mxm_wifiex: update to mxm6x17437.p3 release

Corresponding firmware version: SDIO-UART W8987 Firmware version 16.92.21.p119.2 PCIE-UART W8997 Firmware version 16.92.21.p119.2 SDIO-UART W8997 Firmware version 16.92.21.p119.2 SDIO-UART IW416 Firmware version 16.92.21.p119.2 SDIO_UART IW612 Firmware version 18.99.2.p66.17 SDIO-UART W8801 Firmware version 14.92.36.p188 SDIO-UART W9098 Firmware version 17.92.1.p149.131 PCIE-UART W9098 Firmware version 17.92.1.p149.131 Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
2025-01-15 08:15:33 +00:00 · 2024-01-17 15:59:03 +08:00 · 2024-01-17 15:59:03 +08:00 · 08c1478cb7
commit 08c1478cb7
parent 0eeb07cb70
50 changed files with 1333 additions and 383 deletions
--- a/mxm_wifiex/wlan_src/Makefile
+++ b/mxm_wifiex/wlan_src/Makefile
@ -145,7 +145,7 @@ APPDIR= $(shell if test -d "mapp"; then echo mapp; fi)
 #############################################################################

 	ccflags-y += -I$(KERNELDIR)/include
-	ccflags-y += -DMLAN_RELEASE_VERSION='"437"'
+	ccflags-y += -DMLAN_RELEASE_VERSION='"437.p3"'

 	ccflags-y += -DFPNUM='"92"'

@ -266,10 +266,6 @@ ifeq ($(CONFIG_SDIW624),y)
 	CONFIG_SDIO=y
 	ccflags-y += -DSDIW624
 endif
-ifeq ($(CONFIG_SDAW693),y)
-	CONFIG_SDIO=y
-	ccflags-y += -DSDAW693
-endif
 ifeq ($(CONFIG_SD9177),y)
 	CONFIG_SDIO=y
 	ccflags-y += -DSD9177
@ -330,10 +326,6 @@ ifeq ($(CONFIG_PCIEIW624),y)
 	CONFIG_PCIE=y
 	ccflags-y += -DPCIEIW624
 endif
-ifeq ($(CONFIG_PCIEAW693),y)
-	CONFIG_PCIE=y
-	ccflags-y += -DPCIEAW693
-endif
 ifeq ($(CONFIG_SDIO),y)
 	ccflags-y += -DSDIO
 	ccflags-y += -DSDIO_MMC
--- a/mxm_wifiex/wlan_src/mlan/mlan_11d.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11d.c
@ -954,9 +954,9 @@ mlan_status wlan_ret_802_11d_domain_info(mlan_private *pmpriv,
 	/* Dump domain info response data */
 	HEXDUMP("11D: DOMAIN Info Rsp Data", (t_u8 *)resp, resp->size);

-	no_of_sub_band = (t_u8)(
-		(wlan_le16_to_cpu(domain->header.len) - COUNTRY_CODE_LEN) /
-		sizeof(IEEEtypes_SubbandSet_t));
+	no_of_sub_band = (t_u8)((wlan_le16_to_cpu(domain->header.len) -
+				 COUNTRY_CODE_LEN) /
+				sizeof(IEEEtypes_SubbandSet_t));

 	PRINTM(MINFO, "11D Domain Info Resp: number of sub-band=%d\n",
 	       no_of_sub_band);
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
@ -2456,6 +2456,7 @@ int wlan_cmd_append_11n_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	pmlan_adapter pmadapter = pmpriv->adapter;
 	MrvlIETypes_HTCap_t *pht_cap;
 	MrvlIEtypes_ChanListParamSet_t *pchan_list;
+	ChanScanParamSet_t *pchan_param;
 	MrvlIETypes_2040BSSCo_t *p2040_bss_co;
 	MrvlIETypes_ExtCap_t *pext_cap;
 	t_u32 usr_dot_11n_dev_cap, orig_usr_dot_11n_dev_cap = 0;
@ -2529,12 +2530,12 @@ int wlan_cmd_append_11n_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,

 	if (pbss_desc->pht_info) {
 		pchan_list = (MrvlIEtypes_ChanListParamSet_t *)*ppbuffer;
-		memset(pmadapter, pchan_list, 0,
-		       sizeof(MrvlIEtypes_ChanListParamSet_t));
 		pchan_list->header.type = wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
-		pchan_list->header.len =
-			sizeof(MrvlIEtypes_ChanListParamSet_t) -
-			sizeof(MrvlIEtypesHeader_t);
+		pchan_list->header.len = sizeof(ChanScanParamSet_t);
+
+		pchan_param = (ChanScanParamSet_t *)pchan_list->chan_scan_param;
+		memset(pmadapter, pchan_param, 0x00,
+		       sizeof(ChanScanParamSet_t));
 		pchan_list->chan_scan_param[0].chan_number =
 			pbss_desc->pht_info->ht_info.pri_chan;
 		pchan_list->chan_scan_param[0].bandcfg.chanBand =
@ -2568,11 +2569,14 @@ int wlan_cmd_append_11n_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 		pchan_list->chan_scan_param[0].bandcfg.scanMode =
 			SCAN_MODE_USER;
 		HEXDUMP("ChanList", (t_u8 *)pchan_list,
-			sizeof(MrvlIEtypes_ChanListParamSet_t));
+			sizeof(ChanScanParamSet_t) +
+				sizeof(MrvlIEtypesHeader_t));
 		HEXDUMP("pht_info", (t_u8 *)pbss_desc->pht_info,
 			sizeof(MrvlIETypes_HTInfo_t) - 2);
-		*ppbuffer += sizeof(MrvlIEtypes_ChanListParamSet_t);
-		ret_len += sizeof(MrvlIEtypes_ChanListParamSet_t);
+		*ppbuffer += sizeof(ChanScanParamSet_t) +
+			     sizeof(MrvlIEtypesHeader_t);
+		ret_len += sizeof(ChanScanParamSet_t) +
+			   sizeof(MrvlIEtypesHeader_t);
 		pchan_list->header.len =
 			wlan_cpu_to_le16(pchan_list->header.len);
 	}
@ -2954,10 +2958,11 @@ int wlan_send_addba(mlan_private *priv, int tid, t_u8 *peer_mac)
 	PRINTM(MCMND, "Send addba: TID %d, " MACSTR "\n", tid,
 	       MAC2STR(peer_mac));

-	add_ba_req.block_ack_param_set = (t_u16)(
-		(tid << BLOCKACKPARAM_TID_POS) |
-		(priv->add_ba_param.tx_win_size << BLOCKACKPARAM_WINSIZE_POS) |
-		IMMEDIATE_BLOCK_ACK);
+	add_ba_req.block_ack_param_set =
+		(t_u16)((tid << BLOCKACKPARAM_TID_POS) |
+			(priv->add_ba_param.tx_win_size
+			 << BLOCKACKPARAM_WINSIZE_POS) |
+			IMMEDIATE_BLOCK_ACK);
 	/** enable AMSDU inside AMPDU */
 	if (priv->add_ba_param.tx_amsdu &&
 	    (priv->aggr_prio_tbl[tid].amsdu != BA_STREAM_NOT_ALLOWED))
--- a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
@ -691,20 +691,21 @@ static cfp_table_t cfp_table_A[] = {
 /** Number of the CFP tables for 5GHz */
 #define MLAN_CFP_TABLE_SIZE_A (NELEMENTS(cfp_table_A))

-enum { RATEID_DBPSK1Mbps, //(0)
-       RATEID_DQPSK2Mbps, //(1)
-       RATEID_CCK5_5Mbps, //(2)
-       RATEID_CCK11Mbps, //(3)
-       RATEID_CCK22Mbps, //(4)
-       RATEID_OFDM6Mbps, //(5)
-       RATEID_OFDM9Mbps, //(6)
-       RATEID_OFDM12Mbps, //(7)
-       RATEID_OFDM18Mbps, //(8)
-       RATEID_OFDM24Mbps, //(9)
-       RATEID_OFDM36Mbps, //(10)
-       RATEID_OFDM48Mbps, //(11)
-       RATEID_OFDM54Mbps, //(12)
-       RATEID_OFDM72Mbps, //(13)
+enum {
+	RATEID_DBPSK1Mbps, //(0)
+	RATEID_DQPSK2Mbps, //(1)
+	RATEID_CCK5_5Mbps, //(2)
+	RATEID_CCK11Mbps, //(3)
+	RATEID_CCK22Mbps, //(4)
+	RATEID_OFDM6Mbps, //(5)
+	RATEID_OFDM9Mbps, //(6)
+	RATEID_OFDM12Mbps, //(7)
+	RATEID_OFDM18Mbps, //(8)
+	RATEID_OFDM24Mbps, //(9)
+	RATEID_OFDM36Mbps, //(10)
+	RATEID_OFDM48Mbps, //(11)
+	RATEID_OFDM54Mbps, //(12)
+	RATEID_OFDM72Mbps, //(13)
 };

 static const t_u8 rateUnit_500Kbps[] = {
@ -1912,9 +1913,9 @@ t_u8 wlan_get_txpwr_of_chan_from_cfp(mlan_private *pmpriv, t_u16 band,
 							(cfp_a + j)
 								->max_tx_power);
 					else
-						tx_power = (t_u8)(
-							(cfp_a + j)
-								->max_tx_power);
+						tx_power =
+							(t_u8)((cfp_a + j)
+								       ->max_tx_power);
 					break;
 				}
 			}
--- a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
@ -556,7 +556,11 @@ static t_void wlan_dump_info(mlan_adapter *pmadapter, t_u8 reason)
 	PRINTM(MERROR, "tx_lock_flag = %d\n", pmadapter->tx_lock_flag);
 	PRINTM(MERROR, "scan_processing = %d\n", pmadapter->scan_processing);
 	PRINTM(MERROR, "scan_state = 0x%x\n", pmadapter->scan_state);
-	PRINTM(MERROR, "bypass_pkt_count=%d\n", pmadapter->bypass_pkt_count);
+	PRINTM(MERROR, "bypass_pkt_count=%d\n",
+	       util_scalar_read(pmadapter->pmoal_handle,
+				&pmadapter->bypass_pkt_count,
+				pmadapter->callbacks.moal_spin_lock,
+				pmadapter->callbacks.moal_spin_unlock));
 #ifdef SDIO
 	if (IS_SD(pmadapter->card_type)) {
 		mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
@ -1356,6 +1360,12 @@ static mlan_status wlan_dnld_cmd_to_fw(mlan_private *pmpriv,
 	if (pcmd->command == HostCmd_CMD_802_11_SCAN_EXT)
 		pmadapter->scan_state |= wlan_get_ext_scan_state(pcmd);

+	if (pmpriv->bss_mode == MLAN_BSS_MODE_INFRA &&
+	    pmpriv->media_connected &&
+	    (pcmd->command == HostCmd_CMD_802_11_DEAUTHENTICATE ||
+	     pcmd->command == HostCmd_CMD_802_11_DISASSOCIATE))
+		wlan_clean_txrx(pmpriv);
+
 	PRINTM_GET_SYS_TIME(MCMND, &sec, &usec);
 	PRINTM_NETINTF(MCMND, pmpriv);
 	PRINTM(MCMND,
@ -2765,6 +2775,13 @@ t_void wlan_cancel_all_pending_cmd(pmlan_adapter pmadapter, t_u8 flag)
 		}
 	}

+	if (pmadapter->cmd_timer_is_set) {
+		pcb->moal_stop_timer(pmadapter->pmoal_handle,
+				     pmadapter->pmlan_cmd_timer);
+		/* Cancel command timeout timer */
+		pmadapter->cmd_timer_is_set = MFALSE;
+	}
+
 	/* Cancel all pending command */
 	while ((pcmd_node = (cmd_ctrl_node *)util_peek_list(
 			pmadapter->pmoal_handle, &pmadapter->cmd_pending_q,
@ -5461,8 +5478,9 @@ mlan_status wlan_process_csi_event(pmlan_private pmpriv)
 				  MLAN_MEM_DEF, &evt_buf);
 	if ((status == MLAN_STATUS_SUCCESS) && evt_buf) {
 		t_u16 csi_sig;
-		pcsi_record_ds csi_record = (pcsi_record_ds)(
-			pmbuf->pbuf + pmbuf->data_offset + sizeof(eventcause));
+		pcsi_record_ds csi_record =
+			(pcsi_record_ds)(pmbuf->pbuf + pmbuf->data_offset +
+					 sizeof(eventcause));
 		/* Check CSI signature */
 		csi_sig = csi_record->CSI_Sign;
 		if (csi_sig != CSI_SIGNATURE) {
@ -5966,6 +5984,56 @@ mlan_status wlan_cmd_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *pcmd)
 }

 #ifdef SDIO
+/**
+ *  @brief This function prepares command of sdio rx aggr command.
+ *
+ *  @param pcmd         A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   Command action: GET or SET
+ *  @param pdata_buf    A pointer to new setting buf
+
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_sdio_rx_aggr_cfg(HostCmd_DS_COMMAND *pcmd,
+				      t_u16 cmd_action, t_void *pdata_buf)
+{
+	HostCmd_DS_SDIO_SP_RX_AGGR_CFG *cfg = &pcmd->params.sdio_rx_aggr;
+
+	pcmd->command = wlan_cpu_to_le16(HostCmd_CMD_SDIO_SP_RX_AGGR_CFG);
+	pcmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_SDIO_SP_RX_AGGR_CFG) +
+				      S_DS_GEN);
+	cfg->action = cmd_action;
+	if (pdata_buf && (cmd_action == HostCmd_ACT_GEN_SET))
+		cfg->enable = *(t_u8 *)pdata_buf;
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of sdio rx aggr command
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+mlan_status wlan_ret_sdio_rx_aggr_cfg(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	HostCmd_DS_SDIO_SP_RX_AGGR_CFG *cfg = &resp->params.sdio_rx_aggr;
+
+	pmadapter->pcard_sd->sdio_rx_aggr_enable = cfg->enable;
+	pmadapter->pcard_sd->sdio_rx_block_size =
+		wlan_le16_to_cpu(cfg->sdio_block_size);
+	PRINTM(MMSG, "SDIO rx aggr: %d block_size=%d\n", cfg->enable,
+	       pmadapter->pcard_sd->sdio_rx_block_size);
+	if (!pmadapter->pcard_sd->sdio_rx_block_size)
+		pmadapter->pcard_sd->sdio_rx_aggr_enable = MFALSE;
+	if (pmadapter->pcard_sd->sdio_rx_aggr_enable) {
+		pmadapter->pcard_sd->max_sp_rx_size = SDIO_CMD53_MAX_SIZE;
+		wlan_re_alloc_sdio_rx_mpa_buffer(pmadapter);
+	}
+	return MLAN_STATUS_SUCCESS;
+}
 #endif

 /**
@ -6314,6 +6382,22 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,

 #ifdef SDIO
 	if (IS_SD(pmadapter->card_type)) {
+		if ((pmadapter->fw_cap_info & SDIO_SP_RX_AGGR_ENABLE) &&
+		    pmadapter->pcard_sd->sdio_rx_aggr_enable) {
+			t_u8 sdio_sp_rx_aggr = MTRUE;
+			ret = wlan_prepare_cmd(pmpriv,
+					       HostCmd_CMD_SDIO_SP_RX_AGGR_CFG,
+					       HostCmd_ACT_GEN_SET, 0, MNULL,
+					       &sdio_sp_rx_aggr);
+			if (ret) {
+				ret = MLAN_STATUS_FAILURE;
+				goto done;
+			}
+		} else {
+			pmadapter->pcard_sd->sdio_rx_aggr_enable = MFALSE;
+			PRINTM(MCMND, "FW: SDIO rx aggr disabled 0x%x\n",
+			       pmadapter->fw_cap_info);
+		}
 	}
 #endif
 #ifdef STA_SUPPORT
@ -6413,6 +6497,8 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 			fw_cap_tlv = (MrvlIEtypes_fw_cap_info_t *)tlv;
 			pmadapter->fw_cap_info =
 				wlan_le32_to_cpu(fw_cap_tlv->fw_cap_info);
+			pmadapter->fw_cap_info &=
+				pmadapter->init_para.dev_cap_mask;
 			pmadapter->fw_cap_ext =
 				wlan_le32_to_cpu(fw_cap_tlv->fw_cap_ext);
 			PRINTM(MCMND, "fw_cap_info=0x%x fw_cap_ext=0x%x\n",
--- a/mxm_wifiex/wlan_src/mlan/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
@ -278,7 +278,14 @@ typedef t_s32 t_sval;

 #ifdef PCIE
 /* Interrupt type */
-enum { RX_DATA, RX_EVENT, TX_COMPLETE, RX_CMD_RESP, RX_CMD_DNLD };
+enum {
+	RX_DATA,
+	RX_EVENT,
+	TX_COMPLETE,
+	RX_CMD_RESP,
+	RX_CMD_DNLD,
+	RX_DATA_DELAY
+};
 #endif
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
@ -388,6 +395,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_IW624 0x0b
 /** Black bird card type */
 #define CARD_TYPE_AW693 0x0c
+/** IW615 card type */
+#define CARD_TYPE_IW615 0x0c

 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
@ -423,6 +432,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_SDIW624 (CARD_TYPE_IW624 | (INTF_SD << 8))
 /** SD_IW624 card type */
 #define CARD_TYPE_SDAW693 (CARD_TYPE_AW693 | (INTF_SD << 8))
+/** SD_IW615 card type */
+#define CARD_TYPE_SDIW615 (CARD_TYPE_IW615 | (INTF_SD << 8))

 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@ -436,6 +447,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
 #define IS_SDIW624(ct) (CARD_TYPE_SDIW624 == (ct))
 #define IS_SDAW693(ct) (CARD_TYPE_SDAW693 == (ct))
+#define IS_SDIW615(ct) (CARD_TYPE_SDIW615 == (ct))

 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@ -461,6 +473,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SDIW624 "SDIW624"
 /** SDAW693 Card */
 #define CARD_SDAW693 "SDAW693"
+/** SDIW615 Card */
+#define CARD_SDIW615 "SDIW615"
 #endif

 #ifdef PCIE
@ -519,6 +533,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
 /** USBIW624 card type */
 #define CARD_TYPE_USBIW624 (CARD_TYPE_IW624 | (INTF_USB << 8))
+/** USBIW615 card type */
+#define CARD_TYPE_USBIW615 (CARD_TYPE_IW615 | (INTF_USB << 8))

 #define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
@ -527,6 +543,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
 #define IS_USBIW624(ct) (CARD_TYPE_USBIW624 == (ct))
+#define IS_USBIW615(ct) (CARD_TYPE_USBIW615 == (ct))

 /** USB8801 Card */
 #define CARD_USB8801 "USB8801"
@ -542,6 +559,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9097 "USBIW620"
 /** USBIW624 Card */
 #define CARD_USBIW624 "USBIW624"
+/** USBIW615 Card */
+#define CARD_USBIW615 "USBIW615"
 #endif

 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
@ -555,6 +574,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
 #define IS_CARDIW624(ct) (CARD_TYPE_IW624 == ((ct)&0xf))
 #define IS_CARDAW693(ct) (CARD_TYPE_AW693 == ((ct)&0xf))
+#define IS_CARDIW615(ct) (CARD_TYPE_IW615 == ((ct)&0xf))

 typedef struct _card_type_entry {
 	t_u16 card_type;
@ -714,6 +734,7 @@ typedef enum _mlan_buf_type {
 	MLAN_BUF_TYPE_EVENT,
 	MLAN_BUF_TYPE_RAW_DATA,
 #ifdef SDIO
+	MLAN_BUF_TYPE_SPA_DATA,
 #endif
 } mlan_buf_type;

@ -945,29 +966,34 @@ enum mlan_channel_type {
 };

 /** channel band */
-enum { BAND_2GHZ = 0,
-       BAND_5GHZ = 1,
-       BAND_6GHZ = 2,
-       BAND_4GHZ = 3,
+enum {
+	BAND_2GHZ = 0,
+	BAND_5GHZ = 1,
+	BAND_6GHZ = 2,
+	BAND_4GHZ = 3,
 };

 /** channel offset */
-enum { SEC_CHAN_NONE = 0,
-       SEC_CHAN_ABOVE = 1,
-       SEC_CHAN_5MHZ = 2,
-       SEC_CHAN_BELOW = 3 };
+enum {
+	SEC_CHAN_NONE = 0,
+	SEC_CHAN_ABOVE = 1,
+	SEC_CHAN_5MHZ = 2,
+	SEC_CHAN_BELOW = 3
+};

 /** channel bandwidth */
-enum { CHAN_BW_20MHZ = 0,
-       CHAN_BW_10MHZ,
-       CHAN_BW_40MHZ,
-       CHAN_BW_80MHZ,
+enum {
+	CHAN_BW_20MHZ = 0,
+	CHAN_BW_10MHZ,
+	CHAN_BW_40MHZ,
+	CHAN_BW_80MHZ,
 };

 /** scan mode */
-enum { SCAN_MODE_MANUAL = 0,
-       SCAN_MODE_ACS,
-       SCAN_MODE_USER,
+enum {
+	SCAN_MODE_MANUAL = 0,
+	SCAN_MODE_ACS,
+	SCAN_MODE_USER,
 };

 /** DFS state */
@ -2646,6 +2672,8 @@ typedef struct _mlan_device {
 	/** SDIO MPA Rx */
 	t_u32 mpa_rx_cfg;
 #ifdef SDIO
+	/** SDIO Single port rx aggr */
+	t_u8 sdio_rx_aggr_enable;
 	/* see blk_queue_max_segment_size */
 	t_u32 max_seg_size;
 	/* see blk_queue_max_segments */
--- a/mxm_wifiex/wlan_src/mlan/mlan_fw.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
@ -1151,6 +1151,8 @@ enum host_cmd_id {
 #define TLV_TYPE_PREV_BSSID (PROPRIETARY_TLV_BASE_ID + 330)

 #ifdef SDIO
+/** fw_cap_info bit16 for sdio sp rx aggr flag*/
+#define SDIO_SP_RX_AGGR_ENABLE MBIT(16)

 #endif

@ -1292,7 +1294,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_Extension_t {
 	/** Element id extension */
 	t_u8 ext_id;
 	/** payload */
-	t_u8 data[1];
+	t_u8 data[];
 } MLAN_PACK_END MrvlIEtypes_Extension_t, *pMrvlIEtypes_Extension_t;

 /* HE MAC Capabilities Information field BIT 1 for TWT Req */
@ -1635,7 +1637,7 @@ typedef MLAN_PACK_START struct _ie_data {
 	/** IE Length */
 	t_u16 ie_length;
 	/** IE pointer */
-	t_u8 ie_ptr[1];
+	t_u8 ie_ptr[];
 } MLAN_PACK_END tdls_ie_data;

 /** Event structure for generic events from TDLS FW */
@ -1706,7 +1708,7 @@ typedef MLAN_PACK_START struct _WLAN_802_11_VARIABLE_IEs {
 	/** Length */
 	t_u8 length;
 	/** IE data */
-	t_u8 data[1];
+	t_u8 data[];
 } MLAN_PACK_END WLAN_802_11_VARIABLE_IEs;

 /** TLV related data structures*/
@ -2156,7 +2158,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_ChanListParamSet_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** Channel scan parameters */
-	ChanScanParamSet_t chan_scan_param[1];
+	ChanScanParamSet_t chan_scan_param[];
 } MLAN_PACK_END MrvlIEtypes_ChanListParamSet_t;

 /** MrvlIEtypes_EESParamSet_t */
@ -2206,7 +2208,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_ChanBandListParamSet_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** Channel Band parameters */
-	ChanBandParamSet_t chan_band_param[1];
+	ChanBandParamSet_t chan_band_param[];
 } MLAN_PACK_END MrvlIEtypes_ChanBandListParamSet_t;

 /** MrvlIEtypes_RatesParamSet_t */
@ -2214,7 +2216,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_RatesParamSet_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** Rates */
-	t_u8 rates[1];
+	t_u8 rates[];
 } MLAN_PACK_END MrvlIEtypes_RatesParamSet_t;

 /** _MrvlIEtypes_Bssid_List_t */
@ -2230,7 +2232,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_SsIdParamSet_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** SSID */
-	t_u8 ssid[1];
+	t_u8 ssid[];
 } MLAN_PACK_END MrvlIEtypes_SsIdParamSet_t;

 /**MrvlIEtypes_AssocType_t */
@ -2264,7 +2266,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_WildCardSsIdParamSet_t {
 	/** Maximum SSID length */
 	t_u8 max_ssid_length;
 	/** SSID */
-	t_u8 ssid[1];
+	t_u8 ssid[];
 } MLAN_PACK_END MrvlIEtypes_WildCardSsIdParamSet_t;

 /**TSF data size */
@ -2275,7 +2277,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_TsfTimestamp_t {
 	MrvlIEtypesHeader_t header;
 	/** the length of each TSF data is 8 bytes, could be multiple TSF here
 	 */
-	t_u8 tsf_data[1];
+	t_u8 tsf_data[];
 } MLAN_PACK_END MrvlIEtypes_TsfTimestamp_t;

 /** CfParamSet_t */
@ -2402,7 +2404,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_RxBaSync_t {
 	/** bitmap len */
 	t_u16 bitmap_len;
 	/** bitmap */
-	t_u8 bitmap[1];
+	t_u8 bitmap[];
 } MLAN_PACK_END MrvlIEtypes_RxBaSync_t;

 /** MrvlIEtypes_RsnParamSet_t */
@ -2715,7 +2717,7 @@ typedef MLAN_PACK_START struct _MrvlIETypes_ChanTRPCConfig_t {
 	/** channel number */
 	t_u8 chan_num;
 	/** mode groups */
-	mod_group_setting mod_group[1];
+	mod_group_setting mod_group[];
 } MLAN_PACK_END MrvlIETypes_ChanTRPCConfig_t;

 /* HostCmd_DS_CHANNEL_TRPC_CONFIG */
@ -3072,6 +3074,12 @@ typedef MLAN_PACK_START struct _HostCmd_DS_GET_HW_SPEC {
 } MLAN_PACK_END HostCmd_DS_GET_HW_SPEC;

 #ifdef SDIO
+/* HostCmd_DS_SDIO_SP_RX_AGGR_CFG */
+typedef MLAN_PACK_START struct _HostCmd_DS_SDIO_SP_RX_AGGR_CFG {
+	t_u8 action;
+	t_u8 enable;
+	t_u16 sdio_block_size;
+} MLAN_PACK_END HostCmd_DS_SDIO_SP_RX_AGGR_CFG;
 #endif

 /**  HostCmd_DS_802_11_CFG_DATA */
@ -3172,7 +3180,7 @@ typedef MLAN_PACK_START struct _HostCmd_DS_STATS {
 	/** Action */
 	t_u16 action;
 	/** TLV buffer */
-	t_u8 tlv_buffer[1];
+	t_u8 tlv_buffer[];
 } MLAN_PACK_END HostCmd_DS_STATS;

 typedef MLAN_PACK_START struct _HostCmd_DS_GET_CH_LOAD {
@ -4783,7 +4791,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_WmmParamSet_t {
 	/** Header */
 	MrvlIEtypesHeader_t header;
 	/** WMM IE */
-	t_u8 wmm_ie[1];
+	t_u8 wmm_ie[];
 } MLAN_PACK_END MrvlIEtypes_WmmParamSet_t;

 /** MrvlIEtypes_WmmQueueStatus_t */
@ -6237,7 +6245,7 @@ typedef MLAN_PACK_START struct _HostCmd_DS_SYS_CONFIG {
 	/** CMD Action GET/SET*/
 	t_u16 action;
 	/** Tlv buffer */
-	t_u8 tlv_buffer[1];
+	t_u8 tlv_buffer[];
 } MLAN_PACK_END HostCmd_DS_SYS_CONFIG;

 /** HostCmd_SYS_CONFIG */
@ -7688,6 +7696,7 @@ typedef struct MLAN_PACK_START _HostCmd_DS_COMMAND {
 		/** Hardware specifications */
 		HostCmd_DS_GET_HW_SPEC hw_spec;
 #ifdef SDIO
+		HostCmd_DS_SDIO_SP_RX_AGGR_CFG sdio_rx_aggr;
 #endif
 		/** Cfg data */
 		HostCmd_DS_802_11_CFG_DATA cfg_data;
--- a/mxm_wifiex/wlan_src/mlan/mlan_hostcmd_ids.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_hostcmd_ids.h
@ -271,6 +271,8 @@ ENUM_ELEMENT(HostCmd_CMD_GET_HW_SPEC, 0x0003),
 	ENUM_ELEMENT(HostCmd_CMD_PACKET_AGGR_OVER_HOST_INTERFACE, 0x0117),

 #ifdef SDIO
+	/** Host Command ID : SDIO single port RX aggr */
+	ENUM_ELEMENT(HostCmd_CMD_SDIO_SP_RX_AGGR_CFG, 0x0223),
 #endif

 	/** Host Command ID : Extended scan support */
--- a/mxm_wifiex/wlan_src/mlan/mlan_init.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_init.c
@ -900,7 +900,7 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)

 	wlan_wmm_init(pmadapter);
 	wlan_init_wmm_param(pmadapter);
-	pmadapter->bypass_pkt_count = 0;
+
 	if (pmadapter->psleep_cfm) {
 		pmadapter->psleep_cfm->buf_type = MLAN_BUF_TYPE_CMD;
 		pmadapter->psleep_cfm->data_len = sizeof(OPT_Confirm_Sleep);
@ -1187,9 +1187,13 @@ mlan_status wlan_init_lock_list(pmlan_adapter pmadapter)
 	util_init_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->rx_data_queue, MTRUE,
 			    pmadapter->callbacks.moal_init_lock);
+	util_scalar_init((t_void *)pmadapter->pmoal_handle,
+			 &pmadapter->bypass_pkt_count, 0, MNULL,
+			 pmadapter->callbacks.moal_init_lock);
 	util_scalar_init((t_void *)pmadapter->pmoal_handle,
 			 &pmadapter->pending_bridge_pkts, 0, MNULL,
 			 pmadapter->callbacks.moal_init_lock);
+
 	/* Initialize cmd_free_q */
 	util_init_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->cmd_free_q, MTRUE,
@ -1297,8 +1301,11 @@ t_void wlan_free_lock_list(pmlan_adapter pmadapter)
 	util_free_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->rx_data_queue, pcb->moal_free_lock);

+	util_scalar_free((t_void *)pmadapter->pmoal_handle,
+			 &pmadapter->bypass_pkt_count, pcb->moal_free_lock);
 	util_scalar_free((t_void *)pmadapter->pmoal_handle,
 			 &pmadapter->pending_bridge_pkts, pcb->moal_free_lock);
+
 	util_free_list_head((t_void *)pmadapter->pmoal_handle,
 			    &pmadapter->cmd_free_q,
 			    pmadapter->callbacks.moal_free_lock);
--- a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
@ -2410,6 +2410,8 @@ typedef struct _mlan_debug_info {
 	t_u32 last_int_status;
 	/** number of interrupt receive */
 	t_u32 num_of_irq;
+	/** flag for sdio rx aggr */
+	t_u8 sdio_rx_aggr;
 	/** FW update port number */
 	t_u32 mp_update[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX * 2];
 	/** Invalid port update count */
@ -4280,12 +4282,13 @@ enum _mlan_reg_type {
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
 	defined(PCIEIW624) || defined(USBIW624) || defined(SD9097) ||          \
-	defined(SD9177)
+	defined(SD9177) || defined(SDIW615) || defined(USBIW615)
 	MLAN_REG_CIU = 8,
 #endif
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
-	defined(PCIEIW624) || defined(USBIW624) || defined(SD9097)
+	defined(PCIEIW624) || defined(USBIW624) || defined(SD9097) ||          \
+	defined(SDIW615) || defined(USBIW615)
 	MLAN_REG_MAC2 = 0x81,
 	MLAN_REG_BBP2 = 0x82,
 	MLAN_REG_RF2 = 0x83,
@ -6122,7 +6125,7 @@ typedef struct _mlan_ds_stats {
 	/** tlv len */
 	t_u16 tlv_len;
 	/** TLV buffer */
-	t_u8 tlv_buf[1];
+	t_u8 tlv_buf[];
 } mlan_ds_stats;

 typedef struct _mlan_ds_ch_load {
--- a/mxm_wifiex/wlan_src/mlan/mlan_join.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_join.c
@ -672,7 +672,7 @@ static int wlan_update_rsn_ie(mlan_private *pmpriv,
 	t_u8 preference_selected;
 	t_u8 cipher_selected_id;
 #if 0 // defined(ENABLE_GCMP_SUPPORT)
-      // embedded supplicant doesn't support GCMP yet
+      //  embedded supplicant doesn't support GCMP yet
 	t_u8 cipher_preference[11] = {0, 0, 1, 0, 2, 0, 0, 0, 4, 5, 3};
 #else
 	t_u8 cipher_preference[5] = {0, 0, 1, 0, 2};
@ -1984,7 +1984,6 @@ mlan_status wlan_disconnect(mlan_private *pmpriv, mlan_ioctl_req *pioctl_req,
 		memcpy_ext(pmpriv->adapter, &local_param, deauth_param,
 			   sizeof(*deauth_param), sizeof(local_param));
 	if (pmpriv->media_connected == MTRUE) {
-		wlan_clean_txrx(pmpriv);
 		if (pmpriv->bss_mode == MLAN_BSS_MODE_INFRA) {
 			if (!deauth_param ||
 			    !memcmp(pmpriv->adapter, deauth_param->mac_addr,
--- a/mxm_wifiex/wlan_src/mlan/mlan_main.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_main.h
@ -558,11 +558,20 @@ extern t_void (*assert_callback)(t_void *pmoal_handle, t_u32 cond);
 /** Type vdll */
 #define MLAN_TYPE_VDLL 4
 #ifdef SDIO
+/** Type single port aggr data */
+#define MLAN_TYPE_SPA_DATA 10
+/** OFFSET of 512 block number */
+#define OFFSET_OF_BLOCK_NUMBER 15
+/** OFFSET of SDIO Header */
+#define OFFSET_OF_SDIO_HEADER 28
+/** sdio max rx size for cmd53, 255 * 256, reserve 1 block for DMA alignment */
+#define SDIO_CMD53_MAX_SIZE 65280
 #define MAX_SUPPORT_AMSDU_SIZE 4096
 /** Maximum numbfer of registers to read for multiple port */
 #if defined(SD8887) || defined(SD8997) || defined(SD8977) ||                   \
 	defined(SD8987) || defined(SD9098) || defined(SD9097) ||               \
-	defined(SDIW624) || defined(SD8978) || defined(SD9177)
+	defined(SDIW624) || defined(SD8978) || defined(SD9177) ||              \
+	defined(SDIW615)
 #define MAX_MP_REGS 196
 #else
 /* upto 0xB7 */
@ -2093,6 +2102,10 @@ typedef struct _mlan_sdio_card {
 	/** GPIO interrupt pin number */
 	t_u32 gpio_pin;

+	/** flag for sdio rx aggr */
+	t_bool sdio_rx_aggr_enable;
+	/** fw rx block size */
+	t_u16 sdio_rx_block_size;
 } mlan_sdio_card, *pmlan_sdio_card;
 #endif

@ -2362,7 +2375,9 @@ struct _mlan_adapter {
 	/** pcie cmd_dnld_int flag */
 	t_u8 pcie_cmd_dnld_int;
 	/** more_tx_task_flag */
-	t_u32 more_tx_task_flag;
+	t_u8 more_tx_task_flag;
+	/** more event flag */
+	t_u8 more_event_flag;
 	/** tx data lock to synchronize send_data and send_data_complete */
 	t_void *pmlan_tx_lock;
 	/** event lock to synchronize process_event and event_ready */
@ -2827,7 +2842,7 @@ struct _mlan_adapter {
 	/** management frame wakeup filter config */
 	mlan_mgmt_frame_wakeup mgmt_filter[MAX_MGMT_FRAME_FILTER];
 	/** Bypass TX queue pkt count  */
-	t_u32 bypass_pkt_count;
+	mlan_scalar bypass_pkt_count;
 #ifdef STA_SUPPORT
 	/** warm-reset IOCTL request buffer pointer */
 	pmlan_ioctl_req pwarm_reset_ioctl_req;
@ -2914,9 +2929,16 @@ struct _mlan_adapter {
 #define MLAN_ETHER_PKT_TYPE_ARP (0x0806)
 /** Ethernet packet type for WAPI */
 #define MLAN_ETHER_PKT_TYPE_WAPI (0x88B4)
+/** Ethernet packet type for IP */
+#define MLAN_ETHER_PKT_TYPE_IP (0x0800)
 /** Ethernet packet type offset */
 #define MLAN_ETHER_PKT_TYPE_OFFSET (12)

+/** IP packet Protocol number for ICMP */
+#define MLAN_IP_PROTOCOL_ICMP (0x01)
+/** IP packet Protocol number offset */
+#define MLAN_IP_PROTOCOL_OFFSET (11)
+
 /** Rx packet Sniffer Operation Mode
 *
 * MODE1 : Can be enabled only in disconnected state.
@ -3998,6 +4020,10 @@ mlan_status wlan_cmd_get_hw_spec(pmlan_private pmpriv,
 mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				 t_void *pioctl_buf);
 #ifdef SDIO
+mlan_status wlan_cmd_sdio_rx_aggr_cfg(HostCmd_DS_COMMAND *pcmd,
+				      t_u16 cmd_action, t_void *pdata_buf);
+mlan_status wlan_ret_sdio_rx_aggr_cfg(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp);
 #endif

 mlan_status wlan_misc_ioctl_mac_control(pmlan_adapter pmadapter,
--- a/mxm_wifiex/wlan_src/mlan/mlan_misc.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
@ -466,7 +466,11 @@ mlan_status wlan_get_info_debug_info(pmlan_adapter pmadapter,
 		debug_info->tx_lock_flag = pmadapter->tx_lock_flag;
 		debug_info->port_open = pmpriv->port_open;
 		debug_info->tx_pause = pmpriv->tx_pause;
-		debug_info->bypass_pkt_count = pmadapter->bypass_pkt_count;
+		debug_info->bypass_pkt_count =
+			util_scalar_read(pmadapter->pmoal_handle,
+					 &pmadapter->bypass_pkt_count,
+					 pmadapter->callbacks.moal_spin_lock,
+					 pmadapter->callbacks.moal_spin_unlock);
 		debug_info->scan_processing = pmadapter->scan_processing;
 		debug_info->scan_state = pmadapter->scan_state;
 		debug_info->mlan_processing = pmadapter->mlan_processing;
@ -591,6 +595,8 @@ mlan_status wlan_get_info_debug_info(pmlan_adapter pmadapter,
 			debug_info->mpa_buf = pmadapter->pcard_sd->mpa_buf;
 			debug_info->mpa_buf_size =
 				pmadapter->pcard_sd->mpa_buf_size;
+			debug_info->sdio_rx_aggr =
+				pmadapter->pcard_sd->sdio_rx_aggr_enable;
 			memcpy_ext(pmadapter, debug_info->mpa_rx_count,
 				   pmadapter->pcard_sd->mpa_rx_count,
 				   sizeof(pmadapter->pcard_sd->mpa_rx_count),
@ -1711,7 +1717,7 @@ mlan_status wlan_reg_mem_ioctl_reg_rw(pmlan_adapter pmadapter,
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
 	defined(PCIEIW624) || defined(USBIW624) || defined(SD9097) ||          \
-	defined(SD9177)
+	defined(SD9177) || defined(SDIW615) || defined(USBIW615)
 	case MLAN_REG_CIU:
 		cmd_no = HostCmd_CMD_REG_ACCESS;
 		break;
@ -3338,6 +3344,7 @@ mlan_status wlan_process_802dot11_mgmt_pkt(mlan_private *priv, t_u8 *payload,
 					    (t_u8 *)priv->curr_bss_params
 						    .bss_descriptor.mac_address,
 					    MLAN_MAC_ADDR_LENGTH)) ||
+				    !priv->assoc_rsp_size ||
 				    !memcmp(pmadapter, pieee_pkt_hdr->addr3,
 					    (t_u8 *)priv->curr_bss_params
 						    .prev_bssid,
@ -3352,8 +3359,9 @@ mlan_status wlan_process_802dot11_mgmt_pkt(mlan_private *priv, t_u8 *payload,
 				}
 				PRINTM_NETINTF(MMSG, priv);
 				PRINTM(MMSG,
-				       "wlan: HostMlme Disconnected: sub_type=%d\n",
-				       sub_type);
+				       "wlan: HostMlme Disconnected: sub_type=%d " MACSTR
+				       "\n",
+				       sub_type, MAC2STR(pieee_pkt_hdr->addr3));
 				pmadapter->pending_disconnect_priv = priv;
 				wlan_recv_event(
 					priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
@ -3167,7 +3167,6 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)

 		event = *((t_u32 *)&pmbuf_evt->pbuf[pmbuf_evt->data_offset +
 						    PCIE_INTF_HEADER_LEN]);
-		pmadapter->event_cause = wlan_le32_to_cpu(event);
 		/* The first 4bytes will be the event transfer header
 		   len is 2 bytes followed by type which is 2 bytes */
 		evt_len = *((t_u16 *)&pmbuf_evt->pbuf[pmbuf_evt->data_offset]);
@ -3185,7 +3184,13 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)
 		pmbuf_evt->data_len = evt_len - PCIE_INTF_HEADER_LEN;
 		PRINTM(MINFO, "Event length: %d\n", pmbuf_evt->data_len);

+		pcb->moal_spin_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_event_lock);
+		pmadapter->event_cause = wlan_le32_to_cpu(event);
 		pmadapter->event_received = MTRUE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_event_lock);
+
 		pmadapter->pmlan_buffer_event = pmbuf_evt;
 		pmadapter->pcard_pcie->evtbd_rdptr++;
 #if defined(PCIE8997) || defined(PCIE8897)
@ -3241,18 +3246,27 @@ static void wlan_pcie_process_event(mlan_adapter *pmadapter)
 			    pmadapter->pmlan_event_lock);
 	if (pmadapter->pcie_event_processing || pmadapter->event_received ||
 	    pmadapter->event_cause) {
+		pmadapter->more_event_flag = MTRUE;
 		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
 				      pmadapter->pmlan_event_lock);
 		goto exit_event_proc;
 	} else {
 		pmadapter->pcie_event_processing = MTRUE;
+		pmadapter->more_event_flag = MFALSE;
 		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
 				      pmadapter->pmlan_event_lock);
 	}
+event_process_start:
 	wlan_pcie_process_event_ready(pmadapter);

 	pcb->moal_spin_lock(pmadapter->pmoal_handle,
 			    pmadapter->pmlan_event_lock);
+	if (pmadapter->more_event_flag && !pmadapter->event_cause) {
+		pmadapter->more_event_flag = MFALSE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_event_lock);
+		goto event_process_start;
+	}
 	pmadapter->pcie_event_processing = MFALSE;
 	pcb->moal_spin_unlock(pmadapter->pmoal_handle,
 			      pmadapter->pmlan_event_lock);
@ -4608,21 +4622,24 @@ mlan_status wlan_set_pcie_buf_config(mlan_private *pmpriv)
 		/* Send the ring base addresses and count to firmware */
 		host_spec.txbd_addr_lo = wlan_cpu_to_le32(
 			(t_u32)(pmadapter->pcard_pcie->txbd_ring_pbase));
-		host_spec.txbd_addr_hi = wlan_cpu_to_le32((t_u32)(
-			((t_u64)pmadapter->pcard_pcie->txbd_ring_pbase) >> 32));
+		host_spec.txbd_addr_hi = wlan_cpu_to_le32((
+			t_u32)(((t_u64)pmadapter->pcard_pcie->txbd_ring_pbase) >>
+			       32));
 		host_spec.txbd_count =
 			wlan_cpu_to_le32(pmadapter->pcard_pcie->txrx_bd_size);
 		host_spec.rxbd_addr_lo = wlan_cpu_to_le32(
 			(t_u32)(pmadapter->pcard_pcie->rxbd_ring_pbase));
-		host_spec.rxbd_addr_hi = wlan_cpu_to_le32((t_u32)(
-			((t_u64)pmadapter->pcard_pcie->rxbd_ring_pbase) >> 32));
+		host_spec.rxbd_addr_hi = wlan_cpu_to_le32((
+			t_u32)(((t_u64)pmadapter->pcard_pcie->rxbd_ring_pbase) >>
+			       32));
 		host_spec.rxbd_count =
 			wlan_cpu_to_le32(pmadapter->pcard_pcie->txrx_bd_size);
 		host_spec.evtbd_addr_lo = wlan_cpu_to_le32(
 			(t_u32)(pmadapter->pcard_pcie->evtbd_ring_pbase));
-		host_spec.evtbd_addr_hi = wlan_cpu_to_le32((t_u32)(
-			((t_u64)pmadapter->pcard_pcie->evtbd_ring_pbase) >>
-			32));
+		host_spec.evtbd_addr_hi =
+			wlan_cpu_to_le32((t_u32)(((t_u64)pmadapter->pcard_pcie
+							  ->evtbd_ring_pbase) >>
+						 32));
 		host_spec.evtbd_count = wlan_cpu_to_le32(MLAN_MAX_EVT_BD);

 		ret = wlan_prepare_cmd(pmpriv,
--- a/mxm_wifiex/wlan_src/mlan/mlan_scan.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
@ -408,6 +408,15 @@ static t_s32 wlan_find_best_network_in_list(mlan_private *pmpriv)
 	for (i = 0; i < pmadapter->num_in_scan_table; i++) {
 		switch (mode) {
 		case MLAN_BSS_MODE_INFRA:
+			if (wlan_is_network_compatible(pmpriv, i, mode) >= 0) {
+				if (SCAN_RSSI(pmadapter->pscan_table[i].rssi) >
+				    best_rssi) {
+					best_rssi = SCAN_RSSI(
+						pmadapter->pscan_table[i].rssi);
+					best_net = i;
+				}
+			}
+			break;
 		case MLAN_BSS_MODE_AUTO:
 		default:
 			if (SCAN_RSSI(pmadapter->pscan_table[i].rssi) >
@ -873,14 +882,12 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 			 * prepared */
 			memcpy_ext(pmadapter,
 				   pchan_tlv_out->chan_scan_param + tlv_idx,
-				   ptmp_chan_list,
-				   sizeof(pchan_tlv_out->chan_scan_param),
-				   sizeof(pchan_tlv_out->chan_scan_param));
+				   ptmp_chan_list, sizeof(ChanScanParamSet_t),
+				   sizeof(ChanScanParamSet_t));

 			/* Increment the TLV header length by the size appended
 			 */
-			pchan_tlv_out->header.len +=
-				sizeof(pchan_tlv_out->chan_scan_param);
+			pchan_tlv_out->header.len += sizeof(ChanScanParamSet_t);

 			/*
 			 * The tlv buffer length is set to the number of
@ -889,8 +896,9 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 			 * compensates for any TLVs that were appended
 			 * before the channel list.
 			 */
-			pscan_cfg_out->tlv_buf_len = (t_u32)(
-				(t_u8 *)pchan_tlv_out - pscan_cfg_out->tlv_buf);
+			pscan_cfg_out->tlv_buf_len =
+				(t_u32)((t_u8 *)pchan_tlv_out -
+					pscan_cfg_out->tlv_buf);

 			/* Add the size of the channel tlv header and the data
 			 * length */
@ -1231,9 +1239,10 @@ static mlan_status wlan_scan_setup_scan_config(
 				(MrvlIEtypes_WildCardSsIdParamSet_t *)ptlv_pos;
 			pwildcard_ssid_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_WILDCARDSSID);
-			pwildcard_ssid_tlv->header.len = (t_u16)(
-				ssid_len +
-				sizeof(pwildcard_ssid_tlv->max_ssid_length));
+			pwildcard_ssid_tlv->header.len =
+				(t_u16)(ssid_len +
+					sizeof(pwildcard_ssid_tlv
+						       ->max_ssid_length));
 			pwildcard_ssid_tlv->max_ssid_length =
 				puser_scan_in->ssid_list[ssid_idx].max_len;

@ -2017,8 +2026,9 @@ static mlan_status wlan_interpret_bss_desc_with_ie(pmlan_adapter pmadapter,
 				pbss_entry->pwpa_ie =
 					(IEEEtypes_VendorSpecific_t *)
 						pcurrent_ptr;
-				pbss_entry->wpa_offset = (t_u16)(
-					pcurrent_ptr - pbss_entry->pbeacon_buf);
+				pbss_entry->wpa_offset =
+					(t_u16)(pcurrent_ptr -
+						pbss_entry->pbeacon_buf);
 				HEXDUMP("InterpretIE: Resp WPA_IE",
 					(t_u8 *)pbss_entry->pwpa_ie,
 					((*(pbss_entry->pwpa_ie)).vend_hdr.len +
@ -2094,8 +2104,9 @@ static mlan_status wlan_interpret_bss_desc_with_ie(pmlan_adapter pmadapter,
 					   osen_oui, sizeof(osen_oui))) {
 				pbss_entry->posen_ie =
 					(IEEEtypes_Generic_t *)pcurrent_ptr;
-				pbss_entry->osen_offset = (t_u16)(
-					pcurrent_ptr - pbss_entry->pbeacon_buf);
+				pbss_entry->osen_offset =
+					(t_u16)(pcurrent_ptr -
+						pbss_entry->pbeacon_buf);
 				HEXDUMP("InterpretIE: Resp OSEN_IE",
 					(t_u8 *)pbss_entry->posen_ie,
 					(*(pbss_entry->posen_ie)).ieee_hdr.len +
@ -2270,13 +2281,15 @@ static mlan_status wlan_interpret_bss_desc_with_ie(pmlan_adapter pmadapter,
 			case HE_CAPABILITY:
 				pbss_entry->phe_cap =
 					(IEEEtypes_HECap_t *)pcurrent_ptr;
-				pbss_entry->he_cap_offset = (t_u16)(
-					pcurrent_ptr - pbss_entry->pbeacon_buf);
+				pbss_entry->he_cap_offset =
+					(t_u16)(pcurrent_ptr -
+						pbss_entry->pbeacon_buf);
 				break;
 			case HE_OPERATION:
 				pbss_entry->phe_oprat = pext_tlv;
-				pbss_entry->he_oprat_offset = (t_u16)(
-					pcurrent_ptr - pbss_entry->pbeacon_buf);
+				pbss_entry->he_oprat_offset =
+					(t_u16)(pcurrent_ptr -
+						pbss_entry->pbeacon_buf);
 				break;
 			default:
 				break;
@ -4940,10 +4953,10 @@ mlan_status wlan_cmd_802_11_scan_ext(mlan_private *pmpriv,
 			else
 				pext_scan_cmd->ext_scan_type = EXT_SCAN_DEFAULT;
 		} else {
-			pcmd->size = wlan_cpu_to_le16((t_u16)(
-				sizeof(pext_scan_cmd->ext_scan_type) +
-				(t_u16)(sizeof(pext_scan_cmd->reserved)) +
-				S_DS_GEN));
+			pcmd->size = wlan_cpu_to_le16((
+				t_u16)(sizeof(pext_scan_cmd->ext_scan_type) +
+				       (t_u16)(sizeof(pext_scan_cmd->reserved)) +
+				       S_DS_GEN));
 			pext_scan_cmd->ext_scan_type = EXT_SCAN_CANCEL;
 			LEAVE();
 			return MLAN_STATUS_SUCCESS;
@ -5723,8 +5736,8 @@ static mlan_status wlan_parse_ext_scan_result(mlan_private *pmpriv,
 			 */
 			if (pscan_info_tlv) {
 				/* RSSI is 2 byte long */
-				bss_new_entry->rssi = -(t_s32)(
-					wlan_le16_to_cpu(pscan_info_tlv->rssi));
+				bss_new_entry->rssi = -(t_s32)(wlan_le16_to_cpu(
+					pscan_info_tlv->rssi));
 				PRINTM(MINFO, "EXT_SCAN: RSSI=%d\n",
 				       bss_new_entry->rssi);
 				memcpy_ext(pmpriv->adapter, &tsf_val,
@ -6395,8 +6408,9 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 		pwildcard_ssid_tlv = (MrvlIEtypes_WildCardSsIdParamSet_t *)tlv;
 		pwildcard_ssid_tlv->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_WILDCARDSSID);
-		pwildcard_ssid_tlv->header.len = (t_u16)(
-			ssid_len + sizeof(pwildcard_ssid_tlv->max_ssid_length));
+		pwildcard_ssid_tlv->header.len =
+			(t_u16)(ssid_len +
+				sizeof(pwildcard_ssid_tlv->max_ssid_length));
 		pwildcard_ssid_tlv->max_ssid_length =
 			bg_scan_in->ssid_list[ssid_idx].max_len;
 		memcpy_ext(pmadapter, pwildcard_ssid_tlv->ssid,
@ -6823,6 +6837,7 @@ t_s32 wlan_find_ssid_in_list(mlan_private *pmpriv, mlan_802_11_ssid *ssid,
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	t_s32 net = -1;
+	t_s32 j;
 	t_u8 best_rssi = 0;
 	t_u32 i;

@ -6850,6 +6865,23 @@ t_s32 wlan_find_ssid_in_list(mlan_private *pmpriv, mlan_802_11_ssid *ssid,

 			switch (mode) {
 			case MLAN_BSS_MODE_INFRA:
+				j = wlan_is_network_compatible(pmpriv, i, mode);
+
+				if (j >= 0) {
+					if (SCAN_RSSI(pmadapter->pscan_table[i]
+							      .rssi) >
+					    best_rssi) {
+						best_rssi = SCAN_RSSI(
+							pmadapter
+								->pscan_table[i]
+								.rssi);
+						net = i;
+					}
+				} else {
+					if (net == -1)
+						net = j;
+				}
+				break;
 			case MLAN_BSS_MODE_AUTO:
 			default:
 				/*
@ -6915,6 +6947,9 @@ t_s32 wlan_find_bssid_in_list(mlan_private *pmpriv, t_u8 *bssid, t_u32 mode)
 				continue;
 			switch (mode) {
 			case MLAN_BSS_MODE_INFRA:
+				net = wlan_is_network_compatible(pmpriv, i,
+								 mode);
+				break;
 			default:
 				net = i;
 				break;
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
@ -225,7 +225,7 @@ static const struct _mlan_card_info mlan_card_info_sd8897 = {

 #if defined(SD8977) || defined(SD8997) || defined(SD8987) ||                   \
 	defined(SD9098) || defined(SD9097) || defined(SDIW624) ||              \
-	defined(SD8978) || defined(SD9177)
+	defined(SD8978) || defined(SD9177) || defined(SDIW615)
 static const struct _mlan_sdio_card_reg mlan_reg_sd8977_sd8997 = {
 	.start_rd_port = 0,
 	.start_wr_port = 0,
@ -347,6 +347,17 @@ static const struct _mlan_card_info mlan_card_info_sd9177 = {
 };
 #endif

+#ifdef SDIW615
+static const struct _mlan_card_info mlan_card_info_sdiw615 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
+};
+#endif
+
 #if defined(SD8977) || defined(SD8978)
 static const struct _mlan_card_info mlan_card_info_sd8977 = {
 	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
@ -583,8 +594,8 @@ static mlan_status wlan_get_rd_port(mlan_adapter *pmadapter, t_u8 *pport)
 	} else {
 		if (pmadapter->pcard_sd->mp_rd_bitmap &
 		    (1 << pmadapter->pcard_sd->curr_rd_port)) {
-			pmadapter->pcard_sd->mp_rd_bitmap &= (t_u32)(
-				~(1 << pmadapter->pcard_sd->curr_rd_port));
+			pmadapter->pcard_sd->mp_rd_bitmap &= (t_u32)(~(
+				1 << pmadapter->pcard_sd->curr_rd_port));
 			*pport = pmadapter->pcard_sd->curr_rd_port;

 			/* hw rx wraps round only after port (MAX_PORT-1) */
@ -1044,10 +1055,11 @@ static mlan_status wlan_sdio_prog_fw_w_helper(pmlan_adapter pmadapter, t_u8 *fw,
 			check_fw_status = MTRUE;
 	}
 #endif
-#if defined(SD9097) || defined(SD9177) || defined(SDIW624)
+#if defined(SD9097) || defined(SD9177) || defined(SDIW624) || defined(SDIW615)
 	if (IS_SD9097(pmadapter->card_type) ||
 	    IS_SDIW624(pmadapter->card_type) ||
-	    IS_SDAW693(pmadapter->card_type) || IS_SD9177(pmadapter->card_type))
+	    IS_SDAW693(pmadapter->card_type) ||
+	    IS_SDIW615(pmadapter->card_type) || IS_SD9177(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif

@ -1261,6 +1273,32 @@ static mlan_status wlan_decode_rx_packet(mlan_adapter *pmadapter,
 	ENTER();

 	switch (upld_typ) {
+	case MLAN_TYPE_SPA_DATA:
+		PRINTM(MINFO, "--- Rx: SPA Data packet ---\n");
+		pmbuf->data_len = pmadapter->upld_len;
+		if (pmadapter->rx_work_flag) {
+			pmbuf->buf_type = MLAN_BUF_TYPE_SPA_DATA;
+			if (lock_flag)
+				pmadapter->callbacks.moal_spin_lock(
+					pmadapter->pmoal_handle,
+					pmadapter->rx_data_queue.plock);
+			util_enqueue_list_tail(pmadapter->pmoal_handle,
+					       &pmadapter->rx_data_queue,
+					       (pmlan_linked_list)pmbuf, MNULL,
+					       MNULL);
+			pmadapter->rx_pkts_queued++;
+			if (lock_flag)
+				pmadapter->callbacks.moal_spin_unlock(
+					pmadapter->pmoal_handle,
+					pmadapter->rx_data_queue.plock);
+		} else {
+			wlan_decode_spa_buffer(pmadapter,
+					       pmbuf->pbuf + pmbuf->data_offset,
+					       pmbuf->data_len);
+			wlan_free_mlan_buffer(pmadapter, pmbuf);
+		}
+		pmadapter->data_received = MTRUE;
+		break;
 	case MLAN_TYPE_DATA:
 		PRINTM(MINFO, "--- Rx: Data packet ---\n");
 		if (pmadapter->upld_len > pmbuf->data_len) {
@ -1415,7 +1453,7 @@ static mlan_status wlan_receive_single_packet(mlan_adapter *pmadapter)
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-	if (pkt_type != MLAN_TYPE_DATA) {
+	if (pkt_type != MLAN_TYPE_DATA && pkt_type != MLAN_TYPE_SPA_DATA) {
 		PRINTM(MERROR,
 		       "receive a wrong pkt from DATA PORT: type=%d, len=%dd\n",
 		       pkt_type, pmbuf->data_len);
@ -1549,7 +1587,8 @@ static mlan_status wlan_receive_mp_aggr_buf(mlan_adapter *pmadapter)
 			/* copy pkt to deaggr buf */
 			mbuf_deaggr =
 				pmadapter->pcard_sd->mpa_rx.mbuf_arr[pind];
-			if ((pkt_type == MLAN_TYPE_DATA) &&
+			if ((pkt_type == MLAN_TYPE_DATA ||
+			     pkt_type == MLAN_TYPE_SPA_DATA) &&
 			    (pkt_len <=
 			     pmadapter->pcard_sd->mpa_rx.len_arr[pind])) {
 				memcpy_ext(pmadapter,
@ -1710,7 +1749,8 @@ rx_curr_single:
 			goto done;
 		}
 		if (new_mode || (port != CTRL_PORT)) {
-			if (pkt_type != MLAN_TYPE_DATA) {
+			if (pkt_type != MLAN_TYPE_DATA &&
+			    pkt_type != MLAN_TYPE_SPA_DATA) {
 				PRINTM(MERROR,
 				       "receive a wrong pkt from DATA PORT: type=%d, len=%dd\n",
 				       pkt_type, pmbuf->data_len);
@ -2404,6 +2444,12 @@ mlan_status wlan_get_sdio_device(pmlan_adapter pmadapter)
 		pmadapter->pcard_info = &mlan_card_info_sdiw624;
 		break;
 #endif
+#ifdef SDIW615
+	case CARD_TYPE_SDIW615:
+		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
+		pmadapter->pcard_info = &mlan_card_info_sdiw615;
+		break;
+#endif
 #ifdef SD9177
 	case CARD_TYPE_SD9177:
 		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
@ -2614,7 +2660,7 @@ static mlan_status wlan_sdio_card_to_host_recovery(mlan_adapter *pmadapter,
 				   pmadapter->pcard_sd->ioport + port)) {
 		PRINTM(MERROR, "Recovery: Fail to do cmd53\n");
 	}
-	if (pkt_type != MLAN_TYPE_DATA) {
+	if (pkt_type != MLAN_TYPE_DATA && pkt_type != MLAN_TYPE_SPA_DATA) {
 		PRINTM(MERROR,
 		       "Recovery: Receive a wrong pkt: type=%d, len=%d\n",
 		       pkt_type, pmadapter->upld_len);
@ -2624,6 +2670,12 @@ static mlan_status wlan_sdio_card_to_host_recovery(mlan_adapter *pmadapter,
 		// TODO fill the hole in Rx reorder table
 		PRINTM(MDATA, "Recovery: Drop Data packet\n");
 		pmadapter->dbg.num_pkt_dropped++;
+	} else if (pkt_type == MLAN_TYPE_SPA_DATA) {
+		PRINTM(MDATA, "Recovery: SPA Data packet len=%d\n",
+		       pmadapter->upld_len);
+		wlan_decode_spa_buffer(pmadapter, pmadapter->pcard_sd->rx_buf,
+				       pmadapter->upld_len);
+		pmadapter->data_received = MTRUE;
 	}
 	PRINTM(MMSG, "wlan: Success handle rx port=%d, rx_len=%d \n", port,
 	       rx_len);
@ -2839,7 +2891,7 @@ static mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter,
 				    MLAN_SDIO_BLOCK_SIZE;
 			if (rx_len <= SDIO_INTF_HEADER_LEN ||
 			    (rx_blocks * MLAN_SDIO_BLOCK_SIZE) >
-				    ALLOC_BUF_SIZE) {
+				    pmadapter->pcard_sd->mpa_rx.buf_size) {
 				PRINTM(MERROR, "invalid rx_len=%d\n", rx_len);
 				ret = MLAN_STATUS_FAILURE;
 				goto done;
@ -3015,7 +3067,7 @@ exit:

 #if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
 	defined(SD9177) || defined(SD8997) || defined(SD8987) ||               \
-	defined(SD8978)
+	defined(SD8978) || defined(SDIW615)
 /**
 *  @brief This function sends vdll data to the card.
 *
@ -3078,7 +3130,7 @@ static mlan_status wlan_sdio_host_to_card_ext(pmlan_private pmpriv, t_u8 type,

 #if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
 	defined(SD9177) || defined(SD8997) || defined(SD8987) ||               \
-	defined(SD8978)
+	defined(SD8978) || defined(SDIW615)
 	if (type == MLAN_TYPE_VDLL)
 		return wlan_sdio_send_vdll(pmadapter, pmbuf);
 #endif
@ -3091,6 +3143,99 @@ static mlan_status wlan_sdio_host_to_card_ext(pmlan_private pmpriv, t_u8 type,
 	return ret;
 }

+/**
+ *  @brief Deaggregate single port aggregation packet
+ *
+ *  @param pmadapter  A pointer to mlan_adapter structure
+ *  @param buf	A pointer to aggregated data packet
+ *  @param len
+ *
+ *  @return		N/A
+ */
+void wlan_decode_spa_buffer(mlan_adapter *pmadapter, t_u8 *buf, t_u32 len)
+{
+	int total_pkt_len;
+	t_u8 block_num = 0;
+	t_u16 block_size = 0;
+	t_u8 *data;
+	t_u32 pkt_len;
+	mlan_buffer *mbuf_deaggr = MNULL;
+
+	ENTER();
+
+	data = (t_u8 *)buf;
+	total_pkt_len = len;
+	if (total_pkt_len < pmadapter->pcard_sd->sdio_rx_block_size) {
+		PRINTM(MERROR, "Invalid sp aggr packet size=%d\n",
+		       total_pkt_len);
+		goto done;
+	}
+	while (total_pkt_len >=
+	       (OFFSET_OF_SDIO_HEADER + SDIO_INTF_HEADER_LEN)) {
+		block_num = *(data + OFFSET_OF_BLOCK_NUMBER);
+		block_size =
+			pmadapter->pcard_sd->sdio_rx_block_size * block_num;
+		if (block_size > total_pkt_len) {
+			PRINTM(MERROR,
+			       "Error in pkt, block_num=%d, pkt_len=%d\n",
+			       block_num, total_pkt_len);
+			break;
+		}
+		pkt_len = wlan_le16_to_cpu(
+			*(t_u16 *)(data + OFFSET_OF_SDIO_HEADER));
+		if ((pkt_len + OFFSET_OF_SDIO_HEADER) > block_size) {
+			PRINTM(MERROR,
+			       "Error in pkt, pkt_len=%d, block_size=%d\n",
+			       pkt_len, block_size);
+			break;
+		}
+		if (pkt_len > SDIO_INTF_HEADER_LEN) {
+			mbuf_deaggr = wlan_alloc_mlan_buffer(
+				pmadapter, pkt_len - SDIO_INTF_HEADER_LEN,
+				MLAN_RX_HEADER_LEN, MOAL_ALLOC_MLAN_BUFFER);
+		} else {
+			PRINTM(MERROR, "Invalid packet length error\n");
+		}
+
+		if (mbuf_deaggr == MNULL) {
+			PRINTM(MERROR, "Error allocating daggr mlan_buffer\n");
+			break;
+		}
+		memcpy_ext(pmadapter,
+			   mbuf_deaggr->pbuf + mbuf_deaggr->data_offset,
+			   data + OFFSET_OF_SDIO_HEADER + SDIO_INTF_HEADER_LEN,
+			   pkt_len - SDIO_INTF_HEADER_LEN,
+			   pkt_len - SDIO_INTF_HEADER_LEN);
+		mbuf_deaggr->data_len = pkt_len - SDIO_INTF_HEADER_LEN;
+		wlan_handle_rx_packet(pmadapter, mbuf_deaggr);
+		data += block_size;
+		total_pkt_len -= block_size;
+		if (total_pkt_len < pmadapter->pcard_sd->sdio_rx_block_size)
+			break;
+	}
+done:
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function deaggr rx pkt
+ *
+ *  @param pmadapter A pointer to mlan_adapter structure
+ *  @param pmbuf     A pointer to the SDIO mpa data
+ *  @return          N/A
+ */
+t_void wlan_sdio_deaggr_rx_pkt(pmlan_adapter pmadapter, mlan_buffer *pmbuf)
+{
+	if (pmbuf->buf_type == MLAN_BUF_TYPE_SPA_DATA) {
+		wlan_decode_spa_buffer(pmadapter,
+				       pmbuf->pbuf + pmbuf->data_offset,
+				       pmbuf->data_len);
+		wlan_free_mlan_buffer(pmadapter, pmbuf);
+	} else
+		wlan_handle_rx_packet(pmadapter, pmbuf);
+}
+
 /**
 *  @brief This function allocates buffer for the SDIO aggregation buffer
 *          related members of adapter structure
@ -3206,6 +3351,84 @@ mlan_status wlan_free_sdio_mpa_buffers(mlan_adapter *pmadapter)
 	return MLAN_STATUS_SUCCESS;
 }

+/**
+ *  @brief This function re-allocate rx mpa buffer
+ *
+ *  @param pmadapter       A pointer to mlan_adapter structure
+ *
+ *  @return        MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_re_alloc_sdio_rx_mpa_buffer(mlan_adapter *pmadapter)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	pmlan_callbacks pcb = &pmadapter->callbacks;
+	t_u32 buf_size = 0;
+	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
+	t_u32 mpa_rx_buf_size = pmadapter->pcard_sd->mp_tx_aggr_buf_size;
+
+	if (pmadapter->pcard_sd->mpa_rx.buf) {
+		pcb->moal_mfree(pmadapter->pmoal_handle,
+				(t_u8 *)pmadapter->pcard_sd->mpa_rx.head_ptr);
+		pmadapter->pcard_sd->mpa_rx.head_ptr = MNULL;
+		pmadapter->pcard_sd->mpa_rx.buf = MNULL;
+		pmadapter->pcard_sd->mpa_rx.buf_size = 0;
+	}
+	if (pmadapter->pcard_sd->sdio_rx_aggr_enable) {
+		mpa_rx_buf_size = MAX(mpa_rx_buf_size, SDIO_CMD53_MAX_SIZE);
+		/** reallocate rx buffer for recover when single port rx
+		 * aggregation enabled */
+		if (pmadapter->pcard_sd->rx_buffer) {
+			pcb->moal_mfree(pmadapter->pmoal_handle,
+					(t_u8 *)pmadapter->pcard_sd->rx_buffer);
+			pmadapter->pcard_sd->rx_buffer = MNULL;
+			pmadapter->pcard_sd->rx_buf = MNULL;
+		}
+		ret = pmadapter->callbacks.moal_malloc(
+			pmadapter->pmoal_handle,
+			SDIO_CMD53_MAX_SIZE + DMA_ALIGNMENT,
+			MLAN_MEM_DEF | MLAN_MEM_DMA,
+			(t_u8 **)&pmadapter->pcard_sd->rx_buffer);
+
+		if (ret != MLAN_STATUS_SUCCESS ||
+		    !pmadapter->pcard_sd->rx_buffer) {
+			PRINTM(MERROR, "Failed to allocate receive buffer\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto error;
+		}
+		pmadapter->pcard_sd->rx_buf = (t_u8 *)ALIGN_ADDR(
+			pmadapter->pcard_sd->rx_buffer, DMA_ALIGNMENT);
+	}
+	if ((pmadapter->pcard_sd->max_segs < mp_aggr_pkt_limit) ||
+	    (pmadapter->pcard_sd->max_seg_size <
+	     pmadapter->pcard_sd->max_sp_rx_size)) {
+		if (!wlan_secure_add(&mpa_rx_buf_size, DMA_ALIGNMENT, &buf_size,
+				     TYPE_UINT32))
+			PRINTM(MERROR, "%s:rx_buf_size overflow \n", __func__);
+
+		ret = pcb->moal_malloc(
+			pmadapter->pmoal_handle, buf_size,
+			MLAN_MEM_DEF | MLAN_MEM_DMA,
+			(t_u8 **)&pmadapter->pcard_sd->mpa_rx.head_ptr);
+		if (ret != MLAN_STATUS_SUCCESS ||
+		    !pmadapter->pcard_sd->mpa_rx.head_ptr) {
+			PRINTM(MERROR,
+			       "Could not allocate buffer for SDIO MP RX aggr\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto error;
+		}
+		pmadapter->pcard_sd->mpa_rx.buf = (t_u8 *)ALIGN_ADDR(
+			pmadapter->pcard_sd->mpa_rx.head_ptr, DMA_ALIGNMENT);
+	} else {
+		PRINTM(MMSG, "wlan: Enable RX SG mode\n");
+		pmadapter->pcard_sd->mpa_rx.head_ptr = MNULL;
+		pmadapter->pcard_sd->mpa_rx.buf = MNULL;
+	}
+	pmadapter->pcard_sd->mpa_rx.buf_size = mpa_rx_buf_size;
+	PRINTM(MMSG, "mpa_rx_buf_size=%d\n", mpa_rx_buf_size);
+error:
+	return ret;
+}
+
 /**
 *  @brief This function wakes up the card.
 *
@ -3390,7 +3613,7 @@ mlan_status wlan_reset_fw(pmlan_adapter pmadapter)
 	}
 #if defined(SD8997) || defined(SD8977) || defined(SD8987) ||                   \
 	defined(SD9098) || defined(SD9097) || defined(SDIW624) ||              \
-	defined(SD8978) || defined(SD9177)
+	defined(SD8978) || defined(SD9177) || defined(SDIW615)
 	if (MFALSE
 #ifdef SD8997
 	    || IS_SD8997(pmadapter->card_type)
@ -3413,6 +3636,9 @@ mlan_status wlan_reset_fw(pmlan_adapter pmadapter)
 #ifdef SDIW624
 	    || IS_SDIW624(pmadapter->card_type)
 #endif
+#ifdef SDIW615
+	    || IS_SDIW615(pmadapter->card_type)
+#endif
 #ifdef SD9177
 	    || IS_SD9177(pmadapter->card_type)
 #endif
@ -3498,7 +3724,7 @@ static mlan_status wlan_sdio_handle_rx_packet(mlan_adapter *pmadapter,
 {
 	ENTER();

-	wlan_handle_rx_packet(pmadapter, pmbuf);
+	wlan_sdio_deaggr_rx_pkt(pmadapter, pmbuf);

 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
@ -358,6 +358,10 @@ mlan_status wlan_get_sdio_device(pmlan_adapter pmadapter);

 mlan_status wlan_send_mp_aggr_buf(mlan_adapter *pmadapter);

+mlan_status wlan_re_alloc_sdio_rx_mpa_buffer(mlan_adapter *pmadapter);
+
+void wlan_decode_spa_buffer(mlan_adapter *pmadapter, t_u8 *buf, t_u32 len);
+t_void wlan_sdio_deaggr_rx_pkt(pmlan_adapter pmadapter, mlan_buffer *pmbuf);
 /** Transfer data to card */
 mlan_status wlan_sdio_host_to_card(mlan_adapter *pmadapter, t_u8 type,
 				   mlan_buffer *mbuf, mlan_tx_param *tx_param);
--- a/mxm_wifiex/wlan_src/mlan/mlan_shim.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
@ -362,6 +362,8 @@ mlan_status mlan_register(pmlan_device pmdevice, t_void **ppmlan_adapter)

 		pmadapter->init_para.mpa_tx_cfg = pmdevice->mpa_tx_cfg;
 		pmadapter->init_para.mpa_rx_cfg = pmdevice->mpa_rx_cfg;
+		pmadapter->pcard_sd->sdio_rx_aggr_enable =
+			pmdevice->sdio_rx_aggr_enable;
 	}
 #endif

@ -1436,6 +1438,7 @@ mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf)
 	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	mlan_private *pmpriv;
 	t_u16 eth_type = 0;
+	t_u8 ip_protocol = 0;
 	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
 	tdlsStatus_e tdls_status;

@ -1453,9 +1456,21 @@ mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf)
 	eth_type =
 		mlan_ntohs(*(t_u16 *)&pmbuf->pbuf[pmbuf->data_offset +
 						  MLAN_ETHER_PKT_TYPE_OFFSET]);
+
+	/** Identify ICMP packet from ETH_IP packet. ICMP packet in IP header
+	 * Protocol field is 0x01 */
+	if (eth_type == MLAN_ETHER_PKT_TYPE_IP) {
+		ip_protocol = *((t_u8 *)(pmbuf->pbuf + pmbuf->data_offset +
+					 MLAN_ETHER_PKT_TYPE_OFFSET +
+					 MLAN_IP_PROTOCOL_OFFSET));
+	}
+
 	if ((eth_type == MLAN_ETHER_PKT_TYPE_EAPOL) ||
 	    (eth_type == MLAN_ETHER_PKT_TYPE_ARP) ||
-	    (eth_type == MLAN_ETHER_PKT_TYPE_WAPI) ||
+	    (eth_type == MLAN_ETHER_PKT_TYPE_WAPI)
+	    /** Send ICMP packet via bypass_txqueue to reduce long ping latency
+	     */
+	    || (ip_protocol == MLAN_IP_PROTOCOL_ICMP) ||
 	    (eth_type == MLAN_ETHER_PKT_TYPE_TDLS_ACTION) ||
 	    (pmbuf->buf_type == MLAN_BUF_TYPE_RAW_DATA)
 	    /* Adding the Ucast/Mcast pkt to bypass queue when flag is set*/
@ -1943,11 +1958,20 @@ void mlan_process_pcie_interrupt_cb(t_void *padapter, int type)
 	} else if (type == TX_COMPLETE && !wlan_is_tx_pending(pmadapter)) {
 		LEAVE();
 		return;
+	} else if (type == RX_DATA_DELAY) {
+		PRINTM(MEVENT, "Delay Rx DATA\n");
+		pcb->moal_spin_lock(pmadapter->pmoal_handle,
+				    pmadapter->pmlan_rx_lock);
+		pmadapter->pcard_pcie->rx_pending = MFALSE;
+		pcb->moal_spin_unlock(pmadapter->pmoal_handle,
+				      pmadapter->pmlan_rx_lock);
+		LEAVE();
+		return;
 	}
 	pmadapter->ops.process_int_status(pmadapter, type);
 	switch (type) {
 	case RX_DATA: // Rx Data
-		if (pmadapter->data_received) {
+		if (pmadapter->rx_pkts_queued) {
 			if (pmadapter->napi)
 				mlan_queue_rx_work(pmadapter);
 			else
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
@ -3634,6 +3634,9 @@ mlan_status wlan_ops_sta_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_get_hw_spec(pmpriv, cmd_ptr);
 		break;
 #ifdef SDIO
+	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:
+		ret = wlan_cmd_sdio_rx_aggr_cfg(cmd_ptr, cmd_action, pdata_buf);
+		break;
 #endif
 	case HostCmd_CMD_CFG_DATA:
 		ret = wlan_cmd_cfg_data(pmpriv, cmd_ptr, cmd_action, cmd_oid,
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
@ -265,6 +265,10 @@ static mlan_status wlan_process_cmdresp_error(mlan_private *pmpriv,
 			pmadapter->dbg.num_remain_chan_err++;
 		break;
 #ifdef SDIO
+	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:
+		pmadapter->pcard_sd->sdio_rx_aggr_enable = MFALSE;
+		PRINTM(MMSG, "FW don't support SDIO single port rx aggr\n");
+		break;
 #endif

 	case HostCmd_CMD_MGMT_IE_LIST: {
@ -3178,6 +3182,9 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 		ret = wlan_ret_get_hw_spec(pmpriv, resp, pioctl_buf);
 		break;
 #ifdef SDIO
+	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:
+		ret = wlan_ret_sdio_rx_aggr_cfg(pmpriv, resp);
+		break;
 #endif
 	case HostCmd_CMD_CFG_DATA:
 		ret = wlan_ret_cfg_data(pmpriv, resp, pioctl_buf);
@ -3262,7 +3269,6 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_802_11_DISASSOCIATE:
 		ret = wlan_ret_802_11_deauthenticate(pmpriv, resp, pioctl_buf);
 		break;
-		break;
 	case HostCmd_CMD_802_11_GET_LOG:
 		ret = wlan_ret_get_log(pmpriv, resp, pioctl_buf);
 		break;
@ -3408,7 +3414,6 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_WMM_PARAM_CONFIG:
 		ret = wlan_ret_wmm_param_config(pmpriv, resp, pioctl_buf);
 		break;
-		break;
 	case HostCmd_CMD_MGMT_IE_LIST:
 		ret = wlan_ret_mgmt_ie_list(pmpriv, resp, pioctl_buf);
 		break;
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
@ -811,6 +811,12 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 		break;

 	case EVENT_LINK_LOST:
+		if (pmpriv->curr_bss_params.host_mlme &&
+		    !pmpriv->assoc_rsp_size) {
+			PRINTM(MMSG,
+			       "wlan: skip link lost event before associate complete\n");
+			break;
+		}
 		if (pmbuf && (pmbuf->data_len >=
 			      sizeof(eventcause) + sizeof(Event_Link_Lost))) {
 			link_lost_evt = (Event_Link_Lost *)(pmbuf->pbuf +
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
@ -1357,6 +1357,9 @@ static mlan_status wlan_bss_ioctl(pmlan_adapter pmadapter,
 			   &pmpriv->curr_bss_params.attemp_bssid,
 			   &bss->param.bssid, MLAN_MAC_ADDR_LENGTH,
 			   MLAN_MAC_ADDR_LENGTH);
+		/* clear assoc_rsp_size */
+		pmpriv->assoc_rsp_size = 0;
+		pmpriv->assoc_req_size = 0;
 		break;
 	case MLAN_OID_BSS_START:
 		status = wlan_bss_ioctl_start(pmadapter, pioctl_req);
@ -3223,76 +3226,93 @@ static mlan_status wlan_set_gen_ie_helper(mlan_private *priv, t_u8 *ie_data_ptr,
 			     (!memcmp(priv->adapter, pvendor_ie->oui, wpa_oui,
 				      sizeof(wpa_oui)))) ||
 			    (pvendor_ie->element_id == RSN_IE)) {
-			/* IE is a WPA/WPA2 IE so call set_wpa function */
-			ret = wlan_set_wpa_ie_helper(priv, ie_data_ptr, ie_len);
-			priv->wps.session_enable = MFALSE;
-		} else if (pvendor_ie->element_id == WAPI_IE) {
-			/* IE is a WAPI IE so call set_wapi function */
-			ret = wlan_set_wapi_ie(priv, ie_data_ptr, ie_len);
-		} else if ((pvendor_ie->element_id == VENDOR_SPECIFIC_221) &&
-			   (!memcmp(priv->adapter, pvendor_ie->oui, osen_oui,
-				    sizeof(osen_oui)))) {
-			/* IE is a OSEN IE so call set_osen function */
-			ret = wlan_set_osen_ie(priv, ie_data_ptr, ie_len);
-
-		} else if ((pvendor_ie->element_id == WPS_IE) &&
-			   (priv->wps.session_enable == MFALSE) &&
-			   (!memcmp(priv->adapter, pvendor_ie->oui, wps_oui,
-				    sizeof(wps_oui)))) {
-			/*
-			 * Discard first two byte (Element ID and Length)
-			 * because they are not needed in the case of setting
-			 * WPS_IE
-			 */
-			if (pvendor_ie->len > 4) {
-				memcpy_ext(priv->adapter,
-					   (t_u8 *)&priv->wps.wps_ie,
-					   ie_data_ptr, ie_len,
-					   sizeof(IEEEtypes_VendorSpecific_t));
-				HEXDUMP("wps_ie", (t_u8 *)&priv->wps.wps_ie,
-					priv->wps.wps_ie.vend_hdr.len + 2);
-			} else {
-				/* Only wps oui exist, reset driver wps buffer
+				/* IE is a WPA/WPA2 IE so call set_wpa function
 				 */
-				memset(priv->adapter, (t_u8 *)&priv->wps.wps_ie,
-				       0x00, sizeof(priv->wps.wps_ie));
-				PRINTM(MINFO, "wps_ie cleared\n");
-			}
-		} else {
-			/*
-			 * Verify that the passed length is not larger than
-			 * the available space remaining in the buffer
-			 */
-			if (ie_len <
-			    (sizeof(priv->gen_ie_buf) - priv->gen_ie_buf_len)) {
-				/* Test to see if it is a WPS IE, if so, enable
-				 * wps session flag */
-				pvendor_ie =
-					(IEEEtypes_VendorHeader_t *)ie_data_ptr;
-				if ((pvendor_ie->element_id == WPS_IE) &&
-				    (!memcmp(priv->adapter, pvendor_ie->oui,
-					     wps_oui, sizeof(wps_oui)))) {
-					priv->wps.session_enable = MTRUE;
-					PRINTM(MINFO, "WPS Session Enabled.\n");
-				}
+				ret = wlan_set_wpa_ie_helper(priv, ie_data_ptr,
+							     ie_len);
+				priv->wps.session_enable = MFALSE;
+			} else if (pvendor_ie->element_id == WAPI_IE) {
+				/* IE is a WAPI IE so call set_wapi function */
+				ret = wlan_set_wapi_ie(priv, ie_data_ptr,
+						       ie_len);
+			} else if ((pvendor_ie->element_id ==
+				    VENDOR_SPECIFIC_221) &&
+				   (!memcmp(priv->adapter, pvendor_ie->oui,
+					    osen_oui, sizeof(osen_oui)))) {
+				/* IE is a OSEN IE so call set_osen function */
+				ret = wlan_set_osen_ie(priv, ie_data_ptr,
+						       ie_len);

-				/* Append the passed data to the end of
-				 * the genIeBuffer */
-				memcpy_ext(priv->adapter,
-					   priv->gen_ie_buf +
-						   priv->gen_ie_buf_len,
-					   ie_data_ptr, ie_len,
-					   MRVDRV_GENIE_BUF_SIZE -
-						   priv->gen_ie_buf_len);
-				/* Increment the stored buffer length by
-				 * the size passed */
-				priv->gen_ie_buf_len += ie_len;
+			} else if ((pvendor_ie->element_id == WPS_IE) &&
+				   (priv->wps.session_enable == MFALSE) &&
+				   (!memcmp(priv->adapter, pvendor_ie->oui,
+					    wps_oui, sizeof(wps_oui)))) {
+				/*
+				 * Discard first two byte (Element ID and
+				 * Length) because they are not needed in the
+				 * case of setting WPS_IE
+				 */
+				if (pvendor_ie->len > 4) {
+					memcpy_ext(
+						priv->adapter,
+						(t_u8 *)&priv->wps.wps_ie,
+						ie_data_ptr, ie_len,
+						sizeof(IEEEtypes_VendorSpecific_t));
+					HEXDUMP("wps_ie",
+						(t_u8 *)&priv->wps.wps_ie,
+						priv->wps.wps_ie.vend_hdr.len +
+							2);
+				} else {
+					/* Only wps oui exist, reset driver wps
+					 * buffer
+					 */
+					memset(priv->adapter,
+					       (t_u8 *)&priv->wps.wps_ie, 0x00,
+					       sizeof(priv->wps.wps_ie));
+					PRINTM(MINFO, "wps_ie cleared\n");
+				}
 			} else {
-				/* Passed data does not fit in the
-				 * remaining buffer space */
-				ret = MLAN_STATUS_FAILURE;
+				/*
+				 * Verify that the passed length is not larger
+				 * than the available space remaining in the
+				 * buffer
+				 */
+				if (ie_len < (sizeof(priv->gen_ie_buf) -
+					      priv->gen_ie_buf_len)) {
+					/* Test to see if it is a WPS IE, if so,
+					 * enable wps session flag */
+					pvendor_ie =
+						(IEEEtypes_VendorHeader_t *)
+							ie_data_ptr;
+					if ((pvendor_ie->element_id ==
+					     WPS_IE) &&
+					    (!memcmp(priv->adapter,
+						     pvendor_ie->oui, wps_oui,
+						     sizeof(wps_oui)))) {
+						priv->wps.session_enable =
+							MTRUE;
+						PRINTM(MINFO,
+						       "WPS Session Enabled.\n");
+					}
+
+					/* Append the passed data to the end of
+					 * the genIeBuffer */
+					memcpy_ext(
+						priv->adapter,
+						priv->gen_ie_buf +
+							priv->gen_ie_buf_len,
+						ie_data_ptr, ie_len,
+						MRVDRV_GENIE_BUF_SIZE -
+							priv->gen_ie_buf_len);
+					/* Increment the stored buffer length by
+					 * the size passed */
+					priv->gen_ie_buf_len += ie_len;
+				} else {
+					/* Passed data does not fit in the
+					 * remaining buffer space */
+					ret = MLAN_STATUS_FAILURE;
+				}
 			}
-		}
 	}

 	/* Return MLAN_STATUS_SUCCESS, or MLAN_STATUS_FAILURE for error case */
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
@ -133,8 +133,9 @@ t_void *wlan_ops_sta_process_txpd(t_void *priv, pmlan_buffer pmbuf)
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	}
 	/* Offset of actual data */
-	plocal_tx_pd->tx_pkt_offset = (t_u16)(
-		(t_ptr)pmbuf->pbuf + pmbuf->data_offset - (t_ptr)plocal_tx_pd);
+	plocal_tx_pd->tx_pkt_offset =
+		(t_u16)((t_ptr)pmbuf->pbuf + pmbuf->data_offset -
+			(t_ptr)plocal_tx_pd);

 	if (!plocal_tx_pd->tx_control) {
 		/* TxCtrl set by user or default */
--- a/mxm_wifiex/wlan_src/mlan/mlan_txrx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_txrx.c
@ -380,13 +380,14 @@ t_void wlan_add_buf_bypass_txqueue(mlan_adapter *pmadapter, pmlan_buffer pmbuf)

 	if (pmbuf->buf_type != MLAN_BUF_TYPE_RAW_DATA)
 		pmbuf->buf_type = MLAN_BUF_TYPE_DATA;
-	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
-					    priv->bypass_txq.plock);
-	pmadapter->bypass_pkt_count++;
+	util_scalar_increment(pmadapter->pmoal_handle,
+			      &pmadapter->bypass_pkt_count,
+			      pmadapter->callbacks.moal_spin_lock,
+			      pmadapter->callbacks.moal_spin_unlock);
 	util_enqueue_list_tail(pmadapter->pmoal_handle, &priv->bypass_txq,
-			       (pmlan_linked_list)pmbuf, MNULL, MNULL);
-	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
-					      priv->bypass_txq.plock);
+			       (pmlan_linked_list)pmbuf,
+			       pmadapter->callbacks.moal_spin_lock,
+			       pmadapter->callbacks.moal_spin_unlock);
 	LEAVE();
 }

@ -399,6 +400,7 @@ t_void wlan_add_buf_bypass_txqueue(mlan_adapter *pmadapter, pmlan_buffer pmbuf)
 */
 INLINE t_u8 wlan_bypass_tx_list_empty(mlan_adapter *pmadapter)
 {
+	t_u32 bypass_pkt_count;
 #if defined(USB)
 	if (IS_USB(pmadapter->card_type)) {
 		pmlan_callbacks pcb = &pmadapter->callbacks;
@ -418,9 +420,14 @@ INLINE t_u8 wlan_bypass_tx_list_empty(mlan_adapter *pmadapter)
 			}
 		}
 		return MTRUE;
-	} else
+	}
 #endif
-		return (pmadapter->bypass_pkt_count) ? MFALSE : MTRUE;
+	bypass_pkt_count =
+		util_scalar_read(pmadapter->pmoal_handle,
+				 &pmadapter->bypass_pkt_count,
+				 pmadapter->callbacks.moal_spin_lock,
+				 pmadapter->callbacks.moal_spin_unlock);
+	return (bypass_pkt_count) ? MFALSE : MTRUE;
 }

 /**
@ -443,7 +450,10 @@ t_void wlan_cleanup_bypass_txq(mlan_private *priv)
 		util_unlink_list(pmadapter->pmoal_handle, &priv->bypass_txq,
 				 (pmlan_linked_list)pmbuf, MNULL, MNULL);
 		wlan_write_data_complete(pmadapter, pmbuf, MLAN_STATUS_FAILURE);
-		pmadapter->bypass_pkt_count--;
+		util_scalar_decrement(pmadapter->pmoal_handle,
+				      &pmadapter->bypass_pkt_count,
+				      pmadapter->callbacks.moal_spin_lock,
+				      pmadapter->callbacks.moal_spin_unlock);
 	}
 	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
 					      priv->bypass_txq.plock);
@ -480,13 +490,13 @@ t_void wlan_process_bypass_tx(pmlan_adapter pmadapter)
 					pmadapter->callbacks.moal_spin_lock,
 					pmadapter->callbacks.moal_spin_unlock);
 				if (pmbuf) {
-					pmadapter->callbacks.moal_spin_lock(
+					util_scalar_decrement(
 						pmadapter->pmoal_handle,
-						priv->bypass_txq.plock);
-					pmadapter->bypass_pkt_count--;
-					pmadapter->callbacks.moal_spin_unlock(
-						pmadapter->pmoal_handle,
-						priv->bypass_txq.plock);
+						&pmadapter->bypass_pkt_count,
+						pmadapter->callbacks
+							.moal_spin_lock,
+						pmadapter->callbacks
+							.moal_spin_unlock);
 					PRINTM(MINFO,
 					       "Dequeuing bypassed packet %p\n",
 					       pmbuf);
@ -504,10 +514,14 @@ t_void wlan_process_bypass_tx(pmlan_adapter pmadapter)
 						/* Queue the packet again so
 						 * that it will be TX'ed later
 						 */
-						pmadapter->callbacks.moal_spin_lock(
+						util_scalar_increment(
 							pmadapter->pmoal_handle,
-							priv->bypass_txq.plock);
-						pmadapter->bypass_pkt_count++;
+							&pmadapter->bypass_pkt_count,
+							pmadapter->callbacks
+								.moal_spin_lock,
+							pmadapter->callbacks
+								.moal_spin_unlock);
+
 						util_enqueue_list_head(
 							pmadapter->pmoal_handle,
 							&priv->bypass_txq,
@ -516,9 +530,6 @@ t_void wlan_process_bypass_tx(pmlan_adapter pmadapter)
 								.moal_spin_lock,
 							pmadapter->callbacks
 								.moal_spin_unlock);
-						pmadapter->callbacks.moal_spin_unlock(
-							pmadapter->pmoal_handle,
-							priv->bypass_txq.plock);
 					}
 					break;
 				} else {
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
@ -208,6 +208,10 @@ static mlan_status uap_process_cmdresp_error(mlan_private *pmpriv,
 	 */
 	switch (resp->command) {
 #ifdef SDIO
+	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:
+		pmadapter->pcard_sd->sdio_rx_aggr_enable = MFALSE;
+		PRINTM(MMSG, "FW don't support SDIO single port rx aggr\n");
+		break;
 #endif

 	case HostCmd_CMD_APCMD_SYS_CONFIGURE: {
@ -732,7 +736,7 @@ static mlan_status wlan_uap_cmd_ap_config(pmlan_private pmpriv,

 	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_SYS_CONFIGURE);
 	sys_config->action = wlan_cpu_to_le16(cmd_action);
-	cmd_size = sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN;
+	cmd_size = sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN;

 	tlv = (t_u8 *)sys_config->tlv_buffer;
 	if (memcmp(pmpriv->adapter, zero_mac, &bss->param.bss_config.mac_addr,
@ -1516,8 +1520,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,

 	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_APCMD_SYS_CONFIGURE);
 	sys_config->action = wlan_cpu_to_le16(cmd_action);
-	cmd->size =
-		wlan_cpu_to_le16(sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN);
 	if (pioctl_buf == MNULL) {
 		if (pdata_buf) {
 			switch (pdata_header->type) {
@ -1527,7 +1530,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 				chan_band_tlv = (MrvlIEtypes_channel_band_t *)
 							sys_config->tlv_buffer;
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(MrvlIEtypes_channel_band_t));
 				chan_band_tlv->header.type = wlan_cpu_to_le16(
@ -1548,7 +1551,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 					pdata_buf;
 				bcn_pd_tlv = (MrvlIEtypes_beacon_period_t *)
 						     sys_config->tlv_buffer;
-				cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+				cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) +
 					    S_DS_GEN +
 					    sizeof(MrvlIEtypes_beacon_period_t);
 				bcn_pd_tlv->header.type = wlan_cpu_to_le16(
@ -1597,7 +1600,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 			case TLV_TYPE_MGMT_IE:
 				cust_ie = (mlan_ds_misc_custom_ie *)pdata_buf;
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN + sizeof(MrvlIEtypesHeader_t) +
 					cust_ie->len);
 				ie_header->type =
@ -1663,7 +1666,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 							pmpriv, &oper_class_ie,
 							curr_oper_class);
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN + length);
 				break;
 			case TLV_TYPE_UAP_MAX_STA_CNT_PER_CHIP:
@ -1673,7 +1676,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 					sizeof(MrvlIEtypes_uap_max_sta_cnt_t),
 					sizeof(MrvlIEtypes_uap_max_sta_cnt_t));
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(MrvlIEtypes_uap_max_sta_cnt_t));
 				break;
@ -1688,7 +1691,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 			mac_tlv =
 				(MrvlIEtypes_MacAddr_t *)sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_MacAddr_t));
 			mac_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS);
@ -1704,7 +1707,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 			mac_tlv =
 				(MrvlIEtypes_MacAddr_t *)sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_MacAddr_t));
 			mac_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS);
@ -1719,7 +1722,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 			tlv_wmm_parameter = (MrvlIEtypes_wmm_parameter_t *)
 						    sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_wmm_parameter_t));
 			tlv_wmm_parameter->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_AP_WMM_PARAM);
@ -1768,7 +1771,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 			    bss->param.ap_scan_channels.num_of_chan <=
 				    MLAN_MAX_CHANNEL) {
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(tlv_chan_list->header) +
 					sizeof(ChanScanParamSet_t) *
@ -1801,7 +1804,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 					(t_u16)(sizeof(ChanScanParamSet_t) *
 						MLAN_MAX_CHANNEL));
 				cmd->size = wlan_cpu_to_le16(
-					sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
+					sizeof(HostCmd_DS_SYS_CONFIG) +
 					S_DS_GEN +
 					sizeof(MrvlIEtypes_ChanListParamSet_t) +
 					sizeof(ChanScanParamSet_t) *
@ -1811,7 +1814,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 			chan_band_tlv = (MrvlIEtypes_channel_band_t *)
 						sys_config->tlv_buffer;
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_channel_band_t));
 			chan_band_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_UAP_CHAN_BAND_CONFIG);
@ -1829,8 +1832,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 				       bss->param.ap_channel.channel);
 			}
 		} else if (bss->sub_command == MLAN_OID_ACTION_CHAN_SWITCH) {
-			cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) - 1 +
-				    S_DS_GEN +
+			cmd->size = sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				    sizeof(MrvlIEtypes_action_chan_switch_t);
 			tlv_chan_switch = (MrvlIEtypes_action_chan_switch_t *)
 						  sys_config->tlv_buffer;
@ -1889,7 +1891,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 		if ((misc->sub_command == MLAN_OID_MISC_GEN_IE) &&
 		    (misc->param.gen_ie.type == MLAN_IE_TYPE_GEN_IE)) {
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypesHeader_t) +
 				misc->param.gen_ie.len);
 			ie_header->type = wlan_cpu_to_le16(TLV_TYPE_WAPI_IE);
@ -1904,7 +1906,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 		if ((misc->sub_command == MLAN_OID_MISC_CUSTOM_IE) &&
 		    (misc->param.cust_ie.type == TLV_TYPE_MGMT_IE)) {
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypesHeader_t) +
 				misc->param.cust_ie.len);
 			ie_header->type = wlan_cpu_to_le16(TLV_TYPE_MGMT_IE);
@ -1961,7 +1963,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 					misc->param.wacp_mode;
 			}
 			cmd->size = wlan_cpu_to_le16(
-				sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN +
+				sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN +
 				sizeof(MrvlIEtypes_wacp_mode_t));
 		}
 	}
@ -2043,8 +2045,7 @@ static mlan_status wlan_uap_ret_cmd_ap_config(pmlan_private pmpriv,

 	bss = (mlan_ds_bss *)pioctl_buf->pbuf;
 	tlv = (MrvlIEtypesHeader_t *)sys_config->tlv_buffer;
-	tlv_buf_left =
-		resp->size - (sizeof(HostCmd_DS_SYS_CONFIG) - 1 + S_DS_GEN);
+	tlv_buf_left = resp->size - (sizeof(HostCmd_DS_SYS_CONFIG) + S_DS_GEN);

 	while (tlv_buf_left >= sizeof(MrvlIEtypesHeader_t)) {
 		tlv_type = wlan_le16_to_cpu(tlv->type);
@ -4603,11 +4604,11 @@ static mlan_status wlan_cmd_stats(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,

 	ENTER();
 	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_STATS);
-	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_STATS) + S_DS_GEN);
+
 	if (cmd_action) {
 		cmd->size =
 			wlan_cpu_to_le16(sizeof(HostCmd_DS_STATS) + S_DS_GEN +
-					 sizeof(Stats_Cfg_Params_TLV_t) - 1);
+					 sizeof(Stats_Cfg_Params_TLV_t));
 		stats_cmd->action = wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);

 		stats_param = (Stats_Cfg_Params_TLV_t *)stats->tlv_buf;
@ -4615,7 +4616,15 @@ static mlan_status wlan_cmd_stats(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 		    NXP_802_11_PER_PEER_STATS_CFG_TLV_ID) {
 			cfg_param =
 				(Stats_Cfg_Params_TLV_t *)stats_cmd->tlv_buffer;
-			*cfg_param = *stats_param;
+			cfg_param->tlvHeader.type =
+				wlan_cpu_to_le16(stats_param->tlvHeader.type);
+			cfg_param->tlvHeader.len = wlan_cpu_to_le16(
+				sizeof(Stats_Cfg_Params_TLV_t) -
+				sizeof(MrvlIEtypesHeader_t));
+			cfg_param->op = stats_param->op;
+			memcpy_ext(pmpriv->adapter, cfg_param->mac,
+				   stats_param->mac, MLAN_MAC_ADDR_LENGTH,
+				   MLAN_MAC_ADDR_LENGTH);
 		}
 		/* To identify the reset operation */
 		if (stats_param->op == OP_RESET) {
@ -4660,7 +4669,7 @@ static mlan_status wlan_ret_stats(pmlan_private pmpriv,
 			   (t_u8 *)&misc_cfg->param.stats.tlv_buf, pBuf, len,
 			   len);
 		misc_cfg->param.stats.tlv_len = len;
-		pioctl_buf->buf_len = sizeof(mlan_ds_stats) + len - 1;
+		pioctl_buf->buf_len = sizeof(mlan_ds_stats) + len;

 		stats_param =
 			(Stats_Cfg_Params_TLV_t *)misc_cfg->param.stats.tlv_buf;
@ -4682,7 +4691,7 @@ static mlan_status wlan_ret_stats(pmlan_private pmpriv,
 				len + sizeof(Stats_mcast_drv_t);

 			pioctl_buf->buf_len = sizeof(mlan_ds_stats) + len +
-					      sizeof(Stats_mcast_drv_t) - 1;
+					      sizeof(Stats_mcast_drv_t);
 		}
 	}

@ -4796,6 +4805,9 @@ mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_get_hw_spec(pmpriv, cmd_ptr);
 		break;
 #ifdef SDIO
+	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:
+		ret = wlan_cmd_sdio_rx_aggr_cfg(cmd_ptr, cmd_action, pdata_buf);
+		break;
 #endif
 	case HostCmd_CMD_802_11_HS_CFG_ENH:
 		ret = wlan_uap_cmd_802_11_hs_cfg(pmpriv, cmd_ptr, cmd_action,
@ -5262,6 +5274,9 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 		ret = wlan_ret_get_hw_spec(pmpriv, resp, pioctl_buf);
 		break;
 #ifdef SDIO
+	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:
+		ret = wlan_ret_sdio_rx_aggr_cfg(pmpriv, resp);
+		break;
 #endif
 	case HostCmd_CMD_CFG_DATA:
 		ret = wlan_ret_cfg_data(pmpriv, resp, pioctl_buf);
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
@ -234,8 +234,9 @@ t_void *wlan_ops_uap_process_txpd(t_void *priv, pmlan_buffer pmbuf)
 	}

 	/* Offset of actual data */
-	plocal_tx_pd->tx_pkt_offset = (t_u16)(
-		(t_ptr)pmbuf->pbuf + pmbuf->data_offset - (t_ptr)plocal_tx_pd);
+	plocal_tx_pd->tx_pkt_offset =
+		(t_u16)((t_ptr)pmbuf->pbuf + pmbuf->data_offset -
+			(t_ptr)plocal_tx_pd);

 	if (!plocal_tx_pd->tx_control) {
 		/* TxCtrl set by user or default */
--- a/mxm_wifiex/wlan_src/mlan/mlan_usb.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_usb.c
@ -110,6 +110,17 @@ static const struct _mlan_card_info mlan_card_info_usbIW624 = {
 };
 #endif

+#ifdef USBIW615
+static const struct _mlan_card_info mlan_card_info_usbIW615 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 1,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
+};
+#endif
+
 /********************************************************
 			Global Variables
 ********************************************************/
@ -492,11 +503,11 @@ static int wlan_usb_deaggr_rx_num_pkts(pmlan_adapter pmadapter, t_u8 *pdata,
 static inline t_u32 usb_tx_aggr_pad_len(t_u32 len,
 					usb_tx_aggr_params *pusb_tx_aggr)
 {
-	return (t_u32)(
-		(len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
-			(len + (pusb_tx_aggr->aggr_ctrl.aggr_align -
-				(len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
-			len);
+	return (t_u32)((len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
+			       (len +
+				(pusb_tx_aggr->aggr_ctrl.aggr_align -
+				 (len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
+			       len);
 }

 /**
@ -816,6 +827,11 @@ mlan_status wlan_get_usb_device(pmlan_adapter pmadapter)
 	case CARD_TYPE_USBIW624:
 		pmadapter->pcard_info = &mlan_card_info_usbIW624;
 		break;
+#endif
+#ifdef USBIW615
+	case CARD_TYPE_USBIW615:
+		pmadapter->pcard_info = &mlan_card_info_usbIW615;
+		break;
 #endif
 	default:
 		PRINTM(MERROR, "can't get right USB card type \n");
--- a/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
@ -2296,11 +2296,11 @@ mlan_status wlan_ret_wmm_get_status(pmlan_private priv, t_u8 *ptlv,
 		case TLV_TYPE_WMMQSTATUS:
 			ptlv_wmm_q_status =
 				(MrvlIEtypes_WmmQueueStatus_t *)ptlv_hdr;
-			PRINTM(MEVENT, "WMM_STATUS: QSTATUS TLV: %d\n",
+			PRINTM(MEVENT, "WMM_STATUS: QSTATUS TLV: %u\n",
 			       ptlv_wmm_q_status->queue_index);

 			PRINTM(MINFO,
-			       "CMD_RESP: WMM_GET_STATUS: QSTATUS TLV: %d, %d, %d\n",
+			       "CMD_RESP: WMM_GET_STATUS: QSTATUS TLV: %u, %d, %d\n",
 			       ptlv_wmm_q_status->queue_index,
 			       ptlv_wmm_q_status->flow_required,
 			       ptlv_wmm_q_status->disabled);
@ -2309,15 +2309,17 @@ mlan_status wlan_ret_wmm_get_status(pmlan_private priv, t_u8 *ptlv,
 			 * bounds */
 			ptlv_wmm_q_status->queue_index = MIN(
 				ptlv_wmm_q_status->queue_index, MAX_AC_QUEUES);
-
-			pac_status =
-				&priv->wmm.ac_status[ptlv_wmm_q_status
-							     ->queue_index];
-			pac_status->disabled = ptlv_wmm_q_status->disabled;
-			pac_status->flow_required =
-				ptlv_wmm_q_status->flow_required;
-			pac_status->flow_created =
-				ptlv_wmm_q_status->flow_created;
+			if (ptlv_wmm_q_status->queue_index < MAX_AC_QUEUES) {
+				pac_status =
+					&priv->wmm.ac_status
+						 [ptlv_wmm_q_status->queue_index];
+				pac_status->disabled =
+					ptlv_wmm_q_status->disabled;
+				pac_status->flow_required =
+					ptlv_wmm_q_status->flow_required;
+				pac_status->flow_created =
+					ptlv_wmm_q_status->flow_created;
+			}
 			break;

 		case TLV_TYPE_VENDOR_SPECIFIC_IE: /* WMM_IE */
--- a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
@ -278,7 +278,14 @@ typedef t_s32 t_sval;

 #ifdef PCIE
 /* Interrupt type */
-enum { RX_DATA, RX_EVENT, TX_COMPLETE, RX_CMD_RESP, RX_CMD_DNLD };
+enum {
+	RX_DATA,
+	RX_EVENT,
+	TX_COMPLETE,
+	RX_CMD_RESP,
+	RX_CMD_DNLD,
+	RX_DATA_DELAY
+};
 #endif
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
@ -388,6 +395,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_IW624 0x0b
 /** Black bird card type */
 #define CARD_TYPE_AW693 0x0c
+/** IW615 card type */
+#define CARD_TYPE_IW615 0x0c

 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
@ -423,6 +432,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_SDIW624 (CARD_TYPE_IW624 | (INTF_SD << 8))
 /** SD_IW624 card type */
 #define CARD_TYPE_SDAW693 (CARD_TYPE_AW693 | (INTF_SD << 8))
+/** SD_IW615 card type */
+#define CARD_TYPE_SDIW615 (CARD_TYPE_IW615 | (INTF_SD << 8))

 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@ -436,6 +447,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
 #define IS_SDIW624(ct) (CARD_TYPE_SDIW624 == (ct))
 #define IS_SDAW693(ct) (CARD_TYPE_SDAW693 == (ct))
+#define IS_SDIW615(ct) (CARD_TYPE_SDIW615 == (ct))

 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@ -461,6 +473,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SDIW624 "SDIW624"
 /** SDAW693 Card */
 #define CARD_SDAW693 "SDAW693"
+/** SDIW615 Card */
+#define CARD_SDIW615 "SDIW615"
 #endif

 #ifdef PCIE
@ -519,6 +533,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
 /** USBIW624 card type */
 #define CARD_TYPE_USBIW624 (CARD_TYPE_IW624 | (INTF_USB << 8))
+/** USBIW615 card type */
+#define CARD_TYPE_USBIW615 (CARD_TYPE_IW615 | (INTF_USB << 8))

 #define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
@ -527,6 +543,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
 #define IS_USBIW624(ct) (CARD_TYPE_USBIW624 == (ct))
+#define IS_USBIW615(ct) (CARD_TYPE_USBIW615 == (ct))

 /** USB8801 Card */
 #define CARD_USB8801 "USB8801"
@ -542,6 +559,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9097 "USBIW620"
 /** USBIW624 Card */
 #define CARD_USBIW624 "USBIW624"
+/** USBIW615 Card */
+#define CARD_USBIW615 "USBIW615"
 #endif

 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
@ -555,6 +574,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
 #define IS_CARDIW624(ct) (CARD_TYPE_IW624 == ((ct)&0xf))
 #define IS_CARDAW693(ct) (CARD_TYPE_AW693 == ((ct)&0xf))
+#define IS_CARDIW615(ct) (CARD_TYPE_IW615 == ((ct)&0xf))

 typedef struct _card_type_entry {
 	t_u16 card_type;
@ -714,6 +734,7 @@ typedef enum _mlan_buf_type {
 	MLAN_BUF_TYPE_EVENT,
 	MLAN_BUF_TYPE_RAW_DATA,
 #ifdef SDIO
+	MLAN_BUF_TYPE_SPA_DATA,
 #endif
 } mlan_buf_type;

@ -945,29 +966,34 @@ enum mlan_channel_type {
 };

 /** channel band */
-enum { BAND_2GHZ = 0,
-       BAND_5GHZ = 1,
-       BAND_6GHZ = 2,
-       BAND_4GHZ = 3,
+enum {
+	BAND_2GHZ = 0,
+	BAND_5GHZ = 1,
+	BAND_6GHZ = 2,
+	BAND_4GHZ = 3,
 };

 /** channel offset */
-enum { SEC_CHAN_NONE = 0,
-       SEC_CHAN_ABOVE = 1,
-       SEC_CHAN_5MHZ = 2,
-       SEC_CHAN_BELOW = 3 };
+enum {
+	SEC_CHAN_NONE = 0,
+	SEC_CHAN_ABOVE = 1,
+	SEC_CHAN_5MHZ = 2,
+	SEC_CHAN_BELOW = 3
+};

 /** channel bandwidth */
-enum { CHAN_BW_20MHZ = 0,
-       CHAN_BW_10MHZ,
-       CHAN_BW_40MHZ,
-       CHAN_BW_80MHZ,
+enum {
+	CHAN_BW_20MHZ = 0,
+	CHAN_BW_10MHZ,
+	CHAN_BW_40MHZ,
+	CHAN_BW_80MHZ,
 };

 /** scan mode */
-enum { SCAN_MODE_MANUAL = 0,
-       SCAN_MODE_ACS,
-       SCAN_MODE_USER,
+enum {
+	SCAN_MODE_MANUAL = 0,
+	SCAN_MODE_ACS,
+	SCAN_MODE_USER,
 };

 /** DFS state */
@ -2646,6 +2672,8 @@ typedef struct _mlan_device {
 	/** SDIO MPA Rx */
 	t_u32 mpa_rx_cfg;
 #ifdef SDIO
+	/** SDIO Single port rx aggr */
+	t_u8 sdio_rx_aggr_enable;
 	/* see blk_queue_max_segment_size */
 	t_u32 max_seg_size;
 	/* see blk_queue_max_segments */
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
@ -2410,6 +2410,8 @@ typedef struct _mlan_debug_info {
 	t_u32 last_int_status;
 	/** number of interrupt receive */
 	t_u32 num_of_irq;
+	/** flag for sdio rx aggr */
+	t_u8 sdio_rx_aggr;
 	/** FW update port number */
 	t_u32 mp_update[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX * 2];
 	/** Invalid port update count */
@ -4280,12 +4282,13 @@ enum _mlan_reg_type {
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
 	defined(PCIEIW624) || defined(USBIW624) || defined(SD9097) ||          \
-	defined(SD9177)
+	defined(SD9177) || defined(SDIW615) || defined(USBIW615)
 	MLAN_REG_CIU = 8,
 #endif
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(USB9097) || defined(SDIW624) ||           \
-	defined(PCIEIW624) || defined(USBIW624) || defined(SD9097)
+	defined(PCIEIW624) || defined(USBIW624) || defined(SD9097) ||          \
+	defined(SDIW615) || defined(USBIW615)
 	MLAN_REG_MAC2 = 0x81,
 	MLAN_REG_BBP2 = 0x82,
 	MLAN_REG_RF2 = 0x83,
@ -6122,7 +6125,7 @@ typedef struct _mlan_ds_stats {
 	/** tlv len */
 	t_u16 tlv_len;
 	/** TLV buffer */
-	t_u8 tlv_buf[1];
+	t_u8 tlv_buf[];
 } mlan_ds_stats;

 typedef struct _mlan_ds_ch_load {
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
@ -5005,10 +5005,12 @@ void woal_cfg80211_free_bands(struct wiphy *wiphy)
 *
 * @param priv           A pointer moal_private structure
 * @param reason_code    disconnect reason code
+ * @param bssid          A pointer to bssid
+ *
 *
 * @return          N/A
 */
-void woal_deauth_event(moal_private *priv, int reason_code)
+void woal_deauth_event(moal_private *priv, int reason_code, u8 *bssid)
 {
 	struct woal_event *evt;
 	unsigned long flags;
@ -5022,7 +5024,9 @@ void woal_deauth_event(moal_private *priv, int reason_code)
 	}
 	evt->priv = priv;
 	evt->type = WOAL_EVENT_DEAUTH;
-	evt->reason_code = reason_code;
+	evt->deauth_info.reason_code = reason_code;
+	moal_memcpy_ext(priv->phandle, evt->deauth_info.mac_addr, bssid,
+			MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	INIT_LIST_HEAD(&evt->link);
 	spin_lock_irqsave(&handle->evt_lock, flags);
 	list_add_tail(&evt->link, &handle->evt_queue);
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
@ -513,7 +513,7 @@ void woal_cfg80211_notify_antcfg(moal_private *priv, struct wiphy *wiphy,
 #endif

 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
-void woal_deauth_event(moal_private *priv, int reason_code);
+void woal_deauth_event(moal_private *priv, int reason_code, u8 *bssid);
 #endif

 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
@ -2940,8 +2940,8 @@ static int woal_cfg80211_subcmd_link_statistic_get(struct wiphy *wiphy,
 	ioctl_link_stats_buf = info->param.link_statistic;
 	num_radio = *((t_u32 *)info->param.link_statistic);

-	radio_stat = (wifi_radio_stat *)(info->param.link_statistic +
-					 sizeof(num_radio));
+	radio_stat =
+		(wifi_radio_stat *)(ioctl_link_stats_buf + sizeof(num_radio));
 	radio_stat_len = num_radio * sizeof(wifi_radio_stat);

 	/* Re-write on_time/tx_time/rx_time/on_time_scan from moal handle */
@ -2977,8 +2977,9 @@ static int woal_cfg80211_subcmd_link_statistic_get(struct wiphy *wiphy,
 		radio_stat_tmp++;
 	}

-	iface_stat = (wifi_iface_stat *)(info->param.link_statistic +
+	iface_stat = (wifi_iface_stat *)(ioctl_link_stats_buf +
 					 sizeof(num_radio) + radio_stat_len);
+
 	iface_stat_len = sizeof(wifi_iface_stat);

 	/* could get peer info with separate cmd */
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
@ -163,9 +163,10 @@ enum logger_attributes {

 /* Below events refer to the wifi_connectivity_event ring and shall be supported
 */
-enum { WIFI_EVENT_ASSOCIATION_REQUESTED = 0,
-       WIFI_EVENT_AUTH_COMPLETE,
-       WIFI_EVENT_ASSOC_COMPLETE,
+enum {
+	WIFI_EVENT_ASSOCIATION_REQUESTED = 0,
+	WIFI_EVENT_AUTH_COMPLETE,
+	WIFI_EVENT_ASSOC_COMPLETE,
 };

 enum {
@ -175,11 +176,13 @@ enum {
 	RING_BUFFER_ENTRY_FLAGS_HAS_TIMESTAMP = (1 << (1))
 };

-enum { ENTRY_TYPE_CONNECT_EVENT = 1,
-       ENTRY_TYPE_PKT,
-       ENTRY_TYPE_WAKE_LOCK,
-       ENTRY_TYPE_POWER_EVENT,
-       ENTRY_TYPE_DATA };
+enum {
+	ENTRY_TYPE_CONNECT_EVENT = 1,
+	ENTRY_TYPE_PKT,
+	ENTRY_TYPE_WAKE_LOCK,
+	ENTRY_TYPE_POWER_EVENT,
+	ENTRY_TYPE_DATA
+};

 /** WiFi ring buffer entry structure */
 typedef struct {
@ -506,9 +509,10 @@ int woal_packet_fate_monitor(moal_private *priv,
 #define APF_FRAME_HEADER_SIZE 14
 #define PACKET_FILTER_MAX_LEN 1024

-enum { PACKET_FILTER_STATE_INIT = 0,
-       PACKET_FILTER_STATE_STOP,
-       PACKET_FILTER_STATE_START,
+enum {
+	PACKET_FILTER_STATE_INIT = 0,
+	PACKET_FILTER_STATE_STOP,
+	PACKET_FILTER_STATE_START,
 };

 enum wifi_attr_packet_filter {
--- a/mxm_wifiex/wlan_src/mlinux/moal_debug.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_debug.c
@ -163,6 +163,8 @@ static struct debug_data items[] = {
 	 INFO_ADDR | (INTF_SD << 8)},
 	{"mp_invalid_update", item_size(mp_invalid_update),
 	 item_addr(mp_invalid_update), INFO_ADDR | (INTF_SD << 8)},
+	{"sdio_rx_aggr", item_size(sdio_rx_aggr), item_addr(sdio_rx_aggr),
+	 INFO_ADDR | (INTF_SD << 8)},
 	{"mpa_sent_last_pkt", item_size(mpa_sent_last_pkt),
 	 item_addr(mpa_sent_last_pkt), INFO_ADDR | (INTF_SD << 8)},
 	{"mpa_sent_no_ports", item_size(mpa_sent_no_ports),
@ -361,6 +363,8 @@ static struct debug_data uap_items[] = {
 	 INFO_ADDR | (INTF_SD << 8)},
 	{"mp_invalid_update", item_size(mp_invalid_update),
 	 item_addr(mp_invalid_update), INFO_ADDR | (INTF_SD << 8)},
+	{"sdio_rx_aggr", item_size(sdio_rx_aggr), item_addr(sdio_rx_aggr),
+	 INFO_ADDR | (INTF_SD << 8)},
 	{"mpa_sent_last_pkt", item_size(mpa_sent_last_pkt),
 	 item_addr(mpa_sent_last_pkt), INFO_ADDR | (INTF_SD << 8)},
 	{"mpa_sent_no_ports", item_size(mpa_sent_no_ports),
--- a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
@ -13248,8 +13248,8 @@ static int woal_priv_stats(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	ioctl_req->action = stats->action;

 	moal_memcpy_ext(priv->phandle, &misc->param.stats, stats,
-			sizeof(mlan_ds_stats) + stats->tlv_len - 1,
-			sizeof(mlan_ds_stats) + stats->tlv_len - 1);
+			sizeof(mlan_ds_stats) + stats->tlv_len,
+			sizeof(mlan_ds_stats) + stats->tlv_len);

 	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
@ -21857,16 +21857,45 @@ handled:
 		if (priv_cmd.used_len <= priv_cmd.total_len) {
 			memset(buf + priv_cmd.used_len, 0,
 			       (size_t)(CMD_BUF_LEN - priv_cmd.used_len));
+#ifdef CONFIG_COMPAT
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+			if (copy_to_user(
+				    ((in_compat_syscall()) ?
+					     compat_ptr((uintptr_t)cmd_buf) :
+					     (void __user *)cmd_buf),
+				    buf, priv_cmd.total_len))
+#else
 			if (copy_to_user((void __user *)cmd_buf, buf,
-					 priv_cmd.total_len)) {
+					 priv_cmd.total_len))
+#endif
+#else
+			if (copy_to_user((void __user *)cmd_buf, buf,
+					 priv_cmd.total_len))
+#endif
+			{
 				PRINTM(MERROR,
 				       "%s: failed to copy data to user buffer\n",
 				       __FUNCTION__);
 				ret = -EFAULT;
 				goto done;
 			}
+#ifdef CONFIG_COMPAT
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+			if (copy_to_user(
+				    ((in_compat_syscall()) ?
+					     compat_ptr((
+						     uintptr_t)(req->ifr_data)) :
+					     req->ifr_data),
+				    &priv_cmd, sizeof(android_wifi_priv_cmd)))
+#else
 			if (copy_to_user(req->ifr_data, &priv_cmd,
-					 sizeof(android_wifi_priv_cmd))) {
+					 sizeof(android_wifi_priv_cmd)))
+#endif
+#else
+			if (copy_to_user(req->ifr_data, &priv_cmd,
+					 sizeof(android_wifi_priv_cmd)))
+#endif
+			{
 				PRINTM(MERROR,
 				       "%s: failed to copy command header to user buffer\n",
 				       __FUNCTION__);
@ -22117,12 +22146,13 @@ int woal_do_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
 	int ret = 0;

 	ENTER();
-
+#if 0
 #ifdef CONFIG_COMPAT
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
 	if (in_compat_syscall()) /* not implemented yet */
 		return -EOPNOTSUPP;
 #endif
+#endif
 #endif

 	PRINTM(MINFO, "woal_do_ioctl: ioctl cmd = 0x%x\n", cmd);
--- a/mxm_wifiex/wlan_src/mlinux/moal_init.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_init.c
@ -292,6 +292,7 @@ static int indrstcfg = 0xffffffff;
 #define DEFAULT_DEV_CAP_MASK 0xffffffff
 static t_u32 dev_cap_mask = DEFAULT_DEV_CAP_MASK;
 #ifdef SDIO
+static int sdio_rx_aggr = MTRUE;
 #endif

 /** The global variable of scan beacon buffer **/
@ -364,6 +365,9 @@ static card_type_entry card_type_map_tbl[] = {
 #ifdef SDIW624
 	{CARD_TYPE_SDIW624, 0, CARD_SDIW624},
 #endif
+#ifdef SDIW615
+	{CARD_TYPE_SDIW615, 0, CARD_SDIW615},
+#endif
 #ifdef PCIE8897
 	{CARD_TYPE_PCIE8897, 0, CARD_PCIE8897},
 #endif
@ -401,7 +405,9 @@ static card_type_entry card_type_map_tbl[] = {
 #ifdef USBIW624
 	{CARD_TYPE_USBIW624, 0, CARD_USBIW624},
 #endif
-
+#ifdef USBIW615
+	{CARD_TYPE_USBIW615, 0, CARD_USBIW615},
+#endif
 };

 static int dfs53cfg = DFS_W53_DEFAULT_FW;
@ -1109,6 +1115,20 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			PRINTM(MMSG, "dev_cap_mask=%d\n", params->dev_cap_mask);
 		}
 #ifdef SDIO
+		else if (strncmp(line, "sdio_rx_aggr",
+				 strlen("sdio_rx_aggr")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			if (out_data)
+				moal_extflg_set(handle, EXT_SDIO_RX_AGGR);
+			else
+				moal_extflg_clear(handle, EXT_SDIO_RX_AGGR);
+			PRINTM(MMSG, "sdio_rx_aggr %s\n",
+			       moal_extflg_isset(handle, EXT_SDIO_RX_AGGR) ?
+				       "on" :
+				       "off");
+		}
 #endif
 		else if (strncmp(line, "pmic", strlen("pmic")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
@ -1755,6 +1775,8 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 	if (params)
 		handle->params.dev_cap_mask = params->dev_cap_mask;
 #ifdef SDIO
+	if (sdio_rx_aggr)
+		moal_extflg_set(handle, EXT_SDIO_RX_AGGR);
 #endif
 	if (pmic)
 		moal_extflg_set(handle, EXT_PMIC);
@ -2842,6 +2864,9 @@ MODULE_PARM_DESC(
 	"0: buf copy in amsud deaggregation; 1: avoid buf copy in amsud deaggregation (default)");

 #ifdef SDIO
+module_param(sdio_rx_aggr, int, 0);
+MODULE_PARM_DESC(sdio_rx_aggr,
+		 "1: Enable SDIO rx aggr; 0: Disable SDIO rx aggr");
 #endif

 module_param(pmic, int, 0);
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.c
@ -119,6 +119,7 @@ static struct _card_info card_info_SD8801 = {
 	.scratch_reg = 0x60,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0,
 	.fw_reset_reg = 0x64,
 	.fw_reset_val = 0,
 	.fw_wakeup_reg = 0,
@ -158,6 +159,7 @@ static struct _card_info card_info_SD8887 = {
 	.scratch_reg = 0x90,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0,
 	.fw_reset_reg = 0x0B6,
 	.fw_reset_val = 1,
 	.fw_wakeup_reg = 0,
@ -197,6 +199,7 @@ static struct _card_info card_info_SD8897 = {
 	.scratch_reg = 0xc0,
 	.func1_reg_start = 0x04,
 	.func1_reg_end = 0x0b,
+	.fw_stuck_code_reg = 0,
 	.fw_reset_reg = 0x0E8,
 	.fw_reset_val = 1,
 	.fw_wakeup_reg = 0,
@ -225,6 +228,7 @@ static struct _card_info card_info_PCIE8897 = {
 	.rev_id_reg = 0x0c58,
 	.fw_name = PCIE8897_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE8897_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0,
 	.sniffer_support = 0,
 	.per_pkt_cfg_support = 0,
 	.host_mlme_required = 0,
@ -280,6 +284,7 @@ static struct _card_info card_info_SD8977 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -322,6 +327,7 @@ static struct _card_info card_info_SD8978 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -364,6 +370,7 @@ static struct _card_info card_info_SD8997 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -407,6 +414,7 @@ static struct _card_info card_info_SD9098 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -450,6 +458,7 @@ static struct _card_info card_info_SD9097 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -493,6 +502,7 @@ static struct _card_info card_info_SDIW624 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -536,6 +546,7 @@ static struct _card_info card_info_SD9177 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -549,6 +560,47 @@ static struct _card_info card_info_SD9177 = {
 };
 #endif

+#ifdef SDIW615
+static struct _card_info card_info_SDIW615 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.histogram_table_num = 3,
+	.feature_control = FEATURE_CTRL_DEFAULT & (~FEATURE_CTRL_STREAM_2X2),
+	.rev_id_reg = 0xc8,
+	.host_strap_reg = 0xf4,
+	.magic_reg = 0xf0,
+	.fw_name = SDIW615_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = SDIW615_DEFAULT_WLAN_FW_NAME,
+#ifdef SDIO
+	.dump_fw_info = DUMP_FW_SDIO_V3,
+	.dump_fw_ctrl_reg = 0xf9,
+	.dump_fw_start_reg = 0xf1,
+	.dump_fw_end_reg = 0xf8,
+	.dump_fw_host_ready = 0xcc,
+	.dump_reg.reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60, 0x61, 0x62, 0x64,
+			       0x65, 0x66, 0x68, 0x69, 0x6a},
+	.dump_reg.reg_table_size = 13,
+	.scratch_reg = 0xe8,
+	.func1_reg_start = 0x10,
+	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
+	.fw_reset_reg = 0x0EE,
+	.fw_reset_val = 0x99,
+	.slew_rate_reg = 0x90002328,
+	.slew_rate_bit_offset = 12,
+#endif
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
+};
+#endif
+
 #ifdef PCIE8997
 static struct _card_info card_info_PCIE8997 = {
 	.embedded_supp = 1,
@ -566,6 +618,7 @@ static struct _card_info card_info_PCIE8997 = {
 	.magic_reg = 0x0cd4,
 	.fw_name = PCIE8997_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE8997_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0xcf8,
 	.fw_reset_reg = 0xcf4,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0x0c48,
@ -593,6 +646,7 @@ static struct _card_info card_info_PCIE9097 = {
 	.magic_reg = 0x1c74,
 	.fw_name = PCIE9097_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE9097_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0x1c80,
 	.fw_reset_reg = 0x1c94,
 	.fw_reset_val = 0x98,
 	.fw_wakeup_reg = 0x0,
@ -620,6 +674,7 @@ static struct _card_info card_info_PCIE9098 = {
 	.magic_reg = 0x1c74,
 	.fw_name = PCIE9098_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE9098_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0x1c98,
 	.fw_reset_reg = 0x1c94,
 	.fw_reset_val = 0x98,
 	.fw_wakeup_reg = 0x0,
@ -648,6 +703,7 @@ static struct _card_info card_info_PCIEIW624 = {
 	.boot_mode_reg = 0x1c8c,
 	.fw_name = PCIEIW624_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIEIW624_DEFAULT_WLAN_FW_NAME,
+	.fw_stuck_code_reg = 0x1c80,
 	.fw_reset_reg = 0x1c94,
 	.fw_reset_val = 0x98,
 	.fw_wakeup_reg = 0x0,
@ -782,6 +838,26 @@ static struct _card_info card_info_USBIW624 = {
 };
 #endif

+#ifdef USBIW615
+static struct _card_info card_info_USBIW615 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.feature_control = FEATURE_CTRL_DEFAULT,
+	.histogram_table_num = 3,
+	.fw_name = USBIW615_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = USBIW615_DEFAULT_WLAN_FW_NAME,
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
+};
+#endif
+
 #ifdef SD8987
 static struct _card_info card_info_SD8987 = {
 	.embedded_supp = 1,
@ -810,6 +886,7 @@ static struct _card_info card_info_SD8987 = {
 	.scratch_reg = 0xe8,
 	.func1_reg_start = 0x10,
 	.func1_reg_end = 0x17,
+	.fw_stuck_code_reg = 0xEB,
 	.fw_reset_reg = 0x0EE,
 	.fw_reset_val = 0x99,
 	.fw_wakeup_reg = 0,
@ -1021,7 +1098,8 @@ void woal_clean_up(moal_handle *handle)
 				if (priv->host_mlme)
 					woal_deauth_event(
 						priv,
-						MLAN_REASON_DEAUTH_LEAVING);
+						MLAN_REASON_DEAUTH_LEAVING,
+						priv->cfg_bssid);
 				else
 #endif
 					cfg80211_disconnected(priv->netdev, 0,
@ -1147,7 +1225,8 @@ static void woal_hang_work_queue(struct work_struct *work)
 				if (priv->host_mlme)
 					woal_deauth_event(
 						priv,
-						MLAN_REASON_DEAUTH_LEAVING);
+						MLAN_REASON_DEAUTH_LEAVING,
+						priv->cfg_bssid);
 				else
 #endif
 					cfg80211_disconnected(priv->netdev, 0,
@ -2300,6 +2379,8 @@ mlan_status woal_init_sw(moal_handle *handle)
 #endif
 #ifdef SDIO
 	if (IS_SD(handle->card_type)) {
+		device.sdio_rx_aggr_enable =
+			moal_extflg_isset(handle, EXT_SDIO_RX_AGGR);
 		device.int_mode = (t_u32)moal_extflg_isset(handle, EXT_INTMODE);
 		device.gpio_pin = (t_u32)handle->params.gpiopin;
 #ifdef SDIO_MMC
@ -2651,9 +2732,11 @@ static t_u32 woal_set_sdio_slew_rate(moal_handle *handle)
 	if ((handle->card_info->slew_rate_reg != 0) &&
 	    (handle->params.slew_rate > 3 || handle->params.slew_rate < 0))
 		return MLAN_STATUS_FAILURE;
-#if defined(SD9098) || defined(SD9097) || defined(SDIW624) || defined(SD9177)
+#if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
+	defined(SD9177) || defined(SDIW615)
 	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
-	    IS_SDIW624(handle->card_type) || IS_SD9177(handle->card_type))
+	    IS_SDIW624(handle->card_type) || IS_SDIW615(handle->card_type) ||
+	    IS_SD9177(handle->card_type))
 		reg_type = MLAN_REG_CIU;
 #endif

@ -4237,6 +4320,7 @@ static mlan_status woal_init_fw_dpc(moal_handle *handle)
 			    !IS_USB9098(handle->card_type) &&
 			    !IS_USB9097(handle->card_type) &&
 			    !IS_USBIW624(handle->card_type) &&
+			    !IS_USBIW615(handle->card_type) &&
 			    !IS_USB8978(handle->card_type))
 				ret = woal_reset_usb_dev(handle);
 			goto done;
@ -6710,6 +6794,8 @@ void woal_tx_timeout(struct net_device *dev
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	t_u8 auto_fw_dump = MFALSE;
+	moal_handle *ref_handle = NULL;
+
 	ENTER();

 	priv->num_tx_timeout++;
@ -6732,6 +6818,9 @@ void woal_tx_timeout(struct net_device *dev
 		woal_mlan_debug_info(priv);
 		woal_moal_debug_info(priv, NULL, MFALSE);
 		priv->phandle->driver_status = MTRUE;
+		ref_handle = (moal_handle *)priv->phandle->pref_mac;
+		if (ref_handle)
+			ref_handle->driver_status = MTRUE;
 		if (!auto_fw_dump && !priv->phandle->fw_dump)
 			woal_process_hang(priv->phandle);

@ -8727,6 +8816,11 @@ static int woal_get_card_info(moal_handle *phandle)
 		phandle->card_info = &card_info_SDIW624;
 		break;
 #endif
+#ifdef SDIW615
+	case CARD_TYPE_SDIW615:
+		phandle->card_info = &card_info_SDIW615;
+		break;
+#endif
 #ifdef SD9177
 	case CARD_TYPE_SD9177:
 		phandle->card_info = &card_info_SD9177;
@ -8785,6 +8879,11 @@ static int woal_get_card_info(moal_handle *phandle)
 		phandle->card_info = &card_info_USBIW624;
 		break;
 #endif
+#ifdef USBIW615
+	case CARD_TYPE_USBIW615:
+		phandle->card_info = &card_info_USBIW615;
+		break;
+#endif
 #ifdef SD8987
 	case CARD_TYPE_SD8987:
 		phandle->card_info = &card_info_SD8987;
@ -9610,7 +9709,8 @@ t_void woal_send_disconnect_to_system(moal_private *priv,
 			   is not valid */
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 			if (priv->host_mlme)
-				woal_deauth_event(priv, reason_code);
+				woal_deauth_event(priv, reason_code,
+						  priv->cfg_bssid);
 			else
 #endif
 				cfg80211_disconnected(priv->netdev, reason_code,
@ -11320,6 +11420,7 @@ t_void woal_scan_timeout_handler(struct work_struct *work)
 	unsigned long flags;
 	moal_private *priv = woal_get_priv(handle, MLAN_BSS_ROLE_STA);
 	t_u8 auto_fw_dump = MFALSE;
+	moal_handle *ref_handle = NULL;

 	ENTER();

@ -11347,6 +11448,10 @@ t_void woal_scan_timeout_handler(struct work_struct *work)
 				woal_moal_debug_info(priv, NULL, MFALSE);
 			}
 			handle->driver_status = MTRUE;
+			ref_handle = (moal_handle *)handle->pref_mac;
+			if (ref_handle)
+				ref_handle->driver_status = MTRUE;
+
 			if (!auto_fw_dump && !handle->fw_dump && priv)
 				woal_process_hang(priv->phandle);
 			wifi_status = WIFI_STATUS_SCAN_TIMEOUT;
@ -11426,8 +11531,9 @@ t_void woal_evt_work_queue(struct work_struct *work)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 		case WOAL_EVENT_DEAUTH:
 			priv = evt->priv;
-			woal_host_mlme_disconnect(evt->priv, evt->reason_code,
-						  priv->cfg_bssid);
+			woal_host_mlme_disconnect(evt->priv,
+						  evt->deauth_info.reason_code,
+						  evt->deauth_info.mac_addr);
 			break;

 		case WOAL_EVENT_ASSOC_RESP:
@ -11556,6 +11662,8 @@ static void woal_pcie_rx_data_task(unsigned long data)
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 	if (handle->cfg80211_suspend == MTRUE) {
+		mlan_process_pcie_interrupt_cb(handle->pmlan_adapter,
+					       RX_DATA_DELAY);
 		LEAVE();
 		return;
 	}
@ -11622,6 +11730,8 @@ t_void woal_pcie_rx_work_queue(struct work_struct *work)
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 	if (handle->cfg80211_suspend == MTRUE) {
+		mlan_process_pcie_interrupt_cb(handle->pmlan_adapter,
+					       RX_DATA_DELAY);
 		LEAVE();
 		return;
 	}
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.h
@ -398,11 +398,13 @@ typedef enum _MOAL_HARDWARE_STATUS {
 enum { MOAL_NO_WAIT, MOAL_IOCTL_WAIT, MOAL_IOCTL_WAIT_TIMEOUT };

 /** moal_main_state */
-enum { MOAL_STATE_IDLE,
-       MOAL_RECV_INT,
-       MOAL_ENTER_WORK_QUEUE,
-       MOAL_START_MAIN_PROCESS,
-       MOAL_END_MAIN_PROCESS };
+enum {
+	MOAL_STATE_IDLE,
+	MOAL_RECV_INT,
+	MOAL_ENTER_WORK_QUEUE,
+	MOAL_START_MAIN_PROCESS,
+	MOAL_END_MAIN_PROCESS
+};

 /** HostCmd_Header */
 typedef struct _HostCmd_Header {
@ -1224,7 +1226,7 @@ struct woal_event {
 		chan_band_info chan_info;
 		woal_evt_buf evt;
 		mlan_ds_assoc_info assoc_info;
-		int reason_code;
+		mlan_deauth_param deauth_info;
 		chan_radar_info radar_info;
 	};
 };
@ -1667,7 +1669,7 @@ struct _moal_private {
 #endif
 #ifdef STA_CFG80211
 #ifdef STA_SUPPORT
-	/** CFG80211 association description */
+	/** CFG80211 association bssid  */
 	t_u8 cfg_bssid[ETH_ALEN];
 	/** Disconnect request from CFG80211 */
 	bool cfg_disconnect;
@ -1728,6 +1730,10 @@ struct _moal_private {
 	t_u8 auth_tx_cnt;
 	/** deauth evt cnt */
 	t_u8 deauth_evt_cnt;
+	/** delay deauth event */
+	t_u8 delay_deauth_notify;
+	/** notify bssid */
+	t_u8 bssid_notify[ETH_ALEN];
 #endif
 #ifdef CONFIG_PROC_FS
 	/** Proc entry */
@ -1933,6 +1939,7 @@ typedef struct _card_info {
 	t_u8 slew_rate_bit_offset;
 #endif
 #if defined(SDIO) || defined(PCIE)
+	t_u32 fw_stuck_code_reg;
 	t_u32 fw_reset_reg;
 	t_u8 fw_reset_val;
 	t_u32 fw_wakeup_reg;
@ -2176,7 +2183,8 @@ extern t_u8 ru_signal_52[9];
 				y = (y + 1) - TONE_MAX_USERS_242;                 \
 			} else {                                                  \
 				tone = (y == 2) ? RU_TONE_106 :                   \
-						  (y == 1) ? 0 : RU_TONE_106;     \
+				       (y == 1) ? 0 :                             \
+						  RU_TONE_106;                    \
 			}                                                         \
 		} else if (x == RU_40_242_TONE) {                                 \
 			if (!y) {                                                 \
@ -2377,6 +2385,7 @@ enum ext_mod_params {
 	EXT_AGGR_CTRL,
 	EXT_LOW_PW_MODE,
 #ifdef SDIO
+	EXT_SDIO_RX_AGGR,
 #endif
 	EXT_PMIC,
 	EXT_DISCONNECT_ON_SUSPEND,
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
@ -331,6 +331,8 @@ static mlan_status woal_do_flr(moal_handle *handle, bool prepare, bool flr_flag)

 	if (!prepare)
 		goto perform_init;
+	if (!handle->pmlan_adapter)
+		goto exit;

 	/* Reset all interfaces */
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
@ -415,6 +417,8 @@ perform_init:
 		PRINTM(MFATAL, "Software Init Failed\n");
 		goto err_init_fw;
 	}
+	if (!handle->pmlan_adapter)
+		goto err_init_fw;

 #if defined(PCIE9098)
 	if ((card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1) ||
@ -1700,6 +1704,18 @@ static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 		drv_ptr += sprintf(drv_ptr, "reg:0x%02x value=0x%08x\n",
 				   config_reg_table[i], value);
 	}
+
+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		woal_pcie_read_reg(phandle, reg, &value);
+		value = (value & 0xff00) >> 8;
+		if (value) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", value);
+			drv_ptr += sprintf(drv_ptr, "FW in debug mode (0x%x)\n",
+					   value);
+		}
+	}
+
 	drv_ptr += sprintf(drv_ptr, "FW Scrach Registers:\n");

 #if defined(PCIE8897) || defined(PCIE8997)
@ -1849,6 +1865,16 @@ static void woal_pcie_reg_dbg(moal_handle *phandle)
 		PRINTM(MERROR, "reg:0x%02x value=0x%08x\n", config_reg_table[i],
 		       value);
 	}
+
+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		woal_pcie_read_reg(phandle, reg, &value);
+		value = (value & 0xff00) >> 8;
+		if (value) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", value);
+		}
+	}
+
 	PRINTM(MMSG, "FW Scrach Registers:\n");
 #if defined(PCIE8897) || defined(PCIE8997)
 	if (IS_PCIE8897(phandle->card_type) ||
--- a/mxm_wifiex/wlan_src/mlinux/moal_proc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_proc.c
@ -672,6 +672,7 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 			handle->driver_status = MTRUE;
 		ref_handle = (moal_handle *)handle->pref_mac;
 		if (ref_handle) {
+			ref_handle->driver_status = MTRUE;
 			priv = woal_get_priv(ref_handle, MLAN_BSS_ROLE_ANY);
 			if (priv) {
 				ref_handle->fw_dump_status = MTRUE;
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
@ -156,19 +156,27 @@ Change log:
 #ifdef SD9177
 #define SD9177_A0 0x00
 #define SD9177_A1 0x01
-#define SD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin"
-#define SD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin"
-#define SDUART9177_DEFAULT_COMBO_FW_NAME "nxp/sduart_nw61x.bin"
-#define SDSD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin"
-#define SD9177_DEFAULT_WLAN_FW_NAME "nxp/sd_w61x.bin"
-#define SDUART9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin"
-#define SDSD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_v1.bin"
-#define SD9177_DEFAULT_WLAN_V1_FW_NAME "nxp/sd_w61x_v1.bin"
-#define SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME "nxp/sduart_nw61x_rftm_v1.bin"
-#define SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_rftm_v1.bin"
-#define SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME "nxp/sd_w61x_rftm_v1.bin"
+#define SD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin.se"
+#define SD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin.se"
+#define SDUART9177_DEFAULT_COMBO_FW_NAME "nxp/sduart_nw61x.bin.se"
+#define SDSD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin.se"
+#define SD9177_DEFAULT_WLAN_FW_NAME "nxp/sd_w61x.bin.se"
+#define SDUART9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sduart_nw61x_v1.bin.se"
+#define SDSD9177_DEFAULT_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_v1.bin.se"
+#define SD9177_DEFAULT_WLAN_V1_FW_NAME "nxp/sd_w61x_v1.bin.se"
+#define SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME                               \
+	"nxp/sduart_nw61x_rftm_v1.bin.se"
+#define SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME "nxp/sdsd_nw61x_rftm_v1.bin.se"
+#define SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME "nxp/sd_w61x_rftm_v1.bin.se"
 #endif /* SD9177 */

+#ifdef SDIW615
+#define SDIW615_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw615_combo.bin"
+#define SDUARTIW615_COMBO_FW_NAME "nxp/sduartiw615_combo.bin"
+#define SDSDIW615_COMBO_FW_NAME "sdsdiw615_combo.bin"
+#define SDIW615_DEFAULT_WLAN_FW_NAME "nxp/sdiw615_wlan.bin"
+#endif /* SDIW615 */
+
 /********************************************************
 		Global Functions
 ********************************************************/
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
@ -96,6 +96,10 @@ static moal_if_ops sdiommc_ops;
 /** Device ID for SDIW624 */
 #define SD_DEVICE_ID_IW624 (0x020D)
 #endif
+#ifdef SDIW615
+/** Device ID for SDIW615 */
+#define SD_DEVICE_ID_IW615 (0x020D)
+#endif

 /** WLAN IDs */
 static const struct sdio_device_id wlan_ids[] = {
@ -132,6 +136,9 @@ static const struct sdio_device_id wlan_ids[] = {
 #endif
 #ifdef SDIW624
 	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_IW624)},
+#endif
+#ifdef SDIW615
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_IW615)},
 #endif
 	{},
 };
@ -461,6 +468,20 @@ static t_u16 woal_update_card_type(t_void *card)
 			strlen(driver_version) -
 				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
 	}
+#endif
+#ifdef SDIW615
+	if (cardp_sd->func->device == SD_DEVICE_ID_IW615) {
+		card_type = CARD_TYPE_SDIW615;
+		moal_memcpy_ext(NULL, driver_version, CARD_SDIW615,
+				strlen(CARD_SDIW615), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V18, strlen(V18),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
 #endif
 	return card_type;
 }
@ -1444,7 +1465,7 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)

 #if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
 	defined(SD9097) || defined(SDIW624) || defined(SD8978) ||              \
-	defined(SD9177)
+	defined(SD9177) || defined(SDIW615)
 	t_u32 magic_reg = handle->card_info->magic_reg;
 	t_u32 magic = 0;
 	t_u32 host_strap_reg = handle->card_info->host_strap_reg;
@ -1465,7 +1486,7 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)

 #if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
 	defined(SD9097) || defined(SDIW624) || defined(SD8978) ||              \
-	defined(SD9177)
+	defined(SD9177) || defined(SDIW615)
 	/** Revision ID register */
 	woal_sdiommc_read_reg(handle, magic_reg, &magic);
 	/** Revision ID register */
@ -1718,6 +1739,19 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 		}
 	}
 #endif
+
+#ifdef SDIW615
+	if (IS_SDIW615(handle->card_type)) {
+		if (magic == CHIP_MAGIC_VALUE) {
+			if (strap == CARD_TYPE_SD_UART)
+				strcpy(handle->card_info->fw_name,
+				       SDUARTIW615_COMBO_FW_NAME);
+			else
+				strcpy(handle->card_info->fw_name,
+				       SDSDIW615_COMBO_FW_NAME);
+		}
+	}
+#endif
 done:
 	PRINTM(MCMND, "combo fw:%s wlan fw:%s \n", handle->card_info->fw_name,
 	       handle->card_info->fw_name_wlan);
@ -2571,6 +2605,15 @@ static void woal_sdiommc_reg_dbg(moal_handle *phandle)
 	char buf[256], *ptr;

 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
+
+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		ret = woal_sdio_readb(phandle, reg, &data);
+		if (!ret && data) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", data);
+		}
+	}
+
 	for (loop = 0; loop < 5; loop++) {
 		memset(buf, 0, sizeof(buf));
 		ptr = buf;
@ -2716,6 +2759,16 @@ static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)

 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);

+	reg = phandle->card_info->fw_stuck_code_reg;
+	if (reg != 0) {
+		ret = woal_sdio_readb(phandle, reg, &data);
+		if (!ret && data) {
+			PRINTM(MERROR, "FW in debug mode (0x%x)\n", data);
+			drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN,
+					    "FW in debug mode (0x%x)\n", data);
+		}
+	}
+
 	drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN,
 			    "--------sdio_reg_debug_info---------\n");
 	for (loop = 0; loop < 5; loop++) {
@ -2875,10 +2928,11 @@ static int woal_sdiommc_reset_fw(moal_handle *handle)
 		ret = -EFAULT;
 		goto done;
 	}
-#if defined(SD9098) || defined(SD9097) || defined(SDIW624) || defined(SD9177)
+#if defined(SD9098) || defined(SD9097) || defined(SDIW624) ||                  \
+	defined(SD9177) || defined(SDIW615)
 	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
 	    IS_SDIW624(handle->card_type) || IS_SD9177(handle->card_type) ||
-	    IS_SDAW693(handle->card_type))
+	    IS_SDIW615(handle->card_type) || IS_SDAW693(handle->card_type))
 		handle->ops.write_reg(handle, 0x00, 0x10);
 #endif
 	/* Poll register around 100 ms */
--- a/mxm_wifiex/wlan_src/mlinux/moal_shim.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
@ -2955,10 +2955,11 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)

 		if (!is_zero_timeval(priv->phandle->scan_time_start)) {
 			woal_get_monotonic_time(&priv->phandle->scan_time_end);
-			priv->phandle->scan_time += (t_u64)(
-				timeval_to_usec(priv->phandle->scan_time_end) -
-				timeval_to_usec(
-					priv->phandle->scan_time_start));
+			priv->phandle->scan_time +=
+				(t_u64)(timeval_to_usec(
+						priv->phandle->scan_time_end) -
+					timeval_to_usec(
+						priv->phandle->scan_time_start));
 			PRINTM(MINFO,
 			       "%s : start_timeval=%d:%d end_timeval=%d:%d inter=%llu scan_time=%llu\n",
 			       __func__,
@ -3293,6 +3294,12 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 					0,
 #endif
 					GFP_KERNEL);
+/* sending becon_loss event will help supplicant to roam to other APs if
+ * available on the same Network */
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+				cfg80211_cqm_beacon_loss_notify(priv->netdev,
+								GFP_KERNEL);
+#endif
 			}
 			priv->last_event |= EVENT_PRE_BCN_LOST;
 		}
--- a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
@ -2174,6 +2174,7 @@ static int woal_cfg80211_authenticate(struct wiphy *wiphy,
 #endif

 	priv->cfg_disconnect = MFALSE;
+	priv->delay_deauth_notify = MFALSE;
 #ifdef UAP_CFG80211
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
 		PRINTM(MERROR, "ERR: Role is AP\n");
@ -5512,12 +5513,9 @@ static int woal_cfg80211_deauthenticate(struct wiphy *wiphy,

 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (priv->host_mlme) {
-		priv->host_mlme = MFALSE;
-		priv->auth_flag = 0;
-		priv->auth_alg = 0xFFFF;
-		/*send deauth packet to notify disconnection to wpa_supplicant
-		 */
-		woal_deauth_event(priv, req->reason_code);
+		priv->delay_deauth_notify = MTRUE;
+		moal_memcpy_ext(priv->phandle, priv->bssid_notify, req->bssid,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	}
 #endif

@ -5560,12 +5558,15 @@ static int woal_cfg80211_disassociate(struct wiphy *wiphy,

 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (priv->host_mlme) {
-		priv->host_mlme = MFALSE;
-		priv->auth_flag = 0;
-		priv->auth_alg = 0xFFFF;
-		/*send deauth packet to notify disconnection to wpa_supplicant
-		 */
-		woal_deauth_event(priv, req->reason_code);
+		priv->delay_deauth_notify = MTRUE;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)
+		moal_memcpy_ext(priv->phandle, priv->bssid_notify, req->ap_addr,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+#else
+		moal_memcpy_ext(priv->phandle, priv->bssid_notify,
+				req->bss->bssid, MLAN_MAC_ADDR_LENGTH,
+				MLAN_MAC_ADDR_LENGTH);
+#endif
 	}
 #endif

@ -6842,7 +6843,20 @@ int woal_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow)

 	handle->cfg80211_suspend = MTRUE;
 	if (!wow) {
-		PRINTM(MERROR, "None of the WOWLAN triggers enabled\n");
+		PRINTM(MEVENT,
+		       "None of the WOWLAN triggers enabled in suspend\n");
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		if (priv->delay_deauth_notify) {
+			priv->delay_deauth_notify = MFALSE;
+			priv->host_mlme = MFALSE;
+			priv->auth_flag = 0;
+			priv->auth_alg = 0xFFFF;
+			/*send deauth packet to notify disconnection to
+			 * wpa_supplicant */
+			woal_deauth_event(priv, MLAN_REASON_DEAUTH_LEAVING,
+					  priv->bssid_notify);
+		}
+#endif
 		ret = 0;
 		goto done;
 	}
@ -7923,20 +7937,30 @@ static int woal_send_tdls_action_frame(struct wiphy *wiphy,
 	t_u16 pkt_len;
 	t_u16 packet_len;
 	int ret = 0;
+	t_u16 buf_size = 0;

 	ENTER();

 #define HEADER_SIZE 8 /* pkt_type + tx_control */

-	pmbuf = woal_alloc_mlan_buffer(
-		priv->phandle,
-		((int)((MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE +
-			sizeof(pkt_len) +
+	woal_secure_add(&buf_size, MLAN_MIN_DATA_HEADER_LEN, &buf_size,
+			TYPE_UINT32);
+	woal_secure_add(&buf_size, HEADER_SIZE, &buf_size, TYPE_UINT32);
+	woal_secure_add(&buf_size, sizeof(pkt_len), &buf_size, TYPE_UINT32);
+	woal_secure_add(&buf_size,
 			max(sizeof(struct ieee80211_mgmt),
-			    sizeof(struct ieee80211_tdls_data))) +
-		       50 + /* supported rates */
-		       sizeof(IEEEtypes_ExtCap_t) + /* ext capab */
-		       extra_ies_len + sizeof(IEEEtypes_tdls_linkie))));
+			    sizeof(struct ieee80211_tdls_data)),
+			&buf_size, TYPE_UINT32);
+	/* supported rates */
+	woal_secure_add(&buf_size, 50, &buf_size, TYPE_UINT32);
+	/* ext capab */
+	woal_secure_add(&buf_size, sizeof(IEEEtypes_ExtCap_t), &buf_size,
+			TYPE_UINT32);
+	woal_secure_add(&buf_size, extra_ies_len, &buf_size, TYPE_UINT32);
+	woal_secure_add(&buf_size, sizeof(IEEEtypes_tdls_linkie), &buf_size,
+			TYPE_UINT32);
+	pmbuf = woal_alloc_mlan_buffer(priv->phandle, buf_size);
+
 	if (!pmbuf) {
 		PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
 		ret = -ENOMEM;
@ -9620,8 +9644,8 @@ void woal_host_mlme_disconnect(moal_private *priv, u16 reason_code, u8 *sa)
 		moal_memcpy_ext(priv->phandle, mgmt->sa,
 				priv->sme_current.bssid, ETH_ALEN,
 				sizeof(mgmt->sa));
-		moal_memcpy_ext(priv->phandle, mgmt->bssid, priv->cfg_bssid,
-				ETH_ALEN, sizeof(mgmt->bssid));
+		moal_memcpy_ext(priv->phandle, mgmt->bssid, sa, ETH_ALEN,
+				sizeof(mgmt->bssid));
 		priv->host_mlme = MFALSE;
 		priv->auth_flag = 0;
 	} else {
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap.c
@ -4609,12 +4609,13 @@ int woal_uap_do_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
 {
 	int ret = 0;
 	ENTER();
-
+#if 0
 #ifdef CONFIG_COMPAT
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
 	if (in_compat_syscall()) /* not implemented yet */
 		return -EOPNOTSUPP;
 #endif
+#endif
 #endif

 	switch (cmd) {
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
@ -3452,9 +3452,9 @@ int woal_uap_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
 	if (info->param.sta_list.info[idx].stats.last_rx_in_msec) {
 		moal_get_system_time(priv->phandle, &sec, &usec);
 		cur_msec = (t_u64)sec * 1000 + (t_u64)usec / 1000;
-		sinfo->inactive_time = (t_u32)(
-			cur_msec -
-			info->param.sta_list.info[idx].stats.last_rx_in_msec);
+		sinfo->inactive_time =
+			(t_u32)(cur_msec - info->param.sta_list.info[idx]
+						   .stats.last_rx_in_msec);
 		PRINTM(MIOCTL,
 		       "cur:%llu - [%d].last_rx:%llu = inactive_time:%d\n",
 		       cur_msec, idx,
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.c
@ -35,7 +35,7 @@ extern struct semaphore AddRemoveCardSem;
 ********************************************************/

 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBIW624)
+	defined(USB8978) || defined(USBIW624) || defined(USBIW615)
 /** Card-type detection frame response */
 typedef struct {
 	/** 32-bit ACK+WINNER field */
@ -100,6 +100,12 @@ static struct usb_device_id woal_usb_table[] = {
 			"NXP WLAN USB Adapter")},
 	{NXP_USB_DEVICE(USBIW624_VID_1, USBIW624_PID_2,
 			"NXP WLAN USB Adapter")},
+#endif
+#ifdef USBIW615
+	{NXP_USB_DEVICE(USBIW615_VID_1, USBIW615_PID_1,
+			"NXP WLAN USB Adapter")},
+	{NXP_USB_DEVICE(USBIW615_VID_1, USBIW615_PID_2,
+			"NXP WLAN USB Adapter")},
 #endif
 	/* Terminating entry */
 	{},
@ -131,6 +137,10 @@ static struct usb_device_id woal_usb_table_skip_fwdnld[] = {
 #ifdef USBIW624
 	{NXP_USB_DEVICE(USBIW624_VID_1, USBIW624_PID_2,
 			"NXP WLAN USB Adapter")},
+#endif
+#ifdef USBIW615
+	{NXP_USB_DEVICE(USBIW615_VID_1, USBIW615_PID_2,
+			"NXP WLAN USB Adapter")},
 #endif
 	/* Terminating entry */
 	{},
@ -497,7 +507,7 @@ rx_ret:
 ********************************************************/

 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBIW624)
+	defined(USB8978) || defined(USBIW624) || defined(USBIW615)
 /**
 *  @brief  Check chip revision
 *
@ -825,6 +835,22 @@ static t_u16 woal_update_card_type(t_void *card)
 				strlen(driver_version) - strlen(INTF_CARDTYPE) -
 					strlen(KERN_VERSION));
 	}
+#endif
+#ifdef USBIW615
+	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
+		    (__force __le16)USBIW615_PID_1 ||
+	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
+		    (__force __le16)USBIW615_PID_2) {
+		card_type = CARD_TYPE_USBIW615;
+		moal_memcpy_ext(NULL, driver_version, CARD_USBIW615,
+				strlen(CARD_USBIW615), strlen(driver_version));
+		moal_memcpy_ext(NULL,
+				driver_version + strlen(INTF_CARDTYPE) +
+					strlen(KERN_VERSION),
+				V17, strlen(V17),
+				strlen(driver_version) - strlen(INTF_CARDTYPE) -
+					strlen(KERN_VERSION));
+	}
 #endif
 	return card_type;
 }
@ -896,6 +922,9 @@ static int woal_usb_probe(struct usb_interface *intf,
 #ifdef USBIW624
 			case (__force __le16)USBIW624_PID_1:
 #endif /* USBIW624 */
+#ifdef USBIW615
+			case (__force __le16)USBIW615_PID_1:
+#endif /* USBIW615 */

 				/* If skip FW is set, we must return error so
 				 * the next driver can download the FW */
@ -926,6 +955,9 @@ static int woal_usb_probe(struct usb_interface *intf,
 #ifdef USBIW624
 			case (__force __le16)USBIW624_PID_2:
 #endif /* USBIW624 */
+#ifdef USBIW615
+			case (__force __le16)USBIW615_PID_2:
+#endif /* USBIW615 */

 				usb_cardp->boot_state = USB_FW_READY;
 				break;
@ -2064,7 +2096,7 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBIW624)
+	defined(USB8978) || defined(USBIW624) || defined(USBIW615)
 	t_u32 revision_id = 0;
 	t_u32 strap = 0;
 	t_u32 boot_mode = 0;
@ -2085,7 +2117,7 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 #endif

 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBIW624)
+	defined(USB8978) || defined(USBIW624) || defined(USBIW615)
 	ret = woal_check_chip_revision(handle, &revision_id, &strap,
 				       &boot_mode);
 	if (ret != MLAN_STATUS_SUCCESS) {
@ -2203,6 +2235,16 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 				USBUSBIW624_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
 	}
 #endif
+#ifdef USBIW615
+	if (IS_USBIW615(handle->card_type)) {
+		if (strap == CARD_TYPE_USB_UART)
+			strcpy(handle->card_info->fw_name,
+			       USBUARTIW615_COMBO_FW_NAME);
+		else
+			strcpy(handle->card_info->fw_name,
+			       USBUSBIW615_COMBO_FW_NAME);
+	}
+#endif

 done:
 	PRINTM(MCMND, "combo fw:%s wlan fw:%s \n", handle->card_info->fw_name,
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.h
@ -98,6 +98,15 @@ Change Log:
 #define USBIW624_PID_2 0x020F
 #endif /* USBIW624 */

+#ifdef USBIW615
+/** USB VID 1 */
+#define USBIW615_VID_1 0x0471
+/** USB PID 1 */
+#define USBIW615_PID_1 0x021E
+/** USB PID 2 */
+#define USBIW615_PID_2 0x021F
+#endif /* USBIW615 */
+
 /** Boot state: FW download */
 #define USB_FW_DNLD 1
 /** Boot state: FW ready */
@ -110,7 +119,8 @@ Change Log:
 #define MVUSB_RX_DATA_URB 6

 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USB8801) || defined(USBIW624)
+	defined(USB8978) || defined(USB8801) || defined(USBIW624) ||           \
+	defined(USBIW615)
 /* Transmit buffer size for chip revision check */
 #define CHIP_REV_TX_BUF_SIZE 16
 /* Receive buffer size for chip revision check */
@ -174,11 +184,18 @@ Change Log:

 #ifdef USBIW624
 #define USBIW624_DEFAULT_COMBO_FW_NAME "nxp/usbusbiw624_combo.bin"
-#define USBUARTIW624_COMBO_FW_NAME "nxp/usbusbiw624_combo.bin"
+#define USBUARTIW624_COMBO_FW_NAME "nxp/usbuartiw624_combo.bin"
 #define USBUSBIW624_COMBO_FW_NAME "nxp/usbusbiw624_combo.bin"
 #define USBIW624_DEFAULT_WLAN_FW_NAME "nxp/usbiw624_wlan.bin"
 #endif /* USBIW624 */

+#ifdef USBIW615
+#define USBIW615_DEFAULT_COMBO_FW_NAME "nxp/usbusbiw615_combo.bin"
+#define USBUARTIW615_COMBO_FW_NAME "nxp/usbuartiw615_combo.bin"
+#define USBUSBIW615_COMBO_FW_NAME "nxp/usbusbiw615_combo.bin"
+#define USBIW615_DEFAULT_WLAN_FW_NAME "nxp/usbiw615_wlan.bin"
+#endif /* USBIW615 */
+
 /** urb context */
 typedef struct _urb_context {
 	/** Pointer to moal_handle structure */
--- a/mxm_wifiex/wlan_src/mlinux/moal_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
@ -3156,8 +3156,8 @@ static int woal_get_scan(struct net_device *dev, struct iw_request_info *info,

 			while ((unsigned int)beacon_size >=
 			       sizeof(IEEEtypes_Header_t)) {
-				element_id = (IEEEtypes_ElementId_e)(
-					*(t_u8 *)pbeacon);
+				element_id = (IEEEtypes_ElementId_e)(*(
+					t_u8 *)pbeacon);
 				element_len = *((t_u8 *)pbeacon + 1);
 				if ((unsigned int)beacon_size <
 				    (unsigned int)element_len +