diff --git a/mxm_wifiex/wlan_src/Makefile b/mxm_wifiex/wlan_src/Makefile
index 9e88a83..4392f10 100644
--- a/mxm_wifiex/wlan_src/Makefile
+++ b/mxm_wifiex/wlan_src/Makefile
@@ -37,7 +37,7 @@ CONFIG_SD8897=n
 CONFIG_USB8897=n
 CONFIG_PCIE8897=n
 CONFIG_SD8977=n
-CONFIG_SD8978=n
+CONFIG_SD8978=y
 CONFIG_USB8978=n
 CONFIG_SD8997=y
 CONFIG_USB8997=n
@@ -343,6 +343,7 @@ endif
 #ccflags-y += -Wmissing-field-initializers
 #ccflags-y += -Wstringop-truncation
 #ccflags-y += -Wmisleading-indentation
+#ccflags-y += -Wunused-const-variable
 #############################################################################
 # Make Targets
 #############################################################################
diff --git a/mxm_wifiex/wlan_src/README_MLAN b/mxm_wifiex/wlan_src/README_MLAN
index 27ead6d..800e769 100644
--- a/mxm_wifiex/wlan_src/README_MLAN
+++ b/mxm_wifiex/wlan_src/README_MLAN
@@ -119,7 +119,8 @@
 	multi_dtim=0|x <use default DTIM interval(default) | set x*beacon_period as DTIM interval>
 	inact_tmo=0|x <use default IEEE ps inactivity timout value (default) | use IEEE ps inactivity timeout value x ms>
 	uap_max_sta: Maximum number of STA for UAP/GO (default 0, max 64)
-	host_mlme=0|1 <Disable Host MLME support (default)| Enable Host MLME support>
+	host_mlme=0|1 <Operate in non-host_mlme mode (default)| Operate in host_mlme mode>
+	for supplicant/authenticator running on host side, WPA3 support is available only in host_mlme mode
 	country_ie_ignore=0|1 <Follow countryIE from AP and beacon hint enable (default) | Ignore countryIE from AP and beacon hint disable>
 	beacon_hints=0|1 <enable beacon hints(default) | disable beacon hints>
 
@@ -439,6 +440,8 @@ SYNOPSIS
 	mlanutl mlanX txratecfg [l] [m] [n] [o]
 	mlanutl uapX txratecfg [l] [m] [n] [o]
 	mlanutl mlanX hssetpara condition [GPIO# [gap]] [ind_GPIO# [level]]
+	mlanutl mlanX mefcfg <mef.conf>
+        mlanutl mlanX cloud_keep_alive <keep_alive.conf> <start/stop/reset>
 
 DESCRIPTION
 	Those commands are used to send additional commands to the NXP MLAN
@@ -640,6 +643,31 @@ getlog
 	dot11AMPDUDelimiterCRCErrorCount	Increments when an MPDU delimiter has a CRC error when this is the first
 						CRC error in the received A-MPDU or when the previous delimiter has been decoded correctly
 
+        Cmd Usage: mlanutl mlanX getlog ext
+	The above command is used with the argument "ext" to display the following error statistics:-
+
+	rxStuckIssueCount-1
+        rxStuckIssueCount-2
+        rxStuckRecoveryCount
+        rxStuckTsf-1
+        rxStuckTsf-2
+        txWatchdogRecoveryCount
+        txWatchdogTsf-1
+        txWatchdogTsf-2
+        channelSwitchAnnouncementSent
+        channelSwitchState
+        registerClass
+        channelNumber
+        channelSwitchMode
+        RxResetRecoveryCount
+        RxIsr2NotDoneCnt
+        gdmaAbortCnt
+        gResetRxMacCnt
+        gOwnrshpCtlErrCnt
+        gOwnrshpBcnErrCnt
+        gOwnrshpMgtErrCnt
+        gOwnrshpDatErrCnt
+
 getsignal
 	This command gets the last and average value of RSSI, SNR and NF of
 	Beacon and Data.
@@ -731,9 +759,10 @@ Usage:
 		0:      Get 2.4G txpwrlimit table
 		0x10:   Get 5G sub0 txpwrlimit table
 		0x11:   Get 5G sub1 txpwrlimit table
-		0x12    Get 5G sub2 txpwrlimit table
-		0x1f    Get all 5G txpwrlimit table
-		0xff    Get both 2G and 5G txpwrlimit table
+		0x12:   Get 5G sub2 txpwrlimit table
+		0x13:   Get 5G sub3 txpwrlimit table
+		0x1f:   Get all 5G txpwrlimit table
+		0xff:   Get both 2G and 5G txpwrlimit table
 	<raw_data_file> driver will save fw raw data to this file.
 
     Examples:
@@ -1403,3 +1432,27 @@ hssetpara
 
 	Note: The parameters will be saved in the driver and be used when host suspends.
               The ind_GPIO# and level parameters only work with specific board and firmware.
+mefcfg
+	This command is used to set MEF settings.
+
+	Usage:
+		mlanutl mlanX mefcfg <mef.conf>
+
+	Where the parameter is:
+		mef.conf : The configuration file specifying the MEF settings.
+
+	Example:
+		mlanutl mlan0 mefcfg config/mef.conf
+cloud_keep_alive
+        This command is used to start/stop send keep alive packet which set from host.And reset TCP connection.
+
+        Usage:
+                mlanutl mlanX cloud_keep_alive <keep_alive.conf> <start/stop/reset>
+
+        where <start/stop/reset>
+                start means set cloud keep alive packet and paramters to firmware. stop means stop firmware from sending keep alive packet.reset will stop and reset TCP connection when host resume.
+
+        Examples:
+                mlanutl mlan0 cloud_keep_alive keep_alive.conf start
+                mlanutl mlan0 cloud_keep_alive keep_alive.conf stop
+                mlanutl mlan0 cloud_keep_alive keep_alive.conf reset
diff --git a/mxm_wifiex/wlan_src/mapp/mlanconfig/config/txpwrlimit_cfg_8987.conf b/mxm_wifiex/wlan_src/mapp/mlanconfig/config/txpwrlimit_cfg_8987.conf
index 74be6d6..aef78cb 100644
--- a/mxm_wifiex/wlan_src/mapp/mlanconfig/config/txpwrlimit_cfg_8987.conf
+++ b/mxm_wifiex/wlan_src/mapp/mlanconfig/config/txpwrlimit_cfg_8987.conf
@@ -13,6 +13,10 @@ txpwrlimit_2g_cfg_get={
                                 # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
                                 #                               189, 192,196;
                                 #                   5G: channel 7,8,11,12,16,34)
+        ChanTRPC.TlvType:2=0x0249
+        ChanTRPC.TlvLength:2={  # Get Tx Power Values for a particular antenna
+            TLVAntNum:1=0       # Antenna Num: 0 - Both, 1 - Main, 2 - Aux
+        }
 }
 
 
@@ -29,6 +33,10 @@ txpwrlimit_5g_cfg_get_sub0={
                                 # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
                                 #                               189, 192,196;
                                 #                   5G: channel 7,8,11,12,16,34)
+        ChanTRPC.TlvType:2=0x0249
+        ChanTRPC.TlvLength:2={  # Get Tx Power Values for a particular antenna
+            TLVAntNum:1=0       # Antenna Num: 0 - Both, 1 - Main, 2 - Aux
+        }
 }
 
 
@@ -45,6 +53,10 @@ txpwrlimit_5g_cfg_get_sub1={
                                 # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
                                 #                               189, 192,196;
                                 #                   5G: channel 7,8,11,12,16,34)
+        ChanTRPC.TlvType:2=0x0249
+        ChanTRPC.TlvLength:2={  # Get Tx Power Values for a particular antenna
+            TLVAntNum:1=0       # Antenna Num: 0 - Both, 1 - Main, 2 - Aux
+        }
 }
 
 
@@ -61,6 +73,10 @@ txpwrlimit_5g_cfg_get_sub2={
                                 # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
                                 #                               189, 192,196;
                                 #                   5G: channel 7,8,11,12,16,34)
+        ChanTRPC.TlvType:2=0x0249
+        ChanTRPC.TlvLength:2={  # Get Tx Power Values for a particular antenna
+            TLVAntNum:1=0       # Antenna Num: 0 - Both, 1 - Main, 2 - Aux
+        }
 }
 
 
@@ -77,6 +93,10 @@ txpwrlimit_5g_cfg_get_sub3={
                                 # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
                                 #                               189, 192,196;
                                 #                   5G: channel 7,8,11,12,16,34)
+        ChanTRPC.TlvType:2=0x0249
+        ChanTRPC.TlvLength:2={  # Get Tx Power Values for a particular antenna
+            TLVAntNum:1=0       # Antenna Num: 0 - Both, 1 - Main, 2 - Aux
+        }
 }
 
 ## Set CFG data for Tx power limitation
@@ -127,6 +147,10 @@ txpwrlimit_2g_cfg_set={
         Action:2=1              # 1 - SET
         RSVD:2=0                # do NOT change this line
 
+        ChanTRPC.TlvType:2=0x0249
+        ChanTRPC.TlvLength:2={  # Configure Tx Power Values for a particular antenna
+            TLVAntNum:1=0       # Antenna Num: 0 - Both, 1 - Main, 2 - Aux
+        }
         ChanTRPC.TlvType:2=0x0189
         ChanTRPC.TlvLength:2={
             TLVStartFreq:2=2407
@@ -233,6 +257,10 @@ txpwrlimit_5g_cfg_set={
         Action:2=1              # 1 - SET
         RSVD:2=0                # do NOT change this line
 
+        ChanTRPC.TlvType:2=0x0249
+        ChanTRPC.TlvLength:2={  # Configure Tx Power Values for a particular antenna
+            TLVAntNum:1=0       # Antenna Num: 0 - Both, 1 - Main, 2 - Aux
+        }
         ChanTRPC.TlvType:2=0x0189
         ChanTRPC.TlvLength:2={
             TLVStartFreq:2=5000
diff --git a/mxm_wifiex/wlan_src/mapp/mlanutl/Makefile b/mxm_wifiex/wlan_src/mapp/mlanutl/Makefile
index 62fdd6c..46977f9 100644
--- a/mxm_wifiex/wlan_src/mapp/mlanutl/Makefile
+++ b/mxm_wifiex/wlan_src/mapp/mlanutl/Makefile
@@ -22,7 +22,9 @@ CFLAGS := $(filter-out -I$(KERNELDIR)%, $(CFLAGS))
 #CFLAGS += -DAP22 -fshort-enums
 CFLAGS += -Wall
 #ECHO = @
-LIBS = -lrt
+ifeq (,$(findstring ANDROID_KERNEL, $(CFLAGS)))
+LIBS=-lrt
+endif
 
 .PHONY: default tags all
 
diff --git a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c
index 156027e..8dad9fd 100644
--- a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c
+++ b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c
@@ -113,6 +113,8 @@ static int process_addbapara(int argc, char *argv[]);
 static int process_aggrpriotbl(int argc, char *argv[]);
 static int process_addbareject(int argc, char *argv[]);
 static int process_hssetpara(int argc, char *argv[]);
+static int process_mefcfg(int argc, char *argv[]);
+static int process_cloud_keep_alive(int argc, char *argv[]);
 
 struct command_node command_list[] = {
 	{"version", process_version},
@@ -141,6 +143,8 @@ struct command_node command_list[] = {
 	{"httxcfg", process_httxcfg},
 	{"htcapinfo", process_htcapinfo},
 	{"hssetpara", process_hssetpara},
+	{"mefcfg", process_mefcfg},
+	{"cloud_keep_alive", process_cloud_keep_alive},
 };
 
 static char *usage[] = {
@@ -176,6 +180,8 @@ static char *usage[] = {
 	"         addbapara",
 	"         addbareject",
 	"         hssetpara",
+	"         mefcfg",
+	"         cloud_keep_alive",
 };
 
 /** Socket */
@@ -923,7 +929,7 @@ static int prepare_host_cmd_buffer(FILE *fp, char *cmd_name, t_u8 *buf)
 }
 
 #define SUBID_OFFSET 2
-static t_u16 supported_subcmd[] = {0x104, 0x111, 0x11b, 0x11e};
+static t_u16 supported_subcmd[] = {0x104, 0x111, 0x11b, 0x11e, 0x27};
 
 static int check_if_hostcmd_subcmd_allowed(t_u8 *buf)
 {
@@ -1578,7 +1584,11 @@ static int process_getlog(int argc, char *argv[])
 		       "RxResetRecoveryCount               %u\n"
 		       "RxIsr2NotDoneCnt                   %u\n"
 		       "gdmaAbortCnt                       %u\n"
-		       "gResetRxMacCnt                     %u\n",
+		       "gResetRxMacCnt                     %u\n"
+		       "gOwnrshpCtlErrCnt                  %u\n"
+		       "gOwnrshpBcnErrCnt                  %u\n"
+		       "gOwnrshpMgtErrCnt                  %u\n"
+		       "gOwnrshpDatErrCnt                  %u\n",
 		       stats->rx_stuck_issue_cnt[0],
 		       stats->rx_stuck_issue_cnt[1],
 		       stats->rx_stuck_recovery_cnt, stats->rx_stuck_tsf[0],
@@ -1589,7 +1599,9 @@ static int process_getlog(int argc, char *argv[])
 		       stats->channel_number, stats->channel_switch_mode,
 		       stats->rx_reset_mac_recovery_cnt,
 		       stats->rx_Isr2_NotDone_Cnt, stats->gdma_abort_cnt,
-		       stats->g_reset_rx_mac_cnt);
+		       stats->g_reset_rx_mac_cnt, stats->dwCtlErrCnt,
+		       stats->dwBcnErrCnt, stats->dwMgtErrCnt,
+		       stats->dwDatErrCnt);
 	}
 
 	if (cmd->used_len == sizeof(struct eth_priv_get_log)) {
@@ -2067,6 +2079,9 @@ static int get_txpwrlimit(FILE *fp_raw, char *argv[], t_u16 sub_band,
 		case 0x12:
 			fprintf(fp_raw, "txpwrlimit_5g_sub2_get={\n");
 			break;
+		case 0x13:
+			fprintf(fp_raw, "txpwrlimit_5g_sub3_get={\n");
+			break;
 		default:
 			break;
 		}
@@ -2112,7 +2127,7 @@ static int process_get_txpwrlimit(int argc, char *argv[])
 	/* Sanity tests */
 	if (argc < 4) {
 		printf("Error: invalid no of arguments\n");
-		printf("mlanutl mlanX/uapX get_txpwrlimit [0/0x10/0x11/0x12/0x1f/0xff]\n");
+		printf("mlanutl mlanX/uapX get_txpwrlimit [0/0x10/0x11/0x12/0x13/0x1f/0xff]\n");
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
@@ -2138,6 +2153,7 @@ static int process_get_txpwrlimit(int argc, char *argv[])
 	case 0x10:
 	case 0x11:
 	case 0x12:
+	case 0x13:
 		ret = get_txpwrlimit(fp_raw, argv, sub_band, buffer,
 				     sizeof(mlan_ds_misc_chan_trpc_cfg) +
 					     strlen(argv[2]),
@@ -2156,6 +2172,10 @@ static int process_get_txpwrlimit(int argc, char *argv[])
 				     sizeof(mlan_ds_misc_chan_trpc_cfg) +
 					     strlen(argv[2]),
 				     cmd);
+		ret = get_txpwrlimit(fp_raw, argv, 0x13, buffer,
+				     sizeof(mlan_ds_misc_chan_trpc_cfg) +
+					     strlen(argv[2]),
+				     cmd);
 		break;
 	case 0xff:
 		ret = get_txpwrlimit(fp_raw, argv, 0, buffer,
@@ -2174,10 +2194,14 @@ static int process_get_txpwrlimit(int argc, char *argv[])
 				     sizeof(mlan_ds_misc_chan_trpc_cfg) +
 					     strlen(argv[2]),
 				     cmd);
+		ret = get_txpwrlimit(fp_raw, argv, 0x13, buffer,
+				     sizeof(mlan_ds_misc_chan_trpc_cfg) +
+					     strlen(argv[2]),
+				     cmd);
 		break;
 	default:
 		printf("Error: invalid arguments\n");
-		printf("mlanutl mlanX/uapX get_txpwrlimit [0/0x10/0x11/0x12/0x1f/0xff]\n");
+		printf("mlanutl mlanX/uapX get_txpwrlimit [0/0x10/0x11/0x12/0x13/0x1f/0xff]\n");
 		break;
 	}
 done:
@@ -3674,6 +3698,1304 @@ static int process_hssetpara(int argc, char *argv[])
 	return MLAN_STATUS_SUCCESS;
 }
 
+#define STACK_NBYTES 100 /**< Number of bytes in stack */
+#define MAX_BYTESEQ 6 /**< Maximum byte sequence */
+#define TYPE_DNUM 1 /**< decimal number */
+#define TYPE_BYTESEQ 2 /**< byte sequence */
+#define MAX_OPERAND 0x40 /**< Maximum operands */
+#define TYPE_EQ (MAX_OPERAND + 1) /**< byte comparison:    == operator */
+#define TYPE_EQ_DNUM (MAX_OPERAND + 2) /**< decimal comparison: =d operator */
+#define TYPE_EQ_BIT (MAX_OPERAND + 3) /**< bit comparison:     =b operator */
+#define TYPE_AND (MAX_OPERAND + 4) /**< && operator */
+#define TYPE_OR (MAX_OPERAND + 5) /**< || operator */
+
+typedef struct {
+	t_u16 sp; /**< Stack pointer */
+	t_u8 byte[STACK_NBYTES]; /**< Stack */
+} mstack_t;
+
+typedef struct {
+	t_u8 type; /**< Type */
+	t_u8 reserve[3]; /**< so 4-byte align val array */
+	/* byte sequence is the largest among all the operands and operators. */
+	/* byte sequence format: 1 byte of num of bytes, then variable num bytes
+	 */
+	t_u8 val[MAX_BYTESEQ + 1]; /**< Value */
+} op_t;
+
+/**
+ *  @brief push data to stack
+ *
+ *  @param s			a pointer to mstack_t structure
+ *
+ *  @param nbytes		number of byte to push to stack
+ *
+ *  @param val			a pointer to data buffer
+ *
+ *  @return			TRUE-- sucess , FALSE -- fail
+ *
+ */
+static int push_n(mstack_t *s, t_u8 nbytes, t_u8 *val)
+{
+	if ((s->sp + nbytes) < STACK_NBYTES) {
+		memcpy((void *)(s->byte + s->sp), (const void *)val,
+		       (size_t)nbytes);
+		s->sp += nbytes;
+		/* printf("push: n %d sp %d\n", nbytes, s->sp); */
+		return TRUE;
+	} else /* stack full */
+		return FALSE;
+}
+
+/**
+ *  @brief push data to stack
+ *
+ *  @param s			a pointer to mstack_t structure
+ *
+ *  @param op			a pointer to op_t structure
+ *
+ *  @return			TRUE-- sucess , FALSE -- fail
+ *
+ */
+static int push(mstack_t *s, op_t *op)
+{
+	t_u8 nbytes;
+	switch (op->type) {
+	case TYPE_DNUM:
+		if (push_n(s, 4, op->val))
+			return push_n(s, 1, &op->type);
+		return FALSE;
+	case TYPE_BYTESEQ:
+		nbytes = op->val[0];
+		if (push_n(s, nbytes, op->val + 1) && push_n(s, 1, op->val) &&
+		    push_n(s, 1, &op->type))
+			return TRUE;
+		return FALSE;
+	default:
+		return push_n(s, 1, &op->type);
+	}
+}
+
+/**
+ *  @brief parse RPN string
+ *
+ *  @param s			a pointer to Null-terminated string to scan.
+ *
+ *  @param first_time		a pointer to return first_time
+ *
+ *  @return			A pointer to the last token found in string.
+ *  				NULL is returned when there are no more tokens to be
+ * found.
+ *
+ */
+static char *getop(char *s, int *first_time)
+{
+	const char delim[] = " \t\n";
+	char *p;
+	if (*first_time) {
+		p = strtok(s, delim);
+		*first_time = FALSE;
+	} else {
+		p = strtok(NULL, delim);
+	}
+	return p;
+}
+
+/**
+ *  @brief Verify hex digit.
+ *
+ *  @param c			input ascii char
+ *  @param h			a pointer to return integer value of the digit
+ * char.
+ *  @return			TURE -- c is hex digit, FALSE -- c is not hex
+ * digit.
+ */
+static int ishexdigit(char c, t_u8 *h)
+{
+	if (c >= '0' && c <= '9') {
+		*h = c - '0';
+		return TRUE;
+	} else if (c >= 'a' && c <= 'f') {
+		*h = c - 'a' + 10;
+		return TRUE;
+	} else if (c >= 'A' && c <= 'F') {
+		*h = c - 'A' + 10;
+		return TRUE;
+	}
+	return FALSE;
+}
+
+/**
+ *  @brief convert hex string to integer.
+ *
+ *  @param s			A pointer to hex string, string length up to 2
+ * digits.
+ *  @return			integer value.
+ */
+static t_u8 hex_atoi(char *s)
+{
+	int i;
+	t_u8 digit; /* digital value */
+	t_u8 t = 0; /* total value */
+
+	for (i = 0, t = 0; ishexdigit(s[i], &digit) && i < 2; i++)
+		t = 16 * t + digit;
+	return t;
+}
+
+/**
+ *  @brief Parse byte sequence in hex format string to a byte sequence.
+ *
+ *  @param opstr		A pointer to byte sequence in hex format string, with
+ * ':' as delimiter between two byte.
+ *  @param val			A pointer to return byte sequence string
+ *  @return			NA
+ */
+static void parse_hex(char *opstr, t_u8 *val)
+{
+	char delim = ':';
+	char *p;
+	char *q;
+	t_u8 i;
+
+	/* +1 is for skipping over the preceding h character. */
+	p = opstr + 1;
+
+	/* First byte */
+	val[1] = hex_atoi(p++);
+
+	/* Parse subsequent bytes. */
+	/* Each byte is preceded by the : character. */
+	for (i = 1; *p; i++) {
+		q = strchr(p, delim);
+		if (!q)
+			break;
+		p = q + 1;
+		val[i + 1] = hex_atoi(p);
+	}
+	/* Set num of bytes */
+	val[0] = i;
+}
+
+/**
+ *  @brief str2bin, convert RPN string to binary format
+ *
+ *  @param str			A pointer to rpn string
+ *  @param stack		A pointer to mstack_t structure
+ *  @return			MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+static int str2bin(char *str, mstack_t *stack)
+{
+	int first_time;
+	char *opstr;
+	op_t op; /* operator/operand */
+	int dnum;
+	int ret = MLAN_STATUS_SUCCESS;
+
+	memset(stack, 0, sizeof(mstack_t));
+	first_time = TRUE;
+	while ((opstr = getop(str, &first_time)) != NULL) {
+		if (isdigit((unsigned char)*opstr)) {
+			op.type = TYPE_DNUM;
+			dnum = cpu_to_le32(atoi(opstr));
+			memcpy((t_u8 *)op.val, &dnum, sizeof(dnum));
+			if (!push(stack, &op)) {
+				printf("push decimal number failed\n");
+				ret = MLAN_STATUS_FAILURE;
+				break;
+			}
+		} else if (*opstr == 'h') {
+			op.type = TYPE_BYTESEQ;
+			parse_hex(opstr, op.val);
+			if (!push(stack, &op)) {
+				printf("push byte sequence failed\n");
+				ret = MLAN_STATUS_FAILURE;
+				break;
+			}
+		} else if (!strcmp(opstr, "==")) {
+			op.type = TYPE_EQ;
+			if (!push(stack, &op)) {
+				printf("push byte cmp operator failed\n");
+				ret = MLAN_STATUS_FAILURE;
+				break;
+			}
+		} else if (!strcmp(opstr, "=d")) {
+			op.type = TYPE_EQ_DNUM;
+			if (!push(stack, &op)) {
+				printf("push decimal cmp operator failed\n");
+				ret = MLAN_STATUS_FAILURE;
+				break;
+			}
+		} else if (!strcmp(opstr, "=b")) {
+			op.type = TYPE_EQ_BIT;
+			if (!push(stack, &op)) {
+				printf("push bit cmp operator failed\n");
+				ret = MLAN_STATUS_FAILURE;
+				break;
+			}
+		} else if (!strcmp(opstr, "&&")) {
+			op.type = TYPE_AND;
+			if (!push(stack, &op)) {
+				printf("push AND operator failed\n");
+				ret = MLAN_STATUS_FAILURE;
+				break;
+			}
+		} else if (!strcmp(opstr, "||")) {
+			op.type = TYPE_OR;
+			if (!push(stack, &op)) {
+				printf("push OR operator failed\n");
+				ret = MLAN_STATUS_FAILURE;
+				break;
+			}
+		} else {
+			printf("Unknown operand\n");
+			ret = MLAN_STATUS_FAILURE;
+			break;
+		}
+	}
+	return ret;
+}
+
+#define FILTER_BYTESEQ TYPE_EQ /**< byte sequence */
+#define FILTER_DNUM TYPE_EQ_DNUM /**< decimal number */
+#define FILTER_BITSEQ TYPE_EQ_BIT /**< bit sequence */
+#define FILTER_TEST (FILTER_BITSEQ + 1) /**< test */
+
+#define NAME_TYPE 1 /**< Field name 'type' */
+#define NAME_PATTERN 2 /**< Field name 'pattern' */
+#define NAME_OFFSET 3 /**< Field name 'offset' */
+#define NAME_NUMBYTE 4 /**< Field name 'numbyte' */
+#define NAME_REPEAT 5 /**< Field name 'repeat' */
+#define NAME_BYTE 6 /**< Field name 'byte' */
+#define NAME_MASK 7 /**< Field name 'mask' */
+#define NAME_DEST 8 /**< Field name 'dest' */
+
+static struct mef_fields {
+	char *name; /**< Name */
+	t_s8 nameid; /**< Name Id. */
+} mef_fields[] = {{"type", NAME_TYPE},	   {"pattern", NAME_PATTERN},
+		  {"offset", NAME_OFFSET}, {"numbyte", NAME_NUMBYTE},
+		  {"repeat", NAME_REPEAT}, {"byte", NAME_BYTE},
+		  {"mask", NAME_MASK},	   {"dest", NAME_DEST}};
+
+/**
+ *  @brief get filter data
+ *
+ *  @param fp			A pointer to file stream
+ *  @param ln			A pointer to line number
+ *  @param buf			A pointer to hostcmd data
+ *  @param size			A pointer to the return size of hostcmd buffer
+ *  @return			MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+static int mlan_get_filter_data(FILE *fp, int *ln, t_u8 *buf, t_u16 *size)
+{
+	t_s32 errors = 0, i;
+	char line[256], *pos = NULL, *pos1 = NULL;
+	t_u16 type = 0;
+	t_u32 pattern = 0;
+	t_u16 repeat = 0;
+	t_u16 offset = 0;
+	char byte_seq[50];
+	char mask_seq[50];
+	t_u16 numbyte = 0;
+	t_s8 type_find = 0;
+	t_s8 pattern_find = 0;
+	t_s8 offset_find = 0;
+	t_s8 numbyte_find = 0;
+	t_s8 repeat_find = 0;
+	t_s8 byte_find = 0;
+	t_s8 mask_find = 0;
+	t_s8 dest_find = 0;
+	char dest_seq[50];
+
+	*size = 0;
+	while ((pos = mlan_config_get_line(fp, line, sizeof(line), ln))) {
+		if (strcmp(pos, "}") == 0) {
+			break;
+		}
+		pos1 = strchr(pos, '=');
+		if (pos1 == NULL) {
+			printf("Line %d: Invalid mef_filter line '%s'\n", *ln,
+			       pos);
+			errors++;
+			continue;
+		}
+		*pos1++ = '\0';
+		for (i = 0; (t_u32)i < NELEMENTS(mef_fields); i++) {
+			if (strncmp(pos, mef_fields[i].name,
+				    strlen(mef_fields[i].name)) == 0) {
+				switch (mef_fields[i].nameid) {
+				case NAME_TYPE:
+					type = a2hex_or_atoi(pos1);
+					if ((type != FILTER_DNUM) &&
+					    (type != FILTER_BYTESEQ) &&
+					    (type != FILTER_BITSEQ) &&
+					    (type != FILTER_TEST)) {
+						printf("Invalid filter type:%d\n",
+						       type);
+						return MLAN_STATUS_FAILURE;
+					}
+					type_find = 1;
+					break;
+				case NAME_PATTERN:
+					pattern = a2hex_or_atoi(pos1);
+					pattern_find = 1;
+					break;
+				case NAME_OFFSET:
+					offset = a2hex_or_atoi(pos1);
+					offset_find = 1;
+					break;
+				case NAME_NUMBYTE:
+					numbyte = a2hex_or_atoi(pos1);
+					numbyte_find = 1;
+					break;
+				case NAME_REPEAT:
+					repeat = a2hex_or_atoi(pos1);
+					repeat_find = 1;
+					break;
+				case NAME_BYTE:
+					memset(byte_seq, 0, sizeof(byte_seq));
+					strncpy(byte_seq, pos1,
+						(sizeof(byte_seq) - 1));
+					byte_find = 1;
+					break;
+				case NAME_MASK:
+					memset(mask_seq, 0, sizeof(mask_seq));
+					strncpy(mask_seq, pos1,
+						(sizeof(mask_seq) - 1));
+					mask_find = 1;
+					break;
+				case NAME_DEST:
+					memset(dest_seq, 0, sizeof(dest_seq));
+					strncpy(dest_seq, pos1,
+						(sizeof(dest_seq) - 1));
+					dest_find = 1;
+					break;
+				}
+				break;
+			}
+		}
+		if (i == NELEMENTS(mef_fields)) {
+			printf("Line %d: unknown mef field '%s'.\n", *line,
+			       pos);
+			errors++;
+		}
+	}
+	if (type_find == 0) {
+		printf("Can not find filter type\n");
+		return MLAN_STATUS_FAILURE;
+	}
+	switch (type) {
+	case FILTER_DNUM:
+		if (!pattern_find || !offset_find || !numbyte_find) {
+			printf("Missing field for FILTER_DNUM: pattern=%d,offset=%d,numbyte=%d\n",
+			       pattern_find, offset_find, numbyte_find);
+			return MLAN_STATUS_FAILURE;
+		}
+		memset(line, 0, sizeof(line));
+		snprintf(line, sizeof(line), "%d %d %d =d ", pattern, offset,
+			 numbyte);
+		break;
+	case FILTER_BYTESEQ:
+		if (!byte_find || !offset_find || !repeat_find) {
+			printf("Missing field for FILTER_BYTESEQ: byte=%d,offset=%d,repeat=%d\n",
+			       byte_find, offset_find, repeat_find);
+			return MLAN_STATUS_FAILURE;
+		}
+		memset(line, 0, sizeof(line));
+		snprintf(line, sizeof(line), "%d h%s %d == ", repeat, byte_seq,
+			 offset);
+		break;
+	case FILTER_BITSEQ:
+		if (!byte_find || !offset_find || !mask_find) {
+			printf("Missing field for FILTER_BITSEQ: byte=%d,offset=%d,mask_find=%d\n",
+			       byte_find, offset_find, mask_find);
+			return MLAN_STATUS_FAILURE;
+		}
+		if (strlen(byte_seq) != strlen(mask_seq)) {
+			printf("byte string's length is different with mask's length!\n");
+			return MLAN_STATUS_FAILURE;
+		}
+		memset(line, 0, sizeof(line));
+		snprintf(line, sizeof(line), "h%s %d h%s =b ", byte_seq, offset,
+			 mask_seq);
+		break;
+	case FILTER_TEST:
+		if (!byte_find || !offset_find || !repeat_find || !dest_find) {
+			printf("Missing field for FILTER_TEST: byte=%d,offset=%d,repeat=%d,dest=%d\n",
+			       byte_find, offset_find, repeat_find, dest_find);
+			return MLAN_STATUS_FAILURE;
+		}
+		memset(line, 0, sizeof(line));
+		snprintf(line, sizeof(line), "h%s %d h%s %d ", dest_seq, repeat,
+			 byte_seq, offset);
+		break;
+	}
+	memcpy(buf, line, strlen(line));
+	*size = strlen(line);
+	return MLAN_STATUS_SUCCESS;
+}
+
+#define NAME_MODE 1 /**< Field name 'mode' */
+#define NAME_ACTION 2 /**< Field name 'action' */
+#define NAME_FILTER_NUM 3 /**< Field name 'filter_num' */
+#define NAME_RPN 4 /**< Field name 'RPN' */
+static struct mef_entry_fields {
+	char *name; /**< Name */
+	t_s8 nameid; /**< Name id */
+} mef_entry_fields[] = {
+	{"mode", NAME_MODE},
+	{"action", NAME_ACTION},
+	{"filter_num", NAME_FILTER_NUM},
+	{"RPN", NAME_RPN},
+};
+
+typedef struct _MEF_ENTRY {
+	/** Mode */
+	t_u8 Mode;
+	/** Size */
+	t_u8 Action;
+	/** Size of expression */
+	t_u16 ExprSize;
+} MEF_ENTRY;
+
+/**
+ *  @brief get mef_entry data
+ *
+ *  @param fp			A pointer to file stream
+ *  @param ln			A pointer to line number
+ *  @param buf			A pointer to hostcmd data
+ *  @param size			A pointer to the return size of hostcmd buffer
+ *  @return			MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+static int mlan_get_mef_entry_data(FILE *fp, int *ln, t_u8 *buf, t_u16 *size)
+{
+	char line[256], *pos = NULL, *pos1 = NULL;
+	t_u8 mode, action, filter_num = 0;
+	char rpn[256];
+	t_s8 mode_find = 0;
+	t_s8 action_find = 0;
+	t_s8 filter_num_find = 0;
+	t_s8 rpn_find = 0;
+	char rpn_str[256];
+	int rpn_len = 0;
+	char filter_name[50];
+	t_s8 name_found = 0;
+	t_u16 len = 0;
+	int i;
+	int first_time = TRUE;
+	char *opstr = NULL;
+	char filter_action[10];
+	t_s32 errors = 0;
+	MEF_ENTRY *pMefEntry = (MEF_ENTRY *)buf;
+	mstack_t stack;
+	while ((pos = mlan_config_get_line(fp, line, sizeof(line), ln))) {
+		if (strcmp(pos, "}") == 0) {
+			break;
+		}
+		pos1 = strchr(pos, '=');
+		if (pos1 == NULL) {
+			printf("Line %d: Invalid mef_entry line '%s'\n", *ln,
+			       pos);
+			errors++;
+			continue;
+		}
+		*pos1++ = '\0';
+		if (!mode_find || !action_find || !filter_num_find ||
+		    !rpn_find) {
+			for (i = 0;
+			     (unsigned int)i < NELEMENTS(mef_entry_fields);
+			     i++) {
+				if (strncmp(pos, mef_entry_fields[i].name,
+					    strlen(mef_entry_fields[i].name)) ==
+				    0) {
+					switch (mef_entry_fields[i].nameid) {
+					case NAME_MODE:
+						mode = a2hex_or_atoi(pos1);
+						if (mode & ~0x7) {
+							printf("invalid mode=%d\n",
+							       mode);
+							return MLAN_STATUS_FAILURE;
+						}
+						pMefEntry->Mode = mode;
+						mode_find = 1;
+						break;
+					case NAME_ACTION:
+						action = a2hex_or_atoi(pos1);
+						if (action & ~0xff) {
+							printf("invalid action=%d\n",
+							       action);
+							return MLAN_STATUS_FAILURE;
+						}
+						pMefEntry->Action = action;
+						action_find = 1;
+						break;
+					case NAME_FILTER_NUM:
+						filter_num =
+							a2hex_or_atoi(pos1);
+						filter_num_find = 1;
+						break;
+					case NAME_RPN:
+						memset(rpn, 0, sizeof(rpn));
+						strncpy(rpn, pos1,
+							(sizeof(rpn) - 1));
+						rpn_find = 1;
+						break;
+					}
+					break;
+				}
+			}
+			if (i == NELEMENTS(mef_fields)) {
+				printf("Line %d: unknown mef_entry field '%s'.\n",
+				       *line, pos);
+				return MLAN_STATUS_FAILURE;
+			}
+		}
+		if (mode_find && action_find && filter_num_find && rpn_find) {
+			for (i = 0; i < filter_num; i++) {
+				opstr = getop(rpn, &first_time);
+				if (opstr == NULL)
+					break;
+				snprintf(filter_name, sizeof(filter_name),
+					 "%s={", opstr);
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), ln))) {
+					if (strncmp(pos, filter_name,
+						    strlen(filter_name)) == 0) {
+						name_found = 1;
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: %s not found in file\n",
+						filter_name);
+					return MLAN_STATUS_FAILURE;
+				}
+				if (MLAN_STATUS_FAILURE ==
+				    mlan_get_filter_data(
+					    fp, ln, (t_u8 *)(rpn_str + rpn_len),
+					    &len))
+					break;
+				rpn_len += len;
+				if (i > 0) {
+					memcpy(rpn_str + rpn_len, filter_action,
+					       strlen(filter_action));
+					rpn_len += strlen(filter_action);
+				}
+				opstr = getop(rpn, &first_time);
+				if (opstr == NULL)
+					break;
+				memset(filter_action, 0, sizeof(filter_action));
+				snprintf(filter_action, sizeof(filter_action),
+					 "%s ", opstr);
+			}
+			/* Remove the last space */
+			if (rpn_len > 0) {
+				rpn_len--;
+				rpn_str[rpn_len] = 0;
+			}
+			if (MLAN_STATUS_FAILURE == str2bin(rpn_str, &stack)) {
+				printf("Fail on str2bin!\n");
+				return MLAN_STATUS_FAILURE;
+			}
+			*size = sizeof(MEF_ENTRY);
+			pMefEntry->ExprSize = cpu_to_le16(stack.sp);
+			memmove(buf + sizeof(MEF_ENTRY), stack.byte, stack.sp);
+			*size += stack.sp;
+			break;
+		} else if (mode_find && action_find && filter_num_find &&
+			   (filter_num == 0)) {
+			pMefEntry->ExprSize = 0;
+			*size = sizeof(MEF_ENTRY);
+			break;
+		}
+	}
+	return MLAN_STATUS_SUCCESS;
+}
+
+#define MEFCFG_CMDCODE 0x009a
+
+/**
+ *  @brief Process mefcfg command
+ *  @param argc     number of arguments
+ *  @param argv     A pointer to arguments array
+ *  @return         MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+static int process_mefcfg(int argc, char *argv[])
+{
+	char line[256], cmdname[256], *pos = NULL;
+	int cmdname_found = 0, name_found = 0;
+	int ln = 0;
+	int ret = MLAN_STATUS_SUCCESS;
+	int i;
+	t_u8 *buffer = NULL;
+	t_u16 len = 0;
+	HostCmd_DS_MEF_CFG *mefcmd = NULL;
+	HostCmd_DS_GEN *hostcmd = NULL;
+	FILE *fp = NULL;
+	t_u32 cmd_len = 0, cmd_header_len;
+	struct eth_priv_cmd *cmd = NULL;
+	struct ifreq ifr;
+
+	if (argc < 4) {
+		printf("Error: invalid no of arguments\n");
+		printf("Syntax: ./mlanutl mlan0 mefcfg <mef.conf>\n");
+		exit(1);
+	}
+
+	cmd_header_len = strlen(CMD_NXP) + strlen("HOSTCMD");
+	cmd_len = sizeof(HostCmd_DS_GEN) + sizeof(HostCmd_DS_MEF_CFG);
+	buffer = (t_u8 *)malloc(BUFFER_LENGTH);
+	if (!buffer) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		return -ENOMEM;
+	}
+
+	memset(buffer, 0, BUFFER_LENGTH);
+
+	cmd = (struct eth_priv_cmd *)malloc(sizeof(struct eth_priv_cmd));
+	if (!cmd) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Fill up buffer */
+#ifdef USERSPACE_32BIT_OVER_KERNEL_64BIT
+	memset(cmd, 0, sizeof(struct eth_priv_cmd));
+	memcpy(&cmd->buf, &buffer, sizeof(buffer));
+#else
+	cmd->buf = buffer;
+#endif
+	cmd->used_len = 0;
+	cmd->total_len = BUFFER_LENGTH;
+	/* buf = MRVL_CMD<cmd> */
+	prepare_buffer(buffer, HOSTCMD, 0, NULL);
+
+	/* buf = MRVL_CMD<cmd><hostcmd_size><HostCmd_DS_GEN> */
+	hostcmd = (HostCmd_DS_GEN *)(buffer + cmd_header_len + sizeof(t_u32));
+	hostcmd->command = cpu_to_le16(MEFCFG_CMDCODE);
+	hostcmd->seq_num = 0;
+	hostcmd->result = 0;
+	/* buf = MRVL_CMD<cmd><hostcmd_size><HostCmd_DS_GEN><HostCmd_DS_MEF_CFG>
+	 */
+	mefcmd = (HostCmd_DS_MEF_CFG *)(buffer + cmd_header_len +
+					sizeof(t_u32) + S_DS_GEN);
+
+	/* Host Command Population */
+	snprintf(cmdname, sizeof(cmdname), "%s={", argv[2]);
+	cmdname_found = 0;
+	fp = fopen(argv[3], "r");
+	if (fp == NULL) {
+		fprintf(stderr, "Cannot open file %s\n", argv[4]);
+		exit(1);
+	}
+
+	while ((pos = mlan_config_get_line(fp, line, sizeof(line), &ln))) {
+		if (strcmp(pos, cmdname) == 0) {
+			cmdname_found = 1;
+			snprintf(cmdname, sizeof(cmdname), "Criteria=");
+			name_found = 0;
+			while ((pos = mlan_config_get_line(
+					fp, line, sizeof(line), &ln))) {
+				if (strncmp(pos, cmdname, strlen(cmdname)) ==
+				    0) {
+					name_found = 1;
+					mefcmd->Criteria = a2hex_or_atoi(
+						pos + strlen(cmdname));
+					break;
+				}
+			}
+			if (!name_found) {
+				fprintf(stderr,
+					"mlanutl: criteria not found in file '%s'\n",
+					argv[3]);
+				break;
+			}
+			snprintf(cmdname, sizeof(cmdname), "NumEntries=");
+			name_found = 0;
+			while ((pos = mlan_config_get_line(
+					fp, line, sizeof(line), &ln))) {
+				if (strncmp(pos, cmdname, strlen(cmdname)) ==
+				    0) {
+					name_found = 1;
+					mefcmd->NumEntries = a2hex_or_atoi(
+						pos + strlen(cmdname));
+					break;
+				}
+			}
+			if (!name_found) {
+				fprintf(stderr,
+					"mlanutl: NumEntries not found in file '%s'\n",
+					argv[3]);
+				break;
+			}
+			for (i = 0; i < mefcmd->NumEntries; i++) {
+				snprintf(cmdname, sizeof(cmdname),
+					 "mef_entry_%d={", i);
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: %s not found in file '%s'\n",
+						cmdname, argv[3]);
+					break;
+				}
+				if (MLAN_STATUS_FAILURE ==
+				    mlan_get_mef_entry_data(
+					    fp, &ln, (t_u8 *)hostcmd + cmd_len,
+					    &len)) {
+					ret = MLAN_STATUS_FAILURE;
+					break;
+				}
+				cmd_len += len;
+			}
+			break;
+		}
+	}
+	fclose(fp);
+	/* buf = MRVL_CMD<cmd><hostcmd_size> */
+	memcpy(buffer + cmd_header_len, (t_u8 *)&cmd_len, sizeof(t_u32));
+
+	if (!cmdname_found)
+		fprintf(stderr,
+			"mlanutl: cmdname '%s' not found in file '%s'\n",
+			argv[4], argv[3]);
+
+	if (!cmdname_found || !name_found) {
+		ret = MLAN_STATUS_FAILURE;
+		goto mef_exit;
+	}
+	hostcmd->size = cpu_to_le16(cmd_len);
+	mefcmd->Criteria = cpu_to_le32(mefcmd->Criteria);
+	mefcmd->NumEntries = cpu_to_le16(mefcmd->NumEntries);
+	hexdump("mefcfg", buffer + cmd_header_len, cmd_len, ' ');
+
+	/* Initialize the ifr structure */
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_ifrn.ifrn_name, dev_name, strlen(dev_name));
+	ifr.ifr_ifru.ifru_data = (void *)cmd;
+	/* Perform ioctl */
+	if (ioctl(sockfd, MLAN_ETH_PRIV, &ifr)) {
+		perror("ioctl[MEF_CFG]");
+		printf("ERR:Command sending failed!\n");
+
+		if (buffer)
+			free(buffer);
+
+		if (cmd)
+			free(cmd);
+
+		return MLAN_STATUS_FAILURE;
+	}
+
+	ret = process_host_cmd_resp(HOSTCMD, buffer);
+
+mef_exit:
+	if (buffer)
+		free(buffer);
+	if (cmd)
+		free(cmd);
+	return ret;
+}
+
+/**
+ *  @brief Check the Hex String
+ *  @param s  A pointer to the string
+ *  @return   MLAN_STATUS_SUCCESS --HexString, MLAN_STATUS_FAILURE --not
+ * HexString
+ */
+static int ishexstring(char *s)
+{
+	int ret = MLAN_STATUS_FAILURE;
+	t_s32 tmp;
+
+	if (!strncasecmp("0x", s, 2)) {
+		s += 2;
+	}
+	while (*s) {
+		tmp = toupper((unsigned char)*s);
+		if (((tmp >= 'A') && (tmp <= 'F')) ||
+		    ((tmp >= '0') && (tmp <= '9'))) {
+			ret = MLAN_STATUS_SUCCESS;
+		} else {
+			ret = MLAN_STATUS_FAILURE;
+			break;
+		}
+		s++;
+	}
+
+	return ret;
+}
+/**
+ *  @brief Converts colon separated MAC address to hex value
+ *
+ *  @param mac      A pointer to the colon separated MAC string
+ *  @param raw      A pointer to the hex data buffer
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ *                  MAC_BROADCAST   - if broadcast mac
+ *                  MAC_MULTICAST   - if multicast mac
+ */
+static int mac2raw(char *mac, t_u8 *raw)
+{
+	unsigned int temp_raw[ETH_ALEN];
+	int num_tokens = 0;
+	int i;
+
+	if (strlen(mac) != ((2 * ETH_ALEN) + (ETH_ALEN - 1))) {
+		return MLAN_STATUS_FAILURE;
+	}
+	num_tokens = sscanf(mac, "%2x:%2x:%2x:%2x:%2x:%2x", temp_raw + 0,
+			    temp_raw + 1, temp_raw + 2, temp_raw + 3,
+			    temp_raw + 4, temp_raw + 5);
+	if (num_tokens != ETH_ALEN) {
+		return MLAN_STATUS_FAILURE;
+	}
+	for (i = 0; i < num_tokens; i++)
+		raw[i] = (t_u8)temp_raw[i];
+
+	if (memcmp(raw, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) == 0) {
+		return MAC_BROADCAST;
+	} else if (raw[0] & 0x01) {
+		return MAC_MULTICAST;
+	}
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief Convert String to Integer
+ *  @param buf      A pointer to the string
+ *  @return         Integer
+ */
+static int atoval(char *buf)
+{
+	if (!strncasecmp(buf, "0x", 2))
+		return a2hex(buf + 2);
+	else if (!ishexstring(buf))
+		return a2hex(buf);
+	else
+		return atoi(buf);
+}
+
+/**
+ *  @brief Parses a command line
+ *
+ *  @param line     The line to parse
+ *  @param args     Pointer to the argument buffer to be filled in
+ *  @param args_count Max number of elements which can be filled in buffer
+ * 'args'
+ *  @return         Number of arguments in the line or EOF
+ */
+static int parse_line(char *line, char *args[], t_u16 args_count)
+{
+	int arg_num = 0;
+	int is_start = 0;
+	int is_quote = 0;
+	int length = 0;
+	int i = 0;
+
+	arg_num = 0;
+	length = strlen(line);
+	/* Process line */
+
+	/* Find number of arguments */
+	is_start = 0;
+	is_quote = 0;
+	for (i = 0; (i < length) && (arg_num < args_count); i++) {
+		/* Ignore leading spaces */
+		if (is_start == 0) {
+			if (line[i] == ' ') {
+				continue;
+			} else if (line[i] == '\t') {
+				continue;
+			} else if (line[i] == '\n') {
+				break;
+			} else {
+				is_start = 1;
+				args[arg_num] = &line[i];
+				arg_num++;
+			}
+		}
+		if (is_start == 1) {
+			/* Ignore comments */
+			if (line[i] == '#') {
+				if (is_quote == 0) {
+					line[i] = '\0';
+					arg_num--;
+				}
+				break;
+			}
+			/* Separate by '=' */
+			if (line[i] == '=') {
+				line[i] = '\0';
+				is_start = 0;
+				continue;
+			}
+			/* Separate by ',' */
+			if (line[i] == ',') {
+				line[i] = '\0';
+				is_start = 0;
+				continue;
+			}
+			/* Change ',' to ' ', but not inside quotes */
+			if ((line[i] == ',') && (is_quote == 0)) {
+				line[i] = ' ';
+				continue;
+			}
+		}
+		/* Remove newlines */
+		if (line[i] == '\n') {
+			line[i] = '\0';
+		}
+		/* Check for quotes */
+		if (line[i] == '"') {
+			is_quote = (is_quote == 1) ? 0 : 1;
+			continue;
+		}
+		if (((line[i] == ' ') || (line[i] == '\t')) &&
+		    (is_quote == 0)) {
+			line[i] = '\0';
+			is_start = 0;
+			continue;
+		}
+	}
+	return arg_num;
+}
+
+/**
+ *  @brief Process cloud keep alive command
+ *  @param argc     number of arguments
+ *  @param argv     A pointer to arguments array
+ *  @return         MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+static int process_cloud_keep_alive(int argc, char *argv[])
+{
+	t_u8 *buffer = NULL;
+	struct eth_priv_cmd *cmd = NULL;
+	struct ifreq ifr;
+	FILE *fp = NULL;
+	int ret = MLAN_STATUS_SUCCESS;
+	char line[256], cmdname[256], *pos = NULL;
+	int cmdname_found = 0, name_found = 0, arg_num = 0;
+	int ln = 0, i = 0;
+	char *args[256];
+	cloud_keep_alive *keep_alive = NULL;
+
+	if (argc < 5) {
+		printf("Error: invalid no of arguments\n");
+		printf("Syntax: ./mlanutl mlanX cloud_keep_alive <keep_alive.conf> <start/stop/reset>\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Initialize buffer */
+	buffer = (t_u8 *)malloc(BUFFER_LENGTH);
+	if (!buffer) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+	memset(buffer, 0, BUFFER_LENGTH);
+
+	/* Insert command */
+	strncpy((char *)buffer, argv[2], strlen(argv[2]));
+
+	keep_alive = (cloud_keep_alive *)(buffer + strlen(argv[2]));
+
+	cmdname_found = 0;
+	snprintf(cmdname, sizeof(cmdname), "%s={", argv[4]);
+
+	fp = fopen(argv[3], "r");
+	if (fp == NULL) {
+		fprintf(stderr, "Cannot open file %s\n", argv[3]);
+		ret = MLAN_STATUS_FAILURE;
+		if (buffer)
+			free(buffer);
+		goto done;
+	}
+
+	while ((pos = mlan_config_get_line(fp, line, sizeof(line), &ln))) {
+		if (strcmp(pos, cmdname) == 0) {
+			cmdname_found = 1;
+			snprintf(cmdname, sizeof(cmdname), "mkeep_alive_id=");
+			name_found = 0;
+			while ((pos = mlan_config_get_line(
+					fp, line, sizeof(line), &ln))) {
+				if (strncmp(pos, cmdname, strlen(cmdname)) ==
+				    0) {
+					name_found = 1;
+					keep_alive->mkeep_alive_id =
+						a2hex_or_atoi(pos +
+							      strlen(cmdname));
+					break;
+				}
+			}
+			if (!name_found) {
+				fprintf(stderr,
+					"mlanutl: keep alive id not found in file '%s'\n",
+					argv[3]);
+				break;
+			}
+			snprintf(cmdname, sizeof(cmdname), "enable=");
+			name_found = 0;
+			while ((pos = mlan_config_get_line(
+					fp, line, sizeof(line), &ln))) {
+				if (strncmp(pos, cmdname, strlen(cmdname)) ==
+				    0) {
+					name_found = 1;
+					keep_alive->enable = a2hex_or_atoi(
+						pos + strlen(cmdname));
+					break;
+				}
+			}
+			if (!name_found) {
+				fprintf(stderr,
+					"mlanutl: enable not found in file '%s'\n",
+					argv[3]);
+				break;
+			}
+			if (strcmp(argv[4], "reset") == 0) {
+				snprintf(cmdname, sizeof(cmdname), "reset=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						keep_alive
+							->reset = a2hex_or_atoi(
+							pos + strlen(cmdname));
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: reset not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+			}
+			if (strcmp(argv[4], "start") == 0) {
+				snprintf(cmdname, sizeof(cmdname),
+					 "sendInterval=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						keep_alive->sendInterval =
+							a2hex_or_atoi(
+								pos +
+								strlen(cmdname));
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: sendInterval not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+				snprintf(cmdname, sizeof(cmdname),
+					 "retryInterval=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						keep_alive->retryInterval =
+							a2hex_or_atoi(
+								pos +
+								strlen(cmdname));
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: retryInterval not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+				snprintf(cmdname, sizeof(cmdname),
+					 "retryCount=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						keep_alive->retryCount =
+							a2hex_or_atoi(
+								pos +
+								strlen(cmdname));
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: retryCount not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+				snprintf(cmdname, sizeof(cmdname),
+					 "destMacAddr=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						mac2raw(pos + strlen(cmdname),
+							keep_alive->dst_mac);
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: destination MAC address not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+				snprintf(cmdname, sizeof(cmdname),
+					 "srcMacAddr=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						mac2raw(pos + strlen(cmdname),
+							keep_alive->src_mac);
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: source MAC address not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+				snprintf(cmdname, sizeof(cmdname), "pktLen=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						keep_alive->pkt_len =
+							a2hex_or_atoi(
+								pos +
+								strlen(cmdname));
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: ip packet length not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+				snprintf(cmdname, sizeof(cmdname), "ipPkt=");
+				name_found = 0;
+				while ((pos = mlan_config_get_line(
+						fp, line, sizeof(line), &ln))) {
+					if (strncmp(pos, cmdname,
+						    strlen(cmdname)) == 0) {
+						name_found = 1;
+						arg_num = parse_line(line, args,
+								     256);
+						if (arg_num <
+						    keep_alive->pkt_len) {
+							fprintf(stderr,
+								"Invalid ipPkt or pkt_len in '%s'\n",
+								argv[3]);
+							break;
+						}
+						for (i = 0;
+						     i < keep_alive->pkt_len;
+						     i++)
+							keep_alive->pkt[i] =
+								(t_u8)atoval(
+									args[i +
+									     1]);
+						break;
+					}
+				}
+				if (!name_found) {
+					fprintf(stderr,
+						"mlanutl: ipPkt data not found in file '%s'\n",
+						argv[3]);
+					break;
+				}
+			}
+		}
+	}
+	if (!cmdname_found) {
+		fprintf(stderr, "mlanutl: ipPkt data not found in file '%s'\n",
+			argv[3]);
+		free(buffer);
+		if (fp)
+			fclose(fp);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	cmd = (struct eth_priv_cmd *)malloc(sizeof(struct eth_priv_cmd));
+	if (!cmd) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Fill up buffer */
+#ifdef USERSPACE_32BIT_OVER_KERNEL_64BIT
+	memset(cmd, 0, sizeof(struct eth_priv_cmd));
+	memcpy(&cmd->buf, &buffer, sizeof(buffer));
+#else
+	cmd->buf = buffer;
+#endif
+	cmd->used_len = 0;
+	cmd->total_len = BUFFER_LENGTH;
+	/* Perform IOCTL */
+	memset(&ifr, 0, sizeof(struct ifreq));
+	strncpy(ifr.ifr_ifrn.ifrn_name, dev_name, strlen(dev_name));
+	ifr.ifr_ifru.ifru_data = (void *)cmd;
+
+	if (ioctl(sockfd, MLAN_ETH_PRIV, &ifr)) {
+		perror("mlanutl");
+		fprintf(stderr, "mlanutl: cloud keep alive fail\n");
+		if (cmd)
+			free(cmd);
+		if (buffer)
+			free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+	/* Process result */
+	keep_alive = (cloud_keep_alive *)(buffer + strlen(argv[2]));
+	if (strcmp(argv[4], "start") != 0) {
+		hexdump("Last cloud keep alive packet info", keep_alive->pkt,
+			keep_alive->pkt_len, ' ');
+	}
+
+	if (buffer)
+		free(buffer);
+	if (cmd)
+		free(cmd);
+
+done:
+	return ret;
+}
+
 /********************************************************
 			Global Functions
 ********************************************************/
diff --git a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h
index 319b5fa..c949d30 100644
--- a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h
+++ b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h
@@ -365,6 +365,15 @@ struct eth_priv_get_log {
 	t_u32 gdma_abort_cnt;
 	/** Rx Reset MAC Count */
 	t_u32 g_reset_rx_mac_cnt;
+	// Ownership error counters
+	/*Error Ownership error count*/
+	t_u32 dwCtlErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwBcnErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwMgtErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwDatErrCnt;
 };
 
 /** MLAN MAC Address Length */
@@ -1183,4 +1192,44 @@ typedef struct MAPP_HostCmd_DS_MEM {
 	t_u32 value;
 } __ATTRIB_PACK__ HostCmd_DS_MEM;
 
+typedef struct _HostCmd_DS_MEF_CFG {
+	/** Criteria */
+	t_u32 Criteria;
+	/** Number of entries */
+	t_u16 NumEntries;
+} __ATTRIB_PACK__ HostCmd_DS_MEF_CFG;
+
+typedef struct _MEF_CFG_DATA {
+	/** Size */
+	t_u16 size;
+	/** Data */
+	HostCmd_DS_MEF_CFG data;
+} __ATTRIB_PACK__ MEF_CFG_DATA;
+
+/** cloud keep alive parameters */
+typedef struct _cloud_keep_alive {
+	/** id */
+	t_u8 mkeep_alive_id;
+	/** enable/disable of this id */
+	t_u8 enable;
+	/** enable/disable reset*/
+	t_u8 reset;
+	/** Reserved */
+	t_u8 reserved;
+	/** Destination MAC address */
+	t_u8 dst_mac[ETH_ALEN];
+	/** Source MAC address */
+	t_u8 src_mac[ETH_ALEN];
+	/** packet send period */
+	t_u32 sendInterval;
+	/** packet retry interval */
+	t_u32 retryInterval;
+	/** packet retry count */
+	t_u8 retryCount;
+	/** packet length */
+	t_u8 pkt_len;
+	/** packet content */
+	t_u8 pkt[255];
+} __ATTRIB_PACK__ cloud_keep_alive;
+
 #endif /* _MLANUTL_H_ */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11ax.c b/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
index c8d729d..e391b2b 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
@@ -158,6 +158,11 @@ t_u16 wlan_fill_he_cap_tlv(mlan_private *pmpriv, t_u8 band,
 {
 	pmlan_adapter pmadapter = pmpriv->adapter;
 	t_u16 len = 0;
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(SD9097) || defined(USB9097)
+	t_u16 rx_nss = 0, tx_nss = 0;
+#endif
+	MrvlIEtypes_He_cap_t *phecap = MNULL;
 
 	if (!phe_cap) {
 		LEAVE();
@@ -176,7 +181,37 @@ t_u16 wlan_fill_he_cap_tlv(mlan_private *pmpriv, t_u8 band,
 	}
 	phe_cap->type = wlan_cpu_to_le16(phe_cap->type);
 	phe_cap->len = wlan_cpu_to_le16(phe_cap->len);
-
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(SD9097) || defined(USB9097)
+	if (IS_CARD9098(pmpriv->adapter->card_type) ||
+	    IS_CARD9097(pmpriv->adapter->card_type)) {
+		if (band & BAND_A) {
+			rx_nss = GET_RXMCSSUPP(pmpriv->adapter->user_htstream >>
+					       8);
+			tx_nss = GET_TXMCSSUPP(pmpriv->adapter->user_htstream >>
+					       8) &
+				 0x0f;
+		} else {
+			rx_nss = GET_RXMCSSUPP(pmpriv->adapter->user_htstream);
+			tx_nss = GET_TXMCSSUPP(pmpriv->adapter->user_htstream) &
+				 0x0f;
+		}
+	}
+#endif
+	phecap = (MrvlIEtypes_He_cap_t *)phe_cap;
+	phecap->rx_mcs_80 = wlan_cpu_to_le16(0xfffe);
+	phecap->tx_mcs_80 = wlan_cpu_to_le16(0xfffe);
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(SD9097) || defined(USB9097)
+	if (IS_CARD9098(pmpriv->adapter->card_type) ||
+	    IS_CARD9097(pmpriv->adapter->card_type)) {
+		if (rx_nss == 2)
+			phecap->rx_mcs_80 = wlan_cpu_to_le16(0xfffa);
+		if (tx_nss == 2)
+			phecap->tx_mcs_80 = wlan_cpu_to_le16(0xfffa);
+	}
+#endif
+	DBG_HEXDUMP(MCMD_D, "fill_11ax_tlv", (t_u8 *)phecap, len);
 	LEAVE();
 	return len;
 }
@@ -197,6 +232,10 @@ int wlan_cmd_append_11ax_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	MrvlIEtypes_He_cap_t *phecap = MNULL;
 	int len = 0;
 	t_u8 bw_80p80 = MFALSE;
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(SD9097) || defined(USB9097)
+	t_u16 rx_nss = 0, tx_nss = 0;
+#endif
 
 	ENTER();
 
@@ -230,26 +269,44 @@ int wlan_cmd_append_11ax_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	}
 	phecap->type = wlan_cpu_to_le16(phecap->type);
 	phecap->len = wlan_cpu_to_le16(phecap->len);
-
-	if (bw_80p80) {
-		/** configure 2*2 to 1*1 to support 80+80Mhz*/
-		/** set 1*1 mcs rate for 80Mhz rx*/
-		phecap->he_txrx_mcs_support[0] &= ~(MBIT(0) | MBIT(1));
-		/** set 1*1 mcs rate for 80Mhz tx*/
-		phecap->he_txrx_mcs_support[3] &= ~(MBIT(0) | MBIT(1));
-		/** set 1*1 mcs rate for 160Mhz rx*/
-		phecap->he160_txrx_mcs_support[0] &= ~(MBIT(0) | MBIT(1));
-		/** set 1*1 mcs rate for 160Mhz tx*/
-		phecap->he160_txrx_mcs_support[3] &= ~(MBIT(0) | MBIT(1));
-		/** set 1*1 mcs rate for 80+80Mhz rx*/
-		phecap->he8080_txrx_mcs_support[0] &= ~(MBIT(0) | MBIT(1));
-		/** set 1*1 mcs rate for 80+80Mhz tx*/
-		phecap->he8080_txrx_mcs_support[3] &= ~(MBIT(0) | MBIT(1));
-	} else {
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(SD9097) || defined(USB9097)
+	if (IS_CARD9098(pmpriv->adapter->card_type) ||
+	    IS_CARD9097(pmpriv->adapter->card_type)) {
+		if (pbss_desc->bss_band & BAND_A) {
+			rx_nss = GET_RXMCSSUPP(pmpriv->adapter->user_htstream >>
+					       8);
+			tx_nss = GET_TXMCSSUPP(pmpriv->adapter->user_htstream >>
+					       8) &
+				 0x0f;
+		} else {
+			rx_nss = GET_RXMCSSUPP(pmpriv->adapter->user_htstream);
+			tx_nss = GET_TXMCSSUPP(pmpriv->adapter->user_htstream) &
+				 0x0f;
+		}
+		/** force 1x1 when enable 80P80 */
+		if (bw_80p80)
+			rx_nss = tx_nss = 1;
+	}
+#endif
+	phecap->rx_mcs_80 = wlan_cpu_to_le16(0xfffe);
+	phecap->tx_mcs_80 = wlan_cpu_to_le16(0xfffe);
+#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
+	defined(PCIE9097) || defined(SD9097) || defined(USB9097)
+	if (IS_CARD9098(pmpriv->adapter->card_type) ||
+	    IS_CARD9097(pmpriv->adapter->card_type)) {
+		if (rx_nss == 2)
+			phecap->rx_mcs_80 = wlan_cpu_to_le16(0xfffa);
+		if (tx_nss == 2)
+			phecap->tx_mcs_80 = wlan_cpu_to_le16(0xfffa);
+	}
+#endif
+	if (!bw_80p80) {
 		/** reset BIT3 and BIT4 channel width ,not support 80 + 80*/
 		/** not support 160Mhz now, if support,not reset bit3 */
 		phecap->he_phy_cap[0] &= ~(MBIT(3) | MBIT(4));
 	}
+	DBG_HEXDUMP(MCMD_D, "append_11ax_tlv", (t_u8 *)phecap, len);
 
 	LEAVE();
 	return len;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n.c b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
index ed8c2ba..a9a42d8 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
@@ -1396,10 +1396,16 @@ static void wlan_fill_cap_info(mlan_private *priv, HTCap_t *ht_cap, t_u8 bands)
 	RESETHT_MAXAMSDU(ht_cap->ht_cap_info);
 
 	/* SM power save */
-	if (ISSUPP_MIMOPS(priv->adapter->hw_dot_11n_dev_cap))
-		RESETHT_SM_POWERSAVE(ht_cap->ht_cap_info); /* Enable HT SMPS*/
-	else
-		SETHT_STATIC_SMPS(ht_cap->ht_cap_info); /* Disable HT SMPS */
+	RESETHT_SM_POWERSAVE(ht_cap->ht_cap_info); /* Clear to HT SMPS static
+						      mode*/
+	if (ISSUPP_MIMOPS(usr_dot_11n_dev_cap)) {
+		if (ISSUPP_SMPS_DYNAMIC_MODE(usr_dot_11n_dev_cap))
+			SETHT_SMPS_DYNAMIC(ht_cap->ht_cap_info); /* Set to HT
+								    SMPS dynamic
+								    mode */
+	} else {
+		SETHT_SMPS_DISABLE(ht_cap->ht_cap_info); /* Disable HT SMPS */
+	}
 
 	LEAVE();
 }
@@ -1462,8 +1468,8 @@ static void wlan_reset_cap_info(mlan_private *priv, HTCap_t *ht_cap, t_u8 bands)
 	/* Need change to support 8k AMSDU receive */
 	RESETHT_MAXAMSDU(ht_cap->ht_cap_info);
 	/* SM power save */
-	if (!ISSUPP_MIMOPS(priv->adapter->hw_dot_11n_dev_cap))
-		SETHT_STATIC_SMPS(ht_cap->ht_cap_info); /* Disable HT SMPS */
+	if (!ISSUPP_MIMOPS(usr_dot_11n_dev_cap))
+		SETHT_SMPS_DISABLE(ht_cap->ht_cap_info); /* Disable HT SMPS */
 
 	LEAVE();
 }
@@ -3046,6 +3052,7 @@ int wlan_get_rxreorder_tbl(mlan_private *priv, rx_reorder_tbl *buf)
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 		ptbl->start_win = rx_reorder_tbl_ptr->start_win;
 		ptbl->win_size = rx_reorder_tbl_ptr->win_size;
+
 		ptbl->amsdu = rx_reorder_tbl_ptr->amsdu;
 		for (i = 0; i < rx_reorder_tbl_ptr->win_size; ++i) {
 			if (rx_reorder_tbl_ptr->rx_reorder_ptr[i])
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c b/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
index 185065c..0a5f7e7 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
@@ -79,10 +79,12 @@ static mlan_status wlan_11n_dispatch_amsdu_pkt(mlan_private *priv,
  *
  *  @param priv     A pointer to mlan_private
  *  @param payload  A pointer to rx packet payload
+ *  @param rx_reor_tbl_ptr       pointer to RxReorderTbl
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-static mlan_status wlan_11n_dispatch_pkt(t_void *priv, t_void *payload)
+static mlan_status wlan_11n_dispatch_pkt(t_void *priv, t_void *payload,
+					 RxReorderTbl *rx_reor_tbl_ptr)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 #ifdef STA_SUPPORT
@@ -93,6 +95,7 @@ static mlan_status wlan_11n_dispatch_pkt(t_void *priv, t_void *payload)
 		LEAVE();
 		return ret;
 	}
+
 #ifdef UAP_SUPPORT
 	if (GET_BSS_ROLE((mlan_private *)priv) == MLAN_BSS_ROLE_UAP) {
 		if (MLAN_STATUS_SUCCESS ==
@@ -188,7 +191,8 @@ static mlan_status wlan_11n_dispatch_pkt_until_start_win(
 		pmpriv->adapter->callbacks.moal_spin_unlock(
 			pmpriv->adapter->pmoal_handle, pmpriv->rx_pkt_lock);
 		if (rx_tmp_ptr)
-			wlan_11n_dispatch_pkt(priv, rx_tmp_ptr);
+			wlan_11n_dispatch_pkt(priv, rx_tmp_ptr,
+					      rx_reor_tbl_ptr);
 	}
 
 	pmpriv->adapter->callbacks.moal_spin_lock(pmpriv->adapter->pmoal_handle,
@@ -264,7 +268,7 @@ static mlan_status wlan_11n_scan_and_dispatch(t_void *priv,
 		rx_reor_tbl_ptr->rx_reorder_ptr[i] = MNULL;
 		pmpriv->adapter->callbacks.moal_spin_unlock(
 			pmpriv->adapter->pmoal_handle, pmpriv->rx_pkt_lock);
-		wlan_11n_dispatch_pkt(priv, rx_tmp_ptr);
+		wlan_11n_dispatch_pkt(priv, rx_tmp_ptr, rx_reor_tbl_ptr);
 	}
 
 	pmpriv->adapter->callbacks.moal_spin_lock(pmpriv->adapter->pmoal_handle,
@@ -516,6 +520,7 @@ static t_void wlan_11n_create_rxreorder_tbl(mlan_private *priv, t_u8 *ta,
 	new_node->ba_status = BA_STREAM_SETUP_INPROGRESS;
 	for (i = 0; i < win_size; ++i)
 		new_node->rx_reorder_ptr[i] = MNULL;
+
 	mlan_block_rx_process(pmadapter, MFALSE);
 	LEAVE();
 }
@@ -763,7 +768,7 @@ mlan_status mlan_11n_rxreorder_pkt(void *priv, t_u16 seq_num, t_u16 tid,
 		wlan_11n_get_rxreorder_tbl((mlan_private *)priv, tid, ta);
 	if (!rx_reor_tbl_ptr || rx_reor_tbl_ptr->win_size <= 1) {
 		if (pkt_type != PKT_TYPE_BAR)
-			wlan_11n_dispatch_pkt(priv, payload);
+			wlan_11n_dispatch_pkt(priv, payload, rx_reor_tbl_ptr);
 
 		LEAVE();
 		return ret;
@@ -774,7 +779,7 @@ mlan_status mlan_11n_rxreorder_pkt(void *priv, t_u16 seq_num, t_u16 tid,
 			wlan_start_flush_data(priv, rx_reor_tbl_ptr);
 		}
 		if ((pkt_type == PKT_TYPE_AMSDU) && !rx_reor_tbl_ptr->amsdu) {
-			wlan_11n_dispatch_pkt(priv, payload);
+			wlan_11n_dispatch_pkt(priv, payload, rx_reor_tbl_ptr);
 			LEAVE();
 			return ret;
 		}
@@ -801,7 +806,8 @@ mlan_status mlan_11n_rxreorder_pkt(void *priv, t_u16 seq_num, t_u16 tid,
 							seq_num;
 						if (pkt_type != PKT_TYPE_BAR)
 							wlan_11n_dispatch_pkt(
-								priv, payload);
+								priv, payload,
+								rx_reor_tbl_ptr);
 					}
 					LEAVE();
 					return ret;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
index 80cdc4a..9b14c9a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
@@ -1281,9 +1281,9 @@ static t_void wlan_cfp_copy_dynamic(pmlan_adapter pmadapter,
 	}
 
 	/* first clear dest dynamic blacklisted entries */
+	/* do not clear the flags */
 	for (i = 0; i < num_cfp; i++) {
 		cfp[i].dynamic.blacklist = MFALSE;
-		cfp[i].dynamic.flags = 0;
 	}
 
 	/* copy dynamic blacklisted entries from source where channels match */
@@ -1293,8 +1293,6 @@ static t_void wlan_cfp_copy_dynamic(pmlan_adapter pmadapter,
 				if (cfp[i].channel == cfp_src[j].channel) {
 					cfp[i].dynamic.blacklist =
 						cfp_src[j].dynamic.blacklist;
-					cfp[i].dynamic.flags =
-						cfp_src[j].dynamic.flags;
 					break;
 				}
 	}
@@ -1323,6 +1321,17 @@ mlan_status wlan_misc_country_2_cfp_table_code(pmlan_adapter pmadapter,
 
 	ENTER();
 
+	if (pmadapter->otp_region) {
+		if (!memcmp(pmadapter, pmadapter->otp_region->country_code,
+			    country_code, COUNTRY_CODE_LEN - 1)) {
+			if (pmadapter->cfp_otp_bg)
+				*cfp_bg = pmadapter->otp_region->region_code;
+			if (pmadapter->cfp_otp_a)
+				*cfp_a = pmadapter->otp_region->region_code;
+			LEAVE();
+			return MLAN_STATUS_SUCCESS;
+		}
+	}
 	/* Look for code in mapping table */
 	for (i = 0; i < NELEMENTS(country_code_mapping); i++) {
 		if (!memcmp(pmadapter, country_code_mapping[i].country_code,
@@ -2712,7 +2721,7 @@ mlan_status wlan_set_regiontable(mlan_private *pmpriv, t_u8 region, t_u8 band)
 			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no,
 					      region_chan_old[j].pcfp,
 					      region_chan_old[j].num_cfp);
-		} else if (region) {
+		} else if (cfp) {
 			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no, MNULL, 0);
 		}
 		i++;
@@ -2744,7 +2753,7 @@ mlan_status wlan_set_regiontable(mlan_private *pmpriv, t_u8 region, t_u8 band)
 			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no,
 					      region_chan_old[j].pcfp,
 					      region_chan_old[j].num_cfp);
-		} else if (region) {
+		} else if (cfp) {
 			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no, MNULL, 0);
 		}
 	}
@@ -3110,6 +3119,43 @@ t_u8 wlan_mrvl_rateid_to_ieee_rateid(t_u8 rate)
 	return rateUnit_500Kbps[rate];
 }
 
+/**
+ *  @brief	 sort cfp otp table
+ *
+ *  @param pmapdater	a pointer to mlan_adapter structure
+ *
+ *  @return
+ *    None
+ */
+static void wlan_sort_cfp_otp_table(mlan_adapter *pmadapter)
+{
+	t_u8 c, d;
+	chan_freq_power_t *ch1;
+	chan_freq_power_t *ch2;
+	chan_freq_power_t swap;
+
+	if (pmadapter->tx_power_table_a_rows <= 1)
+		return;
+	for (c = 0; c < pmadapter->tx_power_table_a_rows - 1; c++) {
+		for (d = 0; d < pmadapter->tx_power_table_a_rows - c - 1; d++) {
+			ch1 = (chan_freq_power_t *)(pmadapter->cfp_otp_a + d);
+			ch2 = (chan_freq_power_t *)(pmadapter->cfp_otp_a + d +
+						    1);
+			if (ch1->channel > ch2->channel) {
+				memcpy_ext(pmadapter, &swap, ch1,
+					   sizeof(chan_freq_power_t),
+					   sizeof(chan_freq_power_t));
+				memcpy_ext(pmadapter, ch1, ch2,
+					   sizeof(chan_freq_power_t),
+					   sizeof(chan_freq_power_t));
+				memcpy_ext(pmadapter, ch2, &swap,
+					   sizeof(chan_freq_power_t),
+					   sizeof(chan_freq_power_t));
+			}
+		}
+	}
+}
+
 /**
  *  @brief	Update CFP tables and power tables from FW
  *
@@ -3144,8 +3190,11 @@ void wlan_add_fw_cfp_tables(pmlan_private pmpriv, t_u8 *buf, t_u16 buf_left)
 		PRINTM(MERROR, "CFP table update failed!\n");
 		goto out;
 	}
-	if (pmadapter->otp_region)
+	if (pmadapter->otp_region) {
+		memset(pmadapter, pmadapter->region_channel, 0,
+		       sizeof(pmadapter->region_channel));
 		wlan_free_fw_cfp_tables(pmadapter);
+	}
 	pmadapter->tx_power_table_bg_rows = FW_CFP_TABLE_MAX_ROWS_BG;
 	pmadapter->tx_power_table_bg_cols = FW_CFP_TABLE_MAX_COLS_BG;
 	pmadapter->tx_power_table_a_rows = FW_CFP_TABLE_MAX_ROWS_A;
@@ -3223,6 +3272,10 @@ void wlan_add_fw_cfp_tables(pmlan_private pmpriv, t_u8 *buf, t_u16 buf_left)
 			pmadapter->domain_reg.country_code[1] =
 				pmadapter->otp_region->country_code[1];
 			pmadapter->domain_reg.country_code[2] = '\0';
+			PRINTM(MCMND, "OTP region: region_code=%d %c%c\n",
+			       pmadapter->otp_region->region_code,
+			       pmadapter->country_code[0],
+			       pmadapter->country_code[1]);
 			pmadapter->cfp_code_bg =
 				pmadapter->otp_region->region_code;
 			pmadapter->cfp_code_a =
@@ -3271,6 +3324,11 @@ void wlan_add_fw_cfp_tables(pmlan_private pmpriv, t_u8 *buf, t_u16 buf_left)
 					(pmadapter->cfp_otp_bg + i)
 						->passive_scan_or_radar_detect =
 						MTRUE;
+				PRINTM(MCMD_D,
+				       "OTP Region (BG): chan=%d flags=0x%x\n",
+				       (pmadapter->cfp_otp_bg + i)->channel,
+				       (pmadapter->cfp_otp_bg + i)
+					       ->dynamic.flags);
 				data++;
 			}
 			ret = pcb->moal_malloc(
@@ -3306,6 +3364,12 @@ void wlan_add_fw_cfp_tables(pmlan_private pmpriv, t_u8 *buf, t_u16 buf_left)
 					(pmadapter->cfp_otp_a + i)
 						->passive_scan_or_radar_detect =
 						MTRUE;
+				PRINTM(MCMD_D,
+				       "OTP Region (A): chan=%d flags=0x%x\n",
+				       (pmadapter->cfp_otp_a + i)->channel,
+				       (pmadapter->cfp_otp_a + i)
+					       ->dynamic.flags);
+
 				data++;
 			}
 			break;
@@ -3380,6 +3444,9 @@ void wlan_add_fw_cfp_tables(pmlan_private pmpriv, t_u8 *buf, t_u16 buf_left)
 				((power_table_attr_t *)data)->rows_5g;
 			pmadapter->tx_power_table_a_cols =
 				((power_table_attr_t *)data)->cols_5g;
+			PRINTM(MCMD_D, "OTP region: bg_row=%d, a_row=%d\n",
+			       pmadapter->tx_power_table_bg_rows,
+			       pmadapter->tx_power_table_a_rows);
 			break;
 		default:
 			break;
@@ -3410,7 +3477,8 @@ void wlan_add_fw_cfp_tables(pmlan_private pmpriv, t_u8 *buf, t_u16 buf_left)
 				NXP_CHANNEL_NO_OFDM;
 		}
 	}
-
+	if (pmadapter->cfp_otp_a)
+		wlan_sort_cfp_otp_table(pmadapter);
 out:
 	LEAVE();
 }
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
index 75440b0..24f23f6 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
@@ -320,6 +320,7 @@ static t_void wlan_dump_info(mlan_adapter *pmadapter, t_u8 reason)
 	       pmadapter->pps_uapsd_mode, pmadapter->sleep_period.period);
 	PRINTM(MERROR, "tx_lock_flag = %d\n", pmadapter->tx_lock_flag);
 	PRINTM(MERROR, "scan_processing = %d\n", pmadapter->scan_processing);
+	PRINTM(MERROR, "bypass_pkt_count=%d\n", pmadapter->bypass_pkt_count);
 #ifdef SDIO
 	if (IS_SD(pmadapter->card_type)) {
 		mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
@@ -974,7 +975,22 @@ static t_u16 wlan_get_cmd_timeout(t_u16 cmd_id)
 		timeout = MRVDRV_TIMER_5S;
 		break;
 	default:
+#ifdef IMX_SUPPORT
+		/*
+		 * During the roaming test and the 5AP connection test, cmd
+		 * timeout are observed for commands like 0x5e, 0x16, 0xd1.
+		 * Observed that response has come just after default timeout of
+		 * 2 seconds for these commands. This random timeout is not
+		 * observed when the default timeout is increased to 5 seconds
+		 * (As an work around, Increase the default timeout to 5
+		 * seconds. Need to further debug exact reason for delay in cmd
+		 * responses)
+		 *
+		 */
 		timeout = MRVDRV_TIMER_1S * 5;
+#else
+		timeout = MRVDRV_TIMER_1S * 2;
+#endif
 		break;
 	}
 	LEAVE();
@@ -2409,22 +2425,8 @@ t_void wlan_cancel_all_pending_cmd(pmlan_adapter pmadapter, t_u8 flag)
 		wlan_insert_cmd_to_free_q(pmadapter, pcmd_node);
 	}
 	wlan_release_cmd_lock(pmadapter);
-#ifdef STA_SUPPORT
-	if (pmadapter->scan_processing &&
-	    pmadapter->ext_scan_type == EXT_SCAN_ENHANCE) {
-		if (priv) {
-			if (MLAN_STATUS_FAILURE ==
-			    wlan_prepare_cmd(priv, HostCmd_CMD_802_11_SCAN_EXT,
-					     HostCmd_ACT_GEN_SET, 0, MNULL,
-					     MNULL))
-				PRINTM(MERROR, "Failed to prepare command");
-			wlan_recv_event(priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
-					MNULL);
-		}
-	} else
-		/* Cancel all pending scan command */
-		wlan_flush_scan_queue(pmadapter);
-#endif
+	/* Cancel all pending scan command */
+	wlan_flush_scan_queue(pmadapter);
 	LEAVE();
 }
 
@@ -5047,6 +5049,11 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				PRINTM(MCMND, "chanrpt api ver=%d.%d\n",
 				       api_rev->major_ver, api_rev->minor_ver);
 				break;
+			case FW_HOTFIX_VER_ID:
+				pmadapter->fw_hotfix_ver = api_rev->major_ver;
+				PRINTM(MCMND, "fw hotfix ver=%d\n",
+				       api_rev->major_ver);
+				break;
 			default:
 				break;
 			}
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_decl.h b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
index 42884ba..1688908 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "247.p5"
+#define MLAN_RELEASE_VERSION "266"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -266,6 +266,7 @@ typedef t_s32 t_sval;
 /** pcie card reset */
 #define FW_RELOAD_PCIE_RESET 4
 #endif
+#define FW_RELOAD_SDIO_HW_RESET 5
 
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
@@ -428,6 +429,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SD8987 "SD8987"
 /** SD9097 Card */
 #define CARD_SD9097 "SD9097"
+/** SDIW620 Card */
+#define CARD_SDIW620 "SDIW620"
 /** SD9098 Card */
 #define CARD_SD9098 "SD9098"
 /** SD9177 Card */
@@ -457,6 +460,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_PCIE8997 "PCIE8997"
 /** PCIE9097 Card */
 #define CARD_PCIE9097 "PCIE9097"
+/** PCIEIW620 Card */
+#define CARD_PCIEIW620 "PCIEIW620"
 /** PCIE9000S Card */
 #define CARD_PCIE9000S "PCIE9000S"
 /** PCIE9098 Card */
@@ -498,6 +503,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9098 "USB9098"
 /** USB9097 Card */
 #define CARD_USB9097 "USB9097"
+/** USBIW620 Card */
+#define CARD_USBIW620 "USBIW620"
 #endif
 
 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
@@ -1386,7 +1393,7 @@ typedef MLAN_PACK_START struct _tdls_each_link_status {
 	/** Key Length */
 	t_u8 key_length;
 	/** actual key */
-	t_u8 key[];
+	t_u8 key[1];
 } MLAN_PACK_END tdls_each_link_status;
 
 /** TDLS configuration data */
@@ -2021,6 +2028,7 @@ typedef struct _mlan_callbacks {
 				     t_u8 antenna);
 	t_void (*moal_updata_peer_signal)(t_void *pmoal, t_u32 bss_index,
 					  t_u8 *peer_addr, t_s8 snr, t_s8 nflr);
+	t_u64 (*moal_do_div)(t_u64 num, t_u32 base);
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
 	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal,
 						  t_u32 bss_index);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_fw.h b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
index 04b89e0..4617f9b 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_fw.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
@@ -552,6 +552,8 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define HWSPEC_MAX_AMSDU_SUPP MBIT(31)
 /** Greenfield support */
 #define HWSPEC_GREENFIELD_SUPP MBIT(29)
+/** SM Power Save enable */
+#define CAPINFO_SMPS_ENABLE MBIT(27)
 /** RX STBC support */
 #define HWSPEC_RXSTBC_SUPP MBIT(26)
 /** ShortGI @ 40Mhz support */
@@ -562,6 +564,8 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define HWSPEC_LDPC_SUPP MBIT(22)
 /** Channel width 40Mhz support */
 #define HWSPEC_CHANBW40_SUPP MBIT(17)
+/** SM Power Save mode */
+#define CAPINFO_SMPS_MODE MBIT(9)
 /** 40Mhz intolarent enable */
 #define CAPINFO_40MHZ_INTOLARENT MBIT(8)
 
@@ -580,7 +584,11 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define DEFAULT_11N_TX_BF_CAP_1X1 0x19E74608
 
 /** Bits to ignore in hw_dev_cap as these bits are set in get_hw_spec */
-#define IGN_HW_DEV_CAP (CAPINFO_40MHZ_INTOLARENT)
+#define IGN_HW_DEV_CAP                                                         \
+	(CAPINFO_40MHZ_INTOLARENT | (CAPINFO_SMPS_ENABLE | CAPINFO_SMPS_MODE))
+
+/** HW_SPEC FwCapInfo : If FW support RSN Replay Detection */
+#define ISSUPP_RSN_REPLAY_DETECTION(FwCapInfo) (FwCapInfo & MBIT(28))
 
 /** HW_SPEC FwCapInfo */
 #define ISSUPP_11NENABLED(FwCapInfo) (FwCapInfo & MBIT(11))
@@ -615,6 +623,8 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define ISSUPP_CHANWIDTH20(Dot11nDevCap) (Dot11nDevCap & MBIT(16))
 /** HW_SPEC Dot11nDevCap : Channel BW support @ 10Mhz  support */
 #define ISSUPP_CHANWIDTH10(Dot11nDevCap) (Dot11nDevCap & MBIT(15))
+/** Dot11nUsrCap : SMPS static/dynamic mode if BIT27 MIMO PS support eanbled */
+#define ISSUPP_SMPS_DYNAMIC_MODE(Dot11nDevCap) (Dot11nDevCap & MBIT(9))
 /** Dot11nUsrCap : 40Mhz intolarance enabled */
 #define ISENABLED_40MHZ_INTOLARENT(Dot11nDevCap) (Dot11nDevCap & MBIT(8))
 /** Dot11nUsrCap : Reset 40Mhz intolarance enabled */
@@ -689,8 +699,11 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define SETHT_DSSSCCK40(HTCapInfo) (HTCapInfo |= MBIT(12))
 /** SET HTCapInfo : Enable 40Mhz Intolarence */
 #define SETHT_40MHZ_INTOLARANT(HTCapInfo) (HTCapInfo |= MBIT(14))
-/** SET HTCapInfo : Disable Static SM power save */
-#define SETHT_STATIC_SMPS(HTCapInfo) ((HTCapInfo) |= (MBIT(2) | MBIT(3)))
+
+/** SET HTCapInfo : Set SM power save disabled */
+#define SETHT_SMPS_DISABLE(HTCapInfo) ((HTCapInfo) |= (MBIT(2) | MBIT(3)))
+/** SET HTCapInfo : Set Dynamic SM power save */
+#define SETHT_SMPS_DYNAMIC(HTCapInfo) ((HTCapInfo) |= MBIT(2))
 
 /** RESET HTCapInfo : Set support for LDPC coding capability */
 #define RESETHT_LDPCCODINGCAP(HTCapInfo) (HTCapInfo &= ~MBIT(0))
@@ -1404,7 +1417,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_Extension_t {
 	/** Element id extension */
 	t_u8 ext_id;
 	/** payload */
-	t_u8 data[];
+	t_u8 data[1];
 } MLAN_PACK_END MrvlIEtypes_Extension_t, *pMrvlIEtypes_Extension_t;
 
 /* HE MAC Capabilities Information field BIT 1 for TWT Req */
@@ -1422,12 +1435,18 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_He_cap_t {
 	t_u8 he_mac_cap[6];
 	/** he phy capability info */
 	t_u8 he_phy_cap[11];
-	/** he txrx mcs support , size would be 4 or 8 or 12 */
-	t_u8 he_txrx_mcs_support[4];
-	/** 160Mhz tx rx mcs support*/
-	t_u8 he160_txrx_mcs_support[4];
-	/** 80+80 Mhz tx rx mcs suport */
-	t_u8 he8080_txrx_mcs_support[4];
+	/** rx mcs for 80 */
+	t_u16 rx_mcs_80;
+	/** tx mcs for 80 */
+	t_u16 tx_mcs_80;
+	/** rx mcs for bw 160 */
+	t_u16 rx_mcs_160;
+	/** tx mcs for bw 160 */
+	t_u16 tx_mcs_160;
+	/** rx mcs for bw 80+80 */
+	t_u16 rx_mcs_80p80;
+	/** tx mcs for bw 80+80 */
+	t_u16 tx_mcs_80p80;
 	/** PPE Thresholds (optional) */
 	t_u8 val[20];
 } MLAN_PACK_END MrvlIEtypes_He_cap_t, *pMrvlIEtypes_he_cap_t;
@@ -1927,6 +1946,8 @@ typedef enum _ENH_PS_MODES {
 #define EVENT_VDLL_IND 0x00000081
 #define EVENT_EXCEED_MAX_P2P_CONN 0x00000089
 
+/** Card Event definition : RESET PN */
+
 #define EVENT_FW_HANG_REPORT 0x0000008F
 
 #define EVENT_FW_DUMP_INFO 0x00000073
@@ -1982,7 +2003,7 @@ typedef MLAN_PACK_START struct _ie_data {
 	/** IE Length */
 	t_u16 ie_length;
 	/** IE pointer */
-	t_u8 ie_ptr[];
+	t_u8 ie_ptr[1];
 } MLAN_PACK_END tdls_ie_data;
 
 /** Event structure for generic events from TDLS FW */
@@ -2170,6 +2191,7 @@ typedef MLAN_PACK_START struct _RxPD {
 	t_u64 toa_tod_tstamps;
 	/** rx info */
 	t_u32 rx_info;
+
 } MLAN_PACK_END RxPD, *PRxPD;
 
 /** IEEEtypes_FrameCtl_t*/
@@ -2938,7 +2960,7 @@ typedef MLAN_PACK_START struct _MrvlIETypes_ChanTRPCConfig_t {
 	/** channel number */
 	t_u8 chan_num;
 	/** mode groups */
-	mod_group_setting mod_group[];
+	mod_group_setting mod_group[1];
 } MLAN_PACK_END MrvlIETypes_ChanTRPCConfig_t;
 
 /* HostCmd_DS_CHANNEL_TRPC_CONFIG */
@@ -2948,7 +2970,7 @@ typedef MLAN_PACK_START struct _HostCmd_DS_CHANNEL_TRPC_CONFIG {
 	/** 0/1/2/3 */
 	t_u16 sub_band;
 	/** chan TRPC config */
-	MrvlIETypes_ChanTRPCConfig_t tlv[];
+	// MrvlIETypes_ChanTRPCConfig_t tlv[];
 } MLAN_PACK_END HostCmd_DS_CHANNEL_TRPC_CONFIG;
 
 typedef MLAN_PACK_START struct _HostCmd_DS_MEF_CFG {
@@ -3176,6 +3198,7 @@ enum API_VER_ID {
 	FW_API_VER_ID = 2,
 	UAP_FW_API_VER_ID = 3,
 	CHANRPT_API_VER_ID = 4,
+	FW_HOTFIX_VER_ID = 5,
 };
 
 /** FW AP V15 */
@@ -3678,6 +3701,15 @@ typedef MLAN_PACK_START struct _HostCmd_DS_802_11_GET_LOG {
 	t_u32 gdma_abort_cnt;
 	/** Rx Reset MAC Count */
 	t_u32 g_reset_rx_mac_cnt;
+	// Ownership error counters
+	/*Error Ownership error count*/
+	t_u32 dwCtlErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwBcnErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwMgtErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwDatErrCnt;
 } MLAN_PACK_END HostCmd_DS_802_11_GET_LOG;
 
 /* maln wifi rate */
@@ -4305,7 +4337,7 @@ MLAN_PACK_START struct coalesce_receive_filt_rule {
 	t_u8 num_of_fields;
 	t_u8 pkt_type;
 	t_u16 max_coalescing_delay;
-	struct coalesce_filt_field_param params[];
+	struct coalesce_filt_field_param params[1];
 } MLAN_PACK_END;
 
 /** HostCmd_DS_COALESCE_CONFIG */
@@ -4313,7 +4345,7 @@ typedef MLAN_PACK_START struct _HostCmd_DS_COALESCE_CONFIG {
 	/** Action 0-GET, 1-SET */
 	t_u16 action;
 	t_u16 num_of_rules;
-	struct coalesce_receive_filt_rule rule[];
+	struct coalesce_receive_filt_rule rule[1];
 } MLAN_PACK_END HostCmd_DS_COALESCE_CONFIG;
 
 /** TLV type : FW support max connection TLV */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ieee.h b/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
index 6f73424..906a345 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
@@ -132,6 +132,7 @@ typedef MLAN_PACK_START enum _IEEEtypes_ElementId_e {
 	VS_IE = VENDOR_SPECIFIC_221,
 	WAPI_IE = 68,
 	FRAGMENT = 242,
+	RSNX_IE = 244,
 	EXTENSION = 255
 } MLAN_PACK_END IEEEtypes_ElementId_e;
 
@@ -1994,7 +1995,8 @@ typedef struct _BSSDescriptor_t {
 	t_u32 beacon_buf_size;
 	/** Max allocated size for updated scan response */
 	t_u32 beacon_buf_size_max;
-
+	/** scan age in secs */
+	t_u32 age_in_secs;
 } BSSDescriptor_t, *pBSSDescriptor_t;
 
 #endif /* !_MLAN_IEEE_H_ */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_init.c b/mxm_wifiex/wlan_src/mlan/mlan_init.c
index a435843..201ac3f 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_init.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_init.c
@@ -283,9 +283,15 @@ mlan_status wlan_allocate_adapter(pmlan_adapter pmadapter)
 		beacon_buffer_size = MAX_SCAN_BEACON_BUFFER;
 	else
 		beacon_buffer_size = DEFAULT_SCAN_BEACON_BUFFER;
-	ret = pmadapter->callbacks.moal_malloc(pmadapter->pmoal_handle,
-					       beacon_buffer_size, MLAN_MEM_DEF,
-					       (t_u8 **)&pmadapter->bcn_buf);
+	if (pmadapter->callbacks.moal_vmalloc &&
+	    pmadapter->callbacks.moal_vfree)
+		ret = pmadapter->callbacks.moal_vmalloc(
+			pmadapter->pmoal_handle, beacon_buffer_size,
+			(t_u8 **)&pmadapter->bcn_buf);
+	else
+		ret = pmadapter->callbacks.moal_malloc(
+			pmadapter->pmoal_handle, beacon_buffer_size,
+			MLAN_MEM_DEF, (t_u8 **)&pmadapter->bcn_buf);
 	if (ret != MLAN_STATUS_SUCCESS || !pmadapter->bcn_buf) {
 		PRINTM(MERROR, "Failed to allocate bcn buf\n");
 		LEAVE();
@@ -721,7 +727,7 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 	memset(pmadapter, pmadapter->pscan_table, 0,
 	       (sizeof(BSSDescriptor_t) * MRVDRV_MAX_BSSID_LIST));
 	pmadapter->active_scan_triggered = MFALSE;
-	pmadapter->ext_scan = MTRUE;
+	pmadapter->ext_scan = EXT_SCAN_TYPE_ENH;
 	pmadapter->scan_probes = DEFAULT_PROBES;
 
 	memset(pmadapter, pmadapter->bcn_buf, 0, pmadapter->bcn_buf_size);
@@ -1666,8 +1672,12 @@ t_void wlan_free_adapter(pmlan_adapter pmadapter)
 		pmadapter->pchan_stats = MNULL;
 	}
 	if (pmadapter->bcn_buf) {
-		pcb->moal_mfree(pmadapter->pmoal_handle,
-				(t_u8 *)pmadapter->bcn_buf);
+		if (pcb->moal_vmalloc && pcb->moal_vfree)
+			pcb->moal_vfree(pmadapter->pmoal_handle,
+					(t_u8 *)pmadapter->bcn_buf);
+		else
+			pcb->moal_mfree(pmadapter->pmoal_handle,
+					(t_u8 *)pmadapter->bcn_buf);
 		pmadapter->bcn_buf = MNULL;
 	}
 #endif
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
index c0015af..a9d3c79 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
@@ -1259,8 +1259,9 @@ typedef MLAN_PACK_START struct _otp_region_info {
 	t_u8 country_code[2];
 	t_u8 region_code;
 	t_u8 environment;
-	t_u16 force_reg : 1;
-	t_u16 reserved : 15;
+	t_u8 force_reg : 1;
+	t_u8 reserved : 7;
+	t_u8 dfs_region;
 } MLAN_PACK_END otp_region_info_t;
 
 /** Type definition of mlan_ds_custom_reg_domain */
@@ -1636,6 +1637,15 @@ typedef struct _mlan_ds_get_stats {
 	t_u32 gdma_abort_cnt;
 	/** Rx Reset MAC Count */
 	t_u32 g_reset_rx_mac_cnt;
+	// Ownership error counters
+	/*Error Ownership error count*/
+	t_u32 dwCtlErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwBcnErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwMgtErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwDatErrCnt;
 } mlan_ds_get_stats, *pmlan_ds_get_stats;
 
 /** Type definition of mlan_ds_uap_stats for MLAN_OID_GET_STATS */
@@ -1771,6 +1781,8 @@ typedef struct _mlan_ds_get_signal {
 typedef struct _mlan_fw_info {
 	/** Firmware version */
 	t_u32 fw_ver;
+	/** Firmware Hotfix version */
+	t_u8 hotfix_version;
 	/** MAC address */
 	mlan_802_11_mac_addr mac_addr;
 	/** 802.11n device capabilities */
@@ -2402,7 +2414,7 @@ typedef struct _sta_info_data {
 	/** ie length */
 	t_u16 ie_len;
 	/** ie buffer */
-	t_u8 ie_buf[];
+	t_u8 ie_buf[1];
 } sta_info_data;
 
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
@@ -2933,7 +2945,9 @@ typedef struct _mlan_ds_beacon_stuck_param_cfg {
 #define HOST_SLEEP_COND_IPV6_PACKET MBIT(31)
 
 /** Host sleep config conditions: Default */
-#define HOST_SLEEP_DEF_COND 0
+#define HOST_SLEEP_DEF_COND                                                    \
+	(HOST_SLEEP_COND_BROADCAST_DATA | HOST_SLEEP_COND_UNICAST_DATA |       \
+	 HOST_SLEEP_COND_MAC_EVENT)
 
 /** Host sleep config GPIO : Default */
 #define HOST_SLEEP_DEF_GPIO 0xff
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_main.h b/mxm_wifiex/wlan_src/mlan/mlan_main.h
index be2b181..e7b738c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_main.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_main.h
@@ -346,8 +346,8 @@ extern t_u32 mlan_drvdbg;
 		(x)->rx_pkt_offset = wlan_le16_to_cpu((x)->rx_pkt_offset);     \
 		(x)->rx_pkt_type = wlan_le16_to_cpu((x)->rx_pkt_type);         \
 		(x)->seq_num = wlan_le16_to_cpu((x)->seq_num);                 \
-		(x)->rx_info = wlan_le32_to_cpu((x)->rx_info);                 \
-	}
+		(x)->rx_info = wlan_le32_to_cpu((x)->rx_info);
+}
 
 #else
 /** Convert ulong n/w to host */
@@ -473,7 +473,7 @@ extern t_void (*assert_callback)(t_void *pmoal_handle, t_u32 cond);
 #define DEFAULT_BCN_MISS_TIMEOUT 10
 
 /** Maximum buffer space for beacons retrieved from scan responses */
-#define MAX_SCAN_BEACON_BUFFER 49152
+#define MAX_SCAN_BEACON_BUFFER 102400
 /** Default buffer space for beacons retrieved from scan responses */
 #define DEFAULT_SCAN_BEACON_BUFFER 4096
 
@@ -2337,6 +2337,8 @@ typedef struct _mlan_adapter {
 	t_u8 fw_ver;
 	/** firmware minor version */
 	t_u8 fw_min_ver;
+	/** firmare hotfix version */
+	t_u8 fw_hotfix_ver;
 	/** uap firmware version */
 	t_u8 uap_fw_ver;
 	/** mac address retrun from get_hw_spec */
@@ -2403,6 +2405,8 @@ typedef struct _mlan_adapter {
 	 *       FALSE - No cmd response to process
 	 */
 	t_u8 cmd_resp_received;
+	/** block download cmd to firmware */
+	t_u8 cmd_lock;
 	/** Event received:
 	 *       TRUE - Event received from fw, and yet to process
 	 *       FALSE - No events to process
@@ -2539,7 +2543,7 @@ typedef struct _mlan_adapter {
 	t_u8 scan_block;
 	/** Extended scan or legacy scan */
 	t_u8 ext_scan;
-	t_u16 bcn_buf_size;
+	t_u32 bcn_buf_size;
 	/** Beacon buffer */
 	t_u8 *bcn_buf;
 	/** Pointer to valid beacon buffer end */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_misc.c b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
index dd15214..66f7d13 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_misc.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
@@ -683,15 +683,16 @@ mlan_status wlan_misc_ioctl_mac_control(pmlan_adapter pmadapter,
 t_void wlan_wakeup_card_timeout_func(void *function_context)
 {
 	pmlan_adapter pmadapter = (pmlan_adapter)function_context;
+	mlan_private *pmpriv = wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY);
 
 	ENTER();
 
 	PRINTM(MERROR, "%s: ps_state=%d\n", __FUNCTION__, pmadapter->ps_state);
 	if (pmadapter->ps_state != PS_STATE_AWAKE) {
+		PRINTM_NETINTF(MERROR, pmpriv);
 		PRINTM(MERROR, "Wakeup card timeout!\n");
 		pmadapter->pm_wakeup_timeout++;
-		wlan_recv_event(wlan_get_priv(pmadapter, MLAN_BSS_ROLE_ANY),
-				MLAN_EVENT_ID_DRV_DBG_DUMP, MNULL);
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_DBG_DUMP, MNULL);
 	}
 	pmadapter->wakeup_fw_timer_is_set = MFALSE;
 
@@ -1741,10 +1742,8 @@ sta_node *wlan_get_station_entry(mlan_private *priv, t_u8 *mac)
 		LEAVE();
 		return MNULL;
 	}
-	sta_ptr = (sta_node *)util_peek_list(
-		priv->adapter->pmoal_handle, &priv->sta_list,
-		priv->adapter->callbacks.moal_spin_lock,
-		priv->adapter->callbacks.moal_spin_unlock);
+	sta_ptr = (sta_node *)util_peek_list(priv->adapter->pmoal_handle,
+					     &priv->sta_list, MNULL, MNULL);
 
 	while (sta_ptr && (sta_ptr != (sta_node *)&priv->sta_list)) {
 		if (!memcmp(priv->adapter, sta_ptr->mac_addr, mac,
@@ -1792,9 +1791,7 @@ sta_node *wlan_add_station_entry(mlan_private *priv, t_u8 *mac)
 	memcpy_ext(priv->adapter, sta_ptr->mac_addr, mac, MLAN_MAC_ADDR_LENGTH,
 		   MLAN_MAC_ADDR_LENGTH);
 	util_enqueue_list_tail(priv->adapter->pmoal_handle, &priv->sta_list,
-			       (pmlan_linked_list)sta_ptr,
-			       priv->adapter->callbacks.moal_spin_lock,
-			       priv->adapter->callbacks.moal_spin_unlock);
+			       (pmlan_linked_list)sta_ptr, MNULL, MNULL);
 #ifdef DRV_EMBEDDED_AUTHENTICATOR
 	if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) &&
 	    IsAuthenticatorEnabled(priv->psapriv))
@@ -1833,9 +1830,7 @@ t_void wlan_delete_station_entry(mlan_private *priv, t_u8 *mac)
 						  sta_ptr->cm_connectioninfo);
 #endif
 		util_unlink_list(priv->adapter->pmoal_handle, &priv->sta_list,
-				 (pmlan_linked_list)sta_ptr,
-				 priv->adapter->callbacks.moal_spin_lock,
-				 priv->adapter->callbacks.moal_spin_unlock);
+				 (pmlan_linked_list)sta_ptr, MNULL, MNULL);
 		priv->adapter->callbacks.moal_mfree(priv->adapter->pmoal_handle,
 						    (t_u8 *)sta_ptr);
 	}
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
index aefa40e..d7540c7 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
@@ -40,7 +40,159 @@ Change log:
 /********************************************************
 			Local Variables
 ********************************************************/
+#ifdef PCIE8897
+static const struct _mlan_pcie_card_reg mlan_reg_pcie8897 = {
+	.reg_txbd_rdptr = PCIE8897_RD_DATA_PTR_Q0_Q1,
+	.reg_txbd_wrptr = PCIE8897_WR_DATA_PTR_Q0_Q1,
+	.reg_rxbd_rdptr = PCIE8897_RD_DATA_PTR_Q0_Q1,
+	.reg_rxbd_wrptr = PCIE8897_WR_DATA_PTR_Q0_Q1,
+	.reg_evtbd_rdptr = REG_EVTBD_RDPTR,
+	.reg_evtbd_wrptr = REG_EVTBD_WRPTR,
+	.reg_host_int_mask = PCIE_HOST_INT_MASK,
+	.reg_host_int_status_mask = PCIE_HOST_INT_STATUS_MASK,
+	.reg_host_int_status = PCIE_HOST_INT_STATUS,
+	.reg_cpu_int_event = PCIE_CPU_INT_EVENT,
+	.reg_ip_rev = PCIE_IP_REV_REG,
+	.reg_drv_ready = REG_DRV_READY,
+	.reg_cpu_int_status = PCIE_CPU_INT_STATUS,
+	.reg_scratch_0 = PCIE_SCRATCH_0_REG,
+	.reg_scratch_1 = PCIE_SCRATCH_1_REG,
+	.reg_scratch_2 = PCIE_SCRATCH_2_REG,
+	.reg_scratch_3 = PCIE_SCRATCH_3_REG,
+	.host_intr_mask = HOST_INTR_MASK,
+	.host_intr_dnld_done = HOST_INTR_DNLD_DONE,
+	.host_intr_upld_rdy = HOST_INTR_UPLD_RDY,
+	.host_intr_cmd_done = HOST_INTR_CMD_DONE,
+	.host_intr_event_rdy = HOST_INTR_EVENT_RDY,
+	.txrx_rw_ptr_mask = 0x000003FF,
+	.txrx_rw_ptr_wrap_mask = 0x000007FF,
+	.txrx_rw_ptr_rollover_ind = MBIT(10),
+	.use_adma = MFALSE,
+	.msi_int_wr_clr = MTRUE,
+};
 
+static const struct _mlan_card_info mlan_card_info_pcie8897 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 0,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+};
+#endif
+
+#ifdef PCIE8997
+static const struct _mlan_pcie_card_reg mlan_reg_pcie8997 = {
+	.reg_txbd_rdptr = PCIE8997_RD_DATA_PTR_Q0_Q1,
+	.reg_txbd_wrptr = PCIE8997_WR_DATA_PTR_Q0_Q1,
+	.reg_rxbd_rdptr = PCIE8997_RD_DATA_PTR_Q0_Q1,
+	.reg_rxbd_wrptr = PCIE8997_WR_DATA_PTR_Q0_Q1,
+	.reg_evtbd_rdptr = REG_EVTBD_RDPTR,
+	.reg_evtbd_wrptr = REG_EVTBD_WRPTR,
+	.reg_host_int_mask = PCIE_HOST_INT_MASK,
+	.reg_host_int_status_mask = PCIE_HOST_INT_STATUS_MASK,
+	.reg_host_int_status = PCIE_HOST_INT_STATUS,
+	.reg_cpu_int_event = PCIE_CPU_INT_EVENT,
+	.reg_ip_rev = PCIE_IP_REV_REG,
+	.reg_drv_ready = REG_DRV_READY,
+	.reg_cpu_int_status = PCIE_CPU_INT_STATUS,
+	.reg_scratch_0 = PCIE_SCRATCH_0_REG,
+	.reg_scratch_1 = PCIE_SCRATCH_1_REG,
+	.reg_scratch_2 = PCIE_SCRATCH_2_REG,
+	.reg_scratch_3 = PCIE_SCRATCH_3_REG,
+	.host_intr_mask = HOST_INTR_MASK,
+	.host_intr_dnld_done = HOST_INTR_DNLD_DONE,
+	.host_intr_upld_rdy = HOST_INTR_UPLD_RDY,
+	.host_intr_cmd_done = HOST_INTR_CMD_DONE,
+	.host_intr_event_rdy = HOST_INTR_EVENT_RDY,
+	.txrx_rw_ptr_mask = 0x00000FFF,
+	.txrx_rw_ptr_wrap_mask = 0x00001FFF,
+	.txrx_rw_ptr_rollover_ind = MBIT(12),
+	.use_adma = MFALSE,
+	.msi_int_wr_clr = MTRUE,
+};
+
+static const struct _mlan_card_info mlan_card_info_pcie8997 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+};
+#endif
+
+#ifdef PCIE9097
+static const struct _mlan_pcie_card_reg mlan_reg_pcie9097_b0 = {
+	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
+	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
+	.reg_rxbd_rdptr = PCIE9098_RXBD_RDPTR,
+	.reg_rxbd_wrptr = PCIE9098_RXBD_WRPTR,
+	.reg_evtbd_rdptr = PCIE9098_EVTBD_RDPTR,
+	.reg_evtbd_wrptr = PCIE9098_EVTBD_WRPTR,
+	.reg_host_int_mask = PCIE9097_B0_HOST_INT_MASK,
+	.reg_host_int_status_mask = PCIE9097_B0_HOST_INT_STATUS_MASK,
+	.reg_host_int_status = PCIE9097_B0_HOST_INT_STATUS,
+	.reg_host_int_clr_sel = PCIE9097_B0_HOST_INT_CLR_SEL,
+	.reg_cpu_int_event = PCIE9098_CPU_INT_EVENT,
+	.reg_ip_rev = PCIE9098_DEV_ID_REG,
+	.reg_drv_ready = PCIE9098_DRV_READY,
+	.reg_cpu_int_status = PCIE9098_CPU_INT_STATUS,
+	.reg_rev_id = PCIE9098_REV_ID_REG,
+	.reg_scratch_0 = PCIE9098_SCRATCH_0_REG,
+	.reg_scratch_1 = PCIE9098_SCRATCH_1_REG,
+	.reg_scratch_2 = PCIE9098_SCRATCH_2_REG,
+	.reg_scratch_3 = PCIE9098_SCRATCH_3_REG,
+	.reg_scratch_6 = PCIE9098_SCRATCH_6_REG,
+	.reg_scratch_7 = PCIE9098_SCRATCH_7_REG,
+	.host_intr_mask = PCIE9098_HOST_INTR_MASK,
+	.host_intr_dnld_done = PCIE9098_HOST_INTR_DNLD_DONE,
+	.host_intr_upld_rdy = PCIE9098_HOST_INTR_UPLD_RDY,
+	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
+	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
+	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.use_adma = MTRUE,
+	.msi_int_wr_clr = MTRUE,
+};
+#endif
+
+#if defined(PCIE9098) || defined(PCIE9097)
+static const struct _mlan_pcie_card_reg mlan_reg_pcie9098 = {
+	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
+	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
+	.reg_rxbd_rdptr = PCIE9098_RXBD_RDPTR,
+	.reg_rxbd_wrptr = PCIE9098_RXBD_WRPTR,
+	.reg_evtbd_rdptr = PCIE9098_EVTBD_RDPTR,
+	.reg_evtbd_wrptr = PCIE9098_EVTBD_WRPTR,
+	.reg_host_int_mask = PCIE9098_HOST_INT_MASK,
+	.reg_host_int_status_mask = PCIE9098_HOST_INT_STATUS_MASK,
+	.reg_host_int_status = PCIE9098_HOST_INT_STATUS,
+	.reg_host_int_clr_sel = PCIE9098_HOST_INT_CLR_SEL,
+	.reg_cpu_int_event = PCIE9098_CPU_INT_EVENT,
+	.reg_ip_rev = PCIE9098_DEV_ID_REG,
+	.reg_drv_ready = PCIE9098_DRV_READY,
+	.reg_cpu_int_status = PCIE9098_CPU_INT_STATUS,
+	.reg_rev_id = PCIE9098_REV_ID_REG,
+	.reg_scratch_0 = PCIE9098_SCRATCH_0_REG,
+	.reg_scratch_1 = PCIE9098_SCRATCH_1_REG,
+	.reg_scratch_2 = PCIE9098_SCRATCH_2_REG,
+	.reg_scratch_3 = PCIE9098_SCRATCH_3_REG,
+	.reg_scratch_6 = PCIE9098_SCRATCH_6_REG,
+	.reg_scratch_7 = PCIE9098_SCRATCH_7_REG,
+	.host_intr_mask = PCIE9098_HOST_INTR_MASK,
+	.host_intr_dnld_done = PCIE9098_HOST_INTR_DNLD_DONE,
+	.host_intr_upld_rdy = PCIE9098_HOST_INTR_UPLD_RDY,
+	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
+	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
+	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.use_adma = MTRUE,
+	.msi_int_wr_clr = MTRUE,
+};
+
+static const struct _mlan_card_info mlan_card_info_pcie9098 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+};
+#endif
 /********************************************************
 			Global Variables
 ********************************************************/
@@ -2464,7 +2616,14 @@ static mlan_status wlan_pcie_process_cmd_resp(mlan_adapter *pmadapter)
 
 	pmadapter->upld_len = wlan_le16_to_cpu(resp_len);
 	pmadapter->upld_len -= PCIE_INTF_HEADER_LEN;
-
+	cmd_buf = pmadapter->pcard_pcie->cmd_buf;
+	if (cmd_buf) {
+		pcb->moal_unmap_memory(pmadapter->pmoal_handle,
+				       cmd_buf->pbuf + cmd_buf->data_offset,
+				       cmd_buf->buf_pa, WLAN_UPLD_SIZE,
+				       PCI_DMA_TODEVICE);
+		pmadapter->pcard_pcie->cmd_buf = MNULL;
+	}
 	if (!pmadapter->curr_cmd) {
 		if (pmadapter->ps_state == PS_STATE_SLEEP_CFM) {
 			wlan_process_sleep_confirm_resp(
@@ -2500,15 +2659,6 @@ static mlan_status wlan_pcie_process_cmd_resp(mlan_adapter *pmadapter)
 			mlan_delay_for_sleep_cookie(pmadapter,
 						    MAX_DELAY_LOOP_COUNT);
 #endif
-			cmd_buf = pmadapter->pcard_pcie->cmd_buf;
-			if (cmd_buf) {
-				pcb->moal_unmap_memory(
-					pmadapter->pmoal_handle,
-					cmd_buf->pbuf + cmd_buf->data_offset,
-					cmd_buf->buf_pa, WLAN_UPLD_SIZE,
-					PCI_DMA_TODEVICE);
-				pmadapter->pcard_pcie->cmd_buf = MNULL;
-			}
 		}
 		memcpy_ext(pmadapter, pmadapter->upld_buf,
 			   pmbuf->pbuf + pmbuf->data_offset +
@@ -2580,9 +2730,6 @@ static mlan_status wlan_pcie_cmdrsp_complete(mlan_adapter *pmadapter,
 					     mlan_buffer *pmbuf,
 					     mlan_status status)
 {
-	mlan_buffer *pcmdmbuf;
-	pmlan_callbacks pcb = &pmadapter->callbacks;
-
 	ENTER();
 
 	/*return the cmd response pmbuf*/
@@ -2592,18 +2739,6 @@ static mlan_status wlan_pcie_cmdrsp_complete(mlan_adapter *pmadapter,
 		pmadapter->pcard_pcie->cmdrsp_buf = pmbuf;
 	}
 
-	/*unmap the cmd pmbuf, so the cpu can not access the memory in the
-	 * command node*/
-	pcmdmbuf = pmadapter->pcard_pcie->cmd_buf;
-
-	if (pcmdmbuf) {
-		pcb->moal_unmap_memory(pmadapter->pmoal_handle,
-				       pcmdmbuf->pbuf + pcmdmbuf->data_offset,
-				       pcmdmbuf->buf_pa, WLAN_UPLD_SIZE,
-				       PCI_DMA_TODEVICE);
-		pmadapter->pcard_pcie->cmd_buf = MNULL;
-	}
-
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
@@ -3437,13 +3572,15 @@ static mlan_status wlan_pcie_interrupt(t_u16 msg_id, pmlan_adapter pmadapter)
 			    pmoal_handle,
 			    pmadapter->pcard_pcie->reg->reg_host_int_status,
 			    &pcie_ireg)) {
-			PRINTM(MWARN, "Read register failed\n");
+			PRINTM(MERROR, "Read func%d register failed\n",
+			       pmadapter->pcard_pcie->func_num);
 			LEAVE();
 			return MLAN_STATUS_FAILURE;
 		}
 
 		if ((pcie_ireg != 0xFFFFFFFF) && (pcie_ireg)) {
-			PRINTM(MINTR, "pcie_ireg=0x%x\n", pcie_ireg);
+			PRINTM(MINTR, "func%d: pcie_ireg=0x%x\n",
+			       pmadapter->pcard_pcie->func_num, pcie_ireg);
 			if (!pmadapter->pps_uapsd_mode &&
 			    (pmadapter->ps_state == PS_STATE_SLEEP)) {
 				/* Potentially for PCIe we could get other
@@ -3573,20 +3710,22 @@ static mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
 			    pmadapter->pmoal_handle,
 			    pmadapter->pcard_pcie->reg->reg_host_int_status,
 			    &pcie_ireg)) {
-			PRINTM(MWARN, "Read register failed\n");
+			PRINTM(MERROR, "Read func%d register failed\n",
+			       pmadapter->pcard_pcie->func_num);
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
 
 		if ((pcie_ireg != 0xFFFFFFFF) && (pcie_ireg)) {
-			PRINTM(MINTR, "pcie_ireg=0x%x\n", pcie_ireg);
+			PRINTM(MINTR, "func%d: pcie_ireg=0x%x\n",
+			       pmadapter->pcard_pcie->func_num, pcie_ireg);
 			if (pmadapter->pcard_pcie->reg->msi_int_wr_clr) {
 				if (pcb->moal_write_reg(
 					    pmadapter->pmoal_handle,
 					    pmadapter->pcard_pcie->reg
 						    ->reg_host_int_status,
 					    ~pcie_ireg)) {
-					PRINTM(MWARN,
+					PRINTM(MERROR,
 					       "Write register failed\n");
 					ret = MLAN_STATUS_FAILURE;
 					goto done;
@@ -3671,13 +3810,15 @@ static mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
 			    pmadapter->pmoal_handle,
 			    pmadapter->pcard_pcie->reg->reg_host_int_status,
 			    &pcie_ireg)) {
-			PRINTM(MWARN, "Read register failed\n");
+			PRINTM(MERROR, "Read func%d register failed\n",
+			       pmadapter->pcard_pcie->func_num);
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
 
 		if ((pcie_ireg != 0xFFFFFFFF) && (pcie_ireg)) {
-			PRINTM(MINTR, "Poll: pcie_ireg=0x%x\n", pcie_ireg);
+			PRINTM(MINTR, "func%d: Poll pcie_ireg=0x%x\n",
+			       pmadapter->pcard_pcie->func_num, pcie_ireg);
 			if ((pmadapter->pcard_pcie->pcie_int_mode ==
 			     PCIE_INT_MODE_LEGACY) ||
 			    pmadapter->pcard_pcie->reg->msi_int_wr_clr) {
@@ -4287,7 +4428,8 @@ static mlan_status wlan_pm_pcie_wakeup_card(pmlan_adapter pmadapter,
 	t_u32 age_ts_usec;
 
 	ENTER();
-	PRINTM(MEVENT, "Wakeup device...\n");
+	PRINTM(MEVENT, "func%d: Wakeup device...\n",
+	       pmadapter->pcard_pcie->func_num);
 	pmadapter->callbacks.moal_get_system_time(pmadapter->pmoal_handle,
 						  &pmadapter->pm_wakeup_in_secs,
 						  &age_ts_usec);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_pcie.h b/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
index f912e70..18915d4 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
@@ -458,160 +458,6 @@ Change log:
 /** Max interrupt status register read limit */
 #define MAX_READ_REG_RETRY 10000
 
-#ifdef PCIE8897
-static const struct _mlan_pcie_card_reg mlan_reg_pcie8897 = {
-	.reg_txbd_rdptr = PCIE8897_RD_DATA_PTR_Q0_Q1,
-	.reg_txbd_wrptr = PCIE8897_WR_DATA_PTR_Q0_Q1,
-	.reg_rxbd_rdptr = PCIE8897_RD_DATA_PTR_Q0_Q1,
-	.reg_rxbd_wrptr = PCIE8897_WR_DATA_PTR_Q0_Q1,
-	.reg_evtbd_rdptr = REG_EVTBD_RDPTR,
-	.reg_evtbd_wrptr = REG_EVTBD_WRPTR,
-	.reg_host_int_mask = PCIE_HOST_INT_MASK,
-	.reg_host_int_status_mask = PCIE_HOST_INT_STATUS_MASK,
-	.reg_host_int_status = PCIE_HOST_INT_STATUS,
-	.reg_cpu_int_event = PCIE_CPU_INT_EVENT,
-	.reg_ip_rev = PCIE_IP_REV_REG,
-	.reg_drv_ready = REG_DRV_READY,
-	.reg_cpu_int_status = PCIE_CPU_INT_STATUS,
-	.reg_scratch_0 = PCIE_SCRATCH_0_REG,
-	.reg_scratch_1 = PCIE_SCRATCH_1_REG,
-	.reg_scratch_2 = PCIE_SCRATCH_2_REG,
-	.reg_scratch_3 = PCIE_SCRATCH_3_REG,
-	.host_intr_mask = HOST_INTR_MASK,
-	.host_intr_dnld_done = HOST_INTR_DNLD_DONE,
-	.host_intr_upld_rdy = HOST_INTR_UPLD_RDY,
-	.host_intr_cmd_done = HOST_INTR_CMD_DONE,
-	.host_intr_event_rdy = HOST_INTR_EVENT_RDY,
-	.txrx_rw_ptr_mask = 0x000003FF,
-	.txrx_rw_ptr_wrap_mask = 0x000007FF,
-	.txrx_rw_ptr_rollover_ind = MBIT(10),
-	.use_adma = MFALSE,
-	.msi_int_wr_clr = MTRUE,
-};
-
-static const struct _mlan_card_info mlan_card_info_pcie8897 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 0,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
-};
-#endif
-
-#ifdef PCIE8997
-static const struct _mlan_pcie_card_reg mlan_reg_pcie8997 = {
-	.reg_txbd_rdptr = PCIE8997_RD_DATA_PTR_Q0_Q1,
-	.reg_txbd_wrptr = PCIE8997_WR_DATA_PTR_Q0_Q1,
-	.reg_rxbd_rdptr = PCIE8997_RD_DATA_PTR_Q0_Q1,
-	.reg_rxbd_wrptr = PCIE8997_WR_DATA_PTR_Q0_Q1,
-	.reg_evtbd_rdptr = REG_EVTBD_RDPTR,
-	.reg_evtbd_wrptr = REG_EVTBD_WRPTR,
-	.reg_host_int_mask = PCIE_HOST_INT_MASK,
-	.reg_host_int_status_mask = PCIE_HOST_INT_STATUS_MASK,
-	.reg_host_int_status = PCIE_HOST_INT_STATUS,
-	.reg_cpu_int_event = PCIE_CPU_INT_EVENT,
-	.reg_ip_rev = PCIE_IP_REV_REG,
-	.reg_drv_ready = REG_DRV_READY,
-	.reg_cpu_int_status = PCIE_CPU_INT_STATUS,
-	.reg_scratch_0 = PCIE_SCRATCH_0_REG,
-	.reg_scratch_1 = PCIE_SCRATCH_1_REG,
-	.reg_scratch_2 = PCIE_SCRATCH_2_REG,
-	.reg_scratch_3 = PCIE_SCRATCH_3_REG,
-	.host_intr_mask = HOST_INTR_MASK,
-	.host_intr_dnld_done = HOST_INTR_DNLD_DONE,
-	.host_intr_upld_rdy = HOST_INTR_UPLD_RDY,
-	.host_intr_cmd_done = HOST_INTR_CMD_DONE,
-	.host_intr_event_rdy = HOST_INTR_EVENT_RDY,
-	.txrx_rw_ptr_mask = 0x00000FFF,
-	.txrx_rw_ptr_wrap_mask = 0x00001FFF,
-	.txrx_rw_ptr_rollover_ind = MBIT(12),
-	.use_adma = MFALSE,
-	.msi_int_wr_clr = MTRUE,
-};
-
-static const struct _mlan_card_info mlan_card_info_pcie8997 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
-};
-#endif
-
-#if defined(PCIE9098) || defined(PCIE9097)
-static const struct _mlan_pcie_card_reg mlan_reg_pcie9098 = {
-	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
-	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
-	.reg_rxbd_rdptr = PCIE9098_RXBD_RDPTR,
-	.reg_rxbd_wrptr = PCIE9098_RXBD_WRPTR,
-	.reg_evtbd_rdptr = PCIE9098_EVTBD_RDPTR,
-	.reg_evtbd_wrptr = PCIE9098_EVTBD_WRPTR,
-	.reg_host_int_mask = PCIE9098_HOST_INT_MASK,
-	.reg_host_int_status_mask = PCIE9098_HOST_INT_STATUS_MASK,
-	.reg_host_int_status = PCIE9098_HOST_INT_STATUS,
-	.reg_host_int_clr_sel = PCIE9098_HOST_INT_CLR_SEL,
-	.reg_cpu_int_event = PCIE9098_CPU_INT_EVENT,
-	.reg_ip_rev = PCIE9098_DEV_ID_REG,
-	.reg_drv_ready = PCIE9098_DRV_READY,
-	.reg_cpu_int_status = PCIE9098_CPU_INT_STATUS,
-	.reg_rev_id = PCIE9098_REV_ID_REG,
-	.reg_scratch_0 = PCIE9098_SCRATCH_0_REG,
-	.reg_scratch_1 = PCIE9098_SCRATCH_1_REG,
-	.reg_scratch_2 = PCIE9098_SCRATCH_2_REG,
-	.reg_scratch_3 = PCIE9098_SCRATCH_3_REG,
-	.reg_scratch_6 = PCIE9098_SCRATCH_6_REG,
-	.reg_scratch_7 = PCIE9098_SCRATCH_7_REG,
-	.host_intr_mask = PCIE9098_HOST_INTR_MASK,
-	.host_intr_dnld_done = PCIE9098_HOST_INTR_DNLD_DONE,
-	.host_intr_upld_rdy = PCIE9098_HOST_INTR_UPLD_RDY,
-	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
-	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
-	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
-	.use_adma = MTRUE,
-	.msi_int_wr_clr = MTRUE,
-};
-
-static const struct _mlan_card_info mlan_card_info_pcie9098 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 1,
-	.v17_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
-};
-#endif
-
-#ifdef PCIE9097
-static const struct _mlan_pcie_card_reg mlan_reg_pcie9097_b0 = {
-	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
-	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
-	.reg_rxbd_rdptr = PCIE9098_RXBD_RDPTR,
-	.reg_rxbd_wrptr = PCIE9098_RXBD_WRPTR,
-	.reg_evtbd_rdptr = PCIE9098_EVTBD_RDPTR,
-	.reg_evtbd_wrptr = PCIE9098_EVTBD_WRPTR,
-	.reg_host_int_mask = PCIE9097_B0_HOST_INT_MASK,
-	.reg_host_int_status_mask = PCIE9097_B0_HOST_INT_STATUS_MASK,
-	.reg_host_int_status = PCIE9097_B0_HOST_INT_STATUS,
-	.reg_host_int_clr_sel = PCIE9097_B0_HOST_INT_CLR_SEL,
-	.reg_cpu_int_event = PCIE9098_CPU_INT_EVENT,
-	.reg_ip_rev = PCIE9098_DEV_ID_REG,
-	.reg_drv_ready = PCIE9098_DRV_READY,
-	.reg_cpu_int_status = PCIE9098_CPU_INT_STATUS,
-	.reg_rev_id = PCIE9098_REV_ID_REG,
-	.reg_scratch_0 = PCIE9098_SCRATCH_0_REG,
-	.reg_scratch_1 = PCIE9098_SCRATCH_1_REG,
-	.reg_scratch_2 = PCIE9098_SCRATCH_2_REG,
-	.reg_scratch_3 = PCIE9098_SCRATCH_3_REG,
-	.reg_scratch_6 = PCIE9098_SCRATCH_6_REG,
-	.reg_scratch_7 = PCIE9098_SCRATCH_7_REG,
-	.host_intr_mask = PCIE9098_HOST_INTR_MASK,
-	.host_intr_dnld_done = PCIE9098_HOST_INTR_DNLD_DONE,
-	.host_intr_upld_rdy = PCIE9098_HOST_INTR_UPLD_RDY,
-	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
-	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
-	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
-	.use_adma = MTRUE,
-	.msi_int_wr_clr = MTRUE,
-};
-#endif
-
 extern mlan_adapter_operations mlan_pcie_ops;
 
 /* Get pcie device from card type */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_scan.c b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
index 4da9ff5..cce5986 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_scan.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
@@ -496,6 +496,10 @@ static t_void wlan_scan_create_channel_list(
 			if (radio_type && (pscan_region->band != BAND_A))
 				continue;
 		}
+		PRINTM(MCMD_D,
+		       "create_channel_list: region=%d band=%d num_cfp=%d\n",
+		       pscan_region->region, pscan_region->band,
+		       pscan_region->num_cfp);
 		if ((puser_scan_in &&
 		     (puser_scan_in->bss_mode == MLAN_SCAN_MODE_IBSS)) ||
 		    pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
@@ -586,7 +590,7 @@ static t_void wlan_scan_create_channel_list(
 
 			pscan_chan_list[chan_idx].chan_number =
 				(t_u8)cfp->channel;
-			PRINTM(MINFO,
+			PRINTM(MCMD_D,
 			       "chan=%d, mode=%d, passive_to_active=%d\n",
 			       pscan_chan_list[chan_idx].chan_number,
 			       pscan_chan_list[chan_idx]
@@ -737,6 +741,8 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 				    radio_type_to_band(
 					    ptmp_chan_list->bandcfg.chanBand),
 				    ptmp_chan_list->chan_number)) {
+				PRINTM(MCMND, "Block scan chan = %d\n",
+				       ptmp_chan_list->chan_number);
 				ptmp_chan_list++;
 				continue;
 			}
@@ -747,7 +753,7 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 				first_chan = 0;
 			}
 
-			PRINTM(MINFO,
+			PRINTM(MCMD_D,
 			       "Scan: Chan(%3d), bandcfg(%x), Mode(%d,%d), Dur(%d)\n",
 			       ptmp_chan_list->chan_number,
 			       ptmp_chan_list->bandcfg,
@@ -2439,7 +2445,7 @@ static t_void wlan_ret_802_11_scan_store_beacon(mlan_private *pmpriv,
 	t_u32 adj_idx;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u8 *tmp_buf;
-	t_u16 bcn_size = 0;
+	t_u32 bcn_size = 0;
 	t_u32 bcn_offset = 0;
 
 	ENTER();
@@ -2714,11 +2720,19 @@ static t_void wlan_ret_802_11_scan_store_beacon(mlan_private *pmpriv,
 		     (pmadapter->bcn_buf + pmadapter->bcn_buf_size)) &&
 		    (pmadapter->bcn_buf_size < MAX_SCAN_BEACON_BUFFER)) {
 			/* no space for this entry, realloc bcn buffer */
-			ret = pmadapter->callbacks.moal_malloc(
-				pmadapter->pmoal_handle,
-				pmadapter->bcn_buf_size +
-					DEFAULT_SCAN_BEACON_BUFFER,
-				MLAN_MEM_DEF, (t_u8 **)&tmp_buf);
+			if (pmadapter->callbacks.moal_vmalloc &&
+			    pmadapter->callbacks.moal_vfree)
+				ret = pmadapter->callbacks.moal_vmalloc(
+					pmadapter->pmoal_handle,
+					pmadapter->bcn_buf_size +
+						DEFAULT_SCAN_BEACON_BUFFER,
+					(t_u8 **)&tmp_buf);
+			else
+				ret = pmadapter->callbacks.moal_malloc(
+					pmadapter->pmoal_handle,
+					pmadapter->bcn_buf_size +
+						DEFAULT_SCAN_BEACON_BUFFER,
+					MLAN_MEM_DEF, (t_u8 **)&tmp_buf);
 
 			if ((ret == MLAN_STATUS_SUCCESS) && (tmp_buf)) {
 				PRINTM(MCMND,
@@ -2747,9 +2761,15 @@ static t_void wlan_ret_802_11_scan_store_beacon(mlan_private *pmpriv,
 						&pmadapter->pscan_table[adj_idx]);
 				}
 				pmadapter->pbcn_buf_end = tmp_buf + bcn_size;
-				pmadapter->callbacks.moal_mfree(
-					pmadapter->pmoal_handle,
-					(t_u8 *)pmadapter->bcn_buf);
+				if (pmadapter->callbacks.moal_vmalloc &&
+				    pmadapter->callbacks.moal_vfree)
+					pmadapter->callbacks.moal_vfree(
+						pmadapter->pmoal_handle,
+						(t_u8 *)pmadapter->bcn_buf);
+				else
+					pmadapter->callbacks.moal_mfree(
+						pmadapter->pmoal_handle,
+						(t_u8 *)pmadapter->bcn_buf);
 				pmadapter->bcn_buf = tmp_buf;
 				pmadapter->bcn_buf_size +=
 					DEFAULT_SCAN_BEACON_BUFFER;
@@ -3557,6 +3577,44 @@ static t_void wlan_scan_delete_table_entry(mlan_private *pmpriv,
 	LEAVE();
 }
 
+/**
+ *  @brief Delete all entry's age out
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *
+ *  @return             N/A
+ */
+static void wlan_scan_delete_ageout_entry(mlan_private *pmpriv)
+{
+	BSSDescriptor_t *pbss_entry;
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	t_s32 table_idx = pmadapter->num_in_scan_table - 1;
+	t_u32 i = 0;
+	t_u32 age_in_secs = 0;
+	t_u32 age_ts_usec = 0;
+
+	ENTER();
+#define SCAN_RESULT_AGEOUT 10
+	pmadapter->callbacks.moal_get_system_time(pmadapter->pmoal_handle,
+						  &age_in_secs, &age_ts_usec);
+
+	for (i = 0; i < pmadapter->num_in_scan_table; i++) {
+		pbss_entry = &pmadapter->pscan_table[table_idx];
+		if (age_in_secs >
+		    (pbss_entry->age_in_secs + SCAN_RESULT_AGEOUT)) {
+			PRINTM(MCMND,
+			       "SCAN: ageout AP MAC Addr-" MACSTR
+			       " ssid: %-32s\n",
+			       MAC2STR(pbss_entry->mac_address),
+			       pbss_entry->ssid.ssid);
+			wlan_scan_delete_table_entry(pmpriv, table_idx);
+		}
+		table_idx--;
+	}
+	LEAVE();
+	return;
+}
+
 /**
  *  @brief Delete all occurrences of a given SSID from the scan table
  *
@@ -4089,6 +4147,8 @@ mlan_status wlan_scan_networks(mlan_private *pmpriv, t_void *pioctl_buf,
 		       sizeof(BSSDescriptor_t) * MRVDRV_MAX_BSSID_LIST);
 		pmadapter->num_in_scan_table = 0;
 		pmadapter->pbcn_buf_end = pmadapter->bcn_buf;
+	} else {
+		wlan_scan_delete_ageout_entry(pmpriv);
 	}
 	for (i = 0; i < pmadapter->num_in_chan_stats; i++)
 		pmadapter->pchan_stats[i].cca_scan_duration = 0;
@@ -4416,6 +4476,10 @@ mlan_status wlan_ret_802_11_scan(mlan_private *pmpriv, HostCmd_DS_COMMAND *resp,
 	PRINTM(MINFO, "SCAN_RESP: returned %d APs before parsing\n",
 	       pscan_rsp->number_of_sets);
 
+	/* Update the age_in_second */
+	pmadapter->callbacks.moal_get_system_time(
+		pmadapter->pmoal_handle, &pmadapter->age_in_secs, &age_ts_usec);
+
 	num_in_table = pmadapter->num_in_scan_table;
 	pbss_info = pscan_rsp->bss_desc_and_tlv_buffer;
 
@@ -4499,7 +4563,7 @@ mlan_status wlan_ret_802_11_scan(mlan_private *pmpriv, HostCmd_DS_COMMAND *resp,
 			 * for use in join
 			 */
 			bss_new_entry->bss_band = band;
-
+			bss_new_entry->age_in_secs = pmadapter->age_in_secs;
 			cfp = wlan_find_cfp_by_band_and_channel(
 				pmadapter, (t_u8)bss_new_entry->bss_band,
 				(t_u16)bss_new_entry->channel);
@@ -4645,9 +4709,6 @@ mlan_status wlan_ret_802_11_scan(mlan_private *pmpriv, HostCmd_DS_COMMAND *resp,
 
 	/* Update the total number of BSSIDs in the scan table */
 	pmadapter->num_in_scan_table = num_in_table;
-	/* Update the age_in_second */
-	pmadapter->callbacks.moal_get_system_time(
-		pmadapter->pmoal_handle, &pmadapter->age_in_secs, &age_ts_usec);
 	if (is_bgscan_resp)
 		goto done;
 	wlan_request_cmd_lock(pmadapter);
@@ -4771,6 +4832,7 @@ mlan_status wlan_cmd_802_11_scan_ext(mlan_private *pmpriv,
 				(t_u16)(sizeof(pext_scan_cmd->reserved)) +
 				S_DS_GEN));
 			pext_scan_cmd->ext_scan_type = EXT_SCAN_CANCEL;
+			pmpriv->adapter->cmd_lock = MFALSE;
 			LEAVE();
 			return MLAN_STATUS_SUCCESS;
 		}
@@ -4840,6 +4902,7 @@ mlan_status wlan_ret_802_11_scan_ext(mlan_private *pmpriv,
 		LEAVE();
 		return MLAN_STATUS_SUCCESS;
 	} else if (ext_scan_type == EXT_SCAN_ENHANCE) {
+		pmpriv->adapter->cmd_lock = MTRUE;
 		/* Setup the timer after scan command response */
 		pcb->moal_start_timer(pmpriv->adapter->pmoal_handle,
 				      pmpriv->adapter->pmlan_cmd_timer, MFALSE,
@@ -4989,16 +5052,18 @@ done:
  *
  *  @return                MLAN_STATUS_FAILURE/MLAN_STATUS_SUCCESS
  */
-static mlan_status wlan_update_ssid_in_beacon_buf(mlan_adapter *pmadapter,
-						  BSSDescriptor_t *pbss_entry,
-						  BSSDescriptor_t *pnew_entry,
-						  IEEEtypes_Ssid_t *pssid)
+static mlan_status wlan_update_ssid_in_beacon_buf(
+	mlan_adapter *pmadapter, BSSDescriptor_t *pbss_entry,
+	BSSDescriptor_t *pnew_entry, IEEEtypes_Ssid_t *pssid,
+	IEEEtypes_ExtCap_t *pnew_extcap, IEEEtypes_Generic_t *pnew_rsnx)
 {
 	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
 	t_u8 *pbeacon_buf = MNULL;
 	t_u32 beacon_buf_size = 0;
 	t_s8 offset = pnew_entry->ssid.ssid_len - pbss_entry->ssid.ssid_len;
+	IEEEtypes_ExtCap_t *pextcap;
 	mlan_status ret = MLAN_STATUS_FAILURE;
+	t_u32 rsnx_offset = 0;
 
 	if (pnew_entry->ssid.ssid_len >= pbss_entry->ssid.ssid_len)
 		beacon_buf_size =
@@ -5009,6 +5074,11 @@ static mlan_status wlan_update_ssid_in_beacon_buf(mlan_adapter *pmadapter,
 			pbss_entry->beacon_buf_size -
 			(pbss_entry->ssid.ssid_len - pnew_entry->ssid.ssid_len);
 
+	rsnx_offset = beacon_buf_size;
+	if (pnew_rsnx)
+		beacon_buf_size +=
+			pnew_rsnx->ieee_hdr.len + sizeof(IEEEtypes_Header_t);
+
 	ret = pcb->moal_malloc(pmadapter->pmoal_handle, beacon_buf_size,
 			       MLAN_MEM_DEF, (t_u8 **)&pbeacon_buf);
 	if (ret != MLAN_STATUS_SUCCESS || !pbeacon_buf) {
@@ -5057,8 +5127,21 @@ static mlan_status wlan_update_ssid_in_beacon_buf(mlan_adapter *pmadapter,
 		pnew_entry->ht_info_offset += offset;
 	if (pnew_entry->pbss_co_2040)
 		pnew_entry->bss_co_2040_offset += offset;
-	if (pnew_entry->pext_cap)
+	if (pnew_entry->pext_cap) {
 		pnew_entry->ext_cap_offset += offset;
+		if (pnew_extcap) {
+			pextcap = (IEEEtypes_ExtCap_t
+					   *)(pnew_entry->pbeacon_buf +
+					      pnew_entry->ext_cap_offset);
+			memcpy_ext(pmadapter,
+				   pbeacon_buf + pnew_entry->ext_cap_offset,
+				   (t_u8 *)pnew_extcap,
+				   pnew_extcap->ieee_hdr.len +
+					   sizeof(IEEEtypes_Header_t),
+				   pextcap->ieee_hdr.len +
+					   sizeof(IEEEtypes_Header_t));
+		}
+	}
 	if (pnew_entry->poverlap_bss_scan_param)
 		pnew_entry->overlap_bss_offset += offset;
 	if (pnew_entry->pvht_cap)
@@ -5079,6 +5162,12 @@ static mlan_status wlan_update_ssid_in_beacon_buf(mlan_adapter *pmadapter,
 		pnew_entry->he_cap_offset += offset;
 	if (pnew_entry->phe_oprat)
 		pnew_entry->he_oprat_offset += offset;
+	if (pnew_rsnx)
+		memcpy_ext(
+			pmadapter, pbeacon_buf + rsnx_offset, (t_u8 *)pnew_rsnx,
+			pnew_rsnx->ieee_hdr.len + sizeof(IEEEtypes_Header_t),
+			pnew_rsnx->ieee_hdr.len + sizeof(IEEEtypes_Header_t));
+	DBG_HEXDUMP(MCMD_D, "MBSSID beacon buf", pbeacon_buf, beacon_buf_size);
 	ret = MLAN_STATUS_SUCCESS;
 done:
 	return ret;
@@ -5097,14 +5186,25 @@ done:
 static void wlan_gen_multi_bssid_by_bssid_index(pmlan_adapter pmadapter,
 						BSSDescriptor_t *pbss_entry,
 						BSSDescriptor_t *pnew_entry,
-						t_u8 bssid_index)
+						t_u8 bssid_index,
+						t_u8 max_bssid_indicator)
 {
 	t_u8 mask = 0xff;
 	t_u8 new_bssid[6];
+	t_u8 bssid_a;
+	t_u8 src_bssid[6];
+
+	memcpy_ext(pmadapter, (t_u8 *)src_bssid, pbss_entry->mac_address,
+		   sizeof(mlan_802_11_mac_addr), sizeof(src_bssid));
 	memcpy_ext(pmadapter, (t_u8 *)new_bssid,
 		   (t_u8 *)&pbss_entry->mac_address,
 		   sizeof(mlan_802_11_mac_addr), sizeof(new_bssid));
-	new_bssid[5] = (new_bssid[5] + bssid_index) & mask;
+
+	mask = (mask >> (8 - max_bssid_indicator));
+	bssid_a = src_bssid[5] & (~mask);
+	src_bssid[5] = (src_bssid[5] + bssid_index) & mask;
+	new_bssid[5] = bssid_a | src_bssid[5];
+
 	memcpy_ext(pmadapter, (t_u8 *)&pnew_entry->mac_address, new_bssid,
 		   sizeof(new_bssid), sizeof(mlan_802_11_mac_addr));
 	memcpy_ext(pmadapter, (t_u8 *)&pnew_entry->multi_bssid_ap_addr,
@@ -5121,12 +5221,14 @@ static void wlan_gen_multi_bssid_by_bssid_index(pmlan_adapter pmadapter,
  *  @param pbss_profile     A pointer to IEEEtypes_NonTransBSSIDprofile_t
  *  @param num_in_table     A pointer to buffer to save num of entry in scan
  * table.
+ *  @param  max_bssid_indicator max bssid indicator
  *
  *  @return                 N/A
  */
 static t_void wlan_parse_non_trans_bssid_profile(
 	mlan_private *pmpriv, BSSDescriptor_t *pbss_entry,
-	IEEEtypes_NonTransBSSIDProfile_t *pbss_profile, t_u32 *num_in_table)
+	IEEEtypes_NonTransBSSIDProfile_t *pbss_profile, t_u32 *num_in_table,
+	t_u8 max_bssid_indicator)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	IEEEtypes_Header_t *pheader =
@@ -5141,6 +5243,8 @@ static t_void wlan_parse_non_trans_bssid_profile(
 	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
 	BSSDescriptor_t *bss_new_entry = MNULL;
 	t_u8 *pbeacon_buf = MNULL;
+	IEEEtypes_ExtCap_t *pextcap = MNULL;
+	IEEEtypes_Generic_t *prsnx = MNULL;
 
 	ENTER();
 
@@ -5176,6 +5280,18 @@ static t_void wlan_parse_non_trans_bssid_profile(
 			       pbssid_index->bssid_index);
 			ret = MTRUE;
 			break;
+		case EXT_CAPABILITY:
+			pextcap = (IEEEtypes_ExtCap_t *)pos;
+			DBG_HEXDUMP(MCMD_D, "MBSSID extcap", pos,
+				    pextcap->ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		case RSNX_IE:
+			prsnx = (IEEEtypes_Generic_t *)pos;
+			DBG_HEXDUMP(MCMD_D, "MBSSID RSNX", pos,
+				    prsnx->ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
 		case SSID:
 			pssid = (IEEEtypes_Ssid_t *)pos;
 			PRINTM(MCMND, "MBSSID: Find mbssid ssid=%s\n",
@@ -5200,7 +5316,8 @@ static t_void wlan_parse_non_trans_bssid_profile(
 			   sizeof(BSSDescriptor_t), sizeof(BSSDescriptor_t));
 		wlan_gen_multi_bssid_by_bssid_index(pmadapter, pbss_entry,
 						    bss_new_entry,
-						    pbssid_index->bssid_index);
+						    pbssid_index->bssid_index,
+						    max_bssid_indicator);
 		if (pssid) {
 			memset(pmadapter, (t_u8 *)&bss_new_entry->ssid, 0,
 			       sizeof(mlan_802_11_ssid));
@@ -5210,8 +5327,8 @@ static t_void wlan_parse_non_trans_bssid_profile(
 				   MLAN_MAX_SSID_LENGTH);
 			if (MLAN_STATUS_SUCCESS !=
 			    wlan_update_ssid_in_beacon_buf(
-				    pmadapter, pbss_entry, bss_new_entry,
-				    pssid)) {
+				    pmadapter, pbss_entry, bss_new_entry, pssid,
+				    pextcap, prsnx)) {
 				PRINTM(MERROR,
 				       "Fail to update MBSSID beacon buf\n");
 				pcb->moal_mfree(pmadapter->pmoal_handle,
@@ -5273,7 +5390,8 @@ static t_void wlan_parse_multi_bssid_ie(mlan_private *pmpriv,
 			break;
 		}
 		wlan_parse_non_trans_bssid_profile(
-			pmpriv, pbss_entry, pbssid_profile, num_in_table);
+			pmpriv, pbss_entry, pbssid_profile, num_in_table,
+			pmulti_bssid->max_bssid_indicator);
 		pcurrent_ptr += pbssid_profile->ieee_hdr.len + 2;
 		bytes_left -= pbssid_profile->ieee_hdr.len + 2;
 	}
@@ -5378,6 +5496,9 @@ static mlan_status wlan_parse_ext_scan_result(mlan_private *pmpriv,
 	PRINTM(MINFO, "EXT_SCAN: bss_descript_size %d\n", scan_resp_size);
 	PRINTM(MINFO, "EXT_SCAN: returned %d APs before parsing\n",
 	       number_of_sets);
+	/* Update the age_in_second */
+	pmadapter->callbacks.moal_get_system_time(
+		pmadapter->pmoal_handle, &pmadapter->age_in_secs, &age_ts_usec);
 
 	num_in_table = pmadapter->num_in_scan_table;
 	ptlv = (MrvlIEtypes_Data_t *)pscan_resp;
@@ -5511,6 +5632,7 @@ static mlan_status wlan_parse_ext_scan_result(mlan_private *pmpriv,
 			/* Save the band designation for this entry for use in
 			 * join */
 			bss_new_entry->bss_band = band;
+			bss_new_entry->age_in_secs = pmadapter->age_in_secs;
 
 			cfp = wlan_find_cfp_by_band_and_channel(
 				pmadapter, (t_u8)bss_new_entry->bss_band,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
index 751a109..f0dab5e 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
@@ -40,6 +40,310 @@ Change log:
 /********************************************************
 		Local Variables
 ********************************************************/
+#ifdef SD8887
+static const struct _mlan_sdio_card_reg mlan_reg_sd8887 = {
+	.start_rd_port = 0,
+	.start_wr_port = 0,
+	.base_0_reg = 0x6C,
+	.base_1_reg = 0x6D,
+	.poll_reg = 0x5C,
+	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |
+			   CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,
+	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS |
+			   DN_LD_CMD_PORT_HOST_INT_STATUS |
+			   UP_LD_CMD_PORT_HOST_INT_STATUS,
+	.status_reg_0 = 0x90,
+	.status_reg_1 = 0x91,
+	.sdio_int_mask = 0xff,
+	.data_port_mask = 0xffffffff,
+	.max_mp_regs = 196,
+	.rd_bitmap_l = 0x10,
+	.rd_bitmap_u = 0x11,
+	.rd_bitmap_1l = 0x12,
+	.rd_bitmap_1u = 0x13,
+	.wr_bitmap_l = 0x14,
+	.wr_bitmap_u = 0x15,
+	.wr_bitmap_1l = 0x16,
+	.wr_bitmap_1u = 0x17,
+	.rd_len_p0_l = 0x18,
+	.rd_len_p0_u = 0x19,
+	.card_config_2_1_reg = 0xD9,
+	.cmd_config_0 = 0xC4,
+	.cmd_config_1 = 0xC5,
+	.cmd_config_2 = 0xC6,
+	.cmd_config_3 = 0xC7,
+	.cmd_rd_len_0 = 0xC0,
+	.cmd_rd_len_1 = 0xC1,
+	.cmd_rd_len_2 = 0xC2,
+	.cmd_rd_len_3 = 0xC3,
+	.io_port_0_reg = 0xE4,
+	.io_port_1_reg = 0xE5,
+	.io_port_2_reg = 0xE6,
+	.host_int_rsr_reg = 0x04,
+	.host_int_mask_reg = 0x08,
+	.host_int_status_reg = 0x0C,
+	.host_restart_reg = 0x58,
+	.card_to_host_event_reg = 0x5C,
+	.host_interrupt_mask_reg = 0x60,
+	.card_interrupt_status_reg = 0x64,
+	.card_interrupt_rsr_reg = 0x68,
+	.card_revision_reg = 0xC8,
+	.card_ocr_0_reg = 0xD4,
+	.card_ocr_1_reg = 0xD5,
+	.card_ocr_3_reg = 0xD6,
+	.card_config_reg = 0xD7,
+	.card_misc_cfg_reg = 0xD8,
+	.debug_0_reg = 0xDC,
+	.debug_1_reg = 0xDD,
+	.debug_2_reg = 0xDE,
+	.debug_3_reg = 0xDF,
+	.fw_reset_reg = 0x0B6,
+	.fw_reset_val = 1,
+	.winner_check_reg = 0x90,
+};
+
+static const struct _mlan_card_info mlan_card_info_sd8887 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
+	.v16_fw_api = 0,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+};
+#endif
+
+#ifdef SD8801
+static const struct _mlan_sdio_card_reg mlan_reg_sd8801 = {
+	.start_rd_port = 1,
+	.start_wr_port = 1,
+	.base_0_reg = 0x40,
+	.base_1_reg = 0x41,
+	.poll_reg = 0x30,
+	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK,
+	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS,
+	.status_reg_0 = 0x60,
+	.status_reg_1 = 0x61,
+	.sdio_int_mask = 0x3f,
+	.data_port_mask = 0x0000fffe,
+	.max_mp_regs = 64,
+	.rd_bitmap_l = 0x4,
+	.rd_bitmap_u = 0x5,
+	.wr_bitmap_l = 0x6,
+	.wr_bitmap_u = 0x7,
+	.rd_len_p0_l = 0x8,
+	.rd_len_p0_u = 0x9,
+	.io_port_0_reg = 0x78,
+	.io_port_1_reg = 0x79,
+	.io_port_2_reg = 0x7A,
+	.host_int_rsr_reg = 0x01,
+	.host_int_mask_reg = 0x02,
+	.host_int_status_reg = 0x03,
+	.card_misc_cfg_reg = 0x6c,
+	.fw_reset_reg = 0x64,
+	.fw_reset_val = 0,
+};
+
+static const struct _mlan_card_info mlan_card_info_sd8801 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
+	.v14_fw_api = 1,
+	.v16_fw_api = 0,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+};
+#endif
+
+#ifdef SD8897
+static const struct _mlan_sdio_card_reg mlan_reg_sd8897 = {
+	.start_rd_port = 0,
+	.start_wr_port = 0,
+	.base_0_reg = 0x60,
+	.base_1_reg = 0x61,
+	.poll_reg = 0x50,
+	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |
+			   CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,
+	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS |
+			   DN_LD_CMD_PORT_HOST_INT_STATUS |
+			   UP_LD_CMD_PORT_HOST_INT_STATUS,
+	.status_reg_0 = 0xC0,
+	.status_reg_1 = 0xC1,
+	.sdio_int_mask = 0xff,
+	.data_port_mask = 0xffffffff,
+	.max_mp_regs = 184,
+	.rd_bitmap_l = 0x04,
+	.rd_bitmap_u = 0x05,
+	.rd_bitmap_1l = 0x06,
+	.rd_bitmap_1u = 0x07,
+	.wr_bitmap_l = 0x08,
+	.wr_bitmap_u = 0x09,
+	.wr_bitmap_1l = 0x0A,
+	.wr_bitmap_1u = 0x0B,
+	.rd_len_p0_l = 0x0C,
+	.rd_len_p0_u = 0x0D,
+	.card_config_2_1_reg = 0xCD,
+	.cmd_config_0 = 0xB8,
+	.cmd_config_1 = 0xB9,
+	.cmd_config_2 = 0xBA,
+	.cmd_config_3 = 0xBB,
+	.cmd_rd_len_0 = 0xB4,
+	.cmd_rd_len_1 = 0xB5,
+	.cmd_rd_len_2 = 0xB6,
+	.cmd_rd_len_3 = 0xB7,
+	.io_port_0_reg = 0xD8,
+	.io_port_1_reg = 0xD9,
+	.io_port_2_reg = 0xDA,
+	.host_int_rsr_reg = 0x01,
+	.host_int_mask_reg = 0x02,
+	.host_int_status_reg = 0x03,
+	.host_restart_reg = 0x4C,
+	.card_to_host_event_reg = 0x50,
+	.host_interrupt_mask_reg = 0x54,
+	.card_interrupt_status_reg = 0x58,
+	.card_interrupt_rsr_reg = 0x5C,
+	.card_revision_reg = 0xBC,
+	.card_ocr_0_reg = 0xC8,
+	.card_ocr_1_reg = 0xC9,
+	.card_ocr_3_reg = 0xCA,
+	.card_config_reg = 0xCB,
+	.card_misc_cfg_reg = 0xCC,
+	.debug_0_reg = 0xD0,
+	.debug_1_reg = 0xD1,
+	.debug_2_reg = 0xD2,
+	.debug_3_reg = 0xD3,
+	.fw_reset_reg = 0x0E8,
+	.fw_reset_val = 1,
+	.winner_check_reg = 0xC0,
+};
+
+static const struct _mlan_card_info mlan_card_info_sd8897 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 0,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+};
+#endif
+
+#if defined(SD8977) || defined(SD8997) || defined(SD8987) ||                   \
+	defined(SD9098) || defined(SD9097) || defined(SD8978) ||               \
+	defined(SD9177)
+static const struct _mlan_sdio_card_reg mlan_reg_sd8977_sd8997 = {
+	.start_rd_port = 0,
+	.start_wr_port = 0,
+	.base_0_reg = 0xf8,
+	.base_1_reg = 0xf9,
+	.poll_reg = 0x5C,
+	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |
+			   CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,
+	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS |
+			   DN_LD_CMD_PORT_HOST_INT_STATUS |
+			   UP_LD_CMD_PORT_HOST_INT_STATUS,
+	.status_reg_0 = 0xe8,
+	.status_reg_1 = 0xe9,
+	.sdio_int_mask = 0xff,
+	.data_port_mask = 0xffffffff,
+	.max_mp_regs = 196,
+	.rd_bitmap_l = 0x10,
+	.rd_bitmap_u = 0x11,
+	.rd_bitmap_1l = 0x12,
+	.rd_bitmap_1u = 0x13,
+	.wr_bitmap_l = 0x14,
+	.wr_bitmap_u = 0x15,
+	.wr_bitmap_1l = 0x16,
+	.wr_bitmap_1u = 0x17,
+	.rd_len_p0_l = 0x18,
+	.rd_len_p0_u = 0x19,
+	.card_config_2_1_reg = 0xD9,
+	.cmd_config_0 = 0xC4,
+	.cmd_config_1 = 0xC5,
+	.cmd_config_2 = 0xC6,
+	.cmd_config_3 = 0xC7,
+	.cmd_rd_len_0 = 0xC0,
+	.cmd_rd_len_1 = 0xC1,
+	.cmd_rd_len_2 = 0xC2,
+	.cmd_rd_len_3 = 0xC3,
+	.io_port_0_reg = 0xE4,
+	.io_port_1_reg = 0xE5,
+	.io_port_2_reg = 0xE6,
+	.host_int_rsr_reg = 0x04,
+	.host_int_mask_reg = 0x08,
+	.host_int_status_reg = 0x0C,
+	.host_restart_reg = 0x58,
+	.card_to_host_event_reg = 0x5C,
+	.host_interrupt_mask_reg = 0x60,
+	.card_interrupt_status_reg = 0x64,
+	.card_interrupt_rsr_reg = 0x68,
+	.card_revision_reg = 0xC8,
+	.card_ocr_0_reg = 0xD4,
+	.card_ocr_1_reg = 0xD5,
+	.card_ocr_3_reg = 0xD6,
+	.card_config_reg = 0xD7,
+	.card_misc_cfg_reg = 0xD8,
+	.debug_0_reg = 0xDC,
+	.debug_1_reg = 0xDD,
+	.debug_2_reg = 0xDE,
+	.debug_3_reg = 0xDF,
+	.fw_reset_reg = 0x0EE,
+	.fw_reset_val = 0x99,
+	.fw_dnld_offset_0_reg = 0xEC,
+	.fw_dnld_offset_1_reg = 0xED,
+	.fw_dnld_offset_2_reg = 0xEE,
+	.fw_dnld_offset_3_reg = 0xEF,
+	.fw_dnld_status_0_reg = 0xE8,
+	.fw_dnld_status_1_reg = 0xE9,
+	.winner_check_reg = 0xFC,
+};
+#endif
+#ifdef SD8997
+static const struct _mlan_card_info mlan_card_info_sd8997 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+};
+#endif
+
+#ifdef SD9097
+static const struct _mlan_card_info mlan_card_info_sd9097 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+};
+#endif
+#ifdef SD9098
+static const struct _mlan_card_info mlan_card_info_sd9098 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+};
+#endif
+#ifdef SD9177
+static const struct _mlan_card_info mlan_card_info_sd9177 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+};
+#endif
+
+#if defined(SD8977) || defined(SD8978)
+static const struct _mlan_card_info mlan_card_info_sd8977 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
+	.v16_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+};
+#endif
+
+#ifdef SD8987
+static const struct _mlan_card_info mlan_card_info_sd8987 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
+	.v16_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+};
+#endif
 
 /********************************************************
 		Global Variables
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sdio.h b/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
index 60dca48..4d0fa3e 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
@@ -350,312 +350,6 @@ Change log:
 /** max aggr buf size 64k-256 */
 #define SDIO_MP_AGGR_BUF_SIZE_MAX (65280)
 
-#ifdef SD8887
-static const struct _mlan_sdio_card_reg mlan_reg_sd8887 = {
-	.start_rd_port = 0,
-	.start_wr_port = 0,
-	.base_0_reg = 0x6C,
-	.base_1_reg = 0x6D,
-	.poll_reg = 0x5C,
-	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |
-			   CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,
-	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS |
-			   DN_LD_CMD_PORT_HOST_INT_STATUS |
-			   UP_LD_CMD_PORT_HOST_INT_STATUS,
-	.status_reg_0 = 0x90,
-	.status_reg_1 = 0x91,
-	.sdio_int_mask = 0xff,
-	.data_port_mask = 0xffffffff,
-	.max_mp_regs = 196,
-	.rd_bitmap_l = 0x10,
-	.rd_bitmap_u = 0x11,
-	.rd_bitmap_1l = 0x12,
-	.rd_bitmap_1u = 0x13,
-	.wr_bitmap_l = 0x14,
-	.wr_bitmap_u = 0x15,
-	.wr_bitmap_1l = 0x16,
-	.wr_bitmap_1u = 0x17,
-	.rd_len_p0_l = 0x18,
-	.rd_len_p0_u = 0x19,
-	.card_config_2_1_reg = 0xD9,
-	.cmd_config_0 = 0xC4,
-	.cmd_config_1 = 0xC5,
-	.cmd_config_2 = 0xC6,
-	.cmd_config_3 = 0xC7,
-	.cmd_rd_len_0 = 0xC0,
-	.cmd_rd_len_1 = 0xC1,
-	.cmd_rd_len_2 = 0xC2,
-	.cmd_rd_len_3 = 0xC3,
-	.io_port_0_reg = 0xE4,
-	.io_port_1_reg = 0xE5,
-	.io_port_2_reg = 0xE6,
-	.host_int_rsr_reg = 0x04,
-	.host_int_mask_reg = 0x08,
-	.host_int_status_reg = 0x0C,
-	.host_restart_reg = 0x58,
-	.card_to_host_event_reg = 0x5C,
-	.host_interrupt_mask_reg = 0x60,
-	.card_interrupt_status_reg = 0x64,
-	.card_interrupt_rsr_reg = 0x68,
-	.card_revision_reg = 0xC8,
-	.card_ocr_0_reg = 0xD4,
-	.card_ocr_1_reg = 0xD5,
-	.card_ocr_3_reg = 0xD6,
-	.card_config_reg = 0xD7,
-	.card_misc_cfg_reg = 0xD8,
-	.debug_0_reg = 0xDC,
-	.debug_1_reg = 0xDD,
-	.debug_2_reg = 0xDE,
-	.debug_3_reg = 0xDF,
-	.fw_reset_reg = 0x0B6,
-	.fw_reset_val = 1,
-	.winner_check_reg = 0x90,
-};
-
-static const struct _mlan_card_info mlan_card_info_sd8887 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
-	.v16_fw_api = 0,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
-};
-#endif
-
-#ifdef SD8801
-static const struct _mlan_sdio_card_reg mlan_reg_sd8801 = {
-	.start_rd_port = 1,
-	.start_wr_port = 1,
-	.base_0_reg = 0x40,
-	.base_1_reg = 0x41,
-	.poll_reg = 0x30,
-	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK,
-	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS,
-	.status_reg_0 = 0x60,
-	.status_reg_1 = 0x61,
-	.sdio_int_mask = 0x3f,
-	.data_port_mask = 0x0000fffe,
-	.max_mp_regs = 64,
-	.rd_bitmap_l = 0x4,
-	.rd_bitmap_u = 0x5,
-	.wr_bitmap_l = 0x6,
-	.wr_bitmap_u = 0x7,
-	.rd_len_p0_l = 0x8,
-	.rd_len_p0_u = 0x9,
-	.io_port_0_reg = 0x78,
-	.io_port_1_reg = 0x79,
-	.io_port_2_reg = 0x7A,
-	.host_int_rsr_reg = 0x01,
-	.host_int_mask_reg = 0x02,
-	.host_int_status_reg = 0x03,
-	.card_misc_cfg_reg = 0x6c,
-	.fw_reset_reg = 0x64,
-	.fw_reset_val = 0,
-};
-
-static const struct _mlan_card_info mlan_card_info_sd8801 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
-	.v14_fw_api = 1,
-	.v16_fw_api = 0,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
-};
-#endif
-
-#ifdef SD8897
-static const struct _mlan_sdio_card_reg mlan_reg_sd8897 = {
-	.start_rd_port = 0,
-	.start_wr_port = 0,
-	.base_0_reg = 0x60,
-	.base_1_reg = 0x61,
-	.poll_reg = 0x50,
-	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |
-			   CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,
-	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS |
-			   DN_LD_CMD_PORT_HOST_INT_STATUS |
-			   UP_LD_CMD_PORT_HOST_INT_STATUS,
-	.status_reg_0 = 0xC0,
-	.status_reg_1 = 0xC1,
-	.sdio_int_mask = 0xff,
-	.data_port_mask = 0xffffffff,
-	.max_mp_regs = 184,
-	.rd_bitmap_l = 0x04,
-	.rd_bitmap_u = 0x05,
-	.rd_bitmap_1l = 0x06,
-	.rd_bitmap_1u = 0x07,
-	.wr_bitmap_l = 0x08,
-	.wr_bitmap_u = 0x09,
-	.wr_bitmap_1l = 0x0A,
-	.wr_bitmap_1u = 0x0B,
-	.rd_len_p0_l = 0x0C,
-	.rd_len_p0_u = 0x0D,
-	.card_config_2_1_reg = 0xCD,
-	.cmd_config_0 = 0xB8,
-	.cmd_config_1 = 0xB9,
-	.cmd_config_2 = 0xBA,
-	.cmd_config_3 = 0xBB,
-	.cmd_rd_len_0 = 0xB4,
-	.cmd_rd_len_1 = 0xB5,
-	.cmd_rd_len_2 = 0xB6,
-	.cmd_rd_len_3 = 0xB7,
-	.io_port_0_reg = 0xD8,
-	.io_port_1_reg = 0xD9,
-	.io_port_2_reg = 0xDA,
-	.host_int_rsr_reg = 0x01,
-	.host_int_mask_reg = 0x02,
-	.host_int_status_reg = 0x03,
-	.host_restart_reg = 0x4C,
-	.card_to_host_event_reg = 0x50,
-	.host_interrupt_mask_reg = 0x54,
-	.card_interrupt_status_reg = 0x58,
-	.card_interrupt_rsr_reg = 0x5C,
-	.card_revision_reg = 0xBC,
-	.card_ocr_0_reg = 0xC8,
-	.card_ocr_1_reg = 0xC9,
-	.card_ocr_3_reg = 0xCA,
-	.card_config_reg = 0xCB,
-	.card_misc_cfg_reg = 0xCC,
-	.debug_0_reg = 0xD0,
-	.debug_1_reg = 0xD1,
-	.debug_2_reg = 0xD2,
-	.debug_3_reg = 0xD3,
-	.fw_reset_reg = 0x0E8,
-	.fw_reset_val = 1,
-	.winner_check_reg = 0xC0,
-};
-
-static const struct _mlan_card_info mlan_card_info_sd8897 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 0,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
-};
-#endif
-
-#if defined(SD8977) || defined(SD8997) || defined(SD8987) ||                   \
-	defined(SD9098) || defined(SD9097) || defined(SD8978) ||               \
-	defined(SD9177)
-static const struct _mlan_sdio_card_reg mlan_reg_sd8977_sd8997 = {
-	.start_rd_port = 0,
-	.start_wr_port = 0,
-	.base_0_reg = 0xf8,
-	.base_1_reg = 0xf9,
-	.poll_reg = 0x5C,
-	.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |
-			   CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,
-	.host_int_status = DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS |
-			   DN_LD_CMD_PORT_HOST_INT_STATUS |
-			   UP_LD_CMD_PORT_HOST_INT_STATUS,
-	.status_reg_0 = 0xe8,
-	.status_reg_1 = 0xe9,
-	.sdio_int_mask = 0xff,
-	.data_port_mask = 0xffffffff,
-	.max_mp_regs = 196,
-	.rd_bitmap_l = 0x10,
-	.rd_bitmap_u = 0x11,
-	.rd_bitmap_1l = 0x12,
-	.rd_bitmap_1u = 0x13,
-	.wr_bitmap_l = 0x14,
-	.wr_bitmap_u = 0x15,
-	.wr_bitmap_1l = 0x16,
-	.wr_bitmap_1u = 0x17,
-	.rd_len_p0_l = 0x18,
-	.rd_len_p0_u = 0x19,
-	.card_config_2_1_reg = 0xD9,
-	.cmd_config_0 = 0xC4,
-	.cmd_config_1 = 0xC5,
-	.cmd_config_2 = 0xC6,
-	.cmd_config_3 = 0xC7,
-	.cmd_rd_len_0 = 0xC0,
-	.cmd_rd_len_1 = 0xC1,
-	.cmd_rd_len_2 = 0xC2,
-	.cmd_rd_len_3 = 0xC3,
-	.io_port_0_reg = 0xE4,
-	.io_port_1_reg = 0xE5,
-	.io_port_2_reg = 0xE6,
-	.host_int_rsr_reg = 0x04,
-	.host_int_mask_reg = 0x08,
-	.host_int_status_reg = 0x0C,
-	.host_restart_reg = 0x58,
-	.card_to_host_event_reg = 0x5C,
-	.host_interrupt_mask_reg = 0x60,
-	.card_interrupt_status_reg = 0x64,
-	.card_interrupt_rsr_reg = 0x68,
-	.card_revision_reg = 0xC8,
-	.card_ocr_0_reg = 0xD4,
-	.card_ocr_1_reg = 0xD5,
-	.card_ocr_3_reg = 0xD6,
-	.card_config_reg = 0xD7,
-	.card_misc_cfg_reg = 0xD8,
-	.debug_0_reg = 0xDC,
-	.debug_1_reg = 0xDD,
-	.debug_2_reg = 0xDE,
-	.debug_3_reg = 0xDF,
-	.fw_reset_reg = 0x0EE,
-	.fw_reset_val = 0x99,
-	.fw_dnld_offset_0_reg = 0xEC,
-	.fw_dnld_offset_1_reg = 0xED,
-	.fw_dnld_offset_2_reg = 0xEE,
-	.fw_dnld_offset_3_reg = 0xEF,
-	.fw_dnld_status_0_reg = 0xE8,
-	.fw_dnld_status_1_reg = 0xE9,
-	.winner_check_reg = 0xFC,
-};
-
-#ifdef SD8997
-static const struct _mlan_card_info mlan_card_info_sd8997 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
-};
-#endif
-
-#ifdef SD9097
-static const struct _mlan_card_info mlan_card_info_sd9097 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 1,
-	.v17_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
-};
-#endif
-#ifdef SD9098
-static const struct _mlan_card_info mlan_card_info_sd9098 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 1,
-	.v17_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
-};
-#endif
-#ifdef SD9177
-static const struct _mlan_card_info mlan_card_info_sd9177 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
-	.v16_fw_api = 1,
-	.v17_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
-};
-#endif
-
-#if defined(SD8977) || defined(SD8978)
-static const struct _mlan_card_info mlan_card_info_sd8977 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
-	.v16_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
-};
-#endif
-
-#ifdef SD8987
-static const struct _mlan_card_info mlan_card_info_sd8987 = {
-	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_2K,
-	.v16_fw_api = 1,
-	.supp_ps_handshake = 0,
-	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
-};
-#endif
-#endif
-
 extern mlan_adapter_operations mlan_sdio_ops;
 
 /** Probe and initialization function */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_shim.c b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
index c3cdb7c..e4dc13a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_shim.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
@@ -319,6 +319,7 @@ mlan_status mlan_register(pmlan_device pmdevice, t_void **ppmlan_adapter)
 	MASSERT(pcb->moal_spin_unlock);
 	MASSERT(pcb->moal_hist_data_add);
 	MASSERT(pcb->moal_updata_peer_signal);
+	MASSERT(pcb->moal_do_div);
 	/* Save pmoal_handle */
 	pmadapter->pmoal_handle = pmdevice->pmoal_handle;
 
@@ -1163,6 +1164,7 @@ process_start:
 			    wlan_11h_radar_detected_tx_blocked(pmadapter)) {
 				if (pmadapter->cmd_sent ||
 				    pmadapter->curr_cmd ||
+				    pmadapter->cmd_lock ||
 				    !wlan_is_send_cmd_allowed(
 					    pmadapter->tdls_status) ||
 				    !wlan_is_cmd_pending(pmadapter)) {
@@ -1222,6 +1224,7 @@ process_start:
 			pmadapter->vdll_ctrl.pending_block = MNULL;
 		}
 		if (!pmadapter->cmd_sent && !pmadapter->curr_cmd &&
+		    !pmadapter->cmd_lock &&
 		    wlan_is_send_cmd_allowed(pmadapter->tdls_status)) {
 			if (wlan_exec_next_cmd(pmadapter) ==
 			    MLAN_STATUS_FAILURE) {
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
index 4785ed7..00b0aeb 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
@@ -2553,7 +2553,9 @@ static mlan_status wlan_cmd_coalesce_config(pmlan_private pmpriv,
 
 	ENTER();
 
-	cmd->size = sizeof(HostCmd_DS_COALESCE_CONFIG) + S_DS_GEN;
+	cmd->size = (sizeof(HostCmd_DS_COALESCE_CONFIG) -
+		     sizeof(struct coalesce_receive_filt_rule)) +
+		    S_DS_GEN;
 	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_COALESCE_CFG);
 	coalesce_config->action = wlan_cpu_to_le16(cmd_action);
 	coalesce_config->num_of_rules = wlan_cpu_to_le16(cfg->num_of_rules);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
index 11cd55b..0e85b9c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
@@ -742,6 +742,16 @@ static mlan_status wlan_ret_get_log(pmlan_private pmpriv,
 			wlan_le32_to_cpu(pget_log->gdma_abort_cnt);
 		pget_info->param.stats.g_reset_rx_mac_cnt =
 			wlan_le32_to_cpu(pget_log->g_reset_rx_mac_cnt);
+		// Ownership error counters
+		pget_info->param.stats.dwCtlErrCnt =
+			wlan_le32_to_cpu(pget_log->dwCtlErrCnt);
+		pget_info->param.stats.dwBcnErrCnt =
+			wlan_le32_to_cpu(pget_log->dwBcnErrCnt);
+		pget_info->param.stats.dwMgtErrCnt =
+			wlan_le32_to_cpu(pget_log->dwMgtErrCnt);
+		pget_info->param.stats.dwDatErrCnt =
+			wlan_le32_to_cpu(pget_log->dwDatErrCnt);
+
 		if (pmpriv->adapter->getlog_enable) {
 			pget_info->param.stats.tx_frag_cnt =
 				wlan_le32_to_cpu(pget_log->tx_frag_cnt);
@@ -1864,7 +1874,7 @@ static mlan_status wlan_ret_tdls_config(pmlan_private pmpriv,
 				wlan_le16_to_cpu(link_ptr->data_rssi_avg);
 			link_ptr->data_nf_avg =
 				wlan_le16_to_cpu(link_ptr->data_nf_avg);
-			link_length = sizeof(tdls_each_link_status);
+			link_length = sizeof(tdls_each_link_status) - 1;
 			/* adjust as per open or secure network */
 			if (link_ptr->link_flags & 0x02) {
 				link_ptr->key_lifetime = wlan_le32_to_cpu(
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
index 29bad5b..db93a7b 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
@@ -1004,6 +1004,7 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 		PRINTM(MEVENT, "EVENT: EXT_SCAN status report (%d)\n",
 		       pmbuf->data_len);
 		pmadapter->ext_scan_timeout = MFALSE;
+		pmadapter->cmd_lock = MFALSE;
 		ret = wlan_handle_event_ext_scan_status(priv, pmbuf);
 		break;
 	case EVENT_MEAS_REPORT_RDY:
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
index d63dcba..b8aec45 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
@@ -414,6 +414,8 @@ static mlan_status wlan_get_info_ioctl(pmlan_adapter pmadapter,
 		pioctl_req->data_read_written =
 			sizeof(mlan_fw_info) + MLAN_SUB_COMMAND_SIZE;
 		pget_info->param.fw_info.fw_ver = pmadapter->fw_release_number;
+		pget_info->param.fw_info.hotfix_version =
+			pmadapter->fw_hotfix_ver;
 		memcpy_ext(pmadapter, &pget_info->param.fw_info.mac_addr,
 			   pmpriv->curr_addr, MLAN_MAC_ADDR_LENGTH,
 			   MLAN_MAC_ADDR_LENGTH);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
index 37b1585..046b230 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
@@ -3177,6 +3177,15 @@ static mlan_status wlan_uap_ret_get_log(pmlan_private pmpriv,
 			wlan_le32_to_cpu(pget_log->gdma_abort_cnt);
 		pget_info->param.stats.g_reset_rx_mac_cnt =
 			wlan_le32_to_cpu(pget_log->g_reset_rx_mac_cnt);
+		// Ownership error counters
+		pget_info->param.stats.dwCtlErrCnt =
+			wlan_le32_to_cpu(pget_log->dwCtlErrCnt);
+		pget_info->param.stats.dwBcnErrCnt =
+			wlan_le32_to_cpu(pget_log->dwBcnErrCnt);
+		pget_info->param.stats.dwMgtErrCnt =
+			wlan_le32_to_cpu(pget_log->dwMgtErrCnt);
+		pget_info->param.stats.dwDatErrCnt =
+			wlan_le32_to_cpu(pget_log->dwDatErrCnt);
 		if (pmpriv->adapter->getlog_enable) {
 			pget_info->param.stats.tx_frag_cnt =
 				wlan_le32_to_cpu(pget_log->tx_frag_cnt);
@@ -3601,7 +3610,7 @@ static mlan_status wlan_uap_ret_sta_list(pmlan_private pmpriv,
 			} else
 				info->param.sta_list.info[i].bandmode = 0xFF;
 			pioctl_buf->data_read_written +=
-				sizeof(sta_info_data) +
+				sizeof(sta_info_data) - 1 +
 				info->param.sta_list.info[i].ie_len;
 			buf += sizeof(MrvlIEtypes_sta_info_t) +
 			       info->param.sta_list.info[i].ie_len;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
index ec3071f..eda871d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
@@ -682,27 +682,10 @@ static mlan_status wlan_uap_bss_ioctl_deauth_sta(pmlan_adapter pmadapter,
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_ds_bss *bss = MNULL;
-	const t_u8 bc_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-	sta_node *sta_ptr = MNULL;
 
 	ENTER();
 
 	bss = (mlan_ds_bss *)pioctl_req->pbuf;
-	if (pmpriv->uap_host_based & UAP_FLAG_HOST_MLME) {
-		if (memcmp(pmpriv->adapter, bss->param.deauth_param.mac_addr,
-			   bc_mac, MLAN_MAC_ADDR_LENGTH)) {
-			sta_ptr = wlan_get_station_entry(
-				pmpriv, bss->param.deauth_param.mac_addr);
-			if (!sta_ptr) {
-				PRINTM(MCMND,
-				       "Skip deauth to station " MACSTR "\n",
-				       MAC2STR(bss->param.deauth_param
-						       .mac_addr));
-				LEAVE();
-				return ret;
-			}
-		}
-	}
 	ret = wlan_prepare_cmd(pmpriv, HOST_CMD_APCMD_STA_DEAUTH,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       (t_void *)&bss->param.deauth_param);
@@ -1038,6 +1021,7 @@ wlan_uap_sec_ioctl_set_encrypt_key(pmlan_adapter pmadapter,
 		LEAVE();
 		return ret;
 	}
+
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_802_11_KEY_MATERIAL,
 			       HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
 			       (t_void *)pioctl_req, &sec->param.encrypt_key);
@@ -1920,6 +1904,8 @@ mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 				   MLAN_MAC_ADDR_LENGTH);
 			pget_info->param.fw_info.fw_ver =
 				pmadapter->fw_release_number;
+			pget_info->param.fw_info.hotfix_version =
+				pmadapter->fw_hotfix_ver;
 			pget_info->param.fw_info.fw_bands = pmadapter->fw_bands;
 			pget_info->param.fw_info.ecsa_enable =
 				pmadapter->ecsa_enable;
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
index 42884ba..1688908 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "247.p5"
+#define MLAN_RELEASE_VERSION "266"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -266,6 +266,7 @@ typedef t_s32 t_sval;
 /** pcie card reset */
 #define FW_RELOAD_PCIE_RESET 4
 #endif
+#define FW_RELOAD_SDIO_HW_RESET 5
 
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
@@ -428,6 +429,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SD8987 "SD8987"
 /** SD9097 Card */
 #define CARD_SD9097 "SD9097"
+/** SDIW620 Card */
+#define CARD_SDIW620 "SDIW620"
 /** SD9098 Card */
 #define CARD_SD9098 "SD9098"
 /** SD9177 Card */
@@ -457,6 +460,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_PCIE8997 "PCIE8997"
 /** PCIE9097 Card */
 #define CARD_PCIE9097 "PCIE9097"
+/** PCIEIW620 Card */
+#define CARD_PCIEIW620 "PCIEIW620"
 /** PCIE9000S Card */
 #define CARD_PCIE9000S "PCIE9000S"
 /** PCIE9098 Card */
@@ -498,6 +503,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9098 "USB9098"
 /** USB9097 Card */
 #define CARD_USB9097 "USB9097"
+/** USBIW620 Card */
+#define CARD_USBIW620 "USBIW620"
 #endif
 
 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
@@ -1386,7 +1393,7 @@ typedef MLAN_PACK_START struct _tdls_each_link_status {
 	/** Key Length */
 	t_u8 key_length;
 	/** actual key */
-	t_u8 key[];
+	t_u8 key[1];
 } MLAN_PACK_END tdls_each_link_status;
 
 /** TDLS configuration data */
@@ -2021,6 +2028,7 @@ typedef struct _mlan_callbacks {
 				     t_u8 antenna);
 	t_void (*moal_updata_peer_signal)(t_void *pmoal, t_u32 bss_index,
 					  t_u8 *peer_addr, t_s8 snr, t_s8 nflr);
+	t_u64 (*moal_do_div)(t_u64 num, t_u32 base);
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
 	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal,
 						  t_u32 bss_index);
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h b/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
index 6f73424..906a345 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
@@ -132,6 +132,7 @@ typedef MLAN_PACK_START enum _IEEEtypes_ElementId_e {
 	VS_IE = VENDOR_SPECIFIC_221,
 	WAPI_IE = 68,
 	FRAGMENT = 242,
+	RSNX_IE = 244,
 	EXTENSION = 255
 } MLAN_PACK_END IEEEtypes_ElementId_e;
 
@@ -1994,7 +1995,8 @@ typedef struct _BSSDescriptor_t {
 	t_u32 beacon_buf_size;
 	/** Max allocated size for updated scan response */
 	t_u32 beacon_buf_size_max;
-
+	/** scan age in secs */
+	t_u32 age_in_secs;
 } BSSDescriptor_t, *pBSSDescriptor_t;
 
 #endif /* !_MLAN_IEEE_H_ */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
index c0015af..a9d3c79 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
@@ -1259,8 +1259,9 @@ typedef MLAN_PACK_START struct _otp_region_info {
 	t_u8 country_code[2];
 	t_u8 region_code;
 	t_u8 environment;
-	t_u16 force_reg : 1;
-	t_u16 reserved : 15;
+	t_u8 force_reg : 1;
+	t_u8 reserved : 7;
+	t_u8 dfs_region;
 } MLAN_PACK_END otp_region_info_t;
 
 /** Type definition of mlan_ds_custom_reg_domain */
@@ -1636,6 +1637,15 @@ typedef struct _mlan_ds_get_stats {
 	t_u32 gdma_abort_cnt;
 	/** Rx Reset MAC Count */
 	t_u32 g_reset_rx_mac_cnt;
+	// Ownership error counters
+	/*Error Ownership error count*/
+	t_u32 dwCtlErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwBcnErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwMgtErrCnt;
+	/*Control Ownership error count*/
+	t_u32 dwDatErrCnt;
 } mlan_ds_get_stats, *pmlan_ds_get_stats;
 
 /** Type definition of mlan_ds_uap_stats for MLAN_OID_GET_STATS */
@@ -1771,6 +1781,8 @@ typedef struct _mlan_ds_get_signal {
 typedef struct _mlan_fw_info {
 	/** Firmware version */
 	t_u32 fw_ver;
+	/** Firmware Hotfix version */
+	t_u8 hotfix_version;
 	/** MAC address */
 	mlan_802_11_mac_addr mac_addr;
 	/** 802.11n device capabilities */
@@ -2402,7 +2414,7 @@ typedef struct _sta_info_data {
 	/** ie length */
 	t_u16 ie_len;
 	/** ie buffer */
-	t_u8 ie_buf[];
+	t_u8 ie_buf[1];
 } sta_info_data;
 
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
@@ -2933,7 +2945,9 @@ typedef struct _mlan_ds_beacon_stuck_param_cfg {
 #define HOST_SLEEP_COND_IPV6_PACKET MBIT(31)
 
 /** Host sleep config conditions: Default */
-#define HOST_SLEEP_DEF_COND 0
+#define HOST_SLEEP_DEF_COND                                                    \
+	(HOST_SLEEP_COND_BROADCAST_DATA | HOST_SLEEP_COND_UNICAST_DATA |       \
+	 HOST_SLEEP_COND_MAC_EVENT)
 
 /** Host sleep config GPIO : Default */
 #define HOST_SLEEP_DEF_GPIO 0xff
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
index 212c1f5..3343843 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
@@ -1373,6 +1373,10 @@ int woal_cfg80211_add_key(struct wiphy *wiphy, struct net_device *netdev,
 		PRINTM(MINFO, "Skip set keys during ft connecting\n");
 		return -EFAULT;
 	}
+
+	/** cancel pending scan */
+	woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
+
 	if (woal_cfg80211_set_key(priv, 0, params->cipher, params->key,
 				  params->key_len, params->seq, params->seq_len,
 				  key_index, mac_addr, 0, MOAL_IOCTL_WAIT)) {
@@ -2412,6 +2416,34 @@ void woal_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
 	LEAVE();
 }
 
+/*
+ * @brief  prepare and send WOAL_EVENT_CANCEL_CHANRPT
+ *
+ * @param priv           A pointer moal_private structure
+ *
+ * @return          N/A
+ */
+static void woal_cancel_chanrpt_event(moal_private *priv)
+{
+	struct woal_event *evt;
+	unsigned long flags;
+	moal_handle *handle = priv->phandle;
+
+	evt = kzalloc(sizeof(struct woal_event), GFP_ATOMIC);
+	if (!evt) {
+		PRINTM(MERROR, "Fail to alloc memory for deauth event\n");
+		LEAVE();
+		return;
+	}
+	evt->priv = priv;
+	evt->type = WOAL_EVENT_CANCEL_CHANRPT;
+	INIT_LIST_HEAD(&evt->link);
+	spin_lock_irqsave(&handle->evt_lock, flags);
+	list_add_tail(&evt->link, &handle->evt_queue);
+	spin_unlock_irqrestore(&handle->evt_lock, flags);
+	queue_work(handle->evt_workqueue, &handle->evt_work);
+}
+
 #if KERNEL_VERSION(3, 2, 0) <= CFG80211_VERSION_CODE
 #if KERNEL_VERSION(3, 3, 0) <= CFG80211_VERSION_CODE
 #if KERNEL_VERSION(3, 6, 0) <= CFG80211_VERSION_CODE
@@ -2610,6 +2642,9 @@ int woal_cfg80211_mgmt_tx(struct wiphy *wiphy,
 				PRINTM(MMSG,
 				       "wlan: HostMlme %s send deauth/disassoc\n",
 				       priv->netdev->name);
+				if (priv->phandle->is_cac_timer_set)
+					woal_cancel_chanrpt_event(priv);
+
 				break;
 			case IEEE80211_STYPE_ASSOC_RESP:
 			case IEEE80211_STYPE_REASSOC_RESP:
@@ -2622,6 +2657,7 @@ int woal_cfg80211_mgmt_tx(struct wiphy *wiphy,
 			}
 		}
 	}
+
 #if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
 	if ((ieee80211_is_action(((struct ieee80211_mgmt *)buf)->frame_control))
 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
@@ -3352,15 +3388,62 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 			    !moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
 				break;
 			else {
-				if ((out_len + length + 2) < (int)ie_out_len) {
-					moal_memcpy_ext(priv->phandle,
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(4, 20, 0)
+				if (ext_id == HE_CAPABILITY) {
+					mlan_ds_11ax_he_cfg he_cfg;
+					IEEEtypes_HECap_t *hecap_ie;
+
+					if (priv->channel <= 14)
+						he_cfg.band = MBIT(0);
+					else
+						he_cfg.band = MBIT(1);
+
+					PRINTM(MCMND,
+					       "Retrieve 11ax cfg by channel=%d band=%d\n",
+					       priv->channel, he_cfg.band);
+
+					if (0 == woal_11ax_cfg(priv,
+							       MLAN_ACT_GET,
+							       &he_cfg)) {
+						hecap_ie = (IEEEtypes_HECap_t
+								    *)&he_cfg
+								   .he_cap.len;
+
+						hecap_ie->ieee_hdr.len =
+							he_cfg.he_cap.len;
+						hecap_ie->ieee_hdr.element_id =
+							he_cfg.he_cap.id;
+
+						moal_memcpy_ext(
+							priv->phandle,
+							ie_out + out_len,
+							hecap_ie,
+							hecap_ie->ieee_hdr.len +
+								2,
+							ie_out_len - out_len);
+
+						out_len +=
+							hecap_ie->ieee_hdr.len +
+							2;
+					} else {
+						PRINTM(MERROR,
+						       "Fail to get 11ax he_cap parameters\n");
+					}
+				} else
+#endif
+				{
+					if ((out_len + length + 2) <
+					    (int)ie_out_len) {
+						moal_memcpy_ext(
+							priv->phandle,
 							ie_out + out_len, pos,
 							length + 2,
 							ie_out_len - out_len);
-					out_len += length + 2;
-				} else {
-					PRINTM(MERROR,
-					       "IE too big, fail copy EXTENSION IE\n");
+						out_len += length + 2;
+					} else {
+						PRINTM(MERROR,
+						       "IE too big, fail copy EXTENSION IE\n");
+					}
 				}
 				break;
 			}
@@ -4634,49 +4717,137 @@ void woal_cfg80211_notify_antcfg(moal_private *priv, struct wiphy *wiphy,
 	if (IS_STA_OR_UAP_CFG80211(priv->phandle->params.cfg80211_wext) &&
 	    wiphy) {
 		if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
+			struct ieee80211_supported_band *bands =
+				wiphy->bands[IEEE80211_BAND_2GHZ];
+
 			if (((radio->param.ant_cfg.tx_antenna & 0xFF) != 3 &&
 			     (radio->param.ant_cfg.tx_antenna & 0xFF) != 0) ||
 			    ((radio->param.ant_cfg.rx_antenna & 0xFF) != 3 &&
-			     (radio->param.ant_cfg.rx_antenna & 0xFF) != 0))
-				wiphy->bands[IEEE80211_BAND_2GHZ]
-					->ht_cap.mcs.rx_mask[1] = 0;
-			else if ((radio->param.ant_cfg.tx_antenna & 0xFF) ==
-					 3 ||
-				 (radio->param.ant_cfg.rx_antenna & 0xFF) == 3)
-				wiphy->bands[IEEE80211_BAND_2GHZ]
-					->ht_cap.mcs.rx_mask[1] = 0xff;
+			     (radio->param.ant_cfg.rx_antenna & 0xFF) != 0)) {
+				bands->ht_cap.mcs.rx_mask[1] = 0;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
+				if (bands->n_iftype_data &&
+				    bands->iftype_data &&
+				    bands->iftype_data->he_cap.has_he) {
+					t_u16 mcs_nss[2];
 
-			wiphy->bands[IEEE80211_BAND_2GHZ]
-				->ht_cap.mcs.rx_mask[4] = 0;
+					mcs_nss[0] = bands->iftype_data->he_cap
+							     .he_mcs_nss_supp
+							     .rx_mcs_80;
+					mcs_nss[1] = mcs_nss[0] |= 0x0c;
+					moal_memcpy_ext(
+						priv->phandle,
+						(t_void *)&bands->iftype_data
+							->he_cap.he_mcs_nss_supp
+							.rx_mcs_80,
+						(t_void *)&mcs_nss,
+						sizeof(mcs_nss),
+						sizeof(bands->iftype_data->he_cap
+							       .he_mcs_nss_supp));
+				}
+#endif
+			} else if ((radio->param.ant_cfg.tx_antenna & 0xFF) ==
+					   3 ||
+				   (radio->param.ant_cfg.rx_antenna & 0xFF) ==
+					   3) {
+				bands->ht_cap.mcs.rx_mask[1] = 0xff;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
+				if (bands->n_iftype_data &&
+				    bands->iftype_data &&
+				    bands->iftype_data->he_cap.has_he) {
+					t_u16 mcs_nss[2];
+
+					mcs_nss[0] = bands->iftype_data->he_cap
+							     .he_mcs_nss_supp
+							     .rx_mcs_80;
+					mcs_nss[1] = mcs_nss[0] =
+						(mcs_nss[0] & ~0x0c) |
+						((mcs_nss[0] & 0x3) << 2);
+
+					moal_memcpy_ext(
+						priv->phandle,
+						(t_void *)&bands->iftype_data
+							->he_cap.he_mcs_nss_supp
+							.rx_mcs_80,
+						(t_void *)&mcs_nss,
+						sizeof(mcs_nss),
+						sizeof(bands->iftype_data->he_cap
+							       .he_mcs_nss_supp));
+				}
+#endif
+			}
+			bands->ht_cap.mcs.rx_mask[4] = 0;
 		}
 
 		if (wiphy->bands[IEEE80211_BAND_5GHZ]) {
+			struct ieee80211_supported_band *bands =
+				wiphy->bands[IEEE80211_BAND_5GHZ];
+
 			if (((radio->param.ant_cfg.tx_antenna & 0xFF00) !=
 				     0x300 &&
 			     (radio->param.ant_cfg.tx_antenna & 0xFF00) != 0) ||
 			    ((radio->param.ant_cfg.rx_antenna & 0xFF00) !=
 				     0x300 &&
 			     (radio->param.ant_cfg.rx_antenna & 0xFF00) != 0)) {
-				wiphy->bands[IEEE80211_BAND_5GHZ]
-					->ht_cap.mcs.rx_mask[1] = 0;
-				wiphy->bands[IEEE80211_BAND_5GHZ]
-					->vht_cap.vht_mcs.rx_mcs_map =
+				bands->ht_cap.mcs.rx_mask[1] = 0;
+				bands->vht_cap.vht_mcs.rx_mcs_map =
 					(__force __le16)0xfffe;
-				wiphy->bands[IEEE80211_BAND_5GHZ]
-					->vht_cap.vht_mcs.tx_mcs_map =
+				bands->vht_cap.vht_mcs.tx_mcs_map =
 					(__force __le16)0xfffe;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
+				if (bands->n_iftype_data &&
+				    bands->iftype_data &&
+				    bands->iftype_data->he_cap.has_he) {
+					t_u16 mcs_nss[2];
+
+					mcs_nss[0] = bands->iftype_data->he_cap
+							     .he_mcs_nss_supp
+							     .rx_mcs_80;
+					mcs_nss[1] = mcs_nss[0] |= 0x0c;
+					moal_memcpy_ext(
+						priv->phandle,
+						(t_void *)&bands->iftype_data
+							->he_cap.he_mcs_nss_supp
+							.rx_mcs_80,
+						(t_void *)&mcs_nss,
+						sizeof(mcs_nss),
+						sizeof(bands->iftype_data->he_cap
+							       .he_mcs_nss_supp));
+				}
+#endif
 			} else if ((radio->param.ant_cfg.tx_antenna & 0xFF00) ==
 					   0x300 ||
 				   (radio->param.ant_cfg.rx_antenna & 0xFF00) ==
 					   0x300) {
-				wiphy->bands[IEEE80211_BAND_5GHZ]
-					->ht_cap.mcs.rx_mask[1] = 0xff;
-				wiphy->bands[IEEE80211_BAND_5GHZ]
-					->vht_cap.vht_mcs.rx_mcs_map =
+				bands->ht_cap.mcs.rx_mask[1] = 0xff;
+				bands->vht_cap.vht_mcs.rx_mcs_map =
 					(__force __le16)0xfffa;
-				wiphy->bands[IEEE80211_BAND_5GHZ]
-					->vht_cap.vht_mcs.tx_mcs_map =
+				bands->vht_cap.vht_mcs.tx_mcs_map =
 					(__force __le16)0xfffa;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
+				if (bands->n_iftype_data &&
+				    bands->iftype_data &&
+				    bands->iftype_data->he_cap.has_he) {
+					t_u16 mcs_nss[2];
+
+					mcs_nss[0] = bands->iftype_data->he_cap
+							     .he_mcs_nss_supp
+							     .rx_mcs_80;
+					mcs_nss[1] = mcs_nss[0] =
+						(mcs_nss[0] & ~0x0c) |
+						((mcs_nss[0] & 0x3) << 2);
+
+					moal_memcpy_ext(
+						priv->phandle,
+						(t_void *)&bands->iftype_data
+							->he_cap.he_mcs_nss_supp
+							.rx_mcs_80,
+						(t_void *)&mcs_nss,
+						sizeof(mcs_nss),
+						sizeof(bands->iftype_data->he_cap
+							       .he_mcs_nss_supp));
+				}
+#endif
 			}
 		}
 	}
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
index b6850ec..6bafc1b 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
@@ -419,6 +419,7 @@ int woal_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 			      u8 *mac_addr);
 #endif
 #endif
+
 #if KERNEL_VERSION(3, 12, 0) <= CFG80211_VERSION_CODE
 #if KERNEL_VERSION(3, 15, 0) <= CFG80211_VERSION_CODE
 int woal_cfg80211_start_radar_detection(struct wiphy *wiphy,
@@ -434,6 +435,8 @@ int woal_cfg80211_start_radar_detection(struct wiphy *wiphy,
 int woal_cfg80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 				 struct cfg80211_csa_settings *params);
 
+void woal_process_cancel_chanrpt_event(moal_private *priv);
+
 void woal_cac_timer_func(void *context);
 void woal_csa_work_queue(struct work_struct *work);
 #endif
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
index 2479b97..8dd2404 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
@@ -2762,6 +2762,9 @@ static int woal_cfg80211_subcmd_link_statistic_get(struct wiphy *wiphy,
 	t_u64 max_msec = (t_u64)24 * (t_u64)24 * (t_u64)3600 * (t_u64)1000;
 	moal_handle *handle = priv->phandle;
 
+	if (priv->media_connected == MFALSE)
+		return -EFAULT;
+
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(t_u32) + BUF_MAXLEN);
 	if (req == NULL) {
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_debug.c b/mxm_wifiex/wlan_src/mlinux/moal_debug.c
index 5635105..2192610 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_debug.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_debug.c
@@ -1100,7 +1100,7 @@ static int woal_debug_read(struct seq_file *sfp, void *data)
 			seq_printf(
 				sfp,
 				"tid = %d, ta =  %02x:%02x:%02x:%02x:%02x:%02x, start_win = %d, "
-				"win_size = %d, amsdu=%d\n",
+				"win_size = %d, amsdu=%d",
 				(int)info->rx_tbl[i].tid, info->rx_tbl[i].ta[0],
 				info->rx_tbl[i].ta[1], info->rx_tbl[i].ta[2],
 				info->rx_tbl[i].ta[3], info->rx_tbl[i].ta[4],
@@ -1108,6 +1108,8 @@ static int woal_debug_read(struct seq_file *sfp, void *data)
 				(int)info->rx_tbl[i].start_win,
 				(int)info->rx_tbl[i].win_size,
 				(int)info->rx_tbl[i].amsdu);
+			seq_printf(sfp, "\n");
+
 			seq_printf(sfp, "buffer: ");
 			for (j = 0; j < info->rx_tbl[i].win_size; j++) {
 				if (info->rx_tbl[i].buffer[j] == MTRUE)
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
index 491df6c..379881f 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
@@ -3714,11 +3714,16 @@ done:
 static int woal_priv_setgettcpackenh(moal_private *priv, t_u8 *respbuf,
 				     t_u32 respbuflen)
 {
-	t_u32 data[1];
+	t_u32 data[2] = {0, 0};
 	int ret = 0;
 	int user_data_len = 0;
 
 	ENTER();
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
 
 	if (strlen(respbuf) == (strlen(CMD_NXP) + strlen(PRIV_CMD_TCPACKENH))) {
 		/* GET operation */
@@ -3731,17 +3736,25 @@ static int woal_priv_setgettcpackenh(moal_private *priv, t_u8 *respbuf,
 				data, ARRAY_SIZE(data), &user_data_len);
 	}
 
-	if (user_data_len >= 2) {
-		PRINTM(MERROR, "Too many arguments\n");
-		ret = -EINVAL;
-		goto done;
-	}
-
 	if (user_data_len == 0) {
 		/* get operation */
-		respbuf[0] = priv->enable_tcp_ack_enh;
+		data[0] = priv->enable_tcp_ack_enh;
+		data[1] = priv->tcp_ack_max_hold;
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data,
+				sizeof(data), respbuflen);
+		ret = sizeof(data);
 	} else {
 		/* set operation */
+		if (user_data_len >= 3) {
+			PRINTM(MERROR, "Too many arguments\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (data[0] > 1 || data[1] > TCP_ACK_MAX_HOLD) {
+			PRINTM(MERROR, "Invalid argument\n");
+			ret = -EINVAL;
+			goto done;
+		}
 		if (data[0] == MTRUE) {
 			PRINTM(MINFO, "Enabling TCP Ack enhancement\n");
 			priv->enable_tcp_ack_enh = MTRUE;
@@ -3750,14 +3763,17 @@ static int woal_priv_setgettcpackenh(moal_private *priv, t_u8 *respbuf,
 			priv->enable_tcp_ack_enh = MFALSE;
 			/* release the tcp sessions if any */
 			woal_flush_tcp_sess_queue(priv);
-		} else {
-			PRINTM(MERROR, "Unknown option = %u\n", data[0]);
-			ret = -EINVAL;
-			goto done;
 		}
-		respbuf[0] = priv->enable_tcp_ack_enh;
+		if (user_data_len >= 2) {
+			PRINTM(MINFO, "TCP drop Ack configure: %d\n", data[1]);
+			priv->tcp_ack_max_hold = data[1];
+		}
+		data[0] = priv->enable_tcp_ack_enh;
+		data[1] = priv->tcp_ack_max_hold;
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data,
+				sizeof(data), respbuflen);
+		ret = sizeof(data);
 	}
-	ret = 1;
 
 done:
 	LEAVE();
@@ -5549,6 +5565,12 @@ static int woal_priv_set_get_psmode(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 
+	if (data != 0 && data != 1) {
+		PRINTM(MERROR, "Invalid psmode=%d\n", data);
+		ret = -EINVAL;
+		goto done;
+	}
+
 	/* Flip the value */
 	data = !data;
 
@@ -6863,7 +6885,8 @@ static int woal_priv_get_txpwrlimit(moal_private *priv, t_u8 *respbuf,
 	header_len = strlen(PRIV_CMD_GET_TXPWR_LIMIT);
 	trpc_cfg = (mlan_ds_misc_chan_trpc_cfg *)(respbuf + header_len);
 	if ((trpc_cfg->sub_band != 0) && (trpc_cfg->sub_band != 0x10) &&
-	    (trpc_cfg->sub_band != 0x11) && (trpc_cfg->sub_band != 0x12)) {
+	    (trpc_cfg->sub_band != 0x11) && (trpc_cfg->sub_band != 0x12) &&
+	    (trpc_cfg->sub_band != 0x13)) {
 		PRINTM(MERROR, "Invalid subband=0x%x\n", trpc_cfg->sub_band);
 		ret = -EINVAL;
 		goto done;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c b/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
index dfa5e2b..8e4f209 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
@@ -76,6 +76,7 @@ typedef struct _region_code_mapping_t {
 
 /** Region code mapping table */
 static region_code_mapping_t region_code_mapping[] = {
+	{"00", 0x00}, /* World       */
 	{"US", 0x10}, /* US FCC      */
 	{"CA", 0x20}, /* IC Canada   */
 	{"SG", 0x10}, /* Singapore   */
@@ -94,6 +95,7 @@ static region_code_mapping_t region_code_mapping[] = {
 
 /** EEPROM Region code mapping table */
 static region_code_mapping_t hw_region_code_mapping[] = {
+	{"00 ", 0x00}, /* World       */
 	{"US ", 0x10}, /* US FCC      */
 	{"CA ", 0x20}, /* IC Canada   */
 	{"KR ", 0x30}, /* Korea       */
@@ -894,9 +896,9 @@ void woal_request_set_multicast_list(moal_private *priv, struct net_device *dev)
 		if (mc_count > MLAN_MAX_MULTICAST_LIST_SIZE)
 			bss->param.multicast_list.mode = MLAN_ALL_MULTI_MODE;
 	}
-
+	PRINTM(MCMND, "%s set multicast_list\n", dev->name);
 	/* Send IOCTL request to MLAN */
-	status = woal_request_ioctl(priv, req, MOAL_NO_WAIT);
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_PENDING)
 		kfree(req);
 done:
@@ -1860,6 +1862,8 @@ mlan_status woal_request_get_fw_info(moal_private *priv, t_u8 wait_option,
 	status = woal_request_ioctl(priv, req, wait_option);
 	if (status == MLAN_STATUS_SUCCESS) {
 		priv->phandle->fw_release_number = info->param.fw_info.fw_ver;
+		priv->phandle->fw_hotfix_version =
+			info->param.fw_info.hotfix_version;
 		priv->phandle->fw_ecsa_enable = info->param.fw_info.ecsa_enable;
 		priv->phandle->fw_getlog_enable =
 			info->param.fw_info.getlog_enable;
@@ -3246,6 +3250,7 @@ done:
  */
 void woal_get_version(moal_handle *handle, char *version, int max_len)
 {
+	t_u8 hotfix_ver = 0;
 	union {
 		t_u32 l;
 		t_u8 c[4];
@@ -3254,9 +3259,17 @@ void woal_get_version(moal_handle *handle, char *version, int max_len)
 
 	ENTER();
 
+	hotfix_ver = handle->fw_hotfix_version;
 	ver.l = handle->fw_release_number;
-	snprintf(fw_ver, sizeof(fw_ver), "%u.%u.%u.p%u", ver.c[2], ver.c[1],
-		 ver.c[0], ver.c[3]);
+
+	if (hotfix_ver) {
+		snprintf(fw_ver, sizeof(fw_ver), "%u.%u.%u.p%u.%u", ver.c[2],
+			 ver.c[1], ver.c[0], ver.c[3], hotfix_ver);
+
+	} else {
+		snprintf(fw_ver, sizeof(fw_ver), "%u.%u.%u.p%u", ver.c[2],
+			 ver.c[1], ver.c[0], ver.c[3]);
+	}
 
 	snprintf(version, max_len, handle->driver_version, fw_ver);
 
@@ -3906,7 +3919,7 @@ int woal_11h_cancel_chan_report_ioctl(moal_private *priv, t_u8 wait_option)
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
-
+	PRINTM(MCMND, "wlan: woal_11h_cancel_chan_report\n");
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11h_cfg));
 	if (req == NULL) {
 		ret = -ENOMEM;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.c b/mxm_wifiex/wlan_src/mlinux/moal_main.c
index 6bf8145..80a446a 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.c
@@ -717,6 +717,7 @@ static mlan_callbacks woal_callbacks = {
 	.moal_assert = moal_assert,
 	.moal_hist_data_add = moal_hist_data_add,
 	.moal_updata_peer_signal = moal_updata_peer_signal,
+	.moal_do_div = moal_do_div,
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
 	.moal_wait_hostcmd_complete = moal_wait_hostcmd_complete,
 	.moal_notify_hostcmd_complete = moal_notify_hostcmd_complete,
@@ -3102,6 +3103,8 @@ static mlan_status woal_req_txpwr_data(moal_handle *handle,
 	ENTER();
 
 	if (txpwrlimit_cfg && strncmp(txpwrlimit_cfg, "none", strlen("none"))) {
+		PRINTM(MMSG, "Download txpwrlimit_cfg=%s\n",
+		       handle->params.txpwrlimit_cfg);
 		if (req_fw_nowait) {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
 			if ((request_firmware_nowait(
@@ -3717,18 +3720,7 @@ void woal_fill_mlan_buffer(moal_private *priv, mlan_buffer *pmbuf,
 	 *   and MSDU lifetime expiry.
 	 */
 	woal_get_monotonic_time(&tstamp);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
-	skb->tstamp = ktime_get_raw();
-#else
-	skb->tstamp = timeval_to_ktime(tstamp);
-#endif
-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
-	skb_set_timestamp(skb, &tstamp);
-#else
-	moal_memcpy_ext(priv->phandle, &skb->stamp, &tstamp, sizeof(skb->stamp),
-			sizeof(skb->stamp));
-#endif
+	skb->tstamp = ktime_get_real();
 
 	pmbuf->pdesc = skb;
 	pmbuf->pbuf = skb->head + sizeof(mlan_buffer);
@@ -4142,6 +4134,20 @@ moal_private *woal_add_interface(moal_handle *handle, t_u8 bss_index,
 #endif
 #endif /*UAP_CFG80211 */
 
+	/* Create workqueue for main process */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+	priv->mclist_workqueue =
+		alloc_workqueue("MCLIST_WORK_QUEUE",
+				WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
+#else
+	priv->mclist_workqueue = create_workqueue("MCLIST_WORK_QUEUE");
+#endif
+	if (!priv->mclist_workqueue) {
+		PRINTM(MERROR, "cannot alloc mclist workqueue \n");
+		goto error;
+	}
+	MLAN_INIT_WORK(&priv->mclist_work, woal_mclist_work_queue);
+
 	/* Initialize priv structure */
 	woal_init_priv(priv, MOAL_IOCTL_WAIT);
 
@@ -4207,9 +4213,14 @@ moal_private *woal_add_interface(moal_handle *handle, t_u8 bss_index,
 	return priv;
 error:
 	handle->priv_num = bss_index;
-#if defined(STA_CFG80211) || defined(UAP_CFG80211)
 	/* Unregister wiphy device and free */
 	if (priv) {
+		if (priv->mclist_workqueue) {
+			flush_workqueue(priv->mclist_workqueue);
+			destroy_workqueue(priv->mclist_workqueue);
+			priv->mclist_workqueue = NULL;
+		}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		if (priv->wdev &&
 		    IS_STA_OR_UAP_CFG80211(handle->params.cfg80211_wext))
 			priv->wdev = NULL;
@@ -4221,8 +4232,8 @@ error:
 		}
 #endif
 #endif
-	}
 #endif
+	}
 	if (dev && dev->reg_state == NETREG_REGISTERED)
 		unregister_netdev(dev);
 	if (dev)
@@ -4310,6 +4321,12 @@ void woal_remove_interface(moal_handle *handle, t_u8 bss_index)
 	if (dev->reg_state == NETREG_REGISTERED)
 		unregister_netdev(dev);
 
+	if (priv->mclist_workqueue) {
+		flush_workqueue(priv->mclist_workqueue);
+		destroy_workqueue(priv->mclist_workqueue);
+		priv->mclist_workqueue = NULL;
+	}
+
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 	/* Unregister wiphy device and free */
 	if (priv->wdev && IS_STA_OR_UAP_CFG80211(handle->params.cfg80211_wext))
@@ -4640,13 +4657,13 @@ int woal_open(struct net_device *dev)
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 #if defined(USB)
-#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 0, 0)
-	struct usb_device *udev =
-		((struct usb_card_rec *)(priv->phandle->card))->udev;
-#else
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
 	struct usb_interface *intf =
 		((struct usb_card_rec *)priv->phandle->card)->intf;
-#endif /* >= 5.0.0 */
+#else
+	struct usb_device *udev =
+		((struct usb_card_rec *)(priv->phandle->card))->udev;
+#endif /* < 2.6.34 */
 #endif /* USB_SUSPEND_RESUME */
 	t_u8 carrier_on = MFALSE;
 
@@ -4660,19 +4677,15 @@ int woal_open(struct net_device *dev)
 	}
 #if defined(USB)
 	if (IS_USB(priv->phandle->card_type)) {
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
 		/* Error enabling PM on interface */
 		if (usb_autopm_get_interface(intf)) {
 			LEAVE();
 			return -EIO;
 		}
-#else
-		atomic_set(&intf->pm_usage_cnt, 1);
-#endif /* < 2.6.34 */
 #else
 		atomic_set(&udev->dev.power.usage_count, 1);
-#endif /* 5.0. 0 */
+#endif /* < 2.6.34 */
 	}
 #endif /* USB_SUSPEND_RESUME */
 
@@ -4743,13 +4756,13 @@ int woal_close(struct net_device *dev)
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 #if defined(USB)
-#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 0, 0)
-	struct usb_device *udev =
-		((struct usb_card_rec *)(priv->phandle->card))->udev;
-#else
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
 	struct usb_interface *intf =
 		((struct usb_card_rec *)priv->phandle->card)->intf;
-#endif /* < 5.0.0 */
+#else
+	struct usb_device *udev =
+		((struct usb_card_rec *)(priv->phandle->card))->udev;
+#endif /* < 2.6.34 */
 #endif /* USB_SUSPEND_RESUME */
 #ifdef STA_CFG80211
 	int cfg80211_wext = priv->phandle->params.cfg80211_wext;
@@ -4797,15 +4810,11 @@ int woal_close(struct net_device *dev)
 	MODULE_PUT;
 #if defined(USB)
 	if (IS_USB(priv->phandle->card_type)) {
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
 		usb_autopm_put_interface(intf);
-#else
-		atomic_set(&intf->pm_usage_cnt, 0);
-#endif /* < 2.6.34 */
 #else
 		atomic_set(&udev->dev.power.usage_count, 0);
-#endif /* < 5.0.0 */
+#endif /* < 2.6.34 */
 	}
 #endif /* USB_SUSPEND_RESUME */
 
@@ -5104,6 +5113,7 @@ void woal_mlan_debug_info(moal_private *priv)
 	PRINTM(MERROR, "max_tx_buf_size = %d\n", info->max_tx_buf_size);
 	PRINTM(MERROR, "tx_buf_size = %d\n", info->tx_buf_size);
 	PRINTM(MERROR, "curr_tx_buf_size = %d\n", info->curr_tx_buf_size);
+	PRINTM(MERROR, "bypass_pkt_count=%d\n", info->bypass_pkt_count);
 
 	PRINTM(MERROR, "data_sent=%d cmd_sent=%d\n", info->data_sent,
 	       info->cmd_sent);
@@ -5756,9 +5766,7 @@ static int woal_process_tcp_ack(moal_private *priv, mlan_buffer *pmbuf)
 			tcp_session->ack_seq = ack_seq;
 			ret = DROP_TCP_ACK;
 			skb->cb[0]++;
-// We will drop 90% tcp ack
-#define TCP_ACK_MAX_HOLD 9
-			if (skb->cb[0] >= TCP_ACK_MAX_HOLD)
+			if (skb->cb[0] >= priv->tcp_ack_max_hold)
 				woal_send_tcp_ack(priv, tcp_session);
 			spin_unlock_irqrestore(&priv->tcp_sess_lock, flags);
 			skb = (struct sk_buff *)pmbuf->pdesc;
@@ -5806,7 +5814,9 @@ static int woal_start_xmit(moal_private *priv, struct sk_buff *skb)
 	}
 	// kernel crash with cloned skb without copy
 	// uap0  <-->muap0 bridge
-	if ((skb->cloned &&
+	/* STA role need skb copy to improve throughput.but uAP unicast not */
+	if ((skb->cloned && priv->bss_role == MLAN_BSS_ROLE_STA) ||
+	    (skb->cloned && priv->bss_role == MLAN_BSS_ROLE_UAP &&
 	     (!is_unicast_ether_addr(((struct ethhdr *)skb->data)->h_dest))) ||
 	    (skb_headroom(skb) <
 	     (MLAN_MIN_DATA_HEADER_LEN + sizeof(mlan_buffer) +
@@ -6145,7 +6155,7 @@ void woal_set_multicast_list(struct net_device *dev)
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	ENTER();
-	woal_request_set_multicast_list(priv, dev);
+	queue_work(priv->mclist_workqueue, &priv->mclist_work);
 	LEAVE();
 }
 #endif
@@ -6226,6 +6236,7 @@ void woal_init_priv(moal_private *priv, t_u8 wait_option)
 #endif
 
 	priv->enable_tcp_ack_enh = MTRUE;
+	priv->tcp_ack_max_hold = TCP_ACK_MAX_HOLD;
 
 	priv->enable_auto_tdls = MFALSE;
 	priv->tdls_check_tx = MFALSE;
@@ -6611,6 +6622,7 @@ static int woal_get_card_info(moal_handle *phandle)
 #ifdef SD9177
 	case CARD_TYPE_SD9177:
 		phandle->card_info = &card_info_SD9177;
+		phandle->event_fw_dump = MFALSE;
 		break;
 #endif
 #ifdef PCIE8997
@@ -7397,10 +7409,10 @@ t_void woal_store_ssu_dump(moal_handle *phandle, mlan_event *pmevent)
 #else
 	vfs_mkdir(&init_user_ns, path.dentry->d_inode, dentry, 0777);
 #endif
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 7, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
 	mutex_unlock(&path.dentry->d_inode->i_mutex);
 #else
-	inode_unlock(path.dentry->d_inode);
+	done_path_create(&path, dentry);
 #endif
 
 save_ssudump:
@@ -7863,6 +7875,7 @@ static int woal_dump_mlan_drv_info(moal_private *priv, t_u8 *buf)
 	ptr += sprintf(ptr, "max_tx_buf_size = %d\n", info->max_tx_buf_size);
 	ptr += sprintf(ptr, "tx_buf_size = %d\n", info->tx_buf_size);
 	ptr += sprintf(ptr, "curr_tx_buf_size = %d\n", info->curr_tx_buf_size);
+	ptr += sprintf(ptr, "bypass_pkt_count=%d\n", info->bypass_pkt_count);
 
 	ptr += sprintf(ptr, "data_sent=%d cmd_sent=%d\n", info->data_sent,
 		       info->cmd_sent);
@@ -8010,7 +8023,10 @@ static int woal_dump_moal_hex(moal_handle *phandle, t_u8 *buf)
 	ptr += sprintf(ptr, "<--moal_handle End-->\n");
 
 	for (i = 0; i < phandle->priv_num; i++) {
-		ptr += sprintf(ptr, "<--moal_private(%d)-->\n", i);
+		if (!phandle->priv[i])
+			continue;
+		ptr += sprintf(ptr, "<--moal_private(%d) %s-->\n", i,
+			       phandle->priv[i]->netdev->name);
 		ptr += sprintf(ptr, "moal_private=%p, size=%ld(0x%lx)\n",
 			       phandle->priv[i],
 			       (long int)sizeof(*(phandle->priv[i])),
@@ -8133,10 +8149,10 @@ void woal_create_dump_dir(moal_handle *phandle, char *dir_buf, int buf_size)
 #else
 	ret = vfs_mkdir(&init_user_ns, path.dentry->d_inode, dentry, 0777);
 #endif
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 7, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
 	mutex_unlock(&path.dentry->d_inode->i_mutex);
 #else
-	inode_unlock(path.dentry->d_inode);
+	done_path_create(&path, dentry);
 #endif
 
 	if (ret < 0) {
@@ -8439,13 +8455,18 @@ void woal_moal_debug_info(moal_private *priv, moal_handle *handle, u8 flag)
 	if (IS_SD(phandle->card_type)) {
 		if (flag && ((phandle->main_state == MOAL_END_MAIN_PROCESS) ||
 			     (phandle->main_state == MOAL_STATE_IDLE))) {
-			if (phandle->ops.reg_dbg && (drvdbg & (MREG_D | MFW_D)))
-				phandle->ops.reg_dbg(phandle);
+			if (phandle->ops.reg_dbg &&
+			    (drvdbg & (MREG_D | MFW_D))) {
+				if (!phandle->event_fw_dump)
+					phandle->ops.reg_dbg(phandle);
+			}
 		} else {
 			if (drvdbg & (MREG_D | MFW_D)) {
-				phandle->reg_dbg = MTRUE;
-				queue_work(phandle->workqueue,
-					   &phandle->main_work);
+				if (!phandle->event_fw_dump) {
+					phandle->reg_dbg = MTRUE;
+					queue_work(phandle->workqueue,
+						   &phandle->main_work);
+				}
 			}
 		}
 	}
@@ -8590,6 +8611,19 @@ static int woal_netdev_poll_rx(struct napi_struct *napi, int budget)
 	return recv;
 }
 
+/**
+ *  @brief This workqueue function handles set multicast_list
+ *
+ *  @param work    A pointer to work_struct
+ *
+ *  @return        N/A
+ */
+t_void woal_mclist_work_queue(struct work_struct *work)
+{
+	moal_private *priv = container_of(work, moal_private, mclist_work);
+	woal_request_set_multicast_list(priv, priv->netdev);
+}
+
 /**
  *  @brief This workqueue function handles woal event queue
  *
@@ -8661,6 +8695,14 @@ t_void woal_evt_work_queue(struct work_struct *work)
 				(moal_private *)evt->priv, &evt->assoc_resp);
 			break;
 #endif
+#endif
+#ifdef UAP_CFG80211
+#if KERNEL_VERSION(3, 12, 0) <= CFG80211_VERSION_CODE
+		case WOAL_EVENT_CANCEL_CHANRPT:
+			woal_process_cancel_chanrpt_event(
+				(moal_private *)evt->priv);
+			break;
+#endif
 #endif
 		}
 		kfree(evt);
@@ -8862,10 +8904,6 @@ void woal_regist_oob_wakeup_irq(moal_handle *handle)
 	}
 
 	disable_irq(handle->irq_oob_wakeup);
-	if (device_init_wakeup(dev, true)) {
-		dev_err(dev, "fail to init irq_oob_wakeup\n");
-		goto err_exit;
-	}
 
 	LEAVE();
 	return;
@@ -8887,7 +8925,6 @@ void woal_unregist_oob_wakeup_irq(moal_handle *handle)
 
 	ENTER();
 	if (handle->irq_oob_wakeup >= 0) {
-		device_init_wakeup(dev, false);
 		devm_free_irq(dev, handle->irq_oob_wakeup, handle);
 	}
 	LEAVE();
@@ -9238,7 +9275,7 @@ moal_handle *woal_add_card(void *card, struct device *dev, moal_if_ops *if_ops,
 		PRINTM(MFATAL, "Firmware Init Failed\n");
 		goto err_init_fw;
 	}
-
+	device_init_wakeup(dev, true);
 #ifdef SD8887
 	if (IS_SD8887(handle->card_type)) {
 		union {
@@ -9325,6 +9362,7 @@ mlan_status woal_remove_card(void *card)
 	}
 	if (!handle)
 		goto exit_remove;
+	device_init_wakeup(handle->hotplug_device, false);
 #ifdef MFG_CMD_SUPPORT
 	if (handle->params.mfg_mode == MLAN_INIT_PARA_ENABLED
 #if defined(USB)
@@ -9589,10 +9627,11 @@ exit_sem_err:
  *  @brief This function reload fw
  *
  *  @param handle   A pointer to moal_handle structure
+ *  @param mode     FW_RELOAD_SDIO_INBAND_RESET or FW_RELOAD_SDIO_HW_RESET
  *
  *  @return        0--success, otherwise failure
  */
-static int woal_reset_and_reload_fw(moal_handle *handle)
+static int woal_reset_and_reload_fw(moal_handle *handle, t_u8 mode)
 {
 	int ret = 0, tries = 0;
 	t_u32 value = 1;
@@ -9600,7 +9639,11 @@ static int woal_reset_and_reload_fw(moal_handle *handle)
 	t_u8 reset_val = handle->card_info->fw_reset_val;
 
 	ENTER();
-
+	if (mode == FW_RELOAD_SDIO_HW_RESET) {
+		PRINTM(MCMND, "woal_sdio_reset_fw...\n");
+		woal_sdio_reset_hw(handle);
+		goto reload_fw;
+	}
 	if (!IS_SD9098(handle->card_type) && !IS_SD9097(handle->card_type) &&
 	    !IS_SD9177(handle->card_type)) {
 		mlan_pm_wakeup_card(handle->pmlan_adapter, MTRUE);
@@ -9647,6 +9690,7 @@ static int woal_reset_and_reload_fw(moal_handle *handle)
 	if (!IS_SD9098(handle->card_type) && !IS_SD9097(handle->card_type) &&
 	    !IS_SD9177(handle->card_type))
 		mlan_pm_wakeup_card(handle->pmlan_adapter, MFALSE);
+reload_fw:
 	/* Download FW */
 	ret = woal_request_fw(handle);
 	if (ret) {
@@ -9828,9 +9872,10 @@ void woal_request_fw_reload(moal_handle *phandle, t_u8 mode)
 			woal_reload_fw(ref_handle);
 	}
 #ifdef SDIO_MMC
-	else if (mode == FW_RELOAD_SDIO_INBAND_RESET &&
+	else if ((mode == FW_RELOAD_SDIO_INBAND_RESET ||
+		  mode == FW_RELOAD_SDIO_HW_RESET) &&
 		 IS_SD(handle->card_type)) {
-		ret = woal_reset_and_reload_fw(handle);
+		ret = woal_reset_and_reload_fw(handle, mode);
 		if (ref_handle)
 			woal_reload_fw(ref_handle);
 	}
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.h b/mxm_wifiex/wlan_src/mlinux/moal_main.h
index aaf918c..186c685 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.h
@@ -231,6 +231,7 @@ typedef t_u8 BOOLEAN;
 #define V15 "15"
 #define V16 "16"
 #define V17 "17"
+#define V18 "18"
 
 /** Chip Magic Value */
 #define CHIP_MAGIC_VALUE 0x24
@@ -954,7 +955,7 @@ typedef struct _wait_queue {
 /**
  * the maximum number of adapter supported
  **/
-#define MAX_MLAN_ADAPTER 3
+#define MAX_MLAN_ADAPTER 4
 
 typedef struct _moal_drv_mode {
 	/** driver mode */
@@ -1013,6 +1014,7 @@ struct debug_data_priv {
 /** IP address operation: Remove */
 #define IPADDR_OP_REMOVE 0
 
+#define TCP_ACK_MAX_HOLD 9
 #define DROP_TCP_ACK 1
 #define HOLD_TCP_ACK 2
 struct tcp_sess {
@@ -1059,6 +1061,11 @@ enum woal_event_type {
 	WOAL_EVENT_ASSOC_RESP,
 #endif
 #endif
+#ifdef UAP_CFG80211
+#if KERNEL_VERSION(3, 12, 0) <= CFG80211_VERSION_CODE
+	WOAL_EVENT_CANCEL_CHANRPT,
+#endif
+#endif
 };
 
 typedef struct _woal_evt_buf {
@@ -1257,6 +1264,10 @@ struct _moal_private {
 	t_u8 current_addr[ETH_ALEN];
 	/** Media connection status */
 	BOOLEAN media_connected;
+	/** mclist work queue */
+	struct workqueue_struct *mclist_workqueue;
+	/** csa work */
+	struct work_struct mclist_work;
 	/** Statistics of tcp ack tx dropped */
 	t_u32 tcp_ack_drop_cnt;
 	/** Statistics of tcp ack tx in total from kernel */
@@ -1327,6 +1338,8 @@ struct _moal_private {
 	t_u8 conn_wep_key[MAX_WEP_KEY_SIZE];
 	/** connection param */
 	struct cfg80211_connect_params sme_current;
+	/** station info */
+	struct station_info *sinfo;
 	/* associcate bss */
 	struct cfg80211_bss *assoc_bss;
 #endif
@@ -1501,6 +1514,8 @@ struct _moal_private {
 	struct list_head tcp_sess_queue;
 	/** TCP Ack enhance flag */
 	t_u8 enable_tcp_ack_enh;
+	/** TCP Ack drop count */
+	t_u8 tcp_ack_max_hold;
 	/** TCP session spin lock */
 	spinlock_t tcp_sess_lock;
 	/** tcp list */
@@ -1882,6 +1897,8 @@ struct _moal_handle {
 	BOOLEAN surprise_removed;
 	/** Firmware release number */
 	t_u32 fw_release_number;
+	/** Firmware Hotfix version */
+	t_u8 fw_hotfix_version;
 	/** ECSA support */
 	t_u8 fw_ecsa_enable;
 	/** Getlog support */
@@ -3165,6 +3182,7 @@ void woal_reassoc_timer_func(void *context);
 t_void woal_main_work_queue(struct work_struct *work);
 t_void woal_rx_work_queue(struct work_struct *work);
 t_void woal_evt_work_queue(struct work_struct *work);
+t_void woal_mclist_work_queue(struct work_struct *work);
 
 netdev_tx_t woal_hard_start_xmit(struct sk_buff *skb, struct net_device *dev);
 #ifdef STA_SUPPORT
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
index ef7e53d..6392759 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
@@ -163,8 +163,8 @@ static t_u16 woal_update_card_type(t_void *card)
 #ifdef PCIE9097
 	if (cardp_pcie->dev->device == PCIE_DEVICE_ID_NXP_88W9097) {
 		card_type = CARD_TYPE_PCIE9097;
-		moal_memcpy_ext(NULL, driver_version, CARD_PCIE9097,
-				strlen(CARD_PCIE9097), strlen(driver_version));
+		moal_memcpy_ext(NULL, driver_version, CARD_PCIEIW620,
+				strlen(CARD_PCIEIW620), strlen(driver_version));
 		moal_memcpy_ext(NULL,
 				driver_version + strlen(INTF_CARDTYPE) +
 					strlen(KERN_VERSION),
@@ -498,6 +498,7 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 {
 	pcie_service_card *cardp;
 	moal_handle *handle = NULL;
+	moal_handle *ref_handle = NULL;
 	int i;
 	int ret = MLAN_STATUS_SUCCESS;
 	int hs_actived;
@@ -505,7 +506,6 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 	int keep_power = 0;
 
 	ENTER();
-	PRINTM(MCMND, "<--- Enter woal_pcie_suspend --->\n");
 	if (pdev) {
 		cardp = (pcie_service_card *)pci_get_drvdata(pdev);
 		if (!cardp || !cardp->handle) {
@@ -519,6 +519,10 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 	}
 
 	handle = cardp->handle;
+	if (handle->second_mac)
+		PRINTM(MCMND, "<--- Enter woal_pcie_suspend# --->\n");
+	else
+		PRINTM(MCMND, "<--- Enter woal_pcie_suspend --->\n");
 	if (handle->is_suspended == MTRUE) {
 		PRINTM(MWARN, "Device already suspended\n");
 		LEAVE();
@@ -533,23 +537,6 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 		if (handle->priv[i] &&
 		    (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA))
 			woal_cancel_scan(handle->priv[i], MOAL_IOCTL_WAIT);
-
-#ifdef PCIE9098
-		if (IS_PCIE9098(handle->card_type)) {
-			if ((cardp->dev->device ==
-			     PCIE_DEVICE_ID_NXP_88W9098P_FN0) ||
-			    (cardp->dev->device ==
-			     PCIE_DEVICE_ID_NXP_88W9098P_FN1)) {
-				if (handle->priv[i] &&
-				    handle->priv[i]->media_connected) {
-					PRINTM(MMSG,
-					       "Suspend not allowed while connected\n");
-					ret = -EBUSY;
-					goto done;
-				}
-			}
-		}
-#endif
 	}
 	handle->suspend_fail = MFALSE;
 	memset(&pm_info, 0, sizeof(pm_info));
@@ -611,7 +598,9 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 #endif /* IMX_SUPPORT */
 	pci_enable_wake(pdev, pci_choose_state(pdev, state), 1);
 	pci_save_state(pdev);
-	pci_set_power_state(pdev, pci_choose_state(pdev, state));
+	ref_handle = (moal_handle *)handle->pref_mac;
+	if (ref_handle && ref_handle->is_suspended)
+		pci_set_power_state(pdev, pci_choose_state(pdev, state));
 done:
 	PRINTM(MCMND, "<--- Leave woal_pcie_suspend --->\n");
 	LEAVE();
@@ -633,8 +622,6 @@ static int woal_pcie_resume(struct pci_dev *pdev)
 	int i;
 
 	ENTER();
-
-	PRINTM(MCMND, "<--- Enter woal_pcie_resume --->\n");
 	if (pdev) {
 		cardp = (pcie_service_card *)pci_get_drvdata(pdev);
 		if (!cardp || !cardp->handle) {
@@ -648,6 +635,10 @@ static int woal_pcie_resume(struct pci_dev *pdev)
 		return -ENOSYS;
 	}
 	handle = cardp->handle;
+	if (handle->second_mac)
+		PRINTM(MCMND, "<--- Enter woal_pcie_resume# --->\n");
+	else
+		PRINTM(MCMND, "<--- Enter woal_pcie_resume --->\n");
 	if (handle->is_suspended == MFALSE) {
 		PRINTM(MWARN, "Device already resumed\n");
 		goto done;
@@ -1003,9 +994,16 @@ static irqreturn_t woal_pcie_interrupt(int irq, void *dev_id)
 	}
 	PRINTM(MINFO, "*** IN PCIE IRQ ***\n");
 	handle->main_state = MOAL_RECV_INT;
-	PRINTM(MINTR, "*\n");
+	if (handle->second_mac)
+		PRINTM(MINTR, "**\n");
+	else
+		PRINTM(MINTR, "*\n");
 
 	ret = mlan_interrupt(0xffff, handle->pmlan_adapter);
+	if (handle->is_suspended) {
+		PRINTM(MINTR, "Receive interrupt in hs_suspended\n");
+		goto exit;
+	}
 	queue_work(handle->workqueue, &handle->main_work);
 
 exit:
@@ -1056,7 +1054,10 @@ static irqreturn_t woal_pcie_msix_interrupt(int irq, void *dev_id)
 	}
 	PRINTM(MINFO, "*** IN PCIE IRQ ***\n");
 	handle->main_state = MOAL_RECV_INT;
-	PRINTM(MINTR, "*\n");
+	if (handle->second_mac)
+		PRINTM(MINTR, "**\n");
+	else
+		PRINTM(MINTR, "*\n");
 	ret = mlan_interrupt(ctx->msg_id, handle->pmlan_adapter);
 	queue_work(handle->workqueue, &handle->main_work);
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_pcie.h b/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
index 9f6011c..4161d72 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
@@ -97,13 +97,13 @@ Change log:
 #define PCIE9097_A0 0x00
 #define PCIE9097_B0 0x01
 #define PCIE9097_B1 0x02
-#define PCIE9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusb9097_combo.bin"
-#define PCIEUART9097_DEFAULT_COMBO_FW_NAME "nxp/pcieuart9097_combo.bin"
-#define PCIEUSB9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusb9097_combo.bin"
-#define PCIEUART9097_COMBO_V1_FW_NAME "nxp/pcieuart9097_combo_v1.bin"
-#define PCIEUSB9097_COMBO_V1_FW_NAME "nxp/pcieusb9097_combo_v1.bin"
-#define PCIE9097_DEFAULT_WLAN_FW_NAME "nxp/pcie9097_wlan.bin"
-#define PCIE9097_WLAN_V1_FW_NAME "nxp/pcie9097_wlan_v1.bin"
+#define PCIE9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw620_combo.bin"
+#define PCIEUART9097_DEFAULT_COMBO_FW_NAME "nxp/pcieuartiw620_combo.bin"
+#define PCIEUSB9097_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw620_combo.bin"
+#define PCIEUART9097_COMBO_V1_FW_NAME "nxp/pcieuartiw620_combo_v1.bin"
+#define PCIEUSB9097_COMBO_V1_FW_NAME "nxp/pcieusbiw620_combo_v1.bin"
+#define PCIE9097_DEFAULT_WLAN_FW_NAME "nxp/pcieiw620_wlan.bin"
+#define PCIE9097_WLAN_V1_FW_NAME "nxp/pcieiw620_wlan_v1.bin"
 #endif /* PCIE9097 */
 
 #if defined(PCIE9098) || defined(PCIE9097)
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_priv.h b/mxm_wifiex/wlan_src/mlinux/moal_priv.h
index 5853db0..5dba96a 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_priv.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_priv.h
@@ -276,200 +276,6 @@ Change log:
 #define WOAL_FROYO_STOP (WOAL_IOCTL + 30)
 #endif
 
-/**
- * iwpriv ioctl handlers
- */
-static const struct iw_priv_args woal_private_args[] = {
-	{WOAL_SETONEINT_GETWORDCHAR, IW_PRIV_TYPE_INT | 1,
-	 IW_PRIV_TYPE_CHAR | 128, ""},
-	{WOAL_VERSION, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128,
-	 "version"},
-	{WOAL_VEREXT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128, "verext"},
-	{WOAL_SETNONE_GETNONE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, ""},
-	{WOAL_WARMRESET, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "warmreset"},
-#ifdef CONFIG_USB_SUSPEND
-	{WOAL_USB_SUSPEND, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "usbsuspend"},
-	{WOAL_USB_RESUME, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "usbresume"},
-#endif /* CONFIG_USB_SUSPEND */
-	{WOAL_SETONEINT_GETONEINT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 ""},
-	{WOAL_SET_GET_TXRATE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "txratecfg"},
-	{WOAL_SET_GET_REGIONCODE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "regioncode"},
-	{WOAL_SET_RADIO, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "radioctrl"},
-	{WOAL_WMM_ENABLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "wmmcfg"},
-	{WOAL_11D_ENABLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "11dcfg"},
-	{WOAL_11D_CLR_CHAN_TABLE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE,
-	 "11dclrtbl"},
-	{WOAL_SET_GET_QOS_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "qoscfg"},
-#ifndef OPCHAN
-	{WOAL_SET_GET_WWS_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "wwscfg"},
-#endif
-#if defined(REASSOCIATION)
-	{WOAL_SET_GET_REASSOC, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "reassoctrl"},
-#endif
-	{WOAL_TXBUF_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "txbufcfg"},
-	{WOAL_SLEEP_PD, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "sleeppd"},
-	{WOAL_AUTH_TYPE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "authtype"},
-	{WOAL_PORT_CTRL, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "port_ctrl"},
-#ifdef WIFI_DIRECT_SUPPORT
-#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
-	{WOAL_SET_GET_BSS_ROLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "bssrole"},
-#endif
-#endif
-	{WOAL_SET_GET_11H_LOCAL_PWR_CONSTRAINT, IW_PRIV_TYPE_INT | 1,
-	 IW_PRIV_TYPE_INT | 1, "powercons"},
-	{WOAL_HT_STREAM_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "htstreamcfg"},
-	{WOAL_MAC_CONTROL, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "macctrl"},
-	{WOAL_THERMAL, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "thermal"},
-	{WOAL_CFG_HOTSPOT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "hotspotcfg"},
-	{WOAL_SET_GET_SIXTEEN_INT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 ""},
-	{WOAL_TX_POWERCFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "txpowercfg"},
-#ifdef DEBUG_LEVEL1
-	{WOAL_DRV_DBG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16, "drvdbg"},
-#endif
-	{WOAL_BEACON_INTERVAL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "bcninterval"},
-	{WOAL_SIGNAL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "getsignal"},
-	{
-		WOAL_DEEP_SLEEP,
-		IW_PRIV_TYPE_INT | 16,
-		IW_PRIV_TYPE_INT | 16,
-		"deepsleep",
-	},
-	{WOAL_11N_TX_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "httxcfg"},
-	{WOAL_11N_HTCAP_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "htcapinfo"},
-	{WOAL_PRIO_TBL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "aggrpriotbl"},
-	{WOAL_11N_AMSDU_AGGR_CTRL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "amsduaggrctrl"},
-	{WOAL_ADDBA_UPDT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "addbapara"},
-	{WOAL_ADDBA_REJECT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "addbareject"},
-	{WOAL_TX_BF_CAP, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "httxbfcap"},
-	{WOAL_HS_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16, "hscfg"},
-	{WOAL_HS_SETPARA, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "hssetpara"},
-	{WOAL_REG_READ_WRITE, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "regrdwr"},
-	{WOAL_BAND_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "bandcfg"},
-	{WOAL_INACTIVITY_TIMEOUT_EXT, IW_PRIV_TYPE_INT | 16,
-	 IW_PRIV_TYPE_INT | 16, "inactivityto"},
-#ifdef SDIO
-	{WOAL_SDIO_CLOCK, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "sdioclock"},
-	{WOAL_CMD_52RDWR, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "sdcmd52rw"},
-#endif
-	{WOAL_SCAN_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "scancfg"},
-	{WOAL_PS_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16, "pscfg"},
-	{WOAL_MEM_READ_WRITE, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "memrdwr"},
-#ifdef SDIO
-	{WOAL_SDIO_MPA_CTRL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "mpactrl"},
-#endif
-	{WOAL_SLEEP_PARAMS, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "sleepparams"},
-	{WOAL_DFS_TESTING, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "dfstesting"},
-	{WOAL_MGMT_FRAME_CTRL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "mgmtframectrl"},
-	{WOAL_CFP_CODE, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "cfpcode"},
-	{WOAL_SET_GET_TX_RX_ANT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "antcfg"},
-	{WOAL_IND_RST_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
-	 "indrstcfg"},
-	{WOALGETLOG, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_CHAR | GETLOG_BUFSIZE,
-	 "getlog"},
-	{WOAL_SETADDR_GETNONE, IW_PRIV_TYPE_ADDR | 1, IW_PRIV_TYPE_NONE, ""},
-	{WOAL_DEAUTH, IW_PRIV_TYPE_ADDR | 1, IW_PRIV_TYPE_NONE, "deauth"},
-	{WOAL_SET_GET_256_CHAR, IW_PRIV_TYPE_CHAR | 256,
-	 IW_PRIV_TYPE_CHAR | 256, ""},
-	{WOAL_PASSPHRASE, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "passphrase"},
-	{WOAL_GET_KEY, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "getkey"},
-	{WOAL_ASSOCIATE, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "associate"},
-	{WOAL_WMM_QUEUE_STATUS, IW_PRIV_TYPE_CHAR | 256,
-	 IW_PRIV_TYPE_CHAR | 256, "qstatus"},
-	{WOAL_WMM_TS_STATUS, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "ts_status"},
-	{WOAL_IP_ADDRESS, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "ipaddr"},
-	{WOAL_TX_BF_CFG, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "httxbfcfg"},
-	{WOAL_SETNONE_GETTWELVE_CHAR, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_CHAR | 12,
-	 ""},
-	{WOAL_WPS_SESSION, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_CHAR | 12,
-	 "wpssession"},
-	{WOAL_SETNONE_GET_FOUR_INT, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_INT | 4,
-	 ""},
-	{WOAL_DATA_RATE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_INT | 4,
-	 "getdatarate"},
-	{WOAL_ESUPP_MODE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_INT | 4, "esuppmode"},
-	{WOAL_SET_GET_64_INT, IW_PRIV_TYPE_INT | 64, IW_PRIV_TYPE_INT | 64, ""},
-	{WOAL_ECL_SYS_CLOCK, IW_PRIV_TYPE_INT | 64, IW_PRIV_TYPE_INT | 64,
-	 "sysclock"},
-	{WOAL_HOST_CMD, IW_PRIV_TYPE_BYTE | 2047, IW_PRIV_TYPE_BYTE | 2047,
-	 "hostcmd"},
-	{WOAL_SET_INTS_GET_CHARS, IW_PRIV_TYPE_INT | 16,
-	 IW_PRIV_TYPE_BYTE | 256, ""},
-	{WOAL_READ_EEPROM, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_BYTE | 256,
-	 "rdeeprom"},
-	{WOAL_SET_GET_2K_BYTES, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, ""},
-#if defined(SDIO)
-	{WOAL_CMD_53RDWR, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "sdcmd53rw"},
-#endif
-	{WOAL_SET_USER_SCAN, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "setuserscan"},
-	{WOAL_GET_SCAN_TABLE, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "getscantable"},
-	{WOAL_SET_USER_SCAN_EXT, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "setuserscanext"},
-	{WOAL_WMM_ADDTS, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "addts"},
-	{WOAL_WMM_DELTS, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "delts"},
-	{WOAL_WMM_QUEUE_CONFIG, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "qconfig"},
-	{WOAL_WMM_QUEUE_STATS, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "qstats"},
-	{WOAL_BYPASSED_PACKET, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
-	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "pb_bypass"},
-#ifdef UAP_WEXT
-	{WOAL_FROYO_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "START"},
-	{WOAL_FROYO_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "STOP"},
-	{WOAL_FROYO_WL_FW_RELOAD, IW_PRIV_TYPE_CHAR | 256,
-	 IW_PRIV_TYPE_CHAR | 256, "WL_FW_RELOAD"},
-#endif
-};
-
 /** moal_802_11_rates  */
 typedef struct _moal_802_11_rates {
 	/** Num of rates */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_proc.c b/mxm_wifiex/wlan_src/mlinux/moal_proc.c
index a8b4c50..3b1c3be 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_proc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_proc.c
@@ -512,6 +512,8 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 	}
 #endif /* SD */
 	if (!strncmp(databuf, "debug_dump", strlen("debug_dump"))) {
+		PRINTM(MERROR, "Recevie debug_dump command\n");
+		handle->driver_status = MTRUE;
 		ref_handle = (moal_handle *)handle->pref_mac;
 		if (ref_handle) {
 			priv = woal_get_priv(ref_handle, MLAN_BSS_ROLE_ANY);
@@ -525,7 +527,6 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 		}
 		priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 		if (priv) {
-			PRINTM(MERROR, "Recevie debug_dump command\n");
 #ifdef DEBUG_LEVEL1
 			drvdbg &= ~MFW_D;
 #endif
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sdio.h b/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
index a8e4882..714ec93 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
@@ -108,10 +108,10 @@ Change log:
 #endif /* SD8897 */
 
 #ifdef SD8978
-#define SD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsd8978_combo.bin"
-#define SDUART8978_DEFAULT_COMBO_FW_NAME "nxp/sduart8978_combo.bin"
-#define SDSD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsd8978_combo.bin"
-#define SD8978_DEFAULT_WLAN_FW_NAME "nxp/sd8978_wlan.bin"
+#define SD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw416_combo.bin"
+#define SDUART8978_DEFAULT_COMBO_FW_NAME "nxp/sduartiw416_combo.bin"
+#define SDSD8978_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw416_combo.bin"
+#define SD8978_DEFAULT_WLAN_FW_NAME "nxp/sdiw416_wlan.bin"
 #endif /* SD8978 */
 
 #ifdef SD9098
@@ -131,20 +131,20 @@ Change log:
 #ifdef SD9097
 #define SD9097_B0 0x01
 #define SD9097_B1 0x02
-#define SD9097_DEFAULT_COMBO_FW_NAME "nxp/sdsd9097_combo_v1.bin"
+#define SD9097_DEFAULT_COMBO_FW_NAME "nxp/sdsdiw620_combo_v1.bin"
 
-#define SD9097_DEFAULT_WLAN_FW_NAME "nxp/sd9097_wlan_v1.bin"
-#define SDUART9097_COMBO_V1_FW_NAME "nxp/sduart9097_combo_v1.bin"
-#define SDSD9097_COMBO_V1_FW_NAME "nxp/sdsd9097_combo_v1.bin"
-#define SD9097_WLAN_V1_FW_NAME "nxp/sd9097_wlan_v1.bin"
+#define SD9097_DEFAULT_WLAN_FW_NAME "nxp/sdiw620_wlan_v1.bin"
+#define SDUART9097_COMBO_V1_FW_NAME "nxp/sduartiw620_combo_v1.bin"
+#define SDSD9097_COMBO_V1_FW_NAME "nxp/sdsdiw620_combo_v1.bin"
+#define SD9097_WLAN_V1_FW_NAME "nxp/sdiw620_wlan_v1.bin"
 #endif /* SD9097 */
 
 #ifdef SD9177
 #define SD9177_A0 0x01
-#define SD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd9177_combo.bin"
-#define SDUART9177_DEFAULT_COMBO_FW_NAME "nxp/sduart9177_combo.bin"
-#define SDSD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd9177_combo.bin"
-#define SD9177_DEFAULT_WLAN_FW_NAME "nxp/sd9177_wlan.bin"
+#define SD9177_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw61x.bin"
+#define SDUART9177_DEFAULT_COMBO_FW_NAME "nxp/sduart_nw61x.bin"
+#define SDSD9177_DEFAULT_COMBO_FW_NAME "sdsd_nw61x.bin"
+#define SD9177_DEFAULT_WLAN_FW_NAME "nxp/sd_w61x.bin"
 /** Device ID for SD9177 */
 #define SD_DEVICE_ID_9177 (0x0205)
 #endif /* SD9177 */
@@ -180,6 +180,7 @@ struct sdio_mmc_card {
 	/** saved host clock value */
 	unsigned int host_clock;
 };
+void woal_sdio_reset_hw(moal_handle *handle);
 #endif /* SDIO_MMC */
 
 /** cmd52 read write */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
index c83b261..2fab6e6 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
@@ -342,8 +342,8 @@ static t_u16 woal_update_card_type(t_void *card)
 #ifdef SD8978
 	if (cardp_sd->func->device == SD_DEVICE_ID_8978) {
 		card_type = CARD_TYPE_SD8978;
-		moal_memcpy_ext(NULL, driver_version, CARD_SD8978,
-				strlen(CARD_SD8978), strlen(driver_version));
+		moal_memcpy_ext(NULL, driver_version, "SDIW416",
+				strlen("SDIW416"), strlen(driver_version));
 		moal_memcpy_ext(
 			NULL,
 			driver_version + strlen(INTF_CARDTYPE) +
@@ -419,7 +419,7 @@ static t_u16 woal_update_card_type(t_void *card)
 			NULL,
 			driver_version + strlen(INTF_CARDTYPE) +
 				strlen(KERN_VERSION),
-			V17, strlen(V17),
+			V18, strlen(V18),
 			strlen(driver_version) -
 				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
 	}
@@ -494,6 +494,10 @@ int woal_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
 		goto err;
 	}
 
+#ifdef IMX_SUPPORT
+	woal_regist_oob_wakeup_irq(card->handle);
+#endif /* IMX_SUPPORT */
+
 	LEAVE();
 	return ret;
 err:
@@ -521,6 +525,9 @@ void woal_sdio_remove(struct sdio_func *func)
 		PRINTM(MINFO, "SDIO func=%d\n", func->num);
 		card = sdio_get_drvdata(func);
 		if (card) {
+#ifdef IMX_SUPPORT
+			woal_unregist_oob_wakeup_irq(card->handle);
+#endif /* IMX_SUPPORT */
 			woal_remove_card(card);
 			kfree(card);
 		}
@@ -717,6 +724,15 @@ int woal_sdio_suspend(struct device *dev)
 		handle->suspend_notify_req = MFALSE;
 #endif
 		if (hs_actived) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 3, 4)
+			if (pm_flags & MMC_PM_WAKE_SDIO_IRQ) {
+				ret = sdio_set_host_pm_flags(
+					func, MMC_PM_WAKE_SDIO_IRQ);
+				PRINTM(MCMND,
+				       "suspend with MMC_PM_WAKE_SDIO_IRQ ret=%d\n",
+				       ret);
+			}
+#endif
 #ifdef MMC_PM_SKIP_RESUME_PROBE
 			PRINTM(MCMND,
 			       "suspend with MMC_PM_KEEP_POWER and MMC_PM_SKIP_RESUME_PROBE\n");
@@ -739,6 +755,9 @@ int woal_sdio_suspend(struct device *dev)
 
 	/* Indicate device suspended */
 	handle->is_suspended = MTRUE;
+#ifdef IMX_SUPPORT
+	woal_enable_oob_wakeup_irq(handle);
+#endif /* IMX_SUPPORT */
 done:
 	PRINTM(MCMND, "<--- Leave woal_sdio_suspend --->\n");
 	LEAVE();
@@ -787,6 +806,9 @@ int woal_sdio_resume(struct device *dev)
 
 	/* Disable Host Sleep */
 	woal_cancel_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY), MOAL_NO_WAIT);
+#ifdef IMX_SUPPORT
+	woal_disable_oob_wakeup_irq(handle);
+#endif /* IMX_SUPPORT */
 	PRINTM(MCMND, "<--- Leave woal_sdio_resume --->\n");
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -1131,10 +1153,14 @@ static void woal_sdiommc_unregister_dev(moal_handle *handle)
 	ENTER();
 	if (handle->card) {
 		struct sdio_mmc_card *card = handle->card;
+		struct sdio_func *func = card->func;
+
 		/* Release the SDIO IRQ */
 		sdio_claim_host(card->func);
 		sdio_release_irq(card->func);
 		sdio_disable_func(card->func);
+		if (handle->driver_status)
+			mmc_hw_reset(func->card->host);
 		sdio_release_host(card->func);
 
 		sdio_set_drvdata(card->func, NULL);
@@ -1570,11 +1596,23 @@ static rdwr_status woal_cmd52_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
 	t_u8 dbg_dump_ctrl_reg = phandle->card_info->dump_fw_ctrl_reg;
 	t_u8 debug_host_ready = phandle->card_info->dump_fw_host_ready;
 
+#ifdef SD9177
+	if (IS_SD9177(phandle->card_type)) {
+		if (phandle->event_fw_dump)
+			debug_host_ready = 0xAA;
+	}
+#endif
 	ret = woal_sdio_writeb(phandle, dbg_dump_ctrl_reg, debug_host_ready);
 	if (ret) {
 		PRINTM(MERROR, "SDIO Write ERR\n");
 		return RDWR_STATUS_FAILURE;
 	}
+#ifdef SD9177
+	if (IS_SD9177(phandle->card_type)) {
+		if (phandle->event_fw_dump)
+			return RDWR_STATUS_SUCCESS;
+	}
+#endif
 	for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
 		ret = woal_sdio_readb(phandle, dbg_dump_ctrl_reg, &ctrl_data);
 		if (ret) {
@@ -2039,6 +2077,18 @@ void woal_dump_firmware_info_v3(moal_handle *phandle)
 		PRINTM(MERROR, "Could not dump firmwware info\n");
 		return;
 	}
+#ifdef SD9177
+	if (IS_SD9177(phandle->card_type)) {
+		if (phandle->event_fw_dump) {
+			if (RDWR_STATUS_FAILURE !=
+			    woal_cmd52_rdwr_firmware(phandle, doneflag)) {
+				PRINTM(MMSG,
+				       "====SDIO FW DUMP EVENT MODE START ====\n");
+				return;
+			}
+		}
+	}
+#endif
 
 	dbg_dump_start_reg = phandle->card_info->dump_fw_start_reg;
 	dbg_dump_end_reg = phandle->card_info->dump_fw_end_reg;
@@ -2276,6 +2326,11 @@ static void woal_sdiommc_dump_fw_info(moal_handle *phandle)
 		woal_dump_firmware_info_v2(phandle);
 	} else if (phandle->card_info->dump_fw_info == DUMP_FW_SDIO_V3) {
 		woal_dump_firmware_info_v3(phandle);
+		if (phandle->event_fw_dump) {
+			phandle->event_fw_dump = MFALSE;
+			queue_work(phandle->workqueue, &phandle->main_work);
+			return;
+		}
 	}
 #ifdef SD8801
 	else {
@@ -2385,6 +2440,45 @@ static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)
 	return drv_ptr - (char *)drv_buf;
 }
 
+/**
+ *  @brief This function reset sdio through sdio bus driver
+ *
+ *  @param phandle   A pointer to moal_handle
+ *
+ *  @return          N/A
+ */
+void woal_sdio_reset_hw(moal_handle *handle)
+{
+	struct sdio_mmc_card *card = handle->card;
+	struct sdio_func *func = card->func;
+	ENTER();
+	sdio_claim_host(func);
+	sdio_release_irq(card->func);
+	sdio_disable_func(card->func);
+	mmc_hw_reset(func->card->host);
+#ifdef MMC_QUIRK_BLKSZ_FOR_BYTE_MODE
+	/* The byte mode patch is available in kernel MMC driver
+	 * which fixes one issue in MP-A transfer.
+	 * bit1: use func->cur_blksize for byte mode
+	 */
+	func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+	/* wait for chip fully wake up */
+	if (!func->enable_timeout)
+		func->enable_timeout = 200;
+#endif
+	sdio_enable_func(func);
+	sdio_claim_irq(func, woal_sdio_interrupt);
+	sdio_set_block_size(card->func, MLAN_SDIO_BLOCK_SIZE);
+	sdio_release_host(func);
+	LEAVE();
+	return;
+}
+
 static moal_if_ops sdiommc_ops = {
 	.register_dev = woal_sdiommc_register_dev,
 	.unregister_dev = woal_sdiommc_unregister_dev,
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_shim.c b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
index 003830f..e76d6ba 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_shim.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
@@ -201,19 +201,21 @@ mlan_status moal_malloc_consistent(t_void *pmoal, t_u32 size, t_u8 **ppbuf,
 {
 	moal_handle *handle = (moal_handle *)pmoal;
 	pcie_service_card *card = (pcie_service_card *)handle->card;
+	dma_addr_t dma;
 	*pbuf_pa = 0;
 
 	if (!card)
 		return MLAN_STATUS_FAILURE;
 
 	*ppbuf = (t_u8 *)pci_alloc_consistent(card->dev, size,
-					      (dma_addr_t *)pbuf_pa);
+					      (dma_addr_t *)&dma);
 	if (*ppbuf == NULL) {
 		PRINTM(MERROR,
 		       "%s: allocate consistent memory (%d bytes) failed!\n",
 		       __func__, (int)size);
 		return MLAN_STATUS_FAILURE;
 	}
+	*pbuf_pa = (t_u64)dma;
 	atomic_inc(&handle->malloc_cons_count);
 
 	return MLAN_STATUS_SUCCESS;
@@ -1644,6 +1646,8 @@ static void moal_connection_status_check_pmqos(t_void *pmoal)
 	}
 }
 
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
 /**
  * @brief   Handle RX MGMT PKT event
  *
@@ -1673,6 +1677,8 @@ static void woal_rx_mgmt_pkt_event(moal_private *priv, t_u8 *pkt, t_u16 len)
 		queue_work(handle->evt_workqueue, &handle->evt_work);
 	}
 }
+#endif
+#endif
 
 /**
  *  @brief This function handles event receive
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
index f4d6826..87202f1 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
@@ -418,6 +418,8 @@ static const struct ieee80211_regdomain mrvl_regdom = {
 		/* IEEE 802.11a, channel 100..165 */
 		REG_RULE(5470 - 10, 5850 + 10, 80, 6, 20, 0),
 	}};
+
+#define AUTH_TX_DEFAULT_WAIT_TIME 2400
 /********************************************************
 				Local Variables
 ********************************************************/
@@ -1062,14 +1064,7 @@ static mlan_status woal_send_domain_info_cmd_fw(moal_private *priv,
 		goto done;
 	}
 
-	if (MTRUE ==
-	    is_cfg80211_special_region_code(priv->phandle->country_code)) {
-		PRINTM(MIOCTL,
-		       "skip region code config, cfg80211 special region code: %s\n",
-		       priv->phandle->country_code);
-		goto done;
-	}
-	PRINTM(MIOCTL, "Send domain info: country=%c%c band=%d\n",
+	PRINTM(MCMD_D, "Send domain info: country=%c%c band=%d\n",
 	       priv->phandle->country_code[0], priv->phandle->country_code[1],
 	       band);
 	/* Allocate an IOCTL request buffer */
@@ -1083,11 +1078,17 @@ static mlan_status woal_send_domain_info_cmd_fw(moal_private *priv,
 	req->req_id = MLAN_IOCTL_11D_CFG;
 	req->action = MLAN_ACT_SET;
 
-	/* Set country code */
-	cfg_11d->param.domain_info.country_code[0] =
-		priv->phandle->country_code[0];
-	cfg_11d->param.domain_info.country_code[1] =
-		priv->phandle->country_code[1];
+	if (is_cfg80211_special_region_code(priv->phandle->country_code)) {
+		/* Set country code */
+		cfg_11d->param.domain_info.country_code[0] = 'W';
+		cfg_11d->param.domain_info.country_code[1] = 'W';
+	} else {
+		/* Set country code */
+		cfg_11d->param.domain_info.country_code[0] =
+			priv->phandle->country_code[0];
+		cfg_11d->param.domain_info.country_code[1] =
+			priv->phandle->country_code[1];
+	}
 	cfg_11d->param.domain_info.country_code[2] = ' ';
 	cfg_11d->param.domain_info.band = band;
 
@@ -1834,6 +1835,101 @@ static void woal_save_auth_params(moal_private *priv,
 	LEAVE();
 }
 
+/**
+ * @brief Request scan based on auth_request parameter
+ *
+ * @param priv            A pointer to moal_private structure
+ * @param req             A pointer to cfg80211_auth_request
+ * @param wait_option     wait option
+ *
+ * @return                0 -- success, otherwise fail
+ */
+static int woal_cfg80211_auth_scan(moal_private *priv,
+				   struct cfg80211_auth_request *req,
+				   t_u8 wait_option)
+{
+	moal_handle *handle = priv->phandle;
+	int ret = 0;
+	wlan_user_scan_cfg scan_req;
+	enum ieee80211_band band;
+	struct ieee80211_supported_band *sband;
+	struct ieee80211_channel *ch;
+	int chan_idx = 0, i;
+	const u8 *ssid;
+
+	ENTER();
+	if (handle->scan_pending_on_block == MTRUE) {
+		PRINTM(MINFO, "scan already in processing...\n");
+		LEAVE();
+		return ret;
+	}
+#ifdef REASSOCIATION
+	if (MOAL_ACQ_SEMAPHORE_BLOCK(&handle->reassoc_sem)) {
+		PRINTM(MERROR, "Acquire semaphore error, woal_do_combo_scan\n");
+		LEAVE();
+		return -EBUSY;
+	}
+#endif /* REASSOCIATION */
+	priv->report_scan_result = MTRUE;
+	memset(&scan_req, 0x00, sizeof(scan_req));
+	rcu_read_lock();
+	ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+	if (ssid) {
+		moal_memcpy_ext(priv->phandle, scan_req.ssid_list[0].ssid,
+				ssid + 2, ssid[1],
+				sizeof(scan_req.ssid_list[0].ssid));
+		scan_req.ssid_list[0].max_len = 0;
+	}
+	rcu_read_unlock();
+	moal_memcpy_ext(priv->phandle, scan_req.specific_bssid, req->bss->bssid,
+			ETH_ALEN, ETH_ALEN);
+	if (req->bss->channel) {
+		scan_req.chan_list[0].chan_number = req->bss->channel->hw_value;
+		scan_req.chan_list[0].radio_type = req->bss->channel->band;
+		if (req->bss->channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+			scan_req.chan_list[0].scan_type =
+				MLAN_SCAN_TYPE_PASSIVE;
+		else if (req->bss->channel->flags & IEEE80211_CHAN_RADAR)
+			scan_req.chan_list[0].scan_type =
+				MLAN_SCAN_TYPE_PASSIVE_TO_ACTIVE;
+		else
+			scan_req.chan_list[0].scan_type = MLAN_SCAN_TYPE_ACTIVE;
+		scan_req.chan_list[0].scan_time = 0;
+	} else {
+		for (band = 0; (band < IEEE80211_NUM_BANDS); band++) {
+			if (!priv->wdev->wiphy->bands[band])
+				continue;
+			sband = priv->wdev->wiphy->bands[band];
+			for (i = 0; (i < sband->n_channels); i++) {
+				ch = &sband->channels[i];
+				if (ch->flags & IEEE80211_CHAN_DISABLED)
+					continue;
+				scan_req.chan_list[chan_idx].radio_type = band;
+				if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+					scan_req.chan_list[chan_idx].scan_type =
+						MLAN_SCAN_TYPE_PASSIVE;
+				else if (ch->flags & IEEE80211_CHAN_RADAR)
+					scan_req.chan_list[chan_idx].scan_type =
+						MLAN_SCAN_TYPE_PASSIVE_TO_ACTIVE;
+				else
+					scan_req.chan_list[chan_idx].scan_type =
+						MLAN_SCAN_TYPE_ACTIVE;
+				scan_req.chan_list[chan_idx].chan_number =
+					(u32)ch->hw_value;
+				chan_idx++;
+			}
+		}
+	}
+	moal_memcpy_ext(priv->phandle, scan_req.random_mac, priv->random_mac,
+			ETH_ALEN, sizeof(scan_req.random_mac));
+	ret = woal_request_userscan(priv, wait_option, &scan_req);
+#ifdef REASSOCIATION
+	MOAL_REL_SEMAPHORE(&handle->reassoc_sem);
+#endif
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief This function is authentication handler when host MLME
  *          enable.
@@ -1910,10 +2006,14 @@ static int woal_cfg80211_authenticate(struct wiphy *wiphy,
 		}
 	}
 	if (MLAN_STATUS_SUCCESS != woal_find_bssid(priv, req->bss->bssid)) {
-		PRINTM(MMSG, "bssid not find in scan list\n");
-		kfree(ssid_bssid);
-		LEAVE();
-		return -EFAULT;
+		woal_cfg80211_auth_scan(priv, req, MOAL_IOCTL_WAIT);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_find_bssid(priv, req->bss->bssid)) {
+			PRINTM(MMSG, "bssid not find in scan list\n");
+			kfree(ssid_bssid);
+			LEAVE();
+			return -EFAULT;
+		}
 	}
 	kfree(ssid_bssid);
 
@@ -2041,7 +2141,6 @@ static int woal_cfg80211_authenticate(struct wiphy *wiphy,
 		}
 	}
 
-#define AUTH_TX_DEFAULT_WAIT_TIME 1200
 	if (priv->auth_flag == 0) {
 		if (woal_cfg80211_remain_on_channel_cfg(
 			    priv, MOAL_IOCTL_WAIT, MFALSE, (t_u8 *)&status,
@@ -3152,6 +3251,15 @@ static mlan_status woal_cfg80211_dump_station_info(moal_private *priv,
 #endif
 
 	ENTER();
+
+	if (priv->phandle->scan_pending_on_block) {
+		if (priv->sinfo)
+			moal_memcpy_ext(priv->phandle, sinfo, priv->sinfo,
+					sizeof(struct station_info),
+					sizeof(struct station_info));
+		LEAVE();
+		return ret;
+	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
 	sinfo->filled = MBIT(NL80211_STA_INFO_RX_BYTES) |
 			MBIT(NL80211_STA_INFO_TX_BYTES) |
@@ -3227,6 +3335,11 @@ static mlan_status woal_cfg80211_dump_station_info(moal_private *priv,
 	sinfo->bss_param.dtim_period = dtim_period;
 #endif
 	woal_cfg80211_fill_rate_info(priv, sinfo);
+	if (priv->sinfo)
+		moal_memcpy_ext(priv->phandle, priv->sinfo, sinfo,
+				sizeof(struct station_info),
+				sizeof(struct station_info));
+
 done:
 	LEAVE();
 	return ret;
@@ -3439,10 +3552,8 @@ create_custom_regdomain(mlan_ds_custom_reg_domain *custom_reg)
 		rule->power_rule.max_eirp = DBM_TO_MBM(19);
 		rule->flags = 0;
 
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 		if (chflags & NXP_CHANNEL_PASSIVE)
 			rule->flags |= NL80211_RRF_NO_IR;
-#endif
 		if (chflags & NXP_CHANNEL_DFS)
 			rule->flags |= NL80211_RRF_DFS;
 		if (chflags & NXP_CHANNEL_NO_OFDM)
@@ -3461,8 +3572,24 @@ create_custom_regdomain(mlan_ds_custom_reg_domain *custom_reg)
 		regd->alpha2[0] = custom_reg->region.country_code[0];
 		regd->alpha2[1] = custom_reg->region.country_code[1];
 	}
-	PRINTM(MCMND, "create_custom_regdomain: %c%c rules=%d\n",
-	       regd->alpha2[0], regd->alpha2[1], valid_rules);
+
+	switch (custom_reg->region.dfs_region) {
+	case 1:
+		regd->dfs_region = NL80211_DFS_FCC;
+		break;
+	case 2:
+		regd->dfs_region = NL80211_DFS_ETSI;
+		break;
+	case 3:
+		regd->dfs_region = NL80211_DFS_JP;
+		break;
+	default:
+		regd->dfs_region = NL80211_DFS_UNSET;
+		break;
+	}
+
+	PRINTM(MCMND, "create_custom_regdomain: %c%c rules=%d dfs_region=%d\n",
+	       regd->alpha2[0], regd->alpha2[1], valid_rules, regd->dfs_region);
 	for (idx = 0; idx < (int)regd->n_reg_rules; idx++) {
 		rule = &regd->reg_rules[idx];
 		freq_range = &rule->freq_range;
@@ -3473,6 +3600,10 @@ create_custom_regdomain(mlan_ds_custom_reg_domain *custom_reg)
 		       freq_range->end_freq_khz - freq_range->start_freq_khz,
 		       freq_range->max_bandwidth_khz);
 	}
+	if (!regd->n_reg_rules) {
+		kfree(regd);
+		regd = NULL;
+	}
 	return regd;
 }
 
@@ -3535,12 +3666,10 @@ static int woal_update_custom_regdomain(moal_private *priv, struct wiphy *wiphy)
 		    country_code[0] ||
 	    misc->param.custom_reg_domain.region.country_code[1] !=
 		    country_code[1]) {
-		PRINTM(MERROR, "country code %c%c not match %c%c\n",
+		PRINTM(MCMND, "FW country code %c%c not match %c%c\n",
 		       misc->param.custom_reg_domain.region.country_code[0],
 		       misc->param.custom_reg_domain.region.country_code[1],
 		       country_code[0], country_code[1]);
-		ret = -EFAULT;
-		goto done;
 	}
 	regd = create_custom_regdomain(&misc->param.custom_reg_domain);
 	if (regd) {
@@ -3675,6 +3804,10 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
 		break;
 	case NL80211_REGDOM_SET_BY_CORE:
 		PRINTM(MCMND, "Regulatory domain BY_CORE\n");
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+		if (handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE)
+			woal_update_custom_regdomain(priv, wiphy);
+#endif
 		break;
 	case NL80211_REGDOM_SET_BY_USER:
 		PRINTM(MCMND, "Regulatory domain BY_USER\n");
@@ -3688,8 +3821,7 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
 		break;
 	}
 	if (priv->wdev && priv->wdev->wiphy &&
-	    (request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) &&
-	    (MTRUE != is_cfg80211_special_region_code(region))) {
+	    (request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
 		band = priv->phandle->band;
 		priv->phandle->band = IEEE80211_BAND_2GHZ;
 		woal_send_domain_info_cmd_fw(priv, MOAL_IOCTL_WAIT);
@@ -3933,6 +4065,36 @@ static t_u8 woal_is_scan_result_expired(moal_private *priv)
 	return MFALSE;
 }
 
+/**
+ *  @brief check if the scan result ageout
+ *
+ *  @param priv         A pointer to moal_private
+ *
+ *
+ *  @return             MTRUE/MFALSE;
+ */
+t_u8 wlan_check_scan_table_ageout(moal_private *priv)
+{
+	mlan_scan_resp scan_resp;
+	wifi_timeval t;
+	ENTER();
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_scan_table(priv, MOAL_IOCTL_WAIT, &scan_resp)) {
+		LEAVE();
+		return MFALSE;
+	}
+	woal_get_monotonic_time(&t);
+#define CFG80211_SCAN_RESULT_AGEOUT 10
+	if (t.time_sec >
+	    (scan_resp.age_in_secs + CFG80211_SCAN_RESULT_AGEOUT)) {
+		LEAVE();
+		return MFALSE;
+	}
+	PRINTM(MCMND, "Scan: Keep Previous result\n");
+	LEAVE();
+	return MTRUE;
+}
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 /**
  * @brief Request the driver to do a scan. Always returning
@@ -4049,16 +4211,13 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 	}
 #endif
 
-	if (priv->phandle->scan_request->n_channels <= 38)
-		scan_req->ext_scan_type = EXT_SCAN_ENHANCE;
-
 	memset(&scan_cfg, 0, sizeof(mlan_scan_cfg));
+	woal_get_scan_config(priv, &scan_cfg);
 #ifdef WIFI_DIRECT_SUPPORT
 	if (priv->phandle->miracast_mode)
 		scan_req->scan_chan_gap = priv->phandle->scan_chan_gap;
 	else {
 #endif
-		woal_get_scan_config(priv, &scan_cfg);
 		if (scan_cfg.scan_chan_gap)
 			scan_req->scan_chan_gap = scan_cfg.scan_chan_gap;
 		else if (woal_is_any_interface_active(priv->phandle))
@@ -4072,6 +4231,12 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 	if (scan_req->scan_chan_gap && priv->phandle->pref_mac)
 		scan_req->scan_chan_gap |= GAP_FLAG_OPTIONAL;
 
+	if (priv->phandle->scan_request->n_channels <= 38 &&
+	    !woal_is_any_interface_active(priv->phandle)) {
+		if (scan_cfg.ext_scan == 3)
+			scan_req->ext_scan_type = EXT_SCAN_ENHANCE;
+	}
+
 	for (i = 0; i < priv->phandle->scan_request->n_ssids; i++) {
 		moal_memcpy_ext(priv->phandle, scan_req->ssid_list[i].ssid,
 				priv->phandle->scan_request->ssids[i].ssid,
@@ -4108,6 +4273,8 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 		else
 			scan_req->chan_list[i].scan_type =
 				MLAN_SCAN_TYPE_ACTIVE;
+		PRINTM(MCMD_D, "cfg80211_scan: chan=%d chan->flag=0x%x\n",
+		       chan->hw_value, chan->flags);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
 		scan_req->chan_list[i].scan_time =
 			priv->phandle->scan_request->duration;
@@ -4203,6 +4370,8 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 
 	PRINTM(MCMND, "wlan:random_mac " MACSTR "\n",
 	       MAC2STR(scan_req->random_mac));
+	scan_req->keep_previous_scan = wlan_check_scan_table_ageout(priv);
+
 	if (MLAN_STATUS_SUCCESS != woal_do_scan(priv, scan_req)) {
 		PRINTM(MERROR, "woal_do_scan fails!\n");
 		ret = -EAGAIN;
@@ -4474,7 +4643,6 @@ static int woal_connect_ft_over_air(moal_private *priv, t_u8 *bssid,
 	woal_mgmt_frame_register(priv, IEEE80211_STYPE_AUTH, MTRUE);
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-#define AUTH_TX_DEFAULT_WAIT_TIME 1200
 	woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MFALSE, &status,
 					    chan, 0, AUTH_TX_DEFAULT_WAIT_TIME);
 #endif
@@ -8191,6 +8359,10 @@ void woal_save_conn_params(moal_private *priv,
 				sme->key, sme->key_len,
 				sizeof(priv->conn_wep_key));
 	}
+	if (priv->sinfo)
+		memset(priv->sinfo, 0, sizeof(struct station_info));
+	else
+		priv->sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
 }
 
 /**
@@ -8206,6 +8378,10 @@ void woal_clear_conn_params(moal_private *priv)
 	memset(&priv->sme_current, 0, sizeof(struct cfg80211_connect_params));
 	priv->roaming_required = MFALSE;
 	priv->assoc_bss = NULL;
+	if (priv->sinfo) {
+		kfree(priv->sinfo);
+		priv->sinfo = NULL;
+	}
 	LEAVE();
 }
 
@@ -8850,6 +9026,7 @@ mlan_status woal_register_sta_cfg80211(struct net_device *dev, t_u8 bss_type)
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	struct wireless_dev *wdev = NULL;
 	int psmode = 0;
+	enum ieee80211_band band;
 
 	ENTER();
 
@@ -8887,6 +9064,14 @@ mlan_status woal_register_sta_cfg80211(struct net_device *dev, t_u8 bss_type)
 		else
 			priv->wdev->ps = MFALSE;
 	}
+	if (priv->phandle->country_code[0] && priv->phandle->country_code[1]) {
+		band = priv->phandle->band;
+		priv->phandle->band = IEEE80211_BAND_2GHZ;
+		woal_send_domain_info_cmd_fw(priv, MOAL_IOCTL_WAIT);
+		priv->phandle->band = IEEE80211_BAND_5GHZ;
+		woal_send_domain_info_cmd_fw(priv, MOAL_IOCTL_WAIT);
+		priv->phandle->band = band;
+	}
 	LEAVE();
 	return ret;
 }
@@ -9368,9 +9553,8 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 	}
 #endif
 
-	priv->phandle->country_code[0] = '0';
-	priv->phandle->country_code[1] = '0';
-	priv->phandle->country_code[2] = ' ';
+	memset(&priv->phandle->country_code, 0,
+	       sizeof(priv->phandle->country_code));
 
 	if (reg_alpha2 && !strncmp(reg_alpha2, "99", strlen("99"))) {
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
index 394e0f9..8624d11 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
@@ -83,6 +83,65 @@ done:
 	return ret;
 }
 
+/**
+ * @brief send deauth to station, that has been added and associated
+ *
+ * @param                 A pointer to moal_private
+ * @param mac			        A pointer to station mac address
+ * @param reason_code     ieee deauth reason code
+ * @return                0 -- success, otherwise fail
+ */
+static int woal_deauth_assoc_station(moal_private *priv, u8 *mac_addr,
+				     u16 reason_code)
+{
+	int ret = -EFAULT;
+	int i = 0;
+	mlan_ds_get_info *info = NULL;
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!mac_addr) {
+		LEAVE();
+		return -EINVAL;
+	}
+
+	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
+		sizeof(mlan_ds_get_info));
+	if (ioctl_req == NULL) {
+		LEAVE();
+		return -ENOMEM;
+	}
+
+	info = (mlan_ds_get_info *)ioctl_req->pbuf;
+	info->sub_command = MLAN_OID_UAP_STA_LIST;
+	ioctl_req->req_id = MLAN_IOCTL_GET_INFO;
+	ioctl_req->action = MLAN_ACT_GET;
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS)
+		goto done;
+	if (!info->param.sta_list.sta_count) {
+		PRINTM(MCMND, "wlan: skip deauth to station " MACSTR "\n",
+		       MAC2STR(mac_addr));
+		goto done;
+	}
+
+	for (i = 0; i < info->param.sta_list.sta_count; i++) {
+		if (!memcmp(info->param.sta_list.info[i].mac_address, mac_addr,
+			    ETH_ALEN))
+			ret = woal_deauth_station(priv, mac_addr, reason_code);
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
 /**
  * @brief send deauth to all station
  *
@@ -569,6 +628,26 @@ static IEEEtypes_VHTCap_t *woal_get_vhtcap_info(const t_u8 *ie, int len)
 	return vhtcap_ie;
 }
 
+/**
+ * @brief get vht_oper from beacon ie
+ *
+ * @param ie              Pointer to IEs
+ * @param len             Total length of ie
+ *
+ * @return                Pointer to vht_opr ie
+ */
+static IEEEtypes_VHTOprat_t *woal_get_vht_oprat_ie(const t_u8 *ie, int len)
+{
+	IEEEtypes_VHTOprat_t *vht_oprat_ie = NULL;
+	vht_oprat_ie = (IEEEtypes_VHTOprat_t *)woal_parse_ie_tlv(ie, len,
+								 VHT_OPERATION);
+	if (vht_oprat_ie)
+		PRINTM(MMSG,
+		       "Get vht_oprat_ie from beacon ies: chan_width=%d\n",
+		       vht_oprat_ie->chan_width);
+	return vht_oprat_ie;
+}
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
 /** Starting Frequency for 11A band */
 #define START_FREQ_11A_BAND 5000 /* in MHz */
@@ -753,6 +832,7 @@ static int woal_cfg80211_beacon_config(moal_private *priv,
 	t_u8 enable_11ac = MFALSE;
 	t_u8 vht20_40 = MFALSE;
 	IEEEtypes_VHTCap_t *vhtcap_ie = NULL;
+	IEEEtypes_VHTOprat_t *vhtopr_ie = NULL;
 	IEEEtypes_HECap_t *hecap_ie = NULL;
 	t_u8 enable_11ax = MFALSE;
 	t_u8 *wapi_ie = NULL;
@@ -1025,32 +1105,30 @@ static int woal_cfg80211_beacon_config(moal_private *priv,
 		} else {
 			sys_config->bandcfg.chan2Offset = 0;
 		}
-		if (priv->bss_type == MLAN_BSS_TYPE_UAP) {
-			ht_cap = woal_get_htcap_info(ie, ie_len);
-			if (ht_cap) {
-				if (sys_config->bandcfg.chanBand == BAND_2GHZ)
-					sys_config->ht_cap_info =
-						(ht_cap &
-						 (wiphy->bands[IEEE80211_BAND_2GHZ]
-							  ->ht_cap.cap &
-						  0x13ff)) |
-						0x0c;
-				else
-					sys_config->ht_cap_info =
-						(ht_cap &
-						 (wiphy->bands[IEEE80211_BAND_5GHZ]
-							  ->ht_cap.cap &
-						  0x13ff)) |
-						0x0c;
-			}
-			PRINTM(MCMND,
-			       "11n=%d, ht_cap=0x%x, channel=%d, bandcfg:chanBand=0x%x chanWidth=0x%x chan2Offset=0x%x scanMode=0x%x\n",
-			       enable_11n, sys_config->ht_cap_info,
-			       priv->channel, sys_config->bandcfg.chanBand,
-			       sys_config->bandcfg.chanWidth,
-			       sys_config->bandcfg.chan2Offset,
-			       sys_config->bandcfg.scanMode);
+		ht_cap = woal_get_htcap_info(ie, ie_len);
+		if (ht_cap) {
+			if (sys_config->bandcfg.chanBand == BAND_2GHZ)
+				sys_config->ht_cap_info =
+					(ht_cap &
+					 (wiphy->bands[IEEE80211_BAND_2GHZ]
+						  ->ht_cap.cap &
+					  0x13ff)) |
+					0x0c;
+			else
+				sys_config->ht_cap_info =
+					(ht_cap &
+					 (wiphy->bands[IEEE80211_BAND_5GHZ]
+						  ->ht_cap.cap &
+					  0x13ff)) |
+					0x0c;
 		}
+		PRINTM(MCMND,
+		       "11n=%d, ht_cap=0x%x, channel=%d, bandcfg:chanBand=0x%x chanWidth=0x%x chan2Offset=0x%x scanMode=0x%x\n",
+		       enable_11n, sys_config->ht_cap_info, priv->channel,
+		       sys_config->bandcfg.chanBand,
+		       sys_config->bandcfg.chanWidth,
+		       sys_config->bandcfg.chan2Offset,
+		       sys_config->bandcfg.scanMode);
 	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 	if (!params->ssid || !params->ssid_len) {
@@ -1260,6 +1338,10 @@ static int woal_cfg80211_beacon_config(moal_private *priv,
 	}
 	if (enable_11ac && enable_11n) {
 		vhtcap_ie = woal_get_vhtcap_info(ie, ie_len);
+		vhtopr_ie = woal_get_vht_oprat_ie(ie, ie_len);
+		// Enable VHT80
+		if (vhtopr_ie && vhtopr_ie->chan_width)
+			vht20_40 = 0;
 		woal_uap_set_11ac_status(priv, MLAN_ACT_ENABLE, vht20_40,
 					 vhtcap_ie);
 	} else {
@@ -1546,6 +1628,20 @@ int woal_cfg80211_add_virt_if(struct wiphy *wiphy,
 	new_priv->bss_virtual = MTRUE;
 	new_priv->pa_netdev = priv->netdev;
 
+	/* Create workqueue for main process */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+	new_priv->mclist_workqueue =
+		alloc_workqueue("MCLIST_WORK_QUEUE",
+				WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
+#else
+	new_priv->mclist_workqueue = create_workqueue("MCLIST_WORK_QUEUE");
+#endif
+	if (!new_priv->mclist_workqueue) {
+		PRINTM(MERROR, "cannot alloc mclist workqueue \n");
+		return -EFAULT;
+	}
+	MLAN_INIT_WORK(&new_priv->mclist_work, woal_mclist_work_queue);
+
 	woal_init_sta_dev(ndev, new_priv);
 
 	/* Initialize priv structure */
@@ -1717,7 +1813,11 @@ int woal_cfg80211_del_virt_if(struct wiphy *wiphy, struct net_device *dev)
 			}
 		}
 #endif
-
+		if (vir_priv->mclist_workqueue) {
+			flush_workqueue(vir_priv->mclist_workqueue);
+			destroy_workqueue(vir_priv->mclist_workqueue);
+			vir_priv->mclist_workqueue = NULL;
+		}
 		woal_clear_all_mgmt_ies(vir_priv, MOAL_IOCTL_WAIT);
 		woal_cfg80211_deinit_p2p(vir_priv);
 		woal_bss_remove(vir_priv);
@@ -2537,7 +2637,8 @@ int woal_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 #ifdef WIFI_DIRECT_SUPPORT
 		if (!priv->phandle->is_go_timer_set)
 #endif
-			woal_deauth_station(priv, (u8 *)mac_addr, reason_code);
+			woal_deauth_assoc_station(priv, (u8 *)mac_addr,
+						  reason_code);
 	} else {
 		PRINTM(MIOCTL, "del all station\n");
 	}
@@ -3011,6 +3112,36 @@ void woal_csa_work_queue(struct work_struct *work)
 	LEAVE();
 }
 
+/*
+ * @brief  handle WOAL_EVENT_CANCEL_CHANRPT
+ *
+ * @param priv           A pointer moal_private structure
+ *
+ * @return          N/A
+ */
+void woal_process_cancel_chanrpt_event(moal_private *priv)
+{
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
+	if (priv->phandle->is_cac_timer_set &&
+	    priv->bss_index == priv->phandle->cac_bss_index) {
+		woal_cancel_timer(&priv->phandle->cac_timer);
+		priv->phandle->is_cac_timer_set = MFALSE;
+		/* Make sure Chan Report is cancelled */
+		woal_11h_cancel_chan_report_ioctl(priv, MOAL_IOCTL_WAIT);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+		cfg80211_cac_event(priv->netdev, &priv->phandle->dfs_channel,
+				   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
+#else
+		cfg80211_cac_event(priv->netdev, NL80211_RADAR_CAC_ABORTED,
+				   GFP_KERNEL);
+#endif
+		memset(&priv->phandle->dfs_channel, 0,
+		       sizeof(struct cfg80211_chan_def));
+		priv->phandle->cac_bss_index = 0xff;
+	}
+#endif
+}
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
 /**
  * @brief start radar detection
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.h b/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.h
index 259bf0c..ef1dfe9 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.h
@@ -82,47 +82,4 @@ Change log:
 /** Private command ID to stop driver */
 #define WOAL_UAP_FROYO_STOP (WOAL_UAP_IOCTL + 30)
 
-/**
- * iwpriv ioctl handlers
- */
-static const struct iw_priv_args woal_uap_priv_args[] = {
-	{WOAL_UAP_SETNONE_GETNONE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, ""},
-	{WOAL_UAP_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "start"},
-	{WOAL_UAP_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "stop"},
-	{WOAL_AP_BSS_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "bssstart"},
-	{WOAL_AP_BSS_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "bssstop"},
-	{WOAL_UAP_SETONEINT_GETWORDCHAR, IW_PRIV_TYPE_INT | 1,
-	 IW_PRIV_TYPE_CHAR | 128, ""},
-	{WOAL_UAP_VERSION, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128,
-	 "version"},
-	{WOAL_UAP_VEREXT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128,
-	 "verext"},
-#ifdef WIFI_DIRECT_SUPPORT
-#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
-	{WOAL_UAP_SETONEINT_GETONEINT, IW_PRIV_TYPE_INT | 1,
-	 IW_PRIV_TYPE_INT | 1, ""},
-	{WOAL_UAP_SET_GET_BSS_ROLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
-	 "bssrole"},
-#endif
-#endif
-	{WOAL_UAP_SET_GET_256_CHAR, IW_PRIV_TYPE_CHAR | 256,
-	 IW_PRIV_TYPE_CHAR | 256, ""},
-	{WOAL_WL_FW_RELOAD, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "fwreload"},
-	{WOAL_AP_SET_CFG, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
-	 "apcfg"},
-	{WOAL_UAP_HOST_CMD, IW_PRIV_TYPE_BYTE | 2047, IW_PRIV_TYPE_BYTE | 2047,
-	 "hostcmd"},
-	{WOAL_UAP_FROYO_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "START"},
-	{WOAL_UAP_FROYO_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "STOP"},
-	{WOAL_UAP_FROYO_AP_BSS_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE,
-	 "AP_BSS_START"},
-	{WOAL_UAP_FROYO_AP_BSS_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE,
-	 "AP_BSS_STOP"},
-	{WOAL_UAP_FROYO_WL_FW_RELOAD, IW_PRIV_TYPE_CHAR | 256,
-	 IW_PRIV_TYPE_CHAR | 256, "WL_FW_RELOAD"},
-	{WOAL_UAP_FROYO_AP_SET_CFG, IW_PRIV_TYPE_CHAR | 256,
-	 IW_PRIV_TYPE_CHAR | 256, "AP_SET_CFG"},
-};
-
 #endif /* _MOAL_UAP_PRIV_H_ */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
index 9ebfaa0..df0525e 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
@@ -60,6 +60,49 @@ static const chan_to_freq_t chan_to_freq[] = {
 	{165, 5825, 1},
 };
 
+/**
+ * iwpriv ioctl handlers
+ */
+static const struct iw_priv_args woal_uap_priv_args[] = {
+	{WOAL_UAP_SETNONE_GETNONE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, ""},
+	{WOAL_UAP_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "start"},
+	{WOAL_UAP_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "stop"},
+	{WOAL_AP_BSS_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "bssstart"},
+	{WOAL_AP_BSS_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "bssstop"},
+	{WOAL_UAP_SETONEINT_GETWORDCHAR, IW_PRIV_TYPE_INT | 1,
+	 IW_PRIV_TYPE_CHAR | 128, ""},
+	{WOAL_UAP_VERSION, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128,
+	 "version"},
+	{WOAL_UAP_VEREXT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128,
+	 "verext"},
+#ifdef WIFI_DIRECT_SUPPORT
+#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
+	{WOAL_UAP_SETONEINT_GETONEINT, IW_PRIV_TYPE_INT | 1,
+	 IW_PRIV_TYPE_INT | 1, ""},
+	{WOAL_UAP_SET_GET_BSS_ROLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "bssrole"},
+#endif
+#endif
+	{WOAL_UAP_SET_GET_256_CHAR, IW_PRIV_TYPE_CHAR | 256,
+	 IW_PRIV_TYPE_CHAR | 256, ""},
+	{WOAL_WL_FW_RELOAD, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "fwreload"},
+	{WOAL_AP_SET_CFG, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "apcfg"},
+	{WOAL_UAP_HOST_CMD, IW_PRIV_TYPE_BYTE | 2047, IW_PRIV_TYPE_BYTE | 2047,
+	 "hostcmd"},
+	{WOAL_UAP_FROYO_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "START"},
+	{WOAL_UAP_FROYO_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "STOP"},
+	{WOAL_UAP_FROYO_AP_BSS_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE,
+	 "AP_BSS_START"},
+	{WOAL_UAP_FROYO_AP_BSS_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE,
+	 "AP_BSS_STOP"},
+	{WOAL_UAP_FROYO_WL_FW_RELOAD, IW_PRIV_TYPE_CHAR | 256,
+	 IW_PRIV_TYPE_CHAR | 256, "WL_FW_RELOAD"},
+	{WOAL_UAP_FROYO_AP_SET_CFG, IW_PRIV_TYPE_CHAR | 256,
+	 IW_PRIV_TYPE_CHAR | 256, "AP_SET_CFG"},
+};
+
 /** Convertion from frequency to channel */
 #define freq_to_chan(x) ((((x)-2412) / 5) + 1)
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_usb.c b/mxm_wifiex/wlan_src/mlinux/moal_usb.c
index d7a41ce..2544c8a 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.c
@@ -681,9 +681,9 @@ static t_u16 woal_update_card_type(t_void *card)
 	/* Update card type */
 #ifdef USB8801
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8801_PID_1 ||
+		    (__force __le16)USB8801_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8801_PID_2) {
+		    (__force __le16)USB8801_PID_2) {
 		card_type = CARD_TYPE_USB8801;
 		moal_memcpy_ext(NULL, driver_version, CARD_USB8801,
 				strlen(CARD_USB8801), strlen(driver_version));
@@ -697,9 +697,9 @@ static t_u16 woal_update_card_type(t_void *card)
 #endif
 #ifdef USB8897
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8897_PID_1 ||
+		    (__force __le16)USB8897_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8897_PID_2) {
+		    (__force __le16)USB8897_PID_2) {
 		card_type = CARD_TYPE_USB8897;
 		moal_memcpy_ext(NULL, driver_version, CARD_USB8897,
 				strlen(CARD_USB8897), strlen(driver_version));
@@ -713,19 +713,19 @@ static t_u16 woal_update_card_type(t_void *card)
 #endif
 #ifdef USB8997
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8997_PID_1 ||
+		    (__force __le16)USB8997_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8997_PID_2 ||
+		    (__force __le16)USB8997_PID_2 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8997_PID_3 ||
+		    (__force __le16)USB8997_PID_3 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8997_PID_4 ||
+		    (__force __le16)USB8997_PID_4 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8997_PID_5 ||
+		    (__force __le16)USB8997_PID_5 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8997_PID_6 ||
+		    (__force __le16)USB8997_PID_6 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8997V2_PID_1) {
+		    (__force __le16)USB8997V2_PID_1) {
 		card_type = CARD_TYPE_USB8997;
 		moal_memcpy_ext(NULL, driver_version, CARD_USB8997,
 				strlen(CARD_USB8997), strlen(driver_version));
@@ -739,12 +739,12 @@ static t_u16 woal_update_card_type(t_void *card)
 #endif
 #ifdef USB8978
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8978_PID_1 ||
+		    (__force __le16)USB8978_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB8978_PID_2) {
+		    (__force __le16)USB8978_PID_2) {
 		card_type = CARD_TYPE_USB8978;
-		moal_memcpy_ext(NULL, driver_version, CARD_USB8978,
-				strlen(CARD_USB8978), strlen(driver_version));
+		moal_memcpy_ext(NULL, driver_version, "USBIW416",
+				strlen("USBIW416"), strlen(driver_version));
 		moal_memcpy_ext(NULL,
 				driver_version + strlen(INTF_CARDTYPE) +
 					strlen(KERN_VERSION),
@@ -755,9 +755,9 @@ static t_u16 woal_update_card_type(t_void *card)
 #endif
 #ifdef USB9098
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB9098_PID_1 ||
+		    (__force __le16)USB9098_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB9098_PID_2) {
+		    (__force __le16)USB9098_PID_2) {
 		card_type = CARD_TYPE_USB9098;
 		moal_memcpy_ext(NULL, driver_version, CARD_USB9098,
 				strlen(CARD_USB9098), strlen(driver_version));
@@ -771,12 +771,12 @@ static t_u16 woal_update_card_type(t_void *card)
 #endif
 #ifdef USB9097
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB9097_PID_1 ||
+		    (__force __le16)USB9097_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    USB9097_PID_2) {
+		    (__force __le16)USB9097_PID_2) {
 		card_type = CARD_TYPE_USB9097;
-		moal_memcpy_ext(NULL, driver_version, CARD_USB9097,
-				strlen(CARD_USB9097), strlen(driver_version));
+		moal_memcpy_ext(NULL, driver_version, CARD_USBIW620,
+				strlen(CARD_USBIW620), strlen(driver_version));
 		moal_memcpy_ext(NULL,
 				driver_version + strlen(INTF_CARDTYPE) +
 					strlen(KERN_VERSION),
@@ -824,33 +824,33 @@ static int woal_usb_probe(struct usb_interface *intf,
 	/* Check probe is for our device */
 	for (i = 0; woal_usb_table[i].idVendor; i++) {
 		if (woal_cpu_to_le16(udev->descriptor.idVendor) ==
-			    woal_usb_table[i].idVendor &&
+			    (__force __le16)woal_usb_table[i].idVendor &&
 		    woal_cpu_to_le16(udev->descriptor.idProduct) ==
-			    woal_usb_table[i].idProduct) {
+			    (__force __le16)woal_usb_table[i].idProduct) {
 			PRINTM(MMSG, "VID/PID = %X/%X, Boot2 version = %X\n",
 			       woal_cpu_to_le16(udev->descriptor.idVendor),
 			       woal_cpu_to_le16(udev->descriptor.idProduct),
 			       woal_cpu_to_le16(udev->descriptor.bcdDevice));
 			switch (woal_cpu_to_le16(udev->descriptor.idProduct)) {
 #ifdef USB8801
-			case USB8801_PID_1:
+			case (__force __le16)USB8801_PID_1:
 #endif /* USB8801 */
 #ifdef USB8897
-			case USB8897_PID_1:
+			case (__force __le16)USB8897_PID_1:
 #endif /* USB8897 */
 #ifdef USB8997
-			case USB8997_PID_1:
-			case USB8997V2_PID_1:
+			case (__force __le16)USB8997_PID_1:
+			case (__force __le16)USB8997V2_PID_1:
 #endif /* USB8997 */
 #ifdef USB8978
-			case USB8978_PID_1:
-			case USB8978_PID_1_BT:
+			case (__force __le16)USB8978_PID_1:
+			case (__force __le16)USB8978_PID_1_BT:
 #endif /* USB8978 */
 #ifdef USB9098
-			case USB9098_PID_1:
+			case (__force __le16)USB9098_PID_1:
 #endif /* USB9098 */
 #ifdef USB9097
-			case USB9097_PID_1:
+			case (__force __le16)USB9097_PID_1:
 #endif /* USB9097 */
 				/* If skip FW is set, we must return error so
 				 * the next driver can download the FW */
@@ -860,23 +860,23 @@ static int woal_usb_probe(struct usb_interface *intf,
 					usb_cardp->boot_state = USB_FW_DNLD;
 				break;
 #ifdef USB8801
-			case USB8801_PID_2:
+			case (__force __le16)USB8801_PID_2:
 #endif /* USB8801 */
 #ifdef USB8897
-			case USB8897_PID_2:
+			case (__force __le16)USB8897_PID_2:
 #endif /* USB8897 */
 #ifdef USB8997
-			case USB8997_PID_2:
+			case (__force __le16)USB8997_PID_2:
 #endif /* USB8997 */
 #ifdef USB8978
-			case USB8978_PID_2:
-			case USB8978_PID_2_BT:
+			case (__force __le16)USB8978_PID_2:
+			case (__force __le16)USB8978_PID_2_BT:
 #endif /* USB8978 */
 #ifdef USB9098
-			case USB9098_PID_2:
+			case (__force __le16)USB9098_PID_2:
 #endif /* USB9098 */
 #ifdef USB9097
-			case USB9097_PID_2:
+			case (__force __le16)USB9097_PID_2:
 #endif /* USB9097 */
 				usb_cardp->boot_state = USB_FW_READY;
 				break;
@@ -964,7 +964,7 @@ static int woal_usb_probe(struct usb_interface *intf,
 					endpoint->bEndpointAddress;
 				atomic_set(&usb_cardp->tx_data_urb_pending, 0);
 				usb_cardp->tx_data_maxpktsize =
-					woal_le16_to_cpu(
+					(__force int)woal_le16_to_cpu(
 						endpoint->wMaxPacketSize);
 			}
 
@@ -988,8 +988,9 @@ static int woal_usb_probe(struct usb_interface *intf,
 				usb_cardp->tx_cmd_ep =
 					endpoint->bEndpointAddress;
 				atomic_set(&usb_cardp->tx_cmd_urb_pending, 0);
-				usb_cardp->tx_cmd_maxpktsize = woal_le16_to_cpu(
-					endpoint->wMaxPacketSize);
+				usb_cardp->tx_cmd_maxpktsize =
+					(__force int)woal_le16_to_cpu(
+						endpoint->wMaxPacketSize);
 			}
 		}
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_usb.h b/mxm_wifiex/wlan_src/mlinux/moal_usb.h
index 5d20c3f..6e6b1c9 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.h
@@ -4,7 +4,7 @@
  * driver.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -127,10 +127,10 @@ Change Log:
 #endif /* USB8997 */
 
 #ifdef USB8978
-#define USB8978_DEFAULT_COMBO_FW_NAME "nxp/usbusb8978_combo.bin"
-#define USB8978_DEFAULT_WLAN_FW_NAME "nxp/usb8978_wlan.bin"
-#define USBUART8978_DEFAULT_COMBO_FW_NAME "nxp/usbuart8978_combo.bin"
-#define USBUSB8978_DEFAULT_COMBO_FW_NAME "nxp/usbusb8978_combo.bin"
+#define USB8978_DEFAULT_COMBO_FW_NAME "nxp/usbusbiw416_combo.bin"
+#define USB8978_DEFAULT_WLAN_FW_NAME "nxp/usbiw416_wlan.bin"
+#define USBUART8978_DEFAULT_COMBO_FW_NAME "nxp/usbuartiw416_combo.bin"
+#define USBUSB8978_DEFAULT_COMBO_FW_NAME "nxp/usbusbiw416_combo.bin"
 #endif /* USB8978 */
 
 #ifdef USB8897
@@ -155,11 +155,11 @@ Change Log:
 #ifdef USB9097
 #define USB9097_B0 0x01
 #define USB9097_B1 0x02
-#define USB9097_DEFAULT_COMBO_FW_NAME "nxp/usbusb9097_combo_v1.bin"
-#define USB9097_DEFAULT_WLAN_FW_NAME "nxp/usb9097_wlan_v1.bin"
-#define USB9097_WLAN_V1_FW_NAME "nxp/usb9097_wlan_v1.bin"
-#define USBUART9097_COMBO_V1_FW_NAME "nxp/usbuart9097_combo_v1.bin"
-#define USBUSB9097_COMBO_V1_FW_NAME "nxp/usbusb9097_combo_v1.bin"
+#define USB9097_DEFAULT_COMBO_FW_NAME "nxp/usbusbiw620_combo_v1.bin"
+#define USB9097_DEFAULT_WLAN_FW_NAME "nxp/usbiw620_wlan_v1.bin"
+#define USB9097_WLAN_V1_FW_NAME "nxp/usbiw620_wlan_v1.bin"
+#define USBUART9097_COMBO_V1_FW_NAME "nxp/usbuartiw620_combo_v1.bin"
+#define USBUSB9097_COMBO_V1_FW_NAME "nxp/usbusbiw620_combo_v1.bin"
 #endif /* USB9097 */
 
 /** urb context */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_wext.c b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
index d69a112..a99ad47 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
@@ -34,6 +34,203 @@ Change log:
 	 IW_EV_FREQ_LEN + IW_EV_QUAL_LEN + MLAN_MAX_SSID_LENGTH +              \
 	 IW_EV_PARAM_LEN + 40) /* 40 for WPAIE */
 
+/********************************************************
+			Local Variables
+********************************************************/
+/**
+ * iwpriv ioctl handlers
+ */
+static const struct iw_priv_args woal_private_args[] = {
+	{WOAL_SETONEINT_GETWORDCHAR, IW_PRIV_TYPE_INT | 1,
+	 IW_PRIV_TYPE_CHAR | 128, ""},
+	{WOAL_VERSION, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128,
+	 "version"},
+	{WOAL_VEREXT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_CHAR | 128, "verext"},
+	{WOAL_SETNONE_GETNONE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, ""},
+	{WOAL_WARMRESET, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "warmreset"},
+#ifdef CONFIG_USB_SUSPEND
+	{WOAL_USB_SUSPEND, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "usbsuspend"},
+	{WOAL_USB_RESUME, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "usbresume"},
+#endif /* CONFIG_USB_SUSPEND */
+	{WOAL_SETONEINT_GETONEINT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 ""},
+	{WOAL_SET_GET_TXRATE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "txratecfg"},
+	{WOAL_SET_GET_REGIONCODE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "regioncode"},
+	{WOAL_SET_RADIO, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "radioctrl"},
+	{WOAL_WMM_ENABLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "wmmcfg"},
+	{WOAL_11D_ENABLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "11dcfg"},
+	{WOAL_11D_CLR_CHAN_TABLE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE,
+	 "11dclrtbl"},
+	{WOAL_SET_GET_QOS_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "qoscfg"},
+#ifndef OPCHAN
+	{WOAL_SET_GET_WWS_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "wwscfg"},
+#endif
+#if defined(REASSOCIATION)
+	{WOAL_SET_GET_REASSOC, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "reassoctrl"},
+#endif
+	{WOAL_TXBUF_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "txbufcfg"},
+	{WOAL_SLEEP_PD, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "sleeppd"},
+	{WOAL_AUTH_TYPE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "authtype"},
+	{WOAL_PORT_CTRL, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "port_ctrl"},
+#ifdef WIFI_DIRECT_SUPPORT
+#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
+	{WOAL_SET_GET_BSS_ROLE, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "bssrole"},
+#endif
+#endif
+	{WOAL_SET_GET_11H_LOCAL_PWR_CONSTRAINT, IW_PRIV_TYPE_INT | 1,
+	 IW_PRIV_TYPE_INT | 1, "powercons"},
+	{WOAL_HT_STREAM_CFG, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "htstreamcfg"},
+	{WOAL_MAC_CONTROL, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "macctrl"},
+	{WOAL_THERMAL, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1, "thermal"},
+	{WOAL_CFG_HOTSPOT, IW_PRIV_TYPE_INT | 1, IW_PRIV_TYPE_INT | 1,
+	 "hotspotcfg"},
+	{WOAL_SET_GET_SIXTEEN_INT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 ""},
+	{WOAL_TX_POWERCFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "txpowercfg"},
+#ifdef DEBUG_LEVEL1
+	{WOAL_DRV_DBG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16, "drvdbg"},
+#endif
+	{WOAL_BEACON_INTERVAL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "bcninterval"},
+	{WOAL_SIGNAL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "getsignal"},
+	{
+		WOAL_DEEP_SLEEP,
+		IW_PRIV_TYPE_INT | 16,
+		IW_PRIV_TYPE_INT | 16,
+		"deepsleep",
+	},
+	{WOAL_11N_TX_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "httxcfg"},
+	{WOAL_11N_HTCAP_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "htcapinfo"},
+	{WOAL_PRIO_TBL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "aggrpriotbl"},
+	{WOAL_11N_AMSDU_AGGR_CTRL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "amsduaggrctrl"},
+	{WOAL_ADDBA_UPDT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "addbapara"},
+	{WOAL_ADDBA_REJECT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "addbareject"},
+	{WOAL_TX_BF_CAP, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "httxbfcap"},
+	{WOAL_HS_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16, "hscfg"},
+	{WOAL_HS_SETPARA, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "hssetpara"},
+	{WOAL_REG_READ_WRITE, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "regrdwr"},
+	{WOAL_BAND_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "bandcfg"},
+	{WOAL_INACTIVITY_TIMEOUT_EXT, IW_PRIV_TYPE_INT | 16,
+	 IW_PRIV_TYPE_INT | 16, "inactivityto"},
+#ifdef SDIO
+	{WOAL_SDIO_CLOCK, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "sdioclock"},
+	{WOAL_CMD_52RDWR, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "sdcmd52rw"},
+#endif
+	{WOAL_SCAN_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "scancfg"},
+	{WOAL_PS_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16, "pscfg"},
+	{WOAL_MEM_READ_WRITE, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "memrdwr"},
+#ifdef SDIO
+	{WOAL_SDIO_MPA_CTRL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "mpactrl"},
+#endif
+	{WOAL_SLEEP_PARAMS, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "sleepparams"},
+	{WOAL_DFS_TESTING, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "dfstesting"},
+	{WOAL_MGMT_FRAME_CTRL, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "mgmtframectrl"},
+	{WOAL_CFP_CODE, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "cfpcode"},
+	{WOAL_SET_GET_TX_RX_ANT, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "antcfg"},
+	{WOAL_IND_RST_CFG, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_INT | 16,
+	 "indrstcfg"},
+	{WOALGETLOG, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_CHAR | GETLOG_BUFSIZE,
+	 "getlog"},
+	{WOAL_SETADDR_GETNONE, IW_PRIV_TYPE_ADDR | 1, IW_PRIV_TYPE_NONE, ""},
+	{WOAL_DEAUTH, IW_PRIV_TYPE_ADDR | 1, IW_PRIV_TYPE_NONE, "deauth"},
+	{WOAL_SET_GET_256_CHAR, IW_PRIV_TYPE_CHAR | 256,
+	 IW_PRIV_TYPE_CHAR | 256, ""},
+	{WOAL_PASSPHRASE, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "passphrase"},
+	{WOAL_GET_KEY, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "getkey"},
+	{WOAL_ASSOCIATE, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "associate"},
+	{WOAL_WMM_QUEUE_STATUS, IW_PRIV_TYPE_CHAR | 256,
+	 IW_PRIV_TYPE_CHAR | 256, "qstatus"},
+	{WOAL_WMM_TS_STATUS, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "ts_status"},
+	{WOAL_IP_ADDRESS, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "ipaddr"},
+	{WOAL_TX_BF_CFG, IW_PRIV_TYPE_CHAR | 256, IW_PRIV_TYPE_CHAR | 256,
+	 "httxbfcfg"},
+	{WOAL_SETNONE_GETTWELVE_CHAR, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_CHAR | 12,
+	 ""},
+	{WOAL_WPS_SESSION, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_CHAR | 12,
+	 "wpssession"},
+	{WOAL_SETNONE_GET_FOUR_INT, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_INT | 4,
+	 ""},
+	{WOAL_DATA_RATE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_INT | 4,
+	 "getdatarate"},
+	{WOAL_ESUPP_MODE, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_INT | 4, "esuppmode"},
+	{WOAL_SET_GET_64_INT, IW_PRIV_TYPE_INT | 64, IW_PRIV_TYPE_INT | 64, ""},
+	{WOAL_ECL_SYS_CLOCK, IW_PRIV_TYPE_INT | 64, IW_PRIV_TYPE_INT | 64,
+	 "sysclock"},
+	{WOAL_HOST_CMD, IW_PRIV_TYPE_BYTE | 2047, IW_PRIV_TYPE_BYTE | 2047,
+	 "hostcmd"},
+	{WOAL_SET_INTS_GET_CHARS, IW_PRIV_TYPE_INT | 16,
+	 IW_PRIV_TYPE_BYTE | 256, ""},
+	{WOAL_READ_EEPROM, IW_PRIV_TYPE_INT | 16, IW_PRIV_TYPE_BYTE | 256,
+	 "rdeeprom"},
+	{WOAL_SET_GET_2K_BYTES, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, ""},
+#if defined(SDIO)
+	{WOAL_CMD_53RDWR, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "sdcmd53rw"},
+#endif
+	{WOAL_SET_USER_SCAN, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "setuserscan"},
+	{WOAL_GET_SCAN_TABLE, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "getscantable"},
+	{WOAL_SET_USER_SCAN_EXT, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "setuserscanext"},
+	{WOAL_WMM_ADDTS, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "addts"},
+	{WOAL_WMM_DELTS, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "delts"},
+	{WOAL_WMM_QUEUE_CONFIG, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "qconfig"},
+	{WOAL_WMM_QUEUE_STATS, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "qstats"},
+	{WOAL_BYPASSED_PACKET, IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES,
+	 IW_PRIV_TYPE_BYTE | WOAL_2K_BYTES, "pb_bypass"},
+#ifdef UAP_WEXT
+	{WOAL_FROYO_START, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "START"},
+	{WOAL_FROYO_STOP, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_NONE, "STOP"},
+	{WOAL_FROYO_WL_FW_RELOAD, IW_PRIV_TYPE_CHAR | 256,
+	 IW_PRIV_TYPE_CHAR | 256, "WL_FW_RELOAD"},
+#endif
+};
+
 /********************************************************
 			Local Functions
 ********************************************************/