=0" > /proc/mwlan/adapterX/config
+
+    Set RF channel
+	echo "channel=6" > /proc/mwlan/adapterX/config
+
+    Get and reset packet error rate
+	echo "get_and_reset_per" > /proc/mwlan/adapterX/config
+
+    Set Tx Power
+	This command will set power only if caldata is already loaded in the FW.
+	Power       (-15 to 24 dBm)
+	Modulation  (0: CCK, 1:OFDM, 2:MCS)
+	Path ID     (0: PathA, 1:PathB, 2:PathA+B)
+	echo "tx_power=16 2 0" > /proc/mwlan/adapterX/config
+
+    Set MFG HE TB Tx to configure Trigger based TX reponse
+    Enable Tx   (0:disable, 1:enable)
+    Q num       (0-7 : TCQs 0-7, 17-20: AXQs 0-3)
+    AID         (Association ID as applicable)
+    AXQ MU Timer(to set the MU EDCA Timer for the Queue)
+    Tx Power    (-11 to 9 dBm)
+    echo "he_tb_tx=1 1 5 400 10" > /proc/mwlan/adapterX/config
+
+    Set Tx Continuous Mode
+	Start                 (0:disable, 1:enable)
+	Continuous Wave Mode  (0:disable, 1:enable)
+	Payload Pattern       (0 to 0xFFFFFFFF)
+	CS Mode               (Applicable only when continuous wave is disabled)
+	                      (0:disable, 1:enable)
+	Active SubChannel     (0:low, 1:upper, 3:both)
+	Tx Data Rate          (Rate Index corresponding to legacy/HT/VHT rates)
+
+	Example: To start continuous wave (tone) mode, first stop any ongoing
+	Tx and then start wave mode:
+	step1: echo "tx_continuous=0" > /proc/mwlan/adapterX/config
+	step2: echo "tx_continuous=1 1 0xAAA 0 3 7" > /proc/mwlan/adapterX/config
+
+	Example: To start continuous packet mode, first stop any ongoing Tx and
+	then start pkt mode:
+	step1: echo "tx_continuous=0" > /proc/mwlan/adapterX/config
+	step2: echo "tx_continuous=1 0 0xAAA 0 3 7" > /proc/mwlan/adapterX/config
+
+	stop:
+	echo "tx_continuous=0" > /proc/mwlan/adapterX/config
+
+    Set Tx Frame
+	Start                 (0:disable, 1:enable)
+	Tx Data Rate          (Rate Index corresponding to legacy/HT/VHT rates)
+	Payload Pattern       (0 to 0xFFFFFFFF)
+	Payload Length        (1 to 0x400)
+	Adjust Burst SIFS Gap (0:disable, 1:enable)
+	Burst SIFS in us      (0 to 255us)
+	Short Preamble        (0:disable, 1:enable)
+	Active SubChannel     (0:low, 1:upper, 3:both)
+	Short GI              (0:disable, 1:enable)
+	Adv Coding            (0:disable, 1:enable)
+	Beamforming           (0:disable, 1:enable)
+	GreenField Mode       (0:disable, 1:enable)
+	STBC                  (0:disable, 1:enable)
+	Signal Bw             (0: 20Mhz, 1: 40Mhz, 4:80Mhz, -1: Set to default)
+	NumPkt                (-1:Set to default value, 1 to 0xfffffffe to specify number of packaets to send)
+	MaxPktExt             (0|8|16us, -1:Set to default Value 2)
+	BeamChange            (0|1, -1:Set to default Value 1)
+	DCM                   (0|1, -1:Set to default Value 0)
+	Doppler               (0|1, -1:Set to default Value 0)
+	MidamblePeriod        (10|20, -1:Set to default Value 0)
+	QNum                  (0-12|17-20, -1:Set to default Value if 11ax QNum:17 else QNum:0)
+	BSSID                 (xx:xx:xx:xx:xx:xx)
+
+	Example: To start Tx frame with duty cycle, first stop any ongoing Tx
+        and then start Tx frame:
+	echo "tx_frame=0" > /proc/mwlan/adapterX/config
+	echo "tx_frame=1 7 0xAAA 0x100 1 20 0 0 0 0 0 0 0 0 -1 -1 -1 -1 -1 -1 -1 05:43:3f:c4:51" > /proc/mwlan/adapterX/config
+
+    Configure Trigger Frame
+    	Start                 	(0|1, 0:disable, 1:enable)
+    	standalone HETB			(0|1,  0:disable, 1:enable)
+		Frame Control Type		(1: Control frame)
+		Frame Control Sub-Type	(2: Trigger frame)
+		Duration				(0x156C , Max Duration time)
+		TriggerType				(0: Basic Trigger Frame)
+		UlLen					(UL Length)
+		MoreTF					(0|1, 0:FALSE, 1:TRUE)
+		CS Required				(0|1, 0:FALSE, 1:TRUE)
+		UL_bandwidth			(0: 20Mhz, 1: 40Mhz, 2:80Mhz, 3:80+80 MHz|160MHz -1:Set to default value)
+		LTF Type				(0: 1xLTF+1.6usGI, 1: 2xLTF+0.8usGI, 2: 2xLTF+1.6usGI, 3: 4xLTF+3.2usGI)
+		LTF Mode				(0|1, 0: Single stream pilots, 1: Mask LTF sequence of each spatial stream)
+		LTF symbol				(Number of LTF Symbols)
+		UL STBC					(0|1, 0:STBC encoding disable, 1:STBC encoding disable)
+		LDPC ESS				(0|1, 0:LDPC ESS disable, 1:LDPC ESS enable)
+		ApTxPwr					(0-61, 0-60:Values 0-61 maps to -20 dBm to 40 dBm)
+		PreFecPadFct			(1-4, a-factor)
+		Disambing				(0|1, 0:Set to Default)
+		Spatial Reuse			(65535 Default Value)
+		Doppler					(0|1, 0:disable, 1:enable)
+		HE SIG2					(0x1FF Default value)
+		AID12					(any 12 bit value)
+		RUAllocReg				(RU index, any 8 bit value)
+		RUAlloc					(0|1, 0: RU allocated is primary 80Mhz, 1: non-primary 80MHz)
+		Coding Type				(0|1, 0: BCC,1: LDPC)
+		UlMCS				    (Valid MCS Value)
+		UL DCM					(0|1, 0:disable, 1:enable)
+		SSAlloc					(Spatial streams, BITS[0-2]:Number of spatial streams BITS[3-5]:Starting spatial stream)
+		Target RSSI ID			(0-90, 0-90:Values 0-90 map to -100dBm to -20dBm)
+		MPDU MU SF				(0:Multiplier=1, 1:Multiplier=2 , 2:Multiplier=4, 3:Multiplier=8)
+		TID_AL					(0:Set to default Value)
+		AC_PL					(0|1, 0:disable, 1:enable)
+		Pref_AC				    (0:AC_VO, 1:AC_V1, 2:AC_BE, 3:AC_BK)
+
+    Example: To configure Trigger frame:
+    echo "trigger_frame=1 0 1 2 5484 0 256 0 0 2 1 0 0 0 1 60 1 0 65535 0 511 5 0 67 0 0 0 0 90 0 0 0 0"  > /proc/mwlan/adapter0/config
+
+    Example: To disable configuration of  Trigger frame:
+    echo "trigger_frame=0"  > /proc/mwlan/adapter0/config
+
+    For more information about trigger frame configuration as per supported BW(80MHz, 40MHz and 20MHz),
+    Please refer : config/trigger_frame_cfg.conf
+
+    Example : To start trigger frame transmission :
+    echo "rf_test_mode=1" > /proc/mwlan/adapter0/config
+    echo "radio_mode=3 0" > /proc/mwlan/adapterX/config
+    echo "bw=0" > /proc/mwlan/adapter0/config
+    echo "channel=36" > /proc/mwlan/adapter0/config
+    echo "trigger_frame=1 0 1 2 5484 0 256 0 0 0 1 0 0 0 1 60 1 0 65535 0 511 5 0 61 0 0 0 0 90 0 0 0 0"  > /proc/mwlan/adapter0/config
+    echo "tx_frame=1 0x1102 0xabababab 200" >/proc/mwlan/adapter0/config
+
+6) Set host sleep parameters
+
+    hssetpara
+	This command is used to set host sleep parameters.
+    Example:
+        echo "hssetpara=2 0xff 0xc8 3 400" > /proc/mwlan/adapter0/config
+        echo "hssetpara=2 1 0xc8 3 400 " > /proc/mwlan/adapter0/config
+
+7) For Antenna Diversity Command
+
+    antcfg
+        This command is used to set/get the mode of Tx/Rx path.
+
+        GET Command Format: cat /proc/mwlan/adapter0/config
+        SET Command Format: echo "antcfg=[m] [n] [o] [p]" > /proc/mwlan/adapter0/config
+
+    For chip which support STREAM_2X2
+    where value of m is:
+        Bit 0   -- Tx Path A or Tx/Rx Path A if [n] is not provided
+        Bit 1   -- Tx Path B or Tx/Rx Path B if [n] is not provided
+        Bit 0-1 -- Tx Path A+B or Tx/Rx Path A+B if [n] is not provided
+        For 9097/9098/IW624/AW693, LOW BYTE for 2G setting
+        Bit 8   -- Tx Path A or Tx/Rx Path A if [n] is not provided
+        Bit 9   -- Tx Path B or Tx/Rx Path B if [n] is not provided
+        Bit 8-9 -- Tx Path A+B or Tx/Rx Path A+B if [n] is not provided
+        For 9097/9098/IW624/AW693, HIGH BYTE for 5G setting
+    where value of n is:
+        Bit 0   -- Rx Path A
+        Bit 1   -- Rx Path B
+        Bit 0-1 -- Rx Path A+B
+        For 9097/9098/IW624/AW693, LOW BYTE for 2G setting
+        Bit 8   -- Rx Path A
+        Bit 8   -- Rx Path B
+        Bit 8-9 -- Rx Path A+B
+        For 9097/9098/IW624/AW693, HIGH BYTE for 5G setting
+    The Tx path setting (m) is used for both Tx and Rx if Rx path (n) is not provided.
+
+    Examples:
+        cat /proc/mwlan/adapter0/config                         : Get Tx and Rx path
+        echo "antcfg=3" > /proc/mwlan/adapter0/config           : Set Tx and Rx path to A+B
+        echo "antcfg=1 3" > /proc/mwlan/adapter0/config         : Set Tx path to A and Rx path to A+B
+
+        echo "antcfg=0x103" > /proc/mwlan/adapter0/config           : Set Tx and Rx path to A+B on 2G and Tx and Rx path to A on 5G
+        echo "antcfg=0x103 0x103" > /proc/mwlan/adapter0/config     : Set Tx path to A+B and Rx path to A+B on 2G, and Tx and Rx path to A on 5G
+
+        echo "antcfg=0x202" > /proc/mwlan/adapter0/config : Use 5GHz path B pin for 5G TX/RX and 2GHz path B pin for 2G TX/RX
+
+        On RD board connection is as follows :
+        5GHz path A pin -> AntA
+        5GHz path B pin -> AntB
+        2GHz path A pin -> AntB
+        2GHz path B pin -> AntA
+
+    For chip which support SAD
+        where value of m is:
+        Bit 0   -- Tx/Rx antenna 1
+        Bit 1   -- Tx/Rx antenna 2
+        ...
+        0xFFFF  -- Tx/Rx antenna diversity
+
+        where value of n is:
+                SAD evaluate time interval, only be provided when m = 0xFFFF, default value is 6s(0x1770)
+
+    Examples:
+        cat /proc/mwlan/adapter0/config                                : Get Tx/Rx antenna mode
+        echo "antcfg=1" > /proc/mwlan/adapter0/config                : Set Tx/Rx antenna 1
+        echo "antcfg=0xFFFF" > /proc/mwlan/adapter0/config            : Set Tx/Rx antenna diversity
+        echo "antcfg=0xFFFF 0x1770" > /proc/mwlan/adapter0/config     : Set antenna evaluate time interval to 6s
+
+
diff --git a/wlan_sd8987/README_MLAN b/wlan_src/README_MLAN
old mode 100755
new mode 100644
similarity index 82%
rename from wlan_sd8987/README_MLAN
rename to wlan_src/README_MLAN
index 3a347f3..fe6eb49
--- a/wlan_sd8987/README_MLAN
+++ b/wlan_src/README_MLAN
@@ -1,7 +1,7 @@
 ===============================================================================
 			U S E R  M A N U A L
 
- Copyright 2008-2022 NXP
+ Copyright 2008-2024 NXP
 
 
 1) FOR DRIVER BUILD
@@ -9,7 +9,7 @@
 	Goto source code directory wlan_src/.
 	make [clean] build
 	The driver and utility binaries can be found in ../bin_xxxx directory.
-	The driver code supports Linux kernel from 2.6.32 to 6.0.0.
+	The driver code supports Linux kernel from 2.6.32 to 6.9.10.
 
 2) FOR DRIVER INSTALL
 
@@ -20,6 +20,7 @@
 			Bit 0 :  STA
 			Bit 1 :  uAP
 			Bit 2 :  WIFIDIRECT
+			Bit 4 :  NAN
 
 		max_sta_bss: Maximum number of STA BSS (default 1, max 1)
 		sta_name: Name of the STA interface (default: "mlan")
@@ -28,6 +29,8 @@
 		max_wfd_bss: Maximum number of WIFIDIRECT BSS (default 1, max 1)
 		wfd_name: Name of the WIFIDIRECT interface (default: "wfd")
 		max_vir_bss: Number of Virtual interfaces (default 0)
+		nan_name: Name of the NAN interface (default: "nan")
+		max_nan_bss: Number of NAN interfaces (default 1)
 		uap_oper_ctrl: uAP operation control when in-STA disconnect with ext-AP
                                0: default do nothing, 2: uAP stops and restarts automatically
 	   For example, to install multi-chip driver,
@@ -41,6 +44,21 @@
 		rmmod moal
 		rmmod mlan
 
+	pref_dbc
+	This load time parameter is used to config preferred DBC mode and takes effect when dmcs is enabled
+	This parameter only used for AW693(BB)
+
+	Usage:
+		pref_dbc=[value]
+		insmod mlan.ko; insmod pcieaw693.ko fw_name=aw693w.bin dmcs=1 pref_dbc=1
+		<value = 0> : default preferred DBC mode
+		<value = 1> : Enable preferred DBC mode
+		<value = 2> : Disable preferred DBC mode
+
+	Example :
+		insmod mlan.ko; insmod pcieaw693.ko fw_name=aw693w.bin dmcs=1 pref_dbc=1 : Enable preferred DBC mode
+		insmod mlan.ko; insmod pcieaw693.ko fw_name=aw693w.bin dmcs=1 pref_dbc=2 : Disable preferred DBC mode
+
 	To load driver with MFG firmware file, use mfg_mode=1 when insmod WLAN driver and
 	specify MFG firmware name if needed.
 
@@ -48,72 +66,92 @@
 	This parameter only used for 9177(FC)
 
 	There are some other parameters for debugging purpose etc. Use modinfo to check details.
-	  drvdbg=<bit mask of driver debug message control>
-	  dev_cap_mask=<Bit mask of the device capability>
-	  mac_addr=xx:xx:xx:xx:xx:xx <override the MAC address (in hex)>
-	  auto_ds=0|1|2 <use MLAN default | enable auto deepsleep | disable auto deepsleep>
-	  ext_scan=0|1|2 <use MLAN default | Enable Extended Scan| Enable Enhanced Extended Scan>
-      net_rx=0|1 <use netif_rx_ni in rx | use netif_receive_skb in rx>
-      amsdu_deaggr=0|1 <default | Try avoid buf copy in amsud deaggregation>
+	drvdbg=<bit mask of driver debug message control>
+	dev_cap_mask=<Bit mask of the device capability>
+	This load parameter is uses to configure device features support
+	Usage:
+		dev_cap_mask=<value to be configured>
+		<BIT0-BIT15> : Represents features supported
+		<BIT16>: Indicates support for 11AX
+		<BIT17>: Indicates support for 6G
+	Example:
+		To disable 11AX and 6G support: dev_cap_mask=0xfffcffff
 
-	  ps_mode=0|1|2 <use MLAN default | enable IEEE PS mode | disable IEEE PS mode>
-	  sched_scan=0|1 <disable sched_scan | enable sched_scan default>
-	  max_tx_buf=2048|4096|8192 <maximum AMSDU Tx buffer size>
-	  pm_keep_power=1|0 <PM keep power in suspend (default) | PM no power in suspend>
-	  shutdown_hs=1|0 <Enable HS when shutdown | No HS when shutdown (default)>
-	  cfg_11d=0|1|2 <use MLAN default | enable 11d | disable 11d>
-	  dts_enable=0|1 <Disable DTS | Enable DTS (default)>
-	  fw_name = <FW file name>
+	mac_addr=xx:xx:xx:xx:xx:xx <override the MAC address (in hex)>
+	auto_ds=0|1|2 <use MLAN default | enable auto deepsleep | disable auto deepsleep>
+	ext_scan=0|1|2 <use MLAN default | Enable Extended Scan| Enable Enhanced Extended Scan>
+	p2a_scan=0|1|2 <MLAN default | Enable passive to active scan for DFS channel | Disable passive to active scan for DFS channel>
+	scan_chan_gap=x <Time gap between two scans in milliseconds when connected to AP (max value 500ms)>
+	net_rx=0|1 <use netif_rx/netif_rx_ni in rx | use netif_receive_skb in rx (default)>
+	amsdu_deaggr=0|1 <buf copy in amsud deaggregation | avoid buf copy in amsud deaggregation (default)>
+	bootup_cal_ctrl=0|1 <disable boot time config default | enable boot time config>
+	ps_mode=0|1|2 <use MLAN default | enable IEEE PS mode | disable IEEE PS mode>
+	sched_scan=0|1 <disable sched_scan | enable sched_scan default>
+	max_tx_buf=2048|4096|8192 <maximum AMSDU Tx buffer size>
+	pm_keep_power=1|0 <PM keep power in suspend (default) | PM no power in suspend>
+	shutdown_hs=1|0 <Enable HS when shutdown | No HS when shutdown (default)>
+	cfg_11d=0|1|2 <use MLAN default | enable 11d | disable 11d>
+	disable_11h_tpc=0|1 <enable 80211h TPC (default) | disable 80211h TPC of uAP and STA both>
+	(Note: This feature will be supported for IW416 and IW610x chipsets with host_mlme=1 case as of now.)
+	dts_enable=0|1 <Disable DTS | Enable DTS (default)>
+	fw_name = <FW file name>
 		e.g. copy pcieuart9098_combo_v1.bin to firmware directory, fw_name=nxp/pcieuart9098_combo_v1.bin
-	  hw_name = <hardware name>
-	  reg_work=0|1 <Disable register work queue| Enable register work queue>
-	  hw_test=0|1 <Disable hardware test (default) | Enable hardware test>
-	  fw_serial=0|1 <support parallel download FW | support serial download FW (default)>
-	  req_fw_nowait=0|1 <use request_firmware API (default) | use request_firmware_nowait API>
-      dfs53cfg=0|1|2 <use Fw Default | New W53 | Old W53>
-	  mcs32=0|1 <disable HT MCS32 support | enable HT MCS32 (default)>
-	  SD8887: antcfg=0|1|2|0xffff <default | Tx/Rx antenna 1 | Tx/Rx antenna 2 | enable antenna diversity>
-	  SD8897/SD8997: antcfg=0x11|0x13|0x33 <Bit0:Rx Path A, Bit1:Rx Path B, Bit 4:Tx Path A, Bit 5:Tx Path B>
-	  slew_rate: Slew Rate Control value = 0|1|2|3 (0 is the slowest slew rate and 03 has the highest slew rate (default))
-	  init_cfg=<init config (MAC addresses, registers etc.) file name>
+	hw_name = <hardware name>
+	reg_work=0|1 <Disable register work queue| Enable register work queue>
+	hw_test=0|1 <Disable hardware test (default) | Enable hardware test>
+	fw_serial=0|1 <support parallel download FW | support serial download FW (default)>
+	req_fw_nowait=0|1 <use request_firmware API (default) | use request_firmware_nowait API>
+	dfs53cfg=0|1|2 <use Fw Default | New W53 | Old W53>
+	mcs32=0|1 <disable HT MCS32 support | enable HT MCS32 (default)>
+	For 9097/9098/IW624/AW693: antcfg=0x101|0x303|.. <Bit0: Tx/Rx Path A for 2G, Bit1: Tx/Rx Path B for 2G, Bit8: Tx/Rx Path A for 5G, Bit9: Tx/Rx Path B for 5G>
+		For AW693, it's recommended to use mod_para configuration file for antcfg as MAC1 supports 2x2 and MAC2 supports only 1x1.
+	For 8897/8997: antcfg=0x11|0x13|0x33 <Bit0:Rx Path A, Bit1:Rx Path B, Bit 4:Tx Path A, Bit 5:Tx Path B>
+	For others: antcfg=0|1|2|0xffff <default | Tx/Rx antenna 1 | Tx/Rx antenna 2 | enable antenna diversity>
+	slew_rate: Slew Rate Control value = 0|1|2|3 (0 is the slowest slew rate and 03 has the highest slew rate (default))
+	init_cfg=<init config (MAC addresses, registers etc.) file name>
 		e.g. copy init_cfg.conf to firmware directory, init_cfg=nxp/init_cfg.conf
-	  cal_data_cfg=<CAL data config file name>
+	cal_data_cfg=<CAL data config file name>
 		e.g. copy cal_data.conf to firmware directory, cal_data_cfg=nxp/cal_data.conf
-          Note: Loading driver with 8887 must include correct cal_data_cfg parameter.
-	 dpd_data_cfg=<DPD data config file name>
-	   e.g. copy dpd_data.conf to firmware directory, dpd_data_cfg=nxp/dpd_data.conf
-	  txpwrlimit_cfg=<Tx power limit config file name>
+		Note: Loading driver with 8887 must include correct cal_data_cfg parameter.
+	dpd_data_cfg=<DPD data config file name>
+		e.g. copy dpd_data.conf to firmware directory, dpd_data_cfg=nxp/dpd_data.conf
+	txpwrlimit_cfg=<Tx power limit config file name>
 		e.g. copy txpwrlimit_cfg_set.conf to firmware directory, txpwrlimit_cfg=nxp/txpwrlimit_cfg_set.conf
-      cntry_txpwr=0|1|2
+		txpwrlimit_cfg_set.conf file should be the binary format file generate by mlanutl application
+	cntry_txpwr=0|1|2
                   0: Disable setting tx power table of country (default)
                   1: Enable setting tx power table of country
                   2: Enable setting rgpower table of country
-	  init_hostcmd_cfg=<init hostcmd config file name>
+	init_hostcmd_cfg=<init hostcmd config file name>
 		e.g. copy init_hostcmd_cfg.conf to firmware directory, init_hostcmd_cfg=nxp/init_hostcmd_cfg.conf
-	  band_steer_cfg=<band steer config file name>
+	band_steer_cfg=<band steer config file name>
 		e.g. generate bscfg.conf by band_steer_cfg.conf, then copy bscfg.conf to firmware directory, band_steer_cfg=nxp/bscfg.conf
-	  sdio_rx_aggr=1|0 <Enable SDIO rx aggr (default) | Disable SDIO rx aggr>
-	  cfg80211_wext=<bit mask of CFG80211 and WEXT control>
+	sdio_rx_aggr=1|0 <Enable SDIO rx aggr (default) | Disable SDIO rx aggr>
+	cfg80211_wext=<bit mask of CFG80211 and WEXT control>
 		Bit 0: STA WEXT
 		Bit 1: uAP WEXT
 		Bit 2: STA CFG80211
 		Bit 3: uAP CFG80211
-	  cfg80211_drcs=1|0 <Enable DRCS support (default) | Disable DRCS support>
-	  reg_alpha2=<Regulatory alpha2 (default NULL)>
-	  skip_fwdnld=0|1 <enable FW download support (default) | disable FW download support>
-	  wq_sched_prio: Priority for work queue
-	  wq_sched_policy: Scheduling policy for work queue
+	cfg80211_drcs=1|0 <Enable DRCS support (default) | Disable DRCS support>
+	skip_fwdnld=0|1 <enable FW download support (default) | disable FW download support>
+	wq_sched_prio: Priority for work queue
+	wq_sched_policy: Scheduling policy for work queue
 		(0: SCHED_NORMAL, 1: SCHED_FIFO, 2: SCHED_RR, 3: SCHED_BATCH, 5: SCHED_IDLE)
 		Please note that, both wq_sched_prio and wq_sched_policy should be provided
 		as module parameters. If wq_sched_policy is (0, 3 or 5), then wq_sched_prio
 		must be 0. wq_sched_prio should be 1 to 99 otherwise.
-	  rx_work=0|1|2 <default | Enable rx_work_queue | Disable rx_work_queue>
-	  pcie_int_mode=0|1|2 <Legacy mode, MSI mode (default), MSI-X mode>
-	  pcie_int_mode=0|1 <Legacy mode, MSI mode (default)>
-      ring_size=32|64|128|256|512 <adma ring size for 9097/9098>
-	  aggrctrl=1|0 <enable Tx aggr | disable Tx aggr>
-	  usb_aggr=0|1|2 <use MLAN default (disabled) | enable USB aggr | disable USB aggr>
-	  low_power_mode_enable=0|1 <disable low power mode (default)| enable low power mode>
+	rx_work=0|1|2 <default (enabled for multi-core) | Enable rx_work_queue | Disable rx_work_queue>
+	tx_work=0|1 <Disable tx_work_queue | Enable tx_work_queue (default on iMX)>
+	tx_skb_clone=0|1 <Disable tx_skb_clone | Enable tx_skb_clone (default on iMX)>
+	pmqos=0|1 <Disable pmqos | Enable pmqos (default on iMX)>
+	rps=0|x <Disables rps (default) | bit0-bit4 (0x1-0xf) Enables rps on specific cpu>
+	intmode=0|1 <SDIO Interrupt Mode (default) | GPIO Interrupt Mode>
+	gpiopin=0|x <GPIO pin number when intmode=1 (default 0, HW mapped intr on GPIO-21)>
+	pcie_int_mode=0|1 <Legacy mode, MSI mode (default)>
+	ring_size=32|64|128|256|512 <adma ring size for 9097/9098>
+	aggrctrl=1|0 <enable Tx aggr | disable Tx aggr>
+	usb_aggr=0|1|2 <use MLAN default (disabled) | enable USB aggr | disable USB aggr>
+	low_power_mode_enable=0|1 <disable low power mode (default)| enable low power mode>
 	  When low power mode is enabled, the output power will be clipped at ~+10dBm and the
 	  expected PA current is expected to be in the 80-90 mA range for b/g/n modes
 	wakelock_timeout=<set wakelock_timeout value (ms)>
@@ -124,6 +162,7 @@
 	hs_wake_interval=<Host sleep wakeup interval,it will round to nearest multiple dtim*beacon_period in fw>
 	disconnect_on_suspend=0|1 <Disable disconnect wifi on suspend (default) | Enable disconnect wifi on suspend>
 	hs_mimo_switch=0|1 <Disable dynamic MIMO-SISO switch during host sleep (default) | Enable dynamic MIMO-SISO switch during host sleep>
+	hs_auto_arp=0|1 <disable hs_auto_arp (default) | enable hs_auto_arp>
 	gtk_rekey_offload=0|1|2 <disable gtk_rekey_offload|enable gtk_rekey_offload (default) | enable gtk_rekey_offload in suspend mode only>
 	napi=0|1 <disable napi | enable napi>
 	fixed_beacon_buffer=0|1 <allocate default buffer size (default) | allocate max buffer size>
@@ -136,15 +175,39 @@
 	  Bit15~Bit8:Channel time for channel index1;
 	  Bit7~Bit0:mode for channel index1; 0|1 <PM1 | Null2Self>
 	roamoffload_in_hs=0|1 <always enable fw roaming (default) | enable fw roaming only when host suspend>
-	uap_max_sta: Maximum number of STA for UAP/GO (default 0, max 64)
+	uap_max_sta: Maximum number of STA for UAP/GO (default 0, max STA number for UAP/GO supported in FW)
+	wacp_mode=0|1|2 <disable WACP (default) | WACP mode 1 | WACP mode 2>
+	dfs_offload=0|1 <disable dfs offload (default) | enable dfs offload>
+	indrstcfg=x <high byte: GPIO pin number (255 default); low byte: IR mode (0: disable, 1: out-of-band, 2: in band)>
+	auto_fw_reload=0|1|3 <disable|enable PCIE FLR|enable PCIE InBand Reset (default)>
+	auto_fw_reload=0|1 <disable|enable InBand Reset (default)>
+	dmcs=0|1|2 <firmware default (default) | enable dynamic mapping | disable dynamic mapping>
 	host_mlme=0|1 <Operate in non-host_mlme mode | Operate in host_mlme mode (default)>
-	for supplicant/authenticator running on host side, WPA3 support is available only in host_mlme mode
-	country_ie_ignore=0|1 <Follow countryIE from AP and beacon hint enable (default) | Ignore countryIE from AP and beacon hint disable>
-	beacon_hints=0|1 <enable beacon hints(default) | disable beacon hints>
-
+		for supplicant/authenticator running on host side, WPA3 support is available only in host_mlme mode
+		for chipset 89xx FP-92, 90xx and later, host_mlme restricted to 1
+	disable_regd_by_driver=0|1 <reg domain set by driver enable | reg domain set by driver disable (default)>
+	reg_alpha2=<Regulatory alpha2 (default NULL)>
+	country_ie_ignore=0|1 <Follow countryIE from AP and beacon hint enable | Ignore countryIE from AP and beacon hint disable (default)>
+	beacon_hints=0|1 <enable beacon hints | disable beacon hints (default)>
+	mon_filter=x <Bit6:TX frames excluding control; Bit5:non-bss beacons; Bit3:unicast destined non-promiscuous frames only; Bit2:data frames; Bit1:control frames; Bit0:management frames>
+	edmac_ctrl=0|1 <Disable edmac EU adaptivity (default) | Enable edmac EU adaptivity>
 	chan_track=0|1 <restore channel tracking parameters(default) | set channel tracking new parameters> for 9098 only
 	keep_previous_scan=0|1, <Flush previous scan result before start scan | Keep previous scan result(default)>
-
+	auto_11ax=0|1, <disable auto_11ax | enable auto_11ax(default)>
+	dual_nb=0|1, <default combo FW name - single narrowband (default) | default combo FW name - dual narrowband>
+	fw_data_cfg=0|x <disable configuration for custom Fw data(default) | set configuration for custom Fw data>
+		Configurations for fw_data_cfg:
+		Bit 0: Configuration for Fw remapping addr
+		Bit 1: Configuration for USB endpoint
+		BIT 2: Configuration for DPD current optimizations
+	mclient_scheduling=0|1 <disable multi-client scheduling | enable multi-client scheduling (default)>
+	tx_budget=xxx <airtime tx budget for multi-client scheduling in usec, 0 - disable, 2600 - default>
+	reject_addba_req=0(default)|1|2|3 <set the conditions of rejecting addba request>
+		The conditions are:
+		Bit 0 : 1   -- reject the addba request when host sleep activated
+		Bit 1 : 1   -- reject the addba request when FW auto re-connect enabled
+		               this bit is only used with STA BSS
+		others      -- reserved
 
 	Note: On some platforms (e.g. PXA910/920) double quotation marks ("") need to used
 	for module parameters.
@@ -321,10 +384,11 @@
        sd8887_wlan_a2.bin
 
     c) Trigger FW reload
-       echo "fw_reload=1" > /proc/mwlan/adapterX/config   trigger inband firmware reset and reload firmware
+       echo "fw_reload=1" > /proc/mwlan/adapterX/config   trigger SDIO inband firmware reset and reload firmware
        echo "fw_reload=2" > /proc/mwlan/adapterX/config   trigger firmware reload
        echo "fw_reload=3" > /proc/mwlan/adapterX/config   set firmware reload flag in driver.
-       echo "fw_reload=4" > /proc/mwlan/config   trigger pcie FLR and reload firmware.
+       echo "fw_reload=4" > /proc/mwlan/config   trigger PCIe FLR and reload firmware.
+       echo "fw_reload=6" > /proc/mwlan/config   trigger PCIe inband firmware reset and reload firmware.
 
     (Note: This feature will be supported on Robin3 and KF2.
            For CAC-A2, it only work with the board which supports parallel fw download)
@@ -348,6 +412,14 @@
     parameters values for each command and the output,
 	cat /proc/mwlan/adapterX/config
 
+  Set Radio Mode
+    echo "radio_mode=<radioMode0> <radioMode1>"
+
+    Example: 2.4G[1x1]
+    echo "radio_mode=11 0" > /proc/mwlan/adapterX/config
+    5G[1x1]
+    echo "radio_mode=3 0" > /proc/mwlan/adapterX/config
+
     Set Tx Antenna
 	For 1x1 chipsets, 1:Main, 2:Aux when antenna diversity is supported
 	For 2x2 chipsets, 1:Path A, 2: Path B, 3: Path A+B
@@ -370,15 +442,12 @@
     Set RF channel
 	echo "channel=6" > /proc/mwlan/adapterX/config
 
-    Set Radio Mode
-        echo "radio_mode=14 4" > /proc/mwlan/adapterX/config
-
     Get and reset packet error rate
 	echo "get_and_reset_per" > /proc/mwlan/adapterX/config
 
     Set Tx Power
 	This command will set power only if caldata is already loaded in the FW.
-	Power       (0 to 24 dBm)
+	Power       (-15 to 24 dBm)
 	Modulation  (0: CCK, 1:OFDM, 2:MCS)
 	Path ID     (0: PathA, 1:PathB, 2:PathA+B)
 	echo "tx_power=16 2 0" > /proc/mwlan/adapterX/config
@@ -427,21 +496,56 @@
 	Beamforming           (0:disable, 1:enable)
 	GreenField Mode       (0:disable, 1:enable)
 	STBC                  (0:disable, 1:enable)
-	NumPkt                (Set to default value -1)
-	MaxPktExt             (Set to default value -1)
-	BeamChange            (Set to default value -1)
-	DCM                   (Set to default value -1)
-	Doppler               (Set to default value -1)
-	MidamblePeriod        (Set to default value -1)
-	QNum                  (Set to default value  1)
+	Signal Bw             (0: 20Mhz, 1: 40Mhz, 4:80Mhz, -1: Set to default)
+	NumPkt                (-1:Set to default value, 1 to 0xfffffffe to specify number of packaets to send)
+	MaxPktExt             (0|8|16us, -1:Set to default Value 2)
+	BeamChange            (0|1, -1:Set to default Value 1)
+	DCM                   (0|1, -1:Set to default Value 0)
+	Doppler               (0|1, -1:Set to default Value 0)
+	MidamblePeriod        (10|20, -1:Set to default Value 0)
+	QNum                  (0-12|17-20, -1:Set to default Value if 11ax QNum:17 else QNum:0)
 	BSSID                 (xx:xx:xx:xx:xx:xx)
 
 	Example: To start Tx frame with duty cycle, first stop any ongoing Tx
         and then start Tx frame:
 	echo "tx_frame=0" > /proc/mwlan/adapterX/config
-	echo "tx_frame=1 7 0xAAA 0x100 1 20 0 0 0 0 0 0 0 05:43:3f:c4:51" > /proc/mwlan/adapterX/config
+	echo "tx_frame=1 7 0xAAA 0x100 1 20 0 0 0 0 0 0 0 0 -1 -1 -1 -1 -1 -1 -1 05:43:3f:c4:51" > /proc/mwlan/adapterX/config
 
     Configure Trigger Frame
+    	Start                 	(0|1, 0:disable, 1:enable)
+    	standalone HETB			(0|1,  0:disable, 1:enable)
+		Frame Control Type		(1: Control frame)
+		Frame Control Sub-Type	(2: Trigger frame)
+		Duration				(0x156C , Max Duration time)
+		TriggerType				(0: Basic Trigger Frame)
+		UlLen					(UL Length)
+		MoreTF					(0|1, 0:FALSE, 1:TRUE)
+		CS Required				(0|1, 0:FALSE, 1:TRUE)
+		UL_bandwidth			(0: 20Mhz, 1: 40Mhz, 2:80Mhz, 3:80+80 MHz|160MHz -1:Set to default value)
+		LTF Type				(0: 1xLTF+1.6usGI, 1: 2xLTF+0.8usGI, 2: 2xLTF+1.6usGI, 3: 4xLTF+3.2usGI)
+		LTF Mode				(0|1, 0: Single stream pilots, 1: Mask LTF sequence of each spatial stream)
+		LTF symbol				(Number of LTF Symbols)
+		UL STBC					(0|1, 0:STBC encoding disable, 1:STBC encoding disable)
+		LDPC ESS				(0|1, 0:LDPC ESS disable, 1:LDPC ESS enable)
+		ApTxPwr					(0-61, 0-60:Values 0-61 maps to -20 dBm to 40 dBm)
+		PreFecPadFct			(1-4, a-factor)
+		Disambing				(0|1, 0:Set to Default)
+		Spatial Reuse			(65535 Default Value)
+		Doppler					(0|1, 0:disable, 1:enable)
+		HE SIG2					(0x1FF Default value)
+		AID12					(any 12 bit value)
+		RUAllocReg				(RU index, any 8 bit value)
+		RUAlloc					(0|1, 0: RU allocated is primary 80Mhz, 1: non-primary 80MHz)
+		Coding Type				(0|1, 0: BCC,1: LDPC)
+		UlMCS				    (Valid MCS Value)
+		UL DCM					(0|1, 0:disable, 1:enable)
+		SSAlloc					(Spatial streams, BITS[0-2]:Number of spatial streams BITS[3-5]:Starting spatial stream)
+		Target RSSI ID			(0-90, 0-90:Values 0-90 map to -100dBm to -20dBm)
+		MPDU MU SF				(0:Multiplier=1, 1:Multiplier=2 , 2:Multiplier=4, 3:Multiplier=8)
+		TID_AL					(0:Set to default Value)
+		AC_PL					(0|1, 0:disable, 1:enable)
+		Pref_AC				    (0:AC_VO, 1:AC_V1, 2:AC_BE, 3:AC_BK)
+
     Example: To configure Trigger frame:
     echo "trigger_frame=1 0 1 2 5484 0 256 0 0 2 1 0 0 0 1 60 1 0 65535 0 511 5 0 67 0 0 0 0 90 0 0 0 0"  > /proc/mwlan/adapter0/config
 
@@ -453,7 +557,7 @@
 
     Example : To start trigger frame transmission :
     echo "rf_test_mode=1" > /proc/mwlan/adapter0/config
-    echo "band=1" > /proc/mwlan/adapter0/config
+    echo "radio_mode=3 0" > /proc/mwlan/adapterX/config
     echo "bw=0" > /proc/mwlan/adapter0/config
     echo "channel=36" > /proc/mwlan/adapter0/config
     echo "trigger_frame=1 0 1 2 5484 0 256 0 0 0 1 0 0 0 1 60 1 0 65535 0 511 5 0 61 0 0 0 0 90 0 0 0 0"  > /proc/mwlan/adapter0/config
@@ -480,20 +584,20 @@
         Bit 0   -- Tx Path A or Tx/Rx Path A if [n] is not provided
         Bit 1   -- Tx Path B or Tx/Rx Path B if [n] is not provided
         Bit 0-1 -- Tx Path A+B or Tx/Rx Path A+B if [n] is not provided
-        For 9097/9098/IW62X, LOW BYTE for 2G setting
+        For 9097/9098/IW624/AW693, LOW BYTE for 2G setting
         Bit 8   -- Tx Path A or Tx/Rx Path A if [n] is not provided
         Bit 9   -- Tx Path B or Tx/Rx Path B if [n] is not provided
         Bit 8-9 -- Tx Path A+B or Tx/Rx Path A+B if [n] is not provided
-        For 9097/9098/IW62X, HIGH BYTE for 5G setting
+        For 9097/9098/IW624/AW693, HIGH BYTE for 5G setting
     where value of n is:
         Bit 0   -- Rx Path A
         Bit 1   -- Rx Path B
         Bit 0-1 -- Rx Path A+B
-        For 9097/9098/IW62X, LOW BYTE for 2G setting
+        For 9097/9098/IW624/AW693, LOW BYTE for 2G setting
         Bit 8   -- Rx Path A
         Bit 8   -- Rx Path B
         Bit 8-9 -- Rx Path A+B
-        For 9097/9098/IW62X, HIGH BYTE for 5G setting
+        For 9097/9098/IW624/AW693, HIGH BYTE for 5G setting
     The Tx path setting (m) is used for both Tx and Rx if Rx path (n) is not provided.
 
     Examples:
@@ -567,12 +671,14 @@
         mlanutl mlanX 11axcfg [config/11axcfg.conf]
 	mlanutl mlanX 11axcmd <subcmd> <value>
 	mlanutl mlanX txratecfg [l] [m] [n] [o]
+    mlanutl mlanX txratecfg [l] [m] [n] [o] [p]
 	mlanutl uapX txratecfg [l] [m] [n] [o]
 	mlanutl mlanX txwatchdog [l]
 	mlanutl uapX txwatchdog [l]
 	mlanutl mlanX hssetpara condition [GPIO# [gap]] [ind_GPIO# [level]]
 	mlanutl mlanX mefcfg <mef.conf>
         mlanutl mlanX cloud_keep_alive <keep_alive.conf> <start/stop/reset>
+        mlanutl mlanX cloud_keep_alive_rx <keep_alive_rx.conf> <start/stop/reset>
 	mlanutl mlanX min_ba_threshold <n>
 	mlanutl mlanX 11dcfg
 	mlanutl mlanX 11dclrtbl
@@ -593,8 +699,7 @@
 	mlanutl mlanX autotdls [n]
         mlanutl mlanX tdls_idle_time [n]
         mlanutl uapX dfs_offload [n]
-	mlanutl mlanX bandcfg [l] [m] [n]
-	mlanutl mlanX bcninterval [n]
+	mlanutl mlanX bandcfg [l]
 	mlanutl wfdX bssrole [l]
 	mlanutl mlanX cfgdata <register type> [<conf file>]
 	mlanutl mlanX cfpcode [m] [n]
@@ -609,6 +714,7 @@
 	mlanutl mlanX deauth [l]
 	mlanutl uapX deauth [l]
 	mlanutl mlanX deepsleep [l] [m]
+	mlanutl mlanX flush_time [l] [m]
 	mlanutl mlanX delba <l> [<m> <n>]
 	mlanutl uapX delba <l> [<m> <n>]
 	mlanutl mlanX delts <filename.conf> <section# of tspec>
@@ -616,7 +722,6 @@
 	mlanutl uapX clear_nop
 	mlanutl uapX nop_list
 	mlanutl uapX fake_radar
-	mlanutl uapX getchload <duration> [<cca_threshold>]
 	mlanutl uapX getchload <duration>
 	mlanutl dfsX dfs_cac <channel> [<bw> <cac-period>]
 	mlanutl dfsX autodfs <stop | start> [conf_file]
@@ -629,12 +734,15 @@
 	mlanutl mlanX getkey
 	mlanutl mlanX getscantable [ARGS]
 	mlanutl uapX getstalist
-    mlanutl uapX channel_switch <switch mode> <oper class> <new channel> <switch count> <bandwidth/num_pkts>
+    mlanutl uapX channel_switch <switch mode> <oper class> <new channel> <switch count> <bandwidth/num_pkts/num_retry_pkts> <mode>
+    mlanutl uapX chanswitch_param [<mode> <num_pkts/num_retry_pkts>]
     mlanutl uapX channel_switch <switch mode> <oper class> <new channel> <switch count> <bandwidth>
+	mlanutl uapX setmode <multi_ap mode>
 	mlanutl mlanX hostcmd <11n_2040coex.conf> 2040coex
 	mlanutl mlanX hostcmd <auto_tx.conf> auto_tx_get
 	mlanutl mlanX hostcmd <auto_tx.conf> auto_tx_unreg
 	mlanutl mlanX hostcmd <bg_scan.conf> bgscfg
+	mlanutl mlanX hostcmd <bg_scan.conf> bgs_query
 
 	mlanutl mlanX hostcmd <pkt_coalescing.conf> coalesce_cfg
 	mlanutl mlanX hostcmd <ed_mac_ctrl.conf> ed_mac_ctrl
@@ -691,7 +799,7 @@
 	mlanutl mlanX htstreamcfg [n]
 	mlanutl mlanX httxbfcap [cap]
 	mlanutl mlanX httxbfcfg "<action>[;GlobalData/tsData/interval/txPeerData/snrData]"
-	mlanutl mlanX inactivityto <n> <m> <l> [k]
+	mlanutl mlanX inactivityto <n> <m> <l> [k][j]
 	mlanutl mlanX ipaddr ["<op>;<ipaddr>"]
 	mlanutl mlanX linkstats
 	mlanutl mlanX listeninterval [l]
@@ -734,6 +842,7 @@
 	mlanutl mlanX sdcmd52rw <FN no.> <address> [data]
 	mlanutl mlanX sdcmd53rw <FN no.> <address> <mode> <blksize> <blknum> [data1] ... [dataN]
 	mlanutl mlanX sdioclock <n>
+	mlanutl mlanX sdiobuswidth <n>
 	mlanutl mlanX setuserscan [ARGS]
 	mlanutl mlanX cancelscan
 	mlanutl mlanX sleepparams [<p1> <p2> <p3> <p4> <p5> <p6>]
@@ -791,14 +900,18 @@
         mlanutl mlanX get_sensor_temp
         mlanutl <inteface> indrstcfg <ir_mode> [gpio_pin]
 
+        mlanutl <interface> fwwakeupmethod <method> <GPIO_pin>
 
         mlanutl uapX ctrldeauth <n>
 
+		mlanutl <interface> gpiocfg <pin_num> <mode> <value>
         mlanutl mlanX/uapX bootsleep <1/0>
 
         mlanutl mlanX ssu [mode] [ssu file]
 
         mlanutl mlanX csi <disable/enable (config file)>
+        Note: csi shall be enabled only after there is an active
+              interface of uAP or STA connected to an ex-AP
 
         mlanutl mlanX arb [mode]
 
@@ -807,8 +920,14 @@
 	mlanutl mlanX/uapX range_ext [mode]
         mlanutl mlanX twt_setup [config/twt.conf]
         mlanutl mlanX twt_teardown [config/twt.conf]
+        mlanutl mlanX twt_report
+        mlanutl mlanX twt_information [config/twt.conf]
+        mlanutl uapX btwt_AP_config_set [config/twt.conf]
+        mlanutl uapX btwt_AP_config_get [config/twt.conf]
         mlanutl <interface> rx_abort_cfg [enable] [rssi_threshold]
+        mlanutl <interface> ofdm_desense_cfg [enable] [cca_threshold](Only for IW416)
         mlanutl <interface> rx_abort_cfg_ext [enable] [margin ceil_thresh]
+        mlanutl <interface> nav_mitigation [start_nav_mitigation] [threshold]
         mlanutl <interface> tx_ampdu_prot_mode [mode]
         mlanutl <interface> rate_adapt_cfg [low_thresh high_thresh timer_interval]
         mlanutl <interface> cck_desense_cfg [mode] [margin ceil_thresh] [num_on_intervals num_off_intervals]
@@ -823,7 +942,14 @@
         mlanutl mlanX/uapX mcast_aggr_group [action] [mcast_addr]
         mlanutl mlanX/uapX mc_aggr_cfg [i][j]
         mlanutl uapX mcast_tx <mcast_tx.conf>
+		mlanutl mlanX ftm <subcommand> [<args>]
+	mlanutl mlanX/uapX turbo_mode <mode>
 	mlanutl <interface> getuuid
+	mlanutl uapX crosssynch [j][k] [l] [m] [n]
+	mlanutl mlanX/uapX wlan_tsp_cfg [j] [k] [l] [m] [n] [o] [p] [q]
+	mlanutl <interface> led m <n o p q> <n o p q> <n o p q> <n o p q> <n o p q> <n o p q>
+	mlanutl mlanX vndr_cmd_dump [mlanutl_cmd] [arguments]
+	mlanutl mlanX auth_assoc_timeout_cfg <auth_timeout> <auth_retry_timeout_if_ack>  <auth_retry_timeout_if_noack>  <assoc_timeout> <reassoc_timeout> <assoc_retry_timeout>
 
 DESCRIPTION
 	Those commands are used to send additional commands to the NXP MLAN
@@ -861,6 +987,8 @@
 		bit 5:  MEVENT          PRINTM(MEVENT,...)
 		bit 6:  MINTR           PRINTM(MINTR,...)
 		bit 7:  MIOCTL          PRINTM(MIOCTL,...)
+		bit 9:  MREG_D          PRINTM(MREG_D,...)
+		bit 10: MREG            PRINTM(MREG,...)
 		...
 		bit 16: MDAT_D          PRINTM(MDAT_D,...), DBG_HEXDUMP(MDAT_D,...)
 		bit 17: MCMD_D          PRINTM(MCMD_D,...), DBG_HEXDUMP(MCMD_D,...)
@@ -875,7 +1003,7 @@
 	If CONFIG_DEBUG=2, all kinds of debug messages can be configured.
 
 	If CONFIG_DEBUG=1, all kinds of debug messages can be configured except
-	for MENTRY, MWARN and MINFO. By default MMSG, MFATAL and MERROR are enabled.
+	for MENTRY, MWARN and MINFO. By default MMSG, MFATAL, MERROR and MREG_D are enabled.
 
 	Some special debug messages,
 		'*'             // MLAN driver ISR is called (bit 6 MINTR enabled)
@@ -1139,6 +1267,7 @@
  	mlanutl mlanX get_txpwrlimit <n> [raw_data_file]
 	where <n>
 		0:      Get 2.4G txpwrlimit table
+		0x80:   Get 2.4G txpwrlimit table of MAC2 (for AW693 chipset)
 		0x10:   Get 5G sub0 txpwrlimit table
 		0x11:   Get 5G sub1 txpwrlimit table
 		0x12:   Get 5G sub2 txpwrlimit table
@@ -1557,12 +1686,44 @@
                                            26-tine RU allocated by a trigger frame from the HE AP.
                                            valid value range [1..3600] in seconds. Any value more than 3600 will disable this feature.
                                            By default this feature is currently disabled.
+            <subcmd = llde > :       configure llde (Low Latency Data Exchange)
+                                     This subcmd is used to set/get suofdma parameters as defined in llde.conf
+                                     where
+                                         <llde> is SUOFDMA control
+                                             1 - start; 0 - stop
+                                         <mode> is operation mode
+                                             0 - default; 1 - carplay; 2 - gameplay; 3 - sound bar
+											 In sound bar mode, basic triggers will not be sent. Only MU-RTS + DL data from uAp. This will set dl_llde parameter automatically.
+                                         <fixrate> is MCS rate of TB data expected to be used by STA
+                                             0xff - auto
+                                         <triggerlimit> is placeholder to limit number of STA DL traffic per trigger interval
+                                             0xff - auto
+                                         <peakULrate> is peak MCS rate UL data for auto fixrate. Doesn't matter for fix MCS rate.
+                                         <dl_llde> is Downlink LLDE mode
+                                             1 - enable; 0 - disable
+                                         <pollinterval> is interval period for trigger frame (in us)
+                                             0 - auto (5ms default) [Changes according to payload in auto mode]
+										 <txOpDuration> is TxOp duation for trigger frame (in us).
+										 <llde_ctrl> is for additional configuration like NSS etc.
+											 0 - auto, 1 - NSS 1x1
+                                         <device_filter> is for setting device filter 0: no preference, 1: iphone (carplay IE in assoc)
+                                         <macfilter1> is make traffic to specific mac address to be high priority. Can have max 2 mac address entries
+                                         <macfilter2> is another mac entry possible
+                                         <packet_type> is to set high priority data packet type. 0: All traffic, 1: ping, 2: TCP ACK, 4: TCP Data, 8: UDP
+
+                                     get suofdma stats without any value
+
+			<subcmd =  get_rutx_pwr > : get ru tx subband value ( applicable only for FC )
+            <subcmd = HeSuER > : enable/disable TX HE SU ER PPDU format in auto rate mode
+                                      enable  HeSuER when [value_1 = 1]
+                                      disable HeSuER when [value_1 = 0]
     Example :
             mlanutl mlan0 11axcmd obss_pd_offset 2 3     : set obss_pd offset of spatial reuse, NON_SRG_OffSET = 2, SRG_OFFSET = 3
             mlanutl mlan0 11axcmd obss_pd_offset         : get obss_pd offset of spatial reuse
             mlanutl mlan0 11axcmd enable_sr 1            : enable spatial reuse
             mlanutl mlan0 11axcmd beam_change 0          : enable beam change
             mlanutl mlan0 11axcmd enable_htc 1           : enable transmission of HTC
+            mlanutl mlan0 11axcmd get_rutx_pwr           : get rx tx subband values
             mlanutl uap0 11axcmd txop_rts 0x34           : set RTS threshold value to 0x34
             mlanutl uap0 11axcmd txop_rts                : get RTS threshold value
             mlanutl mlan0 11axcmd tx_omi 0x41            : set omi value to 0x41
@@ -1570,6 +1731,14 @@
             mlanutl mlan0 11axcmd obssnbru_toltime 1800  : set OBSSNBRU tolerance time to 1800 seconds
             mlanutl mlan0 11axcmd obssnbru_toltime 3601  : disable OBSSNBRU tolerance time
             mlanutl mlan0 11axcmd obssnbru_toltime       : get OBSSNBRU tolerance time
+            mlanutl mlan0 11axcmd set_bsrp 1             : enable BSRP Forwarding to FW
+            mlanutl uap0 11axcmd llde <llde.conf>
+            llde.conf file params e.g. 1 3 7 255 9 0 0 2000 1 1 a0:94:da:00:c3:31 20:50:43:22:0f:b2 1
+                                                         : enable uplink llde with sound bar mode, fixrate MCS7, auto triggerlimit, peak MCS9, disable DL llde,
+                                                           auto pollinterval, 2000 us TxOp duration, NSS-1x1, set high packet priority of all IPhone devices,
+                                                           also set high pkt prioriy of those two specific mac address when packet type matches to PING packets.
+            mlanutl mlan0 11axcmd HeSuER 0               : disable TX HE SU ER PPDU format in auto rate mode
+            mlanutl mlan0 11axcmd HeSuER                 : get HeSuER
 
 txratecfg
 	This command is used to set/get the transmit data rate.
@@ -1585,6 +1754,8 @@
 
 	4) Parameter [o] is optional. If [o] is not given, it will be set as 0xffff.
 
+    5) Parameter [p] is optional. It is only for auto tx packets. For parameter [P], BW configuration in [o] parameter is compulsory.
+
 	Where
 	[l] is <format>
 	<format> - This parameter specifies the data rate format used in this command
@@ -1726,6 +1897,17 @@
 
         0xffff: Auto
 
+    [p] is <autoTx_set>
+    <autoTx_set> - This parameter is used to set the fix rate only for auto tx packets.
+        0: reset data rate of auto tx packets.
+        1: set configured data rate only for auto tx packets.
+
+    NOTE: BW configuration in [o] parameter is compulsory.
+         Bit 2 - 4 : indicate BW:
+             0 = 20 MHz
+             1 = 40 MHz
+             2 = 80 MHz
+
 	Examples:
 		mlanutl mlan0 txratecfg          : Read the current data rate setting
 		mlanutl mlan0 txratecfg 0 3      : Set fixed Tx rate to 11 Mbps
@@ -1736,6 +1918,8 @@
 		mlanutl mlan0 txratecfg 3 5 2 0x2282   : Set 11AX fixed Tx rate to MCS5 for NSS2, and Preamble type is 2, BW is 0, LTF + GI size 0
                                                          STBC is 1, DMC is 0, Coding is 1, maxPE is 2.
 		mlanutl mlan0 txratecfg 0xff     : Disable fixed rate and uses auto rate
+        mlanutl mlan0 txratecfg 2 0 1 4 1  : set fixed TX rate to MCS0 for NSS1 only for auto tx null/QoS null packets.
+        mlanutl mlan0 txratecfg 2 0 1 4 0  : Disable fixed TX rate and use auto rate for null/QoS null packets.
 
 hssetpara
 	This command is used to set host sleep parameters.
@@ -1774,8 +1958,9 @@
 	The default is 0xff.
 
 	where Gap is the gap in milliseconds between wakeup signal and wakeup event or 0xff
-	for special setting (host acknowledge required) when GPIO is used to wakeup host.
-	The default is 200.
+	for special setting (host acknowledge required, not valid for wakeup through SDIO interface,
+	required for wakeup through PCIe interface).
+	The default is 0xff for PCIe and 200 for others.
 
 	The host sleep set except for cancellation will be blocked if host sleep is
 	already activated.
@@ -1895,6 +2080,19 @@
                 mlanutl mlan0 cloud_keep_alive keep_alive.conf start
                 mlanutl mlan0 cloud_keep_alive keep_alive.conf stop
                 mlanutl mlan0 cloud_keep_alive keep_alive.conf reset
+cloud_keep_alive_rx
+        This command is used to start/stop send keep alive rx packet which set from host.
+
+        Usage:
+                mlanutl mlanX cloud_keep_alive_rx <keep_alive_rx.conf> <start/stop/reset>
+
+        where <start/stop/reset>
+                start means set cloud keep alive rx packet and paramters to firmware. stop means stop firmware from sending keep alive rx packet.reset will stop and reset TCP connection when host resume.
+
+        Examples:
+                mlanutl mlan0 cloud_keep_alive_rx keep_alive_rx.conf start
+                mlanutl mlan0 cloud_keep_alive_rx keep_alive_rx.conf stop
+                mlanutl mlan0 cloud_keep_alive_rx keep_alive_rx.conf reset
 min_ba_threshold
         This command is to set minimum Tx BA setup threshold
 
@@ -2016,20 +2214,20 @@
 		Bit 0   -- Tx Path A or Tx/Rx Path A if [n] is not provided
 		Bit 1   -- Tx Path B or Tx/Rx Path B if [n] is not provided
 		Bit 0-1 -- Tx Path A+B or Tx/Rx Path A+B if [n] is not provided
-		For 9097/9098/NW62X, LOW BYTE for 2G setting
+		For 9097/9098/IW624/AW693, LOW BYTE for 2G setting
 		Bit 8   -- Tx Path A or Tx/Rx Path A if [n] is not provided
 		Bit 9   -- Tx Path B or Tx/Rx Path B if [n] is not provided
 		Bit 8-9 -- Tx Path A+B or Tx/Rx Path A+B if [n] is not provided
-		For 9097/9098/NW62X, HIGH BYTE for 5G setting
+		For 9097/9098/IW624/AW693, HIGH BYTE for 5G setting
 	where value of n is:
 		Bit 0   -- Rx Path A
 		Bit 1   -- Rx Path B
 		Bit 0-1 -- Rx Path A+B
-		For 9097/9098/NW62X, LOW BYTE for 2G setting
+		For 9097/9098/IW624/AW693, LOW BYTE for 2G setting
 		Bit 8   -- Rx Path A
 		Bit 8   -- Rx Path B
 		Bit 8-9 -- Rx Path A+B
-		For 9097/9098/NW62X, HIGH BYTE for 5G setting
+		For 9097/9098/IW624/AW693, HIGH BYTE for 5G setting
 	The Tx path setting (m) is used for both Tx and Rx if Rx path (n) is not provided.
 
 	Examples:
@@ -2049,7 +2247,7 @@
         2GHz path B pin -> AntA
 
     For chip which support SAD
-        where value of m is:
+    	where value of m is:
 		Bit 0   -- Tx/Rx antenna 1
 		Bit 1   -- Tx/Rx antenna 2
 		...
@@ -2063,6 +2261,7 @@
 		mlanutl mlan0 antcfg 1             : Set Tx/Rx antenna 1
 		mlanutl mlan0 antcfg 0xFFFF        : Set Tx/Rx antenna diversity
 		mlanutl mlan0 antcfg 0xFFFF 0x1770 : Set antenna evaluate time interval to 6s
+
 mimoswitch
 	This command is used to do MIMO switch for 11n and 11ac mode and is available for all interfaces.
         mlanutl mlanX/uapX mimoswitch [tx_antmode] [rx_antmode]
@@ -2093,6 +2292,38 @@
 	Example:
 		mlanutl mlan0 arpfilter config/arpfilter.conf
 
+ftm
+	This command is used to configure and run FTM session
+
+	Usage:
+		mlanutl mlanX ftm <subcommand> [<args>]
+
+	Where:
+		<subcommand>	: Any of the below command with its arguments
+		 - session_cfg  [<ftm_protocol> <config_file>]
+		 - session_ctrl [<action> <chan> <mac_address> <loop_cnt>]
+
+			Where,
+			session_cfg params are:
+				<ftm_protocol> : 0:Dot11mc, 1:Dot11az_ntb
+				<config_file> : Config file with Dot11mc / dot11az parameters
+
+			session_ctrl params are:
+				<action> : 1: Start, 2: Stop
+				<loop_cnt> : number of ftm sessions to run repeatedly ( default:1,  0:non-stop, n>1: n times)
+				<chan>  : Channel on which FTM must be started
+				<mac_address> : Mac address of the peer with whom FTM session is required
+
+	Note: For STA, Associate to Ex-AP before starting FTM session.
+
+	eg:
+		mlanutl mlan0 ftm session_cfg 0 config/ftm.conf 		- Sets dot11mc FTM session params from config file
+		mlanutl mlan0 ftm session_cfg 1 config/ftm.conf 		- Sets dot11az ntb session params from donfig file
+		mlanutl mlan0 ftm session_ctrl 1 6 00:50:43:20:bc:4  	- Starts FTM session and runs it once",
+		mlanutl mlan0 ftm session_ctrl 1 6 00:50:43:20:bc:4 2 	- Starts FTM session and runs it for 2 cycles",
+		mlanutl mlan0 ftm session_ctrl 1 6 00:50:43:20:bc:4 0	- Runs FTM session non stop until user terminate",
+		mlanutl mlan0 ftm session_ctrl 2 						- Stop the FTM session
+
 assocctrl
 	This command is used to set/get the driver auto assoc, driver auto re-connect
 	and FW auto re-connect configurations.
@@ -2176,7 +2407,7 @@
 
 	Usage :
 			mlanutl mlanX comparergpwr <uncompressed file> [target_file]
-       where:
+    	where:
             <target_file>       : raw data file save from get_chnrgpwr command.
             <uncompressed file> : uncompressed raw data file generated by powerutil from the excel input region power file
 
@@ -2188,7 +2419,7 @@
 
 	Usage :
 			mlanutl mlanX comparetrpc <target_file> <src_file> [display]
-       where:
+    	where:
             <target_file>       : raw data file save from get_txpwrlimit command.
             <src_file>          : raw data file used by driver load parameter "txpwrlimit_cfg" which will be download to FW during driver init.
 	    <display> 		: display comparison output
@@ -2272,7 +2503,7 @@
 	Note: This command is only available in disconnected state.
 
 	Usage:
-		mlanutl mlanX bandcfg [l] [m] [n]
+		mlanutl mlanX bandcfg [l]
 
 	where the parameters:
 		[l]: Infrastructure band
@@ -2286,29 +2517,11 @@
 		     bit 6: AC 5G
 		     bit 8: AX 2.4G
 		     bit 9: AX 5G
-		[m]: Ad-hoc start band
-		     bit 0: B
-		     bit 1: G
-		     bit 2: A
-		[n]: Ad-hoc start channel
 	Examples:
 		mlanutl mlan0 bandcfg            : Get infra/ad-hoc band and ad-hoc
 		                                  start channel configurations
 		mlanutl mlan0 bandcfg 1          : Set infra band to B only
-		mlanutl mlan0 bandcfg 3 2 6      : Set infra band to B/G, ad-hoc start band
-		                                  to G and ad-hoc start channel to 6
-
-bcninterval
-	This command is used to set/get the beacon interval in ad-hoc mode.
-	The valid beacon interval is between 20 - 1000, default beacon
-	interval is 100.
-
-	Where <n>
-		Beacon interval in TU (Time Unit: 1024 us).
-
-	Examples:
-		mlanutl mlan0 bcninterval 200    : Set ad-hoc beacon interval to 200
-		mlanutl mlan0 bcninterval        : Get ad-hoc beacon interval
+		mlanutl mlan0 bandcfg 3			 : Set infra band to B/G
 
 bssrole
 	This command is used to set/get the BSS role.
@@ -2413,6 +2626,7 @@
 		           -1 - Append/Delete IE automatically
 		                Delete will delete the IE from the matching IE buffer
 		                Append will append the IE to the buffer with the same mask
+                               note :  index must be given only as decimal and not in hex value.
 		<mask>      :  Management subtype mask value as per bit definitions
 		            :  Bit 0 - Association request
 		            :  Bit 1 - Association response
@@ -2479,6 +2693,22 @@
         Note:
             Deepsleep must be disabled before changing idle time.
 
+flush_time
+	This command is used to set/get AMPDU reordering flush time.
+
+	Usage:
+		mlanutl mlanX flush_time [l] [m]
+
+	where the parameters are:
+		[l]: BE/BK reordering flush time
+		[m]: VI/VO reordering flush time
+
+	Examples:
+		mlanutl mlan0 flush_time              : Display AMPDU reordering flush time
+		mlanutl mlan0 flush_time 512 128      : Set BE/BK flush time to 512ms, VI/VO flush time to 128ms
+
+Note: minimal flush time is 100ms.
+
 delba
 	This command is used to delete either all Tx BA or all Rx BA or a specific BA stream
 	based on direction, TID and peer address.
@@ -2563,18 +2793,14 @@
 
 getchload
     This command gets the current channel load (in %), noise floor value (in dbm) and rx_quality (in %, higher % indicates better rx quality)
-	This command also sets cca threhold value when provided and enables OFDM desense (Only for IW416)
 Usage:
-        mlanutl uapX getchload <duration> [<cca_threshold>]
+        mlanutl uapX getchload <duration>
 	<duration> can be within 1-10(specifying 10ms to 100ms), default duration will be 100ms
-	[<cca_threshold>] can be within 1 to 120 and also sets OFDM desense (Only for IW416)
 
         Examples:
         mlanutl uap0 getchload          : gets channel load (in %), noise floor (in dbm) and rx_quality (in %) for 100ms duration
 		mlanutl uap0 getchload 1	    : gets channel load (in %), noise floor (in dbm) and rx_quality (in %) for 10ms duration
 		mlanutl uap0 getchload 6	    : gets channel load (in %), noise floor (in dbm) and rx_quality (in %) for 60ms duration
-		mlanutl uap0 getchload 4 70     : gets channel load (in %), noise floor (in dbm) and rx_quality (in %) for 40ms duration
-                                          and sets cca threshold as -70dBm setting OFDM desense (Only for IW416)
 
 dfs_repeater
 	This command is used to get/set DFS Repeater mode.
@@ -2813,7 +3039,7 @@
     Example:
         mlanutl uap0 getstalist
 
-channel_switch <switch mode> <oper class> <new channel> <switch count> <bandwidth/num_pkts>
+channel_switch <switch mode> <oper class> <new channel> <switch count> <bandwidth/num_pkts/num_retry_pkts> <mode>
 channel_switch <switch mode> <oper class> <new channel> <switch count> <bandwidth>
     This command is used to do channel switch according to spec.
 
@@ -2822,12 +3048,17 @@
         oper class  : operating class according to IEEE std802.11 spec, when 0 is used, only CSA IE will be used
         new channel : the channel will switch to
         switch count: channel switch time to send ECSA ie
-                      (when set to 0, CSA/ECSA action frame will be send out)
-        switch count: channel switch time to send CSA ie
-
+                      (for IW51x/AW51x/IW61x/AW61x, when set to 0, CSA/ECSA action frame will be send out)
         bandwidth   : channel width switch to(optional),only for 5G channels.
                       Support value 1 -- 40M above, 3 -- 40M below, 4 -- 80M, 5 -- 160M
-        num_pkts    : send number of CSA/ECSA action frame
+       Below <num_pkts/num_retry_pkts> <mode> params are applicable only to IW51x/AW51x/IW61x/AW61x
+       num_pkts    : send number of broadcast CSA/ECSA action frame (default:3, maximum:9)
+       num_retry_pkts: retry attempt limit for unicast CSA/ECSA action frame
+
+       mode        : BIT0: 0: send broadcast CSA/ECSA action frame
+                           1: send unicast CSA/ECSA action frame
+                     BIT1: 0: disable CTS for action frame
+                           1: enable CTS for action frame
 
     Example:
         mlanutl uap0 channel_switch 1 115 36 10     :switch to channel 36, oper class 115
@@ -2836,7 +3067,35 @@
         mlanutl uap0 channel_switch 1 0 36 10 1     :switch to channel 36, bandwidth 40MHz above
         mlanutl uap0 channel_switch 1 0 36 0 3       :switch to channel 36, and send 3 broadcast CSA action frame
         mlanutl uap0 channel_switch 1 115 36 0 3   :switch to channel 36, and send 3 broadcast ECSA action frame
-		                                                                     (Only IW61X supports sending CSA/ECSA action frames)
+        mlanutl uap0 channel_switch 1 115 36 0 8 3  :switch to channel 36, and send unicast action frame,
+                                                     protected by CTS and set max retry attempt to 8
+
+chanswitch_param
+	This command configures the new CSA parameter for target channel and backup channel.
+
+	mlanutl uapX chanswitch_param <mode> <num_pkts/num_retry_pkts>
+
+	mode: BIT0: 0: send broadcast CSA/ECSA action frame
+	            1: send unicast CSA/ECSA action frame
+	      BIT1: 0: disable CTS for action frame
+	            1: enable CTS for action frame
+	num_pkts: send number of broadcast CSA/ECSA action frame (default:3, maximum:9)
+	num_retry_pkts: retry attempt limit for unicast CSA/ECSA action frame
+
+	Example:
+        mlanutl uap0 chanswitch_param       : This command will get the current values for the [mode] and [num_pkts/num_retry_pkts].
+        mlanutl uap0 chanswitch_param 0 3   : send 3 broadcast CSA action frame
+        mlanutl uap0 chanswitch_param 1 5   : send unicast action frame and set max retry attempt to 5
+
+setmode
+    This command is used to set the multi_ap mode.
+
+    Example:
+        mlanutl uap0 setmode 3		: multi_ap_flag = 0x60, Supports backhaul and fronthaul BSS
+        mlanutl uap0 setmode 2		: multi_ap_flag = 0x40, Supports backhaul BSS
+        mlanutl uap0 setmode 1		: multi_ap_flag = 0x20, Supports fronthaul BSS
+
+	mlanutl uap0 setmode 		: Get the mode value
 
 hostcmd 2040coex
 	This command is used to send the 11n 20/40 Coex command to firmware.
@@ -2862,6 +3121,12 @@
 	Usage:
 		mlanutl mlanX hostcmd config/bg_scan.conf bgscfg
 
+hostcmd bgs_query
+	This command is used to query background scan report.
+
+	Usage:
+		mlanutl mlanX hostcmd config/bg_scan.conf bgs_query
+
 hostcmd <pkt_coalescing.conf> coalesce_cfg
 	This command is used to set/clear rules to filter and buffer
 	broadcast/multicast packet which reduce unwanted patcket or interrupt to
@@ -3275,13 +3540,14 @@
 	when WLAN device is put to sleep.
 
 	Usage:
-		mlanutl mlanX inactivityto <n> <m> <l> [k]
+		mlanutl mlanX inactivityto <n> <m> <l> [k] [j]
 
 	where the parameter are:
 		<n>: timeout unit in microseconds.
 		<m>: Inactivity timeout for unicast data.
 		<l>: Inactivity timeout for multicast data.
 		[k]: Inactivity timeout for new Rx traffic after PS notification to AP.
+		[j]: Inactivity timeout for cmd.
 
 	Examples:
 		mlanutl mlan0 inactivityto           : Get the timeout value
@@ -3321,7 +3587,7 @@
 		mlanutl mlanX listeninterval [l]
 
 	where the parameter:
-		[l]: Value of listen interval [Default 10]
+		[l]: Value of listen interval [Default 20]
 
 	Examples:
 		mlanutl mlan0 listeninterval     : Display Listen interval
@@ -3412,6 +3678,9 @@
 			: Bit 4 - Probe Request
 			: Bit 5 - Probe Response
 			: Bit 8 - Beacon Frames
+			: Bit 10 - Disassociation
+			: Bit 11 - Authentication
+			: Bit 12 - Deauthentication
 			: Bit 13 - Action Frames
 
 	Examples:
@@ -3477,6 +3746,9 @@
 		    bit 0: (1/0) enable/disable management frame
 		    bit 1: (1/0) enable/disable control frame
 		    bit 2: (1/0) enable/disable data frame
+                    bit 3: (1/0) enable/disable frames destined to active connection only
+                    bit 5: (1/0) enable/disable non-BSS beacon frames
+                    bit 6: (1/0) enable/disable Tx frames, excluding control
 		<band>   : 802.11 band
 		    bit 0: B
 		    bit 1: G
@@ -3561,7 +3833,7 @@
 	   a passphrase or psk. If no arguments are provided then AKMP=802.1x, and passphrase
 	   should be provided after association.
 	   End of each parameter should be followed by a ';'(except for the last parameter)
-	   as the delimiter. If ';' or '/' has to be used in an SSID then a '/' should be preceded
+	   as the delimiter. If ';' or '/' has to be used in an SSID or passphrase then a '/' should be preceded
 	   to ';' or '/' as a escape.
 
 	Examples:
@@ -3574,6 +3846,9 @@
 		If user wants to input the ssid as "//;" then command has to be
 		mlanutl mlan0 passphrase "1;ssid=/////;;passphrase=abcdefgh"
 
+		If user wants to input ssid as "NXP" and passphrase as "12345/;67890" then command has to be
+		mlanutl mlan0 passphrase "1;ssid=NXP;passphrase=12345///;67890"
+
 	3) "2;<ssid=valid ssid>" - This will clear the passphrase
 	   for specified ssid, if none specified then it will clear all.
 
@@ -3873,7 +4148,7 @@
 	This command is used to set/get scan configuration parameters.
 
 	Usage:
-               mlanutl mlanX scancfg [t] [m] [p] [s] [a] [b] [c] [ext] [gap]
+ 		mlanutl mlanX scancfg [t] [m] [p] [s] [a] [b] [c] [ext] [gap]
 
 	where the parameters:
 		[t]: Scan Type (0: Unchanged, 1: Active, 2: Passive, default Active)
@@ -3895,10 +4170,10 @@
 		                                   specific scan time to 200 ms, all the other scan
 		                                   configurations are unchanged
 		mlanutl mlan0 scancfg 0 0 0 0 0 0 1  : Set Passive to Active Scan to enable, all the
-                                                      other scan configurations are unchanged
+ 		                                       other scan configurations are unchanged
 		mlanutl mlan0 scancfg 2 0 0 0 0 0 2  : Set scan type to passive, Passive to Active
-                                                      Scan to disable, all the other scan configurations
-                                                      are unchanged
+  		                                       Scan to disable, all the other scan configurations
+  		                                       are unchanged
 
 sdcmd52rw
 	This command is used to read/write a controller register in
@@ -3944,8 +4219,13 @@
 	Usage:
 		mlanutl mlanX sdioclock 1 (on)
 		mlanutl mlanX sdioclock 0 (off)
-		mlanutl mlanX sdioclock (get the current clock state)
 
+sdiobuswidth
+	Set sdiobuswidth to 1-bit or 4 bit mode.
+
+	Usage:
+		mlanutl mlanX sdiowidth 4 (4-bit mode)
+		mlanutl mlanX sdiowidth 1 (1-bit mode)
 
 setuserscan
 	Initiate a customized scan and retrieve the results
@@ -3962,6 +4242,7 @@
 	  wc="[WILDCARD SSID]"     specify a UNIX pattern matching filter (using *
 	                           and ?) for SSIDs found in a broadcast probe
 	  keep=[0 or 1]            keep the previous scan results (1), discard (0)
+	                           please note aged out (>10s) entries will be deleted even keep=1
 	  dur=[scan time]          time to scan for each channel in milliseconds
 	  gap=[gap time]           Time gap between two scans in milliseconds
 	  probes=[#]               number of probe requests to send on each chan
@@ -3985,7 +4266,7 @@
 		setuserscan chan=1g,6g,11g
 
 	2) Perform a passive scan on channel 11 for 20 ms:
-		setuserscan chan=11gp dur=20
+		setuserscan chan=11g dur=20
 
 	3) Perform an active scan on channels 1, 6, and 11; and a passive scan on
 	   channel 36 in the 'a' band:
@@ -4483,7 +4764,7 @@
            AC_BK: 1
            AC_VI: 2
            AC_V0: 3
-           AIFSN: AIFSN value
+           AIFSN: AIFSN (bit0-3 for AIFSN value, bit 4 for ACM)
            ECW_MAX: ECW max
            ECW_MIN: ECW min
            TX_OP: TXOP Limit
@@ -4491,16 +4772,21 @@
 
         Example:
         mlanutl mlanX wmmparamcfg 0 3 10 4 0
-           Set AC_BE with AIFSN 3, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+           Set AC_BE with AIFSN 3, ACM=0, ECW_MAX 10, ECW_MIN 4 and TXOP 0
 
         mlanutl mlanX wmmparamcfg 1 7 10 4 0
-           Set AC_BK with AIFSN 7, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+           Set AC_BK with AIFSN 7, ACM=0, ECW_MAX 10, ECW_MIN 4 and TXOP 0
 
         mlanutl mlanX wmmparamcfg 2 2 4 3 94
-           Set AC_VI with AIFSN 2, ECW_MAX 4, ECW_MIN 3 and TXOP 94
+           Set AC_VI with AIFSN 2, ACM=0, ECW_MAX 4, ECW_MIN 3 and TXOP 94
 
         mlanutl mlanX wmmparamcfg 3 2 3 2 47
-           Set AC_VO with AIFSN 2, ECW_MAX 3, ECW_MIN 2 and TXOP 47
+           Set AC_VO with AIFSN 2, ACM=0, ECW_MAX 3, ECW_MIN 2 and TXOP 47
+
+	Below command will enable ACM for given AC  irrespective of AP advertisement.
+	Ideal case - ACM bit for the AC will be enabled based on the AP advertisement of ACM on that AC.
+	mlanutl mlanX wmmparamcfg 0 19 10 4 0
+	Set AC_BE with AIFSN 3, ACM=1, ECW_MAX 10, ECW_MIN 4 and TXOP 0
 
         mlanutl mlanX wmmparamcfg
             Get current WMM parameters
@@ -4560,26 +4846,25 @@
     channel index0:
         [c] :  chantime(in TU)
         [s] :  switchtime(in TU)
-        [u] :  undozetime(in TU)
+        [u] :  rx wait time(in TU)
         [m] :  mode :0x0 --- PM1(default)
                      0x1 --- Null2Self
     channel index1:
         <a> :  chantime(in TU)
         <b> :  switchtime(in TU)
-        <d> :  undozetime(in TU)
+        <d> :  rx wait time(in TU)
         <e> :  mode :0x0 --- PM1(default)
                      0x1 --- Null2Self
     Note:
         channel index0: the first channel
         channel index1: the second channel
-        undozetime should be less than other channel's switchtime
         If want to set two channels the same parameters, just ignore the last four parameters and
         use [c] [s] [u] [m] to set.
     Examples:
         mlanutl mlanX mc_cfg_ext                        : Get the drcs parameters for two channels.
-        mlanutl mlanX mc_cfg_ext 15 10 5 0              : Set two channels:channeltime 15TU, switchtime 10TU, undozetime 5TU, mode PM1
-        mlanutl mlanX mc_cfg_ext 15 10 5 0 25 15 9 0    : Set channel index0: channeltime 17TU, switchtime 10TU, undozetime 5TU, mode PM1;
-                                                        set channel index1: channeltime 25TU, switchtime 15TU, undozetime 9TU, mode PM1.
+        mlanutl mlanX mc_cfg_ext 15 10 5 0              : Set two channels:channeltime 15TU, switchtime 10TU, rx wait time 5TU, mode PM1
+        mlanutl mlanX mc_cfg_ext 15 10 5 0 25 15 9 0    : Set channel index0: channeltime 15TU, switchtime 10TU, rx wait time 5TU, mode PM1;
+                                                        set channel index1: channeltime 25TU, switchtime 15TU, rx wait time 9TU, mode PM1.
 
 cfg_noa
 	This is used to get/set P2P NoA (Notice of Absence) parameters only for P2P GO.
@@ -4643,6 +4928,20 @@
             mlanutl mlan0 indrstcfg         : Get the status and the pin used for reset pin
             mlanutl mlan0 indrstcfg 2       : Enable in band reset mode
 
+    This command is used to set FW wakeup method and GPIO pin
+    Usage :
+            mlanutl <interface> fwwakeupmethod <method> <GPIO_pin>
+            interface : mlanX
+            method:
+                        1       -- Firmware wakeup through the interface command interrupt
+                                -- (default setting for SDIO/PCIe/USB)
+                        2       -- Firmware wakeup through the GPIO pin
+            GPIO_pin:  If firware wakeup throug GPIO pin, [g] is GPIO pin number
+    Example :
+            mlanutl mlan0 fwwakeupmethod     : Get current wakeup method
+            mlanutl mlan0 fwwakeupmethod 1   : Set wakeup method is interface method
+            mlanutl mlan0 fwwakeupmethod 2 5 : Set wakeup method is GPIO method and GPIO pin is 5.
+
 ctrldeauth
     This command is used to set/get firmware ctrldeauth setting
     Usage :
@@ -4669,18 +4968,25 @@
             mlanutl mlan0 robustcoex gpiocfg 1 4 1 : Enable robustcoex gpio, set gpionum to 4 and gpiopolarity to 1
             mlanutl mlan0 robustcoex gpiocfg 0     : Disable robustcoex gpio
 
-cwmode
-    This command is used to set Cont. Tx/Wave mode.
+gpiocfg
+	This command is used to configure gpio pins, set and get gpio pins value to high and low.
 
-    Usage:
-            mlanutl <interface> cwmode config/cwmode.conf
-            interface: mlanX
-            cwmode.conf: This config file specifies whether to enable/disable Cont Tx/Wave mode.
-                         User can specify parameters like Channel, datarate, BW, Channel Offset, Band.
-                         Detailed information about parameters is mentioned in the conf file.
-    Example:
-            mlanutl mlan0 cwmode config/cwmode.conf                       : Enable/Disable Cont Tx/Wave mode.
-            mlanutl mlan0 cwmode                                          : Get current Tx mode
+	Usage :
+			mlanutl <interface> gpiocfg <pin_num> <mode> <value>
+
+			<mode> : set type of operation to perform
+				 1 : Configure gpio pin to output mode
+				 0 : Configure gpio pin to input mode
+			<pin_num> : Number of gpio pin to configure
+			<value> : set value
+				  0 : For set state low
+				  1 : for set state high
+
+	Example :
+			mlanutl mlan0 gpiocfg 5 1 1		: Set gpio pin 5 as output mode and value high
+			mlanutl mlan0 gpiocfg 5	1		: Set gpio pin 5 status as output mode
+			mlanutl mlan0 gpiocfg 4	0		: Set gpio pin 4 status as input mode
+			mlanutl mlan0 gpiocfg 4			: Get gpio pin 4 mode and value
 
 bootsleep
     This command is used to set and get boot sleep configure.
@@ -4705,7 +5011,7 @@
         ssu file    : file to config ssu parameter
 
     Example :
-        mlanutl mlan0 ssu                   :Enable SSU and use driver default ssu parameter
+    	mlanutl mlan0 ssu                   :Enable SSU and use driver default ssu parameter
         mlanutl mlan0 ssu config/ssu.conf   :Enable SSU and use ssu parameter from ssu.conf
         mlanutl mlan0 ssu 2                 :Enable SSU and use FW default ssu parameter
 
@@ -4718,8 +5024,11 @@
         enable     : config file with csi filters
 
     Example :
-        mlanutl mlan0 csi config/csi.conf       : Enable CSI
-        mlanutl mlan0 csi 0             	: Disable CSI
+    	mlanutl mlan0 csi config/csi.conf       : Enable CSI
+    	mlanutl mlan0 csi 0             	: Disable CSI
+
+    Note: csi shall be enabled only after there is an active
+          interface of uAP or STA connected to an ex-AP
 
 arb
     Set HW ARB mode
@@ -4737,24 +5046,23 @@
             4:  arb mode 4 (Improve RX throughput)
 
     Example :
-        mlanutl mlan0 arb 1           : Set HW ARB mode 1
+    	mlanutl mlan0 arb 1           : Set HW ARB mode 1
 
 dmcs
     This command is used to config DMCS or get DMCS status.
 
     Usage:
             mlanutl mlanX dmcs <subcmd> [value]
-
             <subcmd = 0> : config mapping policy
                            disable dynamic mapping when [value = 0]
-                           enable dynamic mapping when [value = 1]
+                           enable dynamic mapping but disable prefer DBC when [value = 1]
+                           enable dynamic mapping and enable prefer DBC when [value = 2]
             <subcmd = 1> : get DMCS status
 
     Example :
             mlanutl mlan0 dmcs 0 1         : Enable dynamic mapping
             mlanutl mlan0 dmcs 0 0         : Disable dynamic mapping
             mlanutl mlan0 dmcs 1           : Get DMCS status
-
 range_ext
     This command is used to config range extension mode.
 
@@ -4789,6 +5097,42 @@
     Example:
             mlanutl mlan0 twt_teardown config/twt.conf
 
+twt_report
+    This command is used to get BTWT id's/schedules.
+
+    Usage:
+            mlanutl mlanX twt_report
+
+    Example:
+            mlanutl mlan0 twt_report
+
+twt_information
+    This command is used to config TWT information parameters using conf file.
+
+    Usage:
+            mlanutl mlanX twt_information [conf file]
+
+    Example:
+            mlanutl mlan0 twt_information config/twt.conf
+
+btwt_AP_config_set
+    This command is used to set BTWT AP config parameters using conf file.
+
+    Usage:
+            mlanutl uapX btwt_AP_config_set [conf file]
+
+    Example:
+            mlanutl uap0 btwt_AP_config_set config/twt.conf
+
+btwt_AP_config_get
+    This command is used to get BTWT AP config parameters using conf file.
+
+    Usage:
+            mlanutl uapX btwt_AP_config_get [conf file]
+
+    Example:
+            mlanutl uap0 btwt_AP_config_get config/twt.conf
+
 rx_abort_cfg
     This command is used to set/get static rx abort config for pkt having
     weaker RSSI than threshold. This threshold will be overwritten on starting
@@ -4814,19 +5158,45 @@
             - Enable rx abort and set weak RSSI Threshold to -40 dBm
         mlanutl mlan0 rx_abort_cfg 0
             - Disable rx abort
+ofdm_desense_cfg
+    This command is used to set ofdm_desense_cfg to configure cca_threshold(Only for IW416)
 
+    Usage:
+        mlanutl <interface> ofdm_desense_cfg [enable] [cca_threshold]
+
+    Where the parameters are:
+        <interface>       : mlanX,
+                            uapX
+        [enable]          : 0 - Disable ofdm_desense_cfg
+                            1 - Enable ofdm_desense_cfg of pkt to conigure cca
+        [cca_threshold]  : weak CCA pkt threshold in dBm (absolute value)
+
+    Examples:
+        mlanutl mlan0 ofdm_desense_cfg
+            - Display current ofdm_desense_cfg configuration
+        mlanutl uap0 ofdm_desense_cfg 1 60
+            - Enable ofdm_desense_cfg and set cca_threshold to -60 dBm
+        mlanutl mlan0 ofdm_desense_cfg 1 40
+            - Enable ofdm_desense_cfg  and set weak cca_threshold to -40 dBm
+        mlanutl mlan0 ofdm_desense_cfg 0
+            - Disable ofdm_desense_cfg
 rx_abort_cfg_ext
     This command is used to set/get dynamic rx abort config. This will set
     threshold based on minimum of ceiling rssi threshold and the weakest
     RSSI among all connected peers. Margin can be specified as an offset to
     this threshold. Default margin is set to -10 dBm. Ceiling rssi threshold
-    can be changed by specifying. Default ceil is set to -70 dBm.
-    This will be disabled on enabling fixed rx abort (rx_abort_cfg)
+    can be changed by specifying. Default ceil is set to EDMAC based threshold
+    if EDMAC is enabled otherwise set to -62 dBm if EDMAC is disabled.
+    Floor rssi threshold value can also be specified to cap the weakest rssi.
+    Default floor rssi value is set to -82 dBm.
+    If thresholds are set via this command, they will take precedence over default
+    values. Provision is provided to restore deafault values (see examples below).
 
+    This will be disabled on enabling fixed rx abort (rx_abort_cfg)
     Note: This dynamic rx abort mode is enabled by default.
 
     Usage:
-        mlanutl <interface> rx_abort_cfg_ext [enable] [margin ceil_thresh]
+        mlanutl <interface> rx_abort_cfg_ext [enable] [margin ceil_thresh floor_thresh]
 
     Where the parameters are:
         <interface>       : mlanX,
@@ -4837,6 +5207,8 @@
                             (default = 10)
         [ceil_thresh]     : ceiling weak RSSI pkt threshold in dBm
                             (absolute value) (default = 70)
+        [floor_thresh]    : floor weak RSSI pkt threshold in dBm
+                            (absolute value) (default = 82)
 
     Examples:
         mlanutl mlan0 rx_abort_cfg_ext
@@ -4844,12 +5216,54 @@
         mlanutl uap0 rx_abort_cfg_ext 1 10 60
             - Enable dynamic rx abort, set margin to -10 dBm and set ceil
               RSSI Threshold to -60 dBm
+        mlanutl uap0 rx_abort_cfg_ext 1 10 75 85
+            - Enable dynamic rx abort, set margin to -10 dBm and set ceil
+              RSSI Threshold to -70 dBm, set floor RSSI Threshold to -85 dBm
+        mlanutl uap0 rx_abort_cfg_ext 1 10 0xff
+            - Enable dynamic rx abort, set margin to -10 dBm and set ceil value
+              to default, based on EDMAC enabled or disabled status
         mlanutl mlan0 rx_abort_cfg_ext 1 5 50
             - Enable dynamic rx abort, set margin to -5 dBm and set ceil
               RSSI Threshold to -50 dBm
         mlanutl mlan0 rx_abort_cfg_ext 0
             - Disable dynamic rx abort
 
+nav_mitigation
+    This command is used to set/get NAV migration parameters NAV mitigation status and duration threshold in us.
+    threshold value will be ignored if start_nav_mitigation is passed as 0.
+    In case start_nav_mitigation and threshold are not passed then nav_mitigation command will return below parameters:
+        Current NAV mitigation status
+        Current NAV mitigation duration threshold in us
+        Counter for NAV mitigation detected
+        Counter for NAV mitigation stopped
+
+    Usage:
+        mlanutl <interface> nav_mitigation [start_nav_mitigation] [threshold]
+
+    Where the parameters are:
+        <interface>       : mlanX,
+                            uapX
+        [start_nav_mitigation]	: 0 - Stop NAV mitigation
+                                 1 - Start NAV mitigation
+        [threshold]          	: Duration value in us to set as threshold
+
+    Examples:
+        mlanutl mlan0 nav_mitigation
+            - Display the values for below parameters:
+                Current NAV mitigation status (stopped:0, started:1)
+                Current NAV mitigation threshold in us
+                Counter for NAV mitigation detected
+                Counter for NAV mitigation stopped
+        mlanutl uap0 nav_mitigation 0
+            - Stop the NAV mitigation for given interface
+        mlanutl uap0 nav_mitigation 1 6000
+            - Start the NAV mitigation for given interface with threshold 6000us
+
+        mlanutl mlan0 nav_mitigation 0
+            - Stop the NAV mitigation for given interface
+        mlanutl mlan0 nav_mitigation 1 6000
+            - Start the NAV mitigation for given interface with threshold 6000us
+
 tx_ampdu_prot_mode
     This command is used to set either RTS/CTS or CTS2SELF protection mechanism
     in MAC, for aggregated Tx QoS data frames. RTS/CTS is enabled by default.
@@ -5152,16 +5566,20 @@
              Bit 1: Packet expiry
              Bit 2: CTS2Self
              Bit 3: CTS2Sef duration offset
+             Bit 6: UC non aggregation
         [j]: Mask Bitmap, 1-valid, 0-invalid
              Bit 0: MC aggregation
              Bit 1: Packet expiry
              Bit 2: CTS2Self
+             Bit 6: UC non aggregation
 
     Examples:
             mlanutl uap0 mc_aggr_cfg 1 1                    Enable MC aggregation
             mlanutl uap0 mc_aggr_cfg 7 7                    Enable MC aggregation,Packet expiry,CTS2Self feature
+            mlanutl uap0 mc_aggr_cfg 0x46 0x46              Enable UC non aggregation,Packet expiry,CTS2Self feature
             mlanutl uap0 mc_aggr_cfg                        Query current MC aggregation configuration.
 
+        Note: UC non aggregation and MC aggregation are mutually exclusive.
 mcast_tx
     This command is used to transmit multicast packets as per the mcast_tx conf file.
 
@@ -5171,6 +5589,19 @@
 	<interface>  : wifi interface name i.e. uap0
 	<mcast_tx.conf> : multicast tx conf file
 
+turbo_mode
+
+    This command is used to set/get turbo mode.
+
+    Usage:
+        ./mlanutl mlan0 turbo_mode
+        ./mlanutl mlan0 turbo_mode <mode>
+        <mode> can be 0,1,2,3,4
+
+    Examples:
+        ./mlanutl mlan0 turbo_mode 2        : sets turbo_mode to 2
+        ./mlanutl mlan0 turbo_mode            : gets the current turbo_mode
+
 stats
     This command is used to get/reset Tx-Rx stats for unicast/multicast address.
     Usage:
@@ -5196,6 +5627,237 @@
             i/p: mlanutl uap0 getuuid
             o/p: uuid: a0b0c0d0d0c0b0a0a0b0c0d0d0c0b0a0
 
+crosssynch
+	This command is used to start and stop cross chip TSF synch feature
+
+	Usage:
+	mlanutl uapX  crosssynch [j][k] [l] [m] [n]
+
+	where
+		[j] Start_stop:
+			<action> - This parameter use to start of stop feature
+			0: stop
+			1: start
+		[k] Role:
+			1: Master
+			2: Slave
+		[l] period: Periodicity of toggle in us
+		[m] InitTSF_Low: Initial TSF, low dword
+		[n] InitTSF_high: Initial TSF, high dword
+
+Examples:
+	mlanutl uap0 crosssynch // Get params
+	mlanutl uap0 crosssynch 1 1 0xC8 0x40000 0 // start master
+	mlanutl uap0 crosssynch 1 2 0xC8 0x40000 0 // start slave
+
+wlan_tsp_cfg
+       This command is used to set and get the TSP configuraion.
+       This command also reads out CAU TSEN and RFU temperature registers
+
+       Usage:
+       mlanutl mlanX/uapX wlan_tsp_cfg [j] [k] [l] [m] [n] [o] [p] [q]
+
+       where:
+               [j] enable:
+                       This parameter used to start or stop the TSP feature
+                       0: disable
+                       1: enable
+               [k] backoff:
+                       Power backoff [0...10]
+               [l] highThreshold : High power Threshold [0...300]
+               [m] lowThreshold : Low power Threshold [0...300]
+               [n] duty_cyc_step : Duty Cycle setp [1...100]
+               [o] duty_cyc_min : Duty Cycle min [0...100]
+               [p] high_thrshld_temp : High Threshold temperature [-100 ....150]
+               [q] low_thrshld_temp : Low Threshold temperature [-100.... 150]
+
+               highThreshold must be greater than lowThreshold.
+               High Threshold temperature must be greater than Low Threshold temperature.
+
+Examples:
+       mlanutl mlanX/uapX wlan_tsp_cfg 1 2 100 50	// enable TSP with some basic parameter values
+       mlanutl mlanX/uapX wlan_tsp_cfg		// Get TSP config parameter values
+       mlanutl mlanX/uapX wlan_tsp_cfg 0	// disable(if enable=1 is already set)
+
+led
+    This command is used to set/get LED behavior parameter such as led state, duty cycle index and
+	cycle length index for each firmware state.
+    Duty cycle index and cycle length index will be set only if led state is set to user defined(5).
+    In case no argument passed then led command will return led state, duty cycle and
+    cycle length for each firmware state.
+
+    Usage:
+        mlanutl <interface> led m <n o p q> <n o p q> <n o p q> <n o p q> <n o p q> <n o p q>
+
+    Where the parameters are:
+        <interface>       : mlanX,
+                            uapX
+        [m]: Enable or Disable
+             0: Disable LED feature
+             1: Enable LED feature with FW default / previously configured settings
+
+        [n]: Firmware state
+             0: reserved
+             1: powersave
+             2: scanning
+             3: Data Tx/Rx
+             4: Connected and Idle
+             5: Disconnected
+
+        [o]: Led state
+             0: Off
+             1: On
+             2: Fast blink
+             3: Slow blink
+             4: Medium blink
+             5: User defined
+
+        If [o] < 5, then <p> and <q> are not present.
+        If led state = 5:
+            [p]: Cycle length index
+                 0: 37ms
+                 1: 74ms
+                 2: 149ms
+                 3: 298ms
+                 4: 596ms
+                 5: 1192ms
+
+            [q]: Duty Cycle index
+                 0: 1/2
+                 1: 1/4
+                 2: 1/8
+                 3: 1/16
+                 4: 1/32
+
+    Examples:
+        mlanutl mlan0 led
+            - Display Led feature enable/disable status
+            - If feature is enabled, display the below parameters for each firmware state:
+               Led state
+               Cycle length index (Cycle Length)
+               Duty cycle index (Duty Cycle)
+
+        mlanutl mlan0 led 0
+            - Disables the feature
+        mlanutl mlan0 led 1
+            - Enables feature with FW default / previously configured settings
+        mlanutl mlan0 led 1 2 2
+            - Fast blink on scanning
+        mlanutl mlan0 led 1 2 2 3 5 1 0
+            - Fast blink on scanning, For data tx/rx: cycle length is 74ms, duty cycle is 1/2.
+
+vndr_cmd_dump
+    This command is used to get the dump for the mlanutl commands, which are supported via the
+    netlink interface. The generated dump includes OUI, a subcmd id and its arguments. This
+    dump is printed in specific raw format as per iw and wpa_cli vendor cmd input format.
+
+    This dump will be used as an input data to an iw and wpa_cli vendor cmd, which sends the
+    private vendor cmd to driver over the netlink. The specific subcmd support required in
+    driver for that cmd to work.
+
+    Usage:
+	mlanutl mlanX vndr_cmd_dump [mlanutl_cmd] [arguments]
+
+    Where the parameters are:
+        <interface>        :  mlanX,
+                              uapX
+       [mlanutl_cmd]       :  mlanutl cmd for which dump is required and
+                              this is supported in driver over the netlink
+       [arguments]         :  mlanutl cmd arguments as per user mlanult manual,
+                              which are set as per user requirements.
+    Examples:
+        // SET cmd:
+        mlanutl mlan0 vndr_cmd_dump scancfg 0 1 5 490 480 1200 2 1 500
+        mlanutl mlan0 vndr_cmd_dump addbapara 0 32 48 1 1
+                - Display the corresponding cmd input data in the required hexdump formats
+                  for an uaputl supported cmd
+                - Generated hexdump will be used with iw/wpa_cli vendor cmd to set that correponding cmd
+        Below iw/wpa_cli vendor cmd using the above hexdump to set the correponding cmd,
+        iw dev mlan0 vendor send 0x5043 0x200 0x01 0x00 0x01 0x01 0x01 0x05 0x02 0x01 0xea 0x02 0x01 0xe0 0x02 0x04 0xb0 0x01 0x02 0x01 0x01 0x02 0x01 0xf4
+        wpa_cli -i mlan0 vendor 5043 512 0100010101050201ea0201e00204b0010201010201f4 nested=0
+                - iw/wpa_cli private vendor related to scancfg SET cmd over the netlink
+        iw dev mlan0 vendor send 0x5043 0x201 0x01 0x00 0x01 0x20 0x01 0x30 0x01 0x01 0x01 0x01
+        wpa_cli -i mlan0 vendor 5043 513 01000120013001010101 nested=0
+                - iw/wpa_cli private vendor related to addbapara SET cmd over the netlink
+
+        // GET cmd:
+        mlanutl mlan0 vndr_cmd_dump scancfg
+        mlanutl mlan0 vndr_cmd_dump addbapara
+                - Display the corresponding cmd input data in the required hexdump formats
+                  for an uaputl supported cmd
+                - Generated hexdump will be used with iw/wpa_cli vendor cmd to get the
+                  correponding cmd response
+        Below iw/wpa_cli vendor cmd using the above hexdump to GET the correponding cmd response,
+        iw dev mlan0 vendor recv 0x5043 0x200 0x00
+        wpa_cli -i mlan0 vendor 5043 512 00 nested=0
+                - iw/wpa_cli private vendor related to scancfg GET cmd over the netlink
+                  and cmd output is printed as 4-byte hex format for each argument
+                - wpa_cli doesn't print the cmd output, even though the cmd was responded by driver
+        iw dev mlan0 vendor recv 0x5043 0x201 0x00
+        wpa_cli -i mlan0 vendor 5043 513 00 nested=0
+                - iw/wpa_cli private vendor related to addbapara GET cmd over the netlink
+                  and cmd output is printed as 4-byte hex format for each argument
+                - wpa_cli doen't print the cmd output, even though the cmd was responded by driver
+
+auth_assoc_timeout_cfg
+   This command is used to set/get Auth, (Re)Assoc Timeout configuration parameters.
+
+    Usage:
+	mlanutl mlanX auth_assoc_timeout_cfg <auth_timeout> <auth_retry_timeout_if_ack>  <auth_retry_timeout_if_noack>  <assoc_timeout> <reassoc_timeout> <assoc_retry_timeout>
+
+    Where the parameters are:
+	<auth_timeout>: Max waiting time before sending Auth Timeout
+			(value in ms, default 2400 ms, valid range: 500-2400).
+        <auth_retry_timeout_if_ack>: Timeout for each AuthFrame Retry. this should be under the cap of "auth_timeout".
+		This is when AP does Ack for AuthRequest but No Response from AP.
+		(value in ms, default: 300 ms, valid range: 50-300)
+        <auth_retry_timeout_if_no_ack>: Timeout for each AuthFrame Retry. This should be under the cap of "auth timeout".
+		This is when AP does not Ack for AuthRequest or AuthRequest Tx fails.
+		(value in ms, default: 80 ms, valid range: 40-80)
+        <assoc_timeout>: Max waiting time before sending Assoc Timeout. This is always initial connection.
+		(value in ms, default: 1500 ms valid range: 200-1500)
+	<reassoc_timeout>: Max waiting time before sending Assoc Timeout.
+		This is valid only for Roam, not for initial connection.
+		(value in ms, default: 330, valid range: 100-1500)
+	<assoc_retry_timeout>: Timeout for each Assoc/ReAssoc frame retry if acked.
+		(value in ms, default: 150 ms, valid range: 50-150)
+
+    Example:
+        mlanutl mlan0 auth_assoc_timeout_cfg
+            - Get the current auth_assoc_timeout_cfg configuration
+        mlanutl mlan0 auth_assoc_timeout_cfg 500 50 40 200 100 50
+
+events_mask
+	This command is to set/get the event masking configuration during Host Sleep (HS).
+	Any specific maskable event can be masked during Host Sleep using this
+	configuration.
+
+	Usage:
+		mlanutl mlanX events_mask [event_mask_in_hs.conf]
+			- Set/Get the event mask configuration for HS.
+
+		Where the parameters are:
+			<event_mask_in_hs.conf>: Events mask configuration file for Set.
+
+	Example:
+		mlanutl mlan0 events_mask event_mask_in_hs.conf
+			- Set the event mask configuration for HS.
+
+		Format of the conf file - Configuration to mask event 0x0017 in HS.
+		events_mask={
+			Enabled=1
+			[0x0017]
+		}
+
+		Explanation of the fields,
+		Enable=0|1  :   0 - Disabling the event masking feature.
+				1 - Enabling the event masking feature.
+		[0x0017]    : 	Event ID that needs to be masked. Multiple event IDs
+				can be listed in this format.
+
+		mlanutl mlan0 events_mask
+			- Get the event mask configuration for HS.
+
 ===============================================================================
 ===============================================================================
 		U S E R  M A N U A L  F O R  Enable Scan GAP
@@ -5207,3 +5869,4 @@
 
 For detail information, please refer the command description.
 ===============================================================================
+
diff --git a/wlan_src/README_MLANWLS b/wlan_src/README_MLANWLS
new file mode 100644
index 0000000..e0475fc
--- /dev/null
+++ b/wlan_src/README_MLANWLS
@@ -0,0 +1,189 @@
+===============================================================================
+		               USER  MANUAL FOR MLANWLS APP
+
+                           Copyright 2024 NXP
+
+
+1) FOR MLANWLS APP ONLY BUILD
+
+	Goto source code directory wlan_src/app/linux/mlanwls
+	make [clean] build
+	The app binaries can be found in mlanwls/ directory.
+
+2) Supported Features
+	- Location R1
+		- Dot11mc FTM session ISTA mode
+	- Location R2
+		- Dot11az Non-Trigger based FTM ISTA mode
+		- Dot11az Non-Trigger based FTM RSTA mode
+		- Dot11az Trigger based ISTA
+		- STA-STA FTM
+
+3) Usage:
+	The app can be run in 2 different modes.
+		- FTM command execution mode
+			- In this mode, user can run ftm commands to configure FTM session, Start / Stop FTM session.
+			  This mode supports ISTA function testing
+
+			- To Run the mlanwls driver app in command mode for wifi location measurements
+				Command Format :
+				- mlanwls <interface> <cmd> <subcommand> <args>
+
+				Commands Supported :
+				- mlanwls mlanX ftm session_cfg [<args>]
+				- mlanwls mlanX ftm session_ctrl [<args>]
+				- mlanwls mlanX ftm anqp_req [<args>]
+
+
+		- Event monitoring mode (For uAP)
+			- In this mode, The app monitors the events received from WLAN FW and process it.
+			  Typical use case would be, in AP mode to receives CSI events for csi processing.
+			   Events Processed :
+				- CSI event from FW
+				- FTM Event with Radio Measurement Request
+				- FTM complete event to get measured distance
+
+			- To Run the mlanwls driver app in event monitoring mode
+			  Command Format :
+				- mlanwls <interface> event <wlan_device_number>
+				Where:
+					<interface> : uap0 / muap0 (for multiple mac chipset)
+					<wlan_device_number> : To capture the events from FW on the corresponding interface,
+					    user need to provide wifi device number argument for the selected <interface>,
+						0: mac1 / radio0 / mlan0 / uap0 interface,
+						1: mac2 / radio1 / mmlan0 /muap0 interface,
+						Default: 0 / if not specified,
+				eg:
+					./mlanwls uap0 event  - Capture the events for uap0 interface
+
+					For Multiple mac chipsets,
+					./mlanwls muap0 event 1  - Capture the events for muap0 interface
+
+4) Command To Configure FTM session
+
+session_cfg
+
+	This sub command is used to configure FTM session params.
+	The default configuration set is Dot11mc at the start of the application and after every FTM session complete
+	the FTM session configuration in FW is reset to default 11mc protocol.
+
+	Important Note:
+	So to run 11az session, session_Cfg <1> <ftm.conf> command should be run before each session_ctrl to set 11az config.
+	This session_cfg for 11az will not persist after session gets completed and it will be reset to 11mc.
+
+	Usage:
+		mlanwls mlanX ftm session_cfg [<ftm_protocol> <config_file>]
+
+	Where,
+		<ftm_protocol> 	: 0:Dot11mc, 1:Dot11az-NTB 2:Dot11az-TB
+		<config_file> 	: Config file with Dot11mc / dot11az parameters
+					: Default config file ( ftm.conf ) is present in config folder in release
+
+	eg:
+		mlanwls mlan0 ftm session_cfg 0 config/ftm.conf 		- Sets dot11mc FTM session params from config file
+		mlanwls mlan0 ftm session_cfg 1 config/ftm.conf 		- Sets dot11az Non Trigger Based (NTB)session params from config file
+		mlanwls mlan0 ftm session_cfg 2 config/ftm.conf 		- Sets dot11az Trigger Based (TB) session params from config file
+
+5) Command To Start FTM session
+
+session_ctrl
+
+	This sub command is used to start FTM session in specific mode.
+	-	Associated with PMF Session
+	-	Associated without PMF Session
+	-	Unassociated with PMF Session
+	-	Unassociated without PMF session
+
+	Usage:
+		mlanwls <interface> ftm session_ctrl [<action> <chan> <mac_address> <loop_cnt> <wlan_device_number>]
+
+	Where:
+		<interface> : mlan0 / mmlan0(for multiple mac chipset)
+		<action> :
+		1: Start 11mc/11az FTM with associated Peer AP,
+		2: Stop FTM session
+		3: Start protected 11az FTM with associated Peer AP,
+		4: Start 11az/11mc FTM with unassoc Peer,
+		5: Start protected 11az FTM with unassoc Peer with PASN,
+		6: Start 11mc/11az FTM with unassociated Peer STA
+		<loop_cnt> : number of ftm sessions to run repeatedly ( default:1,  0:non-stop, n>1: n times).
+					 Note this <loop_cnt> option can be used only with 11mc config as 11az session needs explicit session_cfg command to be given before every session start.
+		<chan>     : Channel on which FTM must be started
+					For 6GHz channel, specify suffix 'e' to channel number. eg. '37e'
+		<mac_address> : Mac address of the associated peer with whom FTM session is required
+		<wlan_device_number> : wifi device number for the selected <interface>/<radio>,
+			0: mac1 / radio0 / mlan0 / uap0 interface,
+			1: mac2 / radio1 / mmlan0 /muap0 interface,
+			Default: 0 / if not specified,
+
+	Note:
+		- Run session_cfg command before running session_ctrl to set the required protocol (11mc/11az) and
+		the corresponding ftm params.
+		- In current implementation, STA FW default protocol is set to 11mc.
+		So if we need to run 11az session multiple times continuosly,each run needs session_cfg command given before session_ctrl.
+		For 11az session, run session_cfg every time before session_ctrl as below:
+				mlanwls mlan0 ftm session_cfg 1 config/ftm.conf 		- Sets dot11az Non Trigger Based (NTB)session params from config file
+				mlanwls mlan0 ftm session_ctrl <1/3/4/5> 6 00:50:43:20:bc:4  	- Run corresponding 11az FTM session
+		- If session_ctrl should be run on radio1 / mac2 interface for multiple mac chipsets, wlan_dev_number=1 should be given to bind the
+		netlink event socket to mac2 interface
+
+	eg:
+		mlanwls mlan0 ftm session_ctrl 1 6 00:50:43:20:bc:4  	- Run non-secure FTM session (11az/mc as configured by session_cfg command )
+		mlanwls mlan0 ftm session_ctrl 3 6 00:50:43:20:bc:4 	- Runs secure 11az FTM session ( TB/NTB as configured by session_cfg command ),
+		mlanwls mlan0 ftm session_ctrl 4 6 00:50:43:20:bc:4		- Runs non-secure FTM session with unassoc peer until user terminate,
+		mlanwls mlan0 ftm session_ctrl 5 6 00:50:43:20:bc:4  	- Runs Secure FTM session with unassociated Peer AP,
+		mlanwls mlan0 ftm session_ctrl 2						- Stop the FTM session
+		mlanwls mmlan0 ftm session_ctrl 1 11 00:50:43:20:bc:4 2 1	- Runs 2 associated FTM sessions on radio1 (11az/mc as configured ) without PMF on channel 11
+		mlanwls mlan0 ftm session_ctrl 1 37e 00:50:43:20:bc:4  	- Run non-secure FTM session on 6G channel 37 (11az/mc as configured by session_cfg command )
+
+6) Command To Send ANQP Request frame
+
+anqp_req
+
+	This sub command is used to send ANQP GAS Request to peer
+	Usage:
+		mlanwls mlanX ftm anqp_req [<conf> <chan> <mac_address>]
+
+	Where:
+		<config_file> : Config file with Dot11mc ANQP Query Request list
+		<chan> 	: Channel on which FTM must be started
+		<mac_address> : Mac address of the peer
+
+	eg.
+		mlanwls mlan0 ftm anqp_req ftm.conf 6 00:50:43:20:bc:04 - Sends ANQP Req frame to peer
+
+8)Enable FTM for unassociated STA state
+
+dot11mc_unassoc_ftm_cfg
+
+    This command is used to enable or disable the configuration for
+    DOT11MC FTM frames exchanges in un-associated state for STA or uAP
+
+    Usage:
+        mlanutl <mlanX/uAPX> dot11mc_unassoc_ftm_cfg [enable]
+
+        [enable]          : 0 - Disable unassociated state FTM
+                            1 - Enable unassociated state FTM
+
+    Examples:
+        mlanutl mlan0 dot11mc_unassoc_ftm_cfg
+            - Get current state of unassociated state FTM cfg
+        mlanutl mlan0 dot11mc_unassoc_ftm_cfg 1
+            - Set the unassociated state FTM cfg to Enabled
+
+===============================================================================
+REVISION LOG
+
+V5.2  - Added new error codes (Ref. WSW-46943)
+V5.1  - Added event mode support for mac2 (mmlan0) interface
+V5.0  - CSI processing code moved to libcsi
+V4.1  - Added Session_ctrl with action code 5 for Secure unassociated FTM session with PASN
+V4.0  - Added dedicated Session control Action Code for FTM session types
+V3.2  - Added support to send ANQP GAS Request frame
+V3.1  - Added support to process Radio measurement FTM Request event
+V3.0  - Restructured  app usage - Independant command mode and Event monitoring mode*/
+V2.1  - Integrated CSI event processing as part of FTM session ctrl command */
+V2.0  - Added support to process FW CSI events on host*/
+V1.2  - Added support to process ANQP event*/
+V1.1  - Added support to read the config from file*/
+V1.0  - Initial version that supported FTM session cfg and ctrl command*/
diff --git a/wlan_src/README_RBC b/wlan_src/README_RBC
new file mode 100644
index 0000000..837599f
--- /dev/null
+++ b/wlan_src/README_RBC
@@ -0,0 +1,112 @@
+===============================================================================
+            U S E R  M A N U A L for Robust BT-WLAN coex (RBC)
+
+ Copyright 2014-2020 NXP
+
+===============================================================================
+
+###############################
+
+# Abbreviations and acronyms
+
+###############################
+RBC - Robust BT-WLAN co-existence
+TMD - Time Distribute
+SMPS - Spatial Multiplexing Power Save
+
+###############################
+
+# Default RBC modes:
+
+###############################
+1.  For systems where BT and WLAN have seperate antennas, RBC mode is
+    automatically disabled in FW after detecting this from FEM cal data. e.g.
+    For 1x1 Dual-Ant system and 2x2 3-Ant system RBC mode is disabled.
+2.  For systems where BT and WLAN share an antenna, RBC mode is automatically
+    enabled in FW after detecting this from FEM cal data.
+    Default modes:
+    1x1 single antenna system: TMD RBC
+    2x2 2-antenna system: 1x1 SMPS RBC
+
+
+#################################
+
+# 2x2 2-antenna system RBC modes
+
+#################################
+There are three mutually exclusive RBC modes for a 2x2 system.
+The default RBC mode is 1x1 SMPS RBC. The required RBC mode must be
+configured before starting uAP or associating in-STA. The mode cannot be
+changed dynamically when any of these connections is active. The modes are
+described below:
+1.  1x1 SMPS RBC mode: WLAN switches to 1x1 FEM when BT is turned on. Also,
+    in-STA goes to SMPS mode w.r.t. ext-AP. When BT is turned off, WLAN
+    switches back to 2x2 FEM setting and in-STA moves out of SMPS.
+    uAP starts bss with only 1-stream even BT is off because it cannot
+    dynamically move between 1-stream and 2-stream rates like in-STA. To start
+    uAP with 2-stream, RBC mode has to be disabled.
+2.  1x2 SMPS RBC mode: Similar as 1x1 SMPS RBC mode. WLAN switches to 1x2 FEM
+    when BT is turned on. In this mode, it is expected that when BT is not
+    actively transmitting, WLAN can receive on both the antennas to enhance
+    the range. Note that 1-stream rates are used for receive and transmit.
+3.  2x2 TMD RBC mode: WLAN uses 2x2 antenna setting and timeshares the antenna
+    with BT.
+
+###############################
+
+# RBC mode select:
+
+###############################
+
+User can use robust_btc.conf and hostcmd to select different RBC mode:
+
+hostcmd mode_get
+hostcmd mode_timeshare
+hostcmd mode_spatial
+    This command is used to get/set Robust BT Coex.
+    mode_get:       get the current mode
+    mode_timeshare: set Robust BT Coex to timeshare mode  (default on 1x1 chips)
+    mode_spatial:   set Robust BT Coex to spatial mode    (only for, and default on 2x2 chips)
+
+    Usage:
+        mlanconfig mlanX hostcmd config/robust_btc.conf mode_get
+        mlanconfig mlanX hostcmd config/robust_btc.conf mode_timeshare
+        mlanconfig mlanX hostcmd config/robust_btc.conf mode_spatial
+
+hostcmd gpio_cfg
+    This command is used to enable/disable GPIO cfg.
+    gpio_cfg: enable/disable GPIO cfg for external bt request  (default is enable with High Polarity)
+
+    Usage:
+        mlanconfig mlanX hostcmd config/robust_btc.conf gpio_cfg
+
+hostcmd generictime
+hostcmd a2dptime
+hostcmd inquirytime
+hostcmd ap_generictime
+hostcmd ap_a2dptime
+hostcmd ap_inquirytime
+        This command is used to configure the time slice of COEX (only works in timeshare mode)
+        generictime:       configure the Bttime and Wlantime in Station Generic case
+        a2dptime:          configure the Bttime and Wlantime in Station A2DP case
+        inquirytime:       configure the Bttime and Wlantime in Station Inquiry case
+        ap_generictime:    configure the Bttime and Wlantime in Ap Generic case
+        ap_a2dptime:       configure the Bttime and Wlantime in Ap A2DP case
+        ap_inquirytime:    configure the Bttime and Wlantime in Ap Inquiry case
+
+    Usage:
+                mlanutl mlanX hostcmd config/robust_btc.conf generictime
+                mlanutl mlanX hostcmd config/robust_btc.conf a2dptime
+                mlanutl mlanX hostcmd config/robust_btc.conf inquirytim
+                mlanutl mlanX hostcmd config/robust_btc.conf ap_generictime
+                mlanutl mlanX hostcmd config/robust_btc.conf ap_a2dptime
+                mlanutl mlanX hostcmd config/robust_btc.conf ap_inquirytime
+
+hostcmd external_coex_uart_gpio_config
+       This command is used to configure the UART+GPIO external coex mode with following parameters
+       Enabled:                configure the feature and ouutput on GPIO 0x08 disable, 0x07 enable
+       ExtCoexHwIntWci2:       Enable UART for coex interface 0x00 disable, 0x01 enable
+
+    Usase:
+       mlanutl mlanX hostcmd config/robust_btc.conf external_coex_uart_gpio_config
+
diff --git a/wlan_src/README_UAP b/wlan_src/README_UAP
new file mode 100644
index 0000000..a0fcfc7
--- /dev/null
+++ b/wlan_src/README_UAP
@@ -0,0 +1,3057 @@
+===============================================================================
+			U S E R  M A N U A L
+
+ Copyright 2009-2024 NXP
+
+
+1) FOR DRIVER BUILD
+
+	Goto source code directory wlan_src.
+		make [clean] build
+	The driver binaries can be found in ../bin_xxxx directory.
+	The driver code supports Linux kernel from 2.6.32 to 6.9.10.
+
+2) FOR DRIVER INSTALL
+
+	a) Copy firmware image to /lib/firmware/nxp/, copy wifi_mod_para.conf to /lib/firmware/nxp/.
+	b) Install WLAN driver
+	   There are drv_mode, max_sta_bss, max_uap_bss etc. module parameters.
+		The bit settings of drv_mode are,
+			Bit 0 :  STA
+			Bit 1 :  uAP
+			Bit 2 :  WIFIDIRECT
+			Bit 4 :  NAN
+
+		max_uap_bss: Maximum number of uAP BSS (default 1, max 2)
+		uap_name: Name of the uAP interface (default: "uap")
+
+	   For example, to install multi-chip driver,
+		insmod mlan.ko
+		insmod moal.ko mod_para=nxp/wifi_mod_para.conf [drvdbg=0x7]
+	   wifi_mod_para.conf is used to support multi-chips which has different load module parameters. It contains
+           the module parameters for different chips.
+	c) Uninstall WLAN driver,
+		ifconfig mlanX down
+		ifconfig uapX down
+		rmmod moal
+		rmmod mlan
+
+	To load driver with MFG firmware file, use mfg_mode=1 when insmod WLAN driver and
+	specify MFG firmware name if needed.
+
+	There are some other parameters for debugging purpose etc. Use modinfo to check details.
+	  drvdbg=<bit mask of driver debug message control>
+	  dev_cap_mask=<Bit mask of the device capability>
+	  mac_addr=xx:xx:xx:xx:xx:xx <override the MAC address (in hex)>
+	  auto_ds=0|1|2 <use MLAN default | enable auto deepsleep | disable auto deepsleep>
+	  ps_mode=0|1|2 <use MLAN default | enable IEEE PS mode | disable IEEE PS mode>
+	  max_tx_buf=2048|4096|8192 <maximum AMSDU Tx buffer size>
+	  pm_keep_power=1|0 <PM keep power in suspend (default) | PM no power in suspend>
+	  shutdown_hs=1|0 <Enable HS when shutdown | No HS when shutdown (default)>
+	  cfg_11d=0|1|2 <use MLAN default | enable 11d | disable 11d>
+	  dts_enable=0|1 <Disable DTS | Enable DTS (default)>
+	  fw_name = <FW file name>
+		e.g. copy pcieuart9098_combo_v1.bin to firmware directory, fw_name=nxp/pcieuart9098_combo_v1.bin
+	  hw_test=0|1 <Disable hardware test (default) | Enable hardware test>
+	  fw_serial=0|1 <support parallel download FW | support serial download FW (default)>
+	  req_fw_nowait=0|1 <use request_firmware API (default) | use request_firmware_nowait API>
+	  antcfg=0|1|2|0xffff <default | Tx/Rx antenna 1 | Tx/Rx antenna 2 | enable antenna diversity>
+	  slew_rate: Slew Rate Control value = 0|1|2|3 (0 is the slowest slew rate and 03 has the highest slew rate (default))
+	  init_cfg=<init config (MAC addresses, registers etc.) file name>
+		e.g. copy init_cfg.conf to firmware directory, init_cfg=nxp/init_cfg.conf
+	  cal_data_cfg=<CAL data config file name>
+		e.g. copy cal_data.conf to firmware directory, cal_data_cfg=nxp/cal_data.conf
+		Note: Loading driver with 8887 must include correct cal_data_cfg parameter.
+	  txpwrlimit_cfg=<Tx power limit config file name>
+		e.g. copy txpwrlimit_cfg_set.conf to firmware directory, txpwrlimit_cfg=nxp/txpwrlimit_cfg_set.conf
+	  cntry_txpwr=<Enable setting tx power table of country | Disable setting tx power table of country (default)>
+	  init_hostcmd_cfg=<init hostcmd config file name>
+		e.g. copy init_hostcmd_cfg.conf to firmware directory, init_hostcmd_cfg=nxp/init_hostcmd_cfg.conf
+	  sdio_rx_aggr=1|0 <Enable SDIO rx aggr (default) | Disable SDIO rx aggr>
+	  cfg80211_wext=<bit mask of CFG80211 and WEXT control>
+		Bit 0: STA WEXT
+		Bit 1: uAP WEXT
+		Bit 2: STA CFG80211
+		Bit 3: uAP CFG80211
+	  skip_fwdnld=0|1 <enable FW download support (default) | disable FW download support>
+	  wq_sched_prio: Priority for work queue
+	  wq_sched_policy: Scheduling policy for work queue
+		(0: SCHED_NORMAL, 1: SCHED_FIFO, 2: SCHED_RR, 3: SCHED_BATCH, 5: SCHED_IDLE)
+		Please note that, both wq_sched_prio and wq_sched_policy should be provided
+		as module parameters. If wq_sched_policy is (0, 3 or 5), then wq_sched_prio
+		must be 0. wq_sched_prio should be 1 to 99 otherwise.
+	  rx_work=0|1|2 <default | Enable rx_work_queue | Disable rx_work_queue>
+	  usb_aggr=0|1|2 <use MLAN default (disabled) | enable USB aggr | disable USB aggr>
+	  low_power_mode_enable=0|1 <disable low power mode (default)| enable low power mode>
+	  When low power mode is enabled, the output power will be clipped at ~+10dBm and the
+	  expected PA current is expected to be in the 80-90 mA range for b/g/n modes
+	  max_wfd_bss: Maximum number of WIFIDIRECT BSS (default 1, max 1)
+	  wfd_name: Name of the WIFIDIRECT interface (default: "wfd")
+	  max_vir_bss: Number of Virtual interfaces (default 0)
+	  nan_name: Name of the NAN interface (default: "nan")
+	  max_nan_bss: Number of NAN interfaces (default 1)
+	 dpd_data_cfg=<DPD data config file name>
+	   e.g. copy dpd_data.conf to firmware directory, dpd_data_cfg=nxp/dpd_data.conf
+	  pcie_int_mode=0|1 <Legacy mode, MSI mode (default)>
+	wakelock_timeout=<set wakelock_timeout value (ms)>
+	pmic=0|1 <No pmic configure cmd sent to firmware | Send pmic configure cmd to firmware>
+	indication_gpio=0xXY <GPIO to indicate wakeup source and its level; high four bits X:
+                  level(0/1) for normal wakeup; low four bits Y: GPIO pin number. This parameter
+                  only works with specific board and firmware.>
+	hs_wake_interval=<Host sleep wakeup interval,it will round to nearest multiple dtim*beacon_period in fw>
+	disconnect_on_suspend=0|1 <Disable disconnect wifi on suspend (default) | Enable disconnect wifi on suspend>
+	hs_mimo_switch=0|1 <Disable dynamic MIMO-SISO switch during host sleep (default) | Enable dynamic MIMO-SISO switch during host sleep>
+	fixed_beacon_buffer=0|1 <allocate default buffer size (default) | allocate max buffer size>
+	GoAgeoutTime=0|x <use default ageout time (default) | set Go age out time xTU(TU 100ms)>
+	multi_dtim=0|x <use default DTIM interval(default) | set x*beacon_period as DTIM interval>
+	inact_tmo=0|x <use default IEEE ps inactivity timout value (default) | use IEEE ps inactivity timeout value x ms>
+	drcs_chantime_mode=0|x <channel time and mode for DRCS, use default value (default) | use setting value>
+	  Bit31~Bit24:Channel time for channel index0;
+	  Bit23~Bit16:mode for channel index0; 0|1 <PM1 | Null2Self>
+	  Bit15~Bit8:Channel time for channel index1;
+	  Bit7~Bit0:mode for channel index1; 0|1 <PM1 | Null2Self>
+	roamoffload_in_hs=0|1 <always enable fw roaming (default) | enable fw roaming only when host suspend>
+	uap_max_sta: Maximum number of STA for UAP/GO (default 0, max STA number for UAP/GO supported in FW)
+	host_mlme=0|1 <Disable Host MLME support (default)| Enable Host MLME support>
+	country_ie_ignore=0|1 <Follow countryIE from AP and beacon hint enable (default) | Ignore countryIE from AP and beacon hint disable>
+	beacon_hints=0|1 <enable beacon hints(default) | disable beacon hints>
+    wacp_mode=0|1|2 <disable WACP default | WACP mode 1 | WACP mode 2>
+
+	Note: On some platforms (e.g. PXA910/920) double quotation marks ("") need to used
+	for module parameters.
+		insmod sdxxx.ko "<para1> <para2> ..."
+
+3) FOR DRIVER PROC & DEBUG
+	The following info are provided in /proc/mwlan/adapterX/uapY/info.
+
+	driver_name = "uap"
+	driver_version = <driver version>
+	InterfaceName= "uapX"
+	State= "Disconnected" | "Connected"
+	MACAddress= <6-byte adapter MAC address>
+	MCCount= <multicast address count>
+	num_tx_bytes = <number of bytes sent to device>
+	num_rx_bytes = <number of bytes received from device and sent to kernel>
+	num_tx_pkts = <number of packets sent to device>
+	num_rx_pkts = <number of packets received from device and sent to kernel>
+	num_tx_pkts_dropped = <number of tx packets dropped by driver>
+	num_rx_pkts_dropped = <number of rx packets dropped by driver>
+	num_tx_pkts_err = <number of tx packets failed to send to device>
+	num_rx_pkts_err = <number of rx packets failed to receive from device>
+	num_tx_timeout =  <number of tx timeout>
+	carrier "on" | "off"
+	tx queue "stopped" | "started"
+
+	The following debug info are provided in /proc/mwlan/adapterX/uapY/debug.
+
+	drvdbg = <bit masks of driver debug message control>
+		bit 0:  MMSG  		PRINTM(MMSG,...)
+		bit 1:  MFATAL		PRINTM(MFATAL,...)
+		bit 2:  MERROR		PRINTM(MERROR,...)
+		bit 3:  MDATA 		PRINTM(MDATA,...)
+		bit 4:  MCMND 		PRINTM(MCMND,...)
+		bit 5:  MEVENT		PRINTM(MEVENT,...)
+		bit 6:  MINTR 		PRINTM(MINTR,...)
+		bit 7:  MIOCTL 		PRINTM(MIOCTL,...)
+		...
+		bit 16: MDAT_D		PRINTM(MDAT_D,...), DBG_HEXDUMP(MDAT_D,...)
+		bit 17: MCMD_D		PRINTM(MCMD_D,...), DBG_HEXDUMP(MCMD_D,...)
+		bit 18: MEVT_D		PRINTM(MEVT_D,...), DBG_HEXDUMP(MEVT_D,...)
+		bit 19: MFW_D		PRINTM(MFW_D,...),  DBG_HEXDUMP(MFW_D,...)
+		bit 20: MIF_D		PRINTM(MIF_D,...),  DBG_HEXDUMP(MIF_D,...)
+		...
+		bit 28: MENTRY		PRINTM(MENTRY,...), ENTER(), LEAVE()
+		bit 29: MWARN 		PRINTM(MWARN,...)
+		bit 30: MINFO 		PRINTM(MINFO,...)
+	wmm_ac_vo = <number of packets sent to device from WMM AcVo queue>
+	wmm_ac_vi = <number of packets sent to device from WMM AcVi queue>
+	wmm_ac_be = <number of packets sent to device from WMM AcBE queue>
+	wmm_ac_bk = <number of packets sent to device from WMM AcBK queue>
+	max_tx_buf_size = <maximum Tx buffer size>
+	tx_buf_size = <current Tx buffer size>
+	curr_tx_buf_size = <current Tx buffer size in FW>
+	ps_mode = <0/1, CAM mode/PS mode>
+	ps_state = <0/1/2/3, awake state/pre-sleep state/sleep-confirm state/sleep state>
+	wakeup_dev_req = <0/1, wakeup device not required/required>
+	wakeup_tries = <wakeup device count, cleared when device awake>
+	hs_configured = <0/1, host sleep not configured/configured>
+	hs_activated = <0/1, extended host sleep not activated/activated>
+	tx_pkts_queued = <number of Tx packets queued>
+	num_bridge_pkts = <number of bridged packets>
+	num_drop_pkts = <number of dropped packets>
+	num_tx_timeout = <number of Tx timeout>
+	num_cmd_timeout = <number of timeout commands>
+	timeout_cmd_id = <command id of the last timeout command>
+	timeout_cmd_act = <command action of the last timeout command>
+	last_cmd_id = <command id of the last several commands sent to device>
+	last_cmd_act = <command action of the last several commands sent to device>
+	last_cmd_index = <0 based last command index>
+	last_cmd_resp_id = <command id of the last several command responses received from device>
+	last_cmd_resp_index = <0 based last command response index>
+	last_event = <event id of the last several events received from device>
+	last_event_index = <0 based last event index>
+	num_cmd_h2c_fail = <number of commands failed to send to device>
+	num_cmd_sleep_cfm_fail = <number of sleep confirm failed to send to device>
+	num_tx_h2c_fail = <number of data packets failed to send to device>
+	num_cmdevt_c2h_fail = <number of commands/events failed to receive from device>
+	num_rx_c2h_fail = <number of data packets failed to receive from device>
+	num_int_read_fail = <number of interrupt read failures>
+	last_int_status = <last interrupt status>
+	cmd_sent = <0/1, send command resources available/sending command to device>
+	data_sent = <0/1, send data resources available/sending data to device>
+	mp_rd_bitmap = <SDIO multi-port read bitmap>
+	curr_rd_port = <SDIO multi-port current read port>
+	mp_wr_bitmap = <SDIO multi-port write bitmap>
+	curr_wr_port = <SDIO multi-port current write port>
+	txbd_rdptr = <PCIE transmit read pointer>
+	txbd_wrptr = <PCIE transmit write pointer>
+	rxbd_rdptr = <PCIE recieve read pointer>
+	rxbd_wrptr = <PCIE recieve write pointer>
+	eventbd_rdptr = <PCIE event read pointer>
+	eventbd_wrptr = <PCIE event write pointer>
+	cmd_resp_received = <0/1, no cmd response to process/response received and yet to process>
+	event_received = <0/1, no event to process/event received and yet to process>
+	tx_cmd_urb_pending = <number of URB pending for cmd transmit>
+	tx_data_urb_pending = <number of URB pending for data transmit>
+	rx_cmd_urb_pending = <number of URB pending for cmd receive>
+	rx_data_urb_pending = <number of URB pending for data receive>
+	ioctl_pending = <number of ioctl pending>
+	tx_pending = <number of Tx packet pending>
+	rx_pending = <number of Rx packet pending>
+	lock_count = <number of lock used>
+	malloc_count = <number of malloc done>
+	mbufalloc_count = <number of mlan_buffer allocated>
+	malloc_cons_count = <number of consistent malloc done>
+	main_state = <current state of the main process>
+	sdiocmd53w = <SDIO Cmd53 write status>
+	sdiocmd53r = <SDIO Cmd52 read status>
+	hs_skip_count = <number of skipped suspends>
+	hs_force_count = <number of forced suspends>
+
+	Example:
+		echo "drvdbg=0x7" > /proc/mwlan/adapterX/uapY/debug	#enable MMSG,MFATAL,MERROR messages
+
+	Use dmesg or cat /var/log/debug to check driver debug messages.
+
+	To log driver debug messages to file,
+	a) Edit /etc/rsyslog.conf, add one line "*.debug		/var/log/debug"
+	b) touch /var/log/debug (if the file doesn't exist)
+	c) service rsyslog restart
+
+4) SOFT_RESET command
+   This command is used to perform a "soft reset" on the module.
+   The FW code will disable hardware and jump to boot code.
+   Host software will then need to re-download firmware if required.
+
+   Usage:
+	echo "soft_reset=1" > /proc/mwlan/adapterX/config
+
+===============================================================================
+
+		U S E R  M A N U A L  F O R  UAPUTL
+
+NAME
+uaputl.exe [options] <command> [command parameters]]
+
+Options:
+	--help 	Display help
+	-v    	Display version
+	-i <interface>
+	-d <debug_level=0|1|2>
+
+Example:
+	./uaputl.exe --help
+		"display help for uaputl"
+
+	./uaputl.exe sys_config --help
+		"display help for sys_config command"
+
+This tool can be used to set/get uAP's settings. To change AP settings, you might
+need to issue "bss_stop" command to stop AP before making change and issue "bss_start"
+command to restart the AP after making change.
+
+------------------
+Supported Commands
+------------------
+version
+debug_level
+sys_config [CONFIG_FILE_NAME]
+bss_config [CONFIG_FILE_NAME]
+sys_info
+sys_reset
+bss_start
+bss_stop
+sta_list
+sta_deauth <STA_MAC_ADDRESS>
+sta_deauth_ext <STA_MAC_ADDRESS> <REASON_CODE>
+radioctrl [0|1]
+txratecfg [l] [m] [n] [o]
+antcfg [m] [n]
+pscfg [MODE] [CTRL INACTTO MIN_SLEEP MAX_SLEEP MIN_AWAKE MAX_AWAKE]
+mic_err <STA_MAC_ADDRESS>
+key_material <MAC_ADDRESS> <KEY> [KEY_ID]
+sys_cfg_custom_ie [INDEX] [MASK] [IEBuffer]
+coex_config [CONFIG_FILE_NAME]
+hscfg [condition [[GPIO# [gap]]]]
+hssetpara condition [[GPIO# [gap]]]
+sys_cfg_wmm  [qosinfo=<qosinfo>]
+             [AC_BE AIFSN ECW_MAX ECW_MIN TX_OP]
+             [AC_BK AIFSN ECW_MAX ECW_MIN TX_OP]
+             [AC_VI AIFSN ECW_MAX ECW_MIN TX_OP]
+             [AC_VO AIFSN ECW_MAX ECW_MIN TX_OP]
+sys_cfg_ap_wmm [0]
+               [AC_BE AIFSN ECW_MAX ECW_MIN TX_OP]
+               [AC_BK AIFSN ECW_MAX ECW_MIN TX_OP]
+               [AC_VI AIFSN ECW_MAX ECW_MIN TX_OP]
+               [AC_VO AIFSN ECW_MAX ECW_MIN TX_OP]
+sys_cfg_11n [ENABLE] [HTCAP] [AMPDU] [TXBFCAP] [HT_MCS_MAP]
+addbapara [timeout txwinsize rxwinsize txamsdu rxamsdu]
+aggrpriotbl <m0> <n0> <m1> <n1> ... <m7> <n7>
+addbareject <m0> <m1> ... <m7>
+httxbfcfg <ACTION> [ACT_DATA]
+httxcfg [<m>]
+htstreamcfg [n]
+deepsleep [MODE] [IDLE_TIME]
+sdcmd52rw <FN no.> <address> [data]
+hostcmd <txpwrlimit_cfg.conf> txpwrlimit_cfg_get
+hostcmd <txpwrlimit_cfg.conf> txpwrlimit_2g_cfg_set
+hostcmd <txpwrlimit_cfg.conf> txpwrlimit_5g_cfg_set
+tx_data_pause [ENABLE][TX_BUF_CNT]
+vhtcfg <j> <k> [l] [m] [n] [o]
+dfstesting [<user_cac_pd> <user_nop_pd> <no_chan_change> <fixed_chan_num><cac_restart>]
+cscount [<channel_switch_count>]
+mgmtframectrl [MASK]
+
+-------------------------------------------------------------------
+The following commands can be issued individually for debug purpose
+-------------------------------------------------------------------
+sys_cfg_ap_mac_address [AP_MAC_ADDRESS]
+sys_cfg_ssid [SSID]
+sys_cfg_beacon_period [BEACON_PERIOD]
+sys_cfg_dtim_period [DTIM_PERIOD]
+sys_cfg_channel [CHANNEL] [MODE]
+sys_cfg_channel_ext [CHANNEL] [BAND] [MODE]
+sys_cfg_scan_channels [CHANNEL[.BAND]]
+sys_cfg_rates [RATES]
+sys_cfg_rates_ext [rates RATES] [mbrate RATE]
+sys_cfg_bcast_ssid_ctl [0|1|2]
+sys_cfg_preamble_ctl
+sys_cfg_bss_status
+sys_cfg_rts_threshold [RTS_THRESHOLD]
+sys_cfg_frag_threshold [FRAG_THRESHOLD]
+sys_cfg_rsn_replay_prot [1|0]
+sys_cfg_tx_beacon_rate [TX_BEACON_RATE]
+sys_cfg_mcbc_data_rate [MCBC_DATA_RATE]
+sys_cfg_pkt_fwd_ctl [PKT_FWD_CTRL]
+sys_cfg_sta_ageout_timer [STA_AGEOUT_TIMER]
+sys_cfg_ps_sta_ageout_timer [PS_STA_AGEOUT_TIMER]
+sys_cfg_auth [AUTH_MODE]
+sys_cfg_protocol [PROTOCOL] [AKM_SUITE]
+sys_cfg_pmf [MFPC] [MFPR] [BCN_PPROT]
+sys_cfg_wep_key [INDEX ISDEFAULT KEY] (use of WEP/TKIP is not recommended anymore)
+sys_cfg_cipher [PAIRWISE_CIPHER GROUP_CIPHER]
+sys_cfg_pwk_cipher [<PROTOCOL>] [PAIRWISE_CIPHER]
+sys_cfg_gwk_cipher [GROUP_CIPHER]
+sys_cfg_group_rekey_timer [GROUP_REKEY_TIMER]
+sys_cfg_wpa_passphrase [PASSPHRASE]
+sys_cfg_wpa3_sae_password [PASSWORD]
+sys_cfg_max_sta_num [STA_NUM]
+sys_cfg_retry_limit [RETRY_LIMIT]
+sys_cfg_sticky_tim_config [ENABLE] [<DURATION> <STICKY_BIT_MASK>]
+sys_cfg_sticky_tim_sta_mac_addr [CONTROL] [STA_MAC_ADDRESS]
+sys_cfg_2040_coex [ENABLE]
+sys_cfg_eapol_pwk_hsk [<TIMEOUT> <RETRIES>]
+sys_cfg_eapol_gwk_hsk [<TIMEOUT> <RETRIES>]
+sta_filter_table <FILTERMODE> <MACADDRESS_LIST>
+regrdwr <TYPE> <OFFSET> [value]
+memaccess <ADDR> [value]
+rdeeprom <offset> <byteCount>
+cfg_data <type> [*.conf]
+sys_cfg_80211d [state STATE] [country COUNTRY]
+sys_cfg_80211d_country_ie [clear | country COUNTRY]
+uap_stats
+sys_cfg_tdls_ext_cap [CONFIG_FILE]
+sys_cfg_restrict_client_mode [<ENABLE> [MODE_CONFIG]]
+sys_cfg_wacp_mode [Mode]
+skip_cac <CHANNEL> <MODE> [<bw>]
+vndr_cmd_dump [uaputl_cmd] [arguments]
+
+-------------------
+Details of Commands
+-------------------
+
+version
+-------
+    "./uaputl.exe -v"
+
+    This command prints the uAP utility version information.
+
+debug_level
+-----------
+    "./uaputl.exe -d <debug_level>"
+
+    The supported debug_level are:
+        0     - no debug
+        1     - enable MSG_DEBUG
+        2     - enable all the debug
+    This command use to control the debug level of uaputl.exe.
+
+    Example:
+	./uaputl.exe -d 2 sys_config
+		Enable all the debug in uaputl.exe
+
+sys_config
+----------
+    "./uaputl.exe sys_config [CONFIG_FILE]"
+    This command is used to set or get the current settings of the Micro AP.
+
+    The supported options are:
+        CONFIG_FILE is file contain all the Micro AP settings.
+        empty - Get current Micro AP settings
+
+    Example:
+	./uaputl.exe sys_config
+		Get current settings of the Micro AP.
+
+	./uaputl.exe sys_config config/uaputl.conf
+		Load Micro AP's settings from uaputl.conf file and set.
+
+bss_config
+----------
+    "./uaputl.exe bss_config [CONFIG_FILE]"
+    This command is used to set or get the current settings of the BSS.
+
+    The supported options are:
+        CONFIG_FILE is file contain all the BSS settings.
+        empty - Get current BSS settings
+
+    Example:
+	./uaputl.exe bss_config
+		Get current settings of the BSS.
+
+	./uaputl.exe bss_config config/uaputl.conf
+		Load BSS settings from uaputl.conf file and set.
+
+sys_info
+--------
+    "./uaputl.exe sys_info"
+
+    This command returns system information such as firmware version number
+    and HW information.
+
+sys_reset
+---------
+    "./uaputl.exe sys_reset"
+
+    This command is used to reset the Micro AP back to its initial state.
+    For example, this can be used to recover from a serious error, or before
+    creating a new BSS.
+
+    This command has the following effects:
+        1. The WLAN hardware MAC is reset.
+        2. All MIB variables are initialized to their respective default
+           values.
+        3. The firmware internal variables are reset to their respective
+           default values.
+        4. The firmware state machines are reset to their respective initial
+           states.
+
+bss_start
+---------
+    "./uaputl.exe bss_start"
+
+    This command starts the BSS.
+    There is no error for redundant bss_start command.
+
+bss_stop
+--------
+    "./uaputl.exe bss_stop"
+
+    This command stops the BSS. The command causes the firmware to:
+        1. Deauthenticate all associated client stations.
+        2. Turn off the radio (hence stopping beaconing).
+    There is no error for redundant bss_stop command.
+
+sta_list
+--------
+    "./uaputl.exe sta_list"
+
+    This command returns the list of client stations that are currently
+    associated with the AP.
+
+    The output is formatted as shown below, for each STA:
+    "STA <STA_NUM> information:
+     ==========================
+     MAC Address: <STA MAC address>
+     Power Mgmt status: active|power save
+     Rssi:  <RSSI_VALUE>"
+
+sta_deauth
+----------
+    "./uaputl.exe sta_deauth <STA_MAC_ADDRESS>"
+
+    This command is used to de-authentciate a client station for any reason.
+
+radioctrl
+----------
+    "./uaputl.exe radioctrl [0|1]"
+
+    This command is used to set or get the radio settings.
+    The supported options are:
+        1     - Turn radio on
+        0     - Turn radio off
+        empty - Get current radio setting
+
+txratecfg
+----------
+    "./uaputl.exe txratecfg [l] [m] [n] [o]"
+
+    This command is used to set/get the transmit data rate.
+
+    Note:
+    1) Parameter [o] is optional. If [o] is not given, it will be set as 0xffff.
+
+    Where
+        [l] is <format>
+        <format> - This parameter specifies the data rate format used in this command
+            0:    LG
+            1:    HT
+            2:    VHT
+            3:    HE
+
+            0xff: Auto
+
+        [m] is <index>
+        <index> - This parameter specifies the rate or MCS index
+        If <format> is 0 (LG),
+            0    1 Mbps
+            1    2 Mbps
+            2    5.5 Mbps
+            3    11 Mbps
+            4    6 Mbps
+            5    9 Mbps
+            6    12 Mbps
+            7    18 Mbps
+            8    24 Mbps
+            9    36 Mbps
+            10   48 Mbps
+            11   54 Mbps
+        If <format> is 1 (HT),
+            0    MCS0
+            1    MCS1
+            2    MCS2
+            3    MCS3
+            4    MCS4
+            5    MCS5
+            6    MCS6
+            7    MCS7
+            8    MCS8
+            9    MCS9
+            10   MCS10
+            11   MCS11
+            12   MCS12
+            13   MCS13
+            14   MCS14
+            15   MCS15
+            32   MCS32
+        If <format> is 2 (VHT),
+            0    MCS0
+            1    MCS1
+            2    MCS2
+            3    MCS3
+            4    MCS4
+            5    MCS5
+            6    MCS6
+            7    MCS7
+            8    MCS8
+            9    MCS9
+        [n] is <nss>
+        <nss> - This parameter specifies the NSS. It is valid only for VHT
+        If <format> is 2 (VHT),
+            1    NSS1
+            2    NSS2
+        If <format> is 3 (HE),
+            0    MCS0
+            1    MCS1
+            2    MCS2
+            3    MCS3
+            4    MCS4
+            5    MCS5
+            6    MCS6
+            7    MCS7
+            8    MCS8
+            9    MCS9
+            10    MCS10
+            11    MCS11
+        [n] is <nss>
+        <nss> - This parameter specifies the NSS. It is valid only for HE
+        If <format> is 3 (HE),
+            1    NSS1
+            2    NSS2
+
+    [o] is <rate setting, only support 9098/9097/9xxx chips>
+        Bit0 - 1: indicate preambleType
+          For legacy 11b: preemble type
+             00    = long
+             01    = short
+             10/11  = reserved
+          For legacy 11g: reserved
+          For 11n: Green field PPDU indicator
+             00 = HT-mix
+             01 = HT-GF
+             10/11 = reserved.
+          For 11ac: reserved.
+          For 11ax:
+             00 = HE-SU
+             10 = HE-EXT-SU
+             Others are reserved
+
+        Bit 2 - 4 : indicate BW:
+          For HE ER:
+            0 = 242-tone RU
+            1 =  upper frequency 106-tone RU within the primary 20 MHz
+          Otherwise:
+            0 = 20 MHz
+            1 = 40 MHz
+            2 = 80 MHz
+            3 = 160 MHz
+
+        Bit 5 -6: indicate LTF + GI size
+          For HT:
+            0 = normal
+            1 = Short GI
+          For VHT:
+            01 = Short GI
+            11 = Short GI and Nsym mod 10=9
+            00 = otherwise
+          For HE:
+            0 = 1xHELTF + GI0.8us
+            1 = 2xHELTF + GI0.8us
+            2 = 2xHELTF + GI1.6us
+            3 = 4xHELTF + GI0.8us if DCM = 0 and STBC = 0
+                4xHELTF + GI3.2us, otherwise.
+
+        Bit 7: Indicate  STBC:
+            0 = no STBC
+            1 = STBC
+
+        Bit 8: indicate DCM:
+            0 = no DCM
+            1 = DCM
+
+        Bit 9: indicate coding:
+            0 = BCC
+            1 = LDPC
+
+        Bit 10 - 11: reserved.
+
+        Bit 12 - 13: Indicate maxPE
+            Max packet extension
+            0 - 9 usec
+            1 - 8 usec
+            2 - 16 usec.
+
+        Bit 14 - 15: reserved.
+
+        0xffff: Auto
+
+    Examples:
+        ./uaputl.exe txratecfg 0 3        : Set fixed Tx rate to 11 Mbps
+        ./uaputl.exe txratecfg 0 11       : Set fixed Tx rate to 54 Mbps
+        ./uaputl.exe txratecfg 1 3        : Set fixed Tx rate to MCS3
+        ./uaputl.exe txratecfg 2 3 2    : Set fixed Tx rate to MCS3 for NSS2
+        ./uaputl.exe txratecfg 3 3 2    : Set fixed Tx rate to MCS3 for NSS2
+        ./uaputl.exe txratecfg 3 5 2 0x2282   : Set 11AX fixed Tx rate to MCS5 for NSS2, and Preamble type is 2, BW is 0, LTF + GI size 0
+                                                 STBC is 1, DMC is 0, Coding is 1, maxPE is 2.
+        ./uaputl.exe txratecfg 0xff     : Disable fixed rate and uses auto rate
+        ./uaputl.exe txratecfg          : Read the current data rate setting
+
+antcfg
+----------
+	"./uaputl.exe antcfg [m] [n]"
+
+    This command is used to set/get the transmit and receive antenna.
+    where value of m is:
+        Bit 0   -- Tx Path A
+        Bit 1   -- Tx Path B
+        Bit 0-1 -- Tx Path A+B
+        For 9097/9098/IW624, LOW BYTE for 2G setting
+        Bit 8   -- Tx Path A
+        Bit 9   -- Tx Path B
+        Bit 8-9 -- Tx Path A+B
+        For 9097/9098/IW624, HIGH BYTE for 5G setting
+
+    where value of n is:
+        Bit 0   -- Rx Path A
+        Bit 1   -- Rx Path B
+        Bit 0-1 -- Rx Path A+B
+        For 9097/9098/IW624, LOW BYTE for 2G setting
+        Bit 8   -- Rx Path A
+        Bit 9   -- Rx Path B
+        Bit 8-9 -- Rx Path A+B
+        For 9097/9098/IW624, HIGH BYTE for 5G setting
+    The Tx path setting (m) is used if Rx path (n) is not provided.
+
+    Examples:
+        ./uaputl.exe antcfg             : Get Tx and Rx path
+        ./uaputl.exe antcfg 3           : Set Tx and Rx path to A+B
+        ./uaputl.exe antcfg 2 3         : Set Tx path to B and Rx path to A+B
+        ./uaputl.exe antcfg 0x103       : Set Tx and Rx path to A+B on 2G and Tx and Rx path to A on 5G
+        ./uaputl.exe antcfg 0x3 0x3     : Set Tx path to A+B and Rx path to A+B on 2G, 5G not changed
+        ./uaputl.exe antcfg 0x300 0x300 : Set Tx path to A+B and Rx path to A+B on 5G, 2G not changed
+
+sys_cfg_ap_mac_address
+----------------------
+    "./uaputl.exe sys_cfg_ap_mac_address [AP_MAC_ADDRESS]"
+
+    This command is used to set or get the AP MAC address.
+
+    If no arguments are given, this command returns the current AP MAC
+    address.
+    Otherwise, this MAC address becomes the BSSID of the infrastructure
+    network created by the AP.
+
+    Example:
+	./uaputl.exe sys_cfg_ap_mac_address 00:50:43:20:aa:bb
+		Set AP MAC address to 00:50:43:20:aa:bb
+
+	./uaputl.exe sys_cfg_ap_mac_address
+		Get AP MAC address"
+
+sys_cfg_ssid
+------------
+    "./uaputl.exe sys_cfg_ssid [SSID]"
+
+    This command is used to set or get the AP SSID.
+
+    If no arguments are given, this command returns the current AP SSID.
+    While setting, the maximum length of the SSID can be 32 characters.
+
+    Example:
+	./uaputl.exe sys_cfg_ssid microap
+		Set AP ssid to "microap"
+
+	./uaputl.exe sys_cfg_ssid
+		Get AP ssid
+
+sys_cfg_beacon_period
+---------------------
+    "./uaputl.exe sys_cfg_beacon_period [BEACON_PERIOD]"
+
+    This command is used to set or get the AP beacon period.
+
+    If no arguments are given, this command returns the current AP beacon
+    period.
+
+    Beacon period is represented in milliseconds.
+
+    Example:
+	./uaputl.exe sys_cfg_beacon_period 100
+		Set AP beacon period to 100 TU
+
+	./uaputl.exe sys_cfg_beacon_period
+		Get AP beacon period
+
+sys_cfg_dtim_period
+-------------------
+    "./uaputl.exe sys_cfg_dtim_period [DTIM_PERIOD]
+
+    This command is used to set or get the AP DTIM period.
+
+    If no arguments are given, this command returns the current AP DTIM
+    period.
+
+    Example:
+	./uaputl.exe sys_cfg_dtim_period 3
+		Set AP DTIM period to 3
+
+	./uaputl.exe sys_cfg_dtim_period
+		Get AP DTIM period
+
+sys_cfg_scan_channels
+---------------------
+    "./uaputl.exe sys_cfg_scan_channels [CHANNEL[.BAND]]"
+
+    This command is used to set or get the AP's scan channel list.
+
+    If no arguments are given, this command returns the scan channel list.
+    If BAND is 0, channel is set in 2.4 GHz band, and if BAND is 1, channel is set to 5GHz.
+    Channels from only one of the bands should be specified.
+    Each CHANNEL.BAND pair must be separated by a space. BAND parameter is optional.
+
+    Example:
+	./uaputl.exe sys_cfg_scan_channels 1 11 6
+		Set AP scan channel list to 1 11 6
+
+	./uaputl.exe sys_cfg_scan_channels 11.0 6.0
+		Set AP scan channel list to 11 6
+
+	./uaputl.exe sys_cfg_scan_channels
+		Get AP scan channel list
+
+	./uaputl.exe sys_cfg_scan_channels 8.1 16.1 34
+		Set AP scan channel list to 8 16 and 34 in 5GHz band.
+
+
+sys_cfg_channel
+---------------
+    "./uaputl.exe sys_cfg_channel [CHANNEL] [MODE]"
+
+    This command is used to set or get the AP radio channel.
+
+    If no arguments are given, this command returns the current AP radio
+    channel.
+
+    MODE: band config mode.
+          Bit 0:  automatic channel selection (ACS) enable/disable
+          Bit 1:  secondary channel is above primary channel enable/disable(only allow for channel 1-7)
+          Bit 2:  secondary channel is below primary channel enable/disable(only allow for channel 5-11)
+          For 'a' band channel:
+          Bit 1:  secondary channel is above primary channel enable/disable
+          Bit 2:  secondary channel is below primary channel enable/disable
+          Only following pairs of channels are valid for secondary channel setting in 5GHz band.
+          36, 40
+          44, 48
+          52, 56
+          60, 64
+          100, 104
+          108, 112
+          116, 120
+          124, 128
+          132, 136
+          149, 153
+          157, 161
+          165, 169
+          173, 177
+
+    Example:
+        ./uaputl.exe sys_cfg_channel 6
+                Set AP radio channel to 6, and no secondary channel.
+
+        ./uaputl.exe sys_cfg_channel 11 0
+                Set AP radio channel to 11 with Manual Channel Select.
+
+        ./uaputl.exe sys_cfg_channel 0 1
+                Set AP to ACS.
+
+        ./uaputl.exe sys_cfg_channel
+                Get AP radio channel
+
+        ./uaputl.exe sys_cfg_channel 6 2
+                Set AP primary radio channel to 6, and secondary channel is above.
+        ./uaputl.exe sys_cfg_channel 6 4
+                Set AP primary radio channel to 6, and secondary channel is below
+        ./uaputl.exe sys_cfg_channel 0 3
+                Set AP to ACS mode, and secondary channel is above.
+        ./uaputl.exe sys_cfg_channel 0 5
+                Set AP to ACS mode, and secondary channel is below.
+        ./uaputl.exe sys_cfg_channel 36 2
+                Set AP primary radio channel to 36, and secondary channel is above.
+        ./uaputl.exe sys_cfg_channel 40 4
+                Set AP primary radio channel to 40, and secondary channel is below.
+
+sys_cfg_channel_ext
+---------------
+    "./uaputl.exe sys_cfg_channel_ext [CHANNEL] [BAND] [MODE]"
+
+    This command is used to set or get the AP radio channel.
+
+    If no arguments are given, this command returns the current AP radio
+    channel.
+
+    BAND: 0 : 2.4GHz operation
+          1 : 5GHz operation
+    MODE: band config mode.
+          Bit 0:  automatic channel selection (ACS) enable/disable
+          Bit 1:  secondary channel is above primary channel enable/disable(only allow for channel 1-7)
+          Bit 2:  secondary channel is below primary channel enable/disable(only allow for channel 5-11)
+          For 'a' band channel:
+          Bit 1:  secondary channel is above primary channel enable/disable
+          Bit 2:  secondary channel is below primary channel enable/disable
+          Only following pairs of channels are valid for secondary channel setting in 5GHz band.
+          36, 40
+          44, 48
+          52, 56
+          60, 64
+          100, 104
+          108, 112
+          116, 120
+          124, 128
+          132, 136
+          149, 153
+          157, 161
+          165, 169
+          173, 177
+    Example:
+        ./uaputl.exe sys_cfg_channel_ext 6
+                Set AP radio channel to 6, and no secondary channel.
+
+        ./uaputl.exe sys_cfg_channel_ext 11 0 0
+                Set AP radio channel to 11 in 2.4GHz band with Manual Channel Select.
+
+        ./uaputl.exe sys_cfg_channel_ext 0 0 1
+                Set AP to ACS mode and 2.4GHz band.
+
+        ./uaputl.exe sys_cfg_channel_ext 8 0
+                Set AP to channel 8 and 2.4GHz band.
+
+        ./uaputl.exe sys_cfg_channel_ext 8 1
+                Set AP to channel 8 and 5GHz band.
+
+        ./uaputl.exe sys_cfg_channel_ext 36 1
+                Set AP to channel 36 and 5GHZ band.
+
+        ./uaputl.exe sys_cfg_channel_ext
+                Get AP radio channel, band and mode.
+
+        ./uaputl.exe sys_cfg_channel_ext 6 0 2
+                Set AP primary radio channel to 6, band to 2.4GHz and secondary channel is above.
+        ./uaputl.exe sys_cfg_channel_ext 6 0 4
+                Set AP primary radio channel to 6, band to 2.4GHz and secondary channel is below
+        ./uaputl.exe sys_cfg_channel_ext 0 0 3
+                Set AP to ACS mode, band to 2.4GHz and secondary channel is above.
+        ./uaputl.exe sys_cfg_channel_ext 0 0 5
+                Set AP to ACS mode, band to 2.4GHz and secondary channel is below.
+        ./uaputl.exe sys_cfg_channel_ext 36 1 2
+                Set AP primary radio channel to 36, band to 5GHz and secondary channel is above.
+        ./uaputl.exe sys_cfg_channel_ext 40 1 4
+                Set AP primary radio channel to 40, band to 5GHz and secondary channel is below.
+
+sys_cfg_rates
+-------------
+    "./uaputl.exe sys_cfg_rates [RATES]"
+
+    If 'Rate' provided, a 'set' is performed else a 'get' is performed
+    RATES is provided as a set of data rates, in unit of 500 kilobits
+    A rate with MSB bit is basic rate, i.e 0x82 is basic rate.
+
+    'set' will not allowed after bss start.
+
+    Valid rates: 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108
+    Non-Basic rates: 0x02, 0x04, 0x0b, 0x16, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c
+    Basic rates: 0x82, 0x84, 0x8b, 0x96, 0x8C, 0x92, 0x98, 0xA4, 0xB0, 0xC8, 0xE0, 0xEc
+
+    Each rate must be separated by a space.
+
+    Example:
+    ./uaputl.exe sys_cfg_rates 0x82 0x84 0x96 0x0c 0x12 0x18
+    ./uaputl.exe sys_cfg_rates
+
+sys_cfg_rates_ext
+-----------------
+    "./uaputl.exe sys_cfg_rates_ext [rates RATES] [mbrate RATE]"
+
+    If 'Rate' provided, a 'set' is performed else a 'get' is performed.
+    RATES is provided as a set of data rates, in unit of 500 kilobits
+    A rate with MSB bit is basic rate, i.e 0x82 is basic rate.
+    If only operational rates is provided, MCBC rate and unicast rate will be set to auto.
+
+    Valid rates: 2, 4, 11, 13, 22, 12, 18, 24, 36, 48, 72, 96, 108
+    Non-Basic rates: 0x02, 0x04, 0x0b, 0x0d, 0x16, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c
+    Basic rates: 0x82, 0x84, 0x8b, 0x96, 0x8C, 0x92, 0x98, 0xA4, 0xB0, 0xC8, 0xE0, 0xEc
+    Rates 2, 4, 11 and 22 (in units of 500 Kbps) must be present in either of
+    basic or non-basic rates. If OFDM rates are enabled then 12, 24 and 48 (in
+    units of 500 Kbps) must be present in either basic or non-basic rates.
+
+    Each rate must be separated by a space.
+
+    rates followed by RATES for setting operational rates.
+    mbrate followed by RATE for setting multicast and broadcast rate.
+
+    operational rates only allow to set before bss start.
+
+    Example:
+    ./uaputl.exe sys_cfg_rates_ext rates 0x82 0x04 11 0x96 12 24 48 mbrate 0x16
+        Set AP operation rates to 0x82,0x04,11,0x96,12,24,48, multicast rate to 0x16
+    ./uaputl.exe sys_cfg_rates_ext rates 0x82 0x04 11 0x96 12 24 48
+		Set AP operation rates to 0x82,0x04,11,0x96,12,24,48.
+
+sys_cfg_bcast_ssid_ctl
+----------------------
+    "./uaputl.exe sys_cfg_bcast_ssid_ctl [0|1|2]"
+
+    This command is used to set or get the SSID broadcast feature setting.
+
+    The supported options are:
+        0     - Disable SSID broadcast, send empty SSID (length=0) in beacon.
+        1     - Enable SSID broadcast
+        2     - Disable SSID broadcast, clear SSID (ACSII 0) in beacon, but keep the original length
+        empty - Get current SSID broadcast setting
+
+    When broadcast SSID is enabled, the AP responds to probe requests from
+    client stations that contain null SSID.
+
+    When broadcast SSID is disabled (sys_cfg_bcast_ssid_ctl = 0/2), the AP:
+        1. Does not respond to probe requests that contain null SSID.
+        2. when sys_cfg_bcast_ssid_ctl = 0, generates beacons that contain null SSID (length=0).
+        3. when sys_cfg_bcast_ssid_ctl = 2, clear SSID (ACSII 0) in beacon and keep the original length
+
+   Example:
+        ./uaputl.exe sys_cfg_bcast_ssid_ctl 0
+                Disable SSID broadcast, send empty SSID (length=0) in beacon.
+
+	./uaputl.exe sys_cfg_bcast_ssid_ctl 1
+		Enable SSID broadcast
+
+        ./uaputl.exe sys_cfg_bcast_ssid_ctl 2
+                Disable SSID broadcast, clear SSID (ACSII 0) in beacon, but keep the original length
+
+	./uaputl.exe sys_cfg_bcast_ssid_ctl
+		Get SSID broadcast setting
+
+sys_cfg_preamble_ctl
+--------------------
+    "./uaputl.exe sys_cfg_preamble_ctl"
+
+    This command is used to set/get type of preamble.
+
+    The supported options are:
+	Preamble: 0 - Auto/Default
+		  1 - Short Preamble
+		  2 - Long Preamble
+
+    Example:
+	./uaputl.exe sys_cfg_preamble_ctl
+		Get AP preamble setting
+
+	./uaputl.exe sys_cfg_premable_ctl 2
+		Set AP preamble setting to Long premable
+
+sys_cfg_bss_status
+--------------------
+    "./uaputl.exe sys_cfg_bss_status"
+
+    This command is used to get current BSS status.
+
+    Example:
+	./uaputl.exe sys_cfg_bss_status
+		Get current BSS status
+
+sys_cfg_rts_threshold
+---------------------
+    "./uaputl.exe sys_cfg_rts_threshold [RTS_THRESHOLD]"
+
+    This command is used to set or get the RTS threshold value.
+
+    If no arguments are given, this command returns the current RTS threshold
+    value.
+
+    Example:
+	./uaputl.exe sys_cfg_rts_threshold 2347
+		Set AP RTS threshold to 2347
+
+	./uaputl.exe sys_cfg_rts_threshold
+		Get AP RTS threshold
+
+sys_cfg_frag_threshold
+----------------------
+    "./uaputl.exe sys_cfg_frag_threshold [FRAG_THRESHOLD]"
+
+    This command is used to set or get the Fragmentation threshold value.
+
+    If no arguments are given, this command returns the current Fragmentation threshold
+    value.
+
+    Example:
+	./uaputl.exe sys_cfg_frag_threshold 2346
+		Set AP Fragmentation threshold to 2346
+
+	./uaputl.exe sys_cfg_frag_threshold
+		Get AP Fragmentation threshold
+
+    Note: Please use aggrpriotbl command to disable the AMPDU/AMSDU aggregation when frag_threshold is set.
+
+sys_cfg_rsn_replay_prot
+-----------------------
+    "./uaputl.exe sys_cfg_rsn_replay_prot [1|0]"
+
+    This command is used to enable or disable RSN replay protection.
+
+    The supported options are:
+        0     - Disable RSN replay protection
+        1     - Enable RSN replay protection
+        empty - Get current RSN replay protection setting
+
+   Example:
+	./uaputl.exe sys_cfg_rsn_replay_prot 1
+		Enable RSN replay protection
+
+	./uaputl.exe sys_cfg_rsn_replay_prot
+		Get RSN replay protection setting
+
+sys_cfg_tx_beacon_rate
+--------------------
+    "./uaputl.exe sys_cfg_tx_beacon_rate [TX_BEACON_RATE]"
+
+    This command is used to set or get the Tx beacon rate settings.
+
+    The supported options are:
+        0     - Auto rate
+        >0    - Set specified beacon rate
+        empty - Get current beacon rate
+
+    Tx beacon rate is represented in units of 500 kbps. While setting Tx beacon
+    rates, only zero or rates currently configured are allowed.
+
+	Following is the list of supported rates in units of 500 Kbps:
+	    2,    4,    11,   13,  22,   12,   18,   24,   36,   48,   72,   96,   108
+	    0x02, 0x04, 0x0b, 0xd, 0x16, 0x0C, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c
+
+    Example:
+	./uaputl.exe sys_cfg_tx_beacon_rate 0x04
+		Set AP Tx beacon rate to 2 M
+
+   	./uaputl.exe sys_cfg_tx_beacon_rate 4
+		Set AP Tx data beacon to 2 M
+
+	./uaputl.exe sys_cfg_tx_beacon_rate
+		Get AP Tx beacon rate
+
+sys_cfg_mcbc_data_rate
+----------------------
+    "./uaputl.exe sys_cfg_mcbc_data_rate [MCBC_DATA_RATE]"
+
+    This command is used to set or get the MCBC data rate to use for multicast
+    or broadcast packet transmission.
+
+    The supported options are:
+        0     - Auto rate
+        >0    - Set specified MCBC data rate
+        empty - Get current MCBC data rate
+
+    MCBC data rate is represented in units of 500 kbps. While setting MCBC data
+    rates, only zero or one of rates currently configured as basic rates are allowed.
+
+    For example:  If current basic rates is "0x82 0x84 0x8b 0x96", then the allowed
+                  values for MCBC data rate will be "0x2 0x4 0xb 0x16".
+
+    Example:
+	./uaputl.exe sys_cfg_mcbc_data_rate 22
+		Set AP MCBC data rate to 11 M
+
+   	./uaputl.exe sys_cfg_mcbc_data_rate 0
+		Set AP MCBC data rate to auto
+
+	./uaputl.exe sys_cfg_mcbc_data_rate
+		Get AP MCBC data rate
+
+sys_cfg_pkt_fwd_ctl
+-------------------
+    "./uaputl.exe sys_cfg_pkt_fwd_ctl [PKT_FWD_CTRL]"
+
+    This command is used to set or get the packet forwarding control
+    settings.
+
+    where PKT_FWD_CTRL is:
+        bit 0 -- Packet forwarding handled by Host (0) or Firmware (1)
+        bit 1 -- Intra-BSS broadcast packets are allowed (0) or denied (1)
+        bit 2 -- Intra-BSS unicast packets are allowed (0) or denied (1)
+        bit 3 -- Inter-BSS unicast packets are allowed (0) or denied (1)
+        empty - Get current packet forwarding setting
+
+    Example:
+	./uaputl.exe sys_cfg_pkt_fwd_ctl 1
+		Set AP packet forwarding control in firmware to allow all packets
+
+	./uaputl.exe sys_cfg_pkt_fwd_ctl 6
+		Set AP packet forwarding control in Host, only allow Inter-BSS unicast packets forwarding.
+
+	./uaputl.exe sys_cfg_pkt_fwd_ctl 8
+		Set AP packet forwarding control in Host, only allow Intra-BSS packets forwarding.
+
+	./uaputl.exe sys_cfg_pkt_fwd_ctl 0
+		Set AP packet forwarding control in Host, allow Intra-BSS packets and
+	            Inter-BSS unicast packets forwarding.
+
+	./uaputl.exe sys_cfg_pkt_fwd_ctl
+		Get AP packet forwarding control
+
+sys_cfg_sta_ageout_timer
+------------------------
+    "./uaputl.exe sys_cfg_sta_ageout_timer [STA_AGEOUT_TIMER]"
+
+    This command is used to set or get the STA ageout value.
+
+    Value of 0 will mean that stations will never be aged out.
+
+    Minimum value for this is 100. Maximum allowed setting should be 864000.
+
+    If no arguments are given, this command returns the current STA ageout
+    value.
+
+    Ageout timer value is represented in units of 100 ms.
+
+    Example:
+	./uaputl.exe sys_cfg_sta_ageout_timer 1800
+		Set AP STA ageout time to 180000 ms
+
+	./uaputl.exe sys_cfg_sta_ageout_timer
+		Get AP STA ageout time
+
+sys_cfg_ps_sta_ageout_timer
+---------------------------
+	"./uaputl.exe sys_cfg_ps_sta_ageout_timer [PS_STA_AGEOUT_TIMER]"
+
+	This command is used to set or get the PS STA ageout value.
+
+	Value of 0 will mean that stations will never be aged out.
+
+	Minimum value for this is 100. Maximum allowed setting should be 864000.
+
+	If no arguments are given, this command returns the current	PS STA ageout
+	value.
+
+	Ageout timer value is represented in units of 100 ms.
+
+	Example:
+	./uaputl.exe sys_cfg_ps_sta_ageout_timer 1800
+		Set AP PS STA ageout time to 180000 ms
+
+	./uaputl.exe sys_cfg_ps_sta_ageout_timer
+		Get AP PS STA ageout time
+
+sys_cfg_auth
+------------
+    This command is used for embedded supplicant.
+    "./uaputl.exe sys_cfg_auth [AUTHMODE] [PWE derivation] [transition disable]"
+
+    This command is used to set or get the AP authentication mode.
+
+    The supported options are:
+        AUTHMODE :     0 - Open authentication
+                       1 - Shared key authentication
+                       3 - WPA3 SAE
+                       4 - OWE
+                       255 - Auto (Open and Shared key) authentication
+        PWE derivation :        0 - Looping only (default)
+                                1 - H2E only
+                                2 - Both looping and H2E
+        transition disable :    0 - transition enable (default)
+                                1 - transition disable
+    empty - Get current authentication mode
+
+    Example:
+	./uaputl.exe sys_cfg_auth 0
+		Set AP authentication mode to Open.
+
+	./uaputl.exe sys_cfg_auth
+		Get AP authentication mode.
+
+sys_cfg_protocol
+----------------
+    "./uaputl.exe sys_cfg_protocol [PROTOCOL] [AKM_SUITE]"
+
+    This command is used to set or get the encryption protocol.
+
+    The supported options are:
+	PROTOCOL:
+			1		 No RSN
+			2		WEP Static
+			8		  WPA	// use of WPA/TKIP is not recommended anymore
+			32		  WPA2
+			40		 WPA, WPA2 Mixed Mode // use of WPA/TKIP is not recommended anymore
+			256		 WPA3 SAE
+			512		 OWE
+    empty - Get current encryption protocol
+
+    AKM_SUITE:
+            bit 0   KEY_MGMT_EAP
+            bit 1   KEY_MGMT_PSK
+            bit 2   KEY_MGMT_NONE
+            bit 8   KEY_MGMT_PSK_SHA256
+            bit 10  KEY_MGMT_SAE
+
+    Example:
+	./uaputl.exe sys_cfg_protocol 2
+		Set AP encryption protocol to static WEP.
+
+	./uaputl.exe sys_cfg_protocol
+		Get AP encryption protocol.
+
+    ./uaputl.exe sys_cfg_protocol 32 0x102
+        Set AP encryption protocol to WPA2 and AKM SUITE to PSK and PSK SHA256
+
+    ./uaputl.exe sys_cfg_protocol 40 0x100
+        Set AP encryption protocol to WPA+WPA2 and AKM SUITE to PSK SHA256 // use of WPA/TKIP is not recommended anymore
+
+    ./uaputl.exe sys_cfg_protocol 256 0x400
+        Set AP encryption protocol to WPA3 SAE and AKM SUITE to SAE.
+
+    ./uaputl.exe sys_cfg_protocol 256 0x500
+        Set AP encryption protocol to WPA3 SAE + WPA2 and AKM SUITE to SAE and PSK SHA256.
+
+    ./uaputl.exe sys_cfg_protocol 256 0x402
+        Set AP encryption protocol to WPA3 SAE + WPA2 and AKM SUITE to SAE and PSK.
+
+sys_cfg_pmf
+-----------
+    "./uaputl.exe sys_cfg_pmf [MFPC] [MFPR] [BCN_PPROT]"
+
+    This command is used to set or get the PMF settings.
+
+    The supported options are:
+        MFPC:       0 - Mgmt frame protection not capable
+                    1 - Mgmt frame protection capable
+
+        MFPR:       0 - Mgmt frame protection not required
+                    1 - Mgmt frame protection required
+                    x - don't care if MFPC = 0
+
+        BCN_PPROT:  0 - beacon protection not required (default)
+                    1 - beacon protection required
+
+    Example:
+    ./uaputl.exe sys_cfg_pmf 1 1
+        Set AP's PMF params to Mgmt frames protection capable and required.
+
+    ./uaputl.exe sys_cfg_pmf 1 1 1
+        Set AP's PMF params to Mgmt frames protection capable and required and also enable beacon protection.
+
+    ./uaputl.exe sys_cfg_pmf
+        Get AP's PMF params settings.
+
+sys_cfg_ext_cap_len
+-------------------
+    "./uaputl.exe sys_cfg_ext_cap_len [length]"
+
+    This command is used to set or get AP extended capabilities IE Length.
+
+    Default length value is 10. It can be changed to 8 by the command.
+
+    Example:
+    ./uaputl.exe sys_cfg_ext_cap_len 8
+        Set AP's extended capabilities IE Length to 8.
+
+    ./uaputl.exe sys_cfg_ext_cap_len 5
+        Invalid length value.
+
+    ./uaputl.exe sys_cfg_ext_cap_len
+        Get AP's extended capabilities IE Length.
+
+sys_cfg_wep_key  // (use of WEP/TKIP is not recommended anymore)
+---------------
+    "./uaputl.exe sys_cfg_wep_key [INDEX ISDEFAULT Key_0]  // (use of WEP/TKIP is not recommended anymore)
+                                  [INDEX ISDEFAULT Key_1]
+                                  [INDEX ISDEFAULT Key_2]
+                                  [INDEX ISDEFAULT Key_3]
+                                  [INDEX]"
+
+    This command is used to set or get the WEP (use of WEP/TKIP is not recommended anymore) key settings.
+
+    The supported options are:
+        INDEX:       0 - KeyIndex is 0
+                     1 - KeyIndex is 1
+                     2 - KeyIndex is 2
+                     3 - KeyIndex is 3
+	ISDEFAULT:   0: KeyIndex is not the default
+		     1: KeyIndex is the default transmit key
+
+        KEY_* :      Key value.
+        empty - Get current WEP key settings for all the keys (use of WEP/TKIP is not recommended anymore)
+        INDEX - Only INDEX will get the key setting for the particular
+                KeyIndex.
+
+    Example:
+	./uaputl.exe sys_cfg_wep_key 0 1 55555 (use of WEP/TKIP is not recommended anymore)
+		Set AP's default transmit key to "55555", key index is 0.
+
+    ./uaputl.exe sys_cfg_wep_key 0 1 12345678901234567890123456 (use of WEP/TKIP is not recommended anymore)
+        Set AP's default transmit key to "12345678901234567890123456", key index is 0.
+
+	./uaputl.exe sys_cfg_wep_key  (use of WEP/TKIP is not recommended anymore)
+		Get AP all the WEP keys settings.  (use of WEP/TKIP is not recommended anymore)
+
+	./uaputl.exe sys_cfg_wep_key 1  (use of WEP/TKIP is not recommended anymore)
+		Get WEP key setting for the KeyIndex = 1.  (use of WEP/TKIP is not recommended anymore)
+
+sys_cfg_cipher
+--------------
+    "./uaputl.exe sys_cfg_cipher [PAIRWISE_CIPHER GROUP_CIPHER]"
+
+    This command is used to set or get the key types for the pairwise and group key.
+
+    The supported options are:
+	PAIRWISE_CIPHER:
+			0		  None
+			4		  TKIP	 //use of WEP/TKIP is not recommended anymore
+			8		 AES CCMP
+			12		 AES CCMP + TKIP //use of WEP/TKIP is not recommended anymore
+        GROUP_CIPHER:
+			0		  None
+			4		  TKIP	 //use of WEP/TKIP is not recommended anymore
+			8		 AES CCMP
+    	empty - Get current key types
+
+	Valid combinations of [PAIRWISE_CIPHER GROUP_CIPHER] are:
+		[0 0], [4 4], [8 8], [12 4].
+
+    Example:
+	./uaputl.exe sys_cfg_cipher 4 4
+		Set AP's pairwise and group key's type to TKIP.  //use of WEP/TKIP is not recommended anymore
+
+	./uaputl.exe sys_cfg_cipher
+		Get AP's key types for the pairwise and group key.
+
+sys_cfg_pwk_cipher
+------------------
+    "./uaputl.exe sys_cfg_pwk_cipher [<PROTOCOL>] [PAIRWISE_CIPHER]"
+
+    This command is used to set or get protocol and corresponding pairwise cipher settings.
+
+    The supported options are:
+        PROTOCOL:
+                        0                None
+                        8                 WPA // use of WPA/TKIP is not recommended anymore
+                        32                WPA2
+                        256              WPA3 SAE
+        PAIRWISE_CIPHER:
+                        0                 None
+                        4                 TKIP //use of WEP/TKIP is not recommended anymore
+                        8                AES CCMP
+                        12               AES CCMP + TKIP //use of WEP/TKIP is not recommended anymore
+        WPA/TKIP cipher cannot be used when uAP operates in 802.11n mode.
+        If only PROTOCOL is provided, pairwise cipher for that protocol is displayed.
+        empty - Get protocol and corresponding pairwise cipher settings.
+
+    Example:
+        ./uaputl.exe sys_cfg_pwk_cipher 8 4
+                Set AP's pairwise cipher to TKIP ( use of WEP/TKIP is not recommended anymore) for WPA protocol. // use of WPA/TKIP is not recommended anymore
+
+        ./uaputl.exe sys_cfg_pwk_cipher 32
+                Get AP's pairwise cipher for WPA2 protocol.
+
+        ./uaputl.exe sys_cfg_pwk_cipher
+                Get AP's protocol and corresponding pairwise cipher settings.
+
+sys_cfg_gwk_cipher
+------------------
+    "./uaputl.exe sys_cfg_gwk_cipher [GROUP_CIPHER]"
+
+    This command is used to set or get group cipher.
+
+    The supported options are:
+        GROUP_CIPHER:
+                        0                 None
+                        4                 TKIP //use of WEP/TKIP is not recommended anymore
+                        8                AES CCMP
+        empty - Get group cipher settings.
+
+    Example:
+        ./uaputl.exe sys_cfg_gwk_cipher 8
+                Set AP's group cipher to AES CCMP.
+
+        ./uaputl.exe sys_cfg_gwk_cipher
+                Get AP's group cipher settings.
+
+sys_cfg_group_rekey_timer
+-------------------------
+    "./uaputl.exe sys_cfg_group_rekey_timer [GROUP_REKEY_TIMER]"
+
+    This command is used to set or get the AP group re-key time interval, in seconds.
+
+    The supported options are:
+        GROUP_REKEY_TIMER is represented in seconds. This is only applicable
+        		 if the protocol is WPA or WPA2. Value of 0 will disable group re-key. // use of WPA/TKIP is not recommended anymore
+
+        empty - Get current group rekey timer
+
+    Example:
+	./uaputl.exe sys_cfg_group_rekey_timer 1800
+		Set AP's group re-key time interval to 1800 s
+
+	./uaputl.exe sys_cfg_group_rekey_timer
+		Get AP's group re-key time interval.
+
+sys_cfg_wpa_passphrase
+----------------------
+    "./uaputl.exe sys_cfg_wpa_passphrase [PASSPHRASE]"
+
+    This command is used to set or get the WPA or WPA2 passphrase. // use of WPA/TKIP is not recommended anymore
+
+    If no arguments are given, this command returns the current WPA or WPA2 // use of WPA/TKIP is not recommended anymore
+    passphrase.
+    While setting, the maximum length of the passphrase can be 64 characters.
+
+    Example:
+	./uaputl.exe sys_cfg_wpa_passphrase 1234567890
+		Set AP's WPA or WPA2 passphrase to "1234567890" // use of WPA/TKIP is not recommended anymore
+
+	./uaputl.exe sys_cfg_wpa_passphrase
+		Get AP's WPA or WPA2 passphrase. // use of WPA/TKIP is not recommended anymore
+
+sys_cfg_wpa3_sae_password
+----------------------
+    "./uaputl.exe sys_cfg_wpa3_sae_password [PASSWORD]"
+
+    This command is used to set or get the WPA3 SAE passphrase.
+
+    Also setting psk for WPA3 SAE protocol is not possible, as new psk gets generated
+    everytime in protocol flow.
+
+    If no arguments are given, this command returns the current WPA3 SAE Password.
+    While setting, the maximum length of the password can be 255 characters.
+
+    Example:
+        ./uaputl.exe sys_cfg_wpa3_sae_password 1234567890
+                Set AP's WPA3 SAE password to "1234567890"
+
+        ./uaputl.exe sys_cfg_wpa3_sae_password
+                Get AP's WPA3 SAE password.
+
+sys_cfg_max_sta_num
+-------------------
+    "./uaputl.exe sys_cfg_max_sta_num [STA_NUM]"
+
+    This command is used to set or get the maximum number of stations allowed to connect to uAP.
+
+    If no arguments are given, this command returns the configured maximum number of stations
+		allowed to connect to uAP and maximum number of stations supported.
+
+    Example:
+	./uaputl.exe sys_cfg_max_sta_num 2
+		Set AP's maximum station number to 2
+
+	./uaputl.exe sys_cfg_max_sta_num
+		Get AP's maximum station number configured and maximum station number supported.
+
+sys_cfg_retry_limit
+-------------------
+    "./uaputl.exe sys_cfg_retry_limit [RETRY_LIMIT]"
+
+    This command is used to set or get the retry limit to use for packet transmissions.
+
+    The maximum retry_limit allowed is 14.
+
+    If no arguments are given, this command returns the current retry limit value.
+
+    Example:
+	./uaputl.exe sys_cfg_retry_limit 2
+		Set AP's retry limit value to 2
+
+	./uaputl.exe sys_cfg_retry_limit
+		Get AP's retry limit value
+
+sys_cfg_sticky_tim_config
+-------------------------
+    "./uaputl.exe sys_cfg_sticky_tim_config [ENABLE] [<DURATION> <STICKY_BIT_MASK>]"
+
+    This command is used to set or get sticky TIM configuration.
+
+    ENABLE is used to enable or disable sticky TIM feature.
+    Following are the valid values of ENABLE
+    0- disable SticktyTIM
+    1- enable StickyTIM  (Both DURATION in beacons and STICKY_BIT_MASK must be provided)
+    2- enable StickyTIM  (enable sticky TIM without changing previous values of
+       DURATION and STICKY_BIT_MASK)
+
+    When bit 0 of STICKY_BIT_MASK is set, TIM bit is made sticky and when
+    cleared, normal TIM bit updates resume.
+    When bit 1 of STICKY_BIT_MASK is set, MoreData bit is made sticky and when
+    cleared, normal MoreData bit updates resume.
+    STICKY_BIT_MASK = 0 is NOT a valid configuration value.
+
+    If no argument is given, this command returns current sticky TIM configuration.
+
+    Example:
+    ./uaputl.exe sys_cfg_sticky_tim_config
+                Get sticky TIM configuration.
+
+    ./uaputl.exe sys_cfg_sticky_tim_config 0
+                Disable sticky TIM feature.
+
+    ./uaputl.exe sys_cfg_sticky_tim_config 1 30 1
+                Enable sticky TIM feature with DURATION of 30 beacons and
+                STICKY_BIT_MASK set to 1.
+
+sys_cfg_sticky_tim_sta_mac_addr
+-------------------------------
+    "./uaputl.exe sys_cfg_sticky_tim_sta_mac_addr [CONTROL] [STA_MAC_ADDRESS]"
+
+    This command is used to set or get sticky TIM control parameter for associated station.
+
+    CONTROL when set to 1, sticky TIM bit for that station is activated.
+    When set to 0, sticky TIM bit for that station is deactivated.
+
+    If no argument is given, it returns sticky TIM configuration for all associated stations.
+    If only STA_MAC_ADDRESS is provided, it returns sticky TIM configartion for that station.
+
+    Example:
+    ./uaputl.exe sys_cfg_sticky_tim_sta_mac_addr
+            Get sticky TIM configuration for all associated stations.
+
+    ./uaputl.exe sys_cfg_sticky_tim_sta_mac_addr 00:50:43:20:11:22
+            Get control parameter for station 00:50:43:20:11:22.
+
+    ./uaputl.exe sys_cfg_sticky_tim_sta_mac_addr 1 00:50:43:20:11:22
+            Set control parameter for station with MAC address 00:50:43:20:11:22 to 1.
+
+    Note:TIM bit for an associated STA is made sticky only if both below mentioned
+         conditions are satisfied
+         1.Enable = 1 or 2 in most recently received sys_cfg_sticky_tim_config command, and
+         2.Control = 1 in most recently received sys_cfg_sticky_tim_sta_mac_addr
+           with this station MAC address.
+
+sys_cfg_2040_coex
+-------------------------------
+    "./uaputl.exe sys_cfg_2040_coex [ENABLE]"
+
+    This command is used to set or get 20/40 BSS coexistence configuration.
+
+    ENABLE when set to 0, disables 20/40 coex.
+    When set to 1, enables 20/40 coex.
+
+    If no argument is given, it returns 20/40 BSS coex configuration.
+
+    Example:
+    ./uaputl.exe sys_cfg_2040_coex
+            Get 20/40 BSS coexistence configuration.
+
+    ./uaputl.exe sys_cfg_2040_coex 0
+            Disable 20/40 BSS coexistence.
+
+    ./uaputl.exe sys_cfg_2040_coex 1
+            Enable 20/40 BSS coexistence.
+
+    Note:20/40 BSS coex configuration can be set only before starting BSS.
+
+sys_cfg_eapol_pwk_hsk
+---------------------
+    "./uaputl.exe sys_cfg_eapol_pwk_hsk [<TIMEOUT> <RETRIES>]"
+
+	This command is used to set or get pairwise handshake update timeout and
+	number of retries.
+
+	Both TIMEOUT and number of RETRIES should be provided for a 'set'.
+
+	If no arguments are given, this command returns timeout value and number
+	of
+	retries for pairwise key.
+
+	Example:
+	./uaputl.exe sys_cfg_eapol_pwk_hsk 50 2
+		Set AP's pairwise key timeout to 50ms and number of retries to 2.
+
+	./uaputl.exe sys_cfg_eapol_pwk_hsk
+		Get AP's pairwise key timeout and number of retries.
+
+sys_cfg_eapol_gwk_hsk
+---------------------
+	"./uaputl.exe sys_cfg_eapol_gwk_hsk [<TIMEOUT> <RETRIES>]"
+
+	This command is used to set or get groupwise handshake update timeout and
+	number of retries.
+
+	Both TIMEOUT and number of RETRIES should be provided for a	'set'.
+
+	If no arguments are given, this command returns timeout	value and number
+	of retries for groupwise key.
+
+	Example:
+	./uaputl.exe sys_cfg_eapol_gwk_hsk 50 2
+	Set AP's groupwise key timeout to 50ms and number of retries to 2.
+
+	./uaputl.exe sys_cfg_eapol_gwk_hsk
+	Get AP's groupwise key timeout and number of retries.
+
+sta_filter_table
+----------------
+    "./uaputl.exe sta_filter_table <FILTERMODE> [<MACADDRESS_LIST>]"
+
+    This command is used to get or set the client station MAC address
+    filter table.
+
+    The supported options are:
+    FILTERMODE : 0 - Disable filter table
+                 1 - Allow mac address specified in the allowed list
+                 2 - Block MAC addresses specified in the  banned list
+    MACADDRESS_LIST is the list of MAC addresses to be acted upon. Each
+    MAC address must be separated with a space. Maximum of 16 MAC addresses
+    are supported.
+
+    empty - Get current client station MAC address filter table.
+
+    Example:
+	./uaputl.exe sta_filter_table 0
+		Disable filter table
+
+	./uaputl.exe sta_filter_table 1 00:50:43:20:aa:bb
+		Set AP's filter mode to allow, only MAC address "00:50:43:ab:bb" will be allowed.
+
+	./uaputl.exe sta_filter_table
+		Get AP's filter table settings.
+
+regrdwr
+-------
+     "./uaputl.exe regrdwr <TYPE> <OFFSET> [value]"
+
+     These commands are used to read the MAC, BBP and RF registers from the card.
+     TYPE can take 3 values, 1 - read/write MAC register
+                             2 - read/write BBP register
+                             3 - read/write RF  register
+                             0x81 - read/write MAC2 register
+                             0x82 - read/write BBP2 register
+                             0x83 - read/write RF2 register
+
+     OFFSET specifies the offset location that is to be read.
+     This parameter can be specified either in decimal or in hexadecimal (by preceding the number with a "0x").
+
+     value if specified, then that value will be written to that offset in the specified register. Value should be
+     specified in hexadecimal.
+
+     Example:
+	./uaputl.exe regrdwr 1 0xa123
+		read MAC register 0xa123
+
+	./uaputl.exe regrdwr 1 0xa123 0xaa
+		write 0xaa to MAC register 0xa123
+
+        ./uaputl.exe regrdwr 2 0x0123
+		read BBP register 0x0123
+
+	./uaputl.exe regrdwr 2 0x0123 0xaa
+		write 0xaa to BBP register 0x0123
+
+        ./uaputl.exe regrdwr 3 0x0123
+		read RF register 0x0123
+
+	./uaputl.exe regrdwr 3 0x0123 0xaa
+		write 0xaa to RF register 0x0123
+
+memaccess
+---------
+ 	"./uaputl.exe memaccess <ADDR> [value]"
+	This commands is used to read/write to a memory address
+
+	ADDR specifies the address of the location that is to be read/write
+	This parameter can be specified either in decimal or in hexadecimal (by preceding the number with a "0x").
+
+	value if specified, then that value will be written to that address in the specified register.
+
+	Example:
+		./uaputl.exe memaccess 0xc00153e4
+			read contents of memory location 0xc00153e4
+
+
+		./uaputl.exe memaccess 0xc00153e4 0xaabbccdd
+			write value 0xaabbccdd to  memory location 0xc00153e4
+
+rdeeprom
+--------
+    "./uaputl.exe rdeeprom <offset> <bytecount>"
+
+    This command is used to read bytes from offset location on
+    EEPROM
+
+    offset: 0,4,8,..., multiple of 4
+    bytecount: 4-20, multiple of 4
+
+   	Example:
+    ./uaputl.exe rdeeprom 200 12
+        read 12 bytes from offset 200 ON EEPROM
+
+cfg_data
+--------
+ 	"./uaputl.exe cfg_data <type> [*.conf]"
+
+    This command is used to set/get the configuration data to/from the firmware.
+
+    type: 2 -- cal data
+
+   	Example:
+        ./uaputl.exe cfg_data 2 cal_data.conf
+            read cal_data from cal_data.conf and download to firmware.
+        ./uaputl.exe cfg_data 2
+            read cal_data from firmware
+
+sys_cfg_80211d
+--------------
+    "./uaputl.exe sys_cfg_80211d [state STATE] [country COUNTRY]"
+    This command is used to set/get 802.11D specific parameters.
+    If no parameters are provided, this command returns state, country and
+    domain information.
+
+    Allowed values for state are 0 for disable and 1 for enable.
+    COUNTRY is a two letter string input (derived from ISO 3166 code;
+    http://www.iso.org/iso/country_codes/iso_3166_code_lists/english_country_names_and_code_elements.htm
+    )
+
+    Countries are mapped with specific domain in file "80211d_domain.conf". In
+    order to set customize band setting, user can modify 80211d_domain.conf
+    file.
+
+    Example:
+    ./uaputl.exe sys_cfg_80211d state 0
+        To-disable
+
+    ./uaputl.exe sys_cfg_80211d state 1
+        To-enable
+
+    ./uaputl.exe sys_cfg_80211d country IN
+        for using country as INDIA
+
+    ./uaputl.exe sys_cfg_80211d state 1 country US
+        for enabling and setting country in single command.
+
+sys_cfg_80211d_country_ie
+-------------------------
+    "./uaputl.exe sys_cfg_80211d_country_ie [clear | country COUNTRY]"
+    This command is used to set/get/clear 802.11D beacon custom country IE
+    parameters. If no parameters are provided, this command returns country and
+    domain information. The set/clear action can be specified only before
+    starting the bss.
+
+    COUNTRY is a two letter string input (derived from ISO 3166 code;
+    http://www.iso.org/iso/country_codes/iso_3166_code_lists/english_country_names_and_code_elements.htm)
+
+    Countries are mapped with specific domain in file "80211d_country_ie.conf". In
+    order to set customize band setting, user can modify 80211d_country_ie.conf
+    file.
+
+    Example:
+    ./uaputl.exe sys_cfg_80211d_country_ie country FR
+        for using country as France
+
+    ./uaputl.exe sys_cfg_80211d_country_ie clear
+        for clearing currently set custom country IE
+
+uap_stats
+---------
+    "./uaputl.exe uap_stats"
+    This command is used to get uAP statistics.
+
+    Example:
+    ./uaputl.exe uap_stats
+
+pscfg
+---------
+    "./uaputl.exe pscfg [MODE] [CTRL INACTTO MIN_SLEEP MAX_SLEEP MIN_AWAKE MAX_AWAKE]
+
+    This command is used to set or get the AP's power mode and power save params.
+
+    The supported options are:
+        MODE :     0 - disable power mode
+                   2 - enable inactivity based power save mode
+
+        PS PARAMS:
+            CTRL:  0 - disable protection frame Tx before PS
+                   1 - enable protection frame Tx before PS
+            INACTTO: Inactivity timeout in microseconds, default value is 200000 us
+            MIN_SLEEP: Minimum sleep duration in microseconds, default value 17000 us
+            MAX_SLEEP: Maximum sleep duration in microseconds, default value 17000 us
+			The value of MIN_SLEEP should be >= 5000 us.
+			The value of MAX_SLEEP should be <= beacon interval(when ctrl: 0).
+			The value of MAX_SLEEP should be <= 32000 us(when ctrl: 1).
+
+            MIN_AWAKE: Minimum awake duration in microseconds, default value is 2000 us
+            MAX_AWAKE: Maximum awake duration in microseconds, default value is 2000 us
+			The value of MIN_AWAKE should be >= 2000 us.
+            MIN_AWAKE,MAX_AWAKE only valid when MODE is set to inactivity based power save mode.
+
+
+	empty - Get current power mode and power save params.
+
+    Example:
+	./uaputl.exe pscfg 0
+		Disable AP's power mode.
+
+   	./uaputl.exe pscfg 2
+		Enable inactivity based power save mode.
+
+   	./uaputl.exe pscfg 2 1 400000 20000 20000 10000 10000
+		Enable inactivity based power save mode, enable protection, set inactivity timeout 400000 us
+        set minimum sleep duration to 20000 us, maximum sleep duration to 20000 us
+        and set minimum awake duration to 10000us, maximum awake duration to 10000 us
+
+	./uaputl.exe pscfg
+		Get current AP's power mode and power save params.
+
+hscfg
+-----
+    ./uaputl.exe hscfg [condition [[GPIO# [gap]]]]
+	This command is used to configure the host sleep parameters.
+
+	This command takes one (condition), two (condition and GPIO#) or three
+	(condition, GPIO# and gap) parameters for set. If no parameter provided,
+	get is performed.
+
+	where Condition is:
+		bit 0 = 1   -- broadcast data
+		bit 1 = 1   -- unicast data
+		bit 2 = 1   -- mac event
+		bit 3 = 1   -- multicast data
+		bit 6 = 1  --  Wakeup when mgmt frame received.
+
+	The host sleep mode will be cancelled if condition is set to 0xffff.
+	The default is 0x7.
+
+	where GPIO is the pin number of GPIO used to wakeup the host. It could be any valid
+	GPIO pin# (e.g. 0-7) or 0xff (interface, e.g. SDIO will be used instead).
+	The default is 0xff.
+
+	where Gap is the gap in milliseconds between wakeup signal and wakeup event or 0xff
+	for special setting (host acknowledge required) when GPIO is used to wakeup host.
+	The default is 200.
+
+	Examples:
+		./uaputl.exe hscfg              : Get current host sleep mode
+		./uaputl.exe hscfg 0xffff       : Cancel host sleep mode
+		./uaputl.exe hscfg 3            : Broadcast and unicast data
+		                                  Use GPIO and gap set previously
+		./uaputl.exe hscfg 2 3          : Unicast data
+		                                  Use GPIO 3 and gap set previously
+		./uaputl.exe hscfg 2 1 0xa0     : Unicast data
+		                                  Use GPIO 1 and gap 160 ms
+		./uaputl.exe hscfg 2 0xff       : Unicast data
+		                                  Use interface (e.g. SDIO)
+		                                  Use gap set previously
+		./uaputl.exe hscfg 4 3 0xff     : MAC event
+		                                  Use GPIO 3
+		                                  Special host sleep mode
+		./uaputl.exe hscfg 1 0xff 0xff  : Broadcast data
+		                                  Use interface (e.g. SDIO)
+		                                  Use gap 255ms
+
+hssetpara
+---------
+    ./uaputl.exe hssetpara condition [[GPIO# [gap]]]
+    This command is used to configure the host sleep parameters.
+
+    Note:
+    1) The usages of parameters are the same as "hscfg" command.
+    2) The parameters will be saved in the driver and be used when host suspends.
+
+sta_deauth_ext
+--------------
+    "./uaputl.exe sta_deauth_ext <STA_MAC_ADDRESS><REASON_CODE>"
+
+    This command is used to de-authenticate a client station with specific reason code.
+
+    Example:
+        ./uaputl.exe sta_deauth_ext 00:50:43:20:34:58  4
+            deauth station 00:50:43:20:34:58 with IEEE reason code 4 (Disassociated due to inactivity)
+
+mic_err
+-------
+    "./uaputl.exe mic_err <STA_MAC_ADDRESS>"
+
+    This command is used to report station mic error.
+
+    Example:
+        ./uaputl.exe mic_err 00:50:43:20:34:58
+            report mic err for station 00:50:43:20:34:58
+
+key_material
+------------
+    "./uaputl.exe key_material <MAC_ADDRESS> <KEY> [KEY_ID]"
+
+    This command is used to set key. Get operation is not supported.
+
+        MAC_ADDRESS: station mac address while setting station unicast key
+                     ff:ff:ff:ff:ff:ff while setting multicast key
+
+        KEY: hex string, allowed length should be 32 or 64.
+        KEY_ID: default value is 0.
+
+    Example:
+        ./uaputl.exe key_material ff:ff:ff:ff:ff:ff 12345678901234567890123456789012 1
+            set group key, key value is "12345678901234567890123456789012", key id is 1
+
+        ./uaputl.exe key_material 00:50:43:20:34:58 1234567890123456789012345678901234567890123456789012345678901234
+            set station 00:50:43:20:34:58 unicast key,
+            key value is "1234567890123456789012345678901234567890123456789012345678901234"
+
+sys_cfg_custom_ie
+-----------------
+    "./uaputl.exe sys_cfg_custom_ie [INDEX] [MASK] [IEBuffer]"
+
+    This command is used to set or get custom IEs for management frames.
+
+    The supported options are:
+        INDEX:       0 - IE Index is 0
+                     1 - IE Index is 1
+                     2 - IE Index is 2
+                     MAX IE Index depends on device memory.
+
+               	    -1 - Append/Delete IE automatically
+                         Delete will delete the IE from the matching IE buffer
+                         Append will append the IE to the buffer with the same mask
+        MASK :       Management subtype mask value as per bit definitions
+	                   :  Bit 0 - Association request.
+	                   :  Bit 1 - Association response.
+	                   :  Bit 2 - Reassociation request.
+	                   :  Bit 3 - Reassociation response.
+	                   :  Bit 4 - Probe request.
+	                   :  Bit 5 - Probe response.
+	                   :  Bit 8 - Beacon.
+        MASK :       MASK = 0 to clear the mask and the IE buffer
+
+        IEBuffer:    IE buffer to set in hexadecimal bytes.
+	                  The Buffer should not be space separated.
+	                  ( Maximum length = 256 bytes )
+        empty - Get IE buffer, subtype mask settings for all the indices [0-3].
+        INDEX - Only INDEX will get the IE buffer configured for the particular
+                Index.
+
+    Example:
+	./uaputl.exe sys_cfg_custom_ie
+		Get IE buffer, subtype mask settings for all indices.
+
+	./uaputl.exe sys_cfg_custom_ie 1
+		Get IE buffer and subtype mask WEP key (use of WEP/TKIP is not recommended anymore) setting for the Index = 1.
+
+	./uaputl.exe sys_cfg_custom_ie 2 0
+		Clear IE buffer and mask value for Index = 2.
+
+	./uaputl.exe sys_cfg_custom_ie 3 0x101 0xdd051234567890
+		Set IE buffer and mask value for Index = 3.
+
+	./uaputl.exe sys_cfg_custom_ie -1 0x101 0xdd051234567890
+		Append the specified IEBuffer at index with mask value of 0x101
+
+	./uaputl.exe sys_cfg_custom_ie -1 0 0xdd051234567890
+		Delete the specified IEBuffer from all the IEs.
+
+	./uaputl.exe sys_cfg_custom_ie 2 0 0xdd051234567890
+		Delete the specified IEBuffer from the IEs at index 2.
+
+coex_config
+-----------
+    "./uaputl.exe coex_config [CONFIG_FILE]"
+    This command is used to set or get the BT coex configuration settings.
+
+    The supported options are:
+        CONFIG_FILE is file contain all the BT coex settings.
+        empty - Get current BT coex settings
+
+    Example:
+	./uaputl.exe coex_config
+		Get current BT coex settings.
+
+	./uaputl.exe coex_config uapcoex.conf
+		Load BT coex configuration settings from uapcoex.conf file and set.
+
+sys_cfg_wmm
+-----------
+    "./uaputl.exe sys_cfg_wmm [qosinfo=<qosinfo>]
+                              [0]
+                              [AC_BE AIFSN ECW_MAX ECW_MIN TX_OP]
+                              [AC_BK AIFSN ECW_MAX ECW_MIN TX_OP]
+                              [AC_VI AIFSN ECW_MAX ECW_MIN TX_OP]
+                              [AC_VO AIFSN ECW_MAX ECW_MIN TX_OP]"
+
+    This command can be used set/get beacon WMM parameters
+
+    The supported option are:
+        qosinfo: qos information. User can set only MSB. Valid values are 0x80 and 0x00.
+        Lower 4 bits are managed by FW. Hence, value read for qosinfo may have
+        lower 4 bits non-zero.
+
+        AC_BE: 0
+        AC_BK: 1
+        AC_VI: 2
+        AC_V0: 3
+        AIFSN: AIFSN value
+        ECW_MAX: ECW max
+        ECW_MIN: ECW min
+        TX_OP: TXOP Limit
+        empty - Get current WMM parameters
+        When all the parameter are 0, wmm will be disabled.
+
+        Example:
+        ./uaputl.exe sys_cfg_wmm 0 3 10 4 0
+           Set AC_BE with AIFSN 3, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+
+        ./uaputl.exe sys_cfg_wmm 1 7 10 4 0
+           Set AC_BK with AIFSN 7, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+
+        ./uaputl.exe sys_cfg_wmm 2 2 4 3 94
+           Set AC_VI with AIFSN 2, ECW_MAX 4, ECW_MIN 3 and TXOP 94
+
+        ./uaputl.exe sys_cfg_wmm 3 2 3 2 47
+           Set AC_VO with AIFSN 2, ECW_MAX 3, ECW_MIN 2 and TXOP 47
+
+        ./uaputl.exe sys_cfg_wmm
+            Get current wmm parameters
+
+        ./uaputl.exe sys_cfg_wmm 0 3 10 4 0 1 7 10 4 0 2 2 4 3 94 3 2 3 2 47
+            Set AC_BE with AIFSN 3, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+            Set AC_BK with AIFSN 7, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+            Set AC_VI with AIFSN 2, ECW_MAX 4, ECW_MIN 3 and TXOP 94
+            Set AC_VO with AIFSN 2, ECW_MAX 3, ECW_MIN 2 and TXOP 47
+
+        ./uaputl.exe sys_cfg_wmm qosinfo=0x80 0 3 10 4 0 1 7 10 4 0 2 2 4 3 94 3 2 3 2 47
+            Enable wmm PS mode.
+            Set AC_BE with AIFSN 3, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+            Set AC_BK with AIFSN 7, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+            Set AC_VI with AIFSN 2, ECW_MAX 4, ECW_MIN 3 and TXOP 94
+            Set AC_VO with AIFSN 2, ECW_MAX 3, ECW_MIN 2 and TXOP 47
+
+        ./uaputl.exe sys_cfg_wmm 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
+        ./uaputl.exe sys_cfg_wmm 0
+            Disable wmm
+
+sys_cfg_ap_wmm
+-----------
+    "./uaputl.exe sys_cfg_ap wmm [0]
+                                 [AC_BE AIFSN ECW_MAX ECW_MIN TX_OP]
+                                 [AC_BK AIFSN ECW_MAX ECW_MIN TX_OP]
+                                 [AC_VI AIFSN ECW_MAX ECW_MIN TX_OP]
+                                 [AC_VO AIFSN ECW_MAX ECW_MIN TX_OP]"
+
+    This command can be used set/get AP WMM parameters
+
+    The supported option are:
+        AC_BE: 0
+        AC_BK: 1
+        AC_VI: 2
+        AC_V0: 3
+        AIFSN: AIFSN value
+        ECW_MAX: ECW max
+        ECW_MIN: ECW min
+        TX_OP: TXOP Limit
+        empty - Get current AP WMM parameters
+        When all the parameter are 0, AP wmm will be disabled.
+
+        Example:
+        ./uaputl.exe sys_cfg_ap_wmm 0 3 10 4 0
+           Set AC_BE with AIFSN 3, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+
+        ./uaputl.exe sys_cfg_ap_wmm 1 7 10 4 0
+           Set AC_BK with AIFSN 7, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+
+        ./uaputl.exe sys_cfg_ap_wmm 2 2 4 3 94
+           Set AC_VI with AIFSN 2, ECW_MAX 4, ECW_MIN 3 and TXOP 94
+
+        ./uaputl.exe sys_cfg_ap_wmm 3 2 3 2 47
+           Set AC_VO with AIFSN 2, ECW_MAX 3, ECW_MIN 2 and TXOP 47
+
+        ./uaputl.exe sys_cfg_ap_wmm
+            Get current AP wmm parameters
+
+        ./uaputl.exe sys_cfg_ap_wmm 0 3 10 4 0 1 7 10 4 0 2 2 4 3 94 3 2 3 2 47
+            Set AC_BE with AIFSN 3, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+            Set AC_BK with AIFSN 7, ECW_MAX 10, ECW_MIN 4 and TXOP 0
+            Set AC_VI with AIFSN 2, ECW_MAX 4, ECW_MIN 3 and TXOP 94
+            Set AC_VO with AIFSN 2, ECW_MAX 3, ECW_MIN 2 and TXOP 47
+
+        ./uaputl.exe sys_cfg_ap_wmm 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
+        ./uaputl.exe sys_cfg_ap_wmm 0
+            Disable AP wmm
+
+addbapara
+---------
+    "./uaputl.exe addbapara [timeout txwinsize rxwinsize txamsdu rxamsdu]"
+	This command can be used to update the default ADDBA parameters.
+
+	The supported options are:
+	    timeout - This is the block ack timeout for ADDBA request.
+		    0 : Disable (recommended for throughput test)
+		    1 - 65535 : Block Ack Timeout in TU
+	    txwinsize - Buffer size for ADDBA request. (32 is default value)
+	    rxwinsize - Buffer size for ADDBA response. (16 is default value)
+	    txamsdu - amsdu support for ADDBA request. (1 is default value)
+		    0 : Disable amsdu in ADDBA request.
+		    1 - Enable amsdu in ADDBA request.
+	    rxamsdu - amsdu support for ADDBA response. (1 is default value)
+		    0 : Disable amsdu in ADDBA response.
+		    1 - Enable amsdu in ADDBA response.
+        empty - Get current ADDBA parameters.
+
+	Current window size limit for Tx as well as Rx is 1023.
+
+	Example:
+	./uaputl.exe addbapara
+        Get the current addba params
+	./uaputl.exe addbaparam 1000 64 8 0 0
+        This will change the ADDBA timeout to (1000 * 1024) us,	txwinsize to 64 and rxwinsize to 8
+        and disable AMSDU in ADDBA request/response.
+
+	In case the ADDBA timeout value is updated then a ADDBA is sent for all streams
+	to update the timeout value.
+
+	In case txwinsize and/or rxwinsize is updated, the effect could only be seen on
+	next ADDBA request/response. The current streams will not be affected with this
+	change.
+
+	In case of txamdsdu/rxamsdu is updated, the effect could only be seen on
+	next ADDBA request/response. The current streams will not be affected with this
+	change. AMSDU in AMPDU stream will be enabled when AP support this feature
+	and AMSDU is enabled in aggrpriotbl.
+
+sys_cfg_11n
+-----------
+    "./uaputl.exe sys_cfg_11n [ENABLE] [HTCAP] [AMPDU] [TXBFCAP] [HT_MCS_CAP]"
+    This command can be used set/get 802.11n parameters.
+
+    The supported option are:
+        ENABLE: 0 - disable 802.11n in uap
+                1 - enable 802.11n in uap
+		Note: If 802.11n is disabled, 802.11ac MUST be disabled at the same time
+        HTCAP: HT Capabilities info (default value is 0x111c)
+               Bit 15-13: Reserved set to 0
+               Bit 12: DSS/CCK mode in 40MHz enable/disable
+               Bit 11-10: Reserved set to 0
+               Bit 9-8: Reserved set to 0x01
+               Bit 7: STBC enable/disable
+               Bit 6: Short GI in 40 Mhz enable/disable
+               Bit 5: Short GI in 20 Mhz enable/disable
+               Bit 4: Green field enable/disable
+               Bit 3-2: Reserved set to 1
+               Bit 1: 20/40 Mhz enable disable.
+               Bit 0: LDPC enable/disable
+        AMPDU: A-MPDU Parameter (default value is 0x03)
+               Bit 7-5: Reserved set to 0
+               Bit 4-2: Minimum MPDU Start spacing
+                        Set to 0 for no restriction
+                        Set to 1 for 1/4 us
+                        Set to 2 for 1/2 us
+                        Set to 3 for 1 us
+                        Set to 4 for 2 us
+                        Set to 5 for 4 us
+                        Set to 6 for 8 us
+                        Set to 7 for 16 us
+               Bit 1-0: Max A-MPDU length
+        TXBFCAP: TX Beamforming capabilities
+               Bit 0    : Implicit TX BF receiving capable
+               Bit 1    : RX staggered sounding capable
+               Bit 2    : TX staggered sounding capable
+               Bit 3    : RX NDP capable
+               Bit 4    : TX NDP capable
+               Bit 5    : Implicit TX BF capable
+               Bit 6-7  : Calibration
+                       0: - not supported
+                       1: - STA can respond to a calibration request using
+                            the CSI Report, but cannot initiate calibration
+                       2: - reserved
+                       3: - STA can both initiate and respond to a calibration request
+               Bit 8    : Explicit CSI TX BF capable
+               Bit 9    : Explicit non-compressed steering capable
+               Bit 10   : Explicit compressed steering capable
+               Bit 11-12: Explicit TX BF CSI feedback
+                       0: - not supported
+                       1: - delayed feedback
+                       2: - immediate feedback
+                       3: - delayed and immediate feedback
+               Bit 13-14: Explicit non-compressed BF feedback capable
+                       0: - not supported
+                       1: - delayed feedback
+                       2: - immediate feedback
+                       3: - delayed and immediate feedback
+               Bit 15-16: Explicit compressed BF feedback capable
+                       0: - not supported
+                       1: - delayed feedback
+                       2: - immediate feedback
+                       3: - delayed and immediate feedback
+               Bit 17-18: Minimal grouping
+                       0: - no grouping (STA supports groups of 1)
+                       1: - groups of 1, 2
+                       2: - groups of 1, 4
+                       3: - groups of 1, 2, 4
+               Bit 19-20: CSI number of beamformer antennas supported
+                       0: - single TX antenna sounding
+                       1: - 2 TX antenna sounding
+                       2: - 3 TX antenna sounding
+                       3: - 4 TX antenna sounding
+               Bit 21-22: Non-compressed steering number of beamformer antennas supported
+                       0: - single TX antenna sounding
+                       1: - 2 TX antenna sounding
+                       2: - 3 TX antenna sounding
+                       3: - 4 TX antenna sounding
+               Bit 23-24: Compressed steering number of beamformer antennas supported
+                       0: - single TX antenna sounding
+                       1: - 2 TX antenna sounding
+                       2: - 3 TX antenna sounding
+                       3: - 4 TX antenna sounding
+               Bit 25-26: CSI max number of rows beamformer supported
+                       0: - single row of CSI
+                       1: - 2 rows of CSI
+                       2: - 3 rows of CSI
+                       3: - 4 rows of CSI
+               Bit 27-28: Channel estimation capability
+                       0: - 1 space time stream
+                       1: - 2 space time streams
+                       2: - 3 space time streams
+                       3: - 4 space time streams
+               Bit 29-31: Reserved
+        HT_MCS_MAP: MCS rate bitmap
+               Bit 0-7   : MCS_SET_0
+               Bit 15-8  : MCS_SET_1
+        empty - Get current 802.11n parameters.
+
+        Example:
+        ./uaputl.exe sys_cfg_11n 1 0x117e 3
+            enable 802.11n, and set HT Capabilities info to 0x117e, and A-MPDU Parameter to 0x03
+        ./uaputl.exe sys_cfg_11n 1 0x117e 3 0xFFFFFFFF
+            enable 802.11n, and set HT Capabilities info to 0x117e, A-MPDU
+            Parameter to 0x03 and TX Beamforming capabilities to 0xFFFFFFFF
+        ./uaputl.exe sys_cfg_11n 1 0x117e 3 0xFFFFFFFF 0x00100023
+            enable 802.11n, and set HT Capabilities info to 0x117e, A-MPDU
+            Parameter to 0x03, TX Beamforming capabilities to 0xFFFFFFFF and
+            MCS rate bitmap to 0x00100023.
+        ./uaputl.exe sys_cfg_11n 0
+            disable 802.11n in uap
+        ./uaputl.exe sys_cfg_11n
+            Get current 802.11n parameters
+
+aggrpriotbl
+-----------
+        "./uaputl.exe aggrpriotbl <m0> <n0> <m1> <n1> ... <m7> <n7>"
+        This command is used set/get the priority table for AMPDU/AMSDU traffic per tid.
+	    This command can also be used to disable AMPDU/AMSDU for a given tid.
+	    In case of AMPDU this priority table will be used to setup block ack (to make
+	    sure the highest priority tid always uses AMPDU as we have limited AMPDU streams)
+
+        The supported option are:
+            <m0> <n0> <m1> <n1> ... <m7> <n7>
+
+	    <mx> - This is priority for Tid0 for AMPDU packet. A priority could be any
+                values between 0 - 7, 0xff to disable aggregation.
+	    <nx> - This is priority for Tid0 for AMSDU packet. A priority could be any
+		        values between 0 - 7, 0xff to disable aggregation.
+
+        empty - Get current priority table for AMPDU/AMSDU traffic.
+
+        Example:
+        ./uaputl.exe aggrpriotbl
+            This command will get the current Priority table for AMPDU and AMSDU.
+			<2 2 0 0 1 1 3 3 4 4 5 5 255 255 255 255>. This is read as
+			<"Prio for AMPDU for Tid0" "Prio for AMSDU for Tid0"
+			"Prio for AMPDU for Tid1" "Prio for AMSDU for Tid1" and so on
+
+	    ./uaputl.exe aggrpriotbl 2 2 0 0 1 1 3 3 4 4 5 5 255 255 255 255
+            This will set the priority table for AMPDU and AMSDU
+			Priority for Tid0/AMPDU = 2, Tid0/AMSDU = 2, Tid1/AMPDU = 0, Tid1/AMSDU = 0
+			and so on. Aggregation for Tid6 and Tid7 are disabled.
+			Here higher the priority number, higher the priority (i.e. 7
+			has higher priority than 6). Similarly for AMSDU.
+
+	    ./uaputl.exe aggrpriotbl 0xff 2 0xff 0 0xff 1 0xff 3 0xff 4 0xff 5 0xff 0xff 0xff 0xff
+            This will disable AMPDU for all the TIDs but will still keep AMSDU enabled to Tid0 to Tid5
+
+	    The default setting is 2 255 0 255 1 255 3 255 4 255 5 255 255 255 255 255.
+
+	    A delBA should be seen in case a disable happens on a TID for which AMPDU stream
+	        is currently setup.
+
+        Note:- This command should only be issued in disconnected state.
+
+addbareject
+-----------
+        "./uaputl.exe addbareject <m0> <m1> ... <m7>"
+        This command is used set/get the addbareject table for all the TIDs.
+	    This command can also be used to enable rejection of ADDBA requests for a given tid.
+
+        The supported option are:
+            <m0> <m1> ... <m7>
+        <mX> - This can be 0/1 for TidX. 1 enables rejection of ADDBA request for TidX and
+		   0 would accept any ADDBAs for TidX.
+        empty - Get current addbareject table for all the TIDs.
+
+        Example:
+        ./uaputl.exe addbareject
+            This command will get the current table.
+	        [0 0 0 0 0 0 1 1]. ADDBA would be accepted for all TIDs except for TID [6,7].
+	        This is the default state.
+
+        ./uaputl.exe addbareject 0 0 1 1 0 0 0 0
+            This command will accept ADDBA requests for Tid [0,1,4,5,6,7] and reject ADDBA requests for Tid [2,3]
+
+	    ./uaputl.exe addbareject 1 1 1 1 1 1 1 1
+            This will enable rejection of ADDBA requests for all Tids.
+
+        Note:- This command should only be issued in disconnected state.
+
+sys_cfg_tdls_ext_cap
+--------------------
+
+    "./uaputl.exe sys_cfg_tdls_ext_cap [CONFIG_FILE]"
+
+    This command is used to set/get TDLS extended capability settings.
+
+    If CONFIG_FILE is provided, a SET is performed , else a GET is performed.
+
+    Examples:
+        ./uaputl.exe sys_cfg_tdls_ext_cap config/tdls_ext_cap.conf
+        Set TDLS extended capability parameters in the config file.
+        ./uaputl.exe sys_cfg_tdls_ext_cap
+        Get TDLS extended capability parameters.
+
+sys_cfg_wacp_mode
+-----------------
+    "./uaputl.exe sys_cfg_wacp_mode [MODE]"
+
+    This commands is used to configure WACP mode.
+
+    <MODE>       0 - default mode, disable WACP
+                 1 - enable WACP mode 1
+                 2 - enable WACP mode 2
+
+    Examples:
+   ./uaputl.exe sys_cfg_wacp_mode 1   : Enable WACP Mode 1
+   ./uaputl.exe sys_cfg_wacp_mode 0   : Disable WACP Mode
+
+    "./uaputl.exe skip_cac <CHANNEL> <MODE> [<bw>]"
+
+    This command is used to enable/disable skip CAC on a particular channel.
+
+    <CHANNEL>   5G DFS channel
+    <MODE>       0 - disable skip cac
+                 1 - enable skip cac
+    <bw>         0 - 20 Mhz (default)
+                 2 - 40 Mhz
+                 3 - 80 Mhz
+
+    Examples:
+	./uaputl.exe skip_cac 52 1   : Enable skip CAC on channel 52
+	./uaputl.exe skip_cac 52 0   : Disable skip CAC on channel 52
+	./uaputl.exe skip_cac 52 1 3 : Enable skip CAC on channel 52 with bandwidth 80Mhz.
+
+httxbfcfg
+---------
+	"./uaputl.exe httxbfcfg <ACTION> [ACT_DATA]"
+
+	This command is used to configure the TX beamforming options.
+
+	The supported options are:
+		ACTION: 0 - Control global parameters for beamforming
+                1 - Performs NDP Sounding for PEER
+		        2 - TX BF interval in milliseconds
+		        3 - Enable/Disable beamforming/sounding for the indicated peer.
+		        4 - TX BF SNR Threshold for peer
+		ACT_DATA: Specific data for the above actions
+                  For ACTION 0 - Beamforming enable/disable, sounding enable/disable,
+                                 FB type, snr_threshold, sounding interval, Beamformig mode
+		          For ACTION 1 - PEER MAC and status
+		          For ACTION 2 - TX BF interval
+		          For ACTION 3 - PEER MAC
+		          For ACTION 4 - PEER MAC and SNR
+		          empty - Get action specific settings
+
+	Examples:
+		./uaputl.exe httxbfcfg 0                          : Get current global configuration parameter
+		./uaputl.exe httxbfcfg 2 00:50:43:20:BF:64        : Get the TX BF periodicity for a given peer
+		./uaputl.exe httxbfcfg 3                          : Get the list of MAC addresses that have
+		                                                      beamforming and/or sounding enabled
+		./uaputl.exe httxbfcfg 4                          : Get the list of PEER MAC, SNR tuples
+		                                                      programmed into the firmware.
+		./uaputl.exe httxbfcfg 0 0 0 3 10 500 5           : Disable beamforming, sounding, set FB type
+		                                                      to 3, snr threshold to 10, sounding interval
+		                                                      to 500 ms and beamforming mode to 5
+		./uaputl.exe httxbfcfg 1 00:50:43:20:BF:64        : Perform NDP Trigger sounding to peer
+		                                                      00:50:43:20:BF:64
+		./uaputl.exe httxbfcfg 2 00:50:43:20:BF:64 500    : Set TX BF periodicity for peer 00:50:43:20:BF:64
+		                                                      to 500 milliseconds
+		./uaputl.exe httxbfcfg 3 00:50:43:20:BF:43 1 0 3  : Enable beamforming, disable sounding and set
+		                                                      FB type to 3 for peer 00:50:43:20:BF:43
+		./uaputl.exe httxbfcfg 4 00:50:43:20:BF:24 43     : Set TX BF SNR threshold to peer
+
+
+httxcfg
+	This command is used to configure various 11n specific configuration
+	for transmit (such as Short GI, Channel BW and Green field support)
+
+	where <m> is <txcfg>
+	This is a bitmap and should be used as following
+		Bit 15-8: Reserved set to 0
+		Bit 7: STBC enable/disable
+		Bit 6: Short GI in 40 Mhz enable/disable
+		Bit 5: Short GI in 20 Mhz enable/disable
+		Bit 4: Green field enable/disable
+		Bit 3-2: Reserved set to 1
+		Bit 1: 20/40 Mhz enable disable.
+		Bit 0: LDPC enable/disable
+
+	When Bit 1 is set then firmware could transmit in 20Mhz or 40Mhz based
+	on rate adaptation. When this bit is reset then firmware will only
+	transmit in 20Mhz.
+
+	Example:
+		./uaputl.exe -i uapX httxcfg
+		This will display HT Tx configuration.
+
+		./uaputl.exe -i uapX httxcfg 0x62
+		This will enable 20/40 and Short GI but will disable Green field.
+
+		./uaputl.exe -i uapX httxcfg 0x30
+		This will enable Short GI 20 Mhz and Green field.
+
+	Note:- If 20/40 MHz support is disabled in htcapinfo, device will not transmit
+	in 40 MHz even 20/40 MHz is enabled in httxcfg.
+
+htstreamcfg
+	This command is used to set/get HT stream configuration.
+	The setting only takes effect in next association.
+
+	Usage:
+		./uaputl.exe -i uapX htstreamcfg [n]
+
+	where <n>
+		0x11: HT stream 1x1 mode
+		0x22: HT stream 2x2 mode
+
+	Examples:
+		./uaputl.exe -i uapX htstreamcfg        : Get current setting
+		./uaputl.exe -i uapX htstreamcfg 0x11   : Set HT stream 1x1 mode
+		./uaputl.exe -i uapX htstreamcfg 0x22   : Set HT stream 2x2 mode
+
+deepsleep
+---------
+    "./uaputl.exe deepsleep [MODE] [IDLE_TIME]"
+    This command is used to set/get auto deep sleep mode.
+
+    The supported option are:
+        [MODE]: Enable/disable auto deep sleep mode (1/0)
+        [IDLE_TIME]: Idle time in milliseconds after which firmware will put the device
+                    in deep sleep mode. Default value is 100 ms.
+        empty - Get current deep sleep mode.
+
+    Example:
+    ./uaputl.exe deepsleep          : Display auto deep sleep mode
+    ./uaputl.exe deepsleep 1        : Enable auto deep sleep mode, idle time unchanged
+    ./uaputl.exe deepsleep 0        : Disable auto deep sleep mode
+    ./uaputl.exe deepsleep 1 500    : Enable auto deep sleep mode with idle time 500 ms
+
+    Note:
+            Deepsleep must be disabled before changing idle time.
+
+sdcmd52rw
+	This command is used to read/write a controller register in
+	Secure Digital I/O Interfaces.
+
+	Usage:
+    "./uaputl.exe sdcmd52rw <function number> <register address> [value]"
+
+	For SDIO MMC driver, only function 0 and 1 access is allowed. And there
+	is a limitation for function 0 write, only vendor specific CCCR registers
+	(0xf0 -0xff) are permiited.
+
+	Examples:
+    ./uaputl.exe sdcmd52rw 1 3          : Issue cmd52 to read function 1, register 3.
+    ./uaputl.exe sdcmd52rw 1 1 0x3f     : Issue cmd52 to write function 1, register 1
+                                          with value 0x3f.
+
+txpwrlimit_cfg_get
+txpwrlimit_2g_cfg_set
+txpwrlimit_5g_cfg_set
+------------------
+    This command is used to set/get the configuration data of Tx power limitation.
+    Note: The configuration set should be issued when no STA is connected.
+
+    Examples:
+        ./uaputl.exe hostcmd config/txpwrlimit_cfg.conf txpwrlimit_cfg_get
+        ./uaputl.exe hostcmd config/txpwrlimit_cfg.conf txpwrlimit_2g_cfg_set
+        ./uaputl.exe hostcmd config/txpwrlimit_cfg.conf txpwrlimit_5g_cfg_set
+
+tx_data_pause
+-------------
+  "./uaputl.exe tx_data_pause [ENABLE][TX_BUF_CNT]"
+
+    This command is used to set/get tx data pause settings.
+
+    The supported option are:
+        [ENABLE]: Enable/disable pause tx events from firmware to host.
+        [TX_BUF_CNT]: Max number of TX buffers allowed for all PS clients
+        empty - Get current tx data pause settings
+
+    Example:
+    ./uaputl.exe tx_data_pause      : Display tx data pause settings
+    ./uaputl.exe tx_data_pause 1    : Enable pause tx event, max tx buffer number unchanged.
+    ./uaputl.exe tx_data_pause 0    : Disable pasue tx event, max tx buffer number unchanged.
+    ./uaputl.exe tx_data_pause 1 15 : Enable pause tx event, with max tx buffer number 15.
+
+vhtcfg
+	This command is used to set and get various 11ac specific configuration
+	for transmission and reception. For the SET operation, all paramaters
+	may be applied.	For the GET operation, only the first two parameters are applied.
+	The 6th argument "rx_mcs_set" can be used to disbale/enable 802.11ac.
+
+	where <j> is <band>
+	<band> - This is the band setting for the vhtcfg
+		0: Settings for both 2.4G and 5G bands (for SET operation, 11N BW only)
+		1: Settings for 2.4G band (for 11N BW only)
+		2: Settings for 5G band
+
+	where <k> is <txrx>
+	<txrx> - This parameter specifies the configuration of VHT operation for TX or/and VHT capabilities
+		3: configuration of VHT capabilities (uAP only)
+	Note: For the UAP, only 3 is supported for txrx.
+
+	where [l] is <bwcfg>
+	<bwcfg> - This parameter specifies the bandwidth (BW) configuration
+		  applied to the vhtcfg.
+	If <txrx> is 3 (For uAP),
+		0: Tx BW follows the BW (20/40 MHz) from 11N CFG
+		1: Tx BW follows the BW (80/160/80+80 MHz) from VHT Capabilities
+		   defined in <vhtcap> below for 5G band.
+
+	where [m] is <vhtcap>
+	<vhtcap> - This parameter specifies the VHT capabilities info if <txrx> is 2 (association)
+		   or the VHT Tx operations if <txrx> is 1 (Tx operations).
+		   The VHT Tx operation should be a subset of VHT capabilities for association.
+		   It is a bitmap and should be used as follows:
+
+		Bit 31-30: Reserved and set to 0
+		Bit 29:    TX antenna pattern consistency
+			   1: antenna pattern does not change
+			   0: antenna pattern might change
+		Bit 28:    RX antenna pattern consistency
+			   1: antenna pattern does not change
+			   0: antenna pattern might change
+		Bit 27-26: VHT link adaptation capable
+			   0: no feedback of VHT MFB from the STA
+			   1: unsolicted feedback of VHT MFB from the STA
+			   2: both response and unsolicted feedback of VHT MFB
+			      from the STA
+			   3: reserved and set to 0
+		Bit 25-23: Maximum A-MPDU length exponent
+		Bit 22:    +HTC-VHT capable (1: enable. 0 disable)
+		Bit 21:    VHT TXOP PS
+		Bit 20:    MU beamformee capable (1: enable. 0 disable)
+		Bit 19:    MU beamformer capable (1: enable. 0 disable)
+		Bit 18-16: Number of sounding dimensions (set to maximum-1
+			   if Bit 11 is 1. Otherwise, reserved and set to 0)
+		Bit 15-13: Compressed steering number of beamformer
+			   antennas supported (set to maximum-1 if Bit 12 is 1.
+			   Otherwise, reserved and set to 0)
+		Bit 12:    SU beamformee capable (1: enable. 0 disable)
+		Bit 11:    SU beamformer capable (1: enable. 0 disable)
+		Bit 10-8:  Rx STBC
+			   0: no support
+			   1: support of 1 spatial stream
+			   2: support of 1-2 streams
+			   3: support of 1-3 spatial streams
+			   4: support of 1-4 spatial streams
+			   5-7: reserved and set to 0
+		Bit 7:     TX STBC (1: enable. 0 disable)
+		Bit 6:     Short GI for 160 and 80+80 MHz (1: enable. 0 disable)
+		Bit 5:     Short GI for 80 MHz (1: enable. 0 disable)
+		Bit 4:     Rx LDPC (1: enable. 0 disable)
+		Bit 3-2:   Supported channel width set.
+			   0: no support of either 160 or 80+80 MHz.
+			   1: support of 160 MHz
+			   2: support of both 160 and 80+80 MHz.
+			   3: reserved and set to 0.
+		Bit 1-0:   Maximum MPDU length
+			   0: 3895 octets.
+			   1: 7991 octets.
+			   2: 11454 octets.
+			   3: reserved and set to 0.
+
+	where [n] is <tx_mcs_map>,
+	<tx_mcs_map> - This parameter specifies the TX MCS map. It may not be used for the STA if <txrx> is 1 (Tx operations).
+		It is a bitmap and should be used as following
+		Bit 15-0:  MCS map, which is defined as folows:
+			Bit 15-14: Max MCS for 8 SS
+			Bit 13-12: Max MCS for 7 SS
+			Bit 11-10: Max MCS for 6 SS
+			Bit 9-8:   Max MCS for 5 SS
+			Bit 7-6:   Max MCS for 4 SS
+			Bit 5-4:   Max MCS for 3 SS
+			Bit 3-2:   Max MCS for 2 SS
+			Bit 1-0:   Max MCS for 1 SS
+
+	where [o] is <rx_mcs_map>.
+	<rx_mcs_map> - This parameter specifies the RX MCS map. It may not be used for the STA if <txrx> is 1 (Tx operations).
+		It is a bitmap with the same sructure as for <tx_mcs_map>
+		rx_mcs_map = 0xffff : FW will disable 802.11ac
+                rx_mcs_map = others : FW will enable 802.11ac
+
+	Note: The user setting of vhtcap may be overwritten by the driver
+	      if the setting of those fields is beyond the hardware capabilities.
+
+	Examples:
+		./uaputl.exe -i uapX vhtcfg 2 3            : Get current VHT configuration in 5GHz for the uAP.
+		./uaputl.exe -i uapX vhtcfg 2 3 0 0x000001f0 0xfffa 0xfffa
+		    : Set the current/maximum VHT configuration in 5GHz for the uAP.
+		      Both Tx and Rx supports MCS 0-9 for both 1 and 2 spatial streams.
+		./uaputl.exe -i uapX vhtcfg 2 3 0 0x000001b0
+		    : Set the VHT capability information in 5GHz for the uAP, and keep the Tx/Rx MCS Map same as before.
+
+dfstesting
+----------
+  "./uaputl.exe dfstesting [<user_cac_pd> <user_nop_pd> <no_chan_change> <fixed_chan_num><cac_restart>]"
+
+    This command is used to set/get DFS testing settings.
+
+    The supported option are:
+        <user_cac_pd>: user-configured Channel Availability Check in sec
+                       0 = disable, use default period (60 seconds)
+                       1-1800 = enable with that period
+        <user_nop_pd>: user-configured Non-Occupancy Period in sec
+                       0 = disable, use default period (1800)
+                       1-65535 = enable with that period
+        <no_chan_change>: enable/disable no channel change on radar
+                          0 = disable, 1 = enable (overrides below)
+        <fixed_chan_num>: user-configured channel to change to on radar
+                          0 = disable, 1-255 = enable with that channel
+                          (channel validity for region, etc. is not checked)
+                          (only takes effect if no_chan_change = 0)
+        <cac_restart> after CAC success, driver auto restart CAC again
+
+    Example:
+    ./uaputl.exe dfstesting               : Get current dfstesting settings
+    ./uaputl.exe dfstesting 60 0 0 0 0    : user_cac=60sec, others disabled/default
+    ./uaputl.exe dfstesting 0 0 1 0 0     : only no_chan_change enabled
+    ./uaputl.exe dfstesting 0 120 0 64 0  : user_nop=2min, force chan 64 on radar
+    ./uaputl.exe dfstesting 60 0 0 0 1    : user_cac=60sec, restart cac after success
+
+cscount
+---------------
+
+  "./uaputl.exe cscount [<channel_switch_count>]"
+
+    This command is used to configure the number of beacons AP sends with channel switch IE, before channel change due to
+    radar detection. If not configured, <channel_switch_count> is set to 5 by default.
+
+    The supported options are:
+        <channel_switch_count>: user configured channel switch count
+                                5-20 = configure with that value
+
+   Example:
+   ./uaputl.exe cscount         : Get user configured channel switch count value
+   ./uaputl.exe cscount 10      : Set channel switch count to 10
+
+
+mgmtframectrl
+-------------
+  "./uaputl.exe mgmtframectrl [MASK]"
+
+    This command is used to set/get management frame control mask.
+
+    where the parameter [MASK] is the bit mask of management frame reception.
+        Following are the bit definitions.
+        Bit 0 : Association Request
+        Bit 1 : Association Response
+        Bit 2 : Re-Association Request
+        Bit 3 : Re-Association Response
+        Bit 4 : Probe Request
+        Bit 5 : Probe Response
+        Bit 8 : Beacon Frames
+
+    Example:
+    ./uaputl.exe mgmtframectrl 0x101
+    Set management frame control mask to 0x101.
+
+sys_cfg_restrict_client_mode
+--------------------
+	"./uaputl.exe sys_cfg_restrict_client_mode [<ENABLE> [MODE_CONFIG]]"
+
+	This command is used to set/get the mode in which the ex-Stations can connect to the uAP.
+	If no arguments are given, this command returns the current configuration.
+	By default this feature will be disabled.
+	[ENABLE]:
+		1: Enable the feature.
+		0: Disable the feature.
+	[MODE_CONFIG]: config mode.
+		Bit 0:	B only Mode.
+		Bit 1:	A only Mode.
+		Bit 2:	G only Mode.
+		Bit 3:	N only Mode.
+		Bit 4:	AC only Mode.
+
+	Example:
+	./uaputl.exe sys_cfg_restrict_client_mode 1 0x8.
+	Only N mode clients will be able to connect. Association will fail for other clients.
+
+	./uaputl.exe sys_cfg_restrict_client_mode 0.
+	This feature is disabled.
+
+	Note:
+	The set operation should be performed before bss is started.
+	User should make sure that the mode advertized by uAP in beacons
+	(i.e. combination of supported/extended rates IE and capability IEs)
+	is superset of the mode allowed for ex-STA associations using this TLV.
+
+uap_oper_ctrl
+-------------
+	"./uaputl.exe uap_oper_ctrl [control] [chanopt] [bandcfg] [channel]"
+
+	This command is used to set/get uAP operation control when in-STA disconnected with ext-AP.
+	If no arguments are given, this command returns the current configuration.
+
+	The supported options are:
+		<control> : 0  default, do nothing
+				   2  uAP stops and restart automatically
+		<chanopt> Specify which channel should be used when uap restarts automatically
+				   1: uap restarts on default 2.4G/channel 6
+				   2: uap restart on band/channel configured by driver previously
+				   3: uap restart on band/channel configured by parameter bandcfg/channel
+		<bandcfg> This parameter specifies the bandwidth when chanopt is 3
+				   0: 20Mhz
+				   2: 40Mhz
+				   3: 80Mhz
+		<channel> This parameter specifies the channel will be used when chanopt is 3
+
+		Example:
+		./uaputl.exe uap_oper_ctrl  2 1
+		uap stops and restart automatically when in-STA disconnects with ext-AP,
+		and restart on default 2.4G/channel 6.
+
+		./uaputl.exe uap_oper_ctrl  2 2
+		uap stops and restart automatically when in-STA disconnects with ext-AP,
+		and restart on band/channel configured by driver previously.
+
+		./uaputl.exe uap_oper_ctrl  2 3 2 36
+		uap stops and restart automatically when in-STA disconnects with ext-AP,
+		and restart on channel 36, bandwidth 40.
+
+		./uaputl.exe uap_oper_ctrl  0
+		when in-STA disconnects with ext-AP, uap will stay on current operation channel.
+
+		./uaputl.exe uap_oper_ctrl
+		Get current uap operation control setting.
+
+band_steering_cfg
+-----------------
+	"./uaputl.exe band_steering_cfg [state STATE] [block_2g_prb_req NUMBER_OF_PRB_REQ_TO_BLOCK] [max_btm_req_allowed MAX_BTM_REQ_ALLOWED_FOR_2G_STICKY_STA]"
+
+	This command is used to set/get band steering configuration.
+	If no arguments are given, this command returns the current configuration.
+
+	The supported options are:
+		<state> :  0  disable band steering feature
+				   1  enable band steering feature
+		<block_2g_prb_req> This parameter specifies the number of probe requests to block before allowing response for the STA.
+
+		Example:
+		./uaputl.exe band_steering_cfg
+		This will return the current values for "state" and "block_2g_prb_req".
+
+		./uaputl.exe band_steering_cfg state 1 block_2g_prb_req 5
+		This will send probe response for 6th probe requests after denying response for first 5 probe requests.
+
+		./uaputl.exe band_steering_cfg state 1 max_btm_req_allowed 5
+		This will send max 5 bss_transition requests to station.
+
+		./uaputl.exe band_steering_cfg state 0
+		This will disable the band steering feature.
+
+		./uaputl.exe band_steering_cfg state 1 block_2g_prb_req 6 max_btm_req_allowed 6
+		This will send probe response for 6th probe requests after denying response for first 5 probe requests and will send max 5 bss_transition requests to station.
+
+beacon_stuck_detect
+-----------------
+        "./uaputl.exe beacon_stuck_detect [beacon_stuck_detect_count] [recovery_confirm_count]"
+
+        This command is used to set/get beacon stuck detect mechanism configuration.
+        If no arguments are given, this command returns the current configuration.
+
+        The supported options are:
+                <beacon_stuck_detect_count> :
+                        This parameter specifies number of beacon interval after which FW will check
+                        for beacon Tx status. Value should be between 0 to 60. Default value is 20.
+
+                <recovery_confirm_count> :
+                        This parameter specifies upon doing MAC reset, number of beacon interval
+                        after which FW will check for recovery status. Value should be between 0 to 60.
+                        Default value is 5. Also value should be less than beacon_stuck_detect_count.
+
+                Example:
+                ./uaputl.exe beacon_stuck_detect
+                This will return the current values for "beacon_stuck_detect_count" and "recovery_confirm_count".
+
+                ./uaputl.exe beacon_stuck_detect 20  5
+                This will set beacon_stuck_detect_count to 20 and recovery_confirm_count to 5.
+
+                ./uaputl.exe beacon_stuck_detect 0  0
+                Disable the beacon stuck detect meachanism.
+
+vndr_cmd_dump
+-------------
+    "./uaputl vndr_cmd_dump [uaputl_cmd] [arguments]"
+
+    This command is used to get the dump for the uaputl commands, which are supported via the
+    netlink interface. The generated dump includes an OUI, subcmd id for supported cmd and its
+    arguments. This dump is printed in the required raw format as per iw/wpa_cli vendor cmd.
+
+    This dump will be used as input data to an iw or wpa_cli vendor cmd, which sends the private
+    vendor cmd to driver via netlink. The specific subcmd support required in the driver for that
+    cmd to work.
+
+    [uaputl_cmd]   :   uaputl cmd for which dump is generated and
+                       this cmd is supported in driver via the netlink
+    [arguments]    :   uaputl cmd arguments as per uaputl user manual,
+                       which is set as per end user requirements.
+
+    Examples:
+                // SET cmd:
+                ./uaputl.exe vndr_cmd_dump sys_cfg_80211d_country_ie country US
+                      - Display the corresponding cmd input data in the required hexdump formats
+                      - Generated hexdump can be directly used with the iw/wpa_cli vendor cmd
+                 Below iw/wpa_cli vendor cmd using the above hexdump to SET the custom country ie,
+                 iw dev uap0 vendor send 0x5043 0x202 0x81 0x02 0x14 0x00 0x00 0x00 0x00 0x00 0x01 0x00 0x07 0x00 0x06 0x00 0x55 0x53 0x20 0x01 0x0b 0x1e 0x00 0x00 0x00 0x00
+                 wpa_cli -i mlan0 vendor 5043 514 8102140000000000010007000600555320010b1e00000000 nested=0
+                      - iw/wpa_cli vendor cmd uses the hexdump to set that custom country_ie in beacons via netlink
+
+                 // CLEAR cmd:
+                 ./uaputl.exe vndr_cmd_dump sys_cfg_80211d_country_ie clear
+                      - Display the corresponding cmd input data in the required hexdump formats
+                      - Generated hexdump can be directly used with the iw/wpa_cli vendor cmd
+                 Below iw/wpa_cli vendor cmd using the above hexdump to CLEAR the custom country ie,
+                 iw dev uap0 vendor send 0x5043 0x202 0x81 0x02 0x0a 0x00 0x00 0x00 0x00 0x00 0x04 0x00 0x00 0x00 0x00 0x00
+                 wpa_cli -i mlan0 vendor 5043 514 81020a0000000000040000000000 nested=0
+                      - iw/wpa_cli vendor cmd uses the hexdump to clear the custom country_ie in beacons via netlink
+
+                 // GET cmd:
+                 ./uaputl.exe vndr_cmd_dump sys_cfg_80211d_country_ie
+                      - Display the corresponding cmd input data in the required hexdump formats
+                      - Genertaed hexdump can be directly used with the iw/wpa_cli vendor cmd,
+                  Below iw/wpa_cli vendor cmd using the above hexdump to GET the custom country ie,
+                  iw dev uap0 vendor send 0x5043 0x202 0x81 0x02 0x0a 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+                  wpa_cli -i mlan0 vendor 5043 514 81020a0000000000000000000000 nested=0
+                      - iw/wpa_cli vendor cmd uses the hexdump to get the custom country_ie from beacons via netlink
+                      - wpa_cli doesn't print the cmd response, even though the cmd was responded by driver
+
+===============================================================================
+        U S E R  M A N U A L  F O R  MLANEVENT
+
+NAME
+mlanevent.exe
+
+This tool can be used to listen for and obtain events from the uAP driver
+through the netlink layer.
+
+----------------
+Supported events
+----------------
+STA_DEAUTH
+STA_ASSOC
+BSS_START
+BSS_IDLE
+BSS_ACTIVE
+
+-----------------
+Details of events
+-----------------
+
+STA_DEAUTH
+----------
+    For this event, the following information is shown:
+        + Deauthenticated STA MAC address.
+        + Reason for deauthentication.
+
+STA_ASSOC
+---------
+    For this event, the following information is shown:
+        + STA MAC address.
+
+BSS_START
+---------
+    For this event, the following information is shown:
+        + AP MAC address.
+
+BSS_IDLE
+--------
+    For this event, there is no associated information.
+
+BSS_ACTIVE
+----------
+    For this event, there is no associated information.
+
+===============================================================================
+        U S E R  M A N U A L  F O R  IWPRIV
+
+NAME
+	This manual describes the usage of private commands used in NXP MLAN
+	Linux UAP Driver.
+
+	To use parameters as hex format, a '0x' must precede it for the parameters to
+	be parsed properly.
+
+SYNOPSIS
+	iwpriv <uapX> <command> [sub-command] ...
+
+	iwpriv uapX version
+	iwpriv uapX verext
+	iwpriv uapX start
+	iwpriv uapX stop
+	iwpriv uapX bssstart
+	iwpriv uapX bssstop
+	iwpriv uapX fwreload <path>
+	iwpriv uapX apcfg "ASCII_CMD=AP_CFG,SSID=TEST_uAP,[SEC,][KEY,]
+	                   [CHANNEL,][PREAMBLE,][MAX_SCB,][END]"
+
+DESCRIPTION
+	Those commands are used to send additional commands to the NXP MLAN
+	card via the Linux device driver.
+
+	The uapX parameter specifies the network device that is to be used to
+	perform this command on. It could be uap0, uap1 etc.
+
+version
+	This is used to get the current version of the driver and the firmware.
+
+verext
+	Retrieve and display an extended version string from the firmware
+
+	Usage:
+		iwpriv uapX verext [#]
+
+	where [#] is an optional argument to retrieve a specific version string,
+	omission of the argument retrieves the 0 indexed string.
+
+start
+	Start the uAP driver.
+
+	Usage:
+		iwpriv uapX start
+
+stop
+	Stop the uAP driver.
+
+	Usage:
+		iwpriv uapX stop
+
+bssstart
+	Start the AP mode, so that uAP will start transmitting beacon.
+
+	Usage:
+		iwpriv uapX bssstart
+
+bssstop
+	Stop the AP mode and disconnect all stations. uAP will stop
+	transmitting beacon as well.
+
+	Usage:
+		iwpriv uapX bssstop
+
+fwreload
+	Reload the firmware. Here string "FW_PATH=" in the path
+	argument is mandatory part.
+
+	Usage:
+		iwpriv uapX fwreload <path>
+
+apcfg
+	This command is used to set the AP configurations. Here string
+	"ASCII_CMD=AP_CFG" is minimum requirement in the ASCII string.
+	Note: BSS will be stopped then restarted if BSS is already started
+	when the command is received.
+
+	Usage:
+		iwpriv uapX apcfg "ASCII_CMD=AP_CFG,SSID=TEST_uAP,[SEC=sec,]
+			[KEY=key,][CHANNEL=channel,][MAX_SCB=max_scb,][END]"
+
+	Where the parameters are:
+		SSID:       Set SSID to be used in beacon and probe response
+		[SEC]:      Security modes - open, wep128 (use of WEP/TKIP is not recommended anymore), wpa-psk or wpa2-psk // use of WPA/TKIP is not recommended anymore
+		            11n will be auto disabled in wep128 (use of WEP/TKIP is not recommended anymore) and wpa-psk mode
+		[KEY]:      Encrypted key for wep128 (use of WEP/TKIP , WPA/TKIP is not recommended anymore), wpa-psk or wpa2-psk, minimum 8 chars
+		[CHANNEL]:  Channel to be selected
+		[MAX_SCB]:  Maximum STA number
+		[END]:      Optional termination in ASCII string
+
+	Examples:
+		iwpriv uap0 apcfg "ASCII_CMD=AP_CFG,SSID=TEST_uAP"
+                                        : Set AP SSID to "TEST_uAP"
+		iwpriv uap0 apcfg "ASCII_CMD=AP_CFG,SSID=TEST_uAP,SEC=open"
+                                        : Set AP SSID to "TEST_uAP" and
+                                          security mode is disabled
+		iwpriv uap0 apcfg "ASCII_CMD=AP_CFG,SSID=TEST_uAP,SEC=WPA2-PSK,KEY=ecbe5facdbfe234a"
+                                        : Set AP SSID to "TEST_uAP" and security mode
+                                          to WPA2-SPK and encrypted key ecbe5facdbfe234a
+		iwpriv uap0 apcfg "ASCII_CMD=AP_CFG,SSID=TEST_uAP,CHANNEL=8"
+                                        : Set AP SSID to "TEST_uAP" and
+                                          set the AP channel to 8
+
+===============================================================================
diff --git a/wlan_src/README_WIFIDIRECT b/wlan_src/README_WIFIDIRECT
new file mode 100644
index 0000000..9bdce5d
--- /dev/null
+++ b/wlan_src/README_WIFIDIRECT
@@ -0,0 +1,392 @@
+
+===============================================================================
+
+        S E T U P  I N S T R U C T I O N S F O R  *WifiDirect*
+
+Driver,FW release:
+
+1. Make sure, bg_scan.conf,uaputl.conf has SSID starting with "DIRECT-"
+2. Download uAP configuration and BG scan configuration.
+3. This version of wifidirectutl breaks the backward compatibility and will work
+with following releases -
+    8797 >= 14.xx.16.p15
+         >= 14.xx.11.p138
+    8766 >= 14.xx.11.p138
+    8787 >= 14.xx.9.p89
+
+    However, In case one needs to run the utility in backward compatibility mode
+    he can do so by running following command before running the utility -
+
+    # export WIFIDIR_USE_FIXED_IE_INDICES=1
+
+    To disable backward comaptibility mode run following command -
+
+    # export WIFIDIR_USE_FIXED_IE_INDICES=0
+
+WPSWIFIDIRECT release:
+
+1. Modify the wifidirect.conf file to specify the correct HW addresses of
+   devices. The DUT mac address and peer mac address needs to be correctly
+   entered.
+
+===============================================================================
+        U S E R  M A N U A L  F O R  WIFIDIRECTUTL
+
+NAME
+	wifidirectutl
+
+This tool can be used to configure WifiDirect parameters.
+
+------------------
+Supported Commands
+------------------
+wifidirect_mode [MODE]
+wifidirect_config [*.conf]
+wifidirect_params_config [*.conf]
+wifidirect_action_frame <*.conf> | [<PeerAddr> <Category> <OuiSubtype> <DialogToken>]
+wifidirect_discovery_request <*.conf>
+wifidirect_discovery_response <*.conf>
+
+wifidirect_cfg_discovery_period [<MinDiscPeriod> <MaxDiscPeriod>]
+wifidirect_cfg_intent [IntentValue]
+wifidirect_cfg_capability [<DeviceCapability> <GroupCapability>]
+wifidirect_cfg_noa <enable|disable> <index> [<counttype> <duration> <interval>]
+wifidirect_cfg_opp_ps <enable|disable> [<CTWindow>]
+wifidirect_cfg_invitation_list [mac_addr]
+wifidirect_cfg_listen_channel [ListenChannel]
+wifidirect_cfg_op_channel [OperatingChannel]
+wifidirect_cfg_persistent_group_record [index] [role]
+           [<groupbss> <deviceId> <ssid> <psk>] [peermac1] [peermac2]
+wifidirect_cfg_persistent_group_invoke [index] | <cancel>
+wifidirect_cfg_presence_req_params [<type> <duration> <interval>]
+wifidirect_cfg_ext_listen_time [<duration> <interval>]
+wifidirect_cfg_provisioning_params [<action> <configMethods> <devicePassword>]
+wifidirect_cfg_wps_params [<action>]
+
+wifidirect_mode [mode]
+----------
+    "./wifidirectutl <iface> wifidirect_mode [mode]"
+
+    This command is used to setup various modes for wifidirect device.
+    The mode 2 can be used only when wifidirect is started using mode 1.
+    The mode 3 should not be used for uAP.
+
+    The supported options are:
+        mode :     0 - stop wifidirect mode
+                   1 - start wifidirect mode
+                   2 - start wifidirect group owner mode
+                   3 - start wifidirect client mode
+                   4 - start wifidirect find phase
+                   5 - stop wifidirect find phase
+        empty - Get current wifidirect mode
+
+    Example:
+        ./wifidirectutl <iface> wifidirect_mode 0
+                Stop wifidirect mode.
+
+        ./wifidirectutl <iface> wifidirect_mode 1
+                Start wifidirect mode.
+
+        ./wifidirectutl <iface> wifidirect_mode
+                Get current WIFIDIRECT start/stop mode.
+
+wifidirect_config
+----------
+    "./wifidirectutl <iface> wifidirect_config [*.conf]"
+
+    This command is used to set/get the wifidirect configuration.
+
+        Example:
+        ./wifidirectutl <iface> wifidirect_config wifidirect.conf
+            Read configuration from wifidirect.conf and apply it.
+        ./wifidirectutl <iface> wifidirect_config
+            Read existing wifidirect configuration and display it.
+
+wifidirect_params_config
+----------
+    "./wifidirectutl <iface> wifidirect_params_config [*.conf]"
+
+    This command is used to set/get the wifidirect parameters configuration.
+
+        Example:
+        ./wifidirectutl <iface> wifidirect_params_config wifidirect.conf
+            Read parameter configuration from wifidirect.conf and apply it.
+        ./wifidirectutl <iface> wifidirect_params_config
+            Read existing wifidirect parameters's configuration and display it.
+
+wifidirect_action_frame
+----------
+    "./wifidirectutl <iface> wifidirect_action_frame <*.conf> | <PeerAddr> <Category> <OUISubtype> <DialogToken>"
+
+    This command is used to send action frames as specified in config file or on command line.
+
+        Example:
+        ./wifidirectutl <iface> wifidirect_action_frame wifidirect.conf
+            Read action_frame from wifidirect.conf and send to peer.
+        ./wifidirectutl <iface> wifidirect_action_frame <PeerAddr> <Category> <OUISubtype> <DialogToken>
+            Read action frame parameters from command line and send to peer.
+
+wifidirect_discovery_request
+----------
+    "./wifidirectutl <iface> wifidirect_discovery_request <*.conf>"
+
+    This command is used to send wifidirect discovery request packet.
+
+        Example:
+        ./wifidirectutl <iface> wifidirect_discovery_request wifidirect.conf
+            Read discovery packet from wifidirect.conf and send to peer.
+
+wifidirect_discovery_response
+----------
+    "./wifidirectutl <iface> wifidirect_discovery_response <*.conf>"
+
+    This command is used to send wifidirect discovery response packet.
+
+        Example:
+        ./wifidirectutl <iface> wifidirect_discovery_response wifidirect.conf
+            Read discovery packet from wifidirect.conf and send to peer.
+
+wifidirect_cfg_discovery_period
+----------
+	"./wifidirectutl <iface> wifidirect_cfg_discovery_period [<MinDiscPeriod> <MaxDiscPeriod>]"
+
+	This command is used to set or get minimum and maximum discovery period.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_discovery_period 10 20
+		Set minimum discovery interval to 10 and maximum discovery
+		interval to	20.
+
+		./wifidirectutl <iface> wifidirect_cfg_discovery_period
+		Get minimum and maximum discovery interval.
+
+wifidirect_cfg_intent
+----------
+	"./wifidirectutl <iface> wifidirect_cfg_intent [IntentValue]"
+
+	This command is used to set or get intent value.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_intent 12
+		Set intent value to 12.
+
+		./wifidirectutl <iface> wifidirect_cfg_intent
+		Get Group Owner Intent.
+
+wifidirect_cfg_capability
+----------
+	"./wifidirectutl <iface> wifidirect_cfg_capability [<DeviceCapability> <GroupCapability>]"
+
+	This command is used to set or get device capability and group capability.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_capability 10 20
+		Set Device capability to 10 and group capability to 20
+
+		./wifidirectutl <iface> wifidirect_cfg_capability
+		Get Device capability and group capability.
+
+wifidirect_cfg_noa
+----------
+	"./wifidirectutl <iface> wifidirect_cfg_noa <enable|disable> <index> [<counttype> <duration> <interval>]"
+
+	This command is used to set or get NoA parameters like count_type, duration and
+	interval in ms when NoA is enabled. Valid value of index is [0, 1].
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_noa enable 0 10 50 100
+		Enable NoA and set count to 10, duration to 50ms and interval to 100 ms
+            for index 0.
+
+		./wifidirectutl <iface> wifidirect_cfg_noa disable 1
+		Disable NoA at index 1.
+
+		./wifidirectutl <iface> wifidirect_cfg_noa
+		Get NoA settings.
+
+wifidirect_cfg_opp_ps
+----------
+	"./wifidirectutl <iface> wifidirect_cfg_opp_ps <enable|disable> [<CTWindow>]"
+
+	This command is used to set or get Opportunistic power save and CT window.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_opp_ps enable 50
+		Set OppPS and CTwindow value to 50.
+
+		./wifidirectutl <iface> wifidirect_cfg_opp_ps disable
+		Disable OppPS.
+
+		./wifidirectutl <iface> wifidirect_cfg_opp_ps
+		Get OppPS and CT window.
+
+wifidirect_cfg_invitation_list
+----------
+	"./wifidirectutl <iface> wifidirect_cfg_invitation_list [mac_addr]"
+
+	This command is used to set or get invitation list of peers.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_invitation_list 00:50:43:20:23:34
+		Set 00:50:43:20:23:34 in invitation list of peers.
+
+		./wifidirectutl <iface> wifidirect_cfg_invitation_list
+		Get Invitation list of peers.
+
+wifidirect_cfg_listen_channel
+----------
+	"./wifidirectutl <iface> wifidirect_cfg_listen_channel [ListenChannel]"
+
+	This command is used to set or get Listen channel.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_listen_channel 11
+		Set Listen channel to 11.
+
+		./wifidirectutl <iface> wifidirect_cfg_listen_channel
+		Get Listen channel.
+
+wifidirect_cfg_op_channel
+----------
+		"./wifidirectutl <iface> wifidirect_cfg_op_channel [OperatingChannel]"
+
+		This command is used to set or get Operating channel.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_op_channel 11
+		Set Operating channel to 11.
+
+		./wifidirectutl <iface> wifidirect_cfg_op_channel
+		Get Operating channel.
+
+wifidirect_cfg_persistent_group_record
+----------
+		"./wifidirectutl <iface> [index] [role]
+                 [<groupbss> <deviceId> <ssid> <psk>] [peermac1] [peermac2]"
+
+		This command is used to set or get the persistent group record
+        maintained in the device. Valid index is from 0 to 3. The role should be
+        0 for client, 1 for group-owner.
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_persistent_group_record 0 1
+        00:50:43:12:24:36 00:50:43:13:26:39 "DIRECT-" "1234567890"
+        00:50:43:20:c2:d0
+		Set persistent group record with index 0, role as group owner, bssId and
+        device Id, ssid="DIRECT-", passphrase="1234567890", and peer mac address.
+        The passphrase get converted to PSK.
+
+		./wifidirectutl <iface> wifidirect_cfg_persistent_group_record 1 1
+        00:50:43:12:24:36 00:50:43:13:26:39 "DIRECT-" "1234567890"
+        0x1234567890123456789012345678901234567890123456789012345678901234
+		Set persistent group record with index 1, role as group owner, bssId and
+        device Id, ssid="DIRECT-", passphrase="1234567890", and peer mac address.
+        The passphrase get converted to PSK.
+        PSK is specified with "0x" prefix and 32 bytes (64 characters).
+
+		./wifidirectutl <iface> wifidirect_cfg_persistent_group_record 1
+		Get persistent group record with index 1.
+
+		./wifidirectutl <iface> wifidirect_cfg_persistent_group_record
+		Get persistent group record for all indices.
+
+wifidirect_cfg_persistent_group_invoke
+----------
+		"./wifidirectutl <iface> wifidirect_cfg_persistent_group_invoke [index] | <cancel>"
+
+		This command is used to invoke a particular persistent group record
+        from the list. Valid index is from 0 to 3.
+
+		./wifidirectutl <iface> wifidirect_cfg_persistent_group_invoke 2
+		Invoke persistent group record with index 1.
+
+		./wifidirectutl <iface> wifidirect_cfg_persistent_group_invoke cancel
+		Cancel invokation of persistent groups.
+
+wifidirect_cfg_presence_req_params
+----------
+		"./wifidirectutl <iface> wifidirect_cfg_presence_req_params [<type> <duration> <interval>]"
+
+		This command is used to set/get presence request parameters. Type should
+        be 1 for preferred values and 2 for acceptable values.
+
+		./wifidirectutl <iface> wifidirect_cfg_presence_req_params 1 50 100
+		Set duration to 50ms and interval to 100ms.
+
+		./wifidirectutl <iface> wifidirect_cfg_presence_req_params
+		Get presence request parameters.
+
+wifidirect_cfg_ext_listen_time
+----------
+		"./wifidirectutl <iface> wifidirect_cfg_ext_listen_time [<duration> <interval>]"
+
+		This command is used to set/get extended listen timing parameters.
+
+		./wifidirectutl <iface> wifidirect_cfg_ext_listen_time 1200 1300
+		Set availability period to 1200ms and availability interval to 1300 ms.
+
+		./wifidirectutl <iface> wifidirect_cfg_ext_listen_time
+		Get extended listen timing parameters.
+
+wifidirect_cfg_provisioning_params
+----------
+		"./wifidirectutl <iface> wifidirect_cfg_provisioning_params [<action> <configMethod> <devicePassword>]"
+
+		This command is used to set/get provisioning protocol parameters. Action should
+        be 1 for request parameters and 2 for response parameters.
+
+		./wifidirectutl <iface> wifidirect_cfg_provisioning_params 1 0x80 0x04
+		Set config method to 0x86 and device password to 0x04.
+
+		./wifidirectutl <iface> wifidirect_cfg_provisioning_params
+		Get Provision protocol parameters.
+
+wifidirect_cfg_wps_params
+----------
+		"./wifidirectutl <iface> wifidirect_cfg_wps_params [<action>]"
+
+		This command is used to set WPS action. action can be "pin" (pin entered),
+        "pbc"(button pressed) or "none".
+
+		Example:
+		./wifidirectutl <iface> wifidirect_cfg_wps_params pin
+		Indicates pin operation
+
+		./wifidirectutl <iface> wifidirect_cfg_wps_params none
+		Indicates no operation
+
+
+===============================================================================
+        U S E R  M A N U A L  F O R  MLANEVENT
+
+NAME
+mlanevent.exe
+
+This tool can be used to listen for and obtain events from the driver
+through the netlink layer. This is only used for display/debugging purpose.
+
+----------------
+Supported events
+----------------
+WIFIDIRECT_GENERIC_EVENT
+WIFIDIRECT_SERVICE_DISCOVERY
+
+-----------------
+Details of events
+-----------------
+
+WIFIDIRECT_GENERIC_EVENT
+-----------------
+    For this event, the following information is shown:
+        + Event length.
+        + Event Type indicating Negociation, Invitation, Discoverability,
+		Provision discovery related Request or Response.
+        + Event SubType indicating Client or Group owner role.
+        + Peer MAC address.
+        + Associated WIFIDIRECT IE elements.
+
+WIFIDIRECT_SERVICE_DISCOVERY
+---------------------
+    For this event, the following information is shown:
+        + Peer MAC address.
+        + Service discovery packet details.
diff --git a/wlan_sd8987/gpl-2.0.txt b/wlan_src/gpl-2.0.txt
old mode 100755
new mode 100644
similarity index 100%
rename from wlan_sd8987/gpl-2.0.txt
rename to wlan_src/gpl-2.0.txt
diff --git a/wlan_src/mlan/mlan.h b/wlan_src/mlan/mlan.h
new file mode 100644
index 0000000..39b74ff
--- /dev/null
+++ b/wlan_src/mlan/mlan.h
@@ -0,0 +1,46 @@
+/** @file mlan.h
+ *
+ *  @brief This file declares all APIs that will be called from MOAL module.
+ *  It also defines the data structures used for APIs between MLAN and MOAL.
+ *
+ *
+ *  Copyright 2008-2021 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/******************************************************
+Change log:
+    10/13/2008: initial version
+    11/07/2008: split mlan.h into mlan_decl.h & mlan_ioctl.h
+******************************************************/
+
+#ifndef _MLAN_H_
+#define _MLAN_H_
+
+#include "mlan_decl.h"
+#include "mlan_ioctl.h"
+#include "mlan_ieee.h"
+
+#endif /* !_MLAN_H_ */
diff --git a/wlan_sd8987/mlan/mlan_11ac.c b/wlan_src/mlan/mlan_11ac.c
old mode 100755
new mode 100644
similarity index 84%
rename from wlan_sd8987/mlan/mlan_11ac.c
rename to wlan_src/mlan/mlan_11ac.c
index 6ced102..038a2f3
--- a/wlan_sd8987/mlan/mlan_11ac.c
+++ b/wlan_src/mlan/mlan_11ac.c
@@ -1,22 +1,33 @@
 /** @file mlan_11ac.c
  *
- *  @brief This file contains the functions for station ioctl.
+ *  @brief This file defines the private and adapter data
+ *  structures and declares global function prototypes used
+ *  in MLAN module.
  *
  *
  *  Copyright 2011-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -53,97 +64,84 @@
  *
  *  @return             channel center frequency center, if found; O, otherwise
  */
-
 t_u8 wlan_get_center_freq_idx(mlan_private *pmpriv, t_u16 band, t_u32 pri_chan,
 			      t_u8 chan_bw)
 {
-	t_u8 center_freq_idx = 0;
+	struct center_freq_desc {
+		t_u8 pri_chan;
+		t_u8 ch_40;
+		t_u8 ch_80;
+		t_u8 ch_160;
+	};
 
-	if (band & BAND_AAC) {
-		switch (pri_chan) {
-		case 36:
-		case 40:
-		case 44:
-		case 48:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 42;
-				break;
-			}
-			/* fall through */
-		case 52:
-		case 56:
-		case 60:
-		case 64:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 58;
-				break;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 50;
-				break;
-			}
-			/* fall through */
-		case 100:
-		case 104:
-		case 108:
-		case 112:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 106;
-				break;
-			}
-			/* fall through */
-		case 116:
-		case 120:
-		case 124:
-		case 128:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 122;
-				break;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 114;
-				break;
-			}
-			/* fall through */
-		case 132:
-		case 136:
-		case 140:
-		case 144:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 138;
-				break;
-			}
-			/* fall through */
-		case 149:
-		case 153:
-		case 157:
-		case 161:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 155;
-				break;
-			}
-			/* fall through */
-		case 165:
-		case 169:
-		case 173:
-		case 177:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 171;
-				break;
-			}
-			/* fall through */
-		case 184:
-		case 188:
-		case 192:
-		case 196:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 190;
-				break;
-			}
-			/* fall through */
-		default: /* error. go to the default */
-			center_freq_idx = 42;
+	static const struct center_freq_desc center_freq_idx_map_5g[] = {
+		{.pri_chan = 36, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 40, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 44, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 48, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 52, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 56, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 60, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 64, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 68, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 72, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 76, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 80, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 84, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 88, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 92, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 96, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 100, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 104, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 108, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 112, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 116, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 120, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 124, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 128, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 132, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 136, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 140, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 144, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 149, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 153, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 157, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 161, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 165, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 169, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 173, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 177, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 184, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 188, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 192, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 196, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 0,
+		 .ch_40 = 42 /* terminator with default cfreq */}};
+
+	const struct center_freq_desc *map = MNULL;
+
+	if (band == BAND_5GHZ)
+		map = center_freq_idx_map_5g;
+
+	for (; map != MNULL; map++) {
+		/* reached end of map, return default value for that map */
+		if (map->pri_chan == 0)
+			return map->ch_40;
+
+		if (map->pri_chan == pri_chan) {
+			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
+			    chan_bw == CHANNEL_BW_40MHZ_BELOW)
+				return map->ch_40;
+
+			if (chan_bw == CHANNEL_BW_80MHZ)
+				return map->ch_80;
+
+			if (chan_bw == CHANNEL_BW_160MHZ)
+				return map->ch_160;
 		}
 	}
-	return center_freq_idx;
+
+	return 0;
 }
 
 /**
@@ -228,8 +226,9 @@
 	t_u32 hw_value = 0;
 	t_u8 nss = 0;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	t_u16 rx_nss = 0;
 	t_u16 tx_nss = 0;
 #endif
@@ -312,11 +311,13 @@
 		/** update the RX MCS map */
 		if (cfg->param.vht_cfg.txrx & MLAN_RADIO_RX) {
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 			if (IS_CARD9098(pmadapter->card_type) ||
-			    IS_CARDNW62X(pmadapter->card_type) ||
-			    IS_CARD9097(pmadapter->card_type)) {
+			    IS_CARDIW624(pmadapter->card_type) ||
+			    IS_CARD9097(pmadapter->card_type) ||
+			    IS_CARDAW693(pmadapter->card_type)) {
 				if (cfg->param.vht_cfg.band == BAND_SELECT_A) {
 					rx_nss = GET_RXMCSSUPP(
 						pmadapter->user_htstream >> 8);
@@ -346,8 +347,9 @@
 					pmadapter->hw_dot_11ac_mcs_support,
 					nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 				if ((rx_nss != 0) && (nss > rx_nss))
 					cfg_value = NO_NSS_SUPPORT;
 #endif
@@ -374,8 +376,9 @@
 					pmadapter->hw_dot_11ac_mcs_support,
 					nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 				if ((tx_nss != 0) && (nss > tx_nss))
 					cfg_value = NO_NSS_SUPPORT;
 #endif
@@ -800,8 +803,9 @@
 	t_u16 mcs_resp = 0;
 	t_u16 nss;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	t_u16 rx_nss = 0, tx_nss = 0;
 #endif
 	ENTER();
@@ -822,11 +826,13 @@
 		mcs_map_resp =
 			wlan_le16_to_cpu(pvht_cap->vht_cap.mcs_sets.rx_mcs_map);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	if (IS_CARD9098(priv->adapter->card_type) ||
-	    IS_CARDNW62X(priv->adapter->card_type) ||
-	    IS_CARD9097(priv->adapter->card_type)) {
+	    IS_CARDIW624(priv->adapter->card_type) ||
+	    IS_CARD9097(priv->adapter->card_type) ||
+	    IS_CARDAW693(priv->adapter->card_type)) {
 		if (bands & BAND_A) {
 			rx_nss = GET_RXMCSSUPP(priv->adapter->user_htstream >>
 					       8);
@@ -848,8 +854,9 @@
 		mcs_user = GET_VHTNSSMCS(mcs_map_user, nss);
 		mcs_resp = GET_VHTNSSMCS(mcs_map_resp, nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((rx_nss != 0) && (nss > rx_nss))
 			mcs_user = NO_NSS_SUPPORT;
 #endif
@@ -881,8 +888,9 @@
 		mcs_user = GET_VHTNSSMCS(mcs_map_user, nss);
 		mcs_resp = GET_VHTNSSMCS(mcs_map_resp, nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((tx_nss != 0) && (nss > tx_nss))
 			mcs_user = NO_NSS_SUPPORT;
 #endif
@@ -1080,7 +1088,7 @@
 		break;
 	}
 	vht_oprat->chan_center_freq_1 = wlan_get_center_freq_idx(
-		priv, BAND_AAC, pbss_desc->channel, chan_bw);
+		priv, BAND_5GHZ, pbss_desc->channel, chan_bw);
 
 	LEAVE();
 	return;
@@ -1098,8 +1106,9 @@
 {
 	t_u8 ret = MFALSE;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	t_u16 rx_nss = 0, tx_nss = 0;
 	IEEEtypes_VHTCap_t *pvht_cap = pbss_desc->pvht_cap;
 	MrvlIEtypes_He_cap_t *phecap = MNULL;
@@ -1109,11 +1118,13 @@
 	ENTER();
 
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	if (!IS_CARD9098(pmpriv->adapter->card_type) &&
-	    !IS_CARDNW62X(pmpriv->adapter->card_type) &&
-	    !IS_CARD9097(pmpriv->adapter->card_type))
+	    !IS_CARDIW624(pmpriv->adapter->card_type) &&
+	    !IS_CARD9097(pmpriv->adapter->card_type) &&
+	    !IS_CARDAW693(pmpriv->adapter->card_type))
 		return ret;
 	/** check band A */
 	if (!(pbss_desc->bss_band & BAND_A))
@@ -1164,8 +1175,9 @@
 	int ret_len = 0;
 	t_u8 bw_80p80 = MFALSE;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	t_u16 rx_nss = 0;
 #endif
 
@@ -1236,11 +1248,13 @@
 		/** set default bandwidth:80M*/
 		SET_OPER_MODE_80M(pmrvl_oper_mode->oper_mode);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if (IS_CARD9098(pmadapter->card_type) ||
-		    IS_CARDNW62X(pmadapter->card_type) ||
-		    IS_CARD9097(pmadapter->card_type)) {
+		    IS_CARDIW624(pmadapter->card_type) ||
+		    IS_CARD9097(pmadapter->card_type) ||
+		    IS_CARDAW693(pmadapter->card_type)) {
 			if (pbss_desc->bss_band & BAND_A)
 				rx_nss = GET_RXMCSSUPP(
 					pmadapter->user_htstream >> 8);
@@ -1254,11 +1268,13 @@
 		nss = wlan_get_nss_num_vht_mcs(mcs_map_user);
 
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if (IS_CARD9098(pmadapter->card_type) ||
-		    IS_CARDNW62X(pmadapter->card_type) ||
-		    IS_CARD9097(pmadapter->card_type)) {
+		    IS_CARDIW624(pmadapter->card_type) ||
+		    IS_CARD9097(pmadapter->card_type) ||
+		    IS_CARDAW693(pmadapter->card_type)) {
 			PRINTM(MCMND, "rx_nss=%d nss=%d\n", rx_nss, nss);
 			nss = MIN(rx_nss, nss);
 		}
@@ -1451,12 +1467,7 @@
  */
 t_u8 wlan_11ac_bandconfig_allowed(mlan_private *pmpriv, t_u16 bss_band)
 {
-	if (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS) {
-		if (bss_band & BAND_G)
-			return (pmpriv->adapter->adhoc_start_band & BAND_GAC);
-		else if (bss_band & BAND_A)
-			return (pmpriv->adapter->adhoc_start_band & BAND_AAC);
-	} else {
+	{
 		if (bss_band & BAND_G)
 			return (pmpriv->config_bands & BAND_GAC);
 		else if (bss_band & BAND_A)
diff --git a/wlan_src/mlan/mlan_11ac.h b/wlan_src/mlan/mlan_11ac.h
new file mode 100644
index 0000000..d064668
--- /dev/null
+++ b/wlan_src/mlan/mlan_11ac.h
@@ -0,0 +1,67 @@
+/** @file mlan_11ac.h
+ *
+ *  @brief This file defines the private and adapter data
+ *  structures and declares global function prototypes used
+ *  in MLAN module.
+ *
+ *
+ *  Copyright 2011-2021 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+#ifndef _MLAN_11AC_H_
+#define _MLAN_11AC_H_
+
+#include "mlan_11n_aggr.h"
+#include "mlan_11n_rxreorder.h"
+#include "mlan_wmm.h"
+
+void wlan_show_dot11acdevcap(pmlan_adapter pmadapter, t_u32 cap);
+void wlan_show_dot11acmcssupport(pmlan_adapter pmadapter, t_u32 support);
+t_u16 wlan_convert_mcsmap_to_maxrate(mlan_private *priv, t_u16 bands,
+				     t_u16 mcs_map);
+void wlan_fill_vht_cap_tlv(mlan_private *priv, MrvlIETypes_VHTCap_t *pvht_cap,
+			   t_u16 bands, t_u8 flag, t_u8 bw_80p80);
+void wlan_fill_vht_cap_ie(mlan_private *priv, IEEEtypes_VHTCap_t *pvht_cap,
+			  t_u16 bands);
+void wlan_fill_tdls_vht_oprat_ie(mlan_private *priv,
+				 IEEEtypes_VHTOprat_t *vht_oprat,
+				 sta_node *sta_ptr);
+t_u8 wlan_is_ap_in_11ac_mode(mlan_private *priv);
+int wlan_cmd_append_11ac_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
+			     t_u8 **ppbuffer);
+mlan_status wlan_11ac_cfg_ioctl(pmlan_adapter pmadapter,
+				pmlan_ioctl_req pioctl_req);
+void wlan_update_11ac_cap(mlan_private *pmpriv);
+t_u8 wlan_11ac_bandconfig_allowed(mlan_private *pmpriv, t_u16 bss_band);
+t_u8 wlan_is_80_80_support(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc);
+
+mlan_status wlan_cmd_11ac_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+			      t_u16 cmd_action, t_void *pdata_buf);
+
+mlan_status wlan_ret_11ac_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+			      mlan_ioctl_req *pioctl_buf);
+
+#endif /* _MLAN_11AC_H_ */
diff --git a/wlan_sd8987/mlan/mlan_11ax.c b/wlan_src/mlan/mlan_11ax.c
old mode 100755
new mode 100644
similarity index 75%
rename from wlan_sd8987/mlan/mlan_11ax.c
rename to wlan_src/mlan/mlan_11ax.c
index 38b903d..9eb5626
--- a/wlan_sd8987/mlan/mlan_11ax.c
+++ b/wlan_src/mlan/mlan_11ax.c
@@ -1,22 +1,33 @@
 /** @file mlan_11ax.c
  *
- *  @brief This file contains the functions for 11ax related features.
+ *  @brief This file defines the private and adapter data
+ *  structures and declares global function prototypes used
+ *  in MLAN module.
  *
  *
- *  Copyright 2018-2022 NXP
+ *  Copyright 2018-2022, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -296,8 +307,9 @@
 	pmlan_adapter pmadapter = pmpriv->adapter;
 	t_u16 len = 0;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	t_u16 rx_nss = 0, tx_nss = 0;
 #endif
 	MrvlIEtypes_He_cap_t *phecap = MNULL;
@@ -326,10 +338,12 @@
 	phe_cap->type = wlan_cpu_to_le16(phe_cap->type);
 	phe_cap->len = wlan_cpu_to_le16(phe_cap->len);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	if (IS_CARD9098(pmpriv->adapter->card_type) ||
-	    IS_CARD9097(pmpriv->adapter->card_type)) {
+	    IS_CARD9097(pmpriv->adapter->card_type) ||
+	    IS_CARDAW693(pmpriv->adapter->card_type)) {
 		if (band & BAND_AAX) {
 			rx_nss = GET_RXMCSSUPP(pmpriv->adapter->user_htstream >>
 					       8);
@@ -348,8 +362,9 @@
 		cfg_value = GET_HE_NSSMCS(phecap->rx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->rx_mcs_80, nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((rx_nss != 0) && (nss > rx_nss))
 			cfg_value = NO_NSS_SUPPORT;
 #endif
@@ -364,8 +379,9 @@
 		cfg_value = GET_HE_NSSMCS(phecap->tx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->tx_mcs_80, nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((tx_nss != 0) && (nss > tx_nss))
 			cfg_value = NO_NSS_SUPPORT;
 #endif
@@ -401,8 +417,9 @@
 	int len = 0;
 	t_u8 bw_80p80 = MFALSE;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	t_u16 rx_nss = 0, tx_nss = 0;
 #endif
 	t_u8 nss = 0;
@@ -446,11 +463,13 @@
 	phecap->type = wlan_cpu_to_le16(phecap->type);
 	phecap->len = wlan_cpu_to_le16(phecap->len);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	if (IS_CARD9098(pmpriv->adapter->card_type) ||
-	    IS_CARDNW62X(pmpriv->adapter->card_type) ||
-	    IS_CARD9097(pmpriv->adapter->card_type)) {
+	    IS_CARDIW624(pmpriv->adapter->card_type) ||
+	    IS_CARD9097(pmpriv->adapter->card_type) ||
+	    IS_CARDAW693(pmpriv->adapter->card_type)) {
 		if (pbss_desc->bss_band & band_selected) {
 			rx_nss = GET_RXMCSSUPP(pmpriv->adapter->user_htstream >>
 					       8);
@@ -471,8 +490,9 @@
 		cfg_value = GET_HE_NSSMCS(phecap->rx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->rx_mcs_80, nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((rx_nss != 0) && (nss > rx_nss))
 			cfg_value = NO_NSS_SUPPORT;
 #endif
@@ -487,8 +507,9 @@
 		cfg_value = GET_HE_NSSMCS(phecap->tx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->tx_mcs_80, nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((tx_nss != 0) && (nss > tx_nss))
 			cfg_value = NO_NSS_SUPPORT;
 #endif
@@ -551,8 +572,10 @@
 			    (t_u8 *)pmadapter->hw_2g_he_cap,
 			    pmadapter->hw_2g_hecap_len);
 	} else {
-		pmadapter->fw_bands |= BAND_AAX;
-		pmadapter->config_bands |= BAND_AAX;
+		if (pmadapter->fw_bands & BAND_A) {
+			pmadapter->fw_bands |= BAND_AAX;
+			pmadapter->config_bands |= BAND_AAX;
+		}
 		pmadapter->hw_hecap_len =
 			hw_he_cap->len + sizeof(MrvlIEtypesHeader_t);
 		memcpy_ext(pmadapter, pmadapter->hw_he_cap, (t_u8 *)hw_he_cap,
@@ -627,12 +650,7 @@
 	t_u16 bss_band = pbss_desc->bss_band;
 	if (pbss_desc->disable_11n)
 		return MFALSE;
-	if (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS) {
-		if (bss_band & BAND_G)
-			return (pmpriv->adapter->adhoc_start_band & BAND_GAX);
-		else if (bss_band & BAND_A)
-			return (pmpriv->adapter->adhoc_start_band & BAND_AAX);
-	} else {
+	{
 		if (bss_band & BAND_G)
 			return (pmpriv->config_bands & BAND_GAX);
 		else if (bss_band & BAND_A)
@@ -869,6 +887,9 @@
 	mlan_ds_11ax_cmd_cfg *cfg = MNULL;
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	t_u16 cmd_action = 0;
+	mlan_ds_11ax_llde_pkt_filter_cmd *llde_pkt_filter = MNULL;
+	int mlan_ds_11ax_cmd_cfg_header = 0;
+	t_u8 null_mac_addr[MLAN_MAC_ADDR_LENGTH] = {0};
 
 	ENTER();
 
@@ -887,6 +908,64 @@
 	else
 		cmd_action = HostCmd_ACT_GEN_GET;
 
+	/* update pmadapter structure with llde packet filter parameters */
+	if ((cfg->sub_id == MLAN_11AXCMD_LLDE_SUBID) &&
+	    (pioctl_req->action == MLAN_ACT_SET)) {
+		mlan_ds_11ax_cmd_cfg_header = sizeof(t_u32 /*sub_command*/) +
+					      sizeof(t_u32 /*sub_id*/);
+		llde_pkt_filter =
+			(mlan_ds_11ax_llde_pkt_filter_cmd
+				 *)((t_u8 *)cfg + mlan_ds_11ax_cmd_cfg_header +
+				    sizeof(mlan_ds_11ax_llde_cmd));
+
+		pmadapter->llde_packet_type = llde_pkt_filter->packet_type;
+		pmadapter->llde_device_filter = llde_pkt_filter->device_filter;
+
+		/* reset old entries */
+		pmadapter->llde_totalMacFilters = 0;
+		// coverity[bad_memset: SUPPRESS]
+		memset(pmadapter, (t_u8 *)&pmadapter->llde_macfilters, 0,
+		       MAX_MAC_FILTER_ENTRIES * MLAN_MAC_ADDR_LENGTH);
+
+		/* copy valid mac adresses only */
+		if (memcmp(pmadapter, &llde_pkt_filter->macfilter1,
+			   &null_mac_addr, MLAN_MAC_ADDR_LENGTH) != 0) {
+			pmadapter->llde_totalMacFilters++;
+			memcpy_ext(pmadapter,
+				   &pmadapter->llde_macfilters
+					    [0 * MLAN_MAC_ADDR_LENGTH],
+				   &llde_pkt_filter->macfilter1,
+				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+
+			if (memcmp(pmadapter, &llde_pkt_filter->macfilter2,
+				   &null_mac_addr, MLAN_MAC_ADDR_LENGTH) != 0) {
+				pmadapter->llde_totalMacFilters++;
+				memcpy_ext(pmadapter,
+					   &pmadapter->llde_macfilters
+						    [1 * MLAN_MAC_ADDR_LENGTH],
+					   &llde_pkt_filter->macfilter2,
+					   MLAN_MAC_ADDR_LENGTH,
+					   MLAN_MAC_ADDR_LENGTH);
+			}
+		} else if (memcmp(pmadapter, &llde_pkt_filter->macfilter2,
+				  &null_mac_addr, MLAN_MAC_ADDR_LENGTH) != 0) {
+			pmadapter->llde_totalMacFilters++;
+			memcpy_ext(pmadapter,
+				   &pmadapter->llde_macfilters
+					    [0 * MLAN_MAC_ADDR_LENGTH],
+				   &llde_pkt_filter->macfilter2,
+				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		}
+
+		/* remove llde packet filter parameters from buffer which will
+		 * be passed to fimrware */
+		/* pass mlan_ds_11ax_llde_cmd params only to fw */
+		// coverity[bad_memset: SUPPRESS]
+		memset(pmadapter,
+		       (t_u8 *)cfg + mlan_ds_11ax_cmd_cfg_header +
+			       sizeof(mlan_ds_11ax_llde_cmd),
+		       0, sizeof(mlan_ds_11ax_llde_pkt_filter_cmd));
+	}
 	/* Send request to firmware */
 	status = wlan_prepare_cmd(pmpriv, HostCmd_CMD_11AX_CMD, cmd_action, 0,
 				  (t_void *)pioctl_req, (t_void *)cfg);
@@ -924,6 +1003,14 @@
 		(mlan_ds_11ax_txomi_cmd *)&ds_11ax_cmd->param;
 	mlan_ds_11ax_toltime_cmd *toltime_cmd =
 		(mlan_ds_11ax_toltime_cmd *)&ds_11ax_cmd->param;
+	mlan_ds_11ax_set_bsrp_cmd *set_bsrp_cmd =
+		(mlan_ds_11ax_set_bsrp_cmd *)&ds_11ax_cmd->param;
+	mlan_ds_11ax_llde_cmd *llde_cmd =
+		(mlan_ds_11ax_llde_cmd *)&ds_11ax_cmd->param;
+	mlan_ds_11ax_rutxpwr_cmd *rutxpwr_cmd =
+		(mlan_ds_11ax_rutxpwr_cmd *)&ds_11ax_cmd->param;
+	mlan_ds_11ax_HeSuER_cmd *HeSuER_cmd =
+		(mlan_ds_11ax_HeSuER_cmd *)&ds_11ax_cmd->param;
 	MrvlIEtypes_Data_t *tlv = MNULL;
 
 	ENTER();
@@ -966,6 +1053,26 @@
 			   sizeof(t_u32), sizeof(t_u32));
 		cmd->size += sizeof(t_u32);
 		break;
+	case MLAN_11AXCMD_SET_BSRP_SUBID:
+		axcmd->val[0] = set_bsrp_cmd->value;
+		cmd->size += sizeof(t_u8);
+		break;
+	case MLAN_11AXCMD_LLDE_SUBID:
+		memcpy_ext(pmadapter, axcmd->val, &llde_cmd->llde,
+			   sizeof(mlan_ds_11ax_llde_cmd),
+			   sizeof(mlan_ds_11ax_llde_cmd));
+		cmd->size += sizeof(mlan_ds_11ax_llde_cmd);
+		break;
+	case MLAN_11AXCMD_RUTXSUBPWR_SUBID:
+		memcpy_ext(pmadapter, axcmd->val, &rutxpwr_cmd->subBand,
+			   sizeof(t_u8), sizeof(t_u8));
+		cmd->size += sizeof(t_u8);
+		break;
+	case MLAN_11AXCMD_HESUER_SUBID:
+		axcmd->val[0] = HeSuER_cmd->value;
+		cmd->size += sizeof(t_u8);
+		break;
+
 	default:
 		PRINTM(MERROR, "Unknown subcmd %x\n", ds_11ax_cmd->sub_id);
 		break;
@@ -1042,6 +1149,25 @@
 		memcpy_ext(pmadapter, &cfg->param.toltime_cfg.tol_time,
 			   axcmd->val, sizeof(t_u32), sizeof(t_u32));
 		break;
+	case MLAN_11AXCMD_SET_BSRP_SUBID:
+		cfg->param.setbsrp_cfg.value = *axcmd->val;
+		break;
+	case MLAN_11AXCMD_LLDE_SUBID:
+		memcpy_ext(pmadapter, &cfg->param.llde_cfg.llde, axcmd->val,
+			   sizeof(mlan_ds_11ax_llde_cmd),
+			   sizeof(mlan_ds_11ax_llde_cmd));
+		pmadapter->llde_enabled = cfg->param.llde_cfg.llde;
+		pmadapter->llde_mode = cfg->param.llde_cfg.mode;
+		break;
+	case MLAN_11AXCMD_RUTXSUBPWR_SUBID:
+		memcpy_ext(pmadapter, &cfg->param.rutxpwr_cfg, axcmd->val,
+			   sizeof(mlan_ds_11ax_rutxpwr_cmd),
+			   sizeof(mlan_ds_11ax_rutxpwr_cmd));
+		break;
+	case MLAN_11AXCMD_HESUER_SUBID:
+		cfg->param.HeSuER_cfg.value = *axcmd->val;
+		break;
+
 	default:
 		PRINTM(MERROR, "Unknown subcmd %x\n", axcmd->sub_id);
 		break;
@@ -1071,6 +1197,9 @@
 	mlan_ds_twtcfg *ds_twtcfg = (mlan_ds_twtcfg *)pdata_buf;
 	hostcmd_twt_setup *twt_setup_params = MNULL;
 	hostcmd_twt_teardown *twt_teardown_params = MNULL;
+	hostcmd_twt_report *twt_report_params = MNULL;
+	hostcmd_twt_information *twt_information_params = MNULL;
+	hostcmd_btwt_ap_config *btwt_ap_config_params = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -1109,6 +1238,9 @@
 			ds_twtcfg->param.twt_setup.twt_mantissa);
 		twt_setup_params->twt_request =
 			ds_twtcfg->param.twt_setup.twt_request;
+		twt_setup_params->bcnMiss_threshold = wlan_cpu_to_le16(
+			ds_twtcfg->param.twt_setup.bcnMiss_threshold);
+
 		cmd->size += sizeof(hostcmd_twtcfg->param.twt_setup);
 		break;
 	case MLAN_11AX_TWT_TEARDOWN_SUBID:
@@ -1123,6 +1255,94 @@
 			ds_twtcfg->param.twt_teardown.teardown_all_twt;
 		cmd->size += sizeof(hostcmd_twtcfg->param.twt_teardown);
 		break;
+	case MLAN_11AX_TWT_REPORT_SUBID:
+		twt_report_params = &hostcmd_twtcfg->param.twt_report;
+		memset(pmpriv->adapter, twt_report_params, 0x00,
+		       sizeof(hostcmd_twtcfg->param.twt_report));
+		twt_report_params->type = ds_twtcfg->param.twt_report.type;
+		cmd->size += sizeof(hostcmd_twtcfg->param.twt_report);
+		break;
+	case MLAN_11AX_TWT_INFORMATION_SUBID:
+		twt_information_params = &hostcmd_twtcfg->param.twt_information;
+		// coverity[bad_memset: SUPPRESS]
+		memset(pmadapter, twt_information_params, 0x00,
+		       sizeof(hostcmd_twtcfg->param.twt_information));
+		twt_information_params->flow_identifier =
+			ds_twtcfg->param.twt_information.flow_identifier;
+		twt_information_params->suspend_duration = wlan_cpu_to_le32(
+			ds_twtcfg->param.twt_information.suspend_duration);
+		cmd->size += sizeof(hostcmd_twtcfg->param.twt_information);
+		break;
+	case MLAN_11AX_BTWT_AP_CONFIG_SUBID:
+		btwt_ap_config_params = &hostcmd_twtcfg->param.btwt_ap_config;
+		// coverity[bad_memset: SUPPRESS]
+		memset(pmadapter, btwt_ap_config_params, 0x00,
+		       sizeof(hostcmd_twtcfg->param.btwt_ap_config));
+		btwt_ap_config_params->ap_bcast_bet_sta_wait =
+			ds_twtcfg->param.btwt_ap_config.ap_bcast_bet_sta_wait;
+		btwt_ap_config_params->Ap_Bcast_Offset = wlan_cpu_to_le16(
+			ds_twtcfg->param.btwt_ap_config.Ap_Bcast_Offset);
+		btwt_ap_config_params->bcastTWTLI =
+			ds_twtcfg->param.btwt_ap_config.bcastTWTLI;
+		btwt_ap_config_params->count =
+			ds_twtcfg->param.btwt_ap_config.count;
+		btwt_ap_config_params->BTWT_sets[0].btwtId =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[0].btwtId;
+		btwt_ap_config_params->BTWT_sets[0].Ap_Bcast_Mantissa =
+			wlan_cpu_to_le16(
+				ds_twtcfg->param.btwt_ap_config.BTWT_sets[0]
+					.Ap_Bcast_Mantissa);
+		btwt_ap_config_params->BTWT_sets[0].Ap_Bcast_Exponent =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[0]
+				.Ap_Bcast_Exponent;
+		btwt_ap_config_params->BTWT_sets[0].nominalwake =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[0].nominalwake;
+		btwt_ap_config_params->BTWT_sets[1].btwtId =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[1].btwtId;
+		btwt_ap_config_params->BTWT_sets[1].Ap_Bcast_Mantissa =
+			wlan_cpu_to_le16(
+				ds_twtcfg->param.btwt_ap_config.BTWT_sets[1]
+					.Ap_Bcast_Mantissa);
+		btwt_ap_config_params->BTWT_sets[1].Ap_Bcast_Exponent =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[1]
+				.Ap_Bcast_Exponent;
+		btwt_ap_config_params->BTWT_sets[1].nominalwake =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[1].nominalwake;
+		btwt_ap_config_params->BTWT_sets[2].btwtId =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[2].btwtId;
+		btwt_ap_config_params->BTWT_sets[2].Ap_Bcast_Mantissa =
+			wlan_cpu_to_le16(
+				ds_twtcfg->param.btwt_ap_config.BTWT_sets[2]
+					.Ap_Bcast_Mantissa);
+		btwt_ap_config_params->BTWT_sets[2].Ap_Bcast_Exponent =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[2]
+				.Ap_Bcast_Exponent;
+		btwt_ap_config_params->BTWT_sets[2].nominalwake =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[2].nominalwake;
+		btwt_ap_config_params->BTWT_sets[3].btwtId =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[3].btwtId;
+		btwt_ap_config_params->BTWT_sets[3].Ap_Bcast_Mantissa =
+			wlan_cpu_to_le16(
+				ds_twtcfg->param.btwt_ap_config.BTWT_sets[3]
+					.Ap_Bcast_Mantissa);
+		btwt_ap_config_params->BTWT_sets[3].Ap_Bcast_Exponent =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[3]
+				.Ap_Bcast_Exponent;
+		btwt_ap_config_params->BTWT_sets[3].nominalwake =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[3].nominalwake;
+		btwt_ap_config_params->BTWT_sets[4].btwtId =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[4].btwtId;
+		btwt_ap_config_params->BTWT_sets[4].Ap_Bcast_Mantissa =
+			wlan_cpu_to_le16(
+				ds_twtcfg->param.btwt_ap_config.BTWT_sets[4]
+					.Ap_Bcast_Mantissa);
+		btwt_ap_config_params->BTWT_sets[4].Ap_Bcast_Exponent =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[4]
+				.Ap_Bcast_Exponent;
+		btwt_ap_config_params->BTWT_sets[4].nominalwake =
+			ds_twtcfg->param.btwt_ap_config.BTWT_sets[4].nominalwake;
+		cmd->size += sizeof(hostcmd_twtcfg->param.btwt_ap_config);
+		break;
 	default:
 		PRINTM(MERROR, "Unknown subcmd %x\n", ds_twtcfg->sub_id);
 		ret = MLAN_STATUS_FAILURE;
diff --git a/wlan_sd8987/mlan/mlan_11ax.h b/wlan_src/mlan/mlan_11ax.h
old mode 100755
new mode 100644
similarity index 63%
rename from wlan_sd8987/mlan/mlan_11ax.h
rename to wlan_src/mlan/mlan_11ax.h
index 3125551..6b6d502
--- a/wlan_sd8987/mlan/mlan_11ax.h
+++ b/wlan_src/mlan/mlan_11ax.h
@@ -1,22 +1,33 @@
 /** @file mlan_11ax.h
  *
- *  @brief This file contains the functions for station ioctl.
+ *  @brief This file defines the private and adapter data
+ *  structures and declares global function prototypes used
+ *  in MLAN module.
  *
  *
  *  Copyright 2018-2022 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
diff --git a/wlan_sd8987/mlan/mlan_11d.c b/wlan_src/mlan/mlan_11d.c
old mode 100755
new mode 100644
similarity index 94%
rename from wlan_sd8987/mlan/mlan_11d.c
rename to wlan_src/mlan/mlan_11d.c
index 947d146..5056df1
--- a/wlan_sd8987/mlan/mlan_11d.c
+++ b/wlan_src/mlan/mlan_11d.c
@@ -3,20 +3,29 @@
  *  @brief This file contains functions for 802.11D.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2022, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 /********************************************************
@@ -36,16 +45,8 @@
 ********************************************************/
 
 #ifdef STA_SUPPORT
-/** Region code mapping */
-typedef struct _region_code_mapping {
-	/** Region */
-	t_u8 region[COUNTRY_CODE_LEN];
-	/** Code */
-	t_u8 code;
-} region_code_mapping_t;
-
 /** Region code mapping table */
-static region_code_mapping_t region_code_mapping[] = {
+region_code_mapping_t region_code_mapping[] = {
 	{"US ", 0x10}, /* US FCC      */
 	{"CA ", 0x20}, /* IC Canada   */
 	{"SG ", 0x10}, /* Singapore   */
@@ -115,6 +116,7 @@
 	{132, 5660, TX_PWR_DEFAULT, MTRUE, {0x13, 0, 0}},
 	{136, 5680, TX_PWR_DEFAULT, MTRUE, {0x13, 0, 0}},
 	{140, 5700, TX_PWR_DEFAULT, MTRUE, {0x13, 0, 0}},
+	{144, 5720, TX_PWR_DEFAULT, MTRUE, {0x13, 0, 0}},
 	{149, 5745, TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{153, 5765, TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{157, 5785, TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
@@ -145,7 +147,7 @@
  *
  *  @return             Region string
  */
-static t_u8 *wlan_11d_code_2_region(pmlan_adapter pmadapter, t_u8 code)
+t_u8 *wlan_11d_code_2_region(pmlan_adapter pmadapter, t_u8 code)
 {
 	t_u8 i;
 
@@ -638,16 +640,24 @@
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
 static mlan_status wlan_11d_send_domain_info(mlan_private *pmpriv,
-					     t_void *pioctl_buf)
+					     t_void *pioctl_buf,
+					     t_bool is_op_special_set)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
 
 	/* Send cmd to FW to set domain info */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11D_DOMAIN_INFO,
-			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_buf,
-			       MNULL);
+	if (is_op_special_set) {
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11D_DOMAIN_INFO,
+				       HostCmd_ACT_SPC_SET, 0,
+				       (t_void *)pioctl_buf, MNULL);
+	} else {
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11D_DOMAIN_INFO,
+				       HostCmd_ACT_GEN_SET, 0,
+				       (t_void *)pioctl_buf, MNULL);
+	}
+
 	if (ret)
 		PRINTM(MERROR, "11D: Failed to download domain Info\n");
 
@@ -853,6 +863,8 @@
 	MrvlIEtypes_DomainParamSet_t *domain = &pdomain_info->domain;
 	t_u8 no_of_sub_band = pmadapter->domain_reg.no_of_sub_band;
 	MrvlIEtypes_Rgn_dom_code_t *rgn = MNULL;
+	t_u8 *tlv = MNULL;
+
 	t_u8 i;
 
 	ENTER();
@@ -881,7 +893,10 @@
 		return MLAN_STATUS_SUCCESS;
 	}
 
+	tlv = (t_u8 *)&pdomain_info->domain;
+
 	/* Set domain info fields */
+	domain = (MrvlIEtypes_DomainParamSet_t *)tlv;
 	domain->header.type = wlan_cpu_to_le16(TLV_TYPE_DOMAIN);
 	memcpy_ext(pmadapter, domain->country_code,
 		   pmadapter->domain_reg.country_code,
@@ -898,20 +913,22 @@
 			   MRVDRV_MAX_SUBBAND_802_11D *
 				   sizeof(IEEEtypes_SubbandSet_t));
 
-		pcmd->size = sizeof(pdomain_info->action) + domain->header.len +
-			     sizeof(MrvlIEtypesHeader_t) + S_DS_GEN;
+		pcmd->size += sizeof(pdomain_info->action) +
+			      domain->header.len + sizeof(MrvlIEtypesHeader_t) +
+			      S_DS_GEN;
+
+		tlv += domain->header.len + sizeof(MrvlIEtypesHeader_t);
 
 		if (pmadapter->domain_reg.dfs_region != NXP_DFS_UNKNOWN) {
-			rgn = (MrvlIEtypes_Rgn_dom_code_t
-				       *)((t_u8 *)&pdomain_info->domain +
-					  domain->header.len +
-					  sizeof(MrvlIEtypesHeader_t));
+			rgn = (MrvlIEtypes_Rgn_dom_code_t *)tlv;
 			rgn->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_REGION_DOMAIN_CODE);
 			rgn->header.len = 2;
 			rgn->domain_code = pmadapter->domain_reg.dfs_region;
 			pcmd->size += sizeof(MrvlIEtypes_Rgn_dom_code_t);
+			tlv += sizeof(MrvlIEtypes_Rgn_dom_code_t);
 		}
+
 	} else {
 		pcmd->size = sizeof(pdomain_info->action) + S_DS_GEN;
 	}
@@ -966,6 +983,8 @@
 		break;
 	case HostCmd_ACT_GEN_GET:
 		break;
+	case HostCmd_ACT_SPC_SET:
+		break;
 	default:
 		PRINTM(MERROR, "11D: Invalid Action:%d\n", domain_info->action);
 		ret = MLAN_STATUS_FAILURE;
@@ -1317,7 +1336,7 @@
 		wlan_11d_generate_domain_info(pmadapter, &parsed_region_chan);
 
 		/* Set domain info */
-		ret = wlan_11d_send_domain_info(pmpriv, MNULL);
+		ret = wlan_11d_send_domain_info(pmpriv, MNULL, MTRUE);
 		if (ret) {
 			PRINTM(MERROR,
 			       "11D: Error sending domain info to FW\n");
@@ -1412,7 +1431,7 @@
 		wlan_11d_generate_domain_info(pmadapter, &region_chan);
 
 		/* Set domain info */
-		ret = wlan_11d_send_domain_info(pmpriv, MNULL);
+		ret = wlan_11d_send_domain_info(pmpriv, MNULL, MTRUE);
 		if (ret) {
 			PRINTM(MERROR,
 			       "11D: Error sending domain info to FW\n");
@@ -1540,7 +1559,7 @@
 		domain_info->no_of_sub_band,
 		(IEEEtypes_SubbandSet_t *)domain_info->sub_band,
 		domain_info->dfs_region);
-	ret = wlan_11d_send_domain_info(pmpriv, pioctl_req);
+	ret = wlan_11d_send_domain_info(pmpriv, pioctl_req, MFALSE);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -1562,8 +1581,7 @@
 	else
 		pmadapter->region_code = 0;
 	if (wlan_set_regiontable(pmpriv, pmadapter->region_code,
-				 pmadapter->config_bands |
-					 pmadapter->adhoc_start_band)) {
+				 pmadapter->config_bands)) {
 		PRINTM(MIOCTL, "Fail to set regiontabl\n");
 		goto done;
 	}
@@ -1618,8 +1636,7 @@
 		else
 			pmadapter->region_code = 0;
 		if (wlan_set_regiontable(pmpriv, pmadapter->region_code,
-					 pmadapter->config_bands |
-						 pmadapter->adhoc_start_band)) {
+					 pmadapter->config_bands)) {
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
@@ -1646,7 +1663,7 @@
 					 num_sub_band, pdomain_tlv->sub_band,
 					 NXP_DFS_UNKNOWN);
 
-	ret = wlan_11d_send_domain_info(pmpriv, pioctl_buf);
+	ret = wlan_11d_send_domain_info(pmpriv, pioctl_buf, MFALSE);
 
 done:
 	LEAVE();
diff --git a/wlan_sd8987/mlan/mlan_11h.c b/wlan_src/mlan/mlan_11h.c
old mode 100755
new mode 100644
similarity index 87%
rename from wlan_sd8987/mlan/mlan_11h.c
rename to wlan_src/mlan/mlan_11h.c
index ce3b024..da86c25
--- a/wlan_sd8987/mlan/mlan_11h.c
+++ b/wlan_src/mlan/mlan_11h.c
@@ -3,20 +3,29 @@
  *  @brief This file contains functions for 802.11H.
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -157,50 +166,6 @@
 }
 
 /**
- *  @brief Convert an IEEE formatted IE to 16-bit ID/Len NXP
- *         proprietary format
- *
- *  @param pmadapter Pointer to mlan_adapter
- *  @param pout_buf Output parameter: Buffer to output NXP formatted IE
- *  @param pin_ie   Pointer to IEEE IE to be converted to NXP format
- *
- *  @return         Number of bytes output to pout_buf parameter return
- */
-static t_u32 wlan_11h_convert_ieee_to_mrvl_ie(mlan_adapter *pmadapter,
-					      t_u8 *pout_buf,
-					      const t_u8 *pin_ie)
-{
-	MrvlIEtypesHeader_t mrvl_ie_hdr;
-	t_u8 *ptmp_buf = pout_buf;
-
-	ENTER();
-	/* Assign the Element Id and Len to the NXP struct attributes */
-	mrvl_ie_hdr.type = wlan_cpu_to_le16(pin_ie[0]);
-	mrvl_ie_hdr.len = wlan_cpu_to_le16(pin_ie[1]);
-
-	/* If the element ID is zero, return without doing any copying */
-	if (!mrvl_ie_hdr.type) {
-		LEAVE();
-		return 0;
-	}
-
-	/* Copy the header to the buffer pointer */
-	memcpy_ext(pmadapter, ptmp_buf, &mrvl_ie_hdr, sizeof(mrvl_ie_hdr),
-		   sizeof(mrvl_ie_hdr));
-
-	/* Increment the temp buffer pointer by the size appended */
-	ptmp_buf += sizeof(mrvl_ie_hdr);
-
-	/* Append the data section of the IE; length given by the IEEE IE length
-	 */
-	memcpy_ext(pmadapter, ptmp_buf, pin_ie + 2, pin_ie[1], pin_ie[1]);
-
-	LEAVE();
-	/* Return the number of bytes appended to pout_buf */
-	return sizeof(mrvl_ie_hdr) + pin_ie[1];
-}
-
-/**
  *  @brief find all bonded channel.
  *
  *  @param pri_chan   primary channel
@@ -275,98 +240,41 @@
  *
  *  @return  N/A
  */
-t_void wlan_11h_set_chan_dfs_state(mlan_private *priv, t_u8 chan, t_u8 bw,
-				   dfs_state_t dfs_state)
+static t_void wlan_11h_set_chan_dfs_state(mlan_private *priv, t_u8 chan,
+					  t_u8 bw, dfs_state_t dfs_state)
 {
 	t_u8 n_chan;
-	t_u8 chan_list[4];
+	t_u8 chan_list[4] = {0};
 	t_u8 i;
 	n_chan = woal_get_bonded_channels(chan, bw, chan_list);
 	for (i = 0; i < n_chan; i++)
 		wlan_set_chan_dfs_state(priv, BAND_A, chan_list[i], dfs_state);
 }
 
-#ifdef STA_SUPPORT
 /**
- *  @brief Setup the IBSS DFS element passed to the firmware in adhoc start
- *         and join commands
+ *  @brief reset dfs_checking_chan's dfs state
  *
- *  The DFS Owner and recovery fields are set to be our MAC address and
- *    a predetermined constant recovery value.  If we are joining an adhoc
- *    network, these values are replaced with the existing IBSS values.
- *    They are valid only when starting a new IBSS.
+ *  @param priv         Private driver information structure
+ *  @param dfs_state    dfs state
  *
- *  The IBSS DFS Element is variable in size based on the number of
- *    channels supported in our current region.
- *
- *  @param priv Private driver information structure
- *  @param pdfs Output parameter: Pointer to the IBSS DFS element setup by
- *              this function.
- *
- *  @return
- *    - Length of the returned element in pdfs output parameter
- *    - 0 if returned element is not setup
+ *  @return  N/A
  */
-static t_u32 wlan_11h_set_ibss_dfs_ie(mlan_private *priv,
-				      IEEEtypes_IBSS_DFS_t *pdfs)
+t_void wlan_11h_reset_dfs_checking_chan_dfs_state(mlan_private *priv,
+						  dfs_state_t dfs_state)
 {
-	t_u8 num_chans = 0;
-	MeasRptBasicMap_t initial_map;
-	mlan_adapter *adapter = priv->adapter;
-
+	wlan_dfs_device_state_t *pstate_dfs = &priv->adapter->state_dfs;
+	dfs_state_t state;
 	ENTER();
-
-	memset(adapter, pdfs, 0x00, sizeof(IEEEtypes_IBSS_DFS_t));
-
-	/*
-	 * A basic measurement report is included with each channel in the
-	 *   map field.  Initial value for the map for each supported channel
-	 *   is with only the unmeasured bit set.
-	 */
-	memset(adapter, &initial_map, 0x00, sizeof(initial_map));
-	initial_map.unmeasured = 1;
-
-	/* Set the DFS Owner and recovery interval fields */
-	memcpy_ext(adapter, pdfs->dfs_owner, priv->curr_addr,
-		   sizeof(pdfs->dfs_owner), sizeof(pdfs->dfs_owner));
-	pdfs->dfs_recovery_interval = WLAN_11H_DEFAULT_DFS_RECOVERY_INTERVAL;
-
-	for (; (num_chans < adapter->parsed_region_chan.no_of_chan) &&
-	       (num_chans < WLAN_11H_MAX_IBSS_DFS_CHANNELS);
-	     num_chans++) {
-		pdfs->channel_map[num_chans].channel_number =
-			adapter->parsed_region_chan.chan_pwr[num_chans].chan;
-
-		/*
-		 * Set the initial map field with a basic measurement
-		 */
-		pdfs->channel_map[num_chans].rpt_map = initial_map;
+	if (pstate_dfs->dfs_check_channel) {
+		state = wlan_get_chan_dfs_state(priv, BAND_A,
+						pstate_dfs->dfs_check_channel);
+		if (state == DFS_AVAILABLE)
+			wlan_11h_set_chan_dfs_state(
+				priv, pstate_dfs->dfs_check_channel,
+				pstate_dfs->dfs_check_bandwidth, dfs_state);
 	}
-
-	/*
-	 * If we have an established channel map, include it and return
-	 *   a valid DFS element
-	 */
-	if (num_chans) {
-		PRINTM(MINFO, "11h: Added %d channels to IBSS DFS Map\n",
-		       num_chans);
-
-		pdfs->element_id = IBSS_DFS;
-		pdfs->len = (sizeof(pdfs->dfs_owner) +
-			     sizeof(pdfs->dfs_recovery_interval) +
-			     num_chans * sizeof(IEEEtypes_ChannelMap_t));
-
-		LEAVE();
-		return pdfs->len + sizeof(pdfs->len) + sizeof(pdfs->element_id);
-	}
-
-	/* Ensure the element is zeroed out for an invalid return */
-	memset(adapter, pdfs, 0x00, sizeof(IEEEtypes_IBSS_DFS_t));
-
 	LEAVE();
-	return 0;
 }
-#endif
 
 /**
  *  @brief Setup the Supported Channel IE sent in association requests
@@ -914,113 +822,7 @@
 	return ret_len;
 }
 
-/**
- *  @brief Utility function to process a start or join to an adhoc network
- *
- *  Add the elements to the TLV buffer needed in the start/join adhoc commands:
- *       - IBSS DFS IE
- *       - Quiet IE
- *
- *  Also send the local constraint to the firmware in a TPC_INFO command.
- *
- *  @param priv          Private driver information structure
- *  @param ppbuffer      Output parameter: Pointer to the TLV output buffer,
- *                       modified on return to point after the appended 11h TLVs
- *  @param channel       Channel on which we are starting/joining the IBSS
- *  @param p11h_bss_info Pointer to the 11h BSS information for this network
- *                       that was parsed out of the scan response.  NULL
- *                       indicates we are starting the adhoc network
- *
- *  @return              Integer number of bytes appended to the TLV output
- *                       buffer (ppbuffer)
- */
-static t_u32 wlan_11h_process_adhoc(mlan_private *priv, t_u8 **ppbuffer,
-				    t_u32 channel,
-				    wlan_11h_bss_info_t *p11h_bss_info)
-{
-	IEEEtypes_IBSS_DFS_t dfs_elem;
-	t_u32 size_appended;
-	t_u32 ret_len = 0;
-	t_s8 local_constraint = 0;
-	mlan_adapter *adapter = priv->adapter;
-
-	ENTER();
-
-#ifdef STA_SUPPORT
-	/* Format our own IBSS DFS Element.  Include our channel map fields */
-	wlan_11h_set_ibss_dfs_ie(priv, &dfs_elem);
-#endif
-
-	if (p11h_bss_info) {
-		/*
-		 * Copy the DFS Owner/Recovery Interval from the BSS
-		 * we are joining
-		 */
-		memcpy_ext(adapter, dfs_elem.dfs_owner,
-			   p11h_bss_info->ibss_dfs.dfs_owner,
-			   sizeof(dfs_elem.dfs_owner),
-			   sizeof(dfs_elem.dfs_owner));
-		dfs_elem.dfs_recovery_interval =
-			p11h_bss_info->ibss_dfs.dfs_recovery_interval;
-	}
-
-	/* Append the dfs element to the TLV buffer */
-	size_appended = wlan_11h_convert_ieee_to_mrvl_ie(
-		adapter, (t_u8 *)*ppbuffer, (t_u8 *)&dfs_elem);
-
-	HEXDUMP("11h: IBSS-DFS", (t_u8 *)*ppbuffer, size_appended);
-	*ppbuffer += size_appended;
-	ret_len += size_appended;
-
-	/*
-	 * Check to see if we are joining a network.  Join is indicated by the
-	 *   BSS Info pointer being valid (not NULL)
-	 */
-	if (p11h_bss_info) {
-		/*
-		 * If there was a quiet element, include it in
-		 * adhoc join command
-		 */
-		if (p11h_bss_info->quiet.element_id == QUIET) {
-			size_appended = wlan_11h_convert_ieee_to_mrvl_ie(
-				adapter, (t_u8 *)*ppbuffer,
-				(t_u8 *)&p11h_bss_info->quiet);
-			HEXDUMP("11h: Quiet", (t_u8 *)*ppbuffer, size_appended);
-			*ppbuffer += size_appended;
-			ret_len += size_appended;
-		}
-
-		/* Copy the local constraint from the network */
-		local_constraint =
-			p11h_bss_info->power_constraint.local_constraint;
-	} else {
-		/*
-		 * If we are the adhoc starter, we can add a quiet element
-		 */
-		if (adapter->state_11h.quiet_ie.quiet_period) {
-			size_appended = wlan_11h_convert_ieee_to_mrvl_ie(
-				adapter, (t_u8 *)*ppbuffer,
-				(t_u8 *)&adapter->state_11h.quiet_ie);
-			HEXDUMP("11h: Quiet", (t_u8 *)*ppbuffer, size_appended);
-			*ppbuffer += size_appended;
-			ret_len += size_appended;
-		}
-		/* Use the local_constraint configured in the driver state */
-		local_constraint = adapter->state_11h.usr_def_power_constraint;
-	}
-
-	PRINTM(MINFO, "WEILIE 1: ppbuffer = %p\n", *ppbuffer);
-
-	ret_len += wlan_11h_set_local_power_constraint_tlv(
-		ppbuffer, (t_u8)channel, (t_u8)local_constraint,
-		(t_u8)priv->adapter->state_11h.min_tx_power_capability,
-		(t_u8)priv->adapter->state_11h.max_tx_power_capability);
-	PRINTM(MINFO, "WEILIE 2: ppbuffer = %p\n", *ppbuffer);
-
-	LEAVE();
-	return ret_len;
-}
-
+#if defined(UAP_SUPPORT)
 /**
  *  @brief Return whether the driver has enabled 11h for the interface
  *
@@ -1039,6 +841,7 @@
 	LEAVE();
 	return priv->intf_state_11h.is_11h_enabled;
 }
+#endif
 
 /**
  *  @brief Return whether the device has activated slave radar detection.
@@ -1091,7 +894,7 @@
  *    - MTRUE if radar detection is required
  *    - MFALSE otherwise
  */
-t_bool wlan_11h_is_radar_channel(mlan_private *priv, t_u8 channel)
+static t_bool wlan_11h_is_radar_channel(mlan_private *priv, t_u8 channel)
 {
 	t_bool required = MFALSE;
 
@@ -1125,11 +928,6 @@
 	ENTER();
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
 		/* Ad-hoc creator */
-		if (((priv->media_connected == MTRUE) ||
-		     (priv->adhoc_state == ADHOC_STARTING)) &&
-		    (priv->adapter->adhoc_start_band & BAND_A) &&
-		    wlan_11h_radar_detect_required(priv, priv->adhoc_channel))
-			ret = MTRUE;
 	} else if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
 		/* UAP */
 #ifdef UAP_SUPPORT
@@ -1160,13 +958,6 @@
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP)
 		ret = MTRUE;
 
-	/* STA: only ad-hoc creator is master */
-	else if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) &&
-		 (priv->bss_mode == MLAN_BSS_MODE_IBSS) &&
-		 (priv->adhoc_state == ADHOC_STARTED ||
-		  priv->adhoc_state == ADHOC_STARTING))
-		ret = MTRUE;
-
 	/* all other cases = slave interface */
 	LEAVE();
 	return ret;
@@ -1369,14 +1160,12 @@
 					    sizeof(mlan_ioctl_req));
 
 	/* prepare mlan_ioctl_req */
-	memset(pmadapter, pioctl_req, 0x00, sizeof(mlan_ioctl_req));
 	pioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
 	pioctl_req->action = MLAN_ACT_SET;
 	pioctl_req->pbuf = (t_u8 *)pds_misc_cfg;
 	pioctl_req->buf_len = sizeof(mlan_ds_misc_cfg);
 
 	/* prepare mlan_ds_misc_cfg */
-	memset(pmadapter, pds_misc_cfg, 0x00, sizeof(mlan_ds_misc_cfg));
 	pds_misc_cfg->sub_command = MLAN_OID_MISC_CUSTOM_IE;
 	pds_misc_cfg->param.cust_ie.type = TLV_TYPE_MGMT_IE;
 	pds_misc_cfg->param.cust_ie.len = (sizeof(custom_ie) - MAX_IE_SIZE);
@@ -1731,9 +1520,6 @@
 			return MLAN_STATUS_FAILURE;
 		}
 
-		memset(pmadapter, (t_u8 *)pdfs_ts, 0,
-		       sizeof(wlan_dfs_timestamp_t));
-
 		util_enqueue_list_tail(pmadapter->pmoal_handle,
 				       &pmadapter->state_dfs.dfs_ts_head,
 				       (pmlan_linked_list)pdfs_ts, MNULL,
@@ -1772,7 +1558,7 @@
 					   t_u8 channel, t_u8 bandwidth)
 {
 	t_u8 n_chan;
-	t_u8 chan_list[4];
+	t_u8 chan_list[4] = {0};
 	t_u8 i;
 	n_chan = woal_get_bonded_channels(channel, bandwidth, chan_list);
 	for (i = 0; i < n_chan; i++)
@@ -1896,7 +1682,7 @@
  *  @return        MTRUE-dfs_master and dfs_slave interface on same DFS channel
  *
  */
-t_u8 static wlan_11h_check_dfs_channel(mlan_adapter *pmadapter)
+static t_u8 wlan_11h_check_dfs_channel(mlan_adapter *pmadapter)
 {
 	mlan_private *priv_master = MNULL;
 	mlan_private *priv_slave = MNULL;
@@ -1932,7 +1718,7 @@
  *
  *  @return      MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status static wlan_11h_disable_dfs(mlan_private *priv, t_void *pioctl_buf)
+static mlan_status wlan_11h_disable_dfs(mlan_private *priv, t_void *pioctl_buf)
 {
 	t_u32 enable = 0;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -2347,98 +2133,6 @@
 }
 
 /**
- *  @brief Retrieve a randomly selected starting channel if needed for 11h
- *
- *  If 11h is enabled and an A-Band channel start band preference
- *    configured in the driver, the start channel must be random in order
- *    to meet with
- *
- *  @param priv  Private driver information structure
- *
- *  @return      Starting channel
- */
-t_u8 wlan_11h_get_adhoc_start_channel(mlan_private *priv)
-{
-	t_u8 start_chn;
-	mlan_adapter *adapter = priv->adapter;
-	t_u32 region;
-	t_u32 rand_entry;
-	region_chan_t *chn_tbl;
-	t_u8 rand_tries = 0;
-
-	ENTER();
-
-	/*
-	 * Set start_chn to the Default.  Used if 11h is disabled or the band
-	 *   does not require 11h support.
-	 */
-	start_chn = DEFAULT_AD_HOC_CHANNEL;
-
-	/*
-	 * Check that we are looking for a channel in the A Band
-	 */
-	if ((adapter->adhoc_start_band & BAND_A)) {
-		/*
-		 * Set default to the A Band default.
-		 * Used if random selection fails
-		 * or if 11h is not enabled
-		 */
-		start_chn = DEFAULT_AD_HOC_CHANNEL_A;
-
-		/*
-		 * Check that 11h is enabled in the driver
-		 */
-		if (wlan_11h_is_enabled(priv)) {
-			/*
-			 * Search the region_channel tables for a channel table
-			 *   that is marked for the A Band.
-			 */
-			for (region = 0; (region < MAX_REGION_CHANNEL_NUM);
-			     region++) {
-				chn_tbl = &adapter->region_channel[region];
-
-				/* Check if table is valid and marked for A Band
-				 */
-				if (chn_tbl->valid &&
-				    chn_tbl->region == adapter->region_code &&
-				    chn_tbl->band & BAND_A) {
-					/*
-					 * Set the start channel.  Get a random
-					 * number and use it to pick an entry
-					 * in the table between 0 and the number
-					 * of channels in the table (NumCFP).
-					 */
-					do {
-						rand_entry =
-							wlan_11h_get_random_num(
-								adapter) %
-							chn_tbl->num_cfp;
-						start_chn =
-							(t_u8)chn_tbl
-								->pcfp[rand_entry]
-								.channel;
-					} while (
-						(wlan_11h_is_channel_under_nop(
-							 adapter, start_chn) ||
-						 ((adapter->state_rdh.stage ==
-						   RDH_GET_INFO_CHANNEL) &&
-						  wlan_11h_radar_detect_required(
-							  priv, start_chn))) &&
-						(++rand_tries <
-						 MAX_RANDOM_CHANNEL_RETRIES));
-				}
-			}
-		}
-	}
-
-	PRINTM(MINFO, "11h: %s: AdHoc Channel set to %u\n",
-	       wlan_11h_is_enabled(priv) ? "Enabled" : "Disabled", start_chn);
-
-	LEAVE();
-	return start_chn;
-}
-
-/**
  *  @brief Retrieve channel closed for operation by Channel Switch Announcement
  *
  *  After receiving CSA, we must not transmit in any form on the original
@@ -2726,92 +2420,6 @@
 }
 
 /**
- *  @brief Process an TLV buffer for a pending BSS Adhoc start command.
- *
- *  Activate 11h functionality in the firmware if driver has is enabled
- *    for 11h (configured by the application via IOCTL).
- *
- *  @param priv          Private driver information structure
- *  @param ppbuffer      Output parameter: Pointer to the TLV output buffer,
- *                       modified on return to point after the appended 11h TLVs
- *  @param pcap_info     Pointer to the capability info for the BSS to join
- *  @param channel       Channel on which we are starting the IBSS
- *  @param p11h_bss_info Input/Output parameter: Pointer to the 11h BSS
- *                       information for this network that we are establishing.
- *                       11h sensed flag set on output if warranted.
- *
- *  @return
- *      - MLAN_STATUS_SUCCESS if 11h is disabled
- *      - Integer number of bytes appended to the TLV output buffer (ppbuffer)
- *      - < 0 for error (e.g. radar detected on channel)
- */
-t_s32 wlan_11h_process_start(mlan_private *priv, t_u8 **ppbuffer,
-			     IEEEtypes_CapInfo_t *pcap_info, t_u32 channel,
-			     wlan_11h_bss_info_t *p11h_bss_info)
-{
-	mlan_adapter *adapter = priv->adapter;
-	t_s32 ret = MLAN_STATUS_SUCCESS;
-	t_bool is_dfs_chan = MFALSE;
-
-	ENTER();
-	if (wlan_11h_is_enabled(priv) &&
-	    ((adapter->adhoc_start_band & BAND_A))) {
-		if (!wlan_fw_11d_is_enabled(priv)) {
-			/* No use having 11h enabled without 11d enabled */
-			if (wlan_11d_enable(priv, MNULL, ENABLE_11D)) {
-				ret = MLAN_STATUS_FAILURE;
-				LEAVE();
-				return ret;
-			}
-#ifdef STA_SUPPORT
-			wlan_11d_create_dnld_countryinfo(
-				priv, adapter->adhoc_start_band);
-#endif
-		}
-
-		/*
-		 * Activate 11h functions in firmware,
-		 * turns on capability bit
-		 */
-		wlan_11h_activate(priv, MNULL, MTRUE);
-		pcap_info->spectrum_mgmt = MTRUE;
-
-		/* If using a DFS channel, enable radar detection. */
-		is_dfs_chan = wlan_11h_radar_detect_required(priv, channel);
-		if (is_dfs_chan) {
-			if (!wlan_11h_is_master_radar_det_active(priv))
-				wlan_11h_config_master_radar_det(priv, MTRUE);
-		}
-		wlan_11h_check_update_radar_det_state(priv);
-
-		/* Set flag indicating this BSS we are starting is using 11h */
-		p11h_bss_info->sensed_11h = MTRUE;
-
-		if (is_dfs_chan) {
-			/* check if this channel is under NOP */
-			if (wlan_11h_is_channel_under_nop(adapter, channel))
-				ret = MLAN_STATUS_FAILURE;
-			/* check last channel report, if this channel is free of
-			 * radar */
-			if (ret == MLAN_STATUS_SUCCESS)
-				ret = wlan_11h_check_chan_report(priv, channel);
-		}
-		if (ret == MLAN_STATUS_SUCCESS)
-			ret = wlan_11h_process_adhoc(priv, ppbuffer, channel,
-						     MNULL);
-		else
-			ret = MLAN_STATUS_FAILURE;
-	} else {
-		/* Deactivate 11h functions in the firmware */
-		wlan_11h_activate(priv, MNULL, MFALSE);
-		pcap_info->spectrum_mgmt = MFALSE;
-		wlan_11h_check_update_radar_det_state(priv);
-	}
-	LEAVE();
-	return ret;
-}
-
-/**
  *  @brief Process an TLV buffer for a pending BSS Join command for
  *         both adhoc and infra networks
  *
@@ -2891,22 +2499,12 @@
 		}
 		wlan_11h_check_update_radar_det_state(priv);
 
-		if (pcap_info->ibss) {
-			PRINTM(MINFO, "11h: Adhoc join: Sensed\n");
-			ret = wlan_11h_process_adhoc(priv, ppbuffer, channel,
-						     p11h_bss_info);
-		} else {
+		{
 			PRINTM(MINFO, "11h: Infra join: Sensed\n");
 			ret = wlan_11h_process_infra_join(
 				priv, ppbuffer, band, channel, p11h_bss_info);
 		}
 	} else {
-		if (pcap_info->ibss) {
-			/* Deactivate 11h functions in the firmware */
-			wlan_11h_activate(priv, MNULL, MFALSE);
-			pcap_info->spectrum_mgmt = MFALSE;
-			wlan_11h_check_update_radar_det_state(priv);
-		}
 	}
 
 	LEAVE();
@@ -3121,17 +2719,6 @@
 					  sizeof(IEEEtypes_Header_t)));
 		break;
 
-	case IBSS_DFS:
-		PRINTM(MINFO, "11h: Ibss Dfs IE Found\n");
-		p11h_bss_info->sensed_11h = MTRUE;
-		memcpy_ext(pmadapter, &p11h_bss_info->ibss_dfs, pelement,
-			   element_len + sizeof(IEEEtypes_Header_t),
-			   sizeof(IEEEtypes_IBSS_DFS_t));
-		p11h_bss_info->ibss_dfs.len =
-			MIN(element_len, (sizeof(IEEEtypes_IBSS_DFS_t) -
-					  sizeof(IEEEtypes_Header_t)));
-		break;
-
 	case SUPPORTED_CHANNELS:
 	case TPC_REQUEST:
 		/*
@@ -3421,7 +3008,10 @@
 				if (ch_nop_info->chan_width == CHAN_BW_80MHZ)
 					ch_nop_info->new_chan.center_chan =
 						wlan_get_center_freq_idx(
-							pmpriv, BAND_AAC,
+							pmpriv,
+							ch_nop_info->new_chan
+								.bandcfg
+								.chanBand,
 							ch_nop_info->new_chan
 								.channel,
 							ch_nop_info->chan_width);
@@ -3506,6 +3096,21 @@
 					priv, BAND_A,
 					ds_11hcfg->param.ch_dfs_state.channel);
 		} else {
+			if (ds_11hcfg->param.ch_dfs_state.dfs_state ==
+			    DFS_UNAVAILABLE) {
+				wlan_11h_add_dfs_timestamp(
+					pmadapter, DFS_TS_REPR_NOP_START,
+					ds_11hcfg->param.ch_dfs_state.channel);
+			} else if (ds_11hcfg->param.ch_dfs_state.dfs_state ==
+				   DFS_AVAILABLE) {
+				if (MFALSE ==
+				    wlan_11h_is_channel_under_nop(
+					    pmadapter,
+					    ds_11hcfg->param.ch_dfs_state
+						    .channel))
+					PRINTM(MINFO,
+					       "Channel is not in NOP\n");
+			}
 			wlan_set_chan_dfs_state(
 				priv, BAND_A,
 				ds_11hcfg->param.ch_dfs_state.channel,
@@ -3550,6 +3155,7 @@
 	LEAVE();
 	return ret;
 }
+
 /**
  *  @brief Check if channel is under NOP (Non-Occupancy Period)
  *  If so, the channel should not be used until the period expires.
@@ -3815,7 +3421,8 @@
 		if (wlan_11h_radar_detect_required(pmpriv,
 						   pmadapter->dfsr_channel)) {
 			mlan_status ret = MLAN_STATUS_SUCCESS;
-			ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_BSS_STOP,
+			ret = wlan_prepare_cmd(pmpriv,
+					       HostCmd_CMD_APCMD_BSS_STOP,
 					       HostCmd_ACT_GEN_SET, 0, MNULL,
 					       MNULL);
 			if (ret) {
@@ -3864,7 +3471,8 @@
 				    pmpriv, pmadapter->dfsr_channel))
 				return;
 
-			ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_BSS_STOP,
+			ret = wlan_prepare_cmd(pmpriv,
+					       HostCmd_CMD_APCMD_BSS_STOP,
 					       HostCmd_ACT_GEN_SET, 0, MNULL,
 					       MNULL);
 			if (ret) {
@@ -3878,7 +3486,8 @@
 		pmpriv = priv_list[i];
 
 		if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_UAP) {
-			ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_BSS_START,
+			ret = wlan_prepare_cmd(pmpriv,
+					       HostCmd_CMD_APCMD_BSS_START,
 					       HostCmd_ACT_GEN_SET, 0, MNULL,
 					       MNULL);
 			if (ret) {
@@ -4163,22 +3772,19 @@
 					pmpriv->uap_state_chan_cb.bandcfg);
 		else
 #endif
-			pstate_rdh->new_channel =
-				wlan_11h_get_adhoc_start_channel(pmpriv);
 
-		if (!pstate_rdh->new_channel ||
-		    (pstate_rdh->new_channel ==
-		     pstate_rdh->curr_channel)) { /* report error */
+			if (!pstate_rdh->new_channel ||
+			    (pstate_rdh->new_channel ==
+			     pstate_rdh->curr_channel)) { /* report error */
 			PRINTM(MERROR,
 			       "%s():  ERROR - Failed to choose new_chan"
 			       " (!= curr_chan) !!\n",
 			       __func__);
 #ifdef UAP_SUPPORT
 			if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_UAP) {
-				ret = wlan_prepare_cmd(pmpriv,
-						       HOST_CMD_APCMD_BSS_STOP,
-						       HostCmd_ACT_GEN_SET, 0,
-						       MNULL, MNULL);
+				ret = wlan_prepare_cmd(
+					pmpriv, HostCmd_CMD_APCMD_BSS_STOP,
+					HostCmd_ACT_GEN_SET, 0, MNULL, MNULL);
 				PRINTM(MERROR,
 				       "STOP UAP and exit radar handling...\n");
 				pstate_rdh->stage = RDH_OFF;
@@ -4253,9 +3859,7 @@
 				t_u16 bcn_dtim_msec;
 
 				/* adhoc creator */
-				if (wlan_11h_is_dfs_master(pmpriv)) {
-					bcn_pd_msec = pmpriv->beacon_period;
-				} else {
+				{
 					bcn_pd_msec = pmpriv->curr_bss_params
 							      .bss_descriptor
 							      .beacon_period;
@@ -4411,21 +4015,14 @@
 				pstate_rdh->priv_list[pstate_rdh->priv_curr_idx];
 #ifdef UAP_SUPPORT
 			if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_UAP) {
-				ret = wlan_prepare_cmd(pmpriv,
-						       HOST_CMD_APCMD_BSS_STOP,
-						       HostCmd_ACT_GEN_SET, 0,
-						       MNULL, MNULL);
+				ret = wlan_prepare_cmd(
+					pmpriv, HostCmd_CMD_APCMD_BSS_STOP,
+					HostCmd_ACT_GEN_SET, 0, MNULL, MNULL);
 				break; /* leads to exit case */
 			}
 #endif
 #ifdef STA_SUPPORT
 			if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_STA) {
-				if (wlan_11h_is_dfs_master(pmpriv)) {
-					/* Save ad-hoc creator state before stop
-					 * clears it */
-					pmpriv->adhoc_state_prev =
-						pmpriv->adhoc_state;
-				}
 				if (pmpriv->media_connected == MTRUE) {
 					wlan_disconnect(pmpriv, MNULL, MNULL);
 					break; /* leads to exit case */
@@ -4520,64 +4117,13 @@
 					ret = wlan_11h_check_update_radar_det_state(
 						pmpriv);
 				}
-				ret = wlan_prepare_cmd(pmpriv,
-						       HOST_CMD_APCMD_BSS_START,
-						       HostCmd_ACT_GEN_SET, 0,
-						       MNULL, MNULL);
+				ret = wlan_prepare_cmd(
+					pmpriv, HostCmd_CMD_APCMD_BSS_START,
+					HostCmd_ACT_GEN_SET, 0, MNULL, MNULL);
 				break; /* leads to exit case */
 			}
 #endif
 #ifdef STA_SUPPORT
-			if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_STA) {
-				/* Check previous state to find former
-				 * Ad-hoc creator interface. Set new
-				 * state to Starting, so it'll be seen
-				 * as a DFS master. */
-				if (pmpriv->adhoc_state_prev == ADHOC_STARTED) {
-					pmpriv->adhoc_state = ADHOC_STARTING;
-					pmpriv->adhoc_state_prev = ADHOC_IDLE;
-				}
-				if (wlan_11h_is_dfs_master(pmpriv)) {
-					/* set new adhoc channel here */
-					pmpriv->adhoc_channel =
-						pstate_rdh->new_channel;
-					if (wlan_11h_radar_detect_required(
-						    pmpriv,
-						    pstate_rdh->new_channel)) {
-						/* Radar detection is required
-						   for this channel, make sure
-						   11h is activated in the
-						   firmware */
-						ret = wlan_11h_activate(
-							pmpriv, MNULL, MTRUE);
-						if (ret)
-							break;
-						ret = wlan_11h_config_master_radar_det(
-							pmpriv, MTRUE);
-						if (ret)
-							break;
-						ret = wlan_11h_check_update_radar_det_state(
-							pmpriv);
-						if (ret)
-							break;
-					}
-					ret = wlan_prepare_cmd(
-						pmpriv,
-						HostCmd_CMD_802_11_AD_HOC_START,
-						HostCmd_ACT_GEN_SET, 0, MNULL,
-						&pmpriv->adhoc_last_start_ssid);
-					break; /* leads to exit case */
-				}
-
-				/* NOTE:  DON'T reconnect slave STA intfs -
-				 * infra/adhoc_joiner Do we want to return to
-				 * same AP/network (on radar channel)? If want
-				 * to connect back, depend on either:
-				 *     1. driver's reassoc thread
-				 *     2. wpa_supplicant, or other user-space
-				 * app
-				 */
-			}
 #endif
 		}
 
diff --git a/wlan_sd8987/mlan/mlan_11h.h b/wlan_src/mlan/mlan_11h.h
old mode 100755
new mode 100644
similarity index 84%
rename from wlan_sd8987/mlan/mlan_11h.h
rename to wlan_src/mlan/mlan_11h.h
index 4d0f563..dc3790a
--- a/wlan_sd8987/mlan/mlan_11h.h
+++ b/wlan_src/mlan/mlan_11h.h
@@ -4,20 +4,29 @@
  *  function declarations of 802.11h
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -94,9 +103,6 @@
 /** Initialize the 11h interface structure */
 extern void wlan_11h_priv_init(mlan_private *pmpriv);
 
-/** Get an initial random channel to start an adhoc network on */
-extern t_u8 wlan_11h_get_adhoc_start_channel(mlan_private *priv);
-
 /** Get channel that has been closed via Channel Switch Announcement */
 extern t_u8 wlan_11h_get_csa_closed_channel(mlan_private *priv);
 
@@ -169,6 +175,8 @@
 /** get/set channel dfs state */
 mlan_status wlan_11h_ioctl_chan_dfs_state(pmlan_adapter pmadapter,
 					  pmlan_ioctl_req pioctl_req);
+t_void wlan_11h_reset_dfs_checking_chan_dfs_state(mlan_private *priv,
+						  dfs_state_t dfs_state);
 
 /** get/set dfs w53 cfg */
 mlan_status wlan_11h_ioctl_dfs_w53_cfg(pmlan_adapter pmadapter,
diff --git a/wlan_sd8987/mlan/mlan_11n.c b/wlan_src/mlan/mlan_11n.c
old mode 100755
new mode 100644
similarity index 93%
rename from wlan_sd8987/mlan/mlan_11n.c
rename to wlan_src/mlan/mlan_11n.c
index 3af2069..948ab6f
--- a/wlan_sd8987/mlan/mlan_11n.c
+++ b/wlan_src/mlan/mlan_11n.c
@@ -3,20 +3,29 @@
  *  @brief This file contains functions for 11n handling.
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -33,6 +42,7 @@
 #include "mlan_wmm.h"
 #include "mlan_11n.h"
 #include "mlan_11ac.h"
+#include "mlan_11ax.h"
 
 /********************************************************
 			Local Variables
@@ -398,6 +408,7 @@
 			    MLAN_MAC_ADDR_LENGTH)) {
 			PRINTM(MIOCTL, "Tx:Send delba to tid=%d, " MACSTR "\n",
 			       ptx_tbl->tid, MAC2STR(ptx_tbl->ra));
+			ptx_tbl->ba_status = BA_STREAM_SENT_DELBA;
 			wlan_send_delba(priv, MNULL, ptx_tbl->tid, ptx_tbl->ra,
 					1);
 		}
@@ -469,6 +480,7 @@
 	}
 
 	while (ptx_tbl != (TxBAStreamTbl *)&priv->tx_ba_stream_tbl_ptr) {
+		ptx_tbl->ba_status = BA_STREAM_SETUP_SENT_ADDBA;
 		wlan_send_addba(priv, ptx_tbl->tid, ptx_tbl->ra);
 		ptx_tbl = ptx_tbl->pnext;
 	}
@@ -508,7 +520,12 @@
 		cfg->param.addba_param.rxamsdu = pmpriv->add_ba_param.rx_amsdu;
 	} else {
 		timeout = pmpriv->add_ba_param.timeout;
-		pmpriv->add_ba_param.timeout = cfg->param.addba_param.timeout;
+		if (pmadapter->tx_ba_timeout_support) {
+			pmpriv->add_ba_param.timeout =
+				cfg->param.addba_param.timeout;
+		} else {
+			pmpriv->add_ba_param.timeout = 0;
+		}
 		pmpriv->add_ba_param.tx_win_size =
 			cfg->param.addba_param.txwinsize;
 
@@ -621,75 +638,6 @@
 }
 
 /**
- *  @brief Set/get ibss ampdu param
- *
- *  @param pmadapter	A pointer to mlan_adapter structure
- *  @param pioctl_req	A pointer to ioctl request buffer
- *
- *  @return		MLAN_STATUS_SUCCESS --success, otherwise fail
- */
-static mlan_status wlan_11n_ioctl_ibss_ampdu_param(pmlan_adapter pmadapter,
-						   pmlan_ioctl_req pioctl_req)
-{
-	int i = 0;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_11n_cfg *cfg = MNULL;
-
-	ENTER();
-
-	cfg = (mlan_ds_11n_cfg *)pioctl_req->pbuf;
-
-	if (pioctl_req->action == MLAN_ACT_GET) {
-		PRINTM(MINFO, "Get IBSS AMPDU param\n");
-		for (i = 0; i < MAX_NUM_TID; i++) {
-			cfg->param.ibss_ampdu.ampdu[i] = pmpriv->ibss_ampdu[i];
-			cfg->param.ibss_ampdu.addba_reject[i] =
-				pmpriv->ibss_addba_reject[i];
-		}
-	} else {
-		for (i = 0; i < MAX_NUM_TID; i++) {
-			/* For AMPDU  RX*/
-			if (cfg->param.ibss_ampdu.addba_reject[i] >
-			    ADDBA_RSP_STATUS_REJECT) {
-				pioctl_req->status_code =
-					MLAN_ERROR_INVALID_PARAMETER;
-				ret = MLAN_STATUS_FAILURE;
-				break;
-			}
-			pmpriv->ibss_addba_reject[i] =
-				cfg->param.ibss_ampdu.addba_reject[i];
-			/* For AMPDU TX*/
-			if ((cfg->param.ibss_ampdu.ampdu[i] > HIGH_PRIO_TID) &&
-			    (cfg->param.ibss_ampdu.ampdu[i] !=
-			     BA_STREAM_NOT_ALLOWED)) {
-				pioctl_req->status_code =
-					MLAN_ERROR_INVALID_PARAMETER;
-				ret = MLAN_STATUS_FAILURE;
-				break;
-			}
-			pmpriv->ibss_ampdu[i] = cfg->param.ibss_ampdu.ampdu[i];
-		}
-		PRINTM(MMSG, "IBSS addba reject: %d %d %d %d %d %d %d %d\n",
-		       pmpriv->ibss_addba_reject[0],
-		       pmpriv->ibss_addba_reject[1],
-		       pmpriv->ibss_addba_reject[2],
-		       pmpriv->ibss_addba_reject[3],
-		       pmpriv->ibss_addba_reject[4],
-		       pmpriv->ibss_addba_reject[5],
-		       pmpriv->ibss_addba_reject[6],
-		       pmpriv->ibss_addba_reject[7]);
-		PRINTM(MMSG, "IBSS ampdu %d %d %d %d %d %d %d %d\n",
-		       pmpriv->ibss_ampdu[0], pmpriv->ibss_ampdu[1],
-		       pmpriv->ibss_ampdu[2], pmpriv->ibss_ampdu[3],
-		       pmpriv->ibss_ampdu[4], pmpriv->ibss_ampdu[5],
-		       pmpriv->ibss_ampdu[6], pmpriv->ibss_ampdu[7]);
-	}
-	LEAVE();
-	return ret;
-}
-
-/**
  *  @brief Set/Get Minimum BA Threshold
  *
  *  @param pmadapter   A pointer to mlan_adapter structure
@@ -759,6 +707,8 @@
 			     !memcmp(pmadapter, peer_address,
 				     tx_ba_stream_tbl_ptr->ra,
 				     MLAN_MAC_ADDR_LENGTH))) {
+				tx_ba_stream_tbl_ptr->ba_status =
+					BA_STREAM_SENT_DELBA;
 				if (last_tx_ba_to_delete &&
 				    (tx_ba_stream_tbl_ptr ==
 				     last_tx_ba_to_delete))
@@ -1022,6 +972,8 @@
 				PRINTM(MIOCTL,
 				       "Tx:Send delba to tid=%d, " MACSTR "\n",
 				       tid, MAC2STR(tx_ba_stream_tbl_ptr->ra));
+				tx_ba_stream_tbl_ptr->ba_status =
+					BA_STREAM_SENT_DELBA;
 				wlan_release_ralist_lock(priv);
 				wlan_send_delba(priv, MNULL,
 						tx_ba_stream_tbl_ptr->tid,
@@ -1526,15 +1478,18 @@
 
 	/* Set ampdu param */
 	SETAMPDU_SIZE(pht_cap->ht_cap.ampdu_param, AMPDU_FACTOR_64K);
-	SETAMPDU_SPACING(pht_cap->ht_cap.ampdu_param, 0);
+	SETAMPDU_SPACING(pht_cap->ht_cap.ampdu_param,
+			 pmadapter->hw_mpdu_density);
 
 	rx_mcs_supp = GET_RXMCSSUPP(priv->usr_dev_mcs_support);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	if (IS_CARD9098(pmadapter->card_type) ||
-	    IS_CARDNW62X(pmadapter->card_type) ||
-	    IS_CARD9097(pmadapter->card_type)) {
+	    IS_CARDIW624(pmadapter->card_type) ||
+	    IS_CARD9097(pmadapter->card_type) ||
+	    IS_CARDAW693(pmadapter->card_type)) {
 		if (bands & BAND_A)
 			rx_mcs_supp = MIN(
 				rx_mcs_supp,
@@ -1607,11 +1562,13 @@
 
 	rx_mcs_supp = GET_RXMCSSUPP(priv->usr_dev_mcs_support);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	if (IS_CARD9098(pmadapter->card_type) ||
-	    IS_CARDNW62X(pmadapter->card_type) ||
-	    IS_CARD9097(pmadapter->card_type)) {
+	    IS_CARDIW624(pmadapter->card_type) ||
+	    IS_CARD9097(pmadapter->card_type) ||
+	    IS_CARDAW693(pmadapter->card_type)) {
 		if (bands & BAND_A)
 			rx_mcs_supp = MIN(
 				rx_mcs_supp,
@@ -1682,8 +1639,9 @@
 	PRINTM(MINFO, "GET_HW_SPEC: LDPC coded packet receive %s\n",
 	       (ISSUPP_RXLDPC(cap) ? "supported" : "not supported"));
 
-	PRINTM(MINFO, "GET_HW_SPEC: Number of Tx BA streams supported = %d\n",
-	       ISSUPP_GETTXBASTREAM(cap));
+	PRINTM(MINFO,
+	       "GET_HW_SPEC: Number of Tx BA streams supported = %d/%d\n",
+	       ISSUPP_GETTXBASTREAM(cap), wlan_get_bastream_limit(pmadapter));
 	PRINTM(MINFO, "GET_HW_SPEC: 40 Mhz channel width %s\n",
 	       (ISSUPP_CHANWIDTH40(cap) ? "supported" : "not supported"));
 	PRINTM(MINFO, "GET_HW_SPEC: 20 Mhz channel width %s\n",
@@ -1761,8 +1719,12 @@
 		ptx_ba_tbl = wlan_11n_get_txbastream_status(
 			priv, BA_STREAM_SETUP_INPROGRESS);
 		wlan_release_ralist_lock(priv);
-		if (ptx_ba_tbl)
+		if (ptx_ba_tbl) {
+			/* mark this txba stream as waiting addba resp, in case
+			 * we send duplicate addba req command */
+			ptx_ba_tbl->ba_status = BA_STREAM_SETUP_SENT_ADDBA;
 			wlan_send_addba(priv, ptx_ba_tbl->tid, ptx_ba_tbl->ra);
+		}
 	} else { /*
 		  * In case of failure, recreate
 		  * the deleted stream in case
@@ -1770,11 +1732,11 @@
 		  */
 		if (INITIATOR_BIT(pdel_ba->del_ba_param_set)) {
 			wlan_request_ralist_lock(priv);
-			if (!wlan_11n_get_txbastream_tbl(
-				    priv, tid, pdel_ba->peer_mac_addr, MFALSE))
-				wlan_11n_create_txbastream_tbl(
-					priv, pdel_ba->peer_mac_addr, tid,
-					BA_STREAM_SETUP_INPROGRESS);
+			wlan_11n_set_txbastream_status(priv, tid,
+						       pdel_ba->peer_mac_addr,
+						       BA_STREAM_SETUP_COMPLETE,
+						       MFALSE);
+
 			ptx_ba_tbl = wlan_11n_get_txbastream_status(
 				priv, BA_STREAM_SETUP_INPROGRESS);
 			wlan_release_ralist_lock(priv);
@@ -1873,12 +1835,27 @@
 				BA_STREAM_NOT_ALLOWED;
 
 		} else {
+			t_u8 event_buf[256];
+			mlan_event *pevent = (mlan_event *)event_buf;
+			addba_timeout_event *evtbuf =
+				(addba_timeout_event *)pevent->event_buf;
 			if (ra_list) {
 				ra_list->packet_count = 0;
 				ra_list->ba_packet_threshold =
 					wlan_get_random_ba_threshold(
 						priv->adapter);
 			}
+			memset(priv->adapter, event_buf, 0x00,
+			       sizeof(event_buf));
+			pevent->bss_index = priv->bss_index;
+			pevent->event_id = MLAN_EVENT_ID_DRV_ADDBA_TIMEOUT;
+			pevent->event_len = sizeof(addba_timeout_event);
+			memcpy_ext(priv->adapter, evtbuf->peer_mac_addr,
+				   padd_ba_rsp->peer_mac_addr,
+				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+			evtbuf->tid = tid;
+			wlan_recv_event(priv, MLAN_EVENT_ID_DRV_ADDBA_TIMEOUT,
+					pevent);
 		}
 	}
 
@@ -2497,6 +2474,7 @@
 	pmlan_adapter pmadapter = pmpriv->adapter;
 	MrvlIETypes_HTCap_t *pht_cap;
 	MrvlIEtypes_ChanListParamSet_t *pchan_list;
+	ChanScanParamSet_t *pchan_param;
 	MrvlIETypes_2040BSSCo_t *p2040_bss_co;
 	MrvlIETypes_ExtCap_t *pext_cap;
 	t_u32 usr_dot_11n_dev_cap, orig_usr_dot_11n_dev_cap = 0;
@@ -2524,10 +2502,7 @@
 	else
 		usr_dot_11n_dev_cap = pmpriv->usr_dot_11n_dev_cap_bg;
 
-	if (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
-		usr_dot_11ac_bw = BW_FOLLOW_VHTCAP;
-	else
-		usr_dot_11ac_bw = pmpriv->usr_dot_11ac_bw;
+	usr_dot_11ac_bw = pmpriv->usr_dot_11ac_bw;
 	if ((pbss_desc->bss_band & (BAND_B | BAND_G | BAND_A)) &&
 	    ISSUPP_CHANWIDTH40(usr_dot_11n_dev_cap) &&
 	    !wlan_check_chan_width_ht40_by_region(pmpriv, pbss_desc)) {
@@ -2573,12 +2548,12 @@
 
 	if (pbss_desc->pht_info) {
 		pchan_list = (MrvlIEtypes_ChanListParamSet_t *)*ppbuffer;
-		memset(pmadapter, pchan_list, 0,
-		       sizeof(MrvlIEtypes_ChanListParamSet_t));
 		pchan_list->header.type = wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
-		pchan_list->header.len =
-			sizeof(MrvlIEtypes_ChanListParamSet_t) -
-			sizeof(MrvlIEtypesHeader_t);
+		pchan_list->header.len = sizeof(ChanScanParamSet_t);
+
+		pchan_param = (ChanScanParamSet_t *)pchan_list->chan_scan_param;
+		memset(pmadapter, pchan_param, 0x00,
+		       sizeof(ChanScanParamSet_t));
 		pchan_list->chan_scan_param[0].chan_number =
 			pbss_desc->pht_info->ht_info.pri_chan;
 		pchan_list->chan_scan_param[0].bandcfg.chanBand =
@@ -2612,11 +2587,14 @@
 		pchan_list->chan_scan_param[0].bandcfg.scanMode =
 			SCAN_MODE_USER;
 		HEXDUMP("ChanList", (t_u8 *)pchan_list,
-			sizeof(MrvlIEtypes_ChanListParamSet_t));
+			sizeof(ChanScanParamSet_t) +
+				sizeof(MrvlIEtypesHeader_t));
 		HEXDUMP("pht_info", (t_u8 *)pbss_desc->pht_info,
 			sizeof(MrvlIETypes_HTInfo_t) - 2);
-		*ppbuffer += sizeof(MrvlIEtypes_ChanListParamSet_t);
-		ret_len += sizeof(MrvlIEtypes_ChanListParamSet_t);
+		*ppbuffer += sizeof(ChanScanParamSet_t) +
+			     sizeof(MrvlIEtypesHeader_t);
+		ret_len += sizeof(ChanScanParamSet_t) +
+			   sizeof(MrvlIEtypesHeader_t);
 		pchan_list->header.len =
 			wlan_cpu_to_le16(pchan_list->header.len);
 	}
@@ -2658,6 +2636,8 @@
 			RESET_EXTCAP_EXT_CHANNEL_SWITCH(pext_cap->ext_cap);
 		else
 			SET_EXTCAP_EXT_CHANNEL_SWITCH(pext_cap->ext_cap);
+		if (wlan_check_11ax_twt_supported(pmpriv, pbss_desc))
+			SET_EXTCAP_TWT_REQ(pext_cap->ext_cap);
 
 		HEXDUMP("Extended Capabilities IE", (t_u8 *)pext_cap,
 			sizeof(MrvlIETypes_ExtCap_t));
@@ -2751,9 +2731,6 @@
 	case MLAN_OID_11N_CFG_TX_AGGR_CTRL:
 		status = wlan_11n_ioctl_txaggrctrl(pmadapter, pioctl_req);
 		break;
-	case MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM:
-		status = wlan_11n_ioctl_ibss_ampdu_param(pmadapter, pioctl_req);
-		break;
 	case MLAN_OID_11N_CFG_MIN_BA_THRESHOLD:
 		status = wlan_11n_ioctl_min_ba_threshold_cfg(pmadapter,
 							     pioctl_req);
@@ -2878,6 +2855,58 @@
 }
 
 /**
+ *  @brief This function will set ba_status txbastream entry with
+ *       given RA/TID.
+ *
+ *  @param priv      A pointer to mlan_private
+ *  @param ra        RA to find in txbastream
+ *  @param tid       TID to find in txbastream
+ *  @param ba_status BA stream status
+ *
+ *  @return          N/A
+ */
+void wlan_11n_set_txbastream_status(mlan_private *priv, int tid, t_u8 *ra,
+				    baStatus_e ba_status, int lock)
+{
+	TxBAStreamTbl *ptx_tbl;
+	pmlan_adapter pmadapter = priv->adapter;
+
+	ENTER();
+
+	if (lock)
+		wlan_request_ralist_lock(priv);
+	ptx_tbl = (TxBAStreamTbl *)util_peek_list(pmadapter->pmoal_handle,
+						  &priv->tx_ba_stream_tbl_ptr,
+						  MNULL, MNULL);
+	if (!ptx_tbl) {
+		if (lock)
+			wlan_release_ralist_lock(priv);
+		LEAVE();
+		return;
+	}
+
+	while (ptx_tbl != (TxBAStreamTbl *)&priv->tx_ba_stream_tbl_ptr) {
+		PRINTM(MDAT_D, "get_txbastream_tbl TID %d\n", ptx_tbl->tid);
+		DBG_HEXDUMP(MDAT_D, "RA", ptx_tbl->ra, MLAN_MAC_ADDR_LENGTH);
+
+		if ((!memcmp(pmadapter, ptx_tbl->ra, ra,
+			     MLAN_MAC_ADDR_LENGTH)) &&
+		    (ptx_tbl->tid == tid)) {
+			ptx_tbl->ba_status = ba_status;
+			if (lock)
+				wlan_release_ralist_lock(priv);
+			LEAVE();
+			return;
+		}
+		ptx_tbl = ptx_tbl->pnext;
+	}
+	if (lock)
+		wlan_release_ralist_lock(priv);
+	LEAVE();
+	return;
+}
+
+/**
  *  @brief This function will create a entry in tx ba stream table for the
  *          given RA/TID.
  *
@@ -2946,8 +2975,8 @@
 
 	ENTER();
 
-	PRINTM(MCMND, "Send addba: TID %d\n", tid);
-	DBG_HEXDUMP(MCMD_D, "Send addba RA", peer_mac, MLAN_MAC_ADDR_LENGTH);
+	PRINTM(MCMND, "Send addba: TID %d, " MACSTR "\n", tid,
+	       MAC2STR(peer_mac));
 
 	add_ba_req.block_ack_param_set =
 		(t_u16)((tid << BLOCKACKPARAM_TID_POS) |
@@ -2996,6 +3025,9 @@
 
 	ENTER();
 
+	PRINTM(MCMND, "Send delba: TID %d initiator=%d, " MACSTR "\n", tid,
+	       initiator, MAC2STR(peer_mac));
+
 	memset(priv->adapter, &delba, 0, sizeof(delba));
 	delba.del_ba_param_set = (tid << DELBA_TID_POS);
 
@@ -3126,7 +3158,7 @@
 		LEAVE();
 		return count;
 	}
-	bastream_max = ISSUPP_GETTXBASTREAM(priv->adapter->hw_dot_11n_dev_cap);
+	bastream_max = wlan_get_bastream_limit(priv->adapter);
 	if (bastream_max == 0)
 		bastream_max = MLAN_MAX_TX_BASTREAM_DEFAULT;
 
@@ -3157,12 +3189,7 @@
  */
 t_u8 wlan_11n_bandconfig_allowed(mlan_private *pmpriv, t_u16 bss_band)
 {
-	if (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS) {
-		if (bss_band & BAND_G)
-			return (pmpriv->adapter->adhoc_start_band & BAND_GN);
-		else if (bss_band & BAND_A)
-			return (pmpriv->adapter->adhoc_start_band & BAND_AN);
-	} else {
+	{
 		if (bss_band & BAND_G)
 			return (pmpriv->config_bands & BAND_GN);
 		else if (bss_band & BAND_A)
diff --git a/wlan_sd8987/mlan/mlan_11n.h b/wlan_src/mlan/mlan_11n.h
old mode 100755
new mode 100644
similarity index 85%
rename from wlan_sd8987/mlan/mlan_11n.h
rename to wlan_src/mlan/mlan_11n.h
index 0a2a990..110d135
--- a/wlan_sd8987/mlan/mlan_11n.h
+++ b/wlan_src/mlan/mlan_11n.h
@@ -8,18 +8,27 @@
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -87,6 +96,10 @@
 /** Get Tx BA stream table */
 TxBAStreamTbl *wlan_11n_get_txbastream_tbl(mlan_private *priv, int tid,
 					   t_u8 *ra, int lock);
+/** Set Tx BA stream table  BA status */
+void wlan_11n_set_txbastream_status(mlan_private *priv, int tid, t_u8 *ra,
+				    baStatus_e ba_status, int lock);
+
 /** Create Tx BA stream table */
 void wlan_11n_create_txbastream_tbl(mlan_private *priv, t_u8 *ra, int tid,
 				    baStatus_e ba_status);
@@ -293,7 +306,7 @@
 #ifdef UAP_SUPPORT
 	sta_node *sta_ptr = MNULL;
 #endif
-	if (priv->amsdu_disable)
+	if (priv->amsdu_disable || !ptr->max_amsdu)
 		return MFALSE;
 #ifdef UAP_SUPPORT
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
@@ -320,6 +333,23 @@
 }
 
 /**
+ *  @brief This function gets max number of BA stream supported
+ *
+ *  @param pmadapter  A pointer to mlan_adapter
+ *
+ *  @return           number of BA streams
+ */
+static INLINE t_u32 wlan_get_bastream_limit(mlan_adapter *pmadapter)
+{
+	t_u32 bastreams = ISSUPP_GETTXBASTREAM(pmadapter->hw_dot_11n_dev_cap);
+
+	if (pmadapter->mclient_tx_supported)
+		return pmadapter->tx_ba_stream_limit;
+
+	return bastreams;
+}
+
+/**
  *  @brief This function checks whether a BA stream is available or not
  *
  *  @param priv     A pointer to mlan_private
@@ -338,7 +368,7 @@
 			bastream_num += wlan_wmm_list_len(
 				(pmlan_list_head)&pmpriv->tx_ba_stream_tbl_ptr);
 	}
-	bastream_max = ISSUPP_GETTXBASTREAM(priv->adapter->hw_dot_11n_dev_cap);
+	bastream_max = wlan_get_bastream_limit(priv->adapter);
 	if (bastream_max == 0)
 		bastream_max = MLAN_MAX_TX_BASTREAM_DEFAULT;
 	return (bastream_num < bastream_max) ? MTRUE : MFALSE;
@@ -376,14 +406,14 @@
 	tid = priv->aggr_prio_tbl[ptr_tid].ampdu_user;
 
 	while (ptx_tbl != (TxBAStreamTbl *)&priv->tx_ba_stream_tbl_ptr) {
-		if (tid > priv->aggr_prio_tbl[ptx_tbl->tid].ampdu_user) {
+		if ((ptx_tbl->ba_status == BA_STREAM_SETUP_COMPLETE) &&
+		    (tid > priv->aggr_prio_tbl[ptx_tbl->tid].ampdu_user)) {
 			tid = priv->aggr_prio_tbl[ptx_tbl->tid].ampdu_user;
 			*ptid = ptx_tbl->tid;
 			memcpy_ext(priv->adapter, ra, ptx_tbl->ra,
 				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 			ret = MTRUE;
 		}
-
 		ptx_tbl = ptx_tbl->pnext;
 	}
 	LEAVE();
diff --git a/wlan_src/mlan/mlan_11n_aggr.c b/wlan_src/mlan/mlan_11n_aggr.c
new file mode 100644
index 0000000..1e6f84d
--- /dev/null
+++ b/wlan_src/mlan/mlan_11n_aggr.c
@@ -0,0 +1,1052 @@
+/** @file mlan_11n_aggr.c
+ *
+ *  @brief This file contains functions for 11n Aggregation.
+ *
+ *
+ *  Copyright 2008-2021, 2024 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/********************************************************
+Change log:
+    11/10/2008: initial version
+********************************************************/
+
+#include "mlan.h"
+#include "mlan_join.h"
+#include "mlan_util.h"
+#include "mlan_fw.h"
+#include "mlan_main.h"
+#include "mlan_wmm.h"
+#include "mlan_11n.h"
+#include "mlan_11n_aggr.h"
+
+/********************************************************
+			Local Variables
+********************************************************/
+
+/********************************************************
+			Global Variables
+********************************************************/
+
+/********************************************************
+			Local Functions
+********************************************************/
+/**
+ *  @brief Aggregate individual packets into one AMSDU packet
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param amsdu_buf A pointer to packet buffer
+ *  @param data      A pointer to aggregated data packet being formed
+ *  @param pkt_len   Length of current packet to aggregate
+ *  @param pad       Pad
+ *
+ *  @return         Final packet size
+ */
+static int wlan_11n_form_amsdu_pkt(pmlan_adapter pmadapter, t_u8 *amsdu_buf,
+				   t_u8 *data, int pkt_len, int *pad)
+{
+	int dt_offset, amsdu_buf_offset;
+	Rfc1042Hdr_t snap = {
+		0xaa, /* LLC DSAP */
+		0xaa, /* LLC SSAP */
+		0x03, /* LLC CTRL */
+		{0x00, 0x00, 0x00}, /* SNAP OUI */
+		0x0000 /* SNAP type */
+		/*
+		 * This field will be overwritten
+		 * later with ethertype
+		 */
+	};
+
+	ENTER();
+
+	memcpy_ext(pmadapter, amsdu_buf, data, (MLAN_MAC_ADDR_LENGTH)*2,
+		   (MLAN_MAC_ADDR_LENGTH)*2);
+	dt_offset = amsdu_buf_offset = (MLAN_MAC_ADDR_LENGTH)*2;
+
+	snap.snap_type = *(t_u16 *)(data + dt_offset);
+	dt_offset += sizeof(t_u16);
+	*(t_u16 *)(amsdu_buf + amsdu_buf_offset) =
+		mlan_htons(pkt_len + LLC_SNAP_LEN -
+			   ((2 * MLAN_MAC_ADDR_LENGTH) + sizeof(t_u16)));
+	amsdu_buf_offset += sizeof(t_u16);
+	memcpy_ext(pmadapter, amsdu_buf + amsdu_buf_offset, &snap, LLC_SNAP_LEN,
+		   LLC_SNAP_LEN);
+	amsdu_buf_offset += LLC_SNAP_LEN;
+
+	memcpy_ext(pmadapter, amsdu_buf + amsdu_buf_offset, data + dt_offset,
+		   pkt_len - dt_offset, pkt_len - dt_offset);
+	*pad = (((pkt_len + LLC_SNAP_LEN) & 3)) ?
+		       (4 - (((pkt_len + LLC_SNAP_LEN)) & 3)) :
+		       0;
+
+	LEAVE();
+	return pkt_len + LLC_SNAP_LEN + *pad;
+}
+
+/**
+ *  @brief Add TxPD to AMSDU header
+ *
+ *  @param priv     A pointer to mlan_private structure
+ *  @param mbuf		Pointer to buffer where the TxPD will be formed
+ *
+ *  @return		N/A
+ */
+static void wlan_11n_form_amsdu_txpd(mlan_private *priv, mlan_buffer *mbuf)
+{
+	TxPD *ptx_pd;
+	mlan_adapter *pmadapter = priv->adapter;
+
+	ENTER();
+
+	ptx_pd = (TxPD *)mbuf->pbuf;
+	// coverity[bad_memset:SUPPRESS]
+	memset(pmadapter, ptx_pd, 0, Tx_PD_SIZEOF(pmadapter));
+
+	/*
+	 * Original priority has been overwritten
+	 */
+	ptx_pd->priority = (t_u8)mbuf->priority;
+	ptx_pd->bss_num = GET_BSS_NUM(priv);
+	ptx_pd->bss_type = priv->bss_type;
+	/* Always zero as the data is followed by TxPD */
+	ptx_pd->tx_pkt_offset = Tx_PD_SIZEOF(pmadapter);
+	ptx_pd->tx_pkt_type = PKT_TYPE_AMSDU;
+	if (mbuf->flags & MLAN_BUF_FLAG_TDLS)
+		ptx_pd->flags = MRVDRV_TxPD_FLAGS_TDLS_PACKET;
+
+	if (mbuf->flags & MLAN_BUF_FLAG_EASYMESH) {
+		ptx_pd->flags |= MRVDRV_TxPD_FLAGS_EASYMESH;
+		memcpy_ext(priv->adapter, ptx_pd->ra_mac, mbuf->mac,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	}
+	if (ptx_pd->tx_control == 0)
+		/* TxCtrl set by user or default */
+		ptx_pd->tx_control = priv->pkt_tx_ctrl;
+
+	endian_convert_TxPD(ptx_pd);
+
+	LEAVE();
+}
+
+/**
+ *  @brief free pkts in amsdu_txq
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *
+ *  @return  N/A
+ */
+static INLINE void wlan_free_amsdu_txq(pmlan_adapter pmadapter)
+{
+	pmlan_buffer pmbuf;
+
+	ENTER();
+	while ((pmbuf = (pmlan_buffer)util_peek_list(pmadapter->pmoal_handle,
+						     &pmadapter->amsdu_txq,
+						     MNULL, MNULL))) {
+		util_unlink_list(pmadapter->pmoal_handle, &pmadapter->amsdu_txq,
+				 (pmlan_linked_list)pmbuf, MNULL, MNULL);
+		wlan_write_data_complete(pmadapter, pmbuf, MLAN_STATUS_FAILURE);
+	}
+	LEAVE();
+}
+
+#ifdef PCIEAW693
+/**
+ *  @brief Add TxPD to AMSDU header
+ *
+ *  @param priv     A pointer to mlan_private structure
+ *  @param pmbuf	A pointer to buffer where the TxPD will be formed
+ *  @param amsdu_pkt_len   amsdu packet length
+ *
+ *  @return		increased length (TxPD + intf_hr_len + padding for DMA
+ * alignment)
+ */
+static t_u16 wlan_form_amsdu_txpd(mlan_private *priv, mlan_buffer *pmbuf,
+				  t_u16 amsdu_pkt_len)
+{
+	mlan_adapter *pmadapter = priv->adapter;
+	TxPD *ptx_pd;
+	t_u8 *head_ptr = MNULL;
+	t_u16 data_len = pmbuf->data_len;
+	ENTER();
+
+	head_ptr = pmbuf->pbuf + pmbuf->data_offset - Tx_PD_SIZEOF(pmadapter) -
+		   priv->intf_hr_len;
+	/*making data buffer 8 ytes aligned for increasing TP with PCIE Scatter
+	 * Gather*/
+	head_ptr = (t_u8 *)((t_ptr)head_ptr & ~((t_ptr)(8 - 1)));
+	ptx_pd = (TxPD *)(head_ptr + priv->intf_hr_len);
+	// coverity[bad_memset:SUPPRESS]
+	memset(pmadapter, ptx_pd, 0, Tx_PD_SIZEOF(pmadapter));
+
+	/* Set the BSS number to TxPD */
+	ptx_pd->bss_num = GET_BSS_NUM(priv);
+	ptx_pd->bss_type = priv->bss_type;
+	ptx_pd->priority = (t_u8)pmbuf->priority;
+	ptx_pd->tx_pkt_type = PKT_TYPE_AMSDU;
+	ptx_pd->tx_pkt_length = amsdu_pkt_len;
+
+	ptx_pd->tx_pkt_offset = (t_u16)((t_ptr)pmbuf->pbuf +
+					pmbuf->data_offset - (t_ptr)ptx_pd);
+	if (pmbuf->flags & MLAN_BUF_FLAG_TDLS)
+		ptx_pd->flags = MRVDRV_TxPD_FLAGS_TDLS_PACKET;
+	if (ptx_pd->tx_control == 0)
+		/* TxCtrl set by user or default */
+		ptx_pd->tx_control = priv->pkt_tx_ctrl;
+
+	if (pmbuf->flags & MLAN_BUF_FLAG_EASYMESH) {
+		ptx_pd->flags |= MRVDRV_TxPD_FLAGS_EASYMESH;
+		memcpy_ext(priv->adapter, ptx_pd->ra_mac, pmbuf->mac,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	}
+
+	endian_convert_TxPD(ptx_pd);
+
+	/* Adjust the data offset and length to include TxPD in pmbuf */
+	pmbuf->data_len += pmbuf->data_offset;
+	pmbuf->data_offset = (t_u32)(head_ptr - pmbuf->pbuf);
+	pmbuf->data_len -= pmbuf->data_offset;
+
+	PRINTM(MDATA, "amsdu_pkt_len=%d, extra_len=%d\n", amsdu_pkt_len,
+	       pmbuf->data_len - data_len);
+	DBG_HEXDUMP(MDAT_D, "AMSDU TxPD", ptx_pd, Tx_PD_SIZEOF(pmadapter));
+
+	LEAVE();
+	return (pmbuf->data_len - data_len);
+}
+
+/**
+ *  @brief Form amsdu subframe
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param pmbuf     A pointer to mlan_buffer
+ *  @param pad       Pad
+ *
+ *  @return         Final packet size
+ */
+static int wlan_form_amsdu_subframe(pmlan_adapter pmadapter, mlan_buffer *pmbuf,
+				    int *pad)
+{
+	int dt_offset, amsdu_buf_offset;
+	Rfc1042Hdr_t snap = {
+		0xaa, /* LLC DSAP */
+		0xaa, /* LLC SSAP */
+		0x03, /* LLC CTRL */
+		{0x00, 0x00, 0x00}, /* SNAP OUI */
+		0x0000 /* SNAP type */
+		/*
+		 * This field will be overwritten
+		 * later with ethertype
+		 */
+	};
+	t_u8 *amsdu_buf = MNULL;
+	t_u8 *data = pmbuf->pbuf + pmbuf->data_offset;
+	int pkt_len = pmbuf->data_len;
+
+	ENTER();
+
+	pmbuf->data_offset -= sizeof(Rfc1042Hdr_t);
+	pmbuf->data_len += sizeof(Rfc1042Hdr_t);
+
+	amsdu_buf = pmbuf->pbuf + pmbuf->data_offset;
+
+	memcpy_ext(pmadapter, amsdu_buf, data, (MLAN_MAC_ADDR_LENGTH)*2,
+		   (MLAN_MAC_ADDR_LENGTH)*2);
+	dt_offset = amsdu_buf_offset = (MLAN_MAC_ADDR_LENGTH)*2;
+
+	snap.snap_type = *(t_u16 *)(data + dt_offset);
+	dt_offset += sizeof(t_u16);
+	*(t_u16 *)(amsdu_buf + amsdu_buf_offset) =
+		mlan_htons(pkt_len + LLC_SNAP_LEN -
+			   ((2 * MLAN_MAC_ADDR_LENGTH) + sizeof(t_u16)));
+	amsdu_buf_offset += sizeof(t_u16);
+	memcpy_ext(pmadapter, amsdu_buf + amsdu_buf_offset, &snap, LLC_SNAP_LEN,
+		   LLC_SNAP_LEN);
+	amsdu_buf_offset += LLC_SNAP_LEN;
+	*pad = (((pkt_len + LLC_SNAP_LEN) & 3)) ?
+		       (4 - (((pkt_len + LLC_SNAP_LEN)) & 3)) :
+		       0;
+	pmbuf->data_len += *pad;
+
+	DBG_HEXDUMP(MDAT_D, "AMSDU subframe", pmbuf->pbuf + pmbuf->data_offset,
+		    MIN(pmbuf->data_len, MAX_DATA_DUMP_LEN));
+	PRINTM(MDATA, "AMSDU subframe len=%d\n", pkt_len + LLC_SNAP_LEN + *pad);
+	LEAVE();
+	return pkt_len + LLC_SNAP_LEN + *pad;
+}
+#endif
+
+/**
+ *  @brief Update the TxPktLength field in TxPD after the complete AMSDU
+ *  packet is formed
+ *
+ *  @param priv     A pointer to mlan_private structure
+ *  @param mbuf     TxPD buffer
+ *
+ *  @return         N/A
+ */
+static INLINE void wlan_11n_update_pktlen_amsdu_txpd(mlan_private *priv,
+						     pmlan_buffer mbuf)
+{
+	TxPD *ptx_pd;
+	ENTER();
+
+	ptx_pd = (TxPD *)mbuf->pbuf;
+	ptx_pd->tx_pkt_length = (t_u16)wlan_cpu_to_le16(
+		mbuf->data_len - Tx_PD_SIZEOF(priv->adapter));
+	ptx_pd->pkt_delay_2ms =
+		wlan_wmm_compute_driver_packet_delay(priv, mbuf);
+
+#ifdef STA_SUPPORT
+	if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) &&
+	    (priv->adapter->pps_uapsd_mode)) {
+		if (MTRUE == wlan_check_last_packet_indication(priv)) {
+			priv->adapter->tx_lock_flag = MTRUE;
+			ptx_pd->flags |= MRVDRV_TxPD_POWER_MGMT_LAST_PACKET;
+		}
+	}
+#endif /* STA_SUPPORT */
+	LEAVE();
+}
+
+/**
+ *  @brief check if UAP AMSDU packet need forward out to connected peers
+ *
+ *  @param priv       A pointer to mlan_private
+ *
+ *  @return			  MTRUE--packet need forward
+ *
+ */
+static t_u8 wlan_uap_check_forward(mlan_private *priv, Eth803Hdr_t *hdr)
+{
+	/** include multicast packet */
+	if (hdr->dest_addr[0] & 0x01)
+		return MTRUE;
+	/** include unicast packet to another station */
+	if (wlan_get_station_entry(priv, hdr->dest_addr))
+		return MTRUE;
+	return MFALSE;
+}
+
+/**
+ *  @brief Get number of aggregated packets
+ *
+ *  @param priv		A pointer to mlan_private structure
+ *  @param data			A pointer to packet data
+ *  @param total_pkt_len	Total packet length
+ *  @param forward      A pointer forward flag
+ *
+ *  @return			Number of packets
+ */
+static int wlan_11n_get_num_aggrpkts(mlan_private *priv, t_u8 *data,
+				     int total_pkt_len, t_u8 *forward)
+{
+	int pkt_count = 0, pkt_len, pad;
+	t_u8 hdr_len = sizeof(Eth803Hdr_t);
+
+	t_u8 forward_flag = MFALSE;
+
+	ENTER();
+	while (total_pkt_len >= hdr_len) {
+		if (priv->bss_role == MLAN_BSS_ROLE_UAP &&
+		    wlan_uap_check_forward(priv, (Eth803Hdr_t *)data))
+			forward_flag = MTRUE;
+		/* Length will be in network format, change it to host */
+		pkt_len = mlan_ntohs(
+			(*(t_u16 *)(data + (2 * MLAN_MAC_ADDR_LENGTH))));
+		if (pkt_len > total_pkt_len) {
+			PRINTM(MERROR, "Error in packet length.\n");
+			break;
+		}
+
+		pad = (((pkt_len + sizeof(Eth803Hdr_t)) & 3)) ?
+			      (4 - ((pkt_len + sizeof(Eth803Hdr_t)) & 3)) :
+			      0;
+		data += pkt_len + pad + sizeof(Eth803Hdr_t);
+		total_pkt_len -= pkt_len + pad + sizeof(Eth803Hdr_t);
+		++pkt_count;
+	}
+	*forward = forward_flag;
+	LEAVE();
+	return pkt_count;
+}
+
+/********************************************************
+			Global Functions
+********************************************************/
+
+/**
+ *  @brief Deaggregate the received AMSDU packet
+ *
+ *  @param priv		A pointer to mlan_private structure
+ *  @param pmbuf	A pointer to aggregated data packet
+ *
+ *  @return		MLAN_STATUS_SUCCESS --success, otherwise fail
+ */
+mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
+{
+	t_u16 pkt_len;
+	int total_pkt_len;
+	t_u8 *data;
+	mlan_adapter *pmadapter = priv->adapter;
+	t_u32 max_rx_data_size = MLAN_RX_DATA_BUF_SIZE;
+	int pad;
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	RxPacketHdr_t *prx_pkt;
+	mlan_buffer *daggr_mbuf = MNULL;
+	t_u8 rfc1042_eth_hdr[MLAN_MAC_ADDR_LENGTH] = {0xaa, 0xaa, 0x03,
+						      0x00, 0x00, 0x00};
+	t_u8 hdr_len = sizeof(Eth803Hdr_t);
+	t_u8 forward = MFALSE;
+	t_u8 eapol_type[2] = {0x88, 0x8e};
+	t_u8 tdls_action_type[2] = {0x89, 0x0d};
+	t_u32 in_ts_sec, in_ts_usec;
+	t_u32 out_ts_sec, out_ts_usec;
+	t_u32 in_copy_ts_sec, in_copy_ts_usec;
+	t_u32 out_copy_ts_sec, out_copy_ts_usec;
+	t_u32 copy_delay = 0;
+	t_u32 delay = 0;
+	t_u8 num_subframes = 0;
+
+	ENTER();
+
+	data = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
+	total_pkt_len = pmbuf->data_len;
+
+	/* Sanity test */
+#if defined(USB)
+	if (IS_USB(pmadapter->card_type) &&
+	    pmadapter->pcard_usb->usb_rx_deaggr.aggr_ctrl.enable) {
+		max_rx_data_size =
+			pmadapter->pcard_usb->usb_rx_deaggr.aggr_ctrl.aggr_max;
+		if (pmadapter->pcard_usb->usb_rx_deaggr.aggr_ctrl.aggr_mode ==
+		    MLAN_USB_AGGR_MODE_NUM) {
+			max_rx_data_size *=
+				MAX(MLAN_USB_MAX_PKT_SIZE,
+				    pmadapter->pcard_usb->usb_rx_deaggr
+					    .aggr_ctrl.aggr_align);
+			max_rx_data_size =
+				MAX(max_rx_data_size, MLAN_RX_DATA_BUF_SIZE);
+		}
+	}
+#endif
+	if (total_pkt_len > (int)max_rx_data_size) {
+		PRINTM(MERROR,
+		       "Total packet length greater than tx buffer"
+		       " size %d\n",
+		       total_pkt_len);
+		goto done;
+	}
+	if (pmadapter->tp_state_on)
+		pmadapter->callbacks.moal_get_system_time(
+			pmadapter->pmoal_handle, &in_ts_sec, &in_ts_usec);
+	num_subframes = pmbuf->use_count =
+		wlan_11n_get_num_aggrpkts(priv, data, total_pkt_len, &forward);
+
+	// rx_trace 7
+	if (pmadapter->tp_state_on) {
+		pmadapter->callbacks.moal_tp_accounting(
+			pmadapter->pmoal_handle, pmbuf, 7 /*RX_DROP_P3*/);
+		pmadapter->callbacks.moal_tp_accounting_rx_param(
+			pmadapter->pmoal_handle, 4, pmbuf->use_count);
+	}
+	if (pmadapter->tp_state_drop_point == 7 /*RX_DROP_P3*/)
+		goto done;
+	prx_pkt = (RxPacketHdr_t *)data;
+	/**  check if packet need send to host only */
+	if (pmbuf->pdesc && !forward) {
+		if (pmadapter->callbacks.moal_recv_amsdu_packet) {
+			ret = pmadapter->callbacks.moal_recv_amsdu_packet(
+				pmadapter->pmoal_handle, pmbuf);
+			if (ret == MLAN_STATUS_PENDING) {
+#ifdef USB
+				if (IS_USB(pmadapter->card_type))
+					pmadapter->callbacks.moal_recv_complete(
+						pmadapter->pmoal_handle, MNULL,
+						pmadapter->rx_data_ep, ret);
+#endif
+				priv->msdu_in_rx_amsdu_cnt += num_subframes;
+				priv->amsdu_rx_cnt++;
+				return ret;
+			}
+			goto done;
+		}
+	}
+	while (total_pkt_len >= hdr_len) {
+		prx_pkt = (RxPacketHdr_t *)data;
+		/* Length will be in network format, change it to host */
+		pkt_len = mlan_ntohs(
+			(*(t_u16 *)(data + (2 * MLAN_MAC_ADDR_LENGTH))));
+		if (pkt_len > total_pkt_len) {
+			PRINTM(MERROR,
+			       "Error in packet length: total_pkt_len = %d, pkt_len = %d\n",
+			       total_pkt_len, pkt_len);
+			ret = MLAN_STATUS_FAILURE;
+			break;
+		}
+
+		pad = (((pkt_len + sizeof(Eth803Hdr_t)) & 3)) ?
+			      (4 - ((pkt_len + sizeof(Eth803Hdr_t)) & 3)) :
+			      0;
+
+		total_pkt_len -= pkt_len + pad + sizeof(Eth803Hdr_t);
+
+		if (memcmp(pmadapter, &prx_pkt->rfc1042_hdr, rfc1042_eth_hdr,
+			   sizeof(rfc1042_eth_hdr)) == 0) {
+			memmove(pmadapter, data + LLC_SNAP_LEN, data,
+				(2 * MLAN_MAC_ADDR_LENGTH));
+			data += LLC_SNAP_LEN;
+			pkt_len += sizeof(Eth803Hdr_t) - LLC_SNAP_LEN;
+		} else {
+			*(t_u16 *)(data + (2 * MLAN_MAC_ADDR_LENGTH)) =
+				(t_u16)0;
+			pkt_len += sizeof(Eth803Hdr_t);
+		}
+		daggr_mbuf = wlan_alloc_mlan_buffer(pmadapter,
+						    pkt_len + MLAN_NET_IP_ALIGN,
+						    0, MOAL_ALLOC_MLAN_BUFFER);
+		if (daggr_mbuf == MNULL) {
+			PRINTM(MERROR, "Error allocating daggr mlan_buffer\n");
+			ret = MLAN_STATUS_FAILURE;
+			break;
+		}
+		daggr_mbuf->data_offset += MLAN_NET_IP_ALIGN;
+		daggr_mbuf->bss_index = pmbuf->bss_index;
+		daggr_mbuf->buf_type = pmbuf->buf_type;
+		daggr_mbuf->data_len = pkt_len;
+		daggr_mbuf->in_ts_sec = pmbuf->in_ts_sec;
+		daggr_mbuf->in_ts_usec = pmbuf->in_ts_usec;
+		daggr_mbuf->flags = pmbuf->flags;
+		daggr_mbuf->extra_ts_sec = pmbuf->extra_ts_sec;
+		daggr_mbuf->extra_ts_usec = pmbuf->extra_ts_usec;
+		daggr_mbuf->pparent = pmbuf;
+		daggr_mbuf->priority = pmbuf->priority;
+		if (pmadapter->tp_state_on)
+			pmadapter->callbacks.moal_get_system_time(
+				pmadapter->pmoal_handle, &in_copy_ts_sec,
+				&in_copy_ts_usec);
+		memcpy_ext(pmadapter,
+			   daggr_mbuf->pbuf + daggr_mbuf->data_offset, data,
+			   pkt_len, daggr_mbuf->data_len);
+		if (pmadapter->tp_state_on) {
+			pmadapter->callbacks.moal_get_system_time(
+				pmadapter->pmoal_handle, &out_copy_ts_sec,
+				&out_copy_ts_usec);
+			copy_delay +=
+				(t_s32)(out_copy_ts_sec - in_copy_ts_sec) *
+				1000000;
+			copy_delay +=
+				(t_s32)(out_copy_ts_usec - in_copy_ts_usec);
+		}
+#ifdef UAP_SUPPORT
+		if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
+			if (pmbuf->flags & MLAN_BUF_FLAG_EASYMESH)
+				memcpy_ext(priv->adapter, daggr_mbuf->mac,
+					   pmbuf->mac, MLAN_MAC_ADDR_LENGTH,
+					   MLAN_MAC_ADDR_LENGTH);
+			ret = wlan_uap_recv_packet(priv, daggr_mbuf);
+		} else {
+#endif /* UAP_SUPPORT */
+			/** send EAPOL from AMSDU pkt to firmware */
+			if (priv->sec_info.ewpa_enabled &&
+			    (!memcmp(pmadapter,
+				     daggr_mbuf->pbuf +
+					     daggr_mbuf->data_offset +
+					     MLAN_ETHER_PKT_TYPE_OFFSET,
+				     eapol_type, sizeof(eapol_type)))) {
+				ret = wlan_prepare_cmd(
+					priv, HostCmd_CMD_802_11_EAPOL_PKT, 0,
+					0, MNULL, daggr_mbuf);
+				if (ret == MLAN_STATUS_SUCCESS)
+					wlan_recv_event(
+						priv,
+						MLAN_EVENT_ID_DRV_DEFER_HANDLING,
+						MNULL);
+				wlan_free_mlan_buffer(pmadapter, daggr_mbuf);
+				data += pkt_len + pad;
+				continue;
+			}
+			/**process tdls packet*/
+			if (!memcmp(pmadapter,
+				    daggr_mbuf->pbuf + daggr_mbuf->data_offset +
+					    MLAN_ETHER_PKT_TYPE_OFFSET,
+				    tdls_action_type,
+				    sizeof(tdls_action_type))) {
+				PRINTM(MEVENT,
+				       "Recevie AMSDU TDLS action frame\n");
+				wlan_process_tdls_action_frame(
+					priv,
+					daggr_mbuf->pbuf +
+						daggr_mbuf->data_offset,
+					daggr_mbuf->data_len);
+			}
+
+			ret = pmadapter->callbacks.moal_recv_packet(
+				pmadapter->pmoal_handle, daggr_mbuf);
+#ifdef UAP_SUPPORT
+		}
+#endif /* UAP_SUPPORT */
+		switch (ret) {
+		case MLAN_STATUS_PENDING:
+			break;
+		case MLAN_STATUS_FAILURE:
+			PRINTM(MERROR, "Deaggr, send to moal failed\n");
+			daggr_mbuf->status_code = MLAN_ERROR_PKT_INVALID;
+			/* fall through */
+		case MLAN_STATUS_SUCCESS:
+			wlan_recv_packet_complete(pmadapter, daggr_mbuf, ret);
+			break;
+		default:
+			break;
+		}
+
+		data += pkt_len + pad;
+	}
+	if (pmadapter->tp_state_on) {
+		pmadapter->callbacks.moal_get_system_time(
+			pmadapter->pmoal_handle, &out_ts_sec, &out_ts_usec);
+		delay += (t_s32)(out_ts_sec - in_ts_sec) * 1000000;
+		delay += (t_s32)(out_ts_usec - in_ts_usec);
+		pmadapter->callbacks.moal_amsdu_tp_accounting(
+			pmadapter->pmoal_handle, delay, copy_delay);
+	}
+
+done:
+	priv->msdu_in_rx_amsdu_cnt += pmbuf->use_count;
+	priv->amsdu_rx_cnt++;
+	/** we should free the aggr buffer after deaggr */
+	pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
+	LEAVE();
+	return ret;
+}
+
+#ifdef PCIEAW693
+/**
+ *  @brief Send amsdu subframe list to interface
+ *
+ *  @param priv     A pointer to mlan_private structure
+ *  @param pra_list Pointer to the RA List table containing the pointers
+ *                  to packets.
+ *  @param headroom Any interface specific headroom that may be need. TxPD
+ *                  will be formed leaving this headroom.
+ *  @param ptrindex Pointer index
+ *
+ *  @return     Final packet size or MLAN_STATUS_FAILURE
+ */
+static int wlan_send_amsdu_subframe_list(mlan_private *priv,
+					 raListTbl *pra_list, int headroom,
+					 int ptrindex)
+{
+	int pkt_size = 0;
+	pmlan_adapter pmadapter = priv->adapter;
+	mlan_buffer *pmbuf_src;
+	mlan_buffer *pmbuf_last = MNULL;
+	mlan_buffer *pmbuf_first = MNULL;
+	int pad = 0;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+#ifdef DEBUG_LEVEL1
+	t_u32 sec = 0, usec = 0;
+#endif
+	t_u32 max_amsdu_size = MIN(pra_list->max_amsdu, pmadapter->tx_buf_size);
+	t_u32 max_msdu_count = 0;
+	t_u32 msdu_in_tx_amsdu_cnt = 0;
+	ENTER();
+
+	max_msdu_count = pmadapter->ops.get_max_msdu_cnt(pmadapter);
+	pmbuf_src = (pmlan_buffer)util_peek_list(
+		pmadapter->pmoal_handle, &pra_list->buf_head, MNULL, MNULL);
+	if (pmbuf_src) {
+		pmbuf_first = pmbuf_src;
+	} else {
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+		goto exit;
+	}
+
+	wlan_wmm_consume_mpdu_budget(pra_list);
+
+	while (pmbuf_src &&
+	       ((pkt_size + (pmbuf_src->data_len + LLC_SNAP_LEN) + headroom) <=
+		max_amsdu_size) &&
+	       (msdu_in_tx_amsdu_cnt < max_msdu_count)) {
+		pmbuf_src =
+			(pmlan_buffer)util_dequeue_list(pmadapter->pmoal_handle,
+							&pra_list->buf_head,
+							MNULL, MNULL);
+		wlan_wmm_consume_byte_budget(pra_list, pmbuf_src);
+		/* Collects TP statistics */
+		if (pmadapter->tp_state_on &&
+		    (pkt_size > Tx_PD_SIZEOF(pmadapter)))
+			pmadapter->callbacks.moal_tp_accounting(
+				pmadapter->pmoal_handle, pmbuf_src, 3);
+		pra_list->total_pkts--;
+
+		/* decrement for every PDU taken from the list */
+		priv->wmm.pkts_queued[ptrindex]--;
+		util_scalar_decrement(pmadapter->pmoal_handle,
+				      &priv->wmm.tx_pkts_queued, MNULL, MNULL);
+
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+
+		if (pmbuf_src) {
+			pkt_size += wlan_form_amsdu_subframe(pmadapter,
+							     pmbuf_src, &pad);
+			util_enqueue_list_tail(pmadapter->pmoal_handle,
+					       &pmadapter->amsdu_txq,
+					       (pmlan_linked_list)pmbuf_src,
+					       MNULL, MNULL);
+			pmbuf_last = pmbuf_src;
+			priv->msdu_in_tx_amsdu_cnt++;
+			msdu_in_tx_amsdu_cnt++;
+		}
+		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+						    priv->wmm.ra_list_spinlock);
+
+		if (!wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
+			pmadapter->callbacks.moal_spin_unlock(
+				pmadapter->pmoal_handle,
+				priv->wmm.ra_list_spinlock);
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+
+		pmbuf_src =
+			(pmlan_buffer)util_peek_list(pmadapter->pmoal_handle,
+						     &pra_list->buf_head, MNULL,
+						     MNULL);
+	}
+
+	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
+					      priv->wmm.ra_list_spinlock);
+	if (!pmbuf_last) {
+		PRINTM(MERROR,
+		       "SG_AGGR ERROR: pkt_size=%d max_msdu_count=%d max_amsdu_size=%d msdu_in_tx_amsdu_cnt=%d\n",
+		       pkt_size, max_msdu_count, max_amsdu_size,
+		       msdu_in_tx_amsdu_cnt);
+		goto exit;
+	}
+	/* Last AMSDU packet does not need padding */
+	pkt_size -= pad;
+	pmbuf_last->data_len -= pad;
+
+	pkt_size += wlan_form_amsdu_txpd(priv, pmbuf_first, pkt_size);
+	/* Collects TP statistics */
+	if (pmadapter->tp_state_on) {
+		mlan_buffer mbuf;
+		mbuf.data_len = pkt_size;
+		pmadapter->callbacks.moal_tp_accounting(pmadapter->pmoal_handle,
+							&mbuf, 4);
+		pmadapter->callbacks.moal_tp_accounting_rx_param(
+			pmadapter->pmoal_handle, 5, msdu_in_tx_amsdu_cnt);
+	}
+	/* Drop Tx packets at drop point 4 */
+	if (pmadapter->tp_state_drop_point == 4) {
+		wlan_free_amsdu_txq(pmadapter);
+		goto exit;
+	}
+	ret = pmadapter->ops.send_data_list(pmadapter, MLAN_TYPE_DATA,
+					    msdu_in_tx_amsdu_cnt, pkt_size);
+
+	if (ret != MLAN_STATUS_RESOURCE) {
+		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+						    priv->wmm.ra_list_spinlock);
+		if (wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
+			priv->wmm.packets_out[ptrindex]++;
+			priv->wmm.tid_tbl_ptr[ptrindex].ra_list_curr = pra_list;
+		}
+		wlan_advance_bss_on_pkt_push(
+			pmadapter, &pmadapter->bssprio_tbl[priv->bss_priority]);
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+	}
+
+	PRINTM_GET_SYS_TIME(MDATA, &sec, &usec);
+	PRINTM_NETINTF(MDATA, priv);
+	PRINTM(MDATA, "%lu.%06lu : Data => FW\n", sec, usec);
+	priv->amsdu_tx_cnt++;
+exit:
+	LEAVE();
+	return pkt_size;
+}
+#endif
+/**
+ *  @brief Aggregate multiple packets into one single AMSDU packet
+ *
+ *  @param priv     A pointer to mlan_private structure
+ *  @param pra_list Pointer to the RA List table containing the pointers
+ *                  to packets.
+ *  @param headroom Any interface specific headroom that may be need. TxPD
+ *                  will be formed leaving this headroom.
+ *  @param ptrindex Pointer index
+ *
+ *  @return     Final packet size or MLAN_STATUS_FAILURE
+ */
+int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
+			   int headroom, int ptrindex)
+{
+	int pkt_size = 0;
+	pmlan_adapter pmadapter = priv->adapter;
+	mlan_buffer *pmbuf_aggr, *pmbuf_src;
+	t_u8 *data;
+	int pad = 0;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+#ifdef DEBUG_LEVEL1
+	t_u32 sec = 0, usec = 0;
+#endif
+	mlan_tx_param tx_param;
+#ifdef STA_SUPPORT
+	TxPD *ptx_pd = MNULL;
+#endif
+	t_u32 max_amsdu_size = MIN(pra_list->max_amsdu, pmadapter->tx_buf_size);
+	t_u32 msdu_in_tx_amsdu_cnt = 0;
+	ENTER();
+
+	PRINTM(MDAT_D, "Handling Aggr packet\n");
+
+#ifdef PCIEAW693
+	if (IS_PCIEAW693(pmadapter->card_type)) {
+		return wlan_send_amsdu_subframe_list(priv, pra_list, headroom,
+						     ptrindex);
+	}
+#endif
+	pmbuf_src = (pmlan_buffer)util_peek_list(
+		pmadapter->pmoal_handle, &pra_list->buf_head, MNULL, MNULL);
+	if (pmbuf_src) {
+		pmbuf_aggr = wlan_alloc_mlan_buffer(
+			pmadapter, pmadapter->tx_buf_size, headroom,
+			MOAL_MEM_FLAG_DIRTY | MOAL_MALLOC_BUFFER |
+				MOAL_MEM_FLAG_ATOMIC);
+		if (!pmbuf_aggr) {
+			PRINTM(MERROR, "Error allocating mlan_buffer\n");
+			pmadapter->callbacks.moal_spin_unlock(
+				pmadapter->pmoal_handle,
+				priv->wmm.ra_list_spinlock);
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+
+		data = pmbuf_aggr->pbuf + headroom;
+		pmbuf_aggr->bss_index = pmbuf_src->bss_index;
+		pmbuf_aggr->buf_type = pmbuf_src->buf_type;
+		pmbuf_aggr->priority = pmbuf_src->priority;
+		pmbuf_aggr->pbuf = data;
+		pmbuf_aggr->data_offset = 0;
+		pmbuf_aggr->in_ts_sec = pmbuf_src->in_ts_sec;
+		pmbuf_aggr->in_ts_usec = pmbuf_src->in_ts_usec;
+		pmbuf_aggr->extra_ts_sec = pmbuf_src->extra_ts_sec;
+		pmbuf_aggr->extra_ts_usec = pmbuf_src->extra_ts_usec;
+		if (pmbuf_src->flags & MLAN_BUF_FLAG_TDLS)
+			pmbuf_aggr->flags |= MLAN_BUF_FLAG_TDLS;
+		if (pmbuf_src->flags & MLAN_BUF_FLAG_TCP_ACK)
+			pmbuf_aggr->flags |= MLAN_BUF_FLAG_TCP_ACK;
+
+		if (pmbuf_src->flags & MLAN_BUF_FLAG_EASYMESH) {
+			pmbuf_aggr->flags |= MLAN_BUF_FLAG_EASYMESH;
+			memcpy_ext(priv->adapter, pmbuf_aggr->mac,
+				   pmbuf_src->mac, MLAN_MAC_ADDR_LENGTH,
+				   MLAN_MAC_ADDR_LENGTH);
+		}
+		/* Form AMSDU */
+		wlan_11n_form_amsdu_txpd(priv, pmbuf_aggr);
+		pkt_size = Tx_PD_SIZEOF(pmadapter);
+#ifdef STA_SUPPORT
+		if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA)
+			ptx_pd = (TxPD *)pmbuf_aggr->pbuf;
+#endif
+		priv->msdu_in_tx_amsdu_cnt++;
+	} else {
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+		goto exit;
+	}
+
+	wlan_wmm_consume_mpdu_budget(pra_list);
+
+	while (pmbuf_src && ((pkt_size + (pmbuf_src->data_len + LLC_SNAP_LEN) +
+			      headroom) <= max_amsdu_size)) {
+		pmbuf_src =
+			(pmlan_buffer)util_dequeue_list(pmadapter->pmoal_handle,
+							&pra_list->buf_head,
+							MNULL, MNULL);
+		wlan_wmm_consume_byte_budget(pra_list, pmbuf_src);
+		/* Collects TP statistics */
+		if (pmadapter->tp_state_on &&
+		    (pkt_size > Tx_PD_SIZEOF(pmadapter)))
+			pmadapter->callbacks.moal_tp_accounting(
+				pmadapter->pmoal_handle, pmbuf_src, 3);
+		pra_list->total_pkts--;
+
+		/* decrement for every PDU taken from the list */
+		priv->wmm.pkts_queued[ptrindex]--;
+		util_scalar_decrement(pmadapter->pmoal_handle,
+				      &priv->wmm.tx_pkts_queued, MNULL, MNULL);
+
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+
+		if (pmbuf_src) {
+			pkt_size += wlan_11n_form_amsdu_pkt(
+				pmadapter, (data + pkt_size),
+				pmbuf_src->pbuf + pmbuf_src->data_offset,
+				pmbuf_src->data_len, &pad);
+
+			DBG_HEXDUMP(MDAT_D, "pmbuf_src", pmbuf_src,
+				    sizeof(mlan_buffer));
+			wlan_write_data_complete(pmadapter, pmbuf_src,
+						 MLAN_STATUS_SUCCESS);
+		}
+
+		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+						    priv->wmm.ra_list_spinlock);
+
+		if (!wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
+			pmadapter->callbacks.moal_spin_unlock(
+				pmadapter->pmoal_handle,
+				priv->wmm.ra_list_spinlock);
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+
+		pmbuf_src =
+			(pmlan_buffer)util_peek_list(pmadapter->pmoal_handle,
+						     &pra_list->buf_head, MNULL,
+						     MNULL);
+		priv->msdu_in_tx_amsdu_cnt++;
+		msdu_in_tx_amsdu_cnt++;
+	}
+
+	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
+					      priv->wmm.ra_list_spinlock);
+
+	/* Last AMSDU packet does not need padding */
+	pkt_size -= pad;
+	pmbuf_aggr->data_len = pkt_size;
+	wlan_11n_update_pktlen_amsdu_txpd(priv, pmbuf_aggr);
+	pmbuf_aggr->data_len += headroom;
+	pmbuf_aggr->pbuf = data - headroom;
+	tx_param.next_pkt_len =
+		((pmbuf_src) ? pmbuf_src->data_len + Tx_PD_SIZEOF(pmadapter) :
+			       0);
+	/* Collects TP statistics */
+	if (pmadapter->tp_state_on) {
+		pmadapter->callbacks.moal_tp_accounting(pmadapter->pmoal_handle,
+							pmbuf_aggr, 4);
+		pmadapter->callbacks.moal_tp_accounting_rx_param(
+			pmadapter->pmoal_handle, 5, msdu_in_tx_amsdu_cnt);
+	}
+
+	/* Drop Tx packets at drop point 4 */
+	if (pmadapter->tp_state_drop_point == 4) {
+		wlan_write_data_complete(pmadapter, pmbuf_aggr, ret);
+		goto exit;
+	} else
+		ret = pmadapter->ops.host_to_card(priv, MLAN_TYPE_DATA,
+						  pmbuf_aggr, &tx_param);
+	switch (ret) {
+#ifdef USB
+	case MLAN_STATUS_PRESOURCE:
+		PRINTM(MINFO, "MLAN_STATUS_PRESOURCE is returned\n");
+		break;
+#endif
+	case MLAN_STATUS_RESOURCE:
+		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+						    priv->wmm.ra_list_spinlock);
+
+		if (!wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
+			pmadapter->callbacks.moal_spin_unlock(
+				pmadapter->pmoal_handle,
+				priv->wmm.ra_list_spinlock);
+			pmbuf_aggr->status_code = MLAN_ERROR_PKT_INVALID;
+			wlan_write_data_complete(pmadapter, pmbuf_aggr,
+						 MLAN_STATUS_FAILURE);
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+#ifdef STA_SUPPORT
+		/* reset tx_lock_flag */
+		if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) &&
+		    pmadapter->pps_uapsd_mode &&
+		    (pmadapter->tx_lock_flag == MTRUE)) {
+			pmadapter->tx_lock_flag = MFALSE;
+			if (ptx_pd != MNULL)
+				ptx_pd->flags = 0;
+		}
+#endif
+		util_enqueue_list_head(pmadapter->pmoal_handle,
+				       &pra_list->buf_head,
+				       (pmlan_linked_list)pmbuf_aggr, MNULL,
+				       MNULL);
+
+		pra_list->total_pkts++;
+
+		/* add back only one: aggregated packet is requeued as one */
+		priv->wmm.pkts_queued[ptrindex]++;
+		util_scalar_increment(pmadapter->pmoal_handle,
+				      &priv->wmm.tx_pkts_queued, MNULL, MNULL);
+		pmbuf_aggr->flags |= MLAN_BUF_FLAG_REQUEUED_PKT;
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+		PRINTM(MINFO, "MLAN_STATUS_RESOURCE is returned\n");
+		pmbuf_aggr->status_code = MLAN_ERROR_PKT_INVALID;
+		break;
+	case MLAN_STATUS_FAILURE:
+		pmbuf_aggr->status_code = MLAN_ERROR_DATA_TX_FAIL;
+		pmadapter->dbg.num_tx_host_to_card_failure++;
+		wlan_write_data_complete(pmadapter, pmbuf_aggr, ret);
+		goto exit;
+	case MLAN_STATUS_PENDING:
+		break;
+	case MLAN_STATUS_SUCCESS:
+		wlan_write_data_complete(pmadapter, pmbuf_aggr, ret);
+		break;
+	default:
+		break;
+	}
+	if (ret != MLAN_STATUS_RESOURCE) {
+		pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+						    priv->wmm.ra_list_spinlock);
+		if (wlan_is_ralist_valid(priv, pra_list, ptrindex)) {
+			priv->wmm.packets_out[ptrindex]++;
+			priv->wmm.tid_tbl_ptr[ptrindex].ra_list_curr = pra_list;
+		}
+
+		wlan_advance_bss_on_pkt_push(
+			pmadapter, &pmadapter->bssprio_tbl[priv->bss_priority]);
+
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+	}
+	PRINTM_GET_SYS_TIME(MDATA, &sec, &usec);
+	PRINTM_NETINTF(MDATA, priv);
+	PRINTM(MDATA, "%lu.%06lu : Data => FW\n", sec, usec);
+	priv->amsdu_tx_cnt++;
+
+exit:
+	LEAVE();
+	return MIN((pkt_size + headroom), INT_MAX);
+}
diff --git a/wlan_src/mlan/mlan_11n_aggr.h b/wlan_src/mlan/mlan_11n_aggr.h
new file mode 100644
index 0000000..2973f72
--- /dev/null
+++ b/wlan_src/mlan/mlan_11n_aggr.h
@@ -0,0 +1,47 @@
+/** @file mlan_11n_aggr.h
+ *
+ *  @brief This file contains related macros, enum, and struct
+ *  of 11n aggregation functionalities
+ *
+ *
+ *  Copyright 2008-2021 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/********************************************************
+Change log:
+    11/10/2008: initial version
+********************************************************/
+
+#ifndef _MLAN_11N_AGGR_H_
+#define _MLAN_11N_AGGR_H_
+
+/** Aggregate 11N packets */
+mlan_status wlan_11n_deaggregate_pkt(pmlan_private priv, pmlan_buffer pmbuf);
+/** Deaggregate 11N packets */
+int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *ptr, int headroom,
+			   int ptrindex);
+
+#endif /* !_MLAN_11N_AGGR_H_ */
diff --git a/wlan_sd8987/mlan/mlan_11n_rxreorder.c b/wlan_src/mlan/mlan_11n_rxreorder.c
old mode 100755
new mode 100644
similarity index 89%
rename from wlan_sd8987/mlan/mlan_11n_rxreorder.c
rename to wlan_src/mlan/mlan_11n_rxreorder.c
index 27b94bf..b7ae763
--- a/wlan_sd8987/mlan/mlan_11n_rxreorder.c
+++ b/wlan_src/mlan/mlan_11n_rxreorder.c
@@ -6,18 +6,27 @@
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -134,13 +143,13 @@
 static void mlan_11n_rxreorder_timer_restart(pmlan_adapter pmadapter,
 					     RxReorderTbl *rx_reor_tbl_ptr)
 {
-	t_u16 min_flush_time = 0;
+	t_u16 min_flush_time = pmadapter->flush_time_ac_be_bk;
+	mlan_wmm_ac_e wmm_ac;
 	ENTER();
 
-	if (rx_reor_tbl_ptr->win_size >= 32)
-		min_flush_time = MIN_FLUSH_TIMER_15_MS;
-	else
-		min_flush_time = MIN_FLUSH_TIMER_MS;
+	wmm_ac = wlan_wmm_convert_tos_to_ac(pmadapter, rx_reor_tbl_ptr->tid);
+	if ((WMM_AC_VI == wmm_ac) || (WMM_AC_VO == wmm_ac))
+		min_flush_time = pmadapter->flush_time_ac_vi_vo;
 
 	if (rx_reor_tbl_ptr->timer_context.timer_is_set)
 		pmadapter->callbacks.moal_stop_timer(
@@ -149,7 +158,7 @@
 
 	pmadapter->callbacks.moal_start_timer(
 		pmadapter->pmoal_handle, rx_reor_tbl_ptr->timer_context.timer,
-		MFALSE, (rx_reor_tbl_ptr->win_size * min_flush_time));
+		MFALSE, min_flush_time);
 
 	rx_reor_tbl_ptr->timer_context.timer_is_set = MTRUE;
 	LEAVE();
@@ -168,7 +177,7 @@
 static mlan_status wlan_11n_dispatch_pkt_until_start_win(
 	t_void *priv, RxReorderTbl *rx_reor_tbl_ptr, int start_win)
 {
-	int no_pkt_to_send, i, xchg;
+	t_u32 no_pkt_to_send, i, xchg;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	void *rx_tmp_ptr = MNULL;
 	mlan_private *pmpriv = (mlan_private *)priv;
@@ -208,6 +217,13 @@
 		rx_reor_tbl_ptr->rx_reorder_ptr[no_pkt_to_send + i] = MNULL;
 	}
 
+	/* clear the bits of reorder bitmap that has been dispatched */
+	if (no_pkt_to_send < (8 * (sizeof(rx_reor_tbl_ptr->bitmap))))
+		rx_reor_tbl_ptr->bitmap =
+			rx_reor_tbl_ptr->bitmap >> no_pkt_to_send;
+	else
+		rx_reor_tbl_ptr->bitmap = 0;
+
 	rx_reor_tbl_ptr->start_win = start_win;
 	pmpriv->adapter->callbacks.moal_spin_unlock(
 		pmpriv->adapter->pmoal_handle, pmpriv->rx_pkt_lock);
@@ -286,6 +302,12 @@
 		}
 	}
 
+	/* clear the bits of reorder bitmap that has been dispatched */
+	if (i < (8 * sizeof(rx_reor_tbl_ptr->bitmap)))
+		rx_reor_tbl_ptr->bitmap = rx_reor_tbl_ptr->bitmap >> i;
+	else
+		rx_reor_tbl_ptr->bitmap = 0;
+
 	rx_reor_tbl_ptr->start_win =
 		(rx_reor_tbl_ptr->start_win + i) & (MAX_TID_VALUE - 1);
 
@@ -517,6 +539,8 @@
 	new_node->win_size = win_size;
 	new_node->force_no_drop = MFALSE;
 	new_node->check_start_win = MTRUE;
+	new_node->bitmap = 0;
+
 	new_node->ba_status = BA_STREAM_SETUP_INPROGRESS;
 	for (i = 0; i < win_size; ++i)
 		new_node->rx_reorder_ptr[i] = MNULL;
@@ -622,6 +646,54 @@
 #endif
 	return priv->addba_reject[tid];
 }
+
+/**
+ *  @brief This function handles the command response of
+ *          delete a block ack request
+ *
+ *  @param priv		A pointer to mlan_private structure
+ *  @param addba	A pointer to addba buffer
+ *
+ *  @return        N/A
+ */
+mlan_status wlan_11n_add_bastream(mlan_private *priv, t_u8 *addba)
+{
+	HostCmd_DS_11N_ADDBA_REQ *pevt_addba_req =
+		(HostCmd_DS_11N_ADDBA_REQ *)addba;
+	RxReorderTbl *rx_reor_tbl_ptr = MNULL;
+	t_u16 block_ack_param_set;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int tid;
+
+	ENTER();
+
+	DBG_HEXDUMP(MCMD_D, "addba req", (t_u8 *)addba,
+		    sizeof(HostCmd_DS_11N_ADDBA_REQ));
+	if (priv->adapter->scan_processing) {
+		PRINTM(MERROR,
+		       "Scan in progress, ignore ADDBA Request event\n");
+		LEAVE();
+		return ret;
+	}
+	block_ack_param_set =
+		wlan_le16_to_cpu(pevt_addba_req->block_ack_param_set);
+	tid = (block_ack_param_set & BLOCKACKPARAM_TID_MASK) >>
+	      BLOCKACKPARAM_TID_POS;
+	rx_reor_tbl_ptr = wlan_11n_get_rxreorder_tbl(
+		priv, tid, pevt_addba_req->peer_mac_addr);
+	if (rx_reor_tbl_ptr &&
+	    (rx_reor_tbl_ptr->ba_status != BA_STREAM_SETUP_COMPLETE)) {
+		PRINTM(MCMND,
+		       "BA setup in progress, ignore ADDBA Request event\n");
+		LEAVE();
+		return ret;
+	}
+	ret = wlan_prepare_cmd(priv, HostCmd_CMD_11N_ADDBA_RSP,
+			       HostCmd_ACT_GEN_SET, 0, MNULL, addba);
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief This function prepares command for adding a block ack
  *          response.
@@ -640,7 +712,7 @@
 	HostCmd_DS_11N_ADDBA_REQ *pevt_addba_req =
 		(HostCmd_DS_11N_ADDBA_REQ *)pdata_buf;
 	t_u8 tid = 0;
-	int win_size = 0;
+	t_u32 win_size = 0;
 
 	ENTER();
 
@@ -685,21 +757,26 @@
 	else
 		padd_ba_rsp->status_code =
 			wlan_cpu_to_le16(ADDBA_RSP_STATUS_ACCEPT);
+
+	win_size = (padd_ba_rsp->block_ack_param_set &
+		    BLOCKACKPARAM_WINSIZE_MASK) >>
+		   BLOCKACKPARAM_WINSIZE_POS;
+
 	padd_ba_rsp->block_ack_param_set &= ~BLOCKACKPARAM_WINSIZE_MASK;
 	if (!priv->add_ba_param.rx_amsdu)
 		/* We do not support AMSDU inside AMPDU, hence reset the bit */
 		padd_ba_rsp->block_ack_param_set &=
 			~BLOCKACKPARAM_AMSDU_SUPP_MASK;
 
-	padd_ba_rsp->block_ack_param_set |=
-		(priv->add_ba_param.rx_win_size << BLOCKACKPARAM_WINSIZE_POS);
-	win_size = (padd_ba_rsp->block_ack_param_set &
-		    BLOCKACKPARAM_WINSIZE_MASK) >>
-		   BLOCKACKPARAM_WINSIZE_POS;
+	/*cert failure observed due to BA setup failure
+	 if win_size requested from client is 0 */
+	if (win_size)
+		win_size = MIN(win_size, priv->add_ba_param.rx_win_size);
+	else
+		win_size = priv->add_ba_param.rx_win_size;
 
-	if (win_size == 0)
-		padd_ba_rsp->status_code =
-			wlan_cpu_to_le16(ADDBA_RSP_STATUS_DECLINED);
+	padd_ba_rsp->block_ack_param_set |= win_size
+					    << BLOCKACKPARAM_WINSIZE_POS;
 
 	padd_ba_rsp->block_ack_param_set =
 		wlan_cpu_to_le16(padd_ba_rsp->block_ack_param_set);
@@ -793,6 +870,11 @@
 			PRINTM(MDAT_D, "AMSDU ");
 
 		if (rx_reor_tbl_ptr->check_start_win) {
+			PRINTM(MDAT_D,
+			       "0:seq_num %d start_win %d win_size %d last_seq %d\n",
+			       seq_num, rx_reor_tbl_ptr->start_win,
+			       rx_reor_tbl_ptr->win_size,
+			       rx_reor_tbl_ptr->last_seq);
 			if (seq_num == rx_reor_tbl_ptr->start_win)
 				rx_reor_tbl_ptr->check_start_win = MFALSE;
 			else {
@@ -960,6 +1042,8 @@
 				rx_reor_tbl_ptr
 					->rx_reorder_ptr[seq_num - start_win] =
 					payload;
+				MLAN_SET_BIT(rx_reor_tbl_ptr->bitmap,
+					     seq_num - start_win);
 			} else { /* Wrap condition */
 				if (rx_reor_tbl_ptr
 					    ->rx_reorder_ptr[(seq_num +
@@ -973,6 +1057,9 @@
 					->rx_reorder_ptr[(seq_num +
 							  (MAX_TID_VALUE)) -
 							 start_win] = payload;
+				MLAN_SET_BIT(rx_reor_tbl_ptr->bitmap,
+					     (seq_num + (MAX_TID_VALUE)) -
+						     start_win);
 			}
 		}
 
@@ -988,11 +1075,20 @@
 	}
 
 done:
-	if (!rx_reor_tbl_ptr->timer_context.timer_is_set ||
-	    (prev_start_win != rx_reor_tbl_ptr->start_win)) {
-		mlan_11n_rxreorder_timer_restart(pmadapter, rx_reor_tbl_ptr);
+	if (rx_reor_tbl_ptr->bitmap == 0) {
+		if (rx_reor_tbl_ptr->timer_context.timer_is_set) {
+			pmadapter->callbacks.moal_stop_timer(
+				pmadapter->pmoal_handle,
+				rx_reor_tbl_ptr->timer_context.timer);
+			rx_reor_tbl_ptr->timer_context.timer_is_set = MFALSE;
+		}
+	} else {
+		if (!rx_reor_tbl_ptr->timer_context.timer_is_set ||
+		    (prev_start_win != rx_reor_tbl_ptr->start_win)) {
+			mlan_11n_rxreorder_timer_restart(pmadapter,
+							 rx_reor_tbl_ptr);
+		}
 	}
-
 	LEAVE();
 	return ret;
 }
@@ -1027,7 +1123,7 @@
 		cleanup_rx_reorder_tbl = (initiator) ? MFALSE : MTRUE;
 
 	PRINTM(MEVENT,
-	       "delete_bastream_tbl: " MACSTR " tid=%d, type=%d"
+	       "delete_bastream_tbl: " MACSTR " tid=%d, type=%d "
 	       "initiator=%d reason=%d\n",
 	       MAC2STR(peer_mac), tid, type, initiator, reason_code);
 
@@ -1062,14 +1158,13 @@
 					ra_list->del_ba_count = 0;
 				else
 					ra_list->del_ba_count++;
-				ra_list->packet_count = 0;
+			}
+			ra_list->packet_count = 0;
 /** after delba, we will try to set up BA again after sending 1k packets*/
 #define MIN_BA_SETUP_PACKET_REQIRED 1024
-				ra_list->ba_packet_threshold =
-					MIN_BA_SETUP_PACKET_REQIRED +
-					wlan_get_random_ba_threshold(
-						priv->adapter);
-			}
+			ra_list->ba_packet_threshold =
+				MIN_BA_SETUP_PACKET_REQIRED +
+				wlan_get_random_ba_threshold(priv->adapter);
 		}
 	}
 
@@ -1162,6 +1257,13 @@
 
 	DBG_HEXDUMP(MCMD_D, "Event:", (t_u8 *)event, 20);
 
+	if (event->origninator &&
+	    !wlan_11n_get_txbastream_tbl(priv, event->tid, event->peer_mac_addr,
+					 MFALSE)) {
+		LEAVE();
+		return;
+	}
+
 	memset(priv->adapter, &delba, 0, sizeof(HostCmd_DS_11N_DELBA));
 	memcpy_ext(priv->adapter, delba.peer_mac_addr, event->peer_mac_addr,
 		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
@@ -1445,6 +1547,9 @@
 					priv->add_ba_param.rx_win_size =
 						MLAN_WFD_COEX_AMPDU_DEF_RXWINSIZE;
 #endif
+				if (priv->bss_type == MLAN_BSS_TYPE_NAN)
+					priv->add_ba_param.rx_win_size =
+						MLAN_NAN_COEX_AMPDU_DEF_RXWINSIZE;
 #ifdef UAP_SUPPORT
 				if (priv->bss_type == MLAN_BSS_TYPE_UAP)
 					priv->add_ba_param.rx_win_size =
diff --git a/wlan_sd8987/mlan/mlan_11n_rxreorder.h b/wlan_src/mlan/mlan_11n_rxreorder.h
old mode 100755
new mode 100644
similarity index 72%
rename from wlan_sd8987/mlan/mlan_11n_rxreorder.h
rename to wlan_src/mlan/mlan_11n_rxreorder.h
index d409e85..9293251
--- a/wlan_sd8987/mlan/mlan_11n_rxreorder.h
+++ b/wlan_src/mlan/mlan_11n_rxreorder.h
@@ -6,18 +6,27 @@
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -82,6 +91,7 @@
 void mlan_11n_delete_bastream_tbl(mlan_private *priv, int tid,
 				  t_u8 *PeerMACAddr, t_u8 type, int initiator,
 				  t_u16 reason_code);
+mlan_status wlan_11n_add_bastream(mlan_private *priv, t_u8 *addba);
 void wlan_11n_ba_stream_timeout(mlan_private *priv,
 				HostCmd_DS_11N_BATIMEOUT *event);
 mlan_status wlan_ret_11n_addba_resp(mlan_private *priv,
diff --git a/wlan_sd8987/mlan/mlan_cfp.c b/wlan_src/mlan/mlan_cfp.c
old mode 100755
new mode 100644
similarity index 91%
rename from wlan_sd8987/mlan/mlan_cfp.c
rename to wlan_src/mlan/mlan_cfp.c
index 899df13..87cc9e3
--- a/wlan_sd8987/mlan/mlan_cfp.c
+++ b/wlan_src/mlan/mlan_cfp.c
@@ -5,20 +5,29 @@
  *  related code
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -32,6 +41,7 @@
 #include "mlan_fw.h"
 #include "mlan_join.h"
 #include "mlan_main.h"
+#include "mlan_11h.h"
 
 /********************************************************
  *			Local Variables
@@ -82,12 +92,13 @@
 	{"KR", 0x30, 0x30}, /* Republic Of Korea */
 	{"JP", 0xFF, 0x40}, /* Japan       */
 	{"CN", 0x30, 0x50}, /* China       */
+	{"TW", 0x30, 0x30}, /* TW support  */
 	{"BR", 0x01, 0x09}, /* Brazil      */
 	{"RU", 0x30, 0x0f}, /* Russia      */
 	{"IN", 0x10, 0x06}, /* India       */
 	{"MY", 0x30, 0x06}, /* Malaysia    */
 	{"NZ", 0x30, 0x30}, /* New Zeland  */
-	{"MX", 0x10, 0x07}, /* Mexico */
+	{"MX", 0x30, 0x07}, /* Mexico */
 };
 
 /** Country code for ETSI */
@@ -397,6 +408,7 @@
 	{132, 5660, WLAN_TX_PWR_EMEA_DEFAULT, MTRUE, {0x13, 0, 0}},
 	{136, 5680, WLAN_TX_PWR_EMEA_DEFAULT, MTRUE, {0x13, 0, 0}},
 	{140, 5700, WLAN_TX_PWR_EMEA_DEFAULT, MTRUE, {0x13, 0, 0}},
+	{144, 5720, WLAN_TX_PWR_EMEA_DEFAULT, MTRUE, {0x13, 0, 0}},
 	{149, 5745, WLAN_TX_PWR_EMEA_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{153, 5765, WLAN_TX_PWR_EMEA_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{157, 5785, WLAN_TX_PWR_EMEA_DEFAULT, MFALSE, {0x10, 0, 0}},
@@ -578,10 +590,10 @@
 	{40, 5200, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{44, 5220, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{48, 5240, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
-	{52, 5260, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
-	{56, 5280, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
-	{60, 5300, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
-	{64, 5320, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
+	{52, 5260, WLAN_TX_PWR_DEFAULT, MTRUE, {0x10, 0, 0}},
+	{56, 5280, WLAN_TX_PWR_DEFAULT, MTRUE, {0x10, 0, 0}},
+	{60, 5300, WLAN_TX_PWR_DEFAULT, MTRUE, {0x10, 0, 0}},
+	{64, 5320, WLAN_TX_PWR_DEFAULT, MTRUE, {0x10, 0, 0}},
 	{149, 5745, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{153, 5765, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
 	{157, 5785, WLAN_TX_PWR_DEFAULT, MFALSE, {0x10, 0, 0}},
@@ -978,30 +990,6 @@
 t_u16 cfp_code_index_a[MRVDRV_MAX_CFP_CODE_A] = {0x1, 0x2, 0x3, 0x4, 0x5};
 
 /**
- * The rates supported for ad-hoc B mode
- */
-t_u8 AdhocRates_B[B_SUPPORTED_RATES] = {0x82, 0x84, 0x8b, 0x96, 0};
-
-/**
- * The rates supported for ad-hoc G mode
- */
-t_u8 AdhocRates_G[G_SUPPORTED_RATES] = {0x8c, 0x12, 0x98, 0x24, 0xb0,
-					0x48, 0x60, 0x6c, 0x00};
-
-/**
- * The rates supported for ad-hoc BG mode
- */
-t_u8 AdhocRates_BG[BG_SUPPORTED_RATES] = {0x82, 0x84, 0x8b, 0x96, 0x0c,
-					  0x12, 0x18, 0x24, 0x30, 0x48,
-					  0x60, 0x6c, 0x00};
-
-/**
- * The rates supported in A mode for ad-hoc
- */
-t_u8 AdhocRates_A[A_SUPPORTED_RATES] = {0x8c, 0x12, 0x98, 0x24, 0xb0,
-					0x48, 0x60, 0x6c, 0x00};
-
-/**
  * The rates supported in A mode (used for BAND_A)
  */
 t_u8 SupportedRates_A[A_SUPPORTED_RATES] = {0x0c, 0x12, 0x18, 0x24, 0xb0,
@@ -2203,7 +2191,7 @@
  *
  *  @return                 BAND_B|BAND_G|BAND_A
  */
-t_u16 wlan_convert_config_bands(t_u16 config_bands)
+static t_u16 wlan_convert_config_bands(t_u16 config_bands)
 {
 	t_u16 bands = 0;
 	if (config_bands & BAND_B)
@@ -2266,30 +2254,6 @@
 			k = wlan_copy_rates(rates, k, SupportedRates_A,
 					    sizeof(SupportedRates_A));
 		}
-	} else {
-		/* Adhoc. mode */
-		if (bands == BAND_B) {
-			/* B only */
-			PRINTM(MINFO, "Band: Adhoc B\n");
-			k = wlan_copy_rates(rates, k, AdhocRates_B,
-					    sizeof(AdhocRates_B));
-		} else if (bands == BAND_G) {
-			/* G only */
-			PRINTM(MINFO, "Band: Adhoc G\n");
-			k = wlan_copy_rates(rates, k, AdhocRates_G,
-					    sizeof(AdhocRates_G));
-
-		} else if (bands & BAND_A) {
-			/* support A */
-			PRINTM(MINFO, "Band: Adhoc A\n");
-			k = wlan_copy_rates(rates, k, AdhocRates_A,
-					    sizeof(AdhocRates_A));
-
-		} else {
-			PRINTM(MINFO, "Band: Adhoc BG\n");
-			k = wlan_copy_rates(rates, k, AdhocRates_BG,
-					    sizeof(AdhocRates_BG));
-		}
 	}
 
 	LEAVE();
@@ -2459,11 +2423,12 @@
  *  @param pmpriv             A pointer to mlan_private structure
  *  @param channel            Channel number
  *  @param oper_class         operating class
+ *  @param bandwidth          band width
  *
  *  @return                   MLAN_STATUS_PENDING --success, otherwise fail
  */
 mlan_status wlan_check_operclass_validation(mlan_private *pmpriv, t_u8 channel,
-					    t_u8 oper_class)
+					    t_u8 oper_class, t_u8 bandwidth)
 {
 	int arraysize = 0, i = 0, channum = 0;
 	oper_bw_chan *poper_bw_chan = MNULL;
@@ -2486,7 +2451,7 @@
 	}
 	if (oper_class >= 128) {
 		center_freq_idx = wlan_get_center_freq_idx(
-			pmpriv, BAND_AAC, channel, CHANNEL_BW_80MHZ);
+			pmpriv, BAND_5GHZ, channel, CHANNEL_BW_80MHZ);
 		channel = center_freq_idx;
 	}
 	poper_bw_chan = wlan_get_nonglobal_operclass_table(pmpriv, &arraysize);
@@ -2556,7 +2521,7 @@
 	}
 	if (bw == BW_80MHZ) {
 		center_freq_idx = wlan_get_center_freq_idx(
-			pmpriv, BAND_AAC, channel, CHANNEL_BW_80MHZ);
+			pmpriv, BAND_5GHZ, channel, CHANNEL_BW_80MHZ);
 		channel = center_freq_idx;
 	}
 
@@ -2594,14 +2559,16 @@
 int wlan_add_supported_oper_class_ie(mlan_private *pmpriv, t_u8 **pptlv_out,
 				     t_u8 curr_oper_class)
 {
-	t_u8 oper_class_us[] = {1,  2,	3,  4,	5,  12, 22, 23,	 24,  25, 26,
-				27, 28, 29, 30, 31, 32, 33, 128, 129, 130};
-	t_u8 oper_class_eu[] = {1, 2,  3,  4,  5,  6,	7,   8,
-				9, 10, 11, 12, 17, 128, 129, 130};
-	t_u8 oper_class_jp[] = {1,  30, 31, 32, 33,  34,  35, 36,
-				37, 38, 39, 40, 41,  42,  43, 44,
-				45, 56, 57, 58, 128, 129, 130};
-	t_u8 oper_class_cn[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 128, 129, 130};
+	t_u8 oper_class_us[] = {115, 118, 124, 121, 125, 81,  116,
+				119, 122, 126, 126, 117, 120, 123,
+				127, 127, 83,  84,  128, 129, 130};
+	t_u8 oper_class_eu[] = {115, 118, 121, 81, 116, 119, 122, 117,
+				120, 123, 83,  84, 125, 128, 129, 130};
+	t_u8 oper_class_jp[] = {115, 81,  82,  118, 118, 121, 121, 116,
+				119, 119, 122, 122, 117, 120, 120, 123,
+				123, 83,  84,  121, 128, 129, 130};
+	t_u8 oper_class_cn[] = {115, 118, 125, 116, 119, 126,
+				81,  83,  84,  128, 129, 130};
 	t_u8 country_code[][COUNTRY_CODE_LEN] = {"US", "JP", "CN"};
 	int country_id = 0, ret = 0;
 	MrvlIETypes_SuppOperClass_t *poper_class = MNULL;
@@ -2711,11 +2678,12 @@
 
 		if ((j < MAX_REGION_CHANNEL_NUM) &&
 		    (region_chan_old[j].valid == MTRUE)) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no,
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
 					      region_chan_old[j].pcfp,
 					      region_chan_old[j].num_cfp);
 		} else if (cfp) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no, MNULL, 0);
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
+					      MNULL, 0);
 		}
 		i++;
 	}
@@ -2743,11 +2711,12 @@
 				break;
 		}
 		if ((j < MAX_REGION_CHANNEL_NUM) && region_chan_old[j].valid) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no,
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
 					      region_chan_old[j].pcfp,
 					      region_chan_old[j].num_cfp);
 		} else if (cfp) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no, MNULL, 0);
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
+					      MNULL, 0);
 		}
 		i++;
 	}
@@ -3263,6 +3232,140 @@
 }
 
 /**
+ *  @brief	        Set max tx power value per channel in otp tables
+ *
+ *  @param pmapdater	a pointer to mlan_adapter structure
+ *  @param is6g	        6g table true or false
+ *
+ *  @return
+ *    None
+ */
+static void wlan_set_otp_cfp_max_tx_pwr(mlan_adapter *pmadapter, t_bool is6g)
+{
+	t_u8 i, j, k, n;
+	t_u8 rows, cols, max = 0;
+	t_u8 bonded_chan_count = 0;
+
+	if (!pmadapter->otp_region)
+		return;
+
+	if (!is6g && pmadapter->cfp_otp_bg && pmadapter->tx_power_table_bg) {
+		rows = pmadapter->tx_power_table_bg_rows;
+		cols = pmadapter->tx_power_table_bg_cols;
+		if (pmadapter->tx_power_table_bg_size < (rows * cols))
+			goto table_a;
+		max = 0;
+		for (i = 0; i < rows; i++) {
+			if ((pmadapter->cfp_otp_bg + i)->dynamic.flags &
+			    NXP_CHANNEL_DISABLED)
+				continue;
+
+			/* Get the max value among all mod groups for this chan
+			 */
+			for (j = 1; j < cols; j++) {
+				max = MAX(
+					max,
+					pmadapter->tx_power_table_bg[i * cols +
+								     j]);
+			}
+
+			bonded_chan_count++;
+			/* As the BG band allows overlapping 40MHz
+			 * bonded groups, keep comparing the max value
+			 * with the next consecutive 40Mhz channel, if
+			 * all of below 4 cases are true:
+			 *   1. this is not the last row
+			 *   2. this channel suports 40 MHz
+			 *   3. the next channel also supports 40MHz
+			 *   4. the next channel is not disabled
+			 */
+			if ((i < (rows - 1)) &&
+			    (!((pmadapter->cfp_otp_bg + i)->dynamic.flags &
+			       NXP_CHANNEL_NOHT40)) &&
+			    (!((pmadapter->cfp_otp_bg + i + 1)->dynamic.flags &
+			       NXP_CHANNEL_NOHT40)) &&
+			    (!((pmadapter->cfp_otp_bg + i + 1)->dynamic.flags &
+			       NXP_CHANNEL_DISABLED))) {
+				continue;
+			}
+			/* Apply the max power value to all channels in this
+			 * bonded group
+			 */
+			for (k = 0; k < bonded_chan_count; k++) {
+				(pmadapter->cfp_otp_bg + i - k)->max_tx_power =
+					max;
+			}
+			max = 0;
+			bonded_chan_count = 0;
+		}
+	}
+table_a:
+	if (!is6g && pmadapter->cfp_otp_a && pmadapter->tx_power_table_a) {
+		rows = pmadapter->tx_power_table_a_rows;
+		cols = pmadapter->tx_power_table_a_cols;
+		if (pmadapter->tx_power_table_a_size < (rows * cols))
+			return;
+		max = 0;
+		bonded_chan_count = 0;
+		for (i = 0; i < rows; i++) {
+			if ((pmadapter->cfp_otp_a + i)->dynamic.flags &
+			    NXP_CHANNEL_DISABLED)
+				continue;
+
+			/* The 5G cfp table is sorted based on the channel num
+			 * and may contain 4G and 5.9G channels. As the cfp
+			 * table index may not match the 5G powertable channel
+			 * index, get the corresponding channel row from
+			 * powertable
+			 */
+			n = 0;
+			while (n < pmadapter->tx_power_table_a_rows) {
+				if (pmadapter->tx_power_table_a[n * cols] ==
+				    (pmadapter->cfp_otp_a + i)->channel)
+					break;
+				n++;
+			}
+			/* Get the max value among all mod groups for this chan
+			 */
+			for (j = 1; j < cols; j++)
+				max = MAX(max,
+					  pmadapter->tx_power_table_a[n * cols +
+								      j]);
+
+			bonded_chan_count++;
+
+			if ((i < (rows - 1)) &&
+			    !((pmadapter->cfp_otp_a + i + 1)->dynamic.flags &
+			      NXP_CHANNEL_DISABLED)) {
+				/* Compare the max power value with the next
+				 * chan in this bonded group, unless this is the
+				 * last or the next one is disabled
+				 */
+				if (!((pmadapter->cfp_otp_a + i)->dynamic.flags &
+				      NXP_CHANNEL_NOHT80)) {
+					if (bonded_chan_count < 4)
+						continue;
+				} else if (!((pmadapter->cfp_otp_a + i)
+						     ->dynamic.flags &
+					     NXP_CHANNEL_NOHT40)) {
+					if (bonded_chan_count < 2)
+						continue;
+				}
+			}
+
+			/* Apply the max power value to all channels in this
+			 * bonded group
+			 */
+			for (k = 0; k < bonded_chan_count; k++)
+				(pmadapter->cfp_otp_a + i - k)->max_tx_power =
+					max;
+			max = 0;
+			bonded_chan_count = 0;
+		}
+	}
+}
+
+/**
  *  @brief	Update CFP tables and power tables from FW
  *
  *  @param priv		Private driver information structure
@@ -3355,35 +3458,60 @@
 					break;
 				}
 			}
-			for (i = 0; i < MLAN_CFP_TABLE_SIZE_A; i++) {
-				if (cfp_table_A[i].code ==
-				    pmadapter->otp_region->region_code) {
-					max_tx_pwr_a = (cfp_table_A[i].cfp)
-							       ->max_tx_power;
-					break;
+			if (pmadapter->fw_bands & BAND_A) {
+				for (i = 0; i < MLAN_CFP_TABLE_SIZE_A; i++) {
+					if (cfp_table_A[i].code ==
+					    pmadapter->otp_region->region_code) {
+						max_tx_pwr_a =
+							(cfp_table_A[i].cfp)
+								->max_tx_power;
+						break;
+					}
 				}
 			}
+			PRINTM(MCMND,
+			       "OTP region: region_code=%d %c%c dfs_region=%d\n",
+			       pmadapter->otp_region->region_code,
+			       pmadapter->otp_region->country_code[0],
+			       pmadapter->otp_region->country_code[1],
+			       pmadapter->otp_region->dfs_region);
+
 			/* Update the region code and the country code in
 			 * pmadapter
 			 */
 			pmadapter->region_code =
 				pmadapter->otp_region->region_code;
-			pmadapter->country_code[0] =
-				pmadapter->otp_region->country_code[0];
-			pmadapter->country_code[1] =
-				pmadapter->otp_region->country_code[1];
+			if (pmadapter->otp_region->force_reg) {
+				/* Region is enforced. Use FW country code only
+				 */
+				pmadapter->country_code[0] =
+					pmadapter->otp_region->country_code[0];
+				pmadapter->country_code[1] =
+					pmadapter->otp_region->country_code[1];
+			} else if (memcmp(pmadapter,
+					  pmadapter->otp_region->country_code,
+					  pmadapter->country_code,
+					  COUNTRY_CODE_LEN - 1)) {
+				PRINTM(MERROR,
+				       "FW country code %c%c does not match with %c%c\n",
+				       pmadapter->otp_region->country_code[0],
+				       pmadapter->otp_region->country_code[1],
+				       pmadapter->country_code[0],
+				       pmadapter->country_code[1]);
+
+				/* FW code mismatch, replace with the driver
+				 * code */
+				pmadapter->otp_region->country_code[0] =
+					pmadapter->country_code[0];
+				pmadapter->otp_region->country_code[1] =
+					pmadapter->country_code[1];
+			}
 			pmadapter->country_code[2] = '\0';
 			pmadapter->domain_reg.country_code[0] =
 				pmadapter->otp_region->country_code[0];
 			pmadapter->domain_reg.country_code[1] =
 				pmadapter->otp_region->country_code[1];
 			pmadapter->domain_reg.country_code[2] = '\0';
-			PRINTM(MCMND,
-			       "OTP region: region_code=%d %c%c dfs_region=%d\n",
-			       pmadapter->otp_region->region_code,
-			       pmadapter->country_code[0],
-			       pmadapter->country_code[1],
-			       pmadapter->otp_region->dfs_region);
 			pmadapter->cfp_code_bg =
 				pmadapter->otp_region->region_code;
 			pmadapter->cfp_code_a =
@@ -3439,6 +3567,12 @@
 					       ->dynamic.flags);
 				data++;
 			}
+			if (!(pmadapter->fw_bands & BAND_A)) {
+				pmadapter->tx_power_table_a_rows = 0;
+				pmadapter->tx_power_table_a_cols = 0;
+				break;
+			}
+
 			ret = pcb->moal_malloc(
 				pmadapter->pmoal_handle,
 				pmadapter->tx_power_table_a_rows *
@@ -3522,6 +3656,12 @@
 				   data, i, i);
 			pmadapter->tx_power_table_bg_size = i;
 			data += i;
+			if (!(pmadapter->fw_bands & BAND_A)) {
+				pmadapter->tx_power_table_a_rows = 0;
+				pmadapter->tx_power_table_a_cols = 0;
+				break;
+			}
+
 			i = 0;
 			while ((i < pmadapter->tx_power_table_a_rows *
 					    pmadapter->tx_power_table_a_cols) &&
@@ -3550,16 +3690,19 @@
 				((power_table_attr_t *)data)->rows_2g;
 			pmadapter->tx_power_table_bg_cols =
 				((power_table_attr_t *)data)->cols_2g;
-			pmadapter->tx_power_table_a_rows =
-				((power_table_attr_t *)data)->rows_5g;
-			pmadapter->tx_power_table_a_cols =
-				((power_table_attr_t *)data)->cols_5g;
-			PRINTM(MCMD_D,
-			       "OTP region: bg_row=%d,bg_cols=%d a_row=%d, a_cols=%d\n",
+			PRINTM(MCMD_D, "OTP region: bg_row=%d,bg_cols=%d\n",
 			       pmadapter->tx_power_table_bg_rows,
-			       pmadapter->tx_power_table_bg_cols,
-			       pmadapter->tx_power_table_a_rows,
-			       pmadapter->tx_power_table_a_cols);
+			       pmadapter->tx_power_table_bg_cols);
+			if (pmadapter->fw_bands & BAND_A) {
+				pmadapter->tx_power_table_a_rows =
+					((power_table_attr_t *)data)->rows_5g;
+				pmadapter->tx_power_table_a_cols =
+					((power_table_attr_t *)data)->cols_5g;
+				PRINTM(MCMD_D,
+				       "OTP region: a_row=%d, a_cols=%d\n",
+				       pmadapter->tx_power_table_a_rows,
+				       pmadapter->tx_power_table_a_cols);
+			}
 			break;
 		default:
 			break;
@@ -3569,6 +3712,7 @@
 	}
 	if (!pmadapter->cfp_otp_bg || !pmadapter->tx_power_table_bg)
 		goto out;
+
 	/* Set remaining flags for BG */
 	rows = pmadapter->tx_power_table_bg_rows;
 	cols = pmadapter->tx_power_table_bg_cols;
@@ -3592,6 +3736,7 @@
 	}
 	if (pmadapter->cfp_otp_a)
 		wlan_sort_cfp_otp_table(pmadapter);
+	wlan_set_otp_cfp_max_tx_pwr(pmadapter, MFALSE);
 out:
 	LEAVE();
 }
@@ -3690,7 +3835,8 @@
 	t_u8 cfp_code_a = pmadapter->region_code;
 	t_u8 cfp_code_bg = pmadapter->region_code;
 	t_u32 len = 0, size = 0;
-	t_u8 *req_buf, *tmp;
+	t_u8 *req_buf;
+	mlan_cfpinfo c = {0};
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -3700,36 +3846,39 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto out;
 	}
+	ret = wlan_11h_ioctl_nop_channel_list(pmadapter, pioctl_req);
+	if (ret) {
+		PRINTM(MERROR,
+		       "cfpinfo wlan_11h_ioctl_nop_channel_list failed!\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto out;
+	}
 	/* Calculate the total response size required to return region,
 	 * country codes, cfp tables and power tables
 	 */
-	size = sizeof(pmadapter->country_code) + sizeof(pmadapter->region_code);
-	/* Add size to store region, country and environment codes */
-	size += sizeof(t_u32);
-	if (pmadapter->cfp_code_bg)
-		cfp_code_bg = pmadapter->cfp_code_bg;
-
+	size = sizeof(mlan_cfpinfo);
 	/* Get cfp table and its size corresponding to the region code */
-	cfp_bg = wlan_get_region_cfp_table(pmadapter, cfp_code_bg,
-					   BAND_G | BAND_B, &cfp_no_bg);
-	size += cfp_no_bg * sizeof(chan_freq_power_t);
-	if (pmadapter->cfp_code_a)
-		cfp_code_a = pmadapter->cfp_code_a;
-	cfp_a = wlan_get_region_cfp_table(pmadapter, cfp_code_a, BAND_A,
-					  &cfp_no_a);
-	size += cfp_no_a * sizeof(chan_freq_power_t);
-	if (pmadapter->otp_region)
-		size += sizeof(pmadapter->otp_region->environment);
-
-	/* Get power table size */
-	if (pmadapter->tx_power_table_bg) {
+	if (pmadapter->fw_bands & (BAND_B | BAND_G)) {
+		if (pmadapter->cfp_code_bg)
+			cfp_code_bg = pmadapter->cfp_code_bg;
+		cfp_bg = wlan_get_region_cfp_table(pmadapter, cfp_code_bg,
+						   BAND_G | BAND_B, &cfp_no_bg);
+		size += cfp_no_bg * sizeof(chan_freq_power_t);
+		c.is2g_present = 1;
+		c.rows_2g = cfp_no_bg;
+		c.cols_2g = pmadapter->tx_power_table_bg_cols;
 		size += pmadapter->tx_power_table_bg_size;
-		/* Add size to store table size, rows and cols */
-		size += 3 * sizeof(t_u32);
 	}
-	if (pmadapter->tx_power_table_a) {
+	if (pmadapter->fw_bands & BAND_A) {
+		if (pmadapter->cfp_code_a)
+			cfp_code_a = pmadapter->cfp_code_a;
+		cfp_a = wlan_get_region_cfp_table(pmadapter, cfp_code_a, BAND_A,
+						  &cfp_no_a);
+		size += cfp_no_a * sizeof(chan_freq_power_t);
+		c.is5g_present = 1;
+		c.rows_5g = cfp_no_a;
+		c.cols_5g = pmadapter->tx_power_table_a_cols;
 		size += pmadapter->tx_power_table_a_size;
-		size += 3 * sizeof(t_u32);
 	}
 	/* Check information buffer length of MLAN IOCTL */
 	if (pioctl_req->buf_len < size) {
@@ -3740,90 +3889,52 @@
 		ret = MLAN_STATUS_RESOURCE;
 		goto out;
 	}
-	/* Copy the total size of region code, country code and environment
-	 * in first four bytes of the IOCTL request buffer and then copy
-	 * codes respectively in following bytes
-	 */
+
 	req_buf = (t_u8 *)pioctl_req->pbuf;
-	size = sizeof(pmadapter->country_code) + sizeof(pmadapter->region_code);
+
+	/* Copy the nss, region code, country code and environment */
+	if (IS_STREAM_2X2(pmadapter->feature_control))
+		c.nss = 2;
+	else if (IS_CARDAW693(pmadapter->card_type) && !pmadapter->second_mac)
+		c.nss = 2;
+	else
+		c.nss = 1;
+	c.region_code = (t_u8)pmadapter->region_code;
+	c.country_code[0] = pmadapter->country_code[0];
+	c.country_code[1] = pmadapter->country_code[1];
 	if (pmadapter->otp_region)
-		size += sizeof(pmadapter->otp_region->environment);
-	tmp = (t_u8 *)&size;
-	memcpy_ext(pmadapter, req_buf, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-	memcpy_ext(pmadapter, req_buf + len, &pmadapter->region_code,
-		   sizeof(pmadapter->region_code),
-		   sizeof(pmadapter->region_code));
-	len += sizeof(pmadapter->region_code);
-	memcpy_ext(pmadapter, req_buf + len, &pmadapter->country_code,
-		   sizeof(pmadapter->country_code),
-		   sizeof(pmadapter->country_code));
-	len += sizeof(pmadapter->country_code);
-	if (pmadapter->otp_region) {
-		memcpy_ext(pmadapter, req_buf + len,
-			   &pmadapter->otp_region->environment,
-			   sizeof(pmadapter->otp_region->environment),
-			   sizeof(pmadapter->otp_region->environment));
-		len += sizeof(pmadapter->otp_region->environment);
+		c.environment = pmadapter->otp_region->environment;
+	/* copy the mlan_cfpinfo struct at the start of req_buf */
+	memcpy_ext(pmadapter, req_buf, &c, sizeof(mlan_cfpinfo),
+		   sizeof(mlan_cfpinfo));
+	len += sizeof(mlan_cfpinfo);
+
+	/* copy cfp tables */
+	if (cfp_bg) {
+		size = cfp_no_bg * sizeof(chan_freq_power_t);
+		memcpy_ext(pmadapter, req_buf + len, cfp_bg, size, size);
+		len += size;
 	}
-	/* copy the cfp table size followed by the entire table */
-	if (!cfp_bg)
-		goto out;
-	size = cfp_no_bg * sizeof(chan_freq_power_t);
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-	memcpy_ext(pmadapter, req_buf + len, cfp_bg, size, size);
-	len += size;
-	if (!cfp_a)
-		goto out;
-	size = cfp_no_a * sizeof(chan_freq_power_t);
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-	memcpy_ext(pmadapter, req_buf + len, cfp_a, size, size);
-	len += size;
-	/* Copy the size of the power table, number of rows, number of cols
-	 * and the entire power table
-	 */
-	if (!pmadapter->tx_power_table_bg)
-		goto out;
-	size = pmadapter->tx_power_table_bg_size;
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-
-	/* No. of rows */
-	size = pmadapter->tx_power_table_bg_rows;
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-
-	/* No. of cols */
-	size = pmadapter->tx_power_table_bg_size /
-	       pmadapter->tx_power_table_bg_rows;
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-	memcpy_ext(pmadapter, req_buf + len, pmadapter->tx_power_table_bg,
-		   pmadapter->tx_power_table_bg_size,
-		   pmadapter->tx_power_table_bg_size);
-	len += pmadapter->tx_power_table_bg_size;
-	if (!pmadapter->tx_power_table_a)
-		goto out;
-	size = pmadapter->tx_power_table_a_size;
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-
-	/* No. of rows */
-	size = pmadapter->tx_power_table_a_rows;
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-
-	/* No. of cols */
-	size = pmadapter->tx_power_table_a_size /
-	       pmadapter->tx_power_table_a_rows;
-	memcpy_ext(pmadapter, req_buf + len, tmp, sizeof(size), sizeof(size));
-	len += sizeof(size);
-	memcpy_ext(pmadapter, req_buf + len, pmadapter->tx_power_table_a,
-		   pmadapter->tx_power_table_a_size,
-		   pmadapter->tx_power_table_a_size);
-	len += pmadapter->tx_power_table_a_size;
+	if (cfp_a) {
+		size = cfp_no_a * sizeof(chan_freq_power_t);
+		memcpy_ext(pmadapter, req_buf + len, cfp_a, size, size);
+		len += size;
+	}
+	/* copy power tables */
+	if (pmadapter->tx_power_table_bg) {
+		memcpy_ext(pmadapter, req_buf + len,
+			   pmadapter->tx_power_table_bg,
+			   pmadapter->tx_power_table_bg_size,
+			   pmadapter->tx_power_table_bg_size);
+		len += pmadapter->tx_power_table_bg_size;
+	}
+	if (pmadapter->tx_power_table_a) {
+		memcpy_ext(pmadapter, req_buf + len,
+			   pmadapter->tx_power_table_a,
+			   pmadapter->tx_power_table_a_size,
+			   pmadapter->tx_power_table_a_size);
+		len += pmadapter->tx_power_table_a_size;
+	}
 out:
 	if (pioctl_req)
 		pioctl_req->data_read_written = len;
diff --git a/wlan_sd8987/mlan/mlan_cmdevt.c b/wlan_src/mlan/mlan_cmdevt.c
old mode 100755
new mode 100644
similarity index 81%
rename from wlan_sd8987/mlan/mlan_cmdevt.c
rename to wlan_src/mlan/mlan_cmdevt.c
index 062bb35..f1d58fd
--- a/wlan_sd8987/mlan/mlan_cmdevt.c
+++ b/wlan_src/mlan/mlan_cmdevt.c
@@ -4,20 +4,29 @@
  *  @brief This file contains the handling of CMD/EVENT in MLAN
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -26,6 +35,7 @@
     05/12/2009: initial version
 ************************************************************/
 #include "mlan.h"
+#include "mlan_util.h"
 #ifdef STA_SUPPORT
 #include "mlan_join.h"
 #endif
@@ -49,6 +59,30 @@
 			Local Variables
 ********************************************************/
 
+#ifdef DEBUG_LEVEL1
+
+#define ENUM_ELEMENT(_name, _id)                                               \
+	{                                                                      \
+		.id = _id, .name = #_name                                      \
+	}
+#define ENUM_ELEMENT_LAST(name)                                                \
+	{                                                                      \
+		0xFFFF, 0                                                      \
+	}
+
+static const struct reflective_enum_element host_cmd_id_names[] = {
+#include "mlan_hostcmd_ids.h"
+};
+
+static const struct reflective_enum_element host_fw_event_names[] = {
+#include "mlan_event_ids.h"
+};
+
+#undef ENUM_ELEMENT
+#undef ENUM_ELEMENT_LAST
+
+#endif /* DEBUG_LEVEL1 */
+
 /*******************************************************
 			Global Variables
 ********************************************************/
@@ -56,6 +90,32 @@
 /********************************************************
 			Local Functions
 ********************************************************/
+static const char *wlan_hostcmd_get_name(enum host_cmd_id id)
+{
+#ifdef DEBUG_LEVEL1
+	const char *name = reflective_enum_lookup_name(host_cmd_id_names, id);
+
+	if (name) {
+		return wlan_str_skip_prefix(name, "HostCmd_CMD_");
+	}
+#endif
+
+	return "???";
+}
+
+static const char *wlan_event_get_name(enum host_fw_event_id id)
+{
+#ifdef DEBUG_LEVEL1
+	const char *name = reflective_enum_lookup_name(host_fw_event_names, id);
+
+	if (name) {
+		return wlan_str_skip_prefix(name, "EVENT_");
+	}
+#endif
+
+	return "???";
+}
+
 #ifdef STA_SUPPORT
 /**
  *  @brief This function check if the command was cancel scan command
@@ -113,14 +173,11 @@
 	case HostCmd_CMD_FUNC_INIT:
 	case HostCmd_CMD_CFG_DATA:
 	case HostCmd_CMD_REGION_POWER_CFG:
-	case HostCmd_CHANNEL_TRPC_CONFIG:
+	case HostCmd_CMD_CHANNEL_TRPC_CONFIG:
 	case HostCmd_CMD_FUNC_SHUTDOWN:
 	case HostCmd_CMD_802_11_ASSOCIATE:
 	case HostCmd_CMD_802_11_DEAUTHENTICATE:
 	case HostCmd_CMD_802_11_DISASSOCIATE:
-	case HostCmd_CMD_802_11_AD_HOC_START:
-	case HostCmd_CMD_802_11_AD_HOC_JOIN:
-	case HostCmd_CMD_802_11_AD_HOC_STOP:
 	case HostCmd_CMD_11N_ADDBA_REQ:
 	case HostCmd_CMD_11N_ADDBA_RSP:
 	case HostCmd_CMD_11N_DELBA:
@@ -129,13 +186,13 @@
 	case HostCmd_CMD_TDLS_OPERATION:
 	case HostCmd_CMD_SOFT_RESET:
 #ifdef UAP_SUPPORT
-	case HOST_CMD_APCMD_SYS_RESET:
-	case HOST_CMD_APCMD_BSS_START:
-	case HOST_CMD_APCMD_BSS_STOP:
-	case HOST_CMD_APCMD_STA_DEAUTH:
+	case HostCmd_CMD_APCMD_SYS_RESET:
+	case HostCmd_CMD_APCMD_BSS_START:
+	case HostCmd_CMD_APCMD_BSS_STOP:
+	case HostCmd_CMD_APCMD_STA_DEAUTH:
 #endif
 	case HostCmd_CMD_802_11_BG_SCAN_CONFIG:
-	case HostCMD_APCMD_ACS_SCAN:
+	case HostCmd_CMD_APCMD_ACS_SCAN:
 		ret = MFALSE;
 		break;
 	default:
@@ -204,7 +261,7 @@
  *
  *  @return             N/A
  */
-t_void wlan_flush_ext_cmd_pending_queue(pmlan_adapter pmadapter)
+static t_void wlan_flush_ext_cmd_pending_queue(pmlan_adapter pmadapter)
 {
 	cmd_ctrl_node *pcmd_node = MNULL;
 	HostCmd_DS_COMMAND *pcmd = MNULL;
@@ -253,8 +310,9 @@
 	if (pmpriv->adapter->scan_processing &&
 	    pmpriv->adapter->ext_scan_type == EXT_SCAN_ENHANCE) {
 		if (MFALSE == wlan_is_cmd_allowed_during_scan(cmd_no)) {
-			PRINTM(MCMND, "QUEUE_CMD: cmd=0x%x ext_cmd_pending_q\n",
-			       cmd_no);
+			PRINTM(MCMND,
+			       "QUEUE_CMD: %s [0x%x] ext_cmd_pending_q\n",
+			       wlan_hostcmd_get_name(cmd_no), cmd_no);
 			wlan_queue_cmd_to_ext_cmd_pending_queue(pmpriv,
 								pcmd_node);
 			return;
@@ -394,8 +452,9 @@
 					  [pmadapter->dbg.last_cmd_index];
 			PRINTM_GET_SYS_TIME(MERROR, &sec, &usec);
 			PRINTM(MERROR,
-			       "Current cmd id (%lu.%06lu) = 0x%x, act = 0x%x\n",
-			       sec, usec, cmd_id, cmd_act);
+			       "Current cmd id (%lu.%06lu) %s [0x%x], act = 0x%x\n",
+			       sec, usec, wlan_hostcmd_get_name(cmd_id), cmd_id,
+			       cmd_act);
 #if defined(SDIO) || defined(PCIE)
 			if (!IS_USB(pmadapter->card_type) &&
 			    pcmd_node->cmdbuf) {
@@ -403,9 +462,13 @@
 				pcmd_buf = pcmd_node->cmdbuf->pbuf +
 					   pcmd_node->cmdbuf->data_offset +
 					   pmadapter->ops.intf_header_len;
-				for (i = 0; i < 16; i++)
-					PRINTM(MERROR, "%02x ", *pcmd_buf++);
-				PRINTM(MERROR, "\n");
+				if ((pmadapter->ops.intf_header_len + 16) >
+				    pcmd_node->cmdbuf->data_len) {
+					for (i = 0; i < 16; i++)
+						PRINTM(MERROR, "%02x ",
+						       *pcmd_buf++);
+					PRINTM(MERROR, "\n");
+				}
 			}
 #endif
 			pmpriv = pcmd_node->priv;
@@ -502,7 +565,11 @@
 	PRINTM(MERROR, "tx_lock_flag = %d\n", pmadapter->tx_lock_flag);
 	PRINTM(MERROR, "scan_processing = %d\n", pmadapter->scan_processing);
 	PRINTM(MERROR, "scan_state = 0x%x\n", pmadapter->scan_state);
-	PRINTM(MERROR, "bypass_pkt_count=%d\n", pmadapter->bypass_pkt_count);
+	PRINTM(MERROR, "bypass_pkt_count=%d\n",
+	       util_scalar_read(pmadapter->pmoal_handle,
+				&pmadapter->bypass_pkt_count,
+				pmadapter->callbacks.moal_spin_lock,
+				pmadapter->callbacks.moal_spin_unlock));
 #ifdef SDIO
 	if (IS_SD(pmadapter->card_type)) {
 		mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
@@ -682,7 +749,9 @@
 	while (*pos != '\0') {
 		if (*pos == (t_u8)c)
 			return pos;
-		pos++;
+		if (!wlan_secure_add(&pos, 1, &pos, TYPE_PTR)) {
+			PRINTM(MERROR, "pos is invalid\n");
+		}
 	}
 	return MNULL;
 }
@@ -1144,9 +1213,6 @@
 	case HostCmd_CMD_802_11_ASSOCIATE:
 	case HostCmd_CMD_802_11_DEAUTHENTICATE:
 	case HostCmd_CMD_802_11_DISASSOCIATE:
-	case HostCmd_CMD_802_11_AD_HOC_START:
-	case HostCmd_CMD_802_11_AD_HOC_JOIN:
-	case HostCmd_CMD_802_11_AD_HOC_STOP:
 	case HostCmd_CMD_11N_ADDBA_REQ:
 	case HostCmd_CMD_11N_ADDBA_RSP:
 	case HostCmd_CMD_11N_DELBA:
@@ -1157,12 +1223,12 @@
 	case HostCmd_CMD_SUPPLICANT_PROFILE:
 	case HostCmd_CMD_SOFT_RESET:
 #ifdef UAP_SUPPORT
-	case HOST_CMD_APCMD_SYS_RESET:
-	case HOST_CMD_APCMD_BSS_START:
-	case HOST_CMD_APCMD_BSS_STOP:
-	case HOST_CMD_APCMD_STA_DEAUTH:
+	case HostCmd_CMD_APCMD_SYS_RESET:
+	case HostCmd_CMD_APCMD_BSS_START:
+	case HostCmd_CMD_APCMD_BSS_STOP:
+	case HostCmd_CMD_APCMD_STA_DEAUTH:
 #endif
-	case HostCMD_APCMD_ACS_SCAN:
+	case HostCmd_CMD_APCMD_ACS_SCAN:
 		timeout = MRVDRV_TIMER_5S;
 		break;
 	default:
@@ -1302,12 +1368,17 @@
 
 	if (pcmd->command == HostCmd_CMD_802_11_SCAN_EXT)
 		pmadapter->scan_state |= wlan_get_ext_scan_state(pcmd);
+	if (pmpriv->bss_mode == MLAN_BSS_MODE_INFRA &&
+	    pmpriv->media_connected &&
+	    (pcmd->command == HostCmd_CMD_802_11_DEAUTHENTICATE ||
+	     pcmd->command == HostCmd_CMD_802_11_DISASSOCIATE))
+		wlan_clean_txrx(pmpriv);
 
 	PRINTM_GET_SYS_TIME(MCMND, &sec, &usec);
 	PRINTM_NETINTF(MCMND, pmpriv);
 	PRINTM(MCMND,
-	       "DNLD_CMD (%lu.%06lu): 0x%x, act 0x%x, len %d, seqno 0x%x timeout %d\n",
-	       sec, usec, cmd_code,
+	       "DNLD_CMD (%lu.%06lu): %s [0x%x], act 0x%x, len %d, seqno 0x%x timeout %d\n",
+	       sec, usec, wlan_hostcmd_get_name(cmd_code), cmd_code,
 	       wlan_le16_to_cpu(*(t_u16 *)((t_u8 *)pcmd + S_DS_GEN)), cmd_size,
 	       wlan_le16_to_cpu(pcmd->seq_num), timeout);
 	DBG_HEXDUMP(MCMD_D, "DNLD_CMD", (t_u8 *)pcmd, cmd_size);
@@ -1452,19 +1523,7 @@
 			cmd_len + pmadapter->ops.intf_header_len;
 #endif
 
-	if (pmbuf)
-		ret = pmadapter->ops.host_to_card(pmpriv, MLAN_TYPE_CMD, pmbuf,
-						  MNULL);
-
-#ifdef USB
-	if (IS_USB(pmadapter->card_type) && (ret != MLAN_STATUS_PENDING))
-		wlan_free_mlan_buffer(pmadapter, pmbuf);
-#endif
-	if (ret == MLAN_STATUS_FAILURE) {
-		PRINTM(MERROR, "SLEEP_CFM: failed\n");
-		pmadapter->dbg.num_cmd_sleep_cfm_host_to_card_failure++;
-		goto done;
-	} else {
+	if (pmbuf) {
 		if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_UAP)
 			pmadapter->ps_state = PS_STATE_SLEEP_CFM;
 #ifdef STA_SUPPORT
@@ -1489,14 +1548,31 @@
 		}
 #endif /* STA_SUPPORT */
 
-		PRINTM_NETINTF(MEVENT, pmpriv);
 #define NUM_SC_PER_LINE 16
-		if (++i % NUM_SC_PER_LINE == 0)
-			PRINTM(MEVENT, "+\n");
-		else
-			PRINTM(MEVENT, "+");
-	}
+		if (++i % NUM_SC_PER_LINE == 0) {
+			if (pmadapter->second_mac)
+				PRINTM(MEVENT, "++\n");
+			else
+				PRINTM(MEVENT, "+\n");
+		} else {
+			if (pmadapter->second_mac)
+				PRINTM(MEVENT, "++");
+			else
+				PRINTM(MEVENT, "+");
+		}
 
+		ret = pmadapter->ops.host_to_card(pmpriv, MLAN_TYPE_CMD, pmbuf,
+						  MNULL);
+	}
+#ifdef USB
+	if (IS_USB(pmadapter->card_type) && (ret != MLAN_STATUS_PENDING))
+		wlan_free_mlan_buffer(pmadapter, pmbuf);
+#endif
+	if (ret == MLAN_STATUS_FAILURE) {
+		PRINTM(MERROR, "SLEEP_CFM: failed\n");
+		pmadapter->dbg.num_cmd_sleep_cfm_host_to_card_failure++;
+		goto done;
+	}
 done:
 	LEAVE();
 	return ret;
@@ -1597,7 +1673,6 @@
 	}
 
 	pmadapter->cmd_pool = pcmd_array;
-	memset(pmadapter, pmadapter->cmd_pool, 0, buf_size);
 
 #if defined(PCIE) || defined(SDIO)
 	if (!IS_USB(pmadapter->card_type)) {
@@ -1737,7 +1812,9 @@
 				if (priv)
 					PRINTM_NETINTF(MEVENT, priv);
 				PRINTM(MERROR,
-				       "Error processing DFS Event: 0x%x\n",
+				       "Error processing DFS Event: %s [0x%x]\n",
+				       wlan_event_get_name(eventcause &
+							   EVENT_ID_MASK),
 				       eventcause);
 				goto done;
 			}
@@ -1768,17 +1845,13 @@
 	    eventcause != EVENT_FW_DUMP_INFO) {
 		PRINTM_GET_SYS_TIME(MEVENT, &in_ts_sec, &in_ts_usec);
 		PRINTM_NETINTF(MEVENT, priv);
-		PRINTM(MEVENT, "%lu.%06lu : Event: 0x%x\n", in_ts_sec,
-		       in_ts_usec, eventcause);
+		PRINTM(MEVENT, "%lu.%06lu : Event: %s [0x%x]\n", in_ts_sec,
+		       in_ts_usec, wlan_event_get_name(eventcause), eventcause);
 	}
 
 	ret = priv->ops.process_event(priv);
 done:
-	pmadapter->event_cause = 0;
-	pmadapter->pmlan_buffer_event = MNULL;
-	if (pmbuf)
-		pmadapter->ops.event_complete(pmadapter, pmbuf,
-					      MLAN_STATUS_SUCCESS);
+	pmadapter->ops.event_complete(pmadapter, pmbuf, MLAN_STATUS_SUCCESS);
 
 	LEAVE();
 	return ret;
@@ -1824,7 +1897,49 @@
 	LEAVE();
 	return;
 }
+#ifdef USB
+/**
+ *  @brief This function requests a lock on Rx event.
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             N/A
+ */
+t_void wlan_request_event_lock(mlan_adapter *pmadapter)
+{
+	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
 
+	ENTER();
+
+	/* Call MOAL spin lock callback function */
+	pcb->moal_spin_lock(pmadapter->pmoal_handle,
+			    pmadapter->pmlan_usb_event_lock);
+
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function releases a lock on Rx event.
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             N/A
+ */
+t_void wlan_release_event_lock(mlan_adapter *pmadapter)
+{
+	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
+
+	ENTER();
+
+	/* Call MOAL spin unlock callback function */
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_usb_event_lock);
+
+	LEAVE();
+	return;
+}
+#endif
 /**
  *  @brief This function prepare the command before sending to firmware.
  *
@@ -2054,7 +2169,8 @@
 	}
 
 	PRINTM_NETINTF(MCMND, pcmd_node->priv);
-	PRINTM(MCMND, "QUEUE_CMD: cmd=0x%x is queued\n", command);
+	PRINTM(MCMND, "QUEUE_CMD: %s [0x%x] is queued\n",
+	       wlan_hostcmd_get_name(command), command);
 
 done:
 	LEAVE();
@@ -2138,6 +2254,43 @@
 	return ret;
 }
 
+#if defined(SDIO) || defined(PCIE)
+/**
+ *  @brief This function handles the command error in pre_asleep state
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             N/A
+ */
+static void wlan_handle_cmd_error_in_pre_aleep(mlan_adapter *pmadapter,
+					       t_u16 cmd_no)
+{
+	cmd_ctrl_node *pcmd_node = MNULL;
+	ENTER();
+	PRINTM(MERROR, "CMD_RESP: 0x%x block in pre_asleep!\n", cmd_no);
+	wlan_request_cmd_lock(pmadapter);
+	pcmd_node = pmadapter->curr_cmd;
+	pmadapter->curr_cmd = MNULL;
+	if (pcmd_node) {
+		if (!IS_USB(pmadapter->card_type)) {
+			pcmd_node->cmdbuf->data_offset +=
+				pmadapter->ops.intf_header_len;
+			pcmd_node->cmdbuf->data_len -=
+				pmadapter->ops.intf_header_len;
+		}
+		if (pcmd_node->respbuf) {
+			pmadapter->ops.cmdrsp_complete(pmadapter,
+						       pcmd_node->respbuf,
+						       MLAN_STATUS_SUCCESS);
+			pcmd_node->respbuf = MNULL;
+		}
+		wlan_insert_cmd_to_pending_q(pmadapter, pcmd_node, MFALSE);
+	}
+	wlan_release_cmd_lock(pmadapter);
+	LEAVE();
+}
+#endif
+
 /**
  *  @brief This function handles the command response
  *
@@ -2253,9 +2406,10 @@
 	PRINTM_GET_SYS_TIME(MCMND, &sec, &usec);
 	PRINTM_NETINTF(MCMND, pmadapter->curr_cmd->priv);
 	PRINTM(MCMND,
-	       "CMD_RESP (%lu.%06lu): 0x%x, result %d, len %d, seqno 0x%x\n",
-	       sec, usec, orig_cmdresp_no, cmdresp_result, resp->size,
-	       resp->seq_num);
+	       "CMD_RESP (%lu.%06lu): %s [0x%x], result %d, len %d, seqno 0x%x\n",
+	       sec, usec,
+	       wlan_hostcmd_get_name(orig_cmdresp_no & ~HostCmd_RET_BIT),
+	       orig_cmdresp_no, cmdresp_result, resp->size, resp->seq_num);
 
 	if (!(orig_cmdresp_no & HostCmd_RET_BIT)) {
 		PRINTM(MERROR, "CMD_RESP: Invalid response to command!\n");
@@ -2269,12 +2423,48 @@
 		goto done;
 	}
 
+	if (cmdresp_result == HostCmd_RESULT_RGPWR_KEY_MISMATCH) {
+		PRINTM(MERROR,
+		       "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
+		PRINTM(MERROR, " Security Key Mismatch for rgpower_XX.bin \n");
+		PRINTM(MERROR,
+		       "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_RGPWR_KEY_MISMATCH,
+				MNULL);
+	}
+	if (cmdresp_result == HostCmd_RESULT_EDMAC_RUTABLE_KEY_MISMATCH) {
+		PRINTM(MERROR,
+		       "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
+		PRINTM(MERROR,
+		       " Security Key Mismatch for edmac and rutable \n");
+		PRINTM(MERROR,
+		       "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
+	}
+
 	if (pmadapter->curr_cmd->cmd_flag & CMD_F_HOSTCMD) {
+#if defined(SDIO) || defined(PCIE)
+		if (!IS_USB(pmadapter->card_type) && pmadapter->curr_cmd &&
+		    cmdresp_result == HostCmd_RESULT_PRE_ASLEEP) {
+			wlan_handle_cmd_error_in_pre_aleep(pmadapter,
+							   cmdresp_no);
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+#endif
 		pmadapter->curr_cmd->cmd_flag &= ~CMD_F_HOSTCMD;
 		if ((cmdresp_result == HostCmd_RESULT_OK) &&
 		    (cmdresp_no == HostCmd_CMD_802_11_HS_CFG_ENH))
 			ret = wlan_ret_802_11_hs_cfg(pmpriv, resp, pioctl_buf);
 	} else {
+#if defined(SDIO) || defined(PCIE)
+		if (!IS_USB(pmadapter->card_type) && pmadapter->curr_cmd &&
+		    cmdresp_result == HostCmd_RESULT_PRE_ASLEEP) {
+			wlan_handle_cmd_error_in_pre_aleep(pmadapter,
+							   cmdresp_no);
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+#endif
 		/* handle response */
 		ret = pmpriv->ops.process_cmdresp(pmpriv, cmdresp_no, resp,
 						  pioctl_buf);
@@ -2310,7 +2500,8 @@
 		if (IS_PCIE(pmadapter->card_type) &&
 		    cmdresp_no == HostCmd_CMD_FUNC_SHUTDOWN &&
 		    pmadapter->pwarm_reset_ioctl_req) {
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 			if (pmadapter->pcard_pcie->reg->use_adma)
 #endif
 				wlan_pcie_init_fw(pmadapter);
@@ -2426,18 +2617,21 @@
 	pmadapter->dbg.timeout_cmd_act =
 		pmadapter->dbg.last_cmd_act[pmadapter->dbg.last_cmd_index];
 	PRINTM_GET_SYS_TIME(MERROR, &sec, &usec);
-	PRINTM(MERROR, "Timeout cmd id (%lu.%06lu) = 0x%x, act = 0x%x\n", sec,
-	       usec, pmadapter->dbg.timeout_cmd_id,
-	       pmadapter->dbg.timeout_cmd_act);
+	PRINTM(MERROR, "Timeout cmd id (%lu.%06lu) %s [0x%x], act = 0x%x\n",
+	       sec, usec, wlan_hostcmd_get_name(pmadapter->dbg.timeout_cmd_id),
+	       pmadapter->dbg.timeout_cmd_id, pmadapter->dbg.timeout_cmd_act);
 #if defined(SDIO) || defined(PCIE)
 	if (!IS_USB(pmadapter->card_type) && pcmd_node->cmdbuf) {
 		t_u8 *pcmd_buf;
 		pcmd_buf = pcmd_node->cmdbuf->pbuf +
 			   pcmd_node->cmdbuf->data_offset +
 			   pmadapter->ops.intf_header_len;
-		for (i = 0; i < 16; i++)
-			PRINTM(MERROR, "%02x ", *pcmd_buf++);
-		PRINTM(MERROR, "\n");
+		if ((pmadapter->ops.intf_header_len + 16) <
+		    pcmd_node->cmdbuf->data_len) {
+			for (i = 0; i < 16; i++)
+				PRINTM(MERROR, "%02x ", *pcmd_buf++);
+			PRINTM(MERROR, "\n");
+		}
 	}
 #endif
 #ifdef PCIE
@@ -2638,6 +2832,13 @@
 		}
 	}
 
+	if (pmadapter->cmd_timer_is_set) {
+		pcb->moal_stop_timer(pmadapter->pmoal_handle,
+				     pmadapter->pmlan_cmd_timer);
+		/* Cancel command timeout timer */
+		pmadapter->cmd_timer_is_set = MFALSE;
+	}
+
 	/* Cancel all pending command */
 	while ((pcmd_node = (cmd_ctrl_node *)util_peek_list(
 			pmadapter->pmoal_handle, &pmadapter->cmd_pending_q,
@@ -2850,8 +3051,9 @@
  *
  *  @return           N/A
  */
-t_void wlan_fill_hal_wifi_rate(pmlan_private pmpriv, mlan_wifi_rate *pmlan_rate,
-			       wifi_rate *prate)
+static t_void wlan_fill_hal_wifi_rate(pmlan_private pmpriv,
+				      mlan_wifi_rate *pmlan_rate,
+				      wifi_rate *prate)
 {
 	t_u8 index = 0;
 	t_u8 rate_info = 0;
@@ -2893,6 +3095,466 @@
 }
 
 /**
+ *  @brief This function prepares command of ftm config session params.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param cmd_oid      OID: CONFIG or CANCEL
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_802_11_ftm_config_session_params(pmlan_private pmpriv,
+						      HostCmd_DS_COMMAND *cmd,
+						      t_u16 cmd_action,
+						      t_u32 cmd_oid,
+						      t_void *pdata_buf)
+{
+	HostCmd_DS_FTM_CONFIG_SESSION_PARAMS *ftm_config =
+		&cmd->params.ftm_config;
+	t_u8 *tlv = MNULL;
+	mlan_rtt_config_params *rtt_params = MNULL;
+	MrvlIEtypes_RTTRangeRequest_t *tlv_rtt_rr = MNULL;
+	mlan_rtt_cancel_params *rtt_cancel = MNULL;
+	MrvlIEtypes_RTTRangeCancel_t *tlv_rtt_rc = MNULL;
+	t_u32 i = 0;
+
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS);
+	cmd->size = S_DS_GEN + sizeof(HostCmd_DS_FTM_CONFIG_SESSION_PARAMS);
+
+	ftm_config->action = wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);
+	tlv = ftm_config->tlv_buffer;
+
+	if (cmd_oid == OID_RTT_REQUEST) {
+		rtt_params = (mlan_rtt_config_params *)pdata_buf;
+		for (i = 0; i < rtt_params->rtt_config_num; i++) {
+			tlv_rtt_rr = (MrvlIEtypes_RTTRangeRequest_t *)tlv;
+			tlv_rtt_rr->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_RTT_RANGE_REQUEST);
+			tlv_rtt_rr->header.len =
+				wlan_cpu_to_le16((sizeof(*tlv_rtt_rr) -
+						  sizeof(MrvlIEtypesHeader_t)));
+			memcpy_ext(pmpriv->adapter, tlv_rtt_rr->addr,
+				   rtt_params->rtt_config[i].addr,
+				   sizeof(rtt_params->rtt_config[i].addr),
+				   sizeof(tlv_rtt_rr->addr));
+			tlv_rtt_rr->type = rtt_params->rtt_config[i].type;
+			tlv_rtt_rr->peer = rtt_params->rtt_config[i].peer;
+			tlv_rtt_rr->channel = rtt_params->rtt_config[i].channel;
+			tlv_rtt_rr->bandcfg = rtt_params->rtt_config[i].bandcfg;
+			tlv_rtt_rr->burst_period =
+				rtt_params->rtt_config[i].burst_period;
+			tlv_rtt_rr->num_burst =
+				rtt_params->rtt_config[i].num_burst;
+			tlv_rtt_rr->num_frames_per_burst =
+				rtt_params->rtt_config[i].num_frames_per_burst;
+			tlv_rtt_rr->num_retries_per_rtt_frame =
+				rtt_params->rtt_config[i]
+					.num_retries_per_rtt_frame;
+			tlv_rtt_rr->num_retries_per_ftmr =
+				rtt_params->rtt_config[i].num_retries_per_ftmr;
+			tlv_rtt_rr->LCI_request =
+				rtt_params->rtt_config[i].LCI_request;
+			tlv_rtt_rr->LCR_request =
+				rtt_params->rtt_config[i].LCR_request;
+			tlv_rtt_rr->burst_duration =
+				rtt_params->rtt_config[i].burst_duration;
+			tlv_rtt_rr->preamble =
+				rtt_params->rtt_config[i].preamble;
+			tlv_rtt_rr->bw = rtt_params->rtt_config[i].bw;
+			cmd->size += sizeof(*tlv_rtt_rr);
+			tlv += sizeof(*tlv_rtt_rr);
+		}
+	} else if (cmd_oid == OID_RTT_CANCEL) {
+		rtt_cancel = (mlan_rtt_cancel_params *)pdata_buf;
+		for (i = 0; i < rtt_cancel->rtt_cancel_num; i++) {
+			tlv_rtt_rc = (MrvlIEtypes_RTTRangeCancel_t *)tlv;
+			tlv_rtt_rc->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_RTT_RANGE_CANCEL);
+			tlv_rtt_rc->header.len =
+				wlan_cpu_to_le16(sizeof(*tlv_rtt_rc) -
+						 sizeof(MrvlIEtypesHeader_t));
+			memcpy_ext(pmpriv->adapter, tlv_rtt_rc->addr,
+				   rtt_cancel->rtt_cancel[i],
+				   sizeof(rtt_cancel->rtt_cancel[i]),
+				   sizeof(tlv_rtt_rc->addr));
+			cmd->size += sizeof(*tlv_rtt_rc);
+			tlv += sizeof(*tlv_rtt_rc);
+		}
+	} else {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of ftm config session
+ * params.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status
+wlan_ret_802_11_ftm_config_session_params(pmlan_private pmpriv,
+					  HostCmd_DS_COMMAND *resp,
+					  mlan_ioctl_req *pioctl_buf)
+{
+	ENTER();
+
+	PRINTM(MCMND, "ftm config successfully\n");
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function transform Event_WLS_FTM_t to wifi_rtt_result in
+ * mlan_event.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param event_ftm  A pointer to Event_WLS_FTM_t
+ *  @param event_ftm_len   length of event_ftm
+ *  @param pevent       A pointer to mlan_event
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_fill_hal_rtt_results(pmlan_private pmpriv,
+				      Event_WLS_FTM_t *event_ftm,
+				      t_u32 event_ftm_len, mlan_event *pevent)
+{
+	/** For input buffer Event_WLS_FTM_t */
+	t_u8 *tlv = event_ftm->u.rtt_results.tlv_buffer;
+	int event_left_len = event_ftm_len - (tlv - (t_u8 *)event_ftm);
+	MrvlIEtypes_RTTResult_t *tlv_rtt_result = MNULL;
+	t_u16 tlv_rtt_result_len = 0;
+	IEEEtypes_Header_t *tlv_ie = MNULL;
+	int tlv_ie_len = 0;
+	int tlv_left_len = 0;
+	t_u8 *tlv_pos = MNULL;
+	/** For output buffer mlan_event */
+	t_u8 *pos = pevent->event_buf;
+	wifi_rtt_result_element *rtt_result_elem = MNULL;
+	wifi_rtt_result *rtt_result = MNULL;
+	t_u32 i = 0;
+
+	ENTER();
+	PRINTM(MCMND,
+	       "wlan_fill_hal_rtt_results event_ftm_len=%d event_left_len=%d event_ftm=%p tlv=%p\n",
+	       event_ftm_len, event_left_len, event_ftm, tlv);
+
+	pevent->event_id = MLAN_EVENT_ID_DRV_RTT_RESULT;
+
+	/** Event format for moal is: [complete(u8)] + [multiple number of rtt
+	 * result(len(u16) + body)] */
+
+	/** [complete(u8)] */
+	*pos = event_ftm->u.rtt_results.complete;
+	pos += sizeof(event_ftm->u.rtt_results.complete);
+
+	/** multiple number of rtt result(wifi_rtt_result_element) */
+	/** Fill rtt results, 1 tlv at least contain 1 MrvlIEtypes_RTTResult_t
+	 */
+	while (event_left_len >= sizeof(MrvlIEtypes_RTTResult_t)) {
+		PRINTM(MCMND, "[%d] event_left_len=%d tlv=%p\n", i,
+		       event_left_len, tlv);
+		tlv_rtt_result = (MrvlIEtypes_RTTResult_t *)tlv;
+		tlv_rtt_result_len =
+			wlan_le16_to_cpu(tlv_rtt_result->header.len);
+
+		rtt_result_elem = (wifi_rtt_result_element *)pos;
+		pos += sizeof(*rtt_result_elem);
+
+		rtt_result = (wifi_rtt_result *)(rtt_result_elem->data);
+		memcpy_ext(pmpriv->adapter, rtt_result->addr,
+			   tlv_rtt_result->addr, sizeof(tlv_rtt_result->addr),
+			   sizeof(rtt_result->addr));
+		rtt_result->burst_num =
+			wlan_le32_to_cpu(tlv_rtt_result->burst_num);
+		rtt_result->measurement_number =
+			wlan_le32_to_cpu(tlv_rtt_result->measurement_number);
+		rtt_result->success_number =
+			wlan_le32_to_cpu(tlv_rtt_result->success_number);
+		rtt_result->number_per_burst_peer =
+			tlv_rtt_result->number_per_burst_peer;
+		rtt_result->status = tlv_rtt_result->status;
+		rtt_result->retry_after_duration =
+			tlv_rtt_result->retry_after_duration;
+		rtt_result->type = tlv_rtt_result->type;
+		rtt_result->rssi = wlan_le32_to_cpu(tlv_rtt_result->rssi);
+		rtt_result->rssi_spread =
+			wlan_le32_to_cpu(tlv_rtt_result->rssi_spread);
+		wlan_fill_hal_wifi_rate(pmpriv, &tlv_rtt_result->tx_rate,
+					&rtt_result->tx_rate);
+		wlan_fill_hal_wifi_rate(pmpriv, &tlv_rtt_result->rx_rate,
+					&rtt_result->rx_rate);
+		rtt_result->rtt = wlan_le64_to_cpu(tlv_rtt_result->rtt);
+		rtt_result->rtt_sd = wlan_le64_to_cpu(tlv_rtt_result->rtt_sd);
+		rtt_result->rtt_spread =
+			wlan_le64_to_cpu(tlv_rtt_result->rtt_spread);
+		rtt_result->distance_mm =
+			wlan_le32_to_cpu(tlv_rtt_result->distance_mm);
+		rtt_result->distance_sd_mm =
+			wlan_le32_to_cpu(tlv_rtt_result->distance_sd_mm);
+		rtt_result->distance_spread_mm =
+			wlan_le32_to_cpu(tlv_rtt_result->distance_spread_mm);
+		rtt_result->ts = wlan_le64_to_cpu(tlv_rtt_result->ts);
+		rtt_result->burst_duration =
+			wlan_le32_to_cpu(tlv_rtt_result->burst_duration);
+		rtt_result->negotiated_burst_num =
+			wlan_le32_to_cpu(tlv_rtt_result->negotiated_burst_num);
+		pos += sizeof(*rtt_result);
+
+		tlv_ie = (IEEEtypes_Header_t *)(tlv_rtt_result->tlv_buffer);
+		tlv_pos = (t_u8 *)tlv_ie;
+		tlv_left_len =
+			tlv_rtt_result_len - (sizeof(*tlv_rtt_result) -
+					      sizeof(tlv_rtt_result->header));
+		PRINTM(MCMND, "tlv_ie=%p tlv_left_len=%d\n", tlv_ie,
+		       tlv_left_len);
+		/** Get the standard IEEEIE: MEASUREMENT_REPORT for LCI/LCR*/
+		while ((tlv_left_len > 0) && (tlv_left_len > sizeof(*tlv_ie))) {
+			tlv_ie_len = tlv_ie->len;
+			PRINTM(MCMND,
+			       "[-] tlv_ie=%p tlv_ie_len=%d   tlv_left_len=%d  jump=%d\n",
+			       tlv_ie, tlv_ie_len, tlv_left_len,
+			       sizeof(*tlv_ie) + tlv_ie_len);
+			if ((tlv_ie_len > 0) &&
+			    (tlv_ie->element_id == MEASUREMENT_REPORT)) {
+				PRINTM(MCMND, "LCI/LCR IE: id=%d len=%d\n",
+				       tlv_ie->element_id, tlv_ie->len);
+				memcpy_ext(pmpriv->adapter, pos, (t_u8 *)tlv_ie,
+					   sizeof(*tlv_ie) + tlv_ie_len,
+					   sizeof(*tlv_ie) + tlv_ie_len);
+				pos += sizeof(*tlv_ie) + tlv_ie_len;
+			}
+			tlv_left_len -= sizeof(*tlv_ie) + tlv_ie_len;
+			tlv_pos += sizeof(*tlv_ie) + tlv_ie_len;
+			tlv_ie = (IEEEtypes_Header_t *)tlv_pos;
+			PRINTM(MCMND,
+			       "[+] tlv_ie=%p tlv_ie_len=%d   tlv_left_len=%d \n",
+			       tlv_ie, tlv_ie_len, tlv_left_len);
+		}
+
+		rtt_result_elem->len = pos - rtt_result_elem->data;
+
+		tlv += tlv_rtt_result_len + sizeof(tlv_rtt_result->header);
+		event_left_len -=
+			tlv_rtt_result_len + sizeof(tlv_rtt_result->header);
+		i++;
+	}
+
+	/** event_len include the mlan_event header and payload */
+	pevent->event_len = pos - pevent->event_buf;
+	PRINTM(MCMND, "pevent->event_len=%d \n", pevent->event_len);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command of ftm config responder.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *cmd,
+						 t_u16 cmd_action,
+						 t_u32 cmd_oid,
+						 t_void *pdata_buf)
+{
+	mlan_rtt_responder *rtt_rsp_cfg = (mlan_rtt_responder *)pdata_buf;
+	HostCmd_DS_FTM_CONFIG_RESPONDER *responder =
+		&cmd->params.ftm_rtt_responder;
+	t_u8 *tlv = responder->tlv_buffer;
+	MrvlIEtypes_RTTResponderEnCfg_t *tlv_rsp_en = MNULL;
+	MrvlIEtypes_RTTLCICfg_t *tlv_lci = MNULL;
+	MrvlIEtypes_RTTLCRCfg_t *tlv_lcr = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_FTM_CONFIG_RESPONDER);
+	cmd->size = S_DS_GEN + sizeof(HostCmd_DS_FTM_CONFIG_RESPONDER);
+
+	switch (rtt_rsp_cfg->action) {
+	case RTT_GET_RESPONDER_INFO:
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_GET_RSP_INFO);
+		break;
+	case RTT_SET_RESPONDER_ENABLE:
+		tlv_rsp_en = (MrvlIEtypes_RTTResponderEnCfg_t *)tlv;
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_EN);
+		tlv_rsp_en->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_RTT_RESPONDER_EN_CFG);
+		tlv_rsp_en->header.len = wlan_cpu_to_le16(
+			sizeof(*tlv_rsp_en) - sizeof(MrvlIEtypesHeader_t));
+		tlv_rsp_en->channel = rtt_rsp_cfg->u.encfg.channel;
+		tlv_rsp_en->bandcfg = rtt_rsp_cfg->u.encfg.bandcfg;
+		tlv_rsp_en->max_duration_seconds =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.encfg.max_dur_sec);
+		cmd->size += sizeof(*tlv_rsp_en);
+		break;
+	case RTT_SET_RESPONDER_DISABLE:
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_DIS);
+		break;
+	case RTT_SET_RESPONDER_LCI:
+		tlv_lci = (MrvlIEtypes_RTTLCICfg_t *)tlv;
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_LCI);
+		tlv_lci->header.type = wlan_cpu_to_le16(TLV_TYPE_RTT_LCI_CFG);
+		tlv_lci->header.len = wlan_cpu_to_le16(
+			sizeof(*tlv_lci) - sizeof(MrvlIEtypesHeader_t));
+		tlv_lci->latitude =
+			wlan_cpu_to_le64(rtt_rsp_cfg->u.lci.latitude);
+		tlv_lci->longitude =
+			wlan_cpu_to_le64(rtt_rsp_cfg->u.lci.longitude);
+		tlv_lci->altitude =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.altitude);
+		tlv_lci->latitude_unc = rtt_rsp_cfg->u.lci.latitude_unc;
+		tlv_lci->longitude_unc = rtt_rsp_cfg->u.lci.longitude_unc;
+		tlv_lci->altitude_unc = rtt_rsp_cfg->u.lci.altitude_unc;
+		tlv_lci->motion_pattern = rtt_rsp_cfg->u.lci.motion_pattern;
+		tlv_lci->floor = wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.floor);
+		tlv_lci->height_above_floor =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.height_above_floor);
+		tlv_lci->height_unc =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.height_unc);
+		cmd->size += sizeof(*tlv_lci);
+		break;
+	case RTT_SET_RESPONDER_LCR:
+		tlv_lcr = (MrvlIEtypes_RTTLCRCfg_t *)tlv;
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_LCR);
+		tlv_lcr->header.type = wlan_cpu_to_le16(TLV_TYPE_RTT_LCR_CFG);
+		tlv_lcr->header.len = wlan_cpu_to_le16(
+			sizeof(*tlv_lcr) - sizeof(MrvlIEtypesHeader_t));
+		memcpy_ext(pmpriv->adapter, tlv_lcr->country_code,
+			   rtt_rsp_cfg->u.lcr.country_code,
+			   sizeof(rtt_rsp_cfg->u.lcr.country_code),
+			   sizeof(tlv_lcr->country_code));
+		tlv_lcr->length = wlan_cpu_to_le32(rtt_rsp_cfg->u.lcr.length);
+		memcpy_ext(pmpriv->adapter, tlv_lcr->civic_info,
+			   rtt_rsp_cfg->u.lcr.civic_info,
+			   sizeof(rtt_rsp_cfg->u.lcr.civic_info),
+			   sizeof(tlv_lcr->civic_info));
+		cmd->size += sizeof(*tlv_lcr);
+		break;
+	default:
+		PRINTM(MERROR,
+		       "wlan_cmd_802_11_ftm_config_responder: action not found\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+		break;
+	}
+
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function handles the command response of ftm config responder
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *resp,
+						 mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)(pioctl_buf->pbuf);
+	mlan_rtt_responder *rtt_rsp_cfg = &(misc->param.rtt_rsp_cfg);
+	HostCmd_DS_FTM_CONFIG_RESPONDER *responder = MNULL;
+	t_u32 cmdrsp_len = wlan_le16_to_cpu(resp->size);
+	int left_len = 0;
+	t_u8 *tlv = MNULL;
+	MrvlIEtypes_RTTResponderInfo_t *tlv_rsp_info = MNULL;
+
+	ENTER();
+
+	PRINTM(MCMND, "ftm config responder successfully cmdrsp_len=%d\n",
+	       cmdrsp_len);
+
+	if ((cmdrsp_len < S_DS_GEN) ||
+	    (cmdrsp_len - S_DS_GEN < sizeof(HostCmd_DS_FTM_CONFIG_RESPONDER)))
+		goto done;
+
+	responder = &resp->params.ftm_rtt_responder;
+	left_len = cmdrsp_len - (S_DS_GEN + sizeof(*responder));
+	PRINTM(MCMND, "left_len=%d\n", left_len);
+
+	tlv = responder->tlv_buffer;
+	while ((left_len > 0) && (left_len > sizeof(MrvlIEtypesHeader_t))) {
+		PRINTM(MCMND, "left_len=%d tlv: type=0x%x len=%d\n", left_len,
+		       ((MrvlIEtypesHeader_t *)tlv)->type,
+		       ((MrvlIEtypesHeader_t *)tlv)->len);
+		if (((MrvlIEtypesHeader_t *)tlv)->type ==
+		    TLV_TYPE_RTT_RESPONDER_INFO) {
+			if (((MrvlIEtypesHeader_t *)tlv)->len >=
+			    (sizeof(MrvlIEtypes_RTTResponderInfo_t) -
+			     sizeof(MrvlIEtypesHeader_t))) {
+				tlv_rsp_info =
+					(MrvlIEtypes_RTTResponderInfo_t *)tlv;
+				PRINTM(MCMND, "rtt_rsp_cfg->action=0x%x\n",
+				       rtt_rsp_cfg->action);
+				if (rtt_rsp_cfg->action ==
+					    RTT_GET_RESPONDER_INFO ||
+				    rtt_rsp_cfg->action ==
+					    RTT_SET_RESPONDER_ENABLE) {
+					rtt_rsp_cfg->u.info.channel =
+						tlv_rsp_info->channel;
+					rtt_rsp_cfg->u.info.bandcfg =
+						tlv_rsp_info->bandcfg;
+					rtt_rsp_cfg->u.info.preamble =
+						tlv_rsp_info->preamble;
+					PRINTM(MCMND,
+					       "set to rtt_rsp_cfg channel=%d bandcfg=%d %d %d %d preamble=%d\n",
+					       rtt_rsp_cfg->u.info.channel,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chanBand,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chanWidth,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chan2Offset,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chan2Offset,
+					       rtt_rsp_cfg->u.info.preamble);
+					break;
+				}
+			}
+		}
+		left_len -= ((MrvlIEtypesHeader_t *)tlv)->len +
+			    sizeof(MrvlIEtypesHeader_t);
+		tlv += ((MrvlIEtypesHeader_t *)tlv)->len +
+		       sizeof(MrvlIEtypesHeader_t);
+	}
+
+done:
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief Handle the version_ext resp
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -2957,13 +3619,16 @@
 
 	if (!pmadapter->cmd_sent && !pmadapter->curr_cmd &&
 	    !pmadapter->keep_wakeup && !wlan_is_tx_pending(pmadapter) &&
+	    !wlan_is_rx_pending(pmadapter) && !pmadapter->event_cause &&
 	    !IS_CARD_RX_RCVD(pmadapter)) {
 		wlan_dnld_sleep_confirm_cmd(pmadapter);
 	} else {
-		PRINTM(MCMND, "Delay Sleep Confirm (%s%s%s%s)\n",
+		PRINTM(MCMND, "Delay Sleep Confirm (%s%s%s%s%s%s)\n",
 		       (pmadapter->cmd_sent) ? "D" : "",
 		       (pmadapter->curr_cmd) ? "C" : "",
+		       (pmadapter->event_cause) ? "V" : "",
 		       (wlan_is_tx_pending(pmadapter)) ? "T" : "",
+		       (wlan_is_rx_pending(pmadapter)) ? "P" : "",
 		       (IS_CARD_RX_RCVD(pmadapter)) ? "R" : "");
 	}
 
@@ -3141,8 +3806,10 @@
 		LEAVE();
 		return;
 	}
-	PRINTM_NETINTF(MEVENT, pmpriv);
-	PRINTM(MEVENT, "#\n");
+	if (pmadapter->second_mac)
+		PRINTM(MEVENT, "##\n");
+	else
+		PRINTM(MEVENT, "#\n");
 	if (cmd->result != MLAN_STATUS_SUCCESS) {
 		PRINTM(MERROR, "Sleep confirm command failed\n");
 		pmadapter->pm_wakeup_card_req = MFALSE;
@@ -3192,6 +3859,16 @@
 		psmode_enh->action = wlan_cpu_to_le16(GET_PS);
 		psmode_enh->params.ps_bitmap = wlan_cpu_to_le16(ps_bitmap);
 		cmd->size = wlan_cpu_to_le16(S_DS_GEN + AUTO_PS_FIX_SIZE);
+	} else if (cmd_action == EXT_PS_PARAM) {
+		psmode_enh->action = wlan_cpu_to_le16(EXT_PS_PARAM);
+		psmode_enh->params.ext_param.reserved = 0;
+		cmd->size = wlan_cpu_to_le16(S_DS_GEN + sizeof(t_u16) +
+					     sizeof(ext_ps_param));
+		psmode_enh->params.ext_param.param.header.type =
+			wlan_cpu_to_le16(TLV_TYPE_PS_EXT_PARAM);
+		psmode_enh->params.ext_param.param.header.len = sizeof(t_u32);
+		psmode_enh->params.ext_param.param.mode =
+			wlan_cpu_to_le32(*((t_u32 *)pdata_buf));
 	} else if (cmd_action == EN_AUTO_PS) {
 		psmode_enh->action = wlan_cpu_to_le16(EN_AUTO_PS);
 		psmode_enh->params.auto_ps.ps_bitmap =
@@ -3722,6 +4399,102 @@
 }
 
 /**
+ * @brief This function prepares command of fw_wakeup_method.
+ *
+ * @param pmpriv       A pointer to mlan_private structure
+ * @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ * @param cmd_action   The action: GET or SET
+ * @param pdata_buf    A pointer to data buffer
+ *
+ * @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_802_11_fw_wakeup_method(pmlan_private pmpriv,
+					     HostCmd_DS_COMMAND *cmd,
+					     t_u16 cmd_action, t_u16 *pdata_buf)
+{
+	HostCmd_DS_802_11_FW_WAKEUP_METHOD *fwwm = &cmd->params.fwwakeupmethod;
+	mlan_fw_wakeup_params *fw_wakeup_params = MNULL;
+	MrvlIEtypes_WakeupSourceGPIO_t *tlv =
+		(MrvlIEtypes_WakeupSourceGPIO_t *)(t_u8 *)fwwm->tlv_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_FW_WAKE_METHOD);
+	cmd->size = sizeof(HostCmd_DS_802_11_FW_WAKEUP_METHOD) + S_DS_GEN;
+	fwwm->action = wlan_cpu_to_le16(cmd_action);
+	switch (cmd_action) {
+	case HostCmd_ACT_GEN_SET:
+		fw_wakeup_params = (mlan_fw_wakeup_params *)pdata_buf;
+		fwwm->method = wlan_cpu_to_le16(fw_wakeup_params->method);
+
+		if (fw_wakeup_params->method == WAKEUP_FW_THRU_GPIO) {
+			cmd->size += sizeof(MrvlIEtypes_WakeupSourceGPIO_t);
+			tlv->header.type = wlan_cpu_to_le16(
+				TLV_TYPE_HS_WAKEUP_SOURCE_GPIO);
+			tlv->header.len = wlan_cpu_to_le16(
+				sizeof(MrvlIEtypes_WakeupSourceGPIO_t) -
+				sizeof(MrvlIEtypesHeader_t));
+			tlv->ind_gpio = (t_u8)fw_wakeup_params->gpio_pin;
+		}
+
+		break;
+	case HostCmd_ACT_GEN_GET:
+	default:
+		fwwm->method = wlan_cpu_to_le16(WAKEUP_FW_UNCHANGED);
+		break;
+	}
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of fw_wakeup_method
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_fw_wakeup_method(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp,
+				      mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_802_11_FW_WAKEUP_METHOD *fwwm = &resp->params.fwwakeupmethod;
+	t_u16 action;
+	MrvlIEtypes_WakeupSourceGPIO_t *gpio_tlv =
+		(MrvlIEtypes_WakeupSourceGPIO_t *)(t_u8 *)fwwm->tlv_buf;
+	mlan_ds_pm_cfg *pmcfg = MNULL;
+
+	ENTER();
+
+	action = wlan_le16_to_cpu(fwwm->action);
+
+	pmpriv->adapter->fw_wakeup_method = wlan_le16_to_cpu(fwwm->method);
+	pmpriv->adapter->fw_wakeup_gpio_pin = 0;
+
+	if ((resp->size -
+	     (sizeof(HostCmd_DS_802_11_FW_WAKEUP_METHOD) + S_DS_GEN)) ==
+	    sizeof(MrvlIEtypes_WakeupSourceGPIO_t)) {
+		pmpriv->adapter->fw_wakeup_gpio_pin = gpio_tlv->ind_gpio;
+	}
+	PRINTM(MCMND, "FW wakeup method=%d, gpio=%d\n",
+	       pmpriv->adapter->fw_wakeup_method,
+	       pmpriv->adapter->fw_wakeup_gpio_pin);
+
+	if (pioctl_buf) {
+		pmcfg = (mlan_ds_pm_cfg *)pioctl_buf->pbuf;
+		pmcfg->param.fw_wakeup_params.method =
+			pmpriv->adapter->fw_wakeup_method;
+		pmcfg->param.fw_wakeup_params.gpio_pin =
+			pmpriv->adapter->fw_wakeup_gpio_pin;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  * @brief This function prepares command of robustcoex.
  *
  * @param pmpriv       A pointer to mlan_private structure
@@ -3837,6 +4610,67 @@
 #endif
 
 /**
+ * @brief This function enable/disable CSI support.
+ *
+ * @param pmpriv       A pointer to mlan_private structure
+ * @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ * @param cmd_action   The action: GET or SET
+ * @param pdata_buf    A pointer to data buffer
+ *
+ * @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_csi(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+			 t_u16 cmd_action, t_u16 *pdata_buf)
+{
+	HostCmd_DS_CSI_CFG *csi_cfg_cmd = &cmd->params.csi_params;
+	mlan_ds_csi_params *csi_params = MNULL;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CSI);
+	cmd->size = sizeof(HostCmd_DS_CSI_CFG) + S_DS_GEN;
+	csi_cfg_cmd->action = wlan_cpu_to_le16(cmd_action);
+	switch (cmd_action) {
+	case CSI_CMD_ENABLE:
+		csi_params = (mlan_ds_csi_params *)pdata_buf;
+		csi_cfg_cmd->head_id = wlan_cpu_to_le32(csi_params->head_id);
+		csi_cfg_cmd->tail_id = wlan_cpu_to_le32(csi_params->tail_id);
+		csi_cfg_cmd->chip_id = csi_params->chip_id;
+		csi_cfg_cmd->csi_channel_bandconfig.header.type =
+			wlan_cpu_to_le16(NXP_CSI_MONITOR_TLV_ID);
+		csi_cfg_cmd->csi_channel_bandconfig.header.len =
+			sizeof(MrvlIEtypes_csi_channel_bandcfg_t) -
+			sizeof(MrvlIEtypesHeader_t);
+		csi_cfg_cmd->csi_channel_bandconfig.bandconfig =
+			csi_params->band_config;
+		csi_cfg_cmd->csi_channel_bandconfig.channel =
+			csi_params->channel;
+		csi_cfg_cmd->csi_channel_bandconfig.csi_monitor_enable =
+			csi_params->csi_monitor_enable;
+		csi_cfg_cmd->csi_channel_bandconfig.ra4us = csi_params->ra4us;
+		csi_cfg_cmd->csi_filter_cnt = csi_params->csi_filter_cnt;
+		if (csi_cfg_cmd->csi_filter_cnt > CSI_FILTER_MAX)
+			csi_cfg_cmd->csi_filter_cnt = CSI_FILTER_MAX;
+		memcpy_ext(pmpriv->adapter, (t_u8 *)csi_cfg_cmd->csi_filter,
+			   (t_u8 *)csi_params->csi_filter,
+			   sizeof(mlan_csi_filter_t) *
+				   csi_cfg_cmd->csi_filter_cnt,
+			   sizeof(csi_cfg_cmd->csi_filter));
+		DBG_HEXDUMP(MCMD_D, "Enable CSI", csi_cfg_cmd,
+			    sizeof(HostCmd_DS_CSI_CFG));
+		break;
+	case CSI_CMD_DISABLE:
+		DBG_HEXDUMP(MCMD_D, "Disable CSI", csi_cfg_cmd,
+			    sizeof(HostCmd_DS_CSI_CFG));
+	default:
+		break;
+	}
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  * @brief This function prepares command of dmcs config.
  *
  * @param pmpriv       A pointer to mlan_private structure
@@ -4261,6 +5095,38 @@
 }
 
 /**
+ *  @brief  This function prepares command of func_init.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_func_init(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd)
+{
+	HostCmd_DS_FUNC_INIT *func_init = &cmd->params.func_init;
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	MrvlIEtypes_boot_time_cfg_t *pboot_time_tlv = MNULL;
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_FUNC_INIT);
+	cmd->size = S_DS_GEN + sizeof(MrvlIEtypes_boot_time_cfg_t);
+	pboot_time_tlv = (MrvlIEtypes_boot_time_cfg_t *)func_init->tlv_buf;
+	pboot_time_tlv->type = wlan_cpu_to_le16(TLV_TYPE_BOOT_TIME_CFG);
+	pboot_time_tlv->len =
+		wlan_cpu_to_le16(sizeof(MrvlIEtypes_boot_time_cfg_t) -
+				 sizeof(MrvlIEtypesHeader_t));
+	if (pmadapter->init_para.bootup_cal_ctrl == 1) {
+		pboot_time_tlv->enable = MTRUE;
+	} else {
+		pboot_time_tlv->enable = MFALSE;
+	}
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief  This function issues adapter specific commands
  *          to initialize firmware
  *
@@ -4323,16 +5189,6 @@
 		pmadapter->ptxpwr_data = MNULL;
 		pmadapter->txpwr_data_len = 0;
 	}
-	if (!pmadapter->pdpd_data &&
-	    (pmadapter->dpd_data_len == UNKNOW_DPD_LENGTH)) {
-		ret = wlan_prepare_cmd(priv, HostCmd_CMD_CFG_DATA,
-				       HostCmd_ACT_GEN_GET, OID_TYPE_DPD, MNULL,
-				       MNULL);
-		if (ret) {
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-	}
 	/** Cal data dnld cmd prepare */
 	if ((pmadapter->pcal_data) && (pmadapter->cal_data_len > 0)) {
 		ret = wlan_prepare_cmd(priv, HostCmd_CMD_CFG_DATA,
@@ -4382,6 +5238,7 @@
 #ifdef STA_SUPPORT
 	pmlan_private pmpriv_sta = MNULL;
 #endif
+	t_u32 mode = BLOCK_CMD_IN_PRE_ASLEEP;
 	ENTER();
 
 	pmpriv = wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY);
@@ -4389,9 +5246,18 @@
 	pmpriv_sta = wlan_get_priv(pmadapter, MLAN_BSS_ROLE_STA);
 #endif
 
-#ifdef SDIO
-	if (IS_SD(pmadapter->card_type)) {
+	/* Get fw wakeup method */
+	if (pmpriv) {
+		ret = wlan_prepare_cmd(pmpriv,
+				       HostCmd_CMD_802_11_FW_WAKE_METHOD,
+				       HostCmd_ACT_GEN_GET, 0, MNULL, MNULL);
+		if (ret) {
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
 	}
+
+#ifdef SDIO
 #endif
 
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_RECONFIGURE_TX_BUFF,
@@ -4415,7 +5281,17 @@
 		}
 	}
 #endif
-
+	if (pmpriv && (pmadapter->init_para.disable_11h_tpc)) {
+		/* Send command to FW to disable 11h tpc */
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_SNMP_MIB,
+				       HostCmd_ACT_GEN_SET,
+				       Dot11h_disable_tpc_i, MNULL,
+				       &pmadapter->init_para.disable_11h_tpc);
+		if (ret) {
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+	}
 #ifdef STA_SUPPORT
 	if (pmpriv_sta && (pmadapter->ps_mode == Wlan802_11PowerModePSP)) {
 		ret = wlan_prepare_cmd(pmpriv_sta,
@@ -4441,6 +5317,45 @@
 		}
 	}
 
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_PS_MODE_ENH,
+			       EXT_PS_PARAM, HostCmd_ACT_GEN_SET, MNULL, &mode);
+	if (ret) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	if (pmadapter->init_para.antcfg)
+		wlan_handle_antcfg(pmpriv, pmadapter->init_para.antcfg);
+
+	if (pmadapter->init_para.dmcs) {
+		mlan_ds_misc_mapping_policy dmcs_policy;
+		dmcs_policy.subcmd = 0;
+		dmcs_policy.mapping_policy = pmadapter->init_para.dmcs;
+
+		if (pmadapter->init_para.dmcs == 2)
+			dmcs_policy.mapping_policy = 0;
+		else {
+			dmcs_policy.mapping_policy = pmadapter->init_para.dmcs;
+			if ((pmadapter->init_para.dmcs == 1) &&
+			    (pmadapter->init_para.pref_dbc == 2))
+				dmcs_policy.mapping_policy = 2;
+			else
+				dmcs_policy.mapping_policy = 1;
+		}
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_DMCS_CONFIG,
+				       HostCmd_ACT_GEN_SET, 0, (t_void *)MNULL,
+				       &dmcs_policy);
+	}
+
+	if (pmadapter->init_para.reject_addba_req) {
+		mlan_ds_reject_addba_req rej_addba_req_cfg;
+		rej_addba_req_cfg.conditions =
+			pmadapter->init_para.reject_addba_req;
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_REJECT_ADDBA_REQ,
+				       HostCmd_ACT_GEN_SET, 0, (t_void *)MNULL,
+				       &rej_addba_req_cfg);
+	}
+
 #define DEF_AUTO_NULL_PKT_PERIOD 30
 	if (pmpriv_sta) {
 		t_u32 value = DEF_AUTO_NULL_PKT_PERIOD;
@@ -4484,7 +5399,7 @@
 			(t_u8)(pmadapter->init_para.drcs_chantime_mode >> 8);
 		/* switchtime use default value in fw*/
 		drcs_init_cfg[0].switchtime = 10;
-		drcs_init_cfg[0].undozetime = 5;
+		drcs_init_cfg[0].rx_wait_time = 5;
 		drcs_init_cfg[0].mode =
 			(t_u8)(pmadapter->init_para.drcs_chantime_mode);
 		drcs_init_cfg[1].chan_idx = 0x2;
@@ -4492,7 +5407,7 @@
 			(t_u8)(pmadapter->init_para.drcs_chantime_mode >> 24);
 		/* switchtime use default value in fw*/
 		drcs_init_cfg[1].switchtime = 10;
-		drcs_init_cfg[1].undozetime = 5;
+		drcs_init_cfg[1].rx_wait_time = 5;
 		drcs_init_cfg[1].mode =
 			(t_u8)(pmadapter->init_para.drcs_chantime_mode >> 16);
 		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_DRCS_CONFIG,
@@ -4510,6 +5425,7 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
+
 	ret = MLAN_STATUS_PENDING;
 done:
 	LEAVE();
@@ -4566,6 +5482,10 @@
 		PRINTM(MERROR, "dnld vdll: Fail to alloc vdll buf");
 		goto done;
 	}
+	if (!pmpriv) {
+		PRINTM(MERROR, "dnld vdll: Fail to get pmpriv");
+		goto done;
+	}
 	cmd_hdr = (HostCmd_DS_GEN *)(pmbuf->pbuf + pmbuf->data_offset);
 	cmd_hdr->command = wlan_cpu_to_le16(HostCmd_CMD_VDLL);
 	cmd_hdr->seq_num = wlan_cpu_to_le16(0xFF00);
@@ -4702,8 +5622,10 @@
 	case VDLL_IND_TYPE_REQ:
 		offset = wlan_le32_to_cpu(ind->offset);
 		block_len = wlan_le16_to_cpu(ind->block_len);
-		PRINTM(MEVENT, "VDLL_IND: type=%d offset = 0x%x, len = %d\n",
-		       wlan_le16_to_cpu(ind->type), offset, block_len);
+		PRINTM(MEVENT,
+		       "VDLL_IND: type=%d ID=%d offset = 0x%x len = %d\n",
+		       wlan_le16_to_cpu(ind->type),
+		       wlan_le16_to_cpu(ind->vdllId), offset, block_len);
 		if (offset <= ctrl->vdll_len) {
 			block_len = MIN(block_len, ctrl->vdll_len - offset);
 			if (!pmadapter->cmd_sent) {
@@ -4737,6 +5659,34 @@
 	case VDLL_IND_TYPE_ERR_ID:
 		PRINTM(MERROR, "VDLL_IND (ID ERR).\n");
 		break;
+	case VDLL_IND_TYPE_SEC_ERR_ID:
+		PRINTM(MERROR, "VDLL_IND (SECURE ERR).\n");
+		break;
+	case VDLL_IND_TYPE_INTF_RESET:
+		PRINTM(MEVENT, "VDLL_IND (INTF_RESET)\n");
+#ifdef PCIE8997
+		/* For PCIe PFU, need to reset both Tx and Rx rd/wrptr */
+		if (IS_PCIE8997(pmadapter->card_type)) {
+			pmadapter->pcard_pcie->txbd_wrptr = 0;
+			pmadapter->pcard_pcie->txbd_rdptr = 0;
+			pmadapter->pcard_pcie->rxbd_wrptr =
+				pmadapter->pcard_pcie->reg
+					->txrx_rw_ptr_rollover_ind;
+			pmadapter->pcard_pcie->rxbd_rdptr = 0;
+		}
+#endif
+#if defined(SD8997) || defined(SD8987) || defined(SD8978)
+		/* For SDIO, need to reset wr_port only */
+		if (IS_SD8997(pmadapter->card_type) ||
+		    IS_SD8987(pmadapter->card_type) ||
+		    IS_SD8978(pmadapter->card_type)) {
+			pmadapter->pcard_sd->curr_wr_port =
+				pmadapter->pcard_sd->reg->start_wr_port;
+			pmadapter->pcard_sd->mpa_tx.start_port =
+				pmadapter->pcard_sd->reg->start_wr_port;
+		}
+#endif
+		break;
 	default:
 		PRINTM(MERROR, "unknow vdll ind type=%d\n", ind->type);
 		break;
@@ -5113,7 +6063,7 @@
 
 	if (cmd_action == HostCmd_ACT_GEN_SET) {
 		channel_time_slicing->header.type =
-			wlan_cpu_to_le16(MRVL_DRCS_TIME_SLICE_TLV_ID);
+			wlan_cpu_to_le16(NXP_DRCS_TIME_SLICE_TLV_ID);
 		channel_time_slicing->header.len =
 			wlan_cpu_to_le16(sizeof(MrvlTypes_DrcsTimeSlice_t) -
 					 sizeof(MrvlIEtypesHeader_t));
@@ -5121,14 +6071,14 @@
 			wlan_cpu_to_le16(drcs_cfg->chan_idx);
 		channel_time_slicing->chantime = drcs_cfg->chantime;
 		channel_time_slicing->switchtime = drcs_cfg->switchtime;
-		channel_time_slicing->undozetime = drcs_cfg->undozetime;
+		channel_time_slicing->rx_wait_time = drcs_cfg->rx_wait_time;
 		channel_time_slicing->mode = drcs_cfg->mode;
 		PRINTM(MCMND,
-		       "Set multi-channel: chan_idx=%d chantime=%d switchtime=%d undozetime=%d mode=%d\n",
+		       "Set multi-channel: chan_idx=%d chantime=%d switchtime=%d rx_wait_time=%d mode=%d\n",
 		       channel_time_slicing->chan_idx,
 		       channel_time_slicing->chantime,
 		       channel_time_slicing->switchtime,
-		       channel_time_slicing->undozetime,
+		       channel_time_slicing->rx_wait_time,
 		       channel_time_slicing->mode);
 		cmd->size = wlan_cpu_to_le16(S_DS_GEN +
 					     sizeof(HostCmd_DS_DRCS_CFG));
@@ -5137,7 +6087,7 @@
 			drcs_cfg++;
 			channel_time_slicing = pdrcs_cfg->drcs_buf;
 			channel_time_slicing->header.type =
-				wlan_cpu_to_le16(MRVL_DRCS_TIME_SLICE_TLV_ID);
+				wlan_cpu_to_le16(NXP_DRCS_TIME_SLICE_TLV_ID);
 			channel_time_slicing->header.len = wlan_cpu_to_le16(
 				sizeof(MrvlTypes_DrcsTimeSlice_t) -
 				sizeof(MrvlIEtypesHeader_t));
@@ -5145,14 +6095,16 @@
 				wlan_cpu_to_le16(drcs_cfg->chan_idx);
 			channel_time_slicing->chantime = drcs_cfg->chantime;
 			channel_time_slicing->switchtime = drcs_cfg->switchtime;
-			channel_time_slicing->undozetime = drcs_cfg->undozetime;
+			// coverity[overflow_sink:SUPPRESS]
+			channel_time_slicing->rx_wait_time =
+				drcs_cfg->rx_wait_time;
 			channel_time_slicing->mode = drcs_cfg->mode;
 			PRINTM(MCMND,
-			       "Set multi-channel: chan_idx=%d chantime=%d switchtime=%d undozetime=%d mode=%d\n",
+			       "Set multi-channel: chan_idx=%d chantime=%d switchtime=%d rx_wait_time=%d mode=%d\n",
 			       channel_time_slicing->chan_idx,
 			       channel_time_slicing->chantime,
 			       channel_time_slicing->switchtime,
-			       channel_time_slicing->undozetime,
+			       channel_time_slicing->rx_wait_time,
 			       channel_time_slicing->mode);
 			cmd->size += wlan_cpu_to_le16(
 				sizeof(MrvlTypes_DrcsTimeSlice_t));
@@ -5190,7 +6142,7 @@
 	if (pioctl_buf) {
 		pcfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
 		if (wlan_le16_to_cpu(channel_time_slicing->header.type) !=
-			    MRVL_DRCS_TIME_SLICE_TLV_ID ||
+			    NXP_DRCS_TIME_SLICE_TLV_ID ||
 		    wlan_le16_to_cpu(channel_time_slicing->header.len) !=
 			    sizeof(MrvlTypes_DrcsTimeSlice_t) -
 				    sizeof(MrvlIEtypesHeader_t)) {
@@ -5203,15 +6155,15 @@
 			channel_time_slicing->chantime;
 		pcfg->param.drcs_cfg[0].switchtime =
 			channel_time_slicing->switchtime;
-		pcfg->param.drcs_cfg[0].undozetime =
-			channel_time_slicing->undozetime;
+		pcfg->param.drcs_cfg[0].rx_wait_time =
+			channel_time_slicing->rx_wait_time;
 		pcfg->param.drcs_cfg[0].mode = channel_time_slicing->mode;
 		PRINTM(MCMND,
-		       "multi-channel: chan_idx=%d chantime=%d switchtime=%d undozetime=%d mode=%d\n",
+		       "multi-channel: chan_idx=%d chantime=%d switchtime=%d rx_wait_time=%d mode=%d\n",
 		       pcfg->param.drcs_cfg[0].chan_idx,
 		       channel_time_slicing->chantime,
 		       channel_time_slicing->switchtime,
-		       channel_time_slicing->undozetime,
+		       channel_time_slicing->rx_wait_time,
 		       channel_time_slicing->mode);
 		pioctl_buf->buf_len = sizeof(mlan_ds_drcs_cfg);
 		/*Channel for chan_idx 1 and 2 have different parameters*/
@@ -5219,7 +6171,7 @@
 			channel_time_slicing1 = presp_cfg->drcs_buf;
 			if (wlan_le16_to_cpu(
 				    channel_time_slicing1->header.type) !=
-				    MRVL_DRCS_TIME_SLICE_TLV_ID ||
+				    NXP_DRCS_TIME_SLICE_TLV_ID ||
 			    wlan_le16_to_cpu(
 				    channel_time_slicing1->header.len) !=
 				    sizeof(MrvlTypes_DrcsTimeSlice_t) -
@@ -5234,13 +6186,13 @@
 			drcs_cfg1->chantime = channel_time_slicing1->chantime;
 			drcs_cfg1->switchtime =
 				channel_time_slicing1->switchtime;
-			drcs_cfg1->undozetime =
-				channel_time_slicing1->undozetime;
+			drcs_cfg1->rx_wait_time =
+				channel_time_slicing1->rx_wait_time;
 			drcs_cfg1->mode = channel_time_slicing1->mode;
 			PRINTM(MCMND,
-			       "multi-channel: chan_idx=%d chantime=%d switchtime=%d undozetime=%d mode=%d\n",
+			       "multi-channel: chan_idx=%d chantime=%d switchtime=%d rx_wait_time=%d mode=%d\n",
 			       drcs_cfg1->chan_idx, drcs_cfg1->chantime,
-			       drcs_cfg1->switchtime, drcs_cfg1->undozetime,
+			       drcs_cfg1->switchtime, drcs_cfg1->rx_wait_time,
 			       drcs_cfg1->mode);
 			pioctl_buf->buf_len += sizeof(mlan_ds_drcs_cfg);
 		}
@@ -5293,7 +6245,7 @@
 	pcmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_SDIO_SP_RX_AGGR_CFG) +
 				      S_DS_GEN);
 	cfg->action = cmd_action;
-	if (cmd_action == HostCmd_ACT_GEN_SET)
+	if (pdata_buf && (cmd_action == HostCmd_ACT_GEN_SET))
 		cfg->enable = *(t_u8 *)pdata_buf;
 	return MLAN_STATUS_SUCCESS;
 }
@@ -5416,7 +6368,7 @@
 			pevent->bss_index = pmpriv->bss_index;
 			pevent->event_id = MLAN_EVENT_ID_STORE_HOST_CMD_RESP;
 			pevent->resp = (t_u8 *)resp;
-			pevent->event_len = wlan_le16_to_cpu(resp->size);
+			pevent->event_len = resp->size;
 			wlan_recv_event(pmpriv,
 					MLAN_EVENT_ID_STORE_HOST_CMD_RESP,
 					(mlan_event *)pevent);
@@ -5441,7 +6393,7 @@
 				 t_u16 cmd_action, t_void *pdata_buf)
 {
 	HostCmd_DS_MAC_CONTROL *pmac = &pcmd->params.mac_ctrl;
-	t_u32 action = *((t_u32 *)pdata_buf);
+	t_u32 action = 0;
 
 	ENTER();
 
@@ -5454,7 +6406,10 @@
 	pcmd->command = wlan_cpu_to_le16(HostCmd_CMD_MAC_CONTROL);
 	pcmd->size =
 		wlan_cpu_to_le16(sizeof(HostCmd_DS_MAC_CONTROL) + S_DS_GEN);
-	pmac->action = wlan_cpu_to_le32(action);
+	if (pdata_buf) {
+		action = *((t_u32 *)pdata_buf);
+		pmac->action = wlan_cpu_to_le32(action);
+	}
 
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -5478,6 +6433,75 @@
 }
 
 /**
+ *  @brief This function handles multi-client scheduling capabilites from FW
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param tlv          A pointer ti TLV payload from FW
+ *  @param tlv_len      length of TLV data pointed by tlv
+ *
+ *  @return             N/A
+ */
+static void wlan_setup_mclient_caps(mlan_private *pmpriv,
+				    mlan_adapter *pmadapter, void *tlv,
+				    t_u16 tlv_len)
+{
+	MrvlIEtypes_MclientFwCaps_t caps = {0};
+
+	memcpy_ext(pmadapter, &caps, tlv, sizeof(caps), tlv_len);
+
+	PRINTM(MMSG, "mclient caps: tx_ba_stream_limit %u, tx_mpdu_pps %u %u",
+	       wlan_le32_to_cpu(caps.tx_ba_stream_limit),
+	       wlan_le32_to_cpu(caps.tx_mpdu_no_amsdu_pps),
+	       wlan_le32_to_cpu(caps.tx_mpdu_with_amsdu_pps));
+
+	pmadapter->mclient_tx_supported =
+		pmadapter->init_para.mclient_scheduling;
+	pmadapter->tx_ba_stream_limit =
+		wlan_le32_to_cpu(caps.tx_ba_stream_limit);
+	pmadapter->tx_mpdu_with_amsdu_pps =
+		wlan_le32_to_cpu(caps.tx_mpdu_with_amsdu_pps);
+	pmadapter->tx_mpdu_no_amsdu_pps =
+		wlan_le32_to_cpu(caps.tx_mpdu_no_amsdu_pps);
+
+	if (pmadapter->mclient_tx_supported)
+		pmadapter->tx_ba_timeout_support = caps.tx_ba_timeout_support;
+	else
+		pmadapter->tx_ba_timeout_support = 1;
+
+	if (!pmadapter->tx_ba_timeout_support) {
+		t_u32 i;
+
+		for (i = 0; i < NELEMENTS(pmadapter->priv); ++i) {
+			mlan_private *mlan = pmadapter->priv[i];
+
+			if (mlan)
+				mlan->add_ba_param.timeout = 0;
+		}
+	}
+
+	wlan_cmd_mclient_scheduling_enable(pmpriv,
+					   pmadapter->mclient_tx_supported);
+}
+
+/**
+ *  @brief This function updates firmware extended caps
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             none
+ */
+static void wlan_update_fw_ext_cap(mlan_adapter *pmadapter)
+{
+	if (!(pmadapter->init_para.dev_cap_mask & MBIT(16)))
+		pmadapter->fw_cap_ext &= ~FW_CAPINFO_EXT_802_11AX;
+	if (!(pmadapter->init_para.dev_cap_mask & MBIT(17)))
+		pmadapter->fw_cap_ext &= ~FW_CAPINFO_EXT_6G;
+}
+
+#define DISABLE_5G_MASK (1U << 10)
+
+/**
  *  @brief This function handles the command response of get_hw_spec
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -5505,11 +6529,18 @@
 	MrvlIEtypes_fw_cap_info_t *fw_cap_tlv = MNULL;
 
 	MrvlIEtypes_Secure_Boot_Uuid_t *sb_uuid_tlv = MNULL;
+	t_u32 feature_mask = 0;
 
 	ENTER();
 
 	pmadapter->fw_cap_info = wlan_le32_to_cpu(hw_spec->fw_cap_info);
-	pmadapter->fw_cap_info &= pmadapter->init_para.dev_cap_mask;
+	/* read feature list from lower 16-bytes only */
+	feature_mask =
+		0xffff0000 | (pmadapter->init_para.dev_cap_mask & 0xffff);
+	if (!(feature_mask & DISABLE_5G_MASK)) {
+		feature_mask &= ~(1 << 13);
+	}
+	pmadapter->fw_cap_info &= feature_mask;
 
 	PRINTM(MMSG, "fw_cap_info=0x%x, dev_cap_mask=0x%x\n",
 	       wlan_le32_to_cpu(hw_spec->fw_cap_info),
@@ -5556,17 +6587,13 @@
 						BAND_GAC;
 			}
 		}
-		pmadapter->adhoc_start_band = BAND_A;
-		pmpriv->adhoc_channel = DEFAULT_AD_HOC_CHANNEL_A;
-	} else if (pmadapter->fw_bands & BAND_G) {
-		pmadapter->adhoc_start_band = BAND_G | BAND_B;
-		pmpriv->adhoc_channel = DEFAULT_AD_HOC_CHANNEL;
-	} else if (pmadapter->fw_bands & BAND_B) {
-		pmadapter->adhoc_start_band = BAND_B;
-		pmpriv->adhoc_channel = DEFAULT_AD_HOC_CHANNEL;
+	} else {
 	}
 #endif /* STA_SUPPORT */
 
+	pmadapter->fw_country_code = wlan_le16_to_cpu(hw_spec->fw_country_code);
+	PRINTM(MCMND, "GET_HW_SPEC: country_code=0x%X\n",
+	       pmadapter->fw_country_code);
 	pmadapter->fw_release_number =
 		wlan_le32_to_cpu(hw_spec->fw_release_number);
 	pmadapter->number_of_antenna =
@@ -5592,6 +6619,9 @@
 	pmadapter->hw_dot_11n_dev_cap =
 		wlan_le32_to_cpu(hw_spec->dot_11n_dev_cap);
 	pmadapter->hw_dev_mcs_support = hw_spec->dev_mcs_support;
+	pmadapter->hw_mpdu_density = GET_MPDU_DENSITY(hw_spec->hw_dev_cap);
+	PRINTM(MCMND, "GET_HW_SPEC: hw_mpdu_density=%d dev_mcs_support=0x%x\n",
+	       pmadapter->hw_mpdu_density, hw_spec->dev_mcs_support);
 	for (i = 0; i < pmadapter->priv_num; i++) {
 		if (pmadapter->priv[i])
 			wlan_update_11n_cap(pmadapter->priv[i]);
@@ -5600,8 +6630,9 @@
 	wlan_show_dot11ndevcap(pmadapter, pmadapter->hw_dot_11n_dev_cap);
 	wlan_show_devmcssupport(pmadapter, pmadapter->hw_dev_mcs_support);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	pmadapter->user_htstream = pmadapter->hw_dev_mcs_support;
 	/** separate stream config for 2.4G and 5G, will be changed according to
 	 * antenna cfg*/
@@ -5653,6 +6684,12 @@
 		pmadapter->max_mgmt_ie_index = MAX_MGMT_IE_INDEX;
 
 	pmadapter->region_code = wlan_le16_to_cpu(hw_spec->region_code);
+#ifdef STA_SUPPORT
+	/* Set country code */
+	memcpy(pmadapter, pmadapter->country_code,
+	       wlan_11d_code_2_region(pmadapter, (t_u8)pmadapter->region_code),
+	       COUNTRY_CODE_LEN - 1);
+#endif
 	for (i = 0; i < MRVDRV_MAX_REGION_CODE; i++) {
 		/* Use the region code to search for the index */
 		if (pmadapter->region_code == region_code_index[i])
@@ -5692,18 +6729,10 @@
 		}
 	}
 #endif
-
-	if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
-				 pmadapter->fw_bands)) {
-		if (pioctl_req)
-			pioctl_req->status_code = MLAN_ERROR_CMD_SCAN_FAIL;
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
 #ifdef STA_SUPPORT
 	if (wlan_11d_set_universaltable(pmpriv, pmadapter->fw_bands)) {
 		if (pioctl_req)
-			pioctl_req->status_code = MLAN_ERROR_CMD_SCAN_FAIL;
+			pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
@@ -5797,8 +6826,10 @@
 			fw_cap_tlv = (MrvlIEtypes_fw_cap_info_t *)tlv;
 			pmadapter->fw_cap_info =
 				wlan_le32_to_cpu(fw_cap_tlv->fw_cap_info);
+			pmadapter->fw_cap_info &= feature_mask;
 			pmadapter->fw_cap_ext =
 				wlan_le32_to_cpu(fw_cap_tlv->fw_cap_ext);
+			wlan_update_fw_ext_cap(pmadapter);
 			PRINTM(MCMND, "fw_cap_info=0x%x fw_cap_ext=0x%x\n",
 			       pmadapter->fw_cap_info, pmadapter->fw_cap_ext);
 			break;
@@ -5809,6 +6840,10 @@
 			PRINTM(MMSG, "uuid: %016llx%016llx\n",
 			       pmadapter->uuid_lo, pmadapter->uuid_hi);
 			break;
+		case TLV_TYPE_MCLIENT_FW_CAPS:
+			wlan_setup_mclient_caps(pmpriv, pmadapter, tlv,
+						tlv_len);
+			break;
 		default:
 			break;
 		}
@@ -5816,6 +6851,19 @@
 		tlv = (MrvlIEtypesHeader_t *)((t_u8 *)tlv + tlv_len +
 					      sizeof(MrvlIEtypesHeader_t));
 	}
+#ifdef PCIE
+	if (IS_PCIE(pmadapter->card_type) &&
+	    IS_FW_SUPPORT_RX_SW_INT(pmadapter)) {
+		pmadapter->ops.select_host_int(pmadapter);
+	}
+#endif
+	if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
+				 pmadapter->fw_bands)) {
+		if (pioctl_req)
+			pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
 done:
 	LEAVE();
 	return ret;
@@ -5932,8 +6980,14 @@
 	HostCmd_DS_REMAIN_ON_CHANNEL *remain_channel =
 		&resp->params.remain_on_chan;
 	mlan_ds_radio_cfg *radio_cfg = MNULL;
+	t_u16 action = wlan_le16_to_cpu(remain_channel->action);
 
 	ENTER();
+	if (action == HostCmd_ACT_GEN_REMOVE)
+		pmpriv->adapter->remain_on_channel = MFALSE;
+	else
+		pmpriv->adapter->remain_on_channel = MTRUE;
+
 	if (pioctl_buf) {
 		radio_cfg = (mlan_ds_radio_cfg *)pioctl_buf->pbuf;
 		radio_cfg->param.remain_chan.status = remain_channel->status;
@@ -5967,7 +7021,7 @@
 	ENTER();
 	cmd->size = wlan_cpu_to_le16((sizeof(HostCmd_DS_WIFI_DIRECT_MODE)) +
 				     S_DS_GEN);
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_WIFI_DIRECT_MODE_CONFIG);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_WIFI_DIRECT_MODE_CONFIG);
 	wfd_mode->action = wlan_cpu_to_le16(cmd_action);
 	if (cmd_action == HostCmd_ACT_GEN_SET)
 		wfd_mode->mode = wlan_cpu_to_le16(mode);
@@ -6026,7 +7080,7 @@
 	ENTER();
 
 	cmd->size = sizeof(HostCmd_DS_WIFI_DIRECT_PARAM_CONFIG) + S_DS_GEN;
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_P2P_PARAMS_CONFIG);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_P2P_PARAMS_CONFIG);
 	p2p_config->action = wlan_cpu_to_le16(cmd_action);
 	if (cmd_action == HostCmd_ACT_GEN_SET) {
 		tlv = (t_u8 *)p2p_config->tlv_buf;
@@ -6226,7 +7280,8 @@
 	ENTER();
 
 	cmd->size = sizeof(HostCmd_DS_GPIO_TSF_LATCH_PARAM_CONFIG) + S_DS_GEN;
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG);
+	cmd->command =
+		wlan_cpu_to_le16(HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG);
 	gpio_tsf_config->action = wlan_cpu_to_le16(cmd_action);
 	if (cmd_action == HostCmd_ACT_GEN_SET) {
 		tlv = (t_u8 *)gpio_tsf_config->tlv_buf;
@@ -6435,6 +7490,84 @@
 }
 
 /**
+ *  @brief This function prepares command of CROSS CHIP SYNCH.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				      t_void *pdata_buf)
+{
+	HostCmd_DS_CROSS_CHIP_SYNCH *cross_chip_synch =
+		&cmd->params.cross_chip_synch;
+	mlan_ds_cross_chip_synch *cfg = (mlan_ds_cross_chip_synch *)pdata_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CROSS_CHIP_SYNCH);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_CROSS_CHIP_SYNCH) +
+				     S_DS_GEN);
+	cross_chip_synch->action = wlan_cpu_to_le16(cmd_action);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		cross_chip_synch->start_stop = cfg->start_stop;
+		cross_chip_synch->role = cfg->role;
+		cross_chip_synch->period = wlan_cpu_to_le32(cfg->period);
+		cross_chip_synch->init_tsf_low =
+			wlan_cpu_to_le32(cfg->init_tsf_low);
+		cross_chip_synch->init_tsf_high =
+			wlan_cpu_to_le32(cfg->init_tsf_high);
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of CROSS CHIP SYNCH.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND structure
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req buf
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp,
+				      mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_CROSS_CHIP_SYNCH *cross_chip_synch =
+		&resp->params.cross_chip_synch;
+	mlan_ds_misc_cfg *cfg = MNULL;
+	ENTER();
+	if (pioctl_buf) {
+		cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+
+		if (wlan_le16_to_cpu(cross_chip_synch->action) ==
+		    HostCmd_ACT_GEN_GET) {
+			cfg->param.cross_chip_synch.start_stop =
+				cross_chip_synch->start_stop;
+			cfg->param.cross_chip_synch.role =
+				cross_chip_synch->role;
+			cfg->param.cross_chip_synch.period =
+				wlan_le32_to_cpu(cross_chip_synch->period);
+			cfg->param.cross_chip_synch.init_tsf_low =
+				wlan_le32_to_cpu(
+					cross_chip_synch->init_tsf_low);
+			cfg->param.cross_chip_synch.init_tsf_high =
+				wlan_le32_to_cpu(
+					cross_chip_synch->init_tsf_high);
+		}
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function prepares command of mimo switch configuration.
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -6538,7 +7671,7 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_TX_RX_PKT_STATS);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_TX_RX_PKT_STATS);
 	cmd->size =
 		wlan_cpu_to_le16(sizeof(HostCmd_DS_TX_RX_HISTOGRAM) + S_DS_GEN);
 
@@ -6564,7 +7697,8 @@
 	HostCmd_DS_TX_RX_HISTOGRAM *ptx_rx_histogram =
 		&resp->params.tx_rx_histogram;
 	mlan_ds_misc_cfg *info;
-	t_u16 cmdsize = wlan_le16_to_cpu(resp->size), length;
+	t_u16 cmdsize = resp->size;
+	t_u16 length;
 	t_u32 *pos, count = 0;
 
 	ENTER();
@@ -6595,75 +7729,6 @@
 	return MLAN_STATUS_SUCCESS;
 }
 
-/*
- *  @brief This function prepares command of cwmode control.
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
- *  @param cmd_action   The action: GET or SET
- *  @param pdata_buf    A pointer to data buffer
- *
- *  @return             MLAN_STATUS_SUCCESS
- */
-mlan_status wlan_cmd_cw_mode_ctrl(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
-				  t_u16 cmd_action, t_void *pdata_buf)
-{
-	HostCmd_DS_CW_MODE_CTRL *cwmode_ctrl = &cmd->params.cwmode;
-	mlan_ds_cw_mode_ctrl *cw_mode = (mlan_ds_cw_mode_ctrl *)pdata_buf;
-	ENTER();
-	cmd->size =
-		wlan_cpu_to_le16((sizeof(HostCmd_DS_CW_MODE_CTRL)) + S_DS_GEN);
-	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CW_MODE_CTRL);
-	cwmode_ctrl->action = wlan_cpu_to_le16(cmd_action);
-
-	if (cmd_action == HostCmd_ACT_GEN_SET) {
-		cwmode_ctrl->mode = cw_mode->mode;
-		cwmode_ctrl->channel = cw_mode->channel;
-		cwmode_ctrl->chanInfo = cw_mode->chanInfo;
-		cwmode_ctrl->txPower = wlan_cpu_to_le16(cw_mode->txPower);
-		cwmode_ctrl->rateInfo = wlan_cpu_to_le32(cw_mode->rateInfo);
-		cwmode_ctrl->pktLength = wlan_cpu_to_le16(cw_mode->pktLength);
-	}
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
-/*
- *  @brief This function handles the command response of cwmode_ctrl
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param resp         A pointer to HostCmd_DS_COMMAND
- *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
- *
- *  @return             MLAN_STATUS_SUCCESS
- */
-mlan_status wlan_ret_cw_mode_ctrl(pmlan_private pmpriv,
-				  HostCmd_DS_COMMAND *resp,
-				  mlan_ioctl_req *pioctl_buf)
-{
-	HostCmd_DS_CW_MODE_CTRL *cwmode_resp = &resp->params.cwmode;
-	mlan_ds_misc_cfg *misc = MNULL;
-
-	ENTER();
-	if (pioctl_buf) {
-		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
-		misc->param.cwmode.mode = cwmode_resp->mode;
-		misc->param.cwmode.channel = cwmode_resp->channel;
-		misc->param.cwmode.chanInfo = cwmode_resp->chanInfo;
-		misc->param.cwmode.txPower =
-			wlan_le16_to_cpu(cwmode_resp->txPower);
-		misc->param.cwmode.rateInfo =
-			wlan_le32_to_cpu(cwmode_resp->rateInfo);
-		;
-		misc->param.cwmode.pktLength =
-			wlan_le16_to_cpu(cwmode_resp->pktLength);
-		;
-		pioctl_buf->data_read_written = sizeof(mlan_ds_misc_cfg);
-	}
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
 /**
  *  @brief This function prepares command of rf_antenna.
  *
@@ -6753,8 +7818,9 @@
 	t_u16 tx_ant_mode = wlan_le16_to_cpu(pantenna->tx_antenna_mode);
 	t_u16 rx_ant_mode = wlan_le16_to_cpu(pantenna->rx_antenna_mode);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	mlan_adapter *pmadapter = pmpriv->adapter;
 #endif
 	typedef struct _HostCmd_DS_802_11_RF_ANTENNA_1X1 {
@@ -6784,10 +7850,18 @@
 		       wlan_le16_to_cpu(pantenna->action_rx), rx_ant_mode);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
-		if (IS_CARD9098(pmadapter->card_type) ||
-		    IS_CARDNW62X(pmadapter->card_type) ||
-		    IS_CARD9097(pmadapter->card_type)) {
+	defined(SDIW624) || defined(SDAW693) || defined(PCIEAW693) ||          \
+	defined(PCIEIW624) || defined(USBIW624)
+		if (IS_CARDAW693(pmadapter->card_type) &&
+		    (tx_ant_mode == RF_ANTENNA_AUTO)) {
+			PRINTM(MCMND,
+			       "user_htstream=0x%x, tx_antenna=0x%x rx_antenna=0x%x\n",
+			       pmadapter->user_htstream, tx_ant_mode,
+			       rx_ant_mode);
+		} else if (IS_CARD9098(pmadapter->card_type) ||
+			   IS_CARDIW624(pmadapter->card_type) ||
+			   IS_CARDAW693(pmadapter->card_type) ||
+			   IS_CARD9097(pmadapter->card_type)) {
 			tx_ant_mode &= 0x0303;
 			rx_ant_mode &= 0x0303;
 			/** 2G antcfg TX */
@@ -6857,8 +7931,9 @@
 {
 	mlan_ds_reg_rw *reg_rw;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	MrvlIEtypes_Reg_type_t *tlv;
 	mlan_adapter *pmadapter = pmpriv->adapter;
 #endif
@@ -6876,11 +7951,13 @@
 		mac_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		mac_reg->value = wlan_cpu_to_le32(reg_rw->value);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_MAC2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW624(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -6917,11 +7994,13 @@
 		bbp_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		bbp_reg->value = (t_u8)reg_rw->value;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_BBP2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW624(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -6947,11 +8026,13 @@
 		rf_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		rf_reg->value = (t_u8)reg_rw->value;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_RF2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW624(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -7012,11 +8093,13 @@
 		bca_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		bca_reg->value = wlan_cpu_to_le32(reg_rw->value);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_BCA2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW624(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -7216,6 +8299,69 @@
 }
 
 /**
+ *  @brief This function prepares command of gpio_cfg.
+ *
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   the action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_gpio_cfg_ops(HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				  t_void *pdata_buf)
+{
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pdata_buf;
+	HostCmd_gpio_cfg_ops *gpio_cfg =
+		(HostCmd_gpio_cfg_ops *)&cmd->params.gpio_cfg_ops;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_GPIO_CFG);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_gpio_cfg_ops) + S_DS_GEN);
+
+	gpio_cfg->action = (t_u8)cmd_action;
+	gpio_cfg->opsType = misc->param.gpio_cfg_ops.opsType;
+	gpio_cfg->pin_num = misc->param.gpio_cfg_ops.pin_num;
+	gpio_cfg->value = misc->param.gpio_cfg_ops.value;
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of gpio_cfg
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to command buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_gpio_cfg_ops(pmlan_private pmpriv,
+				  HostCmd_DS_COMMAND *resp,
+				  mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_ds_gpio_cfg_ops *gpio_cfg = MNULL;
+	HostCmd_gpio_cfg_ops *gpio =
+		(HostCmd_gpio_cfg_ops *)&resp->params.gpio_cfg_ops;
+
+	ENTER();
+
+	if (pioctl_buf) {
+		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		gpio_cfg = &misc->param.gpio_cfg_ops;
+
+		gpio_cfg->action = gpio->action;
+		gpio_cfg->opsType = gpio->opsType;
+		gpio_cfg->pin_num = gpio->pin_num;
+		gpio_cfg->value = gpio->value;
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *
  *  @brief This function handles coex events generated by firmware
  *
@@ -7868,6 +9014,50 @@
 }
 
 /**
+ *  @brief This function prepares command of chan region cfg
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   the action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_chan_region_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_void *pdata_buf)
+{
+	HostCmd_DS_CHAN_REGION_CFG *reg = MNULL;
+	mlan_ds_chan_attr *ca = (mlan_ds_chan_attr *)pdata_buf;
+	MrvlIEtypesHeader_t *tlv = MNULL;
+	t_u32 buf_size = 0;
+
+	ENTER();
+
+	reg = (HostCmd_DS_CHAN_REGION_CFG *)&cmd->params.reg_cfg;
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CHAN_REGION_CFG);
+	cmd->size =
+		wlan_cpu_to_le16(sizeof(HostCmd_DS_CHAN_REGION_CFG) + S_DS_GEN);
+	reg->action = wlan_cpu_to_le16(cmd_action);
+
+	buf_size = MRVDRV_SIZE_OF_CMD_BUFFER - cmd->size;
+	if (ca && (cmd_action == HostCmd_ACT_GEN_SET)) {
+		tlv = (MrvlIEtypesHeader_t *)&reg->tlv_buffer;
+		tlv->type = wlan_cpu_to_le16(TLV_TYPE_CHAN_ATTR_CFG);
+		ca->data_len =
+			MIN(ca->data_len, MIN(sizeof(ca->chan_attr), buf_size));
+		tlv->len = wlan_cpu_to_le16(ca->data_len);
+		memcpy_ext(pmpriv->adapter,
+			   (t_u8 *)tlv + sizeof(MrvlIEtypesHeader_t),
+			   (t_u8 *)ca->chan_attr, ca->data_len, buf_size);
+		cmd->size += wlan_cpu_to_le16(sizeof(MrvlIEtypesHeader_t) +
+					      ca->data_len);
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+/**
  *  @brief This function handles the command response of chan_region_cfg
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -7884,7 +9074,7 @@
 	t_u16 action;
 	HostCmd_DS_CHAN_REGION_CFG *reg = MNULL;
 	t_u8 *tlv_buf = MNULL;
-	t_u16 tlv_buf_left;
+	t_u16 tlv_buf_left = 0;
 	mlan_ds_misc_cfg *misc_cfg = MNULL;
 	mlan_ds_misc_chnrgpwr_cfg *cfg = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -7899,15 +9089,24 @@
 
 	action = wlan_le16_to_cpu(reg->action);
 	if (action != HostCmd_ACT_GEN_GET) {
+		goto done;
+	}
+
+	tlv_buf = (t_u8 *)&resp->params.reg_cfg.tlv_buffer;
+
+	if (resp->size > (S_DS_GEN + sizeof(*reg))) {
+		tlv_buf_left = resp->size - S_DS_GEN - sizeof(*reg);
+	} else {
+		PRINTM(MERROR, "Region size calculation ERROR.\n");
+	}
+	if (!tlv_buf || !tlv_buf_left) {
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
-	tlv_buf = (t_u8 *)reg + sizeof(*reg);
-	tlv_buf_left = wlan_le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*reg);
-
 	/* Add FW cfp tables and region info */
 	wlan_add_fw_cfp_tables(pmpriv, tlv_buf, tlv_buf_left);
+
 	if (pmadapter->otp_region) {
 		if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
 					 pmadapter->fw_bands)) {
@@ -7929,7 +9128,7 @@
 	if (misc_cfg->sub_command == MLAN_OID_MISC_GET_REGIONPWR_CFG) {
 		cfg = (mlan_ds_misc_chnrgpwr_cfg *)&(
 			misc_cfg->param.rgchnpwr_cfg);
-		cfg->length = wlan_le16_to_cpu(resp->size);
+		cfg->length = resp->size;
 		memcpy_ext(pmpriv->adapter, cfg->chnrgpwr_buf, (t_u8 *)resp,
 			   cfg->length, sizeof(cfg->chnrgpwr_buf));
 	} else {
@@ -8208,7 +9407,7 @@
 			.get_link_statistic;
 
 	/* TLV parse */
-	if (resp->size > (sizeof(HostCmd_DS_802_11_LINK_STATISTIC) - S_DS_GEN))
+	if (resp->size > (sizeof(HostCmd_DS_802_11_LINK_STATISTIC) + S_DS_GEN))
 		left_len = resp->size -
 			   sizeof(HostCmd_DS_802_11_LINK_STATISTIC) - S_DS_GEN;
 
@@ -8217,6 +9416,10 @@
 	while (left_len > sizeof(MrvlIEtypesHeader_t)) {
 		tlv_type = wlan_le16_to_cpu(tlv->type);
 		tlv_len = wlan_le16_to_cpu(tlv->len);
+		if (left_len < (tlv_len + sizeof(MrvlIEtypesHeader_t))) {
+			PRINTM(MERROR, "Invalid link statistic tlv\n");
+			break;
+		}
 		switch (tlv_type) {
 		case TLV_TYPE_LL_STAT_IFACE:
 			fw_ifaceStat = (mlan_wifi_iface_stat
@@ -8402,6 +9605,12 @@
 			   iface_stat->peer_info[peerIdx].peer_mac_address,
 			   fw_ifaceStat->peer_info[peerIdx].peer_mac_address,
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		iface_stat->peer_info[peerIdx].bssload.sta_count =
+			wlan_le16_to_cpu(fw_ifaceStat->peer_info[peerIdx]
+						 .bssload.sta_count);
+		iface_stat->peer_info[peerIdx].bssload.chan_util =
+			wlan_le16_to_cpu(fw_ifaceStat->peer_info[peerIdx]
+						 .bssload.chan_util);
 		iface_stat->peer_info[peerIdx].capabilities = wlan_le32_to_cpu(
 			fw_ifaceStat->peer_info[peerIdx].capabilities);
 		iface_stat->peer_info[peerIdx].num_rate = wlan_le32_to_cpu(
@@ -8549,7 +9758,7 @@
 	boot_sleep->action = wlan_cpu_to_le16(cmd_action);
 	boot_sleep->enable = wlan_cpu_to_le16(enable);
 
-	cmd->size = S_DS_GEN + sizeof(HostCmd_DS_BOOT_SLEEP);
+	cmd->size = wlan_cpu_to_le16(S_DS_GEN + sizeof(HostCmd_DS_BOOT_SLEEP));
 
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -8579,257 +9788,6 @@
 	return MLAN_STATUS_SUCCESS;
 }
 
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-
-/**
- *  @brief This function handles send crypto command
- *
- *  @param pmpriv         A pointer to mlan_private structure
- *  @param cmd          Hostcmd ID
- *  @param cmd_action   Command action
- *  @param pdata_buf    A void pointer to information buffer
- *
- *  @return        MLAN_STATUS_SUCCESS
- */
-mlan_status wlan_cmd_crypto(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
-			    t_u16 cmd_action, t_u16 *pdata_buf)
-{
-	HostCmd_DS_CRYPTO *cry_cmd = &cmd->params.crypto_cmd;
-	mlan_ds_sup_cfg *cfg = (mlan_ds_sup_cfg *)pdata_buf;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	subcmd_prf_hmac_sha1_t *prf_hmac_sha1 = MNULL;
-	subcmd_hmac_sha1_t *hmac_sha1 = MNULL;
-	subcmd_hmac_sha256_t *hmac_sha256 = MNULL;
-	subcmd_sha256_t *sha256 = MNULL;
-	subcmd_rijndael_t *rijndael = MNULL;
-	subcmd_rc4_t *rc4 = MNULL;
-	subcmd_md5_t *md5 = MNULL;
-	subcmd_mrvl_f_t *mrvl_f = MNULL;
-	subcmd_sha256_kdf_t *sha256_kdf = MNULL;
-	t_u8 *ptlv = MNULL;
-	t_u8 tlv_bitmap = 0;
-	t_u32 i = 0;
-#endif
-	ENTER();
-
-	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CRYPTO);
-	cmd->size = S_DS_GEN + sizeof(HostCmd_DS_CRYPTO);
-	cry_cmd->action = wlan_cpu_to_le16(cmd_action);
-	cry_cmd->subCmdCode = cfg->sub_command;
-	switch (cfg->sub_command) {
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	case HostCmd_CMD_CRYPTO_SUBCMD_PRF_HMAC_SHA1:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_PREFIX |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		prf_hmac_sha1 = (subcmd_prf_hmac_sha1_t *)cry_cmd->subCmd;
-		prf_hmac_sha1->output_len = cfg->output_len;
-		/* set tlv start */
-		ptlv = prf_hmac_sha1->tlv;
-		cmd->size += sizeof(subcmd_prf_hmac_sha1_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_HMAC_SHA1:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		hmac_sha1 = (subcmd_hmac_sha1_t *)cry_cmd->subCmd;
-		hmac_sha1->output_len = cfg->output_len;
-		hmac_sha1->data_blks_nr = cfg->data_blks_nr;
-		/* set tlv start */
-		ptlv = hmac_sha1->tlv;
-		cmd->size += sizeof(subcmd_hmac_sha1_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_HMAC_SHA256:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		hmac_sha256 = (subcmd_hmac_sha256_t *)cry_cmd->subCmd;
-		hmac_sha256->output_len = cfg->output_len;
-		hmac_sha256->data_blks_nr = cfg->data_blks_nr;
-		/* set tlv start */
-		ptlv = hmac_sha256->tlv;
-		cmd->size += sizeof(subcmd_hmac_sha256_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_SHA256:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		sha256 = (subcmd_sha256_t *)cry_cmd->subCmd;
-		sha256->output_len = cfg->output_len;
-		sha256->data_blks_nr = cfg->data_blks_nr;
-		/* set tlv start */
-		ptlv = sha256->tlv;
-		cmd->size += sizeof(subcmd_sha256_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_RIJNDAEL:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		rijndael = (subcmd_rijndael_t *)cry_cmd->subCmd;
-		rijndael->sub_action_code = cfg->sub_action_code;
-		rijndael->output_len = cfg->output_len;
-		/* set tlv start */
-		ptlv = rijndael->tlv;
-		cmd->size += sizeof(subcmd_rijndael_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_RC4:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_IV |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		rc4 = (subcmd_rc4_t *)cry_cmd->subCmd;
-		rc4->skip_bytes = cfg->skip_bytes;
-		rc4->output_len = cfg->output_len;
-		/* set tlv start */
-		ptlv = rc4->tlv;
-		cmd->size += sizeof(subcmd_rc4_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_MD5:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		md5 = (subcmd_md5_t *)cry_cmd->subCmd;
-		md5->output_len = cfg->output_len;
-		/* set tlv start */
-		ptlv = md5->tlv;
-		cmd->size += sizeof(subcmd_md5_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_MRVL_F:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		mrvl_f = (subcmd_mrvl_f_t *)cry_cmd->subCmd;
-		mrvl_f->iterations = cfg->iteration;
-		mrvl_f->count = cfg->count;
-		mrvl_f->output_len = cfg->output_len;
-		/* set tlv start */
-		ptlv = mrvl_f->tlv;
-		cmd->size += sizeof(subcmd_mrvl_f_t);
-		break;
-	case HostCmd_CMD_CRYPTO_SUBCMD_SHA256_KDF:
-		tlv_bitmap = BIT_TLV_TYPE_CRYPTO_KEY |
-			     BIT_TLV_TYPE_CRYPTO_KEY_PREFIX |
-			     BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK;
-		/* set subcmd start */
-		sha256_kdf = (subcmd_sha256_kdf_t *)cry_cmd->subCmd;
-		sha256_kdf->output_len = cfg->output_len;
-		/* set tlv start */
-		ptlv = sha256_kdf->tlv;
-		cmd->size += sizeof(subcmd_sha256_kdf_t);
-		break;
-#endif
-	default:
-		break;
-	}
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	/* add tlv */
-	if (tlv_bitmap & BIT_TLV_TYPE_CRYPTO_KEY) {
-		((MrvlIEParamSet_t *)ptlv)->Type =
-			wlan_cpu_to_le16(TLV_TYPE_CRYPTO_KEY);
-		((MrvlIEParamSet_t *)ptlv)->Length =
-			wlan_cpu_to_le16(cfg->key_len);
-		memcpy_ext(pmpriv->adapter,
-			   (t_u8 *)ptlv + sizeof(MrvlIEParamSet_t), cfg->key,
-			   cfg->key_len, cfg->key_len);
-		cmd->size += cfg->key_len + sizeof(MrvlIEParamSet_t);
-		ptlv += cfg->key_len + sizeof(MrvlIEParamSet_t);
-	}
-
-	if (tlv_bitmap & BIT_TLV_TYPE_CRYPTO_KEY_PREFIX) {
-		((MrvlIEParamSet_t *)ptlv)->Type =
-			wlan_cpu_to_le16(TLV_TYPE_CRYPTO_KEY_PREFIX);
-		((MrvlIEParamSet_t *)ptlv)->Length =
-			wlan_cpu_to_le16(cfg->key_prefix_len);
-		memcpy_ext(pmpriv->adapter, ptlv + sizeof(MrvlIEParamSet_t),
-			   cfg->key_prefix, cfg->key_prefix_len,
-			   cfg->key_prefix_len);
-		cmd->size += cfg->key_prefix_len + sizeof(MrvlIEParamSet_t);
-		ptlv += cfg->key_prefix_len + sizeof(MrvlIEParamSet_t);
-	}
-
-	if (tlv_bitmap & BIT_TLV_TYPE_CRYPTO_KEY_IV) {
-		((MrvlIEParamSet_t *)ptlv)->Type =
-			wlan_cpu_to_le16(TLV_TYPE_CRYPTO_KEY_IV);
-		((MrvlIEParamSet_t *)ptlv)->Length =
-			wlan_cpu_to_le16(cfg->key_iv_len);
-		memcpy_ext(pmpriv->adapter, ptlv + sizeof(MrvlIEParamSet_t),
-			   cfg->key_iv, cfg->key_iv_len, cfg->key_iv_len);
-		cmd->size += cfg->key_iv_len + sizeof(MrvlIEParamSet_t);
-		ptlv += cfg->key_iv_len + sizeof(MrvlIEParamSet_t);
-	}
-
-	if (tlv_bitmap & BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK) {
-		t_u16 data_blk_len = 0;
-		t_u8 *pdata_blk = MNULL;
-		for (i = 0; i < cfg->data_blks_nr; i++) {
-			data_blk_len = *(cfg->key_data_blk_len + i);
-			pdata_blk = *(cfg->key_data_blk + i);
-			((MrvlIEParamSet_t *)ptlv)->Type =
-				wlan_cpu_to_le16(TLV_TYPE_CRYPTO_KEY_DATA_BLK);
-			((MrvlIEParamSet_t *)ptlv)->Length =
-				wlan_cpu_to_le16(data_blk_len);
-			memcpy_ext(pmpriv->adapter,
-				   ptlv + sizeof(MrvlIEParamSet_t), pdata_blk,
-				   data_blk_len, data_blk_len);
-			cmd->size += data_blk_len + sizeof(MrvlIEParamSet_t);
-			ptlv += data_blk_len + sizeof(MrvlIEParamSet_t);
-		}
-	}
-#endif
-	HEXDUMP("HostCmd_DS_COMMAND wlan_cmd_crypto", cmd, cmd->size);
-
-	cmd->size = wlan_cpu_to_le16(cmd->size);
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
-/**
- *  @brief This function handles the command response of crypto command
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param resp         A pointer to HostCmd_DS_COMMAND
- *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
- *
- *  @return        MLAN_STATUS_SUCCESS
- */
-mlan_status wlan_ret_crypto(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
-			    mlan_ioctl_req *pioctl_buf)
-{
-	HostCmd_DS_CRYPTO *crypto_cmd = &resp->params.crypto_cmd;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	mlan_adapter *pmadapter = pmpriv->adapter;
-	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
-	mlan_ds_sup_cfg *cfg = (mlan_ds_sup_cfg *)pioctl_buf->pbuf;
-#endif
-
-	ENTER();
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	if (!cfg) {
-		PRINTM(MERROR, "wlan_ret_crypto cfg is null \n");
-		goto done;
-	}
-	if (resp->result == HostCmd_RESULT_OK) {
-		/* copy the result */
-		memcpy_ext(pmpriv->adapter, cfg->output,
-			   (t_u8 *)crypto_cmd + sizeof(HostCmd_DS_CRYPTO) +
-				   sizeof(cfg->output_len),
-			   cfg->output_len, cfg->output_len);
-	}
-
-	/* Prevent the ioctl from completing when the cmd is freed */
-	if (cfg->call_back) {
-		pmadapter->curr_cmd->pioctl_buf = MNULL;
-		/* trigger wait q */
-		pcb->moal_notify_hostcmd_complete(pmadapter->pmoal_handle,
-						  pmpriv->bss_index);
-	}
-#endif
-done:
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-#endif
-
 /**
  *  @brief This function prepares command of mac_address.
  *
@@ -8928,6 +9886,40 @@
 }
 
 /**
+ *  @brief This function prepares command of OFDM DESENSE cfg
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   the action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_void *pdata_buf)
+{
+	HostCmd_DS_CMD_OFDM_DESENSE_CFG *cfg_cmd =
+		(HostCmd_DS_CMD_OFDM_DESENSE_CFG *)&cmd->params.ofdm_desense_cfg;
+	mlan_ds_misc_ofdm_desense_cfg *cfg =
+		(mlan_ds_misc_ofdm_desense_cfg *)pdata_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_OFDM_DESENSE_CFG);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_CMD_OFDM_DESENSE_CFG) +
+				     S_DS_GEN);
+	cfg_cmd->action = wlan_cpu_to_le16(cmd_action);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		cfg_cmd->enable = (t_u8)cfg->enable;
+		cfg_cmd->cca_threshold = (t_s8)cfg->cca_threshold;
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function handles the command response of Rx Abort Cfg
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -8954,6 +9946,35 @@
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
+/**
+ *  @brief This function handles the command response of OFDM DESENSE CFG
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *resp,
+				     mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_CMD_OFDM_DESENSE_CFG *cfg_cmd =
+		(HostCmd_DS_CMD_OFDM_DESENSE_CFG *)&resp->params
+			.ofdm_desense_cfg;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+
+	ENTER();
+
+	if (pioctl_buf) {
+		misc_cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		misc_cfg->param.ofdm_desense_cfg.enable = (t_u8)cfg_cmd->enable;
+		misc_cfg->param.ofdm_desense_cfg.cca_threshold =
+			(t_s8)cfg_cmd->cca_threshold;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
 
 /**
  *  @brief This function prepares command of Rx abort cfg ext
@@ -8984,6 +10005,11 @@
 		cfg_cmd->enable = (t_u8)cfg->enable;
 		cfg_cmd->rssi_margin = (t_s8)cfg->rssi_margin;
 		cfg_cmd->ceil_rssi_threshold = (t_s8)cfg->ceil_rssi_threshold;
+		cfg_cmd->floor_rssi_threshold = (t_s8)cfg->floor_rssi_threshold;
+		cfg_cmd->current_dynamic_rssi_threshold =
+			(t_s8)cfg->current_dynamic_rssi_threshold;
+		cfg_cmd->rssi_default_config = (t_u8)cfg->rssi_default_config;
+		cfg_cmd->edmac_enable = (t_u8)cfg->edmac_enable;
 	}
 
 	LEAVE();
@@ -8991,6 +10017,146 @@
 }
 
 /**
+ *  @brief This function prepares command of nav mitigation
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   the action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_nav_mitigation(pmlan_private pmpriv,
+				    HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				    t_void *pdata_buf)
+{
+	HostCmd_DS_CMD_NAV_MITIGATION_CFG *cfg_cmd =
+		(HostCmd_DS_CMD_NAV_MITIGATION_CFG *)&cmd->params.nav_mitigation;
+	mlan_ds_misc_nav_mitigation *cfg =
+		(mlan_ds_misc_nav_mitigation *)pdata_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_NAV_MITIGATION_CFG);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_CMD_NAV_MITIGATION_CFG) +
+				     S_DS_GEN);
+	cfg_cmd->action = wlan_cpu_to_le16(cmd_action);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		cfg_cmd->start_nav_mitigation =
+			wlan_cpu_to_le16(cfg->start_nav_mitigation);
+		cfg_cmd->threshold = wlan_cpu_to_le16(cfg->threshold);
+		cfg_cmd->detect_cnt = wlan_cpu_to_le16(cfg->detect_cnt);
+		cfg_cmd->stop_cnt = wlan_cpu_to_le16(cfg->stop_cnt);
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command of LED config parameter
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   the action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_led_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+				t_u16 cmd_action, t_void *pdata_buf)
+{
+	int count = 0;
+	HostCmd_DS_CMD_LED_CFG *cfg_cmd = &cmd->params.ledcntrcfg;
+	t_u8 *tlv = MNULL;
+	t_u16 cmd_size = 0;
+	int i = 0;
+	mlan_ds_misc_led_cfg *cfg = (mlan_ds_misc_led_cfg *)pdata_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_LED_CONTROL);
+	cfg_cmd->action = wlan_cpu_to_le16(cmd_action);
+	cmd_size = S_DS_GEN + sizeof(HostCmd_DS_CMD_LED_CFG);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		cfg_cmd->enable = wlan_cpu_to_le16(cfg->enable);
+		count = cfg->led_cfg_len;
+		if (count != 0) {
+			tlv = (t_u8 *)cmd + cmd_size;
+			while (i < count) {
+				MrvlIEtypes_led_behavior_t *led_tlv =
+					(MrvlIEtypes_led_behavior_t *)tlv;
+
+				led_tlv->header.type =
+					wlan_cpu_to_le16(TLV_TYPE_LEDBEHAVIOR);
+				led_tlv->header.len = wlan_cpu_to_le16(
+					sizeof(MrvlIEtypes_led_behavior_t) -
+					sizeof(MrvlIEtypesHeader_t));
+				led_tlv->firmwarestate = wlan_cpu_to_le16(
+					cfg->misc_led_behvr[i].firmwarestate);
+				led_tlv->ledstate = wlan_cpu_to_le16(
+					cfg->misc_led_behvr[i].ledstate);
+				led_tlv->ledargs = wlan_cpu_to_le16(
+					cfg->misc_led_behvr[i].ledargs);
+				cmd_size += sizeof(MrvlIEtypes_led_behavior_t);
+				i++;
+				if (i != count) {
+					tlv += sizeof(
+						MrvlIEtypes_led_behavior_t);
+				}
+			}
+		}
+	}
+	cmd->size = wlan_cpu_to_le16(cmd_size);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of led config
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_led_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)(pioctl_buf->pbuf);
+	mlan_ds_misc_led_cfg *mlan_led_cfg = &(misc->param.led_config);
+	t_u8 *tlv = MNULL;
+	int left_len = 0, i = 0;
+	t_u32 cmdrsp_len = wlan_le16_to_cpu(resp->size);
+	ENTER();
+
+	if ((cmdrsp_len < S_DS_GEN) ||
+	    (cmdrsp_len - S_DS_GEN < sizeof(HostCmd_DS_CMD_LED_CFG)))
+		return MLAN_STATUS_SUCCESS;
+
+	mlan_led_cfg->enable = resp->params.ledcntrcfg.enable;
+	left_len = cmdrsp_len - (S_DS_GEN + sizeof(HostCmd_DS_CMD_LED_CFG));
+
+	if (!wlan_secure_add(&resp, (S_DS_GEN + sizeof(HostCmd_DS_CMD_LED_CFG)),
+			     &tlv, TYPE_PTR)) {
+		PRINTM(MERROR, "tlv is invalid\n");
+	}
+
+	for (i = 0; i < MAX_FW_STATES; i++) {
+		mlan_led_cfg->misc_led_behvr[i].firmwarestate = *tlv;
+		tlv++;
+		tlv++; // to skip reserved byte
+		mlan_led_cfg->misc_led_behvr[i].ledstate = *tlv;
+		tlv++;
+		mlan_led_cfg->misc_led_behvr[i].ledargs = *tlv;
+		tlv++;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function handles the command response of Rx Abort Cfg ext
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -9017,6 +10183,49 @@
 			cfg_cmd->rssi_margin;
 		misc_cfg->param.rx_abort_cfg_ext.ceil_rssi_threshold =
 			cfg_cmd->ceil_rssi_threshold;
+		misc_cfg->param.rx_abort_cfg_ext.floor_rssi_threshold =
+			cfg_cmd->floor_rssi_threshold;
+		misc_cfg->param.rx_abort_cfg_ext.current_dynamic_rssi_threshold =
+			cfg_cmd->current_dynamic_rssi_threshold;
+		misc_cfg->param.rx_abort_cfg_ext.rssi_default_config =
+			cfg_cmd->rssi_default_config;
+		misc_cfg->param.rx_abort_cfg_ext.edmac_enable =
+			cfg_cmd->edmac_enable;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of nav mitigation
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_nav_mitigation(pmlan_private pmpriv,
+				    HostCmd_DS_COMMAND *resp,
+				    mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_CMD_NAV_MITIGATION_CFG *cfg_cmd =
+		(HostCmd_DS_CMD_NAV_MITIGATION_CFG *)&resp->params
+			.nav_mitigation;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+
+	ENTER();
+
+	if (pioctl_buf) {
+		misc_cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		misc_cfg->param.nav_mitigation.start_nav_mitigation =
+			wlan_le16_to_cpu(cfg_cmd->start_nav_mitigation);
+		misc_cfg->param.nav_mitigation.threshold =
+			wlan_le16_to_cpu(cfg_cmd->threshold);
+		misc_cfg->param.nav_mitigation.detect_cnt =
+			wlan_le16_to_cpu(cfg_cmd->detect_cnt);
+		misc_cfg->param.nav_mitigation.stop_cnt =
+			wlan_le16_to_cpu(cfg_cmd->stop_cnt);
 	}
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -9444,7 +10653,7 @@
 
 	ENTER();
 
-	cmd->command = wlan_cpu_to_le16(HostCmd_CHANNEL_TRPC_CONFIG);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CHANNEL_TRPC_CONFIG);
 	trpc_cfg->action = wlan_cpu_to_le16(cmd_action);
 	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_CHANNEL_TRPC_CONFIG) +
 				     S_DS_GEN);
@@ -9514,7 +10723,7 @@
 }
 /**
  *  @brief This function handles the command response of
- *  packet aggregation
+ *  CHAN_TRPC setting
  *
  *  @param pmpriv       A pointer to mlan_private structure
  *  @param resp         A pointer to HostCmd_DS_COMMAND
@@ -9536,7 +10745,7 @@
 		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
 		cfg = (mlan_ds_misc_chan_trpc_cfg *)&(misc->param.trpc_cfg);
 		cfg->sub_band = wlan_le16_to_cpu(trpc_cfg->sub_band);
-		cfg->length = wlan_le16_to_cpu(resp->size);
+		cfg->length = resp->size;
 		memcpy_ext(pmadapter, cfg->trpc_buf, (t_u8 *)resp, cfg->length,
 			   sizeof(cfg->trpc_buf));
 	}
@@ -9629,7 +10838,6 @@
 	cfg_cmd->noise = wlan_cpu_to_le16(cfg->noise);
 	cfg_cmd->rx_quality = wlan_cpu_to_le16(cfg->rx_quality);
 	cfg_cmd->duration = wlan_cpu_to_le16(cfg->duration);
-	cfg_cmd->cca_th = wlan_cpu_to_le16(cfg->cca_th);
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
@@ -9709,6 +10917,192 @@
 }
 
 /**
+ *  @brief This function prepares command of TSP config.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_tsp_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+				t_u16 cmd_action, t_void *pdata_buf)
+{
+	HostCmd_DS_TSP_CFG *tsp_config = &cmd->params.tsp_cfg;
+	mlan_ds_tsp_cfg *cfg = (mlan_ds_tsp_cfg *)pdata_buf;
+	t_u8 rfu = 0;
+	t_u8 rpath = 0;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_TSP_CFG);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_TSP_CFG) + S_DS_GEN);
+	tsp_config->action = wlan_cpu_to_le16(cmd_action);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		tsp_config->enable = wlan_cpu_to_le16(cfg->enable);
+		if (tsp_config->enable == 0) {
+			cmd->size = wlan_cpu_to_le16(
+				sizeof(tsp_config->action) +
+				sizeof(tsp_config->enable) + S_DS_GEN);
+		} else {
+			tsp_config->backoff = wlan_cpu_to_le32(cfg->backoff);
+			tsp_config->high_thrshld =
+				wlan_cpu_to_le32(cfg->high_thrshld);
+			tsp_config->low_thrshld =
+				wlan_cpu_to_le32(cfg->low_thrshld);
+			tsp_config->reg_cau_val =
+				wlan_cpu_to_le32(cfg->reg_cau_val);
+			tsp_config->duty_cyc_step =
+				wlan_cpu_to_le32(cfg->duty_cyc_step);
+			tsp_config->duty_cyc_min =
+				wlan_cpu_to_le32(cfg->duty_cyc_min);
+			tsp_config->high_thrshld_temp =
+				wlan_cpu_to_le32(cfg->high_thrshld_temp);
+			tsp_config->low_thrshld_temp =
+				wlan_cpu_to_le32(cfg->low_thrshld_temp);
+
+			for (rfu = 0; rfu < MAX_RFUS; rfu++) {
+				for (rpath = 0; rpath < MAX_PATHS; rpath++) {
+					tsp_config->reg_rfu_val
+						[rfu][rpath] = wlan_cpu_to_le32(
+						cfg->reg_rfu_temp[rfu][rpath]);
+				}
+			}
+		}
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of TSP config.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND structure
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req buf
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_tsp_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_TSP_CFG *tsp_config = &resp->params.tsp_cfg;
+	mlan_ds_misc_cfg *cfg = MNULL;
+	t_u8 rfu = 0;
+	t_u8 rpath = 0;
+	ENTER();
+	if (pioctl_buf) {
+		cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+
+		if (wlan_le16_to_cpu(tsp_config->action) ==
+		    HostCmd_ACT_GEN_GET) {
+			cfg->param.tsp_cfg.enable =
+				wlan_le16_to_cpu(tsp_config->enable);
+			cfg->param.tsp_cfg.backoff =
+				wlan_le32_to_cpu(tsp_config->backoff);
+			cfg->param.tsp_cfg.high_thrshld =
+				wlan_le32_to_cpu(tsp_config->high_thrshld);
+			cfg->param.tsp_cfg.low_thrshld =
+				wlan_le32_to_cpu(tsp_config->low_thrshld);
+			cfg->param.tsp_cfg.reg_cau_val =
+				wlan_le32_to_cpu(tsp_config->reg_cau_val);
+			cfg->param.tsp_cfg.duty_cyc_step =
+				wlan_le32_to_cpu(tsp_config->duty_cyc_step);
+			cfg->param.tsp_cfg.duty_cyc_min =
+				wlan_le32_to_cpu(tsp_config->duty_cyc_min);
+			cfg->param.tsp_cfg.high_thrshld_temp =
+				wlan_le32_to_cpu(tsp_config->high_thrshld_temp);
+			cfg->param.tsp_cfg.low_thrshld_temp =
+				wlan_le32_to_cpu(tsp_config->low_thrshld_temp);
+
+			for (rfu = 0; rfu < MAX_RFUS; rfu++) {
+				for (rpath = 0; rpath < MAX_PATHS; rpath++) {
+					cfg->param.tsp_cfg
+						.reg_rfu_temp[rfu][rpath] =
+						wlan_le32_to_cpu(
+							tsp_config->reg_rfu_val
+								[rfu][rpath]);
+				}
+			}
+		}
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command of TX_FRAME
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   the action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_tx_frame(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+			      t_u16 cmd_action, t_void *pdata_buf)
+{
+	t_u16 cmd_size = 0;
+	HostCmd_DS_80211_TX_FRAME *tx_frame_cmd = &cmd->params.tx_frame;
+	mlan_ds_misc_tx_frame *tx_frame = (mlan_ds_misc_tx_frame *)pdata_buf;
+	TxPD *plocal_tx_pd = (TxPD *)tx_frame_cmd->buffer;
+	t_u32 pkt_type;
+	t_u32 tx_control;
+	t_u8 *pdata = tx_frame->tx_buf;
+	t_u16 data_len = tx_frame->data_len;
+
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_TX_FRAME);
+	cmd_size = sizeof(HostCmd_DS_80211_TX_FRAME) + S_DS_GEN;
+	tx_frame_cmd->action = 0;
+	tx_frame_cmd->status = 0;
+	memcpy_ext(pmpriv->adapter, &tx_frame_cmd->band_config,
+		   (t_u8 *)&tx_frame->bandcfg, sizeof(t_u8), sizeof(t_u8));
+	tx_frame_cmd->channel = tx_frame->channel;
+
+	if (tx_frame->buf_type == MLAN_BUF_TYPE_RAW_DATA) {
+		memcpy_ext(pmpriv->adapter, &pkt_type, tx_frame->tx_buf,
+			   sizeof(pkt_type), sizeof(pkt_type));
+		memcpy_ext(pmpriv->adapter, &tx_control,
+			   tx_frame->tx_buf + sizeof(pkt_type),
+			   sizeof(tx_control), sizeof(tx_control));
+		data_len -= sizeof(pkt_type) + sizeof(tx_control);
+		pdata += sizeof(pkt_type) + sizeof(tx_control);
+	}
+	memcpy_ext(pmpriv->adapter,
+		   tx_frame_cmd->buffer + Tx_PD_SIZEOF(pmpriv->adapter), pdata,
+		   data_len, data_len);
+
+	// coverity[bad_memset:SUPPRESS]
+	memset(pmpriv->adapter, plocal_tx_pd, 0, Tx_PD_SIZEOF(pmpriv->adapter));
+	plocal_tx_pd->bss_num = GET_BSS_NUM(pmpriv);
+	plocal_tx_pd->bss_type = pmpriv->bss_type;
+	plocal_tx_pd->tx_pkt_length = (t_u16)data_len;
+	plocal_tx_pd->priority = (t_u8)tx_frame->priority;
+	plocal_tx_pd->tx_pkt_offset = Tx_PD_SIZEOF(pmpriv->adapter);
+	plocal_tx_pd->pkt_delay_2ms = 0xff;
+
+	if (tx_frame->buf_type == MLAN_BUF_TYPE_RAW_DATA) {
+		plocal_tx_pd->tx_pkt_type = (t_u16)pkt_type;
+		plocal_tx_pd->tx_control = tx_control;
+	}
+
+	if (tx_frame->flags & MLAN_BUF_FLAG_TX_STATUS) {
+		plocal_tx_pd->tx_control_1 |= tx_frame->tx_seq_num << 8;
+		plocal_tx_pd->flags |= MRVDRV_TxPD_FLAGS_TX_PACKET_STATUS;
+	}
+
+	endian_convert_TxPD(plocal_tx_pd);
+	cmd_size += Tx_PD_SIZEOF(pmpriv->adapter) + data_len;
+	cmd->size = wlan_cpu_to_le16(cmd_size);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function prepares command of get_sensor_temp
  *
  *  @param pmpriv      A pointer to mlan_private structure
@@ -9728,7 +11122,7 @@
 		return MLAN_STATUS_FAILURE;
 	}
 
-	cmd->command = wlan_cpu_to_le16(HostCmd_DS_GET_SENSOR_TEMP);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_DS_GET_SENSOR_TEMP);
 	cmd->size = wlan_cpu_to_le16(S_DS_GEN + 4);
 
 	LEAVE();
@@ -9763,3 +11157,151 @@
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
+
+/**
+ *  @brief This function prepares command to configure edmac
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd         A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action  Action: GET or SET
+ *  @param pdata_buf   A pointer to data buffer
+ *
+ *  @return            MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_edmac_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+			       t_u16 cmd_action, t_void *pdata_buf)
+{
+	HostCmd_DS_EDMAC_CFG *edmac_cmd = &cmd->params.ed_mac_cfg;
+	mlan_ds_ed_mac_cfg *edmac_cfg = (mlan_ds_ed_mac_cfg *)pdata_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_EDMAC_CFG);
+	cmd->size = wlan_cpu_to_le16(sizeof(mlan_ds_ed_mac_cfg) + S_DS_GEN);
+
+	edmac_cmd->ed_ctrl_2g = wlan_cpu_to_le16(edmac_cfg->ed_ctrl_2g);
+	edmac_cmd->ed_offset_2g = wlan_cpu_to_le16(edmac_cfg->ed_offset_2g);
+	edmac_cmd->ed_ctrl_5g = wlan_cpu_to_le16(edmac_cfg->ed_ctrl_5g);
+	edmac_cmd->ed_offset_5g = wlan_cpu_to_le16(edmac_cfg->ed_offset_5g);
+	edmac_cmd->ed_bitmap_txq_lock =
+		wlan_cpu_to_le32(edmac_cfg->ed_bitmap_txq_lock);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function send command to FW to configure multi-client scheduling
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param enable      Enable/Disable multi-client scheduling
+ *
+ *  @return            MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_mclient_scheduling_enable(pmlan_private pmpriv,
+					       t_bool enable)
+{
+	HostCmd_MCLIENT_SCHEDULE_CFG cfg;
+
+	memset(pmpriv->adapter, &cfg, 0xff, sizeof(cfg));
+
+	cfg.action = wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);
+	cfg.mclient_enable = !!enable;
+	cfg.ps_mode_change_report = !!enable;
+
+	return wlan_prepare_cmd(pmpriv, HostCmd_CMD_MCLIENT_SCHEDULE_CFG,
+				HostCmd_ACT_GEN_SET, 0, MNULL, &cfg);
+}
+
+/**
+ *  @brief This function prepares command to configure multi-client scheduling
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd         A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action  Action: GET or SET
+ *  @param pdata_buf   A pointer to data buffer
+ *
+ *  @return            MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_mclient_scheduling_cfg(pmlan_private pmpriv,
+					    HostCmd_DS_COMMAND *cmd,
+					    t_u16 cmd_action, t_pvoid pdata_buf)
+{
+	HostCmd_MCLIENT_SCHEDULE_CFG *req = pdata_buf;
+	HostCmd_MCLIENT_SCHEDULE_CFG *mclient_cfg = &cmd->params.mclient_cfg;
+	const t_u16 cmd_size = sizeof(*mclient_cfg);
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_MCLIENT_SCHEDULE_CFG);
+	cmd->size = wlan_cpu_to_le16(cmd_size + S_DS_GEN);
+
+	memcpy_ext(pmpriv->adapter, mclient_cfg, req, cmd_size, cmd_size);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command to query TX rate
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd         A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action  Action: GET or SET
+ *  @param pdata_buf   A pointer to data buffer
+ *
+ *  @return            MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_sta_tx_rate_req(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_pvoid pdata_buf)
+{
+	HostCmd_CMD_802_11_STA_TX_RATE *req = pdata_buf;
+	HostCmd_CMD_802_11_STA_TX_RATE *sta_tx_rate_req =
+		&cmd->params.sta_rx_rate;
+	const t_u16 cmd_size = MIN(sizeof(req->entry),
+				   (sizeof(req->entry[0]) * req->num_entries));
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_PEER_TX_RATE_QUERY);
+	cmd->size = wlan_cpu_to_le16(cmd_size + S_DS_GEN);
+
+	memcpy_ext(pmpriv->adapter, sta_tx_rate_req, req, cmd_size, cmd_size);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles HostCmd_CMD_PEER_TX_RATE_QUERY command response
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param resp        A pointer to command response
+ *  @param pioctl_buf  A pointer to mlan_ioctl_req structure
+ *
+ *  @return            MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_sta_tx_rate(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				 mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_CMD_802_11_STA_TX_RATE *info = &resp->params.sta_rx_rate;
+	int i;
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	const t_s32 entry_size = sizeof(info->entry[0]);
+	t_s32 size = resp->size - S_DS_GEN;
+
+	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+					    pmpriv->wmm.ra_list_spinlock);
+
+	for (i = 0; i < NELEMENTS(info->entry) && size >= entry_size;
+	     i++, size -= entry_size) {
+		wlan_wmm_update_sta_tx_rate(pmpriv, info->entry[i].sta_mac,
+					    &info->entry[i].rate);
+	}
+
+	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
+					      pmpriv->wmm.ra_list_spinlock);
+
+	return MLAN_STATUS_SUCCESS;
+}
diff --git a/wlan_sd8987/mlan/mlan_decl.h b/wlan_src/mlan/mlan_decl.h
old mode 100755
new mode 100644
similarity index 79%
rename from wlan_sd8987/mlan/mlan_decl.h
rename to wlan_src/mlan/mlan_decl.h
index 3f43ae7..d537b08
--- a/wlan_sd8987/mlan/mlan_decl.h
+++ b/wlan_src/mlan/mlan_decl.h
@@ -3,29 +3,35 @@
  *  @brief This file declares the generic data structures and APIs.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2022, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
 #ifndef _MLAN_DECL_H_
 #define _MLAN_DECL_H_
 
-/** MLAN release version */
-#define MLAN_RELEASE_VERSION "368.p3"
-
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
 typedef signed char t_s8, *t_ps8;
@@ -181,6 +187,11 @@
 #define MLAN_WFD_COEX_AMPDU_DEF_RXWINSIZE 16
 #endif
 
+/** NAN use the same window size for tx/rx */
+#define MLAN_NAN_AMPDU_DEF_TXRXWINSIZE 16
+/** RX winsize for COEX */
+#define MLAN_NAN_COEX_AMPDU_DEF_RXWINSIZE 16
+
 /** Block ack timeout value */
 #define MLAN_DEFAULT_BLOCK_ACK_TIMEOUT 0xffff
 /** Maximum Tx Win size configured for ADDBA request [10 bits] */
@@ -204,6 +215,8 @@
 #define MLAN_RATE_INDEX_MCS4 4
 /** Rate index for MCS 7 */
 #define MLAN_RATE_INDEX_MCS7 7
+/** Rate index for MCS 8 */
+#define MLAN_RATE_INDEX_MCS8 8
 /** Rate index for MCS 9 */
 #define MLAN_RATE_INDEX_MCS9 9
 /** Rate index for MCS11 */
@@ -262,12 +275,29 @@
 #define FW_RELOAD_NO_EMULATION 2
 /** out band reset with interface re-emulation */
 #define FW_RELOAD_WITH_EMULATION 3
-#ifdef PCIE
 /** pcie card reset */
 #define FW_RELOAD_PCIE_RESET 4
-#endif
+/** sdio hw reset */
 #define FW_RELOAD_SDIO_HW_RESET 5
+/** pcie inband reset */
+#define FW_RELOAD_PCIE_INBAND_RESET 6
 
+/** auto fw reload enable */
+#define AUTO_FW_RELOAD_ENABLE MBIT(0)
+/** auto fw reload enable pcie inband reset */
+#define AUTO_FW_RELOAD_PCIE_INBAND_RESET MBIT(1)
+
+#ifdef PCIE
+/* Interrupt type */
+enum {
+	RX_DATA,
+	RX_EVENT,
+	TX_COMPLETE,
+	RX_CMD_RESP,
+	RX_CMD_DNLD,
+	RX_DATA_DELAY
+};
+#endif
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
 #define MLAN_USB_AGGR_MODE_NUM (0)
@@ -373,13 +403,20 @@
 /** 8801 card type */
 #define CARD_TYPE_8801 0x0a
 /** OWL card type */
-#define CARD_TYPE_NW62X 0x0b
+#define CARD_TYPE_IW624 0x0b
+/** Black bird card type */
+#define CARD_TYPE_AW693 0x0c
+/** IW610 card type */
+#define CARD_TYPE_IW610 0x0d
 
 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
 #define CHIP_9098_REV_A1 2
 /** 9097 CHIP REV */
 #define CHIP_9097_REV_B0 1
+/** Blackbird reverion num */
+#define CHIP_AW693_REV_A0 1
+#define CHIP_AW693_REV_A1 2
 
 #define INTF_MASK 0xff
 #define CARD_TYPE_MASK 0xff
@@ -405,8 +442,12 @@
 #define CARD_TYPE_SD9177 (CARD_TYPE_9177 | (INTF_SD << 8))
 /** SD8801 card type */
 #define CARD_TYPE_SD8801 (CARD_TYPE_8801 | (INTF_SD << 8))
-/** SD_NW62X card type */
-#define CARD_TYPE_SDNW62X (CARD_TYPE_NW62X | (INTF_SD << 8))
+/** SD_IW624 card type */
+#define CARD_TYPE_SDIW624 (CARD_TYPE_IW624 | (INTF_SD << 8))
+/** SD_IW624 card type */
+#define CARD_TYPE_SDAW693 (CARD_TYPE_AW693 | (INTF_SD << 8))
+/** SD_IW610 card type */
+#define CARD_TYPE_SDIW610 (CARD_TYPE_IW610 | (INTF_SD << 8))
 
 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@@ -418,7 +459,9 @@
 #define IS_SD9098(ct) (CARD_TYPE_SD9098 == (ct))
 #define IS_SD9177(ct) (CARD_TYPE_SD9177 == (ct))
 #define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
-#define IS_SDNW62X(ct) (CARD_TYPE_SDNW62X == (ct))
+#define IS_SDIW624(ct) (CARD_TYPE_SDIW624 == (ct))
+#define IS_SDAW693(ct) (CARD_TYPE_SDAW693 == (ct))
+#define IS_SDIW610(ct) (CARD_TYPE_SDIW610 == (ct))
 
 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@@ -440,8 +483,12 @@
 #define CARD_SD9177 "SDIW612"
 /** SD8801 Card */
 #define CARD_SD8801 "SD8801"
-/** SDNW62X Card */
-#define CARD_SDNW62X "SDNW62X"
+/** SDIW624 Card */
+#define CARD_SDIW624 "SDIW624"
+/** SDAW693 Card */
+#define CARD_SDAW693 "SDAW693"
+/** SDIW610 Card */
+#define CARD_SDIW610 "SDIW610"
 #endif
 
 #ifdef PCIE
@@ -453,14 +500,17 @@
 #define CARD_TYPE_PCIE9097 (CARD_TYPE_9097 | (INTF_PCIE << 8))
 /** PCIE9098 card type */
 #define CARD_TYPE_PCIE9098 (CARD_TYPE_9098 | (INTF_PCIE << 8))
-/** PCIENW62X card type */
-#define CARD_TYPE_PCIENW62X (CARD_TYPE_NW62X | (INTF_PCIE << 8))
+/** PCIEIW624 card type */
+#define CARD_TYPE_PCIEIW624 (CARD_TYPE_IW624 | (INTF_PCIE << 8))
+/** PCIEAW693 card type */
+#define CARD_TYPE_PCIEAW693 (CARD_TYPE_AW693 | (INTF_PCIE << 8))
 
 #define IS_PCIE8897(ct) (CARD_TYPE_PCIE8897 == (ct))
 #define IS_PCIE8997(ct) (CARD_TYPE_PCIE8997 == (ct))
 #define IS_PCIE9097(ct) (CARD_TYPE_PCIE9097 == (ct))
 #define IS_PCIE9098(ct) (CARD_TYPE_PCIE9098 == (ct))
-#define IS_PCIENW62X(ct) (CARD_TYPE_PCIENW62X == (ct))
+#define IS_PCIEIW624(ct) (CARD_TYPE_PCIEIW624 == (ct))
+#define IS_PCIEAW693(ct) (CARD_TYPE_PCIEAW693 == (ct))
 
 /** PCIE8897 Card */
 #define CARD_PCIE8897 "PCIE8897"
@@ -474,8 +524,10 @@
 #define CARD_PCIE9098 "PCIE9098"
 /** PCIEAW690 Card */
 #define CARD_PCIEAW690 "PCIEAW690"
-/** PCIENW62X Card */
-#define CARD_PCIENW62X "PCIENW62X"
+/** PCIEIW624 Card */
+#define CARD_PCIEIW624 "PCIEIW624"
+/** PCIEAW693 Card */
+#define CARD_PCIEAW693 "PCIEAW693"
 /** PCIEIW629 Card */
 #define CARD_PCIEIW629 "PCIEIW629"
 #endif
@@ -493,8 +545,10 @@
 #define CARD_TYPE_USB9098 (CARD_TYPE_9098 | (INTF_USB << 8))
 /** USB9097 card type */
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
-/** USBNW62X card type */
-#define CARD_TYPE_USBNW62X (CARD_TYPE_NW62X | (INTF_USB << 8))
+/** USBIW624 card type */
+#define CARD_TYPE_USBIW624 (CARD_TYPE_IW624 | (INTF_USB << 8))
+/** USBIW610 card type */
+#define CARD_TYPE_USBIW610 (CARD_TYPE_IW610 | (INTF_USB << 8))
 
 #define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
@@ -502,7 +556,8 @@
 #define IS_USB8978(ct) (CARD_TYPE_USB8978 == (ct))
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
-#define IS_USBNW62X(ct) (CARD_TYPE_USBNW62X == (ct))
+#define IS_USBIW624(ct) (CARD_TYPE_USBIW624 == (ct))
+#define IS_USBIW610(ct) (CARD_TYPE_USBIW610 == (ct))
 
 /** USB8801 Card */
 #define CARD_USB8801 "USB8801"
@@ -516,20 +571,25 @@
 #define CARD_USB9098 "USB9098"
 /** USB9097 Card */
 #define CARD_USB9097 "USBIW620"
-/** USBNW62X Card */
-#define CARD_USBNW62X "USBNW62X"
+/** USBIW624 Card */
+#define CARD_USBIW624 "USBIW624"
+/** USBIW610 Card */
+#define CARD_USBIW610 "USBIW610"
 #endif
 
 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
 #define IS_CARD8887(ct) (CARD_TYPE_8887 == ((ct)&0xf))
 #define IS_CARD8897(ct) (CARD_TYPE_8897 == ((ct)&0xf))
 #define IS_CARD8977(ct) (CARD_TYPE_8977 == ((ct)&0xf))
+#define IS_CARD8978(ct) (CARD_TYPE_8978 == ((ct)&0xf))
 #define IS_CARD8997(ct) (CARD_TYPE_8997 == ((ct)&0xf))
 #define IS_CARD8987(ct) (CARD_TYPE_8987 == ((ct)&0xf))
 #define IS_CARD9098(ct) (CARD_TYPE_9098 == ((ct)&0xf))
 #define IS_CARD9097(ct) (CARD_TYPE_9097 == ((ct)&0xf))
 #define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
-#define IS_CARDNW62X(ct) (CARD_TYPE_NW62X == ((ct)&0xf))
+#define IS_CARDIW624(ct) (CARD_TYPE_IW624 == ((ct)&0xf))
+#define IS_CARDAW693(ct) (CARD_TYPE_AW693 == ((ct)&0xf))
+#define IS_CARDIW610(ct) (CARD_TYPE_IW610 == ((ct)&0xf))
 
 typedef struct _card_type_entry {
 	t_u16 card_type;
@@ -599,8 +659,14 @@
 
 #define MLAN_BUF_FLAG_TX_CTRL MBIT(14)
 
+#define MLAN_BUF_FLAG_EASYMESH MBIT(16)
+
 #define MLAN_BUF_FLAG_MC_AGGR_PKT MBIT(17)
 
+#define MLAN_BUF_FLAG_TCP_PKT MBIT(18)
+
+#define MLAN_BUF_FLAG_LLDE_PKT_FILTER MBIT(19)
+
 #ifdef DEBUG_LEVEL1
 /** Debug level bit definition */
 #define MMSG MBIT(0)
@@ -611,8 +677,8 @@
 #define MEVENT MBIT(5)
 #define MINTR MBIT(6)
 #define MIOCTL MBIT(7)
-
 #define MREG_D MBIT(9)
+#define MREG MBIT(10)
 
 #define MMPA_D MBIT(15)
 #define MDAT_D MBIT(16)
@@ -620,7 +686,8 @@
 #define MEVT_D MBIT(18)
 #define MFW_D MBIT(19)
 #define MIF_D MBIT(20)
-
+#define MFWDP_D MBIT(21)
+#define MSCH_D MBIT(22)
 #define MENTRY MBIT(28)
 #define MWARN MBIT(29)
 #define MINFO MBIT(30)
@@ -631,6 +698,8 @@
 #define MLAN_MEM_DMA MBIT(0)
 /** Memory allocation flag: ATOMIC */
 #define MLAN_MEM_FLAG_ATOMIC MBIT(1)
+/** Memory allocation flag: DIRTY - do not memset to 0 buffer */
+#define MLAN_MEM_FLAG_DIRTY MBIT(2)
 
 /** Default memory allocation flag */
 #define MLAN_MEM_DEF 0
@@ -724,6 +793,7 @@
 #ifdef WIFI_DIRECT_SUPPORT
 	MLAN_BSS_TYPE_WIFIDIRECT = 2,
 #endif
+	MLAN_BSS_TYPE_NAN = 4,
 	MLAN_BSS_TYPE_DFS = 8,
 	MLAN_BSS_TYPE_ANY = 0xff,
 } mlan_bss_type;
@@ -751,8 +821,6 @@
 typedef enum _mlan_event_id {
 	/* Event generated by firmware (MSB=0) */
 	MLAN_EVENT_ID_FW_UNKNOWN = 0x00000001,
-	MLAN_EVENT_ID_FW_ADHOC_LINK_SENSED = 0x00000002,
-	MLAN_EVENT_ID_FW_ADHOC_LINK_LOST = 0x00000003,
 	MLAN_EVENT_ID_FW_DISCONNECTED = 0x00000004,
 	MLAN_EVENT_ID_FW_MIC_ERR_UNI = 0x00000005,
 	MLAN_EVENT_ID_FW_MIC_ERR_MUL = 0x00000006,
@@ -799,6 +867,7 @@
 	MLAN_EVENT_ID_SSU_DUMP_FILE = 0x00000039,
 #endif /* SSU_SUPPORT */
 	MLAN_EVENT_ID_CSI = 0x00000040,
+	MLAN_EVENT_ID_FW_TX_BULK_STATUS = 0x00000043,
 	/* Event generated by MLAN driver (MSB=1) */
 	MLAN_EVENT_ID_DRV_CONNECTED = 0x80000001,
 	MLAN_EVENT_ID_DRV_DEFER_HANDLING = 0x80000002,
@@ -822,11 +891,21 @@
 	MLAN_EVENT_ID_DRV_UAP_CHAN_INFO = 0x80000020,
 #endif
 	MLAN_EVENT_ID_FW_ROAM_OFFLOAD_RESULT = 0x80000023,
+	MLAN_EVENT_ID_NAN_STARTED = 0x80000024,
+	MLAN_EVENT_ID_DRV_RTT_RESULT = 0x80000025,
 	MLAN_EVENT_ID_DRV_ASSOC_FAILURE_LOGGER = 0x80000026,
 	MLAN_EVENT_ID_DRV_ASSOC_SUCC_LOGGER = 0x80000027,
 	MLAN_EVENT_ID_DRV_DISCONNECT_LOGGER = 0x80000028,
 	MLAN_EVENT_ID_DRV_WIFI_STATUS = 0x80000029,
 	MLAN_EVENT_ID_STORE_HOST_CMD_RESP = 0x80000030,
+	MLAN_EVENT_ID_DRV_ADDBA_TIMEOUT = 0x80000031,
+#ifdef PCIE
+	MLAN_EVENT_ID_DRV_DEFER_RX_DATA = 0x80000032,
+	MLAN_EVENT_ID_DRV_DEFER_CMDRESP = 0x80000034,
+	MLAN_EVENT_ID_DRV_DEFER_TX_COMPLTE = 0x80000035,
+	MLAN_EVENT_ID_DRV_DELAY_TX_COMPLETE = 0x80000036,
+#endif
+	MLAN_EVENT_ID_DRV_RGPWR_KEY_MISMATCH = 0x80000037,
 } mlan_event_id;
 
 /** Data Structures */
@@ -876,7 +955,9 @@
 
 #define OID_TYPE_CAL 0x2
 #define OID_TYPE_DPD 0xa
+#define NONE_TYPE_DPD 0xb
 #define UNKNOW_DPD_LENGTH 0xffffffff
+#define NONE_DPD_LENGTH 0xfafafafa
 
 /** Custom data structure */
 typedef struct _mlan_init_param {
@@ -979,10 +1060,10 @@
 	t_u8 chan2Offset : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 #else
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
@@ -1157,6 +1238,10 @@
 	t_u8 mcs_index;
 	/** bitrate, in 500Kbps */
 	t_u16 bitrate;
+	/** NSS */
+	t_u8 nss_index;
+	/** DCM */
+	t_u8 dcm;
 } MLAN_PACK_END mix_rate_info, *pmix_rate_info;
 
 typedef MLAN_PACK_START struct _rxpd_extra_info {
@@ -1168,10 +1253,12 @@
 	t_u8 mcs_known;
 	/** mcs.flags */
 	t_u8 mcs_flags;
-	/** vht sig1 */
-	t_u32 vht_sig1;
-	/** vht sig2 */
-	t_u32 vht_sig2;
+	/** vht/he sig1 */
+	t_u32 vht_he_sig1;
+	/** vht/he sig2 */
+	t_u32 vht_he_sig2;
+	/** HE user idx */
+	t_u32 user_idx;
 } MLAN_PACK_END rxpd_extra_info, *prxpd_extra_info;
 
 typedef MLAN_PACK_START struct _radiotap_info {
@@ -1259,7 +1346,19 @@
 	/** mc_pkt_flags */
 	t_u8 mc_pkt_flags;
 } MLAN_PACK_END mc_txcontrol, *pmc_txcontrol;
-
+typedef MLAN_PACK_START struct MAPP_Stats_Mcast_drv {
+	t_u32 cycle_recv_under_2300usec;
+	t_u32 cycle_recv_in_time;
+	t_u32 cycle_recv_over_2900usec;
+	t_u32 cycle_recv_over_3500usec;
+	t_u32 cycle_recv_over_5000usec;
+	t_u32 cycle_recv_over_10000usec;
+	t_u32 cycle_recv_over_15000usec;
+	t_u32 spent_time_under_1000usec;
+	t_u32 spent_time_over_1000usec;
+	t_u32 spent_time_over_2000usec;
+	t_u32 spent_time_over_3000usec;
+} MLAN_PACK_END Stats_mcast_drv_t, *pStats_mcast_drv_t;
 /** mlan_buffer data structure */
 typedef struct _mlan_buffer {
 	/** Pointer to previous mlan_buffer */
@@ -1305,6 +1404,8 @@
 	t_u32 extra_ts_sec;
 	/** Time stamp when packet is dequed from rx_q(micro seconds) */
 	t_u32 extra_ts_usec;
+	/** When TX ra mac address,  When Rx Ta mac address*/
+	t_u8 mac[MLAN_MAC_ADDR_LENGTH];
 	/** Fields below are valid for MLAN module only */
 	/** Pointer to parent mlan_buffer */
 	struct _mlan_buffer *pparent;
@@ -1546,7 +1647,7 @@
 	/** Key Length */
 	t_u8 key_length;
 	/** actual key */
-	t_u8 key[1];
+	t_u8 key[];
 } MLAN_PACK_END tdls_each_link_status;
 
 /** TDLS configuration data */
@@ -1673,7 +1774,7 @@
 			/** number of links */
 			t_u8 active_links;
 			/** structure for link status */
-			tdls_each_link_status link_stats[1];
+			tdls_each_link_status link_stats[];
 		} MLAN_PACK_END tdls_link_status_resp;
 
 	} u;
@@ -1695,6 +1796,14 @@
 	t_u16 reason_code;
 } tdls_tear_down_event;
 
+/** Event structure for addba timeout */
+typedef struct _addba_timeout_event {
+	/** Peer mac address */
+	t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+	/** Tid */
+	t_u8 tid;
+} addba_timeout_event;
+
 /** channel width */
 typedef enum wifi_channel_width {
 	WIFI_CHAN_WIDTH_20 = 0,
@@ -1788,7 +1897,6 @@
 typedef enum {
 	MLAN_INTERFACE_STA = 0,
 	MLAN_INTERFACE_SOFTAP = 1,
-	MLAN_INTERFACE_IBSS = 2,
 	MLAN_INTERFACE_P2P_CLIENT = 3,
 	MLAN_INTERFACE_P2P_GO = 4,
 	MLAN_INTERFACE_NAN = 5,
@@ -1912,6 +2020,14 @@
 	WIFI_PEER_INVALID,
 } wifi_peer_type;
 
+typedef struct bssload_info {
+	/** station count */
+	t_u16 sta_count;
+	/** channel utilization */
+	t_u16 chan_util;
+	t_u8 PAD[4];
+} bssload_info_t;
+
 /** per peer statistics */
 typedef struct {
 	/** peer type (AP, TDLS, GO etc.) */
@@ -1920,6 +2036,8 @@
 	t_u8 peer_mac_address[6];
 	/** peer WIFI_CAPABILITY_XXX */
 	t_u32 capabilities;
+	/** STA count and channel utilization */
+	bssload_info_t bssload;
 	/** number of rates */
 	t_u32 num_rate;
 	/** per rate statistics, number of entries  = num_rate */
@@ -2035,6 +2153,308 @@
 	0x00000080 /** all contention (min, max, avg) statistics (within ac    \
 		      statisctics) */
 
+/** =========== Define Copied from HAL START =========== */
+/** Ranging status */
+typedef enum {
+	RTT_STATUS_SUCCESS = 0,
+	/** general failure status */
+	RTT_STATUS_FAILURE = 1,
+	/** target STA does not respond to request */
+	RTT_STATUS_FAIL_NO_RSP = 2,
+	/** request rejected. Applies to 2-sided RTT only */
+	RTT_STATUS_FAIL_REJECTED = 3,
+	RTT_STATUS_FAIL_NOT_SCHEDULED_YET = 4,
+	/** timing measurement times out */
+	RTT_STATUS_FAIL_TM_TIMEOUT = 5,
+	/** Target on different channel, cannot range */
+	RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6,
+	/** ranging not supported */
+	RTT_STATUS_FAIL_NO_CAPABILITY = 7,
+	/** request aborted for unknown reason */
+	RTT_STATUS_ABORTED = 8,
+	/** Invalid T1-T4 timestamp */
+	RTT_STATUS_FAIL_INVALID_TS = 9,
+	/** 11mc protocol failed */
+	RTT_STATUS_FAIL_PROTOCOL = 10,
+	/** request could not be scheduled */
+	RTT_STATUS_FAIL_SCHEDULE = 11,
+	/** responder cannot collaborate at time of request */
+	RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,
+	/** bad request args */
+	RTT_STATUS_INVALID_REQ = 13,
+	/** WiFi not enabled */
+	RTT_STATUS_NO_WIFI = 14,
+	/** Responder overrides param info, cannot range with new params */
+	RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE = 15
+} wifi_rtt_status;
+
+/** RTT peer type */
+typedef enum {
+	RTT_PEER_AP = 0x1,
+	RTT_PEER_STA = 0x2,
+	RTT_PEER_P2P_GO = 0x3,
+	RTT_PEER_P2P_CLIENT = 0x4,
+	RTT_PEER_NAN = 0x5
+} rtt_peer_type;
+
+/** RTT Measurement Bandwidth */
+typedef enum {
+	WIFI_RTT_BW_5 = 0x01,
+	WIFI_RTT_BW_10 = 0x02,
+	WIFI_RTT_BW_20 = 0x04,
+	WIFI_RTT_BW_40 = 0x08,
+	WIFI_RTT_BW_80 = 0x10,
+	WIFI_RTT_BW_160 = 0x20
+} wifi_rtt_bw;
+
+/** RTT Type */
+typedef enum {
+	RTT_TYPE_1_SIDED = 0x1,
+	RTT_TYPE_2_SIDED = 0x2,
+} wifi_rtt_type;
+
+/** RTT configuration */
+typedef struct {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	wifi_rtt_type type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	rtt_peer_type peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	wifi_channel_info channel;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u32 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u32 num_burst;
+	/** num of frames per burst. Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames to be attempted in a
+	 * single burst. This also equals the number of FTM frames that the
+	 * initiator will request that the responder send in a single frame. */
+	t_u32 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can retry an FTMR
+	 * frame. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u32 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	wifi_preamble preamble;
+	/** RTT BW to be used in the RTT frames */
+	wifi_rtt_bw bw;
+} wifi_rtt_config;
+
+/** Format of information elements found in the beacon */
+typedef struct {
+	/** element identifier */
+	t_u8 id;
+	/** number of bytes to follow */
+	t_u8 len;
+	t_u8 data[];
+} wifi_information_element;
+
+/** RTT results */
+typedef struct {
+	/** device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** burst number in a multi-burst request */
+	t_u32 burst_num;
+	/** Total RTT measurement frames attempted */
+	t_u32 measurement_number;
+	/** Total successful RTT measurement frames */
+	t_u32 success_number;
+	/** Maximum number of "FTM frames per burst" supported by
+	 * the responder STA. Applies to 2-sided RTT only.
+	 * If reponder overrides with larger value:
+	 * - for single-burst request initiator will truncate the
+	 * larger value and send a TMR_STOP after receiving as
+	 * many frames as originally requested.
+	 * - for multi-burst request, initiator will return
+	 * failure right away */
+	t_u8 number_per_burst_peer;
+	/** ranging status */
+	wifi_rtt_status status;
+	/** When status == RTT_STATUS_FAIL_BUSY_TRY_LATER,
+	 * this will be the time provided by the responder as to
+	 * when the request can be tried again. Applies to 2-sided
+	 * RTT only. In sec, 1-31sec. */
+	t_u8 retry_after_duration;
+	/** RTT type */
+	wifi_rtt_type type;
+	/** average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB */
+	int rssi;
+	/** rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
+	 */
+	int rssi_spread;
+	/** 1-sided RTT: TX rate of RTT frame.
+	 * 2-sided RTT: TX rate of initiator's Ack in response to FTM frame. */
+	wifi_rate tx_rate;
+	/** 1-sided RTT: TX rate of Ack from other side.
+	 * 2-sided RTT: TX rate of FTM frame coming from responder. */
+	wifi_rate rx_rate;
+	/** round trip time in picoseconds */
+	t_s64 rtt;
+	/** rtt standard deviation in picoseconds */
+	t_s64 rtt_sd;
+	/** difference between max and min rtt times recorded in picoseconds */
+	t_s64 rtt_spread;
+	/** distance in mm (optional) */
+	int distance_mm;
+	/** standard deviation in mm (optional) */
+	int distance_sd_mm;
+	/** difference between max and min distance recorded in mm (optional) */
+	int distance_spread_mm;
+	/** time of the measurement (in microseconds since boot) */
+	t_s64 ts;
+	/** in ms, actual time taken by the FW to finish one burst
+	 * measurement. Applies to 1-sided and 2-sided RTT. */
+	int burst_duration;
+	/** Number of bursts allowed by the responder. Applies
+	 * to 2-sided RTT only. */
+	int negotiated_burst_num;
+	/** for 11mc only */
+	wifi_information_element *LCI;
+	/** for 11mc only */
+	wifi_information_element *LCR;
+} wifi_rtt_result;
+
+/** Preamble definition for bit mask used in wifi_rtt_capabilities */
+#define PREAMBLE_LEGACY 0x1
+#define PREAMBLE_HT 0x2
+#define PREAMBLE_VHT 0x4
+
+/** BW definition for bit mask used in wifi_rtt_capabilities */
+#define BW_5_SUPPORT 0x1
+#define BW_10_SUPPORT 0x2
+#define BW_20_SUPPORT 0x4
+#define BW_40_SUPPORT 0x8
+#define BW_80_SUPPORT 0x10
+#define BW_160_SUPPORT 0x20
+
+/** RTT Capabilities */
+typedef struct {
+	/** if 1-sided rtt data collection is supported */
+	t_u8 rtt_one_sided_supported;
+	/** if ftm rtt data collection is supported */
+	t_u8 rtt_ftm_supported;
+	/** if initiator supports LCI request. Applies to 2-sided RTT */
+	t_u8 lci_support;
+	/** if initiator supports LCR request. Applies to 2-sided RTT */
+	t_u8 lcr_support;
+	/** bit mask indicates what preamble is supported by initiator */
+	t_u8 preamble_support;
+	/** bit mask indicates what BW is supported by initiator */
+	t_u8 bw_support;
+	/** if 11mc responder mode is supported */
+	t_u8 responder_supported;
+	/** draft 11mc spec version supported by chip. For instance,
+	 * version 4.0 should be 40 and version 4.3 should be 43 etc. */
+	t_u8 mc_version;
+} wifi_rtt_capabilities;
+
+/** API for setting LCI/LCR information to be provided to a requestor */
+typedef enum {
+	/** Not expected to change location */
+	WIFI_MOTION_NOT_EXPECTED = 0,
+	/** Expected to change location */
+	WIFI_MOTION_EXPECTED = 1,
+	/** Movement pattern unknown */
+	WIFI_MOTION_UNKNOWN = 2,
+} wifi_motion_pattern;
+
+/** LCI information */
+typedef struct {
+	/** latitude in degrees * 2^25 , 2's complement */
+	long latitude;
+	/** latitude in degrees * 2^25 , 2's complement */
+	long longitude;
+	/** Altitude in units of 1/256 m */
+	int altitude;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 latitude_unc;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 longitude_unc;
+	/** As defined in Section 2.4.5 from IETF RFC 6225: */
+	t_u8 altitude_unc;
+	/** Following element for configuring the Z subelement */
+	wifi_motion_pattern motion_pattern;
+	/** floor in units of 1/16th of floor. 0x80000000 if unknown. */
+	int floor;
+	/** in units of 1/64 m */
+	int height_above_floor;
+	/** in units of 1/64 m. 0 if unknown */
+	int height_unc;
+} wifi_lci_information;
+
+/** LCR information */
+typedef struct {
+	/** country code */
+	char country_code[2];
+	/** length of the info field */
+	int length;
+	/** Civic info to be copied in FTM frame */
+	char civic_info[256];
+} wifi_lcr_information;
+
+/**
+ * RTT Responder information
+ */
+typedef struct {
+	wifi_channel_info channel;
+	wifi_preamble preamble;
+} wifi_rtt_responder;
+
+/** =========== Define Copied from HAL END =========== */
+
+#define MAX_RTT_CONFIG_NUM 10
+
+/** RTT config params */
+typedef struct wifi_rtt_config_params {
+	t_u8 rtt_config_num;
+	wifi_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} wifi_rtt_config_params_t;
+
+#define OID_RTT_REQUEST 0
+#define OID_RTT_CANCEL 1
+
+/** Pass RTT result element between mlan and moal */
+typedef struct {
+	/** element identifier  */
+	t_u16 id;
+	/** number of bytes to follow  */
+	t_u16 len;
+	/** data: fill with one wifi_rtt_result  */
+	t_u8 data[];
+} wifi_rtt_result_element;
+
 /** station stats */
 typedef struct _sta_stats {
 	/** last_rx_in_msec */
@@ -2193,13 +2613,8 @@
 				     t_u8 antenna);
 	t_void (*moal_updata_peer_signal)(t_void *pmoal, t_u32 bss_index,
 					  t_u8 *peer_addr, t_s8 snr, t_s8 nflr);
+	mlan_status (*moal_get_host_time_ns)(t_u64 *time);
 	t_u64 (*moal_do_div)(t_u64 num, t_u32 base);
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal,
-						  t_u32 bss_index);
-	mlan_status (*moal_notify_hostcmd_complete)(t_void *pmoal,
-						    t_u32 bss_index);
-#endif
 	void (*moal_tp_accounting)(t_void *pmoal, t_void *buf,
 				   t_u32 drop_point);
 	void (*moal_tp_accounting_rx_param)(t_void *pmoal, unsigned int type,
@@ -2297,6 +2712,8 @@
 #endif
 	/** Auto deep sleep */
 	t_u32 auto_ds;
+	/** Boot Time Config */
+	t_u32 bootup_cal_ctrl;
 	/** IEEE PS mode */
 	t_u32 ps_mode;
 	/** Max Tx buffer size */
@@ -2346,6 +2763,10 @@
 	t_u8 passive_to_active_scan;
 	/** uap max supported station per chip */
 	t_u8 uap_max_sta;
+	/** wacp mode */
+	t_u8 wacp_mode;
+	/** custom Fw data */
+	t_u32 fw_data_cfg;
 	/** drv mode */
 	t_u32 drv_mode;
 	/** dfs w53 cfg */
@@ -2356,6 +2777,22 @@
 	t_u8 ext_scan;
 	/* mcs32 setting */
 	t_u8 mcs32;
+	/** second mac flag */
+	t_u8 second_mac;
+	/** napi */
+	t_u8 napi;
+	/** antcfg */
+	t_u32 antcfg;
+	/** dmcs */
+	t_u8 dmcs;
+	t_u8 pref_dbc;
+	t_u32 reject_addba_req;
+
+	t_u32 max_tx_pending;
+	t_u16 tx_budget;
+	t_u8 mclient_scheduling;
+	t_u8 disable_11h_tpc;
+	t_u32 amsdu_disable;
 } mlan_device, *pmlan_device;
 
 /** MLAN API function prototype */
@@ -2436,7 +2873,103 @@
 MLAN_API mlan_status mlan_disable_host_int(t_void *padapter);
 /** mlan unmask host interrupt */
 MLAN_API mlan_status mlan_enable_host_int(t_void *padapter);
+#ifdef PCIE
+MLAN_API void mlan_process_pcie_interrupt_cb(t_void *pmadapter, int type);
+#endif
 
 #define CSI_SIGNATURE 0xABCD
 
+/** secure add/sub **/
+#ifndef SINT8_MAX
+#define SINT8_MAX 0x7f
+#endif
+
+#ifndef SINT8_MIN
+#define SINT8_MIN 0x80
+#endif
+
+#ifndef UINT8_MAX
+#define UINT8_MAX 0xff
+#endif
+
+#ifndef SINT16_MAX
+#define SINT16_MAX 0x7fff
+#endif
+
+#ifndef SINT16_MIN
+#define SINT16_MIN 0x8000
+#endif
+
+#ifndef UINT16_MAX
+#define UINT16_MAX 0xffff
+#endif
+
+#ifndef SINT32_MAX
+#define SINT32_MAX 0x7fffffff
+#endif
+
+#ifndef SINT32_MIN
+#define SINT32_MIN 0x80000000
+#endif
+
+#ifndef UINT32_MAX
+#define UINT32_MAX 0xffffffff
+#endif
+
+#ifndef SINT64_MAX
+#define SINT64_MAX 0x7fffffffffffffff
+#endif
+
+#ifndef SINT64_MIN
+#define SINT64_MIN 0x8000000000000000
+#endif
+
+#ifndef UINT64_MAX
+#define UINT64_MAX 0xffffffffffffffff
+#endif
+
+#ifndef PTR_MAX
+#ifdef MLAN_64BIT
+#define PTR_MAX UINT64_MAX
+#else
+#define PTR_MAX UINT32_MAX
+#endif
+#endif
+
+#ifndef SINT_MAX
+#ifdef MLAN_64BIT
+#define SINT_MAX SINT64_MAX
+#else
+#define SINT_MAX SINT32_MAX
+#endif
+#endif
+
+#ifndef SINT_MIN
+#ifdef MLAN_64BIT
+#define SINT_MIN SINT64_MIN
+#else
+#define SINT_MIN SINT32_MIN
+#endif
+#endif
+
+#ifndef UINT_MAX
+#ifdef MLAN_64BIT
+#define UINT_MAX UINT64_MAX
+#else
+#define UINT_MAX UINT32_MAX
+#endif
+#endif
+
+typedef enum {
+	TYPE_SINT8,
+	TYPE_UINT8,
+	TYPE_SINT16,
+	TYPE_UINT16,
+	TYPE_SINT32,
+	TYPE_UINT32,
+	TYPE_SINT64,
+	TYPE_UINT64,
+	TYPE_PTR,
+} data_type;
+
 #endif /* !_MLAN_DECL_H_ */
diff --git a/wlan_src/mlan/mlan_event_ids.h b/wlan_src/mlan/mlan_event_ids.h
new file mode 100644
index 0000000..c34ed6d
--- /dev/null
+++ b/wlan_src/mlan/mlan_event_ids.h
@@ -0,0 +1,226 @@
+/** @file mlan_event_ids.h
+ *
+ *  @brief This file contains FW event ID definitions.
+ *
+ *
+ *  Copyright 2023-2024 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/* include guard is absent intentionally */
+
+/* FW -> Host Event ID Constants */
+
+/** Card Event definition : Dummy host wakeup signal */
+ENUM_ELEMENT(EVENT_DUMMY_HOST_WAKEUP_SIGNAL, 0x0001),
+	/** Card Event definition : Link lost */
+	ENUM_ELEMENT(EVENT_LINK_LOST, 0x0003),
+	/** Card Event definition : Link sensed */
+	ENUM_ELEMENT(EVENT_LINK_SENSED, 0x0004),
+	/** Card Event definition : MIB changed */
+	ENUM_ELEMENT(EVENT_MIB_CHANGED, 0x0006),
+	/** Card Event definition : Init done */
+	ENUM_ELEMENT(EVENT_INIT_DONE, 0x0007),
+	/** Card Event definition : Deauthenticated */
+	ENUM_ELEMENT(EVENT_DEAUTHENTICATED, 0x0008),
+	/** Card Event definition : Disassociated */
+	ENUM_ELEMENT(EVENT_DISASSOCIATED, 0x0009),
+	/** Card Event definition : Power save awake */
+	ENUM_ELEMENT(EVENT_PS_AWAKE, 0x000a),
+	/** Card Event definition : Power save sleep */
+	ENUM_ELEMENT(EVENT_PS_SLEEP, 0x000b),
+	/** Card Event definition : MIC error multicast */
+	ENUM_ELEMENT(EVENT_MIC_ERR_MULTICAST, 0x000d),
+	/** Card Event definition : MIC error unicast */
+	ENUM_ELEMENT(EVENT_MIC_ERR_UNICAST, 0x000e),
+
+	/** Card Event definition : Stop Tx */
+	ENUM_ELEMENT(EVENT_STOP_TX, 0x0013),
+	/** Card Event definition : Start Tx */
+	ENUM_ELEMENT(EVENT_START_TX, 0x0014),
+	/** Card Event definition : Channel switch */
+	ENUM_ELEMENT(EVENT_CHANNEL_SWITCH, 0x0015),
+
+	/** Card Event definition : MEAS report ready */
+	ENUM_ELEMENT(EVENT_MEAS_REPORT_RDY, 0x0016),
+
+	/** Card Event definition : WMM status change */
+	ENUM_ELEMENT(EVENT_WMM_STATUS_CHANGE, 0x0017),
+
+	/** Card Event definition : BG scan report */
+	ENUM_ELEMENT(EVENT_BG_SCAN_REPORT, 0x0018),
+	/** Card Event definition : BG scan stopped */
+	ENUM_ELEMENT(EVENT_BG_SCAN_STOPPED, 0x0065),
+
+	/** Card Event definition : Beacon RSSI low */
+	ENUM_ELEMENT(EVENT_RSSI_LOW, 0x0019),
+	/** Card Event definition : Beacon SNR low */
+	ENUM_ELEMENT(EVENT_SNR_LOW, 0x001a),
+	/** Card Event definition : Maximum fail */
+	ENUM_ELEMENT(EVENT_MAX_FAIL, 0x001b),
+	/** Card Event definition : Beacon RSSI high */
+	ENUM_ELEMENT(EVENT_RSSI_HIGH, 0x001c),
+	/** Card Event definition : Beacon SNR high */
+	ENUM_ELEMENT(EVENT_SNR_HIGH, 0x001d),
+
+	/** Card Event definition : Data RSSI low */
+	ENUM_ELEMENT(EVENT_DATA_RSSI_LOW, 0x0024),
+	/** Card Event definition : Data SNR low */
+	ENUM_ELEMENT(EVENT_DATA_SNR_LOW, 0x0025),
+	/** Card Event definition : Data RSSI high */
+	ENUM_ELEMENT(EVENT_DATA_RSSI_HIGH, 0x0026),
+	/** Card Event definition : Data SNR high */
+	ENUM_ELEMENT(EVENT_DATA_SNR_HIGH, 0x0027),
+
+	/** Card Event definition : Link Quality */
+	ENUM_ELEMENT(EVENT_LINK_QUALITY, 0x0028),
+
+	/** Card Event definition : Port release event */
+	ENUM_ELEMENT(EVENT_PORT_RELEASE, 0x002b),
+
+#ifdef UAP_SUPPORT
+	/** Event ID: STA deauth */
+	ENUM_ELEMENT(EVENT_MICRO_AP_STA_DEAUTH, 0x002c),
+	/** Event ID: STA assoicated */
+	ENUM_ELEMENT(EVENT_MICRO_AP_STA_ASSOC, 0x002d),
+	/** Event ID: BSS started */
+	ENUM_ELEMENT(EVENT_MICRO_AP_BSS_START, 0x002e),
+	/** Event ID: BSS idle event */
+	ENUM_ELEMENT(EVENT_MICRO_AP_BSS_IDLE, 0x0043),
+	/** Event ID: BSS active event */
+	ENUM_ELEMENT(EVENT_MICRO_AP_BSS_ACTIVE, 0x0044),
+
+	/** Event ID: MIC countermeasures event */
+	ENUM_ELEMENT(EVENT_MICRO_AP_MIC_COUNTERMEASURES, 0x004c),
+#endif /* UAP_SUPPORT */
+
+	/** Card Event definition : Pre-Beacon Lost */
+	ENUM_ELEMENT(EVENT_PRE_BEACON_LOST, 0x0031),
+
+	ENUM_ELEMENT(EVENT_WATCHDOG_TMOUT, 0x0032),
+
+	/** Card Event definition : Add BA event */
+	ENUM_ELEMENT(EVENT_ADDBA, 0x0033),
+	/** Card Event definition : Del BA event */
+	ENUM_ELEMENT(EVENT_DELBA, 0x0034),
+	/** Card Event definition: BA stream timeout*/
+	ENUM_ELEMENT(EVENT_BA_STREAM_TIMEOUT, 0x0037),
+
+	/** Card Event definition : AMSDU aggr control */
+	ENUM_ELEMENT(EVENT_AMSDU_AGGR_CTRL, 0x0042),
+
+	/** Card Event definition: WEP ICV error */
+	ENUM_ELEMENT(EVENT_WEP_ICV_ERR, 0x0046),
+
+	/** Card Event definition : Host sleep enable */
+	ENUM_ELEMENT(EVENT_HS_ACT_REQ, 0x0047),
+
+	/** Card Event definition : BW changed */
+	ENUM_ELEMENT(EVENT_BW_CHANGE, 0x0048),
+
+#ifdef WIFI_DIRECT_SUPPORT
+	/** WIFIDIRECT generic event */
+	ENUM_ELEMENT(EVENT_WIFIDIRECT_GENERIC_EVENT, 0x0049),
+	/** WIFIDIRECT service discovery event */
+	ENUM_ELEMENT(EVENT_WIFIDIRECT_SERVICE_DISCOVERY, 0x004a),
+#endif
+	/** Remain on Channel expired event */
+	ENUM_ELEMENT(EVENT_REMAIN_ON_CHANNEL_EXPIRED, 0x005f),
+
+	/** TDLS generic event */
+	ENUM_ELEMENT(EVENT_TDLS_GENERIC_EVENT, 0x0052),
+
+	ENUM_ELEMENT(EVENT_MEF_HOST_WAKEUP, 0x004f),
+
+	/** Card Event definition: Channel switch pending announcment */
+	ENUM_ELEMENT(EVENT_CHANNEL_SWITCH_ANN, 0x0050),
+
+	/** Event definition:  Radar Detected by card */
+	ENUM_ELEMENT(EVENT_RADAR_DETECTED, 0x0053),
+
+	/** Event definition:  Radar Detected by card */
+	ENUM_ELEMENT(EVENT_CHANNEL_REPORT_RDY, 0x0054),
+
+	/** Event definition:  Scan results through event */
+	ENUM_ELEMENT(EVENT_EXT_SCAN_REPORT, 0x0058),
+	/** Enhance ext scan done event */
+	ENUM_ELEMENT(EVENT_EXT_SCAN_STATUS_REPORT, 0x007f),
+
+	/** Event definition: RXBA_SYNC */
+	ENUM_ELEMENT(EVENT_RXBA_SYNC, 0x0059),
+
+	/** Event ID: TX data pause event */
+	ENUM_ELEMENT(EVENT_TX_DATA_PAUSE, 0x0055),
+
+	/** Event definition : FW debug information */
+	ENUM_ELEMENT(EVENT_FW_DEBUG_INFO, 0x0063),
+
+	/** Event ID: SAD Report */
+	ENUM_ELEMENT(EVENT_SAD_REPORT, 0x0066),
+
+	/** Event ID: Multi Chan Info*/
+	ENUM_ELEMENT(EVENT_MULTI_CHAN_INFO, 0x006a),
+
+	ENUM_ELEMENT(EVENT_FW_DUMP_INFO, 0x0073),
+	/** Event ID: Tx status */
+	ENUM_ELEMENT(EVENT_TX_STATUS_REPORT, 0x0074),
+
+	ENUM_ELEMENT(EVENT_NAN_GENERIC, 0x0075),
+
+	ENUM_ELEMENT(EVENT_BT_COEX_WLAN_PARA_CHANGE, 0x0076),
+
+	ENUM_ELEMENT(EVENT_VDLL_IND, 0x0081),
+
+	ENUM_ELEMENT(EVENT_ROAM_OFFLOAD, 0x0083),
+
+	ENUM_ELEMENT(EVENT_WLS_FTM_COMPLETE, 0x0086),
+
+	ENUM_ELEMENT(EVENT_EXCEED_MAX_P2P_CONN, 0x0089),
+
+#if defined(PCIE)
+	ENUM_ELEMENT(EVENT_SSU_DUMP_DMA, 0x008C),
+#endif
+
+	ENUM_ELEMENT(EVENT_CSI, 0x008D),
+	ENUM_ELEMENT(EVENT_FW_HANG_REPORT, 0x008F),
+	ENUM_ELEMENT(EVENT_DPD_LOG, 0x0091),
+	/** Card Event definition : RESET PN */
+
+	ENUM_ELEMENT(EVENT_ASSOC_REQ_IE, 0x0095),
+
+	ENUM_ELEMENT(EVENT_CHAN_LOAD, 0x0099),
+
+	ENUM_ELEMENT(EVENT_IMD3_CAL_START, 0x00A0),
+	ENUM_ELEMENT(EVENT_IMD3_CAL_END, 0x00A1),
+
+	/** Event ID: Bulk Tx status */
+	ENUM_ELEMENT(EVENT_TX_STATUS_BULK_REPORT, 0x00A2),
+
+	/** Event ID: peer's power save mode change */
+	ENUM_ELEMENT(EVENT_PEER_PS_MODE_CHANGE, 0x00A3),
+
+	ENUM_ELEMENT(EVENT_CHAN_SWITCH_TO_6G_BLOCK, 0x00A4),
+	/* Always keep this last */
+	ENUM_ELEMENT_LAST(__HostEvent_Last)
diff --git a/wlan_sd8987/mlan/mlan_fw.h b/wlan_src/mlan/mlan_fw.h
old mode 100755
new mode 100644
similarity index 80%
rename from wlan_sd8987/mlan/mlan_fw.h
rename to wlan_src/mlan/mlan_fw.h
index ccb2204..51ad5ef
--- a/wlan_sd8987/mlan/mlan_fw.h
+++ b/wlan_src/mlan/mlan_fw.h
@@ -5,20 +5,29 @@
  *  in MLAN module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -30,6 +39,8 @@
 #ifndef _MLAN_FW_H_
 #define _MLAN_FW_H_
 
+#include "mlan_tlv_ids.h"
+
 /** Interface header length */
 #ifdef USB
 #define USB_INTF_HEADER_LEN 0
@@ -153,10 +164,30 @@
 extern t_u8 SupportedRates_BG[BG_SUPPORTED_RATES];
 extern t_u8 SupportedRates_A[A_SUPPORTED_RATES];
 extern t_u8 SupportedRates_N[N_SUPPORTED_RATES];
-extern t_u8 AdhocRates_G[G_SUPPORTED_RATES];
-extern t_u8 AdhocRates_B[B_SUPPORTED_RATES];
-extern t_u8 AdhocRates_BG[BG_SUPPORTED_RATES];
-extern t_u8 AdhocRates_A[A_SUPPORTED_RATES];
+
+#define MAX_FW_DATA_BLOCK 8
+#if defined(USB8978) || defined(SD8978)
+/** Fw custom data */
+#define FW_DATA_FW_REMAP_CONFIG_LEN 44
+extern t_u8 fw_data_fw_remap_config[FW_DATA_FW_REMAP_CONFIG_LEN];
+#endif
+#if defined(USB8978)
+#define FW_DATA_USB_BULK_EP_LEN 36
+extern t_u8 fw_data_usb_bulk_ep[FW_DATA_USB_BULK_EP_LEN];
+#endif
+#if defined(USB8978) || defined(SD8978)
+#define FW_DATA_DPD_CURRENT_OPT_LEN 36
+extern t_u8 fw_data_dpd_current_opt[FW_DATA_DPD_CURRENT_OPT_LEN];
+#endif
+
+/** Firmware wakeup method : Unchanged */
+#define WAKEUP_FW_UNCHANGED 0
+/** Firmware wakeup method : Through interface */
+#define WAKEUP_FW_THRU_INTERFACE 1
+/** Firmware wakeup method : Through GPIO*/
+#define WAKEUP_FW_THRU_GPIO 2
+/** Default value of GPIO */
+#define DEF_WAKEUP_FW_GPIO 0
 
 /** Default auto deep sleep mode */
 #define DEFAULT_AUTO_DS_MODE MTRUE
@@ -248,21 +279,21 @@
 #define MRVDRV_SNAP_HEADER_LEN 8
 
 /** The number of times to try when polling for status bits */
-#define MAX_POLL_TRIES 300
+#define MAX_POLL_TRIES 100
 
 /** The number of times to try when waiting for downloaded firmware to
      become active when multiple interface is present */
 #define MAX_MULTI_INTERFACE_POLL_TRIES 150
 /** The number of times to try when waiting for downloaded firmware to
      become active. (polling the scratch register). */
-#define MAX_FIRMWARE_POLL_TRIES 100
+#define MAX_FIRMWARE_POLL_TRIES 300
 
 /** FW fill in rx_len with extra 204 bytes */
 #define EXTRA_LEN 256
 
 /** Buffer size for ethernet Tx packets */
-#define MRVDRV_ETH_TX_PACKET_BUFFER_SIZE                                       \
-	(MV_ETH_FRAME_LEN + sizeof(TxPD) + EXTRA_LEN)
+#define MRVDRV_ETH_TX_PACKET_BUFFER_SIZE(_adapter)                             \
+	(MV_ETH_FRAME_LEN + Tx_PD_SIZEOF(_adapter) + EXTRA_LEN)
 
 /** Buffer size for ethernet Rx packets */
 #define MRVDRV_ETH_RX_PACKET_BUFFER_SIZE                                       \
@@ -302,256 +333,6 @@
 /** 2K buf size */
 #define MLAN_TX_DATA_BUF_SIZE_2K 2048
 
-/** Terminating TLV Type */
-#define MRVL_TERMINATE_TLV_ID 0xffff
-
-/** TLV type : SSID */
-#define TLV_TYPE_SSID 0x0000
-/** TLV type : Rates */
-#define TLV_TYPE_RATES 0x0001
-/** TLV type : PHY FH */
-#define TLV_TYPE_PHY_FH 0x0002
-/** TLV type : PHY DS */
-#define TLV_TYPE_PHY_DS 0x0003
-/** TLV type : CF */
-#define TLV_TYPE_CF 0x0004
-/** TLV type : IBSS */
-#define TLV_TYPE_IBSS 0x0006
-
-/** TLV type : Domain */
-#define TLV_TYPE_DOMAIN 0x0007
-
-/** TLV type : Power constraint */
-#define TLV_TYPE_POWER_CONSTRAINT 0x0020
-
-/** TLV type : Power capability */
-#define TLV_TYPE_POWER_CAPABILITY 0x0021
-
-#define TLV_TYPE_HT_CAPABILITY 0x002d
-
-#define TLV_TYPE_EXTENSION_ID 0x00ff
-
-/**TLV type : Host MLME Flag*/
-#define TLV_TYPE_HOST_MLME (PROPRIETARY_TLV_BASE_ID + 307)
-
-/** TLV type : AP wacp mode */
-#define TLV_TYPE_UAP_WACP_MODE (PROPRIETARY_TLV_BASE_ID + 0x147) /* 0x0247 */
-
-/** TLV type : Vendor Specific IE */
-#define TLV_TYPE_VENDOR_SPECIFIC_IE 0x00dd
-
-/** TLV type : Key material */
-#define TLV_TYPE_KEY_MATERIAL (PROPRIETARY_TLV_BASE_ID + 0x00) /* 0x0100 */
-/** TLV type : Channel list */
-#define TLV_TYPE_CHANLIST (PROPRIETARY_TLV_BASE_ID + 0x01) /* 0x0101 */
-/** TLV type : Number of probes */
-#define TLV_TYPE_NUMPROBES (PROPRIETARY_TLV_BASE_ID + 0x02) /* 0x0102 */
-/** TLV type : Beacon RSSI low */
-#define TLV_TYPE_RSSI_LOW (PROPRIETARY_TLV_BASE_ID + 0x04) /* 0x0104 */
-/** TLV type : Beacon SNR low */
-#define TLV_TYPE_SNR_LOW (PROPRIETARY_TLV_BASE_ID + 0x05) /* 0x0105 */
-/** TLV type : Fail count */
-#define TLV_TYPE_FAILCOUNT (PROPRIETARY_TLV_BASE_ID + 0x06) /* 0x0106 */
-/** TLV type : BCN miss */
-#define TLV_TYPE_BCNMISS (PROPRIETARY_TLV_BASE_ID + 0x07) /* 0x0107 */
-/** TLV type : LED behavior */
-#define TLV_TYPE_LEDBEHAVIOR (PROPRIETARY_TLV_BASE_ID + 0x09) /* 0x0109 */
-/** TLV type : Passthrough */
-#define TLV_TYPE_PASSTHROUGH (PROPRIETARY_TLV_BASE_ID + 0x0a) /* 0x010a */
-/** TLV type : Power TBL 2.4 Ghz */
-#define TLV_TYPE_POWER_TBL_2_4GHZ                                              \
-	(PROPRIETARY_TLV_BASE_ID + 0x0c) /* 0x010c                             \
-					  */
-/** TLV type : Power TBL 5 GHz */
-#define TLV_TYPE_POWER_TBL_5GHZ (PROPRIETARY_TLV_BASE_ID + 0x0d) /* 0x010d */
-/** TLV type : WMM queue status */
-#define TLV_TYPE_WMMQSTATUS (PROPRIETARY_TLV_BASE_ID + 0x10) /* 0x0110 */
-/** TLV type : Wildcard SSID */
-#define TLV_TYPE_WILDCARDSSID (PROPRIETARY_TLV_BASE_ID + 0x12) /* 0x0112 */
-/** TLV type : TSF timestamp */
-#define TLV_TYPE_TSFTIMESTAMP (PROPRIETARY_TLV_BASE_ID + 0x13) /* 0x0113 */
-/** TLV type : ARP filter */
-#define TLV_TYPE_ARP_FILTER (PROPRIETARY_TLV_BASE_ID + 0x15) /* 0x0115 */
-/** TLV type : Beacon RSSI high */
-#define TLV_TYPE_RSSI_HIGH (PROPRIETARY_TLV_BASE_ID + 0x16) /* 0x0116 */
-/** TLV type : Beacon SNR high */
-#define TLV_TYPE_SNR_HIGH (PROPRIETARY_TLV_BASE_ID + 0x17) /* 0x0117 */
-/** TLV type : Start BG scan later */
-#define TLV_TYPE_STARTBGSCANLATER                                              \
-	(PROPRIETARY_TLV_BASE_ID + 0x1e) /* 0x011e                             \
-					  */
-/** TLV type: BG scan repeat count */
-#define TLV_TYPE_REPEAT_COUNT (PROPRIETARY_TLV_BASE_ID + 0xb0) /* 0x01b0 */
-/** TLV type : Authentication type */
-#define TLV_TYPE_AUTH_TYPE (PROPRIETARY_TLV_BASE_ID + 0x1f) /* 0x011f */
-/** TLV type : BSSID */
-#define TLV_TYPE_BSSID (PROPRIETARY_TLV_BASE_ID + 0x23) /* 0x0123 */
-
-/** TLV type : Link Quality */
-#define TLV_TYPE_LINK_QUALITY (PROPRIETARY_TLV_BASE_ID + 0x24) /* 0x0124 */
-
-/** TLV type : Data RSSI low */
-#define TLV_TYPE_RSSI_LOW_DATA (PROPRIETARY_TLV_BASE_ID + 0x26) /* 0x0126 */
-/** TLV type : Data SNR low */
-#define TLV_TYPE_SNR_LOW_DATA (PROPRIETARY_TLV_BASE_ID + 0x27) /* 0x0127 */
-/** TLV type : Data RSSI high */
-#define TLV_TYPE_RSSI_HIGH_DATA (PROPRIETARY_TLV_BASE_ID + 0x28) /* 0x0128 */
-/** TLV type : Data SNR high */
-#define TLV_TYPE_SNR_HIGH_DATA (PROPRIETARY_TLV_BASE_ID + 0x29) /* 0x0129 */
-
-/** TLV type : Channel band list */
-#define TLV_TYPE_CHANNELBANDLIST (PROPRIETARY_TLV_BASE_ID + 0x2a) /* 0x012a */
-
-/** TLV type : Security Cfg */
-#define TLV_TYPE_SECURITY_CFG (PROPRIETARY_TLV_BASE_ID + 0x3a) /* 0x013a */
-
-/** TLV type : Passphrase */
-#define TLV_TYPE_PASSPHRASE (PROPRIETARY_TLV_BASE_ID + 0x3c) /* 0x013c */
-/** TLV type : SAE Password */
-#define TLV_TYPE_SAE_PASSWORD (PROPRIETARY_TLV_BASE_ID + 0x141) /* 0x0241 */
-/** TLV type : SAE PWE Derivation Mode */
-#define TLV_TYPE_WPA3_SAE_PWE_DERIVATION_MODE                                  \
-	(PROPRIETARY_TLV_BASE_ID + 339) /* 0x0100 + 0x153 */
-/** TLV type : Encryption Protocol TLV */
-#define TLV_TYPE_ENCRYPTION_PROTO                                              \
-	(PROPRIETARY_TLV_BASE_ID + 0x40) /* 0x0140                             \
-					  */
-/** TLV type : Cipher TLV */
-#define TLV_TYPE_CIPHER (PROPRIETARY_TLV_BASE_ID + 0x42) /* 0x0142 */
-/** TLV type : PMK */
-#define TLV_TYPE_PMK (PROPRIETARY_TLV_BASE_ID + 0x44) /* 0x0144 */
-
-/** TLV type : BCN miss */
-#define TLV_TYPE_PRE_BCNMISS (PROPRIETARY_TLV_BASE_ID + 0x49) /* 0x0149 */
-
-/** TLV type : ENABLE ROAM IE */
-#define TLV_TYPE_ROAM (PROPRIETARY_TLV_BASE_ID + 245)
-/** TLV type : AP LIST IE */
-#define TLV_TYPE_APLIST (PROPRIETARY_TLV_BASE_ID + 246)
-/** TLV type : PMK */
-#define TLV_TYPE_PMK_R0 (PROPRIETARY_TLV_BASE_ID + 247)
-/** TLV type : PMK */
-#define TLV_TYPE_PMK_R0_NAME (PROPRIETARY_TLV_BASE_ID + 248)
-/** TLV type : TRIGGER CONDITION*/
-#define TLV_TYPE_ROM_TRIGGER (PROPRIETARY_TLV_BASE_ID + 264)
-/** TLV type : RETRY_COUNT*/
-#define TLV_TYPE_ROM_RETRY_COUNT (PROPRIETARY_TLV_BASE_ID + 265)
-/** TLV type : BGSCAN SETTING*/
-#define TLV_TYPE_ROM_BGSCAN (PROPRIETARY_TLV_BASE_ID + 266)
-/** TLV type : PARA RSSI*/
-#define TLV_TYPE_ROM_PARA_RSSI (PROPRIETARY_TLV_BASE_ID + 267)
-/** TLV type : BSSID blacklist*/
-#define TLV_TYPE_BLACKLIST_BSSID (PROPRIETARY_TLV_BASE_ID + 0x11d)
-/** TLV type : BAND & RSSI*/
-#define TLV_TYPE_BAND_RSSI (PROPRIETARY_TLV_BASE_ID + 0x11e)
-/** TLV type : ESS scan*/
-#define TLV_TYPE_ENERGYEFFICIENTSCAN (PROPRIETARY_TLV_BASE_ID + 0xda)
-/** TLV type : KEY params*/
-#define TLV_TYPE_ROAM_OFFLOAD_USER_SET_PMK (PROPRIETARY_TLV_BASE_ID + 291)
-
-/** TLV type: WAPI IE */
-#define TLV_TYPE_WAPI_IE (PROPRIETARY_TLV_BASE_ID + 0x5e) /* 0x015e */
-
-/** TLV type: MGMT IE */
-#define TLV_TYPE_MGMT_IE (PROPRIETARY_TLV_BASE_ID + 0x69) /* 0x0169 */
-/** TLV type: MAX_MGMT_IE */
-#define TLV_TYPE_MAX_MGMT_IE (PROPRIETARY_TLV_BASE_ID + 0xaa) /* 0x01aa */
-
-/** TLV : Region Domain Code */
-#define TLV_TYPE_REGION_DOMAIN_CODE                                            \
-	(PROPRIETARY_TLV_BASE_ID + 0xab) /* 0x01ab */
-
-/** TLV type: key param v2 */
-#define TLV_TYPE_KEY_PARAM_V2 (PROPRIETARY_TLV_BASE_ID + 0x9C) /* 0x019C */
-
-/** TLV type: ps params in hs */
-#define TLV_TYPE_PS_PARAMS_IN_HS (PROPRIETARY_TLV_BASE_ID + 0xB5) /* 0x01b5 */
-/** TLV type: hs wake hold off */
-#define TLV_TYPE_HS_WAKE_HOLDOFF (PROPRIETARY_TLV_BASE_ID + 0xB6) /* 0x01b6 */
-/** TLV type: wake up source */
-#define TLV_TYPE_HS_WAKEUP_SOURCE_GPIO                                         \
-	(PROPRIETARY_TLV_BASE_ID + 0x105) /* 0x0205 */
-/** TLV type: management filter  */
-#define TLV_TYPE_MGMT_FRAME_WAKEUP                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0x116) /* 0x0216 */
-/** TLV type: extend wakeup source */
-#define TLV_TYPE_WAKEUP_EXTEND (PROPRIETARY_TLV_BASE_ID + 0x118) /* 0x0218 */
-/** TLV type: HS antenna mode */
-#define TLV_TYPE_HS_ANTMODE (PROPRIETARY_TLV_BASE_ID + 0x119) /* 0x0219 */
-
-/** TLV type: robustcoex mode */
-#define TLV_TYPE_ROBUSTCOEX (PROPRIETARY_TLV_BASE_ID + 0x11B) /* 0x021B */
-
-#define TLV_TYPE_DMCS_STATUS (PROPRIETARY_TLV_BASE_ID + 0x13A) /* 0x023A */
-
-/** TLV type : TDLS IDLE TIMEOUT */
-#define TLV_TYPE_TDLS_IDLE_TIMEOUT                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0xC2) /* 0x01C2                             \
-					  */
-
-/** TLV type : HT Capabilities */
-#define TLV_TYPE_HT_CAP (PROPRIETARY_TLV_BASE_ID + 0x4a) /* 0x014a */
-/** TLV type : HT Information */
-#define TLV_TYPE_HT_INFO (PROPRIETARY_TLV_BASE_ID + 0x4b) /* 0x014b */
-/** TLV type : Secondary Channel Offset */
-#define TLV_SECONDARY_CHANNEL_OFFSET                                           \
-	(PROPRIETARY_TLV_BASE_ID + 0x4c) /* 0x014c */
-/** TLV type : 20/40 BSS Coexistence */
-#define TLV_TYPE_2040BSS_COEXISTENCE                                           \
-	(PROPRIETARY_TLV_BASE_ID + 0x4d) /* 0x014d */
-/** TLV type : Overlapping BSS Scan Parameters */
-#define TLV_TYPE_OVERLAP_BSS_SCAN_PARAM                                        \
-	(PROPRIETARY_TLV_BASE_ID + 0x4e) /* 0x014e */
-/** TLV type : Extended capabilities */
-#define TLV_TYPE_EXTCAP (PROPRIETARY_TLV_BASE_ID + 0x4f) /* 0x014f */
-/** TLV type : Set of MCS values that STA desires to use within the BSS */
-#define TLV_TYPE_HT_OPERATIONAL_MCS_SET                                        \
-	(PROPRIETARY_TLV_BASE_ID + 0x50) /* 0x0150 */
-/** TLV ID : Management Frame */
-#define TLV_TYPE_MGMT_FRAME (PROPRIETARY_TLV_BASE_ID + 0x68) /* 0x0168 */
-/** TLV type : RXBA_SYNC */
-#define TLV_TYPE_RXBA_SYNC (PROPRIETARY_TLV_BASE_ID + 0x99) /* 0x0199 */
-
-#ifdef WIFI_DIRECT_SUPPORT
-/** TLV type : AP PSK */
-#define TLV_TYPE_UAP_PSK (PROPRIETARY_TLV_BASE_ID + 0xa8) /* 0x01a8 */
-/** TLV type : p2p NOA */
-#define TLV_TYPE_WIFI_DIRECT_NOA (PROPRIETARY_TLV_BASE_ID + 0x83)
-/** TLV type : p2p opp ps */
-#define TLV_TYPE_WIFI_DIRECT_OPP_PS (PROPRIETARY_TLV_BASE_ID + 0x84)
-#endif /* WIFI_DIRECT_SUPPORT */
-/** TLV type : GPIO TSF LATCH CONFIG */
-#define TLV_TYPE_GPIO_TSF_LATCH_CONFIG (PROPRIETARY_TLV_BASE_ID + 0x154)
-/** TLV type : GPIO TSF LATCH REPORT*/
-#define TLV_TYPE_GPIO_TSF_LATCH_REPORT (PROPRIETARY_TLV_BASE_ID + 0x155)
-
-/** TLV : 20/40 coex config */
-#define TLV_TYPE_2040_BSS_COEX_CONTROL                                         \
-	(PROPRIETARY_TLV_BASE_ID + 0x98) /* 0x0198 */
-
-/** TLV type :  aggr win size */
-#define TLV_BTCOEX_WL_AGGR_WINSIZE (PROPRIETARY_TLV_BASE_ID + 0xca)
-/** TLV type :  scan time */
-#define TLV_BTCOEX_WL_SCANTIME (PROPRIETARY_TLV_BASE_ID + 0Xcb)
-/** TLV type : Ewpa_eapol_pkt */
-#define TLV_TYPE_EAPOL_PKT (PROPRIETARY_TLV_BASE_ID + 0xcf)
-
-#define TLV_TYPE_COALESCE_RULE (PROPRIETARY_TLV_BASE_ID + 0x9a)
-
-/** TLV type :  EES Configuration */
-#define TLV_TYPE_EES_CFG (PROPRIETARY_TLV_BASE_ID + 0xda)
-/** TLV type :  EES Network Configuration */
-#define TLV_TYPE_EES_NET_CFG (PROPRIETARY_TLV_BASE_ID + 0xdb)
-
-#define TLV_TYPE_LL_STAT_IFACE (PROPRIETARY_TLV_BASE_ID + 300)
-#define TLV_TYPE_LL_STAT_RADIO (PROPRIETARY_TLV_BASE_ID + 301)
-
-/** TLV type: fw cap info */
-#define TLV_TYPE_FW_CAP_INFO (PROPRIETARY_TLV_BASE_ID + 318)
-
-/** TLV type: secure boot uuid */
-#define TLV_TYPE_SECURE_BOOT_UUID (PROPRIETARY_TLV_BASE_ID + 348)
-
 /** ADDBA TID mask */
 #define ADDBA_TID_MASK (MBIT(2) | MBIT(3) | MBIT(4) | MBIT(5))
 /** DELBA TID mask */
@@ -708,6 +489,9 @@
 /** DevMCSSupported : Rx MCS supported */
 #define GET_RXMCSSUPP(DevMCSSupported) (DevMCSSupported & 0x0f)
 
+/** hw_dev_cap : MPDU DENSITY */
+#define GET_MPDU_DENSITY(hw_dev_cap) (hw_dev_cap & 0x7)
+
 /** GET HTCapInfo : Supported Channel BW */
 #define GETHT_SUPPCHANWIDTH(HTCapInfo) (HTCapInfo & MBIT(1))
 /** GET HTCapInfo : Support for Greenfield */
@@ -889,7 +673,14 @@
 #define SET_EXTCAP_TWT_REQ(ext_cap) (ext_cap.TWTReq = 1)
 /** ExtCap : ReSet support Ext TWT REQ */
 #define RESET_EXTCAP_TWT_REQ(ext_cap) (ext_cap.TWTReq = 0)
+/** ExtCap : Support for Beacon Protection */
+#define ISSUPP_EXTCAP_EXT_BEACON_PROT(ext_cap) (ext_cap.beacon_prot)
+/** ExtCap : Set support Beacon Protection */
+#define SET_EXTCAP_BEACON_PROT(ext_cap) (ext_cap.beacon_prot = 1)
 
+/** ExtCap : Set FTMI bit(bit 71) */
+#define SET_EXTCAP_FTMI(ext_cap) (ext_cap.FTMI = 1)
+#define SET_EXTCAP_INTERNETWORKING(ext_cap) (ext_cap.Interworking = 1)
 /** LLC/SNAP header len   */
 #define LLC_SNAP_LEN 8
 
@@ -1054,20 +845,6 @@
 	(DevMCSMap |= (value & 0x3) << (2 * (nss - 1)))
 #define RESET_DEVRXMCSMAP(DevMCSMap) (DevMCSMap &= 0xFFFF0000)
 
-/** TLV type : Rate scope */
-#define TLV_TYPE_RATE_DROP_PATTERN                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0x51) /* 0x0151                             \
-					  */
-/** TLV type : Rate drop pattern */
-#define TLV_TYPE_RATE_DROP_CONTROL                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0x52) /* 0x0152                             \
-					  */
-/** TLV type : Rate scope */
-#define TLV_TYPE_RATE_SCOPE (PROPRIETARY_TLV_BASE_ID + 0x53) /* 0x0153 */
-
-/** TLV type : Power group */
-#define TLV_TYPE_POWER_GROUP (PROPRIETARY_TLV_BASE_ID + 0x54) /* 0x0154 */
-
 /** Modulation class for DSSS Rates */
 #define MOD_CLASS_HR_DSSS 0x03
 /** Modulation class for OFDM Rates */
@@ -1076,307 +853,27 @@
 #define MOD_CLASS_HT 0x08
 /** Modulation class for VHT Rates */
 #define MOD_CLASS_VHT 0x09
-/** HT bandwidth 20 MHz */
-#define HT_BW_20 0
-/** HT bandwidth 40 MHz */
-#define HT_BW_40 1
-/** HT bandwidth 80 MHz */
-#define HT_BW_80 2
+/** Modulation class for HE Rates */
+#define MOD_CLASS_HE 0x0A
 
-/** TLV type : TX RATE CFG, rename from TLV_TYPE_GI_LTF_SIZE to include CMD and
- * HE ER SU settings to this tlv */
-#define TLV_TYPE_TX_RATE_CFG (PROPRIETARY_TLV_BASE_ID + 319) /* 0x023f */
-
-/** TLV type : Scan Response */
-#define TLV_TYPE_BSS_SCAN_RSP (PROPRIETARY_TLV_BASE_ID + 0x56) /* 0x0156 */
-/** TLV type : Scan Response Stats */
-#define TLV_TYPE_BSS_SCAN_INFO (PROPRIETARY_TLV_BASE_ID + 0x57) /* 0x0157 */
-
-/** TLV type : 11h Basic Rpt */
-#define TLV_TYPE_CHANRPT_11H_BASIC                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0x5b) /* 0x015b                             \
-					  */
-
-/** TLV type : ZERO DFS Operation */
-#define TLV_TYPE_ZERO_DFS_OPERATION (PROPRIETARY_TLV_BASE_ID + 0x13b) // + 315
-/** TLV type : DFS W53 Configuration */
-#define TLV_TYPE_DFS_W53_CFG (PROPRIETARY_TLV_BASE_ID + 0x145) // + 325
-#ifdef OPCHAN
-/** TLV type : OpChannel control */
-#define TLV_TYPE_OPCHAN_CONTROL_DESC                                           \
-	(PROPRIETARY_TLV_BASE_ID + 0x79) /* 0x0179 */
-/** TLV type : OpChannel channel group control */
-#define TLV_TYPE_OPCHAN_CHANGRP_CTRL                                           \
-	(PROPRIETARY_TLV_BASE_ID + 0x7a) /* 0x017a */
-#endif
-
-/** TLV type : Action frame */
-#define TLV_TYPE_IEEE_ACTION_FRAME                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0x8c) /* 0x018c                             \
-					  */
-
-/** TLV type : SCAN channel gap */
-#define TLV_TYPE_SCAN_CHANNEL_GAP                                              \
-	(PROPRIETARY_TLV_BASE_ID + 0xc5) /* 0x01c5                             \
-					  */
-/** TLV type : Channel statistics */
-#define TLV_TYPE_CHANNEL_STATS (PROPRIETARY_TLV_BASE_ID + 0xc6) /* 0x01c6 */
-/** TLV type : BSS_MODE */
-#define TLV_TYPE_BSS_MODE (PROPRIETARY_TLV_BASE_ID + 0xce) /* 0x01ce */
+/** HT/VHT/HE bandwidth 20 MHz */
+#define BW_20 0
+/** HT/VHT/HE bandwidth 40 MHz */
+#define BW_40 1
+/** HT/VHT/HE bandwidth 80 MHz */
+#define BW_80 2
 
 /** Firmware Host Command ID Constants */
-/** Host Command ID : Get hardware specifications */
-#define HostCmd_CMD_GET_HW_SPEC 0x0003
-/** Host Command ID : 802.11 scan */
-#define HostCmd_CMD_802_11_SCAN 0x0006
-/** Host Command ID : 802.11 get log */
-#define HostCmd_CMD_802_11_GET_LOG 0x000b
 
-/** Host Command id: GET_TX_RX_PKT_STATS */
-#define HOST_CMD_TX_RX_PKT_STATS 0x008d
-
-/** Host Command ID : 802.11 get/set link layer statistic */
-#define HostCmd_CMD_802_11_LINK_STATS 0x0256
-
-/** Host Command ID : MAC multicast address */
-#define HostCmd_CMD_MAC_MULTICAST_ADR 0x0010
-/** Host Command ID : 802.11 EEPROM access */
-#define HostCmd_CMD_802_11_EEPROM_ACCESS 0x0059
-/** Host Command ID : 802.11 associate */
-#define HostCmd_CMD_802_11_ASSOCIATE 0x0012
-
-/** Host Command ID : 802.11 SNMP MIB */
-#define HostCmd_CMD_802_11_SNMP_MIB 0x0016
-/** Host Command ID : MAC register access */
-#define HostCmd_CMD_MAC_REG_ACCESS 0x0019
-/** Host Command ID : BBP register access */
-#define HostCmd_CMD_BBP_REG_ACCESS 0x001a
-/** Host Command ID : RF register access */
-#define HostCmd_CMD_RF_REG_ACCESS 0x001b
-
-/** Host Command ID : 802.11 radio control */
-#define HostCmd_CMD_802_11_RADIO_CONTROL 0x001c
-/** Host Command ID : 802.11 RF channel */
-#define HostCmd_CMD_802_11_RF_CHANNEL 0x001d
-/** Host Command ID : 802.11 RF Tx power */
-#define HostCmd_CMD_802_11_RF_TX_POWER 0x001e
-
-/** Host Command ID : 802.11 RF antenna */
-#define HostCmd_CMD_802_11_RF_ANTENNA 0x0020
-
-/** Host Command ID : 802.11 deauthenticate */
-#define HostCmd_CMD_802_11_DEAUTHENTICATE 0x0024
-/** Host Command ID: 802.11 disassoicate */
-#define HostCmd_CMD_802_11_DISASSOCIATE 0x0026
-/** Host Command ID : MAC control */
-#define HostCmd_CMD_MAC_CONTROL 0x0028
-/** Host Command ID : 802.11 Ad-Hoc start */
-#define HostCmd_CMD_802_11_AD_HOC_START 0x002b
-/** Host Command ID : 802.11 Ad-Hoc join */
-#define HostCmd_CMD_802_11_AD_HOC_JOIN 0x002c
-
-/** Host Command ID: CW Mode */
-#define HostCmd_CMD_CW_MODE_CTRL 0x0239
-/** Host Command ID : 802.11 key material */
-#define HostCmd_CMD_802_11_KEY_MATERIAL 0x005e
-
-/** Host Command ID : 802.11 Ad-Hoc stop */
-#define HostCmd_CMD_802_11_AD_HOC_STOP 0x0040
-
-/** Host Command ID : 802.22 MAC address */
-#define HostCmd_CMD_802_11_MAC_ADDRESS 0x004D
-
-/** Host Command ID : WMM Traffic Stream Status */
-#define HostCmd_CMD_WMM_TS_STATUS 0x005d
-
-/** Host Command ID : 802.11 D domain information */
-#define HostCmd_CMD_802_11D_DOMAIN_INFO 0x005b
-
-/*This command gets/sets the Transmit Rate-based Power Control (TRPC) channel
- * configuration.*/
-#define HostCmd_CHANNEL_TRPC_CONFIG 0x00fb
-
-/** Host Command ID : 802.11 TPC information */
-#define HostCmd_CMD_802_11_TPC_INFO 0x005f
-/** Host Command ID : 802.11 TPC adapt req */
-#define HostCmd_CMD_802_11_TPC_ADAPT_REQ 0x0060
-/** Host Command ID : 802.11 channel SW ann */
-#define HostCmd_CMD_802_11_CHAN_SW_ANN 0x0061
-
-/** Host Command ID : Measurement request */
-#define HostCmd_CMD_MEASUREMENT_REQUEST 0x0062
-/** Host Command ID : Measurement report */
-#define HostCmd_CMD_MEASUREMENT_REPORT 0x0063
-
-/** Host Command ID : 802.11 sleep parameters */
-#define HostCmd_CMD_802_11_SLEEP_PARAMS 0x0066
-
-/** Host Command ID : 802.11 ps inactivity timeout */
-#define HostCmd_CMD_802_11_PS_INACTIVITY_TIMEOUT 0x0067
-
-/** Host Command ID : 802.11 sleep period */
-#define HostCmd_CMD_802_11_SLEEP_PERIOD 0x0068
-
-/** Host Command ID: 802.11 BG scan config */
-#define HostCmd_CMD_802_11_BG_SCAN_CONFIG 0x006b
-/** Host Command ID : 802.11 BG scan query */
-#define HostCmd_CMD_802_11_BG_SCAN_QUERY 0x006c
-
-/** Host Command ID : WMM ADDTS req */
-#define HostCmd_CMD_WMM_ADDTS_REQ 0x006E
-/** Host Command ID : WMM DELTS req */
-#define HostCmd_CMD_WMM_DELTS_REQ 0x006F
-/** Host Command ID : WMM queue configuration */
-#define HostCmd_CMD_WMM_QUEUE_CONFIG 0x0070
-/** Host Command ID : 802.11 get status */
-#define HostCmd_CMD_WMM_GET_STATUS 0x0071
-
-/** Host Command ID : 802.11 subscribe event */
-#define HostCmd_CMD_802_11_SUBSCRIBE_EVENT 0x0075
-
-/** Host Command ID : 802.11 Tx rate query */
-#define HostCmd_CMD_802_11_TX_RATE_QUERY 0x007f
-/** Host Command ID :Get timestamp value */
-#define HostCmd_CMD_GET_TSF 0x0080
-
-/** Host Command ID : WMM queue stats */
-#define HostCmd_CMD_WMM_QUEUE_STATS 0x0081
-
-/** Host Command ID : KEEP ALIVE command */
-#define HostCmd_CMD_AUTO_TX 0x0082
-
-/** Host Command ID : 802.11 IBSS coalescing status */
-#define HostCmd_CMD_802_11_IBSS_COALESCING_STATUS 0x0083
-
-/** Host Command ID : Memory access */
-#define HostCmd_CMD_MEM_ACCESS 0x0086
-
-#if defined(SDIO)
-/** Host Command ID : SDIO GPIO interrupt configuration */
-#define HostCmd_CMD_SDIO_GPIO_INT_CONFIG 0x0088
-#endif
-
-/** Host Command ID : Mfg command */
-#define HostCmd_CMD_MFG_COMMAND 0x0089
-/** Host Command ID : Inactivity timeout ext */
-#define HostCmd_CMD_INACTIVITY_TIMEOUT_EXT 0x008a
-
-/** Host Command ID : DBGS configuration */
-#define HostCmd_CMD_DBGS_CFG 0x008b
-/** Host Command ID : Get memory */
-#define HostCmd_CMD_GET_MEM 0x008c
-
-/** Host Command ID : Cal data dnld */
-#define HostCmd_CMD_CFG_DATA 0x008f
-
-/** Host Command ID : SDIO pull control */
-#define HostCmd_CMD_SDIO_PULL_CTRL 0x0093
-
-/** Host Command ID : ECL system clock configuration */
-#define HostCmd_CMD_ECL_SYSTEM_CLOCK_CONFIG 0x0094
-
-/** Host Command ID : Extended version */
-#define HostCmd_CMD_VERSION_EXT 0x0097
-
-/** Host Command ID : MEF configuration */
-#define HostCmd_CMD_MEF_CFG 0x009a
-/** Host Command ID : 802.11 RSSI INFO*/
-#define HostCmd_CMD_RSSI_INFO 0x00a4
-/** Host Command ID : Function initialization */
-#define HostCmd_CMD_FUNC_INIT 0x00a9
-/** Host Command ID : Function shutdown */
-#define HostCmd_CMD_FUNC_SHUTDOWN 0x00aa
-
-/** Host Command ID : Robustcoex */
-#define HostCmd_CMD_802_11_ROBUSTCOEX 0x00e0
-
-/** Host Command ID :EAPOL PKT */
-#define HostCmd_CMD_802_11_EAPOL_PKT 0x012e
-
-/** Host Command ID :MIMO SWITCH **/
-#define HostCmd_CMD_802_11_MIMO_SWITCH 0x0235
-
-/** Host Command ID : 802.11 RSSI INFO EXT*/
-#define HostCmd_CMD_RSSI_INFO_EXT 0x0237
-/** Host Command ID : ROAMING OFFLOAD TO FW*/
-#define HostCmd_CMD_ROAM_OFFLOAD 0x0245
-
-/** Host Command ID: Multi chan config */
-#define HostCmd_CMD_MULTI_CHAN_CONFIG 0x011e
-/** Host Command ID: Multi chan policy */
-#define HostCmd_CMD_MULTI_CHAN_POLICY 0x0121
-/** TLV ID for multi chan info */
-#define TLV_TYPE_MULTI_CHAN_INFO (PROPRIETARY_TLV_BASE_ID + 0xb7)
-/** TLV ID for multi chan group info */
-#define TLV_TYPE_MULTI_CHAN_GROUP_INFO_TLV_ID (PROPRIETARY_TLV_BASE_ID + 0xb8)
-/** TLV ID for DRCS TimeSlice */
-#define MRVL_DRCS_TIME_SLICE_TLV_ID (PROPRIETARY_TLV_BASE_ID + 263)
-/** Host Command ID: DRCS config */
-#define HostCmd_CMD_DRCS_CONFIG 0x024a
-
-#define TLV_TYPE_PREV_BSSID (PROPRIETARY_TLV_BASE_ID + 330)
-
-/** Host Command ID : Channel report request */
-#define HostCmd_CMD_CHAN_REPORT_REQUEST 0x00dd
-
-/** Host Command ID: SUPPLICANT_PMK */
-#define HostCmd_CMD_SUPPLICANT_PMK 0x00c4
-/** Host Command ID: SUPPLICANT_PROFILE */
-#define HostCmd_CMD_SUPPLICANT_PROFILE 0x00c5
-
-/** Host Command ID : Add Block Ack Request */
-#define HostCmd_CMD_11N_ADDBA_REQ 0x00ce
-/** Host Command ID : Delete a Block Ack Request */
-#define HostCmd_CMD_11N_CFG 0x00cd
-/** Host Command ID : Add Block Ack Response */
-#define HostCmd_CMD_11N_ADDBA_RSP 0x00cf
-/** Host Command ID : Delete a Block Ack Request */
-#define HostCmd_CMD_11N_DELBA 0x00d0
-/** Host Command ID: Configure Tx Buf size */
-#define HostCmd_CMD_RECONFIGURE_TX_BUFF 0x00d9
-/** Host Command ID: AMSDU Aggr Ctrl */
-#define HostCmd_CMD_AMSDU_AGGR_CTRL 0x00df
-/** Host Command ID: 11AC config */
-#define HostCmd_CMD_11AC_CFG 0x0112
-/** Host Command ID: Configure TX Beamforming capability */
-#define HostCmd_CMD_TX_BF_CFG 0x0104
-
-/** Host Command ID : 802.11 TX power configuration */
-#define HostCmd_CMD_TXPWR_CFG 0x00d1
-
-/** Host Command ID : Soft Reset */
-#define HostCmd_CMD_SOFT_RESET 0x00d5
-
-/** Host Command ID : 802.11 b/g/n rate configration */
-#define HostCmd_CMD_TX_RATE_CFG 0x00d6
-
-/** Host Command ID : Enhanced PS mode */
-#define HostCmd_CMD_802_11_PS_MODE_ENH 0x00e4
-
-/** Host command action : Host sleep configuration */
-#define HostCmd_CMD_802_11_HS_CFG_ENH 0x00e5
-
-/** Host Command ID : CAU register access */
-#define HostCmd_CMD_CAU_REG_ACCESS 0x00ed
-
-/** Host Command ID : mgmt IE list */
-#define HostCmd_CMD_MGMT_IE_LIST 0x00f2
-
-#define HostCmd_CMD_802_11_BAND_STEERING 0x026f
-/*** Host Command ID " MC_AGGR_CFG */
-#define HostCmd_CMD_MC_AGGR_CFG 0x027a
-#define HostCmd_CMD_802_11_STATS 0x0014
-#define HostCmd_CMD_GET_CH_LOAD 0x027b
-
-/** Host Command ID : TDLS configuration */
-#define HostCmd_CMD_TDLS_CONFIG 0x0100
-/** Host Command ID : TDLS operation */
-#define HostCmd_CMD_TDLS_OPERATION 0x0122
+#define ENUM_ELEMENT(name, id) name = id
+#define ENUM_ELEMENT_LAST(name) name
+enum host_cmd_id {
+#include "mlan_hostcmd_ids.h"
+};
+#undef ENUM_ELEMENT
+#undef ENUM_ELEMENT_LAST
 
 #ifdef SDIO
-/** Host Command ID : SDIO single port RX aggr */
-#define HostCmd_CMD_SDIO_SP_RX_AGGR_CFG 0x0223
-
 /** fw_cap_info bit16 for sdio sp rx aggr flag*/
 #define SDIO_SP_RX_AGGR_ENABLE MBIT(16)
 
@@ -1397,12 +894,6 @@
 /** fw_cap_info bit23 for firmware roaming*/
 #define FW_ROAMING_SUPPORT MBIT(23)
 
-/** fw_cap_info bit25 for adhoc support*/
-#define FW_CAPINFO_ADHOC_SUPPORT MBIT(25)
-/** Check if adhoc is supported by firmware */
-#define IS_FW_SUPPORT_ADHOC(_adapter)                                          \
-	(_adapter->fw_cap_info & FW_CAPINFO_ADHOC_SUPPORT)
-
 /** Check if supplicant is supported by firmware */
 #define IS_FW_SUPPORT_SUPPLICANT(_adapter)                                     \
 	(_adapter->fw_cap_info & FW_CAPINFO_SUPPLICANT_SUPPORT)
@@ -1441,6 +932,14 @@
 #define FW_CAPINFO_EXT_CHAN_TRACK MBIT(13)
 /** FW cap info bit 14: 6G Support */
 #define FW_CAPINFO_EXT_6G MBIT(14)
+/** FW cap info bit 16: Tx mgmt pkt with command*/
+#define FW_CAPINFO_EXT_CMD_TX_DATA MBIT(16)
+/** FW cap info bit 19: security rgpower table */
+#define FW_CAPINFO_EXT_SEC_RG_POWER MBIT(19)
+/** FW cap info bit 20: RX_SW_INT */
+#define FW_CAPINFO_EXT_RX_SW_INT MBIT(20)
+/** FW cap info bit 21: EASY_MESH_SUPPORT */
+#define FW_CAPINFO_EASY_MESH MBIT(21)
 
 /** Check if 5G 1x1 only is supported by firmware */
 #define IS_FW_SUPPORT_5G_1X1_ONLY(_adapter)                                    \
@@ -1479,6 +978,20 @@
 	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_CHAN_TRACK)
 /** Check if 6G supported by firmware */
 #define IS_FW_SUPPORT_6G(_adapter) (_adapter->fw_cap_ext & FW_CAPINFO_EXT_6G)
+/** Check if transmit mgmt pkt through command supported by firmware */
+#define IS_FW_SUPPORT_CMD_TX_DATA(_adapter)                                    \
+	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_CMD_TX_DATA)
+/** Check if security rgpower table supported by firmware */
+#define IS_FW_SUPPORT_SEC_RG_POWER(_adapter)                                   \
+	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_SEC_RG_POWER)
+#define IS_FW_SUPPORT_RX_SW_INT(_adapter)                                      \
+	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_RX_SW_INT)
+/** Check if easy mesh supported by firmware */
+#define IS_FW_SUPPORT_EASY_MESH(_adapter)                                      \
+	(_adapter->fw_cap_ext & FW_CAPINFO_EASY_MESH)
+
+#define Tx_PD_SIZEOF(_adapter)                                                 \
+	(IS_FW_SUPPORT_EASY_MESH(_adapter) ? sizeof(TxPD) : (sizeof(TxPD) - 8))
 
 /** MrvlIEtypes_PrevBssid_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_PrevBssid_t {
@@ -1512,7 +1025,7 @@
 	/** Element id extension */
 	t_u8 ext_id;
 	/** payload */
-	t_u8 data[1];
+	t_u8 data[];
 } MLAN_PACK_END MrvlIEtypes_Extension_t, *pMrvlIEtypes_Extension_t;
 
 /* HE MAC Capabilities Information field BIT 1 for TWT Req */
@@ -1570,119 +1083,10 @@
 #define IS_FW_SUPPORT_EMBEDDED_OWE(_adapter)                                   \
 	(_adapter->fw_cap_info & FW_CAPINFO_EMBEDDED_OWE_SUPPORT)
 
-/** Host Command ID : Extended scan support */
-#define HostCmd_CMD_802_11_SCAN_EXT 0x0107
-
-/** Host Command ID : Forward mgmt frame */
-#define HostCmd_CMD_RX_MGMT_IND 0x010c
-
-#ifdef PCIE
-/** Host Command ID: Host buffer description */
-#define HostCmd_CMD_PCIE_HOST_BUF_DETAILS 0x00fa
-#endif
-
-/** Host Command ID : Set BSS_MODE */
-#define HostCmd_CMD_SET_BSS_MODE 0x00f7
-
-#ifdef UAP_SUPPORT
-/**  Host Command id: SYS_INFO */
-#define HOST_CMD_APCMD_SYS_INFO 0x00ae
-/** Host Command id: sys_reset */
-#define HOST_CMD_APCMD_SYS_RESET 0x00af
-/** Host Command id: SYS_CONFIGURE  */
-#define HOST_CMD_APCMD_SYS_CONFIGURE 0x00b0
-/** Host Command id: BSS_START */
-#define HOST_CMD_APCMD_BSS_START 0x00b1
-/** Host Command id: BSS_STOP  */
-#define HOST_CMD_APCMD_BSS_STOP 0x00b2
-/** Host Command id: sta_list */
-#define HOST_CMD_APCMD_STA_LIST 0x00b3
-/** Host Command id: STA_DEAUTH */
-#define HOST_CMD_APCMD_STA_DEAUTH 0x00b5
-
-/** Host Command id: REPORT_MIC */
-#define HOST_CMD_APCMD_REPORT_MIC 0x00ee
-/** Host Command id: UAP_OPER_CTRL */
-#define HOST_CMD_APCMD_OPER_CTRL 0x0233
-#endif /* UAP_SUPPORT */
-
-/** Host Command id: PMIC CONFIGURE*/
-#define HOST_CMD_PMIC_CONFIGURE 0x23E
-
-/** Host Command ID: 802.11 Network Monitor */
-#define HostCmd_CMD_802_11_NET_MONITOR 0x0102
-
-/** Host Command ID: Tx data pause */
-#define HostCmd_CMD_CFG_TX_DATA_PAUSE 0x0103
-
-#ifdef WIFI_DIRECT_SUPPORT
-/** Host Command ID: P2P PARAMS CONFIG */
-#define HOST_CMD_P2P_PARAMS_CONFIG 0x00ea
-/** Host Command ID: WIFI_DIRECT_MODE_CONFIG */
-#define HOST_CMD_WIFI_DIRECT_MODE_CONFIG 0x00eb
-#endif
-
-/** Host Command ID: GPIO TSF LATCH */
-#define HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG 0x0278
-/** Host Command ID: Remain On Channel */
-#define HostCmd_CMD_802_11_REMAIN_ON_CHANNEL 0x010d
-
-#define HostCmd_CMD_COALESCE_CFG 0x010a
-
-/** Host Command ID: GTK REKEY OFFLOAD CFG */
-#define HostCmd_CMD_GTK_REKEY_OFFLOAD_CFG 0x010f
-
-/** Host Command ID : OTP user data */
-#define HostCmd_CMD_OTP_READ_USER_DATA 0x0114
-
-/** Host Command ID: fw auto reconnect */
-#define HostCmd_CMD_FW_AUTO_RECONNECT 0x0115
-
-/** Host Command ID: HS wakeup reason */
-#define HostCmd_CMD_HS_WAKEUP_REASON 0x0116
-
-/** Host Command ID: reject addba request */
-#define HostCmd_CMD_REJECT_ADDBA_REQ 0x0119
-
-#define HostCmd_CMD_FW_DUMP_EVENT 0x0125
-
-#define HostCMD_CONFIG_LOW_POWER_MODE 0x0128
-
-/** Host Command ID : Target device access */
-#define HostCmd_CMD_TARGET_ACCESS 0x012a
-
-/** Host Command ID: BCA device access */
-#define HostCmd_CMD_BCA_REG_ACCESS 0x0272
-/** Host Command ID: register device access */
-#define HostCmd_CMD_REG_ACCESS 0x027C
-
-/** Host Command ID: DFS repeater mode */
-#define HostCmd_DFS_REPEATER_MODE 0x012b
-
-/** Host Command ID: ACS scan */
-#define HostCMD_APCMD_ACS_SCAN 0x0224
-
-/** Host Command ID: Get sensor temp*/
-#define HostCmd_DS_GET_SENSOR_TEMP 0x0227
-
-/** Host Command ID : Configure ADHOC_OVER_IP parameters */
-#define HostCmd_CMD_WMM_PARAM_CONFIG 0x023a
-
-#define HostCmd_CMD_IPV6_RA_OFFLOAD_CFG 0x0238
-
-#ifdef STA_SUPPORT
-/** Host Command ID :  set/get sta configure */
-#define HostCmd_CMD_STA_CONFIGURE 0x023f
-#endif
-
-/** Host Command ID : GPIO independent reset configure */
-#define HostCmd_CMD_INDEPENDENT_RESET_CFG 0x0243
-
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
-/* TLV type: reg type */
-#define TLV_TYPE_REG_ACCESS_CTRL (PROPRIETARY_TLV_BASE_ID + 0x13C) /* 0x023c*/
+#if defined(PCIE9098) || defined(SDAW693) || defined(SD9098) ||                \
+	defined(USB9098) || defined(PCIE9097) || defined(USB9097) ||           \
+	defined(SDIW624) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 /** MrvlIEtypes_Reg_type_t*/
 typedef MLAN_PACK_START struct _MrvlIEtypes_Reg_type_t {
 	/** Header */
@@ -1691,10 +1095,6 @@
 	t_u8 type;
 } MLAN_PACK_END MrvlIEtypes_Reg_type_t;
 #endif
-/** use to query chan region cfg setting in firmware */
-#define HostCmd_CMD_CHAN_REGION_CFG 0x0242
-/** used in hostcmd to download region power cfg setting to firmware */
-#define HostCmd_CMD_REGION_POWER_CFG 0x0249
 
 /* mod_grp */
 typedef enum _mod_grp {
@@ -1746,44 +1146,15 @@
 #define FW_CFP_TABLE_MAX_ROWS_A 39
 #define FW_CFP_TABLE_MAX_COLS_A 29
 
-#define HostCmd_CMD_DYN_BW 0x0252
+#define HostCmd_ACT_RTT_GET_RSP_INFO 0x0000
+#define HostCmd_ACT_RTT_SET_RSP_EN 0x0001
+#define HostCmd_ACT_RTT_SET_RSP_DIS 0x0002
+#define HostCmd_ACT_RTT_SET_RSP_LCI 0x0003
+#define HostCmd_ACT_RTT_SET_RSP_LCR 0x0004
 
-#define HostCmd_CMD_BOOT_SLEEP 0x0258
-
-#define HostCmd_CMD_RX_ABORT_CFG 0x0261
-#define HostCmd_CMD_RX_ABORT_CFG_EXT 0x0262
-#define HostCmd_CMD_TX_AMPDU_PROT_MODE 0x0263
-#define HostCmd_CMD_RATE_ADAPT_CFG 0x0264
-#define HostCmd_CMD_CCK_DESENSE_CFG 0x0265
-
-#define HostCmd_CMD_VDLL 0x0240
-#if defined(PCIE)
-#define HostCmd_CMD_SSU 0x0259
-#endif
-#define HostCmd_CMD_CSI 0x025b
 #define CSI_CMD_ENABLE 0x0001
 #define CSI_CMD_DISABLE 0x0002
 
-#define HostCmd_CMD_DMCS_CONFIG 0x0260
-
-/** Host Command ID: 11AX config */
-#define HostCmd_CMD_11AX_CFG 0x0266
-/** Host Command ID: 11AX command */
-#define HostCmd_CMD_11AX_CMD 0x026d
-/** Host Command ID: Range ext command */
-#define HostCmd_CMD_RANGE_EXT 0x0274
-/** Host Command ID: TWT cfg command */
-#define HostCmd_CMD_TWT_CFG 0x0270
-
-#define HostCmd_CMD_LOW_POWER_MODE_CFG 0x026e
-#define HostCmd_CMD_UAP_BEACON_STUCK_CFG 0x0271
-#define HostCmd_CMD_ARB_CONFIG 0x0273
-#define HostCmd_CMD_DOT11MC_UNASSOC_FTM_CFG 0x0275
-#define HostCmd_CMD_HAL_PHY_CFG 0x0276
-
-/** Host Command ID : IPS Config */
-#define HostCmd_CMD_IPS_CONFIG 0x0279
-
 typedef MLAN_PACK_START struct {
 	t_u32 enable;
 } MLAN_PACK_END HostCmd_DS_IPS_CONFIG;
@@ -1792,6 +1163,7 @@
 typedef enum _ENH_PS_MODES {
 	GET_PS = 0,
 	SLEEP_CONFIRM = 5,
+	EXT_PS_PARAM = 6,
 	DIS_AUTO_PS = 0xfe,
 	EN_AUTO_PS = 0xff,
 } ENH_PS_MODES;
@@ -1799,10 +1171,17 @@
 /** Command RET code, MSB is set to 1 */
 #define HostCmd_RET_BIT 0x8000
 
+/** Special purpose action : Set */
+#define HostCmd_ACT_SPC_AUTO_SET 0x8002
+/** Special purpose action : Set */
+#define HostCmd_ACT_SPC_AUTO_NOSET 0x8003
+
 /** General purpose action : Get */
 #define HostCmd_ACT_GEN_GET 0x0000
 /** General purpose action : Set */
 #define HostCmd_ACT_GEN_SET 0x0001
+/** Special purpose action : Set */
+#define HostCmd_ACT_SPC_SET 0x8001
 /** General purpose action : Set Default */
 #define HostCmd_ACT_GEN_SET_DEFAULT 0x0002
 /** General purpose action : Get_Current */
@@ -1838,6 +1217,14 @@
 #define HostCmd_RESULT_BUSY 0x0004
 /** Data buffer is not big enough */
 #define HostCmd_RESULT_PARTIAL_DATA 0x0005
+/** cmd is blocked by cmd_filter */
+#define HostCmd_RESULT_BLOCK 0x0006
+/** cmd is blocked by pre_asleep */
+#define HostCmd_RESULT_PRE_ASLEEP 0x0007
+/** rgpower_XX.bin download failed with security key mismatch */
+#define HostCmd_RESULT_RGPWR_KEY_MISMATCH 0x0008
+/** rgpower_XX.bin download failed with security key mismatch edmac/rutable */
+#define HostCmd_RESULT_EDMAC_RUTABLE_KEY_MISMATCH 0x0009
 
 /* Define action or option for HostCmd_CMD_MAC_CONTROL */
 /** MAC action : Rx on */
@@ -1858,8 +1245,6 @@
 #define HostCmd_ACT_MAC_STRICT_PROTECTION_ENABLE 0x0400
 /** MAC action : Force 11n protection disable */
 #define HostCmd_ACT_MAC_FORCE_11N_PROTECTION_OFF 0x0800
-/** MAC action : Ad-Hoc G protection on */
-#define HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON 0x2000
 /** MAC action : Static-Dynamic BW enable */
 #define HostCmd_ACT_MAC_STATIC_DYNAMIC_BW_ENABLE MBIT(16)
 /** MAC action : Dynamic BW */
@@ -1868,8 +1253,6 @@
 /* Define action or option for HostCmd_CMD_802_11_SCAN */
 /** Scan type : BSS */
 #define HostCmd_BSS_MODE_BSS 0x0001
-/** Scan type : IBSS */
-#define HostCmd_BSS_MODE_IBSS 0x0002
 /** Scan type : Any */
 #define HostCmd_BSS_MODE_ANY 0x0003
 
@@ -1916,191 +1299,29 @@
 /** Get BSS type from Host Command (bit 15:12) */
 #define HostCmd_GET_BSS_TYPE(seq) (((seq)&HostCmd_BSS_TYPE_MASK) >> 12)
 
-/* EVENT ID*/
-/** Card Event definition : Dummy host wakeup signal */
-#define EVENT_DUMMY_HOST_WAKEUP_SIGNAL 0x00000001
-/** Card Event definition : Link lost */
-#define EVENT_LINK_LOST 0x00000003
-/** Card Event definition : Link sensed */
-#define EVENT_LINK_SENSED 0x00000004
-/** Card Event definition : MIB changed */
-#define EVENT_MIB_CHANGED 0x00000006
-/** Card Event definition : Init done */
-#define EVENT_INIT_DONE 0x00000007
-/** Card Event definition : Deauthenticated */
-#define EVENT_DEAUTHENTICATED 0x00000008
-/** Card Event definition : Disassociated */
-#define EVENT_DISASSOCIATED 0x00000009
-/** Card Event definition : Power save awake */
-#define EVENT_PS_AWAKE 0x0000000a
-/** Card Event definition : Power save sleep */
-#define EVENT_PS_SLEEP 0x0000000b
-/** Card Event definition : MIC error multicast */
-#define EVENT_MIC_ERR_MULTICAST 0x0000000d
-/** Card Event definition : MIC error unicast */
-#define EVENT_MIC_ERR_UNICAST 0x0000000e
+/* EVENT ID */
 
-/** Card Event definition : Ad-Hoc BCN lost */
-#define EVENT_ADHOC_BCN_LOST 0x00000011
+#define ENUM_ELEMENT(name, id) name = id
+#define ENUM_ELEMENT_LAST(name) name
+enum host_fw_event_id {
+#include "mlan_event_ids.h"
+};
+#undef ENUM_ELEMENT
+#undef ENUM_ELEMENT_LAST
 
-/** Card Event definition : Stop Tx */
-#define EVENT_STOP_TX 0x00000013
-/** Card Event definition : Start Tx */
-#define EVENT_START_TX 0x00000014
-/** Card Event definition : Channel switch */
-#define EVENT_CHANNEL_SWITCH 0x00000015
+enum nan_event_subtype {
+	NAN_EVT_SUBTYPE_SD_EVENT = 0,
+	NAN_EVT_SUBTYPE_NAN_STARTED = 1,
+	NAN_EVT_SUBTYPE_SDF_TX_DONE = 2,
+};
 
-/** Card Event definition : MEAS report ready */
-#define EVENT_MEAS_REPORT_RDY 0x00000016
-
-/** Card Event definition : WMM status change */
-#define EVENT_WMM_STATUS_CHANGE 0x00000017
-
-/** Card Event definition : BG scan report */
-#define EVENT_BG_SCAN_REPORT 0x00000018
-/** Card Event definition : BG scan stopped */
-#define EVENT_BG_SCAN_STOPPED 0x00000065
-
-/** Card Event definition : Beacon RSSI low */
-#define EVENT_RSSI_LOW 0x00000019
-/** Card Event definition : Beacon SNR low */
-#define EVENT_SNR_LOW 0x0000001a
-/** Card Event definition : Maximum fail */
-#define EVENT_MAX_FAIL 0x0000001b
-/** Card Event definition : Beacon RSSI high */
-#define EVENT_RSSI_HIGH 0x0000001c
-/** Card Event definition : Beacon SNR high */
-#define EVENT_SNR_HIGH 0x0000001d
-
-/** Card Event definition : IBSS coalsced */
-#define EVENT_IBSS_COALESCED 0x0000001e
-
-/** Event definition : IBSS station connected */
-#define EVENT_IBSS_STATION_CONNECT 0x00000020
-/** Event definition : IBSS station dis-connected */
-#define EVENT_IBSS_STATION_DISCONNECT 0x00000021
-
-/** Card Event definition : Data RSSI low */
-#define EVENT_DATA_RSSI_LOW 0x00000024
-/** Card Event definition : Data SNR low */
-#define EVENT_DATA_SNR_LOW 0x00000025
-/** Card Event definition : Data RSSI high */
-#define EVENT_DATA_RSSI_HIGH 0x00000026
-/** Card Event definition : Data SNR high */
-#define EVENT_DATA_SNR_HIGH 0x00000027
-
-/** Card Event definition : Link Quality */
-#define EVENT_LINK_QUALITY 0x00000028
-
-/** Card Event definition : Port release event */
-#define EVENT_PORT_RELEASE 0x0000002b
-
-#ifdef UAP_SUPPORT
-/** Event ID: STA deauth */
-#define EVENT_MICRO_AP_STA_DEAUTH 0x0000002c
-/** Event ID: STA assoicated */
-#define EVENT_MICRO_AP_STA_ASSOC 0x0000002d
-/** Event ID: BSS started */
-#define EVENT_MICRO_AP_BSS_START 0x0000002e
-/** Event ID: BSS idle event */
-#define EVENT_MICRO_AP_BSS_IDLE 0x00000043
-/** Event ID: BSS active event */
-#define EVENT_MICRO_AP_BSS_ACTIVE 0x00000044
-
-/** Event ID: MIC countermeasures event */
-#define EVENT_MICRO_AP_MIC_COUNTERMEASURES 0x0000004c
-#endif /* UAP_SUPPORT */
-
-/** Card Event definition : Pre-Beacon Lost */
-#define EVENT_PRE_BEACON_LOST 0x00000031
-
-#define EVENT_WATCHDOG_TMOUT 0x00000032
-
-/** Card Event definition : Add BA event */
-#define EVENT_ADDBA 0x00000033
-/** Card Event definition : Del BA event */
-#define EVENT_DELBA 0x00000034
-/** Card Event definition: BA stream timeout*/
-#define EVENT_BA_STREAM_TIMEOUT 0x00000037
-
-/** Card Event definition : AMSDU aggr control */
-#define EVENT_AMSDU_AGGR_CTRL 0x00000042
-
-/** Card Event definition: WEP ICV error */
-#define EVENT_WEP_ICV_ERR 0x00000046
-
-/** Card Event definition : Host sleep enable */
-#define EVENT_HS_ACT_REQ 0x00000047
-
-/** Card Event definition : BW changed */
-#define EVENT_BW_CHANGE 0x00000048
-
-#ifdef WIFI_DIRECT_SUPPORT
-/** WIFIDIRECT generic event */
-#define EVENT_WIFIDIRECT_GENERIC_EVENT 0x00000049
-/** WIFIDIRECT service discovery event */
-#define EVENT_WIFIDIRECT_SERVICE_DISCOVERY 0x0000004a
-#endif
-/** Remain on Channel expired event */
-#define EVENT_REMAIN_ON_CHANNEL_EXPIRED 0x0000005f
-
-/** TDLS generic event */
-#define EVENT_TDLS_GENERIC_EVENT 0x00000052
-
-#define EVENT_MEF_HOST_WAKEUP 0x0000004f
-
-/** Card Event definition: Channel switch pending announcment */
-#define EVENT_CHANNEL_SWITCH_ANN 0x00000050
-
-/** Event definition:  Radar Detected by card */
-#define EVENT_RADAR_DETECTED 0x00000053
-
-/** Event definition:  Radar Detected by card */
-#define EVENT_CHANNEL_REPORT_RDY 0x00000054
-
-/** Event definition:  Scan results through event */
-#define EVENT_EXT_SCAN_REPORT 0x00000058
-/** Enhance ext scan done event */
-#define EVENT_EXT_SCAN_STATUS_REPORT 0x0000007f
-
-/** Event definition: RXBA_SYNC */
-#define EVENT_RXBA_SYNC 0x00000059
-
-/** Event ID: TX data pause event */
-#define EVENT_TX_DATA_PAUSE 0x00000055
-
-/** Event definition : FW debug information */
-#define EVENT_FW_DEBUG_INFO 0x00000063
-
-/** Event ID: SAD Report */
-#define EVENT_SAD_REPORT 0x00000066
-
-/** Event ID: Multi Chan Info*/
-#define EVENT_MULTI_CHAN_INFO 0x0000006a
-
-#define EVENT_FW_DUMP_INFO 0x00000073
-/** Event ID: Tx status */
-#define EVENT_TX_STATUS_REPORT 0x00000074
-
-#define EVENT_BT_COEX_WLAN_PARA_CHANGE 0x00000076
-
-#define EVENT_VDLL_IND 0x00000081
-
-#define EVENT_ROAM_OFFLOAD 0x00000083
-
-#define EVENT_EXCEED_MAX_P2P_CONN 0x00000089
-
-#if defined(PCIE)
-#define EVENT_SSU_DUMP_DMA 0x0000008C
-#endif
-
-#define EVENT_CSI 0x0000008D
-#define EVENT_FW_HANG_REPORT 0x0000008F
-/** Card Event definition : RESET PN */
-
-#define EVENT_ASSOC_REQ_IE 0x00000095
-
-#define CHAN_LOAD_EVENT 0x00000099
+enum wls_event_subtype {
+	WLS_SUB_EVENT_FTM_COMPLETE = 0,
+	WLS_SUB_EVENT_RADIO_RECEIVED = 1,
+	WLS_SUB_EVENT_RADIO_RPT_RECEIVED = 2,
+	WLS_SUB_EVENT_ANQP_RESP_RECEIVED = 3,
+	WLS_SUB_EVENT_RTT_RESULTS = 4,
+};
 
 /** Event ID mask */
 #define EVENT_ID_MASK 0xffff
@@ -2140,6 +1361,8 @@
 /** TDLS off channel */
 #define TDLS_OFF_CHANNEL 1
 
+#define RXPD_FLAG_PKT_EASYMESH MBIT(4)
+
 /** structure for channel switch result from TDLS FW */
 typedef MLAN_PACK_START struct _chan_switch_result {
 	/** current channel, 0 - base channel, 1 - off channel*/
@@ -2154,7 +1377,7 @@
 	/** IE Length */
 	t_u16 ie_length;
 	/** IE pointer */
-	t_u8 ie_ptr[1];
+	t_u8 ie_ptr[];
 } MLAN_PACK_END tdls_ie_data;
 
 /** Event structure for generic events from TDLS FW */
@@ -2184,6 +1407,12 @@
 	TDLS_PEER_STA_UNREACHABLE = 25,
 } tdls_error_code_e;
 
+/** Event structure for generic events from NAN FW */
+typedef MLAN_PACK_START struct _event_nan_generic {
+	/** NAN Event SubType */
+	t_u16 event_sub_type;
+} MLAN_PACK_END event_nan_generic;
+
 #define RXPD_FLAG_EXTRA_HEADER (1 << 1)
 
 #define RXPD_FLAG_UCAST_PKT (1 << 3)
@@ -2219,7 +1448,7 @@
 	/** Length */
 	t_u8 length;
 	/** IE data */
-	t_u8 data[1];
+	t_u8 data[];
 } MLAN_PACK_END WLAN_802_11_VARIABLE_IEs;
 
 /** TLV related data structures*/
@@ -2257,6 +1486,9 @@
 /** Bit mask for TxPD flags field for Tx status report */
 #define MRVDRV_TxPD_FLAGS_TX_PACKET_STATUS MBIT(5)
 
+/** Bit mask for TxPD flags field for EASYMESH */
+#define MRVDRV_TxPD_FLAGS_EASYMESH MBIT(7)
+
 /** Packet type: 802.11 */
 #define PKT_TYPE_802DOT11 0x05
 
@@ -2275,6 +1507,8 @@
 #define RXPD_CHAN_MASK 0x3FE0
 /** Rate control mask  15-23 */
 #define TXPD_RATE_MASK 0xff8000
+/** DCM at bit 16 */
+#define RXPD_DCM_MASK 0x10000
 /** enable bw ctrl in TxPD */
 #define TXPD_BW_ENABLE MBIT(20)
 /** enable tx power ctrl in TxPD */
@@ -2289,8 +1523,12 @@
 /** tx_control*/
 #ifdef BIG_ENDIAN_SUPPORT
 typedef MLAN_PACK_START struct _tx_ctrl {
+	/** this is not used in driver as of now, fw uses this bit */
+	t_u32 tx_via_cmd : 1;
+	/** llde packet filter */
+	t_u32 llde_pkt_filter : 1;
 	/** reserved */
-	t_u32 reserved : 3;
+	t_u32 reserved : 1;
 	/** mc retry packet */
 	t_u32 mc_pkt_retry : 1;
 	/** end of mc AMPDU */
@@ -2357,7 +1595,11 @@
 	/** mc retry packet */
 	t_u32 mc_pkt_retry : 1;
 	/** reserved */
-	t_u32 reserved : 3;
+	t_u32 reserved : 1;
+	/** llde packet filter */
+	t_u32 llde_pkt_filter : 1;
+	/** this is not used in driver as of now, fw uses this bit */
+	t_u32 tx_via_cmd : 1;
 } MLAN_PACK_END tx_ctrl;
 #endif
 
@@ -2394,6 +1636,9 @@
 	t_u8 reserved;
 	/** Tx Control */
 	t_u32 tx_control_1;
+	/** ra mac address */
+	t_u8 ra_mac[6];
+	t_u8 reserved3[2];
 } MLAN_PACK_END TxPD, *PTxPD;
 
 /** RxPD Descriptor */
@@ -2438,9 +1683,14 @@
 	t_u32 rx_info;
 
 	/** Reserved */
-	t_u8 reserved3[8];
+	t_u8 reserved3[7];
+	t_u8 rx_pkt_flags;
+	t_u8 ta_mac[6];
+	t_u8 reserved4[2];
 } MLAN_PACK_END RxPD, *PRxPD;
 
+#define RX_PKT_FLAG_MEF_MATCH_PKT MBIT(0)
+
 /** IEEEtypes_FrameCtl_t*/
 #ifdef BIG_ENDIAN_SUPPORT
 typedef MLAN_PACK_START struct _IEEEtypes_FrameCtl_t {
@@ -2604,8 +1854,8 @@
 /** ChanScanMode_t */
 typedef MLAN_PACK_START struct _ChanScanMode_t {
 #ifdef BIG_ENDIAN_SUPPORT
-	/** Reserved */
-	t_u8 reserved_7 : 1;
+	/** rnr_flag, host use only */
+	t_u8 rnr_flag : 1;
 	/** First passive scan then active scan */
 	t_u8 passive_to_active_scan : 1;
 	/** First channel in scan */
@@ -2635,8 +1885,8 @@
 	t_u8 first_chan : 1;
 	/** First passive scan then active scan */
 	t_u8 passive_to_active_scan : 1;
-	/** Reserved */
-	t_u8 reserved_7 : 1;
+	/** rnr_flag, host use only */
+	t_u8 rnr_flag : 1;
 #endif
 } MLAN_PACK_END ChanScanMode_t;
 
@@ -2659,7 +1909,7 @@
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** Channel scan parameters */
-	ChanScanParamSet_t chan_scan_param[1];
+	ChanScanParamSet_t chan_scan_param[];
 } MLAN_PACK_END MrvlIEtypes_ChanListParamSet_t;
 
 /** MrvlIEtypes_EESParamSet_t */
@@ -2709,7 +1959,7 @@
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** Channel Band parameters */
-	ChanBandParamSet_t chan_band_param[1];
+	ChanBandParamSet_t chan_band_param[];
 } MLAN_PACK_END MrvlIEtypes_ChanBandListParamSet_t;
 
 /** MrvlIEtypes_RatesParamSet_t */
@@ -2717,7 +1967,7 @@
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** Rates */
-	t_u8 rates[1];
+	t_u8 rates[];
 } MLAN_PACK_END MrvlIEtypes_RatesParamSet_t;
 
 /** _MrvlIEtypes_Bssid_List_t */
@@ -2733,7 +1983,7 @@
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** SSID */
-	t_u8 ssid[1];
+	t_u8 ssid[];
 } MLAN_PACK_END MrvlIEtypes_SsIdParamSet_t;
 
 /**MrvlIEtypes_AssocType_t */
@@ -2744,6 +1994,14 @@
 	t_u8 host_mlme;
 } MLAN_PACK_END MrvlIEtypes_HostMlme_t;
 
+/** MrvlIEtypes_MultiAp_t */
+typedef MLAN_PACK_START struct _MrvlIEtypes_MultiAp_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Multi AP flag */
+	t_u8 flag;
+} MLAN_PACK_END MrvlIEtypes_MultiAp_t;
+
 /** MrvlIEtypes_NumProbes_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_NumProbes_t {
 	/** Header */
@@ -2759,7 +2017,7 @@
 	/** Maximum SSID length */
 	t_u8 max_ssid_length;
 	/** SSID */
-	t_u8 ssid[1];
+	t_u8 ssid[];
 } MLAN_PACK_END MrvlIEtypes_WildCardSsIdParamSet_t;
 
 /**TSF data size */
@@ -2770,7 +2028,7 @@
 	MrvlIEtypesHeader_t header;
 	/** the length of each TSF data is 8 bytes, could be multiple TSF here
 	 */
-	t_u8 tsf_data[1];
+	t_u8 tsf_data[];
 } MLAN_PACK_END MrvlIEtypes_TsfTimestamp_t;
 
 /** CfParamSet_t */
@@ -2785,12 +2043,6 @@
 	t_u16 cfp_duration_remaining;
 } MLAN_PACK_END CfParamSet_t;
 
-/** IbssParamSet_t */
-typedef MLAN_PACK_START struct _IbssParamSet_t {
-	/** ATIM window value */
-	t_u16 atim_window;
-} MLAN_PACK_END IbssParamSet_t;
-
 /** MrvlIEtypes_SsParamSet_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_SsParamSet_t {
 	/** Header */
@@ -2799,8 +2051,6 @@
 	union {
 		/** CF parameter set */
 		CfParamSet_t cf_param_set[1];
-		/** IBSS parameter set */
-		IbssParamSet_t ibss_param_set[1];
 	} cf_ibss;
 } MLAN_PACK_END MrvlIEtypes_SsParamSet_t;
 
@@ -2905,7 +2155,7 @@
 	/** bitmap len */
 	t_u16 bitmap_len;
 	/** bitmap */
-	t_u8 bitmap[1];
+	t_u8 bitmap[];
 } MLAN_PACK_END MrvlIEtypes_RxBaSync_t;
 
 /** MrvlIEtypes_RsnParamSet_t */
@@ -3063,6 +2313,7 @@
 		wapi_param wapi;
 		/** IGTK key param */
 		cmac_aes_param cmac_aes;
+		gmac_aes_256_param gmac_aes;
 		/** gcmp key param */
 		gcmp_param gcmp;
 		/** ccmp 256 key parameters */
@@ -3217,7 +2468,7 @@
 	/** channel number */
 	t_u8 chan_num;
 	/** mode groups */
-	mod_group_setting mod_group[1];
+	mod_group_setting mod_group[];
 } MLAN_PACK_END MrvlIETypes_ChanTRPCConfig_t;
 
 /* HostCmd_DS_CHANNEL_TRPC_CONFIG */
@@ -3263,6 +2514,16 @@
 	t_u32 ipv4_addr;
 } MLAN_PACK_END filter_entry;
 
+#define NUM_EVT_MASK_BITMAP 10
+typedef struct _HostCmd_DS_EVENT_MASK_CFG {
+	/** Get / Set action*/
+	t_u8 action;
+	/** feature enabled or disabled */
+	t_u8 enabled;
+	/** Bit map of the masked events. 1 - masked, 0 - allowed */
+	t_u32 events_bitmap[NUM_EVT_MASK_BITMAP];
+} MLAN_PACK_END HostCmd_DS_EVENT_MASK_CFG;
+
 typedef MLAN_PACK_START struct _HostCmd_DS_MEF_CFG {
 	/** Criteria */
 	t_u32 criteria;
@@ -3350,8 +2611,7 @@
 	t_u16 bcn_miss_timeout;
 	/** local listen interval */
 	t_u16 local_listen_interval;
-	/** Adhoc awake period */
-	t_u16 adhoc_wake_period;
+	t_u16 rsrvd;
 	/** mode - (0x01 - firmware to automatically choose PS_POLL or NULL
 	 * mode, 0x02 - PS_POLL, 0x03 - NULL mode )
 	 */
@@ -3373,6 +2633,24 @@
 	t_u16 resp_ctrl;
 } MLAN_PACK_END sleep_confirm_param;
 
+/* bit define for pre_asleep*/
+#define BLOCK_CMD_IN_PRE_ASLEEP MBIT(0)
+/** MrvlIEtypes_ext_ps_param_t */
+typedef MLAN_PACK_START struct _MrvlIEtypes_ext_ps_param_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** mode: bit0:BLOCK_CMD_IN_PRE_ASLEEP */
+	t_u32 mode;
+} MLAN_PACK_END MrvlIEtypes_ext_ps_param_t;
+
+/** ext_ps_param_t */
+typedef MLAN_PACK_START struct _ext_ps_param {
+	/** reserved */
+	t_u16 reserved;
+	/** ext_ps_param tlv */
+	MrvlIEtypes_ext_ps_param_t param;
+} MLAN_PACK_END ext_ps_param;
+
 /** bitmap for get auto deepsleep */
 #define BITMAP_AUTO_DS 0x01
 /** bitmap for sta power save */
@@ -3383,6 +2661,7 @@
 #define BITMAP_UAP_INACT_PS 0x100
 /** bitmap for uap DTIM PS */
 #define BITMAP_UAP_DTIM_PS 0x200
+
 /** Structure definition for the new ieee power save parameters*/
 typedef MLAN_PACK_START struct _auto_ps_param {
 	/** bitmap for enable power save mode */
@@ -3396,13 +2675,6 @@
 /** fix size for auto ps */
 #define AUTO_PS_FIX_SIZE 4
 
-/** TLV type : auto ds param */
-#define TLV_TYPE_AUTO_DS_PARAM (PROPRIETARY_TLV_BASE_ID + 0x71) /* 0x0171 */
-/** TLV type : ps param */
-#define TLV_TYPE_PS_PARAM (PROPRIETARY_TLV_BASE_ID + 0x72) /* 0x0172 */
-/** TLV type : beacon timeout */
-#define TLV_TYPE_BCN_TIMEOUT (PROPRIETARY_TLV_BASE_ID + 0x11F) /* 0x011F */
-
 /** MrvlIEtypes_auto_ds_param_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_auto_ds_param_t {
 	/** Header */
@@ -3464,12 +2736,11 @@
 		t_u16 ps_bitmap;
 		/** auto ps param */
 		auto_ps_param auto_ps;
+		/** ext ps param */
+		ext_ps_param ext_param;
 	} params;
 } MLAN_PACK_END HostCmd_DS_802_11_PS_MODE_ENH;
 
-/** FW VERSION tlv */
-#define TLV_TYPE_FW_VER_INFO (PROPRIETARY_TLV_BASE_ID + 0xC7) /* 0x1C7 */
-
 /** MrvlIEtypes_fw_ver_info_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_fw_ver_info_t {
 	/** Header */
@@ -3513,8 +2784,8 @@
 	t_u16 hw_if_version;
 	/** HW version number */
 	t_u16 version;
-	/** Reserved field */
-	t_u16 reserved;
+	/** country code from OTP */
+	t_u16 fw_country_code;
 	/** Max no of Multicast address  */
 	t_u16 num_of_mcast_adr;
 	/** MAC address */
@@ -3525,8 +2796,8 @@
 	t_u16 number_of_antenna;
 	/** FW release number, example 0x1234=1.2.3.4 */
 	t_u32 fw_release_number;
-	/** Reserved field */
-	t_u32 reserved_1;
+	/** hw dev cap */
+	t_u32 hw_dev_cap;
 	/** Reserved field */
 	t_u32 reserved_2;
 	/** Reserved field */
@@ -3585,9 +2856,6 @@
 	t_u8 *tlv_buf[];
 } MLAN_PACK_END HostCmd_DS_802_11_RSSI_INFO_EXT;
 
-/** TLV rssi info */
-#define TLV_TYPE_RSSI_INFO (PROPRIETARY_TLV_BASE_ID + 0xe5) /* 0x01E5 */
-
 /** MrvlIEtypes_eapol_pkt_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_RSSI_EXT_t {
 	/** Header */
@@ -3627,13 +2895,15 @@
 	 * bit 0 MC aggregation
 	 * bit 1 packet expiry
 	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
+	 * bit 3 CTS2Self duration offset
+	 * bit 6 UC non aggregation*/
 	t_u8 enable_bitmap;
 	/* 1 valid, 0 invalid
 	 * bit 0 MC aggregation
 	 * bit 1 packet expiry
 	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
+	 * bit 3 CTS2Self duration offset
+	 * bit 6 UC non aggregation*/
 	t_u8 mask_bitmap;
 	/** CTS2Self duration offset */
 	t_u16 cts2self_offset;
@@ -3656,7 +2926,7 @@
 	/** Action */
 	t_u16 action;
 	/** TLV buffer */
-	t_u8 tlv_buffer[1];
+	t_u8 tlv_buffer[];
 } MLAN_PACK_END HostCmd_DS_STATS;
 
 typedef MLAN_PACK_START struct _HostCmd_DS_GET_CH_LOAD {
@@ -3666,7 +2936,6 @@
 	t_s16 noise;
 	t_u16 rx_quality;
 	t_u16 duration;
-	t_u16 cca_th;
 } MLAN_PACK_END HostCmd_DS_GET_CH_LOAD;
 
 /**  HostCmd_DS_CMD_802_11_RSSI_INFO */
@@ -3747,8 +3016,6 @@
 	t_u8 pause_tx_count;
 } MLAN_PACK_END HostCmd_DS_CMD_TX_DATA_PAUSE;
 
-/** TLV type : TX pause TLV */
-#define TLV_TYPE_TX_PAUSE (PROPRIETARY_TLV_BASE_ID + 0x94) /* 0x0194 */
 /** MrvlIEtypes_SsIdParamSet_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_tx_pause_t {
 	/** Header */
@@ -3806,88 +3073,6 @@
 	IEEEtypes_AssocRsp_t assoc_rsp;
 } MLAN_PACK_END HostCmd_DS_802_11_ASSOCIATE_RSP;
 
-/** HostCmd_DS_802_11_AD_HOC_START*/
-typedef MLAN_PACK_START struct _HostCmd_DS_802_11_AD_HOC_START {
-	/** AdHoc SSID */
-	t_u8 ssid[MLAN_MAX_SSID_LENGTH];
-	/** BSS mode */
-	t_u8 bss_mode;
-	/** Beacon period */
-	t_u16 beacon_period;
-	/** DTIM period */
-	t_u8 dtim_period;
-	/** SS parameter set */
-	IEEEtypes_SsParamSet_t ss_param_set;
-	/** PHY parameter set */
-	IEEEtypes_PhyParamSet_t phy_param_set;
-	/** Reserved field */
-	t_u16 reserved1;
-	/** Capability information */
-	IEEEtypes_CapInfo_t cap;
-	/** Supported data rates */
-	t_u8 DataRate[HOSTCMD_SUPPORTED_RATES];
-} MLAN_PACK_END HostCmd_DS_802_11_AD_HOC_START;
-
-/**  HostCmd_CMD_802_11_AD_HOC_START response */
-typedef MLAN_PACK_START struct _HostCmd_DS_802_11_AD_HOC_START_RESULT {
-	/** Padding */
-	t_u8 pad[3];
-	/** AdHoc BSSID */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** Padding to sync with FW structure*/
-	t_u8 pad2[2];
-	/** Result */
-	t_u8 result;
-} MLAN_PACK_END HostCmd_DS_802_11_AD_HOC_START_RESULT;
-
-/**  HostCmd_CMD_802_11_AD_HOC_START response */
-typedef MLAN_PACK_START struct _HostCmd_DS_802_11_AD_HOC_JOIN_RESULT {
-	/** Result */
-	t_u8 result;
-} MLAN_PACK_END HostCmd_DS_802_11_AD_HOC_JOIN_RESULT;
-
-/** AdHoc_BssDesc_t */
-typedef MLAN_PACK_START struct _AdHoc_BssDesc_t {
-	/** BSSID */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** SSID */
-	t_u8 ssid[MLAN_MAX_SSID_LENGTH];
-	/** BSS mode */
-	t_u8 bss_mode;
-	/** Beacon period */
-	t_u16 beacon_period;
-	/** DTIM period */
-	t_u8 dtim_period;
-	/** Timestamp */
-	t_u8 time_stamp[8];
-	/** Local time */
-	t_u8 local_time[8];
-	/** PHY parameter set */
-	IEEEtypes_PhyParamSet_t phy_param_set;
-	/** SS parameter set */
-	IEEEtypes_SsParamSet_t ss_param_set;
-	/** Capability information */
-	IEEEtypes_CapInfo_t cap;
-	/** Supported data rates */
-	t_u8 data_rates[HOSTCMD_SUPPORTED_RATES];
-
-	/*
-	 *  DO NOT ADD ANY FIELDS TO THIS STRUCTURE.
-	 *  It is used in the Adhoc join command and will cause a
-	 *  binary layout mismatch with the firmware
-	 */
-} MLAN_PACK_END AdHoc_BssDesc_t;
-
-/** HostCmd_DS_802_11_AD_HOC_JOIN */
-typedef MLAN_PACK_START struct _HostCmd_DS_802_11_AD_HOC_JOIN {
-	/** AdHoc BSS descriptor */
-	AdHoc_BssDesc_t bss_descriptor;
-	/** Reserved field */
-	t_u16 reserved1;
-	/** Reserved field */
-	t_u16 reserved2;
-} MLAN_PACK_END HostCmd_DS_802_11_AD_HOC_JOIN;
-
 #if defined(SDIO)
 /** Interrupt Raising Edge */
 #define INT_RASING_EDGE 0
@@ -4027,8 +3212,10 @@
 	/** Rx Stuck Related Info*/
 	/** Rx Stuck Issue count */
 	t_u32 rx_stuck_issue_cnt[2];
-	/** Rx Stuck Recovery count */
-	t_u32 rx_stuck_recovery_cnt;
+	/** Rx Stuck Recovery count polling based */
+	t_u32 rx_stuck_poll_recovery_cnt;
+	/** Rx Stuck Recovery count interrupt based */
+	t_u32 rx_stuck_intr_recovery_cnt;
 	/** Rx Stuck TSF */
 	t_u64 rx_stuck_tsf[2];
 	/** Tx Watchdog Recovery Related Info */
@@ -4055,6 +3242,8 @@
 	t_u32 gdma_abort_cnt;
 	/** Rx Reset MAC Count */
 	t_u32 g_reset_rx_mac_cnt;
+	/** SDMA FSM stuck Count*/
+	t_u32 SdmaStuckCnt;
 	// Ownership error counters
 	/*Error Ownership error count*/
 	t_u32 dwCtlErrCnt;
@@ -4165,6 +3354,14 @@
 	t_u32 retries_long;
 } MLAN_PACK_END mlan_wifi_rate_stat;
 
+typedef MLAN_PACK_START struct {
+	/** station count */
+	t_u16 sta_count;
+	/** channel utilization */
+	t_u16 chan_util;
+	t_u8 PAD[4];
+} MLAN_PACK_END mlan_bssload_info;
+
 /** per peer statistics */
 typedef MLAN_PACK_START struct {
 	/** peer type (AP, TDLS, GO etc.) */
@@ -4173,6 +3370,8 @@
 	t_u8 peer_mac_address[6];
 	/** peer WIFI_CAPABILITY_XXX */
 	t_u32 capabilities;
+	/** STA count and channel utilization */
+	mlan_bssload_info bssload;
 	/** number of rates */
 	t_u32 num_rate;
 	/** per rate statistics, number of entries  = num_rate */
@@ -4338,8 +3537,8 @@
 	t_u32 conditions;
 	/** GPIO pin or 0xff for interface */
 	t_u8 gpio;
-	/** gap in milliseconds or or 0xff for special setting when
-	 *  GPIO is used to wakeup host
+	/** gap in milliseconds or 0xff for special setting
+	 *  (host acknowledge required)
 	 */
 	t_u8 gap;
 } MLAN_PACK_END hs_config_param;
@@ -4374,6 +3573,15 @@
 	} params;
 } MLAN_PACK_END HostCmd_DS_802_11_HS_CFG_ENH;
 
+/** HostCmd_CMD_802_11_FW_WAKE_METHOD */
+typedef MLAN_PACK_START struct _HostCmd_DS_802_11_FW_WAKEUP_METHOD {
+	/** Action */
+	t_u16 action;
+	/** Method */
+	t_u16 method;
+	t_u8 tlv_buf[];
+} MLAN_PACK_END HostCmd_DS_802_11_FW_WAKEUP_METHOD;
+
 /** HostCmd_CMD_802_11_ROBUSTCOEX */
 typedef MLAN_PACK_START struct _HostCmd_DS_802_11_ROBUSTCOEX {
 	/** Action */
@@ -4430,6 +3638,21 @@
 } MLAN_PACK_END HostCmd_DS_SSU_CFG;
 #endif
 
+/** MrvlIEtypes_channel_bandcfg_t */
+typedef MLAN_PACK_START struct _MrvlIEtypes_csi_channel_bandcfg_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Enable getting CSI data on special channel */
+	t_u8 csi_monitor_enable;
+	/** CSI data received in cfg channel with mac addr filter, not only RA
+	 * is us or other*/
+	t_u8 ra4us;
+	/** bandconfig*/
+	t_u8 bandconfig;
+	/** channel num */
+	t_u8 channel;
+} MLAN_PACK_END MrvlIEtypes_csi_channel_bandcfg_t;
+
 /** HostCmd_CMD_CSI_START */
 typedef MLAN_PACK_START struct _HostCmd_DS_CSI_CFG {
 	/** Action */
@@ -4444,6 +3667,8 @@
 	t_u8 chip_id;
 	/** CSI filters */
 	mlan_csi_filter_t csi_filter[CSI_FILTER_MAX];
+	/**channel and bandconfig*/
+	MrvlIEtypes_csi_channel_bandcfg_t csi_channel_bandconfig;
 } MLAN_PACK_END HostCmd_DS_CSI_CFG;
 
 typedef MLAN_PACK_START struct _HostCmd_DS_HAL_PHY_CFG {
@@ -4473,6 +3698,7 @@
 	StopDeauth_i = 44,
 	Dot11H_fakeRadar = 45,
 	ChanTrackParam_i = 46,
+	Dot11h_disable_tpc_i = 47,
 } SNMP_MIB_INDEX;
 
 /** max SNMP buf size */
@@ -4559,6 +3785,25 @@
 	t_u8 tlv_buf[];
 } MLAN_PACK_END HostCmd_DS_TX_RATE_CFG;
 
+/** HostCmd_DS_FUNC_INIT */
+typedef MLAN_PACK_START struct _HostCmd_DS_FUNC_INIT {
+	/* MrvlIEtypes_boot_time_cfg_t */
+	t_u8 tlv_buf[0];
+} MLAN_PACK_END HostCmd_DS_FUNC_INIT;
+
+/** BootTimeCfg TLV */
+typedef MLAN_PACK_START struct _MrvlIEtypes_boot_time_cfg_t {
+	/** Header type */
+	t_u16 type;
+	/** Header length */
+	t_u16 len;
+	/* enable: 1: enable boot time optimization 0: disable boot time
+	 * optimization */
+	t_u8 enable;
+	/* reserved */
+	t_u8 reserve[3];
+} MLAN_PACK_END MrvlIEtypes_boot_time_cfg_t, *pMrvlIEtypes_boot_time_cfg_t;
+
 /** Power_Group_t */
 typedef MLAN_PACK_START struct _Power_Group_t {
 	/** Modulation Class */
@@ -4614,8 +3859,6 @@
 
 /** Connection type infra */
 #define CONNECTION_TYPE_INFRA 0
-/** Connection type adhoc */
-#define CONNECTION_TYPE_ADHOC 1
 #ifdef WIFI_DIRECT_SUPPORT
 /** BSS Mode: WIFIDIRECT Client */
 #define BSS_MODE_WIFIDIRECT_CLIENT 0
@@ -4747,6 +3990,47 @@
 	t_u8 tlv_buf[];
 } MLAN_PACK_END HostCmd_DS_GPIO_TSF_LATCH_PARAM_CONFIG;
 
+/** MrvlIEtypes_CROSS_CHIP_SYNCH_CONFIG */
+typedef MLAN_PACK_START struct _HostCmd_DS_CROSS_CHIP_SYNCH {
+	/** Action 0-GET, 1-SET */
+	t_u16 action;
+	/**cross chip sync start/stop */
+	t_u8 start_stop;
+	/**cross chip synch role, master or slave */
+	t_u8 role;
+	/**cross chip synch periodicty of toggle in us */
+	t_u32 period;
+	/**cross chip synch initial TSF low */
+	t_u32 init_tsf_low;
+	/**cross chip synch intial TSF high */
+	t_u32 init_tsf_high;
+} MLAN_PACK_END HostCmd_DS_CROSS_CHIP_SYNCH;
+
+typedef MLAN_PACK_START struct _HostCmd_DS_TSP_CFG {
+	/** TSP config action 0-GET, 1-SET */
+	t_u16 action;
+	/** TSP enable/disable tsp algothrim */
+	t_u16 enable;
+	/** TSP config power backoff */
+	t_s32 backoff;
+	/** TSP config high threshold */
+	t_s32 high_thrshld;
+	/** TSP config low threshold */
+	t_s32 low_thrshld;
+	/** TSP config DUTY_CYC_STEP */
+	t_s32 duty_cyc_step;
+	/** TSP config DUTY_CYC_MIN */
+	t_s32 duty_cyc_min;
+	/** TSP config HIGH_THRESHOLD_TEMP */
+	t_s32 high_thrshld_temp;
+	/** TSP config LOW_THRESHOLD_TEMP */
+	t_s32 low_thrshld_temp;
+	/** TSP CAU TSEN read value */
+	t_s32 reg_cau_val;
+	/** TSP RFU read values */
+	t_s32 reg_rfu_val[MAX_RFUS][MAX_PATHS];
+} MLAN_PACK_END HostCmd_DS_TSP_CFG;
+
 MLAN_PACK_START struct coalesce_filt_field_param {
 	t_u8 operation;
 	t_u8 operand_len;
@@ -4770,8 +4054,6 @@
 	struct coalesce_receive_filt_rule rule[1];
 } MLAN_PACK_END HostCmd_DS_COALESCE_CONFIG;
 
-/** TLV type : FW support max connection TLV */
-#define TLV_TYPE_MAX_CONN (PROPRIETARY_TLV_BASE_ID + 0x117) /* 0x0217 */
 /** MrvlIEtypes_Max_Conn_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_Max_Conn_t {
 	/** Header */
@@ -4996,7 +4278,7 @@
 	/** Numner of sets */
 	t_u8 number_of_sets;
 	/** BSS descriptor and TLV buffer */
-	t_u8 bss_desc_and_tlv_buffer[1];
+	t_u8 bss_desc_and_tlv_buffer[];
 } MLAN_PACK_END HostCmd_DS_802_11_SCAN_RSP;
 
 /** HostCmd_DS_802_11_BG_SCAN_CONFIG */
@@ -5268,8 +4550,8 @@
 	t_u8 twt_request;
 	/** TWT Setup State. Set to 0 by driver, filled by FW in response*/
 	t_u8 twt_setup_state;
-	/** Reserved, set to 0. */
-	t_u8 reserved[2];
+	/** TWT link lost timeout threshold */
+	t_u16 bcnMiss_threshold;
 } MLAN_PACK_END hostcmd_twt_setup, *phostcmd_twt_setup;
 
 /** Type definition of hostcmd_twt_teardown */
@@ -5287,6 +4569,41 @@
 	t_u8 reserved[3];
 } MLAN_PACK_END hostcmd_twt_teardown, *phostcmd_twt_teardown;
 
+/** Type definition of hostcmd_twt_report */
+typedef MLAN_PACK_START struct _hostcmd_twt_report {
+	/** TWT report type, 0: BTWT id */
+	t_u8 type;
+	/** TWT report length of value in data */
+	t_u8 length;
+	t_u8 reserve[2];
+	/** TWT report payload for FW response to fill */
+	t_u8 data[36];
+} MLAN_PACK_END hostcmd_twt_report, *phostcmd_twt_report;
+
+/** Type definition of hostcmd_twt_information */
+typedef struct MLAN_PACK_START _hostcmd_twt_information {
+	/** TWT Flow Identifier. Range: [0-7] */
+	t_u8 flow_identifier;
+	/** Suspend Duration. Range: [0-UINT32_MAX]
+	 * 0:Suspend forever;
+	 * Else:Suspend agreement for specific duration in milli seconds,
+	 * 		after than resume the agreement and enter SP immediately
+	 */
+	t_u32 suspend_duration;
+	/** TWT Information State. Set to 0 by driver, filled by FW in response
+	 */
+	t_u8 twt_information_state;
+} MLAN_PACK_END hostcmd_twt_information, *phostcmd_twt_information;
+
+/** Type definition of hostcmd_btwt_ap_config*/
+typedef struct MLAN_PACK_START _hostcmd_btwt_ap_config {
+	t_u8 ap_bcast_bet_sta_wait;
+	t_u16 Ap_Bcast_Offset;
+	t_u8 bcastTWTLI;
+	t_u8 count;
+	BTWT_set BTWT_sets[BTWT_AGREEMENT_MAX];
+} MLAN_PACK_END hostcmd_btwt_ap_config, *phostcmd_btwt_ap_config;
+
 /** HostCmd_DS_TWT_CFG */
 typedef MLAN_PACK_START struct _HostCmd_DS_TWT_CFG {
 	/** Action */
@@ -5300,6 +4617,15 @@
 		/** TWT Teardown config for Sub ID: MLAN_11AX_TWT_TEARDOWN_SUBID
 		 */
 		hostcmd_twt_teardown twt_teardown;
+		/** TWT report for Sub ID: MLAN_11AX_TWT_REPORT_SUBID */
+		hostcmd_twt_report twt_report;
+		/** TWT Information config for Sub ID:
+		 * MLAN_11AX_TWT_INFORMATION_SUBID
+		 */
+		hostcmd_twt_information twt_information;
+		/** BTWT AP config for Sub ID: MLAN_11AX_BTWT_AP_CONFIG_SUBID
+		 */
+		hostcmd_btwt_ap_config btwt_ap_config;
 	} param;
 } MLAN_PACK_END HostCmd_DS_TWT_CFG;
 
@@ -5322,7 +4648,7 @@
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** WMM IE */
-	t_u8 wmm_ie[1];
+	t_u8 wmm_ie[];
 } MLAN_PACK_END MrvlIEtypes_WmmParamSet_t;
 
 /** MrvlIEtypes_WmmQueueStatus_t */
@@ -5378,6 +4704,32 @@
 } MLAN_PACK_END HostCmd_DS_WMM_GET_STATUS;
 
 /**
+ *  @brief Command structure for the HostCmd_CMD_WMM_HOST_ADDTS_REQ firmware
+ * command
+ */
+typedef MLAN_PACK_START struct {
+	/* TS id - unique per tid, TA, RA combination */
+	t_u8 tsid;
+	/* RA BSSID */
+	t_u8 peer_addr[MLAN_MAC_ADDR_LENGTH];
+	/* User priority (UP) */
+	t_u8 user_prio;
+	/* Admitted Air time for UP */
+	t_u16 admitted_time;
+} MLAN_PACK_END HostCmd_DS_WMM_HOST_ADDTS_REQ;
+
+/**
+ *  @brief Command structure for the HostCmd_CMD_WMM_HOST_DELTS_REQ firmware
+ * command
+ */
+typedef MLAN_PACK_START struct {
+	/* TS id - unique per tid, TA, RA combination */
+	t_u8 tsid;
+	/* RA BSSID */
+	t_u8 peer_addr[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END HostCmd_DS_WMM_HOST_DELTS_REQ;
+
+/**
  *  @brief Command structure for the HostCmd_CMD_WMM_ADDTS_REQ firmware command
  */
 typedef MLAN_PACK_START struct {
@@ -5535,6 +4887,16 @@
 	t_u8 oper_class[1];
 } MLAN_PACK_END MrvlIETypes_SuppOperClass_t;
 
+/*  Supported Transmit Power Envelope Element */
+typedef MLAN_PACK_START struct {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Transmit Power Information */
+	t_u8 tpc_info;
+	/** Maximum Transmit Power Spectral Density */
+	t_u8 max_tp_spectral_density;
+} MLAN_PACK_END MrvlIETypes_TpcEnvelope_t;
+
 /** Oper_class channel bandwidth element */
 typedef MLAN_PACK_START struct _MrvlIEtypes_chan_bw_oper_t {
 	/** Header */
@@ -5904,34 +5266,19 @@
 	char version_str[128];
 } MLAN_PACK_END HostCmd_DS_VERSION_EXT;
 
-#define TLV_TYPE_CHAN_ATTR_CFG (PROPRIETARY_TLV_BASE_ID + 237)
-#define TLV_TYPE_REGION_INFO (PROPRIETARY_TLV_BASE_ID + 238)
-#define TLV_TYPE_POWER_TABLE (PROPRIETARY_TLV_BASE_ID + 262)
-#define TLV_TYPE_POWER_TABLE_ATTR (PROPRIETARY_TLV_BASE_ID + 317)
 /** HostCmd_DS_CHAN_REGION_CFG */
 typedef MLAN_PACK_START struct _HostCmd_DS_CHAN_REGION_CFG {
 	/** Action */
 	t_u16 action;
+	/** TLV buffer */
+	t_u8 tlv_buffer[1];
 } MLAN_PACK_END HostCmd_DS_CHAN_REGION_CFG;
 
-/** HostCmd_CMD_CW_MODE_CTRL */
-typedef MLAN_PACK_START struct _HostCmd_DS_CW_MODE_CTRL {
-	/** Action for CW Tone Control */
+/** HostCmd_DS_REGION_POWER_CFG */
+typedef MLAN_PACK_START struct _HostCmd_DS_REGION_POWER_CFG {
+	/** Action */
 	t_u16 action;
-	/** Mode of Operation 0: Disbale 1: Tx Continuous Packet 2: Tx
-	 * Continuous Wave */
-	t_u8 mode;
-	/** channel */
-	t_u8 channel;
-	/** channel info*/
-	t_u8 chanInfo;
-	/** Tx Power level in dBm */
-	t_u16 txPower;
-	/** Packet Length */
-	t_u16 pktLength;
-	/** bit rate Info */
-	t_u32 rateInfo;
-} MLAN_PACK_END HostCmd_DS_CW_MODE_CTRL;
+} MLAN_PACK_END HostCmd_DS_REGION_POWER_CFG;
 
 /** HostCmd_CMD_802_11_RF_ANTENNA */
 typedef MLAN_PACK_START struct _HostCmd_DS_802_11_RF_ANTENNA {
@@ -5945,22 +5292,6 @@
 	t_u16 rx_antenna_mode;
 } MLAN_PACK_END HostCmd_DS_802_11_RF_ANTENNA;
 
-/** HostCmd_DS_802_11_IBSS_STATUS */
-typedef MLAN_PACK_START struct _HostCmd_DS_802_11_IBSS_STATUS {
-	/** Action */
-	t_u16 action;
-	/** Enable */
-	t_u16 enable;
-	/** BSSID */
-	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
-	/** Beacon interval */
-	t_u16 beacon_interval;
-	/** ATIM window interval */
-	t_u16 atim_window;
-	/** User G rate protection */
-	t_u16 use_g_rate_protect;
-} MLAN_PACK_END HostCmd_DS_802_11_IBSS_STATUS;
-
 /** HostCmd_DS_MGMT_IE_LIST_CFG */
 typedef MLAN_PACK_START struct _HostCmd_DS_MGMT_IE_LIST {
 	/** Action */
@@ -6074,6 +5405,18 @@
 	t_u32 value;
 } MLAN_PACK_END HostCmd_DS_REG_ACCESS;
 
+/** Type defination of HostCmd_gpio_cfg_ops */
+typedef MLAN_PACK_START struct _HostCmd_gpio_cfg_ops {
+	/** Get or Set action */
+	t_u8 action;
+	/** Operation type */
+	t_u8 opsType;
+	/** pin number */
+	t_u8 pin_num;
+	/** pin value */
+	t_u8 value;
+} MLAN_PACK_END HostCmd_gpio_cfg_ops;
+
 /** HostCmd_DS_TARGET_ACCESS */
 typedef MLAN_PACK_START struct _HostCmd_DS_TARGET_ACCESS {
 	/** Action */
@@ -6305,8 +5648,8 @@
 	t_u16 mcast_timeout;
 	/** Timeout for additional RX traffic after Null PM1 packet exchange */
 	t_u16 ps_entry_timeout;
-	/** Reserved to further expansion */
-	t_u16 reserved;
+	/** Inactivity timeout for cmd */
+	t_u16 ps_cmd_timeout;
 } MLAN_PACK_END HostCmd_DS_INACTIVITY_TIMEOUT_EXT;
 
 /** HostCmd_DS_INDEPENDENT_RESET_CFG */
@@ -6327,11 +5670,6 @@
 	t_u16 inact_tmo;
 } MLAN_PACK_END HostCmd_DS_802_11_PS_INACTIVITY_TIMEOUT;
 
-/** TLV type : STA Mac address */
-#define TLV_TYPE_STA_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 0x20) /* 0x0120 */
-
-#define TLV_TYPE_RANDOM_MAC (PROPRIETARY_TLV_BASE_ID + 0xEC) /*0x01EC*/
-
 /** MrvlIEtypes_MacAddr_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_MacAddr_t {
 	/** Header */
@@ -6340,128 +5678,7 @@
 	t_u8 mac[MLAN_MAC_ADDR_LENGTH];
 } MLAN_PACK_END MrvlIEtypes_MacAddr_t;
 
-/** Assoc Request */
-#define SUBTYPE_ASSOC_REQUEST 0
-/** ReAssoc Request */
-#define SUBTYPE_REASSOC_REQUEST 2
-/** Probe Resp */
-#define SUBTYPE_PROBE_RESP 5
-/** Disassoc Request */
-#define SUBTYPE_DISASSOC 10
-/** Auth Request */
-#define SUBTYPE_AUTH 11
-/** Deauth Request */
-#define SUBTYPE_DEAUTH 12
-/** Action frame */
-#define SUBTYPE_ACTION 13
-/** beacon */
-#define SUBTYPE_BEACON 8
-
 #ifdef UAP_SUPPORT
-/** TLV type : AP Channel band Config */
-#define TLV_TYPE_UAP_CHAN_BAND_CONFIG                                          \
-	(PROPRIETARY_TLV_BASE_ID + 0x2a) /* 0x012a */
-/** TLV type : AP Mac address */
-#define TLV_TYPE_UAP_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 0x2b) /* 0x012b */
-/** TLV type : AP Beacon period */
-#define TLV_TYPE_UAP_BEACON_PERIOD                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0x2c) /* 0x012c                             \
-					  */
-/** TLV type : AP DTIM period */
-#define TLV_TYPE_UAP_DTIM_PERIOD (PROPRIETARY_TLV_BASE_ID + 0x2d) /* 0x012d */
-/** TLV type : AP Tx power */
-#define TLV_TYPE_UAP_TX_POWER (PROPRIETARY_TLV_BASE_ID + 0x2f) /* 0x012f */
-/** TLV type : AP SSID broadcast control */
-#define TLV_TYPE_UAP_BCAST_SSID_CTL                                            \
-	(PROPRIETARY_TLV_BASE_ID + 0x30) /* 0x0130 */
-/** TLV type : AP Preamble control */
-#define TLV_TYPE_UAP_PREAMBLE_CTL                                              \
-	(PROPRIETARY_TLV_BASE_ID + 0x31) /* 0x0131                             \
-					  */
-/** TLV type : AP Antenna control */
-#define TLV_TYPE_UAP_ANTENNA_CTL (PROPRIETARY_TLV_BASE_ID + 0x32) /* 0x0132 */
-/** TLV type : AP RTS threshold */
-#define TLV_TYPE_UAP_RTS_THRESHOLD                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0x33) /* 0x0133                             \
-					  */
-/** TLV type : AP Tx data rate */
-#define TLV_TYPE_UAP_TX_DATA_RATE                                              \
-	(PROPRIETARY_TLV_BASE_ID + 0x35) /* 0x0135                             \
-					  */
-/** TLV type: AP Packet forwarding control */
-#define TLV_TYPE_UAP_PKT_FWD_CTL (PROPRIETARY_TLV_BASE_ID + 0x36) /* 0x0136 */
-/** TLV type: STA information */
-#define TLV_TYPE_UAP_STA_INFO (PROPRIETARY_TLV_BASE_ID + 0x37) /* 0x0137 */
-/** TLV type: AP STA MAC address filter */
-#define TLV_TYPE_UAP_STA_MAC_ADDR_FILTER                                       \
-	(PROPRIETARY_TLV_BASE_ID + 0x38) /* 0x0138 */
-/** TLV type: AP STA ageout timer */
-#define TLV_TYPE_UAP_STA_AGEOUT_TIMER                                          \
-	(PROPRIETARY_TLV_BASE_ID + 0x39) /* 0x0139 */
-/** TLV type: AP WEP keys */
-#define TLV_TYPE_UAP_WEP_KEY (PROPRIETARY_TLV_BASE_ID + 0x3b) /* 0x013b */
-/** TLV type: AP WPA passphrase */
-#define TLV_TYPE_UAP_WPA_PASSPHRASE                                            \
-	(PROPRIETARY_TLV_BASE_ID + 0x3c) /* 0x013c */
-/** TLV type: AP protocol */
-#define TLV_TYPE_UAP_ENCRYPT_PROTOCOL                                          \
-	(PROPRIETARY_TLV_BASE_ID + 0x40) /* 0x0140 */
-/** TLV type: AP AKMP */
-#define TLV_TYPE_UAP_AKMP (PROPRIETARY_TLV_BASE_ID + 0x41) /* 0x0141 */
-/** TLV type: AP Fragment threshold */
-#define TLV_TYPE_UAP_FRAG_THRESHOLD                                            \
-	(PROPRIETARY_TLV_BASE_ID + 0x46) /* 0x0146 */
-/** TLV type: AP Group rekey timer */
-#define TLV_TYPE_UAP_GRP_REKEY_TIME                                            \
-	(PROPRIETARY_TLV_BASE_ID + 0x47) /* 0x0147 */
-/**TLV type : AP Max Station number */
-#define TLV_TYPE_UAP_MAX_STA_CNT (PROPRIETARY_TLV_BASE_ID + 0x55) /* 0x0155 */
-/**TLV type : AP Max Station number per chip */
-#define TLV_TYPE_UAP_MAX_STA_CNT_PER_CHIP                                      \
-	(PROPRIETARY_TLV_BASE_ID + 0x140) /* 0x0240 */
-/**TLV type : AP Retry limit */
-#define TLV_TYPE_UAP_RETRY_LIMIT (PROPRIETARY_TLV_BASE_ID + 0x5d) /* 0x015d */
-/** TLV type : AP MCBC data rate */
-#define TLV_TYPE_UAP_MCBC_DATA_RATE                                            \
-	(PROPRIETARY_TLV_BASE_ID + 0x62) /* 0x0162 */
-/**TLV type: AP RSN replay protection */
-#define TLV_TYPE_UAP_RSN_REPLAY_PROTECT                                        \
-	(PROPRIETARY_TLV_BASE_ID + 0x64) /* 0x0164 */
-/**TLV type: AP mgmt IE passthru mask */
-#define TLV_TYPE_UAP_MGMT_IE_PASSTHRU_MASK                                     \
-	(PROPRIETARY_TLV_BASE_ID + 0x70) /* 0x0170 */
-
-/**TLV type: AP pairwise handshake timeout */
-#define TLV_TYPE_UAP_EAPOL_PWK_HSK_TIMEOUT                                     \
-	(PROPRIETARY_TLV_BASE_ID + 0x75) /* 0x0175 */
-/**TLV type: AP pairwise handshake retries */
-#define TLV_TYPE_UAP_EAPOL_PWK_HSK_RETRIES                                     \
-	(PROPRIETARY_TLV_BASE_ID + 0x76) /* 0x0176 */
-/**TLV type: AP groupwise handshake timeout */
-#define TLV_TYPE_UAP_EAPOL_GWK_HSK_TIMEOUT                                     \
-	(PROPRIETARY_TLV_BASE_ID + 0x77) /* 0x0177 */
-/**TLV type: AP groupwise handshake retries */
-#define TLV_TYPE_UAP_EAPOL_GWK_HSK_RETRIES                                     \
-	(PROPRIETARY_TLV_BASE_ID + 0x78) /* 0x0178 */
-/** TLV type: AP PS STA ageout timer */
-#define TLV_TYPE_UAP_PS_STA_AGEOUT_TIMER                                       \
-	(PROPRIETARY_TLV_BASE_ID + 0x7b) /* 0x017b */
-/** TLV type : Pairwise Cipher */
-#define TLV_TYPE_PWK_CIPHER (PROPRIETARY_TLV_BASE_ID + 0x91) /* 0x0191 */
-/** TLV type : Group Cipher */
-#define TLV_TYPE_GWK_CIPHER (PROPRIETARY_TLV_BASE_ID + 0x92) /* 0x0192 */
-/** TLV type : BSS Status */
-#define TLV_TYPE_BSS_STATUS (PROPRIETARY_TLV_BASE_ID + 0x93) /* 0x0193 */
-/** TLV type :  AP WMM params */
-#define TLV_TYPE_AP_WMM_PARAM (PROPRIETARY_TLV_BASE_ID + 0xd0) /* 0x01d0 */
-/** TLV type : AP Tx beacon rate */
-#define TLV_TYPE_UAP_TX_BEACON_RATE (PROPRIETARY_TLV_BASE_ID + 288) /* 0x0220  \
-								     */
-#define NXP_802_11_PER_PEER_STATS_CFG_TLV_ID                                   \
-	(PROPRIETARY_TLV_BASE_ID + 346) /* 0x025A */
-#define NXP_802_11_PER_PEER_STATS_ENTRY_TLV_ID                                 \
-	(PROPRIETARY_TLV_BASE_ID + 347) /* 0x025B */
-
 /** MrvlIEtypes_beacon_period_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_beacon_period_t {
 	/** Header */
@@ -6544,8 +5761,6 @@
 	t_u16 uap_max_sta;
 } MLAN_PACK_END MrvlIEtypes_uap_max_sta_cnt_t;
 
-#define MRVL_ACTION_CHAN_SWITCH_ANNOUNCE (PROPRIETARY_TLV_BASE_ID + 342)
-
 /** MrvlIEtypes_uap_chan_switch */
 typedef MLAN_PACK_START struct _MrvlIEtypes_action_chan_switch_t {
 	/** Header */
@@ -6800,7 +6015,7 @@
 	/** CMD Action GET/SET*/
 	t_u16 action;
 	/** Tlv buffer */
-	t_u8 tlv_buffer[1];
+	t_u8 tlv_buffer[];
 } MLAN_PACK_END HostCmd_DS_SYS_CONFIG;
 
 /** HostCmd_SYS_CONFIG */
@@ -6837,11 +6052,6 @@
 
 /** Host Command id: POWER_MGMT  */
 #define HOST_CMD_POWER_MGMT_EXT 0x00ef
-/** TLV type: AP Sleep param */
-#define TLV_TYPE_AP_SLEEP_PARAM (PROPRIETARY_TLV_BASE_ID + 0x6a) /* 0x016a */
-/** TLV type: AP Inactivity Sleep param */
-#define TLV_TYPE_AP_INACT_SLEEP_PARAM                                          \
-	(PROPRIETARY_TLV_BASE_ID + 0x6b) /* 0x016b */
 
 /** MrvlIEtypes_sleep_param_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_sleep_param_t {
@@ -6906,9 +6116,6 @@
 	t_u8 tlv_buf[];
 } MLAN_PACK_END HostCmd_DS_STA_LIST;
 
-/** TLV ID : WAPI Information */
-#define TLV_TYPE_AP_WAPI_INFO (PROPRIETARY_TLV_BASE_ID + 0x67) /* 0x0167 */
-
 /** MrvlIEtypes_sta_info_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_wapi_info_t {
 	/** Header */
@@ -6996,7 +6203,7 @@
 	/** Channel swith time (in TU) for chan_idx*/
 	t_u8 switchtime;
 	/** Undoze time (in TU) for chan_idx*/
-	t_u8 undozetime;
+	t_u8 rx_wait_time;
 	/** Rx traffic control scheme when channel switch*/
 	/** only valid for GC/STA interface*/
 	t_u8 mode;
@@ -7185,9 +6392,6 @@
 	t_u16 dyn_bw;
 } MLAN_PACK_END HostCmd_DS_DYN_BW;
 
-/** Host Command ID : Packet aggregation CTRL */
-#define HostCmd_CMD_PACKET_AGGR_CTRL 0x0251
-
 /** HostCmd_DS_PACKET_AGGR_CTRL */
 typedef MLAN_PACK_START struct _HostCmd_DS_PACKET_AGGR_AGGR_CTRL {
 	/** ACT_GET/ACT_SET */
@@ -7203,14 +6407,6 @@
 } MLAN_PACK_END HostCmd_DS_PACKET_AGGR_CTRL;
 
 #ifdef USB
-/** Host Command ID : Packet aggregation over host interface */
-#define HostCmd_CMD_PACKET_AGGR_OVER_HOST_INTERFACE 0x0117
-
-/** TLV ID : USB Aggregation parameters */
-#define MRVL_USB_AGGR_PARAM_TLV_ID                                             \
-	(PROPRIETARY_TLV_BASE_ID + 0xB1) /* 0x1B1                              \
-					  */
-
 /** TLV size : USB Aggregation parameters, except header */
 #define MRVL_USB_AGGR_PARAM_TLV_LEN (14)
 
@@ -7561,9 +6757,6 @@
 	t_u8 tlv_buffer[1];
 
 } MLAN_PACK_END HostCmd_DS_OPCHAN_CHANGROUP_CONFIG;
-
-#define HostCmd_CMD_OPCHAN_CONFIG 0x00f8
-#define HostCmd_CMD_OPCHAN_CHANGROUP_CONFIG 0x00f9
 #endif
 
 typedef MLAN_PACK_START struct {
@@ -7660,6 +6853,20 @@
 	t_u64 paddr;
 } MLAN_PACK_END adma_dual_desc_buf, *padma_dual_desc_buf;
 
+/** PCIE ADMA configuration */
+typedef MLAN_PACK_START struct _HostCmd_DS_PCIE_ADMA_INIT {
+	/* tx adma ring size */
+	t_u16 tx_ring_size;
+	/* rx adma ring size */
+	t_u16 rx_ring_size;
+	/* event adma ring size */
+	t_u16 evt_ring_size;
+	/* interrupt mode: 0-legacy 1-msi 2-msix */
+	t_u8 int_mode;
+	/** reserved */
+	t_u8 reserved;
+} HostCmd_DS_PCIE_ADMA_INIT;
+
 #if defined(PCIE8997) || defined(PCIE8897)
 /** PCIE ring buffer description for DATA */
 typedef MLAN_PACK_START struct _mlan_pcie_data_buf {
@@ -7714,10 +6921,10 @@
 	t_u32 temperature;
 } MLAN_PACK_END HostCmd_DS_SENSOR_TEMP;
 
-#define TLV_TYPE_IPV6_RA_OFFLOAD (PROPRIETARY_TLV_BASE_ID + 0xE6) /** 0x1E6*/
 typedef MLAN_PACK_START struct {
 	MrvlIEtypesHeader_t Header;
-	t_u8 ipv6_addr[16];
+	/** ipv6 address buffer */
+	t_u8 ipv6_addrs[];
 } MLAN_PACK_END MrvlIETypes_IPv6AddrParamSet_t;
 
 typedef MLAN_PACK_START struct _HostCmd_DS_IPV6_RA_OFFLOAD {
@@ -7727,6 +6934,8 @@
 	t_u16 action;
 	/** 0x00: disable IPv6 RA Offload; 0x01: enable IPv6 RA offload */
 	t_u8 enable;
+	/** Number of IPv6 address configured in FW */
+	t_u8 ipv6_addr_count;
 	MrvlIETypes_IPv6AddrParamSet_t ipv6_addr_param;
 } MLAN_PACK_END HostCmd_DS_IPV6_RA_OFFLOAD;
 
@@ -7738,6 +6947,14 @@
 	t_u8 tlv_buffer[];
 	/**MrvlIEtypes_channel_band_t band_channel; */
 } MLAN_PACK_END HostCmd_DS_STA_CONFIGURE;
+
+/** Event_Link_Lost structure */
+typedef MLAN_PACK_START struct _Event_Link_Lost {
+	/** Reason code */
+	t_u16 reason_code;
+	/** bssid of Link Lost AP */
+	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END Event_Link_Lost;
 #endif
 
 /** HostCmd_DS_AUTO_TX structure */
@@ -7750,9 +6967,6 @@
 
 #define OID_CLOUD_KEEP_ALIVE 0
 #define EVENT_CLOUD_KEEP_ALIVE_RETRY_FAIL 0x00000085
-/** TLV for cloud keep alive control info */
-#define TLV_TYPE_CLOUD_KEEP_ALIVE                                              \
-	(PROPRIETARY_TLV_BASE_ID + 0x102) /* 0x0100 + 258 */
 typedef MLAN_PACK_START struct _MrvlIEtypes_Cloud_Keep_Alive_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
@@ -7764,9 +6978,6 @@
 	t_u8 tlv[];
 } MLAN_PACK_END MrvlIEtypes_Cloud_Keep_Alive_t;
 
-/** TLV for cloud keep alive control info */
-#define TLV_TYPE_KEEP_ALIVE_CTRL                                               \
-	(PROPRIETARY_TLV_BASE_ID + 0x103) /* 0x0100 + 259 */
 typedef MLAN_PACK_START struct _MrvlIEtypes_Keep_Alive_Ctrl_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
@@ -7778,9 +6989,6 @@
 	t_u16 retry_count;
 } MLAN_PACK_END MrvlIEtypes_Keep_Alive_Ctrl_t;
 
-/** TLV for cloud keep alive packet */
-#define TLV_TYPE_KEEP_ALIVE_PKT                                                \
-	(PROPRIETARY_TLV_BASE_ID + 0x104) /* 0x0100 + 260 */
 typedef MLAN_PACK_START struct _MrvlIEtypes_Keep_Alive_Pkt_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
@@ -7790,8 +6998,20 @@
 	t_u8 ip_packet[];
 } MLAN_PACK_END MrvlIEtypes_Keep_Alive_Pkt_t;
 
-/** TLV to indicate firmware only keep probe response while scan */
-#define TLV_TYPE_ONLYPROBERESP (PROPRIETARY_TLV_BASE_ID + 0xE9) /* 0x01E9 */
+#define OID_CLOUD_KEEP_ALIVE_ACK 1
+
+typedef MLAN_PACK_START struct _MrvlIEtypes_Cloud_Keep_Alive_Rx_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** ID for cloud keep alive */
+	t_u8 keep_alive_id;
+	/** Enable/disable for this ID */
+	t_u8 enable;
+	/** Ethernet Header */
+	Eth803Hdr_t eth_header;
+	/** packet buffer*/
+	t_u8 ip_packet[];
+} MLAN_PACK_END MrvlIEtypes_Cloud_Keep_Alive_Rx_t;
 typedef MLAN_PACK_START struct _MrvlIEtypes_OnlyProberesp_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
@@ -7799,93 +7019,208 @@
 	t_u8 proberesp_only;
 } MLAN_PACK_END MrvlIEtypes_OnlyProberesp_t;
 
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-#define HostCmd_CMD_CRYPTO 0x025e
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTRangeRequest_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Peer device MAC address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	t_u8 type;
+	/** peer device hint (STA, P2P, AP) */
+	t_u8 peer;
+	/** channel number */
+	t_u8 channel;
+	/** Band Config */
+	Band_Config_t bandcfg;
+	/** Time interval between bursts (units: 100 ms) */
+	t_u8 burst_period;
+	/** Total number of RTT bursts to be executed. */
+	t_u8 num_burst;
+	/** num of frames per burst. */
+	t_u8 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. */
+	t_u8 num_retries_per_rtt_frame;
+	/** Maximum number of retries that the initiator can retry an FTMR
+	 * frame. */
+	t_u8 num_retries_per_ftmr;
+	/** LCI request */
+	t_u8 LCI_request;
+	/** LCR request */
+	t_u8 LCR_request;
+	/** burst duration */
+	t_u8 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	t_u8 preamble;
+	/** RTT BW to be used in the RTT frames */
+	t_u8 bw;
+} MLAN_PACK_END MrvlIEtypes_RTTRangeRequest_t;
 
-#define HostCmd_CMD_CRYPTO_SUBCMD_PRF_HMAC_SHA1 (0x1)
-#define HostCmd_CMD_CRYPTO_SUBCMD_HMAC_SHA1 (0x2)
-#define HostCmd_CMD_CRYPTO_SUBCMD_HMAC_SHA256 (0x3)
-#define HostCmd_CMD_CRYPTO_SUBCMD_SHA256 (0x4)
-#define HostCmd_CMD_CRYPTO_SUBCMD_RIJNDAEL (0x5)
-#define HostCmd_CMD_CRYPTO_SUBCMD_RC4 (0x6)
-#define HostCmd_CMD_CRYPTO_SUBCMD_MD5 (0x7)
-#define HostCmd_CMD_CRYPTO_SUBCMD_MRVL_F (0x8)
-#define HostCmd_CMD_CRYPTO_SUBCMD_SHA256_KDF (0x9)
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTRangeCancel_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Peer device MAC address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END MrvlIEtypes_RTTRangeCancel_t;
 
-#define TLV_TYPE_CRYPTO_KEY (PROPRIETARY_TLV_BASE_ID + 308)
-#define TLV_TYPE_CRYPTO_KEY_IV (PROPRIETARY_TLV_BASE_ID + 309)
-#define TLV_TYPE_CRYPTO_KEY_PREFIX (PROPRIETARY_TLV_BASE_ID + 310)
-#define TLV_TYPE_CRYPTO_KEY_DATA_BLK (PROPRIETARY_TLV_BASE_ID + 311)
-
-/** MrvlIEParamSet_t */
-typedef MLAN_PACK_START struct {
-	/** Type */
-	t_u16 Type;
-	/** Length */
-	t_u16 Length;
-} MLAN_PACK_END MrvlIEParamSet_t;
-
-/** HostCmd_DS_CRYPTO */
-typedef MLAN_PACK_START struct _HostCmd_DS_CRYPTO {
-	/** action */
+typedef MLAN_PACK_START struct _HostCmd_DS_FTM_CONFIG_SESSION_PARAMS {
+	/** Action */
 	t_u16 action;
-	/** subCmdCode */
-	t_u8 subCmdCode;
-	/** subCmd start */
-	t_u8 subCmd[];
-} MLAN_PACK_END HostCmd_DS_CRYPTO;
+	/** TLV buffer */
+	/** MrvlIEtypes_RTTRangeRequest_t */
+	/** MrvlIEtypes_RTTRangeCancel_t */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END HostCmd_DS_FTM_CONFIG_SESSION_PARAMS;
 
-/** subcmd_prf_hmac_sha1 used by prf_hmac_sha1, md5 and sha256_kdf */
-typedef MLAN_PACK_START struct _subcmd_prf_hmac_sha1 {
-	/** output_len */
-	t_u16 output_len;
-	/** tlv start */
-	t_u8 tlv[];
-} MLAN_PACK_END subcmd_prf_hmac_sha1_t, subcmd_md5_t, subcmd_sha256_kdf_t;
+typedef MLAN_PACK_START struct _WLS_Sub_Event_RTTResults_t {
+	/** complete */
+	t_u8 complete;
+	/** tlv buffer */
+	/** MrvlIEtypes_RTTResult_t */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END WLS_SUB_EVENT_RTTResults_t;
 
-/** subcmd_hmac_sha1 used by hmac_sha1, hmac_sha256, sha256 */
-typedef MLAN_PACK_START struct _subcmd_hmac_sha1 {
-	/** output_len */
-	t_u16 output_len;
-	/** number of data blocks */
-	t_u16 data_blks_nr;
-	/** tlv start */
-	t_u8 tlv[];
-} MLAN_PACK_END subcmd_hmac_sha1_t, subcmd_hmac_sha256_t, subcmd_sha256_t;
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTResult_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Peer device MAC address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** burst number in a multi-burst request */
+	t_u32 burst_num;
+	/** Total RTT measurement frames attempted */
+	t_u32 measurement_number;
+	/** Total successful RTT measurement frames */
+	t_u32 success_number;
+	/** Maximum number of "FTM frames per burst" supported by the responder
+	 * STA. */
+	t_u8 number_per_burst_peer;
+	/** ranging status */
+	t_u8 status;
+	/** The time provided by the responder when the request can be tried
+	 * again. */
+	t_u8 retry_after_duration;
+	/** RTT type */
+	t_u8 type;
+	/** average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB */
+	t_s32 rssi;
+	/** rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
+	 */
+	t_s32 rssi_spread;
+	/** TX rate */
+	mlan_wifi_rate tx_rate;
+	/** RX rate */
+	mlan_wifi_rate rx_rate;
+	/** round trip time in picoseconds */
+	t_s64 rtt;
+	/** rtt standard deviation in picoseconds */
+	t_s64 rtt_sd;
+	/** difference between max and min rtt times recorded in picoseconds */
+	t_s64 rtt_spread;
+	/** distance in mm (optional) */
+	t_s32 distance_mm;
+	/** standard deviation in mm (optional) */
+	t_s32 distance_sd_mm;
+	/** difference between max and min distance recorded in mm (optional) */
+	t_s32 distance_spread_mm;
+	/** time of the measurement (in microseconds since boot) */
+	t_s64 ts;
+	/** in ms, actual time taken by the FW to finish one burst */
+	t_s32 burst_duration;
+	/** Number of bursts allowed by the responder. */
+	t_s32 negotiated_burst_num;
+	/** tlv buffer */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END MrvlIEtypes_RTTResult_t;
 
-/** subcmd_rijndael, used by rijndael */
-typedef MLAN_PACK_START struct _subcmd_rijndael {
-	/** output_len */
-	t_u16 output_len;
-	/** sub action code */
-	t_u8 sub_action_code;
-	/** tlv start */
-	t_u8 tlv[];
-} MLAN_PACK_END subcmd_rijndael_t;
+/** TLV for IEEEI IE */
+typedef MLAN_PACK_START struct _MrvlIEtypes_IEEEIE_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** data */
+	t_u8 data[];
+} MLAN_PACK_END MrvlIEtypes_IEEEIE_t;
 
-/** subcmd_rc4, used by rc4 */
-typedef MLAN_PACK_START struct _subcmd_rc4 {
-	/** output_len */
-	t_u16 output_len;
-	/** skip bytes */
-	t_u16 skip_bytes;
-	/** tlv start */
-	t_u8 tlv[];
-} MLAN_PACK_END subcmd_rc4_t;
+/** auto link switch network info */
+typedef MLAN_PACK_START struct _Event_WLS_FTM_t {
+	/** Event ID */
+	t_u16 event_id;
+	/** BSS index number for multiple BSS support */
+	t_u8 bss_index;
+	/** BSS type */
+	t_u8 bss_type;
+	/** sub event id */
+	t_u8 sub_event_id;
+	union {
+		/** RTT Results Sub Event */
+		WLS_SUB_EVENT_RTTResults_t rtt_results;
+	} u;
+} MLAN_PACK_END Event_WLS_FTM_t;
 
-/** subcmd_mrvf_f, used by mrvl_f*/
-typedef MLAN_PACK_START struct _subcmd_mrvf_f {
-	/** output_len */
-	t_u16 output_len;
-	/** iterations */
-	t_u32 iterations;
-	/** count */
-	t_u32 count;
-	/** tlv start */
-	t_u8 tlv[];
-} MLAN_PACK_END subcmd_mrvl_f_t;
+typedef MLAN_PACK_START struct _HostCmd_DS_FTM_CONFIG_RESPONDER {
+	/** Action */
+	t_u16 action;
+	/** TLV buffer */
+	/** MrvlIEtypes_RTTResponderInfo_t */
+	/** MrvlIEtypes_RTTResponderEnCfg_t */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END HostCmd_DS_FTM_CONFIG_RESPONDER;
 
-#endif
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTResponderInfo_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** channel */
+	t_u8 channel;
+	/** bandcfg */
+	Band_Config_t bandcfg;
+	/** bandcfg */
+	t_u8 preamble;
+} MLAN_PACK_END MrvlIEtypes_RTTResponderInfo_t;
+
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTResponderEnCfg_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** channel */
+	t_u8 channel;
+	/** bandcfg */
+	Band_Config_t bandcfg;
+	/** bandcfg */
+	t_u32 max_duration_seconds;
+} MLAN_PACK_END MrvlIEtypes_RTTResponderEnCfg_t;
+
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTLCICfg_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** latitude */
+	t_u64 latitude;
+	/** longitude */
+	t_u64 longitude;
+	/** altitude */
+	t_u32 altitude;
+	/** latitude_unc */
+	t_u8 latitude_unc;
+	/** longitude_unc */
+	t_u8 longitude_unc;
+	/** altitude_unc */
+	t_u8 altitude_unc;
+	/** motion_pattern */
+	t_u8 motion_pattern;
+	/** floor */
+	t_u32 floor;
+	/** height_above_floor */
+	t_u32 height_above_floor;
+	/** height_unc */
+	t_u32 height_unc;
+} MLAN_PACK_END MrvlIEtypes_RTTLCICfg_t;
+
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTLCRCfg_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** country_code */
+	char country_code[2];
+	/** length of the info field */
+	t_u32 length;
+	/** Civic info to be copied in FTM frame */
+	char civic_info[256];
+} MLAN_PACK_END MrvlIEtypes_RTTLCRCfg_t;
 
 #ifdef UAP_SUPPORT
 /** action add station */
@@ -7908,10 +7243,6 @@
 	t_u8 tlv[];
 } MLAN_PACK_END HostCmd_DS_ADD_STATION;
 
-/** Host Command ID : Add New Station */
-#define HostCmd_CMD_ADD_NEW_STATION 0x025f
-/** TLV id: station flag */
-#define TLV_TYPE_UAP_STA_FLAGS (PROPRIETARY_TLV_BASE_ID + 313)
 /**MrvlIEtypes_Sta_Flag_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_StaFlag_t {
 	/** Header */
@@ -7942,6 +7273,16 @@
 	/** rx weak rssi pkt threshold */
 	t_s8 rssi_threshold;
 } MLAN_PACK_END HostCmd_DS_CMD_RX_ABORT_CFG;
+
+/** HostCmd_CMD_OFDM_DESENSE_CFG */
+typedef MLAN_PACK_START struct _HostCmd_DS_CMD_OFDM_DESENSE_CFG {
+	/** Action */
+	t_u16 action;
+	/** Enable/disable cca desense on pkt  */
+	t_u8 enable;
+	/**  cca pkt threshold */
+	t_s8 cca_threshold;
+} MLAN_PACK_END HostCmd_DS_CMD_OFDM_DESENSE_CFG;
 /** HostCmd_CMD_RX_ABORT_CFG_EXT */
 typedef MLAN_PACK_START struct _HostCmd_DS_CMD_RX_ABORT_CFG_EXT {
 	/** Action */
@@ -7952,8 +7293,45 @@
 	t_s8 rssi_margin;
 	/** specify ceil rssi threshold */
 	t_s8 ceil_rssi_threshold;
+	/** specify floor rssi threshold */
+	t_s8 floor_rssi_threshold;
+	/** current dynamic rssi threshold */
+	t_s8 current_dynamic_rssi_threshold;
+	/** rssi config: default or user configured */
+	t_u8 rssi_default_config;
+	/** EDMAC status */
+	t_u8 edmac_enable;
 } MLAN_PACK_END HostCmd_DS_CMD_RX_ABORT_CFG_EXT;
 
+/** HostCmd_CMD_NAV_MITIGATION_CFG */
+typedef MLAN_PACK_START struct _HostCmd_DS_CMD_NAV_MITIGATION_CFG {
+	/** Action */
+	t_u16 action;
+	/** start/stop nav mitigation */
+	t_u16 start_nav_mitigation;
+	/** Duration value in us to set as threshold in ACT_SET action */
+	t_u16 threshold;
+	/** Counter for NAV mitigation detected */
+	t_u16 detect_cnt;
+	/** Counter for NAV mitigation stopped */
+	t_u16 stop_cnt;
+} MLAN_PACK_END HostCmd_DS_CMD_NAV_MITIGATION_CFG;
+
+typedef MLAN_PACK_START struct _HostCmd_DS_CMD_LED_CFG {
+	t_u16 action;
+	t_u8 enable;
+	t_u8 numled;
+} MLAN_PACK_END HostCmd_DS_CMD_LED_CFG;
+
+/* TLV 0x109 LED Behavior */
+typedef MLAN_PACK_START struct {
+	MrvlIEtypesHeader_t header;
+	t_u8 firmwarestate;
+	t_u8 reserved;
+	t_u8 ledstate;
+	t_u8 ledargs;
+} MLAN_PACK_END MrvlIEtypes_led_behavior_t;
+
 /** HostCmd_CMD_ARB_CONFIG */
 typedef MLAN_PACK_START struct _HostCmd_DS_CMD_ARB_CONFIG {
 	/** Action */
@@ -8010,6 +7388,82 @@
 	t_u8 num_off_intervals;
 } MLAN_PACK_END HostCmd_DS_CMD_CCK_DESENSE_CFG;
 
+/** HostCmd_DS_80211_TX_FRAME */
+typedef MLAN_PACK_START struct _HostCmd_DS_80211_TX_FRAME {
+	/** Action Set or get */
+	t_u16 action;
+	/** status */
+	t_u16 status;
+	/** BandConfig */
+	t_u8 band_config;
+	/** channel */
+	t_u8 channel;
+	/** reserved */
+	t_u32 reserved;
+	/** buffer include TxPD and full Tx packet */
+	t_u8 buffer[];
+} MLAN_PACK_END HostCmd_DS_80211_TX_FRAME;
+
+/* edmac configuration: HostCmd_DS_EDMAC_CFG*/
+typedef MLAN_PACK_START struct _HostCmd_DS_EDMAC_CFG {
+	/** EU adaptivity for 2.4ghz band */
+	t_u16 ed_ctrl_2g;
+	/** Energy detect threshold offset for 2.4ghz */
+	t_s16 ed_offset_2g;
+	/** EU adaptivity for 5ghz band */
+	t_u16 ed_ctrl_5g;
+	/** Energy detect threshold offset for 5ghz */
+	t_s16 ed_offset_5g;
+
+	t_u32 ed_bitmap_txq_lock;
+} MLAN_PACK_END HostCmd_DS_EDMAC_CFG;
+
+/* Auth, Assoc Timeout configuration: HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG */
+typedef MLAN_PACK_START struct _HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG {
+	/** Action */
+	t_u16 action;
+	/** auth timeout */
+	t_u16 auth_timeout;
+	/** Auth retry timeout if received ack */
+	t_u16 auth_retry_timeout_if_ack;
+	/** Auth retry timeout if ack is not received */
+	t_u16 auth_retry_timeout_if_no_ack;
+	/** assoc timeout */
+	t_u16 assoc_timeout;
+	/** reassoc timeout */
+	t_u16 reassoc_timeout;
+	/** assoc/reassoc frame retry timeout if ack received */
+	t_u16 retry_timeout;
+} MLAN_PACK_END HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG;
+
+/* maximum number of STAs HostCmd_CMD_802_11_STA_TX_RATE can have */
+enum { MAX_STA_IN_TX_RATE_REQ = 32 };
+
+/** HostCmd_CMD_802_11_STA_TX_RATE */
+typedef MLAN_PACK_START struct _HostCmd_CMD_802_11_STA_TX_RATE {
+	struct {
+		/** STA`s MAC */
+		t_u8 sta_mac[MLAN_MAC_ADDR_LENGTH];
+		/** TX rate */
+		HostCmd_TX_RATE_QUERY rate;
+	} entry[MAX_STA_IN_TX_RATE_REQ];
+
+	/** actual number of entries in array */
+	t_u16 num_entries;
+} HostCmd_CMD_802_11_STA_TX_RATE;
+
+/** HostCmd_MCLIENT_SCHEDULE_CFG */
+typedef MLAN_PACK_START struct _HostCmd_MCLIENT_SCHEDULE_CFG {
+	/** action - get/set */
+	t_u16 action;
+
+	/** enable multi-client scheduliing */
+	t_u8 mclient_enable;
+
+	/** enable PS mode change reporting */
+	t_u8 ps_mode_change_report;
+} HostCmd_MCLIENT_SCHEDULE_CFG;
+
 /** HostCmd_DS_COMMAND */
 typedef struct MLAN_PACK_START _HostCmd_DS_COMMAND {
 	/** Command Header : Command */
@@ -8067,11 +7521,12 @@
 		/** RF antenna */
 		HostCmd_DS_802_11_RF_ANTENNA antenna;
 
-		/** CW Mode: Tx CW Level control */
-		HostCmd_DS_CW_MODE_CTRL cwmode;
+		/** Function Init */
+		HostCmd_DS_FUNC_INIT func_init;
 		/** Enhanced power save command */
 		HostCmd_DS_802_11_PS_MODE_ENH psmode_enh;
 		HostCmd_DS_802_11_HS_CFG_ENH opt_hs_cfg;
+		HostCmd_DS_802_11_FW_WAKEUP_METHOD fwwakeupmethod;
 		/** Scan */
 		HostCmd_DS_802_11_SCAN scan;
 		/** Extended Scan */
@@ -8094,14 +7549,6 @@
 		HostCmd_DS_802_11_ASSOCIATE_RSP associate_rsp;
 		/** Deauthenticate */
 		HostCmd_DS_802_11_DEAUTHENTICATE deauth;
-		/** Ad-Hoc start */
-		HostCmd_DS_802_11_AD_HOC_START adhoc_start;
-		/** Ad-Hoc start result */
-		HostCmd_DS_802_11_AD_HOC_START_RESULT adhoc_start_result;
-		/** Ad-Hoc join result */
-		HostCmd_DS_802_11_AD_HOC_JOIN_RESULT adhoc_join_result;
-		/** Ad-Hoc join */
-		HostCmd_DS_802_11_AD_HOC_JOIN adhoc_join;
 		/** Domain information */
 		HostCmd_DS_802_11D_DOMAIN_INFO domain_info;
 		/** Domain information response */
@@ -8157,8 +7604,6 @@
 		HostCmd_DS_802_11_SUPPLICANT_PROFILE esupplicant_profile;
 		/** Extended version */
 		HostCmd_DS_VERSION_EXT verext;
-		/** Adhoc Coalescing */
-		HostCmd_DS_802_11_IBSS_STATUS ibss_coalescing;
 		/** Mgmt IE list configuration */
 		HostCmd_DS_MGMT_IE_LIST_CFG mgmt_ie_list;
 		/** TDLS configuration command */
@@ -8214,6 +7659,9 @@
 		HostCmd_DS_PCIE_HOST_BUF_DETAILS pcie_host_spec;
 #endif
 #endif
+#if defined(PCIE)
+		HostCmd_DS_PCIE_ADMA_INIT pcie_adma_config;
+#endif
 		HostCmd_DS_REMAIN_ON_CHANNEL remain_on_chan;
 #ifdef WIFI_DIRECT_SUPPORT
 		HostCmd_DS_WIFI_DIRECT_MODE wifi_direct_mode;
@@ -8246,7 +7694,10 @@
 		HostCmd_DS_802_11_PS_INACTIVITY_TIMEOUT ps_inact_tmo;
 		HostCmd_DS_ROAM_OFFLOAD roam_offload;
 		HostCmd_DS_CHAN_REGION_CFG reg_cfg;
+		HostCmd_DS_REGION_POWER_CFG rg_power_cfg;
 		HostCmd_DS_AUTO_TX auto_tx;
+		HostCmd_DS_FTM_CONFIG_SESSION_PARAMS ftm_config;
+		HostCmd_DS_FTM_CONFIG_RESPONDER ftm_rtt_responder;
 		HostCmd_DS_DYN_BW dyn_bw;
 		HostCmd_DS_802_11_ROBUSTCOEX robustcoexparams;
 		HostCmd_DS_DMCS_CFG dmcs;
@@ -8256,10 +7707,6 @@
 		HostCmd_DS_CSI_CFG csi_params;
 		/** boot sleep configure */
 		HostCmd_DS_BOOT_SLEEP boot_sleep;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-		/** crypto cmd */
-		HostCmd_DS_CRYPTO crypto_cmd;
-#endif
 #ifdef UAP_SUPPORT
 		/** Add station cmd */
 		HostCmd_DS_ADD_STATION sta_info;
@@ -8273,7 +7720,10 @@
 		HostCmd_DS_TWT_CFG twtcfg;
 
 		HostCmd_DS_CMD_RX_ABORT_CFG rx_abort_cfg;
+		HostCmd_DS_CMD_OFDM_DESENSE_CFG ofdm_desense_cfg;
 		HostCmd_DS_CMD_RX_ABORT_CFG_EXT rx_abort_cfg_ext;
+		HostCmd_DS_CMD_NAV_MITIGATION_CFG nav_mitigation;
+		HostCmd_DS_CMD_LED_CFG ledcntrcfg;
 		HostCmd_DS_CMD_TX_AMPDU_PROT_MODE tx_ampdu_prot_mode;
 		HostCmd_DS_CMD_RATE_ADAPT_CFG rate_adapt_cfg;
 		HostCmd_DS_CMD_CCK_DESENSE_CFG cck_desense_cfg;
@@ -8287,6 +7737,8 @@
 		struct mfg_cmd_tx_frame2 mfg_tx_frame2;
 		struct mfg_Cmd_HE_TBTx_t mfg_he_power;
 		mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t mfg_tx_trigger_config;
+		mfg_cmd_otp_mac_addr_rd_wr_t mfg_otp_mac_addr_rd_wr;
+		mfg_cmd_otp_cal_data_rd_wr_t mfg_otp_cal_data_rd_wr;
 		HostCmd_DS_CMD_ARB_CONFIG arb_cfg;
 		HostCmd_DS_CMD_DOT11MC_UNASSOC_FTM_CFG dot11mc_unassoc_ftm_cfg;
 		HostCmd_DS_HAL_PHY_CFG hal_phy_cfg_params;
@@ -8294,6 +7746,22 @@
 		HostCmd_DS_MC_AGGR_CFG mc_aggr_cfg;
 		HostCmd_DS_STATS stats;
 		HostCmd_DS_GET_CH_LOAD ch_load;
+		HostCmd_DS_CROSS_CHIP_SYNCH cross_chip_synch;
+		HostCmd_DS_TSP_CFG tsp_cfg;
+		HostCmd_DS_80211_TX_FRAME tx_frame;
+
+		HostCmd_DS_EDMAC_CFG ed_mac_cfg;
+		HostCmd_gpio_cfg_ops gpio_cfg_ops;
+
+		HostCmd_CMD_802_11_STA_TX_RATE sta_rx_rate;
+		HostCmd_MCLIENT_SCHEDULE_CFG mclient_cfg;
+
+		/** WMM HOST ADDTS */
+		HostCmd_DS_WMM_HOST_ADDTS_REQ host_add_ts;
+		/** WMM HOST DELTS */
+		HostCmd_DS_WMM_HOST_DELTS_REQ host_del_ts;
+		/** Auth, (Re)Assoc timeout configuration */
+		HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG auth_assoc_cfg;
 	} params;
 } MLAN_PACK_END HostCmd_DS_COMMAND, *pHostCmd_DS_COMMAND;
 
@@ -8330,6 +7798,11 @@
 	t_u64 uuid_hi;
 } MLAN_PACK_END MrvlIEtypes_Secure_Boot_Uuid_t;
 
+typedef MLAN_PACK_START struct _MrvlIEtypes_PsStaStatus_t {
+	t_u8 mac[MLAN_MAC_ADDR_LENGTH];
+	t_u8 sleep;
+} MLAN_PACK_END MrvlIEtypes_PsStaStatus_t;
+
 /** req host side download vdll block */
 #define VDLL_IND_TYPE_REQ 0
 /** notify vdll start offset in firmware image */
@@ -8338,18 +7811,53 @@
 #define VDLL_IND_TYPE_ERR_SIG 2
 /** notify vdll download error: ID error */
 #define VDLL_IND_TYPE_ERR_ID 3
+/** notify vdll download error: Secure error */
+#define VDLL_IND_TYPE_SEC_ERR_ID 4
+/** req host side interface reset */
+#define VDLL_IND_TYPE_INTF_RESET 5
 
 /** vdll indicate event structure */
 typedef MLAN_PACK_START struct _vdll_ind {
 	/*VDLL ind type*/
 	t_u16 type;
-	/*reserved*/
-	t_u16 reserved;
+	/*vdllId*/
+	t_u16 vdllId;
 	/*indicate the offset downloaded so far*/
 	t_u32 offset;
 	/*VDLL block size*/
 	t_u16 block_len;
 } MLAN_PACK_END vdll_ind, *pvdll_ind;
+
+typedef MLAN_PACK_START struct _MrvlIEtypes_MclientFwCaps_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+
+	/* max number of supported TX BA streams */
+	t_u32 tx_ba_stream_limit;
+
+	/* estimated FW MPDU PPS performance */
+	t_u32 tx_mpdu_with_amsdu_pps;
+	t_u32 tx_mpdu_no_amsdu_pps;
+
+	/* timeout support for TX BA */
+	t_u8 tx_ba_timeout_support;
+
+	t_u8 __padding[3];
+} MLAN_PACK_END MrvlIEtypes_MclientFwCaps_t;
+
+/** Fw custom data structure */
+typedef struct MLAN_PACK_START _fw_data_t {
+	t_u8 *fw_data_buffer;
+	t_u8 fw_data_buffer_len;
+} MLAN_PACK_END fw_data_t;
+
+typedef enum _BLOCK_6G_CHAN_SWITCH_REASON {
+	BLOCK_6G_CHAN_SWITCH_REASON_MMH = 1,
+	BLOCK_6G_CHAN_SWITCH_REASON_MMH_STA = 2,
+	BLOCK_6G_CHAN_SWITCH_REASON_STA_MMH = 3,
+	BLOCK_6G_CHAN_SWITCH_REASON_STA_RX_ECSA = 4,
+} BLOCK_6G_CHAN_SWITCH_REASON;
+
 #ifdef PRAGMA_PACK
 #pragma pack(pop)
 #endif
diff --git a/wlan_src/mlan/mlan_hostcmd_ids.h b/wlan_src/mlan/mlan_hostcmd_ids.h
new file mode 100644
index 0000000..3a9c2b6
--- /dev/null
+++ b/wlan_src/mlan/mlan_hostcmd_ids.h
@@ -0,0 +1,490 @@
+/** @file mlan_hostcmd_ids.h
+ *
+ *  @brief This file contains host command ID definitions.
+ *
+ *
+ *  Copyright 2023-2024 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/* include guard is absent intentionally */
+
+/** Firmware Host Command ID Constants */
+/** Host Command ID : Get hardware specifications */
+ENUM_ELEMENT(HostCmd_CMD_GET_HW_SPEC, 0x0003),
+	/** Host Command ID : 802.11 scan */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_SCAN, 0x0006),
+	/** Host Command ID : 802.11 get log */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_GET_LOG, 0x000b),
+
+	/** Host Command id: GET_TX_RX_PKT_STATS */
+	ENUM_ELEMENT(HostCmd_CMD_TX_RX_PKT_STATS, 0x008d),
+
+	/** Host Command ID : 802.11 get/set link layer statistic */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_LINK_STATS, 0x0256),
+
+	/** Host Command ID : MAC multicast address */
+	ENUM_ELEMENT(HostCmd_CMD_MAC_MULTICAST_ADR, 0x0010),
+	/** Host Command ID : 802.11 EEPROM access */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_EEPROM_ACCESS, 0x0059),
+	/** Host Command ID : 802.11 associate */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_ASSOCIATE, 0x0012),
+
+	/** Host Command ID : 802.11 SNMP MIB */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_SNMP_MIB, 0x0016),
+	/** Host Command ID : MAC register access */
+	ENUM_ELEMENT(HostCmd_CMD_MAC_REG_ACCESS, 0x0019),
+	/** Host Command ID : BBP register access */
+	ENUM_ELEMENT(HostCmd_CMD_BBP_REG_ACCESS, 0x001a),
+	/** Host Command ID : RF register access */
+	ENUM_ELEMENT(HostCmd_CMD_RF_REG_ACCESS, 0x001b),
+
+	/** Host Command ID : 802.11 radio control */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_RADIO_CONTROL, 0x001c),
+	/** Host Command ID : 802.11 RF channel */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_RF_CHANNEL, 0x001d),
+	/** Host Command ID : 802.11 RF Tx power */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_RF_TX_POWER, 0x001e),
+
+	/** Host Command ID : 802.11 RF antenna */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_RF_ANTENNA, 0x0020),
+
+	/** Host Command ID : 802.11 deauthenticate */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_DEAUTHENTICATE, 0x0024),
+	/** Host Command ID: 802.11 disassoicate */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_DISASSOCIATE, 0x0026),
+	/** Host Command ID : MAC control */
+	ENUM_ELEMENT(HostCmd_CMD_MAC_CONTROL, 0x0028),
+
+	/** Host Command ID : 802.11 key material */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_KEY_MATERIAL, 0x005e),
+
+	/** Host Command ID : GPIO Configuration */
+	ENUM_ELEMENT(HostCmd_CMD_GPIO_CFG, 0x0041),
+
+	/** Host Command ID : 802.22 MAC address */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_MAC_ADDRESS, 0x004D),
+
+	/** Host Command ID : LED control config  */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_LED_CONTROL, 0x004E),
+
+	/** Host Command ID : WMM Traffic Stream Status */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_TS_STATUS, 0x005d),
+
+	/** Host Command ID : 802.11 D domain information */
+	ENUM_ELEMENT(HostCmd_CMD_802_11D_DOMAIN_INFO, 0x005b),
+
+	/*This command gets/sets the Transmit Rate-based Power Control (TRPC)
+	 * channel configuration.*/
+	ENUM_ELEMENT(HostCmd_CMD_CHANNEL_TRPC_CONFIG, 0x00fb),
+
+	/** Host Command ID : 802.11 TPC information */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_TPC_INFO, 0x005f),
+	/** Host Command ID : 802.11 TPC adapt req */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_TPC_ADAPT_REQ, 0x0060),
+	/** Host Command ID : 802.11 channel SW ann */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_CHAN_SW_ANN, 0x0061),
+
+	/** Host Command ID : Measurement request */
+	ENUM_ELEMENT(HostCmd_CMD_MEASUREMENT_REQUEST, 0x0062),
+	/** Host Command ID : Measurement report */
+	ENUM_ELEMENT(HostCmd_CMD_MEASUREMENT_REPORT, 0x0063),
+
+	/** Host Command ID : 802.11 sleep parameters */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_SLEEP_PARAMS, 0x0066),
+
+	/** Host Command ID : 802.11 ps inactivity timeout */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_PS_INACTIVITY_TIMEOUT, 0x0067),
+
+	/** Host Command ID : 802.11 sleep period */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_SLEEP_PERIOD, 0x0068),
+
+	/** Host Command ID: 802.11 BG scan config */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_BG_SCAN_CONFIG, 0x006b),
+	/** Host Command ID : 802.11 BG scan query */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_BG_SCAN_QUERY, 0x006c),
+
+	/** Host Command ID : WMM ADDTS req */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_ADDTS_REQ, 0x006E),
+	/** Host Command ID : WMM DELTS req */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_DELTS_REQ, 0x006F),
+	/** Host Command ID : WMM queue configuration */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_QUEUE_CONFIG, 0x0070),
+	/** Host Command ID : 802.11 get status */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_GET_STATUS, 0x0071),
+
+	/** Host Command ID : 802.11 firmware wakeup method */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_FW_WAKE_METHOD, 0x0074),
+	/** Host Command ID : 802.11 subscribe event */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_SUBSCRIBE_EVENT, 0x0075),
+
+	/** Host Command ID : 802.11 Tx rate query */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_TX_RATE_QUERY, 0x007f),
+	/** Host Command ID :Get timestamp value */
+	ENUM_ELEMENT(HostCmd_CMD_GET_TSF, 0x0080),
+
+	/** Host Command ID : WMM queue stats */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_QUEUE_STATS, 0x0081),
+
+	/** Host Command ID : KEEP ALIVE command */
+	ENUM_ELEMENT(HostCmd_CMD_AUTO_TX, 0x0082),
+
+	/** Host Command ID : Memory access */
+	ENUM_ELEMENT(HostCmd_CMD_MEM_ACCESS, 0x0086),
+
+#if defined(SDIO)
+	/** Host Command ID : SDIO GPIO interrupt configuration */
+	ENUM_ELEMENT(HostCmd_CMD_SDIO_GPIO_INT_CONFIG, 0x0088),
+#endif
+
+	/** Host Command ID : Mfg command */
+	ENUM_ELEMENT(HostCmd_CMD_MFG_COMMAND, 0x0089),
+	/** Host Command ID : Inactivity timeout ext */
+	ENUM_ELEMENT(HostCmd_CMD_INACTIVITY_TIMEOUT_EXT, 0x008a),
+
+	/** Host Command ID : DBGS configuration */
+	ENUM_ELEMENT(HostCmd_CMD_DBGS_CFG, 0x008b),
+	/** Host Command ID : Get memory */
+	ENUM_ELEMENT(HostCmd_CMD_GET_MEM, 0x008c),
+
+	/** Host Command ID : Cal data dnld */
+	ENUM_ELEMENT(HostCmd_CMD_CFG_DATA, 0x008f),
+
+	/** Host Command ID : SDIO pull control */
+	ENUM_ELEMENT(HostCmd_CMD_SDIO_PULL_CTRL, 0x0093),
+
+	/** Host Command ID : ECL system clock configuration */
+	ENUM_ELEMENT(HostCmd_CMD_ECL_SYSTEM_CLOCK_CONFIG, 0x0094),
+
+	/** Host Command ID : Extended version */
+	ENUM_ELEMENT(HostCmd_CMD_VERSION_EXT, 0x0097),
+
+	/** Host Command ID : MEF configuration */
+	ENUM_ELEMENT(HostCmd_CMD_MEF_CFG, 0x009a),
+	/** Host Command ID : 802.11 RSSI INFO*/
+	ENUM_ELEMENT(HostCmd_CMD_RSSI_INFO, 0x00a4),
+	/** Host Command ID : Function initialization */
+	ENUM_ELEMENT(HostCmd_CMD_FUNC_INIT, 0x00a9),
+	/** Host Command ID : Function shutdown */
+	ENUM_ELEMENT(HostCmd_CMD_FUNC_SHUTDOWN, 0x00aa),
+
+#ifdef OPCHAN
+	ENUM_ELEMENT(HostCmd_CMD_OPCHAN_CONFIG, 0x00f8),
+	ENUM_ELEMENT(HostCmd_CMD_OPCHAN_CHANGROUP_CONFIG, 0x00f9),
+#endif
+
+	/** Host Command ID : Robustcoex */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_ROBUSTCOEX, 0x00e0),
+
+	/** Host Command ID :EAPOL PKT */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_EAPOL_PKT, 0x012e),
+
+	ENUM_ELEMENT(HostCmd_CMD_EDMAC_CFG, 0x0130),
+
+	/** Host Command ID :MIMO SWITCH **/
+	ENUM_ELEMENT(HostCmd_CMD_802_11_MIMO_SWITCH, 0x0235),
+
+	/** Host Command ID : 802.11 RSSI INFO EXT*/
+	ENUM_ELEMENT(HostCmd_CMD_RSSI_INFO_EXT, 0x0237),
+	/** Host Command ID : ROAMING OFFLOAD TO FW*/
+	ENUM_ELEMENT(HostCmd_CMD_ROAM_OFFLOAD, 0x0245),
+
+	/** Host Command ID: Multi chan config */
+	ENUM_ELEMENT(HostCmd_CMD_MULTI_CHAN_CONFIG, 0x011e),
+	/** Host Command ID: Multi chan policy */
+	ENUM_ELEMENT(HostCmd_CMD_MULTI_CHAN_POLICY, 0x0121),
+	/** Host Command ID: DRCS config */
+	ENUM_ELEMENT(HostCmd_CMD_DRCS_CONFIG, 0x024a),
+
+	/** Host Command ID : Channel report request */
+	ENUM_ELEMENT(HostCmd_CMD_CHAN_REPORT_REQUEST, 0x00dd),
+
+	/** Host Command ID: SUPPLICANT_PMK */
+	ENUM_ELEMENT(HostCmd_CMD_SUPPLICANT_PMK, 0x00c4),
+	/** Host Command ID: SUPPLICANT_PROFILE */
+	ENUM_ELEMENT(HostCmd_CMD_SUPPLICANT_PROFILE, 0x00c5),
+
+	/** Host Command ID : Add Block Ack Request */
+	ENUM_ELEMENT(HostCmd_CMD_11N_ADDBA_REQ, 0x00ce),
+	/** Host Command ID : Delete a Block Ack Request */
+	ENUM_ELEMENT(HostCmd_CMD_11N_CFG, 0x00cd),
+	/** Host Command ID : Add Block Ack Response */
+	ENUM_ELEMENT(HostCmd_CMD_11N_ADDBA_RSP, 0x00cf),
+	/** Host Command ID : Delete a Block Ack Request */
+	ENUM_ELEMENT(HostCmd_CMD_11N_DELBA, 0x00d0),
+	/** Host Command ID: Configure Tx Buf size */
+	ENUM_ELEMENT(HostCmd_CMD_RECONFIGURE_TX_BUFF, 0x00d9),
+	/** Host Command ID: AMSDU Aggr Ctrl */
+	ENUM_ELEMENT(HostCmd_CMD_AMSDU_AGGR_CTRL, 0x00df),
+	/** Host Command ID: 11AC config */
+	ENUM_ELEMENT(HostCmd_CMD_11AC_CFG, 0x0112),
+	/** Host Command ID: Configure TX Beamforming capability */
+	ENUM_ELEMENT(HostCmd_CMD_TX_BF_CFG, 0x0104),
+
+	/** Host Command ID : 802.11 TX power configuration */
+	ENUM_ELEMENT(HostCmd_CMD_TXPWR_CFG, 0x00d1),
+
+	/** Host Command ID : Soft Reset */
+	ENUM_ELEMENT(HostCmd_CMD_SOFT_RESET, 0x00d5),
+
+	/** Host Command ID : 802.11 b/g/n rate configration */
+	ENUM_ELEMENT(HostCmd_CMD_TX_RATE_CFG, 0x00d6),
+
+	/** Host Command ID : Enhanced PS mode */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_PS_MODE_ENH, 0x00e4),
+
+	/** Host command action : Host sleep configuration */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_HS_CFG_ENH, 0x00e5),
+
+	/** Host Command ID : CAU register access */
+	ENUM_ELEMENT(HostCmd_CMD_CAU_REG_ACCESS, 0x00ed),
+
+	/** Host Command ID : mgmt IE list */
+	ENUM_ELEMENT(HostCmd_CMD_MGMT_IE_LIST, 0x00f2),
+
+	ENUM_ELEMENT(HostCmd_CMD_802_11_BAND_STEERING, 0x026f),
+	/*** Host Command ID " MC_AGGR_CFG */
+	ENUM_ELEMENT(HostCmd_CMD_MC_AGGR_CFG, 0x027a),
+	ENUM_ELEMENT(HostCmd_CMD_802_11_STATS, 0x0014),
+	ENUM_ELEMENT(HostCmd_CMD_GET_CH_LOAD, 0x027b),
+
+	/** Host Command ID: CROSS CHIP SYNCH */
+	ENUM_ELEMENT(HostCmd_CMD_CROSS_CHIP_SYNCH, 0x027d),
+
+	ENUM_ELEMENT(HostCmd_CMD_TSP_CFG, 0x0280),
+
+	/** Host Command ID : TDLS configuration */
+	ENUM_ELEMENT(HostCmd_CMD_TDLS_CONFIG, 0x0100),
+	/** Host Command ID : TDLS operation */
+	ENUM_ELEMENT(HostCmd_CMD_TDLS_OPERATION, 0x0122),
+
+	/** Host Command ID : Packet aggregation over host interface */
+	ENUM_ELEMENT(HostCmd_CMD_PACKET_AGGR_OVER_HOST_INTERFACE, 0x0117),
+
+#ifdef SDIO
+	/** Host Command ID : SDIO single port RX aggr */
+	ENUM_ELEMENT(HostCmd_CMD_SDIO_SP_RX_AGGR_CFG, 0x0223),
+#endif
+
+	/** Host Command ID : Extended scan support */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_SCAN_EXT, 0x0107),
+
+	/** Host Command ID : Forward mgmt frame */
+	ENUM_ELEMENT(HostCmd_CMD_RX_MGMT_IND, 0x010c),
+
+#ifdef PCIE
+	/** Host Command ID: Host buffer description */
+	ENUM_ELEMENT(HostCmd_CMD_PCIE_HOST_BUF_DETAILS, 0x00fa),
+#endif
+
+	/** Host Command ID : Set BSS_MODE */
+	ENUM_ELEMENT(HostCmd_CMD_SET_BSS_MODE, 0x00f7),
+
+#ifdef UAP_SUPPORT
+	/**  Host Command id: SYS_INFO */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_SYS_INFO, 0x00ae),
+	/** Host Command id: sys_reset */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_SYS_RESET, 0x00af),
+	/** Host Command id: SYS_CONFIGURE  */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_SYS_CONFIGURE, 0x00b0),
+	/** Host Command id: BSS_START */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_BSS_START, 0x00b1),
+	/** Host Command id: BSS_STOP  */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_BSS_STOP, 0x00b2),
+	/** Host Command id: sta_list */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_STA_LIST, 0x00b3),
+	/** Host Command id: STA_DEAUTH */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_STA_DEAUTH, 0x00b5),
+
+	/** Host Command id: REPORT_MIC */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_REPORT_MIC, 0x00ee),
+	/** Host Command id: UAP_OPER_CTRL */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_OPER_CTRL, 0x0233),
+#endif /* UAP_SUPPORT */
+
+	/** Host Command id: PMIC CONFIGURE*/
+	ENUM_ELEMENT(HostCmd_CMD_PMIC_CONFIGURE, 0x23E),
+
+	/** Host Command ID: 802.11 Network Monitor */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_NET_MONITOR, 0x0102),
+
+	/** Host Command ID: Tx data pause */
+	ENUM_ELEMENT(HostCmd_CMD_CFG_TX_DATA_PAUSE, 0x0103),
+
+#ifdef WIFI_DIRECT_SUPPORT
+	/** Host Command ID: P2P PARAMS CONFIG */
+	ENUM_ELEMENT(HostCmd_CMD_P2P_PARAMS_CONFIG, 0x00ea),
+	/** Host Command ID: WIFI_DIRECT_MODE_CONFIG */
+	ENUM_ELEMENT(HostCmd_CMD_WIFI_DIRECT_MODE_CONFIG, 0x00eb),
+#endif
+
+	/** Host Command ID: GPIO TSF LATCH */
+	ENUM_ELEMENT(HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG, 0x0278),
+	/** Host Command ID: Remain On Channel */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_REMAIN_ON_CHANNEL, 0x010d),
+
+	ENUM_ELEMENT(HostCmd_CMD_COALESCE_CFG, 0x010a),
+
+	/** Host Command ID: GTK REKEY OFFLOAD CFG */
+	ENUM_ELEMENT(HostCmd_CMD_GTK_REKEY_OFFLOAD_CFG, 0x010f),
+
+	/** Host Command ID : OTP user data */
+	ENUM_ELEMENT(HostCmd_CMD_OTP_READ_USER_DATA, 0x0114),
+
+	/** Host Command ID: fw auto reconnect */
+	ENUM_ELEMENT(HostCmd_CMD_FW_AUTO_RECONNECT, 0x0115),
+
+	/** Host Command ID: HS wakeup reason */
+	ENUM_ELEMENT(HostCmd_CMD_HS_WAKEUP_REASON, 0x0116),
+
+	/** Host Command ID: reject addba request */
+	ENUM_ELEMENT(HostCmd_CMD_REJECT_ADDBA_REQ, 0x0119),
+
+	ENUM_ELEMENT(HostCmd_CMD_FW_DUMP_EVENT, 0x0125),
+
+	ENUM_ELEMENT(HostCmd_CMD_CONFIG_LOW_POWER_MODE, 0x0128),
+
+	/** Host Command ID : Target device access */
+	ENUM_ELEMENT(HostCmd_CMD_TARGET_ACCESS, 0x012a),
+
+	/** Host Command ID: BCA device access */
+	ENUM_ELEMENT(HostCmd_CMD_BCA_REG_ACCESS, 0x0272),
+	/** Host Command ID: register device access */
+	ENUM_ELEMENT(HostCmd_CMD_REG_ACCESS, 0x027C),
+
+	/** Host Command ID: DFS repeater mode */
+	ENUM_ELEMENT(HostCmd_CMD_DFS_REPEATER_MODE, 0x012b),
+
+	/** Host Command ID: ACS scan */
+	ENUM_ELEMENT(HostCmd_CMD_APCMD_ACS_SCAN, 0x0224),
+
+	/** Host Command ID: Get sensor temp*/
+	ENUM_ELEMENT(HostCmd_CMD_DS_GET_SENSOR_TEMP, 0x0227),
+
+	/** Host Command ID: NAN Parameters cofiguration */
+	ENUM_ELEMENT(HostCmd_CMD_NAN_PARAMS_CONFIG, 0x0228),
+	/** Host Command ID: NAN mode cofiguration */
+	ENUM_ELEMENT(HostCmd_CMD_NAN_MODE_CONFIG, 0x0229),
+	/** Host Command ID: NAN service discovery functionality */
+	ENUM_ELEMENT(HostCmd_CMD_NAN_SDF, 0x022a),
+	/** Host Command ID: NAN service hash */
+	ENUM_ELEMENT(HostCmd_CMD_NAN_SERVICE_HASH, 0x022b),
+	/** Host Command ID: NAN service state info (get/set) */
+	ENUM_ELEMENT(HostCmd_CMD_NAN_STATE_INFO, 0x022c),
+
+	/** Host Command ID : Configure ADHOC_OVER_IP parameters */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_PARAM_CONFIG, 0x023a),
+
+	ENUM_ELEMENT(HostCmd_CMD_IPV6_RA_OFFLOAD_CFG, 0x0238),
+
+#ifdef STA_SUPPORT
+	/** Host Command ID :  set/get sta configure */
+	ENUM_ELEMENT(HostCmd_CMD_STA_CONFIGURE, 0x023f),
+#endif
+
+	/** Host Command ID : GPIO independent reset configure */
+	ENUM_ELEMENT(HostCmd_CMD_INDEPENDENT_RESET_CFG, 0x0243),
+
+	/** use to query chan region cfg setting in firmware */
+	ENUM_ELEMENT(HostCmd_CMD_CHAN_REGION_CFG, 0x0242),
+	/** used in hostcmd to download region power cfg setting to firmware */
+	ENUM_ELEMENT(HostCmd_CMD_REGION_POWER_CFG, 0x0249),
+
+	/** Host Command ID : Packet aggregation CTRL */
+	ENUM_ELEMENT(HostCmd_CMD_PACKET_AGGR_CTRL, 0x0251),
+
+	ENUM_ELEMENT(HostCmd_CMD_DYN_BW, 0x0252),
+
+	ENUM_ELEMENT(HostCmd_CMD_BOOT_SLEEP, 0x0258),
+
+	ENUM_ELEMENT(HostCmd_CMD_RX_ABORT_CFG, 0x0261),
+	ENUM_ELEMENT(HostCmd_CMD_RX_ABORT_CFG_EXT, 0x0262),
+	ENUM_ELEMENT(HostCmd_CMD_TX_AMPDU_PROT_MODE, 0x0263),
+	ENUM_ELEMENT(HostCmd_CMD_RATE_ADAPT_CFG, 0x0264),
+	ENUM_ELEMENT(HostCmd_CMD_CCK_DESENSE_CFG, 0x0265),
+
+	ENUM_ELEMENT(HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS, 0x024d),
+	ENUM_ELEMENT(HostCmd_CMD_FTM_SESSION_CTRL, 0x024e),
+	ENUM_ELEMENT(HostCmd_CMD_FTM_FEATURE_CTRL, 0x024f),
+	ENUM_ELEMENT(HostCmd_CMD_WLS_REQ_FTM_RANGE, 0x0250),
+
+	ENUM_ELEMENT(HostCmd_CMD_FTM_CONFIG_RESPONDER, 0x0255),
+
+	ENUM_ELEMENT(HostCmd_CMD_VDLL, 0x0240),
+#if defined(PCIE)
+	ENUM_ELEMENT(HostCmd_CMD_SSU, 0x0259),
+#endif
+	ENUM_ELEMENT(HostCmd_CMD_CSI, 0x025b),
+
+#if defined(UAP_SUPPORT)
+	/** Host Command ID : Add New Station */
+	ENUM_ELEMENT(HostCmd_CMD_ADD_NEW_STATION, 0x025f),
+#endif
+
+	ENUM_ELEMENT(HostCmd_CMD_DMCS_CONFIG, 0x0260),
+
+	/** Host Command ID: 11AX config */
+	ENUM_ELEMENT(HostCmd_CMD_11AX_CFG, 0x0266),
+	/** Host Command ID: 11AX command */
+	ENUM_ELEMENT(HostCmd_CMD_11AX_CMD, 0x026d),
+	/** Host Command ID: Range ext command */
+	ENUM_ELEMENT(HostCmd_CMD_RANGE_EXT, 0x0274),
+	/** Host Command ID: TWT cfg command */
+	ENUM_ELEMENT(HostCmd_CMD_TWT_CFG, 0x0270),
+
+	ENUM_ELEMENT(HostCmd_CMD_LOW_POWER_MODE_CFG, 0x026e),
+	ENUM_ELEMENT(HostCmd_CMD_UAP_BEACON_STUCK_CFG, 0x0271),
+	ENUM_ELEMENT(HostCmd_CMD_ARB_CONFIG, 0x0273),
+	ENUM_ELEMENT(HostCmd_CMD_DOT11MC_UNASSOC_FTM_CFG, 0x0275),
+	ENUM_ELEMENT(HostCmd_CMD_HAL_PHY_CFG, 0x0276),
+
+	/** Host Command ID : IPS Config */
+	ENUM_ELEMENT(HostCmd_CMD_IPS_CONFIG, 0x0279),
+	ENUM_ELEMENT(HostCmd_CMD_OFDM_DESENSE_CFG, 0x027f),
+	ENUM_ELEMENT(HostCmd_CMD_NAV_MITIGATION_CFG, 0x0282),
+
+	/** Host Command ID: Tx Frame */
+	ENUM_ELEMENT(HostCmd_CMD_802_11_TX_FRAME, 0x0283),
+	/** Host Command ID: PCIE ADMA INIT */
+	ENUM_ELEMENT(HostCmd_CMD_PCIE_ADMA_INIT, 0x0284),
+
+	/** Host Command ID: query of current TX rate to the peer */
+	ENUM_ELEMENT(HostCmd_CMD_PEER_TX_RATE_QUERY, 0x0285),
+
+	/** Host Command ID: multi-client TX scheduling configuration */
+	ENUM_ELEMENT(HostCmd_CMD_MCLIENT_SCHEDULE_CFG, 0x0286),
+
+	/** Host Command ID : WMM HOST ADDTS req */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_HOST_ADDTS_REQ, 0x0287),
+	/** Host Command ID : WMM HOST DELTS req */
+	ENUM_ELEMENT(HostCmd_CMD_WMM_HOST_DELTS_REQ, 0x0288),
+
+	/** Host Command ID : Auth, Assoc timeout configuration */
+	ENUM_ELEMENT(HostCmd_CMD_AUTH_ASSOC_TIMEOUT_CFG, 0x0289),
+
+	/** Host Command ID : HS Event masking configuration */
+	ENUM_ELEMENT(HostCmd_CMD_HS_EVENT_MASK, 0x028a),
+	/* Always keep this last */
+	ENUM_ELEMENT_LAST(__HostCmd_CMD_Last)
diff --git a/wlan_sd8987/mlan/mlan_ieee.h b/wlan_src/mlan/mlan_ieee.h
old mode 100755
new mode 100644
similarity index 91%
rename from wlan_sd8987/mlan/mlan_ieee.h
rename to wlan_src/mlan/mlan_ieee.h
index cf2ef85..c80f12f
--- a/wlan_sd8987/mlan/mlan_ieee.h
+++ b/wlan_src/mlan/mlan_ieee.h
@@ -4,20 +4,29 @@
  *  definitions used in MLAN and MOAL module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -29,6 +38,9 @@
 #ifndef _MLAN_IEEE_H_
 #define _MLAN_IEEE_H_
 
+/** WLAN header size */
+#define IEEE80211_HEADER_SIZE 24
+
 /** FIX IES size in beacon buffer */
 #define WLAN_802_11_FIXED_IE_SIZE 12
 /** WLAN supported rates */
@@ -48,7 +60,7 @@
 
 #ifdef BIG_ENDIAN_SUPPORT
 /** Frame control: Type Mgmt frame */
-#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x3000
+#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x0c00
 /** Frame control: SubType Mgmt frame */
 #define IEEE80211_GET_FC_MGMT_FRAME_SUBTYPE(fc) (((fc)&0xF000) >> 12)
 #else
@@ -68,6 +80,9 @@
 typedef enum _IEEEtypes_Ext_ElementId_e {
 	HE_CAPABILITY = 35,
 	HE_OPERATION = 36,
+	MU_EDCA_PARAM_SET = 38,
+	MBSSID_CONFIG = 55,
+	NON_INHERITANCE = 56,
 	HE_6G_CAPABILITY = 59
 } IEEEtypes_Ext_ElementId_e;
 
@@ -80,7 +95,6 @@
 	DS_PARAM_SET = 3,
 	CF_PARAM_SET = 4,
 
-	IBSS_PARAM_SET = 6,
 	COUNTRY_INFO = 7,
 	POWER_CONSTRAINT = 32,
 	POWER_CAPABILITY = 33,
@@ -89,7 +103,8 @@
 	CHANNEL_SWITCH_ANN = 37,
 	EXTEND_CHANNEL_SWITCH_ANN = 60,
 	QUIET = 40,
-	IBSS_DFS = 41,
+	MEASUREMENT_REQUEST = 38,
+	MEASUREMENT_REPORT = 39,
 	SUPPORTED_CHANNELS = 36,
 	REGULATORY_CLASS = 59,
 	HT_CAPABILITY = 45,
@@ -177,6 +192,33 @@
 	t_u8 data[IEEE_MAX_IE_SIZE - sizeof(IEEEtypes_Header_t)];
 } MLAN_PACK_END IEEEtypes_Generic_t, *pIEEEtypes_Generic_t;
 
+#define MEASURE_TYPE_CLI 8
+#define MEASURE_TYPE_LOCATION_CIVIC 9
+
+/** Measurement Report IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MeasurementReport_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Measurement Token */
+	t_u8 ms_token;
+	/** Measurement Report Mode */
+	t_u8 ms_rp_mode;
+	/** Measurement Type, value in MEASURE_TYPE_XXX */
+	t_u8 ms_type;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_MeasurementReport_t;
+
+/** Report */
+typedef MLAN_PACK_START struct _IEEEtypes_Report_t {
+	/** Subelement ID */
+	t_u8 subelement_id;
+	/** length */
+	t_u8 length;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_Report_t;
+
 /**ft capability policy*/
 typedef MLAN_PACK_START struct _IEEEtypes_FtCapPolicy_t {
 #ifdef BIG_ENDIAN_SUPPORT
@@ -230,7 +272,7 @@
 	/** SNonce */
 	t_u8 s_nonce[32];
 	/** sub element */
-	t_u8 sub_element[1];
+	t_u8 sub_element[];
 } MLAN_PACK_END IEEEtypes_FastBssTransElement_t;
 
 /*Category for FT*/
@@ -290,6 +332,27 @@
 	t_u8 variablep[];
 } MLAN_PACK_END IEEEtypes_assoc_req;
 
+/** Assoc Request */
+#define SUBTYPE_ASSOC_REQUEST 0
+/** Assoc Response */
+#define SUBTYPE_ASSOC_RESP 1
+/** ReAssoc Request */
+#define SUBTYPE_REASSOC_REQUEST 2
+/** ReAssoc Request */
+#define SUBTYPE_REASSOC_RESP 3
+/** Probe Resp */
+#define SUBTYPE_PROBE_RESP 5
+/** Disassoc Request */
+#define SUBTYPE_DISASSOC 10
+/** Auth Request */
+#define SUBTYPE_AUTH 11
+/** Deauth Request */
+#define SUBTYPE_DEAUTH 12
+/** Action frame */
+#define SUBTYPE_ACTION 13
+/** beacon */
+#define SUBTYPE_BEACON 8
+
 /*Mgmt frame*/
 typedef MLAN_PACK_START struct {
 	/** frame control */
@@ -341,15 +404,14 @@
 	t_u8 privacy : 1;
 	t_u8 cf_poll_rqst : 1;
 	t_u8 cf_pollable : 1;
-	t_u8 ibss : 1;
+	t_u8 rsrvd4 : 1;
 	t_u8 ess : 1;
 } MLAN_PACK_END IEEEtypes_CapInfo_t, *pIEEEtypes_CapInfo_t;
 #else
 typedef MLAN_PACK_START struct _IEEEtypes_CapInfo_t {
 	/** Capability Bit Map : ESS */
 	t_u8 ess : 1;
-	/** Capability Bit Map : IBSS */
-	t_u8 ibss : 1;
+	t_u8 rsrvd4 : 1;
 	/** Capability Bit Map : CF pollable */
 	t_u8 cf_pollable : 1;
 	/** Capability Bit Map : CF poll request */
@@ -405,22 +467,10 @@
 	t_u16 cfp_duration_remaining;
 } MLAN_PACK_END IEEEtypes_CfParamSet_t, *pIEEEtypes_CfParamSet_t;
 
-/** IEEEtypes_IbssParamSet_t */
-typedef MLAN_PACK_START struct _IEEEtypes_IbssParamSet_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** ATIM window value in milliseconds */
-	t_u16 atim_window;
-} MLAN_PACK_END IEEEtypes_IbssParamSet_t, *pIEEEtypes_IbssParamSet_t;
-
 /** IEEEtypes_SsParamSet_t */
 typedef MLAN_PACK_START union _IEEEtypes_SsParamSet_t {
 	/** SS parameter : CF parameter set */
 	IEEEtypes_CfParamSet_t cf_param_set;
-	/** SS parameter : IBSS parameter set */
-	IEEEtypes_IbssParamSet_t ibss_param_set;
 } MLAN_PACK_END IEEEtypes_SsParamSet_t, *pIEEEtypes_SsParamSet_t;
 
 /** IEEEtypes_FhParamSet_t */
@@ -509,7 +559,7 @@
 	/** Association ID */
 	IEEEtypes_AId_t a_id;
 	/** IE data buffer */
-	t_u8 ie_buffer[1];
+	t_u8 ie_buffer[];
 } MLAN_PACK_END IEEEtypes_AssocRsp_t, *pIEEEtypes_AssocRsp_t;
 
 /** 802.11 supported rates */
@@ -557,7 +607,7 @@
 	/* count */
 	t_u16 count;
 	/** wpa_suite list */
-	wpa_suite list[1];
+	wpa_suite list[];
 } MLAN_PACK_END wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
 
 /** IEEEtypes_Rsn_t */
@@ -849,6 +899,28 @@
 
 } MLAN_PACK_END IEEEtypes_WMM_Tspec_Action_e;
 
+/** NAN SDF vendor oui size */
+#define NAN_SDF_VENDOR_SIZE 4
+/** NAN service descriptor attribute offset */
+#define NAN_SDA_OFFSET 5
+/** NAN service control type offset */
+#define NAN_SRVC_CTRL_OFFSET 11
+/** Service control field */
+#define NAN_SRV_CTRL_TYPE_MASK (BIT(0) | BIT(1))
+/** NAN service control type */
+#define NAN_PUBLISH 0
+#define NAN_FOLLOW_UP 2
+
+/** NAN Attribute ID list */
+typedef MLAN_PACK_START enum _Nan_AttrId_e {
+	NAN_ATTR_SDA = 0x03
+} MLAN_PACK_END Nan_AttrId_e;
+
+/** Public Action Codes */
+typedef MLAN_PACK_START enum _IEEEtypes_Public_ActionCategory_e {
+	IEEE_PUBLIC_ACTION_CATEGORY_VENDOR_SPECIFIC = 9
+} MLAN_PACK_END IEEEtypes_Public_ActionCategory_e;
+
 /** WMM TSPEC Category Action Base */
 typedef MLAN_PACK_START struct {
 	IEEEtypes_ActionCategory_e category;
@@ -925,7 +997,7 @@
 	/** Country code */
 	t_u8 country_code[COUNTRY_CODE_LEN];
 	/** Set of subbands */
-	IEEEtypes_SubbandSet_t sub_band[1];
+	IEEEtypes_SubbandSet_t sub_band[];
 } MLAN_PACK_END IEEEtypes_CountryInfoSet_t, *pIEEEtypes_CountryInfoSet_t;
 
 /** Data structure for Country IE full set */
@@ -1091,6 +1163,18 @@
 	/** Optional Subelement data*/
 	t_u8 sub_elem_data[];
 } MLAN_PACK_END IEEEtypes_MultiBSSID_t, *pIEEEtypes_MultiBSSID_t;
+
+/** Multi BSSID Configuration IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MBSSID_Config_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Element id extension */
+	t_u8 ext_id;
+	/** BSSID Count */
+	t_u8 bssid_cnt;
+	/** Full Set Rx Periodicity */
+	t_u8 fs_rx_periodicity;
+} MLAN_PACK_END IEEEtypes_MBSSID_Config_t, *pIEEEtypes_MBSSID_Config_t;
 /** 20/40 BSS Coexistence IE */
 typedef MLAN_PACK_START struct _IEEEtypes_2040BSSCo_t {
 	/** Generic IE header */
@@ -1406,6 +1490,32 @@
 	t_u8 option[9];
 } MLAN_PACK_END IEEEtypes_HeOp_t;
 
+/** MU EDCA Parameter Set */
+typedef MLAN_PACK_START struct _IEEEtypes_MUEDCAParamSet_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Extended Tag */
+	t_u8 ext_tag;
+	/** QOS Information */
+	t_u8 qos_info;
+	/** MUAC BE Paramter Record */
+	t_u8 muac_be[3];
+	/** MUAC BK Paramter Record */
+	t_u8 muac_bk[3];
+	/** MUAC VI Paramter Record */
+	t_u8 muac_vi[3];
+	/** MUAC VO Paramter Record */
+	t_u8 muac_vo[3];
+} MLAN_PACK_END IEEEtypes_MUEDCAParamSet_t, *pIEEEtypes_MUEDCAParamSet_t;
+
+/** IEEE format IE */
+typedef MLAN_PACK_START struct _IEEEtypes_Element_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** IE data */
+	t_u8 data[];
+} MLAN_PACK_END IEEEtypes_Element_t, *pIEEEtypes_Element_t;
+
 /** default channel switch count */
 #define DEF_CHAN_SWITCH_COUNT 5
 
@@ -1442,8 +1552,6 @@
 
 /** Maximum number of subbands in the IEEEtypes_SupportedChannels_t structure */
 #define WLAN_11H_MAX_SUBBANDS 6
-/** Maximum number of DFS channels configured in IEEEtypes_IBSS_DFS_t */
-#define WLAN_11H_MAX_IBSS_DFS_CHANNELS 25
 
 /**  IEEE Power Constraint element (7.3.2.15) */
 typedef MLAN_PACK_START struct {
@@ -1592,24 +1700,6 @@
 
 } MLAN_PACK_END IEEEtypes_ChannelMap_t;
 
-/*  IEEE IBSS DFS Element (7.3.2.24) */
-/**
- *  IBSS DFS element included in ad hoc beacons and probe responses.
- *    Provides information regarding the IBSS DFS Owner as well as the
- *    originating STAs supported channels and basic measurement results.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 41 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 dfs_owner[MLAN_MAC_ADDR_LENGTH]; /**< DFS Owner STA Address */
-	t_u8 dfs_recovery_interval; /**< DFS Recovery time in TBTTs */
-
-	/** Variable length map field, one Map entry for each supported channel
-	 */
-	IEEEtypes_ChannelMap_t channel_map[WLAN_11H_MAX_IBSS_DFS_CHANNELS];
-
-} MLAN_PACK_END IEEEtypes_IBSS_DFS_t;
-
 /* 802.11h BSS information kept for each BSSID received in scan results */
 /**
  * IEEE BSS information needed from scan results for later processing in
@@ -1626,7 +1716,6 @@
 	IEEEtypes_ChanSwitchAnn_t chan_switch_ann; /**< Channel Switch
 						      Announcement IE */
 	IEEEtypes_Quiet_t quiet; /**< Quiet IE */
-	IEEEtypes_IBSS_DFS_t ibss_dfs; /**< IBSS DFS Element IE */
 
 } wlan_11h_bss_info_t;
 
@@ -1718,8 +1807,8 @@
 	t_u8 radio_type;
 	/** Scan type: Active = 1, Passive = 2 */
 	t_u8 scan_type;
-	/** Reserved */
-	t_u8 reserved;
+	/** rnr_flag */
+	t_u8 rnr_flag;
 	/** Scan duration in milliseconds; if 0 default used */
 	t_u32 scan_time;
 } MLAN_PACK_END wlan_user_scan_chan;
@@ -1834,11 +1923,14 @@
 #define BG_SCAN_SSID_RSSI_MATCH 0x0004
 /**wait for all channel scan to complete to report scan result*/
 #define BG_SCAN_WAIT_ALL_CHAN_DONE 0x80000000
-/** Maximum number of channels that can be sent in bg scan config */
-#define CHAN_MAX_24G 14
-#define CHAN_MAX_5G 24
-#define CHAN_MAX_UNII4 3
-#define WLAN_BG_SCAN_CHAN_MAX (CHAN_MAX_24G + CHAN_MAX_5G + CHAN_MAX_UNII4)
+
+#define CHAN_MAX_6G 0
+
+/** max bgscan chan number */
+#define WLAN_BG_SCAN_CHAN_MAX 38
+
+/** max bgscan chan number, include UNII_4 channel */
+#define WLAN_BG_SCAN_CHAN_MAX_UNII_4 41
 
 /** Enumeration definition */
 /** EES MODE */
@@ -1906,7 +1998,7 @@
 	/** SSID filter list used in the to limit the scan results */
 	wlan_user_scan_ssid ssid_list[MRVDRV_MAX_SSID_LIST_LENGTH];
 	/** Variable number (fixed maximum) of channels to scan up */
-	wlan_user_scan_chan chan_list[WLAN_BG_SCAN_CHAN_MAX];
+	wlan_user_scan_chan chan_list[WLAN_USER_SCAN_CHAN_MAX];
 	/** scan channel gap */
 	t_u16 scan_chan_gap;
 	/** Enable EES configuration */
@@ -2052,6 +2144,10 @@
 	t_u8 multi_bssid_ap;
 	/** the mac address of multi-bssid AP */
 	mlan_802_11_mac_addr multi_bssid_ap_addr;
+	/** Multi BSSID Configuration IE */
+	IEEEtypes_MBSSID_Config_t *pmbssid_config;
+	/** Multi BSSID Configuration IE offset */
+	t_u16 mbssid_config_offset;
 	/** 20/40 BSS Coexistence IE */
 	IEEEtypes_2040BSSCo_t *pbss_co_2040;
 	/** 20/40 BSS Coexistence Offset */
@@ -2132,7 +2228,10 @@
 	IEEEtypes_MobilityDomain_t *pmd_ie;
 	/** Mobility domain IE offset in the beacon buffer */
 	t_u16 md_offset;
-
+	/** MU EDCA Parameter IE */
+	IEEEtypes_MUEDCAParamSet_t *pmuedca_ie;
+	/** MU EDCA Parameter IE offset */
+	t_u16 muedca_offset;
 	/** Pointer to the returned scan response */
 	t_u8 *pbeacon_buf;
 	/** Length of the stored scan response */
diff --git a/wlan_sd8987/mlan/mlan_init.c b/wlan_src/mlan/mlan_init.c
old mode 100755
new mode 100644
similarity index 90%
rename from wlan_sd8987/mlan/mlan_init.c
rename to wlan_src/mlan/mlan_init.c
index a9fd9cd..e9f2431
--- a/wlan_sd8987/mlan/mlan_init.c
+++ b/wlan_src/mlan/mlan_init.c
@@ -4,20 +4,29 @@
  *  and HW.
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -45,9 +54,6 @@
 #ifdef PCIE
 #include "mlan_pcie.h"
 #endif /* PCIE */
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-#include "hostsa_init.h"
-#endif
 #include "mlan_11ax.h"
 
 /********************************************************
@@ -486,13 +492,7 @@
 #ifdef UAP_SUPPORT
 	priv->num_drop_pkts = 0;
 #endif
-#if defined(STA_SUPPORT)
-	priv->adhoc_state_prev = ADHOC_IDLE;
-	memset(pmadapter, &priv->adhoc_last_start_ssid, 0,
-	       sizeof(priv->adhoc_last_start_ssid));
-#endif
 	priv->atim_window = 0;
-	priv->adhoc_state = ADHOC_IDLE;
 	priv->tx_power_level = 0;
 	priv->max_tx_power_level = 0;
 	priv->min_tx_power_level = 0;
@@ -571,8 +571,6 @@
 		priv->addba_reject[i] = ADDBA_RSP_STATUS_ACCEPT;
 	priv->addba_reject[6] = ADDBA_RSP_STATUS_REJECT;
 	priv->addba_reject[7] = ADDBA_RSP_STATUS_REJECT;
-	memcpy_ext(priv->adapter, priv->ibss_addba_reject, priv->addba_reject,
-		   sizeof(priv->addba_reject), sizeof(priv->ibss_addba_reject));
 	priv->max_amsdu = 0;
 #ifdef STA_SUPPORT
 	if (priv->bss_type == MLAN_BSS_TYPE_STA) {
@@ -596,7 +594,7 @@
 	}
 #endif
 	priv->user_rxwinsize = priv->add_ba_param.rx_win_size;
-	memset(pmadapter, priv->rx_seq, 0, sizeof(priv->rx_seq));
+	memset(pmadapter, priv->rx_seq, 0xff, sizeof(priv->rx_seq));
 	priv->port_ctrl_mode = MTRUE;
 	priv->port_open = MFALSE;
 	priv->prior_port_status = MFALSE;
@@ -604,6 +602,7 @@
 	priv->hotspot_cfg = 0;
 
 	priv->intf_hr_len = pmadapter->ops.intf_header_len;
+	priv->multi_ap_flag = 0;
 	memset(pmadapter, &priv->chan_rep_req, 0, sizeof(priv->chan_rep_req));
 #ifdef USB
 	if (IS_USB(pmadapter->card_type)) {
@@ -618,9 +617,6 @@
 	}
 #endif
 	ret = wlan_add_bsspriotbl(priv);
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	hostsa_init(priv);
-#endif
 
 	LEAVE();
 	return ret;
@@ -789,6 +785,8 @@
 	pmadapter->local_listen_interval = 0; /* default value in firmware will
 						 be used */
 #endif /* STA_SUPPORT */
+	pmadapter->fw_wakeup_method = WAKEUP_FW_UNCHANGED;
+	pmadapter->fw_wakeup_gpio_pin = DEF_WAKEUP_FW_GPIO;
 
 	pmadapter->is_deep_sleep = MFALSE;
 	pmadapter->idle_time = DEEP_SLEEP_IDLE_TIME;
@@ -868,7 +866,12 @@
 	pmadapter->is_hs_configured = MFALSE;
 	pmadapter->hs_cfg.conditions = HOST_SLEEP_DEF_COND;
 	pmadapter->hs_cfg.gpio = HOST_SLEEP_DEF_GPIO;
-	pmadapter->hs_cfg.gap = HOST_SLEEP_DEF_GAP;
+#ifdef PCIE
+	if (IS_PCIE(pmadapter->card_type))
+		pmadapter->hs_cfg.gap = HOST_SLEEP_GAP_SPECIAL;
+	else
+#endif
+		pmadapter->hs_cfg.gap = HOST_SLEEP_DEF_GAP;
 	pmadapter->hs_activated = MFALSE;
 	pmadapter->min_wake_holdoff = HOST_SLEEP_DEF_WAKE_HOLDOFF;
 	pmadapter->hs_inactivity_timeout = HOST_SLEEP_DEF_INACTIVITY_TIMEOUT;
@@ -894,7 +897,7 @@
 
 	wlan_wmm_init(pmadapter);
 	wlan_init_wmm_param(pmadapter);
-	pmadapter->bypass_pkt_count = 0;
+
 	if (pmadapter->psleep_cfm) {
 		pmadapter->psleep_cfm->buf_type = MLAN_BUF_TYPE_CMD;
 		pmadapter->psleep_cfm->data_len = sizeof(OPT_Confirm_Sleep);
@@ -929,7 +932,6 @@
 	pmadapter->null_pkt_interval = 0;
 	pmadapter->fw_bands = 0;
 	pmadapter->config_bands = 0;
-	pmadapter->adhoc_start_band = 0;
 	pmadapter->pscan_channels = MNULL;
 	pmadapter->fw_release_number = 0;
 	pmadapter->fw_cap_info = 0;
@@ -937,6 +939,9 @@
 	pmadapter->upld_len = 0;
 	pmadapter->event_cause = 0;
 	pmadapter->pmlan_buffer_event = MNULL;
+	pmadapter->flush_time_ac_vi_vo = DEF_FLUSH_TIME_AC_VI_VO;
+	pmadapter->flush_time_ac_be_bk = DEF_FLUSH_TIME_AC_BE_BK;
+
 	memset(pmadapter, &pmadapter->region_channel, 0,
 	       sizeof(pmadapter->region_channel));
 	pmadapter->region_code = 0;
@@ -958,6 +963,7 @@
 		pmadapter->pcard_pcie->txbd_rdptr = 0;
 		pmadapter->pcard_pcie->rxbd_rdptr = 0;
 		pmadapter->pcard_pcie->evtbd_rdptr = 0;
+		pmadapter->pcard_pcie->txbd_pending = 0;
 #if defined(PCIE8997) || defined(PCIE8897)
 		if (!pmadapter->pcard_pcie->reg->use_adma) {
 			pmadapter->pcard_pcie->rxbd_wrptr =
@@ -967,11 +973,14 @@
 				EVT_RW_PTR_ROLLOVER_IND;
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			pmadapter->pcard_pcie->rxbd_wrptr =
 				pmadapter->pcard_pcie->txrx_bd_size;
 			pmadapter->pcard_pcie->evtbd_wrptr = MLAN_MAX_EVT_BD;
+			pmadapter->pcard_pcie->last_write_index_with_irq =
+				0xffffffff;
 		}
 #endif
 	}
@@ -1041,6 +1050,28 @@
 					priv->adapter->callbacks.moal_init_lock);
 			}
 			util_init_list_head(
+				pmadapter->pmoal_handle, &priv->wmm.all_stas,
+				MTRUE, pmadapter->callbacks.moal_init_lock);
+			util_init_list_head(
+				pmadapter->pmoal_handle,
+				&priv->wmm.pending_stas, MTRUE,
+				pmadapter->callbacks.moal_init_lock);
+			util_init_list_head(
+				pmadapter->pmoal_handle,
+				&priv->wmm.active_stas.list, MTRUE,
+				pmadapter->callbacks.moal_init_lock);
+			for (j = 0; j < NELEMENTS(priv->wmm.pending_txq); ++j) {
+				util_init_list_head(
+					pmadapter->pmoal_handle,
+					&priv->wmm.pending_txq[j], MTRUE,
+					pmadapter->callbacks.moal_init_lock);
+			}
+			priv->wmm.selected_ra_list = MNULL;
+			pcb->moal_get_host_time_ns(
+				&priv->wmm.active_stas.next_update);
+			pcb->moal_get_host_time_ns(&priv->wmm.next_rate_update);
+			priv->wmm.is_rate_update_pending = MFALSE;
+			util_init_list_head(
 				(t_void *)pmadapter->pmoal_handle,
 				&priv->tx_ba_stream_tbl_ptr, MTRUE,
 				pmadapter->callbacks.moal_init_lock);
@@ -1131,6 +1162,43 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto error;
 	}
+#ifdef PCIE
+	if (pcb->moal_init_lock(pmadapter->pmoal_handle,
+				&pmadapter->pmlan_rx_lock) !=
+	    MLAN_STATUS_SUCCESS) {
+		ret = MLAN_STATUS_FAILURE;
+		goto error;
+	}
+
+	if (pcb->moal_init_lock(pmadapter->pmoal_handle,
+				&pmadapter->pmlan_tx_lock) !=
+	    MLAN_STATUS_SUCCESS) {
+		ret = MLAN_STATUS_FAILURE;
+		goto error;
+	}
+	if (pcb->moal_init_lock(pmadapter->pmoal_handle,
+				&pmadapter->pmlan_event_lock) !=
+	    MLAN_STATUS_SUCCESS) {
+		ret = MLAN_STATUS_FAILURE;
+		goto error;
+	}
+	if (pcb->moal_init_lock(pmadapter->pmoal_handle,
+				&pmadapter->pmlan_pcie_lock) !=
+	    MLAN_STATUS_SUCCESS) {
+		ret = MLAN_STATUS_FAILURE;
+		goto error;
+	}
+#endif
+#ifdef USB
+	if (IS_USB(pmadapter->card_type)) {
+		if (pcb->moal_init_lock(pmadapter->pmoal_handle,
+					&pmadapter->pmlan_usb_event_lock) !=
+		    MLAN_STATUS_SUCCESS) {
+			ret = MLAN_STATUS_FAILURE;
+			goto error;
+		}
+	}
+#endif
 #if defined(USB)
 	if (IS_USB(pmadapter->card_type)) {
 		for (i = 0; i < MAX_USB_TX_PORT_NUM; i++) {
@@ -1149,9 +1217,16 @@
 	util_init_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->rx_data_queue, MTRUE,
 			    pmadapter->callbacks.moal_init_lock);
+	util_init_list_head((t_void *)pmadapter->pmoal_handle,
+			    &pmadapter->amsdu_txq, MTRUE,
+			    pmadapter->callbacks.moal_init_lock);
+	util_scalar_init((t_void *)pmadapter->pmoal_handle,
+			 &pmadapter->bypass_pkt_count, 0, MNULL,
+			 pmadapter->callbacks.moal_init_lock);
 	util_scalar_init((t_void *)pmadapter->pmoal_handle,
 			 &pmadapter->pending_bridge_pkts, 0, MNULL,
 			 pmadapter->callbacks.moal_init_lock);
+
 	/* Initialize cmd_free_q */
 	util_init_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->cmd_free_q, MTRUE,
@@ -1212,6 +1287,25 @@
 	if (pmadapter->pmlan_cmd_lock)
 		pcb->moal_free_lock(pmadapter->pmoal_handle,
 				    pmadapter->pmlan_cmd_lock);
+#ifdef PCIE
+	if (pmadapter->pmlan_rx_lock)
+		pcb->moal_free_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_rx_lock);
+	if (pmadapter->pmlan_tx_lock)
+		pcb->moal_free_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_tx_lock);
+	if (pmadapter->pmlan_event_lock)
+		pcb->moal_free_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_event_lock);
+	if (pmadapter->pmlan_pcie_lock)
+		pcb->moal_free_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_pcie_lock);
+#endif
+#ifdef USB
+	if (IS_USB(pmadapter->card_type) && pmadapter->pmlan_usb_event_lock)
+		pcb->moal_free_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_usb_event_lock);
+#endif
 #if defined(USB)
 	if (IS_USB(pmadapter->card_type)) {
 		for (i = 0; i < MAX_USB_TX_PORT_NUM; i++) {
@@ -1244,9 +1338,14 @@
 	/* Free lists */
 	util_free_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->rx_data_queue, pcb->moal_free_lock);
+	util_free_list_head((t_void *)pmadapter->pmoal_handle,
+			    &pmadapter->amsdu_txq, pcb->moal_free_lock);
 
 	util_scalar_free((t_void *)pmadapter->pmoal_handle,
+			 &pmadapter->bypass_pkt_count, pcb->moal_free_lock);
+	util_scalar_free((t_void *)pmadapter->pmoal_handle,
 			 &pmadapter->pending_bridge_pkts, pcb->moal_free_lock);
+
 	util_free_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->cmd_free_q,
 			    pmadapter->callbacks.moal_free_lock);
@@ -1294,6 +1393,24 @@
 					priv->adapter->callbacks.moal_free_lock);
 			util_free_list_head(
 				(t_void *)priv->adapter->pmoal_handle,
+				&priv->wmm.all_stas,
+				priv->adapter->callbacks.moal_free_lock);
+			util_free_list_head(
+				(t_void *)priv->adapter->pmoal_handle,
+				&priv->wmm.pending_stas,
+				priv->adapter->callbacks.moal_free_lock);
+			util_free_list_head(
+				(t_void *)priv->adapter->pmoal_handle,
+				&priv->wmm.active_stas.list,
+				priv->adapter->callbacks.moal_free_lock);
+			for (j = 0; j < NELEMENTS(priv->wmm.pending_txq); ++j) {
+				util_free_list_head(
+					(t_void *)priv->adapter->pmoal_handle,
+					&priv->wmm.pending_txq[j],
+					priv->adapter->callbacks.moal_free_lock);
+			}
+			util_free_list_head(
+				(t_void *)priv->adapter->pmoal_handle,
 				&priv->tx_ba_stream_tbl_ptr,
 				priv->adapter->callbacks.moal_free_lock);
 			util_free_list_head(
@@ -1515,26 +1632,7 @@
 						BAND_AAC;
 			}
 		}
-		pmadapter->adhoc_start_band = BAND_A;
-		for (i = 0; i < pmadapter->priv_num; i++) {
-			if (pmadapter->priv[i])
-				pmadapter->priv[i]->adhoc_channel =
-					DEFAULT_AD_HOC_CHANNEL_A;
-		}
-	} else if (pmadapter->fw_bands & BAND_G) {
-		pmadapter->adhoc_start_band = BAND_G | BAND_B;
-		for (i = 0; i < pmadapter->priv_num; i++) {
-			if (pmadapter->priv[i])
-				pmadapter->priv[i]->adhoc_channel =
-					DEFAULT_AD_HOC_CHANNEL;
-		}
-	} else if (pmadapter->fw_bands & BAND_B) {
-		pmadapter->adhoc_start_band = BAND_B;
-		for (i = 0; i < pmadapter->priv_num; i++) {
-			if (pmadapter->priv[i])
-				pmadapter->priv[i]->adhoc_channel =
-					DEFAULT_AD_HOC_CHANNEL;
-		}
+	} else {
 	}
 #endif /* STA_SUPPORT */
 	for (i = 0; i < pmadapter->priv_num; i++) {
@@ -1565,7 +1663,7 @@
 			pmadapter->fw_bands |= BAND_GAX;
 			pmadapter->config_bands |= BAND_GAX;
 		}
-		if (pmadapter->hw_hecap_len) {
+		if ((pmadapter->fw_bands & BAND_A) && pmadapter->hw_hecap_len) {
 			pmadapter->fw_bands |= BAND_AAX;
 			pmadapter->config_bands |= BAND_AAX;
 		}
@@ -1709,6 +1807,14 @@
 		return;
 	}
 
+#ifdef PCIE
+	if (IS_PCIE(pmadapter->card_type)) {
+		/* Free ssu dma buffer just in case  */
+		wlan_free_ssu_pcie_buf(pmadapter);
+		/* Free PCIE ring buffers */
+		wlan_free_pcie_ring_buf(pmadapter);
+	}
+#endif
 	wlan_cancel_all_pending_cmd(pmadapter, MTRUE);
 	/* Free command buffer */
 	PRINTM(MINFO, "Free Command buffer\n");
@@ -1812,15 +1918,6 @@
 	wlan_free_mlan_buffer(pmadapter, pmadapter->psleep_cfm);
 	pmadapter->psleep_cfm = MNULL;
 
-#ifdef PCIE
-	if (IS_PCIE(pmadapter->card_type)) {
-		/* Free ssu dma buffer just in case  */
-		wlan_free_ssu_pcie_buf(pmadapter);
-		/* Free PCIE ring buffers */
-		wlan_free_pcie_ring_buf(pmadapter);
-	}
-#endif
-
 	/* Free timers */
 	wlan_free_timer(pmadapter);
 
@@ -1871,10 +1968,6 @@
 	wlan_free_curr_bcn(pmpriv);
 #endif /* STA_SUPPORT */
 
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	hostsa_cleanup(pmpriv);
-#endif /*EMBEDDED AUTHENTICATOR*/
-
 	wlan_delete_station_list(pmpriv);
 	LEAVE();
 }
@@ -2055,11 +2148,17 @@
 	/* Reconfigure wmm parameter*/
 	if (status == MLAN_STATUS_SUCCESS) {
 		pmpriv = wlan_get_priv(pmadapter, MLAN_BSS_ROLE_STA);
-		if (pmpriv)
-			status = wlan_prepare_cmd(pmpriv,
-						  HostCmd_CMD_WMM_PARAM_CONFIG,
-						  HostCmd_ACT_GEN_SET, 0, MNULL,
-						  &pmadapter->ac_params);
+		if (pmpriv) {
+			status =
+				wlan_prepare_cmd(pmpriv,
+						 HostCmd_CMD_WMM_PARAM_CONFIG,
+						 HostCmd_ACT_GEN_SET_DEFAULT, 0,
+						 MNULL, &pmadapter->ac_params);
+			if (status != MLAN_STATUS_SUCCESS)
+				PRINTM(MERROR,
+				       "ERR: wlan_prepare_cmd returned status=0x%x\n",
+				       status);
+		}
 	}
 	/* Invoke callback */
 	ret = pcb->moal_init_fw_complete(pmadapter->pmoal_handle, status);
diff --git a/wlan_sd8987/mlan/mlan_init.h b/wlan_src/mlan/mlan_init.h
old mode 100755
new mode 100644
similarity index 68%
rename from wlan_sd8987/mlan/mlan_init.h
rename to wlan_src/mlan/mlan_init.h
index 65e8259..4ebe5c4
--- a/wlan_sd8987/mlan/mlan_init.h
+++ b/wlan_src/mlan/mlan_init.h
@@ -6,18 +6,27 @@
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -46,6 +55,8 @@
 #define FW_CMD_7 0x00000007
 /** CMD id for CMD10 */
 #define FW_CMD_10 0x0000000a
+/** CMD id for CMD21 */
+#define FW_CMD_21 0x00000015
 
 /** Firmware data transmit size */
 #define FW_DATA_XMIT_SIZE (sizeof(FWHeader) + DataLength + sizeof(t_u32))
diff --git a/wlan_sd8987/mlan/mlan_ioctl.h b/wlan_src/mlan/mlan_ioctl.h
old mode 100755
new mode 100644
similarity index 87%
rename from wlan_sd8987/mlan/mlan_ioctl.h
rename to wlan_src/mlan/mlan_ioctl.h
index 7790db9..934694c
--- a/wlan_sd8987/mlan/mlan_ioctl.h
+++ b/wlan_src/mlan/mlan_ioctl.h
@@ -3,20 +3,29 @@
  *  @brief This file declares the IOCTL data structures and APIs.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -89,6 +98,7 @@
 #ifdef UAP_SUPPORT
 	MLAN_OID_ACTION_CHAN_SWITCH = 0x0002001E,
 #endif
+	MLAN_OID_BSS_HOST_MLME = 0x0002001F,
 
 	/* Radio Configuration Group */
 	MLAN_IOCTL_RADIO_CFG = 0x00030000,
@@ -163,6 +173,7 @@
 	MLAN_OID_PM_CFG_DEEP_SLEEP = 0x00090004,
 	MLAN_OID_PM_CFG_SLEEP_PD = 0x00090005,
 	MLAN_OID_PM_CFG_PS_CFG = 0x00090006,
+	MLAN_OID_PM_CFG_FW_WAKEUP_METHOD = 0x00090007,
 	MLAN_OID_PM_CFG_SLEEP_PARAMS = 0x00090008,
 #ifdef UAP_SUPPORT
 	MLAN_OID_PM_CFG_PS_MODE = 0x00090009,
@@ -182,6 +193,8 @@
 	MLAN_OID_WMM_CFG_QUEUE_STATS = 0x000A0006,
 	MLAN_OID_WMM_CFG_QUEUE_STATUS = 0x000A0007,
 	MLAN_OID_WMM_CFG_TS_STATUS = 0x000A0008,
+	MLAN_OID_WMM_CFG_HOST_ADDTS = 0x000A000A,
+	MLAN_OID_WMM_CFG_HOST_DELTS = 0x000A000B,
 
 	/* WPS Configuration Group */
 	MLAN_IOCTL_WPS_CFG = 0x000B0000,
@@ -204,7 +217,6 @@
 	MLAN_OID_11N_CFG_REJECT_ADDBA_REQ = 0x000C000D,
 	MLAN_OID_11N_CFG_COEX_RX_WINSIZE = 0x000C000E,
 	MLAN_OID_11N_CFG_TX_AGGR_CTRL = 0x000C000F,
-	MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM = 0x000C0010,
 	MLAN_OID_11N_CFG_MIN_BA_THRESHOLD = 0x000C0011,
 
 	/* 802.11d Configuration Group */
@@ -328,6 +340,9 @@
 
 	MLAN_OID_MISC_ROBUSTCOEX = 0x00200056,
 	MLAN_OID_MISC_GET_TX_RX_HISTOGRAM = 0x00200057,
+	MLAN_OID_MISC_CONFIG_RTT = 0x00200059,
+	MLAN_OID_MISC_CANCEL_RTT = 0x0020005A,
+	MLAN_OID_MISC_RTT_RESPONDER_CFG = 0x0020005B,
 	MLAN_OID_MISC_CFP_INFO = 0x00200060,
 	MLAN_OID_MISC_BOOT_SLEEP = 0x00200061,
 #if defined(PCIE)
@@ -354,6 +369,7 @@
 	MLAN_OID_MISC_TP_STATE = 0x0020007D,
 	MLAN_OID_MISC_HAL_PHY_CFG = 0x0020007E,
 	MLAN_OID_MISC_RF_TEST_HE_POWER = 0X0020007F,
+	MLAN_OID_MISC_MULTI_AP_CFG = 0x00200080,
 #ifdef UAP_SUPPORT
 	MLAN_OID_MISC_WACP_MODE = 0x00200081,
 #endif
@@ -365,6 +381,21 @@
 	MLAN_OID_MISC_CH_LOAD = 0x00200087,
 	MLAN_OID_MISC_STATS = 0x00200088,
 	MLAN_OID_MISC_CH_LOAD_RESULTS = 0x00200089,
+	MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX = 0x0020008A,
+	MLAN_OID_MISC_CROSS_CHIP_SYNCH = 0x0020008B,
+	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
+	MLAN_OID_MISC_OFDM_DESENSE_CFG = 0x0020008D,
+	MLAN_OID_MISC_TSP_CFG = 0x002008C,
+	MLAN_OID_MISC_REORDER_FLUSH_TIME = 0x0020008F,
+	MLAN_OID_MISC_NAV_MITIGATION = 0x00200090,
+	MLAN_OID_MISC_LED_CONFIG = 0x00200091,
+	MLAN_OID_MISC_TX_FRAME = 0x00200092,
+	MLAN_OID_MISC_EDMAC_CONFIG = 0x00200093,
+	MLAN_OID_MISC_GPIO_CFG = 0x00200094,
+	MLAN_OID_MISC_REGION_POWER_CFG = 0x00200095,
+	MLAN_OID_MISC_OTP_MAC_RD_WR = 0x00200097,
+	MLAN_OID_MISC_OTP_CAL_DATA_RD_WR = 0x00200098,
+	MLAN_OID_MISC_AUTH_ASSOC_TIMEOUT_CONFIG = 0x00200099,
 };
 
 /** Sub command size */
@@ -379,16 +410,16 @@
 	MLAN_ACT_RESET,
 	MLAN_ACT_DEFAULT
 };
-
+#define MLAN_ACT_PASN_KEY_DNLD 7
+#define MLAN_ACT_PASN_SET_KEY 0
 /** Enumeration for generic enable/disable */
 enum _mlan_act_generic { MLAN_ACT_DISABLE = 0, MLAN_ACT_ENABLE = 1 };
 
 /** Enumeration for scan mode */
 enum _mlan_scan_mode {
 	MLAN_SCAN_MODE_UNCHANGED = 0,
-	MLAN_SCAN_MODE_BSS,
-	MLAN_SCAN_MODE_IBSS,
-	MLAN_SCAN_MODE_ANY
+	MLAN_SCAN_MODE_BSS = 1,
+	MLAN_SCAN_MODE_ANY = 3
 };
 
 /** Enumeration for scan type */
@@ -473,6 +504,21 @@
 	t_u8 status;
 } MLAN_PACK_END tx_status_event;
 
+typedef MLAN_PACK_START struct _tx_mgmt_status_event {
+	/** packet type */
+	t_u8 packet_type;
+	/** tx_token_id */
+	t_u8 tx_token_id;
+	/** 0--success, 1--fail, 2--watchdogtimeout */
+	t_u8 status;
+} MLAN_PACK_END tx_mgmt_status_event;
+
+typedef MLAN_PACK_START struct _tx_bulk_status_event {
+	/* bulk event is multi set for tx_status [bulk1 bulk2 ...bulk128]
+     bulk1 { packet_type, tx_token_id, status } so on.
+  */
+	tx_mgmt_status_event bulk_events[128];
+} MLAN_PACK_END tx_bulk_status_event;
 /**
  *  Sructure to retrieve the scan table
  */
@@ -486,7 +532,7 @@
 	 * Buffer marker for multiple wlan_ioctl_get_scan_table_entry
 	 * structures. Each struct is padded to the nearest 32 bit boundary.
 	 */
-	t_u8 scan_table_entry_buf[1];
+	t_u8 scan_table_entry_buf[];
 } wlan_ioctl_get_scan_table_info;
 
 /**
@@ -543,7 +589,7 @@
 	/** Length of scan_cfg_buf */
 	t_u32 scan_cfg_len;
 	/** Buffer of scan config */
-	t_u8 scan_cfg_buf[1];
+	t_u8 scan_cfg_buf[];
 } mlan_user_scan, *pmlan_user_scan;
 
 /** Type definition of mlan_scan_req */
@@ -616,8 +662,8 @@
 /** Enumeration for BSS mode */
 enum _mlan_bss_mode {
 	MLAN_BSS_MODE_INFRA = 1,
-	MLAN_BSS_MODE_IBSS,
-	MLAN_BSS_MODE_AUTO
+	MLAN_BSS_MODE_IBSS = 2,
+	MLAN_BSS_MODE_AUTO = 3
 };
 
 /** Maximum key length */
@@ -708,7 +754,7 @@
 #define CHAN_FLAGS_MAX MBIT(31)
 
 /** Maximum response buffer length */
-#define ASSOC_RSP_BUF_SIZE 500
+#define ASSOC_RSP_BUF_SIZE 2060
 
 /** Type definition of mlan_ds_misc_assoc_rsp for MLAN_OID_MISC_ASSOC_RSP */
 typedef struct _mlan_ds_misc_assoc_rsp {
@@ -916,6 +962,12 @@
 #define PROTOCOL_WAPI 0x80
 /** WPA3 SAE */
 #define PROTOCOL_WPA3_SAE 0x100
+/* hunting-and-pecking loop only */
+#define SAE_PWE_HUNT_AND_PECK 0
+/** hash-to-element only */
+#define SAE_PWE_HASH_TO_ELEMENT 1
+/** both hunting-and-pecking loop and hash-to-element */
+#define SAE_PWE_BOTH 2
 /** OWE */
 #define PROTOCOL_OWE 0x200
 
@@ -987,6 +1039,10 @@
 	t_u32 length;
 	/** passphrase */
 	t_u8 passphrase[64];
+	/** SAE Password length */
+	t_u32 sae_password_length;
+	/** Passphrase */
+	t_u8 sae_password[255];
 	/**group key rekey time in seconds */
 	t_u32 gk_rekey_time;
 } wpa_param;
@@ -1165,6 +1221,8 @@
 
 	/** uap host based config */
 	t_u32 uap_host_based_config;
+	/** multi ap flag */
+	t_u8 multi_ap_flag;
 } mlan_uap_bss_param, *pmlan_uap_bss_param;
 
 /** mlan_uap_scan_channels */
@@ -1181,6 +1239,11 @@
 
 #define MAX_NUM_PKTS 9
 #define DEF_NUM_PKTS 3
+
+/** Default channel mode and retry packets for channel switch */
+#define DEFAULT_RETRY_PKTS 9
+#define DEFAULT_CHAN_MODE_MASK 3
+
 /** mlan_chan_switch_param */
 typedef struct _mlan_action_chan_switch {
 	/** mode*/
@@ -1335,6 +1398,7 @@
 		/** STA info for MLAN_OID_UAP_ADD_STATION */
 		mlan_ds_sta_info sta_info;
 #endif
+
 	} param;
 } mlan_ds_bss, *pmlan_ds_bss;
 
@@ -1372,8 +1436,6 @@
 	BAND_AAC = 64,
 	BAND_GAX = 256,
 	BAND_AAX = 512,
-	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
-
 };
 
 /** Channel bandwidth */
@@ -1393,10 +1455,6 @@
 typedef struct _mlan_ds_band_cfg {
 	/** Infra band */
 	t_u32 config_bands;
-	/** Ad-hoc start band */
-	t_u32 adhoc_start_band;
-	/** Ad-hoc start channel */
-	t_u32 adhoc_channel;
 	/** fw supported band */
 	t_u32 fw_bands;
 } mlan_ds_band_cfg;
@@ -1528,13 +1586,6 @@
 /** Status Information Group */
 /*-----------------------------------------------------------------*/
 /** Enumeration for ad-hoc status */
-enum _mlan_adhoc_status {
-	ADHOC_IDLE,
-	ADHOC_STARTED,
-	ADHOC_JOINED,
-	ADHOC_COALESCED,
-	ADHOC_STARTING
-};
 
 typedef struct _mlan_ds_get_stats_org {
 	/** Statistics counter */
@@ -1695,8 +1746,10 @@
 	/** Rx Stuck Related Info*/
 	/** Rx Stuck Issue count */
 	t_u32 rx_stuck_issue_cnt[2];
-	/** Rx Stuck Recovery count */
-	t_u32 rx_stuck_recovery_cnt;
+	/** Rx Stuck Recovery count polling based */
+	t_u32 rx_stuck_poll_recovery_cnt;
+	/** Rx Stuck Recovery count interrupt based */
+	t_u32 rx_stuck_intr_recovery_cnt;
 	/** Rx Stuck TSF */
 	t_u64 rx_stuck_tsf[2];
 	/** Tx Watchdog Recovery Related Info */
@@ -1723,6 +1776,8 @@
 	t_u32 gdma_abort_cnt;
 	/** Rx Reset MAC Count */
 	t_u32 g_reset_rx_mac_cnt;
+	/** SDMA FSM stuck Count*/
+	t_u32 SdmaStuckCnt;
 	// Ownership error counters
 	/*Error Ownership error count*/
 	t_u32 dwCtlErrCnt;
@@ -1885,6 +1940,8 @@
 	t_u32 hw_dot_11n_dev_cap;
 	/** Device support for MIMO abstraction of MCSs */
 	t_u8 hw_dev_mcs_support;
+	/** mpdu density */
+	t_u8 hw_mpdu_density;
 	/** user's MCS setting */
 	t_u8 usr_dev_mcs_support;
 	/** 802.11ac device capabilities */
@@ -1927,12 +1984,19 @@
 	t_u8 prohibit_80mhz;
 	/** FW support beacon protection */
 	t_u8 fw_beacon_prot;
+	/** FW RTT support */
+	t_u8 rtt_support;
 
 	/* lower 8 bytes of uuid */
 	t_u64 uuid_lo;
 
 	/* higher 8 bytes of uuid */
 	t_u64 uuid_hi;
+	/* FW support tx data by cmd */
+	t_u8 cmd_tx_data;
+	t_u8 sec_rgpower;
+	/*country code from OTP*/
+	t_u16 fw_country_code;
 } mlan_fw_info, *pmlan_fw_info;
 
 /** Version string buffer length */
@@ -1953,87 +2017,7 @@
 /** Extended Capabilities Data */
 typedef struct MLAN_PACK_START _ExtCap_t {
 	/** Extended Capabilities value */
-	t_u8 rsvdBit87 : 1; /* bit 87 */
-	t_u8 rsvdBit86 : 1; /* bit 86 */
-	t_u8 rsvdBit85 : 1; /* bit 85 */
-	t_u8 beacon_prot : 1; /* bit 84 */
-	t_u8 rsvdBit83 : 1; /* bit 83 */
-	t_u8 rsvdBit82 : 1; /* bit 82 */
-	t_u8 rsvdBit81 : 1; /* bit 81 */
-	t_u8 rsvdBit80 : 1; /* bit 80 */
-	t_u8 rsvdBit79 : 1; /* bit 79 */
-	t_u8 TWTResp : 1; /* bit 78 */
-	t_u8 TWTReq : 1; /* bit 77 */
-	t_u8 rsvdBit76 : 1; /* bit 76 */
-	t_u8 rsvdBit75 : 1; /* bit 75 */
-	t_u8 rsvdBit74 : 1; /* bit 74 */
-	t_u8 rsvdBit73 : 1; /* bit 73 */
-	t_u8 FILS : 1; /* bit 72 */
-	t_u8 FTMI : 1; /* bit 71 */
-	t_u8 FTMR : 1; /* bit 70 */
-	t_u8 CAQ : 1; /* bit 69 */
-	t_u8 rsvdBit68 : 1; /* bit 68 */
-	t_u8 NCC : 1; /* bit 67 */
-	t_u8 rsvdBit66 : 1; /* bit 66 */
-	t_u8 chanSchedMgnt : 1; /* bit 65 */
-	t_u8 MaxAMSDU1 : 1; /* bit 64 */
-	t_u8 MaxAMSDU0 : 1; /* bit 63 */
-	t_u8 OperModeNtf : 1; /* bit 62 */
-	t_u8 TDLSWildBandwidth : 1; /* bit 61 */
-	t_u8 rsvdBit60 : 1; /* bit 60 */
-	t_u8 rsvdBit59 : 1; /* bit 59 */
-	t_u8 rsvdBit58 : 1; /* bit 58 */
-	t_u8 rsvdBit57 : 1; /* bit 57 */
-	t_u8 rsvdBit56 : 1; /* bit 56 */
-	t_u8 rsvdBit55 : 1; /* bit 55 */
-	t_u8 rsvdBit54 : 1; /* bit 54 */
-	t_u8 rsvdBit53 : 1; /* bit 53 */
-	t_u8 rsvdBit52 : 1; /* bit 52 */
-	t_u8 rsvdBit51 : 1; /* bit 51 */
-	t_u8 rsvdBit50 : 1; /* bit 50 */
-	t_u8 rsvdBit49 : 1; /* bit 49 */
-	t_u8 rsvdBit48 : 1; /* bit 48 */
-	t_u8 rsvdBit47 : 1; /* bit 47 */
-	t_u8 rsvdBit46 : 1; /* bit 46 */
-	t_u8 rsvdBit45 : 1; /* bit 45 */
-	t_u8 rsvdBit44 : 1; /* bit 44 */
-	t_u8 rsvdBit43 : 1; /* bit 43 */
-	t_u8 rsvdBit42 : 1; /* bit 42 */
-	t_u8 rsvdBit41 : 1; /* bit 41 */
-	t_u8 rsvdBit40 : 1; /* bit 40 */
-	t_u8 TDLSChlSwitchProhib : 1; /* bit 39 */
-	t_u8 TDLSProhibited : 1; /* bit 38 */
-	t_u8 TDLSSupport : 1; /* bit 37 */
-	t_u8 MSGCF_Capa : 1; /* bit 36 */
-	t_u8 Reserved35 : 1; /* bit 35 */
-	t_u8 SSPN_Interface : 1; /* bit 34 */
-	t_u8 EBR : 1; /* bit 33 */
-	t_u8 Qos_Map : 1; /* bit 32 */
-	t_u8 Interworking : 1; /* bit 31 */
-	t_u8 TDLSChannelSwitching : 1; /* bit 30 */
-	t_u8 TDLSPeerPSMSupport : 1; /* bit 29 */
-	t_u8 TDLSPeerUAPSDSupport : 1; /* bit 28 */
-	t_u8 UTC : 1; /* bit 27 */
-	t_u8 DMS : 1; /* bit 26 */
-	t_u8 SSID_List : 1; /* bit 25 */
-	t_u8 ChannelUsage : 1; /* bit 24 */
-	t_u8 TimingMeasurement : 1; /* bit 23 */
-	t_u8 MultipleBSSID : 1; /* bit 22 */
-	t_u8 AC_StationCount : 1; /* bit 21 */
-	t_u8 QoSTrafficCap : 1; /* bit 20 */
-	t_u8 BSS_Transition : 1; /* bit 19 */
-	t_u8 TIM_Broadcast : 1; /* bit 18 */
-	t_u8 WNM_Sleep : 1; /* bit 17 */
-	t_u8 TFS : 1; /* bit 16 */
-	t_u8 GeospatialLocation : 1; /* bit 15 */
-	t_u8 CivicLocation : 1; /* bit 14 */
-	t_u8 CollocatedIntf : 1; /* bit 13 */
-	t_u8 ProxyARPService : 1; /* bit 12 */
-	t_u8 FMS : 1; /* bit 11 */
-	t_u8 LocationTracking : 1; /* bit 10 */
-	t_u8 MulticastDiagnostics : 1; /* bit 9  */
-	t_u8 Diagnostics : 1; /* bit 8  */
-	t_u8 Event : 1; /* bit 7  */
+	t_u8 Event : 1; /* bit 7  */ /* Byte 1 */
 	t_u8 SPSMP_Support : 1; /* bit 6 */
 	t_u8 Reserved5 : 1; /* bit 5 */
 	t_u8 PSMP_Capable : 1; /* bit 4 */
@@ -2041,6 +2025,86 @@
 	t_u8 ExtChanSwitching : 1; /* bit 2 */
 	t_u8 Reserved1 : 1; /* bit 1 */
 	t_u8 BSS_CoexistSupport : 1; /* bit 0 */
+	t_u8 GeospatialLocation : 1; /* bit 15 */ /* Byte 2 */
+	t_u8 CivicLocation : 1; /* bit 14 */
+	t_u8 CollocatedIntf : 1; /* bit 13 */
+	t_u8 ProxyARPService : 1; /* bit 12 */
+	t_u8 FMS : 1; /* bit 11 */
+	t_u8 LocationTracking : 1; /* bit 10 */
+	t_u8 MulticastDiagnostics : 1; /* bit 9  */
+	t_u8 Diagnostics : 1; /* bit 8  */
+	t_u8 TimingMeasurement : 1; /* bit 23 */ /* Byte 3 */
+	t_u8 MultipleBSSID : 1; /* bit 22 */
+	t_u8 AC_StationCount : 1; /* bit 21 */
+	t_u8 QoSTrafficCap : 1; /* bit 20 */
+	t_u8 BSS_Transition : 1; /* bit 19 */
+	t_u8 TIM_Broadcast : 1; /* bit 18 */
+	t_u8 WNM_Sleep : 1; /* bit 17 */
+	t_u8 TFS : 1; /* bit 16 */
+	t_u8 Interworking : 1; /* bit 31 */ /* Byte 4 */
+	t_u8 TDLSChannelSwitching : 1; /* bit 30 */
+	t_u8 TDLSPeerPSMSupport : 1; /* bit 29 */
+	t_u8 TDLSPeerUAPSDSupport : 1; /* bit 28 */
+	t_u8 UTC : 1; /* bit 27 */
+	t_u8 DMS : 1; /* bit 26 */
+	t_u8 SSID_List : 1; /* bit 25 */
+	t_u8 ChannelUsage : 1; /* bit 24 */
+	t_u8 TDLSChlSwitchProhib : 1; /* bit 39 */ /* Byte 5 */
+	t_u8 TDLSProhibited : 1; /* bit 38 */
+	t_u8 TDLSSupport : 1; /* bit 37 */
+	t_u8 MSGCF_Capa : 1; /* bit 36 */
+	t_u8 Reserved35 : 1; /* bit 35 */
+	t_u8 SSPN_Interface : 1; /* bit 34 */
+	t_u8 EBR : 1; /* bit 33 */
+	t_u8 Qos_Map : 1; /* bit 32 */
+	t_u8 rsvdBit47 : 1; /* bit 47 */ /* Byte 6 */
+	t_u8 rsvdBit46 : 1; /* bit 46 */
+	t_u8 rsvdBit45 : 1; /* bit 45 */
+	t_u8 rsvdBit44 : 1; /* bit 44 */
+	t_u8 rsvdBit43 : 1; /* bit 43 */
+	t_u8 rsvdBit42 : 1; /* bit 42 */
+	t_u8 rsvdBit41 : 1; /* bit 41 */
+	t_u8 rsvdBit40 : 1; /* bit 40 */
+	t_u8 rsvdBit55 : 1; /* bit 55 */ /* Byte 7 */
+	t_u8 rsvdBit54 : 1; /* bit 54 */
+	t_u8 rsvdBit53 : 1; /* bit 53 */
+	t_u8 rsvdBit52 : 1; /* bit 52 */
+	t_u8 rsvdBit51 : 1; /* bit 51 */
+	t_u8 rsvdBit50 : 1; /* bit 50 */
+	t_u8 rsvdBit49 : 1; /* bit 49 */
+	t_u8 rsvdBit48 : 1; /* bit 48 */
+	t_u8 MaxAMSDU0 : 1; /* bit 63 */ /* Byte 8 */
+	t_u8 OperModeNtf : 1; /* bit 62 */
+	t_u8 TDLSWildBandwidth : 1; /* bit 61 */
+	t_u8 rsvdBit60 : 1; /* bit 60 */
+	t_u8 rsvdBit59 : 1; /* bit 59 */
+	t_u8 rsvdBit58 : 1; /* bit 58 */
+	t_u8 rsvdBit57 : 1; /* bit 57 */
+	t_u8 rsvdBit56 : 1; /* bit 56 */
+	t_u8 FTMI : 1; /* bit 71 */ /* Byte 9 */
+	t_u8 FTMR : 1; /* bit 70 */
+	t_u8 CAQ : 1; /* bit 69 */
+	t_u8 rsvdBit68 : 1; /* bit 68 */
+	t_u8 NCC : 1; /* bit 67 */
+	t_u8 rsvdBit66 : 1; /* bit 66 */
+	t_u8 chanSchedMgnt : 1; /* bit 65 */
+	t_u8 MaxAMSDU1 : 1; /* bit 64 */
+	t_u8 rsvdBit79 : 1; /* bit 79 */ /* Byte 10 */
+	t_u8 TWTResp : 1; /* bit 78 */
+	t_u8 TWTReq : 1; /* bit 77 */
+	t_u8 rsvdBit76 : 1; /* bit 76 */
+	t_u8 rsvdBit75 : 1; /* bit 75 */
+	t_u8 rsvdBit74 : 1; /* bit 74 */
+	t_u8 rsvdBit73 : 1; /* bit 73 */
+	t_u8 FILS : 1; /* bit 72 */
+	t_u8 rsvdBit87 : 1; /* bit 87 */ /* Byte 11 */
+	t_u8 rsvdBit86 : 1; /* bit 86 */
+	t_u8 rsvdBit85 : 1; /* bit 85 */
+	t_u8 beacon_prot : 1; /* bit 84 */
+	t_u8 rsvdBit83 : 1; /* bit 83 */
+	t_u8 rsvdBit82 : 1; /* bit 82 */
+	t_u8 rsvdBit81 : 1; /* bit 81 */
+	t_u8 rsvdBit80 : 1; /* bit 80 */
 } MLAN_PACK_END ExtCap_t, *pExtCap_t;
 #else
 /** Extended Capabilities Data */
@@ -2164,8 +2228,6 @@
 	t_s32 max_power_level;
 	/** Min power level in dBm */
 	t_s32 min_power_level;
-	/** Adhoc state */
-	t_u32 adhoc_state;
 	/** NF of last beacon */
 	t_s32 bcn_nf_last;
 	/** wep status */
@@ -2341,6 +2403,8 @@
 	t_u8 tx_lock_flag;
 	/** Corresponds to port_open member of mlan_private */
 	t_u8 port_open;
+	/** Corresponds to tx_pause member of mlan_private */
+	t_u8 tx_pause;
 	/** bypass pkt count */
 	t_u32 bypass_pkt_count;
 	/** Corresponds to scan_processing member of mlan_adapter */
@@ -2359,6 +2423,14 @@
 	t_u32 mlan_rx_processing;
 	/** rx pkts queued */
 	t_u32 rx_pkts_queued;
+#ifdef PCIE
+	/** process pcie event interrupt */
+	t_u8 pcie_event_processing;
+	/** process pcie tx interrupt */
+	t_u8 pcie_tx_processing;
+	/** process pcie rx interrupt */
+	t_u8 pcie_rx_processing;
+#endif
 	/** Number of host to card command failures */
 	t_u32 num_cmd_host_to_card_failure;
 	/** Number of host to card sleep confirm failures */
@@ -2456,6 +2528,12 @@
 	t_u16 last_event_index;
 	/** Number of no free command node */
 	t_u16 num_no_cmd_node;
+	/** num_assoc_cmd_error, count result 4 error */
+	t_u16 num_assoc_err;
+	/** num_scan_cmd_error, count result 4 error */
+	t_u16 num_scan_err;
+	/** num_remain_on_channel_cmd_error, count result 4 error */
+	t_u16 num_remain_chan_err;
 	/** pending command id */
 	t_u16 pending_cmd;
 	/** time stamp for dnld last cmd */
@@ -2548,6 +2626,9 @@
 	t_u16 ie_len;
 } sta_info_data;
 
+/** Per station Maximum IE buffer SIZE */
+#define MAX_STA_LIST_IE_SIZE 13
+
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
 typedef struct _mlan_ds_sta_list {
 	/** station count */
@@ -2833,51 +2914,6 @@
 	} param;
 } mlan_ds_sec_cfg, *pmlan_ds_sec_cfg;
 
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-#define BIT_TLV_TYPE_CRYPTO_KEY (1 << 0)
-#define BIT_TLV_TYPE_CRYPTO_KEY_IV (1 << 1)
-#define BIT_TLV_TYPE_CRYPTO_KEY_PREFIX (1 << 2)
-#define BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK (1 << 3)
-
-/** Type definition of mlan_ds_sup_cfg */
-typedef struct _mlan_ds_sup_cfg {
-	/** Sub-command */
-	t_u8 sub_command;
-	/** output length */
-	t_u16 output_len;
-	/** number of data blks */
-	t_u16 data_blks_nr;
-	/** sub action code */
-	t_u8 sub_action_code;
-	/** skip bytes */
-	t_u16 skip_bytes;
-	/** iteration */
-	t_u32 iteration;
-	/** count */
-	t_u32 count;
-	/** pointer to output */
-	t_u8 *output;
-	/** key length  */
-	t_u16 key_len;
-	/** pointer to key */
-	t_u8 *key;
-	/** key iv length  */
-	t_u16 key_iv_len;
-	/** pointer to key iv */
-	t_u8 *key_iv;
-	/** key prefix length */
-	t_u16 key_prefix_len;
-	/** pointer to key prefix */
-	t_u8 *key_prefix;
-	/** pointer to data blk length array */
-	t_u32 *key_data_blk_len;
-	/** pointer to key data blk pointer array */
-	t_u8 **key_data_blk;
-	/** callback */
-	t_u8 call_back;
-} mlan_ds_sup_cfg, *pmlan_ds_sup_cfg;
-#endif
-
 /*-----------------------------------------------------------------*/
 /** Rate Configuration Group */
 /*-----------------------------------------------------------------*/
@@ -2977,6 +3013,8 @@
 typedef struct _mlan_ds_rate {
 	/** Sub-command */
 	t_u32 sub_command;
+	/** Only set auto tx fix rate */
+	t_u16 auto_null_fixrate_enable;
 	/** Rate configuration parameter */
 	union {
 		/** Rate configuration for MLAN_OID_RATE_CFG */
@@ -3102,6 +3140,8 @@
 
 /** Host sleep config GPIO : Default */
 #define HOST_SLEEP_DEF_GPIO 0xff
+/** Host sleep config gap : Special setting (host acknowledge required) */
+#define HOST_SLEEP_GAP_SPECIAL 0xff
 /** Host sleep config gap : Default */
 #define HOST_SLEEP_DEF_GAP 200
 /** Host sleep config min wake holdoff */
@@ -3123,7 +3163,7 @@
 	/** GPIO pin or 0xff for interface */
 	t_u32 gpio;
 	/** Gap in milliseconds or or 0xff for special
-	 *  setting when GPIO is used to wakeup host
+	 *  setting (host acknowledge required)
 	 */
 	t_u32 gap;
 	/** Host sleep wake interval */
@@ -3220,6 +3260,8 @@
 	t_u32 mcast_timeout;
 	/** Timeout for additional Rx traffic after Null PM1 packet exchange */
 	t_u32 ps_entry_timeout;
+	/** Inactivity timeout for cmd */
+	t_u32 ps_cmd_timeout;
 } mlan_ds_inactivity_to, *pmlan_ds_inactivity_to;
 
 /** Minimum sleep period in milliseconds */
@@ -3368,6 +3410,15 @@
 	t_u16 hs_wakeup_reason;
 } mlan_ds_hs_wakeup_reason;
 
+/** Type definition of mlan_fw_wakeup_params for
+ * MLAN_OID_PM_CFG_FW_WAKEUP_METHOD */
+typedef struct _mlan_fw_wakeup_params {
+	/** FW wakeup method */
+	t_u16 method;
+	/** GPIO pin NO.*/
+	t_u8 gpio_pin;
+} mlan_fw_wakeup_params, *pmlan_fw_wakeup_params;
+
 /** Type definition of mlan_ds_ps_cfg for MLAN_OID_PM_CFG_PS_CFG */
 typedef struct _mlan_ds_bcn_timeout {
 	/** Beacon miss timeout period window */
@@ -3398,6 +3449,8 @@
 		t_u32 sleep_period;
 		/** PS configuration parameters for MLAN_OID_PM_CFG_PS_CFG */
 		mlan_ds_ps_cfg ps_cfg;
+		/** FW wakeup method for MLAN_OID_PM_CFG_FW_WAKEUP_METHOD */
+		mlan_fw_wakeup_params fw_wakeup_params;
 		/** PS configuration parameters for MLAN_OID_PM_CFG_SLEEP_PARAMS
 		 */
 		mlan_ds_sleep_params sleep_params;
@@ -3596,6 +3649,26 @@
 	t_u8 reserved[10];
 } mlan_ds_wmm_queue_config, *pmlan_ds_wmm_queue_config;
 
+/** WMM HOST ADDTS configuration parameters */
+typedef struct _mlan_ds_tx_addts {
+	/* TS id - unique per tid, TA, RA combination */
+	t_u8 tsid;
+	/* RA BSSID */
+	t_u8 peer[MLAN_MAC_ADDR_LENGTH];
+	/* User priority (UP) */
+	t_u8 user_prio;
+	/* Admitted Air time for UP */
+	t_u16 admitted_time;
+} mlan_ds_tx_addts_cfg;
+
+/** WMM HOST DELTS configuration parameters */
+typedef struct _mlan_ds_tx_delts {
+	/* TS id - unique per tid, TA, RA combination */
+	t_u8 tsid;
+	/* RA BSSID */
+	t_u8 peer[MLAN_MAC_ADDR_LENGTH];
+} mlan_ds_tx_delts_cfg;
+
 /** Type definition of mlan_ds_wmm_cfg for MLAN_IOCTL_WMM_CFG */
 typedef struct _mlan_ds_wmm_cfg {
 	/** Sub-command */
@@ -3610,6 +3683,10 @@
 		mlan_ds_wmm_addts addts;
 		/** WMM delete TS for MLAN_OID_WMM_CFG_DELTS */
 		mlan_ds_wmm_delts delts;
+		/** WMM add TS for host config */
+		mlan_ds_tx_addts_cfg host_addts;
+		/** WMM del TS for host config */
+		mlan_ds_tx_delts_cfg host_delts;
 		/** WMM queue configuration for MLAN_OID_WMM_CFG_QUEUE_CONFIG */
 		mlan_ds_wmm_queue_config q_cfg;
 		/** AC Parameters Record WMM_AC_BE, WMM_AC_BK, WMM_AC_VI,
@@ -3835,14 +3912,6 @@
 	t_u32 conditions;
 } mlan_ds_reject_addba_req, *pmlan_ds_reject_addba_req;
 
-/** Type definition of mlan_ds_ibss_ampdu_param */
-typedef struct _mlan_ds_ibss_ampdu_param {
-	/** ampdu priority table */
-	t_u8 ampdu[MAX_NUM_TID];
-	/** rx amdpdu setting */
-	t_u8 addba_reject[MAX_NUM_TID];
-} mlan_ds_ibss_ampdu_param, *pmlan_ds_ibss_ampdu_param;
-
 /** Type definition of mlan_ds_11n_cfg for MLAN_IOCTL_11N_CFG */
 typedef struct _mlan_ds_11n_cfg {
 	/** Sub-command */
@@ -3879,8 +3948,6 @@
 		t_u32 coex_rx_winsize;
 		/** Control TX AMPDU configuration */
 		t_u32 txaggrctrl;
-		/** aggrprirotity table for MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM */
-		mlan_ds_ibss_ampdu_param ibss_ampdu;
 		/** Minimum BA Threshold for MLAN_OID_11N_CFG_MIN_BA_THRESHOLD
 		 */
 		t_u8 min_ba_threshold;
@@ -4007,6 +4074,10 @@
 #define MLAN_11AXCMD_CFG_ID_TXOP_RTS 5
 #define MLAN_11AXCMD_CFG_ID_TX_OMI 6
 #define MLAN_11AXCMD_CFG_ID_OBSSNBRU_TOLTIME 7
+#define MLAN_11AXCMD_CFG_ID_SET_BSRP 8
+#define MLAN_11AXCMD_CFG_ID_LLDE 9
+#define MLAN_11AXCMD_CFG_ID_RUTXPWR 10
+#define MLAN_11AXCMD_CFG_ID_HESUER 11
 
 #define MLAN_11AXCMD_SR_SUBID 0x102
 #define MLAN_11AXCMD_BEAM_SUBID 0x103
@@ -4014,12 +4085,23 @@
 #define MLAN_11AXCMD_TXOMI_SUBID 0x105
 #define MLAN_11AXCMD_OBSS_TOLTIME_SUBID 0x106
 #define MLAN_11AXCMD_TXOPRTS_SUBID 0x108
+#define MLAN_11AXCMD_SET_BSRP_SUBID 0x109
+#define MLAN_11AXCMD_LLDE_SUBID 0x110
+#define MLAN_11AXCMD_RUTXSUBPWR_SUBID 0x118
+#define MLAN_11AXCMD_HESUER_SUBID 0x121
 
 #define MLAN_11AX_TWT_SETUP_SUBID 0x114
 #define MLAN_11AX_TWT_TEARDOWN_SUBID 0x115
+#define MLAN_11AX_TWT_REPORT_SUBID 0x116
+#define MLAN_11AX_TWT_INFORMATION_SUBID 0x119
+#define MLAN_11AX_BTWT_AP_CONFIG_SUBID 0x120
+#define BTWT_AGREEMENT_MAX 5
 
 #define MRVL_DOT11AX_ENABLE_SR_TLV_ID (PROPRIETARY_TLV_BASE_ID + 322)
 #define MRVL_DOT11AX_OBSS_PD_OFFSET_TLV_ID (PROPRIETARY_TLV_BASE_ID + 323)
+#define NXP_6E_INBAND_FRAMES_TLV_ID (PROPRIETARY_TLV_BASE_ID + 345) // 0x0159
+
+#define MLAN_11AXCMD_LLDE_MODE_EVENT_DRIVEN 5
 
 /** Type definition of mlan_11axcmdcfg_obss_pd_offset for MLAN_OID_11AX_CMD_CFG
  */
@@ -4087,6 +4169,55 @@
 	t_u32 tol_time;
 } mlan_ds_11ax_toltime_cmd, *pmlan_ds_11ax_toltime_cmd;
 
+/** Type definition of mlan_ds_11ax_set_bsrp_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_set_bsrp_cmd {
+	/** command value: 1 is enable, 0 is disable*/
+	t_u8 value;
+} mlan_ds_11ax_set_bsrp_cmd, *pmlan_ds_11ax_set_bsrp_cmd;
+
+/** Type definition of mlan_ds_11ax_llde_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_llde_cmd {
+	t_u8 llde; // Uplink LLDE: enable=1,disable=0
+	t_u8 mode; // operation mode: default=0,carplay=1,gameplay=2
+	t_u8 fixrate; // trigger frame rate: auto=0xff
+	t_u8 triggerlimit; // cap airtime limit index: auto=0xff
+	t_u8 peakULrate; // cap peak UL rate
+	t_u8 dl_llde; // Downlink LLDE: enable=1,disable=0
+	t_u16 pollinterval; // Set trigger frame interval(us): auto=0
+	t_u16 txOpDuration; // Set TxOp duration
+	t_u16 llde_ctrl; // for other configurations
+	t_u16 mu_rts_successcnt;
+	t_u16 mu_rts_failcnt;
+	t_u16 basic_trigger_successcnt;
+	t_u16 basic_trigger_failcnt;
+	t_u16 tbppdu_nullcnt;
+	t_u16 tbppdu_datacnt;
+} mlan_ds_11ax_llde_cmd, *pmlan_ds_11ax_llde_cmd;
+
+/** Type definition of mlan_ds_11ax_rutxpwr_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_rutxpwr_cmd {
+	/** type*/
+	t_u16 type;
+	/** length of TLV */
+	t_u16 len;
+	/** Sub-Band */
+	t_u8 subBand;
+	/** column,row are 3 for every subband table,however column are 7 for FC
+	 * and 6 for other SOCs */
+	t_u8 col;
+	/** row are 3 for every subband table,total row for MAC1 is 12 and MAC2
+	 * id 3 ( consider only 2G support */
+	t_u8 row;
+	/**ru tx data */
+	t_s8 rutxSubPwr[89];
+} mlan_ds_11ax_rutxpwr_cmd, *pmlan_ds_11ax_rutxpwr_cmd;
+
+/** Type definition of mlan_ds_11ax_HeSuER_cmd for MLAN_11AXCMD_HESUER_SUBID */
+typedef struct _mlan_ds_11ax_HeSuER_cmd {
+	/** command value: 1 is enable, 0 is disable*/
+	t_u8 value;
+} mlan_ds_11ax_HeSuER_cmd, *pmlan_ds_11ax_HeSuER_cmd;
+
 /** Type definition of mlan_ds_11ax_cmd_cfg for MLAN_OID_11AX_CMD_CFG */
 typedef struct _mlan_ds_11ax_cmd_cfg {
 	/** Sub-command */
@@ -4108,9 +4239,41 @@
 		/** OBSS tolerance time configuration for
 		 * MLAN_11AXCMD_TOLTIME_SUBID */
 		mlan_ds_11ax_toltime_cmd toltime_cfg;
+		/** SET_BSRP configuration for MLAN_11AXCMD_SET_BSRP_SUBID */
+		mlan_ds_11ax_set_bsrp_cmd setbsrp_cfg;
+		/* MLAN_11AXCMD_LLDE_SUBID */
+		mlan_ds_11ax_llde_cmd llde_cfg;
+		/* MLAN_11AXCMD_RUTXPWR_SUBID */
+		mlan_ds_11ax_rutxpwr_cmd rutxpwr_cfg;
+		/** HeSuER configuration for MLAN_11AXCMD_HESUER_SUBID */
+		mlan_ds_11ax_HeSuER_cmd HeSuER_cfg;
 	} param;
 } mlan_ds_11ax_cmd_cfg, *pmlan_ds_11ax_cmd_cfg;
 
+/** Type definition of mlan_ds_11ax_llde_pkt_filter_cmd for
+ * mlan_ds_11ax_llde_pkt_filter_cmd_cfg */
+typedef struct _mlan_ds_11ax_llde_pkt_filter_cmd {
+	/** 0: no preference, 1: iphone (carplay IE in assoc)*/
+	t_u8 device_filter;
+	/** make traffic to specific mac address to be high priority, Can have
+	 * max 2 mac address entries */
+	t_u8 macfilter1[MLAN_MAC_ADDR_LENGTH];
+	/** make traffic to specific mac address to be high priority, other mac
+	 * filter */
+	t_u8 macfilter2[MLAN_MAC_ADDR_LENGTH];
+	/** high priority data packet type. 0: All traffic, 1: ping, 2: TCP ACK,
+	 * 4: TCP Data, 8: UDP */
+	t_u8 packet_type;
+} mlan_ds_11ax_llde_pkt_filter_cmd, *pmlan_ds_11ax_llde_pkt_filter_cmd;
+
+/** Type definition of BTWT_set*/
+typedef struct MLAN_PACK_START {
+	t_u8 btwtId;
+	t_u16 Ap_Bcast_Mantissa;
+	t_u8 Ap_Bcast_Exponent;
+	t_u8 nominalwake;
+} MLAN_PACK_END BTWT_set;
+
 /** Type definition of mlan_ds_twt_setup for MLAN_OID_11AX_TWT_CFG */
 typedef struct MLAN_PACK_START _mlan_ds_twt_setup {
 	/** Implicit, 0: TWT session is explicit, 1: Session is implicit */
@@ -4140,6 +4303,8 @@
 	t_u16 twt_mantissa;
 	/** TWT Request Type, 0: REQUEST_TWT, 1: SUGGEST_TWT*/
 	t_u8 twt_request;
+	/** TWT link lost timeout threshold */
+	t_u16 bcnMiss_threshold;
 } MLAN_PACK_END mlan_ds_twt_setup, *pmlan_ds_twt_setup;
 
 /** Type definition of mlan_ds_twt_teardown for MLAN_OID_11AX_TWT_CFG */
@@ -4153,6 +4318,40 @@
 	t_u8 teardown_all_twt;
 } MLAN_PACK_END mlan_ds_twt_teardown, *pmlan_ds_twt_teardown;
 
+/** Type definition of mlan_ds_twt_report for MLAN_OID_11AX_TWT_CFG */
+typedef MLAN_PACK_START struct _mlan_ds_twt_report {
+	/** TWT report type, 0: BTWT id */
+	t_u8 type;
+	/** TWT report length of value in data */
+	t_u8 length;
+	t_u8 reserve[2];
+	/** TWT report payload for FW response to fill */
+	t_u8 data[36];
+} MLAN_PACK_END mlan_ds_twt_report, *pmlan_ds_twt_report;
+
+/** Type definition of mlan_ds_twt_information for MLAN_OID_11AX_TWT_CFG */
+typedef struct MLAN_PACK_START _mlan_ds_twt_information {
+	/** TWT Flow Identifier. Range: [0-7] */
+	t_u8 flow_identifier;
+	/** Suspend Duration. Range: [0-UINT32_MAX]
+	 * 0:Suspend forever;
+	 * Else:Suspend agreement for specific duration in milli seconds,
+	 * 		after than resume the agreement and enter SP immediately
+	 */
+	t_u32 suspend_duration;
+} MLAN_PACK_END mlan_ds_twt_information, *pmlan_ds_twt_information;
+
+/** Type definition of mlan_ds_btwt_ap_config for MLAN_OID_11AX_TWT_CFG */
+typedef struct MLAN_PACK_START _mlan_ds_btwt_ap_config {
+	/** TWT Flow Identifier. Range: [0-7] */
+	t_u8 ap_bcast_bet_sta_wait;
+	t_u16 Ap_Bcast_Offset;
+	t_u8 bcastTWTLI;
+	t_u8 count;
+	BTWT_set BTWT_sets[BTWT_AGREEMENT_MAX];
+
+} MLAN_PACK_END mlan_ds_btwt_ap_config, *pmlan_ds_btwt_ap_config;
+
 /** Type definition of mlan_ds_twtcfg for MLAN_OID_11AX_TWT_CFG */
 typedef struct MLAN_PACK_START _mlan_ds_twtcfg {
 	/** Sub-command */
@@ -4166,6 +4365,16 @@
 		/** TWT Teardown config for Sub ID: MLAN_11AX_TWT_TEARDOWN_SUBID
 		 */
 		mlan_ds_twt_teardown twt_teardown;
+		/** TWT report for Sub ID: MLAN_11AX_TWT_REPORT_SUBID */
+		mlan_ds_twt_report twt_report;
+		/** TWT Information config for Sub ID:
+		 * MLAN_11AX_TWT_INFORMATION_SUBID
+		 */
+		mlan_ds_twt_information twt_information;
+		/** BTWT AP config for Sub ID:
+		 * MLAN_11AX_BTWT_AP_CONFIG_SUBID_SUBID
+		 */
+		mlan_ds_btwt_ap_config btwt_ap_config;
 	} param;
 } MLAN_PACK_END mlan_ds_twtcfg, *pmlan_ds_twtcfg;
 
@@ -4244,14 +4453,17 @@
 	MLAN_REG_PSU = 6,
 	MLAN_REG_BCA = 7,
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097) ||          \
-	defined(SD9177)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097) || defined(SD9177) ||             \
+	defined(SDIW610) || defined(USBIW610)
 	MLAN_REG_CIU = 8,
 #endif
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097) || defined(SDIW610) ||            \
+	defined(USBIW610)
 	MLAN_REG_MAC2 = 0x81,
 	MLAN_REG_BBP2 = 0x82,
 	MLAN_REG_RF2 = 0x83,
@@ -4456,6 +4668,26 @@
 	t_u8 cmd[MRVDRV_SIZE_OF_CMD_BUFFER];
 } mlan_ds_misc_cmd;
 
+/** Type definition of mlan_ds_misc_tx_frame for MLAN_OID_MISC_TX_FRAME */
+typedef struct _mlan_ds_misc_tx_frame {
+	/** Band Configuration */
+	Band_Config_t bandcfg;
+	/** channel */
+	t_u8 channel;
+	/** Buffer type: data, cmd, event etc. */
+	mlan_buf_type buf_type;
+	/** QoS priority */
+	t_u32 priority;
+	/** Flags for this buffer */
+	t_u32 flags;
+	/** tx_seq_num */
+	t_u32 tx_seq_num;
+	/** tx_buf length */
+	t_u16 data_len;
+	/** Tx buffer */
+	t_u8 tx_buf[MRVDRV_SIZE_OF_CMD_BUFFER];
+} mlan_ds_misc_tx_frame;
+
 /** Maximum number of system clocks */
 #define MLAN_MAX_CLK_NUM 16
 
@@ -4489,6 +4721,12 @@
 #define MLAN_NETMON_CONTROL MBIT(1)
 /* data frame */
 #define MLAN_NETMON_DATA MBIT(2)
+/* only unicast destined frame (no promiscuous) */
+#define MLAN_NETMON_NOPROM MBIT(3)
+/* capture non-bss Rx beacons */
+#define MLAN_NETMON_NON_BSS_BCN MBIT(5)
+/* capture Tx frames */
+#define MLAN_NETMON_TX MBIT(6)
 
 typedef struct _mlan_ds_misc_net_monitor {
 	/** Enable/disable network monitor */
@@ -4522,6 +4760,15 @@
 	/** Rx weak RSSI pkt threshold */
 	t_s8 rssi_threshold;
 } mlan_ds_misc_rx_abort_cfg;
+/** Type definition of mlan_ds_misc_ofdm_desense_cfg
+ * for MLAN_OID_MISC_OFDM_DESENSE_CFG
+ */
+typedef struct _mlan_ds_misc_ofdm_desense_cfg {
+	/** enable/disable ofdm desense cfg */
+	t_u8 enable;
+	/** OFDM  CCA pkt threshold */
+	t_s8 cca_threshold;
+} mlan_ds_misc_ofdm_desense_cfg;
 
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
  * for MLAN_OID_MISC_RX_ABORT_CFG_EXT
@@ -4533,8 +4780,49 @@
 	t_s8 rssi_margin;
 	/** specify ceil rssi threshold */
 	t_s8 ceil_rssi_threshold;
+	/** specify floor rssi threshold */
+	t_s8 floor_rssi_threshold;
+	/** current dynamic rssi threshold */
+	t_s8 current_dynamic_rssi_threshold;
+	/** rssi config: default or user configured */
+	t_u8 rssi_default_config;
+	/** EDMAC status */
+	t_u8 edmac_enable;
 } mlan_ds_misc_rx_abort_cfg_ext;
 
+/** Type definition of mlan_ds_misc_nav_mitigation
+ * for MLAN_OID_MISC_NAV_MITIGATION
+ */
+typedef struct _mlan_ds_misc_nav_mitigation {
+	/** start/stop nav mitigation */
+	t_u16 start_nav_mitigation;
+	/** Duration value in us to set as threshold in ACT_SET action */
+	t_u16 threshold;
+	/** Counter for NAV mitigation detected */
+	t_u16 detect_cnt;
+	/** Counter for NAV mitigation stopped */
+	t_u16 stop_cnt;
+
+} mlan_ds_misc_nav_mitigation;
+
+#define MAX_FW_STATES 6
+typedef struct _mlan_ds_led_behavior {
+	t_u8 firmwarestate;
+	t_u8 ledstate;
+	t_u8 ledargs;
+} mlan_ds_misc_led_behavior;
+
+/** Type definition of mlan_ds_misc_led_cfg
+ * for MLAN_OID_MISC_LED_CONFIG
+ */
+typedef struct _mlan_ds_misc_led_cfg {
+	t_u32 sub_command;
+	t_u8 enable;
+	/** tlv len */
+	t_u16 led_cfg_len;
+	mlan_ds_misc_led_behavior misc_led_behvr[MAX_FW_STATES];
+} mlan_ds_misc_led_cfg;
+
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
  * for MLAN_OID_MISC_TX_AMDPU_PROT_MODE
  */
@@ -4619,7 +4907,10 @@
 typedef struct _mlan_ds_misc_ipv6_ra_offload {
 	/** 0: disable; 1: enable*/
 	t_u8 enable;
-	t_u8 ipv6_addr[16];
+	/** Number of IPv6 address configured in FW */
+	t_u8 ipv6_addrs_count;
+	/** Ipv6 address array */
+	t_u8 ipv6_addrs[];
 } mlan_ds_misc_ipv6_ra_offload;
 
 /* MEF configuration disable */
@@ -4676,6 +4967,18 @@
 	t_u8 country_code[COUNTRY_CODE_LEN];
 } mlan_ds_misc_country_code;
 
+/** Type defination of mlan_ds_gpio_cfg_ops */
+typedef struct _mlan_ds_gpio_cfg_ops {
+	/** Get or Set action */
+	t_u8 action;
+	/** Operation type */
+	t_u8 opsType;
+	/** pin number */
+	t_u8 pin_num;
+	/** pin value */
+	t_u8 value;
+} mlan_ds_gpio_cfg_ops;
+
 /** action for set */
 #define SUBSCRIBE_EVT_ACT_BITWISE_SET 0x0002
 /** action for clear */
@@ -4943,7 +5246,7 @@
 	/** Channel swith time (in TU) for chan_idx */
 	t_u8 switchtime;
 	/** Undoze time (in TU) for chan_idx */
-	t_u8 undozetime;
+	t_u8 rx_wait_time;
 	/** Rx traffic control scheme when channel switch*/
 	/** only valid for GC/STA interface*/
 	t_u8 mode;
@@ -5373,6 +5676,21 @@
 	t_u16 ether_type;
 } mlan_ds_misc_keep_alive, *pmlan_ds_misc_keep_alive;
 
+#define MKEEP_ALIVE_ACK_PKT_MAX 100
+typedef struct _mlan_ds_misc_keep_alive_rx {
+	t_u8 mkeep_alive_id;
+	t_u8 enable;
+	/** enable/disable tcp reset*/
+	t_u8 reset;
+	/**True means saved in driver, false means not saved or download*/
+	t_u8 cached;
+	t_u8 dst_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u8 src_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u16 pkt_len;
+	t_u8 packet[MKEEP_ALIVE_ACK_PKT_MAX];
+	/** Ethernet type */
+	t_u16 ether_type;
+} mlan_ds_misc_keep_alive_rx, *pmlan_ds_misc_keep_alive_rx;
 /** TX and RX histogram statistic parameters*/
 typedef MLAN_PACK_START struct _mlan_ds_misc_tx_rx_histogram {
 	/** Enable or disable get tx/rx histogram statistic */
@@ -5382,25 +5700,9 @@
 	/** Size of Tx/Rx info */
 	t_u16 size;
 	/** Store Tx/Rx info */
-	t_u8 value[1];
+	t_u8 value[];
 } MLAN_PACK_END mlan_ds_misc_tx_rx_histogram;
 
-typedef MLAN_PACK_START struct _mlan_ds_cw_mode_ctrl {
-	/** Mode of Operation 0: Disable 1: Tx Continuous Packet 2: Tx
-	 * Continuous Wave */
-	t_u8 mode;
-	/*channel*/
-	t_u8 channel;
-	/* channel info*/
-	t_u8 chanInfo;
-	/** Tx Power level in dBm */
-	t_u16 txPower;
-	/** Packet Length */
-	t_u16 pktLength;
-	/** bit rate Info */
-	t_u32 rateInfo;
-} MLAN_PACK_END mlan_ds_cw_mode_ctrl;
-
 #define RX_PKT_INFO MBIT(1)
 /** Struct for per-packet configuration */
 typedef struct _mlan_per_pkt_cfg {
@@ -5427,6 +5729,115 @@
 	t_u8 gpio_polarity;
 } mlan_ds_misc_robustcoex_params;
 
+/** RTT configuration */
+typedef struct _mlan_rtt_config {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	t_u8 type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	t_u8 peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	t_u8 channel;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	Band_Config_t bandcfg;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u8 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u8 num_burst;
+	/** num of frames per burst.
+	 * Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames
+	 * to be attempted in a single burst. This also
+	 * equals the number of FTM frames that the
+	 * initiator will request that the responder send
+	 * in a single frame. */
+	t_u8 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can
+	 * retry an FTMR frame.
+	 * Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u8 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	t_u8 preamble;
+	/** RTT BW to be used in the RTT frames */
+	t_u8 bw;
+} mlan_rtt_config, *pmlan_rtt_config;
+
+/** RTT config params */
+typedef struct _mlan_rtt_config_params {
+	t_u8 rtt_config_num;
+	mlan_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} mlan_rtt_config_params;
+
+/** RTT cancel params */
+typedef struct _mlan_rtt_cancel_params {
+	t_u8 rtt_cancel_num;
+	t_u8 rtt_cancel[MAX_RTT_CONFIG_NUM][MLAN_MAC_ADDR_LENGTH];
+} mlan_rtt_cancel_params;
+
+/** RTT responder info */
+typedef struct _rtt_responder_info {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u8 preamble;
+} rtt_responder_info;
+
+/** RTT responder enable configure */
+typedef struct _rtt_responder_encfg {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u32 max_dur_sec;
+} rtt_responder_encfg;
+
+/** Define for mlan_rtt_responder.action */
+#define RTT_GET_RESPONDER_INFO 0
+#define RTT_SET_RESPONDER_ENABLE 1
+#define RTT_SET_RESPONDER_DISABLE 2
+#define RTT_SET_RESPONDER_LCI 3
+#define RTT_SET_RESPONDER_LCR 4
+
+/** RTT responder configure for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+typedef struct _mlan_rtt_responder {
+	t_u8 action;
+	union {
+		rtt_responder_info info;
+		rtt_responder_encfg encfg;
+		wifi_lci_information lci;
+		wifi_lcr_information lcr;
+	} u;
+} mlan_rtt_responder;
+
 #if defined(PCIE)
 typedef struct _mlan_ds_ssu_params {
 	t_u32 nskip;
@@ -5464,6 +5875,15 @@
 	t_u8 csi_filter_cnt;
 	/** Chip ID */
 	t_u8 chip_id;
+	/** band config */
+	t_u8 band_config;
+	/** Channel num */
+	t_u8 channel;
+	/** Enable getting CSI data on special channel */
+	t_u8 csi_monitor_enable;
+	/** CSI data received in cfg channel with mac addr filter, not only RA
+	 * is us or other*/
+	t_u8 ra4us;
 	/** CSI filters */
 	mlan_csi_filter_t csi_filter[CSI_FILTER_MAX];
 } MLAN_PACK_END mlan_ds_csi_params;
@@ -5537,6 +5957,9 @@
 #define MFG_CMD_RADIO_MODE_CFG 0x1211
 #define MFG_CMD_CONFIG_MAC_HE_TB_TX 0x110A
 #define MFG_CMD_CONFIG_TRIGGER_FRAME 0x110C
+#define MFG_CMD_OTP_MAC_ADD 0x108C
+#define MFG_CMD_OTP_CAL_DATA 0x121A
+
 /** MFG CMD generic cfg */
 struct MLAN_PACK_START mfg_cmd_generic_cfg {
 	/** MFG command code */
@@ -5594,7 +6017,9 @@
 	/** STBC */
 	t_u32 stbc;
 	/** power id */
-	t_u32 rsvd[2];
+	t_u32 rsvd[1];
+	/**signal bw*/
+	t_u32 signal_bw;
 	/** NumPkt */
 	t_u32 NumPkt;
 	/** MaxPE */
@@ -5831,6 +6256,37 @@
 	mfg_cmd_IEEETypes_BasicHETrigUserInfo_t basic_trig_user_info;
 } MLAN_PACK_END mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t;
 
+typedef MLAN_PACK_START struct _mfg_cmd_otp_mac_addr_rd_wr_t {
+	/** MFG command code */
+	t_u32 mfg_cmd;
+	/** Action */
+	t_u16 action;
+	/** Device ID */
+	t_u16 device_id;
+	/** MFG Error code */
+	t_u32 error;
+	/** Destination MAC Address */
+	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END mfg_cmd_otp_mac_addr_rd_wr_t;
+
+#define CAL_DATA_LEN 1400
+typedef MLAN_PACK_START struct _mfg_cmd_otp_cal_data_rd_wr_t {
+	/** MFG command code */
+	t_u32 mfg_cmd;
+	/** Action */
+	t_u16 action;
+	/** Device ID */
+	t_u16 device_id;
+	/** MFG Error code */
+	t_u32 error;
+	/** CAL Data write status */
+	t_u32 cal_data_status;
+	/** CAL Data Length*/
+	t_u32 cal_data_len;
+	/** Destination MAC Address */
+	t_u8 cal_data[CAL_DATA_LEN];
+} MLAN_PACK_END mfg_cmd_otp_cal_data_rd_wr_t;
+
 typedef struct _mlan_ds_misc_chnrgpwr_cfg {
 	/** length */
 	t_u16 length;
@@ -5848,6 +6304,22 @@
 	chan_freq_power_t cfp_tbl[];
 } mlan_ds_misc_cfp_tbl;
 
+/** channel attribute */
+typedef struct _chan_attr {
+	/** channel number */
+	t_u8 channel;
+	/** channel flags */
+	t_u8 flags;
+} chan_attr_t;
+
+/** channel flags table */
+typedef struct _mlan_ds_chan_attr {
+	/** Data length */
+	t_u16 data_len;
+	/** Data */
+	chan_attr_t chan_attr[MLAN_MAX_CHANNEL_NUM];
+} MLAN_PACK_END mlan_ds_chan_attr;
+
 /** mlan_ds_mc_aggr_cfg for MLAN_OID_MISC_MC_AGGR_CFG */
 typedef struct _mlan_ds_mc_aggr_cfg {
 	/** action */
@@ -5856,13 +6328,15 @@
 	 * bit 0 MC aggregation
 	 * bit 1 packet expiry
 	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
+	 * bit 3 CTS2Self duration offset
+	 * bit 6 UC non aggregation*/
 	t_u8 enable_bitmap;
 	/* 1 valid, 0 invalid
 	 * bit 0 MC aggregation
 	 * bit 1 packet expiry
 	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
+	 * bit 3 CTS2Self duration offset
+	 * bit 6 UC non aggregation*/
 	t_u8 mask_bitmap;
 	/** CTS2Self duration offset */
 	t_u16 cts2self_offset;
@@ -5875,7 +6349,7 @@
 	/** tlv len */
 	t_u16 tlv_len;
 	/** TLV buffer */
-	t_u8 tlv_buf[1];
+	t_u8 tlv_buf[];
 } mlan_ds_stats;
 
 typedef struct _mlan_ds_ch_load {
@@ -5885,9 +6359,102 @@
 	t_s16 noise;
 	t_u16 rx_quality;
 	t_u16 duration;
-	t_u16 cca_th;
 } mlan_ds_ch_load;
 
+/** Type definition of mlan_ds_cross_chip_synch */
+typedef struct _mlan_ds_cross_chip_synch {
+	/**cross chip sync action 0-GET, 1-SET */
+	t_u16 action;
+	/**cross chip sync start or stop */
+	t_u8 start_stop;
+	/**cross chip sync role, master or slave */
+	t_u8 role;
+	/**cross chip sync periodicty of toggle in us */
+	t_u32 period;
+	/**cross chip sync initial TSF low */
+	t_u32 init_tsf_low;
+	/**cross chip sync intial TSF high */
+	t_u32 init_tsf_high;
+} mlan_ds_cross_chip_synch;
+
+#define MAX_RFUS 2
+#define MAX_PATHS 2
+typedef struct _mlan_ds_tsp_cfg {
+	/** TSP config action 0-GET, 1-SET */
+	t_u16 action;
+	/** TSP enable/disable tsp algothrim */
+	t_u16 enable;
+	/** TSP config power backoff */
+	t_s32 backoff;
+	/** TSP config high threshold */
+	t_s32 high_thrshld;
+	/** TSP config low threshold */
+	t_s32 low_thrshld;
+	/** TSP config DUTY_CYC_STEP */
+	t_s32 duty_cyc_step;
+	/** TSP config DUTY_CYC_MIN */
+	t_s32 duty_cyc_min;
+	/** TSP config HIGH_THRESHOLD_TEMP */
+	t_s32 high_thrshld_temp;
+	/** TSP config LOW_THRESHOLD_TEMP */
+	t_s32 low_thrshld_temp;
+	/** TSP CAU TSEN register */
+	t_s32 reg_cau_val;
+	/** TSP RFU registers */
+	t_s32 reg_rfu_temp[MAX_RFUS][MAX_PATHS];
+} MLAN_PACK_END mlan_ds_tsp_cfg;
+
+typedef struct _mlan_ds_reorder_flush_time {
+	/** AC BK/BE_flush time*/
+	t_u16 flush_time_ac_be_bk;
+	/** AC VI/VO flush time */
+	t_u16 flush_time_ac_vi_vo;
+} mlan_ds_reorder_flush_time;
+
+/** EDMAC configuration parameters */
+typedef struct _mlan_ds_ed_mac_cfg {
+	/** EU adaptivity for 2.4ghz band */
+	t_u16 ed_ctrl_2g;
+	/** Energy detect threshold offset for 2.4ghz */
+	t_s16 ed_offset_2g;
+	/** EU adaptivity for 5ghz band */
+	t_u16 ed_ctrl_5g;
+	/** Energy detect threshold offset for 5ghz */
+	t_s16 ed_offset_5g;
+
+	t_u32 ed_bitmap_txq_lock;
+} mlan_ds_ed_mac_cfg;
+
+/** valid range for mlan_ds_auth_assoc_timeout_cfg */
+#define AUTH_TIMEOUT_MIN 500
+#define AUTH_TIMEOUT_MAX 2400
+#define AUTH_RETRY_TIMEOUT_ACK_MIN 50
+#define AUTH_RETRY_TIMEOUT_ACK_MAX 300
+#define AUTH_RETRY_TIMEOUT_NO_ACK_MIN 40
+#define AUTH_RETRY_TIMEOUT_NO_ACK_MAX 80
+#define ASSOC_TIMEOUT_MIN 200
+#define ASSOC_TIMEOUT_MAX 1500
+#define REASSOC_TIMEOUT_MIN 100
+#define REASSOC_TIMEOUT_MAX 1500
+#define ASSOC_RETRY_TIMEOUT_MIN 50
+#define ASSOC_RETRY_TIMEOUT_MAX 150
+
+/** Auth Assoc timeout configuration parameters */
+typedef struct _mlan_ds_auth_assoc_timeout_cfg {
+	/** auth timeout */
+	t_u16 auth_timeout;
+	/** Auth retry timeout if received ack */
+	t_u16 auth_retry_timeout_if_ack;
+	/** Auth retry timeout if ack is not received */
+	t_u16 auth_retry_timeout_if_no_ack;
+	/** assoc timeout */
+	t_u16 assoc_timeout;
+	/** reassoc timeout */
+	t_u16 reassoc_timeout;
+	/** assoc/reassoc frame retry timeout if ack received */
+	t_u16 retry_timeout;
+} mlan_ds_auth_assoc_timeout_cfg;
+
 /** Type definition of mlan_ds_misc_cfg for MLAN_IOCTL_MISC_CFG */
 typedef struct _mlan_ds_misc_cfg {
 	/** Sub-command */
@@ -5904,6 +6471,8 @@
 #endif
 		/** Hostcmd for MLAN_OID_MISC_HOST_CMD */
 		mlan_ds_misc_cmd hostcmd;
+		/** tx_frame for MLAN_OID_MISC_TX_FRAME */
+		mlan_ds_misc_tx_frame tx_frame;
 		/** System clock for MLAN_OID_MISC_SYS_CLOCK */
 		mlan_ds_misc_sys_clock sys_clock;
 		/** WWS set/get for MLAN_OID_MISC_WWS */
@@ -5955,6 +6524,8 @@
 #endif
 		/** Hotspot config param set */
 		t_u32 hotspot_cfg;
+		/** Multi AP flag */
+		t_u8 multi_ap_flag;
 #ifdef STA_SUPPORT
 		ExtCap_t ext_cap;
 #endif
@@ -6001,11 +6572,17 @@
 		t_u64 misc_tsf;
 		mlan_ds_custom_reg_domain custom_reg_domain;
 		mlan_ds_misc_keep_alive keep_alive;
+		mlan_ds_misc_keep_alive_rx keep_alive_rx;
 		mlan_ds_misc_tx_rx_histogram tx_rx_histogram;
-		mlan_ds_cw_mode_ctrl cwmode;
 		/**  Tx/Rx per-packet control */
 		t_u8 txrx_pkt_ctrl;
 		mlan_ds_misc_robustcoex_params robustcoexparams;
+		/** config RTT for MLAN_OID_MISC_CONFIG_RTT */
+		mlan_rtt_config_params rtt_params;
+		/** cancel RTT for MLAN_OID_MISC_CANCEL_RTT */
+		mlan_rtt_cancel_params rtt_cancel;
+		/** config RTT responder for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+		mlan_rtt_responder rtt_rsp_cfg;
 #if defined(PCIE)
 		mlan_ds_ssu_params ssu_params;
 #endif
@@ -6016,12 +6593,16 @@
 		mlan_ds_misc_mapping_policy dmcs_policy;
 		mlan_ds_misc_dmcs_status dmcs_status;
 		mlan_ds_misc_rx_abort_cfg rx_abort_cfg;
+		mlan_ds_misc_ofdm_desense_cfg ofdm_desense_cfg;
 		mlan_ds_misc_rx_abort_cfg_ext rx_abort_cfg_ext;
+		mlan_ds_misc_nav_mitigation nav_mitigation;
+		mlan_ds_misc_led_cfg led_config;
 		mlan_ds_misc_tx_ampdu_prot_mode tx_ampdu_prot_mode;
 		mlan_ds_misc_rate_adapt_cfg rate_adapt_cfg;
 		mlan_ds_misc_cck_desense_cfg cck_desense_cfg;
 		mlan_ds_misc_chan_trpc_cfg trpc_cfg;
 		mlan_ds_misc_chnrgpwr_cfg rgchnpwr_cfg;
+		mlan_ds_chan_attr chan_attr_cfg;
 
 		mlan_ds_band_steer_cfg band_steer_cfg;
 		mlan_ds_beacon_stuck_param_cfg beacon_stuck_cfg;
@@ -6030,9 +6611,12 @@
 		struct mfg_cmd_tx_frame2 mfg_tx_frame2;
 		struct mfg_Cmd_HE_TBTx_t mfg_he_power;
 		mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t mfg_tx_trigger_config;
+		mfg_cmd_otp_mac_addr_rd_wr_t mfg_otp_mac_addr_rd_wr;
+		mfg_cmd_otp_cal_data_rd_wr_t mfg_otp_cal_data_rd_wr;
 		mlan_ds_misc_arb_cfg arb_cfg;
 		mlan_ds_misc_cfp_tbl cfp;
 		t_u8 range_ext_mode;
+		mlan_ds_twt_report twt_report_info;
 		mlan_ds_misc_dot11mc_unassoc_ftm_cfg dot11mc_unassoc_ftm_cfg;
 		mlan_ds_misc_tp_state tp_state;
 		mlan_ds_hal_phy_cfg_params hal_phy_cfg_params;
@@ -6043,9 +6627,33 @@
 #endif
 		t_u32 ips_ctrl;
 		mlan_ds_ch_load ch_load;
+		mlan_ds_cross_chip_synch cross_chip_synch;
+		mlan_ds_tsp_cfg tsp_cfg;
+		mlan_ds_reorder_flush_time flush_time;
+		mlan_ds_ed_mac_cfg edmac_cfg;
+		mlan_ds_gpio_cfg_ops gpio_cfg_ops;
+		mlan_ds_auth_assoc_timeout_cfg auth_assoc_cfg;
 	} param;
 } mlan_ds_misc_cfg, *pmlan_ds_misc_cfg;
 
+typedef struct _mlan_cfpinfo {
+	t_u8 nss : 2;
+	t_u8 is2g_present : 1;
+	t_u8 is5g_present : 1;
+	t_u8 is6g_present : 1;
+	t_u8 reserved : 3;
+	t_u8 rows_2g;
+	t_u8 cols_2g;
+	t_u8 rows_5g;
+	t_u8 cols_5g;
+	t_u8 rows_6g;
+	t_u8 cols_6g;
+	t_u8 region_code;
+	t_u8 environment;
+	t_u8 country_code[2];
+	t_u16 action;
+} mlan_cfpinfo;
+
 /** Hotspot status enable */
 #define HOTSPOT_ENABLED MBIT(0)
 /** Hotspot status disable */
diff --git a/wlan_sd8987/mlan/mlan_join.c b/wlan_src/mlan/mlan_join.c
old mode 100755
new mode 100644
similarity index 67%
rename from wlan_sd8987/mlan/mlan_join.c
rename to wlan_src/mlan/mlan_join.c
index 3bf0539..48eb26f
--- a/wlan_sd8987/mlan/mlan_join.c
+++ b/wlan_src/mlan/mlan_join.c
@@ -7,20 +7,29 @@
  *  to the firmware.
  *
  *
- *  Copyright 2008-2023 NXP
+ *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -39,9 +48,6 @@
 #include "mlan_11ac.h"
 #include "mlan_11ax.h"
 #include "mlan_11h.h"
-#ifdef DRV_EMBEDDED_SUPPLICANT
-#include "authenticator_api.h"
-#endif
 /********************************************************
 			Local Constants
 ********************************************************/
@@ -309,12 +315,13 @@
 	PRINTM(MINFO, "Tx DataRate is set to 0x%X\n", pmpriv->data_rate);
 
 	if (!pmpriv->is_data_rate_auto) {
-		while (*ptr) {
+		while (rate1_size && *ptr) {
 			if ((*ptr & 0x7f) == pmpriv->data_rate) {
 				ret = MLAN_STATUS_SUCCESS;
 				goto done;
 			}
 			ptr++;
+			rate1_size--;
 		}
 		PRINTM(MMSG,
 		       "Previously set fixed data rate %#x is not "
@@ -841,6 +848,14 @@
 	ap_mfpc = ((*prsn_cap & (0x1 << MFPC_BIT)) == (0x1 << MFPC_BIT));
 	ap_mfpr = ((*prsn_cap & (0x1 << MFPR_BIT)) == (0x1 << MFPR_BIT));
 
+	/* Check for negative case
+	 * If WPA3SAE AP has PMF=0, block the association */
+	if ((*akm_type == AssocAgentAuth_Wpa3Sae) && (!ap_mfpc && !ap_mfpr)) {
+		PRINTM(MERROR,
+		       "RSNE: WPA3-SAE AP with incorrect PMF setting, can't associate to AP\n");
+		return MLAN_STATUS_FAILURE;
+	}
+
 	if ((!ap_mfpc && !ap_mfpr && pmpriv->pmfcfg.mfpr) ||
 	    ((!ap_mfpc) && ap_mfpr) ||
 	    (ap_mfpc && ap_mfpr && (!pmpriv->pmfcfg.mfpc))) {
@@ -1040,9 +1055,7 @@
 	t_u32 rates_size;
 	t_u16 tmp_cap;
 	t_u8 *pos;
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	void *rsn_wpa_ie_tmp = MNULL;
-#endif
+	IEEEtypes_CapInfo_t *pcap_info;
 	t_u8 ft_akm = 0;
 	t_u8 oper_class;
 	t_u8 oper_class_flag = MFALSE;
@@ -1050,6 +1063,7 @@
 	MrvlIEtypes_HostMlme_t *host_mlme_tlv = MNULL;
 	MrvlIEtypes_PrevBssid_t *prev_bssid_tlv = MNULL;
 	t_u8 zero_mac[MLAN_MAC_ADDR_LENGTH] = {0};
+	MrvlIEtypes_MultiAp_t *multi_ap_tlv = MNULL;
 
 	ENTER();
 
@@ -1060,6 +1074,9 @@
 
 	/* Save so we know which BSS Desc to use in the response handler */
 	pmpriv->pattempted_bss_desc = pbss_desc;
+	memcpy_ext(pmpriv->adapter, &pmpriv->curr_bss_params.attemp_bssid,
+		   pbss_desc->mac_address, MLAN_MAC_ADDR_LENGTH,
+		   MLAN_MAC_ADDR_LENGTH);
 	/* clear assoc_rsp_size */
 	pmpriv->assoc_rsp_size = 0;
 	pmpriv->assoc_req_size = 0;
@@ -1168,8 +1185,8 @@
 			psae_pwe_mode_tlv = (MrvlIEtypes_SAE_PWE_Mode_t *)pos;
 			psae_pwe_mode_tlv->header.type = wlan_cpu_to_le16(
 				TLV_TYPE_WPA3_SAE_PWE_DERIVATION_MODE);
-			psae_pwe_mode_tlv->header.len =
-				sizeof(psae_pwe_mode_tlv->pwe);
+			psae_pwe_mode_tlv->header.len = wlan_cpu_to_le16(
+				sizeof(psae_pwe_mode_tlv->pwe));
 			psae_pwe_mode_tlv->pwe[0] =
 				pbss_desc->prsnx_ie->data[0];
 			pos += sizeof(psae_pwe_mode_tlv->header) +
@@ -1254,25 +1271,13 @@
 			psecurity_cfg_ie->header.len = sizeof(t_u8);
 			pos += sizeof(psecurity_cfg_ie->header) +
 			       psecurity_cfg_ie->header.len;
-		}
-#ifdef DRV_EMBEDDED_SUPPLICANT
-		else if (supplicantIsEnabled(pmpriv->psapriv)) {
-			supplicantClrEncryptKey(pmpriv->psapriv);
-
-			if (pbss_desc->prsn_ie)
-				rsn_wpa_ie_tmp = pbss_desc->prsn_ie;
-			else if (pbss_desc->pwpa_ie)
-				rsn_wpa_ie_tmp = pbss_desc->pwpa_ie;
-			prsn_ie_tlv = (MrvlIEtypes_RsnParamSet_t *)pos;
-			pos += supplicantFormatRsnWpaTlv(
-				pmpriv->psapriv, rsn_wpa_ie_tmp, prsn_ie_tlv);
-		}
-#endif
-		else if (pmpriv->sec_info.ewpa_enabled ||
-			 (pbss_desc->owe_transition_mode ==
-			  OWE_TRANS_MODE_OWE) ||
-			 (pmpriv->sec_info.authentication_mode ==
-			  MLAN_AUTH_MODE_OWE)) {
+			psecurity_cfg_ie->header.len =
+				wlan_cpu_to_le16(psecurity_cfg_ie->header.len);
+		} else if (pmpriv->sec_info.ewpa_enabled ||
+			   (pbss_desc->owe_transition_mode ==
+			    OWE_TRANS_MODE_OWE) ||
+			   (pmpriv->sec_info.authentication_mode ==
+			    MLAN_AUTH_MODE_OWE)) {
 			prsn_ie_tlv = (MrvlIEtypes_RsnParamSet_t *)pos;
 			if (pbss_desc->pwpa_ie) {
 				prsn_ie_tlv->header.type =
@@ -1444,6 +1449,13 @@
 	    wlan_11ax_bandconfig_allowed(pmpriv, pbss_desc))
 		wlan_cmd_append_11ax_tlv(pmpriv, pbss_desc, &pos);
 
+	if ((!pbss_desc->disable_11n) &&
+	    (ISSUPP_11NENABLED(pmadapter->fw_cap_info) ||
+	     ISSUPP_11ACENABLED(pmadapter->fw_cap_info) ||
+	     IS_FW_SUPPORT_11AX(pmadapter))) {
+		PRINTM(MCMND, "STBC NOT supported, Will be disabled\n");
+	}
+
 	wlan_wmm_process_association_req(pmpriv, &pos, &pbss_desc->wmm_ie);
 	if (pmpriv->sec_info.wapi_enabled && pmpriv->wapi_ie_len)
 		wlan_cmd_append_wapi_ie(pmpriv, &pos);
@@ -1462,18 +1474,20 @@
 		host_mlme_tlv = (MrvlIEtypes_HostMlme_t *)pos;
 		host_mlme_tlv->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_HOST_MLME);
-		host_mlme_tlv->header.len =
-			wlan_cpu_to_le16(sizeof(host_mlme_tlv->host_mlme));
+		host_mlme_tlv->header.len = sizeof(host_mlme_tlv->host_mlme);
 		host_mlme_tlv->host_mlme = MTRUE;
 		pos += sizeof(host_mlme_tlv->header) +
 		       host_mlme_tlv->header.len;
+		host_mlme_tlv->header.len =
+			wlan_cpu_to_le16(host_mlme_tlv->header.len);
 	}
 	if (memcmp(pmadapter, &pmpriv->curr_bss_params.prev_bssid, zero_mac,
 		   MLAN_MAC_ADDR_LENGTH)) {
 		prev_bssid_tlv = (MrvlIEtypes_PrevBssid_t *)pos;
 		prev_bssid_tlv->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_PREV_BSSID);
-		prev_bssid_tlv->header.len = MLAN_MAC_ADDR_LENGTH;
+		prev_bssid_tlv->header.len =
+			wlan_cpu_to_le16(MLAN_MAC_ADDR_LENGTH);
 		memcpy_ext(pmadapter, prev_bssid_tlv->prev_bssid,
 			   &pmpriv->curr_bss_params.prev_bssid,
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
@@ -1482,6 +1496,18 @@
 		pos += sizeof(prev_bssid_tlv->header) + MLAN_MAC_ADDR_LENGTH;
 	}
 
+	if (pmpriv->multi_ap_flag) {
+		multi_ap_tlv = (MrvlIEtypes_MultiAp_t *)pos;
+		multi_ap_tlv->header.type = wlan_cpu_to_le16(TLV_TYPE_MULTI_AP);
+		multi_ap_tlv->header.len = sizeof(multi_ap_tlv->flag);
+		multi_ap_tlv->flag = pmpriv->multi_ap_flag;
+		PRINTM(MINFO, " TLV multi_ap_flag : 0x%x\n",
+		       multi_ap_tlv->flag);
+		pos += sizeof(multi_ap_tlv->header) + multi_ap_tlv->header.len;
+		multi_ap_tlv->header.len =
+			wlan_cpu_to_le16(sizeof(multi_ap_tlv->flag));
+	}
+
 	if (wlan_11d_create_dnld_countryinfo(pmpriv, pbss_desc->bss_band)) {
 		PRINTM(MERROR, "Dnld_countryinfo_11d failed\n");
 		ret = MLAN_STATUS_FAILURE;
@@ -1508,9 +1534,17 @@
 	memcpy_ext(pmadapter, &tmp_cap, &pbss_desc->cap_info,
 		   sizeof(passo->cap_info), sizeof(tmp_cap));
 
+	/* retain spectrum_mgmt capability */
+	pcap_info = &passo->cap_info;
+	if (pcap_info->spectrum_mgmt)
+		SPECTRUM_MGMT_ENABLED(tmp_cap);
+
 	if (pmpriv->config_bands == BAND_B)
 		SHORT_SLOT_TIME_DISABLED(tmp_cap);
 
+	if (pmpriv->adapter->pcard_info->support_11mc)
+		RADIO_MEASUREMENT_ENABLED(tmp_cap);
+
 	tmp_cap &= CAPINFO_MASK;
 	PRINTM(MINFO, "ASSOC_CMD: tmp_cap=%4X CAPINFO_MASK=%4lX\n", tmp_cap,
 	       CAPINFO_MASK);
@@ -1616,21 +1650,26 @@
 	assoc_logger_data *assoc_succ;
 	mlan_ds_bss *bss;
 	IEEEtypes_MgmtHdr_t *hdr;
+	t_u16 sub_type = 0;
+	t_u16 assoc_rsp_size = 0;
 
 	ENTER();
 
-	if (pmpriv->curr_bss_params.host_mlme) {
-		hdr = (IEEEtypes_MgmtHdr_t *)&resp->params;
-		if (!memcmp(pmpriv->adapter, hdr->BssId,
-			    pmpriv->pattempted_bss_desc->mac_address,
-			    MLAN_MAC_ADDR_LENGTH))
-			passoc_rsp = (IEEEtypes_AssocRsp_t
-					      *)((t_u8 *)(&resp->params) +
+	hdr = (IEEEtypes_MgmtHdr_t *)&resp->params;
+	sub_type = IEEE80211_GET_FC_MGMT_FRAME_SUBTYPE(hdr->FrmCtl);
+	assoc_rsp_size = resp->size - S_DS_GEN;
+	if ((assoc_rsp_size >=
+	     (sizeof(IEEEtypes_MgmtHdr_t) + sizeof(IEEEtypes_AssocRsp_t))) &&
+	    !memcmp(pmpriv->adapter, hdr->BssId,
+		    pmpriv->curr_bss_params.attemp_bssid,
+		    MLAN_MAC_ADDR_LENGTH) &&
+	    ((sub_type == SUBTYPE_ASSOC_RESP) ||
+	     (sub_type == SUBTYPE_REASSOC_RESP))) {
+		passoc_rsp =
+			(IEEEtypes_AssocRsp_t *)((t_u8 *)(&resp->params) +
 						 sizeof(IEEEtypes_MgmtHdr_t));
-		else
-			passoc_rsp = (IEEEtypes_AssocRsp_t *)&resp->params;
+		pmpriv->curr_bss_params.host_mlme = MTRUE;
 	} else
-
 		passoc_rsp = (IEEEtypes_AssocRsp_t *)&resp->params;
 	passoc_rsp->status_code = wlan_le16_to_cpu(passoc_rsp->status_code);
 	if (pmpriv->media_connected == MTRUE)
@@ -1663,11 +1702,19 @@
 				    pmpriv->pattempted_bss_desc->mac_address,
 				    MLAN_MAC_ADDR_LENGTH))
 				wlan_reset_connect_state(pmpriv, MTRUE);
-			else
+			else {
+				memcpy_ext(
+					pmpriv->adapter,
+					&pmpriv->curr_bss_params.attemp_bssid,
+					pmpriv->curr_bss_params.bss_descriptor
+						.mac_address,
+					MLAN_MAC_ADDR_LENGTH,
+					MLAN_MAC_ADDR_LENGTH);
 				wlan_recv_event(
 					pmpriv,
 					MLAN_EVENT_ID_DRV_ASSOC_FAILURE_REPORT,
 					MNULL);
+			}
 		} else
 			wlan_reset_connect_state(pmpriv, MTRUE);
 		pmpriv->adapter->dbg.num_cmd_assoc_failure++;
@@ -1694,6 +1741,7 @@
 
 	/* Send a Media Connected event, according to the Spec */
 	pmpriv->media_connected = MTRUE;
+	pmpriv->multi_ap_flag = 0;
 	pmpriv->adapter->pps_uapsd_mode = MFALSE;
 	pmpriv->adapter->tx_lock_flag = MFALSE;
 	pmpriv->adapter->delay_null_pkt = MFALSE;
@@ -1835,11 +1883,7 @@
 
 	if (!pmpriv->sec_info.wpa_enabled && !pmpriv->sec_info.wpa2_enabled &&
 	    !pmpriv->sec_info.ewpa_enabled && !pmpriv->sec_info.wapi_enabled &&
-	    !pmpriv->wps.session_enable && !pmpriv->sec_info.osen_enabled
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	    && !supplicantIsEnabled(pmpriv->psapriv)
-#endif
-	) {
+	    !pmpriv->wps.session_enable && !pmpriv->sec_info.osen_enabled) {
 		/* We are in Open/WEP mode, open port immediately */
 		if (pmpriv->port_ctrl_mode == MTRUE) {
 			pmpriv->port_open = MTRUE;
@@ -1848,22 +1892,9 @@
 	}
 	if (pmpriv->sec_info.wpa_enabled || pmpriv->sec_info.wpa2_enabled ||
 	    pmpriv->sec_info.ewpa_enabled || pmpriv->sec_info.wapi_enabled ||
-	    pmpriv->wps.session_enable || pmpriv->sec_info.osen_enabled
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	    || (supplicantIsEnabled(pmpriv->psapriv))
-#endif
-	)
+	    pmpriv->wps.session_enable || pmpriv->sec_info.osen_enabled)
 		pmpriv->adapter->scan_block = MTRUE;
 
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	supplicantInitSession(
-		pmpriv->psapriv,
-		(t_u8 *)&pmpriv->curr_bss_params.bss_descriptor.ssid.ssid,
-		pmpriv->curr_bss_params.bss_descriptor.ssid.ssid_len,
-		(t_u8 *)&pmpriv->curr_bss_params.bss_descriptor.mac_address,
-		(t_u8 *)&pmpriv->curr_addr);
-#endif
-
 	pevent = (mlan_event *)event_buf;
 	memset(pmadapter, event_buf, 0, sizeof(event_buf));
 	pevent->bss_index = pmpriv->bss_index;
@@ -1900,752 +1931,6 @@
 			pioctl_req->status_code = MLAN_ERROR_NO_ERROR;
 		}
 	}
-
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief This function prepares command of ad_hoc_start.
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
- *  @param pdata_buf    A pointer cast of mlan_802_11_ssid structure
- *
- *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-mlan_status wlan_cmd_802_11_ad_hoc_start(mlan_private *pmpriv,
-					 HostCmd_DS_COMMAND *cmd,
-					 t_void *pdata_buf)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = pmpriv->adapter;
-	HostCmd_DS_802_11_AD_HOC_START *padhoc_start = &cmd->params.adhoc_start;
-	BSSDescriptor_t *pbss_desc;
-	t_u32 cmd_append_size = 0;
-	t_u32 i;
-	t_u16 tmp_cap;
-	MrvlIEtypes_ChanListParamSet_t *pchan_tlv;
-
-	MrvlIEtypes_RsnParamSet_t *prsn_ie_tlv;
-	/* wpa ie for WPA_NONE AES */
-	const t_u8 wpa_ie[24] = {0xdd, 0x16, 0x00, 0x50, 0xf2, 0x01,
-				 0x01, 0x00, 0x00, 0x50, 0xf2, 0x04,
-				 0x01, 0x00, 0x00, 0x50, 0xf2, 0x00,
-				 0x01, 0x00, 0x00, 0x50, 0xf2, 0x00};
-	t_s32 append_size_11h = 0;
-	t_u8 *pos =
-		(t_u8 *)padhoc_start + sizeof(HostCmd_DS_802_11_AD_HOC_START);
-
-	ENTER();
-
-	if (!pmadapter) {
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_AD_HOC_START);
-
-	pbss_desc = &pmpriv->curr_bss_params.bss_descriptor;
-	pmpriv->pattempted_bss_desc = pbss_desc;
-
-	/*
-	 * Fill in the parameters for 2 data structures:
-	 *   1. HostCmd_DS_802_11_AD_HOC_START command
-	 *   2. pbss_desc
-	 * Driver will fill up SSID, bss_mode,IBSS param, Physical Param,
-	 * probe delay, and Cap info.
-	 * Firmware will fill up beacon period, Basic rates
-	 * and operational rates.
-	 */
-
-	memset(pmadapter, padhoc_start->ssid, 0, MLAN_MAX_SSID_LENGTH);
-
-	memcpy_ext(pmadapter, padhoc_start->ssid,
-		   ((mlan_802_11_ssid *)pdata_buf)->ssid,
-		   ((mlan_802_11_ssid *)pdata_buf)->ssid_len,
-		   MLAN_MAX_SSID_LENGTH);
-
-	PRINTM(MINFO, "ADHOC_S_CMD: SSID = %s\n", padhoc_start->ssid);
-
-	memset(pmadapter, pbss_desc->ssid.ssid, 0, MLAN_MAX_SSID_LENGTH);
-	memcpy_ext(pmadapter, pbss_desc->ssid.ssid,
-		   ((mlan_802_11_ssid *)pdata_buf)->ssid,
-		   ((mlan_802_11_ssid *)pdata_buf)->ssid_len,
-		   MLAN_MAX_SSID_LENGTH);
-
-	pbss_desc->ssid.ssid_len =
-		MIN(MLAN_MAX_SSID_LENGTH,
-		    ((mlan_802_11_ssid *)pdata_buf)->ssid_len);
-
-	/* Set the BSS mode */
-	padhoc_start->bss_mode = HostCmd_BSS_MODE_IBSS;
-	pbss_desc->bss_mode = MLAN_BSS_MODE_IBSS;
-	padhoc_start->beacon_period = wlan_cpu_to_le16(pmpriv->beacon_period);
-	pbss_desc->beacon_period = pmpriv->beacon_period;
-
-	/* Set Physical param set */
-/** Parameter IE Id */
-#define DS_PARA_IE_ID 3
-/** Parameter IE length */
-#define DS_PARA_IE_LEN 1
-
-	padhoc_start->phy_param_set.ds_param_set.element_id = DS_PARA_IE_ID;
-	padhoc_start->phy_param_set.ds_param_set.len = DS_PARA_IE_LEN;
-
-	if (!wlan_get_cfp_by_band_and_channel(
-		    pmadapter, pmadapter->adhoc_start_band,
-		    (t_u16)pmpriv->adhoc_channel, pmadapter->region_channel)) {
-		chan_freq_power_t *cfp;
-		cfp = wlan_get_cfp_by_band_and_channel(
-			pmadapter, pmadapter->adhoc_start_band,
-			FIRST_VALID_CHANNEL, pmadapter->region_channel);
-		if (cfp)
-			pmpriv->adhoc_channel = (t_u8)cfp->channel;
-	}
-
-	MASSERT(pmpriv->adhoc_channel);
-
-	PRINTM(MINFO, "ADHOC_S_CMD: Creating ADHOC on Channel %d\n",
-	       pmpriv->adhoc_channel);
-
-	pmpriv->curr_bss_params.bss_descriptor.channel = pmpriv->adhoc_channel;
-	pmpriv->curr_bss_params.band = pmadapter->adhoc_start_band;
-
-	pbss_desc->channel = pmpriv->adhoc_channel;
-	padhoc_start->phy_param_set.ds_param_set.current_chan =
-		pmpriv->adhoc_channel;
-
-	memcpy_ext(pmadapter, &pbss_desc->phy_param_set,
-		   &padhoc_start->phy_param_set,
-		   sizeof(IEEEtypes_PhyParamSet_t),
-		   sizeof(IEEEtypes_PhyParamSet_t));
-
-	pbss_desc->network_type_use = Wlan802_11DS;
-
-	/* Set IBSS param set */
-/** IBSS parameter IE Id */
-#define IBSS_PARA_IE_ID 6
-/** IBSS parameter IE length */
-#define IBSS_PARA_IE_LEN 2
-
-	padhoc_start->ss_param_set.ibss_param_set.element_id = IBSS_PARA_IE_ID;
-	padhoc_start->ss_param_set.ibss_param_set.len = IBSS_PARA_IE_LEN;
-	padhoc_start->ss_param_set.ibss_param_set.atim_window =
-		wlan_cpu_to_le16(pmpriv->atim_window);
-	pbss_desc->atim_window = pmpriv->atim_window;
-	memcpy_ext(pmadapter, &pbss_desc->ss_param_set,
-		   &padhoc_start->ss_param_set, sizeof(IEEEtypes_SsParamSet_t),
-		   sizeof(IEEEtypes_SsParamSet_t));
-
-	/* Set Capability info */
-	padhoc_start->cap.ess = 0;
-	padhoc_start->cap.ibss = 1;
-	pbss_desc->cap_info.ibss = 1;
-
-	/* Set up privacy in pbss_desc */
-	if (pmpriv->sec_info.wep_status == Wlan802_11WEPEnabled ||
-	    pmpriv->sec_info.wpa_enabled || pmpriv->sec_info.ewpa_enabled) {
-/** Ad-Hoc capability privacy on */
-#define AD_HOC_CAP_PRIVACY_ON 1
-		PRINTM(MINFO, "ADHOC_S_CMD: wep_status set, Privacy to WEP\n");
-		pbss_desc->privacy = Wlan802_11PrivFilter8021xWEP;
-		padhoc_start->cap.privacy = AD_HOC_CAP_PRIVACY_ON;
-	} else {
-		PRINTM(MWARN, "ADHOC_S_CMD: wep_status NOT set, Setting "
-			      "Privacy to ACCEPT ALL\n");
-		pbss_desc->privacy = Wlan802_11PrivFilterAcceptAll;
-	}
-
-	memset(pmadapter, padhoc_start->DataRate, 0,
-	       sizeof(padhoc_start->DataRate));
-
-	if ((pmpriv->adapter->region_code == COUNTRY_CODE_JP_40 ||
-	     pmpriv->adapter->region_code == COUNTRY_CODE_JP_FF) &&
-	    (pbss_desc->phy_param_set.ds_param_set.current_chan == 14)) {
-		wlan_get_active_data_rates(pmpriv, pmpriv->bss_mode, BAND_B,
-					   padhoc_start->DataRate);
-	} else {
-		wlan_get_active_data_rates(pmpriv, pmpriv->bss_mode,
-					   pmadapter->adhoc_start_band,
-					   padhoc_start->DataRate);
-	}
-
-	if ((pmadapter->adhoc_start_band & BAND_G) &&
-	    (pmpriv->curr_pkt_filter & HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON)) {
-		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_MAC_CONTROL,
-				       HostCmd_ACT_GEN_SET, 0, MNULL,
-				       &pmpriv->curr_pkt_filter);
-
-		if (ret) {
-			PRINTM(MERROR,
-			       "ADHOC_S_CMD: G Protection config failed\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-	}
-	/* Find the last non zero */
-	for (i = 0;
-	     i < sizeof(padhoc_start->DataRate) && padhoc_start->DataRate[i];
-	     i++)
-		/* XXX Do not delete no-operation line */
-		;
-
-	pmpriv->curr_bss_params.num_of_rates = i;
-
-	/* Copy the ad-hoc creating rates into Current BSS rate structure */
-	memcpy_ext(pmadapter, &pmpriv->curr_bss_params.data_rates,
-		   &padhoc_start->DataRate,
-		   pmpriv->curr_bss_params.num_of_rates, WLAN_SUPPORTED_RATES);
-
-	PRINTM(MINFO, "ADHOC_S_CMD: Rates=%02x %02x %02x %02x\n",
-	       padhoc_start->DataRate[0], padhoc_start->DataRate[1],
-	       padhoc_start->DataRate[2], padhoc_start->DataRate[3]);
-
-	PRINTM(MINFO, "ADHOC_S_CMD: AD HOC Start command is ready\n");
-
-	if (IS_SUPPORT_MULTI_BANDS(pmadapter)) {
-		/* Append a channel TLV */
-		pchan_tlv = (MrvlIEtypes_ChanListParamSet_t *)pos;
-		pchan_tlv->header.type = wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
-		pchan_tlv->header.len =
-			wlan_cpu_to_le16(sizeof(ChanScanParamSet_t));
-
-		memset(pmadapter, pchan_tlv->chan_scan_param, 0x00,
-		       sizeof(ChanScanParamSet_t));
-		pchan_tlv->chan_scan_param[0].chan_number =
-			(t_u8)pmpriv->curr_bss_params.bss_descriptor.channel;
-
-		PRINTM(MINFO, "ADHOC_S_CMD: TLV Chan = %d\n",
-		       pchan_tlv->chan_scan_param[0].chan_number);
-
-		pchan_tlv->chan_scan_param[0].bandcfg.chanBand =
-			wlan_band_to_radio_type(pmpriv->curr_bss_params.band);
-		PRINTM(MINFO, "ADHOC_S_CMD: TLV Bandcfg = %x\n",
-		       pchan_tlv->chan_scan_param[0].bandcfg);
-		pos += sizeof(pchan_tlv->header) + sizeof(ChanScanParamSet_t);
-		cmd_append_size +=
-			sizeof(pchan_tlv->header) + sizeof(ChanScanParamSet_t);
-	}
-
-	if (wlan_11d_create_dnld_countryinfo(pmpriv,
-					     pmpriv->curr_bss_params.band)) {
-		PRINTM(MERROR, "ADHOC_S_CMD: dnld_countryinfo_11d failed\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/*
-	 * Call 11h start API to add any 11h flags/elements as TLV parameters
-	 */
-	append_size_11h =
-		wlan_11h_process_start(pmpriv, &pos, &padhoc_start->cap,
-				       pmpriv->adhoc_channel,
-				       &pbss_desc->wlan_11h_bss_info);
-	if (append_size_11h >= 0)
-		cmd_append_size += append_size_11h;
-	else {
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	if (pmpriv->sec_info.ewpa_enabled) {
-		memcpy_ext(pmadapter, pmpriv->wpa_ie, wpa_ie, sizeof(wpa_ie),
-			   sizeof(pmpriv->wpa_ie));
-		pmpriv->wpa_ie_len = sizeof(wpa_ie);
-	}
-
-	if (pmpriv->sec_info.wpa_enabled || pmpriv->sec_info.ewpa_enabled) {
-		prsn_ie_tlv = (MrvlIEtypes_RsnParamSet_t *)pos;
-		prsn_ie_tlv->header.type = (t_u16)pmpriv->wpa_ie[0];
-		/* WPA_IE or RSN_IE */
-		prsn_ie_tlv->header.type = prsn_ie_tlv->header.type & 0x00FF;
-		prsn_ie_tlv->header.type =
-			wlan_cpu_to_le16(prsn_ie_tlv->header.type);
-		prsn_ie_tlv->header.len = (t_u16)pmpriv->wpa_ie[1];
-		prsn_ie_tlv->header.len = prsn_ie_tlv->header.len & 0x00FF;
-		if (prsn_ie_tlv->header.len <= (sizeof(pmpriv->wpa_ie) - 2))
-			memcpy_ext(pmadapter, prsn_ie_tlv->rsn_ie,
-				   &pmpriv->wpa_ie[2], prsn_ie_tlv->header.len,
-				   prsn_ie_tlv->header.len);
-		else {
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-
-		DBG_HEXDUMP(MCMD_D, "ADHOC_S_CMD: RSN IE", (t_u8 *)prsn_ie_tlv,
-			    sizeof(prsn_ie_tlv->header) +
-				    prsn_ie_tlv->header.len);
-		pos += sizeof(prsn_ie_tlv->header) + prsn_ie_tlv->header.len;
-		cmd_append_size +=
-			sizeof(prsn_ie_tlv->header) + prsn_ie_tlv->header.len;
-		prsn_ie_tlv->header.len =
-			wlan_cpu_to_le16(prsn_ie_tlv->header.len);
-	}
-
-	cmd->size = (t_u16)wlan_cpu_to_le16(
-		(t_u16)(sizeof(HostCmd_DS_802_11_AD_HOC_START) + S_DS_GEN +
-			cmd_append_size));
-
-	memcpy_ext(pmadapter, &tmp_cap, &padhoc_start->cap, sizeof(t_u16),
-		   sizeof(tmp_cap));
-
-	if (pmadapter->adhoc_start_band == BAND_B)
-		SHORT_SLOT_TIME_DISABLED(tmp_cap);
-	else
-		SHORT_SLOT_TIME_ENABLED(tmp_cap);
-
-	tmp_cap = wlan_cpu_to_le16(tmp_cap);
-	memcpy_ext(pmadapter, &padhoc_start->cap, &tmp_cap, sizeof(t_u16),
-		   sizeof(padhoc_start->cap));
-
-	ret = MLAN_STATUS_SUCCESS;
-done:
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief This function prepares command of ad_hoc_join.
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
- *  @param pdata_buf    Void cast of BSSDescriptor_t from the
- *                        scan table to join
- *
- *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-mlan_status wlan_cmd_802_11_ad_hoc_join(mlan_private *pmpriv,
-					HostCmd_DS_COMMAND *cmd,
-					t_void *pdata_buf)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = pmpriv->adapter;
-	HostCmd_DS_802_11_AD_HOC_JOIN *padhoc_join = &cmd->params.adhoc_join;
-	BSSDescriptor_t *pbss_desc = (BSSDescriptor_t *)pdata_buf;
-	MrvlIEtypes_ChanListParamSet_t *pchan_tlv;
-	MrvlIEtypes_RsnParamSet_t *prsn_ie_tlv;
-	t_u32 cmd_append_size = 0;
-	t_u16 tmp_cap;
-	t_u32 i, rates_size = 0;
-	t_u32 curr_pkt_filter;
-	t_u8 *pos = (t_u8 *)padhoc_join + sizeof(HostCmd_DS_802_11_AD_HOC_JOIN);
-	t_s32 append_size_11h = 0;
-
-	ENTER();
-
-/** Use G protection */
-#define USE_G_PROTECTION 0x02
-	if (pbss_desc->erp_flags & USE_G_PROTECTION) {
-		curr_pkt_filter = pmpriv->curr_pkt_filter |
-				  HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON;
-
-		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_MAC_CONTROL,
-				       HostCmd_ACT_GEN_SET, 0, MNULL,
-				       &curr_pkt_filter);
-		if (ret) {
-			PRINTM(MERROR,
-			       "ADHOC_J_CMD: G Protection config failed\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-	}
-
-	pmpriv->pattempted_bss_desc = pbss_desc;
-
-	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_AD_HOC_JOIN);
-
-	padhoc_join->bss_descriptor.bss_mode = HostCmd_BSS_MODE_IBSS;
-
-	padhoc_join->bss_descriptor.beacon_period =
-		wlan_cpu_to_le16(pbss_desc->beacon_period);
-
-	memcpy_ext(pmadapter, &padhoc_join->bss_descriptor.bssid,
-		   &pbss_desc->mac_address, MLAN_MAC_ADDR_LENGTH,
-		   MLAN_MAC_ADDR_LENGTH);
-
-	memcpy_ext(pmadapter, &padhoc_join->bss_descriptor.ssid,
-		   &pbss_desc->ssid.ssid, pbss_desc->ssid.ssid_len,
-		   MLAN_MAX_SSID_LENGTH);
-
-	memcpy_ext(pmadapter, &padhoc_join->bss_descriptor.phy_param_set,
-		   &pbss_desc->phy_param_set, sizeof(IEEEtypes_PhyParamSet_t),
-		   sizeof(IEEEtypes_PhyParamSet_t));
-
-	padhoc_join->bss_descriptor.phy_param_set.fh_param_set.dwell_time =
-		wlan_cpu_to_le16(padhoc_join->bss_descriptor.phy_param_set
-					 .fh_param_set.dwell_time);
-
-	memcpy_ext(pmadapter, &padhoc_join->bss_descriptor.ss_param_set,
-		   &pbss_desc->ss_param_set, sizeof(IEEEtypes_SsParamSet_t),
-		   sizeof(IEEEtypes_SsParamSet_t));
-	padhoc_join->bss_descriptor.ss_param_set.ibss_param_set.atim_window = 0;
-	padhoc_join->bss_descriptor.ss_param_set.ibss_param_set.atim_window =
-		wlan_cpu_to_le16(padhoc_join->bss_descriptor.ss_param_set
-					 .ibss_param_set.atim_window);
-
-	memcpy_ext(pmadapter, &tmp_cap, &pbss_desc->cap_info,
-		   sizeof(IEEEtypes_CapInfo_t), sizeof(IEEEtypes_CapInfo_t));
-
-	tmp_cap &= CAPINFO_MASK;
-
-	PRINTM(MINFO, "ADHOC_J_CMD: tmp_cap=%4X CAPINFO_MASK=%4lX\n", tmp_cap,
-	       CAPINFO_MASK);
-	memcpy_ext(pmadapter, &padhoc_join->bss_descriptor.cap, &tmp_cap,
-		   sizeof(IEEEtypes_CapInfo_t), sizeof(IEEEtypes_CapInfo_t));
-
-	/* Information on BSSID descriptor passed to FW */
-	PRINTM(MINFO, "ADHOC_J_CMD: BSSID = " MACSTR ", SSID = %s\n",
-	       MAC2STR(padhoc_join->bss_descriptor.bssid),
-	       padhoc_join->bss_descriptor.ssid);
-
-	for (i = 0; i < WLAN_SUPPORTED_RATES && pbss_desc->supported_rates[i];
-	     i++)
-		/* XXX Do not delete no-operation line */
-		;
-	rates_size = i;
-
-	/* Copy Data Rates from the Rates recorded in scan response */
-	memset(pmadapter, padhoc_join->bss_descriptor.data_rates, 0,
-	       sizeof(padhoc_join->bss_descriptor.data_rates));
-	memcpy_ext(pmadapter, padhoc_join->bss_descriptor.data_rates,
-		   pbss_desc->supported_rates, rates_size,
-		   WLAN_SUPPORTED_RATES);
-
-	HEXDUMP("Adapted Rates:", padhoc_join->bss_descriptor.data_rates,
-		rates_size);
-
-	/* Copy the adhoc join rates into Current BSS state structure */
-	pmpriv->curr_bss_params.num_of_rates = rates_size;
-	memcpy_ext(pmadapter, &pmpriv->curr_bss_params.data_rates,
-		   pbss_desc->supported_rates, rates_size,
-		   WLAN_SUPPORTED_RATES);
-
-	/* Copy the channel information */
-	pmpriv->curr_bss_params.bss_descriptor.channel = pbss_desc->channel;
-	pmpriv->curr_bss_params.band = pbss_desc->bss_band;
-
-	if (pmpriv->sec_info.wep_status == Wlan802_11WEPEnabled ||
-	    pmpriv->sec_info.wpa_enabled || pmpriv->sec_info.ewpa_enabled)
-		padhoc_join->bss_descriptor.cap.privacy = AD_HOC_CAP_PRIVACY_ON;
-
-	if (IS_SUPPORT_MULTI_BANDS(pmadapter)) {
-		/* Append a channel TLV */
-		pchan_tlv = (MrvlIEtypes_ChanListParamSet_t *)pos;
-		pchan_tlv->header.type = wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
-		pchan_tlv->header.len =
-			wlan_cpu_to_le16(sizeof(ChanScanParamSet_t));
-
-		memset(pmadapter, pchan_tlv->chan_scan_param, 0x00,
-		       sizeof(ChanScanParamSet_t));
-		pchan_tlv->chan_scan_param[0].chan_number =
-			(pbss_desc->phy_param_set.ds_param_set.current_chan);
-		PRINTM(MINFO, "ADHOC_J_CMD: TLV Chan = %d\n",
-		       pchan_tlv->chan_scan_param[0].chan_number);
-
-		pchan_tlv->chan_scan_param[0].bandcfg.chanBand =
-			wlan_band_to_radio_type(pbss_desc->bss_band);
-
-		PRINTM(MINFO, "ADHOC_J_CMD: TLV Bandcfg = %x\n",
-		       pchan_tlv->chan_scan_param[0].bandcfg);
-		pos += sizeof(pchan_tlv->header) + sizeof(ChanScanParamSet_t);
-		cmd_append_size +=
-			sizeof(pchan_tlv->header) + sizeof(ChanScanParamSet_t);
-	}
-
-	if (wlan_11d_create_dnld_countryinfo(pmpriv, pbss_desc->bss_band)) {
-		PRINTM(MERROR, "Dnld_countryinfo_11d failed\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-	if (wlan_11d_parse_dnld_countryinfo(pmpriv,
-					    pmpriv->pattempted_bss_desc)) {
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/*
-	 * Call 11h join API after capability bits are set so
-	 *   adhoc/infra 11h behavior can be properly triggered.
-	 *   pos modified if data is appended
-	 */
-	append_size_11h +=
-		wlan_11h_process_join(pmpriv, &pos,
-				      &padhoc_join->bss_descriptor.cap,
-				      pbss_desc->bss_band, pbss_desc->channel,
-				      &pbss_desc->wlan_11h_bss_info);
-	if (append_size_11h >= 0)
-		cmd_append_size += append_size_11h;
-	else {
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	if (pmpriv->sec_info.wpa_enabled) {
-		prsn_ie_tlv = (MrvlIEtypes_RsnParamSet_t *)pos;
-		/* WPA_IE or RSN_IE */
-		prsn_ie_tlv->header.type = (t_u16)pmpriv->wpa_ie[0];
-		prsn_ie_tlv->header.type = prsn_ie_tlv->header.type & 0x00FF;
-		prsn_ie_tlv->header.type =
-			wlan_cpu_to_le16(prsn_ie_tlv->header.type);
-		prsn_ie_tlv->header.len = (t_u16)pmpriv->wpa_ie[1];
-		prsn_ie_tlv->header.len = prsn_ie_tlv->header.len & 0x00FF;
-		if (prsn_ie_tlv->header.len <= (sizeof(pmpriv->wpa_ie) - 2))
-			memcpy_ext(pmadapter, prsn_ie_tlv->rsn_ie,
-				   &pmpriv->wpa_ie[2], prsn_ie_tlv->header.len,
-				   prsn_ie_tlv->header.len);
-		else {
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-
-		HEXDUMP("ADHOC_JOIN: RSN IE", (t_u8 *)prsn_ie_tlv,
-			sizeof(prsn_ie_tlv->header) + prsn_ie_tlv->header.len);
-		pos += sizeof(prsn_ie_tlv->header) + prsn_ie_tlv->header.len;
-		cmd_append_size +=
-			sizeof(prsn_ie_tlv->header) + prsn_ie_tlv->header.len;
-		prsn_ie_tlv->header.len =
-			wlan_cpu_to_le16(prsn_ie_tlv->header.len);
-	} else if (pmpriv->sec_info.ewpa_enabled) {
-		prsn_ie_tlv = (MrvlIEtypes_RsnParamSet_t *)pos;
-		if (pbss_desc->pwpa_ie) {
-			prsn_ie_tlv->header.type =
-				(t_u16)(*(pbss_desc->pwpa_ie))
-					.vend_hdr.element_id;
-			prsn_ie_tlv->header.type =
-				prsn_ie_tlv->header.type & 0x00FF;
-			prsn_ie_tlv->header.type =
-				wlan_cpu_to_le16(prsn_ie_tlv->header.type);
-			prsn_ie_tlv->header.len =
-				(t_u16)(*(pbss_desc->pwpa_ie)).vend_hdr.len;
-			prsn_ie_tlv->header.len =
-				prsn_ie_tlv->header.len & 0x00FF;
-			if (prsn_ie_tlv->header.len <=
-			    (sizeof(pmpriv->wpa_ie))) {
-				memcpy_ext(pmadapter, prsn_ie_tlv->rsn_ie,
-					   &((*(pbss_desc->pwpa_ie))
-						     .vend_hdr.oui[0]),
-					   prsn_ie_tlv->header.len,
-					   prsn_ie_tlv->header.len);
-			} else {
-				ret = MLAN_STATUS_FAILURE;
-				goto done;
-			}
-
-			HEXDUMP("ADHOC_JOIN: RSN IE", (t_u8 *)prsn_ie_tlv,
-				sizeof(prsn_ie_tlv->header) +
-					prsn_ie_tlv->header.len);
-			pos += sizeof(prsn_ie_tlv->header) +
-			       prsn_ie_tlv->header.len;
-			cmd_append_size += sizeof(prsn_ie_tlv->header) +
-					   prsn_ie_tlv->header.len;
-			prsn_ie_tlv->header.len =
-				wlan_cpu_to_le16(prsn_ie_tlv->header.len);
-		}
-		if (pbss_desc->prsn_ie) {
-			prsn_ie_tlv = (MrvlIEtypes_RsnParamSet_t *)pos;
-			prsn_ie_tlv->header.type =
-				(t_u16)(*(pbss_desc->prsn_ie))
-					.ieee_hdr.element_id;
-			prsn_ie_tlv->header.type =
-				prsn_ie_tlv->header.type & 0x00FF;
-			prsn_ie_tlv->header.type =
-				wlan_cpu_to_le16(prsn_ie_tlv->header.type);
-			prsn_ie_tlv->header.len =
-				(t_u16)(*(pbss_desc->prsn_ie)).ieee_hdr.len;
-			prsn_ie_tlv->header.len =
-				prsn_ie_tlv->header.len & 0x00FF;
-			if (prsn_ie_tlv->header.len <=
-			    (sizeof(pmpriv->wpa_ie))) {
-				memcpy_ext(pmadapter, prsn_ie_tlv->rsn_ie,
-					   &((*(pbss_desc->prsn_ie)).data[0]),
-					   prsn_ie_tlv->header.len,
-					   prsn_ie_tlv->header.len);
-			} else {
-				ret = MLAN_STATUS_FAILURE;
-				goto done;
-			}
-
-			HEXDUMP("ADHOC_JOIN: RSN IE", (t_u8 *)prsn_ie_tlv,
-				sizeof(prsn_ie_tlv->header) +
-					prsn_ie_tlv->header.len);
-			pos += sizeof(prsn_ie_tlv->header) +
-			       prsn_ie_tlv->header.len;
-			cmd_append_size += sizeof(prsn_ie_tlv->header) +
-					   prsn_ie_tlv->header.len;
-			prsn_ie_tlv->header.len =
-				wlan_cpu_to_le16(prsn_ie_tlv->header.len);
-		}
-	}
-
-	cmd->size = (t_u16)wlan_cpu_to_le16(
-		(t_u16)(sizeof(HostCmd_DS_802_11_AD_HOC_JOIN) + S_DS_GEN +
-			cmd_append_size));
-
-	memcpy_ext(pmadapter, &tmp_cap, &padhoc_join->bss_descriptor.cap,
-		   sizeof(IEEEtypes_CapInfo_t), sizeof(IEEEtypes_CapInfo_t));
-	tmp_cap = wlan_cpu_to_le16(tmp_cap);
-
-	memcpy_ext(pmadapter, &padhoc_join->bss_descriptor.cap, &tmp_cap,
-		   sizeof(IEEEtypes_CapInfo_t), sizeof(IEEEtypes_CapInfo_t));
-
-done:
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief This function handles the command response of ad_hoc_start and
- *          ad_hoc_join
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param resp         A pointer to HostCmd_DS_COMMAND
- *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
- *
- *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-mlan_status wlan_ret_802_11_ad_hoc(mlan_private *pmpriv,
-				   HostCmd_DS_COMMAND *resp, t_void *pioctl_buf)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_ioctl_req *pioctl_req = (mlan_ioctl_req *)pioctl_buf;
-	HostCmd_DS_802_11_AD_HOC_START_RESULT *padhoc_start_result =
-		&resp->params.adhoc_start_result;
-	HostCmd_DS_802_11_AD_HOC_JOIN_RESULT *padhoc_join_result =
-		&resp->params.adhoc_join_result;
-	BSSDescriptor_t *pbss_desc;
-	t_u16 command = resp->command;
-	t_u8 result = 0;
-	t_u8 event_buf[100];
-	mlan_event *pevent = (mlan_event *)event_buf;
-	int ie_len = 0;
-	IEEEtypes_WmmParameter_t *pwmm_param_ie = MNULL;
-	mlan_adapter *pmadapter = pmpriv->adapter;
-	const t_u8 wmm_oui[4] = {0x00, 0x50, 0xf2, 0x02};
-
-	ENTER();
-
-	pmpriv->wmm_enabled = MFALSE;
-	if (command == HostCmd_CMD_802_11_AD_HOC_START) {
-		result = padhoc_start_result->result;
-		ie_len = resp->size -
-			 (sizeof(HostCmd_DS_802_11_AD_HOC_START_RESULT) +
-			  S_DS_GEN);
-		pwmm_param_ie =
-			(IEEEtypes_WmmParameter_t
-				 *)((t_u8 *)resp +
-				    (sizeof(HostCmd_DS_802_11_AD_HOC_START_RESULT) +
-				     S_DS_GEN));
-	} else {
-		result = padhoc_join_result->result;
-		ie_len = resp->size -
-			 (sizeof(HostCmd_DS_802_11_AD_HOC_JOIN_RESULT) +
-			  S_DS_GEN);
-		pwmm_param_ie =
-			(IEEEtypes_WmmParameter_t
-				 *)((t_u8 *)resp +
-				    (sizeof(HostCmd_DS_802_11_AD_HOC_JOIN_RESULT) +
-				     S_DS_GEN));
-	}
-
-	pbss_desc = pmpriv->pattempted_bss_desc;
-
-	/*
-	 * Join result code 0 --> SUCCESS
-	 */
-	if (result) {
-		PRINTM(MERROR, "ADHOC_RESP Failed 0x%x\n", result);
-		if (pmpriv->media_connected == MTRUE)
-			wlan_reset_connect_state(pmpriv, MTRUE);
-		if (pmpriv->adhoc_state == ADHOC_STARTING)
-			pmpriv->adhoc_state = ADHOC_IDLE;
-
-		memset(pmpriv->adapter, &pmpriv->curr_bss_params.bss_descriptor,
-		       0x00, sizeof(BSSDescriptor_t));
-
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/* Send a Media Connected event, according to the Spec */
-	pmpriv->media_connected = MTRUE;
-
-	if (command == HostCmd_CMD_802_11_AD_HOC_START) {
-		PRINTM(MINFO, "ADHOC_S_RESP  %s\n", pbss_desc->ssid.ssid);
-
-		/* Update the created network descriptor with the new BSSID */
-		memcpy_ext(pmpriv->adapter, pbss_desc->mac_address,
-			   padhoc_start_result->bssid, MLAN_MAC_ADDR_LENGTH,
-			   MLAN_MAC_ADDR_LENGTH);
-
-		pmpriv->adhoc_state = ADHOC_STARTED;
-		if (pmpriv->adapter->state_rdh.stage == RDH_RESTART_INTFS)
-			wlan_11h_radar_detected_callback((t_void *)pmpriv);
-	} else {
-		/*
-		 * Now the join cmd should be successful.
-		 * If BSSID has changed use SSID to compare instead of BSSID
-		 */
-		PRINTM(MINFO, "ADHOC_J_RESP  %s\n", pbss_desc->ssid.ssid);
-
-		/*
-		 * Make a copy of current BSSID descriptor, only needed
-		 * for join since the current descriptor is already
-		 * being used for adhoc start
-		 */
-		memcpy_ext(pmpriv->adapter,
-			   &pmpriv->curr_bss_params.bss_descriptor, pbss_desc,
-			   sizeof(BSSDescriptor_t), sizeof(BSSDescriptor_t));
-
-		pmpriv->adhoc_state = ADHOC_JOINED;
-	}
-
-	/** process wmm ie */
-	if (ie_len >= (int)sizeof(IEEEtypes_VendorHeader_t)) {
-		if ((pwmm_param_ie->vend_hdr.element_id ==
-		     VENDOR_SPECIFIC_221) &&
-		    !memcmp(pmadapter, pwmm_param_ie->vend_hdr.oui, wmm_oui,
-			    sizeof(wmm_oui)) &&
-		    (pwmm_param_ie->vend_hdr.len + 2 == ie_len)) {
-			DBG_HEXDUMP(MCMD_D, "WMM Param", (t_u8 *)pwmm_param_ie,
-				    ie_len);
-			memcpy_ext(pmpriv->adapter,
-				   (t_u8 *)&pmpriv->curr_bss_params
-					   .bss_descriptor.wmm_ie,
-				   pwmm_param_ie,
-				   (pwmm_param_ie->vend_hdr.len + 2),
-				   sizeof(IEEEtypes_WmmParameter_t));
-			pmpriv->wmm_enabled = MTRUE;
-			wlan_wmm_setup_queue_priorities(pmpriv, pwmm_param_ie);
-			wlan_wmm_setup_ac_downgrade(pmpriv);
-		}
-	}
-	/* Since WMM is not enabled, setup the queues with the defaults */
-	if (!pmpriv->wmm_enabled)
-		wlan_wmm_setup_queues(pmpriv);
-
-	PRINTM(MINFO, "ADHOC_RESP: Channel = %d\n", pmpriv->adhoc_channel);
-	PRINTM(MINFO, "ADHOC_RESP: BSSID = " MACSTR "\n",
-	       MAC2STR(pmpriv->curr_bss_params.bss_descriptor.mac_address));
-
-	pevent->bss_index = pmpriv->bss_index;
-	pevent->event_id = MLAN_EVENT_ID_DRV_CONNECTED;
-	pevent->event_len = MLAN_MAC_ADDR_LENGTH;
-	memcpy_ext(pmpriv->adapter, (t_u8 *)pevent->event_buf,
-		   (t_u8 *)pmpriv->curr_bss_params.bss_descriptor.mac_address,
-		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
-	wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_CONNECTED, pevent);
-	wlan_save_curr_bcn(pmpriv);
-
-done:
-	/* Need to indicate IOCTL complete */
-	if (pioctl_req != MNULL) {
-		if (ret != MLAN_STATUS_SUCCESS)
-			pioctl_req->status_code = MLAN_ERROR_CMD_ASSOC_FAIL;
-		else
-			pioctl_req->status_code = MLAN_ERROR_NO_ERROR;
-	}
-
 	LEAVE();
 	return ret;
 }
@@ -2694,117 +1979,6 @@
 }
 
 /**
- *  @brief Start an Adhoc Network
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param pioctl_buf   A pointer to MLAN IOCTL Request buffer
- *  @param padhoc_ssid  The ssid of the Adhoc Network
- *
- *  @return             MLAN_STATUS_SUCCESS--success, MLAN_STATUS_FAILURE--fail
- */
-mlan_status wlan_adhoc_start(mlan_private *pmpriv, t_void *pioctl_buf,
-			     mlan_802_11_ssid *padhoc_ssid)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	wlan_meas_state_t *pmeas_state = &pmpriv->adapter->state_meas;
-	t_u8 radar = MFALSE;
-	pmlan_ioctl_req pioctl_req = (mlan_ioctl_req *)pioctl_buf;
-
-	ENTER();
-
-	/*
-	 * If the report indicates no measurement was done, leave the default
-	 * return value alone.
-	 */
-	if (!pmeas_state->meas_rpt_returned.rpt.basic.map.unmeasured) {
-		radar = pmeas_state->meas_rpt_returned.rpt.basic.map.radar ?
-				MTRUE :
-				MFALSE;
-	}
-
-	if (radar) {
-		if (pioctl_req)
-			pioctl_req->status_code = MLAN_ERROR_IOCTL_INVALID;
-		ret = MLAN_STATUS_FAILURE;
-		LEAVE();
-		return ret;
-	}
-
-	PRINTM(MINFO, "Adhoc Channel = %d\n", pmpriv->adhoc_channel);
-	PRINTM(MINFO, "curr_bss_params.channel = %d\n",
-	       pmpriv->curr_bss_params.bss_descriptor.channel);
-	PRINTM(MINFO, "curr_bss_params.band = %d\n",
-	       pmpriv->curr_bss_params.band);
-
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_AD_HOC_START,
-			       HostCmd_ACT_GEN_SET, 0, pioctl_buf, padhoc_ssid);
-#if defined(STA_SUPPORT)
-	if (ret == MLAN_STATUS_SUCCESS)
-		memcpy_ext(pmpriv->adapter, &pmpriv->adhoc_last_start_ssid,
-			   padhoc_ssid, sizeof(mlan_802_11_ssid),
-			   sizeof(mlan_802_11_ssid));
-#endif
-
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief Join an adhoc network found in a previous scan
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param pioctl_buf   A pointer to MLAN IOCTL Request buffer
- *  @param pbss_desc     A pointer to the BSS descriptor found in a previous
- * scan to attempt to join
- *
- *  @return             MLAN_STATUS_SUCCESS--success, MLAN_STATUS_FAILURE--fail
- */
-mlan_status wlan_adhoc_join(mlan_private *pmpriv, t_void *pioctl_buf,
-			    BSSDescriptor_t *pbss_desc)
-{
-	pmlan_adapter pmadapter = pmpriv->adapter;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	pmlan_ioctl_req pioctl_req = (mlan_ioctl_req *)pioctl_buf;
-
-	ENTER();
-
-	PRINTM(MINFO, "wlan_adhoc_join: CurBss.ssid =%s\n",
-	       pmpriv->curr_bss_params.bss_descriptor.ssid.ssid);
-	PRINTM(MINFO, "wlan_adhoc_join: CurBss.ssid_len =%u\n",
-	       pmpriv->curr_bss_params.bss_descriptor.ssid.ssid_len);
-	PRINTM(MINFO, "wlan_adhoc_join: ssid =%s\n", pbss_desc->ssid.ssid);
-	PRINTM(MINFO, "wlan_adhoc_join: ssid len =%u\n",
-	       pbss_desc->ssid.ssid_len);
-
-	/* Check if the requested SSID is already joined */
-	if (pmpriv->curr_bss_params.bss_descriptor.ssid.ssid_len &&
-	    !wlan_ssid_cmp(pmadapter, &pbss_desc->ssid,
-			   &pmpriv->curr_bss_params.bss_descriptor.ssid) &&
-	    (pmpriv->curr_bss_params.bss_descriptor.bss_mode ==
-	     MLAN_BSS_MODE_IBSS)) {
-		PRINTM(MINFO,
-		       "ADHOC_J_CMD: New ad-hoc SSID is the same as current, "
-		       "not attempting to re-join\n");
-
-		if (pioctl_req)
-			pioctl_req->status_code = MLAN_ERROR_IOCTL_INVALID;
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-
-	PRINTM(MINFO, "curr_bss_params.channel = %d\n",
-	       pmpriv->curr_bss_params.bss_descriptor.channel);
-	PRINTM(MINFO, "curr_bss_params.band = %d\n",
-	       pmpriv->curr_bss_params.band);
-
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_AD_HOC_JOIN,
-			       HostCmd_ACT_GEN_SET, 0, pioctl_buf, pbss_desc);
-
-	LEAVE();
-	return ret;
-}
-
-/**
  *  @brief Send Deauthentication Request or Stop the AdHoc network depending on
  * mode
  *
@@ -2855,15 +2029,6 @@
 
 			if (ret == MLAN_STATUS_SUCCESS && pioctl_req)
 				ret = MLAN_STATUS_PENDING;
-
-		} else if (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS) {
-			ret = wlan_prepare_cmd(pmpriv,
-					       HostCmd_CMD_802_11_AD_HOC_STOP,
-					       HostCmd_ACT_GEN_SET, 0,
-					       (t_void *)pioctl_req, MNULL);
-
-			if (ret == MLAN_STATUS_SUCCESS && pioctl_req)
-				ret = MLAN_STATUS_PENDING;
 		}
 	}
 
diff --git a/wlan_src/mlan/mlan_join.h b/wlan_src/mlan/mlan_join.h
new file mode 100644
index 0000000..724af8a
--- /dev/null
+++ b/wlan_src/mlan/mlan_join.h
@@ -0,0 +1,48 @@
+/** @file mlan_join.h
+ *
+ *  @brief This file defines the interface for the WLAN infrastructure
+ *  and adhoc join routines.
+ *
+ *  Driver interface functions and type declarations for the join module
+ *  implemented in mlan_join.c.  Process all start/join requests for
+ *  both adhoc and infrastructure networks
+ *
+ *
+ *  Copyright 2008-2021, 2024 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/******************************************************
+Change log:
+    10/13/2008: initial version
+******************************************************/
+
+#ifndef _MLAN_JOIN_H_
+#define _MLAN_JOIN_H_
+
+/** Size of buffer allocated to store IEs passed to firmware in the assoc req */
+#define MRVDRV_GENIE_BUF_SIZE 256
+
+#endif /* _MLAN_JOIN_H_ */
diff --git a/wlan_sd8987/mlan/mlan_main.h b/wlan_src/mlan/mlan_main.h
old mode 100755
new mode 100644
similarity index 88%
rename from wlan_sd8987/mlan/mlan_main.h
rename to wlan_src/mlan/mlan_main.h
index 643db9a..2c98ed4
--- a/wlan_sd8987/mlan/mlan_main.h
+++ b/wlan_src/mlan/mlan_main.h
@@ -5,20 +5,29 @@
  *  in MLAN module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -156,6 +165,12 @@
 			print_callback(MNULL, MMSG, msg);                      \
 	} while (0)
 
+#define PRINTM_MSCH_D(msg...)                                                  \
+	do {                                                                   \
+		if ((mlan_drvdbg & MSCH_D) && (print_callback))                \
+			print_callback(MNULL, MSCH_D, msg);                    \
+	} while (0)
+
 #define PRINTM(level, msg...) PRINTM_##level((char *)msg)
 
 /** Log debug message */
@@ -353,8 +368,9 @@
 #define endian_convert_RxPD_extra_header(x)                                    \
 	do {                                                                   \
 		(x)->channel_flags = wlan_le16_to_cpu((x)->channel_flags);     \
-		(x)->vht_sig1 = wlan_le32_to_cpu((x)->vht_sig1);               \
-		(x)->vht_sig2 = wlan_le32_to_cpu((x)->vht_sig2);               \
+		(x)->vht_he_sig1 = wlan_le32_to_cpu((x)->vht_he_sig1);         \
+		(x)->vht_he_sig2 = wlan_le32_to_cpu((x)->vht_he_sig2);         \
+		(x)->user_idx = wlan_le32_to_cpu((x)->user_idx);               \
 	} while (0)
 #else
 /** Convert ulong n/w to host */
@@ -569,7 +585,8 @@
 /** Maximum numbfer of registers to read for multiple port */
 #if defined(SD8887) || defined(SD8997) || defined(SD8977) ||                   \
 	defined(SD8987) || defined(SD9098) || defined(SD9097) ||               \
-	defined(SDNW62X) || defined(SD8978) || defined(SD9177)
+	defined(SDAW693) || defined(SDIW624) || defined(SD8978) ||             \
+	defined(SD9177) || defined(SDIW610)
 #define MAX_MP_REGS 196
 #else
 /* upto 0xB7 */
@@ -616,6 +633,14 @@
 /** Debug command number */
 #define DBG_CMD_NUM 10
 
+/** scan GAP value is optional */
+#define GAP_FLAG_OPTIONAL MBIT(15)
+
+/** max numbe of mac filters allowed in llde list */
+#define MAX_MAC_FILTER_ENTRIES 2
+/** max numbe of iPhone devices allowed in llde list */
+#define MAX_IPHONE_FILTER_ENTRIES 2
+
 /** Info for debug purpose */
 typedef struct _wlan_dbg {
 	/** Number of host to card command failures */
@@ -671,6 +696,12 @@
 	t_u16 last_event_index;
 	/** Number of no free command node */
 	t_u16 num_no_cmd_node;
+	/** num_assoc_cmd_error, count result 4 error */
+	t_u16 num_assoc_err;
+	/** num_scan_cmd_error, count result 4 error */
+	t_u16 num_scan_err;
+	/** num_remain_on_channel_cmd_error, count result 4 error */
+	t_u16 num_remain_chan_err;
 } wlan_dbg;
 
 /** Hardware status codes */
@@ -705,11 +736,6 @@
 	PS_STATE_SLEEP
 } PS_STATE;
 
-/** Minimum flush timer for win size of 1 is 50 ms */
-#define MIN_FLUSH_TIMER_MS 50
-/** Minimum flush timer for win size of 1 is 15 ms */
-#define MIN_FLUSH_TIMER_15_MS 15
-
 /** Tx BA stream table */
 typedef struct _TxBAStreamTbl TxBAStreamTbl;
 
@@ -743,7 +769,9 @@
 typedef enum _baStatus_e {
 	BA_STREAM_NOT_SETUP = 0,
 	BA_STREAM_SETUP_INPROGRESS,
-	BA_STREAM_SETUP_COMPLETE
+	BA_STREAM_SETUP_SENT_ADDBA,
+	BA_STREAM_SETUP_COMPLETE,
+	BA_STREAM_SENT_DELBA,
 } baStatus_e;
 
 /** RA list table */
@@ -779,6 +807,11 @@
 	t_u8 is_tdls_link;
 	/** tx_pause flag */
 	t_u8 tx_pause;
+
+	t_u8 tid;
+	t_u8 queue;
+	struct wmm_sta_table *sta;
+	mlan_linked_list pending_txq_entry;
 };
 
 /** TID table */
@@ -791,6 +824,7 @@
 
 /** Highest priority setting for a packet (uses voice AC) */
 #define WMM_HIGHEST_PRIORITY 7
+#define WMM_SECOND_HIGHEST_PRIORITY 6
 /** Highest priority TID  */
 #define HIGH_PRIO_TID 7
 /** Lowest priority TID  */
@@ -801,6 +835,45 @@
 /** Max driver packet delay in msec */
 #define WMM_DRV_DELAY_MAX 510
 
+struct wmm_sta_table {
+	mlan_linked_list all_stas_entry;
+	mlan_linked_list pending_stas_entry;
+	mlan_linked_list active_sta_entry;
+
+	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
+	t_bool ps_sleep;
+
+	raListTbl *ra_lists[MAX_NUM_TID];
+
+	struct {
+		t_u16 time_budget_init_us;
+		t_u32 mpdu_with_amsdu_pps_cap;
+		t_u32 mpdu_no_amsdu_pps_cap;
+		t_u32 byte_budget_init;
+		t_u32 mpdu_with_amsdu_budget_init;
+		t_u32 mpdu_no_amsdu_budget_init;
+		t_u32 phy_rate_kbps;
+		t_u32 queue_packets;
+		t_s32 bytes[MAX_NUM_TID];
+		t_s32 mpdus[MAX_NUM_TID];
+	} budget;
+};
+
+typedef struct mlan_wmm_param {
+	t_u8 ecwmin;
+	;
+	t_u8 ecwmax;
+	t_u8 aifsn;
+} mlan_wmm_param;
+
+typedef struct mlan_wmm_contention {
+	mlan_wmm_param param;
+	t_u8 ecw;
+	t_bool move_cw_on_lost;
+	t_u16 remaining_aifs;
+	t_u16 remaining_backoff;
+} mlan_wmm_contention;
+
 /** Struct of WMM DESC */
 typedef struct _wmm_desc {
 	/** TID table */
@@ -831,6 +904,24 @@
 	mlan_scalar tx_pkts_queued;
 	/** Tracks highest priority with a packet queued */
 	mlan_scalar highest_queued_prio;
+
+	mlan_list_head all_stas; /* struct wmm_sta_table */
+
+	mlan_list_head pending_stas; /* struct wmm_sta_table */
+
+	struct {
+		mlan_list_head list; /* STAs that had some TX traffic since last
+					tracking period, struct wmm_sta_table */
+		t_u32 n_stas;
+		t_u64 next_update;
+	} active_stas;
+
+	mlan_list_head pending_txq[MAX_AC_QUEUES];
+	mlan_wmm_contention txq_contention[MAX_AC_QUEUES];
+	raListTbl *selected_ra_list;
+	t_u64 next_rate_update;
+	t_bool is_rate_update_pending;
+
 } wmm_desc_t;
 
 /** Security structure */
@@ -871,7 +962,10 @@
 	t_u8 data_rates[WLAN_SUPPORTED_RATES];
 	/** Host MLME flag*/
 	t_u8 host_mlme;
+	/** prev_bssid */
 	mlan_802_11_mac_addr prev_bssid;
+	/** attemp_bssid */
+	mlan_802_11_mac_addr attemp_bssid;
 	t_u8 use_mfp;
 } current_bss_params_t;
 
@@ -1174,18 +1268,6 @@
 	/** ATIM window */
 	t_u16 atim_window;
 
-	/** AdHoc channel */
-	t_u8 adhoc_channel;
-	/** AdHoc link sensed flag */
-	t_u8 adhoc_is_link_sensed;
-	/** AdHoc operating state */
-	t_u8 adhoc_state;
-#if defined(STA_SUPPORT)
-	/** AdHoc operating state backup */
-	t_u8 adhoc_state_prev;
-	/** AdHoc previous ssid used for Start */
-	mlan_802_11_ssid adhoc_last_start_ssid;
-#endif
 	mlan_ds_11h_chan_rep_req chan_rep_req;
 	/** FSM variable for 11d support */
 	wlan_802_11d_state_t state_11d;
@@ -1274,10 +1356,6 @@
 	tx_aggr_t aggr_prio_tbl[MAX_NUM_TID];
 	/** Pointer to the priorities for AMSDU/AMPDU table*/
 	t_u8 addba_reject[MAX_NUM_TID];
-	/** Pointer to the priorities for AMSDU/AMPDU table*/
-	t_u8 ibss_ampdu[MAX_NUM_TID];
-	/** Pointer to the priorities for AMSDU/AMPDU table*/
-	t_u8 ibss_addba_reject[MAX_NUM_TID];
 	/** Struct to store ADDBA parameters */
 	add_ba_param_t add_ba_param;
 	/**  user rx_win_size */
@@ -1292,11 +1370,11 @@
 #ifdef STA_SUPPORT
 	/** Buffer to store the association response for application retrieval
 	 */
-	t_u8 assoc_rsp_buf[MRVDRV_ASSOC_RSP_BUF_SIZE];
+	t_u8 assoc_rsp_buf[ASSOC_RSP_BUF_SIZE];
 	/** Length of the data stored in assoc_rsp_buf */
 	t_u32 assoc_rsp_size;
 	/** Buffer to store the association req IEs */
-	t_u8 assoc_req_buf[MRVDRV_ASSOC_RSP_BUF_SIZE];
+	t_u8 assoc_req_buf[ASSOC_RSP_BUF_SIZE];
 	/** Length of the data stored in assoc_rsp_buf */
 	t_u32 assoc_req_size;
 	/** Generic IEEE IEs passed from the application to be inserted into the
@@ -1335,6 +1413,7 @@
 	/** IP address */
 	t_u8 ip_addr[IPADDR_LEN];
 	t_u32 hotspot_cfg;
+	t_u8 multi_ap_flag;
 #ifdef STA_SUPPORT
 	ExtCap_t ext_cap;
 	ExtCap_t def_ext_cap;
@@ -1349,9 +1428,6 @@
 #endif
 	/** Control TX AMPDU on infra link */
 	t_u8 txaggrctrl;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	t_void *psapriv;
-#endif
 	/** rx per packet info */
 	t_u8 rx_pkt_info;
 	/** received amsdu count*/
@@ -1408,6 +1484,14 @@
 	mlan_private *priv;
 } reorder_tmr_cnxt_t;
 
+#define MLAN_SET_BIT(x, val) ((x) |= (1UL << (val)))
+#define MLAN_CLEAR_BIT(x, val) ((x) &= ~(1UL << (val)))
+/** default RX reorder table flush time 128 ms for AC_VI, AC_VO*/
+#define DEF_FLUSH_TIME_AC_VI_VO 128
+/** default RX reorder table flush time 512 ms for AC_BE, AC_BK*/
+#define DEF_FLUSH_TIME_AC_BE_BK 512
+/** minimal AMPDU flush time */
+#define MIN_FLUSH_TIME 100
 /** RX reorder table */
 struct _RxReorderTbl {
 	/** RxReorderTbl previous node */
@@ -1439,6 +1523,8 @@
 	t_u8 pkt_count;
 	/** flush data flag */
 	t_u8 flush_data;
+	/** BA window bitmap */
+	t_u64 bitmap;
 };
 
 /** BSS priority node */
@@ -1513,6 +1599,9 @@
 /** station node */
 typedef struct _sta_node sta_node, *psta_node;
 
+#define VENDOR_OUI_LEN 4
+#define MAX_VENDOR_OUI_NUM 10
+
 /** station node*/
 struct _sta_node {
 	/** previous node */
@@ -1574,16 +1663,23 @@
 	IEEEtypes_HECap_t tdls_he_cap;
 	/** HE Operations IE */
 	IEEEtypes_HeOp_t he_op;
+	IEEEtypes_Generic_t multi_ap_ie;
+	t_u8 is_multi_ap;
 	/** wapi key on off flag */
 	t_u8 wapi_key_on;
 	/** tx pause status */
 	t_u8 tx_pause;
 	/** station band mode */
 	t_u16 bandmode;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	t_void *cm_connectioninfo;
-#endif
 	sta_stats stats;
+	/** station aid */
+	t_u16 aid;
+	/** apple device based on OUI in assoc req */
+	t_u8 is_apple_sta;
+	/** vendor oui list */
+	t_u8 vendor_oui[VENDOR_OUI_LEN * MAX_VENDOR_OUI_NUM];
+	/** vendor OUI count */
+	t_u8 vendor_oui_count;
 };
 
 /** 802.11h State information kept in the 'mlan_adapter' driver structure */
@@ -1909,6 +2005,8 @@
 #endif
 	/** Auto deep sleep */
 	t_u32 auto_ds;
+	/** Boot Time Config */
+	t_u32 bootup_cal_ctrl;
 	/** IEEE PS mode */
 	t_u32 ps_mode;
 	/** Max Tx buffer size */
@@ -1929,6 +2027,10 @@
 	t_u8 passive_to_active_scan;
 	/** uap max sta */
 	t_u8 uap_max_sta;
+	/** wacp mode */
+	t_u8 wacp_mode;
+	/** custom Fw data */
+	t_u32 fw_data_cfg;
 	/** dfs w53 cfg */
 	t_u8 dfs53cfg;
 	/** dfs_offload */
@@ -1939,6 +2041,18 @@
 #endif
 	t_u8 ext_scan;
 	t_u8 mcs32;
+	/** antcfg */
+	t_u32 antcfg;
+	/** dmcs*/
+	t_u8 dmcs;
+	/** pref_dbc*/
+	t_u8 pref_dbc;
+	t_u32 max_tx_pending;
+	t_u16 tx_budget;
+	t_u8 mclient_scheduling;
+	t_u32 reject_addba_req;
+	t_u8 disable_11h_tpc;
+	t_u32 amsdu_disable;
 } mlan_init_para, *pmlan_init_para;
 
 #ifdef SDIO
@@ -2167,7 +2281,12 @@
 	t_u32 host_intr_cmd_done;
 	/** Event ready interrupt for host */
 	t_u32 host_intr_event_rdy;
+	/** cmd dnld interrupt for host */
 	t_u32 host_intr_cmd_dnld;
+	/** adma align size */
+	t_u8 adma_align_size;
+	/** adma min pkt size */
+	t_u8 adma_min_pkt_size;
 	/* TX/RX buffer description mask */
 	t_u32 txrx_rw_ptr_mask;
 	/* TX/RX buffer description wrap mask */
@@ -2186,8 +2305,10 @@
 	t_u32 pcie_int_mode;
 	/** PCIE function number */
 	t_u8 func_num;
+	/** rx interrupt pending */
+	t_u8 rx_pending;
 	/** pending num of tx ring buffer in firmware */
-	t_u8 txbd_pending;
+	t_u16 txbd_pending;
 	/** Write pointer for TXBD ring */
 	t_u32 txbd_wrptr;
 	/** Shadow copy of TXBD read pointer */
@@ -2249,8 +2370,11 @@
 	mlan_buffer *cmdrsp_buf;
 	/** Command buffer */
 	mlan_buffer *vdll_cmd_buf;
+	/** last write index where we have tx_done interrupt enabled  */
+	t_u32 last_write_index_with_irq;
 	/** last tx_pkt_size  */
 	t_u32 last_tx_pkt_size[MLAN_MAX_TXRX_BD];
+
 } mlan_pcie_card, *pmlan_pcie_card;
 #endif
 
@@ -2282,6 +2406,7 @@
 	t_u8 supp_ps_handshake;
 	/** DEFAULT_11N_TX_BF_CAP */
 	t_u32 default_11n_tx_bf_cap;
+	t_u8 support_11mc;
 } mlan_card_info, *pmlan_card_info;
 
 typedef struct _mlan_adapter mlan_adapter, *pmlan_adapter;
@@ -2293,7 +2418,7 @@
 	/**interrupt handler*/
 	mlan_status (*interrupt)(t_u16 msg_id, pmlan_adapter pmadapter);
 	/**INT process handler*/
-	mlan_status (*process_int_status)(pmlan_adapter pmadapter);
+	mlan_status (*process_int_status)(pmlan_adapter pmadapter, t_u8 type);
 	/**host to card handler*/
 	mlan_status (*host_to_card)(pmlan_private pmpriv, t_u8 type,
 				    mlan_buffer *pmbuf,
@@ -2320,6 +2445,15 @@
 	mlan_status (*disable_host_int)(mlan_adapter *pmadapter);
 	/** enable host interrupt */
 	mlan_status (*enable_host_int)(mlan_adapter *pmadapter);
+	/** select host interrupt */
+	mlan_status (*select_host_int)(mlan_adapter *pmadapter);
+#ifdef PCIEAW693
+	/** get_max_msdu_pkt_num in AMSDU packet*/
+	t_u32 (*get_max_msdu_cnt)(mlan_adapter *pmadapter);
+	/** send_data_list */
+	mlan_status (*send_data_list)(mlan_adapter *pmadapter, t_u8 type,
+				      t_u8 num_pkt, t_u16 pkt_size);
+#endif
 	/**Interface header length*/
 	t_u32 intf_header_len;
 } mlan_adapter_operations;
@@ -2344,6 +2478,31 @@
 	t_void *pmlan_lock;
 	/** main_proc_lock for main_process */
 	t_void *pmain_proc_lock;
+	mlan_private *selected_mlan_bss;
+#ifdef PCIE
+	/** rx data lock to synchronize wlan_pcie_process_recv_data */
+	t_void *pmlan_rx_lock;
+	/** PCIe rx process */
+	t_u8 pcie_rx_processing;
+	/** PCIe event process */
+	t_u8 pcie_event_processing;
+	/** PCIe tx process */
+	t_u8 pcie_tx_processing;
+	/** pcie cmd_dnld_int flag */
+	t_u8 pcie_cmd_dnld_int;
+	/** pcie event_int flag */
+	t_u8 pcie_event_int;
+	/** more_tx_task_flag */
+	t_u8 more_tx_task_flag;
+	/** more event flag */
+	t_u8 more_event_flag;
+	/** tx data lock to synchronize send_data and send_data_complete */
+	t_void *pmlan_tx_lock;
+	/** event lock to synchronize process_event and event_ready */
+	t_void *pmlan_event_lock;
+	/** pcie lock to synchronize rxbd_wr_ptr and txbd_wr_ptr */
+	t_void *pmlan_pcie_lock;
+#endif
 	/** mlan_processing */
 	t_u32 mlan_processing;
 	/** main_process_cnt */
@@ -2362,6 +2521,10 @@
 	t_u32 more_task_flag;
 	/** delay task flag */
 	t_u32 delay_task_flag;
+#ifdef PCIE
+	/** delay rx data */
+	t_u32 delay_rx_data_flag;
+#endif
 	/** Max tx buf size */
 	t_u16 max_tx_buf_size;
 	/** Tx buf size */
@@ -2408,7 +2571,8 @@
 	t_u32 fw_cap_ext;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(SDAW693) || defined(SDIW624) || defined(PCIEAW693) ||          \
+	defined(PCIEIW624) || defined(USBIW624)
 	/** High byte for 5G, low byte for 2G, like 0x2211 0x22 for 5G, 0x11 for
 	 * 2G */
 	t_u16 user_htstream;
@@ -2554,6 +2718,8 @@
 	wlan_802_11d_domain_reg_t domain_reg;
 	/** Country Code */
 	t_u8 country_code[COUNTRY_CODE_LEN];
+	/**country code from OTP*/
+	t_u16 fw_country_code;
 	/** FSM variable for 11h support */
 	wlan_11h_device_state_t state_11h;
 	/** FSM variable for DFS support */
@@ -2617,8 +2783,6 @@
 
 	/** F/W supported bands */
 	t_u16 fw_bands;
-	/** User selected band to start adhoc network */
-	t_u16 adhoc_start_band;
 	/** User selected bands */
 	t_u16 config_bands;
 	/** Pointer to channel list last sent to the firmware for scanning */
@@ -2639,6 +2803,8 @@
 	t_u8 rx_data_ep;
 	/** Tx data endpoint address */
 	t_u8 tx_data_ep;
+	/** mlan_lock for rx event */
+	t_void *pmlan_usb_event_lock;
 #endif
 	/** Multi channel status */
 	t_u8 mc_status;
@@ -2683,6 +2849,10 @@
 	/** Beacon miss timeout */
 	t_u16 bcn_miss_time_out;
 
+	/** Firmware wakeup method */
+	t_u16 fw_wakeup_method;
+	/** Firmware wakeup GPIO pin */
+	t_u8 fw_wakeup_gpio_pin;
 	/** Deep Sleep flag */
 	t_u8 is_deep_sleep;
 	/** Idle time */
@@ -2714,6 +2884,8 @@
 	t_u8 wakeup_fw_timer_is_set;
 	/** Number of wake up timeouts */
 	t_u32 pm_wakeup_timeout;
+	/** Card wakeup flag */
+	t_u8 pm_wakeup_flag;
 
 	/** Host Sleep configured flag */
 	t_u8 is_hs_configured;
@@ -2729,6 +2901,8 @@
 	t_u32 hw_dot_11n_dev_cap;
 	/** Device support for MIMO abstraction of MCSs */
 	t_u8 hw_dev_mcs_support;
+	/** mpdu density */
+	t_u8 hw_mpdu_density;
 #ifdef STA_SUPPORT
 	/** Adhoc Secondary Channel Bandwidth */
 	t_u8 chan_bandwidth;
@@ -2750,6 +2924,8 @@
 	t_u16 max_mgmt_ie_index;
 	/** Head of Rx data queue */
 	mlan_list_head rx_data_queue;
+	/** Head of AMSDU Tx data queue */
+	mlan_list_head amsdu_txq;
 #ifdef MFG_CMD_SUPPORT
 	t_u32 mfg_mode;
 #endif
@@ -2792,7 +2968,7 @@
 	/** management frame wakeup filter config */
 	mlan_mgmt_frame_wakeup mgmt_filter[MAX_MGMT_FRAME_FILTER];
 	/** Bypass TX queue pkt count  */
-	t_u32 bypass_pkt_count;
+	mlan_scalar bypass_pkt_count;
 #ifdef STA_SUPPORT
 	/** warm-reset IOCTL request buffer pointer */
 	pmlan_ioctl_req pwarm_reset_ioctl_req;
@@ -2844,21 +3020,109 @@
 	t_u8 tx_power_table_a_cols;
 	/**mlan adapter operations*/
 	mlan_adapter_operations ops;
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-	/** authenticator_priv */
-	pmlan_private authenticator_priv;
-#endif
 	/** TP accounting mode 1-enable 0-disable */
 	t_u32 tp_state_on;
 	/** Packet drop point */
 	t_u32 tp_state_drop_point;
+	/** second mac flag */
+	t_u8 second_mac;
+	/** napi */
+	t_u8 napi;
 	/* lower 8 bytes of uuid */
 	t_u64 uuid_lo;
 
 	/* higher 8 bytes of uuid */
 	t_u64 uuid_hi;
+	/** AC BK/BE_flush time*/
+	t_u16 flush_time_ac_be_bk;
+	/** AC VI/VO flush time */
+	t_u16 flush_time_ac_vi_vo;
+	/** remain_on_channel flag */
+	t_u8 remain_on_channel;
+
+	t_u8 mclient_tx_supported;
+	t_u8 tx_ba_timeout_support;
+	t_u32 tx_ba_stream_limit;
+	t_u32 tx_mpdu_with_amsdu_pps;
+	t_u32 tx_mpdu_no_amsdu_pps;
+
+	struct {
+		raListTbl *ra_list;
+		t_u32 pushed_pkg;
+	} ra_list_tracing;
+	/** LLDE enable/disable */
+	t_u8 llde_enabled;
+	/** LLDE modes 0 - default; 1 - carplay; 2 - gameplay; 3 - sound bar, 4
+	 * – validation, 5- event driven */
+	t_u8 llde_mode;
+	/** high priority data packet type. 0: All traffic, 1: ping, 2: TCP ACK,
+	 * 4: TCP Data, 8: UDP */
+	t_u8 llde_packet_type;
+	/** 0: no preference, 1: iphone  */
+	t_u8 llde_device_filter;
+	/** total iPhone devices allowed in list */
+	t_u8 llde_totalIPhones;
+	/** total other devices as defined in llde.conf */
+	t_u8 llde_totalMacFilters;
+	/** mac filter list as defined in llde.conf file */
+	t_u8 llde_macfilters[MAX_MAC_FILTER_ENTRIES * MLAN_MAC_ADDR_LENGTH];
+	/** iPhone device list */
+	t_u8 llde_iphonefilters[MAX_IPHONE_FILTER_ENTRIES *
+				MLAN_MAC_ADDR_LENGTH];
 };
 
+/** IPv4 ARP request header */
+typedef MLAN_PACK_START struct {
+	/** Hardware type */
+	t_u16 Htype;
+	/** Protocol type */
+	t_u16 Ptype;
+	/** Hardware address length */
+	t_u8 addr_len;
+	/** Protocol address length */
+	t_u8 proto_len;
+	/** Operation code */
+	t_u16 op_code;
+	/** Source mac address */
+	t_u8 sender_mac[MLAN_MAC_ADDR_LENGTH];
+	/** Sender IP address */
+	t_u8 sender_ip[4];
+	/** Destination mac address */
+	t_u8 target_mac[MLAN_MAC_ADDR_LENGTH];
+	/** Destination IP address */
+	t_u8 target_ip[4];
+} MLAN_PACK_END IPv4_ARP_t;
+
+/** IPv6 Nadv packet header */
+typedef MLAN_PACK_START struct {
+	/** IP protocol version */
+	t_u8 version;
+	/** flow label */
+	t_u8 flow_lab[3];
+	/** Payload length */
+	t_u16 payload_len;
+	/** Next header type */
+	t_u8 next_hdr;
+	/** Hot limit */
+	t_u8 hop_limit;
+	/** Source address */
+	t_u8 src_addr[16];
+	/** Destination address */
+	t_u8 dst_addr[16];
+	/** ICMP type */
+	t_u8 icmp_type;
+	/** IPv6 Code */
+	t_u8 ipv6_code;
+	/** IPv6 Checksum */
+	t_u16 ipv6_checksum;
+	/** Flags */
+	t_u32 flags;
+	/** Target address */
+	t_u8 taget_addr[16];
+	/** Reserved */
+	t_u8 rev[8];
+} MLAN_PACK_END IPv6_Nadv_t;
+
 /** Check if stream 2X2 enabled */
 #define IS_STREAM_2X2(x) ((x)&FEATURE_CTRL_STREAM_2X2)
 /** Check if DFS support enabled */
@@ -2873,9 +3137,43 @@
 #define MLAN_ETHER_PKT_TYPE_ARP (0x0806)
 /** Ethernet packet type for WAPI */
 #define MLAN_ETHER_PKT_TYPE_WAPI (0x88B4)
+/** Ethernet packet type for IP */
+#define MLAN_ETHER_PKT_TYPE_IP (0x0800)
+/** Ethernet packet type for 1905.1a (EASYMESH) */
+#define MLAN_ETHER_PKT_TYPE_1905 (0x893a)
 /** Ethernet packet type offset */
 #define MLAN_ETHER_PKT_TYPE_OFFSET (12)
 
+/** IP packet Protocol number for ICMP */
+#define MLAN_IP_PROTOCOL_ICMP (0x01)
+/** IP packet Protocol number offset */
+#define MLAN_IP_PROTOCOL_OFFSET (11)
+
+/** IP packet Protocol number for TCP */
+#define MLAN_IP_PROTOCOL_TCP (0x06)
+/** IP packet Protocol number for UDP */
+#define MLAN_IP_PROTOCOL_UDP (0x11)
+
+#define LLDE_FILTER_PKT_ALL 0
+#define LLDE_FILTER_PKT_ICMP_PING 1
+#define LLDE_FILTER_PKT_TCP_ACK 2
+#define LLDE_FILTER_PKT_TCP_DATA 4
+#define LLDE_FILTER_PKT_UDP 8
+#define MLAN_TCP_ACK_OFFSET 24
+#define MLAN_TCP_ACK_HEADER_LEN 52
+
+#ifdef STA_SUPPORT
+/** Region code mapping */
+typedef struct _region_code_mapping {
+	/** Region */
+	t_u8 region[COUNTRY_CODE_LEN];
+	/** Code */
+	t_u8 code;
+} region_code_mapping_t;
+extern region_code_mapping_t region_code_mapping[];
+t_u8 *wlan_11d_code_2_region(pmlan_adapter pmadapter, t_u8 code);
+#endif
+
 /** Rx packet Sniffer Operation Mode
  *
  * MODE1 : Can be enabled only in disconnected state.
@@ -2963,6 +3261,21 @@
 	return MFALSE;
 }
 
+/**
+ *  @brief check if Rx pending
+ *
+ *  @param pmadapter	Pointer to mlan_adapter
+ *  @return  MTRUE/MFALSE;
+ */
+static inline t_u8 wlan_is_rx_pending(mlan_adapter *pmadapter)
+{
+#ifdef PCIE
+	if (IS_PCIE(pmadapter->card_type) && pmadapter->pcard_pcie->rx_pending)
+		return MTRUE;
+#endif
+	return MFALSE;
+}
+
 /** process host cmd */
 mlan_status wlan_misc_ioctl_host_cmd(pmlan_adapter pmadapter,
 				     pmlan_ioctl_req pioctl_req);
@@ -2985,6 +3298,8 @@
 #endif
 
 mlan_status wlan_misc_csi(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_csi(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+			 t_u16 cmd_action, t_u16 *pdata_buf);
 mlan_status wlan_process_csi_event(pmlan_private pmpriv);
 
 mlan_status wlan_misc_hal_phy_cfg(pmlan_adapter pmadapter,
@@ -3061,6 +3376,10 @@
 				     pmlan_buffer pmbuf, mlan_status status);
 
 #ifdef USB
+/** Request event lock */
+t_void wlan_request_event_lock(mlan_adapter *pmadapter);
+/** Release event lock */
+t_void wlan_release_event_lock(mlan_adapter *pmadapter);
 mlan_status wlan_usb_deaggr_rx_pkt(pmlan_adapter pmadapter, pmlan_buffer pmbuf);
 
 /**
@@ -3143,12 +3462,18 @@
 t_void wlan_cleanup_bypass_txq(pmlan_private priv);
 t_u8 wlan_bypass_tx_list_empty(mlan_adapter *pmadapter);
 
+mlan_status wlan_misc_ioctl_tx_frame(pmlan_adapter pmadapter,
+				     pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_tx_frame(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+			      t_u16 cmd_action, t_void *pdata_buf);
+
 /** Check if this is the last packet */
 t_u8 wlan_check_last_packet_indication(pmlan_private priv);
 
 #define MOAL_ALLOC_MLAN_BUFFER MBIT(0)
 #define MOAL_MALLOC_BUFFER MBIT(1)
 #define MOAL_MEM_FLAG_ATOMIC MBIT(2)
+#define MOAL_MEM_FLAG_DIRTY MBIT(3)
 
 #ifdef PCIE
 /* This defines the direction arg to the DMA mapping routines. */
@@ -3246,6 +3571,20 @@
 					    pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_get_tsf_info(pmlan_adapter pmadapter,
 				   pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				      t_void *pdata_buf);
+mlan_status wlan_ret_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp,
+				      mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_misc_ioctl_cross_chip_synch(pmlan_adapter pmadapter,
+					     pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_tsp_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+				t_u16 cmd_action, t_void *pdata_buf);
+mlan_status wlan_ret_tsp_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_misc_ioctl_tsp_config(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req);
 /** get ralist info */
 int wlan_get_ralist_info(mlan_private *priv, pralist_info buf);
 /** dump ralist */
@@ -3295,6 +3634,7 @@
 
 mlan_status wlan_radio_ioctl_ant_cfg(pmlan_adapter pmadapter,
 				     pmlan_ioctl_req pioctl_req);
+mlan_status wlan_handle_antcfg(mlan_private *pmpriv, t_u32 init_antcfg);
 
 mlan_status wlan_cmd_tx_rate_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				 t_u16 cmd_action, t_void *pdata_buf,
@@ -3319,6 +3659,16 @@
 /** Sends HS_WAKEUP event to applications */
 t_void wlan_host_sleep_wakeup_event(pmlan_private priv);
 
+mlan_status wlan_cmd_802_11_fw_wakeup_method(pmlan_private pmpriv,
+					     HostCmd_DS_COMMAND *cmd,
+					     t_u16 cmd_action,
+					     t_u16 *pdata_buf);
+mlan_status wlan_ret_fw_wakeup_method(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp,
+				      mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_fw_wakeup_method(pmlan_adapter pmadapter,
+				  pmlan_ioctl_req pioctl_req);
+
 /** Prepares command of robustcoex */
 mlan_status wlan_cmd_robustcoex(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				t_u16 cmd_action, t_u16 *pdata_buf);
@@ -3340,6 +3690,10 @@
 mlan_status wlan_cmd_ssu(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 			 t_u16 cmd_action, t_u16 *pdata_buf);
 #endif
+#ifdef PCIE
+/** Init write pointer */
+mlan_status wlan_pcie_init_fw(pmlan_adapter pmadapter);
+#endif
 
 /** send get hw spec command to firmware */
 mlan_status wlan_adapter_get_hw_spec(pmlan_adapter pmadapter);
@@ -3450,6 +3804,9 @@
 mlan_status wlan_ret_802_11_scan(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				 t_void *pioctl_buf);
 
+mlan_status wlan_scan_ioctl(pmlan_adapter pmadapter,
+			    pmlan_ioctl_req pioctl_req);
+
 t_u8 wlan_get_ext_scan_state(HostCmd_DS_COMMAND *pcmd);
 /** Extended scan command handler */
 mlan_status wlan_cmd_802_11_scan_ext(pmlan_private pmpriv,
@@ -3511,29 +3868,6 @@
 mlan_status wlan_disconnect(mlan_private *pmpriv, mlan_ioctl_req *pioctl_req,
 			    mlan_deauth_param *deauth_param);
 
-/** Ad-Hoc start */
-mlan_status wlan_adhoc_start(mlan_private *pmpriv, t_void *pioctl_buf,
-			     mlan_802_11_ssid *padhoc_ssid);
-
-/** Ad-Hoc join */
-mlan_status wlan_adhoc_join(mlan_private *pmpriv, t_void *pioctl_buf,
-			    BSSDescriptor_t *pBSSDesc);
-
-/** Ad-Hoc start command handler */
-mlan_status wlan_cmd_802_11_ad_hoc_start(mlan_private *pmpriv,
-					 HostCmd_DS_COMMAND *cmd,
-					 t_void *pdata_buf);
-
-/** Ad-Hoc command handler */
-mlan_status wlan_cmd_802_11_ad_hoc_join(mlan_private *pmpriv,
-					HostCmd_DS_COMMAND *cmd,
-					t_void *pdata_buf);
-
-/** Handler for Ad-Hoc commands */
-mlan_status wlan_ret_802_11_ad_hoc(mlan_private *pmpriv,
-				   HostCmd_DS_COMMAND *resp,
-				   t_void *pioctl_buf);
-
 /** Handler for bgscan query commands */
 mlan_status wlan_cmd_802_11_bg_scan_query(mlan_private *pmpriv,
 					  HostCmd_DS_COMMAND *pcmd,
@@ -3594,12 +3928,28 @@
 				t_u16 cmd_action, t_void *pdata_buf);
 mlan_status wlan_ret_rxabortcfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_cmd_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_void *pdata_buf);
+mlan_status wlan_ret_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *resp,
+				     mlan_ioctl_req *pioctl_buf);
 mlan_status wlan_cmd_rxabortcfg_ext(pmlan_private pmpriv,
 				    HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
 				    t_void *pdata_buf);
+mlan_status wlan_cmd_nav_mitigation(pmlan_private pmpriv,
+				    HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				    t_void *pdata_buf);
+mlan_status wlan_cmd_led_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+				t_u16 cmd_action, t_void *pdata_buf);
 mlan_status wlan_ret_rxabortcfg_ext(pmlan_private pmpriv,
 				    HostCmd_DS_COMMAND *resp,
 				    mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_ret_nav_mitigation(pmlan_private pmpriv,
+				    HostCmd_DS_COMMAND *resp,
+				    mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_ret_led_config(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf);
 mlan_status wlan_cmd_tx_ampdu_prot_mode(pmlan_private pmpriv,
 					HostCmd_DS_COMMAND *cmd,
 					t_u16 cmd_action, t_void *pdata_buf);
@@ -3642,8 +3992,14 @@
 
 mlan_status wlan_misc_ioctl_rxabortcfg(pmlan_adapter pmadapter,
 				       pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_ioctl_ofdmdesense_cfg(pmlan_adapter pmadapter,
+					    pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_rxabortcfg_ext(pmlan_adapter pmadapter,
 					   pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_ioctl_nav_mitigation(pmlan_adapter pmadapter,
+					   pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_ioctl_led(pmlan_adapter pmadapter,
+				pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_tx_ampdu_prot_mode(pmlan_adapter pmadapter,
 					       pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_dot11mc_unassoc_ftm_cfg(pmlan_adapter pmadapter,
@@ -3660,6 +4016,10 @@
 					pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_range_ext(pmlan_adapter pmadapter,
 				      pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_ioctl_twt_report(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req);
+mlan_status wlan_ret_twt_report(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf);
 mlan_status wlan_misc_ioctl_arb_cfg(pmlan_adapter pmadapter,
 				    pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_tp_state(pmlan_adapter pmadapter,
@@ -3691,6 +4051,7 @@
 			       dfs_state_t dfs_state);
 t_void wlan_reset_all_chan_dfs_state(mlan_private *priv, t_u16 band,
 				     dfs_state_t dfs_state);
+
 /* 802.11D related functions */
 /** Initialize 11D */
 t_void wlan_11d_priv_init(mlan_private *pmpriv);
@@ -3744,6 +4105,10 @@
 mlan_status wlan_11d_cfg_domain_info(pmlan_adapter pmadapter,
 				     mlan_ioctl_req *pioctl_req);
 
+/** This functionn set/get reorder flush time */
+mlan_status wlan_misc_ioctl_reorder_flush_time(pmlan_adapter pmadapter,
+					       mlan_ioctl_req *pioctl_req);
+
 /** This function converts region string to CFP table code */
 mlan_status wlan_misc_country_2_cfp_table_code(pmlan_adapter pmadapter,
 					       t_u8 *country_code, t_u8 *cfp_bg,
@@ -3767,7 +4132,7 @@
 void wlan_check_sta_capability(pmlan_private priv, pmlan_buffer pevent,
 			       sta_node *sta_ptr);
 /** find specific ie */
-t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u8 ie_len,
+t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u16 ie_len,
 			   IEEEtypes_ElementId_e id, t_u8 ext_id);
 t_u8 wlan_is_wmm_ie_present(pmlan_adapter pmadapter, t_u8 *pbuf, t_u16 buf_len);
 /** Ethernet II header */
@@ -3852,6 +4217,30 @@
 }
 
 /**
+ *  @brief This function checks if address is broadcast
+ *
+ *  @param addr  mac address
+ *  @return      1 - broadcast, 0 - not broadcast
+ */
+static INLINE t_bool is_bcast_addr(t_u8 *addr)
+{
+	return ((*(t_u16 *)addr == 0xffff) &&
+		(*(t_u16 *)((t_u8 *)addr + 2) == 0xffff) &&
+		(*(t_u16 *)((t_u8 *)addr + 4) == 0xffff));
+}
+
+/**
+ *  @brief This function checks if address is multicast
+ *
+ *  @param addr  mac address
+ *  @return      1 - multicast, 0 - not multicast
+ */
+static INLINE t_bool is_mcast_addr(t_u8 *addr)
+{
+	return ((*(t_u8 *)addr & 0x01) == 0x01);
+}
+
+/**
  *  @brief This function checks tx_pause flag for peer
  *
  *  @param priv     A pointer to mlan_private
@@ -3889,6 +4278,8 @@
 		return MTRUE;
 }
 #endif
+mlan_status wlan_check_easymesh_pkt(mlan_private *priv, pmlan_buffer pmbuf,
+				    RxPD *prx_pd);
 
 #ifdef UAP_SUPPORT
 mlan_status wlan_process_uap_rx_packet(mlan_private *priv, pmlan_buffer pmbuf);
@@ -3904,6 +4295,7 @@
 					   pmlan_ioctl_req pioctl_req,
 					   t_bool send_ioctl);
 
+mlan_status wlan_cmd_func_init(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd);
 mlan_status wlan_cmd_get_hw_spec(pmlan_private pmpriv,
 				 HostCmd_DS_COMMAND *pcmd);
 mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
@@ -3922,12 +4314,6 @@
 mlan_status wlan_ret_mac_control(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				 mlan_ioctl_req *pioctl_buf);
 
-mlan_status wlan_cmd_cw_mode_ctrl(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
-				  t_u16 cmd_action, t_void *pdata_buf);
-mlan_status wlan_ret_cw_mode_ctrl(pmlan_private pmpriv,
-				  HostCmd_DS_COMMAND *resp,
-				  mlan_ioctl_req *pioctl_buf);
-
 mlan_status wlan_cmd_802_11_radio_control(pmlan_private pmpriv,
 					  HostCmd_DS_COMMAND *cmd,
 					  t_u16 cmd_action, t_void *pdata_buf);
@@ -3947,6 +4333,9 @@
 				mlan_ioctl_req *pioctl_buf);
 mlan_status wlan_ret_mem_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_ret_gpio_cfg_ops(pmlan_private pmpriv,
+				  HostCmd_DS_COMMAND *resp,
+				  mlan_ioctl_req *pioctl_buf);
 
 mlan_status wlan_reg_mem_ioctl_reg_rw(pmlan_adapter pmadapter,
 				      pmlan_ioctl_req pioctl_req);
@@ -3958,6 +4347,8 @@
 				t_u16 cmd_action, t_void *pdata_buf);
 mlan_status wlan_cmd_mem_access(HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
 				t_void *pdata_buf);
+mlan_status wlan_cmd_gpio_cfg_ops(HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				  t_void *pdata_buf);
 mlan_status wlan_cmd_802_11_mac_address(pmlan_private pmpriv,
 					HostCmd_DS_COMMAND *cmd,
 					t_u16 cmd_action);
@@ -3987,6 +4378,33 @@
 mlan_status wlan_misc_ioctl_tdls_cs_channel(pmlan_adapter pmadapter,
 					    pmlan_ioctl_req pioctl_req);
 
+mlan_status wlan_config_rtt(pmlan_adapter pmadapter,
+			    pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cancel_rtt(pmlan_adapter pmadapter,
+			    pmlan_ioctl_req pioctl_req);
+mlan_status wlan_rtt_responder_cfg(pmlan_adapter pmadapter,
+				   pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_802_11_ftm_config_session_params(pmlan_private pmpriv,
+						      HostCmd_DS_COMMAND *cmd,
+						      t_u16 cmd_action,
+						      t_u32 cmd_oid,
+						      t_void *pdata_buf);
+mlan_status
+wlan_ret_802_11_ftm_config_session_params(pmlan_private pmpriv,
+					  HostCmd_DS_COMMAND *resp,
+					  mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_fill_hal_rtt_results(pmlan_private pmpriv,
+				      Event_WLS_FTM_t *event_ftm,
+				      t_u32 event_ftm_len, mlan_event *pevent);
+mlan_status wlan_cmd_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *cmd,
+						 t_u16 cmd_action,
+						 t_u32 cmd_oid,
+						 t_void *pdata_buf);
+mlan_status wlan_ret_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *resp,
+						 mlan_ioctl_req *pioctl_buf);
+
 mlan_status wlan_get_info_ver_ext(pmlan_adapter pmadapter,
 				  pmlan_ioctl_req pioctl_req);
 
@@ -4013,12 +4431,13 @@
 mlan_status wlan_misc_hotspot_cfg(pmlan_adapter pmadapter,
 				  pmlan_ioctl_req pioctl_req);
 
-#ifdef STA_SUPPORT
+mlan_status wlan_misc_multi_ap_cfg(pmlan_adapter pmadapter,
+				   pmlan_ioctl_req pioctl_req);
+
 mlan_status wlan_misc_ext_capa_cfg(pmlan_adapter pmadapter,
 				   pmlan_ioctl_req pioctl_req);
 
 t_u32 wlan_is_ext_capa_support(mlan_private *pmpriv);
-#endif
 
 #ifdef STA_SUPPORT
 void wlan_add_ext_capa_info_ie(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
@@ -4031,14 +4450,6 @@
 mlan_status wlan_ret_boot_sleep(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				mlan_ioctl_req *pioctl_buf);
 
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-mlan_status wlan_cmd_crypto(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
-			    t_u16 cmd_action, t_u16 *pdata_buf);
-
-mlan_status wlan_ret_crypto(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
-			    mlan_ioctl_req *pioctl_buf);
-#endif
-
 #define BW_20MHZ 0
 #define BW_40MHZ 1
 #define BW_80MHZ 2
@@ -4048,7 +4459,7 @@
 mlan_status wlan_get_curr_oper_class(mlan_private *pmpriv, t_u8 channel,
 				     t_u8 bw, t_u8 *oper_class);
 mlan_status wlan_check_operclass_validation(mlan_private *pmpriv, t_u8 channel,
-					    t_u8 oper_class);
+					    t_u8 oper_class, t_u8 bandwidth);
 mlan_status wlan_misc_ioctl_operclass_validation(pmlan_adapter pmadapter,
 						 mlan_ioctl_req *pioctl_req);
 mlan_status wlan_misc_ioctl_oper_class(pmlan_adapter pmadapter,
@@ -4130,9 +4541,6 @@
 mlan_status wlan_misc_ioctl_pmic_configure(pmlan_adapter pmadapter,
 					   pmlan_ioctl_req pioctl_req);
 
-mlan_status wlan_misc_ioctl_cwmode_ctrl(pmlan_adapter pmadapter,
-					pmlan_ioctl_req pioctl_req);
-
 mlan_status wlan_set_mef_entry(mlan_private *pmpriv, pmlan_adapter pmadapter,
 			       mef_cfg_data *pmef);
 mlan_status wlan_process_mef_cfg_cmd(mlan_private *pmpriv,
@@ -4176,11 +4584,11 @@
 mlan_status wlan_misc_ioctl_get_tsf(pmlan_adapter pmadapter,
 				    pmlan_ioctl_req pioctl_req);
 void wlan_add_fw_cfp_tables(pmlan_private pmpriv, t_u8 *buf, t_u16 buf_left);
-
 void wlan_free_fw_cfp_tables(mlan_adapter *pmadapter);
-
 mlan_status wlan_misc_chan_reg_cfg(pmlan_adapter pmadapter,
 				   pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_region_power_cfg(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req);
 
 mlan_status wlan_get_cfp_table(pmlan_adapter pmadapter,
 			       pmlan_ioctl_req pioctl_req);
@@ -4218,6 +4626,9 @@
 t_u8 wlan_get_center_freq_idx(mlan_private *pmpriv, t_u16 band, t_u32 pri_chan,
 			      t_u8 chan_bw);
 
+mlan_status wlan_cmd_chan_region_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_void *pdata_buf);
 mlan_status wlan_ret_chan_region_cfg(pmlan_private pmpriv,
 				     HostCmd_DS_COMMAND *resp,
 				     mlan_ioctl_req *pioctl_buf);
@@ -4228,6 +4639,9 @@
 				   HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
 				   t_void *pdata_buf);
 
+mlan_status wlan_misc_gpiocfg(pmlan_adapter pmadapter,
+			      mlan_ioctl_req *pioctl_req);
+
 mlan_status wlan_misc_bootsleep(pmlan_adapter pmadapter,
 				pmlan_ioctl_req pioctl_req);
 
@@ -4254,6 +4668,9 @@
 mlan_status wlan_ret_set_get_low_power_mode_cfg(pmlan_private pmpriv,
 						HostCmd_DS_COMMAND *resp,
 						mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_ret_auth_assoc_timeout_cfg(pmlan_private pmpriv,
+					    HostCmd_DS_COMMAND *resp,
+					    mlan_ioctl_req *pioctl_buf);
 
 mlan_status wlan_cmd_range_ext(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 			       t_u16 cmd_action, t_void *pdata_buf);
@@ -4268,10 +4685,18 @@
 				     HostCmd_DS_COMMAND *resp,
 				     mlan_ioctl_req *pioctl_buf);
 
+mlan_status wlan_misc_ioctl_edmac_cfg(pmlan_adapter pmadapter,
+				      pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_edmac_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+			       t_u16 cmd_action, t_void *pdata_buf);
+
 /** Set/Get Country code */
 mlan_status wlan_misc_ioctl_country_code(pmlan_adapter pmadapter,
 					 mlan_ioctl_req *pioctl_req);
 
+/** Get custom Fw data */
+mlan_status wlan_get_custom_fw_data(pmlan_adapter pmadapter, t_u8 *pdata);
+
 /**
  *  @brief RA based queueing
  *
@@ -4357,6 +4782,23 @@
 	return chr <= ' ' && (chr == ' ' || (chr <= 13 && chr >= 9));
 }
 
+static INLINE const char *wlan_str_skip_prefix(const char *str,
+					       const char *prefix)
+{
+	const char *substr = str;
+
+	while (*substr && *substr == *prefix) {
+		substr++;
+		prefix++;
+	}
+
+	if (*substr && !*prefix) {
+		str = substr;
+	}
+
+	return str;
+}
+
 /** delay unit */
 typedef enum _delay_unit {
 	USEC,
@@ -4613,4 +5055,33 @@
 
 	return count;
 }
+
+t_bool wlan_secure_add(t_void *datain, t_s32 add, t_void *dataout,
+		       data_type type);
+t_bool wlan_secure_sub(t_void *datain, t_s32 sub, t_void *dataout,
+		       data_type type);
+
+void wlan_wmm_contention_init(
+	mlan_private *mlan,
+	const IEEEtypes_WmmAcParameters_t ac_params[MAX_AC_QUEUES]);
+void wlan_update_sta_ps_state(pmlan_private priv, t_u8 *mac, t_u8 sleep);
+mlan_status wlan_cmd_sta_tx_rate_req(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_pvoid pdata_buf);
+mlan_status wlan_ret_sta_tx_rate(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				 mlan_ioctl_req *pioctl_buf);
+
+mlan_status wlan_cmd_mclient_scheduling_cfg(pmlan_private pmpriv,
+					    HostCmd_DS_COMMAND *cmd,
+					    t_u16 cmd_action,
+					    t_pvoid pdata_buf);
+
+mlan_status wlan_cmd_mclient_scheduling_enable(pmlan_private pmpriv,
+					       t_bool enable);
+
+void wlan_add_iPhone_entry(mlan_private *priv, t_u8 *mac);
+void wlan_delete_iPhone_entry(mlan_private *priv, t_u8 *mac);
+
+extern void print_chan_switch_block_event(t_u16 reason_code);
+
 #endif /* !_MLAN_MAIN_H_ */
diff --git a/wlan_sd8987/mlan/mlan_meas.c b/wlan_src/mlan/mlan_meas.c
old mode 100755
new mode 100644
similarity index 92%
rename from wlan_sd8987/mlan/mlan_meas.c
rename to wlan_src/mlan/mlan_meas.c
index 5ed4776..fa1135b
--- a/wlan_sd8987/mlan/mlan_meas.c
+++ b/wlan_src/mlan/mlan_meas.c
@@ -14,18 +14,27 @@
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
diff --git a/wlan_src/mlan/mlan_meas.h b/wlan_src/mlan/mlan_meas.h
new file mode 100644
index 0000000..51a3fb9
--- /dev/null
+++ b/wlan_src/mlan/mlan_meas.h
@@ -0,0 +1,64 @@
+/**
+ *  @file mlan_meas.h
+ *
+ *  @brief Interface for the measurement module implemented in mlan_meas.c
+ *
+ *  Driver interface functions and type declarations for the measurement module
+ *    implemented in mlan_meas.c
+ *
+ *  @sa mlan_meas.c
+ *
+ *
+ *  Copyright 2008-2021 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/*************************************************************
+Change Log:
+    03/25/2009: initial version
+************************************************************/
+
+#ifndef _MLAN_MEAS_H_
+#define _MLAN_MEAS_H_
+
+#include "mlan_fw.h"
+
+/* Send a given measurement request to the firmware, report back the result */
+extern int wlan_meas_util_send_req(pmlan_private pmpriv,
+				   pHostCmd_DS_MEASUREMENT_REQUEST pmeas_req,
+				   t_u32 wait_for_resp_timeout,
+				   pmlan_ioctl_req pioctl_req,
+				   pHostCmd_DS_MEASUREMENT_REPORT pmeas_rpt);
+
+/* Setup a measurement command before it is sent to the firmware */
+extern int wlan_meas_cmd_process(mlan_private *pmpriv,
+				 HostCmd_DS_COMMAND *pcmd_ptr,
+				 const t_void *pinfo_buf);
+
+/* Handle a given measurement command response from the firmware */
+extern int wlan_meas_cmdresp_process(mlan_private *pmpriv,
+				     const HostCmd_DS_COMMAND *resp);
+
+#endif /* _MLAN_MEAS_H_ */
diff --git a/wlan_sd8987/mlan/mlan_misc.c b/wlan_src/mlan/mlan_misc.c
old mode 100755
new mode 100644
similarity index 81%
rename from wlan_sd8987/mlan/mlan_misc.c
rename to wlan_src/mlan/mlan_misc.c
index 3ffa5bb..b0f54d9
--- a/wlan_sd8987/mlan/mlan_misc.c
+++ b/wlan_src/mlan/mlan_misc.c
@@ -1,23 +1,32 @@
 /**
  * @file mlan_misc.c
  *
- *  @brief This file include miscellaneous functions for MLAN module
+ *  @brief This file include Miscellaneous functions for MLAN module
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -39,9 +48,6 @@
 #ifdef UAP_SUPPORT
 #include "mlan_uap.h"
 #endif
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-#include "authenticator_api.h"
-#endif
 /********************************************************
 			Local Variables
 ********************************************************/
@@ -49,6 +55,31 @@
 /********************************************************
 			Global Variables
 ********************************************************/
+#if defined(USB8978) || defined(SD8978)
+/** custom Fw data */
+/** Fw remap config */
+t_u8 fw_data_fw_remap_config[FW_DATA_FW_REMAP_CONFIG_LEN] = {
+	0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x00, 0x00,
+	0x00, 0x6A, 0x26, 0x96, 0xB2, 0x44, 0x65, 0x01, 0x04, 0x01, 0x00,
+	0x00, 0x80, 0x00, 0x00, 0x0C, 0xA0, 0xCC, 0x1B, 0x6A, 0x41, 0x04,
+	0x00, 0x0C, 0xA0, 0x02, 0x00, 0x00, 0x00, 0x4A, 0xE7, 0xE5, 0xA3};
+#endif
+
+#if defined(USB8978)
+/** USB endpoint config */
+t_u8 fw_data_usb_bulk_ep[FW_DATA_USB_BULK_EP_LEN] = {
+	0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
+	0x93, 0xCC, 0x0E, 0xB8, 0xFC, 0x83, 0x02, 0xC0, 0x01, 0x00, 0x00, 0x00,
+	0xF8, 0x83, 0x02, 0xC0, 0xCC, 0x1B, 0x6A, 0x41, 0xAC, 0x56, 0xD9, 0xEB};
+#endif
+
+#if defined(USB8978) || defined(SD8978)
+/** DPD curremt optimizations */
+t_u8 fw_data_dpd_current_opt[FW_DATA_DPD_CURRENT_OPT_LEN] = {
+	0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
+	0x93, 0xCC, 0x0E, 0xB8, 0xF8, 0xAF, 0x00, 0xB0, 0xCC, 0x1B, 0x6A, 0x41,
+	0xFC, 0xAF, 0x00, 0xB0, 0x01, 0x00, 0x00, 0x00, 0xF5, 0x1D, 0xBA, 0x80};
+#endif
 
 /********************************************************
 			Local Functions
@@ -303,6 +334,71 @@
 /********************************************************
 			Global Functions
 ********************************************************/
+/**
+ *  @brief Get custom Fw data
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   A pointer to custom Fw data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS --success, otherwise
+ * MLAN_STATUS_FAILURE
+ */
+mlan_status wlan_get_custom_fw_data(pmlan_adapter pmadapter, t_u8 *pdata)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u32 fw_data_param = pmadapter->init_para.fw_data_cfg;
+	t_u32 fw_data_param_num = 0, index = 0, i = 0;
+	fw_data_t *pfw_data_list = MNULL;
+
+	ENTER();
+	MASSERT(pmadapter);
+	if (MNULL == pdata) {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	fw_data_param_num = MIN(MAX_FW_DATA_BLOCK, bitcount(fw_data_param));
+	pfw_data_list = (fw_data_t *)pdata;
+	for (i = 0; i < fw_data_param_num; i++) {
+		/** initilize the Fw data buffers with correct index */
+		while (fw_data_param) {
+			index = fw_data_param & (-fw_data_param);
+			switch (index) {
+#if defined(USB8978) || defined(SD8978)
+			case MBIT(0):
+				pfw_data_list[i].fw_data_buffer =
+					fw_data_fw_remap_config;
+				pfw_data_list[i].fw_data_buffer_len =
+					sizeof(fw_data_fw_remap_config);
+				break;
+#endif
+#if defined(USB8978)
+			case MBIT(1):
+				pfw_data_list[i].fw_data_buffer =
+					fw_data_usb_bulk_ep;
+				pfw_data_list[i].fw_data_buffer_len =
+					sizeof(fw_data_usb_bulk_ep);
+				break;
+#endif
+#if defined(USB8978) || defined(SD8978)
+			case MBIT(2):
+				pfw_data_list[i].fw_data_buffer =
+					fw_data_dpd_current_opt;
+				pfw_data_list[i].fw_data_buffer_len =
+					sizeof(fw_data_dpd_current_opt);
+				break;
+#endif
+			default:
+				break;
+			}
+			fw_data_param ^= index;
+			break;
+		}
+	}
+
+	LEAVE();
+	return ret;
+}
 
 /**
  *  @brief send host cmd
@@ -334,6 +430,35 @@
 }
 
 /**
+ *  @brief send host cmd
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_tx_frame(pmlan_adapter pmadapter,
+				     pmlan_ioctl_req pioctl_req)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *misc = MNULL;
+
+	ENTER();
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_TX_FRAME,
+			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
+			       &misc->param.tx_frame);
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Send function init/shutdown command to firmware
  *
  *  @param pmadapter	A pointer to mlan_adapter structure
@@ -439,13 +564,24 @@
 		debug_info->qos_cfg = pmpriv->wmm_qosinfo;
 		debug_info->tx_lock_flag = pmadapter->tx_lock_flag;
 		debug_info->port_open = pmpriv->port_open;
-		debug_info->bypass_pkt_count = pmadapter->bypass_pkt_count;
+		debug_info->tx_pause = pmpriv->tx_pause;
+		debug_info->bypass_pkt_count =
+			util_scalar_read(pmadapter->pmoal_handle,
+					 &pmadapter->bypass_pkt_count,
+					 pmadapter->callbacks.moal_spin_lock,
+					 pmadapter->callbacks.moal_spin_unlock);
 		debug_info->scan_processing = pmadapter->scan_processing;
 		debug_info->scan_state = pmadapter->scan_state;
 		debug_info->mlan_processing = pmadapter->mlan_processing;
 		debug_info->main_lock_flag = pmadapter->main_lock_flag;
 		debug_info->main_process_cnt = pmadapter->main_process_cnt;
 		debug_info->delay_task_flag = pmadapter->delay_task_flag;
+#ifdef PCIE
+		debug_info->pcie_event_processing =
+			pmadapter->pcie_event_processing;
+		debug_info->pcie_tx_processing = pmadapter->pcie_tx_processing;
+		debug_info->pcie_rx_processing = pmadapter->pcie_rx_processing;
+#endif
 		debug_info->num_cmd_host_to_card_failure =
 			pmadapter->dbg.num_cmd_host_to_card_failure;
 		debug_info->num_cmd_sleep_cfm_host_to_card_failure =
@@ -695,9 +831,12 @@
 	PRINTM(MERROR, "%s: ps_state=%d\n", __FUNCTION__, pmadapter->ps_state);
 	if (pmadapter->ps_state != PS_STATE_AWAKE) {
 		PRINTM_NETINTF(MERROR, pmpriv);
-		PRINTM(MERROR, "Wakeup card timeout!\n");
+		PRINTM(MERROR, "Wakeup card timeout(%d)!\n",
+		       pmadapter->pm_wakeup_timeout);
 		pmadapter->pm_wakeup_timeout++;
-		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_DBG_DUMP, MNULL);
+		pmadapter->pm_wakeup_flag = MTRUE;
+		wlan_recv_event(wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY),
+				MLAN_EVENT_ID_DRV_DEFER_HANDLING, MNULL);
 	}
 	pmadapter->wakeup_fw_timer_is_set = MFALSE;
 
@@ -818,6 +957,40 @@
 }
 
 /**
+ *  @brief Get/Set the firmware wakeup method
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success,
+ * otherwise fail
+ */
+mlan_status wlan_fw_wakeup_method(pmlan_adapter pmadapter,
+				  pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action;
+	mlan_ds_pm_cfg *pmcfg = (mlan_ds_pm_cfg *)pioctl_req->pbuf;
+
+	ENTER();
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else
+		cmd_action = HostCmd_ACT_GEN_GET;
+
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_FW_WAKE_METHOD,
+			       cmd_action, 0, (t_void *)pioctl_req,
+			       &pmcfg->param.fw_wakeup_params);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Set Robustcoex gpiocfg
  *
  *  @param pmadapter	A pointer to mlan_adapter structure
@@ -1031,16 +1204,22 @@
 
 	/* head_room is not implemented for malloc mlan buffer */
 	if (malloc_flag & MOAL_MALLOC_BUFFER) {
-		buf_size = sizeof(mlan_buffer) + data_len + DMA_ALIGNMENT;
+		buf_size =
+			(t_u32)(sizeof(mlan_buffer) + data_len + DMA_ALIGNMENT);
 		if (malloc_flag & MOAL_MEM_FLAG_ATOMIC)
 			mem_flags |= MLAN_MEM_FLAG_ATOMIC;
+		if (malloc_flag & MOAL_MEM_FLAG_DIRTY)
+			mem_flags |= MLAN_MEM_FLAG_DIRTY;
 		ret = pcb->moal_malloc(pmadapter->pmoal_handle, buf_size,
 				       mem_flags, (t_u8 **)&pmbuf);
 		if ((ret != MLAN_STATUS_SUCCESS) || !pmbuf) {
 			pmbuf = MNULL;
 			goto exit;
 		}
-		memset(pmadapter, pmbuf, 0, sizeof(mlan_buffer));
+
+		if (malloc_flag & MOAL_MEM_FLAG_DIRTY)
+			memset(pmadapter, pmbuf, 0x00,
+			       sizeof(*pmbuf) + head_room);
 
 		pmbuf->pdesc = MNULL;
 		/* Align address */
@@ -1205,7 +1384,8 @@
 #if defined(WIFI_DIRECT_SUPPORT)
 	t_u8 bss_mode;
 #endif
-	t_u8 i, global_band = 0;
+	t_u8 i;
+	t_u16 global_band = 0;
 	int j;
 
 	ENTER();
@@ -1265,19 +1445,15 @@
 		}
 
 		if (global_band != pmadapter->config_bands) {
-			if (wlan_set_regiontable(
-				    pmpriv, (t_u8)pmadapter->region_code,
-				    global_band |
-					    pmadapter->adhoc_start_band)) {
+			if (wlan_set_regiontable(pmpriv,
+						 (t_u8)pmadapter->region_code,
+						 global_band)) {
 				pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
 				LEAVE();
 				return MLAN_STATUS_FAILURE;
 			}
 
-			if (wlan_11d_set_universaltable(
-				    pmpriv,
-				    global_band |
-					    pmadapter->adhoc_start_band)) {
+			if (wlan_11d_set_universaltable(pmpriv, global_band)) {
 				pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
 				LEAVE();
 				return MLAN_STATUS_FAILURE;
@@ -1345,6 +1521,14 @@
 		pioctl_req->action = MLAN_ACT_GET;
 		/* Get the IE */
 		cmd_action = HostCmd_ACT_GEN_GET;
+		ie_data = (custom_ie *)(((t_u8 *)&misc->param.cust_ie) +
+					sizeof(MrvlIEtypesHeader_t));
+		index = ie_data->ie_index;
+		if (index >= pmadapter->max_mgmt_ie_index) {
+			PRINTM(MERROR, "Invalid custom IE index %d\n", index);
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
 	} else {
 		/* ioctl_len : ioctl length from application, start with
 		 * misc->param.cust_ie.len and reach upto 0 */
@@ -1602,7 +1786,7 @@
 #ifdef UAP_SUPPORT
 	else if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_UAP) {
 		ret = wlan_prepare_cmd(
-			pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action, 0,
+			pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE, cmd_action, 0,
 			(send_ioctl) ? (t_void *)pioctl_req : MNULL,
 			(send_ioctl) ? MNULL : &misc->param.cust_ie);
 	}
@@ -1641,24 +1825,27 @@
 	switch (reg_mem->param.reg_rw.type) {
 	case MLAN_REG_MAC:
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	case MLAN_REG_MAC2:
 #endif
 		cmd_no = HostCmd_CMD_MAC_REG_ACCESS;
 		break;
 	case MLAN_REG_BBP:
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	case MLAN_REG_BBP2:
 #endif
 		cmd_no = HostCmd_CMD_BBP_REG_ACCESS;
 		break;
 	case MLAN_REG_RF:
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	case MLAN_REG_RF2:
 #endif
 		cmd_no = HostCmd_CMD_RF_REG_ACCESS;
@@ -1671,16 +1858,18 @@
 		break;
 	case MLAN_REG_BCA:
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	case MLAN_REG_BCA2:
 #endif
 		cmd_no = HostCmd_CMD_BCA_REG_ACCESS;
 		break;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097) ||          \
-	defined(SD9177)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097) || defined(SD9177) ||             \
+	defined(SDIW610) || defined(USBIW610)
 	case MLAN_REG_CIU:
 		cmd_no = HostCmd_CMD_REG_ACCESS;
 		break;
@@ -1853,25 +2042,50 @@
 		LEAVE();
 		return MNULL;
 	}
-	memset(priv->adapter, sta_ptr, 0, sizeof(sta_node));
 	memcpy_ext(priv->adapter, sta_ptr->mac_addr, mac, MLAN_MAC_ADDR_LENGTH,
 		   MLAN_MAC_ADDR_LENGTH);
 	util_enqueue_list_tail(priv->adapter->pmoal_handle, &priv->sta_list,
 			       (pmlan_linked_list)sta_ptr,
 			       priv->adapter->callbacks.moal_spin_lock,
 			       priv->adapter->callbacks.moal_spin_unlock);
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-	if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) &&
-	    IsAuthenticatorEnabled(priv->psapriv))
-		authenticator_init_client(priv->psapriv,
-					  &sta_ptr->cm_connectioninfo, mac);
-#endif
 done:
 	LEAVE();
 	return sta_ptr;
 }
 
 /**
+ *  @brief This function deletes iPhone entry from llde device list
+ *
+ *  @param priv    A pointer to mlan_private
+ *  @param mac     iPhone mac address to dekete in llde iPhone device list table
+ *
+ *  @return	   void
+ */
+void wlan_delete_iPhone_entry(mlan_private *priv, t_u8 *mac)
+{
+	t_u8 i = 0;
+
+	/* validate devices which are in llde_iphonefilters list are available
+	 */
+	for (i = 0; i < MAX_IPHONE_FILTER_ENTRIES; i++) {
+		if (memcmp(priv->adapter,
+			   &priv->adapter
+				    ->llde_iphonefilters[i *
+							 MLAN_MAC_ADDR_LENGTH],
+			   mac, MLAN_MAC_ADDR_LENGTH) == 0) {
+			/* remove device as it is not available */
+			// coverity[bad_memset: SUPPRESS]
+			memset(priv->adapter,
+			       (t_u8 *)&priv->adapter->llde_iphonefilters
+				       [i * MLAN_MAC_ADDR_LENGTH],
+			       0, MLAN_MAC_ADDR_LENGTH);
+			priv->adapter->llde_totalIPhones--;
+			break;
+		}
+	}
+}
+
+/**
  *  @brief This function will delete a station entry from station list
  *
  *
@@ -1886,12 +2100,8 @@
 	ENTER();
 	sta_ptr = wlan_get_station_entry(priv, mac);
 	if (sta_ptr) {
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) &&
-		    IsAuthenticatorEnabled(priv->psapriv))
-			authenticator_free_client(priv->psapriv,
-						  sta_ptr->cm_connectioninfo);
-#endif
+		if (sta_ptr->is_apple_sta)
+			wlan_delete_iPhone_entry(priv, mac);
 		util_unlink_list(priv->adapter->pmoal_handle, &priv->sta_list,
 				 (pmlan_linked_list)sta_ptr,
 				 priv->adapter->callbacks.moal_spin_lock,
@@ -1920,12 +2130,6 @@
 			priv->adapter->pmoal_handle, &priv->sta_list,
 			priv->adapter->callbacks.moal_spin_lock,
 			priv->adapter->callbacks.moal_spin_unlock))) {
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) &&
-		    IsAuthenticatorEnabled(priv->psapriv))
-			authenticator_free_client(priv->psapriv,
-						  sta_ptr->cm_connectioninfo);
-#endif
 		priv->adapter->callbacks.moal_mfree(priv->adapter->pmoal_handle,
 						    (t_u8 *)sta_ptr);
 	}
@@ -1945,7 +2149,7 @@
 	tdls_peer_info *peer_info = buf;
 	sta_node *sta_ptr = MNULL;
 	int count = 0;
-	IEEEtypes_Header_t *ieee_hdr;
+
 	ENTER();
 	if (priv->bss_type != MLAN_BSS_TYPE_STA) {
 		LEAVE();
@@ -1976,10 +2180,8 @@
 				   &sta_ptr->vht_cap,
 				   sizeof(IEEEtypes_VHTCap_t),
 				   sizeof(peer_info->vht_cap));
-			ieee_hdr = (IEEEtypes_Header_t *)peer_info->he_cap;
 			memcpy_ext(priv->adapter, peer_info->he_cap,
-				   &sta_ptr->he_cap,
-				   sizeof(IEEEtypes_Header_t) + ieee_hdr->len,
+				   &sta_ptr->he_cap, sizeof(IEEEtypes_HECap_t),
 				   sizeof(peer_info->he_cap));
 			peer_info++;
 			count++;
@@ -2126,8 +2328,6 @@
 		LEAVE();
 		return;
 	}
-	memset(pmadapter, (t_u8 *)tdls_config, 0,
-	       sizeof(mlan_ds_misc_tdls_config));
 	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
 	tdls_all_cfg->u.tdls_config.enable = enable;
 	tdls_config->tdls_action = WLAN_TDLS_CONFIG;
@@ -2170,8 +2370,6 @@
 		LEAVE();
 		return;
 	}
-	memset(pmadapter, (t_u8 *)tdls_config, 0,
-	       sizeof(mlan_ds_misc_tdls_config));
 
 	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
 	tdls_config->tdls_action = WLAN_TDLS_CS_PARAMS;
@@ -2220,8 +2418,6 @@
 		LEAVE();
 		return;
 	}
-	memset(pmadapter, (t_u8 *)tdls_config, 0,
-	       sizeof(mlan_ds_misc_tdls_config));
 
 	if (pioctl_buf) {
 		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
@@ -2965,6 +3161,124 @@
 }
 
 /**
+ *  @brief config rtt
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_config_rtt(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req)
+{
+	pmlan_private pmpriv = MNULL;
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!pioctl_req) {
+		PRINTM(MERROR, "MLAN IOCTL information is not present\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto exit;
+	}
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS,
+			       HostCmd_ACT_GEN_SET, OID_RTT_REQUEST,
+			       (t_void *)pioctl_req, &(misc->param.rtt_params));
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+exit:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief cancel rtt
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_cancel_rtt(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req)
+{
+	pmlan_private pmpriv = MNULL;
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!pioctl_req) {
+		PRINTM(MERROR, "MLAN IOCTL information is not present\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto exit;
+	}
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS,
+			       HostCmd_ACT_GEN_SET, OID_RTT_CANCEL,
+			       (t_void *)pioctl_req, &(misc->param.rtt_cancel));
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+exit:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief rtt responder cfg
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_rtt_responder_cfg(pmlan_adapter pmadapter,
+				   pmlan_ioctl_req pioctl_req)
+{
+	pmlan_private pmpriv = MNULL;
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!pioctl_req) {
+		PRINTM(MERROR, "MLAN IOCTL information is not present\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto exit;
+	}
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_FTM_CONFIG_RESPONDER,
+			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
+			       &(misc->param.rtt_rsp_cfg));
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+exit:
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Get TX/RX histogram statistic
  *
  *  @param pmadapter    A pointer to mlan_adapter structure
@@ -2982,7 +3296,7 @@
 	ENTER();
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_TX_RX_PKT_STATS,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TX_RX_PKT_STATS,
 			       HostCmd_ACT_GEN_GET, 0, (t_void *)pioctl_req,
 			       &(pmisc->param.tx_rx_histogram));
 
@@ -3039,7 +3353,8 @@
 
 	/* Send request to firmware */
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_RX_MGMT_IND,
-			       pioctl_req->action, 0, (t_void *)pioctl_req,
+			       (t_u16)pioctl_req->action, 0,
+			       (t_void *)pioctl_req,
 			       &misc->param.mgmt_subtype_mask);
 
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -3209,11 +3524,18 @@
 		}
 #endif
 		if (priv->bss_role == MLAN_BSS_ROLE_STA) {
+			/* Igone DeAuth/DisAssoc frame from OLD AP during
+			 * Roaming */
 			if (priv->curr_bss_params.host_mlme) {
-				if (memcmp(pmadapter, pieee_pkt_hdr->addr3,
-					   (t_u8 *)priv->curr_bss_params
-						   .bss_descriptor.mac_address,
-					   MLAN_MAC_ADDR_LENGTH)) {
+				if ((memcmp(pmadapter, pieee_pkt_hdr->addr3,
+					    (t_u8 *)priv->curr_bss_params
+						    .bss_descriptor.mac_address,
+					    MLAN_MAC_ADDR_LENGTH)) ||
+				    !priv->assoc_rsp_size ||
+				    !memcmp(pmadapter, pieee_pkt_hdr->addr3,
+					    (t_u8 *)priv->curr_bss_params
+						    .prev_bssid,
+					    MLAN_MAC_ADDR_LENGTH)) {
 					PRINTM(MCMND,
 					       "Dropping Deauth frame from other bssid: type=%d " MACSTR
 					       "\n",
@@ -3224,8 +3546,9 @@
 				}
 				PRINTM_NETINTF(MMSG, priv);
 				PRINTM(MMSG,
-				       "wlan: HostMlme Disconnected: sub_type=%d\n",
-				       sub_type);
+				       "wlan: HostMlme Disconnected: sub_type=%d " MACSTR
+				       "\n",
+				       sub_type, MAC2STR(pieee_pkt_hdr->addr3));
 				pmadapter->pending_disconnect_priv = priv;
 				wlan_recv_event(
 					priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
@@ -3261,7 +3584,8 @@
 			       prx_pd->nf, prx_pd->snr);
 		}
 		if (memcmp(pmadapter, pieee_pkt_hdr->addr1, broadcast,
-			   MLAN_MAC_ADDR_LENGTH))
+			   MLAN_MAC_ADDR_LENGTH) &&
+		    !is_mcast_addr(pieee_pkt_hdr->addr1))
 			unicast = MTRUE;
 		break;
 	default:
@@ -3289,7 +3613,8 @@
 	pevent = (pmlan_event)event_buf;
 	pevent->bss_index = priv->bss_index;
 	mgmt = (IEEE80211_MGMT *)payload;
-	if (!priv->curr_bss_params.host_mlme && sub_type == SUBTYPE_ACTION &&
+	if (priv->bss_role == MLAN_BSS_ROLE_STA &&
+	    !priv->curr_bss_params.host_mlme && sub_type == SUBTYPE_ACTION &&
 	    mgmt->u.ft_resp.category == FT_CATEGORY &&
 	    mgmt->u.ft_resp.action == FT_ACTION_RESPONSE &&
 	    mgmt->u.ft_resp.status_code == 0) {
@@ -3306,7 +3631,8 @@
 			   payload + FT_ACTION_HEAD_LEN,
 			   payload_len - FT_ACTION_HEAD_LEN,
 			   pevent->event_len - MLAN_MAC_ADDR_LENGTH);
-	} else if (!priv->curr_bss_params.host_mlme &&
+	} else if (priv->bss_role == MLAN_BSS_ROLE_STA &&
+		   !priv->curr_bss_params.host_mlme &&
 		   sub_type == SUBTYPE_AUTH &&
 		   mgmt->u.auth.auth_alg == MLAN_AUTH_MODE_FT &&
 		   mgmt->u.auth.auth_transaction == 2 &&
@@ -3341,7 +3667,6 @@
 	return MLAN_STATUS_SUCCESS;
 }
 
-#ifdef STA_SUPPORT
 /**
  *  @brief Extended capabilities configuration
  *
@@ -3402,7 +3727,6 @@
 		return MFALSE;
 	}
 }
-#endif
 
 /**
  *  @brief Set hotspot enable/disable
@@ -3430,8 +3754,65 @@
 	return ret;
 }
 
+/**
+ *  @brief Set multi ap flag
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   A pointer to ioctl request buffer
+ *
+ *  @return             MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_multi_ap_cfg(pmlan_adapter pmadapter,
+				   pmlan_ioctl_req pioctl_req)
+{
+	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (MLAN_ACT_GET == pioctl_req->action)
+		misc->param.multi_ap_flag = pmpriv->multi_ap_flag;
+	else if (MLAN_ACT_SET == pioctl_req->action) {
+		if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_UAP) {
+			ret = wlan_prepare_cmd(pmpriv,
+					       HostCmd_CMD_APCMD_SYS_CONFIGURE,
+					       HostCmd_ACT_GEN_SET, 0,
+					       (t_void *)pioctl_req, MNULL);
+			if (ret == MLAN_STATUS_SUCCESS)
+				ret = MLAN_STATUS_PENDING;
+		}
+		pmpriv->multi_ap_flag = misc->param.multi_ap_flag;
+	}
+
+	LEAVE();
+	return ret;
+}
+
 #ifdef STA_SUPPORT
 /**
+ *  @brief This function check if we should enable beacon protection support
+ *
+ *  @param pbss_desc    A pointer to BSSDescriptor_t structure
+ *
+ *  @return        MTRUE/MFALSE
+ */
+static t_u8 wlan_check_beacon_prot_supported(mlan_private *pmpriv,
+					     BSSDescriptor_t *pbss_desc)
+{
+	if (pbss_desc && pbss_desc->pext_cap) {
+		if (pbss_desc->pext_cap->ieee_hdr.len < 11)
+			return MFALSE;
+		if (!ISSUPP_EXTCAP_EXT_BEACON_PROT(
+			    pbss_desc->pext_cap->ext_cap))
+			return MFALSE;
+	}
+	if (!IS_FW_SUPPORT_BEACON_PROT(pmpriv->adapter))
+		return MFALSE;
+	return MTRUE;
+}
+
+/**
  *  @brief Add Extended Capabilities IE
  *
  *  @param pmpriv             A pointer to mlan_private structure
@@ -3455,10 +3836,18 @@
 		SET_EXTCAP_EXT_CHANNEL_SWITCH(pmpriv->ext_cap);
 	else
 		RESET_EXTCAP_EXT_CHANNEL_SWITCH(pmpriv->ext_cap);
+	if (pmpriv->adapter->pcard_info->support_11mc) {
+		SET_EXTCAP_FTMI(pmpriv->ext_cap);
+		SET_EXTCAP_INTERNETWORKING(pmpriv->ext_cap);
+	}
 	if (pbss_desc && pbss_desc->multi_bssid_ap)
 		SET_EXTCAP_MULTI_BSSID(pmpriv->ext_cap);
 	if (wlan_check_11ax_twt_supported(pmpriv, pbss_desc))
 		SET_EXTCAP_TWT_REQ(pmpriv->ext_cap);
+
+	if (wlan_check_beacon_prot_supported(pmpriv, pbss_desc))
+		SET_EXTCAP_BEACON_PROT(pmpriv->ext_cap);
+
 	memcpy_ext(pmpriv->adapter, &pext_cap->ext_cap, &pmpriv->ext_cap,
 		   sizeof(pmpriv->ext_cap), sizeof(pext_cap->ext_cap));
 	*pptlv_out += sizeof(MrvlIETypes_ExtCap_t);
@@ -3531,6 +3920,217 @@
 #endif
 
 /**
+ *  @brief This function adds iPhone entry into llde device list
+ *
+ *  @param priv    A pointer to mlan_private
+ *  @param mac     iPhone mac address to add in llde iPhone device list table
+ *
+ *  @return	   void
+ */
+void wlan_add_iPhone_entry(mlan_private *priv, t_u8 *mac)
+{
+	t_u8 null_mac_addr[MLAN_MAC_ADDR_LENGTH] = {0};
+	t_u8 t_iphonefilters[MAX_IPHONE_FILTER_ENTRIES * MLAN_MAC_ADDR_LENGTH] =
+		{0};
+	int i = 0, j = 0;
+
+	/* reset count */
+	priv->adapter->llde_totalIPhones = 0;
+
+	if (MAX_IPHONE_FILTER_ENTRIES > 1) {
+		/* back up original list */
+		memcpy_ext(priv->adapter, &t_iphonefilters,
+			   &priv->adapter->llde_iphonefilters,
+			   MAX_IPHONE_FILTER_ENTRIES * MLAN_MAC_ADDR_LENGTH,
+			   MAX_IPHONE_FILTER_ENTRIES * MLAN_MAC_ADDR_LENGTH);
+
+		/* clear original list */
+		// coverity[bad_memset: SUPPRESS]
+		memset(priv->adapter,
+		       (t_u8 *)&priv->adapter->llde_iphonefilters, 0,
+		       MAX_IPHONE_FILTER_ENTRIES * MLAN_MAC_ADDR_LENGTH);
+
+		/* copy valid entries into original list */
+		for (i = 0, j = 1; i < MAX_IPHONE_FILTER_ENTRIES; i++) {
+			if (memcmp(priv->adapter,
+				   &t_iphonefilters[i * MLAN_MAC_ADDR_LENGTH],
+				   &null_mac_addr, MLAN_MAC_ADDR_LENGTH) != 0) {
+				memcpy_ext(
+					priv->adapter,
+					&priv->adapter->llde_iphonefilters
+						 [j++ * MLAN_MAC_ADDR_LENGTH],
+					&t_iphonefilters[i *
+							 MLAN_MAC_ADDR_LENGTH],
+					MLAN_MAC_ADDR_LENGTH,
+					MLAN_MAC_ADDR_LENGTH);
+			}
+		}
+	}
+
+	/* add latest connected device entry at the start of list to get high
+	 * priority while search in list */
+	if (MAX_IPHONE_FILTER_ENTRIES) {
+		memcpy_ext(priv->adapter, &priv->adapter->llde_iphonefilters[0],
+			   mac, MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	}
+
+	/* update connected device count */
+	for (i = 0; i < MAX_IPHONE_FILTER_ENTRIES; i++) {
+		if (memcmp(priv->adapter,
+			   &priv->adapter
+				    ->llde_iphonefilters[i *
+							 MLAN_MAC_ADDR_LENGTH],
+			   &null_mac_addr, MLAN_MAC_ADDR_LENGTH) != 0)
+			priv->adapter->llde_totalIPhones++;
+	}
+
+	return;
+}
+
+/**
+ *  @brief extracts all vendor specific oui's to pass it to fw in add_station
+ * cmd
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param sta_ptr A pointer to sta_node
+ *  @param pbuf     A pointer to IE buffer
+ *  @param buf_len  IE buffer len
+ *
+ *  @return         MTRUE/MFALSE
+ */
+static void wlan_check_sta_vendor_ies(pmlan_adapter pmadapter,
+				      sta_node *sta_ptr, t_u8 *pbuf,
+				      t_u16 buf_len)
+{
+	t_u16 bytes_left = buf_len;
+	IEEEtypes_ElementId_e element_id;
+	t_u8 *pcurrent_ptr = pbuf;
+	t_u8 element_len, oui_pos = 0, index = 0, found_existing_oui = 0;
+	t_u16 total_ie_len;
+	IEEEtypes_VendorSpecific_t *pvendor_ie;
+	const t_u8 apple_oui[VENDOR_OUI_LEN] = {0x00, 0x17, 0xf2, 0x0a};
+
+	ENTER();
+
+	/* Process variable IE */
+	while (bytes_left >= 2) {
+		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
+		element_len = *((t_u8 *)pcurrent_ptr + 1);
+		total_ie_len = element_len + sizeof(IEEEtypes_Header_t);
+
+		if (bytes_left < total_ie_len) {
+			PRINTM(MERROR, "InterpretIE: Error in processing IE, "
+				       "bytes left < IE length\n");
+			bytes_left = 0;
+			continue;
+		}
+		switch (element_id) {
+		case VENDOR_SPECIFIC_221:
+			pvendor_ie = (IEEEtypes_VendorSpecific_t *)pcurrent_ptr;
+			if (!memcmp(pmadapter, pvendor_ie->vend_hdr.oui,
+				    apple_oui, sizeof(apple_oui))) {
+				sta_ptr->is_apple_sta = MTRUE;
+			}
+			found_existing_oui = 0;
+			/* check if oui already present in list */
+			for (index = 0; index < sta_ptr->vendor_oui_count;
+			     index++) {
+				oui_pos = index * VENDOR_OUI_LEN;
+				if (!memcmp(pmadapter, pvendor_ie->vend_hdr.oui,
+					    (t_u8 *)&sta_ptr
+						    ->vendor_oui[oui_pos],
+					    VENDOR_OUI_LEN)) {
+					found_existing_oui = 1;
+					break;
+				}
+			}
+			if ((found_existing_oui == 0) &&
+			    (sta_ptr->vendor_oui_count < MAX_VENDOR_OUI_NUM)) {
+				// add oui in list, sta_ptr->vendor_oui_count
+				// does not exceed MAX_VENDOR_OUI_NUM hence
+				// sta_ptr->vendor_oui buffer size does not
+				// exceed (MAX_VENDOR_OUI_NUM * VENDOR_OUI_LEN)
+				// coverity[overrun-buffer-arg: SUPPRESS]
+				memcpy_ext(pmadapter,
+					   (t_u8 *)&sta_ptr->vendor_oui
+						   [sta_ptr->vendor_oui_count *
+						    VENDOR_OUI_LEN],
+					   pvendor_ie->vend_hdr.oui,
+					   VENDOR_OUI_LEN, VENDOR_OUI_LEN);
+				sta_ptr->vendor_oui_count++;
+			}
+			break;
+		default:
+			break;
+		}
+		pcurrent_ptr += element_len + 2;
+		/* Need to account for IE ID and IE Len */
+		bytes_left -= (element_len + 2);
+	}
+
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function extracts multi-ap IE
+ *
+ *  @param pmadapter        A pointer to mlan_adapter
+ *  @param pbuf             A pointer to IE buffer
+ *  @param buf_len          IE buffer length
+ *  @param multi_ap_ie      A pointer to Vendor IE
+ *
+ *  @return                 MTRUE - if multi-ap ie found, MFALSE - otherwise
+ */
+static t_u8 wlan_get_multi_ap_ie(pmlan_adapter pmadapter, t_u8 *pbuf,
+				 t_u16 buf_len,
+				 IEEEtypes_Generic_t *multi_ap_ie)
+{
+	t_u16 bytes_left = buf_len;
+	IEEEtypes_ElementId_e element_id;
+	t_u8 *pcurrent_ptr = pbuf;
+	t_u8 element_len;
+	t_u16 total_ie_len;
+	IEEEtypes_Generic_t *pvendor_ie;
+	const t_u8 multi_ap_oui[3] = {0x50, 0x6f, 0x9a};
+
+	ENTER();
+
+	/* Process variable IE */
+	while (bytes_left >= 2) {
+		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
+		element_len = *((t_u8 *)pcurrent_ptr + 1);
+		total_ie_len = element_len + sizeof(IEEEtypes_Header_t);
+
+		if (bytes_left < total_ie_len) {
+			PRINTM(MERROR, "InterpretIE: Error in processing IE, "
+				       "bytes left < IE length\n");
+			bytes_left = 0;
+			continue;
+		}
+
+		if (element_id == VENDOR_SPECIFIC_221) {
+			pvendor_ie = (IEEEtypes_Generic_t *)pcurrent_ptr;
+			if (!memcmp(pmadapter, pvendor_ie->data, multi_ap_oui,
+				    sizeof(multi_ap_oui))) {
+				memcpy_ext(pmadapter, multi_ap_ie, pvendor_ie,
+					   pvendor_ie->ieee_hdr.len +
+						   sizeof(IEEEtypes_Header_t),
+					   sizeof(IEEEtypes_Generic_t));
+				return MTRUE;
+			}
+		}
+
+		pcurrent_ptr += element_len + 2;
+		/* Need to account for IE ID and IE Len */
+		bytes_left -= (element_len + 2);
+	}
+
+	LEAVE();
+	return MFALSE;
+}
+
+/**
  *  @brief This function will search for the specific ie
  *
  *  @param priv    A pointer to mlan_private
@@ -3553,6 +4153,7 @@
 	t_u8 *rate = MNULL;
 	t_u8 b_only = MFALSE;
 #endif
+	t_u8 maxIPhoneEntries = MAX_IPHONE_FILTER_ENTRIES;
 
 	int tlv_buf_left = pevent->data_len - ASSOC_EVENT_FIX_SIZE;
 	MrvlIEtypesHeader_t *tlv =
@@ -3611,6 +4212,14 @@
 							       ie_len);
 				PRINTM(MCMND, "STA: is_wmm_enabled=%d\n",
 				       sta_ptr->is_wmm_enabled);
+
+				wlan_check_sta_vendor_ies(priv->adapter,
+							  sta_ptr, assoc_req_ie,
+							  ie_len);
+				if (sta_ptr->is_apple_sta && maxIPhoneEntries) {
+					wlan_add_iPhone_entry(
+						priv, sta_ptr->mac_addr);
+				}
 				pht_cap = (IEEEtypes_HTCap_t *)
 					wlan_get_specific_ie(priv, assoc_req_ie,
 							     ie_len,
@@ -3715,13 +4324,9 @@
 						sta_ptr->bandmode = BAND_G;
 				} else
 					sta_ptr->bandmode = BAND_A;
-#endif
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-				if (IsAuthenticatorEnabled(priv->psapriv))
-					authenticator_get_sta_security_info(
-						priv->psapriv,
-						sta_ptr->cm_connectioninfo,
-						assoc_req_ie, ie_len);
+				sta_ptr->is_multi_ap = wlan_get_multi_ap_ie(
+					priv->adapter, assoc_req_ie, ie_len,
+					&sta_ptr->multi_ap_ie);
 #endif
 				break;
 			}
@@ -3804,7 +4409,7 @@
  *
  *  @return	       ie's poiner or MNULL
  */
-t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u8 ie_len,
+t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u16 ie_len,
 			   IEEEtypes_ElementId_e id, t_u8 ext_id)
 {
 	t_u32 bytes_left = ie_len;
@@ -4001,11 +4606,20 @@
 		/* User input validation */
 		if (IS_STREAM_2X2(pmadapter->feature_control)) {
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
-			if (IS_CARD9098(pmadapter->card_type) ||
-			    IS_CARD9097(pmadapter->card_type) ||
-			    IS_CARDNW62X(pmadapter->card_type)) {
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
+			if (IS_CARDAW693(pmadapter->card_type) &&
+			    ant_cfg->tx_antenna == RF_ANTENNA_AUTO) {
+				PRINTM(MCMND,
+				       "user_htstream=0x%x, tx_antenna=0x%x >rx_antenna=0x%x\n",
+				       pmadapter->user_htstream,
+				       ant_cfg->tx_antenna,
+				       ant_cfg->rx_antenna);
+			} else if (IS_CARD9098(pmadapter->card_type) ||
+				   IS_CARD9097(pmadapter->card_type) ||
+				   IS_CARDAW693(pmadapter->card_type) ||
+				   IS_CARDIW624(pmadapter->card_type)) {
 				ant_cfg->tx_antenna &= 0x0303;
 				ant_cfg->rx_antenna &= 0x0303;
 				/** 2G antcfg TX */
@@ -4049,15 +4663,17 @@
 				ant_cfg->tx_antenna &= 0x0003;
 				ant_cfg->rx_antenna &= 0x0003;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 			}
 #endif
 			if (!ant_cfg->tx_antenna ||
-			    bitcount(ant_cfg->tx_antenna & 0x00FF) >
-				    pmadapter->number_of_antenna ||
-			    bitcount(ant_cfg->tx_antenna & 0xFF00) >
-				    pmadapter->number_of_antenna) {
+			    (ant_cfg->tx_antenna != RF_ANTENNA_AUTO &&
+			     (bitcount(ant_cfg->tx_antenna & 0x00FF) >
+				      pmadapter->number_of_antenna ||
+			      bitcount(ant_cfg->tx_antenna & 0xFF00) >
+				      pmadapter->number_of_antenna))) {
 				PRINTM(MERROR,
 				       "Invalid TX antenna setting: 0x%x\n",
 				       ant_cfg->tx_antenna);
@@ -4066,6 +4682,7 @@
 				ret = MLAN_STATUS_FAILURE;
 				goto exit;
 			}
+
 			if (ant_cfg->rx_antenna) {
 				if (bitcount(ant_cfg->rx_antenna & 0x00FF) >
 					    pmadapter->number_of_antenna ||
@@ -4079,8 +4696,11 @@
 					ret = MLAN_STATUS_FAILURE;
 					goto exit;
 				}
-			} else
-				ant_cfg->rx_antenna = ant_cfg->tx_antenna;
+			} else {
+				if (ant_cfg->tx_antenna != RF_ANTENNA_AUTO)
+					ant_cfg->rx_antenna =
+						ant_cfg->tx_antenna;
+			}
 		} else if (!radio_cfg->param.ant_cfg_1x1.antenna ||
 			   ((radio_cfg->param.ant_cfg_1x1.antenna !=
 			     RF_ANTENNA_AUTO) &&
@@ -4115,6 +4735,129 @@
 }
 
 /**
+ *  @brief Set antenna configuration
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   A pointer to ioctl request buffer
+ *
+ *  @return     MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_handle_antcfg(mlan_private *pmpriv, t_u32 init_antcfg)
+{
+	mlan_ds_ant_cfg ant_cfg;
+	mlan_ds_ant_cfg_1x1 ant_cfg_1x1;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	pmlan_adapter pmadapter = pmpriv->adapter;
+	ENTER();
+
+	memset(pmadapter, &ant_cfg, 0, sizeof(ant_cfg));
+	memset(pmadapter, &ant_cfg_1x1, 0, sizeof(ant_cfg_1x1));
+	if (IS_STREAM_2X2(pmadapter->feature_control)) {
+		if (IS_CARD9098(pmadapter->card_type) ||
+		    IS_CARD9097(pmadapter->card_type) ||
+		    IS_CARDIW624(pmadapter->card_type) ||
+		    IS_CARDAW693(pmadapter->card_type)) {
+			ant_cfg.tx_antenna = ant_cfg.rx_antenna = init_antcfg;
+		} else {
+			ant_cfg.tx_antenna = (init_antcfg & 0x0030) >> 4;
+			ant_cfg.rx_antenna = init_antcfg & 0x0003;
+		}
+	} else
+		ant_cfg_1x1.antenna = init_antcfg;
+
+	/* User input validation */
+	if (IS_STREAM_2X2(pmadapter->feature_control)) {
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
+		if (IS_CARD9098(pmadapter->card_type) ||
+		    IS_CARD9097(pmadapter->card_type) ||
+		    IS_CARDAW693(pmadapter->card_type) ||
+		    IS_CARDIW624(pmadapter->card_type)) {
+			ant_cfg.tx_antenna &= 0x0303;
+			ant_cfg.rx_antenna &= 0x0303;
+			/** 2G antcfg TX */
+			if (ant_cfg.tx_antenna & 0x00FF) {
+				pmadapter->user_htstream &= ~0xF0;
+				pmadapter->user_htstream |=
+					(bitcount(ant_cfg.tx_antenna & 0x00FF)
+					 << 4);
+			}
+			/* 5G antcfg tx */
+			if (ant_cfg.tx_antenna & 0xFF00) {
+				pmadapter->user_htstream &= ~0xF000;
+				pmadapter->user_htstream |=
+					(bitcount(ant_cfg.tx_antenna & 0xFF00)
+					 << 12);
+			}
+			/* 2G antcfg RX */
+			if (ant_cfg.rx_antenna & 0x00FF) {
+				pmadapter->user_htstream &= ~0xF;
+				pmadapter->user_htstream |=
+					bitcount(ant_cfg.rx_antenna & 0x00FF);
+			}
+			/* 5G antcfg RX */
+			if (ant_cfg.rx_antenna & 0xFF00) {
+				pmadapter->user_htstream &= ~0xF00;
+				pmadapter->user_htstream |=
+					(bitcount(ant_cfg.rx_antenna & 0xFF00)
+					 << 8);
+			}
+			PRINTM(MCMND,
+			       "user_htstream=0x%x, tx_antenna=0x%x >rx_antenna=0x%x\n",
+			       pmadapter->user_htstream, ant_cfg.tx_antenna,
+			       ant_cfg.rx_antenna);
+		} else {
+#endif
+			ant_cfg.tx_antenna &= 0x0003;
+			ant_cfg.rx_antenna &= 0x0003;
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
+		}
+#endif
+		if (!ant_cfg.tx_antenna ||
+		    bitcount(ant_cfg.tx_antenna & 0x00FF) >
+			    pmadapter->number_of_antenna ||
+		    bitcount(ant_cfg.tx_antenna & 0xFF00) >
+			    pmadapter->number_of_antenna) {
+			PRINTM(MERROR, "Invalid TX antenna setting: 0x%x\n",
+			       ant_cfg.tx_antenna);
+			goto exit;
+		}
+		if (ant_cfg.rx_antenna) {
+			if (bitcount(ant_cfg.rx_antenna & 0x00FF) >
+				    pmadapter->number_of_antenna ||
+			    bitcount(ant_cfg.rx_antenna & 0xFF00) >
+				    pmadapter->number_of_antenna) {
+				PRINTM(MERROR,
+				       "Invalid RX antenna setting: 0x%x\n",
+				       ant_cfg.rx_antenna);
+				goto exit;
+			}
+		} else
+			ant_cfg.rx_antenna = ant_cfg.tx_antenna;
+	} else if (!ant_cfg_1x1.antenna ||
+		   ((ant_cfg_1x1.antenna != RF_ANTENNA_AUTO) &&
+		    (ant_cfg_1x1.antenna & 0xFFFC))) {
+		PRINTM(MERROR, "Invalid antenna setting\n");
+		goto exit;
+	}
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_RF_ANTENNA,
+			       HostCmd_ACT_GEN_SET, 0, MNULL,
+			       (IS_STREAM_2X2(pmadapter->feature_control)) ?
+				       (t_void *)&ant_cfg :
+				       (t_void *)&ant_cfg_1x1);
+exit:
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Get rate bitmap
  *
  *  @param pmadapter	A pointer to mlan_adapter structure
@@ -4287,11 +5030,7 @@
 	} else {
 		memset(pmadapter, rates, 0, sizeof(rates));
 		wlan_get_active_data_rates(pmpriv, pmpriv->bss_mode,
-					   (pmpriv->bss_mode ==
-					    MLAN_BSS_MODE_INFRA) ?
-						   pmpriv->config_bands :
-						   pmadapter->adhoc_start_band,
-					   rates);
+					   pmpriv->config_bands, rates);
 		rate = rates;
 		for (i = 0; (rate[i] && i < WLAN_SUPPORTED_RATES); i++) {
 			PRINTM(MINFO, "Rate=0x%X  Wanted=0x%X\n", rate[i],
@@ -4497,9 +5236,24 @@
 	       pmpriv->is_data_rate_auto, pmpriv->data_rate);
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TX_RATE_CFG,
-			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
-			       (t_void *)bitmap_rates);
+	if (ds_rate->auto_null_fixrate_enable == 1) {
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TX_RATE_CFG,
+				       HostCmd_ACT_SPC_AUTO_SET, 0,
+				       (t_void *)pioctl_req,
+				       (t_void *)bitmap_rates);
+		ds_rate->auto_null_fixrate_enable = 0xff;
+	} else if (ds_rate->auto_null_fixrate_enable == 0) {
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TX_RATE_CFG,
+				       HostCmd_ACT_SPC_AUTO_NOSET, 0,
+				       (t_void *)pioctl_req,
+				       (t_void *)bitmap_rates);
+		ds_rate->auto_null_fixrate_enable = 0xff;
+	} else
+
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TX_RATE_CFG,
+				       HostCmd_ACT_GEN_SET, 0,
+				       (t_void *)pioctl_req,
+				       (t_void *)bitmap_rates);
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
 
@@ -4609,6 +5363,16 @@
 	else
 		cmd_action = HostCmd_ACT_GEN_GET;
 
+	if (pioctl_req->action == MLAN_ACT_SET) {
+		if (pmpriv->adapter->remain_on_channel &&
+		    !radio_cfg->param.remain_chan.remove) {
+			PRINTM(MCMND, "Ignore New Remain on channe: chan=%d\n",
+			       radio_cfg->param.remain_chan.channel);
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+	}
+
 	/* Send request to firmware */
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_REMAIN_ON_CHANNEL,
 			       cmd_action, 0, (t_void *)pioctl_req,
@@ -4649,7 +5413,7 @@
 		cmd_action = HostCmd_ACT_GEN_GET;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_WIFI_DIRECT_MODE_CONFIG,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_WIFI_DIRECT_MODE_CONFIG,
 			       cmd_action, 0, (t_void *)pioctl_req,
 			       &bss->param.wfd_mode);
 
@@ -4685,8 +5449,8 @@
 		cmd_action = HostCmd_ACT_GEN_GET;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_P2P_PARAMS_CONFIG, cmd_action,
-			       0, (t_void *)pioctl_req,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_P2P_PARAMS_CONFIG,
+			       cmd_action, 0, (t_void *)pioctl_req,
 			       &misc_cfg->param.p2p_config);
 
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -4722,7 +5486,7 @@
 		cmd_action = HostCmd_ACT_GEN_GET;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG,
 			       cmd_action, 0, (t_void *)pioctl_req,
 			       &misc_cfg->param.gpio_tsf_latch_config);
 
@@ -4755,7 +5519,7 @@
 	cmd_action = HostCmd_ACT_GEN_GET;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG,
 			       cmd_action, 0, (t_void *)pioctl_req,
 			       &misc_cfg->param.tsf_info);
 
@@ -4767,6 +5531,88 @@
 }
 
 /**
+ *  @brief Set/Get CROSS CHIP SYNCH config
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_SUCCESS --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_cross_chip_synch(pmlan_adapter pmadapter,
+					     pmlan_ioctl_req pioctl_req)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+	t_u16 cmd_action = 0;
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	ENTER();
+
+	misc_cfg = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else if (pioctl_req->action == MLAN_ACT_GET)
+		cmd_action = HostCmd_ACT_GEN_GET;
+	else {
+		PRINTM(MERROR, "Unsupported cmd_action\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CROSS_CHIP_SYNCH, cmd_action,
+			       0, (t_void *)pioctl_req,
+			       &misc_cfg->param.gpio_tsf_latch_config);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief Set/Get TSP config
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_SUCCESS --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_tsp_config(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+	t_u16 cmd_action = 0;
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	ENTER();
+
+	misc_cfg = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else if (pioctl_req->action == MLAN_ACT_GET)
+		cmd_action = HostCmd_ACT_GEN_GET;
+	else {
+		PRINTM(MERROR, "Unsupported cmd_action\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TSP_CFG, cmd_action, 0,
+			       (t_void *)pioctl_req,
+			       &misc_cfg->param.gpio_tsf_latch_config);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Set coalesce config
  *
  *  @param pmadapter	A pointer to mlan_adapter structure
@@ -5109,8 +5955,9 @@
 	}
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_DFS_REPEATER_MODE, cmd_action, 0,
-			       (t_void *)pioctl_req, &misc->param.dfs_repeater);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_DFS_REPEATER_MODE,
+			       cmd_action, 0, (t_void *)pioctl_req,
+			       &misc->param.dfs_repeater);
 
 done:
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -5140,7 +5987,7 @@
 	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCMD_CONFIG_LOW_POWER_MODE,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CONFIG_LOW_POWER_MODE,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       &misc->param.low_pwr_mode);
 
@@ -5168,7 +6015,7 @@
 	ENTER();
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_PMIC_CONFIGURE,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_PMIC_CONFIGURE,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       MNULL);
 
@@ -5179,41 +6026,6 @@
 	return ret;
 }
 
-/*  @brief Set/Get CW Mode Level control
- *
- *  @param pmadapter    A pointer to mlan_adapter structure
- *  @param pioctl_req   A pointer to ioctl request buffer
- *
- *  @return             MLAN_STATUS_SUCCESS
- */
-mlan_status wlan_misc_ioctl_cwmode_ctrl(pmlan_adapter pmadapter,
-					pmlan_ioctl_req pioctl_req)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_ds_misc_cfg *misc = MNULL;
-	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	t_u16 cmd_action = 0;
-
-	ENTER();
-
-	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
-
-	if (pioctl_req->action == MLAN_ACT_SET)
-		cmd_action = HostCmd_ACT_GEN_SET;
-	else
-		cmd_action = HostCmd_ACT_GEN_GET;
-
-	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CW_MODE_CTRL, cmd_action, 0,
-			       (t_void *)pioctl_req, &misc->param.cwmode);
-
-	if (ret == MLAN_STATUS_SUCCESS)
-		ret = MLAN_STATUS_PENDING;
-
-	LEAVE();
-	return ret;
-}
-
 /**
  *  @brief push value to stack
  *
@@ -5606,7 +6418,6 @@
 	}
 
 	/** Fill the cmd header data*/
-	memset(pmadapter, hostcmd, 0, sizeof(mlan_ds_misc_cmd));
 	buf = hostcmd->cmd;
 	hostcmd_hdr = (HostCmd_DS_GEN *)buf;
 	hostcmd_hdr->command = wlan_cpu_to_le16(HostCmd_CMD_MEF_CFG);
@@ -5698,7 +6509,6 @@
 	/** Fill mef_cfg structure*/
 	mef.criteria = pmef->criteria;
 	mef.entry_num = entry_num;
-	memset(pmadapter, mef.pentry, 0, sizeof(mef_entry_t) * entry_num);
 	pentry = mef.pentry;
 	/** Fill mef_entry_t structure*/
 	/** Copy Auto arp response entry*/
@@ -5783,8 +6593,8 @@
 					    pmadapter))
 					PRINTM(MERROR,
 					       "Set MEF Entries Error\n");
-			} else if (!(mef_cfg->op_code &
-				     MLAN_IPADDR_OP_IP_REMOVE)) {
+			} else if (mef_cfg->op_code ==
+				   MLAN_IPADDR_OP_IP_REMOVE) {
 				pmef->enable_autoarp_entry = 0;
 				pmef->num_wowlan_entry = 0;
 				pmef->num_ipv6_ns_offload = 0;
@@ -5843,24 +6653,6 @@
 	ENTER();
 
 	sec = (mlan_ds_sec_cfg *)pioctl_req->pbuf;
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_STA &&
-	    !IS_FW_SUPPORT_SUPPLICANT(pmpriv->adapter)) {
-		if (sec->param.passphrase.psk_type == MLAN_PSK_QUERY)
-			SupplicantQueryPassphrase(
-				pmpriv->psapriv,
-				(void *)&sec->param.passphrase);
-		else if (sec->param.passphrase.psk_type == MLAN_PSK_CLEAR)
-			SupplicantClearPMK(pmpriv->psapriv,
-					   (void *)&sec->param.passphrase);
-		else
-			SupplicantSetPassphrase(pmpriv->psapriv,
-						(void *)&sec->param.passphrase);
-
-		LEAVE();
-		return ret;
-	}
-#endif
 
 	if (!IS_FW_SUPPORT_SUPPLICANT(pmpriv->adapter)) {
 		LEAVE();
@@ -5988,8 +6780,7 @@
 		pmadapter->cfp_code_bg = misc->param.region_code;
 		pmadapter->cfp_code_a = misc->param.region_code;
 		if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
-					 pmadapter->config_bands |
-						 pmadapter->adhoc_start_band)) {
+					 pmadapter->config_bands)) {
 			pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
 			ret = MLAN_STATUS_FAILURE;
 		}
@@ -6078,26 +6869,73 @@
  *
  *  @return		MLAN_STATUS_PENDING --success, otherwise fail
  */
+mlan_status wlan_misc_region_power_cfg(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	ENTER();
+
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_REGION_POWER_CFG,
+			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
+			       MNULL);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief  Create custom regulatory cfg
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
 mlan_status wlan_misc_chan_reg_cfg(pmlan_adapter pmadapter,
 				   pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u16 cmd_action = 0;
 
 	ENTER();
 
-	if (pioctl_req->action == MLAN_ACT_GET)
+	misc_cfg = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	if (pioctl_req->action == MLAN_ACT_GET) {
 		cmd_action = HostCmd_ACT_GEN_GET;
-	else {
-		PRINTM(MERROR, "No support set channel region cfg!");
-		return MLAN_STATUS_FAILURE;
+		if (misc_cfg &&
+		    misc_cfg->param.custom_reg_domain.region.country_code[0] !=
+			    '\0' &&
+		    misc_cfg->param.custom_reg_domain.region.country_code[1] !=
+			    '\0') {
+			/* Copy the driver country code in the
+			 * custom_reg_domain. The cmd response handler will use
+			 * it to compare with the FW country code
+			 */
+			pmadapter->country_code[0] =
+				misc_cfg->param.custom_reg_domain.region
+					.country_code[0];
+			pmadapter->country_code[1] =
+				misc_cfg->param.custom_reg_domain.region
+					.country_code[1];
+			pmadapter->country_code[2] = '\0';
+		}
+		/* Send 2G/5G/6G CFP table request to the firmware */
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CHAN_REGION_CFG,
+				       cmd_action, 0, (t_void *)pioctl_req,
+				       MNULL);
+	} else {
+		cmd_action = HostCmd_ACT_GEN_SET;
+		/* Send 2G/5G/6G CFP table to the firmware */
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CHAN_REGION_CFG,
+				       cmd_action, 0, (t_void *)pioctl_req,
+				       &misc_cfg->param.chan_attr_cfg);
 	}
-
-	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CHAN_REGION_CFG, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
-
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
 
@@ -6119,6 +6957,7 @@
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_ds_misc_cfg *misc = MNULL;
 	t_u8 channel, oper_class;
+	t_u8 bandwidth;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -6126,9 +6965,11 @@
 	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
 	channel = misc->param.bw_chan_oper.channel;
 	oper_class = misc->param.bw_chan_oper.oper_class;
+	bandwidth = misc->param.bw_chan_oper.bandwidth;
+
 	if (pioctl_req->action == MLAN_ACT_GET) {
 		ret = wlan_check_operclass_validation(pmpriv, channel,
-						      oper_class);
+						      oper_class, bandwidth);
 	} else {
 		PRINTM(MERROR, "Unsupported cmd_action\n");
 		LEAVE();
@@ -6258,7 +7099,7 @@
 		return MLAN_STATUS_FAILURE;
 	pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
-	cmd_action = pioctl_req->action;
+	cmd_action = (t_u16)pioctl_req->action;
 
 	/* Send request to firmware */
 	pmpriv->ch_load_param = 255; /* Default value for identifying
@@ -6296,8 +7137,8 @@
 	cmd_action = HostCmd_ACT_GEN_GET;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CHANNEL_TRPC_CONFIG, cmd_action,
-			       0, (t_void *)pioctl_req,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CHANNEL_TRPC_CONFIG,
+			       cmd_action, 0, (t_void *)pioctl_req,
 			       (t_void *)&misc->param.trpc_cfg);
 
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -6437,6 +7278,41 @@
 }
 
 /**
+ *  @brief config gpio cfg
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   Pointer to the IOCTL request buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+mlan_status wlan_misc_gpiocfg(pmlan_adapter pmadapter,
+			      pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	if (pioctl_req->action == MLAN_ACT_GET)
+		cmd_action = HostCmd_ACT_GEN_GET;
+	else
+		cmd_action = HostCmd_ACT_GEN_SET;
+
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_GPIO_CFG, cmd_action, 0,
+			       (t_void *)pioctl_req, (t_void *)misc);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief config boot sleep
  *
  *  @param pmadapter    A pointer to mlan_adapter structure
@@ -6491,8 +7367,6 @@
 {
 	t_u32 i, global_band = 0;
 	t_u32 infra_band = 0;
-	t_u32 adhoc_band = 0;
-	t_u32 adhoc_channel = 0;
 	mlan_ds_radio_cfg *radio_cfg = MNULL;
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 
@@ -6501,8 +7375,6 @@
 	radio_cfg = (mlan_ds_radio_cfg *)pioctl_req->pbuf;
 	if (pioctl_req->action == MLAN_ACT_SET) {
 		infra_band = radio_cfg->param.band_cfg.config_bands;
-		adhoc_band = radio_cfg->param.band_cfg.adhoc_start_band;
-		adhoc_channel = radio_cfg->param.band_cfg.adhoc_channel;
 
 		/* SET Infra band */
 		if ((infra_band | pmadapter->fw_bands) & ~pmadapter->fw_bands) {
@@ -6511,15 +7383,6 @@
 			return MLAN_STATUS_FAILURE;
 		}
 
-		/* SET Ad-hoc Band */
-		if ((adhoc_band | pmadapter->fw_bands) & ~pmadapter->fw_bands) {
-			pioctl_req->status_code = MLAN_ERROR_INVALID_PARAMETER;
-			LEAVE();
-			return MLAN_STATUS_FAILURE;
-		}
-		if (!adhoc_band)
-			adhoc_band = pmadapter->adhoc_start_band;
-
 		for (i = 0; i < pmadapter->priv_num; i++) {
 			if (pmadapter->priv[i] &&
 			    pmadapter->priv[i] != pmpriv &&
@@ -6531,14 +7394,13 @@
 		global_band |= infra_band;
 
 		if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
-					 global_band | adhoc_band)) {
+					 global_band)) {
 			pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
 			LEAVE();
 			return MLAN_STATUS_FAILURE;
 		}
 #ifdef STA_SUPPORT
-		if (wlan_11d_set_universaltable(pmpriv,
-						global_band | adhoc_band)) {
+		if (wlan_11d_set_universaltable(pmpriv, global_band)) {
 			pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
 			LEAVE();
 			return MLAN_STATUS_FAILURE;
@@ -6547,51 +7409,12 @@
 		pmpriv->config_bands = infra_band;
 		pmadapter->config_bands = global_band;
 
-		pmadapter->adhoc_start_band = adhoc_band;
-		pmpriv->intf_state_11h.adhoc_auto_sel_chan = MFALSE;
-
 #ifdef STA_SUPPORT
-		/*
-		 * If no adhoc_channel is supplied verify if the existing
-		 * adhoc channel compiles with new adhoc_band
-		 */
-		if (!adhoc_channel) {
-			if (!wlan_find_cfp_by_band_and_channel(
-				    pmadapter, pmadapter->adhoc_start_band,
-				    pmpriv->adhoc_channel)) {
-				/* Pass back the default channel */
-				radio_cfg->param.band_cfg.adhoc_channel =
-					DEFAULT_AD_HOC_CHANNEL;
-				if ((pmadapter->adhoc_start_band & BAND_A)) {
-					radio_cfg->param.band_cfg.adhoc_channel =
-						DEFAULT_AD_HOC_CHANNEL_A;
-				}
-			}
-		} else {
-			/* Return error if adhoc_band and adhoc_channel
-			 * combination is invalid
-			 */
-			if (!wlan_find_cfp_by_band_and_channel(
-				    pmadapter, pmadapter->adhoc_start_band,
-				    (t_u16)adhoc_channel)) {
-				pioctl_req->status_code =
-					MLAN_ERROR_INVALID_PARAMETER;
-				LEAVE();
-				return MLAN_STATUS_FAILURE;
-			}
-			pmpriv->adhoc_channel = (t_u8)adhoc_channel;
-		}
-
 #endif
 
 	} else {
 		/* Infra Bands   */
 		radio_cfg->param.band_cfg.config_bands = pmpriv->config_bands;
-		/* Adhoc Band    */
-		radio_cfg->param.band_cfg.adhoc_start_band =
-			pmadapter->adhoc_start_band;
-		/* Adhoc Channel */
-		radio_cfg->param.band_cfg.adhoc_channel = pmpriv->adhoc_channel;
 		/* FW support Bands */
 		radio_cfg->param.band_cfg.fw_bands = pmadapter->fw_bands;
 		PRINTM(MINFO, "Global config band = %d\n",
@@ -6635,6 +7458,38 @@
 	LEAVE();
 	return ret;
 }
+
+/**
+ *  @brief OFDM DESENSE CFG
+ *
+ *  @param pmadapter   A pointer to mlan_adapter structure
+ *  @param pioctl_req  A pointer to ioctl request buffer
+ *
+ *  @return        MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_ofdmdesense_cfg(pmlan_adapter pmadapter,
+					    pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *pmisc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else
+		cmd_action = HostCmd_ACT_GEN_GET;
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_OFDM_DESENSE_CFG, cmd_action,
+			       0, (t_void *)pioctl_req,
+			       &(pmisc->param.ofdm_desense_cfg));
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
 /**
  *  @brief Rx Abort Cfg ext
  *
@@ -6668,6 +7523,71 @@
 }
 
 /**
+ *  @brief nav mitigation parameter
+ *
+ *  @param pmadapter   A pointer to mlan_adapter structure
+ *  @param pioctl_req  A pointer to ioctl request buffer
+ *
+ *  @return        MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_nav_mitigation(pmlan_adapter pmadapter,
+					   pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *pmisc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else
+		cmd_action = HostCmd_ACT_GEN_GET;
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_NAV_MITIGATION_CFG,
+			       cmd_action, 0, (t_void *)pioctl_req,
+			       &(pmisc->param.nav_mitigation));
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief led config parameter
+ *
+ *  @param pmadapter   A pointer to mlan_adapter structure
+ *  @param pioctl_req  A pointer to ioctl request buffer
+ *
+ *  @return        MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_led(pmlan_adapter pmadapter,
+				pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *pmisc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else
+		cmd_action = HostCmd_ACT_GEN_GET;
+
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_LED_CONTROL,
+			       cmd_action, 0, (t_void *)pioctl_req,
+			       &(pmisc->param.led_config));
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Dot11mc unassociated FTM CFG
  *
  *  @param pmadapter   A pointer to mlan_adapter structure
@@ -6954,6 +7874,36 @@
 				       cmd_action, 0, (t_void *)pioctl_req,
 				       &(pmisc->param.mfg_he_power));
 		break;
+
+	case MLAN_OID_MISC_OTP_MAC_RD_WR:
+		if (pioctl_req->action == MLAN_ACT_SET)
+			cmd_action = HostCmd_ACT_GEN_SET;
+		else if (pioctl_req->action == MLAN_ACT_GET)
+			cmd_action = HostCmd_ACT_GEN_GET;
+		else {
+			PRINTM(MERROR, "Unsupported cmd_action\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_MFG_COMMAND,
+				       cmd_action, 0, (t_void *)pioctl_req,
+				       &(pmisc->param.mfg_otp_mac_addr_rd_wr));
+		break;
+
+	case MLAN_OID_MISC_OTP_CAL_DATA_RD_WR:
+		if (pioctl_req->action == MLAN_ACT_SET)
+			cmd_action = HostCmd_ACT_GEN_SET;
+		else if (pioctl_req->action == MLAN_ACT_GET)
+			cmd_action = HostCmd_ACT_GEN_GET;
+		else {
+			PRINTM(MERROR, "Unsupported cmd_action\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_MFG_COMMAND,
+				       cmd_action, 0, (t_void *)pioctl_req,
+				       &(pmisc->param.mfg_otp_cal_data_rd_wr));
+		break;
 	}
 
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -6996,6 +7946,34 @@
 }
 
 /**
+ *   @brief twt_report cmd
+ *   @param pmadapter   A pointer to mlan_adapter structure
+ *   @param pioctl_req  A pointer to ioctl request buffer
+ *
+ *   @return        MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_twt_report(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *pmisc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	cmd_action = HostCmd_ACT_GEN_GET;
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TWT_CFG, cmd_action, 0,
+			       (t_void *)pioctl_req,
+			       &(pmisc->param.twt_report_info));
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Perform warm reset
  *
  *  @param pmadapter	A pointer to mlan_adapter structure
@@ -7039,8 +8017,16 @@
 
 	/* Initialize private structures */
 	for (i = 0; i < pmadapter->priv_num; i++) {
-		if (pmadapter->priv[i])
+		if (pmadapter->priv[i]) {
+			/* Reset to sta role */
+#ifdef WIFI_DIRECT_SUPPORT
+			if (pmadapter->priv[i]->bss_type ==
+			    MLAN_BSS_TYPE_WIFIDIRECT)
+				pmadapter->priv[i]->bss_role =
+					MLAN_BSS_ROLE_STA;
+#endif
 			wlan_init_priv(pmadapter->priv[i]);
+		}
 	}
 	mlan_block_rx_process(pmadapter, MFALSE);
 
@@ -7113,8 +8099,8 @@
 	else
 		cmd_action = HostCmd_ACT_GEN_GET;
 
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action,
-			       0, (t_void *)pioctl_req,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
+			       cmd_action, 0, (t_void *)pioctl_req,
 			       (t_void *)&misc->param.wacp_mode);
 
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -7143,8 +8129,8 @@
 	}
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_DS_GET_SENSOR_TEMP, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_DS_GET_SENSOR_TEMP,
+			       cmd_action, 0, (t_void *)pioctl_req, MNULL);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -7201,8 +8187,7 @@
 		else
 			pmadapter->region_code = 0;
 		if (wlan_set_regiontable(pmpriv, pmadapter->region_code,
-					 pmadapter->config_bands |
-						 pmadapter->adhoc_start_band)) {
+					 pmadapter->config_bands)) {
 			pioctl_req->status_code = MLAN_ERROR_INVALID_PARAMETER;
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
@@ -7221,3 +8206,333 @@
 	LEAVE();
 	return ret;
 }
+
+/**
+ *  @brief get/set rx flush time
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   Pointer to the IOCTL request buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+mlan_status wlan_misc_ioctl_reorder_flush_time(pmlan_adapter pmadapter,
+					       mlan_ioctl_req *pioctl_req)
+{
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	if (pioctl_req->action == MLAN_ACT_SET) {
+		if (misc->param.flush_time.flush_time_ac_be_bk >=
+		    MIN_FLUSH_TIME)
+			pmadapter->flush_time_ac_be_bk =
+				misc->param.flush_time.flush_time_ac_be_bk;
+		if (misc->param.flush_time.flush_time_ac_vi_vo >=
+		    MIN_FLUSH_TIME)
+			pmadapter->flush_time_ac_vi_vo =
+				misc->param.flush_time.flush_time_ac_vi_vo;
+	}
+	misc->param.flush_time.flush_time_ac_be_bk =
+		pmadapter->flush_time_ac_be_bk;
+	misc->param.flush_time.flush_time_ac_vi_vo =
+		pmadapter->flush_time_ac_vi_vo;
+	PRINTM(MCMND, "flush time: BE/BK=%d ms  VI/VO=%d ms\n",
+	       pmadapter->flush_time_ac_be_bk, pmadapter->flush_time_ac_vi_vo);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief configure edmac parameters
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   Pointer to the IOCTL request buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+mlan_status wlan_misc_ioctl_edmac_cfg(pmlan_adapter pmadapter,
+				      pmlan_ioctl_req pioctl_req)
+{
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	ENTER();
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	if (MLAN_ACT_SET == pioctl_req->action) {
+		if (IS_CARD9098(pmadapter->card_type) ||
+		    IS_CARD9097(pmadapter->card_type) ||
+		    IS_CARDAW693(pmadapter->card_type) ||
+		    IS_CARDIW624(pmadapter->card_type) ||
+		    IS_CARDIW610(pmadapter->card_type)) {
+			misc->param.edmac_cfg.ed_ctrl_2g = 0x1;
+			misc->param.edmac_cfg.ed_offset_2g = 0x8;
+			misc->param.edmac_cfg.ed_ctrl_5g = 0x1;
+			misc->param.edmac_cfg.ed_offset_5g = 0x8;
+			misc->param.edmac_cfg.ed_bitmap_txq_lock = 0x1e00FF;
+		} else if (IS_CARD9177(pmadapter->card_type)) {
+			// from config/ed_mac_ctrl_V2_nw61x.conf
+			misc->param.edmac_cfg.ed_ctrl_2g = 0x1;
+			misc->param.edmac_cfg.ed_offset_2g = 0xA;
+			misc->param.edmac_cfg.ed_ctrl_5g = 0x1;
+			misc->param.edmac_cfg.ed_offset_5g = 0xA;
+			misc->param.edmac_cfg.ed_bitmap_txq_lock = 0x1e00FF;
+		} else if (IS_CARD8997(pmadapter->card_type)) {
+			// from config/ed_mac_ctrl_V2_8997.conf
+			misc->param.edmac_cfg.ed_ctrl_2g = 0x1;
+			misc->param.edmac_cfg.ed_offset_2g = 0x0;
+			misc->param.edmac_cfg.ed_ctrl_5g = 0x1;
+			misc->param.edmac_cfg.ed_offset_5g = 0x4;
+			misc->param.edmac_cfg.ed_bitmap_txq_lock = 0xFF;
+		} else if (IS_CARD8978(pmadapter->card_type)) {
+			// from config/ed_mac_ctrl_V2_iw416.conf
+			misc->param.edmac_cfg.ed_ctrl_2g = 0x1;
+			misc->param.edmac_cfg.ed_offset_2g = 0x9;
+			misc->param.edmac_cfg.ed_ctrl_5g = 0x1;
+			misc->param.edmac_cfg.ed_offset_5g = 0xC;
+			misc->param.edmac_cfg.ed_bitmap_txq_lock = 0xFF;
+		} else {
+			PRINTM(MERROR, "Failed to configure edmac param");
+			pioctl_req->status_code = MLAN_ERROR_INVALID_PARAMETER;
+			return MLAN_STATUS_FAILURE;
+		}
+	} else {
+		misc->param.edmac_cfg.ed_ctrl_2g = 0x0;
+		misc->param.edmac_cfg.ed_ctrl_5g = 0x0;
+	}
+
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_EDMAC_CFG,
+			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
+			       (t_void *)&misc->param.edmac_cfg);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief Add 2 variables securely, to prevent overflow.
+ *
+ *  @param datain	Pointer to 1st variable
+ *  @param add		2nd variable value to add to 1st variable
+ *  @param dataout	Pointer to variable where sum is to be stored
+ *  @param type		Datatype of 1st and 2nd variable
+ *
+ *  @return			MTRUE if success or MFALSE if overflow error
+ */
+t_bool wlan_secure_add(t_void *datain, t_s32 add, t_void *dataout,
+		       data_type type)
+{
+	t_bool status = MTRUE;
+
+	switch (type) {
+	case TYPE_SINT8:
+		if (add > SINT8_MAX || *(t_s8 *)datain > SINT8_MAX - add)
+			goto fail;
+		else
+			*(t_s8 *)dataout = *(t_s8 *)datain + add;
+		break;
+
+	case TYPE_UINT8:
+		if (add > UINT8_MAX || *(t_u8 *)datain > UINT8_MAX - add)
+			goto fail;
+		else
+			*(t_u8 *)dataout = *(t_u8 *)datain + add;
+		break;
+
+	case TYPE_SINT16:
+		if (add > SINT16_MAX || *(t_s16 *)datain > SINT16_MAX - add)
+			goto fail;
+		else
+			*(t_s16 *)dataout = *(t_s16 *)datain + add;
+		break;
+
+	case TYPE_UINT16:
+		if (add > UINT16_MAX || *(t_u16 *)datain > UINT16_MAX - add)
+			goto fail;
+		else
+			*(t_u16 *)dataout = *(t_u16 *)datain + add;
+		break;
+
+	case TYPE_SINT32:
+		if (*(t_s32 *)datain > SINT32_MAX - add)
+			goto fail;
+		else
+			*(t_s32 *)dataout = *(t_s32 *)datain + add;
+		break;
+
+	case TYPE_UINT32:
+		if (*(t_u32 *)datain > UINT32_MAX - add)
+			goto fail;
+		else
+			*(t_u32 *)dataout = *(t_u32 *)datain + add;
+		break;
+
+	case TYPE_SINT64:
+		if (*(t_s64 *)datain > SINT64_MAX - add)
+			goto fail;
+		else
+			*(t_s64 *)dataout = *(t_s64 *)datain + add;
+		break;
+
+	case TYPE_UINT64:
+		if (*(t_u64 *)datain > UINT64_MAX - add)
+			goto fail;
+		else
+			*(t_u64 *)dataout = *(t_u64 *)datain + add;
+		break;
+
+	case TYPE_PTR:
+		if (*(t_ptr *)datain > PTR_MAX - add)
+			goto fail;
+		else
+			*(t_ptr *)dataout = *(t_ptr *)datain + add;
+		break;
+
+	default:
+		status = MFALSE;
+		break;
+	}
+ret:
+	return status;
+
+fail:
+	status = MFALSE;
+	goto ret;
+}
+
+/**
+ *  @brief Subtract 2 variables securely, to prevent underflow.
+ *
+ *  @param datain	Pointer to 1st variable
+ *  @param add		2nd variable value to subtract from 1st variable
+ *  @param dataout	Pointer to variable where diff is to be stored
+ *  @param type		Datatype of 1st and 2nd variable
+ *
+ *  @return			MTRUE if success or MFALSE if underflow error
+ */
+t_bool wlan_secure_sub(t_void *datain, t_s32 sub, t_void *dataout,
+		       data_type type)
+{
+	t_u8 status = MTRUE;
+
+	switch (type) {
+	case TYPE_SINT8:
+		if (*(t_s8 *)datain >= (t_s8)SINT8_MIN + sub)
+			*(t_s8 *)dataout = *(t_s8 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT8:
+		if (*(t_u8 *)datain >= sub)
+			*(t_u8 *)dataout = *(t_u8 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_SINT16:
+		if (*(t_s16 *)datain >= (t_s16)SINT16_MIN + sub)
+			*(t_s16 *)dataout = *(t_s16 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT16:
+		if (*(t_u16 *)datain >= sub)
+			*(t_u16 *)dataout = *(t_u16 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_SINT32:
+		if (*(t_s32 *)datain >= (t_s32)SINT32_MIN + sub)
+			*(t_s32 *)dataout = *(t_s32 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT32:
+		if (*(t_u32 *)datain >= sub)
+			*(t_u32 *)dataout = *(t_u32 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_SINT64:
+		if (*(t_s64 *)datain >= (t_s64)SINT64_MIN + sub)
+			*(t_s64 *)dataout = *(t_s64 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT64:
+		if (*(t_u64 *)datain >= sub)
+			*(t_u64 *)dataout = *(t_u64 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_PTR:
+		if (*(t_ptr *)datain >= sub)
+			*(t_ptr *)dataout = *(t_ptr *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	default:
+		status = MFALSE;
+		break;
+	}
+ret:
+	return status;
+
+fail:
+	status = MFALSE;
+	goto ret;
+}
+
+/**
+ *  @brief Prints verbose msg of 6G chan_switch block event for the reason_code
+ *
+ *  @param reason_code       Reason code contained in event body
+ *
+ *  @return                  N/A
+ */
+void print_chan_switch_block_event(t_u16 reason_code)
+{
+	ENTER();
+	switch (reason_code) {
+	case BLOCK_6G_CHAN_SWITCH_REASON_STA_RX_ECSA:
+		PRINTM(MEVENT,
+		       "EVENT: Mobile-AP does not support HE-Cap/WPA3"
+		       " to switch to 6Ghz, leading to RX ECSA Failure of STA\n");
+		break;
+	case BLOCK_6G_CHAN_SWITCH_REASON_MMH_STA:
+		PRINTM(MEVENT,
+		       "EVENT: Mobile-AP does not support HE-Cap/WPA3"
+		       " to switch to 6Ghz, leading to 6Ghz Assoc Failure of STA\n");
+		break;
+	case BLOCK_6G_CHAN_SWITCH_REASON_STA_MMH:
+		PRINTM(MEVENT,
+		       "EVENT: Mobile-AP does not support HE-Cap/WPA3"
+		       " to switch to 6Ghz channel same as STA, leading to bss start failure");
+		break;
+	case BLOCK_6G_CHAN_SWITCH_REASON_MMH:
+		PRINTM(MEVENT,
+		       "EVENT: Mobile-AP does not support HE-Cap/WPA3"
+		       " to switch to 6Ghz channel, leading to chan_switch failure");
+		break;
+	default:
+		break;
+	}
+	LEAVE();
+	return;
+}
diff --git a/wlan_src/mlan/mlan_module.c b/wlan_src/mlan/mlan_module.c
new file mode 100644
index 0000000..d4f8ea9
--- /dev/null
+++ b/wlan_src/mlan/mlan_module.c
@@ -0,0 +1,79 @@
+/** @file mlan_module.c
+ *
+ *  @brief This file declares the exported symbols from MLAN.
+ *
+ *
+ *  Copyright 2008-2021 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/******************************************************
+Change log:
+    12/08/2008: initial version
+******************************************************/
+
+#ifdef LINUX
+#include <linux/module.h>
+#include "mlan_decl.h"
+#include "mlan_ioctl.h"
+#ifdef PCIE
+EXPORT_SYMBOL(mlan_process_pcie_interrupt_cb);
+#endif
+EXPORT_SYMBOL(mlan_register);
+EXPORT_SYMBOL(mlan_unregister);
+EXPORT_SYMBOL(mlan_init_fw);
+EXPORT_SYMBOL(mlan_set_init_param);
+EXPORT_SYMBOL(mlan_dnld_fw);
+EXPORT_SYMBOL(mlan_shutdown_fw);
+#ifdef USB
+EXPORT_SYMBOL(mlan_write_data_async_complete);
+EXPORT_SYMBOL(mlan_recv);
+#endif
+EXPORT_SYMBOL(mlan_send_packet);
+EXPORT_SYMBOL(mlan_ioctl);
+EXPORT_SYMBOL(mlan_main_process);
+EXPORT_SYMBOL(mlan_rx_process);
+EXPORT_SYMBOL(mlan_select_wmm_queue);
+EXPORT_SYMBOL(mlan_process_deaggr_pkt);
+#if defined(SDIO) || defined(PCIE)
+EXPORT_SYMBOL(mlan_interrupt);
+#if defined(SYSKT)
+EXPORT_SYMBOL(mlan_hs_callback);
+#endif /* SYSKT_MULTI || SYSKT */
+#endif /* SDIO || PCIE */
+
+EXPORT_SYMBOL(mlan_pm_wakeup_card);
+EXPORT_SYMBOL(mlan_is_main_process_running);
+#ifdef PCIE
+EXPORT_SYMBOL(mlan_set_int_mode);
+#endif
+EXPORT_SYMBOL(mlan_disable_host_int);
+EXPORT_SYMBOL(mlan_enable_host_int);
+
+MODULE_DESCRIPTION("M-WLAN MLAN Driver");
+MODULE_AUTHOR("NXP");
+MODULE_VERSION(MLAN_RELEASE_VERSION);
+MODULE_LICENSE("GPL");
+#endif /* LINUX */
diff --git a/wlan_sd8987/mlan/mlan_pcie.c b/wlan_src/mlan/mlan_pcie.c
old mode 100755
new mode 100644
similarity index 76%
rename from wlan_sd8987/mlan/mlan_pcie.c
rename to wlan_src/mlan/mlan_pcie.c
index 297bb6e..418247c
--- a/wlan_sd8987/mlan/mlan_pcie.c
+++ b/wlan_src/mlan/mlan_pcie.c
@@ -3,20 +3,29 @@
  *  @brief This file contains PCI-E specific code
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -76,6 +85,7 @@
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 0,
 };
 #endif
 
@@ -103,6 +113,7 @@
 	.host_intr_upld_rdy = HOST_INTR_UPLD_RDY,
 	.host_intr_cmd_done = HOST_INTR_CMD_DONE,
 	.host_intr_event_rdy = HOST_INTR_EVENT_RDY,
+	.host_intr_cmd_dnld = HOST_INTR_CMD_DNLD,
 	.txrx_rw_ptr_mask = 0x00000FFF,
 	.txrx_rw_ptr_wrap_mask = 0x00001FFF,
 	.txrx_rw_ptr_rollover_ind = MBIT(12),
@@ -115,10 +126,47 @@
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
-#if defined(PCIE9097) || defined(PCIENW62X)
+#ifdef PCIEAW693
+static const struct _mlan_pcie_card_reg mlan_reg_pcieaw693 = {
+	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
+	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
+	.reg_rxbd_rdptr = PCIE9098_RXBD_RDPTR,
+	.reg_rxbd_wrptr = PCIE9098_RXBD_WRPTR,
+	.reg_evtbd_rdptr = PCIE9098_EVTBD_RDPTR,
+	.reg_evtbd_wrptr = PCIE9098_EVTBD_WRPTR,
+	.reg_host_int_mask = PCIE9097_B0_HOST_INT_MASK,
+	.reg_host_int_status_mask = PCIE9097_B0_HOST_INT_STATUS_MASK,
+	.reg_host_int_status = PCIE9097_B0_HOST_INT_STATUS,
+	.reg_host_int_clr_sel = PCIE9097_B0_HOST_INT_CLR_SEL,
+	.reg_cpu_int_event = PCIE9098_CPU_INT_EVENT,
+	.reg_ip_rev = PCIE9098_DEV_ID_REG,
+	.reg_drv_ready = PCIE9098_DRV_READY,
+	.reg_cpu_int_status = PCIE9098_CPU_INT_STATUS,
+	.reg_rev_id = PCIE9098_REV_ID_REG,
+	.reg_scratch_0 = PCIE9098_SCRATCH_0_REG,
+	.reg_scratch_1 = PCIE9098_SCRATCH_1_REG,
+	.reg_scratch_2 = PCIE9098_SCRATCH_2_REG,
+	.reg_scratch_3 = PCIE9098_SCRATCH_3_REG,
+	.reg_scratch_6 = PCIE9098_SCRATCH_6_REG,
+	.reg_scratch_7 = PCIE9098_SCRATCH_7_REG,
+	.host_intr_mask = PCIE9098_HOST_INTR_MASK,
+	.host_intr_dnld_done = PCIE9098_HOST_INTR_DNLD_DONE,
+	.host_intr_upld_rdy = PCIE9098_HOST_INTR_UPLD_RDY,
+	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
+	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
+	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.adma_align_size = ADMA_ALIGN_SIZE_1,
+	.adma_min_pkt_size = ADMA_MIN_PKT_SIZE_32,
+	.use_adma = MTRUE,
+	.msi_int_wr_clr = MTRUE,
+};
+#endif
+
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEIW624)
 static const struct _mlan_pcie_card_reg mlan_reg_pcie9097_b0 = {
 	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
 	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
@@ -147,12 +195,14 @@
 	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
 	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
 	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.adma_align_size = ADMA_ALIGN_SIZE,
+	.adma_min_pkt_size = ADMA_MIN_PKT_SIZE,
 	.use_adma = MTRUE,
 	.msi_int_wr_clr = MTRUE,
 };
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEIW624)
 static const struct _mlan_pcie_card_reg mlan_reg_pcie9098 = {
 	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
 	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
@@ -181,16 +231,22 @@
 	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
 	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
 	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.adma_align_size = ADMA_ALIGN_SIZE,
+	.adma_min_pkt_size = ADMA_MIN_PKT_SIZE,
 	.use_adma = MTRUE,
 	.msi_int_wr_clr = MTRUE,
 };
+#endif
 
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 static const struct _mlan_card_info mlan_card_info_pcie9098 = {
 	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
 	.v16_fw_api = 1,
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 /********************************************************
@@ -204,7 +260,134 @@
 static mlan_status wlan_pcie_delete_evtbd_ring(pmlan_adapter pmadapter);
 static mlan_status wlan_pcie_delete_rxbd_ring(pmlan_adapter pmadapter);
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
+/**
+ *  @brief This function program dma_cfg/dma_cfg2/dma_cfg3 registers
+ *
+ *  @param pmadapter  A pointer to mlan_adapter structure
+ *  @param q_addr     adma queue address
+ *  @param direction  adma direction (ADMA_DEVICE_TO_HOST/ADMA_HOST_TO_DEVICE)
+ *  @param dma_mode   dma mode (DMA_MODE_DUAL_DESC/DMA_MODE_DIRECT)
+ *  @param size       desc num/dma_size
+ *  @param init       init flag
+ *
+ *  @return 	      MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_init_dma_cfg_registers(mlan_adapter *pmadapter,
+					       t_u32 q_addr, t_u8 direction,
+					       t_u8 dma_mode, t_u16 size,
+					       t_u8 init)
+{
+	t_u32 dma_cfg, dma_cfg2 = 0;
+	t_u32 dma_cfg3 = 0;
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+	if (init) {
+		/* Read the dma_cfg2 register */
+		if (pcb->moal_read_reg(pmadapter->pmoal_handle,
+				       q_addr + ADMA_DMA_CFG2, &dma_cfg2)) {
+			PRINTM(MERROR, "Fail to read DMA CFG2 register\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+		dma_cfg2 &= ~(ADMA_SRC_DMA_DONE_INT_BYPASS_EN |
+			      ADMA_DST_DMA_DONE_INT_BYPASS_EN |
+			      ADMA_MSI_LEGACY_SRC_DMA_DONE_INT_BYPASS_EN |
+			      ADMA_MSI_LEGACY_DST_DMA_DONE_INT_BYPASS_EN |
+			      ADMA_MSI_LEGACY_ENABLE | ADMA_MSIX_ENABLE |
+			      ADMA_MSIX_INT_SRC_DST_SEL);
+
+		if (dma_mode == DMA_MODE_DUAL_DESC) {
+			if (direction == ADMA_HOST_TO_DEVICE) {
+				dma_cfg2 |= ADMA_SRC_DMA_DONE_INT_BYPASS_EN;
+				dma_cfg2 |=
+					ADMA_MSI_LEGACY_SRC_DMA_DONE_INT_BYPASS_EN;
+			} else {
+				/* Read the dma_cfg3 register */
+				if (pcb->moal_read_reg(pmadapter->pmoal_handle,
+						       q_addr + ADMA_DMA_CFG3,
+						       &dma_cfg3)) {
+					PRINTM(MERROR,
+					       "Fail to read DMA CFG3 register\n");
+					ret = MLAN_STATUS_FAILURE;
+					goto done;
+				}
+				dma_cfg3 |= ADMA_Q_PTR_CLR;
+				if (pcb->moal_write_reg(pmadapter->pmoal_handle,
+							q_addr + ADMA_DMA_CFG3,
+							(t_u32)dma_cfg3)) {
+					PRINTM(MERROR,
+					       "Failed to write ADMA_DMA_CFG3.\n");
+					ret = MLAN_STATUS_FAILURE;
+				}
+				dma_cfg2 |= ADMA_DST_DMA_DONE_INT_BYPASS_EN;
+				dma_cfg2 |=
+					ADMA_MSI_LEGACY_DST_DMA_DONE_INT_BYPASS_EN;
+			}
+		} else {
+			if (direction == ADMA_HOST_TO_DEVICE)
+				dma_cfg2 |= ADMA_SRC_ADDR_IS_HOST;
+			else
+				dma_cfg2 |= ADMA_DST_ADDR_IS_HOST;
+		}
+		dma_cfg2 |= ADMA_MSI_LEGACY_ENABLE;
+		PRINTM(MCMND, "dma_cfg2=0x%x\n", dma_cfg2);
+
+		/* enable INT_BYPASS_EN in the dma_cfg2 register */
+		if (pcb->moal_write_reg(pmadapter->pmoal_handle,
+					q_addr + ADMA_DMA_CFG2,
+					(t_u32)dma_cfg2)) {
+			PRINTM(MERROR, "Failed to write DMA CFG2.\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+	}
+	/* Read the TX ring read pointer set by firmware */
+	if (pcb->moal_read_reg(pmadapter->pmoal_handle, q_addr + ADMA_DMA_CFG,
+			       &dma_cfg)) {
+		PRINTM(MERROR, "Fail to read DMA CFG register\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	if (direction == ADMA_HOST_TO_DEVICE) {
+		if (dma_mode == DMA_MODE_DUAL_DESC) {
+			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
+				     SRC_NUM_DESC_MASK | DMA_SIZE_MASK);
+			dma_cfg |= (t_u32)size << SRC_NUM_DESC_BIT;
+			dma_cfg |= DESC_MODE_RING << 2;
+		} else {
+			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
+				     SRC_NUM_DESC_MASK | DST_NUM_DESC_MASK |
+				     DMA_SIZE_MASK);
+			dma_cfg |= (t_u32)size << DMA_SIZE_BIT;
+		}
+	} else {
+		if (dma_mode == DMA_MODE_DUAL_DESC) {
+			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
+				     DST_NUM_DESC_MASK | DMA_SIZE_MASK);
+			dma_cfg |= (t_u32)size << DST_NUM_DESC_BIT;
+			dma_cfg |= DESC_MODE_RING << 2;
+		} else {
+			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
+				     SRC_NUM_DESC_MASK | DST_NUM_DESC_MASK);
+		}
+	}
+	dma_cfg |= (t_u32)dma_mode;
+	PRINTM(MINFO, "dma_cfg=0x%x\n", dma_cfg);
+	if (pcb->moal_write_reg(pmadapter->pmoal_handle, q_addr + ADMA_DMA_CFG,
+				dma_cfg)) {
+		PRINTM(MERROR, "Fail to set DMA CFG register\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+done:
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief This function init the adma setting
  *
@@ -219,13 +402,11 @@
 static mlan_status wlan_init_adma(mlan_adapter *pmadapter, t_u8 type,
 				  t_u64 pbase, t_u16 size, t_u8 init)
 {
-	t_u32 dma_cfg, dma_cfg2, dma_cfg3, int_mapping;
+	t_u32 int_mapping;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 q_addr = 0;
 	t_u8 direction = 0;
 	t_u8 dma_mode = 0;
-	t_u32 msix_data;
-	t_u32 msix_vector;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	ENTER();
 	if (init)
@@ -236,31 +417,26 @@
 		q_addr = ADMA_CHAN0_Q0;
 		direction = ADMA_HOST_TO_DEVICE;
 		dma_mode = DMA_MODE_DUAL_DESC;
-		msix_vector = ADMA_VECTOR_CHAN0_Q0;
 		break;
 	case ADMA_RX_DATA:
 		q_addr = ADMA_CHAN1_Q0;
 		direction = ADMA_DEVICE_TO_HOST;
 		dma_mode = DMA_MODE_DUAL_DESC;
-		msix_vector = AMDA_VECTOR_CHAN1_Q0;
 		break;
 	case ADMA_EVENT:
 		q_addr = ADMA_CHAN1_Q1;
 		direction = ADMA_DEVICE_TO_HOST;
 		dma_mode = DMA_MODE_DUAL_DESC;
-		msix_vector = AMDA_VECTOR_CHAN1_Q1;
 		break;
 	case ADMA_CMD:
 		q_addr = ADMA_CHAN2_Q0;
 		direction = ADMA_HOST_TO_DEVICE;
 		dma_mode = DMA_MODE_DIRECT;
-		msix_vector = AMDA_VECTOR_CHAN2_Q0;
 		break;
 	case ADMA_CMDRESP:
 		q_addr = ADMA_CHAN2_Q1;
 		direction = ADMA_DEVICE_TO_HOST;
 		dma_mode = DMA_MODE_DIRECT;
-		msix_vector = AMDA_VECTOR_CHAN2_Q1;
 		break;
 	default:
 		PRINTM(MERROR, "unknow adma type\n");
@@ -287,107 +463,8 @@
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
-
-		/* Read the dma_cfg2 register */
-		if (pcb->moal_read_reg(pmadapter->pmoal_handle,
-				       q_addr + ADMA_DMA_CFG2, &dma_cfg2)) {
-			PRINTM(MERROR, "Fail to read DMA CFG2 register\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-		dma_cfg2 &= ~(ADMA_SRC_DMA_DONE_INT_BYPASS_EN |
-			      ADMA_DST_DMA_DONE_INT_BYPASS_EN |
-			      ADMA_MSI_LEGACY_SRC_DMA_DONE_INT_BYPASS_EN |
-			      ADMA_MSI_LEGACY_DST_DMA_DONE_INT_BYPASS_EN |
-			      ADMA_MSI_LEGACY_ENABLE | ADMA_MSIX_ENABLE |
-			      ADMA_MSIX_INT_SRC_DST_SEL);
-
-		if (dma_mode == DMA_MODE_DUAL_DESC) {
-			if (direction == ADMA_HOST_TO_DEVICE) {
-				dma_cfg2 |= ADMA_SRC_DMA_DONE_INT_BYPASS_EN;
-				if (pmadapter->pcard_pcie->pcie_int_mode !=
-				    PCIE_INT_MODE_MSIX)
-					dma_cfg2 |=
-						ADMA_MSI_LEGACY_SRC_DMA_DONE_INT_BYPASS_EN;
-			} else {
-				/* Read the dma_cfg3 register */
-				if (pcb->moal_read_reg(pmadapter->pmoal_handle,
-						       q_addr + ADMA_DMA_CFG3,
-						       &dma_cfg3)) {
-					PRINTM(MERROR,
-					       "Fail to read DMA CFG3 register\n");
-					ret = MLAN_STATUS_FAILURE;
-					goto done;
-				}
-				dma_cfg3 |= ADMA_Q_PTR_CLR;
-				if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-							q_addr + ADMA_DMA_CFG3,
-							(t_u32)dma_cfg3)) {
-					PRINTM(MERROR,
-					       "Failed to write ADMA_DMA_CFG3.\n");
-					ret = MLAN_STATUS_FAILURE;
-					goto done;
-				}
-
-				dma_cfg2 |= ADMA_DST_DMA_DONE_INT_BYPASS_EN;
-				if (pmadapter->pcard_pcie->pcie_int_mode !=
-				    PCIE_INT_MODE_MSIX)
-					dma_cfg2 |=
-						ADMA_MSI_LEGACY_DST_DMA_DONE_INT_BYPASS_EN;
-			}
-		} else {
-			if (direction == ADMA_HOST_TO_DEVICE)
-				dma_cfg2 |= ADMA_SRC_ADDR_IS_HOST;
-			else
-				dma_cfg2 |= ADMA_DST_ADDR_IS_HOST;
-		}
-
-		if (pmadapter->pcard_pcie->pcie_int_mode ==
-		    PCIE_INT_MODE_MSIX) {
-			if (pcb->moal_read_reg(pmadapter->pmoal_handle,
-					       q_addr + ADMA_MSIX_DOORBELL_DATA,
-					       &msix_data)) {
-				PRINTM(MERROR,
-				       "Fail to read DMA MSIX data register\n");
-				ret = MLAN_STATUS_FAILURE;
-				goto done;
-			}
-			msix_data &= ~ADMA_MSIX_VECTOR_MASK;
-			msix_data &= ~ADMA_MSIX_PF_MASK;
-			msix_data |= msix_vector;
-			msix_data |= pmadapter->pcard_pcie->func_num
-				     << ADMA_MSIX_PF_BIT;
-			PRINTM(MCMND, "msix_data=0x%x\n", msix_data);
-			if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-						q_addr +
-							ADMA_MSIX_DOORBELL_DATA,
-						(t_u32)msix_data)) {
-				PRINTM(MERROR,
-				       "Failed to write DMA DOORBELL_DATA.\n");
-				ret = MLAN_STATUS_FAILURE;
-				goto done;
-			}
-			dma_cfg2 |= ADMA_MSIX_ENABLE;
-		} else
-			dma_cfg2 |= ADMA_MSI_LEGACY_ENABLE;
-		PRINTM(MCMND, "dma_cfg2=0x%x\n", dma_cfg2);
-
-		/* enable INT_BYPASS_EN in the dma_cfg2 register */
-		if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-					q_addr + ADMA_DMA_CFG2,
-					(t_u32)dma_cfg2)) {
-			PRINTM(MERROR, "Failed to write DMA CFG2.\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
 	}
-	/* Read the TX ring read pointer set by firmware */
-	if (pcb->moal_read_reg(pmadapter->pmoal_handle, q_addr + ADMA_DMA_CFG,
-			       &dma_cfg)) {
-		PRINTM(MERROR, "Fail to read DMA CFG register\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
+
 	if (direction == ADMA_HOST_TO_DEVICE) {
 		/* Write the lower 32bits of the physical address to
 		 * ADMA_SRC_LOW */
@@ -426,17 +503,6 @@
 				goto done;
 			}
 		}
-		if (dma_mode == DMA_MODE_DUAL_DESC) {
-			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
-				     SRC_NUM_DESC_MASK | DMA_SIZE_MASK);
-			dma_cfg |= (t_u32)size << SRC_NUM_DESC_BIT;
-			dma_cfg |= DESC_MODE_RING << 2;
-		} else {
-			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
-				     SRC_NUM_DESC_MASK | DST_NUM_DESC_MASK |
-				     DMA_SIZE_MASK);
-			dma_cfg |= (t_u32)size << DMA_SIZE_BIT;
-		}
 	} else {
 		/* Write the lower 32bits of the physical address to
 		 * ADMA_DST_LOW */
@@ -475,23 +541,19 @@
 				goto done;
 			}
 		}
-		if (dma_mode == DMA_MODE_DUAL_DESC) {
-			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
-				     DST_NUM_DESC_MASK | DMA_SIZE_MASK);
-			dma_cfg |= (t_u32)size << DST_NUM_DESC_BIT;
-			dma_cfg |= DESC_MODE_RING << 2;
-		} else {
-			dma_cfg &= ~(DESC_MODE_MASK | DMA_MODE_MASK |
-				     SRC_NUM_DESC_MASK | DST_NUM_DESC_MASK);
+	}
+	if (!IS_PCIEIW624(pmadapter->card_type) &&
+	    !(IS_PCIEAW693(pmadapter->card_type) &&
+	      (pmadapter->card_rev > CHIP_AW693_REV_A0))) {
+		if (wlan_init_dma_cfg_registers(pmadapter, q_addr, direction,
+						dma_mode, size, init)) {
+			PRINTM(MERROR,
+			       "Failed to configure dma_cfg registers\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
 		}
 	}
-	dma_cfg |= (t_u32)dma_mode;
-	if (pcb->moal_write_reg(pmadapter->pmoal_handle, q_addr + ADMA_DMA_CFG,
-				dma_cfg)) {
-		PRINTM(MERROR, "Fail to set DMA CFG register\n");
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
+
 	if (type == ADMA_CMD && !init) {
 		/* Write 1 to src_wr_ptr to trigger direct dma */
 		if (pcb->moal_write_reg(pmadapter->pmoal_handle,
@@ -542,7 +604,172 @@
 
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
+#if defined(PCIEAW693)
+/**
+ *  @brief This function get max msdu count
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *
+ *  @return          max msdu count
+ */
+static t_u32 wlan_pcie_get_max_msdu_cnt(mlan_adapter *pmadapter)
+{
+	t_u32 ring_size = 0;
+	const t_u32 num_tx_buffers = pmadapter->pcard_pcie->txrx_bd_size;
+	const t_u32 num_pending = pmadapter->pcard_pcie->txbd_pending;
+
+	ENTER();
+#ifdef PCIEAW693
+	if (!IS_PCIEAW693(pmadapter->card_type))
+		return 0;
+#endif
+
+	if (num_tx_buffers > num_pending)
+		ring_size = num_tx_buffers - num_pending;
+
+	LEAVE();
+	return ring_size;
+}
+#endif
+
+#if defined(PCIEAW693)
+/**
+ *  @brief This function return the index of desc with EOP flag.
+ *
+ *  @param pmadapter     A pointer to mlan_adapter structure
+ *  @param num_tx_buffs  Ring size
+ *  @param index         index in Tx ring
+ *  @param wrindx        Current write index in TX ring
+ *
+ *  @return              index in Tx ring with EOP flag
+ */
+static t_u32 wlan_get_adma_desc_with_eop(mlan_pcie_card *pcard,
+					 t_u32 num_tx_buffs, t_u32 index,
+					 t_u32 wrindx)
+{
+	for (; index != wrindx; index = (index + 1) & (num_tx_buffs - 1)) {
+		adma_dual_desc_buf *desc = pcard->txbd_ring[index];
+		if (desc->flags & ADMA_BD_FLAG_EOP)
+			return index;
+	}
+
+	return wrindx;
+}
+
+/**
+ *  @brief This function enables tx_done interrupt in pending descriptor if
+ * needed.
+ *
+ *  @param pmadapter     A pointer to mlan_adapter structure
+ *  @param num_tx_buffs  Ring size
+ *  @param wrindx        Current write index in TX ring
+ *
+ *  @return              N/A
+ */
+static void wlan_get_adma_buf_flag_sliding(mlan_adapter *pmadapter,
+					   t_u32 num_tx_buffs, t_u32 wrindx)
+{
+	const t_u32 txbd_pending_threshold = num_tx_buffs / 4;
+	const t_u32 invalid_index = 0xffffffff;
+	mlan_pcie_card *pcard = pmadapter->pcard_pcie;
+	t_u32 last_write_index_with_irq = invalid_index;
+	const t_u32 mid =
+		(wrindx - pcard->txbd_pending / 2) & (num_tx_buffs - 1);
+	const t_u32 mid_idx =
+		wlan_get_adma_desc_with_eop(pcard, num_tx_buffs, mid, wrindx);
+
+	if (mid_idx != wrindx && pcard->txbd_pending > txbd_pending_threshold &&
+	    pcard->last_write_index_with_irq != mid_idx) {
+		adma_dual_desc_buf *desc = pcard->txbd_ring[mid_idx];
+
+		desc->flags |= wlan_cpu_to_le16(ADMA_BD_FLAG_INT_EN);
+		last_write_index_with_irq = mid_idx;
+	}
+
+	if (last_write_index_with_irq != invalid_index) {
+		if (pcard->last_write_index_with_irq != invalid_index &&
+		    pcard->last_write_index_with_irq != mid_idx) {
+			adma_dual_desc_buf *desc =
+				pcard->txbd_ring
+					[pcard->last_write_index_with_irq];
+
+			desc->flags &= ~wlan_cpu_to_le16(ADMA_BD_FLAG_INT_EN);
+		}
+
+		pcard->last_write_index_with_irq = last_write_index_with_irq;
+	}
+}
+#endif
+
+/**
+ *  @brief This function enables tx_done interrupt in pending descriptor if
+ * needed.
+ *
+ *  @param pmadapter     A pointer to mlan_adapter structure
+ *  @param num_tx_buffs  Ring size
+ *  @param wrindx        Current write index in TX ring
+ *
+ *  @return              N/A
+ */
+static t_u16 wlan_get_adma_buf_flag(mlan_adapter *pmadapter, t_u32 num_tx_buffs,
+				    t_u32 wrindx)
+{
+	mlan_pcie_card *pcard = pmadapter->pcard_pcie;
+	t_u16 flags = 0;
+	/* enable DMA transfer done interrupt when ring is full so we don't need
+	 * to wait when it became empty */
+	const t_u32 txbd_pending_threshold = num_tx_buffs - 1;
+	const t_bool need_int_en =
+		pcard->txbd_pending >= txbd_pending_threshold;
+
+	if (need_int_en) {
+		const t_u32 distance = num_tx_buffs / 2;
+		t_u32 past_wrindx = (wrindx - distance) & (num_tx_buffs - 1);
+		const t_u32 distance_to_last =
+			(past_wrindx - pcard->last_write_index_with_irq) &
+			(num_tx_buffs - 1);
+
+		if (pcard->last_write_index_with_irq == 0xffffffff ||
+		    distance_to_last >= distance) {
+			flags = ADMA_BD_FLAG_INT_EN;
+			pcard->last_write_index_with_irq = past_wrindx;
+		}
+	}
+
+	if (pcard->last_write_index_with_irq == wrindx) {
+		/* we are going to overwrite descriptor where we set interrupt,
+		 * need to invalidate */
+		pcard->last_write_index_with_irq = 0xffffffff;
+	}
+	return flags;
+}
+
+/**
+ *  @brief This function set the host interrupt select mask
+ *
+ *  @param pmadapter  A pointer to mlan_adapter structure
+ *
+ *
+ *  @return 	      MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_pcie_set_host_int_select_reg(mlan_adapter *pmadapter,
+						     t_u32 int_sel_mask)
+{
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+	ENTER();
+	/* Simply write the mask to the register */
+	if (pcb->moal_write_reg(pmadapter->pmoal_handle, PCIE9098_HOST_INT_SEL,
+				int_sel_mask)) {
+		PRINTM(MWARN, "Set host interrupt select register failed\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function set the host interrupt select mask
  *
@@ -590,7 +817,105 @@
 }
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+/**
+ *  @brief This function downloads boot command to the card.
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pmbuf        A pointer to mlan_buffer
+ *  @param mapping      mapping flag
+ *
+ *  @return 	        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_pcie_send_boot_cmd(mlan_adapter *pmadapter,
+					   mlan_buffer *pmbuf, t_u8 mapping)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+
+	ENTER();
+
+	if (!pmadapter || !pmbuf) {
+		PRINTM(MERROR, "NULL Pointer\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	if (mapping) {
+		if (MLAN_STATUS_FAILURE ==
+		    pcb->moal_map_memory(pmadapter->pmoal_handle,
+					 pmbuf->pbuf + pmbuf->data_offset,
+					 &pmbuf->buf_pa, WLAN_UPLD_SIZE,
+					 PCI_DMA_TODEVICE)) {
+			PRINTM(MERROR, "BootCmd: failed to moal_map_memory\n");
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+	}
+
+	if (!(pmbuf->pbuf && pmbuf->data_len && pmbuf->buf_pa)) {
+		PRINTM(MERROR, "%s: Invalid buffer <%p, %#x:%x, len=%d>\n",
+		       __func__, pmbuf->pbuf,
+		       (t_u32)((t_u64)pmbuf->buf_pa >> 32),
+		       (t_u32)pmbuf->buf_pa, pmbuf->data_len);
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Write the lower 32bits of the physical address to scratch
+	 * register 0 */
+	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
+				pmadapter->pcard_pcie->reg->reg_scratch_0,
+				(t_u32)pmbuf->buf_pa)) {
+		PRINTM(MERROR,
+		       "Failed to write download command to boot code\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Write the upper 32bits of the physical address to scratch
+	 * register 1 */
+	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
+				pmadapter->pcard_pcie->reg->reg_scratch_1,
+				(t_u32)((t_u64)pmbuf->buf_pa >> 32))) {
+		PRINTM(MERROR,
+		       "Failed to write download command to boot code\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	/* Write the command length to scratch register 2 */
+	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
+				pmadapter->pcard_pcie->reg->reg_scratch_2,
+				pmbuf->data_len)) {
+		PRINTM(MERROR,
+		       "Failed to write command length to scratch register 2\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Ring the door bell */
+	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
+				pmadapter->pcard_pcie->reg->reg_cpu_int_event,
+				CPU_INTR_DOOR_BELL)) {
+		PRINTM(MERROR, "Failed to assert door-bell interrupt\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	LEAVE();
+	return ret;
+
+done:
+	if (MLAN_STATUS_FAILURE ==
+	    pcb->moal_unmap_memory(
+		    pmadapter->pmoal_handle, pmbuf->pbuf + pmbuf->data_offset,
+		    pmbuf->buf_pa, WLAN_UPLD_SIZE, PCI_DMA_TODEVICE))
+		PRINTM(MERROR, "BootCmd: failed to moal_unmap_memory\n");
+	LEAVE();
+	return ret;
+}
+
+#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
+	defined(PCIEAW693) || defined(PCIEIW624)
 /**
  *  @brief This function handles command response completion
  *
@@ -653,10 +978,37 @@
 		goto done;
 	}
 	pmadapter->pcard_pcie->vdll_cmd_buf = pmbuf;
+
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	/* issue the DMA */
-	/* send the VDLL block down to the firmware */
-	wlan_init_adma(pmadapter, ADMA_CMD, pmbuf->buf_pa, pmbuf->data_len,
-		       MFALSE);
+	if (pmadapter->pcard_pcie->reg->use_adma) {
+		if (IS_PCIEIW624(pmadapter->card_type) ||
+		    (IS_PCIEAW693(pmadapter->card_type) &&
+		     (pmadapter->card_rev > CHIP_AW693_REV_A0))) {
+			if (wlan_pcie_send_boot_cmd(pmadapter, pmbuf, MFALSE)) {
+				PRINTM(MERROR,
+				       "Failed to send vdll block to device\n");
+				ret = MLAN_STATUS_FAILURE;
+				goto done;
+			}
+		} else {
+			/* send the VDLL block down to the firmware */
+			wlan_init_adma(pmadapter, ADMA_CMD, pmbuf->buf_pa,
+				       pmbuf->data_len, MFALSE);
+		}
+	}
+#endif
+
+#ifdef PCIE8997
+	if (!pmadapter->pcard_pcie->reg->use_adma) {
+		if (wlan_pcie_send_boot_cmd(pmadapter, pmbuf, MFALSE)) {
+			PRINTM(MERROR, "Failed to send vdll block to device\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+	}
+#endif
 
 	PRINTM(MINFO, "PCIE - Download VDLL Block: successful.\n");
 done:
@@ -761,9 +1113,11 @@
 		LEAVE();
 		return ret;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
-	    (pmadapter->card_type == CARD_TYPE_PCIENW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEIW624) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type == CARD_TYPE_PCIE9097)) {
 		ret = wlan_pcie_set_host_int_select_mask(pmadapter, MFALSE);
 		if (ret) {
@@ -793,8 +1147,6 @@
 
 	ENTER();
 
-	if (pmadapter->pcard_pcie->pcie_int_mode == PCIE_INT_MODE_MSIX)
-		goto done;
 	if (pcb->moal_read_reg(pmadapter->pmoal_handle,
 			       pmadapter->pcard_pcie->reg->reg_host_int_status,
 			       &pcie_ireg)) {
@@ -839,9 +1191,11 @@
 		LEAVE();
 		return ret;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
-	    (pmadapter->card_type == CARD_TYPE_PCIENW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEIW624) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type == CARD_TYPE_PCIE9097)) {
 		ret = wlan_pcie_set_host_int_select_mask(pmadapter, MTRUE);
 		if (ret) {
@@ -870,7 +1224,8 @@
 #if defined(PCIE8997) || defined(PCIE8897)
 	pmlan_pcie_data_buf ptx_bd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	padma_dual_desc_buf padma_bd_buf;
 #endif
 
@@ -892,7 +1247,8 @@
 			pmadapter->pcard_pcie->txrx_bd_size;
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		pmadapter->pcard_pcie->txbd_ring_size =
 			sizeof(adma_dual_desc_buf) *
@@ -923,7 +1279,8 @@
 
 	for (i = 0; i < pmadapter->pcard_pcie->txrx_bd_size; i++) {
 		pmadapter->pcard_pcie->tx_buf_list[i] = MNULL;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf
@@ -978,7 +1335,8 @@
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_data_buf *ptx_bd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
 
@@ -1012,7 +1370,8 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)
@@ -1064,7 +1423,8 @@
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_data_buf *prxbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
 
@@ -1088,7 +1448,8 @@
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	/*
 	 * driver maintaines the write pointer and firmware maintaines the read
 	 * pointer. The read pointer starts at 0 (zero) while the write pointer
@@ -1180,7 +1541,8 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf
@@ -1190,8 +1552,7 @@
 			pmadapter->pcard_pcie->rxbd_ring[i] =
 				(t_void *)padma_bd_buf;
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(pmbuf->data_len);
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
 			padma_bd_buf->pkt_size = 0;
@@ -1219,7 +1580,8 @@
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_data_buf *prxbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
 
@@ -1237,6 +1599,7 @@
 				pmadapter->pcard_pcie->rx_buf_list[i]);
 		}
 		pmadapter->pcard_pcie->rx_buf_list[i] = MNULL;
+
 #if defined(PCIE8997) || defined(PCIE8897)
 		if (!pmadapter->pcard_pcie->reg->use_adma) {
 			prxbd_buf = (mlan_pcie_data_buf *)
@@ -1250,7 +1613,8 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)
@@ -1301,7 +1665,8 @@
 	pmlan_pcie_evt_buf pevtbd_buf;
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
 
@@ -1320,7 +1685,8 @@
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		pmadapter->pcard_pcie->evtbd_wrptr = MLAN_MAX_EVT_BD;
 		pmadapter->pcard_pcie->evtbd_ring_size =
@@ -1392,7 +1758,8 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf
@@ -1402,8 +1769,7 @@
 			pmadapter->pcard_pcie->evtbd_ring[i] =
 				(t_void *)padma_bd_buf;
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(pmbuf->data_len);
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
 			padma_bd_buf->pkt_size = 0;
@@ -1431,7 +1797,8 @@
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_evt_buf *pevtbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
 
@@ -1447,6 +1814,7 @@
 		}
 
 		pmadapter->pcard_pcie->evt_buf_list[i] = MNULL;
+
 #if defined(PCIE8997) || defined(PCIE8897)
 		if (!pmadapter->pcard_pcie->reg->use_adma) {
 			pevtbd_buf =
@@ -1461,7 +1829,8 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)
@@ -1509,7 +1878,7 @@
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	/** Virtual base address of command response */
-	t_u8 *cmdrsp_vbase;
+	t_u8 *cmdrsp_vbase = MNULL;
 	/** Physical base address of command response */
 	t_u64 cmdrsp_pbase = 0;
 
@@ -1542,6 +1911,7 @@
 	pmbuf->data_len = MRVDRV_SIZE_OF_CMD_BUFFER;
 	pmbuf->total_pcie_buf_len = MRVDRV_SIZE_OF_CMD_BUFFER;
 	pmadapter->pcard_pcie->cmdrsp_buf = pmbuf;
+
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
@@ -1658,7 +2028,8 @@
 			return MFALSE;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		if ((pmadapter->pcard_pcie->txbd_rdptr &
 		     ADMA_RW_PTR_WRAP_MASK) != (rdptr & ADMA_RW_PTR_WRAP_MASK))
@@ -1684,7 +2055,7 @@
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	mlan_buffer *pmbuf;
 	t_u32 wrdoneidx;
-	t_u32 rdptr;
+	t_u32 rdptr = 0;
 	t_u32 unmap_count = 0;
 #if defined(PCIE8997) || defined(PCIE8897)
 	t_u32 txrx_rw_ptr_mask = pmadapter->pcard_pcie->reg->txrx_rw_ptr_mask;
@@ -1692,13 +2063,18 @@
 		pmadapter->pcard_pcie->reg->txrx_rw_ptr_rollover_ind;
 	mlan_pcie_data_buf *ptx_bd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 	t_u32 wrptr;
 #endif
 
 	ENTER();
 
+	if (!wlan_is_tx_pending(pmadapter)) {
+		LEAVE();
+		return ret;
+	}
 	/* Read the TX ring read pointer set by firmware */
 	if (pcb->moal_read_reg(pmadapter->pmoal_handle,
 			       pmadapter->pcard_pcie->reg->reg_txbd_rdptr,
@@ -1716,12 +2092,13 @@
 		rdptr = rdptr >> TXBD_RW_PTR_START;
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		wrptr = rdptr & 0xffff;
 		rdptr = rdptr >> ADMA_RPTR_START;
 		if (wrptr != pmadapter->pcard_pcie->txbd_wrptr)
-			PRINTM(MERROR, "wlan: Unexpected wrptr 0x%x 0x%x\n",
+			PRINTM(MINFO, "wlan: Unexpected wrptr 0x%x 0x%x\n",
 			       wrptr, pmadapter->pcard_pcie->txbd_wrptr);
 	}
 #endif
@@ -1746,7 +2123,6 @@
 				break;
 			}
 			unmap_count++;
-			pmadapter->pcard_pcie->txbd_pending--;
 #if defined(PCIE8997) || defined(PCIE8897)
 			if (pmadapter->pcard_pcie->txbd_flush)
 				wlan_write_data_complete(pmadapter, pmbuf,
@@ -1776,7 +2152,8 @@
 					 txrx_rw_ptr_rollover_ind);
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)pmadapter->pcard_pcie
@@ -1793,8 +2170,6 @@
 #endif
 	}
 
-	if (unmap_count)
-		pmadapter->data_sent = MFALSE;
 #if defined(PCIE8997) || defined(PCIE8897)
 	if (pmadapter->pcard_pcie->txbd_flush) {
 		if (PCIE_TXBD_EMPTY(pmadapter->pcard_pcie->txbd_wrptr,
@@ -1806,17 +2181,74 @@
 	}
 #endif
 done:
+	pcb->moal_spin_lock(pmadapter->pmoal_handle,
+			    pmadapter->pmlan_pcie_lock);
+	pmadapter->pcard_pcie->txbd_pending -= unmap_count;
+	if (unmap_count) {
+#ifdef PCIEAW693
+		if (IS_PCIEAW693(pmadapter->card_type) &&
+		    (wlan_pcie_get_max_msdu_cnt(pmadapter) < 2))
+			pmadapter->data_sent = MTRUE;
+		else
+#endif
+			pmadapter->data_sent = MFALSE;
+	}
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_pcie_lock);
+
 	LEAVE();
 	return ret;
 }
 
+/**
+ *  @brief This function process pcie tx_complete
+ *
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             N/A
+ */
+static void wlan_pcie_process_tx_complete(mlan_adapter *pmadapter)
+{
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+	ENTER();
+	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->pmlan_tx_lock);
+	if (pmadapter->pcie_tx_processing) {
+		pmadapter->more_tx_task_flag = MTRUE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_tx_lock);
+		goto exit_tx_proc;
+	} else {
+		pmadapter->pcie_tx_processing = MTRUE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_tx_lock);
+	}
+tx_process_start:
+	wlan_pcie_send_data_complete(pmadapter);
+
+	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->pmlan_tx_lock);
+	if (pmadapter->more_tx_task_flag) {
+		pmadapter->more_tx_task_flag = MFALSE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_tx_lock);
+		goto tx_process_start;
+	}
+	pmadapter->pcie_tx_processing = MFALSE;
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_tx_lock);
+exit_tx_proc:
+	LEAVE();
+	return;
+}
+
 #if defined(PCIE8997) || defined(PCIE8897)
 #define PCIE_TXBD_NOT_FULL(wrptr, rdptr, mask, rollover_ind)                   \
 	(((wrptr & mask) != (rdptr & mask)) ||                                 \
 	 ((wrptr & rollover_ind) == (rdptr & rollover_ind)))
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 #define ADMA_TXBD_IS_FULL(wrptr, rdptr, mask, rollover_ind)                    \
 	(((wrptr & mask) == (rdptr & mask)) &&                                 \
 	 ((wrptr & rollover_ind) != (rdptr & rollover_ind)))
@@ -1840,7 +2272,8 @@
 			return MFALSE;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		txrx_rw_ptr_mask = pmadapter->pcard_pcie->txrx_bd_size - 1;
 		txrx_rw_ptr_rollover_ind = pmadapter->pcard_pcie->txrx_bd_size;
@@ -1856,6 +2289,194 @@
 	return MFALSE;
 }
 
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
+#if defined(PCIEAW693)
+/**
+ *  @brief This function downloads data to the card.
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *
+ *  @param pmbuf     A pointer to mlan_buffer (pmbuf->data_len should include
+ * PCIE header)
+ *  @param flag      A pointer to mlan_tx_param
+ *
+ *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_pcie_send_adma_data(mlan_adapter *pmadapter,
+					    mlan_buffer *pmbuf, t_u16 flags,
+					    t_u16 pkt_size)
+{
+	t_u32 reg_txbd_wrptr = pmadapter->pcard_pcie->reg->reg_txbd_wrptr;
+	adma_dual_desc_buf *padma_bd_buf = MNULL;
+	const t_u32 num_tx_buffs = pmadapter->pcard_pcie->txrx_bd_size;
+	mlan_status ret = MLAN_STATUS_PENDING;
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+	t_u32 rxbd_val = 0;
+	t_u32 wrindx;
+	t_u32 wr_ptr_start = 0;
+
+	ENTER();
+
+	if (!pmbuf) {
+		PRINTM(MERROR, "%s() has no buffer", __FUNCTION__);
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	if (!(pmbuf->pbuf && pmbuf->data_len)) {
+		PRINTM(MERROR, "Invalid parameter <%p, %#x>\n", pmbuf->pbuf,
+		       pmbuf->data_len);
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	PRINTM(MDATA,
+	       "wlan_pcie_send_adma_data: len=%d flags=0x%x, pkt_size=%d\n",
+	       pmbuf->data_len, flags, pkt_size);
+	PRINTM(MINFO, "SEND DATA: <Rd: %#x, Wr: %#x>\n",
+	       pmadapter->pcard_pcie->txbd_rdptr,
+	       pmadapter->pcard_pcie->txbd_wrptr);
+
+	if (wlan_check_txbd_not_full(pmadapter)) {
+		pmadapter->data_sent = MTRUE;
+
+		/* Map pmbuf, and attach to tx ring */
+		if (MLAN_STATUS_FAILURE ==
+		    pcb->moal_map_memory(pmadapter->pmoal_handle,
+					 pmbuf->pbuf + pmbuf->data_offset,
+					 &pmbuf->buf_pa, pmbuf->data_len,
+					 PCI_DMA_TODEVICE)) {
+			PRINTM(MERROR,
+			       "SEND DATA: failed to moal_map_memory\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+		wrindx = pmadapter->pcard_pcie->txbd_wrptr & (num_tx_buffs - 1);
+		PRINTM(MDAT_D,
+		       "SEND DATA: Attach pmbuf %p at tx_ring[%d], txbd_wrptr=0x%x\n",
+		       pmbuf, wrindx, pmadapter->pcard_pcie->txbd_wrptr);
+		pcb->moal_spin_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_pcie_lock);
+		pmadapter->pcard_pcie->tx_buf_list[wrindx] = pmbuf;
+		pmadapter->pcard_pcie->txbd_pending++;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_pcie_lock);
+
+		wr_ptr_start = ADMA_WPTR_START;
+		padma_bd_buf = (adma_dual_desc_buf *)
+				       pmadapter->pcard_pcie->txbd_ring[wrindx];
+		padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
+		padma_bd_buf->len =
+			ALIGN_SZ(pmbuf->data_len,
+				 pmadapter->pcard_pcie->reg->adma_align_size);
+		if (padma_bd_buf->len <
+		    pmadapter->pcard_pcie->reg->adma_min_pkt_size)
+			padma_bd_buf->len =
+				pmadapter->pcard_pcie->reg->adma_min_pkt_size;
+
+		padma_bd_buf->flags = ADMA_BD_FLAG_SRC_HOST;
+		if (flags & ADMA_BD_FLAG_SOP) {
+			padma_bd_buf->flags |= ADMA_BD_FLAG_SOP;
+			padma_bd_buf->pkt_size = pkt_size;
+		} else {
+			padma_bd_buf->pkt_size = padma_bd_buf->len;
+		}
+		if (flags & ADMA_BD_FLAG_EOP) {
+			wlan_get_adma_buf_flag_sliding(pmadapter, num_tx_buffs,
+						       wrindx);
+			padma_bd_buf->flags |= ADMA_BD_FLAG_EOP;
+		}
+		padma_bd_buf->flags = wlan_cpu_to_le16(padma_bd_buf->flags);
+		padma_bd_buf->len = wlan_cpu_to_le16(padma_bd_buf->len);
+		padma_bd_buf->pkt_size =
+			wlan_cpu_to_le16(padma_bd_buf->pkt_size);
+		pmadapter->pcard_pcie->last_tx_pkt_size[wrindx] =
+			pmbuf->data_len;
+		pmadapter->pcard_pcie->txbd_wrptr++;
+		pmadapter->pcard_pcie->txbd_wrptr &= ADMA_RW_PTR_WRAP_MASK;
+		DBG_HEXDUMP(MDAT_D, "adma_bd_buf", padma_bd_buf,
+			    sizeof(adma_dual_desc_buf));
+		if (flags & ADMA_BD_FLAG_EOP) {
+			PRINTM(MINFO, "REG_TXBD_WRPT(0x%x) = 0x%x\n",
+			       reg_txbd_wrptr,
+			       ((pmadapter->pcard_pcie->txbd_wrptr
+				 << wr_ptr_start) |
+				rxbd_val));
+			/* Write the TX ring write pointer in to REG_TXBD_WRPTR
+			 */
+			if (pcb->moal_write_reg(
+				    pmadapter->pmoal_handle, reg_txbd_wrptr,
+				    (pmadapter->pcard_pcie->txbd_wrptr
+				     << wr_ptr_start) |
+					    rxbd_val)) {
+				PRINTM(MERROR,
+				       "SEND DATA: failed to write REG_TXBD_WRPTR\n");
+				ret = MLAN_STATUS_FAILURE;
+				goto done_unmap;
+			}
+		}
+		PRINTM(MINFO, "SEND DATA: Updated <Rd: %#x, Wr: %#x>\n",
+		       pmadapter->pcard_pcie->txbd_rdptr,
+		       pmadapter->pcard_pcie->txbd_wrptr);
+
+		if (wlan_check_txbd_not_full(pmadapter)) {
+#ifdef PCIEAW693
+			if (IS_PCIEAW693(pmadapter->card_type) &&
+			    (wlan_pcie_get_max_msdu_cnt(pmadapter) < 2)) {
+				pmadapter->data_sent = MTRUE;
+				wlan_pcie_process_tx_complete(pmadapter);
+			} else
+#endif
+				pmadapter->data_sent = MFALSE;
+		} else
+			wlan_pcie_process_tx_complete(pmadapter);
+		if (pmadapter->data_sent)
+			pmadapter->data_sent_cnt++;
+
+		PRINTM(MINFO, "Sent packet to firmware successfully\n");
+	} else {
+		PRINTM(MERROR,
+		       "TX Ring full, can't send anymore packets to firmware\n");
+		PRINTM(MINFO, "SEND DATA (FULL!): <Rd: %#x, Wr: %#x>\n",
+		       pmadapter->pcard_pcie->txbd_rdptr,
+		       pmadapter->pcard_pcie->txbd_wrptr);
+		pmadapter->data_sent = MTRUE;
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	LEAVE();
+	return ret;
+
+done_unmap:
+	if (MLAN_STATUS_FAILURE ==
+	    pcb->moal_unmap_memory(
+		    pmadapter->pmoal_handle, pmbuf->pbuf + pmbuf->data_offset,
+		    pmbuf->buf_pa, pmbuf->data_len, PCI_DMA_TODEVICE)) {
+		PRINTM(MERROR, "SEND DATA: failed to moal_unmap_memory\n");
+		ret = MLAN_STATUS_FAILURE;
+	}
+	pcb->moal_spin_lock(pmadapter->pmoal_handle,
+			    pmadapter->pmlan_pcie_lock);
+	pmadapter->pcard_pcie->txbd_pending--;
+	pmadapter->pcard_pcie->tx_buf_list[wrindx] = MNULL;
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_pcie_lock);
+
+	if (padma_bd_buf) {
+		padma_bd_buf->paddr = 0;
+		padma_bd_buf->len = 0;
+		padma_bd_buf->flags = 0;
+		padma_bd_buf->pkt_size = 0;
+		padma_bd_buf->reserved = 0;
+	}
+done:
+	LEAVE();
+	return ret;
+}
+#endif
+
+#endif
+
 /**
  *  @brief This function downloads data to the card.
  *
@@ -1878,11 +2499,13 @@
 		pmadapter->pcard_pcie->reg->txrx_rw_ptr_rollover_ind;
 	mlan_pcie_data_buf *ptx_bd_buf = MNULL;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf = MNULL;
 #endif
 	const t_u32 num_tx_buffs = pmadapter->pcard_pcie->txrx_bd_size;
 	mlan_status ret = MLAN_STATUS_PENDING;
+	mlan_status status;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	t_u32 rxbd_val = 0;
 	t_u32 wrindx;
@@ -1892,6 +2515,11 @@
 
 	ENTER();
 
+	if (pmadapter->pcard_pcie->reg->use_adma) {
+		if (wlan_is_tx_pending(pmadapter))
+			wlan_pcie_process_tx_complete(pmadapter);
+	}
+
 	if (!pmbuf) {
 		PRINTM(MERROR, "%s() has no buffer", __FUNCTION__);
 		ret = MLAN_STATUS_FAILURE;
@@ -1932,6 +2560,10 @@
 		PRINTM(MDAT_D,
 		       "SEND DATA: Attach pmbuf %p at tx_ring[%d], txbd_wrptr=0x%x\n",
 		       pmbuf, wrindx, pmadapter->pcard_pcie->txbd_wrptr);
+
+		pcb->moal_spin_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_pcie_lock);
+
 		pmadapter->pcard_pcie->tx_buf_list[wrindx] = pmbuf;
 #if defined(PCIE8997) || defined(PCIE8897)
 		if (!pmadapter->pcard_pcie->reg->use_adma) {
@@ -1948,6 +2580,7 @@
 			ptx_bd_buf->offset = 0;
 			pmadapter->pcard_pcie->last_tx_pkt_size[wrindx] =
 				pmbuf->data_len;
+
 			pmadapter->pcard_pcie->txbd_wrptr++;
 			if ((pmadapter->pcard_pcie->txbd_wrptr &
 			     txrx_rw_ptr_mask) == num_tx_buffs)
@@ -1961,19 +2594,29 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			wr_ptr_start = ADMA_WPTR_START;
 			padma_bd_buf = (adma_dual_desc_buf *)pmadapter
 					       ->pcard_pcie->txbd_ring[wrindx];
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len =
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE);
+			padma_bd_buf->len = pmbuf->data_len;
+
+#if defined(PCIEAW693)
+			if (IS_PCIEAW693(pmadapter->card_type)) {
+				padma_bd_buf->flags = 0;
+				wlan_get_adma_buf_flag_sliding(
+					pmadapter, num_tx_buffs, wrindx);
+			} else
+#endif
+			{
+				padma_bd_buf->flags = wlan_get_adma_buf_flag(
+					pmadapter, num_tx_buffs, wrindx);
+			}
 			padma_bd_buf->flags = wlan_cpu_to_le16(
-				ADMA_BD_FLAG_SOP | ADMA_BD_FLAG_EOP |
-				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_SRC_HOST);
-			if (padma_bd_buf->len < ADMA_MIN_PKT_SIZE)
-				padma_bd_buf->len = ADMA_MIN_PKT_SIZE;
+				padma_bd_buf->flags | ADMA_BD_FLAG_SOP |
+				ADMA_BD_FLAG_EOP | ADMA_BD_FLAG_SRC_HOST);
 			padma_bd_buf->len = wlan_cpu_to_le16(padma_bd_buf->len);
 			padma_bd_buf->pkt_size = padma_bd_buf->len;
 			pmadapter->pcard_pcie->last_tx_pkt_size[wrindx] =
@@ -1988,23 +2631,36 @@
 		       ((pmadapter->pcard_pcie->txbd_wrptr << wr_ptr_start) |
 			rxbd_val));
 		/* Write the TX ring write pointer in to REG_TXBD_WRPTR */
-		if (pcb->moal_write_reg(pmadapter->pmoal_handle, reg_txbd_wrptr,
-					(pmadapter->pcard_pcie->txbd_wrptr
-					 << wr_ptr_start) |
-						rxbd_val)) {
+		status = pcb->moal_write_reg(
+			pmadapter->pmoal_handle, reg_txbd_wrptr,
+			(pmadapter->pcard_pcie->txbd_wrptr << wr_ptr_start) |
+				rxbd_val);
+
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_pcie_lock);
+
+		if (status) {
 			PRINTM(MERROR,
 			       "SEND DATA: failed to write REG_TXBD_WRPTR\n");
 			ret = MLAN_STATUS_FAILURE;
 			goto done_unmap;
 		}
+
 		PRINTM(MINFO, "SEND DATA: Updated <Rd: %#x, Wr: %#x>\n",
 		       pmadapter->pcard_pcie->txbd_rdptr,
 		       pmadapter->pcard_pcie->txbd_wrptr);
 
-		if (wlan_check_txbd_not_full(pmadapter))
-			pmadapter->data_sent = MFALSE;
-		else
-			wlan_pcie_send_data_complete(pmadapter);
+		if (wlan_check_txbd_not_full(pmadapter)) {
+#ifdef PCIEAW693
+			if (IS_PCIEAW693(pmadapter->card_type) &&
+			    (wlan_pcie_get_max_msdu_cnt(pmadapter) < 2)) {
+				pmadapter->data_sent = MTRUE;
+				wlan_pcie_process_tx_complete(pmadapter);
+			} else
+#endif
+				pmadapter->data_sent = MFALSE;
+		} else
+			wlan_pcie_process_tx_complete(pmadapter);
 		if (pmadapter->data_sent)
 			pmadapter->data_sent_cnt++;
 
@@ -2042,8 +2698,13 @@
 		PRINTM(MERROR, "SEND DATA: failed to moal_unmap_memory\n");
 		ret = MLAN_STATUS_FAILURE;
 	}
+	pcb->moal_spin_lock(pmadapter->pmoal_handle,
+			    pmadapter->pmlan_pcie_lock);
 	pmadapter->pcard_pcie->txbd_pending--;
 	pmadapter->pcard_pcie->tx_buf_list[wrindx] = MNULL;
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_pcie_lock);
+
 #if defined(PCIE8997) || defined(PCIE8897)
 	if (!pmadapter->pcard_pcie->reg->use_adma && ptx_bd_buf) {
 		ptx_bd_buf->paddr = 0;
@@ -2053,7 +2714,8 @@
 		ptx_bd_buf->offset = 0;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma && padma_bd_buf) {
 		padma_bd_buf->paddr = 0;
 		padma_bd_buf->len = 0;
@@ -2093,7 +2755,8 @@
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		if ((pmadapter->pcard_pcie->rxbd_rdptr &
 		     ADMA_RW_PTR_WRAP_MASK) != (rdptr & ADMA_RW_PTR_WRAP_MASK))
@@ -2139,7 +2802,8 @@
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		PRINTM(MDATA, "local wrptr: 0x%x -> reg rdptr: 0x%x\n",
 		       (pmadapter->pcard_pcie->rxbd_wrptr &
@@ -2167,10 +2831,11 @@
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
-	t_u32 rdptr, rd_index;
+	t_u32 rdptr = 0;
+	t_u32 rd_index;
 	mlan_buffer *pmbuf = MNULL;
 	t_u32 txbd_val = 0;
-	t_u16 rx_len, rx_type;
+	t_u16 rx_len = 0, rx_type;
 	const t_u32 num_rx_buffs = pmadapter->pcard_pcie->txrx_bd_size;
 	t_u32 reg_rxbd_rdptr = pmadapter->pcard_pcie->reg->reg_rxbd_rdptr;
 #if defined(PCIE8997) || defined(PCIE8897)
@@ -2179,10 +2844,12 @@
 		pmadapter->pcard_pcie->reg->txrx_rw_ptr_rollover_ind;
 	mlan_pcie_data_buf *prxbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
-	t_u32 in_ts_sec, in_ts_usec;
+	t_u32 in_ts_sec = 0;
+	t_u32 in_ts_usec = 0;
 
 	ENTER();
 
@@ -2193,7 +2860,8 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		rdptr = rdptr >> ADMA_RPTR_START;
 #endif
@@ -2205,6 +2873,12 @@
 			pmadapter->pmoal_handle, 6, 0);
 	}
 	while (wlan_check_rx_pending_buffer(pmadapter, rdptr)) {
+		if (pmadapter->rx_pkts_queued > HIGH_RX_PENDING) {
+			PRINTM(MEVENT, "RX Pause\n");
+			pmadapter->delay_rx_data_flag = MTRUE;
+			goto done;
+		}
+
 		/* detach pmbuf (with data) from Rx Ring */
 		rd_index =
 			pmadapter->pcard_pcie->rxbd_rdptr & (num_rx_buffs - 1);
@@ -2215,6 +2889,14 @@
 			goto done;
 		}
 		pmbuf = pmadapter->pcard_pcie->rx_buf_list[rd_index];
+		/* if in previous Interrupt, SKB allocation fails, then there
+		 * will be no valid pmbuf in RxRing at the current index. we can
+		 * attempt reattch a valid pmbuf at same index and continue Rx.
+		 */
+		if (!pmbuf) {
+			PRINTM(MDAT_D, "RECV DATA: invalid pmbuf");
+			goto reattach;
+		}
 		if (MLAN_STATUS_FAILURE ==
 		    pcb->moal_unmap_memory(pmadapter->pmoal_handle,
 					   pmbuf->pbuf + pmbuf->data_offset,
@@ -2285,6 +2967,13 @@
 
 				pmadapter->data_received = MTRUE;
 			}
+		} else {
+			/* Queue the mlan_buffer again */
+			PRINTM(MERROR, "PCIE: Drop invalid packet, length=%d",
+			       rx_len);
+		}
+	reattach:
+		if ((rx_len <= MLAN_RX_DATA_BUF_SIZE) || (!pmbuf)) {
 			/* Create new buffer and attach it to Rx Ring */
 			pmbuf = wlan_alloc_mlan_buffer(pmadapter,
 						       MLAN_RX_DATA_BUF_SIZE,
@@ -2296,10 +2985,6 @@
 				ret = MLAN_STATUS_FAILURE;
 				goto done;
 			}
-		} else {
-			/* Queue the mlan_buffer again */
-			PRINTM(MERROR, "PCIE: Drop invalid packet, length=%d",
-			       rx_len);
 		}
 
 		if (MLAN_STATUS_FAILURE ==
@@ -2339,6 +3024,9 @@
 					 txrx_rw_ptr_rollover_ind);
 			}
 
+			pcb->moal_spin_lock(pmadapter->pmoal_handle,
+					    pmadapter->pmlan_pcie_lock);
+
 			/* update rxbd's wrptrs */
 			if ((++pmadapter->pcard_pcie->rxbd_wrptr &
 			     txrx_rw_ptr_mask) ==
@@ -2354,14 +3042,14 @@
 			txbd_val = txbd_val << TXBD_RW_PTR_START;
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)pmadapter->pcard_pcie
 					->rxbd_ring[rd_index];
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(pmbuf->data_len);
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
 			padma_bd_buf->pkt_size = 0;
@@ -2378,15 +3066,26 @@
 		       pmadapter->pcard_pcie->rxbd_wrptr, rdptr);
 
 		/* Write the RX ring write pointer in to REG_RXBD_WRPTR */
-		if (pcb->moal_write_reg(
-			    pmadapter->pmoal_handle,
-			    pmadapter->pcard_pcie->reg->reg_rxbd_wrptr,
-			    pmadapter->pcard_pcie->rxbd_wrptr | txbd_val)) {
+		ret = pcb->moal_write_reg(
+			pmadapter->pmoal_handle,
+			pmadapter->pcard_pcie->reg->reg_rxbd_wrptr,
+			pmadapter->pcard_pcie->rxbd_wrptr | txbd_val);
+
+#if defined(PCIE8997) || defined(PCIE8897)
+		if (!pmadapter->pcard_pcie->reg->use_adma) {
+			pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+					      pmadapter->pmlan_pcie_lock);
+		}
+#endif
+		if (ret) {
 			PRINTM(MERROR,
 			       "RECV DATA: failed to write REG_RXBD_WRPTR\n");
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
+		if ((pmadapter->ps_state == PS_STATE_SLEEP) ||
+		    (pmadapter->ps_state == PS_STATE_SLEEP_CFM))
+			goto done;
 
 		/* Read the RX ring read pointer set by firmware */
 		if (pcb->moal_read_reg(pmadapter->pmoal_handle, reg_rxbd_rdptr,
@@ -2396,7 +3095,8 @@
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma)
 			rdptr = rdptr >> ADMA_RPTR_START;
 #endif
@@ -2496,53 +3196,15 @@
 				goto done;
 			}
 		}
-
-		/* Write the lower 32bits of the physical address to
-		 * REG_CMD_ADDR_LO */
-		if (pcb->moal_write_reg(
-			    pmadapter->pmoal_handle, REG_CMD_ADDR_LO,
-			    (t_u32)pmadapter->pcard_pcie->cmd_buf->buf_pa)) {
-			PRINTM(MERROR,
-			       "Failed to write download command to boot code.\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-		/* Write the upper 32bits of the physical address to
-		 * REG_CMD_ADDR_HI */
-		if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-					REG_CMD_ADDR_HI,
-					(t_u32)((t_u64)pmadapter->pcard_pcie
-							->cmd_buf->buf_pa >>
-						32))) {
-			PRINTM(MERROR,
-			       "Failed to write download command to boot code.\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-
-		/* Write the command length to REG_CMD_SIZE */
-		if (pcb->moal_write_reg(
-			    pmadapter->pmoal_handle, REG_CMD_SIZE,
-			    pmadapter->pcard_pcie->cmd_buf->data_len)) {
-			PRINTM(MERROR,
-			       "Failed to write command length to REG_CMD_SIZE\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-
-		/* Ring the door bell */
-		if (pcb->moal_write_reg(
-			    pmadapter->pmoal_handle,
-			    pmadapter->pcard_pcie->reg->reg_cpu_int_event,
-			    CPU_INTR_DOOR_BELL)) {
-			PRINTM(MERROR,
-			       "Failed to assert door-bell interrupt.\n");
+		if (wlan_pcie_send_boot_cmd(pmadapter, pmbuf, MFALSE)) {
+			PRINTM(MERROR, "Failed to send hostcmd to device\n");
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		/* To send a command, the driver will:
 		   1. driver prepare the cmdrep buffer for adma
@@ -2555,10 +3217,21 @@
 		wlan_init_adma(pmadapter, ADMA_CMDRESP,
 			       pmadapter->pcard_pcie->cmdrsp_buf->buf_pa,
 			       MRVDRV_SIZE_OF_CMD_BUFFER, MFALSE);
-		wlan_init_adma(pmadapter, ADMA_CMD,
-			       pmadapter->pcard_pcie->cmd_buf->buf_pa,
-			       pmadapter->pcard_pcie->cmd_buf->data_len,
-			       MFALSE);
+		if (IS_PCIEIW624(pmadapter->card_type) ||
+		    (IS_PCIEAW693(pmadapter->card_type) &&
+		     (pmadapter->card_rev > CHIP_AW693_REV_A0))) {
+			if (wlan_pcie_send_boot_cmd(pmadapter, pmbuf, MFALSE)) {
+				PRINTM(MERROR,
+				       "Failed to send vdll block to device\n");
+				ret = MLAN_STATUS_FAILURE;
+				goto done;
+			}
+		} else {
+			wlan_init_adma(pmadapter, ADMA_CMD,
+				       pmadapter->pcard_pcie->cmd_buf->buf_pa,
+				       pmadapter->pcard_pcie->cmd_buf->data_len,
+				       MFALSE);
+		}
 	}
 #endif
 done:
@@ -2612,6 +3285,7 @@
 	pmlan_buffer pmbuf = pmadapter->pcard_pcie->cmdrsp_buf;
 	pmlan_buffer cmd_buf = MNULL;
 	t_u16 resp_len = 0;
+	t_u8 cmd_resp_received = MFALSE;
 
 	ENTER();
 
@@ -2679,7 +3353,7 @@
 			   pmadapter->upld_len, MRVDRV_SIZE_OF_CMD_BUFFER);
 
 	} else {
-		pmadapter->cmd_resp_received = MTRUE;
+		cmd_resp_received = MTRUE;
 		pmbuf->data_len = pmadapter->upld_len;
 		pmbuf->data_offset += PCIE_INTF_HEADER_LEN;
 		pmadapter->curr_cmd->respbuf = pmbuf;
@@ -2710,7 +3384,8 @@
 			}
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			/* Clear the cmd-rsp buffer address in adma registers.
 			   This will prevent firmware from writing to the same
@@ -2727,6 +3402,11 @@
 	}
 
 done:
+	if (cmd_resp_received) {
+		wlan_request_cmd_lock(pmadapter);
+		pmadapter->cmd_resp_received = cmd_resp_received;
+		wlan_release_cmd_lock(pmadapter);
+	}
 	LEAVE();
 	return ret;
 }
@@ -2778,7 +3458,8 @@
 			return MFALSE;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		if ((pmadapter->pcard_pcie->evtbd_rdptr &
 		     ADMA_RW_PTR_WRAP_MASK) != (rdptr & ADMA_RW_PTR_WRAP_MASK))
@@ -2801,23 +3482,18 @@
 {
 	t_u32 rd_index =
 		pmadapter->pcard_pcie->evtbd_rdptr & (MLAN_MAX_EVT_BD - 1);
-	t_u32 rdptr, event;
+	t_u32 rdptr = 0;
+	t_u32 event;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_evt_buf *pevtbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
 	ENTER();
 
-	if (pmadapter->event_received) {
-		PRINTM(MINFO, "Event being processed, do not "
-			      "process this interrupt just yet\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-
 	if (rd_index >= MLAN_MAX_EVT_BD) {
 		PRINTM(MINFO, "Invalid rd_index...\n");
 		LEAVE();
@@ -2832,7 +3508,8 @@
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		rdptr = rdptr >> ADMA_RPTR_START;
 #endif
@@ -2863,7 +3540,8 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)pmadapter->pcard_pcie
@@ -2879,7 +3557,6 @@
 
 		event = *((t_u32 *)&pmbuf_evt->pbuf[pmbuf_evt->data_offset +
 						    PCIE_INTF_HEADER_LEN]);
-		pmadapter->event_cause = wlan_le32_to_cpu(event);
 		/* The first 4bytes will be the event transfer header
 		   len is 2 bytes followed by type which is 2 bytes */
 		evt_len = *((t_u16 *)&pmbuf_evt->pbuf[pmbuf_evt->data_offset]);
@@ -2897,8 +3574,13 @@
 		pmbuf_evt->data_len = evt_len - PCIE_INTF_HEADER_LEN;
 		PRINTM(MINFO, "Event length: %d\n", pmbuf_evt->data_len);
 
-		pmadapter->event_received = MTRUE;
+		pcb->moal_spin_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_event_lock);
 		pmadapter->pmlan_buffer_event = pmbuf_evt;
+		pmadapter->event_cause = wlan_le32_to_cpu(event);
+		pmadapter->event_received = MTRUE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_event_lock);
 		pmadapter->pcard_pcie->evtbd_rdptr++;
 #if defined(PCIE8997) || defined(PCIE8897)
 		if (!pmadapter->pcard_pcie->reg->use_adma) {
@@ -2912,7 +3594,8 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma)
 			pmadapter->pcard_pcie->evtbd_rdptr &=
 				ADMA_RW_PTR_WRAP_MASK;
@@ -2938,6 +3621,51 @@
 }
 
 /**
+ *  @brief This function process pcie received event
+ *
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             N/A
+ */
+static void wlan_pcie_process_event(mlan_adapter *pmadapter)
+{
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+	ENTER();
+	pcb->moal_spin_lock(pmadapter->pmoal_handle,
+			    pmadapter->pmlan_event_lock);
+	if (pmadapter->pcie_event_processing || pmadapter->event_received ||
+	    pmadapter->event_cause) {
+		pmadapter->more_event_flag = MTRUE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_event_lock);
+		goto exit_event_proc;
+	} else {
+		pmadapter->pcie_event_processing = MTRUE;
+		pmadapter->more_event_flag = MFALSE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_event_lock);
+	}
+event_process_start:
+	wlan_pcie_process_event_ready(pmadapter);
+
+	pcb->moal_spin_lock(pmadapter->pmoal_handle,
+			    pmadapter->pmlan_event_lock);
+	if (pmadapter->more_event_flag && !pmadapter->event_cause) {
+		pmadapter->more_event_flag = MFALSE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_event_lock);
+		goto event_process_start;
+	}
+	pmadapter->pcie_event_processing = MFALSE;
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_event_lock);
+exit_event_proc:
+	LEAVE();
+	return;
+}
+
+/**
  *  @brief This function handles event completion
  *
  *  @param pmadapter    A pointer to mlan_adapter structure
@@ -2953,18 +3681,20 @@
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	t_u32 wrptr =
 		pmadapter->pcard_pcie->evtbd_wrptr & (MLAN_MAX_EVT_BD - 1);
-	t_u32 rdptr;
+	t_u32 rdptr = 0;
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_evt_buf *pevtbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
 
 	ENTER();
+
 	if (!pmbuf) {
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
 	}
 
 	if (wrptr >= MLAN_MAX_EVT_BD) {
@@ -2981,7 +3711,8 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		rdptr = rdptr >> ADMA_RPTR_START;
 #endif
@@ -2996,8 +3727,8 @@
 					 &pmbuf->buf_pa, MAX_EVENT_SIZE,
 					 PCI_DMA_FROMDEVICE)) {
 			PRINTM(MERROR, "EvtCom: failed to moal_map_memory\n");
-			LEAVE();
-			return MLAN_STATUS_FAILURE;
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
 		}
 
 		pmadapter->pcard_pcie->evt_buf_list[wrptr] = pmbuf;
@@ -3012,13 +3743,13 @@
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf = (adma_dual_desc_buf *)pmadapter
 					       ->pcard_pcie->evtbd_ring[wrptr];
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(pmbuf->data_len);
 			padma_bd_buf->flags = 0;
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
@@ -3048,7 +3779,8 @@
 		}
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		pmadapter->pcard_pcie->evtbd_wrptr &= ADMA_RW_PTR_WRAP_MASK;
 #endif
@@ -3069,108 +3801,23 @@
 	if (ret && pmbuf)
 		wlan_free_mlan_buffer(pmadapter, pmbuf);
 
+	pcb->moal_spin_lock(pmadapter->pmoal_handle,
+			    pmadapter->pmlan_event_lock);
+
+	pmadapter->event_cause = 0;
+	pmadapter->pmlan_buffer_event = MNULL;
+
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_event_lock);
+
 	PRINTM(MINFO, "EvtCom: Check Events Again\n");
-	ret = wlan_pcie_process_event_ready(pmadapter);
+	wlan_pcie_process_event(pmadapter);
 
 	LEAVE();
 	return ret;
 }
 
 /**
- *  @brief This function downloads boot command to the card.
- *
- *  @param pmadapter    A pointer to mlan_adapter structure
- *  @param pmbuf        A pointer to mlan_buffer
- *
- *  @return 	        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status wlan_pcie_send_boot_cmd(mlan_adapter *pmadapter,
-					   mlan_buffer *pmbuf)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	pmlan_callbacks pcb = &pmadapter->callbacks;
-
-	ENTER();
-
-	if (!pmadapter || !pmbuf) {
-		PRINTM(MERROR, "NULL Pointer\n");
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-
-	if (MLAN_STATUS_FAILURE ==
-	    pcb->moal_map_memory(
-		    pmadapter->pmoal_handle, pmbuf->pbuf + pmbuf->data_offset,
-		    &pmbuf->buf_pa, WLAN_UPLD_SIZE, PCI_DMA_TODEVICE)) {
-		PRINTM(MERROR, "BootCmd: failed to moal_map_memory\n");
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-
-	if (!(pmbuf->pbuf && pmbuf->data_len && pmbuf->buf_pa)) {
-		PRINTM(MERROR, "%s: Invalid buffer <%p, %#x:%x, len=%d>\n",
-		       __func__, pmbuf->pbuf,
-		       (t_u32)((t_u64)pmbuf->buf_pa >> 32),
-		       (t_u32)pmbuf->buf_pa, pmbuf->data_len);
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/* Write the lower 32bits of the physical address to scratch
-	 * register 0 */
-	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-				pmadapter->pcard_pcie->reg->reg_scratch_0,
-				(t_u32)pmbuf->buf_pa)) {
-		PRINTM(MERROR,
-		       "Failed to write download command to boot code\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/* Write the upper 32bits of the physical address to scratch
-	 * register 1 */
-	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-				pmadapter->pcard_pcie->reg->reg_scratch_1,
-				(t_u32)((t_u64)pmbuf->buf_pa >> 32))) {
-		PRINTM(MERROR,
-		       "Failed to write download command to boot code\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/* Write the command length to scratch register 2 */
-	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-				pmadapter->pcard_pcie->reg->reg_scratch_2,
-				pmbuf->data_len)) {
-		PRINTM(MERROR,
-		       "Failed to write command length to scratch register 2\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/* Ring the door bell */
-	if (pcb->moal_write_reg(pmadapter->pmoal_handle,
-				pmadapter->pcard_pcie->reg->reg_cpu_int_event,
-				CPU_INTR_DOOR_BELL)) {
-		PRINTM(MERROR, "Failed to assert door-bell interrupt\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	LEAVE();
-	return ret;
-
-done:
-	if (MLAN_STATUS_FAILURE ==
-	    pcb->moal_unmap_memory(
-		    pmadapter->pmoal_handle, pmbuf->pbuf + pmbuf->data_offset,
-		    pmbuf->buf_pa, WLAN_UPLD_SIZE, PCI_DMA_TODEVICE))
-		PRINTM(MERROR, "BootCmd: failed to moal_unmap_memory\n");
-	LEAVE();
-	return ret;
-}
-
-/**
  *  @brief  This function init rx port in firmware
  *
  *  @param pmadapter	A pointer to mlan_adapter
@@ -3261,6 +3908,7 @@
 		PRINTM(MERROR, "prog_fw: Unable to allocate mlan_buffer\n");
 		goto done;
 	}
+
 #if defined(PCIE9098)
 	if (IS_PCIE9098(pmadapter->card_type)) {
 		rev_id_reg = pmadapter->pcard_pcie->reg->reg_rev_id;
@@ -3281,8 +3929,8 @@
 	if (IS_PCIE9097(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
-#if defined(PCIENW62X)
-	if (IS_PCIENW62X(pmadapter->card_type))
+#if defined(PCIEIW624)
+	if (IS_PCIEIW624(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
 
@@ -3394,7 +4042,7 @@
 		}
 
 		/* Send the boot command to device */
-		if (wlan_pcie_send_boot_cmd(pmadapter, pmbuf)) {
+		if (wlan_pcie_send_boot_cmd(pmadapter, pmbuf, MTRUE)) {
 			PRINTM(MERROR,
 			       "Failed to send firmware download command\n");
 			goto done;
@@ -3493,23 +4141,29 @@
 		pmadapter->pcard_pcie->txrx_bd_size = MAX_TXRX_BD;
 		break;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEIW624)
 	case CARD_TYPE_PCIE9097:
 	case CARD_TYPE_PCIE9098:
-	case CARD_TYPE_PCIENW62X:
+	case CARD_TYPE_PCIEIW624:
 		pmadapter->pcard_pcie->reg = &mlan_reg_pcie9098;
 		pmadapter->pcard_info = &mlan_card_info_pcie9098;
 		pmadapter->pcard_pcie->txrx_bd_size = ADMA_DEF_TXRX_BD;
 		pmadapter->pcard_pcie->txrx_num_desc = TXRX_DEF_NUM_DESC;
-#if defined(PCIE9097) || defined(PCIENW62X)
 		if ((card_type == CARD_TYPE_PCIE9097 &&
 		     pmadapter->card_rev == CHIP_9097_REV_B0) ||
-		    (card_type == CARD_TYPE_PCIENW62X))
+		    (card_type == CARD_TYPE_PCIEIW624))
 			pmadapter->pcard_pcie->reg = &mlan_reg_pcie9097_b0;
-#endif
 
 		break;
 #endif
+#ifdef PCIEAW693
+	case CARD_TYPE_PCIEAW693:
+		pmadapter->pcard_pcie->reg = &mlan_reg_pcieaw693;
+		pmadapter->pcard_info = &mlan_card_info_pcie9098;
+		pmadapter->pcard_pcie->txrx_bd_size = ADMA_DEF_TXRX_BD;
+		pmadapter->pcard_pcie->txrx_num_desc = TXRX_DEF_NUM_DESC;
+		break;
+#endif
 	default:
 		PRINTM(MERROR, "can't get right pcie card type \n");
 		ret = MLAN_STATUS_FAILURE;
@@ -3559,7 +4213,7 @@
  */
 static mlan_status wlan_pcie_interrupt(t_u16 msg_id, pmlan_adapter pmadapter)
 {
-	t_u32 pcie_ireg;
+	t_u32 pcie_ireg = 0;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	t_void *pmoal_handle = pmadapter->pmoal_handle;
 	t_void *pint_lock = pmadapter->pint_lock;
@@ -3571,22 +4225,6 @@
 		pcb->moal_spin_lock(pmoal_handle, pint_lock);
 		pmadapter->ireg = 1;
 		pcb->moal_spin_unlock(pmoal_handle, pint_lock);
-	} else if (pmadapter->pcard_pcie->pcie_int_mode == PCIE_INT_MODE_MSIX) {
-		pcie_ireg = (1 << msg_id) &
-			    pmadapter->pcard_pcie->reg->host_intr_mask;
-		if (pcie_ireg) {
-			if (!pmadapter->pps_uapsd_mode &&
-			    (pmadapter->ps_state == PS_STATE_SLEEP)) {
-				pmadapter->pm_wakeup_fw_try = MFALSE;
-				pmadapter->ps_state = PS_STATE_AWAKE;
-				pmadapter->pm_wakeup_card_req = MFALSE;
-			}
-		}
-		pcb->moal_spin_lock(pmoal_handle, pint_lock);
-		pmadapter->ireg |= pcie_ireg;
-		pcb->moal_spin_unlock(pmoal_handle, pint_lock);
-
-		PRINTM(MINTR, "ireg: 0x%08x\n", pcie_ireg);
 	} else {
 		wlan_pcie_disable_host_int_mask(pmadapter);
 		if (pcb->moal_read_reg(
@@ -3635,73 +4273,6 @@
 }
 
 /**
- *  @brief This function checks the msix interrupt status and
- *  handle it accordingly.
- *
- *  @param pmadapter    A pointer to mlan_adapter structure
- *
- *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-mlan_status wlan_process_msix_int(mlan_adapter *pmadapter)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	t_u32 pcie_ireg = 0;
-	pmlan_callbacks pcb = &pmadapter->callbacks;
-
-	ENTER();
-
-	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->pint_lock);
-	pcie_ireg =
-		pmadapter->ireg & pmadapter->pcard_pcie->reg->host_intr_mask;
-	pmadapter->ireg = 0;
-	pcb->moal_spin_unlock(pmadapter->pmoal_handle, pmadapter->pint_lock);
-
-	if (pcie_ireg & pmadapter->pcard_pcie->reg->host_intr_dnld_done) {
-		PRINTM(MINFO, "<--- DATA sent Interrupt --->\n");
-		ret = wlan_pcie_send_data_complete(pmadapter);
-		if (ret)
-			goto done;
-	}
-	if (pcie_ireg & pmadapter->pcard_pcie->reg->host_intr_upld_rdy) {
-		PRINTM(MINFO, "Rx DATA\n");
-		ret = wlan_pcie_process_recv_data(pmadapter);
-		if (ret)
-			goto done;
-	}
-	if (pcie_ireg & pmadapter->pcard_pcie->reg->host_intr_event_rdy) {
-		PRINTM(MINFO, "Rx EVENT\n");
-		ret = wlan_pcie_process_event_ready(pmadapter);
-		if (ret)
-			goto done;
-	}
-	if (pcie_ireg & pmadapter->pcard_pcie->reg->host_intr_cmd_done) {
-		if (pmadapter->cmd_sent) {
-			PRINTM(MINFO, "<--- CMD sent Interrupt --->\n");
-			pmadapter->cmd_sent = MFALSE;
-		}
-		ret = wlan_pcie_process_cmd_resp(pmadapter);
-		if (ret)
-			goto done;
-	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
-	if (pmadapter->pcard_pcie->reg->host_intr_cmd_dnld &&
-	    (pcie_ireg & pmadapter->pcard_pcie->reg->host_intr_cmd_dnld)) {
-		if (pmadapter->cmd_sent)
-			pmadapter->cmd_sent = MFALSE;
-		if (pmadapter->pcard_pcie->vdll_cmd_buf)
-			wlan_pcie_send_vdll_complete(pmadapter);
-		PRINTM(MINFO, "<--- CMD DNLD DONE Interrupt --->\n");
-	}
-#endif
-	PRINTM(MINFO, "cmd_sent=%d data_sent=%d\n", pmadapter->cmd_sent,
-	       pmadapter->data_sent);
-
-done:
-	LEAVE();
-	return ret;
-}
-
-/**
  *  @brief This function checks the interrupt status and
  *  handle it accordingly.
  *
@@ -3717,10 +4288,6 @@
 
 	ENTER();
 
-	if (pmadapter->pcard_pcie->pcie_int_mode == PCIE_INT_MODE_MSIX) {
-		wlan_process_msix_int(pmadapter);
-		goto done;
-	}
 	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->pint_lock);
 	if (pmadapter->pcard_pcie->pcie_int_mode != PCIE_INT_MODE_MSI)
 		pcie_ireg = pmadapter->ireg;
@@ -3770,54 +4337,67 @@
 			PRINTM(MINFO, "<--- DATA sent Interrupt --->\n");
 			pmadapter->callbacks.moal_tp_accounting_rx_param(
 				pmadapter->pmoal_handle, 3, 0);
-
-			ret = wlan_pcie_send_data_complete(pmadapter);
-			if (ret)
-				goto done;
+			wlan_recv_event(
+				wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY),
+				MLAN_EVENT_ID_DRV_DEFER_TX_COMPLTE, MNULL);
 		}
 		if (pcie_ireg &
 		    pmadapter->pcard_pcie->reg->host_intr_upld_rdy) {
 			pcie_ireg &=
 				~pmadapter->pcard_pcie->reg->host_intr_upld_rdy;
 			PRINTM(MINFO, "Rx DATA\n");
+			pcb->moal_spin_lock(pmadapter->pmoal_handle,
+					    pmadapter->pmlan_rx_lock);
+			pmadapter->pcard_pcie->rx_pending = MTRUE;
+			pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+					      pmadapter->pmlan_rx_lock);
 			pmadapter->callbacks.moal_tp_accounting_rx_param(
 				pmadapter->pmoal_handle, 0, 0);
-			ret = wlan_pcie_process_recv_data(pmadapter);
-			if (ret)
-				goto done;
+			wlan_recv_event(wlan_get_priv(pmadapter,
+						      MLAN_BSS_ROLE_ANY),
+					MLAN_EVENT_ID_DRV_DEFER_RX_DATA, MNULL);
+			if (wlan_is_tx_pending(pmadapter))
+				wlan_recv_event(
+					wlan_get_priv(pmadapter,
+						      MLAN_BSS_ROLE_ANY),
+					MLAN_EVENT_ID_DRV_DEFER_TX_COMPLTE,
+					MNULL);
 		}
 		if (pcie_ireg &
 		    pmadapter->pcard_pcie->reg->host_intr_event_rdy) {
 			pcie_ireg &=
 				~pmadapter->pcard_pcie->reg->host_intr_event_rdy;
 			PRINTM(MINFO, "Rx EVENT\n");
-			ret = wlan_pcie_process_event_ready(pmadapter);
-			if (ret)
-				goto done;
+			pmadapter->pcie_event_int = MTRUE;
+			wlan_recv_event(
+				wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY),
+				MLAN_EVENT_ID_DRV_DEFER_HANDLING, MNULL);
 		}
 		if (pcie_ireg &
 		    pmadapter->pcard_pcie->reg->host_intr_cmd_done) {
 			pcie_ireg &=
 				~pmadapter->pcard_pcie->reg->host_intr_cmd_done;
-			if (pmadapter->cmd_sent) {
+			if (pmadapter->cmd_sent &&
+			    !pmadapter->vdll_ctrl.vdll_len) {
 				PRINTM(MINFO, "<--- CMD sent Interrupt --->\n");
 				pmadapter->cmd_sent = MFALSE;
 			}
-			ret = wlan_pcie_process_cmd_resp(pmadapter);
-			if (ret)
-				goto done;
+			wlan_recv_event(wlan_get_priv(pmadapter,
+						      MLAN_BSS_ROLE_ANY),
+					MLAN_EVENT_ID_DRV_DEFER_CMDRESP, MNULL);
 		}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
+	defined(PCIEAW693) || defined(PCIEIW624)
 		if (pmadapter->pcard_pcie->reg->host_intr_cmd_dnld &&
 		    (pcie_ireg &
 		     pmadapter->pcard_pcie->reg->host_intr_cmd_dnld)) {
 			pcie_ireg &=
 				~pmadapter->pcard_pcie->reg->host_intr_cmd_dnld;
-			if (pmadapter->cmd_sent)
-				pmadapter->cmd_sent = MFALSE;
-			if (pmadapter->pcard_pcie->vdll_cmd_buf)
-				wlan_pcie_send_vdll_complete(pmadapter);
+			pmadapter->pcie_cmd_dnld_int = MTRUE;
 			PRINTM(MINFO, "<--- CMD DNLD DONE Interrupt --->\n");
+			wlan_recv_event(
+				wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY),
+				MLAN_EVENT_ID_DRV_DEFER_HANDLING, MNULL);
 		}
 #endif
 		if (pmadapter->pcard_pcie->pcie_int_mode == PCIE_INT_MODE_MSI) {
@@ -3949,7 +4529,7 @@
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
-	t_u32 firmware_stat;
+	t_u32 firmware_stat = 0;
 	t_u32 tries;
 
 	ENTER();
@@ -4099,11 +4679,12 @@
 		return MLAN_STATUS_FAILURE;
 	}
 
-	if (type == MLAN_TYPE_DATA)
+	if (type == MLAN_TYPE_DATA) {
 		ret = wlan_pcie_send_data(pmadapter, type, pmbuf, tx_param);
-	else if (type == MLAN_TYPE_CMD)
+	} else if (type == MLAN_TYPE_CMD)
 		ret = wlan_pcie_send_cmd(pmadapter, pmbuf);
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
+	defined(PCIEAW693) || defined(PCIEIW624)
 	else if (type == MLAN_TYPE_VDLL)
 		ret = wlan_pcie_send_vdll(pmadapter, pmbuf);
 #endif
@@ -4124,7 +4705,7 @@
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	mlan_buffer *pmbuf = MNULL;
 	/** Virtual base address of ssu buffer */
-	t_u8 *ssu_vbase;
+	t_u8 *ssu_vbase = MNULL;
 	/** Physical base address of ssu buffer */
 	t_u64 ssu_pbase = 0;
 
@@ -4231,9 +4812,11 @@
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
-	    (pmadapter->card_type == CARD_TYPE_PCIENW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEIW624) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type == CARD_TYPE_PCIE9097)) {
 		wlan_pcie_init_adma_ring_size(pmadapter);
 	}
@@ -4289,8 +4872,9 @@
 	pmadapter->pcard_pcie->cmdrsp_buf = MNULL;
 #ifdef RPTR_MEM_COP
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type ==
-	     CARD_TYPE_PCIENW62X)(pmadapter->card_type == CARD_TYPE_PCIE9097))
+	     CARD_TYPE_PCIEIW624)(pmadapter->card_type == CARD_TYPE_PCIE9097))
 		wlan_pcie_free_rdptrs(pmadapter);
 #endif
 
@@ -4333,6 +4917,12 @@
 #if defined(PCIE8997) || defined(PCIE8897)
 	HostCmd_DS_PCIE_HOST_BUF_DETAILS host_spec;
 #endif
+#if defined(PCIE)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
+	HostCmd_DS_PCIE_ADMA_INIT pcie_adma_cfg;
+#endif
+#endif
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -4380,8 +4970,29 @@
 		}
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
+		if (IS_PCIEIW624(pmadapter->card_type) ||
+		    (IS_PCIEAW693(pmadapter->card_type) &&
+		     (pmadapter->card_rev > CHIP_AW693_REV_A0))) {
+			pcie_adma_cfg.tx_ring_size =
+				pmadapter->pcard_pcie->txrx_bd_size;
+			pcie_adma_cfg.rx_ring_size =
+				pmadapter->pcard_pcie->txrx_bd_size;
+			pcie_adma_cfg.evt_ring_size = MLAN_MAX_EVT_BD;
+			pcie_adma_cfg.int_mode =
+				pmadapter->pcard_pcie->pcie_int_mode;
+			ret = wlan_prepare_cmd(pmpriv,
+					       HostCmd_CMD_PCIE_ADMA_INIT,
+					       HostCmd_ACT_GEN_SET, 0, MNULL,
+					       &pcie_adma_cfg);
+			if (ret) {
+				PRINTM(MERROR,
+				       "PCIE_ADMA_INIT: send command failed\n");
+				ret = MLAN_STATUS_FAILURE;
+			}
+		}
 		/** config ADMA for Tx Data */
 		wlan_init_adma(pmadapter, ADMA_TX_DATA,
 			       pmadapter->pcard_pcie->txbd_ring_pbase,
@@ -4442,6 +5053,40 @@
 }
 #endif
 
+#if defined(PCIE)
+/**
+ *  @brief This function prepares command PCIE ADMA init.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_pcie_adma_init(pmlan_private pmpriv,
+				    HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				    t_pvoid pdata_buf)
+{
+	HostCmd_DS_PCIE_ADMA_INIT *ppcie_adma_cfg =
+		&cmd->params.pcie_adma_config;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_PCIE_ADMA_INIT);
+	cmd->size = wlan_cpu_to_le16((sizeof(HostCmd_DS_PCIE_ADMA_INIT)) +
+				     S_DS_GEN);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		memcpy_ext(pmpriv->adapter, ppcie_adma_cfg, pdata_buf,
+			   sizeof(HostCmd_DS_PCIE_ADMA_INIT),
+			   sizeof(HostCmd_DS_PCIE_ADMA_INIT));
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+#endif
+
 /**
  *  @brief This function wakes up the card.
  *
@@ -4514,10 +5159,222 @@
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ *  @brief This function checks the interrupt status and
+ *  handle it accordingly.
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_pcie_interrupt_ext(t_u16 msg_id,
+					   pmlan_adapter pmadapter)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	ENTER();
+	ret = wlan_pcie_interrupt(msg_id, pmadapter);
+	if (ret == MLAN_STATUS_SUCCESS) {
+		/* if we get interrupt, it means device wakes up, no need to
+		 * wake up */
+		pmadapter->pm_wakeup_timeout = 0;
+		wlan_process_pcie_int_status(pmadapter);
+	}
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function process pcie receive data
+ *
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             N/A
+ */
+static void wlan_pcie_process_rx(mlan_adapter *pmadapter)
+{
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+	ENTER();
+	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->pmlan_rx_lock);
+	if (pmadapter->pcie_rx_processing) {
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_rx_lock);
+		goto exit_rx_proc;
+	} else {
+		pmadapter->pcie_rx_processing = MTRUE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_rx_lock);
+	}
+
+	wlan_pcie_process_recv_data(pmadapter);
+
+	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->pmlan_rx_lock);
+	pmadapter->pcie_rx_processing = MFALSE;
+	pmadapter->pcard_pcie->rx_pending = MFALSE;
+	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+			      pmadapter->pmlan_rx_lock);
+exit_rx_proc:
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function process pcie_cmd_dnld interrupt
+ *
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             N/A
+ */
+static void wlan_pcie_process_cmd_dnld(mlan_adapter *pmadapter)
+{
+	ENTER();
+	if (pmadapter->cmd_sent)
+		pmadapter->cmd_sent = MFALSE;
+#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
+	defined(PCIEAW693) || defined(PCIEIW624)
+	if (pmadapter->pcard_pcie->vdll_cmd_buf)
+		wlan_pcie_send_vdll_complete(pmadapter);
+#endif
+
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function checks the interrupt status and
+ *  handle it accordingly.
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_process_pcie_int_status_ext(mlan_adapter *pmadapter,
+						    t_u8 type)
+{
+	ENTER();
+	switch (type) {
+	case RX_DATA: // Rx Data
+		wlan_pcie_process_rx(pmadapter);
+		break;
+	case RX_EVENT: // Rx event
+		wlan_pcie_process_event(pmadapter);
+		break;
+	case TX_COMPLETE: // Tx data complete
+		wlan_pcie_process_tx_complete(pmadapter);
+		break;
+	case RX_CMD_RESP: // Rx CMD Resp
+		wlan_pcie_process_cmd_resp(pmadapter);
+		break;
+	case RX_CMD_DNLD:
+		wlan_pcie_process_cmd_dnld(pmadapter);
+		break;
+	default:
+		break;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function enables rx host interrupts.
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param enable   0-disable 1-enable
+ *
+ *  @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_pcie_select_host_int(mlan_adapter *pmadapter)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
+	t_u32 int_sel_mask =
+		PCIE9098_HOST_INTR_SEL_MASK & ~PCIE9098_HOST_INTR_UPLD_RDY;
+#endif
+
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
+	if (pmadapter->pcard_pcie->reg->use_adma) {
+		ret = wlan_pcie_set_host_int_select_reg(pmadapter,
+							int_sel_mask);
+		PRINTM(MMSG, "set int_sel_mask=0x%x\n", int_sel_mask);
+	}
+#endif
+	return ret;
+}
+
+#if defined(PCIEAW693)
+/**
+ *  @brief This function send buffer list to FW
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param type      packet type
+ *  @param num_pkt   num of pkt
+ *  @param pkt_size  packet size
+ *
+ *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_pcie_send_data_list(mlan_adapter *pmadapter, t_u8 type,
+					    t_u8 num_pkt, t_u16 pkt_size)
+{
+	pmlan_buffer pmbuf;
+
+	t_u16 *tmp;
+	t_u8 *payload;
+	t_u8 i;
+	ENTER();
+#ifdef PCIEAW693
+	if (!IS_PCIEAW693(pmadapter->card_type)) {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+#endif
+	if ((((pmadapter->pcard_pcie->txbd_wrptr >> 1) %
+	      TX_DONE_POLL_DISTANCE) == 0) &&
+	    wlan_is_tx_pending(pmadapter))
+		wlan_pcie_process_tx_complete(pmadapter);
+
+	if (num_pkt == 1) {
+		pmbuf = (pmlan_buffer)util_dequeue_list(pmadapter->pmoal_handle,
+							&pmadapter->amsdu_txq,
+							MNULL, MNULL);
+		if (pmbuf) {
+			wlan_pcie_send_data(pmadapter, type, pmbuf, MNULL);
+		}
+		return MLAN_STATUS_SUCCESS;
+	}
+	for (i = 0; i < num_pkt; i++) {
+		pmbuf = (pmlan_buffer)util_dequeue_list(pmadapter->pmoal_handle,
+							&pmadapter->amsdu_txq,
+							MNULL, MNULL);
+		if (!pmbuf)
+			break;
+		/* first pkt */
+		if (i == 0) {
+			payload = pmbuf->pbuf + pmbuf->data_offset;
+			tmp = (t_u16 *)&payload[0];
+			*tmp = wlan_cpu_to_le16((t_u16)pkt_size);
+			tmp = (t_u16 *)&payload[2];
+			*tmp = wlan_cpu_to_le16(type);
+			wlan_pcie_send_adma_data(pmadapter, pmbuf,
+						 ADMA_BD_FLAG_SOP, pkt_size);
+		} else if (i == (num_pkt - 1)) { /* last pkt */
+			wlan_pcie_send_adma_data(pmadapter, pmbuf,
+						 ADMA_BD_FLAG_EOP, 0);
+		} else {
+			wlan_pcie_send_adma_data(pmadapter, pmbuf, 0, 0);
+		}
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+#endif
+
 mlan_adapter_operations mlan_pcie_ops = {
 	.dnld_fw = wlan_pcie_dnld_fw,
-	.interrupt = wlan_pcie_interrupt,
-	.process_int_status = wlan_process_pcie_int_status,
+	.interrupt = wlan_pcie_interrupt_ext,
+	.process_int_status = wlan_process_pcie_int_status_ext,
 	.host_to_card = wlan_pcie_host_to_card,
 	.wakeup_card = wlan_pm_pcie_wakeup_card,
 	.reset_card = wlan_pcie_wakeup,
@@ -4525,6 +5382,11 @@
 	.data_complete = wlan_pcie_data_complete,
 	.cmdrsp_complete = wlan_pcie_cmdrsp_complete,
 	.handle_rx_packet = wlan_handle_rx_packet,
+	.select_host_int = wlan_pcie_select_host_int,
 	.debug_dump = wlan_pcie_debug_dump,
 	.intf_header_len = PCIE_INTF_HEADER_LEN,
+#ifdef PCIEAW693
+	.send_data_list = wlan_pcie_send_data_list,
+	.get_max_msdu_cnt = wlan_pcie_get_max_msdu_cnt,
+#endif
 };
diff --git a/wlan_sd8987/mlan/mlan_pcie.h b/wlan_src/mlan/mlan_pcie.h
old mode 100755
new mode 100644
similarity index 90%
rename from wlan_sd8987/mlan/mlan_pcie.h
rename to wlan_src/mlan/mlan_pcie.h
index bd17a18..89d0e79
--- a/wlan_sd8987/mlan/mlan_pcie.h
+++ b/wlan_src/mlan/mlan_pcie.h
@@ -6,18 +6,27 @@
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -169,8 +178,12 @@
 #define ADMA_BD_FLAG_DST_HOST MBIT(4)
 /** ADMA MIN PKT SIZE */
 #define ADMA_MIN_PKT_SIZE 128
+/** ADMA MIN PKT SIZE 32 */
+#define ADMA_MIN_PKT_SIZE_32 32
 /** ADMA dual descriptor mode requir 8 bytes alignment in buf size */
 #define ADMA_ALIGN_SIZE 8
+/** ADMA dual descriptor mode requir 8 bytes alignment in buf size */
+#define ADMA_ALIGN_SIZE_1 1
 /** ADMA RW_PTR wrap mask */
 #define ADMA_RW_PTR_WRAP_MASK 0x00001FFF
 /** ADMA MSIX DOORBEEL DATA */
@@ -182,7 +195,8 @@
 /** PF start bit */
 #define ADMA_MSIX_PF_BIT 24
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 /** PCIE9098 dev_id/vendor id reg */
 #define PCIE9098_DEV_ID_REG 0x0000
 /** PCIE revision ID register */
@@ -409,10 +423,13 @@
 #define HOST_INTR_CMD_DONE MBIT(2)
 /** Event ready interrupt for host */
 #define HOST_INTR_EVENT_RDY MBIT(3)
+/** Command download interrupt for host */
+#define HOST_INTR_CMD_DNLD MBIT(7)
+
 /** Interrupt mask for host */
 #define HOST_INTR_MASK                                                         \
 	(HOST_INTR_DNLD_DONE | HOST_INTR_UPLD_RDY | HOST_INTR_CMD_DONE |       \
-	 HOST_INTR_EVENT_RDY)
+	 HOST_INTR_EVENT_RDY | HOST_INTR_CMD_DNLD)
 
 /** Lower 32bits command address holding register */
 #define REG_CMD_ADDR_LO PCIE_SCRATCH_0_REG
@@ -458,6 +475,9 @@
 /** Max interrupt status register read limit */
 #define MAX_READ_REG_RETRY 10000
 
+/* check TX done ring on every X pushed packets */
+#define TX_DONE_POLL_DISTANCE 16
+
 extern mlan_adapter_operations mlan_pcie_ops;
 
 /* Get pcie device from card type */
@@ -466,9 +486,6 @@
 /** Set PCIE host buffer configurations */
 mlan_status wlan_set_pcie_buf_config(mlan_private *pmpriv);
 
-/** Init write pointer */
-mlan_status wlan_pcie_init_fw(pmlan_adapter pmadapter);
-
 #if defined(PCIE8997) || defined(PCIE8897)
 /** Prepare command PCIE host buffer config */
 mlan_status wlan_cmd_pcie_host_buf_cfg(pmlan_private pmpriv,
@@ -476,6 +493,13 @@
 				       t_u16 cmd_action, t_pvoid pdata_buf);
 #endif
 
+#if defined(PCIE)
+/** Prepare command PCIE host buffer config */
+mlan_status wlan_cmd_pcie_adma_init(pmlan_private pmpriv,
+				    pHostCmd_DS_COMMAND cmd, t_u16 cmd_action,
+				    t_pvoid pdata_buf);
+#endif
+
 /** Wakeup PCIE card */
 mlan_status wlan_pcie_wakeup(pmlan_adapter pmadapter);
 
@@ -485,7 +509,6 @@
 mlan_status wlan_pcie_init(mlan_adapter *pmadapter);
 
 /** Read interrupt status */
-mlan_status wlan_process_msix_int(mlan_adapter *pmadapter);
 /** Transfer data to card */
 mlan_status wlan_pcie_host_to_card(pmlan_private pmpriv, t_u8 type,
 				   mlan_buffer *mbuf, mlan_tx_param *tx_param);
diff --git a/wlan_sd8987/mlan/mlan_scan.c b/wlan_src/mlan/mlan_scan.c
old mode 100755
new mode 100644
similarity index 82%
rename from wlan_sd8987/mlan/mlan_scan.c
rename to wlan_src/mlan/mlan_scan.c
index 544f7b0..dc34101
--- a/wlan_sd8987/mlan/mlan_scan.c
+++ b/wlan_src/mlan/mlan_scan.c
@@ -6,20 +6,29 @@
  *  for sending scan commands to the firmware.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -37,9 +46,6 @@
 #include "mlan_11ac.h"
 #include "mlan_11ax.h"
 #include "mlan_11h.h"
-#ifdef DRV_EMBEDDED_SUPPLICANT
-#include "authenticator_api.h"
-#endif
 /********************************************************
 			Local Constants
 ********************************************************/
@@ -171,6 +177,38 @@
  *  @brief This function will update the channel statistics from scan result
  *
  *  @param pmpriv           A pointer to mlan_private structure
+ *  @param pchan_stats      A pointer to chan_statistics_t
+ *
+ *  @return                 MTRUE/MFALSE
+ */
+static t_u8 wlan_set_chan_statistics(mlan_private *pmpriv,
+				     chan_statistics_t *pchan_stats)
+{
+	t_u8 i;
+	t_u8 ret = MFALSE;
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	chan_statistics_t *pstats = MNULL;
+	ENTER();
+	for (i = 0; i < pmadapter->idx_chan_stats; i++) {
+		pstats = (chan_statistics_t *)&pmadapter->pchan_stats[i];
+		if (pstats->chan_num == pchan_stats->chan_num &&
+		    (pstats->bandcfg.chanBand ==
+		     pchan_stats->bandcfg.chanBand)) {
+			memcpy_ext(pmadapter, (chan_statistics_t *)pstats,
+				   pchan_stats, sizeof(chan_statistics_t),
+				   sizeof(chan_statistics_t));
+			ret = MTRUE;
+			break;
+		}
+	}
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function will update the channel statistics from scan result
+ *
+ *  @param pmpriv           A pointer to mlan_private structure
  *  @param pchanstats_tlv   A pointer to MrvlIEtypes_ChannelStats_t tlv
  *
  *  @return                NA
@@ -190,13 +228,6 @@
 	ENTER();
 
 	for (i = 0; i < num_chan; i++) {
-		if (pmadapter->idx_chan_stats >= pmadapter->num_in_chan_stats) {
-			PRINTM(MERROR,
-			       "Over flow: idx_chan_stats=%d, num_in_chan_stats=%d\n",
-			       pmadapter->idx_chan_stats,
-			       pmadapter->num_in_chan_stats);
-			break;
-		}
 		pchan_stats->total_networks =
 			wlan_le16_to_cpu(pchan_stats->total_networks);
 		pchan_stats->cca_scan_duration =
@@ -209,12 +240,24 @@
 		       pchan_stats->total_networks,
 		       pchan_stats->cca_scan_duration,
 		       pchan_stats->cca_busy_duration);
-		memcpy_ext(pmadapter,
-			   (chan_statistics_t *)&pmadapter
-				   ->pchan_stats[pmadapter->idx_chan_stats],
-			   pchan_stats, sizeof(chan_statistics_t),
-			   sizeof(chan_statistics_t));
-		pmadapter->idx_chan_stats++;
+		if (!wlan_set_chan_statistics(pmpriv, pchan_stats)) {
+			if (pmadapter->idx_chan_stats >=
+			    pmadapter->num_in_chan_stats) {
+				PRINTM(MERROR,
+				       "Over flow: idx_chan_stats=%d, num_in_chan_stats=%d\n",
+				       pmadapter->idx_chan_stats,
+				       pmadapter->num_in_chan_stats);
+				LEAVE();
+				return;
+			}
+			memcpy_ext(
+				pmadapter,
+				(chan_statistics_t *)&pmadapter
+					->pchan_stats[pmadapter->idx_chan_stats],
+				pchan_stats, sizeof(chan_statistics_t),
+				sizeof(chan_statistics_t));
+			pmadapter->idx_chan_stats++;
+		}
 		pchan_stats++;
 	}
 	LEAVE();
@@ -373,7 +416,7 @@
  *  @return  matched: non-zero. unmatched: 0
  *
  */
-static t_u8 wlan_is_band_compatible(t_u8 cfg_band, t_u8 scan_band)
+static t_u16 wlan_is_band_compatible(t_u16 cfg_band, t_u16 scan_band)
 {
 	t_u16 band;
 	switch (scan_band) {
@@ -411,7 +454,6 @@
 	for (i = 0; i < pmadapter->num_in_scan_table; i++) {
 		switch (mode) {
 		case MLAN_BSS_MODE_INFRA:
-		case MLAN_BSS_MODE_IBSS:
 			if (wlan_is_network_compatible(pmpriv, i, mode) >= 0) {
 				if (SCAN_RSSI(pmadapter->pscan_table[i].rssi) >
 				    best_rssi) {
@@ -500,14 +542,10 @@
 		       "create_channel_list: region=%d band=%d num_cfp=%d\n",
 		       pscan_region->region, pscan_region->band,
 		       pscan_region->num_cfp);
-		if ((puser_scan_in &&
-		     (puser_scan_in->bss_mode == MLAN_SCAN_MODE_IBSS)) ||
-		    pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
-			band = pmadapter->adhoc_start_band;
-		else
-			band = pmpriv->config_bands;
+		band = pmpriv->config_bands;
 		if (!wlan_is_band_compatible(band, pscan_region->band))
 			continue;
+
 		for (next_chan = 0; next_chan < pscan_region->num_cfp;
 		     next_chan++) {
 			/* Set the default scan type to the user specified type,
@@ -688,6 +726,7 @@
 	MrvlIEtypes_Extension_t *phe_cap;
 	t_u16 len = 0;
 	t_u8 radio_type = 0;
+	t_u8 channel = 0;
 
 	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
 
@@ -711,7 +750,6 @@
 
 	/* check expiry before preparing scan list - may affect blacklist */
 	wlan_11h_get_csa_closed_channel(pmpriv);
-
 	pchan_tlv_out->header.type = wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
 
 	/* Set the temp channel struct pointer to the start of the desired list
@@ -763,12 +801,15 @@
 				first_chan = 0;
 			}
 			radio_type = ptmp_chan_list->bandcfg.chanBand;
+			channel = ptmp_chan_list->chan_number;
 			PRINTM(MCMD_D,
-			       "Scan: Chan(%3d), bandcfg(%x), Mode(%d,%d), Dur(%d)\n",
+			       "Scan: Chan(%3d), bandcfg(%x), Mode(%d,%d,%d), Dur(%d)\n",
 			       ptmp_chan_list->chan_number,
 			       ptmp_chan_list->bandcfg,
 			       ptmp_chan_list->chan_scan_mode.passive_scan,
 			       ptmp_chan_list->chan_scan_mode.disable_chan_filt,
+			       ptmp_chan_list->chan_scan_mode
+				       .passive_to_active_scan,
 			       wlan_le16_to_cpu(ptmp_chan_list->max_scan_time));
 
 			if (foundJPch14 == MTRUE) {
@@ -887,14 +928,12 @@
 			 * prepared */
 			memcpy_ext(pmadapter,
 				   pchan_tlv_out->chan_scan_param + tlv_idx,
-				   ptmp_chan_list,
-				   sizeof(pchan_tlv_out->chan_scan_param),
-				   sizeof(pchan_tlv_out->chan_scan_param));
+				   ptmp_chan_list, sizeof(ChanScanParamSet_t),
+				   sizeof(ChanScanParamSet_t));
 
 			/* Increment the TLV header length by the size appended
 			 */
-			pchan_tlv_out->header.len +=
-				sizeof(pchan_tlv_out->chan_scan_param);
+			pchan_tlv_out->header.len += sizeof(ChanScanParamSet_t);
 
 			/*
 			 * The tlv buffer length is set to the number of
@@ -973,6 +1012,17 @@
 			if (pmadapter->ext_scan && pmadapter->ext_scan_enh &&
 			    pmadapter->ext_scan_type == EXT_SCAN_ENHANCE)
 				done_early = MFALSE;
+
+			/*
+			 * Stop the loop if the *next* channel is of different
+			 * Band
+			 */
+			// coverity[overflow_sink:SUPPRESS]
+			if (ptmp_chan_list->bandcfg.chanBand !=
+			    ((ChanScanParamSet_t *)(ptmp_chan_list - 1))
+				    ->bandcfg.chanBand) {
+				done_early = MTRUE;
+			}
 		}
 
 		/* The total scan time should be less than scan command timeout
@@ -1032,9 +1082,11 @@
 		if (IS_FW_SUPPORT_11AX(pmadapter) &&
 		    ((pmpriv->config_bands & BAND_GAX) ||
 		     (pmpriv->config_bands & BAND_AAX))) {
+			t_u16 select_band =
+				(radio_type == BAND_5GHZ ? BAND_AAX : BAND_GAX);
 			phe_cap = (MrvlIEtypes_Extension_t *)ptlv_pos;
-			len = wlan_fill_he_cap_tlv(pmpriv, pmpriv->config_bands,
-						   phe_cap, MFALSE);
+			len = wlan_fill_he_cap_tlv(pmpriv, select_band, phe_cap,
+						   MFALSE);
 			HEXDUMP("SCAN: HE_CAPABILITIES IE", (t_u8 *)phe_cap,
 				len);
 			ptlv_pos += len;
@@ -1129,7 +1181,7 @@
 	t_u8 *ptlv_pos;
 	t_u32 num_probes;
 	t_u32 ssid_len;
-	t_u32 chan_idx;
+	t_u32 chan_idx = 0;
 	t_u32 chan_list_idx = 0;
 	t_u32 scan_type;
 	t_u16 scan_dur;
@@ -1381,12 +1433,8 @@
 	/* Append rates tlv */
 	memset(pmadapter, rates, 0, sizeof(rates));
 
-	rates_size = wlan_get_supported_rates(
-		pmpriv, pmpriv->bss_mode,
-		(pmpriv->bss_mode == MLAN_BSS_MODE_INFRA) ?
-			pmpriv->config_bands :
-			pmadapter->adhoc_start_band,
-		rates);
+	rates_size = wlan_get_supported_rates(pmpriv, pmpriv->bss_mode,
+					      pmpriv->config_bands, rates);
 
 	prates_tlv = (MrvlIEtypes_RatesParamSet_t *)ptlv_pos;
 	prates_tlv->header.type = wlan_cpu_to_le16(TLV_TYPE_RATES);
@@ -1596,7 +1644,6 @@
 			*pscan_current_only = MTRUE;
 			PRINTM(MINFO, "Scan: Scanning current channel only\n");
 		}
-
 	} else {
 		num_of_channel =
 			wlan_scan_create_channel_list(pmpriv, puser_scan_in,
@@ -1725,7 +1772,6 @@
 	IEEEtypes_FhParamSet_t *pfh_param_set;
 	IEEEtypes_DsParamSet_t *pds_param_set;
 	IEEEtypes_CfParamSet_t *pcf_param_set;
-	IEEEtypes_IbssParamSet_t *pibss_param_set;
 	IEEEtypes_CapInfo_t *pcap_info;
 	WLAN_802_11_FIXED_IEs fixed_ie;
 	t_u8 *pcurrent_ptr;
@@ -1858,10 +1904,7 @@
 		pbss_entry->privacy = Wlan802_11PrivFilterAcceptAll;
 	}
 
-	if (pcap_info->ibss == 1)
-		pbss_entry->bss_mode = MLAN_BSS_MODE_IBSS;
-	else
-		pbss_entry->bss_mode = MLAN_BSS_MODE_INFRA;
+	pbss_entry->bss_mode = MLAN_BSS_MODE_INFRA;
 
 	if (pcap_info->spectrum_mgmt == 1) {
 		PRINTM(MINFO, "InterpretIE: 11h- Spectrum Management "
@@ -1960,20 +2003,6 @@
 					      sizeof(IEEEtypes_Header_t)));
 			break;
 
-		case IBSS_PARAM_SET:
-			pibss_param_set =
-				(IEEEtypes_IbssParamSet_t *)pcurrent_ptr;
-			pbss_entry->atim_window =
-				wlan_le16_to_cpu(pibss_param_set->atim_window);
-			memcpy_ext(pmadapter,
-				   &pbss_entry->ss_param_set.ibss_param_set,
-				   pibss_param_set, total_ie_len,
-				   sizeof(IEEEtypes_IbssParamSet_t));
-			pbss_entry->ss_param_set.ibss_param_set.len = MIN(
-				element_len, (sizeof(IEEEtypes_IbssParamSet_t) -
-					      sizeof(IEEEtypes_Header_t)));
-			break;
-
 		/* Handle Country Info IE */
 		case COUNTRY_INFO:
 			pcountry_info =
@@ -2011,7 +2040,6 @@
 		case TPC_REPORT:
 		case CHANNEL_SWITCH_ANN:
 		case QUIET:
-		case IBSS_DFS:
 		case SUPPORTED_CHANNELS:
 		case TPC_REQUEST:
 			wlan_11h_process_bss_elem(
@@ -2322,6 +2350,23 @@
 					(t_u16)(pcurrent_ptr -
 						pbss_entry->pbeacon_buf);
 				break;
+			case MU_EDCA_PARAM_SET:
+				PRINTM(MCMND, "MU-EDCA IE received\n");
+				pbss_entry->pmuedca_ie =
+					(IEEEtypes_MUEDCAParamSet_t *)
+						pcurrent_ptr;
+				pbss_entry->muedca_offset =
+					(t_u16)(pcurrent_ptr -
+						pbss_entry->pbeacon_buf);
+				break;
+			case MBSSID_CONFIG:
+				pbss_entry->pmbssid_config =
+					(IEEEtypes_MBSSID_Config_t *)
+						pcurrent_ptr;
+				pbss_entry->mbssid_config_offset =
+					(t_u16)(pcurrent_ptr -
+						pbss_entry->pbeacon_buf);
+				break;
 			default:
 				break;
 			}
@@ -2476,11 +2521,24 @@
 					 *)(pbss_entry->pbeacon_buf +
 					    pbss_entry->he_oprat_offset);
 		}
+
+		if (pbss_entry->pmuedca_ie) {
+			pbss_entry->pmuedca_ie =
+				(IEEEtypes_MUEDCAParamSet_t
+					 *)(pbss_entry->pbeacon_buf +
+					    pbss_entry->muedca_offset);
+		}
 		if (pbss_entry->prsnx_ie) {
 			pbss_entry->prsnx_ie =
 				(IEEEtypes_Generic_t *)(pbss_entry->pbeacon_buf +
 							pbss_entry->rsnx_offset);
 		}
+		if (pbss_entry->pmbssid_config) {
+			pbss_entry->pmbssid_config =
+				(IEEEtypes_MBSSID_Config_t
+					 *)(pbss_entry->pbeacon_buf +
+					    pbss_entry->mbssid_config_offset);
+		}
 	} else {
 		pbss_entry->pwpa_ie = MNULL;
 		pbss_entry->wpa_offset = 0;
@@ -2503,6 +2561,10 @@
 		pbss_entry->ext_cap_offset = 0;
 		pbss_entry->poverlap_bss_scan_param = MNULL;
 		pbss_entry->overlap_bss_offset = 0;
+		pbss_entry->pmuedca_ie = MNULL;
+		pbss_entry->muedca_offset = 0;
+		pbss_entry->pmbssid_config = MNULL;
+		pbss_entry->mbssid_config_offset = 0;
 	}
 	LEAVE();
 	return;
@@ -2811,10 +2873,18 @@
 				pnew_beacon->he_oprat_offset =
 					pmadapter->pscan_table[beacon_idx]
 						.he_oprat_offset;
+			if (pnew_beacon->pmuedca_ie)
+				pnew_beacon->muedca_offset =
+					pmadapter->pscan_table[beacon_idx]
+						.muedca_offset;
 			if (pnew_beacon->prsnx_ie)
 				pnew_beacon->rsnx_offset =
 					pmadapter->pscan_table[beacon_idx]
 						.rsnx_offset;
+			if (pnew_beacon->pmbssid_config)
+				pnew_beacon->mbssid_config_offset =
+					pmadapter->pscan_table[beacon_idx]
+						.mbssid_config_offset;
 		}
 		/* Point the new entry to its permanent storage space */
 		pnew_beacon->pbeacon_buf = pbcn_store;
@@ -3075,12 +3145,24 @@
 					 *)(pcurr_bss->pbeacon_buf +
 					    pcurr_bss->he_oprat_offset);
 		}
+
+		if (pcurr_bss->pmuedca_ie) {
+			pcurr_bss->pmuedca_ie =
+				(IEEEtypes_MUEDCAParamSet_t
+					 *)(pcurr_bss->pbeacon_buf +
+					    pcurr_bss->muedca_offset);
+		}
 		if (pcurr_bss->prsnx_ie) {
 			pcurr_bss->prsnx_ie =
 				(IEEEtypes_Generic_t *)(pcurr_bss->pbeacon_buf +
 							pcurr_bss->rsnx_offset);
 		}
-
+		if (pcurr_bss->pmbssid_config) {
+			pcurr_bss->pmbssid_config =
+				(IEEEtypes_MBSSID_Config_t
+					 *)(pcurr_bss->pbeacon_buf +
+					    pcurr_bss->mbssid_config_offset);
+		}
 		PRINTM(MINFO, "current beacon restored %d\n",
 		       pmpriv->curr_bcn_size);
 	} else {
@@ -3133,14 +3215,14 @@
 	for (i = 0; i < (int)pmadapter->num_in_scan_table; i++) {
 		if (pmadapter->pscan_table[i].channel == channel) {
 			if (rssi == 0)
-				rssi = (t_s32)pmadapter->pscan_table[i].rssi;
+				rssi = (t_u8)pmadapter->pscan_table[i].rssi;
 			else {
 				if (min_flag)
-					rssi = MIN(
+					rssi = (t_u8)MIN(
 						rssi,
 						pmadapter->pscan_table[i].rssi);
 				else
-					rssi = MAX(
+					rssi = (t_u8)MAX(
 						rssi,
 						pmadapter->pscan_table[i].rssi);
 			}
@@ -3295,8 +3377,16 @@
 				MNULL;
 			pmpriv->curr_bss_params.bss_descriptor.he_oprat_offset =
 				0;
+			pmpriv->curr_bss_params.bss_descriptor.pmuedca_ie =
+				MNULL;
+			pmpriv->curr_bss_params.bss_descriptor.muedca_offset =
+				0;
 			pmpriv->curr_bss_params.bss_descriptor.prsnx_ie = MNULL;
 			pmpriv->curr_bss_params.bss_descriptor.rsnx_offset = 0;
+			pmpriv->curr_bss_params.bss_descriptor.pmbssid_config =
+				MNULL;
+			pmpriv->curr_bss_params.bss_descriptor
+				.mbssid_config_offset = 0;
 			pmpriv->curr_bss_params.bss_descriptor.pbeacon_buf =
 				MNULL;
 			pmpriv->curr_bss_params.bss_descriptor.beacon_buf_size =
@@ -3383,7 +3473,8 @@
 	 * Prepares domain info from scan table and downloads the
 	 *   domain info command to the FW.
 	 */
-	wlan_11d_prepare_dnld_domain_info_cmd(pmpriv);
+	if (pmpriv->bss_role == MLAN_BSS_ROLE_STA)
+		wlan_11d_prepare_dnld_domain_info_cmd(pmpriv);
 	PRINTM(MMSG, "wlan: SCAN COMPLETED: scanned AP count=%d\n",
 	       pmadapter->num_in_scan_table);
 	LEAVE();
@@ -3675,6 +3766,26 @@
 							    ->pscan_table[del_idx]
 							    .he_oprat_offset);
 			}
+			if (pmadapter->pscan_table[del_idx].pmuedca_ie) {
+				pmadapter->pscan_table[del_idx].pmuedca_ie =
+					(IEEEtypes_MUEDCAParamSet_t
+						 *)(pmadapter
+							    ->pscan_table[del_idx]
+							    .pbeacon_buf +
+						    pmadapter
+							    ->pscan_table[del_idx]
+							    .muedca_offset);
+			}
+			if (pmadapter->pscan_table[del_idx].pmbssid_config) {
+				pmadapter->pscan_table[del_idx].pmbssid_config =
+					(IEEEtypes_MBSSID_Config_t
+						 *)(pmadapter
+							    ->pscan_table[del_idx]
+							    .pbeacon_buf +
+						    pmadapter
+							    ->pscan_table[del_idx]
+							    .mbssid_config_offset);
+			}
 		}
 	}
 
@@ -3857,11 +3968,8 @@
 	}
 
 	if ((pbss_desc->bss_mode == mode) &&
-	    (pmpriv->sec_info.ewpa_enabled == MTRUE
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	     || supplicantIsEnabled(pmpriv->psapriv)
-#endif
-	     || pmpriv->sec_info.authentication_mode == MLAN_AUTH_MODE_OWE ||
+	    (pmpriv->sec_info.ewpa_enabled == MTRUE ||
+	     pmpriv->sec_info.authentication_mode == MLAN_AUTH_MODE_OWE ||
 	     pbss_desc->owe_transition_mode == OWE_TRANS_MODE_OWE)) {
 		if (((pbss_desc->pwpa_ie) &&
 		     ((*(pbss_desc->pwpa_ie)).vend_hdr.element_id == WPA_IE)) ||
@@ -4235,10 +4343,6 @@
 		return MLAN_STATUS_FAILURE;
 	}
 
-	memset(pmadapter, pscan_chan_list, 0x00, buf_size);
-	memset(pmadapter, pscan_cfg_out, 0x00,
-	       sizeof(wlan_scan_cmd_config_tlv));
-
 	keep_previous_scan = MFALSE;
 
 	ret = wlan_scan_setup_scan_config(pmpriv, puser_scan_in,
@@ -4264,14 +4368,11 @@
 		keep_previous_scan = puser_scan_in->keep_previous_scan;
 
 	if (keep_previous_scan == MFALSE) {
-		memset(pmadapter, pmadapter->pscan_table, 0x00,
-		       sizeof(BSSDescriptor_t) * MRVDRV_MAX_BSSID_LIST);
-		pmadapter->num_in_scan_table = 0;
+		wlan_flush_scan_table(pmadapter);
 		pmadapter->pbcn_buf_end = pmadapter->bcn_buf;
 	} else {
 		wlan_scan_delete_ageout_entry(pmpriv);
 	}
-	pmadapter->idx_chan_stats = 0;
 
 	ret = wlan_scan_channel_list(pmpriv, pioctl_buf, max_chan_per_scan,
 				     filtered_scan, &pscan_cfg_out->config,
@@ -4371,10 +4472,11 @@
 	t_u32 bss_idx, i;
 	t_u8 null_ssid[MLAN_MAX_SSID_LENGTH] = {0};
 	mlan_callbacks *pcb = (mlan_callbacks *)&pmpriv->adapter->callbacks;
-	wlan_user_scan_cfg *user_scan_cfg;
+	wlan_user_scan_cfg *user_scan_cfg = MNULL;
 	mlan_ds_scan *pscan = (mlan_ds_scan *)pioctl_buf->pbuf;
 	mlan_scan_req *pscan_req = MNULL;
 	wlan_user_scan_cfg *puser_scan_in = MNULL;
+	t_u16 band;
 
 	ENTER();
 
@@ -4398,7 +4500,6 @@
 		PRINTM(MERROR, "Memory allocation for user_scan_cfg failed\n");
 		goto done;
 	}
-	memset(pmadapter, user_scan_cfg, 0, sizeof(wlan_user_scan_cfg));
 	for (bss_idx = 0; bss_idx < pmadapter->num_in_scan_table; bss_idx++) {
 		scan_reqd = MFALSE;
 		if (!memcmp(pmadapter,
@@ -4445,12 +4546,15 @@
 			if (scan_reqd) {
 				chan_listed = MFALSE;
 				for (i = 0; i < id; i++) {
+					band = radio_type_to_band(
+						user_scan_cfg->chan_list[i]
+							.radio_type);
+
 					if ((user_scan_cfg->chan_list[i]
 						     .chan_number ==
 					     pmadapter->pscan_table[bss_idx]
 						     .channel) &&
-					    (user_scan_cfg->chan_list[i]
-						     .radio_type &
+					    (band &
 					     pmadapter->pscan_table[bss_idx]
 						     .bss_band)) {
 						chan_listed = MTRUE;
@@ -4472,6 +4576,9 @@
 				user_scan_cfg->chan_list[id].scan_type =
 					MLAN_SCAN_TYPE_ACTIVE;
 				id++;
+
+				if (id >= WLAN_USER_SCAN_CHAN_MAX)
+					break;
 			}
 		}
 	}
@@ -4491,16 +4598,20 @@
 				   MLAN_MAX_SSID_LENGTH);
 		}
 		user_scan_cfg->keep_previous_scan = MTRUE;
+		if (pmadapter->ext_scan_type == EXT_SCAN_ENHANCE)
+			user_scan_cfg->ext_scan_type = EXT_SCAN_ENHANCE;
+		PRINTM(MCMND, "active scan request for passive channel %d\n",
+		       id);
 		if (MLAN_STATUS_SUCCESS !=
 		    wlan_scan_networks(pmpriv, pioctl_buf, user_scan_cfg)) {
 			goto done;
 		}
 		ret = MTRUE;
 	}
+done:
 	if (user_scan_cfg)
 		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)user_scan_cfg);
 
-done:
 	LEAVE();
 	return ret;
 }
@@ -4548,7 +4659,7 @@
 	t_u32 num_in_table;
 	t_u32 bss_idx;
 	t_u32 idx;
-	t_u32 tlv_buf_size;
+	t_u32 tlv_buf_size = 0;
 	t_u64 tsf_val;
 	chan_freq_power_t *cfp;
 	MrvlIEtypes_ChanBandListParamSet_t *pchan_band_tlv = MNULL;
@@ -4599,10 +4710,21 @@
 	 *   BSS Descriptions (bss_descript_size as bytesLef) and the command
 	 *   response header (S_DS_GEN)
 	 */
-	tlv_buf_size = scan_resp_size -
-		       (bytes_left + sizeof(pscan_rsp->bss_descript_size) +
-			sizeof(pscan_rsp->number_of_sets) + S_DS_GEN);
-	if (is_bgscan_resp)
+	if (scan_resp_size >
+	    (bytes_left + sizeof(pscan_rsp->bss_descript_size) +
+	     sizeof(pscan_rsp->number_of_sets) + S_DS_GEN)) {
+		tlv_buf_size =
+			(scan_resp_size -
+			 (bytes_left + sizeof(pscan_rsp->bss_descript_size) +
+			  sizeof(pscan_rsp->number_of_sets) + S_DS_GEN));
+	} else {
+		PRINTM(MERROR,
+		       "scan_resp_size: Incorrect size of TLV buff size.\n");
+	}
+
+	if (is_bgscan_resp &&
+	    (tlv_buf_size >
+	     sizeof(resp->params.bg_scan_query_resp.report_condition)))
 		tlv_buf_size -= sizeof(
 			resp->params.bg_scan_query_resp.report_condition);
 
@@ -5172,138 +5294,536 @@
 /** 8 bytes timestamp, 2 bytest interval, 2 bytes capability */
 #define BEACON_FIX_SIZE 12
 
+/* Element iteration helpers */
+#define for_each_element(_elem, _data, _datalen)                               \
+	for (_elem = (IEEEtypes_Element_t *)(_data);                           \
+	     (const t_u8 *)(_data) + (_datalen) - (const t_u8 *)_elem >=       \
+		     (int)sizeof(*_elem) &&                                    \
+	     (const t_u8 *)(_data) + (_datalen) - (const t_u8 *)_elem >=       \
+		     (int)sizeof(*_elem) + _elem->ieee_hdr.len;                \
+	     _elem = (IEEEtypes_Element_t *)(_elem->data +                     \
+					     _elem->ieee_hdr.len))
+
+#define for_each_element_id(element, _id, data, datalen)                       \
+	for_each_element (element, data, datalen)                              \
+		if (element->ieee_hdr.element_id == (_id))
+
 /**
- *  @brief This function realloc the beacon buffer and update ssid for new entry
- *
- *  @param pmadpater        A pointer to mlan_adapter structure
- *  @param pbss_entry       A pointer to the bss_entry which has multi-bssid IE
- *  @param pnew_entry       A pinter to new entry
- *  @param pssid            A pointer to ssid IE
- *
- *  @return                MLAN_STATUS_FAILURE/MLAN_STATUS_SUCCESS
+ *  @brief This function updates the NonTx BSS Descriptor entry before adding
+ *         it to the scan table
+ *  @param pmadapter	A pointer to mlan adapter
+ *  @param pbss_entry	A pointer to the parent BSS descriptor entry
+ *  @param pnew_entry   A pointer to the nonTx BSS descriptor entry
+ *  @param pbeacon_info A pointer to the beacon buffer of NonTx BSS descriptor
+ *  @param ie_len		NonTx beacon buffer length
  */
-static mlan_status wlan_update_ssid_in_beacon_buf(
-	mlan_adapter *pmadapter, BSSDescriptor_t *pbss_entry,
-	BSSDescriptor_t *pnew_entry, IEEEtypes_Ssid_t *pssid,
-	IEEEtypes_ExtCap_t *pnew_extcap, IEEEtypes_Generic_t *pnew_rsnx)
+static mlan_status wlan_update_nonTx_bss_desc(mlan_adapter *pmadapter,
+					      BSSDescriptor_t *pbss_entry,
+					      BSSDescriptor_t *pnew_entry,
+					      t_u8 **pbeacon_info, t_u32 ie_len)
 {
 	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
-	t_u8 *pbeacon_buf = MNULL;
-	t_u32 beacon_buf_size = 0;
-	t_s8 offset = pnew_entry->ssid.ssid_len - pbss_entry->ssid.ssid_len;
-	IEEEtypes_ExtCap_t *pextcap;
+	IEEEtypes_ElementId_e element_id;
+	t_u8 *pcurrent_ptr = MNULL;
+	t_u8 *pbuf = MNULL;
+	t_u8 *prate = MNULL;
+	t_u8 element_len = 0;
+	t_u8 bytes_to_copy = 0;
+	t_u8 rate_size = 0;
+	t_u8 found_data_rate_ie = 0;
+	t_u16 total_ie_len = 0;
+	t_u32 beacon_buf_size = BEACON_FIX_SIZE + ie_len;
+	t_u32 bytes_left = 0;
 	mlan_status ret = MLAN_STATUS_FAILURE;
-	t_u32 rsnx_offset = 0;
+	IEEEtypes_VendorSpecific_t *pvendor_ie;
+	const t_u8 wpa_oui[4] = {0x00, 0x50, 0xf2, 0x01};
+	const t_u8 wmm_oui[4] = {0x00, 0x50, 0xf2, 0x02};
+	const t_u8 owe_oui[4] = {0x50, 0x6f, 0x9a, 0x1c};
+	const t_u8 osen_oui[] = {0x50, 0x6f, 0x9a, 0x12};
+	IEEEtypes_CountryInfoSet_t *pcountry_info;
+	IEEEtypes_Extension_t *pext_tlv;
 
-	if (pnew_entry->ssid.ssid_len >= pbss_entry->ssid.ssid_len)
-		beacon_buf_size =
-			pbss_entry->beacon_buf_size +
-			(pnew_entry->ssid.ssid_len - pbss_entry->ssid.ssid_len);
-	else
-		beacon_buf_size =
-			pbss_entry->beacon_buf_size -
-			(pbss_entry->ssid.ssid_len - pnew_entry->ssid.ssid_len);
+	ENTER();
+	found_data_rate_ie = MFALSE;
+	rate_size = 0;
 
-	rsnx_offset = beacon_buf_size;
-	if (pnew_rsnx)
-		beacon_buf_size +=
-			pnew_rsnx->ieee_hdr.len + sizeof(IEEEtypes_Header_t);
-
+	/* Allocate the beacon buffer for new entry */
 	ret = pcb->moal_malloc(pmadapter->pmoal_handle, beacon_buf_size,
-			       MLAN_MEM_DEF, (t_u8 **)&pbeacon_buf);
-	if (ret != MLAN_STATUS_SUCCESS || !pbeacon_buf) {
-		PRINTM(MERROR,
-		       "Memory allocation for beacon buf for bss_new_entry\n");
+			       MLAN_MEM_DEF, (t_u8 **)&pbuf);
+	if (ret != MLAN_STATUS_SUCCESS || !pbuf) {
+		PRINTM(MERROR, "Memory allocation for beacon buf failed!\n");
 		goto done;
 	}
+
 	pnew_entry->beacon_buf_size = beacon_buf_size;
-	pnew_entry->pbeacon_buf = pbeacon_buf;
-	/** copy fixed IE */
-	memcpy_ext(pmadapter, pbeacon_buf, pbss_entry->pbeacon_buf,
-		   BEACON_FIX_SIZE, BEACON_FIX_SIZE);
-	/** copy new ssid ie */
-	memcpy_ext(pmadapter, pbeacon_buf + BEACON_FIX_SIZE, (t_u8 *)pssid,
-		   pssid->len + sizeof(IEEEtypes_Header_t),
-		   pssid->len + sizeof(IEEEtypes_Header_t));
-	/** copy left IE to new beacon buffer */
-	memcpy_ext(pmadapter,
-		   pbeacon_buf + BEACON_FIX_SIZE + pssid->len +
-			   sizeof(IEEEtypes_Header_t),
-		   pbss_entry->pbeacon_buf + BEACON_FIX_SIZE +
-			   pbss_entry->ssid.ssid_len +
-			   sizeof(IEEEtypes_Header_t),
-		   pbss_entry->beacon_buf_size - BEACON_FIX_SIZE -
-			   (pbss_entry->ssid.ssid_len +
-			    sizeof(IEEEtypes_Header_t)),
-		   pbss_entry->beacon_buf_size - BEACON_FIX_SIZE -
-			   (pbss_entry->ssid.ssid_len +
-			    sizeof(IEEEtypes_Header_t)));
+	pnew_entry->pbeacon_buf = pbuf;
 
-	/* adjust the ie pointer */
-	if (pnew_entry->pwpa_ie)
-		pnew_entry->wpa_offset += offset;
-	if (pnew_entry->prsn_ie)
-		pnew_entry->rsn_offset += offset;
-	if (pnew_entry->pwapi_ie)
-		pnew_entry->wapi_offset += offset;
+	/** Copy fixed IE to beacon buffer */
+	memcpy_ext(pmadapter, pbuf, pbss_entry->pbeacon_buf, BEACON_FIX_SIZE,
+		   BEACON_FIX_SIZE);
 
-	if (pnew_entry->posen_ie)
-		pnew_entry->osen_offset += offset;
-	if (pnew_entry->pmd_ie)
-		pnew_entry->md_offset += offset;
-	if (pnew_entry->pht_cap)
-		pnew_entry->ht_cap_offset += offset;
-	if (pnew_entry->pht_info)
-		pnew_entry->ht_info_offset += offset;
-	if (pnew_entry->pbss_co_2040)
-		pnew_entry->bss_co_2040_offset += offset;
-	if (pnew_entry->pext_cap) {
-		pnew_entry->ext_cap_offset += offset;
-		if (pnew_extcap) {
-			pextcap = (IEEEtypes_ExtCap_t
-					   *)(pnew_entry->pbeacon_buf +
-					      pnew_entry->ext_cap_offset);
-			memcpy_ext(pmadapter,
-				   pbeacon_buf + pnew_entry->ext_cap_offset,
-				   (t_u8 *)pnew_extcap,
-				   pnew_extcap->ieee_hdr.len +
-					   sizeof(IEEEtypes_Header_t),
-				   pextcap->ieee_hdr.len +
-					   sizeof(IEEEtypes_Header_t));
+	/** Initialize the current working beacon pointer */
+	pcurrent_ptr = *pbeacon_info;
+
+	/** Copy variable IEs to beacon buffer */
+	memcpy_ext(pmadapter, pbuf + BEACON_FIX_SIZE, pcurrent_ptr, ie_len,
+		   ie_len);
+
+	pcurrent_ptr = pbuf + BEACON_FIX_SIZE;
+	bytes_left = ie_len;
+
+	/* Adjust the IE pointers and offsets */
+	while (bytes_left >= 2) {
+		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
+		element_len = *((t_u8 *)pcurrent_ptr + 1);
+		total_ie_len = element_len + sizeof(IEEEtypes_Header_t);
+
+		switch (element_id) {
+		case SSID:
+			// coverity[bad_memset:SUPPRESS]
+			memset(pmadapter, (t_u8 *)&pnew_entry->ssid.ssid, 0,
+			       sizeof(mlan_802_11_ssid));
+			pnew_entry->ssid.ssid_len = element_len;
+			memcpy_ext(pmadapter, pnew_entry->ssid.ssid,
+				   (pcurrent_ptr + 2), element_len,
+				   element_len);
+			PRINTM(MMSG, "SSID: %-32s\n", pnew_entry->ssid.ssid);
+			break;
+
+		case SUPPORTED_RATES:
+			memcpy_ext(pmadapter, pnew_entry->data_rates,
+				   pcurrent_ptr + 2, element_len,
+				   sizeof(pnew_entry->data_rates));
+			memcpy_ext(pmadapter, pnew_entry->supported_rates,
+				   pcurrent_ptr + 2, element_len,
+				   sizeof(pnew_entry->supported_rates));
+			DBG_HEXDUMP(MINFO, "SupportedRates:",
+				    pnew_entry->supported_rates, element_len);
+			rate_size = element_len;
+			found_data_rate_ie = MTRUE;
+			break;
+		/* Handle Country Info IE */
+		case COUNTRY_INFO:
+			pcountry_info =
+				(IEEEtypes_CountryInfoSet_t *)pcurrent_ptr;
+			memcpy_ext(pmadapter, &pnew_entry->country_info,
+				   pcountry_info, pcountry_info->len + 2,
+				   sizeof(pnew_entry->country_info));
+			DBG_HEXDUMP(MINFO,
+				    "CountryInfo:", pnew_entry->country_info,
+				    element_len + 2);
+			break;
+		case POWER_CONSTRAINT:
+		case POWER_CAPABILITY:
+		case TPC_REPORT:
+		case CHANNEL_SWITCH_ANN:
+		case QUIET:
+		case SUPPORTED_CHANNELS:
+		case TPC_REQUEST:
+			wlan_11h_process_bss_elem(
+				pmadapter, &pnew_entry->wlan_11h_bss_info,
+				pcurrent_ptr);
+			break;
+		case EXTENDED_SUPPORTED_RATES:
+			/* Only process extended supported rate
+			 * if data rate is already found.
+			 * Data rate IE should come before
+			 * extended supported rate IE
+			 */
+			if (found_data_rate_ie) {
+				if ((element_len + rate_size) >
+				    WLAN_SUPPORTED_RATES) {
+					bytes_to_copy = (WLAN_SUPPORTED_RATES -
+							 rate_size);
+				} else {
+					bytes_to_copy = element_len;
+				}
+
+				prate = (t_u8 *)pnew_entry->data_rates;
+				prate += rate_size;
+				memcpy_ext(pmadapter, prate, pcurrent_ptr + 2,
+					   bytes_to_copy, bytes_to_copy);
+
+				prate = (t_u8 *)pnew_entry->supported_rates;
+				prate += rate_size;
+				memcpy_ext(pmadapter, prate, pcurrent_ptr + 2,
+					   bytes_to_copy, bytes_to_copy);
+			}
+			DBG_HEXDUMP(MINFO, "Ext SupportedRates:",
+				    pnew_entry->supported_rates,
+				    element_len + rate_size);
+			break;
+
+		case VENDOR_SPECIFIC_221:
+			pvendor_ie = (IEEEtypes_VendorSpecific_t *)pcurrent_ptr;
+
+			if (!memcmp(pmadapter, pvendor_ie->vend_hdr.oui,
+				    wpa_oui, sizeof(wpa_oui))) {
+				pnew_entry->pwpa_ie =
+					(IEEEtypes_VendorSpecific_t *)
+						pcurrent_ptr;
+				pnew_entry->wpa_offset =
+					(t_u16)(pcurrent_ptr -
+						pnew_entry->pbeacon_buf);
+
+				DBG_HEXDUMP(
+					MINFO,
+					"WPA_IE:", (t_u8 *)pnew_entry->pwpa_ie,
+					((*(pnew_entry->pwpa_ie)).vend_hdr.len +
+					 sizeof(IEEEtypes_Header_t)));
+			} else if (!memcmp(pmadapter, pvendor_ie->vend_hdr.oui,
+					   wmm_oui, sizeof(wmm_oui))) {
+				if (total_ie_len ==
+					    sizeof(IEEEtypes_WmmParameter_t) ||
+				    total_ie_len ==
+					    sizeof(IEEEtypes_WmmInfo_t)) {
+					/* Only accept and copy the WMM IE if
+					 * it matches the size expected for the
+					 * WMM Info IE or the WMM Parameter IE
+					 */
+					memcpy_ext(pmadapter,
+						   (t_u8 *)&pnew_entry->wmm_ie,
+						   pcurrent_ptr, total_ie_len,
+						   sizeof(pnew_entry->wmm_ie));
+					DBG_HEXDUMP(MINFO, "WMM_IE:",
+						    (t_u8 *)&pnew_entry->wmm_ie,
+						    total_ie_len);
+				}
+			} else if (IS_FW_SUPPORT_EMBEDDED_OWE(pmadapter) &&
+				   !memcmp(pmadapter, pvendor_ie->vend_hdr.oui,
+					   owe_oui, sizeof(owe_oui))) {
+				/* Current Format of OWE IE is
+				 * element_id:element_len:oui:MAC Address:SSID
+				 * length:SSID */
+				t_u8 trans_ssid_len = *(
+					pcurrent_ptr +
+					sizeof(IEEEtypes_Header_t) +
+					sizeof(owe_oui) + MLAN_MAC_ADDR_LENGTH);
+
+				if (!trans_ssid_len ||
+				    trans_ssid_len > MRVDRV_MAX_SSID_LENGTH) {
+					bytes_left = 0;
+					continue;
+				}
+
+				if (!pnew_entry->cap_info.privacy)
+					pnew_entry->owe_transition_mode =
+						OWE_TRANS_MODE_OPEN;
+				else
+					pnew_entry->owe_transition_mode =
+						OWE_TRANS_MODE_OWE;
+
+				memcpy_ext(
+					pmadapter,
+					pnew_entry->trans_mac_address,
+					(pcurrent_ptr +
+					 sizeof(IEEEtypes_Header_t) +
+					 sizeof(owe_oui)),
+					MLAN_MAC_ADDR_LENGTH,
+					sizeof(pnew_entry->trans_mac_address));
+
+				pnew_entry->trans_ssid.ssid_len =
+					trans_ssid_len;
+
+				memcpy_ext(
+					pmadapter, pnew_entry->trans_ssid.ssid,
+					(pcurrent_ptr +
+					 sizeof(IEEEtypes_Header_t) +
+					 sizeof(owe_oui) +
+					 MLAN_MAC_ADDR_LENGTH + sizeof(t_u8)),
+					trans_ssid_len,
+					sizeof(pnew_entry->trans_ssid.ssid));
+
+				PRINTM(MINFO,
+				       "OWE Transition AP privacy=%d MAC Addr-" MACSTR
+				       " ssid %s\n",
+				       pnew_entry->owe_transition_mode,
+				       MAC2STR(pnew_entry->trans_mac_address),
+				       pnew_entry->trans_ssid.ssid);
+			} else if (!memcmp(pmadapter, pvendor_ie->vend_hdr.oui,
+					   osen_oui, sizeof(osen_oui))) {
+				pnew_entry->posen_ie =
+					(IEEEtypes_Generic_t *)pcurrent_ptr;
+				pnew_entry->osen_offset =
+					(t_u16)(pcurrent_ptr -
+						pnew_entry->pbeacon_buf);
+
+				DBG_HEXDUMP(
+					MINFO, "OSEN_IE:",
+					(t_u8 *)pnew_entry->posen_ie,
+					(*(pnew_entry->posen_ie)).ieee_hdr.len +
+						sizeof(IEEEtypes_Header_t));
+			}
+			break;
+		case RSN_IE:
+			pnew_entry->prsn_ie =
+				(IEEEtypes_Generic_t *)pcurrent_ptr;
+			pnew_entry->rsn_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "RSN_IE:", (t_u8 *)pnew_entry->prsn_ie,
+				    (*(pnew_entry->prsn_ie)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		case RSNX_IE:
+			pnew_entry->prsnx_ie =
+				(IEEEtypes_Generic_t *)pcurrent_ptr;
+			pnew_entry->rsnx_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "RSNX_IE:", (t_u8 *)pnew_entry->prsnx_ie,
+				    (*(pnew_entry->prsnx_ie)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		case WAPI_IE:
+			pnew_entry->pwapi_ie =
+				(IEEEtypes_Generic_t *)pcurrent_ptr;
+			pnew_entry->wapi_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "WAPI_IE:", (t_u8 *)pnew_entry->pwapi_ie,
+				    (*(pnew_entry->pwapi_ie)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		case HT_CAPABILITY:
+			pnew_entry->pht_cap = (IEEEtypes_HTCap_t *)pcurrent_ptr;
+			pnew_entry->ht_cap_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "HTCAP_IE:", (t_u8 *)pnew_entry->pht_cap,
+				    (*(pnew_entry->pht_cap)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case HT_OPERATION:
+			pnew_entry->pht_info =
+				(IEEEtypes_HTInfo_t *)pcurrent_ptr;
+			pnew_entry->ht_info_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "HTOPER_IE:", (t_u8 *)pnew_entry->pht_info,
+				    (*(pnew_entry->pht_info)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case BSSCO_2040:
+			pnew_entry->pbss_co_2040 =
+				(IEEEtypes_2040BSSCo_t *)pcurrent_ptr;
+			pnew_entry->bss_co_2040_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "2040BSSCOEX_IE:",
+				    (t_u8 *)pnew_entry->pbss_co_2040,
+				    (*(pnew_entry->pbss_co_2040)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case EXT_CAPABILITY:
+			pnew_entry->pext_cap =
+				(IEEEtypes_ExtCap_t *)pcurrent_ptr;
+			pnew_entry->ext_cap_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "EXTCAP_IE:", (t_u8 *)pnew_entry->pext_cap,
+				    (*(pnew_entry->pext_cap)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case OVERLAPBSSSCANPARAM:
+			pnew_entry->poverlap_bss_scan_param =
+				(IEEEtypes_OverlapBSSScanParam_t *)pcurrent_ptr;
+			pnew_entry->overlap_bss_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "OBSS_IE",
+				    (t_u8 *)pnew_entry->poverlap_bss_scan_param,
+				    (*(pnew_entry->poverlap_bss_scan_param))
+						    .ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		case VHT_CAPABILITY:
+			pnew_entry->pvht_cap =
+				(IEEEtypes_VHTCap_t *)pcurrent_ptr;
+			pnew_entry->vht_cap_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "VHTCAP_IE:", (t_u8 *)pnew_entry->pvht_cap,
+				    (*(pnew_entry->pvht_cap)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case VHT_OPERATION:
+			pnew_entry->pvht_oprat =
+				(IEEEtypes_VHTOprat_t *)pcurrent_ptr;
+			pnew_entry->vht_oprat_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "VHTOPER_IE:",
+				    (t_u8 *)pnew_entry->pvht_oprat,
+				    (*(pnew_entry->pvht_oprat)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case EXT_BSS_LOAD:
+			pnew_entry->pext_bssload =
+				(IEEEtypes_ExtBSSload_t *)pcurrent_ptr;
+			pnew_entry->ext_bssload_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "EXTBSSLOAD_IE",
+				    (t_u8 *)pnew_entry->pext_bssload,
+				    (*(pnew_entry->pext_bssload)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case VHT_TX_POWER_ENV:
+			pnew_entry->pvht_txpower =
+				(IEEEtypes_VHTtxpower_t *)pcurrent_ptr;
+			pnew_entry->vht_txpower_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "TXPOW_IE:",
+				    (t_u8 *)pnew_entry->pvht_txpower,
+				    (*(pnew_entry->pvht_txpower)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case EXT_POWER_CONSTR:
+			pnew_entry->pext_pwer =
+				(IEEEtypes_ExtPwerCons_t *)pcurrent_ptr;
+			pnew_entry->ext_pwer_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "EXTPOW_IE",
+				    (t_u8 *)pnew_entry->pext_pwer,
+				    (*(pnew_entry->pext_pwer)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case QUIET_CHAN:
+			pnew_entry->pquiet_chan =
+				(IEEEtypes_QuietChan_t *)pcurrent_ptr;
+			pnew_entry->quiet_chan_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "QUIETCHAN_IE",
+				    (t_u8 *)pnew_entry->pquiet_chan,
+				    (*(pnew_entry->pquiet_chan)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+
+		case OPER_MODE_NTF:
+			pnew_entry->poper_mode =
+				(IEEEtypes_OperModeNtf_t *)pcurrent_ptr;
+			pnew_entry->oper_mode_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO,
+				    "OMN_IE:", (t_u8 *)pnew_entry->poper_mode,
+				    (*(pnew_entry->poper_mode)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		case EXTENSION:
+			pext_tlv = (IEEEtypes_Extension_t *)pcurrent_ptr;
+			switch (pext_tlv->ext_id) {
+			case HE_CAPABILITY:
+				pnew_entry->phe_cap =
+					(IEEEtypes_HECap_t *)pcurrent_ptr;
+				pnew_entry->he_cap_offset =
+					(t_u16)(pcurrent_ptr -
+						pnew_entry->pbeacon_buf);
+				DBG_HEXDUMP(
+					MINFO, "HECAP_IE:",
+					(t_u8 *)pnew_entry->phe_cap,
+					(*(pnew_entry->phe_cap)).ieee_hdr.len +
+						sizeof(IEEEtypes_Header_t));
+				break;
+			case HE_OPERATION:
+				pnew_entry->phe_oprat = pext_tlv;
+				pnew_entry->he_oprat_offset =
+					(t_u16)(pcurrent_ptr -
+						pnew_entry->pbeacon_buf);
+				DBG_HEXDUMP(
+					MINFO, "HEOPER_IE:",
+					(t_u8 *)pnew_entry->phe_oprat,
+					(*(pnew_entry->phe_oprat)).ieee_hdr.len +
+						sizeof(IEEEtypes_Header_t));
+				break;
+			case MU_EDCA_PARAM_SET:
+				pnew_entry->pmuedca_ie =
+					(IEEEtypes_MUEDCAParamSet_t *)
+						pcurrent_ptr;
+				pnew_entry->muedca_offset =
+					(t_u16)(pcurrent_ptr -
+						pnew_entry->pbeacon_buf);
+				DBG_HEXDUMP(MINFO, "MUEDCA_IE:",
+					    (t_u8 *)pnew_entry->pmuedca_ie,
+					    (*(pnew_entry->pmuedca_ie))
+							    .ieee_hdr.len +
+						    sizeof(IEEEtypes_Header_t));
+				break;
+			case MBSSID_CONFIG:
+				pnew_entry->pmbssid_config =
+					(IEEEtypes_MBSSID_Config_t *)
+						pcurrent_ptr;
+				pnew_entry->mbssid_config_offset =
+					(t_u16)(pcurrent_ptr -
+						pnew_entry->pbeacon_buf);
+				DBG_HEXDUMP(MINFO, "MBSSID_CONFIG_IE:",
+					    (t_u8 *)pnew_entry->pmbssid_config,
+					    (*(pnew_entry->pmbssid_config))
+							    .ieee_hdr.len +
+						    sizeof(IEEEtypes_Header_t));
+				break;
+			default:
+				break;
+			}
+			break;
+		case MOBILITY_DOMAIN:
+			pnew_entry->pmd_ie =
+				(IEEEtypes_MobilityDomain_t *)pcurrent_ptr;
+			pnew_entry->md_offset =
+				(t_u16)(pcurrent_ptr - pnew_entry->pbeacon_buf);
+			DBG_HEXDUMP(MINFO, "Mobility Domain IE",
+				    (t_u8 *)pnew_entry->pmd_ie,
+				    (*(pnew_entry->pmd_ie)).ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		default:
+			break;
 		}
+
+		pcurrent_ptr += element_len + 2;
+		bytes_left -= (element_len + 2);
 	}
-	if (pnew_entry->poverlap_bss_scan_param)
-		pnew_entry->overlap_bss_offset += offset;
-	if (pnew_entry->pvht_cap)
-		pnew_entry->vht_cap_offset += offset;
-	if (pnew_entry->pvht_oprat)
-		pnew_entry->vht_oprat_offset += offset;
-	if (pnew_entry->pvht_txpower)
-		pnew_entry->vht_txpower_offset += offset;
-	if (pnew_entry->pext_pwer)
-		pnew_entry->ext_pwer_offset += offset;
-	if (pnew_entry->pext_bssload)
-		pnew_entry->ext_bssload_offset += offset;
-	if (pnew_entry->pquiet_chan)
-		pnew_entry->quiet_chan_offset += offset;
-	if (pnew_entry->poper_mode)
-		pnew_entry->oper_mode_offset += offset;
-	if (pnew_entry->phe_cap)
-		pnew_entry->he_cap_offset += offset;
-	if (pnew_entry->phe_oprat)
-		pnew_entry->he_oprat_offset += offset;
-	if (pnew_rsnx)
-		memcpy_ext(
-			pmadapter, pbeacon_buf + rsnx_offset, (t_u8 *)pnew_rsnx,
-			pnew_rsnx->ieee_hdr.len + sizeof(IEEEtypes_Header_t),
-			pnew_rsnx->ieee_hdr.len + sizeof(IEEEtypes_Header_t));
-	DBG_HEXDUMP(MCMD_D, "MBSSID beacon buf", pbeacon_buf, beacon_buf_size);
-	ret = MLAN_STATUS_SUCCESS;
 done:
+	LEAVE();
 	return ret;
 }
 
 /**
+ *  @brief This function returns a pointer to IE with matching element ID
+ *
+ *  @param pmadpater		A pointer to mlan_adapter structure
+ *  @param eid   			A pointer to element ID to search for
+ *	@param subie			NonTx BSSID buffer from which to search
+ *IE
+ *	@param subie_len		NonTx BSSID buffer len
+ *	@param match			Pointer to IE to be matched
+ *	@param match_len		1 for EXT_ID, 0 for Non_Ext ID
+ *	@param match_offset		IE offset to be matched
+ *  @return elem            Returns pointer to the matched element
+ */
+static IEEEtypes_Element_t *wlan_find_elem_match(mlan_adapter *pmadapter,
+						 t_u8 eid, t_u8 *subie,
+						 t_u32 subie_len, t_u8 *match,
+						 t_u32 match_len,
+						 t_u32 match_offset)
+{
+	IEEEtypes_Element_t *elem;
+
+	for_each_element_id (elem, eid, subie, subie_len) {
+		if (elem->ieee_hdr.len >= match_offset + match_len &&
+		    !memcmp(pmadapter, elem->data + match_offset, match,
+			    match_len))
+			return elem;
+	}
+	return MNULL;
+}
+
+/**
  *  @brief This function generate the bssid from bssid_idx
  *
  *  @param pmadpater        A pointer to mlan_adapter structure
@@ -5343,188 +5863,719 @@
 }
 
 /**
- *  @brief This function parse the non_trans_bssid_profile
+ *  @brief This function checks if the given IE is inherited
  *
- *  @param pmadapter        A pointer to mlan_adapter structure
- *  @param pbss_entry       A pointer to BSSDescriptor_t which has multi-bssid
- * IE
- *  @param pbss_profile     A pointer to IEEEtypes_NonTransBSSIDprofile_t
- *  @param num_in_table     A pointer to buffer to save num of entry in scan
- * table.
- *  @param  max_bssid_indicator max bssid indicator
+ *  @param elem				The element to check
+ *  @param non_inherit_ie   A pointer
+ *
+ *  @return                 TRUE -  if element is inherited from TxBSSID
+ *                          FALSE - IF element in NOT inherited
+ */
+static t_bool wlan_is_element_inherited(IEEEtypes_Element_t *elem,
+					IEEEtypes_Element_t *non_inherit_ie)
+{
+	t_u8 id_len, ext_id_len, i, loop_len, id;
+	const t_u8 *list;
+
+	ENTER();
+	if (elem->ieee_hdr.element_id == MULTI_BSSID)
+		return MFALSE;
+
+	if (!non_inherit_ie || non_inherit_ie->ieee_hdr.len < 2)
+		return MTRUE;
+
+	/*
+	 * non inheritance element format is:
+	 * ext ID (56) | IDs list len | list | extension IDs list len | list
+	 * Both lists are optional. Both lengths are mandatory */
+	id_len = non_inherit_ie->data[1];
+	if (non_inherit_ie->ieee_hdr.len < 3 + id_len)
+		return MTRUE;
+
+	ext_id_len = non_inherit_ie->data[2 + id_len];
+	if (non_inherit_ie->ieee_hdr.len < 3 + id_len + ext_id_len)
+		return MTRUE;
+
+	if (elem->ieee_hdr.element_id == EXTENSION) {
+		if (!ext_id_len)
+			return MTRUE;
+		loop_len = ext_id_len;
+		list = &non_inherit_ie->data[3 + id_len];
+		id = elem->data[0];
+	} else {
+		if (!id_len)
+			return MTRUE;
+		loop_len = id_len;
+		list = &non_inherit_ie->data[2];
+		id = elem->ieee_hdr.element_id;
+	}
+
+	for (i = 0; i < loop_len; i++) {
+		if (list[i] == id)
+			return MFALSE;
+	}
+
+	LEAVE();
+	return MTRUE;
+}
+
+/**
+ *  @brief This function copies an IE fragment by fragment from the parent
+ *  		(Tx BSSID) to non-Tx BSSID
+ *
+ *  @param pmadapter	A pointer to mlan adapter
+ *  @param elem			A pointer to the IE to be copied from parent to
+ * NonTx BSSID
+ *  @param ie     		A pointer to the IE buffer in parent Tx BSSID
+ *  @param ie_len     	IE buffer length
+ *  @param pos			Pointer to location where IE is copied
+ *  @param buf        	Original buffer pointer of the new generated IE
+ *  @param buf_len     	Buffer length of generated IE
+ *  @return             Copied IE length
+ */
+static t_u32 wlan_copy_ie_with_fragments(pmlan_adapter pmadapter,
+					 IEEEtypes_Element_t *elem,
+					 const t_u8 *ie, t_u32 ie_len,
+					 t_u8 **pos, t_u8 *buf, t_u32 buf_len)
+{
+	ENTER();
+	/* Error checking */
+	if (elem->ieee_hdr.len + 2 > buf + buf_len - *pos) {
+		PRINTM(MERROR, "Copy length in error!\n");
+		return 0;
+	}
+
+	/* Copy the IE */
+	memcpy_ext(pmadapter, *pos, elem, elem->ieee_hdr.len + 2,
+		   elem->ieee_hdr.len + 2);
+	DBG_HEXDUMP(MINFO, "Copying the IE", *pos, elem->ieee_hdr.len + 2);
+	*pos += elem->ieee_hdr.len + 2;
+
+	/* Finish the copy if element is not fragmented */
+	if (elem->ieee_hdr.len != 255) {
+		// coverity[overflow_sink:SUPPRESS]
+		return *pos - buf;
+	}
+
+	/* Adjust the IE offsets */
+	ie_len = ie + ie_len - elem->data - elem->ieee_hdr.len;
+	ie = (const t_u8 *)elem->data + elem->ieee_hdr.len;
+
+	/* Check for remaining fragments and copy if any */
+	for_each_element (elem, ie, ie_len) {
+		if (elem->ieee_hdr.element_id != FRAGMENT)
+			break;
+
+		/* Error checking */
+		if (elem->ieee_hdr.len + 2 > buf + buf_len - *pos) {
+			PRINTM(MERROR, "Copy length in error!!\n");
+			return 0;
+		}
+
+		/* Copy the IE */
+		memcpy_ext(pmadapter, *pos, elem, elem->ieee_hdr.len + 2,
+			   elem->ieee_hdr.len + 2);
+		*pos += elem->ieee_hdr.len + 2;
+
+		/* Break if element is not fragmented */
+		if (elem->ieee_hdr.len != 255)
+			break;
+	}
+
+	LEAVE();
+	// coverity[overflow_sink:SUPPRESS]
+	return *pos - buf;
+}
+
+/**
+ *  @brief This function generates a new NonTx BSSID entry from
+ *  	   the parent TxBSS entry
+ *
+ *  @param pmadapter		A pointer to mlan private
+ *  @param ie     			A pointer to the IE buffer in parent Tx
+ * BSSID
+ *  @param ie_len     		IE buffer length
+ *  @param merged_ie		Pointer to merged NonTx BSSID profile
+ *  @param merged_ie_len    Length of the NonTx BSSID profile
+ *  @param new_ie     		Pointer to new ie buffer
+ *  @param new_ie_len     	Length of new ie buffer
+ *  @return             	Copied IE length
+ */
+static t_u32 wlan_gen_new_ie(mlan_private *pmpriv, t_u8 *ie, t_u32 ie_len,
+			     t_u8 *merged_ie, t_u32 merged_ie_len, t_u8 *new_ie,
+			     t_u32 new_ie_len)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	IEEEtypes_ElementId_e element_id;
+	IEEEtypes_Extension_t *pext_tlv = MNULL;
+	IEEEtypes_Element_t *non_inherit_elem = MNULL;
+	IEEEtypes_Element_t *parent = MNULL, *sub = MNULL;
+	t_u8 element_len = 0, id = 0, ext_id = 0;
+	t_u8 *pcurrent_ptr = merged_ie, *pos = new_ie;
+	t_u32 left_len = merged_ie_len, match_len = 0;
+	t_s32 ret_val = 0;
+
+	ENTER();
+	/* Fetch the Non-Inherit Element */
+	while (left_len >= 2) {
+		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
+		element_len = *((t_u8 *)pcurrent_ptr + 1);
+
+		if (element_id == EXTENSION) {
+			pext_tlv = (IEEEtypes_Extension_t *)pcurrent_ptr;
+
+			if (pext_tlv->ext_id == NON_INHERITANCE) {
+				non_inherit_elem =
+					(IEEEtypes_Element_t *)pcurrent_ptr;
+				break;
+			}
+		}
+		pcurrent_ptr += element_len + 2;
+		left_len -= (element_len + 2);
+	}
+
+	if (!non_inherit_elem)
+		PRINTM(MINFO, "Non-Inherit Elem NOT present\n");
+
+	/* Copy the elements from the parent MBSSID Beacon IE to the generated
+	 * IE
+	 * If they are included in the NonTx profile or in the Non inheritance
+	 * element, then copy all occurances of these elements, the first time
+	 * we encounter them
+	 */
+	for_each_element (parent, ie, ie_len) {
+		if (parent->ieee_hdr.element_id == FRAGMENT)
+			continue;
+
+		if (parent->ieee_hdr.element_id == EXTENSION) {
+			if (parent->ieee_hdr.len < 1)
+				continue;
+
+			id = EXTENSION;
+			ext_id = parent->data[0];
+			match_len = 1;
+		} else {
+			id = parent->ieee_hdr.element_id;
+			match_len = 0;
+		}
+
+		/* Check for the first occurance in NonTx profile */
+		sub = wlan_find_elem_match(pmadapter, id, merged_ie,
+					   merged_ie_len, &ext_id, match_len,
+					   0);
+
+		/* Copy from Tx profile if not present in NonTx profile and
+		 * inherited
+		 */
+		if (!sub &&
+		    wlan_is_element_inherited(parent, non_inherit_elem)) {
+			if ((ret_val = wlan_copy_ie_with_fragments(
+				     pmadapter, parent, ie, ie_len, &pos,
+				     new_ie, new_ie_len)) <= 0)
+				return 0;
+
+			continue;
+		}
+
+		/* Already copied if an earlier element had the same type */
+		if (wlan_find_elem_match(pmadapter, id, ie, (t_u8 *)parent - ie,
+					 &ext_id, match_len, 0))
+			continue;
+
+		/* Not inheriting, copy all similar elements from NonTx profile
+		 */
+		while (sub) {
+			if ((ret_val = wlan_copy_ie_with_fragments(
+				     pmadapter, sub, merged_ie, merged_ie_len,
+				     &pos, new_ie, new_ie_len)) <= 0)
+				return 0;
+			// coverity[overflow_sink:SUPPRESS]
+			sub = wlan_find_elem_match(
+				pmadapter, id, sub->data + sub->ieee_hdr.len,
+				merged_ie_len + merged_ie -
+					(sub->data + sub->ieee_hdr.len),
+				&ext_id, match_len, 0);
+		}
+	}
+
+	/* The above loop skips the elements that are included in NonTx profile
+	 * but NOT in the parent Tx profile; So do a pass over NonTx profile
+	 * and append the missed IEs. Skip the NonTx BSSID cpas and Non-
+	 * Inheritance element */
+	for_each_element (sub, merged_ie, merged_ie_len) {
+		if (sub->ieee_hdr.element_id == NONTX_BSSID_CAP)
+			continue;
+
+		if (sub->ieee_hdr.element_id == FRAGMENT)
+			continue;
+
+		if (sub->ieee_hdr.element_id == EXTENSION) {
+			if (sub->ieee_hdr.len < 1)
+				continue;
+
+			id = EXTENSION;
+			ext_id = sub->data[0];
+			match_len = 1;
+
+			if (ext_id == NON_INHERITANCE)
+				continue;
+		} else {
+			id = sub->ieee_hdr.element_id;
+			match_len = 0;
+		}
+
+		/* Processed if one was included in the parent */
+		if (wlan_find_elem_match(pmadapter, id, ie, ie_len, &ext_id,
+					 match_len, 0))
+			continue;
+
+		if ((ret_val = wlan_copy_ie_with_fragments(
+			     pmadapter, sub, merged_ie, merged_ie_len, &pos,
+			     new_ie, new_ie_len)) <= 0)
+			return 0;
+	}
+
+	LEAVE();
+	return pos - new_ie;
+}
+
+/**
+ *  @brief This function generates the nonTx BSSID profile
+ *
+ *  @param pmadapter       		A pointer to mlan_private structure
+ *  @param pbss_entry       	A pointer to BSSDescriptor_t which has
+ * multi-bssid IE
+ *  @param pmerged_profile  	A pointer to merged NonTX BSSID Profile
+ *  @param profile_len      	Length of the merged NonTX Profile
+ *  @param num_in_table			A pointer to buffer to save num of entry
+ * in scan table.
+ *  @param max_bssid_indicator 	max bssid indicator
  *
  *  @return                 N/A
  */
-static t_void wlan_parse_non_trans_bssid_profile(
-	mlan_private *pmpriv, BSSDescriptor_t *pbss_entry,
-	IEEEtypes_NonTransBSSIDProfile_t *pbss_profile, t_u32 *num_in_table,
-	t_u8 max_bssid_indicator)
+static void wlan_gen_non_trans_bssid_profile(mlan_private *pmpriv,
+					     BSSDescriptor_t *pbss_entry,
+					     t_u8 *pmerged_profile,
+					     t_u32 profile_len,
+					     t_u32 *num_in_table,
+					     t_u8 max_bssid_indicator)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
-	IEEEtypes_Header_t *pheader =
-		(IEEEtypes_Header_t *)pbss_profile->profile_data;
+	t_u8 *pcurrent_ptr = pmerged_profile;
+	IEEEtypes_ElementId_e element_id =
+		(IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
 	IEEEtypes_MultiBSSIDIndex_t *pbssid_index = MNULL;
-	IEEEtypes_Ssid_t *pssid = MNULL;
-	IEEEtypes_NotxBssCap_t *pcap =
-		(IEEEtypes_NotxBssCap_t *)pbss_profile->profile_data;
-	t_u8 *pos = pbss_profile->profile_data;
-	t_s8 left_len = pbss_profile->ieee_hdr.len;
-	t_u8 ret = MFALSE;
+	IEEEtypes_NotxBssCap_t *pcap = MNULL;
 	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
 	BSSDescriptor_t *bss_new_entry = MNULL;
-	t_u8 *pbeacon_buf = MNULL;
-	IEEEtypes_ExtCap_t *pextcap = MNULL;
-	IEEEtypes_Generic_t *prsnx = MNULL;
+	t_u8 *pbeacon_buf = MNULL, *pnew_beacon_buf = MNULL;
+	t_u8 element_len = *((t_u8 *)pcurrent_ptr + 1);
+	t_u32 left_len = profile_len;
+	t_u32 ie_len = pbss_entry->beacon_buf_size - BEACON_FIX_SIZE;
+	t_u32 copied_len = 0;
+	t_u8 ret = MFALSE;
 
 	ENTER();
-
-	/* The first element within the Nontransmitted
-	 * BSSID Profile is not the Nontransmitted
-	 * BSSID Capability element.
-	 */
-	if (pcap->element_id != NONTX_BSSID_CAP || pcap->len != 2) {
+	/* Check for NonTx BSSID Capability */
+	if (element_id != NONTX_BSSID_CAP || element_len != 2) {
 		PRINTM(MERROR,
-		       "The first element within the Nontransmitted BSSID Profile is not the NontransmittedBSSID Capability element\n");
+		       "The first element within the NonTx BSSID profile is not the "
+		       "NonTx BSSID Capability element\n");
 		LEAVE();
 		return;
 	}
 
+	/* Check for valid NonTx BSSID */
 	while (left_len >= 2) {
-		pheader = (IEEEtypes_Header_t *)pos;
-		if ((t_s8)(pheader->len + sizeof(IEEEtypes_Header_t)) >
+		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
+		element_len = *((t_u8 *)pcurrent_ptr + 1);
+
+		if ((t_u8)(element_len + sizeof(IEEEtypes_Header_t)) >
 		    left_len) {
-			PRINTM(MMSG, "invalid IE length = %d left len %d\n",
-			       pheader->len, left_len);
-			break;
+			PRINTM(MERROR, "Invalid IE length = %d left len %d\n",
+			       element_len, left_len);
+			goto done;
 		}
-		switch (pheader->element_id) {
-		case MBSSID_INDEX:
-			pbssid_index = (IEEEtypes_MultiBSSIDIndex_t *)pos;
+
+		/* Find the NonTx Capability */
+		if (element_id == NONTX_BSSID_CAP) {
+			pcap = (IEEEtypes_NotxBssCap_t *)pcurrent_ptr;
+			PRINTM(MINFO, "NonTx Cap =%x\n", pcap->cap);
+		}
+
+		/* Find the MBSSID Index */
+		if (element_id == MBSSID_INDEX) {
+			pbssid_index =
+				(IEEEtypes_MultiBSSIDIndex_t *)pcurrent_ptr;
 			if (pbssid_index->bssid_index == 0 ||
 			    pbssid_index->bssid_index > 46) {
 				PRINTM(MERROR,
-				       " No valid Multiple BSSID-Index element\n");
+				       "No valid Multiple BSSID-Index element\n");
 				goto done;
 			}
-			PRINTM(MCMND, "MBSSID: Find mbssid_index=%d\n",
+			PRINTM(MCMND, "MBSSID: mbssid_index=%d\n",
 			       pbssid_index->bssid_index);
 			ret = MTRUE;
 			break;
-		case EXT_CAPABILITY:
-			pextcap = (IEEEtypes_ExtCap_t *)pos;
-			DBG_HEXDUMP(MCMD_D, "MBSSID extcap", pos,
-				    pextcap->ieee_hdr.len +
-					    sizeof(IEEEtypes_Header_t));
-			break;
-		case RSNX_IE:
-			prsnx = (IEEEtypes_Generic_t *)pos;
-			DBG_HEXDUMP(MCMD_D, "MBSSID RSNX", pos,
-				    prsnx->ieee_hdr.len +
-					    sizeof(IEEEtypes_Header_t));
-			break;
-		case SSID:
-			pssid = (IEEEtypes_Ssid_t *)pos;
-			PRINTM(MCMND, "MBSSID: Find mbssid ssid=%s\n",
-			       pssid->ssid);
-			break;
-		default:
-			break;
 		}
-		left_len -= pheader->len + sizeof(IEEEtypes_Header_t);
-		pos += pheader->len + sizeof(IEEEtypes_Header_t);
+
+		left_len -= (element_len + 2);
+		pcurrent_ptr += element_len + 2;
 	}
+
 	if (ret == MTRUE) {
 		ret = pcb->moal_malloc(pmadapter->pmoal_handle,
 				       sizeof(BSSDescriptor_t), MLAN_MEM_DEF,
 				       (t_u8 **)&bss_new_entry);
+
 		if (ret != MLAN_STATUS_SUCCESS || !bss_new_entry) {
 			PRINTM(MERROR,
 			       "Memory allocation for bss_new_entry failed!\n");
 			goto done;
 		}
+
+		/* Populate the fixed fields of new NonTx BSS entry */
 		memcpy_ext(pmadapter, bss_new_entry, pbss_entry,
 			   sizeof(BSSDescriptor_t), sizeof(BSSDescriptor_t));
+
 		wlan_gen_multi_bssid_by_bssid_index(pmadapter, pbss_entry,
 						    bss_new_entry,
 						    pbssid_index->bssid_index,
 						    max_bssid_indicator);
-		if (pssid) {
-			memset(pmadapter, (t_u8 *)&bss_new_entry->ssid, 0,
-			       sizeof(mlan_802_11_ssid));
-			bss_new_entry->ssid.ssid_len = pssid->len;
-			memcpy_ext(pmadapter, bss_new_entry->ssid.ssid,
-				   pssid->ssid, pssid->len,
-				   MLAN_MAX_SSID_LENGTH);
-			if (MLAN_STATUS_SUCCESS !=
-			    wlan_update_ssid_in_beacon_buf(
-				    pmadapter, pbss_entry, bss_new_entry, pssid,
-				    pextcap, prsnx)) {
-				PRINTM(MERROR,
-				       "Fail to update MBSSID beacon buf\n");
-				pcb->moal_mfree(pmadapter->pmoal_handle,
-						(t_u8 *)bss_new_entry);
-				goto done;
-			}
-			pbeacon_buf = bss_new_entry->pbeacon_buf;
-		}
+
 		memcpy_ext(pmadapter, &bss_new_entry->cap_info, &pcap->cap,
 			   sizeof(IEEEtypes_CapInfo_t),
 			   sizeof(IEEEtypes_CapInfo_t));
+
 		bss_new_entry->multi_bssid_ap = MULTI_BSSID_SUB_AP;
+
+		/* Allocate the beacon buffer for new entry */
+		// coverity[overflow_sink:SUPPRESS]
+		ret = pcb->moal_malloc(pmadapter->pmoal_handle, ie_len,
+				       MLAN_MEM_DEF, (t_u8 **)&pbeacon_buf);
+		if (ret != MLAN_STATUS_SUCCESS || !pbeacon_buf) {
+			PRINTM(MERROR,
+			       "Memory allocation for beacon buf failed!\n");
+			goto done;
+		}
+
+		/** Generate the NonTx BSSID Beacon buffer */
+		// coverity[overflow_sink:SUPPRESS]
+		copied_len = wlan_gen_new_ie(
+			pmpriv, pbss_entry->pbeacon_buf + BEACON_FIX_SIZE,
+			ie_len, pmerged_profile, profile_len, pbeacon_buf,
+			ie_len);
+
+		if (!copied_len) {
+			PRINTM(MERROR, "Failed to generate NonTx BSSID IE!\n");
+			goto done;
+		} else {
+			PRINTM(MMSG, "NonTx Beacon Buffer IE Len = %d\n",
+			       copied_len);
+		}
+		DBG_HEXDUMP(MCMD_D, "NonTx BSSID", pbeacon_buf, copied_len);
+
+		/** Update NonTx BSS descriptor entries */
+		// coverity[overflow_sink:SUPPRESS]
+		if (MLAN_STATUS_SUCCESS !=
+		    wlan_update_nonTx_bss_desc(pmadapter, pbss_entry,
+					       bss_new_entry, &pbeacon_buf,
+					       copied_len)) {
+			PRINTM(MERROR,
+			       "Fail to update NonTx BSSID beacon buf\n");
+			goto done;
+		}
+		pnew_beacon_buf = bss_new_entry->pbeacon_buf;
+		DBG_HEXDUMP(MCMD_D, "NonTx Beacon buf",
+			    bss_new_entry->pbeacon_buf,
+			    BEACON_FIX_SIZE + copied_len);
+
+		/** Add the NonTx BSS entry to the scan table */
 		wlan_add_new_entry_to_scan_table(pmpriv, bss_new_entry,
 						 num_in_table);
-		if (pssid && pbeacon_buf)
-			pcb->moal_mfree(pmadapter->pmoal_handle,
-					(t_u8 *)pbeacon_buf);
-		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)bss_new_entry);
 	}
 done:
+	pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)(pnew_beacon_buf));
+	pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)bss_new_entry);
+	pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)pbeacon_buf);
 	LEAVE();
 	return;
 }
 
 /**
- *  @brief This function parse the multi_bssid IE from pbss_entry
+ *  @brief This function finds the next MBSSID element containing the split
+ *         NonTx BSSID profile
+ *
+ *  @param pbss_entry   	A pointer to BSSDescriptor_t that has MBSSID IE
+ *  @param ie_len      		Maximum IE len in beacon/probe response
+ *  @param pmbssid     		A pointer to MBSSID IE
+ *  @param pnontx_bssid     A pointer to NonTx BSSID subelement
+ *  @return                 A pointer to next MBSSID element
+ */
+static IEEEtypes_MultiBSSID_t *
+wlan_get_next_mbssid_profile(BSSDescriptor_t *pbss_entry, t_u32 ie_len,
+			     IEEEtypes_MultiBSSID_t *pmbssid,
+			     IEEEtypes_NonTransBSSIDProfile_t *pnontx_bssid)
+{
+	IEEEtypes_MultiBSSID_t *pnext_mbssid = MNULL;
+	IEEEtypes_NonTransBSSIDProfile_t *pnext_nontx_bssid = MNULL;
+	t_u8 *mbssid_end = MNULL;
+	t_u8 *pcurrent_ptr = MNULL;
+	IEEEtypes_ElementId_e element_id;
+	t_u32 bytes_left = 0;
+	t_u16 total_ie_len = 0;
+	t_u8 element_len = 0;
+
+	ENTER();
+	if (!pmbssid || !pnontx_bssid) {
+		PRINTM(MERROR, "No MBSSID or NonTx BSSID element present\n");
+		return MNULL;
+	}
+
+	mbssid_end = pmbssid->sub_elem_data + (pmbssid->ieee_hdr.len - 1);
+	pcurrent_ptr = pmbssid->sub_elem_data + (pmbssid->ieee_hdr.len - 1);
+	bytes_left = ie_len -
+		     (mbssid_end - (pbss_entry->pbeacon_buf + BEACON_FIX_SIZE));
+
+	/* If it is not the last NonTx subelement in current MBSSID IE,
+	 * return MNULL
+	 */
+	if ((pnontx_bssid->profile_data + pnontx_bssid->ieee_hdr.len) <
+	    (mbssid_end - 1)) {
+		PRINTM(MMSG, "Not the last Subelement\n");
+		return MNULL;
+	}
+
+	/* Search for the next MBSSID */
+	while (bytes_left >= 2) {
+		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
+		element_len = *((t_u8 *)pcurrent_ptr + 1);
+		total_ie_len = element_len + sizeof(IEEEtypes_Header_t);
+		PRINTM(MINFO, "bytes_left=%d total_ie_len=%d\n", bytes_left,
+		       total_ie_len);
+
+		if (bytes_left < total_ie_len) {
+			PRINTM(MERROR, "InterpretIE: Error in processing IE, "
+				       "bytes left < IE length\n");
+			bytes_left = 0;
+			continue;
+		}
+		if (element_id == MULTI_BSSID) {
+			pnext_mbssid = (IEEEtypes_MultiBSSID_t *)pcurrent_ptr;
+			break;
+		}
+		pcurrent_ptr += total_ie_len;
+		bytes_left -= total_ie_len;
+	}
+
+	/* There isn't a next MBSSID IE - profile is complete.
+	 */
+	if (!pnext_mbssid) {
+		PRINTM(MMSG, "Profile Complete\n");
+		return MNULL;
+	}
+
+	/* Length error */
+	if (pnext_mbssid->ieee_hdr.len < 4) {
+		PRINTM(MERROR, "Next MBSSID Length error\n");
+		return MNULL;
+	}
+
+	/* Next nonTx BSSID */
+	pnext_nontx_bssid =
+		(IEEEtypes_NonTransBSSIDProfile_t *)pnext_mbssid->sub_elem_data;
+
+	/* Next nonTx BSSID length error */
+	if ((pnext_mbssid->sub_elem_data + pnext_mbssid->ieee_hdr.len - 1) <
+	    (pnext_nontx_bssid->profile_data +
+	     pnext_nontx_bssid->ieee_hdr.len)) {
+		PRINTM(MERROR, "Next nonTxBSSID Length error\n");
+		return MNULL;
+	}
+
+	if ((pnext_nontx_bssid->ieee_hdr.element_id != 0) ||
+	    (pnext_nontx_bssid->ieee_hdr.len < 2)) {
+		PRINTM(MERROR, "Next nonTxBSSID Length error\n");
+		return MNULL;
+	}
+
+	/* Check if next nonTx BSSID is start of a new profile
+	 * OR a split profile */
+	LEAVE();
+	return pnext_nontx_bssid->profile_data[0] == NONTX_BSSID_CAP ?
+		       MNULL :
+		       pnext_mbssid;
+}
+
+/**
+ *  @brief This function merges the NonTx BSSID profile entries split
+ *         across multiple MBSSID elements
+ *
+ *  @param pmpriv			A pointer to mlan adapter
+ *  @param pbss_entry   	A pointer to BSSDescriptor_t that has MBSSID IE
+ *  @param pmbssid     		A pointer to MBSSID IE
+ *  @param pnontx_bssid     A pointer to NonTx BSSID subelement
+ *  @param merged_ie        A pointer to merged NonTx BSSID element
+ *  @param max_copy_len     Maximum IE len in beacon/probe response
+ *  @return                 Length of merged NonTX BSSID element
+ */
+static t_u32
+wlan_merge_nontx_bssid_profile(pmlan_adapter pmadapter,
+			       BSSDescriptor_t *pbss_entry,
+			       IEEEtypes_MultiBSSID_t *pmbssid,
+			       IEEEtypes_NonTransBSSIDProfile_t *pnontx_bssid,
+			       t_u8 *merged_ie, t_u32 max_copy_len)
+{
+	IEEEtypes_MultiBSSID_t *pnext_mbssid = pmbssid;
+	IEEEtypes_NonTransBSSIDProfile_t *pnext_nontx_bssid = pnontx_bssid;
+	t_u32 copied_len = 0;
+	t_u32 ie_len = pbss_entry->beacon_buf_size - BEACON_FIX_SIZE;
+
+	ENTER();
+	if (!pmbssid || !pnontx_bssid) {
+		PRINTM(MERROR, "No MBSSID or NonTx BSSID element present\n");
+		return 0;
+	}
+
+	/* Length error */
+	if (pnontx_bssid->ieee_hdr.len > max_copy_len) {
+		PRINTM(MERROR,
+		       "Invalid NonTxBSSID profile length:%d max_copy_len:%d\n",
+		       pnontx_bssid->ieee_hdr.len, max_copy_len);
+		return 0;
+	}
+
+	copied_len = pnontx_bssid->ieee_hdr.len;
+	/* Copy the 1st part of NonTxBssid profile */
+	PRINTM(MINFO, "NonTxBSSID 1st part length: %d\n",
+	       pnontx_bssid->ieee_hdr.len);
+	memcpy_ext(pmadapter, merged_ie, pnontx_bssid->profile_data,
+		   pnontx_bssid->ieee_hdr.len, pnontx_bssid->ieee_hdr.len);
+
+	/* Check for split nonTxBssid in next MBSSID elem */
+	// coverity[overflow_sink:SUPPRESS]
+	while ((pnext_mbssid = wlan_get_next_mbssid_profile(
+			pbss_entry, ie_len, pnext_mbssid, pnext_nontx_bssid)) !=
+	       MNULL) {
+		// coverity[overflow_sink:SUPPRESS]
+		pnext_nontx_bssid = (IEEEtypes_NonTransBSSIDProfile_t *)
+					    pnext_mbssid->sub_elem_data;
+
+		if (copied_len + pnext_nontx_bssid->ieee_hdr.len >
+		    max_copy_len) {
+			PRINTM(MINFO, "Total length:%d\n",
+			       copied_len + pnext_nontx_bssid->ieee_hdr.len);
+			break;
+		}
+		memcpy_ext(pmadapter, merged_ie + copied_len,
+			   pnext_nontx_bssid->profile_data,
+			   pnext_nontx_bssid->ieee_hdr.len,
+			   pnext_nontx_bssid->ieee_hdr.len);
+		copied_len += pnext_nontx_bssid->ieee_hdr.len;
+		PRINTM(MINFO, "NonTxBSSID next part length: %d\n",
+		       pnext_nontx_bssid->ieee_hdr.len);
+	}
+
+	LEAVE();
+	// coverity[overflow_sink:SUPPRESS]
+	return copied_len;
+}
+
+/**
+ *  @brief This function parses the multi_bssid IE from pbss_entry
  *
  *  @param pmpriv        A pointer to mlan_private structure
- *  @param pbss_entry       A pointer to BSSDescriptor_t which has multi-bssid
- * IE
- *  @param num_in_table     A pointer to buffer to save num of entry in scan
- * table.
+ *  @param pbss_entry    A pointer to BSSDescriptor_t that has Multi-BSSID IE
+ *  @param pmulti_bssid  A pointer to Multi-BSSID IE
+ *  @param num_in_table  A pointer to number entry in the scan table
  *
- *  @return                 number entry in scan table
+ *  @return              void
  */
 static t_void wlan_parse_multi_bssid_ie(mlan_private *pmpriv,
 					BSSDescriptor_t *pbss_entry,
 					IEEEtypes_MultiBSSID_t *pmulti_bssid,
 					t_u32 *num_in_table)
 {
-	t_u32 bytes_left = 0;
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	t_u32 bytes_left = 0, max_copy_len = 0, profile_len = 0;
 	t_u8 *pcurrent_ptr = MNULL;
 	IEEEtypes_NonTransBSSIDProfile_t *pbssid_profile = MNULL;
+	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
+	t_u8 *pmerged_profile = MNULL;
+	t_u8 ret = 0;
 
+	ENTER();
 	if (!pmulti_bssid)
 		return;
+
+	if (pmulti_bssid->ieee_hdr.len < 4) {
+		PRINTM(MINFO, "MBSSID IE length error!\n");
+		return;
+	}
+
+	max_copy_len = pbss_entry->beacon_buf_size - BEACON_FIX_SIZE;
 	bytes_left = pmulti_bssid->ieee_hdr.len - 1;
 	pcurrent_ptr = pmulti_bssid->sub_elem_data;
+
+	/* Allocate memory for the merged profile */
+	// coverity[overflow_sink:SUPPRESS]
+	// coverity[overwrite_var:SUPPRESS]
+	ret = pcb->moal_malloc(pmadapter->pmoal_handle, max_copy_len,
+			       MLAN_MEM_DEF, &pmerged_profile);
+	if (ret != MLAN_STATUS_SUCCESS || !pmerged_profile) {
+		PRINTM(MERROR,
+		       "Memory allocation for pmerged_profile failed!\n");
+		goto done;
+	}
+
 	while (bytes_left >= 2) {
+		/* NonTx BSSID Profile */
 		pbssid_profile =
 			(IEEEtypes_NonTransBSSIDProfile_t *)pcurrent_ptr;
+
 		if (pbssid_profile->ieee_hdr.element_id !=
 		    NONTRANS_BSSID_PROFILE_SUBELEM_ID) {
-			PRINTM(MERROR, "Invalid multi-bssid IE\n");
+			PRINTM(MERROR, "Invalid NonTx BSSID IE\n");
 			break;
 		}
 		if (bytes_left < (t_u32)(pbssid_profile->ieee_hdr.len + 2)) {
-			PRINTM(MERROR, "Invalid multi-bssid IE\n");
+			PRINTM(MERROR, "Invalid NonTx BSSID IE length\n");
 			break;
 		}
-		wlan_parse_non_trans_bssid_profile(
-			pmpriv, pbss_entry, pbssid_profile, num_in_table,
-			pmulti_bssid->max_bssid_indicator);
+
+		/* Check for NonTx BSSID Capability */
+		if (pbssid_profile->profile_data[0] != NONTX_BSSID_CAP) {
+			PRINTM(MERROR,
+			       "The first element within the NonTx BSSID profile is not the "
+			       "NonTx BSSID Capability element\n");
+			pcurrent_ptr += pbssid_profile->ieee_hdr.len + 2;
+			bytes_left -= pbssid_profile->ieee_hdr.len + 2;
+			continue;
+		}
+
+		/* Merge the split nonTxBSSID profiles */
+		profile_len = wlan_merge_nontx_bssid_profile(
+			pmpriv->adapter, pbss_entry, pmulti_bssid,
+			pbssid_profile, pmerged_profile, max_copy_len);
+		PRINTM(MCMND, "Length of Merged profile: %d\n", profile_len);
+		DBG_HEXDUMP(MCMD_D, "Merged NonTx Profile", pmerged_profile,
+			    profile_len);
+
+		/* Generate the NonTx BSSID entry and add to the scan table */
+		// coverity[overflow_sink:SUPPRESS]
+		wlan_gen_non_trans_bssid_profile(
+			pmpriv, pbss_entry, pmerged_profile, profile_len,
+			num_in_table, pmulti_bssid->max_bssid_indicator);
+
 		pcurrent_ptr += pbssid_profile->ieee_hdr.len + 2;
 		bytes_left -= pbssid_profile->ieee_hdr.len + 2;
+
+		// coverity[bad_memset:SUPPRESS]
+		memset(pmadapter, (t_u8 *)pmerged_profile, 0x00, max_copy_len);
 	}
+done:
+	pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)pmerged_profile);
+	LEAVE();
 	return;
 }
 
@@ -5567,11 +6618,13 @@
 			bytes_left = 0;
 			continue;
 		}
-		if (element_id == MULTI_BSSID)
+		if (element_id == MULTI_BSSID) {
+			PRINTM(MINFO, "Found MBSSID IE!!\n");
 			wlan_parse_multi_bssid_ie(
 				pmpriv, pbss_entry,
 				(IEEEtypes_MultiBSSID_t *)pcurrent_ptr,
 				num_in_table);
+		}
 		pcurrent_ptr += total_ie_len;
 		bytes_left -= total_ie_len;
 	}
@@ -5958,7 +7011,7 @@
 	t_u16 tlv_buf_left, tlv_len, tlv_type;
 	MrvlIEtypesHeader_t *tlv;
 	MrvlIEtypes_ChannelStats_t *tlv_chan_stats;
-	t_u8 status;
+	t_u8 status = 0;
 	cmd_ctrl_node *pcmd_node = MNULL;
 
 	ENTER();
@@ -6089,7 +7142,8 @@
 	wlan_release_cmd_lock(pmadapter);
 	wlan_move_cmd_to_cmd_pending_q(pmadapter);
 	pmadapter->bgscan_reported = MFALSE;
-	wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_SCAN_REPORT, MNULL);
+	if (!status)
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_SCAN_REPORT, MNULL);
 	LEAVE();
 	return ret;
 }
@@ -6136,10 +7190,9 @@
  *
  *  @return                 channel number
  */
-static t_u8
-wlan_bgscan_create_channel_list(mlan_private *pmpriv,
-				const wlan_bgscan_cfg *pbg_scan_in,
-				MrvlIEtypes_ChanListParamSet_t *tlv_chan_list)
+static t_u8 wlan_bgscan_create_channel_list(
+	mlan_private *pmpriv, const wlan_bgscan_cfg *pbg_scan_in,
+	MrvlIEtypes_ChanListParamSet_t *tlv_chan_list, t_u8 max_bgscan_chan)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	region_chan_t *pscan_region;
@@ -6178,17 +7231,12 @@
 			if (radio_type && (pscan_region->band != BAND_A))
 				continue;
 		}
-		if ((pbg_scan_in &&
-		     (pbg_scan_in->bss_type == MLAN_SCAN_MODE_IBSS)) ||
-		    pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
-			band = pmadapter->adhoc_start_band;
-		else
-			band = pmpriv->config_bands;
+		band = pmpriv->config_bands;
 		if (!wlan_is_band_compatible(band, pscan_region->band))
 			continue;
 		for (next_chan = 0; next_chan < pscan_region->num_cfp;
 		     next_chan++, chan_idx++) {
-			if (chan_idx >= WLAN_BG_SCAN_CHAN_MAX)
+			if (chan_idx >= max_bgscan_chan)
 				break;
 			/*
 			 * Set the default scan type to ACTIVE SCAN type, will
@@ -6296,6 +7344,7 @@
 	MrvlIETypes_HTCap_t *pht_cap = MNULL;
 	MrvlIETypes_VHTCap_t *pvht_cap = MNULL;
 	MrvlIEtypes_Extension_t *phe_cap = MNULL;
+	MrvlIEtypes_ScanChanGap_t *pscan_gap_tlv;
 	t_u16 len = 0;
 
 	t_u8 index;
@@ -6309,10 +7358,21 @@
 	t_u16 scan_dur;
 	t_u8 scan_type;
 	t_u16 band;
+	t_u8 max_bgscan_chan = 0;
+	t_u16 scan_chan_gap = 0;
 	const t_u8 zero_mac[6] = {0, 0, 0, 0, 0, 0};
 
 	ENTER();
 
+	max_bgscan_chan = WLAN_BG_SCAN_CHAN_MAX;
+
+#if defined(SD9177)
+	if (IS_CARD9177(pmadapter->card_type))
+		max_bgscan_chan = WLAN_BG_SCAN_CHAN_MAX_UNII_4;
+#endif
+
+	PRINTM(MCMND, "max_bgscan_chan=%d\n", max_bgscan_chan);
+
 	pcmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_BG_SCAN_CONFIG);
 	bg_scan->action = wlan_cpu_to_le16(bg_scan_in->action);
 	bg_scan->enable = bg_scan_in->enable;
@@ -6380,6 +7440,21 @@
 		tlv += sizeof(MrvlIEtypes_RepeatCount_t);
 		cmd_size += sizeof(MrvlIEtypes_RepeatCount_t);
 	}
+	scan_chan_gap = (bg_scan_in->scan_chan_gap ? bg_scan_in->scan_chan_gap :
+						     pmadapter->scan_chan_gap);
+	if (scan_chan_gap) {
+		pscan_gap_tlv = (MrvlIEtypes_ScanChanGap_t *)tlv;
+		PRINTM(MCMND, "bgScan: channel gap = 0x%x\n", scan_chan_gap);
+		pscan_gap_tlv->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_SCAN_CHANNEL_GAP);
+		pscan_gap_tlv->header.len = sizeof(pscan_gap_tlv->gap);
+		pscan_gap_tlv->gap = wlan_cpu_to_le16((t_u16)scan_chan_gap);
+		/** indicate FW, gap is optional */
+		pscan_gap_tlv->gap |= GAP_FLAG_OPTIONAL;
+		tlv += sizeof(pscan_gap_tlv->header) +
+		       pscan_gap_tlv->header.len;
+		cmd_size += sizeof(MrvlIEtypes_ScanChanGap_t);
+	}
 	for (ssid_idx = 0; ((ssid_idx < NELEMENTS(bg_scan_in->ssid_list)) &&
 			    (*bg_scan_in->ssid_list[ssid_idx].ssid ||
 			     bg_scan_in->ssid_list[ssid_idx].max_len));
@@ -6403,7 +7478,7 @@
 			    pwildcard_ssid_tlv->header.len;
 		pwildcard_ssid_tlv->header.len =
 			wlan_cpu_to_le16(pwildcard_ssid_tlv->header.len);
-		PRINTM(MINFO, "Scan: ssid_list[%d]: %s, %d\n", ssid_idx,
+		PRINTM(MCMD_D, "bgScan: ssid_list[%d]: %s, %d\n", ssid_idx,
 		       pwildcard_ssid_tlv->ssid,
 		       pwildcard_ssid_tlv->max_ssid_length);
 	}
@@ -6411,15 +7486,11 @@
 		tlv_chan_list = (MrvlIEtypes_ChanListParamSet_t *)tlv;
 		PRINTM(MINFO, "Scan: Using supplied channel list\n");
 		chan_num = 0;
-		for (chan_idx = 0; chan_idx < WLAN_BG_SCAN_CHAN_MAX &&
+		for (chan_idx = 0; chan_idx < max_bgscan_chan &&
 				   bg_scan_in->chan_list[chan_idx].chan_number;
 		     chan_idx++) {
 			radio_type = bg_scan_in->chan_list[chan_idx].radio_type;
-			if (bg_scan_in->bss_type == MLAN_SCAN_MODE_IBSS ||
-			    pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
-				band = pmadapter->adhoc_start_band;
-			else
-				band = pmpriv->config_bands;
+			band = pmpriv->config_bands;
 			if (!wlan_is_band_compatible(
 				    band, radio_type_to_band(radio_type)))
 				continue;
@@ -6467,6 +7538,21 @@
 						pmadapter->specific_scan_time;
 				}
 			}
+			PRINTM(MCMD_D,
+			       "BGScan: Chan(%3d), bandcfg(%x), Mode(%d), Dur(%d)\n",
+			       tlv_chan_list->chan_scan_param[chan_num]
+				       .chan_number,
+			       tlv_chan_list->chan_scan_param[chan_num].bandcfg,
+			       tlv_chan_list->chan_scan_param[chan_num]
+				       .chan_scan_mode.passive_scan,
+			       scan_dur);
+
+			if (tlv_chan_list->chan_scan_param[chan_num]
+				    .chan_scan_mode.passive_scan)
+				tlv_chan_list->chan_scan_param[chan_num]
+					.chan_scan_mode.passive_to_active_scan =
+					MTRUE;
+
 			tlv_chan_list->chan_scan_param[chan_num].min_scan_time =
 				wlan_cpu_to_le16(scan_dur);
 			tlv_chan_list->chan_scan_param[chan_num].max_scan_time =
@@ -6483,8 +7569,8 @@
 			    sizeof(ChanScanParamSet_t) * chan_num;
 	} else {
 		tlv_chan_list = (MrvlIEtypes_ChanListParamSet_t *)tlv;
-		chan_num = wlan_bgscan_create_channel_list(pmpriv, bg_scan_in,
-							   tlv_chan_list);
+		chan_num = wlan_bgscan_create_channel_list(
+			pmpriv, bg_scan_in, tlv_chan_list, max_bgscan_chan);
 		tlv_chan_list->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
 		tlv_chan_list->header.len =
@@ -6495,7 +7581,8 @@
 			    sizeof(ChanScanParamSet_t) * chan_num;
 	}
 	if (bg_scan_in->chan_per_scan) {
-		bg_scan->chan_per_scan = bg_scan_in->chan_per_scan;
+		bg_scan->chan_per_scan =
+			MIN(max_bgscan_chan, bg_scan_in->chan_per_scan);
 	} else {
 		if (bg_scan_in->report_condition & BG_SCAN_WAIT_ALL_CHAN_DONE)
 			bg_scan->chan_per_scan = chan_num;
@@ -6811,7 +7898,8 @@
 			     t_u8 *bssid, t_u32 mode)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
-	t_s32 net = -1, j;
+	t_s32 net = -1;
+	t_s32 j;
 	t_u8 best_rssi = 0;
 	t_u32 i;
 
@@ -6839,7 +7927,6 @@
 
 			switch (mode) {
 			case MLAN_BSS_MODE_INFRA:
-			case MLAN_BSS_MODE_IBSS:
 				j = wlan_is_network_compatible(pmpriv, i, mode);
 
 				if (j >= 0) {
@@ -6922,7 +8009,6 @@
 				continue;
 			switch (mode) {
 			case MLAN_BSS_MODE_INFRA:
-			case MLAN_BSS_MODE_IBSS:
 				net = wlan_is_network_compatible(pmpriv, i,
 								 mode);
 				break;
@@ -7064,8 +8150,6 @@
 		goto done;
 	}
 
-	memset(pmpriv->adapter, pscan_cfg, 0x00, sizeof(wlan_user_scan_cfg));
-
 	memcpy_ext(pmpriv->adapter, pscan_cfg->ssid_list[0].ssid,
 		   preq_ssid->ssid, preq_ssid->ssid_len, MLAN_MAX_SSID_LENGTH);
 	pscan_cfg->keep_previous_scan = MFALSE;
diff --git a/wlan_sd8987/mlan/mlan_sdio.c b/wlan_src/mlan/mlan_sdio.c
old mode 100755
new mode 100644
similarity index 93%
rename from wlan_sd8987/mlan/mlan_sdio.c
rename to wlan_src/mlan/mlan_sdio.c
index e1b6f20..5ed0ec7
--- a/wlan_sd8987/mlan/mlan_sdio.c
+++ b/wlan_src/mlan/mlan_sdio.c
@@ -3,20 +3,29 @@
  *  @brief This file contains SDIO specific code
  *
  *
- *  Copyright 2008-2021, 2023 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -107,6 +116,7 @@
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 0,
 };
 #endif
 
@@ -147,6 +157,7 @@
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 0,
 };
 #endif
 
@@ -217,12 +228,14 @@
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 0,
 };
 #endif
 
 #if defined(SD8977) || defined(SD8997) || defined(SD8987) ||                   \
-	defined(SD9098) || defined(SD9097) || defined(SDNW62X) ||              \
-	defined(SD8978) || defined(SD9177)
+	defined(SD9098) || defined(SD9097) || defined(SDIW624) ||              \
+	defined(SDAW693) || defined(SD8978) || defined(SD9177) ||              \
+	defined(SDIW610)
 static const struct _mlan_sdio_card_reg mlan_reg_sd8977_sd8997 = {
 	.start_rd_port = 0,
 	.start_wr_port = 0,
@@ -297,6 +310,7 @@
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -307,16 +321,29 @@
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
-#ifdef SDNW62X
-static const struct _mlan_card_info mlan_card_info_sdnw62x = {
+#ifdef SDIW624
+static const struct _mlan_card_info mlan_card_info_sdiw624 = {
 	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
 	.v16_fw_api = 1,
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
+};
+#endif
+
+#ifdef SDAW693
+static const struct _mlan_card_info mlan_card_info_sdaw693 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -327,6 +354,7 @@
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 #ifdef SD9177
@@ -336,6 +364,18 @@
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
+};
+#endif
+
+#ifdef SDIW610
+static const struct _mlan_card_info mlan_card_info_sdiw610 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
 };
 #endif
 
@@ -345,6 +385,7 @@
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
 };
 #endif
 
@@ -354,6 +395,7 @@
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
 };
 #endif
 
@@ -976,7 +1018,7 @@
 	t_u8 *firmware = fw;
 	t_u32 firmwarelen = fw_len;
 	t_u32 offset = 0;
-	t_u32 base0 = 0, base1;
+	t_u32 base0 = 0, base1 = 0;
 	t_void *tmpfwbuf = MNULL;
 	t_u32 tmpfwbufsz;
 	t_u8 *fwbuf;
@@ -1015,7 +1057,6 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-	memset(pmadapter, tmpfwbuf, 0, tmpfwbufsz);
 	/* Ensure 8-byte aligned firmware buffer */
 	fwbuf = (t_u8 *)ALIGN_ADDR(tmpfwbuf, DMA_ALIGNMENT);
 #if defined(SD9098)
@@ -1035,9 +1076,12 @@
 			check_fw_status = MTRUE;
 	}
 #endif
-#if defined(SD9097) || defined(SD9177) || defined(SDNW62X)
+#if defined(SD9097) || defined(SD9177) || defined(SDIW624) ||                  \
+	defined(SDAW693) || defined(SDIW610)
 	if (IS_SD9097(pmadapter->card_type) ||
-	    IS_SDNW62X(pmadapter->card_type) || IS_SD9177(pmadapter->card_type))
+	    IS_SDIW624(pmadapter->card_type) ||
+	    IS_SDAW693(pmadapter->card_type) ||
+	    IS_SDIW610(pmadapter->card_type) || IS_SD9177(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
 
@@ -1163,7 +1207,7 @@
 			 * for last block */
 			if (firmwarelen && firmwarelen - offset < txlen)
 				txlen = firmwarelen - offset;
-			PRINTM(MINFO, ".");
+			PRINTM(MINFO, ".\n");
 
 			tx_blocks = (txlen + MLAN_SDIO_BLOCK_SIZE_FW_DNLD - 1) /
 				    MLAN_SDIO_BLOCK_SIZE_FW_DNLD;
@@ -1245,6 +1289,7 @@
 {
 	t_u8 *cmd_buf;
 	t_u32 event;
+	t_u32 offset = 0;
 	t_u32 in_ts_sec, in_ts_usec;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 
@@ -1334,7 +1379,7 @@
 
 	case MLAN_TYPE_CMD:
 		PRINTM(MINFO, "--- Rx: Cmd Response ---\n");
-		if (pmadapter->cmd_sent)
+		if (pmadapter->cmd_sent && !pmadapter->vdll_ctrl.vdll_len)
 			pmadapter->cmd_sent = MFALSE;
 		/* take care of curr_cmd = NULL case */
 		if (!pmadapter->curr_cmd) {
@@ -1372,8 +1417,12 @@
 
 	case MLAN_TYPE_EVENT:
 		PRINTM(MINFO, "--- Rx: Event ---\n");
-		event = *(t_u32 *)&pmbuf->pbuf[pmbuf->data_offset +
-					       SDIO_INTF_HEADER_LEN];
+
+		if (!wlan_secure_add(&pmbuf->data_offset, SDIO_INTF_HEADER_LEN,
+				     &offset, TYPE_UINT32)) {
+			PRINTM(MERROR, "offset is invalid\n");
+		}
+		event = *(t_u32 *)&pmbuf->pbuf[offset];
 		pmadapter->event_cause = wlan_le32_to_cpu(event);
 		if ((pmadapter->upld_len > MLAN_EVENT_HEADER_LEN) &&
 		    ((pmadapter->upld_len - MLAN_EVENT_HEADER_LEN) <
@@ -1901,6 +1950,7 @@
 	t_s32 f_send_cur_buf = 0;
 	t_s32 f_precopy_cur_buf = 0;
 	t_s32 f_postcopy_cur_buf = 0;
+	t_u32 temp = 0;
 	t_u8 aggr_sg = 0;
 	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
 	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
@@ -2019,8 +2069,12 @@
 	if (f_send_cur_buf) {
 		PRINTM(MINFO, "host_2_card_mp_aggr: writing to port #%d\n",
 		       port);
-		ret = wlan_write_data_sync(pmadapter, mbuf,
-					   pmadapter->pcard_sd->ioport + port);
+		if (!wlan_secure_add(&pmadapter->pcard_sd->ioport, port, &temp,
+				     TYPE_UINT32)) {
+			PRINTM(MERROR, "temp is  overflowed\n");
+			return MLAN_STATUS_FAILURE;
+		}
+		ret = wlan_write_data_sync(pmadapter, mbuf, temp);
 		if (!(pmadapter->pcard_sd->mp_wr_bitmap &
 		      (1 << pmadapter->pcard_sd->curr_wr_port)))
 			pmadapter->pcard_sd->mpa_sent_no_ports++;
@@ -2286,10 +2340,6 @@
 		LEAVE();
 		return ret;
 	}
-#ifdef SD9177
-	if (IS_SD9177(pmadapter->card_type))
-		wlan_mdelay(pmadapter, 1000);
-#endif
 done:
 
 	/* re-enable host interrupt for mlan after fw dnld is successful */
@@ -2419,10 +2469,22 @@
 		pmadapter->pcard_info = &mlan_card_info_sd9097;
 		break;
 #endif
-#ifdef SDNW62X
-	case CARD_TYPE_SDNW62X:
+#ifdef SDIW624
+	case CARD_TYPE_SDIW624:
 		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
-		pmadapter->pcard_info = &mlan_card_info_sdnw62x;
+		pmadapter->pcard_info = &mlan_card_info_sdiw624;
+		break;
+#endif
+#ifdef SDAW693
+	case CARD_TYPE_SDAW693:
+		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
+		pmadapter->pcard_info = &mlan_card_info_sdaw693;
+		break;
+#endif
+#ifdef SDIW610
+	case CARD_TYPE_SDIW610:
+		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
+		pmadapter->pcard_info = &mlan_card_info_sdiw610;
 		break;
 #endif
 #ifdef SD9177
@@ -2447,7 +2509,7 @@
  *  @param pmadapter    A pointer to mlan_adapter structure
  *  @return             N/A
  */
-void wlan_dump_mp_registers(pmlan_adapter pmadapter)
+static void wlan_dump_mp_registers(pmlan_adapter pmadapter)
 {
 	t_u32 mp_wr_bitmap;
 	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
@@ -2581,6 +2643,7 @@
 		 * Clear the interrupt status register
 		 */
 		PRINTM(MINTR, "wlan_interrupt: sdio_ireg = 0x%x\n", sdio_ireg);
+		pmadapter->pm_wakeup_timeout = 0;
 		pmadapter->pcard_sd->num_of_irq++;
 		pcb->moal_spin_lock(pmadapter->pmoal_handle,
 				    pmadapter->pint_lock);
@@ -2663,9 +2726,11 @@
  *  @brief This function checks the interrupt status and handle it accordingly.
  *
  *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param type      interrupt type, not used in SDIO
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-static mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
+static mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter,
+						t_u8 type)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -3037,7 +3102,9 @@
 	return ret;
 }
 
-#if (defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177))
+#if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
+	defined(SDAW693) || defined(SD9177) || defined(SD8997) ||              \
+	defined(SD8987) || defined(SD8978) || defined(SDIW610)
 /**
  *  @brief This function sends vdll data to the card.
  *
@@ -3098,7 +3165,9 @@
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_adapter *pmadapter = pmpriv->adapter;
 
-#if (defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177))
+#if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
+	defined(SDAW693) || defined(SD9177) || defined(SD8997) ||              \
+	defined(SD8987) || defined(SD8978) || defined(SDIW610)
 	if (type == MLAN_TYPE_VDLL)
 		return wlan_sdio_send_vdll(pmadapter, pmbuf);
 #endif
@@ -3157,9 +3226,14 @@
 			       pkt_len, block_size);
 			break;
 		}
-		mbuf_deaggr = wlan_alloc_mlan_buffer(
-			pmadapter, pkt_len - SDIO_INTF_HEADER_LEN,
-			MLAN_RX_HEADER_LEN, MOAL_ALLOC_MLAN_BUFFER);
+		if (pkt_len > SDIO_INTF_HEADER_LEN) {
+			mbuf_deaggr = wlan_alloc_mlan_buffer(
+				pmadapter, pkt_len - SDIO_INTF_HEADER_LEN,
+				MLAN_RX_HEADER_LEN, MOAL_ALLOC_MLAN_BUFFER);
+		} else {
+			PRINTM(MERROR, "Invalid packet length error\n");
+		}
+
 		if (mbuf_deaggr == MNULL) {
 			PRINTM(MERROR, "Error allocating daggr mlan_buffer\n");
 			break;
@@ -3215,6 +3289,7 @@
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
+	t_u32 buf_size = 0;
 	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
 
 	ENTER();
@@ -3222,9 +3297,12 @@
 	if ((pmadapter->pcard_sd->max_segs < mp_aggr_pkt_limit) ||
 	    (pmadapter->pcard_sd->max_seg_size <
 	     pmadapter->pcard_sd->max_sp_tx_size)) {
+		if (!wlan_secure_add(&mpa_tx_buf_size, DMA_ALIGNMENT, &buf_size,
+				     TYPE_UINT32))
+			PRINTM(MERROR, "%s:tx_buf_size overflow \n", __func__);
+
 		ret = pcb->moal_malloc(
-			pmadapter->pmoal_handle,
-			mpa_tx_buf_size + DMA_ALIGNMENT,
+			pmadapter->pmoal_handle, buf_size,
 			MLAN_MEM_DEF | MLAN_MEM_DMA,
 			(t_u8 **)&pmadapter->pcard_sd->mpa_tx.head_ptr);
 		if (ret != MLAN_STATUS_SUCCESS ||
@@ -3246,9 +3324,12 @@
 	if ((pmadapter->pcard_sd->max_segs < mp_aggr_pkt_limit) ||
 	    (pmadapter->pcard_sd->max_seg_size <
 	     pmadapter->pcard_sd->max_sp_rx_size)) {
+		if (!wlan_secure_add(&mpa_rx_buf_size, DMA_ALIGNMENT, &buf_size,
+				     TYPE_UINT32))
+			PRINTM(MERROR, "%s:rx_buf_size overflow \n", __func__);
+
 		ret = pcb->moal_malloc(
-			pmadapter->pmoal_handle,
-			mpa_rx_buf_size + DMA_ALIGNMENT,
+			pmadapter->pmoal_handle, buf_size,
 			MLAN_MEM_DEF | MLAN_MEM_DMA,
 			(t_u8 **)&pmadapter->pcard_sd->mpa_rx.head_ptr);
 		if (ret != MLAN_STATUS_SUCCESS ||
@@ -3318,6 +3399,7 @@
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
+	t_u32 buf_size = 0;
 	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
 	t_u32 mpa_rx_buf_size = pmadapter->pcard_sd->mp_tx_aggr_buf_size;
 
@@ -3356,9 +3438,12 @@
 	if ((pmadapter->pcard_sd->max_segs < mp_aggr_pkt_limit) ||
 	    (pmadapter->pcard_sd->max_seg_size <
 	     pmadapter->pcard_sd->max_sp_rx_size)) {
+		if (!wlan_secure_add(&mpa_rx_buf_size, DMA_ALIGNMENT, &buf_size,
+				     TYPE_UINT32))
+			PRINTM(MERROR, "%s:rx_buf_size overflow \n", __func__);
+
 		ret = pcb->moal_malloc(
-			pmadapter->pmoal_handle,
-			mpa_rx_buf_size + DMA_ALIGNMENT,
+			pmadapter->pmoal_handle, buf_size,
 			MLAN_MEM_DEF | MLAN_MEM_DMA,
 			(t_u8 **)&pmadapter->pcard_sd->mpa_rx.head_ptr);
 		if (ret != MLAN_STATUS_SUCCESS ||
@@ -3397,7 +3482,10 @@
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 
 	ENTER();
-	PRINTM(MEVENT, "Wakeup device...\n");
+	if (pmadapter->second_mac)
+		PRINTM(MEVENT, "#2 Wakeup device...\n");
+	else
+		PRINTM(MEVENT, "Wakeup device...\n");
 	pmadapter->callbacks.moal_get_system_time(pmadapter->pmoal_handle,
 						  &pmadapter->pm_wakeup_in_secs,
 						  &age_ts_usec);
@@ -3409,8 +3497,12 @@
 		pmadapter->wakeup_fw_timer_is_set = MTRUE;
 	}
 
-	ret = pcb->moal_write_reg(pmadapter->pmoal_handle,
-				  HOST_TO_CARD_EVENT_REG, HOST_POWER_UP);
+	if (pmadapter->fw_wakeup_method == WAKEUP_FW_THRU_GPIO) {
+		/* GPIO_PORT_TO_LOW(); */
+	} else
+		ret = pcb->moal_write_reg(pmadapter->pmoal_handle,
+					  HOST_TO_CARD_EVENT_REG,
+					  HOST_POWER_UP);
 
 	LEAVE();
 	return ret;
@@ -3430,8 +3522,11 @@
 
 	ENTER();
 
-	ret = pcb->moal_write_reg(pmadapter->pmoal_handle,
-				  HOST_TO_CARD_EVENT_REG, 0);
+	if (pmadapter->fw_wakeup_method == WAKEUP_FW_THRU_GPIO) {
+		/* GPIO_PORT_TO_HIGH(); */
+	} else
+		ret = pcb->moal_write_reg(pmadapter->pmoal_handle,
+					  HOST_TO_CARD_EVENT_REG, 0);
 
 	LEAVE();
 	return ret;
@@ -3561,8 +3656,9 @@
 		goto done;
 	}
 #if defined(SD8997) || defined(SD8977) || defined(SD8987) ||                   \
-	defined(SD9098) || defined(SD9097) || defined(SDNW62X) ||              \
-	defined(SD8978) || defined(SD9177)
+	defined(SD9098) || defined(SD9097) || defined(SDIW624) ||              \
+	defined(SDAW693) || defined(SD8978) || defined(SD9177) ||              \
+	defined(SDIW610)
 	if (MFALSE
 #ifdef SD8997
 	    || IS_SD8997(pmadapter->card_type)
@@ -3582,8 +3678,14 @@
 #ifdef SD9097
 	    || IS_SD9097(pmadapter->card_type)
 #endif
-#ifdef SDNW62X
-	    || IS_SDNW62X(pmadapter->card_type)
+#ifdef SDIW624
+	    || IS_SDIW624(pmadapter->card_type)
+#endif
+#ifdef SDAW693
+	    || IS_SDAW693(pmadapter->card_type)
+#endif
+#ifdef SDIW610
+	    || IS_SDIW610(pmadapter->card_type)
 #endif
 #ifdef SD9177
 	    || IS_SD9177(pmadapter->card_type)
@@ -3625,13 +3727,34 @@
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return          N/A
  */
-static mlan_status wlan_sdio_data_evt_complete(pmlan_adapter pmadapter,
+static mlan_status wlan_sdio_evt_complete(pmlan_adapter pmadapter,
+					  mlan_buffer *pmbuf,
+					  mlan_status status)
+{
+	ENTER();
+	pmadapter->event_cause = 0;
+	pmadapter->pmlan_buffer_event = MNULL;
+	if (pmbuf)
+		wlan_free_mlan_buffer(pmadapter, pmbuf);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handle data/cmd complete
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param pmbuf     A pointer to the mlan_buffer
+ *  @return          N/A
+ */
+static mlan_status wlan_sdio_data_cmd_complete(pmlan_adapter pmadapter,
 					       mlan_buffer *pmbuf,
 					       mlan_status status)
 {
 	ENTER();
-
-	wlan_free_mlan_buffer(pmadapter, pmbuf);
+	if (pmbuf)
+		wlan_free_mlan_buffer(pmadapter, pmbuf);
 
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -3662,9 +3785,9 @@
 	.host_to_card = wlan_sdio_host_to_card_ext,
 	.wakeup_card = wlan_pm_sdio_wakeup_card,
 	.reset_card = wlan_pm_sdio_reset_card,
-	.event_complete = wlan_sdio_data_evt_complete,
-	.data_complete = wlan_sdio_data_evt_complete,
-	.cmdrsp_complete = wlan_sdio_data_evt_complete,
+	.event_complete = wlan_sdio_evt_complete,
+	.data_complete = wlan_sdio_data_cmd_complete,
+	.cmdrsp_complete = wlan_sdio_data_cmd_complete,
 	.handle_rx_packet = wlan_sdio_handle_rx_packet,
 	.disable_host_int = wlan_disable_sdio_host_int,
 	.enable_host_int = wlan_enable_sdio_host_int,
diff --git a/wlan_sd8987/mlan/mlan_sdio.h b/wlan_src/mlan/mlan_sdio.h
old mode 100755
new mode 100644
similarity index 92%
rename from wlan_sd8987/mlan/mlan_sdio.h
rename to wlan_src/mlan/mlan_sdio.h
index 4d0fa3e..09bb18f
--- a/wlan_sd8987/mlan/mlan_sdio.h
+++ b/wlan_src/mlan/mlan_sdio.h
@@ -1,23 +1,31 @@
 /** @file mlan_sdio.h
  *
- * @brief This file contains definitions for SDIO interface.
- * driver.
+ *  @brief This file contains definitions for SDIO interface.
  *
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 /****************************************************
diff --git a/wlan_sd8987/mlan/mlan_shim.c b/wlan_src/mlan/mlan_shim.c
old mode 100755
new mode 100644
similarity index 80%
rename from wlan_sd8987/mlan/mlan_shim.c
rename to wlan_src/mlan/mlan_shim.c
index fdd7140..323996d
--- a/wlan_sd8987/mlan/mlan_shim.c
+++ b/wlan_src/mlan/mlan_shim.c
@@ -2,21 +2,60 @@
  *
  *  @brief This file contains APIs to MOAL module.
  *
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  Copyright 2008-2021 NXP
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/**
+ *  @mainpage MLAN Driver
+ *
+ *  @section overview_sec Overview
+ *
+ *  The MLAN is an OS independent WLAN driver for NXP 802.11
+ *  embedded chipset.
+ *
+ *
+ *  Copyright 2008-2021, 2024 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
  *
  */
 
@@ -44,9 +83,6 @@
 #endif
 #include "mlan_11h.h"
 #include "mlan_11n_rxreorder.h"
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-#include "authenticator_api.h"
-#endif
 
 /********************************************************
 			Local Variables
@@ -320,6 +356,8 @@
 	MASSERT(pcb->moal_hist_data_add);
 	MASSERT(pcb->moal_updata_peer_signal);
 	MASSERT(pcb->moal_do_div);
+
+	MASSERT(pcb->moal_get_host_time_ns);
 	/* Save pmoal_handle */
 	pmadapter->pmoal_handle = pmdevice->pmoal_handle;
 
@@ -328,7 +366,13 @@
 	pmadapter->card_type = pmdevice->card_type;
 	pmadapter->card_rev = pmdevice->card_rev;
 	pmadapter->init_para.uap_max_sta = pmdevice->uap_max_sta;
+	pmadapter->init_para.wacp_mode = pmdevice->wacp_mode;
+	pmadapter->init_para.fw_data_cfg = pmdevice->fw_data_cfg;
 	pmadapter->init_para.mcs32 = pmdevice->mcs32;
+	pmadapter->init_para.antcfg = pmdevice->antcfg;
+	pmadapter->init_para.reject_addba_req = pmdevice->reject_addba_req;
+	pmadapter->init_para.dmcs = pmdevice->dmcs;
+	pmadapter->init_para.pref_dbc = pmdevice->pref_dbc;
 
 #ifdef SDIO
 	if (IS_SD(pmadapter->card_type)) {
@@ -345,10 +389,8 @@
 		}
 		if ((pmdevice->int_mode == INT_MODE_GPIO) &&
 		    (pmdevice->gpio_pin == 0)) {
-			PRINTM(MERROR,
-			       "SDIO_GPIO_INT_CONFIG: Invalid GPIO Pin\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto error;
+			PRINTM(MINFO,
+			       "SDIO_GPIO_INT_CONFIG: FW will duplicate SDIO Intr on GPIO-21\n");
 		}
 		pmadapter->init_para.int_mode = pmdevice->int_mode;
 		pmadapter->init_para.gpio_pin = pmdevice->gpio_pin;
@@ -381,6 +423,10 @@
 			   sizeof(mlan_adapter_operations),
 			   sizeof(mlan_adapter_operations));
 		pmadapter->init_para.ring_size = pmdevice->ring_size;
+		pmadapter->init_para.max_tx_pending = pmdevice->max_tx_pending;
+		pmadapter->init_para.tx_budget = pmdevice->tx_budget;
+		pmadapter->init_para.mclient_scheduling =
+			pmdevice->mclient_scheduling;
 		ret = wlan_get_pcie_device(pmadapter);
 		if (MLAN_STATUS_SUCCESS != ret) {
 			ret = MLAN_STATUS_FAILURE;
@@ -416,6 +462,7 @@
 #endif
 	pmadapter->init_para.auto_ds = pmdevice->auto_ds;
 	pmadapter->init_para.ext_scan = pmdevice->ext_scan;
+	pmadapter->init_para.bootup_cal_ctrl = pmdevice->bootup_cal_ctrl;
 	pmadapter->init_para.ps_mode = pmdevice->ps_mode;
 	if (pmdevice->max_tx_buf == MLAN_TX_DATA_BUF_SIZE_2K ||
 	    pmdevice->max_tx_buf == MLAN_TX_DATA_BUF_SIZE_4K ||
@@ -441,6 +488,8 @@
 	pmadapter->multiple_dtim = pmdevice->multi_dtim;
 	pmadapter->inact_tmo = pmdevice->inact_tmo;
 	pmadapter->init_para.drcs_chantime_mode = pmdevice->drcs_chantime_mode;
+	pmadapter->second_mac = pmdevice->second_mac;
+	pmadapter->napi = pmdevice->napi;
 	pmadapter->hs_wake_interval = pmdevice->hs_wake_interval;
 	if (pmdevice->indication_gpio != 0xff) {
 		pmadapter->ind_gpio = pmdevice->indication_gpio & 0x0f;
@@ -464,6 +513,8 @@
 #endif
 	pmadapter->init_para.dfs53cfg = pmdevice->dfs53cfg;
 	pmadapter->init_para.dfs_offload = pmdevice->dfs_offload;
+	pmadapter->init_para.disable_11h_tpc = pmdevice->disable_11h_tpc;
+	pmadapter->init_para.amsdu_disable = pmdevice->amsdu_disable;
 	pmadapter->priv_num = 0;
 	pmadapter->priv[0] = MNULL;
 
@@ -1039,6 +1090,8 @@
 	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->prx_proc_lock);
 	if (pmadapter->mlan_rx_processing || pmadapter->rx_lock_flag) {
 		pmadapter->more_rx_task_flag = MTRUE;
+		if (rx_pkts)
+			*rx_pkts = 0;
 		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
 				      pmadapter->prx_proc_lock);
 		goto exit_rx_proc;
@@ -1053,18 +1106,6 @@
 rx_process_start:
 	/* Check for Rx data */
 	while (MTRUE) {
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		if (pmadapter->authenticator_priv) {
-			if (IsAuthenticatorEnabled(
-				    pmadapter->authenticator_priv->psapriv)) {
-				AuthenticatorKeyMgmtInit(
-					pmadapter->authenticator_priv->psapriv,
-					pmadapter->authenticator_priv
-						->curr_addr);
-				pmadapter->authenticator_priv = MNULL;
-			}
-		}
-#endif
 		if (pmadapter->flush_data) {
 			pmadapter->flush_data = MFALSE;
 			wlan_flush_rxreorder_tbl(pmadapter);
@@ -1102,12 +1143,24 @@
 			goto rx_process_start;
 		}
 
-		if (pmadapter->delay_task_flag &&
+		if (!IS_PCIE(pmadapter->card_type) &&
+		    pmadapter->delay_task_flag &&
 		    (pmadapter->rx_pkts_queued < LOW_RX_PENDING)) {
 			PRINTM(MEVENT, "Run\n");
 			pmadapter->delay_task_flag = MFALSE;
 			mlan_queue_main_work(pmadapter);
 		}
+#ifdef PCIE
+		if (IS_PCIE(pmadapter->card_type) &&
+		    pmadapter->delay_rx_data_flag &&
+		    (pmadapter->rx_pkts_queued < LOW_RX_PENDING)) {
+			PRINTM(MEVENT, "Run\n");
+			pmadapter->delay_rx_data_flag = MFALSE;
+			wlan_recv_event(wlan_get_priv(pmadapter,
+						      MLAN_BSS_ROLE_ANY),
+					MLAN_EVENT_ID_DRV_DEFER_RX_DATA, MNULL);
+		}
+#endif
 		pmadapter->ops.handle_rx_packet(pmadapter, pmbuf);
 		if (limit && rx_num >= limit)
 			break;
@@ -1179,8 +1232,8 @@
 				pmadapter->pending_disconnect_priv, MTRUE);
 			pmadapter->pending_disconnect_priv = MNULL;
 		}
-#if defined(SDIO) || defined(PCIE)
-		if (!IS_USB(pmadapter->card_type)) {
+#if defined(SDIO)
+		if (IS_SD(pmadapter->card_type)) {
 			if (pmadapter->rx_pkts_queued > HIGH_RX_PENDING) {
 				pcb->moal_tp_accounting_rx_param(
 					pmadapter->pmoal_handle, 2, 0);
@@ -1193,13 +1246,40 @@
 			if (pmadapter->ireg) {
 				if (pmadapter->hs_activated == MTRUE)
 					wlan_process_hs_config(pmadapter);
-				pmadapter->ops.process_int_status(pmadapter);
+				pmadapter->ops.process_int_status(pmadapter, 0);
 				if (pmadapter->data_received)
 					mlan_queue_rx_work(pmadapter);
 			}
 		}
 #endif
+#ifdef PCIE
+		if (IS_PCIE(pmadapter->card_type) &&
+		    pmadapter->pcie_cmd_dnld_int) {
+			pmadapter->pcie_cmd_dnld_int = MFALSE;
+			mlan_process_pcie_interrupt_cb(pmadapter, RX_CMD_DNLD);
+		}
+		if (IS_PCIE(pmadapter->card_type) &&
+		    pmadapter->pcie_event_int) {
+			pmadapter->pcie_event_int = MFALSE;
+			mlan_process_pcie_interrupt_cb(pmadapter, RX_EVENT);
+		}
+#endif
 
+		/* wake up timeout happened */
+		if ((pmadapter->ps_state == PS_STATE_SLEEP) &&
+		    pmadapter->pm_wakeup_flag) {
+			pmadapter->pm_wakeup_flag = MFALSE;
+			if (pmadapter->pm_wakeup_timeout > 2)
+				wlan_recv_event(
+					wlan_get_priv(pmadapter,
+						      MLAN_BSS_ROLE_ANY),
+					MLAN_EVENT_ID_DRV_DBG_DUMP, MNULL);
+			else {
+				pmadapter->ops.wakeup_card(pmadapter, MTRUE);
+				pmadapter->pm_wakeup_fw_try = MTRUE;
+				continue;
+			}
+		}
 		/* Need to wake up the card ? */
 		if ((pmadapter->ps_state == PS_STATE_SLEEP) &&
 		    (pmadapter->pm_wakeup_card_req &&
@@ -1286,11 +1366,24 @@
 		}
 
 		/* Check for event */
+#ifdef USB
+		if (IS_USB(pmadapter->card_type))
+			wlan_request_event_lock(pmadapter);
+#endif
 		if (pmadapter->event_received) {
 			pmadapter->event_received = MFALSE;
+#ifdef USB
+			if (IS_USB(pmadapter->card_type))
+				wlan_release_event_lock(pmadapter);
+#endif
 			wlan_process_event(pmadapter);
 		}
-
+#ifdef USB
+		else {
+			if (IS_USB(pmadapter->card_type))
+				wlan_release_event_lock(pmadapter);
+		}
+#endif
 		/* Check if we need to confirm Sleep Request received previously
 		 */
 		if (pmadapter->ps_state == PS_STATE_PRE_SLEEP)
@@ -1369,7 +1462,19 @@
 			break;
 		}
 #endif
-
+#ifdef PCIE
+		if (IS_PCIE(pmadapter->card_type)) {
+			if (pmadapter->pcard_pcie->reg->use_adma) {
+				if (wlan_is_tx_pending(pmadapter)) {
+					wlan_recv_event(
+						wlan_get_priv(pmadapter,
+							      MLAN_BSS_ROLE_ANY),
+						MLAN_EVENT_ID_DRV_DELAY_TX_COMPLETE,
+						MNULL);
+				}
+			}
+		}
+#endif
 	} while (MTRUE);
 
 	pcb->moal_spin_lock(pmadapter->pmoal_handle,
@@ -1386,12 +1491,85 @@
 
 exit_main_proc:
 	if (pmadapter->hw_status == WlanHardwareStatusClosing)
-		mlan_shutdown_fw(pmadapter);
+		if (MLAN_STATUS_SUCCESS != mlan_shutdown_fw(pmadapter))
+			PRINTM(MERROR, "ERR:mlan_shutdown_fw failed\n");
 	LEAVE();
 	return ret;
 }
 
 /**
+ *  @brief Function to check if llde pkt type matches to defined pkt filter and
+ * mark those pkts
+ *
+ *  @param padapter	A pointer to mlan_adapter structure
+ *  @param pmbuf		A pointer to mlan_buffer structure
+ *
+ *  @return			void
+ */
+static void mlan_check_llde_pkt_filter(mlan_adapter *pmadapter,
+				       pmlan_buffer pmbuf, t_u8 ip_protocol)
+{
+	t_u8 matched_filter = 0;
+	t_u8 i = 0;
+
+	if (!(pmadapter->llde_enabled &&
+	      (pmadapter->llde_mode == MLAN_11AXCMD_LLDE_MODE_EVENT_DRIVEN))) {
+		return;
+	}
+	/* match iphone mac addr */
+	if (pmadapter->llde_device_filter) {
+		for (i = 0; i < pmadapter->llde_totalIPhones; i++) {
+			if (memcmp(pmadapter,
+				   &pmadapter->llde_iphonefilters
+					    [i * MLAN_MAC_ADDR_LENGTH],
+				   (pmbuf->pbuf + pmbuf->data_offset),
+				   MLAN_MAC_ADDR_LENGTH) == 0) {
+				matched_filter = 1;
+				break;
+			}
+		}
+	}
+	if (matched_filter == 0) {
+		/* check mac filter if iphone device filter not matched */
+		for (i = 0; i < pmadapter->llde_totalMacFilters; i++) {
+			if (memcmp(pmadapter,
+				   &pmadapter->llde_macfilters
+					    [i * MLAN_MAC_ADDR_LENGTH],
+				   (pmbuf->pbuf + pmbuf->data_offset),
+				   MLAN_MAC_ADDR_LENGTH) == 0) {
+				matched_filter = 1;
+				break;
+			}
+		}
+	}
+
+	/* device address is matched, check packet type to mark it as special
+	 * llde packet */
+	if (matched_filter) {
+		if ((pmadapter->llde_packet_type == LLDE_FILTER_PKT_ALL) ||
+		    ((pmadapter->llde_packet_type == LLDE_FILTER_PKT_UDP) &&
+		     (ip_protocol == MLAN_IP_PROTOCOL_UDP))) {
+			pmbuf->flags |= MLAN_BUF_FLAG_LLDE_PKT_FILTER;
+		} else if (((pmadapter->llde_packet_type ==
+			     LLDE_FILTER_PKT_TCP_ACK) ||
+			    (pmadapter->llde_packet_type ==
+			     LLDE_FILTER_PKT_TCP_DATA)) &&
+			   (ip_protocol == MLAN_IP_PROTOCOL_TCP)) {
+			/*TODO: identify TCP ACK and Data packets and set the
+			 * MLAN_BUF_FLAG_LLDE_PKT_FILTER flag accordingly */
+			pmbuf->flags |= MLAN_BUF_FLAG_LLDE_PKT_FILTER;
+
+		} else if ((pmadapter->llde_packet_type ==
+			    LLDE_FILTER_PKT_ICMP_PING) &&
+			   (ip_protocol == MLAN_IP_PROTOCOL_ICMP)) {
+			pmbuf->flags |= MLAN_BUF_FLAG_LLDE_PKT_FILTER;
+		}
+	}
+
+	return;
+}
+
+/**
  *  @brief Function to send packet
  *
  *  @param padapter	A pointer to mlan_adapter structure
@@ -1405,6 +1583,7 @@
 	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	mlan_private *pmpriv;
 	t_u16 eth_type = 0;
+	t_u8 ip_protocol = 0;
 	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
 	tdlsStatus_e tdls_status;
 
@@ -1419,15 +1598,52 @@
 	pmbuf->flags |= MLAN_BUF_FLAG_MOAL_TX_BUF;
 	pmpriv = pmadapter->priv[pmbuf->bss_index];
 
+	if (pmbuf->data_offset > UINT32_MAX - MLAN_ETHER_PKT_TYPE_OFFSET)
+		return MLAN_STATUS_FAILURE;
 	eth_type =
 		mlan_ntohs(*(t_u16 *)&pmbuf->pbuf[pmbuf->data_offset +
 						  MLAN_ETHER_PKT_TYPE_OFFSET]);
-	if (((pmadapter->priv[pmbuf->bss_index]->port_ctrl_mode == MTRUE) &&
-	     ((eth_type == MLAN_ETHER_PKT_TYPE_EAPOL) ||
-	      (eth_type == MLAN_ETHER_PKT_TYPE_ARP) ||
-	      (eth_type == MLAN_ETHER_PKT_TYPE_WAPI))) ||
+
+#ifdef UAP_SUPPORT
+	/** Identify ICMP packet from ETH_IP packet. ICMP packet in IP header
+	 * Protocol field is 0x01 */
+	/** Enable the ICMP_VIA_BYPASS_TXQ only if wacp_mode is enabled */
+	if ((pmadapter->init_para.wacp_mode) &&
+	    ((pmpriv->bss_role == MLAN_BSS_ROLE_UAP) &&
+	     pmpriv->uap_bss_started)) {
+		if (eth_type == MLAN_ETHER_PKT_TYPE_IP) {
+			ip_protocol =
+				*((t_u8 *)(pmbuf->pbuf + pmbuf->data_offset +
+					   MLAN_ETHER_PKT_TYPE_OFFSET +
+					   MLAN_IP_PROTOCOL_OFFSET));
+			if (ip_protocol == MLAN_IP_PROTOCOL_ICMP) {
+				pmbuf->priority = WMM_HIGHEST_PRIORITY;
+				/** If LLDE Enabled, change the ICMP Prio to 6
+				 */
+				if (pmadapter->llde_enabled &&
+				    (pmadapter->llde_mode ==
+				     MLAN_11AXCMD_LLDE_MODE_EVENT_DRIVEN))
+					pmbuf->priority =
+						WMM_SECOND_HIGHEST_PRIORITY;
+			}
+
+			mlan_check_llde_pkt_filter(pmadapter, pmbuf,
+						   ip_protocol);
+		}
+	}
+#endif
+
+	if ((eth_type == MLAN_ETHER_PKT_TYPE_EAPOL) ||
+	    (eth_type == MLAN_ETHER_PKT_TYPE_ARP) ||
+	    (eth_type == MLAN_ETHER_PKT_TYPE_WAPI)
+	    /** Send ICMP packet via bypass_txqueue to reduce long ping latency
+	     */
+	    || (ip_protocol == MLAN_IP_PROTOCOL_ICMP) ||
 	    (eth_type == MLAN_ETHER_PKT_TYPE_TDLS_ACTION) ||
+	    (eth_type == MLAN_ETHER_PKT_TYPE_1905) ||
 	    (pmbuf->buf_type == MLAN_BUF_TYPE_RAW_DATA)
+	    /* Adding the Ucast/Mcast pkt to bypass queue when flag is set*/
+	    || (pmbuf->flags & MLAN_BUF_FLAG_MC_AGGR_PKT)
 
 	) {
 		if (eth_type == MLAN_ETHER_PKT_TYPE_TDLS_ACTION) {
@@ -1440,10 +1656,38 @@
 				pmbuf->flags |= MLAN_BUF_FLAG_TDLS;
 		}
 		if (eth_type == MLAN_ETHER_PKT_TYPE_EAPOL) {
+			pmbuf->priority = 7;
 			PRINTM_NETINTF(MMSG, pmpriv);
 			PRINTM(MMSG, "wlan: Send EAPOL pkt to " MACSTR "\n",
 			       MAC2STR(pmbuf->pbuf + pmbuf->data_offset));
 		}
+
+		if (eth_type == MLAN_ETHER_PKT_TYPE_1905) {
+			t_u16 msg_type = 0;
+
+			if (pmbuf->data_offset >
+			    UINT32_MAX - MLAN_ETHER_PKT_TYPE_OFFSET - 4)
+				return MLAN_STATUS_FAILURE;
+
+			msg_type = mlan_ntohs(
+				*(t_u16 *)&pmbuf
+					 ->pbuf[pmbuf->data_offset +
+						MLAN_ETHER_PKT_TYPE_OFFSET + 4]);
+
+			if (msg_type == 0x0007 || /* CMDU_TYPE_AP_AUTOCONFIGURATION_SEARCH
+						   */
+			    msg_type == 0x0008 || /* CMDU_TYPE_AP_AUTOCONFIGURATION_RESPONSE
+						   */
+			    msg_type == 0x0009) { /* CMDU_TYPE_AP_AUTOCONFIGURATION_WSC
+						   */
+				pmbuf->priority = 7;
+				PRINTM_NETINTF(MMSG, pmpriv);
+				PRINTM(MMSG,
+				       "wlan: Send 1905.1a pkt type: 0x%04x\n",
+				       msg_type);
+			}
+		}
+
 		if (pmadapter->tp_state_on)
 			pmadapter->callbacks.moal_tp_accounting(
 				pmadapter->pmoal_handle, pmbuf->pdesc, 2);
@@ -1467,6 +1711,22 @@
 }
 
 /**
+ *  @brief clean up txrx
+ *
+ *  @param adapter	A pointer to mlan_adapter structure
+ *
+ *  @return		N/A
+ */
+static t_void wlan_free_txrx(pmlan_adapter pmadapter)
+{
+	t_u8 i;
+	for (i = 0; i < pmadapter->priv_num; i++) {
+		if (pmadapter->priv[i])
+			wlan_clean_txrx(pmadapter->priv[i]);
+	}
+}
+
+/**
  *  @brief MLAN ioctl handler
  *
  *  @param adapter	A pointer to mlan_adapter structure
@@ -1484,13 +1744,9 @@
 	ENTER();
 
 	if (pioctl_req == MNULL) {
-		PRINTM(MMSG, "Cancel all pending cmd!\n");
+		PRINTM(MMSG, "Cancel all pending cmd and txrx queue\n");
 		wlan_cancel_all_pending_cmd(pmadapter, MFALSE);
-		goto exit;
-	}
-	if (pioctl_req->action == MLAN_ACT_CANCEL) {
-		wlan_cancel_pending_ioctl(pmadapter, pioctl_req);
-		ret = MLAN_STATUS_SUCCESS;
+		wlan_free_txrx(pmadapter);
 		goto exit;
 	}
 	pmpriv = pmadapter->priv[pioctl_req->bss_index];
@@ -1624,11 +1880,13 @@
 			if ((len > 0) && (len < MAX_EVENT_SIZE))
 				memmove(pmadapter, pmadapter->event_body, pbuf,
 					len);
-			pmadapter->event_received = MTRUE;
-			pmadapter->pmlan_buffer_event = pmbuf;
+			wlan_request_event_lock(pmadapter);
 			/* remove 4 byte recv_type */
 			pmbuf->data_offset += MLAN_TYPE_LEN;
 			pmbuf->data_len -= MLAN_TYPE_LEN;
+			pmadapter->event_received = MTRUE;
+			pmadapter->pmlan_buffer_event = pmbuf;
+			wlan_release_event_lock(pmadapter);
 			/* MOAL to call mlan_main_process for processing */
 			break;
 		default:
@@ -1862,4 +2120,85 @@
 	pmadapter->pcard_pcie->func_num = func_num;
 	LEAVE();
 }
+
+/**
+ *  @brief This function handle RX/EVENT/CMDRESP/TX_COMPLETE interrupt.
+ *
+ *  @param adapter  A pointer to mlan_adapter structure
+ *  @param type     interrupt type
+ *  @return         N/A
+ */
+void mlan_process_pcie_interrupt_cb(t_void *padapter, int type)
+{
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+
+	ENTER();
+
+	if (type == RX_DATA) {
+		if ((pmadapter->ps_state == PS_STATE_SLEEP) ||
+		    (pmadapter->ps_state == PS_STATE_SLEEP_CFM)) {
+			LEAVE();
+			return;
+		}
+
+		if (pmadapter->rx_pkts_queued > HIGH_RX_PENDING) {
+			pcb->moal_tp_accounting_rx_param(
+				pmadapter->pmoal_handle, 2, 0);
+			PRINTM(MEVENT, "Pause\n");
+			pmadapter->delay_rx_data_flag = MTRUE;
+			if (pmadapter->napi)
+				mlan_queue_rx_work(pmadapter);
+			else
+				mlan_rx_process(pmadapter, MNULL);
+			LEAVE();
+			return;
+		}
+	} else if (type == TX_COMPLETE && !wlan_is_tx_pending(pmadapter)) {
+		LEAVE();
+		return;
+	} else if (type == RX_DATA_DELAY) {
+		PRINTM(MEVENT, "Delay Rx DATA\n");
+		pcb->moal_spin_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_rx_lock);
+		pmadapter->pcard_pcie->rx_pending = MFALSE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_rx_lock);
+		LEAVE();
+		return;
+	}
+	pmadapter->ops.process_int_status(pmadapter, type);
+	switch (type) {
+	case RX_DATA: // Rx Data
+		if (pmadapter->rx_pkts_queued) {
+			if (pmadapter->napi)
+				mlan_queue_rx_work(pmadapter);
+			else
+				mlan_rx_process(pmadapter, MNULL);
+		}
+		break;
+	case TX_COMPLETE: // Tx data complete
+		wlan_recv_event(wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY),
+				MLAN_EVENT_ID_DRV_DEFER_HANDLING, MNULL);
+		if (pmadapter->pcard_pcie->reg->use_adma) {
+			if (wlan_is_tx_pending(pmadapter))
+				wlan_recv_event(
+					wlan_get_priv(pmadapter,
+						      MLAN_BSS_ROLE_ANY),
+					MLAN_EVENT_ID_DRV_DELAY_TX_COMPLETE,
+					MNULL);
+		}
+		break;
+	case RX_CMD_RESP: // Rx CMD Resp
+		if (mlan_main_process(pmadapter) == MLAN_STATUS_FAILURE)
+			PRINTM(MERROR, "mlan_main_process failed.\n");
+		break;
+	case RX_CMD_DNLD:
+	case RX_EVENT:
+	default:
+		break;
+	}
+	LEAVE();
+	return;
+}
 #endif
diff --git a/wlan_sd8987/mlan/mlan_sta_cmd.c b/wlan_src/mlan/mlan_sta_cmd.c
old mode 100755
new mode 100644
similarity index 92%
rename from wlan_sd8987/mlan/mlan_sta_cmd.c
rename to wlan_src/mlan/mlan_sta_cmd.c
index 3550bff..3fcb9f8
--- a/wlan_sd8987/mlan/mlan_sta_cmd.c
+++ b/wlan_src/mlan/mlan_sta_cmd.c
@@ -5,20 +5,29 @@
  *  it is ready.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -242,6 +251,18 @@
 			cmd->size += sizeof(t_u16);
 		}
 		break;
+	case Dot11h_disable_tpc_i:
+		psnmp_mib->oid = wlan_cpu_to_le16((t_u16)Dot11h_disable_tpc_i);
+		if (cmd_action == HostCmd_ACT_GEN_SET) {
+			psnmp_mib->query_type =
+				wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);
+			psnmp_mib->buf_size = wlan_cpu_to_le16(sizeof(t_u16));
+			ul_temp = *(t_u32 *)pdata_buf;
+			*((t_u16 *)(psnmp_mib->value)) =
+				wlan_cpu_to_le16((t_u16)ul_temp);
+			cmd->size += sizeof(t_u16);
+		}
+		break;
 	case WwsMode_i:
 		psnmp_mib->oid = wlan_cpu_to_le16((t_u16)WwsMode_i);
 		if (cmd_action == HostCmd_ACT_GEN_SET) {
@@ -406,9 +427,11 @@
 		mcmd->short_preamble = wlan_cpu_to_le32(cfg->short_preamble);
 		mcmd->act_sub_ch = wlan_cpu_to_le32(cfg->act_sub_ch);
 		mcmd->short_gi = wlan_cpu_to_le32(cfg->short_gi);
+		mcmd->adv_coding = wlan_cpu_to_le32(cfg->adv_coding);
 		mcmd->tx_bf = wlan_cpu_to_le32(cfg->tx_bf);
 		mcmd->gf_mode = wlan_cpu_to_le32(cfg->gf_mode);
 		mcmd->stbc = wlan_cpu_to_le32(cfg->stbc);
+		mcmd->signal_bw = wlan_cpu_to_le32(cfg->signal_bw);
 		mcmd->NumPkt = wlan_cpu_to_le32(cfg->NumPkt);
 		mcmd->MaxPE = wlan_cpu_to_le32(cfg->MaxPE);
 		mcmd->BeamChange = wlan_cpu_to_le32(cfg->BeamChange);
@@ -484,8 +507,9 @@
  *  @return             MLAN_STATUS_SUCCESS
  */
 
-mlan_status wlan_cmd_mfg_he_tb_tx(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
-				  t_u16 action, t_void *pdata_buf)
+static mlan_status wlan_cmd_mfg_he_tb_tx(pmlan_private pmpriv,
+					 HostCmd_DS_COMMAND *cmd, t_u16 action,
+					 t_void *pdata_buf)
 {
 	struct mfg_Cmd_HE_TBTx_t *mcmd =
 		(struct mfg_Cmd_HE_TBTx_t *)&cmd->params.mfg_he_power;
@@ -510,6 +534,81 @@
 }
 
 /**
+ *  @brief This function prepares command of MFG OTP RW.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param action       The action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+
+static mlan_status wlan_cmd_mfg_otp_rw(pmlan_private pmpriv,
+				       HostCmd_DS_COMMAND *cmd, t_u16 action,
+				       t_void *pdata_buf)
+{
+	mfg_cmd_otp_mac_addr_rd_wr_t *mcmd =
+		(mfg_cmd_otp_mac_addr_rd_wr_t *)&cmd->params
+			.mfg_otp_mac_addr_rd_wr;
+	mfg_cmd_otp_mac_addr_rd_wr_t *cfg =
+		(mfg_cmd_otp_mac_addr_rd_wr_t *)pdata_buf;
+
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_MFG_COMMAND);
+	cmd->size = wlan_cpu_to_le16(sizeof(mfg_cmd_otp_mac_addr_rd_wr_t) +
+				     S_DS_GEN);
+
+	mcmd->mfg_cmd = wlan_cpu_to_le32(cfg->mfg_cmd);
+	mcmd->action = wlan_cpu_to_le16(cfg->action);
+	if (action == HostCmd_ACT_GEN_SET) {
+		memcpy_ext(pmpriv->adapter, mcmd->mac_addr, cfg->mac_addr,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command of MFG OTP CAL DATA RW.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param action       The action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+
+static mlan_status wlan_cmd_mfg_otp_cal_data_rw(pmlan_private pmpriv,
+						HostCmd_DS_COMMAND *cmd,
+						t_u16 action, t_void *pdata_buf)
+{
+	mfg_cmd_otp_cal_data_rd_wr_t *mcmd =
+		(mfg_cmd_otp_cal_data_rd_wr_t *)&cmd->params
+			.mfg_otp_cal_data_rd_wr;
+	mfg_cmd_otp_cal_data_rd_wr_t *cfg =
+		(mfg_cmd_otp_cal_data_rd_wr_t *)pdata_buf;
+
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_MFG_COMMAND);
+	cmd->size = wlan_cpu_to_le16(sizeof(mfg_cmd_otp_cal_data_rd_wr_t) +
+				     S_DS_GEN);
+
+	mcmd->mfg_cmd = wlan_cpu_to_le32(cfg->mfg_cmd);
+	mcmd->action = wlan_cpu_to_le16(cfg->action);
+	mcmd->cal_data_status = wlan_cpu_to_le32(cfg->cal_data_status);
+	mcmd->cal_data_len = wlan_cpu_to_le32(cfg->cal_data_len);
+	if (action == HostCmd_ACT_GEN_SET) {
+		memcpy_ext(pmpriv->adapter, mcmd->cal_data, cfg->cal_data,
+			   mcmd->cal_data_len, mcmd->cal_data_len);
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function prepares command of MFG cmd.
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -548,6 +647,13 @@
 		ret = wlan_cmd_mfg_config_trigger_frame(pmpriv, cmd, action,
 							pdata_buf);
 		goto cmd_mfg_done;
+	case MFG_CMD_OTP_MAC_ADD:
+		ret = wlan_cmd_mfg_otp_rw(pmpriv, cmd, action, pdata_buf);
+		goto cmd_mfg_done;
+	case MFG_CMD_OTP_CAL_DATA:
+		ret = wlan_cmd_mfg_otp_cal_data_rw(pmpriv, cmd, action,
+						   pdata_buf);
+		goto cmd_mfg_done;
 	case MFG_CMD_SET_TEST_MODE:
 	case MFG_CMD_UNSET_TEST_MODE:
 	case MFG_CMD_TX_ANT:
@@ -1002,6 +1108,10 @@
 	HostCmd_DS_MAC_MULTICAST_ADR *pmc_addr = &cmd->params.mc_addr;
 
 	ENTER();
+	if (!pdata_buf) {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
 	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_MAC_MULTICAST_ADR) +
 				     S_DS_GEN);
 	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_MAC_MULTICAST_ADR);
@@ -1064,29 +1174,6 @@
 }
 
 /**
- *  @brief This function prepares command of ad_hoc_stop.
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
- *
- *  @return             MLAN_STATUS_SUCCESS
- */
-static mlan_status wlan_cmd_802_11_ad_hoc_stop(pmlan_private pmpriv,
-					       HostCmd_DS_COMMAND *cmd)
-{
-	ENTER();
-
-	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_AD_HOC_STOP);
-	cmd->size = wlan_cpu_to_le16(S_DS_GEN);
-
-	if (wlan_11h_is_active(pmpriv))
-		wlan_11h_activate(pmpriv, MNULL, MFALSE);
-
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
-/**
  *  @brief This function prepares command of key_material.
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -1165,7 +1252,7 @@
 		PRINTM(MCMND, "Remove Key\n");
 		goto done;
 	}
-	pkey_material->action = wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);
+	pkey_material->action = wlan_cpu_to_le16(cmd_action);
 	pkey_material->key_param_set.key_idx = pkey->key_index & KEY_INDEX_MASK;
 	pkey_material->key_param_set.type =
 		wlan_cpu_to_le16(TLV_TYPE_KEY_PARAM_V2);
@@ -1281,7 +1368,7 @@
 					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
 					     sizeof(gcmp_param) +
 					     sizeof(pkey_material->action));
-
+		PRINTM(MCMND, "Set GCMP Key\n");
 		goto done;
 	}
 	if (pkey->key_flags & KEY_FLAG_CCMP_256) {
@@ -1305,7 +1392,7 @@
 					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
 					     sizeof(ccmp_256_param) +
 					     sizeof(pkey_material->action));
-
+		PRINTM(MCMND, "Set CCMP256 Key\n");
 		goto done;
 	}
 	if (pkey->key_len == WPA_AES_KEY_LEN &&
@@ -1372,7 +1459,7 @@
 		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID))
 			memcpy_ext(pmpriv->adapter,
 				   pkey_material->key_param_set.key_params
-					   .cmac_aes.ipn,
+					   .gmac_aes.ipn,
 				   pkey->pn, SEQ_MAX_SIZE, IGTK_PN_SIZE);
 		pkey_material->key_param_set.key_info &=
 			~(wlan_cpu_to_le16(KEY_INFO_MCAST_KEY));
@@ -1380,10 +1467,10 @@
 			wlan_cpu_to_le16(KEY_INFO_AES_MCAST_IGTK);
 		pkey_material->key_param_set.key_type =
 			KEY_TYPE_ID_BIP_GMAC_256;
-		pkey_material->key_param_set.key_params.cmac_aes.key_len =
+		pkey_material->key_param_set.key_params.gmac_aes.key_len =
 			wlan_cpu_to_le16(pkey->key_len);
 		memcpy_ext(pmpriv->adapter,
-			   pkey_material->key_param_set.key_params.cmac_aes.key,
+			   pkey_material->key_param_set.key_params.gmac_aes.key,
 			   pkey->key_material, pkey->key_len,
 			   WPA_IGTK_256_KEY_LEN);
 		pkey_material->key_param_set.length = wlan_cpu_to_le16(
@@ -1594,8 +1681,7 @@
 				     S_DS_GEN);
 
 	if (cmd_action == HostCmd_ACT_GEN_SET) {
-		if ((pmpriv->adapter->adhoc_start_band & BAND_A))
-			prf_chan->rf_type.bandcfg.chanBand = BAND_5GHZ;
+		prf_chan->rf_type.bandcfg.chanBand = BAND_5GHZ;
 		prf_chan->rf_type.bandcfg.chanWidth =
 			pmpriv->adapter->chan_bandwidth;
 		prf_chan->current_channel =
@@ -1607,51 +1693,6 @@
 }
 
 /**
- *  @brief This function prepares command of ibss_coalescing_status.
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
- *  @param cmd_action   The action: GET or SET
- *  @param pdata_buf    A pointer to data buffer or MNULL
- *
- *  @return             MLAN_STATUS_SUCCESS
- */
-static mlan_status wlan_cmd_ibss_coalescing_status(pmlan_private pmpriv,
-						   HostCmd_DS_COMMAND *cmd,
-						   t_u16 cmd_action,
-						   t_void *pdata_buf)
-{
-	HostCmd_DS_802_11_IBSS_STATUS *pibss_coal =
-		&(cmd->params.ibss_coalescing);
-	t_u16 enable = 0;
-
-	ENTER();
-
-	cmd->command =
-		wlan_cpu_to_le16(HostCmd_CMD_802_11_IBSS_COALESCING_STATUS);
-	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_802_11_IBSS_STATUS) +
-				     S_DS_GEN);
-	cmd->result = 0;
-	pibss_coal->action = wlan_cpu_to_le16(cmd_action);
-
-	switch (cmd_action) {
-	case HostCmd_ACT_GEN_SET:
-		if (pdata_buf != MNULL)
-			enable = *(t_u16 *)pdata_buf;
-		pibss_coal->enable = wlan_cpu_to_le16(enable);
-		break;
-
-	/* In other case.. Nothing to do */
-	case HostCmd_ACT_GEN_GET:
-	default:
-		break;
-	}
-
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
-/**
  *  @brief This function prepares command of mgmt IE list.
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -2615,7 +2656,7 @@
 	memset(pmadapter, usb_aggr_param_tlv, 0,
 	       MRVL_USB_AGGR_PARAM_TLV_LEN + sizeof(MrvlIEtypesHeader_t));
 	usb_aggr_param_tlv->header.type =
-		wlan_cpu_to_le16(MRVL_USB_AGGR_PARAM_TLV_ID);
+		wlan_cpu_to_le16(NXP_USB_AGGR_PARAM_TLV_ID);
 	usb_aggr_param_tlv->header.len =
 		wlan_cpu_to_le16(MRVL_USB_AGGR_PARAM_TLV_LEN);
 	cmd->size = wlan_cpu_to_le16(
@@ -2689,6 +2730,8 @@
 			wlan_cpu_to_le16((t_u16)inac_to->mcast_timeout);
 		cmd_inac_to->ps_entry_timeout =
 			wlan_cpu_to_le16((t_u16)inac_to->ps_entry_timeout);
+		cmd_inac_to->ps_cmd_timeout =
+			wlan_cpu_to_le16((t_u16)inac_to->ps_cmd_timeout);
 	}
 
 	LEAVE();
@@ -2718,13 +2761,14 @@
 	net_mon = (mlan_ds_misc_net_monitor *)pdata_buf;
 
 	cmd->size = wlan_cpu_to_le16(S_DS_GEN +
-				     sizeof(HostCmd_DS_802_11_NET_MONITOR));
+				     sizeof(HostCmd_DS_802_11_NET_MONITOR) +
+				     sizeof(ChanBandParamSet_t));
 	cmd->command = wlan_cpu_to_le16(cmd->command);
 	cmd_net_mon->action = wlan_cpu_to_le16(cmd_action);
 	if (cmd_action == HostCmd_ACT_GEN_SET) {
 		if (net_mon->enable_net_mon) {
 			cmd_net_mon->enable_net_mon =
-				wlan_cpu_to_le16((t_u16)NET_MON_MODE1);
+				wlan_cpu_to_le16((t_u16)NET_MON_MODE3);
 			cmd_net_mon->filter_flag =
 				wlan_cpu_to_le16((t_u16)net_mon->filter_flag);
 		}
@@ -2984,14 +3028,16 @@
  *  @return             N/A
  */
 
-mlan_status wlan_cmd_ipv6_ra_offload(mlan_private *pmpriv,
-				     HostCmd_DS_COMMAND *pcmd, t_u16 cmd_action,
-				     void *pdata_buf)
+static mlan_status wlan_cmd_ipv6_ra_offload(mlan_private *pmpriv,
+					    HostCmd_DS_COMMAND *pcmd,
+					    t_u16 cmd_action, void *pdata_buf)
 {
 	HostCmd_DS_IPV6_RA_OFFLOAD *ipv6_ra_cfg = &pcmd->params.ipv6_ra_offload;
 	mlan_ds_misc_ipv6_ra_offload *ipv6_ra_offload =
 		(mlan_ds_misc_ipv6_ra_offload *)pdata_buf;
 	MrvlIEtypesHeader_t *ie = &ipv6_ra_cfg->ipv6_addr_param.Header;
+	t_u8 *pipv6addrs = ipv6_ra_cfg->ipv6_addr_param.ipv6_addrs;
+	t_u8 *psrcipv6addr = ipv6_ra_offload->ipv6_addrs;
 
 	ENTER();
 
@@ -3000,13 +3046,16 @@
 	if (cmd_action == HostCmd_ACT_GEN_SET) {
 		ipv6_ra_cfg->enable = ipv6_ra_offload->enable;
 		ie->type = wlan_cpu_to_le16(TLV_TYPE_IPV6_RA_OFFLOAD);
-		ie->len = wlan_cpu_to_le16(16);
-		memcpy_ext(pmpriv->adapter,
-			   ipv6_ra_cfg->ipv6_addr_param.ipv6_addr,
-			   ipv6_ra_offload->ipv6_addr, 16,
-			   sizeof(ipv6_ra_cfg->ipv6_addr_param.ipv6_addr));
+		ipv6_ra_cfg->ipv6_addr_count =
+			ipv6_ra_offload->ipv6_addrs_count;
+		memcpy_ext(pmpriv->adapter, pipv6addrs, psrcipv6addr,
+			   (ipv6_ra_offload->ipv6_addrs_count * IPADDR_LEN),
+			   (ipv6_ra_offload->ipv6_addrs_count * IPADDR_LEN));
+		ie->len = wlan_cpu_to_le16(16 *
+					   ipv6_ra_offload->ipv6_addrs_count);
 		pcmd->size = wlan_cpu_to_le16(
-			S_DS_GEN + sizeof(HostCmd_DS_IPV6_RA_OFFLOAD));
+			S_DS_GEN + sizeof(HostCmd_DS_IPV6_RA_OFFLOAD) +
+			(IPADDR_LEN * ipv6_ra_cfg->ipv6_addr_count));
 	} else if (cmd_action == HostCmd_ACT_GEN_GET)
 		pcmd->size = wlan_cpu_to_le16(S_DS_GEN +
 					      sizeof(ipv6_ra_cfg->action));
@@ -3315,7 +3364,7 @@
 		pos += sizeof(MrvlIEtypes_RepeatCount_t);
 	}
 	LEAVE();
-	return (pos - begin);
+	return ((t_u16)(pos - begin));
 }
 /**
  *  @brief This function sends enable/disable roam offload command to firmware.
@@ -3458,6 +3507,8 @@
 	MrvlIEtypes_Keep_Alive_Ctrl_t *ctrl_tlv = MNULL;
 	MrvlIEtypes_Keep_Alive_Pkt_t *pkt_tlv = MNULL;
 	mlan_ds_misc_keep_alive *misc_keep_alive = MNULL;
+	MrvlIEtypes_Cloud_Keep_Alive_Rx_t *keep_alive_Rx_tlv = MNULL;
+	mlan_ds_misc_keep_alive_rx *misc_keep_alive_rx = MNULL;
 	t_u8 eth_ip[] = {0x08, 0x00};
 
 	ENTER();
@@ -3555,6 +3606,46 @@
 		cmd->size = cmd->size + len + sizeof(MrvlIEtypesHeader_t);
 		cmd->size = wlan_cpu_to_le16(cmd->size);
 		break;
+	case OID_CLOUD_KEEP_ALIVE_ACK:
+		misc_keep_alive_rx = (mlan_ds_misc_keep_alive_rx *)pdata_buf;
+		keep_alive_Rx_tlv = (MrvlIEtypes_Cloud_Keep_Alive_Rx_t *)pos;
+		keep_alive_Rx_tlv->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_CLOUD_KEEP_ALIVE_ACK);
+		keep_alive_Rx_tlv->keep_alive_id =
+			misc_keep_alive_rx->mkeep_alive_id;
+		keep_alive_Rx_tlv->enable = misc_keep_alive_rx->enable;
+		memcpy_ext(pmpriv->adapter,
+			   keep_alive_Rx_tlv->eth_header.dest_addr,
+			   misc_keep_alive_rx->dst_mac, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+		memcpy_ext(pmpriv->adapter,
+			   keep_alive_Rx_tlv->eth_header.src_addr,
+			   misc_keep_alive_rx->src_mac, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+		memcpy_ext(pmpriv->adapter,
+			   (t_u8 *)&keep_alive_Rx_tlv->eth_header.h803_len,
+			   eth_ip, sizeof(t_u16), sizeof(t_u16));
+		if (misc_keep_alive_rx->ether_type)
+			keep_alive_Rx_tlv->eth_header.h803_len =
+				mlan_htons(misc_keep_alive_rx->ether_type);
+		else
+			memcpy_ext(
+				pmpriv->adapter,
+				(t_u8 *)&keep_alive_Rx_tlv->eth_header.h803_len,
+				eth_ip, sizeof(t_u16), sizeof(t_u16));
+		memcpy_ext(pmpriv->adapter,
+			   (t_u8 *)&keep_alive_Rx_tlv->ip_packet,
+			   misc_keep_alive_rx->packet,
+			   misc_keep_alive_rx->pkt_len,
+			   MKEEP_ALIVE_ACK_PKT_MAX);
+
+		len = sizeof(MrvlIEtypes_Cloud_Keep_Alive_Rx_t) +
+		      misc_keep_alive_rx->pkt_len - sizeof(MrvlIEtypesHeader_t);
+		keep_alive_Rx_tlv->header.len = wlan_cpu_to_le16(len);
+
+		cmd->size = cmd->size + len + sizeof(MrvlIEtypesHeader_t);
+		cmd->size = wlan_cpu_to_le16(cmd->size);
+		break;
 	default:
 		break;
 	}
@@ -3577,69 +3668,52 @@
 
 	ENTER();
 	if (priv->adapter->pcard_info->v16_fw_api) {
-		if (!IS_FW_SUPPORT_ADHOC(priv->adapter)) {
-			switch (cmd_no) {
-			case HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON:
-			case HostCmd_CMD_802_11_IBSS_COALESCING_STATUS:
-			case HostCmd_CMD_802_11_AD_HOC_START:
-			case HostCmd_CMD_802_11_AD_HOC_JOIN:
-			case HostCmd_CMD_802_11_AD_HOC_STOP:
-				ret = MLAN_STATUS_FAILURE;
-				break;
-			default:
-				break;
-			}
-		}
 	}
 	LEAVE();
 	return ret;
 }
 
 /**
- * @brief This function enable/disable CSI support.
+ *  @brief This function prepares command to configure Auth, (Re)assoc Timeout
  *
- * @param pmpriv       A pointer to mlan_private structure
- * @param cmd          A pointer to HostCmd_DS_COMMAND structure
- * @param cmd_action   The action: GET or SET
- * @param pdata_buf    A pointer to data buffer
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd         A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action  Action: GET or SET
+ *  @param pdata_buf   A pointer to data buffer
  *
- * @return             MLAN_STATUS_SUCCESS
+ *  @return            MLAN_STATUS_SUCCESS
  */
-static mlan_status wlan_cmd_csi(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
-				t_u16 cmd_action, t_u16 *pdata_buf)
+static mlan_status wlan_cmd_auth_assoc_timeout_cfg(pmlan_private pmpriv,
+						   HostCmd_DS_COMMAND *cmd,
+						   t_u16 cmd_action,
+						   t_void *pdata_buf)
 {
-	HostCmd_DS_CSI_CFG *csi_cfg_cmd = &cmd->params.csi_params;
-	mlan_ds_csi_params *csi_params = MNULL;
+	HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG *auth_assoc_cmd =
+		&cmd->params.auth_assoc_cfg;
+	mlan_ds_auth_assoc_timeout_cfg *auth_assoc_cfg =
+		(mlan_ds_auth_assoc_timeout_cfg *)pdata_buf;
 
 	ENTER();
 
-	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CSI);
-	cmd->size = sizeof(HostCmd_DS_CSI_CFG) + S_DS_GEN;
-	csi_cfg_cmd->action = wlan_cpu_to_le16(cmd_action);
-	switch (cmd_action) {
-	case CSI_CMD_ENABLE:
-		csi_params = (mlan_ds_csi_params *)pdata_buf;
-		csi_cfg_cmd->head_id = wlan_cpu_to_le32(csi_params->head_id);
-		csi_cfg_cmd->tail_id = wlan_cpu_to_le32(csi_params->tail_id);
-		csi_cfg_cmd->chip_id = csi_params->chip_id;
-		csi_cfg_cmd->csi_filter_cnt = csi_params->csi_filter_cnt;
-		if (csi_cfg_cmd->csi_filter_cnt > CSI_FILTER_MAX)
-			csi_cfg_cmd->csi_filter_cnt = CSI_FILTER_MAX;
-		memcpy_ext(pmpriv->adapter, (t_u8 *)csi_cfg_cmd->csi_filter,
-			   (t_u8 *)csi_params->csi_filter,
-			   sizeof(mlan_csi_filter_t) *
-				   csi_cfg_cmd->csi_filter_cnt,
-			   sizeof(csi_cfg_cmd->csi_filter));
-		DBG_HEXDUMP(MCMD_D, "Enable CSI", csi_cfg_cmd,
-			    sizeof(HostCmd_DS_CSI_CFG));
-		break;
-	case CSI_CMD_DISABLE:
-		DBG_HEXDUMP(MCMD_D, "Disable CSI", csi_cfg_cmd,
-			    sizeof(HostCmd_DS_CSI_CFG));
-	default:
-		break;
-	}
-	cmd->size = wlan_cpu_to_le16(cmd->size);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_AUTH_ASSOC_TIMEOUT_CFG);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG) +
+				     S_DS_GEN);
+
+	auth_assoc_cmd->action = wlan_cpu_to_le16(cmd_action);
+
+	auth_assoc_cmd->auth_timeout =
+		wlan_cpu_to_le16(auth_assoc_cfg->auth_timeout);
+	auth_assoc_cmd->auth_retry_timeout_if_ack =
+		wlan_cpu_to_le16(auth_assoc_cfg->auth_retry_timeout_if_ack);
+	auth_assoc_cmd->auth_retry_timeout_if_no_ack =
+		wlan_cpu_to_le16(auth_assoc_cfg->auth_retry_timeout_if_no_ack);
+	auth_assoc_cmd->assoc_timeout =
+		wlan_cpu_to_le16(auth_assoc_cfg->assoc_timeout);
+	auth_assoc_cmd->reassoc_timeout =
+		wlan_cpu_to_le16(auth_assoc_cfg->reassoc_timeout);
+	auth_assoc_cmd->retry_timeout =
+		wlan_cpu_to_le16(auth_assoc_cfg->retry_timeout);
+
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
@@ -3705,10 +3779,6 @@
 		ret = wlan_cmd_802_11_rf_antenna(pmpriv, cmd_ptr, cmd_action,
 						 pdata_buf);
 		break;
-	case HostCmd_CMD_CW_MODE_CTRL:
-		ret = wlan_cmd_cw_mode_ctrl(pmpriv, cmd_ptr, cmd_action,
-					    pdata_buf);
-		break;
 	case HostCmd_CMD_TXPWR_CFG:
 		ret = wlan_cmd_tx_power_cfg(pmpriv, cmd_ptr, cmd_action,
 					    pdata_buf);
@@ -3725,6 +3795,10 @@
 		ret = wlan_cmd_802_11_hs_cfg(pmpriv, cmd_ptr, cmd_action,
 					     (hs_config_param *)pdata_buf);
 		break;
+	case HostCmd_CMD_802_11_FW_WAKE_METHOD:
+		ret = wlan_cmd_802_11_fw_wakeup_method(pmpriv, cmd_ptr,
+						       cmd_action, pdata_buf);
+		break;
 	case HostCmd_CMD_802_11_ROBUSTCOEX:
 		ret = wlan_cmd_robustcoex(pmpriv, cmd_ptr, cmd_action,
 					  pdata_buf);
@@ -3749,7 +3823,7 @@
 		ret = wlan_cmd_ips_config(pmpriv, cmd_ptr, cmd_action,
 					  pdata_buf);
 		break;
-	case HOST_CMD_PMIC_CONFIGURE:
+	case HostCmd_CMD_PMIC_CONFIGURE:
 		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
 		cmd_ptr->size = wlan_cpu_to_le16(S_DS_GEN);
 		break;
@@ -3778,15 +3852,6 @@
 		ret = wlan_cmd_802_11_deauthenticate(pmpriv, cmd_no, cmd_ptr,
 						     pdata_buf);
 		break;
-	case HostCmd_CMD_802_11_AD_HOC_START:
-		ret = wlan_cmd_802_11_ad_hoc_start(pmpriv, cmd_ptr, pdata_buf);
-		break;
-	case HostCmd_CMD_802_11_AD_HOC_JOIN:
-		ret = wlan_cmd_802_11_ad_hoc_join(pmpriv, cmd_ptr, pdata_buf);
-		break;
-	case HostCmd_CMD_802_11_AD_HOC_STOP:
-		ret = wlan_cmd_802_11_ad_hoc_stop(pmpriv, cmd_ptr);
-		break;
 	case HostCmd_CMD_802_11_GET_LOG:
 		ret = wlan_cmd_802_11_get_log(pmpriv, cmd_ptr);
 		break;
@@ -3794,6 +3859,14 @@
 		ret = wlan_cmd_802_11_link_statistic(pmpriv, cmd_ptr,
 						     cmd_action, pioctl_buf);
 		break;
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_cmd_802_11_ftm_config_session_params(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_cmd_802_11_ftm_config_responder(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
 	case HostCmd_CMD_RSSI_INFO:
 		ret = wlan_cmd_802_11_rssi_info(pmpriv, cmd_ptr, cmd_action);
 		break;
@@ -3842,8 +3915,7 @@
 		if (pmpriv->adapter->hw_status == WlanHardwareStatusReset)
 			pmpriv->adapter->hw_status =
 				WlanHardwareStatusInitializing;
-		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
-		cmd_ptr->size = wlan_cpu_to_le16(S_DS_GEN);
+		ret = wlan_cmd_func_init(pmpriv, cmd_ptr);
 		break;
 	case HostCmd_CMD_FUNC_SHUTDOWN:
 		pmpriv->adapter->hw_status = WlanHardwareStatusReset;
@@ -3931,6 +4003,12 @@
 	case HostCmd_CMD_WMM_DELTS_REQ:
 		ret = wlan_cmd_wmm_delts_req(pmpriv, cmd_ptr, pdata_buf);
 		break;
+	case HostCmd_CMD_WMM_HOST_ADDTS_REQ:
+		ret = wlan_cmd_wmm_host_addts_req(pmpriv, cmd_ptr, pdata_buf);
+		break;
+	case HostCmd_CMD_WMM_HOST_DELTS_REQ:
+		ret = wlan_cmd_wmm_host_delts_req(pmpriv, cmd_ptr, pdata_buf);
+		break;
 	case HostCmd_CMD_WMM_QUEUE_CONFIG:
 		ret = wlan_cmd_wmm_queue_config(pmpriv, cmd_ptr, pdata_buf);
 		break;
@@ -3944,10 +4022,6 @@
 		ret = wlan_cmd_wmm_param_config(pmpriv, cmd_ptr, cmd_action,
 						pdata_buf);
 		break;
-	case HostCmd_CMD_802_11_IBSS_COALESCING_STATUS:
-		ret = wlan_cmd_ibss_coalescing_status(pmpriv, cmd_ptr,
-						      cmd_action, pdata_buf);
-		break;
 	case HostCmd_CMD_MGMT_IE_LIST:
 		ret = wlan_cmd_mgmt_ie_list(pmpriv, cmd_ptr, cmd_action,
 					    pdata_buf);
@@ -3981,6 +4055,9 @@
 	case HostCmd_CMD_MEM_ACCESS:
 		ret = wlan_cmd_mem_access(cmd_ptr, cmd_action, pdata_buf);
 		break;
+	case HostCmd_CMD_GPIO_CFG:
+		ret = wlan_cmd_gpio_cfg_ops(cmd_ptr, cmd_action, pdata_buf);
+		break;
 	case HostCmd_CMD_INACTIVITY_TIMEOUT_EXT:
 		ret = wlan_cmd_inactivity_timeout(cmd_ptr, cmd_action,
 						  pdata_buf);
@@ -4001,10 +4078,7 @@
 			cmd_ptr->params.bss_mode.con_type = *(t_u8 *)pdata_buf;
 		} else
 #endif
-			if (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
-			cmd_ptr->params.bss_mode.con_type =
-				CONNECTION_TYPE_ADHOC;
-		else if (pmpriv->bss_mode == MLAN_BSS_MODE_INFRA)
+			if (pmpriv->bss_mode == MLAN_BSS_MODE_INFRA)
 			cmd_ptr->params.bss_mode.con_type =
 				CONNECTION_TYPE_INFRA;
 		cmd_ptr->size = wlan_cpu_to_le16(
@@ -4027,12 +4101,18 @@
 		break;
 #endif
 #endif
+#if defined(PCIE)
+	case HostCmd_CMD_PCIE_ADMA_INIT:
+		ret = wlan_cmd_pcie_adma_init(pmpriv, cmd_ptr, cmd_action,
+					      pdata_buf);
+		break;
+#endif
 	case HostCmd_CMD_802_11_REMAIN_ON_CHANNEL:
 		ret = wlan_cmd_remain_on_channel(pmpriv, cmd_ptr, cmd_action,
 						 pdata_buf);
 		break;
 #ifdef WIFI_DIRECT_SUPPORT
-	case HOST_CMD_WIFI_DIRECT_MODE_CONFIG:
+	case HostCmd_CMD_WIFI_DIRECT_MODE_CONFIG:
 		ret = wlan_cmd_wifi_direct_mode(pmpriv, cmd_ptr, cmd_action,
 						pdata_buf);
 		break;
@@ -4077,10 +4157,10 @@
 	case HostCmd_CMD_DRCS_CONFIG:
 		ret = wlan_cmd_drcs_cfg(pmpriv, cmd_ptr, cmd_action, pdata_buf);
 		break;
-	case HostCMD_CONFIG_LOW_POWER_MODE:
+	case HostCmd_CMD_CONFIG_LOW_POWER_MODE:
 		ret = wlan_cmd_low_pwr_mode(pmpriv, cmd_ptr, pdata_buf);
 		break;
-	case HostCmd_DFS_REPEATER_MODE:
+	case HostCmd_CMD_DFS_REPEATER_MODE:
 		ret = wlan_cmd_dfs_repeater_cfg(pmpriv, cmd_ptr, cmd_action,
 						pdata_buf);
 		break;
@@ -4088,7 +4168,7 @@
 		ret = wlan_cmd_coalesce_config(pmpriv, cmd_ptr, cmd_action,
 					       pdata_buf);
 		break;
-	case HostCmd_DS_GET_SENSOR_TEMP:
+	case HostCmd_CMD_DS_GET_SENSOR_TEMP:
 		ret = wlan_cmd_get_sensor_temp(pmpriv, cmd_ptr, cmd_action);
 		break;
 	case HostCmd_CMD_802_11_MIMO_SWITCH:
@@ -4117,16 +4197,21 @@
 						     cmd_action, pdata_buf);
 		break;
 	case HostCmd_CMD_CHAN_REGION_CFG:
+		ret = wlan_cmd_chan_region_cfg(pmpriv, cmd_ptr, cmd_action,
+					       pdata_buf);
+		break;
+	case HostCmd_CMD_REGION_POWER_CFG:
 		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
 		cmd_ptr->size = wlan_cpu_to_le16(
-			sizeof(HostCmd_DS_CHAN_REGION_CFG) + S_DS_GEN);
-		cmd_ptr->params.reg_cfg.action = wlan_cpu_to_le16(cmd_action);
+			sizeof(HostCmd_DS_REGION_POWER_CFG) + S_DS_GEN);
+		cmd_ptr->params.rg_power_cfg.action =
+			wlan_cpu_to_le16(cmd_action);
 		break;
 	case HostCmd_CMD_AUTO_TX:
 		ret = wlan_cmd_auto_tx(pmpriv, cmd_ptr, cmd_action, cmd_oid,
 				       pdata_buf);
 		break;
-	case HOST_CMD_TX_RX_PKT_STATS:
+	case HostCmd_CMD_TX_RX_PKT_STATS:
 		ret = wlan_cmd_tx_rx_pkt_stats(pmpriv, cmd_ptr,
 					       (pmlan_ioctl_req)pioctl_buf,
 					       pdata_buf);
@@ -4143,11 +4228,6 @@
 		ret = wlan_cmd_fw_dump_event(pmpriv, cmd_ptr, cmd_action,
 					     pdata_buf);
 		break;
-#if defined(DRV_EMBEDDED_SUPPLICANT)
-	case HostCmd_CMD_CRYPTO:
-		ret = wlan_cmd_crypto(pmpriv, cmd_ptr, cmd_action, pdata_buf);
-		break;
-#endif
 	case HostCmd_CMD_11AX_CFG:
 		ret = wlan_cmd_11ax_cfg(pmpriv, cmd_ptr, cmd_action, pdata_buf);
 		break;
@@ -4161,7 +4241,7 @@
 	case HostCmd_CMD_TWT_CFG:
 		ret = wlan_cmd_twt_cfg(pmpriv, cmd_ptr, cmd_action, pdata_buf);
 		break;
-	case HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
+	case HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
 		ret = wlan_cmd_gpio_tsf_latch(pmpriv, cmd_ptr, cmd_action,
 					      pioctl_buf, pdata_buf);
 		break;
@@ -4169,10 +4249,22 @@
 		ret = wlan_cmd_rxabortcfg(pmpriv, cmd_ptr, cmd_action,
 					  pdata_buf);
 		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_cmd_ofdmdesense_cfg(pmpriv, cmd_ptr, cmd_action,
+					       pdata_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_cmd_rxabortcfg_ext(pmpriv, cmd_ptr, cmd_action,
 					      pdata_buf);
 		break;
+	case HostCmd_CMD_NAV_MITIGATION_CFG:
+		ret = wlan_cmd_nav_mitigation(pmpriv, cmd_ptr, cmd_action,
+					      pdata_buf);
+		break;
+	case HostCmd_CMD_802_11_LED_CONTROL:
+		ret = wlan_cmd_led_config(pmpriv, cmd_ptr, cmd_action,
+					  pdata_buf);
+		break;
 	case HostCmd_CMD_ARB_CONFIG:
 		ret = wlan_cmd_arb_cfg(pmpriv, cmd_ptr, cmd_action, pdata_buf);
 		break;
@@ -4192,7 +4284,7 @@
 		ret = wlan_cmd_cck_desense_cfg(pmpriv, cmd_ptr, cmd_action,
 					       pdata_buf);
 		break;
-	case HostCmd_CHANNEL_TRPC_CONFIG:
+	case HostCmd_CMD_CHANNEL_TRPC_CONFIG:
 		ret = wlan_cmd_get_chan_trpc_config(pmpriv, cmd_ptr, cmd_action,
 						    pdata_buf);
 		break;
@@ -4211,6 +4303,33 @@
 		ret = wlan_cmd_get_ch_load(pmpriv, cmd_ptr, cmd_action,
 					   pdata_buf);
 		break;
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_cmd_cross_chip_synch(pmpriv, cmd_ptr, cmd_action,
+						pdata_buf);
+		break;
+	case HostCmd_CMD_TSP_CFG:
+		ret = wlan_cmd_tsp_config(pmpriv, cmd_ptr, cmd_action,
+					  pdata_buf);
+		break;
+	case HostCmd_CMD_802_11_TX_FRAME:
+		ret = wlan_cmd_tx_frame(pmpriv, cmd_ptr, cmd_action, pdata_buf);
+		break;
+	case HostCmd_CMD_EDMAC_CFG:
+		ret = wlan_cmd_edmac_cfg(pmpriv, cmd_ptr, cmd_action,
+					 pdata_buf);
+		break;
+	case HostCmd_CMD_PEER_TX_RATE_QUERY:
+		ret = wlan_cmd_sta_tx_rate_req(pmpriv, cmd_ptr, cmd_action,
+					       pdata_buf);
+		break;
+	case HostCmd_CMD_MCLIENT_SCHEDULE_CFG:
+		ret = wlan_cmd_mclient_scheduling_cfg(pmpriv, cmd_ptr,
+						      cmd_action, pdata_buf);
+		break;
+	case HostCmd_CMD_AUTH_ASSOC_TIMEOUT_CFG:
+		ret = wlan_cmd_auth_assoc_timeout_cfg(pmpriv, cmd_ptr,
+						      cmd_action, pdata_buf);
+		break;
 	default:
 		PRINTM(MERROR, "PREP_CMD: unknown command- %#x\n", cmd_no);
 		ret = MLAN_STATUS_FAILURE;
@@ -4266,7 +4385,10 @@
 	}
 
 	memset(pmpriv->adapter, &amsdu_aggr_ctrl, 0, sizeof(amsdu_aggr_ctrl));
-	amsdu_aggr_ctrl.enable = MLAN_ACT_ENABLE;
+	if(pmpriv->adapter->init_para.amsdu_disable)
+		amsdu_aggr_ctrl.enable = MLAN_ACT_DISABLE;
+	else
+		amsdu_aggr_ctrl.enable = MLAN_ACT_ENABLE;
 	/* Send request to firmware */
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_AMSDU_AGGR_CTRL,
 			       HostCmd_ACT_GEN_SET, 0, MNULL,
diff --git a/wlan_sd8987/mlan/mlan_sta_cmdresp.c b/wlan_src/mlan/mlan_sta_cmdresp.c
old mode 100755
new mode 100644
similarity index 90%
rename from wlan_sd8987/mlan/mlan_sta_cmdresp.c
rename to wlan_src/mlan/mlan_sta_cmdresp.c
index a70b71c..e6833ef
--- a/wlan_sd8987/mlan/mlan_sta_cmdresp.c
+++ b/wlan_src/mlan/mlan_sta_cmdresp.c
@@ -4,20 +4,29 @@
  *  responses generated by firmware.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -158,7 +167,8 @@
 
 	ENTER();
 	if (resp->command != HostCmd_CMD_WMM_PARAM_CONFIG &&
-	    resp->command != HostCmd_CMD_CHAN_REGION_CFG)
+	    resp->command != HostCmd_CMD_CHAN_REGION_CFG &&
+	    resp->command != HostCmd_CMD_REGION_POWER_CFG)
 		PRINTM(MERROR, "CMD_RESP: cmd %#x error, result=%#x\n",
 		       resp->command, resp->result);
 	if (pioctl_buf)
@@ -173,14 +183,11 @@
 		/*
 		 * We do not re-try enter-ps command in ad-hoc mode.
 		 */
-		if (wlan_le16_to_cpu(pm->action) == EN_AUTO_PS &&
-		    (wlan_le16_to_cpu(pm->params.auto_ps.ps_bitmap) &
-		     BITMAP_STA_PS) &&
-		    pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
-			pmadapter->ps_mode = Wlan802_11PowerModeCAM;
 	} break;
 	case HostCmd_CMD_802_11_SCAN_EXT:
 	case HostCmd_CMD_802_11_SCAN:
+		if (resp->result == HostCmd_RESULT_BUSY)
+			pmadapter->dbg.num_scan_err++;
 		/* Cancel all pending scan command */
 		wlan_flush_scan_queue(pmadapter);
 
@@ -258,8 +265,14 @@
 		break;
 #endif
 	case HostCmd_CMD_802_11_ASSOCIATE:
+		if (resp->result == HostCmd_RESULT_BUSY)
+			pmadapter->dbg.num_assoc_err++;
 		wlan_reset_connect_state(pmpriv, MTRUE);
 		break;
+	case HostCmd_CMD_802_11_REMAIN_ON_CHANNEL:
+		if (resp->result == HostCmd_RESULT_BUSY)
+			pmadapter->dbg.num_remain_chan_err++;
+		break;
 #ifdef SDIO
 	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:
 		pmadapter->pcard_sd->sdio_rx_aggr_enable = MFALSE;
@@ -331,12 +344,10 @@
 		ret = MLAN_STATUS_SUCCESS;
 		PRINTM(MCMND, "FW don't support chan region cfg command!\n");
 		break;
-#if defined(DRV_EMBEDDED_SUPPLICANT)
-	case HostCmd_CMD_CRYPTO:
-		PRINTM(MCMND, "crypto cmd result=0x%x!\n", resp->result);
-		ret = wlan_ret_crypto(pmpriv, resp, pioctl_buf);
+	case HostCmd_CMD_REGION_POWER_CFG:
+		ret = MLAN_STATUS_SUCCESS;
+		PRINTM(MCMND, "FW don't support region power cfg command!\n");
 		break;
-#endif
 	default:
 		break;
 	}
@@ -641,6 +652,13 @@
 				(ul_temp & SLAVE_RADAR_DET_MASK) ? MTRUE :
 								   MFALSE;
 		}
+		/* Update state for 11h tpc disable */
+		if (oid == Dot11h_disable_tpc_i) {
+			/* Set 11h tpc to private */
+			ul_temp = wlan_le16_to_cpu(*((t_u16 *)(psmib->value)));
+			PRINTM(MCMND, "SNMP_RESP: Dot11h_disable_tpc_i =%u\n",
+			       ul_temp);
+		}
 	}
 
 	if (pioctl_buf) {
@@ -720,8 +738,10 @@
 			wlan_le32_to_cpu(pget_log->rx_stuck_issue_cnt[0]);
 		pget_info->param.stats.rx_stuck_issue_cnt[1] =
 			wlan_le32_to_cpu(pget_log->rx_stuck_issue_cnt[1]);
-		pget_info->param.stats.rx_stuck_recovery_cnt =
-			wlan_le32_to_cpu(pget_log->rx_stuck_recovery_cnt);
+		pget_info->param.stats.rx_stuck_poll_recovery_cnt =
+			wlan_le32_to_cpu(pget_log->rx_stuck_poll_recovery_cnt);
+		pget_info->param.stats.rx_stuck_intr_recovery_cnt =
+			wlan_le32_to_cpu(pget_log->rx_stuck_intr_recovery_cnt);
 		pget_info->param.stats.rx_stuck_tsf[0] =
 			wlan_le64_to_cpu(pget_log->rx_stuck_tsf[0]);
 		pget_info->param.stats.rx_stuck_tsf[1] =
@@ -750,6 +770,8 @@
 			wlan_le32_to_cpu(pget_log->gdma_abort_cnt);
 		pget_info->param.stats.g_reset_rx_mac_cnt =
 			wlan_le32_to_cpu(pget_log->g_reset_rx_mac_cnt);
+		pget_info->param.stats.SdmaStuckCnt =
+			wlan_le32_to_cpu(pget_log->SdmaStuckCnt);
 		// Ownership error counters
 		pget_info->param.stats.dwCtlErrCnt =
 			wlan_le32_to_cpu(pget_log->dwCtlErrCnt);
@@ -888,7 +910,7 @@
  */
 static mlan_status wlan_get_power_level(pmlan_private pmpriv, void *pdata_buf)
 {
-	t_u16 length = 0;
+	t_s32 length = 0;
 	t_s8 max_power = -1, min_power = -1;
 	MrvlTypes_Power_Group_t *ppg_tlv = MNULL;
 	Power_Group_t *pg = MNULL;
@@ -907,7 +929,7 @@
 			min_power = pg->power_min;
 			length -= sizeof(Power_Group_t);
 		}
-		while (length) {
+		while (length > 0) {
 			pg++;
 			if (max_power < pg->power_max)
 				max_power = pg->power_max;
@@ -1265,28 +1287,6 @@
 }
 
 /**
- *  @brief This function handles the command response of ad_hoc_stop
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param resp         A pointer to HostCmd_DS_COMMAND
- *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
- *
- *  @return        MLAN_STATUS_SUCCESS
- */
-static mlan_status wlan_ret_802_11_ad_hoc_stop(pmlan_private pmpriv,
-					       HostCmd_DS_COMMAND *resp,
-					       mlan_ioctl_req *pioctl_buf)
-{
-	ENTER();
-
-	wlan_reset_connect_state(pmpriv, MTRUE);
-	if (pmpriv->adapter->state_rdh.stage == RDH_STOP_INTFS)
-		wlan_11h_radar_detected_callback((t_void *)pmpriv);
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
-/**
  *  @brief This function handles the command response of key_material
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -1556,68 +1556,6 @@
 }
 
 /**
- *  @brief Handle the ibss_coalescing_status resp
- *
- *  @param pmpriv       A pointer to mlan_private structure
- *  @param resp         A pointer to HostCmd_DS_COMMAND
- *
- *  @return             MLAN_STATUS_SUCCESS
- */
-static mlan_status wlan_ret_ibss_coalescing_status(pmlan_private pmpriv,
-						   HostCmd_DS_COMMAND *resp)
-{
-	HostCmd_DS_802_11_IBSS_STATUS *pibss_coal_resp =
-		&(resp->params.ibss_coalescing);
-	t_u8 zero_mac[MLAN_MAC_ADDR_LENGTH] = {0, 0, 0, 0, 0, 0};
-
-	ENTER();
-
-	if (wlan_le16_to_cpu(pibss_coal_resp->action) == HostCmd_ACT_GEN_SET) {
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-
-	PRINTM(MINFO, "New BSSID " MACSTR "\n",
-	       MAC2STR(pibss_coal_resp->bssid));
-
-	/* If rsp has MNULL BSSID, Just return..... No Action */
-	if (!memcmp(pmpriv->adapter, pibss_coal_resp->bssid, zero_mac,
-		    MLAN_MAC_ADDR_LENGTH)) {
-		PRINTM(MMSG, "New BSSID is MNULL\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
-	}
-
-	/* If BSSID is diff, modify current BSS parameters */
-	if (memcmp(pmpriv->adapter,
-		   pmpriv->curr_bss_params.bss_descriptor.mac_address,
-		   pibss_coal_resp->bssid, MLAN_MAC_ADDR_LENGTH)) {
-		/* BSSID */
-		memcpy_ext(pmpriv->adapter,
-			   pmpriv->curr_bss_params.bss_descriptor.mac_address,
-			   pibss_coal_resp->bssid, MLAN_MAC_ADDR_LENGTH,
-			   sizeof(pmpriv->curr_bss_params.bss_descriptor
-					  .mac_address));
-
-		/* Beacon Interval and ATIM window */
-		pmpriv->curr_bss_params.bss_descriptor.beacon_period =
-			wlan_le16_to_cpu(pibss_coal_resp->beacon_interval);
-		pmpriv->curr_bss_params.bss_descriptor.atim_window =
-			wlan_le16_to_cpu(pibss_coal_resp->atim_window);
-
-		/* ERP Information */
-		pmpriv->curr_bss_params.bss_descriptor.erp_flags =
-			(t_u8)wlan_le16_to_cpu(
-				pibss_coal_resp->use_g_rate_protect);
-
-		pmpriv->adhoc_state = ADHOC_COALESCED;
-	}
-
-	LEAVE();
-	return MLAN_STATUS_SUCCESS;
-}
-
-/**
  *  @brief This function handles the command response of MGMT_IE_LIST
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -1905,7 +1843,7 @@
 				wlan_le16_to_cpu(link_ptr->data_rssi_avg);
 			link_ptr->data_nf_avg =
 				wlan_le16_to_cpu(link_ptr->data_nf_avg);
-			link_length = sizeof(tdls_each_link_status) - 1;
+			link_length = sizeof(tdls_each_link_status);
 			/* adjust as per open or secure network */
 			if (link_ptr->link_flags & 0x02) {
 				link_ptr->key_lifetime = wlan_le32_to_cpu(
@@ -2128,6 +2066,8 @@
 			wlan_le16_to_cpu(cmd_inac_to->mcast_timeout);
 		inac_to->ps_entry_timeout =
 			wlan_le16_to_cpu(cmd_inac_to->ps_entry_timeout);
+		inac_to->ps_cmd_timeout =
+			wlan_le16_to_cpu(cmd_inac_to->ps_cmd_timeout);
 	}
 
 	LEAVE();
@@ -2336,7 +2276,7 @@
 		changed = 0;
 		tlv = (*ptlv_buffer) | (*(ptlv_buffer + 1) << 8);
 		switch (tlv) {
-		case MRVL_USB_AGGR_PARAM_TLV_ID:
+		case NXP_USB_AGGR_PARAM_TLV_ID:
 			usb_aggr_param_tlv =
 				(MrvlIETypes_USBAggrParam_t *)ptlv_buffer;
 			misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
@@ -2583,9 +2523,9 @@
  *
  *  @return             MLAN_STATUS_SUCCESS
  */
-mlan_status wlan_ret_ipv6_ra_offload(pmlan_private pmpriv,
-				     HostCmd_DS_COMMAND *resp,
-				     mlan_ioctl_req *pioctl_buf)
+static mlan_status wlan_ret_ipv6_ra_offload(pmlan_private pmpriv,
+					    HostCmd_DS_COMMAND *resp,
+					    mlan_ioctl_req *pioctl_buf)
 {
 	HostCmd_DS_IPV6_RA_OFFLOAD *ipv6_ra_resp =
 		&resp->params.ipv6_ra_offload;
@@ -2599,9 +2539,11 @@
 		ipv6_ra = (mlan_ds_misc_ipv6_ra_offload *)&misc->param
 				  .ipv6_ra_offload;
 		ipv6_ra->enable = ipv6_ra_resp->enable;
-		memcpy_ext(pmpriv->adapter, ipv6_ra->ipv6_addr,
-			   ipv6_ra_resp->ipv6_addr_param.ipv6_addr, 16,
-			   sizeof(ipv6_ra->ipv6_addr));
+		ipv6_ra->ipv6_addrs_count = ipv6_ra_resp->ipv6_addr_count;
+		memcpy_ext(pmpriv->adapter, ipv6_ra->ipv6_addrs,
+			   ipv6_ra_resp->ipv6_addr_param.ipv6_addrs,
+			   (ipv6_ra->ipv6_addrs_count * IPADDR_LEN),
+			   (ipv6_ra->ipv6_addrs_count * IPADDR_LEN));
 	}
 
 	LEAVE();
@@ -2632,20 +2574,22 @@
 		if (pioctl_buf->req_id == MLAN_IOCTL_BSS) {
 			bss = (mlan_ds_bss *)pioctl_buf->pbuf;
 			if (bss->sub_command == MLAN_OID_BSS_CHAN_INFO) {
+				Band_Config_t *bandcfg =
+					&bss->param.sta_channel.bandcfg;
+
 				tlv_band_channel =
 					(MrvlIEtypes_channel_band_t *)
 						cmdrsp_sta_cfg->tlv_buffer;
-				bss->param.sta_channel.bandcfg =
-					tlv_band_channel->bandcfg;
+				*bandcfg = tlv_band_channel->bandcfg;
 				bss->param.sta_channel.channel =
 					tlv_band_channel->channel;
 				bss->param.sta_channel.is_11n_enabled =
 					IS_11N_ENABLED(pmpriv);
-				if (bss->param.sta_channel.bandcfg.chanWidth ==
-				    CHAN_BW_80MHZ)
+				if (bandcfg->chanWidth == CHAN_BW_80MHZ)
 					bss->param.sta_channel.center_chan =
 						wlan_get_center_freq_idx(
-							pmpriv, BAND_AAC,
+							pmpriv,
+							bandcfg->chanBand,
 							bss->param.sta_channel
 								.channel,
 							CHANNEL_BW_80MHZ);
@@ -2752,6 +2696,8 @@
 	MrvlIEtypes_Cloud_Keep_Alive_t *keep_alive_tlv = MNULL;
 	MrvlIEtypes_Keep_Alive_Pkt_t *pkt_tlv = MNULL;
 	mlan_ds_misc_keep_alive *misc_keep_alive = MNULL;
+	MrvlIEtypes_Cloud_Keep_Alive_Rx_t *keep_alive_Rx_tlv = MNULL;
+	mlan_ds_misc_keep_alive_rx *misc_keep_alive_rx = MNULL;
 
 	ENTER();
 
@@ -2828,6 +2774,65 @@
 				}
 			}
 		}
+		if (header->type == TLV_TYPE_CLOUD_KEEP_ALIVE_ACK) {
+			keep_alive_Rx_tlv =
+				(MrvlIEtypes_Cloud_Keep_Alive_Rx_t *)
+					cmdrsp_auto_tx->tlv_buffer;
+			misc_keep_alive_rx = (mlan_ds_misc_keep_alive_rx *)&misc
+						     ->param.keep_alive_rx;
+			misc_keep_alive_rx->mkeep_alive_id =
+				keep_alive_Rx_tlv->keep_alive_id;
+			misc_keep_alive_rx->enable = keep_alive_Rx_tlv->enable;
+			if (((action == HostCmd_ACT_GEN_SET) ||
+			     (action == HostCmd_ACT_GEN_RESET)) &&
+			    !keep_alive_Rx_tlv->enable) {
+				len = len -
+				      sizeof(keep_alive_Rx_tlv->keep_alive_id) -
+				      sizeof(keep_alive_Rx_tlv->enable);
+				if (len > sizeof(MrvlIEtypesHeader_t)) {
+					header = (MrvlIEtypesHeader_t *)
+						keep_alive_Rx_tlv;
+					header->type =
+						wlan_le16_to_cpu(header->type);
+					len = wlan_le16_to_cpu(header->len) -
+					      sizeof(Eth803Hdr_t);
+					if (header->type ==
+					    TLV_TYPE_CLOUD_KEEP_ALIVE_ACK) {
+						memcpy_ext(
+							pmpriv->adapter,
+							misc_keep_alive_rx
+								->dst_mac,
+							keep_alive_Rx_tlv
+								->eth_header
+								.dest_addr,
+							MLAN_MAC_ADDR_LENGTH,
+							sizeof(misc_keep_alive_rx
+								       ->dst_mac));
+						memcpy_ext(
+							pmpriv->adapter,
+							misc_keep_alive_rx
+								->src_mac,
+							keep_alive_Rx_tlv
+								->eth_header
+								.src_addr,
+							MLAN_MAC_ADDR_LENGTH,
+							sizeof(misc_keep_alive
+								       ->src_mac));
+						memcpy_ext(
+							pmpriv->adapter,
+							misc_keep_alive_rx
+								->packet,
+							keep_alive_Rx_tlv
+								->ip_packet,
+							len,
+							sizeof(misc_keep_alive
+								       ->packet));
+						misc_keep_alive_rx->pkt_len =
+							len;
+					}
+				}
+			}
+		}
 	}
 
 	LEAVE();
@@ -2912,9 +2917,11 @@
 	cfg->short_preamble = wlan_le32_to_cpu(mcmd->short_preamble);
 	cfg->act_sub_ch = wlan_le32_to_cpu(mcmd->act_sub_ch);
 	cfg->short_gi = wlan_le32_to_cpu(mcmd->short_gi);
+	cfg->adv_coding = wlan_le32_to_cpu(mcmd->adv_coding);
 	cfg->tx_bf = wlan_le32_to_cpu(mcmd->tx_bf);
 	cfg->gf_mode = wlan_le32_to_cpu(mcmd->gf_mode);
 	cfg->stbc = wlan_le32_to_cpu(mcmd->stbc);
+	cfg->signal_bw = wlan_le32_to_cpu(mcmd->signal_bw);
 	cfg->NumPkt = wlan_le32_to_cpu(mcmd->NumPkt);
 	cfg->MaxPE = wlan_le32_to_cpu(mcmd->MaxPE);
 	cfg->BeamChange = wlan_le32_to_cpu(mcmd->BeamChange);
@@ -3014,6 +3021,74 @@
 }
 
 /**
+ *  @brief This function prepares command resp of MFG CMD OTP RW
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+
+static mlan_status wlan_ret_mfg_otp_rw(pmlan_private pmpriv,
+				       HostCmd_DS_COMMAND *resp,
+				       mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc = MNULL;
+	mfg_cmd_otp_mac_addr_rd_wr_t *cfg = MNULL;
+	mfg_cmd_otp_mac_addr_rd_wr_t *mcmd =
+		(mfg_cmd_otp_mac_addr_rd_wr_t *)&resp->params
+			.mfg_otp_mac_addr_rd_wr;
+
+	ENTER();
+	if (!pioctl_buf) {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+	misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+	cfg = (mfg_cmd_otp_mac_addr_rd_wr_t *)&misc->param
+		      .mfg_otp_mac_addr_rd_wr;
+	memcpy_ext(pmpriv->adapter, &(cfg->mac_addr[0]), &(mcmd->mac_addr[0]),
+		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command resp of MFG CMD OTP CAL DATA RW
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+
+static mlan_status wlan_ret_mfg_otp_cal_data_rw(pmlan_private pmpriv,
+						HostCmd_DS_COMMAND *resp,
+						mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc = MNULL;
+	mfg_cmd_otp_cal_data_rd_wr_t *cfg = MNULL;
+	mfg_cmd_otp_cal_data_rd_wr_t *mcmd =
+		(mfg_cmd_otp_cal_data_rd_wr_t *)&resp->params
+			.mfg_otp_cal_data_rd_wr;
+
+	ENTER();
+	if (!pioctl_buf) {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+	misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+	cfg = (mfg_cmd_otp_cal_data_rd_wr_t *)&misc->param
+		      .mfg_otp_cal_data_rd_wr;
+	memcpy_ext(pmpriv->adapter, &(cfg->cal_data[0]), &(mcmd->cal_data[0]),
+		   cfg->cal_data_len, cfg->cal_data_len);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function prepares command resp of MFG Cmd
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -3030,9 +3105,8 @@
 		(struct mfg_cmd_generic_cfg *)&resp->params.mfg_generic_cfg;
 	struct mfg_cmd_generic_cfg *cfg = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-#ifdef SD9177
 	mlan_adapter *pmadapter = pmpriv->adapter;
-#endif
+	t_u16 card_type = pmadapter->card_type;
 
 	ENTER();
 	if (!pioctl_buf) {
@@ -3053,6 +3127,12 @@
 		ret = wlan_ret_mfg_config_trigger_frame(pmpriv, resp,
 							pioctl_buf);
 		goto cmd_mfg_done;
+	case MFG_CMD_OTP_MAC_ADD:
+		ret = wlan_ret_mfg_otp_rw(pmpriv, resp, pioctl_buf);
+		goto cmd_mfg_done;
+	case MFG_CMD_OTP_CAL_DATA:
+		ret = wlan_ret_mfg_otp_cal_data_rw(pmpriv, resp, pioctl_buf);
+		goto cmd_mfg_done;
 	case MFG_CMD_SET_TEST_MODE:
 	case MFG_CMD_UNSET_TEST_MODE:
 	case MFG_CMD_TX_ANT:
@@ -3072,28 +3152,104 @@
 	cfg = (struct mfg_cmd_generic_cfg *)&misc->param.mfg_generic_cfg;
 
 	cfg->error = wlan_le32_to_cpu(mcmd->error);
-
-#ifdef SD9177
-	if (IS_SD9177(pmadapter->card_type) &&
+	card_type = card_type & 0xff;
+	if (((card_type == CARD_TYPE_9098) || (card_type == CARD_TYPE_9097) ||
+	     (card_type == CARD_TYPE_9177) || (card_type == CARD_TYPE_IW624) ||
+	     (card_type == CARD_TYPE_AW693) ||
+	     (card_type == CARD_TYPE_IW610)) &&
 	    (wlan_le32_to_cpu(mcmd->mfg_cmd) == MFG_CMD_RFPWR)) {
 		//! TX_POWER was multipied by 16 while passing to fw
 		//! So It is needed to divide by 16 for user vals understanding.
 		cfg->data1 = (wlan_le32_to_cpu(mcmd->data1) >> 4);
 	} else {
-#endif
 		cfg->data1 = wlan_le32_to_cpu(mcmd->data1);
-#ifdef SD9177
 	}
-#endif
 
 	cfg->data2 = wlan_le32_to_cpu(mcmd->data2);
 	cfg->data3 = wlan_le32_to_cpu(mcmd->data3);
 cmd_mfg_done:
+	if (mcmd->error)
+		PRINTM(MERROR, "RFTM_COMMAND ERROR: 0x%08x\n",
+		       wlan_le32_to_cpu(mcmd->error));
 	LEAVE();
 	return ret;
 }
 
 /**
+ *  @brief This function handles the command response of TWT_REPORT
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to command buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_twt_report(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+	HostCmd_DS_TWT_CFG *twt_recfg = &resp->params.twtcfg;
+
+	ENTER();
+
+	if ((wlan_le16_to_cpu(twt_recfg->action) == HostCmd_ACT_GEN_GET) &&
+	    (wlan_le16_to_cpu(twt_recfg->sub_id) ==
+	     MLAN_11AX_TWT_REPORT_SUBID)) {
+		if (pioctl_buf) {
+			misc_cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+			memcpy_ext(pmpriv->adapter,
+				   &misc_cfg->param.twt_report_info,
+				   &resp->params.twtcfg.param.twt_report,
+				   sizeof(mlan_ds_twt_report),
+				   sizeof(mlan_ds_twt_report));
+		}
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of auth assoc timeout cfg
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_auth_assoc_timeout_cfg(pmlan_private pmpriv,
+					    HostCmd_DS_COMMAND *resp,
+					    mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG *auth_assoc_cmd =
+		(HostCmd_DS_AUTH_ASSOC_TIMEOUT_CFG *)&resp->params
+			.auth_assoc_cfg;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+
+	ENTER();
+
+	if (pioctl_buf) {
+		misc_cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		misc_cfg->param.auth_assoc_cfg.auth_timeout =
+			wlan_le16_to_cpu(auth_assoc_cmd->auth_timeout);
+		misc_cfg->param.auth_assoc_cfg.auth_retry_timeout_if_ack =
+			wlan_le16_to_cpu(
+				auth_assoc_cmd->auth_retry_timeout_if_ack);
+		misc_cfg->param.auth_assoc_cfg.auth_retry_timeout_if_no_ack =
+			wlan_le16_to_cpu(
+				auth_assoc_cmd->auth_retry_timeout_if_no_ack);
+		misc_cfg->param.auth_assoc_cfg.assoc_timeout =
+			wlan_le16_to_cpu(auth_assoc_cmd->assoc_timeout);
+		misc_cfg->param.auth_assoc_cfg.reassoc_timeout =
+			wlan_le16_to_cpu(auth_assoc_cmd->reassoc_timeout);
+		misc_cfg->param.auth_assoc_cfg.retry_timeout =
+			wlan_le16_to_cpu(auth_assoc_cmd->retry_timeout);
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function handles the station command response
  *
  *  @param priv             A pointer to mlan_private structure
@@ -3187,6 +3343,9 @@
 	case HostCmd_CMD_802_11_SLEEP_PARAMS:
 		ret = wlan_ret_802_11_sleep_params(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_802_11_FW_WAKE_METHOD:
+		ret = wlan_ret_fw_wakeup_method(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_802_11_ROBUSTCOEX:
 		break;
 	case HostCmd_CMD_DMCS_CONFIG:
@@ -3217,19 +3376,20 @@
 	case HostCmd_CMD_802_11_DISASSOCIATE:
 		ret = wlan_ret_802_11_deauthenticate(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCmd_CMD_802_11_AD_HOC_START:
-	case HostCmd_CMD_802_11_AD_HOC_JOIN:
-		ret = wlan_ret_802_11_ad_hoc(pmpriv, resp, pioctl_buf);
-		break;
-	case HostCmd_CMD_802_11_AD_HOC_STOP:
-		ret = wlan_ret_802_11_ad_hoc_stop(pmpriv, resp, pioctl_buf);
-		break;
 	case HostCmd_CMD_802_11_GET_LOG:
 		ret = wlan_ret_get_log(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_802_11_LINK_STATS:
 		ret = wlan_ret_get_link_statistic(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_ret_802_11_ftm_config_session_params(pmpriv, resp,
+								pioctl_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_ret_802_11_ftm_config_responder(pmpriv, resp,
+							   pioctl_buf);
+		break;
 	case HostCmd_CMD_RSSI_INFO_EXT:
 		ret = wlan_ret_802_11_rssi_info_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -3251,9 +3411,6 @@
 	case HostCmd_CMD_802_11_RF_ANTENNA:
 		ret = wlan_ret_802_11_rf_antenna(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCmd_CMD_CW_MODE_CTRL:
-		ret = wlan_ret_cw_mode_ctrl(pmpriv, resp, pioctl_buf);
-		break;
 	case HostCmd_CMD_VERSION_EXT:
 		ret = wlan_ret_ver_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -3352,6 +3509,9 @@
 	case HostCmd_CMD_WMM_DELTS_REQ:
 		ret = wlan_ret_wmm_delts_req(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_WMM_HOST_ADDTS_REQ:
+	case HostCmd_CMD_WMM_HOST_DELTS_REQ:
+		break;
 	case HostCmd_CMD_WMM_QUEUE_CONFIG:
 		ret = wlan_ret_wmm_queue_config(pmpriv, resp, pioctl_buf);
 		break;
@@ -3364,9 +3524,6 @@
 	case HostCmd_CMD_WMM_PARAM_CONFIG:
 		ret = wlan_ret_wmm_param_config(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCmd_CMD_802_11_IBSS_COALESCING_STATUS:
-		ret = wlan_ret_ibss_coalescing_status(pmpriv, resp);
-		break;
 	case HostCmd_CMD_MGMT_IE_LIST:
 		ret = wlan_ret_mgmt_ie_list(pmpriv, resp, pioctl_buf);
 		break;
@@ -3408,6 +3565,9 @@
 	case HostCmd_CMD_MEM_ACCESS:
 		ret = wlan_ret_mem_access(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_GPIO_CFG:
+		ret = wlan_ret_gpio_cfg_ops(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_INACTIVITY_TIMEOUT_EXT:
 		ret = wlan_ret_inactivity_timeout(pmpriv, resp, pioctl_buf);
 		break;
@@ -3431,11 +3591,17 @@
 		break;
 #endif
 #endif
+#if defined(PCIE)
+	case HostCmd_CMD_PCIE_ADMA_INIT:
+		PRINTM(MINFO, "PCIE ADMA init successful.\n");
+		wlan_pcie_init_fw(pmpriv->adapter);
+		break;
+#endif
 	case HostCmd_CMD_802_11_REMAIN_ON_CHANNEL:
 		ret = wlan_ret_remain_on_channel(pmpriv, resp, pioctl_buf);
 		break;
 #ifdef WIFI_DIRECT_SUPPORT
-	case HOST_CMD_WIFI_DIRECT_MODE_CONFIG:
+	case HostCmd_CMD_WIFI_DIRECT_MODE_CONFIG:
 		ret = wlan_ret_wifi_direct_mode(pmpriv, resp, pioctl_buf);
 		break;
 #endif
@@ -3472,9 +3638,9 @@
 	case HostCmd_CMD_DRCS_CONFIG:
 		ret = wlan_ret_drcs_cfg(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCMD_CONFIG_LOW_POWER_MODE:
+	case HostCmd_CMD_CONFIG_LOW_POWER_MODE:
 		break;
-	case HostCmd_DFS_REPEATER_MODE:
+	case HostCmd_CMD_DFS_REPEATER_MODE:
 		ret = wlan_ret_dfs_repeater_cfg(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_COALESCE_CFG:
@@ -3482,7 +3648,7 @@
 		break;
 	case HostCmd_CMD_MEF_CFG:
 		break;
-	case HostCmd_DS_GET_SENSOR_TEMP:
+	case HostCmd_CMD_DS_GET_SENSOR_TEMP:
 		ret = wlan_ret_get_sensor_temp(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_802_11_MIMO_SWITCH:
@@ -3493,7 +3659,7 @@
 	case HostCmd_CMD_STA_CONFIGURE:
 		ret = wlan_ret_sta_config(pmpriv, resp, pioctl_buf);
 		break;
-	case HOST_CMD_PMIC_CONFIGURE:
+	case HostCmd_CMD_PMIC_CONFIGURE:
 		break;
 	case HostCmd_CMD_INDEPENDENT_RESET_CFG:
 		ret = wlan_ret_ind_rst_cfg(pmpriv, resp, pioctl_buf);
@@ -3509,10 +3675,12 @@
 	case HostCmd_CMD_CHAN_REGION_CFG:
 		ret = wlan_ret_chan_region_cfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_REGION_POWER_CFG:
+		break;
 	case HostCmd_CMD_AUTO_TX:
 		ret = wlan_ret_auto_tx(pmpriv, resp, pioctl_buf);
 		break;
-	case HOST_CMD_TX_RX_PKT_STATS:
+	case HostCmd_CMD_TX_RX_PKT_STATS:
 		ret = wlan_ret_tx_rx_pkt_stats(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_DYN_BW:
@@ -3521,11 +3689,6 @@
 	case HostCmd_CMD_BOOT_SLEEP:
 		ret = wlan_ret_boot_sleep(pmpriv, resp, pioctl_buf);
 		break;
-#if defined(DRV_EMBEDDED_SUPPLICANT)
-	case HostCmd_CMD_CRYPTO:
-		ret = wlan_ret_crypto(pmpriv, resp, pioctl_buf);
-		break;
-#endif
 	case HostCmd_CMD_11AX_CFG:
 		ret = wlan_ret_11ax_cfg(pmpriv, resp, pioctl_buf);
 		break;
@@ -3536,16 +3699,26 @@
 		ret = wlan_ret_range_ext(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_TWT_CFG:
+		ret = wlan_ret_twt_report(pmpriv, resp, pioctl_buf);
 		break;
-	case HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
+	case HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
 		ret = wlan_ret_gpio_tsf_latch(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_RX_ABORT_CFG:
 		ret = wlan_ret_rxabortcfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_ret_ofdmdesense_cfg(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_ret_rxabortcfg_ext(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_NAV_MITIGATION_CFG:
+		ret = wlan_ret_nav_mitigation(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_802_11_LED_CONTROL:
+		ret = wlan_ret_led_config(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_ARB_CONFIG:
 		ret = wlan_ret_arb_cfg(pmpriv, resp, pioctl_buf);
 		break;
@@ -3568,7 +3741,7 @@
 	case HostCmd_CMD_CCK_DESENSE_CFG:
 		ret = wlan_ret_cck_desense_cfg(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCmd_CHANNEL_TRPC_CONFIG:
+	case HostCmd_CMD_CHANNEL_TRPC_CONFIG:
 		ret = wlan_ret_get_chan_trpc_config(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_LOW_POWER_MODE_CFG:
@@ -3584,6 +3757,24 @@
 	case HostCmd_CMD_GET_CH_LOAD:
 		ret = wlan_ret_ch_load(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_ret_cross_chip_synch(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_TSP_CFG:
+		ret = wlan_ret_tsp_config(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_802_11_TX_FRAME:
+		break;
+	case HostCmd_CMD_EDMAC_CFG:
+		break;
+	case HostCmd_CMD_PEER_TX_RATE_QUERY:
+		ret = wlan_ret_sta_tx_rate(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_MCLIENT_SCHEDULE_CFG:
+		break;
+	case HostCmd_CMD_AUTH_ASSOC_TIMEOUT_CFG:
+		ret = wlan_ret_auth_assoc_timeout_cfg(pmpriv, resp, pioctl_buf);
+		break;
 	default:
 		PRINTM(MERROR, "CMD_RESP: Unknown command response %#x\n",
 		       resp->command);
diff --git a/wlan_sd8987/mlan/mlan_sta_event.c b/wlan_src/mlan/mlan_sta_event.c
old mode 100755
new mode 100644
similarity index 84%
rename from wlan_sd8987/mlan/mlan_sta_event.c
rename to wlan_src/mlan/mlan_sta_event.c
index effe3cc..8d47c11
--- a/wlan_sd8987/mlan/mlan_sta_event.c
+++ b/wlan_src/mlan/mlan_sta_event.c
@@ -3,20 +3,29 @@
  *  @brief This file contains MLAN event handling.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2022, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -33,9 +42,6 @@
 #include "mlan_wmm.h"
 #include "mlan_11n.h"
 #include "mlan_11h.h"
-#ifdef DRV_EMBEDDED_SUPPLICANT
-#include "authenticator_api.h"
-#endif
 #ifdef PCIE
 #include "mlan_pcie.h"
 #endif /* PCIE */
@@ -337,6 +343,75 @@
 	return;
 }
 
+/**
+ *  @brief This function will handle the generic NAN event for further wlan
+ * action based on the Event subtypes
+ *
+ *  @param pmpriv     A pointer to mlan_private
+ *  @param evt_buf    A pointer to mlan_event
+ *  @param pmbuf    A pointer to mlan buffer
+ *
+ *  @return         N/A
+ */
+static void wlan_process_nan_event(pmlan_private pmpriv, pmlan_buffer pmbuf)
+{
+	t_u8 *evt_buf = MNULL;
+	mlan_event *pevent;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	event_nan_generic *nan_event =
+		(event_nan_generic *)(pmbuf->pbuf + pmbuf->data_offset +
+				      sizeof(mlan_event_id));
+	pmlan_adapter pmadapter = pmpriv->adapter;
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+
+	ENTER();
+
+	ret = pcb->moal_malloc(pmadapter->pmoal_handle, MAX_EVENT_SIZE,
+			       MLAN_MEM_DEF, &evt_buf);
+	if (ret != MLAN_STATUS_SUCCESS || !evt_buf) {
+		LEAVE();
+		return;
+	}
+
+	pevent = (pmlan_event)evt_buf;
+
+	pevent->bss_index = pmpriv->bss_index;
+	if (wlan_le16_to_cpu(nan_event->event_sub_type) ==
+		    NAN_EVT_SUBTYPE_SD_EVENT ||
+	    wlan_le16_to_cpu(nan_event->event_sub_type) ==
+		    NAN_EVT_SUBTYPE_SDF_TX_DONE) {
+		pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
+		pevent->event_len = pmbuf->data_len;
+		memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
+			   pmbuf->pbuf + pmbuf->data_offset, pevent->event_len,
+			   pevent->event_len);
+		wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		pcb->moal_mfree(pmadapter->pmoal_handle, evt_buf);
+	} else {
+		t_u8 test_mac[MLAN_MAC_ADDR_LENGTH] = {0x00, 0x11, 0x22,
+						       0x33, 0x44, 0x55};
+		pevent->event_id = MLAN_EVENT_ID_DRV_CONNECTED;
+		pevent->event_len = MLAN_MAC_ADDR_LENGTH;
+		memcpy_ext(pmpriv->adapter, (t_u8 *)pevent->event_buf, test_mac,
+			   MLAN_MAC_ADDR_LENGTH, pevent->event_len);
+		wlan_ralist_add(pmpriv, test_mac);
+		memcpy_ext(pmpriv->adapter,
+			   pmpriv->curr_bss_params.bss_descriptor.mac_address,
+			   test_mac, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_CONNECTED, pevent);
+		if (pmpriv->port_ctrl_mode == MTRUE)
+			pmpriv->port_open = MTRUE;
+		pmpriv->media_connected = MTRUE;
+		PRINTM_NETINTF(MEVENT, pmpriv);
+		PRINTM(MEVENT, "nan interface - opened\n");
+		pcb->moal_mfree(pmadapter->pmoal_handle, evt_buf);
+	}
+
+	LEAVE();
+	return;
+}
+
 /********************************************************
 			Global Functions
 ********************************************************/
@@ -405,17 +480,13 @@
 	priv->rxpd_rate_info = 0;
 	priv->max_amsdu = 0;
 	priv->amsdu_disable = MFALSE;
+	priv->multi_ap_flag = 0;
 	wlan_coex_ampdu_rxwinsize(pmadapter);
 
 	priv->sec_info.ewpa_enabled = MFALSE;
 	priv->sec_info.wpa_enabled = MFALSE;
 	priv->sec_info.wpa2_enabled = MFALSE;
 	priv->wpa_ie_len = 0;
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	supplicantStopSessionTimer(priv->psapriv);
-	supplicantClrEncryptKey(priv->psapriv);
-	supplicantDisable(priv->psapriv);
-#endif
 
 	priv->sec_info.wapi_enabled = MFALSE;
 	priv->wapi_ie_len = 0;
@@ -433,12 +504,6 @@
 	priv->is_data_rate_auto = MTRUE;
 	priv->data_rate = 0;
 
-	if (priv->bss_mode == MLAN_BSS_MODE_IBSS) {
-		priv->adhoc_state = ADHOC_IDLE;
-		priv->adhoc_is_link_sensed = MFALSE;
-		priv->intf_state_11h.adhoc_auto_sel_chan = MTRUE;
-	}
-
 	if (drv_disconnect) {
 		/* Free Tx and Rx packets, report disconnect to upper layer */
 		wlan_clean_txrx(priv);
@@ -474,11 +539,6 @@
 		return;
 	}
 
-	if (pmadapter->pending_disconnect_priv) {
-		LEAVE();
-		return;
-	}
-
 	pevent->bss_index = priv->bss_index;
 	pevent->event_id = MLAN_EVENT_ID_FW_DISCONNECTED;
 	pevent->event_len = sizeof(priv->disconnect_reason_code);
@@ -563,17 +623,9 @@
 			PRINTM(MCMND, "TxPause: " MACSTR " pause=%d, pkts=%d\n",
 			       MAC2STR(tx_pause_tlv->peermac),
 			       tx_pause_tlv->tx_pause, tx_pause_tlv->pkt_cnt);
-
-			if (bssid &&
-			    !memcmp(priv->adapter, bssid, tx_pause_tlv->peermac,
-				    MLAN_MAC_ADDR_LENGTH)) {
-				if (tx_pause_tlv->tx_pause)
-					priv->tx_pause = MTRUE;
-				else
-					priv->tx_pause = MFALSE;
-			} else {
-				status = wlan_get_tdls_link_status(
-					priv, tx_pause_tlv->peermac);
+			status = wlan_get_tdls_link_status(
+				priv, tx_pause_tlv->peermac);
+			if (status != TDLS_NOT_SETUP) {
 				if (MTRUE == wlan_is_tdls_link_setup(status)) {
 					sta_ptr = wlan_get_station_entry(
 						priv, tx_pause_tlv->peermac);
@@ -592,6 +644,11 @@
 						}
 					}
 				}
+			} else {
+				if (tx_pause_tlv->tx_pause)
+					priv->tx_pause = MTRUE;
+				else
+					priv->tx_pause = MFALSE;
 			}
 		}
 		tlv_buf_left -= (sizeof(MrvlIEtypesHeader_t) + tlv_len);
@@ -679,13 +736,17 @@
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	mlan_event *pevent = MNULL;
 	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	Event_WLS_FTM_t *event_ftm = MNULL;
 	chan_band_info *pchan_band_info = MNULL;
 	t_u8 radar_chan;
+	t_u8 bandwidth;
 	t_u16 enable = 0;
+	Event_Link_Lost *link_lost_evt = MNULL;
 
 	ENTER();
 
 	if (!pmbuf) {
+		PRINTM(MERROR, "ERR:event buffer is null\n");
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
@@ -693,6 +754,8 @@
 	/* Event length check */
 	if ((pmbuf->data_len - sizeof(eventcause)) > MAX_EVENT_SIZE) {
 		pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
+		PRINTM(MERROR, "ERR:event buffer len invalid=%d\n",
+		       pmbuf->data_len);
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
@@ -722,9 +785,6 @@
 		break;
 	case EVENT_LINK_SENSED:
 		PRINTM(MEVENT, "EVENT: LINK_SENSED\n");
-		pmpriv->adhoc_is_link_sensed = MTRUE;
-		wlan_recv_event(pmpriv, MLAN_EVENT_ID_FW_ADHOC_LINK_SENSED,
-				MNULL);
 		break;
 
 	case EVENT_DEAUTHENTICATED:
@@ -763,20 +823,67 @@
 		break;
 
 	case EVENT_LINK_LOST:
-		reason_code = wlan_le16_to_cpu(*(t_u16 *)(pmbuf->pbuf +
-							  pmbuf->data_offset +
-							  sizeof(eventcause)));
-		PRINTM(MMSG, "wlan: EVENT: Link lost (reason 0x%x)\n",
-		       reason_code);
-		pmpriv->disconnect_reason_code = reason_code;
+		if (pmpriv->curr_bss_params.host_mlme &&
+		    !pmpriv->assoc_rsp_size) {
+			PRINTM(MMSG,
+			       "wlan: skip link lost event before associate complete\n");
+			break;
+		}
+		if (pmbuf && (pmbuf->data_len >=
+			      sizeof(eventcause) + sizeof(Event_Link_Lost))) {
+			link_lost_evt = (Event_Link_Lost *)(pmbuf->pbuf +
+							    pmbuf->data_offset +
+							    sizeof(eventcause));
+			PRINTM(MMSG,
+			       "wlan: EVENT: Link lost (reason 0x%x) bssid: " MACSTR
+			       "\n",
+			       link_lost_evt->reason_code,
+			       MAC2STR(link_lost_evt->bssid));
+			pmpriv->disconnect_reason_code =
+				link_lost_evt->reason_code;
+			if (memcmp(pmpriv->adapter, link_lost_evt->bssid,
+				   &pmpriv->curr_bss_params.attemp_bssid,
+				   MLAN_MAC_ADDR_LENGTH)) {
+				PRINTM(MMSG, "wlan: skip link lost event\n");
+				PRINTM(MMSG, "pattempted_bssid: " MACSTR "\n",
+				       MAC2STR(&pmpriv->curr_bss_params
+							.attemp_bssid));
+				break;
+			}
+		} else {
+			if (memcmp(pmpriv->adapter,
+				   pmpriv->curr_bss_params.bss_descriptor
+					   .mac_address,
+				   &pmpriv->curr_bss_params.attemp_bssid,
+				   MLAN_MAC_ADDR_LENGTH)) {
+				PRINTM(MMSG, "wlan: skip link lost event\n");
+				PRINTM(MMSG,
+				       "pattempted_bssid: " MACSTR
+				       " curr_bssid:" MACSTR "\n",
+				       MAC2STR(&pmpriv->curr_bss_params
+							.attemp_bssid),
+				       MAC2STR(pmpriv->curr_bss_params
+						       .bss_descriptor
+						       .mac_address));
+				break;
+			}
+			reason_code = wlan_le16_to_cpu(
+				*(t_u16 *)(pmbuf->pbuf + pmbuf->data_offset +
+					   sizeof(eventcause)));
+			PRINTM(MMSG, "wlan: EVENT: Link lost (reason 0x%x)\n",
+			       reason_code);
+			pmpriv->disconnect_reason_code = reason_code;
+		}
 		pmadapter->dbg.num_event_link_lost++;
 		wlan_handle_disconnect_event(pmpriv);
 		break;
 
 	case EVENT_PS_SLEEP:
 		PRINTM(MINFO, "EVENT: SLEEP\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "_");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "__");
+		else
+			PRINTM(MEVENT, "_");
 
 		/* Handle unexpected PS SLEEP event */
 		if (pmadapter->ps_state == PS_STATE_SLEEP_CFM)
@@ -788,8 +895,10 @@
 
 	case EVENT_PS_AWAKE:
 		PRINTM(MINFO, "EVENT: AWAKE\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "|");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "||");
+		else
+			PRINTM(MEVENT, "|");
 		if (!pmadapter->pps_uapsd_mode && pmpriv->media_connected &&
 		    (pmpriv->port_open || !pmpriv->port_ctrl_mode) &&
 		    pmadapter->sleep_period.period) {
@@ -843,20 +952,13 @@
 	case EVENT_INIT_DONE:
 		break;
 
-	case EVENT_ADHOC_BCN_LOST:
-		PRINTM(MEVENT, "EVENT: ADHOC_BCN_LOST\n");
-		pmpriv->adhoc_is_link_sensed = MFALSE;
-		wlan_clean_txrx(pmpriv);
-		wlan_recv_event(pmpriv, MLAN_EVENT_ID_FW_ADHOC_LINK_LOST,
-				MNULL);
-		break;
 	case EVENT_ASSOC_REQ_IE:
 		pmpriv->assoc_req_size = pmbuf->data_len - sizeof(eventcause);
 		evt_buf =
 			(pmbuf->pbuf + pmbuf->data_offset + sizeof(eventcause));
 		memcpy_ext(pmpriv->adapter, pmpriv->assoc_req_buf, evt_buf,
 			   pmbuf->data_len - sizeof(eventcause),
-			   MRVDRV_ASSOC_RSP_BUF_SIZE);
+			   ASSOC_RSP_BUF_SIZE);
 		break;
 
 	case EVENT_FW_DEBUG_INFO:
@@ -872,6 +974,13 @@
 		wlan_recv_event(pmpriv, pevent->event_id, pevent);
 		break;
 
+	case EVENT_CHAN_SWITCH_TO_6G_BLOCK:
+		reason_code = wlan_le16_to_cpu(*(t_u16 *)(pmbuf->pbuf +
+							  pmbuf->data_offset +
+							  sizeof(eventcause)));
+		print_chan_switch_block_event(reason_code);
+		break;
+
 	case EVENT_BG_SCAN_REPORT:
 		PRINTM(MEVENT, "EVENT: BGS_REPORT\n");
 		pmadapter->bgscan_reported = MTRUE;
@@ -958,11 +1067,10 @@
 				   sizeof(pchan_band_info->bandcfg));
 			pchan_band_info->channel = pchan_info->channel;
 			if (pchan_band_info->bandcfg.chanWidth == CHAN_BW_80MHZ)
-				pchan_band_info->center_chan =
-					wlan_get_center_freq_idx(
-						priv, BAND_AAC,
-						pchan_info->channel,
-						CHANNEL_BW_80MHZ);
+				pchan_band_info
+					->center_chan = wlan_get_center_freq_idx(
+					priv, pchan_band_info->bandcfg.chanBand,
+					pchan_info->channel, CHANNEL_BW_80MHZ);
 			wlan_recv_event(pmpriv,
 					MLAN_EVENT_ID_FW_CHAN_SWITCH_COMPLETE,
 					pevent);
@@ -1011,8 +1119,8 @@
 				   sizeof(eventcause),
 			   pevent->event_len, pevent->event_len);
 		/* Handle / pass event data */
-		ret = wlan_11h_handle_event_chanrpt_ready(pmpriv, pevent,
-							  &radar_chan, 0);
+		ret = wlan_11h_handle_event_chanrpt_ready(
+			pmpriv, pevent, &radar_chan, &bandwidth);
 		/* Also send this event as passthru */
 		pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
 		pevent->event_len = pmbuf->data_len;
@@ -1118,26 +1226,19 @@
 		PRINTM(MEVENT, "EVENT: Pre-Beacon Lost\n");
 		wlan_recv_event(pmpriv, MLAN_EVENT_ID_FW_PRE_BCN_LOST, MNULL);
 		break;
-	case EVENT_IBSS_COALESCED:
-		PRINTM(MEVENT, "EVENT: IBSS_COALESCED\n");
-		ret = wlan_prepare_cmd(
-			pmpriv, HostCmd_CMD_802_11_IBSS_COALESCING_STATUS,
-			HostCmd_ACT_GEN_GET, 0, MNULL, MNULL);
-		break;
 	case EVENT_ADDBA:
 		PRINTM(MEVENT, "EVENT: ADDBA Request\n");
-		if (pmpriv->media_connected == MTRUE)
-			ret = wlan_prepare_cmd(pmpriv,
-					       HostCmd_CMD_11N_ADDBA_RSP,
-					       HostCmd_ACT_GEN_SET, 0, MNULL,
-					       pmadapter->event_body);
+		if (pmpriv->media_connected == MTRUE &&
+		    !pmpriv->adapter->remain_on_channel)
+			wlan_11n_add_bastream(pmpriv, pmadapter->event_body);
 		else
 			PRINTM(MERROR,
 			       "Ignore ADDBA Request event in disconnected state\n");
 		break;
 	case EVENT_DELBA:
 		PRINTM(MEVENT, "EVENT: DELBA Request\n");
-		if (pmpriv->media_connected == MTRUE)
+		if (pmpriv->media_connected == MTRUE &&
+		    !pmpriv->adapter->remain_on_channel)
 			wlan_11n_delete_bastream(pmpriv, pmadapter->event_body);
 		else
 			PRINTM(MERROR,
@@ -1145,7 +1246,8 @@
 		break;
 	case EVENT_BA_STREAM_TIMEOUT:
 		PRINTM(MEVENT, "EVENT:  BA Stream timeout\n");
-		if (pmpriv->media_connected == MTRUE)
+		if (pmpriv->media_connected == MTRUE &&
+		    !pmpriv->adapter->remain_on_channel)
 			wlan_11n_ba_stream_timeout(
 				pmpriv, (HostCmd_DS_11N_BATIMEOUT *)
 						pmadapter->event_body);
@@ -1232,6 +1334,7 @@
 		PRINTM_NETINTF(MEVENT, pmpriv);
 		PRINTM(MEVENT, "EVENT: REMAIN_ON_CHANNEL_EXPIRED reason=%d\n",
 		       *(t_u16 *)pmadapter->event_body);
+		pmpriv->adapter->remain_on_channel = MFALSE;
 		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_FLUSH_RX_WORK, MNULL);
 		wlan_recv_event(pmpriv, MLAN_EVENT_ID_FW_REMAIN_ON_CHAN_EXPIRED,
 				MNULL);
@@ -1253,10 +1356,6 @@
 		wlan_process_sta_tx_pause_event(priv, pmbuf);
 		break;
 
-	case EVENT_IBSS_STATION_CONNECT:
-		break;
-	case EVENT_IBSS_STATION_DISCONNECT:
-		break;
 	case EVENT_SAD_REPORT: {
 #ifdef DEBUG_LEVEL1
 		t_u8 *pevt_dat =
@@ -1297,6 +1396,10 @@
 		PRINTM(MEVENT, "EVENT: BT coex wlan param update\n");
 		wlan_bt_coex_wlan_param_update_event(pmpriv, pmbuf);
 		break;
+	case EVENT_NAN_GENERIC:
+		PRINTM(MEVENT, "EVENT: NAN_GENERIC_EVENT\n");
+		wlan_process_nan_event(pmpriv, pmbuf);
+		break;
 
 #if defined(PCIE)
 	case EVENT_SSU_DUMP_DMA:
@@ -1370,14 +1473,37 @@
 		pevent->bss_index = pmpriv->bss_index;
 		pevent->event_id = MLAN_EVENT_ID_FW_ROAM_OFFLOAD_RESULT;
 		/** Drop event id length and 2 bytes reverved length*/
-		pevent->event_len = pmbuf->data_len - sizeof(eventcause) - 2;
-		memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
-			   pmadapter->event_body + 2, pevent->event_len,
-			   pevent->event_len);
-		wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		if ((pmbuf->data_len - sizeof(eventcause)) > 2) {
+			pevent->event_len =
+				pmbuf->data_len - sizeof(eventcause) - 2;
+			memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
+				   pmadapter->event_body + 2, pevent->event_len,
+				   pevent->event_len);
+			wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		} else {
+			PRINTM(MERROR,
+			       "EVENT: ERR:: ROAM OFFLOAD IN FW has invalid length\n");
+		}
 		break;
 	case EVENT_CLOUD_KEEP_ALIVE_RETRY_FAIL:
 		break;
+	case EVENT_WLS_FTM_COMPLETE:
+		PRINTM(MEVENT, "EVENT: FTM_GENERIC_EVENT\n");
+		pevent->bss_index = pmpriv->bss_index;
+		event_ftm =
+			(Event_WLS_FTM_t *)(pmbuf->pbuf + pmbuf->data_offset);
+		if (event_ftm->sub_event_id == WLS_SUB_EVENT_RTT_RESULTS)
+			wlan_fill_hal_rtt_results(pmpriv, event_ftm,
+						  pmbuf->data_len, pevent);
+		else {
+			pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
+			pevent->event_len = pmbuf->data_len;
+			memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
+				   pmbuf->pbuf + pmbuf->data_offset,
+				   pevent->event_len, pevent->event_len);
+		}
+		wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		break;
 	case EVENT_VDLL_IND:
 		wlan_process_vdll_event(pmpriv, pmbuf);
 		break;
@@ -1395,7 +1521,13 @@
 		pmadapter->fw_hang_report = MTRUE;
 		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_DBG_DUMP, MNULL);
 		break;
-	case CHAN_LOAD_EVENT: {
+	case EVENT_IMD3_CAL_START:
+		PRINTM(MEVENT, "EVENT: EVENT_IMD3_CAL_START\n");
+		break;
+	case EVENT_IMD3_CAL_END:
+		PRINTM(MEVENT, "EVENT: EVENT_IMD3_CAL_END\n");
+		break;
+	case EVENT_CHAN_LOAD: {
 		t_u8 *ptr = MNULL;
 		HostCmd_DS_GET_CH_LOAD *cfg_cmd = MNULL;
 		ptr = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
diff --git a/wlan_sd8987/mlan/mlan_sta_ioctl.c b/wlan_src/mlan/mlan_sta_ioctl.c
old mode 100755
new mode 100644
similarity index 93%
rename from wlan_sd8987/mlan/mlan_sta_ioctl.c
rename to wlan_src/mlan/mlan_sta_ioctl.c
index 205a2a8..086ac76
--- a/wlan_sd8987/mlan/mlan_sta_ioctl.c
+++ b/wlan_src/mlan/mlan_sta_ioctl.c
@@ -3,20 +3,29 @@
  *  @brief This file contains the functions for station ioctl.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -35,9 +44,6 @@
 #include "mlan_11ac.h"
 #include "mlan_11ax.h"
 #include "mlan_11h.h"
-#ifdef DRV_EMBEDDED_SUPPLICANT
-#include "authenticator_api.h"
-#endif
 
 /********************************************************
 			Local Variables
@@ -321,9 +327,6 @@
 	info->param.bss_info.max_power_level = pmpriv->max_tx_power_level;
 	info->param.bss_info.min_power_level = pmpriv->min_tx_power_level;
 
-	/* AdHoc state */
-	info->param.bss_info.adhoc_state = pmpriv->adhoc_state;
-
 	/* Last beacon NF */
 	info->param.bss_info.bcn_nf_last = pmpriv->bcn_nf_last;
 
@@ -423,11 +426,16 @@
 			pget_info->param.fw_info.force_reg = MTRUE;
 		else
 			pget_info->param.fw_info.force_reg = MFALSE;
+		/**country code from OTP */
+		pget_info->param.fw_info.fw_country_code =
+			pmadapter->fw_country_code;
 		pget_info->param.fw_info.ecsa_enable = pmadapter->ecsa_enable;
 		pget_info->param.fw_info.getlog_enable =
 			pmadapter->getlog_enable;
 		pget_info->param.fw_info.hw_dev_mcs_support =
 			pmadapter->hw_dev_mcs_support;
+		pget_info->param.fw_info.hw_mpdu_density =
+			pmadapter->hw_mpdu_density;
 		pget_info->param.fw_info.hw_dot_11n_dev_cap =
 			pmadapter->hw_dot_11n_dev_cap;
 		pget_info->param.fw_info.usr_dev_mcs_support =
@@ -467,6 +475,12 @@
 									0x00;
 		pget_info->param.fw_info.fw_beacon_prot =
 			IS_FW_SUPPORT_BEACON_PROT(pmadapter) ? 0x01 : 0x00;
+		pget_info->param.fw_info.rtt_support =
+			IS_FW_SUPPORT_RTT(pmadapter) ? 0x01 : 0x00;
+		pget_info->param.fw_info.cmd_tx_data =
+			IS_FW_SUPPORT_CMD_TX_DATA(pmadapter) ? 0x01 : 0x00;
+		pget_info->param.fw_info.sec_rgpower =
+			IS_FW_SUPPORT_SEC_RG_POWER(pmadapter) ? 0x01 : 0x00;
 		break;
 	case MLAN_OID_GET_BSS_INFO:
 		status = wlan_get_info_bss_info(pmadapter, pioctl_req);
@@ -687,47 +701,39 @@
 	}
 	pioctl_req->data_read_written =
 		sizeof(mlan_multicast_list) + MLAN_SUB_COMMAND_SIZE;
-	if (bss->param.multicast_list.mode == MLAN_PROMISC_MODE) {
-		PRINTM(MINFO, "Enable Promiscuous mode\n");
-		pmpriv->curr_pkt_filter |= HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
+	/* Multicast */
+	pmpriv->curr_pkt_filter &= ~HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
+	if (bss->param.multicast_list.mode == MLAN_ALL_MULTI_MODE) {
+		PRINTM(MINFO, "Enabling All Multicast!\n");
+		pmpriv->curr_pkt_filter |= HostCmd_ACT_MAC_ALL_MULTICAST_ENABLE;
+	} else {
 		pmpriv->curr_pkt_filter &=
 			~HostCmd_ACT_MAC_ALL_MULTICAST_ENABLE;
-	} else {
-		/* Multicast */
-		pmpriv->curr_pkt_filter &= ~HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
-		if (bss->param.multicast_list.mode == MLAN_ALL_MULTI_MODE) {
-			PRINTM(MINFO, "Enabling All Multicast!\n");
+		if (bss->param.multicast_list.mode == MLAN_PROMISC_MODE)
 			pmpriv->curr_pkt_filter |=
-				HostCmd_ACT_MAC_ALL_MULTICAST_ENABLE;
-		} else {
-			pmpriv->curr_pkt_filter &=
-				~HostCmd_ACT_MAC_ALL_MULTICAST_ENABLE;
-			if (bss->param.multicast_list.num_multicast_addr) {
-				PRINTM(MINFO, "Set multicast list=%d\n",
-				       bss->param.multicast_list
-					       .num_multicast_addr);
-				/* Set multicast addresses to firmware */
-				if (old_pkt_filter == pmpriv->curr_pkt_filter) {
-					/* Send request to firmware */
-					ret = wlan_prepare_cmd(
-						pmpriv,
-						HostCmd_CMD_MAC_MULTICAST_ADR,
-						HostCmd_ACT_GEN_SET, 0,
-						(t_void *)pioctl_req,
-						&bss->param.multicast_list);
-					if (ret == MLAN_STATUS_SUCCESS)
-						ret = MLAN_STATUS_PENDING;
-				} else {
-					/* Send request to firmware */
-					ret = wlan_prepare_cmd(
-						pmpriv,
-						HostCmd_CMD_MAC_MULTICAST_ADR,
-						HostCmd_ACT_GEN_SET, 0, MNULL,
-						&bss->param.multicast_list);
-				}
-				if (ret)
-					goto exit;
+				HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
+		if (bss->param.multicast_list.num_multicast_addr) {
+			PRINTM(MINFO, "Set multicast list=%d\n",
+			       bss->param.multicast_list.num_multicast_addr);
+			/* Set multicast addresses to firmware */
+			if (old_pkt_filter == pmpriv->curr_pkt_filter) {
+				/* Send request to firmware */
+				ret = wlan_prepare_cmd(
+					pmpriv, HostCmd_CMD_MAC_MULTICAST_ADR,
+					HostCmd_ACT_GEN_SET, 0,
+					(t_void *)pioctl_req,
+					&bss->param.multicast_list);
+				if (ret == MLAN_STATUS_SUCCESS)
+					ret = MLAN_STATUS_PENDING;
+			} else {
+				/* Send request to firmware */
+				ret = wlan_prepare_cmd(
+					pmpriv, HostCmd_CMD_MAC_MULTICAST_ADR,
+					HostCmd_ACT_GEN_SET, 0, MNULL,
+					&bss->param.multicast_list);
 			}
+			if (ret)
+				goto exit;
 		}
 	}
 	PRINTM(MINFO, "old_pkt_filter=0x%x, curr_pkt_filter=0x%x\n",
@@ -772,9 +778,7 @@
 		return MLAN_STATUS_FAILURE;
 	}
 	if ((wlan_11d_is_enabled(pmpriv) && pmpriv->media_connected == MTRUE) &&
-	    ((pmpriv->bss_mode == MLAN_BSS_MODE_INFRA) ||
-	     (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS &&
-	      pmpriv->adhoc_state != ADHOC_STARTED))) {
+	    ((pmpriv->bss_mode == MLAN_BSS_MODE_INFRA))) {
 		t_u8 chan_no;
 		t_u16 band;
 
@@ -897,8 +901,6 @@
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-	if (pmadapter->adhoc_start_band & BAND_A)
-		pmadapter->adhoc_start_band = BAND_G | BAND_B;
 	if (bss->param.bss_chan.channel) {
 		if (bss->param.bss_chan.channel <= MAX_CHANNEL_BAND_B)
 			cfp = wlan_find_cfp_by_band_and_channel(
@@ -909,7 +911,6 @@
 				pmadapter, BAND_A,
 				(t_u16)bss->param.bss_chan.channel);
 			if (cfp) {
-				pmadapter->adhoc_start_band = BAND_A;
 			}
 		}
 	} else {
@@ -920,7 +921,6 @@
 			cfp = wlan_find_cfp_by_band_and_freq(
 				pmadapter, BAND_A, bss->param.bss_chan.freq);
 			if (cfp) {
-				pmadapter->adhoc_start_band = BAND_A;
 			}
 		}
 	}
@@ -931,8 +931,6 @@
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-	pmpriv->adhoc_channel = (t_u8)cfp->channel;
-	pmpriv->intf_state_11h.adhoc_auto_sel_chan = MFALSE;
 	bss->param.bss_chan.channel = cfp->channel;
 	bss->param.bss_chan.freq = cfp->freq;
 
@@ -1100,65 +1098,6 @@
 			goto start_ssid_done;
 		}
 	} else {
-		/* Adhoc mode */
-		/* If the requested SSID matches current SSID, return */
-		if (bss->param.ssid_bssid.ssid.ssid_len &&
-		    (!wlan_ssid_cmp(pmadapter,
-				    &pmpriv->curr_bss_params.bss_descriptor.ssid,
-				    &bss->param.ssid_bssid.ssid))) {
-			ret = MLAN_STATUS_SUCCESS;
-			goto start_ssid_done;
-		}
-
-		/* Exit Adhoc mode first */
-		PRINTM(MINFO, "Sending Adhoc Stop\n");
-		ret = wlan_disconnect(pmpriv, MNULL, MNULL);
-		if (ret)
-			goto start_ssid_done;
-
-		pmpriv->adhoc_is_link_sensed = MFALSE;
-
-		if (!bss->param.ssid_bssid.idx ||
-		    bss->param.ssid_bssid.idx > pmadapter->num_in_scan_table) {
-			/* Search for the requested network in the scan table */
-			if (bss->param.ssid_bssid.ssid.ssid_len) {
-				i = wlan_find_ssid_in_list(
-					pmpriv, &bss->param.ssid_bssid.ssid,
-					MNULL, MLAN_BSS_MODE_IBSS);
-			} else {
-				i = wlan_find_bssid_in_list(
-					pmpriv,
-					(t_u8 *)&bss->param.ssid_bssid.bssid,
-					MLAN_BSS_MODE_IBSS);
-			}
-		} else {
-			/* use bsslist index number to assoicate */
-			i = wlan_is_network_compatible(
-				pmpriv, bss->param.ssid_bssid.idx - 1,
-				pmpriv->bss_mode);
-		}
-
-		if (i >= 0) {
-			PRINTM(MINFO,
-			       "Network found in scan list ... joining ...\n");
-			pmpriv->curr_chan_flags =
-				bss->param.ssid_bssid.channel_flags;
-			ret = wlan_adhoc_join(pmpriv, pioctl_req,
-					      &pmadapter->pscan_table[i]);
-			if (ret)
-				goto start_ssid_done;
-		} else { /* i >= 0 */
-			PRINTM(MINFO,
-			       "Network not found in the list, "
-			       "creating adhoc with ssid = %s\n",
-			       bss->param.ssid_bssid.ssid.ssid);
-			pmpriv->curr_chan_flags =
-				bss->param.ssid_bssid.channel_flags;
-			ret = wlan_adhoc_start(pmpriv, pioctl_req,
-					       &bss->param.ssid_bssid.ssid);
-			if (ret)
-				goto start_ssid_done;
-		}
 	}
 
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -1194,50 +1133,6 @@
 }
 
 /**
- *  @brief Set/Get IBSS channel
- *
- *  @param pmadapter	A pointer to mlan_adapter structure
- *  @param pioctl_req	A pointer to ioctl request buffer
- *
- *  @return		MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success,
- * otherwise fail
- */
-static mlan_status wlan_bss_ioctl_ibss_channel(pmlan_adapter pmadapter,
-					       pmlan_ioctl_req pioctl_req)
-{
-	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_bss *bss = MNULL;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	t_u16 cmd_action;
-
-	ENTER();
-
-	bss = (mlan_ds_bss *)pioctl_req->pbuf;
-	if (pioctl_req->action == MLAN_ACT_GET) {
-		if (pmpriv->media_connected == MFALSE) {
-			bss->param.bss_chan.channel = pmpriv->adhoc_channel;
-			goto exit;
-		}
-		cmd_action = HostCmd_ACT_GEN_GET;
-	} else {
-		cmd_action = HostCmd_ACT_GEN_SET;
-		pmpriv->adhoc_channel = (t_u8)bss->param.bss_chan.channel;
-		pmpriv->intf_state_11h.adhoc_auto_sel_chan = MFALSE;
-	}
-
-	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_RF_CHANNEL,
-			       cmd_action, 0, (t_void *)pioctl_req,
-			       &bss->param.bss_chan.channel);
-	if (ret == MLAN_STATUS_SUCCESS)
-		ret = MLAN_STATUS_PENDING;
-
-exit:
-	LEAVE();
-	return ret;
-}
-
-/**
  *  @brief Set/Get Listen Interval
  *
  *  @param pmadapter	A pointer to mlan_adapter structure
@@ -1264,65 +1159,6 @@
 	return MLAN_STATUS_SUCCESS;
 }
 
-/*
- *  @brief Set/Get beacon interval
- *
- *  @param pmadapter	A pointer to mlan_adapter structure
- *  @param pioctl_req	A pointer to ioctl request buffer
- *
- *  @return		MLAN_STATUS_SUCCESS --success
- */
-static mlan_status wlan_bss_ioctl_beacon_interval(pmlan_adapter pmadapter,
-						  pmlan_ioctl_req pioctl_req)
-{
-	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_bss *bss = MNULL;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	ENTER();
-	bss = (mlan_ds_bss *)pioctl_req->pbuf;
-	if (pioctl_req->action == MLAN_ACT_GET) {
-		bss->param.bcn_interval = pmpriv->beacon_period;
-		if (pmpriv->media_connected == MTRUE)
-			bss->param.bcn_interval =
-				pmpriv->curr_bss_params.bss_descriptor
-					.beacon_period;
-	} else
-		pmpriv->beacon_period = (t_u16)bss->param.bcn_interval;
-	pioctl_req->data_read_written = sizeof(t_u32) + MLAN_SUB_COMMAND_SIZE;
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief Set/Get ATIM window
- *
- *  @param pmadapter	A pointer to mlan_adapter structure
- *  @param pioctl_req	A pointer to ioctl request buffer
- *
- *  @return		MLAN_STATUS_SUCCESS --success
- */
-static mlan_status wlan_bss_ioctl_atim_window(pmlan_adapter pmadapter,
-					      pmlan_ioctl_req pioctl_req)
-{
-	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_bss *bss = MNULL;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	ENTER();
-	bss = (mlan_ds_bss *)pioctl_req->pbuf;
-	if (pioctl_req->action == MLAN_ACT_GET) {
-		bss->param.atim_window = pmpriv->atim_window;
-		if (pmpriv->media_connected == MTRUE)
-			bss->param.atim_window =
-				pmpriv->curr_bss_params.bss_descriptor
-					.atim_window;
-	} else
-		pmpriv->atim_window = (t_u16)bss->param.atim_window;
-
-	pioctl_req->data_read_written = sizeof(t_u32) + MLAN_SUB_COMMAND_SIZE;
-	LEAVE();
-	return ret;
-}
-
 /**
  *  @brief Query embe
  *
@@ -1356,7 +1192,6 @@
 		LEAVE();
 		return ret;
 	}
-	memset(pmadapter, sec, 0, sizeof(mlan_ds_sec_cfg));
 	sec_pp = (mlan_ds_passphrase *)&sec->param.passphrase;
 	sec_pp->psk_type = MLAN_PSK_QUERY;
 	if (ssid_bssid->ssid.ssid_len == 0) {
@@ -1400,10 +1235,6 @@
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	mlan_ds_bss *bss = MNULL;
-	mlan_ssid_bssid *ssid_bssid = MNULL;
-#endif
 
 	ENTER();
 
@@ -1415,14 +1246,6 @@
 			return MLAN_STATUS_PENDING;
 		}
 	}
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	if (!IS_FW_SUPPORT_SUPPLICANT(pmpriv->adapter)) {
-		bss = (mlan_ds_bss *)pioctl_req->pbuf;
-		ssid_bssid = &bss->param.ssid_bssid;
-		supplicantQueryPassphraseAndEnable(pmpriv->psapriv,
-						   (t_u8 *)ssid_bssid);
-	}
-#endif
 
 	ret = wlan_find_bss(pmpriv, pioctl_req);
 
@@ -1516,6 +1339,7 @@
 {
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	mlan_ds_bss *bss = MNULL;
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 
 	ENTER();
 
@@ -1531,6 +1355,16 @@
 	bss = (mlan_ds_bss *)pioctl_req->pbuf;
 
 	switch (bss->sub_command) {
+	case MLAN_OID_BSS_HOST_MLME:
+		pmpriv->curr_bss_params.host_mlme = MTRUE;
+		memcpy_ext(pmpriv->adapter,
+			   &pmpriv->curr_bss_params.attemp_bssid,
+			   &bss->param.bssid, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+		/* clear assoc_rsp_size */
+		pmpriv->assoc_rsp_size = 0;
+		pmpriv->assoc_req_size = 0;
+		break;
 	case MLAN_OID_BSS_START:
 		status = wlan_bss_ioctl_start(pmadapter, pioctl_req);
 		break;
@@ -1559,15 +1393,6 @@
 	case MLAN_OID_BSS_FIND_BSSID:
 		status = wlan_bss_ioctl_find_bssid(pmadapter, pioctl_req);
 		break;
-	case MLAN_OID_IBSS_BCN_INTERVAL:
-		status = wlan_bss_ioctl_beacon_interval(pmadapter, pioctl_req);
-		break;
-	case MLAN_OID_IBSS_ATIM_WINDOW:
-		status = wlan_bss_ioctl_atim_window(pmadapter, pioctl_req);
-		break;
-	case MLAN_OID_IBSS_CHANNEL:
-		status = wlan_bss_ioctl_ibss_channel(pmadapter, pioctl_req);
-		break;
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
 	case MLAN_OID_BSS_ROLE:
 		util_enqueue_list_tail(pmadapter->pmoal_handle,
@@ -1638,10 +1463,7 @@
 			rate->param.rates);
 	else
 		wlan_get_active_data_rates(pmpriv, pmpriv->bss_mode,
-					   (pmpriv->bss_mode ==
-					    MLAN_BSS_MODE_INFRA) ?
-						   pmpriv->config_bands :
-						   pmadapter->adhoc_start_band,
+					   pmpriv->config_bands,
 					   rate->param.rates);
 	pioctl_req->data_read_written =
 		MLAN_SUPPORTED_RATES + MLAN_SUB_COMMAND_SIZE;
@@ -1772,7 +1594,6 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto exit;
 	}
-	memset(pmadapter, buf, 0, MRVDRV_SIZE_OF_CMD_BUFFER);
 	txp_cfg = (HostCmd_DS_TXPWR_CFG *)buf;
 	txp_cfg->action = HostCmd_ACT_GEN_SET;
 	if (!power->param.power_cfg.is_power_auto) {
@@ -1781,6 +1602,10 @@
 				  *)(buf + sizeof(HostCmd_DS_TXPWR_CFG));
 		pg_tlv->type = TLV_TYPE_POWER_GROUP;
 		pg_tlv->length = 4 * sizeof(Power_Group_t);
+		/*Power Groups for VHTBW20, VHTBW40, VHTBW80 */
+		pg_tlv->length += 3 * sizeof(Power_Group_t);
+		/*Power Groups for HEBW20, HEBW40, HEBW80 */
+		pg_tlv->length += 3 * sizeof(Power_Group_t);
 		pg = (Power_Group_t *)(buf + sizeof(HostCmd_DS_TXPWR_CFG) +
 				       sizeof(MrvlTypes_Power_Group_t));
 		/* Power group for modulation class HR/DSSS */
@@ -1806,7 +1631,7 @@
 		pg->power_step = 0;
 		pg->power_min = (t_s8)dbm;
 		pg->power_max = (t_s8)dbm;
-		pg->ht_bandwidth = HT_BW_20;
+		pg->ht_bandwidth = BW_20;
 		pg++;
 		/* Power group for modulation class HTBW40 */
 		pg->first_rate_code = 0x00;
@@ -1815,7 +1640,61 @@
 		pg->power_step = 0;
 		pg->power_min = (t_s8)dbm;
 		pg->power_max = (t_s8)dbm;
-		pg->ht_bandwidth = HT_BW_40;
+		pg->ht_bandwidth = BW_40;
+		pg++;
+		/* Power group for modulation class VHTBW20 */
+		pg->first_rate_code = 0x00;
+		pg->last_rate_code = 0x19;
+		pg->modulation_class = MOD_CLASS_VHT;
+		pg->power_step = 0;
+		pg->power_min = (t_s8)dbm;
+		pg->power_max = (t_s8)dbm;
+		pg->ht_bandwidth = BW_20;
+		pg++;
+		/* Power group for modulation class VHTBW40 */
+		pg->first_rate_code = 0x00;
+		pg->last_rate_code = 0x19;
+		pg->modulation_class = MOD_CLASS_VHT;
+		pg->power_step = 0;
+		pg->power_min = (t_s8)dbm;
+		pg->power_max = (t_s8)dbm;
+		pg->ht_bandwidth = BW_40;
+		pg++;
+		/* Power group for modulation class VHTBW80 */
+		pg->first_rate_code = 0x00;
+		pg->last_rate_code = 0x19;
+		pg->modulation_class = MOD_CLASS_VHT;
+		pg->power_step = 0;
+		pg->power_min = (t_s8)dbm;
+		pg->power_max = (t_s8)dbm;
+		pg->ht_bandwidth = BW_80;
+		pg++;
+		/* Power group for modulation class HEBW20 */
+		pg->first_rate_code = 0x00;
+		pg->last_rate_code = 0x1B;
+		pg->modulation_class = MOD_CLASS_HE;
+		pg->power_step = 0;
+		pg->power_min = (t_s8)dbm;
+		pg->power_max = (t_s8)dbm;
+		pg->ht_bandwidth = BW_20;
+		pg++;
+		/* Power group for modulation class HEBW40 */
+		pg->first_rate_code = 0x00;
+		pg->last_rate_code = 0x1B;
+		pg->modulation_class = MOD_CLASS_HE;
+		pg->power_step = 0;
+		pg->power_min = (t_s8)dbm;
+		pg->power_max = (t_s8)dbm;
+		pg->ht_bandwidth = BW_40;
+		pg++;
+		/* Power group for modulation class HEBW80 */
+		pg->first_rate_code = 0x00;
+		pg->last_rate_code = 0x1B;
+		pg->modulation_class = MOD_CLASS_HE;
+		pg->power_step = 0;
+		pg->power_min = (t_s8)dbm;
+		pg->power_max = (t_s8)dbm;
+		pg->ht_bandwidth = BW_80;
 	}
 
 	/* Send request to firmware */
@@ -1867,7 +1746,6 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto exit;
 	}
-	memset(pmadapter, buf, 0, MRVDRV_SIZE_OF_CMD_BUFFER);
 	txp_cfg = (HostCmd_DS_TXPWR_CFG *)buf;
 	txp_cfg->action = HostCmd_ACT_GEN_SET;
 	pwr_grp = &power->param.power_ext.power_group[0];
@@ -2428,6 +2306,9 @@
 	case MLAN_OID_PM_CFG_SLEEP_PD:
 		status = wlan_set_get_sleep_pd(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_PM_CFG_FW_WAKEUP_METHOD:
+		status = wlan_fw_wakeup_method(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_PM_CFG_SLEEP_PARAMS:
 		status = wlan_set_get_sleep_params(pmadapter, pioctl_req);
 		break;
@@ -2693,8 +2574,15 @@
 	sec = (mlan_ds_sec_cfg *)pioctl_req->pbuf;
 	if (pioctl_req->action == MLAN_ACT_GET)
 		sec->param.auth_mode = pmpriv->sec_info.authentication_mode;
-	else
+	else {
 		pmpriv->sec_info.authentication_mode = sec->param.auth_mode;
+		if (pmpriv->sec_info.authentication_mode ==
+		    MLAN_AUTH_MODE_OWE) {
+			/* set ewpa_query to TRUE for OWE to set ewpa_enabled
+			 * flag later */
+			pmpriv->ewpa_query = MTRUE;
+		}
+	}
 
 	pioctl_req->data_read_written = sizeof(t_u32) + MLAN_SUB_COMMAND_SIZE;
 	LEAVE();
@@ -2797,7 +2685,7 @@
 	mrvl_wep_key_t *pwep_key = MNULL;
 	int index;
 	int i = 0;
-
+	int max_key_index = 5;
 	ENTER();
 
 	if (pmpriv->wep_key_curr_index >= MRVL_NUM_WEP_KEY)
@@ -2809,8 +2697,11 @@
 		sec->param.encrypt_key.key_index = index;
 	} else {
 		if (sec->param.encrypt_key.key_index >= MRVL_NUM_WEP_KEY) {
+			if (IS_FW_SUPPORT_BEACON_PROT(pmadapter))
+				max_key_index = 7;
 			if ((sec->param.encrypt_key.key_remove == MTRUE) &&
-			    (sec->param.encrypt_key.key_index <= 5)) {
+			    (sec->param.encrypt_key.key_index <=
+			     max_key_index)) {
 				/* call firmware remove key */
 				ret = wlan_prepare_cmd(
 					pmpriv, HostCmd_CMD_802_11_KEY_MATERIAL,
@@ -2821,7 +2712,8 @@
 					ret = MLAN_STATUS_PENDING;
 				goto exit;
 			}
-			PRINTM(MERROR, "Key_index is invalid\n");
+			PRINTM(MERROR, "Key_index %d is invalid.\n",
+			       sec->param.encrypt_key.key_index);
 			ret = MLAN_STATUS_FAILURE;
 			goto exit;
 		}
@@ -3012,8 +2904,8 @@
 	}
 
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_KEY_MATERIAL,
-			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
-			       &sec->param.encrypt_key);
+			       (t_u16)pioctl_req->action, 0,
+			       (t_void *)pioctl_req, &sec->param.encrypt_key);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -3127,7 +3019,9 @@
 	mlan_ds_sec_cfg *sec = MNULL;
 	ENTER();
 	sec = (mlan_ds_sec_cfg *)pioctl_req->pbuf;
-	if (pioctl_req->action == MLAN_ACT_SET) {
+	if ((pioctl_req->action == MLAN_ACT_SET) ||
+	    (pioctl_req->action == MLAN_ACT_PASN_KEY_DNLD) ||
+	    (pioctl_req->action == MLAN_ACT_CLEAR)) {
 		if (sec->param.encrypt_key.is_wapi_key)
 			status = wlan_sec_ioctl_set_wapi_key(pmadapter,
 							     pioctl_req);
@@ -3795,7 +3689,6 @@
 {
 	pmlan_private pmpriv = MNULL;
 	mlan_status ret = MLAN_STATUS_FAILURE;
-	t_u8 chan_width = CHAN_BW_20MHZ;
 	Band_Config_t bandcfg;
 
 	ENTER();
@@ -3809,56 +3702,6 @@
 	}
 
 	memset(pmadapter, &bandcfg, 0, sizeof(Band_Config_t));
-	pmpriv->adhoc_state = ADHOC_STARTING;
-
-	if ((pmadapter->adhoc_start_band & BAND_A)) {
-		if (pmpriv->intf_state_11h.adhoc_auto_sel_chan)
-			pmpriv->adhoc_channel =
-				wlan_11h_get_adhoc_start_channel(pmpriv);
-
-		/*
-		 * Check if the region and channel requires a channel
-		 * availability check.
-		 */
-		if (wlan_11h_radar_detect_required(pmpriv,
-						   pmpriv->adhoc_channel) &&
-		    !wlan_11h_is_channel_under_nop(pmadapter,
-						   pmpriv->adhoc_channel)) {
-			/*
-			 * Radar detection is required for this channel, make
-			 * sure 11h is activated in the firmware
-			 */
-			ret = wlan_11h_activate(pmpriv, MNULL, MTRUE);
-			ret = wlan_11h_config_master_radar_det(pmpriv, MTRUE);
-			ret = wlan_11h_check_update_radar_det_state(pmpriv);
-
-			/* Check for radar on the channel */
-			if ((pmadapter->chan_bandwidth ==
-			     CHANNEL_BW_40MHZ_ABOVE) ||
-			    (pmadapter->chan_bandwidth ==
-			     CHANNEL_BW_40MHZ_BELOW)) {
-				chan_width = CHAN_BW_40MHZ;
-				if (pmadapter->chanrpt_param_bandcfg) {
-					bandcfg.chan2Offset =
-						pmadapter->chan_bandwidth;
-				}
-			} else if (pmadapter->chan_bandwidth ==
-				   CHANNEL_BW_80MHZ)
-				chan_width = CHAN_BW_80MHZ;
-			if (pmadapter->chanrpt_param_bandcfg) {
-				bandcfg.chanWidth = chan_width;
-				bandcfg.chanBand = BAND_5GHZ;
-			} else {
-				*((t_u8 *)&bandcfg) = chan_width;
-			}
-
-			ret = wlan_11h_issue_radar_detect(pmpriv, pioctl_req,
-							  pmpriv->adhoc_channel,
-							  bandcfg);
-			if (ret == MLAN_STATUS_SUCCESS)
-				ret = MLAN_STATUS_PENDING;
-		}
-	}
 
 	LEAVE();
 	return ret;
@@ -4675,8 +4518,7 @@
 		else
 			pmadapter->region_code = 0;
 		if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
-					 pmadapter->config_bands |
-						 pmadapter->adhoc_start_band)) {
+					 pmadapter->config_bands)) {
 			pioctl_req->status_code = MLAN_ERROR_INVALID_PARAMETER;
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
@@ -4810,8 +4652,8 @@
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_misc_ioctl_ipv6_ra_offload(pmlan_adapter pmadapter,
-					    mlan_ioctl_req *pioctl_req)
+static mlan_status wlan_misc_ioctl_ipv6_ra_offload(pmlan_adapter pmadapter,
+						   mlan_ioctl_req *pioctl_req)
 {
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_ds_misc_cfg *misc = MNULL;
@@ -5025,6 +4867,80 @@
 }
 
 /**
+ *  @brief cloud keep alive rx
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   Pointer to the IOCTL request buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_misc_cloud_keep_alive_rx(pmlan_adapter pmadapter,
+						 mlan_ioctl_req *pioctl_req)
+{
+	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *misc = MNULL;
+	t_u16 cmd_action = 0;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else if (pioctl_req->action == MLAN_ACT_GET) {
+		cmd_action = HostCmd_ACT_GEN_GET;
+	} else if (pioctl_req->action == MLAN_ACT_RESET) {
+		cmd_action = HostCmd_ACT_GEN_RESET;
+	} else {
+		cmd_action = HostCmd_ACT_GEN_REMOVE;
+	}
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_AUTO_TX, cmd_action,
+			       OID_CLOUD_KEEP_ALIVE_ACK, (t_void *)pioctl_req,
+			       &misc->param.keep_alive_rx);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief configure auth,assoc timeout parameter
+ *
+ *  @param pmadapter   A pointer to mlan_adapter structure
+ *  @param pioctl_req  A pointer to ioctl request buffer
+ *
+ *  @return        MLAN_STATUS_PENDING --success, otherwise fail
+ */
+static mlan_status wlan_misc_auth_assoc_timeout_cfg(pmlan_adapter pmadapter,
+						    pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *pmisc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else
+		cmd_action = HostCmd_ACT_GEN_GET;
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_AUTH_ASSOC_TIMEOUT_CFG,
+			       cmd_action, 0, (t_void *)pioctl_req,
+			       &(pmisc->param.auth_assoc_cfg));
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Miscellaneous configuration handler
  *
  *  @param pmadapter	A pointer to mlan_adapter structure
@@ -5153,6 +5069,9 @@
 	case MLAN_OID_MISC_HOTSPOT_CFG:
 		status = wlan_misc_hotspot_cfg(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_MULTI_AP_CFG:
+		status = wlan_misc_multi_ap_cfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_OTP_USER_DATA:
 		status = wlan_misc_otp_user_data(pmadapter, pioctl_req);
 		break;
@@ -5171,11 +5090,9 @@
 	case MLAN_OID_MISC_TXCONTROL:
 		status = wlan_misc_ioctl_txcontrol(pmadapter, pioctl_req);
 		break;
-#ifdef STA_SUPPORT
 	case MLAN_OID_MISC_EXT_CAP_CFG:
 		status = wlan_misc_ext_capa_cfg(pmadapter, pioctl_req);
 		break;
-#endif
 	case MLAN_OID_MISC_PMFCFG:
 		status = wlan_misc_pmfcfg(pmadapter, pioctl_req);
 		break;
@@ -5196,9 +5113,6 @@
 	case MLAN_OID_MISC_PMIC_CFG:
 		status = wlan_misc_ioctl_pmic_configure(pmadapter, pioctl_req);
 		break;
-	case MLAN_OID_MISC_CWMODE_CTRL:
-		status = wlan_misc_ioctl_cwmode_ctrl(pmadapter, pioctl_req);
-		break;
 	case MLAN_OID_MISC_MEF_FLT_CFG:
 		status = wlan_misc_ioctl_mef_flt_cfg(pmadapter, pioctl_req);
 		break;
@@ -5241,6 +5155,13 @@
 	case MLAN_OID_MISC_GET_TSF:
 		status = wlan_misc_ioctl_get_tsf(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_CROSS_CHIP_SYNCH:
+		status =
+			wlan_misc_ioctl_cross_chip_synch(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_TSP_CFG:
+		status = wlan_misc_ioctl_tsp_config(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_ROAM_OFFLOAD:
 		status = wlan_misc_roam_offload(pmadapter, pioctl_req);
 		break;
@@ -5250,9 +5171,15 @@
 	case MLAN_OID_MISC_GET_CHAN_REGION_CFG:
 		status = wlan_misc_chan_reg_cfg(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_REGION_POWER_CFG:
+		status = wlan_misc_region_power_cfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_CLOUD_KEEP_ALIVE:
 		status = wlan_misc_cloud_keep_alive(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX:
+		status = wlan_misc_cloud_keep_alive_rx(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_DYN_BW:
 		status = wlan_misc_ioctl_dyn_bw(pmadapter, pioctl_req);
 		break;
@@ -5268,9 +5195,21 @@
 	case MLAN_OID_MISC_DMCS_CONFIG:
 		status = wlan_misc_dmcs_config(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_CONFIG_RTT:
+		status = wlan_config_rtt(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_CANCEL_RTT:
+		status = wlan_cancel_rtt(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_RTT_RESPONDER_CFG:
+		status = wlan_rtt_responder_cfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_GET_TX_RX_HISTOGRAM:
 		status = wlan_get_tx_rx_histogram(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_GPIO_CFG:
+		status = wlan_misc_gpiocfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_BOOT_SLEEP:
 		status = wlan_misc_bootsleep(pmadapter, pioctl_req);
 		break;
@@ -5300,9 +5239,18 @@
 	case MLAN_OID_MISC_RX_ABORT_CFG:
 		status = wlan_misc_ioctl_rxabortcfg(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_OFDM_DESENSE_CFG:
+		status = wlan_misc_ioctl_ofdmdesense_cfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_RX_ABORT_CFG_EXT:
 		status = wlan_misc_ioctl_rxabortcfg_ext(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_NAV_MITIGATION:
+		status = wlan_misc_ioctl_nav_mitigation(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_LED_CONFIG:
+		status = wlan_misc_ioctl_led(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_TX_AMPDU_PROT_MODE:
 		status = wlan_misc_ioctl_tx_ampdu_prot_mode(pmadapter,
 							    pioctl_req);
@@ -5328,6 +5276,8 @@
 	case MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME:
 	case MLAN_OID_MISC_RF_TEST_TX_FRAME:
 	case MLAN_OID_MISC_RF_TEST_HE_POWER:
+	case MLAN_OID_MISC_OTP_MAC_RD_WR:
+	case MLAN_OID_MISC_OTP_CAL_DATA_RD_WR:
 		status = wlan_misc_ioctl_rf_test_cfg(pmadapter, pioctl_req);
 		break;
 	case MLAN_OID_MISC_ARB_CONFIG:
@@ -5336,12 +5286,29 @@
 	case MLAN_OID_MISC_RANGE_EXT:
 		status = wlan_misc_ioctl_range_ext(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_11AX_TWT_CFG:
+		status = wlan_misc_ioctl_twt_report(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_TP_STATE:
 		status = wlan_misc_ioctl_tp_state(pmadapter, pioctl_req);
 		break;
 	case MLAN_OID_MISC_IPS_CFG:
 		status = wlan_misc_ioctl_ips_cfg(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_REORDER_FLUSH_TIME:
+		status = wlan_misc_ioctl_reorder_flush_time(pmadapter,
+							    pioctl_req);
+		break;
+	case MLAN_OID_MISC_TX_FRAME:
+		status = wlan_misc_ioctl_tx_frame(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_EDMAC_CONFIG:
+		status = wlan_misc_ioctl_edmac_cfg(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_AUTH_ASSOC_TIMEOUT_CONFIG:
+		status =
+			wlan_misc_auth_assoc_timeout_cfg(pmadapter, pioctl_req);
+		break;
 	default:
 		if (pioctl_req)
 			pioctl_req->status_code = MLAN_ERROR_IOCTL_INVALID;
@@ -5426,8 +5393,7 @@
  *  @return		MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success,
  * otherwise fail
  */
-static mlan_status wlan_scan_ioctl(pmlan_adapter pmadapter,
-				   pmlan_ioctl_req pioctl_req)
+mlan_status wlan_scan_ioctl(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req)
 {
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -5451,6 +5417,15 @@
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
+	if (pmadapter->remain_on_channel && pioctl_req->action == MLAN_ACT_SET
+#ifdef WIFI_DIRECT_SUPPORT
+	    && (pmpriv->bss_type != MLAN_BSS_TYPE_WIFIDIRECT)
+#endif
+	) {
+		PRINTM(MERROR, "Scan is blocked during remain on channel...\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
 start_config:
 	/* Set scan */
 	if (pioctl_req->action == MLAN_ACT_SET) {
@@ -5547,7 +5522,7 @@
 				pscan->param.scan_resp.pchan_stats =
 					(t_u8 *)pmadapter->pchan_stats;
 				pscan->param.scan_resp.num_in_chan_stats =
-					pmadapter->num_in_chan_stats;
+					pmadapter->idx_chan_stats;
 			}
 		}
 	}
@@ -5574,7 +5549,8 @@
 
 	if ((psec_pp->psk_type == MLAN_PSK_PASSPHRASE &&
 	     psec_pp->psk.passphrase.passphrase_len > 0) ||
-	    (psec_pp->psk_type == MLAN_PSK_PMK))
+	    (psec_pp->psk_type == MLAN_PSK_PMK) ||
+	    priv->sec_info.authentication_mode == MLAN_AUTH_MODE_OWE)
 		priv->sec_info.ewpa_enabled = MTRUE;
 	else
 		priv->sec_info.ewpa_enabled = MFALSE;
diff --git a/wlan_sd8987/mlan/mlan_sta_rx.c b/wlan_src/mlan/mlan_sta_rx.c
old mode 100755
new mode 100644
similarity index 77%
rename from wlan_sd8987/mlan/mlan_sta_rx.c
rename to wlan_src/mlan/mlan_sta_rx.c
index bb9920a..7ef2975
--- a/wlan_sd8987/mlan/mlan_sta_rx.c
+++ b/wlan_src/mlan/mlan_sta_rx.c
@@ -4,20 +4,29 @@
  *  module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2022, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -34,66 +43,11 @@
 #include "mlan_11n_aggr.h"
 #include "mlan_11n_rxreorder.h"
 #include "mlan_11ax.h"
-#ifdef DRV_EMBEDDED_SUPPLICANT
-#include "authenticator_api.h"
-#endif
 
 /********************************************************
 		Local Variables
 ********************************************************/
 
-/** IPv4 ARP request header */
-typedef MLAN_PACK_START struct {
-	/** Hardware type */
-	t_u16 Htype;
-	/** Protocol type */
-	t_u16 Ptype;
-	/** Hardware address length */
-	t_u8 addr_len;
-	/** Protocol address length */
-	t_u8 proto_len;
-	/** Operation code */
-	t_u16 op_code;
-	/** Source mac address */
-	t_u8 src_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Sender IP address */
-	t_u8 src_ip[4];
-	/** Destination mac address */
-	t_u8 dst_mac[MLAN_MAC_ADDR_LENGTH];
-	/** Destination IP address */
-	t_u8 dst_ip[4];
-} MLAN_PACK_END IPv4_ARP_t;
-
-/** IPv6 Nadv packet header */
-typedef MLAN_PACK_START struct {
-	/** IP protocol version */
-	t_u8 version;
-	/** flow label */
-	t_u8 flow_lab[3];
-	/** Payload length */
-	t_u16 payload_len;
-	/** Next header type */
-	t_u8 next_hdr;
-	/** Hot limit */
-	t_u8 hop_limit;
-	/** Source address */
-	t_u8 src_addr[16];
-	/** Destination address */
-	t_u8 dst_addr[16];
-	/** ICMP type */
-	t_u8 icmp_type;
-	/** IPv6 Code */
-	t_u8 ipv6_code;
-	/** IPv6 Checksum */
-	t_u16 ipv6_checksum;
-	/** Flags */
-	t_u32 flags;
-	/** Target address */
-	t_u8 taget_addr[16];
-	/** Reserved */
-	t_u8 rev[8];
-} MLAN_PACK_END IPv6_Nadv_t;
-
 /********************************************************
 		Global functions
 ********************************************************/
@@ -125,8 +79,8 @@
 		/* Graguitous ARP can be ARP request or ARP reply*/
 		if ((parp_hdr->op_code == mlan_htons(0x01)) ||
 		    (parp_hdr->op_code == mlan_htons(0x02)))
-			if (memcmp(pmadapter, parp_hdr->src_ip,
-				   parp_hdr->dst_ip, 4) == 0)
+			if (memcmp(pmadapter, parp_hdr->sender_ip,
+				   parp_hdr->target_ip, 4) == 0)
 				ret = MTRUE;
 	}
 
@@ -408,6 +362,8 @@
 	t_u8 gi = 0;
 	t_u8 ldpc = 0;
 	t_u8 ext_rate_info = 0;
+	t_u8 nss = 0;
+	t_u8 dcm = 0;
 
 	memset(priv->adapter, &rt_info_tmp, 0x00, sizeof(rt_info_tmp));
 	rt_info_tmp.snr = prx_pd->snr;
@@ -418,10 +374,25 @@
 
 	rt_info_tmp.antenna = prx_pd->antenna;
 	rx_rate_info = prx_pd->rate_info;
-	if ((rx_rate_info & 0x3) == MLAN_RATE_FORMAT_VHT) {
+	if ((rx_rate_info & 0x3) == MLAN_RATE_FORMAT_HE) {
+		t_u8 gi_he = 0;
+		/* HE rate */
+		format = MLAN_RATE_FORMAT_HE;
+		mcs_index = MIN(prx_pd->rx_rate & 0xF, 0xb);
+		nss = ((prx_pd->rx_rate & 0xF0) >> 4);
+		nss = MIN(nss + 1, 2);
+		/* 20M: bw=0, 40M: bw=1, 80M: bw=2, 160M: bw=3 */
+		bw = (rx_rate_info & 0xC) >> 2;
+		gi = (rx_rate_info & 0x10) >> 4;
+		gi_he = (rx_rate_info & 0x80) >> 7;
+		gi = gi | gi_he;
+		dcm = (prx_pd->rx_info & RXPD_DCM_MASK) >> 16;
+	} else if ((rx_rate_info & 0x3) == MLAN_RATE_FORMAT_VHT) {
 		/* VHT rate */
 		format = MLAN_RATE_FORMAT_VHT;
 		mcs_index = MIN(prx_pd->rx_rate & 0xF, 9);
+		nss = ((prx_pd->rx_rate & 0xF0) >> 4);
+		nss = MIN(nss + 1, 2);
 		/* 20M: bw=0, 40M: bw=1, 80M: bw=2, 160M: bw=3 */
 		bw = (rx_rate_info & 0xC) >> 2;
 		/* LGI: gi =0, SGI: gi = 1 */
@@ -444,8 +415,14 @@
 	ldpc = rx_rate_info & 0x40;
 
 	rt_info_tmp.rate_info.mcs_index = mcs_index;
-	rt_info_tmp.rate_info.rate_info =
-		(ldpc << 5) | (format << 3) | (bw << 1) | gi;
+	rt_info_tmp.rate_info.nss_index = nss;
+	rt_info_tmp.rate_info.dcm = dcm;
+	if (format == MLAN_RATE_FORMAT_HE) {
+		rt_info_tmp.rate_info.rate_info =
+			(ldpc << 5) | (format << 3) | (bw << 1) | (gi << 6);
+	} else
+		rt_info_tmp.rate_info.rate_info =
+			(ldpc << 5) | (format << 3) | (bw << 1) | gi;
 	rt_info_tmp.rate_info.bitrate =
 		wlan_index_to_data_rate(priv->adapter, prx_pd->rx_rate,
 					prx_pd->rate_info, ext_rate_info);
@@ -487,9 +464,6 @@
 	t_u8 appletalk_aarp_type[2] = {0x80, 0xf3};
 	t_u8 ipx_snap_type[2] = {0x81, 0x37};
 	t_u8 tdls_action_type[2] = {0x89, 0x0d};
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	t_u8 eapol_type[2] = {0x88, 0x8e};
-#endif
 	t_u8 ext_rate_info = 0;
 
 	ENTER();
@@ -609,23 +583,6 @@
 		}
 	}
 
-#ifdef DRV_EMBEDDED_SUPPLICANT
-	if (supplicantIsEnabled(priv->psapriv) &&
-	    (!memcmp(pmadapter, &prx_pkt->eth803_hdr.h803_len, eapol_type,
-		     sizeof(eapol_type)))) {
-		// BML_SET_OFFSET(bufDesc, offset);
-		if (ProcessEAPoLPkt(priv->psapriv, pmbuf)) {
-			pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
-			ret = MLAN_STATUS_SUCCESS;
-			PRINTM(MMSG,
-			       "host supplicant eapol pkt process done.\n");
-
-			LEAVE();
-			return ret;
-		}
-	}
-#endif
-
 mon_process:
 	if (pmbuf->flags & MLAN_BUF_FLAG_NET_MONITOR) {
 		// Use some rxpd space to save rxpd info for radiotap header
@@ -661,7 +618,8 @@
 #ifdef USB
 	else if (IS_USB(pmadapter->card_type))
 		pmadapter->callbacks.moal_recv_complete(pmadapter->pmoal_handle,
-							MNULL, MLAN_USB_EP_DATA,
+							MNULL,
+							pmadapter->rx_data_ep,
 							MLAN_STATUS_SUCCESS);
 #endif
 	LEAVE();
@@ -683,6 +641,15 @@
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	RxPD *prx_pd;
 	RxPacketHdr_t *prx_pkt;
+	RxPD *prx_pd2;
+	EthII_Hdr_t *peth_hdr2;
+	wlan_802_11_header *pwlan_hdr;
+	IEEEtypes_FrameCtl_t *frmctl;
+	pmlan_buffer pmbuf2 = MNULL;
+	mlan_802_11_mac_addr dest_addr = {0x00};
+	mlan_802_11_mac_addr src_addr = {0x00};
+	t_u16 hdr_len;
+	t_u8 snap_eth_hdr[5] = {0xaa, 0xaa, 0x03, 0x00, 0x00};
 	pmlan_private priv = pmadapter->priv[pmbuf->bss_index];
 	t_u8 ta[MLAN_MAC_ADDR_LENGTH];
 	t_u16 rx_pkt_type = 0;
@@ -710,6 +677,13 @@
 		       rxpd_rate_info_orig, prx_pd->rate_info);
 	}
 	rx_pkt_type = prx_pd->rx_pkt_type;
+	if (prx_pd->flags & RXPD_FLAG_PKT_EASYMESH) {
+		PRINTM_NETINTF(MDAT_D, priv);
+		PRINTM(MDAT_D, "Easymesh flags : 0x%x\n", prx_pd->flags);
+		ret = wlan_check_easymesh_pkt(priv, pmbuf, prx_pd);
+		if (ret != MLAN_STATUS_SUCCESS)
+			goto done;
+	}
 	prx_pkt = (RxPacketHdr_t *)((t_u8 *)prx_pd + prx_pd->rx_pkt_offset);
 
 	if ((prx_pd->rx_pkt_offset + prx_pd->rx_pkt_length) !=
@@ -761,14 +735,124 @@
 		}
 	}
 
+	if (pmadapter->enable_net_mon &&
+	    (prx_pd->flags & RXPD_FLAG_UCAST_PKT)) {
+		pwlan_hdr = (wlan_802_11_header *)((t_u8 *)prx_pd +
+						   prx_pd->rx_pkt_offset);
+		frmctl = (IEEEtypes_FrameCtl_t *)pwlan_hdr;
+		if (frmctl->type == 0x02) {
+			/* This is a valid unicast destined data packet, with
+			 * 802.11 and rtap headers attached. Duplicate this
+			 * packet and process this copy as a sniffed packet,
+			 * meant for monitor iface
+			 */
+			pmbuf2 = wlan_alloc_mlan_buffer(pmadapter,
+							pmbuf->data_len,
+							MLAN_RX_HEADER_LEN,
+							MOAL_ALLOC_MLAN_BUFFER);
+			if (!pmbuf2) {
+				PRINTM(MERROR,
+				       "Unable to allocate mlan_buffer for Rx");
+				PRINTM(MERROR, "sniffed packet\n");
+			} else {
+				pmbuf2->bss_index = pmbuf->bss_index;
+				pmbuf2->buf_type = pmbuf->buf_type;
+				pmbuf2->priority = pmbuf->priority;
+				pmbuf2->in_ts_sec = pmbuf->in_ts_sec;
+				pmbuf2->in_ts_usec = pmbuf->in_ts_usec;
+				pmbuf2->data_len = pmbuf->data_len;
+				memcpy(pmadapter,
+				       pmbuf2->pbuf + pmbuf2->data_offset,
+				       pmbuf->pbuf + pmbuf->data_offset,
+				       pmbuf->data_len);
+
+				prx_pd2 = (RxPD *)(pmbuf2->pbuf +
+						   pmbuf2->data_offset);
+				/* set pkt type of duplicated pkt to 802.11 */
+				prx_pd2->rx_pkt_type = PKT_TYPE_802DOT11;
+				wlan_process_rx_packet(pmadapter, pmbuf2);
+			}
+
+			/* Now, process this pkt as a normal data packet.
+			 * rx_pkt_offset points to the 802.11 hdr. Construct
+			 * 802.3 header from 802.11 hdr fields and attach it
+			 * just before the payload.
+			 */
+			memcpy(pmadapter, (t_u8 *)&dest_addr, pwlan_hdr->addr1,
+			       sizeof(pwlan_hdr->addr1));
+			memcpy(pmadapter, (t_u8 *)&src_addr, pwlan_hdr->addr2,
+			       sizeof(pwlan_hdr->addr2));
+
+			hdr_len = sizeof(wlan_802_11_header);
+
+			/* subtract mac addr field size for 3 address mac80211
+			 * header */
+			if (!(frmctl->from_ds && frmctl->to_ds))
+				hdr_len -= sizeof(mlan_802_11_mac_addr);
+
+			/* add 2 bytes of qos ctrl flags */
+			if (frmctl->sub_type & QOS_DATA)
+				hdr_len += 2;
+
+			if (prx_pd->rx_pkt_type == PKT_TYPE_AMSDU) {
+				/* no need to generate 802.3 hdr, update pkt
+				 * offset */
+				prx_pd->rx_pkt_offset += hdr_len;
+				prx_pd->rx_pkt_length -= hdr_len;
+			} else {
+				/* skip 6-byte snap and 2-byte type */
+				if (memcmp(pmadapter,
+					   (t_u8 *)pwlan_hdr + hdr_len,
+					   snap_eth_hdr,
+					   sizeof(snap_eth_hdr)) == 0)
+					hdr_len += 8;
+
+				peth_hdr2 =
+					(EthII_Hdr_t *)((t_u8 *)prx_pd +
+							prx_pd->rx_pkt_offset +
+							hdr_len -
+							sizeof(EthII_Hdr_t));
+				memcpy(pmadapter, peth_hdr2->dest_addr,
+				       (t_u8 *)&dest_addr,
+				       sizeof(peth_hdr2->dest_addr));
+				memcpy(pmadapter, peth_hdr2->src_addr,
+				       (t_u8 *)&src_addr,
+				       sizeof(peth_hdr2->src_addr));
+
+				/* Update the rx_pkt_offset to point the 802.3
+				 * hdr */
+				prx_pd->rx_pkt_offset +=
+					(hdr_len - sizeof(EthII_Hdr_t));
+				prx_pd->rx_pkt_length -=
+					(hdr_len - sizeof(EthII_Hdr_t));
+			}
+			/* update the prx_pkt pointer */
+			prx_pkt = (RxPacketHdr_t *)((t_u8 *)prx_pd +
+						    prx_pd->rx_pkt_offset);
+		} else {
+			pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
+			ret = MLAN_STATUS_FAILURE;
+			PRINTM(MERROR,
+			       "Drop invalid unicast sniffer pkt, subType=0x%x, flag=0x%x, pkt_type=%d\n",
+			       frmctl->sub_type, prx_pd->flags,
+			       prx_pd->rx_pkt_type);
+			wlan_free_mlan_buffer(pmadapter, pmbuf);
+			goto done;
+		}
+	}
+
 	/*
 	 * If the packet is not an unicast packet then send the packet
 	 * directly to os. Don't pass thru rx reordering
 	 */
 	if ((!IS_11N_ENABLED(priv) &&
 	     !(prx_pd->flags & RXPD_FLAG_PKT_DIRECT_LINK)) ||
-	    memcmp(priv->adapter, priv->curr_addr,
-		   prx_pkt->eth803_hdr.dest_addr, MLAN_MAC_ADDR_LENGTH)) {
+	    (memcmp(priv->adapter, priv->curr_addr,
+		    prx_pkt->eth803_hdr.dest_addr, MLAN_MAC_ADDR_LENGTH) &&
+	     !(prx_pd->flags & RXPD_FLAG_PKT_EASYMESH)) ||
+	    ((prx_pd->flags & RXPD_FLAG_PKT_EASYMESH) &&
+	     (is_bcast_addr(prx_pkt->eth803_hdr.dest_addr) ||
+	      is_mcast_addr(prx_pkt->eth803_hdr.dest_addr)))) {
 		priv->snr = prx_pd->snr;
 		priv->nf = prx_pd->nf;
 		wlan_process_rx_packet(pmadapter, pmbuf);
@@ -815,9 +899,14 @@
 	}
 	if ((priv->port_ctrl_mode == MTRUE && priv->port_open == MFALSE) &&
 	    (rx_pkt_type != PKT_TYPE_BAR)) {
-		mlan_11n_rxreorder_pkt(priv, prx_pd->seq_num, prx_pd->priority,
-				       ta, (t_u8)prx_pd->rx_pkt_type,
-				       (t_void *)RX_PKT_DROPPED_IN_FW);
+		if (MLAN_STATUS_SUCCESS !=
+		    mlan_11n_rxreorder_pkt(priv, prx_pd->seq_num,
+					   prx_pd->priority, ta,
+					   (t_u8)prx_pd->rx_pkt_type,
+					   (t_void *)RX_PKT_DROPPED_IN_FW))
+			PRINTM(MINFO, "RX pkt reordering failure seq_num:%d\n",
+			       prx_pd->seq_num);
+
 		if (rx_pkt_type == PKT_TYPE_AMSDU) {
 			pmbuf->data_len = prx_pd->rx_pkt_length;
 			pmbuf->data_offset += prx_pd->rx_pkt_offset;
diff --git a/wlan_sd8987/mlan/mlan_sta_tx.c b/wlan_src/mlan/mlan_sta_tx.c
old mode 100755
new mode 100644
similarity index 82%
rename from wlan_sd8987/mlan/mlan_sta_tx.c
rename to wlan_src/mlan/mlan_sta_tx.c
index c5fbd34..377c503
--- a/wlan_sd8987/mlan/mlan_sta_tx.c
+++ b/wlan_src/mlan/mlan_sta_tx.c
@@ -4,20 +4,29 @@
  *  transmission in MLAN module.
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -85,22 +94,24 @@
 	}
 
 	if (pmbuf->data_offset <
-	    (sizeof(TxPD) + pmpriv->intf_hr_len + DMA_ALIGNMENT)) {
+	    (Tx_PD_SIZEOF(pmadapter) + pmpriv->intf_hr_len + DMA_ALIGNMENT)) {
 		PRINTM(MERROR,
 		       "not enough space for TxPD: headroom=%d pkt_len=%d, required=%d\n",
 		       pmbuf->data_offset, pmbuf->data_len,
-		       sizeof(TxPD) + pmpriv->intf_hr_len + DMA_ALIGNMENT);
+		       Tx_PD_SIZEOF(pmadapter) + pmpriv->intf_hr_len +
+			       DMA_ALIGNMENT);
 		pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
 		goto done;
 	}
 
 	/* head_ptr should be aligned */
-	head_ptr = pmbuf->pbuf + pmbuf->data_offset - sizeof(TxPD) -
+	head_ptr = pmbuf->pbuf + pmbuf->data_offset - Tx_PD_SIZEOF(pmadapter) -
 		   pmpriv->intf_hr_len;
 	head_ptr = (t_u8 *)((t_ptr)head_ptr & ~((t_ptr)(DMA_ALIGNMENT - 1)));
 
 	plocal_tx_pd = (TxPD *)(head_ptr + pmpriv->intf_hr_len);
-	memset(pmadapter, plocal_tx_pd, 0, sizeof(TxPD));
+	// coverity[bad_memset:SUPPRESS]
+	memset(pmadapter, plocal_tx_pd, 0, Tx_PD_SIZEOF(pmadapter));
 	/* Set the BSS number to TxPD */
 	plocal_tx_pd->bss_num = GET_BSS_NUM(pmpriv);
 	plocal_tx_pd->bss_type = pmpriv->bss_type;
@@ -127,6 +138,11 @@
 	}
 	if (pmbuf->flags & MLAN_BUF_FLAG_TDLS)
 		plocal_tx_pd->flags |= MRVDRV_TxPD_FLAGS_TDLS_PACKET;
+	if (pmbuf->flags & MLAN_BUF_FLAG_EASYMESH) {
+		plocal_tx_pd->flags |= MRVDRV_TxPD_FLAGS_EASYMESH;
+		memcpy_ext(pmpriv->adapter, plocal_tx_pd->ra_mac, pmbuf->mac,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	}
 	/* Offset of actual data */
 	plocal_tx_pd->tx_pkt_offset =
 		(t_u16)((t_ptr)pmbuf->pbuf + pmbuf->data_offset -
@@ -225,7 +241,7 @@
 {
 	pmlan_adapter pmadapter = MNULL;
 	TxPD *ptx_pd;
-/* sizeof(TxPD) + Interface specific header */
+/* Tx_PD_SIZEOF(pmadapter) + Interface specific header */
 #define NULL_PACKET_HDR 256
 	t_u32 data_len = NULL_PACKET_HDR;
 	pmlan_buffer pmbuf = MNULL;
@@ -275,12 +291,12 @@
 	pmbuf->buf_type = MLAN_BUF_TYPE_DATA;
 	pmbuf->flags |= MLAN_BUF_FLAG_NULL_PKT;
 	ptr = pmbuf->pbuf + pmbuf->data_offset;
-	pmbuf->data_len = sizeof(TxPD) + priv->intf_hr_len;
+	pmbuf->data_len = Tx_PD_SIZEOF(pmadapter) + priv->intf_hr_len;
 	ptx_pd = (TxPD *)(ptr + priv->intf_hr_len);
 	ptx_pd->tx_control = priv->pkt_tx_ctrl;
 	ptx_pd->flags = flags;
 	ptx_pd->priority = WMM_HIGHEST_PRIORITY;
-	ptx_pd->tx_pkt_offset = sizeof(TxPD);
+	ptx_pd->tx_pkt_offset = Tx_PD_SIZEOF(pmadapter);
 	/* Set the BSS number to TxPD */
 	ptx_pd->bss_num = GET_BSS_NUM(priv);
 	ptx_pd->bss_type = priv->bss_type;
@@ -320,7 +336,8 @@
 	PRINTM_GET_SYS_TIME(MDATA, &sec, &usec);
 	PRINTM_NETINTF(MDATA, priv);
 	PRINTM(MDATA, "%lu.%06lu : Null data => FW\n", sec, usec);
-	DBG_HEXDUMP(MDAT_D, "Null data", ptr, sizeof(TxPD) + priv->intf_hr_len);
+	DBG_HEXDUMP(MDAT_D, "Null data", ptr,
+		    Tx_PD_SIZEOF(pmadapter) + priv->intf_hr_len);
 done:
 	LEAVE();
 	return ret;
diff --git a/wlan_src/mlan/mlan_tlv_ids.h b/wlan_src/mlan/mlan_tlv_ids.h
new file mode 100644
index 0000000..ac3f929
--- /dev/null
+++ b/wlan_src/mlan/mlan_tlv_ids.h
@@ -0,0 +1,515 @@
+/** @file mlan_tlv_ids.h
+ *
+ *  @brief This file contains TLV ID definitions.
+ *
+ *
+ *  Copyright 2023-2024 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+#ifndef _MLAN_TLV_IDS_H_
+#define _MLAN_TLV_IDS_H_
+
+/* include guard is absent intentionally */
+
+/** Terminating TLV type */
+#define NXP_TERMINATE_TLV_ID 0xffff
+
+/** TLV ID Constants */
+
+/** IEEE TLV IDs*/
+/** TLV type : SSID */
+#define TLV_TYPE_SSID 0x0000
+/** TLV type : Rates */
+#define TLV_TYPE_RATES 0x0001
+/** TLV type : PHY FH */
+#define TLV_TYPE_PHY_FH 0x0002
+/** TLV type : PHY DS */
+#define TLV_TYPE_PHY_DS 0x0003
+/** TLV type : CF */
+#define TLV_TYPE_CF 0x0004
+/** TLV type : Domain */
+#define TLV_TYPE_DOMAIN 0x0007
+/** TLV type : Power constraint */
+#define TLV_TYPE_POWER_CONSTRAINT 0x0020
+/** TLV type : Power capability */
+#define TLV_TYPE_POWER_CAPABILITY 0x0021
+#define TLV_TYPE_HT_CAPABILITY 0x002d
+/** TLV type : Vendor Specific IE */
+#define TLV_TYPE_VENDOR_SPECIFIC_IE 0x00dd
+#define TLV_TYPE_EXTENSION_ID 0x00ff
+
+/** Proprietary TLV IDs */
+/** TLV type : Key material */
+#define TLV_TYPE_KEY_MATERIAL (PROPRIETARY_TLV_BASE_ID + 0) /* 0x0100 */
+/** TLV type : Channel list */
+#define TLV_TYPE_CHANLIST (PROPRIETARY_TLV_BASE_ID + 1) /* 0x0101 */
+/** TLV type : Number of probes */
+#define TLV_TYPE_NUMPROBES (PROPRIETARY_TLV_BASE_ID + 2) /* 0x0102 */
+/** TLV type : Beacon RSSI low */
+#define TLV_TYPE_RSSI_LOW (PROPRIETARY_TLV_BASE_ID + 4) /* 0x0104 */
+/** TLV type : Beacon SNR low */
+#define TLV_TYPE_SNR_LOW (PROPRIETARY_TLV_BASE_ID + 5) /* 0x0105 */
+/** TLV type : Fail count */
+#define TLV_TYPE_FAILCOUNT (PROPRIETARY_TLV_BASE_ID + 6) /* 0x0106 */
+/** TLV type : BCN miss */
+#define TLV_TYPE_BCNMISS (PROPRIETARY_TLV_BASE_ID + 7) /* 0x0107 */
+/** TLV type : LED behavior */
+#define TLV_TYPE_LEDBEHAVIOR (PROPRIETARY_TLV_BASE_ID + 9) /* 0x0109 */
+/** TLV type : Passthrough */
+#define TLV_TYPE_PASSTHROUGH (PROPRIETARY_TLV_BASE_ID + 10) /* 0x010a */
+/** TLV type : Power TBL 2.4 Ghz */
+#define TLV_TYPE_POWER_TBL_2_4GHZ (PROPRIETARY_TLV_BASE_ID + 12) /* 0x010c */
+/** TLV type : Power TBL 5 GHz */
+#define TLV_TYPE_POWER_TBL_5GHZ (PROPRIETARY_TLV_BASE_ID + 13) /* 0x010d */
+/** TLV type : WMM queue status */
+#define TLV_TYPE_WMMQSTATUS (PROPRIETARY_TLV_BASE_ID + 16) /* 0x0110 */
+/** TLV type : Wildcard SSID */
+#define TLV_TYPE_WILDCARDSSID (PROPRIETARY_TLV_BASE_ID + 18) /* 0x0112 */
+/** TLV type : TSF timestamp */
+#define TLV_TYPE_TSFTIMESTAMP (PROPRIETARY_TLV_BASE_ID + 19) /* 0x0113 */
+/** TLV type : ARP filter */
+#define TLV_TYPE_ARP_FILTER (PROPRIETARY_TLV_BASE_ID + 21) /* 0x0115 */
+/** TLV type : Beacon RSSI high */
+#define TLV_TYPE_RSSI_HIGH (PROPRIETARY_TLV_BASE_ID + 22) /* 0x0116 */
+/** TLV type : Beacon SNR high */
+#define TLV_TYPE_SNR_HIGH (PROPRIETARY_TLV_BASE_ID + 23) /* 0x0117 */
+/** TLV type : Start BG scan later */
+#define TLV_TYPE_STARTBGSCANLATER (PROPRIETARY_TLV_BASE_ID + 30) /* 0x011e */
+/** TLV type : Authentication type */
+#define TLV_TYPE_AUTH_TYPE (PROPRIETARY_TLV_BASE_ID + 31) /* 0x011f */
+/** TLV type : STA Mac address */
+#define TLV_TYPE_STA_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 32) /* 0x0120 */
+/** TLV type : BSSID */
+#define TLV_TYPE_BSSID (PROPRIETARY_TLV_BASE_ID + 35) /* 0x0123 */
+/** TLV type : Link Quality */
+#define TLV_TYPE_LINK_QUALITY (PROPRIETARY_TLV_BASE_ID + 36) /* 0x0124 */
+/** TLV type : Data RSSI low */
+#define TLV_TYPE_RSSI_LOW_DATA (PROPRIETARY_TLV_BASE_ID + 38) /* 0x0126 */
+/** TLV type : Data SNR low */
+#define TLV_TYPE_SNR_LOW_DATA (PROPRIETARY_TLV_BASE_ID + 39) /* 0x0127 */
+/** TLV type : Data RSSI high */
+#define TLV_TYPE_RSSI_HIGH_DATA (PROPRIETARY_TLV_BASE_ID + 40) /* 0x0128 */
+/** TLV type : Data SNR high */
+#define TLV_TYPE_SNR_HIGH_DATA (PROPRIETARY_TLV_BASE_ID + 41) /* 0x0129 */
+/** TLV type : Channel band list */
+#define TLV_TYPE_CHANNELBANDLIST (PROPRIETARY_TLV_BASE_ID + 42) /* 0x012a */
+#ifdef UAP_SUPPORT
+/** TLV type : AP Channel band Config */
+#define TLV_TYPE_UAP_CHAN_BAND_CONFIG                                          \
+	(PROPRIETARY_TLV_BASE_ID + 42) /* 0x012a */
+/** TLV type : AP Mac address */
+#define TLV_TYPE_UAP_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 43) /* 0x012b */
+/** TLV type : AP Beacon period */
+#define TLV_TYPE_UAP_BEACON_PERIOD (PROPRIETARY_TLV_BASE_ID + 44) /* 0x012c */
+/** TLV type : AP DTIM period */
+#define TLV_TYPE_UAP_DTIM_PERIOD (PROPRIETARY_TLV_BASE_ID + 45) /* 0x012d */
+/** TLV type : AP Tx power */
+#define TLV_TYPE_UAP_TX_POWER (PROPRIETARY_TLV_BASE_ID + 47) /* 0x012f */
+/** TLV type : AP SSID broadcast control */
+#define TLV_TYPE_UAP_BCAST_SSID_CTL (PROPRIETARY_TLV_BASE_ID + 48) /* 0x0130   \
+								    */
+/** TLV type : AP Preamble control */
+#define TLV_TYPE_UAP_PREAMBLE_CTL (PROPRIETARY_TLV_BASE_ID + 49) /* 0x0131 */
+/** TLV type : AP Antenna control */
+#define TLV_TYPE_UAP_ANTENNA_CTL (PROPRIETARY_TLV_BASE_ID + 50) /* 0x0132 */
+/** TLV type : AP RTS threshold */
+#define TLV_TYPE_UAP_RTS_THRESHOLD (PROPRIETARY_TLV_BASE_ID + 51) /* 0x0133 */
+/** TLV type : AP Tx data rate */
+#define TLV_TYPE_UAP_TX_DATA_RATE (PROPRIETARY_TLV_BASE_ID + 53) /* 0x0135 */
+/** TLV type: AP Packet forwarding control */
+#define TLV_TYPE_UAP_PKT_FWD_CTL (PROPRIETARY_TLV_BASE_ID + 54) /* 0x0136 */
+/** TLV type: STA information */
+#define TLV_TYPE_UAP_STA_INFO (PROPRIETARY_TLV_BASE_ID + 55) /* 0x0137 */
+/** TLV type: AP STA MAC address filter */
+#define TLV_TYPE_UAP_STA_MAC_ADDR_FILTER                                       \
+	(PROPRIETARY_TLV_BASE_ID + 56) /* 0x0138 */
+/** TLV type: AP STA ageout timer */
+#define TLV_TYPE_UAP_STA_AGEOUT_TIMER                                          \
+	(PROPRIETARY_TLV_BASE_ID + 57) /* 0x0139 */
+#endif /* UAP_SUPPORT */
+/** TLV type : Security Cfg */
+#define TLV_TYPE_SECURITY_CFG (PROPRIETARY_TLV_BASE_ID + 58) /* 0x013a */
+#ifdef UAP_SUPPORT
+/** TLV type: AP WEP keys */
+#define TLV_TYPE_UAP_WEP_KEY (PROPRIETARY_TLV_BASE_ID + 59) /* 0x013b */
+#endif /* UAP_SUPPORT */
+/** TLV type : Passphrase */
+#define TLV_TYPE_PASSPHRASE (PROPRIETARY_TLV_BASE_ID + 60) /* 0x013c */
+#ifdef UAP_SUPPORT
+/** TLV type: AP WPA passphrase */
+#define TLV_TYPE_UAP_WPA_PASSPHRASE (PROPRIETARY_TLV_BASE_ID + 60) /* 0x013c   \
+								    */
+#endif /* UAP_SUPPORT */
+/** TLV type : Encryption Protocol TLV */
+#define TLV_TYPE_ENCRYPTION_PROTO (PROPRIETARY_TLV_BASE_ID + 64) /* 0x0140 */
+#ifdef UAP_SUPPORT
+/** TLV type: AP protocol */
+#define TLV_TYPE_UAP_ENCRYPT_PROTOCOL                                          \
+	(PROPRIETARY_TLV_BASE_ID + 64) /* 0x0140 */
+/** TLV type: AP AKMP */
+#define TLV_TYPE_UAP_AKMP (PROPRIETARY_TLV_BASE_ID + 65) /* 0x0141 */
+#endif /* UAP_SUPPORT */
+/** TLV type : Cipher TLV */
+#define TLV_TYPE_CIPHER (PROPRIETARY_TLV_BASE_ID + 66) /* 0x0142 */
+/** TLV type : PMK */
+#define TLV_TYPE_PMK (PROPRIETARY_TLV_BASE_ID + 68) /* 0x0144 */
+#ifdef UAP_SUPPORT
+/** TLV type: AP Fragment threshold */
+#define TLV_TYPE_UAP_FRAG_THRESHOLD (PROPRIETARY_TLV_BASE_ID + 70) /* 0x0146   \
+								    */
+/** TLV type: AP Group rekey timer */
+#define TLV_TYPE_UAP_GRP_REKEY_TIME (PROPRIETARY_TLV_BASE_ID + 71) /* 0x0147   \
+								    */
+#endif /* UAP_SUPPORT */
+/** TLV type : BCN miss */
+#define TLV_TYPE_PRE_BCNMISS (PROPRIETARY_TLV_BASE_ID + 73) /* 0x0149 */
+/** TLV type : HT Capabilities */
+#define TLV_TYPE_HT_CAP (PROPRIETARY_TLV_BASE_ID + 74) /* 0x014a */
+/** TLV type : HT Information */
+#define TLV_TYPE_HT_INFO (PROPRIETARY_TLV_BASE_ID + 75) /* 0x014b */
+/** TLV type : Secondary Channel Offset */
+#define TLV_SECONDARY_CHANNEL_OFFSET (PROPRIETARY_TLV_BASE_ID + 76) /* 0x014c  \
+								     */
+/** TLV type : 20/40 BSS Coexistence */
+#define TLV_TYPE_2040BSS_COEXISTENCE (PROPRIETARY_TLV_BASE_ID + 77) /* 0x014d  \
+								     */
+/** TLV type : Overlapping BSS Scan Parameters */
+#define TLV_TYPE_OVERLAP_BSS_SCAN_PARAM                                        \
+	(PROPRIETARY_TLV_BASE_ID + 78) /* 0x014e */
+/** TLV type : Extended capabilities */
+#define TLV_TYPE_EXTCAP (PROPRIETARY_TLV_BASE_ID + 79) /* 0x014f */
+/** TLV type : Set of MCS values that STA desires to use within the BSS */
+#define TLV_TYPE_HT_OPERATIONAL_MCS_SET                                        \
+	(PROPRIETARY_TLV_BASE_ID + 80) /* 0x0150 */
+/** TLV type : Rate scope */
+#define TLV_TYPE_RATE_DROP_PATTERN (PROPRIETARY_TLV_BASE_ID + 81) /* 0x0151 */
+/** TLV type : Rate drop pattern */
+#define TLV_TYPE_RATE_DROP_CONTROL (PROPRIETARY_TLV_BASE_ID + 82) /* 0x0152 */
+/** TLV type : Rate scope */
+#define TLV_TYPE_RATE_SCOPE (PROPRIETARY_TLV_BASE_ID + 83) /* 0x0153 */
+/** TLV type : Power group */
+#define TLV_TYPE_POWER_GROUP (PROPRIETARY_TLV_BASE_ID + 84) /* 0x0154 */
+#ifdef UAP_SUPPORT
+/**TLV type : AP Max Station number */
+#define TLV_TYPE_UAP_MAX_STA_CNT (PROPRIETARY_TLV_BASE_ID + 85) /* 0x0155 */
+#endif /* UAP_SUPPORT */
+/** TLV type : Scan Response */
+#define TLV_TYPE_BSS_SCAN_RSP (PROPRIETARY_TLV_BASE_ID + 86) /* 0x0156 */
+/** TLV type : Scan Response Stats */
+#define TLV_TYPE_BSS_SCAN_INFO (PROPRIETARY_TLV_BASE_ID + 87) /* 0x0157 */
+/** TLV type : 11h Basic Rpt */
+#define TLV_TYPE_CHANRPT_11H_BASIC (PROPRIETARY_TLV_BASE_ID + 91) /* 0x015b */
+#ifdef UAP_SUPPORT
+/**TLV type : AP Retry limit */
+#define TLV_TYPE_UAP_RETRY_LIMIT (PROPRIETARY_TLV_BASE_ID + 93) /* 0x015d */
+#endif /* UAP_SUPPORT */
+/** TLV type: WAPI IE */
+#define TLV_TYPE_WAPI_IE (PROPRIETARY_TLV_BASE_ID + 94) /* 0x015e */
+#ifdef UAP_SUPPORT
+/** TLV type : AP MCBC data rate */
+#define TLV_TYPE_UAP_MCBC_DATA_RATE (PROPRIETARY_TLV_BASE_ID + 98) /* 0x0162   \
+								    */
+#endif /* UAP_SUPPORT */
+#ifdef UAP_SUPPORT
+/**TLV type: AP RSN replay protection */
+#define TLV_TYPE_UAP_RSN_REPLAY_PROTECT                                        \
+	(PROPRIETARY_TLV_BASE_ID + 100) /* 0x0164 */
+/** TLV ID : WAPI Information */
+#define TLV_TYPE_AP_WAPI_INFO (PROPRIETARY_TLV_BASE_ID + 103) /* 0x0167 */
+#endif /* UAP_SUPPORT */
+/** TLV ID : Management Frame */
+#define TLV_TYPE_MGMT_FRAME (PROPRIETARY_TLV_BASE_ID + 104) /* 0x0168 */
+/** TLV type: MGMT IE */
+#define TLV_TYPE_MGMT_IE (PROPRIETARY_TLV_BASE_ID + 105) /* 0x0169 */
+#ifdef UAP_SUPPORT
+/** TLV type: AP Sleep param */
+#define TLV_TYPE_AP_SLEEP_PARAM (PROPRIETARY_TLV_BASE_ID + 106) /* 0x016a */
+/** TLV type: AP Inactivity Sleep param */
+#define TLV_TYPE_AP_INACT_SLEEP_PARAM                                          \
+	(PROPRIETARY_TLV_BASE_ID + 107) /* 0x016b */
+/**TLV type: AP mgmt IE passthru mask */
+#define TLV_TYPE_UAP_MGMT_IE_PASSTHRU_MASK                                     \
+	(PROPRIETARY_TLV_BASE_ID + 112) /* 0x0170 */
+#endif /* UAP_SUPPORT */
+/** TLV type : auto ds param */
+#define TLV_TYPE_AUTO_DS_PARAM (PROPRIETARY_TLV_BASE_ID + 113) /* 0x0171 */
+/** TLV type : ps param */
+#define TLV_TYPE_PS_PARAM (PROPRIETARY_TLV_BASE_ID + 114) /* 0x0172 */
+#ifdef UAP_SUPPORT
+/**TLV type: AP pairwise handshake timeout */
+#define TLV_TYPE_UAP_EAPOL_PWK_HSK_TIMEOUT                                     \
+	(PROPRIETARY_TLV_BASE_ID + 117) /* 0x0175 */
+/**TLV type: AP pairwise handshake retries */
+#define TLV_TYPE_UAP_EAPOL_PWK_HSK_RETRIES                                     \
+	(PROPRIETARY_TLV_BASE_ID + 118) /* 0x0176 */
+/**TLV type: AP groupwise handshake timeout */
+#define TLV_TYPE_UAP_EAPOL_GWK_HSK_TIMEOUT                                     \
+	(PROPRIETARY_TLV_BASE_ID + 119) /* 0x0177 */
+/**TLV type: AP groupwise handshake retries */
+#define TLV_TYPE_UAP_EAPOL_GWK_HSK_RETRIES                                     \
+	(PROPRIETARY_TLV_BASE_ID + 120) /* 0x0178 */
+#endif /* UAP_SUPPORT */
+#ifdef OPCHAN
+/** TLV type : OpChannel control */
+#define TLV_TYPE_OPCHAN_CONTROL_DESC                                           \
+	(PROPRIETARY_TLV_BASE_ID + 121) /* 0x0179 */
+/** TLV type : OpChannel channel group control */
+#define TLV_TYPE_OPCHAN_CHANGRP_CTRL                                           \
+	(PROPRIETARY_TLV_BASE_ID + 122) /* 0x017a */
+#endif /* OPCHAN */
+#ifdef UAP_SUPPORT
+/** TLV type: AP PS STA ageout timer */
+#define TLV_TYPE_UAP_PS_STA_AGEOUT_TIMER                                       \
+	(PROPRIETARY_TLV_BASE_ID + 123) /* 0x017b */
+#endif /* UAP_SUPPORT */
+#ifdef WIFI_DIRECT_SUPPORT
+/** TLV type : p2p NOA */
+#define TLV_TYPE_WIFI_DIRECT_NOA (PROPRIETARY_TLV_BASE_ID + 131) /* 0x0183 */
+/** TLV type : p2p opp ps */
+#define TLV_TYPE_WIFI_DIRECT_OPP_PS (PROPRIETARY_TLV_BASE_ID + 132) /* 0x0184  \
+								     */
+#endif /* WIFI_DIRECT_SUPPORT */
+/** TLV type : Action frame */
+#define TLV_TYPE_IEEE_ACTION_FRAME (PROPRIETARY_TLV_BASE_ID + 140) /* 0x018c   \
+								    */
+#ifdef UAP_SUPPORT
+/** TLV type : Pairwise Cipher */
+#define TLV_TYPE_PWK_CIPHER (PROPRIETARY_TLV_BASE_ID + 145) /* 0x0191 */
+/** TLV type : Group Cipher */
+#define TLV_TYPE_GWK_CIPHER (PROPRIETARY_TLV_BASE_ID + 146) /* 0x0192 */
+/** TLV type : BSS Status */
+#define TLV_TYPE_BSS_STATUS (PROPRIETARY_TLV_BASE_ID + 147) /* 0x0193 */
+#endif /* UAP_SUPPORT */
+/** TLV type : TX pause TLV */
+#define TLV_TYPE_TX_PAUSE (PROPRIETARY_TLV_BASE_ID + 148) /* 0x0194 */
+/** TLV : 20/40 coex config */
+#define TLV_TYPE_2040_BSS_COEX_CONTROL                                         \
+	(PROPRIETARY_TLV_BASE_ID + 152) /* 0x0198 */
+/** TLV type : RXBA_SYNC */
+#define TLV_TYPE_RXBA_SYNC (PROPRIETARY_TLV_BASE_ID + 153) /* 0x0199 */
+#define TLV_TYPE_COALESCE_RULE (PROPRIETARY_TLV_BASE_ID + 154) /* 0x019a */
+/** TLV type: key param v2 */
+#define TLV_TYPE_KEY_PARAM_V2 (PROPRIETARY_TLV_BASE_ID + 156) /* 0x019c */
+#ifdef WIFI_DIRECT_SUPPORT
+/** TLV type : AP PSK */
+#define TLV_TYPE_UAP_PSK (PROPRIETARY_TLV_BASE_ID + 168) /* 0x01a8 */
+#endif /* WIFI_DIRECT_SUPPORT */
+/** TLV type: MAX_MGMT_IE */
+#define TLV_TYPE_MAX_MGMT_IE (PROPRIETARY_TLV_BASE_ID + 170) /* 0x01aa */
+/** TLV : Region Domain Code */
+#define TLV_TYPE_REGION_DOMAIN_CODE (PROPRIETARY_TLV_BASE_ID + 171) /* 0x01ab  \
+								     */
+/** TLV type: BG scan repeat count */
+#define TLV_TYPE_REPEAT_COUNT (PROPRIETARY_TLV_BASE_ID + 176) /* 0x01b0 */
+#ifdef USB
+/** TLV ID : USB Aggregation parameters */
+#define NXP_USB_AGGR_PARAM_TLV_ID (PROPRIETARY_TLV_BASE_ID + 177) /* 0x01b1 */
+#endif /* USB */
+/** TLV type: ps params in hs */
+#define TLV_TYPE_PS_PARAMS_IN_HS (PROPRIETARY_TLV_BASE_ID + 181) /* 0x01b5 */
+/** TLV type: hs wake hold off */
+#define TLV_TYPE_HS_WAKE_HOLDOFF (PROPRIETARY_TLV_BASE_ID + 182) /* 0x01b6 */
+/** TLV ID for multi chan info */
+#define TLV_TYPE_MULTI_CHAN_INFO (PROPRIETARY_TLV_BASE_ID + 183) /* 0x01b7 */
+/** TLV ID for multi chan group info */
+#define TLV_TYPE_MULTI_CHAN_GROUP_INFO_TLV_ID                                  \
+	(PROPRIETARY_TLV_BASE_ID + 184) /* 0x01b8 */
+/** TLV type : TDLS IDLE TIMEOUT */
+#define TLV_TYPE_TDLS_IDLE_TIMEOUT (PROPRIETARY_TLV_BASE_ID + 194) /* 0x01c2   \
+								    */
+/** TLV type : SCAN channel gap */
+#define TLV_TYPE_SCAN_CHANNEL_GAP (PROPRIETARY_TLV_BASE_ID + 197) /* 0x01c5 */
+/** TLV type : Channel statistics */
+#define TLV_TYPE_CHANNEL_STATS (PROPRIETARY_TLV_BASE_ID + 198) /* 0x01c6 */
+/** FW VERSION tlv */
+#define TLV_TYPE_FW_VER_INFO (PROPRIETARY_TLV_BASE_ID + 199) /* 0x01c7 */
+/** TLV type :  aggr win size */
+#define TLV_BTCOEX_WL_AGGR_WINSIZE (PROPRIETARY_TLV_BASE_ID + 202) /* 0x01ca   \
+								    */
+/** TLV type :  scan time */
+#define TLV_BTCOEX_WL_SCANTIME (PROPRIETARY_TLV_BASE_ID + 203) /* 0x01cb */
+/** TLV type : BSS_MODE */
+#define TLV_TYPE_BSS_MODE (PROPRIETARY_TLV_BASE_ID + 206) /* 0x01ce */
+/** TLV type : Ewpa_eapol_pkt */
+#define TLV_TYPE_EAPOL_PKT (PROPRIETARY_TLV_BASE_ID + 207) /* 0x01cf */
+#ifdef UAP_SUPPORT
+/** TLV type :  AP WMM params */
+#define TLV_TYPE_AP_WMM_PARAM (PROPRIETARY_TLV_BASE_ID + 208) /* 0x01d0 */
+#endif /* UAP_SUPPORT */
+/** TLV type : ESS scan*/
+#define TLV_TYPE_ENERGYEFFICIENTSCAN                                           \
+	(PROPRIETARY_TLV_BASE_ID + 218) /* 0x01da */
+/** TLV type : EES Configuration */
+#define TLV_TYPE_EES_CFG (PROPRIETARY_TLV_BASE_ID + 218) /* 0x01da */
+/** TLV type : EES Network Configuration */
+#define TLV_TYPE_EES_NET_CFG (PROPRIETARY_TLV_BASE_ID + 219) /* 0x01db */
+/** TLV rssi info */
+#define TLV_TYPE_RSSI_INFO (PROPRIETARY_TLV_BASE_ID + 229) /* 0x01e5 */
+#define TLV_TYPE_IPV6_RA_OFFLOAD (PROPRIETARY_TLV_BASE_ID + 230) /* 0x01e6 */
+/** TLV to indicate firmware only keep probe response while scan */
+#define TLV_TYPE_ONLYPROBERESP (PROPRIETARY_TLV_BASE_ID + 233) /* 0x01e9 */
+#define TLV_TYPE_RANDOM_MAC (PROPRIETARY_TLV_BASE_ID + 236) /* 0x01ec */
+#define TLV_TYPE_CHAN_ATTR_CFG (PROPRIETARY_TLV_BASE_ID + 237) /* 0x01ed */
+#define TLV_TYPE_REGION_INFO (PROPRIETARY_TLV_BASE_ID + 238) /* 0x01ee */
+/** TLV type : ENABLE ROAM IE */
+#define TLV_TYPE_ROAM (PROPRIETARY_TLV_BASE_ID + 245) /* 0x01f5 */
+/** TLV type : AP LIST IE */
+#define TLV_TYPE_APLIST (PROPRIETARY_TLV_BASE_ID + 246) /* 0x01f6 */
+/** TLV type : PMK */
+#define TLV_TYPE_PMK_R0 (PROPRIETARY_TLV_BASE_ID + 247) /* 0x01f7 */
+/** TLV type : PMK */
+#define TLV_TYPE_PMK_R0_NAME (PROPRIETARY_TLV_BASE_ID + 248) /* 0x01f8 */
+/** TLV for cloud keep alive control info */
+#define TLV_TYPE_CLOUD_KEEP_ALIVE (PROPRIETARY_TLV_BASE_ID + 258) /* 0x0202 */
+/** TLV for cloud keep alive control info */
+#define TLV_TYPE_KEEP_ALIVE_CTRL (PROPRIETARY_TLV_BASE_ID + 259) /* 0x0203 */
+/** TLV for cloud keep alive packet */
+#define TLV_TYPE_KEEP_ALIVE_PKT (PROPRIETARY_TLV_BASE_ID + 260) /* 0x0204 */
+/** TLV type: wake up source */
+#define TLV_TYPE_HS_WAKEUP_SOURCE_GPIO                                         \
+	(PROPRIETARY_TLV_BASE_ID + 261) /* 0x0205 */
+#define TLV_TYPE_POWER_TABLE (PROPRIETARY_TLV_BASE_ID + 262) /* 0x0206 */
+/** TLV ID for DRCS TimeSlice */
+#define NXP_DRCS_TIME_SLICE_TLV_ID (PROPRIETARY_TLV_BASE_ID + 263) /* 0x0207   \
+								    */
+/** TLV type : TRIGGER CONDITION*/
+#define TLV_TYPE_ROM_TRIGGER (PROPRIETARY_TLV_BASE_ID + 264) /* 0x0208 */
+/** TLV type : RETRY_COUNT*/
+#define TLV_TYPE_ROM_RETRY_COUNT (PROPRIETARY_TLV_BASE_ID + 265) /* 0x0209 */
+/** TLV type : BGSCAN SETTING*/
+#define TLV_TYPE_ROM_BGSCAN (PROPRIETARY_TLV_BASE_ID + 266) /* 0x020a */
+/** TLV type : PARA RSSI*/
+#define TLV_TYPE_ROM_PARA_RSSI (PROPRIETARY_TLV_BASE_ID + 267) /* 0x020b */
+/** TLV type: management filter  */
+#define TLV_TYPE_MGMT_FRAME_WAKEUP (PROPRIETARY_TLV_BASE_ID + 278) /* 0x0216   \
+								    */
+/** TLV type : FW support max connection TLV */
+#define TLV_TYPE_MAX_CONN (PROPRIETARY_TLV_BASE_ID + 279) /* 0x0217 */
+/** TLV type: extend wakeup source */
+#define TLV_TYPE_WAKEUP_EXTEND (PROPRIETARY_TLV_BASE_ID + 280) /* 0x0218 */
+/** TLV type: HS antenna mode */
+#define TLV_TYPE_HS_ANTMODE (PROPRIETARY_TLV_BASE_ID + 281) /* 0x0219 */
+/** TLV type: robustcoex mode */
+#define TLV_TYPE_ROBUSTCOEX (PROPRIETARY_TLV_BASE_ID + 283) /* 0x021b */
+/** TLV type : BSSID blacklist*/
+#define TLV_TYPE_BLACKLIST_BSSID (PROPRIETARY_TLV_BASE_ID + 285) /* 0x021d */
+/** TLV type : BAND & RSSI*/
+#define TLV_TYPE_BAND_RSSI (PROPRIETARY_TLV_BASE_ID + 286) /* 0x021e */
+/** TLV type : beacon timeout */
+#define TLV_TYPE_BCN_TIMEOUT (PROPRIETARY_TLV_BASE_ID + 287) /* 0x021f */
+#ifdef UAP_SUPPORT
+/** TLV type : AP Tx beacon rate */
+#define TLV_TYPE_UAP_TX_BEACON_RATE (PROPRIETARY_TLV_BASE_ID + 288) /* 0x0220  \
+								     */
+#endif /* UAP_SUPPORT */
+/** TLV type : KEY params*/
+#define TLV_TYPE_ROAM_OFFLOAD_USER_SET_PMK                                     \
+	(PROPRIETARY_TLV_BASE_ID + 291) /* 0x0223 */
+/** TLV for RTT Range Request */
+#define TLV_TYPE_RTT_RANGE_REQUEST (PROPRIETARY_TLV_BASE_ID + 293) /* 0x0225   \
+								    */
+/** TLV for RTT Range Cancel */
+#define TLV_TYPE_RTT_RANGE_CANCEL (PROPRIETARY_TLV_BASE_ID + 294) /* 0x0226 */
+/** TLV for RTT Result */
+#define TLV_TYPE_RTT_RESULT (PROPRIETARY_TLV_BASE_ID + 295) /* 0x0227 */
+/** TLV for RTTResponderInfo */
+#define TLV_TYPE_RTT_RESPONDER_INFO (PROPRIETARY_TLV_BASE_ID + 296) /* 0x0228  \
+								     */
+/** TLV for RTTResponderEnCfg */
+#define TLV_TYPE_RTT_RESPONDER_EN_CFG                                          \
+	(PROPRIETARY_TLV_BASE_ID + 297) /* 0x0229 */
+/** TLV for RTTLCICfg */
+#define TLV_TYPE_RTT_LCI_CFG (PROPRIETARY_TLV_BASE_ID + 298) /* 0x022a */
+/** TLV for RTTLCRCfg */
+#define TLV_TYPE_RTT_LCR_CFG (PROPRIETARY_TLV_BASE_ID + 299) /* 0x022b */
+#define TLV_TYPE_LL_STAT_IFACE (PROPRIETARY_TLV_BASE_ID + 300) /* 0x022c */
+#define TLV_TYPE_LL_STAT_RADIO (PROPRIETARY_TLV_BASE_ID + 301) /* 0x022d */
+/**TLV type : Host MLME Flag*/
+#define TLV_TYPE_HOST_MLME (PROPRIETARY_TLV_BASE_ID + 307) /* 0x0233 */
+#ifdef UAP_SUPPORT
+/** TLV id: station flag */
+#define TLV_TYPE_UAP_STA_FLAGS (PROPRIETARY_TLV_BASE_ID + 313) /* 0x0239 */
+#endif /* UAP_SUPPORT */
+#define TLV_TYPE_DMCS_STATUS (PROPRIETARY_TLV_BASE_ID + 314) /* 0x023a */
+/** TLV type : ZERO DFS Operation */
+#define TLV_TYPE_ZERO_DFS_OPERATION (PROPRIETARY_TLV_BASE_ID + 315) /* 0x023b  \
+								     */
+#if defined(PCIE9098) || defined(SDAW693) || defined(SD9098) ||                \
+	defined(USB9098) || defined(PCIE9097) || defined(USB9097) ||           \
+	defined(SDIW624) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
+/* TLV type: reg type */
+#define TLV_TYPE_REG_ACCESS_CTRL (PROPRIETARY_TLV_BASE_ID + 316) /* 0x023c*/
+#endif
+#define TLV_TYPE_POWER_TABLE_ATTR (PROPRIETARY_TLV_BASE_ID + 317) /* 0x023d */
+/** TLV type: fw cap info */
+#define TLV_TYPE_FW_CAP_INFO (PROPRIETARY_TLV_BASE_ID + 318) /* 0x023e */
+/** TLV type : TX RATE CFG, rename from TLV_TYPE_GI_LTF_SIZE to include CMD and
+ * HE ER SU settings to this tlv */
+#define TLV_TYPE_TX_RATE_CFG (PROPRIETARY_TLV_BASE_ID + 319) /* 0x023f */
+#ifdef UAP_SUPPORT
+#define TLV_TYPE_UAP_MAX_STA_CNT_PER_CHIP                                      \
+	(PROPRIETARY_TLV_BASE_ID + 320) /* 0x0240 */
+#endif /* UAP_SUPPORT */
+/** TLV type : SAE Password */
+#define TLV_TYPE_SAE_PASSWORD (PROPRIETARY_TLV_BASE_ID + 321) /* 0x0241 */
+/** TLV type : DFS W53 Configuration */
+#define TLV_TYPE_DFS_W53_CFG (PROPRIETARY_TLV_BASE_ID + 325) /* 0x0245 */
+/** TLV type: MULTI AP Flag */
+#define TLV_TYPE_MULTI_AP (PROPRIETARY_TLV_BASE_ID + 326) /* 0x0246 */
+/** TLV type : AP wacp mode */
+#define TLV_TYPE_UAP_WACP_MODE (PROPRIETARY_TLV_BASE_ID + 327) /* 0x0247 */
+#define TLV_TYPE_PREV_BSSID (PROPRIETARY_TLV_BASE_ID + 330) /* 0x024a */
+/** TLV type : SAE PWE Derivation Mode */
+#define TLV_TYPE_WPA3_SAE_PWE_DERIVATION_MODE                                  \
+	(PROPRIETARY_TLV_BASE_ID + 339) /* 0x0253 */
+/** TLV type : GPIO TSF LATCH CONFIG */
+#define TLV_TYPE_GPIO_TSF_LATCH_CONFIG                                         \
+	(PROPRIETARY_TLV_BASE_ID + 340) /* 0x0254 */
+/** TLV type : GPIO TSF LATCH REPORT*/
+#define TLV_TYPE_GPIO_TSF_LATCH_REPORT                                         \
+	(PROPRIETARY_TLV_BASE_ID + 341) /* 0x0255 */
+#define NXP_ACTION_CHAN_SWITCH_ANNOUNCE                                        \
+	(PROPRIETARY_TLV_BASE_ID + 342) /* 0x0256 */
+#ifdef UAP_SUPPORT
+#define NXP_802_11_PER_PEER_STATS_CFG_TLV_ID                                   \
+	(PROPRIETARY_TLV_BASE_ID + 346) /* 0x025a */
+#define NXP_802_11_PER_PEER_STATS_ENTRY_TLV_ID                                 \
+	(PROPRIETARY_TLV_BASE_ID + 347) /* 0x025b */
+#endif /* UAP_SUPPORT */
+/** TLV type: secure boot uuid */
+#define TLV_TYPE_SECURE_BOOT_UUID (PROPRIETARY_TLV_BASE_ID + 348) /* 0x025c */
+#define TLV_TYPE_CLOUD_KEEP_ALIVE_ACK                                          \
+	(PROPRIETARY_TLV_BASE_ID + 349) /* 0x025d */
+/** TLV type: ps_ext_param */
+#define TLV_TYPE_PS_EXT_PARAM (PROPRIETARY_TLV_BASE_ID + 351) /* 0x025f */
+#define TLV_TYPE_MCLIENT_FW_CAPS (PROPRIETARY_TLV_BASE_ID + 352) /* 0x0260 */
+#define NXP_CSI_MONITOR_TLV_ID (PROPRIETARY_TLV_BASE_ID + 354) /* 0x0262 */
+#define TLV_TYPE_BOOT_TIME_CFG (PROPRIETARY_TLV_BASE_ID + 355) /* 0x0263 */
+
+#define VENDOR_IE_OUIS_TLV_ID (PROPRIETARY_TLV_BASE_ID + 357) /* 0x0265 */
+
+#endif /* !MLAN_TLV_IDS_H_ */
diff --git a/wlan_sd8987/mlan/mlan_txrx.c b/wlan_src/mlan/mlan_txrx.c
old mode 100755
new mode 100644
similarity index 60%
rename from wlan_sd8987/mlan/mlan_txrx.c
rename to wlan_src/mlan/mlan_txrx.c
index c55c145..a6f9285
--- a/wlan_sd8987/mlan/mlan_txrx.c
+++ b/wlan_src/mlan/mlan_txrx.c
@@ -4,20 +4,29 @@
  *  @brief This file contains the handling of TX/RX in MLAN
  *
  *
- *  Copyright 2009-2021 NXP
+ *  Copyright 2009-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -70,6 +79,7 @@
 	ENTER();
 
 	prx_pd = (RxPD *)(pmbuf->pbuf + pmbuf->data_offset);
+
 	/* Get the BSS number from RxPD, get corresponding priv */
 	priv = wlan_get_priv_by_id(pmadapter, prx_pd->bss_num & BSS_NUM_MASK,
 				   prx_pd->bss_type);
@@ -79,6 +89,7 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
+
 	pmbuf->bss_index = priv->bss_index;
 	PRINTM_GET_SYS_TIME(MDATA, &sec, &usec);
 	PRINTM_NETINTF(MDATA, priv);
@@ -89,7 +100,85 @@
 	LEAVE();
 	return ret;
 }
+Stats_mcast_drv_t gmcast_stats = {0};
+/* This flag is used to protect the mcast drv stat update
+ * when it's value is copied to provide to mlanutl
+ * MTRUE = Update is allowed
+ * MFALSE = Update is not allowed
+ */
+t_u8 mcast_drv_update_allow_flag = MTRUE;
+#define DEST_MAC_OFFSET 10
+#define CYCLE_START 1
+#define FIVE_SEC 5000000 /* 1000000 usec = 1sec*/
+/**
+ *  @brief This function calculates the cycle delta and driver time delta
+ *  for Mcast packets
+ *
+ *  @param pmadapter    A pointer to pmlan_adapter structure
+ *  @param pmbuf   A pointer to the mlan_buffer for process
+ *
+ *  @return         Nothing
+ */
+static void wlan_drv_mcast_cycle_delay_calulation(pmlan_adapter pmadapter,
+						  pmlan_buffer pmbuf)
+{
+	static t_u32 prev_mcast_sec = 0;
+	static t_u32 prev_mcast_usec = 0;
+	t_u32 curr_ts_sec = 0;
+	t_u32 curr_ts_usec = 0;
+	t_u64 cycle_delta = 0;
+	t_u64 profile_delta = 0;
 
+	if (mcast_drv_update_allow_flag == MFALSE)
+		return;
+	/* Take current time */
+	if (pmadapter && pmadapter->pmoal_handle)
+		pmadapter->callbacks.moal_get_system_time(
+			pmadapter->pmoal_handle, &curr_ts_sec, &curr_ts_usec);
+	else
+		PRINTM(MERROR, "ERR: pmadapter or pmoal_handle NULL\n",
+		       __func__);
+
+	if (curr_ts_sec || curr_ts_usec) {
+		/* Calculate profile delta */
+		profile_delta = (curr_ts_sec - pmbuf->in_ts_sec) * 1000000;
+		profile_delta += (t_s32)(curr_ts_usec - pmbuf->in_ts_usec);
+
+		if ((profile_delta >= 0) && (profile_delta <= 1000))
+			gmcast_stats.spent_time_under_1000usec++;
+		else if ((profile_delta > 1000) && (profile_delta <= 2000))
+			gmcast_stats.spent_time_over_1000usec++;
+		else if ((profile_delta > 2000) && (profile_delta <= 3000))
+			gmcast_stats.spent_time_over_2000usec++;
+		else if (profile_delta > 3000)
+			gmcast_stats.spent_time_over_3000usec++;
+	}
+	/* Process the start cycle data */
+	cycle_delta = (pmbuf->in_ts_sec - prev_mcast_sec) * 1000000;
+	cycle_delta += (t_s32)(pmbuf->in_ts_usec - prev_mcast_usec);
+
+	/* If start cycle delta is more than 5 sec ignore*/
+	if ((pmbuf->u.mc_tx_info.mc_pkt_flags & (1 << CYCLE_START)) &&
+	    (cycle_delta < FIVE_SEC)) {
+		if ((cycle_delta >= 0) && (cycle_delta <= 2300))
+			gmcast_stats.cycle_recv_under_2300usec++;
+		if ((cycle_delta > 2300) && (cycle_delta <= 2900))
+			gmcast_stats.cycle_recv_in_time++;
+		if ((cycle_delta > 2900) && (cycle_delta <= 3500))
+			gmcast_stats.cycle_recv_over_2900usec++;
+		if ((cycle_delta > 3500) && (cycle_delta <= 5000))
+			gmcast_stats.cycle_recv_over_3500usec++;
+		if ((cycle_delta > 5000) && (cycle_delta <= 10000))
+			gmcast_stats.cycle_recv_over_5000usec++;
+		if ((cycle_delta > 10000) && (cycle_delta <= 15000))
+			gmcast_stats.cycle_recv_over_10000usec++;
+		if (cycle_delta > 15000)
+			gmcast_stats.cycle_recv_over_15000usec++;
+	}
+	/* Update the last received mcast cycle value */
+	prev_mcast_sec = pmbuf->in_ts_sec;
+	prev_mcast_usec = pmbuf->in_ts_usec;
+}
 /**
  *  @brief This function checks the conditions and sends packet to device
  *
@@ -112,6 +201,7 @@
 #ifdef STA_SUPPORT
 	PTxPD plocal_tx_pd = MNULL;
 #endif
+	t_u8 dest_mac_first_octet = 0;
 
 	ENTER();
 	head_ptr = (t_u8 *)priv->ops.process_txpd(priv, pmbuf);
@@ -124,6 +214,11 @@
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA)
 		plocal_tx_pd = (TxPD *)(head_ptr + priv->intf_hr_len);
 #endif
+	dest_mac_first_octet = *(head_ptr + priv->intf_hr_len +
+				 Tx_PD_SIZEOF(pmadapter) + DEST_MAC_OFFSET);
+
+	if (dest_mac_first_octet & 0x01)
+		wlan_drv_mcast_cycle_delay_calulation(pmadapter, pmbuf);
 	if (pmadapter->tp_state_on)
 		pmadapter->callbacks.moal_tp_accounting(pmadapter->pmoal_handle,
 							pmbuf, 4);
@@ -139,7 +234,7 @@
 	case MLAN_STATUS_PRESOURCE:
 		PRINTM(MINFO, "MLAN_STATUS_PRESOURCE is returned\n");
 		DBG_HEXDUMP(MDAT_D, "Tx", head_ptr + priv->intf_hr_len,
-			    MIN(pmbuf->data_len + sizeof(TxPD),
+			    MIN(pmbuf->data_len + Tx_PD_SIZEOF(pmadapter),
 				MAX_DATA_DUMP_LEN));
 		break;
 #endif
@@ -162,12 +257,12 @@
 		break;
 	case MLAN_STATUS_PENDING:
 		DBG_HEXDUMP(MDAT_D, "Tx", head_ptr + priv->intf_hr_len,
-			    MIN(pmbuf->data_len + sizeof(TxPD),
+			    MIN(pmbuf->data_len + Tx_PD_SIZEOF(pmadapter),
 				MAX_DATA_DUMP_LEN));
 		break;
 	case MLAN_STATUS_SUCCESS:
 		DBG_HEXDUMP(MDAT_D, "Tx", head_ptr + priv->intf_hr_len,
-			    MIN(pmbuf->data_len + sizeof(TxPD),
+			    MIN(pmbuf->data_len + Tx_PD_SIZEOF(pmadapter),
 				MAX_DATA_DUMP_LEN));
 		wlan_write_data_complete(pmadapter, pmbuf, ret);
 		break;
@@ -296,13 +391,14 @@
 
 	if (pmbuf->buf_type != MLAN_BUF_TYPE_RAW_DATA)
 		pmbuf->buf_type = MLAN_BUF_TYPE_DATA;
-	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
-					    priv->bypass_txq.plock);
-	pmadapter->bypass_pkt_count++;
+	util_scalar_increment(pmadapter->pmoal_handle,
+			      &pmadapter->bypass_pkt_count,
+			      pmadapter->callbacks.moal_spin_lock,
+			      pmadapter->callbacks.moal_spin_unlock);
 	util_enqueue_list_tail(pmadapter->pmoal_handle, &priv->bypass_txq,
-			       (pmlan_linked_list)pmbuf, MNULL, MNULL);
-	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
-					      priv->bypass_txq.plock);
+			       (pmlan_linked_list)pmbuf,
+			       pmadapter->callbacks.moal_spin_lock,
+			       pmadapter->callbacks.moal_spin_unlock);
 	LEAVE();
 }
 
@@ -315,6 +411,7 @@
  */
 INLINE t_u8 wlan_bypass_tx_list_empty(mlan_adapter *pmadapter)
 {
+	t_u32 bypass_pkt_count;
 #if defined(USB)
 	if (IS_USB(pmadapter->card_type)) {
 		pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -334,9 +431,14 @@
 			}
 		}
 		return MTRUE;
-	} else
+	}
 #endif
-		return (pmadapter->bypass_pkt_count) ? MFALSE : MTRUE;
+	bypass_pkt_count =
+		util_scalar_read(pmadapter->pmoal_handle,
+				 &pmadapter->bypass_pkt_count,
+				 pmadapter->callbacks.moal_spin_lock,
+				 pmadapter->callbacks.moal_spin_unlock);
+	return (bypass_pkt_count) ? MFALSE : MTRUE;
 }
 
 /**
@@ -359,7 +461,10 @@
 		util_unlink_list(pmadapter->pmoal_handle, &priv->bypass_txq,
 				 (pmlan_linked_list)pmbuf, MNULL, MNULL);
 		wlan_write_data_complete(pmadapter, pmbuf, MLAN_STATUS_FAILURE);
-		pmadapter->bypass_pkt_count--;
+		util_scalar_decrement(pmadapter->pmoal_handle,
+				      &pmadapter->bypass_pkt_count,
+				      pmadapter->callbacks.moal_spin_lock,
+				      pmadapter->callbacks.moal_spin_unlock);
 	}
 	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
 					      priv->bypass_txq.plock);
@@ -396,13 +501,13 @@
 					pmadapter->callbacks.moal_spin_lock,
 					pmadapter->callbacks.moal_spin_unlock);
 				if (pmbuf) {
-					pmadapter->callbacks.moal_spin_lock(
+					util_scalar_decrement(
 						pmadapter->pmoal_handle,
-						priv->bypass_txq.plock);
-					pmadapter->bypass_pkt_count--;
-					pmadapter->callbacks.moal_spin_unlock(
-						pmadapter->pmoal_handle,
-						priv->bypass_txq.plock);
+						&pmadapter->bypass_pkt_count,
+						pmadapter->callbacks
+							.moal_spin_lock,
+						pmadapter->callbacks
+							.moal_spin_unlock);
 					PRINTM(MINFO,
 					       "Dequeuing bypassed packet %p\n",
 					       pmbuf);
@@ -420,10 +525,14 @@
 						/* Queue the packet again so
 						 * that it will be TX'ed later
 						 */
-						pmadapter->callbacks.moal_spin_lock(
+						util_scalar_increment(
 							pmadapter->pmoal_handle,
-							priv->bypass_txq.plock);
-						pmadapter->bypass_pkt_count++;
+							&pmadapter->bypass_pkt_count,
+							pmadapter->callbacks
+								.moal_spin_lock,
+							pmadapter->callbacks
+								.moal_spin_unlock);
+
 						util_enqueue_list_head(
 							pmadapter->pmoal_handle,
 							&priv->bypass_txq,
@@ -432,9 +541,6 @@
 								.moal_spin_lock,
 							pmadapter->callbacks
 								.moal_spin_unlock);
-						pmadapter->callbacks.moal_spin_unlock(
-							pmadapter->pmoal_handle,
-							priv->bypass_txq.plock);
 					}
 					break;
 				} else {
@@ -446,3 +552,57 @@
 		 !wlan_bypass_tx_list_empty(pmadapter));
 	LEAVE();
 }
+
+/**
+ *  @brief This function will convert 802.11 header to 802.3 header
+	   and save the backhaul station aid to pmbuf
+ *
+ *  @param priv    A pointer to mlan_private
+ *  @param pmbuf   A pointer to mlan_buffer
+ *  @param prx_pd  A pointer to RxPD
+ *
+ *  @return	MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_check_easymesh_pkt(mlan_private *priv, pmlan_buffer pmbuf,
+				    RxPD *prx_pd)
+{
+	Eth803Hdr_t *eth_header = MNULL;
+	sta_node *sta_ptr = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u8 *pos = MNULL;
+	t_u32 tmp = 0;
+
+	ENTER();
+
+	pos = (t_u8 *)prx_pd + prx_pd->rx_pkt_offset;
+	eth_header = (Eth803Hdr_t *)pos;
+
+	PRINTM(MDAT_D,
+	       "Rx Easymesh ETH header destination address: " FULL_MACSTR
+	       "\nETH header source address: " FULL_MACSTR "\n",
+	       FULL_MAC2STR(eth_header->dest_addr),
+	       FULL_MAC2STR(eth_header->src_addr));
+
+	if (priv->bss_type == MLAN_BSS_TYPE_UAP) {
+		pmbuf->flags |= MLAN_BUF_FLAG_EASYMESH;
+		memcpy_ext(priv->adapter, pmbuf->mac, prx_pd->ta_mac,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+
+		sta_ptr = wlan_get_station_entry(priv, prx_pd->ta_mac);
+		if (!sta_ptr) {
+			PRINTM(MERROR,
+			       "Easymesh Error! Can't find station in the station list\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+
+		/* Save station aid to pmbuf and send it to moal */
+		tmp = (t_u32)sta_ptr->aid;
+		pmbuf->priority |= (tmp << 24);
+		PRINTM(MDAT_D, "Easymesh: Rx for VLAN " FULL_MACSTR "\n",
+		       FULL_MAC2STR(prx_pd->ta_mac));
+	}
+done:
+	LEAVE();
+	return ret;
+}
diff --git a/wlan_src/mlan/mlan_uap.h b/wlan_src/mlan/mlan_uap.h
new file mode 100644
index 0000000..f54b0a9
--- /dev/null
+++ b/wlan_src/mlan/mlan_uap.h
@@ -0,0 +1,66 @@
+/** @file mlan_uap.h
+ *
+ *  @brief This file contains related macros, enum, and struct
+ *  of uap functionalities
+ *
+ *
+ *  Copyright 2009-2021 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/********************************************************
+Change log:
+    02/05/2009: initial version
+********************************************************/
+
+#ifndef _MLAN_UAP_H_
+#define _MLAN_UAP_H_
+
+mlan_status wlan_uap_get_channel(pmlan_private pmpriv);
+
+mlan_status wlan_uap_set_channel(pmlan_private pmpriv,
+				 Band_Config_t uap_band_cfg, t_u8 channel);
+
+mlan_status wlan_uap_get_beacon_dtim(pmlan_private pmpriv);
+
+mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req);
+
+mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
+				     t_u16 cmd_action, t_u32 cmd_oid,
+				     t_void *pioctl_buf, t_void *pdata_buf,
+				     t_void *pcmd_buf);
+
+mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
+					 t_void *pcmd_buf, t_void *pioctl);
+
+mlan_status wlan_ops_uap_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf);
+
+mlan_status wlan_ops_uap_process_event(t_void *priv);
+
+t_void *wlan_ops_uap_process_txpd(t_void *priv, pmlan_buffer pmbuf);
+
+mlan_status wlan_ops_uap_init_cmd(t_void *priv, t_u8 first_bss);
+
+#endif /* _MLAN_UAP_H_ */
diff --git a/wlan_sd8987/mlan/mlan_uap_cmdevent.c b/wlan_src/mlan/mlan_uap_cmdevent.c
old mode 100755
new mode 100644
similarity index 87%
rename from wlan_sd8987/mlan/mlan_uap_cmdevent.c
rename to wlan_src/mlan/mlan_uap_cmdevent.c
index 8f2b0ef..7d3f884
--- a/wlan_sd8987/mlan/mlan_uap_cmdevent.c
+++ b/wlan_src/mlan/mlan_uap_cmdevent.c
@@ -3,20 +3,29 @@
  *  @brief This file contains the handling of AP mode command and event
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -40,9 +49,6 @@
 #include "mlan_11h.h"
 #include "mlan_11ac.h"
 #include "mlan_11ax.h"
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-#include "authenticator_api.h"
-#endif
 #ifdef PCIE
 #include "mlan_pcie.h"
 #endif /* PCIE */
@@ -193,6 +199,10 @@
 					     mlan_ioctl_req *pioctl_buf)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
+#ifdef STA_SUPPORT
+	pmlan_ioctl_req pscan_ioctl_req = MNULL;
+	mlan_callbacks *pcb = MNULL;
+#endif
 #if defined(USB)
 	t_u8 i;
 #endif
@@ -200,7 +210,8 @@
 
 	ENTER();
 	if (resp->command != HostCmd_CMD_WMM_PARAM_CONFIG &&
-	    resp->command != HostCmd_CMD_CHAN_REGION_CFG)
+	    resp->command != HostCmd_CMD_CHAN_REGION_CFG &&
+	    resp->command != HostCmd_CMD_REGION_POWER_CFG)
 		PRINTM(MERROR, "CMD_RESP: cmd %#x error, result=%#x\n",
 		       resp->command, resp->result);
 	if (pioctl_buf)
@@ -216,7 +227,7 @@
 		break;
 #endif
 
-	case HOST_CMD_APCMD_SYS_CONFIGURE: {
+	case HostCmd_CMD_APCMD_SYS_CONFIGURE: {
 		HostCmd_DS_SYS_CONFIG *sys_config =
 			(HostCmd_DS_SYS_CONFIG *)&resp->params.sys_config;
 		t_u16 resp_len = 0, travel_len = 0, index;
@@ -298,10 +309,38 @@
 		ret = MLAN_STATUS_SUCCESS;
 		PRINTM(MCMND, "FW don't support chan region cfg command!\n");
 		break;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR)
-	case HostCmd_CMD_CRYPTO:
-		PRINTM(MCMND, "crypto cmd result=0x%x!\n", resp->result);
-		ret = wlan_ret_crypto(pmpriv, resp, pioctl_buf);
+	case HostCmd_CMD_REGION_POWER_CFG:
+		ret = MLAN_STATUS_SUCCESS;
+		PRINTM(MCMND, "FW don't support region power cfg command!\n");
+		break;
+	case HostCmd_CMD_802_11_REMAIN_ON_CHANNEL:
+		if (resp->result == HostCmd_RESULT_BUSY)
+			pmadapter->dbg.num_remain_chan_err++;
+		break;
+#ifdef STA_SUPPORT
+	case HostCmd_CMD_802_11_SCAN_EXT:
+		if (resp->result == HostCmd_RESULT_BUSY)
+			pmadapter->dbg.num_scan_err++;
+		/* Cancel all pending scan command */
+		wlan_flush_scan_queue(pmadapter);
+
+		pcb = (pmlan_callbacks)&pmadapter->callbacks;
+
+		wlan_request_cmd_lock(pmadapter);
+		pmadapter->scan_processing = MFALSE;
+		pscan_ioctl_req = pmadapter->pscan_ioctl_req;
+		pmadapter->pscan_ioctl_req = MNULL;
+		/* Need to indicate IOCTL complete */
+		if (pscan_ioctl_req) {
+			pscan_ioctl_req->status_code = MLAN_ERROR_NO_ERROR;
+			/* Indicate ioctl complete */
+			pcb->moal_ioctl_complete(
+				pmadapter->pmoal_handle,
+				(pmlan_ioctl_req)pscan_ioctl_req,
+				MLAN_STATUS_SUCCESS);
+		}
+		wlan_release_cmd_lock(pmadapter);
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_SCAN_REPORT, MNULL);
 		break;
 #endif
 	default:
@@ -652,6 +691,28 @@
 }
 
 /**
+ *  @brief This function will STA`s PS mode change event
+ *
+ *  @param priv    A pointer to mlan_private
+ *  @param pevent  A pointer to event buf
+ *
+ *  @return	       N/A
+ */
+static void wlan_process_sta_ps_change_event(pmlan_private priv,
+					     pmlan_buffer pevent)
+{
+	MrvlIEtypes_PsStaStatus_t *ps_status =
+		(void *)(pevent->pbuf + pevent->data_offset + sizeof(t_u32));
+
+	ENTER();
+
+	wlan_update_sta_ps_state(priv, ps_status->mac, ps_status->sleep);
+
+	LEAVE();
+	return;
+}
+
+/**
  *  @brief This function prepares command for config uap settings
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -708,14 +769,16 @@
 	MrvlIETypes_HTCap_t *tlv_htcap = MNULL;
 	MrvlIEtypes_wmm_parameter_t *tlv_wmm_parameter = MNULL;
 	MrvlIEtypes_preamble_t *tlv_preamble = MNULL;
+	MrvlIEtypes_MultiAp_t *tlv_multi_ap = MNULL;
 
 	t_u32 cmd_size = 0;
 	t_u8 zero_mac[] = {0, 0, 0, 0, 0, 0};
 	t_u16 i;
 	t_u16 ac;
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 	int rx_mcs_supp = 0;
 #endif
 
@@ -727,9 +790,9 @@
 
 	bss = (mlan_ds_bss *)pioctl_buf->pbuf;
 
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_APCMD_SYS_CONFIGURE);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_SYS_CONFIGURE);
 	sys_config->action = wlan_cpu_to_le16(cmd_action);
-	cmd_size = sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN;
+	cmd_size = sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN;
 
 	tlv = (t_u8 *)sys_config->tlv_buffer;
 	if (memcmp(pmpriv->adapter, zero_mac, &bss->param.bss_config.mac_addr,
@@ -969,67 +1032,60 @@
 		tlv += sizeof(MrvlIEtypes_retry_limit_t);
 	}
 
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-	if (IS_FW_SUPPORT_AUTHENTICATOR(pmpriv->adapter)) {
-#endif
-		if (bss->param.bss_config.pairwise_update_timeout <
-		    (MAX_VALID_DWORD)) {
-			tlv_pairwise_timeout =
-				(MrvlIEtypes_eapol_pwk_hsk_timeout_t *)tlv;
-			tlv_pairwise_timeout->header.type = wlan_cpu_to_le16(
-				TLV_TYPE_UAP_EAPOL_PWK_HSK_TIMEOUT);
-			tlv_pairwise_timeout->header.len =
-				wlan_cpu_to_le16(sizeof(t_u32));
-			tlv_pairwise_timeout
-				->pairwise_update_timeout = wlan_cpu_to_le32(
+	if (bss->param.bss_config.pairwise_update_timeout < (MAX_VALID_DWORD)) {
+		tlv_pairwise_timeout =
+			(MrvlIEtypes_eapol_pwk_hsk_timeout_t *)tlv;
+		tlv_pairwise_timeout->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_UAP_EAPOL_PWK_HSK_TIMEOUT);
+		tlv_pairwise_timeout->header.len =
+			wlan_cpu_to_le16(sizeof(t_u32));
+		tlv_pairwise_timeout->pairwise_update_timeout =
+			wlan_cpu_to_le32(
 				bss->param.bss_config.pairwise_update_timeout);
-			cmd_size += sizeof(MrvlIEtypes_eapol_pwk_hsk_timeout_t);
-			tlv += sizeof(MrvlIEtypes_eapol_pwk_hsk_timeout_t);
-		}
-
-		if (bss->param.bss_config.pwk_retries < (MAX_VALID_DWORD)) {
-			tlv_pairwise_retries =
-				(MrvlIEtypes_eapol_pwk_hsk_retries_t *)tlv;
-			tlv_pairwise_retries->header.type = wlan_cpu_to_le16(
-				TLV_TYPE_UAP_EAPOL_PWK_HSK_RETRIES);
-			tlv_pairwise_retries->header.len =
-				wlan_cpu_to_le16(sizeof(t_u32));
-			tlv_pairwise_retries->pwk_retries = wlan_cpu_to_le32(
-				bss->param.bss_config.pwk_retries);
-			cmd_size += sizeof(MrvlIEtypes_eapol_pwk_hsk_retries_t);
-			tlv += sizeof(MrvlIEtypes_eapol_pwk_hsk_retries_t);
-		}
-
-		if (bss->param.bss_config.groupwise_update_timeout <
-		    (MAX_VALID_DWORD)) {
-			tlv_groupwise_timeout =
-				(MrvlIEtypes_eapol_gwk_hsk_timeout_t *)tlv;
-			tlv_groupwise_timeout->header.type = wlan_cpu_to_le16(
-				TLV_TYPE_UAP_EAPOL_GWK_HSK_TIMEOUT);
-			tlv_groupwise_timeout->header.len =
-				wlan_cpu_to_le16(sizeof(t_u32));
-			tlv_groupwise_timeout
-				->groupwise_update_timeout = wlan_cpu_to_le32(
-				bss->param.bss_config.groupwise_update_timeout);
-			cmd_size += sizeof(MrvlIEtypes_eapol_gwk_hsk_timeout_t);
-			tlv += sizeof(MrvlIEtypes_eapol_gwk_hsk_timeout_t);
-		}
-
-		if (bss->param.bss_config.gwk_retries < (MAX_VALID_DWORD)) {
-			tlv_groupwise_retries =
-				(MrvlIEtypes_eapol_gwk_hsk_retries_t *)tlv;
-			tlv_groupwise_retries->header.type = wlan_cpu_to_le16(
-				TLV_TYPE_UAP_EAPOL_GWK_HSK_RETRIES);
-			tlv_groupwise_retries->header.len =
-				wlan_cpu_to_le16(sizeof(t_u32));
-			tlv_groupwise_retries->gwk_retries = wlan_cpu_to_le32(
-				bss->param.bss_config.gwk_retries);
-			cmd_size += sizeof(MrvlIEtypes_eapol_gwk_hsk_retries_t);
-			tlv += sizeof(MrvlIEtypes_eapol_gwk_hsk_retries_t);
-		}
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
+		cmd_size += sizeof(MrvlIEtypes_eapol_pwk_hsk_timeout_t);
+		tlv += sizeof(MrvlIEtypes_eapol_pwk_hsk_timeout_t);
 	}
-#endif
+
+	if (bss->param.bss_config.pwk_retries < (MAX_VALID_DWORD)) {
+		tlv_pairwise_retries =
+			(MrvlIEtypes_eapol_pwk_hsk_retries_t *)tlv;
+		tlv_pairwise_retries->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_UAP_EAPOL_PWK_HSK_RETRIES);
+		tlv_pairwise_retries->header.len =
+			wlan_cpu_to_le16(sizeof(t_u32));
+		tlv_pairwise_retries->pwk_retries =
+			wlan_cpu_to_le32(bss->param.bss_config.pwk_retries);
+		cmd_size += sizeof(MrvlIEtypes_eapol_pwk_hsk_retries_t);
+		tlv += sizeof(MrvlIEtypes_eapol_pwk_hsk_retries_t);
+	}
+
+	if (bss->param.bss_config.groupwise_update_timeout <
+	    (MAX_VALID_DWORD)) {
+		tlv_groupwise_timeout =
+			(MrvlIEtypes_eapol_gwk_hsk_timeout_t *)tlv;
+		tlv_groupwise_timeout->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_UAP_EAPOL_GWK_HSK_TIMEOUT);
+		tlv_groupwise_timeout->header.len =
+			wlan_cpu_to_le16(sizeof(t_u32));
+		tlv_groupwise_timeout->groupwise_update_timeout =
+			wlan_cpu_to_le32(
+				bss->param.bss_config.groupwise_update_timeout);
+		cmd_size += sizeof(MrvlIEtypes_eapol_gwk_hsk_timeout_t);
+		tlv += sizeof(MrvlIEtypes_eapol_gwk_hsk_timeout_t);
+	}
+
+	if (bss->param.bss_config.gwk_retries < (MAX_VALID_DWORD)) {
+		tlv_groupwise_retries =
+			(MrvlIEtypes_eapol_gwk_hsk_retries_t *)tlv;
+		tlv_groupwise_retries->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_UAP_EAPOL_GWK_HSK_RETRIES);
+		tlv_groupwise_retries->header.len =
+			wlan_cpu_to_le16(sizeof(t_u32));
+		tlv_groupwise_retries->gwk_retries =
+			wlan_cpu_to_le32(bss->param.bss_config.gwk_retries);
+		cmd_size += sizeof(MrvlIEtypes_eapol_gwk_hsk_retries_t);
+		tlv += sizeof(MrvlIEtypes_eapol_gwk_hsk_retries_t);
+	}
 	if ((bss->param.bss_config.filter.filter_mode <=
 	     MAC_FILTER_MODE_BLOCK_MAC) &&
 	    (bss->param.bss_config.filter.mac_count <= MAX_MAC_FILTER_NUM)) {
@@ -1103,6 +1159,10 @@
 		tlv_auth_type->header.len =
 			wlan_cpu_to_le16(sizeof(MrvlIEtypes_auth_type_t) -
 					 sizeof(MrvlIEtypesHeader_t));
+		tlv_auth_type->PWE_derivation =
+			bss->param.bss_config.pwe_derivation;
+		tlv_auth_type->transition_disable =
+			bss->param.bss_config.transition_disable;
 		tlv_auth_type->auth_type =
 			(t_u8)bss->param.bss_config.auth_mode;
 		cmd_size += sizeof(MrvlIEtypes_auth_type_t);
@@ -1193,49 +1253,34 @@
 			tlv += sizeof(MrvlIEtypes_rsn_replay_prot_t);
 		}
 
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		if (IS_FW_SUPPORT_AUTHENTICATOR(pmpriv->adapter)) {
-#endif
-			if (bss->param.bss_config.wpa_cfg.length) {
-				tlv_passphrase =
-					(MrvlIEtypes_passphrase_t *)tlv;
-				tlv_passphrase->header.type = wlan_cpu_to_le16(
-					TLV_TYPE_UAP_WPA_PASSPHRASE);
-				tlv_passphrase->header
-					.len = (t_u16)wlan_cpu_to_le16(
-					bss->param.bss_config.wpa_cfg.length);
-				memcpy_ext(
-					pmpriv->adapter,
-					tlv_passphrase->passphrase,
-					bss->param.bss_config.wpa_cfg.passphrase,
-					bss->param.bss_config.wpa_cfg.length,
-					bss->param.bss_config.wpa_cfg.length);
-				cmd_size +=
-					sizeof(MrvlIEtypesHeader_t) +
-					bss->param.bss_config.wpa_cfg.length;
-				tlv += sizeof(MrvlIEtypesHeader_t) +
-				       bss->param.bss_config.wpa_cfg.length;
-			}
-
-			if (bss->param.bss_config.wpa_cfg.gk_rekey_time <
-			    MAX_GRP_TIMER) {
-				tlv_rekey_time =
-					(MrvlIEtypes_group_rekey_time_t *)tlv;
-				tlv_rekey_time->header.type = wlan_cpu_to_le16(
-					TLV_TYPE_UAP_GRP_REKEY_TIME);
-				tlv_rekey_time->header.len =
-					wlan_cpu_to_le16(sizeof(t_u32));
-				tlv_rekey_time->gk_rekey_time =
-					wlan_cpu_to_le32(
-						bss->param.bss_config.wpa_cfg
-							.gk_rekey_time);
-				cmd_size +=
-					sizeof(MrvlIEtypes_group_rekey_time_t);
-				tlv += sizeof(MrvlIEtypes_group_rekey_time_t);
-			}
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
+		if (bss->param.bss_config.wpa_cfg.length) {
+			tlv_passphrase = (MrvlIEtypes_passphrase_t *)tlv;
+			tlv_passphrase->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_UAP_WPA_PASSPHRASE);
+			tlv_passphrase->header.len = (t_u16)wlan_cpu_to_le16(
+				bss->param.bss_config.wpa_cfg.length);
+			memcpy_ext(pmpriv->adapter, tlv_passphrase->passphrase,
+				   bss->param.bss_config.wpa_cfg.passphrase,
+				   bss->param.bss_config.wpa_cfg.length,
+				   bss->param.bss_config.wpa_cfg.length);
+			cmd_size += sizeof(MrvlIEtypesHeader_t) +
+				    bss->param.bss_config.wpa_cfg.length;
+			tlv += sizeof(MrvlIEtypesHeader_t) +
+			       bss->param.bss_config.wpa_cfg.length;
 		}
-#endif
+
+		if (bss->param.bss_config.wpa_cfg.gk_rekey_time <
+		    MAX_GRP_TIMER) {
+			tlv_rekey_time = (MrvlIEtypes_group_rekey_time_t *)tlv;
+			tlv_rekey_time->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_UAP_GRP_REKEY_TIME);
+			tlv_rekey_time->header.len =
+				wlan_cpu_to_le16(sizeof(t_u32));
+			tlv_rekey_time->gk_rekey_time = wlan_cpu_to_le32(
+				bss->param.bss_config.wpa_cfg.gk_rekey_time);
+			cmd_size += sizeof(MrvlIEtypes_group_rekey_time_t);
+			tlv += sizeof(MrvlIEtypes_group_rekey_time_t);
+		}
 	} else {
 		if ((bss->param.bss_config.wep_cfg.key0.length) &&
 		    ((bss->param.bss_config.wep_cfg.key0.length == 5) ||
@@ -1345,11 +1390,13 @@
 			   bss->param.bss_config.supported_mcs_set, 16,
 			   sizeof(tlv_htcap->ht_cap.supported_mcs_set));
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097)
 		if (IS_CARD9098(pmpriv->adapter->card_type) ||
-		    IS_CARDNW62X(pmpriv->adapter->card_type) ||
-		    IS_CARD9097(pmpriv->adapter->card_type)) {
+		    IS_CARDIW624(pmpriv->adapter->card_type) ||
+		    IS_CARD9097(pmpriv->adapter->card_type) ||
+		    IS_CARDAW693(pmpriv->adapter->card_type)) {
 			if (bss->param.bss_config.supported_mcs_set[0]) {
 				if (bss->param.bss_config.bandcfg.chanBand ==
 				    BAND_5GHZ)
@@ -1448,11 +1495,6 @@
 		cmd_size += sizeof(MrvlIEtypes_wmm_parameter_t);
 		tlv += sizeof(MrvlIEtypes_wmm_parameter_t);
 	}
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-	if (!IS_FW_SUPPORT_AUTHENTICATOR(pmpriv->adapter))
-		AuthenticatorBssConfig(pmpriv->psapriv,
-				       (t_u8 *)&bss->param.bss_config, 0, 0, 0);
-#endif
 	if (pmpriv->adapter->pcard_info->v17_fw_api &&
 	    bss->param.bss_config.preamble_type) {
 		tlv_preamble = (MrvlIEtypes_preamble_t *)tlv;
@@ -1462,11 +1504,21 @@
 			wlan_cpu_to_le16(sizeof(MrvlIEtypes_preamble_t) -
 					 sizeof(MrvlIEtypesHeader_t));
 		tlv_preamble->preamble_type =
-			wlan_cpu_to_le16(bss->param.bss_config.preamble_type);
+			bss->param.bss_config.preamble_type;
 
 		cmd_size += sizeof(MrvlIEtypes_preamble_t);
 		tlv += sizeof(MrvlIEtypes_preamble_t);
 	}
+	if (bss->param.bss_config.multi_ap_flag) {
+		/** Add multi AP tlv here */
+		tlv_multi_ap = (MrvlIEtypes_MultiAp_t *)tlv;
+		tlv_multi_ap->header.type = wlan_cpu_to_le16(TLV_TYPE_MULTI_AP);
+		tlv_multi_ap->header.len =
+			wlan_cpu_to_le16(sizeof(tlv_multi_ap->flag));
+		tlv_multi_ap->flag = bss->param.bss_config.multi_ap_flag;
+		cmd_size += sizeof(MrvlIEtypes_MultiAp_t);
+		tlv += sizeof(MrvlIEtypes_MultiAp_t);
+	}
 	cmd->size = (t_u16)wlan_cpu_to_le16(cmd_size);
 	PRINTM(MCMND, "AP config: cmd_size=%d\n", cmd_size);
 	LEAVE();
@@ -1520,13 +1572,13 @@
 	MrvlIEtypes_action_chan_switch_t *tlv_chan_switch = MNULL;
 	IEEEtypes_ChanSwitchAnn_t *csa_ie = MNULL;
 	IEEEtypes_ExtChanSwitchAnn_t *ecsa_ie = MNULL;
+	MrvlIEtypes_MultiAp_t *tlv_multi_ap = MNULL;
 
 	ENTER();
 
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_APCMD_SYS_CONFIGURE);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_SYS_CONFIGURE);
 	sys_config->action = wlan_cpu_to_le16(cmd_action);
-	cmd->size =
-		wlan_cpu_to_le16(sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN);
 	if (pioctl_buf == MNULL) {
 		if (pdata_buf) {
 			switch (pdata_header->type) {
@@ -1536,7 +1588,7 @@
 				chan_band_tlv = (MrvlIEtypes_channel_band_t *)
 							sys_config->tlv_buffer;
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(MrvlIEtypes_channel_band_t));
 				chan_band_tlv->header.type = wlan_cpu_to_le16(
@@ -1557,7 +1609,7 @@
 					pdata_buf;
 				bcn_pd_tlv = (MrvlIEtypes_beacon_period_t *)
 						     sys_config->tlv_buffer;
-				cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+				cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) +
 					    S_DS_GEN +
 					    sizeof(MrvlIEtypes_beacon_period_t);
 				bcn_pd_tlv->header.type = wlan_cpu_to_le16(
@@ -1606,7 +1658,7 @@
 			case TLV_TYPE_MGMT_IE:
 				cust_ie = (mlan_ds_misc_custom_ie *)pdata_buf;
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN + sizeof(MrvlIEtypesHeader_t) +
 					cust_ie->len);
 				ie_header->type =
@@ -1672,7 +1724,7 @@
 							pmpriv, &oper_class_ie,
 							curr_oper_class);
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN + length);
 				break;
 			case TLV_TYPE_UAP_MAX_STA_CNT_PER_CHIP:
@@ -1682,7 +1734,7 @@
 					sizeof(MrvlIEtypes_uap_max_sta_cnt_t),
 					sizeof(MrvlIEtypes_uap_max_sta_cnt_t));
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(MrvlIEtypes_uap_max_sta_cnt_t));
 				break;
@@ -1697,7 +1749,7 @@
 			mac_tlv =
 				(MrvlIEtypes_MacAddr_t *)sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_MacAddr_t));
 			mac_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS);
@@ -1713,7 +1765,7 @@
 			mac_tlv =
 				(MrvlIEtypes_MacAddr_t *)sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_MacAddr_t));
 			mac_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS);
@@ -1728,7 +1780,7 @@
 			tlv_wmm_parameter = (MrvlIEtypes_wmm_parameter_t *)
 						    sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_wmm_parameter_t));
 			tlv_wmm_parameter->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_AP_WMM_PARAM);
@@ -1777,7 +1829,7 @@
 			    bss->param.ap_scan_channels.num_of_chan <=
 				    MLAN_MAX_CHANNEL) {
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(tlv_chan_list->header) +
 					sizeof(ChanScanParamSet_t) *
@@ -1810,7 +1862,7 @@
 					(t_u16)(sizeof(ChanScanParamSet_t) *
 						MLAN_MAX_CHANNEL));
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(MrvlIEtypes_ChanListParamSet_t) +
 					sizeof(ChanScanParamSet_t) *
@@ -1820,7 +1872,7 @@
 			chan_band_tlv = (MrvlIEtypes_channel_band_t *)
 						sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_channel_band_t));
 			chan_band_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_UAP_CHAN_BAND_CONFIG);
@@ -1838,15 +1890,13 @@
 				       bss->param.ap_channel.channel);
 			}
 		} else if (bss->sub_command == MLAN_OID_ACTION_CHAN_SWITCH) {
-			cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
-				    S_DS_GEN +
+			cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				    sizeof(MrvlIEtypes_action_chan_switch_t);
 			tlv_chan_switch = (MrvlIEtypes_action_chan_switch_t *)
 						  sys_config->tlv_buffer;
 			tlv_chan_switch->header.type = wlan_cpu_to_le16(
-				MRVL_ACTION_CHAN_SWITCH_ANNOUNCE);
-			// mode reserve for future use
-			tlv_chan_switch->mode = 0;
+				NXP_ACTION_CHAN_SWITCH_ANNOUNCE);
+			tlv_chan_switch->mode = bss->param.chanswitch.mode;
 			tlv_chan_switch->num_pkt =
 				bss->param.chanswitch.chan_switch_count;
 			if (bss->param.chanswitch.new_oper_class) {
@@ -1899,7 +1949,7 @@
 		if ((misc->sub_command == MLAN_OID_MISC_GEN_IE) &&
 		    (misc->param.gen_ie.type == MLAN_IE_TYPE_GEN_IE)) {
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypesHeader_t) +
 				misc->param.gen_ie.len);
 			ie_header->type = wlan_cpu_to_le16(TLV_TYPE_WAPI_IE);
@@ -1914,7 +1964,7 @@
 		if ((misc->sub_command == MLAN_OID_MISC_CUSTOM_IE) &&
 		    (misc->param.cust_ie.type == TLV_TYPE_MGMT_IE)) {
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypesHeader_t) +
 				misc->param.cust_ie.len);
 			ie_header->type = wlan_cpu_to_le16(TLV_TYPE_MGMT_IE);
@@ -1971,9 +2021,22 @@
 					misc->param.wacp_mode;
 			}
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_wacp_mode_t));
 		}
+		if (misc->sub_command == MLAN_OID_MISC_MULTI_AP_CFG) {
+			/** Add multi AP tlv here */
+			tlv_multi_ap =
+				(MrvlIEtypes_MultiAp_t *)sys_config->tlv_buffer;
+			tlv_multi_ap->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_MULTI_AP);
+			tlv_multi_ap->header.len =
+				wlan_cpu_to_le16(sizeof(tlv_multi_ap->flag));
+			tlv_multi_ap->flag = misc->param.multi_ap_flag;
+			cmd->size = wlan_cpu_to_le16(
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
+				sizeof(MrvlIEtypes_MultiAp_t));
+		}
 	}
 done:
 	LEAVE();
@@ -2034,6 +2097,7 @@
 	MrvlIEtypes_gwk_cipher_t *tlv_gwk_cipher = MNULL;
 	MrvlIEtypes_rsn_replay_prot_t *tlv_rsn_prot = MNULL;
 	MrvlIEtypes_passphrase_t *tlv_passphrase = MNULL;
+	MrvlIEtypes_SAE_Password_t *tlv_sae_password = MNULL;
 #ifdef WIFI_DIRECT_SUPPORT
 	MrvlIEtypes_psk_t *tlv_psk = MNULL;
 #endif /* WIFI_DIRECT_SUPPORT */
@@ -2052,8 +2116,7 @@
 
 	bss = (mlan_ds_bss *)pioctl_buf->pbuf;
 	tlv = (MrvlIEtypesHeader_t *)sys_config->tlv_buffer;
-	tlv_buf_left =
-		resp->size - (sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN);
+	tlv_buf_left = resp->size - (sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN);
 
 	while (tlv_buf_left >= sizeof(MrvlIEtypesHeader_t)) {
 		tlv_type = wlan_le16_to_cpu(tlv->type);
@@ -2325,6 +2388,18 @@
 				   sizeof(bss->param.bss_config.wpa_cfg
 						  .passphrase));
 			break;
+		case TLV_TYPE_SAE_PASSWORD:
+			tlv_sae_password = (MrvlIEtypes_SAE_Password_t *)tlv;
+			bss->param.bss_config.wpa_cfg.sae_password_length =
+				MIN(MLAN_PMK_HEXSTR_LENGTH, tlv_len);
+			memcpy_ext(pmpriv->adapter,
+				   bss->param.bss_config.wpa_cfg.sae_password,
+				   tlv_sae_password->sae_password,
+				   bss->param.bss_config.wpa_cfg
+					   .sae_password_length,
+				   sizeof(bss->param.bss_config.wpa_cfg
+						  .sae_password));
+			break;
 #ifdef WIFI_DIRECT_SUPPORT
 		case TLV_TYPE_UAP_PSK:
 			tlv_psk = (MrvlIEtypes_psk_t *)tlv;
@@ -2426,11 +2501,6 @@
 		tlv = (MrvlIEtypesHeader_t *)((t_u8 *)tlv + tlv_len +
 					      sizeof(MrvlIEtypesHeader_t));
 	}
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-	if (!IS_FW_SUPPORT_AUTHENTICATOR(pmpriv->adapter))
-		AuthenticatorBssConfig(pmpriv->psapriv,
-				       (t_u8 *)&bss->param.bss_config, 0, 0, 1);
-#endif
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
@@ -2489,6 +2559,7 @@
 	MrvlIEtypes_MacAddr_t *tlv =
 		(MrvlIEtypes_MacAddr_t *)sys_config->tlv_buffer;
 	mlan_ds_misc_custom_ie *cust_ie = MNULL;
+	MrvlIEtypes_wacp_mode_t *tlv_wacp_mode = MNULL;
 	tlvbuf_max_mgmt_ie *max_mgmt_ie = MNULL;
 	MrvlIEtypes_wmm_parameter_t *tlv_wmm_parameter =
 		(MrvlIEtypes_wmm_parameter_t *)sys_config->tlv_buffer;
@@ -2697,7 +2768,9 @@
 							.center_chan =
 							wlan_get_center_freq_idx(
 								pmpriv,
-								BAND_AAC,
+								chan_band_tlv
+									->bandcfg
+									.chanBand,
 								chan_band_tlv
 									->channel,
 								CHANNEL_BW_80MHZ);
@@ -2806,6 +2879,17 @@
 							sizeof(tlvbuf_max_mgmt_ie));
 					}
 				}
+			} else if (misc->sub_command ==
+				   MLAN_OID_MISC_WACP_MODE) {
+				tlv_wacp_mode = (MrvlIEtypes_wacp_mode_t *)
+							sys_config->tlv_buffer;
+				misc->param.wacp_mode =
+					tlv_wacp_mode->wacp_mode;
+				/** update the wacp_mode in mlan_adapter */
+				if (pioctl_buf->action == MLAN_ACT_SET) {
+					pmpriv->adapter->init_para.wacp_mode =
+						misc->param.wacp_mode;
+				}
 			}
 		}
 	} else { /* no ioctl: driver generated get/set */
@@ -2949,6 +3033,7 @@
 		switch (cmd_oid) {
 		case Dot11D_i:
 		case Dot11H_i:
+		case Dot11h_disable_tpc_i:
 			psnmp_mib->oid = wlan_cpu_to_le16((t_u16)cmd_oid);
 			psnmp_mib->buf_size = wlan_cpu_to_le16(sizeof(t_u16));
 			ul_temp = *(t_u32 *)pdata_buf;
@@ -3023,7 +3108,7 @@
 	MrvlIEtypes_HostMlme_t *tlv;
 
 	ENTER();
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_APCMD_BSS_START);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_BSS_START);
 	cmd->size = S_DS_GEN;
 	if (pmpriv->uap_host_based & UAP_FLAG_HOST_MLME) {
 		tlv = (MrvlIEtypes_HostMlme_t *)((t_u8 *)cmd + cmd->size);
@@ -3261,8 +3346,10 @@
 			wlan_le32_to_cpu(pget_log->rx_stuck_issue_cnt[0]);
 		pget_info->param.stats.rx_stuck_issue_cnt[1] =
 			wlan_le32_to_cpu(pget_log->rx_stuck_issue_cnt[1]);
-		pget_info->param.stats.rx_stuck_recovery_cnt =
-			wlan_le32_to_cpu(pget_log->rx_stuck_recovery_cnt);
+		pget_info->param.stats.rx_stuck_poll_recovery_cnt =
+			wlan_le32_to_cpu(pget_log->rx_stuck_poll_recovery_cnt);
+		pget_info->param.stats.rx_stuck_intr_recovery_cnt =
+			wlan_le32_to_cpu(pget_log->rx_stuck_intr_recovery_cnt);
 		pget_info->param.stats.rx_stuck_tsf[0] =
 			wlan_le64_to_cpu(pget_log->rx_stuck_tsf[0]);
 		pget_info->param.stats.rx_stuck_tsf[1] =
@@ -3291,6 +3378,8 @@
 			wlan_le32_to_cpu(pget_log->gdma_abort_cnt);
 		pget_info->param.stats.g_reset_rx_mac_cnt =
 			wlan_le32_to_cpu(pget_log->g_reset_rx_mac_cnt);
+		pget_info->param.stats.SdmaStuckCnt =
+			wlan_le32_to_cpu(pget_log->SdmaStuckCnt);
 		// Ownership error counters
 		pget_info->param.stats.dwCtlErrCnt =
 			wlan_le32_to_cpu(pget_log->dwCtlErrCnt);
@@ -3424,7 +3513,7 @@
 	mlan_deauth_param *deauth = (mlan_deauth_param *)pdata_buf;
 
 	ENTER();
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_APCMD_STA_DEAUTH);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_STA_DEAUTH);
 	cmd->size = wlan_cpu_to_le16(S_DS_GEN + sizeof(HostCmd_DS_STA_DEAUTH));
 	memcpy_ext(pmpriv->adapter, pcmd_sta_deauth->mac, deauth->mac_addr,
 		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
@@ -3434,6 +3523,34 @@
 }
 
 /**
+ *  @brief This function send deauth command
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param sta_addr     A pointer to sta mac address
+ *  @param reason_code  reason code
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+static mlan_status wlan_send_deauth_cmd(pmlan_private pmpriv, t_u8 *sta_addr,
+					t_u16 reason_code)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_deauth_param param;
+
+	ENTER();
+
+	param.reason_code = reason_code;
+	memcpy_ext(pmpriv->adapter, param.mac_addr, sta_addr,
+		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_STA_DEAUTH,
+			       HostCmd_ACT_GEN_SET, 0, MNULL, (t_void *)&param);
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief This function prepares command of report mic_err
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -3449,7 +3566,7 @@
 		(HostCmd_DS_REPORT_MIC *)&cmd->params.report_mic;
 
 	ENTER();
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_APCMD_REPORT_MIC);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_REPORT_MIC);
 	cmd->size = wlan_cpu_to_le16(S_DS_GEN + sizeof(HostCmd_DS_REPORT_MIC));
 	memcpy_ext(pmpriv->adapter, pcmd_report_mic->mac, pdata_buf,
 		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
@@ -3513,7 +3630,7 @@
 		PRINTM(MCMND, "Remove Key\n");
 		goto done;
 	}
-	pkey_material->action = wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);
+	pkey_material->action = wlan_cpu_to_le16(cmd_action);
 	pkey_material->key_param_set.key_idx = pkey->key_index & KEY_INDEX_MASK;
 	pkey_material->key_param_set.type =
 		wlan_cpu_to_le16(TLV_TYPE_KEY_PARAM_V2);
@@ -3593,6 +3710,59 @@
 	pkey_material->key_param_set.key_info |= KEY_INFO_DEFAULT_KEY;
 	pkey_material->key_param_set.key_info =
 		wlan_cpu_to_le16(pkey_material->key_param_set.key_info);
+	if (pkey->key_flags & KEY_FLAG_GCMP ||
+	    pkey->key_flags & KEY_FLAG_GCMP_256) {
+		if (pkey->key_flags &
+		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID)) {
+			memcpy_ext(
+				pmpriv->adapter,
+				pkey_material->key_param_set.key_params.gcmp.pn,
+				pkey->pn, SEQ_MAX_SIZE, WPA_PN_SIZE);
+		}
+		if (pkey->key_flags & KEY_FLAG_GCMP)
+			pkey_material->key_param_set.key_type =
+				KEY_TYPE_ID_GCMP;
+		else
+			pkey_material->key_param_set.key_type =
+				KEY_TYPE_ID_GCMP_256;
+		pkey_material->key_param_set.key_params.gcmp.key_len =
+			wlan_cpu_to_le16(pkey->key_len);
+		memcpy_ext(pmpriv->adapter,
+			   pkey_material->key_param_set.key_params.gcmp.key,
+			   pkey->key_material, pkey->key_len, WPA_GCMP_KEY_LEN);
+		pkey_material->key_param_set.length = wlan_cpu_to_le16(
+			KEY_PARAMS_FIXED_LEN + sizeof(gcmp_param));
+		cmd->size = wlan_cpu_to_le16(sizeof(MrvlIEtypesHeader_t) +
+					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
+					     sizeof(gcmp_param) +
+					     sizeof(pkey_material->action));
+		PRINTM(MCMND, "Set GCMP Key\n");
+		goto done;
+	}
+	if (pkey->key_flags & KEY_FLAG_CCMP_256) {
+		if (pkey->key_flags &
+		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID)) {
+			memcpy_ext(pmpriv->adapter,
+				   pkey_material->key_param_set.key_params
+					   .ccmp256.pn,
+				   pkey->pn, SEQ_MAX_SIZE, WPA_PN_SIZE);
+		}
+		pkey_material->key_param_set.key_type = KEY_TYPE_ID_CCMP_256;
+		pkey_material->key_param_set.key_params.ccmp256.key_len =
+			wlan_cpu_to_le16(pkey->key_len);
+		memcpy_ext(pmpriv->adapter,
+			   pkey_material->key_param_set.key_params.ccmp256.key,
+			   pkey->key_material, pkey->key_len,
+			   WPA_CCMP_256_KEY_LEN);
+		pkey_material->key_param_set.length = wlan_cpu_to_le16(
+			KEY_PARAMS_FIXED_LEN + sizeof(ccmp_256_param));
+		cmd->size = wlan_cpu_to_le16(sizeof(MrvlIEtypesHeader_t) +
+					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
+					     sizeof(ccmp_256_param) +
+					     sizeof(pkey_material->action));
+		PRINTM(MCMND, "Set CCMP256 Key\n");
+		goto done;
+	}
 	if (pkey->key_len == WPA_AES_KEY_LEN &&
 	    !(pkey->key_flags & KEY_FLAG_AES_MCAST_IGTK)) {
 		if (pkey->key_flags &
@@ -3657,7 +3827,7 @@
 		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID))
 			memcpy_ext(pmpriv->adapter,
 				   pkey_material->key_param_set.key_params
-					   .cmac_aes.ipn,
+					   .gmac_aes.ipn,
 				   pkey->pn, SEQ_MAX_SIZE, IGTK_PN_SIZE);
 		pkey_material->key_param_set.key_info &=
 			~(wlan_cpu_to_le16(KEY_INFO_MCAST_KEY));
@@ -3665,10 +3835,10 @@
 			wlan_cpu_to_le16(KEY_INFO_AES_MCAST_IGTK);
 		pkey_material->key_param_set.key_type =
 			KEY_TYPE_ID_BIP_GMAC_256;
-		pkey_material->key_param_set.key_params.cmac_aes.key_len =
+		pkey_material->key_param_set.key_params.gmac_aes.key_len =
 			wlan_cpu_to_le16(pkey->key_len);
 		memcpy_ext(pmpriv->adapter,
-			   pkey_material->key_param_set.key_params.cmac_aes.key,
+			   pkey_material->key_param_set.key_params.gmac_aes.key,
 			   pkey->key_material, pkey->key_len,
 			   WPA_IGTK_256_KEY_LEN);
 		pkey_material->key_param_set.length = wlan_cpu_to_le16(
@@ -3852,6 +4022,10 @@
 				priv->is_11ax_enabled = MTRUE;
 			}
 		}
+		if (priv->is_11n_enabled || priv->is_11ac_enabled ||
+		    priv->is_11ax_enabled) {
+			PRINTM(MCMND, "STBC NOT supported, Will be disabled\n");
+		}
 
 		if (tlv_type == VENDOR_SPECIFIC_221) {
 			if (!memcmp(priv->adapter,
@@ -3871,6 +4045,8 @@
 				wmm_param_ie.vend_hdr.element_id = WMM_IE;
 				wlan_wmm_setup_queue_priorities(priv,
 								&wmm_param_ie);
+				wlan_wmm_contention_init(
+					priv, wmm_param_ie.ac_params);
 			}
 		}
 		if (tlv_type == TLV_TYPE_UAP_PKT_FWD_CTL) {
@@ -3893,8 +4069,9 @@
 			priv->uap_bandwidth = pchan_info->bandcfg.chanWidth;
 			priv->uap_state_chan_cb.channel = pchan_info->channel;
 			priv->uap_state_chan_cb.bandcfg = pchan_info->bandcfg;
-			PRINTM(MCMND, "uap_channel FW: 0x%x bw=%d\n",
-			       priv->uap_channel, priv->uap_bandwidth);
+			PRINTM(MCMND, "uap_channel FW: 0x%x band=%d bw=%d\n",
+			       priv->uap_channel, pchan_info->bandcfg.chanBand,
+			       priv->uap_bandwidth);
 			event->bss_index = priv->bss_index;
 			event->event_id = MLAN_EVENT_ID_DRV_UAP_CHAN_INFO;
 			event->event_len = sizeof(chan_band_info);
@@ -3903,11 +4080,10 @@
 				   (t_u8 *)&pchan_info->bandcfg, tlv_len,
 				   tlv_len);
 			if (pchan_band_info->bandcfg.chanWidth == CHAN_BW_80MHZ)
-				pchan_band_info->center_chan =
-					wlan_get_center_freq_idx(
-						priv, BAND_AAC,
-						pchan_info->channel,
-						CHANNEL_BW_80MHZ);
+				pchan_band_info
+					->center_chan = wlan_get_center_freq_idx(
+					priv, pchan_band_info->bandcfg.chanBand,
+					pchan_info->channel, CHANNEL_BW_80MHZ);
 			if (priv->adapter->ecsa_enable) {
 				int ret;
 				t_u8 bandwidth = BW_20MHZ;
@@ -3929,7 +4105,7 @@
 					bandwidth;
 
 				ret = wlan_prepare_cmd(
-					priv, HOST_CMD_APCMD_SYS_CONFIGURE,
+					priv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
 					HostCmd_ACT_GEN_SET, 0, MNULL,
 					&chan_bw_oper);
 				if (ret != MLAN_STATUS_SUCCESS &&
@@ -4152,7 +4328,7 @@
 
 	ENTER();
 
-	cmd->command = wlan_cpu_to_le16(HOST_CMD_APCMD_OPER_CTRL);
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_OPER_CTRL);
 	cmd->size =
 		wlan_cpu_to_le16(sizeof(HostCmd_DS_UAP_OPER_CTRL) + S_DS_GEN);
 	poper_ctl->action = wlan_cpu_to_le16(cmd_action);
@@ -4307,6 +4483,8 @@
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
+	/* Save station aid for multi-ap */
+	sta_ptr->aid = bss->param.sta_info.aid;
 	memcpy_ext(pmadapter, new_sta->peer_mac, bss->param.sta_info.peer_mac,
 		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	if (cmd_action != HostCmd_ACT_ADD_STA)
@@ -4324,7 +4502,7 @@
 	tlv_buf = bss->param.sta_info.tlv;
 	tlv = (MrvlIEtypesHeader_t *)tlv_buf;
 	if (bss->param.sta_info.sta_flags & STA_FLAG_WME) {
-		PRINTM(MCMND, "STA flags supports wmm \n");
+		PRINTM(MCMND, "ADD_STA flags supports wmm \n");
 		sta_ptr->is_wmm_enabled = MTRUE;
 	}
 	// append sta_flag_flags.
@@ -4346,11 +4524,11 @@
 				(MrvlIEtypes_RatesParamSet_t *)tlv);
 			break;
 		case QOS_INFO:
-			PRINTM(MCMND, "STA supports wmm\n");
+			PRINTM(MCMND, "ADD_STA supports wmm\n");
 			sta_ptr->is_wmm_enabled = MTRUE;
 			break;
 		case HT_CAPABILITY:
-			PRINTM(MCMND, "STA supports 11n\n");
+			PRINTM(MCMND, "ADD_STA supports 11n\n");
 			sta_ptr->is_11n_enabled = MTRUE;
 			phtcap = (MrvlIETypes_HTCap_t *)tlv;
 			if (sta_ptr->HTcap.ieee_hdr.element_id ==
@@ -4369,7 +4547,7 @@
 				sta_ptr->max_amsdu = MLAN_TX_DATA_BUF_SIZE_4K;
 			break;
 		case VHT_CAPABILITY:
-			PRINTM(MCMND, "STA supports 11ac\n");
+			PRINTM(MCMND, "ADD_STA supports 11ac\n");
 			sta_ptr->is_11ac_enabled = MTRUE;
 			pvhtcap = (MrvlIETypes_VHTCap_t *)tlv;
 			if (GET_VHTCAP_MAXMPDULEN(
@@ -4387,7 +4565,7 @@
 			pext_tlv = (MrvlIEtypes_Extension_t *)tlv;
 			if (pext_tlv->ext_id == HE_CAPABILITY) {
 				sta_ptr->is_11ax_enabled = MTRUE;
-				PRINTM(MCMND, "STA supports 11ax\n");
+				PRINTM(MCMND, "ADD_STA supports 11ax\n");
 			} else {
 				pext_tlv = MNULL;
 			}
@@ -4411,19 +4589,45 @@
 		if (pext_tlv == MNULL) {
 			tlv = (MrvlIEtypesHeader_t *)pos;
 			tlv->type = wlan_cpu_to_le16(EXTENSION);
-			tlv->len = wlan_cpu_to_le16(
-				MIN(sta_ptr->he_cap.ieee_hdr.len,
-				    sizeof(IEEEtypes_HECap_t) -
-					    sizeof(IEEEtypes_Header_t)));
+			tlv->len = MIN(sta_ptr->he_cap.ieee_hdr.len,
+				       sizeof(IEEEtypes_HECap_t) -
+					       sizeof(IEEEtypes_Header_t));
 
 			pos += sizeof(MrvlIEtypesHeader_t);
 			memcpy_ext(pmadapter, pos,
 				   (t_u8 *)&sta_ptr->he_cap.ext_id, tlv->len,
 				   tlv->len);
+			pos += tlv->len;
 			travel_len += sizeof(MrvlIEtypesHeader_t) + tlv->len;
+			tlv->len = wlan_cpu_to_le16(tlv->len);
 		}
 	}
 
+	if (sta_ptr->is_multi_ap) {
+		tlv = (MrvlIEtypesHeader_t *)pos;
+		tlv->type = wlan_cpu_to_le16(VENDOR_SPECIFIC_221);
+		tlv->len = sta_ptr->multi_ap_ie.ieee_hdr.len;
+
+		pos += sizeof(MrvlIEtypesHeader_t);
+		memcpy_ext(pmadapter, pos, (t_u8 *)&sta_ptr->multi_ap_ie.data,
+			   tlv->len, tlv->len);
+		pos += tlv->len;
+		travel_len += sizeof(MrvlIEtypesHeader_t) + tlv->len;
+		tlv->len = wlan_cpu_to_le16(tlv->len);
+	}
+
+	if (sta_ptr->vendor_oui_count) {
+		tlv = (MrvlIEtypesHeader_t *)pos;
+		tlv->type = wlan_cpu_to_le16(VENDOR_IE_OUIS_TLV_ID);
+		tlv->len = sta_ptr->vendor_oui_count * VENDOR_OUI_LEN;
+		pos += sizeof(MrvlIEtypesHeader_t);
+		memcpy_ext(pmadapter, pos, (t_u8 *)&sta_ptr->vendor_oui,
+			   tlv->len, tlv->len);
+		pos += tlv->len;
+		travel_len += sizeof(MrvlIEtypesHeader_t) + tlv->len;
+		tlv->len = wlan_cpu_to_le16(tlv->len);
+	}
+
 	if (sta_ptr->is_11n_enabled) {
 		if (pmpriv->uap_channel <= 14)
 			sta_ptr->bandmode = BAND_GN;
@@ -4465,6 +4669,37 @@
 }
 
 /**
+ *  @brief clean up station's ralist and rx_reordering table.
+ *
+ *  @param pmpriv       A pointer to pmlan_private structure
+ *  @param sta_addr     A pointer to station mac address
+ *
+ *  @return             MLAN_STATUS_PENDING --success, otherwise fail
+ */
+static void wlan_clean_up_station(pmlan_private pmpriv, t_u8 *sta_addr)
+{
+	if (pmpriv->is_11n_enabled || pmpriv->is_11ax_enabled) {
+		wlan_cleanup_reorder_tbl(pmpriv, sta_addr);
+		wlan_11n_cleanup_txbastream_tbl(pmpriv, sta_addr);
+	}
+	wlan_wmm_delete_peer_ralist(pmpriv, sta_addr);
+	return;
+}
+
+static mlan_status wlan_ret_add_station(pmlan_private pmpriv,
+					HostCmd_DS_COMMAND *resp,
+					mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_ADD_STATION *add_sta = &resp->params.sta_info;
+
+	wlan_clean_up_station(pmpriv, add_sta->peer_mac);
+	return MLAN_STATUS_SUCCESS;
+}
+
+extern Stats_mcast_drv_t gmcast_stats;
+extern t_u8 mcast_drv_update_allow_flag;
+#define OP_RESET 3
+/**
  *  @brief This function prepares command of per peer stats
  *
  *  @param pmpriv        A pointer to mlan_private structure
@@ -4483,11 +4718,11 @@
 
 	ENTER();
 	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_STATS);
-	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_STATS) + S_DS_GEN);
+
 	if (cmd_action) {
 		cmd->size =
 			wlan_cpu_to_le16(sizeof(HostCmd_DS_STATS) + S_DS_GEN +
-					 sizeof(Stats_Cfg_Params_TLV_t) - 1);
+					 sizeof(Stats_Cfg_Params_TLV_t));
 		stats_cmd->action = wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);
 
 		stats_param = (Stats_Cfg_Params_TLV_t *)stats->tlv_buf;
@@ -4495,7 +4730,22 @@
 		    NXP_802_11_PER_PEER_STATS_CFG_TLV_ID) {
 			cfg_param =
 				(Stats_Cfg_Params_TLV_t *)stats_cmd->tlv_buffer;
-			*cfg_param = *stats_param;
+			cfg_param->tlvHeader.type =
+				wlan_cpu_to_le16(stats_param->tlvHeader.type);
+			cfg_param->tlvHeader.len = wlan_cpu_to_le16(
+				sizeof(Stats_Cfg_Params_TLV_t) -
+				sizeof(MrvlIEtypesHeader_t));
+			cfg_param->op = stats_param->op;
+			memcpy_ext(pmpriv->adapter, cfg_param->mac,
+				   stats_param->mac, MLAN_MAC_ADDR_LENGTH,
+				   MLAN_MAC_ADDR_LENGTH);
+		}
+		/* To identify the reset operation */
+		if (stats_param->op == OP_RESET) {
+			mcast_drv_update_allow_flag = MFALSE;
+			memset(pmpriv->adapter, &gmcast_stats, 0,
+			       sizeof(Stats_mcast_drv_t));
+			mcast_drv_update_allow_flag = MTRUE;
 		}
 	} else {
 		cmd->size =
@@ -4521,6 +4771,7 @@
 {
 	HostCmd_DS_STATS *cfg_cmd = (HostCmd_DS_STATS *)&resp->params.stats;
 	mlan_ds_misc_cfg *misc_cfg = MNULL;
+	Stats_Cfg_Params_TLV_t *stats_param = MNULL;
 	t_u8 *pBuf = (t_u8 *)&cfg_cmd->tlv_buffer;
 	int len = resp->size;
 
@@ -4532,7 +4783,30 @@
 			   (t_u8 *)&misc_cfg->param.stats.tlv_buf, pBuf, len,
 			   len);
 		misc_cfg->param.stats.tlv_len = len;
-		pioctl_buf->buf_len = sizeof(mlan_ds_stats) + len - 1;
+		pioctl_buf->buf_len = sizeof(mlan_ds_stats) + len;
+
+		stats_param =
+			(Stats_Cfg_Params_TLV_t *)misc_cfg->param.stats.tlv_buf;
+		if (stats_param && (stats_param->tlvHeader.type ==
+				    NXP_802_11_PER_PEER_STATS_ENTRY_TLV_ID)) {
+			/* add the mcast drv stats */
+			mcast_drv_update_allow_flag = MFALSE;
+			/* Adding the Mcast drv stats to stats tlv_buf */
+			memcpy_ext(pmpriv->adapter,
+				   (t_u8 *)(((t_u8 *)&misc_cfg->param.stats
+						     .tlv_buf) +
+					    len),
+				   (t_u8 *)&gmcast_stats,
+				   sizeof(Stats_mcast_drv_t),
+				   sizeof(Stats_mcast_drv_t));
+			mcast_drv_update_allow_flag = MTRUE;
+			/* Updating the tlv_len */
+			misc_cfg->param.stats.tlv_len =
+				len + sizeof(Stats_mcast_drv_t);
+
+			pioctl_buf->buf_len = sizeof(mlan_ds_stats) + len +
+					      sizeof(Stats_mcast_drv_t);
+		}
 	}
 
 	LEAVE();
@@ -4569,23 +4843,19 @@
 
 	/* Prepare command */
 	switch (cmd_no) {
-	case HostCMD_APCMD_ACS_SCAN:
+	case HostCmd_CMD_APCMD_ACS_SCAN:
 	case HostCmd_CMD_SOFT_RESET:
-	case HOST_CMD_APCMD_BSS_STOP:
-	case HOST_CMD_APCMD_SYS_INFO:
-	case HOST_CMD_APCMD_SYS_RESET:
-	case HOST_CMD_APCMD_STA_LIST:
+	case HostCmd_CMD_APCMD_BSS_STOP:
+	case HostCmd_CMD_APCMD_SYS_INFO:
+	case HostCmd_CMD_APCMD_SYS_RESET:
+	case HostCmd_CMD_APCMD_STA_LIST:
 		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
 		cmd_ptr->size = wlan_cpu_to_le16(S_DS_GEN);
 		break;
-	case HOST_CMD_APCMD_BSS_START:
+	case HostCmd_CMD_APCMD_BSS_START:
 		ret = wlan_uap_cmd_bss_start(pmpriv, cmd_ptr);
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		if (IsAuthenticatorEnabled(pmpriv->psapriv))
-			AuthenticatorBssConfig(pmpriv->psapriv, MNULL, 1, 0, 0);
-#endif
 		break;
-	case HOST_CMD_APCMD_SYS_CONFIGURE:
+	case HostCmd_CMD_APCMD_SYS_CONFIGURE:
 		ret = wlan_uap_cmd_sys_configure(pmpriv, cmd_ptr, cmd_action,
 						 (pmlan_ioctl_req)pioctl_buf,
 						 pdata_buf);
@@ -4604,8 +4874,7 @@
 		if (pmpriv->adapter->hw_status == WlanHardwareStatusReset)
 			pmpriv->adapter->hw_status =
 				WlanHardwareStatusInitializing;
-		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
-		cmd_ptr->size = wlan_cpu_to_le16(S_DS_GEN);
+		ret = wlan_cmd_func_init(pmpriv, cmd_ptr);
 		break;
 	case HostCmd_CMD_FUNC_SHUTDOWN:
 		pmpriv->adapter->hw_status = WlanHardwareStatusReset;
@@ -4635,10 +4904,10 @@
 	case HostCmd_CMD_CHAN_REPORT_REQUEST:
 		ret = wlan_11h_cmd_process(pmpriv, cmd_ptr, pdata_buf);
 		break;
-	case HOST_CMD_APCMD_STA_DEAUTH:
+	case HostCmd_CMD_APCMD_STA_DEAUTH:
 		ret = wlan_uap_cmd_sta_deauth(pmpriv, cmd_ptr, pdata_buf);
 		break;
-	case HOST_CMD_APCMD_REPORT_MIC:
+	case HostCmd_CMD_APCMD_REPORT_MIC:
 		ret = wlan_uap_cmd_report_mic(pmpriv, cmd_ptr, pdata_buf);
 		break;
 	case HostCmd_CMD_802_11_KEY_MATERIAL:
@@ -4660,6 +4929,10 @@
 	case HostCmd_CMD_HS_WAKEUP_REASON:
 		ret = wlan_cmd_hs_wakeup_reason(pmpriv, cmd_ptr, pdata_buf);
 		break;
+	case HostCmd_CMD_802_11_FW_WAKE_METHOD:
+		ret = wlan_cmd_802_11_fw_wakeup_method(
+			pmpriv, cmd_ptr, cmd_action, (t_u16 *)pdata_buf);
+		break;
 	case HostCmd_CMD_802_11_ROBUSTCOEX:
 		ret = wlan_cmd_robustcoex(pmpriv, cmd_ptr, cmd_action,
 					  (t_u16 *)pdata_buf);
@@ -4709,6 +4982,14 @@
 		ret = MLAN_STATUS_SUCCESS;
 		break;
 #endif
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_cmd_802_11_ftm_config_session_params(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_cmd_802_11_ftm_config_responder(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
 	case HostCmd_CMD_VERSION_EXT:
 		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
 		cmd_ptr->params.verext.version_str_sel =
@@ -4722,7 +5003,7 @@
 		cmd_ptr->params.rx_mgmt_ind.action =
 			wlan_cpu_to_le16(cmd_action);
 		cmd_ptr->params.rx_mgmt_ind.mgmt_subtype_mask =
-			(t_u32)(*((t_u32 *)pdata_buf));
+			wlan_cpu_to_le32((t_u32)(*((t_u32 *)pdata_buf)));
 		cmd_ptr->size = wlan_cpu_to_le16(
 			sizeof(HostCmd_DS_RX_MGMT_IND) + S_DS_GEN);
 		break;
@@ -4751,16 +5032,16 @@
 						 pdata_buf);
 		break;
 #ifdef WIFI_DIRECT_SUPPORT
-	case HOST_CMD_WIFI_DIRECT_MODE_CONFIG:
+	case HostCmd_CMD_WIFI_DIRECT_MODE_CONFIG:
 		ret = wlan_cmd_wifi_direct_mode(pmpriv, cmd_ptr, cmd_action,
 						pdata_buf);
 		break;
-	case HOST_CMD_P2P_PARAMS_CONFIG:
+	case HostCmd_CMD_P2P_PARAMS_CONFIG:
 		ret = wlan_cmd_p2p_params_config(pmpriv, cmd_ptr, cmd_action,
 						 pdata_buf);
 		break;
 #endif
-	case HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
+	case HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
 		ret = wlan_cmd_gpio_tsf_latch(pmpriv, cmd_ptr, cmd_action,
 					      pioctl_buf, pdata_buf);
 		break;
@@ -4806,7 +5087,7 @@
 	case HostCmd_CMD_DRCS_CONFIG:
 		ret = wlan_cmd_drcs_cfg(pmpriv, cmd_ptr, cmd_action, pdata_buf);
 		break;
-	case HOST_CMD_APCMD_OPER_CTRL:
+	case HostCmd_CMD_APCMD_OPER_CTRL:
 		ret = wlan_uap_cmd_oper_ctrl(pmpriv, cmd_ptr, cmd_action,
 					     pdata_buf);
 		break;
@@ -4829,6 +5110,13 @@
 			sizeof(HostCmd_DS_CHAN_REGION_CFG) + S_DS_GEN);
 		cmd_ptr->params.reg_cfg.action = wlan_cpu_to_le16(cmd_action);
 		break;
+	case HostCmd_CMD_REGION_POWER_CFG:
+		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
+		cmd_ptr->size = wlan_cpu_to_le16(
+			sizeof(HostCmd_DS_REGION_POWER_CFG) + S_DS_GEN);
+		cmd_ptr->params.rg_power_cfg.action =
+			wlan_cpu_to_le16(cmd_action);
+		break;
 	case HostCmd_CMD_802_11_NET_MONITOR:
 		ret = wlan_cmd_net_monitor(pmpriv, cmd_ptr, cmd_action,
 					   pdata_buf);
@@ -4845,7 +5133,13 @@
 		break;
 #endif
 #endif
-	case HOST_CMD_TX_RX_PKT_STATS:
+#if defined(PCIE)
+	case HostCmd_CMD_PCIE_ADMA_INIT:
+		ret = wlan_cmd_pcie_adma_init(pmpriv, cmd_ptr, cmd_action,
+					      pdata_buf);
+		break;
+#endif
+	case HostCmd_CMD_TX_RX_PKT_STATS:
 		ret = wlan_cmd_tx_rx_pkt_stats(pmpriv, cmd_ptr,
 					       (pmlan_ioctl_req)pioctl_buf,
 					       pdata_buf);
@@ -4866,11 +5160,6 @@
 		ret = wlan_cmd_boot_sleep(pmpriv, cmd_ptr, cmd_action,
 					  pdata_buf);
 		break;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR)
-	case HostCmd_CMD_CRYPTO:
-		ret = wlan_cmd_crypto(pmpriv, cmd_ptr, cmd_action, pdata_buf);
-		break;
-#endif
 	case HostCmd_CMD_11AX_CFG:
 		ret = wlan_cmd_11ax_cfg(pmpriv, cmd_ptr, cmd_action, pdata_buf);
 		break;
@@ -4881,14 +5170,29 @@
 		ret = wlan_cmd_range_ext(pmpriv, cmd_ptr, cmd_action,
 					 pdata_buf);
 		break;
+	case HostCmd_CMD_TWT_CFG:
+		ret = wlan_cmd_twt_cfg(pmpriv, cmd_ptr, cmd_action, pdata_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG:
 		ret = wlan_cmd_rxabortcfg(pmpriv, cmd_ptr, cmd_action,
 					  pdata_buf);
 		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_cmd_ofdmdesense_cfg(pmpriv, cmd_ptr, cmd_action,
+					       pdata_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_cmd_rxabortcfg_ext(pmpriv, cmd_ptr, cmd_action,
 					      pdata_buf);
 		break;
+	case HostCmd_CMD_NAV_MITIGATION_CFG:
+		ret = wlan_cmd_nav_mitigation(pmpriv, cmd_ptr, cmd_action,
+					      pdata_buf);
+		break;
+	case HostCmd_CMD_802_11_LED_CONTROL:
+		ret = wlan_cmd_led_config(pmpriv, cmd_ptr, cmd_action,
+					  pdata_buf);
+		break;
 	case HostCmd_CMD_TX_AMPDU_PROT_MODE:
 		ret = wlan_cmd_tx_ampdu_prot_mode(pmpriv, cmd_ptr, cmd_action,
 						  pdata_buf);
@@ -4905,7 +5209,7 @@
 		ret = wlan_cmd_cck_desense_cfg(pmpriv, cmd_ptr, cmd_action,
 					       pdata_buf);
 		break;
-	case HostCmd_CHANNEL_TRPC_CONFIG:
+	case HostCmd_CMD_CHANNEL_TRPC_CONFIG:
 		ret = wlan_cmd_get_chan_trpc_config(pmpriv, cmd_ptr, cmd_action,
 						    pdata_buf);
 		break;
@@ -4936,9 +5240,43 @@
 		ret = wlan_cmd_get_ch_load(pmpriv, cmd_ptr, cmd_action,
 					   pdata_buf);
 		break;
-	case HostCmd_DS_GET_SENSOR_TEMP:
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_cmd_cross_chip_synch(pmpriv, cmd_ptr, cmd_action,
+						pdata_buf);
+		break;
+	case HostCmd_CMD_TSP_CFG:
+		ret = wlan_cmd_tsp_config(pmpriv, cmd_ptr, cmd_action,
+					  pdata_buf);
+		break;
+	case HostCmd_CMD_DS_GET_SENSOR_TEMP:
 		wlan_cmd_get_sensor_temp(pmpriv, cmd_ptr, cmd_action);
 		break;
+#ifdef STA_SUPPORT
+	case HostCmd_CMD_802_11_SCAN_EXT:
+		ret = wlan_cmd_802_11_scan_ext(pmpriv, cmd_ptr, pdata_buf);
+		break;
+#endif
+	case HostCmd_CMD_802_11_TX_FRAME:
+		ret = wlan_cmd_tx_frame(pmpriv, cmd_ptr, cmd_action, pdata_buf);
+		break;
+	case HostCmd_CMD_EDMAC_CFG:
+		ret = wlan_cmd_edmac_cfg(pmpriv, cmd_ptr, cmd_action,
+					 pdata_buf);
+		break;
+	case HostCmd_CMD_CSI:
+		ret = wlan_cmd_csi(pmpriv, cmd_ptr, cmd_action, pdata_buf);
+		break;
+
+	case HostCmd_CMD_PEER_TX_RATE_QUERY:
+		ret = wlan_cmd_sta_tx_rate_req(pmpriv, cmd_ptr, cmd_action,
+					       pdata_buf);
+		break;
+
+	case HostCmd_CMD_MCLIENT_SCHEDULE_CFG:
+		ret = wlan_cmd_mclient_scheduling_cfg(pmpriv, cmd_ptr,
+						      cmd_action, pdata_buf);
+		break;
+
 	default:
 		PRINTM(MERROR, "PREP_CMD: unknown command- %#x\n", cmd_no);
 		if (pioctl_req)
@@ -4985,7 +5323,7 @@
 
 	/* Command successful, handle response */
 	switch (cmdresp_no) {
-	case HOST_CMD_APCMD_BSS_STOP:
+	case HostCmd_CMD_APCMD_BSS_STOP:
 		pmpriv->uap_bss_started = MFALSE;
 		/* Timestamp update is required because bss_start after skip_cac
 		 * enabled should not select non-current channel just because
@@ -4998,7 +5336,6 @@
 				pmpriv->adapter->pmoal_handle, &sec, &usec);
 			pstate_dfs->dfs_report_time_sec = sec;
 		}
-		wlan_reset_all_chan_dfs_state(priv, BAND_A, DFS_USABLE);
 		if (pmpriv->intf_state_11h.is_11h_host)
 			pmpriv->intf_state_11h.tx_disabled = MFALSE;
 		else {
@@ -5011,15 +5348,9 @@
 		if (pmpriv->adapter->state_rdh.stage == RDH_STOP_INTFS)
 			wlan_11h_radar_detected_callback((t_void *)pmpriv);
 		wlan_coex_ampdu_rxwinsize(pmadapter);
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		if (IsAuthenticatorEnabled(pmpriv->psapriv)) {
-			AuthenticatorBssConfig(pmpriv->psapriv, MNULL, 0, 1, 0);
-			AuthenticatorkeyClear(pmpriv->psapriv);
-		}
-#endif
 		pmpriv->uap_host_based = 0;
 		break;
-	case HOST_CMD_APCMD_BSS_START:
+	case HostCmd_CMD_APCMD_BSS_START:
 		if (!pmpriv->intf_state_11h.is_11h_host &&
 		    pmpriv->adapter->state_rdh.stage == RDH_RESTART_INTFS)
 			wlan_11h_radar_detected_callback((t_void *)pmpriv);
@@ -5033,19 +5364,20 @@
 		pmpriv->msdu_in_rx_amsdu_cnt = 0;
 		pmpriv->msdu_in_tx_amsdu_cnt = 0;
 		break;
-	case HOST_CMD_APCMD_SYS_RESET:
+	case HostCmd_CMD_APCMD_SYS_RESET:
 		pmpriv->uap_bss_started = MFALSE;
 		pmpriv->uap_host_based = 0;
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		AuthenitcatorInitBssConfig(pmpriv->psapriv);
-#endif
 		ret = wlan_uap_ret_sys_reset(pmpriv, resp, pioctl_buf);
+		if (!(wlan_is_etsi_country(pmpriv->adapter,
+					   pmpriv->adapter->country_code)))
+			wlan_11h_reset_dfs_checking_chan_dfs_state(priv,
+								   DFS_USABLE);
 		wlan_11h_check_update_radar_det_state(pmpriv);
 		wlan_coex_ampdu_rxwinsize(pmadapter);
 		break;
-	case HOST_CMD_APCMD_SYS_INFO:
+	case HostCmd_CMD_APCMD_SYS_INFO:
 		break;
-	case HOST_CMD_APCMD_SYS_CONFIGURE:
+	case HostCmd_CMD_APCMD_SYS_CONFIGURE:
 		ret = wlan_uap_ret_sys_config(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_802_11_PS_MODE_ENH:
@@ -5070,13 +5402,13 @@
 	case HostCmd_CMD_CHAN_REPORT_REQUEST:
 		ret = wlan_11h_cmdresp_process(pmpriv, resp);
 		break;
-	case HOST_CMD_APCMD_STA_DEAUTH:
+	case HostCmd_CMD_APCMD_STA_DEAUTH:
 		break;
-	case HOST_CMD_APCMD_REPORT_MIC:
+	case HostCmd_CMD_APCMD_REPORT_MIC:
 		break;
 	case HostCmd_CMD_802_11_KEY_MATERIAL:
 		break;
-	case HOST_CMD_APCMD_STA_LIST:
+	case HostCmd_CMD_APCMD_STA_LIST:
 		ret = wlan_uap_ret_sta_list(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_GET_HW_SPEC:
@@ -5099,6 +5431,9 @@
 	case HostCmd_CMD_HS_WAKEUP_REASON:
 		ret = wlan_ret_hs_wakeup_reason(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_802_11_FW_WAKE_METHOD:
+		ret = wlan_ret_fw_wakeup_method(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_802_11_ROBUSTCOEX:
 		break;
 	case HostCmd_CMD_DMCS_CONFIG:
@@ -5173,6 +5508,14 @@
 	case HostCmd_CMD_TX_BF_CFG:
 		ret = wlan_ret_tx_bf_cfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_ret_802_11_ftm_config_session_params(pmpriv, resp,
+								pioctl_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_ret_802_11_ftm_config_responder(pmpriv, resp,
+							   pioctl_buf);
+		break;
 	case HostCmd_CMD_VERSION_EXT:
 		ret = wlan_ret_ver_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -5195,14 +5538,14 @@
 		ret = wlan_ret_remain_on_channel(pmpriv, resp, pioctl_buf);
 		break;
 #ifdef WIFI_DIRECT_SUPPORT
-	case HOST_CMD_WIFI_DIRECT_MODE_CONFIG:
+	case HostCmd_CMD_WIFI_DIRECT_MODE_CONFIG:
 		ret = wlan_ret_wifi_direct_mode(pmpriv, resp, pioctl_buf);
 		break;
-	case HOST_CMD_P2P_PARAMS_CONFIG:
+	case HostCmd_CMD_P2P_PARAMS_CONFIG:
 		ret = wlan_ret_p2p_params_config(pmpriv, resp, pioctl_buf);
 		break;
 #endif
-	case HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
+	case HostCmd_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
 		ret = wlan_ret_gpio_tsf_latch(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_802_11_RF_ANTENNA:
@@ -5242,10 +5585,10 @@
 	case HostCmd_CMD_DRCS_CONFIG:
 		ret = wlan_ret_drcs_cfg(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCMD_APCMD_ACS_SCAN:
+	case HostCmd_CMD_APCMD_ACS_SCAN:
 		ret = wlan_ret_cmd_uap_acs_scan(pmpriv, resp, pioctl_buf);
 		break;
-	case HOST_CMD_APCMD_OPER_CTRL:
+	case HostCmd_CMD_APCMD_OPER_CTRL:
 		ret = wlan_uap_ret_oper_ctrl(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_INDEPENDENT_RESET_CFG:
@@ -5260,6 +5603,8 @@
 	case HostCmd_CMD_CHAN_REGION_CFG:
 		ret = wlan_ret_chan_region_cfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_REGION_POWER_CFG:
+		break;
 	case HostCmd_CMD_PACKET_AGGR_CTRL:
 		ret = wlan_ret_packet_aggr_ctrl(pmpriv, resp, pioctl_buf);
 		break;
@@ -5270,7 +5615,13 @@
 		break;
 #endif
 #endif
-	case HOST_CMD_TX_RX_PKT_STATS:
+#if defined(PCIE)
+	case HostCmd_CMD_PCIE_ADMA_INIT:
+		PRINTM(MINFO, "PCIE ADMA init successful.\n");
+		wlan_pcie_init_fw(pmpriv->adapter);
+		break;
+#endif
+	case HostCmd_CMD_TX_RX_PKT_STATS:
 		ret = wlan_ret_tx_rx_pkt_stats(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_802_11_LINK_STATS:
@@ -5280,12 +5631,8 @@
 		ret = wlan_ret_boot_sleep(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_ADD_NEW_STATION:
+		ret = wlan_ret_add_station(pmpriv, resp, pioctl_buf);
 		break;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR)
-	case HostCmd_CMD_CRYPTO:
-		ret = wlan_ret_crypto(pmpriv, resp, pioctl_buf);
-		break;
-#endif
 	case HostCmd_CMD_11AX_CFG:
 		ret = wlan_ret_11ax_cfg(pmpriv, resp, pioctl_buf);
 		break;
@@ -5295,9 +5642,21 @@
 	case HostCmd_CMD_RANGE_EXT:
 		ret = wlan_ret_range_ext(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_TWT_CFG:
+		ret = wlan_ret_twt_report(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG:
 		ret = wlan_ret_rxabortcfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_NAV_MITIGATION_CFG:
+		ret = wlan_ret_nav_mitigation(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_802_11_LED_CONTROL:
+		ret = wlan_ret_led_config(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_ret_ofdmdesense_cfg(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_ret_rxabortcfg_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -5317,7 +5676,7 @@
 	case HostCmd_CMD_CCK_DESENSE_CFG:
 		ret = wlan_ret_cck_desense_cfg(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCmd_CHANNEL_TRPC_CONFIG:
+	case HostCmd_CMD_CHANNEL_TRPC_CONFIG:
 		ret = wlan_ret_get_chan_trpc_config(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_LOW_POWER_MODE_CFG:
@@ -5341,9 +5700,43 @@
 	case HostCmd_CMD_GET_CH_LOAD:
 		ret = wlan_ret_ch_load(pmpriv, resp, pioctl_buf);
 		break;
-	case HostCmd_DS_GET_SENSOR_TEMP:
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_ret_cross_chip_synch(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_TSP_CFG:
+		ret = wlan_ret_tsp_config(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_DS_GET_SENSOR_TEMP:
 		ret = wlan_ret_get_sensor_temp(pmpriv, resp, pioctl_buf);
 		break;
+#ifdef STA_SUPPORT
+	case HostCmd_CMD_802_11_SCAN_EXT:
+		ret = wlan_ret_802_11_scan_ext(pmpriv, resp, pioctl_buf);
+		pioctl_buf = MNULL;
+		pmadapter->curr_cmd->pioctl_buf = MNULL;
+		break;
+#endif
+	case HostCmd_CMD_802_11_TX_FRAME:
+		break;
+	case HostCmd_CMD_EDMAC_CFG:
+		break;
+	case HostCmd_CMD_CSI:
+		if (resp->params.csi_params.action == CSI_CMD_ENABLE) {
+			pmadapter->csi_enabled = 1;
+			PRINTM(MCMND, "CSI ENABLE cmdresp\n");
+		} else {
+			pmadapter->csi_enabled = 0;
+			PRINTM(MCMND, "CSI DISABLE cmdresp\n");
+		}
+		break;
+
+	case HostCmd_CMD_PEER_TX_RATE_QUERY:
+		ret = wlan_ret_sta_tx_rate(pmpriv, resp, pioctl_buf);
+		break;
+
+	case HostCmd_CMD_MCLIENT_SCHEDULE_CFG:
+		break;
+
 	default:
 		PRINTM(MERROR, "CMD_RESP: Unknown command response %#x\n",
 		       resp->command);
@@ -5373,6 +5766,7 @@
 	t_u8 *event_buf = MNULL;
 	mlan_event *pevent = MNULL;
 	t_u8 sta_addr[MLAN_MAC_ADDR_LENGTH];
+	t_u16 reason_code = 0;
 	sta_node *sta_ptr = MNULL;
 	t_u8 i = 0;
 	t_u8 channel = 0;
@@ -5380,17 +5774,21 @@
 	MrvlIEtypes_channel_band_t *pchan_info = MNULL;
 	chan_band_info *pchan_band_info = MNULL;
 	event_exceed_max_p2p_conn *event_excd_p2p = MNULL;
+	Event_WLS_FTM_t *event_ftm = MNULL;
 	t_u16 enable;
 
 	ENTER();
 
 	if (!pmbuf) {
+		PRINTM(MERROR, "ERR:event buffer is null\n");
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
 	/* Event length check */
 	if (pmbuf && (pmbuf->data_len - sizeof(eventcause)) > MAX_EVENT_SIZE) {
 		pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
+		PRINTM(MERROR, "ERR:event buffer len invalid=%d\n",
+		       pmbuf->data_len);
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
@@ -5424,13 +5822,6 @@
 		pevent->event_id = MLAN_EVENT_ID_UAP_FW_BSS_START;
 		wlan_check_uap_capability(pmpriv, pmbuf);
 		wlan_coex_ampdu_rxwinsize(pmadapter);
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		if (IsAuthenticatorEnabled(pmpriv->psapriv)) {
-			pmadapter->authenticator_priv = pmpriv;
-			wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_DEFER_RX_WORK,
-					MNULL);
-		}
-#endif
 		if (wlan_11h_radar_detect_required(pmpriv, pmpriv->uap_channel))
 			wlan_11h_update_dfs_master_state_by_uap(pmpriv);
 		break;
@@ -5449,6 +5840,8 @@
 		wlan_delete_station_list(pmpriv);
 		pmpriv->port_open = MFALSE;
 		pmpriv->amsdu_disable = MFALSE;
+		pmpriv->rxpd_rate_info = 0;
+		pmpriv->rxpd_rate = 0;
 		pmpriv->tx_pause = MFALSE;
 		break;
 	case EVENT_MICRO_AP_MIC_COUNTERMEASURES:
@@ -5457,8 +5850,10 @@
 		break;
 	case EVENT_PS_AWAKE:
 		PRINTM(MINFO, "EVENT: AWAKE\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "||");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "||");
+		else
+			PRINTM(MEVENT, "|");
 		/* Handle unexpected PS AWAKE event */
 		if (pmadapter->ps_state == PS_STATE_SLEEP_CFM)
 			break;
@@ -5469,8 +5864,10 @@
 		break;
 	case EVENT_PS_SLEEP:
 		PRINTM(MINFO, "EVENT: SLEEP\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "__");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "__");
+		else
+			PRINTM(MEVENT, "_");
 		/* Handle unexpected PS SLEEP event */
 		if (pmadapter->ps_state == PS_STATE_SLEEP_CFM)
 			break;
@@ -5488,11 +5885,7 @@
 		if (!sta_ptr)
 			break;
 		wlan_check_sta_capability(pmpriv, pmbuf, sta_ptr);
-		if (pmpriv->is_11n_enabled || pmpriv->is_11ax_enabled
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		    || IsAuthenticatorEnabled(pmpriv->psapriv)
-#endif
-		) {
+		if (pmpriv->is_11n_enabled || pmpriv->is_11ax_enabled) {
 			for (i = 0; i < MAX_NUM_TID; i++) {
 				if (sta_ptr->is_11n_enabled ||
 				    sta_ptr->is_11ax_enabled)
@@ -5508,12 +5901,6 @@
 		}
 		if (pmpriv->sec_info.wapi_enabled)
 			wlan_update_wapi_info_tlv(pmpriv, pmbuf);
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-		/**enter authenticator*/
-		if (IsAuthenticatorEnabled(pmpriv->psapriv))
-			AuthenticatorSendEapolPacket(
-				pmpriv->psapriv, sta_ptr->cm_connectioninfo);
-#endif
 		pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
 		break;
 	case EVENT_MICRO_AP_STA_DEAUTH:
@@ -5527,10 +5914,19 @@
 		wlan_recv_event(pmpriv, pevent->event_id, pevent);
 		memcpy_ext(pmadapter, sta_addr, pmadapter->event_body + 2,
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		reason_code = *(t_u16 *)pmadapter->event_body;
 		sta_ptr = wlan_get_station_entry(pmpriv, sta_addr);
+
 		PRINTM_NETINTF(MMSG, pmpriv);
-		PRINTM(MMSG, "wlan: EVENT: MICRO_AP_STA_DEAUTH " MACSTR "\n",
-		       MAC2STR(sta_addr));
+		PRINTM(MMSG,
+		       "wlan: EVENT: MICRO_AP_STA_DEAUTH reason=0x%x " MACSTR
+		       "\n",
+		       reason_code, MAC2STR(sta_addr));
+		if (pmpriv->uap_host_based & UAP_FLAG_HOST_MLME && sta_ptr) {
+			if (!(reason_code & MBIT(14)))
+				wlan_send_deauth_cmd(pmpriv, sta_addr,
+						     reason_code);
+		}
 		if (pmpriv->is_11n_enabled || pmpriv->is_11ax_enabled) {
 			wlan_cleanup_reorder_tbl(pmpriv, sta_addr);
 			wlan_11n_cleanup_txbastream_tbl(pmpriv, sta_addr);
@@ -5546,18 +5942,17 @@
 		break;
 	case EVENT_ADDBA:
 		PRINTM(MEVENT, "EVENT: ADDBA Request\n");
-		if (pmpriv->media_connected == MTRUE)
-			ret = wlan_prepare_cmd(pmpriv,
-					       HostCmd_CMD_11N_ADDBA_RSP,
-					       HostCmd_ACT_GEN_SET, 0, MNULL,
-					       pmadapter->event_body);
+		if (pmpriv->media_connected == MTRUE &&
+		    !pmpriv->adapter->remain_on_channel)
+			wlan_11n_add_bastream(pmpriv, pmadapter->event_body);
 		else
 			PRINTM(MERROR,
 			       "Ignore ADDBA Request event in BSS idle state\n");
 		break;
 	case EVENT_DELBA:
 		PRINTM(MEVENT, "EVENT: DELBA Request\n");
-		if (pmpriv->media_connected == MTRUE)
+		if (pmpriv->media_connected == MTRUE &&
+		    !pmpriv->adapter->remain_on_channel)
 			wlan_11n_delete_bastream(pmpriv, pmadapter->event_body);
 		else
 			PRINTM(MERROR,
@@ -5565,7 +5960,8 @@
 		break;
 	case EVENT_BA_STREAM_TIMEOUT:
 		PRINTM(MEVENT, "EVENT:  BA Stream timeout\n");
-		if (pmpriv->media_connected == MTRUE)
+		if (pmpriv->media_connected == MTRUE &&
+		    !pmpriv->adapter->remain_on_channel)
 			wlan_11n_ba_stream_timeout(
 				pmpriv, (HostCmd_DS_11N_BATIMEOUT *)
 						pmadapter->event_body);
@@ -5607,10 +6003,11 @@
 		if (pmpriv->adapter->dfs_test_params.cac_restart &&
 		    pmpriv->adapter->state_dfs.dfs_check_pending) {
 			wlan_11h_cancel_radar_detect(pmpriv);
-			wlan_11h_issue_radar_detect(
-				pmpriv, MNULL,
-				pmpriv->adapter->dfs_test_params.chan,
-				pmpriv->adapter->dfs_test_params.bandcfg);
+			if (wlan_11h_issue_radar_detect(
+				    pmpriv, MNULL,
+				    pmpriv->adapter->dfs_test_params.chan,
+				    pmpriv->adapter->dfs_test_params.bandcfg))
+				PRINTM(MINFO, "RADAR detect returned FALSE\n");
 			pevent->event_id = 0;
 			break;
 		}
@@ -5625,7 +6022,6 @@
 		wlan_recv_event(pmpriv, pevent->event_id, pevent);
 		pevent->event_id = 0; /* clear to avoid resending at end of fcn
 				       */
-
 		/* Print event data */
 		pevent->event_id = MLAN_EVENT_ID_FW_RADAR_DETECTED;
 		pevent->event_len = pmbuf->data_len - sizeof(eventcause);
@@ -5638,11 +6034,14 @@
 		*((t_u8 *)pevent->event_buf) = channel;
 		*((t_u8 *)pevent->event_buf + 1) = bandwidth;
 		if (pmpriv->bss_type == MLAN_BSS_TYPE_DFS) {
-			wlan_recv_event(priv, MLAN_EVENT_ID_FW_RADAR_DETECTED,
-					pevent);
-			pevent->event_id = 0; /* clear to avoid
-						 resending at end of fcn
-					       */
+			if (!pmpriv->adapter->dfs_test_params
+				     .no_channel_change_on_radar) {
+				wlan_recv_event(priv,
+						MLAN_EVENT_ID_FW_RADAR_DETECTED,
+						pevent);
+			}
+			pevent->event_id = 0; /* clear to avoid resending at end
+						 of fcn */
 			break;
 		}
 		if (!pmpriv->intf_state_11h.is_11h_host) {
@@ -5740,6 +6139,12 @@
 		pmpriv->uap_state_chan_cb.bandcfg = pchan_info->bandcfg;
 		if (wlan_11h_radar_detect_required(pmpriv, pchan_info->channel))
 			wlan_11h_update_dfs_master_state_by_uap(pmpriv);
+		else {
+			PRINTM(MCMND,
+			       "Disable DFS master operation after channel switch\n");
+			wlan_11h_config_master_radar_det(pmpriv, MFALSE);
+			wlan_11h_check_update_radar_det_state(pmpriv);
+		}
 		if ((pmpriv->adapter->state_rdh.stage != RDH_OFF &&
 		     !pmpriv->intf_state_11h.is_11h_host) ||
 		    pmpriv->adapter->dfs_test_params.no_channel_change_on_radar ||
@@ -5774,7 +6179,8 @@
 			if (pchan_band_info->bandcfg.chanWidth == CHAN_BW_80MHZ)
 				pchan_band_info->center_chan =
 					wlan_get_center_freq_idx(
-						priv, BAND_AAC,
+						priv,
+						pchan_info->bandcfg.chanBand,
 						pchan_info->channel,
 						CHANNEL_BW_80MHZ);
 			pchan_band_info->is_11n_enabled =
@@ -5789,6 +6195,7 @@
 		PRINTM_NETINTF(MEVENT, pmpriv);
 		PRINTM(MEVENT, "EVENT: REMAIN_ON_CHANNEL_EXPIRED reason=%d\n",
 		       *(t_u16 *)pmadapter->event_body);
+		pmpriv->adapter->remain_on_channel = MFALSE;
 		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_FLUSH_RX_WORK, MNULL);
 		pevent->event_id = MLAN_EVENT_ID_FW_REMAIN_ON_CHAN_EXPIRED;
 		break;
@@ -5812,10 +6219,22 @@
 		pevent->event_id = 0; /* clear to avoid resending at end of fcn
 				       */
 		break;
+
+	case EVENT_CHAN_SWITCH_TO_6G_BLOCK:
+		reason_code = wlan_le16_to_cpu(*(t_u16 *)(pmbuf->pbuf +
+							  pmbuf->data_offset +
+							  sizeof(eventcause)));
+		print_chan_switch_block_event(reason_code);
+		break;
+
 	case EVENT_TX_STATUS_REPORT:
 		PRINTM(MINFO, "EVENT: TX_STATUS\n");
 		pevent->event_id = MLAN_EVENT_ID_FW_TX_STATUS;
 		break;
+	case EVENT_TX_STATUS_BULK_REPORT:
+		PRINTM(MINFO, "EVENT: TX_BULK_STATUS\n");
+		pevent->event_id = MLAN_EVENT_ID_FW_TX_BULK_STATUS;
+		break;
 	case EVENT_BT_COEX_WLAN_PARA_CHANGE:
 		PRINTM(MEVENT, "EVENT: BT coex wlan param update\n");
 		wlan_bt_coex_wlan_param_update_event(pmpriv, pmbuf);
@@ -5837,6 +6256,22 @@
 		wlan_process_csi_event(pmpriv);
 		break;
 
+	case EVENT_WLS_FTM_COMPLETE:
+		PRINTM(MEVENT, "EVENT: FTM_GENERIC_EVENT\n");
+		pevent = (pmlan_event)event_buf;
+		pevent->bss_index = pmpriv->bss_index;
+		event_ftm =
+			(Event_WLS_FTM_t *)(pmbuf->pbuf + pmbuf->data_offset);
+		if (event_ftm->sub_event_id == WLS_SUB_EVENT_RTT_RESULTS) {
+			wlan_fill_hal_rtt_results(pmpriv, event_ftm,
+						  pmbuf->data_len, pevent);
+			wlan_recv_event(pmpriv, pevent->event_id, pevent);
+			pevent->event_id = 0; /* clear to avoid resending at end
+						 of fcn */
+			goto done;
+		} else
+			pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
+		break;
 	case EVENT_FW_HANG_REPORT:
 		if (pmbuf->data_len < (sizeof(eventcause) + sizeof(t_u16))) {
 			PRINTM(MEVENT,
@@ -5863,7 +6298,7 @@
 				   sizeof(eventcause),
 			   sizeof(t_u16), sizeof(t_u16));
 		break;
-	case CHAN_LOAD_EVENT: {
+	case EVENT_CHAN_LOAD: {
 		t_u8 *ptr = MNULL;
 		HostCmd_DS_GET_CH_LOAD *cfg_cmd = MNULL;
 		ptr = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
@@ -5878,6 +6313,25 @@
 		PRINTM(MINFO, "EVENT: Dump FW info\n");
 		pevent->event_id = MLAN_EVENT_ID_FW_DUMP_INFO;
 		break;
+#ifdef STA_SUPPORT
+	case EVENT_EXT_SCAN_REPORT:
+		PRINTM(MEVENT, "EVENT: EXT_SCAN Report (%d)\n",
+		       pmbuf->data_len);
+		if (pmadapter->pscan_ioctl_req && pmadapter->ext_scan)
+			ret = wlan_handle_event_ext_scan_report(priv, pmbuf);
+		break;
+	case EVENT_EXT_SCAN_STATUS_REPORT:
+		PRINTM(MEVENT, "EVENT: EXT_SCAN status report (%d)\n",
+		       pmbuf->data_len);
+		pmadapter->ext_scan_timeout = MFALSE;
+		ret = wlan_handle_event_ext_scan_status(priv, pmbuf);
+		break;
+#endif
+
+	case EVENT_PEER_PS_MODE_CHANGE:
+		wlan_process_sta_ps_change_event(priv, pmbuf);
+		break;
+
 	default:
 		pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
 		break;
@@ -5918,7 +6372,7 @@
 		wlan_cpu_to_le16(TLV_TYPE_UAP_MAX_STA_CNT_PER_CHIP);
 	tlv_uap_max_sta.header.len = wlan_cpu_to_le16(sizeof(t_u16));
 	tlv_uap_max_sta.uap_max_sta = wlan_cpu_to_le16(uap_max_sta);
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
 			       HostCmd_ACT_GEN_SET, 0, MNULL, &tlv_uap_max_sta);
 	LEAVE();
 	return ret;
@@ -5956,13 +6410,13 @@
 		wlan_uap_set_uap_max_sta(
 			pmpriv, pmpriv->adapter->init_para.uap_max_sta);
 
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
 			       HostCmd_ACT_GEN_GET, 0, MNULL, MNULL);
 	if (ret) {
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-	last_cmd = HOST_CMD_APCMD_SYS_CONFIGURE;
+	last_cmd = HostCmd_CMD_APCMD_SYS_CONFIGURE;
 	/** set last_init_cmd */
 	if (last_cmd) {
 		pmpriv->adapter->last_init_cmd = last_cmd;
diff --git a/wlan_sd8987/mlan/mlan_uap_ioctl.c b/wlan_src/mlan/mlan_uap_ioctl.c
old mode 100755
new mode 100644
similarity index 92%
rename from wlan_sd8987/mlan/mlan_uap_ioctl.c
rename to wlan_src/mlan/mlan_uap_ioctl.c
index 439dc01..5cb8137
--- a/wlan_sd8987/mlan/mlan_uap_ioctl.c
+++ b/wlan_src/mlan/mlan_uap_ioctl.c
@@ -3,20 +3,29 @@
  *  @brief This file contains the handling of AP mode ioctls
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -62,7 +71,7 @@
 
 	ENTER();
 
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_BSS_STOP,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_BSS_STOP,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       MNULL);
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -253,7 +262,7 @@
 
 prep_bss_start:
 	/* else okay to send command:  not DFS channel or no radar */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_BSS_START,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_BSS_START,
 			       HostCmd_ACT_GEN_SET, 0,
 			       (t_void *)puap_state_chan_cb->pioctl_req_curr,
 			       MNULL);
@@ -304,7 +313,7 @@
 		if (ret == MLAN_STATUS_SUCCESS)
 			ret = MLAN_STATUS_PENDING;
 	} else {
-		ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_BSS_START,
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_BSS_START,
 				       HostCmd_ACT_GEN_SET, 0,
 				       (t_void *)pioctl_req, MNULL);
 		if (ret == MLAN_STATUS_SUCCESS)
@@ -337,7 +346,10 @@
 	 */
 	for (i = 0; i < pmadapter->max_mgmt_ie_index; i++)
 		memset(pmadapter, &pmpriv->mgmt_ie[i], 0, sizeof(custom_ie));
-	pmpriv->add_ba_param.timeout = MLAN_DEFAULT_BLOCK_ACK_TIMEOUT;
+
+	pmpriv->add_ba_param.timeout = pmadapter->tx_ba_timeout_support ?
+					       MLAN_DEFAULT_BLOCK_ACK_TIMEOUT :
+					       0;
 	pmpriv->add_ba_param.tx_win_size = MLAN_UAP_AMPDU_DEF_TXWINSIZE;
 	pmpriv->add_ba_param.rx_win_size = MLAN_UAP_AMPDU_DEF_RXWINSIZE;
 	pmpriv->user_rxwinsize = pmpriv->add_ba_param.rx_win_size;
@@ -355,7 +367,7 @@
 	pmpriv->addba_reject[6] = pmpriv->addba_reject[7] =
 		ADDBA_RSP_STATUS_REJECT;
 
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_RESET,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_RESET,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       MNULL);
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -418,8 +430,8 @@
 	} else
 		cmd_action = HostCmd_ACT_GEN_GET;
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
+			       cmd_action, 0, (t_void *)pioctl_req, MNULL);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -450,8 +462,8 @@
 	else
 		cmd_action = HostCmd_ACT_GEN_GET;
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
+			       cmd_action, 0, (t_void *)pioctl_req, MNULL);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -481,8 +493,8 @@
 	cmd_action = HostCmd_ACT_GEN_SET;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
+			       cmd_action, 0, (t_void *)pioctl_req, MNULL);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -514,8 +526,8 @@
 	else
 		cmd_action = HostCmd_ACT_GEN_GET;
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
+			       cmd_action, 0, (t_void *)pioctl_req, MNULL);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -546,8 +558,8 @@
 	else
 		cmd_action = HostCmd_ACT_GEN_GET;
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
+			       cmd_action, 0, (t_void *)pioctl_req, MNULL);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -580,7 +592,7 @@
 		else
 			cmd_action = HostCmd_ACT_GEN_GET;
 		/* Send request to firmware */
-		ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_OPER_CTRL,
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_OPER_CTRL,
 				       cmd_action, 0, (t_void *)pioctl_req,
 				       (t_void *)pioctl_req->pbuf);
 
@@ -690,8 +702,8 @@
 		cmd_action = HostCmd_ACT_GEN_GET;
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE, cmd_action,
-			       0, (t_void *)pioctl_req, MNULL);
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
+			       cmd_action, 0, (t_void *)pioctl_req, MNULL);
 
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
@@ -718,7 +730,14 @@
 	ENTER();
 
 	bss = (mlan_ds_bss *)pioctl_req->pbuf;
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_STA_DEAUTH,
+
+	/*
+	 * Clean up station's ralist, to stop and flush pending traffic
+	 * before uAP sending deauth command to FW.
+	 */
+	wlan_wmm_delete_peer_ralist(pmpriv, bss->param.deauth_param.mac_addr);
+
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_STA_DEAUTH,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       (t_void *)&bss->param.deauth_param);
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -745,7 +764,7 @@
 	ENTER();
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_STA_LIST,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_STA_LIST,
 			       HostCmd_ACT_GEN_GET, 0, (t_void *)pioctl_req,
 			       MNULL);
 
@@ -908,7 +927,7 @@
 	}
 
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(priv, HOST_CMD_APCMD_SYS_CONFIGURE,
+	ret = wlan_prepare_cmd(priv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       MNULL);
 
@@ -1013,7 +1032,7 @@
 	ENTER();
 
 	sec = (mlan_ds_sec_cfg *)pioctl_req->pbuf;
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_REPORT_MIC,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_REPORT_MIC,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       (t_void *)sec->param.sta_mac);
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -1042,7 +1061,8 @@
 
 	ENTER();
 	sec = (mlan_ds_sec_cfg *)pioctl_req->pbuf;
-	if (pioctl_req->action != MLAN_ACT_SET) {
+	if ((pioctl_req->action != MLAN_ACT_SET) &&
+	    (pioctl_req->action != MLAN_ACT_PASN_KEY_DNLD)) {
 		pioctl_req->status_code = MLAN_ERROR_IOCTL_INVALID;
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
@@ -1055,7 +1075,7 @@
 	}
 
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_KEY_MATERIAL,
-			       HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
+			       pioctl_req->action, KEY_INFO_ENABLED,
 			       (t_void *)pioctl_req, &sec->param.encrypt_key);
 
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -1735,7 +1755,7 @@
 		return MLAN_STATUS_FAILURE;
 	}
 	/* Send request to firmware */
-	ret = wlan_prepare_cmd(pmpriv, HostCMD_APCMD_ACS_SCAN,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_ACS_SCAN,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       MNULL);
 
@@ -1768,7 +1788,7 @@
 	tlv_chan_band.header.len = sizeof(MrvlIEtypes_channel_band_t) -
 				   sizeof(MrvlIEtypesHeader_t);
 
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
 			       HostCmd_ACT_GEN_GET, 0, MNULL, &tlv_chan_band);
 	LEAVE();
 	return ret;
@@ -1797,7 +1817,7 @@
 	tlv_chan_band.bandcfg = uap_band_cfg;
 	tlv_chan_band.channel = channel;
 
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
 			       HostCmd_ACT_GEN_SET, 0, MNULL, &tlv_chan_band);
 	LEAVE();
 	return ret;
@@ -1833,7 +1853,7 @@
 	ptlv_dtim_pd->header.len =
 		sizeof(MrvlIEtypes_dtim_period_t) - sizeof(MrvlIEtypesHeader_t);
 
-	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_SYS_CONFIGURE,
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_SYS_CONFIGURE,
 			       HostCmd_ACT_GEN_GET, 0, MNULL, tlv_buffer);
 	LEAVE();
 	return ret;
@@ -1971,9 +1991,6 @@
 	mlan_ds_rate *rate = MNULL;
 	mlan_ds_reg_mem *reg_mem = MNULL;
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
-	pmlan_ds_scan pscan;
-#endif
 
 	ENTER();
 	switch (pioctl_req->req_id) {
@@ -2038,25 +2055,9 @@
 			status = wlan_uap_bss_ioctl_action_chan_switch(
 				pmadapter, pioctl_req);
 		break;
-#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
+#ifdef STA_SUPPORT
 	case MLAN_IOCTL_SCAN:
-		pscan = (mlan_ds_scan *)pioctl_req->pbuf;
-		if ((pscan->sub_command == MLAN_OID_SCAN_NORMAL) &&
-		    (pioctl_req->action == MLAN_ACT_GET)) {
-			PRINTM(MIOCTL, "Get scan table in uap\n");
-			pscan->param.scan_resp.pscan_table =
-				(t_u8 *)pmadapter->pscan_table;
-			pscan->param.scan_resp.num_in_scan_table =
-				pmadapter->num_in_scan_table;
-			pscan->param.scan_resp.age_in_secs =
-				pmadapter->age_in_secs;
-			pioctl_req->data_read_written =
-				sizeof(mlan_scan_resp) + MLAN_SUB_COMMAND_SIZE;
-			pscan->param.scan_resp.pchan_stats =
-				(t_u8 *)pmadapter->pchan_stats;
-			pscan->param.scan_resp.num_in_chan_stats =
-				pmadapter->num_in_chan_stats;
-		}
+		status = wlan_scan_ioctl(pmadapter, pioctl_req);
 		break;
 #endif
 	case MLAN_IOCTL_GET_INFO:
@@ -2095,6 +2096,8 @@
 				pmadapter->getlog_enable;
 			pget_info->param.fw_info.hw_dev_mcs_support =
 				pmadapter->hw_dev_mcs_support;
+			pget_info->param.fw_info.hw_mpdu_density =
+				pmadapter->hw_mpdu_density;
 			pget_info->param.fw_info.hw_dot_11n_dev_cap =
 				pmadapter->hw_dot_11n_dev_cap;
 			pget_info->param.fw_info.usr_dev_mcs_support =
@@ -2136,6 +2139,9 @@
 				pget_info->param.fw_info.force_reg = MTRUE;
 			else
 				pget_info->param.fw_info.force_reg = MFALSE;
+			/**country code from OTP */
+			pget_info->param.fw_info.fw_country_code =
+				pmadapter->fw_country_code;
 			pget_info->param.fw_info.fw_supplicant_support =
 				IS_FW_SUPPORT_SUPPLICANT(pmadapter) ? 0x01 :
 								      0x00;
@@ -2144,6 +2150,13 @@
 				pmadapter->max_sta_conn;
 			pget_info->param.fw_info.uuid_lo = pmadapter->uuid_lo;
 			pget_info->param.fw_info.uuid_hi = pmadapter->uuid_hi;
+			pget_info->param.fw_info.cmd_tx_data =
+				IS_FW_SUPPORT_CMD_TX_DATA(pmadapter) ? 0x01 :
+								       0x00;
+			pget_info->param.fw_info.sec_rgpower =
+				IS_FW_SUPPORT_SEC_RG_POWER(pmadapter) ? 0x01 :
+									0x00;
+
 		} else if (pget_info->sub_command == MLAN_OID_LINK_STATS)
 			status = wlan_ioctl_link_statistic(pmpriv, pioctl_req);
 		break;
@@ -2242,6 +2255,14 @@
 								 pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_GET_TSF)
 			status = wlan_misc_ioctl_get_tsf(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_CROSS_CHIP_SYNCH) {
+			status = wlan_misc_ioctl_cross_chip_synch(pmadapter,
+								  pioctl_req);
+		}
+		if (misc->sub_command == MLAN_OID_MISC_TSP_CFG) {
+			status = wlan_misc_ioctl_tsp_config(pmadapter,
+							    pioctl_req);
+		}
 		if (misc->sub_command == MLAN_OID_MISC_GET_CHAN_REGION_CFG)
 			status = wlan_misc_chan_reg_cfg(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_OPER_CLASS_CHECK)
@@ -2264,9 +2285,17 @@
 		if (misc->sub_command == MLAN_OID_MISC_RX_ABORT_CFG)
 			status = wlan_misc_ioctl_rxabortcfg(pmadapter,
 							    pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_OFDM_DESENSE_CFG)
+			status = wlan_misc_ioctl_ofdmdesense_cfg(pmadapter,
+								 pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_RX_ABORT_CFG_EXT)
 			status = wlan_misc_ioctl_rxabortcfg_ext(pmadapter,
 								pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_NAV_MITIGATION)
+			status = wlan_misc_ioctl_nav_mitigation(pmadapter,
+								pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_LED_CONFIG)
+			status = wlan_misc_ioctl_led(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_TX_AMPDU_PROT_MODE)
 			status = wlan_misc_ioctl_tx_ampdu_prot_mode(pmadapter,
 								    pioctl_req);
@@ -2285,6 +2314,12 @@
 			status = wlan_misc_robustcoex(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_DMCS_CONFIG)
 			status = wlan_misc_dmcs_config(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_CONFIG_RTT)
+			status = wlan_config_rtt(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_CANCEL_RTT)
+			status = wlan_cancel_rtt(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_RTT_RESPONDER_CFG)
+			status = wlan_rtt_responder_cfg(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_GET_TX_RX_HISTOGRAM)
 			status =
 				wlan_get_tx_rx_histogram(pmadapter, pioctl_req);
@@ -2304,6 +2339,9 @@
 							    pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_GET_REGIONPWR_CFG)
 			status = wlan_get_rgchnpwr_cfg(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_REGION_POWER_CFG)
+			status = wlan_misc_region_power_cfg(pmadapter,
+							    pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_CFP_TABLE)
 			status = wlan_get_cfp_table(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_RANGE_EXT)
@@ -2315,6 +2353,21 @@
 		if (misc->sub_command == MLAN_OID_MISC_COUNTRY_CODE)
 			status = wlan_misc_ioctl_country_code(pmadapter,
 							      pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_REORDER_FLUSH_TIME)
+			status = wlan_misc_ioctl_reorder_flush_time(pmadapter,
+								    pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_EXT_CAP_CFG)
+			status = wlan_misc_ext_capa_cfg(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_TX_FRAME)
+			status =
+				wlan_misc_ioctl_tx_frame(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_EDMAC_CONFIG)
+			status = wlan_misc_ioctl_edmac_cfg(pmadapter,
+							   pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_CSI)
+			status = wlan_misc_csi(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_MULTI_AP_CFG)
+			status = wlan_misc_multi_ap_cfg(pmadapter, pioctl_req);
 		break;
 	case MLAN_IOCTL_POWER_CFG:
 		power = (mlan_ds_power_cfg *)pioctl_req->pbuf;
@@ -2338,6 +2391,8 @@
 			status = wlan_config_mgmt_filter(pmadapter, pioctl_req);
 		if (pm->sub_command == MLAN_OID_PM_INFO)
 			status = wlan_get_pm_info(pmadapter, pioctl_req);
+		if (pm->sub_command == MLAN_OID_PM_CFG_FW_WAKEUP_METHOD)
+			status = wlan_fw_wakeup_method(pmadapter, pioctl_req);
 		break;
 	case MLAN_IOCTL_SNMP_MIB:
 		snmp = (mlan_ds_snmp_mib *)pioctl_req->pbuf;
diff --git a/wlan_sd8987/mlan/mlan_uap_txrx.c b/wlan_src/mlan/mlan_uap_txrx.c
old mode 100755
new mode 100644
similarity index 77%
rename from wlan_sd8987/mlan/mlan_uap_txrx.c
rename to wlan_src/mlan/mlan_uap_txrx.c
index 1fe11f7..4be5c47
--- a/wlan_sd8987/mlan/mlan_uap_txrx.c
+++ b/wlan_src/mlan/mlan_uap_txrx.c
@@ -3,20 +3,29 @@
  *  @brief This file contains AP mode transmit and receive functions
  *
  *
- *  Copyright 2009-2021 NXP
+ *  Copyright 2009-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -36,9 +45,6 @@
 #include "mlan_wmm.h"
 #include "mlan_11n_aggr.h"
 #include "mlan_11n_rxreorder.h"
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-#include "authenticator_api.h"
-#endif
 
 /********************************************************
 			Local Functions
@@ -65,7 +71,13 @@
 	prx_pd = (RxPD *)(pmbuf->pbuf + pmbuf->data_offset);
 
 	/* Chop off RxPD */
-	pmbuf->data_len -= prx_pd->rx_pkt_offset;
+	if (pmbuf->data_len > prx_pd->rx_pkt_offset) {
+		pmbuf->data_len -= prx_pd->rx_pkt_offset;
+	} else {
+		PRINTM(MERROR,
+		       "pmbuf->data_len is smaller than prx_pd->rx_pkt_offset\n");
+		pmbuf->status_code = MLAN_ERROR_PKT_INVALID;
+	}
 	pmbuf->data_offset += prx_pd->rx_pkt_offset;
 	pmbuf->pparent = MNULL;
 
@@ -89,7 +101,6 @@
 		       "uAP Rx Error: moal_recv_packet returned error\n");
 		pmbuf->status_code = MLAN_ERROR_PKT_INVALID;
 	}
-
 	if (ret != MLAN_STATUS_PENDING)
 		pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
 #ifdef USB
@@ -104,51 +115,6 @@
 	return ret;
 }
 
-/**
- *  @brief This function will check if unicast packet need be dropped
- *
- *  @param priv    A pointer to mlan_private
- *  @param mac     mac address to find in station list table
- *
- *  @return	       MLAN_STATUS_FAILURE -- drop packet, otherwise forward to
- * network stack
- */
-static mlan_status wlan_check_unicast_packet(mlan_private *priv, t_u8 *mac)
-{
-	int j;
-	sta_node *sta_ptr = MNULL;
-	pmlan_adapter pmadapter = priv->adapter;
-	pmlan_private pmpriv = MNULL;
-	t_u8 pkt_type = 0;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	ENTER();
-	for (j = 0; j < MLAN_MAX_BSS_NUM; ++j) {
-		pmpriv = pmadapter->priv[j];
-		if (pmpriv) {
-			if (GET_BSS_ROLE(pmpriv) == MLAN_BSS_ROLE_STA)
-				continue;
-			sta_ptr = wlan_get_station_entry(pmpriv, mac);
-			if (sta_ptr) {
-				if (pmpriv == priv)
-					pkt_type = PKT_INTRA_UCAST;
-				else
-					pkt_type = PKT_INTER_UCAST;
-				break;
-			}
-		}
-	}
-	if ((pkt_type == PKT_INTRA_UCAST) &&
-	    (priv->pkt_fwd & PKT_FWD_INTRA_UCAST)) {
-		PRINTM(MDATA, "Drop INTRA_UCAST packet\n");
-		ret = MLAN_STATUS_FAILURE;
-	} else if ((pkt_type == PKT_INTER_UCAST) &&
-		   (priv->pkt_fwd & PKT_FWD_INTER_UCAST)) {
-		PRINTM(MDATA, "Drop INTER_UCAST packet\n");
-		ret = MLAN_STATUS_FAILURE;
-	}
-	LEAVE();
-	return ret;
-}
 /********************************************************
 			Global Functions
 ********************************************************/
@@ -168,6 +134,7 @@
 	t_u32 pkt_type;
 	t_u32 tx_control;
 	t_u8 dst_mac[MLAN_MAC_ADDR_LENGTH];
+	tx_ctrl *ctrl;
 
 	ENTER();
 
@@ -187,12 +154,13 @@
 		pmbuf->data_offset += sizeof(pkt_type) + sizeof(tx_control);
 		pmbuf->data_len -= sizeof(pkt_type) + sizeof(tx_control);
 	}
-	if (pmbuf->data_offset <
-	    (sizeof(TxPD) + pmpriv->intf_hr_len + DMA_ALIGNMENT)) {
+	if (pmbuf->data_offset < (Tx_PD_SIZEOF(pmpriv->adapter) +
+				  pmpriv->intf_hr_len + DMA_ALIGNMENT)) {
 		PRINTM(MERROR,
 		       "not enough space for TxPD: headroom=%d pkt_len=%d, required=%d\n",
 		       pmbuf->data_offset, pmbuf->data_len,
-		       sizeof(TxPD) + pmpriv->intf_hr_len + DMA_ALIGNMENT);
+		       Tx_PD_SIZEOF(pmpriv->adapter) + pmpriv->intf_hr_len +
+			       DMA_ALIGNMENT);
 		DBG_HEXDUMP(MDAT_D, "drop pkt",
 			    pmbuf->pbuf + pmbuf->data_offset, pmbuf->data_len);
 		pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
@@ -200,12 +168,13 @@
 	}
 
 	/* head_ptr should be aligned */
-	head_ptr = pmbuf->pbuf + pmbuf->data_offset - sizeof(TxPD) -
-		   pmpriv->intf_hr_len;
+	head_ptr = pmbuf->pbuf + pmbuf->data_offset -
+		   Tx_PD_SIZEOF(pmpriv->adapter) - pmpriv->intf_hr_len;
 	head_ptr = (t_u8 *)((t_ptr)head_ptr & ~((t_ptr)(DMA_ALIGNMENT - 1)));
 
 	plocal_tx_pd = (TxPD *)(head_ptr + pmpriv->intf_hr_len);
-	memset(pmpriv->adapter, plocal_tx_pd, 0, sizeof(TxPD));
+	// coverity[bad_memset:SUPPRESS]
+	memset(pmpriv->adapter, plocal_tx_pd, 0, Tx_PD_SIZEOF(pmpriv->adapter));
 
 	/* Set the BSS number to TxPD */
 	plocal_tx_pd->bss_num = GET_BSS_NUM(pmpriv);
@@ -245,6 +214,11 @@
 		plocal_tx_pd->tx_pkt_type = (t_u16)pkt_type;
 		plocal_tx_pd->tx_control = tx_control;
 	}
+	if (pmbuf->flags & MLAN_BUF_FLAG_EASYMESH) {
+		plocal_tx_pd->flags |= MRVDRV_TxPD_FLAGS_EASYMESH;
+		memcpy_ext(pmpriv->adapter, plocal_tx_pd->ra_mac, pmbuf->mac,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	}
 
 	if (pmbuf->flags & MLAN_BUF_FLAG_TX_CTRL) {
 		if (pmbuf->u.tx_info.data_rate) {
@@ -304,6 +278,11 @@
 		mc_ctrl->mc_seq = wlan_cpu_to_le16(pmbuf->u.mc_tx_info.seq_num);
 	}
 
+	if (pmbuf->flags & MLAN_BUF_FLAG_LLDE_PKT_FILTER) {
+		ctrl = (tx_ctrl *)&plocal_tx_pd->tx_control;
+		ctrl->llde_pkt_filter = MTRUE;
+	}
+
 	endian_convert_TxPD(plocal_tx_pd);
 
 	/* Adjust the data offset and length to include TxPD in pmbuf */
@@ -337,14 +316,20 @@
 	t_u8 ta[MLAN_MAC_ADDR_LENGTH];
 	t_u16 rx_pkt_type = 0;
 	sta_node *sta_ptr = MNULL;
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-	t_u8 eapol_type[2] = {0x88, 0x8e};
-#endif
 	t_u16 adj_rx_rate = 0;
 	t_u8 antenna = 0;
 
 	t_u32 last_rx_sec = 0;
 	t_u32 last_rx_usec = 0;
+	RxPD *prx_pd2;
+	EthII_Hdr_t *peth_hdr2;
+	wlan_802_11_header *pwlan_hdr;
+	IEEEtypes_FrameCtl_t *frmctl;
+	pmlan_buffer pmbuf2 = MNULL;
+	mlan_802_11_mac_addr src_addr = {0x00};
+	mlan_802_11_mac_addr dest_addr = {0x00};
+	t_u16 hdr_len;
+	t_u8 snap_eth_hdr[5] = {0xaa, 0xaa, 0x03, 0x00, 0x00};
 	t_u8 ext_rate_info = 0;
 
 	ENTER();
@@ -381,6 +366,14 @@
 	}
 
 	rx_pkt_type = prx_pd->rx_pkt_type;
+	if (prx_pd->flags & RXPD_FLAG_PKT_EASYMESH) {
+		PRINTM_NETINTF(MDAT_D, priv);
+		PRINTM(MDAT_D, "UAP Rx Easymesh pkt flags : 0x%x\n",
+		       prx_pd->flags);
+		ret = wlan_check_easymesh_pkt(priv, pmbuf, prx_pd);
+		if (ret != MLAN_STATUS_SUCCESS)
+			goto done;
+	}
 	prx_pkt = (RxPacketHdr_t *)((t_u8 *)prx_pd + prx_pd->rx_pkt_offset);
 
 	PRINTM(MINFO,
@@ -421,6 +414,111 @@
 		pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
 		goto done;
 	}
+	if (pmadapter->enable_net_mon &&
+	    (prx_pd->flags & RXPD_FLAG_UCAST_PKT)) {
+		pwlan_hdr = (wlan_802_11_header *)((t_u8 *)prx_pd +
+						   prx_pd->rx_pkt_offset);
+		frmctl = (IEEEtypes_FrameCtl_t *)pwlan_hdr;
+		if (frmctl->type == 0x02) {
+			/* This is a valid unicast destined data packet, with
+			 * 802.11 and rtap headers attached. Duplicate this
+			 * packet and process this copy as a sniffed packet,
+			 * meant for monitor iface
+			 */
+			pmbuf2 = wlan_alloc_mlan_buffer(pmadapter,
+							MLAN_RX_DATA_BUF_SIZE,
+							MLAN_RX_HEADER_LEN,
+							MOAL_ALLOC_MLAN_BUFFER);
+			if (!pmbuf2) {
+				PRINTM(MERROR,
+				       "Unable to allocate mlan_buffer for Rx");
+				PRINTM(MERROR, "sniffed packet\n");
+			} else {
+				pmbuf2->bss_index = pmbuf->bss_index;
+				pmbuf2->buf_type = pmbuf->buf_type;
+				pmbuf2->priority = pmbuf->priority;
+				pmbuf2->in_ts_sec = pmbuf->in_ts_sec;
+				pmbuf2->in_ts_usec = pmbuf->in_ts_usec;
+				pmbuf2->data_len = pmbuf->data_len;
+				memcpy(pmadapter,
+				       pmbuf2->pbuf + pmbuf2->data_offset,
+				       pmbuf->pbuf + pmbuf->data_offset,
+				       pmbuf->data_len);
+
+				prx_pd2 = (RxPD *)(pmbuf2->pbuf +
+						   pmbuf2->data_offset);
+				/* set pkt type of duplicated pkt to 802.11 */
+				prx_pd2->rx_pkt_type = PKT_TYPE_802DOT11;
+				wlan_process_uap_rx_packet(priv, pmbuf2);
+			}
+
+			/* Now, process this pkt as a normal data packet.
+			 * rx_pkt_offset points to the 802.11 hdr. Construct
+			 * 802.3 header from 802.11 hdr fields and attach it
+			 * just before the payload.
+			 */
+			memcpy(pmadapter, (t_u8 *)&dest_addr, pwlan_hdr->addr1,
+			       sizeof(pwlan_hdr->addr1));
+			memcpy(pmadapter, (t_u8 *)&src_addr, pwlan_hdr->addr2,
+			       sizeof(pwlan_hdr->addr2));
+
+			hdr_len = sizeof(wlan_802_11_header);
+
+			/* subtract mac addr field size for 3 address mac80211
+			 * header */
+			if (!(frmctl->from_ds && frmctl->to_ds))
+				hdr_len -= sizeof(mlan_802_11_mac_addr);
+
+			/* add 2 bytes of qos ctrl flags */
+			if (frmctl->sub_type & QOS_DATA)
+				hdr_len += 2;
+
+			if (prx_pd->rx_pkt_type == PKT_TYPE_AMSDU) {
+				/* no need to generate 802.3 hdr, update pkt
+				 * offset */
+				prx_pd->rx_pkt_offset += hdr_len;
+				prx_pd->rx_pkt_length -= hdr_len;
+			} else {
+				/* skip 6-byte snap and 2-byte type */
+				if (memcmp(pmadapter,
+					   (t_u8 *)pwlan_hdr + hdr_len,
+					   snap_eth_hdr,
+					   sizeof(snap_eth_hdr)) == 0)
+					hdr_len += 8;
+
+				peth_hdr2 =
+					(EthII_Hdr_t *)((t_u8 *)prx_pd +
+							prx_pd->rx_pkt_offset +
+							hdr_len -
+							sizeof(EthII_Hdr_t));
+				memcpy(pmadapter, peth_hdr2->dest_addr,
+				       (t_u8 *)&dest_addr,
+				       sizeof(peth_hdr2->dest_addr));
+				memcpy(pmadapter, peth_hdr2->src_addr,
+				       (t_u8 *)&src_addr,
+				       sizeof(peth_hdr2->src_addr));
+
+				/* Update the rx_pkt_offset to point the 802.3
+				 * hdr */
+				prx_pd->rx_pkt_offset +=
+					(hdr_len - sizeof(EthII_Hdr_t));
+				prx_pd->rx_pkt_length -=
+					(hdr_len - sizeof(EthII_Hdr_t));
+			}
+			/* update the prx_pkt pointer */
+			prx_pkt = (RxPacketHdr_t *)((t_u8 *)prx_pd +
+						    prx_pd->rx_pkt_offset);
+		} else {
+			pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
+			ret = MLAN_STATUS_FAILURE;
+			PRINTM(MERROR,
+			       "Drop invalid unicast sniffer pkt, subType=0x%x, flag=0x%x, pkt_type=%d\n",
+			       frmctl->sub_type, prx_pd->flags,
+			       prx_pd->rx_pkt_type);
+			wlan_free_mlan_buffer(pmadapter, pmbuf);
+			goto done;
+		}
+	}
 
 	if (rx_pkt_type != PKT_TYPE_BAR) {
 		priv->rxpd_rate = prx_pd->rx_rate;
@@ -437,7 +535,11 @@
 		}
 	}
 
-	sta_ptr = wlan_get_station_entry(priv, prx_pkt->eth803_hdr.src_addr);
+	if (prx_pd->flags & RXPD_FLAG_PKT_EASYMESH)
+		sta_ptr = wlan_get_station_entry(priv, prx_pd->ta_mac);
+	else
+		sta_ptr = wlan_get_station_entry(priv,
+						 prx_pkt->eth803_hdr.src_addr);
 	if (sta_ptr) {
 		sta_ptr->snr = prx_pd->snr;
 		sta_ptr->nf = prx_pd->nf;
@@ -451,29 +553,18 @@
 		}
 	}
 
-#ifdef DRV_EMBEDDED_AUTHENTICATOR
-	/**process eapol packet for uap*/
-	if (IsAuthenticatorEnabled(priv->psapriv) &&
-	    (!memcmp(pmadapter, &prx_pkt->eth803_hdr.h803_len, eapol_type,
-		     sizeof(eapol_type)))) {
-		ret = AuthenticatorProcessEapolPacket(
-			priv->psapriv, ((t_u8 *)prx_pd + prx_pd->rx_pkt_offset),
-			prx_pd->rx_pkt_length);
-		if (ret == MLAN_STATUS_SUCCESS) {
-			pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
-			goto done;
-		}
-	}
-#endif
-
 	pmbuf->priority |= prx_pd->priority;
 	if (pmadapter->enable_net_mon &&
 	    (prx_pd->rx_pkt_type == PKT_TYPE_802DOT11)) {
 		wlan_process_uap_rx_packet(priv, pmbuf);
 		goto done;
 	}
-	memcpy_ext(pmadapter, ta, prx_pkt->eth803_hdr.src_addr,
-		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	if (prx_pd->flags & RXPD_FLAG_PKT_EASYMESH)
+		memcpy_ext(pmadapter, ta, prx_pd->ta_mac, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+	else
+		memcpy_ext(pmadapter, ta, prx_pkt->eth803_hdr.src_addr,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	if ((rx_pkt_type != PKT_TYPE_BAR) && (prx_pd->priority < MAX_NUM_TID)) {
 		sta_ptr = wlan_get_station_entry(priv, ta);
 		if (sta_ptr) {
@@ -549,8 +640,8 @@
 				newbuf->in_ts_sec = pmbuf->in_ts_sec;
 				newbuf->in_ts_usec = pmbuf->in_ts_usec;
 				newbuf->data_offset =
-					(sizeof(TxPD) + priv->intf_hr_len +
-					 DMA_ALIGNMENT);
+					(Tx_PD_SIZEOF(pmadapter) +
+					 priv->intf_hr_len + DMA_ALIGNMENT);
 				util_scalar_increment(
 					pmadapter->pmoal_handle,
 					&pmadapter->pending_bridge_pkts,
@@ -597,8 +688,8 @@
 				newbuf->in_ts_sec = pmbuf->in_ts_sec;
 				newbuf->in_ts_usec = pmbuf->in_ts_usec;
 				newbuf->data_offset =
-					(sizeof(TxPD) + priv->intf_hr_len +
-					 DMA_ALIGNMENT);
+					(Tx_PD_SIZEOF(pmadapter) +
+					 priv->intf_hr_len + DMA_ALIGNMENT);
 				util_scalar_increment(
 					pmadapter->pmoal_handle,
 					&pmadapter->pending_bridge_pkts,
@@ -628,13 +719,6 @@
 					MNULL);
 			}
 			goto done;
-		} else if (MLAN_STATUS_FAILURE ==
-			   wlan_check_unicast_packet(
-				   priv, prx_pkt->eth803_hdr.dest_addr)) {
-			/* drop packet */
-			PRINTM(MDATA, "Drop AMSDU dest " MACSTR "\n",
-			       MAC2STR(prx_pkt->eth803_hdr.dest_addr));
-			goto done;
 		}
 	}
 upload:
@@ -707,8 +791,8 @@
 				newbuf->in_ts_sec = pmbuf->in_ts_sec;
 				newbuf->in_ts_usec = pmbuf->in_ts_usec;
 				newbuf->data_offset =
-					(sizeof(TxPD) + priv->intf_hr_len +
-					 DMA_ALIGNMENT);
+					(Tx_PD_SIZEOF(pmadapter) +
+					 priv->intf_hr_len + DMA_ALIGNMENT);
 				util_scalar_increment(
 					pmadapter->pmoal_handle,
 					&pmadapter->pending_bridge_pkts,
@@ -765,7 +849,8 @@
 						newbuf->in_ts_usec =
 							pmbuf->in_ts_usec;
 						newbuf->data_offset =
-							(sizeof(TxPD) +
+							(Tx_PD_SIZEOF(
+								 pmadapter) +
 							 priv->intf_hr_len +
 							 DMA_ALIGNMENT);
 						util_scalar_increment(
@@ -835,14 +920,6 @@
 			wlan_recv_event(priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
 					MNULL);
 			goto done;
-		} else if (MLAN_STATUS_FAILURE ==
-			   wlan_check_unicast_packet(
-				   priv, prx_pkt->eth803_hdr.dest_addr)) {
-			PRINTM(MDATA, "Drop Pkts: Rx dest " MACSTR "\n",
-			       MAC2STR(prx_pkt->eth803_hdr.dest_addr));
-			pmbuf->status_code = MLAN_ERROR_PKT_INVALID;
-			pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
-			goto done;
 		}
 	}
 
diff --git a/wlan_sd8987/mlan/mlan_usb.c b/wlan_src/mlan/mlan_usb.c
old mode 100755
new mode 100644
similarity index 89%
rename from wlan_sd8987/mlan/mlan_usb.c
rename to wlan_src/mlan/mlan_usb.c
index 48be972..fc406af
--- a/wlan_sd8987/mlan/mlan_usb.c
+++ b/wlan_src/mlan/mlan_usb.c
@@ -3,20 +3,29 @@
  *  @brief This file contains USB specific code
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -44,6 +53,7 @@
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 0,
 };
 #endif
 #ifdef USB8897
@@ -52,6 +62,7 @@
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 0,
 };
 #endif
 
@@ -61,15 +72,17 @@
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
 #ifdef USB8978
 static const struct _mlan_card_info mlan_card_info_usb8978 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 1,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
 };
 #endif
 
@@ -80,6 +93,7 @@
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -90,16 +104,29 @@
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
-#ifdef USBNW62X
-static const struct _mlan_card_info mlan_card_info_usbNW62X = {
+#ifdef USBIW624
+static const struct _mlan_card_info mlan_card_info_usbIW624 = {
 	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
 	.v16_fw_api = 1,
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
+};
+#endif
+
+#ifdef USBIW610
+static const struct _mlan_card_info mlan_card_info_usbIW610 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 1,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -210,6 +237,10 @@
 #if defined(USB9098)
 	t_u32 revision_id = 0;
 #endif
+	t_u32 i = 0;
+	t_u32 fw_data_param = pmadapter->init_para.fw_data_cfg;
+	fw_data_t fw_data_list[MAX_FW_DATA_BLOCK] = {0};
+	t_u32 fw_data_param_num = 0, fw_data_index = 0;
 
 	ENTER();
 
@@ -251,12 +282,22 @@
 			check_fw_status = MTRUE;
 	}
 #endif
+
+	if (fw_data_param) {
+		fw_data_param_num =
+			MIN(MAX_FW_DATA_BLOCK, bitcount(fw_data_param));
+		/** Get the custom Fw data */
+		if (MLAN_STATUS_SUCCESS !=
+		    wlan_get_custom_fw_data(pmadapter, (t_u8 *)fw_data_list))
+			goto cleanup;
+	}
+
 #if defined(USB9097)
 	if (IS_USB9097(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
-#if defined(USBNW62X)
-	if (IS_USBNW62X(pmadapter->card_type))
+#if defined(USBIW624)
+	if (IS_USBIW624(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
 
@@ -417,6 +458,30 @@
 		FWSeqNum++;
 		PRINTM(MINFO, ".\n");
 
+		if (fw_data_param) {
+			for (i = fw_data_index; i < fw_data_param_num;) {
+				firmware = fw_data_list[i].fw_data_buffer;
+				/** make TotalBytes as 0 as allocated custom Fw
+				 * data buffers are not contiguous */
+				TotalBytes = 0;
+				fw_data_index++;
+				break;
+			}
+			/** custom Fw data download complete, restore Fw */
+			if (i >= fw_data_param_num) {
+				firmware = pmfw->pfw_buf;
+				fw_data_param = 0;
+				fw_data_index = 0;
+				FWSeqNum = 0;
+				TotalBytes = 0;
+			}
+		}
+
+		/* Add FW ending check for secure download */
+		if (((DnldCmd == FW_CMD_21) && (DataLength == 0)) ||
+		    (TotalBytes >= pmfw->fw_len))
+			break;
+
 	} while ((DnldCmd != FW_HAS_LAST_BLOCK) && retries && mic_retry);
 
 cleanup:
@@ -480,10 +545,11 @@
 static inline t_u32 usb_tx_aggr_pad_len(t_u32 len,
 					usb_tx_aggr_params *pusb_tx_aggr)
 {
-	return (len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
-		       (len + (pusb_tx_aggr->aggr_ctrl.aggr_align -
-			       (len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
-		       len;
+	return (t_u32)((len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
+			       (len +
+				(pusb_tx_aggr->aggr_ctrl.aggr_align -
+				 (len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
+			       len);
 }
 
 /**
@@ -573,8 +639,9 @@
 	pmlan_buffer pmbuf_aggr = MNULL;
 	t_u8 i, use_count;
 	pmlan_buffer pmbuf_curr, pmbuf_next;
-	pmbuf_aggr = wlan_alloc_mlan_buffer(pmadapter, pusb_tx_aggr->aggr_len,
-					    0, MOAL_MALLOC_BUFFER);
+	pmbuf_aggr = wlan_alloc_mlan_buffer(
+		pmadapter, pusb_tx_aggr->aggr_len, 0,
+		MOAL_MEM_FLAG_DIRTY | MOAL_MALLOC_BUFFER);
 	if (pmbuf_aggr) {
 		pmbuf_curr = pusb_tx_aggr->pmbuf_aggr;
 		pmbuf_aggr->bss_index = pmbuf_curr->bss_index;
@@ -798,9 +865,14 @@
 		pmadapter->pcard_info = &mlan_card_info_usb9097;
 		break;
 #endif
-#ifdef USBNW62X
-	case CARD_TYPE_USBNW62X:
-		pmadapter->pcard_info = &mlan_card_info_usbNW62X;
+#ifdef USBIW624
+	case CARD_TYPE_USBIW624:
+		pmadapter->pcard_info = &mlan_card_info_usbIW624;
+		break;
+#endif
+#ifdef USBIW610
+	case CARD_TYPE_USBIW610:
+		pmadapter->pcard_info = &mlan_card_info_usbIW610;
 		break;
 #endif
 	default:
@@ -1297,7 +1369,8 @@
 		return MLAN_STATUS_FAILURE;
 	}
 	if (type == MLAN_TYPE_CMD
-#if (defined(USB9098) || defined(USB9097) || defined(USBNW62X))
+#if defined(USB9098) || defined(USB9097) || defined(USBIW624) ||               \
+	defined(USB8997) || defined(USB8978) || defined(USBIW610)
 	    || type == MLAN_TYPE_VDLL
 #endif
 	) {
@@ -1348,18 +1421,41 @@
 }
 
 /**
- *  @brief This function handle event/cmd complete
+ *  @brief This function handle event complete
  *
  *  @param pmadapter A pointer to mlan_adapter structure
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return          N/A
  */
-static mlan_status wlan_usb_cmdevt_complete(pmlan_adapter pmadapter,
-					    mlan_buffer *pmbuf,
-					    mlan_status status)
+static mlan_status wlan_usb_evt_complete(pmlan_adapter pmadapter,
+					 mlan_buffer *pmbuf, mlan_status status)
 {
 	ENTER();
 
+	wlan_request_event_lock(pmadapter);
+	if (pmadapter->event_received)
+		pmadapter->event_received = MFALSE;
+	pmadapter->event_cause = 0;
+	pmadapter->pmlan_buffer_event = MNULL;
+	wlan_release_event_lock(pmadapter);
+	pmadapter->callbacks.moal_recv_complete(pmadapter->pmoal_handle, pmbuf,
+						pmadapter->rx_cmd_ep, status);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handle cmd complete
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param pmbuf     A pointer to the mlan_buffer
+ *  @return          N/A
+ */
+static mlan_status wlan_usb_cmd_complete(pmlan_adapter pmadapter,
+					 mlan_buffer *pmbuf, mlan_status status)
+{
+	ENTER();
 	pmadapter->callbacks.moal_recv_complete(pmadapter->pmoal_handle, pmbuf,
 						pmadapter->rx_cmd_ep, status);
 
@@ -1411,9 +1507,9 @@
 	.dnld_fw = wlan_usb_dnld_fw,
 	.host_to_card = wlan_usb_host_to_card,
 	.wakeup_card = wlan_pm_usb_wakeup_card,
-	.event_complete = wlan_usb_cmdevt_complete,
+	.event_complete = wlan_usb_evt_complete,
 	.data_complete = wlan_usb_data_complete,
-	.cmdrsp_complete = wlan_usb_cmdevt_complete,
+	.cmdrsp_complete = wlan_usb_cmd_complete,
 	.handle_rx_packet = wlan_usb_handle_rx_packet,
 
 	.intf_header_len = USB_INTF_HEADER_LEN,
diff --git a/wlan_sd8987/mlan/mlan_util.h b/wlan_src/mlan/mlan_util.h
old mode 100755
new mode 100644
similarity index 72%
rename from wlan_sd8987/mlan/mlan_util.h
rename to wlan_src/mlan/mlan_util.h
index 9485f1a..2a9e456
--- a/wlan_sd8987/mlan/mlan_util.h
+++ b/wlan_src/mlan/mlan_util.h
@@ -6,18 +6,27 @@
  *
  *  Copyright 2008-2021 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -47,6 +56,11 @@
 	t_void *plock;
 } mlan_list_head, *pmlan_list_head;
 
+struct reflective_enum_element {
+	int id;
+	const char *name;
+};
+
 /** MLAN MNULL pointer */
 #define MNULL ((void *)0)
 
@@ -64,6 +78,19 @@
 }
 
 /**
+ *  @brief This function initializes a list head without locking
+ *
+ *  @param phead		List head
+ *
+ *  @return			N/A
+ */
+static INLINE t_void util_list_head_reset(pmlan_list_head phead)
+{
+	/* Both next and prev point to self */
+	phead->pprev = phead->pnext = (pmlan_linked_list)phead;
+}
+
+/**
  *  @brief This function initializes a list
  *
  *  @param phead		List head
@@ -102,6 +129,24 @@
 }
 
 /**
+ *  @brief This function peeks into a list without lock
+ *
+ *  @param phead		List head
+ *
+ *  @return			List node
+ */
+static INLINE pmlan_linked_list util_peek_list_nl(t_void *pmoal_handle,
+						  pmlan_list_head phead)
+{
+	pmlan_linked_list pnode = MNULL;
+
+	if (phead->pnext != (pmlan_linked_list)phead)
+		pnode = phead->pnext;
+
+	return pnode;
+}
+
+/**
  *  @brief This function peeks into a list
  *
  *  @param phead		List head
@@ -119,14 +164,34 @@
 
 	if (moal_spin_lock)
 		moal_spin_lock(pmoal_handle, phead->plock);
-	if (phead->pnext != (pmlan_linked_list)phead)
-		pnode = phead->pnext;
+
+	pnode = util_peek_list_nl(pmoal_handle, phead);
+
 	if (moal_spin_unlock)
 		moal_spin_unlock(pmoal_handle, phead->plock);
 	return pnode;
 }
 
 /**
+ *  @brief This function queues a node at the list tail without taking any lock
+ *
+ *  @param phead		List head
+ *  @param pnode		List node to queue
+ *
+ *  @return			N/A
+ */
+static INLINE t_void util_enqueue_list_tail_nl(t_void *pmoal_handle,
+					       pmlan_list_head phead,
+					       pmlan_linked_list pnode)
+{
+	pmlan_linked_list pold_last = phead->pprev;
+	pnode->pprev = pold_last;
+	pnode->pnext = (pmlan_linked_list)phead;
+
+	phead->pprev = pold_last->pnext = pnode;
+}
+
+/**
  *  @brief This function queues a node at the list tail
  *
  *  @param phead		List head
@@ -141,15 +206,11 @@
 	mlan_status (*moal_spin_lock)(t_void *handle, t_void *plock),
 	mlan_status (*moal_spin_unlock)(t_void *handle, t_void *plock))
 {
-	pmlan_linked_list pold_last;
-
 	if (moal_spin_lock)
 		moal_spin_lock(pmoal_handle, phead->plock);
-	pold_last = phead->pprev;
-	pnode->pprev = pold_last;
-	pnode->pnext = (pmlan_linked_list)phead;
 
-	phead->pprev = pold_last->pnext = pnode;
+	util_enqueue_list_tail_nl(pmoal_handle, phead, pnode);
+
 	if (moal_spin_unlock)
 		moal_spin_unlock(pmoal_handle, phead->plock);
 }
@@ -183,6 +244,89 @@
 }
 
 /**
+ *  @brief This function checks if the node points to itself
+ *
+ *  @param pnode		List node to check
+ *
+ *  @return			MTRUE if node points to itself only
+ */
+static INLINE t_bool util_is_node_itself(pmlan_linked_list pnode)
+{
+	return pnode->pprev == pnode && pnode->pnext == pnode;
+}
+
+/**
+ *  @brief This function checks if the node in some list
+ *
+ *  @param pnode		List node to check
+ *
+ *  @return			MTRUE if node is enqueued into some list
+ */
+static INLINE t_bool util_is_node_in_list(pmlan_linked_list pnode)
+{
+	return pnode->pprev && pnode->pnext && !util_is_node_itself(pnode);
+}
+
+/**
+ *  @brief This function checks if the pnode is valid node of list
+ *
+ *  @param phead		List`s head
+ *  @param pnode		List node to check
+ *
+ *  @return			MTRUE if node is enqueued into some list
+ */
+static INLINE t_bool util_is_list_node(pmlan_list_head phead,
+				       pmlan_linked_list pnode)
+{
+	return pnode && (pmlan_linked_list)phead != pnode;
+}
+
+/**
+ *  @brief This function removes a node from the list if the node was in the
+ * list
+ *
+ *  @param pnode		List node to remove
+ *
+ *  @return			N/A
+ */
+static INLINE t_void util_unlink_list_safe_nl(t_void *pmoal_handle,
+					      pmlan_linked_list pnode)
+{
+	if (util_is_node_in_list(pnode)) {
+		pmlan_linked_list pmy_prev;
+		pmlan_linked_list pmy_next;
+
+		pmy_prev = pnode->pprev;
+		pmy_next = pnode->pnext;
+		pmy_next->pprev = pmy_prev;
+		pmy_prev->pnext = pmy_next;
+
+		pnode->pnext = pnode->pprev = MNULL;
+	}
+}
+
+/**
+ *  @brief This function removes a node from the list
+ *
+ *  @param pnode		List node to remove
+ *
+ *  @return			N/A
+ */
+static INLINE t_void util_unlink_list_nl(t_void *pmoal_handle,
+					 pmlan_linked_list pnode)
+{
+	pmlan_linked_list pmy_prev;
+	pmlan_linked_list pmy_next;
+
+	pmy_prev = pnode->pprev;
+	pmy_next = pnode->pnext;
+	pmy_next->pprev = pmy_prev;
+	pmy_prev->pnext = pmy_next;
+
+	pnode->pnext = pnode->pprev = MNULL;
+}
+
+/**
  *  @brief This function removes a node from the list
  *
  *  @param phead		List head
@@ -197,17 +341,11 @@
 	mlan_status (*moal_spin_lock)(t_void *handle, t_void *plock),
 	mlan_status (*moal_spin_unlock)(t_void *handle, t_void *plock))
 {
-	pmlan_linked_list pmy_prev;
-	pmlan_linked_list pmy_next;
-
 	if (moal_spin_lock)
 		moal_spin_lock(pmoal_handle, phead->plock);
-	pmy_prev = pnode->pprev;
-	pmy_next = pnode->pnext;
-	pmy_next->pprev = pmy_prev;
-	pmy_prev->pnext = pmy_next;
 
-	pnode->pnext = pnode->pprev = MNULL;
+	util_unlink_list_nl(pmoal_handle, pnode);
+
 	if (moal_spin_unlock)
 		moal_spin_unlock(pmoal_handle, phead->plock);
 }
@@ -403,8 +541,10 @@
  *  @param moal_spin_lock	A pointer to spin lock handler
  *  @param moal_spin_unlock	A pointer to spin unlock handler
  *
- *  @return					Value after offset
+ *  @return			Value after offset or 0 if (scalar_value + offset)
+ * overflows
  */
+#define INT_MAX 2147483647
 static INLINE t_s32 util_scalar_offset(
 	t_void *pmoal_handle, pmlan_scalar pscalar, t_s32 offset,
 	mlan_status (*moal_spin_lock)(t_void *handle, t_void *plock),
@@ -414,7 +554,10 @@
 
 	if (moal_spin_lock)
 		moal_spin_lock(pmoal_handle, pscalar->plock);
-	newval = (pscalar->value += offset);
+	if (pscalar->value < (INT_MAX - offset))
+		newval = (pscalar->value += offset);
+	else
+		newval = 0;
 	if (moal_spin_unlock)
 		moal_spin_unlock(pmoal_handle, pscalar->plock);
 
@@ -492,4 +635,39 @@
 	return count;
 }
 
+static INLINE const char *
+reflective_enum_lookup_name(const struct reflective_enum_element *elements,
+			    int id)
+{
+	const struct reflective_enum_element *elem = elements;
+
+	while (elem->name && elem->id != id) {
+		elem++;
+	}
+
+	return elem->name;
+}
+
+#define util_offsetof(struct_type, member_name)                                \
+	((t_ptr) & ((struct_type *)0)->member_name)
+
+#define util_container_of(ptr, struct_type, member_name)                       \
+	((struct_type *)((t_u8 *)(ptr)-util_offsetof(struct_type, member_name)))
+
+/**
+ *  @brief This function checks if t1 timestamp is before t2 timestamp
+ *
+ *  @param t1   t1 timestamp
+ *  @param t2   t2 timestamp
+ *
+ *  @return     MTRUE if t1 is before t2
+ */
+static INLINE t_bool util_is_time_before(t_u64 t1, t_u64 t2)
+{
+	t_s64 delta = t2 - t1;
+
+	// coverity[integer_overflow:SUPPRESS]
+	return delta > 0;
+}
+
 #endif /* !_MLAN_UTIL_H_ */
diff --git a/wlan_sd8987/mlan/mlan_wmm.c b/wlan_src/mlan/mlan_wmm.c
old mode 100755
new mode 100644
similarity index 68%
rename from wlan_sd8987/mlan/mlan_wmm.c
rename to wlan_src/mlan/mlan_wmm.c
index c8aab0f..f28ca8e
--- a/wlan_sd8987/mlan/mlan_wmm.c
+++ b/wlan_src/mlan/mlan_wmm.c
@@ -3,20 +3,29 @@
  *  @brief This file contains functions for WMM.
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -65,6 +74,10 @@
  */
 static const t_u8 wmm_aci_to_qidx_map[] = {WMM_AC_BE, WMM_AC_BK, WMM_AC_VI,
 					   WMM_AC_VO};
+
+/** AC to ACI mapping as per IEEE802.11 spec */
+static const t_u8 wmm_ac_to_aci_map[] = {AC_BK, AC_BE, AC_VI, AC_VO};
+
 /**
  * This table will be used to store the tid values based on ACs.
  * It is initialized to default values per TID.
@@ -317,8 +330,7 @@
  *
  *  @return     WMM AC Queue mapping of the IP TOS field
  */
-static INLINE mlan_wmm_ac_e wlan_wmm_convert_tos_to_ac(pmlan_adapter pmadapter,
-						       t_u32 tos)
+mlan_wmm_ac_e wlan_wmm_convert_tos_to_ac(pmlan_adapter pmadapter, t_u32 tos)
 {
 	ENTER();
 
@@ -450,6 +462,38 @@
 }
 
 /**
+ *  @brief Delete all wmm_sta_table
+ *
+ *  @param priv     Pointer to the mlan_private driver data struct
+ *
+ *  @return         N/A
+ */
+static void wlan_wmm_delete_all_sta_entries(pmlan_private priv)
+{
+	pmlan_adapter pmadapter = priv->adapter;
+	t_void *const pmoal_handle = pmadapter->pmoal_handle;
+	mlan_linked_list *sta_entry;
+
+	while ((sta_entry =
+			util_peek_list_nl(pmoal_handle, &priv->wmm.all_stas))) {
+		struct wmm_sta_table *sta = util_container_of(
+			sta_entry, struct wmm_sta_table, all_stas_entry);
+
+		util_unlink_list_nl(pmoal_handle, &sta->all_stas_entry);
+		util_unlink_list_safe_nl(pmoal_handle,
+					 &sta->pending_stas_entry);
+		util_unlink_list_safe_nl(pmoal_handle, &sta->active_sta_entry);
+
+		pmadapter->callbacks.moal_mfree(pmoal_handle, (t_u8 *)sta);
+	}
+
+	util_list_head_reset(&priv->wmm.all_stas);
+
+	priv->wmm.selected_ra_list = MNULL;
+	pmadapter->ra_list_tracing.ra_list = MNULL;
+}
+
+/**
  *  @brief Delete all route address from RA list
  *
  *  @param priv     Pointer to the mlan_private driver data struct
@@ -461,26 +505,30 @@
 	raListTbl *ra_list;
 	int i;
 	pmlan_adapter pmadapter = priv->adapter;
+	t_void *const pmoal_handle = pmadapter->pmoal_handle;
 
 	ENTER();
 
 	for (i = 0; i < MAX_NUM_TID; ++i) {
 		PRINTM(MINFO, "RAList: Freeing buffers for TID %d\n", i);
 		while ((ra_list = (raListTbl *)util_peek_list(
-				pmadapter->pmoal_handle,
-				&priv->wmm.tid_tbl_ptr[i].ra_list, MNULL,
-				MNULL))) {
-			util_unlink_list(pmadapter->pmoal_handle,
+				pmoal_handle, &priv->wmm.tid_tbl_ptr[i].ra_list,
+				MNULL, MNULL))) {
+			util_unlink_list(pmoal_handle,
 					 &priv->wmm.tid_tbl_ptr[i].ra_list,
 					 (pmlan_linked_list)ra_list, MNULL,
 					 MNULL);
 
-			pmadapter->callbacks.moal_mfree(pmadapter->pmoal_handle,
+			if (util_is_node_in_list(&ra_list->pending_txq_entry))
+				util_unlink_list_nl(
+					pmoal_handle,
+					&ra_list->pending_txq_entry);
+
+			pmadapter->callbacks.moal_mfree(pmoal_handle,
 							(t_u8 *)ra_list);
 		}
 
-		util_init_list(
-			(pmlan_linked_list)&priv->wmm.tid_tbl_ptr[i].ra_list);
+		util_list_head_reset(&priv->wmm.tid_tbl_ptr[i].ra_list);
 		priv->wmm.tid_tbl_ptr[i].ra_list_curr = MNULL;
 	}
 
@@ -794,6 +842,707 @@
 }
 
 /**
+ *  @brief Calculates byte budget based on time budget and currect PHY rate
+ *
+ *  @param time_budget_us   Time budget in usec
+ *  @param phy_rate_kbps    TX PHY rate in kbit/sec
+ *
+ *  @return                 byte budget
+ */
+static t_u32 wlan_wmm_get_byte_budget(t_u32 time_budget_us, t_u32 phy_rate_kbps)
+{
+	const t_u32 min_budget = MV_ETH_FRAME_LEN;
+	t_u64 byte_budget =
+		((t_u64)phy_rate_kbps * time_budget_us) / (8 * 1000u);
+
+	if (byte_budget > INT_MAX)
+		return INT_MAX;
+
+	if (byte_budget < min_budget)
+		return min_budget;
+
+	return byte_budget;
+}
+
+/**
+ *  @brief Allocate sta_table address
+ *
+ *  @param pmadapter       Pointer to the mlan_adapter structure
+ *  @param ra              Pointer to the route address
+ *
+ *  @return         sta_table
+ */
+static struct wmm_sta_table *
+wlan_wmm_allocate_sta_table(pmlan_adapter pmadapter, t_u8 *ra)
+{
+	struct wmm_sta_table *sta_table = MNULL;
+	int i;
+	const t_u32 default_rate = 200 * 1000;
+	const t_u32 default_queue_packets = 1024;
+
+	ENTER();
+
+	if (!pmadapter->mclient_tx_supported)
+		goto done;
+
+	if (pmadapter->callbacks.moal_malloc(pmadapter->pmoal_handle,
+					     sizeof(*sta_table), MLAN_MEM_DEF,
+					     (t_u8 **)&sta_table)) {
+		PRINTM(MERROR, "Fail to allocate sta_table\n");
+		goto done;
+	}
+
+	util_init_list(&sta_table->all_stas_entry);
+	util_init_list(&sta_table->pending_stas_entry);
+	util_init_list(&sta_table->active_sta_entry);
+	memcpy_ext(pmadapter, sta_table->ra, ra, MLAN_MAC_ADDR_LENGTH,
+		   MLAN_MAC_ADDR_LENGTH);
+
+	sta_table->budget.time_budget_init_us = pmadapter->init_para.tx_budget;
+	sta_table->budget.byte_budget_init = wlan_wmm_get_byte_budget(
+		sta_table->budget.time_budget_init_us, default_rate);
+	sta_table->budget.queue_packets = default_queue_packets;
+	sta_table->budget.phy_rate_kbps = default_rate;
+
+	sta_table->budget.mpdu_with_amsdu_pps_cap =
+		pmadapter->tx_mpdu_with_amsdu_pps;
+	sta_table->budget.mpdu_no_amsdu_pps_cap =
+		pmadapter->tx_mpdu_no_amsdu_pps;
+
+	sta_table->budget.mpdu_with_amsdu_budget_init =
+		((t_u64)sta_table->budget.mpdu_with_amsdu_pps_cap *
+		 sta_table->budget.time_budget_init_us) /
+		1000000;
+	sta_table->budget.mpdu_no_amsdu_budget_init =
+		((t_u64)sta_table->budget.mpdu_no_amsdu_pps_cap *
+		 sta_table->budget.time_budget_init_us) /
+		1000000;
+
+	for (i = 0; i < NELEMENTS(sta_table->budget.bytes); ++i) {
+		sta_table->budget.bytes[i] = sta_table->budget.byte_budget_init;
+		sta_table->budget.mpdus[i] =
+			sta_table->budget.mpdu_with_amsdu_budget_init;
+	}
+
+done:
+	LEAVE();
+
+	return sta_table;
+}
+
+/**
+ *  @brief Generates pseudorandom number
+ *
+ *  @return         random number
+ */
+static t_u32 wmm_get_random_num(void)
+{
+	static t_u32 state = 2463534242u;
+
+	state ^= state << 13;
+	state ^= state >> 17;
+	state ^= state << 5;
+
+	return state;
+}
+
+/**
+ *  @brief reset remaning AIFS to default value
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *
+ *  @return           N/A
+ */
+static void wlan_wmm_txq_contention_reset_aifs(mlan_wmm_contention *txq_cont)
+{
+	txq_cont->remaining_aifs = txq_cont->param.aifsn * 9 + 16;
+}
+
+/**
+ *  @brief reset remaning backoff to default value
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *
+ *  @return           N/A
+ */
+static void wlan_wmm_txq_contention_reset_backoff(mlan_wmm_contention *txq_cont)
+{
+	const t_u32 mask = (1u << txq_cont->ecw) - 1;
+	txq_cont->remaining_backoff = (wmm_get_random_num() & mask) * 9;
+}
+
+/**
+ *  @brief get remaning time till contention end in usec
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *
+ *  @return           remaning time
+ */
+static t_u32 wlan_wmm_txq_get_remaining_time(mlan_wmm_contention *txq_cont)
+{
+	return txq_cont->remaining_aifs + txq_cont->remaining_backoff;
+}
+
+/**
+ *  @brief decrement contention timer by specified duration
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *  @param duration   duration in usec
+ *
+ *  @return           MTRUE if timer reach 0
+ */
+static t_bool wlan_wmm_txq_count_donw(mlan_wmm_contention *txq_cont,
+				      t_u32 duration)
+{
+	if (txq_cont->remaining_aifs > 0) {
+		t_u32 del = MIN(txq_cont->remaining_aifs, duration);
+
+		txq_cont->remaining_aifs -= del;
+		duration -= del;
+	}
+
+	if (txq_cont->remaining_aifs == 0)
+		txq_cont->remaining_backoff -= duration;
+
+	// coverity[integer_overflow:SUPPRESS]
+	return txq_cont->remaining_backoff == 0 &&
+	       txq_cont->remaining_aifs == 0;
+}
+
+/**
+ *  @brief This function is called when txq_cont win contention
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *
+ *  @return           N/A
+ */
+static void wlan_wmm_txq_win(mlan_wmm_contention *txq_cont)
+{
+	txq_cont->ecw = txq_cont->param.ecwmin;
+	wlan_wmm_txq_contention_reset_aifs(txq_cont);
+	wlan_wmm_txq_contention_reset_backoff(txq_cont);
+}
+
+/**
+ *  @brief This function is called when txq_cont lost contention
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *
+ *  @return           N/A
+ */
+static void wlan_wmm_txq_lost(mlan_wmm_contention *txq_cont)
+{
+	wlan_wmm_txq_contention_reset_aifs(txq_cont);
+	if (txq_cont->move_cw_on_lost) {
+		txq_cont->ecw = MIN(txq_cont->ecw + 1, txq_cont->param.ecwmax);
+		wlan_wmm_txq_contention_reset_backoff(txq_cont);
+	}
+}
+
+/**
+ *  @brief This function is called when collision detected
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *
+ *  @return           N/A
+ */
+static void wlan_wmm_txq_collision(mlan_wmm_contention *txq_cont)
+{
+	txq_cont->ecw = MIN(txq_cont->ecw + 1, txq_cont->param.ecwmax);
+	wlan_wmm_txq_contention_reset_aifs(txq_cont);
+	wlan_wmm_txq_contention_reset_backoff(txq_cont);
+}
+
+/**
+ *  @brief Setup contention parameters based on WMM structure
+ *
+ *  @param txq_cont   Pointer to mlan_wmm_contention structure
+ *  @param wmm_param   Pointer to IEEEtypes_WmmAcParameters_t structure
+ *  @param move_cw_on_lost   tells if CW should be doubled in case of lose
+ *                             in contention
+ *
+ *  @return           N/A
+ */
+static void
+wlan_wmm_txq_contention_setup(mlan_wmm_contention *txq_cont,
+			      t_bool move_cw_on_lost,
+			      const IEEEtypes_WmmAcParameters_t *wmm_param)
+{
+	txq_cont->param.aifsn = wmm_param->aci_aifsn.aifsn;
+	txq_cont->param.ecwmin = wmm_param->ecw.ecw_min;
+	txq_cont->param.ecwmax = wmm_param->ecw.ecw_max;
+	txq_cont->ecw = txq_cont->param.ecwmin;
+	txq_cont->move_cw_on_lost = move_cw_on_lost;
+	wlan_wmm_txq_contention_reset_aifs(txq_cont);
+	wlan_wmm_txq_contention_reset_backoff(txq_cont);
+}
+
+/**
+ *  @brief Get WMM contention winner
+ *
+ *  @param pmadapter   Pointer to pmlan_adapter structure
+ *  @param mlan        Pointer to mlan_private structure
+ *
+ *  @return           TX queue index, -1 if no pending data
+ */
+static int wlan_wmm_contention_get_winner(pmlan_adapter pmadapter,
+					  mlan_private *mlan)
+{
+	int queue;
+	t_u32 active_queues = 0;
+	t_u32 remaining_time = INT_MAX;
+	t_bool has_winner = MFALSE;
+	int winner_queue = -1;
+
+	for (queue = 0; queue < NELEMENTS(mlan->wmm.pending_txq); ++queue) {
+		pmlan_linked_list entry = util_peek_list_nl(
+			pmadapter->pmoal_handle, &mlan->wmm.pending_txq[queue]);
+
+		if (entry) {
+			t_u32 q_remaining_time =
+				wlan_wmm_txq_get_remaining_time(
+					&mlan->wmm.txq_contention[queue]);
+			remaining_time = MIN(remaining_time, q_remaining_time);
+			active_queues |= MBIT(queue);
+		}
+	}
+
+	for (queue = 0; queue < NELEMENTS(mlan->wmm.pending_txq); ++queue) {
+		if (active_queues & MBIT(queue)) {
+			mlan_wmm_contention *txq_cont =
+				&mlan->wmm.txq_contention[queue];
+			t_bool winner = wlan_wmm_txq_count_donw(txq_cont,
+								remaining_time);
+
+			if (winner && !has_winner) {
+				has_winner = MTRUE;
+				winner_queue = queue;
+				wlan_wmm_txq_win(txq_cont);
+			} else if (winner && has_winner) {
+				wlan_wmm_txq_collision(txq_cont);
+			} else {
+				wlan_wmm_txq_lost(txq_cont);
+			}
+		}
+	}
+
+	return winner_queue;
+}
+
+/**
+ *  @brief Initi contention parameters
+ *
+ *  @param mlan        Pointer to mlan_private structure
+ *  @param ac_params   Pointer to IEEEtypes_WmmAcParameters_t array
+ *
+ *  @return           N/A
+ */
+void wlan_wmm_contention_init(
+	mlan_private *mlan,
+	const IEEEtypes_WmmAcParameters_t ac_params[MAX_AC_QUEUES])
+{
+	int queue;
+
+	if (ac_params == MNULL)
+		return;
+
+	for (queue = 0; queue < NELEMENTS(mlan->wmm.queue_priority); ++queue) {
+		const mlan_wmm_ac_e ac = mlan->wmm.queue_priority[queue];
+		const wmm_ac_e aci = wmm_ac_to_aci_map[ac];
+		/* adjust BK`s contention logic to mimic legacy behaviour */
+		const t_bool move_cw_on_lost = aci == AC_BK;
+
+		wlan_wmm_txq_contention_setup(&mlan->wmm.txq_contention[queue],
+					      move_cw_on_lost, &ac_params[aci]);
+	}
+}
+
+/**
+ *  @brief get AC queue index for transmission
+ *
+ *  @param pmadapter   Pointer to pmlan_adapter structure
+ *  @param mlan        Pointer to mlan_private structure
+ *
+ *  @return           AC queue index to TX
+ */
+static int wlan_wmm_get_next_ac(pmlan_adapter pmadapter, mlan_private *mlan)
+{
+	return wlan_wmm_contention_get_winner(pmadapter, mlan);
+}
+
+/**
+ *  @brief checks if BSS is ready for TX
+ *
+ *  @param pmadapter   Pointer to pmlan_adapter structure
+ *  @param mlan        Pointer to mlan_private structure
+ *
+ *  @return           MTRUE when BSS is reasy for TX
+ */
+static t_bool wlan_wmm_is_bss_ready_for_tx(pmlan_adapter pmadapter,
+					   mlan_private *mlan)
+{
+	if ((mlan->port_ctrl_mode == MTRUE) && (mlan->port_open == MFALSE)) {
+		PRINTM(MINFO, "PORT_CLOSED Ignore pkts from BSS%d\n",
+		       mlan->bss_index);
+		return MFALSE;
+	}
+
+	if (mlan->tx_pause) {
+		PRINTM(MINFO, "TX PASUE Ignore pkts from BSS%d\n",
+		       mlan->bss_index);
+		return MFALSE;
+	}
+#if defined(USB)
+	if (!wlan_is_port_ready(pmadapter, mlan->port_index)) {
+		PRINTM(MINFO, "usb port is busy,Ignore pkts from BSS%d\n",
+		       mlan->bss_index);
+		return MFALSE;
+	}
+#endif
+
+	return MTRUE;
+}
+
+static mlan_private *wlan_wmm_get_next_mlan(pmlan_adapter pmadapter,
+					    mlan_bssprio_tbl *bssprio_tbl)
+{
+	mlan_bssprio_node *bss = bssprio_tbl->bssprio_cur;
+	const mlan_callbacks *const cb = &pmadapter->callbacks;
+	t_void *pmoal = pmadapter->pmoal_handle;
+	mlan_bssprio_node *const stop_point = bss;
+
+	do {
+		mlan_private *mlan;
+		t_u32 queue;
+
+		bssprio_tbl->bssprio_cur = bss;
+		if (bss == (mlan_bssprio_node *)&bssprio_tbl->bssprio_head)
+			goto next_bss;
+
+		mlan = bss->priv;
+
+		if (!wlan_wmm_is_bss_ready_for_tx(pmadapter, mlan)) {
+			goto next_bss;
+		}
+
+		cb->moal_spin_lock(pmoal, mlan->wmm.ra_list_spinlock);
+
+		for (queue = 0; queue < NELEMENTS(mlan->wmm.pending_txq);
+		     ++queue) {
+			if (util_peek_list_nl(pmoal,
+					      &mlan->wmm.pending_txq[queue])) {
+				bssprio_tbl->bssprio_cur =
+					bssprio_tbl->bssprio_cur->pnext;
+				return mlan;
+			}
+		}
+
+		cb->moal_spin_unlock(pmoal, mlan->wmm.ra_list_spinlock);
+
+	next_bss:
+		bss = bss->pnext;
+	} while (bss != stop_point);
+
+	return MNULL;
+}
+
+/**
+ *  @brief gets next BSS to TX
+ *
+ *  @param pmadapter   Pointer to pmlan_adapter structure
+ *
+ *  @return           mlan_private
+ */
+static mlan_private *wlan_wmm_get_next_bss(pmlan_adapter pmadapter)
+{
+	int i;
+	t_void *pmoal = pmadapter->pmoal_handle;
+	mlan_private *mlan = MNULL;
+	ENTER();
+
+	for (i = pmadapter->priv_num - 1; i >= 0 && mlan == MNULL; --i) {
+		mlan_bssprio_tbl *bssprio_tbl = &pmadapter->bssprio_tbl[i];
+
+		if (!util_peek_list_nl(pmoal, &bssprio_tbl->bssprio_head))
+			continue;
+
+		mlan = wlan_wmm_get_next_mlan(pmadapter, bssprio_tbl);
+	}
+
+	LEAVE();
+
+	return mlan;
+}
+
+/**
+ *  @brief helper function to refill budget
+ *
+ *  @param current_value   current budget value
+ *  @param init_value      Addition to bugget
+ *
+ *  @return            new budget value
+ */
+static t_s32 wlan_wmm_refill_budget(t_s32 current_value, t_u32 init_value)
+{
+	if (current_value > 0)
+		return init_value;
+
+	// coverity[integer_overflow:SUPPRESS]
+	return current_value + init_value;
+}
+
+/**
+ *  @brief checks if ra_list has budget to be scheduled for TX
+ *
+ *  @param pmadapter   Pointer to pmlan_adapter structure
+ *  @param mlan        Pointer to mlan_private structure
+ *  @param ra_list     Pointer to ra_list structure
+ *
+ *  @return           MTRUE when ra_list can be scheduled
+ */
+static t_bool wlan_wmm_process_ra_list_quoats(pmlan_adapter pmadapter,
+					      mlan_private *mlan,
+					      raListTbl *ra_list)
+{
+	struct wmm_sta_table *sta = ra_list->sta;
+	const t_u8 tid = ra_list->tid;
+	t_bool ready = MTRUE;
+
+	if (sta->budget.bytes[tid] <= 0 || sta->budget.mpdus[tid] <= 0) {
+		const t_u32 mpdu_budget_init =
+			ra_list->amsdu_in_ampdu ?
+				sta->budget.mpdu_with_amsdu_budget_init :
+				sta->budget.mpdu_no_amsdu_budget_init;
+		util_unlink_list_nl(pmadapter->pmoal_handle,
+				    &ra_list->pending_txq_entry);
+
+		util_enqueue_list_tail_nl(
+			pmadapter->pmoal_handle,
+			&mlan->wmm.pending_txq[ra_list->queue],
+			&ra_list->pending_txq_entry);
+
+		sta->budget.bytes[tid] = wlan_wmm_refill_budget(
+			sta->budget.bytes[tid], sta->budget.byte_budget_init);
+		sta->budget.mpdus[tid] = wlan_wmm_refill_budget(
+			sta->budget.mpdus[tid], mpdu_budget_init);
+
+		mlan->wmm.selected_ra_list = MNULL;
+
+		ready = MFALSE;
+	} else {
+		mlan->wmm.selected_ra_list = ra_list;
+	}
+
+	return ready;
+}
+
+/**
+ *  @brief gets next ra_list to TX
+ *
+ *  @param pmadapter   Pointer to pmlan_adapter structure
+ *  @param mlan        Pointer to mlan_private structure
+ *
+ *  @return           raListTbl
+ */
+static raListTbl *wlan_wmm_get_next_ra_list(pmlan_adapter pmadapter,
+					    mlan_private *mlan)
+{
+	int ac;
+	t_void *pmoal = pmadapter->pmoal_handle;
+
+	while ((ac = wlan_wmm_get_next_ac(pmadapter, mlan)) >= 0) {
+		pmlan_linked_list entry;
+
+		while ((entry = util_peek_list_nl(
+				pmoal, &mlan->wmm.pending_txq[ac])) != MNULL) {
+			raListTbl *ra_list;
+			t_bool has_data;
+
+			ra_list = util_container_of(entry, raListTbl,
+						    pending_txq_entry);
+			has_data = ra_list->total_pkts &&
+				   util_peek_list_nl(pmoal, &ra_list->buf_head);
+
+			/* ra_list can be empry since we re-queue it once we hit
+			 * budget limit */
+			if (!has_data) {
+				struct wmm_sta_table *sta = ra_list->sta;
+				const t_u32 mpdu_budget_init =
+					ra_list->amsdu_in_ampdu ?
+						sta->budget
+							.mpdu_with_amsdu_budget_init :
+						sta->budget
+							.mpdu_no_amsdu_budget_init;
+
+				sta->budget.bytes[ra_list->tid] =
+					sta->budget.byte_budget_init;
+				sta->budget.mpdus[ra_list->tid] =
+					mpdu_budget_init;
+
+				util_unlink_list_nl(
+					pmoal, &ra_list->pending_txq_entry);
+				continue;
+			}
+
+			if (wlan_wmm_process_ra_list_quoats(pmadapter, mlan,
+							    ra_list)) {
+				return ra_list;
+			}
+		}
+	}
+
+	return MNULL;
+}
+
+/**
+ *  @brief Track byte budget consumed by ra_list
+ *
+ *  @param ra_list   Pointer to raListTbl structure
+ *  @param pmbuf     Pointer to mlan_buffer structure
+ *
+ *  @return          N/A
+ */
+void wlan_wmm_consume_byte_budget(raListTbl *ra_list, mlan_buffer *pmbuf)
+{
+	struct wmm_sta_table *sta = ra_list->sta;
+
+	if (sta != MNULL) {
+		t_u32 data_len = pmbuf->data_len;
+
+		if (ra_list->ba_status != BA_STREAM_SETUP_COMPLETE) {
+			/*
+			 * Assumption that non-agg consumes 2 times more
+			 * airtime. It is not always true but we don't have
+			 * airtime feedback from FW anyway.
+			 */
+			data_len *= 2;
+		}
+
+		sta->budget.bytes[ra_list->tid] -= data_len;
+	}
+}
+
+/**
+ *  @brief Track MPDU budget consumed by ra_list
+ *
+ *  @param ra_list   Pointer to raListTbl structure
+ *  @param pmbuf     Pointer to mlan_buffer structure
+ *
+ *  @return          N/A
+ */
+void wlan_wmm_consume_mpdu_budget(raListTbl *ra_list)
+{
+	struct wmm_sta_table *sta = ra_list->sta;
+
+	if (sta != MNULL)
+		sta->budget.mpdus[ra_list->tid]--;
+}
+
+/**
+ *  @brief Debug function to track ra_list switching during scheduling
+ *
+ *  @param mlan      Pointer to mlan_private structure
+ *  @param ra_list   Pointer to raListTbl structure
+ *
+ *  @return          N/A
+ */
+static void wlan_wmm_track_ra_list_switch(mlan_private *mlan,
+					  raListTbl *ra_list)
+{
+	const int use_runtime_log = 1;
+	mlan_adapter *adapter = mlan->adapter;
+
+	if (ra_list != adapter->ra_list_tracing.ra_list) {
+		raListTbl *old_list = adapter->ra_list_tracing.ra_list;
+		t_u32 in_tx_ring = 0;
+#ifdef PCIE
+		if (IS_PCIE(mlan->adapter->card_type))
+			in_tx_ring = mlan->adapter->pcard_pcie->txbd_pending;
+#endif
+		if (use_runtime_log && old_list != MNULL) {
+			struct wmm_sta_table *old_sta = old_list->sta;
+
+			PRINTM(MSCH_D,
+			       "mclient: switch[ %u/%u : q size: %u/%u bb: r %d m %d ri %u mi %u %u p %u] %pM tid %u -> %pM tid %u",
+			       adapter->ra_list_tracing.pushed_pkg, in_tx_ring,
+			       old_list->total_pkts,
+			       old_sta->budget.queue_packets,
+			       old_sta->budget.bytes[old_list->tid],
+			       old_sta->budget.mpdus[old_list->tid],
+			       old_sta->budget.byte_budget_init,
+			       old_sta->budget.mpdu_no_amsdu_budget_init,
+			       old_sta->budget.mpdu_with_amsdu_budget_init,
+			       old_sta->budget.phy_rate_kbps / 1000,
+			       old_list->ra, old_list->tid, ra_list->ra,
+			       ra_list->tid);
+		}
+
+		adapter->ra_list_tracing.ra_list = ra_list;
+		adapter->ra_list_tracing.pushed_pkg = 0;
+	}
+
+	adapter->ra_list_tracing.pushed_pkg++;
+}
+
+/**
+ *  @brief gets next raListTbl for TX based on currect scheduling configuration
+ *
+ *  @param pmadapter      A pointer to mlan_adapter
+ *  @param priv           A pointer to mlan_private
+ *  @param tid            A pointer to return tid
+ *
+ *  @return             raListTbl
+ */
+static raListTbl *wlan_wmm_get_next_priolist_ptr(pmlan_adapter pmadapter,
+						 pmlan_private *priv, int *tid)
+{
+	mlan_private *mlan = pmadapter->selected_mlan_bss;
+	mlan_callbacks *cbs = &pmadapter->callbacks;
+	void *const pmoal_handle = pmadapter->pmoal_handle;
+	raListTbl *ra_list = MNULL;
+
+	if (!pmadapter->mclient_tx_supported)
+		return wlan_wmm_get_highest_priolist_ptr(pmadapter, priv, tid);
+
+	if (mlan) {
+		cbs->moal_spin_lock(pmoal_handle, mlan->wmm.ra_list_spinlock);
+	} else {
+		mlan = wlan_wmm_get_next_bss(pmadapter);
+	}
+
+	for (; mlan != MNULL; mlan = wlan_wmm_get_next_bss(pmadapter)) {
+		ra_list = mlan->wmm.selected_ra_list;
+
+		if (ra_list == MNULL || ra_list->total_pkts == 0) {
+			ra_list = wlan_wmm_get_next_ra_list(pmadapter, mlan);
+		} else if (!wlan_wmm_process_ra_list_quoats(pmadapter, mlan,
+							    ra_list)) {
+			pmadapter->selected_mlan_bss = MNULL;
+			cbs->moal_spin_unlock(pmoal_handle,
+					      mlan->wmm.ra_list_spinlock);
+			continue;
+		}
+
+		if (ra_list != MNULL) {
+			wlan_wmm_track_ra_list_switch(mlan, ra_list);
+
+			*priv = mlan;
+			*tid = ra_list->tid;
+
+			pmadapter->selected_mlan_bss = mlan;
+
+			return ra_list;
+		}
+
+		cbs->moal_spin_unlock(pmoal_handle, mlan->wmm.ra_list_spinlock);
+	}
+
+	pmadapter->selected_mlan_bss = MNULL;
+
+	return wlan_wmm_get_highest_priolist_ptr(pmadapter, priv, tid);
+}
+
+/**
  *  @brief This function gets the number of packets in the Tx queue
  *
  *  @param priv           A pointer to mlan_private
@@ -847,6 +1596,8 @@
 						&ptr->buf_head, MNULL, MNULL);
 	if (pmbuf) {
 		PRINTM(MINFO, "Dequeuing the packet %p %p\n", ptr, pmbuf);
+		wlan_wmm_consume_mpdu_budget(ptr);
+		wlan_wmm_consume_byte_budget(ptr, pmbuf);
 		priv->wmm.pkts_queued[ptrindex]--;
 		util_scalar_decrement(pmadapter->pmoal_handle,
 				      &priv->wmm.tx_pkts_queued, MNULL, MNULL);
@@ -857,7 +1608,8 @@
 			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
 
 		tx_param.next_pkt_len =
-			((pmbuf_next) ? pmbuf_next->data_len + sizeof(TxPD) :
+			((pmbuf_next) ? pmbuf_next->data_len +
+						Tx_PD_SIZEOF(pmadapter) :
 					0);
 		status = wlan_process_tx(priv, pmbuf, &tx_param);
 
@@ -901,9 +1653,9 @@
 				priv->wmm.tid_tbl_ptr[ptrindex].ra_list_curr =
 					ptr;
 			}
-			pmadapter->bssprio_tbl[priv->bss_priority].bssprio_cur =
-				pmadapter->bssprio_tbl[priv->bss_priority]
-					.bssprio_cur->pnext;
+			wlan_advance_bss_on_pkt_push(
+				pmadapter,
+				&pmadapter->bssprio_tbl[priv->bss_priority]);
 			pmadapter->callbacks.moal_spin_unlock(
 				pmadapter->pmoal_handle,
 				priv->wmm.ra_list_spinlock);
@@ -963,7 +1715,8 @@
 		pmadapter->callbacks.moal_spin_unlock(
 			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
 		tx_param.next_pkt_len =
-			((pmbuf_next) ? pmbuf_next->data_len + sizeof(TxPD) :
+			((pmbuf_next) ? pmbuf_next->data_len +
+						Tx_PD_SIZEOF(pmadapter) :
 					0);
 
 		ret = pmadapter->ops.host_to_card(priv, MLAN_TYPE_DATA, pmbuf,
@@ -1008,10 +1761,10 @@
 		case MLAN_STATUS_PENDING:
 			break;
 		case MLAN_STATUS_SUCCESS:
-			DBG_HEXDUMP(MDAT_D, "Tx",
-				    pmbuf->pbuf + pmbuf->data_offset,
-				    MIN(pmbuf->data_len + sizeof(TxPD),
-					MAX_DATA_DUMP_LEN));
+			DBG_HEXDUMP(
+				MDAT_D, "Tx", pmbuf->pbuf + pmbuf->data_offset,
+				MIN(pmbuf->data_len + Tx_PD_SIZEOF(pmadapter),
+				    MAX_DATA_DUMP_LEN));
 			wlan_write_data_complete(pmadapter, pmbuf, ret);
 			break;
 		default:
@@ -1027,9 +1780,10 @@
 					ptr;
 				ptr->total_pkts--;
 			}
-			pmadapter->bssprio_tbl[priv->bss_priority].bssprio_cur =
-				pmadapter->bssprio_tbl[priv->bss_priority]
-					.bssprio_cur->pnext;
+
+			wlan_advance_bss_on_pkt_push(
+				pmadapter,
+				&pmadapter->bssprio_tbl[priv->bss_priority]);
 			priv->wmm.pkts_queued[ptrindex]--;
 			util_scalar_decrement(pmadapter->pmoal_handle,
 					      &priv->wmm.tx_pkts_queued, MNULL,
@@ -1063,7 +1817,8 @@
 
 	ENTER();
 
-	ptr = wlan_wmm_get_highest_priolist_ptr(pmadapter, &priv, &ptrindex);
+	ptr = wlan_wmm_get_next_priolist_ptr(pmadapter, &priv, &ptrindex);
+
 	if (!ptr) {
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
@@ -1101,7 +1856,7 @@
 			pmadapter->pmoal_handle, &ptr->buf_head, MNULL, MNULL);
 		if (pmbuf) {
 			pmadapter->callbacks.moal_tp_accounting(
-				pmadapter->pmoal_handle, pmbuf->pdesc, 3);
+				pmadapter->pmoal_handle, pmbuf, 3);
 			if (pmadapter->tp_state_drop_point == 3) {
 				pmbuf = (pmlan_buffer)util_dequeue_list(
 					pmadapter->pmoal_handle, &ptr->buf_head,
@@ -1123,7 +1878,7 @@
 			}
 		}
 	}
-	if (!ptr->is_wmm_enabled ||
+	if (!ptr->is_wmm_enabled || priv->adapter->remain_on_channel ||
 	    (ptr->ba_status || ptr->del_ba_count >= DEL_BA_THRESHOLD)
 #ifdef STA_SUPPORT
 	    || priv->wps.session_enable
@@ -1149,7 +1904,7 @@
 					    priv, tid, ptr->ra, MFALSE)) {
 					wlan_11n_create_txbastream_tbl(
 						priv, ptr->ra, tid,
-						BA_STREAM_SETUP_INPROGRESS);
+						BA_STREAM_SETUP_SENT_ADDBA);
 					wlan_send_addba(priv, tid, ptr->ra);
 				}
 			} else if (wlan_find_stream_to_delete(priv, ptr, tid,
@@ -1161,6 +1916,9 @@
 					wlan_11n_create_txbastream_tbl(
 						priv, ptr->ra, tid,
 						BA_STREAM_SETUP_INPROGRESS);
+					wlan_11n_set_txbastream_status(
+						priv, tid_del, ra,
+						BA_STREAM_SENT_DELBA, MFALSE);
 					wlan_send_delba(priv, MNULL, tid_del,
 							ra, 1);
 				}
@@ -1176,11 +1934,66 @@
 		}
 	}
 
+	if (ptr->sta && ptr->sta->ps_sleep) {
+		wlan_update_ralist_tx_pause(priv, ptr->ra, 1);
+	}
+
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
 
 /**
+ *  @brief remove ra_list from pendiing TX queues
+ *
+ *  @param priv        A pointer to mlan_private
+ *  @param pmadapter   A pointer to pmlan_adapter
+ *  @param ra_list     A pointer to raListTbl
+ *
+ *  @return           N/A
+ */
+static void wlan_ralist_remove_from_pending_txq(pmlan_private priv,
+						pmlan_adapter pmadapter,
+						raListTbl *ra_list)
+{
+	mlan_adapter *adapter = priv->adapter;
+
+	if (util_is_node_in_list(&ra_list->pending_txq_entry))
+		util_unlink_list_nl(pmadapter->pmoal_handle,
+				    &ra_list->pending_txq_entry);
+
+	if (ra_list == priv->wmm.selected_ra_list)
+		priv->wmm.selected_ra_list = MNULL;
+
+	if (ra_list == adapter->ra_list_tracing.ra_list)
+		adapter->ra_list_tracing.ra_list = MNULL;
+
+	if (ra_list->sta)
+		util_unlink_list_safe_nl(pmadapter->pmoal_handle,
+					 &ra_list->sta->pending_stas_entry);
+}
+
+/**
+ *  @brief Add ra_list back to pendiing TX queue
+ *
+ *  @param priv        A pointer to mlan_private
+ *  @param pmadapter   A pointer to pmlan_adapter
+ *  @param ra_list     A pointer to raListTbl
+ *  @param tid         tid
+ *
+ *  @return           N/A
+ */
+static void wlan_ralist_add_to_pending_txq(pmlan_private priv,
+					   pmlan_adapter pmadapter,
+					   raListTbl *ra_list, t_u8 tid)
+{
+	t_u8 queue = wlan_wmm_select_queue(priv, tid);
+
+	util_enqueue_list_head(pmadapter->pmoal_handle,
+			       &priv->wmm.pending_txq[queue],
+			       &ra_list->pending_txq_entry, MNULL, MNULL);
+}
+
+/**
  *  @brief update tx_pause flag in ra_list
  *
  *  @param priv		  A pointer to mlan_private
@@ -1192,7 +2005,6 @@
  */
 t_u16 wlan_update_ralist_tx_pause(pmlan_private priv, t_u8 *mac, t_u8 tx_pause)
 {
-	raListTbl *ra_list;
 	int i;
 	pmlan_adapter pmadapter = priv->adapter;
 	t_u32 pkt_cnt = 0;
@@ -1202,16 +2014,23 @@
 	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
 					    priv->wmm.ra_list_spinlock);
 	for (i = 0; i < MAX_NUM_TID; ++i) {
-		ra_list = wlan_wmm_get_ralist_node(priv, i, mac);
-		if (ra_list && ra_list->tx_pause != tx_pause) {
-			pkt_cnt += ra_list->total_pkts;
-			ra_list->tx_pause = tx_pause;
-			if (tx_pause)
-				priv->wmm.pkts_paused[i] += ra_list->total_pkts;
-			else
-				priv->wmm.pkts_paused[i] -= ra_list->total_pkts;
+		raListTbl *ra_list = wlan_wmm_get_ralist_node(priv, i, mac);
+		if (ra_list == MNULL || ra_list->tx_pause == tx_pause)
+			continue;
+
+		pkt_cnt += ra_list->total_pkts;
+		ra_list->tx_pause = tx_pause;
+		if (tx_pause) {
+			priv->wmm.pkts_paused[i] += ra_list->total_pkts;
+			wlan_ralist_remove_from_pending_txq(priv, pmadapter,
+							    ra_list);
+		} else {
+			priv->wmm.pkts_paused[i] -= ra_list->total_pkts;
+			wlan_ralist_add_to_pending_txq(priv, pmadapter, ra_list,
+						       i);
 		}
 	}
+
 	if (pkt_cnt) {
 		tx_pkts_queued = util_scalar_read(pmadapter->pmoal_handle,
 						  &priv->wmm.tx_pkts_queued,
@@ -1229,6 +2048,7 @@
 	}
 	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
 					      priv->wmm.ra_list_spinlock);
+
 	LEAVE();
 	return pkt_cnt;
 }
@@ -1458,8 +2278,9 @@
 	sec = (sec & 0xFFFF) + (sec >> 16);
 	usec = (usec & 0xFFFF) + (usec >> 16);
 
-	ba_threshold = (((sec << 16) + usec) % BA_SETUP_MAX_PACKET_THRESHOLD) +
-		       pmadapter->min_ba_threshold;
+	ba_threshold =
+		(t_u8)((((sec << 16) + usec) % BA_SETUP_MAX_PACKET_THRESHOLD) +
+		       pmadapter->min_ba_threshold);
 	PRINTM(MINFO, "pmadapter->min_ba_threshold = %d\n",
 	       pmadapter->min_ba_threshold);
 	PRINTM(MINFO, "setup BA after %d packets\n", ba_threshold);
@@ -1498,6 +2319,7 @@
 	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
 					    priv->wmm.ra_list_spinlock);
 	wlan_wmm_cleanup_queues(priv);
+	wlan_wmm_delete_all_sta_entries(priv);
 	wlan_wmm_delete_all_ralist(priv);
 	memcpy_ext(pmadapter, tos_to_tid, ac_to_tid, sizeof(tos_to_tid),
 		   sizeof(tos_to_tid));
@@ -1710,9 +2532,17 @@
 	raListTbl *ra_list;
 	pmlan_adapter pmadapter = priv->adapter;
 	tdlsStatus_e status;
+	struct wmm_sta_table *sta = MNULL;
 
 	ENTER();
 
+	sta = wlan_wmm_allocate_sta_table(pmadapter, ra);
+	if (sta) {
+		util_enqueue_list_tail_nl(pmadapter->pmoal_handle,
+					  &priv->wmm.all_stas,
+					  &sta->all_stas_entry);
+	}
+
 	for (i = 0; i < MAX_NUM_TID; ++i) {
 		ra_list = wlan_wmm_allocate_ralist_node(pmadapter, ra);
 		PRINTM(MINFO, "Creating RA List %p for tid %d\n", ra_list, i);
@@ -1721,6 +2551,13 @@
 		ra_list->max_amsdu = 0;
 		ra_list->ba_status = BA_STREAM_NOT_SETUP;
 		ra_list->amsdu_in_ampdu = MFALSE;
+		ra_list->tid = i;
+		ra_list->queue = wlan_wmm_select_queue(priv, i);
+		ra_list->sta = sta;
+		if (sta)
+			sta->ra_lists[i] = ra_list;
+		util_init_list(&ra_list->pending_txq_entry);
+
 		if (queuing_ra_based(priv)) {
 			ra_list->is_wmm_enabled = wlan_is_wmm_enabled(priv, ra);
 			if (ra_list->is_wmm_enabled)
@@ -1821,6 +2658,15 @@
  */
 t_void wlan_wmm_init(pmlan_adapter pmadapter)
 {
+	static const IEEEtypes_WmmAcParameters_t default_ac_params[] = {
+		[AC_BE] = {.aci_aifsn = {.aifsn = 3, .aci = AC_BE},
+			   .ecw = {.ecw_min = 4, .ecw_max = 10}},
+		[AC_BK] = {.aci_aifsn = {.aifsn = 7, .aci = AC_BK},
+			   .ecw = {.ecw_min = 4, .ecw_max = 10}},
+		[AC_VI] = {.aci_aifsn = {.aifsn = 2, .aci = AC_VI},
+			   .ecw = {.ecw_min = 3, .ecw_max = 4}},
+		[AC_VO] = {.aci_aifsn = {.aifsn = 2, .aci = AC_VO},
+			   .ecw = {.ecw_min = 2, .ecw_max = 3}}};
 	int i, j;
 	pmlan_private priv;
 
@@ -1835,11 +2681,10 @@
 				priv->aggr_prio_tbl[i].ampdu_ap =
 					priv->aggr_prio_tbl[i].ampdu_user =
 						tos_to_tid_inv[i];
-				priv->ibss_ampdu[i] =
-					priv->aggr_prio_tbl[i].ampdu_user;
 				priv->wmm.pkts_queued[i] = 0;
 				priv->wmm.pkts_paused[i] = 0;
 				priv->wmm.tid_tbl_ptr[i].ra_list_curr = MNULL;
+				priv->wmm.selected_ra_list = MNULL;
 			}
 			priv->wmm.drv_pkt_delay_max = WMM_DRV_DELAY_MAX;
 
@@ -1848,15 +2693,14 @@
 			priv->aggr_prio_tbl[6].ampdu_ap =
 				priv->aggr_prio_tbl[6].ampdu_user =
 					BA_STREAM_NOT_ALLOWED;
-			priv->ibss_ampdu[6] = BA_STREAM_NOT_ALLOWED;
 
 			priv->aggr_prio_tbl[7].ampdu_ap =
 				priv->aggr_prio_tbl[7].ampdu_user =
 					BA_STREAM_NOT_ALLOWED;
-			priv->ibss_ampdu[7] = BA_STREAM_NOT_ALLOWED;
-
 			priv->add_ba_param.timeout =
 				MLAN_DEFAULT_BLOCK_ACK_TIMEOUT;
+			if (!pmadapter->tx_ba_timeout_support)
+				priv->add_ba_param.timeout = 0;
 #ifdef STA_SUPPORT
 			if (priv->bss_type == MLAN_BSS_TYPE_STA) {
 				priv->add_ba_param.tx_win_size =
@@ -1873,6 +2717,12 @@
 					MLAN_WFD_AMPDU_DEF_TXRXWINSIZE;
 			}
 #endif
+			if (priv->bss_type == MLAN_BSS_TYPE_NAN) {
+				priv->add_ba_param.tx_win_size =
+					MLAN_NAN_AMPDU_DEF_TXRXWINSIZE;
+				priv->add_ba_param.rx_win_size =
+					MLAN_NAN_AMPDU_DEF_TXRXWINSIZE;
+			}
 #ifdef UAP_SUPPORT
 			if (priv->bss_type == MLAN_BSS_TYPE_UAP) {
 				priv->add_ba_param.tx_win_size =
@@ -1882,11 +2732,18 @@
 			}
 #endif
 			priv->user_rxwinsize = priv->add_ba_param.rx_win_size;
-			priv->add_ba_param.tx_amsdu = MTRUE;
-			priv->add_ba_param.rx_amsdu = MTRUE;
+			if (pmadapter->init_para.amsdu_disable) {
+				priv->add_ba_param.tx_amsdu = MFALSE;
+				priv->add_ba_param.rx_amsdu = MFALSE;
+			} else {
+				priv->add_ba_param.tx_amsdu = MTRUE;
+				priv->add_ba_param.rx_amsdu = MTRUE;
+			}
 			memset(priv->adapter, priv->rx_seq, 0xff,
 			       sizeof(priv->rx_seq));
 			wlan_wmm_default_queue_priorities(priv);
+
+			wlan_wmm_contention_init(priv, default_ac_params);
 		}
 	}
 
@@ -2008,6 +2865,43 @@
 }
 
 /**
+ *   @brief Get wmm_sta_table node
+ *
+ *   @param priv     Pointer to the mlan_private driver data struct
+ *   @param ra_addr  Pointer to the route address
+ *
+ *   @return         wmm_sta_table or MNULL
+ */
+static struct wmm_sta_table *wlan_wmm_get_sta(pmlan_private priv,
+					      const t_u8 *ra_addr)
+{
+	mlan_linked_list *sta_entry;
+	mlan_adapter *adapter = priv->adapter;
+
+	if (!adapter->mclient_tx_supported)
+		return MNULL;
+
+	ENTER();
+
+	for (sta_entry = util_peek_list_nl(adapter->pmoal_handle,
+					   &priv->wmm.all_stas);
+	     sta_entry && sta_entry != (void *)&priv->wmm.all_stas;
+	     sta_entry = sta_entry->pnext) {
+		struct wmm_sta_table *sta = util_container_of(
+			sta_entry, struct wmm_sta_table, all_stas_entry);
+
+		if (memcmp(adapter, sta->ra, ra_addr, MLAN_MAC_ADDR_LENGTH) ==
+		    0) {
+			LEAVE();
+			return sta;
+		}
+	}
+
+	LEAVE();
+	return MNULL;
+}
+
+/**
  *   @brief Check if RA list is valid or not
  *
  *   @param priv     Pointer to the mlan_private driver data struct
@@ -2100,6 +2994,184 @@
 }
 
 /**
+ *  @brief  Update TX PHY rate for STAs in sta_list
+ *
+ *  @param pmpriv     Pointer to the mlan_private driver data struct
+ *  @param sta_list   NULL terminated list of STAs
+ *
+ *  @return MLAN_STATUS_SUCCESS
+ */
+static mlan_status wlan_misc_get_sta_rate(pmlan_private pmpriv,
+					  t_u8 *sta_list[])
+{
+	HostCmd_CMD_802_11_STA_TX_RATE txRateReq = {0};
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int i;
+
+	for (i = 0; i < NELEMENTS(txRateReq.entry) && sta_list[i]; ++i) {
+		memcpy_ext(pmpriv->adapter, txRateReq.entry[i].sta_mac,
+			   sta_list[i], MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+	}
+
+	if (i > 0) {
+		txRateReq.num_entries = i;
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_PEER_TX_RATE_QUERY,
+				       HostCmd_ACT_GEN_GET, 0, MNULL,
+				       &txRateReq);
+	}
+
+	return ret;
+}
+
+/**
+ *  @brief Trigger STAs TX rate update
+ *
+ *  @param pmadapter  Pointer to the pmlan_adapter driver data struct
+ *  @param priv       Pointer to the mlan_private driver data struct
+ *
+ *  @return N/A
+ */
+static void wlan_wmm_update_sta_txrate_info(pmlan_adapter pmadapter,
+					    pmlan_private priv)
+{
+	t_u8 *sta_list[MAX_STA_IN_TX_RATE_REQ + 1] = {0};
+	t_void *pmoal = pmadapter->pmoal_handle;
+	mlan_callbacks *cbs = &pmadapter->callbacks;
+	int idx = 0;
+	const int idx_limit = MAX_STA_IN_TX_RATE_REQ;
+	pmlan_linked_list list_entry;
+	t_u64 time_now;
+	static const t_u64 update_interval = 1000ull * 1000ull * 1000ull;
+
+	cbs->moal_get_host_time_ns(&time_now);
+
+	if (util_is_time_before(time_now, priv->wmm.next_rate_update)) {
+		return;
+	}
+
+	if (priv->wmm.is_rate_update_pending) {
+		return;
+	}
+
+	priv->wmm.next_rate_update = time_now + update_interval;
+
+	while (idx < idx_limit &&
+	       (list_entry = util_peek_list_nl(
+			pmoal, &priv->wmm.pending_stas)) != MNULL) {
+		struct wmm_sta_table *sta = util_container_of(
+			list_entry, struct wmm_sta_table, pending_stas_entry);
+		const t_bool is_bmcast = (sta->ra[0] & 0x01);
+
+		if (!is_bmcast) {
+			sta_list[idx++] = sta->ra;
+		}
+
+		util_unlink_list_nl(pmoal, list_entry);
+	}
+
+	if (idx > 0) {
+		priv->wmm.is_rate_update_pending = MTRUE;
+		wlan_misc_get_sta_rate(priv, sta_list);
+	}
+}
+
+/**
+ *  @brief Updates STAs activity
+ *
+ *  @param pmadapter  Pointer to the pmlan_adapter driver data struct
+ *  @param priv       Pointer to the mlan_private driver data struct
+ *  @param ra_list    Pointer to the raListTbl struct
+ *  @param sta_table  Pointer to the wmm_sta_table struct
+ *
+ *  @return N/A
+ */
+static t_void wlan_wmm_record_sta_tx(pmlan_adapter pmadapter,
+				     pmlan_private priv, raListTbl *ra_list,
+				     struct wmm_sta_table *sta_table)
+{
+	t_bool is_bmcast;
+	const t_u32 tx_active_threshold = 4;
+
+	if (!sta_table)
+		return;
+
+	is_bmcast = (sta_table->ra[0] & 0x01);
+	if (!is_bmcast && ra_list->total_pkts > tx_active_threshold &&
+	    !util_is_node_in_list(&sta_table->active_sta_entry)) {
+		util_enqueue_list_tail_nl(pmadapter->pmoal_handle,
+					  &priv->wmm.active_stas.list,
+					  &sta_table->active_sta_entry);
+		priv->wmm.active_stas.n_stas++;
+	}
+}
+
+/**
+ *  @brief Updates queue_packets budget for all active STAs
+ *
+ *  @param pmadapter  Pointer to the pmlan_adapter driver data struct
+ *  @param priv       Pointer to the mlan_private driver data struct
+ *
+ *  @return N/A
+ */
+static t_void wlan_wmm_update_queue_packets_budget(pmlan_adapter pmadapter,
+						   pmlan_private priv)
+{
+	t_void *pmoal = pmadapter->pmoal_handle;
+	pmlan_linked_list list_entry;
+	const t_u32 queue_packets_limit = pmadapter->init_para.max_tx_pending;
+	t_u64 total_capacity = 0;
+	t_u64 time_now;
+	mlan_callbacks *cbs = &pmadapter->callbacks;
+	static const t_u64 update_interval = 200ull * 1000ull * 1000ull;
+	const t_u32 min_sta_share = 128;
+	const t_u32 max_pending_tx_time_us = 200u * 1000u;
+
+	if (!pmadapter->mclient_tx_supported)
+		return;
+
+	cbs->moal_get_host_time_ns(&time_now);
+
+	if (util_is_time_before(time_now, priv->wmm.active_stas.next_update))
+		return;
+
+	priv->wmm.active_stas.n_stas = 0;
+	priv->wmm.active_stas.next_update = time_now + update_interval;
+
+	for (list_entry = util_peek_list_nl(pmoal, &priv->wmm.active_stas.list);
+	     util_is_list_node(&priv->wmm.active_stas.list, list_entry);
+	     list_entry = list_entry->pnext) {
+		struct wmm_sta_table *sta = util_container_of(
+			list_entry, struct wmm_sta_table, active_sta_entry);
+
+		total_capacity += sta->budget.byte_budget_init;
+	}
+
+	if (total_capacity == 0)
+		return;
+
+	while ((list_entry = util_peek_list_nl(
+			pmoal, &priv->wmm.active_stas.list)) != MNULL) {
+		struct wmm_sta_table *sta = util_container_of(
+			list_entry, struct wmm_sta_table, active_sta_entry);
+		const t_u64 sta_capacity = sta->budget.byte_budget_init;
+		const t_u32 max_pkts_by_airtime =
+			wlan_wmm_get_byte_budget(max_pending_tx_time_us,
+						 sta->budget.phy_rate_kbps) /
+			MV_ETH_FRAME_LEN;
+		t_u32 sta_share =
+			queue_packets_limit * sta_capacity / total_capacity;
+
+		sta_share = MAX(sta_share, min_sta_share);
+		sta_share = MIN(sta_share, queue_packets_limit * 7 / 8);
+		sta_share = MIN(sta_share, max_pkts_by_airtime);
+
+		sta->budget.queue_packets = sta_share;
+		util_unlink_list_nl(pmoal, list_entry);
+	}
+}
+
+/**
  *  @brief Add packet to WMM queue
  *
  *  @param pmadapter  Pointer to the mlan_adapter driver data struct
@@ -2112,6 +3184,7 @@
 	pmlan_private priv = pmadapter->priv[pmbuf->bss_index];
 	t_u32 tid;
 	raListTbl *ra_list;
+	struct wmm_sta_table *sta_table;
 	t_u8 ra[MLAN_MAC_ADDR_LENGTH], tid_down;
 	tdlsStatus_e status;
 #ifdef UAP_SUPPORT
@@ -2156,8 +3229,13 @@
 				&priv->wmm.tid_tbl_ptr[tid_down].ra_list, MNULL,
 				MNULL);
 	} else {
-		memcpy_ext(pmadapter, ra, pmbuf->pbuf + pmbuf->data_offset,
-			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		if (pmbuf->flags & MLAN_BUF_FLAG_EASYMESH)
+			memcpy_ext(pmadapter, ra, pmbuf->mac,
+				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		else
+			memcpy_ext(pmadapter, ra,
+				   pmbuf->pbuf + pmbuf->data_offset,
+				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 		/** put multicast/broadcast packet in the same ralist */
 		if (ra[0] & 0x01)
 			memset(pmadapter, ra, 0xff, sizeof(ra));
@@ -2190,6 +3268,22 @@
 		return;
 	}
 
+	sta_table = wlan_wmm_get_sta(priv, ra_list->ra);
+	wlan_wmm_record_sta_tx(pmadapter, priv, ra_list, sta_table);
+	wlan_wmm_update_queue_packets_budget(pmadapter, priv);
+
+	if (sta_table &&
+	    ra_list->total_pkts > sta_table->budget.queue_packets &&
+	    !(pmbuf->flags & MLAN_BUF_FLAG_TCP_PKT)) {
+		pmadapter->callbacks.moal_spin_unlock(
+			pmadapter->pmoal_handle, priv->wmm.ra_list_spinlock);
+		wlan_write_data_complete(pmadapter, pmbuf,
+					 MLAN_STATUS_RESOURCE);
+		LEAVE();
+
+		return;
+	}
+
 	PRINTM_NETINTF(MDATA, priv);
 	PRINTM(MDATA,
 	       "Adding pkt %p (priority=%d, tid_down=%d) to ra_list %p\n",
@@ -2213,6 +3307,28 @@
 			MLAN_SCALAR_COND_LESS_THAN, tos_to_tid_inv[tid_down],
 			tos_to_tid_inv[tid_down], MNULL, MNULL);
 	}
+
+	if (sta_table) {
+		if (!ra_list->tx_pause &&
+		    !util_is_node_in_list(&sta_table->pending_stas_entry)) {
+			util_enqueue_list_tail_nl(
+				pmadapter->pmoal_handle,
+				&priv->wmm.pending_stas,
+				&sta_table->pending_stas_entry);
+		}
+
+		wlan_wmm_update_sta_txrate_info(pmadapter, priv);
+
+		/* enqueue node-tid to pending AC */
+		if (!ra_list->tx_pause &&
+		    !util_is_node_in_list(&ra_list->pending_txq_entry)) {
+			t_u8 queue = wlan_wmm_select_queue(priv, tid_down);
+
+			util_enqueue_list_tail_nl(pmadapter->pmoal_handle,
+						  &priv->wmm.pending_txq[queue],
+						  &ra_list->pending_txq_entry);
+		}
+	}
 	/* Record the current time the packet was queued; used to determine
 	 *   the amount of time the packet was queued in the driver before it
 	 *   was sent to the firmware.  The delay is then sent along with the
@@ -2263,7 +3379,13 @@
 	ENTER();
 
 	send_wmm_event = MFALSE;
-
+	if (resp_len < (int)sizeof(ptlv_hdr->header)) {
+		PRINTM(MINFO,
+		       "WMM: WMM_GET_STATUS err: cmdresp low length received: %d\n",
+		       resp_len);
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
 	PRINTM(MINFO, "WMM: WMM_GET_STATUS cmdresp received: %d\n", resp_len);
 	HEXDUMP("CMD_RESP: WMM_GET_STATUS", pcurrent, resp_len);
 
@@ -2281,11 +3403,11 @@
 		case TLV_TYPE_WMMQSTATUS:
 			ptlv_wmm_q_status =
 				(MrvlIEtypes_WmmQueueStatus_t *)ptlv_hdr;
-			PRINTM(MEVENT, "WMM_STATUS: QSTATUS TLV: %d\n",
+			PRINTM(MEVENT, "WMM_STATUS: QSTATUS TLV: %u\n",
 			       ptlv_wmm_q_status->queue_index);
 
 			PRINTM(MINFO,
-			       "CMD_RESP: WMM_GET_STATUS: QSTATUS TLV: %d, %d, %d\n",
+			       "CMD_RESP: WMM_GET_STATUS: QSTATUS TLV: %u, %d, %d\n",
 			       ptlv_wmm_q_status->queue_index,
 			       ptlv_wmm_q_status->flow_required,
 			       ptlv_wmm_q_status->disabled);
@@ -2294,15 +3416,17 @@
 			 * bounds */
 			ptlv_wmm_q_status->queue_index = MIN(
 				ptlv_wmm_q_status->queue_index, MAX_AC_QUEUES);
-
-			pac_status =
-				&priv->wmm.ac_status[ptlv_wmm_q_status
-							     ->queue_index];
-			pac_status->disabled = ptlv_wmm_q_status->disabled;
-			pac_status->flow_required =
-				ptlv_wmm_q_status->flow_required;
-			pac_status->flow_created =
-				ptlv_wmm_q_status->flow_created;
+			if (ptlv_wmm_q_status->queue_index < MAX_AC_QUEUES) {
+				pac_status =
+					&priv->wmm.ac_status
+						 [ptlv_wmm_q_status->queue_index];
+				pac_status->disabled =
+					ptlv_wmm_q_status->disabled;
+				pac_status->flow_required =
+					ptlv_wmm_q_status->flow_required;
+				pac_status->flow_created =
+					ptlv_wmm_q_status->flow_created;
+			}
 			break;
 
 		case TLV_TYPE_VENDOR_SPECIFIC_IE: /* WMM_IE */
@@ -2391,6 +3515,8 @@
 
 	wlan_wmm_setup_queue_priorities(priv, pwmm_param_ie);
 	wlan_wmm_setup_ac_downgrade(priv);
+	if (pwmm_param_ie != MNULL)
+		wlan_wmm_contention_init(priv, pwmm_param_ie->ac_params);
 
 	if (send_wmm_event) {
 		wlan_recv_event(priv, MLAN_EVENT_ID_FW_WMM_CONFIG_CHANGE,
@@ -2488,7 +3614,7 @@
 	t_u8 ret_val = 0;
 	t_u32 out_ts_sec, out_ts_usec;
 	t_s32 queue_delay;
-
+	t_s32 temp_delay = 0;
 	ENTER();
 
 	priv->adapter->callbacks.moal_get_system_time(
@@ -2500,9 +3626,17 @@
 			priv->adapter->callbacks.moal_tp_accounting(
 				priv->adapter->pmoal_handle, pmbuf, 11);
 	}
-	queue_delay = (t_s32)(out_ts_sec - pmbuf->in_ts_sec) * 1000;
-	queue_delay += (t_s32)(out_ts_usec - pmbuf->in_ts_usec) / 1000;
+	if (!wlan_secure_sub(&out_ts_sec, pmbuf->in_ts_sec, &temp_delay,
+			     TYPE_SINT32))
+		PRINTM(MERROR, "%s:TS(sec) not valid \n", __func__);
 
+	queue_delay = temp_delay * 1000;
+
+	if (!wlan_secure_sub(&out_ts_usec, pmbuf->in_ts_usec, &temp_delay,
+			     TYPE_SINT32))
+		PRINTM(MERROR, "%s:TS(usec) not valid \n", __func__);
+
+	queue_delay += temp_delay / 1000;
 	/*
 	 * Queue delay is passed as a uint8 in units of 2ms (ms shifted
 	 *  by 1). Min value (other than 0) is therefore 2ms, max is 510ms.
@@ -2683,14 +3817,17 @@
 t_void wlan_wmm_delete_peer_ralist(pmlan_private priv, t_u8 *mac)
 {
 	raListTbl *ra_list;
+	struct wmm_sta_table *sta;
 	int i;
 	pmlan_adapter pmadapter = priv->adapter;
+	mlan_callbacks *cbs = &pmadapter->callbacks;
+	void *const pmoal_handle = pmadapter->pmoal_handle;
 	t_u32 pkt_cnt = 0;
 	t_u32 tx_pkts_queued = 0;
 
 	ENTER();
-	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
-					    priv->wmm.ra_list_spinlock);
+	cbs->moal_spin_lock(pmoal_handle, priv->wmm.ra_list_spinlock);
+
 	for (i = 0; i < MAX_NUM_TID; ++i) {
 		ra_list = wlan_wmm_get_ralist_node(priv, i, mac);
 		if (ra_list) {
@@ -2702,12 +3839,22 @@
 				pkt_cnt += ra_list->total_pkts;
 			wlan_wmm_del_pkts_in_ralist_node(priv, ra_list);
 
-			util_unlink_list(pmadapter->pmoal_handle,
+			if (ra_list == priv->wmm.selected_ra_list)
+				priv->wmm.selected_ra_list = MNULL;
+
+			if (ra_list == pmadapter->ra_list_tracing.ra_list)
+				pmadapter->ra_list_tracing.ra_list = MNULL;
+
+			if (util_is_node_in_list(&ra_list->pending_txq_entry))
+				util_unlink_list_nl(
+					pmoal_handle,
+					&ra_list->pending_txq_entry);
+
+			util_unlink_list(pmoal_handle,
 					 &priv->wmm.tid_tbl_ptr[i].ra_list,
 					 (pmlan_linked_list)ra_list, MNULL,
 					 MNULL);
-			pmadapter->callbacks.moal_mfree(pmadapter->pmoal_handle,
-							(t_u8 *)ra_list);
+			cbs->moal_mfree(pmoal_handle, (t_u8 *)ra_list);
 			if (priv->wmm.tid_tbl_ptr[i].ra_list_curr == ra_list)
 				priv->wmm.tid_tbl_ptr[i].ra_list_curr =
 					(raListTbl *)&priv->wmm.tid_tbl_ptr[i]
@@ -2715,9 +3862,8 @@
 		}
 	}
 	if (pkt_cnt) {
-		tx_pkts_queued = util_scalar_read(pmadapter->pmoal_handle,
-						  &priv->wmm.tx_pkts_queued,
-						  MNULL, MNULL);
+		tx_pkts_queued = util_scalar_read(
+			pmoal_handle, &priv->wmm.tx_pkts_queued, MNULL, MNULL);
 		tx_pkts_queued -= pkt_cnt;
 		util_scalar_write(priv->adapter->pmoal_handle,
 				  &priv->wmm.tx_pkts_queued, tx_pkts_queued,
@@ -2726,8 +3872,18 @@
 				  &priv->wmm.highest_queued_prio, HIGH_PRIO_TID,
 				  MNULL, MNULL);
 	}
-	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
-					      priv->wmm.ra_list_spinlock);
+
+	sta = wlan_wmm_get_sta(priv, mac);
+	if (sta) {
+		util_unlink_list_nl(pmoal_handle, &sta->all_stas_entry);
+		util_unlink_list_safe_nl(pmoal_handle,
+					 &sta->pending_stas_entry);
+		util_unlink_list_safe_nl(pmoal_handle, &sta->active_sta_entry);
+
+		cbs->moal_mfree(pmoal_handle, (t_u8 *)sta);
+	}
+
+	cbs->moal_spin_unlock(pmoal_handle, priv->wmm.ra_list_spinlock);
 	LEAVE();
 }
 
@@ -2853,6 +4009,69 @@
 }
 
 /**
+ *  @brief This function prepares the command of HOST ADDTS
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_wmm_host_addts_req(pmlan_private pmpriv,
+					HostCmd_DS_COMMAND *cmd,
+					t_void *pdata_buf)
+{
+	mlan_ds_tx_addts_cfg *paddts = (mlan_ds_tx_addts_cfg *)pdata_buf;
+	HostCmd_DS_WMM_HOST_ADDTS_REQ *pcmd_addts = &cmd->params.host_add_ts;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_WMM_HOST_ADDTS_REQ);
+	cmd->size = wlan_cpu_to_le16(sizeof(*pcmd_addts) + S_DS_GEN);
+	cmd->result = 0;
+
+	pcmd_addts->tsid = paddts->tsid;
+	;
+	pcmd_addts->user_prio = paddts->user_prio;
+	pcmd_addts->admitted_time = wlan_cpu_to_le16(paddts->admitted_time);
+	memcpy_ext(pmpriv->adapter, pcmd_addts->peer_addr, paddts->peer,
+		   sizeof(pcmd_addts->peer_addr), MLAN_MAC_ADDR_LENGTH);
+
+	LEAVE();
+
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares the command of HOST DELTS
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_wmm_host_delts_req(pmlan_private pmpriv,
+					HostCmd_DS_COMMAND *cmd,
+					t_void *pdata_buf)
+{
+	mlan_ds_tx_delts_cfg *pdelts = (mlan_ds_tx_delts_cfg *)pdata_buf;
+	HostCmd_DS_WMM_HOST_DELTS_REQ *pcmd_delts = &cmd->params.host_del_ts;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_WMM_HOST_DELTS_REQ);
+	cmd->size = wlan_cpu_to_le16(sizeof(*pcmd_delts) + S_DS_GEN);
+	cmd->result = 0;
+
+	pcmd_delts->tsid = pdelts->tsid;
+	memcpy_ext(pmpriv->adapter, pcmd_delts->peer_addr, pdelts->peer,
+		   sizeof(pcmd_delts->peer_addr), sizeof(MLAN_MAC_ADDR_LENGTH));
+
+	LEAVE();
+
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
  *  @brief This function prepares the command of ADDTS
  *
  *  @param pmpriv       A pointer to mlan_private structure
@@ -3285,6 +4504,67 @@
 }
 
 /**
+ *  @brief Request for add a TSPEC
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   A pointer to ioctl request buffer
+ *
+ *  @return             MLAN_STATUS_PENDING --success, otherwise fail
+ */
+static mlan_status wlan_wmm_ioctl_host_addts_req(pmlan_adapter pmadapter,
+						 pmlan_ioctl_req pioctl_req)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_wmm_cfg *cfg = MNULL;
+
+	ENTER();
+
+	cfg = (mlan_ds_wmm_cfg *)pioctl_req->pbuf;
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_WMM_HOST_ADDTS_REQ, 0, 0,
+			       (t_void *)pioctl_req,
+			       (t_void *)&cfg->param.host_addts);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief Request for delete a TSPEC
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   A pointer to ioctl request buffer
+ *
+ *  @return             MLAN_STATUS_PENDING --success, otherwise fail
+ */
+static mlan_status wlan_wmm_ioctl_host_delts_req(pmlan_adapter pmadapter,
+						 pmlan_ioctl_req pioctl_req)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_wmm_cfg *cfg = MNULL;
+
+	ENTER();
+	cfg = (mlan_ds_wmm_cfg *)pioctl_req->pbuf;
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_WMM_HOST_DELTS_REQ, 0, 0,
+			       (t_void *)pioctl_req,
+			       (t_void *)&cfg->param.host_delts);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief To get and start/stop queue stats on a WMM AC
  *
  *  @param pmadapter    A pointer to mlan_adapter structure
@@ -3594,6 +4874,12 @@
 	case MLAN_OID_WMM_CFG_DELTS:
 		status = wlan_wmm_ioctl_delts_req(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_WMM_CFG_HOST_ADDTS:
+		status = wlan_wmm_ioctl_host_addts_req(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_WMM_CFG_HOST_DELTS:
+		status = wlan_wmm_ioctl_host_delts_req(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_WMM_CFG_QUEUE_STATS:
 		status = wlan_wmm_ioctl_queue_stats(pmadapter, pioctl_req);
 		break;
@@ -3675,8 +4961,8 @@
 	tx_pkts_queued =
 		util_scalar_read(pmadapter->pmoal_handle,
 				 &priv->wmm.tx_pkts_queued, MNULL, MNULL);
-	PRINTM(MERROR, "bss_index = %d, tx_pkts_queued = %d\n", priv->bss_index,
-	       tx_pkts_queued);
+	PRINTM(MERROR, "bss_index = %d, tx_pkts_queued = %d tx_pause\n",
+	       priv->bss_index, tx_pkts_queued, priv->tx_pause);
 	if (!tx_pkts_queued)
 		return;
 	for (i = 0; i < MAX_NUM_TID; i++) {
@@ -3712,3 +4998,306 @@
 {
 	return wlan_wmm_downgrade_tid(priv, tid);
 }
+
+#define ieee_mbit_rate(float_value) ((t_u32)(float_value * 1000u))
+
+/**
+ *  @brief The function gets PHY rate in kbit/s for HE PPDU.
+ *
+ *  @param bw     PPDU bandwith
+ *  @param gi     GI type
+ *  @param nss    number of spatial streams
+ *  @param mcs    MCS
+ *
+ *  @return            PHY rate in kbit per second
+ */
+static t_u32 wlam_wmm_get_he_rate(t_u32 bw, t_u32 gi, t_u32 nss, t_u32 mcs)
+{
+	const t_u32 gi_1x_0p8 = 0;
+	const t_u32 gi_2x_0p8 = 1;
+	const t_u32 gi_2x_1p6 = 2;
+
+	const t_u32 bw_20 = 0;
+	const t_u32 bw_40 = 1;
+	const t_u32 bw_160 = 3;
+	t_u32 rate;
+
+	static const t_u32 he_80_3p2_gi_mcS_to_rate[] = {
+		ieee_mbit_rate(30.6),  ieee_mbit_rate(61.3),
+		ieee_mbit_rate(91.9),  ieee_mbit_rate(122.5),
+		ieee_mbit_rate(183.8), ieee_mbit_rate(245),
+		ieee_mbit_rate(275.6), ieee_mbit_rate(306.3),
+		ieee_mbit_rate(367.5), ieee_mbit_rate(408.3),
+		ieee_mbit_rate(459.4), ieee_mbit_rate(510.4)};
+
+	if (mcs >= NELEMENTS(he_80_3p2_gi_mcS_to_rate))
+		return 0;
+
+	rate = he_80_3p2_gi_mcS_to_rate[mcs];
+
+	// 11ax scaling rules
+	// 1.6_gi_rate = 0.8_gi_rate / 1.059
+	// 3.2_gi_rate = 1.6_gi_rate / 1.112
+	// 160mhz_rate = 80mhz_rate * 2.0
+	// 40mhz_rate = 80mhz_rate / 2.09
+	// 20mhz_rate = 40mhz_rate / 2
+
+	if (gi == gi_1x_0p8 || gi == gi_2x_0p8) {
+		rate = (rate * 1112u) / 1000u;
+		rate = (rate * 1059u) / 1000u;
+	} else if (gi == gi_2x_1p6) {
+		rate = (rate * 1112u) / 1000u;
+	}
+
+	if (bw == bw_20) {
+		rate = (rate * 1000u) / 2090u;
+		rate /= 2;
+	} else if (bw == bw_40) {
+		rate = (rate * 1000u) / 2090u;
+	} else if (bw == bw_160) {
+		rate *= 2;
+	}
+
+	rate = rate * nss;
+
+	// coverity[integer_overflow:SUPPRESS]
+	return rate;
+}
+
+/**
+ *  @brief The function gets PHY rate in kbit/s for VHT PPDU.
+ *
+ *  @param bw     PPDU bandwith
+ *  @param sgi    short GI
+ *  @param nss    number of spatial streams
+ *  @param mcs    MCS
+ *
+ *  @return            PHY rate in kbit per second
+ */
+static t_u32 wlam_wmm_get_vht_rate(t_u32 bw, t_u32 sgi, t_u32 nss, t_u32 mcs)
+{
+	const t_u32 bw_20 = 0;
+	const t_u32 bw_40 = 1;
+	const t_u32 bw_160 = 3;
+	t_u32 rate;
+
+	static const t_u32 vht_80_lgi_mcs_to_rate[] = {
+		ieee_mbit_rate(29.3),  ieee_mbit_rate(58.5),
+		ieee_mbit_rate(87.8),  ieee_mbit_rate(117.0),
+		ieee_mbit_rate(175.5), ieee_mbit_rate(234.0),
+		ieee_mbit_rate(263.3), ieee_mbit_rate(292.5),
+		ieee_mbit_rate(351.0), ieee_mbit_rate(390.0)};
+
+	if (mcs >= NELEMENTS(vht_80_lgi_mcs_to_rate))
+		return 0;
+
+	rate = vht_80_lgi_mcs_to_rate[mcs];
+
+	// 11ac scaling rules:
+	// sgi_rate = lgi_rate * 1.111
+	// 160mhz_rate = 80_mhz_rate * 2.0
+	// 40mhz_rate = 80_mhz_rate / 2.166
+	// 20mhz_rate = 40mhz_rate / 2.077
+	// XSS_rate = 1ss_rate * NSS
+	if (sgi)
+		rate = (rate * 1111) / 1000;
+
+	if (bw == bw_20) {
+		rate = (rate * 1000u) / 2166u;
+		rate = (rate * 1000u) / 2077u;
+	} else if (bw == bw_40) {
+		rate = (rate * 1000u) / 2166u;
+	} else if (bw == bw_160) {
+		rate *= 2;
+	}
+
+	rate = rate * nss;
+
+	// coverity[integer_overflow:SUPPRESS]
+	return rate;
+}
+
+/**
+ *  @brief The function gets PHY rate in kbit/s for HT PPDU.
+ *
+ *  @param bw     PPDU bandwith
+ *  @param sgi    short GI
+ *  @param mcs    MCS
+ *
+ *  @return            PHY rate in kbit per second
+ */
+static t_u32 wlam_wmm_get_ht_rate(t_u32 bw, t_u32 sgi, t_u32 mcs)
+{
+	const t_u32 bw_40 = 1;
+	t_u32 rate;
+
+	static const t_u32 ht_20_lgi_mcs_to_rate[] = {
+		ieee_mbit_rate(6.5),  ieee_mbit_rate(13),  ieee_mbit_rate(19.5),
+		ieee_mbit_rate(26),   ieee_mbit_rate(39),  ieee_mbit_rate(52),
+		ieee_mbit_rate(58.5), ieee_mbit_rate(65),  ieee_mbit_rate(13),
+		ieee_mbit_rate(26),   ieee_mbit_rate(39),  ieee_mbit_rate(52),
+		ieee_mbit_rate(78),   ieee_mbit_rate(104), ieee_mbit_rate(117),
+		ieee_mbit_rate(130),
+	};
+
+	if (mcs >= NELEMENTS(ht_20_lgi_mcs_to_rate))
+		return 0;
+
+	rate = ht_20_lgi_mcs_to_rate[mcs];
+
+	// 11n scaling rules:
+	// sgi_rate = lgi_rate * 1.111
+	// 40mhz_rate = 20_mhz_rate * 2.077
+
+	if (sgi)
+		rate = (rate * 1111) / 1000;
+
+	if (bw == bw_40) {
+		rate = (rate * 2077u) / 1000;
+	}
+
+	// coverity[integer_overflow:SUPPRESS]
+	return rate;
+}
+
+/**
+ *  @brief The function gets PHY rate in kbit/s for legacy PPDU.
+ *
+ *  @param rate_idx    rate index
+ *
+ *  @return            PHY rate in kbit per second
+ */
+static t_u32 wlam_wmm_get_legacy_rate(t_u32 rate_idx)
+{
+	static const t_u32 legacy_rate_idx_to_rate[] = {
+		ieee_mbit_rate(1),  ieee_mbit_rate(2),	ieee_mbit_rate(5.5),
+		ieee_mbit_rate(11), ieee_mbit_rate(22), ieee_mbit_rate(6),
+		ieee_mbit_rate(9),  ieee_mbit_rate(12), ieee_mbit_rate(18),
+		ieee_mbit_rate(24), ieee_mbit_rate(36), ieee_mbit_rate(48),
+		ieee_mbit_rate(54), ieee_mbit_rate(72),
+	};
+
+	if (rate_idx >= NELEMENTS(legacy_rate_idx_to_rate))
+		return 0;
+
+	return legacy_rate_idx_to_rate[rate_idx];
+}
+
+/**
+ *  @brief The function sets byte tx_budget based on currect TX rate and
+ *          allocated airtime.
+ *
+ *  @param priv    Pointer to the pmlan_private driver data struct
+ *  @param sta     Pointer to the wmm_sta_table data struct
+ *  @param rate    STA`s TX rate
+ *
+ *  @return N/A
+ */
+static void wlan_wmm_adjust_sta_tx_budget(pmlan_private priv,
+					  struct wmm_sta_table *sta,
+					  HostCmd_TX_RATE_QUERY *rate)
+{
+	const t_u8 ppdu_type_legacy = 0;
+	const t_u8 ppdu_type_ht = 1;
+	const t_u8 ppdu_type_vht = 2;
+	const t_u8 ppdu_type_he = 3;
+	t_u32 phy_rate = 0;
+	t_u8 nss = (rate->tx_rate >> 4) + 1;
+	t_u8 mcs = (rate->tx_rate) & 0x0f;
+	t_u8 ppdu_format = rate->tx_rate_info & 0x3;
+	t_u8 ppdu_bw = (rate->tx_rate_info >> 2) & 0x3;
+	t_u8 ru_size = (rate->ext_tx_rate_info >> 1) & 0x7;
+	t_u8 dcm = (rate->ext_tx_rate_info) & 0x1;
+	t_u8 gi = (rate->tx_rate_info >> 4) & 0x1;
+
+	gi |= (rate->tx_rate_info >> 6) & 0x02;
+
+	if (ppdu_format == ppdu_type_he)
+		phy_rate = wlam_wmm_get_he_rate(ppdu_bw, gi, nss, mcs);
+	else if (ppdu_format == ppdu_type_vht)
+		phy_rate = wlam_wmm_get_vht_rate(ppdu_bw, gi, nss, mcs);
+	else if (ppdu_format == ppdu_type_ht)
+		phy_rate = wlam_wmm_get_ht_rate(ppdu_bw, gi, rate->tx_rate);
+	else if (ppdu_format == ppdu_type_legacy)
+		phy_rate = wlam_wmm_get_legacy_rate(rate->tx_rate);
+
+	if (phy_rate > 0) {
+		const t_u32 old_phy_rate = sta->budget.phy_rate_kbps;
+		sta->budget.byte_budget_init = wlan_wmm_get_byte_budget(
+			sta->budget.time_budget_init_us, phy_rate);
+		sta->budget.phy_rate_kbps = phy_rate;
+
+		if (old_phy_rate / phy_rate >= 2 ||
+		    phy_rate / old_phy_rate >= 2) {
+			PRINTM(MWARN,
+			       "mclient: %pM rate jump %u -> %u, phy type %u\n",
+			       sta->ra, old_phy_rate, phy_rate, ppdu_format);
+		}
+	}
+
+	if (phy_rate == 0) {
+		PRINTM(MERROR,
+		       "mclient_error: invalid rate %u, tx_rate %u, nss %u, mcs %u, ppdu_format %u, ppdu_bw %u, gi %u, dcm %u, ru_size %u, budget %d sta %pM\n",
+		       phy_rate, rate->tx_rate, nss, mcs, ppdu_format, ppdu_bw,
+		       gi, dcm, ru_size, sta->budget.byte_budget_init, sta->ra);
+	}
+}
+
+/**
+ *  @brief The function is called when TX rate command response received
+ *
+ *  @param priv    Pointer to the pmlan_private driver data struct
+ *  @param mac     STA`s MAC
+ *  @param rate    STA`s TX rate
+ *
+ *  @return N/A
+ */
+void wlan_wmm_update_sta_tx_rate(pmlan_private priv, t_u8 *mac,
+				 HostCmd_TX_RATE_QUERY *rate)
+{
+	struct wmm_sta_table *sta = wlan_wmm_get_sta(priv, mac);
+
+	if (sta) {
+		priv->wmm.is_rate_update_pending = MFALSE;
+		wlan_wmm_adjust_sta_tx_budget(priv, sta, rate);
+	}
+}
+
+/**
+ *  @brief The function is called when PS state change event is received
+ *
+ *  @param priv    Pointer to the pmlan_private driver data struct
+ *  @param mac     STA`s MAC
+ *  @param sleep   NTRUE is STA is in IEEE PS mode
+ *
+ *  @return N/A
+ */
+void wlan_update_sta_ps_state(pmlan_private priv, t_u8 *mac, t_u8 sleep)
+{
+	mlan_adapter *pmadapter = priv->adapter;
+	struct wmm_sta_table *sta;
+	t_bool resume_sta = MFALSE;
+	mlan_callbacks *cbs = &pmadapter->callbacks;
+
+	cbs->moal_spin_lock(pmadapter->pmoal_handle,
+			    priv->wmm.ra_list_spinlock);
+
+	sta = wlan_wmm_get_sta(priv, mac);
+	if (sta) {
+		if (!sleep)
+			resume_sta = MTRUE;
+
+		if (sta->ps_sleep == sleep) {
+			PRINTM(MWARN,
+			       "mclient-err: %pM already in same state %u\n",
+			       sta->ra, sta->ps_sleep);
+		}
+
+		sta->ps_sleep = sleep;
+	}
+
+	cbs->moal_spin_unlock(pmadapter->pmoal_handle,
+			      priv->wmm.ra_list_spinlock);
+	if (resume_sta)
+		wlan_update_ralist_tx_pause(priv, mac, 0);
+}
diff --git a/wlan_sd8987/mlan/mlan_wmm.h b/wlan_src/mlan/mlan_wmm.h
old mode 100755
new mode 100644
similarity index 75%
rename from wlan_sd8987/mlan/mlan_wmm.h
rename to wlan_src/mlan/mlan_wmm.h
index 64fcc22..8597063
--- a/wlan_sd8987/mlan/mlan_wmm.h
+++ b/wlan_src/mlan/mlan_wmm.h
@@ -4,20 +4,29 @@
  *  of wmm functionalities
  *
  *
- *  Copyright 2008-2021 NXP
+ *  Copyright 2008-2021, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -180,6 +189,8 @@
 /** select WMM queue */
 t_u8 wlan_wmm_select_queue(mlan_private *pmpriv, t_u8 tid);
 t_void wlan_wmm_delete_peer_ralist(pmlan_private priv, t_u8 *mac);
+/** Convert the IP TOS to an WMM AC Queue assignment */
+mlan_wmm_ac_e wlan_wmm_convert_tos_to_ac(pmlan_adapter pmadapter, t_u32 tos);
 
 #ifdef STA_SUPPORT
 /*
@@ -201,6 +212,14 @@
 extern mlan_status wlan_cmd_wmm_ts_status(pmlan_private pmpriv,
 					  HostCmd_DS_COMMAND *cmd,
 					  t_void *pdata_buf);
+/** WMM HOST ADDTS request command handler */
+extern mlan_status wlan_cmd_wmm_host_addts_req(pmlan_private pmpriv,
+					       HostCmd_DS_COMMAND *cmd,
+					       t_void *pdata_buf);
+/** WMM HOST DELTS request command handler */
+extern mlan_status wlan_cmd_wmm_host_delts_req(pmlan_private pmpriv,
+					       HostCmd_DS_COMMAND *cmd,
+					       t_void *pdata_buf);
 
 /*
  *  Functions used in the cmdresp handling routine
@@ -241,4 +260,20 @@
 
 mlan_status wlan_wmm_cfg_ioctl(pmlan_adapter pmadapter,
 			       pmlan_ioctl_req pioctl_req);
+
+void wlan_wmm_update_sta_tx_rate(pmlan_private priv, t_u8 *mac,
+				 HostCmd_TX_RATE_QUERY *rate);
+
+void wlan_wmm_consume_byte_budget(raListTbl *ra_list, mlan_buffer *pmbuf);
+void wlan_wmm_consume_mpdu_budget(raListTbl *ra_list);
+
+static INLINE void wlan_advance_bss_on_pkt_push(pmlan_adapter pmadapter,
+						mlan_bssprio_tbl *bssprio_tbl)
+{
+	if (pmadapter->mclient_tx_supported)
+		return;
+
+	bssprio_tbl->bssprio_cur = bssprio_tbl->bssprio_cur->pnext;
+}
+
 #endif /* !_MLAN_WMM_H_ */
diff --git a/wlan_src/mlinux/mlan.h b/wlan_src/mlinux/mlan.h
new file mode 100644
index 0000000..39b74ff
--- /dev/null
+++ b/wlan_src/mlinux/mlan.h
@@ -0,0 +1,46 @@
+/** @file mlan.h
+ *
+ *  @brief This file declares all APIs that will be called from MOAL module.
+ *  It also defines the data structures used for APIs between MLAN and MOAL.
+ *
+ *
+ *  Copyright 2008-2021 NXP
+ *
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
+ *
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ *
+ */
+
+/******************************************************
+Change log:
+    10/13/2008: initial version
+    11/07/2008: split mlan.h into mlan_decl.h & mlan_ioctl.h
+******************************************************/
+
+#ifndef _MLAN_H_
+#define _MLAN_H_
+
+#include "mlan_decl.h"
+#include "mlan_ioctl.h"
+#include "mlan_ieee.h"
+
+#endif /* !_MLAN_H_ */
diff --git a/wlan_sd8987/mlan/mlan_decl.h b/wlan_src/mlinux/mlan_decl.h
old mode 100755
new mode 100644
similarity index 79%
copy from wlan_sd8987/mlan/mlan_decl.h
copy to wlan_src/mlinux/mlan_decl.h
index 3f43ae7..d537b08
--- a/wlan_sd8987/mlan/mlan_decl.h
+++ b/wlan_src/mlinux/mlan_decl.h
@@ -3,29 +3,35 @@
  *  @brief This file declares the generic data structures and APIs.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2022, 2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
 #ifndef _MLAN_DECL_H_
 #define _MLAN_DECL_H_
 
-/** MLAN release version */
-#define MLAN_RELEASE_VERSION "368.p3"
-
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
 typedef signed char t_s8, *t_ps8;
@@ -181,6 +187,11 @@
 #define MLAN_WFD_COEX_AMPDU_DEF_RXWINSIZE 16
 #endif
 
+/** NAN use the same window size for tx/rx */
+#define MLAN_NAN_AMPDU_DEF_TXRXWINSIZE 16
+/** RX winsize for COEX */
+#define MLAN_NAN_COEX_AMPDU_DEF_RXWINSIZE 16
+
 /** Block ack timeout value */
 #define MLAN_DEFAULT_BLOCK_ACK_TIMEOUT 0xffff
 /** Maximum Tx Win size configured for ADDBA request [10 bits] */
@@ -204,6 +215,8 @@
 #define MLAN_RATE_INDEX_MCS4 4
 /** Rate index for MCS 7 */
 #define MLAN_RATE_INDEX_MCS7 7
+/** Rate index for MCS 8 */
+#define MLAN_RATE_INDEX_MCS8 8
 /** Rate index for MCS 9 */
 #define MLAN_RATE_INDEX_MCS9 9
 /** Rate index for MCS11 */
@@ -262,12 +275,29 @@
 #define FW_RELOAD_NO_EMULATION 2
 /** out band reset with interface re-emulation */
 #define FW_RELOAD_WITH_EMULATION 3
-#ifdef PCIE
 /** pcie card reset */
 #define FW_RELOAD_PCIE_RESET 4
-#endif
+/** sdio hw reset */
 #define FW_RELOAD_SDIO_HW_RESET 5
+/** pcie inband reset */
+#define FW_RELOAD_PCIE_INBAND_RESET 6
 
+/** auto fw reload enable */
+#define AUTO_FW_RELOAD_ENABLE MBIT(0)
+/** auto fw reload enable pcie inband reset */
+#define AUTO_FW_RELOAD_PCIE_INBAND_RESET MBIT(1)
+
+#ifdef PCIE
+/* Interrupt type */
+enum {
+	RX_DATA,
+	RX_EVENT,
+	TX_COMPLETE,
+	RX_CMD_RESP,
+	RX_CMD_DNLD,
+	RX_DATA_DELAY
+};
+#endif
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
 #define MLAN_USB_AGGR_MODE_NUM (0)
@@ -373,13 +403,20 @@
 /** 8801 card type */
 #define CARD_TYPE_8801 0x0a
 /** OWL card type */
-#define CARD_TYPE_NW62X 0x0b
+#define CARD_TYPE_IW624 0x0b
+/** Black bird card type */
+#define CARD_TYPE_AW693 0x0c
+/** IW610 card type */
+#define CARD_TYPE_IW610 0x0d
 
 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
 #define CHIP_9098_REV_A1 2
 /** 9097 CHIP REV */
 #define CHIP_9097_REV_B0 1
+/** Blackbird reverion num */
+#define CHIP_AW693_REV_A0 1
+#define CHIP_AW693_REV_A1 2
 
 #define INTF_MASK 0xff
 #define CARD_TYPE_MASK 0xff
@@ -405,8 +442,12 @@
 #define CARD_TYPE_SD9177 (CARD_TYPE_9177 | (INTF_SD << 8))
 /** SD8801 card type */
 #define CARD_TYPE_SD8801 (CARD_TYPE_8801 | (INTF_SD << 8))
-/** SD_NW62X card type */
-#define CARD_TYPE_SDNW62X (CARD_TYPE_NW62X | (INTF_SD << 8))
+/** SD_IW624 card type */
+#define CARD_TYPE_SDIW624 (CARD_TYPE_IW624 | (INTF_SD << 8))
+/** SD_IW624 card type */
+#define CARD_TYPE_SDAW693 (CARD_TYPE_AW693 | (INTF_SD << 8))
+/** SD_IW610 card type */
+#define CARD_TYPE_SDIW610 (CARD_TYPE_IW610 | (INTF_SD << 8))
 
 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@@ -418,7 +459,9 @@
 #define IS_SD9098(ct) (CARD_TYPE_SD9098 == (ct))
 #define IS_SD9177(ct) (CARD_TYPE_SD9177 == (ct))
 #define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
-#define IS_SDNW62X(ct) (CARD_TYPE_SDNW62X == (ct))
+#define IS_SDIW624(ct) (CARD_TYPE_SDIW624 == (ct))
+#define IS_SDAW693(ct) (CARD_TYPE_SDAW693 == (ct))
+#define IS_SDIW610(ct) (CARD_TYPE_SDIW610 == (ct))
 
 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@@ -440,8 +483,12 @@
 #define CARD_SD9177 "SDIW612"
 /** SD8801 Card */
 #define CARD_SD8801 "SD8801"
-/** SDNW62X Card */
-#define CARD_SDNW62X "SDNW62X"
+/** SDIW624 Card */
+#define CARD_SDIW624 "SDIW624"
+/** SDAW693 Card */
+#define CARD_SDAW693 "SDAW693"
+/** SDIW610 Card */
+#define CARD_SDIW610 "SDIW610"
 #endif
 
 #ifdef PCIE
@@ -453,14 +500,17 @@
 #define CARD_TYPE_PCIE9097 (CARD_TYPE_9097 | (INTF_PCIE << 8))
 /** PCIE9098 card type */
 #define CARD_TYPE_PCIE9098 (CARD_TYPE_9098 | (INTF_PCIE << 8))
-/** PCIENW62X card type */
-#define CARD_TYPE_PCIENW62X (CARD_TYPE_NW62X | (INTF_PCIE << 8))
+/** PCIEIW624 card type */
+#define CARD_TYPE_PCIEIW624 (CARD_TYPE_IW624 | (INTF_PCIE << 8))
+/** PCIEAW693 card type */
+#define CARD_TYPE_PCIEAW693 (CARD_TYPE_AW693 | (INTF_PCIE << 8))
 
 #define IS_PCIE8897(ct) (CARD_TYPE_PCIE8897 == (ct))
 #define IS_PCIE8997(ct) (CARD_TYPE_PCIE8997 == (ct))
 #define IS_PCIE9097(ct) (CARD_TYPE_PCIE9097 == (ct))
 #define IS_PCIE9098(ct) (CARD_TYPE_PCIE9098 == (ct))
-#define IS_PCIENW62X(ct) (CARD_TYPE_PCIENW62X == (ct))
+#define IS_PCIEIW624(ct) (CARD_TYPE_PCIEIW624 == (ct))
+#define IS_PCIEAW693(ct) (CARD_TYPE_PCIEAW693 == (ct))
 
 /** PCIE8897 Card */
 #define CARD_PCIE8897 "PCIE8897"
@@ -474,8 +524,10 @@
 #define CARD_PCIE9098 "PCIE9098"
 /** PCIEAW690 Card */
 #define CARD_PCIEAW690 "PCIEAW690"
-/** PCIENW62X Card */
-#define CARD_PCIENW62X "PCIENW62X"
+/** PCIEIW624 Card */
+#define CARD_PCIEIW624 "PCIEIW624"
+/** PCIEAW693 Card */
+#define CARD_PCIEAW693 "PCIEAW693"
 /** PCIEIW629 Card */
 #define CARD_PCIEIW629 "PCIEIW629"
 #endif
@@ -493,8 +545,10 @@
 #define CARD_TYPE_USB9098 (CARD_TYPE_9098 | (INTF_USB << 8))
 /** USB9097 card type */
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
-/** USBNW62X card type */
-#define CARD_TYPE_USBNW62X (CARD_TYPE_NW62X | (INTF_USB << 8))
+/** USBIW624 card type */
+#define CARD_TYPE_USBIW624 (CARD_TYPE_IW624 | (INTF_USB << 8))
+/** USBIW610 card type */
+#define CARD_TYPE_USBIW610 (CARD_TYPE_IW610 | (INTF_USB << 8))
 
 #define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
@@ -502,7 +556,8 @@
 #define IS_USB8978(ct) (CARD_TYPE_USB8978 == (ct))
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
-#define IS_USBNW62X(ct) (CARD_TYPE_USBNW62X == (ct))
+#define IS_USBIW624(ct) (CARD_TYPE_USBIW624 == (ct))
+#define IS_USBIW610(ct) (CARD_TYPE_USBIW610 == (ct))
 
 /** USB8801 Card */
 #define CARD_USB8801 "USB8801"
@@ -516,20 +571,25 @@
 #define CARD_USB9098 "USB9098"
 /** USB9097 Card */
 #define CARD_USB9097 "USBIW620"
-/** USBNW62X Card */
-#define CARD_USBNW62X "USBNW62X"
+/** USBIW624 Card */
+#define CARD_USBIW624 "USBIW624"
+/** USBIW610 Card */
+#define CARD_USBIW610 "USBIW610"
 #endif
 
 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
 #define IS_CARD8887(ct) (CARD_TYPE_8887 == ((ct)&0xf))
 #define IS_CARD8897(ct) (CARD_TYPE_8897 == ((ct)&0xf))
 #define IS_CARD8977(ct) (CARD_TYPE_8977 == ((ct)&0xf))
+#define IS_CARD8978(ct) (CARD_TYPE_8978 == ((ct)&0xf))
 #define IS_CARD8997(ct) (CARD_TYPE_8997 == ((ct)&0xf))
 #define IS_CARD8987(ct) (CARD_TYPE_8987 == ((ct)&0xf))
 #define IS_CARD9098(ct) (CARD_TYPE_9098 == ((ct)&0xf))
 #define IS_CARD9097(ct) (CARD_TYPE_9097 == ((ct)&0xf))
 #define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
-#define IS_CARDNW62X(ct) (CARD_TYPE_NW62X == ((ct)&0xf))
+#define IS_CARDIW624(ct) (CARD_TYPE_IW624 == ((ct)&0xf))
+#define IS_CARDAW693(ct) (CARD_TYPE_AW693 == ((ct)&0xf))
+#define IS_CARDIW610(ct) (CARD_TYPE_IW610 == ((ct)&0xf))
 
 typedef struct _card_type_entry {
 	t_u16 card_type;
@@ -599,8 +659,14 @@
 
 #define MLAN_BUF_FLAG_TX_CTRL MBIT(14)
 
+#define MLAN_BUF_FLAG_EASYMESH MBIT(16)
+
 #define MLAN_BUF_FLAG_MC_AGGR_PKT MBIT(17)
 
+#define MLAN_BUF_FLAG_TCP_PKT MBIT(18)
+
+#define MLAN_BUF_FLAG_LLDE_PKT_FILTER MBIT(19)
+
 #ifdef DEBUG_LEVEL1
 /** Debug level bit definition */
 #define MMSG MBIT(0)
@@ -611,8 +677,8 @@
 #define MEVENT MBIT(5)
 #define MINTR MBIT(6)
 #define MIOCTL MBIT(7)
-
 #define MREG_D MBIT(9)
+#define MREG MBIT(10)
 
 #define MMPA_D MBIT(15)
 #define MDAT_D MBIT(16)
@@ -620,7 +686,8 @@
 #define MEVT_D MBIT(18)
 #define MFW_D MBIT(19)
 #define MIF_D MBIT(20)
-
+#define MFWDP_D MBIT(21)
+#define MSCH_D MBIT(22)
 #define MENTRY MBIT(28)
 #define MWARN MBIT(29)
 #define MINFO MBIT(30)
@@ -631,6 +698,8 @@
 #define MLAN_MEM_DMA MBIT(0)
 /** Memory allocation flag: ATOMIC */
 #define MLAN_MEM_FLAG_ATOMIC MBIT(1)
+/** Memory allocation flag: DIRTY - do not memset to 0 buffer */
+#define MLAN_MEM_FLAG_DIRTY MBIT(2)
 
 /** Default memory allocation flag */
 #define MLAN_MEM_DEF 0
@@ -724,6 +793,7 @@
 #ifdef WIFI_DIRECT_SUPPORT
 	MLAN_BSS_TYPE_WIFIDIRECT = 2,
 #endif
+	MLAN_BSS_TYPE_NAN = 4,
 	MLAN_BSS_TYPE_DFS = 8,
 	MLAN_BSS_TYPE_ANY = 0xff,
 } mlan_bss_type;
@@ -751,8 +821,6 @@
 typedef enum _mlan_event_id {
 	/* Event generated by firmware (MSB=0) */
 	MLAN_EVENT_ID_FW_UNKNOWN = 0x00000001,
-	MLAN_EVENT_ID_FW_ADHOC_LINK_SENSED = 0x00000002,
-	MLAN_EVENT_ID_FW_ADHOC_LINK_LOST = 0x00000003,
 	MLAN_EVENT_ID_FW_DISCONNECTED = 0x00000004,
 	MLAN_EVENT_ID_FW_MIC_ERR_UNI = 0x00000005,
 	MLAN_EVENT_ID_FW_MIC_ERR_MUL = 0x00000006,
@@ -799,6 +867,7 @@
 	MLAN_EVENT_ID_SSU_DUMP_FILE = 0x00000039,
 #endif /* SSU_SUPPORT */
 	MLAN_EVENT_ID_CSI = 0x00000040,
+	MLAN_EVENT_ID_FW_TX_BULK_STATUS = 0x00000043,
 	/* Event generated by MLAN driver (MSB=1) */
 	MLAN_EVENT_ID_DRV_CONNECTED = 0x80000001,
 	MLAN_EVENT_ID_DRV_DEFER_HANDLING = 0x80000002,
@@ -822,11 +891,21 @@
 	MLAN_EVENT_ID_DRV_UAP_CHAN_INFO = 0x80000020,
 #endif
 	MLAN_EVENT_ID_FW_ROAM_OFFLOAD_RESULT = 0x80000023,
+	MLAN_EVENT_ID_NAN_STARTED = 0x80000024,
+	MLAN_EVENT_ID_DRV_RTT_RESULT = 0x80000025,
 	MLAN_EVENT_ID_DRV_ASSOC_FAILURE_LOGGER = 0x80000026,
 	MLAN_EVENT_ID_DRV_ASSOC_SUCC_LOGGER = 0x80000027,
 	MLAN_EVENT_ID_DRV_DISCONNECT_LOGGER = 0x80000028,
 	MLAN_EVENT_ID_DRV_WIFI_STATUS = 0x80000029,
 	MLAN_EVENT_ID_STORE_HOST_CMD_RESP = 0x80000030,
+	MLAN_EVENT_ID_DRV_ADDBA_TIMEOUT = 0x80000031,
+#ifdef PCIE
+	MLAN_EVENT_ID_DRV_DEFER_RX_DATA = 0x80000032,
+	MLAN_EVENT_ID_DRV_DEFER_CMDRESP = 0x80000034,
+	MLAN_EVENT_ID_DRV_DEFER_TX_COMPLTE = 0x80000035,
+	MLAN_EVENT_ID_DRV_DELAY_TX_COMPLETE = 0x80000036,
+#endif
+	MLAN_EVENT_ID_DRV_RGPWR_KEY_MISMATCH = 0x80000037,
 } mlan_event_id;
 
 /** Data Structures */
@@ -876,7 +955,9 @@
 
 #define OID_TYPE_CAL 0x2
 #define OID_TYPE_DPD 0xa
+#define NONE_TYPE_DPD 0xb
 #define UNKNOW_DPD_LENGTH 0xffffffff
+#define NONE_DPD_LENGTH 0xfafafafa
 
 /** Custom data structure */
 typedef struct _mlan_init_param {
@@ -979,10 +1060,10 @@
 	t_u8 chan2Offset : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 #else
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
@@ -1157,6 +1238,10 @@
 	t_u8 mcs_index;
 	/** bitrate, in 500Kbps */
 	t_u16 bitrate;
+	/** NSS */
+	t_u8 nss_index;
+	/** DCM */
+	t_u8 dcm;
 } MLAN_PACK_END mix_rate_info, *pmix_rate_info;
 
 typedef MLAN_PACK_START struct _rxpd_extra_info {
@@ -1168,10 +1253,12 @@
 	t_u8 mcs_known;
 	/** mcs.flags */
 	t_u8 mcs_flags;
-	/** vht sig1 */
-	t_u32 vht_sig1;
-	/** vht sig2 */
-	t_u32 vht_sig2;
+	/** vht/he sig1 */
+	t_u32 vht_he_sig1;
+	/** vht/he sig2 */
+	t_u32 vht_he_sig2;
+	/** HE user idx */
+	t_u32 user_idx;
 } MLAN_PACK_END rxpd_extra_info, *prxpd_extra_info;
 
 typedef MLAN_PACK_START struct _radiotap_info {
@@ -1259,7 +1346,19 @@
 	/** mc_pkt_flags */
 	t_u8 mc_pkt_flags;
 } MLAN_PACK_END mc_txcontrol, *pmc_txcontrol;
-
+typedef MLAN_PACK_START struct MAPP_Stats_Mcast_drv {
+	t_u32 cycle_recv_under_2300usec;
+	t_u32 cycle_recv_in_time;
+	t_u32 cycle_recv_over_2900usec;
+	t_u32 cycle_recv_over_3500usec;
+	t_u32 cycle_recv_over_5000usec;
+	t_u32 cycle_recv_over_10000usec;
+	t_u32 cycle_recv_over_15000usec;
+	t_u32 spent_time_under_1000usec;
+	t_u32 spent_time_over_1000usec;
+	t_u32 spent_time_over_2000usec;
+	t_u32 spent_time_over_3000usec;
+} MLAN_PACK_END Stats_mcast_drv_t, *pStats_mcast_drv_t;
 /** mlan_buffer data structure */
 typedef struct _mlan_buffer {
 	/** Pointer to previous mlan_buffer */
@@ -1305,6 +1404,8 @@
 	t_u32 extra_ts_sec;
 	/** Time stamp when packet is dequed from rx_q(micro seconds) */
 	t_u32 extra_ts_usec;
+	/** When TX ra mac address,  When Rx Ta mac address*/
+	t_u8 mac[MLAN_MAC_ADDR_LENGTH];
 	/** Fields below are valid for MLAN module only */
 	/** Pointer to parent mlan_buffer */
 	struct _mlan_buffer *pparent;
@@ -1546,7 +1647,7 @@
 	/** Key Length */
 	t_u8 key_length;
 	/** actual key */
-	t_u8 key[1];
+	t_u8 key[];
 } MLAN_PACK_END tdls_each_link_status;
 
 /** TDLS configuration data */
@@ -1673,7 +1774,7 @@
 			/** number of links */
 			t_u8 active_links;
 			/** structure for link status */
-			tdls_each_link_status link_stats[1];
+			tdls_each_link_status link_stats[];
 		} MLAN_PACK_END tdls_link_status_resp;
 
 	} u;
@@ -1695,6 +1796,14 @@
 	t_u16 reason_code;
 } tdls_tear_down_event;
 
+/** Event structure for addba timeout */
+typedef struct _addba_timeout_event {
+	/** Peer mac address */
+	t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+	/** Tid */
+	t_u8 tid;
+} addba_timeout_event;
+
 /** channel width */
 typedef enum wifi_channel_width {
 	WIFI_CHAN_WIDTH_20 = 0,
@@ -1788,7 +1897,6 @@
 typedef enum {
 	MLAN_INTERFACE_STA = 0,
 	MLAN_INTERFACE_SOFTAP = 1,
-	MLAN_INTERFACE_IBSS = 2,
 	MLAN_INTERFACE_P2P_CLIENT = 3,
 	MLAN_INTERFACE_P2P_GO = 4,
 	MLAN_INTERFACE_NAN = 5,
@@ -1912,6 +2020,14 @@
 	WIFI_PEER_INVALID,
 } wifi_peer_type;
 
+typedef struct bssload_info {
+	/** station count */
+	t_u16 sta_count;
+	/** channel utilization */
+	t_u16 chan_util;
+	t_u8 PAD[4];
+} bssload_info_t;
+
 /** per peer statistics */
 typedef struct {
 	/** peer type (AP, TDLS, GO etc.) */
@@ -1920,6 +2036,8 @@
 	t_u8 peer_mac_address[6];
 	/** peer WIFI_CAPABILITY_XXX */
 	t_u32 capabilities;
+	/** STA count and channel utilization */
+	bssload_info_t bssload;
 	/** number of rates */
 	t_u32 num_rate;
 	/** per rate statistics, number of entries  = num_rate */
@@ -2035,6 +2153,308 @@
 	0x00000080 /** all contention (min, max, avg) statistics (within ac    \
 		      statisctics) */
 
+/** =========== Define Copied from HAL START =========== */
+/** Ranging status */
+typedef enum {
+	RTT_STATUS_SUCCESS = 0,
+	/** general failure status */
+	RTT_STATUS_FAILURE = 1,
+	/** target STA does not respond to request */
+	RTT_STATUS_FAIL_NO_RSP = 2,
+	/** request rejected. Applies to 2-sided RTT only */
+	RTT_STATUS_FAIL_REJECTED = 3,
+	RTT_STATUS_FAIL_NOT_SCHEDULED_YET = 4,
+	/** timing measurement times out */
+	RTT_STATUS_FAIL_TM_TIMEOUT = 5,
+	/** Target on different channel, cannot range */
+	RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6,
+	/** ranging not supported */
+	RTT_STATUS_FAIL_NO_CAPABILITY = 7,
+	/** request aborted for unknown reason */
+	RTT_STATUS_ABORTED = 8,
+	/** Invalid T1-T4 timestamp */
+	RTT_STATUS_FAIL_INVALID_TS = 9,
+	/** 11mc protocol failed */
+	RTT_STATUS_FAIL_PROTOCOL = 10,
+	/** request could not be scheduled */
+	RTT_STATUS_FAIL_SCHEDULE = 11,
+	/** responder cannot collaborate at time of request */
+	RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,
+	/** bad request args */
+	RTT_STATUS_INVALID_REQ = 13,
+	/** WiFi not enabled */
+	RTT_STATUS_NO_WIFI = 14,
+	/** Responder overrides param info, cannot range with new params */
+	RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE = 15
+} wifi_rtt_status;
+
+/** RTT peer type */
+typedef enum {
+	RTT_PEER_AP = 0x1,
+	RTT_PEER_STA = 0x2,
+	RTT_PEER_P2P_GO = 0x3,
+	RTT_PEER_P2P_CLIENT = 0x4,
+	RTT_PEER_NAN = 0x5
+} rtt_peer_type;
+
+/** RTT Measurement Bandwidth */
+typedef enum {
+	WIFI_RTT_BW_5 = 0x01,
+	WIFI_RTT_BW_10 = 0x02,
+	WIFI_RTT_BW_20 = 0x04,
+	WIFI_RTT_BW_40 = 0x08,
+	WIFI_RTT_BW_80 = 0x10,
+	WIFI_RTT_BW_160 = 0x20
+} wifi_rtt_bw;
+
+/** RTT Type */
+typedef enum {
+	RTT_TYPE_1_SIDED = 0x1,
+	RTT_TYPE_2_SIDED = 0x2,
+} wifi_rtt_type;
+
+/** RTT configuration */
+typedef struct {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	wifi_rtt_type type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	rtt_peer_type peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	wifi_channel_info channel;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u32 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u32 num_burst;
+	/** num of frames per burst. Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames to be attempted in a
+	 * single burst. This also equals the number of FTM frames that the
+	 * initiator will request that the responder send in a single frame. */
+	t_u32 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can retry an FTMR
+	 * frame. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u32 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	wifi_preamble preamble;
+	/** RTT BW to be used in the RTT frames */
+	wifi_rtt_bw bw;
+} wifi_rtt_config;
+
+/** Format of information elements found in the beacon */
+typedef struct {
+	/** element identifier */
+	t_u8 id;
+	/** number of bytes to follow */
+	t_u8 len;
+	t_u8 data[];
+} wifi_information_element;
+
+/** RTT results */
+typedef struct {
+	/** device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** burst number in a multi-burst request */
+	t_u32 burst_num;
+	/** Total RTT measurement frames attempted */
+	t_u32 measurement_number;
+	/** Total successful RTT measurement frames */
+	t_u32 success_number;
+	/** Maximum number of "FTM frames per burst" supported by
+	 * the responder STA. Applies to 2-sided RTT only.
+	 * If reponder overrides with larger value:
+	 * - for single-burst request initiator will truncate the
+	 * larger value and send a TMR_STOP after receiving as
+	 * many frames as originally requested.
+	 * - for multi-burst request, initiator will return
+	 * failure right away */
+	t_u8 number_per_burst_peer;
+	/** ranging status */
+	wifi_rtt_status status;
+	/** When status == RTT_STATUS_FAIL_BUSY_TRY_LATER,
+	 * this will be the time provided by the responder as to
+	 * when the request can be tried again. Applies to 2-sided
+	 * RTT only. In sec, 1-31sec. */
+	t_u8 retry_after_duration;
+	/** RTT type */
+	wifi_rtt_type type;
+	/** average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB */
+	int rssi;
+	/** rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
+	 */
+	int rssi_spread;
+	/** 1-sided RTT: TX rate of RTT frame.
+	 * 2-sided RTT: TX rate of initiator's Ack in response to FTM frame. */
+	wifi_rate tx_rate;
+	/** 1-sided RTT: TX rate of Ack from other side.
+	 * 2-sided RTT: TX rate of FTM frame coming from responder. */
+	wifi_rate rx_rate;
+	/** round trip time in picoseconds */
+	t_s64 rtt;
+	/** rtt standard deviation in picoseconds */
+	t_s64 rtt_sd;
+	/** difference between max and min rtt times recorded in picoseconds */
+	t_s64 rtt_spread;
+	/** distance in mm (optional) */
+	int distance_mm;
+	/** standard deviation in mm (optional) */
+	int distance_sd_mm;
+	/** difference between max and min distance recorded in mm (optional) */
+	int distance_spread_mm;
+	/** time of the measurement (in microseconds since boot) */
+	t_s64 ts;
+	/** in ms, actual time taken by the FW to finish one burst
+	 * measurement. Applies to 1-sided and 2-sided RTT. */
+	int burst_duration;
+	/** Number of bursts allowed by the responder. Applies
+	 * to 2-sided RTT only. */
+	int negotiated_burst_num;
+	/** for 11mc only */
+	wifi_information_element *LCI;
+	/** for 11mc only */
+	wifi_information_element *LCR;
+} wifi_rtt_result;
+
+/** Preamble definition for bit mask used in wifi_rtt_capabilities */
+#define PREAMBLE_LEGACY 0x1
+#define PREAMBLE_HT 0x2
+#define PREAMBLE_VHT 0x4
+
+/** BW definition for bit mask used in wifi_rtt_capabilities */
+#define BW_5_SUPPORT 0x1
+#define BW_10_SUPPORT 0x2
+#define BW_20_SUPPORT 0x4
+#define BW_40_SUPPORT 0x8
+#define BW_80_SUPPORT 0x10
+#define BW_160_SUPPORT 0x20
+
+/** RTT Capabilities */
+typedef struct {
+	/** if 1-sided rtt data collection is supported */
+	t_u8 rtt_one_sided_supported;
+	/** if ftm rtt data collection is supported */
+	t_u8 rtt_ftm_supported;
+	/** if initiator supports LCI request. Applies to 2-sided RTT */
+	t_u8 lci_support;
+	/** if initiator supports LCR request. Applies to 2-sided RTT */
+	t_u8 lcr_support;
+	/** bit mask indicates what preamble is supported by initiator */
+	t_u8 preamble_support;
+	/** bit mask indicates what BW is supported by initiator */
+	t_u8 bw_support;
+	/** if 11mc responder mode is supported */
+	t_u8 responder_supported;
+	/** draft 11mc spec version supported by chip. For instance,
+	 * version 4.0 should be 40 and version 4.3 should be 43 etc. */
+	t_u8 mc_version;
+} wifi_rtt_capabilities;
+
+/** API for setting LCI/LCR information to be provided to a requestor */
+typedef enum {
+	/** Not expected to change location */
+	WIFI_MOTION_NOT_EXPECTED = 0,
+	/** Expected to change location */
+	WIFI_MOTION_EXPECTED = 1,
+	/** Movement pattern unknown */
+	WIFI_MOTION_UNKNOWN = 2,
+} wifi_motion_pattern;
+
+/** LCI information */
+typedef struct {
+	/** latitude in degrees * 2^25 , 2's complement */
+	long latitude;
+	/** latitude in degrees * 2^25 , 2's complement */
+	long longitude;
+	/** Altitude in units of 1/256 m */
+	int altitude;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 latitude_unc;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 longitude_unc;
+	/** As defined in Section 2.4.5 from IETF RFC 6225: */
+	t_u8 altitude_unc;
+	/** Following element for configuring the Z subelement */
+	wifi_motion_pattern motion_pattern;
+	/** floor in units of 1/16th of floor. 0x80000000 if unknown. */
+	int floor;
+	/** in units of 1/64 m */
+	int height_above_floor;
+	/** in units of 1/64 m. 0 if unknown */
+	int height_unc;
+} wifi_lci_information;
+
+/** LCR information */
+typedef struct {
+	/** country code */
+	char country_code[2];
+	/** length of the info field */
+	int length;
+	/** Civic info to be copied in FTM frame */
+	char civic_info[256];
+} wifi_lcr_information;
+
+/**
+ * RTT Responder information
+ */
+typedef struct {
+	wifi_channel_info channel;
+	wifi_preamble preamble;
+} wifi_rtt_responder;
+
+/** =========== Define Copied from HAL END =========== */
+
+#define MAX_RTT_CONFIG_NUM 10
+
+/** RTT config params */
+typedef struct wifi_rtt_config_params {
+	t_u8 rtt_config_num;
+	wifi_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} wifi_rtt_config_params_t;
+
+#define OID_RTT_REQUEST 0
+#define OID_RTT_CANCEL 1
+
+/** Pass RTT result element between mlan and moal */
+typedef struct {
+	/** element identifier  */
+	t_u16 id;
+	/** number of bytes to follow  */
+	t_u16 len;
+	/** data: fill with one wifi_rtt_result  */
+	t_u8 data[];
+} wifi_rtt_result_element;
+
 /** station stats */
 typedef struct _sta_stats {
 	/** last_rx_in_msec */
@@ -2193,13 +2613,8 @@
 				     t_u8 antenna);
 	t_void (*moal_updata_peer_signal)(t_void *pmoal, t_u32 bss_index,
 					  t_u8 *peer_addr, t_s8 snr, t_s8 nflr);
+	mlan_status (*moal_get_host_time_ns)(t_u64 *time);
 	t_u64 (*moal_do_div)(t_u64 num, t_u32 base);
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal,
-						  t_u32 bss_index);
-	mlan_status (*moal_notify_hostcmd_complete)(t_void *pmoal,
-						    t_u32 bss_index);
-#endif
 	void (*moal_tp_accounting)(t_void *pmoal, t_void *buf,
 				   t_u32 drop_point);
 	void (*moal_tp_accounting_rx_param)(t_void *pmoal, unsigned int type,
@@ -2297,6 +2712,8 @@
 #endif
 	/** Auto deep sleep */
 	t_u32 auto_ds;
+	/** Boot Time Config */
+	t_u32 bootup_cal_ctrl;
 	/** IEEE PS mode */
 	t_u32 ps_mode;
 	/** Max Tx buffer size */
@@ -2346,6 +2763,10 @@
 	t_u8 passive_to_active_scan;
 	/** uap max supported station per chip */
 	t_u8 uap_max_sta;
+	/** wacp mode */
+	t_u8 wacp_mode;
+	/** custom Fw data */
+	t_u32 fw_data_cfg;
 	/** drv mode */
 	t_u32 drv_mode;
 	/** dfs w53 cfg */
@@ -2356,6 +2777,22 @@
 	t_u8 ext_scan;
 	/* mcs32 setting */
 	t_u8 mcs32;
+	/** second mac flag */
+	t_u8 second_mac;
+	/** napi */
+	t_u8 napi;
+	/** antcfg */
+	t_u32 antcfg;
+	/** dmcs */
+	t_u8 dmcs;
+	t_u8 pref_dbc;
+	t_u32 reject_addba_req;
+
+	t_u32 max_tx_pending;
+	t_u16 tx_budget;
+	t_u8 mclient_scheduling;
+	t_u8 disable_11h_tpc;
+	t_u32 amsdu_disable;
 } mlan_device, *pmlan_device;
 
 /** MLAN API function prototype */
@@ -2436,7 +2873,103 @@
 MLAN_API mlan_status mlan_disable_host_int(t_void *padapter);
 /** mlan unmask host interrupt */
 MLAN_API mlan_status mlan_enable_host_int(t_void *padapter);
+#ifdef PCIE
+MLAN_API void mlan_process_pcie_interrupt_cb(t_void *pmadapter, int type);
+#endif
 
 #define CSI_SIGNATURE 0xABCD
 
+/** secure add/sub **/
+#ifndef SINT8_MAX
+#define SINT8_MAX 0x7f
+#endif
+
+#ifndef SINT8_MIN
+#define SINT8_MIN 0x80
+#endif
+
+#ifndef UINT8_MAX
+#define UINT8_MAX 0xff
+#endif
+
+#ifndef SINT16_MAX
+#define SINT16_MAX 0x7fff
+#endif
+
+#ifndef SINT16_MIN
+#define SINT16_MIN 0x8000
+#endif
+
+#ifndef UINT16_MAX
+#define UINT16_MAX 0xffff
+#endif
+
+#ifndef SINT32_MAX
+#define SINT32_MAX 0x7fffffff
+#endif
+
+#ifndef SINT32_MIN
+#define SINT32_MIN 0x80000000
+#endif
+
+#ifndef UINT32_MAX
+#define UINT32_MAX 0xffffffff
+#endif
+
+#ifndef SINT64_MAX
+#define SINT64_MAX 0x7fffffffffffffff
+#endif
+
+#ifndef SINT64_MIN
+#define SINT64_MIN 0x8000000000000000
+#endif
+
+#ifndef UINT64_MAX
+#define UINT64_MAX 0xffffffffffffffff
+#endif
+
+#ifndef PTR_MAX
+#ifdef MLAN_64BIT
+#define PTR_MAX UINT64_MAX
+#else
+#define PTR_MAX UINT32_MAX
+#endif
+#endif
+
+#ifndef SINT_MAX
+#ifdef MLAN_64BIT
+#define SINT_MAX SINT64_MAX
+#else
+#define SINT_MAX SINT32_MAX
+#endif
+#endif
+
+#ifndef SINT_MIN
+#ifdef MLAN_64BIT
+#define SINT_MIN SINT64_MIN
+#else
+#define SINT_MIN SINT32_MIN
+#endif
+#endif
+
+#ifndef UINT_MAX
+#ifdef MLAN_64BIT
+#define UINT_MAX UINT64_MAX
+#else
+#define UINT_MAX UINT32_MAX
+#endif
+#endif
+
+typedef enum {
+	TYPE_SINT8,
+	TYPE_UINT8,
+	TYPE_SINT16,
+	TYPE_UINT16,
+	TYPE_SINT32,
+	TYPE_UINT32,
+	TYPE_SINT64,
+	TYPE_UINT64,
+	TYPE_PTR,
+} data_type;
+
 #endif /* !_MLAN_DECL_H_ */
diff --git a/wlan_sd8987/mlan/mlan_ieee.h b/wlan_src/mlinux/mlan_ieee.h
old mode 100755
new mode 100644
similarity index 91%
copy from wlan_sd8987/mlan/mlan_ieee.h
copy to wlan_src/mlinux/mlan_ieee.h
index cf2ef85..c80f12f
--- a/wlan_sd8987/mlan/mlan_ieee.h
+++ b/wlan_src/mlinux/mlan_ieee.h
@@ -4,20 +4,29 @@
  *  definitions used in MLAN and MOAL module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -29,6 +38,9 @@
 #ifndef _MLAN_IEEE_H_
 #define _MLAN_IEEE_H_
 
+/** WLAN header size */
+#define IEEE80211_HEADER_SIZE 24
+
 /** FIX IES size in beacon buffer */
 #define WLAN_802_11_FIXED_IE_SIZE 12
 /** WLAN supported rates */
@@ -48,7 +60,7 @@
 
 #ifdef BIG_ENDIAN_SUPPORT
 /** Frame control: Type Mgmt frame */
-#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x3000
+#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x0c00
 /** Frame control: SubType Mgmt frame */
 #define IEEE80211_GET_FC_MGMT_FRAME_SUBTYPE(fc) (((fc)&0xF000) >> 12)
 #else
@@ -68,6 +80,9 @@
 typedef enum _IEEEtypes_Ext_ElementId_e {
 	HE_CAPABILITY = 35,
 	HE_OPERATION = 36,
+	MU_EDCA_PARAM_SET = 38,
+	MBSSID_CONFIG = 55,
+	NON_INHERITANCE = 56,
 	HE_6G_CAPABILITY = 59
 } IEEEtypes_Ext_ElementId_e;
 
@@ -80,7 +95,6 @@
 	DS_PARAM_SET = 3,
 	CF_PARAM_SET = 4,
 
-	IBSS_PARAM_SET = 6,
 	COUNTRY_INFO = 7,
 	POWER_CONSTRAINT = 32,
 	POWER_CAPABILITY = 33,
@@ -89,7 +103,8 @@
 	CHANNEL_SWITCH_ANN = 37,
 	EXTEND_CHANNEL_SWITCH_ANN = 60,
 	QUIET = 40,
-	IBSS_DFS = 41,
+	MEASUREMENT_REQUEST = 38,
+	MEASUREMENT_REPORT = 39,
 	SUPPORTED_CHANNELS = 36,
 	REGULATORY_CLASS = 59,
 	HT_CAPABILITY = 45,
@@ -177,6 +192,33 @@
 	t_u8 data[IEEE_MAX_IE_SIZE - sizeof(IEEEtypes_Header_t)];
 } MLAN_PACK_END IEEEtypes_Generic_t, *pIEEEtypes_Generic_t;
 
+#define MEASURE_TYPE_CLI 8
+#define MEASURE_TYPE_LOCATION_CIVIC 9
+
+/** Measurement Report IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MeasurementReport_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Measurement Token */
+	t_u8 ms_token;
+	/** Measurement Report Mode */
+	t_u8 ms_rp_mode;
+	/** Measurement Type, value in MEASURE_TYPE_XXX */
+	t_u8 ms_type;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_MeasurementReport_t;
+
+/** Report */
+typedef MLAN_PACK_START struct _IEEEtypes_Report_t {
+	/** Subelement ID */
+	t_u8 subelement_id;
+	/** length */
+	t_u8 length;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_Report_t;
+
 /**ft capability policy*/
 typedef MLAN_PACK_START struct _IEEEtypes_FtCapPolicy_t {
 #ifdef BIG_ENDIAN_SUPPORT
@@ -230,7 +272,7 @@
 	/** SNonce */
 	t_u8 s_nonce[32];
 	/** sub element */
-	t_u8 sub_element[1];
+	t_u8 sub_element[];
 } MLAN_PACK_END IEEEtypes_FastBssTransElement_t;
 
 /*Category for FT*/
@@ -290,6 +332,27 @@
 	t_u8 variablep[];
 } MLAN_PACK_END IEEEtypes_assoc_req;
 
+/** Assoc Request */
+#define SUBTYPE_ASSOC_REQUEST 0
+/** Assoc Response */
+#define SUBTYPE_ASSOC_RESP 1
+/** ReAssoc Request */
+#define SUBTYPE_REASSOC_REQUEST 2
+/** ReAssoc Request */
+#define SUBTYPE_REASSOC_RESP 3
+/** Probe Resp */
+#define SUBTYPE_PROBE_RESP 5
+/** Disassoc Request */
+#define SUBTYPE_DISASSOC 10
+/** Auth Request */
+#define SUBTYPE_AUTH 11
+/** Deauth Request */
+#define SUBTYPE_DEAUTH 12
+/** Action frame */
+#define SUBTYPE_ACTION 13
+/** beacon */
+#define SUBTYPE_BEACON 8
+
 /*Mgmt frame*/
 typedef MLAN_PACK_START struct {
 	/** frame control */
@@ -341,15 +404,14 @@
 	t_u8 privacy : 1;
 	t_u8 cf_poll_rqst : 1;
 	t_u8 cf_pollable : 1;
-	t_u8 ibss : 1;
+	t_u8 rsrvd4 : 1;
 	t_u8 ess : 1;
 } MLAN_PACK_END IEEEtypes_CapInfo_t, *pIEEEtypes_CapInfo_t;
 #else
 typedef MLAN_PACK_START struct _IEEEtypes_CapInfo_t {
 	/** Capability Bit Map : ESS */
 	t_u8 ess : 1;
-	/** Capability Bit Map : IBSS */
-	t_u8 ibss : 1;
+	t_u8 rsrvd4 : 1;
 	/** Capability Bit Map : CF pollable */
 	t_u8 cf_pollable : 1;
 	/** Capability Bit Map : CF poll request */
@@ -405,22 +467,10 @@
 	t_u16 cfp_duration_remaining;
 } MLAN_PACK_END IEEEtypes_CfParamSet_t, *pIEEEtypes_CfParamSet_t;
 
-/** IEEEtypes_IbssParamSet_t */
-typedef MLAN_PACK_START struct _IEEEtypes_IbssParamSet_t {
-	/** Element ID */
-	t_u8 element_id;
-	/** Length */
-	t_u8 len;
-	/** ATIM window value in milliseconds */
-	t_u16 atim_window;
-} MLAN_PACK_END IEEEtypes_IbssParamSet_t, *pIEEEtypes_IbssParamSet_t;
-
 /** IEEEtypes_SsParamSet_t */
 typedef MLAN_PACK_START union _IEEEtypes_SsParamSet_t {
 	/** SS parameter : CF parameter set */
 	IEEEtypes_CfParamSet_t cf_param_set;
-	/** SS parameter : IBSS parameter set */
-	IEEEtypes_IbssParamSet_t ibss_param_set;
 } MLAN_PACK_END IEEEtypes_SsParamSet_t, *pIEEEtypes_SsParamSet_t;
 
 /** IEEEtypes_FhParamSet_t */
@@ -509,7 +559,7 @@
 	/** Association ID */
 	IEEEtypes_AId_t a_id;
 	/** IE data buffer */
-	t_u8 ie_buffer[1];
+	t_u8 ie_buffer[];
 } MLAN_PACK_END IEEEtypes_AssocRsp_t, *pIEEEtypes_AssocRsp_t;
 
 /** 802.11 supported rates */
@@ -557,7 +607,7 @@
 	/* count */
 	t_u16 count;
 	/** wpa_suite list */
-	wpa_suite list[1];
+	wpa_suite list[];
 } MLAN_PACK_END wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
 
 /** IEEEtypes_Rsn_t */
@@ -849,6 +899,28 @@
 
 } MLAN_PACK_END IEEEtypes_WMM_Tspec_Action_e;
 
+/** NAN SDF vendor oui size */
+#define NAN_SDF_VENDOR_SIZE 4
+/** NAN service descriptor attribute offset */
+#define NAN_SDA_OFFSET 5
+/** NAN service control type offset */
+#define NAN_SRVC_CTRL_OFFSET 11
+/** Service control field */
+#define NAN_SRV_CTRL_TYPE_MASK (BIT(0) | BIT(1))
+/** NAN service control type */
+#define NAN_PUBLISH 0
+#define NAN_FOLLOW_UP 2
+
+/** NAN Attribute ID list */
+typedef MLAN_PACK_START enum _Nan_AttrId_e {
+	NAN_ATTR_SDA = 0x03
+} MLAN_PACK_END Nan_AttrId_e;
+
+/** Public Action Codes */
+typedef MLAN_PACK_START enum _IEEEtypes_Public_ActionCategory_e {
+	IEEE_PUBLIC_ACTION_CATEGORY_VENDOR_SPECIFIC = 9
+} MLAN_PACK_END IEEEtypes_Public_ActionCategory_e;
+
 /** WMM TSPEC Category Action Base */
 typedef MLAN_PACK_START struct {
 	IEEEtypes_ActionCategory_e category;
@@ -925,7 +997,7 @@
 	/** Country code */
 	t_u8 country_code[COUNTRY_CODE_LEN];
 	/** Set of subbands */
-	IEEEtypes_SubbandSet_t sub_band[1];
+	IEEEtypes_SubbandSet_t sub_band[];
 } MLAN_PACK_END IEEEtypes_CountryInfoSet_t, *pIEEEtypes_CountryInfoSet_t;
 
 /** Data structure for Country IE full set */
@@ -1091,6 +1163,18 @@
 	/** Optional Subelement data*/
 	t_u8 sub_elem_data[];
 } MLAN_PACK_END IEEEtypes_MultiBSSID_t, *pIEEEtypes_MultiBSSID_t;
+
+/** Multi BSSID Configuration IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MBSSID_Config_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Element id extension */
+	t_u8 ext_id;
+	/** BSSID Count */
+	t_u8 bssid_cnt;
+	/** Full Set Rx Periodicity */
+	t_u8 fs_rx_periodicity;
+} MLAN_PACK_END IEEEtypes_MBSSID_Config_t, *pIEEEtypes_MBSSID_Config_t;
 /** 20/40 BSS Coexistence IE */
 typedef MLAN_PACK_START struct _IEEEtypes_2040BSSCo_t {
 	/** Generic IE header */
@@ -1406,6 +1490,32 @@
 	t_u8 option[9];
 } MLAN_PACK_END IEEEtypes_HeOp_t;
 
+/** MU EDCA Parameter Set */
+typedef MLAN_PACK_START struct _IEEEtypes_MUEDCAParamSet_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Extended Tag */
+	t_u8 ext_tag;
+	/** QOS Information */
+	t_u8 qos_info;
+	/** MUAC BE Paramter Record */
+	t_u8 muac_be[3];
+	/** MUAC BK Paramter Record */
+	t_u8 muac_bk[3];
+	/** MUAC VI Paramter Record */
+	t_u8 muac_vi[3];
+	/** MUAC VO Paramter Record */
+	t_u8 muac_vo[3];
+} MLAN_PACK_END IEEEtypes_MUEDCAParamSet_t, *pIEEEtypes_MUEDCAParamSet_t;
+
+/** IEEE format IE */
+typedef MLAN_PACK_START struct _IEEEtypes_Element_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** IE data */
+	t_u8 data[];
+} MLAN_PACK_END IEEEtypes_Element_t, *pIEEEtypes_Element_t;
+
 /** default channel switch count */
 #define DEF_CHAN_SWITCH_COUNT 5
 
@@ -1442,8 +1552,6 @@
 
 /** Maximum number of subbands in the IEEEtypes_SupportedChannels_t structure */
 #define WLAN_11H_MAX_SUBBANDS 6
-/** Maximum number of DFS channels configured in IEEEtypes_IBSS_DFS_t */
-#define WLAN_11H_MAX_IBSS_DFS_CHANNELS 25
 
 /**  IEEE Power Constraint element (7.3.2.15) */
 typedef MLAN_PACK_START struct {
@@ -1592,24 +1700,6 @@
 
 } MLAN_PACK_END IEEEtypes_ChannelMap_t;
 
-/*  IEEE IBSS DFS Element (7.3.2.24) */
-/**
- *  IBSS DFS element included in ad hoc beacons and probe responses.
- *    Provides information regarding the IBSS DFS Owner as well as the
- *    originating STAs supported channels and basic measurement results.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 41 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 dfs_owner[MLAN_MAC_ADDR_LENGTH]; /**< DFS Owner STA Address */
-	t_u8 dfs_recovery_interval; /**< DFS Recovery time in TBTTs */
-
-	/** Variable length map field, one Map entry for each supported channel
-	 */
-	IEEEtypes_ChannelMap_t channel_map[WLAN_11H_MAX_IBSS_DFS_CHANNELS];
-
-} MLAN_PACK_END IEEEtypes_IBSS_DFS_t;
-
 /* 802.11h BSS information kept for each BSSID received in scan results */
 /**
  * IEEE BSS information needed from scan results for later processing in
@@ -1626,7 +1716,6 @@
 	IEEEtypes_ChanSwitchAnn_t chan_switch_ann; /**< Channel Switch
 						      Announcement IE */
 	IEEEtypes_Quiet_t quiet; /**< Quiet IE */
-	IEEEtypes_IBSS_DFS_t ibss_dfs; /**< IBSS DFS Element IE */
 
 } wlan_11h_bss_info_t;
 
@@ -1718,8 +1807,8 @@
 	t_u8 radio_type;
 	/** Scan type: Active = 1, Passive = 2 */
 	t_u8 scan_type;
-	/** Reserved */
-	t_u8 reserved;
+	/** rnr_flag */
+	t_u8 rnr_flag;
 	/** Scan duration in milliseconds; if 0 default used */
 	t_u32 scan_time;
 } MLAN_PACK_END wlan_user_scan_chan;
@@ -1834,11 +1923,14 @@
 #define BG_SCAN_SSID_RSSI_MATCH 0x0004
 /**wait for all channel scan to complete to report scan result*/
 #define BG_SCAN_WAIT_ALL_CHAN_DONE 0x80000000
-/** Maximum number of channels that can be sent in bg scan config */
-#define CHAN_MAX_24G 14
-#define CHAN_MAX_5G 24
-#define CHAN_MAX_UNII4 3
-#define WLAN_BG_SCAN_CHAN_MAX (CHAN_MAX_24G + CHAN_MAX_5G + CHAN_MAX_UNII4)
+
+#define CHAN_MAX_6G 0
+
+/** max bgscan chan number */
+#define WLAN_BG_SCAN_CHAN_MAX 38
+
+/** max bgscan chan number, include UNII_4 channel */
+#define WLAN_BG_SCAN_CHAN_MAX_UNII_4 41
 
 /** Enumeration definition */
 /** EES MODE */
@@ -1906,7 +1998,7 @@
 	/** SSID filter list used in the to limit the scan results */
 	wlan_user_scan_ssid ssid_list[MRVDRV_MAX_SSID_LIST_LENGTH];
 	/** Variable number (fixed maximum) of channels to scan up */
-	wlan_user_scan_chan chan_list[WLAN_BG_SCAN_CHAN_MAX];
+	wlan_user_scan_chan chan_list[WLAN_USER_SCAN_CHAN_MAX];
 	/** scan channel gap */
 	t_u16 scan_chan_gap;
 	/** Enable EES configuration */
@@ -2052,6 +2144,10 @@
 	t_u8 multi_bssid_ap;
 	/** the mac address of multi-bssid AP */
 	mlan_802_11_mac_addr multi_bssid_ap_addr;
+	/** Multi BSSID Configuration IE */
+	IEEEtypes_MBSSID_Config_t *pmbssid_config;
+	/** Multi BSSID Configuration IE offset */
+	t_u16 mbssid_config_offset;
 	/** 20/40 BSS Coexistence IE */
 	IEEEtypes_2040BSSCo_t *pbss_co_2040;
 	/** 20/40 BSS Coexistence Offset */
@@ -2132,7 +2228,10 @@
 	IEEEtypes_MobilityDomain_t *pmd_ie;
 	/** Mobility domain IE offset in the beacon buffer */
 	t_u16 md_offset;
-
+	/** MU EDCA Parameter IE */
+	IEEEtypes_MUEDCAParamSet_t *pmuedca_ie;
+	/** MU EDCA Parameter IE offset */
+	t_u16 muedca_offset;
 	/** Pointer to the returned scan response */
 	t_u8 *pbeacon_buf;
 	/** Length of the stored scan response */
diff --git a/wlan_sd8987/mlan/mlan_ioctl.h b/wlan_src/mlinux/mlan_ioctl.h
old mode 100755
new mode 100644
similarity index 87%
copy from wlan_sd8987/mlan/mlan_ioctl.h
copy to wlan_src/mlinux/mlan_ioctl.h
index 7790db9..934694c
--- a/wlan_sd8987/mlan/mlan_ioctl.h
+++ b/wlan_src/mlinux/mlan_ioctl.h
@@ -3,20 +3,29 @@
  *  @brief This file declares the IOCTL data structures and APIs.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2024 NXP
  *
- *  This software file (the File) is distributed by NXP
- *  under the terms of the GNU General Public License Version 2, June 1991
- *  (the License).  You may use, redistribute and/or modify the File in
- *  accordance with the terms and conditions of the License, a copy of which
- *  is available by writing to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- *  worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *  NXP CONFIDENTIAL
+ *  The source code contained or described herein and all documents related to
+ *  the source code (Materials) are owned by NXP, its
+ *  suppliers and/or its licensors. Title to the Materials remains with NXP,
+ *  its suppliers and/or its licensors. The Materials contain
+ *  trade secrets and proprietary and confidential information of NXP, its
+ *  suppliers and/or its licensors. The Materials are protected by worldwide
+ *  copyright and trade secret laws and treaty provisions. No part of the
+ *  Materials may be used, copied, reproduced, modified, published, uploaded,
+ *  posted, transmitted, distributed, or disclosed in any way without NXP's
+ *  prior express written permission.
  *
- *  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- *  ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- *  this warranty disclaimer.
+ *  No license under any patent, copyright, trade secret or other intellectual
+ *  property right is granted to or conferred upon you by disclosure or delivery
+ *  of the Materials, either expressly, by implication, inducement, estoppel or
+ *  otherwise. Any license under such intellectual property rights must be
+ *  express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
  *
  */
 
@@ -89,6 +98,7 @@
 #ifdef UAP_SUPPORT
 	MLAN_OID_ACTION_CHAN_SWITCH = 0x0002001E,
 #endif
+	MLAN_OID_BSS_HOST_MLME = 0x0002001F,
 
 	/* Radio Configuration Group */
 	MLAN_IOCTL_RADIO_CFG = 0x00030000,
@@ -163,6 +173,7 @@
 	MLAN_OID_PM_CFG_DEEP_SLEEP = 0x00090004,
 	MLAN_OID_PM_CFG_SLEEP_PD = 0x00090005,
 	MLAN_OID_PM_CFG_PS_CFG = 0x00090006,
+	MLAN_OID_PM_CFG_FW_WAKEUP_METHOD = 0x00090007,
 	MLAN_OID_PM_CFG_SLEEP_PARAMS = 0x00090008,
 #ifdef UAP_SUPPORT
 	MLAN_OID_PM_CFG_PS_MODE = 0x00090009,
@@ -182,6 +193,8 @@
 	MLAN_OID_WMM_CFG_QUEUE_STATS = 0x000A0006,
 	MLAN_OID_WMM_CFG_QUEUE_STATUS = 0x000A0007,
 	MLAN_OID_WMM_CFG_TS_STATUS = 0x000A0008,
+	MLAN_OID_WMM_CFG_HOST_ADDTS = 0x000A000A,
+	MLAN_OID_WMM_CFG_HOST_DELTS = 0x000A000B,
 
 	/* WPS Configuration Group */
 	MLAN_IOCTL_WPS_CFG = 0x000B0000,
@@ -204,7 +217,6 @@
 	MLAN_OID_11N_CFG_REJECT_ADDBA_REQ = 0x000C000D,
 	MLAN_OID_11N_CFG_COEX_RX_WINSIZE = 0x000C000E,
 	MLAN_OID_11N_CFG_TX_AGGR_CTRL = 0x000C000F,
-	MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM = 0x000C0010,
 	MLAN_OID_11N_CFG_MIN_BA_THRESHOLD = 0x000C0011,
 
 	/* 802.11d Configuration Group */
@@ -328,6 +340,9 @@
 
 	MLAN_OID_MISC_ROBUSTCOEX = 0x00200056,
 	MLAN_OID_MISC_GET_TX_RX_HISTOGRAM = 0x00200057,
+	MLAN_OID_MISC_CONFIG_RTT = 0x00200059,
+	MLAN_OID_MISC_CANCEL_RTT = 0x0020005A,
+	MLAN_OID_MISC_RTT_RESPONDER_CFG = 0x0020005B,
 	MLAN_OID_MISC_CFP_INFO = 0x00200060,
 	MLAN_OID_MISC_BOOT_SLEEP = 0x00200061,
 #if defined(PCIE)
@@ -354,6 +369,7 @@
 	MLAN_OID_MISC_TP_STATE = 0x0020007D,
 	MLAN_OID_MISC_HAL_PHY_CFG = 0x0020007E,
 	MLAN_OID_MISC_RF_TEST_HE_POWER = 0X0020007F,
+	MLAN_OID_MISC_MULTI_AP_CFG = 0x00200080,
 #ifdef UAP_SUPPORT
 	MLAN_OID_MISC_WACP_MODE = 0x00200081,
 #endif
@@ -365,6 +381,21 @@
 	MLAN_OID_MISC_CH_LOAD = 0x00200087,
 	MLAN_OID_MISC_STATS = 0x00200088,
 	MLAN_OID_MISC_CH_LOAD_RESULTS = 0x00200089,
+	MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX = 0x0020008A,
+	MLAN_OID_MISC_CROSS_CHIP_SYNCH = 0x0020008B,
+	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
+	MLAN_OID_MISC_OFDM_DESENSE_CFG = 0x0020008D,
+	MLAN_OID_MISC_TSP_CFG = 0x002008C,
+	MLAN_OID_MISC_REORDER_FLUSH_TIME = 0x0020008F,
+	MLAN_OID_MISC_NAV_MITIGATION = 0x00200090,
+	MLAN_OID_MISC_LED_CONFIG = 0x00200091,
+	MLAN_OID_MISC_TX_FRAME = 0x00200092,
+	MLAN_OID_MISC_EDMAC_CONFIG = 0x00200093,
+	MLAN_OID_MISC_GPIO_CFG = 0x00200094,
+	MLAN_OID_MISC_REGION_POWER_CFG = 0x00200095,
+	MLAN_OID_MISC_OTP_MAC_RD_WR = 0x00200097,
+	MLAN_OID_MISC_OTP_CAL_DATA_RD_WR = 0x00200098,
+	MLAN_OID_MISC_AUTH_ASSOC_TIMEOUT_CONFIG = 0x00200099,
 };
 
 /** Sub command size */
@@ -379,16 +410,16 @@
 	MLAN_ACT_RESET,
 	MLAN_ACT_DEFAULT
 };
-
+#define MLAN_ACT_PASN_KEY_DNLD 7
+#define MLAN_ACT_PASN_SET_KEY 0
 /** Enumeration for generic enable/disable */
 enum _mlan_act_generic { MLAN_ACT_DISABLE = 0, MLAN_ACT_ENABLE = 1 };
 
 /** Enumeration for scan mode */
 enum _mlan_scan_mode {
 	MLAN_SCAN_MODE_UNCHANGED = 0,
-	MLAN_SCAN_MODE_BSS,
-	MLAN_SCAN_MODE_IBSS,
-	MLAN_SCAN_MODE_ANY
+	MLAN_SCAN_MODE_BSS = 1,
+	MLAN_SCAN_MODE_ANY = 3
 };
 
 /** Enumeration for scan type */
@@ -473,6 +504,21 @@
 	t_u8 status;
 } MLAN_PACK_END tx_status_event;
 
+typedef MLAN_PACK_START struct _tx_mgmt_status_event {
+	/** packet type */
+	t_u8 packet_type;
+	/** tx_token_id */
+	t_u8 tx_token_id;
+	/** 0--success, 1--fail, 2--watchdogtimeout */
+	t_u8 status;
+} MLAN_PACK_END tx_mgmt_status_event;
+
+typedef MLAN_PACK_START struct _tx_bulk_status_event {
+	/* bulk event is multi set for tx_status [bulk1 bulk2 ...bulk128]
+     bulk1 { packet_type, tx_token_id, status } so on.
+  */
+	tx_mgmt_status_event bulk_events[128];
+} MLAN_PACK_END tx_bulk_status_event;
 /**
  *  Sructure to retrieve the scan table
  */
@@ -486,7 +532,7 @@
 	 * Buffer marker for multiple wlan_ioctl_get_scan_table_entry
 	 * structures. Each struct is padded to the nearest 32 bit boundary.
 	 */
-	t_u8 scan_table_entry_buf[1];
+	t_u8 scan_table_entry_buf[];
 } wlan_ioctl_get_scan_table_info;
 
 /**
@@ -543,7 +589,7 @@
 	/** Length of scan_cfg_buf */
 	t_u32 scan_cfg_len;
 	/** Buffer of scan config */
-	t_u8 scan_cfg_buf[1];
+	t_u8 scan_cfg_buf[];
 } mlan_user_scan, *pmlan_user_scan;
 
 /** Type definition of mlan_scan_req */
@@ -616,8 +662,8 @@
 /** Enumeration for BSS mode */
 enum _mlan_bss_mode {
 	MLAN_BSS_MODE_INFRA = 1,
-	MLAN_BSS_MODE_IBSS,
-	MLAN_BSS_MODE_AUTO
+	MLAN_BSS_MODE_IBSS = 2,
+	MLAN_BSS_MODE_AUTO = 3
 };
 
 /** Maximum key length */
@@ -708,7 +754,7 @@
 #define CHAN_FLAGS_MAX MBIT(31)
 
 /** Maximum response buffer length */
-#define ASSOC_RSP_BUF_SIZE 500
+#define ASSOC_RSP_BUF_SIZE 2060
 
 /** Type definition of mlan_ds_misc_assoc_rsp for MLAN_OID_MISC_ASSOC_RSP */
 typedef struct _mlan_ds_misc_assoc_rsp {
@@ -916,6 +962,12 @@
 #define PROTOCOL_WAPI 0x80
 /** WPA3 SAE */
 #define PROTOCOL_WPA3_SAE 0x100
+/* hunting-and-pecking loop only */
+#define SAE_PWE_HUNT_AND_PECK 0
+/** hash-to-element only */
+#define SAE_PWE_HASH_TO_ELEMENT 1
+/** both hunting-and-pecking loop and hash-to-element */
+#define SAE_PWE_BOTH 2
 /** OWE */
 #define PROTOCOL_OWE 0x200
 
@@ -987,6 +1039,10 @@
 	t_u32 length;
 	/** passphrase */
 	t_u8 passphrase[64];
+	/** SAE Password length */
+	t_u32 sae_password_length;
+	/** Passphrase */
+	t_u8 sae_password[255];
 	/**group key rekey time in seconds */
 	t_u32 gk_rekey_time;
 } wpa_param;
@@ -1165,6 +1221,8 @@
 
 	/** uap host based config */
 	t_u32 uap_host_based_config;
+	/** multi ap flag */
+	t_u8 multi_ap_flag;
 } mlan_uap_bss_param, *pmlan_uap_bss_param;
 
 /** mlan_uap_scan_channels */
@@ -1181,6 +1239,11 @@
 
 #define MAX_NUM_PKTS 9
 #define DEF_NUM_PKTS 3
+
+/** Default channel mode and retry packets for channel switch */
+#define DEFAULT_RETRY_PKTS 9
+#define DEFAULT_CHAN_MODE_MASK 3
+
 /** mlan_chan_switch_param */
 typedef struct _mlan_action_chan_switch {
 	/** mode*/
@@ -1335,6 +1398,7 @@
 		/** STA info for MLAN_OID_UAP_ADD_STATION */
 		mlan_ds_sta_info sta_info;
 #endif
+
 	} param;
 } mlan_ds_bss, *pmlan_ds_bss;
 
@@ -1372,8 +1436,6 @@
 	BAND_AAC = 64,
 	BAND_GAX = 256,
 	BAND_AAX = 512,
-	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
-
 };
 
 /** Channel bandwidth */
@@ -1393,10 +1455,6 @@
 typedef struct _mlan_ds_band_cfg {
 	/** Infra band */
 	t_u32 config_bands;
-	/** Ad-hoc start band */
-	t_u32 adhoc_start_band;
-	/** Ad-hoc start channel */
-	t_u32 adhoc_channel;
 	/** fw supported band */
 	t_u32 fw_bands;
 } mlan_ds_band_cfg;
@@ -1528,13 +1586,6 @@
 /** Status Information Group */
 /*-----------------------------------------------------------------*/
 /** Enumeration for ad-hoc status */
-enum _mlan_adhoc_status {
-	ADHOC_IDLE,
-	ADHOC_STARTED,
-	ADHOC_JOINED,
-	ADHOC_COALESCED,
-	ADHOC_STARTING
-};
 
 typedef struct _mlan_ds_get_stats_org {
 	/** Statistics counter */
@@ -1695,8 +1746,10 @@
 	/** Rx Stuck Related Info*/
 	/** Rx Stuck Issue count */
 	t_u32 rx_stuck_issue_cnt[2];
-	/** Rx Stuck Recovery count */
-	t_u32 rx_stuck_recovery_cnt;
+	/** Rx Stuck Recovery count polling based */
+	t_u32 rx_stuck_poll_recovery_cnt;
+	/** Rx Stuck Recovery count interrupt based */
+	t_u32 rx_stuck_intr_recovery_cnt;
 	/** Rx Stuck TSF */
 	t_u64 rx_stuck_tsf[2];
 	/** Tx Watchdog Recovery Related Info */
@@ -1723,6 +1776,8 @@
 	t_u32 gdma_abort_cnt;
 	/** Rx Reset MAC Count */
 	t_u32 g_reset_rx_mac_cnt;
+	/** SDMA FSM stuck Count*/
+	t_u32 SdmaStuckCnt;
 	// Ownership error counters
 	/*Error Ownership error count*/
 	t_u32 dwCtlErrCnt;
@@ -1885,6 +1940,8 @@
 	t_u32 hw_dot_11n_dev_cap;
 	/** Device support for MIMO abstraction of MCSs */
 	t_u8 hw_dev_mcs_support;
+	/** mpdu density */
+	t_u8 hw_mpdu_density;
 	/** user's MCS setting */
 	t_u8 usr_dev_mcs_support;
 	/** 802.11ac device capabilities */
@@ -1927,12 +1984,19 @@
 	t_u8 prohibit_80mhz;
 	/** FW support beacon protection */
 	t_u8 fw_beacon_prot;
+	/** FW RTT support */
+	t_u8 rtt_support;
 
 	/* lower 8 bytes of uuid */
 	t_u64 uuid_lo;
 
 	/* higher 8 bytes of uuid */
 	t_u64 uuid_hi;
+	/* FW support tx data by cmd */
+	t_u8 cmd_tx_data;
+	t_u8 sec_rgpower;
+	/*country code from OTP*/
+	t_u16 fw_country_code;
 } mlan_fw_info, *pmlan_fw_info;
 
 /** Version string buffer length */
@@ -1953,87 +2017,7 @@
 /** Extended Capabilities Data */
 typedef struct MLAN_PACK_START _ExtCap_t {
 	/** Extended Capabilities value */
-	t_u8 rsvdBit87 : 1; /* bit 87 */
-	t_u8 rsvdBit86 : 1; /* bit 86 */
-	t_u8 rsvdBit85 : 1; /* bit 85 */
-	t_u8 beacon_prot : 1; /* bit 84 */
-	t_u8 rsvdBit83 : 1; /* bit 83 */
-	t_u8 rsvdBit82 : 1; /* bit 82 */
-	t_u8 rsvdBit81 : 1; /* bit 81 */
-	t_u8 rsvdBit80 : 1; /* bit 80 */
-	t_u8 rsvdBit79 : 1; /* bit 79 */
-	t_u8 TWTResp : 1; /* bit 78 */
-	t_u8 TWTReq : 1; /* bit 77 */
-	t_u8 rsvdBit76 : 1; /* bit 76 */
-	t_u8 rsvdBit75 : 1; /* bit 75 */
-	t_u8 rsvdBit74 : 1; /* bit 74 */
-	t_u8 rsvdBit73 : 1; /* bit 73 */
-	t_u8 FILS : 1; /* bit 72 */
-	t_u8 FTMI : 1; /* bit 71 */
-	t_u8 FTMR : 1; /* bit 70 */
-	t_u8 CAQ : 1; /* bit 69 */
-	t_u8 rsvdBit68 : 1; /* bit 68 */
-	t_u8 NCC : 1; /* bit 67 */
-	t_u8 rsvdBit66 : 1; /* bit 66 */
-	t_u8 chanSchedMgnt : 1; /* bit 65 */
-	t_u8 MaxAMSDU1 : 1; /* bit 64 */
-	t_u8 MaxAMSDU0 : 1; /* bit 63 */
-	t_u8 OperModeNtf : 1; /* bit 62 */
-	t_u8 TDLSWildBandwidth : 1; /* bit 61 */
-	t_u8 rsvdBit60 : 1; /* bit 60 */
-	t_u8 rsvdBit59 : 1; /* bit 59 */
-	t_u8 rsvdBit58 : 1; /* bit 58 */
-	t_u8 rsvdBit57 : 1; /* bit 57 */
-	t_u8 rsvdBit56 : 1; /* bit 56 */
-	t_u8 rsvdBit55 : 1; /* bit 55 */
-	t_u8 rsvdBit54 : 1; /* bit 54 */
-	t_u8 rsvdBit53 : 1; /* bit 53 */
-	t_u8 rsvdBit52 : 1; /* bit 52 */
-	t_u8 rsvdBit51 : 1; /* bit 51 */
-	t_u8 rsvdBit50 : 1; /* bit 50 */
-	t_u8 rsvdBit49 : 1; /* bit 49 */
-	t_u8 rsvdBit48 : 1; /* bit 48 */
-	t_u8 rsvdBit47 : 1; /* bit 47 */
-	t_u8 rsvdBit46 : 1; /* bit 46 */
-	t_u8 rsvdBit45 : 1; /* bit 45 */
-	t_u8 rsvdBit44 : 1; /* bit 44 */
-	t_u8 rsvdBit43 : 1; /* bit 43 */
-	t_u8 rsvdBit42 : 1; /* bit 42 */
-	t_u8 rsvdBit41 : 1; /* bit 41 */
-	t_u8 rsvdBit40 : 1; /* bit 40 */
-	t_u8 TDLSChlSwitchProhib : 1; /* bit 39 */
-	t_u8 TDLSProhibited : 1; /* bit 38 */
-	t_u8 TDLSSupport : 1; /* bit 37 */
-	t_u8 MSGCF_Capa : 1; /* bit 36 */
-	t_u8 Reserved35 : 1; /* bit 35 */
-	t_u8 SSPN_Interface : 1; /* bit 34 */
-	t_u8 EBR : 1; /* bit 33 */
-	t_u8 Qos_Map : 1; /* bit 32 */
-	t_u8 Interworking : 1; /* bit 31 */
-	t_u8 TDLSChannelSwitching : 1; /* bit 30 */
-	t_u8 TDLSPeerPSMSupport : 1; /* bit 29 */
-	t_u8 TDLSPeerUAPSDSupport : 1; /* bit 28 */
-	t_u8 UTC : 1; /* bit 27 */
-	t_u8 DMS : 1; /* bit 26 */
-	t_u8 SSID_List : 1; /* bit 25 */
-	t_u8 ChannelUsage : 1; /* bit 24 */
-	t_u8 TimingMeasurement : 1; /* bit 23 */
-	t_u8 MultipleBSSID : 1; /* bit 22 */
-	t_u8 AC_StationCount : 1; /* bit 21 */
-	t_u8 QoSTrafficCap : 1; /* bit 20 */
-	t_u8 BSS_Transition : 1; /* bit 19 */
-	t_u8 TIM_Broadcast : 1; /* bit 18 */
-	t_u8 WNM_Sleep : 1; /* bit 17 */
-	t_u8 TFS : 1; /* bit 16 */
-	t_u8 GeospatialLocation : 1; /* bit 15 */
-	t_u8 CivicLocation : 1; /* bit 14 */
-	t_u8 CollocatedIntf : 1; /* bit 13 */
-	t_u8 ProxyARPService : 1; /* bit 12 */
-	t_u8 FMS : 1; /* bit 11 */
-	t_u8 LocationTracking : 1; /* bit 10 */
-	t_u8 MulticastDiagnostics : 1; /* bit 9  */
-	t_u8 Diagnostics : 1; /* bit 8  */
-	t_u8 Event : 1; /* bit 7  */
+	t_u8 Event : 1; /* bit 7  */ /* Byte 1 */
 	t_u8 SPSMP_Support : 1; /* bit 6 */
 	t_u8 Reserved5 : 1; /* bit 5 */
 	t_u8 PSMP_Capable : 1; /* bit 4 */
@@ -2041,6 +2025,86 @@
 	t_u8 ExtChanSwitching : 1; /* bit 2 */
 	t_u8 Reserved1 : 1; /* bit 1 */
 	t_u8 BSS_CoexistSupport : 1; /* bit 0 */
+	t_u8 GeospatialLocation : 1; /* bit 15 */ /* Byte 2 */
+	t_u8 CivicLocation : 1; /* bit 14 */
+	t_u8 CollocatedIntf : 1; /* bit 13 */
+	t_u8 ProxyARPService : 1; /* bit 12 */
+	t_u8 FMS : 1; /* bit 11 */
+	t_u8 LocationTracking : 1; /* bit 10 */
+	t_u8 MulticastDiagnostics : 1; /* bit 9  */
+	t_u8 Diagnostics : 1; /* bit 8  */
+	t_u8 TimingMeasurement : 1; /* bit 23 */ /* Byte 3 */
+	t_u8 MultipleBSSID : 1; /* bit 22 */
+	t_u8 AC_StationCount : 1; /* bit 21 */
+	t_u8 QoSTrafficCap : 1; /* bit 20 */
+	t_u8 BSS_Transition : 1; /* bit 19 */
+	t_u8 TIM_Broadcast : 1; /* bit 18 */
+	t_u8 WNM_Sleep : 1; /* bit 17 */
+	t_u8 TFS : 1; /* bit 16 */
+	t_u8 Interworking : 1; /* bit 31 */ /* Byte 4 */
+	t_u8 TDLSChannelSwitching : 1; /* bit 30 */
+	t_u8 TDLSPeerPSMSupport : 1; /* bit 29 */
+	t_u8 TDLSPeerUAPSDSupport : 1; /* bit 28 */
+	t_u8 UTC : 1; /* bit 27 */
+	t_u8 DMS : 1; /* bit 26 */
+	t_u8 SSID_List : 1; /* bit 25 */
+	t_u8 ChannelUsage : 1; /* bit 24 */
+	t_u8 TDLSChlSwitchProhib : 1; /* bit 39 */ /* Byte 5 */
+	t_u8 TDLSProhibited : 1; /* bit 38 */
+	t_u8 TDLSSupport : 1; /* bit 37 */
+	t_u8 MSGCF_Capa : 1; /* bit 36 */
+	t_u8 Reserved35 : 1; /* bit 35 */
+	t_u8 SSPN_Interface : 1; /* bit 34 */
+	t_u8 EBR : 1; /* bit 33 */
+	t_u8 Qos_Map : 1; /* bit 32 */
+	t_u8 rsvdBit47 : 1; /* bit 47 */ /* Byte 6 */
+	t_u8 rsvdBit46 : 1; /* bit 46 */
+	t_u8 rsvdBit45 : 1; /* bit 45 */
+	t_u8 rsvdBit44 : 1; /* bit 44 */
+	t_u8 rsvdBit43 : 1; /* bit 43 */
+	t_u8 rsvdBit42 : 1; /* bit 42 */
+	t_u8 rsvdBit41 : 1; /* bit 41 */
+	t_u8 rsvdBit40 : 1; /* bit 40 */
+	t_u8 rsvdBit55 : 1; /* bit 55 */ /* Byte 7 */
+	t_u8 rsvdBit54 : 1; /* bit 54 */
+	t_u8 rsvdBit53 : 1; /* bit 53 */
+	t_u8 rsvdBit52 : 1; /* bit 52 */
+	t_u8 rsvdBit51 : 1; /* bit 51 */
+	t_u8 rsvdBit50 : 1; /* bit 50 */
+	t_u8 rsvdBit49 : 1; /* bit 49 */
+	t_u8 rsvdBit48 : 1; /* bit 48 */
+	t_u8 MaxAMSDU0 : 1; /* bit 63 */ /* Byte 8 */
+	t_u8 OperModeNtf : 1; /* bit 62 */
+	t_u8 TDLSWildBandwidth : 1; /* bit 61 */
+	t_u8 rsvdBit60 : 1; /* bit 60 */
+	t_u8 rsvdBit59 : 1; /* bit 59 */
+	t_u8 rsvdBit58 : 1; /* bit 58 */
+	t_u8 rsvdBit57 : 1; /* bit 57 */
+	t_u8 rsvdBit56 : 1; /* bit 56 */
+	t_u8 FTMI : 1; /* bit 71 */ /* Byte 9 */
+	t_u8 FTMR : 1; /* bit 70 */
+	t_u8 CAQ : 1; /* bit 69 */
+	t_u8 rsvdBit68 : 1; /* bit 68 */
+	t_u8 NCC : 1; /* bit 67 */
+	t_u8 rsvdBit66 : 1; /* bit 66 */
+	t_u8 chanSchedMgnt : 1; /* bit 65 */
+	t_u8 MaxAMSDU1 : 1; /* bit 64 */
+	t_u8 rsvdBit79 : 1; /* bit 79 */ /* Byte 10 */
+	t_u8 TWTResp : 1; /* bit 78 */
+	t_u8 TWTReq : 1; /* bit 77 */
+	t_u8 rsvdBit76 : 1; /* bit 76 */
+	t_u8 rsvdBit75 : 1; /* bit 75 */
+	t_u8 rsvdBit74 : 1; /* bit 74 */
+	t_u8 rsvdBit73 : 1; /* bit 73 */
+	t_u8 FILS : 1; /* bit 72 */
+	t_u8 rsvdBit87 : 1; /* bit 87 */ /* Byte 11 */
+	t_u8 rsvdBit86 : 1; /* bit 86 */
+	t_u8 rsvdBit85 : 1; /* bit 85 */
+	t_u8 beacon_prot : 1; /* bit 84 */
+	t_u8 rsvdBit83 : 1; /* bit 83 */
+	t_u8 rsvdBit82 : 1; /* bit 82 */
+	t_u8 rsvdBit81 : 1; /* bit 81 */
+	t_u8 rsvdBit80 : 1; /* bit 80 */
 } MLAN_PACK_END ExtCap_t, *pExtCap_t;
 #else
 /** Extended Capabilities Data */
@@ -2164,8 +2228,6 @@
 	t_s32 max_power_level;
 	/** Min power level in dBm */
 	t_s32 min_power_level;
-	/** Adhoc state */
-	t_u32 adhoc_state;
 	/** NF of last beacon */
 	t_s32 bcn_nf_last;
 	/** wep status */
@@ -2341,6 +2403,8 @@
 	t_u8 tx_lock_flag;
 	/** Corresponds to port_open member of mlan_private */
 	t_u8 port_open;
+	/** Corresponds to tx_pause member of mlan_private */
+	t_u8 tx_pause;
 	/** bypass pkt count */
 	t_u32 bypass_pkt_count;
 	/** Corresponds to scan_processing member of mlan_adapter */
@@ -2359,6 +2423,14 @@
 	t_u32 mlan_rx_processing;
 	/** rx pkts queued */
 	t_u32 rx_pkts_queued;
+#ifdef PCIE
+	/** process pcie event interrupt */
+	t_u8 pcie_event_processing;
+	/** process pcie tx interrupt */
+	t_u8 pcie_tx_processing;
+	/** process pcie rx interrupt */
+	t_u8 pcie_rx_processing;
+#endif
 	/** Number of host to card command failures */
 	t_u32 num_cmd_host_to_card_failure;
 	/** Number of host to card sleep confirm failures */
@@ -2456,6 +2528,12 @@
 	t_u16 last_event_index;
 	/** Number of no free command node */
 	t_u16 num_no_cmd_node;
+	/** num_assoc_cmd_error, count result 4 error */
+	t_u16 num_assoc_err;
+	/** num_scan_cmd_error, count result 4 error */
+	t_u16 num_scan_err;
+	/** num_remain_on_channel_cmd_error, count result 4 error */
+	t_u16 num_remain_chan_err;
 	/** pending command id */
 	t_u16 pending_cmd;
 	/** time stamp for dnld last cmd */
@@ -2548,6 +2626,9 @@
 	t_u16 ie_len;
 } sta_info_data;
 
+/** Per station Maximum IE buffer SIZE */
+#define MAX_STA_LIST_IE_SIZE 13
+
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
 typedef struct _mlan_ds_sta_list {
 	/** station count */
@@ -2833,51 +2914,6 @@
 	} param;
 } mlan_ds_sec_cfg, *pmlan_ds_sec_cfg;
 
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-#define BIT_TLV_TYPE_CRYPTO_KEY (1 << 0)
-#define BIT_TLV_TYPE_CRYPTO_KEY_IV (1 << 1)
-#define BIT_TLV_TYPE_CRYPTO_KEY_PREFIX (1 << 2)
-#define BIT_TLV_TYPE_CRYPTO_KEY_DATA_BLK (1 << 3)
-
-/** Type definition of mlan_ds_sup_cfg */
-typedef struct _mlan_ds_sup_cfg {
-	/** Sub-command */
-	t_u8 sub_command;
-	/** output length */
-	t_u16 output_len;
-	/** number of data blks */
-	t_u16 data_blks_nr;
-	/** sub action code */
-	t_u8 sub_action_code;
-	/** skip bytes */
-	t_u16 skip_bytes;
-	/** iteration */
-	t_u32 iteration;
-	/** count */
-	t_u32 count;
-	/** pointer to output */
-	t_u8 *output;
-	/** key length  */
-	t_u16 key_len;
-	/** pointer to key */
-	t_u8 *key;
-	/** key iv length  */
-	t_u16 key_iv_len;
-	/** pointer to key iv */
-	t_u8 *key_iv;
-	/** key prefix length */
-	t_u16 key_prefix_len;
-	/** pointer to key prefix */
-	t_u8 *key_prefix;
-	/** pointer to data blk length array */
-	t_u32 *key_data_blk_len;
-	/** pointer to key data blk pointer array */
-	t_u8 **key_data_blk;
-	/** callback */
-	t_u8 call_back;
-} mlan_ds_sup_cfg, *pmlan_ds_sup_cfg;
-#endif
-
 /*-----------------------------------------------------------------*/
 /** Rate Configuration Group */
 /*-----------------------------------------------------------------*/
@@ -2977,6 +3013,8 @@
 typedef struct _mlan_ds_rate {
 	/** Sub-command */
 	t_u32 sub_command;
+	/** Only set auto tx fix rate */
+	t_u16 auto_null_fixrate_enable;
 	/** Rate configuration parameter */
 	union {
 		/** Rate configuration for MLAN_OID_RATE_CFG */
@@ -3102,6 +3140,8 @@
 
 /** Host sleep config GPIO : Default */
 #define HOST_SLEEP_DEF_GPIO 0xff
+/** Host sleep config gap : Special setting (host acknowledge required) */
+#define HOST_SLEEP_GAP_SPECIAL 0xff
 /** Host sleep config gap : Default */
 #define HOST_SLEEP_DEF_GAP 200
 /** Host sleep config min wake holdoff */
@@ -3123,7 +3163,7 @@
 	/** GPIO pin or 0xff for interface */
 	t_u32 gpio;
 	/** Gap in milliseconds or or 0xff for special
-	 *  setting when GPIO is used to wakeup host
+	 *  setting (host acknowledge required)
 	 */
 	t_u32 gap;
 	/** Host sleep wake interval */
@@ -3220,6 +3260,8 @@
 	t_u32 mcast_timeout;
 	/** Timeout for additional Rx traffic after Null PM1 packet exchange */
 	t_u32 ps_entry_timeout;
+	/** Inactivity timeout for cmd */
+	t_u32 ps_cmd_timeout;
 } mlan_ds_inactivity_to, *pmlan_ds_inactivity_to;
 
 /** Minimum sleep period in milliseconds */
@@ -3368,6 +3410,15 @@
 	t_u16 hs_wakeup_reason;
 } mlan_ds_hs_wakeup_reason;
 
+/** Type definition of mlan_fw_wakeup_params for
+ * MLAN_OID_PM_CFG_FW_WAKEUP_METHOD */
+typedef struct _mlan_fw_wakeup_params {
+	/** FW wakeup method */
+	t_u16 method;
+	/** GPIO pin NO.*/
+	t_u8 gpio_pin;
+} mlan_fw_wakeup_params, *pmlan_fw_wakeup_params;
+
 /** Type definition of mlan_ds_ps_cfg for MLAN_OID_PM_CFG_PS_CFG */
 typedef struct _mlan_ds_bcn_timeout {
 	/** Beacon miss timeout period window */
@@ -3398,6 +3449,8 @@
 		t_u32 sleep_period;
 		/** PS configuration parameters for MLAN_OID_PM_CFG_PS_CFG */
 		mlan_ds_ps_cfg ps_cfg;
+		/** FW wakeup method for MLAN_OID_PM_CFG_FW_WAKEUP_METHOD */
+		mlan_fw_wakeup_params fw_wakeup_params;
 		/** PS configuration parameters for MLAN_OID_PM_CFG_SLEEP_PARAMS
 		 */
 		mlan_ds_sleep_params sleep_params;
@@ -3596,6 +3649,26 @@
 	t_u8 reserved[10];
 } mlan_ds_wmm_queue_config, *pmlan_ds_wmm_queue_config;
 
+/** WMM HOST ADDTS configuration parameters */
+typedef struct _mlan_ds_tx_addts {
+	/* TS id - unique per tid, TA, RA combination */
+	t_u8 tsid;
+	/* RA BSSID */
+	t_u8 peer[MLAN_MAC_ADDR_LENGTH];
+	/* User priority (UP) */
+	t_u8 user_prio;
+	/* Admitted Air time for UP */
+	t_u16 admitted_time;
+} mlan_ds_tx_addts_cfg;
+
+/** WMM HOST DELTS configuration parameters */
+typedef struct _mlan_ds_tx_delts {
+	/* TS id - unique per tid, TA, RA combination */
+	t_u8 tsid;
+	/* RA BSSID */
+	t_u8 peer[MLAN_MAC_ADDR_LENGTH];
+} mlan_ds_tx_delts_cfg;
+
 /** Type definition of mlan_ds_wmm_cfg for MLAN_IOCTL_WMM_CFG */
 typedef struct _mlan_ds_wmm_cfg {
 	/** Sub-command */
@@ -3610,6 +3683,10 @@
 		mlan_ds_wmm_addts addts;
 		/** WMM delete TS for MLAN_OID_WMM_CFG_DELTS */
 		mlan_ds_wmm_delts delts;
+		/** WMM add TS for host config */
+		mlan_ds_tx_addts_cfg host_addts;
+		/** WMM del TS for host config */
+		mlan_ds_tx_delts_cfg host_delts;
 		/** WMM queue configuration for MLAN_OID_WMM_CFG_QUEUE_CONFIG */
 		mlan_ds_wmm_queue_config q_cfg;
 		/** AC Parameters Record WMM_AC_BE, WMM_AC_BK, WMM_AC_VI,
@@ -3835,14 +3912,6 @@
 	t_u32 conditions;
 } mlan_ds_reject_addba_req, *pmlan_ds_reject_addba_req;
 
-/** Type definition of mlan_ds_ibss_ampdu_param */
-typedef struct _mlan_ds_ibss_ampdu_param {
-	/** ampdu priority table */
-	t_u8 ampdu[MAX_NUM_TID];
-	/** rx amdpdu setting */
-	t_u8 addba_reject[MAX_NUM_TID];
-} mlan_ds_ibss_ampdu_param, *pmlan_ds_ibss_ampdu_param;
-
 /** Type definition of mlan_ds_11n_cfg for MLAN_IOCTL_11N_CFG */
 typedef struct _mlan_ds_11n_cfg {
 	/** Sub-command */
@@ -3879,8 +3948,6 @@
 		t_u32 coex_rx_winsize;
 		/** Control TX AMPDU configuration */
 		t_u32 txaggrctrl;
-		/** aggrprirotity table for MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM */
-		mlan_ds_ibss_ampdu_param ibss_ampdu;
 		/** Minimum BA Threshold for MLAN_OID_11N_CFG_MIN_BA_THRESHOLD
 		 */
 		t_u8 min_ba_threshold;
@@ -4007,6 +4074,10 @@
 #define MLAN_11AXCMD_CFG_ID_TXOP_RTS 5
 #define MLAN_11AXCMD_CFG_ID_TX_OMI 6
 #define MLAN_11AXCMD_CFG_ID_OBSSNBRU_TOLTIME 7
+#define MLAN_11AXCMD_CFG_ID_SET_BSRP 8
+#define MLAN_11AXCMD_CFG_ID_LLDE 9
+#define MLAN_11AXCMD_CFG_ID_RUTXPWR 10
+#define MLAN_11AXCMD_CFG_ID_HESUER 11
 
 #define MLAN_11AXCMD_SR_SUBID 0x102
 #define MLAN_11AXCMD_BEAM_SUBID 0x103
@@ -4014,12 +4085,23 @@
 #define MLAN_11AXCMD_TXOMI_SUBID 0x105
 #define MLAN_11AXCMD_OBSS_TOLTIME_SUBID 0x106
 #define MLAN_11AXCMD_TXOPRTS_SUBID 0x108
+#define MLAN_11AXCMD_SET_BSRP_SUBID 0x109
+#define MLAN_11AXCMD_LLDE_SUBID 0x110
+#define MLAN_11AXCMD_RUTXSUBPWR_SUBID 0x118
+#define MLAN_11AXCMD_HESUER_SUBID 0x121
 
 #define MLAN_11AX_TWT_SETUP_SUBID 0x114
 #define MLAN_11AX_TWT_TEARDOWN_SUBID 0x115
+#define MLAN_11AX_TWT_REPORT_SUBID 0x116
+#define MLAN_11AX_TWT_INFORMATION_SUBID 0x119
+#define MLAN_11AX_BTWT_AP_CONFIG_SUBID 0x120
+#define BTWT_AGREEMENT_MAX 5
 
 #define MRVL_DOT11AX_ENABLE_SR_TLV_ID (PROPRIETARY_TLV_BASE_ID + 322)
 #define MRVL_DOT11AX_OBSS_PD_OFFSET_TLV_ID (PROPRIETARY_TLV_BASE_ID + 323)
+#define NXP_6E_INBAND_FRAMES_TLV_ID (PROPRIETARY_TLV_BASE_ID + 345) // 0x0159
+
+#define MLAN_11AXCMD_LLDE_MODE_EVENT_DRIVEN 5
 
 /** Type definition of mlan_11axcmdcfg_obss_pd_offset for MLAN_OID_11AX_CMD_CFG
  */
@@ -4087,6 +4169,55 @@
 	t_u32 tol_time;
 } mlan_ds_11ax_toltime_cmd, *pmlan_ds_11ax_toltime_cmd;
 
+/** Type definition of mlan_ds_11ax_set_bsrp_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_set_bsrp_cmd {
+	/** command value: 1 is enable, 0 is disable*/
+	t_u8 value;
+} mlan_ds_11ax_set_bsrp_cmd, *pmlan_ds_11ax_set_bsrp_cmd;
+
+/** Type definition of mlan_ds_11ax_llde_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_llde_cmd {
+	t_u8 llde; // Uplink LLDE: enable=1,disable=0
+	t_u8 mode; // operation mode: default=0,carplay=1,gameplay=2
+	t_u8 fixrate; // trigger frame rate: auto=0xff
+	t_u8 triggerlimit; // cap airtime limit index: auto=0xff
+	t_u8 peakULrate; // cap peak UL rate
+	t_u8 dl_llde; // Downlink LLDE: enable=1,disable=0
+	t_u16 pollinterval; // Set trigger frame interval(us): auto=0
+	t_u16 txOpDuration; // Set TxOp duration
+	t_u16 llde_ctrl; // for other configurations
+	t_u16 mu_rts_successcnt;
+	t_u16 mu_rts_failcnt;
+	t_u16 basic_trigger_successcnt;
+	t_u16 basic_trigger_failcnt;
+	t_u16 tbppdu_nullcnt;
+	t_u16 tbppdu_datacnt;
+} mlan_ds_11ax_llde_cmd, *pmlan_ds_11ax_llde_cmd;
+
+/** Type definition of mlan_ds_11ax_rutxpwr_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_rutxpwr_cmd {
+	/** type*/
+	t_u16 type;
+	/** length of TLV */
+	t_u16 len;
+	/** Sub-Band */
+	t_u8 subBand;
+	/** column,row are 3 for every subband table,however column are 7 for FC
+	 * and 6 for other SOCs */
+	t_u8 col;
+	/** row are 3 for every subband table,total row for MAC1 is 12 and MAC2
+	 * id 3 ( consider only 2G support */
+	t_u8 row;
+	/**ru tx data */
+	t_s8 rutxSubPwr[89];
+} mlan_ds_11ax_rutxpwr_cmd, *pmlan_ds_11ax_rutxpwr_cmd;
+
+/** Type definition of mlan_ds_11ax_HeSuER_cmd for MLAN_11AXCMD_HESUER_SUBID */
+typedef struct _mlan_ds_11ax_HeSuER_cmd {
+	/** command value: 1 is enable, 0 is disable*/
+	t_u8 value;
+} mlan_ds_11ax_HeSuER_cmd, *pmlan_ds_11ax_HeSuER_cmd;
+
 /** Type definition of mlan_ds_11ax_cmd_cfg for MLAN_OID_11AX_CMD_CFG */
 typedef struct _mlan_ds_11ax_cmd_cfg {
 	/** Sub-command */
@@ -4108,9 +4239,41 @@
 		/** OBSS tolerance time configuration for
 		 * MLAN_11AXCMD_TOLTIME_SUBID */
 		mlan_ds_11ax_toltime_cmd toltime_cfg;
+		/** SET_BSRP configuration for MLAN_11AXCMD_SET_BSRP_SUBID */
+		mlan_ds_11ax_set_bsrp_cmd setbsrp_cfg;
+		/* MLAN_11AXCMD_LLDE_SUBID */
+		mlan_ds_11ax_llde_cmd llde_cfg;
+		/* MLAN_11AXCMD_RUTXPWR_SUBID */
+		mlan_ds_11ax_rutxpwr_cmd rutxpwr_cfg;
+		/** HeSuER configuration for MLAN_11AXCMD_HESUER_SUBID */
+		mlan_ds_11ax_HeSuER_cmd HeSuER_cfg;
 	} param;
 } mlan_ds_11ax_cmd_cfg, *pmlan_ds_11ax_cmd_cfg;
 
+/** Type definition of mlan_ds_11ax_llde_pkt_filter_cmd for
+ * mlan_ds_11ax_llde_pkt_filter_cmd_cfg */
+typedef struct _mlan_ds_11ax_llde_pkt_filter_cmd {
+	/** 0: no preference, 1: iphone (carplay IE in assoc)*/
+	t_u8 device_filter;
+	/** make traffic to specific mac address to be high priority, Can have
+	 * max 2 mac address entries */
+	t_u8 macfilter1[MLAN_MAC_ADDR_LENGTH];
+	/** make traffic to specific mac address to be high priority, other mac
+	 * filter */
+	t_u8 macfilter2[MLAN_MAC_ADDR_LENGTH];
+	/** high priority data packet type. 0: All traffic, 1: ping, 2: TCP ACK,
+	 * 4: TCP Data, 8: UDP */
+	t_u8 packet_type;
+} mlan_ds_11ax_llde_pkt_filter_cmd, *pmlan_ds_11ax_llde_pkt_filter_cmd;
+
+/** Type definition of BTWT_set*/
+typedef struct MLAN_PACK_START {
+	t_u8 btwtId;
+	t_u16 Ap_Bcast_Mantissa;
+	t_u8 Ap_Bcast_Exponent;
+	t_u8 nominalwake;
+} MLAN_PACK_END BTWT_set;
+
 /** Type definition of mlan_ds_twt_setup for MLAN_OID_11AX_TWT_CFG */
 typedef struct MLAN_PACK_START _mlan_ds_twt_setup {
 	/** Implicit, 0: TWT session is explicit, 1: Session is implicit */
@@ -4140,6 +4303,8 @@
 	t_u16 twt_mantissa;
 	/** TWT Request Type, 0: REQUEST_TWT, 1: SUGGEST_TWT*/
 	t_u8 twt_request;
+	/** TWT link lost timeout threshold */
+	t_u16 bcnMiss_threshold;
 } MLAN_PACK_END mlan_ds_twt_setup, *pmlan_ds_twt_setup;
 
 /** Type definition of mlan_ds_twt_teardown for MLAN_OID_11AX_TWT_CFG */
@@ -4153,6 +4318,40 @@
 	t_u8 teardown_all_twt;
 } MLAN_PACK_END mlan_ds_twt_teardown, *pmlan_ds_twt_teardown;
 
+/** Type definition of mlan_ds_twt_report for MLAN_OID_11AX_TWT_CFG */
+typedef MLAN_PACK_START struct _mlan_ds_twt_report {
+	/** TWT report type, 0: BTWT id */
+	t_u8 type;
+	/** TWT report length of value in data */
+	t_u8 length;
+	t_u8 reserve[2];
+	/** TWT report payload for FW response to fill */
+	t_u8 data[36];
+} MLAN_PACK_END mlan_ds_twt_report, *pmlan_ds_twt_report;
+
+/** Type definition of mlan_ds_twt_information for MLAN_OID_11AX_TWT_CFG */
+typedef struct MLAN_PACK_START _mlan_ds_twt_information {
+	/** TWT Flow Identifier. Range: [0-7] */
+	t_u8 flow_identifier;
+	/** Suspend Duration. Range: [0-UINT32_MAX]
+	 * 0:Suspend forever;
+	 * Else:Suspend agreement for specific duration in milli seconds,
+	 * 		after than resume the agreement and enter SP immediately
+	 */
+	t_u32 suspend_duration;
+} MLAN_PACK_END mlan_ds_twt_information, *pmlan_ds_twt_information;
+
+/** Type definition of mlan_ds_btwt_ap_config for MLAN_OID_11AX_TWT_CFG */
+typedef struct MLAN_PACK_START _mlan_ds_btwt_ap_config {
+	/** TWT Flow Identifier. Range: [0-7] */
+	t_u8 ap_bcast_bet_sta_wait;
+	t_u16 Ap_Bcast_Offset;
+	t_u8 bcastTWTLI;
+	t_u8 count;
+	BTWT_set BTWT_sets[BTWT_AGREEMENT_MAX];
+
+} MLAN_PACK_END mlan_ds_btwt_ap_config, *pmlan_ds_btwt_ap_config;
+
 /** Type definition of mlan_ds_twtcfg for MLAN_OID_11AX_TWT_CFG */
 typedef struct MLAN_PACK_START _mlan_ds_twtcfg {
 	/** Sub-command */
@@ -4166,6 +4365,16 @@
 		/** TWT Teardown config for Sub ID: MLAN_11AX_TWT_TEARDOWN_SUBID
 		 */
 		mlan_ds_twt_teardown twt_teardown;
+		/** TWT report for Sub ID: MLAN_11AX_TWT_REPORT_SUBID */
+		mlan_ds_twt_report twt_report;
+		/** TWT Information config for Sub ID:
+		 * MLAN_11AX_TWT_INFORMATION_SUBID
+		 */
+		mlan_ds_twt_information twt_information;
+		/** BTWT AP config for Sub ID:
+		 * MLAN_11AX_BTWT_AP_CONFIG_SUBID_SUBID
+		 */
+		mlan_ds_btwt_ap_config btwt_ap_config;
 	} param;
 } MLAN_PACK_END mlan_ds_twtcfg, *pmlan_ds_twtcfg;
 
@@ -4244,14 +4453,17 @@
 	MLAN_REG_PSU = 6,
 	MLAN_REG_BCA = 7,
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097) ||          \
-	defined(SD9177)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097) || defined(SD9177) ||             \
+	defined(SDIW610) || defined(USBIW610)
 	MLAN_REG_CIU = 8,
 #endif
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
+	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
+	defined(SDAW693) || defined(PCIEAW693) || defined(PCIEIW624) ||        \
+	defined(USBIW624) || defined(SD9097) || defined(SDIW610) ||            \
+	defined(USBIW610)
 	MLAN_REG_MAC2 = 0x81,
 	MLAN_REG_BBP2 = 0x82,
 	MLAN_REG_RF2 = 0x83,
@@ -4456,6 +4668,26 @@
 	t_u8 cmd[MRVDRV_SIZE_OF_CMD_BUFFER];
 } mlan_ds_misc_cmd;
 
+/** Type definition of mlan_ds_misc_tx_frame for MLAN_OID_MISC_TX_FRAME */
+typedef struct _mlan_ds_misc_tx_frame {
+	/** Band Configuration */
+	Band_Config_t bandcfg;
+	/** channel */
+	t_u8 channel;
+	/** Buffer type: data, cmd, event etc. */
+	mlan_buf_type buf_type;
+	/** QoS priority */
+	t_u32 priority;
+	/** Flags for this buffer */
+	t_u32 flags;
+	/** tx_seq_num */
+	t_u32 tx_seq_num;
+	/** tx_buf length */
+	t_u16 data_len;
+	/** Tx buffer */
+	t_u8 tx_buf[MRVDRV_SIZE_OF_CMD_BUFFER];
+} mlan_ds_misc_tx_frame;
+
 /** Maximum number of system clocks */
 #define MLAN_MAX_CLK_NUM 16
 
@@ -4489,6 +4721,12 @@
 #define MLAN_NETMON_CONTROL MBIT(1)
 /* data frame */
 #define MLAN_NETMON_DATA MBIT(2)
+/* only unicast destined frame (no promiscuous) */
+#define MLAN_NETMON_NOPROM MBIT(3)
+/* capture non-bss Rx beacons */
+#define MLAN_NETMON_NON_BSS_BCN MBIT(5)
+/* capture Tx frames */
+#define MLAN_NETMON_TX MBIT(6)
 
 typedef struct _mlan_ds_misc_net_monitor {
 	/** Enable/disable network monitor */
@@ -4522,6 +4760,15 @@
 	/** Rx weak RSSI pkt threshold */
 	t_s8 rssi_threshold;
 } mlan_ds_misc_rx_abort_cfg;
+/** Type definition of mlan_ds_misc_ofdm_desense_cfg
+ * for MLAN_OID_MISC_OFDM_DESENSE_CFG
+ */
+typedef struct _mlan_ds_misc_ofdm_desense_cfg {
+	/** enable/disable ofdm desense cfg */
+	t_u8 enable;
+	/** OFDM  CCA pkt threshold */
+	t_s8 cca_threshold;
+} mlan_ds_misc_ofdm_desense_cfg;
 
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
  * for MLAN_OID_MISC_RX_ABORT_CFG_EXT
@@ -4533,8 +4780,49 @@
 	t_s8 rssi_margin;
 	/** specify ceil rssi threshold */
 	t_s8 ceil_rssi_threshold;
+	/** specify floor rssi threshold */
+	t_s8 floor_rssi_threshold;
+	/** current dynamic rssi threshold */
+	t_s8 current_dynamic_rssi_threshold;
+	/** rssi config: default or user configured */
+	t_u8 rssi_default_config;
+	/** EDMAC status */
+	t_u8 edmac_enable;
 } mlan_ds_misc_rx_abort_cfg_ext;
 
+/** Type definition of mlan_ds_misc_nav_mitigation
+ * for MLAN_OID_MISC_NAV_MITIGATION
+ */
+typedef struct _mlan_ds_misc_nav_mitigation {
+	/** start/stop nav mitigation */
+	t_u16 start_nav_mitigation;
+	/** Duration value in us to set as threshold in ACT_SET action */
+	t_u16 threshold;
+	/** Counter for NAV mitigation detected */
+	t_u16 detect_cnt;
+	/** Counter for NAV mitigation stopped */
+	t_u16 stop_cnt;
+
+} mlan_ds_misc_nav_mitigation;
+
+#define MAX_FW_STATES 6
+typedef struct _mlan_ds_led_behavior {
+	t_u8 firmwarestate;
+	t_u8 ledstate;
+	t_u8 ledargs;
+} mlan_ds_misc_led_behavior;
+
+/** Type definition of mlan_ds_misc_led_cfg
+ * for MLAN_OID_MISC_LED_CONFIG
+ */
+typedef struct _mlan_ds_misc_led_cfg {
+	t_u32 sub_command;
+	t_u8 enable;
+	/** tlv len */
+	t_u16 led_cfg_len;
+	mlan_ds_misc_led_behavior misc_led_behvr[MAX_FW_STATES];
+} mlan_ds_misc_led_cfg;
+
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
  * for MLAN_OID_MISC_TX_AMDPU_PROT_MODE
  */
@@ -4619,7 +4907,10 @@
 typedef struct _mlan_ds_misc_ipv6_ra_offload {
 	/** 0: disable; 1: enable*/
 	t_u8 enable;
-	t_u8 ipv6_addr[16];
+	/** Number of IPv6 address configured in FW */
+	t_u8 ipv6_addrs_count;
+	/** Ipv6 address array */
+	t_u8 ipv6_addrs[];
 } mlan_ds_misc_ipv6_ra_offload;
 
 /* MEF configuration disable */
@@ -4676,6 +4967,18 @@
 	t_u8 country_code[COUNTRY_CODE_LEN];
 } mlan_ds_misc_country_code;
 
+/** Type defination of mlan_ds_gpio_cfg_ops */
+typedef struct _mlan_ds_gpio_cfg_ops {
+	/** Get or Set action */
+	t_u8 action;
+	/** Operation type */
+	t_u8 opsType;
+	/** pin number */
+	t_u8 pin_num;
+	/** pin value */
+	t_u8 value;
+} mlan_ds_gpio_cfg_ops;
+
 /** action for set */
 #define SUBSCRIBE_EVT_ACT_BITWISE_SET 0x0002
 /** action for clear */
@@ -4943,7 +5246,7 @@
 	/** Channel swith time (in TU) for chan_idx */
 	t_u8 switchtime;
 	/** Undoze time (in TU) for chan_idx */
-	t_u8 undozetime;
+	t_u8 rx_wait_time;
 	/** Rx traffic control scheme when channel switch*/
 	/** only valid for GC/STA interface*/
 	t_u8 mode;
@@ -5373,6 +5676,21 @@
 	t_u16 ether_type;
 } mlan_ds_misc_keep_alive, *pmlan_ds_misc_keep_alive;
 
+#define MKEEP_ALIVE_ACK_PKT_MAX 100
+typedef struct _mlan_ds_misc_keep_alive_rx {
+	t_u8 mkeep_alive_id;
+	t_u8 enable;
+	/** enable/disable tcp reset*/
+	t_u8 reset;
+	/**True means saved in driver, false means not saved or download*/
+	t_u8 cached;
+	t_u8 dst_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u8 src_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u16 pkt_len;
+	t_u8 packet[MKEEP_ALIVE_ACK_PKT_MAX];
+	/** Ethernet type */
+	t_u16 ether_type;
+} mlan_ds_misc_keep_alive_rx, *pmlan_ds_misc_keep_alive_rx;
 /** TX and RX histogram statistic parameters*/
 typedef MLAN_PACK_START struct _mlan_ds_misc_tx_rx_histogram {
 	/** Enable or disable get tx/rx histogram statistic */
@@ -5382,25 +5700,9 @@
 	/** Size of Tx/Rx info */
 	t_u16 size;
 	/** Store Tx/Rx info */
-	t_u8 value[1];
+	t_u8 value[];
 } MLAN_PACK_END mlan_ds_misc_tx_rx_histogram;
 
-typedef MLAN_PACK_START struct _mlan_ds_cw_mode_ctrl {
-	/** Mode of Operation 0: Disable 1: Tx Continuous Packet 2: Tx
-	 * Continuous Wave */
-	t_u8 mode;
-	/*channel*/
-	t_u8 channel;
-	/* channel info*/
-	t_u8 chanInfo;
-	/** Tx Power level in dBm */
-	t_u16 txPower;
-	/** Packet Length */
-	t_u16 pktLength;
-	/** bit rate Info */
-	t_u32 rateInfo;
-} MLAN_PACK_END mlan_ds_cw_mode_ctrl;
-
 #define RX_PKT_INFO MBIT(1)
 /** Struct for per-packet configuration */
 typedef struct _mlan_per_pkt_cfg {
@@ -5427,6 +5729,115 @@
 	t_u8 gpio_polarity;
 } mlan_ds_misc_robustcoex_params;
 
+/** RTT configuration */
+typedef struct _mlan_rtt_config {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	t_u8 type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	t_u8 peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	t_u8 channel;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	Band_Config_t bandcfg;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u8 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u8 num_burst;
+	/** num of frames per burst.
+	 * Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames
+	 * to be attempted in a single burst. This also
+	 * equals the number of FTM frames that the
+	 * initiator will request that the responder send
+	 * in a single frame. */
+	t_u8 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can
+	 * retry an FTMR frame.
+	 * Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u8 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	t_u8 preamble;
+	/** RTT BW to be used in the RTT frames */
+	t_u8 bw;
+} mlan_rtt_config, *pmlan_rtt_config;
+
+/** RTT config params */
+typedef struct _mlan_rtt_config_params {
+	t_u8 rtt_config_num;
+	mlan_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} mlan_rtt_config_params;
+
+/** RTT cancel params */
+typedef struct _mlan_rtt_cancel_params {
+	t_u8 rtt_cancel_num;
+	t_u8 rtt_cancel[MAX_RTT_CONFIG_NUM][MLAN_MAC_ADDR_LENGTH];
+} mlan_rtt_cancel_params;
+
+/** RTT responder info */
+typedef struct _rtt_responder_info {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u8 preamble;
+} rtt_responder_info;
+
+/** RTT responder enable configure */
+typedef struct _rtt_responder_encfg {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u32 max_dur_sec;
+} rtt_responder_encfg;
+
+/** Define for mlan_rtt_responder.action */
+#define RTT_GET_RESPONDER_INFO 0
+#define RTT_SET_RESPONDER_ENABLE 1
+#define RTT_SET_RESPONDER_DISABLE 2
+#define RTT_SET_RESPONDER_LCI 3
+#define RTT_SET_RESPONDER_LCR 4
+
+/** RTT responder configure for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+typedef struct _mlan_rtt_responder {
+	t_u8 action;
+	union {
+		rtt_responder_info info;
+		rtt_responder_encfg encfg;
+		wifi_lci_information lci;
+		wifi_lcr_information lcr;
+	} u;
+} mlan_rtt_responder;
+
 #if defined(PCIE)
 typedef struct _mlan_ds_ssu_params {
 	t_u32 nskip;
@@ -5464,6 +5875,15 @@
 	t_u8 csi_filter_cnt;
 	/** Chip ID */
 	t_u8 chip_id;
+	/** band config */
+	t_u8 band_config;
+	/** Channel num */
+	t_u8 channel;
+	/** Enable getting CSI data on special channel */
+	t_u8 csi_monitor_enable;
+	/** CSI data received in cfg channel with mac addr filter, not only RA
+	 * is us or other*/
+	t_u8 ra4us;
 	/** CSI filters */
 	mlan_csi_filter_t csi_filter[CSI_FILTER_MAX];
 } MLAN_PACK_END mlan_ds_csi_params;
@@ -5537,6 +5957,9 @@
 #define MFG_CMD_RADIO_MODE_CFG 0x1211
 #define MFG_CMD_CONFIG_MAC_HE_TB_TX 0x110A
 #define MFG_CMD_CONFIG_TRIGGER_FRAME 0x110C
+#define MFG_CMD_OTP_MAC_ADD 0x108C
+#define MFG_CMD_OTP_CAL_DATA 0x121A
+
 /** MFG CMD generic cfg */
 struct MLAN_PACK_START mfg_cmd_generic_cfg {
 	/** MFG command code */
@@ -5594,7 +6017,9 @@
 	/** STBC */
 	t_u32 stbc;
 	/** power id */
-	t_u32 rsvd[2];
+	t_u32 rsvd[1];
+	/**signal bw*/
+	t_u32 signal_bw;
 	/** NumPkt */
 	t_u32 NumPkt;
 	/** MaxPE */
@@ -5831,6 +6256,37 @@
 	mfg_cmd_IEEETypes_BasicHETrigUserInfo_t basic_trig_user_info;
 } MLAN_PACK_END mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t;
 
+typedef MLAN_PACK_START struct _mfg_cmd_otp_mac_addr_rd_wr_t {
+	/** MFG command code */
+	t_u32 mfg_cmd;
+	/** Action */
+	t_u16 action;
+	/** Device ID */
+	t_u16 device_id;
+	/** MFG Error code */
+	t_u32 error;
+	/** Destination MAC Address */
+	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END mfg_cmd_otp_mac_addr_rd_wr_t;
+
+#define CAL_DATA_LEN 1400
+typedef MLAN_PACK_START struct _mfg_cmd_otp_cal_data_rd_wr_t {
+	/** MFG command code */
+	t_u32 mfg_cmd;
+	/** Action */
+	t_u16 action;
+	/** Device ID */
+	t_u16 device_id;
+	/** MFG Error code */
+	t_u32 error;
+	/** CAL Data write status */
+	t_u32 cal_data_status;
+	/** CAL Data Length*/
+	t_u32 cal_data_len;
+	/** Destination MAC Address */
+	t_u8 cal_data[CAL_DATA_LEN];
+} MLAN_PACK_END mfg_cmd_otp_cal_data_rd_wr_t;
+
 typedef struct _mlan_ds_misc_chnrgpwr_cfg {
 	/** length */
 	t_u16 length;
@@ -5848,6 +6304,22 @@
 	chan_freq_power_t cfp_tbl[];
 } mlan_ds_misc_cfp_tbl;
 
+/** channel attribute */
+typedef struct _chan_attr {
+	/** channel number */
+	t_u8 channel;
+	/** channel flags */
+	t_u8 flags;
+} chan_attr_t;
+
+/** channel flags table */
+typedef struct _mlan_ds_chan_attr {
+	/** Data length */
+	t_u16 data_len;
+	/** Data */
+	chan_attr_t chan_attr[MLAN_MAX_CHANNEL_NUM];
+} MLAN_PACK_END mlan_ds_chan_attr;
+
 /** mlan_ds_mc_aggr_cfg for MLAN_OID_MISC_MC_AGGR_CFG */
 typedef struct _mlan_ds_mc_aggr_cfg {
 	/** action */
@@ -5856,13 +6328,15 @@
 	 * bit 0 MC aggregation
 	 * bit 1 packet expiry
 	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
+	 * bit 3 CTS2Self duration offset
+	 * bit 6 UC non aggregation*/
 	t_u8 enable_bitmap;
 	/* 1 valid, 0 invalid
 	 * bit 0 MC aggregation
 	 * bit 1 packet expiry
 	 * bit 2 CTS2Self
-	 * bit 3 CTS2Self duration offset*/
+	 * bit 3 CTS2Self duration offset
+	 * bit 6 UC non aggregation*/
 	t_u8 mask_bitmap;
 	/** CTS2Self duration offset */
 	t_u16 cts2self_offset;
@@ -5875,7 +6349,7 @@
 	/** tlv len */
 	t_u16 tlv_len;
 	/** TLV buffer */
-	t_u8 tlv_buf[1];
+	t_u8 tlv_buf[];
 } mlan_ds_stats;
 
 typedef struct _mlan_ds_ch_load {
@@ -5885,9 +6359,102 @@
 	t_s16 noise;
 	t_u16 rx_quality;
 	t_u16 duration;
-	t_u16 cca_th;
 } mlan_ds_ch_load;
 
+/** Type definition of mlan_ds_cross_chip_synch */
+typedef struct _mlan_ds_cross_chip_synch {
+	/**cross chip sync action 0-GET, 1-SET */
+	t_u16 action;
+	/**cross chip sync start or stop */
+	t_u8 start_stop;
+	/**cross chip sync role, master or slave */
+	t_u8 role;
+	/**cross chip sync periodicty of toggle in us */
+	t_u32 period;
+	/**cross chip sync initial TSF low */
+	t_u32 init_tsf_low;
+	/**cross chip sync intial TSF high */
+	t_u32 init_tsf_high;
+} mlan_ds_cross_chip_synch;
+
+#define MAX_RFUS 2
+#define MAX_PATHS 2
+typedef struct _mlan_ds_tsp_cfg {
+	/** TSP config action 0-GET, 1-SET */
+	t_u16 action;
+	/** TSP enable/disable tsp algothrim */
+	t_u16 enable;
+	/** TSP config power backoff */
+	t_s32 backoff;
+	/** TSP config high threshold */
+	t_s32 high_thrshld;
+	/** TSP config low threshold */
+	t_s32 low_thrshld;
+	/** TSP config DUTY_CYC_STEP */
+	t_s32 duty_cyc_step;
+	/** TSP config DUTY_CYC_MIN */
+	t_s32 duty_cyc_min;
+	/** TSP config HIGH_THRESHOLD_TEMP */
+	t_s32 high_thrshld_temp;
+	/** TSP config LOW_THRESHOLD_TEMP */
+	t_s32 low_thrshld_temp;
+	/** TSP CAU TSEN register */
+	t_s32 reg_cau_val;
+	/** TSP RFU registers */
+	t_s32 reg_rfu_temp[MAX_RFUS][MAX_PATHS];
+} MLAN_PACK_END mlan_ds_tsp_cfg;
+
+typedef struct _mlan_ds_reorder_flush_time {
+	/** AC BK/BE_flush time*/
+	t_u16 flush_time_ac_be_bk;
+	/** AC VI/VO flush time */
+	t_u16 flush_time_ac_vi_vo;
+} mlan_ds_reorder_flush_time;
+
+/** EDMAC configuration parameters */
+typedef struct _mlan_ds_ed_mac_cfg {
+	/** EU adaptivity for 2.4ghz band */
+	t_u16 ed_ctrl_2g;
+	/** Energy detect threshold offset for 2.4ghz */
+	t_s16 ed_offset_2g;
+	/** EU adaptivity for 5ghz band */
+	t_u16 ed_ctrl_5g;
+	/** Energy detect threshold offset for 5ghz */
+	t_s16 ed_offset_5g;
+
+	t_u32 ed_bitmap_txq_lock;
+} mlan_ds_ed_mac_cfg;
+
+/** valid range for mlan_ds_auth_assoc_timeout_cfg */
+#define AUTH_TIMEOUT_MIN 500
+#define AUTH_TIMEOUT_MAX 2400
+#define AUTH_RETRY_TIMEOUT_ACK_MIN 50
+#define AUTH_RETRY_TIMEOUT_ACK_MAX 300
+#define AUTH_RETRY_TIMEOUT_NO_ACK_MIN 40
+#define AUTH_RETRY_TIMEOUT_NO_ACK_MAX 80
+#define ASSOC_TIMEOUT_MIN 200
+#define ASSOC_TIMEOUT_MAX 1500
+#define REASSOC_TIMEOUT_MIN 100
+#define REASSOC_TIMEOUT_MAX 1500
+#define ASSOC_RETRY_TIMEOUT_MIN 50
+#define ASSOC_RETRY_TIMEOUT_MAX 150
+
+/** Auth Assoc timeout configuration parameters */
+typedef struct _mlan_ds_auth_assoc_timeout_cfg {
+	/** auth timeout */
+	t_u16 auth_timeout;
+	/** Auth retry timeout if received ack */
+	t_u16 auth_retry_timeout_if_ack;
+	/** Auth retry timeout if ack is not received */
+	t_u16 auth_retry_timeout_if_no_ack;
+	/** assoc timeout */
+	t_u16 assoc_timeout;
+	/** reassoc timeout */
+	t_u16 reassoc_timeout;
+	/** assoc/reassoc frame retry timeout if ack received */
+	t_u16 retry_timeout;
+} mlan_ds_auth_assoc_timeout_cfg;
+
 /** Type definition of mlan_ds_misc_cfg for MLAN_IOCTL_MISC_CFG */
 typedef struct _mlan_ds_misc_cfg {
 	/** Sub-command */
@@ -5904,6 +6471,8 @@
 #endif
 		/** Hostcmd for MLAN_OID_MISC_HOST_CMD */
 		mlan_ds_misc_cmd hostcmd;
+		/** tx_frame for MLAN_OID_MISC_TX_FRAME */
+		mlan_ds_misc_tx_frame tx_frame;
 		/** System clock for MLAN_OID_MISC_SYS_CLOCK */
 		mlan_ds_misc_sys_clock sys_clock;
 		/** WWS set/get for MLAN_OID_MISC_WWS */
@@ -5955,6 +6524,8 @@
 #endif
 		/** Hotspot config param set */
 		t_u32 hotspot_cfg;
+		/** Multi AP flag */
+		t_u8 multi_ap_flag;
 #ifdef STA_SUPPORT
 		ExtCap_t ext_cap;
 #endif
@@ -6001,11 +6572,17 @@
 		t_u64 misc_tsf;
 		mlan_ds_custom_reg_domain custom_reg_domain;
 		mlan_ds_misc_keep_alive keep_alive;
+		mlan_ds_misc_keep_alive_rx keep_alive_rx;
 		mlan_ds_misc_tx_rx_histogram tx_rx_histogram;
-		mlan_ds_cw_mode_ctrl cwmode;
 		/**  Tx/Rx per-packet control */
 		t_u8 txrx_pkt_ctrl;
 		mlan_ds_misc_robustcoex_params robustcoexparams;
+		/** config RTT for MLAN_OID_MISC_CONFIG_RTT */
+		mlan_rtt_config_params rtt_params;
+		/** cancel RTT for MLAN_OID_MISC_CANCEL_RTT */
+		mlan_rtt_cancel_params rtt_cancel;
+		/** config RTT responder for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+		mlan_rtt_responder rtt_rsp_cfg;
 #if defined(PCIE)
 		mlan_ds_ssu_params ssu_params;
 #endif
@@ -6016,12 +6593,16 @@
 		mlan_ds_misc_mapping_policy dmcs_policy;
 		mlan_ds_misc_dmcs_status dmcs_status;
 		mlan_ds_misc_rx_abort_cfg rx_abort_cfg;
+		mlan_ds_misc_ofdm_desense_cfg ofdm_desense_cfg;
 		mlan_ds_misc_rx_abort_cfg_ext rx_abort_cfg_ext;
+		mlan_ds_misc_nav_mitigation nav_mitigation;
+		mlan_ds_misc_led_cfg led_config;
 		mlan_ds_misc_tx_ampdu_prot_mode tx_ampdu_prot_mode;
 		mlan_ds_misc_rate_adapt_cfg rate_adapt_cfg;
 		mlan_ds_misc_cck_desense_cfg cck_desense_cfg;
 		mlan_ds_misc_chan_trpc_cfg trpc_cfg;
 		mlan_ds_misc_chnrgpwr_cfg rgchnpwr_cfg;
+		mlan_ds_chan_attr chan_attr_cfg;
 
 		mlan_ds_band_steer_cfg band_steer_cfg;
 		mlan_ds_beacon_stuck_param_cfg beacon_stuck_cfg;
@@ -6030,9 +6611,12 @@
 		struct mfg_cmd_tx_frame2 mfg_tx_frame2;
 		struct mfg_Cmd_HE_TBTx_t mfg_he_power;
 		mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t mfg_tx_trigger_config;
+		mfg_cmd_otp_mac_addr_rd_wr_t mfg_otp_mac_addr_rd_wr;
+		mfg_cmd_otp_cal_data_rd_wr_t mfg_otp_cal_data_rd_wr;
 		mlan_ds_misc_arb_cfg arb_cfg;
 		mlan_ds_misc_cfp_tbl cfp;
 		t_u8 range_ext_mode;
+		mlan_ds_twt_report twt_report_info;
 		mlan_ds_misc_dot11mc_unassoc_ftm_cfg dot11mc_unassoc_ftm_cfg;
 		mlan_ds_misc_tp_state tp_state;
 		mlan_ds_hal_phy_cfg_params hal_phy_cfg_params;
@@ -6043,9 +6627,33 @@
 #endif
 		t_u32 ips_ctrl;
 		mlan_ds_ch_load ch_load;
+		mlan_ds_cross_chip_synch cross_chip_synch;
+		mlan_ds_tsp_cfg tsp_cfg;
+		mlan_ds_reorder_flush_time flush_time;
+		mlan_ds_ed_mac_cfg edmac_cfg;
+		mlan_ds_gpio_cfg_ops gpio_cfg_ops;
+		mlan_ds_auth_assoc_timeout_cfg auth_assoc_cfg;
 	} param;
 } mlan_ds_misc_cfg, *pmlan_ds_misc_cfg;
 
+typedef struct _mlan_cfpinfo {
+	t_u8 nss : 2;
+	t_u8 is2g_present : 1;
+	t_u8 is5g_present : 1;
+	t_u8 is6g_present : 1;
+	t_u8 reserved : 3;
+	t_u8 rows_2g;
+	t_u8 cols_2g;
+	t_u8 rows_5g;
+	t_u8 cols_5g;
+	t_u8 rows_6g;
+	t_u8 cols_6g;
+	t_u8 region_code;
+	t_u8 environment;
+	t_u8 country_code[2];
+	t_u16 action;
+} mlan_cfpinfo;
+
 /** Hotspot status enable */
 #define HOTSPOT_ENABLED MBIT(0)
 /** Hotspot status disable */
diff --git a/wlan_sd8987/mlinux/moal_cfg80211.c b/wlan_src/mlinux/moal_cfg80211.c
old mode 100755
new mode 100644
similarity index 84%
rename from wlan_sd8987/mlinux/moal_cfg80211.c
rename to wlan_src/mlinux/moal_cfg80211.c
index 243be76..03fb7d6
--- a/wlan_sd8987/mlinux/moal_cfg80211.c
+++ b/wlan_src/mlinux/moal_cfg80211.c
@@ -3,20 +3,28 @@
  * @brief This file contains the functions for CFG80211.
  *
  *
- * Copyright 2011-2022 NXP
+ * Copyright 2011-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -30,6 +38,10 @@
 /********************************************************
  *				Local Variables
  ********************************************************/
+
+/* frmctl + durationid + addr1 + addr2 + addr3 + seqctl */
+#define PACKET_ADDR4_POS (2 + 2 + 6 + 6 + 6 + 2)
+
 /** Supported rates to be advertised to the cfg80211 */
 static struct ieee80211_rate cfg80211_rates[] = {
 	{
@@ -82,54 +94,59 @@
 	},
 };
 
+/** Kernel picks the min of the register max power and the regulatory max.
+      So to register the max chip capability the default max power for all
+   channels is set to 23 dbm which is the max of the typical max tx pwr out
+   range among all chips*/
+
 /** Channel definitions for 2 GHz to be advertised to cfg80211 */
 static struct ieee80211_channel cfg80211_channels_2ghz[] = {
-	{.center_freq = 2412, .hw_value = 1, .max_power = 20},
-	{.center_freq = 2417, .hw_value = 2, .max_power = 20},
-	{.center_freq = 2422, .hw_value = 3, .max_power = 20},
-	{.center_freq = 2427, .hw_value = 4, .max_power = 20},
-	{.center_freq = 2432, .hw_value = 5, .max_power = 20},
-	{.center_freq = 2437, .hw_value = 6, .max_power = 20},
-	{.center_freq = 2442, .hw_value = 7, .max_power = 20},
-	{.center_freq = 2447, .hw_value = 8, .max_power = 20},
-	{.center_freq = 2452, .hw_value = 9, .max_power = 20},
-	{.center_freq = 2457, .hw_value = 10, .max_power = 20},
-	{.center_freq = 2462, .hw_value = 11, .max_power = 20},
-	{.center_freq = 2467, .hw_value = 12, .max_power = 20},
-	{.center_freq = 2472, .hw_value = 13, .max_power = 20},
-	{.center_freq = 2484, .hw_value = 14, .max_power = 20},
+	{.center_freq = 2412, .hw_value = 1, .max_power = 23},
+	{.center_freq = 2417, .hw_value = 2, .max_power = 23},
+	{.center_freq = 2422, .hw_value = 3, .max_power = 23},
+	{.center_freq = 2427, .hw_value = 4, .max_power = 23},
+	{.center_freq = 2432, .hw_value = 5, .max_power = 23},
+	{.center_freq = 2437, .hw_value = 6, .max_power = 23},
+	{.center_freq = 2442, .hw_value = 7, .max_power = 23},
+	{.center_freq = 2447, .hw_value = 8, .max_power = 23},
+	{.center_freq = 2452, .hw_value = 9, .max_power = 23},
+	{.center_freq = 2457, .hw_value = 10, .max_power = 23},
+	{.center_freq = 2462, .hw_value = 11, .max_power = 23},
+	{.center_freq = 2467, .hw_value = 12, .max_power = 23},
+	{.center_freq = 2472, .hw_value = 13, .max_power = 23},
+	{.center_freq = 2484, .hw_value = 14, .max_power = 23},
 };
 
 /** Channel definitions for 5 GHz to be advertised to cfg80211 */
 static struct ieee80211_channel cfg80211_channels_5ghz[] = {
-	{.center_freq = 5180, .hw_value = 36, .max_power = 20},
-	{.center_freq = 5200, .hw_value = 40, .max_power = 20},
-	{.center_freq = 5220, .hw_value = 44, .max_power = 20},
-	{.center_freq = 5240, .hw_value = 48, .max_power = 20},
-	{.center_freq = 5260, .hw_value = 52, .max_power = 20},
-	{.center_freq = 5280, .hw_value = 56, .max_power = 20},
-	{.center_freq = 5300, .hw_value = 60, .max_power = 20},
-	{.center_freq = 5320, .hw_value = 64, .max_power = 20},
-	{.center_freq = 5500, .hw_value = 100, .max_power = 20},
-	{.center_freq = 5520, .hw_value = 104, .max_power = 20},
-	{.center_freq = 5540, .hw_value = 108, .max_power = 20},
-	{.center_freq = 5560, .hw_value = 112, .max_power = 20},
-	{.center_freq = 5580, .hw_value = 116, .max_power = 20},
-	{.center_freq = 5600, .hw_value = 120, .max_power = 20},
-	{.center_freq = 5620, .hw_value = 124, .max_power = 20},
-	{.center_freq = 5640, .hw_value = 128, .max_power = 20},
-	{.center_freq = 5660, .hw_value = 132, .max_power = 20},
-	{.center_freq = 5680, .hw_value = 136, .max_power = 20},
-	{.center_freq = 5700, .hw_value = 140, .max_power = 20},
-	{.center_freq = 5720, .hw_value = 144, .max_power = 20},
-	{.center_freq = 5745, .hw_value = 149, .max_power = 20},
-	{.center_freq = 5765, .hw_value = 153, .max_power = 20},
-	{.center_freq = 5785, .hw_value = 157, .max_power = 20},
-	{.center_freq = 5805, .hw_value = 161, .max_power = 20},
-	{.center_freq = 5825, .hw_value = 165, .max_power = 20},
-	{.center_freq = 5845, .hw_value = 169, .max_power = 20},
-	{.center_freq = 5865, .hw_value = 173, .max_power = 20},
-	{.center_freq = 5885, .hw_value = 177, .max_power = 20},
+	{.center_freq = 5180, .hw_value = 36, .max_power = 23},
+	{.center_freq = 5200, .hw_value = 40, .max_power = 23},
+	{.center_freq = 5220, .hw_value = 44, .max_power = 23},
+	{.center_freq = 5240, .hw_value = 48, .max_power = 23},
+	{.center_freq = 5260, .hw_value = 52, .max_power = 23},
+	{.center_freq = 5280, .hw_value = 56, .max_power = 23},
+	{.center_freq = 5300, .hw_value = 60, .max_power = 23},
+	{.center_freq = 5320, .hw_value = 64, .max_power = 23},
+	{.center_freq = 5500, .hw_value = 100, .max_power = 23},
+	{.center_freq = 5520, .hw_value = 104, .max_power = 23},
+	{.center_freq = 5540, .hw_value = 108, .max_power = 23},
+	{.center_freq = 5560, .hw_value = 112, .max_power = 23},
+	{.center_freq = 5580, .hw_value = 116, .max_power = 23},
+	{.center_freq = 5600, .hw_value = 120, .max_power = 23},
+	{.center_freq = 5620, .hw_value = 124, .max_power = 23},
+	{.center_freq = 5640, .hw_value = 128, .max_power = 23},
+	{.center_freq = 5660, .hw_value = 132, .max_power = 23},
+	{.center_freq = 5680, .hw_value = 136, .max_power = 23},
+	{.center_freq = 5700, .hw_value = 140, .max_power = 23},
+	{.center_freq = 5720, .hw_value = 144, .max_power = 23},
+	{.center_freq = 5745, .hw_value = 149, .max_power = 23},
+	{.center_freq = 5765, .hw_value = 153, .max_power = 23},
+	{.center_freq = 5785, .hw_value = 157, .max_power = 23},
+	{.center_freq = 5805, .hw_value = 161, .max_power = 23},
+	{.center_freq = 5825, .hw_value = 165, .max_power = 23},
+	{.center_freq = 5845, .hw_value = 169, .max_power = 23},
+	{.center_freq = 5865, .hw_value = 173, .max_power = 23},
+	{.center_freq = 5885, .hw_value = 177, .max_power = 23},
 };
 
 struct ieee80211_supported_band cfg80211_band_2ghz = {
@@ -174,6 +191,10 @@
 #endif
 #endif
 
+static t_u8 *woal_remove_11ax_ies(moal_private *priv, t_u8 *ie, t_u8 len,
+				  t_u8 *new_ie_len, t_u32 ie_out_len,
+				  t_u8 *skipped_len);
+
 /**
  * @brief Get the private structure from wiphy
  *
@@ -199,6 +220,27 @@
 }
 
 /**
+ *  @brief get ieee80211_channel
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param pchan_info   A pointer to chan_band_info structure
+ *
+ *  @return           radio_type
+ */
+static struct ieee80211_channel *
+woal_get_ieee80211_channel(moal_private *priv, chan_band_info *pchan_info)
+{
+	enum ieee80211_band band = IEEE80211_BAND_2GHZ;
+	int freq = 0;
+	if (pchan_info->bandcfg.chanBand == BAND_2GHZ)
+		band = IEEE80211_BAND_2GHZ;
+	else if (pchan_info->bandcfg.chanBand == BAND_5GHZ)
+		band = IEEE80211_BAND_5GHZ;
+	freq = ieee80211_channel_to_frequency(pchan_info->channel, band);
+	return ieee80211_get_channel(priv->wdev->wiphy, freq);
+}
+
+/**
  *  @brief Get current frequency of active interface
  *
  *  @param priv        A pointer to moal_private
@@ -207,53 +249,55 @@
  */
 int woal_get_active_intf_freq(moal_private *priv)
 {
+#ifdef WIFI_DIRECT_SUPPORT
+#if CFG80211_VERSION_CODE >= WIFI_DIRECT_KERNEL_VERSION
+	moal_private *pmpriv = NULL;
 	moal_handle *handle = priv->phandle;
 	int i;
+#endif
+#endif
 
-	if (priv->media_connected == MTRUE
 #ifdef UAP_SUPPORT
-	    || priv->bss_started == MTRUE
-#endif
-	)
-		return ieee80211_channel_to_frequency(
-			priv->channel
-#if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
-			,
-			(priv->channel <= 14 ? IEEE80211_BAND_2GHZ :
-					       IEEE80211_BAND_5GHZ)
-#endif
-		);
-
-	for (i = 0; i < handle->priv_num; i++) {
-#ifdef STA_SUPPORT
-		if (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA) {
-			if (handle->priv[i]->media_connected == MTRUE)
-				return ieee80211_channel_to_frequency(
-					handle->priv[i]->channel
-#if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
-					,
-					(handle->priv[i]->channel <= 14 ?
-						 IEEE80211_BAND_2GHZ :
-						 IEEE80211_BAND_5GHZ)
-#endif
-				);
-		}
-#endif
-#ifdef UAP_SUPPORT
-		if (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_UAP) {
-			if (handle->priv[i]->bss_started == MTRUE)
-				return ieee80211_channel_to_frequency(
-					handle->priv[i]->channel
-#if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
-					,
-					(handle->priv[i]->channel <= 14 ?
-						 IEEE80211_BAND_2GHZ :
-						 IEEE80211_BAND_5GHZ)
-#endif
-				);
-		}
+	if (priv->bss_role == MLAN_BSS_ROLE_UAP && priv->bss_started &&
+	    priv->uap_host_based) {
+#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
+		return priv->chan.chan->center_freq;
 #endif
 	}
+#endif
+#ifdef STA_SUPPORT
+	if (priv->bss_role == MLAN_BSS_ROLE_STA &&
+	    priv->media_connected == MTRUE && priv->sme_current.ssid_len) {
+		return priv->conn_chan.center_freq;
+	}
+#endif
+
+#ifdef WIFI_DIRECT_SUPPORT
+#if CFG80211_VERSION_CODE >= WIFI_DIRECT_KERNEL_VERSION
+	if (priv->bss_type == MLAN_BSS_TYPE_WIFIDIRECT) {
+		for (i = 0; i < handle->priv_num; i++) {
+			if (handle->priv[i] &&
+			    handle->priv[i]->bss_type ==
+				    MLAN_BSS_TYPE_WIFIDIRECT) {
+				pmpriv = handle->priv[i];
+				if (pmpriv->bss_role == MLAN_BSS_ROLE_STA &&
+				    pmpriv->media_connected == MTRUE &&
+				    pmpriv->sme_current.ssid_len) {
+					return pmpriv->conn_chan.center_freq;
+				}
+				if (pmpriv->bss_role == MLAN_BSS_ROLE_UAP &&
+				    pmpriv->bss_started &&
+				    pmpriv->uap_host_based) {
+#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
+					return pmpriv->chan.chan->center_freq;
+#endif
+				}
+			}
+		}
+	}
+#endif
+#endif
+
 	return 0;
 }
 
@@ -330,6 +374,7 @@
  *  @param key_index        Key index
  *  @param addr             Mac for which key is to be set
  *  @param disable          Key disabled or not
+ *  @param pairwise         pairwise flag
  *  @param wait_option      wait option
  *
  *  @return                 MLAN_STATUS_SUCCESS -- success, otherwise fail
@@ -337,7 +382,7 @@
 mlan_status woal_cfg80211_set_key(moal_private *priv, t_u8 is_enable_wep,
 				  t_u32 cipher, const t_u8 *key, int key_len,
 				  const t_u8 *seq, int seq_len, t_u8 key_index,
-				  const t_u8 *addr, int disable,
+				  const t_u8 *addr, int disable, t_u8 pairwise,
 				  t_u8 wait_option)
 {
 	mlan_ioctl_req *req = NULL;
@@ -439,9 +484,16 @@
 				   ETH_ALEN) == 0)
 				sec->param.encrypt_key.key_flags =
 					KEY_FLAG_GROUP_KEY;
-			else
-				sec->param.encrypt_key.key_flags =
-					KEY_FLAG_SET_TX_KEY;
+			else {
+#if KERNEL_VERSION(2, 6, 36) < CFG80211_VERSION_CODE
+				if (!pairwise)
+					sec->param.encrypt_key.key_flags =
+						KEY_FLAG_GROUP_KEY;
+				else
+#endif
+					sec->param.encrypt_key.key_flags =
+						KEY_FLAG_SET_TX_KEY;
+			}
 		} else {
 			moal_memcpy_ext(priv->phandle,
 					sec->param.encrypt_key.mac_addr,
@@ -539,13 +591,13 @@
 		else
 			cipher = WLAN_CIPHER_SUITE_WEP104;
 		ret = woal_cfg80211_set_key(priv, 0, cipher, key, key_len, NULL,
-					    0, index, NULL, 0, wait_option);
+					    0, index, NULL, 0, 0, wait_option);
 	} else {
 		/* No key provided so it is enable key. We
 		 * want to just set the transmit key index
 		 */
 		ret = woal_cfg80211_set_key(priv, 1, cipher, key, key_len, NULL,
-					    0, index, NULL, 0, wait_option);
+					    0, index, NULL, 0, 0, wait_option);
 	}
 	if (ret != MLAN_STATUS_SUCCESS)
 		PRINTM(MERROR, "woal_cfg80211_set_wep_keys Fail\n");
@@ -1107,6 +1159,10 @@
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
 	t_u8 bss_role;
 #endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)
+	moal_private *dfs_priv =
+		woal_get_priv_bss_type(priv->phandle, MLAN_BSS_TYPE_DFS);
+#endif
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -1125,6 +1181,22 @@
 	 */
 	if (priv->wdev->iftype == NL80211_IFTYPE_AP &&
 	    type == NL80211_IFTYPE_STATION) {
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)
+		if (dfs_priv && dfs_priv->radar_background) {
+			PRINTM(MMSG, "Cancel background radar detection\n");
+			woal_11h_cancel_chan_report_ioctl(dfs_priv,
+							  MOAL_IOCTL_WAIT);
+			dfs_priv->chan_rpt_pending = MFALSE;
+			dfs_priv->radar_background = MFALSE;
+			woal_update_channels_dfs_state(
+				dfs_priv, dfs_priv->chan_rpt_req.chanNum,
+				dfs_priv->chan_rpt_req.bandcfg.chanWidth,
+				DFS_USABLE);
+			memset(&dfs_priv->chan_rpt_req, 0,
+			       sizeof(mlan_ds_11h_chan_rep_req));
+			cfg80211_background_cac_abort(wiphy);
+		}
+#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
 		if (priv->phandle->is_cac_timer_set &&
 		    priv->bss_index == priv->phandle->cac_bss_index) {
@@ -1250,14 +1322,20 @@
 #endif /* WIFI_DIRECT_SUPPORT */
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
 		if (priv->bss_type == MLAN_BSS_TYPE_UAP) {
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			woal_cfg80211_del_beacon(wiphy, dev, 0);
 #else
 			woal_cfg80211_del_beacon(wiphy, dev);
 #endif
 			bss_role = MLAN_BSS_ROLE_STA;
-			woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET,
-						   &bss_role);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET,
+						       &bss_role)) {
+				PRINTM(MERROR,
+				       "%s: WLAN set bss role config failed. \n",
+				       __func__);
+			}
 			PRINTM(MIOCTL, "set bss role for STA\n");
 		}
 #endif
@@ -1484,7 +1562,8 @@
  */
 #endif
 int woal_cfg80211_add_key(struct wiphy *wiphy, struct net_device *netdev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 			  int link_id,
 #endif
 			  t_u8 key_index,
@@ -1494,6 +1573,7 @@
 			  const t_u8 *mac_addr, struct key_params *params)
 {
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(netdev);
+	t_u8 pairwise_key = MFALSE;
 
 	ENTER();
 	if (priv->ft_pre_connect) {
@@ -1504,9 +1584,25 @@
 	/** cancel pending scan */
 	woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
 
+#if KERNEL_VERSION(2, 6, 36) < CFG80211_VERSION_CODE
+	if (pairwise)
+		pairwise_key = MTRUE;
+	if (mac_addr)
+		PRINTM(MCMND,
+		       "wlan: set_key key_index=%d pairwise=%d " MACSTR
+		       " cipher=0x%x key_len=%d seq_len=%d\n",
+		       key_index, pairwise, MAC2STR(mac_addr), params->cipher,
+		       params->key_len, params->seq_len);
+	else
+		PRINTM(MCMND,
+		       "wlan: set_key key_index=%d pairwise=%d cipher=0x%x key_len=%d seq_len=%d\n",
+		       key_index, pairwise, params->cipher, params->key_len,
+		       params->seq_len);
+#endif
 	if (woal_cfg80211_set_key(priv, 0, params->cipher, params->key,
 				  params->key_len, params->seq, params->seq_len,
-				  key_index, mac_addr, 0, MOAL_IOCTL_WAIT)) {
+				  key_index, mac_addr, 0, pairwise_key,
+				  MOAL_IOCTL_WAIT)) {
 		PRINTM(MERROR, "Error adding the crypto keys\n");
 		LEAVE();
 		return -EFAULT;
@@ -1543,7 +1639,8 @@
  */
 #endif
 int woal_cfg80211_del_key(struct wiphy *wiphy, struct net_device *netdev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 			  int link_id,
 #endif
 			  t_u8 key_index,
@@ -1560,13 +1657,9 @@
 		LEAVE();
 		return -EFAULT;
 	}
-	/* del_key will be trigger from cfg80211_rx_mlme_mgmt funtion
-	 * where we receive deauth/disassoicate packet in rx_work
-	 * use MOAL_NO_WAIT to avoid dead lock
-	 */
 	if (MLAN_STATUS_FAILURE ==
 	    woal_cfg80211_set_key(priv, 0, 0, NULL, 0, NULL, 0, key_index,
-				  mac_addr, 1, MOAL_NO_WAIT)) {
+				  mac_addr, 1, 0, MOAL_IOCTL_WAIT)) {
 		PRINTM(MERROR, "Error deleting the crypto keys\n");
 		LEAVE();
 		return -EFAULT;
@@ -1602,7 +1695,8 @@
 #endif
 int woal_cfg80211_set_default_key(struct wiphy *wiphy,
 				  struct net_device *netdev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 				  int link_id,
 #endif
 				  t_u8 key_index
@@ -1619,7 +1713,11 @@
 	ENTER();
 	memset(&bss_info, 0, sizeof(mlan_bss_info));
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "%s: WLAN get bss info failed. \n",
+			       __func__);
+		}
 		if (!bss_info.wep_status) {
 			LEAVE();
 			return ret;
@@ -1637,7 +1735,8 @@
 #if KERNEL_VERSION(2, 6, 30) <= CFG80211_VERSION_CODE
 int woal_cfg80211_set_default_mgmt_key(struct wiphy *wiphy,
 				       struct net_device *netdev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 				       int link_id,
 #endif
 				       t_u8 key_index)
@@ -1651,7 +1750,8 @@
 #if KERNEL_VERSION(5, 10, 0) <= CFG80211_VERSION_CODE
 int woal_cfg80211_set_default_beacon_key(struct wiphy *wiphy,
 					 struct net_device *netdev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 					 int link_id,
 #endif
 					 t_u8 key_index)
@@ -2238,7 +2338,8 @@
  * @return                0 -- success, otherwise fail
  */
 int woal_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *dev,
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 				   unsigned int link_id,
 #endif
 				   const u8 *peer,
@@ -2568,36 +2669,345 @@
 	LEAVE();
 }
 
-#ifdef UAP_CFG80211
-#if KERNEL_VERSION(3, 12, 0) <= CFG80211_VERSION_CODE
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
 /*
- * @brief  prepare and send WOAL_EVENT_CANCEL_CHANRPT
+ * @brief  check if we need set remain_on_channel
  *
  * @param priv           A pointer moal_private structure
+ * @param wait           Duration to wait
  *
- * @return          N/A
+ * @return          MFALSE-no need set remain_on_channel
  */
-void woal_cancel_chanrpt_event(moal_private *priv)
+static t_u8 woal_check_mgmt_tx_channel(moal_private *priv,
+				       struct ieee80211_channel *chan,
+				       unsigned int wait)
 {
-	struct woal_event *evt;
-	unsigned long flags;
-	moal_handle *handle = priv->phandle;
-
-	evt = kzalloc(sizeof(struct woal_event), GFP_ATOMIC);
-	if (!evt) {
-		PRINTM(MERROR, "Fail to alloc memory for deauth event\n");
-		LEAVE();
-		return;
-	}
-	evt->priv = priv;
-	evt->type = WOAL_EVENT_CANCEL_CHANRPT;
-	INIT_LIST_HEAD(&evt->link);
-	spin_lock_irqsave(&handle->evt_lock, flags);
-	list_add_tail(&evt->link, &handle->evt_queue);
-	spin_unlock_irqrestore(&handle->evt_lock, flags);
-	queue_work(handle->evt_workqueue, &handle->evt_work);
+	int freq;
+	if (priv->bss_type == MLAN_BSS_TYPE_UAP)
+		return MFALSE;
+	if (wait)
+		return MTRUE;
+	freq = woal_get_active_intf_freq(priv);
+	if (chan->center_freq == freq)
+		return MFALSE;
+	return MTRUE;
 }
 #endif
+
+/*
+ * @brief  transmit management packet
+ *
+ * @param priv           A pointer moal_private structure
+ * @param buf                   Frame buffer
+ * @param len                   Frame length
+ * @param chan                  A pointer to ieee80211_channel structure
+ * @param cookie                Frame cookie
+ * @param wait                  Duration to wait
+ *
+ * @return           0 -- success, otherwise fail
+ */
+static int woal_mgmt_tx(moal_private *priv, const u8 *buf, size_t len,
+			struct ieee80211_channel *chan, u64 cookie,
+			unsigned int wait, bool send_tx_expired)
+{
+	int ret = 0;
+	pmlan_buffer pmbuf = NULL;
+	t_u8 *pbuf = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+	t_u16 packet_len = 0;
+	t_u16 pkt_len = 0;
+	t_u32 pkt_type;
+	t_u32 tx_control;
+	unsigned long flags;
+	struct sk_buff *skb = NULL;
+	struct tx_status_info *tx_info = NULL;
+	t_u32 remain_len = 0;
+	t_u32 buf_flags = 0;
+	t_u8 tx_seq_num = 0;
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	t_u8 *new_ie = NULL;
+	t_u8 new_ie_len = 0;
+	t_u16 fc, type, stype;
+	t_u8 skipped_len = 0;
+
+	ENTER();
+
+	if (len < IEEE80211_HEADER_SIZE) {
+		PRINTM(MERROR, "Invalid tx mgmt info buffer length\n");
+		goto done;
+	}
+
+	/* pkt_type + tx_control */
+#define HEADER_SIZE 8
+	if (!woal_secure_add(&len, MLAN_MAC_ADDR_LENGTH, &packet_len,
+			     TYPE_UINT16)) {
+		PRINTM(MERROR, "packet_len is invalid\n");
+	}
+
+	/* Remove 11ax IEs and reduce IE length if band support disabled
+	 * and assoc response includes 11ax IEs
+	 */
+	if (chan && ((chan->band == NL80211_BAND_2GHZ &&
+		      !(priv->phandle->fw_bands & BAND_GAX)) ||
+		     (chan->band == NL80211_BAND_5GHZ &&
+		      !(priv->phandle->fw_bands & BAND_AAX)))) {
+		fc = le16_to_cpu(((struct ieee80211_mgmt *)buf)->frame_control);
+		type = fc & IEEE80211_FCTL_FTYPE;
+		stype = fc & IEEE80211_FCTL_STYPE;
+		if ((type == IEEE80211_FTYPE_MGMT &&
+		     (stype == IEEE80211_STYPE_ASSOC_RESP ||
+		      stype == IEEE80211_STYPE_REASSOC_RESP))) {
+			new_ie = woal_remove_11ax_ies(priv, (t_u8 *)buf, len,
+						      &new_ie_len, MAX_IE_SIZE,
+						      &skipped_len);
+		}
+	}
+
+	if (new_ie && skipped_len)
+		packet_len -= skipped_len;
+
+	if (priv->phandle->cmd_tx_data) {
+		ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+		if (ioctl_req == NULL) {
+			ret = -ENOMEM;
+			goto done;
+		}
+		misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+		misc->sub_command = MLAN_OID_MISC_TX_FRAME;
+		ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+		ioctl_req->action = MLAN_ACT_SET;
+		if (chan) {
+			misc->param.tx_frame.bandcfg.chanBand =
+				woal_ieee_band_to_radio_type(chan->band);
+			misc->param.tx_frame.channel = chan->hw_value;
+		}
+		pbuf = misc->param.tx_frame.tx_buf;
+	} else {
+		pmbuf = woal_alloc_mlan_buffer(
+			priv->phandle, MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE +
+					       packet_len + sizeof(packet_len));
+		if (!pmbuf) {
+			PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
+			ret = -ENOMEM;
+			goto done;
+		}
+
+		pmbuf->data_offset = MLAN_MIN_DATA_HEADER_LEN;
+		pbuf = pmbuf->pbuf + pmbuf->data_offset;
+	}
+	pkt_type = MRVL_PKT_TYPE_MGMT_FRAME;
+	tx_control = 0;
+	remain_len = HEADER_SIZE + packet_len + sizeof(packet_len);
+	/* Add pkt_type and tx_control */
+	moal_memcpy_ext(priv->phandle, pbuf, &pkt_type, sizeof(pkt_type),
+			remain_len);
+	remain_len -= sizeof(pkt_type);
+	moal_memcpy_ext(priv->phandle, pbuf + sizeof(pkt_type), &tx_control,
+			sizeof(tx_control), remain_len);
+	remain_len -= sizeof(tx_control);
+	pkt_len = woal_cpu_to_le16(packet_len);
+	moal_memcpy_ext(priv->phandle, pbuf + HEADER_SIZE, &pkt_len,
+			sizeof(pkt_len), remain_len);
+	remain_len -= sizeof(packet_len);
+	moal_memcpy_ext(priv->phandle, pbuf + HEADER_SIZE + sizeof(packet_len),
+			buf, PACKET_ADDR4_POS, remain_len);
+	remain_len -= PACKET_ADDR4_POS;
+	moal_memcpy_ext(priv->phandle,
+			pbuf + HEADER_SIZE + sizeof(packet_len) +
+				PACKET_ADDR4_POS,
+			addr, MLAN_MAC_ADDR_LENGTH, remain_len);
+	remain_len -= MLAN_MAC_ADDR_LENGTH;
+
+	if (!new_ie_len) {
+		// coverity[overrun:SUPPRESS]
+		moal_memcpy_ext(priv->phandle,
+				pbuf + HEADER_SIZE + sizeof(packet_len) +
+					PACKET_ADDR4_POS + MLAN_MAC_ADDR_LENGTH,
+				buf + PACKET_ADDR4_POS, len - PACKET_ADDR4_POS,
+				remain_len);
+	} else {
+		/* new IEs post cleanup of 11ax IEs received from kernel */
+		// coverity[overrun:SUPPRESS]
+		moal_memcpy_ext(priv->phandle,
+				pbuf + HEADER_SIZE + sizeof(packet_len) +
+					PACKET_ADDR4_POS + MLAN_MAC_ADDR_LENGTH,
+				new_ie, new_ie_len, remain_len);
+	}
+
+	DBG_HEXDUMP(MDAT_D, "Mgmt Tx", pbuf,
+		    HEADER_SIZE + packet_len + sizeof(packet_len));
+	if ((ieee80211_is_action(((struct ieee80211_mgmt *)buf)->frame_control))
+#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
+	    || moal_extflg_isset(priv->phandle, EXT_HOST_MLME)
+#endif
+	) {
+		buf_flags = MLAN_BUF_FLAG_TX_STATUS;
+		if (!priv->tx_seq_num)
+			priv->tx_seq_num++;
+		tx_seq_num = priv->tx_seq_num++;
+		tx_info = kzalloc(sizeof(struct tx_status_info), GFP_ATOMIC);
+		if (tx_info) {
+			skb = alloc_skb(len, GFP_ATOMIC);
+			if (skb) {
+				moal_memcpy_ext(priv->phandle, skb->data, buf,
+						len, len);
+				skb_put(skb, len);
+				spin_lock_irqsave(&priv->tx_stat_lock, flags);
+				tx_info->tx_cookie = cookie;
+				tx_info->tx_skb = skb;
+				tx_info->tx_seq_num = tx_seq_num;
+				tx_info->send_tx_expired = send_tx_expired;
+				if ((priv->bss_role == MLAN_BSS_ROLE_UAP) &&
+				    (priv->phandle->remain_on_channel && !wait))
+					tx_info->cancel_remain_on_channel =
+						MTRUE;
+				INIT_LIST_HEAD(&tx_info->link);
+				list_add_tail(&tx_info->link,
+					      &priv->tx_stat_queue);
+				spin_unlock_irqrestore(&priv->tx_stat_lock,
+						       flags);
+			} else {
+				kfree(tx_info);
+				tx_info = NULL;
+			}
+		}
+	}
+	if (priv->phandle->cmd_tx_data) {
+		misc->param.tx_frame.data_len =
+			HEADER_SIZE + packet_len + sizeof(packet_len);
+		misc->param.tx_frame.buf_type = MLAN_BUF_TYPE_RAW_DATA;
+		misc->param.tx_frame.priority = 7;
+		misc->param.tx_frame.flags = buf_flags;
+		misc->param.tx_frame.tx_seq_num = tx_seq_num;
+		status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+		if (status != MLAN_STATUS_SUCCESS) {
+			PRINTM(MERROR, "Fail to send packet status=%d\n",
+			       status);
+			if (tx_info)
+				woal_remove_tx_info(priv, tx_info->tx_seq_num);
+			ret = -EFAULT;
+			goto done;
+		}
+		if (!tx_info) {
+			/* Delay 30ms to guarantee the packet has been already
+			 * tx'ed, because if we call cfg80211_mgmt_tx_status()
+			 * immediately, then wpa_supplicant will call
+			 * cancel_remain_on_channel(), which may affect the mgmt
+			 * frame tx. Meanwhile it is only necessary for P2P
+			 * action handshake to wait 30ms.
+			 */
+			if (buf_flags == MLAN_BUF_FLAG_TX_STATUS)
+				woal_sched_timeout(30);
+				/* Notify the mgmt tx status */
+#if KERNEL_VERSION(2, 6, 37) <= CFG80211_VERSION_CODE
+#if KERNEL_VERSION(3, 6, 0) > CFG80211_VERSION_CODE
+			cfg80211_mgmt_tx_status(dev, cookie, buf, len, true,
+						GFP_ATOMIC);
+#else
+			cfg80211_mgmt_tx_status(priv->wdev, cookie, buf, len,
+						true, GFP_ATOMIC);
+#endif
+#endif
+		}
+	} else {
+		pmbuf->data_len = HEADER_SIZE + packet_len + sizeof(packet_len);
+		pmbuf->buf_type = MLAN_BUF_TYPE_RAW_DATA;
+		pmbuf->bss_index = priv->bss_index;
+		pmbuf->flags = buf_flags;
+		pmbuf->tx_seq_num = tx_seq_num;
+
+		status = mlan_send_packet(priv->phandle->pmlan_adapter, pmbuf);
+
+		switch (status) {
+		case MLAN_STATUS_PENDING:
+			atomic_inc(&priv->phandle->tx_pending);
+			queue_work(priv->phandle->workqueue,
+				   &priv->phandle->main_work);
+
+			/* Delay 30ms to guarantee the packet has been already
+			 * tx'ed, because if we call cfg80211_mgmt_tx_status()
+			 * immediately, then wpa_supplicant will call
+			 * cancel_remain_on_channel(), which may affect the mgmt
+			 * frame tx. Meanwhile it is only necessary for P2P
+			 * action handshake to wait 30ms.
+			 */
+			if (buf_flags == MLAN_BUF_FLAG_TX_STATUS) {
+				if (tx_info)
+					break;
+				else
+					woal_sched_timeout(30);
+			}
+			/* Notify the mgmt tx status */
+#if KERNEL_VERSION(2, 6, 37) <= CFG80211_VERSION_CODE
+#if KERNEL_VERSION(3, 6, 0) > CFG80211_VERSION_CODE
+			cfg80211_mgmt_tx_status(dev, cookie, buf, len, true,
+						GFP_ATOMIC);
+#else
+			cfg80211_mgmt_tx_status(priv->wdev, cookie, buf, len,
+						true, GFP_ATOMIC);
+#endif
+#endif
+			break;
+		case MLAN_STATUS_SUCCESS:
+			woal_free_mlan_buffer(priv->phandle, pmbuf);
+			break;
+		case MLAN_STATUS_FAILURE:
+		default:
+			woal_free_mlan_buffer(priv->phandle, pmbuf);
+			ret = -EFAULT;
+			break;
+		}
+	}
+done:
+	if (priv->phandle->cmd_tx_data) {
+		if (status != MLAN_STATUS_PENDING)
+			kfree(ioctl_req);
+	} else {
+		if (status != MLAN_STATUS_PENDING) {
+			if (tx_info)
+				woal_remove_tx_info(priv, tx_info->tx_seq_num);
+		}
+	}
+
+	if (new_ie)
+		kfree(new_ie);
+
+	LEAVE();
+	return ret;
+}
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+/*
+ * @brief  validate if packet is NAN publish
+ *
+ * @param buf	Frame buffer
+ *
+ * @return	true -- success, otherwise false
+ */
+static BOOLEAN is_nan_action_frame(const t_u8 *buf)
+{
+	t_u8 nan_sdf_oui[4] = {0x50, 0x6f, 0x9a, 0x13};
+	t_u8 nan_attr_id, nan_srv_ctrl_type;
+
+	if (!memcmp(nan_sdf_oui, buf + 1, NAN_SDF_VENDOR_SIZE)) {
+		nan_attr_id = *(buf + NAN_SDA_OFFSET);
+		nan_srv_ctrl_type =
+			*(buf + NAN_SDA_OFFSET + NAN_SRVC_CTRL_OFFSET);
+		PRINTM(MINFO, "NAN: attribute%x service ctrl type%x\n",
+		       nan_attr_id, nan_srv_ctrl_type);
+		if (nan_attr_id == NAN_ATTR_SDA &&
+		    ((nan_srv_ctrl_type & NAN_SRV_CTRL_TYPE_MASK) ==
+			     NAN_PUBLISH ||
+		     (nan_srv_ctrl_type & NAN_SRV_CTRL_TYPE_MASK) ==
+			     NAN_FOLLOW_UP)) {
+			return MTRUE;
+		}
+	}
+
+	return MFALSE;
+}
 #endif
 
 #if KERNEL_VERSION(3, 2, 0) <= CFG80211_VERSION_CODE
@@ -2745,23 +3155,17 @@
 #endif
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 	int ret = 0;
-	pmlan_buffer pmbuf = NULL;
-	mlan_status status = MLAN_STATUS_SUCCESS;
-	t_u16 packet_len = 0;
-	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
-	t_u32 pkt_type;
-	t_u32 tx_control;
+
 #if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
 	t_u8 channel_status;
 	t_u32 duration;
 	moal_private *remain_priv = NULL;
 #endif
-
-	unsigned long flags;
-	struct sk_buff *skb = NULL;
-	struct tx_status_info *tx_info = NULL;
-	t_u32 remain_len = 0;
 	t_u16 fc, type, stype;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+	t_u8 category, action;
+#endif
+	bool send_tx_expired = false;
 
 	ENTER();
 
@@ -2778,6 +3182,7 @@
 	 * remain_on_channel_cfg in order to receive action frame from peer
 	 * device
 	 */
+
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
 		if (ieee80211_is_probe_resp(
 			    ((struct ieee80211_mgmt *)buf)->frame_control)) {
@@ -2796,10 +3201,15 @@
 			case IEEE80211_STYPE_DEAUTH:
 			case IEEE80211_STYPE_DISASSOC:
 #ifdef UAP_SUPPORT
-				if (!priv->bss_started) {
+				if ((priv->bss_role == MLAN_BSS_ROLE_UAP) &&
+				    !priv->bss_started) {
 					PRINTM(MCMND,
 					       "Drop deauth packet before AP started\n");
-					woal_cancel_cac(priv);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+					if (!moal_extflg_isset(priv->phandle,
+							       EXT_DFS_OFFLOAD))
+#endif
+						woal_cancel_cac(priv);
 					goto done;
 				}
 #endif
@@ -2876,7 +3286,7 @@
 		woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
 #endif
 
-		if (chan && priv->bss_type != MLAN_BSS_ROLE_UAP) {
+		if (chan && woal_check_mgmt_tx_channel(priv, chan, wait)) {
 			duration = (wait > MGMT_TX_DEFAULT_WAIT_TIME) ?
 					   wait :
 					   MGMT_TX_DEFAULT_WAIT_TIME;
@@ -2933,17 +3343,6 @@
 	}
 #endif
 
-	/* pkt_type + tx_control */
-#define HEADER_SIZE 8
-	packet_len = (t_u16)len + MLAN_MAC_ADDR_LENGTH;
-	pmbuf = woal_alloc_mlan_buffer(priv->phandle,
-				       MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE +
-					       packet_len + sizeof(packet_len));
-	if (!pmbuf) {
-		PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
-		ret = -ENOMEM;
-		goto done;
-	}
 #if KERNEL_VERSION(3, 8, 0) > LINUX_VERSION_CODE
 	*cookie = random32() | 1;
 #else
@@ -2953,132 +3352,29 @@
 	*cookie = get_random_u32() | 1;
 #endif
 #endif
-	pmbuf->data_offset = MLAN_MIN_DATA_HEADER_LEN;
-	pkt_type = MRVL_PKT_TYPE_MGMT_FRAME;
-	tx_control = 0;
-	remain_len = HEADER_SIZE + packet_len + sizeof(packet_len);
-	/* Add pkt_type and tx_control */
-	moal_memcpy_ext(priv->phandle, pmbuf->pbuf + pmbuf->data_offset,
-			&pkt_type, sizeof(pkt_type), remain_len);
-	remain_len -= sizeof(pkt_type);
-	moal_memcpy_ext(priv->phandle,
-			pmbuf->pbuf + pmbuf->data_offset + sizeof(pkt_type),
-			&tx_control, sizeof(tx_control), remain_len);
-	remain_len -= sizeof(tx_control);
-	/* frmctl + durationid + addr1 + addr2 + addr3 + seqctl */
-#define PACKET_ADDR4_POS (2 + 2 + 6 + 6 + 6 + 2)
-	moal_memcpy_ext(priv->phandle,
-			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), remain_len);
-	remain_len -= sizeof(packet_len);
-	moal_memcpy_ext(priv->phandle,
-			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE +
-				sizeof(packet_len),
-			buf, PACKET_ADDR4_POS, remain_len);
-	remain_len -= PACKET_ADDR4_POS;
-	moal_memcpy_ext(priv->phandle,
-			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE +
-				sizeof(packet_len) + PACKET_ADDR4_POS,
-			addr, MLAN_MAC_ADDR_LENGTH, remain_len);
-	remain_len -= MLAN_MAC_ADDR_LENGTH;
-	moal_memcpy_ext(priv->phandle,
-			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE +
-				sizeof(packet_len) + PACKET_ADDR4_POS +
-				MLAN_MAC_ADDR_LENGTH,
-			buf + PACKET_ADDR4_POS, len - PACKET_ADDR4_POS,
-			remain_len);
 
-	pmbuf->data_len = HEADER_SIZE + packet_len + sizeof(packet_len);
-	pmbuf->buf_type = MLAN_BUF_TYPE_RAW_DATA;
-	pmbuf->bss_index = priv->bss_index;
-	if ((ieee80211_is_action(((struct ieee80211_mgmt *)buf)->frame_control))
-#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
-	    || moal_extflg_isset(priv->phandle, EXT_HOST_MLME)
-#endif
-	) {
-		pmbuf->flags = MLAN_BUF_FLAG_TX_STATUS;
-		if (!priv->tx_seq_num)
-			priv->tx_seq_num++;
-		pmbuf->tx_seq_num = priv->tx_seq_num++;
-		tx_info = kzalloc(sizeof(struct tx_status_info), GFP_ATOMIC);
-		if (tx_info) {
-			skb = alloc_skb(len, GFP_ATOMIC);
-			if (skb) {
-				moal_memcpy_ext(priv->phandle, skb->data, buf,
-						len, len);
-				skb_put(skb, len);
-				spin_lock_irqsave(&priv->tx_stat_lock, flags);
-				tx_info->tx_cookie = *cookie;
-				tx_info->tx_skb = skb;
-				tx_info->tx_seq_num = pmbuf->tx_seq_num;
-				if ((priv->bss_role == MLAN_BSS_ROLE_UAP) &&
-				    (priv->phandle->remain_on_channel && !wait))
-					tx_info->cancel_remain_on_channel =
-						MTRUE;
-				INIT_LIST_HEAD(&tx_info->link);
-				list_add_tail(&tx_info->link,
-					      &priv->tx_stat_queue);
-				spin_unlock_irqrestore(&priv->tx_stat_lock,
-						       flags);
-			} else {
-				kfree(tx_info);
-				tx_info = NULL;
-			}
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+	if (len > sizeof(moal_802_11_action_header) &&
+	    ieee80211_is_action(
+		    ((struct ieee80211_mgmt *)buf)->frame_control)) {
+		category = *(buf + sizeof(moal_802_11_action_header) - 1);
+		action = *(buf + sizeof(moal_802_11_action_header));
+		if (category == IEEE_MGMT_ACTION_CATEGORY_PUBLIC &&
+		    action == IEEE_PUBLIC_ACTION_CATEGORY_VENDOR_SPECIFIC &&
+		    is_nan_action_frame(buf +
+					sizeof(moal_802_11_action_header))) {
+			PRINTM(MINFO,
+			       "NAN: set tx duration expired for cookie=%llx\n",
+			       *cookie);
+			send_tx_expired = true;
 		}
 	}
-
-	status = mlan_send_packet(priv->phandle->pmlan_adapter, pmbuf);
-
-	switch (status) {
-	case MLAN_STATUS_PENDING:
-		atomic_inc(&priv->phandle->tx_pending);
-		queue_work(priv->phandle->workqueue, &priv->phandle->main_work);
-
-		/* Delay 30ms to guarantee the packet has been already tx'ed,
-		 * because if we call cfg80211_mgmt_tx_status() immediately,
-		 * then wpa_supplicant will call cancel_remain_on_channel(),
-		 * which may affect the mgmt frame tx. Meanwhile it is only
-		 * necessary for P2P action handshake to wait 30ms.
-		 */
-		if ((ieee80211_is_action(
-			    ((struct ieee80211_mgmt *)buf)->frame_control))
-#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
-		    || moal_extflg_isset(priv->phandle, EXT_HOST_MLME)
 #endif
-		) {
-			if (tx_info)
-				break;
-			else
-				woal_sched_timeout(30);
-		}
-		/* Notify the mgmt tx status */
-#if KERNEL_VERSION(2, 6, 37) <= CFG80211_VERSION_CODE
-#if KERNEL_VERSION(3, 6, 0) > CFG80211_VERSION_CODE
-		cfg80211_mgmt_tx_status(dev, *cookie, buf, len, true,
-					GFP_ATOMIC);
-#else
-		cfg80211_mgmt_tx_status(priv->wdev, *cookie, buf, len, true,
-					GFP_ATOMIC);
-#endif
-#endif
-		break;
-	case MLAN_STATUS_SUCCESS:
-		woal_free_mlan_buffer(priv->phandle, pmbuf);
-		break;
-	case MLAN_STATUS_FAILURE:
-	default:
-		woal_free_mlan_buffer(priv->phandle, pmbuf);
-		ret = -EFAULT;
-		break;
-	}
+
+	ret = woal_mgmt_tx(priv, buf, len, chan, *cookie, wait,
+			   send_tx_expired);
 
 done:
-
-	if (status != MLAN_STATUS_PENDING) {
-		if (tx_info)
-			woal_remove_tx_info(priv, tx_info->tx_seq_num);
-	}
-
 	LEAVE();
 	return ret;
 }
@@ -3248,10 +3544,21 @@
 int woal_cfg80211_set_qos_map(struct wiphy *wiphy, struct net_device *dev,
 			      struct cfg80211_qos_map *qos_map)
 {
-	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_private *priv = NULL;
 	int i, j, ret = 0;
 
 	ENTER();
+	if (!dev) {
+		PRINTM(MERROR, "netdev pointer is NULL \n");
+		ret = -EINVAL;
+		goto done;
+	}
+	priv = (moal_private *)woal_get_netdev_priv(dev);
+	if (!priv) {
+		PRINTM(MERROR, "failed to retrieve netdev priv\n");
+		ret = -EINVAL;
+		goto done;
+	}
 	/**clear dscp map*/
 	if (!qos_map) {
 		memset(priv->dscp_map, 0xFF, sizeof(priv->dscp_map));
@@ -3288,7 +3595,7 @@
 
 		qos_map_ie.ieee_hdr.element_id = QOS_MAPPING;
 		qos_map_ie.ieee_hdr.len =
-			2 * qos_map->num_des + sizeof(qos_map->up);
+			(t_u8)(2 * qos_map->num_des + sizeof(qos_map->up));
 		qos_map_ies_len =
 			qos_map_ie.ieee_hdr.len + sizeof(qos_map_ie.ieee_hdr);
 
@@ -3334,10 +3641,10 @@
  *
  * @return                out IE length
  */
-static t_u16 woal_get_specific_ie(const t_u8 *ie, int len, t_u8 *ie_out,
+static t_u16 woal_get_specific_ie(const t_u8 *ie, size_t len, t_u8 *ie_out,
 				  t_u32 ie_out_len, t_u16 mask)
 {
-	int left_len = len;
+	size_t left_len = len;
 	const t_u8 *pos = ie;
 	int length;
 	t_u8 id = 0;
@@ -3459,6 +3766,145 @@
 	return MFALSE;
 }
 
+/*
+ * @brief  search for given IE
+ *
+ * @param ie             A pointer to IE
+ * @param ie_len         IE length
+ * @param eid            Element id to be searched
+ * @param ext_eid        Element extension id to be searched
+ *
+ * @return               true - success, false - otherwise
+ */
+static bool woal_search_ie(t_u8 *ie, t_u8 ie_len, t_u8 eid, t_u8 ext_eid)
+{
+	IEEEtypes_Header_t *pheader = NULL;
+	t_u8 *pos = NULL;
+	t_u8 ret_len = 0;
+	t_u8 ret = false;
+	t_u8 id = 0;
+
+	ENTER();
+
+	pos = (t_u8 *)ie;
+	ret_len = ie_len;
+	while (ret_len >= 2) {
+		pheader = (IEEEtypes_Header_t *)pos;
+		if ((t_u8)(pheader->len + sizeof(IEEEtypes_Header_t)) >
+		    ret_len) {
+			PRINTM(MMSG, "invalid IE length = %d left len %d\n",
+			       pheader->len, ret_len);
+			break;
+		}
+
+		if (ext_eid && pheader->element_id == ext_eid) {
+			id = *(pos + 2);
+			if (id == eid) {
+				ret = true;
+				break;
+			}
+		} else if (pheader->element_id == eid) {
+			ret = true;
+			break;
+		}
+
+		ret_len -= pheader->len + sizeof(IEEEtypes_Header_t);
+		pos += pheader->len + sizeof(IEEEtypes_Header_t);
+	}
+
+	LEAVE();
+	return ret;
+}
+
+/*
+ * @brief  remove 11ax IEs if band support is disabled
+ *
+ * @param priv           A pointer moal_private structure
+ * @param buf            Frame buffer
+ * @param len            Frame length
+ * @param new_ie         A pointer to newly generated IE
+ * @param new_ie_len     Length of newly generated IE
+ * @param skipped_len    Length of IEs removed
+ *
+ * @return               new ie buffer - success, NULL - otherwise
+ */
+static t_u8 *woal_remove_11ax_ies(moal_private *priv, t_u8 *ie, t_u8 len,
+				  t_u8 *new_ie_len, t_u32 ie_out_len,
+				  t_u8 *skipped_len)
+{
+	int left_len = 0;
+	const t_u8 *pos = NULL;
+	int length = 0;
+	t_u8 id = 0;
+	t_u8 ext_id = 0;
+
+	t_u8 *new_ie = NULL;
+	t_u8 min_ie_len = PACKET_ADDR4_POS + sizeof(IEEEtypes_CapInfo_t) +
+			  sizeof(IEEEtypes_StatusCode_t) +
+			  sizeof(IEEEtypes_AId_t);
+
+	/* search for 11ax IE in IE buffer */
+	if (!woal_search_ie(ie + min_ie_len, len - min_ie_len, HE_CAPABILITY,
+			    EXTENSION) &&
+	    !woal_search_ie(ie + min_ie_len, len - min_ie_len, HE_OPERATION,
+			    EXTENSION))
+		return NULL;
+
+	new_ie = kzalloc(len, GFP_KERNEL);
+	if (!new_ie) {
+		PRINTM(MERROR, "Failed to allocate memory for New IE\n");
+		return NULL;
+	}
+
+	/* copy fixed parameters of assoc response */
+	moal_memcpy_ext(priv->phandle, new_ie, ie + PACKET_ADDR4_POS,
+			sizeof(IEEEtypes_AssocRsp_t),
+			sizeof(IEEEtypes_AssocRsp_t));
+	*new_ie_len += sizeof(IEEEtypes_AssocRsp_t);
+
+	pos = ie + min_ie_len;
+	left_len = len - min_ie_len;
+
+	/* HE IE will be fileter out */
+	while (left_len >= 2) {
+		length = *(pos + 1);
+		id = *pos;
+
+		/* length exceeds remaining IE length */
+		if ((length + 2) > left_len)
+			break;
+
+		switch (id) {
+		case EXTENSION:
+			ext_id = *(pos + 2);
+			if (ext_id == HE_CAPABILITY || ext_id == HE_OPERATION ||
+			    ext_id == HE_6G_CAPABILITY) {
+				*skipped_len +=
+					length + sizeof(IEEEtypes_Header_t);
+				break;
+			}
+		// fall through
+		default:
+			if ((*new_ie_len + length + 2) < (int)ie_out_len) {
+				moal_memcpy_ext(priv->phandle,
+						new_ie + *new_ie_len, pos,
+						length + 2,
+						ie_out_len - *new_ie_len);
+				*new_ie_len += length + 2;
+			} else {
+				PRINTM(MERROR,
+				       "IE len exceeds, failed to copy %d IE\n",
+				       id);
+			}
+			break;
+		}
+		pos += (length + 2);
+		left_len -= (length + 2);
+	}
+
+	return new_ie;
+}
+
 /**
  * @brief Filter specific IE in ie buf
  *
@@ -3473,8 +3919,8 @@
  *
  * @return                out IE length
  */
-static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
-				    t_u8 *ie_out, t_u32 ie_out_len,
+static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie,
+				    size_t len, t_u8 *ie_out, t_u32 ie_out_len,
 				    t_u16 wps_flag, const t_u8 *dup_ie,
 				    int dup_ie_len)
 {
@@ -3543,13 +3989,16 @@
 		case EXTENDED_SUPPORTED_RATES:
 		case WLAN_EID_ERP_INFO:
 		/* Fall Through */
-		case REGULATORY_CLASS:
-		/* Fall Through */
 		case OVERLAPBSSSCANPARAM:
 		/* Fall Through */
 		case WAPI_IE:
 			break;
 		case EXTENSION:
+			/* skip 11ax, 6G if bands are not enabled */
+			if (!(priv->phandle->fw_bands & BAND_GAX) ||
+			    !(priv->phandle->fw_bands & BAND_AAX))
+				break;
+
 			ext_id = *(pos + 2);
 			if ((ext_id == HE_CAPABILITY || ext_id == HE_OPERATION)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
@@ -3686,6 +4135,8 @@
 				       "IE too big, fail copy VENDOR_SPECIFIC_221 IE\n");
 			}
 			break;
+		case REGULATORY_CLASS:
+			/* FALLTHRU */
 		default:
 			if ((out_len + length + 2) < (int)ie_out_len) {
 				moal_memcpy_ext(priv->phandle, ie_out + out_len,
@@ -3759,9 +4210,9 @@
  *
  * @return                MTRUE/MFALSE
  */
-static t_u16 woal_is_selected_registrar_on(const t_u8 *ie, int len)
+static t_u16 woal_is_selected_registrar_on(const t_u8 *ie, size_t len)
 {
-	int left_len = len;
+	size_t left_len = len;
 	const t_u8 *pos = ie;
 	int length;
 	t_u8 id = 0;
@@ -4044,7 +4495,8 @@
 		     beacon_ies_data->ie_length) ||
 		    (beacon_ies_data->mgmt_subtype_mask ==
 			     MLAN_CUSTOM_IE_DELETE_MASK &&
-		     beacon_vendor_index != MLAN_CUSTOM_IE_AUTO_IDX_MASK)) {
+		     priv->beacon_vendor_index !=
+			     MLAN_CUSTOM_IE_AUTO_IDX_MASK)) {
 			if (MLAN_STATUS_FAILURE ==
 			    woal_cfg80211_custom_ie(
 				    priv, beacon_ies_data, &beacon_vendor_index,
@@ -4403,13 +4855,13 @@
  *  @return             N/A
  */
 void woal_cfg80211_setup_ht_cap(struct ieee80211_sta_ht_cap *ht_info,
-				t_u32 dev_cap, t_u8 *mcs_set)
+				t_u32 dev_cap, t_u8 *mcs_set, t_u8 mpdu_density)
 {
 	ENTER();
 
 	ht_info->ht_supported = true;
 	ht_info->ampdu_factor = 0x3;
-	ht_info->ampdu_density = 0;
+	ht_info->ampdu_density = mpdu_density;
 
 	memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
 	ht_info->cap = 0;
@@ -4484,14 +4936,14 @@
 	}
 	vht_cap->vht_supported = true;
 	vht_cap->cap = cfg_11ac->param.vht_cfg.vht_cap_info;
-	vht_cap->vht_mcs.rx_mcs_map =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_rx_mcs;
-	vht_cap->vht_mcs.rx_highest =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_rx_max_rate;
-	vht_cap->vht_mcs.tx_mcs_map =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_tx_mcs;
-	vht_cap->vht_mcs.tx_highest =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_tx_max_rate;
+	vht_cap->vht_mcs.rx_mcs_map = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_rx_mcs);
+	vht_cap->vht_mcs.rx_highest = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_rx_max_rate);
+	vht_cap->vht_mcs.tx_mcs_map = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_tx_mcs);
+	vht_cap->vht_mcs.tx_highest = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_tx_max_rate);
 	PRINTM(MCMND,
 	       "vht_cap=0x%x rx_mcs_map=0x%x rx_max=0x%x tx_mcs_map=0x%x tx_max=0x%x\n",
 	       vht_cap->cap, vht_cap->vht_mcs.rx_mcs_map,
@@ -4514,8 +4966,12 @@
 ===
 HE MAC Cap:
 Bit0:  1  (+HTC HE Support)
+Bit1:	1 (TWT requester support)
+Bit2:	1 (TWT responder support)
+Bit20:	1 (Broadcast TWT support)
 Bit25: 1  (OM Control Support. But uAP does not support
 	   Tx OM received from the STA, as it does not support UL OFDMA)
+Bit28-27: Max. A-MPDU Length Exponent Extension
 
 HE PHY Cap:
 Bit1-7: 0x2 (Supported Channel Width Set.
@@ -4529,6 +4985,7 @@
 Bit19: 0x1 (STBC Rx <= 80 MHz)
 Bit20: 0x1 (Doppler Tx)
 Bit21: 0x1 (Doppler Rx)
+Bit24-25: 0x1 (DCM Max Constellation Tx)
 Bit27-28: 0x1 (DCM Max Constellation Rx)
 Bit31: 0x1 (SU Beamformer)
 Bit32: 0x1 (SU BeamFormee)
@@ -4542,16 +4999,16 @@
 Bit75: 0x1 (Rx 1024-QAM Support < 242-tone RU)
 */
 
-#define UAP_HE_MAC_CAP0_MASK 0x00
+#define UAP_HE_MAC_CAP0_MASK 0x06
 #define UAP_HE_MAC_CAP1_MASK 0x00
-#define UAP_HE_MAC_CAP2_MASK 0x00
-#define UAP_HE_MAC_CAP3_MASK 0x02
+#define UAP_HE_MAC_CAP2_MASK 0x10
+#define UAP_HE_MAC_CAP3_MASK 0x1a
 #define UAP_HE_MAC_CAP4_MASK 0x00
 #define UAP_HE_MAC_CAP5_MASK 0x00
 #define UAP_HE_PHY_CAP0_MASK 0x04
 #define UAP_HE_PHY_CAP1_MASK 0x23
 #define UAP_HE_PHY_CAP2_MASK 0x3E
-#define UAP_HE_PHY_CAP3_MASK 0x88
+#define UAP_HE_PHY_CAP3_MASK 0x89
 #define UAP_HE_PHY_CAP4_MASK 0x1D
 #define UAP_HE_PHY_CAP5_MASK 0x01
 #define UAP_HE_PHY_CAP6_MASK 0xA0
@@ -4565,8 +5022,12 @@
 ===
 HE MAC Cap:
 Bit0:   1  (+HTC HE Support)
+Bit1:	1 (TWT requester support)
+Bit2:	1 (TWT responder support)
+Bit20:	1 (Broadcast TWT support)
 Bit25: 1  (OM Control Support. Note: uAP does not support
 	Tx OM received from the STA, as it does not support UL OFDMA)
+Bit28-27: Max. A-MPDU Length Exponent Extension
 
 HE PHY Cap:
 Bit1-7: 0x1 (Supported Channel Width Set)
@@ -4578,6 +5039,7 @@
 Bit19: 0x1 (STBC Rx <= 80 MHz)
 Bit20: 0x1 (Doppler Tx)
 Bit21: 0x1 (Doppler Rx)
+Bit24-25: 0x1 (DCM Max Constellation Tx)
 Bit27-28: 0x1 (DCM Max Constellation Rx)
 Bit31: 0x1 (SU Beamformer)
 Bit32: 0x1 (SU BeamFormee)
@@ -4590,16 +5052,16 @@
 Bit59-61: 0x1 (Max Nc)
 Bit75: 0x1 (Rx 1024-QAM Support < 242-tone RU)
 */
-#define UAP_HE_2G_MAC_CAP0_MASK 0x00
+#define UAP_HE_2G_MAC_CAP0_MASK 0x06
 #define UAP_HE_2G_MAC_CAP1_MASK 0x00
-#define UAP_HE_2G_MAC_CAP2_MASK 0x00
-#define UAP_HE_2G_MAC_CAP3_MASK 0x02
+#define UAP_HE_2G_MAC_CAP2_MASK 0x10
+#define UAP_HE_2G_MAC_CAP3_MASK 0x1a
 #define UAP_HE_2G_MAC_CAP4_MASK 0x00
 #define UAP_HE_2G_MAC_CAP5_MASK 0x00
 #define UAP_HE_2G_PHY_CAP0_MASK 0x02
 #define UAP_HE_2G_PHY_CAP1_MASK 0x20
 #define UAP_HE_2G_PHY_CAP2_MASK 0x3E
-#define UAP_HE_2G_PHY_CAP3_MASK 0x88
+#define UAP_HE_2G_PHY_CAP3_MASK 0x89
 #define UAP_HE_2G_PHY_CAP4_MASK 0x1D
 #define UAP_HE_2G_PHY_CAP5_MASK 0x01
 #define UAP_HE_2G_PHY_CAP6_MASK 0xA0
@@ -4675,14 +5137,17 @@
 	t_u8 extra_mcs_size = 0;
 	int ppe_threshold_len = 0;
 	mlan_ds_11ax_he_capa *phe_cap = NULL;
-	t_u8 hw_hecap_len;
+	t_u8 hw_hecap_len = 0;
+
+	memset(&fw_info, 0, sizeof(mlan_fw_info));
 
 	woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info);
-	if (band->band == NL80211_BAND_5GHZ) {
+	if (band->band == NL80211_BAND_5GHZ && fw_info.fw_bands & BAND_AAX) {
 		phe_cap = (mlan_ds_11ax_he_capa *)fw_info.hw_he_cap;
 		hw_hecap_len = fw_info.hw_hecap_len;
 		woal_uap_update_11ax_ie(BAND_5GHZ, phe_cap);
-	} else {
+	} else if (band->band == NL80211_BAND_2GHZ &&
+		   fw_info.fw_bands & BAND_GAX) {
 		phe_cap = (mlan_ds_11ax_he_capa *)fw_info.hw_2g_he_cap;
 		hw_hecap_len = fw_info.hw_2g_hecap_len;
 		woal_uap_update_11ax_ie(BAND_2GHZ, phe_cap);
@@ -4850,10 +5315,12 @@
  *
  * @param priv           A pointer moal_private structure
  * @param reason_code    disconnect reason code
+ * @param bssid          A pointer to bssid
+ *
  *
  * @return          N/A
  */
-void woal_deauth_event(moal_private *priv, int reason_code)
+void woal_deauth_event(moal_private *priv, int reason_code, u8 *bssid)
 {
 	struct woal_event *evt;
 	unsigned long flags;
@@ -4867,7 +5334,9 @@
 	}
 	evt->priv = priv;
 	evt->type = WOAL_EVENT_DEAUTH;
-	evt->reason_code = reason_code;
+	evt->deauth_info.reason_code = reason_code;
+	moal_memcpy_ext(priv->phandle, evt->deauth_info.mac_addr, bssid,
+			MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	INIT_LIST_HEAD(&evt->link);
 	spin_lock_irqsave(&handle->evt_lock, flags);
 	list_add_tail(&evt->link, &handle->evt_queue);
@@ -4991,23 +5460,47 @@
 	int freq = 0;
 #endif
 #endif
+	struct ieee80211_channel *chan;
 	ENTER();
 
+	/* save the new channel for station interface */
+	if (priv->sme_current.ssid_len) {
+		chan = woal_get_ieee80211_channel(priv, pchan_info);
+		if (chan) {
+			moal_memcpy_ext(priv->phandle, &priv->conn_chan, chan,
+					sizeof(struct ieee80211_channel),
+					sizeof(struct ieee80211_channel));
+		}
+	}
+
 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
 	if (MLAN_STATUS_SUCCESS ==
 	    woal_chandef_create(priv, &chandef, pchan_info)) {
-#if KERNEL_VERSION(3, 14, 0) <= CFG80211_VERSION_CODE
+#if KERNEL_VERSION(6, 7, 0) <= CFG80211_VERSION_CODE
+		wiphy_lock(priv->wdev->wiphy);
+#elif KERNEL_VERSION(3, 14, 0) <= CFG80211_VERSION_CODE
 		mutex_lock(&priv->wdev->mtx);
 #endif
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 3, 0) &&                        \
+	CFG80211_VERSION_CODE < KERNEL_VERSION(6, 9, 0)
 		cfg80211_ch_switch_notify(priv->netdev, &chandef, 0, 0);
+#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 1, 0) &&                    \
+	(defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))) &&       \
+	CFG80211_VERSION_CODE < KERNEL_VERSION(6, 9, 0)
+		cfg80211_ch_switch_notify(priv->netdev, &chandef, 0, 0);
+#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                  \
+       (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
+		cfg80211_ch_switch_notify(priv->netdev, &chandef, 0);
 #else
 		cfg80211_ch_switch_notify(priv->netdev, &chandef);
 #endif
-#if KERNEL_VERSION(3, 14, 0) <= CFG80211_VERSION_CODE
+#if KERNEL_VERSION(6, 7, 0) <= CFG80211_VERSION_CODE
+		wiphy_unlock(priv->wdev->wiphy);
+#elif KERNEL_VERSION(3, 14, 0) <= CFG80211_VERSION_CODE
 		mutex_unlock(&priv->wdev->mtx);
 #endif
 		priv->channel = pchan_info->channel;
+		priv->bandwidth = pchan_info->bandcfg.chanWidth;
 #ifdef UAP_CFG80211
 		moal_memcpy_ext(priv->phandle, &priv->chan, &chandef,
 				sizeof(struct cfg80211_chan_def),
@@ -5025,6 +5518,7 @@
 		return;
 	}
 	priv->channel = pchan_info->channel;
+	priv->bandwidth = pchan_info->bandcfg.chanWidth;
 	freq = ieee80211_channel_to_frequency(pchan_info->channel, band);
 	switch (pchan_info->bandcfg.chanWidth) {
 	case CHAN_BW_20MHZ:
@@ -5042,7 +5536,7 @@
 			type = NL80211_CHAN_HT20;
 		break;
 	}
-	cfg80211_ch_switch_notify(priv->netdev, freq, type, 0);
+	cfg80211_ch_switch_notify(priv->netdev, freq, type);
 #endif
 #endif
 	LEAVE();
@@ -5139,13 +5633,15 @@
 				bands->ht_cap.mcs.rx_mask[1] = 0;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 				bands->vht_cap.vht_mcs.rx_mcs_map =
-					(__force __le16)0xfffe;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffe);
 				bands->vht_cap.vht_mcs.tx_mcs_map =
-					(__force __le16)0xfffe;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffe);
 				bands->vht_cap.vht_mcs.rx_highest =
-					(__force __le16)0x186;
+					(__force __le16)woal_cpu_to_le16(0x186);
 				bands->vht_cap.vht_mcs.tx_highest =
-					(__force __le16)0x186;
+					(__force __le16)woal_cpu_to_le16(0x186);
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 				if (bands->n_iftype_data &&
@@ -5175,13 +5671,15 @@
 				bands->ht_cap.mcs.rx_mask[1] = 0xff;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 				bands->vht_cap.vht_mcs.rx_mcs_map =
-					(__force __le16)0xfffa;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffa);
 				bands->vht_cap.vht_mcs.tx_mcs_map =
-					(__force __le16)0xfffa;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffa);
 				bands->vht_cap.vht_mcs.rx_highest =
-					(__force __le16)0x30c;
+					(__force __le16)woal_cpu_to_le16(0x30c);
 				bands->vht_cap.vht_mcs.tx_highest =
-					(__force __le16)0x30c;
+					(__force __le16)woal_cpu_to_le16(0x30c);
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 				if (bands->n_iftype_data &&
diff --git a/wlan_sd8987/mlinux/moal_cfg80211.h b/wlan_src/mlinux/moal_cfg80211.h
old mode 100755
new mode 100644
similarity index 84%
rename from wlan_sd8987/mlinux/moal_cfg80211.h
rename to wlan_src/mlinux/moal_cfg80211.h
index d9ca184..08e2cff
--- a/wlan_sd8987/mlinux/moal_cfg80211.h
+++ b/wlan_src/mlinux/moal_cfg80211.h
@@ -3,20 +3,28 @@
  * @brief This file contains the CFG80211 specific defines.
  *
  *
- * Copyright 2011-2022 NXP
+ * Copyright 2011-2022, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -58,7 +66,6 @@
 
 /* define for custom ie operation */
 #define MLAN_CUSTOM_IE_AUTO_IDX_MASK 0xffff
-#define MLAN_CUSTOM_IE_NEW_MASK 0x8000
 #define IE_MASK_WPS 0x0001
 #define IE_MASK_P2P 0x0002
 #define IE_MASK_WFD 0x0004
@@ -67,10 +74,14 @@
 
 #define MRVL_PKT_TYPE_MGMT_FRAME 0xE5
 
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+#define MRVL_PKT_TYPE_MGMT_EASYMESH 0xCF
+#endif
+
 mlan_status woal_cfg80211_set_key(moal_private *priv, t_u8 is_enable_wep,
 				  t_u32 cipher, const t_u8 *key, int key_len,
 				  const t_u8 *seq, int seq_len, t_u8 key_index,
-				  const t_u8 *addr, int disable,
+				  const t_u8 *addr, int disable, t_u8 pairwise,
 				  t_u8 wait_option);
 
 mlan_status woal_cfg80211_set_wep_keys(moal_private *priv, const t_u8 *key,
@@ -107,6 +118,8 @@
 void woal_host_mlme_work_queue(struct work_struct *work);
 void woal_host_mlme_process_assoc_resp(moal_private *priv,
 				       mlan_ds_assoc_info *assoc_info);
+void woal_host_mlme_process_assoc_timeout(moal_private *priv,
+					  struct cfg80211_bss *bss);
 #endif
 #endif
 
@@ -128,7 +141,8 @@
 int woal_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed);
 
 int woal_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 			  int link_id,
 #endif
 			  t_u8 key_index,
@@ -138,7 +152,8 @@
 			  const t_u8 *mac_addr, struct key_params *params);
 
 int woal_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 			  int link_id,
 #endif
 			  t_u8 key_index,
@@ -162,7 +177,8 @@
 #endif
 
 int woal_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *dev,
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 				   unsigned int link_id,
 #endif
 				   const u8 *peer,
@@ -213,7 +229,8 @@
 
 #if KERNEL_VERSION(2, 6, 37) < CFG80211_VERSION_CODE
 int woal_cfg80211_set_default_key(struct wiphy *wiphy, struct net_device *dev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 				  int link_id,
 #endif
 				  t_u8 key_index, bool ucast, bool mcast);
@@ -225,7 +242,8 @@
 #if KERNEL_VERSION(2, 6, 30) <= CFG80211_VERSION_CODE
 int woal_cfg80211_set_default_mgmt_key(struct wiphy *wiphy,
 				       struct net_device *netdev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 				       int link_id,
 #endif
 				       t_u8 key_index);
@@ -234,7 +252,8 @@
 #if KERNEL_VERSION(5, 10, 0) <= CFG80211_VERSION_CODE
 int woal_cfg80211_set_default_beacon_key(struct wiphy *wiphy,
 					 struct net_device *netdev,
-#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) || IMX_ANDROID_13)
+#if ((KERNEL_VERSION(6, 1, 0) <= LINUX_VERSION_CODE) ||                        \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))
 					 int link_id,
 #endif
 					 t_u8 key_index);
@@ -427,7 +446,13 @@
 			       struct cfg80211_coalesce *coalesce);
 #endif
 
-#if KERNEL_VERSION(3, 4, 0) <= CFG80211_VERSION_CODE
+#if KERNEL_VERSION(6, 7, 0) <= CFG80211_VERSION_CODE
+int woal_cfg80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
+			     struct cfg80211_ap_settings *params);
+
+int woal_cfg80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
+			     struct cfg80211_ap_update *info);
+#elif KERNEL_VERSION(3, 4, 0) <= CFG80211_VERSION_CODE
 int woal_cfg80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 			     struct cfg80211_ap_settings *params);
 
@@ -441,7 +466,8 @@
 			     struct beacon_parameters *params);
 #endif
 
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 int woal_cfg80211_del_beacon(struct wiphy *wiphy, struct net_device *dev,
 			     unsigned int link_id);
 #else
@@ -502,7 +528,7 @@
 #endif
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
-void woal_deauth_event(moal_private *priv, int reason_code);
+void woal_deauth_event(moal_private *priv, int reason_code, u8 *bssid);
 #endif
 
 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
@@ -532,7 +558,8 @@
 int woal_get_active_intf_freq(moal_private *priv);
 
 void woal_cfg80211_setup_ht_cap(struct ieee80211_sta_ht_cap *ht_info,
-				t_u32 dev_cap, t_u8 *mcs_set);
+				t_u32 dev_cap, t_u8 *mcs_set,
+				t_u8 mpdu_density);
 #if KERNEL_VERSION(3, 6, 0) <= CFG80211_VERSION_CODE
 void woal_cfg80211_setup_vht_cap(moal_private *priv,
 				 struct ieee80211_sta_vht_cap *vht_cap);
diff --git a/wlan_sd8987/mlinux/moal_cfg80211_util.c b/wlan_src/mlinux/moal_cfg80211_util.c
old mode 100755
new mode 100644
similarity index 66%
rename from wlan_sd8987/mlinux/moal_cfg80211_util.c
rename to wlan_src/mlinux/moal_cfg80211_util.c
index 0b885aa..815be91
--- a/wlan_sd8987/mlinux/moal_cfg80211_util.c
+++ b/wlan_src/mlinux/moal_cfg80211_util.c
@@ -3,20 +3,28 @@
  * @brief This file contains the functions for CFG80211 vendor.
  *
  *
- * Copyright 2015-2022 NXP
+ * Copyright 2015-2022, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -116,6 +124,10 @@
 		.vendor_id = MRVL_VENDOR_ID,
 		.subcmd = event_wake_reason_report,
 	},
+	{
+		.vendor_id = MRVL_VENDOR_ID,
+		.subcmd = event_rtt_result,
+	}, /*event_id ???*/
 	/**add vendor event here*/
 };
 
@@ -140,15 +152,43 @@
 	[ATTR_SCAN_MAC_OUI_SET] = {.type = NLA_STRING, .len = 3},
 	[ATTR_NODFS_VALUE] = {.type = NLA_U32},
 	[ATTR_GET_CONCURRENCY_MATRIX_SET_SIZE_MAX] = {.type = NLA_U32},
+	[ATTR_SCAN_BAND_SET] = {.type = NLA_U8},
 };
-
+static const struct nla_policy woal_secure_ranging_ctx_policy
+	[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_MAX + 1] = {
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_ACTION] =
+			{.type = NLA_U32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SRC_ADDR] =
+			{.type = NLA_STRING, .len = ETH_ALEN},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_PEER_MAC_ADDR] =
+			{.type = NLA_STRING, .len = ETH_ALEN},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SHA_TYPE] =
+			{.type = NLA_U32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_TK] =
+			{.type = NLA_STRING, .len = 32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_CIPHER] =
+			{.type = NLA_U32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_LTF_KEYSEED] =
+			{.type = NLA_STRING, .len = 48},
+};
 // clang-format off
 static const struct nla_policy
-	woal_nd_offload_policy[ATTR_ND_OFFLOAD_MAX + 1] = {
+        woal_nd_offload_policy[ATTR_ND_OFFLOAD_MAX + 1] = {
 		[ATTR_ND_OFFLOAD_CONTROL] = {.type = NLA_U8},
 };
 // clang-format on
 
+static const struct nla_policy woal_rtt_policy[ATTR_RTT_MAX + 1] = {
+	[ATTR_RTT_TARGET_NUM] = {.type = NLA_U8},
+	[ATTR_RTT_TARGET_CONFIG] = {.type = NLA_BINARY},
+	[ATTR_RTT_TARGET_ADDR] = {.type = NLA_STRING, .len = ETH_ALEN},
+	[ATTR_RTT_CHANNEL_INFO] = {.type = NLA_BINARY},
+	[ATTR_RTT_MAX_DUR_SEC] = {.type = NLA_U32},
+	[ATTR_RTT_LCI_INFO] = {.type = NLA_BINARY},
+	[ATTR_RTT_LCR_INFO] = {.type = NLA_BINARY},
+
+};
+
 static const struct nla_policy
 	woal_rssi_monitor_policy[ATTR_RSSI_MONITOR_MAX + 1] = {
 		[ATTR_RSSI_MONITOR_CONTROL] = {.type = NLA_U32},
@@ -283,6 +323,54 @@
 #endif
 
 /**
+ * @brief send vendor event to kernel
+ *
+ * @param priv       A pointer to moal_private
+ * @param event    vendor event
+ * @param  len     data length
+ *
+ * @return      0: success  1: fail
+ */
+static struct sk_buff *woal_cfg80211_alloc_vendor_event(moal_private *priv,
+							int event, int len)
+{
+	struct wiphy *wiphy = NULL;
+	struct sk_buff *skb = NULL;
+	int event_id = 0;
+
+	ENTER();
+
+	if (!priv || !priv->wdev || !priv->wdev->wiphy) {
+		PRINTM(MERROR, "Not find this event %d\n", event_id);
+		goto done;
+	}
+	wiphy = priv->wdev->wiphy;
+	PRINTM(MEVENT, "vendor event :0x%x\n", event);
+	event_id = woal_get_event_id(event);
+	if (event_max == event_id) {
+		PRINTM(MERROR, "Not find this event %d\n", event_id);
+		goto done;
+	}
+
+	/**allocate skb*/
+#if KERNEL_VERSION(4, 1, 0) <= CFG80211_VERSION_CODE
+	skb = cfg80211_vendor_event_alloc(wiphy, priv->wdev, len, event_id,
+					  GFP_ATOMIC);
+#else
+	skb = cfg80211_vendor_event_alloc(wiphy, len, event_id, GFP_ATOMIC);
+#endif
+
+	if (!skb) {
+		PRINTM(MERROR, "allocate memory fail for vendor event\n");
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return skb;
+}
+
+/**
  * @brief send dfs vendor event to kernel
  *
  * @param priv       A pointer to moal_private
@@ -722,6 +810,9 @@
 	int ret = MLAN_STATUS_SUCCESS;
 	int length = 0;
 	char driver_dump_file[128];
+#ifndef DUMP_TO_PROC
+	char path_name[64];
+#endif
 	struct sk_buff *skb = NULL;
 
 	ENTER();
@@ -733,12 +824,24 @@
 	dev = wdev->netdev;
 	priv = (moal_private *)woal_get_netdev_priv(dev);
 	handle = priv->phandle;
+#ifdef DUMP_TO_PROC
 	memset(driver_dump_file, 0, sizeof(driver_dump_file));
-	sprintf(driver_dump_file, "/proc/mwlan/");
+	snprintf(driver_dump_file, sizeof(driver_dump_file), "/proc/mwlan/");
 	if (handle->handle_idx)
-		sprintf(driver_dump_file, "drv_dump%d", handle->handle_idx);
+		snprintf(driver_dump_file, sizeof(driver_dump_file),
+			 "drv_dump%d", handle->handle_idx);
 	else
-		sprintf(driver_dump_file, "drv_dump");
+		snprintf(driver_dump_file, sizeof(driver_dump_file),
+			 "drv_dump");
+#else
+	memset(path_name, 0, sizeof(path_name));
+	woal_create_dump_dir(handle, path_name, sizeof(path_name));
+	PRINTM(MMSG, "driver dump path name is %s\n", path_name);
+	woal_dump_drv_info(handle, path_name);
+	memset(driver_dump_file, 0, sizeof(driver_dump_file));
+	snprintf(driver_dump_file, sizeof(driver_dump_file), "%s/%s", path_name,
+		 "file_drv_info");
+#endif
 	PRINTM(MMSG, "driver dump file is %s\n", driver_dump_file);
 	length = sizeof(driver_dump_file);
 	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, length);
@@ -806,6 +909,8 @@
 	}
 	if (fw_info.fw_bands & BAND_A)
 		supp_feature_set |= WLAN_FEATURE_INFRA_5G;
+	if (fw_info.rtt_support)
+		supp_feature_set |= WLAN_FEATURE_D2AP_RTT;
 	if (fw_info.fw_roaming_support)
 		supp_feature_set |= WLAN_FEATURE_CONTROL_ROAMING;
 
@@ -1045,7 +1150,7 @@
  *
  * @return      An invalid ring id for failure or valid ring id on success.
  */
-int woal_get_ring_id_by_name(moal_private *priv, char *ring_name)
+static int woal_get_ring_id_by_name(moal_private *priv, char *ring_name)
 {
 	int id;
 	wifi_ring_buffer *ring;
@@ -1075,8 +1180,9 @@
  *
  * @return      0: success  1: fail
  */
-int woal_start_logging(moal_private *priv, char *ring_name, int log_level,
-		       int flags, int time_intval, int threshold)
+static int woal_start_logging(moal_private *priv, char *ring_name,
+			      int log_level, int flags, int time_intval,
+			      int threshold)
 {
 	int ret = 0;
 	int ring_id;
@@ -1355,8 +1461,8 @@
  *
  * @return      data length
  */
-int woal_ring_pull_data(moal_private *priv, int ring_id, void *data,
-			t_s32 buf_len)
+static int woal_ring_pull_data(moal_private *priv, int ring_id, void *data,
+			       t_s32 buf_len)
 {
 	t_s32 r_len = 0;
 	wifi_ring_buffer *ring;
@@ -1402,9 +1508,10 @@
  *
  * @return      0: success  1: fail
  */
-int woal_ring_buffer_data_vendor_event(moal_private *priv, int ring_id,
-				       t_u8 *data, int len,
-				       wifi_ring_buffer_status *ring_status)
+static int
+woal_ring_buffer_data_vendor_event(moal_private *priv, int ring_id, t_u8 *data,
+				   int len,
+				   wifi_ring_buffer_status *ring_status)
 {
 	struct wiphy *wiphy = NULL;
 	struct sk_buff *skb = NULL;
@@ -1491,7 +1598,7 @@
  *
  * @return void
  */
-void woal_ring_poll_worker(struct work_struct *work)
+static void woal_ring_poll_worker(struct work_struct *work)
 {
 	struct delayed_work *d_work = to_delayed_work(work);
 	wifi_ring_buffer *ring_info =
@@ -1562,8 +1669,8 @@
  *
  * @return      0: success  -1: fail
  */
-int woal_ring_push_data(moal_private *priv, int ring_id,
-			wifi_ring_buffer_entry *hdr, void *data)
+static int woal_ring_push_data(moal_private *priv, int ring_id,
+			       wifi_ring_buffer_entry *hdr, void *data)
 {
 	unsigned long flags;
 	t_u32 w_len;
@@ -1653,6 +1760,7 @@
 
 	if ((ring->wp + w_len) > ring->ring_size ||
 	    (ring->ctrl.written_bytes + w_len) > ring->ring_size) {
+		spin_unlock_irqrestore(&ring->lock, flags);
 		PRINTM(MERROR,
 		       "Ring push buffer overflow: rp=%d  wp=%d, write_bytes=%d\n",
 		       ring->rp, ring->wp, ring->ctrl.written_bytes);
@@ -1975,8 +2083,8 @@
  *
  * @return      0: success  1: fail
  */
-int woal_wake_reason_vendor_event(moal_private *priv,
-				  mlan_ds_hs_wakeup_reason wake_reason)
+static int woal_wake_reason_vendor_event(moal_private *priv,
+					 mlan_ds_hs_wakeup_reason wake_reason)
 {
 	struct wiphy *wiphy = NULL;
 	struct sk_buff *skb = NULL;
@@ -2068,9 +2176,8 @@
 	t_u32 reply_len = 0;
 	int ret = 0;
 
-	/* TODO: Tune pkt fate monitor for TP, Disabling it for now */
-	// struct net_device *dev = wdev->netdev;
-	// moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 
 	ENTER();
 
@@ -2082,8 +2189,9 @@
 		goto done;
 	}
 
-	/* TODO: Tune pkt fate monitor for TP, Disabling it for now */
-	// priv->pkt_fate_monitor_enable = MTRUE;
+	/* Enable pkt fate monitor and use drvdbg MDAT_D to control forwarding
+	 * data packet to kernel */
+	priv->pkt_fate_monitor_enable = MTRUE;
 
 	ret = cfg80211_vendor_cmd_reply(skb);
 
@@ -2108,10 +2216,11 @@
  *
  * @return      0: success  1: fail
  */
-int woal_packet_fate_vendor_event(moal_private *priv,
-				  packet_fate_packet_type pkt_type, t_u8 fate,
-				  frame_type payload_type, t_u32 drv_ts_usec,
-				  t_u32 fw_ts_usec, t_u8 *data, t_u32 len)
+static int woal_packet_fate_vendor_event(moal_private *priv,
+					 packet_fate_packet_type pkt_type,
+					 t_u8 fate, frame_type payload_type,
+					 t_u32 drv_ts_usec, t_u32 fw_ts_usec,
+					 t_u8 *data, t_u32 len)
 {
 	struct wiphy *wiphy = NULL;
 	struct sk_buff *skb = NULL;
@@ -2339,7 +2448,7 @@
 				nla_data(iter),
 				MIN(packet_filter_len, nla_len(iter)));
 			pkt_filter->packet_filter_len =
-				MIN(packet_filter_len, nla_len(iter));
+				(t_u8)MIN(packet_filter_len, nla_len(iter));
 			pkt_filter->state = PACKET_FILTER_STATE_START;
 			spin_unlock_irqrestore(&pkt_filter->lock, flags);
 			DBG_HEXDUMP(MDAT_D, "packet_filter_program",
@@ -2431,8 +2540,9 @@
  * @return non-zero if packet should be passed to AP, zero if
  *         packet should be dropped.
  */
-int process_packet(const t_u8 *program, t_u32 program_len, const t_u8 *packet,
-		   t_u32 packet_len, t_u32 filter_age)
+static int process_packet(const t_u8 *program, t_u32 program_len,
+			  const t_u8 *packet, t_u32 packet_len,
+			  t_u32 filter_age)
 {
 	/* Program counter */
 	t_u32 pc = 0;
@@ -2727,7 +2837,7 @@
 	unsigned long flags;
 
 	ENTER();
-	pkt_filter = priv->packet_filter;
+	pkt_filter = (packet_filter *)priv->packet_filter;
 	if (!unlikely(pkt_filter)) {
 		PRINTM(MINFO, "packet_filter not init\n");
 		goto done;
@@ -2789,6 +2899,659 @@
 }
 
 /**
+ * @brief Prints the scancfg params from the mlan_ds_scan struct
+ *
+ * @param scan	A pointer to mlan_ds_scan struct
+ *
+ * @return      void
+ */
+static void woal_print_scancfg_params(mlan_ds_scan *scan)
+{
+	if (!scan)
+		return;
+	PRINTM(MCMND,
+	       "scancfg params: scan_type = 0x%x, scan_mode = 0x%x, scan_probe = 0x%x \n",
+	       scan->param.scan_cfg.scan_type, scan->param.scan_cfg.scan_mode,
+	       scan->param.scan_cfg.scan_probe);
+
+	PRINTM(MCMND, "scancfg params: passive_to_active_scan = 0x%x \n",
+	       scan->param.scan_cfg.passive_to_active_scan);
+
+	PRINTM(MCMND,
+	       "scancfg params: specific_scan_time = 0x%x, active_scan_time = 0x%x, passive_scan_time = 0x%x \n",
+	       scan->param.scan_cfg.scan_time.specific_scan_time,
+	       scan->param.scan_cfg.scan_time.active_scan_time,
+	       scan->param.scan_cfg.scan_time.passive_scan_time);
+
+	PRINTM(MCMND, "scancfg params: ext_scan = 0x%x\n",
+	       scan->param.scan_cfg.ext_scan);
+	PRINTM(MCMND, "scancfg params: scan_chan_gap = 0x%x\n",
+	       scan->param.scan_cfg.scan_chan_gap);
+}
+
+/**
+ * @brief Parse the vendor cmd input data based on attribute len
+ * 	  and copy each attrubute into a output buffer/integer array
+ *
+ * @param data			A pointer to input data buffer
+ * @param data_len		Input data buffer total len
+ * @param user_buff		A pointer to output data buffer after the
+ * parsing
+ * @param buff_len		Maximum no. of data attributes to be parsed
+ * @param user_data_len		No. of data attributes that are parsed
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_parse_vendor_cmd_attributes(t_u8 *data, t_u32 data_len,
+					    t_u32 *user_buff, t_u32 buff_len,
+					    t_u16 *user_data_len)
+{
+	t_u16 i = 0, j = 0, len = 0;
+
+	len = strlen(data);
+	for (i = 0, j = 0; (i < data_len) && (j < buff_len); ++j) {
+		t_u32 value = 0, value1 = 0;
+		t_u8 attr_len = 0;
+		attr_len = (t_u8) * (data + i);
+		++i;
+		if (attr_len > 0) {
+			t_u8 k = 0;
+			for (k = 0; k < attr_len; ++k) {
+				value1 = (t_u8) * (data + i + k);
+				value = (value << 8) + value1;
+			}
+			i = i + k;
+		} else {
+			PRINTM(MERROR, "\nIn parse_args: Invalid attr_len \n");
+			*user_data_len = 0;
+			return -1;
+		}
+		user_buff[j] = value;
+	}
+	*user_data_len = j;
+	return 0;
+}
+
+/**
+ * @brief Vendor cmd to trigger the scancfg params.
+ *	Set/Get the scancfg params to/from driver
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_set_get_scancfg(struct wiphy *wiphy,
+						struct wireless_dev *wdev,
+						const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_ds_scan *scan = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	struct sk_buff *skb = NULL;
+	t_s32 user_data[9];
+	t_s32 ret = 0;
+	t_u16 user_data_len = 0;
+	t_u16 ret_length = 1;
+	t_u8 get_data = 0, get_val = 0;
+	t_u8 *data_buff = (t_u8 *)data;
+	t_u8 *pos = NULL;
+	ENTER();
+
+	if (len < 1) {
+		PRINTM(MERROR, "vendor cmd: scancfg - Invalid data length!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	if (len == 1) {
+		PRINTM(MMSG, "vendor cmd: Get scancfg params!\n");
+		get_val = (t_u8) * (data_buff);
+
+		/* Get scancfg works if an input argument passed is 00 */
+		if (get_val) {
+			PRINTM(MERROR,
+			       "vendor cmd: Get scancfg failed due to Invalid argument!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		get_data = 1;
+	} else if (len > 1) {
+		PRINTM(MMSG, "Vendor cmd: Set scancfg params!\n");
+		memset((char *)user_data, 0, sizeof(user_data));
+
+		/* vendor cmd : the user_data_len is set only for set cmd */
+		if (woal_parse_vendor_cmd_attributes(data_buff, len, user_data,
+						     ARRAY_SIZE(user_data),
+						     &user_data_len)) {
+			PRINTM(MMSG,
+			       "vendor cmd: Couldn't parse the scancfg params!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_scan));
+	if (req == NULL) {
+		PRINTM(MERROR,
+		       "vendor cmd: Could not allocate mlan ioctl request, scancfg!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	scan = (mlan_ds_scan *)req->pbuf;
+	scan->sub_command = MLAN_OID_SCAN_CONFIG;
+	req->req_id = MLAN_IOCTL_SCAN;
+
+	/* Validate each scancfg parameters */
+	if (user_data_len) {
+		DBG_HEXDUMP(MCMD_D, "scancfg input dump: ", (t_u8 *)user_data,
+			    (user_data_len * sizeof(t_u32)));
+		moal_memcpy_ext(priv->phandle, &scan->param.scan_cfg, user_data,
+				sizeof(user_data),
+				sizeof(scan->param.scan_cfg));
+		if (scan->param.scan_cfg.scan_type > MLAN_SCAN_TYPE_PASSIVE) {
+			PRINTM(MERROR,
+			       "vendor cmd:Invalid argument for scan type\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (scan->param.scan_cfg.scan_mode > MLAN_SCAN_MODE_ANY) {
+			PRINTM(MERROR,
+			       "vendor cmd:Invalid argument for scan mode\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (scan->param.scan_cfg.scan_probe > MAX_PROBES) {
+			PRINTM(MERROR,
+			       "vendor cmd:Invalid argument for scan probes\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if ((scan->param.scan_cfg.scan_time.specific_scan_time >
+		     MRVDRV_MAX_ACTIVE_SCAN_CHAN_TIME) ||
+		    (scan->param.scan_cfg.scan_time.active_scan_time >
+		     MRVDRV_MAX_ACTIVE_SCAN_CHAN_TIME) ||
+		    (scan->param.scan_cfg.scan_time.passive_scan_time >
+		     MRVDRV_MAX_PASSIVE_SCAN_CHAN_TIME)) {
+			PRINTM(MERROR, "Invalid argument for scan time\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (scan->param.scan_cfg.passive_to_active_scan >
+		    MLAN_PASS_TO_ACT_SCAN_DIS) {
+			PRINTM(MERROR,
+			       "Invalid argument for Passive to Active Scan\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (scan->param.scan_cfg.ext_scan > MLAN_EXT_SCAN_ENH) {
+			PRINTM(MERROR, "Invalid argument for extended scan\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (scan->param.scan_cfg.scan_chan_gap >
+		    MRVDRV_MAX_SCAN_CHAN_GAP_TIME) {
+			PRINTM(MERROR,
+			       "Invalid argument for scan channel gap\n");
+			ret = -EINVAL;
+			goto done;
+		}
+
+		req->action = MLAN_ACT_SET;
+		if (scan->param.scan_cfg.scan_time.specific_scan_time)
+			priv->phandle->user_scan_cfg = MTRUE;
+		PRINTM(MINFO, "vendor cmd: SET ioctl request for scanfg\n");
+		woal_print_scancfg_params(scan);
+	} else {
+		PRINTM(MINFO, "vendor cmd: GET ioctl request for scanfg\n");
+		req->action = MLAN_ACT_GET;
+	}
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status == MLAN_STATUS_SUCCESS) {
+		PRINTM(MMSG, "Set/Get scancfg ioctl successfull\n");
+		if (!user_data_len) {
+			moal_memcpy_ext(priv->phandle, user_data,
+					&scan->param.scan_cfg,
+					sizeof(scan->param.scan_cfg),
+					sizeof(user_data));
+			DBG_HEXDUMP(MCMD_D, "scancfg dump: ", (t_u8 *)user_data,
+				    sizeof(user_data));
+			ret_length = sizeof(mlan_scan_cfg);
+		}
+	} else {
+		PRINTM(MERROR, "Set/Get scancfg ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* Allocate skb for cmd reply*/
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, ret_length);
+	if (!skb) {
+		PRINTM(MERROR,
+		       "vendor cmd: allocate memory fail for vendor cmd\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+	/* Get scancfg if an input argument passed is 00 */
+	if (!user_data_len && get_data == 1) {
+		PRINTM(MINFO, "vendor cmd: copying the response into buffer\n");
+		scan = (mlan_ds_scan *)req->pbuf;
+		pos = skb_put(skb, sizeof(mlan_scan_cfg));
+		moal_memcpy_ext(priv->phandle, pos, &scan->param.scan_cfg,
+				sizeof(mlan_scan_cfg), sizeof(mlan_scan_cfg));
+		woal_print_scancfg_params(scan);
+	}
+
+	ret = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(ret))
+		PRINTM(MERROR, "vendor cmd: reply failed with ret:%d \n", ret);
+
+done:
+	if (status != MLAN_STATUS_PENDING && req)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
+/*
+ * @brief A common function copies an user data(from integer array) into
+ * different types of structures. Declare a layout based on each member size of
+ * a strucure within the caller().
+ *
+ * @param phandle		A pointer to moal handler
+ * @param dest_struct		Final destination strucuture
+ * @param src_data		A pointer to input user data/integer array
+ * @param src_data_len		Input user data length
+ * @param dest_struct_len	Destination data structure length
+ * @param layout		A pointer to integer array/layout describing struct
+ * member
+ * *
+ * @return      0: success  -1: fail
+ * */
+static void
+woal_memcpy_user_intarray_to_struct(moal_handle *phandle, void *dest_struct,
+				    t_u32 *src_data, t_u32 src_data_len,
+				    t_u32 dest_struct_len, t_u32 *layout)
+{
+	t_u8 *dest = (t_u8 *)dest_struct;
+	t_u16 i = 0;
+
+	if (!dest_struct || !src_data) {
+		PRINTM(MERROR, "dest/src pointer is null\n");
+	}
+
+	for (i = 0; (layout[i] > 0 && i < src_data_len); ++i) {
+		moal_memcpy_ext(phandle, dest, src_data, layout[i], layout[i]);
+		dest += layout[i];
+		if (layout[i] > sizeof(t_u32)) {
+			src_data += layout[i] / sizeof(t_u32);
+			src_data += (layout[i] % sizeof(t_u32)) ? 1 : 0;
+		} else
+			src_data += 1;
+	}
+}
+
+/*
+ * @brief A common function directly copies different type of structures into
+ * user data buffer(integere array). Declare a layout based on each member size
+ * of a strucure within the caller function.
+ *
+ * @param phandle		A pointer to moal handler
+ * @param dest_data		A pointer to destination data buffer/integer
+ * array
+ * @param src_struct		A pointer to source structure
+ * @param src_struct_len	Source data structure length
+ * @param dest_data_len		Destination user data length
+ * @param layout		A pointer to integer array/layout describing struct
+ * member
+ * *
+ * @return      0: success  -1: fail
+ * */
+static void
+woal_memcpy_struct_to_user_intarray(moal_handle *phandle, t_u32 *dest_data,
+				    void *src_struct, t_u32 src_struct_len,
+				    t_u32 dest_data_len, t_u32 *layout)
+{
+	t_u8 *src = (t_u8 *)src_struct;
+	t_u16 i = 0;
+
+	if (!dest_data || !src_struct) {
+		PRINTM(MERROR, "dest/src pointer is null\n");
+	}
+
+	for (i = 0; (layout[i] > 0 && i < dest_data_len); ++i) {
+		moal_memcpy_ext(phandle, dest_data, src, layout[i], layout[i]);
+		src += layout[i];
+		if (layout[i] > sizeof(t_u32)) {
+			dest_data += layout[i] / sizeof(t_u32);
+			dest_data += (layout[i] % sizeof(t_u32)) ? 1 : 0;
+		} else
+			dest_data += 1;
+	}
+}
+
+/**
+ * @brief Prints the addba params from the woal_print_addba_param
+ *
+ * @param scan	A pointer to woal_print_addba_param struct
+ *
+ * @return      void
+ */
+static void woal_print_addba_params(mlan_ds_11n_addba_param *addba)
+{
+	if (!addba) {
+		PRINTM(MERROR, "addba param is null\n");
+		return;
+	}
+
+	PRINTM(MCMND,
+	       "ADDBA: timeout:%d txwinsize:%d rxwinsize:%d txamsdu=%d, rxamsdu=%d\n",
+	       addba->timeout, addba->txwinsize, addba->rxwinsize,
+	       addba->txamsdu, addba->rxamsdu);
+	return;
+}
+
+/**
+ * @brief API to trigger the addba params.
+ *	It sets or gets the addba params
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_set_get_addbaparams(struct wiphy *wiphy,
+						    struct wireless_dev *wdev,
+						    const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_ds_11n_cfg *cfg_addba = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	struct sk_buff *skb = NULL;
+	t_u32 user_data[5];
+	/* Define layout as per required structure */
+	t_u32 layout[5] = {sizeof(t_u32), sizeof(t_u32), sizeof(t_u32),
+			   sizeof(char), sizeof(char)};
+	t_s32 ret = 0;
+	t_u16 user_data_len = 0;
+	t_u16 ret_length = 1;
+	t_u8 get_data = 0, get_val = 0;
+	t_u8 *data_buff = (t_u8 *)data;
+	t_u8 *pos = NULL;
+	ENTER();
+
+	if (len < 1) {
+		PRINTM(MERROR,
+		       "vendor cmd: addbaparams - Invalid data length!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	if (len == 1) {
+		PRINTM(MMSG, "vendor cmd: Get addbaparams!\n");
+		get_val = (t_u8) * (data_buff);
+
+		/* Get addbaparams works if an input argument passed is 00 */
+		if (get_val) {
+			PRINTM(MERROR,
+			       "vendor cmd: Get addbaparams failed due to Invalid argument!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		get_data = 1;
+		memset((char *)user_data, 0, sizeof(user_data));
+	} else if (len > 1) {
+		PRINTM(MMSG, "Vendor cmd: Set addbaparams !\n");
+		memset((char *)user_data, 0, sizeof(user_data));
+
+		/* vendor cmd : the user_data_len is set only for set cmd */
+		if (woal_parse_vendor_cmd_attributes(data_buff, len, user_data,
+						     ARRAY_SIZE(user_data),
+						     &user_data_len)) {
+			PRINTM(MERROR,
+			       "vendor cmd: Couldn't parse the addbaparams!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11n_cfg));
+	if (req == NULL) {
+		PRINTM(MERROR,
+		       "vendor cmd: Could not allocate mlan ioctl request, addbaparams!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	cfg_addba = (mlan_ds_11n_cfg *)req->pbuf;
+	cfg_addba->sub_command = MLAN_OID_11N_CFG_ADDBA_PARAM;
+	req->req_id = MLAN_IOCTL_11N_CFG;
+
+	/* Validate each addbaparams parameters */
+	if (user_data_len) {
+		DBG_HEXDUMP(MCMD_D,
+			    "addbaparams input dump: ", (t_u8 *)user_data,
+			    (user_data_len * sizeof(t_u32)));
+		/* To copy an user data in an integer array format into strcture
+		 */
+		woal_memcpy_user_intarray_to_struct(
+			priv->phandle, (void *)&cfg_addba->param.addba_param,
+			user_data, ARRAY_SIZE(user_data),
+			sizeof(cfg_addba->param.addba_param), layout);
+
+		woal_print_addba_params(&cfg_addba->param.addba_param);
+		if (cfg_addba->param.addba_param.timeout >
+		    MLAN_DEFAULT_BLOCK_ACK_TIMEOUT) {
+			PRINTM(MERROR, "Incorrect addba timeout value.\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (cfg_addba->param.addba_param.txwinsize >
+		    MLAN_AMPDU_MAX_TXWINSIZE) {
+			PRINTM(MERROR, "Incorrect Tx window size.\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (cfg_addba->param.addba_param.rxwinsize >
+		    MLAN_AMPDU_MAX_RXWINSIZE) {
+			PRINTM(MERROR, "Incorrect Rx window size.\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (cfg_addba->param.addba_param.txamsdu > 1 ||
+		    cfg_addba->param.addba_param.rxamsdu > 1) {
+			PRINTM(MERROR, "Incorrect Tx/Rx amsdu.\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		req->action = MLAN_ACT_SET;
+		PRINTM(MINFO,
+		       "vendor cmd: SET ioctl request for addbaparams\n");
+	} else {
+		PRINTM(MINFO,
+		       "vendor cmd: GET ioctl request for addbaparams\n");
+		req->action = MLAN_ACT_GET;
+	}
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status == MLAN_STATUS_SUCCESS) {
+		PRINTM(MMSG, "Set/Get addbaparams ioctl successfull\n");
+		if (!user_data_len) {
+			/* To copy an strcture members into user data/integer
+			 * array separately */
+			woal_memcpy_struct_to_user_intarray(
+				priv->phandle, user_data,
+				(void *)&cfg_addba->param.addba_param,
+				sizeof(cfg_addba->param.addba_param),
+				ARRAY_SIZE(user_data), layout);
+			woal_print_addba_params(&cfg_addba->param.addba_param);
+			ret_length = sizeof(user_data);
+		}
+	} else {
+		PRINTM(MERROR, "Set/Get addbaparams ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* Allocate skb for cmd reply*/
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, ret_length);
+	if (!skb) {
+		PRINTM(MERROR,
+		       "vendor cmd: allocate memory fail for vendor cmd\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Get addbaparams if an input data argument is 00 */
+	if (!user_data_len && get_data == 1) {
+		PRINTM(MINFO, "vendor cmd: copying the response into buffer\n");
+		DBG_HEXDUMP(MCMD_D, "addbaparams dump: ", (t_u8 *)user_data,
+			    sizeof(user_data));
+		cfg_addba = (mlan_ds_11n_cfg *)req->pbuf;
+		pos = skb_put(skb, sizeof(user_data));
+		moal_memcpy_ext(priv->phandle, pos, user_data,
+				sizeof(user_data), sizeof(user_data));
+	}
+
+	ret = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(ret))
+		PRINTM(MERROR, "vendor cmd: reply failed with ret:%d \n", ret);
+
+done:
+	if (status != MLAN_STATUS_PENDING && req)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief API to trigger the vendor cmd related to
+ * hostcmd/sys_cfg_80211d_country_ie. It sets/get/clear the function/operation
+ * that is specific the hostcmd.
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_hostcmd(struct wiphy *wiphy,
+					struct wireless_dev *wdev,
+					const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_ds_misc_cfg *misc_cfg = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	struct sk_buff *skb = NULL;
+	HostCmd_DS_GEN cmd_info;
+	t_s32 ret = 0;
+	t_u16 ret_length = 1;
+	t_u16 action = 0;
+	t_u8 get_data = 0;
+	t_u8 *data_buff = (t_u8 *)data;
+	t_u8 *pos = NULL;
+	ENTER();
+
+	if (len < (sizeof(HostCmd_DS_GEN) + sizeof(action))) {
+		PRINTM(MERROR, "vendor cmd: Invalid hostcmd!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	moal_memcpy_ext(priv->phandle, &cmd_info, data_buff,
+			sizeof(HostCmd_DS_GEN), sizeof(HostCmd_DS_GEN));
+	action = (u16) * (data_buff + sizeof(cmd_info));
+
+	PRINTM(MMSG, "vendor cmd: hostcmd len=%d, action=%d\n", len, action);
+	if (action == 0)
+		get_data = 1;
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		PRINTM(MERROR,
+		       "vendor cmd: Could not allocate mlan ioctl memory, hostcmd!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	misc_cfg = (mlan_ds_misc_cfg *)req->pbuf;
+	misc_cfg->sub_command = MLAN_OID_MISC_HOST_CMD;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	req->action = action;
+	misc_cfg->param.hostcmd.len = woal_le16_to_cpu(cmd_info.size);
+
+	/* Copy the entire command data into hostcmd cmd buffer */
+	moal_memcpy_ext(priv->phandle, misc_cfg->param.hostcmd.cmd, data_buff,
+			misc_cfg->param.hostcmd.len, MRVDRV_SIZE_OF_CMD_BUFFER);
+
+	DBG_HEXDUMP(MCMD_D, "vendor cmd: hostcmd cmd dump",
+		    (t_u8 *)misc_cfg->param.hostcmd.cmd,
+		    misc_cfg->param.hostcmd.len);
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status == MLAN_STATUS_SUCCESS) {
+		PRINTM(MMSG, "Set/Clear/Get hostcmd ioctl successfull\n");
+		if (get_data) {
+			ret_length = misc_cfg->param.hostcmd.len;
+			PRINTM(MMSG, "vendor cmd: hostcmd GET, len=%d\n",
+			       ret_length);
+		}
+	} else {
+		PRINTM(MERROR, "Set/Clear/Get hostcmd ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* Allocate skb for cmd reply*/
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, ret_length);
+	if (!skb) {
+		PRINTM(MERROR, "vendor cmd: memory allocation failed \n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	if (get_data && ret_length > 1) {
+		PRINTM(MINFO, "vendor cmd: copying the response into buffer\n");
+		DBG_HEXDUMP(MCMD_D, "vendor cmd: hostcmd dump",
+			    (t_u8 *)misc_cfg->param.hostcmd.cmd, ret_length);
+		pos = skb_put(skb, ret_length);
+		moal_memcpy_ext(priv->phandle, pos, misc_cfg->param.hostcmd.cmd,
+				misc_cfg->param.hostcmd.len,
+				misc_cfg->param.hostcmd.len);
+	}
+
+	ret = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(ret))
+		PRINTM(MERROR, "vendor cmd: reply failed with ret:%d \n", ret);
+done:
+	if (status != MLAN_STATUS_PENDING && req)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
  * @brief vendor command to get link layer statistic
  *
  * @param wiphy    A pointer to wiphy struct
@@ -2842,8 +3605,8 @@
 	ioctl_link_stats_buf = info->param.link_statistic;
 	num_radio = *((t_u32 *)info->param.link_statistic);
 
-	radio_stat = (wifi_radio_stat *)(info->param.link_statistic +
-					 sizeof(num_radio));
+	radio_stat =
+		(wifi_radio_stat *)(ioctl_link_stats_buf + sizeof(num_radio));
 	radio_stat_len = num_radio * sizeof(wifi_radio_stat);
 
 	/* Re-write on_time/tx_time/rx_time/on_time_scan from moal handle */
@@ -2879,8 +3642,9 @@
 		radio_stat_tmp++;
 	}
 
-	iface_stat = (wifi_iface_stat *)(info->param.link_statistic +
+	iface_stat = (wifi_iface_stat *)(ioctl_link_stats_buf +
 					 sizeof(num_radio) + radio_stat_len);
+
 	iface_stat_len = sizeof(wifi_iface_stat);
 
 	/* could get peer info with separate cmd */
@@ -3274,16 +4038,56 @@
 		    priv->conn_bssid) ||
 	    nla_put_s8(skb, ATTR_RSSI_MONITOR_CUR_RSSI, rssi_value)) {
 		PRINTM(MERROR, "nla_put failed!\n");
-		kfree(skb);
+		dev_kfree_skb(skb);
 		goto done;
 	}
 	woal_cfg80211_vendor_event(priv, event_rssi_monitor, (t_u8 *)skb->data,
 				   skb->len);
-	kfree(skb);
+	dev_kfree_skb(skb);
 done:
 	LEAVE();
 }
-#endif
+
+/**
+ * @brief send driver hang vendor event to kernel
+ *
+ * @param priv          A pointer to moal_private
+ * @param reload_mode   reload mode
+ *
+ * @return      N/A
+ */
+void woal_cfg80211_driver_hang_event(moal_private *priv, t_u8 reload_mode)
+{
+	struct sk_buff *skb = NULL;
+
+	ENTER();
+
+	skb = dev_alloc_skb(NLA_HDRLEN + sizeof(t_u8));
+	if (!skb) {
+		PRINTM(MERROR,
+		       "woal_cfg80211_driver_hang_event: Failed to allocate skb");
+		goto done;
+	}
+
+	if (nla_put_u8(skb, ATTR_FW_RELOAD_MODE, reload_mode)) {
+		PRINTM(MERROR,
+		       "woal_cfg80211_driver_hang_event: nla_put failed!\n");
+		dev_kfree_skb(skb);
+		goto done;
+	}
+
+	PRINTM(MMSG,
+	       "woal_cfg80211_driver_hang_event: Send event_hang with reload mode: %d",
+	       reload_mode);
+	woal_cfg80211_vendor_event(priv, event_hang, (t_u8 *)skb->data,
+				   skb->len);
+
+	dev_kfree_skb(skb);
+done:
+	LEAVE();
+}
+
+#endif // STA_CFG80211
 
 /**
  * @brief vendor command to key_mgmt_set_key
@@ -3771,7 +4575,7 @@
 	struct net_device *dev = NULL;
 	moal_private *priv = NULL;
 	struct nlattr *tb_vendor[ATTR_WIFI_MAX + 1];
-	t_u8 mac_oui[3];
+	t_u8 mac_oui[3] = {0};
 	int ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -3808,6 +4612,231 @@
 	LEAVE();
 	return ret;
 }
+/**
+ * @brief vendor command to start
+ *     woal_cfg80211_subcmd_secure_ranging_ctx
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  fail otherwise
+ */
+static int woal_cfg80211_subcmd_secure_ranging_ctx(struct wiphy *wiphy,
+						   struct wireless_dev *wdev,
+						   const void *data, int len)
+{
+	moal_private *priv;
+	struct net_device *dev;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_sec_cfg *sec = NULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int type, rem;
+	t_u32 action = 0;
+	int key_len = 0;
+	int peer_addr_set = 0;
+	t_u8 peer_addr[ETH_ALEN];
+	t_u8 own_addr[ETH_ALEN];
+	t_u32 cipher = 0;
+	t_u32 sha_type = 0;
+	t_u8 key[MLAN_MAX_KEY_LENGTH] = {0};
+	t_u8 *ltf_keyseed = NULL;
+	t_u8 bcast_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	const struct nlattr *iter;
+
+	ENTER();
+
+	if (!wdev || !wdev->netdev) {
+		LEAVE();
+		return -EFAULT;
+	}
+
+	dev = wdev->netdev;
+	priv = (moal_private *)woal_get_netdev_priv(dev);
+	if (!priv) {
+		LEAVE();
+		return -EFAULT;
+	}
+
+	nla_for_each_attr (iter, data, len, rem) {
+		type = nla_type(iter);
+		switch (type) {
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_ACTION:
+			action = nla_get_u32(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SRC_ADDR:
+			moal_memcpy_ext(priv->phandle, own_addr, nla_data(iter),
+					nla_len(iter), ETH_ALEN);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_PEER_MAC_ADDR:
+			moal_memcpy_ext(priv->phandle, peer_addr,
+					nla_data(iter), nla_len(iter),
+					ETH_ALEN);
+			peer_addr_set = 1;
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SHA_TYPE:
+			sha_type = nla_get_u32(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_TK:
+			moal_memcpy_ext(priv->phandle, key, nla_data(iter),
+					nla_len(iter), MLAN_MAX_KEY_LENGTH);
+			key_len = nla_len(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_CIPHER:
+			cipher = nla_get_u32(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_LTF_KEYSEED:
+			moal_memcpy_ext(priv->phandle, ltf_keyseed,
+					nla_data(iter), nla_len(iter), 48);
+			break;
+		default:
+			PRINTM(MERROR, "Unknown type: %d\n", type);
+			ret = -EINVAL;
+		}
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	sec = (mlan_ds_sec_cfg *)req->pbuf;
+	sec->sub_command = MLAN_OID_SEC_CFG_ENCRYPT_KEY;
+	req->req_id = MLAN_IOCTL_SEC_CFG;
+	if (action == MLAN_ACT_PASN_SET_KEY) {
+		req->action = MLAN_ACT_PASN_KEY_DNLD;
+		if (key_len) {
+			moal_memcpy_ext(priv->phandle,
+					sec->param.encrypt_key.key_material,
+					key, key_len, MLAN_MAX_KEY_LENGTH);
+			sec->param.encrypt_key.key_len = key_len;
+		}
+		if (peer_addr_set) {
+			moal_memcpy_ext(priv->phandle,
+					sec->param.encrypt_key.mac_addr,
+					peer_addr, ETH_ALEN,
+					MLAN_MAC_ADDR_LENGTH);
+			if (memcmp(sec->param.encrypt_key.mac_addr, bcast_addr,
+				   ETH_ALEN) == 0)
+				sec->param.encrypt_key.key_flags =
+					KEY_FLAG_GROUP_KEY;
+			else
+				sec->param.encrypt_key.key_flags =
+					KEY_FLAG_SET_TX_KEY;
+		} else {
+			moal_memcpy_ext(priv->phandle,
+					sec->param.encrypt_key.mac_addr,
+					bcast_addr, ETH_ALEN,
+					MLAN_MAC_ADDR_LENGTH);
+			sec->param.encrypt_key.key_flags =
+				KEY_FLAG_GROUP_KEY | KEY_FLAG_SET_TX_KEY;
+		}
+
+#if KERNEL_VERSION(3, 6, 0) <= CFG80211_VERSION_CODE
+		if (cipher == WLAN_CIPHER_SUITE_GCMP)
+			sec->param.encrypt_key.key_flags |= KEY_FLAG_GCMP;
+#endif
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+		else if (cipher == WLAN_CIPHER_SUITE_GCMP_256)
+			sec->param.encrypt_key.key_flags |= KEY_FLAG_GCMP_256;
+#endif
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+		if (cipher == WLAN_CIPHER_SUITE_CCMP_256)
+			sec->param.encrypt_key.key_flags |= KEY_FLAG_CCMP_256;
+#endif
+
+		if (cipher == WLAN_CIPHER_SUITE_AES_CMAC
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+		    || cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+		    cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256
+#endif
+		) {
+			sec->param.encrypt_key.key_flags |=
+				KEY_FLAG_AES_MCAST_IGTK;
+
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+			if (cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128)
+				sec->param.encrypt_key.key_flags |=
+					KEY_FLAG_GMAC_128;
+			else if (cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+				sec->param.encrypt_key.key_flags |=
+					KEY_FLAG_GMAC_256;
+#endif
+		}
+	} else {
+		req->action = MLAN_ACT_CLEAR;
+		sec->param.encrypt_key.key_len = MLAN_MAX_KEY_LENGTH;
+		sec->param.encrypt_key.key_index = MLAN_KEY_INDEX_UNICAST;
+		sec->param.encrypt_key.key_flags = KEY_FLAG_REMOVE_KEY;
+		moal_memcpy_ext(priv->phandle, sec->param.encrypt_key.mac_addr,
+				(u8 *)peer_addr, ETH_ALEN,
+				MLAN_MAC_ADDR_LENGTH);
+		memset(sec->param.encrypt_key.key_material, 0,
+		       sizeof(sec->param.encrypt_key.key_material));
+	}
+	/* Send IOCTL request to MLAN */
+	ret = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+/**
+ * @brief vendor command to
+ *
+ * @param wiphy         A pointer to wiphy struct
+ * @param wdev          A pointer to wireless_dev struct
+ * @param data           a pointer to data
+ * @param data_len     data length
+ *
+ * @return      0: success  <0: fail
+ */
+static int woal_cfg80211_subcmd_set_scan_band(struct wiphy *wiphy,
+					      struct wireless_dev *wdev,
+					      const void *data, int data_len)
+{
+	struct net_device *dev = NULL;
+	moal_private *priv = NULL;
+	struct nlattr *tb_vendor[ATTR_WIFI_MAX + 1];
+	int ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!wdev || !wdev->netdev) {
+		LEAVE();
+		return -EFAULT;
+	}
+	dev = wdev->netdev;
+	priv = (moal_private *)woal_get_netdev_priv(dev);
+
+	nla_parse(tb_vendor, ATTR_WIFI_MAX, (struct nlattr *)data, data_len,
+		  NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+		  ,
+		  NULL
+#endif
+	);
+	if (!tb_vendor[ATTR_SCAN_BAND_SET]) {
+		PRINTM(MERROR, "%s: ATTR_SCAN_BAND_SET not found\n", __func__);
+		ret = -EFAULT;
+		goto done;
+	}
+	priv->scan_setband_mask =
+		*(u8 *)nla_data(tb_vendor[ATTR_SCAN_BAND_SET]);
+	PRINTM(MMSG,
+	       "woal_cfg80211_subcmd_set_scan_band: scan_setband_mask :%d",
+	       priv->scan_setband_mask);
+
+done:
+	LEAVE();
+	return ret;
+}
 
 /**
  * @brief vendor command to start keep alive
@@ -4075,6 +5104,793 @@
 	return ret;
 }
 
+/**
+ * @brief vendor command to get rtt capability
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_get_capa(struct wiphy *wiphy,
+					     struct wireless_dev *wdev,
+					     const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_handle *handle = priv->phandle;
+	struct sk_buff *skb = NULL;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "CfgVendor: cfg80211_subcmd_rtt_get_capa\n");
+
+	DBG_HEXDUMP(MCMD_D, "input data", (t_u8 *)data, len);
+
+	/* Alloc the SKB for vendor_event */
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(
+		wiphy, nla_total_size(sizeof(handle->rtt_capa)) +
+			       VENDOR_REPLY_OVERHEAD);
+	if (unlikely(!skb)) {
+		PRINTM(MERROR, "skb alloc failed in %s\n", __func__);
+		goto done;
+	}
+
+	/* Put the attribute to the skb */
+	nla_put(skb, ATTR_RTT_CAPA, sizeof(handle->rtt_capa),
+		&(handle->rtt_capa));
+
+	PRINTM(MCMND, "NL80211_CMD_VENDOR=0x%x\n", NL80211_CMD_VENDOR);
+	PRINTM(MCMND, "NL80211_ATTR_WIPHY=0x%x\n", NL80211_ATTR_WIPHY);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_ID=0x%x\n", NL80211_ATTR_VENDOR_ID);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_SUBCMD=0x%x\n",
+	       NL80211_ATTR_VENDOR_SUBCMD);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_DATA=0x%x\n",
+	       NL80211_ATTR_VENDOR_DATA);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_EVENTS=0x%x\n",
+	       NL80211_ATTR_VENDOR_EVENTS);
+
+	DBG_HEXDUMP(MCMD_D, "output data skb->head", (t_u8 *)skb->head, 50);
+	DBG_HEXDUMP(MCMD_D, "output data skb->data", (t_u8 *)skb->data, 50);
+	err = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(err))
+		PRINTM(MERROR, "Vendor Command reply failed err:%d\n", err);
+
+done:
+	LEAVE();
+	return err;
+}
+
+static void woal_dump_rtt_params(wifi_rtt_config_params_t *rtt_params)
+{
+	int i = 0;
+
+	PRINTM(MMSG, "===== Start DUMP RTT Params =====\n");
+	PRINTM(MMSG, "rtt_config_num=%d\n\n", rtt_params->rtt_config_num);
+
+	for (i = 0; i < rtt_params->rtt_config_num; i++) {
+		PRINTM(MMSG, "----------[%d]----------\n", i);
+		PRINTM(MMSG, "rtt_config[%d].addr=" MACSTR "\n", i,
+		       MAC2STR(rtt_params->rtt_config[i].addr));
+		PRINTM(MMSG, "rtt_config[%d].type=%d\n", i,
+		       rtt_params->rtt_config[i].type);
+		PRINTM(MMSG, "rtt_config[%d].peer=%d\n", i,
+		       rtt_params->rtt_config[i].peer);
+		PRINTM(MMSG, "rtt_config[%d].channel=[%d %d %d %d]\n", i,
+		       rtt_params->rtt_config[i].channel.width,
+		       rtt_params->rtt_config[i].channel.center_freq,
+		       rtt_params->rtt_config[i].channel.center_freq0,
+		       rtt_params->rtt_config[i].channel.center_freq1);
+		PRINTM(MMSG, "rtt_config[%d].burst_period=%d\n", i,
+		       rtt_params->rtt_config[i].burst_period);
+		PRINTM(MMSG, "rtt_config[%d].num_burst=%d\n", i,
+		       rtt_params->rtt_config[i].num_burst);
+		PRINTM(MMSG, "rtt_config[%d].num_frames_per_burst=%d\n", i,
+		       rtt_params->rtt_config[i].num_frames_per_burst);
+		PRINTM(MMSG, "rtt_config[%d].num_retries_per_rtt_frame=%d\n", i,
+		       rtt_params->rtt_config[i].num_retries_per_rtt_frame);
+		PRINTM(MMSG, "rtt_config[%d].num_retries_per_ftmr=%d\n", i,
+		       rtt_params->rtt_config[i].num_retries_per_ftmr);
+		PRINTM(MMSG, "rtt_config[%d].LCI_request=%d\n", i,
+		       rtt_params->rtt_config[i].LCI_request);
+		PRINTM(MMSG, "rtt_config[%d].LCR_request=%d\n", i,
+		       rtt_params->rtt_config[i].LCR_request);
+		PRINTM(MMSG, "rtt_config[%d].burst_duration=%d\n", i,
+		       rtt_params->rtt_config[i].burst_duration);
+		PRINTM(MMSG, "rtt_config[%d].preamble=%d\n", i,
+		       rtt_params->rtt_config[i].preamble);
+		PRINTM(MMSG, "rtt_config[%d].bw=%d\n", i,
+		       rtt_params->rtt_config[i].bw);
+		PRINTM(MMSG, "\n");
+	}
+}
+
+/**
+ * @brief vendor command to request rtt range
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_range_request(struct wiphy *wiphy,
+						  struct wireless_dev *wdev,
+						  const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_handle *handle = priv->phandle;
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	t_u8 zero_mac[MLAN_MAC_ADDR_LENGTH] = {0};
+	t_u8 rtt_config_num = 0;
+	wifi_rtt_config *rtt_config = NULL;
+	t_u8 i = 0, j = 0;
+	wifi_rtt_config_params_t rtt_params;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_TARGET_NUM] || !tb[ATTR_RTT_TARGET_CONFIG]) {
+		PRINTM(MERROR,
+		       "%s: null attr: tb[ATTR_RTT_TARGET_NUM]=%p tb[ATTR_RTT_TARGET_CONFIG]=%p\n",
+		       __func__, tb[ATTR_RTT_TARGET_NUM],
+		       tb[ATTR_RTT_TARGET_CONFIG]);
+		err = -EINVAL;
+		goto done;
+	}
+
+	rtt_config_num = nla_get_u8(tb[ATTR_RTT_TARGET_NUM]);
+
+	if ((rtt_config_num == 0) || ((handle->rtt_params.rtt_config_num +
+				       rtt_config_num) > MAX_RTT_CONFIG_NUM)) {
+		PRINTM(MERROR, "%s: invalid num=%d  num in handle=%d  MAX=%d\n",
+		       __func__, rtt_config_num,
+		       handle->rtt_params.rtt_config_num, MAX_RTT_CONFIG_NUM);
+		err = -EINVAL;
+		goto done;
+	}
+	if (nla_len(tb[ATTR_RTT_TARGET_CONFIG]) !=
+	    sizeof(rtt_params.rtt_config[0]) * rtt_config_num) {
+		PRINTM(MERROR, "%s: invalid %d(total) != %d(num) * %u(each)\n",
+		       __func__, nla_len(tb[ATTR_RTT_TARGET_CONFIG]),
+		       rtt_config_num, (t_u32)sizeof(rtt_params.rtt_config[0]));
+		err = -EINVAL;
+		goto done;
+	}
+
+	rtt_config = (wifi_rtt_config *)nla_data(tb[ATTR_RTT_TARGET_CONFIG]);
+	memset(&rtt_params, 0, sizeof(rtt_params));
+	/** Strip the zero mac config */
+	for (i = 0; i < rtt_config_num; i++) {
+		if (!memcmp(rtt_config[i].addr, zero_mac,
+			    sizeof(rtt_config[i].addr)))
+			continue;
+		else {
+			moal_memcpy_ext(
+				handle,
+				&rtt_params
+					 .rtt_config[rtt_params.rtt_config_num],
+				&rtt_config[i],
+				sizeof(rtt_params.rtt_config
+					       [rtt_params.rtt_config_num]),
+				sizeof(wifi_rtt_config));
+			rtt_params.rtt_config_num++;
+		}
+	}
+	if (!rtt_params.rtt_config_num) {
+		PRINTM(MERROR, "%s: no valid mac addr\n", __func__);
+		goto done;
+	}
+	woal_dump_rtt_params(&rtt_params);
+
+	ret = woal_config_rtt(priv, MOAL_IOCTL_WAIT, &rtt_params);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_config_rtt() failed\n", __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+	for (i = 0; i < rtt_params.rtt_config_num; i++) {
+		for (j = 0; j < handle->rtt_params.rtt_config_num; j++) {
+			if (!memcmp(handle->rtt_params.rtt_config[j].addr,
+				    rtt_params.rtt_config[i].addr,
+				    sizeof(handle->rtt_params.rtt_config[j]
+						   .addr)))
+				break;
+		}
+		moal_memcpy_ext(handle, &(handle->rtt_params.rtt_config[j]),
+				&(rtt_params.rtt_config[i]),
+				sizeof(handle->rtt_params.rtt_config[j]),
+				sizeof(wifi_rtt_config));
+		if (j == handle->rtt_params.rtt_config_num)
+			handle->rtt_params.rtt_config_num++;
+	}
+
+	woal_dump_rtt_params(&(handle->rtt_params));
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to cancel rtt range
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_range_cancel(struct wiphy *wiphy,
+						 struct wireless_dev *wdev,
+						 const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_handle *handle = priv->phandle;
+	t_u8 rtt_config_num = handle->rtt_params.rtt_config_num;
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	t_u32 target_num = 0;
+	t_u8 addr[MAX_RTT_CONFIG_NUM][MLAN_MAC_ADDR_LENGTH] = {0x00};
+	int i = 0, j = 0;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_TARGET_NUM] || !tb[ATTR_RTT_TARGET_ADDR]) {
+		PRINTM(MERROR,
+		       "%s: null attr: tb[ATTR_RTT_TARGET_NUM]=%p tb[ATTR_RTT_TARGET_ADDR]=%p\n",
+		       __func__, tb[ATTR_RTT_TARGET_NUM],
+		       tb[ATTR_RTT_TARGET_ADDR]);
+		err = -EINVAL;
+		goto done;
+	}
+
+	target_num = nla_get_u8(tb[ATTR_RTT_TARGET_NUM]);
+
+	if ((target_num <= 0 || target_num > MAX_RTT_CONFIG_NUM) ||
+	    (nla_len(tb[ATTR_RTT_TARGET_ADDR]) !=
+	     sizeof(t_u8) * MLAN_MAC_ADDR_LENGTH * target_num)) {
+		PRINTM(MERROR, "%s: Check if %din[1-%d] or %d*%u=%d\n",
+		       __func__, target_num, MAX_RTT_CONFIG_NUM, target_num,
+		       (t_u32)(sizeof(t_u8) * MLAN_MAC_ADDR_LENGTH),
+		       nla_len(tb[ATTR_RTT_TARGET_ADDR]));
+		err = -EINVAL;
+		goto done;
+	}
+	woal_dump_rtt_params(&(handle->rtt_params));
+
+	moal_memcpy_ext(handle, addr, nla_data(tb[ATTR_RTT_TARGET_ADDR]),
+			nla_len(tb[ATTR_RTT_TARGET_ADDR]), sizeof(addr));
+
+	for (i = 0; i < target_num; i++)
+		PRINTM(MMSG, "cancel[%d].addr=" MACSTR "\n", i,
+		       MAC2STR(addr[i]));
+
+	for (i = 0; i < target_num; i++) {
+		for (j = 0; j < handle->rtt_params.rtt_config_num; j++) {
+			if (!memcmp(addr[i],
+				    handle->rtt_params.rtt_config[j].addr,
+				    sizeof(addr[0]))) {
+				memset(&(handle->rtt_params.rtt_config[j]),
+				       0x00,
+				       sizeof(handle->rtt_params.rtt_config[0]));
+				if ((j + 1) <
+				    handle->rtt_params.rtt_config_num) {
+					memmove(&(handle->rtt_params
+							  .rtt_config[j]),
+						&(handle->rtt_params
+							  .rtt_config[j + 1]),
+						sizeof(handle->rtt_params
+							       .rtt_config[0]) *
+							(handle->rtt_params
+								 .rtt_config_num -
+							 (j + 1)));
+					memset(&(handle->rtt_params.rtt_config
+							 [handle->rtt_params
+								  .rtt_config_num -
+							  1]),
+					       0x00,
+					       sizeof(handle->rtt_params
+							      .rtt_config[0]));
+				}
+				handle->rtt_params.rtt_config_num--;
+				continue;
+			}
+		}
+	}
+
+	if (handle->rtt_params.rtt_config_num >= rtt_config_num) {
+		PRINTM(MERROR, "%s: No matched mac addr in rtt_config\n",
+		       __func__);
+		goto done;
+	}
+
+	ret = woal_cancel_rtt(priv, MOAL_IOCTL_WAIT, target_num, addr);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_cancel_rtt() failed\n", __func__);
+		err = -EFAULT;
+		goto done;
+	}
+	woal_dump_rtt_params(&(handle->rtt_params));
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor event to report RTT Results
+ *
+ * @param priv     A pointer to moal_private
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      mlan_status
+ */
+mlan_status woal_cfg80211_event_rtt_result(moal_private *priv, t_u8 *data,
+					   int len)
+{
+	// moal_handle *handle = priv->phandle;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u8 *pos = data;
+	t_u32 event_left_len = len;
+	struct sk_buff *skb = NULL;
+	t_u32 vdr_event_len = 0;
+	t_u32 complete = 0;
+	wifi_rtt_result_element *rtt_result_elem = NULL;
+	t_u32 num_results = 0;
+
+	ENTER();
+
+	PRINTM(MEVENT, "Enter %s()\n", __func__);
+
+	vdr_event_len = nla_total_size(sizeof(complete)) +
+			nla_total_size(sizeof(num_results)) +
+			nla_total_size(len) + NLA_ALIGNTO * num_results +
+			VENDOR_REPLY_OVERHEAD;
+	PRINTM(MEVENT, "vdr_event_len = %d\n", vdr_event_len);
+	skb = woal_cfg80211_alloc_vendor_event(priv, event_rtt_result,
+					       vdr_event_len);
+	if (!skb)
+		goto done;
+
+	complete = *pos;
+	nla_put(skb, ATTR_RTT_RESULT_COMPLETE, sizeof(complete), &complete);
+	pos = (t_u8 *)(pos + 1);
+	event_left_len--;
+
+	while (event_left_len > sizeof(wifi_rtt_result_element)) {
+		rtt_result_elem = (wifi_rtt_result_element *)pos;
+
+		nla_put(skb, ATTR_RTT_RESULT_FULL, rtt_result_elem->len,
+			rtt_result_elem->data);
+		num_results++;
+
+		pos += sizeof(*rtt_result_elem) + rtt_result_elem->len;
+		event_left_len -=
+			sizeof(*rtt_result_elem) + rtt_result_elem->len;
+	}
+
+	nla_put(skb, ATTR_RTT_RESULT_NUM, sizeof(num_results), &num_results);
+
+	DBG_HEXDUMP(MEVT_D, "output data skb->data", (t_u8 *)skb->data,
+		    skb->len);
+	/**send event*/
+	cfg80211_vendor_event(skb, GFP_KERNEL);
+
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief vendor command to get rtt responder info
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int
+woal_cfg80211_subcmd_rtt_get_responder_info(struct wiphy *wiphy,
+					    struct wireless_dev *wdev,
+					    const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_rtt_responder rtt_rsp_cfg;
+	struct sk_buff *skb = NULL;
+	wifi_rtt_responder rtt_rsp;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_GET_RESPONDER_INFO;
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+	PRINTM(MCMD_D,
+	       "mlan_rtt_responder from FW: channel=%d bandcfg=%d %d %d %d preamble=%d\n",
+	       rtt_rsp_cfg.u.info.channel, rtt_rsp_cfg.u.info.bandcfg.chanBand,
+	       rtt_rsp_cfg.u.info.bandcfg.chanWidth,
+	       rtt_rsp_cfg.u.info.bandcfg.chan2Offset,
+	       rtt_rsp_cfg.u.info.bandcfg.scanMode,
+	       rtt_rsp_cfg.u.info.preamble);
+
+	memset(&rtt_rsp, 0x00, sizeof(rtt_rsp));
+	woal_bandcfg_to_channel_info(priv, &(rtt_rsp_cfg.u.info.bandcfg),
+				     rtt_rsp_cfg.u.info.channel,
+				     &(rtt_rsp.channel));
+	rtt_rsp.preamble = rtt_rsp_cfg.u.info.preamble;
+	PRINTM(MCMD_D, "wifi_rtt_responder report to HAL:\n");
+	PRINTM(MCMD_D,
+	       "channel: width=%d center_freq=%d center_freq0=%d center_freq1=%d\n",
+	       rtt_rsp.channel.width, rtt_rsp.channel.center_freq,
+	       rtt_rsp.channel.center_freq0, rtt_rsp.channel.center_freq1);
+	PRINTM(MCMD_D, "preamble=%d\n", rtt_rsp.preamble);
+
+	/* Alloc the SKB for vendor_event */
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(
+		wiphy, nla_total_size(sizeof(rtt_rsp)) + VENDOR_REPLY_OVERHEAD);
+	if (unlikely(!skb)) {
+		PRINTM(MERROR, "skb alloc failed in %s\n", __func__);
+		goto done;
+	}
+
+	/* Put the attribute to the skb */
+	nla_put(skb, ATTR_RTT_CHANNEL_INFO, sizeof(rtt_rsp.channel),
+		&(rtt_rsp.channel));
+	nla_put(skb, ATTR_RTT_PREAMBLE, sizeof(rtt_rsp.preamble),
+		&(rtt_rsp.preamble));
+	DBG_HEXDUMP(MCMD_D, "output data skb->data", (t_u8 *)skb->data,
+		    skb->len);
+
+	err = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(err))
+		PRINTM(MERROR, "Vendor Command reply failed err:%d\n", err);
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to enable rtt responder
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_enable_responder(struct wiphy *wiphy,
+						     struct wireless_dev *wdev,
+						     const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	wifi_channel_info *ch_info = NULL;
+	t_u32 max_dur_sec = 0;
+	mlan_rtt_responder rtt_rsp_cfg;
+	wifi_rtt_responder rtt_rsp;
+	struct sk_buff *skb = NULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_CHANNEL_INFO] || !tb[ATTR_RTT_MAX_DUR_SEC]) {
+		PRINTM(MERROR,
+		       "%s: null attr: tb[ATTR_RTT_TARGET_NUM]=%p tb[ATTR_RTT_TARGET_CONFIG]=%p\n",
+		       __func__, tb[ATTR_RTT_CHANNEL_INFO],
+		       tb[ATTR_RTT_MAX_DUR_SEC]);
+		err = -EINVAL;
+		goto done;
+	}
+	ch_info = (wifi_channel_info *)nla_data(tb[ATTR_RTT_CHANNEL_INFO]);
+	max_dur_sec = nla_get_u32(tb[ATTR_RTT_MAX_DUR_SEC]);
+	PRINTM(MCMD_D, "HAL input:\n");
+	PRINTM(MCMD_D,
+	       "wifi_channel_info: width=%d center_freq=%d center_freq0=%d center_freq1=%d\n",
+	       ch_info->width, ch_info->center_freq, ch_info->center_freq0,
+	       ch_info->center_freq1);
+	PRINTM(MCMD_D, "max_dur_sec=%d\n", max_dur_sec);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_ENABLE;
+	rtt_rsp_cfg.u.encfg.channel =
+		ieee80211_frequency_to_channel(ch_info->center_freq);
+	woal_channel_info_to_bandcfg(priv, ch_info,
+				     &(rtt_rsp_cfg.u.encfg.bandcfg));
+	rtt_rsp_cfg.u.encfg.max_dur_sec = max_dur_sec;
+	PRINTM(MCMD_D, "HAL input to rtt_responder_encfg:\n");
+	PRINTM(MCMD_D,
+	       "channel=%d bandcfg=[chanBand=%d chanWidth=%d chan2Offset=%d scanMode=%d]\n",
+	       rtt_rsp_cfg.u.encfg.channel,
+	       rtt_rsp_cfg.u.encfg.bandcfg.chanBand,
+	       rtt_rsp_cfg.u.encfg.bandcfg.chanWidth,
+	       rtt_rsp_cfg.u.encfg.bandcfg.chan2Offset,
+	       rtt_rsp_cfg.u.encfg.bandcfg.scanMode);
+	PRINTM(MCMD_D, "max_dur_sec=%d\n", rtt_rsp_cfg.u.encfg.max_dur_sec);
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+	memset(&rtt_rsp, 0x00, sizeof(rtt_rsp));
+	woal_bandcfg_to_channel_info(priv, &(rtt_rsp_cfg.u.info.bandcfg),
+				     rtt_rsp_cfg.u.info.channel,
+				     &(rtt_rsp.channel));
+	rtt_rsp.preamble = rtt_rsp_cfg.u.info.preamble;
+	PRINTM(MCMD_D, "wifi_rtt_responder report to HAL:\n");
+	PRINTM(MCMD_D,
+	       "channel: width=%d center_freq=%d center_freq0=%d center_freq1=%d\n",
+	       rtt_rsp.channel.width, rtt_rsp.channel.center_freq,
+	       rtt_rsp.channel.center_freq0, rtt_rsp.channel.center_freq1);
+	PRINTM(MCMD_D, "preamble=%d\n", rtt_rsp.preamble);
+
+	/* Alloc the SKB for vendor_event */
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(
+		wiphy, nla_total_size(sizeof(rtt_rsp)) + VENDOR_REPLY_OVERHEAD);
+	if (unlikely(!skb)) {
+		PRINTM(MERROR, "skb alloc failed in %s\n", __func__);
+		goto done;
+	}
+
+	/* Put the attribute to the skb */
+	nla_put(skb, ATTR_RTT_CHANNEL_INFO, sizeof(rtt_rsp.channel),
+		&(rtt_rsp.channel));
+	nla_put(skb, ATTR_RTT_PREAMBLE, sizeof(rtt_rsp.preamble),
+		&(rtt_rsp.preamble));
+	DBG_HEXDUMP(MCMD_D, "output data skb->data", (t_u8 *)skb->data,
+		    skb->len);
+
+	err = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(err))
+		PRINTM(MERROR, "Vendor Command reply failed err:%d\n", err);
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to disable rtt responder
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_disable_responder(struct wiphy *wiphy,
+						      struct wireless_dev *wdev,
+						      const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_rtt_responder rtt_rsp_cfg;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_DISABLE;
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to set rtt lci
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_set_lci(struct wiphy *wiphy,
+					    struct wireless_dev *wdev,
+					    const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	mlan_rtt_responder rtt_rsp_cfg;
+	wifi_lci_information *lci_info;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_LCI_INFO]) {
+		PRINTM(MERROR, "%s: null attr: tb[ATTR_RTT_LCI_INFO]=%p\n",
+		       __func__, tb[ATTR_RTT_LCI_INFO]);
+		err = -EINVAL;
+		goto done;
+	}
+	lci_info = (wifi_lci_information *)nla_data(tb[ATTR_RTT_LCI_INFO]);
+	PRINTM(MCMD_D, "HAL input:\n");
+	PRINTM(MCMD_D,
+	       "wifi_lci_information: latitude=%lu longitude=%lu altitude=%d latitude_unc=%d longitude_unc=%d altitude_unc=%d\n",
+	       lci_info->latitude, lci_info->longitude, lci_info->altitude,
+	       lci_info->latitude_unc, lci_info->longitude_unc,
+	       lci_info->altitude_unc);
+	PRINTM(MCMD_D,
+	       "wifi_lci_information: motion_pattern=%d floor=%d height_above_floor=%d height_unc=%d\n",
+	       lci_info->motion_pattern, lci_info->floor,
+	       lci_info->height_above_floor, lci_info->height_unc);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_LCI;
+	moal_memcpy_ext(priv->phandle, &(rtt_rsp_cfg.u.lci), lci_info,
+			sizeof(rtt_rsp_cfg.u.lci), sizeof(rtt_rsp_cfg.u.lci));
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to set rtt lcr
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_set_lcr(struct wiphy *wiphy,
+					    struct wireless_dev *wdev,
+					    const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	mlan_rtt_responder rtt_rsp_cfg;
+	wifi_lcr_information *lcr_info;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_LCR_INFO]) {
+		PRINTM(MERROR, "%s: null attr: tb[ATTR_RTT_LCR_INFO]=%p\n",
+		       __func__, tb[ATTR_RTT_LCR_INFO]);
+		err = -EINVAL;
+		goto done;
+	}
+	lcr_info = (wifi_lcr_information *)nla_data(tb[ATTR_RTT_LCR_INFO]);
+	PRINTM(MCMD_D, "HAL input:\n");
+	PRINTM(MCMD_D, "wifi_lcr_information: country_code='%c' '%c'\n",
+	       lcr_info->country_code[0], lcr_info->country_code[1]);
+	PRINTM(MCMD_D, "wifi_lci_information: length=%d civic_info=%s\n",
+	       lcr_info->length, lcr_info->civic_info);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_LCR;
+	moal_memcpy_ext(priv->phandle, &(rtt_rsp_cfg.u.lcr), lcr_info,
+			sizeof(rtt_rsp_cfg.u.lcr), sizeof(rtt_rsp_cfg.u.lcr));
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return err;
+}
+
 #define CSI_DUMP_FILE_MAX 1200000
 
 /**
@@ -4361,6 +6177,13 @@
 					      t_u8 format, char *name)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
+#ifndef DUMP_TO_PROC
+	struct file *pfile = NULL;
+	loff_t pos;
+	char dw_string[10];
+	int i = 0;
+	t_u32 *tmp = NULL;
+#endif
 	ENTER();
 
 	if (!dir_name || !file_name || !buf) {
@@ -4368,6 +6191,55 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
+#ifndef DUMP_TO_PROC
+	snprintf(name, MAX_BUF_LEN, "%s/%s", dir_name, file_name);
+	pfile = filp_open(name, O_CREAT | O_RDWR | O_APPEND, 0644);
+
+	if (IS_ERR(pfile)) {
+		PRINTM(MMSG,
+		       "Create file %s error, try to save dump file in /var\n",
+		       name);
+		snprintf(name, MAX_BUF_LEN, "%s/%s", "/var", file_name);
+		pfile = filp_open(name, O_CREAT | O_RDWR | O_APPEND, 0644);
+	}
+	if (IS_ERR(pfile)) {
+		PRINTM(MERROR, "Create Dump file for %s error\n", name);
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	PRINTM(MMSG, "Dump data %s saved in %s\n", file_name, name);
+
+	pos = 0;
+	/* Save CSI dump directly to file */
+	if (format == 1) {
+#if KERNEL_VERSION(4, 14, 0) > LINUX_VERSION_CODE
+		vfs_write(pfile, (const char __user *)buf, buf_len, &pos);
+#else
+		kernel_write(pfile, buf, buf_len, &pos);
+#endif
+	} else {
+		tmp = (t_u32 *)buf;
+		for (i = 0; i < buf_len / 4; i++) {
+			if ((i + 1) % 8 == 0)
+				snprintf(dw_string, sizeof(dw_string), "%08x\n",
+					 *tmp);
+			else
+				snprintf(dw_string, sizeof(dw_string), "%08x ",
+					 *tmp);
+#if KERNEL_VERSION(4, 14, 0) > LINUX_VERSION_CODE
+			vfs_write(pfile, (const char __user *)dw_string, 9,
+				  &pos);
+#else
+			kernel_write(pfile, dw_string, 9, &pos);
+#endif
+			tmp++;
+		}
+	}
+	filp_close(pfile, NULL);
+
+	PRINTM(MMSG, "Dump data saved in %s successfully\n", name);
+#endif
 done:
 	LEAVE();
 	return ret;
@@ -4392,11 +6264,11 @@
 	ENTER();
 
 	DBG_HEXDUMP(MCMD_D, "CSI dump data", data, len);
-	sprintf(path_name, "/data");
+	snprintf(path_name, sizeof(path_name), "/data");
 	if (priv->csi_dump_format == 1)
-		sprintf(file_name, "csi_dump.bin");
+		snprintf(file_name, sizeof(file_name), "csi_dump.bin");
 	else
-		sprintf(file_name, "csi_dump.txt");
+		snprintf(file_name, sizeof(file_name), "csi_dump.txt");
 	priv->csi_dump_len += len;
 	if (priv->csi_dump_len > CSI_DUMP_FILE_MAX) {
 		PRINTM(MERROR,
@@ -4460,6 +6332,68 @@
 	{
 		.info = {
 				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = sub_cmd_set_scan_band,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_set_scan_band,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+		.policy = woal_attr_policy,
+		.maxattr = ATTR_WIFI_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_SET_GET_SCANCFG,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_set_get_scancfg,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+		.policy = VENDOR_CMD_RAW_DATA,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_SET_GET_ADDBAPARAMS,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_set_get_addbaparams,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+		.policy = VENDOR_CMD_RAW_DATA,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_SET_GET_CLR_HOSTCMD,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_hostcmd,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+		.policy = VENDOR_CMD_RAW_DATA,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = sub_cmd_secure_ranging_ctx,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_secure_ranging_ctx,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+		.policy = woal_secure_ranging_ctx_policy,
+		.maxattr = MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
 				.subcmd = sub_cmd_link_statistic_set,
 			},
 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
@@ -4602,6 +6536,112 @@
 	{
 		.info = {
 				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_GET_CAPA,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_get_capa,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_RANGE_REQUEST,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_range_request,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_RANGE_CANCEL,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_range_cancel,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_GET_RESPONDER_INFO,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_get_responder_info,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_ENABLE_RESPONDER,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_enable_responder,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_DISABLE_RESPONDER,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_disable_responder,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_SET_LCI,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_set_lci,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_SET_LCR,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_set_lcr,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
 				.subcmd = sub_cmd_nd_offload
 			},
 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
diff --git a/wlan_sd8987/mlinux/moal_cfg80211_util.h b/wlan_src/mlinux/moal_cfg80211_util.h
old mode 100755
new mode 100644
similarity index 88%
rename from wlan_sd8987/mlinux/moal_cfg80211_util.h
rename to wlan_src/mlinux/moal_cfg80211_util.h
index 7578665..0c1fdd9
--- a/wlan_sd8987/mlinux/moal_cfg80211_util.h
+++ b/wlan_src/mlinux/moal_cfg80211_util.h
@@ -3,20 +3,28 @@
  * @brief This file contains the CFG80211 vendor specific defines.
  *
  *
- * Copyright 2015-2021 NXP
+ * Copyright 2015-2021, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -489,7 +497,12 @@
  * Version of APF instruction set processed by accept_packet().
  * Should be returned by wifi_get_packet_filter_info.
  */
+#if (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34)
+#define APF_VERSION 4
+#else
 #define APF_VERSION 2
+#endif
+
 /** =========== Define Copied from apf_interpreter.h END =========== */
 
 /** =========== Define Copied from apf_interpreter.c START =========== */
@@ -616,14 +629,38 @@
 	ATTR_GET_CONCURRENCY_MATRIX_SET_SIZE_MAX = 8,
 	ATTR_GET_CONCURRENCY_MATRIX_SET_SIZE = 9,
 	ATTR_GET_CONCURRENCY_MATRIX_SET = 10,
+	ATTR_SCAN_BAND_SET = 11,
 	ATTR_WIFI_AFTER_LAST,
 	ATTR_WIFI_MAX = ATTR_WIFI_AFTER_LAST - 1
 } wifi_attr_t;
+enum mrvl_wlan_vendor_attr_secure_ranging_ctx {
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_INVALID = 0,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_ACTION = 1,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SRC_ADDR = 2,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_PEER_MAC_ADDR = 3,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SHA_TYPE = 4,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_TK = 5,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_CIPHER = 6,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_LTF_KEYSEED = 7,
 
+	/* keep last */
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_AFTER_LAST,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_MAX =
+		MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_AFTER_LAST - 1,
+};
 enum mrvl_wlan_vendor_attr_wifi_logger {
 	MRVL_WLAN_VENDOR_ATTR_NAME = 10,
 };
 
+enum ATTR_FW_RELOAD {
+	ATTR_FW_RELOAD_INVALID = 0,
+	ATTR_FW_RELOAD_MODE = 1,
+	ATTR_FW_RELOAD_AFTER_LAST,
+	ATTR_FW_RELOAD_MAX = ATTR_FW_RELOAD_AFTER_LAST - 1,
+};
+
+void woal_cfg80211_driver_hang_event(moal_private *priv, t_u8 reload_mode);
+
 /**vendor event*/
 enum vendor_event {
 	event_hang = 0,
@@ -632,6 +669,7 @@
 	event_fw_reset_failure = 3,
 	event_fw_reset_start = 4,
 	event_rssi_monitor = 0x1501,
+	event_rtt_result = 0x07,
 	event_set_key_mgmt_offload = 0x10001,
 	event_fw_roam_success = 0x10002,
 	event_cloud_keep_alive = 0x10003,
@@ -701,9 +739,22 @@
 	sub_cmd_stop_keep_alive = 0x0004,
 	sub_cmd_dfs_capability = 0x0005,
 	sub_cmd_set_scan_mac_oui = 0x0007,
+	sub_cmd_set_scan_band = 0x0008,
+	sub_cmd_secure_ranging_ctx = 0x0009,
 	sub_cmd_set_packet_filter = 0x0011,
 	sub_cmd_get_packet_filter_capability,
 	sub_cmd_nd_offload = 0x0100,
+	SUBCMD_SET_GET_SCANCFG = 0x0200,
+	SUBCMD_SET_GET_ADDBAPARAMS = 0x0201,
+	SUBCMD_SET_GET_CLR_HOSTCMD = 0x0202,
+	SUBCMD_RTT_GET_CAPA = 0x1100,
+	SUBCMD_RTT_RANGE_REQUEST,
+	SUBCMD_RTT_RANGE_CANCEL,
+	SUBCMD_RTT_GET_RESPONDER_INFO,
+	SUBCMD_RTT_ENABLE_RESPONDER,
+	SUBCMD_RTT_DISABLE_RESPONDER,
+	SUBCMD_RTT_SET_LCI,
+	SUBCMD_RTT_SET_LCR,
 	sub_cmd_link_statistic_set = 0x1200,
 	sub_cmd_link_statistic_get = 0x1201,
 	sub_cmd_link_statistic_clr = 0x1202,
@@ -832,6 +883,29 @@
 		MRVL_WLAN_VENDOR_ATTR_FW_ROAMING_AFTER_LAST - 1
 };
 
+enum attr_rtt {
+	ATTR_RTT_INVALID = 0,
+	ATTR_RTT_CAPA,
+	ATTR_RTT_TARGET_NUM,
+	ATTR_RTT_TARGET_CONFIG,
+	ATTR_RTT_TARGET_ADDR,
+	ATTR_RTT_RESULT_COMPLETE,
+	ATTR_RTT_RESULT_NUM,
+	ATTR_RTT_RESULT_FULL,
+	ATTR_RTT_CHANNEL_INFO,
+	ATTR_RTT_MAX_DUR_SEC,
+	ATTR_RTT_PREAMBLE,
+	ATTR_RTT_LCI_INFO,
+	ATTR_RTT_LCR_INFO,
+
+	/* keep last */
+	ATTR_RTT_AFTER_LAST,
+	ATTR_RTT_MAX = ATTR_RTT_AFTER_LAST - 1
+};
+
+mlan_status woal_cfg80211_event_rtt_result(moal_private *priv, t_u8 *data,
+					   int len);
+
 enum attr_csi {
 	ATTR_CSI_INVALID = 0,
 	ATTR_CSI_CONFIG,
diff --git a/wlan_sd8987/mlinux/moal_debug.c b/wlan_src/mlinux/moal_debug.c
old mode 100755
new mode 100644
similarity index 95%
rename from wlan_sd8987/mlinux/moal_debug.c
rename to wlan_src/mlinux/moal_debug.c
index 1252ab5..5cb4e36
--- a/wlan_sd8987/mlinux/moal_debug.c
+++ b/wlan_src/mlinux/moal_debug.c
@@ -3,20 +3,28 @@
  * @brief This file contains functions for debug proc file.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -78,6 +86,14 @@
 	 item_addr(mlan_rx_processing), INFO_ADDR},
 	{"rx_pkts_queued", item_size(rx_pkts_queued), item_addr(rx_pkts_queued),
 	 INFO_ADDR},
+#ifdef PCIE
+	{"pcie_event_processing", item_size(pcie_event_processing),
+	 item_addr(pcie_event_processing), INFO_ADDR},
+	{"pcie_rx_processing", item_size(pcie_rx_processing),
+	 item_addr(pcie_rx_processing), INFO_ADDR},
+	{"pcie_tx_processing", item_size(pcie_tx_processing),
+	 item_addr(pcie_tx_processing), INFO_ADDR},
+#endif
 	{"wmm_ac_vo", item_size(wmm_ac_vo), item_addr(wmm_ac_vo), INFO_ADDR},
 	{"wmm_ac_vi", item_size(wmm_ac_vi), item_addr(wmm_ac_vi), INFO_ADDR},
 	{"wmm_ac_be", item_size(wmm_ac_be), item_addr(wmm_ac_be), INFO_ADDR},
@@ -113,6 +129,7 @@
 	{"tx_lock_flag", item_size(tx_lock_flag), item_addr(tx_lock_flag),
 	 INFO_ADDR},
 	{"port_open", item_size(port_open), item_addr(port_open), INFO_ADDR},
+	{"tx_pause", item_size(tx_pause), item_addr(tx_pause), INFO_ADDR},
 	{"bypass_pkt_count", item_size(bypass_pkt_count),
 	 item_addr(bypass_pkt_count), INFO_ADDR},
 	{"scan_processing", item_size(scan_processing),
@@ -285,6 +302,14 @@
 	 item_addr(mlan_rx_processing), INFO_ADDR},
 	{"rx_pkts_queued", item_size(rx_pkts_queued), item_addr(rx_pkts_queued),
 	 INFO_ADDR},
+#ifdef PCIE
+	{"pcie_event_processing", item_size(pcie_event_processing),
+	 item_addr(pcie_event_processing), INFO_ADDR},
+	{"pcie_rx_processing", item_size(pcie_rx_processing),
+	 item_addr(pcie_rx_processing), INFO_ADDR},
+	{"pcie_tx_processing", item_size(pcie_tx_processing),
+	 item_addr(pcie_tx_processing), INFO_ADDR},
+#endif
 	{"wmm_ac_vo", item_size(wmm_ac_vo), item_addr(wmm_ac_vo), INFO_ADDR},
 	{"wmm_ac_vi", item_size(wmm_ac_vi), item_addr(wmm_ac_vi), INFO_ADDR},
 	{"wmm_ac_be", item_size(wmm_ac_be), item_addr(wmm_ac_be), INFO_ADDR},
@@ -311,6 +336,7 @@
 	 INFO_ADDR},
 	{"tx_pkts_queued", item_size(tx_pkts_queued), item_addr(tx_pkts_queued),
 	 INFO_ADDR},
+	{"tx_pause", item_size(tx_pause), item_addr(tx_pause), INFO_ADDR},
 	{"bypass_pkt_count", item_size(bypass_pkt_count),
 	 item_addr(bypass_pkt_count), INFO_ADDR},
 	{"num_bridge_pkts", item_size(num_bridge_pkts),
@@ -1089,6 +1115,7 @@
 	seq_printf(sfp, "tcp_ack_drop_cnt=%d\n", priv->tcp_ack_drop_cnt);
 	seq_printf(sfp, "tcp_ack_cnt=%d\n", priv->tcp_ack_cnt);
 	seq_printf(sfp, "tcp_ack_payload=%d\n", priv->tcp_ack_payload);
+	seq_printf(sfp, "tcp_sess_cnt=%d\n", priv->tcp_sess_cnt);
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 	for (i = 0; i < 4; i++)
 		seq_printf(sfp, "wmm_tx_pending[%d]:%d\n", i,
@@ -1206,6 +1233,7 @@
 	t_u32 last_drvdbg = drvdbg;
 #endif
 	gfp_t flag;
+	t_u32 temp_count = 0;
 
 	ENTER();
 
@@ -1214,7 +1242,11 @@
 		return MLAN_STATUS_FAILURE;
 	}
 	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
-	pdata = kzalloc(count + 1, flag);
+
+	if (!woal_secure_add(&count, 1, &temp_count, TYPE_UINT32))
+		PRINTM(MERROR, "%s:count param overflow \n", __func__);
+
+	pdata = kzalloc(temp_count, flag);
 	if (pdata == NULL) {
 		MODULE_PUT;
 		LEAVE();
diff --git a/wlan_sd8987/mlinux/moal_eth_ioctl.c b/wlan_src/mlinux/moal_eth_ioctl.c
old mode 100755
new mode 100644
similarity index 86%
rename from wlan_sd8987/mlinux/moal_eth_ioctl.c
rename to wlan_src/mlinux/moal_eth_ioctl.c
index 3081f33..a13d82a
--- a/wlan_sd8987/mlinux/moal_eth_ioctl.c
+++ b/wlan_src/mlinux/moal_eth_ioctl.c
@@ -1,25 +1,33 @@
 
 /** @file  moal_eth_ioctl.c
-  *
-  * @brief This file contains private ioctl functions
-
-  *
-  * Copyright 2014-2022 NXP
-  *
-  * This software file (the File) is distributed by NXP
-  * under the terms of the GNU General Public License Version 2, June 1991
-  * (the License).  You may use, redistribute and/or modify the File in
-  * accordance with the terms and conditions of the License, a copy of which
-  * is available by writing to the Free Software Foundation, Inc.,
-  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
-  * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
-  *
-  * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
-  * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
-  * this warranty disclaimer.
-  *
-  */
+ *
+ * @brief This file contains private ioctl functions
+ *
+ *
+ * Copyright 2014-2024 NXP
+ *
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
+ *
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ */
 
 /************************************************************************
 Change log:
@@ -60,6 +68,8 @@
 #include <linux/compat.h>
 #endif
 
+#define CMD_BUF_LEN 4096
+
 /********************************************************
 			Local Variables
 ********************************************************/
@@ -67,15 +77,16 @@
 /** Bands supported in Infra mode */
 static t_u16 SupportedInfraBand[] = {
 	BAND_B,
-	BAND_B | BAND_G,
 	BAND_G,
 	BAND_GN,
-	BAND_B | BAND_G | BAND_GN,
+	BAND_B | BAND_G,
 	BAND_G | BAND_GN,
+	BAND_B | BAND_GN,
+	BAND_B | BAND_G | BAND_GN,
 	BAND_A,
 	BAND_B | BAND_A,
-	BAND_B | BAND_G | BAND_A,
 	BAND_G | BAND_A,
+	BAND_B | BAND_G | BAND_A,
 	BAND_A | BAND_B | BAND_G | BAND_AN | BAND_GN,
 	BAND_A | BAND_G | BAND_AN | BAND_GN,
 	BAND_A | BAND_AN,
@@ -83,6 +94,7 @@
 	BAND_B | BAND_G | BAND_GN | BAND_GAC,
 	BAND_G | BAND_GN | BAND_GAC,
 	BAND_GN | BAND_GAC | BAND_GAX,
+	BAND_GN | BAND_GAX,
 	BAND_B | BAND_G | BAND_GN | BAND_GAC | BAND_GAX,
 	BAND_G | BAND_GN | BAND_GAC | BAND_GAX,
 	BAND_A | BAND_B | BAND_G | BAND_AN | BAND_GN | BAND_AAC,
@@ -90,18 +102,17 @@
 	BAND_A | BAND_G | BAND_AN | BAND_GN | BAND_AAC,
 	BAND_A | BAND_AN | BAND_AAC,
 	BAND_A | BAND_B | BAND_G | BAND_AN | BAND_GN | BAND_AAC | BAND_AAX,
+	BAND_A | BAND_B | BAND_G | BAND_AN | BAND_GN | BAND_AAC | BAND_AAX |
+		BAND_GAX,
 	BAND_A | BAND_B | BAND_G | BAND_AN | BAND_GN | BAND_AAC | BAND_GAC |
 		BAND_AAX,
+	BAND_A | BAND_B | BAND_G | BAND_AN | BAND_GN | BAND_AAC | BAND_GAC |
+		BAND_AAX | BAND_GAX,
+	BAND_A | BAND_B | BAND_G | BAND_AN | BAND_GN | BAND_AAC | BAND_GAC |
+		BAND_GAX,
 	BAND_A | BAND_G | BAND_AN | BAND_GN | BAND_AAC | BAND_AAX,
 	BAND_A | BAND_AN | BAND_AAC | BAND_AAX,
-};
-
-/** Bands supported in Ad-Hoc mode */
-static t_u16 SupportedAdhocBand[] = {
-	BAND_B,
-	BAND_B | BAND_G,
-	BAND_G,
-	BAND_A,
+	BAND_B | BAND_G | BAND_GN | BAND_GAX,
 };
 
 /********************************************************
@@ -160,7 +171,10 @@
 				data[j] = woal_atox(cdata);
 				is_hex = 0;
 			} else {
-				woal_atoi(&data[j], cdata);
+				if (woal_atoi(&data[j], cdata) !=
+				    MLAN_STATUS_SUCCESS) {
+					PRINTM(MERROR, " fail on woal_atoi()");
+				}
 			}
 			j++;
 			k = 0;
@@ -321,6 +335,7 @@
 {
 	int len = 0, ret = -1;
 	char buf[MLAN_MAX_VER_STR_LEN];
+	t_u32 temp_buf_len = 0;
 
 	ENTER();
 
@@ -336,9 +351,13 @@
 	len = strlen(buf);
 
 	if (len) {
+		if (!woal_secure_sub(&respbuflen, 1, &temp_buf_len,
+				     TYPE_UINT32)) {
+			PRINTM(MERROR, "%s:respbuflen underflow \n", __func__);
+		}
 		/* Copy back the retrieved version string */
 		PRINTM(MINFO, "MOAL VERSION: %s\n", buf);
-		ret = MIN(len, (int)(respbuflen - 1));
+		ret = MIN(len, (int)temp_buf_len);
 		moal_memcpy_ext(priv->phandle, respbuf, buf, ret,
 				respbuflen - 1);
 	} else {
@@ -427,6 +446,101 @@
 	return ret;
 }
 
+#define MAC_STRING_LENGTH 17
+/**
+ * @brief      extracts llde pkt filter specific parameters from llde.conf file
+ *
+ *
+ *  @param priv    Pointer to the mlan_private driver data struct
+ *  @param respbuf      A pointer to response buffer
+ *  @param param_buf   A pointer to mlan_ds_11ax_llde_pkt_filter_cmd struct
+ *
+ *  @return         returns 0
+ */
+static int woal_set_priv_11axcmdcfg_llde_pkt_filer_cmd(
+	moal_private *priv, t_u8 *respbuf,
+	mlan_ds_11ax_llde_pkt_filter_cmd *param_buf)
+{
+	t_u8 *llde_pkt_filter_pos = NULL;
+	int llde_cfg_len = 0, llde_pkt_filter_len = 0;
+	t_u8 mac_pos[MAC_STRING_LENGTH] = {0};
+	t_u8 peer_mac[ETH_ALEN] = {0};
+	t_u8 convert_int[2] = {0};
+	int tmp_val = 0;
+	t_u8 *tmp_pos = NULL;
+
+	/* if llde device_filter or macfilter is not present in config file then
+	 * return */
+	if (strstr(respbuf, "device_filter") == NULL) {
+		if (strstr(respbuf, "macfilter") == NULL)
+			return 0;
+	}
+
+	llde_pkt_filter_pos = strstr(respbuf, "device_filter");
+	if (llde_pkt_filter_pos) {
+		llde_cfg_len =
+			(strlen(respbuf) - (strlen(llde_pkt_filter_pos) + 1));
+		llde_pkt_filter_len = strlen(llde_pkt_filter_pos);
+	}
+
+	llde_pkt_filter_pos = llde_pkt_filter_pos + strlen("device_filter=");
+	if (llde_pkt_filter_pos) {
+		moal_memcpy_ext(priv->phandle, (t_u8 *)convert_int,
+				(t_u8 *)llde_pkt_filter_pos, 1, 1);
+		(void)woal_atoi(&tmp_val, convert_int);
+		param_buf->device_filter = tmp_val;
+	}
+
+	llde_pkt_filter_pos = strstr(respbuf, "macfilter1");
+	if (llde_pkt_filter_pos)
+		llde_pkt_filter_pos =
+			llde_pkt_filter_pos + strlen("macfilter1=");
+
+	tmp_pos = llde_pkt_filter_pos + MAC_STRING_LENGTH;
+	if (llde_pkt_filter_pos && tmp_pos) {
+		moal_memcpy_ext(priv->phandle, (t_u8 *)mac_pos,
+				(t_u8 *)llde_pkt_filter_pos, MAC_STRING_LENGTH,
+				MAC_STRING_LENGTH);
+		woal_mac2u8(peer_mac, mac_pos);
+		moal_memcpy_ext(priv->phandle, (t_u8 *)&param_buf->macfilter1,
+				(t_u8 *)peer_mac, ETH_ALEN, ETH_ALEN);
+	}
+
+	llde_pkt_filter_pos = strstr(respbuf, "macfilter2");
+	if (llde_pkt_filter_pos)
+		llde_pkt_filter_pos =
+			llde_pkt_filter_pos + strlen("macfilter2=");
+
+	tmp_pos = llde_pkt_filter_pos + MAC_STRING_LENGTH;
+	if (llde_pkt_filter_pos && tmp_pos) {
+		moal_memcpy_ext(priv->phandle, (t_u8 *)mac_pos,
+				(t_u8 *)llde_pkt_filter_pos, MAC_STRING_LENGTH,
+				MAC_STRING_LENGTH);
+		woal_mac2u8(peer_mac, mac_pos);
+		moal_memcpy_ext(priv->phandle, (t_u8 *)&param_buf->macfilter2,
+				(t_u8 *)peer_mac, ETH_ALEN, ETH_ALEN);
+	}
+
+	llde_pkt_filter_pos = strstr(respbuf, "packet_type");
+	if (llde_pkt_filter_pos)
+		llde_pkt_filter_pos =
+			llde_pkt_filter_pos + strlen("packet_type=");
+
+	if (llde_pkt_filter_pos) {
+		moal_memcpy_ext(priv->phandle, (t_u8 *)convert_int,
+				(t_u8 *)llde_pkt_filter_pos, 1, 1);
+		(void)woal_atoi(&tmp_val, convert_int);
+		param_buf->packet_type = tmp_val;
+	}
+
+	/* remove llde_pkt_filter parameters from respbuf as they are parsed
+	above, respbuf will contain llde cfg parameters only which will be later
+	parsed via parse_arguments() */
+	memset(respbuf + llde_cfg_len, 0, llde_pkt_filter_len);
+
+	LEAVE();
+	return 0;
+}
 /**
  * @brief               configure 11ax HE capability or HE operation
  *
@@ -443,13 +557,24 @@
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11ax_cmd_cfg *cfg = NULL;
+	mlan_ds_11ax_llde_pkt_filter_cmd llde_pkt_filter = {0};
 	int ret = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	int header_len = 0, user_data_len = 0;
-	int data[4] = {0};
+	int data[10] = {0};
+	int llde_total_len = 0, alloc_len = 0, mlan_ds_11ax_cmd_cfg_header = 0;
 	ENTER();
 
-	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11ax_cmd_cfg));
+	llde_total_len = sizeof(mlan_ds_11ax_llde_cmd) +
+			 sizeof(mlan_ds_11ax_llde_pkt_filter_cmd);
+	mlan_ds_11ax_cmd_cfg_header =
+		sizeof(t_u32 /*sub_command*/) + sizeof(t_u32 /*sub_id*/);
+	llde_total_len += mlan_ds_11ax_cmd_cfg_header;
+	alloc_len = sizeof(mlan_ds_11ax_cmd_cfg) > llde_total_len ?
+			    sizeof(mlan_ds_11ax_cmd_cfg) :
+			    llde_total_len;
+
+	req = woal_alloc_mlan_ioctl_req(alloc_len);
 	if (req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -461,12 +586,15 @@
 	cfg = (mlan_ds_11ax_cmd_cfg *)req->pbuf;
 	cfg->sub_command = MLAN_OID_11AX_CMD_CFG;
 
+	woal_set_priv_11axcmdcfg_llde_pkt_filer_cmd(priv, respbuf,
+						    &llde_pkt_filter);
+
 	parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
 			&user_data_len);
 	PRINTM(MINFO, "data_len=%d,data=%d,%d,%d\n", user_data_len, data[0],
 	       data[1], data[2]);
 
-	if (user_data_len > 4 || user_data_len == 0) {
+	if (user_data_len > 10 || user_data_len == 0) {
 		PRINTM(MERROR, "Invalid parameters\n");
 		ret = -EFAULT;
 		goto done;
@@ -510,6 +638,41 @@
 		cfg->sub_id = MLAN_11AXCMD_OBSS_TOLTIME_SUBID;
 		cfg->param.toltime_cfg.tol_time = data[1];
 		break;
+	case MLAN_11AXCMD_CFG_ID_SET_BSRP:
+		cfg->sub_id = MLAN_11AXCMD_SET_BSRP_SUBID;
+		cfg->param.setbsrp_cfg.value = data[1];
+		break;
+	case MLAN_11AXCMD_CFG_ID_LLDE:
+		cfg->sub_id = MLAN_11AXCMD_LLDE_SUBID;
+		cfg->param.llde_cfg.llde = data[1];
+		cfg->param.llde_cfg.mode = data[2];
+		cfg->param.llde_cfg.fixrate = data[3];
+		cfg->param.llde_cfg.triggerlimit = data[4];
+		cfg->param.llde_cfg.peakULrate = data[5];
+		cfg->param.llde_cfg.dl_llde = data[6];
+		cfg->param.llde_cfg.pollinterval = data[7];
+		cfg->param.llde_cfg.txOpDuration = data[8];
+		cfg->param.llde_cfg.llde_ctrl = data[9];
+
+		/* append llde packet filter parameters to ioctl buffer */
+		if (cfg->param.llde_cfg.llde) {
+			moal_memcpy_ext(
+				priv->phandle,
+				req->pbuf + mlan_ds_11ax_cmd_cfg_header +
+					sizeof(mlan_ds_11ax_llde_cmd),
+				&llde_pkt_filter,
+				sizeof(mlan_ds_11ax_llde_pkt_filter_cmd),
+				sizeof(mlan_ds_11ax_llde_pkt_filter_cmd));
+		}
+		break;
+	case MLAN_11AXCMD_CFG_ID_RUTXPWR:
+		cfg->sub_id = MLAN_11AXCMD_RUTXSUBPWR_SUBID;
+		break;
+	case MLAN_11AXCMD_CFG_ID_HESUER:
+		cfg->sub_id = MLAN_11AXCMD_HESUER_SUBID;
+		cfg->param.HeSuER_cfg.value = data[1];
+		break;
+
 	default:
 		PRINTM(MERROR, "unknown 11axcmd\n");
 		ret = -EFAULT;
@@ -698,11 +861,9 @@
 {
 	int ret = 0;
 	unsigned int i;
-	int data[3];
+	int data[1];
 	int user_data_len = 0;
 	t_u32 infra_band = 0;
-	t_u32 adhoc_band = 0;
-	t_u32 adhoc_channel = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_radio_cfg *radio_cfg = NULL;
 	mlan_ds_band_cfg *band_cfg = NULL;
@@ -757,40 +918,15 @@
 		     i++)
 			if (infra_band == SupportedInfraBand[i])
 				break;
-		if (i == sizeof(SupportedInfraBand)) {
+		if (i == (sizeof(SupportedInfraBand) /
+			  sizeof(SupportedInfraBand[0]))) {
 			ret = -EINVAL;
 			goto error;
 		}
 
-		/* Set Adhoc band */
-		if (user_data_len >= 2) {
-			adhoc_band = data[1];
-			for (i = 0; i < (sizeof(SupportedAdhocBand) /
-					 sizeof(SupportedAdhocBand[0]));
-			     i++)
-				if (adhoc_band == SupportedAdhocBand[i])
-					break;
-			if (i == sizeof(SupportedAdhocBand)) {
-				ret = -EINVAL;
-				goto error;
-			}
-		}
-
-		/* Set Adhoc channel */
-		if (user_data_len >= 3) {
-			adhoc_channel = data[2];
-			if (adhoc_channel == 0) {
-				/* Check if specified adhoc channel is non-zero
-				 */
-				ret = -EINVAL;
-				goto error;
-			}
-		}
 		/* Set config_bands and adhoc_start_band values to MLAN */
 		req->action = MLAN_ACT_SET;
 		radio_cfg->param.band_cfg.config_bands = infra_band;
-		radio_cfg->param.band_cfg.adhoc_start_band = adhoc_band;
-		radio_cfg->param.band_cfg.adhoc_channel = adhoc_channel;
 	}
 
 	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
@@ -1208,7 +1344,8 @@
 		goto done;
 	}
 
-	ret = sprintf(respbuf, "OK. BA deleted successfully.\n") + 1;
+	ret = snprintf(respbuf, CMD_BUF_LEN, "OK. BA deleted successfully.\n") +
+	      1;
 
 done:
 	if (status != MLAN_STATUS_PENDING)
@@ -1282,11 +1419,11 @@
 		goto done;
 	}
 	if (req->action == MLAN_ACT_GET) {
-		sprintf(respbuf, "0x%x",
-			cfg_11n->param.reject_addba_req.conditions);
+		snprintf(respbuf, CMD_BUF_LEN, "0x%x",
+			 cfg_11n->param.reject_addba_req.conditions);
 		ret = strlen(respbuf) + 1;
 	} else {
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -2086,7 +2223,7 @@
 static int woal_setget_priv_txratecfg(moal_private *priv, t_u8 *respbuf,
 				      t_u32 respbuflen)
 {
-	t_u32 data[4];
+	t_u32 data[5];
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_rate *rate = NULL;
 	woal_tx_rate_cfg *ratecfg = NULL;
@@ -2095,8 +2232,18 @@
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	txrate_setting *rate_setting = NULL;
 
+	t_u32 vht_mcs_limit = MLAN_RATE_INDEX_MCS9;
+	t_u32 he_mcs_limit = MLAN_RATE_INDEX_MCS11;
+	t_u32 nss_limit = MLAN_RATE_NSS2;
+
 	ENTER();
 
+	if (IS_CARDIW610(priv->phandle->card_type)) {
+		vht_mcs_limit = MLAN_RATE_INDEX_MCS8;
+		he_mcs_limit = MLAN_RATE_INDEX_MCS9;
+		nss_limit = MLAN_RATE_NSS1;
+	}
+
 	if (strlen(respbuf) == (strlen(CMD_NXP) + strlen(PRIV_CMD_TXRATECFG))) {
 		/* GET operation */
 		user_data_len = 0;
@@ -2108,12 +2255,18 @@
 				data, ARRAY_SIZE(data), &user_data_len);
 	}
 
-	if (user_data_len > 4) {
+	if (user_data_len > 5) {
 		PRINTM(MERROR, "Too many arguments\n");
 		ret = -EINVAL;
 		goto done;
 	}
 
+	if ((user_data_len == 5) && (data[4] > 1)) {
+		PRINTM(MERROR, "Invalid auto_null_fixrate parameter");
+		ret = -EINVAL;
+		goto done;
+	}
+
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_rate));
 	if (req == NULL) {
 		ret = -ENOMEM;
@@ -2125,6 +2278,8 @@
 	rate->sub_command = MLAN_OID_RATE_CFG;
 	rate->param.rate_cfg.rate_type = MLAN_RATE_INDEX;
 
+	rate->auto_null_fixrate_enable = 0xFF;
+
 	if (user_data_len == 0) {
 		/* Get operation */
 		req->action = MLAN_ACT_GET;
@@ -2141,6 +2296,15 @@
 			/* auto */
 			rate->param.rate_cfg.is_rate_auto = 1;
 		} else {
+			if (data[0] == MLAN_RATE_FORMAT_LG ||
+			    data[0] == MLAN_RATE_FORMAT_HT) {
+				if (user_data_len > 2) {
+					PRINTM(MERROR,
+					       "Invalid number of arguments\n");
+					ret = -EINVAL;
+					goto done;
+				}
+			}
 			/* fixed rate */
 			PRINTM(MINFO, "SET: txratefg format: 0x%x\n", data[0]);
 			if ((data[0] != AUTO_RATE) &&
@@ -2160,9 +2324,9 @@
 				    ((data[0] == MLAN_RATE_FORMAT_HT) &&
 				     (data[1] != 32) && (data[1] > 15)) ||
 				    ((data[0] == MLAN_RATE_FORMAT_VHT) &&
-				     (data[1] > MLAN_RATE_INDEX_MCS9)) ||
+				     (data[1] > vht_mcs_limit)) ||
 				    ((data[0] == MLAN_RATE_FORMAT_HE) &&
-				     (data[1] > MLAN_RATE_INDEX_MCS11))) {
+				     (data[1] > he_mcs_limit))) {
 					PRINTM(MERROR,
 					       "Invalid index selection\n");
 					ret = -EINVAL;
@@ -2177,8 +2341,9 @@
 			if (data[0] == 2 || data[0] == 3) {
 				PRINTM(MINFO, "SET: txratefg nss: 0x%x\n",
 				       data[2]);
-				/* NSS is supported up to 2 */
-				if ((data[2] <= 0) || (data[2] >= 3)) {
+				/* NSS is supported up to 1 for IW610, and up to
+				 * 2 for other chips */
+				if ((data[2] <= 0) || (data[2] > nss_limit)) {
 					PRINTM(MERROR,
 					       "Invalid nss selection\n");
 					ret = -EINVAL;
@@ -2186,7 +2351,7 @@
 				}
 				rate->param.rate_cfg.nss = data[2];
 			}
-			if (user_data_len == 4) {
+			if ((user_data_len == 4) || (data[4] == 1)) {
 				rate->param.rate_cfg.rate_setting =
 					data[3] & ~0x0C00;
 				PRINTM(MIOCTL,
@@ -2194,15 +2359,50 @@
 				       data[3]);
 
 /* HE Preamble type */
-//#define HE_SU_PREAMBLE 0
+#define HE_SU_PREAMBLE 0
 #define HE_ER_PREAMBLE 1
 
 /* HE ER SU Type */
 #define HE_ER_SU_BANDWIDTH_TONE242 0
 #define HE_ER_SU_BANDWIDTH_TONE106 1
+#define HE_SU_BANDWIDTH_MAX 3
 
 				rate_setting = (txrate_setting *)&data[3];
 
+				if (IS_CARDIW610(priv->phandle->card_type)) {
+					if (rate_setting->stbc != 0) {
+						PRINTM(MERROR,
+						       "This chip does not support STBC\n");
+						ret = -EINVAL;
+						goto done;
+					}
+					if (rate_setting->adv_coding != 0) {
+						PRINTM(MERROR,
+						       "This chip does not support LDPC\n");
+						ret = -EINVAL;
+						goto done;
+					}
+					if (data[0] == MLAN_RATE_FORMAT_HE &&
+					    rate_setting->preamble ==
+						    HE_ER_PREAMBLE) {
+						if (rate_setting->bandwidth >
+						    HE_ER_SU_BANDWIDTH_TONE106) {
+							PRINTM(MERROR,
+							       "BW setting for this ER rate is not supported for this 20MHz only chip\n");
+							ret = -EINVAL;
+							goto done;
+						}
+					} else {
+						if (rate_setting->bandwidth !=
+						    0) {
+							PRINTM(MERROR,
+							       "BW setting is not supported for this 20MHz only chip\n");
+							ret = -EINVAL;
+							goto done;
+						}
+					}
+				}
+
 				if (data[0] == MLAN_RATE_FORMAT_HE) {
 					if (rate_setting->preamble ==
 					    HE_ER_PREAMBLE) {
@@ -2235,7 +2435,17 @@
 							ret = -EINVAL;
 							goto done;
 						}
+					} else if (rate_setting->preamble ==
+						   HE_SU_PREAMBLE) {
+						if (rate_setting->bandwidth >
+						    HE_SU_BANDWIDTH_MAX) {
+							PRINTM(MERROR,
+							       "Invalid Bandwidth for HE SU Preamble\n");
+							ret = -EINVAL;
+							goto done;
+						}
 					}
+
 					if ((rate_setting->dcm) &&
 					    (rate_setting->stbc == 0)) {
 						if ((data[1] ==
@@ -2252,6 +2462,13 @@
 			} else {
 				rate->param.rate_cfg.rate_setting = 0xffff;
 			}
+
+			if (user_data_len == 5) {
+				rate->auto_null_fixrate_enable = data[4];
+				PRINTM(MINFO,
+				       "SET: auto_null_fixrate_enable: 0x%x\n",
+				       data[4]);
+			}
 		}
 	}
 
@@ -2637,34 +2854,36 @@
 
 	memset(respbuf, 0, respbuflen);
 	if (sec->param.passphrase.ssid.ssid_len) {
-		len += sprintf(respbuf + len, "ssid:");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "ssid:");
 		moal_memcpy_ext(priv->phandle, respbuf + len,
 				sec->param.passphrase.ssid.ssid,
 				sec->param.passphrase.ssid.ssid_len,
 				respbuflen - len);
 		len += sec->param.passphrase.ssid.ssid_len;
-		len += sprintf(respbuf + len, " ");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, " ");
 	}
 	if (memcmp(&sec->param.passphrase.bssid, zero_mac, sizeof(zero_mac))) {
 		mac = (t_u8 *)&sec->param.passphrase.bssid;
-		len += sprintf(respbuf + len, "bssid:");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "bssid:");
 		for (i = 0; i < ETH_ALEN - 1; ++i)
-			len += sprintf(respbuf + len, "%02x:", mac[i]);
-		len += sprintf(respbuf + len, "%02x ", mac[i]);
+			len += snprintf(respbuf + len, CMD_BUF_LEN,
+					"%02x:", mac[i]);
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "%02x ", mac[i]);
 	}
 	if (sec->param.passphrase.psk_type == MLAN_PSK_PMK) {
-		len += sprintf(respbuf + len, "psk:");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "psk:");
 		for (i = 0; i < MLAN_MAX_KEY_LENGTH; ++i)
-			len += sprintf(respbuf + len, "%02x",
-				       sec->param.passphrase.psk.pmk.pmk[i]);
-		len += sprintf(respbuf + len, "\n");
+			len += snprintf(respbuf + len, CMD_BUF_LEN, "%02x",
+					sec->param.passphrase.psk.pmk.pmk[i]);
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "\n");
 	}
 	if (sec->param.passphrase.psk_type == MLAN_PSK_PASSPHRASE)
-		len += sprintf(respbuf + len, "passphrase:%s\n",
-			       sec->param.passphrase.psk.passphrase.passphrase);
+		len += snprintf(
+			respbuf + len, CMD_BUF_LEN, "passphrase:%s\n",
+			sec->param.passphrase.psk.passphrase.passphrase);
 	if (sec->param.passphrase.psk_type == MLAN_PSK_SAE_PASSWORD)
-		len += sprintf(
-			respbuf + len, "sae_password:%s\n",
+		len += snprintf(
+			respbuf + len, CMD_BUF_LEN, "sae_password:%s\n",
 			sec->param.passphrase.psk.sae_password.sae_password);
 
 	ret = len;
@@ -2793,7 +3012,8 @@
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -2891,6 +3111,87 @@
 }
 #endif
 
+#if defined(UAP_SUPPORT)
+#if defined(STA_CFG80211) && defined(UAP_CFG80211)
+/**
+ *  @brief easymesh uap Set/Get multi AP mode handler
+ *
+ *  @param priv       A pointer to moal_private structure
+ *  @param respbuf    A pointer to response buffer
+ *  @param respbuflen Length of response buffer
+ *
+ *  @return           MultiAP mode for GET, 0 -- success, otherwise fail for SET
+ */
+static int woal_uap_set_multiap_mode(moal_private *priv, t_u8 *respbuf,
+				     t_u32 respbuflen)
+{
+	int mode[1] = {0};
+	int ret = 0;
+	int header_len = 0;
+	int user_data_len = 0;
+
+	ENTER();
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SETMODE);
+	user_data_len = strlen(respbuf) - header_len;
+
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		user_data_len = 0;
+		if (priv->multi_ap_flag == EASY_MESH_MULTI_AP_BH_AND_FH_BSS)
+			mode[0] = EASY_MESH_MULTI_AP_BSS_MODE_3;
+		else if (priv->multi_ap_flag == EASY_MESH_MULTI_AP_BH_BSS)
+			mode[0] = EASY_MESH_MULTI_AP_BSS_MODE_2;
+		else if (priv->multi_ap_flag == EASY_MESH_MULTI_AP_FH_BSS)
+			mode[0] = EASY_MESH_MULTI_AP_BSS_MODE_1;
+		PRINTM(MINFO, "[EM:%s:%d] setmode to 0x%x\n", __func__,
+		       __LINE__, mode[0]);
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)mode,
+				sizeof(mode), respbuflen);
+		ret = sizeof(mode);
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, mode, ARRAY_SIZE(mode),
+				&user_data_len);
+		if (user_data_len > 1) {
+			PRINTM(MERROR, "Invalid number of args!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if ((mode[0] != EASY_MESH_MULTI_AP_BSS_MODE_3) &&
+		    (mode[0] != EASY_MESH_MULTI_AP_BSS_MODE_2) &&
+		    (mode[0] != EASY_MESH_MULTI_AP_BSS_MODE_1)) {
+			PRINTM(MERROR, "Invalid setmode value\n");
+			ret = -EINVAL;
+			goto done;
+		}
+
+		if (mode[0] == EASY_MESH_MULTI_AP_BSS_MODE_3)
+			/* Supports backhaul and fronthaul BSS */
+			priv->multi_ap_flag = EASY_MESH_MULTI_AP_BH_AND_FH_BSS;
+		else if (mode[0] == EASY_MESH_MULTI_AP_BSS_MODE_2)
+			/* Supports backhaul BSS */
+			priv->multi_ap_flag = EASY_MESH_MULTI_AP_BH_BSS;
+		else if (mode[0] == EASY_MESH_MULTI_AP_BSS_MODE_1)
+			/* Supports fronthaul BSS */
+			priv->multi_ap_flag = EASY_MESH_MULTI_AP_FH_BSS;
+		PRINTM(MINFO, "[EM:%s:%d] priv->multi_ap_flag 0x%x\n", __func__,
+		       __LINE__, priv->multi_ap_flag);
+	}
+
+done:
+	LEAVE();
+	return ret;
+}
+#endif
+#endif
+
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
 /**
@@ -3138,7 +3439,7 @@
 	}
 
 	prsp_info->scan_number = num_scans_done;
-	ret_len = pcurrent - respbuf;
+	ret_len = (int)(pcurrent - respbuf);
 
 	LEAVE();
 	return ret_len;
@@ -3283,6 +3584,110 @@
 }
 #endif
 
+/*
+ *  @brief Set/Get reorder flush time
+ *
+ *  @param priv                 A pointer to moal_private structure
+ *  @param action               Action set or get
+ *  @param data                 A pointer to the data buf
+ *
+ *  @return                     MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --
+ * success, otherwise fail
+ */
+static mlan_status woal_set_get_reorder_flush_time(moal_private *priv,
+						   t_u32 action, int *data)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_REORDER_FLUSH_TIME;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	req->action = action;
+
+	if (action == MLAN_ACT_SET) {
+		misc->param.flush_time.flush_time_ac_be_bk = (t_u16)data[0];
+		misc->param.flush_time.flush_time_ac_vi_vo = (t_u16)data[1];
+	}
+
+	/* Send IOCTL request to MLAN */
+	ret = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (ret == MLAN_STATUS_SUCCESS) {
+		data[0] = misc->param.flush_time.flush_time_ac_be_bk;
+		data[1] = misc->param.flush_time.flush_time_ac_vi_vo;
+	}
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief Set/Get AMPDU reordering flush time configurations
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param respbuf      A pointer to response buffer
+ *  @param respbuflen   Available length of response buffer
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_set_get_reorder_flush_time(moal_private *priv,
+						t_u8 *respbuf, t_u32 respbuflen)
+{
+	t_u32 data[2];
+	int ret = 0;
+	int user_data_len = 0;
+	t_u8 action;
+
+	ENTER();
+
+	if (strlen(respbuf) ==
+	    (strlen(CMD_NXP) + strlen(PRIV_CMD_REORDER_FLUSH_TIME))) {
+		/* GET operation */
+		user_data_len = 0;
+	} else {
+		/* SET operation */
+		memset((char *)data, 0, sizeof(data));
+		parse_arguments(respbuf + strlen(CMD_NXP) +
+					strlen(PRIV_CMD_REORDER_FLUSH_TIME),
+				data, ARRAY_SIZE(data), &user_data_len);
+	}
+
+	if (user_data_len >= 3) {
+		PRINTM(MERROR, "Too many arguments\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (user_data_len == 0)
+		action = MLAN_ACT_GET;
+	else
+		action = MLAN_ACT_SET;
+
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_set_get_reorder_flush_time(priv, action, data)) {
+		ret = -EFAULT;
+		goto done;
+	}
+	sprintf(respbuf, "BE/BK=%d VI/VO=%d", data[0], data[1]);
+	ret = strlen(respbuf) + 1;
+done:
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Set/Get deep sleep mode configurations
  *
@@ -3323,7 +3728,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		sprintf(respbuf, "%d %d", data[0], data[1]);
+		snprintf(respbuf, CMD_BUF_LEN, "%d %d", data[0], data[1]);
 		ret = strlen(respbuf) + 1;
 	} else {
 		if (data[0] == DEEP_SLEEP_OFF) {
@@ -3349,7 +3754,7 @@
 			ret = -EINVAL;
 			goto done;
 		}
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -3379,7 +3784,7 @@
 	if (priv->bss_type != MLAN_BSS_TYPE_STA) {
 		PRINTM(MIOCTL, "Bss type[%d]: Not STA, ignore it\n",
 		       priv->bss_type);
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 		goto done;
 	}
 
@@ -3442,7 +3847,7 @@
 			 misc->param.ipaddr_cfg.ip_addr[0][3]);
 		ret = IPADDR_MAX_BUF + 1;
 	} else {
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -3513,7 +3918,7 @@
 		goto done;
 	}
 
-	ret = sprintf(respbuf, "OK\n") + 1;
+	ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(req);
@@ -3731,6 +4136,8 @@
 	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *cfp_misc = NULL;
+	mlan_cfpinfo *c = NULL;
+	t_u32 header_len = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -3742,12 +4149,18 @@
 	}
 
 	/* Allocate an IOCTL request buffer */
-	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	req = woal_alloc_mlan_ioctl_req(
+		MAX(CMD_BUF_LEN, sizeof(mlan_ds_misc_cfg)));
 	if (req == NULL) {
 		ret = -ENOMEM;
 		goto done;
 	}
 
+	/* Check whether user has requested 6GHz or MAC2 tables */
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_CFPINFO);
+	if (respbuflen >= (header_len + sizeof(mlan_cfpinfo)))
+		c = (mlan_cfpinfo *)(respbuf + header_len);
+
 	/* Fill request buffer */
 	cfp_misc = (mlan_ds_misc_cfg *)req->pbuf;
 	cfp_misc->sub_command = MLAN_OID_MISC_CFP_INFO;
@@ -3868,7 +4281,7 @@
 static int woal_priv_assocessid(moal_private *priv, t_u8 *respbuf,
 				t_u32 respbuflen, t_u8 bBSSID)
 {
-	mlan_ssid_bssid ssid_bssid;
+	mlan_ssid_bssid *ssid_bssid = NULL;
 	moal_handle *handle = priv->phandle;
 	int ret = 0;
 	int header_len = 0;
@@ -3894,7 +4307,12 @@
 	copy_len = strlen(respbuf) - header_len;
 	buflen = MIN(copy_len, (int)(sizeof(buf) - 1));
 	memset(buf, 0, sizeof(buf));
-	memset(&ssid_bssid, 0, sizeof(mlan_ssid_bssid));
+	ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		LEAVE();
+		return -ENOMEM;
+	}
 	moal_memcpy_ext(handle, buf, respbuf + header_len, buflen, sizeof(buf));
 	priv->assoc_with_mac = MFALSE;
 
@@ -3916,7 +4334,7 @@
 			if (buf[i] == ':') {
 				mac_idx++;
 			} else {
-				ssid_bssid.bssid[mac_idx] =
+				ssid_bssid->bssid[mac_idx] =
 					(t_u8)woal_atox(buf + i);
 				while ((i < buflen) && isxdigit(buf[i + 1]))
 					/* Skip entire hex value */
@@ -3926,32 +4344,32 @@
 		/* Skip one space between the BSSID and start of the SSID */
 		i++;
 		PRINTM(MMSG, "Trying to associate AP BSSID = [" MACSTR "]\n",
-		       MAC2STR(ssid_bssid.bssid));
+		       MAC2STR(ssid_bssid->bssid));
 		priv->assoc_with_mac = MTRUE;
 	}
 
-	ssid_bssid.ssid.ssid_len = buflen - i;
+	ssid_bssid->ssid.ssid_len = buflen - i;
 	/* Check the size of the ssid_len */
-	if (ssid_bssid.ssid.ssid_len > MLAN_MAX_SSID_LENGTH + 1) {
-		PRINTM(MERROR, "ssid_bssid.ssid.ssid_len = %d\n",
-		       ssid_bssid.ssid.ssid_len);
+	if (ssid_bssid->ssid.ssid_len > MLAN_MAX_SSID_LENGTH + 1) {
+		PRINTM(MERROR, "ssid_bssid->ssid.ssid_len = %d\n",
+		       ssid_bssid->ssid.ssid_len);
 		ret = -E2BIG;
 		goto setessid_ret;
 	}
 
 	/* Copy the SSID */
-	moal_memcpy_ext(handle, ssid_bssid.ssid.ssid, buf + i,
-			ssid_bssid.ssid.ssid_len, MLAN_MAX_SSID_LENGTH);
+	moal_memcpy_ext(handle, ssid_bssid->ssid.ssid, buf + i,
+			ssid_bssid->ssid.ssid_len, MLAN_MAX_SSID_LENGTH);
 
-	if (!ssid_bssid.ssid.ssid_len ||
-	    (MFALSE == woal_ssid_valid(&ssid_bssid.ssid))) {
+	if (!ssid_bssid->ssid.ssid_len ||
+	    (MFALSE == woal_ssid_valid(&ssid_bssid->ssid))) {
 		PRINTM(MERROR, "Invalid SSID - aborting set_essid\n");
 		ret = -EINVAL;
 		goto setessid_ret;
 	}
 
 	PRINTM(MMSG, "Trying to associate AP SSID = %s\n",
-	       (char *)ssid_bssid.ssid.ssid);
+	       (char *)ssid_bssid->ssid.ssid);
 
 	/* Cancel re-association */
 	priv->reassoc_required = MFALSE;
@@ -3959,21 +4377,20 @@
 	if (MOAL_ACQ_SEMAPHORE_BLOCK(&handle->reassoc_sem)) {
 		PRINTM(MERROR, "Acquire semaphore error, woal_set_essid\n");
 		ret = -EBUSY;
-		LEAVE();
-		return ret;
+		goto setessid_ret;
 	}
 
 	if (priv->scan_type == MLAN_SCAN_TYPE_PASSIVE)
 		woal_set_scan_type(priv, MLAN_SCAN_TYPE_ACTIVE);
 
-	if (MTRUE == woal_is_connected(priv, &ssid_bssid)) {
+	if (MTRUE == woal_is_connected(priv, ssid_bssid)) {
 		PRINTM(MIOCTL, "Already connect to the network\n");
-		ret = sprintf(respbuf,
-			      "Has already connected to this ESSID!\n") +
+		ret = snprintf(respbuf, CMD_BUF_LEN,
+			       "Has already connected to this ESSID!\n") +
 		      1;
 		goto setessid_ret;
 	}
-	moal_memcpy_ext(handle, &priv->prev_ssid_bssid, &ssid_bssid,
+	moal_memcpy_ext(handle, &priv->prev_ssid_bssid, ssid_bssid,
 			sizeof(mlan_ssid_bssid), sizeof(mlan_ssid_bssid));
 	priv->auto_assoc_priv.drv_reconnect.status = MFALSE;
 	priv->auto_assoc_priv.auto_assoc_trigger_flag =
@@ -3988,9 +4405,10 @@
 	priv->reassoc_required = MTRUE;
 	priv->phandle->is_reassoc_timer_set = MTRUE;
 	woal_mod_timer(&priv->phandle->reassoc_timer, 0);
-	ret = sprintf(respbuf, "%s\n", buf) + 1;
+	ret = snprintf(respbuf, CMD_BUF_LEN, "%s\n", buf) + 1;
 
 setessid_ret:
+	kfree(ssid_bssid);
 	if (priv->scan_type == MLAN_SCAN_TYPE_PASSIVE)
 		woal_set_scan_type(priv, MLAN_SCAN_TYPE_PASSIVE);
 	MOAL_REL_SEMAPHORE(&handle->reassoc_sem);
@@ -4077,8 +4495,8 @@
 						  .fw_reconn_counter;
 				if (data[2] == 0) {
 					data[1] = 0;
-					sprintf(respbuf, "%d %d", data[0],
-						data[1]);
+					snprintf(respbuf, CMD_BUF_LEN, "%d %d",
+						 data[0], data[1]);
 					ret = strlen(respbuf) + 1;
 				} else {
 					data[1] = 1;
@@ -4086,9 +4504,10 @@
 							  .fw_reconn_interval;
 					data[4] = misc->param.fw_auto_reconnect
 							  .fw_reconn_flags;
-					sprintf(respbuf, "%d %d 0x%x 0x%x 0x%x",
-						data[0], data[1], data[2],
-						data[3], data[4]);
+					snprintf(respbuf, CMD_BUF_LEN,
+						 "%d %d 0x%x 0x%x 0x%x",
+						 data[0], data[1], data[2],
+						 data[3], data[4]);
 					ret = strlen(respbuf) + 1;
 				}
 				kfree(req);
@@ -4115,12 +4534,14 @@
 						priv->auto_assoc_priv.drv_assoc
 							.retry_interval;
 				}
-				sprintf(respbuf, "%d %d 0x%x 0x%x", data[0],
-					data[1], data[2], data[3]);
+				snprintf(respbuf, CMD_BUF_LEN,
+					 "%d %d 0x%x 0x%x", data[0], data[1],
+					 data[2], data[3]);
 				ret = strlen(respbuf) + 1;
 			} else {
 				data[1] = 0;
-				sprintf(respbuf, "%d %d", data[0], data[1]);
+				snprintf(respbuf, CMD_BUF_LEN, "%d %d", data[0],
+					 data[1]);
 				ret = strlen(respbuf) + 1;
 			}
 		}
@@ -4313,7 +4734,7 @@
 					data[3];
 			}
 		}
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -4363,7 +4784,7 @@
 			goto done;
 		} else {
 			data = pm_cfg->param.wakeup_reason.hs_wakeup_reason;
-			sprintf(respbuf, " %d", data);
+			snprintf(respbuf, CMD_BUF_LEN, " %d", data);
 			ret = strlen(respbuf) + 1;
 			kfree(req);
 		}
@@ -4444,10 +4865,11 @@
 		goto done;
 	}
 	if (req->action == MLAN_ACT_GET) {
-		sprintf(respbuf, "%d", pcfg_bss->param.listen_interval);
+		snprintf(respbuf, CMD_BUF_LEN, "%d",
+			 pcfg_bss->param.listen_interval);
 		ret = strlen(respbuf) + 1;
 	} else {
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -4532,6 +4954,8 @@
 	       (drvdbg & MCMD_D) ? "X" : "");
 	printk(KERN_ALERT "MDAT_D (%08x) %s\n", MDAT_D,
 	       (drvdbg & MDAT_D) ? "X" : "");
+	printk(KERN_ALERT "MREG   (%08x) %s\n", MREG,
+	       (drvdbg & MREG) ? "X" : "");
 	printk(KERN_ALERT "MREG_D (%08x) %s\n", MREG_D,
 	       (drvdbg & MREG_D) ? "X" : "");
 	printk(KERN_ALERT "MIOCTL (%08x) %s\n", MIOCTL,
@@ -4712,7 +5136,11 @@
 	if (user_data_len && (data[0] != (int)HOST_SLEEP_CFG_CANCEL ||
 			      invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (ret != MLAN_STATUS_SUCCESS) {
+			ret = -EFAULT;
+			goto done;
+		}
 		if (bss_info.is_hs_configured) {
 			PRINTM(MERROR, "HS already configured\n");
 			ret = -EFAULT;
@@ -4722,8 +5150,11 @@
 
 	/* Do a GET first if some arguments are not provided */
 	if (user_data_len >= 1 && user_data_len < 11) {
-		woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
-				       &hscfg_temp);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
+					   &hscfg_temp)) {
+			PRINTM(MERROR, "Unable to get HS params\n");
+		}
 	}
 	hscfg.conditions = hscfg_temp.conditions;
 	hscfg.gpio = hscfg_temp.gpio;
@@ -4883,7 +5314,7 @@
 		return -EINVAL;
 	}
 	if (user_data_len >= 1 && user_data_len <= 15) {
-		sprintf(respbuf, "%s%s%s", CMD_NXP, PRIV_CMD_HSCFG, buf);
+		snprintf(respbuf, 500, "%s%s%s", CMD_NXP, PRIV_CMD_HSCFG, buf);
 		ret = woal_priv_hscfg(priv, respbuf, sizeof(respbuf), MFALSE);
 	}
 	LEAVE();
@@ -4905,6 +5336,7 @@
 	int data[15] = {0};
 	int user_data_len = 0;
 	int ret = 0;
+	t_u8 *buf = NULL;
 
 	ENTER();
 
@@ -4927,11 +5359,22 @@
 	}
 
 	if (user_data_len >= 1 && user_data_len <= 15) {
-		sprintf(respbuf, "%s%s%s", CMD_NXP, PRIV_CMD_HSCFG,
-			respbuf +
-				(strlen(CMD_NXP) + strlen(PRIV_CMD_HSSETPARA)));
+		buf = kzalloc(CMD_BUF_LEN, GFP_ATOMIC);
+		if (!buf) {
+			PRINTM(MERROR, "Could not allocate buffer\n");
+			goto done;
+		}
+
+		memcpy(buf,
+		       respbuf + (strlen(CMD_NXP) + strlen(PRIV_CMD_HSSETPARA)),
+		       CMD_BUF_LEN -
+			       (strlen(CMD_NXP) + strlen(PRIV_CMD_HSSETPARA)));
+
+		snprintf(respbuf, CMD_BUF_LEN, "%s%s%s", CMD_NXP,
+			 PRIV_CMD_HSCFG, buf);
 		respbuflen = strlen(respbuf);
 		ret = woal_priv_hscfg(priv, respbuf, respbuflen, MFALSE);
+		kfree(buf);
 		goto done;
 	}
 done:
@@ -5040,7 +5483,10 @@
 				sizeof(data), sizeof(scan->param.scan_cfg));
 	} else
 		req->action = MLAN_ACT_GET;
-
+	if (scan->param.scan_cfg.scan_time.specific_scan_time &&
+	    req->action == MLAN_ACT_SET) {
+		priv->phandle->user_scan_cfg = MTRUE;
+	}
 	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
 		ret = -EFAULT;
@@ -5057,6 +5503,166 @@
 }
 
 /**
+ * @brief Set/Get auth_assoc timeout configuration parameters
+ *
+ * @param priv         A pointer to moal_private structure
+ * @param respbuf      A pointer to response buffer
+ * @param respbuflen   Available length of response buffer
+ *
+ * @return         0 --success, otherwise fail
+ */
+static int woal_priv_set_get_auth_assoc_timeout_cfg(moal_private *priv,
+						    t_u8 *respbuf,
+						    t_u32 respbuflen)
+{
+	int ret = 0;
+	int user_data_len = 0;
+	int data[6];
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	memset(data, 0, sizeof(data));
+	if (strlen(respbuf) ==
+	    (strlen(CMD_NXP) + strlen(PRIV_CMD_AUTH_ASSOC_TIMEOUT_CFG))) {
+		/* GET operation */
+		user_data_len = 0;
+	} else {
+		/* SET operation */
+		memset((char *)data, 0, sizeof(data));
+		parse_arguments(respbuf + strlen(CMD_NXP) +
+					strlen(PRIV_CMD_AUTH_ASSOC_TIMEOUT_CFG),
+				data, ARRAY_SIZE(data), &user_data_len);
+		if (sizeof(int) * user_data_len != sizeof(data)) {
+			PRINTM(MERROR,
+			       "auth_assoc_timeout_cfg: invalid numder of arguments provided\n");
+			LEAVE();
+			return -EINVAL;
+		}
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_AUTH_ASSOC_TIMEOUT_CONFIG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	if (user_data_len) {
+		// SET operation
+		if (data[0] < AUTH_TIMEOUT_MIN || data[0] > AUTH_TIMEOUT_MAX) {
+			PRINTM(MERROR,
+			       "Invalid auth_timeout configuration provided,"
+			       "	valid range: %d-%d",
+			       AUTH_TIMEOUT_MIN, AUTH_TIMEOUT_MAX);
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.auth_assoc_cfg.auth_timeout = (u16)data[0];
+
+		if (data[1] < AUTH_RETRY_TIMEOUT_ACK_MIN ||
+		    data[1] > AUTH_RETRY_TIMEOUT_ACK_MAX) {
+			PRINTM(MERROR,
+			       "Invalid auth_retry_timeout_if_ack configuration provided, "
+			       "valid range: %d-%d",
+			       AUTH_RETRY_TIMEOUT_ACK_MIN,
+			       AUTH_RETRY_TIMEOUT_ACK_MAX);
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.auth_assoc_cfg.auth_retry_timeout_if_ack =
+			(u16)data[1];
+
+		if (data[2] < AUTH_RETRY_TIMEOUT_NO_ACK_MIN ||
+		    data[2] > AUTH_RETRY_TIMEOUT_NO_ACK_MAX) {
+			PRINTM(MERROR,
+			       "Invalid auth_retry_timeout_if_no_ack configuration provided, "
+			       "valid range: %d-%d",
+			       AUTH_RETRY_TIMEOUT_NO_ACK_MIN,
+			       AUTH_RETRY_TIMEOUT_NO_ACK_MAX);
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.auth_assoc_cfg.auth_retry_timeout_if_no_ack =
+			(u16)data[2];
+
+		if (data[3] < ASSOC_TIMEOUT_MIN ||
+		    data[3] > ASSOC_TIMEOUT_MAX) {
+			PRINTM(MERROR,
+			       "Invalid assoc_timeout configuration provided, "
+			       "valid range: %d-%d",
+			       ASSOC_TIMEOUT_MIN, ASSOC_TIMEOUT_MAX);
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.auth_assoc_cfg.assoc_timeout = (u16)data[3];
+
+		if (data[4] < REASSOC_TIMEOUT_MIN ||
+		    data[4] > REASSOC_TIMEOUT_MAX) {
+			PRINTM(MERROR,
+			       "Invalid reassoc_timeout configuration provided, "
+			       "valid range: %d-%d",
+			       REASSOC_TIMEOUT_MIN, REASSOC_TIMEOUT_MAX);
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.auth_assoc_cfg.reassoc_timeout = (u16)data[4];
+
+		if (data[5] < ASSOC_RETRY_TIMEOUT_MIN ||
+		    data[5] > ASSOC_RETRY_TIMEOUT_MAX) {
+			PRINTM(MERROR,
+			       "Invalid retry_timeout configuration provided, "
+			       "valid range: %d-%d",
+			       ASSOC_RETRY_TIMEOUT_MIN,
+			       ASSOC_RETRY_TIMEOUT_MAX);
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.auth_assoc_cfg.retry_timeout = (u16)data[5];
+
+		req->action = MLAN_ACT_SET;
+	} else {
+		/* GET operation */
+		req->action = MLAN_ACT_GET;
+	}
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+	if (user_data_len) {
+		// For SET opearion store auth_timeout in driver as driver
+		// handles auth_timeout
+		priv->auth_tx_wait_time =
+			misc->param.auth_assoc_cfg.auth_timeout;
+	}
+
+	// get auth_timeout from driver
+	misc->param.auth_assoc_cfg.auth_timeout = priv->auth_tx_wait_time;
+	data[0] = misc->param.auth_assoc_cfg.auth_timeout;
+	data[1] = misc->param.auth_assoc_cfg.auth_retry_timeout_if_ack;
+	data[2] = misc->param.auth_assoc_cfg.auth_retry_timeout_if_no_ack;
+	data[3] = misc->param.auth_assoc_cfg.assoc_timeout;
+	data[4] = misc->param.auth_assoc_cfg.reassoc_timeout;
+	data[5] = misc->param.auth_assoc_cfg.retry_timeout;
+	moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data, sizeof(data),
+			respbuflen);
+	ret = sizeof(data);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+/**
  * @brief Get Netlink Number
  *
  * @param priv         A pointer to moal_private structure
@@ -5412,8 +6018,6 @@
 				if (cardp->rx_data_list[i].urb) {
 					usb_kill_urb(
 						cardp->rx_data_list[i].urb);
-					usb_init_urb(
-						cardp->rx_data_list[i].urb);
 				}
 			}
 		}
@@ -5458,7 +6062,7 @@
 	t_u8 *data_ptr;
 	const t_u8 bcast[MLAN_MAC_ADDR_LENGTH] = {255, 255, 255, 255, 255, 255};
 	const t_u8 zero_mac[MLAN_MAC_ADDR_LENGTH] = {0, 0, 0, 0, 0, 0};
-	mlan_ssid_bssid ssid_bssid;
+	mlan_ssid_bssid *ssid_bssid = NULL;
 	mlan_bss_info bss_info;
 	struct mwreq *mwr;
 	struct sockaddr *awrq;
@@ -5496,8 +6100,12 @@
 		goto done;
 	}
 
-	/* Broadcast MAC means search for best network */
-	memset(&ssid_bssid, 0, sizeof(mlan_ssid_bssid));
+	ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		ret = -ENOMEM;
+		goto done;
+	}
 
 	if (memcmp(bcast, awrq->sa_data, MLAN_MAC_ADDR_LENGTH)) {
 		/* Check if we are already assoicated to the AP */
@@ -5505,21 +6113,22 @@
 			if (!memcmp(awrq->sa_data, &bss_info.bssid, ETH_ALEN))
 				goto done;
 		}
-		moal_memcpy_ext(priv->phandle, &ssid_bssid.bssid, awrq->sa_data,
-				ETH_ALEN, sizeof(mlan_802_11_mac_addr));
+		moal_memcpy_ext(priv->phandle, &ssid_bssid->bssid,
+				awrq->sa_data, ETH_ALEN,
+				sizeof(mlan_802_11_mac_addr));
 	}
 
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_find_best_network(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_find_best_network(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 		PRINTM(MERROR,
 		       "ASSOC: WAP: MAC address not found in BSSID List\n");
 		ret = -ENETUNREACH;
 		goto done;
 	}
 	/* Zero SSID implies use BSSID to connect */
-	memset(&ssid_bssid.ssid, 0, sizeof(mlan_802_11_ssid));
+	memset(&ssid_bssid->ssid, 0, sizeof(mlan_802_11_ssid));
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_bss_start(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_bss_start(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 		ret = -EFAULT;
 		goto done;
 	}
@@ -5540,6 +6149,8 @@
 #endif /* REASSOCIATION */
 
 done:
+	if (ssid_bssid)
+		kfree(ssid_bssid);
 	LEAVE();
 	return ret;
 }
@@ -5585,9 +6196,6 @@
 	case MW_MODE_INFRA:
 		bss->param.bss_mode = MLAN_BSS_MODE_INFRA;
 		break;
-	case MW_MODE_ADHOC:
-		bss->param.bss_mode = MLAN_BSS_MODE_IBSS;
-		break;
 	case MW_MODE_AUTO:
 		bss->param.bss_mode = MLAN_BSS_MODE_AUTO;
 		break;
@@ -5661,7 +6269,7 @@
 			       t_u32 respbuflen)
 {
 	mlan_802_11_ssid req_ssid;
-	mlan_ssid_bssid ssid_bssid;
+	mlan_ssid_bssid *ssid_bssid = NULL;
 	moal_handle *handle = priv->phandle;
 #ifdef REASSOCIATION
 	mlan_bss_info bss_info;
@@ -5696,7 +6304,13 @@
 	if (priv->scan_type == MLAN_SCAN_TYPE_PASSIVE)
 		woal_set_scan_type(priv, MLAN_SCAN_TYPE_ACTIVE);
 	memset(&req_ssid, 0, sizeof(mlan_802_11_ssid));
-	memset(&ssid_bssid, 0, sizeof(mlan_ssid_bssid));
+
+	ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		ret = -ENOMEM;
+		goto setessid_ret;
+	}
 
 	req_ssid.ssid_len = mwr->u.essid.length;
 
@@ -5730,10 +6344,10 @@
 
 		PRINTM(MINFO, "Requested new SSID = %s\n",
 		       (char *)req_ssid.ssid);
-		moal_memcpy_ext(handle, &ssid_bssid.ssid, &req_ssid,
+		moal_memcpy_ext(handle, &ssid_bssid->ssid, &req_ssid,
 				sizeof(mlan_802_11_ssid),
 				sizeof(mlan_802_11_ssid));
-		if (MTRUE == woal_is_connected(priv, &ssid_bssid)) {
+		if (MTRUE == woal_is_connected(priv, ssid_bssid)) {
 			PRINTM(MIOCTL, "Already connect to the network\n");
 			goto setessid_ret;
 		}
@@ -5764,15 +6378,14 @@
 					       0);
 				ret = MLAN_STATUS_SUCCESS;
 
-				LEAVE();
-				return ret;
+				goto setessid_ret;
 			}
 		}
 #endif
 
 		if (mwr->u.essid.flags != 0xFFFF) {
 			if (MLAN_STATUS_SUCCESS !=
-			    woal_find_essid(priv, &ssid_bssid,
+			    woal_find_essid(priv, ssid_bssid,
 					    MOAL_IOCTL_WAIT)) {
 				/* Do specific SSID scanning */
 				if (MLAN_STATUS_SUCCESS !=
@@ -5789,24 +6402,23 @@
 
 	if (mode != MW_MODE_ADHOC) {
 		if (MLAN_STATUS_SUCCESS !=
-		    woal_find_best_network(priv, MOAL_IOCTL_WAIT,
-					   &ssid_bssid)) {
+		    woal_find_best_network(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 			ret = -EFAULT;
 			goto setessid_ret;
 		}
 	}
 #ifdef UAP_SUPPORT
 	else if (MLAN_STATUS_SUCCESS !=
-		 woal_find_best_network(priv, MOAL_IOCTL_WAIT, &ssid_bssid))
+		 woal_find_best_network(priv, MOAL_IOCTL_WAIT, ssid_bssid))
 		/* Adhoc start, Check the channel command */
 		woal_11h_channel_check_ioctl(priv, MOAL_IOCTL_WAIT);
 #endif
 
 	/* Connect to BSS by ESSID */
-	memset(&ssid_bssid.bssid, 0, MLAN_MAC_ADDR_LENGTH);
+	memset(&ssid_bssid->bssid, 0, MLAN_MAC_ADDR_LENGTH);
 
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_bss_start(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_bss_start(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 		ret = -EFAULT;
 		goto setessid_ret;
 	}
@@ -5825,6 +6437,8 @@
 #endif /* REASSOCIATION */
 
 setessid_ret:
+	if (ssid_bssid)
+		kfree(ssid_bssid);
 	if (priv->scan_type == MLAN_SCAN_TYPE_PASSIVE)
 		woal_set_scan_type(priv, MLAN_SCAN_TYPE_PASSIVE);
 #ifdef REASSOCIATION
@@ -5965,7 +6579,11 @@
 	if (bss_info.media_connected == MTRUE) {
 		moal_memcpy_ext(priv->phandle, mwr->u.ap_addr.sa_data,
 				&bss_info.bssid, MLAN_MAC_ADDR_LENGTH,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				sizeof(mwr->u.ap_addr.sa_data_min));
+#else
 				sizeof(mwr->u.ap_addr.sa_data));
+#endif
 	} else {
 		memset(mwr->u.ap_addr.sa_data, 0, MLAN_MAC_ADDR_LENGTH);
 	}
@@ -6144,7 +6762,9 @@
 
 	memset(data, 0, sizeof(data));
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (ret != MLAN_STATUS_SUCCESS)
+		return -EFAULT;
 
 	if (strlen(respbuf) ==
 	    (strlen(CMD_NXP) + strlen(PRIV_CMD_TXPOWERCFG))) {
@@ -6712,7 +7332,8 @@
 		ret = -ENOMEM;
 		goto done;
 	}
-	strcpy(arguments, respbuf + header_len);
+	strncpy(arguments, respbuf + header_len,
+		strlen(respbuf) * sizeof(char));
 	space_ind = strstr((char *)arguments, " ");
 	if (space_ind)
 		space_ind = strstr(space_ind + 1, " ");
@@ -6720,7 +7341,12 @@
 		if (*(char *)(space_ind + 1) == '-') {
 			is_negative_val = MTRUE;
 			arguments[space_ind + 1 - arguments] = '\0';
-			strcat(arguments, space_ind + 2);
+			if (strlen(respbuf) > 1) {
+				strncat(arguments, space_ind + 2,
+					(strlen(respbuf) * sizeof(char)) - 1);
+			} else {
+				PRINTM(MERROR, "strlen(respbuf) is invalid\n");
+			}
 		}
 	}
 	parse_arguments(arguments, data, ARRAY_SIZE(data), &user_data_len);
@@ -6965,20 +7591,16 @@
 
 	if (!rw) {
 #ifdef SDIO_MMC
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (func)
 			data = sdio_readb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				reg, &ret);
 		else
 			data = sdio_f0_readb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				reg, &ret);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (ret) {
 			PRINTM(MERROR,
 			       "sdio_readb: reading register 0x%X failed\n",
@@ -6997,20 +7619,16 @@
 #endif /* SDIO_MMC */
 	} else {
 #ifdef SDIO_MMC
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (func)
 			sdio_writeb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				data, reg, &ret);
 		else
 			sdio_f0_writeb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				data, reg, &ret);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (ret) {
 			PRINTM(MERROR,
 			       "sdio_writeb: writing register 0x%X failed\n",
@@ -7403,7 +8021,20 @@
 }
 
 /**
- *  @brief              Get TX/RX histogram statistic
+ *  @brief             	check if 6GHz sub band supported
+ *
+ *  @param priv         A pointer to moal_private structure
+ *
+ *  @return             if supported return 1; otherwise 0
+ */
+static t_u8 woal_is_6g_sub_band_allowed(moal_private *priv)
+{
+	t_u8 ret = MFALSE;
+	return ret;
+}
+
+/**
+ *  @brief              Get Tx power limit table from the FW
  *
  *  @param priv         A pointer to moal_private structure
  *  @param respbuf      A pointer to response buffer
@@ -7427,11 +8058,23 @@
 	trpc_cfg = (mlan_ds_misc_chan_trpc_cfg *)(respbuf + header_len);
 	if ((trpc_cfg->sub_band != 0) && (trpc_cfg->sub_band != 0x10) &&
 	    (trpc_cfg->sub_band != 0x11) && (trpc_cfg->sub_band != 0x12) &&
-	    (trpc_cfg->sub_band != 0x13)) {
+	    (trpc_cfg->sub_band != 0x13) && (trpc_cfg->sub_band != 0x20) &&
+	    (trpc_cfg->sub_band != 0x21) && (trpc_cfg->sub_band != 0x22) &&
+	    (trpc_cfg->sub_band != 0x23) && (trpc_cfg->sub_band != 0x24) &&
+	    (trpc_cfg->sub_band != 0x25) && (trpc_cfg->sub_band != 0x26) &&
+	    (trpc_cfg->sub_band != 0x27) &&
+	    (IS_CARDAW693(priv->phandle->card_type) &&
+	     (trpc_cfg->sub_band != 0x80))) {
 		PRINTM(MERROR, "Invalid subband=0x%x\n", trpc_cfg->sub_band);
 		ret = -EINVAL;
 		goto done;
 	}
+	if (trpc_cfg->sub_band >= 0x20 && trpc_cfg->sub_band <= 0x27) {
+		if (!woal_is_6g_sub_band_allowed(priv)) {
+			ret = -EINVAL;
+			goto done;
+		}
+	}
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (req == NULL) {
 		ret = -ENOMEM;
@@ -7479,6 +8122,7 @@
 	wlan_ieee80211_chan_list *plist = NULL;
 	struct ieee80211_supported_band *sband;
 	struct wiphy *wiphy = NULL;
+	t_u8 band;
 	int i;
 
 	ENTER();
@@ -7490,36 +8134,25 @@
 		goto done;
 	}
 	plist = (wlan_ieee80211_chan_list *)respbuf;
-	sband = wiphy->bands[NL80211_BAND_2GHZ];
-	if (sband) {
-		num_chan += sband->n_channels;
-		for (i = 0; i < sband->n_channels; i++) {
-			plist->chan_list[i].center_freq =
-				sband->channels[i].center_freq;
-			plist->chan_list[i].hw_value =
-				sband->channels[i].hw_value;
-			plist->chan_list[i].flags = sband->channels[i].flags;
-			plist->chan_list[i].max_power =
-				sband->channels[i].max_power;
-		}
-	}
-	sband = wiphy->bands[NL80211_BAND_5GHZ];
-	if (sband) {
-		for (i = 0; i < sband->n_channels; i++) {
-			plist->chan_list[i + num_chan].center_freq =
-				sband->channels[i].center_freq;
-			plist->chan_list[i + num_chan].hw_value =
-				sband->channels[i].hw_value;
-			plist->chan_list[i + num_chan].flags =
-				sband->channels[i].flags;
-			plist->chan_list[i + num_chan].max_power =
-				sband->channels[i].max_power;
+	for (band = NL80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; ++band) {
+		sband = wiphy->bands[band];
+		if (sband) {
+			for (i = 0; i < sband->n_channels; i++) {
+				plist->chan_list[i + num_chan].center_freq =
+					sband->channels[i].center_freq;
+				plist->chan_list[i + num_chan].hw_value =
+					sband->channels[i].hw_value;
+				plist->chan_list[i + num_chan].flags =
+					sband->channels[i].flags;
+				plist->chan_list[i + num_chan].max_power =
+					sband->channels[i].max_power;
 #if CFG80211_VERSION_CODE > KERNEL_VERSION(3, 8, 13)
-			plist->chan_list[i + num_chan].dfs_state =
-				sband->channels[i].dfs_state;
+				plist->chan_list[i + num_chan].dfs_state =
+					sband->channels[i].dfs_state;
 #endif
+			}
+			num_chan += sband->n_channels;
 		}
-		num_chan += sband->n_channels;
 	}
 	plist->num_chan = num_chan;
 	ret = sizeof(wlan_ieee80211_chan_list) +
@@ -7890,35 +8523,29 @@
 
 	memset(&delts_ioctl, 0x00, sizeof(delts_ioctl));
 
-	if ((int)strlen(respbuf) > header_len) {
-		copy_len = MIN(strlen(data_ptr), sizeof(delts_ioctl));
-		moal_memcpy_ext(priv->phandle, (t_u8 *)&delts_ioctl, data_ptr,
-				copy_len, sizeof(delts_ioctl));
+	moal_memcpy_ext(priv->phandle, (t_u8 *)&delts_ioctl, data_ptr,
+			sizeof(delts_ioctl), sizeof(delts_ioctl));
+	cfg->param.delts.status_code = (t_u32)delts_ioctl.ieee_reason_code;
+	cfg->param.delts.ie_data_len = (t_u8)delts_ioctl.ie_data_len;
 
-		cfg->param.delts.status_code =
-			(t_u32)delts_ioctl.ieee_reason_code;
-		cfg->param.delts.ie_data_len = (t_u8)delts_ioctl.ie_data_len;
+	moal_memcpy_ext(priv->phandle, cfg->param.delts.ie_data,
+			delts_ioctl.ie_data, cfg->param.delts.ie_data_len,
+			MLAN_WMM_TSPEC_SIZE);
 
-		moal_memcpy_ext(priv->phandle, cfg->param.delts.ie_data,
-				delts_ioctl.ie_data,
-				cfg->param.delts.ie_data_len,
-				MLAN_WMM_TSPEC_SIZE);
-
-		status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
-		if (status != MLAN_STATUS_SUCCESS) {
-			ret = -EFAULT;
-			goto done;
-		}
-
-		/* Return the firmware command result back to the application
-		 * layer */
-		delts_ioctl.cmd_result = cfg->param.delts.result;
-		copy_len = sizeof(delts_ioctl);
-		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)&delts_ioctl,
-				copy_len, respbuflen);
-		ret = copy_len;
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
 	}
 
+	/* Return the firmware command result back to the application
+	 * layer */
+	delts_ioctl.cmd_result = cfg->param.delts.result;
+	copy_len = sizeof(delts_ioctl);
+	moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)&delts_ioctl, copy_len,
+			respbuflen);
+	ret = copy_len;
+
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(req);
@@ -8207,7 +8834,9 @@
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
 		memset(&bss_info, 0, sizeof(bss_info));
 
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (ret != MLAN_STATUS_SUCCESS)
+			return -EFAULT;
 
 		if (bss_info.media_connected == MTRUE) {
 			moal_memcpy_ext(priv->phandle, respbuf,
@@ -8479,7 +9108,7 @@
 		drcs_cfg = (mlan_ds_drcs_cfg *)&cfg->param.drcs_cfg[0];
 		drcs_cfg->chantime = (t_u8)data[0];
 		drcs_cfg->switchtime = (t_u8)data[1];
-		drcs_cfg->undozetime = (t_u8)data[2];
+		drcs_cfg->rx_wait_time = (t_u8)data[2];
 		drcs_cfg->mode = (t_u8)data[3];
 		/* Set the same parameters for two channels*/
 		if (user_data_len < (int)ARRAY_SIZE(data))
@@ -8491,7 +9120,7 @@
 			drcs_cfg->chan_idx = 0x2;
 			drcs_cfg->chantime = (t_u8)data[4];
 			drcs_cfg->switchtime = (t_u8)data[5];
-			drcs_cfg->undozetime = (t_u8)data[6];
+			drcs_cfg->rx_wait_time = (t_u8)data[6];
 			drcs_cfg->mode = (t_u8)data[7];
 		}
 	}
@@ -8607,12 +9236,14 @@
 	if (header_len == (int)strlen(respbuf)) {
 		/* Query current remain on channel status */
 		if (priv->phandle->remain_on_channel)
-			ret = sprintf(respbuf,
+			ret = snprintf(
+				      respbuf, CMD_BUF_LEN,
 				      "There is pending remain on channel from bss %d\n",
 				      priv->phandle->remain_bss_index) +
 			      1;
 		else
-			ret = sprintf(respbuf,
+			ret = snprintf(
+				      respbuf, CMD_BUF_LEN,
 				      "There is no pending remain on channel\n") +
 			      1;
 		goto done;
@@ -8685,7 +9316,8 @@
 
 	if (data[0] == 0) {
 		if (!priv->phandle->remain_on_channel) {
-			ret = sprintf(respbuf,
+			ret = snprintf(
+				      respbuf, CMD_BUF_LEN,
 				      "There is no pending remain on channel to be canceled\n") +
 			      1;
 			goto done;
@@ -8727,7 +9359,7 @@
 	if (status != MLAN_STATUS_SUCCESS)
 		ret = -EFAULT;
 	else
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 
 done:
 	LEAVE();
@@ -8949,7 +9581,9 @@
 		goto done;
 	} else {
 		/* Get radio status */
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (ret != MLAN_STATUS_SUCCESS)
+			return -EFAULT;
 		moal_memcpy_ext(priv->phandle, respbuf, &bss_info.radio_on,
 				sizeof(bss_info.radio_on), respbuflen);
 		ret = sizeof(bss_info.radio_on);
@@ -9339,6 +9973,19 @@
 				respbuflen);
 		ret = sizeof(data);
 	} else {
+#ifdef STA_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME)) {
+			if (priv->host_mlme) {
+				PRINTM(MERROR,
+				       "Don't support reassoctrl in host_mlme mode\n");
+				ret = -EFAULT;
+				LEAVE();
+				return ret;
+			}
+		}
+#endif
+#endif
 		/* SET operation */
 		parse_arguments(respbuf + header_len, &data, 1, &user_data_len);
 		if (user_data_len == 1) {
@@ -10484,7 +11131,7 @@
 static int woal_priv_inactivity_timeout_ext(moal_private *priv, t_u8 *respbuf,
 					    t_u32 respbuflen)
 {
-	int data[4];
+	int data[5];
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_pm_cfg *pmcfg = NULL;
 	pmlan_ds_inactivity_to inac_to = NULL;
@@ -10505,7 +11152,8 @@
 				&user_data_len);
 	}
 
-	if (user_data_len != 0 && user_data_len != 3 && user_data_len != 4) {
+	if (user_data_len != 0 && user_data_len != 3 && user_data_len != 4 &&
+	    user_data_len != 5) {
 		PRINTM(MERROR, "Invalid number of parameters\n");
 		ret = -EINVAL;
 		goto done;
@@ -10534,6 +11182,8 @@
 		inac_to->mcast_timeout = data[2];
 		if (user_data_len == 4)
 			inac_to->ps_entry_timeout = data[3];
+		if (user_data_len == 5)
+			inac_to->ps_cmd_timeout = data[4];
 		req->action = MLAN_ACT_SET;
 
 		status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
@@ -10546,6 +11196,7 @@
 		data[1] = inac_to->unicast_timeout;
 		data[2] = inac_to->mcast_timeout;
 		data[3] = inac_to->ps_entry_timeout;
+		data[4] = inac_to->ps_cmd_timeout;
 
 		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data,
 				sizeof(data), respbuflen);
@@ -10753,6 +11404,49 @@
 	LEAVE();
 	return ret;
 }
+
+/**
+ * @brief               Turn on/off the sdio clock
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ * @return              Number of bytes written, negative for failure.
+ */
+static int woal_priv_sdio_buswidth_ioctl(moal_private *priv, t_u8 *respbuf,
+					 t_u32 respbuflen)
+{
+	int ret = 0;
+	int data = 0;
+	int user_data_len = 0, header_len = 0;
+
+	ENTER();
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SDIO_BUSWIDTH);
+	if ((int)strlen(respbuf) == header_len) {
+		PRINTM(MERROR, "Don't support get operation\n");
+		ret = -EINVAL;
+		goto done;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, &data, 1, &user_data_len);
+
+		if (user_data_len != 1) {
+			PRINTM(MERROR, "Invalid number of parameters\n");
+			ret = -EINVAL;
+			goto done;
+		}
+	}
+	if ((data != SDIO_BUS_WIDTH_1) && (data != SDIO_BUS_WIDTH_4)) {
+		ret = -EINVAL;
+		goto done;
+	}
+	ret = woal_sdio_set_buswidth(priv->phandle, data);
+done:
+	LEAVE();
+	return ret;
+}
 #endif
 
 #ifdef SDIO
@@ -11059,7 +11753,10 @@
 				if (!data[1] ||
 				    data[1] & ~(MLAN_NETMON_DATA |
 						MLAN_NETMON_MANAGEMENT |
-						MLAN_NETMON_CONTROL)) {
+						MLAN_NETMON_CONTROL |
+						MLAN_NETMON_NOPROM |
+						MLAN_NETMON_NON_BSS_BCN |
+						MLAN_NETMON_TX)) {
 					PRINTM(MERROR,
 					       "NET_MON: Invalid filter flag\n");
 					ret = -EINVAL;
@@ -11179,6 +11876,8 @@
 	data[0] = net_mon->enable_net_mon;
 	data[1] = net_mon->filter_flag;
 	data[2] = net_mon->band;
+	if (handle->mon_if)
+		data[2] = handle->mon_if->band_chan_cfg.band;
 	data[3] = net_mon->channel;
 	data[4] = net_mon->chan_bandwidth;
 	data_length = 5;
@@ -11639,222 +12338,98 @@
 }
 
 #ifdef UAP_SUPPORT
+
 /**
- *  @brief determine the center frquency center index for bandwidth
- *         of 80 MHz and 160 MHz
+ *  @brief determine the center frequency center index for bandwidth
+ *         of 40/80/160 MHz
  *
- ** @param priv          Pointer to moal_private structure
+ ** @param priv         Pointer to moal_private structure
  *  @param band         band
  *  @param pri_chan     primary channel
  *  @param chan_bw      channel bandwidth
  *
  *  @return             channel center frequency center, if found; O, otherwise
  */
-
 static t_u8 woal_get_center_freq_idx(moal_private *priv, t_u16 band,
 				     t_u32 pri_chan, t_u8 chan_bw)
 {
-	t_u8 center_freq_idx = 0;
+	struct center_freq_desc {
+		t_u8 pri_chan;
+		t_u8 ch_40;
+		t_u8 ch_80;
+		t_u8 ch_160;
+	};
 
-	if (band & BAND_AAC) {
-		switch (pri_chan) {
-		case 36:
-		case 40:
+	static const struct center_freq_desc center_freq_idx_map_5g[] = {
+		{.pri_chan = 36, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 40, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 44, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 48, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 52, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 56, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 60, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 64, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 68, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 72, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 76, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 80, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 84, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 88, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 92, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 96, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 100, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 104, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 108, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 112, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 116, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 120, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 124, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 128, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 132, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 136, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 140, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 144, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 149, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 153, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 157, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 161, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 165, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 169, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 173, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 177, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 184, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 188, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 192, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 196, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 0,
+		 .ch_40 = 42 /* terminator with default cfreq */}};
+
+	const struct center_freq_desc *map = NULL;
+
+	if (band == BAND_5GHZ)
+		map = center_freq_idx_map_5g;
+
+	for (; map != NULL; map++) {
+		/* reached end of map, return default value for that map */
+		if (map->pri_chan == 0)
+			return map->ch_40;
+
+		if (map->pri_chan == pri_chan) {
 			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 38;
-				break;
-			}
-			/* fall through */
-		case 44:
-		case 48:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 46;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 42;
-				break;
-			}
-			/* fall through */
-		case 52:
-		case 56:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 54;
-				break;
-			}
-			/* fall through */
-		case 60:
-		case 64:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 62;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 58;
-				break;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 50;
-				break;
-			}
-			/* fall through */
-		case 68:
-		case 72:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 70;
-				break;
-			}
-			/* fall through */
-		case 76:
-		case 80:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 78;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 74;
-				break;
-			}
-			/* fall through */
-		case 84:
-		case 88:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 86;
-				break;
-			}
-			/* fall through */
-		case 92:
-		case 96:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 94;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 90;
-				break;
-			}
-			/* fall through */
-		case 100:
-		case 104:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 102;
-				break;
-			}
-			/* fall through */
-		case 108:
-		case 112:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 110;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 106;
-				break;
-			}
-			/* fall through */
-		case 116:
-		case 120:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 118;
-				break;
-			}
-			/* fall through */
-		case 124:
-		case 128:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 126;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 122;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 114;
-			}
-			break;
-		case 132:
-		case 136:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 134;
-				break;
-			}
-			/* fall through */
-		case 140:
-		case 144:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 126;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 138;
-			}
-			break;
-		case 149:
-		case 153:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 151;
-				break;
-			}
-			/* fall through */
-		case 157:
-		case 161:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 159;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 155;
-				break;
-			}
-			/* fall through */
-		case 165:
-		case 169:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 167;
-				break;
-			}
-			/* fall through */
-		case 173:
-		case 177:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 175;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 171;
-				break;
-			}
-			/* fall through */
-		case 184:
-		case 188:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 186;
-				break;
-			}
-			/* fall through */
-		case 192:
-		case 196:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 194;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 190;
-				break;
-			}
-			/* fall through */
-		default: /* error. go to the default */
-			center_freq_idx = 42;
+			    chan_bw == CHANNEL_BW_40MHZ_BELOW)
+				return map->ch_40;
+
+			if (chan_bw == CHANNEL_BW_80MHZ)
+				return map->ch_80;
+
+			if (chan_bw == CHANNEL_BW_160MHZ)
+				return map->ch_160;
 		}
 	}
-	return center_freq_idx;
+
+	return 0;
 }
+
 #endif
 
 #if defined(UAP_SUPPORT)
@@ -11866,6 +12441,7 @@
  *  @param oper_class    oper_class
  *  @param channel       channel
  *  @param switch count  how many csa/ecsa beacon will send out
+ *  @param band          see BAND_5GHZ/BAND_6GHZ enum
  *  @param band_width    1-40Mhz above, 3-40Mhz below, 4-80Mhz, 5-160Mhz
  *  @param ecsa          MTRUE/MFALSE;
  *
@@ -11873,7 +12449,7 @@
  */
 static int woal_channel_switch(moal_private *priv, t_u8 block_tx,
 			       t_u8 oper_class, t_u8 channel, t_u8 switch_count,
-			       t_u8 band_width, t_u8 ecsa)
+			       t_u8 band, t_u8 band_width, t_u8 ecsa)
 {
 	IEEEtypes_ExtChanSwitchAnn_t *ext_chan_switch = NULL;
 	IEEEtypes_ChanSwitchAnn_t *chan_switch = NULL;
@@ -11905,18 +12481,25 @@
 
 	pcust_chansw_ie = (custom_ie *)&misc->param.cust_ie.ie_data_list[0];
 	pcust_chansw_ie->ie_index = 0xffff; /*Auto index */
-	pcust_chansw_ie->ie_length = sizeof(IEEEtypes_ChanSwitchAnn_t);
+	pcust_chansw_ie->ie_length = 0;
 	pcust_chansw_ie->mgmt_subtype_mask =
 		MGMT_MASK_BEACON | MGMT_MASK_PROBE_RESP; /*Add IE for
 							    BEACON/probe resp*/
-	chan_switch = (IEEEtypes_ChanSwitchAnn_t *)pcust_chansw_ie->ie_buffer;
-	chan_switch->element_id = CHANNEL_SWITCH_ANN;
-	chan_switch->len = 3;
-	chan_switch->chan_switch_mode = block_tx;
-	chan_switch->new_channel_num = channel;
-	chan_switch->chan_switch_count = switch_count;
-	DBG_HEXDUMP(MCMD_D, "CSA IE", (t_u8 *)pcust_chansw_ie->ie_buffer,
-		    pcust_chansw_ie->ie_length);
+	pcust_chansw_ie->mgmt_subtype_mask |= MLAN_CUSTOM_IE_NEW_MASK;
+
+	if (band == BAND_2GHZ || band == BAND_5GHZ) {
+		pcust_chansw_ie->ie_length = sizeof(IEEEtypes_ChanSwitchAnn_t);
+		chan_switch =
+			(IEEEtypes_ChanSwitchAnn_t *)pcust_chansw_ie->ie_buffer;
+		chan_switch->element_id = CHANNEL_SWITCH_ANN;
+		chan_switch->len = 3;
+		chan_switch->chan_switch_mode = block_tx;
+		chan_switch->new_channel_num = channel;
+		chan_switch->chan_switch_count = switch_count;
+		DBG_HEXDUMP(MCMD_D, "CSA IE",
+			    (t_u8 *)pcust_chansw_ie->ie_buffer,
+			    pcust_chansw_ie->ie_length);
+	}
 	switch (band_width) {
 	case CHANNEL_BW_40MHZ_ABOVE:
 	case CHANNEL_BW_40MHZ_BELOW:
@@ -11936,27 +12519,23 @@
 		woal_priv_get_nonglobal_operclass_by_bw_channel(
 			priv, bw, channel, &new_oper_class);
 	if (new_oper_class) {
-		pcust_chansw_ie->ie_length +=
-			sizeof(IEEEtypes_ExtChanSwitchAnn_t);
-		ext_chan_switch =
-			(IEEEtypes_ExtChanSwitchAnn_t
-				 *)(pcust_chansw_ie->ie_buffer +
-				    sizeof(IEEEtypes_ChanSwitchAnn_t));
+		ext_chan_switch = (IEEEtypes_ExtChanSwitchAnn_t
+					   *)(pcust_chansw_ie->ie_buffer +
+					      pcust_chansw_ie->ie_length);
 		ext_chan_switch->element_id = EXTEND_CHANNEL_SWITCH_ANN;
 		ext_chan_switch->len = 4;
 		ext_chan_switch->chan_switch_mode = block_tx;
 		ext_chan_switch->new_oper_class = new_oper_class;
 		ext_chan_switch->new_channel_num = channel;
 		ext_chan_switch->chan_switch_count = switch_count;
-		DBG_HEXDUMP(MCMD_D, "ECSA IE",
-			    (t_u8 *)(pcust_chansw_ie->ie_buffer +
-				     sizeof(IEEEtypes_ChanSwitchAnn_t)),
-			    pcust_chansw_ie->ie_length -
-				    sizeof(IEEEtypes_ChanSwitchAnn_t));
+		pcust_chansw_ie->ie_length +=
+			sizeof(IEEEtypes_ExtChanSwitchAnn_t);
+		DBG_HEXDUMP(MCMD_D, "ECSA IE", (t_u8 *)ext_chan_switch,
+			    sizeof(IEEEtypes_ExtChanSwitchAnn_t));
 	}
 	/* bandwidth 40/80/160 should set channel switch wrapper ie for 11ac 5G
 	 * channel*/
-	if (band_width && channel > 14) {
+	if (band_width && (band == BAND_5GHZ)) {
 		pChanSwWrap_ie =
 			(IEEEtypes_Header_t *)(pcust_chansw_ie->ie_buffer +
 					       pcust_chansw_ie->ie_length);
@@ -11971,8 +12550,8 @@
 			sizeof(IEEEtypes_WideBWChanSwitch_t) -
 			sizeof(IEEEtypes_Header_t);
 
-		center_freq_idx = woal_get_center_freq_idx(priv, BAND_AAC,
-							   channel, band_width);
+		center_freq_idx = woal_get_center_freq_idx(priv, band, channel,
+							   band_width);
 		if (band_width == CHANNEL_BW_40MHZ_ABOVE ||
 		    band_width == CHANNEL_BW_40MHZ_BELOW) {
 			pbwchansw_ie->new_channel_width = 0;
@@ -11981,9 +12560,7 @@
 		} else if (band_width == CHANNEL_BW_80MHZ) {
 			pbwchansw_ie->new_channel_width = 1;
 			pbwchansw_ie->new_channel_center_freq0 =
-				center_freq_idx - 4;
-			pbwchansw_ie->new_channel_center_freq1 =
-				center_freq_idx + 4;
+				center_freq_idx;
 		} else if (band_width == CHANNEL_BW_160MHZ) {
 			pbwchansw_ie->new_channel_width = 2;
 			pbwchansw_ie->new_channel_center_freq0 =
@@ -12034,9 +12611,11 @@
 
 	priv->phandle->chsw_wait_q_woken = MFALSE;
 	/* wait for channel switch to complete  */
-	wait_event_interruptible_timeout(
-		priv->phandle->chsw_wait_q, priv->phandle->chsw_wait_q_woken,
-		(u32)HZ * (switch_count + 2) * 110 / 1000);
+	if (!wait_event_interruptible_timeout(priv->phandle->chsw_wait_q,
+					      priv->phandle->chsw_wait_q_woken,
+					      (u32)HZ * (switch_count + 2) *
+						      110 / 1000))
+		PRINTM(MMSG, "chsw_wait_q failed to wakeup\n");
 
 	pcust_chansw_ie->ie_index = 0xffff; /*Auto index */
 	pcust_chansw_ie->mgmt_subtype_mask = 0;
@@ -12121,8 +12700,10 @@
 		sband = wiphy->bands[NL80211_BAND_5GHZ];
 		if (sband) {
 			for (i = 0; i < sband->n_channels; i++) {
-				if (sband->channels[i].flags &
-				    IEEE80211_CHAN_RADAR) {
+				if ((sband->channels[i].flags &
+				     IEEE80211_CHAN_RADAR) &&
+				    (priv->auto_dfs_cfg.num_of_chan <
+				     MAX_DFS_CHAN_LIST)) {
 					priv->auto_dfs_cfg.dfs_chan_list
 						[priv->auto_dfs_cfg.num_of_chan] =
 						sband->channels[i].hw_value;
@@ -12378,6 +12959,7 @@
 {
 	moal_private *pmpriv = NULL;
 	chan_band_info chaninfo;
+	t_u8 band = BAND_2GHZ;
 	moal_handle *ref_handle;
 	t_u8 band_width = CHANNEL_BW_20MHZ;
 
@@ -12412,9 +12994,11 @@
 				band_width = CHANNEL_BW_20MHZ;
 				break;
 			}
+			if (channel > MAX_BG_CHANNEL)
+				band = BAND_5GHZ;
 #define DEF_SWITCH_COUNT 10
 			woal_channel_switch(pmpriv, MTRUE, 0, channel,
-					    DEF_SWITCH_COUNT, band_width,
+					    DEF_SWITCH_COUNT, band, band_width,
 					    MTRUE);
 		}
 	}
@@ -12550,12 +13134,24 @@
 #ifdef UAP_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 				if (!data[0] && priv->chan_rpt_req.chanNum) {
-					woal_update_channels_dfs_state(
-						priv,
-						priv->chan_rpt_req.chanNum,
-						priv->chan_rpt_req.bandcfg
-							.chanWidth,
-						DFS_USABLE);
+					memset(&ch_dfs_state, 0,
+					       sizeof(ch_dfs_state));
+					ch_dfs_state.channel =
+						priv->chan_rpt_req.chanNum;
+					if (!woal_11h_chan_dfs_state(
+						    priv, MLAN_ACT_GET,
+						    &ch_dfs_state)) {
+						if (ch_dfs_state.dfs_state ==
+						    DFS_AVAILABLE)
+							woal_update_channels_dfs_state(
+								priv,
+								priv->chan_rpt_req
+									.chanNum,
+								priv->chan_rpt_req
+									.bandcfg
+									.chanWidth,
+								DFS_USABLE);
+					}
 				}
 #endif
 #endif
@@ -13014,6 +13610,12 @@
 		else
 			priv->enable_mc_aggr = MFALSE;
 	}
+	if (mc_cfg->mask_bitmap & UC_NONAGGR_CTRL) {
+		if (mc_cfg->enable_bitmap & UC_NONAGGR_CTRL)
+			priv->enable_uc_nonaggr = MTRUE;
+		else
+			priv->enable_uc_nonaggr = MFALSE;
+	}
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(ioctl_req);
@@ -13063,8 +13665,8 @@
 	ioctl_req->action = stats->action;
 
 	moal_memcpy_ext(priv->phandle, &misc->param.stats, stats,
-			sizeof(mlan_ds_stats) + stats->tlv_len - 1,
-			sizeof(mlan_ds_stats) + stats->tlv_len - 1);
+			sizeof(mlan_ds_stats) + stats->tlv_len,
+			sizeof(mlan_ds_stats) + stats->tlv_len);
 
 	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
@@ -13184,7 +13786,6 @@
 	misc->param.ch_load.noise = cl_cfg->noise;
 	misc->param.ch_load.rx_quality = cl_cfg->rx_quality;
 	misc->param.ch_load.duration = cl_cfg->duration;
-	misc->param.ch_load.cca_th = cl_cfg->cca_th;
 	status = woal_request_ioctl(priv, ioctl_req, MOAL_NO_WAIT);
 	if (status != MLAN_STATUS_SUCCESS && status != MLAN_STATUS_PENDING) {
 		ret = -EFAULT;
@@ -13247,29 +13848,50 @@
 		}
 		if (priv->phandle->feature_control & FEATURE_CTRL_STREAM_2X2) {
 			radio->param.ant_cfg.tx_antenna = data[0];
-			radio->param.ant_cfg.rx_antenna = data[0];
+			if (data[0] == RF_ANTENNA_AUTO) {
+				radio->param.ant_cfg.rx_antenna = 0;
+				if (data[1] > 0xffff) {
+					ret = -EINVAL;
+					goto done;
+				}
+			} else {
+				radio->param.ant_cfg.rx_antenna = data[0];
+			}
 			if (user_data_len == 2)
 				radio->param.ant_cfg.rx_antenna = data[1];
-#if defined(STA_CFG80211) || defined(UAP_CFG80211)
-			if (IS_CARD9098(priv->phandle->card_type) ||
-			    IS_CARD9097(priv->phandle->card_type)) {
-				woal_cfg80211_notify_antcfg(
-					priv, priv->phandle->wiphy, radio);
-			}
-#endif
 		} else {
 			radio->param.ant_cfg_1x1.antenna = data[0];
-			if (user_data_len == 2)
+			if (user_data_len == 2) {
+				if (data[1] > 0xffff) {
+					ret = -EINVAL;
+					goto done;
+				}
 				radio->param.ant_cfg_1x1.evaluate_time =
 					data[1];
+			}
 		}
 		req->action = MLAN_ACT_SET;
 	}
 	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to set new antenna config\n");
 		ret = -EFAULT;
 		goto done;
 	}
+
+	/* Notify the CFG80211 layer only on SUCCESS from FW */
+	if ((status == MLAN_STATUS_SUCCESS) && (req->action == MLAN_ACT_SET)) {
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		if (IS_CARD9098(priv->phandle->card_type) ||
+		    IS_CARD9097(priv->phandle->card_type) ||
+		    IS_CARDIW624(priv->phandle->card_type) ||
+		    IS_CARDAW693(priv->phandle->card_type)) {
+			woal_cfg80211_notify_antcfg(priv, priv->phandle->wiphy,
+						    radio);
+		}
+#endif
+	}
+
 	if (!user_data_len) {
 		if (priv->phandle->feature_control & FEATURE_CTRL_STREAM_2X2) {
 			data[0] = radio->param.ant_cfg.tx_antenna;
@@ -13296,79 +13918,6 @@
 	return ret;
 }
 
-/*
- * @brief               Set/Get CWMode
- *
- * @param priv          Pointer to moal_private structure
- * @param respbuf       Pointer to response buffer
- * @param resplen       Response buffer length
- *
- *  @return             Number of bytes written, negative for failure.
- */
-static int woal_priv_set_get_cwmode(moal_private *priv, t_u8 *respbuf,
-				    t_u32 respbuflen)
-{
-	mlan_ioctl_req *ioctl_req = NULL;
-	mlan_ds_misc_cfg *misc = NULL;
-	mlan_status status = MLAN_STATUS_SUCCESS;
-	mlan_ds_cw_mode_ctrl *cwmode;
-	int ret = 0;
-	int header_len = 0;
-
-	ENTER();
-
-	if (!priv || !priv->phandle) {
-		PRINTM(MERROR, "priv or handle is null\n");
-		ret = -EFAULT;
-		goto done;
-	}
-
-	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
-	if (ioctl_req == NULL) {
-		ret = -ENOMEM;
-		goto done;
-	}
-
-	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
-	misc->sub_command = MLAN_OID_MISC_CWMODE_CTRL;
-	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
-
-	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_CWMODE);
-	if ((int)strlen(respbuf) == header_len) {
-		/* GET operation */
-		ioctl_req->action = MLAN_ACT_GET;
-	} else {
-		/* SET operation */
-		ioctl_req->action = MLAN_ACT_SET;
-
-		cwmode = (mlan_ds_cw_mode_ctrl *)(respbuf + header_len +
-						  sizeof(t_u8));
-		misc->param.cwmode.mode = cwmode->mode;
-		misc->param.cwmode.txPower = cwmode->txPower;
-		misc->param.cwmode.rateInfo = cwmode->rateInfo;
-		misc->param.cwmode.channel = cwmode->channel;
-		misc->param.cwmode.chanInfo = cwmode->chanInfo;
-		misc->param.cwmode.pktLength = cwmode->pktLength;
-	}
-
-	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
-	if (status != MLAN_STATUS_SUCCESS) {
-		ret = -EFAULT;
-		goto done;
-	}
-
-	moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)&misc->param.cwmode,
-			sizeof(misc->param.cwmode), respbuflen);
-	ret = sizeof(misc->param.cwmode);
-
-done:
-	if (status != MLAN_STATUS_PENDING)
-		kfree(ioctl_req);
-
-	LEAVE();
-	return ret;
-}
-
 /**
  * @brief               Set/Get out band independent reset
  *
@@ -13636,11 +14185,11 @@
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "PTK: ");
+		snprintf((char *)tmp, CMD_BUF_LEN, "\n%s", "PTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, CMD_BUF_LEN, "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get Multicase Key */
@@ -13657,11 +14206,11 @@
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "GTK: ");
+		snprintf((char *)tmp, CMD_BUF_LEN, "\n%s", "GTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, CMD_BUF_LEN, "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get IGTK Key */
@@ -13678,11 +14227,11 @@
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "IGTK: ");
+		snprintf((char *)tmp, CMD_BUF_LEN, "\n%s", "IGTK: ");
 		tmp += 6;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, CMD_BUF_LEN, "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	copy_len = tmp - key_ascii;
@@ -13710,7 +14259,7 @@
 {
 	int ret = 0, copy_len = 0;
 	int header_len = 0;
-	mlan_ssid_bssid ssid_bssid;
+	mlan_ssid_bssid *ssid_bssid = NULL;
 #ifdef REASSOCIATION
 	mlan_bss_info bss_info;
 #endif
@@ -13731,7 +14280,12 @@
 	mac_idx = 0;
 	buflen = MIN(copy_len, (int)(sizeof(buf) - 1));
 	memset(buf, 0, sizeof(buf));
-	memset(&ssid_bssid, 0, sizeof(ssid_bssid));
+	ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		ret = -ENOMEM;
+		goto done;
+	}
 
 	if (buflen < (3 * ETH_ALEN) + 2) {
 		PRINTM(MERROR,
@@ -13756,7 +14310,7 @@
 		if (buf[i] == ':') {
 			mac_idx++;
 		} else {
-			ssid_bssid.bssid[mac_idx] = (t_u8)woal_atox(buf + i);
+			ssid_bssid->bssid[mac_idx] = (t_u8)woal_atox(buf + i);
 
 			while (((i < buflen) && isxdigit(buf[i + 1])))
 				/* Skip entire hex value */
@@ -13768,17 +14322,17 @@
 	i++;
 
 	/* Copy the SSID */
-	ssid_bssid.ssid.ssid_len = buflen - i;
-	moal_memcpy_ext(priv->phandle, ssid_bssid.ssid.ssid, buf + i,
-			sizeof(ssid_bssid.ssid.ssid),
-			sizeof(ssid_bssid.ssid.ssid));
+	ssid_bssid->ssid.ssid_len = buflen - i;
+	moal_memcpy_ext(priv->phandle, ssid_bssid->ssid.ssid, buf + i,
+			sizeof(ssid_bssid->ssid.ssid),
+			sizeof(ssid_bssid->ssid.ssid));
 
 	PRINTM(MCMND, "iwpriv assoc: AP=[" MACSTR "], ssid(%d)=[%s]\n",
-	       MAC2STR(ssid_bssid.bssid), (int)ssid_bssid.ssid.ssid_len,
-	       ssid_bssid.ssid.ssid);
+	       MAC2STR(ssid_bssid->bssid), (int)ssid_bssid->ssid.ssid_len,
+	       ssid_bssid->ssid.ssid);
 
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_bss_start(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_bss_start(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 		ret = -EFAULT;
 		goto done;
 	}
@@ -13797,6 +14351,8 @@
 #endif /* REASSOCIATION */
 
 done:
+	if (ssid_bssid)
+		kfree(ssid_bssid);
 	LEAVE();
 	return ret;
 }
@@ -13901,7 +14457,7 @@
 						*token = '\0';
 						str = token + 1;
 					}
-					woal_atoi(&tmp_val, pos);
+					(void)woal_atoi(&tmp_val, pos);
 					switch (i) {
 					case BF_ENABLE_PARAM:
 						bf_global->bf_enbl =
@@ -13992,11 +14548,11 @@
 				bf_cfg.action = BF_CFG_ACT_GET;
 			} else {
 				woal_mac2u8(tx_bf_peer->peer_mac, &buf[2]);
-				woal_atoi(&tmp_val, &buf[20]);
+				(void)woal_atoi(&tmp_val, &buf[20]);
 				tx_bf_peer->bf_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[22]);
+				(void)woal_atoi(&tmp_val, &buf[22]);
 				tx_bf_peer->sounding_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[24]);
+				(void)woal_atoi(&tmp_val, &buf[24]);
 				tx_bf_peer->fb_type = (t_u8)tmp_val;
 				action = MLAN_ACT_SET;
 				bf_cfg.action = BF_CFG_ACT_SET;
@@ -14145,18 +14701,15 @@
 	       reg, mode, blklen, blknum);
 
 	if (!rw) {
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
-		if (sdio_readsb(
-			    ((struct sdio_mmc_card *)priv->phandle->card)->func,
-			    respbuf, reg, total_len)) {
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
+		if (sdio_readsb(((sdio_mmc_card *)priv->phandle->card)->func,
+				respbuf, reg, total_len)) {
 			PRINTM(MERROR,
 			       "sdio_readsb: reading memory 0x%x failed\n",
 			       reg);
 			goto done;
 		}
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		ret = total_len;
 	} else {
 		int pos = 0;
@@ -14167,16 +14720,13 @@
 		/* Copy/duplicate the pattern to data buffer */
 		for (pos = 0; pos < (int)total_len; pos++)
 			data[pos] = buf[11 + (pos % pattern_len)];
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
-		if (sdio_writesb(
-			    ((struct sdio_mmc_card *)priv->phandle->card)->func,
-			    reg, data, total_len))
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
+		if (sdio_writesb(((sdio_mmc_card *)priv->phandle->card)->func,
+				 reg, data, total_len))
 			PRINTM(MERROR,
 			       "sdio_writesb: writing memory 0x%x failed\n",
 			       reg);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 	}
 
 done:
@@ -14308,6 +14858,90 @@
 }
 
 /**
+ * @brief               Set/Get module configuration
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_fw_wakeup_method(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
+{
+	int header_len = 0, user_data_len = 0;
+	int ret = 0, data[2];
+	mlan_ds_pm_cfg *pm_cfg = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_pm_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+	pm_cfg = (mlan_ds_pm_cfg *)req->pbuf;
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_FW_WAKEUP_METHOD);
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		user_data_len = 0;
+		req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, data,
+				sizeof(data) / sizeof(int), &user_data_len);
+		if (user_data_len > 2) {
+			PRINTM(MERROR, "Invalid parameter number\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (data[0] != FW_WAKEUP_METHOD_INTERFACE &&
+		    data[0] != FW_WAKEUP_METHOD_GPIO) {
+			PRINTM(MERROR, "Invalid FW wake up method:%d\n",
+			       data[0]);
+			ret = -EINVAL;
+			goto done;
+		}
+		if (data[0] == FW_WAKEUP_METHOD_GPIO) {
+			if (user_data_len == 1) {
+				PRINTM(MERROR,
+				       "Please provide gpio pin number for FW_WAKEUP_METHOD gpio\n");
+				ret = -EINVAL;
+				goto done;
+			}
+			pm_cfg->param.fw_wakeup_params.gpio_pin = data[1];
+		}
+
+		req->action = MLAN_ACT_SET;
+		pm_cfg->param.fw_wakeup_params.method = data[0];
+	}
+
+	pm_cfg->sub_command = MLAN_OID_PM_CFG_FW_WAKEUP_METHOD;
+	req->req_id = MLAN_IOCTL_PM_CFG;
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	data[0] = ((mlan_ds_pm_cfg *)req->pbuf)->param.fw_wakeup_params.method;
+	data[1] =
+		((mlan_ds_pm_cfg *)req->pbuf)->param.fw_wakeup_params.gpio_pin;
+	moal_memcpy_ext(priv->phandle, respbuf, &data, sizeof(data),
+			respbuflen);
+	ret = sizeof(int) * 2;
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
  * @brief               Set Robustcoex gpiocfg
  * @param priv          Pointer to moal_private structure
  * @param respbuf       Pointer to response buffer
@@ -14334,7 +14968,7 @@
 	robust_coex_cfg = (mlan_ds_misc_cfg *)req->pbuf;
 	while (respbuf[0] == ' ') {
 		/** skip space */
-		respbuf++;
+		respbuf = (t_u8 *)(respbuf + 1);
 	}
 
 	if (strncmp(respbuf, "gpiocfg", strlen("gpiocfg")) == 0) {
@@ -14468,6 +15102,92 @@
 }
 
 /**
+ * @brief               Set and get gpio pin Configurations
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_gpiocfg(moal_private *priv, t_u8 *respbuf,
+			     t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_ds_gpio_cfg_ops *gpio_cfg = NULL;
+	int ret = 0;
+	int data[3] = {0};
+	int user_data_len = 0, header_len = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_GPIO_CFG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_GPIOCFG);
+
+	if ((int)strlen(respbuf) == header_len) {
+		ret = -EINVAL;
+		goto done;
+	}
+	/* SET operation */
+	memset((t_u8 *)data, 0, sizeof(data));
+
+	parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+			&user_data_len);
+
+	if (user_data_len == 1) {
+		PRINTM(MINFO, "GPIO_CFG: GET\n");
+		req->action = MLAN_ACT_GET;
+	} else if (user_data_len >= 2) {
+		PRINTM(MINFO, "GPIO_CFG: SET\n");
+		req->action = MLAN_ACT_SET;
+	} else {
+		ret = -EINVAL;
+		goto done;
+	}
+
+	gpio_cfg = (mlan_ds_gpio_cfg_ops *)&misc->param.gpio_cfg_ops;
+	if (gpio_cfg) {
+		gpio_cfg->pin_num = (t_u8)data[0];
+		if (user_data_len >= 2)
+			gpio_cfg->opsType = (t_u8)data[1];
+		if (user_data_len == 3)
+			gpio_cfg->value = (t_u8)data[2];
+	} else {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+	gpio_cfg = (mlan_ds_gpio_cfg_ops *)&misc->param.gpio_cfg_ops;
+	if (req->action == MLAN_ACT_GET) {
+		moal_memcpy_ext(priv->phandle, respbuf, gpio_cfg,
+				sizeof(*gpio_cfg), respbuflen);
+		ret = sizeof(*gpio_cfg);
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
  * @brief               Set and get boot sleep configure
  * @param priv          Pointer to moal_private structure
  * @param respbuf       Pointer to response buffer
@@ -14763,10 +15483,17 @@
 
 	cfg->param.csi_params.csi_enable = data_ptr->csi_enable;
 	if (data_ptr->csi_enable == 1) {
-		cfg->param.csi_params.head_id = data_ptr->head_id;
-		cfg->param.csi_params.tail_id = data_ptr->tail_id;
+		cfg->param.csi_params.head_id =
+			woal_cpu_to_le32(data_ptr->head_id);
+		cfg->param.csi_params.tail_id =
+			woal_cpu_to_le32(data_ptr->tail_id);
 		cfg->param.csi_params.csi_filter_cnt = data_ptr->csi_filter_cnt;
 		cfg->param.csi_params.chip_id = data_ptr->chip_id;
+		cfg->param.csi_params.band_config = data_ptr->band_config;
+		cfg->param.csi_params.channel = data_ptr->channel;
+		cfg->param.csi_params.csi_monitor_enable =
+			data_ptr->csi_monitor_enable;
+		cfg->param.csi_params.ra4us = data_ptr->ra4us;
 		if (cfg->param.csi_params.csi_filter_cnt > CSI_FILTER_MAX)
 			cfg->param.csi_params.csi_filter_cnt = CSI_FILTER_MAX;
 		moal_memcpy_ext(priv->phandle, cfg->param.csi_params.csi_filter,
@@ -14949,6 +15676,228 @@
 	return ret;
 }
 
+/**
+* @brief               Configure TWT Report parameters
+
+ *@param priv          Pointer to the mlan_private driver data struct
+ *@param respbuf       A pointer to response buffer
+ *@param len           Length used
+ *@param respbuflen    Available length of response buffer
+
+ *@return              Number of bytes written if successful else negative value
+*/
+static int woal_priv_twt_report(moal_private *priv, t_u8 *respbuf, t_u8 len,
+				t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_twtcfg *cfg = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_twtcfg));
+	if (req == NULL) {
+		PRINTM(MERROR, "Failed to allocate ioctl_req!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	req->req_id = MLAN_IOCTL_11AX_CFG;
+	req->action = MLAN_ACT_GET;
+	cfg = (mlan_ds_twtcfg *)req->pbuf;
+	cfg->sub_command = MLAN_OID_11AX_TWT_CFG;
+	cfg->sub_id = MLAN_11AX_TWT_REPORT_SUBID;
+
+	if (len) {
+		moal_memcpy_ext(priv->phandle, (t_u8 *)&cfg->param.twt_report,
+				respbuf, len, sizeof(mlan_ds_twt_report));
+	}
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "woal_request_ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ret = sizeof(mlan_ds_twt_report);
+done:
+	if (status != MLAN_STATUS_PENDING) {
+		kfree(req);
+	}
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Configure TWT Information parameters
+ *
+ * @param priv          Pointer to the mlan_private driver data struct
+ * @param respbuf       A pointer to response buffer
+ * @param len           Length used
+ * @param respbuflen    Available length of response buffer
+ *
+ * @return              Number of bytes written if successful else negative
+ * value
+ */
+static int woal_priv_twt_information(moal_private *priv, t_u8 *respbuf,
+				     t_u8 len, t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_twtcfg *cfg = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_twtcfg));
+	if (req == NULL) {
+		PRINTM(MERROR, "Failed to allocate ioctl_req!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	req->req_id = MLAN_IOCTL_11AX_CFG;
+	req->action = MLAN_ACT_SET;
+	cfg = (mlan_ds_twtcfg *)req->pbuf;
+	cfg->sub_command = MLAN_OID_11AX_TWT_CFG;
+	cfg->sub_id = MLAN_11AX_TWT_INFORMATION_SUBID;
+
+	if (len) {
+		moal_memcpy_ext(priv->phandle,
+				(t_u8 *)&cfg->param.twt_information, respbuf,
+				len, sizeof(mlan_ds_twt_information));
+	}
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "woal_request_ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ret = sizeof(mlan_ds_twt_information);
+done:
+	if (status != MLAN_STATUS_PENDING) {
+		kfree(req);
+	}
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Configure BTWT AP config
+ *
+ * @param priv          Pointer to the mlan_private driver data struct
+ * @param respbuf       A pointer to response buffer
+ * @param len           Length used
+ * @param respbuflen    Available length of response buffer
+ *
+ * @return              Number of bytes written if successful else negative
+ * value
+ */
+static int woal_priv_btwt_ap_config_set(moal_private *priv, t_u8 *respbuf,
+					t_u8 len, t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_twtcfg *cfg = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_twtcfg));
+	if (req == NULL) {
+		PRINTM(MERROR, "Failed to allocate ioctl_req!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	req->req_id = MLAN_IOCTL_11AX_CFG;
+	req->action = MLAN_ACT_SET;
+	cfg = (mlan_ds_twtcfg *)req->pbuf;
+	cfg->sub_command = MLAN_OID_11AX_TWT_CFG;
+	cfg->sub_id = MLAN_11AX_BTWT_AP_CONFIG_SUBID;
+
+	if (len) {
+		moal_memcpy_ext(priv->phandle,
+				(t_u8 *)&cfg->param.btwt_ap_config, respbuf,
+				len, sizeof(mlan_ds_btwt_ap_config));
+	}
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "woal_request_ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ret = sizeof(mlan_ds_btwt_ap_config);
+done:
+	if (status != MLAN_STATUS_PENDING) {
+		kfree(req);
+	}
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Configure BTWT AP config
+ *
+ * @param priv          Pointer to the mlan_private driver data struct
+ * @param respbuf       A pointer to response buffer
+ * @param len           Length used
+ * @param respbuflen    Available length of response buffer
+ *
+ * @return              Number of bytes written if successful else negative
+ * value
+ */
+static int woal_priv_btwt_ap_config_get(moal_private *priv, t_u8 *respbuf,
+					t_u8 len, t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_twtcfg *cfg = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_twtcfg));
+	if (req == NULL) {
+		PRINTM(MERROR, "Failed to allocate ioctl_req!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	req->req_id = MLAN_IOCTL_11AX_CFG;
+	req->action = MLAN_ACT_GET;
+	cfg = (mlan_ds_twtcfg *)req->pbuf;
+	cfg->sub_command = MLAN_OID_11AX_TWT_CFG;
+	cfg->sub_id = MLAN_11AX_BTWT_AP_CONFIG_SUBID;
+
+	if (len) {
+		moal_memcpy_ext(priv->phandle,
+				(t_u8 *)&cfg->param.btwt_ap_config, respbuf,
+				len, sizeof(mlan_ds_btwt_ap_config));
+	}
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "woal_request_ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ret = sizeof(mlan_ds_btwt_ap_config);
+done:
+	if (status != MLAN_STATUS_PENDING) {
+		kfree(req);
+	}
+	LEAVE();
+	return ret;
+}
+
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(UAP_CFG80211)
 /**
@@ -15306,6 +16255,261 @@
 	return ret;
 }
 
+/**
+ * @brief               Set/Get TSP config parameters
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ * @return              Number of bytes written, negative for failure.
+ */
+static int woal_priv_tsp_config(moal_private *priv, t_u8 *respbuf,
+				t_u32 respbuflen)
+{
+	mlan_ds_tsp_cfg *tsp_cfg = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc_cfg = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	int data[8] = {0};
+	int header_len = 0;
+	int user_data_len = 0;
+	int ret = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_TSP_CFG);
+
+	memset(data, 0, sizeof(data));
+	parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+			&user_data_len);
+
+	if (user_data_len > 8) {
+		PRINTM(MERROR, "invalid parameters\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	misc_cfg = (mlan_ds_misc_cfg *)req->pbuf;
+	misc_cfg->sub_command = MLAN_OID_MISC_TSP_CFG;
+	tsp_cfg = &misc_cfg->param.tsp_cfg;
+	memset(tsp_cfg, 0, sizeof(mlan_ds_tsp_cfg));
+
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		req->action = MLAN_ACT_GET;
+		user_data_len = 0;
+	} else {
+		req->action = MLAN_ACT_SET;
+		if (data[0] == 0) {
+			tsp_cfg->enable = (t_u16)data[0];
+		} else if (data[0] < 0 || data[0] > 1) {
+			PRINTM(MERROR, "err: Invalid TSP enable value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[1] < 0 || data[1] > 10) {
+			PRINTM(MERROR,
+			       "err: Invalid TSP power backoff value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[2] < 0 || data[2] > 300) {
+			PRINTM(MERROR,
+			       "err: Invalid TSP high power threshold value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[3] < 0 || data[3] > 300) {
+			PRINTM(MERROR,
+			       "err: Invalid TSP low power threshold value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[3] > data[2]) {
+			PRINTM(MERROR,
+			       "err: TSP low_thrshld value is greater than high_thrshld\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[4] < 1 || data[4] > 100) {
+			PRINTM(MERROR, "err: Invalid Duty Cycle Step value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[5] < 0 || data[5] > 100) {
+			PRINTM(MERROR, "err: Invalid Duty Cycle Min value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[6] < -100 || data[6] > 150) {
+			PRINTM(MERROR,
+			       "err: Invalid High Threshold Temperature value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[7] < -100 || data[7] > 150) {
+			PRINTM(MERROR,
+			       "err: Invalid Low Threshold Temperature value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[7] > data[6]) {
+			PRINTM(MERROR,
+			       "err: TSP Low Threshold Temperature is greater than High Threshold Temperature value\n");
+			ret = -EINVAL;
+			goto done;
+		} else {
+			tsp_cfg->enable = (t_u16)data[0];
+			tsp_cfg->backoff = (t_s32)data[1];
+			tsp_cfg->high_thrshld = (t_s32)data[2];
+			tsp_cfg->low_thrshld = (t_s32)data[3];
+			tsp_cfg->duty_cyc_step = (t_s32)data[4];
+			tsp_cfg->duty_cyc_min = (t_s32)data[5];
+			tsp_cfg->high_thrshld_temp = (t_s32)data[6];
+			tsp_cfg->low_thrshld_temp = (t_s32)data[7];
+		}
+	}
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!user_data_len) {
+		/* Copy back to userspace call */
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)tsp_cfg,
+				sizeof(mlan_ds_tsp_cfg), respbuflen);
+		ret = sizeof(mlan_ds_tsp_cfg);
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Set/Get cross chip sync config parameters
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_cross_chip_synch(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
+{
+	mlan_ds_cross_chip_synch *cross_chip_sync = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc_cfg = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	int data[5] = {0};
+	int header_len = 0;
+	int user_data_len = 0;
+	int ret = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_CROSS_CHIP_SYNCH);
+
+	memset(data, 0, sizeof(data));
+	parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+			&user_data_len);
+
+	if (user_data_len > 5) {
+		PRINTM(MERROR, "invalid parameters\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	misc_cfg = (mlan_ds_misc_cfg *)req->pbuf;
+	misc_cfg->sub_command = MLAN_OID_MISC_CROSS_CHIP_SYNCH;
+	cross_chip_sync = &misc_cfg->param.cross_chip_synch;
+	memset(cross_chip_sync, 0, sizeof(mlan_ds_cross_chip_synch));
+
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		req->action = MLAN_ACT_GET;
+		user_data_len = 0;
+	} else {
+		req->action = MLAN_ACT_SET;
+
+		if (data[0] < 0 || data[0] > 1) {
+			PRINTM(MERROR, "Invalid start_stop value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[1] < 1 || data[1] > 2) {
+			PRINTM(MERROR, "Invalid role value\n");
+			ret = -EINVAL;
+			goto done;
+		} else {
+			cross_chip_sync->start_stop = (t_u8)data[0];
+			cross_chip_sync->role = (t_u8)data[1];
+			cross_chip_sync->period = (t_u32)data[2];
+			cross_chip_sync->init_tsf_low = (t_u32)data[3];
+			cross_chip_sync->init_tsf_high = (t_u32)data[4];
+		}
+	}
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!user_data_len) {
+		/* Copy back to userspace call */
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)cross_chip_sync,
+				sizeof(mlan_ds_cross_chip_synch), respbuflen);
+		ret = sizeof(mlan_ds_cross_chip_synch);
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
 #ifdef UAP_SUPPORT
 /**
  * @brief               Set/Get target channel
@@ -16170,8 +17374,8 @@
 		goto done;
 	}
 
-	ret = sprintf(respbuf, "off channel %d\n",
-		      misc->param.tdls_cs_channel) +
+	ret = snprintf(respbuf, CMD_BUF_LEN, "off channel %d\n",
+		       misc->param.tdls_cs_channel) +
 	      1;
 
 	PRINTM(MIOCTL, "tdls CS channel %d\n", misc->param.tdls_cs_channel);
@@ -16336,16 +17540,18 @@
  * @param priv          Pointer to moal_private structure
  * @param channel       channel
  * @param oper_class    oper_class
-
+ * @param bandwidth     band width
+ *
  *  @return             SUCCESS/FAIL
  */
 static int woal_check_valid_channel_operclass(moal_private *priv, int channel,
-					      int oper_class)
+					      int oper_class, t_u8 bandwidth)
 {
 	int ret = 0;
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
+	t_u8 bw;
 
 	ENTER();
 
@@ -16354,6 +17560,18 @@
 		ret = -ENOMEM;
 		goto done;
 	}
+	switch (bandwidth) {
+	case CHANNEL_BW_40MHZ_ABOVE:
+	case CHANNEL_BW_40MHZ_BELOW:
+		bw = CHAN_BW_40MHZ;
+		break;
+	case CHANNEL_BW_80MHZ:
+		bw = CHAN_BW_80MHZ;
+		break;
+	default:
+		bw = CHAN_BW_20MHZ;
+		break;
+	}
 
 	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_OPER_CLASS_CHECK;
@@ -16361,6 +17579,7 @@
 	ioctl_req->action = MLAN_ACT_GET;
 	misc->param.bw_chan_oper.oper_class = (t_u8)oper_class;
 	misc->param.bw_chan_oper.channel = (t_u8)channel;
+	misc->param.bw_chan_oper.bandwidth = (t_u8)bw;
 
 	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
@@ -16429,7 +17648,8 @@
  */
 static int woal_action_channel_switch(moal_private *priv, t_u8 block_tx,
 				      t_u8 oper_class, t_u8 channel,
-				      t_u8 switch_count, t_u8 wait_option)
+				      t_u8 switch_count, t_u8 mode,
+				      t_u8 wait_option)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_bss *bss = NULL;
@@ -16447,13 +17667,16 @@
 	bss->sub_command = MLAN_OID_ACTION_CHAN_SWITCH;
 	req->req_id = MLAN_IOCTL_BSS;
 	req->action = MLAN_ACT_SET;
+	bss->param.chanswitch.mode = mode;
 	bss->param.chanswitch.chan_switch_mode = block_tx;
 	bss->param.chanswitch.new_channel_num = channel;
 	if (!switch_count)
 		bss->param.chanswitch.chan_switch_count = DEF_NUM_PKTS;
-	else
+	else if (!mode) /* bcast action frame */
 		bss->param.chanswitch.chan_switch_count =
 			MIN(switch_count, MAX_NUM_PKTS);
+	else /* ucast action frame */
+		bss->param.chanswitch.chan_switch_count = switch_count;
 	bss->param.chanswitch.new_oper_class = oper_class;
 	ret = woal_request_ioctl(priv, req, wait_option);
 done:
@@ -16490,7 +17713,9 @@
 		       __func__);
 	if (ch_dfs.dfs_required)
 		woal_enable_dfs(priv, next_chan, MOAL_NO_WAIT);
-	woal_action_channel_switch(priv, MTRUE, 0, next_chan, 0, MOAL_NO_WAIT);
+	woal_action_channel_switch(priv, MTRUE, 0, next_chan,
+				   priv->chan_num_pkts, priv->chan_mode,
+				   MOAL_NO_WAIT);
 	return;
 }
 #endif
@@ -16509,9 +17734,11 @@
 {
 	int ret = 0;
 	int user_data_len = 0;
-	int data[5] = {0};
+	int data[6] = {0};
+	t_u8 band = BAND_2GHZ;
 	t_u8 channel;
 	mlan_ds_11h_chan_dfs_state ch_dfs;
+
 	ENTER();
 
 	if (!priv || !priv->phandle || (priv->bss_role != MLAN_BSS_ROLE_UAP) ||
@@ -16540,10 +17767,20 @@
 		LEAVE();
 		return ret;
 	}
-
-	/* For 2.4G channels skip the DFS checks */
 	channel = data[2];
-	if (channel > MAX_BG_CHANNEL) {
+	if (data[1]) {
+		if (woal_check_valid_channel_operclass(priv, data[2], data[1],
+						       data[4])) {
+			PRINTM(MERROR, "Wrong channel switch parameters!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+	}
+
+	if (channel > MAX_BG_CHANNEL)
+		band = BAND_5GHZ;
+	/* For 2.4G/6G channels skip the DFS checks */
+	if (band == BAND_5GHZ) {
 		memset(&ch_dfs, 0, sizeof(ch_dfs));
 		ch_dfs.channel = data[2];
 
@@ -16566,23 +17803,114 @@
 			return ret;
 		}
 
-		if (ch_dfs.dfs_required)
+		if (ch_dfs.dfs_required) {
+#ifdef UAP_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+			woal_update_channels_dfs_state(priv, channel, data[4],
+						       DFS_AVAILABLE);
+#endif
+#endif
 			woal_enable_dfs(priv, data[2], MOAL_IOCTL_WAIT);
+		}
 	}
-	if (data[1]) {
-		if (woal_check_valid_channel_operclass(priv, data[2],
-						       data[1])) {
-			PRINTM(MERROR, "Wrong channel switch parameters!\n");
+	if (data[5] && (data[5] < 0 || data[5] > 3)) {
+		PRINTM(MERROR,
+		       "Wrong channel switch parameters for ucast action frame!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (!data[3]) {
+		if (!data[5] && (data[4] < 0 || data[4] > MAX_NUM_PKTS)) {
+			PRINTM(MERROR,
+			       "Bcast action frame count exceeds maximum %d!\n",
+			       MAX_NUM_PKTS);
 			ret = -EINVAL;
 			goto done;
 		}
+		priv->chan_mode = data[5] & DEFAULT_CHAN_MODE_MASK;
+		priv->chan_num_pkts = data[4];
 	}
+
 	if (data[3])
 		woal_channel_switch(priv, data[0], data[1], data[2], data[3],
-				    data[4], MFALSE);
+				    band, data[4], MFALSE);
 	else
 		woal_action_channel_switch(priv, data[0], data[1], data[2],
-					   data[4], MOAL_IOCTL_WAIT);
+					   data[4], data[5], MOAL_IOCTL_WAIT);
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Set the new CSA parameter for target channel and backup
+ * channel
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ * @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_set_channel_switch_param(moal_private *priv, t_u8 *respbuf,
+					      t_u32 respbuflen)
+{
+	int ret = 0;
+	int user_data_len = 0;
+	int data[2] = {0};
+
+	ENTER();
+
+	if (!priv || !priv->phandle || (priv->bss_role != MLAN_BSS_ROLE_UAP)) {
+		PRINTM(MERROR,
+		       "priv or handle is null or interface is not AP/GO\n");
+		ret = -EFAULT;
+		LEAVE();
+		return ret;
+	}
+
+	if (strlen(respbuf) ==
+	    (strlen(CMD_NXP) + strlen(PRIV_CMD_SET_CHAN_SWITCH_PARAM))) {
+		/* GET operation */
+		respbuf[0] = priv->chan_mode;
+		respbuf[1] = priv->chan_num_pkts;
+		ret = 2;
+		goto done;
+	} else {
+		parse_arguments(respbuf + strlen(CMD_NXP) +
+					strlen(PRIV_CMD_SET_CHAN_SWITCH_PARAM),
+				data, ARRAY_SIZE(data), &user_data_len);
+	}
+
+	if (sizeof(int) * user_data_len > sizeof(data)) {
+		PRINTM(MERROR, "Too many arguments\n");
+		ret = -EINVAL;
+		LEAVE();
+		return ret;
+	}
+	if (user_data_len < 2) {
+		PRINTM(MERROR, "Too few arguments\n");
+		ret = -EINVAL;
+		LEAVE();
+		return ret;
+	}
+
+	if (data[0] && (data[0] < 0 || data[0] > 3)) {
+		PRINTM(MERROR,
+		       "Wrong channel switch parameter <mode> for ucast action frame!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (!data[0] && (data[1] < 0 || data[1] > MAX_NUM_PKTS)) {
+		PRINTM(MERROR, "Bcast action frame count exceeds maximum %d!\n",
+		       MAX_NUM_PKTS);
+		ret = -EINVAL;
+		goto done;
+	}
+	priv->chan_mode = data[0] & DEFAULT_CHAN_MODE_MASK;
+	priv->chan_num_pkts = data[1];
 done:
 	LEAVE();
 	return ret;
@@ -16709,7 +18037,7 @@
 
 	priv->phandle->chsw_wait_q_woken = MFALSE;
 	/* wait for channel switch to complete  */
-	wait_event_interruptible_timeout(
+	(void)wait_event_interruptible_timeout(
 		priv->phandle->chsw_wait_q, priv->phandle->chsw_wait_q_woken,
 		(u32)HZ * (ext_chan_switch->chan_switch_count + 2) * 110 /
 			1000);
@@ -16766,8 +18094,8 @@
 			    strlen("On")) == 0) {
 			if (memcmp(priv->random_mac, zero_mac,
 				   MLAN_MAC_ADDR_LENGTH)) {
-				ret = sprintf(respbuf,
-					      "FAKEMAC has been On\n") +
+				ret = snprintf(respbuf, CMD_BUF_LEN,
+					       "FAKEMAC has been On\n") +
 				      1;
 				goto done;
 			}
@@ -17077,7 +18405,7 @@
 			*end = '\0';
 		if (pvariable_name && begin) {
 			if (strcmp(pvariable_name, "AUTO_RECONNECT") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 			} else if (strcmp(pvariable_name, "BSSID") == 0) {
 				woal_mac2u8(mac_addr, begin);
 				moal_memcpy_ext(priv->phandle,
@@ -17181,106 +18509,106 @@
 					goto done;
 				}
 			} else if (strcmp(pvariable_name, "RETRY_COUNT") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.retry_count = (t_u8)data;
 			} else if (strcmp(pvariable_name,
 					  "TRIGGER_CONDITION") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.trigger_condition =
 					(t_u16)data;
 			} else if (strcmp(pvariable_name, "MAX_RSSI") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.max_rssi = (t_u8)data;
 				roam_offload_cfg.rssi_param_set_flag = 1;
 			} else if (strcmp(pvariable_name, "MIN_RSSI") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.min_rssi = (t_u8)data;
 				roam_offload_cfg.rssi_param_set_flag = 1;
 			} else if (strcmp(pvariable_name, "STEP_RSSI") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.step_rssi = (t_u8)data;
 				roam_offload_cfg.rssi_param_set_flag = 1;
 			} else if (strcmp(pvariable_name, "BAND_PREFER") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.band_rssi.band_preferred =
 					(t_u8)data;
 				roam_offload_cfg.band_rssi_flag = 1;
 			} else if (strcmp(pvariable_name, "RSSI_HYSTERESIS") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.band_rssi.rssi_hysteresis =
 					(t_u8)data;
 				roam_offload_cfg.band_rssi_flag = 1;
 			}
 
 			else if (strcmp(pvariable_name, "BSSTYPE") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.bss_type =
 					(t_u8)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			} else if (strcmp(pvariable_name, "CHANSPERSCAN") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.channels_per_scan =
 					(t_u8)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			} else if (strcmp(pvariable_name, "BGRPTCONDITION") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.bg_rpt_condition =
 					(t_u32)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			} else if (strcmp(pvariable_name, "SCANINTERVAL") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.scan_interval =
 					(t_u32)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			}
 
 			else if (strcmp(pvariable_name, "EESMODE") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.ees_mode = (t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "EESRPTCONDITION") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.ees_rpt_condition =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "HIGHSCANPERIOD") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.high_scan_period =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "HIGHSCANCOUNT") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.high_scan_count =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "MIDSCANPERIOD") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.mid_scan_period =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "MIDSCANCOUNT") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.mid_scan_count =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "LOWSCANPERIOD") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.low_scan_period =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "LOWSCANCOUNT") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.low_scan_count =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
@@ -17288,18 +18616,18 @@
 
 			else if (strcmp(pvariable_name, "BCNMISSTHRESHOLD") ==
 				 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bcn_miss_threshold =
 					(t_u8)data;
 			}
 
 			else if (strcmp(pvariable_name,
 					"PREBCNMISSTHRESHOLD") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.pre_bcn_miss_threshold =
 					(t_u8)data;
 			} else if (strcmp(pvariable_name, "REPEATCOUNT") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.repeat_count = (t_u16)data;
 			} else {
 				PRINTM(MERROR, "Un-support parameter: %s\n",
@@ -17446,10 +18774,11 @@
 					goto done;
 				}
 				ssid_passphrase->ssid.ssid_len = strlen(item);
-				strncpy((char *)ssid_passphrase->ssid.ssid,
-					item,
-					MIN(strlen(item),
-					    MLAN_MAX_SSID_LENGTH));
+				moal_memcpy_ext(
+					priv->phandle,
+					(char *)ssid_passphrase->ssid.ssid,
+					item, strlen(item),
+					MLAN_MAX_SSID_LENGTH);
 				PRINTM(MINFO, "ssid=%s, len=%d\n",
 				       ssid_passphrase->ssid.ssid,
 				       (int)ssid_passphrase->ssid.ssid_len);
@@ -17837,12 +19166,306 @@
 }
 
 /**
+ * @brief               Download start keep alive rx parameters
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param mkeep_alive_id       keep alive ID number
+ * @param ip_pke        IP packet from host
+ * @param ip_pke_len    IP packet length from host
+ * @param src_mac       Source MAC address
+ * @param dst_mac       Destination MAC address
+
+ * @return      0: success  fail otherwise
+ */
+int woal_start_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			      t_u8 *ip_pkt, t_u16 ip_pkt_len, t_u8 *src_mac,
+			      t_u8 *dst_mac)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	int ret = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	if (mkeep_alive_id >= MAX_KEEP_ALIVE_RX_ID) {
+		PRINTM(MERROR, "Invalid parameters\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* SET operation */
+	ioctl_req->action = MLAN_ACT_SET;
+	misc->param.keep_alive_rx.mkeep_alive_id = mkeep_alive_id;
+	misc->param.keep_alive_rx.enable = true;
+	moal_memcpy_ext(priv->phandle, misc->param.keep_alive_rx.dst_mac,
+			dst_mac, MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	moal_memcpy_ext(priv->phandle, misc->param.keep_alive_rx.src_mac,
+			src_mac, MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	misc->param.keep_alive_rx.pkt_len =
+		MIN(ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+	moal_memcpy_ext(priv->phandle, misc->param.keep_alive_rx.packet, ip_pkt,
+			ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Download stop keep alive rx parameters
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param mkeep_alive_id       keep alive ID number
+ * @param ip_pkt        Last packet
+ * @param ip_pkt_len    Last packet length
+
+ * @return      0: success  fail otherwise
+ */
+int woal_stop_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			     t_u8 reset, t_u8 *ip_pkt, t_u8 *pkt_len)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_keep_alive_rx *misc_keep_alive_rx = NULL;
+	int ret = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	misc_keep_alive_rx = &misc->param.keep_alive_rx;
+
+	if (mkeep_alive_id >= MAX_KEEP_ALIVE_RX_ID) {
+		PRINTM(MERROR, "Invalid parameters\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* GET operation */
+	ioctl_req->action = MLAN_ACT_GET;
+	misc_keep_alive_rx->mkeep_alive_id = mkeep_alive_id;
+	misc_keep_alive_rx->enable = false;
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!misc_keep_alive_rx->enable) {
+		PRINTM(MERROR, "ID %d is already stop\n", mkeep_alive_id);
+		goto done;
+	}
+
+	if (reset)
+		ioctl_req->action = MLAN_ACT_RESET;
+	else
+		/* SET operation */
+		ioctl_req->action = MLAN_ACT_SET;
+	misc_keep_alive_rx->mkeep_alive_id = mkeep_alive_id;
+	misc_keep_alive_rx->enable = false;
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+	if (pkt_len) {
+		*pkt_len = MIN(misc_keep_alive_rx->pkt_len,
+			       (MKEEP_ALIVE_ACK_PKT_MAX - 1));
+		PRINTM(MINFO, "keep alive rx stop pkt_len is %d\n", *pkt_len);
+	}
+	if (*pkt_len && ip_pkt)
+		moal_memcpy_ext(priv->phandle, ip_pkt,
+				misc_keep_alive_rx->packet, *pkt_len, *pkt_len);
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Save cloud keep alive params in driver handle
+ *
+ * @param priv          Pointer to moal_private structure
+ * @params              Other params for keep alive
+
+ *  @return             Number of bytes written, negative for failure.
+ */
+int woal_priv_save_cloud_keep_alive_params_rx(moal_private *priv,
+					      t_u8 mkeep_alive_id, t_u8 enable,
+					      t_u16 ether_type, t_u8 *ip_pkt,
+					      t_u16 ip_pkt_len, t_u8 *src_mac,
+					      t_u8 *dst_mac)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0;
+	mlan_ds_misc_keep_alive_rx *keep_alive_rx = NULL;
+	moal_handle *phandle = NULL;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	phandle = priv->phandle;
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	if (mkeep_alive_id >= MAX_KEEP_ALIVE_RX_ID) {
+		PRINTM(MERROR, "Invalid parameters\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	/* GET operation */
+	ioctl_req->action = MLAN_ACT_GET;
+	misc->param.keep_alive_rx.mkeep_alive_id = mkeep_alive_id;
+	misc->param.keep_alive_rx.enable = true;
+
+	ret = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (misc->param.keep_alive_rx.enable) {
+		PRINTM(MERROR, "ID %d is in use\n", mkeep_alive_id);
+		ret = -EINVAL;
+		goto done;
+	}
+
+	keep_alive_rx = &phandle->keep_alive_rx[mkeep_alive_id];
+	keep_alive_rx->mkeep_alive_id = mkeep_alive_id;
+	keep_alive_rx->enable = enable;
+	if (enable) {
+		keep_alive_rx->cached = true;
+		moal_memcpy_ext(phandle, keep_alive_rx->dst_mac, dst_mac,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		moal_memcpy_ext(phandle, keep_alive_rx->src_mac, src_mac,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		keep_alive_rx->pkt_len =
+			MIN(ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+		moal_memcpy_ext(phandle, keep_alive_rx->packet, ip_pkt,
+				ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+		if (ether_type)
+			keep_alive_rx->ether_type = ether_type;
+		else
+			keep_alive_rx->ether_type = 0;
+	}
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Cloud keep alive rx feature
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_cloud_keep_alive_rx(moal_private *priv, t_u8 *respbuf,
+					 t_u32 respbuflen)
+{
+	int ret = 0;
+	cloud_keep_alive_rx *keep_alive_rx = NULL;
+	int header_len = 0;
+
+	ENTER();
+
+	header_len = strlen(PRIV_CMD_CLOUD_KEEP_ALIVE_RX);
+
+	keep_alive_rx = (cloud_keep_alive_rx *)(respbuf + header_len);
+
+	if (keep_alive_rx->enable) {
+		ret = woal_priv_save_cloud_keep_alive_params_rx(
+			priv, keep_alive_rx->mkeep_alive_id,
+			keep_alive_rx->enable, 0, keep_alive_rx->pkt,
+			keep_alive_rx->pkt_len, keep_alive_rx->src_mac,
+			keep_alive_rx->dst_mac);
+	} else {
+		if (0 != woal_stop_mkeep_alive_rx(
+				 priv, keep_alive_rx->mkeep_alive_id,
+				 keep_alive_rx->reset, keep_alive_rx->pkt,
+				 &keep_alive_rx->pkt_len)) {
+			ret = -EFAULT;
+			return ret;
+		}
+		ret = respbuflen;
+	}
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Set/Get static rx abort config
  *
  *  @param priv         A pointer to moal_private structure
  *  @param respbuf      A pointer to response buffer
  *  @param respbuflen   Available length of response buffer
- *
+
  *  @return             Number of bytes written, negative for failure.
  */
 static int woal_priv_rx_abort_cfg(moal_private *priv, t_u8 *respbuf,
@@ -17919,6 +19542,90 @@
 	LEAVE();
 	return ret;
 }
+/**
+ *  @brief Set/Get static OFDM DESENSE CFG
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param respbuf      A pointer to response buffer
+ *  @param respbuflen   Available length of response buffer
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_ofdm_desense_cfg(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0;
+	int data[2] = {0};
+	int header_len = 0, user_data_len = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_OFDM_DESENSE_CFG);
+	user_data_len = strlen(respbuf) - header_len;
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_OFDM_DESENSE_CFG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		user_data_len = 0;
+		req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+				&user_data_len);
+		if (user_data_len > 2 ||
+		    (data[0] == MTRUE && user_data_len != 2)) {
+			PRINTM(MERROR, "Invalid number of args!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (data[0] == MTRUE && data[1] > 0x7f) {
+			PRINTM(MERROR, "Invalid threshold value\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.ofdm_desense_cfg.enable = (t_u8)data[0];
+		if (user_data_len == 2)
+			misc->param.ofdm_desense_cfg.cca_threshold =
+				(t_s8)data[1];
+		req->action = MLAN_ACT_SET;
+	}
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	data[0] = misc->param.ofdm_desense_cfg.enable;
+	data[1] = misc->param.ofdm_desense_cfg.cca_threshold;
+	moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data, sizeof(data),
+			respbuflen);
+	ret = sizeof(data);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
 
 /**
  *  @brief Set/Get dynamic rx abort config
@@ -17935,7 +19642,7 @@
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
 	int ret = 0;
-	int data[3] = {0};
+	int data[7] = {0};
 	int header_len = 0, user_data_len = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
@@ -17968,8 +19675,9 @@
 		/* SET operation */
 		parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
 				&user_data_len);
-		if (user_data_len > 3 ||
-		    (data[0] == MTRUE && user_data_len != 3)) {
+		if (user_data_len > 4 ||
+		    ((data[0] == MTRUE && user_data_len != 3) &&
+		     (data[0] == MTRUE && user_data_len != 4))) {
 			PRINTM(MERROR, "Invalid number of args!\n");
 			ret = -EINVAL;
 			goto done;
@@ -17980,12 +19688,18 @@
 				ret = -EINVAL;
 				goto done;
 			}
-			if (data[2] > 0x7f) {
+			if (data[2] > 0x7f && data[2] != 0xff) {
 				PRINTM(MERROR,
 				       "Invalid ceil threshold value\n");
 				ret = -EINVAL;
 				goto done;
 			}
+			if (data[3] > 0x7f) {
+				PRINTM(MERROR,
+				       "Invalid floor threshold value\n");
+				ret = -EINVAL;
+				goto done;
+			}
 		}
 		misc->param.rx_abort_cfg_ext.enable = (t_u8)data[0];
 		if (user_data_len > 1) {
@@ -17993,6 +19707,19 @@
 				(t_s8)data[1];
 			misc->param.rx_abort_cfg_ext.ceil_rssi_threshold =
 				(t_s8)data[2];
+			/** not to update floor_rssi_threshold if not included
+			 * in coammnd */
+			if (user_data_len == 3)
+				misc->param.rx_abort_cfg_ext
+					.floor_rssi_threshold = 0xff;
+			else
+				misc->param.rx_abort_cfg_ext
+					.floor_rssi_threshold = (t_s8)data[3];
+
+			misc->param.rx_abort_cfg_ext
+				.current_dynamic_rssi_threshold = 0;
+			misc->param.rx_abort_cfg_ext.rssi_default_config = 0;
+			misc->param.rx_abort_cfg_ext.edmac_enable = 0;
 		}
 		req->action = MLAN_ACT_SET;
 	}
@@ -18006,6 +19733,11 @@
 	data[0] = misc->param.rx_abort_cfg_ext.enable;
 	data[1] = misc->param.rx_abort_cfg_ext.rssi_margin;
 	data[2] = misc->param.rx_abort_cfg_ext.ceil_rssi_threshold;
+	data[3] = misc->param.rx_abort_cfg_ext.floor_rssi_threshold;
+	data[4] = misc->param.rx_abort_cfg_ext.current_dynamic_rssi_threshold;
+	data[5] = misc->param.rx_abort_cfg_ext.rssi_default_config;
+	data[6] = misc->param.rx_abort_cfg_ext.edmac_enable;
+
 	moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data, sizeof(data),
 			respbuflen);
 	ret = sizeof(data);
@@ -18018,6 +19750,222 @@
 }
 
 /**
+ *  @brief Set/Get NAV mitigation config parameters
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param respbuf      A pointer to response buffer
+ *  @param respbuflen   Available length of response buffer
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_nav_mitigation(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0;
+	int data[4] = {0};
+	int header_len = 0, user_data_len = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_NAV_MITIGATION);
+	user_data_len = strlen(respbuf) - header_len;
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_NAV_MITIGATION;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		user_data_len = 0;
+		req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+				&user_data_len);
+		if (user_data_len > 2 ||
+		    (user_data_len == 1 && data[0] != MFALSE)) {
+			PRINTM(MERROR, "Invalid number of args!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+
+		misc->param.nav_mitigation.start_nav_mitigation = data[0];
+		if (data[0] == MTRUE)
+			misc->param.nav_mitigation.threshold = data[1];
+		else
+			misc->param.nav_mitigation.threshold = 0;
+
+		// Not used for MLAN_ACT_SET, Set to 0
+		misc->param.nav_mitigation.detect_cnt = 0;
+		misc->param.nav_mitigation.stop_cnt = 0;
+		req->action = MLAN_ACT_SET;
+	}
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (req->action == MLAN_ACT_GET) {
+		data[0] = misc->param.nav_mitigation.start_nav_mitigation;
+		data[1] = misc->param.nav_mitigation.threshold;
+		data[2] = misc->param.nav_mitigation.detect_cnt;
+		data[3] = misc->param.nav_mitigation.stop_cnt;
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data,
+				sizeof(data), respbuflen);
+	}
+	ret = sizeof(data);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief Set/Get LED config parameters
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param respbuf      A pointer to response buffer
+ *  @param respbuflen   Available length of response buffer
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_led(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0, config_count = 0, i = 0, j = 0;
+	int data[25] = {0};
+	int header_len = 0, user_data_len = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_LED);
+	user_data_len = strlen(respbuf) - header_len;
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+	/* Fill request buffer */
+	memset(req->pbuf, 0, sizeof(mlan_ds_misc_cfg));
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_LED_CONFIG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		user_data_len = 0;
+		req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+				&user_data_len);
+
+		req->action = MLAN_ACT_SET;
+		misc->param.led_config.enable = data[0];
+		misc->param.led_config.led_cfg_len = 0;
+		if (user_data_len > 1) {
+			/* Calculate the number of LED config passed */
+			i = 1;
+			while (i < user_data_len) {
+				if (data[i + 1] < 5)
+					i += 2;
+				else
+					i += 4;
+				config_count++;
+			}
+			misc->param.led_config.led_cfg_len = config_count;
+
+			j = 1;
+			i = 0;
+			while (i < config_count && j < user_data_len) {
+				if (data[j + 1] < 5) {
+					misc->param.led_config.misc_led_behvr[i]
+						.firmwarestate = data[j];
+					misc->param.led_config.misc_led_behvr[i]
+						.ledstate = data[j + 1];
+					misc->param.led_config.misc_led_behvr[i]
+						.ledargs = 0x0000; // keep empty
+					j += 2;
+				} else {
+					if (data[j + 3] > 4) {
+						PRINTM(MERROR,
+						       "Invalid value passed for Duty cycle index %d!\n",
+						       data[j + 3]);
+						ret = -EINVAL;
+					}
+					misc->param.led_config.misc_led_behvr[i]
+						.firmwarestate = data[j];
+					misc->param.led_config.misc_led_behvr[i]
+						.ledstate = data[j + 1];
+					misc->param.led_config.misc_led_behvr[i]
+						.ledargs =
+						(((data[j + 3] & 0x0F) << 4) |
+						 (data[j + 2] & 0x0F));
+					j += 4;
+				}
+				i++;
+			}
+		}
+	}
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (req->action == MLAN_ACT_GET) {
+		respbuf[0] = misc->param.led_config.enable;
+		if (misc->param.led_config.enable == 1) {
+			moal_memcpy_ext(
+				priv->phandle, &respbuf[1],
+				(t_u8 *)misc->param.led_config.misc_led_behvr,
+				(MAX_FW_STATES *
+				 sizeof(mlan_ds_misc_led_behavior)),
+				respbuflen);
+			ret = ((MAX_FW_STATES *
+				sizeof(mlan_ds_misc_led_behavior)) +
+			       1);
+		} else
+			ret = 1;
+	}
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Enable/Disable Un-associated Dot11mc FTM Frame exchanges
  *
  *  @param priv         A pointer to moal_private structure
@@ -18442,7 +20390,8 @@
 	ENTER();
 
 	if (IS_CARD9098(priv->phandle->card_type) ||
-	    IS_CARD9097(priv->phandle->card_type)) {
+	    IS_CARD9097(priv->phandle->card_type) ||
+	    IS_CARDAW693(priv->phandle->card_type)) {
 		header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_LPM);
 		if ((int)strlen(respbuf) == header_len) {
 			/* GET operation */
@@ -18870,7 +20819,6 @@
 		ret = -EFAULT;
 		goto done;
 	}
-#define CMD_BUF_LEN 4096
 	if (priv_cmd.used_len < 0 || priv_cmd.total_len <= 0 ||
 	    priv_cmd.used_len > priv_cmd.total_len) {
 		PRINTM(MERROR,
@@ -19066,6 +21014,16 @@
 						   priv_cmd.total_len);
 			goto handled;
 #endif
+#if defined(UAP_SUPPORT)
+#if defined(STA_CFG80211) && defined(UAP_CFG80211)
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_SETMODE,
+				    strlen(PRIV_CMD_SETMODE)) == 0) {
+			/* Set multi_ap mode */
+			len = woal_uap_set_multiap_mode(priv, buf,
+							priv_cmd.total_len);
+			goto handled;
+#endif
+#endif
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_BSSROLE,
@@ -19115,6 +21073,13 @@
 			len = woal_priv_setgetdeepsleep(priv, buf,
 							priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_REORDER_FLUSH_TIME,
+				    strlen(PRIV_CMD_REORDER_FLUSH_TIME)) == 0) {
+			/* reorder flush time */
+			len = woal_priv_set_get_reorder_flush_time(
+				priv, buf, priv_cmd.total_len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_IPADDR,
 				    strlen(PRIV_CMD_IPADDR)) == 0) {
 			/* IP address */
@@ -19219,6 +21184,14 @@
 			len = woal_priv_set_get_scancfg(priv, buf,
 							priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_AUTH_ASSOC_TIMEOUT_CFG,
+				    strlen(PRIV_CMD_AUTH_ASSOC_TIMEOUT_CFG)) ==
+			   0) {
+			/* Auth, Assoc configuration */
+			len = woal_priv_set_get_auth_assoc_timeout_cfg(
+				priv, buf, priv_cmd.total_len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_GETNLNUM,
 				    strlen(PRIV_CMD_GETNLNUM)) == 0) {
 			/* Scan configuration */
@@ -19306,12 +21279,32 @@
 							 priv_cmd.total_len);
 			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_NAV_MITIGATION,
+				    strlen(PRIV_CMD_NAV_MITIGATION)) == 0) {
+			/* dconfigure nav mitigate */
+			len = woal_priv_nav_mitigation(priv, buf,
+						       priv_cmd.total_len);
+			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_LED,
+				    strlen(PRIV_CMD_LED)) == 0) {
+			/* dconfigure nav mitigate */
+			len = woal_priv_led(priv, buf, priv_cmd.total_len);
+			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_RX_ABORT_CFG,
 				    strlen(PRIV_CMD_RX_ABORT_CFG)) == 0) {
 			/* static Rx Abort config */
 			len = woal_priv_rx_abort_cfg(priv, buf,
 						     priv_cmd.total_len);
 			goto handled;
+
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_OFDM_DESENSE_CFG,
+				    strlen(PRIV_CMD_OFDM_DESENSE_CFG)) == 0) {
+			/* OFDM DESENSE config */
+			len = woal_priv_ofdm_desense_cfg(priv, buf,
+							 priv_cmd.total_len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_TX_AMPDU_PROT_MODE,
 				    strlen(PRIV_CMD_TX_AMPDU_PROT_MODE)) == 0) {
@@ -19380,6 +21373,10 @@
 			/* Memory Read/Write */
 			len = woal_priv_memrdwr(priv, buf, priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_GPIOCFG,
+				    strlen(PRIV_CMD_GPIOCFG)) == 0) {
+			len = woal_priv_gpiocfg(priv, buf, priv_cmd.total_len);
+			goto handled;
 #ifdef SDIO
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_SDCMD52RW,
 				    strlen(PRIV_CMD_SDCMD52RW)) == 0) {
@@ -19393,6 +21390,13 @@
 			len = woal_priv_sdio_clock_ioctl(priv, buf,
 							 priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_SDIO_BUSWIDTH,
+				    strlen(PRIV_CMD_SDIO_BUSWIDTH)) == 0) {
+			/* change sdio buswidth */
+			len = woal_priv_sdio_buswidth_ioctl(priv, buf,
+							    priv_cmd.total_len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_MPA_CTRL,
 				    strlen(PRIV_CMD_MPA_CTRL)) == 0) {
 			/* Set SDIO Multi-point aggregation
@@ -19579,8 +21583,8 @@
 				len = woal_priv_offchannel(priv, buf,
 							   priv_cmd.total_len);
 			} else
-				len = sprintf(buf,
-					      "CFG80211 is not enabled\n") +
+				len = snprintf(buf, CMD_BUF_LEN,
+					       "CFG80211 is not enabled\n") +
 				      1;
 			goto handled;
 #endif
@@ -19784,6 +21788,17 @@
 						    priv_cmd.total_len);
 			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_CROSS_CHIP_SYNCH,
+				    strlen(PRIV_CMD_CROSS_CHIP_SYNCH)) == 0) {
+			len = woal_priv_cross_chip_synch(priv, buf,
+							 priv_cmd.total_len);
+			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_TSP_CFG,
+				    strlen(PRIV_CMD_TSP_CFG)) == 0) {
+			len = woal_priv_tsp_config(priv, buf,
+						   priv_cmd.total_len);
+			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_CH_LOAD_RESULTS,
 				    strlen(PRIV_CMD_CH_LOAD_RESULTS)) == 0) {
 			/* mc_aggr_cfg*/
@@ -19867,12 +21882,6 @@
 			/* Set/Get CFP table codes */
 			len = woal_priv_cfp_code(priv, buf, priv_cmd.total_len);
 			goto handled;
-		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_CWMODE,
-				    strlen(PRIV_CMD_CWMODE)) == 0) {
-			/* Set/Get Tx CWMode */
-			len = woal_priv_set_get_cwmode(priv, buf,
-						       priv_cmd.total_len);
-			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_ANT_CFG,
 				    strlen(PRIV_CMD_ANT_CFG)) == 0) {
 			/* Set/Get Tx/Rx antenna */
@@ -19925,6 +21934,13 @@
 			len = woal_priv_bypassed_packet(priv, buf,
 							priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_FW_WAKEUP_METHOD,
+				    strlen(PRIV_CMD_FW_WAKEUP_METHOD)) == 0) {
+			/* Set/Get fw wake up method */
+			len = woal_priv_fw_wakeup_method(priv, buf,
+							 priv_cmd.total_len);
+			goto handled;
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(UAP_CFG80211)
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_CFG_NOA,
@@ -20046,8 +22062,8 @@
 				len = woal_priv_dfs_offload_enable(
 					priv, buf, priv_cmd.total_len);
 			else
-				len = sprintf(buf,
-					      "CFG80211 is not enabled\n") +
+				len = snprintf(buf, CMD_BUF_LEN,
+					       "CFG80211 is not enabled\n") +
 				      1;
 			goto handled;
 #endif
@@ -20060,6 +22076,14 @@
 			len = woal_priv_extend_channel_switch(
 				priv, buf, priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_SET_CHAN_SWITCH_PARAM,
+				    strlen(PRIV_CMD_SET_CHAN_SWITCH_PARAM)) ==
+			   0) {
+			/* set CSA/ECSA parameters */
+			len = woal_priv_set_channel_switch_param(
+				priv, buf, priv_cmd.total_len);
+			goto handled;
 #endif
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_DYN_BW,
 				    strlen(PRIV_CMD_DYN_BW)) == 0) {
@@ -20116,17 +22140,69 @@
 						     priv_cmd.total_len);
 			len += strlen(PRIV_CMD_TWT_TEARDOWN) + strlen(CMD_NXP);
 			goto handled;
+
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_TWT_REPORT,
+				    strlen(PRIV_CMD_TWT_REPORT)) == 0) {
+			pdata = buf + strlen(CMD_NXP) +
+				strlen(PRIV_CMD_TWT_REPORT);
+			len = priv_cmd.used_len - strlen(PRIV_CMD_TWT_REPORT) -
+			      strlen(CMD_NXP);
+			len = woal_priv_twt_report(priv, pdata, len,
+						   priv_cmd.total_len);
+			len += strlen(PRIV_CMD_TWT_REPORT) + strlen(CMD_NXP);
+			goto handled;
+
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_TWT_INFORMATION,
+				    strlen(PRIV_CMD_TWT_INFORMATION)) == 0) {
+			pdata = buf + strlen(CMD_NXP) +
+				strlen(PRIV_CMD_TWT_INFORMATION);
+			len = priv_cmd.used_len -
+			      strlen(PRIV_CMD_TWT_INFORMATION) -
+			      strlen(CMD_NXP);
+			len = woal_priv_twt_information(priv, pdata, len,
+							priv_cmd.total_len);
+			len += strlen(PRIV_CMD_TWT_INFORMATION) +
+			       strlen(CMD_NXP);
+			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_BTWT_AP_CONFIG_SET,
+				    strlen(PRIV_CMD_BTWT_AP_CONFIG_SET)) == 0) {
+			pdata = buf + strlen(CMD_NXP) +
+				strlen(PRIV_CMD_BTWT_AP_CONFIG_SET);
+			len = priv_cmd.used_len -
+			      strlen(PRIV_CMD_BTWT_AP_CONFIG_SET) -
+			      strlen(CMD_NXP);
+			len = woal_priv_btwt_ap_config_set(priv, pdata, len,
+							   priv_cmd.total_len);
+			len += strlen(PRIV_CMD_BTWT_AP_CONFIG_SET) +
+			       strlen(CMD_NXP);
+			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_BTWT_AP_CONFIG_GET,
+				    strlen(PRIV_CMD_BTWT_AP_CONFIG_GET)) == 0) {
+			pdata = buf + strlen(CMD_NXP) +
+				strlen(PRIV_CMD_BTWT_AP_CONFIG_GET);
+			len = priv_cmd.used_len -
+			      strlen(PRIV_CMD_BTWT_AP_CONFIG_GET) -
+			      strlen(CMD_NXP);
+			len = woal_priv_btwt_ap_config_get(priv, pdata, len,
+							   priv_cmd.total_len);
+			len += strlen(PRIV_CMD_BTWT_AP_CONFIG_GET) +
+			       strlen(CMD_NXP);
+			goto handled;
+
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_GET_CFG_CHAN_LIST,
 				    strlen(PRIV_CMD_GET_CFG_CHAN_LIST)) == 0) {
-			/* Get txpwrlimit */
+			/* Get channel list */
 			if (IS_STA_OR_UAP_CFG80211(cfg80211_wext))
 				len = woal_priv_getcfgchanlist(
 					priv, buf, priv_cmd.total_len);
 			else
-				len = sprintf(buf,
-					      "CFG80211 is not enabled\n") +
+				len = snprintf(buf, CMD_BUF_LEN,
+					       "CFG80211 is not enabled\n") +
 				      1;
 			goto handled;
 #endif
@@ -20167,7 +22243,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SCAN-CFG", strlen("SCAN-CFG")) == 0) {
 		PRINTM(MIOCTL, "Set SCAN CFG\n");
 		if (MLAN_STATUS_SUCCESS !=
@@ -20175,7 +22251,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RSSI", strlen("RSSI")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
@@ -20189,11 +22265,12 @@
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "%.32s rssi %d\n",
-				      bss_info.ssid.ssid, signal.bcn_rssi_avg) +
+			len = snprintf(buf, CMD_BUF_LEN, "%.32s rssi %d\n",
+				       bss_info.ssid.ssid,
+				       signal.bcn_rssi_avg) +
 			      1;
 		} else {
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 		}
 	} else if (strncmp(buf, "LINKSPEED", strlen("LINKSPEED")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -20202,16 +22279,17 @@
 			goto done;
 		}
 		PRINTM(MIOCTL, "tx rate=%d\n", (int)rate.rate);
-		len = sprintf(buf, "LinkSpeed %d\n",
-			      (int)(rate.rate * 500000 / 1000000)) +
+		len = snprintf(buf, CMD_BUF_LEN, "LinkSpeed %d\n",
+			       (int)(rate.rate * 500000 / 1000000)) +
 		      1;
 	} else
 #endif
 		if (strncmp(buf, "MACADDR", strlen("MACADDR")) == 0) {
-		len = sprintf(buf, "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
-			      priv->current_addr[0], priv->current_addr[1],
-			      priv->current_addr[2], priv->current_addr[3],
-			      priv->current_addr[4], priv->current_addr[5]) +
+		len = snprintf(buf, CMD_BUF_LEN,
+			       "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
+			       priv->current_addr[0], priv->current_addr[1],
+			       priv->current_addr[2], priv->current_addr[3],
+			       priv->current_addr[4], priv->current_addr[5]) +
 		      1;
 	}
 #ifdef STA_SUPPORT
@@ -20221,7 +22299,9 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "powermode = %d\n", power_mode) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "powermode = %d\n",
+			       power_mode) +
+		      1;
 	} else if (strncmp(buf, "SCAN-ACTIVE", strlen("SCAN-ACTIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_ACTIVE)) {
@@ -20230,7 +22310,7 @@
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_ACTIVE;
 		PRINTM(MIOCTL, "Set Active Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SCAN-PASSIVE", strlen("SCAN-PASSIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_PASSIVE)) {
@@ -20239,7 +22319,7 @@
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_PASSIVE;
 		PRINTM(MIOCTL, "Set Passive Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "POWERMODE", strlen("POWERMODE")) == 0) {
 		pdata = buf + strlen("POWERMODE") + 1;
 		if (!moal_extflg_isset(priv->phandle, EXT_HW_TEST)) {
@@ -20249,7 +22329,7 @@
 				goto done;
 			}
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SETROAMING", strlen("SETROAMING")) == 0) {
 		pdata = buf + strlen("SETROAMING") + 1;
 #ifdef STA_CFG80211
@@ -20267,7 +22347,7 @@
 			PRINTM(MIOCTL, "Roaming disabled\n");
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "ROAM", strlen("ROAM")) == 0) {
 		pdata = buf + strlen("ROAM") + 1;
 #ifdef STA_CFG80211
@@ -20285,7 +22365,7 @@
 			PRINTM(MIOCTL, "Roaming disabled\n");
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "COUNTRYCODE", strlen("COUNTRYCODE")) == 0) {
 		memset(country_code, 0, sizeof(country_code));
 		if (MLAN_STATUS_SUCCESS !=
@@ -20293,7 +22373,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "%s\n", country_code) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "%s\n", country_code) + 1;
 	} else if (strncmp(buf, "COUNTRY", strlen("COUNTRY")) == 0) {
 		copy_len = strlen(buf) - strlen("COUNTRY") - 1;
 		if (copy_len > COUNTRY_CODE_LEN || copy_len <= 0) {
@@ -20308,8 +22388,8 @@
 		PRINTM(MIOCTL, "Set COUNTRY %s\n", country_code);
 		if (priv->phandle->params.cntry_txpwr) {
 			if (MLAN_STATUS_SUCCESS !=
-			    woal_request_country_power_table(priv,
-							     country_code)) {
+			    woal_request_country_power_table(priv, country_code,
+							     MOAL_IOCTL_WAIT)) {
 				ret = -EFAULT;
 				goto done;
 			}
@@ -20323,7 +22403,7 @@
 
 				regulatory_hint(priv->wdev->wiphy,
 						country_code);
-				len = sprintf(buf, "OK\n") + 1;
+				len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 				goto done;
 			}
 		}
@@ -20333,7 +22413,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (memcmp(buf, WEXT_CSCAN_HEADER, WEXT_CSCAN_HEADER_SIZE) ==
 		   0) {
 		PRINTM(MIOCTL, "Set Combo Scan\n");
@@ -20342,38 +22422,38 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "GETBAND", strlen("GETBAND")) == 0) {
 		if (MLAN_STATUS_SUCCESS != woal_get_band(priv, &band)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "Band %d\n", band) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "Band %d\n", band) + 1;
 	} else if (strncmp(buf, "SETBAND", strlen("SETBAND")) == 0) {
 		pband = buf + strlen("SETBAND") + 1;
 		if (MLAN_STATUS_SUCCESS != woal_set_band(priv, pband)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 	else if (strncmp(buf, "START", strlen("START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "STOP", strlen("STOP")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #ifdef UAP_SUPPORT
 	else if (strncmp(buf, "AP_BSS_START", strlen("AP_BSS_START")) == 0) {
 		ret = woal_uap_bss_ctrl(priv, MOAL_IOCTL_WAIT, UAP_BSS_START);
 		if (ret)
 			goto done;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "AP_BSS_STOP", strlen("AP_BSS_STOP")) == 0) {
 		ret = woal_uap_bss_ctrl(priv, MOAL_IOCTL_WAIT, UAP_BSS_STOP);
 		if (ret)
 			goto done;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "AP_SET_CFG", strlen("AP_SET_CFG")) == 0) {
 		if (priv_cmd.total_len <= (int)strlen("AP_SET_CFG") + 1)
 			goto done;
@@ -20383,36 +22463,42 @@
 						  strlen("AP_SET_CFG") - 1);
 		if (ret)
 			goto done;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "WL_FW_RELOAD", strlen("WL_FW_RELOAD")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "AP_GET_STA_LIST", strlen("AP_GET_STA_LIST")) ==
 		   0) {
 		/* TODO Add STA list support */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 	else if (strncmp(buf, "SETSUSPENDOPT", strlen("SETSUSPENDOPT")) == 0) {
 		/* it will be done by GUI */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SETSUSPENDMODE", strlen("SETSUSPENDMODE")) ==
 		   0) {
 		/* it will be done by GUI */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXMODE", strlen("BTCOEXMODE")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-START",
 			   strlen("BTCOEXSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-STOP", strlen("BTCOEXSCAN-STOP")) ==
 		   0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #ifdef STA_SUPPORT
 	else if (strncmp(buf, "BGSCAN-START", strlen("BGSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-CONFIG", strlen("BGSCAN-CONFIG")) ==
 		   0) {
+#ifdef STA_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
+			goto done;
+#endif
+#endif
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_bg_scan(priv, buf, priv_cmd.total_len)) {
 			ret = -EFAULT;
@@ -20420,8 +22506,15 @@
 		}
 		priv->bg_scan_start = MTRUE;
 		priv->bg_scan_reported = MFALSE;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-STOP", strlen("BGSCAN-STOP")) == 0) {
+#ifdef STA_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
+			goto done;
+#endif
+#endif
+
 		if (priv->bg_scan_start && !priv->scan_cfg.rssi_threshold) {
 			if (MLAN_STATUS_FAILURE ==
 			    woal_stop_bg_scan(priv, MOAL_NO_WAIT)) {
@@ -20431,7 +22524,7 @@
 			priv->bg_scan_start = MFALSE;
 			priv->bg_scan_reported = MFALSE;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-START", strlen("RXFILTER-START")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -20439,7 +22532,7 @@
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-STOP", strlen("RXFILTER-STOP")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -20447,7 +22540,7 @@
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #ifdef STA_CFG80211
 	else if (strncmp(buf, "GET_EVENT", strlen("GET_EVENT")) == 0) {
@@ -20456,10 +22549,12 @@
 				woal_inform_bss_from_scan_result(
 					priv, NULL, MOAL_IOCTL_WAIT);
 		}
-		len = sprintf(buf, "EVENT=%d\n", priv->last_event) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "EVENT=%d\n",
+			       priv->last_event) +
+		      1;
 		priv->last_event = 0;
 	} else if (strncmp(buf, "GET_802_11W", strlen("GET_802_11W")) == 0) {
-		len = sprintf(buf, "802_11W=ENABLED\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "802_11W=ENABLED\n") + 1;
 	}
 #endif /* STA_CFG80211 */
 	else if (strncmp(buf, "RXFILTER-ADD", strlen("RXFILTER-ADD")) == 0) {
@@ -20468,7 +22563,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-REMOVE", strlen("RXFILTER-REMOVE")) ==
 		   0) {
 		pdata = buf + strlen("RXFILTER-REMOVE") + 1;
@@ -20476,7 +22571,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "QOSINFO", strlen("QOSINFO")) == 0) {
 		pdata = buf + strlen("QOSINFO") + 1;
 #ifdef STA_SUPPORT
@@ -20486,14 +22581,14 @@
 			goto done;
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SLEEPPD", strlen("SLEEPPD")) == 0) {
 		pdata = buf + strlen("SLEEPPD") + 1;
 		if (MLAN_STATUS_SUCCESS != woal_set_sleeppd(priv, pdata)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SET_AP_WPS_P2P_IE",
 			   strlen("SET_AP_WPS_P2P_IE")) == 0) {
 		pdata = buf + strlen("SET_AP_WPS_P2P_IE") + 1;
@@ -20514,7 +22609,7 @@
 		}
 #endif
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 	else if (strncmp(buf, "P2P_DEV_ADDR", strlen("P2P_DEV_ADDR")) == 0) {
@@ -20547,7 +22642,7 @@
 		}
 #endif
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strnicmp(buf, "SCAN_TIMING", strlen("SCAN_TIMING")) == 0) {
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
@@ -20558,7 +22653,7 @@
 		}
 #endif
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strnicmp(buf, "BA_WSIZE_RX", strlen("BA_WSIZE_RX")) == 0) {
 		pdata = buf + strlen("BA_WSIZE_RX") + 1;
 		len = priv_cmd.total_len - strlen("BA_WSIZE_RX") - 1;
@@ -20567,7 +22662,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strnicmp(buf, "BA_WSIZE_TX", strlen("BA_WSIZE_TX")) == 0) {
 		pdata = buf + strlen("BA_WSIZE_TX") + 1;
 		len = priv_cmd.total_len - strlen("BA_WSIZE_TX") - 1;
@@ -20576,7 +22671,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "FAKE_SCAN_COMPLETE",
 			   strlen("FAKE_SCAN_COMPLETE")) == 0) {
 		pdata = buf + strlen("FAKE_SCAN_COMPLETE") + 1;
@@ -20589,7 +22684,7 @@
 			PRINTM(MIOCTL, "fake scan complete disabled\n");
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #ifdef WIFI_DIRECT_SUPPORT
@@ -20600,13 +22695,13 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 #endif
 	else if (strncmp(buf, "WLS_BATCHING", strlen("WLS_BATCHING")) == 0) {
 		/* TODO */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "TDLS_CS_CHAN", strlen("TDLS_CS_CHAN")) == 0) {
 		len = woal_priv_tdls_cs_chan(priv, buf, priv_cmd.total_len);
 	}
@@ -20632,6 +22727,10 @@
 			   strlen("SETROAMPASSPHRASE")) == 0) {
 		len = woal_priv_set_roam_passphrase(priv, buf,
 						    priv_cmd.total_len);
+	} else if (strncmp(buf, PRIV_CMD_CLOUD_KEEP_ALIVE_RX,
+			   strlen(PRIV_CMD_CLOUD_KEEP_ALIVE_RX)) == 0) {
+		len = woal_priv_cloud_keep_alive_rx(priv, buf,
+						    priv_cmd.total_len);
 	} else if (strncmp(buf, PRIV_CMD_CLOUD_KEEP_ALIVE,
 			   strlen(PRIV_CMD_CLOUD_KEEP_ALIVE)) == 0) {
 		len = woal_priv_cloud_keep_alive(priv, buf, priv_cmd.total_len);
@@ -20665,16 +22764,45 @@
 		if (priv_cmd.used_len <= priv_cmd.total_len) {
 			memset(buf + priv_cmd.used_len, 0,
 			       (size_t)(CMD_BUF_LEN - priv_cmd.used_len));
+#ifdef CONFIG_COMPAT
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+			if (copy_to_user(
+				    ((in_compat_syscall()) ?
+					     compat_ptr((uintptr_t)cmd_buf) :
+					     (void __user *)cmd_buf),
+				    buf, priv_cmd.total_len))
+#else
 			if (copy_to_user((void __user *)cmd_buf, buf,
-					 priv_cmd.total_len)) {
+					 priv_cmd.total_len))
+#endif
+#else
+			if (copy_to_user((void __user *)cmd_buf, buf,
+					 priv_cmd.total_len))
+#endif
+			{
 				PRINTM(MERROR,
 				       "%s: failed to copy data to user buffer\n",
 				       __FUNCTION__);
 				ret = -EFAULT;
 				goto done;
 			}
+#ifdef CONFIG_COMPAT
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+			if (copy_to_user(
+				    ((in_compat_syscall()) ?
+					     compat_ptr((
+						     uintptr_t)(req->ifr_data)) :
+					     req->ifr_data),
+				    &priv_cmd, sizeof(android_wifi_priv_cmd)))
+#else
 			if (copy_to_user(req->ifr_data, &priv_cmd,
-					 sizeof(android_wifi_priv_cmd))) {
+					 sizeof(android_wifi_priv_cmd)))
+#endif
+#else
+			if (copy_to_user(req->ifr_data, &priv_cmd,
+					 sizeof(android_wifi_priv_cmd)))
+#endif
+			{
 				PRINTM(MERROR,
 				       "%s: failed to copy command header to user buffer\n",
 				       __FUNCTION__);
@@ -20925,14 +23053,14 @@
 	int ret = 0;
 
 	ENTER();
-
+#if 0
 #ifdef CONFIG_COMPAT
-// TODO: Android 14 accepts to use the same implementation as Android 12 for now.
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0) && !IMX_ANDROID_14)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
 	if (in_compat_syscall()) /* not implemented yet */
 		return -EOPNOTSUPP;
 #endif
 #endif
+#endif
 
 	PRINTM(MINFO, "woal_do_ioctl: ioctl cmd = 0x%x\n", cmd);
 	switch (cmd) {
diff --git a/wlan_sd8987/mlinux/moal_eth_ioctl.h b/wlan_src/mlinux/moal_eth_ioctl.h
old mode 100755
new mode 100644
similarity index 87%
rename from wlan_sd8987/mlinux/moal_eth_ioctl.h
rename to wlan_src/mlinux/moal_eth_ioctl.h
index 3013769..c6a4074
--- a/wlan_sd8987/mlinux/moal_eth_ioctl.h
+++ b/wlan_src/mlinux/moal_eth_ioctl.h
@@ -1,23 +1,30 @@
-
 /** @file moal_eth_ioctl.h
  *
  * @brief This file contains definition for private IOCTL call.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -82,6 +89,9 @@
 #define PRIV_CMD_GET_STA_LIST "getstalist"
 #define PRIV_CMD_BSS_CONFIG "bssconfig"
 #endif
+#if defined(UAP_SUPPORT)
+#define PRIV_CMD_SETMODE "setmode"
+#endif
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
 #define PRIV_CMD_BSSROLE "bssrole"
@@ -100,6 +110,8 @@
 #define PRIV_CMD_EXTCAPCFG "extcapcfg"
 #define PRIV_CMD_CANCELSCAN "cancelscan"
 #endif
+#define PRIV_CMD_REORDER_FLUSH_TIME "flush_time"
+
 #define PRIV_CMD_DEEPSLEEP "deepsleep"
 #define PRIV_CMD_IPADDR "ipaddr"
 #define PRIV_CMD_WPSSESSION "wpssession"
@@ -146,6 +158,7 @@
 #define PRIV_CMD_REGRDWR "regrdwr"
 #define PRIV_CMD_RDEEPROM "rdeeprom"
 #define PRIV_CMD_MEMRDWR "memrdwr"
+#define PRIV_CMD_GPIOCFG "gpiocfg"
 #ifdef SDIO
 #define PRIV_CMD_SDCMD52RW "sdcmd52rw"
 #endif
@@ -209,6 +222,7 @@
 #define PRIV_CMD_TX_BF_CAP "httxbfcap"
 #ifdef SDIO
 #define PRIV_CMD_SDIO_CLOCK "sdioclock"
+#define PRIV_CMD_SDIO_BUSWIDTH "sdiobuswidth"
 #endif
 #ifdef SDIO
 #define PRIV_CMD_MPA_CTRL "mpactrl"
@@ -224,7 +238,6 @@
 #define PRIV_CMD_DFS_CAC "dfs_cac"
 #define PRIV_CMD_AUTODFS "autodfs"
 #define PRIV_CMD_CFP_CODE "cfpcode"
-#define PRIV_CMD_CWMODE "cwmode"
 #define PRIV_CMD_ANT_CFG "antcfg"
 #define PRIV_CMD_SYSCLOCK "sysclock"
 #define PRIV_CMD_GET_KEY "getkey"
@@ -232,6 +245,7 @@
 #define PRIV_CMD_TX_BF_CFG "httxbfcfg"
 #define PRIV_CMD_PORT_CTRL "port_ctrl"
 #define PRIV_CMD_PB_BYPASS "pb_bypass"
+#define PRIV_CMD_FW_WAKEUP_METHOD "fwwakeupmethod"
 #ifdef SDIO
 #define PRIV_CMD_SD_CMD53_RW "sdcmd53rw"
 #endif
@@ -271,6 +285,7 @@
 #define PRIV_CMD_GET_CFG_CHAN_LIST "getcfgchanlist"
 #if defined(UAP_SUPPORT)
 #define PRIV_CMD_EXTEND_CHAN_SWITCH "channel_switch"
+#define PRIV_CMD_SET_CHAN_SWITCH_PARAM "chanswitch_param"
 #endif
 
 #define PRIV_CMD_TDLS_IDLE_TIME "tdls_idle_time"
@@ -297,13 +312,20 @@
 #define PRIV_CMD_STATS "stats"
 #define PRIV_CMD_CH_LOAD "getchload"
 #define PRIV_CMD_CH_LOAD_RESULTS "getloadresults"
+#define PRIV_CMD_CROSS_CHIP_SYNCH "crosssynch"
+#define PRIV_CMD_TSP_CFG "wlan_tsp_cfg"
 
 #define PRIV_CMD_ARB_CFG "arb"
 
 /**Private command to configure static rx abort config */
 #define PRIV_CMD_RX_ABORT_CFG "rx_abort_cfg"
+/**Private command to configure static OFDM DESENSE config */
+#define PRIV_CMD_OFDM_DESENSE_CFG "ofdm_desense_cfg"
 /**Private command to configure dynamic rx abort config */
 #define PRIV_CMD_RX_ABORT_CFG_EXT "rx_abort_cfg_ext"
+/** configure NAV mitigation parameters. */
+#define PRIV_CMD_NAV_MITIGATION "nav_mitigation"
+#define PRIV_CMD_LED "led"
 #define TX_AMPDU_RTS_CTS 0
 #define TX_AMPDU_CTS_2_SELF 1
 #define TX_AMPDU_DISABLE_PROTECTION 2
@@ -390,8 +412,18 @@
 #define PRIV_CMD_TWT_SETUP "twt_setup"
 /** Private command: TWT Teardown Cfg */
 #define PRIV_CMD_TWT_TEARDOWN "twt_teardown"
+/** Private command: TWT report Cfg */
+#define PRIV_CMD_TWT_REPORT "twt_report"
+/** Private command: TWT Information Cfg */
+#define PRIV_CMD_TWT_INFORMATION "twt_information"
+/** Private command: BTWT AP Cfg Set */
+#define PRIV_CMD_BTWT_AP_CONFIG_SET "btwt_AP_config_set"
+/** Private command: BTWT AP Cfg Get */
+#define PRIV_CMD_BTWT_AP_CONFIG_GET "btwt_AP_config_get"
 
 #define PRIV_CMD_LPM "lpm"
+/** Private command: auth/assoc timeout cfg*/
+#define PRIV_CMD_AUTH_ASSOC_TIMEOUT_CFG "auth_assoc_timeout_cfg"
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
 int woal_do_ioctl(struct net_device *dev, struct ifreq *req, void __user *data,
@@ -399,6 +431,10 @@
 #else
 int woal_do_ioctl(struct net_device *dev, struct ifreq *req, int cmd);
 #endif
+
+mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
+			    int *user_data_len);
+
 /*
  * For android private commands, fixed value of ioctl is used.
  * Internally commands are differentiated using strings.
@@ -542,6 +578,7 @@
 #define ACTION_REMOVE 3
 
 #define MC_AGGR_CTRL MBIT(0)
+#define UC_NONAGGR_CTRL MBIT(6)
 /* mcast_aggr_group */
 typedef struct _mcast_aggr_group {
 	/** action */
@@ -684,6 +721,26 @@
 	/** packet content */
 	t_u8 pkt[255];
 } __ATTRIB_PACK__ cloud_keep_alive;
+/** cloud keep alive parameters */
+#define PRIV_CMD_CLOUD_KEEP_ALIVE_RX "cloud_keep_alive_rx"
+typedef struct _cloud_keep_alive_rx {
+	/** id */
+	t_u8 mkeep_alive_id;
+	/** enable/disable of this id */
+	t_u8 enable;
+	/** enable/disable reset*/
+	t_u8 reset;
+	/** Reserved */
+	t_u8 reserved;
+	/** Destination MAC address */
+	t_u8 dst_mac[ETH_ALEN];
+	/** Source MAC address */
+	t_u8 src_mac[ETH_ALEN];
+	/** packet length */
+	t_u8 pkt_len;
+	/** packet content */
+	t_u8 pkt[100];
+} __ATTRIB_PACK__ cloud_keep_alive_rx;
 
 #define TLV_TYPE_PER_PKT_CFG 0x0001
 #define TX_PKT_CTRL MBIT(0)
@@ -703,13 +760,6 @@
 	t_u8 action;
 } __ATTRIB_PACK__ tx_rx_histogram;
 
-/* Enum for different CW mode type */
-typedef enum _cw_modes_e {
-	CWMODE_DISABLE,
-	CWMODE_TXCONTPKT,
-	CWMODE_TXCONTWAVE,
-} cw_modes_e;
-
 /** wlan_ieee80211_chan */
 typedef struct {
 	/** center freq */
diff --git a/wlan_sd8987/mlinux/moal_init.c b/wlan_src/mlinux/moal_init.c
old mode 100755
new mode 100644
similarity index 82%
rename from wlan_sd8987/mlinux/moal_init.c
rename to wlan_src/mlinux/moal_init.c
index cdc57a3..03fc348
--- a/wlan_sd8987/mlinux/moal_init.c
+++ b/wlan_src/mlinux/moal_init.c
@@ -4,20 +4,28 @@
  * driver.
  *
  *
- * Copyright 2018-2022 NXP
+ * Copyright 2018-2022, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 #include "moal_main.h"
@@ -29,7 +37,11 @@
 static char *fw_name;
 static int req_fw_nowait;
 int fw_reload;
-int auto_fw_reload;
+#ifdef PCIE
+int auto_fw_reload = AUTO_FW_RELOAD_ENABLE | AUTO_FW_RELOAD_PCIE_INBAND_RESET;
+#else
+int auto_fw_reload = AUTO_FW_RELOAD_ENABLE;
+#endif
 
 static char *hw_name;
 
@@ -56,12 +68,15 @@
 /** Region alpha2 string */
 static char *reg_alpha2;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-static int country_ie_ignore;
-static int beacon_hints;
+static int country_ie_ignore = 1;
+static int beacon_hints = 1;
 #endif
 #endif
 static int cfg80211_drcs;
 
+static int dmcs;
+static int pref_dbc;
+
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 static int host_mlme = 1;
@@ -75,13 +90,18 @@
 /** Auto deep sleep */
 static int auto_ds;
 
-/** net_rx mode*/
-static int net_rx;
+/** net_rx mode */
+static int net_rx = 1;
 /** amsdu deaggr mode */
-static int amsdu_deaggr;
+static int amsdu_deaggr = 1;
+
+static int tx_budget = 2600;
+static int mclient_scheduling = 1;
 
 static int ext_scan;
 
+/** Boot Time config */
+static int bootup_cal_ctrl = 0;
 /** IEEE PS mode */
 static int ps_mode;
 /** passive to active scan */
@@ -111,6 +131,9 @@
 static int wacp_mode = WACP_MODE_DEFAULT;
 #endif
 
+/** Fw cutom data config */
+static unsigned int fw_data_cfg = 0;
+
 #ifdef WIFI_DIRECT_SUPPORT
 /** Max WIFIDIRECT interfaces */
 static int max_wfd_bss = DEF_WIFIDIRECT_BSS;
@@ -122,6 +145,11 @@
 #endif
 #endif
 
+/** Max NAN interfaces */
+static int max_nan_bss = DEF_NAN_BSS;
+/** NAN interface name */
+static char *nan_name;
+
 /** PM keep power */
 static int pm_keep_power = 1;
 #ifdef SDIO_SUSPEND_RESUME
@@ -129,14 +157,20 @@
 static int shutdown_hs;
 #endif
 
+static int amsdu_disable;
+
 #if defined(SDIO)
 /** SDIO slew rate */
 static int slew_rate = 3;
 #endif
-int tx_work = 0;
+#ifdef IMX_SUPPORT
+static int tx_work = 1;
+#else
+static int tx_work = 0;
+#endif
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 /**
  * RPS to steer packets to specific CPU
  * Default value of 0 keeps rps disabled by default
@@ -145,22 +179,32 @@
 
 /**
  * rps cpu mask
- * rps can be configure to any value between 0x1 - 0xf
+ * rps can be configure to any value between 0x1 - 0xff
  * ex: value of 0x3(0011) indicates to use cpu-0 and cpu-1
+ * ex: value of 0x3f(11 1111) indicates to use cpu-0 and cpu-5
  */
-#define RPS_CPU_MASK 0xf
+#define RPS_CPU_MASK 0xff
 #endif
 #endif
 
-static int tx_skb_clone = 0;
+/**
+ * EDMAC for EU adaptivity
+ * Default value of 0 keeps edmac disabled by default
+ */
+static int edmac_ctrl = 0;
+
 #ifdef IMX_SUPPORT
+static int tx_skb_clone = 1;
 static int pmqos = 1;
 #else
+static int tx_skb_clone = 0;
 static int pmqos = 0;
 #endif
 
 static int chan_track = 0;
 static int mcs32 = 1;
+/** hs_auto_arp setting */
+static int hs_auto_arp = 0;
 
 #if defined(STA_SUPPORT)
 /** 802.11d configuration */
@@ -287,11 +331,29 @@
 
 static t_u16 inact_tmo;
 
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/* default filter flag 0x27 Stands for
+  (MLAN_NETMON_NON_BSS_BCN | \
+   MLAN_NETMON_DATA | \
+   MLAN_NETMON_CONTROL | \
+   MLAN_NETMON_MANAGEMENT)
+*/
+#define DEFAULT_NETMON_FILTER 0x27
+static int mon_filter = DEFAULT_NETMON_FILTER;
+#endif
+#endif
+
+int dual_nb;
+
+/** disable 802.11h tpc configuration */
+static int disable_11h_tpc = 0;
+
 #ifdef DEBUG_LEVEL1
 #ifdef DEBUG_LEVEL2
 #define DEFAULT_DEBUG_MASK (0xffffffff)
 #else
-#define DEFAULT_DEBUG_MASK (MMSG | MFATAL | MERROR | MREG_D)
+#define DEFAULT_DEBUG_MASK (MMSG | MFATAL | MERROR | MREG_D | MFW_D)
 #endif /* DEBUG_LEVEL2 */
 t_u32 drvdbg = DEFAULT_DEBUG_MASK;
 
@@ -328,8 +390,14 @@
 #ifdef SD9177
 	{CARD_TYPE_SD9177, 0, CARD_SD9177},
 #endif
-#ifdef SDNW62X
-	{CARD_TYPE_SDNW62X, 0, CARD_SDNW62X},
+#ifdef SDIW624
+	{CARD_TYPE_SDIW624, 0, CARD_SDIW624},
+#endif
+#ifdef SDAW693
+	{CARD_TYPE_SDAW693, 0, CARD_SDAW693},
+#endif
+#ifdef SDIW610
+	{CARD_TYPE_SDIW610, 0, CARD_SDIW610},
 #endif
 #ifdef PCIE8897
 	{CARD_TYPE_PCIE8897, 0, CARD_PCIE8897},
@@ -343,8 +411,11 @@
 #ifdef PCIE9098
 	{CARD_TYPE_PCIE9098, 0, CARD_PCIE9098},
 #endif
-#ifdef PCIENW62X
-	{CARD_TYPE_PCIENW62X, 0, CARD_PCIENW62X},
+#ifdef PCIEAW693
+	{CARD_TYPE_PCIEAW693, 0, CARD_PCIEAW693},
+#endif
+#ifdef PCIEIW624
+	{CARD_TYPE_PCIEIW624, 0, CARD_PCIEIW624},
 #endif
 #ifdef USB8801
 	{CARD_TYPE_USB8801, 0, CARD_USB8801},
@@ -365,15 +436,19 @@
 #ifdef USB9097
 	{CARD_TYPE_USB9097, 0, CARD_USB9097},
 #endif
-#ifdef USBNW62X
-	{CARD_TYPE_USBNW62X, 0, CARD_USBNW62X},
+#ifdef USBIW624
+	{CARD_TYPE_USBIW624, 0, CARD_USBIW624},
 #endif
-
+#ifdef USBIW610
+	{CARD_TYPE_USBIW610, 0, CARD_USBIW610},
+#endif
 };
 
 static int dfs53cfg = DFS_W53_DEFAULT_FW;
 
 static int keep_previous_scan = 1;
+static int auto_11ax = 1;
+static int reject_addba_req = 0;
 
 /**
  *  @brief This function read a line in module parameter file
@@ -390,7 +465,8 @@
 
 	ENTER();
 
-	if (pos >= (t_s32)size) { /* reach the end */
+	if ((pos >= (t_s32)size) || (data == NULL) ||
+	    (line_pos == NULL)) { /* reach the end */
 		pos = 0; /* Reset position for rfkill */
 		LEAVE();
 		return -1;
@@ -400,6 +476,12 @@
 	dest = line_pos;
 
 	while (pos < (t_s32)size && *src != '\x0A' && *src != '\0') {
+		if ((dest - line_pos) >= (MAX_LINE_LEN - 1)) {
+			PRINTM(MERROR,
+			       "error: input data size exceeds the dest buff limit\n");
+			LEAVE();
+			return -1;
+		}
 		if (*src != ' ' && *src != '\t') /* parse space */
 			*dest++ = *src++;
 		else
@@ -536,7 +618,9 @@
 
 	p = strstr(line, "_");
 	if (p != NULL) {
-		*p++ = '\0';
+		*p = '\0';
+		if (!woal_secure_add(&p, 1, &p, TYPE_PTR))
+			PRINTM(MERROR, "%s:ERR:pointer overflow \n", __func__);
 		*if_id = p;
 	} else {
 		*if_id = NULL;
@@ -683,6 +767,18 @@
 			params->drv_mode = out_data;
 			PRINTM(MMSG, "drv_mode = %d\n", params->drv_mode);
 		}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		else if (strncmp(line, "mon_filter", strlen("mon_filter")) ==
+			 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->mon_filter = out_data;
+			PRINTM(MMSG, "mon_filter = %d\n", params->mon_filter);
+		}
+#endif
+#endif
 #ifdef DEBUG_LEVEL1
 		else if (strncmp(line, "drvdbg", strlen("drvdbg")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
@@ -743,7 +839,20 @@
 		}
 #endif
 #endif
-		else if (strncmp(line, "auto_ds", strlen("auto_ds")) == 0) {
+		else if (strncmp(line, "nan_name", strlen("nan_name")) == 0) {
+			if (parse_line_read_string(line, &out_str) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			woal_dup_string(&params->nan_name, out_str);
+			PRINTM(MMSG, "nan_name=%s\n", params->nan_name);
+		} else if (strncmp(line, "max_nan_bss",
+				   strlen("max_nan_bss")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->max_nan_bss = out_data;
+			PRINTM(MMSG, "max_nan_bss = %d\n", params->max_nan_bss);
+		} else if (strncmp(line, "auto_ds", strlen("auto_ds")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
@@ -763,12 +872,32 @@
 			params->amsdu_deaggr = out_data;
 			PRINTM(MMSG, "amsdu_deaggr = %d\n",
 			       params->amsdu_deaggr);
+		} else if (strncmp(line, "tx_budget", strlen("tx_budget")) ==
+			   0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->tx_budget = out_data;
+		} else if (strncmp(line, "mclient_scheduling",
+				   strlen("mclient_scheduling")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->mclient_scheduling = out_data;
 		} else if (strncmp(line, "ext_scan", strlen("ext_scan")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
 			params->ext_scan = out_data;
 			PRINTM(MMSG, "ext_scan = %d\n", params->ext_scan);
+		} else if (strncmp(line, "bootup_cal_ctrl",
+				   strlen("bootup_cal_ctrl")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->bootup_cal_ctrl = out_data;
+			PRINTM(MMSG, "bootup_cal_ctrl = %d\n",
+			       params->bootup_cal_ctrl);
 		} else if (strncmp(line, "ps_mode", strlen("ps_mode")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
@@ -863,6 +992,15 @@
 			PRINTM(MMSG, "cfg_11d = %d\n", params->cfg_11d);
 		}
 #endif
+		else if (strncmp(line, "amsdu_disable",
+					strlen("amsdu_disable")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+					MLAN_STATUS_SUCCESS)
+				goto err;
+			params->amsdu_disable = out_data;
+			PRINTM(MERROR, "amsdu_disable = %d\n",
+					params->amsdu_disable);
+		}
 #if defined(SDIO)
 		else if (strncmp(line, "slew_rate", strlen("slew_rate")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
@@ -1210,7 +1348,7 @@
 									"off");
 		}
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 		else if (strncmp(line, "rps", strlen("rps")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
@@ -1222,8 +1360,17 @@
 		}
 #endif
 #endif
-		else if (strncmp(line, "tx_skb_clone",
-				 strlen("tx_skb_clone")) == 0) {
+		else if (strncmp(line, "edmac_ctrl", strlen("edmac_ctrl")) ==
+			 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+
+			handle->params.edmac_ctrl = out_data;
+			PRINTM(MMSG, "edmac_ctrl set to %x from cfg\n",
+			       handle->params.edmac_ctrl);
+		} else if (strncmp(line, "tx_skb_clone",
+				   strlen("tx_skb_clone")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
@@ -1276,8 +1423,22 @@
 			       moal_extflg_isset(handle, EXT_CFG80211_DRCS) ?
 				       "on" :
 				       "off");
-		} else if (strncmp(line, "drcs_chantime_mode",
-				   strlen("drcs_chantime_mode")) == 0) {
+		} else if (strncmp(line, "dmcs", strlen("dmcs")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->dmcs = out_data;
+			PRINTM(MMSG, "dmcs=%d\n", params->dmcs);
+		} else if (strncmp(line, "pref_dbc", strlen("pref_dbc")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->pref_dbc = out_data;
+			PRINTM(MMSG, "pref_dbc=%d\n", params->pref_dbc);
+		}
+
+		else if (strncmp(line, "drcs_chantime_mode",
+				 strlen("drcs_chantime_mode")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
@@ -1374,12 +1535,26 @@
 			PRINTM(MMSG, "wacp_moe=%d\n", params->wacp_mode);
 		}
 #endif
-		else if (strncmp(line, "mcs32", strlen("mcs32")) == 0) {
+		else if (strncmp(line, "fw_data_cfg", strlen("fw_data_cfg")) ==
+			 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->fw_data_cfg = out_data;
+			PRINTM(MMSG, "fw_data_cfg= %d\n", params->fw_data_cfg);
+		} else if (strncmp(line, "mcs32", strlen("mcs32")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
 			params->mcs32 = out_data;
 			PRINTM(MMSG, "mcs32=%d\n", params->mcs32);
+		} else if (strncmp(line, "hs_auto_arp",
+				   strlen("hs_auto_arp")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->hs_auto_arp = out_data;
+			PRINTM(MMSG, "hs_auto_arp=%d\n", params->hs_auto_arp);
 		}
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
@@ -1423,8 +1598,48 @@
 			params->keep_previous_scan = out_data;
 			PRINTM(MMSG, "keep_previous_scan=%d\n",
 			       params->keep_previous_scan);
+		} else if (strncmp(line, "auto_11ax", strlen("auto_11ax")) ==
+			   0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->auto_11ax = out_data;
+			PRINTM(MMSG, "auto_11ax=%d\n", params->auto_11ax);
+		} else if (strncmp(line, "dual_nb", strlen("dual_nb")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->dual_nb = out_data;
+			PRINTM(MMSG, "dual_nb=%d\n", params->dual_nb);
+		} else if (strncmp(line, "reject_addba_req",
+				   strlen("reject_addba_req")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->reject_addba_req = out_data;
+			PRINTM(MMSG, "reject_addba_req=%x\n",
+			       params->reject_addba_req);
+		} else if (strncmp(line, "disable_11h_tpc",
+				   strlen("disable_11h_tpc")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->disable_11h_tpc = out_data;
+			PRINTM(MMSG, "disable_11h_tpc=%x\n",
+			       params->disable_11h_tpc);
 		}
 	}
+
+	if (params->tx_budget <= 0)
+		params->mclient_scheduling = 0;
+
+#ifdef PCIE
+	if (!IS_PCIEAW693(handle->card_type))
+		params->mclient_scheduling = 0;
+#else
+	params->mclient_scheduling = 0;
+#endif
+
 	if (end)
 		return ret;
 err:
@@ -1488,6 +1703,13 @@
 	handle->params.drv_mode = drv_mode;
 	if (params)
 		handle->params.drv_mode = params->drv_mode;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	handle->params.mon_filter = mon_filter;
+	if (params)
+		handle->params.mon_filter = params->mon_filter;
+#endif
+#endif
 #ifdef DEBUG_LEVEL1
 	handle->params.drvdbg = drvdbg;
 	if (params)
@@ -1516,6 +1738,15 @@
 		handle->params.mcs32 = params->mcs32;
 	}
 #endif /* UAP_SUPPORT */
+	handle->params.fw_data_cfg = fw_data_cfg;
+	if (params) {
+		handle->params.fw_data_cfg = params->fw_data_cfg;
+	}
+
+	handle->params.hs_auto_arp = hs_auto_arp;
+	if (params) {
+		handle->params.hs_auto_arp = params->hs_auto_arp;
+	}
 #ifdef WIFI_DIRECT_SUPPORT
 	handle->params.max_wfd_bss = max_wfd_bss;
 	woal_dup_string(&handle->params.wfd_name, wfd_name);
@@ -1529,6 +1760,12 @@
 		handle->params.max_vir_bss = params->max_vir_bss;
 #endif
 #endif /* WIFI_DIRECT_SUPPORT */
+	handle->params.max_nan_bss = max_nan_bss;
+	woal_dup_string(&handle->params.nan_name, nan_name);
+	if (params) {
+		handle->params.max_nan_bss = params->max_nan_bss;
+		woal_dup_string(&handle->params.nan_name, params->nan_name);
+	}
 	handle->params.auto_ds = auto_ds;
 	if (params)
 		handle->params.auto_ds = params->auto_ds;
@@ -1540,16 +1777,32 @@
 	if (params)
 		handle->params.amsdu_deaggr = params->amsdu_deaggr;
 
+	handle->params.tx_budget = params ? params->tx_budget : tx_budget;
+	handle->params.mclient_scheduling =
+		params ? params->mclient_scheduling : mclient_scheduling;
+
+	if (handle->params.tx_budget <= 0)
+		handle->params.mclient_scheduling = 0;
+
+#ifdef PCIE
+	if (!IS_PCIEAW693(handle->card_type))
+		handle->params.mclient_scheduling = 0;
+#else
+	handle->params.mclient_scheduling = 0;
+#endif
+
 	handle->params.ext_scan = ext_scan;
 	if (params)
 		handle->params.ext_scan = params->ext_scan;
 
+	handle->params.bootup_cal_ctrl = bootup_cal_ctrl;
 	handle->params.ps_mode = ps_mode;
 	handle->params.p2a_scan = p2a_scan;
 	handle->params.scan_chan_gap = scan_chan_gap;
 	handle->params.sched_scan = sched_scan;
 	handle->params.max_tx_buf = max_tx_buf;
 	if (params) {
+		handle->params.bootup_cal_ctrl = params->bootup_cal_ctrl;
 		handle->params.ps_mode = params->ps_mode;
 		handle->params.max_tx_buf = params->max_tx_buf;
 		handle->params.p2a_scan = params->p2a_scan;
@@ -1574,6 +1827,9 @@
 	if (params)
 		handle->params.cfg_11d = params->cfg_11d;
 #endif
+	handle->params.amsdu_disable = amsdu_disable;
+	if (params)
+		handle->params.amsdu_disable = params->amsdu_disable;
 #if defined(SDIO)
 	handle->params.slew_rate = slew_rate;
 	if (params)
@@ -1694,11 +1950,12 @@
 		moal_extflg_set(handle, EXT_TX_WORK);
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 	handle->params.rps = rps & RPS_CPU_MASK;
 	PRINTM(MMSG, "rps set to %x from module param\n", handle->params.rps);
 #endif
 #endif
+	handle->params.edmac_ctrl = edmac_ctrl;
 
 	if (tx_skb_clone)
 		moal_extflg_set(handle, EXT_TX_SKB_CLONE);
@@ -1722,6 +1979,13 @@
 #endif
 	if (cfg80211_drcs)
 		moal_extflg_set(handle, EXT_CFG80211_DRCS);
+	handle->params.dmcs = dmcs;
+	if (params)
+		handle->params.dmcs = params->dmcs;
+	handle->params.pref_dbc = pref_dbc;
+	if (params)
+		handle->params.pref_dbc = params->pref_dbc;
+
 	handle->params.drcs_chantime_mode = drcs_chantime_mode;
 	if (params)
 		handle->params.drcs_chantime_mode = params->drcs_chantime_mode;
@@ -1764,6 +2028,18 @@
 			handle->params.dfs53cfg = params->dfs53cfg;
 	}
 	handle->params.keep_previous_scan = keep_previous_scan;
+	handle->params.auto_11ax = auto_11ax;
+	handle->params.reject_addba_req = reject_addba_req;
+	handle->params.dual_nb = dual_nb;
+	if (params)
+		handle->params.dual_nb = params->dual_nb;
+
+	handle->params.disable_11h_tpc = disable_11h_tpc;
+	/* Ignore country IE when 11h tpc is disabled */
+	if (disable_11h_tpc)
+		moal_extflg_set(handle, EXT_COUNTRY_IE_IGNORE);
+	if (params)
+		handle->params.disable_11h_tpc = params->disable_11h_tpc;
 }
 
 /**
@@ -1808,6 +2084,10 @@
 		params->wfd_name = NULL;
 	}
 #endif /* WIFI_DIRECT_SUPPORT */
+	if (params->nan_name) {
+		kfree(params->nan_name);
+		params->nan_name = NULL;
+	}
 	if (params->dpd_data_cfg) {
 		kfree(params->dpd_data_cfg);
 		params->dpd_data_cfg = NULL;
@@ -1850,6 +2130,7 @@
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	struct device *dev = handle->hotplug_device;
+	int status;
 
 	if (dev == NULL) {
 		PRINTM(MERROR, "No device attached\n");
@@ -1857,10 +2138,12 @@
 		goto out;
 	}
 
-	ret = request_firmware(&handle->param_data, mod_file, dev);
-	if (ret < 0)
+	status = request_firmware(&handle->param_data, mod_file, dev);
+	if (status < 0) {
 		PRINTM(MERROR, "Request firmware: %s failed, error: %d\n",
 		       mod_file, ret);
+		ret = MLAN_STATUS_FAILURE;
+	}
 out:
 	return ret;
 }
@@ -1935,7 +2218,7 @@
 			}
 		}
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 		else if (!strncmp(prop->name, "rps", strlen("rps"))) {
 			if (!of_property_read_u32(dt_node, prop->name, &data)) {
 				PRINTM(MIOCTL, "rps=0x%x\n", data);
@@ -1944,8 +2227,14 @@
 		}
 #endif
 #endif
-		else if (!strncmp(prop->name, "tx_skb_clone",
-				  strlen("tx_skb_clone"))) {
+		else if (!strncmp(prop->name, "edmac_ctrl",
+				  strlen("edmac_ctrl"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MIOCTL, "edmac_ctrl=0x%x\n", data);
+				edmac_ctrl = data;
+			}
+		} else if (!strncmp(prop->name, "tx_skb_clone",
+				    strlen("tx_skb_clone"))) {
 			if (!of_property_read_u32(dt_node, prop->name, &data)) {
 				PRINTM(MIOCTL, "tx_skb_clone=0x%x\n", data);
 				tx_skb_clone = data;
@@ -1961,6 +2250,14 @@
 				mcs32 = data;
 			}
 		}
+
+		else if (!strncmp(prop->name, "hs_auto_arp",
+				  strlen("hs_auto_arp"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MIOCTL, "hs_auto_arp=0x%x\n", data);
+				hs_auto_arp = data;
+			}
+		}
 #ifdef MFG_CMD_SUPPORT
 		else if (!strncmp(prop->name, "mfg_mode", strlen("mfg_mode"))) {
 			if (!of_property_read_u32(dt_node, prop->name, &data)) {
@@ -2069,6 +2366,17 @@
 				PRINTM(MIOCTL, "cfg80211_drcs=0x%x\n", data);
 				cfg80211_drcs = data;
 			}
+		} else if (!strncmp(prop->name, "dmcs", strlen("dmcs"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MIOCTL, "dmcs=0x%x\n", data);
+				dmcs = data;
+			}
+		} else if (!strncmp(prop->name, "pref_dbc",
+				    strlen("pref_dbc"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MIOCTL, "pref_dbc=0x%x\n", data);
+				pref_dbc = data;
+			}
 		}
 #endif
 #endif
@@ -2193,6 +2501,13 @@
 				multi_dtim = data;
 				PRINTM(MIOCTL, "multi_dtim=%d\n", multi_dtim);
 			}
+		} else if (!strncmp(prop->name, "bootup_cal_ctrl",
+				    strlen("bootup_cal_ctrl"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				bootup_cal_ctrl = data;
+				PRINTM(MIOCTL, "bootup_cal_ctrl=%d\n",
+				       bootup_cal_ctrl);
+			}
 		} else if (!strncmp(prop->name, "inact_tmo",
 				    strlen("inact_tmo"))) {
 			if (!of_property_read_u32(dt_node, prop->name, &data)) {
@@ -2250,7 +2565,13 @@
 			}
 		}
 #endif
-		else if (!strncmp(prop->name, "mcs32", strlen("mcs32"))) {
+		else if (!strncmp(prop->name, "fw_data_cfg",
+				  strlen("fw_data_cfg"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MERROR, "fw_data_cfg=0x%x\n", data);
+				fw_data_cfg = data;
+			}
+		} else if (!strncmp(prop->name, "mcs32", strlen("mcs32"))) {
 			if (!of_property_read_u32(dt_node, prop->name, &data)) {
 				PRINTM(MERROR, "mcs32=0x%x\n", data);
 				mcs32 = data;
@@ -2274,7 +2595,37 @@
 				       data);
 				keep_previous_scan = data;
 			}
+		} else if (!strncmp(prop->name, "auto_11ax",
+				    strlen("auto_11ax"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MERROR, "auto_11ax=0x%x\n", data);
+				auto_11ax = data;
+			}
+		} else if (!strncmp(prop->name, "reject_addba_req",
+				    strlen("reject_addba_req"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MERROR, "rej_addba_req_cfg=0x%x\n",
+				       data);
+				reject_addba_req = data;
+			}
+		} else if (!strncmp(prop->name, "disable_11h_tpc",
+				    strlen("disable_11h_tpc"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MERROR, "disable_11h_tpc=0x%x\n", data);
+				disable_11h_tpc = data;
+			}
 		}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		else if (!strncmp(prop->name, "mon_filter",
+				  strlen("mon_filter"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MERROR, "mon_filter=0x%x\n", data);
+				mon_filter = data;
+			}
+		}
+#endif
+#endif
 	}
 	LEAVE();
 	return;
@@ -2399,7 +2750,7 @@
 	}
 	PRINTM(MMSG, "%s: init module param from usr cfg\n",
 	       card_type_map_tbl[i].name);
-	size = handle->param_data->size;
+	size = (t_u32)handle->param_data->size;
 	data = (t_u8 *)handle->param_data->data;
 	while ((int)parse_cfg_get_line(data, size, line) != -1) {
 		if (line[0] == '#')
@@ -2417,7 +2768,8 @@
 				if (blk_id == NULL)
 					handle->blk_id = 0;
 				else
-					woal_atoi(&handle->blk_id, blk_id);
+					(void)woal_atoi(&handle->blk_id,
+							blk_id);
 				PRINTM(MINFO,
 				       "Validation check, %s, config block: %d\n",
 				       card_type, handle->blk_id);
@@ -2444,13 +2796,26 @@
 			}
 		}
 	}
+	/* do some special handle for MFG mode if mfg_mode is specified in
+	 * module param cfg file */
+#ifdef MFG_CMD_SUPPORT
+	if (handle->params.mfg_mode) {
+#if defined(STA_WEXT) || defined(UAP_WEXT)
+		handle->params.cfg80211_wext = STA_WEXT_MASK | UAP_WEXT_MASK;
+#else
+		handle->params.cfg80211_wext = 0;
+#endif
+		handle->params.drv_mode = DRV_MODE_STA;
+	}
+#endif
+
 	if (no_match)
 		ret = woal_cfg_fallback_process(handle);
 out:
 	if (handle->param_data) {
 		release_firmware(handle->param_data);
 		/* rewind pos */
-		parse_cfg_get_line(NULL, 0, NULL);
+		(void)parse_cfg_get_line(NULL, 0, NULL);
 	}
 	if (ret != MLAN_STATUS_SUCCESS) {
 		PRINTM(MERROR, "Invalid block: %s\n", line);
@@ -2481,8 +2846,14 @@
 MODULE_PARM_DESC(fw_reload,
 		 "0: disable fw_reload; 1: enable fw reload feature");
 module_param(auto_fw_reload, int, 0);
-MODULE_PARM_DESC(auto_fw_reload,
-		 "0: disable auto_fw_reload; 1: enable auto fw reload feature");
+#ifdef PCIE
+MODULE_PARM_DESC(
+	auto_fw_reload,
+	"BIT0: enable auto fw_reload; BIT1: 0: enable PCIE FLR, 1: enable PCIe in-band reset");
+#else
+MODULE_PARM_DESC(auto_fw_reload, "BIT0: enable auto fw_reload");
+#endif
+
 module_param(fw_serial, int, 0);
 MODULE_PARM_DESC(
 	fw_serial,
@@ -2499,8 +2870,9 @@
 	rf_test_mode,
 	"0: Download normal firmware; 1: Download RF_TEST_MODE firmware");
 module_param(drv_mode, int, 0660);
-MODULE_PARM_DESC(drv_mode,
-		 "Bit 0: STA; Bit 1: uAP; Bit 2: WIFIDIRECT; Bit 7: ZERO_DFS");
+MODULE_PARM_DESC(
+	drv_mode,
+	"Bit 0: STA; Bit 1: uAP; Bit 2: WIFIDIRECT; Bit 4: NAN; Bit 7: ZERO_DFS");
 
 #ifdef STA_SUPPORT
 module_param(max_sta_bss, int, 0);
@@ -2524,6 +2896,10 @@
 MODULE_PARM_DESC(max_vir_bss, "Number of Virtual interfaces (0)");
 #endif
 #endif /* WIFI_DIRECT_SUPPORT */
+module_param(nan_name, charp, 0);
+MODULE_PARM_DESC(nan_name, "NAN interface name");
+module_param(max_nan_bss, int, 0);
+MODULE_PARM_DESC(max_nan_bss, "Number of NAN interfaces (1)");
 #ifdef DEBUG_LEVEL1
 module_param(drvdbg, uint, 0660);
 MODULE_PARM_DESC(drvdbg, "Driver debug");
@@ -2536,6 +2912,10 @@
 MODULE_PARM_DESC(
 	ext_scan,
 	"0: MLAN default; 1: Enable Extended Scan; 2: Enable Enhanced Extended Scan");
+module_param(bootup_cal_ctrl, int, 0660);
+MODULE_PARM_DESC(
+	bootup_cal_ctrl,
+	"0: Disable boot time optimization (default); 1: Enable boot time optimization");
 module_param(ps_mode, int, 0660);
 MODULE_PARM_DESC(
 	ps_mode,
@@ -2556,9 +2936,11 @@
 
 #if defined(SDIO)
 module_param(intmode, int, 0);
-MODULE_PARM_DESC(intmode, "0: INT_MODE_SDIO, 1: INT_MODE_GPIO");
+MODULE_PARM_DESC(intmode, "0: INT_MODE_SDIO (default), 1: INT_MODE_GPIO");
 module_param(gpiopin, int, 0);
-MODULE_PARM_DESC(gpiopin, "255:new GPIO int mode, other vlue: gpio pin number");
+MODULE_PARM_DESC(
+	gpiopin,
+	"GPIO pin number when intmode=1 (default 0, HW mapped intr on GPIO-21)");
 #endif
 
 module_param(pm_keep_power, int, 0);
@@ -2573,6 +2955,11 @@
 MODULE_PARM_DESC(cfg_11d,
 		 "0: MLAN default; 1: Enable 802.11d; 2: Disable 802.11d");
 #endif
+
+module_param(amsdu_disable, int, 0);
+MODULE_PARM_DESC(amsdu_disable,
+		"1: Disable AMSDU aggr; 0: Enable AMSDU aggr");
+
 #if defined(SDIO)
 module_param(slew_rate, int, 0);
 MODULE_PARM_DESC(
@@ -2580,22 +2967,29 @@
 	"0:has the slowest slew rate, then 01, then 02, and 03 has the highest slew rate");
 #endif
 module_param(tx_work, uint, 0660);
-MODULE_PARM_DESC(tx_work, "1: Enable tx_work; 0: Disable tx_work");
+MODULE_PARM_DESC(
+	tx_work,
+	"1: Enable tx_work_queue (default on iMX); 0: Disable tx_work_queue");
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 module_param(rps, uint, 0660);
 MODULE_PARM_DESC(
 	rps,
-	"bit0-bit4(0x1 - 0xf): Enables rps on specific cpu ; 0: Disables rps");
+	"bit0-bit4 (0x1-0xf): Enables rps on specific cpu ; 0: Disables rps (default)");
 #endif
 #endif
+module_param(edmac_ctrl, int, 0660);
+MODULE_PARM_DESC(edmac_ctrl, "0: Disable edmac; 1: Enable edmac");
 module_param(tx_skb_clone, uint, 0660);
-MODULE_PARM_DESC(tx_skb_clone,
-		 "1: Enable tx_skb_clone; 0: Disable tx_skb_clone");
+MODULE_PARM_DESC(
+	tx_skb_clone,
+	"1: Enable tx_skb_clone (default on iMX); 0: Disable tx_skb_clone");
 module_param(pmqos, uint, 0660);
-MODULE_PARM_DESC(pmqos, "1: Enable pmqos; 0: Disable pmqos");
+MODULE_PARM_DESC(pmqos, "1: Enable pmqos (default on iMX); 0: Disable pmqos");
 module_param(mcs32, uint, 0660);
 MODULE_PARM_DESC(mcs32, "1: Enable mcs32; 0: Disable mcs32");
+module_param(hs_auto_arp, uint, 0660);
+MODULE_PARM_DESC(hs_auto_arp, "1: Enable hs_auto_arp; 0: Disable hs_auto_arp");
 
 module_param(dpd_data_cfg, charp, 0);
 MODULE_PARM_DESC(dpd_data_cfg, "DPD data file name");
@@ -2649,7 +3043,7 @@
 MODULE_PARM_DESC(ring_size,
 		 "adma dma ring size: 32/64/128/256/512, default 128");
 module_param(pcie_int_mode, int, 0);
-MODULE_PARM_DESC(pcie_int_mode, "0: Legacy mode; 1: MSI mode; 2: MSI-X mode");
+MODULE_PARM_DESC(pcie_int_mode, "0: Legacy mode; 1: MSI mode");
 #endif /* PCIE */
 module_param(low_power_mode_enable, int, 0);
 MODULE_PARM_DESC(low_power_mode_enable, "0/1: Disable/Enable Low Power Mode");
@@ -2662,11 +3056,22 @@
 module_param(dev_cap_mask, uint, 0);
 MODULE_PARM_DESC(dev_cap_mask, "Device capability mask");
 module_param(net_rx, int, 0);
-MODULE_PARM_DESC(net_rx,
-		 "0: use netif_rx_ni in rx; 1: use netif_receive_skb in rx");
+MODULE_PARM_DESC(
+	net_rx,
+	"0: use netif_rx/netif_rx_ni in rx; 1: use netif_receive_skb in rx (default)");
 module_param(amsdu_deaggr, int, 0);
-MODULE_PARM_DESC(amsdu_deaggr,
-		 "0: default; 1: Try to avoid buf copy in amsud deaggregation");
+MODULE_PARM_DESC(
+	amsdu_deaggr,
+	"0: buf copy in amsud deaggregation; 1: avoid buf copy in amsud deaggregation (default)");
+
+module_param(tx_budget, int, 0);
+MODULE_PARM_DESC(
+	tx_budget,
+	"airtime tx budget for multi-client scheduling in usec, 0 - disable, default - 2600");
+
+module_param(mclient_scheduling, int, 0);
+MODULE_PARM_DESC(mclient_scheduling,
+		 "0: disable multi-client scheduling; 1 - enable(default)");
 
 #ifdef SDIO
 module_param(sdio_rx_aggr, int, 0);
@@ -2736,7 +3141,8 @@
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 module_param(dfs_offload, int, 0);
-MODULE_PARM_DESC(dfs_offload, "1: enable dfs offload; 0: disable dfs offload.");
+MODULE_PARM_DESC(dfs_offload,
+		 "1: enable dfs offload; 0: disable dfs offload (default)");
 #endif
 
 module_param(drcs_chantime_mode, int, 0);
@@ -2747,6 +3153,15 @@
 MODULE_PARM_DESC(cfg80211_drcs,
 		 "1: Enable DRCS support; 0: Disable DRCS support");
 
+module_param(dmcs, int, 0);
+MODULE_PARM_DESC(
+	dmcs,
+	"0: Firmware default (default); 1: Enable dynamic mapping; 2: Disable dynamic mapping");
+module_param(pref_dbc, int, 0);
+MODULE_PARM_DESC(
+	pref_dbc,
+	"0: Firmware Default (default); 1: Enable prefer DBC; 2:Disable prefer DBC");
+
 module_param(roamoffload_in_hs, int, 0);
 MODULE_PARM_DESC(
 	roamoffload_in_hs,
@@ -2760,6 +3175,10 @@
 	wacp_mode,
 	"WACP mode for UAP/GO 0: WACP_MODE_DEFAULT; 1: WACP_MODE_1; 2: WACP_MODE_2");
 #endif
+module_param(fw_data_cfg, int, 0);
+MODULE_PARM_DESC(
+	fw_data_cfg,
+	"Custom Fw data Bit0: Fw Remapping; Bit1: USB Bulk End Point; Bit2: DPD Current Optimizations");
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 module_param(host_mlme, int, 0);
@@ -2773,17 +3192,17 @@
 module_param(disable_regd_by_driver, int, 0);
 MODULE_PARM_DESC(
 	disable_regd_by_driver,
-	"0: reg domain set by driver enable(default); 1: reg domain set by driver disable");
+	"0: reg domain set by driver enable; 1: reg domain set by driver disable (default)");
 module_param(reg_alpha2, charp, 0660);
 MODULE_PARM_DESC(reg_alpha2, "Regulatory alpha2");
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 module_param(country_ie_ignore, int, 0);
 MODULE_PARM_DESC(
 	country_ie_ignore,
-	"0: Follow countryIE from AP and beacon hint enable; 1: Ignore countryIE from AP and beacon hint disable");
+	"0: Follow countryIE from AP and beacon hint enable; 1: Ignore countryIE from AP and beacon hint disable (default)");
 module_param(beacon_hints, int, 0);
 MODULE_PARM_DESC(beacon_hints,
-		 "0: enable beacon hints(default); 1: disable beacon hints");
+		 "0: enable beacon hints; 1: disable beacon hints (default)");
 #endif
 #endif
 
@@ -2799,3 +3218,27 @@
 MODULE_PARM_DESC(
 	keep_previous_scan,
 	"1: keep previous scan result; 0: flush previous scan result before start scan ");
+
+module_param(auto_11ax, int, 0);
+MODULE_PARM_DESC(auto_11ax, "1: enable auto_11ax; 0: disable auto_11ax ");
+
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+module_param(mon_filter, int, 0);
+MODULE_PARM_DESC(
+	mon_filter,
+	"Bit6:TX frames excluding control; Bit5:non-bss beacons; Bit3:unicast destined non-promiscuous frames only; Bit2:data frames; Bit1:control frames; Bit0:management frames");
+#endif
+#endif
+
+module_param(dual_nb, int, 0);
+MODULE_PARM_DESC(dual_nb, "0: Single BT (Default); 1: Dual BT");
+
+module_param(reject_addba_req, int, 0);
+MODULE_PARM_DESC(
+	reject_addba_req,
+	"Bit1: Reject the addba request when FW auto re-connect enabled (STA BSS only); Bit0: Reject the addba request when HS activated");
+
+module_param(disable_11h_tpc, int, 0);
+MODULE_PARM_DESC(disable_11h_tpc,
+		 "0: Enable 802.11h tpc; 1: Disable 802.11h tpc");
diff --git a/wlan_sd8987/mlinux/moal_ioctl.c b/wlan_src/mlinux/moal_ioctl.c
old mode 100755
new mode 100644
similarity index 90%
rename from wlan_sd8987/mlinux/moal_ioctl.c
rename to wlan_src/mlinux/moal_ioctl.c
index 848bfea..74a30f6
--- a/wlan_sd8987/mlinux/moal_ioctl.c
+++ b/wlan_src/mlinux/moal_ioctl.c
@@ -3,20 +3,28 @@
  * @brief This file contains ioctl function to MLAN
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -36,7 +44,7 @@
 #ifdef UAP_SUPPORT
 #include "moal_uap.h"
 #endif
-
+#include <linux/list.h>
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #include "moal_cfg80211.h"
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
@@ -269,7 +277,9 @@
 
 	memset(&bss_info, 0, sizeof(bss_info));
 	/* Special Case: 20Mhz-only Channel */
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+		return chan2Offset;
 	if (bss_info.region_code != COUNTRY_CODE_US && chan == 165)
 		return chan2Offset;
 
@@ -904,12 +914,12 @@
 	bss->sub_command = MLAN_OID_BSS_MULTICAST_LIST;
 	req->req_id = MLAN_IOCTL_BSS;
 	req->action = MLAN_ACT_SET;
-	if (dev->flags & IFF_PROMISC) {
-		bss->param.multicast_list.mode = MLAN_PROMISC_MODE;
-	} else if (dev->flags & IFF_ALLMULTI) {
+	if (dev->flags & IFF_ALLMULTI) {
 		bss->param.multicast_list.mode = MLAN_ALL_MULTI_MODE;
 	} else {
-		bss->param.multicast_list.mode = MLAN_MULTICAST_MODE;
+		if (dev->flags & IFF_PROMISC)
+			bss->param.multicast_list.mode = MLAN_PROMISC_MODE;
+		bss->param.multicast_list.mode |= MLAN_MULTICAST_MODE;
 		mc_count = woal_copy_all_mc_list(priv->phandle,
 						 &bss->param.multicast_list);
 		if (mc_count > MLAN_MAX_MULTICAST_LIST_SIZE)
@@ -1208,8 +1218,14 @@
 	int i;
 #endif
 	t_u16 enable = 0;
+	if (priv->phandle->card_info->drcs &&
+	    moal_extflg_isset(priv->phandle, EXT_CFG80211_DRCS)) {
+		if (woal_mc_policy_cfg(priv, &enable, wait_option,
+				       MLAN_ACT_GET)) {
+			PRINTM(MERROR, "Get multi-channel policy failed\n");
+		}
+	}
 
-	woal_mc_policy_cfg(priv, &enable, wait_option, MLAN_ACT_GET);
 	if (!enable)
 		return;
 #ifdef UAP_SUPPORT
@@ -1243,7 +1259,7 @@
 	mlan_ds_bss *bss = NULL;
 	mlan_status status;
 #ifdef UAP_SUPPORT
-	mlan_ssid_bssid temp_ssid_bssid;
+	mlan_ssid_bssid *temp_ssid_bssid = NULL;
 #endif
 
 	ENTER();
@@ -1259,14 +1275,27 @@
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-	moal_memcpy_ext(priv->phandle, &temp_ssid_bssid, ssid_bssid,
+	temp_ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!temp_ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	moal_memcpy_ext(priv->phandle, temp_ssid_bssid, ssid_bssid,
 			sizeof(mlan_ssid_bssid), sizeof(mlan_ssid_bssid));
 	if (MLAN_STATUS_SUCCESS ==
-	    woal_find_best_network(priv, wait_option, &temp_ssid_bssid))
+	    woal_find_best_network(priv, wait_option, temp_ssid_bssid))
 		woal_check_mc_connection(priv, wait_option,
-					 temp_ssid_bssid.channel);
+					 temp_ssid_bssid->channel);
+	kfree(temp_ssid_bssid);
 #endif
 
+	if (MOAL_ACQ_SEMAPHORE_BLOCK(&priv->phandle->async_sem)) {
+		PRINTM(MERROR, "Acquire semaphore error, woal_bss_start\n");
+		LEAVE();
+		return -EBUSY;
+	}
 	/* Allocate an IOCTL request buffer */
 	req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
 	if (req == NULL) {
@@ -1292,10 +1321,12 @@
 				sizeof(mlan_ssid_bssid));
 #ifdef STA_CFG80211
 #ifdef STA_SUPPORT
-	priv->assoc_status = req->status_code;
+	if (status != MLAN_STATUS_PENDING)
+		priv->assoc_status = req->status_code;
 #endif
 #endif
 done:
+	MOAL_REL_SEMAPHORE(&priv->phandle->async_sem);
 	if (status != MLAN_STATUS_PENDING)
 		kfree(req);
 	LEAVE();
@@ -2145,6 +2176,8 @@
 			info->param.fw_info.hotfix_version;
 		priv->phandle->fw_ecsa_enable = info->param.fw_info.ecsa_enable;
 		priv->phandle->fw_bands = info->param.fw_info.fw_bands;
+		priv->phandle->cmd_tx_data = info->param.fw_info.cmd_tx_data;
+		priv->phandle->sec_rgpower = info->param.fw_info.sec_rgpower;
 		priv->phandle->fw_getlog_enable =
 			info->param.fw_info.getlog_enable;
 		priv->phandle->fw_roaming_support =
@@ -2165,10 +2198,12 @@
 					sizeof(mlan_fw_info),
 					sizeof(mlan_fw_info));
 		DBG_HEXDUMP(MCMD_D, "mac", priv->current_addr, 6);
-	} else
+	} else if (status != MLAN_STATUS_PENDING)
 		PRINTM(MERROR,
 		       "get fw info failed! status=%d, error_code=0x%x\n",
 		       status, req->status_code);
+	else
+		PRINTM(MERROR, "get fw info failed! status=%d", status);
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(req);
@@ -2579,6 +2614,43 @@
 }
 
 /**
+ *  @brief send mgmt packet through ioctl
+ *
+ *  @param priv     A pointer to moal_private structure
+ *  @param pmbuf    A pointer to mlan_buffer which hold mgmt packet
+ *  @return         N/A
+ */
+static mlan_status woal_send_mgmt_packet(moal_private *priv, pmlan_buffer pmbuf)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	ENTER();
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL)
+		goto done;
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_TX_FRAME;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	ioctl_req->action = MLAN_ACT_SET;
+	misc->param.tx_frame.data_len = pmbuf->data_len;
+	misc->param.tx_frame.buf_type = MLAN_BUF_TYPE_RAW_DATA;
+	misc->param.tx_frame.priority = 7;
+	if (pmbuf->tx_seq_num)
+		misc->param.tx_frame.flags = MLAN_BUF_FLAG_TX_STATUS;
+	misc->param.tx_frame.tx_seq_num = pmbuf->tx_seq_num;
+	moal_memcpy_ext(priv->phandle, misc->param.tx_frame.tx_buf,
+			pmbuf->pbuf + pmbuf->data_offset, pmbuf->data_len,
+			MRVDRV_SIZE_OF_CMD_BUFFER);
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+	LEAVE();
+	return status;
+}
+
+/**
  *  @brief send raw data packet ioctl function
  *
  *  @param dev      A pointer to net_device structure
@@ -2591,6 +2663,7 @@
 	t_u32 packet_len = 0;
 	int ret = 0;
 	pmlan_buffer pmbuf = NULL;
+	IEEE80211_MGMT *mgmt = NULL;
 	mlan_status status;
 
 	ENTER();
@@ -2614,6 +2687,7 @@
 		goto done;
 	}
 #define PACKET_HEADER_LEN 8
+#define FRAME_LEN 2
 #define MV_ETH_FRAME_LEN 1514
 	if (packet_len > MV_ETH_FRAME_LEN) {
 		PRINTM(MERROR, "Invalid packet length %d\n", packet_len);
@@ -2643,6 +2717,15 @@
 	pmbuf->buf_type = MLAN_BUF_TYPE_RAW_DATA;
 	pmbuf->bss_index = priv->bss_index;
 
+	mgmt = (IEEE80211_MGMT *)(pmbuf->pbuf + pmbuf->data_offset +
+				  PACKET_HEADER_LEN + FRAME_LEN);
+
+	if (priv->phandle->cmd_tx_data &&
+	    ((mgmt->frame_control & IEEE80211_FC_MGMT_FRAME_TYPE_MASK) == 0)) {
+		status = woal_send_mgmt_packet(priv, pmbuf);
+		woal_free_mlan_buffer(priv->phandle, pmbuf);
+		goto done;
+	}
 	status = mlan_send_packet(priv->phandle->pmlan_adapter, pmbuf);
 	switch (status) {
 	case MLAN_STATUS_PENDING:
@@ -3027,8 +3110,10 @@
 	moal_private *priv = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
 	mlan_ioctl_req *req = NULL;
-	mlan_ds_misc_ipv6_ra_offload *ipv6_ra;
+	t_u8 *ipv6_ra;
 	int i = 0;
+	unsigned long flags;
+	struct ipv6addr_entry *ipv6_entry = NULL;
 
 	ENTER();
 
@@ -3052,10 +3137,18 @@
 	misc->sub_command = MLAN_OID_MISC_IPV6_RA_OFFLOAD;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
 	req->action = MLAN_ACT_SET;
-	ipv6_ra = &misc->param.ipv6_ra_offload;
-	ipv6_ra->enable = enable;
-	moal_memcpy_ext(priv->phandle, ipv6_ra->ipv6_addr, priv->ipv6_addr, 16,
-			sizeof(ipv6_ra->ipv6_addr));
+
+	misc->param.ipv6_ra_offload.enable = enable;
+	misc->param.ipv6_ra_offload.ipv6_addrs_count = priv->ipv6count;
+	spin_lock_irqsave(&priv->ipv6addr_lock, flags);
+	ipv6_ra = misc->param.ipv6_ra_offload.ipv6_addrs;
+	list_for_each_entry (ipv6_entry, &priv->ipv6_addrses, link) {
+		moal_memcpy_ext(priv->phandle, ipv6_ra, ipv6_entry->ipv6_addr,
+				IPADDR_LEN, IPADDR_LEN);
+		ipv6_ra += IPADDR_LEN;
+	}
+	spin_unlock_irqrestore(&priv->ipv6addr_lock, flags);
+
 	ret = woal_request_ioctl(woal_get_priv(handle, MLAN_BSS_ROLE_STA), req,
 				 MOAL_NO_WAIT);
 	if (ret != MLAN_STATUS_SUCCESS && ret != MLAN_STATUS_PENDING)
@@ -3153,6 +3246,9 @@
 	return ret;
 }
 
+#define ICMPV6_HEADER_TYPE "\x3a"
+#define IPV6_HEADER_TYPE "\x86\xdd"
+#define TYPE_NS "\x87"
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
 /**
  *  @brief Enable IPv6 Neighbor Solicitation offload
@@ -3199,7 +3295,7 @@
 	filter->repeat = 1;
 	filter->offset = 20;
 	filter->num_byte_seq = 2;
-	moal_memcpy_ext(handle, filter->byte_seq, "\x86\xdd", 2,
+	moal_memcpy_ext(handle, filter->byte_seq, IPV6_HEADER_TYPE, 2,
 			sizeof(filter->byte_seq));
 	entry->rpn[1] = RPN_TYPE_AND;
 
@@ -3208,11 +3304,22 @@
 			     FILLING_BYTE_SEQ);
 	filter->type = TYPE_BYTE_EQ;
 	filter->repeat = 1;
+	filter->offset = 28;
+	filter->num_byte_seq = 1;
+	moal_memcpy_ext(handle, filter->byte_seq, ICMPV6_HEADER_TYPE, 1,
+			sizeof(filter->byte_seq));
+	entry->rpn[2] = RPN_TYPE_AND;
+
+	filter++;
+	filter->fill_flag = (FILLING_TYPE | FILLING_REPEAT | FILLING_OFFSET |
+			     FILLING_BYTE_SEQ);
+	filter->type = TYPE_BYTE_EQ;
+	filter->repeat = 1;
 	filter->offset = 62;
 	filter->num_byte_seq = 1;
-	moal_memcpy_ext(handle, filter->byte_seq, "\x87", 1,
+	moal_memcpy_ext(handle, filter->byte_seq, TYPE_NS, 1,
 			sizeof(filter->byte_seq));
-	entry->filter_num = 2;
+	entry->filter_num = 3;
 	if (enable) {
 		mef_cfg->op_code = MLAN_OP_ADD_IPV6_NS;
 	} else {
@@ -3618,6 +3725,8 @@
 #endif
 	ENTER();
 
+	memset(&hscfg, 0, sizeof(mlan_ds_hs_cfg));
+
 	if (!priv) {
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
@@ -3626,7 +3735,7 @@
 	hscfg.conditions = HOST_SLEEP_CFG_CANCEL;
 	hscfg.is_invoke_hostcmd = MTRUE;
 	ret = woal_set_get_hs_params(priv, MLAN_ACT_SET, wait_option, &hscfg);
-	if (ret != MLAN_STATUS_SUCCESS) {
+	if (ret != MLAN_STATUS_SUCCESS && ret != MLAN_STATUS_PENDING) {
 		PRINTM(MERROR, "%s: woal_set_get_hs_params failed \n",
 		       __func__);
 		LEAVE();
@@ -3639,7 +3748,9 @@
 	if (priv->phandle->fw_roam_enable == ROAM_OFFLOAD_WITH_BSSID ||
 	    priv->phandle->fw_roam_enable == ROAM_OFFLOAD_WITH_SSID ||
 	    priv->phandle->fw_roam_enable == AUTO_RECONNECT)
-		woal_config_fw_roaming(priv, ROAM_OFFLOAD_RESUME_CFG, NULL);
+		if (woal_config_fw_roaming(priv, ROAM_OFFLOAD_RESUME_CFG, NULL))
+			PRINTM(MERROR,
+			       "config fw roaming ROAM_OFFLOAD_RESUME_CFG failed\n");
 #ifdef STA_CFG80211
 	if (priv->phandle->fw_roam_enable == AUTO_RECONNECT)
 		woal_set_clear_pmk(priv, MLAN_ACT_CLEAR);
@@ -3715,12 +3826,16 @@
 #endif
 
 	/*Enable fw roaming*/
-	woal_config_fw_roaming(priv, ROAM_OFFLOAD_ENABLE, NULL);
+	if (woal_config_fw_roaming(priv, ROAM_OFFLOAD_ENABLE, NULL))
+		PRINTM(MERROR,
+		       "config fw roaming ROAM_OFFLOAD_ENABLE failed\n");
 	/*Download fw roaming parameters*/
-	woal_config_fw_roaming(priv, ROAM_OFFLOAD_PARAM_CFG,
-			       &priv->phandle->fw_roam_params);
+	if (woal_config_fw_roaming(priv, ROAM_OFFLOAD_PARAM_CFG,
+				   &priv->phandle->fw_roam_params))
+		PRINTM(MERROR,
+		       "config fw roaming ROAM_OFFLOAD_PARAM_CFG failed\n");
 
-	/*Download userset passphrase key and current connection's PMK*/
+		/*Download userset passphrase key and current connection's PMK*/
 #ifdef STA_CFG80211
 	if (!priv->phandle->fw_roam_params.userset_passphrase) {
 		woal_set_clear_pmk(priv, MLAN_ACT_SET);
@@ -3757,7 +3872,10 @@
 	}
 #endif
 	/*Set userset to mlan adapter*/
-	woal_config_fw_roaming(priv, ROAM_OFFLOAD_ENABLE, &roam_offload_cfg);
+	if (woal_config_fw_roaming(priv, ROAM_OFFLOAD_ENABLE,
+				   &roam_offload_cfg))
+		PRINTM(MERROR,
+		       "config fw roaming ROAM_OFFLOAD_ENABLE failed\n");
 
 	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
@@ -3846,6 +3964,34 @@
 	return ret;
 }
 
+/**  @brief This function set rgpower table
+ *
+ *  @param priv     A Pointer to the moal_private structure
+ *  @return         MTRUE or MFALSE
+ */
+mlan_status woal_set_rgpower_table(moal_handle *handle)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+
+	ENTER();
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req) {
+		misc = (mlan_ds_misc_cfg *)req->pbuf;
+		misc->sub_command = MLAN_OID_MISC_REGION_POWER_CFG;
+		req->req_id = MLAN_IOCTL_MISC_CFG;
+		req->action = MLAN_ACT_SET;
+		ret = woal_request_ioctl(woal_get_priv(handle,
+						       MLAN_BSS_ROLE_ANY),
+					 req, MOAL_IOCTL_WAIT);
+	}
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
 /**  @brief This function enables the host sleep
  *
  *  @param priv     A Pointer to the moal_private structure
@@ -3862,6 +4008,7 @@
 	mlan_ds_ps_info pm_info;
 #endif
 	pmlan_ds_misc_keep_alive keep_alive = NULL;
+	pmlan_ds_misc_keep_alive_rx keep_alive_rx = NULL;
 	t_u8 media_connected = MFALSE;
 
 	ENTER();
@@ -3883,8 +4030,13 @@
 					      EXT_DISCONNECT_ON_SUSPEND) &&
 			    handle->priv[i]->media_connected == MTRUE) {
 				PRINTM(MIOCTL, "disconnect on suspend\n");
-				woal_disconnect(handle->priv[i], MOAL_NO_WAIT,
-						NULL, DEF_DEAUTH_REASON_CODE);
+				if (MLAN_STATUS_SUCCESS !=
+				    woal_disconnect(handle->priv[i],
+						    MOAL_NO_WAIT, NULL,
+						    DEF_DEAUTH_REASON_CODE)) {
+					PRINTM(MIOCTL,
+					       "disconnect on suspend failed\n");
+				}
 			}
 		}
 		if (handle->priv[i]) {
@@ -3905,10 +4057,12 @@
 		moal_private *remain_priv =
 			priv->phandle->priv[priv->phandle->remain_bss_index];
 		if (remain_priv) {
-			woal_cfg80211_remain_on_channel_cfg(remain_priv,
-							    MOAL_NO_WAIT, MTRUE,
-							    &channel_status,
-							    NULL, 0, 0);
+			if (woal_cfg80211_remain_on_channel_cfg(
+				    remain_priv, MOAL_NO_WAIT, MTRUE,
+				    &channel_status, NULL, 0, 0)) {
+				PRINTM(MIOCTL,
+				       "Failed to cancel pending remain on channel\n");
+			}
 			if (priv->phandle->cookie) {
 				cfg80211_remain_on_channel_expired(
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
@@ -3941,7 +4095,10 @@
 	if (handle->fw_roam_enable == ROAM_OFFLOAD_WITH_BSSID ||
 	    handle->fw_roam_enable == ROAM_OFFLOAD_WITH_SSID ||
 	    handle->fw_roam_enable == AUTO_RECONNECT) {
-		woal_config_fw_roaming(priv, ROAM_OFFLOAD_SUSPEND_CFG, NULL);
+		if (woal_config_fw_roaming(priv, ROAM_OFFLOAD_SUSPEND_CFG,
+					   NULL))
+			PRINTM(MERROR,
+			       "config fw roaming ROAM_OFFLOAD_SUSPEND_CFG failed\n");
 #ifdef STA_CFG80211
 		if (priv->phandle->fw_roam_enable == AUTO_RECONNECT)
 			woal_set_clear_pmk(priv, MLAN_ACT_SET);
@@ -4012,6 +4169,21 @@
 			memset(keep_alive->packet, 0, MKEEP_ALIVE_IP_PKT_MAX);
 		}
 	}
+	for (i = 0; i < MAX_KEEP_ALIVE_RX_ID; i++) {
+		keep_alive_rx = &handle->keep_alive_rx[i];
+		if (keep_alive_rx && keep_alive_rx->cached &&
+		    keep_alive_rx->enable) {
+			keep_alive_rx->cached = MFALSE;
+			woal_start_mkeep_alive_rx(
+				woal_get_priv(handle, MLAN_BSS_ROLE_ANY),
+				keep_alive_rx->mkeep_alive_id,
+				keep_alive_rx->packet, keep_alive_rx->pkt_len,
+				keep_alive_rx->src_mac, keep_alive_rx->dst_mac);
+			keep_alive_rx->pkt_len = 0;
+			memset(keep_alive_rx->packet, 0,
+			       MKEEP_ALIVE_ACK_PKT_MAX);
+		}
+	}
 	/* Enable Host Sleep */
 	handle->hs_activate_wait_q_woken = MFALSE;
 	memset(&hscfg, 0, sizeof(mlan_ds_hs_cfg));
@@ -4026,7 +4198,7 @@
 				     HS_ACTIVE_TIMEOUT);
 #ifdef SDIO_MMC
 	if (IS_SD(handle->card_type)) {
-		sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
+		sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
 	}
 #endif
 
@@ -4042,7 +4214,8 @@
 #ifdef SDIO_SUSPEND_RESUME
 	else if (IS_SD(handle->card_type)) {
 		handle->suspend_fail = MTRUE;
-		woal_get_pm_info(priv, &pm_info);
+		if (woal_get_pm_info(priv, &pm_info))
+			PRINTM(MCMND, "get pm info failed\n");
 		if (pm_info.is_suspend_allowed == MTRUE) {
 #ifdef MMC_PM_FUNC_SUSPENDED
 			woal_wlan_is_suspended(priv->phandle);
@@ -4056,7 +4229,7 @@
 #endif /* SDIO_SUSPEND_RESUME*/
 #ifdef SDIO_MMC
 	if (IS_SD(handle->card_type)) {
-		sdio_release_host(((struct sdio_mmc_card *)handle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)handle->card)->func);
 	}
 #endif
 	if (hs_actived != MTRUE) {
@@ -4379,11 +4552,12 @@
 
 	ret = woal_request_ioctl(priv, req, wait_option);
 
-	if (req->action == MLAN_ACT_GET)
+	if ((ret == MLAN_STATUS_SUCCESS) && (req->action == MLAN_ACT_GET)) {
 		moal_memcpy_ext(priv->phandle, pmgmt_subtype_mask,
 				&misc->param.mgmt_subtype_mask,
 				sizeof(misc->param.mgmt_subtype_mask),
 				sizeof(misc->param.mgmt_subtype_mask));
+	}
 
 	if (ret != MLAN_STATUS_PENDING)
 		kfree(req);
@@ -5280,100 +5454,6 @@
 }
 
 /**
- *  @brief Change Adhoc Channel
- *
- *  @param priv         A pointer to moal_private structure
- *  @param channel      The channel to be set.
- *  @param wait_option  wait_option
- *
- *  @return             MLAN_STATUS_SUCCESS--success, MLAN_STATUS_FAILURE--fail
- */
-mlan_status woal_change_adhoc_chan(moal_private *priv, int channel,
-				   t_u8 wait_option)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_bss_info bss_info;
-	mlan_ds_bss *bss = NULL;
-	mlan_ioctl_req *req = NULL;
-
-	ENTER();
-
-	memset(&bss_info, 0, sizeof(bss_info));
-
-	/* Get BSS information */
-	if (MLAN_STATUS_SUCCESS !=
-	    woal_get_bss_info(priv, wait_option, &bss_info)) {
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-	if (bss_info.bss_mode == MLAN_BSS_MODE_INFRA) {
-		ret = MLAN_STATUS_SUCCESS;
-		goto done;
-	}
-
-	/* Allocate an IOCTL request buffer */
-	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
-	if (req == NULL) {
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/* Get current channel */
-	bss = (mlan_ds_bss *)req->pbuf;
-	bss->sub_command = MLAN_OID_IBSS_CHANNEL;
-	req->req_id = MLAN_IOCTL_BSS;
-	req->action = MLAN_ACT_GET;
-
-	/* Send IOCTL request to MLAN */
-	ret = woal_request_ioctl(priv, req, wait_option);
-	if (ret != MLAN_STATUS_SUCCESS)
-		goto done;
-
-	if (bss->param.bss_chan.channel == (unsigned int)channel) {
-		ret = MLAN_STATUS_SUCCESS;
-		goto done;
-	}
-	PRINTM(MINFO, "Updating Channel from %d to %d\n",
-	       (int)bss->param.bss_chan.channel, channel);
-
-	if (bss_info.media_connected != MTRUE) {
-		ret = MLAN_STATUS_SUCCESS;
-		goto done;
-	}
-
-	/* Do disonnect*/
-	bss->sub_command = MLAN_OID_BSS_STOP;
-	memset((t_u8 *)&bss->param.bssid, 0, ETH_ALEN);
-
-	/* Send IOCTL request to MLAN */
-	ret = woal_request_ioctl(priv, req, wait_option);
-	if (ret != MLAN_STATUS_SUCCESS)
-		goto done;
-
-	/* Do specific SSID scanning */
-	if (MLAN_STATUS_SUCCESS !=
-	    woal_request_scan(priv, wait_option, &bss_info.ssid)) {
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-	/* Start/Join Adhoc network */
-	bss->sub_command = MLAN_OID_BSS_START;
-	memset(&bss->param.ssid_bssid, 0, sizeof(mlan_ssid_bssid));
-	moal_memcpy_ext(priv->phandle, &bss->param.ssid_bssid.ssid,
-			&bss_info.ssid, sizeof(mlan_802_11_ssid),
-			sizeof(mlan_802_11_ssid));
-
-	/* Send IOCTL request to MLAN */
-	ret = woal_request_ioctl(priv, req, wait_option);
-
-done:
-	if (ret != MLAN_STATUS_PENDING)
-		kfree(req);
-	LEAVE();
-	return ret;
-}
-
-/**
  *  @brief Find the best network to associate
  *
  *  @param priv             A pointer to moal_private structure
@@ -6029,9 +6109,34 @@
 #ifdef STA_CFG80211
 	unsigned long flags;
 #endif
+
+#ifdef STA_CFG80211
+	// cancel scan timeout
+	if (IS_STA_CFG80211(handle->params.cfg80211_wext) &&
+	    handle->scan_request)
+		cancel_delayed_work(&handle->scan_timeout_work);
+#endif
 	/* If scan is in process, cancel the scan command */
-	if (!handle->scan_pending_on_block || !scan_priv)
+	if (!handle->scan_pending_on_block || !scan_priv) {
+#ifdef STA_CFG80211
+		spin_lock_irqsave(&handle->scan_req_lock, flags);
+		if (IS_STA_CFG80211(handle->params.cfg80211_wext) &&
+		    handle->scan_request) {
+			/* some supplicant cannot handle SCAN abort event */
+			if (scan_priv &&
+			    (scan_priv->bss_type == MLAN_BSS_TYPE_STA))
+				woal_cfg80211_scan_done(handle->scan_request,
+							MTRUE);
+			else
+				woal_cfg80211_scan_done(handle->scan_request,
+							MFALSE);
+			handle->scan_request = NULL;
+			handle->fake_scan_complete = MFALSE;
+		}
+		spin_unlock_irqrestore(&handle->scan_req_lock, flags);
+#endif
 		return ret;
+	}
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_scan));
 	if (req == NULL) {
 		ret = MLAN_STATUS_FAILURE;
@@ -6047,7 +6152,6 @@
 	spin_lock_irqsave(&handle->scan_req_lock, flags);
 	if (IS_STA_CFG80211(handle->params.cfg80211_wext) &&
 	    handle->scan_request) {
-		cancel_delayed_work(&handle->scan_timeout_work);
 		/** some supplicant can not handle SCAN abort event */
 		if (scan_priv->bss_type == MLAN_BSS_TYPE_STA)
 			woal_cfg80211_scan_done(handle->scan_request, MTRUE);
@@ -6057,9 +6161,9 @@
 	}
 	spin_unlock_irqrestore(&handle->scan_req_lock, flags);
 #endif
-	/* add 10ms delay, incase firmware delay 0x7f event after scan cancel
+	/* add 300ms delay, incase firmware delay 0x7f event after scan cancel
 	 * command response */
-	woal_sched_timeout(10);
+	woal_sched_timeout(300);
 	handle->scan_priv = NULL;
 done:
 	if (ret != MLAN_STATUS_PENDING)
@@ -6084,6 +6188,8 @@
 	wifi_timeval t;
 	ENTER();
 
+	memset(&scan_resp, 0, sizeof(scan_resp));
+
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_get_scan_table(priv, wait_option, &scan_resp)) {
 		LEAVE();
@@ -6422,7 +6528,12 @@
 		return;
 	}
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MIOCTL, "Get BSS Info Failed\n");
+		LEAVE();
+		return;
+	}
 	if (!bss_info.media_connected) {
 		PRINTM(MIOCTL, "We already lost connection\n");
 		LEAVE();
@@ -6487,15 +6598,20 @@
  */
 mlan_status woal_stop_bg_scan(moal_private *priv, t_u8 wait_option)
 {
-	wlan_bgscan_cfg scan_cfg;
+	wlan_bgscan_cfg *scan_cfg;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	ENTER();
 
-	memset(&scan_cfg, 0, sizeof(scan_cfg));
-	scan_cfg.action = BG_SCAN_ACT_SET;
-	scan_cfg.enable = MFALSE;
-	ret = woal_request_bgscan(priv, wait_option, &scan_cfg);
-
+	scan_cfg = kmalloc(sizeof(wlan_bgscan_cfg), GFP_KERNEL);
+	if (!scan_cfg) {
+		LEAVE();
+		return ret;
+	}
+	memset(scan_cfg, 0, sizeof(wlan_bgscan_cfg));
+	scan_cfg->action = BG_SCAN_ACT_SET;
+	scan_cfg->enable = MFALSE;
+	ret = woal_request_bgscan(priv, wait_option, scan_cfg);
+	kfree(scan_cfg);
 	LEAVE();
 	return ret;
 }
@@ -6599,8 +6715,7 @@
 	mlan_ds_misc_cfg *misc = NULL;
 
 	ENTER();
-	if (priv->media_connected == MFALSE)
-		goto done;
+
 	if (priv->mrvl_rssi_low || !priv->cqm_rssi_thold)
 		goto done;
 	if (event_id == MLAN_EVENT_ID_FW_BCN_RSSI_LOW) {
@@ -7085,7 +7200,6 @@
 	req->action = MLAN_ACT_SET;
 	memset(&radio_cfg->param.band_cfg, 0, sizeof(mlan_ds_band_cfg));
 	radio_cfg->param.band_cfg.config_bands = band;
-	radio_cfg->param.band_cfg.adhoc_start_band = band;
 	ret = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 
 done:
@@ -7499,8 +7613,6 @@
 				if (cardp->rx_data_list[i].urb) {
 					usb_kill_urb(
 						cardp->rx_data_list[i].urb);
-					usb_init_urb(
-						cardp->rx_data_list[i].urb);
 				}
 			}
 		}
@@ -7571,6 +7683,51 @@
 	return status;
 }
 
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+/**
+ * @brief Set multi ap flag to mlan layer
+ *
+ * @param priv		A pointer to moal_private structure
+ * @param wait_option	wait_option of ioctl
+ * @param flag	    multi ap flag
+ *
+ * @return          MLAN_STATUS_SUCCESS -- success, otherwise fail
+ */
+mlan_status woal_multi_ap_cfg(moal_private *priv, t_u8 wait_option, t_u8 flag)
+{
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *cfg = NULL;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		status = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	cfg = (mlan_ds_misc_cfg *)req->pbuf;
+	cfg->param.multi_ap_flag = flag;
+	cfg->sub_command = MLAN_OID_MISC_MULTI_AP_CFG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	req->action = MLAN_ACT_SET;
+
+	status = woal_request_ioctl(priv, req, wait_option);
+	if (status != MLAN_STATUS_SUCCESS)
+		goto done;
+
+	PRINTM(MCMND, "%s: %s 4addr mode\n", priv->netdev->name,
+	       flag ? "Enable" : "Disable");
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return status;
+}
+#endif
+
 /**
  *  @brief Set hotspot configuration value to mlan layer
  *
@@ -7731,6 +7888,279 @@
 }
 
 /**
+ *  @brief config RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param ch_info   A pointer to wifi_channel_info
+ *  @param bandcfg  A pointer to Band_Config_t
+ *
+ *  @return            void
+ */
+void woal_channel_info_to_bandcfg(moal_private *priv,
+				  wifi_channel_info *ch_info,
+				  Band_Config_t *bandcfg)
+{
+	t_u8 channel = 0;
+
+	if (!ch_info || !bandcfg)
+		return;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	channel = ieee80211_frequency_to_channel(ch_info->center_freq);
+#endif
+
+	switch (ch_info->width) {
+	case WIFI_CHAN_WIDTH_10:
+		bandcfg->chanWidth = CHAN_BW_10MHZ;
+		break;
+	case WIFI_CHAN_WIDTH_20:
+		bandcfg->chanWidth = CHAN_BW_20MHZ;
+		break;
+	case WIFI_CHAN_WIDTH_40:
+		bandcfg->chanWidth = CHAN_BW_40MHZ;
+		break;
+	case WIFI_CHAN_WIDTH_80:
+		bandcfg->chanWidth = CHAN_BW_80MHZ;
+		break;
+	default:
+		bandcfg->chanWidth = CHAN_BW_20MHZ;
+		break;
+	}
+	bandcfg->chan2Offset = SEC_CHAN_NONE;
+	if (bandcfg->chanWidth == CHAN_BW_40MHZ) {
+		if (ch_info->center_freq0 < ch_info->center_freq)
+			bandcfg->chan2Offset = SEC_CHAN_BELOW;
+		else
+			bandcfg->chan2Offset = SEC_CHAN_ABOVE;
+	} else if (bandcfg->chanWidth == CHAN_BW_80MHZ)
+		bandcfg->chan2Offset =
+			woal_get_second_channel_offset(priv, channel);
+	bandcfg->chanBand = (channel <= MAX_BG_CHANNEL) ? BAND_2GHZ : BAND_5GHZ;
+	bandcfg->scanMode = SCAN_MODE_MANUAL;
+
+	return;
+}
+
+/**
+ *  @brief config RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param ch_info   A pointer to wifi_channel_info
+ *  @param bandcfg  A pointer to Band_Config_t
+ *
+ *  @return            void
+ */
+void woal_bandcfg_to_channel_info(moal_private *priv, Band_Config_t *bandcfg,
+				  t_u8 channel, wifi_channel_info *ch_info)
+{
+	if (!ch_info || !bandcfg)
+		return;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	ch_info->center_freq = ieee80211_channel_to_frequency(
+		channel, (channel <= MAX_BG_CHANNEL) ? NL80211_BAND_2GHZ :
+						       NL80211_BAND_5GHZ);
+#endif
+
+	switch (bandcfg->chanWidth) {
+	case CHAN_BW_10MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_10;
+		break;
+	case CHAN_BW_20MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_20;
+		break;
+	case CHAN_BW_40MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_40;
+		break;
+	case CHAN_BW_80MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_80;
+		break;
+	default:
+		ch_info->width = WIFI_CHAN_WIDTH_20;
+		break;
+	}
+
+	return;
+}
+
+/**
+ *  @brief config RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param wait_option  wait option
+ *  @param hotspotcfg   A pointer to rtt_config_params_t
+ *
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
+ * otherwise fail
+ */
+mlan_status woal_config_rtt(moal_private *priv, t_u8 wait_option,
+			    wifi_rtt_config_params_t *rtt_params_in)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_rtt_config_params *rtt_params = NULL;
+	t_u32 i = 0;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CONFIG_RTT;
+	rtt_params = &(misc->param.rtt_params);
+	rtt_params->rtt_config_num = rtt_params_in->rtt_config_num;
+	for (i = 0; i < MIN(rtt_params->rtt_config_num, MAX_RTT_CONFIG_NUM);
+	     i++) {
+		moal_memcpy_ext(priv->phandle, rtt_params->rtt_config[i].addr,
+				rtt_params_in->rtt_config[i].addr,
+				sizeof(rtt_params->rtt_config[i].addr),
+				sizeof(rtt_params->rtt_config[i].addr));
+		rtt_params->rtt_config[i].type =
+			rtt_params_in->rtt_config[i].type;
+		rtt_params->rtt_config[i].peer =
+			rtt_params_in->rtt_config[i].peer;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		rtt_params->rtt_config[i]
+			.channel = ieee80211_frequency_to_channel(
+			rtt_params_in->rtt_config[i].channel.center_freq);
+#endif
+		woal_channel_info_to_bandcfg(
+			priv, &(rtt_params_in->rtt_config[i].channel),
+			&(rtt_params->rtt_config[i].bandcfg));
+		rtt_params->rtt_config[i].burst_period =
+			rtt_params_in->rtt_config[i].burst_period;
+		rtt_params->rtt_config[i].num_burst =
+			rtt_params_in->rtt_config[i].num_burst;
+		rtt_params->rtt_config[i].num_frames_per_burst =
+			rtt_params_in->rtt_config[i].num_frames_per_burst;
+		rtt_params->rtt_config[i].num_retries_per_rtt_frame =
+			rtt_params_in->rtt_config[i].num_retries_per_rtt_frame;
+		rtt_params->rtt_config[i].num_retries_per_ftmr =
+			rtt_params_in->rtt_config[i].num_retries_per_ftmr;
+		rtt_params->rtt_config[i].LCI_request =
+			rtt_params_in->rtt_config[i].LCI_request;
+		rtt_params->rtt_config[i].LCR_request =
+			rtt_params_in->rtt_config[i].LCR_request;
+		rtt_params->rtt_config[i].burst_duration =
+			rtt_params_in->rtt_config[i].burst_duration;
+		rtt_params->rtt_config[i].preamble =
+			rtt_params_in->rtt_config[i].preamble;
+		rtt_params->rtt_config[i].bw = rtt_params_in->rtt_config[i].bw;
+	}
+
+	ret = woal_request_ioctl(priv, req, wait_option);
+	if (ret != MLAN_STATUS_SUCCESS)
+		goto done;
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief cancel RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param wait_option  wait option
+ *  @param hotspotcfg   A pointer to rtt_config_params_t
+ *
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
+ * otherwise fail
+ */
+mlan_status woal_cancel_rtt(moal_private *priv, t_u8 wait_option,
+			    t_u32 addr_num, t_u8 addr[][MLAN_MAC_ADDR_LENGTH])
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_rtt_cancel_params *rtt_cancel = NULL;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CANCEL_RTT;
+	rtt_cancel = &(misc->param.rtt_cancel);
+	rtt_cancel->rtt_cancel_num = addr_num;
+	moal_memcpy_ext(priv->phandle, rtt_cancel->rtt_cancel, addr,
+			sizeof(rtt_cancel->rtt_cancel[0]) *
+				rtt_cancel->rtt_cancel_num,
+			sizeof(rtt_cancel->rtt_cancel[0]) * MAX_RTT_CONFIG_NUM);
+	ret = woal_request_ioctl(priv, req, wait_option);
+	if (ret != MLAN_STATUS_SUCCESS)
+		goto done;
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief cancel RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param wait_option  wait option
+ *  @param hotspotcfg   A pointer to rtt_config_params_t
+ *
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
+ * otherwise fail
+ */
+mlan_status woal_rtt_responder_cfg(moal_private *priv, t_u8 wait_option,
+				   mlan_rtt_responder *rtt_rsp_cfg)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_RTT_RESPONDER_CFG;
+	moal_memcpy_ext(priv->phandle, &(misc->param.rtt_rsp_cfg), rtt_rsp_cfg,
+			sizeof(misc->param.rtt_rsp_cfg),
+			sizeof(misc->param.rtt_rsp_cfg));
+
+	ret = woal_request_ioctl(priv, req, wait_option);
+	if (ret != MLAN_STATUS_SUCCESS)
+		goto done;
+	moal_memcpy_ext(priv->phandle, rtt_rsp_cfg, &(misc->param.rtt_rsp_cfg),
+			sizeof(*rtt_rsp_cfg), sizeof(*rtt_rsp_cfg));
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief Send 11d enable/disable command to firmware.
  *
  *  @param priv             A pointer to moal_private structure
@@ -7793,6 +8223,8 @@
 #define TX_FRAME_STR_LEN 200
 #define TRIGGER_FRAME_STR_LEN 250
 #define HE_TB_TX_STR_LEN 30
+#define MAX_RADIO_MODE 21
+#define OTP_RDWR_LEN 50
 
 /*
  *  @brief Parse mfg cmd radio mode string
@@ -7839,7 +8271,7 @@
 	if (pos)
 		d->data2 = (t_u32)woal_string_to_number(pos);
 
-	if ((d->data1 > 14) || (d->data2 > 14))
+	if ((d->data1 > MAX_RADIO_MODE) || (d->data2 > MAX_RADIO_MODE))
 		ret = -EINVAL;
 
 	kfree(tmp);
@@ -7847,7 +8279,6 @@
 	return ret;
 }
 
-#ifdef SD9177
 /*
  *  @brief PowerLevelToDUT11Bits
  *
@@ -7871,7 +8302,6 @@
 
 	return;
 }
-#endif
 
 /*
  *  @brief Parse mfg cmd tx pwr string
@@ -7891,21 +8321,24 @@
 	char *tmp = NULL;
 	char *pos = NULL;
 	gfp_t flag;
-#ifdef SD9177
 	t_u32 tx_pwr_converted = 0xffffffff;
 	int tx_pwr_local = 0;
-	t_u8 fc_card = MFALSE;
-#endif
+	t_u8 pow_conv = MFALSE;
+	t_u32 pow_limit = 24;
+	t_u8 card_type;
 
 	ENTER();
 	if (!s || !d) {
 		LEAVE();
 		return -EINVAL;
 	}
-#ifdef SD9177
-	if (IS_SD9177(handle->card_type))
-		fc_card = MTRUE;
-#endif
+
+	card_type = (handle->card_type) & 0xff;
+	if ((card_type == CARD_TYPE_9098) || (card_type == CARD_TYPE_9097) ||
+	    (card_type == CARD_TYPE_9177) || (card_type == CARD_TYPE_IW624) ||
+	    (card_type == CARD_TYPE_AW693) || (card_type == CARD_TYPE_IW610))
+		pow_conv = MTRUE;
+
 	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
 	string = kzalloc(TX_PWR_STR_LEN, flag);
 	if (string == NULL) {
@@ -7921,16 +8354,17 @@
 
 	/* tx power value */
 	pos = strsep(&string, " \t");
-#ifdef SD9177
-	if (fc_card && pos) {
-		/* for sd9177 we need to convert user power vals including -ve
-		 * vals as per labtool */
+	if (pow_conv && pos) {
+		/* We need to convert user power vals including -ve vals to
+		 * 1/16dbm resolution*/
 		tx_pwr_local = woal_string_to_number(pos);
-		PowerLevelToDUT11Bits(tx_pwr_local, &tx_pwr_converted);
-		d->data1 = tx_pwr_converted;
-	} else
-#endif
-		if (pos) {
+		if (tx_pwr_local != 0xffffffff) {
+			PowerLevelToDUT11Bits(tx_pwr_local, &tx_pwr_converted);
+			d->data1 = tx_pwr_converted;
+			pow_limit = 384;
+		} else
+			d->data1 = (t_u32)tx_pwr_local;
+	} else if (pos) {
 		d->data1 = (t_u32)woal_string_to_number(pos);
 	}
 	/* modulation */
@@ -7943,11 +8377,8 @@
 	if (pos)
 		d->data3 = (t_u32)woal_string_to_number(pos);
 
-#ifdef SD9177
-	if (((!fc_card) && (d->data1 > 24)) || (d->data2 > 2))
-#else
-	if ((d->data1 > 24) || (d->data2 > 2))
-#endif
+	if (((d->data1 > pow_limit) && (d->data1 <= 0xfffffff0)) ||
+	    (d->data2 > 2))
 		ret = -EINVAL;
 
 	kfree(tmp);
@@ -8256,6 +8687,32 @@
 	if (string == NULL)
 		return -ENOMEM;
 
+	/*Initialize the parameters to default values to be used*/
+	d->data_rate = 0x1100;
+	d->frame_pattern = 0xB496DEB6;
+	d->frame_length = 0x400;
+	d->enable = 0;
+	d->short_preamble = -1;
+	d->short_gi = 0;
+	d->adv_coding = -1;
+	d->tx_bf = 0;
+	d->gf_mode = 0;
+	d->stbc = 0;
+	d->adjust_burst_sifs = 0;
+	d->burst_sifs_in_us = 0;
+	d->signal_bw = -1;
+	d->NumPkt = -1;
+	d->MaxPE = -1;
+	d->BeamChange = -1;
+	d->Dcm = -1;
+	d->Doppler = -1;
+	d->MidP = -1;
+	d->QNum = -1;
+
+	for (i = 0; i < ETH_ALEN; i++) {
+		d->bssid[i] = 0xff;
+	}
+
 	moal_memcpy_ext(NULL, string, s + strlen("tx_frame="),
 			len - strlen("tx_frame="), TX_FRAME_STR_LEN - 1);
 
@@ -8319,6 +8776,10 @@
 
 	pos = strsep(&string, " \t");
 	if (pos)
+		d->signal_bw = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
 		d->NumPkt = (t_u32)woal_string_to_number(pos);
 
 	pos = strsep(&string, " \t");
@@ -8356,12 +8817,7 @@
 		}
 	}
 
-	if ((d->enable > 1) || (d->frame_length == 0) ||
-	    (d->adjust_burst_sifs > 1) || (d->burst_sifs_in_us > 255) ||
-	    (d->short_preamble > 1) ||
-	    (d->act_sub_ch == 2 || d->act_sub_ch > 3) || (d->short_gi > 1) ||
-	    (d->adv_coding > 1) || (d->tx_bf > 1) || (d->gf_mode > 1) ||
-	    (d->stbc > 1))
+	if (d->enable > 1)
 		ret = -EINVAL;
 done:
 	kfree(tmp);
@@ -8383,6 +8839,7 @@
 	int ret = MLAN_STATUS_SUCCESS;
 	char *string = NULL;
 	char *pos = NULL;
+	char *tmp = NULL;
 	gfp_t flag;
 
 	ENTER();
@@ -8398,6 +8855,7 @@
 	moal_memcpy_ext(NULL, string, s + strlen("he_tb_tx="),
 			len - strlen("he_tb_tx="), HE_TB_TX_STR_LEN - 1);
 
+	tmp = string;
 	pos = strsep(&string, " \t");
 	if (pos)
 		d->enable = (t_u32)woal_string_to_number(pos);
@@ -8424,7 +8882,7 @@
 		ret = -EINVAL;
 
 done:
-	kfree(string);
+	kfree(tmp);
 	LEAVE();
 	return ret;
 }
@@ -8498,6 +8956,112 @@
 	return ret;
 }
 
+/*
+ *  @brief Parse mfg cmd otp rdwr
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @param s        A pointer to user buffer
+ *  @param len      Length of user buffer
+ *  @param d        A pointer to mfg_cmd_generic_cfg struct
+ *  @return         0 on success, -EINVAL otherwise
+ */
+
+static int parse_otp_mac_addr_rd_wr_string(const char *s, size_t len,
+					   mfg_cmd_otp_mac_addr_rd_wr_t *d)
+{
+	int ret = MLAN_STATUS_SUCCESS;
+	char *string = NULL;
+	char *tmp = NULL;
+	char *pos = NULL;
+	gfp_t flag;
+	int i = 0;
+
+	ENTER();
+	if (!s || !d) {
+		LEAVE();
+		return -EINVAL;
+	}
+
+	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+	string = kzalloc(OTP_RDWR_LEN, flag);
+	if (string == NULL) {
+		LEAVE();
+		return -ENOMEM;
+	}
+
+	moal_memcpy_ext(NULL, string, s + strlen("otp_mac_addr_rd_wr="),
+			len - strlen("otp_mac_addr_rd_wr="), OTP_RDWR_LEN - 1);
+
+	tmp = string;
+	pos = strsep(&string, " \t");
+	d->action = (t_u16)woal_string_to_number(pos);
+	if (d->action == MFALSE)
+		goto done;
+
+	pos = strsep(&string, " \t");
+	if (pos) {
+		char *begin, *end;
+		begin = pos;
+		for (i = 0; i < MLAN_MAC_ADDR_LENGTH; i++) {
+			end = woal_strsep(&begin, ':', '/');
+			if (end)
+				d->mac_addr[i] = woal_atox(end);
+		}
+	}
+
+	if (d->action > 1)
+		ret = -EINVAL;
+
+done:
+	kfree(tmp);
+	LEAVE();
+	return ret;
+}
+
+/*
+ *  @brief Parse mfg cmd otp cal data rdwr
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @param s        A pointer to user buffer
+ *  @param len      Length of user buffer
+ *  @param d        A pointer to mfg_cmd_generic_cfg struct
+ *  @return         0 on success, -EINVAL otherwise
+ */
+
+static int parse_otp_cal_data_rd_wr_string(const char *s, size_t len,
+					   mfg_cmd_otp_cal_data_rd_wr_t *d)
+{
+	int ret = MLAN_STATUS_SUCCESS;
+	char *string = NULL;
+	char *pos = NULL;
+	int i = 0;
+
+	ENTER();
+	if (!s || !d) {
+		LEAVE();
+		return -EINVAL;
+	}
+
+	string = (char *)&(s[strlen("otp_cal_data_rd_wr=")]);
+	pos = strsep(&string, " \t");
+	d->action = (t_u16)woal_string_to_number(pos);
+	if (d->action == MFALSE)
+		goto done;
+
+	for (i = 0; i < CAL_DATA_LEN; i++) {
+		pos = strsep(&string, " \t");
+		if (pos) {
+			d->cal_data[i] = (t_u16)woal_string_to_number(pos);
+			d->cal_data_len++;
+		}
+	}
+	if (d->action > 1)
+		ret = -EINVAL;
+done:
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief This function sends RF test mode command in firmware
  *
@@ -8585,6 +9149,20 @@
 			    buffer, len, &misc->param.mfg_tx_trigger_config))
 			err = MTRUE;
 		break;
+	case MFG_CMD_OTP_MAC_ADD:
+		misc->sub_command = MLAN_OID_MISC_OTP_MAC_RD_WR;
+		if (parse_otp_mac_addr_rd_wr_string(
+			    buffer, len, &misc->param.mfg_otp_mac_addr_rd_wr)) {
+			err = MTRUE;
+		}
+		break;
+	case MFG_CMD_OTP_CAL_DATA:
+		misc->sub_command = MLAN_OID_MISC_OTP_CAL_DATA_RD_WR;
+		if (parse_otp_cal_data_rd_wr_string(
+			    buffer, len, &misc->param.mfg_otp_cal_data_rd_wr)) {
+			err = MTRUE;
+		}
+		break;
 	default:
 		err = MTRUE;
 	}
@@ -8688,18 +9266,20 @@
 		handle->rf_data->tx_frame_data[12] =
 			misc->param.mfg_tx_frame2.stbc;
 		handle->rf_data->tx_frame_data[13] =
-			misc->param.mfg_tx_frame2.NumPkt;
+			misc->param.mfg_tx_frame2.signal_bw;
 		handle->rf_data->tx_frame_data[14] =
-			misc->param.mfg_tx_frame2.MaxPE;
+			misc->param.mfg_tx_frame2.NumPkt;
 		handle->rf_data->tx_frame_data[15] =
-			misc->param.mfg_tx_frame2.BeamChange;
+			misc->param.mfg_tx_frame2.MaxPE;
 		handle->rf_data->tx_frame_data[16] =
-			misc->param.mfg_tx_frame2.Dcm;
+			misc->param.mfg_tx_frame2.BeamChange;
 		handle->rf_data->tx_frame_data[17] =
-			misc->param.mfg_tx_frame2.Doppler;
+			misc->param.mfg_tx_frame2.Dcm;
 		handle->rf_data->tx_frame_data[18] =
-			misc->param.mfg_tx_frame2.MidP;
+			misc->param.mfg_tx_frame2.Doppler;
 		handle->rf_data->tx_frame_data[19] =
+			misc->param.mfg_tx_frame2.MidP;
+		handle->rf_data->tx_frame_data[20] =
 			misc->param.mfg_tx_frame2.QNum;
 		for (i = 0; i < ETH_ALEN; i++) {
 			handle->rf_data->bssid[i] =
@@ -8733,6 +9313,23 @@
 		handle->rf_data->mfg_tx_trigger_config.basic_trig_user_info =
 			misc->param.mfg_tx_trigger_config.basic_trig_user_info;
 		break;
+	case MFG_CMD_OTP_MAC_ADD:
+		handle->rf_data->mfg_otp_mac_addr_rd_wr.action =
+			misc->param.mfg_otp_mac_addr_rd_wr.action;
+		for (i = 0; i < ETH_ALEN; i++) {
+			handle->rf_data->mfg_otp_mac_addr_rd_wr.mac_addr[i] =
+				misc->param.mfg_otp_mac_addr_rd_wr.mac_addr[i];
+		}
+		break;
+	case MFG_CMD_OTP_CAL_DATA:
+		handle->rf_data->mfg_otp_cal_data_rd_wr.action =
+			misc->param.mfg_otp_cal_data_rd_wr.action;
+		for (i = 0; i < misc->param.mfg_otp_cal_data_rd_wr.cal_data_len;
+		     i++) {
+			handle->rf_data->mfg_otp_cal_data_rd_wr.cal_data[i] =
+				misc->param.mfg_otp_cal_data_rd_wr.cal_data[i];
+		}
+		break;
 	}
 done:
 	if (err || ret != MLAN_STATUS_PENDING)
@@ -8742,3 +9339,59 @@
 	return ret;
 }
 #endif /* RF_TEST_MODE */
+
+/**
+ *  @brief Configures edmac parameters based on region
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param country_code A pointer to country code
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING on success,
+ *                      otherwise failure code
+ */
+mlan_status woal_edmac_cfg(moal_private *priv, t_u8 *country_code)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *cfg = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	BOOLEAN is_etsi = MFALSE;
+
+	ENTER();
+
+	is_etsi = woal_is_etsi_country(country_code);
+	if (is_etsi == MFALSE && priv->phandle->is_edmac_enabled == MFALSE)
+		return MLAN_STATUS_SUCCESS;
+
+	if (is_etsi == MTRUE && priv->phandle->is_edmac_enabled == MTRUE)
+		return MLAN_STATUS_SUCCESS;
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		status = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	cfg = (mlan_ds_misc_cfg *)req->pbuf;
+	cfg->sub_command = MLAN_OID_MISC_EDMAC_CONFIG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	if (is_etsi)
+		req->action = MLAN_ACT_SET;
+	else
+		req->action = MLAN_ACT_CLEAR;
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MMSG, "Failed to configure edmac\n");
+		goto done;
+	}
+
+	if (is_etsi)
+		priv->phandle->is_edmac_enabled = MTRUE;
+	else
+		priv->phandle->is_edmac_enabled = MFALSE;
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return status;
+}
diff --git a/wlan_sd8987/mlinux/moal_main.c b/wlan_src/mlinux/moal_main.c
old mode 100755
new mode 100644
similarity index 75%
rename from wlan_sd8987/mlinux/moal_main.c
rename to wlan_src/mlinux/moal_main.c
index 8d3c16d..592aa90
--- a/wlan_sd8987/mlinux/moal_main.c
+++ b/wlan_src/mlinux/moal_main.c
@@ -4,20 +4,28 @@
  * driver.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -75,6 +83,16 @@
 #endif
 #endif
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+#include <linux/ktime.h>
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+#include <linux/hrtimer.h>
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+#include <linux/rtc.h>
+#include <linux/utsname.h>
+#endif
+
 /********************************************************
 		 Global Variables
  ********************************************************/
@@ -119,13 +137,17 @@
 	.scratch_reg = 0x60,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0,
 	.fw_reset_reg = 0x64,
 	.fw_reset_val = 0,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
 	.slew_rate_reg = 0x8000231C,
 	.slew_rate_bit_offset = 14,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 0,
+	.host_mlme_required = 0,
 };
 #endif
 #ifdef SD8887
@@ -155,13 +177,18 @@
 	.scratch_reg = 0x90,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0,
 	.fw_reset_reg = 0x0B6,
 	.fw_reset_val = 1,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0x90,
 	.slew_rate_reg = 0x80002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 0,
 	.per_pkt_cfg_support = 0,
+	.host_mlme_required = 0,
 };
 #endif
 
@@ -191,13 +218,18 @@
 	.scratch_reg = 0xc0,
 	.func1_reg_start = 0x04,
 	.func1_reg_end = 0x0b,
+	.fw_stuck_code_reg = 0,
 	.fw_reset_reg = 0x0E8,
 	.fw_reset_val = 1,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xC0,
 	.slew_rate_reg = 0x80002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 0,
 	.per_pkt_cfg_support = 0,
+	.host_mlme_required = 0,
 };
 #endif
 
@@ -216,8 +248,10 @@
 	.rev_id_reg = 0x0c58,
 	.fw_name = PCIE8897_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE8897_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0,
 	.sniffer_support = 0,
 	.per_pkt_cfg_support = 0,
+	.host_mlme_required = 0,
 };
 #endif
 
@@ -237,6 +271,7 @@
 	.fw_name_wlan = USB8897_DEFAULT_WLAN_FW_NAME,
 	.sniffer_support = 0,
 	.per_pkt_cfg_support = 0,
+	.host_mlme_required = 0,
 };
 #endif
 
@@ -269,13 +304,18 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x80002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -308,20 +348,25 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x80002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
 #ifdef SD8997
 static struct _card_info card_info_SD8997 = {
 	.embedded_supp = 1,
-	.drcs = 1,
+	.drcs = 0,
 	.go_noa = 1,
 	.v16_fw_api = 1,
 	.pmic = 1,
@@ -347,13 +392,18 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x80002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -387,13 +437,18 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x90002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -427,18 +482,23 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x90002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
-#ifdef SDNW62X
-static struct _card_info card_info_SDNW62X = {
+#ifdef SDIW624
+static struct _card_info card_info_SDIW624 = {
 	.embedded_supp = 1,
 	.drcs = 1,
 	.go_noa = 1,
@@ -453,8 +513,8 @@
 	.rev_id_reg = 0xc8,
 	.host_strap_reg = 0xf4,
 	.magic_reg = 0xf0,
-	.fw_name = SDNW62X_DEFAULT_COMBO_FW_NAME,
-	.fw_name_wlan = SDNW62X_DEFAULT_WLAN_FW_NAME,
+	.fw_name = SDIW624_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = SDIW624_DEFAULT_WLAN_FW_NAME,
 #ifdef SDIO
 	.dump_fw_info = DUMP_FW_SDIO_V3,
 	.dump_fw_ctrl_reg = 0xf9,
@@ -467,13 +527,63 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x90002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
+};
+#endif
+
+#ifdef SDAW693
+static struct _card_info card_info_SDAW693 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.histogram_table_num = 3,
+	.feature_control = FEATURE_CTRL_DEFAULT,
+	.rev_id_reg = 0xc8,
+	.host_strap_reg = 0xf4,
+	.magic_reg = 0xf0,
+	.fw_name = SDAW693_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = SDAW693_DEFAULT_WLAN_FW_NAME,
+#ifdef SDIO
+	.dump_fw_info = DUMP_FW_SDIO_V3,
+	.dump_fw_ctrl_reg = 0xf9,
+	.dump_fw_start_reg = 0xf1,
+	.dump_fw_end_reg = 0xf8,
+	.dump_fw_host_ready = 0xcc,
+	.dump_reg.reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60, 0x61, 0x62, 0x64,
+			       0x65, 0x66, 0x68, 0x69, 0x6a},
+	.dump_reg.reg_table_size = 13,
+	.scratch_reg = 0xe8,
+	.func1_reg_start = 0x10,
+	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
+	.fw_reset_reg = 0x0EE,
+	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
+	.slew_rate_reg = 0x90002328,
+	.slew_rate_bit_offset = 12,
+#endif
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -507,20 +617,69 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x90002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
+};
+#endif
+
+#ifdef SDIW610
+static struct _card_info card_info_SDIW610 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.histogram_table_num = 3,
+	.feature_control = FEATURE_CTRL_DEFAULT & (~FEATURE_CTRL_STREAM_2X2),
+	.rev_id_reg = 0xc8,
+	.host_strap_reg = 0xf4,
+	.magic_reg = 0xf0,
+	.fw_name = SDIW610_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = SDIW610_DEFAULT_WLAN_FW_NAME,
+#ifdef SDIO
+	.dump_fw_info = DUMP_FW_SDIO_V3,
+	.dump_fw_ctrl_reg = 0xf9,
+	.dump_fw_start_reg = 0xf1,
+	.dump_fw_end_reg = 0xf8,
+	.dump_fw_host_ready = 0xcc,
+	.dump_reg.reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60, 0x61, 0x62, 0x64,
+			       0x65, 0x66, 0x68, 0x69, 0x6a},
+	.dump_reg.reg_table_size = 13,
+	.scratch_reg = 0xe8,
+	.func1_reg_start = 0x10,
+	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
+	.fw_reset_reg = 0x0EE,
+	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
+	.slew_rate_reg = 0x45001064,
+	.slew_rate_bit_offset = 16,
+#endif
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
 };
 #endif
 
 #ifdef PCIE8997
 static struct _card_info card_info_PCIE8997 = {
 	.embedded_supp = 1,
-	.drcs = 1,
+	.drcs = 0,
 	.go_noa = 1,
 	.v16_fw_api = 1,
 	.pmic = 1,
@@ -534,8 +693,13 @@
 	.magic_reg = 0x0cd4,
 	.fw_name = PCIE8997_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE8997_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0xcf8,
+	.fw_reset_reg = 0xcf4,
+	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0x0c48,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -557,8 +721,13 @@
 	.magic_reg = 0x1c74,
 	.fw_name = PCIE9097_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE9097_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0x1c80,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
+	.fw_wakeup_reg = 0x0,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -580,13 +749,18 @@
 	.magic_reg = 0x1c74,
 	.fw_name = PCIE9098_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE9098_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0x1c98,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
+	.fw_wakeup_reg = 0x0,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
-#ifdef PCIENW62X
-static struct _card_info card_info_PCIENW62X = {
+#ifdef PCIEIW624
+static struct _card_info card_info_PCIEIW624 = {
 	.embedded_supp = 1,
 	.drcs = 1,
 	.go_noa = 1,
@@ -601,10 +775,45 @@
 	.rev_id_reg = 0x8,
 	.host_strap_reg = 0x1c70,
 	.magic_reg = 0x1c74,
-	.fw_name = PCIENW62X_DEFAULT_COMBO_FW_NAME,
-	.fw_name_wlan = PCIENW62X_DEFAULT_WLAN_FW_NAME,
+	.boot_mode_reg = 0x1c8c,
+	.fw_name = PCIEIW624_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = PCIEIW624_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0x1c80,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
+	.fw_wakeup_reg = 0x0,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
+};
+#endif
+
+#ifdef PCIEAW693
+static struct _card_info card_info_PCIEAW693 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.histogram_table_num = 3,
+	.feature_control = FEATURE_CTRL_DEFAULT,
+	.rev_id_reg = 0x8,
+	.host_strap_reg = 0x1c70,
+	.magic_reg = 0x1c74,
+	.boot_mode_reg = 0x1c8c,
+	.fw_name = PCIEAW693_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = PCIEAW693_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0x1c80,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
+	.fw_wakeup_reg = 0x0,
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -626,6 +835,7 @@
 	.fw_name_wlan = USB8801_DEFAULT_WLAN_FW_NAME,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 0,
+	.host_mlme_required = 0,
 };
 #endif
 
@@ -645,6 +855,7 @@
 	.fw_name_wlan = USB8978_DEFAULT_WLAN_FW_NAME,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -664,6 +875,7 @@
 	.fw_name_wlan = USB8997_DEFAULT_WLAN_FW_NAME,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -684,6 +896,7 @@
 	.fw_name_wlan = USB9098_DEFAULT_WLAN_FW_NAME,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
@@ -704,11 +917,12 @@
 	.fw_name_wlan = USB9097_WLAN_V1_FW_NAME,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
-#ifdef USBNW62X
-static struct _card_info card_info_USBNW62X = {
+#ifdef USBIW624
+static struct _card_info card_info_USBIW624 = {
 	.embedded_supp = 1,
 	.drcs = 1,
 	.go_noa = 1,
@@ -720,8 +934,29 @@
 	.rx_rate_max = 412,
 	.feature_control = FEATURE_CTRL_DEFAULT,
 	.histogram_table_num = 3,
-	.fw_name = USBNW62X_DEFAULT_COMBO_FW_NAME,
-	.fw_name_wlan = USBNW62X_DEFAULT_WLAN_FW_NAME,
+	.fw_name = USBIW624_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = USBIW624_DEFAULT_WLAN_FW_NAME,
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
+};
+#endif
+
+#ifdef USBIW610
+static struct _card_info card_info_USBIW610 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.feature_control = FEATURE_CTRL_DEFAULT,
+	.histogram_table_num = 3,
+	.fw_name = USBIW610_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = USBIW610_DEFAULT_WLAN_FW_NAME,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
 };
@@ -755,20 +990,26 @@
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
+	.fw_wakeup_reg = 0,
+	.fw_wakeup_val = 2,
+	.fw_winner_status_reg = 0xFC,
 	.slew_rate_reg = 0x80002328,
 	.slew_rate_bit_offset = 12,
 #endif
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
+	.host_mlme_required = 1,
 };
 #endif
 
+#define NXP_ETH_P_EAPOL 0x888E
+
 /** Driver version */
 char driver_version[] =
-	INTF_CARDTYPE KERN_VERSION "--" MLAN_RELEASE_VERSION "-GPL"
-				   "-("
+	INTF_CARDTYPE KERN_VERSION "--" MLAN_RELEASE_VERSION "-("
 				   "FP" FPNUM ")"
 #ifdef DEBUG_LEVEL2
 				   "-dbg"
@@ -832,11 +1073,8 @@
 	.moal_assert = moal_assert,
 	.moal_hist_data_add = moal_hist_data_add,
 	.moal_updata_peer_signal = moal_updata_peer_signal,
+	.moal_get_host_time_ns = moal_get_host_time_ns,
 	.moal_do_div = moal_do_div,
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	.moal_wait_hostcmd_complete = moal_wait_hostcmd_complete,
-	.moal_notify_hostcmd_complete = moal_notify_hostcmd_complete,
-#endif
 	.moal_tp_accounting = moal_tp_accounting,
 	.moal_tp_accounting_rx_param = moal_tp_accounting_rx_param,
 	.moal_amsdu_tp_accounting = moal_amsdu_tp_accounting,
@@ -888,6 +1126,57 @@
 /** register work */
 static struct work_struct register_work;
 
+#ifdef DUMP_TO_PROC
+#define MAX_BUF_SIZE 100
+/**
+ *  @brief This function writes the fw dump in kernel(dmesg) log
+ *
+ *  @param pfd_buf       pointer to fw dump buffer
+ *  @param fwdump_len    length of fw dump buffer
+ *
+ *  @return              N/A
+ */
+void woal_print_firmware_dump_buf(t_u8 *pfd_buf, t_u64 fwdump_len)
+{
+	t_u64 i = 0, count = 0;
+	u8 buf[MAX_BUF_SIZE] = {0};
+	u8 *ptr = NULL;
+	ENTER();
+
+	if (!pfd_buf || !fwdump_len) {
+		PRINTM(MERROR,
+		       "%s: fw dump buffer is NULL or total length is zero\n",
+		       __func__);
+		return;
+	}
+
+	PRINTM(MFW_D, "===== FW Dump To Console START=====\n");
+	for (i = 0; ((i < fwdump_len) && ((i + 15) < fwdump_len)); i += 16) {
+		PRINTM(MFW_D,
+		       "[FW Dump] %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X\n",
+		       pfd_buf[i], pfd_buf[i + 1], pfd_buf[i + 2],
+		       pfd_buf[i + 3], pfd_buf[i + 4], pfd_buf[i + 5],
+		       pfd_buf[i + 6], pfd_buf[i + 7], pfd_buf[i + 8],
+		       pfd_buf[i + 9], pfd_buf[i + 10], pfd_buf[i + 11],
+		       pfd_buf[i + 12], pfd_buf[i + 13], pfd_buf[i + 14],
+		       pfd_buf[i + 15]);
+		count++;
+		moal_usleep_range(NULL, 40, 50);
+	}
+
+	if (i < fwdump_len) {
+		ptr = buf;
+		for (; i < fwdump_len; i++) {
+			ptr += snprintf(ptr, MAX_BUF_SIZE, " %02X", pfd_buf[i]);
+		}
+		PRINTM(MFW_D, "[FW Dump]%s\n", buf);
+	}
+
+	PRINTM(MFW_D, "===== FW Dump To Console END=====\n");
+	PRINTM(MFW_D, "FW Dump buffer length = %llu\n", fwdump_len);
+}
+#endif
+
 /**
  *  @brief This function send fw dump event to kernel
  *
@@ -945,6 +1234,34 @@
 		MOAL_REL_SEMAPHORE(&handle->async_sem);
 	}
 #endif
+#ifdef UAP_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
+	if (IS_STA_CFG80211(cfg80211_wext) && handle->is_cac_timer_set &&
+	    (handle->cac_bss_index != 0xff)) {
+		woal_cancel_timer(&handle->cac_timer);
+		handle->is_cac_timer_set = MFALSE;
+		handle->cac_period = MFALSE;
+		priv = handle->priv[handle->cac_bss_index];
+		if (priv) {
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+			cfg80211_cac_event(priv->netdev, &handle->dfs_channel,
+					   NL80211_RADAR_CAC_ABORTED,
+					   GFP_KERNEL);
+#else
+			cfg80211_cac_event(priv->netdev,
+					   NL80211_RADAR_CAC_ABORTED,
+					   GFP_KERNEL);
+#endif
+			if (priv->csa_workqueue)
+				flush_workqueue(priv->csa_workqueue);
+		}
+		memset(&handle->dfs_channel, 0,
+		       sizeof(struct cfg80211_chan_def));
+		handle->cac_bss_index = 0xff;
+	}
+#endif
+#endif
+
 	for (i = 0; i < handle->priv_num; i++) {
 		if (handle->priv[i]) {
 			priv = handle->priv[i];
@@ -957,17 +1274,18 @@
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
 			if (IS_STA_CFG80211(cfg80211_wext) && priv->wdev &&
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			    priv->wdev->connected) {
 #else
 			    priv->wdev->current_bss) {
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 				if (priv->host_mlme)
-					woal_host_mlme_disconnect(
+					woal_deauth_event(
 						priv,
 						MLAN_REASON_DEAUTH_LEAVING,
-						NULL);
+						priv->cfg_bssid);
 				else
 #endif
 					cfg80211_disconnected(priv->netdev, 0,
@@ -983,7 +1301,7 @@
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 			if (IS_STA_CFG80211(cfg80211_wext) &&
-			    priv->sched_scanning) {
+			    priv->sched_scanning && priv->wdev) {
 				priv->bg_scan_start = MFALSE;
 				priv->bg_scan_reported = MFALSE;
 				cfg80211_sched_scan_stopped(priv->wdev->wiphy
@@ -998,10 +1316,150 @@
 #endif
 		}
 	}
+	woal_flush_evt_queue(handle);
 	return;
 }
 
 /**
+ *  @brief This function send the auto recovery failure event to userspace using
+ * netlink
+ *
+ *  @param handle       Pointer to structure moal_handle
+ *
+ *  @return        N/A
+ */
+void woal_send_auto_recovery_failure_event(moal_handle *handle)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	struct sk_buff *skb = NULL;
+	struct nlmsghdr *nlh = NULL;
+	struct sock *sk = handle->nl_sk;
+	int len = strlen(CUS_EVT_FW_RECOVER_FAIL);
+	ENTER();
+
+	/* interface name to be prepended to event */
+	/* NL_MAX_PAYLOAD = 3 * 1024 */
+	if ((len + IFNAMSIZ) > NL_MAX_PAYLOAD) {
+		PRINTM(MERROR, "event size is too big, len=%d\n", (int)len);
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	if (sk) {
+		/* Allocate skb */
+		skb = alloc_skb(NLMSG_SPACE(NL_MAX_PAYLOAD), GFP_ATOMIC);
+		if (!skb) {
+			PRINTM(MERROR, "Could not allocate skb for netlink\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+		memset(skb->data, 0, NLMSG_SPACE(NL_MAX_PAYLOAD));
+
+		nlh = (struct nlmsghdr *)skb->data;
+		nlh->nlmsg_len = NLMSG_SPACE(len + IFNAMSIZ);
+
+		/* From kernel */
+		nlh->nlmsg_pid = 0;
+		nlh->nlmsg_flags = 0;
+
+		/* Data */
+		skb_put(skb, nlh->nlmsg_len);
+		moal_memcpy_ext(handle, NLMSG_DATA(nlh), "wlan", sizeof("wlan"),
+				nlh->nlmsg_len - NLMSG_LENGTH(0));
+
+		moal_memcpy_ext(handle, ((t_u8 *)(NLMSG_DATA(nlh))) + IFNAMSIZ,
+				CUS_EVT_FW_RECOVER_FAIL, len,
+				nlh->nlmsg_len - NLMSG_LENGTH(IFNAMSIZ));
+
+		/* From Kernel */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0)
+		NETLINK_CB(skb).pid = 0;
+#else
+		NETLINK_CB(skb).portid = 0;
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20)
+		/* Multicast message */
+		NETLINK_CB(skb).dst_pid = 0;
+#endif
+
+		/* Multicast group number */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+		NETLINK_CB(skb).dst_groups = NL_MULTICAST_GROUP;
+#else
+		NETLINK_CB(skb).dst_group = NL_MULTICAST_GROUP;
+#endif
+
+		/* Send message */
+		ret = netlink_broadcast(sk, skb, 0, NL_MULTICAST_GROUP,
+					GFP_ATOMIC);
+		if (ret) {
+			PRINTM(MWARN, "netlink_broadcast failed: ret=%d\n",
+			       ret);
+			goto done;
+		}
+
+	} else {
+		PRINTM(MERROR,
+		       "Could not send event through NETLINK. Link down.\n");
+	}
+done:
+	LEAVE();
+}
+
+/**
+ *  @brief This function send the auto recovery complete event to kernel
+ *
+ *  @param handle       Pointer to structure moal_handle
+ *
+ *  @return        N/A
+ */
+void woal_send_auto_recovery_complete_event(moal_handle *handle)
+{
+	moal_private *priv;
+	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
+	if (priv) {
+		woal_broadcast_event(priv, CUS_EVT_FW_RECOVER_SUCCESS,
+				     strlen(CUS_EVT_FW_RECOVER_SUCCESS));
+#ifdef STA_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+		if (IS_STA_OR_UAP_CFG80211(handle->params.cfg80211_wext))
+			woal_cfg80211_vendor_event(
+				priv, event_fw_reset_success,
+				CUS_EVT_FW_RECOVER_SUCCESS,
+				strlen(CUS_EVT_FW_RECOVER_SUCCESS));
+#endif
+#endif
+	}
+	reset_handle = NULL;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+/**
+ *  @brief This function reads hostname
+ *
+ *  @hostname	Pointer to hostname
+ *  @return	N/A
+ */
+static void woal_get_hostname(char *hostname)
+{
+	snprintf(hostname, MAX_HOSTNAME_LEN, "%s ", utsname()->nodename);
+}
+
+/**
+ *  @brief This function reads real time
+ *
+ *  @tstamp	Pointer to timestamp
+ *  @return	N/A
+ */
+static void woal_get_timestamp(char *tstamp)
+{
+	struct rtc_time time;
+	time = rtc_ktime_to_tm(ktime_get_real());
+	snprintf(tstamp, MAX_TIME_LEN, "%ptRs\n", &time);
+}
+#endif
+
+/**
  *  @brief This function process FW hang
  *
  *  @param handle       Pointer to structure moal_handle
@@ -1014,6 +1472,7 @@
 	moal_private *priv;
 	int cfg80211_wext = 0;
 	int ret = 0;
+	t_u8 reload_mode = 0;
 	ENTER();
 	if (!reset_handle) {
 		LEAVE();
@@ -1054,17 +1513,18 @@
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
 			if (IS_STA_CFG80211(cfg80211_wext) && priv->wdev &&
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			    priv->wdev->connected) {
 #else
 			    priv->wdev->current_bss) {
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 				if (priv->host_mlme)
-					woal_host_mlme_disconnect(
+					woal_deauth_event(
 						priv,
 						MLAN_REASON_DEAUTH_LEAVING,
-						NULL);
+						priv->cfg_bssid);
 				else
 #endif
 					cfg80211_disconnected(priv->netdev, 0,
@@ -1080,7 +1540,7 @@
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 			if (IS_STA_CFG80211(cfg80211_wext) &&
-			    priv->sched_scanning) {
+			    priv->sched_scanning && priv->wdev) {
 				priv->bg_scan_start = MFALSE;
 				priv->bg_scan_reported = MFALSE;
 				cfg80211_sched_scan_stopped(priv->wdev->wiphy
@@ -1111,6 +1571,7 @@
 #endif
 #endif
 		}
+
 		if (IS_SD(reset_handle->card_type)) {
 			PRINTM(MMSG, "WIFI auto_fw_reload: fw_reload=1\n");
 			ret = woal_request_fw_reload(
@@ -1118,53 +1579,21 @@
 		}
 #ifdef PCIE
 		else if (IS_PCIE(reset_handle->card_type)) {
-			reset_handle->init_wait_q_woken = MFALSE;
-			PRINTM(MMSG, "WIFI auto_fw_reload: fw_reload=4\n");
-			ret = woal_request_fw_reload(reset_handle,
-						     FW_RELOAD_PCIE_RESET);
-			if (!ret) {
-				/* Wait for FLR to complete */
-				wait_event_timeout(
-					reset_handle->init_wait_q,
-					reset_handle->init_wait_q_woken,
-					10 * HZ);
-				if (reset_handle->hardware_status !=
-				    HardwareStatusReady)
-					ret = -1;
-			}
-		}
-#endif
-		priv = woal_get_priv(reset_handle, MLAN_BSS_ROLE_ANY);
-		if (priv) {
-			if (ret) {
-				woal_broadcast_event(
-					priv, CUS_EVT_FW_RECOVER_FAIL,
-					strlen(CUS_EVT_FW_RECOVER_FAIL));
-#ifdef STA_CFG80211
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-				if (IS_STA_OR_UAP_CFG80211(cfg80211_wext))
-					woal_cfg80211_vendor_event(
-						priv, event_fw_reset_failure,
-						CUS_EVT_FW_RECOVER_FAIL,
-						strlen(CUS_EVT_FW_RECOVER_FAIL));
-#endif
-#endif
+			if (reset_handle->params.auto_fw_reload &
+			    AUTO_FW_RELOAD_PCIE_INBAND_RESET) {
+				PRINTM(MMSG,
+				       "WIFI auto_fw_reload: fw_reload=6\n");
+				ret = woal_request_fw_reload(
+					reset_handle,
+					FW_RELOAD_PCIE_INBAND_RESET);
 			} else {
-				woal_broadcast_event(
-					priv, CUS_EVT_FW_RECOVER_SUCCESS,
-					strlen(CUS_EVT_FW_RECOVER_SUCCESS));
-#ifdef STA_CFG80211
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-				if (IS_STA_OR_UAP_CFG80211(cfg80211_wext))
-					woal_cfg80211_vendor_event(
-						priv, event_fw_reset_success,
-						CUS_EVT_FW_RECOVER_SUCCESS,
-						strlen(CUS_EVT_FW_RECOVER_SUCCESS));
-#endif
-#endif
+				PRINTM(MMSG,
+				       "WIFI auto_fw_reload: fw_reload=4\n");
+				ret = woal_request_fw_reload(
+					reset_handle, FW_RELOAD_PCIE_RESET);
 			}
 		}
-		reset_handle = NULL;
+#endif
 		LEAVE();
 		return;
 	}
@@ -1174,10 +1603,17 @@
 				     strlen(CUS_EVT_DRIVER_HANG));
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-		if (IS_STA_OR_UAP_CFG80211(cfg80211_wext))
-			woal_cfg80211_vendor_event(priv, event_hang,
-						   CUS_EVT_DRIVER_HANG,
-						   strlen(CUS_EVT_DRIVER_HANG));
+		if (IS_STA_OR_UAP_CFG80211(cfg80211_wext)) {
+			PRINTM(MMSG, "Send event_hang(0x0) vendor event");
+			if (IS_SD(reset_handle->card_type)) {
+				reload_mode = FW_RELOAD_SDIO_INBAND_RESET;
+			} else if (IS_PCIE(reset_handle->card_type)) {
+				reload_mode = FW_RELOAD_PCIE_INBAND_RESET;
+				// Todo: add check for FW_RELOAD_PCIE_RESET -
+				// FLR
+			}
+			woal_cfg80211_driver_hang_event(priv, reload_mode);
+		}
 #endif
 #endif
 	}
@@ -1195,16 +1631,21 @@
 void woal_process_hang(moal_handle *handle)
 {
 	ENTER();
+	if (!handle || handle->fw_reseting ||
+	    (handle->hardware_status != HardwareStatusReady)) {
+		LEAVE();
+		return;
+	}
 	if (reset_handle == NULL) {
 		PRINTM(MMSG, "Start to process hanging\n");
 		reset_handle = handle;
 		queue_work(hang_workqueue, &hang_work);
 #ifdef ANDROID_KERNEL
 #define WAKE_LOCK_HANG 5000
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
-		__pm_wakeup_event(&reset_handle->ws, WAKE_LOCK_HANG);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+		__pm_wakeup_event(&handle->ws, WAKE_LOCK_HANG);
 #else
-		wake_lock_timeout(&reset_handle->wake_lock,
+		wake_lock_timeout(&handle->wake_lock,
 				  msecs_to_jiffies(WAKE_LOCK_HANG));
 #endif
 #endif
@@ -1352,7 +1793,7 @@
 #ifdef WIFI_DIRECT_SUPPORT
 	    && priv->bss_type != MLAN_BSS_TYPE_WIFIDIRECT
 #endif
-	) {
+	    && priv->bss_type != MLAN_BSS_TYPE_NAN) {
 		PRINTM(MIOCTL, "Bss type [%d] is not STA/P2P, ignore\n",
 		       (int)priv->bss_type);
 		ret = NOTIFY_DONE;
@@ -1423,6 +1864,65 @@
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
 #if IS_ENABLED(CONFIG_IPV6)
 /**
+ *  @brief This function deletes the IPv6 Address entry
+ *
+ *  @param priv      A pointer to moal_private structure
+ *
+ *  @return          N/A
+ */
+static void woal_remove_ipv6_address(moal_private *priv, t_u8 *addr)
+{
+	struct ipv6addr_entry *ipv6_entry = NULL, *tmp_ipv6_entry;
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->ipv6addr_lock, flags);
+	list_for_each_entry_safe (ipv6_entry, tmp_ipv6_entry,
+				  &priv->ipv6_addrses, link) {
+		if (memcmp(addr, ipv6_entry->ipv6_addr, IPADDR_LEN) == 0) {
+			priv->ipv6count -= 1;
+			list_del(&ipv6_entry->link);
+			kfree(ipv6_entry);
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&priv->ipv6addr_lock, flags);
+	if (list_empty(&priv->ipv6_addrses))
+		priv->ipv6_addr_configured = MFALSE;
+}
+
+/**
+ *  @brief This function adds the IPv6 Address entry
+ *
+ *  @param priv      A pointer to moal_private structure
+ *
+ *  @return          N/A
+ */
+static void woal_add_ipv6_address(moal_private *priv, t_u8 *addr)
+{
+	struct ipv6addr_entry *pipv6_entry = NULL, *ipv6_entry = NULL;
+	unsigned long flags;
+
+	list_for_each_entry (ipv6_entry, &priv->ipv6_addrses, link) {
+		if (!memcmp(ipv6_entry->ipv6_addr, addr, IPADDR_LEN)) {
+			PRINTM(MIOCTL, "ipv6 addr already exists\n");
+			return;
+		}
+	}
+
+	pipv6_entry = kzalloc(sizeof(struct ipv6addr_entry), GFP_ATOMIC);
+	if (pipv6_entry) {
+		spin_lock_irqsave(&priv->ipv6addr_lock, flags);
+		INIT_LIST_HEAD(&pipv6_entry->link);
+		moal_memcpy_ext(priv->phandle, pipv6_entry->ipv6_addr,
+				(t_u8 *)addr, IPADDR_LEN, IPADDR_LEN);
+		list_add_tail(&pipv6_entry->link, &priv->ipv6_addrses);
+		spin_unlock_irqrestore(&priv->ipv6addr_lock, flags);
+		priv->ipv6count += 1;
+	}
+	priv->ipv6_addr_configured = MTRUE;
+}
+
+/**
  *  @brief This function handle the net interface ipv6 address change event
  *
  *  @param nb      pointer to the notifier_block
@@ -1438,7 +1938,7 @@
 	struct net_device *ndev = ifa->idev->dev;
 	moal_private *priv;
 	int ret = NOTIFY_OK;
-
+	t_u8 addr[16] = {0};
 	ENTER();
 
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
@@ -1463,7 +1963,7 @@
 #ifdef WIFI_DIRECT_SUPPORT
 	    && priv->bss_type != MLAN_BSS_TYPE_WIFIDIRECT
 #endif
-	) {
+	    && priv->bss_type != MLAN_BSS_TYPE_NAN) {
 		PRINTM(MIOCTL, "Bss type [%d] is not STA/P2P, ignore\n",
 		       (int)priv->bss_type);
 		ret = NOTIFY_DONE;
@@ -1473,15 +1973,13 @@
 	switch (event) {
 	case NETDEV_UP:
 		PRINTM(MIOCTL, "[%s]: New ipv6 addr\n", ndev->name);
-		moal_memcpy_ext(priv->phandle, priv->ipv6_addr,
-				(t_u8 *)&ifa->addr, sizeof(priv->ipv6_addr),
-				sizeof(priv->ipv6_addr));
-		priv->ipv6_addr_configured = MTRUE;
+		moal_memcpy_ext(priv->phandle, addr, (t_u8 *)&ifa->addr,
+				sizeof(addr), sizeof(addr));
+		woal_add_ipv6_address(priv, addr);
 		break;
 	case NETDEV_DOWN:
 		PRINTM(MIOCTL, "[%s]: Ipv6 addr removed.\n", ndev->name);
-		memset(priv->ipv6_addr, 0, sizeof(priv->ipv6_addr));
-		priv->ipv6_addr_configured = MFALSE;
+		woal_remove_ipv6_address(priv, (t_u8 *)&ifa->addr);
 		break;
 	default:
 		PRINTM(MIOCTL, "[%s]: Ignore event: %u\n", ndev->name,
@@ -1750,9 +2248,6 @@
 		case MLAN_BSS_MODE_INFRA:
 			mode = MW_MODE_INFRA;
 			break;
-		case MLAN_BSS_MODE_IBSS:
-			mode = MW_MODE_ADHOC;
-			break;
 		default:
 			mode = MW_MODE_AUTO;
 			break;
@@ -1817,7 +2312,11 @@
 #ifdef WIFI_DIRECT_SUPPORT
 	int max_wfd_bss = handle->params.max_wfd_bss;
 #endif
+	int max_nan_bss = handle->params.max_nan_bss;
 	int max_dfs_bss = MAX_DFS_BSS;
+#ifdef UAP_SUPPORT
+	int max_uap_bss_limit = MAX_UAP_BSS;
+#endif
 
 	ENTER();
 
@@ -1837,7 +2336,9 @@
 
 #ifdef UAP_SUPPORT
 	if (drv_mode_local & DRV_MODE_UAP) {
-		if ((max_uap_bss < 1) || (max_uap_bss > MAX_UAP_BSS)) {
+		if (handle->pref_mac)
+			max_uap_bss_limit = MAX_UAP_BSS_DUAL_MAC;
+		if ((max_uap_bss < 1) || (max_uap_bss > max_uap_bss_limit)) {
 			PRINTM(MWARN,
 			       "Unsupported max_uap_bss (%d), setting to default\n",
 			       max_uap_bss);
@@ -1865,6 +2366,17 @@
 
 #endif /* WIFI_DIRECT_SUPPORT */
 
+	if (drv_mode_local & DRV_MODE_NAN) {
+		if ((max_nan_bss < 1) || (max_nan_bss > MAX_NAN_BSS)) {
+			PRINTM(MWARN,
+			       "Unsupported max_nan_bss (%d), setting to default\n",
+			       max_nan_bss);
+			max_nan_bss = DEF_NAN_BSS;
+		}
+		intf_num += max_nan_bss;
+		handle->params.max_nan_bss = max_nan_bss;
+	}
+
 	if (drv_mode_local & DRV_MODE_DFS)
 		intf_num += max_dfs_bss;
 	/* Create BSS attribute table */
@@ -1935,6 +2447,20 @@
 	}
 #endif /* WIFI_DIRECT_SUPPORT */
 
+	if (drv_mode_local & DRV_MODE_NAN) {
+		for (j = 0; j < max_nan_bss; j++) {
+			if (i >= (int)intf_num)
+				break;
+			bss_tbl[i].bss_type = MLAN_BSS_TYPE_NAN;
+			bss_tbl[i].frame_type = MLAN_DATA_FRAME_TYPE_ETH_II;
+			bss_tbl[i].active = MTRUE;
+			bss_tbl[i].bss_priority = 0;
+			bss_tbl[i].bss_num = j;
+			bss_tbl[i].bss_virtual = MFALSE;
+			i++;
+		}
+	}
+
 	if (drv_mode_local & DRV_MODE_DFS) {
 		for (j = 0; j < max_dfs_bss; j++) {
 			if (i >= (int)intf_num)
@@ -2003,6 +2529,16 @@
 	handle->hardware_status = HardwareStatusInitializing;
 	handle->main_state = MOAL_STATE_IDLE;
 
+#ifdef DEBUG_LEVEL1
+	drvdbg = handle->params.drvdbg;
+#endif
+
+#ifdef MFG_CMD_SUPPORT
+	mfg_mode = handle->params.mfg_mode;
+#endif
+
+	handle->fw_dump_status = MFALSE;
+
 #ifdef STA_SUPPORT
 	if ((handle->params.drv_mode & DRV_MODE_STA)
 #ifdef STA_WEXT
@@ -2057,7 +2593,7 @@
 
 	handle->is_suspended = MFALSE;
 	handle->hs_activated = MFALSE;
-	handle->hs_auto_arp = MFALSE;
+	handle->hs_auto_arp = (t_u8)handle->params.hs_auto_arp;
 	handle->suspend_fail = MFALSE;
 	handle->hs_skip_count = 0;
 	handle->hs_force_count = 0;
@@ -2157,6 +2693,19 @@
 #endif
 #endif
 
+	handle->rtt_capa.rtt_one_sided_supported = MTRUE;
+	handle->rtt_capa.rtt_ftm_supported = MTRUE;
+	handle->rtt_capa.lci_support = MTRUE;
+	handle->rtt_capa.lcr_support = MTRUE;
+	handle->rtt_capa.preamble_support =
+		PREAMBLE_LEGACY | PREAMBLE_HT | PREAMBLE_VHT;
+	handle->rtt_capa.bw_support =
+		BW_20_SUPPORT | BW_40_SUPPORT | BW_80_SUPPORT;
+	handle->rtt_capa.responder_supported = MTRUE;
+	handle->rtt_capa.mc_version = 60;
+	handle->is_edmac_enabled = MFALSE;
+	handle->driver_init = MFALSE;
+
 	/* Register to MLAN */
 	memset(&device, 0, sizeof(mlan_device));
 	device.pmoal_handle = handle;
@@ -2182,6 +2731,7 @@
 		(t_u32)moal_extflg_isset(handle, EXT_FIX_BCN_BUF);
 	device.auto_ds = (t_u32)handle->params.auto_ds;
 	device.ext_scan = (t_u8)handle->params.ext_scan;
+	device.bootup_cal_ctrl = handle->params.bootup_cal_ctrl;
 	device.ps_mode = (t_u32)handle->params.ps_mode;
 	device.passive_to_active_scan = (t_u8)handle->params.p2a_scan;
 	device.max_tx_buf = (t_u32)handle->params.max_tx_buf;
@@ -2202,9 +2752,9 @@
 		device.gpio_pin = (t_u32)handle->params.gpiopin;
 #ifdef SDIO_MMC
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)
-		device.max_segs = ((struct sdio_mmc_card *)handle->card)
+		device.max_segs = ((sdio_mmc_card *)handle->card)
 					  ->func->card->host->max_segs;
-		device.max_seg_size = ((struct sdio_mmc_card *)handle->card)
+		device.max_seg_size = ((sdio_mmc_card *)handle->card)
 					      ->func->card->host->max_seg_size;
 #endif
 		PRINTM(MMSG, "SDIO: max_segs=%d max_seg_size=%d\n",
@@ -2237,8 +2787,12 @@
 	}
 	PRINTM(MMSG, "rx_work=%d cpu_num=%d\n", device.rx_work,
 	       num_possible_cpus());
-	if (moal_extflg_isset(handle, EXT_NAPI))
+	if (moal_extflg_isset(handle, EXT_NAPI)) {
 		device.rx_work = MTRUE;
+		device.napi = MTRUE;
+	} else {
+		device.napi = MFALSE;
+	}
 
 	device.dev_cap_mask = handle->params.dev_cap_mask;
 
@@ -2247,7 +2801,9 @@
 	device.inact_tmo = handle->params.inact_tmo;
 #ifdef UAP_SUPPORT
 	device.uap_max_sta = handle->params.uap_max_sta;
+	device.wacp_mode = handle->params.wacp_mode;
 #endif
+	device.fw_data_cfg = handle->params.fw_data_cfg;
 	device.mcs32 = handle->params.mcs32;
 	device.hs_wake_interval = handle->params.hs_wake_interval;
 	device.indication_gpio = handle->params.indication_gpio;
@@ -2257,6 +2813,13 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 	device.dfs_offload = moal_extflg_isset(handle, EXT_DFS_OFFLOAD);
 #endif
+	device.second_mac = handle->second_mac;
+	device.antcfg = handle->params.antcfg;
+	device.dmcs = handle->params.dmcs;
+	device.pref_dbc = handle->params.pref_dbc;
+	device.reject_addba_req = handle->params.reject_addba_req;
+	device.disable_11h_tpc = (t_u32)handle->params.disable_11h_tpc;
+	device.amsdu_disable = handle->params.amsdu_disable;
 
 	for (i = 0; i < handle->drv_mode.intf_num; i++) {
 		device.bss_attr[i].bss_type =
@@ -2271,6 +2834,13 @@
 		device.bss_attr[i].bss_virtual =
 			handle->drv_mode.bss_attr[i].bss_virtual;
 	}
+
+	device.max_tx_pending = handle->params.mclient_scheduling ?
+					MCLIENT_MAX_TX_PENDING :
+					MAX_TX_PENDING;
+	device.tx_budget = handle->params.tx_budget;
+	device.mclient_scheduling = handle->params.mclient_scheduling;
+
 	moal_memcpy_ext(handle, &device.callbacks, &woal_callbacks,
 			sizeof(mlan_callbacks), sizeof(mlan_callbacks));
 	if (!handle->params.amsdu_deaggr)
@@ -2347,6 +2917,10 @@
 	}
 #endif
 
+	if (handle->is_fw_dump_timer_set) {
+		woal_cancel_timer(&handle->fw_dump_timer);
+		handle->is_fw_dump_timer_set = MFALSE;
+	}
 	/* Free allocated memory for fwdump filename */
 	kfree(handle->fwdump_fname);
 	if (fwdump_fname) {
@@ -2533,6 +3107,10 @@
 	moal_private *priv = NULL;
 	t_u32 new_value = 0;
 	t_u32 reg_type = MLAN_REG_MAC;
+	int status;
+	t_u32 i = 0;
+	t_u32 roll_count = 1;
+	t_u8 slew_rate_bit_offset = handle->card_info->slew_rate_bit_offset;
 
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 	if (!priv)
@@ -2541,31 +3119,41 @@
 	if ((handle->card_info->slew_rate_reg != 0) &&
 	    (handle->params.slew_rate > 3 || handle->params.slew_rate < 0))
 		return MLAN_STATUS_FAILURE;
-#if defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177)
+#if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
+	defined(SDAW693) || defined(SD9177) || defined(SDIW610)
 	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
-	    IS_SDNW62X(handle->card_type) || IS_SD9177(handle->card_type))
+	    IS_SDIW624(handle->card_type) || IS_SDIW610(handle->card_type) ||
+	    IS_SD9177(handle->card_type))
 		reg_type = MLAN_REG_CIU;
 #endif
 
-	ret = woal_getset_regrdwr(priv, MLAN_ACT_GET, reg_type,
-				  handle->card_info->slew_rate_reg, &value);
-	if (ret < 0) {
+#if defined(SDIW610)
+	if (IS_SDIW610(handle->card_type))
+		roll_count = 6;
+#endif
+
+	status = woal_getset_regrdwr(priv, MLAN_ACT_GET, reg_type,
+				     handle->card_info->slew_rate_reg, &value);
+	if (status < 0) {
 		PRINTM(MERROR, "woal_getset_regrdwr get REG_MAC failed\n");
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-	new_value = value & ~(0x3 << handle->card_info->slew_rate_bit_offset);
-	new_value |= (t_u32)handle->params.slew_rate
-		     << handle->card_info->slew_rate_bit_offset;
+	for (i = 0; i < roll_count; i++) {
+		slew_rate_bit_offset += 2 * i;
+		new_value = value & ~(0x3 << slew_rate_bit_offset);
+		new_value |= (t_u32)handle->params.slew_rate
+			     << slew_rate_bit_offset;
+	}
 
 	if (value != new_value) {
 		PRINTM(MMSG, "Set REG 0x%8x: 0x%x slew_rate=%d\n",
 		       handle->card_info->slew_rate_reg, new_value,
 		       handle->params.slew_rate);
-		ret = woal_getset_regrdwr(priv, MLAN_ACT_SET, reg_type,
-					  handle->card_info->slew_rate_reg,
-					  &new_value);
-		if (ret < 0) {
+		status = woal_getset_regrdwr(priv, MLAN_ACT_SET, reg_type,
+					     handle->card_info->slew_rate_reg,
+					     &new_value);
+		if (status < 0) {
 			PRINTM(MERROR,
 			       "woal_getset_regrdwr get REG_MAC failed\n");
 			ret = MLAN_STATUS_FAILURE;
@@ -2846,7 +3434,7 @@
 		goto done;
 	}
 	ptr = buf;
-	strcpy(ptr, CMD_STR);
+	strncpy(ptr, CMD_STR, CMD_BUF_LEN);
 	ptr = buf + strlen(CMD_STR) + sizeof(t_u32);
 	while ((pos - data) < size) {
 		while (*pos == ' ' || *pos == '\t')
@@ -3399,7 +3987,7 @@
 	}
 	if (handle->user_data) {
 		cfg_data = (t_u8 *)(handle->user_data)->data;
-		len = (handle->user_data)->size;
+		len = (t_size)((handle->user_data)->size);
 		if (type == INIT_HOSTCMD_CFG_DATA ||
 		    type == BAND_STEER_CFG_DATA ||
 		    type == COUNTRY_POWER_TABLE) {
@@ -3520,7 +4108,7 @@
 }
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 static ssize_t woal_set_rps_map(struct netdev_rx_queue *queue, const char *buf,
 				size_t len)
 {
@@ -3545,7 +4133,7 @@
 		PRINTM(MERROR, "%s: bitmap_parse fail err=%d.\n", __func__,
 		       err);
 		free_cpumask_var(mask);
-		return err;
+		return -EINVAL;
 	}
 
 	map = kzalloc(max_t(unsigned int, RPS_MAP_SIZE(cpumask_weight(mask)),
@@ -3614,9 +4202,10 @@
 	char str_buf[MLAN_MAX_VER_STR_LEN];
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
+	int j;
 	moal_private *priv_rps = NULL;
-	t_u8 rps_buf[2];
+	t_u8 rps_buf[3];
 #endif
 #endif
 
@@ -3645,6 +4234,14 @@
 			goto err;
 		}
 	}
+	if (handle->sec_rgpower &&
+	    handle->params.cntry_txpwr != CNTRY_RGPOWER_MODE) {
+		PRINTM(MERROR, "wlan: invalid cntry_txpwr mode=%d\n",
+		       handle->params.cntry_txpwr);
+		woal_set_rgpower_table(handle);
+		ret = MLAN_STATUS_FAILURE;
+		goto err;
+	}
 	woal_get_version(handle, str_buf, sizeof(str_buf) - 1);
 	PRINTM(MMSG, "wlan: version = %s\n", str_buf);
 
@@ -3712,15 +4309,6 @@
 		}
 	}
 
-	if (handle->params.antcfg) {
-		if (MLAN_STATUS_SUCCESS !=
-		    woal_set_user_antcfg(handle, MOAL_IOCTL_WAIT)) {
-			PRINTM(MFATAL, "Set user antcfg data failed\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto err;
-		}
-	}
-
 #ifdef UAP_SUPPORT
 	if (handle->params.uap_oper_ctrl)
 		woal_set_uap_operation_ctrl(handle);
@@ -3738,21 +4326,29 @@
 #endif
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 	if (handle->params.rps) {
-		priv_rps = woal_get_priv_bss_type(handle, MLAN_BSS_TYPE_STA);
-		sprintf(rps_buf, "%x", handle->params.rps);
-		if (priv_rps) {
-			PRINTM(MCMND,
-			       "num_rx_queues=%u real_num_rx_queues=%u\n",
-			       priv_rps->netdev->num_rx_queues,
-			       priv_rps->netdev->real_num_rx_queues);
-			for (i = 0;
-			     i < (int)MIN(priv_rps->netdev->num_rx_queues,
-					  priv_rps->netdev->real_num_rx_queues);
-			     i++) {
-				woal_set_rps_map(&(priv_rps->netdev->_rx[i]),
-						 rps_buf, strlen(rps_buf));
+		snprintf(rps_buf, sizeof(rps_buf), "%x", handle->params.rps);
+		for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
+			priv_rps = handle->priv[i];
+			if (priv_rps && priv_rps->netdev) {
+				PRINTM(MCMND, "bss_type=%d bss_role=%d \n",
+				       priv_rps->bss_type, priv_rps->bss_role);
+				PRINTM(MCMND,
+				       "num_rx_queues=%u real_num_rx_queues=%u rps_buf=%s\n",
+				       priv_rps->netdev->num_rx_queues,
+				       priv_rps->netdev->real_num_rx_queues,
+				       rps_buf);
+				for (j = 0;
+				     j <
+				     (int)MIN(priv_rps->netdev->num_rx_queues,
+					      priv_rps->netdev
+						      ->real_num_rx_queues);
+				     j++) {
+					woal_set_rps_map(
+						&(priv_rps->netdev->_rx[j]),
+						rps_buf, strlen(rps_buf));
+				}
 			}
 		}
 	}
@@ -3782,6 +4378,15 @@
 #ifdef CONFIG_PROC_FS
 		woal_proc_exit(handle);
 #endif
+
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		if (handle->wiphy) {
+			wiphy_unregister(handle->wiphy);
+			woal_cfg80211_free_bands(handle->wiphy);
+			wiphy_free(handle->wiphy);
+			handle->wiphy = NULL;
+		}
+#endif
 	}
 	LEAVE();
 	return ret;
@@ -3797,13 +4402,15 @@
 static mlan_status woal_req_dpd_data(moal_handle *handle,
 				     mlan_init_param *param)
 {
-	int ret = MLAN_STATUS_SUCCESS;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u8 req_fw_nowait = moal_extflg_isset(handle, EXT_REQ_FW_NOWAIT);
 	char *dpd_data_cfg = handle->params.dpd_data_cfg;
-	mlan_status status = MLAN_STATUS_SUCCESS;
+	int status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
-
+	/* dpd_data_cfg=none is treated as no dpd_data_cfg parameter
+	 * present at module load time.
+	 */
 	if (dpd_data_cfg && strncmp(dpd_data_cfg, "none", strlen("none"))) {
 		PRINTM(MMSG, "Request firmware: %s\n", dpd_data_cfg);
 		if (req_fw_nowait) {
@@ -3860,6 +4467,8 @@
 		} else {
 			param->dpd_data_len = UNKNOW_DPD_LENGTH;
 		}
+	} else {
+		param->dpd_data_len = NONE_DPD_LENGTH;
 	}
 
 done:
@@ -4105,8 +4714,11 @@
 			fw.fw_reload = handle->params.fw_reload;
 		else
 			fw.fw_reload = 0;
+		/* Make sure device is awake before FW download */
+		mlan_pm_wakeup_card(handle->pmlan_adapter, MTRUE);
 		wifi_status = WIFI_STATUS_FW_DNLD;
 		ret = mlan_dnld_fw(handle->pmlan_adapter, &fw);
+		mlan_pm_wakeup_card(handle->pmlan_adapter, MFALSE);
 		if (ret == MLAN_STATUS_FAILURE) {
 			wifi_status = WIFI_STATUS_DNLD_FW_FAIL;
 			PRINTM(MERROR,
@@ -4123,7 +4735,8 @@
 			if (!IS_USB8997(handle->card_type) &&
 			    !IS_USB9098(handle->card_type) &&
 			    !IS_USB9097(handle->card_type) &&
-			    !IS_USBNW62X(handle->card_type) &&
+			    !IS_USBIW624(handle->card_type) &&
+			    !IS_USBIW610(handle->card_type) &&
 			    !IS_USB8978(handle->card_type))
 				ret = woal_reset_usb_dev(handle);
 			goto done;
@@ -4176,7 +4789,8 @@
 		wifi_status = WIFI_STATUS_INIT_FW_FAIL;
 		goto done;
 	} else if (ret == MLAN_STATUS_SUCCESS) {
-		wifi_status = WIFI_STATUS_OK;
+		if (!handle->fw_reseting)
+			wifi_status = WIFI_STATUS_OK;
 		handle->hardware_status = HardwareStatusReady;
 		goto done;
 	}
@@ -4185,19 +4799,27 @@
 			   10 * HZ);
 	if (handle->hardware_status != HardwareStatusReady) {
 		wifi_status = WIFI_STATUS_INIT_FW_FAIL;
+		handle->event_fw_dump = MFALSE;
 		if (handle->ops.reg_dbg)
 			handle->ops.reg_dbg(handle);
 #ifdef DEBUG_LEVEL1
 		if (drvdbg & MFW_D) {
-			drvdbg &= ~MFW_D;
-			if (handle->ops.dump_fw_info)
+			if (handle->ops.dump_fw_info) {
 				handle->ops.dump_fw_info(handle);
+#ifdef DUMP_TO_PROC
+				woal_print_firmware_dump_buf(
+					handle->fw_dump_buf,
+					handle->fw_dump_len);
+#endif
+			}
+			drvdbg &= ~MFW_D;
 		}
 #endif
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-	wifi_status = WIFI_STATUS_OK;
+	if (!handle->fw_reseting)
+		wifi_status = WIFI_STATUS_OK;
 	ret = MLAN_STATUS_SUCCESS;
 done:
 	if (handle->dpd_data) {
@@ -4261,6 +4883,7 @@
 	if (ret)
 		goto done;
 
+	handle->driver_init = MTRUE;
 done:
 	/* We should hold the semaphore until callback finishes execution */
 	MOAL_REL_SEMAPHORE(&AddRemoveCardSem);
@@ -4401,6 +5024,9 @@
 			ret = woal_add_card_dpc(handle);
 			if (ret)
 				goto done;
+
+			handle->driver_init = MTRUE;
+
 			/* Release semaphore if download is not required */
 			MOAL_REL_SEMAPHORE(&AddRemoveCardSem);
 		done:
@@ -4431,7 +5057,11 @@
 void woal_fill_mlan_buffer(moal_private *priv, mlan_buffer *pmbuf,
 			   struct sk_buff *skb)
 {
-	wifi_timeval tstamp;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	struct timespec64 ts;
+#else
+	struct timespec ts;
+#endif
 	struct ethhdr *eth;
 	dot11_txcontrol *txcontrol;
 	t_u8 tx_ctrl_flag = MFALSE;
@@ -4482,11 +5112,19 @@
 	}
 	PRINTM(MDAT_D, "packet %04x prio=%#x\n", eth->h_proto, skb->priority);
 
-	if (priv->enable_mc_aggr && priv->num_mcast_addr) {
+	if ((priv->enable_mc_aggr || priv->enable_uc_nonaggr) &&
+	    priv->num_mcast_addr) {
 		if (woal_find_mcast_node_tx(priv, skb)) {
 			mc_txcontrol *tx_ctrl =
 				(mc_txcontrol *)(skb->data + skb->len -
 						 sizeof(mc_txcontrol));
+			/* Need to check whether flags field is set to 0xf9
+			 * so that it can be treated as unicast frames
+			 */
+			if ((tx_ctrl->mc_pkt_flags & 0xf9) == 0xf9) {
+				PRINTM(MDAT_D, "Ucast frame seq_num:%d\n",
+				       tx_ctrl->seq_num);
+			}
 			moal_memcpy_ext(priv->phandle,
 					(t_u8 *)&pmbuf->u.mc_tx_info,
 					(t_u8 *)tx_ctrl, sizeof(mc_txcontrol),
@@ -4503,9 +5141,13 @@
 	 *   packet to the firmware for aggregate delay calculation for stats
 	 *   and MSDU lifetime expiry.
 	 */
-	woal_get_monotonic_time(&tstamp);
-	skb->tstamp = ktime_get_real();
-
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	ktime_get_raw_ts64(&ts);
+	skb->tstamp = timespec64_to_ktime(ts);
+#else
+	getrawmonotonic(&ts);
+	skb->tstamp = timespec_to_ktime(ts);
+#endif
 	pmbuf->pdesc = skb;
 	pmbuf->pbuf = skb->head + sizeof(mlan_buffer);
 #ifdef PCIE
@@ -4517,9 +5159,8 @@
 	pmbuf->data_len = skb->len;
 	pmbuf->priority = skb->priority;
 	pmbuf->buf_type = 0;
-	pmbuf->in_ts_sec = tstamp.time_sec;
-	pmbuf->in_ts_usec = tstamp.time_usec;
-
+	pmbuf->in_ts_sec = (t_u32)ts.tv_sec;
+	pmbuf->in_ts_usec = (t_u32)ts.tv_nsec / 1000;
 	LEAVE();
 	return;
 }
@@ -4986,6 +5627,8 @@
 	dev->hard_header_len += MLAN_MIN_DATA_HEADER_LEN + sizeof(mlan_buffer) +
 				priv->extra_tx_head_len;
 #endif
+	if (priv->phandle->params.mclient_scheduling)
+		dev->tx_queue_len = MCLIENT_MAX_TX_PENDING;
 	/** don't need register to wext */
 	if (priv->bss_type == MLAN_BSS_TYPE_DFS) {
 		LEAVE();
@@ -5008,6 +5651,27 @@
 #endif /* UAP_SUPPORT */
 
 /**
+ * @brief This function sets thresholds for tx_pending
+ *
+ *  @param handle    A pointer to moal_handle structure
+ *  @param priv      A pointer to moal_private structure
+ *
+ *  @return          N/A
+ */
+static void woal_set_interface_pending_limits(moal_handle *handle,
+					      moal_private *priv)
+{
+	priv->max_tx_pending = MAX_TX_PENDING;
+	priv->low_tx_pending = LOW_TX_PENDING;
+
+	if (handle->params.mclient_scheduling &&
+	    priv->bss_type == MLAN_BSS_TYPE_UAP) {
+		priv->max_tx_pending = MCLIENT_MAX_TX_PENDING;
+		priv->low_tx_pending = MCLIENT_LOW_TX_PENDING;
+	}
+}
+
+/**
  * @brief This function adds a new interface. It will
  *      allocate, initialize and register the device.
  *
@@ -5066,6 +5730,15 @@
 			snprintf(name, sizeof(name), "%s", default_wfd_name);
 		break;
 #endif
+	case MLAN_BSS_TYPE_NAN:
+		if (handle->params.nan_name)
+			snprintf(name, sizeof(name), "%s%%d",
+				 handle->params.nan_name);
+		else if (handle->second_mac)
+			snprintf(name, sizeof(name), "m%s", default_nan_name);
+		else
+			snprintf(name, sizeof(name), "%s", default_nan_name);
+		break;
 	case MLAN_BSS_TYPE_DFS:
 		if (handle->second_mac)
 			snprintf(name, sizeof(name), "m%s", default_dfs_name);
@@ -5111,11 +5784,14 @@
 	else if (bss_type == MLAN_BSS_TYPE_WIFIDIRECT)
 		priv->bss_role = MLAN_BSS_ROLE_STA;
 #endif
+	else if (bss_type == MLAN_BSS_TYPE_NAN)
+		priv->bss_role = MLAN_BSS_ROLE_STA;
 	else if (bss_type == MLAN_BSS_TYPE_DFS)
 		priv->bss_role = MLAN_BSS_ROLE_UAP;
 
 	INIT_LIST_HEAD(&priv->tcp_sess_queue);
 	spin_lock_init(&priv->tcp_sess_lock);
+	priv->tcp_sess_cnt = 0;
 #ifdef STA_SUPPORT
 	INIT_LIST_HEAD(&priv->tdls_list);
 	spin_lock_init(&priv->tdls_lock);
@@ -5127,11 +5803,23 @@
 	spin_lock_init(&priv->mcast_lock);
 
 #ifdef STA_CFG80211
+	INIT_LIST_HEAD(&priv->dhcp_discover_queue);
+	spin_lock_init(&priv->dhcp_discover_lock);
+	hash_init(priv->hlist);
+#endif
+#ifdef STA_CFG80211
 #ifdef STA_SUPPORT
 	spin_lock_init(&priv->connect_lock);
 #endif
 #endif
 
+#ifdef STA_CFG80211
+#ifdef STA_SUPPORT
+	INIT_LIST_HEAD(&priv->ipv6_addrses);
+	spin_lock_init(&priv->ipv6addr_lock);
+#endif
+#endif
+
 #ifdef STA_SUPPORT
 	INIT_LIST_HEAD(&priv->pmksa_cache_list);
 	if (bss_type == MLAN_BSS_TYPE_STA) {
@@ -5141,9 +5829,6 @@
 		priv->okc_ie_len = 0;
 	}
 #endif
-#if defined(DRV_EMBEDDED_AUTHENTICATOR)
-	init_waitqueue_head(&priv->hostcmd_wait_q);
-#endif
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
 	SET_MODULE_OWNER(dev);
 #endif
@@ -5152,7 +5837,7 @@
 #ifdef WIFI_DIRECT_SUPPORT
 	    || bss_type == MLAN_BSS_TYPE_WIFIDIRECT
 #endif
-	)
+	    || bss_type == MLAN_BSS_TYPE_NAN)
 		woal_init_sta_dev(dev, priv);
 #endif
 #ifdef UAP_SUPPORT
@@ -5224,7 +5909,7 @@
 		    || bss_type == MLAN_BSS_TYPE_WIFIDIRECT
 #endif
 #endif
-		)
+		    || bss_type == MLAN_BSS_TYPE_NAN)
 			/* Register cfg80211 for STA or Wifi direct */
 			if (woal_register_sta_cfg80211(dev, bss_type)) {
 				PRINTM(MERROR,
@@ -5247,8 +5932,8 @@
 		}
 	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
-	strcpy(csa_str, "CSA");
-	strcat(csa_str, name);
+	strncpy(csa_str, "CSA", sizeof(csa_str));
+	strncat(csa_str, name, sizeof(csa_str) - 4);
 	priv->csa_workqueue = alloc_workqueue(
 		csa_str, WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
 	if (!priv->csa_workqueue) {
@@ -5297,25 +5982,34 @@
 
 	if (bss_type == MLAN_BSS_TYPE_STA ||
 	    priv->bss_type == MLAN_BSS_TYPE_UAP) {
+#ifdef MFG_CMD_SUPPORT
+		if (priv->phandle->params.mfg_mode != MLAN_INIT_PARA_ENABLED) {
+#endif
 #if defined(SD8887) || defined(SD8987)
-		mlan_fw_info fw_info;
-		memset(&fw_info, 0, sizeof(mlan_fw_info));
-		if (MLAN_STATUS_SUCCESS !=
-		    woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info)) {
-			PRINTM(MERROR, "%s: get_fw_info failed \n", __func__);
-			goto error;
-		}
-		if (MFALSE
+			mlan_fw_info fw_info;
+			memset(&fw_info, 0, sizeof(mlan_fw_info));
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT,
+						     &fw_info)) {
+				PRINTM(MERROR, "%s: get_fw_info failed \n",
+				       __func__);
+				goto error;
+			}
+			if (MFALSE
 #ifdef SD8887
-		    || IS_SD8887(handle->card_type)
+			    || IS_SD8887(handle->card_type)
 #endif
 #ifdef SD8987
-		    || IS_SD8987(handle->card_type)
+			    || IS_SD8987(handle->card_type)
 #endif
-		) {
-			if ((fw_info.antinfo & ANT_DIVERSITY_2G) &&
-			    (fw_info.antinfo & ANT_DIVERSITY_5G))
-				handle->card_info->histogram_table_num = 4;
+			) {
+				if ((fw_info.antinfo & ANT_DIVERSITY_2G) &&
+				    (fw_info.antinfo & ANT_DIVERSITY_5G))
+					handle->card_info->histogram_table_num =
+						4;
+			}
+#endif
+#ifdef MFG_CMD_SUPPORT
 		}
 #endif
 
@@ -5389,6 +6083,11 @@
 #endif
 	int i = 0;
 
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	int count = 0;
+#endif
+#endif
 	ENTER();
 
 	if (!priv || !priv->netdev)
@@ -5408,9 +6107,12 @@
 		}
 #endif
 	}
-	woal_flush_tcp_sess_queue(priv);
-
 	woal_flush_tx_stat_queue(priv);
+	woal_flush_tcp_sess_queue(priv);
+#ifdef STA_CFG80211
+	woal_flush_dhcp_discover_queue(priv);
+	woal_flush_arp_request_entry(priv);
+#endif
 
 #ifdef STA_CFG80211
 	if (priv->bss_type == MLAN_BSS_TYPE_STA)
@@ -5456,6 +6158,8 @@
 	if (dev->reg_state == NETREG_REGISTERED)
 		unregister_netdev(dev);
 
+	woal_sched_timeout(100);
+
 	if (priv->mclist_workqueue) {
 		flush_workqueue(priv->mclist_workqueue);
 		destroy_workqueue(priv->mclist_workqueue);
@@ -5490,6 +6194,25 @@
 	if (IS_STA_OR_UAP_CFG80211(handle->params.cfg80211_wext))
 		priv->phandle->wiphy->extended_capabilities = NULL;
 #endif
+#ifdef UAP_SUPPORT
+	/* Clear the whole backhaul station list in moal */
+	for (count = 0; count < MAX_STA_COUNT; count++) {
+		if (priv->vlan_sta_list[count]) {
+			if (priv->vlan_sta_list[count]->is_valid) {
+				priv->vlan_sta_list[count]->is_valid = MFALSE;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+				cfg80211_unregister_netdevice(
+					priv->vlan_sta_list[count]->netdev);
+#else
+				unregister_netdevice(
+					priv->vlan_sta_list[count]->netdev);
+#endif
+			}
+			kfree(priv->vlan_sta_list[count]);
+		}
+		priv->vlan_sta_list[count] = NULL;
+	}
+#endif
 #endif
 	priv->phandle->priv[priv->bss_index] = NULL;
 	priv->phandle = NULL;
@@ -5547,68 +6270,6 @@
 }
 
 /**
- *  @brief Configure antcfg
- *
- *  @param handle    A pointer to moal_handle
- *  @param wait_option  Wait option
- *
- *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
- *                          otherwise fail
- */
-mlan_status woal_set_user_antcfg(moal_handle *handle, t_u8 wait_option)
-{
-	moal_private *priv = NULL;
-	mlan_ioctl_req *req = NULL;
-	mlan_ds_radio_cfg *radio = NULL;
-	mlan_status status;
-	int antcfg;
-
-	ENTER();
-	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
-	if (!priv) {
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-	antcfg = handle->params.antcfg;
-	/* Allocate an IOCTL request buffer */
-	req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_radio_cfg));
-	if (req == NULL) {
-		status = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	/* Fill request buffer */
-	radio = (mlan_ds_radio_cfg *)req->pbuf;
-	radio->sub_command = MLAN_OID_ANT_CFG;
-	req->req_id = MLAN_IOCTL_RADIO_CFG;
-	req->action = MLAN_ACT_SET;
-
-	if (handle->feature_control & FEATURE_CTRL_STREAM_2X2) {
-		if (IS_CARD9098(handle->card_type) ||
-		    IS_CARD9097(handle->card_type)) {
-			radio->param.ant_cfg.tx_antenna =
-				radio->param.ant_cfg.rx_antenna = antcfg;
-#if defined(STA_CFG80211) || defined(UAP_CFG80211)
-			woal_cfg80211_notify_antcfg(priv, priv->phandle->wiphy,
-						    radio);
-#endif
-		} else {
-			radio->param.ant_cfg.tx_antenna =
-				(antcfg & 0x0030) >> 4;
-			radio->param.ant_cfg.rx_antenna = antcfg & 0x0003;
-		}
-	} else
-		radio->param.ant_cfg_1x1.antenna = antcfg;
-	/* Send IOCTL request to MLAN */
-	status = woal_request_ioctl(priv, req, wait_option);
-done:
-	kfree(req);
-	LEAVE();
-	return status;
-}
-
-/**
  *  @brief Configure MLAN for low power mode
  *
  *  @param priv         A pointer to moal_private structure
@@ -5774,7 +6435,7 @@
  *
  *  @return          N/A
  */
-static void woal_flush_evt_queue(moal_handle *handle)
+void woal_flush_evt_queue(moal_handle *handle)
 {
 	struct woal_event *evt = NULL, *tmp_node;
 	unsigned long flags;
@@ -5790,6 +6451,38 @@
 }
 
 /**
+ *  @brief This function queue rx task
+ *
+ *  @param handle    A pointer to moal_handle
+ *
+ *  @return        N/A
+ */
+void woal_queue_rx_task(moal_handle *handle)
+{
+	ENTER();
+#ifdef PCIE
+	if (IS_PCIE(handle->card_type)) {
+#ifdef TASKLET_SUPPORT
+		tasklet_schedule(&handle->pcie_rx_task);
+#else
+		queue_work(handle->pcie_rx_workqueue, &handle->pcie_rx_work);
+#endif
+		LEAVE();
+		return;
+	}
+#endif
+	if (moal_extflg_isset(handle, EXT_NAPI)) {
+		napi_schedule(&handle->napi_rx);
+		LEAVE();
+		return;
+	}
+#if defined(USB) || defined(SDIO)
+	queue_work(handle->rx_workqueue, &handle->rx_work);
+#endif
+	LEAVE();
+}
+
+/**
  *  @brief This function flush all works in the queue
  *
  *  @param handle    A pointer to moal_handle
@@ -5803,12 +6496,32 @@
 	/* Terminate main workqueue */
 	if (handle->workqueue)
 		flush_workqueue(handle->workqueue);
-	if (handle->rx_workqueue)
-		flush_workqueue(handle->rx_workqueue);
 	if (handle->evt_workqueue)
 		flush_workqueue(handle->evt_workqueue);
 	if (handle->tx_workqueue)
 		flush_workqueue(handle->tx_workqueue);
+#if defined(USB) || defined(SDIO)
+	if (IS_USB(handle->card_type) || IS_SD(handle->card_type)) {
+		if (handle->rx_workqueue)
+			flush_workqueue(handle->rx_workqueue);
+	}
+#endif
+#ifdef PCIE
+	if (IS_PCIE(handle->card_type)) {
+		if (handle->pcie_cmd_resp_workqueue)
+			flush_workqueue(handle->pcie_cmd_resp_workqueue);
+		cancel_delayed_work_sync(&handle->pcie_delayed_tx_work);
+#ifdef TASKLET_SUPPORT
+		tasklet_kill(&handle->pcie_tx_complete_task);
+		tasklet_kill(&handle->pcie_rx_task);
+#else
+		if (handle->pcie_tx_complete_workqueue)
+			flush_workqueue(handle->pcie_tx_complete_workqueue);
+		if (handle->pcie_rx_workqueue)
+			flush_workqueue(handle->pcie_rx_workqueue);
+#endif
+	}
+#endif
 	LEAVE();
 }
 
@@ -5830,11 +6543,6 @@
 		destroy_workqueue(handle->workqueue);
 		handle->workqueue = NULL;
 	}
-	if (handle->rx_workqueue) {
-		flush_workqueue(handle->rx_workqueue);
-		destroy_workqueue(handle->rx_workqueue);
-		handle->rx_workqueue = NULL;
-	}
 	if (handle->evt_workqueue) {
 		woal_flush_evt_queue(handle);
 		flush_workqueue(handle->evt_workqueue);
@@ -5846,6 +6554,40 @@
 		destroy_workqueue(handle->tx_workqueue);
 		handle->tx_workqueue = NULL;
 	}
+#if defined(USB) || defined(SDIO)
+	if (IS_USB(handle->card_type) || IS_SD(handle->card_type)) {
+		if (handle->rx_workqueue) {
+			flush_workqueue(handle->rx_workqueue);
+			destroy_workqueue(handle->rx_workqueue);
+			handle->rx_workqueue = NULL;
+		}
+	}
+#endif
+#ifdef PCIE
+	if (IS_PCIE(handle->card_type)) {
+		if (handle->pcie_cmd_resp_workqueue) {
+			flush_workqueue(handle->pcie_cmd_resp_workqueue);
+			destroy_workqueue(handle->pcie_cmd_resp_workqueue);
+			handle->pcie_cmd_resp_workqueue = NULL;
+		}
+		cancel_delayed_work_sync(&handle->pcie_delayed_tx_work);
+#ifdef TASKLET_SUPPORT
+		tasklet_kill(&handle->pcie_tx_complete_task);
+		tasklet_kill(&handle->pcie_rx_task);
+#else
+		if (handle->pcie_rx_workqueue) {
+			flush_workqueue(handle->pcie_rx_workqueue);
+			destroy_workqueue(handle->pcie_rx_workqueue);
+			handle->pcie_rx_workqueue = NULL;
+		}
+		if (handle->pcie_tx_complete_workqueue) {
+			flush_workqueue(handle->pcie_tx_complete_workqueue);
+			destroy_workqueue(handle->pcie_tx_complete_workqueue);
+			handle->pcie_tx_complete_workqueue = NULL;
+		}
+#endif
+	}
+#endif
 	LEAVE();
 }
 
@@ -5873,6 +6615,9 @@
 #endif /* < 2.6.34 */
 #endif /* USB_SUSPEND_RESUME */
 	t_u8 carrier_on = MFALSE;
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	int cfg80211_wext = priv->phandle->params.cfg80211_wext;
+#endif
 
 	ENTER();
 
@@ -5940,6 +6685,14 @@
 		carrier_on = MTRUE;
 #endif
 
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	if (IS_STA_OR_UAP_CFG80211(cfg80211_wext)) {
+		if ((dev->ieee80211_ptr) &&
+		    (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP_VLAN))
+			carrier_on = MTRUE;
+	}
+#endif
+
 	if (carrier_on == MTRUE) {
 		if (!netif_carrier_ok(priv->netdev))
 			netif_carrier_on(priv->netdev);
@@ -5977,7 +6730,24 @@
 #endif
 	ENTER();
 
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	if (IS_STA_OR_UAP_CFG80211(cfg80211_wext)) {
+		/** For multi-ap virtual interface */
+		if ((dev->ieee80211_ptr) &&
+		    (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP_VLAN)) {
+			woal_stop_queue(priv->netdev);
+			MODULE_PUT;
+			LEAVE();
+			return 0;
+		}
+	}
+#endif
+
 	woal_flush_tx_stat_queue(priv);
+#ifdef STA_CFG80211
+	woal_flush_dhcp_discover_queue(priv);
+	woal_flush_arp_request_entry(priv);
+#endif
 
 	if ((priv->media_connected == MTRUE)
 #ifdef UAP_SUPPORT
@@ -6000,10 +6770,13 @@
 	woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
-	if (IS_STA_CFG80211(cfg80211_wext) && priv->wdev->connected) {
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
+	if (IS_STA_CFG80211(cfg80211_wext) && priv->wdev &&
+	    priv->wdev->connected) {
 #else
-	if (IS_STA_CFG80211(cfg80211_wext) && priv->wdev->current_bss) {
+	if (IS_STA_CFG80211(cfg80211_wext) && priv->wdev &&
+	    priv->wdev->current_bss) {
 #endif
 		priv->cfg_disconnect = MTRUE;
 		cfg80211_disconnected(priv->netdev, 0, NULL, 0,
@@ -6015,7 +6788,8 @@
 #endif
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
-	if (IS_STA_CFG80211(cfg80211_wext) && priv->sched_scanning) {
+	if (IS_STA_CFG80211(cfg80211_wext) && priv->sched_scanning &&
+	    priv->wdev) {
 		woal_stop_bg_scan(priv, MOAL_IOCTL_WAIT);
 		priv->bg_scan_start = MFALSE;
 		priv->bg_scan_reported = MFALSE;
@@ -6056,7 +6830,7 @@
  *
  *  @return        0 --success, otherwise fail
  */
-void woal_disable_ampdu(moal_private *priv)
+static void woal_disable_ampdu(moal_private *priv)
 {
 	mlan_ds_11n_aggr_prio_tbl aggr_prio_tbl;
 	int i;
@@ -6119,6 +6893,13 @@
 		return -EFAULT;
 	}
 
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	/* No need to set mac address for multi-ap virtual interface */
+	if ((dev->ieee80211_ptr) &&
+	    (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP_VLAN))
+		return 0;
+#endif
+
 	moal_memcpy_ext(priv->phandle, prev_addr, priv->current_addr, ETH_ALEN,
 			ETH_ALEN);
 	memset(priv->current_addr, 0, ETH_ALEN);
@@ -6128,6 +6909,13 @@
 	HEXDUMP("addr:", (t_u8 *)phw_addr->sa_data, ETH_ALEN);
 	moal_memcpy_ext(priv->phandle, priv->current_addr, phw_addr->sa_data,
 			ETH_ALEN, ETH_ALEN);
+
+	if (priv->bss_type == MLAN_BSS_TYPE_STA) {
+		priv->phandle->set_mac_addr = 1;
+		moal_memcpy_ext(priv->phandle, priv->phandle->mac_addr, phw_addr->sa_data,
+				ETH_ALEN, ETH_ALEN);
+	}
+
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(STA_CFG80211) && defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= WIFI_DIRECT_KERNEL_VERSION
@@ -6299,23 +7087,29 @@
 	PRINTM(MERROR, "tx_pkts_queued=%d\n", info->tx_pkts_queued);
 	PRINTM(MERROR, "fw_hang_report = %d\n", info->fw_hang_report);
 	PRINTM(MERROR, "num_cmd_timeout = %d\n", info->num_cmd_timeout);
-	PRINTM(MERROR, "Timeout cmd id = 0x%x, act = 0x%x\n",
-	       info->timeout_cmd_id, info->timeout_cmd_act);
+	PRINTM(MERROR, "num_no_cmd_node = %d\n", info->num_no_cmd_node);
+	PRINTM(MERROR, "num_assoc_err = %d\n", info->num_assoc_err);
+	PRINTM(MERROR, "num_scan_err = %d\n", info->num_scan_err);
+	PRINTM(MERROR, "num_remain_chan_err = %d\n", info->num_remain_chan_err);
+	if (info->timeout_cmd_id)
+		PRINTM(MERROR, "Timeout cmd id = 0x%x, act = 0x%x\n",
+		       info->timeout_cmd_id, info->timeout_cmd_act);
 
 	PRINTM(MERROR, "last_cmd_index = %d\n", info->last_cmd_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_id[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_id[i]);
 	PRINTM(MERROR, "last_cmd_id = %s\n", str);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_act[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_act[i]);
 	PRINTM(MERROR, "last_cmd_act = %s\n", str);
 	PRINTM(MERROR, "last_cmd_resp_index = %d\n", info->last_cmd_resp_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_resp_id[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ",
+			      info->last_cmd_resp_id[i]);
 	PRINTM(MERROR, "last_cmd_resp_id = %s\n", str);
 	PRINTM(MERROR, "last_event_index = %d\n", info->last_event_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_event[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_event[i]);
 	PRINTM(MERROR, "last_event = %s", str);
 
 	PRINTM(MERROR, "num_data_h2c_failure = %d\n",
@@ -6350,8 +7144,8 @@
 		       info->last_recv_wr_bitmap, info->last_mp_index);
 		for (i = 0; i < SDIO_MP_DBG_NUM; i++) {
 			for (s = str, j = 0; j < mp_aggr_pkt_limit; j++)
-				s += sprintf(
-					s, "0x%02x ",
+				s += snprintf(
+					s, MAX_BUF_LEN, "0x%02x ",
 					info->last_mp_wr_info
 						[i * mp_aggr_pkt_limit + j]);
 
@@ -6410,6 +7204,7 @@
 	       info->sleep_pd);
 	PRINTM(MERROR, "tx_lock_flag = %d\n", info->tx_lock_flag);
 	PRINTM(MERROR, "port_open = %d\n", info->port_open);
+	PRINTM(MERROR, "tx_pause = %d\n", info->tx_pause);
 	PRINTM(MERROR, "scan_processing = %d\n", info->scan_processing);
 	PRINTM(MERROR, "scan_state = 0x%x\n", info->scan_state);
 	for (i = 0; i < (int)info->ralist_num; i++) {
@@ -6476,11 +7271,19 @@
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	t_u8 auto_fw_dump = MFALSE;
+	moal_handle *ref_handle = NULL;
+
 	ENTER();
 
 	priv->num_tx_timeout++;
 	PRINTM(MERROR, "%lu : %s (bss=%d): Tx timeout (%d)\n", jiffies,
 	       dev->name, priv->bss_index, priv->num_tx_timeout);
+	PRINTM(MERROR, "num_tx_pkts = %lu\n", priv->stats.tx_packets);
+	PRINTM(MERROR, "tx_pending = %d\n",
+	       atomic_read(&priv->phandle->tx_pending));
+	if (priv->num_tx_timeout < NUM_TX_TIMEOUT_THRESHOLD)
+		woal_mlan_debug_info(priv);
+
 	woal_set_trans_start(dev);
 
 	if (priv->num_tx_timeout == NUM_TX_TIMEOUT_THRESHOLD &&
@@ -6492,6 +7295,9 @@
 		woal_mlan_debug_info(priv);
 		woal_moal_debug_info(priv, NULL, MFALSE);
 		priv->phandle->driver_status = MTRUE;
+		ref_handle = (moal_handle *)priv->phandle->pref_mac;
+		if (ref_handle)
+			ref_handle->driver_status = MTRUE;
 		if (!auto_fw_dump && !priv->phandle->fw_dump)
 			woal_process_hang(priv->phandle);
 
@@ -6629,8 +7435,7 @@
 #else
 	tid = skb->priority = woal_classify8021d(skb);
 #endif
-#define NXP_ETH_P_EAPOL 0x888E
-#define NXP_ETH_P_WAPI 0x8884
+#define NXP_ETH_P_WAPI 0x88B4
 	switch (skb->protocol) {
 	case htons(ETH_P_ARP):
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
@@ -6745,6 +7550,296 @@
 	LEAVE();
 }
 
+#if defined(STA_CFG80211)
+/**
+ *  @brief This function flushes arp request entry from list
+ *
+ *  @param priv        A pointer to moal_private structure
+ *
+ *  @return            N/A
+ */
+t_void woal_flush_arp_request_entry(moal_private *priv)
+{
+	struct arp_entry *arp = NULL;
+	struct hlist_node *tmp = NULL;
+	unsigned long flags;
+	int i;
+
+	spin_lock_irqsave(&priv->arp_request_lock, flags);
+	hash_for_each_safe (priv->hlist, i, tmp, arp, arp_hlist) {
+		hlist_del(&arp->arp_hlist);
+		kfree(arp);
+	}
+	spin_unlock_irqrestore(&priv->arp_request_lock, flags);
+}
+
+/**
+ *  @brief This function generates constant factor for hash
+ *
+ *  @param factor     Constant factor of hash
+ *
+ *  @return           Returns updated hash factor
+ */
+static t_u32 woal_generate_hash_factor(t_u32 factor)
+{
+	factor *= 0xcc9e2d51;
+	factor = (factor << 15) | (factor >> 17);
+	factor *= 0x1b873593;
+
+	// coverity[integer_overflow:SUPPRESS]
+	return factor;
+}
+
+/**
+ *  @brief This function generates hash based on murmurhash
+ *
+ *  @param data       A pointer to input for hash
+ *  @param len        Length of input
+ *  @param seed       Seed value for hash
+ *
+ *  @return           Returns hash value
+ */
+static t_u32 woal_generate_hash(t_u8 *data, size_t len, t_u32 seed)
+{
+	t_u32 hash = seed;
+	t_u32 factor;
+	size_t i;
+
+	for (i = len >> 2; i; i--) {
+		memcpy(&factor, data, sizeof(t_u32));
+		data += sizeof(t_u32);
+		hash ^= woal_generate_hash_factor(factor);
+		hash = (hash << 13) | (hash >> 19);
+		hash = hash * 5 + 0xe6546b64;
+	}
+
+	factor = 0;
+	for (i = len & 3; i; i--) {
+		factor <<= 8;
+		factor |= data[i - 1];
+	}
+
+	hash ^= woal_generate_hash_factor(factor);
+	hash ^= len;
+	hash ^= hash >> 16;
+	hash *= 0x85ebca6b;
+	hash ^= hash >> 13;
+	hash *= 0xc2b2ae35;
+	hash ^= hash >> 16;
+
+	// coverity[integer_overflow:SUPPRESS]
+	return hash;
+}
+
+/**
+ *  @brief This function generates hash for arp request
+ *
+ *  @param skb        A pointer to sk_buff structure
+ *
+ *  @return           Returns hash of arp request
+ */
+t_u32 woal_generate_arp_request_hash(struct sk_buff *skb)
+{
+	struct ethhdr *eth;
+	struct arphdr *arp;
+	t_u32 hash_key = 0;
+	t_u32 min_len = sizeof(*eth) + sizeof(*arp);
+
+	eth = (struct ethhdr *)(skb->data);
+	if (skb->len < min_len || eth->h_proto != htons(ETH_P_ARP))
+		return 0;
+
+	arp = (struct arphdr *)((u8 *)eth + ETH_HLEN);
+	if (arp->ar_op == htons(ARPOP_REQUEST)) {
+		/*
+		 * since a hash value is required to distinguish ARP
+		 * request.
+		 */
+		hash_key = woal_generate_hash((t_u8 *)arp,
+					      sizeof(struct arp_hdr), 0);
+		return hash_key;
+	}
+	return 0;
+}
+
+/**
+ *  @brief This function adds arp request hash to list
+ *
+ *  @param priv        A pointer to moal_private structure
+ *  @param hash_key    hash key of arp request
+ *
+ *  @return            N/A
+ */
+t_void woal_add_arp_request_node(moal_private *priv, t_u32 hash_key)
+{
+	struct arp_entry *node = NULL;
+	struct hlist_node *temp = NULL;
+	unsigned long flags;
+	bool found = false;
+	int i;
+
+	spin_lock_irqsave(&priv->arp_request_lock, flags);
+	hash_for_each_safe (priv->hlist, i, temp, node, arp_hlist) {
+		if (node && node->hash_key == hash_key) {
+			found = true;
+			break;
+		}
+
+		if (node &&
+		    (jiffies - node->ageout_jiffies) >= ARP_REQ_AGEOUT_TIME) {
+			hlist_del(&node->arp_hlist);
+			kfree(node);
+		}
+	}
+
+	if (!found) {
+		node = kzalloc(sizeof(struct arp_entry), GFP_ATOMIC);
+		if (!node) {
+			PRINTM(MERROR, "Failed to alloc memory for arp node\n");
+			return;
+		}
+
+		node->hash_key = hash_key;
+		node->ageout_jiffies = jiffies;
+		hash_add(priv->hlist, &node->arp_hlist, hash_key);
+	}
+	spin_unlock_irqrestore(&priv->arp_request_lock, flags);
+}
+
+/**
+ *  @brief This function flushes dhcp discover info queue
+ *
+ *  @param priv      	A pointer to moal_private structure
+ *
+ *  @return	        N/A
+ */
+void woal_flush_dhcp_discover_queue(moal_private *priv)
+{
+	struct dhcp_discover_info *discover_info = NULL, *tmp_node;
+	unsigned long flags;
+	spin_lock_irqsave(&priv->dhcp_discover_lock, flags);
+	list_for_each_entry_safe (discover_info, tmp_node,
+				  &priv->dhcp_discover_queue, link) {
+		list_del(&discover_info->link);
+		kfree(discover_info);
+	}
+	INIT_LIST_HEAD(&priv->dhcp_discover_queue);
+	spin_unlock_irqrestore(&priv->dhcp_discover_lock, flags);
+}
+
+/**
+ *  @brief This function gets dhcp_discover_info
+ *
+ *  @param priv      		A pointer to moal_private structure
+ *  @param transation_id         token_id of the packet
+ *
+ *  @return	         N/A
+ */
+struct dhcp_discover_info *woal_get_dhcp_discover_info(moal_private *priv,
+						       t_u32 transaction_id)
+{
+	struct dhcp_discover_info *discover_info = NULL;
+
+	ENTER();
+	list_for_each_entry (discover_info, &priv->dhcp_discover_queue, link) {
+		// TODO: add 5 second ageout check
+		if (discover_info->transaction_id == transaction_id) {
+			LEAVE();
+			return discover_info;
+		}
+	}
+	LEAVE();
+	return NULL;
+}
+
+/**
+ * @brief add dhcp_discover_node
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param transaction_id        dhcp discover pkt's transaction_id
+ * @param pmbuf                 pmbuf
+ *
+ * @return                      N/A
+ */
+t_void woal_add_dhcp_discover_node(moal_private *priv, t_u32 transaction_id,
+				   mlan_buffer *pmbuf)
+{
+	struct dhcp_discover_info *node = NULL;
+	unsigned long flags;
+	t_u8 find_node = MFALSE;
+	if (priv) {
+		spin_lock_irqsave(&priv->dhcp_discover_lock, flags);
+		list_for_each_entry (node, &priv->dhcp_discover_queue, link) {
+			if (node->transaction_id == transaction_id) {
+				find_node = MTRUE;
+				node->in_ts_sec = pmbuf->in_ts_sec;
+				node->in_ts_usec = pmbuf->in_ts_usec;
+				break;
+			}
+		}
+		if (!find_node) {
+			/* create new mcast node */
+			node = kzalloc(sizeof(struct dhcp_discover_info),
+				       GFP_ATOMIC);
+			if (node) {
+				node->transaction_id = transaction_id;
+				node->in_ts_sec = pmbuf->in_ts_sec;
+				node->in_ts_usec = pmbuf->in_ts_usec;
+				INIT_LIST_HEAD(&node->link);
+				list_add_tail(&node->link,
+					      &priv->dhcp_discover_queue);
+				PRINTM(MCMND,
+				       "Add to dhcp_disover_queue: transaction_id=0x%x\n",
+				       transaction_id);
+			}
+		}
+		spin_unlock_irqrestore(&priv->dhcp_discover_lock, flags);
+	}
+}
+
+/**
+ * @brief get_dhcp_discover packet's transation_id
+ *
+ * @param skb                   point to struct skb_buff
+ *
+ * @return                      transation_id
+ */
+t_u32 woal_get_dhcp_discover_transation_id(struct sk_buff *skb)
+{
+	struct ethhdr *eth;
+	struct iphdr *iph;
+	struct udphdr *udph;
+	struct dhcp_pkt *dhcp_info;
+	t_u16 min_pkt_size = 0;
+	const t_u8 bc_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	ENTER();
+	eth = (struct ethhdr *)(skb->data);
+	if (memcmp(eth->h_dest, bc_mac, MLAN_MAC_ADDR_LENGTH))
+		goto done;
+	min_pkt_size = DHCP_ETH_HEADER_SIZE + DHCP_MIN_IP_HEADER_SIZE +
+		       DHCP_UDP_HEADER_SIZE + sizeof(struct dhcp_pkt);
+	if (skb->len < min_pkt_size)
+		goto done;
+	if (eth->h_proto == __constant_htons(ETH_P_IP)) {
+		iph = (struct iphdr *)((t_u8 *)eth + sizeof(struct ethhdr));
+		if (iph->protocol == DHCP_UDP_PROTO) {
+			udph = (struct udphdr *)((t_u8 *)iph + (iph->ihl << 2));
+			if (udph->source == __constant_htons(DHCP_SRC_PORT) &&
+			    udph->dest == __constant_htons(DHCP_DST_PORT)) {
+				dhcp_info = (struct dhcp_pkt
+						     *)((t_u8 *)udph +
+							sizeof(struct udphdr));
+				return __constant_htonl(dhcp_info->xid);
+			}
+		}
+	}
+done:
+	LEAVE();
+	return 0;
+}
+#endif
+
 /**
  *  @brief This function flush mcast list
  *
@@ -6779,20 +7874,20 @@
 	struct mcast_node *node = NULL;
 	unsigned long flags;
 	t_u8 ret = MFALSE;
-	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
+	t_u8 ra[MLAN_MAC_ADDR_LENGTH] = {0};
 	ENTER();
 	moal_memcpy_ext(priv->phandle, ra, skb->data, MLAN_MAC_ADDR_LENGTH,
 			sizeof(ra));
-	if (ra[0] & 0x01) {
-		spin_lock_irqsave(&priv->mcast_lock, flags);
-		list_for_each_entry (node, &priv->mcast_list, link) {
-			if (!memcmp(node->mcast_addr, ra, ETH_ALEN)) {
-				ret = MTRUE;
-				break;
-			}
+	//    if (ra[0] & 0x01){
+	spin_lock_irqsave(&priv->mcast_lock, flags);
+	list_for_each_entry (node, &priv->mcast_list, link) {
+		if (!memcmp(node->mcast_addr, ra, ETH_ALEN)) {
+			ret = MTRUE;
+			break;
 		}
-		spin_unlock_irqrestore(&priv->mcast_lock, flags);
 	}
+	spin_unlock_irqrestore(&priv->mcast_lock, flags);
+	//    }
 	LEAVE();
 	return ret;
 }
@@ -6948,8 +8043,11 @@
 	list_for_each_entry_safe (tcp_sess, tmp_node, &priv->tcp_sess_queue,
 				  link) {
 		list_del(&tcp_sess->link);
-		if (atomic_read(&tcp_sess->is_timer_set))
+		if (atomic_read(&tcp_sess->is_timer_set)) {
+			spin_unlock_irqrestore(&priv->tcp_sess_lock, flags);
 			woal_cancel_timer(&tcp_sess->ack_timer);
+			spin_lock_irqsave(&priv->tcp_sess_lock, flags);
+		}
 		skb = (struct sk_buff *)tcp_sess->ack_skb;
 		if (skb)
 			dev_kfree_skb_any(skb);
@@ -6958,6 +8056,7 @@
 	INIT_LIST_HEAD(&priv->tcp_sess_queue);
 	priv->tcp_ack_drop_cnt = 0;
 	priv->tcp_ack_cnt = 0;
+	priv->tcp_sess_cnt = 0;
 	spin_unlock_irqrestore(&priv->tcp_sess_lock, flags);
 }
 
@@ -7014,6 +8113,7 @@
 			PRINTM(MDATA, "wlan: ageout TCP seesion %p\n",
 			       tcp_sess);
 			list_del(&tcp_sess->link);
+			priv->tcp_sess_cnt--;
 			if (atomic_read(&tcp_sess->is_timer_set))
 				woal_cancel_timer(&tcp_sess->ack_timer);
 			skb = (struct sk_buff *)tcp_sess->ack_skb;
@@ -7061,7 +8161,7 @@
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 			atomic_inc(&priv->wmm_tx_pending[index]);
 			if (atomic_read(&priv->wmm_tx_pending[index]) >=
-			    MAX_TX_PENDING) {
+			    priv->max_tx_pending) {
 				struct netdev_queue *txq = netdev_get_tx_queue(
 					priv->netdev, index);
 				netif_tx_stop_queue(txq);
@@ -7099,23 +8199,18 @@
  *
  *
  *  @param priv         A pointer to moal_private structure
- *  @param tcp_session  A pointer to tcp_session
+ *  @param skb          A pointer to sk_buffer
+ *  @param pmbuf        A pointer to mlan_buffer
  *  @return         N/A
  */
-static void woal_send_tcp_ack(moal_private *priv, struct tcp_sess *tcp_session)
+static void woal_send_tcp_ack(moal_private *priv, struct sk_buff *skb,
+			      mlan_buffer *pmbuf)
 {
 	mlan_status status;
-	struct sk_buff *skb = (struct sk_buff *)tcp_session->ack_skb;
-	mlan_buffer *pmbuf = (mlan_buffer *)tcp_session->pmbuf;
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 	t_u32 index = 0;
 #endif
 	ENTER();
-	if (atomic_cmpxchg(&tcp_session->is_timer_set, MTRUE, MFALSE)) {
-		woal_cancel_timer(&tcp_session->ack_timer);
-	}
-	tcp_session->ack_skb = NULL;
-	tcp_session->pmbuf = NULL;
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 	index = skb_get_queue_mapping(skb);
 #endif
@@ -7126,7 +8221,7 @@
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 		atomic_inc(&priv->wmm_tx_pending[index]);
 		if (atomic_read(&priv->wmm_tx_pending[index]) >=
-		    MAX_TX_PENDING) {
+		    priv->max_tx_pending) {
 			struct netdev_queue *txq =
 				netdev_get_tx_queue(priv->netdev, index);
 			netif_tx_stop_queue(txq);
@@ -7188,6 +8283,8 @@
 		LEAVE();
 		return 0;
 	}
+
+	pmbuf->flags |= MLAN_BUF_FLAG_TCP_PKT;
 	tcph = (struct tcphdr *)((t_u8 *)iph + iph->ihl * 4);
 
 	if (*((t_u8 *)tcph + 13) == 0x10) {
@@ -7208,7 +8305,12 @@
 		if (!tcp_session) {
 			/* check any aging out sessions can be removed */
 			woal_ageout_tcp_sess_queue(priv);
-
+			if (priv->tcp_sess_cnt >= TCP_ACK_MAX_SESS) {
+				PRINTM(MINFO, "tcp_sess_cnt reach limit\n");
+				spin_unlock_irqrestore(&priv->tcp_sess_lock,
+						       flags);
+				goto done;
+			}
 			tcp_session =
 				kmalloc(sizeof(struct tcp_sess), GFP_ATOMIC);
 			if (!tcp_session) {
@@ -7240,6 +8342,7 @@
 			woal_mod_timer(&tcp_session->ack_timer, MOAL_TIMER_1MS);
 			list_add_tail(&tcp_session->link,
 				      &priv->tcp_sess_queue);
+			priv->tcp_sess_cnt++;
 			spin_unlock_irqrestore(&priv->tcp_sess_lock, flags);
 			ret = HOLD_TCP_ACK;
 			LEAVE();
@@ -7271,9 +8374,32 @@
 			tcp_session->ack_seq = ack_seq;
 			ret = DROP_TCP_ACK;
 			skb->cb[0]++;
-			if (skb->cb[0] >= priv->tcp_ack_max_hold)
-				woal_send_tcp_ack(priv, tcp_session);
-			spin_unlock_irqrestore(&priv->tcp_sess_lock, flags);
+			if (skb->cb[0] >= priv->tcp_ack_max_hold) {
+				struct sk_buff *ack_skb = NULL;
+				mlan_buffer *ack_pmbuf = NULL;
+				if (atomic_cmpxchg(&tcp_session->is_timer_set,
+						   MTRUE, MFALSE)) {
+					spin_unlock_irqrestore(
+						&priv->tcp_sess_lock, flags);
+					woal_cancel_timer(
+						&tcp_session->ack_timer);
+					spin_lock_irqsave(&priv->tcp_sess_lock,
+							  flags);
+				}
+				ack_skb =
+					(struct sk_buff *)tcp_session->ack_skb;
+				ack_pmbuf = (mlan_buffer *)tcp_session->pmbuf;
+				tcp_session->ack_skb = NULL;
+				tcp_session->pmbuf = NULL;
+				spin_unlock_irqrestore(&priv->tcp_sess_lock,
+						       flags);
+				if (ack_skb && ack_pmbuf)
+					woal_send_tcp_ack(priv, ack_skb,
+							  ack_pmbuf);
+			} else {
+				spin_unlock_irqrestore(&priv->tcp_sess_lock,
+						       flags);
+			}
 			skb = (struct sk_buff *)pmbuf->pdesc;
 			dev_kfree_skb_any(skb);
 			priv->tcp_ack_drop_cnt++;
@@ -7290,6 +8416,183 @@
 	return ret;
 }
 
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/**
+ *  @brief This function sends Tx pkt to monitor iface
+ *
+ *  @param priv      A pointer to moal_private structure
+ *
+ *  @param pmbuf     A mlan buffer
+ *  @return          N/A
+ */
+static void woal_send_tx_pkt_to_mon_if(moal_private *priv, pmlan_buffer pmbuf)
+{
+	struct ieee80211_hdr *dot11_hdr = NULL;
+	struct radiotap_info *rt = NULL;
+	pmlan_buffer pmbuf2 = NULL;
+	t_u8 *ptr = NULL;
+	int hdr_len;
+	int len = 0;
+	t_u16 fc;
+	t_u8 rfc1042_eth_hdr[ETH_ALEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+	moal_handle *handle = NULL;
+	t_u32 temp_len = 0;
+	if (!priv || !pmbuf)
+		return;
+
+	handle = priv->phandle;
+	/* Only STA and uAP mode are supported */
+	if (!(priv->bss_type == MLAN_BSS_TYPE_STA ||
+	      priv->bss_type == MLAN_BSS_TYPE_UAP))
+		return;
+
+	ENTER();
+
+	if (!woal_secure_add(&pmbuf->data_len, 64, &temp_len, TYPE_UINT32))
+		PRINTM(MERROR, "%s: len to allocate pmbuf2 is invalid\n",
+		       __func__);
+
+	pmbuf2 = woal_alloc_mlan_buffer(handle, temp_len);
+	if (!pmbuf2) {
+		PRINTM(MERROR,
+		       "Failed to allocate mlan_buffer for Tx sniffer packet");
+		goto done;
+	}
+	pmbuf2->bss_index = pmbuf->bss_index;
+	pmbuf2->buf_type = pmbuf->buf_type;
+	pmbuf2->priority = pmbuf->priority;
+	pmbuf2->in_ts_sec = pmbuf->in_ts_sec;
+	pmbuf2->in_ts_usec = pmbuf->in_ts_usec;
+	pmbuf2->flags |= MLAN_BUF_FLAG_NET_MONITOR;
+
+	/* attach 802.11 hdr */
+	dot11_hdr = (struct ieee80211_hdr *)((t_u8 *)pmbuf2->pbuf +
+					     pmbuf2->data_offset);
+	memset((t_u8 *)dot11_hdr, 0, sizeof(struct ieee80211_hdr));
+
+	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA);
+
+	ptr = (t_u8 *)pmbuf->pbuf + pmbuf->data_offset;
+	hdr_len = sizeof(struct ieee80211_hdr);
+
+	switch (priv->bss_type) {
+	case MLAN_BSS_TYPE_STA:
+		fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
+		/* BSSID SA DA */
+		memcpy(dot11_hdr->addr1, priv->cfg_bssid, ETH_ALEN);
+		memcpy(dot11_hdr->addr2, ptr + ETH_ALEN, ETH_ALEN);
+		memcpy(dot11_hdr->addr3, ptr, ETH_ALEN);
+		hdr_len -= ETH_ALEN;
+		break;
+	case MLAN_BSS_TYPE_UAP:
+		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+		/* DA BSSID SA */
+		memcpy(dot11_hdr->addr1, ptr, ETH_ALEN);
+		memcpy(dot11_hdr->addr2, priv->current_addr, ETH_ALEN);
+		memcpy(dot11_hdr->addr3, ptr + ETH_ALEN, ETH_ALEN);
+		/* subtract mac addr field size for 3 address 802.11 header */
+		hdr_len -= ETH_ALEN;
+		break;
+	default:
+		woal_free_mlan_buffer(priv->phandle, pmbuf2);
+		goto done;
+	}
+
+	dot11_hdr->frame_control = fc;
+	/* add 2 bytes for qos ctrl flags */
+	hdr_len += 2;
+
+	/* Add LLC/SNAP rfc1042 header after 802.11 hdr */
+	memcpy((t_u8 *)dot11_hdr + hdr_len, &rfc1042_eth_hdr, ETH_ALEN);
+
+	/* Copy out rest of the data frame */
+	if (!woal_secure_sub(&pmbuf->data_len, 2 * ETH_ALEN, &len,
+			     TYPE_UINT32)) {
+		PRINTM(MERROR, "%s: data_len underflow\n", __func__);
+	}
+
+	ptr += 2 * ETH_ALEN;
+	memcpy(pmbuf2->pbuf + pmbuf2->data_offset + hdr_len +
+		       sizeof(rfc1042_eth_hdr),
+	       ptr, len);
+
+	pmbuf2->data_len = hdr_len + sizeof(rfc1042_eth_hdr) + len;
+
+	rt = (struct radiotap_info *)((t_u8 *)pmbuf2->pbuf +
+				      pmbuf2->data_offset -
+				      sizeof(radiotap_info));
+	memset(rt, 0x00, sizeof(radiotap_info));
+	/* TODO: Fill radiotap header here */
+	/* Send this duplicated packet to Rx monitor pkt handler */
+	if (moal_recv_packet(handle, pmbuf2) != MLAN_STATUS_PENDING)
+		woal_free_mlan_buffer(priv->phandle, pmbuf2);
+done:
+	LEAVE();
+}
+#endif
+#endif
+
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+/**
+ *  @brief This function check if the packet is easymesh packet
+ *
+ *  @param priv      A pointer to moal_private structure
+ *  @param skb       A pointer to sk_buff structure
+ *
+ *  @return          MTRUE/MFALSE
+ */
+static BOOLEAN woal_check_easymesh_packet(moal_private *priv,
+					  mlan_buffer *pmbuf)
+{
+	struct sk_buff *skb = pmbuf->pdesc;
+	ENTER();
+
+	/** not construct 4 address if SA is same as local address */
+	if (!moal_memcmp(NULL, (skb->data + 6), priv->current_addr, ETH_ALEN)) {
+		PRINTM(MINFO,
+		       "%s: SA is same as local address " FULL_MACSTR "\n",
+		       __func__, FULL_MAC2STR(priv->current_addr));
+		LEAVE();
+		return MFALSE;
+	}
+
+	/* RA TA */
+	switch (priv->wdev->iftype) {
+#ifdef UAP_SUPPORT
+	case NL80211_IFTYPE_AP_VLAN:
+		PRINTM(MDAT_D, "%s: Easymesh AP_VLAN\n", priv->netdev->name);
+		moal_memcpy_ext(priv->phandle, pmbuf->mac,
+				priv->vlan_sta_ptr->peer_mac,
+				MLAN_MAC_ADDR_LENGTH, ETH_ALEN);
+		pmbuf->flags |= MLAN_BUF_FLAG_EASYMESH;
+		break;
+#endif
+	case NL80211_IFTYPE_STATION:
+		PRINTM(MDAT_D, "%s Easymesh STATION\n", priv->netdev->name);
+		moal_memcpy_ext(priv->phandle, pmbuf->mac, priv->cfg_bssid,
+				ETH_ALEN, ETH_ALEN);
+		pmbuf->flags |= MLAN_BUF_FLAG_EASYMESH;
+		break;
+	default:
+		PRINTM(MERROR, "Not supported iftype\n");
+		LEAVE();
+		return MFALSE;
+	}
+	PRINTM(MDAT_D,
+	       "Easymesh Tx %s:\nRA: " FULL_MACSTR "\nTA: " FULL_MACSTR
+	       "\nDA: " FULL_MACSTR "\nSA: " FULL_MACSTR "\n",
+	       __func__, FULL_MAC2STR(pmbuf->mac),
+	       FULL_MAC2STR(priv->current_addr), FULL_MAC2STR(skb->data),
+	       FULL_MAC2STR(skb->data + ETH_ALEN));
+
+	LEAVE();
+	return MTRUE;
+}
+#endif
+#endif
+
 /**
  *  @brief This function handles packet transmission
  *
@@ -7308,6 +8611,12 @@
 #endif
 	int ret = 0;
 
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	BOOLEAN multi_ap_packet = MFALSE;
+#endif
+#endif
+
 	ENTER();
 
 	priv->num_tx_timeout = 0;
@@ -7352,11 +8661,53 @@
 	pmbuf->bss_index = priv->bss_index;
 	woal_fill_mlan_buffer(priv, pmbuf, skb);
 
-	if (priv->enable_tcp_ack_enh == MTRUE) {
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	if (priv->wdev->use_4addr) {
+		if ((priv->wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
+		     !priv->vlan_sta_ptr) ||
+		    (priv->wdev->iftype == NL80211_IFTYPE_STATION &&
+		     !priv->media_connected)) {
+			priv->stats.tx_dropped++;
+			dev_kfree_skb_any(skb);
+			LEAVE();
+			return;
+		}
+		multi_ap_packet = woal_check_easymesh_packet(priv, pmbuf);
+	}
+#endif
+#endif
+#ifdef STA_CFG80211
+	if (priv->wdev->use_4addr &&
+	    priv->wdev->iftype == NL80211_IFTYPE_STATION) {
+		t_u32 transaction_id;
+		transaction_id = woal_get_dhcp_discover_transation_id(skb);
+		if (transaction_id)
+			woal_add_dhcp_discover_node(priv, transaction_id,
+						    pmbuf);
+	}
+
+	if (priv->wdev->use_4addr &&
+	    priv->wdev->iftype == NL80211_IFTYPE_STATION) {
+		t_u32 hash_key = woal_generate_arp_request_hash(skb);
+		if (hash_key)
+			woal_add_arp_request_node(priv, hash_key);
+	}
+#endif
+
+	if (priv->enable_tcp_ack_enh && priv->media_connected) {
 		ret = woal_process_tcp_ack(priv, pmbuf);
 		if (ret)
 			goto done;
 	}
+#if defined(STA_CFG80211) && defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	if (priv->phandle->mon_if &&
+	    (priv->phandle->mon_if->flag & MLAN_NETMON_DATA) &&
+	    (priv->phandle->mon_if->flag & MLAN_NETMON_TX))
+		woal_send_tx_pkt_to_mon_if(priv, pmbuf);
+#endif
+#endif
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (priv->enable_auto_tdls && priv->tdls_check_tx)
@@ -7383,7 +8734,7 @@
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 		atomic_inc(&priv->wmm_tx_pending[index]);
 		if (atomic_read(&priv->wmm_tx_pending[index]) >=
-		    MAX_TX_PENDING) {
+		    priv->max_tx_pending) {
 			struct netdev_queue *txq =
 				netdev_get_tx_queue(priv->netdev, index);
 			netif_tx_stop_queue(txq);
@@ -7445,7 +8796,9 @@
 		priv->stats.tx_dropped++;
 		goto done;
 	}
-	if (moal_extflg_isset(priv->phandle, EXT_TX_WORK)) {
+	if (!priv->wdev->use_4addr &&
+	    moal_extflg_isset(priv->phandle, EXT_TX_WORK) &&
+	    (skb->protocol != htons(NXP_ETH_P_EAPOL))) {
 		spin_lock_bh(&(priv->tx_q.lock));
 		__skb_queue_tail(&(priv->tx_q), skb);
 		spin_unlock_bh(&(priv->tx_q.lock));
@@ -7683,6 +9036,12 @@
  */
 void woal_init_priv(moal_private *priv, t_u8 wait_option)
 {
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	int i;
+#endif
+#endif
+
 	ENTER();
 #ifdef STA_SUPPORT
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
@@ -7745,6 +9104,14 @@
 #endif
 #endif
 #endif
+
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+		priv->vlan_sta_ptr = NULL;
+		for (i = 0; i < MAX_STA_COUNT; i++)
+			priv->vlan_sta_list[i] = NULL;
+#endif
+#endif
 	}
 #endif
 
@@ -7869,9 +9236,18 @@
 #ifdef UAP_SUPPORT
 	priv->target_chan = 0;
 	priv->backup_chan = 0;
+	priv->chan_mode = DEFAULT_CHAN_MODE_MASK;
+	priv->chan_num_pkts = DEFAULT_RETRY_PKTS;
 	priv->user_cac_period_msec = 0;
 	priv->chan_under_nop = MFALSE;
 #endif
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	priv->multi_ap_flag = 0;
+#endif
+#endif
+	priv->auth_tx_wait_time = AUTH_TX_DEFAULT_WAIT_TIME;
+	woal_set_interface_pending_limits(priv->phandle, priv);
 	LEAVE();
 }
 
@@ -8064,12 +9440,12 @@
  *
  *  @return             moal_private pointer or NULL
  */
-moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u8 bss_index)
+moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u32 bss_index)
 {
 	int i;
 
 	ENTER();
-	if (!handle || !handle->priv_num) {
+	if (!handle) {
 		LEAVE();
 		return NULL;
 	}
@@ -8134,13 +9510,18 @@
 {
 	mlan_ioctl_req *req = NULL;
 	gfp_t flag;
-
+	t_s32 temp_size = 0;
 	ENTER();
 
-	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
-	req = kzalloc((sizeof(mlan_ioctl_req) + size + sizeof(int) +
-		       sizeof(wait_queue)),
-		      flag);
+	flag = GFP_ATOMIC;
+
+	if (!woal_secure_add(
+		    &size,
+		    (sizeof(mlan_ioctl_req) + sizeof(int) + sizeof(wait_queue)),
+		    &temp_size, TYPE_SINT32))
+		PRINTM(MERROR, "%s:ioctl size overflow \n", __func__);
+
+	req = kzalloc(temp_size, flag);
 	if (!req) {
 		PRINTM(MERROR, "%s: Fail to alloc ioctl buffer\n", __func__);
 		LEAVE();
@@ -8241,15 +9622,25 @@
 		phandle->card_info = &card_info_SD9097;
 		break;
 #endif
-#ifdef SDNW62X
-	case CARD_TYPE_SDNW62X:
-		phandle->card_info = &card_info_SDNW62X;
+#ifdef SDAW693
+	case CARD_TYPE_SDAW693:
+		phandle->card_info = &card_info_SDAW693;
+		break;
+#endif
+#ifdef SDIW624
+	case CARD_TYPE_SDIW624:
+		phandle->card_info = &card_info_SDIW624;
+		break;
+#endif
+#ifdef SDIW610
+	case CARD_TYPE_SDIW610:
+		phandle->card_info = &card_info_SDIW610;
 		break;
 #endif
 #ifdef SD9177
 	case CARD_TYPE_SD9177:
 		phandle->card_info = &card_info_SD9177;
-		phandle->event_fw_dump = MFALSE;
+		phandle->event_fw_dump = MTRUE;
 		break;
 #endif
 #ifdef PCIE8997
@@ -8262,9 +9653,16 @@
 		phandle->card_info = &card_info_PCIE9097;
 		break;
 #endif
-#ifdef PCIENW62X
-	case CARD_TYPE_PCIENW62X:
-		phandle->card_info = &card_info_PCIENW62X;
+#ifdef PCIEAW693
+	case CARD_TYPE_PCIEAW693:
+		phandle->card_info = &card_info_PCIEAW693;
+		phandle->event_fw_dump = MTRUE;
+		break;
+#endif
+#ifdef PCIEIW624
+	case CARD_TYPE_PCIEIW624:
+		phandle->card_info = &card_info_PCIEIW624;
+		phandle->event_fw_dump = MTRUE;
 		break;
 #endif
 #ifdef PCIE9098
@@ -8298,9 +9696,14 @@
 		phandle->card_info = &card_info_USB9097;
 		break;
 #endif
-#ifdef USBNW62X
-	case CARD_TYPE_USBNW62X:
-		phandle->card_info = &card_info_USBNW62X;
+#ifdef USBIW624
+	case CARD_TYPE_USBIW624:
+		phandle->card_info = &card_info_USBIW624;
+		break;
+#endif
+#ifdef USBIW610
+	case CARD_TYPE_USBIW610:
+		phandle->card_info = &card_info_USBIW610;
 		break;
 #endif
 #ifdef SD8987
@@ -8541,9 +9944,11 @@
 				    AUTO_ASSOC_TYPE_DRV_ASSOC) {
 					/* disconnect before driver
 					 * assoc */
-					woal_disconnect(priv, MOAL_IOCTL_WAIT,
-							NULL,
-							DEF_DEAUTH_REASON_CODE);
+					if (woal_disconnect(
+						    priv, MOAL_IOCTL_WAIT, NULL,
+						    DEF_DEAUTH_REASON_CODE))
+						PRINTM(MERROR,
+						       "woal_disconnect failed\n");
 					if (priv->auto_assoc_priv
 						    .auto_assoc_type_on &
 					    (0x1 << (AUTO_ASSOC_TYPE_DRV_ASSOC -
@@ -8927,6 +10332,7 @@
 	handle->is_fw_dump_timer_set = MFALSE;
 	if (handle->priv_num)
 		woal_process_hang(handle);
+	handle->fw_dump = MFALSE;
 	LEAVE();
 	return;
 }
@@ -9056,6 +10462,7 @@
 	woal_stop_queue(priv->netdev);
 	if (netif_carrier_ok(priv->netdev))
 		netif_carrier_off(priv->netdev);
+	woal_flush_tx_stat_queue(priv);
 	woal_flush_tcp_sess_queue(priv);
 
 #ifdef STA_CFG80211
@@ -9108,7 +10515,8 @@
 	if (IS_STA_CFG80211(cfg80211_wext)) {
 		spin_lock_irqsave(&priv->connect_lock, flags);
 		if (!priv->cfg_disconnect && !priv->cfg_connect && priv->wdev &&
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 		    priv->wdev->connected) {
 #else
 		    priv->wdev->current_bss) {
@@ -9125,8 +10533,8 @@
 			   is not valid */
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 			if (priv->host_mlme)
-				woal_host_mlme_disconnect(priv, reason_code,
-							  NULL);
+				woal_deauth_event(priv, reason_code,
+						  priv->cfg_bssid);
 			else
 #endif
 				cfg80211_disconnected(priv->netdev, reason_code,
@@ -9165,9 +10573,85 @@
 }
 #endif /* STA_SUPPORT */
 
+#ifndef DUMP_TO_PROC
+#if defined(PCIE)
+/**
+ *  @brief  This function stores the SSU dumps in a file
+ *
+ *  @param phandle     A pointer to moal_handle
+ *  @param pmevent  A pointer to mlan_event structure
+ *
+ *  @return         N/A
+ */
+t_void woal_store_ssu_dump(moal_handle *phandle, mlan_event *pmevent)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+	struct dentry *dentry;
+	struct path path;
+#endif
+	struct file *pfile_ssudump = NULL;
+	char dw_string[10];
+	loff_t pos = 0;
+	t_u32 i;
+	t_u32 *tmpbuf;
+
+	ENTER();
+#if LINUX_VERSION_CODE > KERNEL_VERSION(3, 1, 0)
+	dentry = kern_path_create(AT_FDCWD, "/data", &path, 1);
+	if (IS_ERR(dentry)) {
+		goto save_ssudump;
+	}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
+	vfs_mkdir(path.dentry->d_inode, dentry, 0777);
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+	vfs_mkdir(&init_user_ns, path.dentry->d_inode, dentry, 0777);
+#else
+	vfs_mkdir(&nop_mnt_idmap, path.dentry->d_inode, dentry, 0777);
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
+	mutex_unlock(&path.dentry->d_inode->i_mutex);
+#else
+	done_path_create(&path, dentry);
+#endif
+save_ssudump:
+#endif
+	pfile_ssudump = filp_open("/data/ssudump.txt",
+				  O_CREAT | O_WRONLY | O_APPEND, 0644);
+	if (IS_ERR(pfile_ssudump)) {
+		PRINTM(MERROR, "Cannot create ssu dump file\n");
+		LEAVE();
+		return;
+	}
+	DBG_HEXDUMP(MEVT_D, "SSU addr", pmevent->event_buf, 8);
+	moal_memcpy_ext(phandle, &tmpbuf, pmevent->event_buf, sizeof(t_ptr),
+			sizeof(t_ptr));
+	PRINTM(MEVENT, "woal_store_ssu_dump: tmpbuf %p\n", tmpbuf);
+	for (i = 0; i < pmevent->event_len / 4; i++) {
+		if ((i + 1) % 8 == 0)
+			snprintf(dw_string, sizeof(dw_string), "%08x\n",
+				 *tmpbuf);
+		else
+			snprintf(dw_string, sizeof(dw_string), "%08x ",
+				 *tmpbuf);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+		vfs_write(pfile_ssudump, (const char __user *)dw_string, 9,
+			  &pos);
+#else
+		kernel_write(pfile_ssudump, dw_string, 9, &pos);
+#endif
+		tmpbuf++;
+	}
+	filp_close(pfile_ssudump, NULL);
+	LEAVE();
+	return;
+}
+#endif /* SSU_SUPPORT */
+#endif
+
 #define OFFSET_SEQNUM 4
 #define OFFSET_TYPE 8
 #define DUMP_TYPE_ENDE 2
+#ifdef DUMP_TO_PROC
 /**
  *  @brief  This function stores the FW dumps received from events
  *
@@ -9182,6 +10666,8 @@
 	t_u16 seqnum;
 	t_u16 type = 0;
 	t_u8 *pos;
+	moal_private *priv = NULL;
+	moal_handle *ref_handle = NULL;
 
 	ENTER();
 
@@ -9196,8 +10682,10 @@
 
 	if (seqnum == 1) {
 #ifdef DEBUG_LEVEL1
-		if (drvdbg & MFW_D)
+		if (drvdbg & MFW_D) {
+			drvdbg &= ~MFW_D;
 			phandle->fw_dump_status = MTRUE;
+		}
 #endif
 		if (phandle->fw_dump == MFALSE) {
 			PRINTM(MMSG, "=====FW trigger dump====\n");
@@ -9221,6 +10709,16 @@
 		}
 		phandle->fw_dump_len = 0;
 		PRINTM(MMSG, "==== Start Receive FW dump event  ====\n");
+		ref_handle = (moal_handle *)phandle->pref_mac;
+		if (ref_handle) {
+			if (!ref_handle->drv_dump_buf ||
+			    !ref_handle->drv_dump_len)
+				ref_handle->drv_dump_buf = woal_dump_drv_info(
+					ref_handle, &ref_handle->drv_dump_len);
+		}
+		if (!phandle->drv_dump_buf || !phandle->drv_dump_len)
+			phandle->drv_dump_buf = woal_dump_drv_info(
+				phandle, &phandle->drv_dump_len);
 	} else {
 		if (!phandle->fw_dump_buf || !phandle->fw_dump_len) {
 			PRINTM(MERROR,
@@ -9233,7 +10731,11 @@
 	moal_memcpy_ext(phandle, pos, pmevent->event_buf + OFFSET_SEQNUM,
 			pmevent->event_len - OFFSET_SEQNUM,
 			FW_DUMP_INFO_LEN - phandle->fw_dump_len);
-	phandle->fw_dump_len += pmevent->event_len - OFFSET_SEQNUM;
+	if (pmevent->event_len > OFFSET_SEQNUM) {
+		phandle->fw_dump_len += pmevent->event_len - OFFSET_SEQNUM;
+	} else {
+		PRINTM(MERROR, "event_len is invalid\n");
+	}
 
 	PRINTM(MINFO, "fw dump event: evt_len=%d toal_len=%ld\n",
 	       pmevent->event_len, (long int)phandle->fw_dump_len);
@@ -9247,8 +10749,9 @@
 			phandle->is_fw_dump_timer_set = MFALSE;
 		}
 		if (phandle->priv_num) {
-			woal_send_fw_dump_complete_event(
-				woal_get_priv(phandle, MLAN_BSS_ROLE_ANY));
+			priv = woal_get_priv(phandle, MLAN_BSS_ROLE_ANY);
+			if (priv)
+				woal_send_fw_dump_complete_event(priv);
 			mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
 			woal_process_hang(phandle);
 		}
@@ -9258,7 +10761,191 @@
 	return;
 }
 
-#define DRV_INFO_SIZE 0x60000
+#else
+
+t_void woal_print_firmware_dump(moal_handle *phandle, char *fwdp_fname)
+{
+	struct file *pfile_fwdump = NULL;
+	loff_t pos = 0;
+	t_u8 *pbuf = NULL;
+	t_u32 i = 0, count = 0, fwdump_len = 0, ret = 0;
+
+	ENTER();
+
+	pos = 0;
+	fwdump_len = (t_u32)phandle->fw_dump_len;
+
+	ret = moal_vmalloc(phandle, fwdump_len, &pbuf);
+	if (ret != MLAN_STATUS_SUCCESS || !pbuf) {
+		PRINTM(MFWDP_D, " moal_vmalloc failed\n");
+	} else {
+		memset(pbuf, 0, fwdump_len);
+		pfile_fwdump = filp_open(fwdp_fname, O_RDONLY, 0644);
+		ret = kernel_read(pfile_fwdump, pbuf,
+				  (long int)phandle->fw_dump_len, &pos);
+
+		if (ret <= 0) {
+			PRINTM(MFWDP_D, "kernel_read failed %d\n", ret);
+		} else {
+			PRINTM(MFWDP_D,
+			       "===== FW Dump To Console START=====\n");
+			for (i = 0;
+			     ((i < fwdump_len) && ((i + 15) < fwdump_len));
+			     i += 16) {
+				PRINTM(MFWDP_D,
+				       "[FW Dump] %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X\n",
+				       pbuf[i], pbuf[i + 1], pbuf[i + 2],
+				       pbuf[i + 3], pbuf[i + 4], pbuf[i + 5],
+				       pbuf[i + 6], pbuf[i + 7], pbuf[i + 8],
+				       pbuf[i + 9], pbuf[i + 10], pbuf[i + 11],
+				       pbuf[i + 12], pbuf[i + 13], pbuf[i + 14],
+				       pbuf[i + 15]);
+				count++;
+				usleep_range(10, 20);
+			}
+
+			if (i < fwdump_len) {
+				for (; i < fwdump_len; i++) {
+					PRINTM(MFWDP_D, "%02X\n", pbuf[i]);
+				}
+			}
+
+			PRINTM(MFWDP_D, "===== FW Dump To Console END=====\n");
+			PRINTM(MFWDP_D, "FW Dump buffer length = %d\n",
+			       fwdump_len);
+		}
+
+		filp_close(pfile_fwdump, NULL);
+	}
+
+	if (pbuf)
+		moal_vfree(phandle, pbuf);
+}
+
+t_void woal_store_firmware_dump(moal_handle *phandle, mlan_event *pmevent)
+{
+	struct file *pfile_fwdump = NULL;
+	loff_t pos = 0;
+	t_u16 seqnum;
+	t_u16 type = 0;
+	t_u8 path_name[64];
+	moal_handle *ref_handle = NULL;
+
+	ENTER();
+	if (phandle->fwdump_fname)
+		pfile_fwdump = filp_open(phandle->fwdump_fname,
+					 O_CREAT | O_WRONLY | O_APPEND, 0644);
+	else {
+		seqnum = woal_le16_to_cpu(
+			*(t_u16 *)(pmevent->event_buf + OFFSET_SEQNUM));
+		type = woal_le16_to_cpu(
+			*(t_u16 *)(pmevent->event_buf + OFFSET_TYPE));
+
+		if (seqnum == 1) {
+#ifdef DEBUG_LEVEL1
+			if (drvdbg & MFW_D) {
+				phandle->fw_dump_status = MTRUE;
+				drvdbg &= ~MFW_D;
+			}
+#endif
+			if (phandle->fw_dump == MFALSE) {
+				PRINTM(MMSG, "=====FW trigger dump====\n");
+				phandle->fw_dump = MTRUE;
+				phandle->is_fw_dump_timer_set = MTRUE;
+				woal_mod_timer(&phandle->fw_dump_timer,
+					       MOAL_TIMER_5S);
+			}
+			phandle->fw_dump_len = 0;
+			PRINTM(MMSG,
+			       "==== Start Receive FW dump event  ====\n");
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+			/** Create dump directort*/
+			woal_create_dump_dir(phandle, path_name,
+					     sizeof(path_name));
+#else
+			memset(path_name, 0, sizeof(path_name));
+			strncpy(path_name, "/data", sizeof(path_name));
+#endif
+			PRINTM(MMSG, "Firmware Dump directory name is %s\n",
+			       path_name);
+			ref_handle = (moal_handle *)phandle->pref_mac;
+			if (ref_handle)
+				woal_dump_drv_info(ref_handle, path_name);
+			woal_dump_drv_info(phandle, path_name);
+			if (fwdump_fname) {
+				memset(fwdump_fname, 0, 64);
+			} else {
+				gfp_t flag;
+				flag = (in_atomic() || irqs_disabled()) ?
+					       GFP_ATOMIC :
+					       GFP_KERNEL;
+				fwdump_fname = kzalloc(64, flag);
+				if (!fwdump_fname) {
+					PRINTM(MERROR,
+					       "Failed to allocate memory for fwdump fname\n");
+					LEAVE();
+					return;
+				}
+			}
+			snprintf(fwdump_fname, MAX_BUF_LEN, "%s/file_fwdump",
+				 path_name);
+			pfile_fwdump =
+				filp_open(fwdump_fname,
+					  O_CREAT | O_WRONLY | O_APPEND, 0644);
+			if (IS_ERR(pfile_fwdump)) {
+				memset(fwdump_fname, 0, 64);
+				snprintf(fwdump_fname, MAX_BUF_LEN, "%s/%s",
+					 "/var", "file_fwdump");
+				pfile_fwdump =
+					filp_open(fwdump_fname,
+						  O_CREAT | O_WRONLY | O_APPEND,
+						  0644);
+			}
+		} else
+			pfile_fwdump =
+				filp_open(fwdump_fname,
+					  O_CREAT | O_WRONLY | O_APPEND, 0644);
+	}
+	if (IS_ERR(pfile_fwdump)) {
+		PRINTM(MERROR, "Cannot create firmware dump file\n");
+		LEAVE();
+		return;
+	}
+	phandle->fw_dump_len += pmevent->event_len - OFFSET_SEQNUM;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	vfs_write(pfile_fwdump,
+		  (const char __user *)pmevent->event_buf + OFFSET_SEQNUM,
+		  pmevent->event_len - OFFSET_SEQNUM, &pos);
+#else
+	kernel_write(pfile_fwdump, pmevent->event_buf + OFFSET_SEQNUM,
+		     pmevent->event_len - OFFSET_SEQNUM, &pos);
+#endif
+	filp_close(pfile_fwdump, NULL);
+	if (type == DUMP_TYPE_ENDE) {
+		woal_print_firmware_dump(phandle,
+					 (phandle->fwdump_fname ?
+						  phandle->fwdump_fname :
+						  fwdump_fname));
+		PRINTM(MMSG, "==== FW DUMP END: %ld bytes ====\n",
+		       (long int)phandle->fw_dump_len);
+		phandle->fw_dump = MFALSE;
+		if (phandle->is_fw_dump_timer_set) {
+			woal_cancel_timer(&phandle->fw_dump_timer);
+			phandle->is_fw_dump_timer_set = MFALSE;
+		}
+		if (phandle->priv_num) {
+			woal_send_fw_dump_complete_event(
+				woal_get_priv(phandle, MLAN_BSS_ROLE_ANY));
+			mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
+			woal_process_hang(phandle);
+		}
+	}
+	LEAVE();
+	return;
+}
+#endif /* DUMP_TO_PROC */
+
+#define DRV_INFO_SIZE 0xA0000
 #define DRV_INFO_PER_INTF 0x11000
 #define ROW_SIZE_16 16
 #define ROW_SIZE_32 32
@@ -9292,10 +10979,10 @@
 		hex_dump_to_buffer(ptr + i, linelen, rowsize, 1, linebuf,
 				   sizeof(linebuf), false);
 
-		pos += sprintf(pos, "%s\n", linebuf);
+		pos += snprintf(pos, sizeof(linebuf), "%s\n", linebuf);
 	}
 
-	return pos - (char *)save_buf;
+	return (int)(pos - (char *)save_buf);
 }
 
 /**
@@ -9325,31 +11012,37 @@
 	     index++) {
 		priv = handle->priv[index];
 		if (priv) {
-			ptr += sprintf(ptr, "[Interface : %s]\n",
-				       priv->proc_entry_name);
+			ptr += snprintf(ptr, MAX_BUF_LEN, "[Interface : %s]\n",
+					priv->proc_entry_name);
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
-			ptr += sprintf(ptr, "wmm_tx_pending[0] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[0]));
-			ptr += sprintf(ptr, "wmm_tx_pending[1] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[1]));
-			ptr += sprintf(ptr, "wmm_tx_pending[2] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[2]));
-			ptr += sprintf(ptr, "wmm_tx_pending[3] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[3]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[0] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[0]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[1] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[1]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[2] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[2]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[3] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[3]));
 #endif
-			ptr += sprintf(ptr, "Media state = \"%s\"\n",
-				       ((priv->media_connected == MFALSE) ?
-						"Disconnected" :
-						"Connected"));
-			ptr += sprintf(ptr, "carrier %s\n",
-				       ((netif_carrier_ok(priv->netdev)) ?
-						"on" :
-						"off"));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"Media state = \"%s\"\n",
+					((priv->media_connected == MFALSE) ?
+						 "Disconnected" :
+						 "Connected"));
+			ptr += snprintf(ptr, MAX_BUF_LEN, "carrier %s\n",
+					((netif_carrier_ok(priv->netdev)) ?
+						 "on" :
+						 "off"));
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 			for (i = 0; i < (int)(priv->netdev->num_tx_queues);
 			     i++) {
-				ptr += sprintf(
-					ptr, "tx queue %d: %s\n", i,
+				ptr += snprintf(
+					ptr, MAX_BUF_LEN, "tx queue %d: %s\n",
+					i,
 					((netif_tx_queue_stopped(
 						 netdev_get_tx_queue(
 							 priv->netdev, i))) ?
@@ -9357,19 +11050,20 @@
 						 "started"));
 			}
 #else
-			ptr += sprintf(ptr, "tx queue %s\n",
-				       ((netif_queue_stopped(priv->netdev)) ?
-						"stopped" :
-						"started"));
+			ptr += snprintf(ptr, MAX_BUF_LEN, "tx queue %s\n",
+					((netif_queue_stopped(priv->netdev)) ?
+						 "stopped" :
+						 "started"));
 #endif
-			ptr += sprintf(ptr, "%s: num_tx_timeout = %d\n",
-				       priv->netdev->name,
-				       priv->num_tx_timeout);
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"%s: num_tx_timeout = %d\n",
+					priv->netdev->name,
+					priv->num_tx_timeout);
 		}
 	}
 
 	LEAVE();
-	return ptr - (char *)buf;
+	return (int)(ptr - (char *)buf);
 }
 
 /**
@@ -9387,6 +11081,10 @@
 	struct usb_card_rec *cardp = NULL;
 #endif
 	char str_buf[MLAN_MAX_VER_STR_LEN];
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+	char hostname[MAX_HOSTNAME_LEN];
+	char tstamp[MAX_TIME_LEN];
+#endif
 
 	ENTER();
 	if (!phandle || !buf) {
@@ -9399,55 +11097,66 @@
 		cardp = (struct usb_card_rec *)phandle->card;
 #endif
 	ptr = (char *)buf;
-	ptr += sprintf(ptr, "------------moal_debug_info-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------moal_debug_info-------------\n");
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+	woal_get_hostname(hostname);
+	woal_get_timestamp(tstamp);
+	ptr += snprintf(ptr, MAX_HOSTNAME_LEN, "Host:%s ", hostname);
+	ptr += snprintf(ptr, MAX_TIME_LEN, "Timestamp:%s", tstamp);
+#endif
 	woal_get_version(phandle, str_buf, sizeof(str_buf) - 1);
-	ptr += sprintf(ptr, "Driver version = %s\n", str_buf);
-	ptr += sprintf(ptr, "main_state = %d\n", phandle->main_state);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "Driver version = %s\n", str_buf);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "main_state = %d\n",
+			phandle->main_state);
 #ifdef USB
 	if (IS_USB(phandle->card_type)) {
-		ptr += sprintf(ptr, "tx_cmd_urb_pending = %d\n",
-			       atomic_read(&cardp->tx_cmd_urb_pending));
-		ptr += sprintf(ptr, "tx_data_urb_pending = %d\n",
-			       atomic_read(&cardp->tx_data_urb_pending));
-		ptr += sprintf(ptr, "tx_data2_urb_pending = %d\n",
-			       atomic_read(&cardp->tx_data2_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "tx_cmd_urb_pending = %d\n",
+				atomic_read(&cardp->tx_cmd_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "tx_data_urb_pending = %d\n",
+				atomic_read(&cardp->tx_data_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "tx_data2_urb_pending = %d\n",
+				atomic_read(&cardp->tx_data2_urb_pending));
 #ifdef USB_CMD_DATA_EP
-		ptr += sprintf(ptr, "rx_cmd_urb_pending = %d\n",
-			       atomic_read(&cardp->rx_cmd_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "rx_cmd_urb_pending = %d\n",
+				atomic_read(&cardp->rx_cmd_urb_pending));
 #endif
-		ptr += sprintf(ptr, "rx_data_urb_pending = %d\n",
-			       atomic_read(&cardp->rx_data_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "rx_data_urb_pending = %d\n",
+				atomic_read(&cardp->rx_data_urb_pending));
 	}
 #endif
-	ptr += sprintf(ptr, "ioctl_pending = %d\n",
-		       atomic_read(&phandle->ioctl_pending));
-	ptr += sprintf(ptr, "tx_pending = %d\n",
-		       atomic_read(&phandle->tx_pending));
-	ptr += sprintf(ptr, "rx_pending = %d\n",
-		       atomic_read(&phandle->rx_pending));
-	ptr += sprintf(ptr, "lock_count = %d\n",
-		       atomic_read(&phandle->lock_count));
-	ptr += sprintf(ptr, "malloc_count = %d\n",
-		       atomic_read(&phandle->malloc_count));
-	ptr += sprintf(ptr, "mbufalloc_count = %d\n",
-		       atomic_read(&phandle->mbufalloc_count));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "ioctl_pending = %d\n",
+			atomic_read(&phandle->ioctl_pending));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_pending = %d\n",
+			atomic_read(&phandle->tx_pending));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "rx_pending = %d\n",
+			atomic_read(&phandle->rx_pending));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "lock_count = %d\n",
+			atomic_read(&phandle->lock_count));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "malloc_count = %d\n",
+			atomic_read(&phandle->malloc_count));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mbufalloc_count = %d\n",
+			atomic_read(&phandle->mbufalloc_count));
 #ifdef PCIE
 	if (IS_PCIE(phandle->card_type)) {
-		ptr += sprintf(ptr, "malloc_cons_count = %d\n",
-			       atomic_read(&phandle->malloc_cons_count));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "malloc_cons_count = %d\n",
+				atomic_read(&phandle->malloc_cons_count));
 	}
 #endif
-	ptr += sprintf(ptr, "hs_skip_count = %u\n", phandle->hs_skip_count);
-	ptr += sprintf(ptr, "hs_force_count = %u\n", phandle->hs_force_count);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "hs_skip_count = %u\n",
+			phandle->hs_skip_count);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "hs_force_count = %u\n",
+			phandle->hs_force_count);
 
 	ptr += woal_dump_priv_drv_info(phandle, ptr);
-	ptr += sprintf(ptr, "------------moal_debug_info End-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------moal_debug_info End-------------\n");
 
 	if (phandle->ops.dump_reg_info)
 		ptr += phandle->ops.dump_reg_info(phandle, ptr);
 
 	LEAVE();
-	return ptr - (char *)buf;
+	return (int)(ptr - (char *)buf);
 }
 
 /**
@@ -9483,80 +11192,107 @@
 		LEAVE();
 		return 0;
 	}
-	ptr += sprintf(ptr, "------------mlan_debug_info-------------\n");
-	ptr += sprintf(ptr, "mlan_processing =%d\n", info->mlan_processing);
-	ptr += sprintf(ptr, "main_lock_flag =%d\n", info->main_lock_flag);
-	ptr += sprintf(ptr, "main_process_cnt =%d\n", info->main_process_cnt);
-	ptr += sprintf(ptr, "delay_task_flag =%d\n", info->delay_task_flag);
-	ptr += sprintf(ptr, "mlan_rx_processing =%d\n",
-		       info->mlan_rx_processing);
-	ptr += sprintf(ptr, "rx_pkts_queued =%d\n", info->rx_pkts_queued);
-	ptr += sprintf(ptr, "tx_pkts_queued =%d\n", info->tx_pkts_queued);
-	ptr += sprintf(ptr, "fw_hang_report = %d\n", info->fw_hang_report);
-	ptr += sprintf(ptr, "num_cmd_timeout = %d\n", info->num_cmd_timeout);
-	ptr += sprintf(ptr, "Timeout cmd id = 0x%x, act = 0x%x\n",
-		       info->timeout_cmd_id, info->timeout_cmd_act);
-	ptr += sprintf(ptr, "last_cmd_index = %d\n", info->last_cmd_index);
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------mlan_debug_info-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mlan_processing =%d\n",
+			info->mlan_processing);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "main_lock_flag =%d\n",
+			info->main_lock_flag);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "main_process_cnt =%d\n",
+			info->main_process_cnt);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "delay_task_flag =%d\n",
+			info->delay_task_flag);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mlan_rx_processing =%d\n",
+			info->mlan_rx_processing);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "rx_pkts_queued =%d\n",
+			info->rx_pkts_queued);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_pkts_queued =%d\n",
+			info->tx_pkts_queued);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "fw_hang_report = %d\n",
+			info->fw_hang_report);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_timeout = %d\n",
+			info->num_cmd_timeout);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_no_cmd_node = %d\n",
+			info->num_no_cmd_node);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_assoc_err = %d\n",
+			info->num_assoc_err);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_scan_err = %d\n",
+			info->num_scan_err);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_remain_chan_err = %d\n",
+			info->num_remain_chan_err);
+	if (info->timeout_cmd_id)
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"Timeout cmd id = 0x%x, act = 0x%x\n",
+				info->timeout_cmd_id, info->timeout_cmd_act);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_index = %d\n",
+			info->last_cmd_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_id[i]);
-	ptr += sprintf(ptr, "last_cmd_id = %s\n", str);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_id[i]);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_id = %s\n", str);
 
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_act[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_act[i]);
 
-	ptr += sprintf(ptr, "last_cmd_act = %s\n", str);
-	ptr += sprintf(ptr, "last_cmd_resp_index = %d\n",
-		       info->last_cmd_resp_index);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_act = %s\n", str);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_resp_index = %d\n",
+			info->last_cmd_resp_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_resp_id[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ",
+			      info->last_cmd_resp_id[i]);
 
-	ptr += sprintf(ptr, "last_cmd_resp_id = %s\n", str);
-	ptr += sprintf(ptr, "last_event_index = %d\n", info->last_event_index);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_resp_id = %s\n", str);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_event_index = %d\n",
+			info->last_event_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_event[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_event[i]);
 
-	ptr += sprintf(ptr, "last_event = %s\n", str);
-	ptr += sprintf(ptr, "num_data_h2c_failure = %d\n",
-		       info->num_tx_host_to_card_failure);
-	ptr += sprintf(ptr, "num_cmd_h2c_failure = %d\n",
-		       info->num_cmd_host_to_card_failure);
-	ptr += sprintf(ptr, "num_alloc_buffer_failure = %d\n",
-		       info->num_alloc_buffer_failure);
-	ptr += sprintf(ptr, "num_pkt_dropped = %d\n", info->num_pkt_dropped);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_event = %s\n", str);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_data_h2c_failure = %d\n",
+			info->num_tx_host_to_card_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_h2c_failure = %d\n",
+			info->num_cmd_host_to_card_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_alloc_buffer_failure = %d\n",
+			info->num_alloc_buffer_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_pkt_dropped = %d\n",
+			info->num_pkt_dropped);
 #ifdef SDIO
 	if (IS_SD(priv->phandle->card_type)) {
-		ptr += sprintf(ptr, "num_data_c2h_failure = %d\n",
-			       info->num_rx_card_to_host_failure);
-		ptr += sprintf(ptr, "num_cmdevt_c2h_failure = %d\n",
-			       info->num_cmdevt_card_to_host_failure);
-		ptr += sprintf(ptr, "num_int_read_failure = %d\n",
-			       info->num_int_read_failure);
-		ptr += sprintf(ptr, "last_int_status = %d\n",
-			       info->last_int_status);
-		ptr += sprintf(ptr, "mp_rd_bitmap=0x%x curr_rd_port=0x%x\n",
-			       (unsigned int)info->mp_rd_bitmap,
-			       info->curr_rd_port);
-		ptr += sprintf(ptr, "mp_wr_bitmap=0x%x curr_wr_port=0x%x\n",
-			       (unsigned int)info->mp_wr_bitmap,
-			       info->curr_wr_port);
-		ptr += sprintf(ptr, "mp_data_port_mask=0x%x\n",
-			       info->mp_data_port_mask);
-		ptr += sprintf(
-			ptr, "last_recv_rd_bitmap=0x%x mp_invalid_update=%d\n",
+		ptr += snprintf(ptr, MAX_BUF_LEN, "num_data_c2h_failure = %d\n",
+				info->num_rx_card_to_host_failure);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"num_cmdevt_c2h_failure = %d\n",
+				info->num_cmdevt_card_to_host_failure);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "num_int_read_failure = %d\n",
+				info->num_int_read_failure);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "last_int_status = %d\n",
+				info->last_int_status);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mp_rd_bitmap=0x%x curr_rd_port=0x%x\n",
+				(unsigned int)info->mp_rd_bitmap,
+				info->curr_rd_port);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mp_wr_bitmap=0x%x curr_wr_port=0x%x\n",
+				(unsigned int)info->mp_wr_bitmap,
+				info->curr_wr_port);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "mp_data_port_mask=0x%x\n",
+				info->mp_data_port_mask);
+		ptr += snprintf(
+			ptr, MAX_BUF_LEN,
+			"last_recv_rd_bitmap=0x%x mp_invalid_update=%d\n",
 			info->last_recv_rd_bitmap, info->mp_invalid_update);
 		mp_aggr_pkt_limit = info->mp_aggr_pkt_limit;
-		ptr += sprintf(ptr,
-			       "last_recv_wr_bitmap=0x%x last_mp_index = %d\n",
-			       info->last_recv_wr_bitmap, info->last_mp_index);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"last_recv_wr_bitmap=0x%x last_mp_index = %d\n",
+				info->last_recv_wr_bitmap, info->last_mp_index);
 		for (i = 0; i < SDIO_MP_DBG_NUM; i++) {
 			for (s = str, j = 0; j < mp_aggr_pkt_limit; j++)
-				s += sprintf(
-					s, "0x%02x ",
+				s += snprintf(
+					s, MAX_BUF_LEN, "0x%02x ",
 					info->last_mp_wr_info
 						[i * mp_aggr_pkt_limit + j]);
 
-			ptr += sprintf(
-				ptr,
+			ptr += snprintf(
+				ptr, MAX_BUF_LEN,
 				"mp_wr_bitmap: 0x%x mp_wr_ports=0x%x len=%d curr_wr_port=0x%x\n%s\n",
 				info->last_mp_wr_bitmap[i],
 				info->last_mp_wr_ports[i],
@@ -9567,80 +11303,178 @@
 #endif
 #ifdef PCIE
 	if (IS_PCIE(priv->phandle->card_type)) {
-		ptr += sprintf(ptr, "txbd_rdptr=0x%x txbd_wrptr=0x%x\n",
-			       info->txbd_rdptr, info->txbd_wrptr);
-		ptr += sprintf(ptr, "rxbd_rdptr=0x%x rxbd_wrptr=0x%x\n",
-			       info->rxbd_rdptr, info->rxbd_wrptr);
-		ptr += sprintf(ptr, "eventbd_rdptr=0x%x event_wrptr=0x%x\n",
-			       info->eventbd_rdptr, info->eventbd_wrptr);
-		ptr += sprintf(ptr, "last_wr_index:%d\n",
-			       info->txbd_wrptr & (info->txrx_bd_size - 1));
-		ptr += sprintf(ptr, "TxRx BD size:%d\n", info->txrx_bd_size);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"txbd_rdptr=0x%x txbd_wrptr=0x%x\n",
+				info->txbd_rdptr, info->txbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"rxbd_rdptr=0x%x rxbd_wrptr=0x%x\n",
+				info->rxbd_rdptr, info->rxbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"eventbd_rdptr=0x%x event_wrptr=0x%x\n",
+				info->eventbd_rdptr, info->eventbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "last_wr_index:%d\n",
+				info->txbd_wrptr & (info->txrx_bd_size - 1));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "TxRx BD size:%d\n",
+				info->txrx_bd_size);
 	}
 #endif
-	ptr += sprintf(ptr, "num_event_deauth = %d\n", info->num_event_deauth);
-	ptr += sprintf(ptr, "num_event_disassoc = %d\n",
-		       info->num_event_disassoc);
-	ptr += sprintf(ptr, "num_event_link_lost = %d\n",
-		       info->num_event_link_lost);
-	ptr += sprintf(ptr, "num_cmd_deauth = %d\n", info->num_cmd_deauth);
-	ptr += sprintf(ptr, "num_cmd_assoc_success = %d\n",
-		       info->num_cmd_assoc_success);
-	ptr += sprintf(ptr, "num_cmd_assoc_failure = %d\n",
-		       info->num_cmd_assoc_failure);
-	ptr += sprintf(ptr, "num_cons_assoc_failure = %d\n",
-		       info->num_cons_assoc_failure);
-	ptr += sprintf(ptr, "cmd_resp_received = %d\n",
-		       info->cmd_resp_received);
-	ptr += sprintf(ptr, "event_received = %d\n", info->event_received);
-	ptr += sprintf(ptr, "max_tx_buf_size = %d\n", info->max_tx_buf_size);
-	ptr += sprintf(ptr, "tx_buf_size = %d\n", info->tx_buf_size);
-	ptr += sprintf(ptr, "curr_tx_buf_size = %d\n", info->curr_tx_buf_size);
-	ptr += sprintf(ptr, "bypass_pkt_count=%d\n", info->bypass_pkt_count);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_event_deauth = %d\n",
+			info->num_event_deauth);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_event_disassoc = %d\n",
+			info->num_event_disassoc);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_event_link_lost = %d\n",
+			info->num_event_link_lost);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_deauth = %d\n",
+			info->num_cmd_deauth);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_assoc_success = %d\n",
+			info->num_cmd_assoc_success);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_assoc_failure = %d\n",
+			info->num_cmd_assoc_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cons_assoc_failure = %d\n",
+			info->num_cons_assoc_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "cmd_resp_received = %d\n",
+			info->cmd_resp_received);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "event_received = %d\n",
+			info->event_received);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "max_tx_buf_size = %d\n",
+			info->max_tx_buf_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_buf_size = %d\n",
+			info->tx_buf_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "curr_tx_buf_size = %d\n",
+			info->curr_tx_buf_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "bypass_pkt_count=%d\n",
+			info->bypass_pkt_count);
 
-	ptr += sprintf(ptr, "data_sent=%d cmd_sent=%d\n", info->data_sent,
-		       info->cmd_sent);
-	ptr += sprintf(ptr, "data_sent_cnt=%u\n", info->data_sent_cnt);
-	ptr += sprintf(ptr, "ps_mode=%d ps_state=%d\n", info->ps_mode,
-		       info->ps_state);
-	ptr += sprintf(
-		ptr, "wakeup_dev_req=%d wakeup_tries=%d pm_wakeup_timeout=%d\n",
+	ptr += snprintf(ptr, MAX_BUF_LEN, "data_sent=%d cmd_sent=%d\n",
+			info->data_sent, info->cmd_sent);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "data_sent_cnt=%u\n",
+			info->data_sent_cnt);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "ps_mode=%d ps_state=%d\n",
+			info->ps_mode, info->ps_state);
+	ptr += snprintf(
+		ptr, MAX_BUF_LEN,
+		"wakeup_dev_req=%d wakeup_tries=%d pm_wakeup_timeout=%d\n",
 		info->pm_wakeup_card_req, info->pm_wakeup_fw_try,
 		info->pm_wakeup_timeout);
-	ptr += sprintf(ptr, "hs_configured=%d hs_activated=%d\n",
-		       info->is_hs_configured, info->hs_activated);
-	ptr += sprintf(ptr, "pps_uapsd_mode=%d sleep_pd=%d\n",
-		       info->pps_uapsd_mode, info->sleep_pd);
-	ptr += sprintf(ptr, "tx_lock_flag = %d\n", info->tx_lock_flag);
-	ptr += sprintf(ptr, "port_open = %d\n", info->port_open);
-	ptr += sprintf(ptr, "scan_processing = %d\n", info->scan_processing);
-	ptr += sprintf(ptr, "scan_state = %d\n", info->scan_state);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "hs_configured=%d hs_activated=%d\n",
+			info->is_hs_configured, info->hs_activated);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "pps_uapsd_mode=%d sleep_pd=%d\n",
+			info->pps_uapsd_mode, info->sleep_pd);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_lock_flag = %d\n",
+			info->tx_lock_flag);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "port_open = %d\n", info->port_open);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_pause = %d\n", info->tx_pause);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "scan_processing = %d\n",
+			info->scan_processing);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "scan_state = %d\n",
+			info->scan_state);
 
 #ifdef PCIE
 	if (IS_PCIE(priv->phandle->card_type)) {
-		ptr += sprintf(ptr, "txbd: rdptr=0x%x wrptr=0x%x\n",
-			       info->txbd_rdptr, info->txbd_wrptr);
-		ptr += sprintf(ptr, "rxbd: rdptr=0x%x wrptr=0x%x\n",
-			       info->rxbd_rdptr, info->rxbd_wrptr);
-		ptr += sprintf(ptr, "eventbd: rdptr=0x%x wrptr=0x%x\n",
-			       info->eventbd_rdptr, info->eventbd_wrptr);
-		ptr += sprintf(ptr, "TXBD Ring:\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"txbd: rdptr=0x%x wrptr=0x%x\n",
+				info->txbd_rdptr, info->txbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"rxbd: rdptr=0x%x wrptr=0x%x\n",
+				info->rxbd_rdptr, info->rxbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"eventbd: rdptr=0x%x wrptr=0x%x\n",
+				info->eventbd_rdptr, info->eventbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "TXBD Ring:\n");
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->txbd_ring_vbase,
 					  info->txbd_ring_size, MTRUE, ptr);
-		ptr += sprintf(ptr, "RXBD Ring:\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "RXBD Ring:\n");
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->rxbd_ring_vbase,
 					  info->rxbd_ring_size, MTRUE, ptr);
-		ptr += sprintf(ptr, "EVTBD Ring:\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "EVTBD Ring:\n");
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->evtbd_ring_vbase,
 					  info->evtbd_ring_size, MTRUE, ptr);
 	}
 #endif
-	ptr += sprintf(ptr, "------------mlan_debug_info End-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------mlan_debug_info End-------------\n");
 
 	LEAVE();
 	return ptr - (char *)buf;
 }
 
+#ifndef DUMP_TO_PROC
+#define HostCmd_CMD_CFG_DATA 0x008f
+#define DEF_FW_PATH "/lib/firmware/"
+#define DEF_HOSTCMD_PATH "/lib/firmware/nxp/hostcmd.conf"
+/**
+ *  @brief This function save the hostcmd response to file
+ *
+ *  @param phandle   A pointer to moal_handle
+ *  @param pevent    A pointer to mlan_cmdresp_event
+ *
+ *  @return          N/A
+ */
+t_void woal_save_host_cmdresp(moal_handle *phandle, mlan_cmdresp_event *pevent)
+{
+	HostCmd_DS_GEN *resp;
+	char file_path[256];
+	struct file *pfile = NULL;
+	char *dpd_data_cfg = phandle->params.dpd_data_cfg;
+	int ret;
+	t_u8 *buf;
+	t_u16 command;
+	int len = 0;
+	char *ptr;
+	loff_t pos = 0;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	mm_segment_t fs;
+#endif
+
+	resp = (HostCmd_DS_GEN *)pevent->resp;
+	command = woal_le16_to_cpu(resp->command);
+	memset(file_path, 0, sizeof(file_path));
+	ret = moal_vmalloc(phandle, pevent->event_len * 5, &buf);
+	if (ret != MLAN_STATUS_SUCCESS || !buf) {
+		PRINTM(MERROR, "Fail to allocate memory to save hostcmd\n");
+		return;
+	}
+	memset(buf, 0, pevent->event_len * 5);
+	ptr = (char *)buf;
+	switch (command) {
+	case HostCmd_CMD_CFG_DATA:
+		if (dpd_data_cfg)
+			snprintf(file_path, sizeof(file_path), "%s%s",
+				 DEF_FW_PATH, dpd_data_cfg);
+		break;
+	default:
+		snprintf(file_path, sizeof(file_path), "%s", DEF_HOSTCMD_PATH);
+		break;
+	}
+	pfile = filp_open(file_path, O_CREAT | O_WRONLY | O_APPEND, 0644);
+	if (IS_ERR(pfile)) {
+		PRINTM(MERROR, "Cannot create file %s\n", file_path);
+		moal_vfree(phandle, buf);
+		return;
+	}
+	ptr += snprintf(ptr, MAX_BUF_LEN, "hostcmd_%02x=={\n", command);
+	ptr += woal_save_hex_dump(ROW_SIZE_16, resp, pevent->event_len, MFALSE,
+				  ptr);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "}\n");
+	len = ptr - (char *)buf;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	fs = get_fs();
+	set_fs(KERNEL_DS);
+	vfs_write(pfile, (const char __user *)buf, len, &pos);
+	set_fs(fs);
+#else
+	kernel_write(pfile, buf, len, &pos);
+#endif
+	PRINTM(MMSG, "Save hostcmd 0x%02x, cmd len=%d file len=%d to file %s\n",
+	       command, pevent->event_len, len, file_path);
+	if (buf)
+		moal_vfree(phandle, buf);
+	filp_close(pfile, NULL);
+	return;
+}
+#endif
+
 /**
  *  @brief This function dump moal hex to file
  *
@@ -9661,30 +11495,32 @@
 		return 0;
 	}
 
-	ptr += sprintf(ptr, "<--moal_handle-->\n");
-	ptr += sprintf(ptr, "moal_handle=%p, size=%ld(0x%lx)\n", phandle,
-		       (long int)sizeof(*phandle),
-		       (long unsigned int)sizeof(*phandle));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--moal_handle-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "moal_handle=%p, size=%ld(0x%lx)\n",
+			phandle, (long int)sizeof(*phandle),
+			(long unsigned int)sizeof(*phandle));
 	ptr += woal_save_hex_dump(ROW_SIZE_16, phandle, sizeof(*phandle), MTRUE,
 				  ptr);
-	ptr += sprintf(ptr, "<--moal_handle End-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--moal_handle End-->\n");
 
 	for (i = 0; i < phandle->priv_num; i++) {
 		if (!phandle->priv[i])
 			continue;
-		ptr += sprintf(ptr, "<--moal_private(%d) %s-->\n", i,
-			       phandle->priv[i]->netdev->name);
-		ptr += sprintf(ptr, "moal_private=%p, size=%ld(0x%lx)\n",
-			       phandle->priv[i],
-			       (long int)sizeof(*(phandle->priv[i])),
-			       (long unsigned int)sizeof(*(phandle->priv[i])));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--moal_private(%d) %s-->\n",
+				i, phandle->priv[i]->netdev->name);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"moal_private=%p, size=%ld(0x%lx)\n",
+				phandle->priv[i],
+				(long int)sizeof(*(phandle->priv[i])),
+				(long unsigned int)sizeof(*(phandle->priv[i])));
 		ptr += woal_save_hex_dump(ROW_SIZE_16, phandle->priv[i],
 					  sizeof(*(phandle->priv[i])), MTRUE,
 					  ptr);
-		ptr += sprintf(ptr, "<--moal_private(%d) End-->\n", i);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"<--moal_private(%d) End-->\n", i);
 	}
 	LEAVE();
-	return ptr - (char *)buf;
+	return (int)(ptr - (char *)buf);
 }
 
 /**
@@ -9715,39 +11551,44 @@
 		return 0;
 	}
 
-	ptr += sprintf(ptr, "<--mlan_adapter-->\n");
-	ptr += sprintf(ptr, "mlan_adapter=%p, size=%d(0x%x)\n",
-		       info->mlan_adapter, info->mlan_adapter_size,
-		       info->mlan_adapter_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_adapter-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mlan_adapter=%p, size=%d(0x%x)\n",
+			info->mlan_adapter, info->mlan_adapter_size,
+			info->mlan_adapter_size);
 	ptr += woal_save_hex_dump(ROW_SIZE_16, info->mlan_adapter,
 				  info->mlan_adapter_size, MTRUE, ptr);
-	ptr += sprintf(ptr, "<--mlan_adapter End-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_adapter End-->\n");
 #ifdef SDIO
 	if (IS_SD(priv->phandle->card_type) && info->mpa_buf &&
 	    info->mpa_buf_size) {
-		ptr += sprintf(ptr, "<--mlan_mpa_buf-->\n");
-		ptr += sprintf(ptr, "mlan_mpa_buf=%p, size=%d(0x%x)\n",
-			       info->mpa_buf, info->mpa_buf_size,
-			       info->mpa_buf_size);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_mpa_buf-->\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mlan_mpa_buf=%p, size=%d(0x%x)\n",
+				info->mpa_buf, info->mpa_buf_size,
+				info->mpa_buf_size);
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->mpa_buf,
 					  info->mpa_buf_size, MTRUE, ptr);
-		ptr += sprintf(ptr, "<--mlan_mpa_buf End-->\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_mpa_buf End-->\n");
 	}
 #endif
 	for (i = 0; i < info->mlan_priv_num; i++) {
-		ptr += sprintf(ptr, "<--mlan_private(%d)-->\n", i);
-		ptr += sprintf(ptr, "mlan_private=%p, size=%d(0x%x)\n",
-			       info->mlan_priv[i], info->mlan_priv_size[i],
-			       info->mlan_priv_size[i]);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_private(%d)-->\n",
+				i);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mlan_private=%p, size=%d(0x%x)\n",
+				info->mlan_priv[i], info->mlan_priv_size[i],
+				info->mlan_priv_size[i]);
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->mlan_priv[i],
 					  info->mlan_priv_size[i], MTRUE, ptr);
-		ptr += sprintf(ptr, "<--mlan_private(%d) End-->\n", i);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"<--mlan_private(%d) End-->\n", i);
 	}
 
 	LEAVE();
 	return ptr - (char *)buf;
 }
 
+#ifdef DUMP_TO_PROC
 /**
  *  @brief This function dump drv info to file
  *
@@ -9792,7 +11633,243 @@
 done:
 	return drv_buf;
 }
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+/**
+ *  @brief This function create dump directory
+ *
+ *  @param phandle   A pointer to moal_handle
+ *  @param dir_buf   A pointer to dir_buf buffer
+ *  @param buf_size  Size of dir_buf buffer
+ *
+ *  @return         N/A
+ */
+void woal_create_dump_dir(moal_handle *phandle, char *dir_buf, int buf_size)
+{
+	struct dentry *dentry;
+	struct path path;
+	t_u32 sec, usec;
+	int ret;
 
+	ENTER();
+
+	if (!phandle || !dir_buf) {
+		PRINTM(MERROR, "Can't create directory\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	moal_get_system_time(phandle, &sec, &usec);
+	memset(dir_buf, 0, buf_size);
+	snprintf(dir_buf, MAX_BUF_LEN, "%s%u", "/data/dump_", sec);
+
+	dentry = kern_path_create(AT_FDCWD, dir_buf, &path, 1);
+	if (IS_ERR(dentry)) {
+		PRINTM(MERROR,
+		       "Create directory %s error, try create dir in /var",
+		       dir_buf);
+		memset(dir_buf, 0, buf_size);
+		snprintf(dir_buf, MAX_BUF_LEN, "%s%u", "/var/dump_", sec);
+		dentry = kern_path_create(AT_FDCWD, dir_buf, &path, 1);
+	}
+	if (IS_ERR(dentry)) {
+		PRINTM(MERROR, "Create directory %s error, use default folder",
+		       dir_buf);
+		goto default_dir;
+	}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0)
+	ret = vfs_mkdir(path.dentry->d_inode, dentry, 0777);
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
+	ret = vfs_mkdir(&init_user_ns, path.dentry->d_inode, dentry, 0777);
+#else
+	ret = vfs_mkdir(&nop_mnt_idmap, path.dentry->d_inode, dentry, 0777);
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
+	mutex_unlock(&path.dentry->d_inode->i_mutex);
+#else
+	done_path_create(&path, dentry);
+#endif
+
+	if (ret < 0) {
+		PRINTM(MERROR,
+		       "Create directory failure, use default folder\n");
+		PRINTM(MERROR, "Create directory failure, ret = %d\n", ret);
+		goto default_dir;
+	} else {
+		PRINTM(MMSG, "Create directory %s successfully\n", dir_buf);
+		goto done;
+	}
+
+default_dir:
+	memset(dir_buf, 0, buf_size);
+	snprintf(dir_buf, MAX_BUF_LEN, "%s", "/data");
+done:
+	LEAVE();
+}
+#endif
+
+/**
+ *  @brief This function save dump buf to file
+ *
+ *  @param dir_name  A pointer to directory name
+ *  @param file_name A pointer to file name
+ *  @param buf       A pointer to dump data
+ *  @param buf_len   The length of dump buf
+ *
+ *  @return         SUCCESS OR FAILURE
+ */
+mlan_status woal_save_dump_info_to_file(char *dir_name, char *file_name,
+					t_u8 *buf, t_u32 buf_len)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	struct file *pfile = NULL;
+	t_u8 name[64];
+	loff_t pos;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	mm_segment_t fs;
+#endif
+
+	ENTER();
+
+	if (!dir_name || !file_name || !buf) {
+		PRINTM(MERROR, "Can't save dump info to file\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	memset(name, 0, sizeof(name));
+	snprintf(name, sizeof(name), "%s/%s", dir_name, file_name);
+	pfile = filp_open(name, O_CREAT | O_RDWR, 0644);
+	if (IS_ERR(pfile)) {
+		PRINTM(MMSG,
+		       "Create file %s error, try to save dump file in /var\n",
+		       name);
+		memset(name, 0, sizeof(name));
+		snprintf(name, sizeof(name), "%s/%s", "/var", file_name);
+		pfile = filp_open(name, O_CREAT | O_RDWR, 0644);
+	}
+	if (IS_ERR(pfile)) {
+		PRINTM(MERROR, "Create Dump file for %s error\n", name);
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	PRINTM(MMSG, "Dump data %s saved in %s\n", file_name, name);
+
+	pos = 0;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	fs = get_fs();
+	set_fs(KERNEL_DS);
+	vfs_write(pfile, (const char __user *)buf, buf_len, &pos);
+	set_fs(fs);
+#else
+	kernel_write(pfile, buf, buf_len, &pos);
+#endif
+	filp_close(pfile, NULL);
+
+	PRINTM(MMSG, "Dump data %s saved in %s successfully\n", file_name,
+	       name);
+
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function dump drv info to file
+ *
+ *  @param phandle   A pointer to moal_handle
+ *  @param dir_name   A pointer to directory name
+ *
+ *  @return         N/A
+ */
+void woal_dump_drv_info(moal_handle *phandle, t_u8 *dir_name)
+{
+	int ret = 0;
+	struct file *pfile = NULL;
+	t_u8 *drv_buf = NULL;
+	t_u8 file_name[64];
+	t_u32 len = 0;
+	t_u32 total_len = 0;
+	moal_private *woal_handle = NULL;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	mm_segment_t fs;
+#endif
+	t_u32 drv_info_size = DRV_INFO_SIZE;
+
+	ENTER();
+	if (!phandle->priv_num)
+		return;
+
+	PRINTM(MMSG, "=== START DRIVER INFO DUMP===");
+	memset(file_name, 0, sizeof(file_name));
+	if (phandle->second_mac)
+		snprintf(file_name, sizeof(file_name), "%s/%s", dir_name,
+			 "file_drv_info_2");
+	else
+		snprintf(file_name, sizeof(file_name), "%s/%s", dir_name,
+			 "file_drv_info");
+	pfile = filp_open(file_name, O_CREAT | O_RDWR, 0644);
+	if (IS_ERR(pfile)) {
+		PRINTM(MMSG,
+		       "Create file %s error, try create /var/file_drv_info",
+		       file_name);
+		pfile = filp_open("/var/file_drv_info", O_CREAT | O_RDWR, 0644);
+	} else {
+		PRINTM(MMSG, "DRV dump data in %s\n", file_name);
+	}
+	if (IS_ERR(pfile)) {
+		PRINTM(MMSG, "Create file_drv_info file failed\n");
+		goto done;
+	}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	fs = get_fs();
+	set_fs(KERNEL_DS);
+#endif
+	woal_handle = woal_get_priv(phandle, MLAN_BSS_ROLE_ANY);
+
+	if (woal_handle != NULL) {
+		if (phandle->priv_num > 3)
+			drv_info_size +=
+				(phandle->priv_num - 3) * DRV_INFO_PER_INTF;
+		ret = moal_vmalloc(phandle, drv_info_size, &drv_buf);
+		if ((ret != MLAN_STATUS_SUCCESS) || !drv_buf) {
+			PRINTM(MERROR, "Error: vmalloc drv buffer failed!\n");
+			goto done;
+		}
+		len = woal_dump_moal_drv_info(phandle, drv_buf);
+		total_len += len;
+		len = woal_dump_mlan_drv_info(woal_handle, drv_buf + total_len);
+		total_len += len;
+		len = woal_dump_moal_hex(phandle, drv_buf + total_len);
+		total_len += len;
+		len = woal_dump_mlan_hex(woal_handle, drv_buf + total_len);
+		total_len += len;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+		vfs_write(pfile, (const char __user *)drv_buf, total_len,
+			  &pfile->f_pos);
+#else
+		kernel_write(pfile, drv_buf, total_len, &pfile->f_pos);
+#endif
+	}
+	PRINTM(MMSG, "Drv info total bytes = %ld (0x%lx)\n",
+	       (long int)total_len, (long unsigned int)total_len);
+	filp_close(pfile, NULL);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+	set_fs(fs);
+#endif
+	PRINTM(MMSG, "=== DRIVER INFO DUMP END===");
+done:
+	if (drv_buf)
+		moal_vfree(phandle, drv_buf);
+	LEAVE();
+}
+#endif
+
+#ifdef DUMP_TO_PROC
 /**
  *  @brief This function adds header and copy the src data to buf
  *
@@ -9868,6 +11945,7 @@
 	LEAVE();
 	return;
 }
+#endif
 
 /**
  *  @brief This function displays extra MOAL debug information
@@ -9885,6 +11963,10 @@
 	struct usb_card_rec *cardp = NULL;
 #endif
 	char buf[MLAN_MAX_VER_STR_LEN];
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+	char hostname[MAX_HOSTNAME_LEN];
+	char tstamp[MAX_TIME_LEN];
+#endif
 	int i = 0;
 
 	ENTER();
@@ -9919,6 +12001,11 @@
 	}
 #endif
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+	woal_get_hostname(hostname);
+	woal_get_timestamp(tstamp);
+	PRINTM(MERROR, "Host:%s Timestamp:%s", hostname, tstamp);
+#endif
 	woal_get_version(phandle, buf, sizeof(buf) - 1);
 	PRINTM(MERROR, "Driver version = %s\n", buf);
 	PRINTM(MERROR, "main_state = %d\n", phandle->main_state);
@@ -9989,8 +12076,7 @@
 	if (IS_PCIE(phandle->card_type)) {
 #ifdef DEBUG_LEVEL1
 		if (phandle->ops.reg_dbg && (drvdbg & (MREG_D | MFW_D))) {
-			if (!phandle->event_fw_dump)
-				phandle->ops.reg_dbg(phandle);
+			phandle->ops.reg_dbg(phandle);
 		}
 #endif
 	}
@@ -10002,18 +12088,15 @@
 #ifdef DEBUG_LEVEL1
 			if (phandle->ops.reg_dbg &&
 			    (drvdbg & (MREG_D | MFW_D))) {
-				if (!phandle->event_fw_dump)
-					phandle->ops.reg_dbg(phandle);
+				phandle->ops.reg_dbg(phandle);
 			}
 #endif
 		} else {
 #ifdef DEBUG_LEVEL1
 			if (drvdbg & (MREG_D | MFW_D)) {
-				if (!phandle->event_fw_dump) {
-					phandle->reg_dbg = MTRUE;
-					queue_work(phandle->workqueue,
-						   &phandle->main_work);
-				}
+				phandle->reg_dbg = MTRUE;
+				queue_work(phandle->workqueue,
+					   &phandle->main_work);
 			}
 #endif
 		}
@@ -10038,7 +12121,8 @@
  *
  *    @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_request_country_power_table(moal_private *priv, char *country)
+mlan_status woal_request_country_power_table(moal_private *priv, char *country,
+					     t_u8 wait_option)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	moal_handle *handle = NULL;
@@ -10063,8 +12147,8 @@
 	handle = priv->phandle;
 	memset(country_name, 0, sizeof(country_name));
 	if (handle->params.hw_name)
-		sprintf(country_name, "%s_txpower_XX.bin",
-			handle->params.hw_name);
+		snprintf(country_name, sizeof(country_name),
+			 "%s_txpower_XX.bin", handle->params.hw_name);
 	else
 		memcpy(country_name, "txpower_XX.bin",
 		       strlen("txpower_XX.bin"));
@@ -10073,8 +12157,8 @@
 	if (handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE) {
 		memset(country_name, 0, sizeof(country_name));
 		if (handle->params.hw_name)
-			sprintf(country_name, "%s_rgpower_XX.bin",
-				handle->params.hw_name);
+			snprintf(country_name, sizeof(country_name),
+				 "%s_rgpower_XX.bin", handle->params.hw_name);
 		else
 			memcpy(country_name, "rgpower_XX.bin",
 			       strlen("rgpower_XX.bin"));
@@ -10088,7 +12172,8 @@
 	memset(file_path, 0, sizeof(file_path));
 	/* file_path should be Null terminated */
 	if (fw_name) {
-		moal_memcpy(handle, file_path, fw_name, sizeof(file_path) - 1);
+		/* file_path[] needs to be reset to 0 before here */
+		strncpy(file_path, fw_name, sizeof(file_path) - 1);
 		last_slash = strrchr(file_path, '/');
 		if (last_slash)
 			memset(last_slash + 1, 0,
@@ -10113,44 +12198,63 @@
 	}
 
 	PRINTM(MMSG, "Trying download country_power_tble: %s\n", file_path);
-	ret = woal_set_user_init_data(handle, COUNTRY_POWER_TABLE,
-				      MOAL_IOCTL_WAIT, file_path);
+	ret = woal_set_user_init_data(handle, COUNTRY_POWER_TABLE, wait_option,
+				      file_path);
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 	/* Try download WW rgpowertable */
 	if ((handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE) &&
 	    (ret == MLAN_STATUS_FILE_ERR)) {
-		memset(country_name, 0, sizeof(country_name));
-		if (handle->params.hw_name)
-			sprintf(country_name, "%s_rgpower_WW.bin",
-				handle->params.hw_name);
-		else
-			memcpy(country_name, "rgpower_WW.bin",
-			       strlen("rgpower_WW.bin"));
-		last_slash = strrchr(file_path, '/');
-		if (last_slash)
-			memset(last_slash + 1, 0,
-			       sizeof(file_path) - 1 -
-				       (last_slash - file_path));
-		else
-			memset(file_path, 0, sizeof(file_path));
-		if ((strlen(file_path) + strlen(country_name)) <
-		    (sizeof(file_path) - 1))
-			strncpy(file_path + strlen(file_path), country_name,
-				sizeof(file_path) - strlen(file_path) - 1);
-		else {
-			PRINTM(MERROR,
-			       "file path buffer too small, fail to dnld power table\n");
-			LEAVE();
-			return MLAN_STATUS_FAILURE;
-		}
-		PRINTM(MMSG, "Trying again download country_power_tble: %s\n",
-		       file_path);
-		ret = woal_set_user_init_data(handle, COUNTRY_POWER_TABLE,
-					      MOAL_IOCTL_WAIT, file_path);
-		if (!ret) {
-			handle->country_code[0] = '0';
-			handle->country_code[1] = '0';
+		if (country[0] == 'W' && country[1] == 'W') {
+			if (handle->sec_rgpower) {
+				PRINTM(MERROR,
+				       "wlan: rgpower_WW.bin not exist\n");
+				woal_set_rgpower_table(handle);
+			}
+		} else {
+			memset(country_name, 0, sizeof(country_name));
+			if (handle->params.hw_name)
+				snprintf(country_name, sizeof(country_name),
+					 "%s_rgpower_WW.bin",
+					 handle->params.hw_name);
+			else
+				memcpy(country_name, "rgpower_WW.bin",
+				       strlen("rgpower_WW.bin"));
+			last_slash = strrchr(file_path, '/');
+			if (last_slash)
+				memset(last_slash + 1, 0,
+				       sizeof(file_path) - 1 -
+					       (last_slash - file_path));
+			else
+				memset(file_path, 0, sizeof(file_path));
+			if ((strlen(file_path) + strlen(country_name)) <
+			    (sizeof(file_path) - 1))
+				strncpy(file_path + strlen(file_path),
+					country_name,
+					sizeof(file_path) - strlen(file_path) -
+						1);
+			else {
+				PRINTM(MERROR,
+				       "file path buffer too small, fail to dnld power table\n");
+				LEAVE();
+				return MLAN_STATUS_FAILURE;
+			}
+			PRINTM(MMSG,
+			       "Trying again download country_power_tble: %s\n",
+			       file_path);
+			ret = woal_set_user_init_data(handle,
+						      COUNTRY_POWER_TABLE,
+						      wait_option, file_path);
+			if (!ret) {
+				handle->country_code[0] = '0';
+				handle->country_code[1] = '0';
+			} else if (ret == MLAN_STATUS_FILE_ERR) {
+				if (handle->sec_rgpower) {
+					PRINTM(MERROR,
+					       "wlan: rgpower_WW.bin not exist\n");
+					woal_set_rgpower_table(handle);
+				}
+			}
 		}
 	}
 #endif
@@ -10229,18 +12333,24 @@
 	unsigned long flags;
 	moal_private *priv = woal_get_priv(handle, MLAN_BSS_ROLE_STA);
 	t_u8 auto_fw_dump = MFALSE;
+	moal_handle *ref_handle = NULL;
 
 	ENTER();
 
 	if (IS_STA_CFG80211(handle->params.cfg80211_wext)) {
 		if (handle->scan_request && handle->fake_scan_complete) {
-			PRINTM(MMSG, "wlan: Send fake scan result\n");
+			PRINTM(MMSG,
+			       "wlan: Send fake scan result for scan_request %p\n",
+			       handle->scan_request);
 			if (priv)
 				woal_inform_bss_from_scan_result(priv, NULL,
 								 MOAL_NO_WAIT);
 			spin_lock_irqsave(&handle->scan_req_lock, flags);
-			woal_cfg80211_scan_done(handle->scan_request, MFALSE);
+			if (handle->scan_request)
+				woal_cfg80211_scan_done(handle->scan_request,
+							MFALSE);
 			handle->scan_request = NULL;
+			handle->fake_scan_complete = MFALSE;
 			spin_unlock_irqrestore(&handle->scan_req_lock, flags);
 		} else if (handle->scan_request) {
 			PRINTM(MMSG, "wlan: scan timeout!\n");
@@ -10253,6 +12363,10 @@
 				woal_moal_debug_info(priv, NULL, MFALSE);
 			}
 			handle->driver_status = MTRUE;
+			ref_handle = (moal_handle *)handle->pref_mac;
+			if (ref_handle)
+				ref_handle->driver_status = MTRUE;
+
 			if (!auto_fw_dump && !handle->fw_dump && priv)
 				woal_process_hang(priv->phandle);
 			wifi_status = WIFI_STATUS_SCAN_TIMEOUT;
@@ -10275,6 +12389,7 @@
 	moal_handle *handle = container_of(work, moal_handle, evt_work);
 	struct woal_event *evt;
 	unsigned long flags;
+	t_u8 country_code[COUNTRY_CODE_LEN];
 #if defined(UAP_CFG80211) || defined(STA_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	moal_private *priv;
@@ -10304,7 +12419,13 @@
 			break;
 		case WOAL_EVENT_RX_MGMT_PKT:
 #if defined(UAP_CFG80211) || defined(STA_CFG80211)
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+			priv = evt->priv;
+			wiphy_lock(priv->wdev->wiphy);
+			cfg80211_rx_mlme_mgmt(priv->netdev, evt->evt.event_buf,
+					      evt->evt.event_len);
+			wiphy_unlock(priv->wdev->wiphy);
+#elif CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
 			priv = evt->priv;
 			mutex_lock(&priv->wdev->mtx);
 			cfg80211_rx_mlme_mgmt(priv->netdev, evt->evt.event_buf,
@@ -10325,14 +12446,23 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 		case WOAL_EVENT_DEAUTH:
 			priv = evt->priv;
-			woal_host_mlme_disconnect(evt->priv, evt->reason_code,
-						  priv->cfg_bssid);
+			woal_host_mlme_disconnect(evt->priv,
+						  evt->deauth_info.reason_code,
+						  evt->deauth_info.mac_addr);
 			break;
 
 		case WOAL_EVENT_ASSOC_RESP:
 			woal_host_mlme_process_assoc_resp(
 				(moal_private *)evt->priv, &evt->assoc_info);
 			break;
+		case WOAL_EVENT_ASSOC_TIMEOUT:
+			woal_host_mlme_process_assoc_timeout(
+				(moal_private *)evt->priv, evt->assoc_bss);
+			break;
+		case WOAL_EVENT_RESET_WIFI:
+			woal_reset_wifi(handle, evt->deauth_evt_cnt,
+					"EAPOL timeout");
+			break;
 #endif
 #endif
 #ifdef UAP_SUPPORT
@@ -10357,6 +12487,26 @@
 			break;
 #endif
 #endif
+		case WOAL_EVENT_RGPWR_KEY_MISMATCH:
+			if (handle->country_code[0] == '0' &&
+			    handle->country_code[1] == '0') {
+				PRINTM(MERROR,
+				       "wlan: rgpower_WW.bin key mismatch!");
+				woal_set_rgpower_table(handle);
+			} else {
+				memset(country_code, 0, sizeof(country_code));
+				handle->country_code[0] = '0';
+				handle->country_code[1] = '0';
+				country_code[0] = 'W';
+				country_code[1] = 'W';
+				if (MLAN_STATUS_SUCCESS !=
+				    woal_request_country_power_table(
+					    evt->priv, country_code,
+					    MOAL_NO_WAIT))
+					PRINTM(MERROR,
+					       "Fail to request country power table\n");
+			}
+			break;
 		default:
 			break;
 		}
@@ -10366,6 +12516,7 @@
 	spin_unlock_irqrestore(&handle->evt_lock, flags);
 	LEAVE();
 }
+#if defined(USB) || defined(SDIO)
 /**
  *  @brief This workqueue function handles rx_process
  *
@@ -10408,6 +12559,191 @@
 	       handle->rx_time);
 	LEAVE();
 }
+#endif
+
+#ifdef PCIE
+#ifdef TASKLET_SUPPORT
+/**
+ *  @brief This tasklet handles rx_data
+ *
+ *  @param work    A pointer to work_struct
+ *
+ *  @return        N/A
+ */
+static void woal_pcie_rx_data_task(unsigned long data)
+{
+	moal_handle *handle = (moal_handle *)data;
+	wifi_timeval start_timeval;
+	wifi_timeval end_timeval;
+
+	ENTER();
+
+	if (!handle || handle->surprise_removed == MTRUE) {
+		LEAVE();
+		return;
+	}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+	if (handle->cfg80211_suspend == MTRUE) {
+		mlan_process_pcie_interrupt_cb(handle->pmlan_adapter,
+					       RX_DATA_DELAY);
+		LEAVE();
+		return;
+	}
+#endif
+#endif
+
+	woal_get_monotonic_time(&start_timeval);
+
+	mlan_process_pcie_interrupt_cb(handle->pmlan_adapter, RX_DATA);
+
+	woal_get_monotonic_time(&end_timeval);
+	handle->rx_time += (t_u64)(timeval_to_usec(end_timeval) -
+				   timeval_to_usec(start_timeval));
+	PRINTM(MINFO,
+	       "%s : start_timeval=%d:%d end_timeval=%d:%d inter=%llu rx_time=%llu\n",
+	       __func__, start_timeval.time_sec, start_timeval.time_usec,
+	       end_timeval.time_sec, end_timeval.time_usec,
+	       (t_u64)(timeval_to_usec(end_timeval) -
+		       timeval_to_usec(start_timeval)),
+	       handle->rx_time);
+	LEAVE();
+}
+
+/**
+ *  @brief This tasklet handles tx_complete interrupt
+ *
+ *  @param work    A pointer to work_struct
+ *
+ *  @return        N/A
+ */
+static t_void woal_pcie_tx_complete_task(unsigned long data)
+{
+	moal_handle *handle = (moal_handle *)data;
+	ENTER();
+
+	if (!handle || handle->surprise_removed == MTRUE) {
+		LEAVE();
+		return;
+	}
+
+	mlan_process_pcie_interrupt_cb(handle->pmlan_adapter, TX_COMPLETE);
+	LEAVE();
+}
+#else
+/**
+ *  @brief This work queue handles rx_data interrupt
+ *
+ *  @param work    A pointer to work_struct
+ *
+ *  @return        N/A
+ */
+t_void woal_pcie_rx_work_queue(struct work_struct *work)
+{
+	moal_handle *handle = container_of(work, moal_handle, pcie_rx_work);
+	wifi_timeval start_timeval;
+	wifi_timeval end_timeval;
+
+	ENTER();
+
+	if (!handle || handle->surprise_removed == MTRUE) {
+		LEAVE();
+		return;
+	}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+	if (handle->cfg80211_suspend == MTRUE) {
+		mlan_process_pcie_interrupt_cb(handle->pmlan_adapter,
+					       RX_DATA_DELAY);
+		LEAVE();
+		return;
+	}
+#endif
+#endif
+
+	woal_get_monotonic_time(&start_timeval);
+
+	mlan_process_pcie_interrupt_cb(handle->pmlan_adapter, RX_DATA);
+
+	woal_get_monotonic_time(&end_timeval);
+	handle->rx_time += (t_u64)(timeval_to_usec(end_timeval) -
+				   timeval_to_usec(start_timeval));
+	PRINTM(MINFO,
+	       "%s : start_timeval=%d:%d end_timeval=%d:%d inter=%llu rx_time=%llu\n",
+	       __func__, start_timeval.time_sec, start_timeval.time_usec,
+	       end_timeval.time_sec, end_timeval.time_usec,
+	       (t_u64)(timeval_to_usec(end_timeval) -
+		       timeval_to_usec(start_timeval)),
+	       handle->rx_time);
+	LEAVE();
+}
+
+/**
+ *  @brief This workqueue handles tx_complete interrupt
+ *
+ *  @param work    A pointer to work_struct
+ *
+ *  @return        N/A
+ */
+t_void woal_pcie_tx_complete_work_queue(struct work_struct *work)
+{
+	moal_handle *handle =
+		container_of(work, moal_handle, pcie_tx_complete_work);
+	ENTER();
+
+	if (!handle || handle->surprise_removed == MTRUE) {
+		LEAVE();
+		return;
+	}
+
+	mlan_process_pcie_interrupt_cb(handle->pmlan_adapter, TX_COMPLETE);
+	LEAVE();
+}
+#endif
+
+/**
+ *  @brief This workqueue handles rx_cmdresp
+ *
+ *  @param work    A pointer to work_struct
+ *
+ *  @return        N/A
+ */
+t_void woal_pcie_cmd_resp_work_queue(struct work_struct *work)
+{
+	moal_handle *handle =
+		container_of(work, moal_handle, pcie_cmd_resp_work);
+	ENTER();
+
+	if (!handle || handle->surprise_removed == MTRUE) {
+		LEAVE();
+		return;
+	}
+
+	mlan_process_pcie_interrupt_cb(handle->pmlan_adapter, RX_CMD_RESP);
+	LEAVE();
+}
+
+/**
+ *  @brief This workqueue handle delayed_tx_work
+ *
+ *  @param work    A pointer to work_struct
+ *
+ *  @return        N/A
+ */
+t_void woal_pcie_delayed_tx_work(struct work_struct *work)
+{
+	struct delayed_work *delayed_work = to_delayed_work(work);
+	moal_handle *handle =
+		container_of(delayed_work, moal_handle, pcie_delayed_tx_work);
+	ENTER();
+	if (!handle || handle->surprise_removed == MTRUE) {
+		LEAVE();
+		return;
+	}
+	mlan_process_pcie_interrupt_cb(handle->pmlan_adapter, TX_COMPLETE);
+	LEAVE();
+}
+#endif // PCIE
 
 /**
  *  @brief This function dequeue pkt from list
@@ -10417,7 +12753,7 @@
  *  @return        skb buffer
  */
 
-struct sk_buff *woal_skb_dequeue_spinlock(struct sk_buff_head *list)
+static struct sk_buff *woal_skb_dequeue_spinlock(struct sk_buff_head *list)
 {
 	struct sk_buff *result;
 
@@ -10428,18 +12764,24 @@
 }
 
 /**
- *  @brief This workqueue function handles rx_work_process
+ *  @brief This workqueue function handles tx_work_process
  *
  *  @param work    A pointer to work_struct
  *
  *  @return        N/A
  */
-t_void woal_tx_work_handler(struct work_struct *work)
+static t_void woal_tx_work_handler(struct work_struct *work)
 {
 	moal_handle *handle = container_of(work, moal_handle, tx_work);
 	moal_private *priv = NULL;
 	int i = 0;
 	struct sk_buff *skb = NULL;
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 10) &&                           \
+	LINUX_VERSION_CODE <= KERNEL_VERSION(5, 8, 18)
+	struct sched_param sp;
+#elif LINUX_VERSION_CODE > KERNEL_VERSION(5, 13, 19)
+	struct sched_attr attr;
+#endif
 
 	ENTER();
 	if (handle->surprise_removed == MTRUE) {
@@ -10447,6 +12789,31 @@
 		return;
 	}
 
+	if ((handle->params.wq_sched_prio != current->rt_priority) ||
+	    (handle->params.wq_sched_policy != current->policy)) {
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 10) &&                           \
+	LINUX_VERSION_CODE <= KERNEL_VERSION(5, 8, 18)
+		PRINTM(MMSG,
+		       "Set tx work queue priority %d and scheduling policy %d\n",
+		       handle->params.wq_sched_prio,
+		       handle->params.wq_sched_policy);
+		/* Change the priority and scheduling policy of tx work queue
+		 */
+		sp.sched_priority = handle->params.wq_sched_prio;
+		sched_setscheduler(current, handle->params.wq_sched_policy,
+				   &sp);
+#elif LINUX_VERSION_CODE > KERNEL_VERSION(5, 13, 19)
+		PRINTM(MMSG,
+		       "Set tx work queue priority %d and scheduling policy %d\n",
+		       handle->params.wq_sched_prio,
+		       handle->params.wq_sched_policy);
+		attr.sched_policy = handle->params.wq_sched_policy;
+		attr.sched_nice = DEF_NICE;
+		attr.sched_priority = handle->params.wq_sched_prio;
+		sched_setattr_nocheck(current, &attr);
+#endif
+	}
+
 	for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
 		priv = handle->priv[i];
 		while ((skb = woal_skb_dequeue_spinlock(&priv->tx_q)) != NULL) {
@@ -10470,8 +12837,11 @@
 #ifdef USB
 	struct usb_card_rec *cardp = (struct usb_card_rec *)handle->card;
 #endif
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 36)
-	struct sched_param sp = {.sched_priority = wq_sched_prio};
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 10) &&                           \
+	LINUX_VERSION_CODE <= KERNEL_VERSION(5, 8, 18)
+	struct sched_param sp;
+#elif LINUX_VERSION_CODE > KERNEL_VERSION(5, 13, 19)
+	struct sched_attr attr;
 #endif
 
 	ENTER();
@@ -10487,24 +12857,39 @@
 	}
 	if (handle->fw_dbg == MTRUE) {
 		handle->fw_dbg = MFALSE;
+#ifdef DEBUG_LEVEL1
+		drvdbg &= ~MFW_D;
+#endif
 		if (handle->ops.dump_fw_info)
 			handle->ops.dump_fw_info(handle);
 		LEAVE();
 		return;
 	}
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 36)
+
 	/* Change the priority and scheduling policy of main work queue
 	 */
 	if ((handle->params.wq_sched_prio != current->rt_priority) ||
 	    (handle->params.wq_sched_policy != current->policy)) {
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 10) &&                           \
+	LINUX_VERSION_CODE <= KERNEL_VERSION(5, 8, 18)
 		PRINTM(MMSG,
-		       "Set work queue priority %d and scheduling policy %d\n",
+		       "Set main work queue priority %d and scheduling policy %d\n",
 		       handle->params.wq_sched_prio,
 		       handle->params.wq_sched_policy);
+		sp.sched_priority = handle->params.wq_sched_prio;
 		sched_setscheduler(current, handle->params.wq_sched_policy,
 				   &sp);
-	}
+#elif LINUX_VERSION_CODE > KERNEL_VERSION(5, 13, 19)
+		PRINTM(MMSG,
+		       "Set main work queue priority %d and scheduling policy %d\n",
+		       handle->params.wq_sched_prio,
+		       handle->params.wq_sched_policy);
+		attr.sched_policy = handle->params.wq_sched_policy;
+		attr.sched_nice = DEF_NICE;
+		attr.sched_priority = handle->params.wq_sched_prio;
+		sched_setattr_nocheck(current, &attr);
 #endif
+	}
 
 	handle->main_state = MOAL_ENTER_WORK_QUEUE;
 #ifdef USB
@@ -10517,7 +12902,7 @@
 #endif
 	handle->main_state = MOAL_START_MAIN_PROCESS;
 	/* Call MLAN main process */
-	mlan_main_process(handle->pmlan_adapter);
+	(void)mlan_main_process(handle->pmlan_adapter);
 	handle->main_state = MOAL_END_MAIN_PROCESS;
 
 	LEAVE();
@@ -10723,7 +13108,6 @@
 			m_handle[index - 1]->pref_mac = (void *)handle;
 		}
 	}
-
 	/* Init module parameters */
 	if (woal_init_module_param(handle)) {
 		PRINTM(MERROR, "Fail to load module parameter file\n");
@@ -10737,7 +13121,6 @@
 #ifdef IMX_SUPPORT
 #ifdef SDIO
 	if (IS_SD(handle->card_type)) {
-		moal_extflg_set(handle, EXT_TX_WORK);
 		moal_extflg_set(handle, EXT_TX_SKB_CLONE);
 	}
 #endif
@@ -10747,6 +13130,10 @@
 	drvdbg = handle->params.drvdbg;
 #endif
 
+#ifdef MFG_CMD_SUPPORT
+	mfg_mode = handle->params.mfg_mode;
+#endif
+
 	if (handle->params.mac_addr
 #ifdef MFG_CMD_SUPPORT
 	    && handle->params.mfg_mode != MLAN_INIT_PARA_ENABLED
@@ -10769,6 +13156,14 @@
 		PRINTM(MERROR, "Fail to get card info\n");
 		goto err_kmalloc;
 	}
+
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	if (handle->card_info->host_mlme_required == 1)
+		moal_extflg_set(handle, EXT_HOST_MLME);
+#endif
+#endif
+
 	/** Get card revision */
 	handle->ops.get_fw_name(handle);
 #ifdef STA_SUPPORT
@@ -10887,27 +13282,112 @@
 #endif
 #endif
 
-	if (!moal_extflg_isset(handle, EXT_NAPI)) {
-		/* Create workqueue for rx process */
+#if defined(USB) || defined(SDIO)
+	if (IS_USB(handle->card_type) || IS_SD(handle->card_type)) {
+		if (!moal_extflg_isset(handle, EXT_NAPI)) {
+			/* Create workqueue for rx process */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+			/* For kernel less than 2.6.14 name can not be
+			 * greater than 10 characters */
+			handle->rx_workqueue =
+				create_workqueue("MOAL_RX_WORKQ");
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+			handle->rx_workqueue = alloc_workqueue(
+				"MOAL_RX_WORK_QUEUE",
+				WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
+#else
+			handle->rx_workqueue =
+				create_workqueue("MOAL_RX_WORK_QUEUE");
+#endif
+#endif
+			if (!handle->rx_workqueue) {
+				woal_terminate_workqueue(handle);
+				goto err_kmalloc;
+			}
+			MLAN_INIT_WORK(&handle->rx_work, woal_rx_work_queue);
+		}
+	}
+#endif
+
+#ifdef PCIE
+	if (IS_PCIE(handle->card_type)) {
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
 		/* For kernel less than 2.6.14 name can not be
 		 * greater than 10 characters */
-		handle->rx_workqueue = create_workqueue("MOAL_RX_WORKQ");
+		handle->pcie_cmd_resp_workqueue =
+			create_workqueue("MOAL_PCIE_CMD_RESP_WORKQ");
 #else
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
-		handle->rx_workqueue = alloc_workqueue(
-			"MOAL_RX_WORK_QUEUE",
+		handle->pcie_cmd_resp_workqueue = alloc_workqueue(
+			"MOAL_PCIE_CMD_RESP_WORK_QUEUE",
 			WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
 #else
-		handle->rx_workqueue = create_workqueue("MOAL_RX_WORK_QUEUE");
+		handle->pcie_cmd_resp_workqueue =
+			create_workqueue("MOAL_PCIE_CMD_RESP_WORK_QUEUE");
 #endif
 #endif
-		if (!handle->rx_workqueue) {
+		if (!handle->pcie_cmd_resp_workqueue) {
 			woal_terminate_workqueue(handle);
 			goto err_kmalloc;
 		}
-		MLAN_INIT_WORK(&handle->rx_work, woal_rx_work_queue);
+		MLAN_INIT_WORK(&handle->pcie_cmd_resp_work,
+			       woal_pcie_cmd_resp_work_queue);
+
+		INIT_DELAYED_WORK(&handle->pcie_delayed_tx_work,
+				  woal_pcie_delayed_tx_work);
+#ifdef TASKLET_SUPPORT
+		tasklet_init(&handle->pcie_tx_complete_task,
+			     woal_pcie_tx_complete_task, (unsigned long)handle);
+		tasklet_init(&handle->pcie_rx_task, woal_pcie_rx_data_task,
+			     (unsigned long)handle);
+#else
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+		/* For kernel less than 2.6.14 name can not be
+		 * greater than 10 characters */
+		handle->pcie_rx_workqueue =
+			create_workqueue("MOAL_PCIE_RX_WORKQ");
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+		handle->pcie_rx_workqueue = alloc_workqueue(
+			"MOAL_PCIE_RX_WORK_QUEUE",
+			WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
+#else
+		handle->pcie_rx_workqueue =
+			create_workqueue("MOAL_PCIE_RX_WORK_QUEUE");
+#endif
+#endif
+		if (!handle->pcie_rx_workqueue) {
+			woal_terminate_workqueue(handle);
+			goto err_kmalloc;
+		}
+		MLAN_INIT_WORK(&handle->pcie_rx_work, woal_pcie_rx_work_queue);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+		/* For kernel less than 2.6.14 name can not be
+		 * greater than 10 characters */
+		handle->pcie_tx_complete_workqueue =
+			create_workqueue("MOAL_PCIE_TX_COMPLETE_WORKQ");
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+		handle->pcie_tx_complete_workqueue = alloc_workqueue(
+			"MOAL_PCIE_TX_COMPLETE_WORKQ",
+			WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
+#else
+		handle->pcie_tx_complete_workqueue =
+			create_workqueue("MOAL_PCIE_TX_COMPLETE_WORKQ");
+#endif
+#endif
+		if (!handle->pcie_tx_complete_workqueue) {
+			woal_terminate_workqueue(handle);
+			goto err_kmalloc;
+		}
+		MLAN_INIT_WORK(&handle->pcie_tx_complete_work,
+			       woal_pcie_tx_complete_work_queue);
+#endif
 	}
+#endif // PCIE
+
 #define NAPI_BUDGET 64
 	if (moal_extflg_isset(handle, EXT_NAPI)) {
 		init_dummy_netdev(&handle->napi_dev);
@@ -10961,7 +13441,7 @@
 	}
 	woal_update_firmware_name(handle);
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_init(&handle->ws, "mwlan");
 #else
 	wake_lock_init(&handle->wake_lock, WAKE_LOCK_SUSPEND, "mwlan");
@@ -10992,6 +13472,11 @@
 	return handle;
 
 err_init_fw:
+	if (handle->is_fw_dump_timer_set) {
+		woal_cancel_timer(&handle->fw_dump_timer);
+		handle->is_fw_dump_timer_set = MFALSE;
+	}
+
 	if ((handle->hardware_status == HardwareStatusFwReady) ||
 	    (handle->hardware_status == HardwareStatusReady)) {
 		PRINTM(MINFO, "shutdown mlan\n");
@@ -11002,7 +13487,7 @@
 						 handle->init_wait_q_woken);
 	}
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
@@ -11211,7 +13696,7 @@
 	PRINTM(MINFO, "unregister device\n");
 	handle->ops.unregister_dev(handle);
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
@@ -11351,9 +13836,7 @@
 }
 #endif
 
-#ifdef SDIO_MMC
-#define FW_POLL_TRIES 100
-
+#ifdef SDIO
 /**
  *  @brief This function reload fw
  *
@@ -11364,59 +13847,15 @@
  */
 static int woal_reset_and_reload_fw(moal_handle *handle, t_u8 mode)
 {
-	int ret = 0, tries = 0;
-	t_u32 value = 1;
-	t_u32 reset_reg = handle->card_info->fw_reset_reg;
-	t_u8 reset_val = handle->card_info->fw_reset_val;
+	int ret = 0;
 
 	ENTER();
+#ifdef SDIO_MMC
 	if (mode == FW_RELOAD_SDIO_HW_RESET) {
 		PRINTM(MCMND, "woal_sdio_reset_fw...\n");
 		woal_sdio_reset_hw(handle);
-		goto reload_fw;
 	}
-	mlan_pm_wakeup_card(handle->pmlan_adapter, MTRUE);
-	/** wait SOC fully wake up */
-	for (tries = 0; tries < FW_POLL_TRIES; ++tries) {
-		ret = handle->ops.write_reg(handle, reset_reg, 0xba);
-		if (ret == MLAN_STATUS_SUCCESS) {
-			handle->ops.read_reg(handle, reset_reg, &value);
-			if (value == 0xba) {
-				PRINTM(MMSG, "FW wake up\n");
-				break;
-			}
-		}
-		udelay(1000);
-	}
-	/* Write register to notify FW */
-	if (handle->ops.write_reg(handle, reset_reg, reset_val) !=
-	    MLAN_STATUS_SUCCESS) {
-		PRINTM(MERROR, "Failed to write register.\n");
-		ret = -EFAULT;
-		goto done;
-	}
-#if defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177)
-	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
-	    IS_SDNW62X(handle->card_type) || IS_SD9177(handle->card_type))
-		handle->ops.write_reg(handle, 0x00, 0x10);
 #endif
-	/* Poll register around 100 ms */
-	for (tries = 0; tries < FW_POLL_TRIES; ++tries) {
-		handle->ops.read_reg(handle, reset_reg, &value);
-		if (value == 0)
-			/* FW is ready */
-			break;
-		udelay(1000);
-	}
-
-	if (value) {
-		PRINTM(MERROR, "Failed to poll FW reset register %X=0x%x\n",
-		       reset_reg, value);
-		ret = -EFAULT;
-		goto done;
-	}
-	mlan_pm_wakeup_card(handle->pmlan_adapter, MFALSE);
-reload_fw:
 	/* Download FW */
 	ret = woal_request_fw(handle);
 	if (ret) {
@@ -11564,6 +14003,11 @@
 #ifdef DEBUG_LEVEL1
 	drvdbg = handle->params.drvdbg;
 #endif
+
+#ifdef MFG_CMD_SUPPORT
+	mfg_mode = handle->params.mfg_mode;
+#endif
+
 	handle->fw_dump_status = MFALSE;
 	handle->driver_status = MFALSE;
 	handle->hardware_status = HardwareStatusReady;
@@ -11571,8 +14015,11 @@
 #ifdef STA_CFG80211
 	handle->scan_timeout = SCAN_TIMEOUT_25S;
 #endif
-	if (MLAN_STATUS_SUCCESS !=
-	    woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info)) {
+	handle->is_edmac_enabled = MFALSE;
+
+	if (priv &&
+	    (MLAN_STATUS_SUCCESS !=
+	     woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info))) {
 		PRINTM(MERROR, "%s: get_fw_info failed \n", __func__);
 	}
 	woal_get_version(handle, str_buf, sizeof(str_buf) - 1);
@@ -11663,7 +14110,12 @@
 		}
 
 		if (handle->params.cntry_txpwr && priv)
-			woal_request_country_power_table(priv, country_code);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_request_country_power_table(priv, country_code,
+							     MOAL_IOCTL_WAIT)) {
+				PRINTM(MERROR,
+				       "Failed to get country power table\n");
+			}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
 		if (handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE)
 			queue_work(handle->evt_workqueue,
@@ -11709,6 +14161,13 @@
 	moal_handle *ref_handle = NULL;
 
 	ENTER();
+
+	if (!handle->driver_init) {
+		PRINTM(MMSG, "Ignore fw reload, driver not initialized\n");
+		LEAVE();
+		return -EFAULT;
+	}
+
 	wifi_status = WIFI_STATUS_FW_RELOAD;
 #ifdef PCIE
 	if (mode == FW_RELOAD_PCIE_RESET) {
@@ -11721,6 +14180,19 @@
 		}
 		LEAVE();
 		return ret;
+	} else if (mode == FW_RELOAD_PCIE_INBAND_RESET) {
+		if (handle->ops.card_reset)
+			handle->ops.card_reset(handle);
+		LEAVE();
+		return ret;
+	}
+#endif
+#ifdef SDIO
+	if (mode == FW_RELOAD_SDIO_INBAND_RESET) {
+		if (handle->ops.card_reset)
+			handle->ops.card_reset(handle);
+		LEAVE();
+		return ret;
 	}
 #endif
 
@@ -11757,9 +14229,8 @@
 			}
 		}
 	}
-#ifdef SDIO_MMC
-	else if ((mode == FW_RELOAD_SDIO_INBAND_RESET ||
-		  mode == FW_RELOAD_SDIO_HW_RESET) &&
+#ifdef SDIO
+	else if ((mode == FW_RELOAD_SDIO_HW_RESET) &&
 		 IS_SD(handle->card_type)) {
 		ret = woal_reset_and_reload_fw(handle, mode);
 		if (ret) {
@@ -11980,8 +14451,7 @@
 #ifdef MMC_PM_KEEP_POWER
 		if (handle->is_suspended == MTRUE) {
 			woal_sdio_resume(
-				&(((struct sdio_mmc_card *)handle->card)->func)
-					 ->dev);
+				&(((sdio_mmc_card *)handle->card)->func)->dev);
 		}
 #endif /* MMC_PM_KEEP_POWER */
 #endif /* SDIO_SUSPEND_RESUME */
@@ -12106,6 +14576,10 @@
 				goto exit;
 			}
 			woal_flush_tx_stat_queue(handle->priv[i]);
+#ifdef STA_CFG80211
+			woal_flush_dhcp_discover_queue(handle->priv[i]);
+			woal_flush_arp_request_entry(handle->priv[i]);
+#endif
 #endif
 		}
 
@@ -12175,6 +14649,188 @@
 #endif
 #endif
 
+/**
+ *  @brief Add 2 variables securely, to prevent overflow.
+ *
+ *  @param datain	Pointer to 1st variable
+ *  @param add		2nd variable value to add to 1st variable
+ *  @param dataout	Pointer to variable where sum is to be stored
+ *  @param type		Datatype of 1st and 2nd variable
+ *
+ *  @return			MTRUE if success or MFALSE if overflow error
+ */
+t_bool woal_secure_add(t_void *datain, t_s32 add, t_void *dataout,
+		       data_type type)
+{
+	t_bool status = MTRUE;
+
+	switch (type) {
+	case TYPE_SINT8:
+		if (add > SINT8_MAX || *(t_s8 *)datain > SINT8_MAX - add)
+			goto fail;
+		else
+			*(t_s8 *)dataout = *(t_s8 *)datain + add;
+		break;
+
+	case TYPE_UINT8:
+		if (add > UINT8_MAX || *(t_u8 *)datain > UINT8_MAX - add)
+			goto fail;
+		else
+			*(t_u8 *)dataout = *(t_u8 *)datain + add;
+		break;
+
+	case TYPE_SINT16:
+		if (add > SINT16_MAX || *(t_s16 *)datain > SINT16_MAX - add)
+			goto fail;
+		else
+			*(t_s16 *)dataout = *(t_s16 *)datain + add;
+		break;
+
+	case TYPE_UINT16:
+		if (add > UINT16_MAX || *(t_u16 *)datain > UINT16_MAX - add)
+			goto fail;
+		else
+			*(t_u16 *)dataout = *(t_u16 *)datain + add;
+		break;
+
+	case TYPE_SINT32:
+		if (*(t_s32 *)datain > SINT32_MAX - add)
+			goto fail;
+		else
+			*(t_s32 *)dataout = *(t_s32 *)datain + add;
+		break;
+
+	case TYPE_UINT32:
+		if (*(t_u32 *)datain > UINT32_MAX - add)
+			goto fail;
+		else
+			*(t_u32 *)dataout = *(t_u32 *)datain + add;
+		break;
+
+	case TYPE_SINT64:
+		if (*(t_s64 *)datain > SINT64_MAX - add)
+			goto fail;
+		else
+			*(t_s64 *)dataout = *(t_s64 *)datain + add;
+		break;
+
+	case TYPE_UINT64:
+		if (*(t_u64 *)datain > UINT64_MAX - add)
+			goto fail;
+		else
+			*(t_u64 *)dataout = *(t_u64 *)datain + add;
+		break;
+
+	case TYPE_PTR:
+		if (*(t_ptr *)datain > PTR_MAX - add)
+			goto fail;
+		else
+			*(t_ptr *)dataout = *(t_ptr *)datain + add;
+		break;
+
+	default:
+		status = MFALSE;
+		break;
+	}
+ret:
+	return status;
+
+fail:
+	status = MFALSE;
+	goto ret;
+}
+
+/**
+ *  @brief Subtract 2 variables securely, to prevent underflow.
+ *
+ *  @param datain	Pointer to 1st variable
+ *  @param add		2nd variable value to subtract from 1st variable
+ *  @param dataout	Pointer to variable where diff is to be stored
+ *  @param type		Datatype of 1st and 2nd variable
+ *
+ *  @return			MTRUE if success or MFALSE if underflow error
+ */
+t_bool woal_secure_sub(t_void *datain, t_s32 sub, t_void *dataout,
+		       data_type type)
+{
+	t_u8 status = MTRUE;
+
+	switch (type) {
+	case TYPE_SINT8:
+		if (*(t_s8 *)datain >= (t_s8)SINT8_MIN + sub)
+			*(t_s8 *)dataout = *(t_s8 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT8:
+		if (*(t_u8 *)datain >= sub)
+			*(t_u8 *)dataout = *(t_u8 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_SINT16:
+		if (*(t_s16 *)datain >= (t_s16)SINT16_MIN + sub)
+			*(t_s16 *)dataout = *(t_s16 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT16:
+		if (*(t_u16 *)datain >= sub)
+			*(t_u16 *)dataout = *(t_u16 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_SINT32:
+		if (*(t_s32 *)datain >= (t_s32)SINT32_MIN + sub)
+			*(t_s32 *)dataout = *(t_s32 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT32:
+		if (*(t_u32 *)datain >= sub)
+			*(t_u32 *)dataout = *(t_u32 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_SINT64:
+		if (*(t_s64 *)datain >= (t_s64)SINT64_MIN + sub)
+			*(t_s64 *)dataout = *(t_s64 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_UINT64:
+		if (*(t_u64 *)datain >= sub)
+			*(t_u64 *)dataout = *(t_u64 *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	case TYPE_PTR:
+		if (*(t_ptr *)datain >= sub)
+			*(t_ptr *)dataout = *(t_ptr *)datain - sub;
+		else
+			goto fail;
+		break;
+
+	default:
+		status = MFALSE;
+		break;
+	}
+ret:
+	return status;
+
+fail:
+	status = MFALSE;
+	goto ret;
+}
+
 module_init(woal_init_module);
 module_exit(woal_cleanup_module);
 
@@ -12187,4 +14843,3 @@
 MODULE_AUTHOR("NXP");
 MODULE_VERSION(MLAN_RELEASE_VERSION);
 MODULE_LICENSE("GPL");
-MODULE_LICENSE("GPL");
diff --git a/wlan_sd8987/mlinux/moal_main.h b/wlan_src/mlinux/moal_main.h
old mode 100755
new mode 100644
similarity index 83%
rename from wlan_sd8987/mlinux/moal_main.h
rename to wlan_src/mlinux/moal_main.h
index 12c47b0..49e5ee6
--- a/wlan_sd8987/mlinux/moal_main.h
+++ b/wlan_src/mlinux/moal_main.h
@@ -3,20 +3,28 @@
  * @brief This file contains wlan driver specific defines etc.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -44,6 +52,12 @@
 #include <linux/mm.h>
 #include <linux/types.h>
 #include <linux/sched.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/hashtable.h>
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 10, 17)
+#include <uapi/linux/sched/types.h>
+#endif
 #include <linux/timer.h>
 #include <linux/ioport.h>
 #include <linux/pci.h>
@@ -105,7 +119,7 @@
 #include <linux/firmware.h>
 
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 #include <linux/pm_wakeup.h>
 #include <linux/device.h>
 #else
@@ -115,6 +129,14 @@
 
 #include <net/ieee80211_radiotap.h>
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
+#include <net/netdev_rx_queue.h>
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 9, 0)
+#include <net/rps.h>
+#endif
+
 #include "mlan.h"
 #include "moal_shim.h"
 /* Wireless header */
@@ -158,13 +180,23 @@
 
 #define IMX_ANDROID_13 0
 #define IMX_ANDROID_14 0
+#define IMX_ANDROID_12_BACKPORT 0
 
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 41)
+#ifdef ANDROID_SDK_VERSION
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 52)
 #undef IMX_ANDROID_13
-#undef IMX_ANDROID_14
 #define IMX_ANDROID_13 1
+#ifdef ANDROID_14_SUPPORT
+#undef IMX_ANDROID_14
 #define IMX_ANDROID_14 1
 #endif
+#endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 41)
+#undef IMX_ANDROID_12_BACKPORT
+#define IMX_ANDROID_12_BACKPORT 1
+#endif
+#else
+#endif
 
 /**
  * Reason Code 3: STA is leaving (or has left) IBSS or ESS
@@ -245,12 +277,13 @@
 /** country rgpower mode */
 #define CNTRY_RGPOWER_MODE 2
 
+#define DEF_NICE 20
 /** Define BOOLEAN */
 typedef t_u8 BOOLEAN;
 
 #define INTF_CARDTYPE "----------%s-MM"
 
-#define KERN_VERSION "5X"
+#define KERN_VERSION "6X"
 
 #define V14 "14"
 #define V15 "15"
@@ -276,6 +309,38 @@
 #define CARD_TYPE_PCIE_USB 7
 /** card type SD9177_UART */
 #define CARD_TYPE_SD9177_UART 1 // As per datasheet/SoC design
+/** card type SDIW624_UARTSPI */
+#define CARD_TYPE_SDIW624_UARTSPI 0 // As per datasheet/SoC design
+/** card type SDIW624_UARTUART */
+#define CARD_TYPE_SDIW624_UARTUART 2 // As per datasheet/SoC design
+/** card type PCIEIW624_USBUSB */
+#define CARD_TYPE_PCIEIW624_USBUSB 4 // As per datasheet/SoC design
+/** card type PCIEIW624_UARTUART */
+#define CARD_TYPE_PCIEIW624_UARTUART 7 // As per datasheet/SoC design
+/** card type PCIEIW624_UARTSPI */
+#define CARD_TYPE_PCIEIW624_UARTSPI 5 // As per datasheet/SoC design
+/** card type SDIW615_sd_uart_spi **/
+#ifdef SDIW610
+#define CARD_TYPE_SDIW610_UART                                                 \
+	1 // As per datasheet/SoC design - Nighthawk, sd-uart strap = 0x3
+#endif
+#ifdef USBIW610
+#define CARD_TYPE_USBIW610_USB                                                 \
+	5 // As per datasheet/SoC design - Nighthawk, usb-usb strap = 0x5
+#define CARD_TYPE_USBIW610_UART                                                \
+	7 // As per datasheet/SoC design - Nighthawk, usb-uart strap = 0x7
+#endif
+
+/* Max buffer size */
+#define MAX_BUF_LEN 512
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+/* Max hostname length */
+#define MAX_HOSTNAME_LEN 128
+
+/* Max rtc time length */
+#define MAX_TIME_LEN 128
+#endif
 
 /** Driver version */
 extern char driver_version[];
@@ -324,6 +389,7 @@
 	RDWR_STATUS_DONE = 2
 } rdwr_status;
 #endif
+
 /** Private structure for MOAL */
 typedef struct _moal_private moal_private, *pmoal_private;
 /** Handle data structure for MOAL  */
@@ -350,6 +416,7 @@
 #define WIFI_STATUS_SCAN_TIMEOUT 8
 #define WIFI_STATUS_FW_DUMP 9
 #define WIFI_STATUS_FW_RELOAD 10
+#define WIFI_STATUS_FW_RECOVERY_FAIL 11
 
 /** fw cap info 11p */
 #define FW_CAPINFO_80211P MBIT(24)
@@ -400,6 +467,24 @@
 	t_u32 timer_is_canceled;
 } moal_drv_timer, *pmoal_drv_timer;
 
+/** moal_802_11_action header */
+typedef struct {
+	/** Frame Cotrol */
+	t_u16 frame_control;
+	/** Duration */
+	t_u16 duration;
+	/** dest addr */
+	t_u8 da[ETH_ALEN];
+	/** source addr */
+	t_u8 sa[ETH_ALEN];
+	/** bssid */
+	t_u8 bssid[ETH_ALEN];
+	/** seq_ctrl */
+	t_u16 seq_ctrl;
+	/** category */
+	t_u8 category;
+} __attribute__((packed)) moal_802_11_action_header;
+
 /**
  *  @brief Timer handler
  *
@@ -424,7 +509,6 @@
 		mod_timer(&timer->tl,
 			  jiffies + ((timer->time_period * HZ) / 1000));
 	} else {
-		timer->timer_is_canceled = MTRUE;
 		timer->time_period = 0;
 	}
 }
@@ -783,10 +867,6 @@
 /** Custom event : OBSS scan parameter */
 #define CUS_EVT_OBSS_SCAN_PARAM "EVENT=OBSS_SCAN_PARAM"
 
-/** Custom event : AdHoc link sensed */
-#define CUS_EVT_ADHOC_LINK_SENSED "EVENT=ADHOC_LINK_SENSED"
-/** Custom event : AdHoc link lost */
-#define CUS_EVT_ADHOC_LINK_LOST "EVENT=ADHOC_LINK_LOST"
 /** Custom event : MIC failure, unicast */
 #define CUS_EVT_MLME_MIC_ERR_UNI "MLME-MICHAELMICFAILURE.indication unicast"
 /** Custom event : MIC failure, multicast */
@@ -819,6 +899,8 @@
 /** Custom event : Deep Sleep awake */
 #define CUS_EVT_DEEP_SLEEP_AWAKE "EVENT=DS_AWAKE"
 
+#define CUS_EVT_ADDBA_TIMEOUT "EVENT=ADDBA_TIMEOUT"
+
 #define CUS_EVT_TOD_TOA "EVENT=TOD-TOA"
 
 /** Custom event : Host Sleep activated */
@@ -842,6 +924,7 @@
 	CONTROL_FRAME_MATCHED, // 8. Control frame matched
 	MANAGEMENT_FRAME_MATCHED, // 9. Management frame matched
 	GTK_REKEY_FAILURE, // 10. GTK rekey failure
+	MGMT_FRAME_FILTER_EXT_MATCHED, // 11. Management frame filter matched
 	RESERVED // Others: reserved
 } HSWakeupReason_t;
 
@@ -849,6 +932,8 @@
 #define CUS_EVT_RADAR_DETECTED "EVENT=RADAR_DETECTED"
 /** Custom event : CAC finished */
 #define CUS_EVT_CAC_FINISHED "EVENT=CAC_FINISHED"
+/** Custom event : CAC start */
+#define CUS_EVT_CAC_START "EVENT=CAC_START"
 #ifdef UAP_SUPPORT
 void woal_move_to_next_channel(moal_private *priv);
 void woal_chan_event(moal_private *priv, t_u8 type, t_u8 channel, t_u8 radar);
@@ -931,6 +1016,12 @@
 /** LOW Tx Pending count */
 #define LOW_TX_PENDING 380
 
+/** MAX Tx Pending count when multi-client scheduling is used  */
+#define MCLIENT_MAX_TX_PENDING (128 * MAX_STA_COUNT)
+
+/** LOW Tx Pending count when multi-client scheduling is used */
+#define MCLIENT_LOW_TX_PENDING (MCLIENT_MAX_TX_PENDING * 3 / 4)
+
 /** Offset for subcommand */
 #define SUBCMD_OFFSET 4
 
@@ -941,6 +1032,8 @@
 /** GAP value is optional */
 #define GAP_FLAG_OPTIONAL MBIT(15)
 
+#define AUTH_TX_DEFAULT_WAIT_TIME 2400
+
 /** max retry count for wait_event_interupptible_xx while loop */
 #define MAX_RETRY_CNT 100
 /** wait_queue structure */
@@ -956,7 +1049,7 @@
 	/** flag for wait_timeout */
 	t_u8 wait_timeout;
 	/** retry count */
-	t_u8 retry;
+	t_u16 retry;
 } wait_queue, *pwait_queue;
 
 /** Auto Rate */
@@ -1008,7 +1101,8 @@
 /** Driver mode uAP bit */
 #define DRV_MODE_UAP MBIT(1)
 /** Maximum uAP BSS */
-#define MAX_UAP_BSS 3
+#define MAX_UAP_BSS 2
+#define MAX_UAP_BSS_DUAL_MAC 3
 /** Default uAP BSS */
 #define DEF_UAP_BSS 1
 
@@ -1028,6 +1122,12 @@
 #define DEF_VIRTUAL_BSS 0
 #endif
 #endif /* WIFI_DIRECT_SUPPORT */
+/** Driver mode NAN bit */
+#define DRV_MODE_NAN MBIT(4)
+/** Maximum NAN BSS */
+#define MAX_NAN_BSS 1
+/** Default NAN BSS */
+#define DEF_NAN_BSS 1
 
 /**Driver mode 0DFS bit**/
 #define DRV_MODE_DFS MBIT(7)
@@ -1100,7 +1200,11 @@
 /** IP address operation: Remove */
 #define IPADDR_OP_REMOVE 0
 
+/* max hold of tcp ack pkt*/
 #define TCP_ACK_MAX_HOLD 9
+/* max num of tcp session */
+#define TCP_ACK_MAX_SESS 100
+
 #define DROP_TCP_ACK 1
 #define HOLD_TCP_ACK 2
 struct tcp_sess {
@@ -1134,6 +1238,8 @@
 	t_u8 tx_seq_num;
 	/** cancel remain on channel when receive tx status */
 	t_u8 cancel_remain_on_channel;
+	/** set to notify userspace tx duration expired */
+	bool send_tx_expired;
 	/**          skb */
 	void *tx_skb;
 };
@@ -1147,6 +1253,7 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	WOAL_EVENT_DEAUTH,
 	WOAL_EVENT_ASSOC_RESP,
+	WOAL_EVENT_ASSOC_TIMEOUT,
 #endif
 #endif
 	WOAL_EVENT_CHAN_RPT,
@@ -1156,6 +1263,8 @@
 	WOAL_EVENT_CANCEL_CHANRPT,
 #endif
 #endif
+	WOAL_EVENT_RGPWR_KEY_MISMATCH,
+	WOAL_EVENT_RESET_WIFI,
 };
 
 /** chan_rpt_info */
@@ -1181,12 +1290,14 @@
 	enum woal_event_type type;
 	/** priv pointer */
 	void *priv;
+	struct cfg80211_bss *assoc_bss;
 	union {
 		chan_band_info chan_info;
 		woal_evt_buf evt;
 		mlan_ds_assoc_info assoc_info;
-		int reason_code;
+		mlan_deauth_param deauth_info;
 		chan_radar_info radar_info;
+		t_u8 deauth_evt_cnt;
 	};
 };
 
@@ -1330,11 +1441,11 @@
 	/* Rx fcs error count */
 	t_u32 rx_pkt_fcs_err_count;
 	/* Tx power config values */
-	t_u32 tx_power_data[3];
+	t_s32 tx_power_data[3];
 	/* Tx continuous config values */
 	t_u32 tx_cont_data[6];
 	/* Tx frame config values */
-	t_u32 tx_frame_data[20];
+	t_u32 tx_frame_data[22];
 	/* HE TB Tx values */
 	t_u32 he_tb_tx[4];
 	t_s32 he_tb_tx_power[1];
@@ -1342,6 +1453,10 @@
 	t_u8 bssid[ETH_ALEN];
 	/* Trigger frame config values */
 	mfg_Cmd_IEEEtypes_CtlBasicTrigHdr_t mfg_tx_trigger_config;
+	/* OTP frame data */
+	mfg_cmd_otp_mac_addr_rd_wr_t mfg_otp_mac_addr_rd_wr;
+	/* OTP CAL data */
+	mfg_cmd_otp_cal_data_rd_wr_t mfg_otp_cal_data_rd_wr;
 };
 
 /** Number of samples in histogram (/proc/mwlan/adapterX/mlan0/histogram).*/
@@ -1409,6 +1524,142 @@
 	t_u8 dfs_chan_list[MAX_DFS_CHAN_LIST];
 } __ATTRIB_PACK__ auto_zero_dfs_cfg;
 
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+/** station node */
+typedef struct _station_node {
+	/** station aid */
+	t_u16 aid;
+	/** station mac address */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+	/** net_device that station is bind to */
+	struct net_device *netdev;
+	/** is valid flag */
+	t_u8 is_valid;
+} station_node;
+
+/** dhcp discover info */
+struct dhcp_discover_info {
+	/** link */
+	struct list_head link;
+	/** transaction id */
+	t_u32 transaction_id;
+	/** Time stamp when packet is received (seconds) */
+	t_u32 in_ts_sec;
+	/** Time stamp when packet is received (micro seconds) */
+	t_u32 in_ts_usec;
+};
+
+#define UDP_PSEUDO_HEADER_SIZE 12
+#define DHCP_ETH_HEADER_SIZE 14
+#define DHCP_MIN_IP_HEADER_SIZE 20
+#define DHCP_UDP_HEADER_SIZE 8
+#define DHCP_IP_PROTO 0x0800
+#define DHCP_IP_VERSION 0x04
+#define DHCP_IP_TOS 0x00
+#define DHCP_IP_TTL 0x40
+#define DHCP_UDP_PROTO 0x11
+#define DHCP_IPADDR_SIZE 4
+#define DHCP_SRC_PORT 0x0044
+#define DHCP_DST_PORT 0x0043
+
+struct dhcp_pkt {
+	/** DHCP op code or message type */
+	t_u8 op;
+	/** Hardware address type */
+	t_u8 htype;
+	/** Hardware address length */
+	t_u8 hlen;
+	/** Hops is optionally used by relay agents */
+	t_u8 hops;
+	/** Transaction identifier */
+	t_u32 xid;
+	/** Seconds till the client has started the DHCP process */
+	t_u16 secs;
+	/** Flags */
+	t_u16 flags;
+	/**
+	 * IP address of the client  Only filled in if
+	 * the client is in BOUND, RENEW or REBINDING
+	 */
+	t_u32 ciaddr;
+	/**
+	 * Your IP address offered to the client.
+	 * Sent  by server during the DISCOVER and ACK
+	 */
+	t_u32 yiaddr;
+	/**
+	 *  IP address of the DHCP server to use next.
+	 */
+	t_u32 siaddr;
+	/** Relay agent IP address */
+	t_u32 giaddr;
+	t_u8 chaddr[16];
+	/** Null terminated server host name */
+	t_u8 sname[64];
+	t_u8 file[128];
+	/** BOOTP magic cookie */
+	t_u32 magic;
+	t_u8 pOptions[1];
+} __ATTRIB_PACK__;
+
+/** IPv4 arp header */
+struct arp_hdr {
+	/** Hardware type */
+	t_u16 htype;
+	/** Protocol type */
+	t_u16 ptype;
+	/** Hardware address length */
+	t_u8 addr_len;
+	/** Protocol address length */
+	t_u8 proto_len;
+	/** Operation code */
+	t_u16 op_code;
+	/** Source mac address */
+	t_u8 sender_mac[MLAN_MAC_ADDR_LENGTH];
+	/** Sender IP address */
+	t_u8 sender_ip[4];
+	/** Destination mac address */
+	t_u8 target_mac[MLAN_MAC_ADDR_LENGTH];
+	/** Destination IP address */
+	t_u8 target_ip[4];
+} __ATTRIB_PACK__;
+
+/** ARP request entry ageout of 10 secs */
+#define ARP_REQ_AGEOUT_TIME (10 * HZ)
+
+/** ARP request node */
+struct arp_entry {
+	t_u32 hash_key;
+	struct hlist_node arp_hlist;
+	t_u64 ageout_jiffies;
+};
+
+#define EASY_MESH_MULTI_AP_FH_BSS (t_u8)(0x20)
+#define EASY_MESH_MULTI_AP_BH_BSS (t_u8)(0x40)
+#define EASY_MESH_MULTI_AP_BH_AND_FH_BSS (t_u8)(0x60)
+
+#define EASY_MESH_MULTI_AP_BSS_MODE_1 (t_u8)(0x01)
+#define EASY_MESH_MULTI_AP_BSS_MODE_2 (t_u8)(0x02)
+#define EASY_MESH_MULTI_AP_BSS_MODE_3 (t_u8)(0x03)
+#endif
+
+#ifdef STA_SUPPORT
+enum scan_set_band {
+	SCAN_SETBAND_AUTO = 0,
+	SCAN_SETBAND_2G = BIT(0),
+	SCAN_SETBAND_5G = BIT(1),
+	SCAN_SETBAND_6G = BIT(2),
+};
+#endif
+
+/** IPv6 address node */
+struct ipv6addr_entry {
+	/** list node link */
+	struct list_head link;
+	/** IPv6 address entry */
+	t_u8 ipv6_addr[16];
+};
+
 /** Private structure for MOAL */
 struct _moal_private {
 	/** Handle structure */
@@ -1446,6 +1697,10 @@
 	t_u8 target_chan;
 	/** backup channel */
 	t_u8 backup_chan;
+	/** channel mode for channel switch */
+	t_u8 chan_mode;
+	/** number of csa for channel switch */
+	t_u8 chan_num_pkts;
 	/** uAP skip CAC*/
 	BOOLEAN skip_cac;
 	/** tx block flag */
@@ -1492,10 +1747,19 @@
 	/** IP addr */
 	t_u8 ip_addr[IPADDR_LEN];
 	t_u8 ipv6_addr_configured;
-	t_u8 ipv6_addr[16];
+	/** IPv6 addr count */
+	t_u8 ipv6count;
+	/** IPv6 addr Queue */
+	struct list_head ipv6_addrses;
+	/** Lock for IPv6 addrs */
+	spinlock_t ipv6addr_lock;
 #ifdef STA_SUPPORT
 	/** scan type */
 	t_u8 scan_type;
+
+	/** set band for scan */
+	t_u8 scan_setband_mask;
+
 	/** extended capabilities */
 	ExtCap_t extended_capabilities;
 	/** bg_scan_start */
@@ -1555,6 +1819,8 @@
 	struct net_device *pa_netdev;
 	/** channel parameter for UAP/GO */
 	t_u16 channel;
+	/** bandwidth parameter for UAP/GO */
+	t_u8 bandwidth;
 #ifdef UAP_SUPPORT
 	/** wep key */
 	wep_key uap_wep_key[4];
@@ -1586,7 +1852,7 @@
 #endif
 #ifdef STA_CFG80211
 #ifdef STA_SUPPORT
-	/** CFG80211 association description */
+	/** CFG80211 association bssid  */
 	t_u8 cfg_bssid[ETH_ALEN];
 	/** Disconnect request from CFG80211 */
 	bool cfg_disconnect;
@@ -1647,6 +1913,10 @@
 	t_u8 auth_tx_cnt;
 	/** deauth evt cnt */
 	t_u8 deauth_evt_cnt;
+	/** delay deauth event */
+	t_u8 delay_deauth_notify;
+	/** notify bssid */
+	t_u8 bssid_notify[ETH_ALEN];
 #endif
 #ifdef CONFIG_PROC_FS
 	/** Proc entry */
@@ -1711,6 +1981,8 @@
 
 	/** tcp session queue */
 	struct list_head tcp_sess_queue;
+	/** tcp session count */
+	t_u8 tcp_sess_cnt;
 	/** TCP Ack enhance flag */
 	t_u8 enable_tcp_ack_enh;
 	/** TCP Ack drop count */
@@ -1725,6 +1997,8 @@
 	t_u32 num_mcast_addr;
 	/** enable mc_aggr */
 	t_u8 enable_mc_aggr;
+	/** enable uc_nonaggr */
+	t_u8 enable_uc_nonaggr;
 	/** tcp list */
 	struct list_head tdls_list;
 	/** tdls spin lock */
@@ -1735,6 +2009,8 @@
 	t_u8 tdls_check_tx;
 	auto_assoc auto_assoc_priv;
 #if CFG80211_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+	t_u32 max_tx_pending;
+	t_u32 low_tx_pending;
 	atomic_t wmm_tx_pending[4];
 #endif
 	struct sk_buff_head tx_q;
@@ -1765,21 +2041,32 @@
 	char csi_dump_path[64];
 	/** CSI config */
 	mlan_ds_csi_params csi_config;
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	/** hostcmd_wait_q */
-	wait_queue_head_t hostcmd_wait_q __ATTRIB_ALIGN__;
-	/** hostcmd_wait_condition */
-	t_bool hostcmd_wait_condition;
-#endif
 	void *rings[RING_ID_MAX];
 	t_u8 pkt_fate_monitor_enable;
 	void *packet_filter;
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	t_u8 multi_ap_flag;
+	station_node *vlan_sta_ptr;
+	station_node *vlan_sta_list[MAX_STA_COUNT];
+	moal_private *parent_priv;
+#endif
+#endif
+	/** dhcp discover lock*/
+	spinlock_t dhcp_discover_lock;
+	/** DHCP DISCOVER Info queue */
+	struct list_head dhcp_discover_queue;
+	/** hash table for arp request */
+	DECLARE_HASHTABLE(hlist, 8);
+	/** arp request lock */
+	spinlock_t arp_request_lock;
 	/** txwatchdog disable */
 	t_u8 txwatchdog_disable;
 
 	/** secure boot uuid lower and higher 8 bytes */
 	t_u64 uuid_lo;
 	t_u64 uuid_hi;
+	t_u16 auth_tx_wait_time;
 };
 
 #ifdef SDIO
@@ -1829,6 +2116,8 @@
 	t_u32 host_strap_reg;
 	/* Chip Magic Register */
 	t_u32 magic_reg;
+	/** Chip boot mode reg */
+	t_u32 boot_mode_reg;
 	/* FW Name */
 	char fw_name[FW_NAMW_MAX_LEN];
 	char fw_name_wlan[FW_NAMW_MAX_LEN];
@@ -1842,13 +2131,20 @@
 	t_u8 scratch_reg;
 	t_u8 func1_reg_start;
 	t_u8 func1_reg_end;
-	t_u32 fw_reset_reg;
-	t_u8 fw_reset_val;
 	t_u32 slew_rate_reg;
 	t_u8 slew_rate_bit_offset;
+	t_u32 fw_winner_status_reg;
+#endif
+#if defined(SDIO) || defined(PCIE)
+	t_u32 fw_stuck_code_reg;
+	t_u32 fw_reset_reg;
+	t_u8 fw_reset_val;
+	t_u32 fw_wakeup_reg;
+	t_u8 fw_wakeup_val;
 #endif
 	t_u8 sniffer_support;
 	t_u8 per_pkt_cfg_support;
+	t_u8 host_mlme_required;
 } card_info;
 
 /** channel_field.flags */
@@ -1882,6 +2178,10 @@
 #define RX_BW_20L 2
 #define RX_BW_20U 3
 #define RX_BW_80 4
+#define RX_HE_BW_20 0
+#define RX_HE_BW_40 1
+#define RX_HE_BW_80 2
+#define RX_HE_BW_160 3
 /** mcs_field.flags
 The flags field is any combination of the following:
 0x03    bandwidth - 0: 20, 1: 40, 2: 20L, 3: 20U
@@ -1944,6 +2244,166 @@
 	t_u16 partial_aid;
 } __packed;
 
+#define HE_BSS_COLOR_KNOWN 0x0002
+#define HE_BEAM_CHANGE_KNOWN 0x0004
+#define HE_UL_DL_KNOWN 0x0008
+#define HE_MCS_KNOWN 0x0020
+#define HE_DCM_KNOWN 0x0040
+#define HE_CODING_KNOWN 0x0080
+#define HE_BW_KNOWN 0x4000
+#define HE_DATA_GI_KNOWN 0x0002
+#define HE_MU_DATA 0x0002
+#define HE_CODING_LDPC_USER0 0x2000
+/** he_field - COCO */
+struct he_field {
+	t_u8 pad;
+	t_u16 data1;
+	t_u16 data2;
+	t_u16 data3;
+	t_u16 data4;
+	t_u16 data5;
+	t_u16 data6;
+} __packed;
+
+extern t_u8 ru_signal[16][9];
+extern t_u8 ru_signal_106[14][9];
+extern t_u8 ru_signal_52[9];
+
+#define MLAN_20_BIT_CH1P 0xC0000000
+#define MLAN_20_BIT_CH1S 0x0000003F
+#define MLAN_20_BIT_CH2 0x007F8000
+#define MLAN_80_CENTER_RU 0x00004000
+#define MLAN_160_CENTER_RU 0x40000000
+#define MLAN_20_BIT_CH3 0x00003FC0
+#define MLAN_20_BIT_CH4 0x7F800000
+#define MLAN_BIT_160_CH3 0x003FC000
+#define MLAN_BIT_160_CH4 0x03FC0000
+
+#define MLAN_DECODE_RU_SIGNALING_CH1(out, x, y)                                \
+	{                                                                      \
+		x = (((x << 8) & MLAN_20_BIT_CH1P)) >> 30;                     \
+		out = x | ((y & MLAN_20_BIT_CH1S) << 2);                       \
+	}
+
+#define MLAN_DECODE_RU_SIGNALING_CH3(out, x, y)                                \
+	{                                                                      \
+		out = ((y & MLAN_20_BIT_CH3) >> 6);                            \
+	}
+
+#define MLAN_DECODE_RU_SIGNALING_CH2(out, x, y)                                \
+	{                                                                      \
+		out = ((y & MLAN_20_BIT_CH2) >> 15);                           \
+	}
+
+#define MLAN_DECODE_RU_SIGNALING_CH4(out, x, y)                                \
+	{                                                                      \
+		out = ((y & MLAN_20_BIT_CH4) >> 23);                           \
+	}
+
+#define MLAN_DECODING_160_RU_CH3(out, x, y)                                    \
+	{                                                                      \
+		out = ((y & MLAN_BIT_160_CH3) >> 5);                           \
+	}
+
+#define MLAN_DECODING_160_RU_CH4(out, x, y)                                    \
+	{                                                                      \
+		out = ((y & MLAN_BIT_160_CH4) >> 22);                          \
+	}
+
+#define RU_SIGNAL_52_TONE 112
+#define TONE_MAX_USERS_52 4
+#define TONE_MAX_USERS_242 3
+#define RU_SIGNAL_26_TONE 0
+#define TONE_MAX_USERS_26 8
+#define RU_26_TONE_LIMIT 15
+#define RU_TONE_LIMIT 96
+#define RU_80_106_TONE 128
+#define RU_40_242_TONE 192
+#define RU_80_484_TONE 200
+#define RU_160_996_TONE 208
+#define RU_TONE_26 4
+#define RU_TONE_52 5
+#define RU_TONE_106 6
+#define RU_TONE_242 7
+#define RU_TONE_484 8
+#define RU_TONE_996 9
+
+#define MLAN_DECODE_RU_TONE(x, y, tone)                                           \
+	{                                                                         \
+		if ((x == RU_SIGNAL_52_TONE)) {                                   \
+			if (((y + 1) <= TONE_MAX_USERS_52)) {                     \
+				tone = RU_TONE_52;                                \
+			} else {                                                  \
+				y = (y + 1) - TONE_MAX_USERS_52;                  \
+			}                                                         \
+		} else if (x == RU_SIGNAL_26_TONE) {                              \
+			if ((y + 1) <= TONE_MAX_USERS_26) {                       \
+				tone = RU_TONE_26;                                \
+			} else {                                                  \
+				y = (y + 1) - TONE_MAX_USERS_26;                  \
+			}                                                         \
+		} else if (x <= RU_TONE_LIMIT) {                                  \
+			t_u32 ru_arr_idx;                                         \
+			ru_arr_idx = x > RU_26_TONE_LIMIT ? 1 : 0;                \
+			if ((y + 1) > (ru_arr_idx ? ru_signal_106[x / 8][8] :     \
+						    ru_signal[x][8])) {           \
+				y = (y + 1) -                                     \
+				    (ru_arr_idx ? ru_signal_106[x / 8][8] :       \
+						  ru_signal[x][8]);               \
+			} else {                                                  \
+				t_u32 ind = 0;                                    \
+				t_u32 idx = 0;                                    \
+				while (ind < 8) {                                 \
+					t_u32 tn =                                \
+						ru_arr_idx ?                      \
+							ru_signal_106[x / 8]      \
+								     [7 - ind] :  \
+							ru_signal[x][7 - ind];    \
+					ind++;                                    \
+					if (tn == 0x1 || tn == 0x0 ||             \
+					    tn == 0x2) {                          \
+						if (idx == y) {                   \
+							tone = tn ? (tn ==        \
+								     2) ?         \
+								    RU_TONE_106 : \
+								    RU_TONE_52 :  \
+								    RU_TONE_26;   \
+							break;                    \
+						} else {                          \
+							idx++;                    \
+						}                                 \
+					}                                         \
+				}                                                 \
+			}                                                         \
+		} else if (x == RU_80_106_TONE) {                                 \
+			if ((y + 1) > TONE_MAX_USERS_242) {                       \
+				y = (y + 1) - TONE_MAX_USERS_242;                 \
+			} else {                                                  \
+				tone = (y == 2) ? RU_TONE_106 :                   \
+				       (y == 1) ? 0 :                             \
+						  RU_TONE_106;                    \
+			}                                                         \
+		} else if (x == RU_40_242_TONE) {                                 \
+			if (!y) {                                                 \
+				tone = RU_TONE_242;                               \
+			} else {                                                  \
+				y--;                                              \
+			}                                                         \
+		} else if (x == RU_80_484_TONE) {                                 \
+			if (!y) {                                                 \
+				tone = RU_TONE_484;                               \
+			} else {                                                  \
+				y--;                                              \
+			}                                                         \
+		} else if (x == RU_160_996_TONE) {                                \
+			if (!y) {                                                 \
+				tone = RU_TONE_996;                               \
+			} else {                                                  \
+				y--;                                              \
+			}                                                         \
+		}                                                                 \
+	}
+
 /** radiotap_body.flags */
 #define RADIOTAP_FLAGS_DURING_CFG 0x01
 #define RADIOTAP_FLAGS_SHORT_PREAMBLE 0x02
@@ -1976,6 +2436,8 @@
 		struct mcs_field mcs;
 		/** vht field */
 		struct vht_field vht;
+		/** he field */
+		struct he_field he;
 	} u;
 } __packed;
 
@@ -2077,6 +2539,7 @@
 #endif
 
 #define MAX_KEEP_ALIVE_ID 4
+#define MAX_KEEP_ALIVE_RX_ID 4
 
 /** Operation data structure for MOAL bus interfaces */
 typedef struct _moal_if_ops {
@@ -2091,6 +2554,7 @@
 	mlan_status (*get_fw_name)(moal_handle *handle);
 	void (*dump_fw_info)(moal_handle *handle);
 	int (*dump_reg_info)(moal_handle *handle, t_u8 *buf);
+	void (*card_reset)(moal_handle *handle);
 	void (*reg_dbg)(moal_handle *handle);
 	t_u8 (*is_second_mac)(moal_handle *handle);
 } moal_if_ops;
@@ -2144,6 +2608,8 @@
 	EXT_TX_SKB_CLONE,
 	EXT_PMQOS,
 	EXT_CHAN_TRACK,
+	EXT_DMCS,
+	EXT_PREF_DBC,
 	EXT_MAX_PARAM,
 };
 
@@ -2162,6 +2628,9 @@
 	int rf_test_mode;
 	char *hw_name;
 	int drv_mode;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	int mon_filter;
+#endif
 #ifdef DEBUG_LEVEL1
 	int drvdbg;
 #endif
@@ -2175,6 +2644,7 @@
 	int uap_max_sta;
 	int wacp_mode;
 #endif /* UAP_SUPPORT */
+	unsigned int fw_data_cfg;
 #ifdef WIFI_DIRECT_SUPPORT
 	int max_wfd_bss;
 	char *wfd_name;
@@ -2182,10 +2652,15 @@
 	int max_vir_bss;
 #endif
 #endif /* WIFI_DIRECT_SUPPORT */
+	char *nan_name;
+	int max_nan_bss;
 	int auto_ds;
 	int net_rx;
 	int amsdu_deaggr;
+	int tx_budget;
+	int mclient_scheduling;
 	int ext_scan;
+	int bootup_cal_ctrl;
 	int ps_mode;
 	int p2a_scan;
 	/** scan chan gap */
@@ -2198,6 +2673,7 @@
 #if defined(STA_SUPPORT)
 	int cfg_11d;
 #endif
+	int amsdu_disable;
 #if defined(SDIO)
 	int slew_rate;
 #endif
@@ -2225,6 +2701,10 @@
 	unsigned int dev_cap_mask;
 	int pmic;
 	int antcfg;
+	/** dmcs*/
+	int dmcs;
+	/** pref_dbc*/
+	int pref_dbc;
 	unsigned int uap_oper_ctrl;
 	int hs_wake_interval;
 	int indication_gpio;
@@ -2241,12 +2721,22 @@
 	t_u8 mcs32;
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 	/* rps module param */
 	int rps;
 #endif
 #endif
+	int edmac_ctrl;
 	int keep_previous_scan;
+	int auto_11ax;
+	/** hs_auto_arp setting */
+	int hs_auto_arp;
+	/** Dual-BT **/
+	int dual_nb;
+	/* reject addba req config for HS or FW Auto-reconnect */
+	t_u32 reject_addba_req;
+	/** disable_11h_tpc setting */
+	int disable_11h_tpc;
 } moal_mod_para;
 
 void woal_tp_acnt_timer_func(void *context);
@@ -2257,7 +2747,7 @@
 #define RX_DROP_P3 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 2)
 #define RX_DROP_P4 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 3)
 #define RX_DROP_P5 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 4)
-#define TXRX_MAX_SAMPLE 60
+#define TXRX_MAX_SAMPLE 50
 #define RX_TIME_PKT (MAX_TP_ACCOUNT_DROP_POINT_NUM + 5)
 #define TX_TIME_PKT (MAX_TP_ACCOUNT_DROP_POINT_NUM + 6)
 
@@ -2282,6 +2772,8 @@
 	unsigned long tx_xmit_skb_realloc_cnt;
 	unsigned long tx_stop_queue_cnt;
 	unsigned long tx_delay_driver[TXRX_MAX_SAMPLE];
+	/* drop_point1 to drop_point3 time */
+	unsigned long tx_delay1_driver[TXRX_MAX_SAMPLE];
 
 	/** RX accounting */
 	unsigned long rx_packets[MAX_TP_ACCOUNT_DROP_POINT_NUM];
@@ -2369,6 +2861,7 @@
 	/** STATUS variables */
 	MOAL_HARDWARE_STATUS hardware_status;
 	BOOLEAN fw_reload;
+	BOOLEAN fw_reseting;
 	/** POWER MANAGEMENT AND PnP SUPPORT */
 	BOOLEAN surprise_removed;
 	/** Firmware release number */
@@ -2379,6 +2872,10 @@
 	t_u16 fw_bands;
 	/** ECSA support */
 	t_u8 fw_ecsa_enable;
+	/* Firmware support cmd_tx_data */
+	t_u8 cmd_tx_data;
+	/** FW support security key for rgpower table */
+	t_u8 sec_rgpower;
 	/** FW ROAMING support */
 	t_u8 fw_roam_enable;
 	/** FW ROAMING capability in fw */
@@ -2464,6 +2961,10 @@
 	/** Bitmap for re-association on/off */
 	t_u8 reassoc_on;
 #endif /* REASSOCIATION */
+	/** RTT capability */
+	wifi_rtt_capabilities rtt_capa;
+	/** RTT config */
+	wifi_rtt_config_params_t rtt_params;
 	/** Driver workqueue */
 	struct workqueue_struct *workqueue;
 	/** main work */
@@ -2474,14 +2975,39 @@
 	/** Host Mlme Work struct**/
 	struct work_struct host_mlme_work;
 #endif
-	/** Driver workqueue */
-	struct workqueue_struct *rx_workqueue;
-	/** main work */
-	struct work_struct rx_work;
 	/** Driver event workqueue */
 	struct workqueue_struct *evt_workqueue;
 	/** event  work */
 	struct work_struct evt_work;
+#if defined(SDIO) || defined(USB)
+	/** Driver workqueue */
+	struct workqueue_struct *rx_workqueue;
+	/** main work */
+	struct work_struct rx_work;
+#endif
+#ifdef PCIE
+	/** Driver pcie rx cmd resp workqueue */
+	struct workqueue_struct *pcie_cmd_resp_workqueue;
+	/** pcie rx cmd resp work */
+	struct work_struct pcie_cmd_resp_work;
+	/** pcie delayed work */
+	struct delayed_work pcie_delayed_tx_work;
+#ifdef TASKLET_SUPPORT
+	/* pcie rx data tasklet */
+	struct tasklet_struct pcie_rx_task;
+	/* pcie tx complete tasklet */
+	struct tasklet_struct pcie_tx_complete_task;
+#else
+	/** Driver pcie rx workqueue */
+	struct workqueue_struct *pcie_rx_workqueue;
+	/* pcie rx work */
+	struct work_struct pcie_rx_work;
+	/** Driver pcie tx complete workqueue */
+	struct workqueue_struct *pcie_tx_complete_workqueue;
+	/* pcie tx complete work */
+	struct work_struct pcie_tx_complete_work;
+#endif
+#endif
 	/** event spin lock */
 	spinlock_t evt_lock;
 	/** event queue */
@@ -2490,6 +3016,7 @@
 	struct workqueue_struct *tx_workqueue;
 	/** tx work */
 	struct work_struct tx_work;
+
 	/** remain on channel flag */
 	t_u8 remain_on_channel;
 	/** bss index for remain on channel */
@@ -2613,6 +3140,8 @@
 	struct semaphore async_sem;
 	/** scan channel gap */
 	t_u16 scan_chan_gap;
+	/** flag to check if specific scan time set by scancfg */
+	t_u8 user_scan_cfg;
 #ifdef STA_CFG80211
 	/** CFG80211 scan request description */
 	struct cfg80211_scan_request *scan_request;
@@ -2622,6 +3151,7 @@
 	struct delayed_work scan_timeout_work;
 	/** scan timeout time */
 	t_u32 scan_timeout;
+
 #endif
 #endif
 	/** main state */
@@ -2632,10 +3162,12 @@
 	t_u8 driver_state;
 	/** ioctl timeout */
 	t_u8 ioctl_timeout;
+#ifdef DUMP_TO_PROC
 	/** Pointer of fw dump buffer */
 	t_u8 *drv_dump_buf;
 	/** drv dump len */
 	t_u32 drv_dump_len;
+#endif
 	/** FW dump state */
 	t_u8 fw_dump;
 	/** event fw dump */
@@ -2648,8 +3180,10 @@
 	t_u64 fw_dump_len;
 	/** fw dump status for each chip, useful in multichip drive */
 	BOOLEAN fw_dump_status;
+#ifdef DUMP_TO_PROC
 	/** Pointer of fw dump buffer */
 	t_u8 *fw_dump_buf;
+#endif
 	/** FW dump full name */
 	t_u8 firmware_dump_file[128];
 
@@ -2681,7 +3215,7 @@
 	t_s8 driver_version[MLAN_MAX_VER_STR_LEN];
 	char *fwdump_fname;
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	struct wakeup_source ws;
 #else
 	struct wake_lock wake_lock;
@@ -2697,6 +3231,7 @@
 #endif
 #endif
 	mlan_ds_misc_keep_alive keep_alive[MAX_KEEP_ALIVE_ID];
+	mlan_ds_misc_keep_alive_rx keep_alive_rx[MAX_KEEP_ALIVE_RX_ID];
 	struct net_device napi_dev;
 	struct napi_struct napi_rx;
 	/* bus interface operations */
@@ -2738,12 +3273,12 @@
 	BOOLEAN is_tp_acnt_timer_set;
 
 	t_u8 request_pm;
-#ifdef IMX_SUPPORT
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
 	struct pm_qos_request woal_pm_qos_req;
 #endif
-#endif
 	t_u32 ips_ctrl;
+	BOOLEAN is_edmac_enabled;
+	bool driver_init;
 };
 
 /**
@@ -2913,6 +3448,12 @@
 	} while (0)
 #endif /* DEBUG_LEVEL2 */
 
+#define PRINTM_MFWDP_D(level, msg...)                                          \
+	do {                                                                   \
+		woal_print(level, msg);                                        \
+		if (drvdbg & MFWDP_D)                                          \
+			printk(KERN_DEBUG msg);                                \
+	} while (0)
 #define PRINTM_MFW_D(level, msg...)                                            \
 	do {                                                                   \
 		woal_print(level, msg);                                        \
@@ -2938,6 +3479,12 @@
 			printk(KERN_DEBUG msg);                                \
 	} while (0)
 
+#define PRINTM_MREG(level, msg...)                                             \
+	do {                                                                   \
+		woal_print(level, msg);                                        \
+		if (drvdbg & MREG)                                             \
+			printk(KERN_DEBUG msg);                                \
+	} while (0)
 #define PRINTM_MIOCTL(level, msg...)                                           \
 	do {                                                                   \
 		woal_print(level, msg);                                        \
@@ -3339,7 +3886,7 @@
 /** Free buffer */
 void woal_free_mlan_buffer(moal_handle *handle, pmlan_buffer pmbuf);
 /** Get private structure of a BSS by index */
-moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u8 bss_index);
+moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u32 bss_index);
 /* Functions in init module */
 /** init module parameters */
 mlan_status woal_init_module_param(moal_handle *handle);
@@ -3351,9 +3898,12 @@
 mlan_status woal_init_sw(moal_handle *handle);
 /** update the default firmware name */
 void woal_update_firmware_name(moal_handle *handle);
+mlan_status woal_set_rgpower_table(moal_handle *handle);
 /** cancel all works in the queue */
 void woal_terminate_workqueue(moal_handle *handle);
 void woal_flush_workqueue(moal_handle *handle);
+void woal_queue_rx_task(moal_handle *handle);
+void woal_flush_evt_queue(moal_handle *handle);
 /** initializes firmware */
 mlan_status woal_init_fw(moal_handle *handle);
 /** frees the structure of moal_handle */
@@ -3481,6 +4031,7 @@
 mlan_status woal_get_wakeup_reason(moal_private *priv,
 				   mlan_ds_hs_wakeup_reason *wakeup_reason);
 int woal_process_proc_hssetpara(moal_handle *handle, t_u8 *buf);
+#ifdef DUMP_TO_PROC
 #define FW_DUMP_INFO_LEN 0x280000
 /** mem dump header */
 typedef struct {
@@ -3499,6 +4050,14 @@
 			       t_u32 type);
 void woal_append_end_block(moal_handle *phandle);
 t_u8 *woal_dump_drv_info(moal_handle *phandle, t_u32 *dump_len);
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+void woal_create_dump_dir(moal_handle *phandle, char *dir_buf, int buf_size);
+#endif
+mlan_status woal_save_dump_info_to_file(char *dir_name, char *file_name,
+					t_u8 *buf, t_u32 buf_len);
+void woal_dump_drv_info(moal_handle *phandle, t_u8 *dir_name);
+#endif
 
 #define FW_DUMP_TYPE_ENDED 0x002
 #define FW_DUMP_TYPE_MEM_ITCM 0x004
@@ -3514,10 +4073,20 @@
 void woal_dump_firmware_info_v2(moal_handle *phandle);
 void woal_dump_firmware_info_v3(moal_handle *phandle);
 #endif /* SDIO_MMC */
+/* Print FW dumps in kernel(dmesg) log */
+t_void woal_print_firmware_dump(moal_handle *phandle, char *fwdp_fname);
 /* Store the FW dumps received from events in a file */
 void woal_store_firmware_dump(moal_handle *phandle, pmlan_event pmevent);
 void woal_send_fw_dump_complete_event(moal_private *priv);
 
+#ifndef DUMP_TO_PROC
+#if defined(PCIE)
+void woal_store_ssu_dump(moal_handle *phandle, pmlan_event pmevent);
+#endif /* SSU_SUPPORT */
+/** save hostcmd response to file */
+t_void woal_save_host_cmdresp(moal_handle *phandle, mlan_cmdresp_event *pevent);
+#endif
+
 int woal_pre_warmreset(moal_private *priv);
 int woal_warmreset(moal_private *priv);
 
@@ -3562,9 +4131,9 @@
 /** Get channel list */
 mlan_status woal_get_channel_list(moal_private *priv, t_u8 wait_option,
 				  mlan_chan_list *chanlist);
+#endif
 mlan_status woal_11d_check_ap_channel(moal_private *priv, t_u8 wait_option,
 				      mlan_ssid_bssid *ssid_bssid);
-#endif
 /** Set/Get retry count */
 mlan_status woal_set_get_retry(moal_private *priv, t_u32 action,
 			       t_u8 wait_option, int *value);
@@ -3606,9 +4175,6 @@
 /** Find best network to connect */
 mlan_status woal_find_best_network(moal_private *priv, t_u8 wait_option,
 				   mlan_ssid_bssid *ssid_bssid);
-/** Set Ad-Hoc channel */
-mlan_status woal_change_adhoc_chan(moal_private *priv, int channel,
-				   t_u8 wait_option);
 
 /** Get scan table */
 mlan_status woal_get_scan_table(moal_private *priv, t_u8 wait_option,
@@ -3654,6 +4220,8 @@
 #define MGMT_MASK_ASSOC_RESP_QOS_MAP 0x4000
 #define MGMT_MASK_BEACON_WPS_P2P 0x8000
 #define MLAN_CUSTOM_IE_DELETE_MASK 0x0
+#define MLAN_CUSTOM_IE_NEW_MASK 0x8000
+
 /** common ioctl for uap, station */
 int woal_custom_ie_ioctl(struct net_device *dev, struct ifreq *req);
 #ifdef UAP_SUPPORT
@@ -3742,10 +4310,22 @@
 
 void woal_fw_dump_timer_func(void *context);
 
-t_void woal_main_work_queue(struct work_struct *work);
+#if defined(USB) || defined(SDIO)
 t_void woal_rx_work_queue(struct work_struct *work);
+#endif
+t_void woal_main_work_queue(struct work_struct *work);
 t_void woal_evt_work_queue(struct work_struct *work);
 t_void woal_mclist_work_queue(struct work_struct *work);
+
+#ifdef PCIE
+t_void woal_pcie_cmd_resp_work_queue(struct work_struct *work);
+t_void woal_pcie_delayed_tx_work(struct work_struct *work);
+#ifndef TASKLET_SUPPORT
+t_void woal_pcie_rx_work_queue(struct work_struct *work);
+t_void woal_pcie_tx_complete_work_queue(struct work_struct *work);
+#endif
+#endif
+
 #ifdef STA_CFG80211
 t_void woal_scan_timeout_handler(struct work_struct *work);
 #endif
@@ -3763,6 +4343,8 @@
 moal_private *woal_add_interface(moal_handle *handle, t_u8 bss_num,
 				 t_u8 bss_type);
 void woal_clean_up(moal_handle *handle);
+void woal_send_auto_recovery_complete_event(moal_handle *handle);
+void woal_send_auto_recovery_failure_event(moal_handle *handle);
 void woal_remove_interface(moal_handle *handle, t_u8 bss_index);
 void woal_set_multicast_list(struct net_device *dev);
 mlan_status woal_request_fw(moal_handle *handle);
@@ -3845,7 +4427,8 @@
 void woal_remove_mcast_node(moal_private *priv, t_u8 *mcast_addr);
 t_u8 woal_find_mcast_node_tx(moal_private *priv, struct sk_buff *skb);
 
-mlan_status woal_request_country_power_table(moal_private *priv, char *region);
+mlan_status woal_request_country_power_table(moal_private *priv, char *region,
+					     t_u8 wait_option);
 mlan_status woal_mc_policy_cfg(moal_private *priv, t_u16 *enable,
 			       t_u8 wait_option, t_u8 action);
 #ifdef UAP_SUPPORT
@@ -3865,6 +4448,19 @@
 mlan_status woal_set_hotspotcfg(moal_private *priv, t_u8 wait_option,
 				t_u32 hotspotcfg);
 
+#if defined(STA_CFG80211)
+mlan_status woal_multi_ap_cfg(moal_private *priv, t_u8 wait_option, t_u8 flag);
+struct dhcp_discover_info *woal_get_dhcp_discover_info(moal_private *priv,
+						       t_u32 transaction_id);
+void woal_flush_dhcp_discover_queue(moal_private *priv);
+t_u32 woal_get_dhcp_discover_transation_id(struct sk_buff *skb);
+t_void woal_add_dhcp_discover_node(moal_private *priv, t_u32 transaction_id,
+				   mlan_buffer *pmbuf);
+t_void woal_add_arp_request_node(moal_private *priv, t_u32 hash_key);
+t_u32 woal_generate_arp_request_hash(struct sk_buff *skb);
+t_void woal_flush_arp_request_entry(moal_private *priv);
+#endif
+
 mlan_status woal_set_get_wowlan_config(moal_private *priv, t_u16 action,
 				       t_u8 wait_option,
 				       mlan_ds_misc_mef_flt_cfg *mefcfg);
@@ -3891,6 +4487,27 @@
 	moal_private *priv, t_u8 mkeep_alive_id, t_u8 enable, t_u16 ether_type,
 	t_u8 *ip_pkt, t_u16 ip_pkt_len, t_u8 *src_mac, t_u8 *dst_mac,
 	t_u32 period_msec, t_u32 retry_interval, t_u8 retry_cnt);
+int woal_start_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			      t_u8 *ip_pkt, t_u16 ip_pkt_len, t_u8 *src_mac,
+			      t_u8 *dst_mac);
+int woal_stop_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			     t_u8 reset, t_u8 *ip_pkt, t_u8 *pkt_len);
+int woal_priv_save_cloud_keep_alive_params_rx(moal_private *priv,
+					      t_u8 mkeep_alive_id, t_u8 enable,
+					      t_u16 ether_type, t_u8 *ip_pkt,
+					      t_u16 ip_pkt_len, t_u8 *src_mac,
+					      t_u8 *dst_mac);
+void woal_channel_info_to_bandcfg(moal_private *priv,
+				  wifi_channel_info *ch_info,
+				  Band_Config_t *bandcfg);
+void woal_bandcfg_to_channel_info(moal_private *priv, Band_Config_t *bandcfg,
+				  t_u8 channel, wifi_channel_info *ch_info);
+mlan_status woal_config_rtt(moal_private *priv, t_u8 wait_option,
+			    wifi_rtt_config_params_t *rtt_params);
+mlan_status woal_cancel_rtt(moal_private *priv, t_u8 wait_option,
+			    t_u32 addr_num, t_u8 addr[][MLAN_MAC_ADDR_LENGTH]);
+mlan_status woal_rtt_responder_cfg(moal_private *priv, t_u8 wait_option,
+				   mlan_rtt_responder *rtt_rsp_cfg);
 #ifdef UAP_SUPPORT
 mlan_status woal_set_wacp_mode(moal_private *priv, t_u8 wait_option);
 #endif
@@ -3927,4 +4544,20 @@
 void woal_enable_oob_wakeup_irq(moal_handle *handle);
 irqreturn_t woal_oob_wakeup_irq_handler(int irq, void *priv);
 #endif /* IMX_SUPPORT */
+
+t_bool woal_secure_add(t_void *datain, t_s32 add, t_void *dataout,
+		       data_type type);
+t_bool woal_secure_sub(t_void *datain, t_s32 sub, t_void *dataout,
+		       data_type type);
+
+mlan_status woal_edmac_cfg(moal_private *priv, t_u8 *country_code);
+
+#ifdef DUMP_TO_PROC
+void woal_print_firmware_dump_buf(t_u8 *pfd_buf, t_u64 fwdump_len);
+#endif
+
+#if !defined(STA_CFG80211) && !defined(UAP_CFG80211)
+unsigned int woal_classify8021d(struct sk_buff *skb);
+#endif
+
 #endif /* _MOAL_MAIN_H */
diff --git a/wlan_sd8987/mlinux/moal_pcie.c b/wlan_src/mlinux/moal_pcie.c
old mode 100755
new mode 100644
similarity index 74%
rename from wlan_sd8987/mlinux/moal_pcie.c
rename to wlan_src/mlinux/moal_pcie.c
index 8d9ea7f..c634eed
--- a/wlan_sd8987/mlinux/moal_pcie.c
+++ b/wlan_src/mlinux/moal_pcie.c
@@ -4,20 +4,28 @@
  *  related functions.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2022, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -33,7 +41,9 @@
 #endif
 
 #include "moal_pcie.h"
-
+#ifdef UAP_SUPPORT
+#include "moal_uap.h"
+#endif
 #if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 70)
 #ifdef IMX_SUPPORT
 #include <linux/busfreq-imx.h>
@@ -57,6 +67,7 @@
 static void woal_pcie_unregister_dev(moal_handle *handle);
 static void woal_pcie_cleanup(pcie_service_card *card);
 static mlan_status woal_pcie_init(pcie_service_card *card);
+static void woal_pcie_work(struct work_struct *work);
 
 /** WLAN IDs */
 static const struct pci_device_id wlan_ids[] = {
@@ -116,10 +127,28 @@
 		0,
 	},
 #endif
-#ifdef PCIENW62X
+#ifdef PCIEAW693
 	{
 		PCIE_VENDOR_ID_NXP,
-		PCIE_DEVICE_ID_88WNW62X,
+		PCIE_DEVICE_ID_88WAW693_FN0,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+	},
+	{
+		PCIE_VENDOR_ID_NXP,
+		PCIE_DEVICE_ID_88WAW693_FN1,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+	},
+#endif
+#ifdef PCIEIW624
+	{
+		PCIE_VENDOR_ID_NXP,
+		PCIE_DEVICE_ID_88WIW624,
 		PCI_ANY_ID,
 		PCI_ANY_ID,
 		0,
@@ -144,7 +173,7 @@
 
 static mlan_status woal_pcie_preinit(struct pci_dev *pdev);
 #if defined(PCIE8897) || defined(PCIE8997) || defined(PCIE9098) ||             \
-	defined(PCIE9097) || defined(PCIENW62X)
+	defined(PCIE9097) || defined(PCIEAW693) || defined(PCIEIW624)
 static rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag,
 					   t_u8 resetflag);
 #endif
@@ -215,15 +244,29 @@
 					strlen(KERN_VERSION));
 	}
 #endif
-#ifdef PCIENW62X
-	if (cardp_pcie->dev->device == PCIE_DEVICE_ID_88WNW62X) {
-		card_type = CARD_TYPE_PCIENW62X;
-		moal_memcpy_ext(NULL, driver_version, CARD_PCIENW62X,
-				strlen(CARD_PCIENW62X), strlen(driver_version));
+#ifdef PCIEAW693
+	if (cardp_pcie->dev->device == PCIE_DEVICE_ID_88WAW693_FN0 ||
+	    cardp_pcie->dev->device == PCIE_DEVICE_ID_88WAW693_FN1) {
+		card_type = CARD_TYPE_PCIEAW693;
+		moal_memcpy_ext(NULL, driver_version, CARD_PCIEAW693,
+				strlen(CARD_PCIEAW693), strlen(driver_version));
 		moal_memcpy_ext(NULL,
 				driver_version + strlen(INTF_CARDTYPE) +
 					strlen(KERN_VERSION),
-				V17, strlen(V17),
+				V18, strlen(V18),
+				strlen(driver_version) - strlen(INTF_CARDTYPE) -
+					strlen(KERN_VERSION));
+	}
+#endif
+#ifdef PCIEIW624
+	if (cardp_pcie->dev->device == PCIE_DEVICE_ID_88WIW624) {
+		card_type = CARD_TYPE_PCIEIW624;
+		moal_memcpy_ext(NULL, driver_version, CARD_PCIEIW624,
+				strlen(CARD_PCIEIW624), strlen(driver_version));
+		moal_memcpy_ext(NULL,
+				driver_version + strlen(INTF_CARDTYPE) +
+					strlen(KERN_VERSION),
+				V18, strlen(V18),
 				strlen(driver_version) - strlen(INTF_CARDTYPE) -
 					strlen(KERN_VERSION));
 	}
@@ -234,6 +277,51 @@
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
 /**
+ * @brief Function to program scratch register to ask device to clear ADMA
+ *
+ * @param handle    A pointer to moal_handle structure
+ *
+ * @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+
+static mlan_status woal_reset_adma(moal_handle *handle)
+{
+	int tries = 0;
+	int ret = MLAN_STATUS_SUCCESS;
+	t_u32 value;
+	t_u32 reset_reg = handle->card_info->fw_reset_reg;
+	t_u8 reset_adma_val = 0x97;
+	/* wake up device before set the reset reg */
+	handle->ops.read_reg(handle, handle->card_info->fw_wakeup_reg, &value);
+	udelay(100);
+	if (handle->ops.write_reg(handle, reset_reg, reset_adma_val) !=
+	    MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to write register.\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	for (tries = 0; tries < 100; ++tries) {
+		ret = handle->ops.read_reg(handle, reset_reg, &value);
+		if (value == 0) {
+			break;
+		}
+		moal_usleep_range(handle, 100, 200);
+	}
+
+	if (value == 0) {
+		PRINTM(MMSG, "%s:ADMA reset done\n", __func__);
+		ret = MLAN_STATUS_SUCCESS;
+	} else {
+		PRINTM(MERROR, "%s:ADMA reset failed(value:%x)\n", __func__,
+		       value);
+		ret = MLAN_STATUS_FAILURE;
+	}
+done:
+	return ret;
+}
+
+/**
  * @brief Function to process pre/post PCIe function level reset
  *
  * @param handle    A pointer to moal_handle structure
@@ -275,7 +363,8 @@
 
 	if (!IS_PCIE8997(handle->card_type) &&
 	    !IS_PCIE9097(handle->card_type) &&
-	    !IS_PCIENW62X(handle->card_type) &&
+	    !IS_PCIEIW624(handle->card_type) &&
+	    !IS_PCIEAW693(handle->card_type) &&
 	    !IS_PCIE9098(handle->card_type)) {
 		LEAVE();
 		return status;
@@ -286,11 +375,14 @@
 
 	if (!prepare)
 		goto perform_init;
+	if (!handle->pmlan_adapter)
+		goto exit;
 
 	/* Reset all interfaces */
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 	woal_reset_intf(priv, MOAL_IOCTL_WAIT, MTRUE);
 	woal_clean_up(handle);
+	mlan_ioctl(handle->pmlan_adapter, NULL);
 
 	/* Shutdown firmware */
 	handle->init_wait_q_woken = MFALSE;
@@ -328,7 +420,16 @@
 	/* Remove interface */
 	for (i = 0; i < handle->priv_num; i++)
 		woal_remove_interface(handle, i);
-
+	handle->priv_num = 0;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	/* Unregister wiphy device and free */
+	if (handle->wiphy) {
+		wiphy_unregister(handle->wiphy);
+		woal_cfg80211_free_bands(handle->wiphy);
+		wiphy_free(handle->wiphy);
+		handle->wiphy = NULL;
+	}
+#endif
 	/* Unregister mlan */
 	if (handle->pmlan_adapter) {
 		mlan_unregister(handle->pmlan_adapter);
@@ -349,6 +450,7 @@
 		}
 		handle->pmlan_adapter = NULL;
 	}
+	handle->fw_dump = MFALSE;
 
 	goto exit;
 
@@ -360,9 +462,12 @@
 		PRINTM(MFATAL, "Software Init Failed\n");
 		goto err_init_fw;
 	}
+	if (!handle->pmlan_adapter)
+		goto err_init_fw;
 
-#ifdef PCIE9098
-	if (card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1)
+#if defined(PCIE9098) || defined(PCIEAW693)
+	if ((card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1) ||
+	    (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN1))
 		mlan_set_int_mode(handle->pmlan_adapter, pcie_int_mode, 1);
 	else
 #endif
@@ -384,6 +489,7 @@
 			moal_extflg_set(handle, EXT_FW_SERIAL);
 		goto err_init_fw;
 	}
+
 	if (flr_flag && fw_serial_bkp)
 		moal_extflg_set(handle, EXT_FW_SERIAL);
 	if (IS_PCIE9098(handle->card_type))
@@ -396,6 +502,10 @@
 	return status;
 
 err_init_fw:
+	if (handle->is_fw_dump_timer_set) {
+		woal_cancel_timer(&handle->fw_dump_timer);
+		handle->is_fw_dump_timer_set = MFALSE;
+	}
 	if ((handle->hardware_status == HardwareStatusFwReady) ||
 	    (handle->hardware_status == HardwareStatusReady)) {
 		PRINTM(MINFO, "shutdown mlan\n");
@@ -406,7 +516,7 @@
 						 handle->init_wait_q_woken);
 	}
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
@@ -426,6 +536,8 @@
 	while (handle->reassoc_thread.pid)
 		woal_sched_timeout(2);
 #endif /* REASSOCIATION */
+	if (moal_extflg_isset(handle, EXT_NAPI))
+		netif_napi_del(&handle->napi_rx);
 	woal_terminate_workqueue(handle);
 	woal_free_moal_handle(handle);
 
@@ -488,6 +600,7 @@
 		ret = -EFAULT;
 		goto err;
 	}
+	INIT_WORK(&card->reset_work, woal_pcie_work);
 
 	if (woal_add_card(card, &card->dev->dev, &pcie_ops, card_type) ==
 	    NULL) {
@@ -531,10 +644,12 @@
 		LEAVE();
 		return;
 	}
-
+	cancel_work_sync(&card->reset_work);
 	handle = card->handle;
-	if (!handle || !handle->priv_num) {
+	if (!handle) {
 		PRINTM(MINFO, "PCIE card handle removed\n");
+		woal_pcie_cleanup(card);
+		kfree(card);
 		LEAVE();
 		return;
 	}
@@ -573,11 +688,17 @@
 		return;
 	}
 	handle = card->handle;
+	if (!handle) {
+		PRINTM(MINFO, "Invalid handle\n");
+		LEAVE();
+		return;
+	}
 	if (handle->second_mac)
 		goto done;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
-	if (IS_PCIE9098(handle->card_type) || IS_PCIENW62X(handle->card_type) ||
-	    IS_PCIE9097(handle->card_type)) {
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
+	if (IS_PCIE9098(handle->card_type) || IS_PCIEIW624(handle->card_type) ||
+	    IS_PCIEAW693(handle->card_type) || IS_PCIE9097(handle->card_type)) {
 		if (RDWR_STATUS_FAILURE !=
 		    woal_pcie_rdwr_firmware(handle, 0, 1))
 			PRINTM(MMSG, "wlan: start in-bound IR...\n");
@@ -638,46 +759,60 @@
 		ret = -EBUSY;
 		goto done;
 	}
-	for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
-		if (handle->priv[i] &&
-		    (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA))
-			woal_cancel_scan(handle->priv[i], MOAL_IOCTL_WAIT);
-	}
-	handle->suspend_fail = MFALSE;
-	memset(&pm_info, 0, sizeof(pm_info));
-#define MAX_RETRY_NUM 8
-	for (i = 0; i < MAX_RETRY_NUM; i++) {
-		if (MLAN_STATUS_SUCCESS ==
-		    woal_get_pm_info(woal_get_priv(handle, MLAN_BSS_ROLE_ANY),
-				     &pm_info)) {
-			if (pm_info.is_suspend_allowed == MTRUE)
-				break;
-			else
-				PRINTM(MMSG,
-				       "Suspend not allowed and retry again\n");
-		}
-		woal_sched_timeout(100);
-	}
-	if (pm_info.is_suspend_allowed == MFALSE) {
-		PRINTM(MMSG, "Suspend not allowed\n");
-		ret = -EBUSY;
-		goto done;
-	}
-
-	for (i = 0; i < handle->priv_num; i++)
-		netif_device_detach(handle->priv[i]->netdev);
 	if (moal_extflg_isset(handle, EXT_PM_KEEP_POWER))
 		keep_power = MTRUE;
 	else
 		keep_power = MFALSE;
 
+	for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
+		if (handle->priv[i])
+			woal_cancel_scan(handle->priv[i], MOAL_IOCTL_WAIT);
+#ifdef UAP_SUPPORT
+		if (handle->priv[i] && !keep_power &&
+		    handle->priv[i]->bss_started == MTRUE) {
+			if (woal_uap_bss_ctrl(handle->priv[i], MOAL_IOCTL_WAIT,
+					      UAP_BSS_STOP)) {
+				PRINTM(MERROR, "%s: stop uap failed \n",
+				       __func__);
+			}
+		}
+#endif
+	}
+	handle->suspend_fail = MFALSE;
 	if (keep_power) {
+		memset(&pm_info, 0, sizeof(pm_info));
+#define MAX_RETRY_NUM 8
+		for (i = 0; i < MAX_RETRY_NUM; i++) {
+			if (MLAN_STATUS_SUCCESS ==
+			    woal_get_pm_info(woal_get_priv(handle,
+							   MLAN_BSS_ROLE_ANY),
+					     &pm_info)) {
+				if (pm_info.is_suspend_allowed == MTRUE)
+					break;
+				else
+					PRINTM(MMSG,
+					       "Suspend not allowed and retry again\n");
+			}
+			woal_sched_timeout(100);
+		}
+		if (pm_info.is_suspend_allowed == MFALSE) {
+			PRINTM(MMSG, "Suspend not allowed\n");
+			ret = -EBUSY;
+			goto done;
+		}
+	}
+	for (i = 0; i < handle->priv_num; i++)
+		netif_device_detach(handle->priv[i]->netdev);
+
+	if (keep_power) {
+		woal_sched_timeout(200);
 		/* Enable Host Sleep */
 		hs_actived = woal_enable_hs(
 			woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
 		if (hs_actived == MTRUE) {
 			/* Indicate device suspended */
 			handle->is_suspended = MTRUE;
+			woal_sched_timeout(10);
 		} else {
 			PRINTM(MMSG, "HS not actived, suspend fail!");
 			handle->suspend_fail = MTRUE;
@@ -830,9 +965,18 @@
 		}
 	}
 	handle->surprise_removed = MTRUE;
+	handle->fw_reseting = MTRUE;
+	// TODO: Can add more chips once the related code has been ported to fw
+	// v18
+	if (IS_PCIE9097(handle->card_type) || IS_PCIE9098(handle->card_type) ||
+	    IS_PCIEAW693(handle->card_type)) {
+		woal_reset_adma(handle);
+	}
+
 	woal_do_flr(handle, true, true);
 	if (ref_handle) {
 		ref_handle->surprise_removed = MTRUE;
+		ref_handle->fw_reseting = MTRUE;
 		woal_do_flr(ref_handle, true, true);
 	}
 
@@ -882,12 +1026,18 @@
 		}
 	}
 	handle->surprise_removed = MFALSE;
-	woal_do_flr(handle, false, true);
+	if (MLAN_STATUS_SUCCESS == woal_do_flr(handle, false, true))
+		handle->fw_reseting = MFALSE;
+	else
+		handle = NULL;
 	if (ref_handle) {
 		ref_handle->surprise_removed = MFALSE;
-		woal_do_flr(ref_handle, false, true);
+		if (MLAN_STATUS_SUCCESS == woal_do_flr(ref_handle, false, true))
+			ref_handle->fw_reseting = MFALSE;
 	}
-
+	wifi_status = WIFI_STATUS_OK;
+	if (handle)
+		woal_send_auto_recovery_complete_event(handle);
 	LEAVE();
 }
 #else
@@ -934,9 +1084,18 @@
 		 * Note. FW might not be healthy.
 		 */
 		handle->surprise_removed = MTRUE;
+		handle->fw_reseting = MTRUE;
+		// TODO: Can add more chips once the related code has been
+		// ported to fw v18
+		if (IS_PCIE9097(handle->card_type) ||
+		    IS_PCIE9098(handle->card_type) ||
+		    IS_PCIEAW693(handle->card_type)) {
+			woal_reset_adma(handle);
+		}
 		woal_do_flr(handle, prepare, true);
 		if (ref_handle) {
 			ref_handle->surprise_removed = MTRUE;
+			ref_handle->fw_reseting = MTRUE;
 			woal_do_flr(ref_handle, prepare, true);
 		}
 	} else {
@@ -946,11 +1105,19 @@
 		 * Reconfigure the sw and fw including fw redownload
 		 */
 		handle->surprise_removed = MFALSE;
-		woal_do_flr(handle, prepare, true);
+		if (MLAN_STATUS_SUCCESS == woal_do_flr(handle, prepare, true))
+			handle->fw_reseting = MFALSE;
+		else
+			handle = NULL;
 		if (ref_handle) {
 			ref_handle->surprise_removed = MFALSE;
-			woal_do_flr(ref_handle, prepare, true);
+			if (MLAN_STATUS_SUCCESS ==
+			    woal_do_flr(ref_handle, prepare, true))
+				ref_handle->fw_reseting = MFALSE;
 		}
+		wifi_status = WIFI_STATUS_OK;
+		if (handle)
+			woal_send_auto_recovery_complete_event(handle);
 	}
 	LEAVE();
 }
@@ -1006,6 +1173,7 @@
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 
 	iowrite32(data, card->pci_mmap1 + reg);
+	PRINTM(MREG, "pcie w %x = %x\n", reg, data);
 
 	return MLAN_STATUS_SUCCESS;
 }
@@ -1024,6 +1192,7 @@
 {
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 	*data = ioread32(card->pci_mmap1 + reg);
+	PRINTM(MREG, "pcie r %x = %x\n", reg, *data);
 
 	if (*data == MLAN_STATUS_FAILURE)
 		return MLAN_STATUS_FAILURE;
@@ -1093,9 +1262,12 @@
 		goto exit;
 	}
 	handle = card->handle;
-	if (handle->surprise_removed == MTRUE) {
-		ret = MLAN_STATUS_FAILURE;
-		goto exit;
+	/* No need to handle Interrupt during FW reload, we can safely return
+	 * success to Kernel */
+	if (handle->surprise_removed == MTRUE && handle->fw_reseting) {
+		PRINTM(MINFO, "*** SKIP INTR handling during FW reload ***\n");
+		ret = MLAN_STATUS_SUCCESS;
+		return IRQ_HANDLED;
 	}
 	PRINTM(MINFO, "*** IN PCIE IRQ ***\n");
 	handle->main_state = MOAL_RECV_INT;
@@ -1103,13 +1275,10 @@
 		PRINTM(MINTR, "**\n");
 	else
 		PRINTM(MINTR, "*\n");
-
-	ret = mlan_interrupt(0xffff, handle->pmlan_adapter);
 	if (handle->is_suspended) {
-		PRINTM(MINTR, "Receive interrupt in hs_suspended\n");
-		goto exit;
+		PRINTM(MERROR, "Receive interrupt in hs_suspended\n");
 	}
-	queue_work(handle->workqueue, &handle->main_work);
+	ret = mlan_interrupt(0xffff, handle->pmlan_adapter);
 
 exit:
 	if (ret == MLAN_STATUS_SUCCESS)
@@ -1119,60 +1288,6 @@
 }
 
 /**
- *  @brief This function handles the MSI-X interrupt.
- *
- *  @param irq	    The irq no. of PCIE device
- *  @param dev_id   A pointer to the msix_context structure
- *
- *  @return         IRQ_HANDLED
- */
-static irqreturn_t woal_pcie_msix_interrupt(int irq, void *dev_id)
-{
-	struct pci_dev *pdev;
-	pcie_service_card *card;
-	moal_handle *handle;
-	msix_context *ctx = (msix_context *)dev_id;
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-
-	if (!ctx) {
-		PRINTM(MFATAL, "%s: ctx=%p is NULL\n", __func__, ctx);
-		goto exit;
-	}
-
-	pdev = ctx->dev;
-
-	if (!pdev) {
-		PRINTM(MFATAL, "%s: pdev is NULL\n", (t_u8 *)pdev);
-		goto exit;
-	}
-
-	card = (pcie_service_card *)pci_get_drvdata(pdev);
-	if (!card || !card->handle) {
-		PRINTM(MFATAL, "%s: card=%p handle=%p\n", __func__, card,
-		       card ? card->handle : NULL);
-		goto exit;
-	}
-	handle = card->handle;
-	if (handle->surprise_removed == MTRUE) {
-		ret = MLAN_STATUS_FAILURE;
-		goto exit;
-	}
-	PRINTM(MINFO, "*** IN PCIE IRQ ***\n");
-	handle->main_state = MOAL_RECV_INT;
-	if (handle->second_mac)
-		PRINTM(MINTR, "**\n");
-	else
-		PRINTM(MINTR, "*\n");
-	ret = mlan_interrupt(ctx->msg_id, handle->pmlan_adapter);
-	queue_work(handle->workqueue, &handle->main_work);
-
-exit:
-	if (ret == MLAN_STATUS_SUCCESS)
-		return IRQ_HANDLED;
-	else
-		return IRQ_NONE;
-}
-/**
  *  @brief This function pre-initializes the PCI-E host
  *  memory space, etc.
  *
@@ -1324,8 +1439,6 @@
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pcie_service_card *card = NULL;
 	struct pci_dev *pdev = NULL;
-	unsigned char nvec;
-	unsigned char i, j;
 	ENTER();
 
 	if (!handle || !handle->card) {
@@ -1341,48 +1454,6 @@
 	card->handle = handle;
 
 	switch (pcie_int_mode) {
-	case PCIE_INT_MODE_MSIX:
-		pcie_int_mode = PCIE_INT_MODE_MSIX;
-		nvec = PCIE_NUM_MSIX_VECTORS;
-
-		for (i = 0; i < nvec; i++) {
-			card->msix_entries[i].entry = i;
-		}
-
-		/* Try to enable msix */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-		ret = pci_enable_msix_exact(pdev, card->msix_entries, nvec);
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31) */
-		ret = pci_enable_msix(pdev, card->msix_entries, nvec);
-#endif
-
-		if (ret == 0) {
-			for (i = 0; i < nvec; i++) {
-				card->msix_contexts[i].dev = pdev;
-				card->msix_contexts[i].msg_id = i;
-				ret = request_irq(card->msix_entries[i].vector,
-						  woal_pcie_msix_interrupt, 0,
-						  "mrvl_pcie_msix",
-						  &(card->msix_contexts[i]));
-
-				if (ret) {
-					PRINTM(MFATAL,
-					       "request_irq failed: ret=%d\n",
-					       ret);
-					for (j = 0; j < i; j++)
-						free_irq(card->msix_entries[j]
-								 .vector,
-							 &(card->msix_contexts
-								   [i]));
-					pci_disable_msix(pdev);
-					break;
-				}
-			}
-			if (i == nvec)
-				break;
-		}
-		// follow through
-
 		/* fall through */
 	case PCIE_INT_MODE_MSI:
 		pcie_int_mode = PCIE_INT_MODE_MSI;
@@ -1420,8 +1491,9 @@
 		break;
 	}
 
-#ifdef PCIE9098
-	if (card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1)
+#if defined(PCIE9098) || defined(PCIEAW693)
+	if ((card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1) ||
+	    (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN1))
 		mlan_set_int_mode(handle->pmlan_adapter, pcie_int_mode, 1);
 	else
 #endif
@@ -1470,8 +1542,6 @@
 	pcie_service_card *card =
 		handle ? (pcie_service_card *)handle->card : NULL;
 	struct pci_dev *pdev = NULL;
-	unsigned char i;
-	unsigned char nvec;
 	ENTER();
 
 	if (card) {
@@ -1479,20 +1549,6 @@
 		PRINTM(MINFO, "%s(): calling free_irq()\n", __func__);
 
 		switch (pcie_int_mode) {
-		case PCIE_INT_MODE_MSIX:
-			nvec = PCIE_NUM_MSIX_VECTORS;
-
-			for (i = 0; i < nvec; i++)
-				synchronize_irq(card->msix_entries[i].vector);
-
-			for (i = 0; i < nvec; i++)
-				free_irq(card->msix_entries[i].vector,
-					 &(card->msix_contexts[i]));
-
-			pci_disable_msix(pdev);
-
-			break;
-
 		case PCIE_INT_MODE_MSI:
 			free_irq(card->dev->irq, pdev);
 			pci_disable_msi(pdev);
@@ -1547,7 +1603,8 @@
 	LEAVE();
 }
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 #define PCIE9098_DUMP_CTRL_REG 0x1C94
 #define PCIE9098_DUMP_START_REG 0x1C98
 #define PCIE9098_DUMP_END_REG 0x1C9F
@@ -1558,7 +1615,8 @@
 #define DEBUG_DUMP_END_REG 0xCFF
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 #define PCIE9098_SCRATCH_12_REG 0x1C90
 #define PCIE9098_SCRATCH_14_REG 0x1C98
 #define PCIE9098_SCRATCH_15_REG 0x1C9C
@@ -1594,7 +1652,8 @@
 	t_u32 dump_end_reg = 0;
 	t_u32 scratch_14_reg = 0;
 	t_u32 scratch_15_reg = 0;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	/* Tx/Rx/Event AMDA start address */
 	t_u32 adma_reg_table[] = {0x10000, 0x10800, 0x10880, 0x11000, 0x11080};
 	t_u8 j;
@@ -1609,6 +1668,18 @@
 		drv_ptr += sprintf(drv_ptr, "reg:0x%02x value=0x%08x\n",
 				   config_reg_table[i], value);
 	}
+
+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		woal_pcie_read_reg(phandle, reg, &value);
+		value = (value & 0xff00) >> 8;
+		if (value) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", value);
+			drv_ptr += sprintf(drv_ptr, "FW in debug mode (0x%x)\n",
+					   value);
+		}
+	}
+
 	drv_ptr += sprintf(drv_ptr, "FW Scrach Registers:\n");
 
 #if defined(PCIE8897) || defined(PCIE8997)
@@ -1622,9 +1693,11 @@
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		reg = PCIE9098_SCRATCH_12_REG;
 		dump_start_reg = PCIE9098_DUMP_REG_START;
@@ -1666,9 +1739,11 @@
 		}
 		i++;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		drv_ptr += sprintf(
 			drv_ptr,
@@ -1689,7 +1764,8 @@
 		drv_ptr += sprintf(drv_ptr, "%s\n", buf);
 	}
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		drv_ptr += sprintf(drv_ptr,
 				   "ADMA Tx/Rx/Event/Cmd/CmdResp registers:\n");
@@ -1743,7 +1819,8 @@
 	t_u32 dump_end_reg = 0;
 	t_u32 scratch_14_reg = 0;
 	t_u32 scratch_15_reg = 0;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	/* Tx/Rx/Event AMDA start address */
 	t_u32 adma_reg_table[] = {0x10000, 0x10800, 0x10880, 0x11000, 0x11080};
 	t_u8 j;
@@ -1755,6 +1832,16 @@
 		PRINTM(MERROR, "reg:0x%02x value=0x%08x\n", config_reg_table[i],
 		       value);
 	}
+
+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		woal_pcie_read_reg(phandle, reg, &value);
+		value = (value & 0xff00) >> 8;
+		if (value) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", value);
+		}
+	}
+
 	PRINTM(MMSG, "FW Scrach Registers:\n");
 #if defined(PCIE8897) || defined(PCIE8997)
 	if (IS_PCIE8897(phandle->card_type) ||
@@ -1767,9 +1854,11 @@
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		reg = PCIE9098_SCRATCH_12_REG;
 		dump_start_reg = PCIE9098_DUMP_START_REG;
@@ -1806,9 +1895,11 @@
 		}
 		i++;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		PRINTM(MMSG, "PCIE registers from offset 0x1c20 to 0x1c9c:\n");
 		memset(buf, 0, sizeof(buf));
@@ -1827,7 +1918,8 @@
 		PRINTM(MMSG, "%s\n", buf);
 	}
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		PRINTM(MMSG, "ADMA Tx/Rx/Event/Cmd/CmdResp registers:\n");
 		for (j = 0; j < ARRAY_SIZE(adma_reg_table); j++) {
@@ -1895,7 +1987,7 @@
 #endif
 
 #if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
+	defined(PCIEAW693) || defined(PCIEIW624)
 #define DEBUG_HOST_READY_8997 0xCC
 #define DEBUG_HOST_EVENT_READY 0xAA
 #define DEBUG_HOST_RESET_READY 0x99
@@ -1905,7 +1997,7 @@
 #endif
 
 #if defined(PCIE8897) || defined(PCIE8997) || defined(PCIE9098) ||             \
-	defined(PCIE9097) || defined(PCIENW62X)
+	defined(PCIE9097) || defined(PCIEAW693) || defined(PCIEIW624)
 /**
  *  @brief This function reads data by 8 bit from card register
  *
@@ -1955,9 +2047,11 @@
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		if (phandle->event_fw_dump)
 			debug_host_ready = DEBUG_HOST_EVENT_READY;
@@ -1975,9 +2069,11 @@
 		       dump_ctrl_reg, debug_host_ready);
 		return RDWR_STATUS_FAILURE;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		if (phandle->event_fw_dump || resetflag)
 			return RDWR_STATUS_SUCCESS;
@@ -2049,6 +2145,9 @@
 	t_u8 read_reg = 0;
 	t_u32 memory_size = 0;
 	t_u32 memdump_finsh = 0;
+#ifndef DUMP_TO_PROC
+	t_u8 path_name[64], file_name[32], firmware_dump_file[128];
+#endif
 	t_u8 *end_ptr = NULL;
 	memory_type_mapping *mem_type_mapping_tbl = mem_type_mapping_tbl_8897;
 
@@ -2056,6 +2155,7 @@
 		PRINTM(MERROR, "Could not dump firmwware info\n");
 		return;
 	}
+#ifdef DUMP_TO_PROC
 	if (!phandle->fw_dump_buf) {
 		ret = moal_vmalloc(phandle, FW_DUMP_INFO_LEN,
 				   &(phandle->fw_dump_buf));
@@ -2067,6 +2167,18 @@
 		memset(phandle->fw_dump_buf, 0x00, FW_DUMP_INFO_LEN);
 	}
 	phandle->fw_dump_len = 0;
+#else
+	memdump_finsh = DEBUG_MEMDUMP_FINISH_8897;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+	/** Create dump directory*/
+	woal_create_dump_dir(phandle, path_name, sizeof(path_name));
+#else
+	memset(path_name, 0, sizeof(path_name));
+	strcpy(path_name, "/data");
+#endif
+	PRINTM(MMSG, "Directory name is %s\n", path_name);
+	woal_dump_drv_info(phandle, path_name);
+#endif
 	/* start dump fw memory	*/
 	moal_get_system_time(phandle, &sec, &usec);
 	PRINTM(MMSG, "====PCIE DEBUG MODE OUTPUT START: %u.%06u ====\n", sec,
@@ -2156,11 +2268,25 @@
 				       (unsigned int)(dbg_ptr -
 						      mem_type_mapping_tbl[idx]
 							      .mem_Ptr));
+#ifdef DUMP_TO_PROC
 				woal_save_dump_info_to_buf(
 					phandle,
 					mem_type_mapping_tbl[idx].mem_Ptr,
 					memory_size,
 					mem_type_mapping_tbl[idx].type);
+#else
+				memset(file_name, 0, sizeof(file_name));
+				sprintf(file_name, "%s%s", "file_pcie_",
+					mem_type_mapping_tbl[idx].mem_name);
+				if (MLAN_STATUS_SUCCESS !=
+				    woal_save_dump_info_to_file(
+					    path_name, file_name,
+					    mem_type_mapping_tbl[idx].mem_Ptr,
+					    memory_size))
+					PRINTM(MMSG,
+					       "Can't save dump file %s in %s\n",
+					       file_name, path_name);
+#endif
 				moal_vfree(phandle,
 					   mem_type_mapping_tbl[idx].mem_Ptr);
 				mem_type_mapping_tbl[idx].mem_Ptr = NULL;
@@ -2168,11 +2294,20 @@
 			}
 		} while (1);
 	}
+#ifdef DUMP_TO_PROC
 	woal_append_end_block(phandle);
+#endif
 	moal_get_system_time(phandle, &sec, &usec);
 	PRINTM(MMSG, "====PCIE DEBUG MODE OUTPUT END: %u.%06u ====\n", sec,
 	       usec);
 	/* end dump fw memory */
+#ifndef DUMP_TO_PROC
+	memset(firmware_dump_file, 0, sizeof(firmware_dump_file));
+	sprintf(firmware_dump_file, "%s/%s", path_name, file_name);
+	moal_memcpy_ext(phandle, phandle->firmware_dump_file,
+			firmware_dump_file, sizeof(firmware_dump_file),
+			sizeof(phandle->firmware_dump_file));
+#endif
 done:
 	for (idx = 0;
 	     idx < dump_num && idx < ARRAY_SIZE(mem_type_mapping_tbl_8897);
@@ -2188,7 +2323,7 @@
 #endif
 
 #if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
+	defined(PCIEAW693) || defined(PCIEIW624)
 /**
  *  @brief This function dump firmware memory to file
  *
@@ -2207,6 +2342,10 @@
 	t_u8 doneflag = 0;
 	rdwr_status stat;
 	t_u32 memory_size = 0;
+#ifndef DUMP_TO_PROC
+	t_u8 path_name[64], file_name[32], firmware_dump_file[128];
+	moal_handle *ref_handle;
+#endif
 	t_u8 *end_ptr = NULL;
 	memory_type_mapping *mem_type_mapping_tbl = &mem_type_mapping_tbl_8997;
 	t_u32 dump_start_reg = 0;
@@ -2216,9 +2355,11 @@
 		PRINTM(MERROR, "Could not dump firmwware info\n");
 		return;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		if (phandle->event_fw_dump) {
 			if (RDWR_STATUS_FAILURE !=
@@ -2230,6 +2371,20 @@
 		}
 	}
 #endif
+#ifndef DUMP_TO_PROC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+	/** Create dump directory*/
+	woal_create_dump_dir(phandle, path_name, sizeof(path_name));
+#else
+	memset(path_name, 0, sizeof(path_name));
+	strcpy(path_name, "/data");
+#endif
+	PRINTM(MMSG, "Create DUMP directory success:dir_name=%s\n", path_name);
+	ref_handle = (moal_handle *)phandle->pref_mac;
+	if (ref_handle)
+		woal_dump_drv_info(ref_handle, path_name);
+	woal_dump_drv_info(phandle, path_name);
+#endif
 
 	/* start dump fw memory	*/
 	moal_get_system_time(phandle, &sec, &usec);
@@ -2239,9 +2394,11 @@
 	if (RDWR_STATUS_FAILURE ==
 	    woal_pcie_rdwr_firmware(phandle, doneflag, 0))
 		goto done;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEAW693) ||            \
+	defined(PCIEIW624)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		dump_start_reg = PCIE9098_DUMP_START_REG;
 		dump_end_reg = PCIE9098_DUMP_END_REG;
@@ -2329,6 +2486,7 @@
 			       mem_type_mapping_tbl->mem_name,
 			       dbg_ptr - mem_type_mapping_tbl->mem_Ptr);
 #endif
+#ifdef DUMP_TO_PROC
 			if (phandle->fw_dump_buf) {
 				moal_vfree(phandle, phandle->fw_dump_buf);
 				phandle->fw_dump_buf = NULL;
@@ -2338,6 +2496,20 @@
 			phandle->fw_dump_len =
 				dbg_ptr - mem_type_mapping_tbl->mem_Ptr;
 			mem_type_mapping_tbl->mem_Ptr = NULL;
+#else
+			memset(file_name, 0, sizeof(file_name));
+			sprintf(file_name, "%s%s", "file_pcie_",
+				mem_type_mapping_tbl->mem_name);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_save_dump_info_to_file(
+				    path_name, file_name,
+				    mem_type_mapping_tbl->mem_Ptr,
+				    dbg_ptr - mem_type_mapping_tbl->mem_Ptr))
+				PRINTM(MMSG, "Can't save dump file %s in %s\n",
+				       file_name, path_name);
+			moal_vfree(phandle, mem_type_mapping_tbl->mem_Ptr);
+			mem_type_mapping_tbl->mem_Ptr = NULL;
+#endif
 			break;
 		}
 	} while (1);
@@ -2345,6 +2517,13 @@
 	PRINTM(MMSG, "====PCIE DEBUG MODE OUTPUT END: %u.%06u ====\n", sec,
 	       usec);
 	/* end dump fw memory */
+#ifndef DUMP_TO_PROC
+	memset(firmware_dump_file, 0, sizeof(firmware_dump_file));
+	sprintf(firmware_dump_file, "%s/%s", path_name, file_name);
+	moal_memcpy_ext(phandle, phandle->firmware_dump_file,
+			firmware_dump_file, sizeof(firmware_dump_file),
+			sizeof(phandle->firmware_dump_file));
+#endif
 done:
 	if (mem_type_mapping_tbl->mem_Ptr) {
 		moal_vfree(phandle, mem_type_mapping_tbl->mem_Ptr);
@@ -2364,9 +2543,10 @@
  */
 static t_u8 woal_pcie_is_second_mac(moal_handle *handle)
 {
-#ifdef PCIE9098
+#if defined(PCIE9098) || defined(PCIEAW693)
 	pcie_service_card *card = (pcie_service_card *)handle->card;
-	if (card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1)
+	if ((card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1) ||
+	    (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN1))
 		return MTRUE;
 #endif
 	return MFALSE;
@@ -2374,6 +2554,15 @@
 
 static void woal_pcie_dump_fw_info(moal_handle *phandle)
 {
+	moal_private *priv = NULL;
+#ifdef DUMP_TO_PROC
+	if (phandle->fw_dump_buf) {
+		PRINTM(MMSG, "FW dump already exist, free existing dump\n");
+		moal_vfree(phandle, phandle->fw_dump_buf);
+		phandle->fw_dump_buf = NULL;
+		phandle->fw_dump_len = 0;
+	}
+#endif
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
 	phandle->fw_dump = MTRUE;
 #ifdef PCIE8897
@@ -2381,14 +2570,14 @@
 		woal_pcie_dump_fw_info_v1(phandle);
 #endif
 #if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
+	defined(PCIEAW693) || defined(PCIEIW624)
 	if (IS_PCIE8997(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
+	    IS_PCIEIW624(phandle->card_type) ||
 	    IS_PCIE9098(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		woal_pcie_dump_fw_info_v2(phandle);
 		if (phandle->event_fw_dump) {
-			phandle->event_fw_dump = MFALSE;
 			queue_work(phandle->workqueue, &phandle->main_work);
 			phandle->is_fw_dump_timer_set = MTRUE;
 			woal_mod_timer(&phandle->fw_dump_timer, MOAL_TIMER_5S);
@@ -2399,37 +2588,55 @@
 	phandle->fw_dump = MFALSE;
 	if (!phandle->priv_num)
 		return;
-	woal_send_fw_dump_complete_event(
-		woal_get_priv(phandle, MLAN_BSS_ROLE_ANY));
+	priv = woal_get_priv(phandle, MLAN_BSS_ROLE_ANY);
+	if (priv == NULL) {
+		return;
+	}
+	woal_send_fw_dump_complete_event(priv);
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
 	queue_work(phandle->workqueue, &phandle->main_work);
 	woal_process_hang(phandle);
 }
 
+/**
+ *  @brief This function get fw name
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @return         MLAN_STATUS_SUCCESS
+ *
+ */
 static mlan_status woal_pcie_get_fw_name(moal_handle *handle)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-#ifdef PCIE9098
+#if defined(PCIE9098) || defined(PCIEAW693)
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 	moal_handle *ref_handle = NULL;
 #endif
 
 #if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
+	defined(PCIEAW693) || defined(PCIEIW624)
 	t_u32 rev_id_reg = handle->card_info->rev_id_reg;
 	t_u32 revision_id = 0;
 #endif
 
 #if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
+	defined(PCIEAW693) || defined(PCIEIW624)
 	t_u32 host_strap_reg = handle->card_info->host_strap_reg;
 	t_u32 magic_reg = handle->card_info->magic_reg;
 	t_u32 strap = 0;
 	t_u32 magic = 0;
 #endif
+#if defined(PCIEIW624) || defined(PCIEAW693)
+	t_u32 boot_mode_reg = handle->card_info->boot_mode_reg;
+	t_u32 boot_mode;
+#endif
+	t_u32 value = 0;
 
 	ENTER();
 
+	/* Make sure device is awake before reading host interface registers */
+	woal_pcie_read_reg(handle, handle->card_info->fw_wakeup_reg, &value);
+
 	if (handle->params.fw_name) {
 #ifdef PCIE9097
 		if (IS_PCIE9097(handle->card_type)) {
@@ -2448,6 +2655,21 @@
 			}
 		}
 #endif
+#ifdef PCIEAW693
+		if (IS_PCIEAW693(handle->card_type)) {
+			woal_pcie_read_reg(handle, rev_id_reg, &revision_id);
+			revision_id &= 0xff;
+			PRINTM(MCMND, "revision_id=0x%x\n", revision_id);
+			switch (revision_id) {
+			case PCIEAW693_A1:
+				handle->card_rev = CHIP_AW693_REV_A1;
+				break;
+			default:
+				handle->card_rev = CHIP_AW693_REV_A0;
+				break;
+			}
+		}
+#endif
 		goto done;
 	}
 
@@ -2579,23 +2801,134 @@
 		}
 	}
 #endif
-#ifdef PCIENW62X
-	if (IS_PCIENW62X(handle->card_type)) {
+#ifdef PCIEAW693
+	if (IS_PCIEAW693(handle->card_type)) {
+		if (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN0) {
+			woal_pcie_read_reg(handle, rev_id_reg, &revision_id);
+			woal_pcie_read_reg(handle, host_strap_reg, &strap);
+			woal_pcie_read_reg(handle, magic_reg, &magic);
+			woal_pcie_read_reg(handle, boot_mode_reg, &boot_mode);
+			revision_id &= 0xff;
+			strap &= 0x7;
+			magic &= 0xff;
+			boot_mode &= 0x03;
+			PRINTM(MCMND,
+			       "magic=0x%x, boot_mode=0x%x, strap=0x%x, revision_id=0x%x\n",
+			       magic, boot_mode, strap, revision_id);
+			if (boot_mode == 0x03)
+				PRINTM(MMSG,
+				       "wlan: PCIE-AW693 in secure-boot mode\n");
+
+			switch (revision_id) {
+			case PCIEAW693_A1:
+				handle->card_rev = CHIP_AW693_REV_A1;
+				if (magic == CHIP_MAGIC_VALUE) {
+					if (strap == CARD_TYPE_PCIE_UART)
+						strcpy(handle->card_info
+							       ->fw_name,
+						       PCIEUARTAW693_COMBO_V1_FW_NAME);
+					else
+						strcpy(handle->card_info
+							       ->fw_name,
+						       PCIEAW693_COMBO_V1_FW_NAME);
+				}
+				strcpy(handle->card_info->fw_name_wlan,
+				       PCIEAW693_WLAN_V1_FW_NAME);
+				if (boot_mode != 0x03) {
+					/* remove extension .se */
+					if (strstr(handle->card_info->fw_name,
+						   ".se"))
+						memset(strstr(handle->card_info
+								      ->fw_name,
+							      ".se"),
+						       '\0', sizeof(".se"));
+					if (strstr(handle->card_info
+							   ->fw_name_wlan,
+						   ".se"))
+						memset(strstr(handle->card_info
+								      ->fw_name_wlan,
+							      ".se"),
+						       '\0', sizeof(".se"));
+				}
+				break;
+			case PCIEAW693_A0:
+				handle->card_rev = CHIP_AW693_REV_A0;
+				if (magic == CHIP_MAGIC_VALUE) {
+					if (strap == CARD_TYPE_PCIE_UART)
+						strcpy(handle->card_info
+							       ->fw_name,
+						       PCIEUARTAW693_DEFAULT_COMBO_FW_NAME);
+					else
+						strcpy(handle->card_info
+							       ->fw_name,
+						       PCIEAW693_DEFAULT_COMBO_FW_NAME);
+				}
+				strcpy(handle->card_info->fw_name_wlan,
+				       PCIEAW693_DEFAULT_WLAN_FW_NAME);
+				break;
+			default:
+				break;
+			}
+		} else {
+			ref_handle = (moal_handle *)handle->pref_mac;
+			if (ref_handle) {
+				woal_pcie_read_reg(handle, rev_id_reg,
+						   &revision_id);
+				revision_id &= 0xff;
+				PRINTM(MCMND, "revision_id=0x%x\n",
+				       revision_id);
+				switch (revision_id) {
+				case PCIEAW693_A1:
+					handle->card_rev = CHIP_AW693_REV_A1;
+					break;
+				default:
+					handle->card_rev = CHIP_AW693_REV_A0;
+					break;
+				}
+				strcpy(handle->card_info->fw_name,
+				       ref_handle->card_info->fw_name);
+				strcpy(handle->card_info->fw_name_wlan,
+				       ref_handle->card_info->fw_name_wlan);
+			}
+		}
+	}
+#endif
+#ifdef PCIEIW624
+	if (IS_PCIEIW624(handle->card_type)) {
 		woal_pcie_read_reg(handle, rev_id_reg, &revision_id);
 		woal_pcie_read_reg(handle, host_strap_reg, &strap);
 		woal_pcie_read_reg(handle, magic_reg, &magic);
+		woal_pcie_read_reg(handle, boot_mode_reg, &boot_mode);
 		revision_id &= 0xff;
 		strap &= 0x7;
 		magic &= 0xff;
-		PRINTM(MCMND, "magic=0x%x, strap=0x%x, revision_id=0x%x\n",
-		       magic, strap, revision_id);
-		if (magic == CHIP_MAGIC_VALUE) {
-			if (strap == CARD_TYPE_PCIE_UART)
+		boot_mode &= 0x03;
+		PRINTM(MCMND,
+		       "magic=0x%x boot_mode=0x%x, strap=0x%x, revision_id=0x%x\n",
+		       magic, boot_mode, strap, revision_id);
+		if (boot_mode == 0x03)
+			PRINTM(MMSG, "wlan: PCIE-IW624 in secure-boot mode\n");
+		if (strap == CARD_TYPE_PCIEIW624_UARTUART) {
+			if (handle->params.dual_nb)
 				strcpy(handle->card_info->fw_name,
-				       PCIEUARTNW62X_DEFAULT_COMBO_FW_NAME);
+				       PCIEUARTUARTIW624_DEFAULT_COMBO_FW_NAME);
 			else
 				strcpy(handle->card_info->fw_name,
-				       PCIEUSBNW62X_DEFAULT_COMBO_FW_NAME);
+				       PCIEUARTIW624_DEFAULT_COMBO_FW_NAME);
+		} else if (strap == CARD_TYPE_PCIEIW624_UARTSPI) {
+			if (handle->params.dual_nb)
+				strcpy(handle->card_info->fw_name,
+				       PCIEUARTSPIIW624_DEFAULT_COMBO_FW_NAME);
+			else
+				strcpy(handle->card_info->fw_name,
+				       PCIEUARTIW624_DEFAULT_COMBO_FW_NAME);
+		} else {
+			if (handle->params.dual_nb)
+				strcpy(handle->card_info->fw_name,
+				       PCIEUSBUSBIW624_DEFAULT_COMBO_FW_NAME);
+			else
+				strcpy(handle->card_info->fw_name,
+				       PCIEUSBIW624_DEFAULT_COMBO_FW_NAME);
 		}
 	}
 #endif
@@ -2606,6 +2939,141 @@
 	return ret;
 }
 
+/**
+ *  @brief This function trigger in-band reset to FW
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @return         0 or failure
+ *
+ */
+static int woal_pcie_reset_fw(moal_handle *handle)
+{
+	int ret = 0, tries = 0;
+	t_u32 value = 1;
+	t_u32 reset_reg = handle->card_info->fw_reset_reg;
+	t_u8 reset_val = handle->card_info->fw_reset_val;
+
+	ENTER();
+	if (IS_PCIE8897(handle->card_type)) {
+		PRINTM(MERROR, "PCIE8897 don't support PCIE in-band reset\n");
+		LEAVE();
+		return -EFAULT;
+	}
+	woal_pcie_read_reg(handle, handle->card_info->fw_wakeup_reg, &value);
+	udelay(100);
+
+	/* Write register to notify FW */
+	if (woal_pcie_write_reg(handle, reset_reg, reset_val) !=
+	    MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to write reregister.\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	/* Poll register around 100 ms */
+	for (tries = 0; tries < MAX_POLL_TRIES; ++tries) {
+		woal_pcie_read_reg(handle, reset_reg, &value);
+		if (value == 0)
+			/* FW is ready */
+			break;
+		udelay(1000);
+	}
+
+	if (value) {
+		PRINTM(MERROR, "Failed to poll FW reset register %X=0x%x\n",
+		       reset_reg, value);
+		ret = -EFAULT;
+		goto done;
+	}
+
+	PRINTM(MMSG, "PCIE Trigger FW In-band Reset success.");
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function handle the pcie work
+ *
+ *  @param WORK   A pointer to work_struct
+ *  @return         N/A
+ *
+ */
+static void woal_pcie_work(struct work_struct *work)
+{
+	pcie_service_card *card =
+		container_of(work, pcie_service_card, reset_work);
+	moal_handle *handle = NULL;
+	moal_handle *ref_handle = NULL;
+	PRINTM(MMSG, "========START IN-BAND RESET===========\n");
+	handle = card->handle;
+
+	// handle-> mac0 , ref_handle->second mac
+	if (handle->pref_mac) {
+		if (handle->second_mac) {
+			handle = (moal_handle *)handle->pref_mac;
+			ref_handle = (moal_handle *)handle->pref_mac;
+		} else {
+			ref_handle = (moal_handle *)handle->pref_mac;
+		}
+		if (ref_handle) {
+			ref_handle->surprise_removed = MTRUE;
+			woal_clean_up(ref_handle);
+			mlan_ioctl(ref_handle->pmlan_adapter, NULL);
+		}
+	}
+	handle->surprise_removed = MTRUE;
+	handle->fw_reseting = MTRUE;
+	// TODO: Can add more chips once the related code has been ported to fw
+	// v18
+	if (IS_PCIE9097(handle->card_type) || IS_PCIE9098(handle->card_type) ||
+	    IS_PCIEAW693(handle->card_type)) {
+		woal_reset_adma(handle);
+	}
+	woal_do_flr(handle, true, true);
+	if (ref_handle) {
+		ref_handle->surprise_removed = MTRUE;
+		ref_handle->fw_reseting = MTRUE;
+		woal_do_flr(ref_handle, true, true);
+	}
+	if (woal_pcie_reset_fw(handle)) {
+		PRINTM(MERROR, "PCIe In-band Reset Fail\n");
+		goto done;
+	}
+	handle->surprise_removed = MFALSE;
+	if (MLAN_STATUS_SUCCESS == woal_do_flr(handle, false, true))
+		handle->fw_reseting = MFALSE;
+	else
+		handle = NULL;
+	if (ref_handle) {
+		ref_handle->surprise_removed = MFALSE;
+		if (MLAN_STATUS_SUCCESS == woal_do_flr(ref_handle, false, true))
+			ref_handle->fw_reseting = MFALSE;
+	}
+	card->work_flags = MFALSE;
+done:
+	wifi_status = WIFI_STATUS_OK;
+	if (handle)
+		woal_send_auto_recovery_complete_event(handle);
+	PRINTM(MMSG, "========END IN-BAND RESET===========\n");
+	return;
+}
+
+/**
+ *  @brief This function start reset_work
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @return         MTRUE/MFALSE
+ *
+ */
+static void woal_pcie_card_reset(moal_handle *handle)
+{
+	pcie_service_card *card = (pcie_service_card *)handle->card;
+	if (!card->work_flags) {
+		card->work_flags = MTRUE;
+		schedule_work(&card->reset_work);
+	}
+}
+
 static moal_if_ops pcie_ops = {
 	.register_dev = woal_pcie_register_dev,
 	.unregister_dev = woal_pcie_unregister_dev,
@@ -2617,5 +3085,6 @@
 	.dump_fw_info = woal_pcie_dump_fw_info,
 	.reg_dbg = woal_pcie_reg_dbg,
 	.dump_reg_info = woal_pcie_dump_reg_info,
+	.card_reset = woal_pcie_card_reset,
 	.is_second_mac = woal_pcie_is_second_mac,
 };
diff --git a/wlan_src/mlinux/moal_pcie.h b/wlan_src/mlinux/moal_pcie.h
new file mode 100644
index 0000000..4aa689f
--- /dev/null
+++ b/wlan_src/mlinux/moal_pcie.h
@@ -0,0 +1,174 @@
+/** @file moal_pcie.h
+ *
+ *  @brief This file contains definitions for PCIE interface.
+ *  driver.
+ *
+ *
+ * Copyright 2008-2021, 2024 NXP
+ *
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
+ *
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ */
+
+/********************************************************
+Change log:
+    02/01/2012: initial version
+********************************************************/
+
+#ifndef _MOAL_PCIE_H_
+#define _MOAL_PCIE_H_
+
+#define PCIE_VENDOR_ID_MRVL (0x11ab)
+#define PCIE_VENDOR_ID_V2_MRVL (0x1b4b)
+#define PCIE_VENDOR_ID_NXP (0x1131)
+
+#ifdef PCIE8997
+/** PCIE device ID for 8997 card */
+#define PCIE_DEVICE_ID_88W8997P (0x2b42)
+#endif
+#ifdef PCIE8897
+/** PCIE device ID for 8897 card */
+#define PCIE_DEVICE_ID_88W8897P (0x2b38)
+#endif
+
+#ifdef PCIE9097
+/** PCIE device ID for 9097 card */
+#define PCIE_DEVICE_ID_88W9097 (0x2b56)
+#endif
+
+#if defined(PCIE9098) || defined(PCIEAW693)
+/** PCIE device ID for 9098 card FN0 */
+#define PCIE_DEVICE_ID_88W9098P_FN0 (0x2b43)
+/** PCIE device ID for 9098 card FN1 */
+#define PCIE_DEVICE_ID_88W9098P_FN1 (0x2b44)
+#endif
+
+#ifdef PCIEIW624
+/** PCIE device ID for IW624 card FN0 */
+#define PCIE_DEVICE_ID_88WIW624 (0x3000)
+#endif
+
+#if defined(PCIE9098) || defined(PCIEAW693)
+/** PCIE device ID for AW693 card FN0 */
+#define PCIE_DEVICE_ID_88WAW693_FN0 (0x3003)
+/** PCIE device ID for AW693 card FN1 */
+#define PCIE_DEVICE_ID_88WAW693_FN1 (0x3004)
+#endif
+
+#include <linux/version.h>
+#include <linux/pci.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
+#include <linux/pcieport_if.h>
+#endif
+#include <linux/interrupt.h>
+
+#include "moal_main.h"
+
+/** Default firmware name */
+#ifdef PCIE8997
+#define PCIE8997_DEFAULT_COMBO_FW_NAME "nxp/pcieusb8997_combo_v4.bin"
+#define PCIEUART8997_DEFAULT_COMBO_FW_NAME "nxp/pcieuart8997_combo_v4.bin"
+#define PCIEUSB8997_DEFAULT_COMBO_FW_NAME "nxp/pcieusb8997_combo_v4.bin"
+#define PCIE8997_DEFAULT_WLAN_FW_NAME "nxp/pcie8997_wlan_v4.bin"
+/** PCIE8997 chip revision ID */
+#define PCIE8997_A0 0x10
+#define PCIE8997_A1 0x11
+#endif /* PCIE8997 */
+
+#ifdef PCIE8897
+#define PCIE8897_DEFAULT_COMBO_FW_NAME "nxp/pcie8897_uapsta.bin"
+#define PCIE8897_DEFAULT_WLAN_FW_NAME "nxp/pcie8897_wlan.bin"
+#endif /* PCIE8897*/
+
+#ifdef PCIEAW693
+#define PCIEUARTAW693_DEFAULT_COMBO_FW_NAME "nxp/pcieuartaw693_combo.bin"
+#define PCIEAW693_DEFAULT_COMBO_FW_NAME "nxp/pcieuartaw693_combo.bin"
+#define PCIEUARTAW693_COMBO_V1_FW_NAME "nxp/pcieuartaw693_combo_v1.bin.se"
+#define PCIEAW693_COMBO_V1_FW_NAME "nxp/pcieuartaw693_combo_v1.bin.se"
+#define PCIEAW693_DEFAULT_WLAN_FW_NAME "nxp/pcieaw693_wlan.bin"
+#define PCIEAW693_WLAN_V1_FW_NAME "nxp/pcieaw693_wlan_v1.bin.se"
+#define PCIEAW693_A0 0x00
+#define PCIEAW693_A1 0x01
+#endif /* PCIEAW693*/
+
+#ifdef PCIE9098
+#define PCIE9098_Z1Z2 0x00
+#define PCIE9098_A0 0x01
+#define PCIE9098_A1 0x02
+#define PCIE9098_A2 0x03
+#define PCIE9098_DEFAULT_COMBO_FW_NAME "nxp/pcieusb9098_combo.bin"
+#define PCIEUART9098_DEFAULT_COMBO_FW_NAME "nxp/pcieuart9098_combo.bin"
+#define PCIEUSB9098_DEFAULT_COMBO_FW_NAME "nxp/pcieusb9098_combo.bin"
+#define PCIEPCIE9098_DEFAULT_COMBO_FW_NAME "nxp/pciepcie9098_combo.bin"
+#define PCIEUART9098_COMBO_V1_FW_NAME "nxp/pcieuart9098_combo_v1.bin"
+#define PCIEUSB9098_COMBO_V1_FW_NAME "nxp/pcieusb9098_combo_v1.bin"
+#define PCIEPCIE9098_COMBO_V1_FW_NAME "nxp/pciepcie9098_combo_v1.bin"
+#define PCIE9098_DEFAULT_WLAN_FW_NAME "nxp/pcie9098_wlan.bin"
+#define PCIE9098_WLAN_V1_FW_NAME "nxp/pcie9098_wlan_v1.bin"
+#endif /* PCIE9098 */
+
+#ifdef PCIE9097
+#define PCIE9097_A0 0x00
+#define PCIE9097_B0 0x01
+#define PCIE9097_B1 0x02
+#define PCIE9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw620_combo.bin"
+#define PCIEUART9097_DEFAULT_COMBO_FW_NAME "nxp/pcieuartiw620_combo.bin"
+#define PCIEUSB9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw620_combo.bin"
+#define PCIEUART9097_COMBO_V1_FW_NAME "nxp/pcieuartiw620_combo_v1.bin"
+#define PCIEUSB9097_COMBO_V1_FW_NAME "nxp/pcieusbiw620_combo_v1.bin"
+#define PCIE9097_DEFAULT_WLAN_FW_NAME "nxp/pcieiw620_wlan.bin"
+#define PCIE9097_WLAN_V1_FW_NAME "nxp/pcieiw620_wlan_v1.bin"
+#endif /* PCIE9097 */
+
+#ifdef PCIEIW624
+#define PCIEIW624_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw624_combo.bin"
+#define PCIEUARTIW624_DEFAULT_COMBO_FW_NAME "nxp/pcieuartiw624_combo.bin"
+#define PCIEUSBIW624_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw624_combo.bin"
+#define PCIEUARTUARTIW624_DEFAULT_COMBO_FW_NAME                                \
+	"nxp/pcieuartuartiw624_combo.bin"
+#define PCIEUARTSPIIW624_DEFAULT_COMBO_FW_NAME "nxp/pcieuartspiiw624_combo.bin"
+#define PCIEUSBUSBIW624_DEFAULT_COMBO_FW_NAME "nxp/pcieusbusbiw624_combo.bin"
+#define PCIEIW624_DEFAULT_WLAN_FW_NAME "nxp/pcieiw624_wlan.bin"
+#endif /* PCIEIW624 */
+
+/** Structure: PCIE service card */
+typedef struct _pcie_service_card {
+	/** pci_dev structure pointer */
+	struct pci_dev *dev;
+	/** moal_handle structure pointer */
+	moal_handle *handle;
+	/** reset work*/
+	struct work_struct reset_work;
+	/** work flag */
+	t_u8 work_flags;
+	/** I/O memory regions pointer to the bus */
+	void __iomem *pci_mmap;
+	/** I/O memory regions pointer to the bus */
+	void __iomem *pci_mmap1;
+} pcie_service_card, *ppcie_service_card;
+
+/** Register to bus driver function */
+mlan_status woal_pcie_bus_register(void);
+/** Unregister from bus driver function */
+void woal_pcie_bus_unregister(void);
+
+#endif /* _MOAL_PCIE_H_ */
diff --git a/wlan_sd8987/mlinux/moal_priv.c b/wlan_src/mlinux/moal_priv.c
old mode 100755
new mode 100644
similarity index 92%
rename from wlan_sd8987/mlinux/moal_priv.c
rename to wlan_src/mlinux/moal_priv.c
index fdab5cd..cf456f1
--- a/wlan_sd8987/mlinux/moal_priv.c
+++ b/wlan_src/mlinux/moal_priv.c
@@ -3,20 +3,28 @@
  * @brief This file contains standard ioctl functions
  *
  *
- * Copyright 2008-2021 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -61,14 +69,6 @@
 	BAND_A | BAND_AN | BAND_AAC,
 };
 
-/** Bands supported in Ad-Hoc mode */
-static t_u8 SupportedAdhocBand[] = {
-	BAND_B,
-	BAND_B | BAND_G,
-	BAND_G,
-	BAND_A,
-};
-
 /********************************************************
 			Local Functions
 ********************************************************/
@@ -83,7 +83,7 @@
  */
 static int woal_associate_ssid_bssid(moal_private *priv, struct iwreq *wrq)
 {
-	mlan_ssid_bssid ssid_bssid;
+	mlan_ssid_bssid *ssid_bssid = NULL;
 #ifdef REASSOCIATION
 	mlan_bss_info bss_info;
 #endif
@@ -94,7 +94,12 @@
 
 	ENTER();
 
-	memset(&ssid_bssid, 0, sizeof(ssid_bssid));
+	ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		LEAVE();
+		return -ENOMEM;
+	}
 	mac_idx = 0;
 	buflen = MIN(wrq->u.data.length, (sizeof(buf) - 1));
 	memset(buf, 0, sizeof(buf));
@@ -102,7 +107,7 @@
 	if (buflen < (3 * ETH_ALEN) + 2) {
 		PRINTM(MERROR,
 		       "Associate: Insufficient length in IOCTL input\n");
-
+		kfree(ssid_bssid);
 		/* buffer should be at least 3 characters per BSSID octet "00:"
 		**   plus a space separater and at least 1 char in the SSID
 		*/
@@ -113,6 +118,7 @@
 	if (copy_from_user(buf, wrq->u.data.pointer, buflen) != 0) {
 		/* copy_from_user failed  */
 		PRINTM(MERROR, "Associate: copy from user failed\n");
+		kfree(ssid_bssid);
 		LEAVE();
 		return -EINVAL;
 	}
@@ -127,7 +133,7 @@
 			mac_idx++;
 		} else {
 			if (mac_idx < ETH_ALEN)
-				ssid_bssid.bssid[mac_idx] =
+				ssid_bssid->bssid[mac_idx] =
 					(t_u8)woal_atox(buf + i);
 
 			while ((i < buflen) && (isxdigit(buf[i + 1]))) {
@@ -141,17 +147,18 @@
 	i++;
 
 	/* Copy the SSID */
-	ssid_bssid.ssid.ssid_len = buflen - i - 1;
-	moal_memcpy_ext(priv->phandle, ssid_bssid.ssid.ssid, buf + i,
-			sizeof(ssid_bssid.ssid.ssid),
-			sizeof(ssid_bssid.ssid.ssid));
+	ssid_bssid->ssid.ssid_len = buflen - i - 1;
+	moal_memcpy_ext(priv->phandle, ssid_bssid->ssid.ssid, buf + i,
+			sizeof(ssid_bssid->ssid.ssid),
+			sizeof(ssid_bssid->ssid.ssid));
 
 	PRINTM(MCMND, "iwpriv assoc: AP=[" MACSTR "], ssid(%d)=[%s]\n",
-	       MAC2STR(ssid_bssid.bssid), (int)ssid_bssid.ssid.ssid_len,
-	       ssid_bssid.ssid.ssid);
+	       MAC2STR(ssid_bssid->bssid), (int)ssid_bssid->ssid.ssid_len,
+	       ssid_bssid->ssid.ssid);
 
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_bss_start(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_bss_start(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
+		kfree(ssid_bssid);
 		LEAVE();
 		return -EFAULT;
 	}
@@ -168,7 +175,7 @@
 				sizeof(mlan_802_11_mac_addr));
 	}
 #endif /* REASSOCIATION */
-
+	kfree(ssid_bssid);
 	LEAVE();
 	return 0;
 }
@@ -515,7 +522,7 @@
  */
 static int woal_11n_htcap_cfg(moal_private *priv, struct iwreq *wrq)
 {
-	int data[2], copy_len;
+	int data[2] = {0}, copy_len;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
 	int ret = 0;
@@ -886,7 +893,7 @@
  */
 static int woal_addba_reject(moal_private *priv, struct iwreq *wrq)
 {
-	int data[MAX_NUM_TID], ret = 0, i, copy_len;
+	int data[MAX_NUM_TID] = {0}, ret = 0, i, copy_len;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
 	int data_length = wrq->u.data.length;
@@ -1160,7 +1167,9 @@
 	if (data_length && (data[0] != (int)HOST_SLEEP_CFG_CANCEL ||
 			    invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+			PRINTM(MINFO, "Fail to get bss_info\n");
 		if (bss_info.is_hs_configured) {
 			PRINTM(MERROR, "HS already configured\n");
 			ret = -EFAULT;
@@ -1170,8 +1179,11 @@
 
 	/* Do a GET first if some arguments are not provided */
 	if (data_length >= 1 && data_length < 3) {
-		woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
-				       &hscfg);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
+					   &hscfg)) {
+			PRINTM(MERROR, "Unable to get HS params\n");
+		}
 	}
 
 	if (data_length)
@@ -1455,11 +1467,9 @@
 {
 	int ret = 0;
 	unsigned int i;
-	int data[3];
+	int data[1];
 	int user_data_len = wrq->u.data.length, copy_len;
 	t_u32 infra_band = 0;
-	t_u32 adhoc_band = 0;
-	t_u32 adhoc_channel = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_radio_cfg *radio_cfg = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -1500,11 +1510,6 @@
 		}
 		/* Infra Band */
 		data[0] = radio_cfg->param.band_cfg.config_bands;
-		/* Adhoc Band */
-		data[1] = radio_cfg->param.band_cfg.adhoc_start_band;
-		/* Adhoc Channel */
-		data[2] = radio_cfg->param.band_cfg.adhoc_channel;
-		wrq->u.data.length = 3;
 
 		if (copy_to_user(wrq->u.data.pointer, data,
 				 sizeof(int) * wrq->u.data.length)) {
@@ -1528,33 +1533,9 @@
 			goto error;
 		}
 
-		/* Set Adhoc band */
-		if (user_data_len >= 2) {
-			adhoc_band = data[1];
-			for (i = 0; i < sizeof(SupportedAdhocBand); i++)
-				if (adhoc_band == SupportedAdhocBand[i])
-					break;
-			if (i == sizeof(SupportedAdhocBand)) {
-				ret = -EINVAL;
-				goto error;
-			}
-		}
-
-		/* Set Adhoc channel */
-		if (user_data_len >= 3) {
-			adhoc_channel = data[2];
-			if (adhoc_channel == 0) {
-				/* Check if specified adhoc channel is non-zero
-				 */
-				ret = -EINVAL;
-				goto error;
-			}
-		}
 		/* Set config_bands and adhoc_start_band values to MLAN */
 		req->action = MLAN_ACT_SET;
 		radio_cfg->param.band_cfg.config_bands = infra_band;
-		radio_cfg->param.band_cfg.adhoc_start_band = adhoc_band;
-		radio_cfg->param.band_cfg.adhoc_channel = adhoc_channel;
 		status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 		if (status != MLAN_STATUS_SUCCESS) {
 			ret = -EFAULT;
@@ -1963,130 +1944,144 @@
 	}
 
 	if (wrq->u.data.pointer) {
-		sprintf(buf,
-			"\n"
-			"mcasttxframe     %u\n"
-			"failed           %u\n"
-			"retry            %u\n"
-			"multiretry       %u\n"
-			"framedup         %u\n"
-			"rtssuccess       %u\n"
-			"rtsfailure       %u\n"
-			"ackfailure       %u\n"
-			"rxfrag           %u\n"
-			"mcastrxframe     %u\n"
-			"fcserror         %u\n"
-			"txframe          %u\n"
-			"wepicverrcnt-1   %u\n"
-			"wepicverrcnt-2   %u\n"
-			"wepicverrcnt-3   %u\n"
-			"wepicverrcnt-4   %u\n"
-			"beacon_rcnt      %u\n"
-			"beacon_mcnt      %u\n",
-			stats.mcast_tx_frame, stats.failed, stats.retry,
-			stats.multi_retry, stats.frame_dup, stats.rts_success,
-			stats.rts_failure, stats.ack_failure, stats.rx_frag,
-			stats.mcast_rx_frame, stats.fcs_error, stats.tx_frame,
-			stats.wep_icv_error[0], stats.wep_icv_error[1],
-			stats.wep_icv_error[2], stats.wep_icv_error[3],
-			stats.bcn_rcv_cnt, stats.bcn_miss_cnt);
+		snprintf(buf, GETLOG_BUFSIZE,
+			 "\n"
+			 "mcasttxframe     %u\n"
+			 "failed           %u\n"
+			 "retry            %u\n"
+			 "multiretry       %u\n"
+			 "framedup         %u\n"
+			 "rtssuccess       %u\n"
+			 "rtsfailure       %u\n"
+			 "ackfailure       %u\n"
+			 "rxfrag           %u\n"
+			 "mcastrxframe     %u\n"
+			 "fcserror         %u\n"
+			 "txframe          %u\n"
+			 "wepicverrcnt-1   %u\n"
+			 "wepicverrcnt-2   %u\n"
+			 "wepicverrcnt-3   %u\n"
+			 "wepicverrcnt-4   %u\n"
+			 "beacon_rcnt      %u\n"
+			 "beacon_mcnt      %u\n",
+			 stats.mcast_tx_frame, stats.failed, stats.retry,
+			 stats.multi_retry, stats.frame_dup, stats.rts_success,
+			 stats.rts_failure, stats.ack_failure, stats.rx_frag,
+			 stats.mcast_rx_frame, stats.fcs_error, stats.tx_frame,
+			 stats.wep_icv_error[0], stats.wep_icv_error[1],
+			 stats.wep_icv_error[2], stats.wep_icv_error[3],
+			 stats.bcn_rcv_cnt, stats.bcn_miss_cnt);
 		if (priv->phandle->fw_getlog_enable) {
-			sprintf(buf + strlen(buf), "tx_frag_cnt       %u\n",
-				stats.tx_frag_cnt);
-			sprintf(buf + strlen(buf), "qos_tx_frag_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "tx_frag_cnt       %u\n", stats.tx_frag_cnt);
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "qos_tx_frag_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_tx_frag_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_tx_frag_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_failed_cnt         ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_failed_cnt         ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_failed_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_failed_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_retry_cnt          ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_retry_cnt          ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_retry_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_retry_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_multi_retry_cnt    ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_multi_retry_cnt    ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_multi_retry_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_multi_retry_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_frm_dup_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_frm_dup_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_frm_dup_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_frm_dup_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_rts_suc_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_rts_suc_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_rts_suc_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_rts_suc_cnt[i]);
 			}
-			sprintf(buf + strlen(buf),
-				"\nqos_rts_failure_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_rts_failure_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_rts_failure_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_rts_failure_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_ack_failure_cnt    ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_ack_failure_cnt    ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_ack_failure_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_ack_failure_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_rx_frag_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_rx_frag_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_rx_frag_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_rx_frag_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_tx_frm_cnt         ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_tx_frm_cnt         ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_tx_frm_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_tx_frm_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_discarded_frm_cnt  ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_discarded_frm_cnt  ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_discarded_frm_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_discarded_frm_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_mpdus_rx_cnt       ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_mpdus_rx_cnt       ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_mpdus_rx_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_mpdus_rx_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_retries_rx_cnt     ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_retries_rx_cnt     ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_retries_rx_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_retries_rx_cnt[i]);
 			}
-			sprintf(buf + strlen(buf),
-				"\nmgmt_ccmp_replays      %u\n"
-				"tx_amsdu_cnt           %u\n"
-				"failed_amsdu_cnt       %u\n"
-				"retry_amsdu_cnt        %u\n"
-				"multi_retry_amsdu_cnt  %u\n"
-				"tx_octets_in_amsdu_cnt %llu\n"
-				"amsdu_ack_failure_cnt  %u\n"
-				"rx_amsdu_cnt           %u\n"
-				"rx_octets_in_amsdu_cnt %llu\n"
-				"tx_ampdu_cnt           %u\n"
-				"tx_mpdus_in_ampdu_cnt  %u\n"
-				"tx_octets_in_ampdu_cnt %llu\n"
-				"ampdu_rx_cnt           %u\n"
-				"mpdu_in_rx_ampdu_cnt   %u\n"
-				"rx_octets_in_ampdu_cnt %llu\n"
-				"ampdu_delimiter_crc_error_cnt      %u\n",
-				stats.mgmt_ccmp_replays, stats.tx_amsdu_cnt,
-				stats.failed_amsdu_cnt, stats.retry_amsdu_cnt,
-				stats.multi_retry_amsdu_cnt,
-				stats.tx_octets_in_amsdu_cnt,
-				stats.amsdu_ack_failure_cnt, stats.rx_amsdu_cnt,
-				stats.rx_octets_in_amsdu_cnt,
-				stats.tx_ampdu_cnt, stats.tx_mpdus_in_ampdu_cnt,
-				stats.tx_octets_in_ampdu_cnt,
-				stats.ampdu_rx_cnt, stats.mpdu_in_rx_ampdu_cnt,
-				stats.rx_octets_in_ampdu_cnt,
-				stats.ampdu_delimiter_crc_error_cnt);
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nmgmt_ccmp_replays      %u\n"
+				 "tx_amsdu_cnt           %u\n"
+				 "failed_amsdu_cnt       %u\n"
+				 "retry_amsdu_cnt        %u\n"
+				 "multi_retry_amsdu_cnt  %u\n"
+				 "tx_octets_in_amsdu_cnt %llu\n"
+				 "amsdu_ack_failure_cnt  %u\n"
+				 "rx_amsdu_cnt           %u\n"
+				 "rx_octets_in_amsdu_cnt %llu\n"
+				 "tx_ampdu_cnt           %u\n"
+				 "tx_mpdus_in_ampdu_cnt  %u\n"
+				 "tx_octets_in_ampdu_cnt %llu\n"
+				 "ampdu_rx_cnt           %u\n"
+				 "mpdu_in_rx_ampdu_cnt   %u\n"
+				 "rx_octets_in_ampdu_cnt %llu\n"
+				 "ampdu_delimiter_crc_error_cnt      %u\n",
+				 stats.mgmt_ccmp_replays, stats.tx_amsdu_cnt,
+				 stats.failed_amsdu_cnt, stats.retry_amsdu_cnt,
+				 stats.multi_retry_amsdu_cnt,
+				 stats.tx_octets_in_amsdu_cnt,
+				 stats.amsdu_ack_failure_cnt,
+				 stats.rx_amsdu_cnt,
+				 stats.rx_octets_in_amsdu_cnt,
+				 stats.tx_ampdu_cnt,
+				 stats.tx_mpdus_in_ampdu_cnt,
+				 stats.tx_octets_in_ampdu_cnt,
+				 stats.ampdu_rx_cnt, stats.mpdu_in_rx_ampdu_cnt,
+				 stats.rx_octets_in_ampdu_cnt,
+				 stats.ampdu_delimiter_crc_error_cnt);
 		}
 		wrq->u.data.length = MIN(GETLOG_BUFSIZE - 1, strlen(buf) + 1);
 		if (copy_to_user(wrq->u.data.pointer, buf,
@@ -2164,8 +2159,9 @@
 	ENTER();
 
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
-
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+		PRINTM(MINFO, "Fail to get bss_info\n");
 	memset(data, 0, sizeof(data));
 	user_data_len = wrq->u.data.length;
 	copy_len = MIN(sizeof(data), sizeof(int) * user_data_len);
@@ -2686,7 +2682,9 @@
 			ret = -EFAULT;
 	} else {
 		/* Get radio status */
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+			PRINTM(MINFO, "Fail to get bss_info\n");
 		wrq->u.data.length = 1;
 		if (copy_to_user(wrq->u.data.pointer, &bss_info.radio_on,
 				 sizeof(bss_info.radio_on))) {
@@ -2761,6 +2759,8 @@
 	       (drvdbg & MCMD_D) ? "X" : "");
 	printk(KERN_ALERT "MDAT_D (%08x) %s\n", MDAT_D,
 	       (drvdbg & MDAT_D) ? "X" : "");
+	printk(KERN_ALERT "MREG   (%08x) %s\n", MREG,
+	       (drvdbg & MREG) ? "X" : "");
 	printk(KERN_ALERT "MREG_D (%08x) %s\n", MREG_D,
 	       (drvdbg & MREG_D) ? "X" : "");
 	printk(KERN_ALERT "MIOCTL (%08x) %s\n", MIOCTL,
@@ -2969,6 +2969,94 @@
 }
 
 /**
+ * @brief Set/Get module configuration
+ *
+ * @param priv     A pointer to moal_private structure
+ * @param wrq      A pointer to iwreq structure
+ *
+ * @return         0 --success, otherwise fail
+ */
+static int woal_fw_wakeup_method(moal_private *priv, struct iwreq *wrq)
+{
+	int ret = 0, data[2];
+	mlan_ds_pm_cfg *pm_cfg = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_pm_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+	pm_cfg = (mlan_ds_pm_cfg *)req->pbuf;
+
+	if (wrq->u.data.length > 2) {
+		ret = -EINVAL;
+		goto done;
+	}
+	if (!wrq->u.data.length) {
+		req->action = MLAN_ACT_GET;
+	} else {
+		req->action = MLAN_ACT_SET;
+		if (copy_from_user(data, wrq->u.data.pointer,
+				   sizeof(int) * wrq->u.data.length)) {
+			PRINTM(MINFO, "Copy from user failed\n");
+			ret = -EFAULT;
+			goto done;
+		}
+		if (data[0] != FW_WAKEUP_METHOD_INTERFACE &&
+		    data[0] != FW_WAKEUP_METHOD_GPIO) {
+			PRINTM(MERROR, "Invalid FW wake up method:%d\n",
+			       data[0]);
+			ret = -EINVAL;
+			goto done;
+		}
+		if (data[0] == FW_WAKEUP_METHOD_GPIO) {
+			if (wrq->u.data.length == 1) {
+				PRINTM(MERROR,
+				       "Please provide gpio pin number for FW_WAKEUP_METHOD gpio\n");
+				ret = -EINVAL;
+				goto done;
+			}
+			pm_cfg->param.fw_wakeup_params.gpio_pin = data[1];
+		}
+
+		pm_cfg->param.fw_wakeup_params.method = data[0];
+	}
+
+	pm_cfg->sub_command = MLAN_OID_PM_CFG_FW_WAKEUP_METHOD;
+	req->req_id = MLAN_IOCTL_PM_CFG;
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	data[0] = ((mlan_ds_pm_cfg *)req->pbuf)->param.fw_wakeup_params.method;
+	data[1] =
+		((mlan_ds_pm_cfg *)req->pbuf)->param.fw_wakeup_params.gpio_pin;
+
+	if (data[0] == FW_WAKEUP_METHOD_INTERFACE)
+		wrq->u.data.length = 1;
+	else
+		wrq->u.data.length = 2;
+	if (copy_to_user(wrq->u.data.pointer, data,
+			 sizeof(int) * wrq->u.data.length)) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
  * @brief Configure sleep parameters
  *
  * @param priv         A pointer to moal_private structure
@@ -3825,33 +3913,35 @@
 	if (action == 0) {
 		memset(buf, 0, sizeof(buf));
 		if (sec->param.passphrase.ssid.ssid_len) {
-			len += sprintf(buf + len, "ssid:");
+			len += snprintf(buf + len, sizeof(buf), "ssid:");
 			moal_memcpy_ext(priv->phandle, buf + len,
 					sec->param.passphrase.ssid.ssid,
 					sec->param.passphrase.ssid.ssid_len,
 					sizeof(buf) - len);
 			len += sec->param.passphrase.ssid.ssid_len;
-			len += sprintf(buf + len, " ");
+			len += snprintf(buf + len, sizeof(buf), " ");
 		}
 		if (memcmp(&sec->param.passphrase.bssid, zero_mac,
 			   sizeof(zero_mac))) {
 			mac = (t_u8 *)&sec->param.passphrase.bssid;
-			len += sprintf(buf + len, "bssid:");
+			len += snprintf(buf + len, sizeof(buf), "bssid:");
 			for (i = 0; i < ETH_ALEN - 1; ++i)
-				len += sprintf(buf + len, "%02x:", mac[i]);
-			len += sprintf(buf + len, "%02x ", mac[i]);
+				len += snprintf(buf + len, sizeof(buf),
+						"%02x:", mac[i]);
+			len += snprintf(buf + len, sizeof(buf), "%02x ",
+					mac[i]);
 		}
 		if (sec->param.passphrase.psk_type == MLAN_PSK_PMK) {
-			len += sprintf(buf + len, "psk:");
+			len += snprintf(buf + len, sizeof(buf), "psk:");
 			for (i = 0; i < MLAN_MAX_KEY_LENGTH; ++i)
-				len += sprintf(
-					buf + len, "%02x",
+				len += snprintf(
+					buf + len, sizeof(buf), "%02x",
 					sec->param.passphrase.psk.pmk.pmk[i]);
-			len += sprintf(buf + len, "\n");
+			len += snprintf(buf + len, sizeof(buf), "\n");
 		}
 		if (sec->param.passphrase.psk_type == MLAN_PSK_PASSPHRASE) {
-			len += sprintf(
-				buf + len, "passphrase:%s\n",
+			len += snprintf(
+				buf + len, sizeof(buf), "passphrase:%s\n",
 				sec->param.passphrase.psk.passphrase.passphrase);
 		}
 		if (wrq->u.data.pointer) {
@@ -3971,11 +4061,11 @@
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "PTK: ");
+		snprintf((char *)tmp, sizeof(key_ascii), "\n%s", "PTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, sizeof(key_ascii), "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get Multicase Key */
@@ -3992,11 +4082,11 @@
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "GTK: ");
+		snprintf((char *)tmp, sizeof(key_ascii), "\n%s", "GTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, sizeof(key_ascii), "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get IGTK Key */
@@ -4013,11 +4103,11 @@
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "IGTK: ");
+		snprintf((char *)tmp, sizeof(key_ascii), "\n%s", "IGTK: ");
 		tmp += 6;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, sizeof(key_ascii), "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	wrq->u.data.length = sizeof(key_ascii) + 1;
@@ -4335,7 +4425,7 @@
 						*token = '\0';
 						str = token + 1;
 					}
-					woal_atoi(&tmp_val, pos);
+					(void)woal_atoi(&tmp_val, pos);
 					switch (i) {
 					case BF_ENABLE_PARAM:
 						bf_global->bf_enbl =
@@ -4432,11 +4522,11 @@
 				bf_cfg.action = BF_CFG_ACT_GET;
 			} else {
 				woal_mac2u8(tx_bf_peer->peer_mac, &buf[2]);
-				woal_atoi(&tmp_val, &buf[20]);
+				(void)woal_atoi(&tmp_val, &buf[20]);
 				tx_bf_peer->bf_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[22]);
+				(void)woal_atoi(&tmp_val, &buf[22]);
 				tx_bf_peer->sounding_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[24]);
+				(void)woal_atoi(&tmp_val, &buf[24]);
 				tx_bf_peer->fb_type = (t_u8)tmp_val;
 				action = MLAN_ACT_SET;
 				bf_cfg.action = BF_CFG_ACT_SET;
@@ -4491,73 +4581,89 @@
 		memset(buf, 0, sizeof(buf));
 		switch (bf_action) {
 		case BF_GLOBAL_CONFIGURATION:
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->bf_enbl);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->sounding_enbl);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->fb_type);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->snr_threshold);
 			data_length +=
-				sprintf(buf + data_length, "%d ",
-					(int)bf_global->sounding_interval);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->bf_mode);
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->bf_enbl);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->sounding_enbl);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->fb_type);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->snr_threshold);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ",
+					 (int)bf_global->sounding_interval);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->bf_mode);
 			break;
 		case SET_GET_BF_PERIODICITY:
-			data_length += sprintf(buf + data_length,
-					       "%02x:%02x:%02x:%02x:%02x:%02x",
-					       bf_periodicity->peer_mac[0],
-					       bf_periodicity->peer_mac[1],
-					       bf_periodicity->peer_mac[2],
-					       bf_periodicity->peer_mac[3],
-					       bf_periodicity->peer_mac[4],
-					       bf_periodicity->peer_mac[5]);
-			data_length += sprintf(buf + data_length, "%c", ' ');
-			data_length += sprintf(buf + data_length, "%d",
-					       bf_periodicity->interval);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%02x:%02x:%02x:%02x:%02x:%02x",
+					 bf_periodicity->peer_mac[0],
+					 bf_periodicity->peer_mac[1],
+					 bf_periodicity->peer_mac[2],
+					 bf_periodicity->peer_mac[3],
+					 bf_periodicity->peer_mac[4],
+					 bf_periodicity->peer_mac[5]);
+			data_length += snprintf(buf + data_length,
+						MAX_IN_OUT_CHAR, "%c", ' ');
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d", bf_periodicity->interval);
 			break;
 		case TX_BF_FOR_PEER_ENBL:
 			for (i = 0; i < (int)bf_cfg.no_of_peers; i++) {
+				data_length += snprintf(
+					buf + data_length, MAX_IN_OUT_CHAR,
+					"%02x:%02x:%02x:%02x:%02x:%02x",
+					tx_bf_peer->peer_mac[0],
+					tx_bf_peer->peer_mac[1],
+					tx_bf_peer->peer_mac[2],
+					tx_bf_peer->peer_mac[3],
+					tx_bf_peer->peer_mac[4],
+					tx_bf_peer->peer_mac[5]);
 				data_length +=
-					sprintf(buf + data_length,
-						"%02x:%02x:%02x:%02x:%02x:%02x",
-						tx_bf_peer->peer_mac[0],
-						tx_bf_peer->peer_mac[1],
-						tx_bf_peer->peer_mac[2],
-						tx_bf_peer->peer_mac[3],
-						tx_bf_peer->peer_mac[4],
-						tx_bf_peer->peer_mac[5]);
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%c", ' ');
+				data_length += snprintf(buf + data_length,
+							MAX_IN_OUT_CHAR, "%d;",
+							tx_bf_peer->bf_enbl);
 				data_length +=
-					sprintf(buf + data_length, "%c", ' ');
-				data_length += sprintf(buf + data_length, "%d;",
-						       tx_bf_peer->bf_enbl);
-				data_length +=
-					sprintf(buf + data_length, "%d;",
-						tx_bf_peer->sounding_enbl);
-				data_length += sprintf(buf + data_length, "%d ",
-						       tx_bf_peer->fb_type);
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%d;",
+						 tx_bf_peer->sounding_enbl);
+				data_length += snprintf(buf + data_length,
+							MAX_IN_OUT_CHAR, "%d ",
+							tx_bf_peer->fb_type);
 				tx_bf_peer++;
 			}
 			break;
 		case SET_SNR_THR_PEER:
 			for (i = 0; i < (int)bf_cfg.no_of_peers; i++) {
+				data_length += snprintf(
+					buf + data_length, MAX_IN_OUT_CHAR,
+					"%02x:%02x:%02x:%02x:%02x:%02x",
+					bf_snr->peer_mac[0],
+					bf_snr->peer_mac[1],
+					bf_snr->peer_mac[2],
+					bf_snr->peer_mac[3],
+					bf_snr->peer_mac[4],
+					bf_snr->peer_mac[5]);
 				data_length +=
-					sprintf(buf + data_length,
-						"%02x:%02x:%02x:%02x:%02x:%02x",
-						bf_snr->peer_mac[0],
-						bf_snr->peer_mac[1],
-						bf_snr->peer_mac[2],
-						bf_snr->peer_mac[3],
-						bf_snr->peer_mac[4],
-						bf_snr->peer_mac[5]);
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%c", ';');
+				data_length += snprintf(buf + data_length,
+							MAX_IN_OUT_CHAR, "%d",
+							bf_snr->snr);
 				data_length +=
-					sprintf(buf + data_length, "%c", ';');
-				data_length += sprintf(buf + data_length, "%d",
-						       bf_snr->snr);
-				data_length +=
-					sprintf(buf + data_length, "%c", ' ');
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%c", ' ');
 				bf_snr++;
 			}
 			break;
@@ -4871,20 +4977,16 @@
 
 	if (!rw) {
 #ifdef SDIO_MMC
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (func)
 			data = sdio_readb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				reg, &ret);
 		else
 			data = sdio_f0_readb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				reg, &ret);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (ret) {
 			PRINTM(MERROR,
 			       "sdio_readb: reading register 0x%X failed\n",
@@ -4903,20 +5005,16 @@
 #endif
 	} else {
 #ifdef SDIO_MMC
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (func)
 			sdio_writeb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				data, reg, &ret);
 		else
 			sdio_f0_writeb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				data, reg, &ret);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (ret) {
 			PRINTM(MERROR,
 			       "sdio_writeb: writing register 0x%X failed\n",
@@ -4978,8 +5076,8 @@
 		ret = -EFAULT;
 		goto done;
 	}
-	if (wrq->u.data.length > WOAL_2K_BYTES) {
-		PRINTM(MERROR, "Data lengh is too large!\n");
+	if (wrq->u.data.length == 0 || wrq->u.data.length > WOAL_2K_BYTES) {
+		PRINTM(MERROR, "Data lengh is invalid!\n");
 		ret = -EINVAL;
 		goto done;
 	}
@@ -5013,16 +5111,13 @@
 	       reg, mode, blklen, blknum);
 
 	if (!rw) {
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
-		if (sdio_readsb(
-			    ((struct sdio_mmc_card *)priv->phandle->card)->func,
-			    data, reg, total_len))
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
+		if (sdio_readsb(((sdio_mmc_card *)priv->phandle->card)->func,
+				data, reg, total_len))
 			PRINTM(MERROR,
 			       "sdio_readsb: reading memory 0x%x failed\n",
 			       reg);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 
 		if (copy_to_user(wrq->u.data.pointer, data, total_len)) {
 			PRINTM(MINFO, "Copy to user failed\n");
@@ -5040,16 +5135,13 @@
 		for (pos = 0; pos < (int)total_len; pos++)
 			data[pos] = buf[11 + (pos % pattern_len)];
 
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
-		if (sdio_writesb(
-			    ((struct sdio_mmc_card *)priv->phandle->card)->func,
-			    reg, data, total_len))
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
+		if (sdio_writesb(((sdio_mmc_card *)priv->phandle->card)->func,
+				 reg, data, total_len))
 			PRINTM(MERROR,
 			       "sdio_writesb: writing memory 0x%x failed\n",
 			       reg);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 	}
 
 done:
@@ -6095,7 +6187,7 @@
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11h_cfg *ds_11hcfg = NULL;
 	int ret = 0;
-	int data[4], copy_len;
+	int data[4] = {0}, copy_len;
 	int data_length = wrq->u.data.length;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	ENTER();
@@ -6258,7 +6350,7 @@
 static int woal_cfp_code(moal_private *priv, struct iwreq *wrq)
 {
 	int ret = 0;
-	int data[2], copy_len;
+	int data[2] = {0}, copy_len;
 	int data_length = wrq->u.data.length;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc_cfg = NULL;
@@ -6376,14 +6468,27 @@
 
 		if (priv->phandle->feature_control & FEATURE_CTRL_STREAM_2X2) {
 			radio->param.ant_cfg.tx_antenna = data[0];
-			radio->param.ant_cfg.rx_antenna = data[0];
+			if (data[0] == RF_ANTENNA_AUTO) {
+				radio->param.ant_cfg.rx_antenna = 0;
+				if (data[1] > 0xffff) {
+					ret = -EINVAL;
+					goto done;
+				}
+			} else {
+				radio->param.ant_cfg.rx_antenna = data[0];
+			}
 			if (wrq->u.data.length == 2)
 				radio->param.ant_cfg.rx_antenna = data[1];
 		} else {
 			radio->param.ant_cfg_1x1.antenna = data[0];
-			if (wrq->u.data.length == 2)
+			if (wrq->u.data.length == 2) {
+				if (data[1] > 0xffff) {
+					ret = -EINVAL;
+					goto done;
+				}
 				radio->param.ant_cfg_1x1.evaluate_time =
 					data[1];
+			}
 		}
 		req->action = MLAN_ACT_SET;
 	} else
@@ -6614,6 +6719,9 @@
 		case WOAL_SLEEP_PD:
 			ret = woal_sleep_pd(priv, wrq);
 			break;
+		case WOAL_FW_WAKEUP_METHOD:
+			ret = woal_fw_wakeup_method(priv, wrq);
+			break;
 		case WOAL_AUTH_TYPE:
 			ret = woal_auth_type(priv, wrq);
 			break;
@@ -7049,8 +7157,6 @@
 	case MLAN_OID_BSS_MODE:
 		if (bss->param.bss_mode == MLAN_BSS_MODE_INFRA)
 			mode = IW_MODE_INFRA;
-		else if (bss->param.bss_mode == MLAN_BSS_MODE_IBSS)
-			mode = IW_MODE_ADHOC;
 		else
 			mode = IW_MODE_AUTO;
 		priv->w_stats.status = mode;
diff --git a/wlan_sd8987/mlinux/moal_priv.h b/wlan_src/mlinux/moal_priv.h
old mode 100755
new mode 100644
similarity index 87%
rename from wlan_sd8987/mlinux/moal_priv.h
rename to wlan_src/mlinux/moal_priv.h
index c35ef67..083c80b
--- a/wlan_sd8987/mlinux/moal_priv.h
+++ b/wlan_src/mlinux/moal_priv.h
@@ -1,4 +1,3 @@
-
 /** @file moal_priv.h
  *
  * @brief This file contains definition for extended private IOCTL call.
@@ -6,18 +5,26 @@
  *
  * Copyright 2008-2021 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -170,6 +177,8 @@
 #define WOAL_SET_GET_WWS_CFG 12
 /** Private command ID to set/get sleep period */
 #define WOAL_SLEEP_PD 13
+/** Private command ID to set/get firmware wakeup method */
+#define WOAL_FW_WAKEUP_METHOD 15
 /** Private command ID to set/get auth type */
 #define WOAL_AUTH_TYPE 18
 /** Private command ID to set/get port control */
diff --git a/wlan_sd8987/mlinux/moal_proc.c b/wlan_src/mlinux/moal_proc.c
old mode 100755
new mode 100644
similarity index 91%
rename from wlan_sd8987/mlinux/moal_proc.c
rename to wlan_src/mlinux/moal_proc.c
index 8cff3c5..16efda3
--- a/wlan_sd8987/mlinux/moal_proc.c
+++ b/wlan_src/mlinux/moal_proc.c
@@ -1,22 +1,30 @@
-/**  @file moal_proc.c
+/** @file moal_proc.c
  *
  * @brief This file contains functions for proc file.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2022, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -26,6 +34,7 @@
 ********************************************************/
 
 #include "moal_main.h"
+#include "moal_eth_ioctl.h"
 #ifdef UAP_SUPPORT
 #include "moal_uap.h"
 #endif
@@ -64,9 +73,6 @@
 };
 #endif
 
-mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
-			    int *user_data_len);
-
 /********************************************************
 		Global Variables
 ********************************************************/
@@ -238,7 +244,7 @@
 	for (i = 0; i < (int)netdev->num_tx_queues; i++) {
 		seq_printf(sfp, "tx queue %d:  %s\n", i,
 			   ((netif_tx_queue_stopped(
-				    netdev_get_tx_queue(netdev, 0))) ?
+				    netdev_get_tx_queue(netdev, i))) ?
 				    "stopped" :
 				    "started"));
 	}
@@ -455,7 +461,7 @@
 }
 #endif
 
-void woal_priv_get_tx_rx_ant(struct seq_file *sfp, moal_private *priv)
+static void woal_priv_get_tx_rx_ant(struct seq_file *sfp, moal_private *priv)
 {
 	int ret = 0;
 	int data[4] = {0};
@@ -519,7 +525,7 @@
 	return;
 }
 
-mlan_status woal_priv_set_tx_rx_ant(moal_handle *handle, char *line)
+static mlan_status woal_priv_set_tx_rx_ant(moal_handle *handle, char *line)
 {
 	moal_private *priv = NULL;
 	mlan_ioctl_req *req = NULL;
@@ -560,20 +566,37 @@
 
 	if (handle->feature_control & FEATURE_CTRL_STREAM_2X2) {
 		radio->param.ant_cfg.tx_antenna = data[0];
-		radio->param.ant_cfg.rx_antenna = data[0];
+		if (data[0] == RF_ANTENNA_AUTO) {
+			radio->param.ant_cfg.rx_antenna = 0;
+			if (data[1] > 0xffff) {
+				kfree(req);
+				LEAVE();
+				return MLAN_STATUS_FAILURE;
+			}
+		} else {
+			radio->param.ant_cfg.rx_antenna = data[0];
+		}
 		if (user_data_len == 2)
 			radio->param.ant_cfg.rx_antenna = data[1];
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		if (IS_CARD9098(priv->phandle->card_type) ||
-		    IS_CARD9097(priv->phandle->card_type)) {
+		    IS_CARD9097(priv->phandle->card_type) ||
+		    IS_CARDIW624(priv->phandle->card_type) ||
+		    IS_CARDAW693(priv->phandle->card_type)) {
 			woal_cfg80211_notify_antcfg(priv, priv->phandle->wiphy,
 						    radio);
 		}
 #endif
 	} else
 		radio->param.ant_cfg_1x1.antenna = data[0];
-	if (user_data_len == 2)
+	if (user_data_len == 2) {
+		if (data[1] > 0xffff) {
+			kfree(req);
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
 		radio->param.ant_cfg_1x1.evaluate_time = data[1];
+	}
 	/* Send IOCTL request to MLAN */
 	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_PENDING)
@@ -595,8 +618,11 @@
 static ssize_t woal_config_write(struct file *f, const char __user *buf,
 				 size_t count, loff_t *off)
 {
-	char databuf[200];
+	char *databuf = NULL;
 	char *line = NULL;
+	int ret = 0;
+	gfp_t flag;
+
 	t_u32 config_data = 0;
 	struct seq_file *sfp = f->private_data;
 	moal_handle *handle = (moal_handle *)sfp->private;
@@ -615,15 +641,17 @@
 		return 0;
 	}
 
-	if (count >= sizeof(databuf)) {
-		MODULE_PUT;
+	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+	databuf = kzalloc(count, flag);
+	if (databuf == NULL) {
 		LEAVE();
-		return (int)count;
+		return -ENOMEM;
 	}
-	memset(databuf, 0, sizeof(databuf));
-	copy_len = MIN((sizeof(databuf) - 1), count);
-	if (copy_from_user(databuf, buf, copy_len)) {
+
+	copy_len = count;
+	if (copy_from_user(databuf, buf, count)) {
 		MODULE_PUT;
+		kfree(databuf);
 		LEAVE();
 		return 0;
 	}
@@ -665,9 +693,10 @@
 			handle->driver_status = MTRUE;
 		ref_handle = (moal_handle *)handle->pref_mac;
 		if (ref_handle) {
+			ref_handle->driver_status = MTRUE;
 			priv = woal_get_priv(ref_handle, MLAN_BSS_ROLE_ANY);
 			if (priv) {
-				handle->fw_dump_status = MTRUE;
+				ref_handle->fw_dump_status = MTRUE;
 				woal_mlan_debug_info(priv);
 				woal_moal_debug_info(priv, NULL, MFALSE);
 			}
@@ -684,7 +713,7 @@
 	if (!strncmp(databuf, "fwdump_file=", strlen("fwdump_file="))) {
 		int len = copy_len - strlen("fwdump_file=");
 		gfp_t flag;
-		if (len) {
+		if (len > 0) {
 			kfree(handle->fwdump_fname);
 			flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC :
 								  GFP_KERNEL;
@@ -706,7 +735,7 @@
 			config_data = FW_RELOAD_SDIO_INBAND_RESET;
 #endif
 		PRINTM(MMSG, "Request fw_reload=%d\n", config_data);
-		woal_request_fw_reload(handle, config_data);
+		ret = woal_request_fw_reload(handle, config_data);
 	}
 	if (!strncmp(databuf, "drop_point=", strlen("drop_point="))) {
 		line += strlen("drop_point") + 1;
@@ -796,6 +825,15 @@
 	if (!strncmp(databuf, "trigger_frame=", strlen("trigger_frame=")) &&
 	    count > strlen("trigger_frame="))
 		cmd = MFG_CMD_CONFIG_TRIGGER_FRAME;
+	if (!strncmp(databuf,
+		     "otp_mac_addr_rd_wr=", strlen("otp_mac_add_rd_wr=")) &&
+	    count > strlen("otp_mac_addr_rd_wr="))
+		cmd = MFG_CMD_OTP_MAC_ADD;
+	if (!strncmp(databuf,
+		     "otp_cal_data_rd_wr=", strlen("otp_cal_data_rd_wr=")) &&
+	    count > strlen("otp_cal_data_rd_wr="))
+		cmd = MFG_CMD_OTP_CAL_DATA;
+
 	if (cmd && handle->rf_test_mode &&
 	    (woal_process_rf_test_mode_cmd(
 		     handle, cmd, (const char *)databuf, (size_t)count,
@@ -813,7 +851,10 @@
 	}
 
 	MODULE_PUT;
+	kfree(databuf);
 	LEAVE();
+	if (ret < 0)
+		return ret;
 	return (int)count;
 }
 
@@ -844,8 +885,8 @@
 	seq_printf(sfp, "drv_mode=%d\n", (int)handle->params.drv_mode);
 	if (priv) {
 		memset(&hscfg, 0, sizeof(mlan_ds_hs_cfg));
-		woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
-				       &hscfg);
+		(void)woal_set_get_hs_params(priv, MLAN_ACT_GET,
+					     MOAL_IOCTL_WAIT, &hscfg);
 		seq_printf(sfp, "hssetpara=%d,0x%x,%d,%d\n", hscfg.conditions,
 			   hscfg.gpio, hscfg.gap, hscfg.hs_wake_interval);
 	}
@@ -1038,6 +1079,14 @@
 					   .basic_trig_user_info.pref_ac);
 		}
 		seq_printf(sfp, "\n");
+		seq_printf(sfp, "otp_mac_add_rd_wr=");
+		seq_printf(sfp, " %02x:%02x:%02x:%02x:%02x:%02x \n",
+			   handle->rf_data->mfg_otp_mac_addr_rd_wr.mac_addr[0],
+			   handle->rf_data->mfg_otp_mac_addr_rd_wr.mac_addr[1],
+			   handle->rf_data->mfg_otp_mac_addr_rd_wr.mac_addr[2],
+			   handle->rf_data->mfg_otp_mac_addr_rd_wr.mac_addr[3],
+			   handle->rf_data->mfg_otp_mac_addr_rd_wr.mac_addr[4],
+			   handle->rf_data->mfg_otp_mac_addr_rd_wr.mac_addr[5]);
 	}
 	// Read current antcfg configuration
 	woal_priv_get_tx_rx_ant(sfp, priv);
@@ -1077,6 +1126,7 @@
 };
 #endif
 
+#ifdef DUMP_TO_PROC
 static int woal_drv_dump_read(struct seq_file *sfp, void *data)
 {
 	moal_handle *handle = (moal_handle *)sfp->private;
@@ -1230,6 +1280,7 @@
 	.release = single_release,
 };
 #endif
+#endif
 
 /**
  *  @brief wifi status proc read function
@@ -1301,11 +1352,11 @@
 
 	if (!strncmp(s, "-", 1)) {
 		pn = -1;
-		s++;
+		s = (char *)(s + 1);
 	}
 	if (!strncmp(s, "0x", 2) || !strncmp(s, "0X", 2)) {
 		base = 16;
-		s += 2;
+		s = (char *)(s + 2);
 	} else
 		base = 10;
 
@@ -1383,8 +1434,10 @@
 	struct proc_dir_entry *pde = proc_mwlan;
 #endif
 	char config_proc_dir[20];
+#ifdef DUMP_TO_PROC
 	char drv_dump_dir[20];
 	char fw_dump_dir[20];
+#endif
 
 	ENTER();
 
@@ -1426,7 +1479,7 @@
 		goto done;
 	}
 
-	strcpy(config_proc_dir, "config");
+	strncpy(config_proc_dir, "config", sizeof(config_proc_dir));
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 	r = proc_create_data(config_proc_dir, 0666, handle->proc_wlan,
 			     &config_proc_fops, handle);
@@ -1440,7 +1493,8 @@
 	if (!r)
 		PRINTM(MERROR, "Fail to create proc config\n");
 
-	strcpy(drv_dump_dir, "drv_dump");
+#ifdef DUMP_TO_PROC
+	strncpy(drv_dump_dir, "drv_dump", sizeof(drv_dump_dir));
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 	r = proc_create_data(drv_dump_dir, 0644, handle->proc_wlan,
 			     &drv_dump_fops, handle);
@@ -1454,7 +1508,7 @@
 	if (!r)
 		PRINTM(MERROR, "Failed to create proc drv dump\n");
 
-	strcpy(fw_dump_dir, "fw_dump");
+	strncpy(fw_dump_dir, "fw_dump", sizeof(fw_dump_dir));
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 	r = proc_create_data(fw_dump_dir, 0644, handle->proc_wlan,
 			     &fw_dump_fops, handle);
@@ -1467,6 +1521,7 @@
 #endif
 	if (!r)
 		PRINTM(MERROR, "Failed to create proc fw dump\n");
+#endif
 
 done:
 	LEAVE();
@@ -1482,19 +1537,23 @@
 void woal_proc_exit(moal_handle *handle)
 {
 	char config_proc_dir[20];
+#ifdef DUMP_TO_PROC
 	char drv_dump_dir[20];
 	char fw_dump_dir[20];
+#endif
 
 	ENTER();
 
 	PRINTM(MINFO, "Remove Proc Interface %s\n", handle->proc_wlan_name);
 	if (handle->proc_wlan) {
-		strcpy(config_proc_dir, "config");
+		strncpy(config_proc_dir, "config", sizeof(config_proc_dir));
 		remove_proc_entry(config_proc_dir, handle->proc_wlan);
-		strcpy(drv_dump_dir, "drv_dump");
+#ifdef DUMP_TO_PROC
+		strncpy(drv_dump_dir, "drv_dump", sizeof(drv_dump_dir));
 		remove_proc_entry(drv_dump_dir, handle->proc_wlan);
-		strcpy(fw_dump_dir, "fw_dump");
+		strncpy(fw_dump_dir, "fw_dump", sizeof(fw_dump_dir));
 		remove_proc_entry(fw_dump_dir, handle->proc_wlan);
+#endif
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
 		/* Remove only if we are the only instance using this */
@@ -1512,6 +1571,7 @@
 		}
 #endif
 	}
+#ifdef DUMP_TO_PROC
 	if (handle->fw_dump_buf) {
 		moal_vfree(handle, handle->fw_dump_buf);
 		handle->fw_dump_buf = NULL;
@@ -1522,6 +1582,7 @@
 		handle->drv_dump_len = 0;
 		handle->drv_dump_buf = NULL;
 	}
+#endif
 	LEAVE();
 }
 
@@ -1556,7 +1617,7 @@
 			LEAVE();
 			return;
 		}
-		strcat(proc_dir_name, dev->name);
+		strncat(proc_dir_name, dev->name, sizeof(proc_dir_name) - 1);
 		/* Try to create adapterX/dev_name directory first under
 		 * /proc/mwlan/ */
 		priv->proc_entry = proc_mkdir(proc_dir_name, proc_mwlan);
@@ -1595,7 +1656,7 @@
 		atomic_inc(&(priv->phandle->proc_wlan->count));
 #endif /* < 3.10.0 */
 #endif /* < 2.6.26 */
-		strcpy(priv->proc_entry_name, dev->name);
+		strncpy(priv->proc_entry_name, dev->name, IFNAMSIZ - 1);
 		if (priv->proc_entry) {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 			r = proc_create_data("info", 0, priv->proc_entry,
diff --git a/wlan_src/mlinux/moal_sdio.h b/wlan_src/mlinux/moal_sdio.h
new file mode 100644
index 0000000..e740b0f
--- /dev/null
+++ b/wlan_src/mlinux/moal_sdio.h
@@ -0,0 +1,255 @@
+/** @file moal_sdio.h
+ *
+ *  @brief This file contains definitions for SDIO interface.
+ *
+ *
+ * Copyright 2008-2022, 2024 NXP
+ *
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
+ *
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ */
+/****************************************************
+Change log:
+****************************************************/
+
+#ifndef _MOAL_SDIO_H
+#define _MOAL_SDIO_H
+
+#include <linux/mmc/sdio.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
+
+#include "moal_main.h"
+
+#ifndef BLOCK_MODE
+/** Block mode */
+#define BLOCK_MODE 1
+#endif
+
+#ifndef BYTE_MODE
+/** Byte Mode */
+#define BYTE_MODE 0
+#endif
+
+/** SDIO bus width 1 bit mode */
+#define SDIO_BUS_WIDTH_1 1
+/** SDIO bus width 4 bit mode */
+#define SDIO_BUS_WIDTH_4 4
+
+#ifndef FIXED_ADDRESS
+/** Fixed address mode */
+#define FIXED_ADDRESS 0
+#endif
+
+#if defined(SD8977)
+#define SD8977_V0 0x0
+#define SD8977_V1 0x8
+#define SD8977_V2 0x9
+#define SD8977_V0_FW_NAME "nxp/sdsd8977_combo.bin"
+#define SD8977_V1_FW_NAME "nxp/sdsd8977_combo_v1.bin"
+#define SD8977_V2_FW_NAME "nxp/sdsd8977_combo_v2.bin"
+#define SD8977_WLAN_V2_FW_NAME "nxp/sd8977_wlan_v2.bin"
+#define SD8977_WLAN_V1_FW_NAME "nxp/sd8977_wlan_v1.bin"
+#define SD8977_WLAN_V0_FW_NAME "nxp/sd8977_wlan.bin"
+#endif /* SD8977_MULTI_FW */
+
+#if defined(SD8887)
+/** SD8887 chip revision ID */
+#define SD8887_A0 0x0
+#define SD8887_A2 0x2
+
+#define SD8887_A0_FW_NAME "nxp/sd8887_uapsta.bin"
+#define SD8887_A2_FW_NAME "nxp/sd8887_uapsta_a2.bin"
+#define SD8887_WLAN_A2_FW_NAME "nxp/sd8887_wlan_a2.bin"
+#define SD8887_WLAN_A0_FW_NAME "nxp/sd8887_wlan.bin"
+#endif /* SD8887_MULTI_FW */
+
+#ifdef SD8801
+#define SD8801_DEFAULT_WLAN_FW_NAME "nxp/sd8801_uapsta.bin"
+#endif /* SD8801 */
+
+/** Default firmware name */
+#ifdef SD8887
+#define SD8887_DEFAULT_COMBO_FW_NAME "nxp/sd8887_uapsta_a2.bin"
+#define SD8887_DEFAULT_WLAN_FW_NAME "nxp/sd8887_wlan_a2.bin"
+#endif /* SD8887 */
+
+#ifdef SD8977
+#define SD8977_DEFAULT_COMBO_FW_NAME "nxp/sdsd8977_combo_v2.bin"
+#define SD8977_DEFAULT_WLAN_FW_NAME "nxp/sd8977_wlan_v2.bin"
+#endif /* SD8977 */
+
+#ifdef SD8997
+#define SD8997_DEFAULT_COMBO_FW_NAME "nxp/sdsd8997_combo_v4.bin"
+#define SDUART8997_DEFAULT_COMBO_FW_NAME "nxp/sduart8997_combo_v4.bin"
+#define SDSD8997_DEFAULT_COMBO_FW_NAME "nxp/sdsd8997_combo_v4.bin"
+#define SD8997_DEFAULT_WLAN_FW_NAME "nxp/sd8997_wlan_v4.bin"
+#endif /* SD8997 */
+
+#ifdef SD8987
+#define SD8987_DEFAULT_COMBO_FW_NAME "nxp/sdsd8987_combo.bin"
+#define SDUART8987_DEFAULT_COMBO_FW_NAME "nxp/sduart8987_combo.bin"
+#define SDSD8987_DEFAULT_COMBO_FW_NAME "nxp/sdsd8987_combo.bin"
+#define SD8987_DEFAULT_WLAN_FW_NAME "nxp/sd8987_wlan.bin"
+#endif /* SD8987 */
+
+#ifdef SD8897
+#define SD8897_DEFAULT_COMBO_FW_NAME "nxp/sdsd8897_uapsta.bin"
+#define SD8897_DEFAULT_WLAN_FW_NAME "nxp/sd8897_wlan.bin"
+#endif /* SD8897 */
+
+#ifdef SD8978
+#define SD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw416_combo.bin"
+#define SDUART8978_DEFAULT_COMBO_FW_NAME "nxp/sduartiw416_combo.bin"
+#define SDSD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw416_combo.bin"
+#define SD8978_DEFAULT_WLAN_FW_NAME "nxp/sdiw416_wlan.bin"
+#endif /* SD8978 */
+
+#ifdef SD9098
+#define SD9098_Z1Z2 0x00
+#define SD9098_A0 0x01
+#define SD9098_A1 0x02
+#define SD9098_A2 0x03
+#define SD9098_DEFAULT_COMBO_FW_NAME "nxp/sdsd9098_combo.bin"
+#define SDUART9098_DEFAULT_COMBO_FW_NAME "nxp/sduart9098_combo.bin"
+#define SDSD9098_DEFAULT_COMBO_FW_NAME "nxp/sdsd9098_combo.bin"
+#define SD9098_DEFAULT_WLAN_FW_NAME "nxp/sd9098_wlan.bin"
+#define SDUART9098_COMBO_V1_FW_NAME "nxp/sduart9098_combo_v1.bin"
+#define SDSD9098_COMBO_V1_FW_NAME "nxp/sdsd9098_combo_v1.bin"
+#define SD9098_WLAN_V1_FW_NAME "nxp/sd9098_wlan_v1.bin"
+#endif /* SD9098 */
+
+#ifdef SD9097
+#define SD9097_B0 0x01
+#define SD9097_B1 0x02
+#define SD9097_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw620_combo_v1.bin"
+
+#define SD9097_DEFAULT_WLAN_FW_NAME "nxp/sdiw620_wlan_v1.bin"
+#define SDUART9097_COMBO_V1_FW_NAME "nxp/sduartiw620_combo_v1.bin"
+#define SDSD9097_COMBO_V1_FW_NAME "nxp/sdsdiw620_combo_v1.bin"
+#define SD9097_WLAN_V1_FW_NAME "nxp/sdiw620_wlan_v1.bin"
+#endif /* SD9097 */
+
+#ifdef SDIW624
+#define SDIW624_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw624_combo.bin"
+#define SDUARTIW624_COMBO_FW_NAME "nxp/sduartiw624_combo.bin"
+#define SDUARTSPIIW624_COMBO_FW_NAME "nxp/sduartspiiw624_combo.bin"
+#define SDUARTUARTIW624_COMBO_FW_NAME "nxp/sduartuartiw624_combo.bin"
+#define SDSDIW624_COMBO_FW_NAME "sdsdiw624_combo.bin"
+#define SDIW624_DEFAULT_WLAN_FW_NAME "nxp/sdiw624_wlan.bin"
+#endif /* SDIW624 */
+
+#ifdef SDAW693
+#define SDAW693_A0 0x00
+#define SDAW693_A1 0x01
+#define SDAW693_DEFAULT_COMBO_FW_NAME "nxp/sdsdwaw693_combo.bin"
+#define SDUARTAW693_COMBO_FW_NAME "nxp/sduartw693_combo.bin"
+#define SDSDAW693_COMBO_FW_NAME "sdsdaw693_combo.bin"
+#define SDUARTAW693_COMBO_V1_FW_NAME "nxp/sduartw693_combo_v1.bin.se"
+#define SDSDAW693_COMBO_V1_FW_NAME "sdsdaw693_combo_v1.bin.se"
+#define SDAW693_DEFAULT_WLAN_FW_NAME "nxp/sdaw693_wlan.bin"
+#define SDAW693_WLAN_V1_FW_NAME "nxp/sdaw693_wlan_v1.bin.se"
+#endif /* SDAW693 */
+
+#ifdef SD9177
+#define SD9177_A0 0x00
+#define SD9177_A1 0x01
+#define SD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin.se"
+#define SD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin.se"
+#define SDUART9177_DEFAULT_COMBO_FW_NAME "nxp/sduart_nw61x.bin.se"
+#define SDSD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin.se"
+#define SD9177_DEFAULT_WLAN_FW_NAME "nxp/sd_w61x.bin.se"
+#define SDUART9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin.se"
+#define SDSD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_v1.bin.se"
+#define SD9177_DEFAULT_WLAN_V1_FW_NAME "nxp/sd_w61x_v1.bin.se"
+#define SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME                               \
+	"nxp/sduart_nw61x_rftm_v1.bin.se"
+#define SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_rftm_v1.bin.se"
+#define SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME "nxp/sd_w61x_rftm_v1.bin.se"
+#endif /* SD9177 */
+
+#ifdef SDIW610
+#define SDIW610_DEFAULT_COMBO_FW_NAME "nxp/sduartspi_iw610.bin.se"
+#define SDUARTIW610_COMBO_FW_NAME "nxp/sduart_iw610.bin.se"
+#define SDUARTSPIIW610_COMBO_FW_NAME "nxp/sduartspi_iw610.bin.se"
+#define SDIW610_DEFAULT_WLAN_FW_NAME "nxp/sd_iw610.bin.se"
+#endif /* SDIW610 */
+
+/********************************************************
+		Global Functions
+********************************************************/
+
+/** Register to bus driver function */
+mlan_status woal_sdiommc_bus_register(void);
+/** Unregister from bus driver function */
+void woal_sdiommc_bus_unregister(void);
+
+int woal_sdio_set_bus_clock(moal_handle *handle, t_u8 option);
+int woal_sdio_set_buswidth(moal_handle *handle, t_u8 bus_width);
+
+#ifdef SDIO_SUSPEND_RESUME
+#ifdef MMC_PM_FUNC_SUSPENDED
+/** Notify SDIO bus driver that WLAN is suspended */
+void woal_wlan_is_suspended(moal_handle *handle);
+#endif
+/** SDIO Suspend */
+int woal_sdio_suspend(struct device *dev);
+/** SDIO Resume */
+int woal_sdio_resume(struct device *dev);
+#endif /* SDIO_SUSPEND_RESUME */
+
+#ifdef SDIO_MMC
+/** Structure: SDIO MMC card */
+typedef struct _sdio_mmc_card {
+	/** sdio_func structure pointer */
+	struct sdio_func *func;
+	/** moal_handle structure pointer */
+	moal_handle *handle;
+	/** reset work*/
+	struct work_struct reset_work;
+	/** work flag */
+	t_u8 work_flags;
+	/** saved host clock value */
+	unsigned int host_clock;
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+	/** oob irq */
+	int oob_irq;
+	/** irq enabled */
+	int irq_enabled;
+	/** sdio func intr enabled **/
+	int sdio_func_intr_enabled;
+	/** irq registered */
+	int irq_registered;
+	/* SDIO OOB Interrupt handling workqueue */
+	struct workqueue_struct *sdio_oob_irq_workqueue;
+	/* SDIO OOB Interrupt handler work */
+	struct work_struct sdio_oob_irq_work;
+#endif
+} sdio_mmc_card;
+void woal_sdio_reset_hw(moal_handle *handle);
+#endif /* SDIO_MMC */
+
+/** cmd52 read write */
+int woal_sdio_read_write_cmd52(moal_handle *handle, int func, int reg, int val);
+#endif /* _MOAL_SDIO_H */
diff --git a/wlan_src/mlinux/moal_sdio_mmc.c b/wlan_src/mlinux/moal_sdio_mmc.c
new file mode 100644
index 0000000..ce74190
--- /dev/null
+++ b/wlan_src/mlinux/moal_sdio_mmc.c
@@ -0,0 +1,3719 @@
+/** @file moal_sdio.c
+ *
+ *  @brief This file contains SDIO MMC IF (interface) module
+ *  related functions.
+ *
+ *
+ * Copyright 2008-2022, 2024 NXP
+ *
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
+ *
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ */
+/****************************************************
+Change log:
+	02/25/09: Initial creation -
+		  This file supports SDIO MMC only
+****************************************************/
+
+#include <linux/firmware.h>
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#include "moal_cfg80211.h"
+#endif
+#include "moal_sdio.h"
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+#if IS_ENABLED(CONFIG_IPV6)
+#include <net/addrconf.h>
+#endif
+#endif
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+#include <linux/gpio.h>
+#include <uapi/linux/sched/types.h>
+#endif
+
+/** define nxp vendor id */
+#define NXP_VENDOR_ID 0x0471
+#define MRVL_VENDOR_ID 0x02df
+/* The macros below are hardware platform dependent.
+   The definition should match the actual platform */
+/** Initialize GPIO port */
+#define GPIO_PORT_INIT()
+/** Set GPIO port to high */
+#define GPIO_PORT_TO_HIGH()
+/** Set GPIO port to low */
+#define GPIO_PORT_TO_LOW()
+
+/********************************************************
+		Local Variables
+********************************************************/
+/* moal interface ops */
+static moal_if_ops sdiommc_ops;
+/********************************************************
+		Global Variables
+********************************************************/
+
+#ifdef SD8887
+/** Device ID for SD8887 */
+#define SD_DEVICE_ID_8887 (0x9135)
+#endif
+#ifdef SD8801
+/** Device ID for SD8801 FN1 */
+#define SD_DEVICE_ID_8801 (0x9139)
+#endif
+#ifdef SD8897
+/** Device ID for SD8897 */
+#define SD_DEVICE_ID_8897 (0x912d)
+#endif
+#ifdef SD8977
+/** Device ID for SD8977 */
+#define SD_DEVICE_ID_8977 (0x9145)
+#endif
+#ifdef SD8978
+/** Device ID for SD8978 */
+#define SD_DEVICE_ID_8978 (0x9159)
+#endif
+#ifdef SD8997
+/** Device ID for SD8997 */
+#define SD_DEVICE_ID_8997 (0x9141)
+#endif
+#ifdef SD8987
+/** Device ID for SD8987 */
+#define SD_DEVICE_ID_8987 (0x9149)
+#endif
+#ifdef SDAW693
+/** Device ID for SDAW693 */
+#define SD_DEVICE_ID_AW693_FN1 (0x0211)
+/** Device ID for SDAW693 */
+#define SD_DEVICE_ID_AW693_FN2 (0x0212)
+#endif
+#ifdef SD9098
+/** Device ID for SD9098 */
+#define SD_DEVICE_ID_9098_FN1 (0x914D)
+/** Device ID for SD9098 */
+#define SD_DEVICE_ID_9098_FN2 (0x914E)
+#endif
+#ifdef SD9097
+/** Device ID for SD9097 */
+#define SD_DEVICE_ID_9097 (0x9155)
+#endif
+#ifdef SD9177
+/** Device ID for SD9177 */
+#define SD_DEVICE_ID_9177 (0x0205)
+#endif
+#ifdef SDIW624
+/** Device ID for SDIW624 */
+#define SD_DEVICE_ID_IW624 (0x020D)
+#endif
+#ifdef SDIW610
+/** Device ID for SDIW610 */
+#define SD_DEVICE_ID_IW610 (0x0215)
+#endif
+
+/** WLAN IDs */
+static const struct sdio_device_id wlan_ids[] = {
+#ifdef SD8887
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8887)},
+#endif
+#ifdef SD8801
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8801)},
+#endif
+#ifdef SD8897
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8897)},
+#endif
+#ifdef SD8977
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8977)},
+#endif
+#ifdef SD8978
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8978)},
+#endif
+#ifdef SD8997
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8997)},
+#endif
+#ifdef SD8987
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8987)},
+#endif
+#ifdef SDAW693
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_AW693_FN1)},
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_AW693_FN2)},
+#endif
+#ifdef SD9098
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN1)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN2)},
+#endif
+#ifdef SD9097
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9097)},
+#endif
+#ifdef SD9177
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_9177)},
+#endif
+#ifdef SDIW624
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_IW624)},
+#endif
+#ifdef SDIW610
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_IW610)},
+#endif
+	{},
+};
+
+MODULE_DEVICE_TABLE(sdio, wlan_ids);
+
+int woal_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id);
+void woal_sdio_remove(struct sdio_func *func);
+static void woal_sdiommc_work(struct work_struct *work);
+#ifdef SDIO
+static void woal_sdiommc_reg_dbg(pmoal_handle handle);
+#endif
+
+#ifdef SDIO_SUSPEND_RESUME
+#ifdef MMC_PM_KEEP_POWER
+int woal_sdio_suspend(struct device *dev);
+int woal_sdio_resume(struct device *dev);
+
+static struct dev_pm_ops wlan_sdio_pm_ops = {
+	.suspend = woal_sdio_suspend,
+	.resume = woal_sdio_resume,
+};
+
+void woal_sdio_shutdown(struct device *dev);
+#endif
+#endif
+
+// clang-format off
+static struct sdio_driver REFDATA wlan_sdio = {
+	.name = "wlan_sdio",
+	.id_table = wlan_ids,
+	.probe = woal_sdio_probe,
+	.remove = woal_sdio_remove,
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+	.drv = {
+		.owner = THIS_MODULE,
+#ifdef SDIO_SUSPEND_RESUME
+#ifdef MMC_PM_KEEP_POWER
+		.pm = &wlan_sdio_pm_ops,
+		.shutdown = woal_sdio_shutdown,
+#endif
+#endif
+
+	}
+#else
+#ifdef SDIO_SUSPEND_RESUME
+#ifdef MMC_PM_KEEP_POWER
+	.drv = {
+		.pm = &wlan_sdio_pm_ops,
+		.shutdown = woal_sdio_shutdown,
+	}
+#endif
+#endif
+#endif
+};
+// clang-format on
+
+/********************************************************
+		Local Functions
+********************************************************/
+static void woal_sdiommc_dump_fw_info(moal_handle *phandle);
+static void woal_trigger_nmi_on_no_dump_event(moal_handle *phandle);
+#if 0
+/**  @brief This function dump the sdio register
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @return         N/A
+ */
+static void woal_dump_sdio_reg(moal_handle *handle)
+{
+	int ret = 0;
+	t_u8 data, i;
+	int fun0_reg[] = {0x05, 0x04};
+	t_u8 array_size = 0;
+#ifdef SD8897
+	int fun1_reg_8897[] = {0x03, 0x04, 0x05, 0x06, 0x07, 0xC0, 0xC1};
+#endif
+	int fun1_reg_other[] = {0x03, 0x04, 0x05, 0x60, 0x61};
+	int *fun1_reg = NULL;
+
+	for (i = 0; i < ARRAY_SIZE(fun0_reg); i++) {
+		data = sdio_f0_readb(
+			((sdio_mmc_card *)handle->card)->func,
+			fun0_reg[i], &ret);
+		PRINTM(MMSG, "fun0: reg 0x%02x=0x%02x ret=%d\n", fun0_reg[i],
+		       data, ret);
+	}
+
+#ifdef SD8897
+	if (IS_SD8897(handle->card_type)) {
+		fun1_reg = fun1_reg_8897;
+		array_size = sizeof(fun1_reg_8897) / sizeof(int);
+	} else {
+#endif
+		fun1_reg = fun1_reg_other;
+		array_size = sizeof(fun1_reg_other) / sizeof(int);
+#ifdef SD8897
+	}
+#endif
+	for (i = 0; i < array_size; i++) {
+		data = sdio_readb(((sdio_mmc_card *)handle->card)->func,
+				  fun1_reg[i], &ret);
+		PRINTM(MMSG, "fun1: reg 0x%02x=0x%02x ret=%d\n", fun1_reg[i],
+		       data, ret);
+	}
+	return;
+}
+#endif
+/********************************************************
+		Global Functions
+********************************************************/
+/**
+ *  @brief This function handles the interrupt.
+ *
+ *  @param func     A pointer to the sdio_func structure
+ *  @return         N/A
+ */
+static void woal_sdio_interrupt(struct sdio_func *func)
+{
+	moal_handle *handle;
+	sdio_mmc_card *card;
+	mlan_status status;
+	t_u32 host_int_status_reg_val;
+	ENTER();
+
+	card = sdio_get_drvdata(func);
+	if (!card || !card->handle) {
+		PRINTM(MINFO,
+		       "sdio_mmc_interrupt(func = %p) card or handle is NULL, card=%p\n",
+		       func, card);
+		LEAVE();
+		return;
+	}
+	handle = card->handle;
+	if (handle->surprise_removed == MTRUE) {
+		LEAVE();
+		return;
+	}
+	handle->main_state = MOAL_RECV_INT;
+	PRINTM(MINFO, "*** IN SDIO IRQ ***\n");
+	PRINTM(MINTR, "*\n");
+
+	if (handle->fw_reseting == MTRUE && (!handle->pmlan_adapter)) {
+		handle->ops.read_reg(handle, 0x0c, &host_int_status_reg_val);
+		PRINTM(MERROR,
+		       "*** Recv intr during fw reset, host int status reg value is %d, ignore it ***\n",
+		       host_int_status_reg_val);
+		LEAVE();
+		return;
+	}
+	/* call mlan_interrupt to read int status */
+	status = mlan_interrupt(0, handle->pmlan_adapter);
+	if (status == MLAN_STATUS_FAILURE) {
+		PRINTM(MINTR, "mlan interrupt failed\n");
+	}
+#ifdef SDIO_SUSPEND_RESUME
+	if (handle->is_suspended) {
+		PRINTM(MINTR, "Receive interrupt in hs_suspended\n");
+		LEAVE();
+		return;
+	}
+#endif
+	handle->main_state = MOAL_START_MAIN_PROCESS;
+	/* Call MLAN main process */
+	status = mlan_main_process(handle->pmlan_adapter);
+	if (status == MLAN_STATUS_FAILURE) {
+		PRINTM(MINTR, "mlan main process exited with failure\n");
+	}
+	handle->main_state = MOAL_END_MAIN_PROCESS;
+	LEAVE();
+}
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+/**
+ * @brief This work handles oob sdio top irq.
+ */
+static void woal_sdio_oob_irq_work(struct work_struct *work)
+{
+	sdio_mmc_card *card =
+		container_of(work, sdio_mmc_card, sdio_oob_irq_work);
+	struct mmc_card *mmc_card = card->func->card;
+	struct sdio_func *func;
+	unsigned char pending;
+	int i;
+	int ret;
+
+	for (i = 0; i < mmc_card->sdio_funcs; i++) {
+		func = NULL;
+		if (mmc_card->sdio_func[i]) {
+			func = mmc_card->sdio_func[i];
+		}
+		if (func) {
+			sdio_claim_host(func);
+			pending = sdio_f0_readb(func, SDIO_CCCR_INTx, &ret);
+			if (!ret && pending && func->irq_handler)
+				func->irq_handler(func);
+			sdio_release_host(func);
+		}
+	}
+
+	if (card->irq_registered && !card->irq_enabled) {
+		card->irq_enabled = MTRUE;
+		enable_irq(card->oob_irq);
+	}
+}
+
+/**
+ *  @brief oob_sdio_irq interrupt handler.
+ *
+ *  @param irq     irq
+ *  @param dev_id   a pointer to structure sdio_mmc_card
+ *  @return         IRQ_HANDLED
+ */
+static irqreturn_t oob_sdio_irq(int irq, void *dev_id)
+{
+	sdio_mmc_card *card = (sdio_mmc_card *)dev_id;
+
+	if (card->sdio_func_intr_enabled) {
+		disable_irq_nosync(card->oob_irq);
+		card->irq_enabled = MFALSE;
+		queue_work(card->sdio_oob_irq_workqueue,
+			   &card->sdio_oob_irq_work);
+	}
+
+	return IRQ_HANDLED;
+}
+
+/**
+ *  @brief This function registers oob_sdio_irq
+ *
+ *  @param card    a pointer to sdio_mmc_card
+ *  @return         0-success else failure
+ */
+static int oob_sdio_irq_register(sdio_mmc_card *card)
+{
+	int ret = 0;
+
+	ret = devm_request_irq(card->handle->hotplug_device, card->oob_irq,
+			       oob_sdio_irq, IRQF_TRIGGER_LOW | IRQF_SHARED,
+			       "nxp_oob_sdio_irq", card);
+
+	if (!ret) {
+		card->irq_registered = MTRUE;
+		card->irq_enabled = MTRUE;
+		enable_irq_wake(card->oob_irq);
+	}
+
+	return ret;
+}
+
+/**
+ *  @brief This function unregister oob_sdio_irq
+ *
+ *  @param card    a pointer to sdio_mmc_card
+ *  @return         N/A
+ */
+static void oob_sdio_irq_unregister(sdio_mmc_card *card)
+{
+	if (card->irq_registered) {
+		card->irq_registered = MFALSE;
+		disable_irq_wake(card->oob_irq);
+		if (card->irq_enabled) {
+			disable_irq(card->oob_irq);
+			card->irq_enabled = MFALSE;
+		}
+		devm_free_irq(card->handle->hotplug_device, card->oob_irq,
+			      card);
+	}
+}
+
+/**
+ *  @brief This function enable interrupt in SDIO Func0 SDIO_CCCR_IENx
+ *
+ *  @param func    a pointer to struct sdio_func
+ *  @param handler  sdio_irq_handler
+ *  @return         0-success else failure
+ */
+static int sdio_func_intr_enable(struct sdio_func *func,
+				 sdio_irq_handler_t *handler)
+{
+	int ret;
+	unsigned char reg;
+
+#ifdef MMC_QUIRK_LENIENT_FN0
+	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+#endif
+	reg = sdio_f0_readb(func, SDIO_CCCR_IENx, &ret);
+	if (ret)
+		return ret;
+	reg |= 1 << func->num;
+	reg |= 1;
+	sdio_f0_writeb(func, reg, SDIO_CCCR_IENx, &ret);
+	if (ret)
+		return ret;
+
+	func->irq_handler = handler;
+
+	return ret;
+}
+
+/**
+ *  @brief This function disable interrupt in SDIO Func0 SDIO_CCCR_IENx
+ *
+ *  @param func    a pointer to struct sdio_func
+ *  @return         0-success else failure
+ */
+static int sdio_func_intr_disable(struct sdio_func *func)
+{
+	int ret;
+	unsigned char reg;
+
+#ifdef MMC_QUIRK_LENIENT_FN0
+	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+#endif
+	if (func->irq_handler)
+		func->irq_handler = NULL;
+
+	reg = sdio_f0_readb(func, SDIO_CCCR_IENx, &ret);
+	if (ret)
+		return ret;
+	reg &= ~(1 << func->num);
+	if (!(reg & 0xFE))
+		reg = 0;
+	sdio_f0_writeb(func, reg, SDIO_CCCR_IENx, &ret);
+
+	return ret;
+}
+
+/**
+ *  @brief This function claim the oob sdio irq
+ *
+ *  @param card    a pointer to sdio_mmc_card
+ *  @param handler  sdio_irq_handler
+ *  @return         0-success else failure
+ */
+static int woal_sdio_claim_irq(sdio_mmc_card *card, sdio_irq_handler_t *handler)
+{
+	int ret;
+	struct sdio_func *func = card->func;
+
+	BUG_ON(!func);
+	BUG_ON(!func->card);
+
+	card->sdio_oob_irq_workqueue = alloc_ordered_workqueue(
+		"SDIO_OOB_IRQ_WORKQ",
+		__WQ_LEGACY | WQ_MEM_RECLAIM | WQ_HIGHPRI);
+	MLAN_INIT_WORK(&card->sdio_oob_irq_work, woal_sdio_oob_irq_work);
+	ret = oob_sdio_irq_register(card);
+	if (ret) {
+		destroy_workqueue(card->sdio_oob_irq_workqueue);
+		card->sdio_oob_irq_workqueue = NULL;
+		return ret;
+	}
+	ret = sdio_func_intr_enable(func, handler);
+	if (ret) {
+		oob_sdio_irq_unregister(card);
+		destroy_workqueue(card->sdio_oob_irq_workqueue);
+		card->sdio_oob_irq_workqueue = NULL;
+	}
+	card->sdio_func_intr_enabled = MTRUE;
+	return ret;
+}
+
+/**
+ *  @brief This function release the oob sdio irq
+ *
+ *  @param card    a pointer to sdio_mmc_card
+ *  @return         0-success else failure
+ */
+static int woal_sdio_release_irq(sdio_mmc_card *card)
+{
+	struct sdio_func *func = card->func;
+	BUG_ON(!func);
+	BUG_ON(!func->card);
+
+	oob_sdio_irq_unregister(card);
+	flush_workqueue(card->sdio_oob_irq_workqueue);
+	destroy_workqueue(card->sdio_oob_irq_workqueue);
+	card->sdio_oob_irq_workqueue = NULL;
+
+	if (card->sdio_func_intr_enabled) {
+		sdio_func_intr_disable(func);
+		card->sdio_func_intr_enabled = MFALSE;
+	}
+
+	return 0;
+}
+
+/**
+ *  @brief This function request oob gpio
+ *
+ *  @param card    a pointer to sdio_mmc_card
+ *  @param oob_gpio  oob gpio
+ *  @return         0-success else failure
+ */
+static int woal_request_gpio(sdio_mmc_card *card, t_u8 oob_gpio)
+{
+#if defined(IMX_SUPPORT)
+	struct device_node *node;
+	node = of_find_compatible_node(NULL, NULL, "nxp,wifi-oob-int");
+	if (!node)
+		return -1;
+	card->oob_irq = irq_of_parse_and_map(node, 0);
+	PRINTM(MMSG, "SDIO OOB IRQ: %d", card->oob_irq);
+	return 0;
+#else
+	return -1;
+#endif
+}
+#endif
+
+/**  @brief This function updates the card types
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param card     A Pointer to card
+ *
+ *  @return         N/A
+ */
+static t_u16 woal_update_card_type(t_void *card)
+{
+	sdio_mmc_card *cardp_sd = (sdio_mmc_card *)card;
+	t_u16 card_type = 0;
+
+	/* Update card type */
+#ifdef SD8887
+	if (cardp_sd->func->device == SD_DEVICE_ID_8887) {
+		card_type = CARD_TYPE_SD8887;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD8887,
+				strlen(CARD_SD8887), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V15, strlen(V15),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD8801
+	if (cardp_sd->func->device == SD_DEVICE_ID_8801) {
+		card_type = CARD_TYPE_SD8801;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD8801,
+				strlen(CARD_SD8801), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V14, strlen(V14),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+
+#ifdef SD8897
+	if (cardp_sd->func->device == SD_DEVICE_ID_8897) {
+		card_type = CARD_TYPE_SD8897;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD8897,
+				strlen(CARD_SD8897), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V15, strlen(V15),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD8977
+	if (cardp_sd->func->device == SD_DEVICE_ID_8977) {
+		card_type = CARD_TYPE_SD8977;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD8977,
+				strlen(CARD_SD8977), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V16, strlen(V16),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD8978
+	if (cardp_sd->func->device == SD_DEVICE_ID_8978) {
+		card_type = CARD_TYPE_SD8978;
+		moal_memcpy_ext(NULL, driver_version, "SDIW416",
+				strlen("SDIW416"), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V16, strlen(V16),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD8997
+	if (cardp_sd->func->device == SD_DEVICE_ID_8997) {
+		card_type = CARD_TYPE_SD8997;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD8997,
+				strlen(CARD_SD8997), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V16, strlen(V16),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD8987
+	if (cardp_sd->func->device == SD_DEVICE_ID_8987) {
+		card_type = CARD_TYPE_SD8987;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD8987,
+				strlen(CARD_SD8987), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V16, strlen(V16),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SDIW624
+	if (cardp_sd->func->device == SD_DEVICE_ID_IW624) {
+		card_type = CARD_TYPE_SDIW624;
+		moal_memcpy_ext(NULL, driver_version, CARD_SDIW624,
+				strlen(CARD_SDIW624), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V18, strlen(V18),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SDAW693
+	if (cardp_sd->func->device == SD_DEVICE_ID_AW693_FN1 ||
+	    cardp_sd->func->device == SD_DEVICE_ID_AW693_FN2) {
+		card_type = CARD_TYPE_SDAW693;
+		moal_memcpy_ext(NULL, driver_version, CARD_SDAW693,
+				strlen(CARD_SDAW693), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V17, strlen(V17),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD9097
+	if (cardp_sd->func->device == SD_DEVICE_ID_9097) {
+		card_type = CARD_TYPE_SD9097;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD9097,
+				strlen(CARD_SD9097), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V17, strlen(V17),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD9098
+	if (cardp_sd->func->device == SD_DEVICE_ID_9098_FN1 ||
+	    cardp_sd->func->device == SD_DEVICE_ID_9098_FN2) {
+		card_type = CARD_TYPE_SD9098;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD9098,
+				strlen(CARD_SD9098), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V17, strlen(V17),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SD9177
+	if (cardp_sd->func->device == SD_DEVICE_ID_9177) {
+		card_type = CARD_TYPE_SD9177;
+		moal_memcpy_ext(NULL, driver_version, CARD_SD9177,
+				strlen(CARD_SD9177), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V18, strlen(V18),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+#ifdef SDIW610
+	if (cardp_sd->func->device == SD_DEVICE_ID_IW610) {
+		card_type = CARD_TYPE_SDIW610;
+		moal_memcpy_ext(NULL, driver_version, CARD_SDIW610,
+				strlen(CARD_SDIW610), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V18, strlen(V18),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+	return card_type;
+}
+
+/**  @brief This function handles client driver probe.
+ *
+ *  @param func     A pointer to sdio_func structure.
+ *  @param id       A pointer to sdio_device_id structure.
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE/error code
+ */
+int woal_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
+{
+	int ret = MLAN_STATUS_SUCCESS;
+	sdio_mmc_card *card = NULL;
+	t_u16 card_type = 0;
+
+	ENTER();
+
+	PRINTM(MMSG, "vendor=0x%4.04X device=0x%4.04X class=%d function=%d\n",
+	       func->vendor, func->device, func->class, func->num);
+
+	card = kzalloc(sizeof(sdio_mmc_card), GFP_KERNEL);
+	if (!card) {
+		PRINTM(MFATAL,
+		       "Failed to allocate memory in probe function!\n");
+		LEAVE();
+		return -ENOMEM;
+	}
+
+	card->func = func;
+
+#ifdef MMC_QUIRK_BLKSZ_FOR_BYTE_MODE
+	/* The byte mode patch is available in kernel MMC driver
+	 * which fixes one issue in MP-A transfer.
+	 * bit1: use func->cur_blksize for byte mode
+	 */
+	func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+	/* wait for chip fully wake up */
+	if (!func->enable_timeout)
+		func->enable_timeout = 200;
+#endif
+	sdio_claim_host(func);
+	ret = sdio_enable_func(func);
+	if (ret) {
+		sdio_release_host(func);
+		PRINTM(MFATAL, "sdio_enable_func() failed: ret=%d\n", ret);
+		ret = -EIO;
+		goto err;
+	}
+	sdio_release_host(func);
+
+	card_type = woal_update_card_type(card);
+	if (!card_type) {
+		PRINTM(MERROR, "sdmmc probe: woal_update_card_type() failed\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto err;
+	}
+	INIT_WORK(&card->reset_work, woal_sdiommc_work);
+	if (NULL ==
+	    woal_add_card(card, &card->func->dev, &sdiommc_ops, card_type)) {
+		PRINTM(MMSG, "woal_add_card failed\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto err;
+	}
+
+#ifdef IMX_SUPPORT
+	woal_regist_oob_wakeup_irq(card->handle);
+#endif /* IMX_SUPPORT */
+
+	LEAVE();
+	return ret;
+err:
+	kfree(card);
+	sdio_claim_host(func);
+	sdio_disable_func(func);
+	sdio_release_host(func);
+
+	LEAVE();
+	return ret;
+}
+
+/**  @brief This function handles client driver remove.
+ *
+ *  @param func     A pointer to sdio_func structure.
+ *  @return         N/A
+ */
+void woal_sdio_remove(struct sdio_func *func)
+{
+	sdio_mmc_card *card;
+
+	ENTER();
+
+	if (func) {
+		PRINTM(MINFO, "SDIO func=%d\n", func->num);
+		card = sdio_get_drvdata(func);
+		if (card) {
+			/* We need to advance the time to set surprise_removed
+			 * to MTRUE as fast as possible to avoid race condition
+			 * with woal_sdio_interrupt()
+			 *
+			 * @todo: Due to woal_sdio_interrupt() is called in
+			 * Linux's work queue, cannot be suspended to impact
+			 * other works. Need a lock in these two functions:
+			 * woal_sdio_remove() waits until woal_sdio_interrupt
+			 * ends. woal_sdio_interrupt() returns if
+			 * woal_sdio_remove() is running.
+			 */
+			if (card->handle != NULL) {
+				card->handle->surprise_removed = MTRUE;
+
+				/* check if woal_sdio_interrupt() is running */
+				while (card->handle->main_state !=
+					       MOAL_END_MAIN_PROCESS &&
+				       card->handle->main_state !=
+					       MOAL_STATE_IDLE)
+					woal_sched_timeout(2); /* wait until
+								  woal_sdio_interrupt
+								  ends */
+			}
+
+#ifdef IMX_SUPPORT
+			woal_unregist_oob_wakeup_irq(card->handle);
+#endif /* IMX_SUPPORT */
+			woal_remove_card(card);
+			kfree(card);
+		}
+	}
+
+	LEAVE();
+}
+
+#ifdef SDIO_SUSPEND_RESUME
+#ifdef MMC_PM_KEEP_POWER
+#ifdef MMC_PM_FUNC_SUSPENDED
+/**  @brief This function tells lower driver that WLAN is suspended
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @return         N/A
+ */
+void woal_wlan_is_suspended(moal_handle *handle)
+{
+	ENTER();
+	if (handle->suspend_notify_req == MTRUE) {
+		handle->is_suspended = MTRUE;
+		sdio_func_suspended(((sdio_mmc_card *)handle->card)->func);
+	}
+	LEAVE();
+}
+#endif
+
+/**  @brief This function handles client driver shutdown
+ *
+ *  @param dev      A pointer to device structure
+ *  @return         N/A
+ */
+void woal_sdio_shutdown(struct device *dev)
+{
+	struct sdio_func *func = dev_to_sdio_func(dev);
+	moal_handle *handle = NULL;
+	sdio_mmc_card *cardp;
+	mlan_ds_ps_info pm_info;
+	int i, retry_num = 8;
+
+	ENTER();
+	PRINTM(MCMND, "<--- Enter woal_sdio_shutdown --->\n");
+	cardp = sdio_get_drvdata(func);
+	if (!cardp || !cardp->handle) {
+		PRINTM(MERROR, "Card or moal_handle structure is not valid\n");
+		LEAVE();
+		return;
+	}
+	handle = cardp->handle;
+	for (i = 0; i < handle->priv_num; i++)
+		netif_device_detach(handle->priv[i]->netdev);
+
+	if (moal_extflg_isset(handle, EXT_SHUTDOWN_HS)) {
+		handle->shutdown_hs_in_process = MTRUE;
+		memset(&pm_info, 0, sizeof(pm_info));
+		for (i = 0; i < retry_num; i++) {
+			if (MLAN_STATUS_SUCCESS ==
+			    woal_get_pm_info(woal_get_priv(handle,
+							   MLAN_BSS_ROLE_ANY),
+					     &pm_info)) {
+				if (pm_info.is_suspend_allowed == MTRUE)
+					break;
+				else
+					PRINTM(MMSG,
+					       "Shutdown not allowed and retry again\n");
+			}
+			woal_sched_timeout(100);
+		}
+		if (pm_info.is_suspend_allowed == MFALSE) {
+			PRINTM(MMSG, "Shutdown not allowed\n");
+			goto done;
+		}
+		woal_enable_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
+
+		wait_event_interruptible_timeout(
+			handle->hs_activate_wait_q,
+			handle->hs_activate_wait_q_woken, HS_ACTIVE_TIMEOUT);
+		if (handle->hs_activated == MTRUE)
+			PRINTM(MMSG, "HS actived in shutdown\n");
+		else
+			PRINTM(MMSG, "Fail to enable HS in shutdown\n");
+	} else {
+		for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
+			if (handle->priv[i]) {
+				if (handle->priv[i]->media_connected == MTRUE
+#ifdef UAP_SUPPORT
+				    || (GET_BSS_ROLE(handle->priv[i]) ==
+					MLAN_BSS_ROLE_UAP)
+#endif
+				) {
+					PRINTM(MIOCTL,
+					       "disconnect on suspend\n");
+					if (woal_disconnect(
+						    handle->priv[i],
+						    MOAL_NO_WAIT, NULL,
+						    DEF_DEAUTH_REASON_CODE))
+						PRINTM(MERROR,
+						       "failed to disconnect on suspend\n");
+				}
+			}
+		}
+	}
+
+done:
+	PRINTM(MCMND, "<--- Leave woal_sdio_shutdown --->\n");
+	LEAVE();
+	return;
+}
+
+/**  @brief This function handles client driver suspend
+ *
+ *  @param dev      A pointer to device structure
+ *  @return         MLAN_STATUS_SUCCESS or error code
+ */
+int woal_sdio_suspend(struct device *dev)
+{
+	struct sdio_func *func = dev_to_sdio_func(dev);
+	mmc_pm_flag_t pm_flags = 0;
+	moal_handle *handle = NULL;
+	sdio_mmc_card *cardp;
+	int i, retry_num = 8;
+	int ret = MLAN_STATUS_SUCCESS;
+	int hs_actived = 0;
+	mlan_ds_ps_info pm_info;
+
+	ENTER();
+	PRINTM(MCMND, "<--- Enter woal_sdio_suspend --->\n");
+	pm_flags = sdio_get_host_pm_caps(func);
+	PRINTM(MCMND, "%s: suspend: PM flags = 0x%x\n", sdio_func_id(func),
+	       pm_flags);
+	cardp = sdio_get_drvdata(func);
+	if (!cardp || !cardp->handle) {
+		PRINTM(MERROR, "Card or moal_handle structure is not valid\n");
+		LEAVE();
+		return MLAN_STATUS_SUCCESS;
+	}
+
+	handle = cardp->handle;
+
+	if (moal_extflg_isset(handle, EXT_PM_KEEP_POWER) &&
+	    !(pm_flags & MMC_PM_KEEP_POWER)) {
+		PRINTM(MERROR,
+		       "%s: cannot remain alive while host is suspended\n",
+		       sdio_func_id(func));
+		LEAVE();
+		return -ENOSYS;
+	}
+	if (handle->is_suspended == MTRUE) {
+		PRINTM(MWARN, "Device already suspended\n");
+		LEAVE();
+		return MLAN_STATUS_SUCCESS;
+	}
+	if (handle->fw_dump) {
+		PRINTM(MMSG, "suspend not allowed while FW dump!");
+		ret = -EBUSY;
+		goto done;
+	}
+#ifdef STA_SUPPORT
+	for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
+		if (handle->priv[i])
+			woal_cancel_scan(handle->priv[i], MOAL_IOCTL_WAIT);
+	}
+#endif
+	handle->suspend_fail = MFALSE;
+	memset(&pm_info, 0, sizeof(pm_info));
+	for (i = 0; i < retry_num; i++) {
+		if (MLAN_STATUS_SUCCESS ==
+		    woal_get_pm_info(woal_get_priv(handle, MLAN_BSS_ROLE_ANY),
+				     &pm_info)) {
+			if (pm_info.is_suspend_allowed == MTRUE)
+				break;
+			else
+				PRINTM(MMSG,
+				       "Suspend not allowed and retry again\n");
+		}
+		woal_sched_timeout(100);
+	}
+	if (pm_info.is_suspend_allowed == MFALSE) {
+		PRINTM(MMSG, "Suspend not allowed\n");
+		ret = -EBUSY;
+		goto done;
+	}
+
+	for (i = 0; i < handle->priv_num; i++)
+		netif_device_detach(handle->priv[i]->netdev);
+
+	if (moal_extflg_isset(handle, EXT_PM_KEEP_POWER)) {
+		/* Enable the Host Sleep */
+#ifdef MMC_PM_FUNC_SUSPENDED
+		handle->suspend_notify_req = MTRUE;
+#endif
+		woal_sched_timeout(200);
+		hs_actived = woal_enable_hs(
+			woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
+#ifdef MMC_PM_FUNC_SUSPENDED
+		handle->suspend_notify_req = MFALSE;
+#endif
+		if (hs_actived) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 3, 4)
+			if (pm_flags & MMC_PM_WAKE_SDIO_IRQ) {
+				ret = sdio_set_host_pm_flags(
+					func, MMC_PM_WAKE_SDIO_IRQ);
+				PRINTM(MCMND,
+				       "suspend with MMC_PM_WAKE_SDIO_IRQ ret=%d\n",
+				       ret);
+			}
+#endif
+#ifdef MMC_PM_SKIP_RESUME_PROBE
+			PRINTM(MCMND,
+			       "suspend with MMC_PM_KEEP_POWER and MMC_PM_SKIP_RESUME_PROBE\n");
+			ret = sdio_set_host_pm_flags(
+				func,
+				MMC_PM_KEEP_POWER | MMC_PM_SKIP_RESUME_PROBE);
+#else
+			PRINTM(MCMND, "suspend with MMC_PM_KEEP_POWER\n");
+			ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
+#endif
+		} else {
+			PRINTM(MMSG, "HS not actived, suspend fail!");
+			handle->suspend_fail = MTRUE;
+			for (i = 0; i < handle->priv_num; i++)
+				netif_device_attach(handle->priv[i]->netdev);
+			ret = -EBUSY;
+			goto done;
+		}
+	}
+
+	/* Indicate device suspended */
+	handle->is_suspended = MTRUE;
+#ifdef IMX_SUPPORT
+	woal_enable_oob_wakeup_irq(handle);
+#endif /* IMX_SUPPORT */
+done:
+	PRINTM(MCMND, "<--- Leave woal_sdio_suspend --->\n");
+	LEAVE();
+	return ret;
+}
+
+/**  @brief This function handles client driver resume
+ *
+ *  @param dev      A pointer to device structure
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+int woal_sdio_resume(struct device *dev)
+{
+	struct sdio_func *func = dev_to_sdio_func(dev);
+	mmc_pm_flag_t pm_flags = 0;
+	moal_handle *handle = NULL;
+	sdio_mmc_card *cardp;
+	int i;
+
+	ENTER();
+	PRINTM(MCMND, "<--- Enter woal_sdio_resume --->\n");
+	pm_flags = sdio_get_host_pm_caps(func);
+	PRINTM(MCMND, "%s: resume: PM flags = 0x%x\n", sdio_func_id(func),
+	       pm_flags);
+	cardp = sdio_get_drvdata(func);
+	if (!cardp || !cardp->handle) {
+		PRINTM(MERROR, "Card or moal_handle structure is not valid\n");
+		LEAVE();
+		return MLAN_STATUS_SUCCESS;
+	}
+	handle = cardp->handle;
+
+	if (handle->is_suspended == MFALSE) {
+		PRINTM(MWARN, "Device already resumed\n");
+		LEAVE();
+		return MLAN_STATUS_SUCCESS;
+	}
+	handle->is_suspended = MFALSE;
+	if (woal_check_driver_status(handle)) {
+		PRINTM(MERROR, "Resuem, device is in hang state\n");
+		LEAVE();
+		return MLAN_STATUS_SUCCESS;
+	}
+	for (i = 0; i < handle->priv_num; i++)
+		netif_device_attach(handle->priv[i]->netdev);
+
+	/* Disable Host Sleep */
+	woal_cancel_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY), MOAL_NO_WAIT);
+#ifdef IMX_SUPPORT
+	woal_disable_oob_wakeup_irq(handle);
+#endif /* IMX_SUPPORT */
+	PRINTM(MCMND, "<--- Leave woal_sdio_resume --->\n");
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+#endif
+#endif /* SDIO_SUSPEND_RESUME */
+
+/**
+ *  @brief This function writes data into card register
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param reg      Register offset
+ *  @param data     Value
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdiommc_write_reg(moal_handle *handle, t_u32 reg,
+					  t_u32 data)
+{
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	sdio_writeb(((sdio_mmc_card *)handle->card)->func, (t_u8)data, reg,
+		    (int *)&ret);
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+	PRINTM(MREG, "sdio w %x = %x (%x)\n", reg, data, ret);
+	return ret;
+}
+
+/**
+ *  @brief This function reads data from card register
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param reg      Register offset
+ *  @param data     Value
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdiommc_read_reg(moal_handle *handle, t_u32 reg,
+					 t_u32 *data)
+{
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	t_u8 val;
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	val = sdio_readb(((sdio_mmc_card *)handle->card)->func, reg,
+			 (int *)&ret);
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+	*data = val;
+	PRINTM(MREG, "sdio r %x = %x (%x)\n", reg, *data, ret);
+
+	return ret;
+}
+
+/**
+ *  @brief This function writes data into card register
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param reg      Register offset
+ *  @param data     Value
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdio_writeb(moal_handle *handle, t_u32 reg, t_u8 data)
+{
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	sdio_writeb(((sdio_mmc_card *)handle->card)->func, (t_u8)data, reg,
+		    (int *)&ret);
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+	PRINTM(MREG, "sdio w %x = %x (%x)\n", reg, data, ret);
+	return ret;
+}
+
+/**
+ *  @brief This function reads data from card register
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param reg      Register offset
+ *  @param data     Value
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdio_readb(moal_handle *handle, t_u32 reg, t_u8 *data)
+{
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	t_u8 val;
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	val = sdio_readb(((sdio_mmc_card *)handle->card)->func, reg,
+			 (int *)&ret);
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+	*data = val;
+	PRINTM(MREG, "sdio r %x = %x (%x)\n", reg, *data, ret);
+
+	return ret;
+}
+
+/**
+ *  @brief This function reads data from card register FN0
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param reg      Register offset
+ *  @param data     Value
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdio_f0_readb(moal_handle *handle, t_u32 reg,
+				      t_u8 *data)
+{
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	t_u8 val;
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	val = sdio_f0_readb(((sdio_mmc_card *)handle->card)->func, reg,
+			    (int *)&ret);
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+	*data = val;
+	PRINTM(MREG, "sdio f0 r %x = %x (%x)\n", reg, *data, ret);
+
+	return ret;
+}
+
+/**
+ *  @brief This function use SG mode to read/write data into card memory
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param pmbuf_list   Pointer to a linked list of mlan_buffer structure
+ *  @param port     Port
+ *  @param write    write flag
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdio_rw_mb(moal_handle *handle, pmlan_buffer pmbuf_list,
+				   t_u32 port, t_u8 write)
+{
+	struct scatterlist sg_list[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX];
+	int num_sg = pmbuf_list->use_count;
+	int i = 0;
+	mlan_buffer *pmbuf = NULL;
+	struct mmc_request mmc_req;
+	struct mmc_command mmc_cmd;
+	struct mmc_data mmc_dat;
+	struct sdio_func *func = ((sdio_mmc_card *)handle->card)->func;
+	t_u32 ioport = (port & MLAN_SDIO_IO_PORT_MASK);
+	t_u32 blkcnt = pmbuf_list->data_len / MLAN_SDIO_BLOCK_SIZE;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+	int status;
+#endif
+
+	if (num_sg > SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX) {
+		PRINTM(MERROR, "ERROR: num_sg=%d", num_sg);
+		return MLAN_STATUS_FAILURE;
+	}
+	sg_init_table(sg_list, num_sg);
+	pmbuf = pmbuf_list->pnext;
+	for (i = 0; i < num_sg; i++) {
+		if (pmbuf == pmbuf_list)
+			break;
+		sg_set_buf(&sg_list[i], pmbuf->pbuf + pmbuf->data_offset,
+			   pmbuf->data_len);
+		pmbuf = pmbuf->pnext;
+	}
+	memset(&mmc_req, 0, sizeof(struct mmc_request));
+	memset(&mmc_cmd, 0, sizeof(struct mmc_command));
+	memset(&mmc_dat, 0, sizeof(struct mmc_data));
+
+	mmc_dat.sg = sg_list;
+	mmc_dat.sg_len = num_sg;
+	mmc_dat.blksz = MLAN_SDIO_BLOCK_SIZE;
+	mmc_dat.blocks = blkcnt;
+	mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
+
+	mmc_cmd.opcode = SD_IO_RW_EXTENDED;
+	mmc_cmd.arg = write ? 1 << 31 : 0;
+	mmc_cmd.arg |= (func->num & 0x7) << 28;
+	mmc_cmd.arg |= 1 << 27; /* block basic */
+	mmc_cmd.arg |= 0; /* fix address */
+	mmc_cmd.arg |= (ioport & 0x1FFFF) << 9;
+	mmc_cmd.arg |= blkcnt & 0x1FF;
+	mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
+
+	mmc_req.cmd = &mmc_cmd;
+	mmc_req.data = &mmc_dat;
+
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	mmc_set_data_timeout(&mmc_dat,
+			     ((sdio_mmc_card *)handle->card)->func->card);
+	mmc_wait_for_req(((sdio_mmc_card *)handle->card)->func->card->host,
+			 &mmc_req);
+
+	if (mmc_cmd.error || mmc_dat.error) {
+		PRINTM(MERROR, "CMD53 %s cmd_error = %d data_error=%d\n",
+		       write ? "write" : "read", mmc_cmd.error, mmc_dat.error);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+		/* issue abort cmd52 command through F0*/
+		sdio_f0_writeb(((sdio_mmc_card *)handle->card)->func, 0x01,
+			       SDIO_CCCR_ABORT, &status);
+#endif
+		sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+		return MLAN_STATUS_FAILURE;
+	}
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function writes multiple bytes into card memory
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param pmbuf    Pointer to mlan_buffer structure
+ *  @param port     Port
+ *  @param timeout  Time out value
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdiommc_write_data_sync(moal_handle *handle,
+						mlan_buffer *pmbuf, t_u32 port,
+						t_u32 timeout)
+{
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	t_u8 *buffer = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
+	t_u8 blkmode =
+		(port & MLAN_SDIO_BYTE_MODE_MASK) ? BYTE_MODE : BLOCK_MODE;
+	t_u32 blksz = (blkmode == BLOCK_MODE) ? MLAN_SDIO_BLOCK_SIZE : 1;
+	t_u32 blkcnt = (blkmode == BLOCK_MODE) ?
+			       (pmbuf->data_len / MLAN_SDIO_BLOCK_SIZE) :
+			       pmbuf->data_len;
+	t_u32 ioport = (port & MLAN_SDIO_IO_PORT_MASK);
+	int status = 0;
+	if (pmbuf->use_count > 1)
+		return woal_sdio_rw_mb(handle, pmbuf, port, MTRUE);
+#ifdef SDIO_MMC_DEBUG
+	handle->cmd53w = 1;
+#endif
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	status = sdio_writesb(((sdio_mmc_card *)handle->card)->func, ioport,
+			      buffer, blkcnt * blksz);
+	if (!status)
+		ret = MLAN_STATUS_SUCCESS;
+	else {
+		PRINTM(MERROR, "cmd53 write error=%d\n", status);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+		/* issue abort cmd52 command through F0*/
+		sdio_f0_writeb(((sdio_mmc_card *)handle->card)->func, 0x01,
+			       SDIO_CCCR_ABORT, &status);
+#endif
+	}
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+#ifdef SDIO_MMC_DEBUG
+	handle->cmd53w = 2;
+#endif
+	return ret;
+}
+
+/**
+ *  @brief This function reads multiple bytes from card memory
+ *
+ *  @param handle   A Pointer to the moal_handle structure
+ *  @param pmbuf    Pointer to mlan_buffer structure
+ *  @param port     Port
+ *  @param timeout  Time out value
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdiommc_read_data_sync(moal_handle *handle,
+					       mlan_buffer *pmbuf, t_u32 port,
+					       t_u32 timeout)
+{
+	mlan_status ret = MLAN_STATUS_FAILURE;
+	t_u8 *buffer = (t_u8 *)(pmbuf->pbuf + pmbuf->data_offset);
+	t_u8 blkmode =
+		(port & MLAN_SDIO_BYTE_MODE_MASK) ? BYTE_MODE : BLOCK_MODE;
+	t_u32 blksz = (blkmode == BLOCK_MODE) ? MLAN_SDIO_BLOCK_SIZE : 1;
+	t_u32 blkcnt = (blkmode == BLOCK_MODE) ?
+			       (pmbuf->data_len / MLAN_SDIO_BLOCK_SIZE) :
+			       pmbuf->data_len;
+	t_u32 ioport = (port & MLAN_SDIO_IO_PORT_MASK);
+	int status = 0;
+	if (pmbuf->use_count > 1)
+		return woal_sdio_rw_mb(handle, pmbuf, port, MFALSE);
+#ifdef SDIO_MMC_DEBUG
+	handle->cmd53r = 1;
+#endif
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	status = sdio_readsb(((sdio_mmc_card *)handle->card)->func, buffer,
+			     ioport, blkcnt * blksz);
+	if (!status) {
+		ret = MLAN_STATUS_SUCCESS;
+	} else {
+		PRINTM(MERROR, "cmd53 read error=%d\n", status);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+		/* issue abort cmd52 command through F0*/
+		sdio_f0_writeb(((sdio_mmc_card *)handle->card)->func, 0x01,
+			       SDIO_CCCR_ABORT, &status);
+#endif
+	}
+	sdio_release_host(((sdio_mmc_card *)handle->card)->func);
+#ifdef SDIO_MMC_DEBUG
+	handle->cmd53r = 2;
+#endif
+	return ret;
+}
+
+/**
+ *  @brief This function registers the IF module in bus driver
+ *
+ *  @return    MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+mlan_status woal_sdiommc_bus_register(void)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	/* SDIO Driver Registration */
+	if (sdio_register_driver(&wlan_sdio)) {
+		PRINTM(MFATAL, "SDIO Driver Registration Failed \n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* init GPIO PORT for wakeup purpose */
+	GPIO_PORT_INIT();
+	/* set default value */
+	GPIO_PORT_TO_HIGH();
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function de-registers the IF module in bus driver
+ *
+ *  @return         N/A
+ */
+void woal_sdiommc_bus_unregister(void)
+{
+	ENTER();
+
+	/* SDIO Driver Unregistration */
+	sdio_unregister_driver(&wlan_sdio);
+
+	LEAVE();
+}
+
+/**
+ *  @brief This function de-registers the device
+ *
+ *  @param handle A pointer to moal_handle structure
+ *  @return         N/A
+ */
+static void woal_sdiommc_unregister_dev(moal_handle *handle)
+{
+	ENTER();
+	if (handle->card) {
+		sdio_mmc_card *card = handle->card;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+		struct sdio_func *func = card->func;
+#endif
+		/* Release the SDIO IRQ */
+		sdio_claim_host(card->func);
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+		if (moal_extflg_isset(handle, EXT_INTMODE))
+			woal_sdio_release_irq(card);
+		else
+#endif
+			sdio_release_irq(card->func);
+		sdio_disable_func(card->func);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+		if (handle->driver_status)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
+			mmc_hw_reset(func->card);
+#else
+			mmc_hw_reset(func->card->host);
+#endif
+#endif
+		sdio_release_host(card->func);
+
+		sdio_set_drvdata(card->func, NULL);
+
+		GPIO_PORT_TO_LOW();
+		PRINTM(MWARN, "Making the sdio dev card as NULL\n");
+		card->handle = NULL;
+	}
+
+	LEAVE();
+}
+
+/**
+ *  @brief This function registers the device
+ *
+ *  @param handle  A pointer to moal_handle structure
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_sdiommc_register_dev(moal_handle *handle)
+{
+	int ret = MLAN_STATUS_SUCCESS;
+	sdio_mmc_card *card = handle->card;
+	struct sdio_func *func;
+
+	ENTER();
+
+	GPIO_PORT_INIT();
+	GPIO_PORT_TO_HIGH();
+
+	/* save adapter pointer in card */
+	card->handle = handle;
+	func = card->func;
+	sdio_claim_host(func);
+
+	/* Request the SDIO IRQ */
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+	if (moal_extflg_isset(handle, EXT_INTMODE)) {
+		ret = woal_request_gpio(card, card->handle->params.gpiopin);
+		if (ret) {
+			PRINTM(MERROR, "Fail to request gpio\n");
+			goto release_host;
+		}
+		ret = woal_sdio_claim_irq(card, woal_sdio_interrupt);
+	} else
+#endif
+		ret = sdio_claim_irq(func, woal_sdio_interrupt);
+	if (ret) {
+		PRINTM(MFATAL, "sdio_claim_irq failed: ret=%d\n", ret);
+		goto release_host;
+	}
+
+	/* Set block size */
+	ret = sdio_set_block_size(card->func, MLAN_SDIO_BLOCK_SIZE);
+	if (ret) {
+		PRINTM(MERROR,
+		       "sdio_set_block_seize(): cannot set SDIO block size\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto release_irq;
+	}
+
+	sdio_release_host(func);
+	sdio_set_drvdata(func, card);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+
+release_irq:
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+	if (moal_extflg_isset(handle, EXT_INTMODE))
+		woal_sdio_release_irq(card);
+	else
+#endif
+		sdio_release_irq(func);
+release_host:
+	sdio_release_host(func);
+	handle->card = NULL;
+
+	LEAVE();
+	return MLAN_STATUS_FAILURE;
+}
+
+/**
+ *  @brief This function set the sdio bus width
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @param mode     1--1 bit mode, 4--4 bit mode
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+int woal_sdio_set_buswidth(moal_handle *handle, t_u8 bus_width)
+{
+	sdio_mmc_card *cardp = (sdio_mmc_card *)handle->card;
+	struct mmc_host *host = cardp->func->card->host;
+	int ret = 0;
+	t_u8 val;
+
+	ENTER();
+
+	if (bus_width != SDIO_BUS_WIDTH_1 && bus_width != SDIO_BUS_WIDTH_4) {
+		LEAVE();
+		return -EFAULT;
+	}
+	sdio_claim_host(((sdio_mmc_card *)handle->card)->func);
+	val = sdio_f0_readb(((sdio_mmc_card *)handle->card)->func, SDIO_CCCR_IF,
+			    (int *)&ret);
+	val &= ~SDIO_BUS_WIDTH_MASK;
+	if (bus_width == SDIO_BUS_WIDTH_1)
+		host->ios.bus_width = MMC_BUS_WIDTH_1;
+	else {
+		host->ios.bus_width = MMC_BUS_WIDTH_4;
+		val |= SDIO_BUS_WIDTH_4BIT;
+	}
+	sdio_f0_writeb(((sdio_mmc_card *)handle->card)->func, val, SDIO_CCCR_IF,
+		       &ret);
+	sdio_release_host(cardp->func);
+	host->ops->set_ios(host, &host->ios);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function set bus clock on/off
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @param option   TRUE--on , FALSE--off
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+int woal_sdio_set_bus_clock(moal_handle *handle, t_u8 option)
+{
+	sdio_mmc_card *cardp = (sdio_mmc_card *)handle->card;
+	struct mmc_host *host = cardp->func->card->host;
+
+	ENTER();
+	if (option == MTRUE) {
+		/* restore value if non-zero */
+		if (cardp->host_clock)
+			host->ios.clock = cardp->host_clock;
+	} else {
+		/* backup value if non-zero, then clear */
+		if (host->ios.clock)
+			cardp->host_clock = host->ios.clock;
+		host->ios.clock = 0;
+	}
+
+	host->ops->set_ios(host, &host->ios);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function updates card reg based on the Cmd52 value in dev
+ * structure
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @param func     A pointer to store func variable
+ *  @param reg      A pointer to store reg variable
+ *  @param val      A pointer to store val variable
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+int woal_sdio_read_write_cmd52(moal_handle *handle, int func, int reg, int val)
+{
+	int ret = MLAN_STATUS_SUCCESS;
+	sdio_mmc_card *card = (sdio_mmc_card *)handle->card;
+
+	ENTER();
+	/* Save current func and reg for read */
+	handle->cmd52_func = func;
+	handle->cmd52_reg = reg;
+	sdio_claim_host(card->func);
+	if (val >= 0) {
+		/* Perform actual write only if val is provided */
+		if (func)
+			sdio_writeb(card->func, val, reg, &ret);
+		else
+			sdio_f0_writeb(card->func, val, reg, &ret);
+		if (ret) {
+			PRINTM(MERROR,
+			       "Cannot write value (0x%x) to func %d reg 0x%x\n",
+			       val, func, reg);
+		} else {
+			PRINTM(MMSG, "write value (0x%x) to func %d reg 0x%x\n",
+			       (u8)val, func, reg);
+			handle->cmd52_val = val;
+		}
+	} else {
+		if (func)
+			val = sdio_readb(card->func, reg, &ret);
+		else
+			val = sdio_f0_readb(card->func, reg, &ret);
+		if (ret) {
+			PRINTM(MERROR,
+			       "Cannot read value from func %d reg 0x%x\n",
+			       func, reg);
+		} else {
+			PRINTM(MMSG,
+			       "read value (0x%x) from func %d reg 0x%x\n",
+			       (u8)val, func, reg);
+			handle->cmd52_val = val;
+		}
+	}
+	sdio_release_host(card->func);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function check if this is second mac
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @return         MTRUE/MFALSE
+ *
+ */
+static t_u8 woal_sdiommc_is_second_mac(moal_handle *handle)
+{
+#if defined(SDAW693) || defined(SD9098)
+	sdio_mmc_card *card = (sdio_mmc_card *)handle->card;
+#endif
+
+#ifdef SDAW693
+	if (card->func->device == SD_DEVICE_ID_AW693_FN2)
+		return MTRUE;
+#endif
+#ifdef SD9098
+	if (card->func->device == SD_DEVICE_ID_9098_FN2)
+		return MTRUE;
+#endif
+	return MFALSE;
+}
+
+static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+#ifdef SD9098
+	sdio_mmc_card *card = (sdio_mmc_card *)handle->card;
+#endif
+	t_u32 revision_id = 0;
+	t_u32 rev_id_reg = handle->card_info->rev_id_reg;
+
+#if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
+	defined(SD9097) || defined(SDIW624) || defined(SDAW693) ||             \
+	defined(SD8978) || defined(SD9177) || defined(SDIW610)
+	t_u32 magic_reg = handle->card_info->magic_reg;
+	t_u32 magic = 0;
+	t_u32 host_strap_reg = handle->card_info->host_strap_reg;
+	t_u32 strap = 0;
+#endif
+
+	ENTER();
+
+	if (handle->params.fw_name)
+		goto done;
+#ifdef SD8801
+	if (IS_SD8801(handle->card_type))
+		goto done;
+#endif
+	/** Revision ID register */
+	woal_sdiommc_read_reg(handle, rev_id_reg, &revision_id);
+	PRINTM(MCMND, "revision_id=0x%x\n", revision_id);
+
+#if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
+	defined(SD9097) || defined(SDIW624) || defined(SDAW693) ||             \
+	defined(SD8978) || defined(SD9177) || defined(SDIW610)
+	/** Revision ID register */
+	woal_sdiommc_read_reg(handle, magic_reg, &magic);
+	/** Revision ID register */
+	woal_sdiommc_read_reg(handle, host_strap_reg, &strap);
+	strap &= 0x1;
+	magic &= 0xFF;
+	/* 1 = SDSD, 0 --SD UART */
+	PRINTM(MCMND, "magic=0x%x strap=0x%x\n", magic, strap);
+#endif
+#if defined(SD8977)
+	if (IS_SD8977(handle->card_type)) {
+		switch (revision_id) {
+		case SD8977_V0:
+			strncpy(handle->card_info->fw_name, SD8977_V0_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8977_WLAN_V0_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		case SD8977_V1:
+			strncpy(handle->card_info->fw_name, SD8977_V1_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8977_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		case SD8977_V2:
+			strncpy(handle->card_info->fw_name, SD8977_V2_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8977_WLAN_V2_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		default:
+			break;
+		}
+	}
+#endif
+#if defined(SD8887)
+	if (IS_SD8887(handle->card_type)) {
+		/* Check revision ID */
+		switch (revision_id) {
+		case SD8887_A0:
+			strncpy(handle->card_info->fw_name, SD8887_A0_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8887_WLAN_A0_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		case SD8887_A2:
+			strncpy(handle->card_info->fw_name, SD8887_A2_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8887_WLAN_A2_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		default:
+			break;
+		}
+	}
+#endif
+
+#ifdef SD8997
+	if (IS_SD8997(handle->card_type)) {
+		if (magic == CHIP_MAGIC_VALUE) {
+			if (strap == CARD_TYPE_SD_UART)
+				strncpy(handle->card_info->fw_name,
+					SDUART8997_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDSD8997_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		}
+	}
+#endif
+
+#ifdef SD8987
+	if (IS_SD8987(handle->card_type)) {
+		if (magic == CHIP_MAGIC_VALUE) {
+			if (strap == CARD_TYPE_SD_UART)
+				strncpy(handle->card_info->fw_name,
+					SDUART8987_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDSD8987_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		}
+	}
+#endif
+
+#ifdef SD8978
+	if (IS_SD8978(handle->card_type)) {
+		if (magic == CHIP_MAGIC_VALUE) {
+			if (strap == CARD_TYPE_SD_UART)
+				strncpy(handle->card_info->fw_name,
+					SDUART8978_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDSD8978_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		}
+	}
+#endif
+
+#ifdef SD9098
+	if (IS_SD9098(handle->card_type) &&
+	    (card->func->device == SD_DEVICE_ID_9098_FN1)) {
+		switch (revision_id) {
+		case SD9098_Z1Z2:
+			if (magic == CHIP_MAGIC_VALUE) {
+				if (strap == CARD_TYPE_SD_UART)
+					strncpy(handle->card_info->fw_name,
+						SDUART9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
+				else
+					strncpy(handle->card_info->fw_name,
+						SDSD9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
+			}
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9098_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		case SD9098_A0:
+		case SD9098_A1:
+		case SD9098_A2:
+			if (magic == CHIP_MAGIC_VALUE) {
+				if (strap == CARD_TYPE_SD_UART)
+					strncpy(handle->card_info->fw_name,
+						SDUART9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
+				else
+					strncpy(handle->card_info->fw_name,
+						SDSD9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
+			}
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9098_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		default:
+			break;
+		}
+	}
+#endif
+#ifdef SD9097
+	if (IS_SD9097(handle->card_type)) {
+		switch (revision_id) {
+		case SD9097_B0:
+		case SD9097_B1:
+			if (magic == CHIP_MAGIC_VALUE) {
+				if (strap == CARD_TYPE_SD_UART)
+					strncpy(handle->card_info->fw_name,
+						SDUART9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
+				else
+					strncpy(handle->card_info->fw_name,
+						SDSD9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
+			}
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9097_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		default:
+			break;
+		}
+	}
+#endif
+#ifdef SDAW693
+	if (IS_SDAW693(handle->card_type)) {
+		magic &= 0x03;
+		if (magic == 0x03)
+			PRINTM(MMSG, "wlan: SDAW693 in secure-boot mode\n");
+
+		switch (revision_id) {
+		case SDAW693_A0:
+			if (strap == CARD_TYPE_SD_UART)
+				strncpy(handle->card_info->fw_name,
+					SDUARTAW693_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDSDAW693_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SDAW693_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		case SDAW693_A1:
+			if (strap == CARD_TYPE_SD_UART)
+				strncpy(handle->card_info->fw_name,
+					SDUARTAW693_COMBO_V1_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDSDAW693_COMBO_V1_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SDAW693_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
+			if (magic != 0x03) {
+				/* remove extension .se */
+				if (strstr(handle->card_info->fw_name, ".se"))
+					memset(strstr(handle->card_info->fw_name,
+						      ".se"),
+					       '\0', sizeof(".se"));
+				if (strstr(handle->card_info->fw_name_wlan,
+					   ".se"))
+					memset(strstr(handle->card_info
+							      ->fw_name_wlan,
+						      ".se"),
+					       '\0', sizeof(".se"));
+			}
+			break;
+		default:
+			break;
+		}
+	}
+#endif
+
+#ifdef SDIW624
+	if (IS_SDIW624(handle->card_type)) {
+		magic &= 0x03;
+		if (magic == 0x03)
+			PRINTM(MMSG, "wlan: SDIW624 in secure-boot mode\n");
+		if (strap == CARD_TYPE_SDIW624_UARTSPI) {
+			if (handle->params.dual_nb)
+				strncpy(handle->card_info->fw_name,
+					SDUARTSPIIW624_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDUARTIW624_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		} else if (strap == CARD_TYPE_SDIW624_UARTUART) {
+			if (handle->params.dual_nb)
+				strncpy(handle->card_info->fw_name,
+					SDUARTUARTIW624_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDUARTIW624_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		} else {
+			strncpy(handle->card_info->fw_name,
+				SDSDIW624_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
+		}
+	}
+#endif
+
+#ifdef SD9177
+	if (IS_SD9177(handle->card_type)) {
+		switch (revision_id) {
+		case SD9177_A0:
+			if (magic == CHIP_MAGIC_VALUE) {
+				if (strap == CARD_TYPE_SD9177_UART)
+					strncpy(handle->card_info->fw_name,
+						SDUART9177_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
+				else
+					strncpy(handle->card_info->fw_name,
+						SDSD9177_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
+			}
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9177_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
+			break;
+		case SD9177_A1:
+			if (magic == CHIP_MAGIC_VALUE) {
+				if (strap == CARD_TYPE_SD9177_UART) {
+					if (handle->params.rf_test_mode)
+						strncpy(handle->card_info
+								->fw_name,
+							SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
+					else
+						strncpy(handle->card_info
+								->fw_name,
+							SDUART9177_DEFAULT_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
+				} else {
+					if (handle->params.rf_test_mode)
+						strncpy(handle->card_info
+								->fw_name,
+							SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
+					else
+						strncpy(handle->card_info
+								->fw_name,
+							SDSD9177_DEFAULT_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
+				}
+			}
+			if (handle->params.rf_test_mode)
+				strncpy(handle->card_info->fw_name,
+					SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name_wlan,
+					SD9177_DEFAULT_WLAN_V1_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			break;
+		default:
+			break;
+		}
+	}
+#endif
+
+#ifdef SDIW610
+	if (IS_SDIW610(handle->card_type)) {
+		magic &= 0x03;
+		if (magic == 0x03)
+			PRINTM(MMSG, "wlan: SDIW610 in secure-boot mode\n");
+		if (strap == CARD_TYPE_SDIW610_UART) {
+			if (handle->params.dual_nb)
+				strncpy(handle->card_info->fw_name,
+					SDUARTSPIIW610_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					SDUARTIW610_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		}
+		strncpy(handle->card_info->fw_name_wlan,
+			SDIW610_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
+		if (magic != 0x03) {
+			/* remove extension .se */
+			if (strstr(handle->card_info->fw_name, ".se"))
+				memset(strstr(handle->card_info->fw_name,
+					      ".se"),
+				       '\0', sizeof(".se"));
+			if (strstr(handle->card_info->fw_name_wlan, ".se"))
+				memset(strstr(handle->card_info->fw_name_wlan,
+					      ".se"),
+				       '\0', sizeof(".se"));
+		}
+	}
+#endif
+done:
+	PRINTM(MCMND, "combo fw:%s wlan fw:%s \n", handle->card_info->fw_name,
+	       handle->card_info->fw_name_wlan);
+	LEAVE();
+	return ret;
+}
+
+#define DEBUG_FW_DONE 0xFF
+#define DEBUG_MEMDUMP_FINISH 0xFE
+#define MAX_POLL_TRIES 100
+
+#define HOST_TO_CARD_EVENT_REG 0x00
+#define HOST_TO_CARD_EVENT MBIT(3)
+#define HOST_RST_EVENT MBIT(4)
+
+typedef enum {
+	DUMP_TYPE_ITCM = 0,
+	DUMP_TYPE_DTCM = 1,
+	DUMP_TYPE_SQRAM = 2,
+	DUMP_TYPE_APU_REGS = 3,
+	DUMP_TYPE_CIU_REGS = 4,
+	DUMP_TYPE_ICU_REGS = 5,
+	DUMP_TYPE_MAC_REGS = 6,
+	DUMP_TYPE_EXTEND_7 = 7,
+	DUMP_TYPE_EXTEND_8 = 8,
+	DUMP_TYPE_EXTEND_9 = 9,
+	DUMP_TYPE_EXTEND_10 = 10,
+	DUMP_TYPE_EXTEND_11 = 11,
+	DUMP_TYPE_EXTEND_12 = 12,
+	DUMP_TYPE_EXTEND_13 = 13,
+	DUMP_TYPE_EXTEND_LAST = 14
+} dumped_mem_type;
+
+#define MAX_NAME_LEN 8
+
+typedef struct {
+	t_u8 mem_name[MAX_NAME_LEN];
+	t_u8 *mem_Ptr;
+	struct file *pfile_mem;
+	t_u8 done_flag;
+	t_u8 type;
+} memory_type_mapping;
+
+static memory_type_mapping mem_type_mapping_tbl[] = {
+	{"ITCM", NULL, NULL, 0xF0, FW_DUMP_TYPE_MEM_ITCM},
+	{"DTCM", NULL, NULL, 0xF1, FW_DUMP_TYPE_MEM_DTCM},
+	{"SQRAM", NULL, NULL, 0xF2, FW_DUMP_TYPE_MEM_SQRAM},
+	{"APU", NULL, NULL, 0xF3, FW_DUMP_TYPE_REG_APU},
+	{"CIU", NULL, NULL, 0xF4, FW_DUMP_TYPE_REG_CIU},
+	{"ICU", NULL, NULL, 0xF5, FW_DUMP_TYPE_REG_ICU},
+	{"MAC", NULL, NULL, 0xF6, FW_DUMP_TYPE_REG_MAC},
+	{"EXT7", NULL, NULL, 0xF7, 0},
+	{"EXT8", NULL, NULL, 0xF8, 0},
+	{"EXT9", NULL, NULL, 0xF9, 0},
+	{"EXT10", NULL, NULL, 0xFA, 0},
+	{"EXT11", NULL, NULL, 0xFB, 0},
+	{"EXT12", NULL, NULL, 0xFC, 0},
+	{"EXT13", NULL, NULL, 0xFD, 0},
+	{"EXTLAST", NULL, NULL, 0xFE, 0},
+};
+static memory_type_mapping mem_type_mapping_tbl_8977_8997 = {"DUMP", NULL, NULL,
+							     0xDD, 0};
+/**
+ *  @brief This function read/write firmware via cmd52
+ *
+ *  @param phandle   A pointer to moal_handle
+ *  @param doneflag  A flag
+ *  @param trigger   trigger FW dump flag
+ *
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+static rdwr_status woal_cmd52_rdwr_firmware(moal_handle *phandle, t_u8 doneflag,
+					    t_u8 trigger)
+{
+	int ret = 0;
+	int tries = 0;
+	t_u8 ctrl_data = 0;
+	t_u8 dbg_dump_ctrl_reg = phandle->card_info->dump_fw_ctrl_reg;
+	t_u8 debug_host_ready = phandle->card_info->dump_fw_host_ready;
+
+#ifdef SD9177
+	if (IS_SD9177(phandle->card_type)) {
+		if (phandle->event_fw_dump)
+			debug_host_ready = 0xAA;
+	}
+#endif
+	ret = woal_sdio_writeb(phandle, dbg_dump_ctrl_reg, debug_host_ready);
+	if (ret) {
+		PRINTM(MERROR, "SDIO Write ERR\n");
+		return RDWR_STATUS_FAILURE;
+	}
+	if (trigger) {
+		PRINTM(MMSG, "Trigger FW dump...\n");
+		ret = woal_sdio_writeb(phandle, HOST_TO_CARD_EVENT_REG,
+				       HOST_TO_CARD_EVENT);
+		if (ret) {
+			PRINTM(MERROR, "Fail to set HOST_TO_CARD_EVENT_REG\n");
+			return RDWR_STATUS_FAILURE;
+		}
+	}
+
+#ifdef SD9177
+	if (IS_SD9177(phandle->card_type)) {
+		if (phandle->event_fw_dump)
+			return RDWR_STATUS_SUCCESS;
+	}
+#endif
+	for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
+		ret = woal_sdio_readb(phandle, dbg_dump_ctrl_reg, &ctrl_data);
+		if (ret) {
+			PRINTM(MERROR, "SDIO READ ERR\n");
+			return RDWR_STATUS_FAILURE;
+		}
+		if (ctrl_data == DEBUG_FW_DONE)
+			break;
+		if (doneflag && ctrl_data == doneflag)
+			return RDWR_STATUS_DONE;
+		if (ctrl_data != debug_host_ready) {
+			PRINTM(MMSG,
+			       "The ctrl reg was changed, re-try again!\n");
+			ret = woal_sdio_writeb(phandle, dbg_dump_ctrl_reg,
+					       debug_host_ready);
+			if (ret) {
+				PRINTM(MERROR, "SDIO Write ERR\n");
+				return RDWR_STATUS_FAILURE;
+			}
+		}
+		udelay(100);
+	}
+	if (ctrl_data == debug_host_ready || tries == MAX_POLL_TRIES) {
+		PRINTM(MERROR, "Fail to pull ctrl_data\n");
+		return RDWR_STATUS_FAILURE;
+	}
+	return RDWR_STATUS_SUCCESS;
+}
+
+#ifdef SD8801
+#define DEBUG_HOST_READY 0xEE
+#define DEBUG_FW_DONE 0xFF
+#define DEBUG_MEMDUMP_FINISH 0xFE
+#define MAX_POLL_TRIES 100
+#define DEBUG_ITCM_DONE 0xaa
+#define DEBUG_DTCM_DONE 0xbb
+#define DEBUG_SQRAM_DONE 0xcc
+
+#define DEBUG_DUMP_CTRL_REG 0x63
+#define DEBUG_DUMP_FIRST_REG 0x62
+#define DEBUG_DUMP_START_REG 0x64
+#define DEBUG_DUMP_END_REG 0x6a
+#define ITCM_SIZE 0x60000
+#define SQRAM_SIZE 0x33500
+#define DTCM_SIZE 0x14000
+
+/**
+ *  @brief This function dump firmware memory to file
+ *
+ *  @param phandle   A pointer to moal_handle
+ *
+ *  @return         N/A
+ */
+void woal_dump_firmware_info(moal_handle *phandle)
+{
+	int ret = 0;
+	unsigned int reg, reg_start, reg_end;
+#ifndef DUMP_TO_PROC
+	t_u8 path_name[64], file_name[32];
+#endif
+	t_u8 *ITCM_Ptr = NULL;
+	t_u8 *DTCM_Ptr = NULL;
+	t_u8 *SQRAM_Ptr = NULL;
+	t_u8 *dbg_ptr = NULL;
+	t_u32 sec, usec;
+	t_u8 ctrl_data = 0;
+	t_u32 dtcm_size = DTCM_SIZE;
+	t_u32 sqram_size = SQRAM_SIZE;
+	t_u8 *end_ptr = NULL;
+	int tries;
+
+	if (!phandle) {
+		PRINTM(MERROR, "Could not dump firmwware info\n");
+		return;
+	}
+#ifdef DUMP_TO_PROC
+	if (!phandle->fw_dump_buf) {
+		ret = moal_vmalloc(phandle, FW_DUMP_INFO_LEN,
+				   &(phandle->fw_dump_buf));
+		if (ret != MLAN_STATUS_SUCCESS || !phandle->fw_dump_buf) {
+			PRINTM(MERROR, "Failed to vmalloc fw dump bufffer\n");
+			return;
+		}
+	} else {
+		memset(phandle->fw_dump_buf, 0x00, FW_DUMP_INFO_LEN);
+	}
+	phandle->fw_dump_len = 0;
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+	/** Create dump directort*/
+	woal_create_dump_dir(phandle, path_name, sizeof(path_name));
+#else
+	memset(path_name, 0, sizeof(path_name));
+	strncpy(path_name, "/data", sizeof(path_name));
+#endif
+	PRINTM(MMSG, "Directory name is %s\n", path_name);
+	woal_dump_drv_info(phandle, path_name);
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
+	sdio_claim_host(((sdio_mmc_card *)phandle->card)->func);
+#endif
+	/* start dump fw memory	*/
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "==== DEBUG MODE OUTPUT START: %u.%06u ====\n", sec, usec);
+	ret = moal_vmalloc(phandle, ITCM_SIZE + 1, (t_u8 **)&ITCM_Ptr);
+	if ((ret != MLAN_STATUS_SUCCESS) || !ITCM_Ptr) {
+		PRINTM(MERROR, "Error: vmalloc ITCM buffer failed!!!\n");
+		goto done;
+	}
+
+	PRINTM(MMSG, "DTCM_SIZE=0x%x\n", dtcm_size);
+	ret = moal_vmalloc(phandle, dtcm_size + 1, (t_u8 **)&DTCM_Ptr);
+	if ((ret != MLAN_STATUS_SUCCESS) || !DTCM_Ptr) {
+		PRINTM(MERROR, "Error: vmalloc DTCM buffer failed!!!\n");
+		goto done;
+	}
+	ret = moal_vmalloc(phandle, sqram_size + 1, (t_u8 **)&SQRAM_Ptr);
+	if ((ret != MLAN_STATUS_SUCCESS) || !SQRAM_Ptr) {
+		PRINTM(MERROR, "Error: vmalloc SQRAM buffer failed!!!\n");
+		goto done;
+	}
+	dbg_ptr = ITCM_Ptr;
+	end_ptr = ITCM_Ptr + ITCM_SIZE;
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "Start ITCM output %u.%06u, please wait...\n", sec, usec);
+	reg_start = DEBUG_DUMP_START_REG;
+	reg_end = DEBUG_DUMP_END_REG;
+	do {
+		ret = woal_sdio_writeb(phandle, DEBUG_DUMP_CTRL_REG,
+				       DEBUG_HOST_READY);
+		if (ret) {
+			PRINTM(MERROR, "SDIO Write ERR\n");
+			goto done;
+		}
+		for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
+			ret = woal_sdio_readb(phandle, DEBUG_DUMP_CTRL_REG,
+					      &ctrl_data);
+			if (ret) {
+				PRINTM(MERROR, "SDIO READ ERR\n");
+				goto done;
+			}
+			if ((ctrl_data == DEBUG_FW_DONE) ||
+			    (ctrl_data == DEBUG_ITCM_DONE) ||
+			    (ctrl_data == DEBUG_DTCM_DONE) ||
+			    (ctrl_data == DEBUG_SQRAM_DONE))
+				break;
+			if (ctrl_data != DEBUG_HOST_READY) {
+				ret = woal_sdio_writeb(phandle,
+						       DEBUG_DUMP_CTRL_REG,
+						       DEBUG_HOST_READY);
+				if (ret) {
+					PRINTM(MERROR, "SDIO Write ERR\n");
+					goto done;
+				}
+			}
+			udelay(100);
+		}
+		if (ctrl_data == DEBUG_HOST_READY) {
+			PRINTM(MERROR, "Fail to pull ctrl_data\n");
+			goto done;
+		}
+		reg = DEBUG_DUMP_FIRST_REG;
+		ret = woal_sdio_readb(phandle, reg, dbg_ptr);
+		if (ret) {
+			PRINTM(MMSG, "SDIO READ ERR\n");
+			goto done;
+		}
+		if (dbg_ptr < end_ptr)
+			dbg_ptr++;
+		else {
+			PRINTM(MINFO, "pre-allocced buf is not enough\n");
+			goto done;
+		}
+		for (reg = reg_start; reg <= reg_end; reg++) {
+			ret = woal_sdio_readb(phandle, reg, dbg_ptr);
+			if (ret) {
+				PRINTM(MMSG, "SDIO READ ERR\n");
+				goto done;
+			}
+			if (dbg_ptr < end_ptr)
+				dbg_ptr++;
+			else
+				PRINTM(MINFO,
+				       "pre-allocced buf is not enough\n");
+		}
+		switch (ctrl_data) {
+		case DEBUG_ITCM_DONE:
+#ifdef MLAN_64BIT
+			PRINTM(MMSG, "ITCM done: size=0x%lx\n",
+			       dbg_ptr - ITCM_Ptr);
+#else
+			PRINTM(MMSG, "ITCM done: size=0x%x\n",
+			       dbg_ptr - ITCM_Ptr);
+#endif
+#ifdef DUMP_TO_PROC
+			woal_save_dump_info_to_buf(phandle, ITCM_Ptr, ITCM_SIZE,
+						   FW_DUMP_TYPE_MEM_ITCM);
+#else
+			memset(file_name, 0, sizeof(file_name));
+			snprintf(file_name, sizeof(file_name), "%s",
+				 "file_sdio_ITCM");
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_save_dump_info_to_file(path_name, file_name,
+							ITCM_Ptr, ITCM_SIZE))
+				PRINTM(MMSG, "Can't save dump file %s in %s\n",
+				       file_name, path_name);
+#endif
+			dbg_ptr = DTCM_Ptr;
+			end_ptr = DTCM_Ptr + dtcm_size;
+			moal_get_system_time(phandle, &sec, &usec);
+			PRINTM(MMSG,
+			       "Start DTCM output %u.%06u, please wait...\n",
+			       sec, usec);
+			break;
+		case DEBUG_DTCM_DONE:
+#ifdef MLAN_64BIT
+			PRINTM(MMSG, "DTCM done: size=0x%lx\n",
+			       dbg_ptr - DTCM_Ptr);
+#else
+			PRINTM(MMSG, "DTCM done: size=0x%x\n",
+			       dbg_ptr - DTCM_Ptr);
+#endif
+#ifdef DUMP_TO_PROC
+			woal_save_dump_info_to_buf(phandle, ITCM_Ptr, dtcm_size,
+						   FW_DUMP_TYPE_MEM_DTCM);
+#else
+			memset(file_name, 0, sizeof(file_name));
+			snprintf(file_name, sizeof(file_name), "%s",
+				 "file_sdio_DTCM");
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_save_dump_info_to_file(path_name, file_name,
+							DTCM_Ptr, dtcm_size))
+				PRINTM(MMSG, "Can't save dump file %s in %s\n",
+				       file_name, path_name);
+#endif
+			dbg_ptr = SQRAM_Ptr;
+			end_ptr = SQRAM_Ptr + sqram_size;
+			moal_get_system_time(phandle, &sec, &usec);
+			PRINTM(MMSG,
+			       "Start SQRAM output %u.%06u, please wait...\n",
+			       sec, usec);
+			break;
+		case DEBUG_SQRAM_DONE:
+#ifdef MLAN_64BIT
+			PRINTM(MMSG, "SQRAM done: size=0x%lx\n",
+			       dbg_ptr - SQRAM_Ptr);
+#else
+			PRINTM(MMSG, "SQRAM done: size=0x%x\n",
+			       dbg_ptr - SQRAM_Ptr);
+#endif
+#ifdef DUMP_TO_PROC
+			woal_save_dump_info_to_buf(phandle, SQRAM_Ptr,
+						   sqram_size,
+						   FW_DUMP_TYPE_MEM_SQRAM);
+#else
+			memset(file_name, 0, sizeof(file_name));
+			snprintf(file_name, sizeof(file_name), "%s",
+				 "file_sdio_SQRAM");
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_save_dump_info_to_file(path_name, file_name,
+							SQRAM_Ptr, sqram_size))
+				PRINTM(MMSG, "Can't save dump file %s in %s\n",
+				       file_name, path_name);
+#endif
+			PRINTM(MMSG, "End output!\n");
+			break;
+		default:
+			break;
+		}
+	} while (ctrl_data != DEBUG_SQRAM_DONE);
+
+#ifdef DUMP_TO_PROC
+	woal_append_end_block(phandle);
+#endif
+	PRINTM(MMSG,
+	       "The output ITCM/DTCM/SQRAM have been saved to files successfully!\n");
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "==== DEBUG MODE OUTPUT END: %u.%06u ====\n", sec, usec);
+	/* end dump fw memory */
+done:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
+	sdio_release_host(((sdio_mmc_card *)phandle->card)->func);
+#endif
+	if (ITCM_Ptr)
+		moal_vfree(phandle, ITCM_Ptr);
+	if (DTCM_Ptr)
+		moal_vfree(phandle, DTCM_Ptr);
+	if (SQRAM_Ptr)
+		moal_vfree(phandle, SQRAM_Ptr);
+	PRINTM(MMSG, "==== DEBUG MODE END ====\n");
+	return;
+}
+#endif
+
+/**
+ *  @brief This function dump firmware memory to file
+ *
+ *  @param phandle   A pointer to moal_handle
+ *
+ *  @return         N/A
+ */
+void woal_dump_firmware_info_v2(moal_handle *phandle)
+{
+	int ret = 0;
+	unsigned int reg, reg_start, reg_end;
+	t_u8 *dbg_ptr = NULL;
+	t_u32 sec, usec;
+	t_u8 dump_num = 0;
+	t_u8 idx = 0;
+	t_u8 doneflag = 0;
+	rdwr_status stat;
+	t_u8 i = 0;
+	t_u8 read_reg = 0;
+	t_u32 memory_size = 0;
+#ifndef DUMP_TO_PROC
+	t_u8 path_name[64], file_name[32], firmware_dump_file[128];
+#endif
+	t_u8 *end_ptr = NULL;
+	t_u8 dbg_dump_start_reg = 0;
+	t_u8 dbg_dump_end_reg = 0;
+	t_u8 dbg_dump_ctrl_reg = 0;
+
+	if (!phandle) {
+		PRINTM(MERROR, "Could not dump firmwware info\n");
+		return;
+	}
+
+	dbg_dump_start_reg = phandle->card_info->dump_fw_start_reg;
+	dbg_dump_end_reg = phandle->card_info->dump_fw_end_reg;
+	dbg_dump_ctrl_reg = phandle->card_info->dump_fw_ctrl_reg;
+
+#ifdef DUMP_TO_PROC
+	if (!phandle->fw_dump_buf) {
+		ret = moal_vmalloc(phandle, FW_DUMP_INFO_LEN,
+				   &(phandle->fw_dump_buf));
+		if (ret != MLAN_STATUS_SUCCESS || !phandle->fw_dump_buf) {
+			PRINTM(MERROR, "Failed to vmalloc fw dump bufffer\n");
+			return;
+		}
+	} else {
+		memset(phandle->fw_dump_buf, 0x00, FW_DUMP_INFO_LEN);
+	}
+	phandle->fw_dump_len = 0;
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+	/** Create dump directort*/
+	woal_create_dump_dir(phandle, path_name, sizeof(path_name));
+#else
+	memset(path_name, 0, sizeof(path_name));
+	strncpy(path_name, "/data", sizeof(path_name));
+#endif
+	PRINTM(MMSG, "Directory name is %s\n", path_name);
+
+	woal_dump_drv_info(phandle, path_name);
+#endif
+
+	/* start dump fw memory */
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "==== DEBUG MODE OUTPUT START: %u.%06u ====\n", sec, usec);
+	/* read the number of the memories which will dump */
+	if (RDWR_STATUS_FAILURE ==
+	    woal_cmd52_rdwr_firmware(phandle, doneflag, MFALSE)) {
+		if (RDWR_STATUS_FAILURE ==
+		    woal_cmd52_rdwr_firmware(phandle, doneflag, MTRUE))
+			goto done;
+	}
+	reg = dbg_dump_start_reg;
+	ret = woal_sdio_readb(phandle, reg, &dump_num);
+	if (ret) {
+		PRINTM(MMSG, "SDIO READ MEM NUM ERR\n");
+		goto done;
+	}
+
+	/* read the length of every memory which will dump */
+	for (idx = 0; idx < dump_num; idx++) {
+		if (RDWR_STATUS_FAILURE ==
+		    woal_cmd52_rdwr_firmware(phandle, doneflag, MFALSE))
+			goto done;
+		memory_size = 0;
+		reg = dbg_dump_start_reg;
+		for (i = 0; i < 4; i++) {
+			ret = woal_sdio_readb(phandle, reg, &read_reg);
+			if (ret) {
+				PRINTM(MMSG, "SDIO READ ERR\n");
+				goto done;
+			}
+			memory_size |= (read_reg << i * 8);
+			reg++;
+		}
+		if (memory_size == 0) {
+			PRINTM(MMSG, "Firmware Dump Finished!\n");
+			ret = woal_sdiommc_write_reg(phandle, dbg_dump_ctrl_reg,
+						     DEBUG_MEMDUMP_FINISH);
+			if (ret) {
+				PRINTM(MERROR,
+				       "SDIO Write MEMDUMP_FINISH ERR\n");
+				goto done;
+			}
+			break;
+		} else {
+			PRINTM(MMSG, "%s_SIZE=0x%x\n",
+			       mem_type_mapping_tbl[idx].mem_name, memory_size);
+			ret = moal_vmalloc(
+				phandle, memory_size + 1,
+				(t_u8 **)&mem_type_mapping_tbl[idx].mem_Ptr);
+			if ((ret != MLAN_STATUS_SUCCESS) ||
+			    !mem_type_mapping_tbl[idx].mem_Ptr) {
+				PRINTM(MERROR,
+				       "Error: vmalloc %s buffer failed!!!\n",
+				       mem_type_mapping_tbl[idx].mem_name);
+				goto done;
+			}
+			dbg_ptr = mem_type_mapping_tbl[idx].mem_Ptr;
+			end_ptr = dbg_ptr + memory_size;
+		}
+		doneflag = mem_type_mapping_tbl[idx].done_flag;
+		moal_get_system_time(phandle, &sec, &usec);
+		PRINTM(MMSG, "Start %s output %u.%06u, please wait...\n",
+		       mem_type_mapping_tbl[idx].mem_name, sec, usec);
+		do {
+			stat = woal_cmd52_rdwr_firmware(phandle, doneflag,
+							MFALSE);
+			if (RDWR_STATUS_FAILURE == stat)
+				goto done;
+			reg_start = dbg_dump_start_reg;
+			reg_end = dbg_dump_end_reg;
+			for (reg = reg_start; reg <= reg_end; reg++) {
+				ret = woal_sdio_readb(phandle, reg, dbg_ptr);
+				if (ret) {
+					PRINTM(MMSG, "SDIO READ ERR\n");
+					goto done;
+				}
+				if (dbg_ptr < end_ptr)
+					dbg_ptr++;
+				else
+					PRINTM(MINFO,
+					       "pre-allocced buf is not enough\n");
+			}
+			if (RDWR_STATUS_DONE == stat) {
+#ifdef MLAN_64BIT
+				PRINTM(MMSG,
+				       "%s done:"
+				       "size = 0x%lx\n",
+				       mem_type_mapping_tbl[idx].mem_name,
+				       dbg_ptr - mem_type_mapping_tbl[idx]
+							 .mem_Ptr);
+#else
+				PRINTM(MMSG,
+				       "%s done:"
+				       "size = 0x%x\n",
+				       mem_type_mapping_tbl[idx].mem_name,
+				       dbg_ptr - mem_type_mapping_tbl[idx]
+							 .mem_Ptr);
+#endif
+#ifdef DUMP_TO_PROC
+				woal_save_dump_info_to_buf(
+					phandle,
+					mem_type_mapping_tbl[idx].mem_Ptr,
+					memory_size,
+					mem_type_mapping_tbl[idx].type);
+#else
+				memset(file_name, 0, sizeof(file_name));
+				snprintf(file_name, sizeof(file_name), "%s%s",
+					 "file_sdio_",
+					 mem_type_mapping_tbl[idx].mem_name);
+				if (MLAN_STATUS_SUCCESS !=
+				    woal_save_dump_info_to_file(
+					    path_name, file_name,
+					    mem_type_mapping_tbl[idx].mem_Ptr,
+					    memory_size))
+					PRINTM(MERROR,
+					       "Can't save dump file %s in %s\n",
+					       file_name, path_name);
+#endif
+				moal_vfree(phandle,
+					   mem_type_mapping_tbl[idx].mem_Ptr);
+				mem_type_mapping_tbl[idx].mem_Ptr = NULL;
+				break;
+			}
+		} while (1);
+	}
+#ifdef DUMP_TO_PROC
+	woal_append_end_block(phandle);
+#endif
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "==== DEBUG MODE OUTPUT END: %u.%06u ====\n", sec, usec);
+	/* end dump fw memory */
+#ifndef DUMP_TO_PROC
+	memset(firmware_dump_file, 0, sizeof(firmware_dump_file));
+	snprintf(firmware_dump_file, sizeof(firmware_dump_file), "%s/%s",
+		 path_name, file_name);
+	moal_memcpy_ext(phandle, phandle->firmware_dump_file,
+			firmware_dump_file, sizeof(firmware_dump_file),
+			sizeof(phandle->firmware_dump_file));
+#endif
+done:
+	for (idx = 0; idx < dump_num; idx++) {
+		if (mem_type_mapping_tbl[idx].mem_Ptr) {
+			moal_vfree(phandle, mem_type_mapping_tbl[idx].mem_Ptr);
+			mem_type_mapping_tbl[idx].mem_Ptr = NULL;
+		}
+	}
+	PRINTM(MMSG, "==== DEBUG MODE END ====\n");
+	return;
+}
+
+static void woal_trigger_nmi_on_no_dump_event(moal_handle *phandle)
+{
+	int ret = 0;
+	t_u8 ctrl_data = 0;
+	t_u8 dbg_dump_ctrl_reg = phandle->card_info->dump_fw_ctrl_reg;
+	phandle->init_wait_q_woken = MFALSE;
+	ret = woal_sdio_readb(phandle, dbg_dump_ctrl_reg, &ctrl_data);
+	if (ctrl_data == 0xAA) {
+		ret = wait_event_timeout(phandle->init_wait_q,
+					 phandle->init_wait_q_woken, 2 * HZ);
+		if (!ret) {
+			PRINTM(MMSG, "Trigger NMI FW dump...\n");
+			ret = woal_sdio_writeb(phandle, HOST_TO_CARD_EVENT_REG,
+					       HOST_RST_EVENT);
+		}
+	}
+}
+
+/**
+ *  @brief This function dump firmware memory to file
+ *
+ *  @param phandle   A pointer to moal_handle
+ *
+ *  @return         N/A
+ */
+void woal_dump_firmware_info_v3(moal_handle *phandle)
+{
+	int ret = 0;
+	int tries = 0;
+	unsigned int reg, reg_start, reg_end;
+	t_u8 *dbg_ptr = NULL;
+	t_u8 *temp_Ptr = NULL;
+	t_u32 sec, usec;
+	t_u8 start_flag = 0;
+	t_u8 doneflag = 0;
+	rdwr_status stat;
+	t_u32 memory_size = 0;
+#ifndef DUMP_TO_PROC
+	t_u8 path_name[64], file_name[32], firmware_dump_file[128];
+	moal_handle *ref_handle;
+#endif
+	t_u8 *end_ptr = NULL;
+	t_u8 dbg_dump_start_reg = 0;
+	t_u8 dbg_dump_end_reg = 0;
+	memory_type_mapping *pmem_type_mapping_tbl =
+		&mem_type_mapping_tbl_8977_8997;
+
+	if (!phandle) {
+		PRINTM(MERROR, "Could not dump firmwware info\n");
+		return;
+	}
+#ifdef SD9177
+	if (IS_SD9177(phandle->card_type)) {
+		if (phandle->event_fw_dump) {
+			if (RDWR_STATUS_FAILURE !=
+			    woal_cmd52_rdwr_firmware(phandle, doneflag,
+						     MFALSE)) {
+				PRINTM(MMSG,
+				       "====SDIO FW DUMP EVENT MODE START ====\n");
+				return;
+			}
+			if (RDWR_STATUS_FAILURE !=
+			    woal_cmd52_rdwr_firmware(phandle, doneflag,
+						     MTRUE)) {
+				PRINTM(MMSG,
+				       "====SDIO FW DUMP EVENT MODE START ====\n");
+				return;
+			}
+		}
+	}
+#endif
+
+	dbg_dump_start_reg = phandle->card_info->dump_fw_start_reg;
+	dbg_dump_end_reg = phandle->card_info->dump_fw_end_reg;
+
+#ifndef DUMP_TO_PROC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+	/** Create dump directort*/
+	woal_create_dump_dir(phandle, path_name, sizeof(path_name));
+#else
+	memset(path_name, 0, sizeof(path_name));
+	strncpy(path_name, "/data", sizeof(path_name));
+#endif
+	PRINTM(MMSG, "Directory name is %s\n", path_name);
+	ref_handle = (moal_handle *)phandle->pref_mac;
+	if (ref_handle)
+		woal_dump_drv_info(ref_handle, path_name);
+	woal_dump_drv_info(phandle, path_name);
+#endif
+
+	/* start dump fw memory */
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "==== DEBUG MODE OUTPUT START: %u.%06u ====\n", sec, usec);
+	/* read the number of the memories which will dump */
+	if (RDWR_STATUS_FAILURE ==
+	    woal_cmd52_rdwr_firmware(phandle, doneflag, MFALSE)) {
+		if (RDWR_STATUS_FAILURE ==
+		    woal_cmd52_rdwr_firmware(phandle, doneflag, MTRUE))
+			goto done;
+	}
+
+	/** check the reg which indicate dump starting */
+	for (reg = dbg_dump_start_reg; reg <= dbg_dump_end_reg; reg++) {
+		for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
+			ret = woal_sdio_readb(phandle, reg, &start_flag);
+			if (ret) {
+				PRINTM(MMSG, "SDIO READ ERR\n");
+				goto done;
+			}
+			/** 0 means dump starting*/
+			if (start_flag == 0)
+				break;
+			udelay(100);
+		}
+		if (tries == MAX_POLL_TRIES) {
+			PRINTM(MMSG, "FW not ready to dump\n");
+			goto done;
+		}
+	}
+	memory_size = 0xF0000;
+	PRINTM(MMSG, "%s_SIZE=0x%x\n", pmem_type_mapping_tbl->mem_name,
+	       memory_size);
+	ret = moal_vmalloc(phandle, memory_size + 1,
+			   (t_u8 **)&pmem_type_mapping_tbl->mem_Ptr);
+	if ((ret != MLAN_STATUS_SUCCESS) || !pmem_type_mapping_tbl->mem_Ptr) {
+		PRINTM(MERROR, "Error: vmalloc %s buffer failed!!!\n",
+		       pmem_type_mapping_tbl->mem_name);
+		goto done;
+	}
+	dbg_ptr = pmem_type_mapping_tbl->mem_Ptr;
+	end_ptr = dbg_ptr + memory_size;
+	doneflag = pmem_type_mapping_tbl->done_flag;
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "Start %s output %u.%06u, please wait...\n",
+	       pmem_type_mapping_tbl->mem_name, sec, usec);
+	do {
+		stat = woal_cmd52_rdwr_firmware(phandle, doneflag, MFALSE);
+		if (RDWR_STATUS_FAILURE == stat)
+			goto done;
+		reg_start = dbg_dump_start_reg;
+		reg_end = dbg_dump_end_reg;
+		for (reg = reg_start; reg <= reg_end; reg++) {
+			ret = woal_sdio_readb(phandle, reg, dbg_ptr);
+			if (ret) {
+				PRINTM(MMSG, "SDIO READ ERR\n");
+				goto done;
+			}
+			dbg_ptr++;
+			if (dbg_ptr >= end_ptr) {
+				PRINTM(MINFO,
+				       "pre-allocced buf is not enough\n");
+
+				ret = moal_vmalloc(phandle,
+						   memory_size + 0x2000 + 1,
+						   (t_u8 **)&temp_Ptr);
+				if ((ret != MLAN_STATUS_SUCCESS) || !temp_Ptr) {
+					PRINTM(MERROR,
+					       "Error: vmalloc  buffer failed!!!\n");
+					goto done;
+				}
+
+				moal_memcpy_ext(phandle, temp_Ptr,
+						pmem_type_mapping_tbl->mem_Ptr,
+						memory_size,
+						memory_size + 0x2000);
+				moal_vfree(phandle,
+					   pmem_type_mapping_tbl->mem_Ptr);
+				pmem_type_mapping_tbl->mem_Ptr = temp_Ptr;
+				temp_Ptr = NULL;
+				dbg_ptr = pmem_type_mapping_tbl->mem_Ptr +
+					  memory_size;
+
+				memory_size += 0x2000;
+				end_ptr = pmem_type_mapping_tbl->mem_Ptr +
+					  memory_size;
+			}
+		}
+		if (RDWR_STATUS_DONE == stat) {
+#ifdef MLAN_64BIT
+			PRINTM(MMSG,
+			       "%s done:"
+			       "size = 0x%lx\n",
+			       pmem_type_mapping_tbl->mem_name,
+			       dbg_ptr - pmem_type_mapping_tbl->mem_Ptr);
+#else
+			PRINTM(MMSG,
+			       "%s done:"
+			       "size = 0x%x\n",
+			       pmem_type_mapping_tbl->mem_name,
+			       dbg_ptr - pmem_type_mapping_tbl->mem_Ptr);
+
+#endif
+#ifdef DUMP_TO_PROC
+			if (phandle->fw_dump_buf) {
+				moal_vfree(phandle, phandle->fw_dump_buf);
+				phandle->fw_dump_buf = NULL;
+				phandle->fw_dump_len = 0;
+			}
+			phandle->fw_dump_buf = pmem_type_mapping_tbl->mem_Ptr;
+			phandle->fw_dump_len =
+				dbg_ptr - pmem_type_mapping_tbl->mem_Ptr;
+			pmem_type_mapping_tbl->mem_Ptr = NULL;
+#else
+			memset(file_name, 0, sizeof(file_name));
+			snprintf(file_name, sizeof(file_name), "%s%s",
+				 "file_sdio_", pmem_type_mapping_tbl->mem_name);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_save_dump_info_to_file(
+				    path_name, file_name,
+				    pmem_type_mapping_tbl->mem_Ptr,
+				    dbg_ptr - pmem_type_mapping_tbl->mem_Ptr))
+				PRINTM(MERROR,
+				       "Can't save dump file %s in %s\n",
+				       file_name, path_name);
+			moal_vfree(phandle, pmem_type_mapping_tbl->mem_Ptr);
+			pmem_type_mapping_tbl->mem_Ptr = NULL;
+#endif
+			break;
+		}
+	} while (1);
+	moal_get_system_time(phandle, &sec, &usec);
+	PRINTM(MMSG, "==== DEBUG MODE OUTPUT END: %u.%06u ====\n", sec, usec);
+	/* end dump fw memory */
+#ifndef DUMP_TO_PROC
+	memset(firmware_dump_file, 0, sizeof(firmware_dump_file));
+	snprintf(firmware_dump_file, sizeof(firmware_dump_file), "%s/%s",
+		 path_name, file_name);
+	moal_memcpy_ext(phandle, phandle->firmware_dump_file,
+			firmware_dump_file, sizeof(firmware_dump_file),
+			sizeof(phandle->firmware_dump_file));
+#endif
+done:
+	if (pmem_type_mapping_tbl->mem_Ptr) {
+		moal_vfree(phandle, pmem_type_mapping_tbl->mem_Ptr);
+		pmem_type_mapping_tbl->mem_Ptr = NULL;
+	}
+	PRINTM(MMSG, "==== DEBUG MODE END ====\n");
+	return;
+}
+
+/**
+ *  @brief This function reads and displays SDIO registers for debugging
+ *
+ *  @param phandle  A pointer to moal_handle
+ *
+ *  @return         N/A
+ */
+static void woal_sdiommc_reg_dbg(moal_handle *phandle)
+{
+	int ret = 0;
+	t_u8 loop, index = 0, func, data;
+	unsigned int reg, reg_start, reg_end;
+	unsigned int scratch_reg = phandle->card_info->scratch_reg;
+	t_u8 *reg_table = phandle->card_info->dump_reg.reg_table;
+	t_u8 reg_table_size = phandle->card_info->dump_reg.reg_table_size;
+	char buf[256], *ptr;
+
+	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
+
+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		ret = woal_sdio_readb(phandle, reg, &data);
+		if (!ret && data) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", data);
+		}
+	}
+
+	for (loop = 0; loop < 5; loop++) {
+		memset(buf, 0, sizeof(buf));
+		ptr = buf;
+		if (loop == 0) {
+			/* Read the registers of SDIO function0 */
+			func = loop;
+			reg_start = 0;
+			reg_end = 9;
+		} else if (loop == 1) {
+			/* Read the registers of SDIO function1 */
+			func = loop;
+			reg_start = phandle->card_info->func1_reg_start;
+			reg_end = phandle->card_info->func1_reg_end;
+		} else if (loop == 2) {
+			/* Read specific registers of SDIO function1 */
+			index = 0;
+			func = 1;
+			reg_start = reg_table[index++];
+			reg_end = reg_table[reg_table_size - 1];
+		} else {
+			/* Read the scratch registers of SDIO function1 */
+			if (loop == 4)
+				mdelay(100);
+			func = 1;
+			reg_start = scratch_reg;
+			reg_end = scratch_reg + 23;
+		}
+		if (loop != 2)
+			ptr += snprintf(ptr, sizeof(buf),
+					"SDIO Func%d (%#x-%#x): ", func,
+					reg_start, reg_end);
+		else
+			ptr += snprintf(ptr, sizeof(buf),
+					"SDIO Func%d: ", func);
+		for (reg = reg_start; reg <= reg_end;) {
+			if (func == 0)
+				ret = woal_sdio_f0_readb(phandle, reg, &data);
+			else
+				ret = woal_sdio_readb(phandle, reg, &data);
+			if (loop == 2)
+				ptr += snprintf(ptr, sizeof(buf), "(%#x) ",
+						reg);
+			if (!ret)
+				ptr += snprintf(ptr, sizeof(buf), "%02x ",
+						data);
+			else {
+				ptr += snprintf(ptr, sizeof(buf), "ERR");
+				break;
+			}
+			if (loop == 2 && reg < reg_end)
+				reg = reg_table[index++];
+			else
+				reg++;
+		}
+		PRINTM(MMSG, "%s\n", buf);
+	}
+	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
+}
+
+/**
+ *  @brief This function dump firmware memory to file
+ *
+ *  @param phandle   A pointer to moal_handle
+ *
+ *  @return         N/A
+ */
+static void woal_sdiommc_dump_fw_info(moal_handle *phandle)
+{
+	if (!phandle) {
+		PRINTM(MERROR, "Could not dump firmwware info\n");
+		return;
+	}
+#ifdef DUMP_TO_PROC
+	if (phandle->fw_dump_buf) {
+		PRINTM(MMSG, "FW dump already exist, free existing dump\n");
+		moal_vfree(phandle, phandle->fw_dump_buf);
+		phandle->fw_dump_buf = NULL;
+		phandle->fw_dump_len = 0;
+	}
+#endif
+	/** cancel all pending commands */
+	mlan_ioctl(phandle->pmlan_adapter, NULL);
+
+	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
+	phandle->fw_dump = MTRUE;
+	if (phandle->card_info->dump_fw_info == DUMP_FW_SDIO_V2) {
+		woal_dump_firmware_info_v2(phandle);
+	} else if (phandle->card_info->dump_fw_info == DUMP_FW_SDIO_V3) {
+		woal_dump_firmware_info_v3(phandle);
+		if (phandle->event_fw_dump) {
+			woal_trigger_nmi_on_no_dump_event(phandle);
+			queue_work(phandle->workqueue, &phandle->main_work);
+			phandle->is_fw_dump_timer_set = MTRUE;
+			woal_mod_timer(&phandle->fw_dump_timer, MOAL_TIMER_5S);
+			return;
+		}
+	}
+#ifdef SD8801
+	else {
+		woal_dump_firmware_info(phandle);
+	}
+#endif
+	phandle->fw_dump = MFALSE;
+	woal_sdiommc_reg_dbg(phandle);
+	if (!phandle->priv_num)
+		return;
+	woal_send_fw_dump_complete_event(
+		woal_get_priv(phandle, MLAN_BSS_ROLE_ANY));
+	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
+	queue_work(phandle->workqueue, &phandle->main_work);
+	woal_process_hang(phandle);
+	return;
+}
+
+/**
+ *  @brief This function save sdio reg info
+ *
+ *  @param phandle   A pointer to moal_handle
+ *  @param buf       A pointer buffer saving log
+ *
+ *  @return          The length of this log
+ */
+static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)
+{
+	char *drv_ptr = (char *)drv_buf;
+	int ret = 0;
+	t_u8 loop, index = 0, func, data;
+	unsigned int reg, reg_start, reg_end;
+	unsigned int scratch_reg = 0;
+	t_u8 *reg_table = NULL;
+	t_u8 reg_table_size = 0;
+	char buf[256], *ptr;
+
+	ENTER();
+
+	if (!phandle || !drv_buf) {
+		PRINTM(MMSG, "%s: can't retreive info\n", __func__);
+		LEAVE();
+		return 0;
+	}
+
+	scratch_reg = phandle->card_info->scratch_reg;
+	reg_table = phandle->card_info->dump_reg.reg_table;
+	reg_table_size = phandle->card_info->dump_reg.reg_table_size;
+
+	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
+
+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		ret = woal_sdio_readb(phandle, reg, &data);
+		if (!ret && data) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", data);
+			drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN,
+					    "FW in debug mode (0x%x)\n", data);
+		}
+	}
+
+	drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN,
+			    "--------sdio_reg_debug_info---------\n");
+	for (loop = 0; loop < 5; loop++) {
+		memset(buf, 0, sizeof(buf));
+		ptr = buf;
+		if (loop == 0) {
+			/* Read the registers of SDIO function0 */
+			func = loop;
+			reg_start = 0;
+			reg_end = 9;
+
+		} else if (loop == 1) {
+			/* Read the registers of SDIO function1 */
+			func = loop;
+			reg_start = phandle->card_info->func1_reg_start;
+			reg_end = phandle->card_info->func1_reg_end;
+		} else if (loop == 2) {
+			/* Read specific registers of SDIO function1 */
+			index = 0;
+			func = 1;
+			reg_start = reg_table[index++];
+			reg_end = reg_table[reg_table_size - 1];
+		} else {
+			/* Read the scratch registers of SDIO function1 */
+			if (loop == 4)
+				mdelay(100);
+			func = 1;
+			reg_start = scratch_reg;
+			reg_end = scratch_reg + 10;
+		}
+		if (loop != 2)
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"SDIO Func%d (%#x-%#x): ", func,
+					reg_start, reg_end);
+		else
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"SDIO Func%d: ", func);
+		for (reg = reg_start; reg <= reg_end;) {
+			if (func == 0)
+				ret = woal_sdio_f0_readb(phandle, reg, &data);
+			else
+				ret = woal_sdio_readb(phandle, reg, &data);
+
+			if (loop == 2)
+				ptr += snprintf(ptr, MAX_BUF_LEN, "(%#x) ",
+						reg);
+			if (!ret)
+				ptr += snprintf(ptr, MAX_BUF_LEN, "%02x ",
+						data);
+			else {
+				ptr += snprintf(ptr, MAX_BUF_LEN, "ERR");
+				break;
+			}
+			if (loop == 2 && reg < reg_end)
+				reg = reg_table[index++];
+			else
+				reg++;
+		}
+		drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN, "%s\n", buf);
+	}
+
+	drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN,
+			    "--------sdio_reg_debug_info End---------\n");
+	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
+
+	LEAVE();
+	return (int)(drv_ptr - (char *)drv_buf);
+}
+
+/**
+ *  @brief This function reset sdio through sdio bus driver
+ *
+ *  @param phandle   A pointer to moal_handle
+ *
+ *  @return          N/A
+ */
+void woal_sdio_reset_hw(moal_handle *handle)
+{
+	sdio_mmc_card *card = handle->card;
+	struct sdio_func *func = card->func;
+	ENTER();
+	sdio_claim_host(func);
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+	if (moal_extflg_isset(handle, EXT_INTMODE))
+		woal_sdio_release_irq(card);
+	else
+#endif
+		sdio_release_irq(card->func);
+	sdio_disable_func(card->func);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
+	mmc_hw_reset(func->card);
+#else
+	mmc_hw_reset(func->card->host);
+#endif
+#endif
+
+#ifdef MMC_QUIRK_BLKSZ_FOR_BYTE_MODE
+	/* The byte mode patch is available in kernel MMC driver
+	 * which fixes one issue in MP-A transfer.
+	 * bit1: use func->cur_blksize for byte mode
+	 */
+	func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+	/* wait for chip fully wake up */
+	if (!func->enable_timeout)
+		func->enable_timeout = 200;
+#endif
+	sdio_enable_func(func);
+#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0)
+	if (moal_extflg_isset(handle, EXT_INTMODE))
+		woal_sdio_claim_irq(card, woal_sdio_interrupt);
+	else
+#endif
+		sdio_claim_irq(func, woal_sdio_interrupt);
+	sdio_set_block_size(card->func, MLAN_SDIO_BLOCK_SIZE);
+	sdio_release_host(func);
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function check fw winner status
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *
+ *  @return        1--success, otherwise failure
+ */
+static BOOLEAN woal_sdiommc_check_winner_status(moal_handle *handle)
+{
+	t_u32 value = 1;
+	t_u32 winner_status_reg = handle->card_info->fw_winner_status_reg;
+
+	ENTER();
+#ifdef SD8801
+	if (IS_SD8801(handle->card_type)) {
+		LEAVE();
+		return MTRUE;
+	}
+#endif
+	handle->ops.read_reg(handle, winner_status_reg, &value);
+	LEAVE();
+	return (value == 0);
+}
+
+/**
+ *  @brief This function reload fw
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *
+ *  @return        0--success, otherwise failure
+ */
+static int woal_sdiommc_reset_fw(moal_handle *handle)
+{
+	int ret = 0, tries = 0;
+	t_u32 value = 1;
+	t_u32 reset_reg = handle->card_info->fw_reset_reg;
+	t_u8 reset_val = handle->card_info->fw_reset_val;
+	t_u32 wakeup_reg = handle->card_info->fw_wakeup_reg;
+	t_u8 wakeup_val = handle->card_info->fw_wakeup_val;
+
+	ENTER();
+	/** write power up bit to wakeu device */
+	if (handle->ops.write_reg(handle, wakeup_reg, wakeup_val) !=
+	    MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to write wakeup register.\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	udelay(4000);
+	/** wait SOC fully wake up */
+	for (tries = 0; tries < MAX_POLL_TRIES; ++tries) {
+		ret = handle->ops.write_reg(handle, reset_reg, 0xba);
+		if (ret == MLAN_STATUS_SUCCESS) {
+			handle->ops.read_reg(handle, reset_reg, &value);
+			if (value == 0xba) {
+				PRINTM(MMSG, "FW wake up\n");
+				break;
+			}
+		}
+		udelay(1000);
+	}
+	/* Write register to notify FW */
+	if (handle->ops.write_reg(handle, reset_reg, reset_val) !=
+	    MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to write reset register.\n");
+		ret = -EFAULT;
+		goto done;
+	}
+#if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
+	defined(SDAW693) || defined(SD9177) || defined(SDIW610)
+	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
+	    IS_SDIW624(handle->card_type) || IS_SD9177(handle->card_type) ||
+	    IS_SDIW610(handle->card_type) || IS_SDAW693(handle->card_type))
+		handle->ops.write_reg(handle, 0x00, 0x10);
+#endif
+	/* Poll register around 100 ms */
+	for (tries = 0; tries < MAX_POLL_TRIES; ++tries) {
+		handle->ops.read_reg(handle, reset_reg, &value);
+		if (value == 0)
+			/* FW is ready */
+			break;
+		udelay(1000);
+	}
+
+	if (value) {
+		PRINTM(MERROR, "Failed to poll FW reset register %X=0x%x\n",
+		       reset_reg, value);
+		ret = -EFAULT;
+		goto done;
+	} else {
+		for (tries = 0; tries < 1000; ++tries) {
+			if (woal_sdiommc_check_winner_status(handle)) {
+				break;
+			}
+			udelay(1000);
+		}
+	}
+	PRINTM(MMSG, "SDIO Trigger FW In-band Reset success");
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief Function to process pre/post SDIO function level reset
+ *
+ * @param handle    A pointer to moal_handle structure
+ * @param prepare   True :- its a prepare reset
+ *		    False :- its a post reset
+ * @param flr       True: flag for wifi-only firmware
+ *
+ * Note: This function is mix of woal_switch_drv_mode() and
+ * remove_card(). Idea is to cleanup the software only.
+ * post reset: add_card()
+ *
+ * @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_do_sdiommc_flr(moal_handle *handle, bool prepare,
+				       bool flr_flag)
+{
+	unsigned int i;
+	int index = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	moal_private *priv = NULL;
+	int fw_serial_bkp = 0;
+	sdio_mmc_card *card = NULL;
+
+	ENTER();
+
+	if (!handle) {
+		PRINTM(MINFO, "\n Handle null during prepare=%d\n", prepare);
+		LEAVE();
+		return status;
+	}
+	card = (sdio_mmc_card *)handle->card;
+	if (MOAL_ACQ_SEMAPHORE_BLOCK(&AddRemoveCardSem))
+		goto exit_sem_err;
+
+	if (!prepare)
+		goto perform_init;
+
+	if (!(handle->pmlan_adapter)) {
+		PRINTM(MINFO, "\n Handle null 2 during prepare=%d\n", prepare);
+		LEAVE();
+		return status;
+	}
+
+	/* Reset all interfaces */
+	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
+	mlan_disable_host_int(handle->pmlan_adapter);
+	woal_reset_intf(priv, MOAL_IOCTL_WAIT, MTRUE);
+	woal_clean_up(handle);
+	mlan_ioctl(handle->pmlan_adapter, NULL);
+
+	/* Shutdown firmware */
+	handle->init_wait_q_woken = MFALSE;
+	status = mlan_shutdown_fw(handle->pmlan_adapter);
+
+	if (status == MLAN_STATUS_PENDING)
+		wait_event_interruptible(handle->init_wait_q,
+					 handle->init_wait_q_woken);
+
+	if (atomic_read(&handle->rx_pending) ||
+	    atomic_read(&handle->tx_pending) ||
+	    atomic_read(&handle->ioctl_pending)) {
+		PRINTM(MERROR,
+		       "ERR: rx_pending=%d,tx_pending=%d,ioctl_pending=%d\n",
+		       atomic_read(&handle->rx_pending),
+		       atomic_read(&handle->tx_pending),
+		       atomic_read(&handle->ioctl_pending));
+	}
+
+	unregister_inetaddr_notifier(&handle->woal_notifier);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+#if IS_ENABLED(CONFIG_IPV6)
+	unregister_inet6addr_notifier(&handle->woal_inet6_notifier);
+#endif
+#endif
+
+#ifdef WIFI_DIRECT_SUPPORT
+#if defined(STA_CFG80211) && defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= WIFI_DIRECT_KERNEL_VERSION
+	/* Remove virtual interface */
+	woal_remove_virtual_interface(handle);
+#endif
+#endif
+#endif
+	/* Remove interface */
+	for (i = 0; i < handle->priv_num; i++)
+		woal_remove_interface(handle, i);
+	handle->priv_num = 0;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	/* Unregister wiphy device and free */
+	if (handle->wiphy) {
+		wiphy_unregister(handle->wiphy);
+		woal_cfg80211_free_bands(handle->wiphy);
+		wiphy_free(handle->wiphy);
+		handle->wiphy = NULL;
+	}
+#endif
+	/* Unregister mlan */
+	if (handle->pmlan_adapter) {
+		mlan_unregister(handle->pmlan_adapter);
+		if (atomic_read(&handle->lock_count) ||
+		    atomic_read(&handle->malloc_count) ||
+		    atomic_read(&handle->mbufalloc_count)) {
+			PRINTM(MERROR,
+			       "mlan has memory leak: lock_count=%d,"
+			       " malloc_count=%d, mbufalloc_count=%d\n",
+			       atomic_read(&handle->lock_count),
+			       atomic_read(&handle->malloc_count),
+			       atomic_read(&handle->mbufalloc_count));
+		}
+		handle->pmlan_adapter = NULL;
+	}
+	handle->fw_dump = MFALSE;
+
+	goto exit;
+
+perform_init:
+	handle->priv_num = 0;
+
+	/* Init SW */
+	if (woal_init_sw(handle)) {
+		PRINTM(MFATAL, "Software Init Failed\n");
+		goto err_init_fw;
+	}
+	/* Init FW and HW */
+	/* Load wlan only binary */
+	if (flr_flag) {
+		fw_serial_bkp = moal_extflg_isset(handle, EXT_FW_SERIAL);
+		moal_extflg_clear(handle, EXT_FW_SERIAL);
+		woal_update_firmware_name(handle);
+	}
+	if (woal_init_fw(handle)) {
+		PRINTM(MFATAL, "Firmware Init Failed\n");
+		woal_sdiommc_reg_dbg(handle);
+		if (fw_serial_bkp)
+			moal_extflg_set(handle, EXT_FW_SERIAL);
+		goto err_init_fw;
+	}
+	if (flr_flag && fw_serial_bkp)
+		moal_extflg_set(handle, EXT_FW_SERIAL);
+exit:
+	MOAL_REL_SEMAPHORE(&AddRemoveCardSem);
+
+exit_sem_err:
+	LEAVE();
+	return status;
+
+err_init_fw:
+	if (handle->is_fw_dump_timer_set) {
+		woal_cancel_timer(&handle->fw_dump_timer);
+		handle->is_fw_dump_timer_set = MFALSE;
+	}
+
+	if ((handle->hardware_status == HardwareStatusFwReady) ||
+	    (handle->hardware_status == HardwareStatusReady)) {
+		PRINTM(MINFO, "shutdown mlan\n");
+		handle->init_wait_q_woken = MFALSE;
+		status = mlan_shutdown_fw(handle->pmlan_adapter);
+		if (status == MLAN_STATUS_PENDING)
+			wait_event_interruptible(handle->init_wait_q,
+						 handle->init_wait_q_woken);
+	}
+#ifdef ANDROID_KERNEL
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+	wakeup_source_trash(&handle->ws);
+#else
+	wake_lock_destroy(&handle->wake_lock);
+#endif
+#endif
+#ifdef CONFIG_PROC_FS
+	woal_proc_exit(handle);
+#endif
+	/* Unregister device */
+	PRINTM(MINFO, "unregister device\n");
+	woal_sdiommc_unregister_dev(handle);
+	handle->surprise_removed = MTRUE;
+#ifdef REASSOCIATION
+	if (handle->reassoc_thread.pid)
+		wake_up_interruptible(&handle->reassoc_thread.wait_q);
+	/* waiting for main thread quit */
+	while (handle->reassoc_thread.pid)
+		woal_sched_timeout(2);
+#endif /* REASSOCIATION */
+	if (moal_extflg_isset(handle, EXT_NAPI))
+		netif_napi_del(&handle->napi_rx);
+	woal_terminate_workqueue(handle);
+	woal_free_moal_handle(handle);
+
+	for (index = 0; index < MAX_MLAN_ADAPTER; index++) {
+		if (m_handle[index] == handle)
+			break;
+	}
+	if (index < MAX_MLAN_ADAPTER)
+		m_handle[index] = NULL;
+	card->handle = NULL;
+	MOAL_REL_SEMAPHORE(&AddRemoveCardSem);
+	LEAVE();
+	return (mlan_status)MLAN_STATUS_FAILURE;
+}
+
+/**
+ *  @brief This function handle the sdio work
+ *
+ *  @param WORK   A pointer to work_struct
+ *  @return         N/A
+ *
+ */
+static void woal_sdiommc_work(struct work_struct *work)
+{
+	sdio_mmc_card *card = container_of(work, sdio_mmc_card, reset_work);
+	moal_handle *handle = NULL;
+	moal_handle *ref_handle = NULL;
+	PRINTM(MMSG, "========START IN-BAND RESET===========\n");
+	handle = card->handle;
+	// handle-> mac0 , ref_handle->second mac
+	if (handle->pref_mac) {
+		if (handle->second_mac) {
+			handle = (moal_handle *)handle->pref_mac;
+			ref_handle = (moal_handle *)handle->pref_mac;
+		} else {
+			ref_handle = (moal_handle *)handle->pref_mac;
+		}
+		if (ref_handle) {
+			ref_handle->surprise_removed = MTRUE;
+			woal_clean_up(ref_handle);
+			mlan_ioctl(ref_handle->pmlan_adapter, NULL);
+		}
+	}
+	handle->surprise_removed = MTRUE;
+	handle->fw_reseting = MTRUE;
+	woal_do_sdiommc_flr(handle, true, true);
+	if (ref_handle) {
+		ref_handle->surprise_removed = MTRUE;
+		ref_handle->fw_reseting = MTRUE;
+		woal_do_sdiommc_flr(ref_handle, true, true);
+	}
+	if (woal_sdiommc_reset_fw(handle)) {
+		PRINTM(MERROR, "SDIO In-band Reset Fail\n");
+		woal_send_auto_recovery_failure_event(handle);
+		wifi_status = WIFI_STATUS_FW_RECOVERY_FAIL;
+		return;
+	}
+
+	handle->surprise_removed = MFALSE;
+	if (MLAN_STATUS_SUCCESS == woal_do_sdiommc_flr(handle, false, true))
+		handle->fw_reseting = MFALSE;
+	else {
+		handle = NULL;
+		wifi_status = WIFI_STATUS_FW_RECOVERY_FAIL;
+		return;
+	}
+
+	if (ref_handle) {
+		ref_handle->surprise_removed = MFALSE;
+		if (MLAN_STATUS_SUCCESS ==
+		    woal_do_sdiommc_flr(ref_handle, false, true))
+			ref_handle->fw_reseting = MFALSE;
+	}
+	card->work_flags = MFALSE;
+	wifi_status = WIFI_STATUS_OK;
+	if (handle)
+		woal_send_auto_recovery_complete_event(handle);
+	PRINTM(MMSG, "========END IN-BAND RESET===========\n");
+	return;
+}
+
+/**
+ *  @brief This function start reset_work
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *  @return         MTRUE/MFALSE
+ *
+ */
+static void woal_sdiommc_card_reset(moal_handle *handle)
+{
+	sdio_mmc_card *card = handle->card;
+	if (!card->work_flags) {
+		card->work_flags = MTRUE;
+		schedule_work(&card->reset_work);
+	}
+}
+
+static moal_if_ops sdiommc_ops = {
+	.register_dev = woal_sdiommc_register_dev,
+	.unregister_dev = woal_sdiommc_unregister_dev,
+	.read_reg = woal_sdiommc_read_reg,
+	.write_reg = woal_sdiommc_write_reg,
+	.read_data_sync = woal_sdiommc_read_data_sync,
+	.write_data_sync = woal_sdiommc_write_data_sync,
+	.get_fw_name = woal_sdiommc_get_fw_name,
+	.dump_fw_info = woal_sdiommc_dump_fw_info,
+	.dump_reg_info = woal_sdiommc_dump_reg_info,
+	.reg_dbg = woal_sdiommc_reg_dbg,
+	.card_reset = woal_sdiommc_card_reset,
+	.is_second_mac = woal_sdiommc_is_second_mac,
+};
diff --git a/wlan_sd8987/mlinux/moal_shim.c b/wlan_src/mlinux/moal_shim.c
old mode 100755
new mode 100644
similarity index 81%
rename from wlan_sd8987/mlinux/moal_shim.c
rename to wlan_src/mlinux/moal_shim.c
index 00127a1..5240335
--- a/wlan_sd8987/mlinux/moal_shim.c
+++ b/wlan_src/mlinux/moal_shim.c
@@ -3,20 +3,28 @@
  * @brief This file contains the callback functions registered to MLAN
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -55,6 +63,8 @@
 
 #endif /*defined(PCIE) || defined(SDIO)*/
 
+#define NXP_ETH_P_WAPI 0x88B4
+
 /********************************************************
 		Local Variables
 ********************************************************/
@@ -107,7 +117,12 @@
 		if (flag & MLAN_MEM_DMA)
 			mem_flag |= GFP_DMA;
 	}
-	*ppbuf = kzalloc(size, mem_flag);
+
+	if (flag & MLAN_MEM_FLAG_DIRTY)
+		*ppbuf = kmalloc(size, mem_flag);
+	else
+		*ppbuf = kzalloc(size, mem_flag);
+
 	if (*ppbuf == NULL) {
 		PRINTM(MERROR, "%s: allocate memory (%d bytes) failed!\n",
 		       __func__, (int)size);
@@ -217,6 +232,11 @@
 		       __func__, (int)size);
 		return MLAN_STATUS_FAILURE;
 	}
+#ifdef PCIEAW693
+	if (IS_PCIEAW693(handle->card_type) &&
+	    (handle->card_rev == CHIP_AW693_REV_A0))
+		dma |= 0x100000000;
+#endif
 	*pbuf_pa = (t_u64)dma;
 	atomic_inc(&handle->malloc_cons_count);
 
@@ -241,7 +261,11 @@
 
 	if (!pbuf || !card)
 		return MLAN_STATUS_FAILURE;
-
+#ifdef PCIEAW693
+	if (IS_PCIEAW693(handle->card_type) &&
+	    (handle->card_rev == CHIP_AW693_REV_A0))
+		buf_pa &= 0xffffffff;
+#endif
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
 	dma_free_coherent(&card->dev->dev, size, pbuf, buf_pa);
 #else
@@ -272,7 +296,6 @@
 
 	if (!card)
 		return MLAN_STATUS_FAILURE;
-
 		/* Init memory to device */
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
 	dma = dma_map_single(&card->dev->dev, pbuf, size, flag);
@@ -287,7 +310,11 @@
 		PRINTM(MERROR, "Tx ring: failed to dma_map_single\n");
 		return MLAN_STATUS_FAILURE;
 	}
-
+#ifdef PCIEAW693
+	if (IS_PCIEAW693(handle->card_type) &&
+	    (handle->card_rev == CHIP_AW693_REV_A0))
+		dma |= 0x100000000;
+#endif
 	*pbuf_pa = dma;
 	return MLAN_STATUS_SUCCESS;
 }
@@ -311,7 +338,11 @@
 
 	if (!card)
 		return MLAN_STATUS_FAILURE;
-
+#ifdef PCIEAW693
+	if (IS_PCIEAW693(handle->card_type) &&
+	    (handle->card_rev == CHIP_AW693_REV_A0))
+		buf_pa &= 0xffffffff;
+#endif
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
 	dma_unmap_single(&card->dev->dev, buf_pa, size, flag);
 #else
@@ -708,13 +739,18 @@
 	wifi_timeval t;
 
 	if (drop_point < MAX_TP_ACCOUNT_DROP_POINT_NUM) {
-		if (drop_point == 4) {
+		if (drop_point == 4 || drop_point == 3) {
 			handle->tp_acnt.tx_bytes[drop_point] += pmbuf->data_len;
 		} else {
 			skb = (struct sk_buff *)buf;
 			handle->tp_acnt.tx_bytes[drop_point] += skb->len;
 		}
 		handle->tp_acnt.tx_packets[drop_point]++;
+		if (drop_point == 3) {
+			woal_get_monotonic_time(&t);
+			pmbuf->extra_ts_sec = t.time_sec;
+			pmbuf->extra_ts_usec = t.time_usec;
+		}
 	} else if (drop_point <= RX_DROP_P5) {
 		t_u16 rx_len = 0;
 		if (drop_point == RX_DROP_P1 || drop_point == RX_DROP_P2)
@@ -755,10 +791,17 @@
 		if (handle->tp_acnt.rx_index >= TXRX_MAX_SAMPLE)
 			handle->tp_acnt.rx_index = 0;
 	} else if (drop_point == TX_TIME_PKT) {
+		delay = (t_s32)(pmbuf->extra_ts_sec - pmbuf->in_ts_sec) *
+			1000000;
+		delay += (t_s32)(pmbuf->extra_ts_usec - pmbuf->in_ts_usec);
+		handle->tp_acnt.tx_delay1_driver[handle->tp_acnt.tx_index] =
+			delay;
+
 		delay = (t_s32)(pmbuf->out_ts_sec - pmbuf->in_ts_sec) * 1000000;
 		delay += (t_s32)(pmbuf->out_ts_usec - pmbuf->in_ts_usec);
 		handle->tp_acnt.tx_delay_driver[handle->tp_acnt.tx_index] =
 			delay;
+
 		handle->tp_acnt.tx_index++;
 		if (handle->tp_acnt.tx_index >= TXRX_MAX_SAMPLE)
 			handle->tp_acnt.tx_index = 0;
@@ -912,6 +955,8 @@
 					MLAN_MAX_VER_STR_LEN - 1);
 		}
 #endif
+		if (phw->fw_cap & FW_CAPINFO_DISABLE_NAN)
+			handle->params.drv_mode &= ~DRV_MODE_NAN;
 		/** FW should only enable DFS on one mac */
 		if (!(phw->fw_cap & FW_CAPINFO_ZERO_DFS))
 			handle->params.drv_mode &= ~DRV_MODE_DFS;
@@ -1022,11 +1067,17 @@
 	}
 
 	if (status != MLAN_STATUS_SUCCESS && status != MLAN_STATUS_COMPLETE)
-		PRINTM(MERROR,
-		       "IOCTL failed: %p id=0x%x, sub_id=0x%x action=%d, status_code=0x%x\n",
-		       pioctl_req, pioctl_req->req_id,
-		       (*(t_u32 *)pioctl_req->pbuf), (int)pioctl_req->action,
-		       pioctl_req->status_code);
+		if (handle->rf_test_mode == MTRUE)
+			PRINTM(MERROR,
+			       "Operation id=0x%x not allowed in rf-mode\n",
+			       pioctl_req->req_id);
+		else
+			PRINTM(MERROR,
+			       "IOCTL failed: %p id=0x%x, sub_id=0x%x action=%d, status_code=0x%x\n",
+			       pioctl_req, pioctl_req->req_id,
+			       (*(t_u32 *)pioctl_req->pbuf),
+			       (int)pioctl_req->action,
+			       pioctl_req->status_code);
 	else
 		PRINTM(MIOCTL,
 		       "IOCTL completed: %p id=0x%x sub_id=0x%x, action=%d,  status=%d, status_code=0x%x\n",
@@ -1115,6 +1166,12 @@
 	t_u32 index = 0;
 #endif
 
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	struct net_device *dev = NULL;
+#endif
+#endif
+
 	ENTER();
 	if (pmbuf && pmbuf->buf_type == MLAN_BUF_TYPE_RAW_DATA) {
 		woal_free_mlan_buffer(handle, pmbuf);
@@ -1124,6 +1181,15 @@
 	if (pmbuf) {
 		priv = woal_bss_index_to_priv(pmoal, pmbuf->bss_index);
 		skb = (struct sk_buff *)pmbuf->pdesc;
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+		if (priv && priv->multi_ap_flag && skb) {
+			dev = skb->dev;
+			if (dev)
+				priv = (moal_private *)netdev_priv(dev);
+		}
+#endif
+#endif
 		if (priv) {
 			woal_set_trans_start(priv->netdev);
 			if (skb) {
@@ -1132,22 +1198,26 @@
 					priv->stats.tx_bytes += skb->len;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-					woal_packet_fate_monitor(
-						priv, PACKET_TYPE_TX,
-						TX_PKT_FATE_SENT,
-						FRAME_TYPE_ETHERNET_II, 0, 0,
-						skb->data, skb->data_len);
+					if (drvdbg & MDAT_D)
+						woal_packet_fate_monitor(
+							priv, PACKET_TYPE_TX,
+							TX_PKT_FATE_SENT,
+							FRAME_TYPE_ETHERNET_II,
+							0, 0, skb->data,
+							skb->data_len);
 #endif
 #endif
 				} else {
 					priv->stats.tx_errors++;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-					woal_packet_fate_monitor(
-						priv, PACKET_TYPE_TX,
-						TX_PKT_FATE_DRV_DROP_OTHER,
-						FRAME_TYPE_ETHERNET_II, 0, 0,
-						skb->data, skb->data_len);
+					if (drvdbg & MDAT_D)
+						woal_packet_fate_monitor(
+							priv, PACKET_TYPE_TX,
+							TX_PKT_FATE_DRV_DROP_OTHER,
+							FRAME_TYPE_ETHERNET_II,
+							0, 0, skb->data,
+							skb->data_len);
 #endif
 #endif
 				}
@@ -1157,7 +1227,7 @@
 					atomic_dec(&handle->tx_pending);
 					if (atomic_dec_return(
 						    &priv->wmm_tx_pending[index]) ==
-					    LOW_TX_PENDING) {
+					    priv->low_tx_pending) {
 						struct netdev_queue *txq =
 							netdev_get_tx_queue(
 								priv->netdev,
@@ -1389,6 +1459,45 @@
 
 #if defined(STA_CFG80211) && defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+
+#define DOT11_MAX_PRIORITY 8
+#define IEEE80211_RADIOTAP_HE 23
+
+t_u8 ru_signal[16][9] = {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08},
+			 {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x07},
+			 {0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0x07},
+			 {0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0x06},
+			 {0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07},
+			 {0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0x06},
+			 {0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0x06},
+			 {0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x05},
+			 {0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07},
+			 {0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x06},
+			 {0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0x06},
+			 {0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0x05},
+			 {0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x06},
+			 {0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0x05},
+			 {0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0x05},
+			 {0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01,
+			  0x04}};
+
+t_u8 ru_signal_106[14][9] = {
+	{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
+	{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
+	{0xff, 0x01, 0xff, 0x01, 0xff, 0xff, 0xff, 0x02, 0x03},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0x01, 0xff, 0x01, 0x03},
+	{0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0x02, 0x05},
+	{0x00, 0x00, 0xff, 0x01, 0xff, 0xff, 0xff, 0x02, 0x04},
+	{0xff, 0x01, 0x00, 0x00, 0xff, 0xff, 0xff, 0x02, 0x04},
+	{0xff, 0x01, 0xff, 0x01, 0xff, 0xff, 0xff, 0x02, 0x03},
+	{0xff, 0xff, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x05},
+	{0xff, 0xff, 0xff, 0x02, 0x00, 0x00, 0xff, 0x01, 0x04},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0x01, 0x00, 0x00, 0x04},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0x01, 0xff, 0x01, 0x03},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0xff, 0xff, 0x02, 0x02},
+	{0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x04}};
+
+t_u8 ru_signal_52[9] = {0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x04};
 /**
  *  @brief This function uploads the packet to the network stack monitor
  * interface
@@ -1406,6 +1515,8 @@
 	struct radiotap_header *rth = NULL;
 	radiotap_info rt_info = {};
 	t_u8 format = 0;
+	t_u8 mcs = 0;
+	t_u8 nss = 0;
 	t_u8 bw = 0;
 	t_u8 gi = 0;
 	t_u8 ldpc = 0;
@@ -1415,6 +1526,12 @@
 	t_u8 *payload = NULL;
 	t_u32 vht_sig1 = 0;
 	t_u32 vht_sig2 = 0;
+	t_u32 he_sig1 = 0;
+	t_u32 he_sig2 = 0;
+	t_u32 usr_idx = 0;
+	t_u32 out = 0;
+	t_u32 tone = 0;
+	t_u8 dcm = 0;
 	ENTER();
 	if (!pmbuf->pdesc) {
 		LEAVE();
@@ -1443,7 +1560,15 @@
 			ldpc = (rt_info.rate_info.rate_info & 0x20) >> 5;
 			format = (rt_info.rate_info.rate_info & 0x18) >> 3;
 			bw = (rt_info.rate_info.rate_info & 0x06) >> 1;
-			gi = rt_info.rate_info.rate_info & 0x01;
+			dcm = rt_info.rate_info.dcm;
+			if (format == MLAN_RATE_FORMAT_HE)
+				gi = (rt_info.rate_info.rate_info & 0xC0) >> 6;
+			else
+
+				gi = rt_info.rate_info.rate_info & 0x01;
+			mcs = rt_info.rate_info.mcs_index;
+			nss = rt_info.rate_info.nss_index;
+
 			skb_push(skb, sizeof(*rth));
 			rth = (struct radiotap_header *)skb->data;
 			memset(skb->data, 0, sizeof(*rth));
@@ -1500,13 +1625,19 @@
 			}
 			/** Channel */
 			rth->body.channel.flags = 0;
-			if (rt_info.chan_num)
-				chan_num = rt_info.chan_num;
-			else
-				chan_num =
-					handle->mon_if->band_chan_cfg.channel;
+			if (rt_info.chan_num &&
+			    (handle->mon_if->band_chan_cfg.channel !=
+			     rt_info.chan_num))
+				handle->mon_if->band_chan_cfg.channel =
+					rt_info.chan_num;
+			chan_num = handle->mon_if->band_chan_cfg.channel;
+
 			band = (chan_num <= 14) ? IEEE80211_BAND_2GHZ :
 						  IEEE80211_BAND_5GHZ;
+			/** update the band, if different in the Rx frame */
+			if (handle->mon_if->band_chan_cfg.band != band)
+				handle->mon_if->band_chan_cfg.band = band;
+
 			rth->body.channel.frequency = woal_cpu_to_le16(
 				ieee80211_channel_to_frequency(chan_num, band));
 			rth->body.channel.flags |=
@@ -1565,8 +1696,8 @@
 			}
 			/** VHT */
 			if (format == MLAN_RATE_FORMAT_VHT) {
-				vht_sig1 = rt_info.extra_info.vht_sig1;
-				vht_sig2 = rt_info.extra_info.vht_sig2;
+				vht_sig1 = rt_info.extra_info.vht_he_sig1;
+				vht_sig2 = rt_info.extra_info.vht_he_sig2;
 				/** Present Flag */
 				rth->hdr.it_present |= cpu_to_le32(
 					1 << IEEE80211_RADIOTAP_VHT);
@@ -1615,11 +1746,173 @@
 				/* Convert FW NSS value to radiotap spec */
 				rth->body.u.vht.mcs_nss[0] |=
 					((vht_sig1 & (0x1C00)) >> 10) + 1;
+				/** gi */
+				rth->body.u.vht.known |=
+					woal_cpu_to_le16(VHT_KNOWN_GI);
+				if (gi)
+					rth->body.u.vht.flags |= VHT_FLAG_SGI;
 				/** coding */
 				if (vht_sig2 & MBIT(2))
 					rth->body.u.vht.coding |=
 						VHT_CODING_LDPC_USER0;
 			}
+			if (format == MLAN_RATE_FORMAT_HE) {
+				he_sig1 = rt_info.extra_info.vht_he_sig1;
+				he_sig2 = rt_info.extra_info.vht_he_sig2;
+				usr_idx = rt_info.extra_info.user_idx;
+				rth->hdr.it_present |=
+					cpu_to_le32(1 << IEEE80211_RADIOTAP_HE);
+				rth->body.u.he.data1 |= (HE_CODING_KNOWN);
+				if (ldpc)
+					rth->body.u.he.data3 |=
+						HE_CODING_LDPC_USER0;
+				rth->body.u.he.data1 |= (HE_BW_KNOWN);
+				if (he_sig1)
+					rth->body.u.he.data1 |= (HE_MU_DATA);
+				if (bw == 1) {
+					rth->body.u.he.data5 |= RX_HE_BW_40;
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (tone != 0) {
+							rth->body.u.he.data5 &=
+								~RX_HE_BW_40;
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				} else if (bw == 2) {
+					rth->body.u.he.data5 |= RX_HE_BW_80;
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH2(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							if ((he_sig2 &
+							     MLAN_80_CENTER_RU) &&
+							    !usr_idx) {
+								tone = RU_TONE_26;
+							} else {
+								usr_idx--;
+							}
+						}
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH4(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (tone != 0) {
+							rth->body.u.he.data5 &=
+								~RX_HE_BW_80;
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				} else if (bw == 3) {
+					rth->body.u.he.data5 |= RX_HE_BW_160;
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH2(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							if ((he_sig2 &
+							     MLAN_160_CENTER_RU) &&
+							    !usr_idx) {
+								tone = RU_TONE_26;
+							} else {
+								usr_idx--;
+							}
+						}
+						if (!tone) {
+							MLAN_DECODING_160_RU_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							MLAN_DECODING_160_RU_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (tone != 0) {
+							rth->body.u.he.data5 &=
+								~RX_HE_BW_160;
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				} else {
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (tone) {
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				}
+
+				rth->body.u.he.data2 |= (HE_DATA_GI_KNOWN);
+				rth->body.u.he.data5 |= ((gi & 3) << 4);
+				rth->body.u.he.data1 |= (HE_MCS_KNOWN);
+
+				rth->body.u.he.data3 |= (mcs << 8);
+				rth->body.u.he.data6 |= nss;
+				rth->body.u.he.data1 |= (HE_DCM_KNOWN);
+				rth->body.u.he.data1 =
+					cpu_to_le16(rth->body.u.he.data1);
+				rth->body.u.he.data5 |= (dcm << 12);
+				rth->body.u.he.data5 =
+					cpu_to_le16(rth->body.u.he.data5);
+				rth->body.u.he.data3 =
+					cpu_to_le16(rth->body.u.he.data3);
+			}
 		}
 		skb_set_mac_header(skb, 0);
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1651,6 +1944,33 @@
 #endif
 #endif
 
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+/**
+ *  @brief This function get binded net_device from station list
+ *
+ *  @param priv Pointer to structure moal_private
+ *  @param aid    station aid from mlan
+ *
+ *  @return    binded net_device pointer or NULL if not found
+ */
+static struct net_device *moal_get_netdev_from_stalist(moal_private *priv,
+						       t_u16 aid)
+{
+	station_node *sta_node = NULL;
+
+	ENTER();
+	sta_node = priv->vlan_sta_list[(aid - 1) % MAX_STA_COUNT];
+	if (sta_node) {
+		LEAVE();
+		return sta_node->netdev;
+	}
+	LEAVE();
+	return NULL;
+}
+#endif
+#endif
+
 /**
  *  @brief This function uploads amsdu packet to the network stack
  *
@@ -1675,6 +1995,11 @@
 	t_u8 drop = 0;
 	t_u8 rfc1042_eth_hdr[MLAN_MAC_ADDR_LENGTH] = {0xaa, 0xaa, 0x03,
 						      0x00, 0x00, 0x00};
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	t_u16 aid = 0;
+#endif
+#endif
 
 	wifi_timeval t1, t2;
 	t_s32 delay;
@@ -1696,6 +2021,19 @@
 		goto done;
 	}
 	netdev = priv->netdev;
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	if (pmbuf->flags & MLAN_BUF_FLAG_EASYMESH) {
+		aid = (pmbuf->priority & 0xFF000000) >> 24;
+		if (!priv->vlan_sta_list[(aid - 1) % MAX_STA_COUNT]->is_valid) {
+			priv->stats.rx_dropped++;
+			goto done;
+		}
+		if (aid != 0)
+			netdev = moal_get_netdev_from_stalist(priv, aid);
+	}
+#endif
+#endif
 	skb = (struct sk_buff *)pmbuf->pdesc;
 	if (!skb)
 		goto done;
@@ -1752,6 +2090,12 @@
 			status = MLAN_STATUS_PENDING;
 		} else {
 			frame = skb_clone(skb, GFP_ATOMIC);
+			if (!frame) {
+				PRINTM(MERROR,
+				       " AMSDU RECV:skb_clone returned NULL\n");
+				break;
+			}
+
 			skb_trim(frame, len);
 			eth = (struct ethhdr *)skb_pull(skb, len + padding);
 			if (!eth) {
@@ -1788,6 +2132,10 @@
 		}
 		frame->protocol = eth_type_trans(frame, netdev);
 		frame->ip_summed = CHECKSUM_NONE;
+
+		priv->stats.rx_bytes += frame->len;
+		priv->stats.rx_packets++;
+
 		if (in_interrupt())
 			netif_rx(frame);
 		else {
@@ -1847,6 +2195,11 @@
 	int j;
 	struct ethhdr *ethh = NULL;
 	struct net_device *netdev = NULL;
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	t_u16 aid = 0;
+#endif
+#endif
 
 	ENTER();
 	if (pmbuf) {
@@ -1933,13 +2286,15 @@
 					priv->stats.rx_dropped++;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-					woal_packet_fate_monitor(
-						priv, PACKET_TYPE_RX,
-						RX_PKT_FATE_DRV_DROP_NOBUFS,
-						FRAME_TYPE_ETHERNET_II, 0, 0,
-						(t_u8 *)(pmbuf->pbuf +
-							 pmbuf->data_offset),
-						pmbuf->data_len);
+					if (drvdbg & MDAT_D)
+						woal_packet_fate_monitor(
+							priv, PACKET_TYPE_RX,
+							RX_PKT_FATE_DRV_DROP_NOBUFS,
+							FRAME_TYPE_ETHERNET_II,
+							0, 0,
+							(t_u8 *)(pmbuf->pbuf +
+								 pmbuf->data_offset),
+							pmbuf->data_len);
 #endif
 #endif
 					goto done;
@@ -1962,6 +2317,66 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 				priv->deauth_evt_cnt = 0;
 #endif
+			} else if (ntohs(ethh->h_proto) == NXP_ETH_P_WAPI) {
+				PRINTM(MEVENT,
+				       "wlan: %s Rx WAPI pkt from " MACSTR "\n",
+				       priv->netdev->name,
+				       MAC2STR(ethh->h_source));
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+				priv->deauth_evt_cnt = 0;
+#endif
+			}
+
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+			if (pmbuf->flags & MLAN_BUF_FLAG_EASYMESH) {
+				aid = (pmbuf->priority & 0xFF000000) >> 24;
+				if (!priv->vlan_sta_list[(aid - 1) %
+							 MAX_STA_COUNT]
+					     ->is_valid) {
+					status = MLAN_STATUS_FAILURE;
+					priv->stats.rx_dropped++;
+					goto done;
+				}
+				if (aid != 0)
+					netdev = moal_get_netdev_from_stalist(
+						priv, aid);
+			}
+#endif
+#endif
+			if (priv->wdev->use_4addr &&
+			    priv->wdev->iftype == NL80211_IFTYPE_STATION) {
+				t_u32 transaction_id;
+				t_u32 hash_key;
+				transaction_id =
+					woal_get_dhcp_discover_transation_id(
+						skb);
+				if (transaction_id &&
+				    woal_get_dhcp_discover_info(
+					    priv, transaction_id)) {
+					PRINTM(MDATA,
+					       "Drop dhcp pkt, transation_id=%x\n",
+					       transaction_id);
+					dev_kfree_skb(skb);
+					goto done;
+				}
+
+				hash_key = woal_generate_arp_request_hash(skb);
+				// TODO: Drop too old entry
+				if (hash_key) {
+					struct arp_entry *node;
+					hash_for_each_possible (priv->hlist,
+								node, arp_hlist,
+								hash_key) {
+						if (node->hash_key ==
+						    hash_key) {
+							PRINTM(MDATA,
+							       "ARP entry exists, drop pkt\n");
+							dev_kfree_skb(skb);
+							goto done;
+						}
+					}
+				}
 			}
 			if (!netdev)
 				netdev = priv->netdev;
@@ -2012,11 +2427,12 @@
 				       priv->netdev->name);
 				status = MLAN_STATUS_FAILURE;
 				priv->stats.rx_dropped++;
-				woal_packet_fate_monitor(
-					priv, PACKET_TYPE_RX,
-					RX_PKT_FATE_DRV_DROP_FILTER,
-					FRAME_TYPE_ETHERNET_II, 0, 0, skb->data,
-					skb->len);
+				if (drvdbg & MDAT_D)
+					woal_packet_fate_monitor(
+						priv, PACKET_TYPE_RX,
+						RX_PKT_FATE_DRV_DROP_FILTER,
+						FRAME_TYPE_ETHERNET_II, 0, 0,
+						skb->data, skb->len);
 				dev_kfree_skb(skb);
 				goto done;
 			}
@@ -2026,10 +2442,12 @@
 			priv->stats.rx_packets++;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-			woal_packet_fate_monitor(priv, PACKET_TYPE_RX,
-						 RX_PKT_FATE_SUCCESS,
-						 FRAME_TYPE_ETHERNET_II, 0, 0,
-						 skb->data, skb->len);
+			if (drvdbg & MDAT_D)
+				woal_packet_fate_monitor(priv, PACKET_TYPE_RX,
+							 RX_PKT_FATE_SUCCESS,
+							 FRAME_TYPE_ETHERNET_II,
+							 0, 0, skb->data,
+							 skb->len);
 #endif
 #endif
 #ifdef ANDROID_KERNEL
@@ -2130,23 +2548,19 @@
 	if (moal_extflg_isset(pmhandle, EXT_PMQOS)) {
 #if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
-#ifdef IMX_SUPPORT
 		if (!pm_qos_request_active(&pmhandle->woal_pm_qos_req))
 			pm_qos_add_request(&pmhandle->woal_pm_qos_req,
 					   PM_QOS_CPU_DMA_LATENCY, 0);
 		else
 			PRINTM(MERROR, "PM-QOS request already active\n");
 #endif
-#endif
 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
-#ifdef IMX_SUPPORT
 		if (!cpu_latency_qos_request_active(&pmhandle->woal_pm_qos_req))
 			cpu_latency_qos_add_request(&pmhandle->woal_pm_qos_req,
 						    0);
 		else
 			PRINTM(MERROR, "PM-QOS request already active\n");
 #endif
-#endif
 	}
 	return;
 }
@@ -2165,22 +2579,18 @@
 	if (moal_extflg_isset(pmhandle, EXT_PMQOS)) {
 #if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
-#ifdef IMX_SUPPORT
 		if (pm_qos_request_active(&pmhandle->woal_pm_qos_req))
 			pm_qos_remove_request(&pmhandle->woal_pm_qos_req);
 		else
 			PRINTM(MERROR, "PM-QOS request already removed\n");
 #endif
-#endif
 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
-#ifdef IMX_SUPPORT
 		if (cpu_latency_qos_request_active(&pmhandle->woal_pm_qos_req))
 			cpu_latency_qos_remove_request(
 				&pmhandle->woal_pm_qos_req);
 		else
 			PRINTM(MERROR, "PM-QOS request already removed\n");
 #endif
-#endif
 	}
 	return;
 }
@@ -2273,6 +2683,243 @@
 #endif
 
 /**
+ *  @brief This function handles rgpower key mismatch event
+ *
+ *  @param priv pointer to the moal_private structure.
+ *
+ *  @return         N/A
+ */
+static void woal_rgpower_key_mismatch_event(moal_private *priv)
+{
+	struct woal_event *evt;
+	unsigned long flags;
+	moal_handle *handle = priv->phandle;
+
+	evt = kzalloc(sizeof(struct woal_event), GFP_ATOMIC);
+	if (evt) {
+		evt->priv = priv;
+		evt->type = WOAL_EVENT_RGPWR_KEY_MISMATCH;
+		INIT_LIST_HEAD(&evt->link);
+		spin_lock_irqsave(&handle->evt_lock, flags);
+		list_add_tail(&evt->link, &handle->evt_queue);
+		spin_unlock_irqrestore(&handle->evt_lock, flags);
+		queue_work(handle->evt_workqueue, &handle->evt_work);
+	}
+}
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/**
+ *  @brief This function prepare wifi reset event
+ *
+ *  @param priv pointer to the moal_private structure.
+ *
+ *  @return         N/A
+ */
+static void woal_wifi_reset_event(moal_private *priv, t_u8 deauth_evt_cnt)
+{
+	struct woal_event *evt;
+	unsigned long flags;
+	moal_handle *handle = priv->phandle;
+
+	evt = kzalloc(sizeof(struct woal_event), GFP_ATOMIC);
+	if (evt) {
+		evt->priv = priv;
+		evt->type = WOAL_EVENT_RESET_WIFI;
+		evt->deauth_evt_cnt = deauth_evt_cnt;
+		INIT_LIST_HEAD(&evt->link);
+		spin_lock_irqsave(&handle->evt_lock, flags);
+		list_add_tail(&evt->link, &handle->evt_queue);
+		spin_unlock_irqrestore(&handle->evt_lock, flags);
+		queue_work(handle->evt_workqueue, &handle->evt_work);
+	}
+	// coverity[leaked_storage]: SUPPRESS
+}
+#endif
+
+/**
+ *  @brief This function handles defer event receive
+ *
+ *  @param handle   Pointer to the moal_handle
+ *  @param event_id 	event id
+ *
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+static mlan_status wlan_process_defer_event(moal_handle *handle,
+					    mlan_event_id event_id)
+{
+	mlan_status status = MLAN_STATUS_FAILURE;
+	ENTER();
+	switch (event_id) {
+#ifdef PCIE
+	case MLAN_EVENT_ID_DRV_DEFER_RX_DATA:
+		status = MLAN_STATUS_SUCCESS;
+#ifdef TASKLET_SUPPORT
+		tasklet_schedule(&handle->pcie_rx_task);
+#else
+		queue_work(handle->pcie_rx_workqueue, &handle->pcie_rx_work);
+#endif
+		break;
+	case MLAN_EVENT_ID_DRV_DEFER_CMDRESP:
+		status = MLAN_STATUS_SUCCESS;
+		queue_work(handle->pcie_cmd_resp_workqueue,
+			   &handle->pcie_cmd_resp_work);
+		break;
+	case MLAN_EVENT_ID_DRV_DEFER_TX_COMPLTE:
+		status = MLAN_STATUS_SUCCESS;
+#ifdef TASKLET_SUPPORT
+		tasklet_schedule(&handle->pcie_tx_complete_task);
+#else
+		queue_work(handle->pcie_tx_complete_workqueue,
+			   &handle->pcie_tx_complete_work);
+#endif
+		break;
+	case MLAN_EVENT_ID_DRV_DELAY_TX_COMPLETE:
+		status = MLAN_STATUS_SUCCESS;
+		schedule_delayed_work(&handle->pcie_delayed_tx_work, 1);
+		break;
+#endif /* PCIE */
+
+	case MLAN_EVENT_ID_DRV_FLUSH_RX_WORK:
+		status = MLAN_STATUS_SUCCESS;
+		if (moal_extflg_isset(handle, EXT_NAPI)) {
+			napi_synchronize(&handle->napi_rx);
+			break;
+		}
+#ifdef PCIE
+		if (IS_PCIE(handle->card_type)) {
+#ifdef TASKLET_SUPPORT
+			tasklet_kill(&handle->pcie_rx_task);
+#else
+			flush_workqueue(handle->pcie_rx_workqueue);
+#endif
+			break;
+		}
+#endif
+#if defined(SDIO) || defined(USB)
+		flush_workqueue(handle->rx_workqueue);
+#endif
+		break;
+	case MLAN_EVENT_ID_DRV_FLUSH_MAIN_WORK:
+		status = MLAN_STATUS_SUCCESS;
+		flush_workqueue(handle->workqueue);
+		break;
+	case MLAN_EVENT_ID_DRV_DEFER_HANDLING:
+		status = MLAN_STATUS_SUCCESS;
+		queue_work(handle->workqueue, &handle->main_work);
+		break;
+	case MLAN_EVENT_ID_DRV_DEFER_RX_WORK:
+		status = MLAN_STATUS_SUCCESS;
+		if (moal_extflg_isset(handle, EXT_NAPI)) {
+			napi_schedule(&handle->napi_rx);
+			break;
+		}
+#ifdef PCIE
+		if (IS_PCIE(handle->card_type)) {
+#ifdef TASKLET_SUPPORT
+			tasklet_schedule(&handle->pcie_rx_task);
+#else
+			queue_work(handle->pcie_rx_workqueue,
+				   &handle->pcie_rx_work);
+#endif
+			break;
+		}
+#endif
+#if defined(USB) || defined(SDIO)
+		queue_work(handle->rx_workqueue, &handle->rx_work);
+#endif
+		break;
+	default:
+		break;
+	}
+	LEAVE();
+	return status;
+}
+
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+/**
+ *  @brief This function handles event receive
+ *
+ *  @param priv Pointer to the MOAL private
+ *  @param tx_status  pointer to tx_mgmt_status_event structure
+ *
+ *  @return         N/A
+ */
+static t_void woal_process_event_tx_status(moal_private *priv,
+					   tx_mgmt_status_event *tx_status)
+{
+	unsigned long flag;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	moal_private *remain_priv = NULL;
+	t_u8 channel_status;
+#endif
+	struct tx_status_info *tx_info = NULL;
+	PRINTM(MEVENT,
+	       "Wlan: Tx status: tx_token=%d, pkt_type=0x%x, status=%d priv->tx_seq_num=%d\n",
+	       tx_status->tx_token_id, tx_status->packet_type,
+	       tx_status->status, priv->tx_seq_num);
+	spin_lock_irqsave(&priv->tx_stat_lock, flag);
+	tx_info = woal_get_tx_info(priv, tx_status->tx_token_id);
+	if (tx_info) {
+		bool ack;
+		struct sk_buff *skb = (struct sk_buff *)tx_info->tx_skb;
+		list_del(&tx_info->link);
+		spin_unlock_irqrestore(&priv->tx_stat_lock, flag);
+		if (!tx_status->status)
+			ack = true;
+		else
+			ack = false;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		if (priv->phandle->remain_on_channel &&
+		    tx_info->cancel_remain_on_channel) {
+			remain_priv =
+				priv->phandle
+					->priv[priv->phandle->remain_bss_index];
+			if (remain_priv) {
+				if (woal_cfg80211_remain_on_channel_cfg(
+					    remain_priv, MOAL_NO_WAIT, MTRUE,
+					    &channel_status, NULL, 0, 0))
+					PRINTM(MERROR,
+					       "remain_on_channel: Failed to cancel\n");
+
+				priv->phandle->remain_on_channel = MFALSE;
+			}
+		}
+#endif
+		PRINTM(MEVENT, "Wlan: Tx status=%d\n", ack);
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		if (tx_info->tx_cookie) {
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
+			cfg80211_mgmt_tx_status(priv->netdev,
+						tx_info->tx_cookie, skb->data,
+						skb->len, ack, GFP_ATOMIC);
+#else
+			cfg80211_mgmt_tx_status(priv->wdev, tx_info->tx_cookie,
+						skb->data, skb->len, ack,
+						GFP_ATOMIC);
+#endif
+#endif
+		}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+		if (drvdbg & MDAT_D)
+			woal_packet_fate_monitor(priv, PACKET_TYPE_TX,
+						 ack ? TX_PKT_FATE_ACKED :
+						       TX_PKT_FATE_SENT,
+						 FRAME_TYPE_80211_MGMT, 0, 0,
+						 skb->data, skb->len);
+#endif
+#endif
+#endif
+		dev_kfree_skb_any(skb);
+		kfree(tx_info);
+	} else {
+		spin_unlock_irqrestore(&priv->tx_stat_lock, flag);
+	}
+}
+#endif
+
+/**
  *  @brief This function handles event receive
  *
  *  @param pmoal Pointer to the MOAL context
@@ -2292,6 +2939,11 @@
 #if defined(STA_SUPPORT) || defined(UAP_SUPPORT)
 	moal_private *pmpriv = NULL;
 #endif
+
+#if defined(STA_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+#endif
+#endif
 #if defined(STA_WEXT) || defined(UAP_WEXT)
 #if defined(STA_SUPPORT) || defined(UAP_WEXT)
 #if defined(UAP_SUPPORT) || defined(STA_WEXT)
@@ -2345,6 +2997,8 @@
 	unsigned long wait_time, wait_time_ms, timeout;
 #endif
 #endif
+	char iwevent_str[256];
+	addba_timeout_event *evtbuf = NULL;
 
 	t_u8 auto_fw_dump = MFALSE;
 	ENTER();
@@ -2354,6 +3008,8 @@
 			handle->is_fw_dump_timer_set = MTRUE;
 			woal_mod_timer(&handle->fw_dump_timer, MOAL_TIMER_5S);
 		}
+		handle->init_wait_q_woken = MTRUE;
+		wake_up(&handle->init_wait_q);
 		woal_store_firmware_dump(pmoal, pmevent);
 		handle->driver_status = MTRUE;
 		wifi_status = WIFI_STATUS_FW_DUMP;
@@ -2362,16 +3018,23 @@
 			ref_handle->driver_status = MTRUE;
 		goto done;
 	}
-	if ((pmevent->event_id != MLAN_EVENT_ID_DRV_DEFER_RX_WORK) &&
-	    (pmevent->event_id != MLAN_EVENT_ID_DRV_DEFER_HANDLING) &&
-	    (pmevent->event_id != MLAN_EVENT_ID_DRV_MGMT_FRAME))
+	if (MLAN_STATUS_SUCCESS ==
+	    wlan_process_defer_event(handle, pmevent->event_id))
+		goto done;
+	if (pmevent->event_id != MLAN_EVENT_ID_DRV_MGMT_FRAME)
 		PRINTM(MEVENT, "event id:0x%x\n", pmevent->event_id);
 #if defined(PCIE)
 	if (pmevent->event_id == MLAN_EVENT_ID_SSU_DUMP_FILE) {
+#ifndef DUMP_TO_PROC
+		woal_store_ssu_dump(pmoal, pmevent);
+#endif
 		goto done;
 	}
 #endif /* SSU_SUPPORT */
 	if (pmevent->event_id == MLAN_EVENT_ID_STORE_HOST_CMD_RESP) {
+#ifndef DUMP_TO_PROC
+		woal_save_host_cmdresp(handle, (mlan_cmdresp_event *)pmevent);
+#endif
 		goto done;
 	}
 	priv = woal_bss_index_to_priv(pmoal, pmevent->bss_index);
@@ -2390,33 +3053,6 @@
 #endif
 	switch (pmevent->event_id) {
 #ifdef STA_SUPPORT
-	case MLAN_EVENT_ID_FW_ADHOC_LINK_SENSED:
-		priv->is_adhoc_link_sensed = MTRUE;
-		if (!netif_carrier_ok(priv->netdev))
-			netif_carrier_on(priv->netdev);
-		woal_wake_queue(priv->netdev);
-#ifdef STA_WEXT
-		if (IS_STA_WEXT(cfg80211_wext))
-			woal_send_iwevcustom_event(priv,
-						   CUS_EVT_ADHOC_LINK_SENSED);
-#endif
-		woal_broadcast_event(priv, CUS_EVT_ADHOC_LINK_SENSED,
-				     strlen(CUS_EVT_ADHOC_LINK_SENSED));
-		break;
-
-	case MLAN_EVENT_ID_FW_ADHOC_LINK_LOST:
-		woal_stop_queue(priv->netdev);
-		if (netif_carrier_ok(priv->netdev))
-			netif_carrier_off(priv->netdev);
-		priv->is_adhoc_link_sensed = MFALSE;
-#ifdef STA_WEXT
-		if (IS_STA_WEXT(cfg80211_wext))
-			woal_send_iwevcustom_event(priv,
-						   CUS_EVT_ADHOC_LINK_LOST);
-#endif
-		woal_broadcast_event(priv, CUS_EVT_ADHOC_LINK_LOST,
-				     strlen(CUS_EVT_ADHOC_LINK_LOST));
-		break;
 
 	case MLAN_EVENT_ID_DRV_CONNECTED:
 #ifdef STA_WEXT
@@ -2425,7 +3061,11 @@
 			memset(wrqu.ap_addr.sa_data, 0x00, ETH_ALEN);
 			moal_memcpy_ext(priv->phandle, wrqu.ap_addr.sa_data,
 					pmevent->event_buf, ETH_ALEN,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+					sizeof(wrqu.ap_addr.sa_data_min));
+#else
 					sizeof(wrqu.ap_addr.sa_data));
+#endif
 			wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 			wireless_send_event(priv->netdev, SIOCGIWAP, &wrqu,
 					    NULL);
@@ -2435,9 +3075,11 @@
 		if (IS_STA_CFG80211(cfg80211_wext)) {
 			moal_memcpy_ext(priv->phandle, priv->cfg_bssid,
 					pmevent->event_buf, ETH_ALEN, ETH_ALEN);
-			woal_set_scan_time(priv, ACTIVE_SCAN_CHAN_TIME,
-					   PASSIVE_SCAN_CHAN_TIME,
-					   MIN_SPECIFIC_SCAN_CHAN_TIME);
+
+			if (!priv->phandle->user_scan_cfg)
+				woal_set_scan_time(priv, ACTIVE_SCAN_CHAN_TIME,
+						   PASSIVE_SCAN_CHAN_TIME,
+						   MIN_SPECIFIC_SCAN_CHAN_TIME);
 		}
 #endif
 		custom_len = strlen(CUS_EVT_AP_CONNECTED);
@@ -2482,11 +3124,13 @@
 					if (!priv->phandle->first_scan_done) {
 						priv->phandle->first_scan_done =
 							MTRUE;
-						woal_set_scan_time(
-							priv,
-							ACTIVE_SCAN_CHAN_TIME,
-							PASSIVE_SCAN_CHAN_TIME,
-							SPECIFIC_SCAN_CHAN_TIME);
+						if (!priv->phandle
+							     ->user_scan_cfg)
+							woal_set_scan_time(
+								priv,
+								ACTIVE_SCAN_CHAN_TIME,
+								PASSIVE_SCAN_CHAN_TIME,
+								SPECIFIC_SCAN_CHAN_TIME);
 					}
 					spin_lock_irqsave(
 						&priv->phandle->scan_req_lock,
@@ -2519,7 +3163,11 @@
 			woal_broadcast_event(priv, (t_u8 *)&pmevent->event_id,
 					     sizeof(mlan_event_id));
 		}
-
+		if (priv->phandle->scan_pending_on_block == MTRUE) {
+			priv->phandle->scan_pending_on_block = MFALSE;
+			priv->phandle->scan_priv = NULL;
+			MOAL_REL_SEMAPHORE(&priv->phandle->async_sem);
+		}
 		if (!is_zero_timeval(priv->phandle->scan_time_start)) {
 			woal_get_monotonic_time(&priv->phandle->scan_time_end);
 			priv->phandle->scan_time +=
@@ -2543,11 +3191,6 @@
 			priv->phandle->scan_time_start.time_usec = 0;
 		}
 
-		if (priv->phandle->scan_pending_on_block == MTRUE) {
-			priv->phandle->scan_pending_on_block = MFALSE;
-			priv->phandle->scan_priv = NULL;
-			MOAL_REL_SEMAPHORE(&priv->phandle->async_sem);
-		}
 		break;
 
 	case MLAN_EVENT_ID_DRV_OBSS_SCAN_PARAM:
@@ -2599,8 +3242,9 @@
 		break;
 
 	case MLAN_EVENT_ID_FW_DISCONNECTED:
-		woal_send_disconnect_to_system(priv,
-					       (t_u16)*pmevent->event_buf);
+		if (priv->media_connected)
+			woal_send_disconnect_to_system(
+				priv, (t_u16)*pmevent->event_buf);
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 		priv->auth_flag = 0;
@@ -2700,6 +3344,9 @@
 				*(t_s16 *)pmevent->event_buf,
 #endif
 				GFP_KERNEL);
+			woal_set_rssi_threshold(priv,
+						MLAN_EVENT_ID_FW_BCN_RSSI_LOW,
+						MOAL_NO_WAIT);
 			priv->last_event |= EVENT_BCN_RSSI_LOW;
 #endif
 			if (!hw_test && priv->roaming_enabled)
@@ -2862,6 +3509,12 @@
 					0,
 #endif
 					GFP_KERNEL);
+/* sending becon_loss event will help supplicant to roam to other APs if
+ * available on the same Network */
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+				cfg80211_cqm_beacon_loss_notify(priv->netdev,
+								GFP_KERNEL);
+#endif
 			}
 			priv->last_event |= EVENT_PRE_BCN_LOST;
 		}
@@ -2914,28 +3567,6 @@
 		woal_broadcast_event(priv, CUS_EVT_WEP_ICV_ERR,
 				     strlen(CUS_EVT_WEP_ICV_ERR));
 		break;
-
-	case MLAN_EVENT_ID_DRV_DEFER_HANDLING:
-		queue_work(priv->phandle->workqueue, &priv->phandle->main_work);
-		break;
-	case MLAN_EVENT_ID_DRV_FLUSH_RX_WORK:
-		if (moal_extflg_isset(priv->phandle, EXT_NAPI)) {
-			napi_synchronize(&priv->phandle->napi_rx);
-			break;
-		}
-		flush_workqueue(priv->phandle->rx_workqueue);
-		break;
-	case MLAN_EVENT_ID_DRV_FLUSH_MAIN_WORK:
-		flush_workqueue(priv->phandle->workqueue);
-		break;
-	case MLAN_EVENT_ID_DRV_DEFER_RX_WORK:
-		if (moal_extflg_isset(priv->phandle, EXT_NAPI)) {
-			napi_schedule(&priv->phandle->napi_rx);
-			break;
-		}
-		queue_work(priv->phandle->rx_workqueue,
-			   &priv->phandle->rx_work);
-		break;
 	case MLAN_EVENT_ID_DRV_DBG_DUMP:
 		priv->phandle->driver_status = MTRUE;
 		ref_handle = (moal_handle *)priv->phandle->pref_mac;
@@ -2986,7 +3617,7 @@
 			) {
 				priv->roaming_required = MTRUE;
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 				__pm_wakeup_event(&priv->phandle->ws,
 						  ROAMING_WAKE_LOCK_TIMEOUT);
 #else
@@ -3000,18 +3631,6 @@
 				wake_up_interruptible(
 					&priv->phandle->reassoc_thread.wait_q);
 #endif
-			} else {
-#if CFG80211_VERSION_CODE > KERNEL_VERSION(2, 6, 35)
-				if (priv->mrvl_rssi_low) {
-					cfg80211_cqm_rssi_notify(
-						priv->netdev,
-						NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-						0,
-#endif
-						GFP_KERNEL);
-				}
-#endif
 			}
 		}
 #endif
@@ -3037,6 +3656,8 @@
 				PRINTM(MMSG,
 				       "wlan: Report sched_scan result\n");
 				woal_report_sched_scan_result(priv);
+				woal_sched_timeout(50);
+				woal_bgscan_stop_event(priv);
 				priv->last_event = 0;
 				PRINTM(MEVENT,
 				       "Reporting Sched_Scan results\n");
@@ -3188,7 +3809,14 @@
 		snprintf(event_buf, sizeof(event_buf) - 1, "%s %d",
 			 CUS_EVT_RADAR_DETECTED, radar_chan);
 		woal_broadcast_event(priv, event_buf, strlen(event_buf));
-		PRINTM(MEVENT, "Radar detected on channel %d\n", radar_chan);
+		PRINTM(MEVENT, "%s: Radar detected on channel %d\n",
+		       priv->netdev->name, radar_chan);
+#ifdef UAP_SUPPORT
+		if (priv->chan_rpt_req.chanNum && priv->chan_rpt_pending) {
+			woal_11h_cancel_chan_report_ioctl(priv, MOAL_NO_WAIT);
+			priv->chan_rpt_pending = MFALSE;
+		}
+#endif
 
 #ifdef UAP_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
@@ -3210,9 +3838,9 @@
 						       DFS_UNAVAILABLE);
 #endif
 #ifdef UAP_SUPPORT
-		if ((priv->target_chan && priv->bss_started &&
-		     (priv->target_chan != radar_chan)) ||
-		    priv->backup_chan) {
+		if (priv->bss_started &&
+		    ((priv->target_chan && (priv->target_chan != radar_chan)) ||
+		     priv->backup_chan)) {
 			PRINTM(MEVENT, "Move to target or backup chan %d %d\n",
 			       priv->target_chan, priv->backup_chan);
 			woal_move_to_next_channel(priv);
@@ -3321,9 +3949,15 @@
 			}
 #endif
 #endif
-			if (priv->channel == pchan_info->channel)
+			/* Block host event only for same channel, same
+			 * bandwidth case */
+			if ((priv->channel == pchan_info->channel) &&
+			    (priv->bandwidth == pchan_info->bandcfg.chanWidth))
 				break;
+			PRINTM(MMSG, "OLD BW = %d NEW BW = %d", priv->bandwidth,
+			       pchan_info->bandcfg.chanWidth);
 			priv->channel = pchan_info->channel;
+			priv->bandwidth = pchan_info->bandcfg.chanWidth;
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 			if (MFALSE
@@ -3331,7 +3965,12 @@
 			    || priv->uap_host_based
 #endif
 #ifdef STA_CFG80211
-			    || priv->sme_current.ssid_len
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
+			    || priv->wdev->connected
+#else
+			    || priv->wdev->current_bss
+#endif
 #endif
 			) {
 				PRINTM(MEVENT,
@@ -3402,7 +4041,8 @@
 #endif
 		memset(&pm_info, 0, sizeof(mlan_ds_ps_info));
 		if (priv->phandle->suspend_fail == MFALSE) {
-			woal_get_pm_info(priv, &pm_info);
+			if (woal_get_pm_info(priv, &pm_info))
+				PRINTM(MEVENT, "get pm info failed\n");
 			if (pm_info.is_suspend_allowed == MTRUE) {
 				priv->phandle->hs_activated = MTRUE;
 #ifdef MMC_PM_FUNC_SUSPENDED
@@ -3456,10 +4096,14 @@
 #ifdef STA_SUPPORT
 #ifdef STA_CFG80211
 		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_STA);
-		if (IS_STA_CFG80211(cfg80211_wext) && pmpriv)
-			woal_set_scan_time(pmpriv, ACTIVE_SCAN_CHAN_TIME,
-					   PASSIVE_SCAN_CHAN_TIME,
-					   MIN_SPECIFIC_SCAN_CHAN_TIME);
+		if (IS_STA_CFG80211(cfg80211_wext) && pmpriv) {
+			if (!priv->phandle->user_scan_cfg) {
+				woal_set_scan_time(pmpriv,
+						   ACTIVE_SCAN_CHAN_TIME,
+						   PASSIVE_SCAN_CHAN_TIME,
+						   MIN_SPECIFIC_SCAN_CHAN_TIME);
+			}
+		}
 #endif
 #endif
 #ifdef UAP_CFG80211
@@ -3468,8 +4112,18 @@
 			PRINTM(MMSG,
 			       "Channel Under Nop: notify cfg80211 new channel=%d\n",
 			       priv->channel);
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
-			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0, 0);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 3, 0) &&                        \
+	CFG80211_VERSION_CODE < KERNEL_VERSION(6, 9, 0)
+			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0,
+						  0);
+#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 1, 0) &&                    \
+	(defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))) &&       \
+	CFG80211_VERSION_CODE < KERNEL_VERSION(6, 9, 0)
+			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0,
+						  0);
+#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                  \
+       (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
+			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0);
 #else
 			cfg80211_ch_switch_notify(priv->netdev, &priv->chan);
 #endif
@@ -3482,7 +4136,11 @@
 	case MLAN_EVENT_ID_DRV_UAP_CHAN_INFO:
 #ifdef UAP_CFG80211
 		if (IS_UAP_CFG80211(cfg80211_wext)) {
+			struct cfg80211_chan_def chandef;
 			pchan_info = (chan_band_info *)pmevent->event_buf;
+			if (woal_chandef_create(priv, &chandef, pchan_info))
+				PRINTM(MERROR,
+				       "Failed to create cfg80211_chan_def structure\n");
 			PRINTM(MEVENT,
 			       "UAP: 11n=%d, chan=%d, center_chan=%d, band=%d, width=%d, 2Offset=%d\n",
 			       pchan_info->is_11n_enabled, pchan_info->channel,
@@ -3491,7 +4149,9 @@
 			       pchan_info->bandcfg.chanWidth,
 			       pchan_info->bandcfg.chan2Offset);
 			if (priv->uap_host_based &&
-			    (priv->channel != pchan_info->channel))
+			    ((priv->chan.chan->hw_value !=
+			      pchan_info->channel) ||
+			     (priv->chan.width != chandef.width)))
 				woal_channel_switch_event(priv, pchan_info);
 		}
 #endif
@@ -3633,7 +4293,7 @@
 			memset(&wrqu, 0, sizeof(union iwreq_data));
 			wrqu.data.pointer = (t_u8 __user *)pmevent->event_buf;
 			if ((pmevent->event_len +
-			     strlen(CUS_EVT_STA_CONNECTED) + 1) > IW_CUSTOM_MAX)
+			     strlen(CUS_EVT_STA_CONNECTED) + 1) > 256)
 				wrqu.data.length =
 					ETH_ALEN +
 					strlen(CUS_EVT_STA_CONNECTED) + 1;
@@ -3658,10 +4318,18 @@
 				PRINTM(MCMND, "deauth reason code =0x%x\n",
 				       reason_code);
 				/** BIT 14 indicate deauth is initiated by FW */
-				if (reason_code & MBIT(14))
-					woal_host_mlme_disconnect(
-						priv, 0,
-						pmevent->event_buf + 2);
+				if (reason_code & MBIT(14)) {
+					if (reason_code & MBIT(1)) {
+						reason_code =
+							MLAN_REASON_DISASSOC_DUE_TO_INACTIVITY;
+						woal_host_mlme_disconnect(
+							priv, reason_code,
+							pmevent->event_buf + 2);
+					} else
+						woal_host_mlme_disconnect(
+							priv, 0,
+							pmevent->event_buf + 2);
+				}
 			} else
 #endif
 				if (priv->netdev && priv->wdev)
@@ -3706,7 +4374,7 @@
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		if (IS_STA_OR_UAP_CFG80211(cfg80211_wext)) {
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-			if (priv->netdev &&
+			if (priv->netdev && priv->netdev->ieee80211_ptr &&
 			    priv->netdev->ieee80211_ptr->wiphy->mgmt_stypes &&
 			    priv->mgmt_subtype_mask) {
 				/* frmctl + durationid + addr1 + addr2 + addr3 +
@@ -3803,7 +4471,8 @@
 						PRINTM(MEVENT,
 						       "HostMlme %s: Receive deauth/disassociate\n",
 						       priv->netdev->name);
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 						if (!priv->wdev->connected) {
 #else
 						if (!priv->wdev->current_bss) {
@@ -3823,14 +4492,11 @@
 #define MAX_DEAUTH_COUNTER 5
 							if (priv->deauth_evt_cnt >=
 							    MAX_DEAUTH_COUNTER) {
-								if (woal_reset_wifi(
-									    priv->phandle,
-									    priv->deauth_evt_cnt,
-									    "EAPOL timeout") ==
-								    MLAN_STATUS_SUCCESS) {
-									priv->deauth_evt_cnt =
-										0;
-								}
+								woal_wifi_reset_event(
+									priv,
+									priv->deauth_evt_cnt);
+								priv->deauth_evt_cnt =
+									0;
 							}
 						}
 						priv->cfg_disconnect = MTRUE;
@@ -3922,6 +4588,11 @@
 #endif
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+				// forward mgmt packet to kernel without (drvdbg
+				// & MDAT_D) because
+				//  (few) userspace process needs this for
+				//  processing disassoc/deauth event with reason
+				//  code
 				woal_packet_fate_monitor(
 					priv, PACKET_TYPE_RX,
 					RX_PKT_FATE_SUCCESS,
@@ -4041,8 +4712,8 @@
 		tx_status_event *tx_status =
 			(tx_status_event *)(pmevent->event_buf + 4);
 		struct tx_status_info *tx_info = NULL;
-		PRINTM(MINFO,
-		       "Receive Tx status: tx_token=%d, pkt_type=0x%x, status=%d tx_seq_num=%d\n",
+		PRINTM(MEVENT,
+		       "Wlan: Tx status: tx_token=%d, pkt_type=0x%x, status=%d priv->tx_seq_num=%d\n",
 		       tx_status->tx_token_id, tx_status->packet_type,
 		       tx_status->status, priv->tx_seq_num);
 		spin_lock_irqsave(&priv->tx_stat_lock, flag);
@@ -4063,10 +4734,13 @@
 					priv->phandle->priv
 						[priv->phandle->remain_bss_index];
 				if (remain_priv) {
-					woal_cfg80211_remain_on_channel_cfg(
-						remain_priv, MOAL_NO_WAIT,
-						MTRUE, &channel_status, NULL, 0,
-						0);
+					if (woal_cfg80211_remain_on_channel_cfg(
+						    remain_priv, MOAL_NO_WAIT,
+						    MTRUE, &channel_status,
+						    NULL, 0, 0))
+						PRINTM(MERROR,
+						       "remain_on_channel: Failed to cancel\n");
+
 					priv->phandle->remain_on_channel =
 						MFALSE;
 				}
@@ -4087,15 +4761,28 @@
 							skb->data, skb->len,
 							ack, GFP_ATOMIC);
 #endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+				if (tx_info->send_tx_expired) {
+					PRINTM(MINFO,
+					       "NAN: send tx duration expired for cookie=%llx\n",
+					       tx_info->tx_cookie);
+					cfg80211_tx_mgmt_expired(
+						priv->wdev, tx_info->tx_cookie,
+						&priv->phandle->chan,
+						GFP_ATOMIC);
+				}
+#endif
 #endif
 			}
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-			woal_packet_fate_monitor(priv, PACKET_TYPE_TX,
-						 ack ? TX_PKT_FATE_ACKED :
-						       TX_PKT_FATE_SENT,
-						 FRAME_TYPE_80211_MGMT, 0, 0,
-						 skb->data, skb->len);
+			if (drvdbg & MDAT_D)
+				woal_packet_fate_monitor(
+					priv, PACKET_TYPE_TX,
+					ack ? TX_PKT_FATE_ACKED :
+					      TX_PKT_FATE_SENT,
+					FRAME_TYPE_80211_MGMT, 0, 0, skb->data,
+					skb->len);
 #endif
 #endif
 #endif
@@ -4106,6 +4793,25 @@
 		}
 #endif
 	} break;
+	case MLAN_EVENT_ID_FW_TX_BULK_STATUS: {
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		tx_bulk_status_event *tx_status =
+			(tx_bulk_status_event *)(pmevent->event_buf + 4);
+		t_u8 curID = 0, num_of_events = 0, payload_len = 0;
+
+		payload_len = (pmevent->event_len - 4);
+		num_of_events =
+			((payload_len) / (sizeof(tx_mgmt_status_event)));
+
+		PRINTM(MEVENT,
+		       "Wlan: Bulk Tx status total_len=%d num_of_events=%d\n",
+		       payload_len, num_of_events);
+		while (curID < num_of_events) {
+			woal_process_event_tx_status(
+				priv, &(tx_status->bulk_events[curID++]));
+		}
+#endif
+	} break;
 	case MLAN_EVENT_ID_DRV_FT_RESPONSE:
 		if (priv->phandle->fw_roam_enable)
 			break;
@@ -4198,7 +4904,8 @@
 		roam_info =
 			kzalloc(sizeof(struct cfg80211_roam_info), GFP_ATOMIC);
 		if (roam_info) {
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			roam_info->links[0].bssid = priv->cfg_bssid;
 #else
 			roam_info->bssid = priv->cfg_bssid;
@@ -4228,6 +4935,36 @@
 		PRINTM(MMSG, "FW Roamed to bssid " MACSTR " successfully\n",
 		       MAC2STR(pmevent->event_buf));
 		break;
+	case MLAN_EVENT_ID_DRV_RTT_RESULT:
+		DBG_HEXDUMP(MEVT_D, "RTT result", pmevent->event_buf,
+			    pmevent->event_len);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+#ifdef STA_CFG80211
+		if (IS_STA_CFG80211(cfg80211_wext))
+			woal_cfg80211_event_rtt_result(priv, pmevent->event_buf,
+						       pmevent->event_len);
+#endif
+#endif
+		break;
+	case MLAN_EVENT_ID_DRV_ADDBA_TIMEOUT:
+		evtbuf = (addba_timeout_event *)(pmevent->event_buf);
+		DBG_HEXDUMP(MEVT_D, "ADDBA_TIMEOUT", pmevent->event_buf,
+			    pmevent->event_len);
+		memset(iwevent_str, 0, sizeof(iwevent_str));
+		snprintf(iwevent_str, sizeof(iwevent_str),
+			 "%s, MAC:%02x%02x%02x%02x%02x%02x,TID=%u",
+			 CUS_EVT_ADDBA_TIMEOUT, evtbuf->peer_mac_addr[0],
+			 evtbuf->peer_mac_addr[1], evtbuf->peer_mac_addr[2],
+			 evtbuf->peer_mac_addr[3], evtbuf->peer_mac_addr[4],
+			 evtbuf->peer_mac_addr[5], evtbuf->tid);
+#if defined(STA_SUPPORT) || defined(UAP_SUPPORT)
+#if defined(STA_WEXT) || defined(UAP_WEXT)
+		if (IS_STA_OR_UAP_WEXT(cfg80211_wext)) {
+			woal_send_iwevcustom_event(priv, iwevent_str);
+		}
+#endif
+#endif
+		break;
 	case MLAN_EVENT_ID_CSI:
 		DBG_HEXDUMP(MEVT_D, "CSI dump", pmevent->event_buf,
 			    pmevent->event_len);
@@ -4253,6 +4990,10 @@
 				     custom_len + csi_len);
 		priv->csi_seq++;
 		break;
+	case MLAN_EVENT_ID_DRV_RGPWR_KEY_MISMATCH:
+		if (handle->sec_rgpower)
+			woal_rgpower_key_mismatch_event(priv);
+		break;
 	default:
 		break;
 	}
@@ -4408,6 +5149,55 @@
 		spin_unlock_irqrestore(&priv->tdls_lock, flags);
 	}
 }
+#if 0
+/**
+ *  @brief This function records host time in nano seconds
+ *
+ *  @return                 64 bit value of host time in nano seconds
+ */
+s64 get_host_time_ns(void)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	struct timespec64 ts;
+#else
+	struct timespec ts;
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	ktime_get_real_ts64(&ts);
+	return timespec64_to_ns(&ts);
+#else
+	getnstimeofday(&ts);
+	return timespec_to_ns(&ts);
+#endif
+}
+#endif
+
+/**
+ *  @brief Retrieves the current system time
+ *
+ *  @param time     Pointer for the seconds of system time
+ *
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+mlan_status moal_get_host_time_ns(t_u64 *time)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	struct timespec64 ts;
+#else
+	struct timespec ts;
+#endif
+	t_u64 hclk_val;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+	ktime_get_real_ts64(&ts);
+#else
+	getnstimeofday(&ts);
+#endif
+	hclk_val = (ts.tv_sec * 1000000000L) + ts.tv_nsec;
+	*time = hclk_val;
+	return MLAN_STATUS_SUCCESS;
+}
 
 /**
  *  @brief Performs division of 64-bit num with base
@@ -4426,63 +5216,3 @@
 	do_div(val, base);
 	return val;
 }
-
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-/**
- *  @brief Performs wait event
- *
- *  @param pmoal   t_void
- *  @param bss_index      index of priv
- *  @return      MLAN_STATUS_SUCCESS
- */
-mlan_status moal_wait_hostcmd_complete(t_void *pmoal, t_u32 bss_index)
-{
-	mlan_status status = MLAN_STATUS_SUCCESS;
-	moal_handle *handle = (moal_handle *)pmoal;
-	moal_private *priv = woal_bss_index_to_priv(handle, bss_index);
-	long time_left = 0;
-
-	ENTER();
-
-	if (!priv) {
-		PRINTM(MERROR, "moal_wait_event: priv is null!\n");
-		goto done;
-	}
-
-	priv->hostcmd_wait_condition = MFALSE;
-	time_left = wait_event_timeout(priv->hostcmd_wait_q,
-				       priv->hostcmd_wait_condition,
-				       MOAL_IOCTL_TIMEOUT);
-
-	if (!time_left) {
-		PRINTM(MERROR, "moal_wait_event: wait timeout ");
-		status = MLAN_STATUS_FAILURE;
-	}
-
-done:
-	LEAVE();
-	return status;
-}
-
-/**
- *  @brief wake up esa wait_q
- *
- *  @param pmoal   t_void
- *  @param bss_index      index of priv
- *  @return      MLAN_STATUS_SUCCESS
- */
-mlan_status moal_notify_hostcmd_complete(t_void *pmoal, t_u32 bss_index)
-{
-	mlan_status status = MLAN_STATUS_SUCCESS;
-	moal_handle *handle = (moal_handle *)pmoal;
-	moal_private *priv = woal_bss_index_to_priv(handle, bss_index);
-
-	ENTER();
-
-	priv->hostcmd_wait_condition = MTRUE;
-	wake_up(&priv->hostcmd_wait_q);
-
-	LEAVE();
-	return status;
-}
-#endif
diff --git a/wlan_sd8987/mlinux/moal_shim.h b/wlan_src/mlinux/moal_shim.h
old mode 100755
new mode 100644
similarity index 79%
rename from wlan_sd8987/mlinux/moal_shim.h
rename to wlan_src/mlinux/moal_shim.h
index c7f947e..ae8dfa3
--- a/wlan_sd8987/mlinux/moal_shim.h
+++ b/wlan_src/mlinux/moal_shim.h
@@ -4,20 +4,28 @@
  * functions defined in moal module
  *
  *
- * Copyright 2008-2021 NXP
+ * Copyright 2008-2021, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 /*************************************************************
@@ -95,10 +103,6 @@
 mlan_status moal_free_lock(t_void *pmoal, t_void *plock);
 mlan_status moal_spin_lock(t_void *pmoal, t_void *plock);
 mlan_status moal_spin_unlock(t_void *pmoal, t_void *plock);
-#if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-mlan_status moal_wait_hostcmd_complete(t_void *pmoal, t_u32 bss_index);
-mlan_status moal_notify_hostcmd_complete(t_void *pmoal, t_u32 bss_index);
-#endif
 t_void moal_print(t_void *pmoal, t_u32 level, char *pformat, IN...);
 t_void moal_print_netintf(t_void *pmoal, t_u32 bss_index, t_u32 level);
 t_void moal_assert(t_void *pmoal, t_u32 cond);
@@ -107,6 +111,7 @@
 
 t_void moal_updata_peer_signal(t_void *pmoal, t_u32 bss_index, t_u8 *peer_addr,
 			       t_s8 snr, t_s8 nflr);
+mlan_status moal_get_host_time_ns(t_u64 *time);
 t_u64 moal_do_div(t_u64 num, t_u32 base);
 
 mlan_status moal_init_timer(t_void *pmoal, t_void **pptimer,
diff --git a/wlan_sd8987/mlinux/moal_sta_cfg80211.c b/wlan_src/mlinux/moal_sta_cfg80211.c
old mode 100755
new mode 100644
similarity index 86%
rename from wlan_sd8987/mlinux/moal_sta_cfg80211.c
rename to wlan_src/mlinux/moal_sta_cfg80211.c
index 8c86956..0e696ee
--- a/wlan_sd8987/mlinux/moal_sta_cfg80211.c
+++ b/wlan_src/mlinux/moal_sta_cfg80211.c
@@ -3,20 +3,28 @@
  * @brief This file contains the functions for STA CFG80211.
  *
  *
- * Copyright 2011-2022 NXP
+ * Copyright 2011-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -25,7 +33,7 @@
 #include "moal_sta_cfg80211.h"
 #include "moal_eth_ioctl.h"
 #ifdef UAP_SUPPORT
-#include "moal_uap.h"
+#include "moal_uap_cfg80211.h"
 #endif
 #include <linux/sort.h>
 
@@ -53,6 +61,38 @@
 #endif
 };
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 1, 0)
+static const u32 cfg80211_akm_suites[] = {
+	WLAN_AKM_SUITE_8021X,
+	WLAN_AKM_SUITE_PSK,
+	WLAN_AKM_SUITE_SAE,
+	WLAN_AKM_SUITE_FT_OVER_SAE,
+	WLAN_AKM_SUITE_8021X_SHA256,
+	WLAN_AKM_SUITE_PSK_SHA256,
+	WLAN_AKM_SUITE_TDLS,
+	WLAN_AKM_SUITE_FT_8021X,
+	WLAN_AKM_SUITE_FT_PSK,
+	WLAN_AKM_SUITE_8021X_SUITE_B,
+	WLAN_AKM_SUITE_8021X_SUITE_B_192,
+	WLAN_AKM_SUITE_FILS_SHA256,
+	WLAN_AKM_SUITE_FILS_SHA384,
+	WLAN_AKM_SUITE_FT_FILS_SHA256,
+	WLAN_AKM_SUITE_FT_FILS_SHA384,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+	WLAN_AKM_SUITE_OWE,
+#endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+	WLAN_AKM_SUITE_FT_PSK_SHA384,
+	WLAN_AKM_SUITE_PSK_SHA384,
+	WLAN_AKM_SUITE_FILS_SHA384,
+	WLAN_AKM_SUITE_FT_FILS_SHA384,
+#endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+	WLAN_AKM_SUITE_WFA_DPP,
+#endif
+};
+#endif
+
 #ifdef UAP_SUPPORT
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 static int woal_cfg80211_set_monitor_channel(struct wiphy *wiphy,
@@ -103,7 +143,8 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 static int woal_cfg80211_get_channel(struct wiphy *wiphy,
 				     struct wireless_dev *wdev,
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 				     unsigned int link_id,
 #endif
 				     struct cfg80211_chan_def *chandef);
@@ -133,7 +174,7 @@
 #else
 				      enum nl80211_tx_power_setting type,
 #endif
-				      int dbm);
+				      int mbm);
 #endif
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
@@ -210,6 +251,9 @@
 #else
 			    u8 *peer,
 #endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 5, 0)
+			    int link_id,
+#endif
 			    u8 action_code, u8 dialog_token, u16 status_code,
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
 			    u32 peer_capability,
@@ -279,12 +323,16 @@
 				      struct cfg80211_disassoc_request *req);
 #endif
 
-#ifdef UAP_CFG80211
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)
-int woal_cfg80211_set_radar_background(struct wiphy *wiphy,
-				       struct cfg80211_chan_def *chandef);
-#endif
-#endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+static int woal_cfg80211_add_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+				   u8 tsid, const u8 *peer, u8 user_prio,
+				   u16 admitted_time);
+static int woal_cfg80211_del_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+				   u8 tsid, const u8 *peer);
+#endif /* KERNEL_VERSION(3, 8, 0) */
+
+static mlan_status woal_cfg80211_dump_station_info(moal_private *priv,
+						   struct station_info *sinfo);
 
 /** cfg80211 operations */
 static struct cfg80211_ops woal_cfg80211_ops = {
@@ -423,6 +471,11 @@
 #ifdef CONFIG_NL80211_TESTMODE
 	.testmode_cmd = woal_testmode_cmd,
 #endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	.add_tx_ts = woal_cfg80211_add_tx_ts,
+	.del_tx_ts = woal_cfg80211_del_tx_ts,
+#endif /* KERNEL_VERSION(3, 8, 0) */
+
 };
 
 /** Region code mapping */
@@ -448,7 +501,6 @@
 		REG_RULE(5470 - 10, 5850 + 10, 80, 6, 20, 0),
 	}};
 
-#define AUTH_TX_DEFAULT_WAIT_TIME 2400
 /********************************************************
 				Local Variables
 ********************************************************/
@@ -458,9 +510,12 @@
 	ieee80211_mgmt_stypes[NUM_NL80211_IFTYPES] = {
 		[NL80211_IFTYPE_STATION] = {
 			.tx = MBIT(IEEE80211_STYPE_ACTION >> 4) |
-			      MBIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+			      MBIT(IEEE80211_STYPE_PROBE_RESP >> 4)|
+			      MBIT(IEEE80211_STYPE_AUTH >> 4)|
+			      MBIT(IEEE80211_STYPE_DEAUTH >> 4),
 			.rx = MBIT(IEEE80211_STYPE_ACTION >> 4) |
-			      MBIT(IEEE80211_STYPE_PROBE_REQ >> 4),
+			      MBIT(IEEE80211_STYPE_PROBE_REQ >> 4)|
+			      MBIT(IEEE80211_STYPE_AUTH >> 4),
 		},
 		[NL80211_IFTYPE_AP] = {
 			.tx = 0xffff,
@@ -894,8 +949,8 @@
  *
  * @return                  0 -- success, otherwise fail
  */
-static int woal_cfg80211_assoc_ies_cfg(moal_private *priv, t_u8 *ie, int ie_len,
-				       t_u8 wait_option)
+static int woal_cfg80211_assoc_ies_cfg(moal_private *priv, t_u8 *ie,
+				       size_t ie_len, t_u8 wait_option)
 {
 	int bytes_left = ie_len;
 	t_u8 *pcurrent_ptr = ie;
@@ -907,6 +962,9 @@
 	t_u8 wps_oui[] = {0x00, 0x50, 0xf2, 0x04};
 	t_u8 hs20_oui[] = {0x50, 0x6f, 0x9a, 0x10};
 
+	t_u8 multiap_oui[] = {0x50, 0x6f, 0x9a, 0x1b};
+	t_u8 multiap_flag = 0;
+
 	while (bytes_left >= 2) {
 		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
 		element_len = *((t_u8 *)pcurrent_ptr + 1);
@@ -944,6 +1002,21 @@
 				}
 			}
 
+			if (!memcmp(pvendor_ie->vend_hdr.oui, multiap_oui,
+				    sizeof(pvendor_ie->vend_hdr.oui)) &&
+			    (pvendor_ie->vend_hdr.oui_type == multiap_oui[3])) {
+				multiap_flag = pvendor_ie->data[0];
+				if (MLAN_STATUS_SUCCESS !=
+				    woal_multi_ap_cfg(priv, wait_option,
+						      multiap_flag)) {
+					PRINTM(MERROR,
+					       "%s: failed to configure multi ap\n",
+					       __func__);
+					ret = -EFAULT;
+					goto done;
+				}
+			}
+
 			if (!memcmp(pvendor_ie->vend_hdr.oui, hs20_oui,
 				    sizeof(pvendor_ie->vend_hdr.oui)) &&
 			    (pvendor_ie->vend_hdr.oui_type == hs20_oui[3])) {
@@ -1045,6 +1118,8 @@
 						pcurrent_ptr, &total_ie_len,
 						wait_option)) {
 				PRINTM(MERROR, "Fail to set GEN IE\n");
+				DBG_HEXDUMP(MCMD_D, "GEN IE", pcurrent_ptr,
+					    total_ie_len);
 				ret = -EFAULT;
 				goto done;
 			}
@@ -1190,6 +1265,7 @@
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
+
 	band = priv->phandle->band;
 	if (!priv->wdev->wiphy->bands[band]) {
 		PRINTM(MERROR, "11D: setting domain info in FW failed band=%d",
@@ -1224,7 +1300,7 @@
 			priv->phandle->country_code[1];
 	}
 	cfg_11d->param.domain_info.country_code[2] = ' ';
-	cfg_11d->param.domain_info.band = band;
+	cfg_11d->param.domain_info.band = woal_ieee_band_to_radio_type(band);
 
 	sband = priv->wdev->wiphy->bands[band];
 	for (i = 0; (i < sband->n_channels) &&
@@ -1274,6 +1350,11 @@
 	PRINTM(MCMND, "CFG80211: Country=%c%c, band=%d, no_of_sub_band=%d\n",
 	       priv->phandle->country_code[0], priv->phandle->country_code[1],
 	       priv->phandle->band, cfg_11d->param.domain_info.no_of_sub_band);
+
+	/* skip download the command to FW when “no_of_sub_band = 0” */
+	if (!no_of_sub_band)
+		goto done;
+
 	/* Send domain info command to FW */
 	status = woal_request_ioctl(priv, req, wait_option);
 	if (status != MLAN_STATUS_SUCCESS) {
@@ -1290,6 +1371,124 @@
 }
 
 /**
+ * @brief Send channel attributes to the FW
+ *
+ * @param priv      A pointer to moal_private structure
+ * @param is6g      whether its a 6g table
+ * @param wait_option  wait option
+ *
+ * @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status woal_dnld_chan_attr(moal_private *priv, t_bool is6g,
+				       t_u8 wait_option)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	struct ieee80211_supported_band *sband = NULL;
+	struct wiphy *wiphy = NULL;
+	t_u8 i, c = 0;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_ds_chan_attr *ca = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!priv || !priv->wdev || !priv->wdev->wiphy) {
+		PRINTM(MERROR, "No priv or no wdev or wiphy in priv\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	wiphy = priv->wdev->wiphy;
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_GET_CHAN_REGION_CFG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	memset(&misc->param.chan_attr_cfg, 0,
+	       sizeof(misc->param.chan_attr_cfg));
+
+	ca = (mlan_ds_chan_attr *)&misc->param.chan_attr_cfg;
+
+	{
+		req->action = MLAN_ACT_SET;
+		sband = wiphy->bands[NL80211_BAND_2GHZ];
+		if (sband) {
+			for (i = 0; i < sband->n_channels; i++, c++) {
+				ca->chan_attr[c].channel =
+					sband->channels[i].hw_value;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_DISABLED)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_DISABLED;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_NO_IR)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_PASSIVE;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_RADAR)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_DFS;
+				if ((sband->channels[i].flags &
+				     IEEE80211_CHAN_NO_HT40MINUS) &&
+				    (sband->channels[i].flags &
+				     IEEE80211_CHAN_NO_HT40PLUS))
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_NOHT40;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_NO_80MHZ)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_NOHT80;
+			}
+		}
+		sband = wiphy->bands[NL80211_BAND_5GHZ];
+		if (sband) {
+			for (i = 0; i < sband->n_channels; i++, c++) {
+				ca->chan_attr[c].channel =
+					sband->channels[i].hw_value;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_DISABLED)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_DISABLED;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_NO_IR)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_PASSIVE;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_RADAR)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_DFS;
+				if ((sband->channels[i].flags &
+				     IEEE80211_CHAN_NO_HT40MINUS) &&
+				    (sband->channels[i].flags &
+				     IEEE80211_CHAN_NO_HT40PLUS))
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_NOHT40;
+				if (sband->channels[i].flags &
+				    IEEE80211_CHAN_NO_80MHZ)
+					ca->chan_attr[c].flags |=
+						NXP_CHANNEL_NOHT80;
+			}
+		}
+	}
+	c = (c > MLAN_MAX_CHANNEL_NUM) ? MLAN_MAX_CHANNEL_NUM : c;
+	ca->data_len = c * sizeof(chan_attr_t);
+
+	/* Send chan attr command to FW */
+	if (c)
+		status = woal_request_ioctl(priv, req, wait_option);
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+/**
  * @brief Request the driver to change the channel and
  * change domain info according to that channel
  *
@@ -1341,11 +1540,6 @@
 	else {
 		config_bands = BAND_AN | BAND_A;
 	}
-	if (mode == MLAN_BSS_MODE_IBSS) {
-		radio_cfg->param.band_cfg.adhoc_start_band = config_bands;
-		radio_cfg->param.band_cfg.adhoc_channel =
-			ieee80211_frequency_to_channel(chan->center_freq);
-	}
 
 	status = woal_request_ioctl(priv, req, wait_option);
 	if (status != MLAN_STATUS_SUCCESS) {
@@ -1354,18 +1548,6 @@
 	}
 	woal_send_domain_info_cmd_fw(priv, wait_option);
 
-	PRINTM(MINFO, "Setting band %d, and mode = %d channel=%d\n",
-	       config_bands, mode,
-	       ieee80211_frequency_to_channel(chan->center_freq));
-
-	if (MLAN_STATUS_SUCCESS !=
-	    woal_change_adhoc_chan(
-		    priv, ieee80211_frequency_to_channel(chan->center_freq),
-		    wait_option)) {
-		ret = -EFAULT;
-		goto done;
-	}
-
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(req);
@@ -1487,7 +1669,18 @@
 	static wifi_timeval reset_time;
 	wifi_timeval ts;
 	t_u64 diff;
+	t_u8 intf_num;
 
+	/* Disconnect all interfaces */
+	for (intf_num = 0; intf_num < handle->priv_num; intf_num++) {
+		if (handle->priv[intf_num] &&
+		    handle->priv[intf_num]->media_connected == MTRUE) {
+			if (woal_disconnect(handle->priv[intf_num],
+					    MOAL_IOCTL_WAIT, NULL,
+					    DEF_DEAUTH_REASON_CODE))
+				PRINTM(MERROR, "woal_disconnect failed\n");
+		}
+	}
 #define MAX_WIFI_RESET_INTERVAL 15 * 60 * 1000000 // 15 minute
 	woal_get_monotonic_time(&ts);
 	diff = (t_u64)(timeval_to_usec(ts) - timeval_to_usec(reset_time));
@@ -1646,84 +1839,6 @@
 }
 
 /**
- * @brief Informs the CFG802.11 subsystem of a new IBSS connection.
- *
- * The following information are sent to the CFG802.11 subsystem
- * to register the new IBSS connection. If we do not register the
- * new IBSS, a kernel panic will result.
- *      - MAC address
- *      - Capabilities
- *      - Beacon period
- *      - RSSI value
- *      - Channel
- *      - Supported rates IE
- *      - Extended capabilities IE
- *      - DS parameter set IE
- *      - HT Capability IE
- *      - Vendor Specific IE (221)
- *      - WPA IE
- *      - RSN IE
- *
- * @param priv              A pointer to moal_private structure
- * @param cahn              A pointer to ieee80211_channel structure
- * @param beacon_interval   Beacon interval
- *
- * @return                  MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-static mlan_status woal_cfg80211_inform_ibss_bss(moal_private *priv,
-						 struct ieee80211_channel *chan,
-						 t_u16 beacon_interval)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_bss_info bss_info;
-	mlan_ds_get_signal signal;
-	t_u8 ie_buf[MLAN_MAX_SSID_LENGTH + sizeof(IEEEtypes_Header_t)];
-	int ie_len = 0;
-	struct cfg80211_bss *bss = NULL;
-
-	ENTER();
-
-	ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
-	if (ret)
-		goto done;
-
-	memset(ie_buf, 0, sizeof(ie_buf));
-	ie_buf[0] = WLAN_EID_SSID;
-	ie_buf[1] = bss_info.ssid.ssid_len;
-
-	moal_memcpy_ext(priv->phandle, &ie_buf[sizeof(IEEEtypes_Header_t)],
-			&bss_info.ssid.ssid, bss_info.ssid.ssid_len,
-			sizeof(ie_buf) - sizeof(IEEEtypes_Header_t));
-	ie_len = ie_buf[1] + sizeof(IEEEtypes_Header_t);
-
-	/* Get signal information from the firmware */
-	memset(&signal, 0, sizeof(mlan_ds_get_signal));
-	if (MLAN_STATUS_SUCCESS !=
-	    woal_get_signal_info(priv, MOAL_IOCTL_WAIT, &signal)) {
-		PRINTM(MERROR, "Error getting signal information\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
-
-	bss = cfg80211_inform_bss(priv->wdev->wiphy, chan,
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
-				  CFG80211_BSS_FTYPE_UNKNOWN,
-#endif
-				  bss_info.bssid, 0, WLAN_CAPABILITY_IBSS,
-				  beacon_interval, ie_buf, ie_len,
-				  signal.bcn_rssi_avg, GFP_KERNEL);
-	if (bss)
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
-		cfg80211_put_bss(priv->wdev->wiphy, bss);
-#else
-		cfg80211_put_bss(bss);
-#endif
-done:
-	LEAVE();
-	return ret;
-}
-
-/**
  * @brief Process country IE before assoicate
  *
  * @param priv            A pointer to moal_private structure
@@ -1927,6 +2042,49 @@
 	return ret;
 }
 
+/**
+ *  @brief This function check if scan is allowed o/n specified band
+ *
+ *  @param priv     A pointer to moal_private structure
+ *  @param chan     ieee80211_channel
+ *
+ *  @return           MTRUE/MFALSE
+ */
+static t_u8 is_scan_band_allowed(moal_private *priv,
+				 struct ieee80211_channel *chan)
+{
+	t_u8 ret = MTRUE;
+	t_u8 band_mask = 0;
+
+	ENTER();
+	if (!priv->scan_setband_mask) {
+		LEAVE();
+		return ret;
+	}
+
+	switch (chan->band) {
+	case IEEE80211_BAND_5GHZ:
+		band_mask = SCAN_SETBAND_5G;
+		break;
+	case IEEE80211_BAND_2GHZ:
+		band_mask = SCAN_SETBAND_2G;
+		break;
+	default:
+		break;
+	}
+
+	if (band_mask & priv->scan_setband_mask) {
+		ret = MTRUE;
+	} else {
+		PRINTM(MINFO, "is_scan_band_allowed: Avoid scan on band %d\n",
+		       chan->band);
+		ret = MFALSE;
+	}
+
+	LEAVE();
+	return ret;
+}
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 /**
  * @brief Save assoc parameters for roaming
@@ -1954,6 +2112,12 @@
 			MLAN_MAC_ADDR_LENGTH);
 	if (req->ie && req->ie_len) {
 		priv->sme_current.ie = kzalloc(req->ie_len, GFP_ATOMIC);
+		if (!priv->sme_current.ie) {
+			PRINTM(MERROR,
+			       "Failed to allocate memory for sme params\n");
+			LEAVE();
+			return;
+		}
 		priv->sme_current.ie_len = req->ie_len;
 		moal_memcpy_ext(priv->phandle, (void *)priv->sme_current.ie,
 				req->ie, req->ie_len, priv->sme_current.ie_len);
@@ -1989,7 +2153,7 @@
 	if (priv->sinfo)
 		memset(priv->sinfo, 0, sizeof(struct station_info));
 	else
-		priv->sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
+		priv->sinfo = kzalloc(sizeof(struct station_info), GFP_ATOMIC);
 	LEAVE();
 }
 
@@ -2126,6 +2290,46 @@
 }
 
 /**
+ *  @brief Send set host_mlme request to MLAN
+ *
+ *  @param priv   A pointer to moal_private structure
+ *
+ *  @return       MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING
+ *                  -- success, otherwise fail
+ */
+static mlan_status woal_request_set_host_mlme(moal_private *priv, t_u8 *bssid)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_bss *bss = NULL;
+	mlan_status status;
+	ENTER();
+
+	/* Allocate an IOCTL request buffer */
+	req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
+	if (req == NULL) {
+		status = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	bss = (mlan_ds_bss *)req->pbuf;
+	bss->sub_command = MLAN_OID_BSS_HOST_MLME;
+	req->req_id = MLAN_IOCTL_BSS;
+	req->action = MLAN_ACT_SET;
+	if (bssid) {
+		moal_memcpy_ext(priv->phandle, &bss->param.bssid, bssid,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	}
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return status;
+}
+
+/**
  *  @brief This function is authentication handler when host MLME
  *          enable.
  *          In this case driver will prepare and send Auth Req.
@@ -2146,20 +2350,39 @@
 	IEEE80211_MGMT *mgmt = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	pmlan_buffer pmbuf = NULL;
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	t_u8 *pbuf = NULL;
 	t_u32 pkt_type, tx_control;
 	t_u16 packet_len = 0, auth_alg;
+	t_u16 pkt_len;
 	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 	int ret = 0;
-
 	t_u8 trans = 1, status_code = 0;
 	t_u8 *varptr = NULL;
-	mlan_ssid_bssid *ssid_bssid;
 	moal_handle *handle = priv->phandle;
+	mlan_ssid_bssid *ssid_bssid;
 	int i;
 
 	ENTER();
 
+	if (!is_scan_band_allowed(priv, req->bss->channel)) {
+		LEAVE();
+		return -EFAULT;
+	}
+#ifdef REASSOCIATION
+	// disable reassoc_on
+	handle->reassoc_on &= ~MBIT(priv->bss_index);
+	priv->reassoc_on = MFALSE;
+	priv->reassoc_required = MFALSE;
+	if (!handle->reassoc_on && handle->is_reassoc_timer_set == MTRUE) {
+		woal_cancel_timer(&handle->reassoc_timer);
+		handle->is_reassoc_timer_set = MFALSE;
+	}
+#endif
+
 	priv->cfg_disconnect = MFALSE;
+	priv->delay_deauth_notify = MFALSE;
 #ifdef UAP_CFG80211
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
 		PRINTM(MERROR, "ERR: Role is AP\n");
@@ -2208,7 +2431,7 @@
 		woal_cfg80211_auth_scan(priv, req, MOAL_IOCTL_WAIT);
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_find_bssid(priv, req->bss->bssid)) {
-			PRINTM(MMSG, "bssid not find in scan list\n");
+			PRINTM(MMSG, "bssid not found in scan list\n");
 			kfree(ssid_bssid);
 			LEAVE();
 			return -EFAULT;
@@ -2256,31 +2479,9 @@
 		woal_mgmt_frame_register(priv, IEEE80211_STYPE_DISASSOC, MTRUE);
 	}
 
-#define HEADER_SIZE 8
-	// frmctl + durationid + addr1 + addr2 + addr3 + seqctl + addr4
-#define MGMT_HEADER_LEN (2 + 2 + 6 + 6 + 6 + 2 + 6)
-	// 6   = auth_alg + auth_transaction +auth_status
-#define AUTH_BODY_LEN 6
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
-	packet_len = (t_u16)req->ie_len + req->auth_data_len + MGMT_HEADER_LEN +
-		     AUTH_BODY_LEN;
-#else
-	packet_len = (t_u16)req->ie_len + req->sae_data_len + MGMT_HEADER_LEN +
-		     AUTH_BODY_LEN;
-#endif
-	pmbuf = woal_alloc_mlan_buffer(priv->phandle,
-				       MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE +
-					       packet_len + sizeof(packet_len));
-
-	if (!pmbuf) {
-		PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
-		ret = -ENOMEM;
-		goto done;
-	}
-
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_cfg80211_set_key(priv, 0, 0, NULL, 0, NULL, 0,
-				  KEY_INDEX_CLEAR_ALL, NULL, 1,
+				  KEY_INDEX_CLEAR_ALL, NULL, 1, 0,
 				  MOAL_IOCTL_WAIT)) {
 		/* Disable keys and clear all previous security settings */
 		PRINTM(MERROR, "Fail to clear previous keys\n");
@@ -2343,9 +2544,48 @@
 	}
 
 	if (priv->auth_flag == 0) {
+		/*
+		 * The priority of auth req is highest so we need to cancel
+		 * current exist remain on channel for same function.
+		 * EX: If wfd0 supplicant often scans, mlan0 is difficult to
+		 * get the chance to request ROC.
+		 * Risk: If exist one is another auth, it will be replaced
+		 * with new auth ROC request.
+		 * Avoid: if using woal_cfg80211_mgmt_tx_cancel_wait(), we
+		 * cannot sure the result when the API reports cancel event
+		 * to cfg80211 if priv->phandle->cookie != 0.
+		 */
+		if (priv->phandle->remain_on_channel) {
+			moal_private *remain_priv = NULL;
+			remain_priv =
+				priv->phandle
+					->priv[priv->phandle->remain_bss_index];
+			if (!remain_priv) {
+				/* cannot find its priv, weird! keep
+				 * continuing... */
+				PRINTM(MERROR,
+				       "mgmt_tx_cancel_wait: Wrong remain_bss_index=%d\n",
+				       priv->phandle->remain_bss_index);
+			} else {
+				if (woal_cfg80211_remain_on_channel_cfg(
+					    remain_priv, MOAL_IOCTL_WAIT, MTRUE,
+					    (t_u8 *)&status, NULL, 0, 0)) {
+					/* fail to cancel current one! keep
+					 * continuing... */
+					PRINTM(MERROR,
+					       "mgmt_tx_cancel_wait: Fail to cancel remain on channel\n");
+				} else {
+					/* only cancel is successfully then
+					 * change the flag */
+					priv->phandle->remain_on_channel =
+						MFALSE;
+				}
+			}
+		}
+
 		if (woal_cfg80211_remain_on_channel_cfg(
 			    priv, MOAL_IOCTL_WAIT, MFALSE, (t_u8 *)&status,
-			    req->bss->channel, 0, AUTH_TX_DEFAULT_WAIT_TIME)) {
+			    req->bss->channel, 0, priv->auth_tx_wait_time)) {
 			PRINTM(MERROR, "Fail to configure remain on channel\n");
 			ret = -EFAULT;
 			goto done;
@@ -2362,19 +2602,54 @@
 			       dev->name, status);
 		}
 	}
+#define HEADER_SIZE 8
+	// frmctl + durationid + addr1 + addr2 + addr3 + seqctl + addr4
+#define MGMT_HEADER_LEN (2 + 2 + 6 + 6 + 6 + 2 + 6)
+	// 6   = auth_alg + auth_transaction +auth_status
+#define AUTH_BODY_LEN 6
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
+	packet_len = (t_u16)req->ie_len + req->auth_data_len + MGMT_HEADER_LEN +
+		     AUTH_BODY_LEN;
+#else
+	packet_len = (t_u16)req->ie_len + req->sae_data_len + MGMT_HEADER_LEN +
+		     AUTH_BODY_LEN;
+#endif
+	if (priv->phandle->cmd_tx_data) {
+		ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+		if (ioctl_req == NULL) {
+			ret = -ENOMEM;
+			goto done;
+		}
+		misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+		misc->sub_command = MLAN_OID_MISC_TX_FRAME;
+		ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+		ioctl_req->action = MLAN_ACT_SET;
+		misc->param.tx_frame.bandcfg.chanBand =
+			woal_ieee_band_to_radio_type(req->bss->channel->band);
+		misc->param.tx_frame.channel = req->bss->channel->hw_value;
+		pbuf = misc->param.tx_frame.tx_buf;
+	} else {
+		pmbuf = woal_alloc_mlan_buffer(
+			priv->phandle, MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE +
+					       packet_len + sizeof(packet_len));
 
-	pmbuf->data_offset = MLAN_MIN_DATA_HEADER_LEN;
+		if (!pmbuf) {
+			PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
+			ret = -ENOMEM;
+			goto done;
+		}
+		pmbuf->data_offset = MLAN_MIN_DATA_HEADER_LEN;
+		pbuf = pmbuf->pbuf + pmbuf->data_offset;
+	}
 	pkt_type = MRVL_PKT_TYPE_MGMT_FRAME;
 	tx_control = 0;
 	/* Add pkt_type and tx_control */
-	moal_memcpy_ext(priv->phandle, pmbuf->pbuf + pmbuf->data_offset,
-			&pkt_type, sizeof(pkt_type), sizeof(pkt_type));
-	moal_memcpy_ext(priv->phandle,
-			pmbuf->pbuf + pmbuf->data_offset + sizeof(pkt_type),
-			&tx_control, sizeof(tx_control), sizeof(tx_control));
+	moal_memcpy_ext(priv->phandle, pbuf, &pkt_type, sizeof(pkt_type),
+			sizeof(pkt_type));
+	moal_memcpy_ext(priv->phandle, pbuf + sizeof(pkt_type), &tx_control,
+			sizeof(tx_control), sizeof(tx_control));
 
-	mgmt = (IEEE80211_MGMT *)(pmbuf->pbuf + pmbuf->data_offset +
-				  HEADER_SIZE + sizeof(packet_len));
+	mgmt = (IEEE80211_MGMT *)(pbuf + HEADER_SIZE + sizeof(packet_len));
 	memset(mgmt, 0, MGMT_HEADER_LEN);
 	/**Authentication Frame: Frame Control*/
 	mgmt->frame_control =
@@ -2423,15 +2698,15 @@
 	}
 #endif
 	/*Add packet len*/
-	moal_memcpy_ext(priv->phandle,
-			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), sizeof(packet_len));
+	pkt_len = woal_cpu_to_le16(packet_len);
+	moal_memcpy_ext(priv->phandle, pbuf + HEADER_SIZE, &pkt_len,
+			sizeof(pkt_len), sizeof(pkt_len));
 
 	/**Authentication Frame: Authentication Alg*/
 	mgmt->u.auth.auth_alg = woal_cpu_to_le16(auth_alg);
-	mgmt->u.auth.auth_transaction = trans;
+	mgmt->u.auth.auth_transaction = woal_cpu_to_le16(trans);
 	/**Authentication Frame: Status code*/
-	mgmt->u.auth.status_code = status_code;
+	mgmt->u.auth.status_code = woal_cpu_to_le16(status_code);
 
 	if (req->ie && req->ie_len) {
 		if (!varptr) {
@@ -2441,56 +2716,83 @@
 				req->ie_len, req->ie_len);
 	}
 
-	pmbuf->data_len = HEADER_SIZE + packet_len + sizeof(packet_len);
-	pmbuf->buf_type = MLAN_BUF_TYPE_RAW_DATA;
-	pmbuf->bss_index = priv->bss_index;
-	pmbuf->priority = 7;
-
 	priv->host_mlme = MTRUE;
 	priv->auth_flag = HOST_MLME_AUTH_PENDING;
 	priv->auth_alg = woal_cpu_to_le16(auth_alg);
+	woal_save_auth_params(priv, req);
+	woal_request_set_host_mlme(priv, req->bss->bssid);
 
 	PRINTM(MMSG, "wlan: HostMlme %s send auth to bssid " MACSTR "\n",
 	       dev->name, MAC2STR(req->bss->bssid));
-	DBG_HEXDUMP(MDAT_D, "Auth:", pmbuf->pbuf + pmbuf->data_offset,
-		    pmbuf->data_len);
-	woal_save_auth_params(priv, req);
-	status = mlan_send_packet(priv->phandle->pmlan_adapter, pmbuf);
-
-	switch (status) {
-	case MLAN_STATUS_PENDING:
-		atomic_inc(&priv->phandle->tx_pending);
-		queue_work(priv->phandle->workqueue, &priv->phandle->main_work);
-#define MAX_AUTH_COUNTER 5
-		priv->auth_tx_cnt++;
-		if (priv->auth_tx_cnt >= MAX_AUTH_COUNTER) {
-			if (woal_reset_wifi(priv->phandle, priv->auth_tx_cnt,
-					    "auth timeout") ==
-			    MLAN_STATUS_SUCCESS) {
-				priv->auth_tx_cnt = 0;
-			}
+	DBG_HEXDUMP(MDAT_D, "Auth:", pbuf,
+		    HEADER_SIZE + packet_len + sizeof(packet_len));
+	if (priv->phandle->cmd_tx_data) {
+		misc->param.tx_frame.data_len =
+			HEADER_SIZE + packet_len + sizeof(packet_len);
+		misc->param.tx_frame.buf_type = MLAN_BUF_TYPE_RAW_DATA;
+		misc->param.tx_frame.priority = 7;
+		status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+		if (status != MLAN_STATUS_SUCCESS) {
+			priv->host_mlme = MFALSE;
+			priv->auth_flag = 0;
+			priv->auth_alg = 0xFFFF;
+			ret = -EFAULT;
+			PRINTM(MERROR, "Fail to send packet status=%d\n",
+			       status);
 		}
-		break;
-	case MLAN_STATUS_SUCCESS:
-		woal_free_mlan_buffer(priv->phandle, pmbuf);
-		break;
-	case MLAN_STATUS_FAILURE:
-	default:
-		woal_free_mlan_buffer(priv->phandle, pmbuf);
-		priv->host_mlme = MFALSE;
-		priv->auth_flag = 0;
-		priv->auth_alg = 0xFFFF;
-		ret = -EFAULT;
-		PRINTM(MERROR, "Fail to send packet status=%d\n", status);
-		break;
+	} else {
+		pmbuf->data_len = HEADER_SIZE + packet_len + sizeof(packet_len);
+		pmbuf->buf_type = MLAN_BUF_TYPE_RAW_DATA;
+		pmbuf->bss_index = priv->bss_index;
+		pmbuf->priority = 7;
+
+		status = mlan_send_packet(priv->phandle->pmlan_adapter, pmbuf);
+
+		switch (status) {
+		case MLAN_STATUS_PENDING:
+			atomic_inc(&priv->phandle->tx_pending);
+			queue_work(priv->phandle->workqueue,
+				   &priv->phandle->main_work);
+#define MAX_AUTH_COUNTER 5
+			priv->auth_tx_cnt++;
+			if (priv->auth_tx_cnt >= MAX_AUTH_COUNTER) {
+				if (woal_reset_wifi(priv->phandle,
+						    priv->auth_tx_cnt,
+						    "auth timeout") ==
+				    MLAN_STATUS_SUCCESS) {
+					priv->auth_tx_cnt = 0;
+				}
+			}
+			break;
+		case MLAN_STATUS_SUCCESS:
+			woal_free_mlan_buffer(priv->phandle, pmbuf);
+			break;
+		case MLAN_STATUS_FAILURE:
+		default:
+			woal_free_mlan_buffer(priv->phandle, pmbuf);
+			priv->host_mlme = MFALSE;
+			priv->auth_flag = 0;
+			priv->auth_alg = 0xFFFF;
+			ret = -EFAULT;
+			PRINTM(MERROR, "Fail to send packet status=%d\n",
+			       status);
+			break;
+		}
 	}
 done:
+	if (priv->phandle->cmd_tx_data) {
+		if (status != MLAN_STATUS_PENDING)
+			kfree(ioctl_req);
+	}
 	if (ret) {
 		woal_mgmt_frame_register(priv, IEEE80211_STYPE_AUTH, MFALSE);
 		if (priv->phandle->remain_on_channel) {
-			woal_cfg80211_remain_on_channel_cfg(
-				priv, MOAL_IOCTL_WAIT, MTRUE, (t_u8 *)&status,
-				NULL, 0, 0);
+			if (woal_cfg80211_remain_on_channel_cfg(
+				    priv, MOAL_IOCTL_WAIT, MTRUE,
+				    (t_u8 *)&status, NULL, 0, 0)) {
+				PRINTM(MERROR,
+				       "Fail to cancel remain on channel\n");
+			}
 			priv->phandle->remain_on_channel = MFALSE;
 		}
 	}
@@ -2519,9 +2821,12 @@
 						 MFALSE);
 
 			if (priv->phandle->remain_on_channel) {
-				woal_cfg80211_remain_on_channel_cfg(
-					priv, MOAL_IOCTL_WAIT, MTRUE,
-					(t_u8 *)&status, NULL, 0, 0);
+				if (woal_cfg80211_remain_on_channel_cfg(
+					    priv, MOAL_IOCTL_WAIT, MTRUE,
+					    (t_u8 *)&status, NULL, 0, 0)) {
+					PRINTM(MERROR,
+					       "failed to cancel remain on channel\n");
+				}
 				priv->phandle->remain_on_channel = MFALSE;
 			}
 			PRINTM(MCMND, "wlan: HostMlme %s auth success\n",
@@ -2531,6 +2836,37 @@
 }
 
 /**
+ *  @brief This workqueue function handles association timeout event in event
+ * queue case
+ *
+ *  @param priv         pointer to moal_private
+ *  @param assoc_info   pointer to cfg80211_bss
+ *
+ *  @return        N/A
+ */
+
+void woal_host_mlme_process_assoc_timeout(moal_private *priv,
+					  struct cfg80211_bss *bss)
+{
+	/* Send Assoc Failure with Timeout to CFG80211 */
+#if (CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0) ||                       \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33 &&             \
+      CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 74)))
+	struct cfg80211_assoc_failure data;
+	memset(&data, 0, sizeof(struct cfg80211_assoc_failure));
+	data.timeout = 1;
+	data.bss[0] = bss;
+	PRINTM(MEVENT, "wlan: HostMlme assoc failure\n");
+	cfg80211_assoc_failure(priv->netdev, &data);
+#else
+	PRINTM(MEVENT, "wlan: HostMlme assoc timeout\n");
+	cfg80211_assoc_timeout(priv->netdev, bss);
+#endif
+	memset(priv->cfg_bssid, 0, ETH_ALEN);
+	woal_clear_conn_params(priv);
+}
+
+/**
  *  @brief This workqueue function handles association response in event queue
  * case
  *
@@ -2544,8 +2880,15 @@
 {
 	struct cfg80211_bss *bss = NULL;
 	unsigned long flags;
+	t_u8 qos_cfg = 0;
+	int uapsd_queues = -1;
 	u8 *assoc_req_buf = NULL;
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+	struct cfg80211_rx_assoc_resp_data resp = {
+		.uapsd_queues = -1,
+	};
+#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                   \
+       (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	struct cfg80211_rx_assoc_resp resp = {
 		.uapsd_queues = -1,
 	};
@@ -2602,26 +2945,50 @@
 						assoc_req_buf =
 							assoc_info
 								->assoc_req_buf;
+					if (!woal_priv_qos_cfg(priv,
+							       MLAN_ACT_GET,
+							       &qos_cfg) &&
+					    qos_cfg != 0) {
+						int ac;
+						uapsd_queues = 0;
+						for (ac = WMM_AC_BK;
+						     ac <= WMM_AC_VO; ac++) {
+							if (qos_cfg &
+							    MBIT(WMM_AC_VO -
+								 ac))
+								uapsd_queues |=
+									MBIT(ac);
+						}
+					}
 
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 					resp.links[0].bss = bss;
 					resp.buf = assoc_info->assoc_resp_buf;
 					resp.len = assoc_info->assoc_resp_len;
 					resp.req_ies = assoc_req_buf;
 					resp.req_ies_len =
 						assoc_info->assoc_req_len;
+					resp.uapsd_queues = uapsd_queues;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+					wiphy_lock(priv->wdev->wiphy);
+					cfg80211_rx_assoc_resp(priv->netdev,
+							       &resp);
+					wiphy_unlock(priv->wdev->wiphy);
+#else
 					mutex_lock(&priv->wdev->mtx);
 					cfg80211_rx_assoc_resp(priv->netdev,
 							       &resp);
 					mutex_unlock(&priv->wdev->mtx);
+#endif
 #else
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 1, 0)
 					mutex_lock(&priv->wdev->mtx);
 					cfg80211_rx_assoc_resp(
 						priv->netdev, bss,
 						assoc_info->assoc_resp_buf,
-						assoc_info->assoc_resp_len, -1,
-						assoc_req_buf,
+						assoc_info->assoc_resp_len,
+						uapsd_queues, assoc_req_buf,
 						assoc_info->assoc_req_len);
 					mutex_unlock(&priv->wdev->mtx);
 #else
@@ -2630,7 +2997,8 @@
 					cfg80211_rx_assoc_resp(
 						priv->netdev, bss,
 						assoc_info->assoc_resp_buf,
-						assoc_info->assoc_resp_len, -1);
+						assoc_info->assoc_resp_len,
+						uapsd_queues);
 					mutex_unlock(&priv->wdev->mtx);
 #else
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
@@ -2656,6 +3024,36 @@
 }
 
 /**
+ * @brief   Handle assoc timeout event (When AP do not respond to (Re)Assoc
+ * Request)
+ *
+ * @param priv          A pointer moal_private structure
+ * @param pchan_info    A pointer to cfg80211_assoc_request structre
+ *
+ * @return          N/A
+ */
+
+static void woal_assoc_timeout_event(moal_private *priv,
+				     struct cfg80211_assoc_request *req)
+{
+	struct woal_event *evt;
+	unsigned long flags;
+	moal_handle *handle = priv->phandle;
+	evt = kzalloc(sizeof(struct woal_event), GFP_ATOMIC);
+	if (evt) {
+		evt->priv = priv;
+		evt->type = WOAL_EVENT_ASSOC_TIMEOUT;
+		evt->assoc_bss = req->bss;
+		INIT_LIST_HEAD(&evt->link);
+		spin_lock_irqsave(&handle->evt_lock, flags);
+		list_add_tail(&evt->link, &handle->evt_queue);
+		spin_unlock_irqrestore(&handle->evt_lock, flags);
+		queue_work(handle->evt_workqueue, &handle->evt_work);
+	}
+	// coverity[leaked_storage:SUPPRESS]
+}
+
+/**
  * @brief   Handle assoc response event
  *
  * @param priv          A pointer moal_private structure
@@ -2670,9 +3068,16 @@
 	struct woal_event *evt;
 	unsigned long flags;
 	moal_handle *handle = priv->phandle;
-	mlan_ds_misc_assoc_req assoc_req;
-	memset(&assoc_req, 0, sizeof(mlan_ds_misc_assoc_req));
-	woal_get_assoc_req(priv, &assoc_req, MOAL_IOCTL_WAIT);
+	mlan_ds_misc_assoc_req *assoc_req = NULL;
+
+	assoc_req = kzalloc(sizeof(mlan_ds_misc_assoc_req), GFP_ATOMIC);
+	if (!assoc_req) {
+		PRINTM(MERROR,
+		       "Fail to allocate mlan_ds_misc_assoc_req buffer\n");
+		return;
+	}
+
+	woal_get_assoc_req(priv, assoc_req, MOAL_IOCTL_WAIT);
 
 	evt = kzalloc(sizeof(struct woal_event), GFP_ATOMIC);
 	if (evt) {
@@ -2684,10 +3089,10 @@
 		evt->assoc_info.assoc_resp_len =
 			MIN(passoc_rsp->assoc_resp_len, ASSOC_RSP_BUF_SIZE);
 		moal_memcpy_ext(priv->phandle, evt->assoc_info.assoc_req_buf,
-				assoc_req.assoc_req_buf,
-				assoc_req.assoc_req_len, ASSOC_RSP_BUF_SIZE);
+				assoc_req->assoc_req_buf,
+				assoc_req->assoc_req_len, ASSOC_RSP_BUF_SIZE);
 		evt->assoc_info.assoc_req_len =
-			MIN(assoc_req.assoc_req_len, ASSOC_RSP_BUF_SIZE);
+			MIN(assoc_req->assoc_req_len, ASSOC_RSP_BUF_SIZE);
 
 		INIT_LIST_HEAD(&evt->link);
 		spin_lock_irqsave(&handle->evt_lock, flags);
@@ -2695,6 +3100,8 @@
 		spin_unlock_irqrestore(&handle->evt_lock, flags);
 		queue_work(handle->evt_workqueue, &handle->evt_work);
 	}
+	kfree(assoc_req);
+	return;
 }
 
 /**
@@ -2715,6 +3122,7 @@
 {
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 	int ret = 0;
+	int ie_len;
 	mlan_ssid_bssid *ssid_bssid = NULL;
 	unsigned long flags;
 	const u8 *ssid_ie;
@@ -2723,6 +3131,15 @@
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
+	if (!priv->auth_flag && !priv->host_mlme) {
+		PRINTM(MINFO,
+		       "wlan: HostMlme %s can not proceed with this Assoc, as Auth is not done yet \n",
+		       priv->netdev->name);
+		LEAVE();
+		return -EFAULT;
+	}
+
+	priv->cfg_disconnect = MFALSE;
 
 	ssid_bssid = kmalloc(sizeof(mlan_ssid_bssid), GFP_KERNEL);
 	if (!ssid_bssid) {
@@ -2756,6 +3173,11 @@
 		return -EBUSY;
 	}
 
+	if (!req || !req->bss) {
+		ret = -EINVAL;
+		goto done;
+	}
+
 	/** cancel pending scan */
 	woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
 
@@ -2765,6 +3187,7 @@
 
 	memset(ssid_bssid, 0, sizeof(mlan_ssid_bssid));
 	rcu_read_lock();
+
 	ssid_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
 	moal_memcpy_ext(priv->phandle, ssid_bssid->bssid, req->bss->bssid,
 			ETH_ALEN, sizeof(ssid_bssid->bssid));
@@ -2786,12 +3209,24 @@
 		goto done;
 	}
 
-	if (!ssid_bssid->ssid.ssid_len || ssid_bssid->ssid.ssid[0] < 0x20) {
+	if (!ssid_bssid->ssid.ssid_len) {
 		PRINTM(MERROR, "Invalid SSID - aborting\n");
 		ret = -EINVAL;
 		goto done;
 	}
 
+	if (req->bss) {
+		if ((!priv->phandle->params.reg_alpha2 ||
+		     strncmp(priv->phandle->params.reg_alpha2, "99",
+			     strlen("99")))
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+		    &&
+		    (!moal_extflg_isset(priv->phandle, EXT_COUNTRY_IE_IGNORE))
+#endif
+		)
+			woal_process_country_ie(priv, req->bss);
+	}
+
 #ifdef STA_WEXT
 	if (IS_STA_WEXT(priv->phandle->params.cfg80211_wext)) {
 		switch (req->crypto.wpa_versions) {
@@ -2825,8 +3260,7 @@
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_cfg80211_assoc_ies_cfg(priv, (t_u8 *)req->ie,
 						req->ie_len, MOAL_IOCTL_WAIT)) {
-			ret = -EFAULT;
-			goto done;
+			PRINTM(MINFO, "Fail to woal_cfg80211_assoc_ies_cfg\n");
 		}
 	}
 
@@ -2874,13 +3308,39 @@
 done:
 
 	if (!ret) {
+		struct station_info sinfo;
 		priv->rssi_low = DEFAULT_RSSI_LOW_THRESHOLD;
 
 		woal_save_assoc_params(priv, req, ssid_bssid);
+		memset(&sinfo, 0, sizeof(sinfo));
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_cfg80211_dump_station_info(priv, &sinfo)) {
+			PRINTM(MERROR, "Failed to get station info\n");
+		}
 
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR,
+			       "woal_get_bss_info Fails to get bss info\n");
+		}
 		priv->channel = bss_info.bss_chan;
+	} else {
+		/* clear the encryption mode */
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_cfg80211_set_auth(priv, MLAN_ENCRYPTION_MODE_NONE,
+					   MFALSE, MOAL_IOCTL_WAIT)) {
+			PRINTM(MERROR, "Could not clear encryption \n");
+			ret = -EFAULT;
+		}
+		/* clear IE */
+		ie_len = 0;
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_set_get_gen_ie(priv, MLAN_ACT_SET, NULL, &ie_len,
+					MOAL_IOCTL_WAIT)) {
+			PRINTM(MERROR, "Could not clear RSN IE\n");
+			ret = -EFAULT;
+		}
 	}
 
 	spin_lock_irqsave(&priv->connect_lock, flags);
@@ -2898,16 +3358,16 @@
 		       priv->netdev->name, MAC2STR(req->bss->bssid));
 		if (ssid_bssid->assoc_rsp.assoc_resp_len &&
 		    ssid_bssid->assoc_rsp.assoc_resp_len >
-			    sizeof(IEEEtypes_MgmtHdr_t)) {
+			    (sizeof(IEEEtypes_MgmtHdr_t) +
+			     sizeof(IEEEtypes_AssocRsp_t))) {
 			// save the connection param when send assoc_resp to
 			// kernel
 			woal_save_assoc_params(priv, req, ssid_bssid);
 			ret = 0;
 		} else {
 			ssid_bssid->assoc_rsp.assoc_resp_len = 0;
-			ret = -EFAULT;
-			memset(priv->cfg_bssid, 0, ETH_ALEN);
-			woal_clear_conn_params(priv);
+			ret = 0;
+			woal_assoc_timeout_event(priv, req);
 		}
 		priv->host_mlme = MFALSE;
 		priv->auth_flag = 0;
@@ -2939,7 +3399,6 @@
 int woal_cfg80211_assoc(moal_private *priv, void *sme, t_u8 wait_option,
 			mlan_ds_misc_assoc_rsp *assoc_rsp)
 {
-	struct cfg80211_ibss_params *ibss_param = NULL;
 	struct cfg80211_connect_params *conn_param = NULL;
 	mlan_802_11_ssid req_ssid;
 	mlan_ssid_bssid *ssid_bssid = NULL;
@@ -2954,7 +3413,6 @@
 	t_u8 *ie = NULL;
 	int ie_len = 0;
 	struct ieee80211_channel *channel = NULL;
-	t_u16 beacon_interval = 0;
 	bool privacy;
 	struct cfg80211_bss *pub = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -2973,25 +3431,7 @@
 
 	mode = woal_nl80211_iftype_to_mode(priv->wdev->iftype);
 
-	if (mode == MLAN_BSS_MODE_IBSS) {
-		ibss_param = (struct cfg80211_ibss_params *)sme;
-		ssid = (t_u8 *)ibss_param->ssid;
-		ssid_len = ibss_param->ssid_len;
-		bssid = (t_u8 *)ibss_param->bssid;
-#if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-		channel = ibss_param->channel;
-#else
-		channel = ibss_param->chandef.chan;
-#endif
-		if (channel)
-			priv->phandle->band = channel->band;
-		if (ibss_param->ie_len)
-			ie = (t_u8 *)ibss_param->ie;
-		ie_len = ibss_param->ie_len;
-		beacon_interval = ibss_param->beacon_interval;
-		privacy = ibss_param->privacy;
-
-	} else {
+	{
 		conn_param = (struct cfg80211_connect_params *)sme;
 		ssid = (t_u8 *)conn_param->ssid;
 		ssid_len = conn_param->ssid_len;
@@ -3087,7 +3527,8 @@
 
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_cfg80211_set_key(priv, 0, 0, NULL, 0, NULL, 0,
-				  KEY_INDEX_CLEAR_ALL, NULL, 1, wait_option)) {
+				  KEY_INDEX_CLEAR_ALL, NULL, 1, 0,
+				  wait_option)) {
 		/* Disable keys and clear all previous security settings */
 		ret = -EFAULT;
 		goto done;
@@ -3116,8 +3557,7 @@
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_cfg80211_assoc_ies_cfg(priv, ie, ie_len,
 						wait_option)) {
-			ret = -EFAULT;
-			goto done;
+			PRINTM(MINFO, "Fail to woal_cfg80211_assoc_ies_cfg\n");
 		}
 	}
 
@@ -3189,56 +3629,6 @@
 		}
 	}
 
-	if (mode == MLAN_BSS_MODE_IBSS) {
-		mlan_ds_bss *bss = NULL;
-		/* Change beacon interval */
-		if ((beacon_interval < MLAN_MIN_BEACON_INTERVAL) ||
-		    (beacon_interval > MLAN_MAX_BEACON_INTERVAL)) {
-			ret = -EINVAL;
-			goto done;
-		}
-		kfree(req);
-		req = NULL;
-
-		req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
-		if (req == NULL) {
-			ret = -ENOMEM;
-			goto done;
-		}
-		bss = (mlan_ds_bss *)req->pbuf;
-		req->req_id = MLAN_IOCTL_BSS;
-		req->action = MLAN_ACT_SET;
-		bss->sub_command = MLAN_OID_IBSS_BCN_INTERVAL;
-		bss->param.bcn_interval = beacon_interval;
-		status = woal_request_ioctl(priv, req, wait_option);
-		if (status != MLAN_STATUS_SUCCESS) {
-			ret = -EFAULT;
-			goto done;
-		}
-
-		/* "privacy" is set only for ad-hoc mode */
-		if (privacy) {
-			/*
-			 * Keep MLAN_ENCRYPTION_MODE_WEP40 for now so that
-			 * the firmware can find a matching network from the
-			 * scan. cfg80211 does not give us the encryption
-			 * mode at this stage so just setting it to wep here
-			 */
-			if (MLAN_STATUS_SUCCESS !=
-			    woal_set_auth_mode(priv, wait_option,
-					       MLAN_AUTH_MODE_OPEN)) {
-				ret = -EFAULT;
-				goto done;
-			}
-
-			wpa_enabled = 0;
-			ret = woal_cfg80211_set_auth(
-				priv, MLAN_ENCRYPTION_MODE_WEP104, wpa_enabled,
-				wait_option);
-			if (ret)
-				goto done;
-		}
-	}
 	moal_memcpy_ext(priv->phandle, &ssid_bssid->ssid, &req_ssid,
 			sizeof(mlan_802_11_ssid), sizeof(ssid_bssid->ssid));
 	if (bssid)
@@ -3309,16 +3699,7 @@
 		goto done;
 	}
 
-	/* Inform the IBSS information to kernel, otherwise
-	 * kernel will give a panic after successful assoc */
-	if (mode == MLAN_BSS_MODE_IBSS) {
-		if (MLAN_STATUS_SUCCESS !=
-		    woal_cfg80211_inform_ibss_bss(priv, channel,
-						  beacon_interval)) {
-			ret = -EFAULT;
-			goto done;
-		}
-	} else if (assoc_rsp) {
+	if (assoc_rsp) {
 		moal_memcpy_ext(priv->phandle, assoc_rsp,
 				&ssid_bssid->assoc_rsp,
 				sizeof(mlan_ds_misc_assoc_rsp),
@@ -3351,6 +3732,37 @@
 	return ret;
 }
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 1, 18)
+/**
+ * @brief This function convert he_gi to nl80211_he_gi
+ *
+ * @param he_gi  0/1/2/3
+ *
+ *
+ * @return  0: NL80211_RATE_INFO_HE_GI_0_8
+ *          1: NL80211_RATE_INFO_HE_GI_1_6
+ *          2: NL80211_RATE_INFO_HE_GI_3_2
+ */
+static t_u8 woal_he_gi_to_nl80211_he_gi(t_u8 he_gi)
+{
+	t_u8 cfg_he_gi = 0;
+	switch (he_gi) {
+	case 3:
+		cfg_he_gi = NL80211_RATE_INFO_HE_GI_3_2;
+		break;
+	case 2:
+		cfg_he_gi = NL80211_RATE_INFO_HE_GI_1_6;
+		break;
+	case 0:
+	case 1:
+	default:
+		cfg_he_gi = NL80211_RATE_INFO_HE_GI_0_8;
+		break;
+	}
+	return cfg_he_gi;
+}
+#endif
+
 /**
  * @brief Request the driver to fill the tx/rx rate info
  *
@@ -3427,7 +3839,8 @@
 			sinfo->txrate.flags = RATE_INFO_FLAGS_HE_MCS;
 			sinfo->txrate.nss = rate->param.data_rate.tx_nss + 1;
 			sinfo->txrate.mcs = rate->param.data_rate.tx_mcs_index;
-			sinfo->txrate.he_gi = rate->param.data_rate.tx_ht_gi;
+			sinfo->txrate.he_gi = woal_he_gi_to_nl80211_he_gi(
+				rate->param.data_rate.tx_ht_gi);
 			if (rate->param.data_rate.tx_ht_bw == MLAN_VHT_BW80)
 				sinfo->txrate.bw = RATE_INFO_BW_80;
 			else if (rate->param.data_rate.tx_ht_bw == MLAN_HT_BW40)
@@ -3474,7 +3887,8 @@
 			sinfo->rxrate.flags = RATE_INFO_FLAGS_HE_MCS;
 			sinfo->rxrate.nss = rate->param.data_rate.rx_nss + 1;
 			sinfo->rxrate.mcs = rate->param.data_rate.rx_mcs_index;
-			sinfo->rxrate.he_gi = rate->param.data_rate.rx_ht_gi;
+			sinfo->rxrate.he_gi = woal_he_gi_to_nl80211_he_gi(
+				rate->param.data_rate.rx_ht_gi);
 			if (rate->param.data_rate.rx_ht_bw == MLAN_VHT_BW80)
 				sinfo->rxrate.bw = RATE_INFO_BW_80;
 			else if (rate->param.data_rate.rx_ht_bw == MLAN_HT_BW40)
@@ -3536,6 +3950,7 @@
 			MBIT(NL80211_STA_INFO_RX_PACKETS) |
 			MBIT(NL80211_STA_INFO_TX_PACKETS) |
 			MBIT(NL80211_STA_INFO_SIGNAL) |
+			MBIT(NL80211_STA_INFO_SIGNAL_AVG) |
 			MBIT(NL80211_STA_INFO_TX_BITRATE) |
 			MBIT(NL80211_STA_INFO_RX_BITRATE);
 #else
@@ -3574,7 +3989,10 @@
 	sinfo->tx_bytes = priv->stats.tx_bytes;
 	sinfo->rx_packets = priv->stats.rx_packets;
 	sinfo->tx_packets = priv->stats.tx_packets;
-	sinfo->signal = signal.bcn_rssi_avg;
+	sinfo->signal = signal.bcn_rssi_last;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+	sinfo->signal_avg = signal.bcn_rssi_avg;
+#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
 	sinfo->tx_failed = stats.failed;
 #endif
@@ -3649,8 +4067,8 @@
  *
  *  @return                 N/A
  */
-t_u32 woal_get_chan_rule_flags(mlan_ds_custom_reg_domain *custom_reg,
-			       t_u8 channel)
+static t_u32 woal_get_chan_rule_flags(mlan_ds_custom_reg_domain *custom_reg,
+				      t_u8 channel)
 {
 	t_u16 num_chan = 0;
 	t_u32 flags = 0;
@@ -3731,6 +4149,7 @@
 	int idx, freq, prev_freq = 0;
 	t_u8 chan;
 	t_u16 num_chan = 0;
+	t_u16 pwr, prev_pwr = 0;
 	t_u32 bw, prev_bw = 0;
 	t_u16 chflags, prev_chflags = 0, valid_rules = 0;
 	struct ieee80211_regdomain *regd = NULL;
@@ -3742,7 +4161,6 @@
 
 	sort(&custom_reg->cfp_tbl[custom_reg->num_bg_chan],
 	     custom_reg->num_a_chan, sizeof(chan_freq_power_t), &compare, NULL);
-
 	regd_size = sizeof(struct ieee80211_regdomain) +
 		    num_chan * sizeof(struct ieee80211_reg_rule);
 
@@ -3766,8 +4184,10 @@
 		       chflags);
 		new_rule = false;
 
-		if (chflags & NXP_CHANNEL_DISABLED)
+		if (chflags & NXP_CHANNEL_DISABLED) {
+			prev_chflags = chflags;
 			continue;
+		}
 
 		if (band == IEEE80211_BAND_5GHZ) {
 			if (!(chflags & NXP_CHANNEL_NOHT80))
@@ -3783,11 +4203,17 @@
 				bw = MHZ_TO_KHZ(20);
 		}
 
+		pwr = custom_reg->cfp_tbl[idx].max_tx_power;
+
 		if (idx == 0 || prev_chflags != chflags || prev_bw != bw ||
 		    freq - prev_freq > 20) {
 			valid_rules++;
 			new_rule = true;
 		}
+		if (!new_rule && pwr != prev_pwr) {
+			valid_rules++;
+			new_rule = true;
+		}
 
 		rule = &regd->reg_rules[valid_rules - 1];
 
@@ -3801,7 +4227,9 @@
 			continue;
 
 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(freq - 10);
-		rule->power_rule.max_eirp = DBM_TO_MBM(19);
+		rule->power_rule.max_eirp = DBM_TO_MBM(pwr);
+		prev_pwr = pwr;
+
 		rule->flags = 0;
 
 		if (chflags & NXP_CHANNEL_PASSIVE)
@@ -3860,6 +4288,57 @@
 }
 
 /**
+ *  @brief get channel region config(0x242),update otp_region including
+ * force_reg
+ *
+ *  @param priv         A pointer to moal_private structure
+ *
+ *  @return		        0-success, otherwise failure
+ */
+
+static int woal_get_chan_region_cfg(moal_private *priv)
+{
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	t_u8 country_code[COUNTRY_CODE_LEN];
+	int ret = 0;
+
+	ENTER();
+
+	memset(country_code, 0, sizeof(country_code));
+	country_code[0] = priv->phandle->country_code[0];
+	country_code[1] = priv->phandle->country_code[1];
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_GET_CHAN_REGION_CFG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	req->action = MLAN_ACT_GET;
+	memset(&misc->param.custom_reg_domain, 0,
+	       sizeof(misc->param.custom_reg_domain));
+
+	misc->param.custom_reg_domain.region.country_code[0] = country_code[0];
+	misc->param.custom_reg_domain.region.country_code[1] = country_code[1];
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief create custom channel regulatory config
  *
  *  @param priv         A pointer to moal_private structure
@@ -3883,6 +4362,16 @@
 		return -EFAULT;
 	}
 
+	memset(country_code, 0, sizeof(country_code));
+	if (MTRUE ==
+	    is_cfg80211_special_region_code(priv->phandle->country_code)) {
+		country_code[0] = 'W';
+		country_code[1] = 'W';
+	} else {
+		country_code[0] = priv->phandle->country_code[0];
+		country_code[1] = priv->phandle->country_code[1];
+	}
+
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (req == NULL) {
 		ret = -EFAULT;
@@ -3894,20 +4383,15 @@
 	req->action = MLAN_ACT_GET;
 	memset(&misc->param.custom_reg_domain, 0,
 	       sizeof(misc->param.custom_reg_domain));
+
+	misc->param.custom_reg_domain.region.country_code[0] = country_code[0];
+	misc->param.custom_reg_domain.region.country_code[1] = country_code[1];
+
 	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
 		ret = -EFAULT;
 		goto done;
 	}
-	memset(country_code, 0, sizeof(country_code));
-	if (MTRUE ==
-	    is_cfg80211_special_region_code(priv->phandle->country_code)) {
-		country_code[0] = 'W';
-		country_code[1] = 'W';
-	} else {
-		country_code[0] = priv->phandle->country_code[0];
-		country_code[1] = priv->phandle->country_code[1];
-	}
 	if (misc->param.custom_reg_domain.region.country_code[0] == '\0' ||
 	    misc->param.custom_reg_domain.region.country_code[1] == '\0') {
 		PRINTM(MCMND, "FW country code not valid\n");
@@ -3925,7 +4409,7 @@
 	}
 	regd = create_custom_regdomain(priv, &misc->param.custom_reg_domain);
 	if (regd) {
-		PRINTM(MMSG, "call regulatory_set_wiphy_regd %c%c",
+		PRINTM(MMSG, "call regulatory_set_wiphy_regd %c%c\n",
 		       misc->param.custom_reg_domain.region.country_code[0],
 		       misc->param.custom_reg_domain.region.country_code[1]);
 		wiphy->regulatory_flags &=
@@ -4010,10 +4494,9 @@
 	t_u8 dfs_region = NXP_DFS_UNKNOWN;
 
 	ENTER();
-
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
-	if (!priv) {
-		PRINTM(MFATAL, "Unable to get priv in %s()\n", __func__);
+	if (!priv || handle->driver_status || handle->surprise_removed) {
+		PRINTM(MERROR, "Blocking reg_notifier in %s()\n", __func__);
 		LEAVE();
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
 		return -EINVAL;
@@ -4052,11 +4535,6 @@
 	moal_memcpy_ext(priv->phandle, region, request->alpha2,
 			sizeof(request->alpha2), sizeof(region));
 	region[2] = ' ';
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
-	if (request->initiator == NL80211_REGDOM_SET_BY_CORE)
-		moal_memcpy_ext(priv->phandle, region, priv->phandle->params.reg_alpha2,
-				sizeof(handle->params.reg_alpha2), sizeof(region));
-#endif
 	if ((handle->country_code[0] != request->alpha2[0]) ||
 	    (handle->country_code[1] != request->alpha2[1])) {
 		if (handle->params.cntry_txpwr) {
@@ -4064,12 +4542,6 @@
 			handle->country_code[0] = request->alpha2[0];
 			handle->country_code[1] = request->alpha2[1];
 			handle->country_code[2] = ' ';
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
-			if (request->initiator == NL80211_REGDOM_SET_BY_CORE) {
-				handle->country_code[0] = priv->phandle->params.reg_alpha2[0];
-				handle->country_code[1] = priv->phandle->params.reg_alpha2[1];
-			}
-#endif
 			memset(country_code, 0, sizeof(country_code));
 			if (MTRUE == is_cfg80211_special_region_code(region)) {
 				country_code[0] = 'W';
@@ -4077,16 +4549,10 @@
 			} else {
 				country_code[0] = request->alpha2[0];
 				country_code[1] = request->alpha2[1];
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
-				if (request->initiator == NL80211_REGDOM_SET_BY_CORE) {
-					country_code[0] = priv->phandle->params.reg_alpha2[0];
-					country_code[1] = priv->phandle->params.reg_alpha2[1];
-				}
-#endif
 			}
 			if (MLAN_STATUS_SUCCESS !=
-			    woal_request_country_power_table(priv,
-							     country_code)) {
+			    woal_request_country_power_table(priv, country_code,
+							     MOAL_IOCTL_WAIT)) {
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
 				return -EFAULT;
 #else
@@ -4140,6 +4606,7 @@
 		PRINTM(MCMND, "Regulatory domain BY_COUNTRY_IE\n");
 		break;
 	}
+
 	if (priv->wdev && priv->wdev->wiphy &&
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
 	    !(wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) &&
@@ -4155,195 +4622,23 @@
 		priv->phandle->band = band;
 	}
 
+	if (priv->wdev && priv->wdev->wiphy &&
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+	    !(wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
+#endif
+	) {
+		woal_dnld_chan_attr(priv, MFALSE, MOAL_IOCTL_WAIT);
+	}
+	if (handle->params.edmac_ctrl)
+		woal_edmac_cfg(priv, priv->phandle->country_code);
+
 	LEAVE();
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
 	return ret;
 #endif
 }
 
-#ifdef UAP_CFG80211
-/**
- * @brief Swithces BSS role of interface
- *
- * @param priv          A pointer to moal_private structure
- * @param wait_option   Wait option (MOAL_WAIT or MOAL_NO_WAIT)
- * @param bss_role      bss role
- *
- * @return         0 --success, otherwise fail
- */
-static mlan_status woal_role_switch(moal_private *priv, t_u8 wait_option,
-				    t_u8 bss_role)
-{
-	int ret = 0;
-	mlan_ds_bss *bss = NULL;
-	mlan_ioctl_req *req = NULL;
-	mlan_status status = MLAN_STATUS_SUCCESS;
-
-	ENTER();
-
-	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
-	if (req == NULL) {
-		ret = -ENOMEM;
-		goto done;
-	}
-	bss = (mlan_ds_bss *)req->pbuf;
-	bss->sub_command = MLAN_OID_BSS_ROLE;
-	req->req_id = MLAN_IOCTL_BSS;
-	req->action = MLAN_ACT_SET;
-	bss->param.bss_role = bss_role;
-
-	status = woal_request_ioctl(priv, req, wait_option);
-	if (status != MLAN_STATUS_SUCCESS) {
-		ret = -EFAULT;
-		goto done;
-	}
-done:
-	if (status != MLAN_STATUS_PENDING)
-		kfree(req);
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief set/get bandcfg
- *
- *  @param priv                 A pointer to moal_private structure
- *  @param action               get or set action
- *  @param band_cfg             A pointer to mlan_ds_band_cfg structure
- *
- *  @return                     0 -- success, otherwise fail
- */
-static int woal_setget_bandcfg(moal_private *priv, t_u8 action,
-			       mlan_ds_band_cfg *band_cfg)
-{
-	int ret = 0;
-	mlan_ioctl_req *req = NULL;
-	mlan_ds_radio_cfg *radio_cfg = NULL;
-	mlan_status status = MLAN_STATUS_SUCCESS;
-
-	ENTER();
-
-	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_radio_cfg));
-	if (req == NULL) {
-		ret = -ENOMEM;
-		goto error;
-	}
-	radio_cfg = (mlan_ds_radio_cfg *)req->pbuf;
-	radio_cfg->sub_command = MLAN_OID_BAND_CFG;
-	req->req_id = MLAN_IOCTL_RADIO_CFG;
-	req->action = action;
-
-	if (req->action == MLAN_ACT_SET)
-		moal_memcpy_ext(priv->phandle, &radio_cfg->param.band_cfg,
-				band_cfg, sizeof(mlan_ds_band_cfg),
-				sizeof(radio_cfg->param.band_cfg));
-
-	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
-	if (status != MLAN_STATUS_SUCCESS) {
-		ret = -EFAULT;
-		goto error;
-	}
-	moal_memcpy_ext(priv->phandle, band_cfg, &radio_cfg->param.band_cfg,
-			sizeof(mlan_ds_band_cfg), sizeof(mlan_ds_band_cfg));
-error:
-	if (status != MLAN_STATUS_PENDING)
-		kfree(req);
-
-	LEAVE();
-	return ret;
-}
-
-/**
- *  @brief request scan
- *
- *  @param priv                 A pointer to moal_private structure
- *  @param scan_cfg             A pointer to wlan_user_scan_cfg structure
- *
- *  @return                     MLAN_STATUS_SUCCESS -- success, otherwise fail
- */
-static mlan_status woal_uap_scan(moal_private *priv,
-				 wlan_user_scan_cfg *scan_cfg)
-{
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	moal_handle *handle = priv->phandle;
-	moal_private *tmp_priv;
-	u8 role;
-	mlan_ds_band_cfg org_bandcfg;
-	mlan_ds_band_cfg bandcfg;
-	u8 band_change = MFALSE;
-	ENTER();
-	if (priv->bss_index > 0)
-		tmp_priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
-	else
-		tmp_priv = priv;
-	if (!tmp_priv) {
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-	role = GET_BSS_ROLE(tmp_priv);
-	if (role == MLAN_BSS_ROLE_UAP) {
-		if (MLAN_STATUS_SUCCESS !=
-		    woal_role_switch(tmp_priv, MOAL_IOCTL_WAIT,
-				     MLAN_BSS_ROLE_STA)) {
-			PRINTM(MERROR, "role switch from uap to sta fail\n");
-			LEAVE();
-			return MLAN_STATUS_FAILURE;
-		}
-	}
-	if (tmp_priv != priv) {
-		if (woal_setget_bandcfg(priv, MLAN_ACT_GET, &bandcfg)) {
-			PRINTM(MERROR, "get bandcfg fail\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-		if (woal_setget_bandcfg(tmp_priv, MLAN_ACT_GET, &org_bandcfg)) {
-			PRINTM(MERROR, "get bandcfg fail\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-		if (bandcfg.config_bands != org_bandcfg.config_bands) {
-			if (woal_setget_bandcfg(tmp_priv, MLAN_ACT_SET,
-						&bandcfg)) {
-				PRINTM(MERROR, "set bandcfg fail\n");
-				ret = MLAN_STATUS_FAILURE;
-				goto done;
-			}
-			band_change = MTRUE;
-		}
-	}
-#ifdef REASSOCIATION
-	if (MOAL_ACQ_SEMAPHORE_BLOCK(&handle->reassoc_sem)) {
-		PRINTM(MERROR, "Acquire semaphore error, woal_do_combo_scan\n");
-		goto done;
-	}
-#endif /* REASSOCIATION */
-	tmp_priv->report_scan_result = MTRUE;
-	ret = woal_request_userscan(tmp_priv, MOAL_IOCTL_WAIT, scan_cfg);
-	woal_sched_timeout(5);
-#ifdef REASSOCIATION
-	MOAL_REL_SEMAPHORE(&handle->reassoc_sem);
-#endif
-done:
-	if (role == MLAN_BSS_ROLE_UAP) {
-		if (MLAN_STATUS_SUCCESS !=
-		    woal_role_switch(tmp_priv, MOAL_IOCTL_WAIT,
-				     MLAN_BSS_ROLE_UAP)) {
-			PRINTM(MERROR, "role switch back to uap fail\n");
-			ret = MLAN_STATUS_FAILURE;
-		}
-	}
-	if (band_change) {
-		if (woal_setget_bandcfg(tmp_priv, MLAN_ACT_SET, &org_bandcfg)) {
-			PRINTM(MERROR, "restore bandcfg fail\n");
-			ret = MLAN_STATUS_FAILURE;
-		}
-	}
-	LEAVE();
-	return ret;
-}
-#endif
-
-static int woal_find_wps_ie_in_probereq(const t_u8 *ie, int len)
+static int woal_find_wps_ie_in_probereq(const t_u8 *ie, size_t len)
 {
 	int left_len = len;
 	const t_u8 *pos = ie;
@@ -4417,7 +4712,7 @@
  *
  *  @return             MTRUE/MFALSE;
  */
-t_u8 wlan_check_scan_table_ageout(moal_private *priv)
+static t_u8 wlan_check_scan_table_ageout(moal_private *priv)
 {
 	mlan_scan_resp scan_resp;
 	wifi_timeval t;
@@ -4429,7 +4724,7 @@
 		return MFALSE;
 	}
 	woal_get_monotonic_time(&t);
-#define CFG80211_SCAN_RESULT_AGEOUT 10
+#define CFG80211_SCAN_RESULT_AGEOUT 20
 	if (t.time_sec >
 	    (scan_resp.age_in_secs + CFG80211_SCAN_RESULT_AGEOUT)) {
 		LEAVE();
@@ -4440,6 +4735,51 @@
 	return MTRUE;
 }
 
+/**
+ * @brief Cancel remain on channel before scan request process
+
+ * @param priv            A pointer to moal_private
+ *
+ * @return                none
+ */
+static void woal_cancel_remain_on_channel(moal_private *priv)
+{
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
+	if (priv->phandle->remain_on_channel) {
+		t_u8 channel_status;
+		moal_private *remain_priv;
+		remain_priv =
+			priv->phandle->priv[priv->phandle->remain_bss_index];
+		if (remain_priv) {
+			PRINTM(MMSG,
+			       "Cancel Remain on Channel before scan request\n");
+			if (woal_cfg80211_remain_on_channel_cfg(
+				    remain_priv, MOAL_IOCTL_WAIT, MTRUE,
+				    &channel_status, NULL, 0, 0))
+				PRINTM(MERROR,
+				       "Fail to cancel remain on channel %s %d\n",
+				       __func__, __LINE__);
+			if (priv->phandle->cookie) {
+				cfg80211_remain_on_channel_expired(
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
+					remain_priv->netdev,
+#else
+					remain_priv->wdev,
+#endif
+					priv->phandle->cookie,
+					&priv->phandle->chan,
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+					priv->phandle->channel_type,
+#endif
+					GFP_ATOMIC);
+				priv->phandle->cookie = 0;
+			}
+			priv->phandle->remain_on_channel = MFALSE;
+		}
+	}
+#endif
+}
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 /**
  * @brief Request the driver to do a scan. Always returning
@@ -4482,13 +4822,13 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
 	t_u8 buf[ETH_ALEN];
 #endif
-	int ret = 0, i;
+	int ret = 0, i, num_chans;
 	unsigned long flags;
 
 	ENTER();
 
 	PRINTM(MINFO, "Received scan request on %s\n", dev->name);
-	if (priv->phandle->driver_status) {
+	if (priv->phandle->driver_status || priv->phandle->surprise_removed) {
 		PRINTM(MERROR,
 		       "Block woal_cfg80211_scan in abnormal driver state\n");
 		LEAVE();
@@ -4523,18 +4863,34 @@
 	priv->phandle->fake_scan_complete = priv->fake_scan_complete;
 	if (priv->fake_scan_complete) {
 		PRINTM(MEVENT, "fake scan complete flag is on\n");
+		spin_lock_irqsave(&priv->phandle->scan_req_lock, flags);
 		priv->phandle->scan_request = request;
+		spin_unlock_irqrestore(&priv->phandle->scan_req_lock, flags);
 		queue_delayed_work(priv->phandle->evt_workqueue,
 				   &priv->phandle->scan_timeout_work,
 				   msecs_to_jiffies(1000));
 		return ret;
 	}
+
+	/** Cance remain on channel */
+	woal_cancel_remain_on_channel(priv);
+
 	memset(&bss_info, 0, sizeof(bss_info));
 	if (MLAN_STATUS_SUCCESS ==
 	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
 		if (bss_info.scan_block) {
-			PRINTM(MEVENT, "Block scan in mlan module\n");
-			return -EAGAIN;
+			PRINTM(MEVENT,
+			       "Block scan in mlan module for scan_request %p\n",
+			       request);
+			spin_lock_irqsave(&priv->phandle->scan_req_lock, flags);
+			priv->phandle->fake_scan_complete = MTRUE;
+			priv->phandle->scan_request = request;
+			spin_unlock_irqrestore(&priv->phandle->scan_req_lock,
+					       flags);
+			queue_delayed_work(priv->phandle->evt_workqueue,
+					   &priv->phandle->scan_timeout_work,
+					   msecs_to_jiffies(1000));
+			return ret;
 		}
 	}
 	if (priv->phandle->scan_request &&
@@ -4545,7 +4901,15 @@
 		LEAVE();
 		return -EBUSY;
 	}
-
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	/* This check is to prevent the situation where
+	 * new scan request comes while Auth is not completed */
+	if (priv->auth_flag & HOST_MLME_AUTH_PENDING) {
+		PRINTM(MCMND, "Block scan as auth is pending\n");
+		LEAVE();
+		return -EAGAIN;
+	}
+#endif
 	spin_lock_irqsave(&priv->phandle->scan_req_lock, flags);
 	priv->phandle->scan_request = request;
 	spin_unlock_irqrestore(&priv->phandle->scan_req_lock, flags);
@@ -4573,7 +4937,9 @@
 #endif
 
 	memset(&scan_cfg, 0, sizeof(mlan_scan_cfg));
-	woal_get_scan_config(priv, &scan_cfg);
+	if (MLAN_STATUS_SUCCESS != woal_get_scan_config(priv, &scan_cfg)) {
+		PRINTM(MERROR, "Fail to get scan request IE\n");
+	}
 #ifdef WIFI_DIRECT_SUPPORT
 	if (priv->phandle->miracast_mode)
 		scan_req->scan_chan_gap = priv->phandle->scan_chan_gap;
@@ -4616,65 +4982,93 @@
 	}
 #endif
 #endif
-	for (i = 0; i < (int)MIN(WLAN_USER_SCAN_CHAN_MAX,
-				 priv->phandle->scan_request->n_channels);
+	if (priv->scan_setband_mask) {
+		PRINTM(MCMD_D,
+		       "cfg80211_scan: scan_setband mask is set to %d\n",
+		       priv->scan_setband_mask);
+	}
+	for (i = 0, num_chans = 0;
+	     i < (int)MIN(WLAN_USER_SCAN_CHAN_MAX,
+			  priv->phandle->scan_request->n_channels);
 	     i++) {
 		chan = priv->phandle->scan_request->channels[i];
-		scan_req->chan_list[i].chan_number = chan->hw_value;
-		scan_req->chan_list[i].radio_type =
+		if (MFALSE == is_scan_band_allowed(priv, chan))
+			continue;
+		scan_req->chan_list[num_chans].chan_number = chan->hw_value;
+		scan_req->chan_list[num_chans].radio_type =
 			woal_ieee_band_to_radio_type(chan->band);
 		if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) ||
 		    !priv->phandle->scan_request->n_ssids)
-			scan_req->chan_list[i].scan_type =
+			scan_req->chan_list[num_chans].scan_type =
 				MLAN_SCAN_TYPE_PASSIVE;
 		else if (chan->flags & IEEE80211_CHAN_RADAR)
-			scan_req->chan_list[i].scan_type =
+			scan_req->chan_list[num_chans].scan_type =
 				MLAN_SCAN_TYPE_PASSIVE_TO_ACTIVE;
 		else
-			scan_req->chan_list[i].scan_type =
+			scan_req->chan_list[num_chans].scan_type =
 				MLAN_SCAN_TYPE_ACTIVE;
 		PRINTM(MCMD_D, "cfg80211_scan: chan=%d chan->flag=0x%x\n",
 		       chan->hw_value, chan->flags);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
-		scan_req->chan_list[i].scan_time =
+		scan_req->chan_list[num_chans].scan_time =
 			priv->phandle->scan_request->duration;
 #else
-		scan_req->chan_list[i].scan_time = 0;
+		scan_req->chan_list[num_chans].scan_time = 0;
 #endif
 #if defined(WIFI_DIRECT_SUPPORT)
 #if CFG80211_VERSION_CODE >= WIFI_DIRECT_KERNEL_VERSION
 		if (priv->bss_type == MLAN_BSS_TYPE_WIFIDIRECT &&
 		    priv->phandle->scan_request->n_ssids) {
 			if (!memcmp(scan_req->ssid_list[0].ssid, "DIRECT-", 7))
-				scan_req->chan_list[i].scan_time =
+				scan_req->chan_list[num_chans].scan_time =
 					MIN_SPECIFIC_SCAN_CHAN_TIME;
 		}
 #endif
 #endif
 #ifdef WIFI_DIRECT_SUPPORT
 		if (priv->phandle->miracast_mode)
-			scan_req->chan_list[i].scan_time =
+			scan_req->chan_list[num_chans].scan_time =
 				priv->phandle->miracast_scan_time;
 		else if (woal_is_any_interface_active(priv->phandle)) {
 			if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-				scan_req->chan_list[i].scan_time =
+				scan_req->chan_list[num_chans].scan_time =
 					INIT_PASSIVE_SCAN_CHAN_TIME;
-			else
-				scan_req->chan_list[i].scan_time =
-					MIN_SPECIFIC_SCAN_CHAN_TIME;
+			else if (priv->bss_type == MLAN_BSS_TYPE_STA &&
+				 scan_req->chan_list[num_chans].scan_type ==
+					 MLAN_SCAN_TYPE_PASSIVE) {
+				/*
+				 * Set passive scan time to 110ms to discover
+				 * all nearby AP's, Current 40ms passive scan
+				 * time does not scan all AP's. As beacon
+				 * interval is 100ms and dwell time on channel
+				 * is 40ms There are issues with 40ms scan time:
+				 * 1. Passive scan does list limited nearby
+				 * AP's. This change is limited to below
+				 * scenario only:
+				 * 1. STA is in connected state
+				 * 2. Scan type is passive
+				 */
+				scan_req->chan_list[num_chans].scan_time =
+					PASSIVE_SCAN_CHAN_TIME;
+			} else {
+				scan_req->chan_list[num_chans].scan_time = MIN(
+					MIN_SPECIFIC_SCAN_CHAN_TIME,
+					scan_cfg.scan_time.specific_scan_time);
+			}
 		}
 #endif
 #ifdef UAP_CFG80211
 		if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
 			if (!woal_is_uap_scan_result_expired(priv))
-				scan_req->chan_list[i].scan_time =
+				scan_req->chan_list[num_chans].scan_time =
 					MIN_SPECIFIC_SCAN_CHAN_TIME;
 
 			else
-				scan_req->chan_list[i].scan_time =
+				scan_req->chan_list[num_chans].scan_time =
 					PASSIVE_SCAN_CHAN_TIME;
 		}
 #endif
+		num_chans++;
 	}
 	if (priv->phandle->scan_request->ie &&
 	    priv->phandle->scan_request->ie_len) {
@@ -4709,20 +5103,6 @@
 			}
 		}
 	}
-#ifdef UAP_CFG80211
-	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
-		/** use sync scan for uap */
-		ret = woal_uap_scan(priv, scan_req);
-		if (!ret) {
-			kfree(scan_req);
-			LEAVE();
-			return ret;
-		} else {
-			PRINTM(MERROR, "Uap SCAN failure\n");
-			goto done;
-		}
-	}
-#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
 	if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
 		PRINTM(MIOCTL, "NL80211_SCAN_FLAG_RANDOM_ADDR is set\n");
@@ -4800,6 +5180,7 @@
 	t_u32 pkt_type;
 	t_u32 tx_control;
 	t_u16 packet_len = 0;
+	t_u16 pkt_len = 0;
 	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 	int ret = 0;
 
@@ -4831,9 +5212,10 @@
 			pmbuf->pbuf + pmbuf->data_offset + sizeof(pkt_type),
 			&tx_control, sizeof(tx_control), sizeof(tx_control));
 	/*Add packet len*/
+	pkt_len = woal_cpu_to_le16(packet_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), sizeof(packet_len));
+			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
 
 	mgmt = (IEEE80211_MGMT *)(pmbuf->pbuf + pmbuf->data_offset +
 				  HEADER_SIZE + sizeof(packet_len));
@@ -4907,6 +5289,7 @@
 	t_u32 pkt_type;
 	t_u32 tx_control;
 	t_u16 packet_len = 0;
+	t_u16 pkt_len;
 	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 	int ret = 0;
 
@@ -4937,9 +5320,10 @@
 			pmbuf->pbuf + pmbuf->data_offset + sizeof(pkt_type),
 			&tx_control, sizeof(tx_control), sizeof(tx_control));
 	/*Add packet len*/
+	pkt_len = woal_cpu_to_le16(packet_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), sizeof(packet_len));
+			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
 
 	mgmt = (IEEE80211_MGMT *)(pmbuf->pbuf + pmbuf->data_offset +
 				  HEADER_SIZE + sizeof(packet_len));
@@ -5022,8 +5406,11 @@
 	woal_mgmt_frame_register(priv, IEEE80211_STYPE_AUTH, MTRUE);
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-	woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MFALSE, &status,
-					    chan, 0, AUTH_TX_DEFAULT_WAIT_TIME);
+	if (woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MFALSE,
+						&status, chan, 0,
+						priv->auth_tx_wait_time)) {
+		PRINTM(MERROR, "Failed remain on channel config\n");
+	}
 #endif
 
 	/*construct auth request and send out*/
@@ -5053,8 +5440,10 @@
 	}
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-	woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MTRUE, &status,
-					    NULL, 0, 0);
+	if (woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MTRUE,
+						&status, NULL, 0, 0)) {
+		PRINTM(MERROR, "Failed to cancel remain on channel\n");
+	}
 #endif
 
 	woal_mgmt_frame_register(priv, IEEE80211_STYPE_AUTH, MFALSE);
@@ -5086,8 +5475,12 @@
 
 	if (priv->media_connected) {
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-		woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MFALSE,
-						    &status, pchan, 0, 1200);
+		if (woal_cfg80211_remain_on_channel_cfg(priv, wait_option,
+							MFALSE, &status, pchan,
+							0, 1200)) {
+			PRINTM(MERROR,
+			       "Failed to configure remain on channel\n");
+		}
 #endif
 		/*construct ft action request and send out*/
 		woal_send_ft_action_requst(priv, priv->ft_ie, priv->ft_ie_len,
@@ -5102,8 +5495,12 @@
 			/*go over air, as current AP may be unreachable */
 			PRINTM(MMSG, "wlan: go over air\n");
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-			woal_cfg80211_remain_on_channel_cfg(
-				priv, wait_option, MTRUE, &status, NULL, 0, 0);
+			if (woal_cfg80211_remain_on_channel_cfg(
+				    priv, wait_option, MTRUE, &status, NULL, 0,
+				    0)) {
+				PRINTM(MERROR,
+				       "Failed to cancel remain on channel\n");
+			}
 #endif
 			woal_connect_ft_over_air(priv, bssid, pchan);
 			LEAVE();
@@ -5115,8 +5512,10 @@
 					sizeof(priv->target_ap_bssid));
 		}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-		woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MTRUE,
-						    &status, NULL, 0, 0);
+		if (woal_cfg80211_remain_on_channel_cfg(
+			    priv, wait_option, MTRUE, &status, NULL, 0, 0)) {
+			PRINTM(MERROR, "Failed to cancel remain on channel\n");
+		}
 #endif
 	}
 
@@ -5184,7 +5583,7 @@
 	unsigned long flags;
 	mlan_ds_misc_assoc_rsp *assoc_rsp = NULL;
 	IEEEtypes_AssocRsp_t *passoc_rsp = NULL;
-	mlan_ds_misc_assoc_req assoc_req;
+	mlan_ds_misc_assoc_req *assoc_req = NULL;
 
 	mlan_ssid_bssid *ssid_bssid = NULL;
 	moal_handle *handle = priv->phandle;
@@ -5277,7 +5676,10 @@
 	    !(priv->ft_cap & MBIT(0))) {
 		/** get current bss info */
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "Fail to get bss info\n");
+		}
 		/** get target bss info */
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_find_essid(priv, ssid_bssid, MOAL_IOCTL_WAIT)) {
@@ -5334,8 +5736,9 @@
 			priv->ft_md = 0;
 			priv->ft_cap = 0;
 		}
-		memset(&assoc_req, 0, sizeof(mlan_ds_misc_assoc_req));
-		woal_get_assoc_req(priv, &assoc_req, MOAL_IOCTL_WAIT);
+		assoc_req = kzalloc(sizeof(mlan_ds_misc_assoc_req), GFP_ATOMIC);
+		if (assoc_req)
+			woal_get_assoc_req(priv, assoc_req, MOAL_IOCTL_WAIT);
 	}
 	spin_lock_irqsave(&priv->connect_lock, flags);
 	priv->cfg_connect = MFALSE;
@@ -5345,8 +5748,8 @@
 		       MAC2STR(priv->cfg_bssid));
 		spin_unlock_irqrestore(&priv->connect_lock, flags);
 		cfg80211_connect_result(
-			priv->netdev, priv->cfg_bssid, assoc_req.assoc_req_buf,
-			assoc_req.assoc_req_len, passoc_rsp->ie_buffer,
+			priv->netdev, priv->cfg_bssid, assoc_req->assoc_req_buf,
+			assoc_req->assoc_req_len, passoc_rsp->ie_buffer,
 			assoc_rsp->assoc_resp_len - ASSOC_RESP_FIXED_SIZE,
 			WLAN_STATUS_SUCCESS, GFP_KERNEL);
 	} else {
@@ -5359,6 +5762,7 @@
 					GFP_KERNEL);
 	}
 	kfree(ssid_bssid);
+	kfree(assoc_req);
 	kfree(assoc_rsp);
 	assoc_rsp = NULL;
 	LEAVE();
@@ -5434,6 +5838,7 @@
 				    t_u16 reason_code)
 {
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
 	PRINTM(MMSG,
@@ -5446,7 +5851,7 @@
 		return 0;
 	}
 #endif
-	if (priv->phandle->driver_status) {
+	if (priv->phandle->driver_status || priv->phandle->surprise_removed) {
 		PRINTM(MERROR,
 		       "Block woal_cfg80211_disconnect in abnormal driver state\n");
 		LEAVE();
@@ -5456,7 +5861,8 @@
 	if (priv->media_connected == MFALSE) {
 		PRINTM(MMSG, " Already disconnected\n");
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 		if (priv->wdev->connected &&
 #else
 		if (priv->wdev->current_bss &&
@@ -5481,6 +5887,15 @@
 		return 0;
 	}
 
+	if (priv->phandle->remain_on_channel) {
+		if (woal_cfg80211_remain_on_channel_cfg(priv, MOAL_IOCTL_WAIT,
+							MTRUE, (t_u8 *)&status,
+							NULL, 0, 0)) {
+			PRINTM(MERROR, "Fail to cancel remain on channel\n");
+		}
+		priv->phandle->remain_on_channel = MFALSE;
+	}
+
 	/** cancel pending scan */
 	woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
 	priv->cfg_disconnect = MTRUE;
@@ -5530,14 +5945,17 @@
 {
 	int ret = 0;
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	if (priv->phandle->driver_status || priv->phandle->surprise_removed) {
+		PRINTM(MERROR,
+		       "Block woal_cfg80211_deauthenticate in abnormal driver state\n");
+		return ret;
+	}
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (priv->host_mlme) {
-		priv->host_mlme = MFALSE;
-		priv->auth_flag = 0;
-		priv->auth_alg = 0xFFFF;
-		/*send deauth packet to notify disconnection to wpa_supplicant
-		 */
-		woal_deauth_event(priv, req->reason_code);
+		priv->delay_deauth_notify = MTRUE;
+		moal_memcpy_ext(priv->phandle, priv->bssid_notify, req->bssid,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	}
 #endif
 
@@ -5571,14 +5989,26 @@
 {
 	int ret = 0;
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+
+	if (priv->phandle->driver_status || priv->phandle->surprise_removed) {
+		PRINTM(MERROR,
+		       "Block woal_cfg80211_disassociate in abnormal driver state\n");
+		return ret;
+	}
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (priv->host_mlme) {
-		priv->host_mlme = MFALSE;
-		priv->auth_flag = 0;
-		priv->auth_alg = 0xFFFF;
-		/*send deauth packet to notify disconnection to wpa_supplicant
-		 */
-		woal_deauth_event(priv, req->reason_code);
+		priv->delay_deauth_notify = MTRUE;
+#if (CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0) ||                       \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33 &&             \
+      CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 74)))
+		moal_memcpy_ext(priv->phandle, priv->bssid_notify, req->ap_addr,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+#else
+		moal_memcpy_ext(priv->phandle, priv->bssid_notify,
+				req->bss->bssid, MLAN_MAC_ADDR_LENGTH,
+				MLAN_MAC_ADDR_LENGTH);
+#endif
 	}
 #endif
 
@@ -5786,7 +6216,8 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 static int woal_cfg80211_get_channel(struct wiphy *wiphy,
 				     struct wireless_dev *wdev,
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 				     unsigned int link_id,
 #endif
 				     struct cfg80211_chan_def *chandef)
@@ -5879,7 +6310,7 @@
 		return -EFAULT;
 	}
 
-	if (priv->phandle->driver_status) {
+	if (priv->phandle->driver_status || priv->phandle->surprise_removed) {
 		PRINTM(MERROR,
 		       "Block woal_cfg80211_set_power_mgmt in abnormal driver state\n");
 		LEAVE();
@@ -5962,7 +6393,7 @@
  *
  * @param wiphy           A pointer to wiphy structure
  * @param type            TX power adjustment type
- * @param dbm             TX power in dbm
+ * @param mbm             TX power in mbm
  *
  * @return                0 -- success, otherwise fail
  */
@@ -5975,14 +6406,16 @@
 #else
 				      enum nl80211_tx_power_setting type,
 #endif
-				      int dbm)
+				      int mbm)
 {
 	int ret = 0;
 	moal_private *priv = NULL;
 	moal_handle *handle = (moal_handle *)woal_get_wiphy_priv(wiphy);
 	mlan_power_cfg_t power_cfg;
+	int dbm = MBM_TO_DBM(mbm);
 
 	ENTER();
+	memset(&power_cfg, 0, sizeof(power_cfg));
 
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 	if (!priv) {
@@ -5993,6 +6426,11 @@
 
 	if (type) {
 		power_cfg.is_power_auto = 0;
+		if (mbm < 0 || (mbm % 100)) {
+			PRINTM(MERROR, "Invalid tx power value %d mbm\n", mbm);
+			LEAVE();
+			return -EOPNOTSUPP;
+		}
 		power_cfg.power_level = dbm;
 	} else
 		power_cfg.is_power_auto = 1;
@@ -6019,17 +6457,22 @@
 					     struct net_device *dev,
 					     s32 rssi_thold, u32 rssi_hyst)
 {
+	int ret = 0;
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 	ENTER();
 	priv->cqm_rssi_thold = rssi_thold;
 	priv->cqm_rssi_high_thold = rssi_thold;
 	priv->cqm_rssi_hyst = rssi_hyst;
+	priv->mrvl_rssi_low = 0;
 
 	PRINTM(MIOCTL, "rssi_thold=%d rssi_hyst=%d\n", (int)rssi_thold,
 	       (int)rssi_hyst);
-	woal_set_rssi_threshold(priv, 0, MOAL_IOCTL_WAIT);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_set_rssi_threshold(priv, 0, MOAL_IOCTL_WAIT)) {
+		PRINTM(MERROR, "Fail to set rssi thresold.\n");
+	}
 	LEAVE();
-	return 0;
+	return ret;
 }
 #endif
 
@@ -6422,6 +6865,13 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
 	t_u8 buf[ETH_ALEN];
 #endif
+	int index = 0;
+	int j = 0;
+	struct cfg80211_ssid *match_ssid = NULL;
+#ifdef WIFI_DIRECT_SUPPORT
+	mlan_scan_cfg scan_cfg;
+#endif
+
 	ENTER();
 
 #ifdef UAP_CFG80211
@@ -6452,17 +6902,39 @@
 	/** We have pending scan, start bgscan later */
 	if (priv->phandle->scan_pending_on_block)
 		priv->scan_cfg.start_later = MTRUE;
-	for (i = 0; i < request->n_match_sets; i++) {
-		ssid = &request->match_sets[i].ssid;
-		strncpy(priv->scan_cfg.ssid_list[i].ssid, ssid->ssid,
+	for (i = 0; i < request->n_ssids; i++) {
+		ssid = &request->ssids[i];
+		strncpy(priv->scan_cfg.ssid_list[index].ssid, ssid->ssid,
 			ssid->ssid_len);
-		priv->scan_cfg.ssid_list[i].max_len = 0;
-		PRINTM(MIOCTL, "sched scan: ssid=%s\n", ssid->ssid);
+		if (ssid->ssid_len) {
+			priv->scan_cfg.ssid_list[index].max_len = 0;
+			index++;
+		}
+		PRINTM(MCMND, "sched scan: ssid=%s\n", ssid->ssid);
 	}
-	/** Add broadcast scan, when n_match_sets = 0 */
-	if (!request->n_match_sets)
+
+	for (i = 0; i < request->n_match_sets; i++) {
+		match_ssid = &request->match_sets[i].ssid;
+		for (j = 0; j < request->n_ssids; j++) {
+			ssid = &request->ssids[j];
+			if (ssid->ssid_len == match_ssid->ssid_len &&
+			    !strncmp(ssid->ssid, match_ssid->ssid,
+				     ssid->ssid_len))
+				break;
+		}
+		if (j == request->n_ssids) {
+			strncpy(priv->scan_cfg.ssid_list[index].ssid,
+				match_ssid->ssid, match_ssid->ssid_len);
+			priv->scan_cfg.ssid_list[index].max_len =
+				match_ssid->ssid_len;
+			index++;
+		}
+		PRINTM(MCMND, "sched scan: match_ssid=%s\n", match_ssid->ssid);
+	}
+	/** Add broadcast scan, when ssid_list is empty */
+	if (!index)
 		priv->scan_cfg.ssid_list[0].max_len = 0xff;
-	for (i = 0; i < (int)MIN(WLAN_BG_SCAN_CHAN_MAX, request->n_channels);
+	for (i = 0; i < (int)MIN(WLAN_USER_SCAN_CHAN_MAX, request->n_channels);
 	     i++) {
 		chan = request->channels[i];
 		priv->scan_cfg.chan_list[i].chan_number = chan->hw_value;
@@ -6475,6 +6947,8 @@
 		else
 			priv->scan_cfg.chan_list[i].scan_type =
 				MLAN_SCAN_TYPE_ACTIVE;
+		PRINTM(MCMD_D, "cfg80211_sched_scan: chan=%d chan->flag=0x%x\n",
+		       chan->hw_value, chan->flags);
 		priv->scan_cfg.chan_list[i].scan_time = 0;
 #ifdef WIFI_DIRECT_SUPPORT
 		if (priv->phandle->miracast_mode)
@@ -6483,7 +6957,7 @@
 #endif
 	}
 	priv->scan_cfg.chan_per_scan =
-		MIN(WLAN_BG_SCAN_CHAN_MAX, request->n_channels);
+		MIN(WLAN_USER_SCAN_CHAN_MAX, request->n_channels);
 
 	/** set scan request IES */
 	if (request->ie && request->ie_len) {
@@ -6555,10 +7029,21 @@
 	priv->scan_cfg.action = BG_SCAN_ACT_SET;
 	priv->scan_cfg.enable = MTRUE;
 #ifdef WIFI_DIRECT_SUPPORT
-	if (priv->phandle->miracast_mode)
+	memset(&scan_cfg, 0, sizeof(mlan_scan_cfg));
+	if (MLAN_STATUS_SUCCESS != woal_get_scan_config(priv, &scan_cfg)) {
+		PRINTM(MERROR, "Fail to get scan request IE\n");
+	}
+	if (priv->phandle->miracast_mode) {
 		priv->scan_cfg.scan_chan_gap = priv->phandle->scan_chan_gap;
-	else
-		priv->scan_cfg.scan_chan_gap = 0;
+	} else {
+		if (scan_cfg.scan_chan_gap)
+			priv->scan_cfg.scan_chan_gap = scan_cfg.scan_chan_gap;
+		else if (woal_is_any_interface_active(priv->phandle))
+			priv->scan_cfg.scan_chan_gap =
+				priv->phandle->scan_chan_gap;
+		else
+			priv->scan_cfg.scan_chan_gap = 0;
+	}
 #endif
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
@@ -6647,7 +7132,7 @@
 		PRINTM(MERROR, "woal_cfg80211_resume: priv is NULL\n");
 		goto done;
 	}
-
+	handle->cfg80211_suspend = MFALSE;
 	for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
 		if (handle->priv[i] &&
 		    (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA)) {
@@ -6660,6 +7145,8 @@
 #if KERNEL_VERSION(3, 2, 0) <= CFG80211_VERSION_CODE
 					woal_report_sched_scan_result(
 						handle->priv[i]);
+					woal_sched_timeout(50);
+					woal_bgscan_stop_event(handle->priv[i]);
 #endif
 					handle->priv[i]->last_event = 0;
 					PRINTM(MCMND,
@@ -6670,7 +7157,7 @@
 					handle->priv[i]->roaming_required =
 						MTRUE;
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 					__pm_wakeup_event(
 						&handle->ws,
 						ROAMING_WAKE_LOCK_TIMEOUT);
@@ -6739,21 +7226,21 @@
 		    wiphy->wowlan_config->gtk_rekey_failure)
 			wakeup_report.gtk_rekey_failure = true;
 		break;
+	case MGMT_FRAME_FILTER_EXT_MATCHED:
+		break;
 	default:
 		break;
 	}
 
 	if ((wakeup_reason.hs_wakeup_reason > 0) &&
-	    (wakeup_reason.hs_wakeup_reason <= 10)) {
+	    (wakeup_reason.hs_wakeup_reason <= 11)) {
 		cfg80211_report_wowlan_wakeup(priv->wdev, &wakeup_report,
 					      GFP_KERNEL);
 	}
 #endif
 
 done:
-	handle->cfg80211_suspend = MFALSE;
-	queue_work(handle->rx_workqueue, &handle->rx_work);
-
+	woal_queue_rx_task(handle);
 	PRINTM(MCMND, "<--- Leave woal_cfg80211_resume --->\n");
 	return 0;
 }
@@ -6816,6 +7303,7 @@
 	moal_handle *handle = (moal_handle *)woal_get_wiphy_priv(wiphy);
 	int i;
 	int ret = 0;
+	moal_private *priv = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	mlan_ds_misc_mef_flt_cfg mef_cfg;
 	mef_entry_t *mef_entry = NULL;
@@ -6826,13 +7314,15 @@
 	t_u8 byte_seq[MAX_NUM_BYTE_SEQ + 1];
 	const t_u8 ipv4_mc_mac[] = {0x33, 0x33};
 	const t_u8 ipv6_mc_mac[] = {0x01, 0x00, 0x5e};
-	moal_private *priv = woal_get_priv(handle, MLAN_BSS_ROLE_STA);
 	mlan_ds_hs_cfg hscfg;
+	priv = woal_get_priv(handle, MLAN_BSS_ROLE_STA);
+	if (!priv) {
+		return 0;
+	}
 
 	PRINTM(MCMND, "<--- Enter woal_cfg80211_suspend --->\n");
 	for (i = 0; i < MIN(handle->priv_num, MLAN_MAX_BSS_NUM); i++) {
-		if (handle->priv[i] &&
-		    (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA)) {
+		if (handle->priv[i]) {
 			if (handle->scan_request) {
 				PRINTM(MIOCTL,
 				       "Cancel pending scan in woal_cfg80211_suspend\n");
@@ -6845,12 +7335,27 @@
 
 	handle->cfg80211_suspend = MTRUE;
 	if (!wow) {
-		PRINTM(MERROR, "None of the WOWLAN triggers enabled\n");
+		PRINTM(MEVENT,
+		       "None of the WOWLAN triggers enabled in suspend\n");
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		if (priv->delay_deauth_notify) {
+			priv->delay_deauth_notify = MFALSE;
+			priv->host_mlme = MFALSE;
+			priv->auth_flag = 0;
+			priv->auth_alg = 0xFFFF;
+			/*send deauth packet to notify disconnection to
+			 * wpa_supplicant */
+			woal_deauth_event(priv, MLAN_REASON_DEAUTH_LEAVING,
+					  priv->bssid_notify);
+		}
+#endif
 		ret = 0;
 		goto done;
 	}
 
-	if (!priv || !priv->media_connected) {
+	if ((!priv || ((priv->bss_role == MLAN_BSS_ROLE_STA) &&
+		       !priv->media_connected)) ||
+	    ((priv->bss_role == MLAN_BSS_ROLE_UAP) && !priv->bss_started)) {
 		PRINTM(MERROR,
 		       "Can not configure WOWLAN in disconnected state\n");
 		ret = 0;
@@ -7414,6 +7919,11 @@
 	}
 	if (tdls_discovery)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 5, 0)
+		woal_cfg80211_tdls_mgmt(wiphy, dev, bcast_addr, 0,
+					TDLS_DISCOVERY_REQUEST, 1, 0, 0, 0,
+					NULL, 0);
+#else
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
 		woal_cfg80211_tdls_mgmt(wiphy, dev, bcast_addr,
 					TDLS_DISCOVERY_REQUEST, 1, 0, 0, 0,
@@ -7423,6 +7933,7 @@
 					TDLS_DISCOVERY_REQUEST, 1, 0, 0, NULL,
 					0);
 #endif
+#endif
 #else
 		woal_cfg80211_tdls_mgmt(wiphy, dev, bcast_addr,
 					TDLS_DISCOVERY_REQUEST, 1, 0, NULL, 0);
@@ -7916,20 +8427,32 @@
 	t_u32 pkt_type;
 	t_u32 tx_control;
 	t_u16 pkt_len;
+	t_u16 packet_len;
 	int ret = 0;
+	t_u16 buf_size = 0;
 
 	ENTER();
 
 #define HEADER_SIZE 8 /* pkt_type + tx_control */
 
-	pmbuf = woal_alloc_mlan_buffer(
-		priv->phandle,
-		MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE + sizeof(pkt_len) +
+	woal_secure_add(&buf_size, MLAN_MIN_DATA_HEADER_LEN, &buf_size,
+			TYPE_UINT32);
+	woal_secure_add(&buf_size, HEADER_SIZE, &buf_size, TYPE_UINT32);
+	woal_secure_add(&buf_size, sizeof(pkt_len), &buf_size, TYPE_UINT32);
+	woal_secure_add(&buf_size,
 			max(sizeof(struct ieee80211_mgmt),
-			    sizeof(struct ieee80211_tdls_data)) +
-			50 + /* supported rates */
-			sizeof(IEEEtypes_ExtCap_t) + /* ext capab */
-			extra_ies_len + sizeof(IEEEtypes_tdls_linkie));
+			    sizeof(struct ieee80211_tdls_data)),
+			&buf_size, TYPE_UINT32);
+	/* supported rates */
+	woal_secure_add(&buf_size, 50, &buf_size, TYPE_UINT32);
+	/* ext capab */
+	woal_secure_add(&buf_size, sizeof(IEEEtypes_ExtCap_t), &buf_size,
+			TYPE_UINT32);
+	woal_secure_add(&buf_size, extra_ies_len, &buf_size, TYPE_UINT32);
+	woal_secure_add(&buf_size, sizeof(IEEEtypes_tdls_linkie), &buf_size,
+			TYPE_UINT32);
+	pmbuf = woal_alloc_mlan_buffer(priv->phandle, buf_size);
+
 	if (!pmbuf) {
 		PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
 		ret = -ENOMEM;
@@ -7975,9 +8498,10 @@
 	pmbuf->bss_index = priv->bss_index;
 
 	pkt_len = pmbuf->data_len - HEADER_SIZE - sizeof(pkt_len);
+	packet_len = woal_cpu_to_le16(pkt_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
+			&packet_len, sizeof(packet_len), sizeof(packet_len));
 
 	DBG_HEXDUMP(MDAT_D, "TDLS action:", pmbuf->pbuf + pmbuf->data_offset,
 		    pmbuf->data_len);
@@ -8151,7 +8675,6 @@
 	return ret;
 }
 
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
 /**
  * @brief Tx TDLS packet
  *
@@ -8168,6 +8691,14 @@
  *
  * @return                      0 -- success, otherwise fail
  */
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 5, 0)
+int woal_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+			    const t_u8 *peer, int link_id, u8 action_code,
+			    t_u8 dialog_token, t_u16 status_code,
+			    t_u32 peer_capability, bool initiator,
+			    const t_u8 *extra_ies, size_t extra_ies_len)
+#else
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
 int woal_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
 			    const t_u8 *peer, u8 action_code, t_u8 dialog_token,
 			    t_u16 status_code, t_u32 peer_capability,
@@ -8220,6 +8751,7 @@
 			    size_t extra_ies_len)
 #endif
 #endif
+#endif
 {
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 	int ret = 0;
@@ -8239,7 +8771,10 @@
 
 	/* check if AP prohited TDLS */
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MERROR, "WLAN, %s: Failed to get bss info.\n", __func__);
+	}
 	if (IS_EXTCAP_TDLS_PROHIBITED(bss_info.ext_cap)) {
 		PRINTM(MMSG, "TDLS is prohibited by AP\n");
 		LEAVE();
@@ -8423,7 +8958,10 @@
 
 	/* check if AP prohited TDLS channel switch */
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MERROR, "WLAN, %s: Failed to get bss info.\n", __func__);
+	}
 	if (IS_EXTCAP_TDLS_CHLSWITCHPROHIB(bss_info.ext_cap)) {
 		PRINTM(MMSG, "TDLS Channel Switching is prohibited by AP\n");
 		LEAVE();
@@ -8544,8 +9082,41 @@
 					struct station_parameters *params)
 {
 	int ret = 0;
+#ifdef UAP_SUPPORT
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_private *vlan_priv = NULL;
+	station_node *sta_node = NULL;
+	int i = 0;
+#endif
 
 	ENTER();
+#ifdef UAP_SUPPORT
+	/** Bind the station to uap virtual interface and
+	save the station info in moal_private */
+	if (params->vlan) {
+		if (params->vlan->ieee80211_ptr &&
+		    params->vlan->ieee80211_ptr->iftype ==
+			    NL80211_IFTYPE_AP_VLAN) {
+			vlan_priv = (moal_private *)woal_get_netdev_priv(
+				params->vlan);
+			for (i = 0; i < MAX_STA_COUNT; i++) {
+				sta_node = priv->vlan_sta_list[i];
+				if (sta_node &&
+				    !moal_memcmp(priv->phandle,
+						 sta_node->peer_mac, mac,
+						 MLAN_MAC_ADDR_LENGTH)) {
+					PRINTM(MCMND,
+					       "wlan: Easymesh change station aid=%d\n",
+					       sta_node->aid);
+					sta_node->netdev = params->vlan;
+					sta_node->is_valid = MTRUE;
+					vlan_priv->vlan_sta_ptr = sta_node;
+					break;
+				}
+			}
+		}
+	}
+#endif
 	/**do nothing*/
 
 	LEAVE();
@@ -8576,12 +9147,29 @@
 {
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 	int ret = 0;
+	station_node *sta_node = NULL;
 
 	ENTER();
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 #ifdef UAP_SUPPORT
 	if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME) &&
 	    (priv->bss_role == MLAN_BSS_ROLE_UAP)) {
+		sta_node = kmalloc(sizeof(station_node), GFP_KERNEL);
+		if (!sta_node) {
+			PRINTM(MERROR,
+			       "Failed to alloc memory for station node\n");
+			LEAVE();
+			return -ENOMEM;
+		}
+		memset(sta_node, 0, sizeof(*sta_node));
+		moal_memcpy_ext(priv->phandle, sta_node->peer_mac, mac,
+				MLAN_MAC_ADDR_LENGTH, ETH_ALEN);
+		sta_node->netdev = dev;
+		sta_node->aid = params->aid;
+		sta_node->is_valid = MFALSE;
+		/** AID should start from 1 to MAX_STA_COUNT */
+		priv->vlan_sta_list[(params->aid - 1) % MAX_STA_COUNT] =
+			sta_node;
 		ret = woal_cfg80211_uap_add_station(wiphy, dev, (u8 *)mac,
 						    params);
 		LEAVE();
@@ -8648,7 +9236,7 @@
 	PRINTM(MINFO, "==>woal_cfg80211_update_ft_ies %x \n", ftie->ie_len);
 #endif
 	md_ie = (IEEEtypes_MobilityDomain_t *)woal_parse_ie_tlv(
-		ftie->ie, ftie->ie_len, MOBILITY_DOMAIN);
+		ftie->ie, (int)ftie->ie_len, MOBILITY_DOMAIN);
 	if (!md_ie) {
 		PRINTM(MERROR, "No Mobility domain IE\n");
 		kfree(assoc_rsp);
@@ -8700,7 +9288,8 @@
 			passoc_rsp = (IEEEtypes_AssocRsp_t *)
 					     assoc_rsp->assoc_resp_buf;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			roam_info.links[0].bssid = priv->cfg_bssid;
 #else
 			roam_info.bssid = priv->cfg_bssid;
@@ -8833,6 +9422,12 @@
 	}
 	if (sme->ie && sme->ie_len) {
 		priv->sme_current.ie = kzalloc(sme->ie_len, GFP_KERNEL);
+		if (!priv->sme_current.ie) {
+			PRINTM(MERROR,
+			       "Failed to allocate memory for sme params\n");
+			LEAVE();
+			return;
+		}
 		moal_memcpy_ext(priv->phandle, (void *)priv->sme_current.ie,
 				sme->ie, sme->ie_len, sme->ie_len);
 	}
@@ -8900,7 +9495,8 @@
 	}
 
 	if (!priv->okc_roaming_ie) {
-		int okc_ie_len = sme->ie_len + sizeof(t_u16) + PMKID_LEN;
+		int okc_ie_len =
+			MIN(INT_MAX, sme->ie_len + sizeof(t_u16) + PMKID_LEN);
 
 		/** Alloc new buffer for okc roaming ie */
 		priv->okc_roaming_ie = kzalloc(okc_ie_len, GFP_KERNEL);
@@ -9172,7 +9768,8 @@
 		}
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 		roam_info.links[0].bssid = priv->cfg_bssid;
 #else
 		roam_info.bssid = priv->cfg_bssid;
@@ -9210,7 +9807,7 @@
 	/* config rssi low threshold again */
 	priv->last_event = 0;
 	priv->rssi_low = DEFAULT_RSSI_LOW_THRESHOLD;
-	sprintf(rssi_low, "%d", priv->rssi_low);
+	snprintf(rssi_low, sizeof(rssi_low), "%d", priv->rssi_low);
 	if (MLAN_STATUS_FAILURE ==
 	    woal_set_rssi_low_threshold(priv, rssi_low, MOAL_IOCTL_WAIT))
 		PRINTM(MERROR, "set_rssi_low_threshold fail\n");
@@ -9253,7 +9850,8 @@
 	if (params->ext_capab_len)
 		req_len += sizeof(MrvlIEtypesHeader_t) + params->ext_capab_len;
 #endif
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.supported_rates_len)
 		req_len += sizeof(MrvlIEtypesHeader_t) +
 			   params->link_sta_params.supported_rates_len;
@@ -9264,14 +9862,16 @@
 #endif
 	if (params->uapsd_queues || params->max_sp)
 		req_len += sizeof(MrvlIEtypesHeader_t) + sizeof(qosinfo);
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.ht_capa)
 #else
 	if (params->ht_capa)
 #endif
 		req_len += sizeof(MrvlIEtypesHeader_t) +
 			   sizeof(struct ieee80211_ht_cap);
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.vht_capa)
 #else
 	if (params->vht_capa)
@@ -9279,7 +9879,8 @@
 		req_len += sizeof(MrvlIEtypesHeader_t) +
 			   sizeof(struct ieee80211_vht_cap);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.opmode_notif_used)
 		req_len += sizeof(MrvlIEtypesHeader_t) + sizeof(u8);
 #else
@@ -9289,13 +9890,15 @@
 #endif
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.he_capa_len)
 		req_len += sizeof(MrvlExtIEtypesHeader_t) +
 			   params->link_sta_params.he_capa_len;
 #else
 	if (params->he_capa_len)
 		req_len += sizeof(MrvlExtIEtypesHeader_t) + params->he_capa_len;
+
 #endif
 #endif
 	req = woal_alloc_mlan_ioctl_req(req_len);
@@ -9344,20 +9947,23 @@
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
 #endif
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.supported_rates_len) {
 #else
 	if (params->supported_rates_len) {
 #endif
 		tlv = (MrvlIEtypes_Data_t *)pos;
 		tlv->header.type = SUPPORTED_RATES;
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 		tlv->header.len = params->link_sta_params.supported_rates_len;
 #else
 		tlv->header.len = params->supported_rates_len;
 #endif
 		moal_memcpy_ext(priv->phandle, tlv->data,
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 				params->link_sta_params.supported_rates,
 				tlv->header.len,
 #else
@@ -9381,7 +9987,8 @@
 			sizeof(MrvlIEtypesHeader_t) + tlv->header.len;
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.ht_capa) {
 #else
 	if (params->ht_capa) {
@@ -9389,7 +9996,8 @@
 		tlv = (MrvlIEtypes_Data_t *)pos;
 		tlv->header.type = HT_CAPABILITY;
 		tlv->header.len = sizeof(struct ieee80211_ht_cap);
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 		moal_memcpy_ext(priv->phandle, tlv->data,
 				params->link_sta_params.ht_capa,
 #else
@@ -9401,7 +10009,8 @@
 			sizeof(MrvlIEtypesHeader_t) + tlv->header.len;
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.vht_capa) {
 #else
 	if (params->vht_capa) {
@@ -9409,7 +10018,8 @@
 		tlv = (MrvlIEtypes_Data_t *)pos;
 		tlv->header.type = VHT_CAPABILITY;
 		tlv->header.len = sizeof(struct ieee80211_vht_cap);
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 		moal_memcpy_ext(priv->phandle, tlv->data,
 				params->link_sta_params.vht_capa,
 #else
@@ -9422,7 +10032,8 @@
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.opmode_notif_used) {
 #else
 	if (params->opmode_notif_used) {
@@ -9430,7 +10041,8 @@
 		tlv = (MrvlIEtypes_Data_t *)pos;
 		tlv->header.type = OPER_MODE_NTF;
 		tlv->header.len = sizeof(u8);
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 		moal_memcpy_ext(priv->phandle, tlv->data,
 				&params->link_sta_params.opmode_notif,
 #else
@@ -9443,7 +10055,8 @@
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
 #endif
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) ||                     \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34))
 	if (params->link_sta_params.he_capa_len) {
 		ext_tlv = (MrvlExtIEtypes_Data_t *)pos;
 		ext_tlv->header.type = EXTENSION;
@@ -9461,6 +10074,7 @@
 			params->link_sta_params.he_capa_len;
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
+
 #elif CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 	if (params->he_capa_len) {
 		ext_tlv = (MrvlExtIEtypes_Data_t *)pos;
@@ -9475,6 +10089,7 @@
 			sizeof(MrvlExtIEtypesHeader_t) + params->he_capa_len;
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
+
 #endif
 	DBG_HEXDUMP(MCMD_D, "sta tlv", &bss->param.sta_info.tlv[0],
 		    bss->param.sta_info.tlv_len);
@@ -9534,18 +10149,19 @@
 	ENTER();
 
 	memset(frame_buf, 0, sizeof(frame_buf));
-	mgmt->frame_control = (__force __le16)IEEE80211_STYPE_DEAUTH;
+	mgmt->frame_control =
+		(__force __le16)cpu_to_le16(IEEE80211_STYPE_DEAUTH);
 	mgmt->duration = 0;
 	mgmt->seq_ctrl = 0;
-	mgmt->u.deauth.reason_code = (__force __le16)reason_code;
+	mgmt->u.deauth.reason_code = (__force __le16)cpu_to_le16(reason_code);
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
 		moal_memcpy_ext(priv->phandle, mgmt->da, broadcast_addr,
 				ETH_ALEN, sizeof(mgmt->da));
 		moal_memcpy_ext(priv->phandle, mgmt->sa,
 				priv->sme_current.bssid, ETH_ALEN,
 				sizeof(mgmt->sa));
-		moal_memcpy_ext(priv->phandle, mgmt->bssid, priv->cfg_bssid,
-				ETH_ALEN, sizeof(mgmt->bssid));
+		moal_memcpy_ext(priv->phandle, mgmt->bssid, sa, ETH_ALEN,
+				sizeof(mgmt->bssid));
 		priv->host_mlme = MFALSE;
 		priv->auth_flag = 0;
 	} else {
@@ -9561,7 +10177,11 @@
 	}
 
 	if (GET_BSS_ROLE(priv) != MLAN_BSS_ROLE_UAP) {
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+		wiphy_lock(priv->wdev->wiphy);
+		cfg80211_rx_mlme_mgmt(priv->netdev, frame_buf, 26);
+		wiphy_unlock(priv->wdev->wiphy);
+#elif CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
 		mutex_lock(&priv->wdev->mtx);
 		cfg80211_rx_mlme_mgmt(priv->netdev, frame_buf, 26);
 		mutex_unlock(&priv->wdev->mtx);
@@ -9641,6 +10261,8 @@
 		wdev->iftype = NL80211_IFTYPE_STATION;
 #endif
 #endif
+	if (bss_type == MLAN_BSS_TYPE_NAN)
+		wdev->iftype = NL80211_IFTYPE_STATION;
 	dev_net_set(dev, wiphy_net(wdev->wiphy));
 	dev->ieee80211_ptr = wdev;
 	SET_NETDEV_DEV(dev, wiphy_dev(wdev->wiphy));
@@ -9682,11 +10304,13 @@
  *
  * @param priv            A pointer to moal_private structure
  * @param wiphy 		  A pointer to structure wiphy
+ * @param fw_info         A pointer to mlan_fw_info
  * @param wait_option     Wait option
  * @return                MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
 static mlan_status woal_cfg80211_init_wiphy(moal_private *priv,
 					    struct wiphy *wiphy,
+					    mlan_fw_info *fw_info,
 					    t_u8 wait_option)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -9704,8 +10328,32 @@
 	t_u16 enable = 0;
 #endif
 	int mcs_supp = 0;
+	char countryOTP[3];
 
 	ENTER();
+	countryOTP[0] = fw_info->fw_country_code & 0x00FF;
+	countryOTP[1] = (fw_info->fw_country_code & 0xFF00) >> 8;
+	countryOTP[2] = '\0';
+
+	/**check for OTP country code */
+	if (!fw_info->force_reg && countryOTP[0] && countryOTP[1] &&
+	    (priv->phandle->params.cntry_txpwr == CNTRY_RGPOWER_MODE)) {
+		priv->phandle->country_code[0] = countryOTP[0];
+		priv->phandle->country_code[1] = countryOTP[1];
+
+		/**download OTP country code rgpower_xx.bin file*/
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_request_country_power_table(priv, countryOTP,
+						     MOAL_IOCTL_WAIT)) {
+			PRINTM(MCMND, "rgpower_xx downloading fail \n");
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
+			return -EFAULT;
+#else
+			return MLAN_STATUS_FAILURE;
+#endif
+		}
+		woal_get_chan_region_cfg(priv);
+	}
 	/* Get 11n tx parameters from MLAN */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11n_cfg));
 	if (req == NULL) {
@@ -9736,14 +10384,16 @@
 	/* Initialize parameters for 2GHz and 5GHz bands */
 	if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
 		if (IS_CARD9098(priv->phandle->card_type) ||
-		    IS_CARD9097(priv->phandle->card_type)) {
+		    IS_CARD9097(priv->phandle->card_type) ||
+		    IS_CARDAW693(priv->phandle->card_type)) {
 			mcs_supp = priv->phandle->params.antcfg & 0xf;
 			if (mcs_supp != 3 && mcs_supp != 0)
 				cfg_11n->param.supported_mcs_set[1] = 0;
 		}
 		woal_cfg80211_setup_ht_cap(
 			&wiphy->bands[IEEE80211_BAND_2GHZ]->ht_cap, hw_dev_cap,
-			cfg_11n->param.supported_mcs_set);
+			cfg_11n->param.supported_mcs_set,
+			fw_info->hw_mpdu_density);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 		woal_cfg80211_setup_vht_cap(
 			priv, &wiphy->bands[IEEE80211_BAND_2GHZ]->vht_cap);
@@ -9756,14 +10406,16 @@
 	/* For 2.4G band only card, this shouldn't be set */
 	if (wiphy->bands[IEEE80211_BAND_5GHZ]) {
 		if (IS_CARD9098(priv->phandle->card_type) ||
-		    IS_CARD9097(priv->phandle->card_type)) {
+		    IS_CARD9097(priv->phandle->card_type) ||
+		    IS_CARDAW693(priv->phandle->card_type)) {
 			mcs_supp = (priv->phandle->params.antcfg & 0xf00) >> 8;
 			if (mcs_supp != 3 && mcs_supp != 0)
 				cfg_11n->param.supported_mcs_set[1] = 0;
 		}
 		woal_cfg80211_setup_ht_cap(
 			&wiphy->bands[IEEE80211_BAND_5GHZ]->ht_cap, hw_dev_cap,
-			cfg_11n->param.supported_mcs_set);
+			cfg_11n->param.supported_mcs_set,
+			fw_info->hw_mpdu_density);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 		woal_cfg80211_setup_vht_cap(
 			priv, &wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap);
@@ -9799,7 +10451,9 @@
 	}
 #endif
 	if (IS_CARD9098(priv->phandle->card_type) ||
-	    IS_CARD9097(priv->phandle->card_type)) {
+	    IS_CARD9097(priv->phandle->card_type) ||
+	    IS_CARDIW624(priv->phandle->card_type) ||
+	    IS_CARDAW693(priv->phandle->card_type)) {
 		woal_cfg80211_notify_antcfg(priv, wiphy, radio);
 	}
 	wiphy->available_antennas_tx = radio->param.ant_cfg.tx_antenna;
@@ -9979,8 +10633,9 @@
 	wiphy->max_scan_ssids = MRVDRV_MAX_SSID_LIST_LENGTH;
 	wiphy->max_scan_ie_len = MAX_IE_SIZE;
 	wiphy->interface_modes = 0;
-	wiphy->interface_modes =
-		MBIT(NL80211_IFTYPE_STATION) | MBIT(NL80211_IFTYPE_AP);
+	wiphy->interface_modes = MBIT(NL80211_IFTYPE_STATION) |
+				 MBIT(NL80211_IFTYPE_AP_VLAN) |
+				 MBIT(NL80211_IFTYPE_AP);
 	wiphy->interface_modes |= MBIT(NL80211_IFTYPE_MONITOR);
 
 #ifdef WIFI_DIRECT_SUPPORT
@@ -10035,6 +10690,11 @@
 	/* Initialize cipher suits */
 	wiphy->cipher_suites = cfg80211_cipher_suites;
 	wiphy->n_cipher_suites = ARRAY_SIZE(cfg80211_cipher_suites);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 1, 0)
+	wiphy->akm_suites = cfg80211_akm_suites;
+	wiphy->n_akm_suites = ARRAY_SIZE(cfg80211_akm_suites);
+#endif
+
 #ifdef UAP_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
@@ -10052,9 +10712,11 @@
 #endif
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+	cfg80211_iface_comb_ap_sta.num_different_channels = 1;
 	if ((moal_extflg_isset(priv->phandle, EXT_CFG80211_DRCS) &&
 	     priv->phandle->card_info->drcs) ||
-	    IS_CARD9098(priv->phandle->card_type)) {
+	    IS_CARD9098(priv->phandle->card_type) ||
+	    IS_CARDAW693(priv->phandle->card_type)) {
 		cfg80211_iface_comb_ap_sta.num_different_channels = 2;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
 		cfg80211_iface_comb_ap_sta.radar_detect_widths = 0;
@@ -10078,6 +10740,11 @@
 	wiphy->flags |=
 		WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL | WIPHY_FLAG_OFFCHAN_TX;
 	wiphy->flags |= WIPHY_FLAG_AP_UAPSD | WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+
+	wiphy->probe_resp_offload = NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
+				    NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
+				    NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
 		wiphy->flags |= WIPHY_FLAG_REPORTS_OBSS;
@@ -10142,6 +10809,9 @@
 	if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
 		wiphy->features |= NL80211_FEATURE_SAE;
 #endif
+	wiphy->flags |= WIPHY_FLAG_4ADDR_AP;
+	wiphy->flags |= WIPHY_FLAG_4ADDR_STATION;
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	wiphy->features |= NL80211_FEATURE_NEED_OBSS_SCAN;
 #endif
@@ -10166,6 +10836,10 @@
 	wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
 #endif
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+	wiphy->features |= NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
+#endif /* KERNEL_VERSION(3, 19, 0) */
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA);
 	wiphy_ext_feature_set(wiphy,
@@ -10198,6 +10872,7 @@
 	}
 #endif
 #endif
+
 	/* Set struct moal_handle pointer in wiphy_priv */
 	wdev_priv = wiphy_priv(wiphy);
 	*(unsigned long *)wdev_priv = (unsigned long)priv->phandle;
@@ -10227,6 +10902,7 @@
 	}
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+#if CFG80211_VERSION_CODE <= KERNEL_VERSION(6, 1, 38)
 	/*REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make
 	 * sure all interfaces on this wiphy reside on allowed channels. If this
 	 * flag is not set, upon a regdomain change, the interfaces are given a
@@ -10234,7 +10910,18 @@
 	 * allowed channel.*/
 	wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
 #endif
+#endif
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+#if CFG80211_VERSION_CODE <= KERNEL_VERSION(6, 3, 12)
+	/*REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make
+	 * sure all interfaces on this wiphy reside on allowed channels. If this
+	 * flag is not set, upon a regdomain change, the interfaces are given a
+	 * grace period (currently 60 seconds) to disconnect or move to an
+	 * allowed channel.*/
+	wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
+#endif
+#endif
 	memset(&priv->phandle->country_code, 0,
 	       sizeof(priv->phandle->country_code));
 	priv->phandle->dfs_region = NXP_DFS_UNKNOWN;
@@ -10263,7 +10950,8 @@
 		(t_u8 *)&priv->extended_capabilities;
 	wiphy->extended_capabilities_len = sizeof(priv->extended_capabilities);
 #endif
-	woal_cfg80211_init_wiphy(priv, wiphy, MOAL_IOCTL_WAIT);
+
+	woal_cfg80211_init_wiphy(priv, wiphy, &fw_info, MOAL_IOCTL_WAIT);
 	if (wiphy_register(wiphy) < 0) {
 		PRINTM(MERROR, "Wiphy device registration failed!\n");
 		ret = MLAN_STATUS_FAILURE;
@@ -10323,3 +11011,140 @@
 	LEAVE();
 	return ret;
 }
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/**
+ * @brief Add WMM tspec TS
+
+ * @param wiphy           A pointer to wiphy structure
+ * @param dev             A pointer to net_device structure
+ * @param tsid            A u8 tsid value for the TS
+ * @param peer            A pointer to peer MAC address
+ * @param user_prio       A u8 user priority value
+ * @param admitted_time   A u16 admitted time for the TS
+ *
+ * @return                0 -- success, otherwise fail
+ */
+static int woal_cfg80211_add_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+				   u8 tsid, const u8 *peer, u8 user_prio,
+				   u16 admitted_time)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_tx_addts_cfg *ts_cfg = NULL;
+	mlan_ds_wmm_cfg *pwmm = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_FAILURE;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+
+	ENTER();
+
+	if (peer == NULL || tsid >= MAX_NUM_TID || user_prio >= MAX_NUM_TID) {
+		PRINTM(MERROR, "ADDTS: Invalid parameters\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	if (memcmp(peer, priv->cfg_bssid, MLAN_MAC_ADDR_LENGTH)) {
+		PRINTM(MERROR, "ADDTS: Invalid peer Address\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_wmm_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	pwmm = (mlan_ds_wmm_cfg *)req->pbuf;
+	pwmm->sub_command = MLAN_OID_WMM_CFG_HOST_ADDTS;
+	ts_cfg = &pwmm->param.host_addts;
+	ts_cfg->tsid = tsid;
+	ts_cfg->user_prio = user_prio;
+	ts_cfg->admitted_time = admitted_time;
+	moal_memcpy_ext(priv->phandle, ts_cfg->peer, peer, sizeof(ts_cfg->peer),
+			MLAN_MAC_ADDR_LENGTH);
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_WMM_CFG;
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	PRINTM(MMSG,
+	       "WMM AC - ADDTS tsid=%u peer=" MACSTR
+	       " up=%u admitted_time=%u\n",
+	       tsid, MAC2STR(peer), user_prio, admitted_time);
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief Set del tx tspec parameters
+
+ * @param wiphy           A pointer to wiphy structure
+ * @param dev             A pointer to net_device structure
+ * @param params		  A pointer to ieee80211_txq_params structure
+ *
+ * @return                0 -- success, otherwise fail
+ */
+static int woal_cfg80211_del_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+				   u8 tsid, const u8 *peer)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_wmm_cfg *pwmm = NULL;
+	mlan_ds_tx_delts_cfg *ts_cfg = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_FAILURE;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+
+	ENTER();
+
+	if (peer == NULL || tsid >= MAX_NUM_TID) {
+		PRINTM(MERROR, "DELTS: Invalid parameters \n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (memcmp(peer, priv->cfg_bssid, MLAN_MAC_ADDR_LENGTH)) {
+		PRINTM(MERROR, "DELTS: Invalid peer Address\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_wmm_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+	pwmm = (mlan_ds_wmm_cfg *)req->pbuf;
+	pwmm->sub_command = MLAN_OID_WMM_CFG_HOST_DELTS;
+	ts_cfg = &pwmm->param.host_delts;
+	ts_cfg->tsid = tsid;
+	moal_memcpy_ext(priv->phandle, ts_cfg->peer, peer, sizeof(ts_cfg->peer),
+			MLAN_MAC_ADDR_LENGTH);
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_WMM_CFG;
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	PRINTM(MMSG, "WMM AC - DELTS tsid=%u peer=" MACSTR "\n", tsid,
+	       MAC2STR(peer));
+done:
+
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+#endif /* KERNEL_VERSION(3, 8, 0) */
diff --git a/wlan_src/mlinux/moal_sta_cfg80211.h b/wlan_src/mlinux/moal_sta_cfg80211.h
new file mode 100644
index 0000000..202c194
--- /dev/null
+++ b/wlan_src/mlinux/moal_sta_cfg80211.h
@@ -0,0 +1,39 @@
+/** @file moal_sta_cfg80211.h
+ *
+ * @brief This file contains the STA CFG80211 specific defines.
+ *
+ *
+ * Copyright 2011-2024 NXP
+ *
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
+ *
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ */
+
+#ifndef _MOAL_STA_CFG80211_H_
+#define _MOAL_STA_CFG80211_H_
+
+/** Convert RSSI signal strength from dBm to mBm (100*dBm) */
+#define RSSI_DBM_TO_MDM(x) ((x)*100)
+
+mlan_status woal_register_sta_cfg80211(struct net_device *dev, t_u8 bss_type);
+
+#endif /* _MOAL_STA_CFG80211_H_ */
diff --git a/wlan_sd8987/mlinux/moal_uap.c b/wlan_src/mlinux/moal_uap.c
old mode 100755
new mode 100644
similarity index 93%
rename from wlan_sd8987/mlinux/moal_uap.c
rename to wlan_src/mlinux/moal_uap.c
index 8a033ba..3126478
--- a/wlan_sd8987/mlinux/moal_uap.c
+++ b/wlan_src/mlinux/moal_uap.c
@@ -4,20 +4,28 @@
  * driver.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2022, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -432,7 +440,7 @@
 	}
 	DBG_HEXDUMP(MCMD_D, "band_steer_para", (t_u8 *)&param, sizeof(param));
 
-	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_band_steer_cfg));
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (ioctl_req == NULL) {
 		LEAVE();
 		return -ENOMEM;
@@ -508,8 +516,7 @@
 	DBG_HEXDUMP(MCMD_D, "beacon_stuck_detect_para", (t_u8 *)&param,
 		    sizeof(param));
 
-	ioctl_req = woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_beacon_stuck_param_cfg));
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (ioctl_req == NULL) {
 		LEAVE();
 		return -ENOMEM;
@@ -663,20 +670,16 @@
 	if (!param.action) {
 		PRINTM(MINFO, "Cmd52 read, func=%d, reg=0x%08X\n", func, reg);
 #ifdef SDIO_MMC
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (func)
 			data = sdio_readb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				reg, &ret);
 		else
 			data = sdio_f0_readb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				reg, &ret);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (ret) {
 			PRINTM(MERROR,
 			       "sdio_readb: reading register 0x%X failed\n",
@@ -699,20 +702,16 @@
 		PRINTM(MINFO, "Cmd52 write, func=%d, reg=0x%08X, data=0x%02X\n",
 		       func, reg, data);
 #ifdef SDIO_MMC
-		sdio_claim_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_claim_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (func)
 			sdio_writeb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				data, reg, &ret);
 		else
 			sdio_f0_writeb(
-				((struct sdio_mmc_card *)priv->phandle->card)
-					->func,
+				((sdio_mmc_card *)priv->phandle->card)->func,
 				data, reg, &ret);
-		sdio_release_host(
-			((struct sdio_mmc_card *)priv->phandle->card)->func);
+		sdio_release_host(((sdio_mmc_card *)priv->phandle->card)->func);
 		if (ret) {
 			PRINTM(MERROR,
 			       "sdio_writeb: writing register 0x%X failed\n",
@@ -918,7 +917,7 @@
 	DBG_HEXDUMP(MCMD_D, "domain_info_para", (t_u8 *)&param, sizeof(param));
 	if (param.action) {
 		/* get tlv header */
-		if (copy_from_user(tlv, req->ifr_data + sizeof(param),
+		if (copy_from_user(&tlv[0], req->ifr_data + sizeof(param),
 				   TLV_HEADER_LEN)) {
 			PRINTM(MERROR, "Copy from user failed\n");
 			ret = -EFAULT;
@@ -1550,7 +1549,12 @@
 	    (hs_cfg.conditions != HOST_SLEEP_CFG_CANCEL ||
 	     invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "ERR: failed in getting bss info\n");
+			ret = -EFAULT;
+			goto done;
+		}
 		if (bss_info.is_hs_configured) {
 			PRINTM(MERROR, "HS already configured\n");
 			ret = -EFAULT;
@@ -1561,8 +1565,12 @@
 	if (hs_cfg.flags & HS_CFG_FLAG_SET) {
 		action = MLAN_ACT_SET;
 		if (hs_cfg.flags != HS_CFG_FLAG_ALL) {
-			woal_set_get_hs_params(priv, MLAN_ACT_GET,
-					       MOAL_IOCTL_WAIT, &hscfg);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_set_get_hs_params(priv, MLAN_ACT_GET,
+						   MOAL_IOCTL_WAIT, &hscfg)) {
+				PRINTM(MERROR,
+				       "Unable to get HS Configuration\n");
+			}
 		}
 		if (hs_cfg.flags & HS_CFG_FLAG_CONDITION)
 			hscfg.conditions = hs_cfg.conditions;
@@ -1917,9 +1925,22 @@
 		mreq->action = MLAN_ACT_SET;
 		radio->param.ant_cfg.tx_antenna = antenna_config.tx_mode;
 		radio->param.ant_cfg.rx_antenna = antenna_config.rx_mode;
+	}
+
+	status = woal_request_ioctl(priv, mreq, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to set new antenna config\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* Notify the CFG80211 layer only on SUCCESS from FW */
+	if ((status == MLAN_STATUS_SUCCESS) && (mreq->action == MLAN_ACT_SET)) {
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		if (IS_CARD9098(priv->phandle->card_type) ||
-		    IS_CARD9097(priv->phandle->card_type)) {
+		    IS_CARD9097(priv->phandle->card_type) ||
+		    IS_CARDIW624(priv->phandle->card_type) ||
+		    IS_CARDAW693(priv->phandle->card_type)) {
 			if (IS_STA_CFG80211(
 				    priv->phandle->params.cfg80211_wext))
 				woal_cfg80211_notify_antcfg(
@@ -1928,11 +1949,6 @@
 #endif
 	}
 
-	status = woal_request_ioctl(priv, mreq, MOAL_IOCTL_WAIT);
-	if (status != MLAN_STATUS_SUCCESS) {
-		ret = -EFAULT;
-		goto done;
-	}
 	if (mreq->action == MLAN_ACT_GET) {
 		antenna_config.tx_mode = radio->param.ant_cfg.tx_antenna;
 		antenna_config.rx_mode = radio->param.ant_cfg.rx_antenna;
@@ -2103,27 +2119,8 @@
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11h_cfg *ds_11hcfg = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
-#ifdef UAP_CFG80211
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-	int cfg80211_wext = priv->phandle->params.cfg80211_wext;
-#endif
-#endif
 
 	ENTER();
-#ifdef UAP_CFG80211
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-	if (action == MLAN_ACT_GET) {
-		if (IS_UAP_CFG80211(cfg80211_wext)) {
-			ret = woal_get_wiphy_chan_dfs_state(
-				priv->phandle->wiphy, ch_dfs_state);
-			if (!ret) {
-				LEAVE();
-				return ret;
-			}
-		}
-	}
-#endif
-#endif
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11h_cfg));
 	if (req == NULL) {
 		ret = -ENOMEM;
@@ -2173,7 +2170,8 @@
 			       {116, 120, 124, 128},
 			       {132, 136, 140, 144}};
 	t_u8 find = false;
-	int i, j;
+	int j;
+	int i;
 	t_u8 sec_chan = 0;
 	mlan_ds_11h_chan_dfs_state *pos = ch_dfs_state;
 	t_u8 n_chan = 1;
@@ -2223,8 +2221,40 @@
 #ifdef UAP_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 /**
+ * @brief update channel dfs state in mlan module
+ *
+ * @param channel         given radar channel
+ * @param dfs_state       dfs_state
+ *
+ * @return                N/A
+ */
+static void woal_set_channel_dfs_state(t_u8 channel, t_u8 dfs_state)
+{
+	int index;
+	mlan_ds_11h_chan_dfs_state ch_dfs_state;
+	moal_private *priv;
+	memset(&ch_dfs_state, 0, sizeof(ch_dfs_state));
+	ch_dfs_state.channel = channel;
+	ch_dfs_state.dfs_state = dfs_state;
+	for (index = 0; index < MAX_MLAN_ADAPTER; index++) {
+		if (m_handle[index]) {
+			priv = woal_get_priv(m_handle[index],
+					     MLAN_BSS_ROLE_UAP);
+			if (priv) {
+				if (woal_11h_chan_dfs_state(priv, MLAN_ACT_SET,
+							    &ch_dfs_state))
+					PRINTM(MERROR,
+					       "Set DFS state for chan:%d failed\n",
+					       ch_dfs_state.channel);
+			}
+		}
+	}
+}
+
+/**
  * @brief update channel dfs state to all wiphy
  *
+ * @param priv     Pointer to the moal_private driver data struct
  * @param channel         given radar channel
  * @param bandwidth       channel's bandwidth
  * @param dfs_state       dfs_state
@@ -2247,9 +2277,62 @@
 						      dfs_state);
 		}
 	}
+	for (i = 0; i < n_chan; i++) {
+		woal_set_channel_dfs_state(ch_dfs_state[i].channel, dfs_state);
+	}
 	LEAVE();
 	return;
 }
+
+/**
+ * @brief reset uap channel dfs_state to DFS_USABLE
+ *
+ * @param priv     Pointer to the moal_private driver data struct
+ *
+ * @return                N/A
+ */
+void woal_update_uap_channel_dfs_state(moal_private *priv)
+{
+	mlan_ds_11h_chan_dfs_state ch_dfs_state;
+	t_u8 channel;
+	t_u8 bandwidth;
+	ENTER();
+	if (woal_is_etsi_country(priv->phandle->country_code)) {
+		LEAVE();
+		return;
+	}
+	if (priv->bss_role == MLAN_BSS_ROLE_UAP && priv->bss_started &&
+	    priv->uap_host_based) {
+		channel = priv->chan.chan->hw_value;
+		memset(&ch_dfs_state, 0, sizeof(ch_dfs_state));
+		ch_dfs_state.channel = channel;
+		if (woal_11h_chan_dfs_state(priv, MLAN_ACT_GET,
+					    &ch_dfs_state)) {
+			PRINTM(MERROR, "%s: woal_11h_chan_dfs_state failed \n",
+			       __func__);
+			LEAVE();
+			return;
+		}
+
+		if (ch_dfs_state.dfs_required &&
+		    ch_dfs_state.dfs_state == DFS_AVAILABLE) {
+			switch (priv->chan.width) {
+			case NL80211_CHAN_WIDTH_40:
+				bandwidth = CHAN_BW_40MHZ;
+				break;
+			case NL80211_CHAN_WIDTH_80:
+				bandwidth = CHAN_BW_80MHZ;
+				break;
+			default:
+				bandwidth = CHAN_BW_20MHZ;
+				break;
+			}
+			woal_update_channels_dfs_state(priv, channel, bandwidth,
+						       DFS_USABLE);
+		}
+	}
+	LEAVE();
+}
 #endif
 #endif
 
@@ -2482,6 +2565,80 @@
 }
 
 /**
+ * @brief Set/Get wacp_mode
+ *
+ *  @param dev      A pointer to net_device structure
+ *  @param req      A pointer to ifreq structure
+ *
+ * @return           0 --success, otherwise fail
+ */
+static int woal_uap_wacp_mode(struct net_device *dev, struct ifreq *req)
+{
+	moal_private *priv = (moal_private *)netdev_priv(dev);
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *pcfg_misc = NULL;
+	wacp_mode_para param;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	/* Sanity check */
+	if (req->ifr_data == NULL) {
+		PRINTM(MERROR, "woal_uap_wacp_mode() corrupt data\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	memset(&param, 0, sizeof(wacp_mode_para));
+	/* Get user data */
+	if (copy_from_user(&param, req->ifr_data, sizeof(wacp_mode_para))) {
+		PRINTM(MERROR, "Copy from user failed\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* Allocate an IOCTL request buffer */
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		status = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	pcfg_misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	pcfg_misc->sub_command = MLAN_OID_MISC_WACP_MODE;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	ioctl_req->action = param.action;
+	pcfg_misc->param.wacp_mode = param.wacp_mode;
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	param.wacp_mode = pcfg_misc->param.wacp_mode;
+	/** Update the moal wacp_mode */
+	if (param.action == MLAN_ACT_SET) {
+		priv->phandle->params.wacp_mode = param.wacp_mode;
+	}
+
+	/* Copy to user */
+	if (copy_to_user(req->ifr_data, &param, sizeof(param))) {
+		PRINTM(MERROR, "Copy to user failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+	LEAVE();
+	return ret;
+}
+
+/**
  *  @brief uap ioctl handler
  *
  *  @param dev      A pointer to net_device structure
@@ -2587,6 +2744,9 @@
 	case UAP_BEACON_STUCK_DETECT:
 		ret = woal_uap_beacon_stuck(dev, req);
 		break;
+	case UAP_WACP_MODE:
+		woal_uap_wacp_mode(dev, req);
+		break;
 	default:
 		break;
 	}
@@ -2645,7 +2805,8 @@
 			sizeof(mlan_deauth_param),
 			sizeof(bss->param.deauth_param));
 	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
-	if (status != MLAN_STATUS_SUCCESS) {
+	if ((status != MLAN_STATUS_SUCCESS) &&
+	    (status != MLAN_STATUS_PENDING)) {
 		ret = -EFAULT;
 		if (copy_to_user(req->ifr_data, &ioctl_req->status_code,
 				 sizeof(t_u32)))
@@ -2713,7 +2874,12 @@
 	} else {
 		/* Get radio status */
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "ERR: failed in getting bss info\n");
+			ret = -EFAULT;
+			goto done;
+		}
 
 		data[1] = bss_info.radio_on;
 		if (copy_to_user(req->ifr_data, data, sizeof(data))) {
@@ -3025,7 +3191,8 @@
 	}
 
 	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
-	if (status != MLAN_STATUS_SUCCESS) {
+	if ((status != MLAN_STATUS_SUCCESS) &&
+	    (status != MLAN_STATUS_PENDING)) {
 		ret = -EFAULT;
 		if (copy_to_user(req->ifr_data, &ioctl_req->status_code,
 				 sizeof(t_u32)))
@@ -3160,7 +3327,8 @@
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -3781,9 +3949,8 @@
 				he_cfg.he_cap.len);
 	}
 #define HE_MAC_CAP_TWT_REQ_SUPPORT MBIT(1)
-	/* uap mode clear TWT request bit */
+	/* uap mode should be TWT responder only */
 	he_cfg.he_cap.he_mac_cap[0] &= ~HE_MAC_CAP_TWT_REQ_SUPPORT;
-
 	if (action == MLAN_ACT_DISABLE) {
 		if (he_cfg.he_cap.len &&
 		    (he_cfg.he_cap.ext_id == HE_CAPABILITY)) {
@@ -4030,6 +4197,61 @@
 	return ret;
 }
 
+#if defined(UAP_CFG80211)
+#if defined(STA_WEXT) || defined(UAP_WEXT)
+/**
+ *  @brief Set/Get multi AP mode
+ *
+ *  @param priv             A pointer to moal_private structure
+ *  @param wrq              A pointer to structure iwreq
+ *
+ *  @return                  0 --success, otherwise fail
+ */
+int woal_uap_set_get_multi_ap_mode(moal_private *priv, struct iwreq *wrq)
+{
+	int ret = 0;
+	int mode = 0;
+
+	ENTER();
+
+	if (wrq->u.data.length) {
+		if (wrq->u.data.length > 1) {
+			PRINTM(MERROR, "Invalid no of arguments!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (copy_from_user(&mode, wrq->u.data.pointer, sizeof(int))) {
+			PRINTM(MERROR, "copy from user failed\n");
+			ret = -EFAULT;
+			goto done;
+		}
+		if (mode == EASY_MESH_MULTI_AP_BSS_MODE_3)
+			/* Supports backhaul and fronthaul BSS */
+			priv->multi_ap_flag = EASY_MESH_MULTI_AP_BH_AND_FH_BSS;
+		else if (mode == EASY_MESH_MULTI_AP_BSS_MODE_2)
+			/* Supports backhaul BSS */
+			priv->multi_ap_flag = EASY_MESH_MULTI_AP_BH_BSS;
+		else if (mode == EASY_MESH_MULTI_AP_BSS_MODE_1)
+			/* Supports fronthaul BSS */
+			priv->multi_ap_flag = EASY_MESH_MULTI_AP_FH_BSS;
+	} else {
+		if (priv->multi_ap_flag == EASY_MESH_MULTI_AP_BH_AND_FH_BSS)
+			mode = EASY_MESH_MULTI_AP_BSS_MODE_3;
+		else if (priv->multi_ap_flag == EASY_MESH_MULTI_AP_BH_BSS)
+			mode = EASY_MESH_MULTI_AP_BSS_MODE_2;
+		else if (priv->multi_ap_flag == EASY_MESH_MULTI_AP_FH_BSS)
+			mode = EASY_MESH_MULTI_AP_BSS_MODE_1;
+		wrq->u.data.length = 1;
+		if (copy_to_user(wrq->u.data.pointer, &mode, sizeof(int)))
+			ret = -EFAULT;
+	}
+done:
+	LEAVE();
+	return ret;
+}
+#endif
+#endif
+
 /**
  *  @brief Set AP configuration
  *
@@ -4444,6 +4666,7 @@
 				PRINTM(MERROR,
 				       "Fail to set mac address after UAP_BSS_RESET\n");
 		}
+		woal_flush_tx_stat_queue(priv);
 		woal_flush_tcp_sess_queue(priv);
 	}
 done:
@@ -4484,13 +4707,14 @@
 {
 	int ret = 0;
 	ENTER();
-
+#if 0
 #ifdef CONFIG_COMPAT
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
 	if (in_compat_syscall()) /* not implemented yet */
 		return -EOPNOTSUPP;
 #endif
 #endif
+#endif
 
 	switch (cmd) {
 	case WOAL_ANDROID_DEF_CMD:
diff --git a/wlan_sd8987/mlinux/moal_uap.h b/wlan_src/mlinux/moal_uap.h
old mode 100755
new mode 100644
similarity index 87%
rename from wlan_sd8987/mlinux/moal_uap.h
rename to wlan_src/mlinux/moal_uap.h
index 8f5b699..011d56f
--- a/wlan_sd8987/mlinux/moal_uap.h
+++ b/wlan_src/mlinux/moal_uap.h
@@ -1,22 +1,30 @@
 /** @file moal_uap.h
  *
- * @brief This file contains uap driver specific defines etc.
+ * @brief This file contains wlan driver specific defines etc.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2009-2022, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -28,9 +36,6 @@
 #ifndef _MOAL_UAP_H
 #define _MOAL_UAP_H
 
-/** Maximum buffer length for WOAL_UAP_SET_GET_256_CHAR */
-#define MAX_BUF_LEN 256
-
 /** Private command ID to send ioctl */
 #define UAP_IOCTL_CMD (SIOCDEVPRIVATE + 2)
 /** Updating ADDBA variables */
@@ -91,6 +96,9 @@
 
 #define UAP_BEACON_STUCK_DETECT 25
 
+/** wacp_mode Config */
+#define UAP_WACP_MODE 26
+
 /** Private command ID to Power Mode */
 #define UAP_POWER_MODE (SIOCDEVPRIVATE + 3)
 
@@ -103,6 +111,11 @@
 /** BSS RESET */
 #define UAP_BSS_RESET 2
 
+/* HE MAC Capabilities Information field BIT 1 for TWT Req */
+#define HE_MAC_CAP_TWT_REQ_SUPPORT MBIT(1)
+/* HE MAC Capabilities Information field BIT 2 for TWT Resp*/
+#define HE_MAC_CAP_TWT_RESP_SUPPORT MBIT(2)
+
 /** wapi_msg */
 typedef struct _wapi_msg {
 	/** message type */
@@ -211,6 +224,19 @@
 	t_u8 bw;
 } skip_cac_para;
 
+typedef struct _wacp_mode_para {
+	/** Action */
+	t_u32 subcmd;
+	/** Action */
+	t_u32 action;
+	/** TLV type*/
+	t_u16 type;
+	/** TLV length */
+	t_u16 len;
+	/** wacp_mode */
+	t_u8 wacp_mode;
+} wacp_mode_para;
+
 /** radio control command */
 #define UAP_RADIO_CTL (SIOCDEVPRIVATE + 5)
 
@@ -546,6 +572,7 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 void woal_update_channels_dfs_state(moal_private *priv, t_u8 channel,
 				    t_u8 bandwidth, t_u8 dfs_state);
+void woal_update_uap_channel_dfs_state(moal_private *priv);
 #endif
 #endif
 
@@ -590,6 +617,12 @@
 				     wmm_parameter_t *ap_wmm_para);
 int woal_uap_set_ap_cfg(moal_private *priv, t_u8 *data, int len);
 
+#if defined(UAP_CFG80211)
+#if defined(STA_WEXT) || defined(UAP_WEXT)
+int woal_uap_set_get_multi_ap_mode(moal_private *priv, struct iwreq *wrq);
+#endif
+#endif
+
 int woal_uap_set_11ac_status(moal_private *priv, t_u8 action, t_u8 vht20_40,
 			     IEEEtypes_VHTCap_t *vhtcap_ie);
 int woal_11ax_cfg(moal_private *priv, t_u8 action, mlan_ds_11ax_he_cfg *he_cfg,
diff --git a/wlan_sd8987/mlinux/moal_uap_cfg80211.c b/wlan_src/mlinux/moal_uap_cfg80211.c
old mode 100755
new mode 100644
similarity index 83%
rename from wlan_sd8987/mlinux/moal_uap_cfg80211.c
rename to wlan_src/mlinux/moal_uap_cfg80211.c
index dac5fa7..a14ae64
--- a/wlan_sd8987/mlinux/moal_uap_cfg80211.c
+++ b/wlan_src/mlinux/moal_uap_cfg80211.c
@@ -3,20 +3,28 @@
  * @brief This file contains the functions for uAP CFG80211.
  *
  *
- * Copyright 2011-2022 NXP
+ * Copyright 2011-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -31,6 +39,7 @@
 /********************************************************
 				Global Variables
 ********************************************************/
+extern const struct net_device_ops woal_uap_netdev_ops;
 /********************************************************
 				Local Functions
 ********************************************************/
@@ -106,9 +115,18 @@
 		LEAVE();
 		return -EINVAL;
 	}
-
+#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
+	if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
+		cfg80211_del_sta(priv->netdev, mac_addr, GFP_KERNEL);
+#endif
+	if (priv->media_connected == MFALSE) {
+		PRINTM(MINFO, "cfg80211: Media not connected!\n");
+		LEAVE();
+		return 0;
+	}
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		LEAVE();
 		return -ENOMEM;
@@ -136,11 +154,6 @@
 			PRINTM(MMSG, "wlan: deauth station " MACSTR "\n",
 			       MAC2STR(mac_addr));
 			ret = woal_deauth_station(priv, mac_addr, reason_code);
-#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
-			if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
-				cfg80211_del_sta(priv->netdev, mac_addr,
-						 GFP_KERNEL);
-#endif
 			break;
 		}
 	}
@@ -178,7 +191,8 @@
 	PRINTM(MIOCTL, "del all station\n");
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -241,6 +255,9 @@
 		break;
 	}
 	count = woal_le16_to_cpu(rsn_ie->pairwise_cipher.count);
+	if (count < 1)
+		return MFALSE;
+
 	for (i = 0; i < count; i++) {
 		switch (rsn_ie->pairwise_cipher.list[i].type) {
 		case WPA_CIPHER_TKIP:
@@ -254,16 +271,16 @@
 			break;
 		}
 	}
-	left -= sizeof(IEEEtypes_Rsn_t) + (count - 1) * sizeof(wpa_suite);
-	if (left < (int)sizeof(wpa_suite_auth_key_mgmt_t))
+	left -= sizeof(IEEEtypes_Rsn_t) + (count) * sizeof(wpa_suite);
+	if (left <
+	    ((int)sizeof(wpa_suite_auth_key_mgmt_t) + (int)sizeof(wpa_suite)))
 		return MFALSE;
-	key_mgmt =
-		(wpa_suite_auth_key_mgmt_t *)((u8 *)rsn_ie +
-					      sizeof(IEEEtypes_Rsn_t) +
-					      (count - 1) * sizeof(wpa_suite));
+	key_mgmt = (wpa_suite_auth_key_mgmt_t *)((u8 *)rsn_ie +
+						 sizeof(IEEEtypes_Rsn_t) +
+						 (count) * sizeof(wpa_suite));
 	count = woal_le16_to_cpu(key_mgmt->count);
-	if (left < (int)(sizeof(wpa_suite_auth_key_mgmt_t) +
-			 (count - 1) * sizeof(wpa_suite)))
+	if (left < ((int)sizeof(wpa_suite_auth_key_mgmt_t) +
+		    (count) * (int)sizeof(wpa_suite)))
 		return MFALSE;
 	for (i = 0; i < count; i++) {
 		switch (key_mgmt->list[i].type) {
@@ -318,6 +335,9 @@
 		break;
 	}
 	count = woal_le16_to_cpu(wpa_ie->pairwise_cipher.count);
+	if (count < 1)
+		return MFALSE;
+
 	for (i = 0; i < count; i++) {
 		switch (wpa_ie->pairwise_cipher.list[i].type) {
 		case WPA_CIPHER_TKIP:
@@ -331,16 +351,16 @@
 			break;
 		}
 	}
-	left -= sizeof(IEEEtypes_Wpa_t) + (count - 1) * sizeof(wpa_suite);
-	if (left < (int)sizeof(wpa_suite_auth_key_mgmt_t))
+	left -= sizeof(IEEEtypes_Wpa_t) + (count) * sizeof(wpa_suite);
+	if (left <
+	    ((int)sizeof(wpa_suite_auth_key_mgmt_t) + (int)sizeof(wpa_suite)))
 		return MFALSE;
-	key_mgmt =
-		(wpa_suite_auth_key_mgmt_t *)((u8 *)wpa_ie +
-					      sizeof(IEEEtypes_Wpa_t) +
-					      (count - 1) * sizeof(wpa_suite));
+	key_mgmt = (wpa_suite_auth_key_mgmt_t *)((u8 *)wpa_ie +
+						 sizeof(IEEEtypes_Wpa_t) +
+						 (count) * sizeof(wpa_suite));
 	count = woal_le16_to_cpu(key_mgmt->count);
-	if (left < (int)(sizeof(wpa_suite_auth_key_mgmt_t) +
-			 (count - 1) * sizeof(wpa_suite)))
+	if (left < ((int)sizeof(wpa_suite_auth_key_mgmt_t) +
+		    (count) * (int)sizeof(wpa_suite)))
 		return MFALSE;
 	for (i = 0; i < count; i++) {
 		switch (key_mgmt->list[i].type) {
@@ -576,6 +596,11 @@
 	else
 		enable_11ax = MFALSE;
 #else
+	if (priv->phandle->params.auto_11ax == 0) {
+		PRINTM(MCMND, "auto_11ax is disabled\n");
+		LEAVE();
+		return enable_11ax;
+	}
 	memset(&he_cfg, 0, sizeof(he_cfg));
 	if (band == BAND_5GHZ)
 		he_cfg.band = MBIT(1);
@@ -597,6 +622,43 @@
 }
 #endif
 
+#if KERNEL_VERSION(4, 20, 0) <= CFG80211_VERSION_CODE
+/**
+ * @brief check channel width with HE capabilities
+ * @param priv            A pointer to moal private structure
+ * @param chandef         A pointer to cfg80211_chan_def structure
+ * @return                0 -- channel width supported, otherwise not supported
+ */
+static t_u8 woal_check_chan_width_capa(moal_private *priv,
+				       struct cfg80211_chan_def *chandef)
+{
+	mlan_fw_info fw_info;
+	mlan_ds_11ax_he_capa *phe_cap = NULL;
+	ENTER();
+	memset(&fw_info, 0, sizeof(mlan_fw_info));
+	woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info);
+	if (chandef->chan->band == NL80211_BAND_5GHZ) {
+		phe_cap = (mlan_ds_11ax_he_capa *)fw_info.hw_he_cap;
+		if (((chandef->width == NL80211_CHAN_WIDTH_160) &&
+		     (!(phe_cap->he_phy_cap[0] & MBIT(3)))) ||
+		    ((chandef->width == NL80211_CHAN_WIDTH_80P80) &&
+		     (!(phe_cap->he_phy_cap[0] & MBIT(4))))) {
+			PRINTM(MCMND, "FW don't support %s in %s band",
+			       (chandef->width == NL80211_CHAN_WIDTH_160) ?
+				       "160MHz" :
+				       "80+80 MHz",
+			       (chandef->chan->band == NL80211_BAND_5GHZ) ?
+				       "5G" :
+				       "6G");
+			LEAVE();
+			return MFALSE;
+		}
+	}
+	LEAVE();
+	return MTRUE;
+}
+#endif
+
 /**
  * @brief get ht_cap from beacon ie
  *
@@ -788,9 +850,12 @@
 	pIEEEtypes_Header_t ext_rate_ie;
 	int var_offset = offsetof(struct ieee80211_mgmt, u.beacon.variable);
 	const u8 *var_pos = head_ie + var_offset;
-	int len = head_len - var_offset;
+	int len = 0;
 	int rate_len = 0;
 
+	if (var_offset > head_len)
+		return;
+	len = head_len - var_offset;
 	rate_ie = (void *)woal_parse_ie_tlv(var_pos, len, WLAN_EID_SUPP_RATES);
 	if (rate_ie) {
 		memset(bss_cfg->rates, 0, sizeof(bss_cfg->rates));
@@ -872,6 +937,8 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
 	mlan_ds_11h_chan_nop_info chan_nop_info;
 #endif
+	t_u8 wpa3_sae = 0;
+	t_u8 *rsnx_ie = NULL;
 	ENTER();
 
 	if (!params) {
@@ -880,17 +947,16 @@
 	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
 	ie = ((struct cfg80211_ap_settings *)params)->beacon.tail;
-	ie_len = ((struct cfg80211_ap_settings *)params)->beacon.tail_len;
+	ie_len = (int)((struct cfg80211_ap_settings *)params)->beacon.tail_len;
 #else
 	ie = ((struct beacon_parameters *)params)->tail;
-	ie_len = ((struct beacon_parameters *)params)->tail_len;
+	ie_len = (int)((struct beacon_parameters *)params)->tail_len;
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
-	wapi_ie = (t_u8 *)woal_parse_ie_tlv(params->beacon.tail,
-					    params->beacon.tail_len, WAPI_IE);
+	wapi_ie =
+		(t_u8 *)woal_parse_ie_tlv(params->beacon.tail, ie_len, WAPI_IE);
 #else
-	wapi_ie = (t_u8 *)woal_parse_ie_tlv(params->tail, params->tail_len,
-					    WAPI_IE);
+	wapi_ie = (t_u8 *)woal_parse_ie_tlv(params->tail, ie_len, WAPI_IE);
 #endif
 	if (wapi_ie) {
 		wapi_ie_len = *(wapi_ie + 1) + 2;
@@ -973,6 +1039,13 @@
 			sizeof(struct cfg80211_chan_def), sizeof(priv->chan));
 #endif
 
+#if KERNEL_VERSION(4, 20, 0) <= CFG80211_VERSION_CODE
+	if (!woal_check_chan_width_capa(priv, &params->chandef)) {
+		ret = -EFAULT;
+		goto done;
+	}
+#endif
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
 	woal_convert_chan_to_bandconfig(priv, &bandcfg, &params->chandef);
 #endif
@@ -996,6 +1069,8 @@
 			       priv->channel, chan_nop_info.new_chan.channel);
 			priv->chan_under_nop = chan_nop_info.chan_under_nop;
 			priv->channel = chan_nop_info.new_chan.channel;
+			priv->bandwidth =
+				chan_nop_info.new_chan.bandcfg.chanWidth;
 			woal_chandef_create(priv, &priv->chan,
 					    &chan_nop_info.new_chan);
 		}
@@ -1220,8 +1295,43 @@
 		case WLAN_AKM_SUITE_PSK:
 			sys_config->key_mgmt |= KEY_MGMT_PSK;
 			break;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+		case WLAN_AKM_SUITE_SAE:
+		case WLAN_AKM_SUITE_FT_OVER_SAE:
+			wpa3_sae = MTRUE;
+			break;
+#endif
 		}
 	}
+	if (wpa3_sae) {
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+		rsnx_ie = (t_u8 *)woal_parse_ie_tlv(params->beacon.tail, ie_len,
+						    RSNX_IE);
+#else
+		rsnx_ie = (t_u8 *)woal_parse_ie_tlv(params->tail, ie_len,
+						    RSNX_IE);
+#endif
+		if (rsnx_ie)
+			sys_config->pwe_derivation = SAE_PWE_BOTH;
+		else
+			sys_config->pwe_derivation = SAE_PWE_HUNT_AND_PECK;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+		switch (params->crypto.sae_pwe) {
+		case NL80211_SAE_PWE_HUNT_AND_PECK:
+			sys_config->pwe_derivation = SAE_PWE_HUNT_AND_PECK;
+			break;
+		case NL80211_SAE_PWE_HASH_TO_ELEMENT:
+			sys_config->pwe_derivation = SAE_PWE_HASH_TO_ELEMENT;
+			break;
+		case NL80211_SAE_PWE_BOTH:
+			sys_config->pwe_derivation = SAE_PWE_BOTH;
+			break;
+		default:
+			break;
+		}
+#endif
+	}
+
 	sys_config->wpa_cfg.pairwise_cipher_wpa = 0;
 	sys_config->wpa_cfg.pairwise_cipher_wpa2 = 0;
 	for (i = 0; i < params->crypto.n_ciphers_pairwise; i++) {
@@ -1357,12 +1467,23 @@
 		/*find and set wmm ie*/
 		woal_set_wmm_ies(priv, ie, ie_len, sys_config);
 	}
-	/* If the security mode is configured as WEP or WPA-PSK,
-	 * it will disable 11n automatically, and if configured as
-	 * open(off) or wpa2-psk, it will automatically enable 11n */
-	if ((sys_config->protocol == PROTOCOL_STATIC_WEP) ||
-	    (sys_config->protocol == PROTOCOL_WPA))
+
+	/** If the security mode is configured as WEP or
+	 * WPA/WPA2 with TKIP only, disable 11n*/
+	if (sys_config->protocol == PROTOCOL_STATIC_WEP)
 		enable_11n = MFALSE;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+	else if (sys_config->protocol & (PROTOCOL_WPA | PROTOCOL_WPA2)) {
+		if ((params->crypto.wpa_versions & NL80211_WPA_VERSION_1) &&
+		    sys_config->wpa_cfg.pairwise_cipher_wpa == CIPHER_TKIP)
+			enable_11n = MFALSE;
+
+		if ((params->crypto.wpa_versions & NL80211_WPA_VERSION_2) &&
+		    sys_config->wpa_cfg.pairwise_cipher_wpa2 == CIPHER_TKIP)
+			enable_11n = MFALSE;
+	}
+#endif
+
 	if (!enable_11n) {
 		if (woal_set_uap_ht_tx_cfg(priv, sys_config->bandcfg, ht_cap,
 					   MFALSE)) {
@@ -1394,10 +1515,15 @@
 		woal_uap_set_11ac_status(priv, MLAN_ACT_DISABLE, vht20_40,
 					 NULL);
 	}
-	if (enable_11ax && enable_11n) {
+	if (enable_11ax) {
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 		hecap_ie = (IEEEtypes_HECap_t *)woal_parse_ext_ie_tlv(
 			ie, ie_len, HE_CAPABILITY);
+#if CFG80211_VERSION_CODE > KERNEL_VERSION(5, 3, 0)
+		if (params->twt_responder == MFALSE) {
+			hecap_ie->he_mac_cap[0] &= ~HE_MAC_CAP_TWT_RESP_SUPPORT;
+		}
+#endif
 #endif
 		woal_uap_set_11ax_status(priv, MLAN_ACT_ENABLE,
 					 sys_config->bandcfg.chanBand,
@@ -1417,6 +1543,11 @@
 	       sys_config->sta_ageout_timer, sys_config->ps_sta_ageout_timer);
 #endif
 
+	if (priv->multi_ap_flag) {
+		sys_config->multi_ap_flag = priv->multi_ap_flag;
+		PRINTM(MINFO, "%s: multi_ap_flag is 0x%x\n", __func__,
+		       sys_config->multi_ap_flag);
+	}
 	if (MLAN_STATUS_SUCCESS != woal_set_get_sys_config(priv, MLAN_ACT_SET,
 							   MOAL_IOCTL_WAIT,
 							   sys_config)) {
@@ -1548,7 +1679,7 @@
 		chan_info.channel = 1;
 		chan_info.is_11n_enabled = MTRUE;
 	}
-	mon_if->flag = 0x7;
+	mon_if->flag = handle->params.mon_filter;
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_set_net_monitor(priv, MOAL_IOCTL_WAIT, MTRUE, mon_if->flag,
 				 &mon_if->band_chan_cfg)) {
@@ -1579,7 +1710,12 @@
 	}
 #endif
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	ret = cfg80211_register_netdevice(ndev);
+#else
 	ret = register_netdevice(ndev);
+#endif
+
 	if (ret) {
 		PRINTM(MFATAL, "register net_device failed, ret=%d\n", ret);
 		free_netdev(ndev);
@@ -1596,6 +1732,199 @@
 	return ret;
 }
 
+/**
+ *  @brief This function setup the multi-ap virtual interface
+ *
+ *  @param dev    A pointer to structure net_device
+ *
+ *  @return       N/A
+ */
+static void woal_vlan_virt_if_setup(struct net_device *dev)
+{
+	ENTER();
+	ether_setup(dev);
+	dev->netdev_ops = &woal_uap_netdev_ops;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 11, 9)
+	dev->needs_free_netdev = true;
+#else
+	dev->destructor = free_netdev;
+#endif
+	LEAVE();
+}
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+/**
+ * @brief Request the driver to add a multi-ap virtual interface
+ *
+ * @param wiphy             A pointer to wiphy structure
+ * @param name              Virtual interface name
+ * @param name_assign_type  Interface name assignment type
+ * @param flags             Flags for the virtual interface
+ * @param params            A pointer to vif_params structure
+ * @param new_dev		    new net_device to return
+ *
+ * @return                  0 -- success, otherwise fail
+ */
+static int woal_cfg80211_add_vlan_vir_if(struct wiphy *wiphy, const char *name,
+					 unsigned char name_assign_type,
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(4, 12, 0)
+					 u32 *flags,
+#endif
+					 struct vif_params *params,
+					 struct net_device **new_dev)
+#else
+/**
+ * @brief Request the driver to add a multi-ap virtual interface
+ *
+ * @param wiphy           A pointer to wiphy structure
+ * @param name            Virtual interface name
+ * @param flags           Flags for the virtual interface
+ * @param params          A pointer to vif_params structure
+ * @param new_dev		  new net_device to return
+ *
+ * @return                0 -- success, otherwise fail
+ */
+static int woal_cfg80211_add_vlan_vir_if(struct wiphy *wiphy,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 7, 0)
+					 const
+#endif
+					 char *name,
+					 u32 *flags, struct vif_params *params,
+					 struct net_device **new_dev)
+#endif
+{
+	int ret = 0;
+	moal_handle *handle = (moal_handle *)woal_get_wiphy_priv(wiphy);
+	moal_private *priv =
+		(moal_private *)woal_get_priv(handle, MLAN_BSS_ROLE_UAP);
+	moal_private *new_priv = NULL;
+	struct net_device *ndev = NULL;
+
+	ENTER();
+	if (!priv) {
+		PRINTM(MFATAL, "Error:woal_get_priv returned NULL\n");
+		ret = -EFAULT;
+		goto fail;
+	}
+	ASSERT_RTNL();
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+#ifndef MAX_WMM_QUEUE
+#define MAX_WMM_QUEUE 4
+#endif
+#endif
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+	ndev = alloc_netdev_mq(sizeof(moal_private), name, name_assign_type,
+			       woal_vlan_virt_if_setup, 1);
+#else
+	ndev = alloc_netdev_mq(sizeof(moal_private), name, NET_NAME_UNKNOWN,
+			       woal_vlan_virt_if_setup, 1);
+#endif
+#else
+	ndev = alloc_netdev_mq(sizeof(moal_private), name,
+			       woal_vlan_virt_if_setup, 1);
+#endif
+#else
+	ndev = alloc_netdev_mq(sizeof(moal_private), name,
+			       woal_vlan_virt_if_setup);
+#endif
+	if (!ndev) {
+		PRINTM(MFATAL, "Init virtual ethernet device failed\n");
+		ret = -EFAULT;
+		goto fail;
+	}
+
+	ret = dev_alloc_name(ndev, ndev->name);
+	if (ret < 0) {
+		PRINTM(MFATAL, "Net device alloc name fail.\n");
+		ret = -EFAULT;
+		goto fail;
+	}
+
+	dev_net_set(ndev, wiphy_net(wiphy));
+
+	moal_memcpy_ext(handle, ndev->perm_addr, wiphy->perm_addr, ETH_ALEN,
+			sizeof(ndev->perm_addr));
+	moal_memcpy_ext(handle, ndev->perm_addr, priv->current_addr, ETH_ALEN,
+			sizeof(ndev->perm_addr));
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0)
+	eth_hw_addr_set(ndev, priv->current_addr);
+#else
+	moal_memcpy_ext(handle, (t_void *)ndev->dev_addr, ndev->perm_addr,
+			ETH_ALEN, MAX_ADDR_LEN);
+#endif
+
+	SET_NETDEV_DEV(ndev, wiphy_dev(wiphy));
+	ndev->watchdog_timeo = MRVDRV_DEFAULT_UAP_WATCHDOG_TIMEOUT;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
+	ndev->needed_headroom += MLAN_MIN_DATA_HEADER_LEN +
+				 sizeof(mlan_buffer) + priv->extra_tx_head_len;
+#else
+	ndev->hard_header_len += MLAN_MIN_DATA_HEADER_LEN +
+				 sizeof(mlan_buffer) + priv->extra_tx_head_len;
+#endif
+
+	ndev->flags |= IFF_BROADCAST | IFF_MULTICAST;
+
+	new_priv = netdev_priv(ndev);
+
+	ndev->ieee80211_ptr = &new_priv->w_dev;
+
+	new_priv->wdev = &new_priv->w_dev;
+	new_priv->netdev = ndev;
+	new_priv->extra_tx_head_len = priv->extra_tx_head_len;
+
+	moal_memcpy_ext(priv->phandle, new_priv->current_addr,
+			priv->current_addr, ETH_ALEN, ETH_ALEN);
+
+	new_priv->phandle = handle;
+	new_priv->wdev->wiphy = handle->wiphy;
+	new_priv->bss_type = MLAN_BSS_TYPE_UAP;
+	new_priv->bss_role = MLAN_BSS_ROLE_UAP;
+	new_priv->bss_index = priv->bss_index;
+	new_priv->parent_priv = priv;
+	new_priv->wdev->iftype = NL80211_IFTYPE_AP_VLAN;
+	new_priv->max_tx_pending = MAX_TX_PENDING;
+	new_priv->low_tx_pending = LOW_TX_PENDING;
+	skb_queue_head_init(&new_priv->tx_q);
+
+	ndev->ieee80211_ptr->use_4addr = params->use_4addr;
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	ret = cfg80211_register_netdevice(ndev);
+#else
+	ret = register_netdevice(ndev);
+#endif
+	if (ret) {
+		PRINTM(MFATAL, "register net_device failed, ret=%d\n", ret);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		cfg80211_unregister_netdevice(ndev);
+#else
+		unregister_netdevice(ndev);
+#endif
+		free_netdev(ndev);
+		goto fail;
+	}
+
+	if (new_dev)
+		*new_dev = ndev;
+
+	if (ndev->ieee80211_ptr->use_4addr && !priv->multi_ap_flag) {
+		/* Supports backhaul and fronthaul BSS and enable four_address
+		 * flag */
+		if (MLAN_STATUS_SUCCESS ==
+		    woal_multi_ap_cfg(priv, MOAL_IOCTL_WAIT,
+				      EASY_MESH_MULTI_AP_BH_AND_FH_BSS)) {
+			priv->multi_ap_flag = EASY_MESH_MULTI_AP_BH_AND_FH_BSS;
+		}
+	}
+
+fail:
+	LEAVE();
+	return ret;
+}
+
 #ifdef WIFI_DIRECT_SUPPORT
 #if CFG80211_VERSION_CODE >= WIFI_DIRECT_KERNEL_VERSION
 /**
@@ -1706,6 +2035,15 @@
 	INIT_LIST_HEAD(&priv->mcast_list);
 	spin_lock_init(&priv->mcast_lock);
 
+#ifdef STA_CFG80211
+	INIT_LIST_HEAD(&priv->dhcp_discover_queue);
+	spin_lock_init(&priv->dhcp_discover_lock);
+#endif
+
+#ifdef STA_CFG80211
+	INIT_LIST_HEAD(&priv->ipv6_addrses);
+	spin_lock_init(&priv->ipv6addr_lock);
+#endif
 	spin_lock_init(&priv->connect_lock);
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
@@ -1860,10 +2198,13 @@
 	/* Initialize priv structure */
 	woal_init_priv(new_priv, MOAL_IOCTL_WAIT);
 	/** Init to GO/CLIENT mode */
-	if (type == NL80211_IFTYPE_P2P_CLIENT)
-		woal_cfg80211_init_p2p_client(new_priv);
-	else if (type == NL80211_IFTYPE_P2P_GO)
-		woal_cfg80211_init_p2p_go(new_priv);
+	if (type == NL80211_IFTYPE_P2P_CLIENT) {
+		if (woal_cfg80211_init_p2p_client(new_priv))
+			PRINTM(MERROR, "%s: Fail to init p2p go", __func__);
+	} else if (type == NL80211_IFTYPE_P2P_GO) {
+		if (woal_cfg80211_init_p2p_go(new_priv))
+			PRINTM(MERROR, "%s: Fail to init p2p client", __func__);
+	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
 	ret = cfg80211_register_netdevice(ndev);
 #else
@@ -2083,6 +2424,8 @@
 	moal_private *priv = NULL;
 	int vir_intf = 0;
 	int i = 0;
+	moal_handle *ref_handle = NULL;
+	int ref_vir_intf = 0;
 #endif
 	ENTER();
 	rtnl_lock();
@@ -2112,6 +2455,38 @@
 			}
 		}
 	}
+	if (handle->pref_mac) {
+		ref_handle = (moal_handle *)handle->pref_mac;
+		for (i = 0; i < ref_handle->priv_num; i++) {
+			priv = ref_handle->priv[i];
+			if (priv) {
+				if (priv->bss_virtual &&
+				    priv->wdev->wiphy == handle->wiphy) {
+					PRINTM(MCMND,
+					       "Remove virtual interfaces from pref mac %s\n",
+					       priv->netdev->name);
+#ifdef CONFIG_PROC_FS
+					/* Remove proc debug */
+					woal_debug_remove(priv);
+					woal_proc_remove(priv);
+#endif /* CONFIG_PROC_FS */
+					netif_device_detach(priv->netdev);
+					if (priv->netdev->reg_state ==
+					    NETREG_REGISTERED)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+						cfg80211_unregister_netdevice(
+							priv->netdev);
+#else
+						unregister_netdevice(
+							priv->netdev);
+#endif
+					ref_handle->priv[i] = NULL;
+					ref_vir_intf++;
+				}
+			}
+		}
+		ref_handle->priv_num -= ref_vir_intf;
+	}
 #endif
 	if (handle->mon_if) {
 		netif_device_detach(handle->mon_if->mon_ndev);
@@ -2275,6 +2650,20 @@
 			ret = -EFAULT;
 		}
 		break;
+	case NL80211_IFTYPE_AP_VLAN:
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(4, 12, 0)
+		ret = woal_cfg80211_add_vlan_vir_if(
+			wiphy, name, name_assign_type, flags, params, &ndev);
+#else
+		ret = woal_cfg80211_add_vlan_vir_if(
+			wiphy, name, name_assign_type, params, &ndev);
+#endif
+#else
+		ret = woal_cfg80211_add_vlan_vir_if(wiphy, name, flags, params,
+						    &ndev);
+#endif
+		break;
 	default:
 		PRINTM(MWARN, "Not supported if type: %d\n", type);
 		ret = -EFAULT;
@@ -2331,6 +2720,10 @@
 	struct net_device *dev = wdev->netdev;
 #endif
 
+	moal_private *vlan_priv = NULL;
+	station_node *vlan_sta_list = NULL;
+	t_u16 aid = 0;
+
 	ENTER();
 
 	PRINTM(MIOCTL, "del virtual intf %s\n", dev->name);
@@ -2355,6 +2748,33 @@
 		return ret;
 	}
 
+#ifdef UAP_SUPPORT
+	/**
+	 * For multi-ap virtual interface, unregister netdevice
+	 * directly for now. Will add more in the future.
+	 */
+	if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP_VLAN) {
+		/* stop network before doing cleanup */
+		if (netif_carrier_ok(dev))
+			netif_carrier_off(dev);
+		vlan_priv = (moal_private *)netdev_priv(dev);
+		aid = vlan_priv->vlan_sta_ptr->aid;
+		PRINTM(MCMND, "wlan: Easymesh del Vlan aid=%d\n", aid);
+		vlan_sta_list =
+			vlan_priv->parent_priv
+				->vlan_sta_list[(aid - 1) % MAX_STA_COUNT];
+		if (vlan_sta_list)
+			vlan_sta_list->is_valid = MFALSE;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		cfg80211_unregister_netdevice(dev);
+#else
+		unregister_netdevice(dev);
+#endif
+		LEAVE();
+		return ret;
+	}
+#endif
+
 	if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
 		for (i = 0; i < handle->priv_num; i++) {
 			vir_priv = handle->priv[i];
@@ -2368,7 +2788,8 @@
 			}
 		}
 		if (vir_priv && vir_priv->bss_type == MLAN_BSS_TYPE_UAP) {
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			if (woal_cfg80211_del_beacon(wiphy, dev, 0))
 #else
 			if (woal_cfg80211_del_beacon(wiphy, dev))
@@ -2376,13 +2797,15 @@
 				PRINTM(MERROR, "%s: del_beacon failed\n",
 				       __func__);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			vir_priv->wdev->links[0].ap.beacon_interval = 0;
 #else
 			vir_priv->wdev->beacon_interval = 0;
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			memset(&vir_priv->wdev->links[0].ap.chandef, 0,
 			       sizeof(vir_priv->wdev->links[0].ap.chandef));
 #else
@@ -2391,7 +2814,8 @@
 #endif
 #endif
 #endif
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 			vir_priv->wdev->u.ap.ssid_len = 0;
 #else
 			vir_priv->wdev->ssid_len = 0;
@@ -2445,7 +2869,7 @@
 
 	ENTER();
 
-	PRINTM(MMSG, "wlan: Starting AP\n");
+	PRINTM(MMSG, "wlan: %s Starting AP\n", dev->name);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
 	/* cancel previous remain on channel to avoid firmware hang */
 	if (priv->phandle->remain_on_channel) {
@@ -2495,6 +2919,7 @@
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	priv->channel = ieee80211_frequency_to_channel(
 		params->chandef.chan->center_freq);
+	priv->bandwidth = params->chandef.width;
 #else
 	priv->channel =
 		ieee80211_frequency_to_channel(params->channel->center_freq);
@@ -2577,13 +3002,24 @@
 			goto done;
 		}
 	}
-	PRINTM(MMSG, "wlan: AP started\n");
+	PRINTM(MMSG, "wlan: %s AP started\n", dev->name);
 done:
 	LEAVE();
 	return ret;
 }
 
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+/**
+ * @brief set AP or GO parameter
+ *
+ * @param wiphy           A pointer to wiphy structure
+ * @param dev             A pointer to net_device structure
+ * @param info            A pointer to cfg80211_ap_update structure
+ * @return                0 -- success, otherwise fail
+ */
+int woal_cfg80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
+			     struct cfg80211_ap_update *info)
+#elif CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
 /**
  * @brief set AP or GO parameter
  *
@@ -2608,6 +3044,9 @@
 #endif
 {
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+	struct cfg80211_beacon_data *params = &info->beacon;
+#endif
 	int ret = 0;
 
 	ENTER();
@@ -2670,7 +3109,8 @@
  *
  * @return                0 -- success, otherwise fail
  */
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                    \
+     (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
 int woal_cfg80211_del_beacon(struct wiphy *wiphy, struct net_device *dev,
 			     unsigned int link_id)
 #else
@@ -2682,17 +3122,26 @@
 #ifdef STA_SUPPORT
 	moal_private *pmpriv = NULL;
 #endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)
+	moal_private *dfs_priv =
+		woal_get_priv_bss_type(priv->phandle, MLAN_BSS_TYPE_DFS);
+#endif
 
 	ENTER();
 
-	if (priv->phandle->driver_status) {
+	if (priv->phandle->driver_status || priv->phandle->surprise_removed) {
 		PRINTM(MERROR,
 		       "Block  woal_cfg80211_del_beacon in abnormal driver state\n");
 		LEAVE();
 		return ret;
 	}
+#ifdef UAP_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+	woal_update_uap_channel_dfs_state(priv);
+#endif
+#endif
 	priv->uap_host_based = MFALSE;
-	PRINTM(MMSG, "wlan: Stoping AP\n");
+	PRINTM(MMSG, "wlan: %s Stopping AP\n", dev->name);
 #ifdef STA_SUPPORT
 	woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
 #endif
@@ -2702,6 +3151,21 @@
 	if (moal_extflg_isset(priv->phandle, EXT_DFS_OFFLOAD))
 		woal_cancel_cac_block(priv);
 #endif
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)
+	if (dfs_priv && dfs_priv->radar_background) {
+		PRINTM(MMSG, "Cancel background radar detection\n");
+		woal_11h_cancel_chan_report_ioctl(dfs_priv, MOAL_IOCTL_WAIT);
+		dfs_priv->chan_rpt_pending = MFALSE;
+		dfs_priv->radar_background = MFALSE;
+		woal_update_channels_dfs_state(
+			dfs_priv, dfs_priv->chan_rpt_req.chanNum,
+			dfs_priv->chan_rpt_req.bandcfg.chanWidth, DFS_USABLE);
+		memset(&dfs_priv->chan_rpt_req, 0,
+		       sizeof(mlan_ds_11h_chan_rep_req));
+		cfg80211_background_cac_abort(priv->phandle->wiphy);
+	}
+#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
 	memset(&priv->chan, 0, sizeof(struct cfg80211_chan_def));
 	if (priv->phandle->is_cac_timer_set &&
@@ -2730,19 +3194,16 @@
 	if (priv->bss_started == MTRUE) {
 		if (woal_uap_bss_ctrl(priv, MOAL_NO_WAIT, UAP_BSS_STOP)) {
 			PRINTM(MERROR, "%s: stop uap failed \n", __func__);
-			ret = -EFAULT;
 			goto done;
 		}
 		if (woal_uap_bss_ctrl(priv, MOAL_NO_WAIT, UAP_BSS_RESET)) {
 			PRINTM(MERROR, "%s: reset uap failed \n", __func__);
-			ret = -EFAULT;
 			goto done;
 		}
 		/* Set WLAN MAC addresses */
 		if (MLAN_STATUS_FAILURE ==
 		    woal_request_set_mac_address(priv, MOAL_NO_WAIT)) {
 			PRINTM(MERROR, "Set MAC address failed\n");
-			ret = -EFAULT;
 			goto done;
 		}
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(4, 20, 0)
@@ -2754,17 +3215,20 @@
 	if (!woal_is_any_interface_active(priv->phandle)) {
 		pmpriv = woal_get_priv((moal_handle *)priv->phandle,
 				       MLAN_BSS_ROLE_STA);
-		if (pmpriv)
+		if (pmpriv && !priv->phandle->user_scan_cfg) {
 			woal_set_scan_time(pmpriv, ACTIVE_SCAN_CHAN_TIME,
 					   PASSIVE_SCAN_CHAN_TIME,
 					   SPECIFIC_SCAN_CHAN_TIME);
+		}
 	}
 #endif
-
 	priv->cipher = 0;
 	memset(priv->uap_wep_key, 0, sizeof(priv->uap_wep_key));
 	priv->channel = 0;
-	PRINTM(MMSG, "wlan: AP stopped\n");
+	priv->bandwidth = 0;
+	priv->multi_ap_flag = 0;
+
+	PRINTM(MMSG, "wlan: %s AP stopped\n", dev->name);
 done:
 	LEAVE();
 	return ret;
@@ -2829,12 +3293,14 @@
 				PRINTM(MERROR, "%s: stop uap failed \n",
 				       __func__);
 		}
+
 		if (params->use_short_preamble == 1)
 			sys_config->preamble_type = 1;
 		else if (params->use_short_preamble == 0)
 			sys_config->preamble_type = 2;
 		else
 			sys_config->preamble_type = 0;
+
 		if (MLAN_STATUS_SUCCESS ==
 		    woal_set_get_sys_config(priv, MLAN_ACT_SET, MOAL_IOCTL_WAIT,
 					    sys_config))
@@ -2890,6 +3356,11 @@
 #endif
 	u16 reason_code = REASON_CODE_DEAUTH_LEAVING;
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	int i;
+#endif
+#endif
 	ENTER();
 
 #ifdef UAP_SUPPORT
@@ -2900,12 +3371,6 @@
 	}
 #endif
 
-	if (priv->media_connected == MFALSE) {
-		PRINTM(MINFO, "cfg80211: Media not connected!\n");
-		LEAVE();
-		return 0;
-	}
-
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
 	if (param) {
 		mac_addr = param->mac;
@@ -2927,6 +3392,25 @@
 	} else {
 		PRINTM(MIOCTL, "del station\n");
 	}
+
+#ifdef UAP_SUPPORT
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+	if (mac_addr) {
+		for (i = 0; i < MAX_STA_COUNT; i++) {
+			if (priv->vlan_sta_list[i] &&
+			    !moal_memcmp(priv->phandle,
+					 priv->vlan_sta_list[i]->peer_mac,
+					 (u8 *)mac_addr,
+					 MLAN_MAC_ADDR_LENGTH)) {
+				kfree(priv->vlan_sta_list[i]);
+				priv->vlan_sta_list[i] = NULL;
+				break;
+			}
+		}
+	}
+#endif
+#endif
+
 	LEAVE();
 	return 0;
 }
@@ -2966,7 +3450,8 @@
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -3065,7 +3550,8 @@
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -3297,6 +3783,9 @@
 		woal_11h_cancel_chan_report_ioctl(priv, MOAL_IOCTL_WAIT);
 		priv->chan_rpt_pending = MFALSE;
 		priv->radar_background = MFALSE;
+		woal_update_channels_dfs_state(
+			priv, priv->chan_rpt_req.chanNum,
+			priv->chan_rpt_req.bandcfg.chanWidth, DFS_USABLE);
 		memset(&priv->chan_rpt_req, 0,
 		       sizeof(mlan_ds_11h_chan_rep_req));
 		LEAVE();
@@ -3328,20 +3817,7 @@
 	}
 	chan_rpt_req.startFreq = START_FREQ_11A_BAND;
 	chan_rpt_req.chanNum = (t_u8)chandef->chan->hw_value;
-	chan_rpt_req.bandcfg.chanBand = BAND_5GHZ;
-	switch (chandef->width) {
-	case NL80211_CHAN_WIDTH_40:
-		chan_rpt_req.bandcfg.chanWidth = CHAN_BW_40MHZ;
-		break;
-	case NL80211_CHAN_WIDTH_80:
-		chan_rpt_req.bandcfg.chanWidth = CHAN_BW_80MHZ;
-		break;
-	case NL80211_CHAN_WIDTH_20:
-	case NL80211_CHAN_WIDTH_20_NOHT:
-	default:
-		chan_rpt_req.bandcfg.chanWidth = CHAN_BW_20MHZ;
-		break;
-	}
+	woal_convert_chan_to_bandconfig(priv, &chan_rpt_req.bandcfg, chandef);
 	chan_rpt_req.millisec_dwell_time = cac_time_ms;
 	chan_rpt_req.host_based = MTRUE;
 	moal_memcpy_ext(priv->phandle, &priv->chan_rpt_req, &chan_rpt_req,
@@ -3405,6 +3881,10 @@
 static void woal_switch_uap_channel(moal_private *priv, t_u8 wait_option)
 {
 	chan_band_info uap_channel;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+	struct cfg80211_ap_update *info = container_of(
+		&priv->beacon_after, struct cfg80211_ap_update, beacon);
+#endif
 	t_u8 chan2Offset = SEC_CHAN_NONE;
 	ENTER();
 	woal_clear_all_mgmt_ies(priv, MOAL_IOCTL_WAIT);
@@ -3412,8 +3892,13 @@
 		PRINTM(MERROR, "%s: stop uap failed \n", __func__);
 		goto done;
 	}
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+	if (woal_cfg80211_set_beacon(priv->wdev->wiphy, priv->netdev, info)) {
+#else
 	if (woal_cfg80211_set_beacon(priv->wdev->wiphy, priv->netdev,
 				     &priv->beacon_after)) {
+#endif
 		PRINTM(MERROR, "%s: set mgmt ies failed \n", __func__);
 		goto done;
 	}
@@ -3464,13 +3949,24 @@
 	}
 	PRINTM(MMSG, "CSA: old chan %d => new chan %d \n", priv->channel,
 	       uap_channel.channel);
+	PRINTM(MMSG, "CSA: old BW %d => new BW %d \n", priv->bandwidth,
+	       uap_channel.bandcfg.chanWidth);
 	priv->channel = uap_channel.channel;
+	priv->bandwidth = uap_channel.bandcfg.chanWidth;
 	moal_memcpy_ext(priv->phandle, &priv->chan, &priv->csa_chan,
 			sizeof(struct cfg80211_chan_def), sizeof(priv->chan));
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 3, 0) &&                        \
+	CFG80211_VERSION_CODE < KERNEL_VERSION(6, 9, 0)
 	cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0, 0);
+#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 1, 0) &&                    \
+	(defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 33))) &&       \
+	CFG80211_VERSION_CODE < KERNEL_VERSION(6, 9, 0)
+	cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0, 0);
+#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) ||                  \
+       (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 31))
+cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0);
 #else
-	cfg80211_ch_switch_notify(priv->netdev, &priv->chan);
+cfg80211_ch_switch_notify(priv->netdev, &priv->chan);
 #endif
 	if (priv->uap_tx_blocked) {
 		if (!netif_carrier_ok(priv->netdev))
@@ -3571,7 +4067,7 @@
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	chan_band_info channel;
 	t_u16 enable = 0;
-
+	t_u8 event_buf[64] = {0};
 	ENTER();
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
@@ -3593,21 +4089,28 @@
 		ret = -EBUSY;
 		goto done;
 	}
-	if (MLAN_STATUS_SUCCESS ==
-	    woal_mc_policy_cfg(priv, &enable, MOAL_IOCTL_WAIT, MLAN_ACT_GET)) {
-		if (enable) {
-			if (MLAN_STATUS_SUCCESS ==
-			    woal_get_active_intf_channel(priv, &channel)) {
-				if (channel.channel !=
-				    chandef->chan->hw_value) {
-					PRINTM(MERROR,
-					       "DFS channel is not allowed when another connection exists on different channel\n");
-					PRINTM(MERROR,
-					       "Another connection's channel=%d, dfs channel=%d\n",
-					       channel.channel,
-					       chandef->chan->hw_value);
-					ret = -EINVAL;
-					goto done;
+	snprintf(event_buf, sizeof(event_buf) - 1, "%s %d", CUS_EVT_CAC_START,
+		 chandef->chan->hw_value);
+	woal_broadcast_event(priv, event_buf, strlen(event_buf));
+	if (priv->phandle->card_info->drcs) {
+		if (MLAN_STATUS_SUCCESS == woal_mc_policy_cfg(priv, &enable,
+							      MOAL_IOCTL_WAIT,
+							      MLAN_ACT_GET)) {
+			if (enable) {
+				if (MLAN_STATUS_SUCCESS ==
+				    woal_get_active_intf_channel(priv,
+								 &channel)) {
+					if (channel.channel !=
+					    chandef->chan->hw_value) {
+						PRINTM(MERROR,
+						       "DFS channel is not allowed when another connection exists on different channel\n");
+						PRINTM(MERROR,
+						       "Another connection's channel=%d, dfs channel=%d\n",
+						       channel.channel,
+						       chandef->chan->hw_value);
+						ret = -EINVAL;
+						goto done;
+					}
 				}
 			}
 		}
@@ -3697,6 +4200,10 @@
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 	t_u32 chsw_msec;
 	mlan_uap_bss_param *bss_cfg = NULL;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+	struct cfg80211_ap_update *info = container_of(
+		&params->beacon_csa, struct cfg80211_ap_update, beacon);
+#endif
 
 	ENTER();
 
@@ -3732,7 +4239,11 @@
 	}
 
 	woal_clear_all_mgmt_ies(priv, MOAL_IOCTL_WAIT);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
+	if (woal_cfg80211_set_beacon(wiphy, dev, info)) {
+#else
 	if (woal_cfg80211_set_beacon(wiphy, dev, &params->beacon_csa)) {
+#endif
 		PRINTM(MERROR, "%s: setting csa mgmt ies failed\n", __func__);
 		goto done;
 	}
diff --git a/wlan_src/mlinux/moal_uap_cfg80211.h b/wlan_src/mlinux/moal_uap_cfg80211.h
new file mode 100644
index 0000000..e721e61
--- /dev/null
+++ b/wlan_src/mlinux/moal_uap_cfg80211.h
@@ -0,0 +1,45 @@
+/** @file moal_uap_cfg80211.h
+ *
+ * @brief This file contains the uAP CFG80211 specific defines.
+ *
+ *
+ * Copyright 2011-2021, 2024 NXP
+ *
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
+ *
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ */
+
+#ifndef _MOAL_UAP_CFG80211_H_
+#define _MOAL_UAP_CFG80211_H_
+
+#include "moal_uap.h"
+
+mlan_status woal_register_uap_cfg80211(struct net_device *dev, t_u8 bss_type);
+
+#ifdef UAP_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)
+int woal_cfg80211_set_radar_background(struct wiphy *wiphy,
+				       struct cfg80211_chan_def *chandef);
+#endif
+#endif
+
+#endif /* _MOAL_UAP_CFG80211_H_ */
diff --git a/wlan_sd8987/mlinux/moal_uap_priv.c b/wlan_src/mlinux/moal_uap_priv.c
old mode 100755
new mode 100644
similarity index 72%
rename from wlan_sd8987/mlinux/moal_uap_priv.c
rename to wlan_src/mlinux/moal_uap_priv.c
index b28e0db..77a006d
--- a/wlan_sd8987/mlinux/moal_uap_priv.c
+++ b/wlan_src/mlinux/moal_uap_priv.c
@@ -1,22 +1,30 @@
 /** @file  moal_uap_priv.c
  *
- * @brief This file contains standard ioctl functions
+ * @brief This file contains wireless extension standard ioctl functions
  *
  *
  * Copyright 2010-2021 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -120,6 +128,16 @@
 			break;
 #endif
 #endif
+#if defined(UAP_CFG80211)
+#if defined(STA_WEXT) || defined(UAP_WEXT)
+		case WOAL_UAP_SET_MODE:
+			PRINTM(MINFO,
+			       "%s: setting multi_ap flag through user command\n",
+			       __func__);
+			ret = woal_uap_set_get_multi_ap_mode(priv, wrq);
+			break;
+#endif
+#endif
 		default:
 			ret = -EINVAL;
 			break;
diff --git a/wlan_sd8987/mlinux/moal_uap_priv.h b/wlan_src/mlinux/moal_uap_priv.h
old mode 100755
new mode 100644
similarity index 62%
rename from wlan_sd8987/mlinux/moal_uap_priv.h
rename to wlan_src/mlinux/moal_uap_priv.h
index 4eab2f5..8ff0556
--- a/wlan_sd8987/mlinux/moal_uap_priv.h
+++ b/wlan_src/mlinux/moal_uap_priv.h
@@ -1,22 +1,30 @@
 /** @file  moal_uap_priv.h
  *
- * @brief This file contains definition for extended private IOCTL call.
+ * @brief This file contains wireless extension standard ioctl functions
  *
  *
  * Copyright 2010-2021 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -65,6 +73,11 @@
 #endif
 #endif
 
+#if defined(UAP_CFG80211)
+/** Private command ID for set multi-AP BSS mode */
+#define WOAL_UAP_SET_MODE 27
+#endif
+
 /** Private command ID for hostcmd */
 #define WOAL_UAP_HOST_CMD (WOAL_UAP_IOCTL + 17)
 
diff --git a/wlan_sd8987/mlinux/moal_uap_wext.c b/wlan_src/mlinux/moal_uap_wext.c
old mode 100755
new mode 100644
similarity index 96%
rename from wlan_sd8987/mlinux/moal_uap_wext.c
rename to wlan_src/mlinux/moal_uap_wext.c
index c74e542..b579b04
--- a/wlan_sd8987/mlinux/moal_uap_wext.c
+++ b/wlan_src/mlinux/moal_uap_wext.c
@@ -5,18 +5,26 @@
  *
  * Copyright 2010-2021 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -84,6 +92,10 @@
 #endif
 #endif
 
+#if defined(UAP_CFG80211)
+	{WOAL_UAP_SET_MODE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "setmode"},
+#endif
 	{WOAL_UAP_SET_GET_256_CHAR, IW_PRIV_TYPE_CHAR | 256,
 	 IW_PRIV_TYPE_CHAR | 256, ""},
 	{WOAL_WL_FW_RELOAD, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
@@ -197,7 +209,7 @@
 {
 	char *cwrq = wrqu->name;
 	ENTER();
-	strcpy(cwrq, "IEEE 802.11-DS");
+	strncpy(cwrq, "IEEE 802.11-DS", IFNAMSIZ);
 	LEAVE();
 	return 0;
 }
@@ -224,7 +236,11 @@
 	if (priv->bss_started)
 		moal_memcpy_ext(priv->phandle, awrq->sa_data,
 				priv->current_addr, MLAN_MAC_ADDR_LENGTH,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				sizeof(awrq->sa_data_min));
+#else
 				sizeof(awrq->sa_data));
+#endif
 	else
 		memset(awrq->sa_data, 0, MLAN_MAC_ADDR_LENGTH);
 	awrq->sa_family = ARPHRD_ETHER;
@@ -401,7 +417,7 @@
 		return -EFAULT;
 	}
 
-	band = (ap_cfg->bandcfg.chanBand == BAND_5GHZ);
+	band = (((ap_cfg->bandcfg.chanBand == BAND_5GHZ) ? 1 : 0));
 	fwrq->m = (long)channel_to_frequency(ap_cfg->channel, band);
 	fwrq->i = (long)ap_cfg->channel;
 	fwrq->e = 6;
@@ -1126,7 +1142,8 @@
 		if (!memcmp(bc_addr, sta_addr, ETH_ALEN)) {
 			PRINTM(MIOCTL, "Deauth all stations\n");
 			req = woal_alloc_mlan_ioctl_req(
-				sizeof(mlan_ds_get_info));
+				sizeof(mlan_ds_get_info) +
+				(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 			if (req == NULL) {
 				LEAVE();
 				return -ENOMEM;
diff --git a/wlan_sd8987/mlinux/moal_usb.c b/wlan_src/mlinux/moal_usb.c
old mode 100755
new mode 100644
similarity index 89%
rename from wlan_sd8987/mlinux/moal_usb.c
rename to wlan_src/mlinux/moal_usb.c
index 0f5d3fd..51c49b7
--- a/wlan_sd8987/mlinux/moal_usb.c
+++ b/wlan_src/mlinux/moal_usb.c
@@ -4,20 +4,28 @@
  * driver.
  *
  *
- * Copyright 2008-2021 NXP
+ * Copyright 2008-2021, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -35,7 +43,7 @@
 ********************************************************/
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
+	defined(USB8978) || defined(USBIW624) || defined(USBIW610)
 /** Card-type detection frame response */
 typedef struct {
 	/** 32-bit ACK+WINNER field */
@@ -95,10 +103,16 @@
 	{NXP_USB_DEVICE(USB9097_VID_1, USB9097_PID_1, "NXP WLAN USB Adapter")},
 	{NXP_USB_DEVICE(USB9097_VID_1, USB9097_PID_2, "NXP WLAN USB Adapter")},
 #endif
-#ifdef USBNW62X
-	{NXP_USB_DEVICE(USBNW62X_VID_1, USBNW62X_PID_1,
+#ifdef USBIW624
+	{NXP_USB_DEVICE(USBIW624_VID_1, USBIW624_PID_1,
 			"NXP WLAN USB Adapter")},
-	{NXP_USB_DEVICE(USBNW62X_VID_1, USBNW62X_PID_2,
+	{NXP_USB_DEVICE(USBIW624_VID_1, USBIW624_PID_2,
+			"NXP WLAN USB Adapter")},
+#endif
+#ifdef USBIW610
+	{NXP_USB_DEVICE(USBIW610_VID_1, USBIW610_PID_1,
+			"NXP WLAN USB Adapter")},
+	{NXP_USB_DEVICE(USBIW610_VID_1, USBIW610_PID_2,
 			"NXP WLAN USB Adapter")},
 #endif
 	/* Terminating entry */
@@ -128,8 +142,12 @@
 #ifdef USB9097
 	{NXP_USB_DEVICE(USB9097_VID_1, USB9097_PID_2, "NXP WLAN USB Adapter")},
 #endif
-#ifdef USBNW62X
-	{NXP_USB_DEVICE(USBNW62X_VID_1, USBNW62X_PID_2,
+#ifdef USBIW624
+	{NXP_USB_DEVICE(USBIW624_VID_1, USBIW624_PID_2,
+			"NXP WLAN USB Adapter")},
+#endif
+#ifdef USBIW610
+	{NXP_USB_DEVICE(USBIW610_VID_1, USBIW610_PID_2,
 			"NXP WLAN USB Adapter")},
 #endif
 	/* Terminating entry */
@@ -497,19 +515,20 @@
 ********************************************************/
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
+	defined(USB8978) || defined(USBIW624) || defined(USBIW610)
 /**
  *  @brief  Check chip revision
  *
  *  @param handle        A pointer to moal_handle structure
  *  @param usb_chip_rev  A pointer to usb_chip_rev variable
  *  @param usb_strap     A pointer to usb_strap
+ *  @param boot_mode     A pointer to boot_mode
  *
  *  @return 	   	 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
 static mlan_status woal_check_chip_revision(moal_handle *handle,
 					    t_u32 *usb_chip_rev,
-					    t_u32 *usb_strap)
+					    t_u32 *usb_strap, t_u32 *boot_mode)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_buffer mbuf;
@@ -582,7 +601,7 @@
 	ack_pkt.strap = woal_le32_to_cpu(ack_pkt.strap);
 
 	if ((ack_pkt.extend & 0xffff0000) == EXTEND_HDR) {
-		extend_ver = ack_pkt.extend & 0x0000ffff;
+		extend_ver = ack_pkt.extend & 0x000000ff;
 		*usb_chip_rev = ack_pkt.chip_rev & 0x000000ff;
 		if (extend_ver >= EXTEND_V2) {
 			PRINTM(MINFO, "chip_rev=0x%x, strap=0x%x\n",
@@ -590,6 +609,8 @@
 			*usb_strap = ack_pkt.strap & 0x7;
 		} else
 			PRINTM(MINFO, "chip_rev=0x%x\n", *usb_chip_rev);
+		if (extend_ver >= EXTEND_V3)
+			*boot_mode = (ack_pkt.extend & 0x0000ff00) >> 8;
 	}
 cleanup:
 	kfree(recv_buff);
@@ -807,18 +828,34 @@
 					strlen(KERN_VERSION));
 	}
 #endif
-#ifdef USBNW62X
+#ifdef USBIW624
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    (__force __le16)USBNW62X_PID_1 ||
+		    (__force __le16)USBIW624_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    (__force __le16)USBNW62X_PID_2) {
-		card_type = CARD_TYPE_USBNW62X;
-		moal_memcpy_ext(NULL, driver_version, CARD_USBNW62X,
-				strlen(CARD_USBNW62X), strlen(driver_version));
+		    (__force __le16)USBIW624_PID_2) {
+		card_type = CARD_TYPE_USBIW624;
+		moal_memcpy_ext(NULL, driver_version, CARD_USBIW624,
+				strlen(CARD_USBIW624), strlen(driver_version));
 		moal_memcpy_ext(NULL,
 				driver_version + strlen(INTF_CARDTYPE) +
 					strlen(KERN_VERSION),
-				V17, strlen(V17),
+				V18, strlen(V18),
+				strlen(driver_version) - strlen(INTF_CARDTYPE) -
+					strlen(KERN_VERSION));
+	}
+#endif
+#ifdef USBIW610
+	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
+		    (__force __le16)USBIW610_PID_1 ||
+	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
+		    (__force __le16)USBIW610_PID_2) {
+		card_type = CARD_TYPE_USBIW610;
+		moal_memcpy_ext(NULL, driver_version, CARD_USBIW610,
+				strlen(CARD_USBIW610), strlen(driver_version));
+		moal_memcpy_ext(NULL,
+				driver_version + strlen(INTF_CARDTYPE) +
+					strlen(KERN_VERSION),
+				V18, strlen(V18),
 				strlen(driver_version) - strlen(INTF_CARDTYPE) -
 					strlen(KERN_VERSION));
 	}
@@ -890,9 +927,12 @@
 #ifdef USB9097
 			case (__force __le16)USB9097_PID_1:
 #endif /* USB9097 */
-#ifdef USBNW62X
-			case (__force __le16)USBNW62X_PID_1:
-#endif /* USBNW62X */
+#ifdef USBIW624
+			case (__force __le16)USBIW624_PID_1:
+#endif /* USBIW624 */
+#ifdef USBIW610
+			case (__force __le16)USBIW610_PID_1:
+#endif /* USBIW610 */
 
 				/* If skip FW is set, we must return error so
 				 * the next driver can download the FW */
@@ -920,9 +960,12 @@
 #ifdef USB9097
 			case (__force __le16)USB9097_PID_2:
 #endif /* USB9097 */
-#ifdef USBNW62X
-			case (__force __le16)USBNW62X_PID_2:
-#endif /* USBNW62X */
+#ifdef USBIW624
+			case (__force __le16)USBIW624_PID_2:
+#endif /* USBIW624 */
+#ifdef USBIW610
+			case (__force __le16)USBIW610_PID_2:
+#endif /* USBIW610 */
 
 				usb_cardp->boot_state = USB_FW_READY;
 				break;
@@ -1234,6 +1277,7 @@
 {
 	struct usb_card_rec *cardp = usb_get_intfdata(intf);
 	moal_handle *handle = NULL;
+	mlan_ds_ps_info pm_info;
 	int i;
 	int ret = 0;
 
@@ -1258,6 +1302,28 @@
 			woal_cancel_scan(handle->priv[i], MOAL_IOCTL_WAIT);
 	}
 #endif
+
+	memset(&pm_info, 0, sizeof(pm_info));
+#define MAX_RETRY_USB 8
+	for (i = 0; i < MAX_RETRY_USB; i++) {
+		if (MLAN_STATUS_SUCCESS ==
+		    woal_get_pm_info(woal_get_priv(handle, MLAN_BSS_ROLE_ANY),
+				     &pm_info)) {
+			if (pm_info.is_suspend_allowed == MTRUE)
+				break;
+			else
+				PRINTM(MMSG,
+				       "Suspend not allowed and retry again\n");
+		}
+		woal_sched_timeout(100);
+	}
+	if (pm_info.is_suspend_allowed == MFALSE) {
+		PRINTM(MMSG, "Suspend not allowed\n");
+		ret = -EBUSY;
+		goto done;
+	}
+
+	woal_sched_timeout(200);
 	/* Enable Host Sleep */
 	woal_enable_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
 
@@ -1280,7 +1346,6 @@
 		for (i = 0; i < MVUSB_RX_DATA_URB; i++) {
 			if (cardp->rx_data_list[i].urb) {
 				usb_kill_urb(cardp->rx_data_list[i].urb);
-				usb_init_urb(cardp->rx_data_list[i].urb);
 			}
 		}
 	}
@@ -2040,9 +2105,10 @@
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
+	defined(USB8978) || defined(USBIW624) || defined(USBIW610)
 	t_u32 revision_id = 0;
 	t_u32 strap = 0;
+	t_u32 boot_mode = 0;
 #endif
 	struct usb_card_rec *cardp = (struct usb_card_rec *)handle->card;
 #if defined(USB9098)
@@ -2060,8 +2126,9 @@
 #endif
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
-	ret = woal_check_chip_revision(handle, &revision_id, &strap);
+	defined(USB8978) || defined(USBIW624) || defined(USBIW610)
+	ret = woal_check_chip_revision(handle, &revision_id, &strap,
+				       &boot_mode);
 	if (ret != MLAN_STATUS_SUCCESS) {
 		PRINTM(MFATAL, "Chip revision check failure!\n");
 		ret = MLAN_STATUS_FAILURE;
@@ -2073,22 +2140,26 @@
 #ifdef USB8997
 	if (IS_USB8997(handle->card_type)) {
 		if (strap == CARD_TYPE_USB_UART)
-			strcpy(handle->card_info->fw_name,
-			       USBUART8997_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUART8997_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 		else if (strap != 0)
-			strcpy(handle->card_info->fw_name,
-			       USBUSB8997_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUSB8997_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 	}
 #endif
 
 #ifdef USB8978
 	if (IS_USB8978(handle->card_type)) {
 		if (strap == CARD_TYPE_USB_UART)
-			strcpy(handle->card_info->fw_name,
-			       USBUART8978_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUART8978_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 		else if (strap != 0)
-			strcpy(handle->card_info->fw_name,
-			       USBUSB8978_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUSB8978_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 	}
 #endif
 
@@ -2097,10 +2168,12 @@
 		if (cardp->second_mac) {
 			ref_handle = (moal_handle *)handle->pref_mac;
 			if (ref_handle) {
-				strcpy(handle->card_info->fw_name,
-				       ref_handle->card_info->fw_name);
-				strcpy(handle->card_info->fw_name_wlan,
-				       ref_handle->card_info->fw_name_wlan);
+				strncpy(handle->card_info->fw_name,
+					ref_handle->card_info->fw_name,
+					FW_NAMW_MAX_LEN);
+				strncpy(handle->card_info->fw_name_wlan,
+					ref_handle->card_info->fw_name_wlan,
+					FW_NAMW_MAX_LEN);
 			}
 			goto done;
 		}
@@ -2108,28 +2181,32 @@
 		case USB9098_Z1Z2:
 			if (strap != 0) {
 				if (strap == CARD_TYPE_USB_UART)
-					strcpy(handle->card_info->fw_name,
-					       USBUART9098_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUART9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       USBUSB9098_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUSB9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       USB9098_DEFAULT_WLAN_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				USB9098_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		case USB9098_A0:
 		case USB9098_A1:
 		case USB9098_A2:
 			if (strap != 0) {
 				if (strap == CARD_TYPE_USB_UART)
-					strcpy(handle->card_info->fw_name,
-					       USBUART9098_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUART9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       USBUSB9098_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUSB9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       USB9098_WLAN_V1_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				USB9098_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		}
 	}
@@ -2141,26 +2218,68 @@
 		case USB9097_B1:
 			if (strap != 0) {
 				if (strap == CARD_TYPE_USB_UART)
-					strcpy(handle->card_info->fw_name,
-					       USBUART9097_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUART9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       USBUSB9097_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUSB9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       USB9097_WLAN_V1_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				USB9097_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		}
 	}
 #endif
-#ifdef USBNW62X
-	if (IS_USBNW62X(handle->card_type)) {
+#ifdef USBIW624
+	if (IS_USBIW624(handle->card_type)) {
+		if (boot_mode == 0x03)
+			PRINTM(MMSG, "wlan: USB-IW624 in secure-boot mode\n");
 		if (strap == CARD_TYPE_USB_UART)
-			strcpy(handle->card_info->fw_name,
-			       USBUARTNW62X_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUARTIW624_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
 		else
-			strcpy(handle->card_info->fw_name,
-			       USBUSBNW62X_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUSBIW624_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
+	}
+#endif
+#ifdef USBIW610
+	if (IS_USBIW610(handle->card_type)) {
+		if (boot_mode == 0x03)
+			PRINTM(MMSG, "wlan: USB-IW610 in secure-boot mode\n");
+		if (strap == CARD_TYPE_USBIW610_UART) {
+			if (handle->params.dual_nb)
+				strncpy(handle->card_info->fw_name,
+					USBUARTSPIIW610_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					USBUARTIW610_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		} else if (strap == CARD_TYPE_USBIW610_USB) {
+			if (handle->params.dual_nb)
+				strncpy(handle->card_info->fw_name,
+					USBUSBSPIIW610_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+			else
+				strncpy(handle->card_info->fw_name,
+					USBUSBIW610_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
+		}
+		strncpy(handle->card_info->fw_name_wlan,
+			USBIW610_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
+		if (boot_mode != 0x03) {
+			/* remove extension .se */
+			if (strstr(handle->card_info->fw_name, ".se"))
+				memset(strstr(handle->card_info->fw_name,
+					      ".se"),
+				       '\0', sizeof(".se"));
+			if (strstr(handle->card_info->fw_name_wlan, ".se"))
+				memset(strstr(handle->card_info->fw_name_wlan,
+					      ".se"),
+				       '\0', sizeof(".se"));
+		}
 	}
 #endif
 
diff --git a/wlan_sd8987/mlinux/moal_usb.h b/wlan_src/mlinux/moal_usb.h
old mode 100755
new mode 100644
similarity index 73%
rename from wlan_sd8987/mlinux/moal_usb.h
rename to wlan_src/mlinux/moal_usb.h
index 5e10133..e86534a
--- a/wlan_sd8987/mlinux/moal_usb.h
+++ b/wlan_src/mlinux/moal_usb.h
@@ -1,23 +1,30 @@
 /** @file moal_usb.h
  *
- * @brief This file contains definitions for USB interface.
- * driver.
+ *  @brief This file contains definitions for USB interface.
  *
  *
- * Copyright 2008-2021 NXP
+ * Copyright 2008-2021, 2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 /*************************************************************
@@ -89,14 +96,23 @@
 #define USB9097_PID_2 0x2061
 #endif /* USB9097 */
 
-#ifdef USBNW62X
+#ifdef USBIW624
 /** USB VID 1 */
-#define USBNW62X_VID_1 0x0471
+#define USBIW624_VID_1 0x0471
 /** USB PID 1 */
-#define USBNW62X_PID_1 0x020E
+#define USBIW624_PID_1 0x020E
 /** USB PID 2 */
-#define USBNW62X_PID_2 0x020F
-#endif /* USBNW62X */
+#define USBIW624_PID_2 0x020F
+#endif /* USBIW624 */
+
+#ifdef USBIW610
+/** USB VID 1 */
+#define USBIW610_VID_1 0x0471
+/** USB PID 1 */
+#define USBIW610_PID_1 0x0214
+/** USB PID 2 */
+#define USBIW610_PID_2 0x0215
+#endif /* USBIW610 */
 
 /** Boot state: FW download */
 #define USB_FW_DNLD 1
@@ -110,7 +126,8 @@
 #define MVUSB_RX_DATA_URB 6
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USB8801) || defined(USBNW62X)
+	defined(USB8978) || defined(USB8801) || defined(USBIW624) ||           \
+	defined(USBIW610)
 /* Transmit buffer size for chip revision check */
 #define CHIP_REV_TX_BUF_SIZE 16
 /* Receive buffer size for chip revision check */
@@ -120,6 +137,7 @@
 #define EXTEND_HDR (0xAB950000)
 #define EXTEND_V1 (0x00000001)
 #define EXTEND_V2 (0x00000002)
+#define EXTEND_V3 (0x00000003)
 #ifdef USB8801
 #define USB8801_DEFAULT_WLAN_FW_NAME "nxp/usb8801_uapsta.bin"
 #endif /* USB8801 */
@@ -171,12 +189,21 @@
 #define USBUSB9097_COMBO_V1_FW_NAME "nxp/usbusbiw620_combo_v1.bin"
 #endif /* USB9097 */
 
-#ifdef USBNW62X
-#define USBNW62X_DEFAULT_COMBO_FW_NAME "nxp/usbusbnw62x_combo.bin"
-#define USBUARTNW62X_COMBO_FW_NAME "nxp/usbuartnw62x_combo.bin"
-#define USBUSBNW62X_COMBO_FW_NAME "nxp/usbusbnw62x_combo.bin"
-#define USBNW62X_DEFAULT_WLAN_FW_NAME "nxp/usbnw62x_wlan.bin"
-#endif /* USBNW62X */
+#ifdef USBIW624
+#define USBIW624_DEFAULT_COMBO_FW_NAME "nxp/usbusbiw624_combo.bin"
+#define USBUARTIW624_COMBO_FW_NAME "nxp/usbuartiw624_combo.bin"
+#define USBUSBIW624_COMBO_FW_NAME "nxp/usbusbiw624_combo.bin"
+#define USBIW624_DEFAULT_WLAN_FW_NAME "nxp/usbiw624_wlan.bin"
+#endif /* USBIW624 */
+
+#ifdef USBIW610
+#define USBIW610_DEFAULT_COMBO_FW_NAME "nxp/usbusbspi_iw610.bin.se"
+#define USBUARTIW610_COMBO_FW_NAME "nxp/usbuart_iw610.bin.se"
+#define USBUARTSPIIW610_COMBO_FW_NAME "nxp/usbuartspi_iw610.bin.se"
+#define USBUSBIW610_COMBO_FW_NAME "nxp/usbusb_iw610.bin.se"
+#define USBUSBSPIIW610_COMBO_FW_NAME "nxp/usbusbspi_iw610.bin.se"
+#define USBIW610_DEFAULT_WLAN_FW_NAME "nxp/usb_iw610.bin.se"
+#endif /* USBIW610 */
 
 /** urb context */
 typedef struct _urb_context {
diff --git a/wlan_sd8987/mlinux/moal_wext.c b/wlan_src/mlinux/moal_wext.c
old mode 100755
new mode 100644
similarity index 93%
rename from wlan_sd8987/mlinux/moal_wext.c
rename to wlan_src/mlinux/moal_wext.c
index cf5632d..436cbba
--- a/wlan_sd8987/mlinux/moal_wext.c
+++ b/wlan_src/mlinux/moal_wext.c
@@ -3,20 +3,28 @@
  * @brief This file contains wireless extension standard ioctl functions
  *
  *
- * Copyright 2008-2021 NXP
+ * Copyright 2008-2024 NXP
  *
- * This software file (the File) is distributed by NXP
- * under the terms of the GNU General Public License Version 2, June 1991
- * (the License).  You may use, redistribute and/or modify the File in
- * accordance with the terms and conditions of the License, a copy of which
- * is available by writing to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
- * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
  *
- * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
- * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
- * this warranty disclaimer.
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
  *
  */
 
@@ -77,6 +85,8 @@
 	{WOAL_TXBUF_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
 	 "txbufcfg"},
 	{WOAL_SLEEP_PD, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "sleeppd"},
+	{WOAL_FW_WAKEUP_METHOD, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "fwwakeupmethod"},
 	{WOAL_AUTH_TYPE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
 	 "authtype"},
 	{WOAL_PORT_CTRL, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
@@ -240,31 +250,6 @@
 ********************************************************/
 
 /**
- *  @brief Compare two SSIDs
- *
- *  @param ssid1    A pointer to ssid to compare
- *  @param ssid2    A pointer to ssid to compare
- *
- *  @return         0--ssid is same, otherwise is different
- */
-static t_s32 woal_ssid_cmp(mlan_802_11_ssid *ssid1, mlan_802_11_ssid *ssid2)
-{
-	ENTER();
-
-	if (!ssid1 || !ssid2) {
-		LEAVE();
-		return -1;
-	}
-	if (ssid1->ssid_len != ssid2->ssid_len) {
-		LEAVE();
-		return -1;
-	}
-
-	LEAVE();
-	return memcmp(ssid1->ssid, ssid2->ssid, ssid1->ssid_len);
-}
-
-/**
  *  @brief Sort Channels
  *
  *  @param freq                 A pointer to iw_freq structure
@@ -417,7 +402,7 @@
 {
 	char *cwrq = wrqu->name;
 	ENTER();
-	strcpy(cwrq, "IEEE 802.11-DS");
+	strncpy(cwrq, "IEEE 802.11-DS", IFNAMSIZ);
 	LEAVE();
 	return 0;
 }
@@ -466,10 +451,6 @@
 		ret = -EFAULT;
 		goto done;
 	}
-	if (MLAN_STATUS_SUCCESS !=
-	    woal_change_adhoc_chan(priv, bss->param.bss_chan.channel,
-				   MOAL_IOCTL_WAIT))
-		ret = -EFAULT;
 
 done:
 	if (status != MLAN_STATUS_PENDING)
@@ -562,9 +543,6 @@
 	case IW_MODE_INFRA:
 		bss->param.bss_mode = MLAN_BSS_MODE_INFRA;
 		break;
-	case IW_MODE_ADHOC:
-		bss->param.bss_mode = MLAN_BSS_MODE_IBSS;
-		break;
 	case IW_MODE_AUTO:
 		bss->param.bss_mode = MLAN_BSS_MODE_AUTO;
 		break;
@@ -608,15 +586,24 @@
 
 	memset(&bss_info, 0, sizeof(bss_info));
 
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		ret = -EFAULT;
+		goto done;
+	}
 
 	if (bss_info.media_connected == MTRUE)
 		moal_memcpy_ext(priv->phandle, awrq->sa_data, &bss_info.bssid,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				MLAN_MAC_ADDR_LENGTH,
+				sizeof(awrq->sa_data_min));
+#else
 				MLAN_MAC_ADDR_LENGTH, sizeof(awrq->sa_data));
+#endif
 	else
 		memset(awrq->sa_data, 0, MLAN_MAC_ADDR_LENGTH);
 	awrq->sa_family = ARPHRD_ETHER;
-
+done:
 	LEAVE();
 	return ret;
 }
@@ -641,7 +628,7 @@
 	const t_u8 zero_mac[MLAN_MAC_ADDR_LENGTH] = {0, 0, 0, 0, 0, 0};
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	struct sockaddr *awrq = &wrqu->addr;
-	mlan_ssid_bssid ssid_bssid;
+	mlan_ssid_bssid *ssid_bssid = NULL;
 	mlan_bss_info bss_info;
 
 	ENTER();
@@ -673,29 +660,34 @@
 	}
 
 	/* Broadcast MAC means search for best network */
-	memset(&ssid_bssid, 0, sizeof(mlan_ssid_bssid));
-
+	ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		ret = -ENOMEM;
+		goto done;
+	}
 	if (memcmp(bcast, awrq->sa_data, MLAN_MAC_ADDR_LENGTH)) {
 		/* Check if we are already assoicated to the AP */
 		if (bss_info.media_connected == MTRUE) {
 			if (!memcmp(awrq->sa_data, &bss_info.bssid, ETH_ALEN))
 				goto done;
 		}
-		moal_memcpy_ext(priv->phandle, &ssid_bssid.bssid, awrq->sa_data,
-				ETH_ALEN, sizeof(ssid_bssid.bssid));
+		moal_memcpy_ext(priv->phandle, &ssid_bssid->bssid,
+				awrq->sa_data, ETH_ALEN,
+				sizeof(ssid_bssid->bssid));
 	}
 
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_find_best_network(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_find_best_network(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 		PRINTM(MERROR,
 		       "ASSOC: WAP: MAC address not found in BSSID List\n");
 		ret = -ENETUNREACH;
 		goto done;
 	}
 	/* Zero SSID implies use BSSID to connect */
-	memset(&ssid_bssid.ssid, 0, sizeof(mlan_802_11_ssid));
+	memset(&ssid_bssid->ssid, 0, sizeof(mlan_802_11_ssid));
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_bss_start(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_bss_start(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 		ret = -EFAULT;
 		goto done;
 	}
@@ -716,7 +708,8 @@
 #endif /* REASSOCIATION */
 
 done:
-
+	if (ssid_bssid)
+		kfree(ssid_bssid);
 	LEAVE();
 	return ret;
 }
@@ -804,6 +797,7 @@
 	mlan_power_cfg_t power_cfg;
 
 	ENTER();
+	memset(&power_cfg, 0, sizeof(mlan_power_cfg_t));
 	if (vwrq_->disabled) {
 		woal_set_radio(priv, 0);
 		goto done;
@@ -851,7 +845,11 @@
 
 	memset(&power_cfg, 0, sizeof(mlan_power_cfg_t));
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		ret = -EFAULT;
+		goto done;
+	}
 
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_set_get_tx_power(priv, MLAN_ACT_GET, &power_cfg)) {
@@ -1194,6 +1192,13 @@
 		dwrq->flags = IW_ENCODE_RESTRICTED;
 		break;
 
+	case MLAN_AUTH_MODE_SAE:
+		dwrq->flags = IW_ENCODE_RESTRICTED;
+		break;
+	case MLAN_AUTH_MODE_OWE:
+		dwrq->flags = IW_ENCODE_OPEN;
+		break;
+
 	case MLAN_AUTH_MODE_AUTO:
 		dwrq->flags = IW_ENCODE_OPEN | IW_ENCODE_RESTRICTED;
 		break;
@@ -1264,6 +1269,8 @@
 
 	ENTER();
 
+	memset(&rate_cfg, 0, sizeof(mlan_rate_cfg_t));
+
 	if (vwrq->value == -1) {
 		rate_cfg.is_rate_auto = 1;
 	} else {
@@ -1972,6 +1979,7 @@
 	mlan_chan_list *pchan_list = NULL;
 	mlan_bss_info bss_info;
 	gfp_t flag;
+	int ret = 0;
 
 	ENTER();
 
@@ -2101,7 +2109,11 @@
 
 	memset(&bss_info, 0, sizeof(bss_info));
 
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		ret = -EFAULT;
+		goto done;
+	}
 
 	range->txpower[0] = bss_info.min_power_level;
 	range->txpower[1] = bss_info.max_power_level;
@@ -2112,8 +2124,9 @@
 	range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
 			  IW_ENC_CAPA_CIPHER_CCMP | IW_ENC_CAPA_CIPHER_TKIP;
 #endif
+done:
 	LEAVE();
-	return 0;
+	return ret;
 }
 
 #ifdef MEF_CFG_RX_FILTER
@@ -2216,7 +2229,7 @@
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2234,11 +2247,12 @@
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "%s rssi %d\n", bss_info.ssid.ssid,
-				      signal.bcn_rssi_avg) +
+			len = snprintf(buf, MAX_BUF_LEN, "%s rssi %d\n",
+				       bss_info.ssid.ssid,
+				       signal.bcn_rssi_avg) +
 			      1;
 		} else {
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		}
 	} else if (strncmp(buf, "LINKSPEED", strlen("LINKSPEED")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -2247,14 +2261,15 @@
 			goto done;
 		}
 		PRINTM(MIOCTL, "tx rate=%d\n", (int)rate.rate);
-		len = sprintf(buf, "LinkSpeed %d\n",
-			      (int)(rate.rate * 500000 / 1000000)) +
+		len = snprintf(buf, MAX_BUF_LEN, "LinkSpeed %d\n",
+			       (int)(rate.rate * 500000 / 1000000)) +
 		      1;
 	} else if (strncmp(buf, "MACADDR", strlen("MACADDR")) == 0) {
-		len = sprintf(buf, "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
-			      priv->current_addr[0], priv->current_addr[1],
-			      priv->current_addr[2], priv->current_addr[3],
-			      priv->current_addr[4], priv->current_addr[5]) +
+		len = snprintf(buf, MAX_BUF_LEN,
+			       "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
+			       priv->current_addr[0], priv->current_addr[1],
+			       priv->current_addr[2], priv->current_addr[3],
+			       priv->current_addr[4], priv->current_addr[5]) +
 		      1;
 	} else if (strncmp(buf, "GETPOWER", strlen("GETPOWER")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -2262,7 +2277,9 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "powermode = %d\n", power_mode) + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "powermode = %d\n",
+			       power_mode) +
+		      1;
 	} else if (strncmp(buf, "SCAN-ACTIVE", strlen("SCAN-ACTIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_ACTIVE)) {
@@ -2271,7 +2288,7 @@
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_ACTIVE;
 		PRINTM(MIOCTL, "Set Active Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SCAN-PASSIVE", strlen("SCAN-PASSIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_PASSIVE)) {
@@ -2280,7 +2297,7 @@
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_PASSIVE;
 		PRINTM(MIOCTL, "Set Passive Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "POWERMODE", strlen("POWERMODE")) == 0) {
 		if (dwrq->length > strlen("POWERMODE") + 1) {
 			pdata = buf + strlen("POWERMODE") + 1;
@@ -2291,7 +2308,7 @@
 					goto done;
 				}
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2311,7 +2328,7 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (memcmp(buf, WEXT_CSCAN_HEADER, strlen(WEXT_CSCAN_HEADER)) ==
 		   0) {
 		PRINTM(MIOCTL, "Set Combo Scan\n");
@@ -2320,38 +2337,38 @@
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "GETBAND", strlen("GETBAND")) == 0) {
 		if (MLAN_STATUS_SUCCESS != woal_get_band(priv, &band)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "Band %d\n", band) + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "Band %d\n", band) + 1;
 	} else if (strncmp(buf, "SETBAND", strlen("SETBAND")) == 0) {
 		pband = buf + strlen("SETBAND") + 1;
 		if (MLAN_STATUS_SUCCESS != woal_set_band(priv, pband)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "START", strlen("START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "STOP", strlen("STOP")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SETSUSPENDOPT", strlen("SETSUSPENDOPT")) ==
 		   0) {
 		/* it will be done by GUI */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXMODE", strlen("BTCOEXMODE")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-START",
 			   strlen("BTCOEXSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-STOP", strlen("BTCOEXSCAN-STOP")) ==
 		   0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-START", strlen("BGSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-CONFIG", strlen("BGSCAN-CONFIG")) ==
 		   0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -2361,7 +2378,7 @@
 		}
 		priv->bg_scan_start = MTRUE;
 		priv->bg_scan_reported = MFALSE;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-STOP", strlen("BGSCAN-STOP")) == 0) {
 		if (priv->bg_scan_start && !priv->scan_cfg.rssi_threshold) {
 			if (MLAN_STATUS_SUCCESS !=
@@ -2372,7 +2389,7 @@
 			priv->bg_scan_start = MFALSE;
 			priv->bg_scan_reported = MFALSE;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-START", strlen("RXFILTER-START")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -2380,7 +2397,7 @@
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-STOP", strlen("RXFILTER-STOP")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -2388,7 +2405,7 @@
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-ADD", strlen("RXFILTER-ADD")) == 0) {
 		if (dwrq->length > strlen("RXFILTER-ADD") + 1) {
 			pdata = buf + strlen("RXFILTER-ADD") + 1;
@@ -2397,7 +2414,7 @@
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2411,7 +2428,7 @@
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2424,7 +2441,7 @@
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2437,7 +2454,7 @@
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2493,7 +2510,9 @@
 				MLAN_MAX_SSID_LENGTH);
 		scan_req->ssid_list[0].max_len = 0;
 	}
-	woal_get_scan_config(priv, &scan_cfg);
+	if (MLAN_STATUS_SUCCESS != woal_get_scan_config(priv, &scan_cfg)) {
+		PRINTM(MERROR, "Unable to get scan configuration\n");
+	}
 	if (scan_cfg.scan_chan_gap)
 		scan_req->scan_chan_gap = scan_cfg.scan_chan_gap;
 	else
@@ -2621,7 +2640,8 @@
 	scan_req->keep_previous_scan = MTRUE;
 	moal_memcpy_ext(priv->phandle, scan_req->ssid_list[0].ssid,
 			ssid_bssid->trans_ssid.ssid,
-			ssid_bssid->trans_ssid.ssid_len,
+			MIN(ssid_bssid->trans_ssid.ssid_len,
+			    MLAN_MAX_SSID_LENGTH),
 			sizeof(scan_req->ssid_list[0].ssid));
 	scan_req->ssid_list[0].max_len = 0;
 	scan_req->chan_list[0].chan_number = ssid_bssid->channel;
@@ -2657,7 +2677,7 @@
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	struct iw_point *dwrq = &wrqu->data;
 	mlan_802_11_ssid req_ssid;
-	mlan_ssid_bssid ssid_bssid;
+	mlan_ssid_bssid *ssid_bssid = NULL;
 	mlan_ssid_bssid *owe_ssid_bssid = NULL;
 #ifdef REASSOCIATION
 	moal_handle *handle = priv->phandle;
@@ -2687,7 +2707,12 @@
 	if (priv->scan_type == MLAN_SCAN_TYPE_PASSIVE)
 		woal_set_scan_type(priv, MLAN_SCAN_TYPE_ACTIVE);
 	memset(&req_ssid, 0, sizeof(mlan_802_11_ssid));
-	memset(&ssid_bssid, 0, sizeof(mlan_ssid_bssid));
+	ssid_bssid = kzalloc(sizeof(mlan_ssid_bssid), GFP_ATOMIC);
+	if (!ssid_bssid) {
+		PRINTM(MERROR, "Fail to allocate ssid_bssid buffer\n");
+		ret = -ENOMEM;
+		goto setessid_ret;
+	}
 
 #if WIRELESS_EXT > 20
 	req_ssid.ssid_len = dwrq->length;
@@ -2728,10 +2753,10 @@
 
 		PRINTM(MINFO, "Requested new SSID = %s\n",
 		       (char *)req_ssid.ssid);
-		moal_memcpy_ext(priv->phandle, &ssid_bssid.ssid, &req_ssid,
+		moal_memcpy_ext(priv->phandle, &ssid_bssid->ssid, &req_ssid,
 				sizeof(mlan_802_11_ssid),
-				sizeof(ssid_bssid.ssid));
-		if (MTRUE == woal_is_connected(priv, &ssid_bssid)) {
+				sizeof(mlan_802_11_ssid));
+		if (MTRUE == woal_is_connected(priv, ssid_bssid)) {
 			PRINTM(MIOCTL, "Already connect to the network\n");
 			goto setessid_ret;
 		}
@@ -2762,15 +2787,14 @@
 					       0);
 				ret = MLAN_STATUS_SUCCESS;
 
-				LEAVE();
-				return ret;
+				goto setessid_ret;
 			}
 		}
 #endif
 
 		if (dwrq->flags != 0xFFFF) {
 			if (MLAN_STATUS_SUCCESS !=
-			    woal_find_essid(priv, &ssid_bssid,
+			    woal_find_essid(priv, ssid_bssid,
 					    MOAL_IOCTL_WAIT)) {
 				/* Do specific SSID scanning */
 				if (MLAN_STATUS_SUCCESS !=
@@ -2786,18 +2810,21 @@
 	mode = woal_get_mode(priv, MOAL_IOCTL_WAIT);
 	if (mode == IW_MODE_ADHOC)
 		/* disconnect before try to associate */
-		woal_disconnect(priv, MOAL_IOCTL_WAIT, NULL,
-				DEF_DEAUTH_REASON_CODE);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_disconnect(priv, MOAL_IOCTL_WAIT, NULL,
+				    DEF_DEAUTH_REASON_CODE)) {
+			PRINTM(MERROR,
+			       "Disconnect before association failed\n");
+		}
 
 	if (mode != IW_MODE_ADHOC) {
 		if (MLAN_STATUS_SUCCESS !=
-		    woal_find_best_network(priv, MOAL_IOCTL_WAIT,
-					   &ssid_bssid)) {
+		    woal_find_best_network(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 			ret = -EFAULT;
 			goto setessid_ret;
 		}
-		if (ssid_bssid.trans_ssid.ssid_len &&
-		    (ssid_bssid.owe_transition_mode == OWE_TRANS_MODE_OPEN)) {
+		if (ssid_bssid->trans_ssid.ssid_len &&
+		    (ssid_bssid->owe_transition_mode == OWE_TRANS_MODE_OPEN)) {
 			// We need scan for OWE AP
 			owe_ssid_bssid = (mlan_ssid_bssid *)kmalloc(
 				sizeof(mlan_ssid_bssid), GFP_KERNEL);
@@ -2806,34 +2833,34 @@
 				ret = -ENOMEM;
 				goto setessid_ret;
 			}
-			woal_owe_specific_scan(priv, &ssid_bssid);
+			woal_owe_specific_scan(priv, ssid_bssid);
 			memset(owe_ssid_bssid, 0, sizeof(mlan_ssid_bssid));
 			moal_memcpy_ext(priv->phandle, &owe_ssid_bssid->ssid,
-					&ssid_bssid.trans_ssid,
+					&ssid_bssid->trans_ssid,
 					sizeof(mlan_802_11_ssid),
 					sizeof(owe_ssid_bssid->ssid));
 			moal_memcpy_ext(priv->phandle, &owe_ssid_bssid->bssid,
-					&ssid_bssid.trans_bssid,
+					&ssid_bssid->trans_bssid,
 					sizeof(mlan_802_11_mac_addr),
 					sizeof(owe_ssid_bssid->bssid));
 			if (MLAN_STATUS_SUCCESS ==
 			    woal_find_essid(priv, owe_ssid_bssid,
 					    MOAL_IOCTL_WAIT))
-				moal_memcpy_ext(priv->phandle, &ssid_bssid,
+				moal_memcpy_ext(priv->phandle, ssid_bssid,
 						owe_ssid_bssid,
 						sizeof(mlan_ssid_bssid),
-						sizeof(ssid_bssid));
+						sizeof(mlan_ssid_bssid));
 		}
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_11d_check_ap_channel(priv, MOAL_IOCTL_WAIT,
-					      &ssid_bssid)) {
+					      ssid_bssid)) {
 			PRINTM(MERROR,
 			       "The AP's channel is invalid for current region\n");
 			ret = -EFAULT;
 			goto setessid_ret;
 		}
 	} else if (MLAN_STATUS_SUCCESS !=
-		   woal_find_best_network(priv, MOAL_IOCTL_WAIT, &ssid_bssid))
+		   woal_find_best_network(priv, MOAL_IOCTL_WAIT, ssid_bssid))
 		/* Adhoc start, Check the channel command */
 		woal_11h_channel_check_ioctl(priv, MOAL_IOCTL_WAIT);
 
@@ -2848,10 +2875,10 @@
 #endif /* REASSOCIATION */
 
 	/* Connect to BSS by ESSID */
-	memset(&ssid_bssid.bssid, 0, MLAN_MAC_ADDR_LENGTH);
+	memset(&ssid_bssid->bssid, 0, MLAN_MAC_ADDR_LENGTH);
 
 	if (MLAN_STATUS_SUCCESS !=
-	    woal_bss_start(priv, MOAL_IOCTL_WAIT, &ssid_bssid)) {
+	    woal_bss_start(priv, MOAL_IOCTL_WAIT, ssid_bssid)) {
 		ret = -EFAULT;
 		goto setessid_ret;
 	}
@@ -2872,6 +2899,8 @@
 #endif /* REASSOCIATION */
 
 setessid_ret:
+	if (ssid_bssid)
+		kfree(ssid_bssid);
 	if (priv->scan_type == MLAN_SCAN_TYPE_PASSIVE)
 		woal_set_scan_type(priv, MLAN_SCAN_TYPE_PASSIVE);
 #ifdef REASSOCIATION
@@ -2951,7 +2980,6 @@
 	mlan_scan_resp scan_resp;
 	mlan_bss_info bss_info;
 	BSSDescriptor_t *scan_table;
-	mlan_ds_get_signal rssi;
 	t_u16 buf_size = 16 + 256 * 2;
 	char *buf = NULL;
 	char *ptr;
@@ -3032,7 +3060,11 @@
 		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
 		moal_memcpy_ext(priv->phandle, iwe.u.ap_addr.sa_data,
 				&scan_table[i].mac_address, ETH_ALEN,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				sizeof(iwe.u.ap_addr.sa_data_min));
+#else
 				sizeof(iwe.u.ap_addr.sa_data));
+#endif
 
 		iwe.len = IW_EV_ADDR_LEN;
 		current_ev = IWE_STREAM_ADD_EVENT(info, current_ev, end_buf,
@@ -3053,9 +3085,7 @@
 
 		/* Add mode */
 		iwe.cmd = SIOCGIWMODE;
-		if (scan_table[i].bss_mode == MLAN_BSS_MODE_IBSS)
-			iwe.u.mode = IW_MODE_ADHOC;
-		else if (scan_table[i].bss_mode == MLAN_BSS_MODE_INFRA)
+		if (scan_table[i].bss_mode == MLAN_BSS_MODE_INFRA)
 			iwe.u.mode = IW_MODE_MASTER;
 		else
 			iwe.u.mode = IW_MODE_AUTO;
@@ -3082,18 +3112,6 @@
 		else
 			iwe.u.qual.noise = bss_info.bcn_nf_last;
 
-		if ((bss_info.bss_mode == MLAN_BSS_MODE_IBSS) &&
-		    !woal_ssid_cmp(&bss_info.ssid, &scan_table[i].ssid) &&
-		    bss_info.adhoc_state == ADHOC_STARTED) {
-			memset(&rssi, 0, sizeof(mlan_ds_get_signal));
-			if (MLAN_STATUS_SUCCESS !=
-			    woal_get_signal_info(priv, MOAL_IOCTL_WAIT,
-						 &rssi)) {
-				ret = -EFAULT;
-				break;
-			}
-			iwe.u.qual.level = rssi.data_rssi_avg;
-		}
 		iwe.u.qual.qual =
 			woal_rssi_to_quality((t_s16)(iwe.u.qual.level - 0x100));
 		iwe.len = IW_EV_QUAL_LEN;
@@ -3133,15 +3151,6 @@
 							   current_val, end_buf,
 							   &iwe, iwe.len);
 		}
-		if ((bss_info.bss_mode == MLAN_BSS_MODE_IBSS) &&
-		    !woal_ssid_cmp(&bss_info.ssid, &scan_table[i].ssid) &&
-		    bss_info.adhoc_state == ADHOC_STARTED) {
-			iwe.u.bitrate.value = 22 * 500000;
-			iwe.len = IW_EV_PARAM_LEN;
-			current_val = IWE_STREAM_ADD_VALUE(info, current_ev,
-							   current_val, end_buf,
-							   &iwe, iwe.len);
-		}
 
 		/* Check if an event is added */
 		if ((unsigned int)(current_val - current_ev) >= IW_EV_PARAM_LEN)
@@ -3150,8 +3159,8 @@
 		/* Beacon Interval */
 		memset(&iwe, 0, sizeof(iwe));
 		ptr = buf;
-		ptr += sprintf(ptr, "Beacon interval=%d",
-			       scan_table[i].beacon_period);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "Beacon interval=%d",
+				scan_table[i].beacon_period);
 
 		iwe.u.data.length = strlen(buf);
 		iwe.cmd = IWEVCUSTOM;
@@ -3226,12 +3235,12 @@
 		memset(&iwe, 0, sizeof(iwe));
 		memset(buf, 0, buf_size);
 		ptr = buf;
-		ptr += sprintf(ptr, "band=");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "band=");
 		memset(&iwe, 0, sizeof(iwe));
 		if (scan_table[i].bss_band == BAND_A)
-			sprintf(ptr, "a");
+			snprintf(ptr, MAX_BUF_LEN, "a");
 		else
-			sprintf(ptr, "bg");
+			snprintf(ptr, MAX_BUF_LEN, "bg");
 		iwe.u.data.length = strlen(buf);
 		PRINTM(MINFO, "iwe.u.data.length %d\n", iwe.u.data.length);
 		PRINTM(MINFO, "BUF: %s\n", buf);
@@ -3371,7 +3380,7 @@
 void woal_send_iwevcustom_event(moal_private *priv, char *str)
 {
 	union iwreq_data iwrq;
-	char buf[IW_CUSTOM_MAX];
+	char buf[256];
 
 	ENTER();
 	/* Check register_netdevice is completed before sending*/
diff --git a/wlan_src/mlinux/moal_wext.h b/wlan_src/mlinux/moal_wext.h
new file mode 100644
index 0000000..76d5a5c
--- /dev/null
+++ b/wlan_src/mlinux/moal_wext.h
@@ -0,0 +1,66 @@
+/** @file moal_wext.h
+ *
+ * @brief This file contains definition for extended private IOCTL call.
+ *
+ *
+ * Copyright 2008-2021 NXP
+ *
+ * NXP CONFIDENTIAL
+ * The source code contained or described herein and all documents related to
+ * the source code (Materials) are owned by NXP, its
+ * suppliers and/or its licensors. Title to the Materials remains with NXP,
+ * its suppliers and/or its licensors. The Materials contain
+ * trade secrets and proprietary and confidential information of NXP, its
+ * suppliers and/or its licensors. The Materials are protected by worldwide
+ * copyright and trade secret laws and treaty provisions. No part of the
+ * Materials may be used, copied, reproduced, modified, published, uploaded,
+ * posted, transmitted, distributed, or disclosed in any way without NXP's prior
+ * express written permission.
+ *
+ * No license under any patent, copyright, trade secret or other intellectual
+ * property right is granted to or conferred upon you by disclosure or delivery
+ * of the Materials, either expressly, by implication, inducement, estoppel or
+ * otherwise. Any license under such intellectual property rights must be
+ * express and approved by NXP in writing.
+ *
+ *  Alternatively, this software may be distributed under the terms of GPL v2.
+ *  SPDX-License-Identifier:    GPL-2.0
+ *
+ */
+
+/********************************************************
+Change log:
+    10/21/2008: initial version
+********************************************************/
+
+#ifndef _WOAL_WEXT_H_
+#define _WOAL_WEXT_H_
+
+/** NF value for default scan */
+#define MRVDRV_NF_DEFAULT_SCAN_VALUE (-96)
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+/** Add event */
+#define IWE_STREAM_ADD_EVENT(i, c, e, w, l)                                    \
+	iwe_stream_add_event((i), (c), (e), (w), (l))
+/** Add point */
+#define IWE_STREAM_ADD_POINT(i, c, e, w, p)                                    \
+	iwe_stream_add_point((i), (c), (e), (w), (p))
+/** Add value */
+#define IWE_STREAM_ADD_VALUE(i, c, v, e, w, l)                                 \
+	iwe_stream_add_value((i), (c), (v), (e), (w), (l))
+#else
+/** Add event */
+#define IWE_STREAM_ADD_EVENT(i, c, e, w, l)                                    \
+	iwe_stream_add_event((c), (e), (w), (l))
+/** Add point */
+#define IWE_STREAM_ADD_POINT(i, c, e, w, p)                                    \
+	iwe_stream_add_point((c), (e), (w), (p))
+/** Add value */
+#define IWE_STREAM_ADD_VALUE(i, c, v, e, w, l)                                 \
+	iwe_stream_add_value((c), (v), (e), (w), (l))
+#endif
+
+extern struct iw_handler_def woal_handler_def;
+struct iw_statistics *woal_get_wireless_stats(struct net_device *dev);
+#endif /* _WOAL_WEXT_H_ */
diff --git a/wlan_src/script/load b/wlan_src/script/load
new file mode 100755
index 0000000..e9819c9
--- /dev/null
+++ b/wlan_src/script/load
@@ -0,0 +1,16 @@
+#! /bin/bash
+if echo $1 2>&1 | grep dbg > /dev/null; then
+    insmod mlan-dbg.ko
+else
+    insmod mlan.ko
+fi
+insmod $1.ko $2 $3 $4 $5 $6 $7 $8
+for (( i = 1; i <= 10; i++ ))
+do
+    ifconfig -a 2>&1 | grep -E "(mlan0|uap0|wfd0)" > /dev/null
+    if [ $? -eq 0 ]; then
+        exit
+    fi
+    sleep 1
+done
+
diff --git a/wlan_src/script/unload b/wlan_src/script/unload
new file mode 100755
index 0000000..03d3e78
--- /dev/null
+++ b/wlan_src/script/unload
@@ -0,0 +1,24 @@
+#! /bin/bash
+ifconfig mlan0 down
+ifconfig uap0 down
+ifconfig mmlan0 down
+ifconfig muap0 down
+ifconfig uap1 down
+ifconfig muap1 down
+ifconfig wfd0 down
+ifconfig wfd1 down
+ifconfig mwfd0 down
+ifconfig mwfd1 down
+ifconfig nan0 down
+ifconfig mnan0 down
+for (( i = 0; i <= 30; i++ ))
+do
+    rmmod moal 2> /dev/null
+    lsmod 2>&1 | grep moal > /dev/null
+    if [ ! $? -eq 0 ]; then
+        break
+    fi
+    sleep 1
+done
+rmmod mlan
+sleep 5
diff --git a/wlan_src/script/wifidirect/start_auto_go.sh b/wlan_src/script/wifidirect/start_auto_go.sh
new file mode 100755
index 0000000..78aa8a8
--- /dev/null
+++ b/wlan_src/script/wifidirect/start_auto_go.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+# iwpriv mlan0 drvdbg 0x20037
+# change the mac address
+./wifidirect/update_mac.sh
+echo "wfd0 Mac address updated in config/wifidirect.conf"
+
+
+./wifidirectutl wfd0 wifidirect_config config/wifidirect.conf
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 1
+#else
+# iwpriv wfd0 bssrole 1
+#endif
+./uaputl.exe -i wfd0 sys_config config/uaputl_wifidirect.conf
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 0
+#else
+# iwpriv wfd0 bssrole 0
+#endif
+# iwpriv wfd0 bssrole 1
+# change the group owner parameters
+# either in uaputl_wifidirect.conf or using CLI below
+#./uaputl.exe -i wfd0 sys_cfg_wpa_passphrase 1234567890
+#./uaputl.exe -i wfd0 sys_cfg_eapol_gwk_hsk 2000 3
+#./uaputl.exe -i wfd0 sys_cfg_eapol_pwk_hsk 2000 3
+# iwpriv wfd0 bssrole 0
+./wifidirectutl wfd0 wifidirect_mode 1
+iwpriv wfd0 bssrole 1
+./wifidirectutl wfd0 wifidirect_mode 2
+./uaputl.exe -i wfd0 bss_start
diff --git a/wlan_src/script/wifidirect/start_find_phase.sh b/wlan_src/script/wifidirect/start_find_phase.sh
new file mode 100755
index 0000000..26ddd60
--- /dev/null
+++ b/wlan_src/script/wifidirect/start_find_phase.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# iwpriv wfd0 drvdbg 0x20037
+#change the mac address
+./wifidirect/update_mac.sh
+echo "wfd0 Mac address updated in config/wifidirect.conf"
+
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 1
+#else
+# iwpriv wfd0 bssrole 1
+#endif
+./uaputl.exe -i wfd0 sys_config config/uaputl_wifidirect.conf
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 0
+#else
+# iwpriv wfd0 bssrole 0
+#endif
+./wifidirectutl wfd0 wifidirect_config config/wifidirect.conf
+# change the passphrase
+# either in uaputl_wifidirect.conf or using CLI below
+#./uaputl.exe -i wfd0 sys_cfg_wpa_passphrase 1234567890
+./wifidirectutl wfd0 wifidirect_mode 1
+./wifidirectutl wfd0 wifidirect_params_config config/wifidirect.conf
+./mlanutl wfd0 hostcmd config/bg_scan_wifidirect.conf bgscfg
+./wifidirectutl wfd0 wifidirect_mode 4
diff --git a/wlan_src/script/wifidirect/start_listen_state.sh b/wlan_src/script/wifidirect/start_listen_state.sh
new file mode 100755
index 0000000..91c1e4d
--- /dev/null
+++ b/wlan_src/script/wifidirect/start_listen_state.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+iwpriv wfd0 drvdbg 0x20037
+# change the mac address
+ifconfig mlan0 hw ether 00:50:43:21:0e:08
+ifconfig wfd0 hw ether 00:50:43:21:0e:08
+ifconfig uap0 hw ether 00:50:43:21:0e:08
+
+iwpriv wfd0 deepsleep 0
+iwconfig wfd0 power off
+
+iwpriv wfd0 bssrole 1
+./uaputl.exe -i wfd0 sys_config config/uaputl_wifidirect.conf
+iwpriv wfd0 bssrole 0
+./wifidirectutl wfd0 wifidirect_config config/wifidirect.conf
+./uaputl.exe -i wfd0 sys_cfg_protocol 32
+./uaputl.exe -i wfd0 sys_cfg_cipher 8 8
+./uaputl.exe -i wfd0 sys_cfg_wpa_passphrase 1234567890
+./wifidirectutl wfd0 wifidirect_mode 1
diff --git a/wlan_src/script/wifidirect/stop_auto_go.sh b/wlan_src/script/wifidirect/stop_auto_go.sh
new file mode 100755
index 0000000..eda03ef
--- /dev/null
+++ b/wlan_src/script/wifidirect/stop_auto_go.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+./uaputl.exe -i wfd0 bss_stop
+sleep 1
+iwpriv wfd0 bssrole 0
+./wifidirectutl wfd0 wifidirect_mode 0
+# IE clear assume index 0, 1
+./uaputl.exe -i wfd0 sys_cfg_custom_ie 0 0
+./uaputl.exe -i wfd0 sys_cfg_custom_ie 1 0
diff --git a/wlan_src/script/wifidirect/stop_wifidirect_client.sh b/wlan_src/script/wifidirect/stop_wifidirect_client.sh
new file mode 100755
index 0000000..5ae1ad5
--- /dev/null
+++ b/wlan_src/script/wifidirect/stop_wifidirect_client.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# deauth the GO first
+./wifidirectutl wfd0 wifidirect_mode 0
+# IE clear assume index 0, 1
+./uaputl.exe -i wfd0 sys_cfg_custom_ie 0 0
+./uaputl.exe -i wfd0 sys_cfg_custom_ie 1 0
diff --git a/wlan_src/script/wifidirect/update_mac.sh b/wlan_src/script/wifidirect/update_mac.sh
new file mode 100755
index 0000000..d744db9
--- /dev/null
+++ b/wlan_src/script/wifidirect/update_mac.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+MAC=`ifconfig wfd0 | grep wfd0 | tr -s ' ' | cut -d ' ' -f5`
+MAC26=`echo $MAC | cut -d ':' -f2-6`
+LAA=`echo $MAC | cut -d ':' -f1`
+LAA=$((0x$LAA+2))
+if [ $LAA -lt 16 ] ; then
+LAA=`printf "%X\n" $LAA`
+MACLAA=0$LAA:$MAC26
+else
+LAA=`printf "%X\n" $LAA`
+MACLAA=$LAA:$MAC26
+fi
+sed "s/00:50:43:00:00:00/$MAC/" config/wifidirect.conf > tmp$$
+mv tmp$$ config/wifidirect.conf
+sed "s/02:50:43:00:00:00/$MACLAA/" config/wifidirect.conf > tmp$$
+mv tmp$$ config/wifidirect.conf
diff --git a/wlan_src/script/wifidisplay/start_auto_go.sh b/wlan_src/script/wifidisplay/start_auto_go.sh
new file mode 100755
index 0000000..cc8b49a
--- /dev/null
+++ b/wlan_src/script/wifidisplay/start_auto_go.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# iwpriv mlan0 drvdbg 0x20037
+# change the mac address
+./wifidirect/update_mac.sh
+echo "wfd0 Mac address updated in config/wifidirect.conf"
+
+
+./wifidirectutl wfd0 wifidirect_config config/wifidirect.conf
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 1
+#else
+# iwpriv wfd0 bssrole 1
+#endif
+./uaputl.exe -i wfd0 sys_config config/uaputl_wifidirect.conf
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 0
+#else
+# iwpriv wfd0 bssrole 0
+#endif
+# iwpriv wfd0 bssrole 1
+# change the group owner parameters
+# either in uaputl_wifidirect.conf or using CLI below
+#./uaputl.exe -i wfd0 sys_cfg_wpa_passphrase 1234567890
+#./uaputl.exe -i wfd0 sys_cfg_eapol_gwk_hsk 2000 3
+#./uaputl.exe -i wfd0 sys_cfg_eapol_pwk_hsk 2000 3
+# iwpriv wfd0 bssrole 0
+./wifidirectutl wfd0 wifidirect_mode 1
+./wifidirectutl wfd0 wifidirect_mode 5
+
+#enable wifi-display
+./wifidirectutl wfd0 wifidisplay_mode 1
+./wifidirectutl wfd0 wifidisplay_config config/wifidisplay.conf
+
+iwpriv wfd0 bssrole 1
+./wifidirectutl wfd0 wifidirect_mode 2
+./uaputl.exe -i wfd0 bss_start
diff --git a/wlan_src/script/wifidisplay/start_find_phase.sh b/wlan_src/script/wifidisplay/start_find_phase.sh
new file mode 100755
index 0000000..8fef6d0
--- /dev/null
+++ b/wlan_src/script/wifidisplay/start_find_phase.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+# iwpriv wfd0 drvdbg 0x20037
+#change the mac address
+./wifidirect/update_mac.sh
+echo "wfd0 Mac address updated in config/wifidirect.conf"
+
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 1
+#else
+# iwpriv wfd0 bssrole 1
+#endif
+./uaputl.exe -i wfd0 sys_config config/uaputl_wifidirect.conf
+#ifdef STREAM_2X2
+iwpriv wfd0 bssrole 0
+#else
+# iwpriv wfd0 bssrole 0
+#endif
+./wifidirectutl wfd0 wifidirect_config config/wifidirect.conf
+# change the passphrase
+# either in uaputl_wifidirect.conf or using CLI below
+#./uaputl.exe -i wfd0 sys_cfg_wpa_passphrase 1234567890
+./wifidirectutl wfd0 wifidirect_mode 1
+./wifidirectutl wfd0 wifidirect_params_config config/wifidirect.conf
+./mlanconfig wfd0 hostcmd config/bg_scan_wifidirect.conf bgscfg
+./wifidirectutl wfd0 wifidirect_mode 4
+
+#enable wifi-display
+./wifidirectutl wfd0 wifidisplay_mode 1
+./wifidirectutl wfd0 wifidisplay_config config/wifidisplay.conf
+
diff --git a/wlan_src/script/wifidisplay/update_mac.sh b/wlan_src/script/wifidisplay/update_mac.sh
new file mode 100755
index 0000000..d744db9
--- /dev/null
+++ b/wlan_src/script/wifidisplay/update_mac.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+MAC=`ifconfig wfd0 | grep wfd0 | tr -s ' ' | cut -d ' ' -f5`
+MAC26=`echo $MAC | cut -d ':' -f2-6`
+LAA=`echo $MAC | cut -d ':' -f1`
+LAA=$((0x$LAA+2))
+if [ $LAA -lt 16 ] ; then
+LAA=`printf "%X\n" $LAA`
+MACLAA=0$LAA:$MAC26
+else
+LAA=`printf "%X\n" $LAA`
+MACLAA=$LAA:$MAC26
+fi
+sed "s/00:50:43:00:00:00/$MAC/" config/wifidirect.conf > tmp$$
+mv tmp$$ config/wifidirect.conf
+sed "s/02:50:43:00:00:00/$MACLAA/" config/wifidirect.conf > tmp$$
+mv tmp$$ config/wifidirect.conf