diff --git a/mxm_wifiex/wlan_src/Makefile b/mxm_wifiex/wlan_src/Makefile
index 0b4b973..4e10bdb 100644
--- a/mxm_wifiex/wlan_src/Makefile
+++ b/mxm_wifiex/wlan_src/Makefile
@@ -1,6 +1,6 @@
 #  File: Makefile
 #
-#  Copyright 2008-2020 NXP
+#  Copyright 2008-2021 NXP
 #
 #  This software file (the File) is distributed by NXP
 #  under the terms of the GNU General Public License Version 2, June 1991
@@ -16,13 +16,15 @@
 #  this warranty disclaimer.
 #
 
+CONFIG_COMPATDIR=n
+ifeq ($(CONFIG_COMPATDIR), y)
 COMPATDIR=/lib/modules/$(KERNELVERSION_X86)/build/compat-wireless-3.2-rc1-1/include
-ifeq ($(CC),)
 CC ?=		$(CROSS_COMPILE)gcc -I$(COMPATDIR)
+else
+CC ?=		$(CROSS_COMPILE)gcc
 endif
-ifeq ($(LD),)
-LD=		$(CROSS_COMPILE)ld
-endif
+
+LD ?=		$(CROSS_COMPILE)ld
 BACKUP=		/root/backup
 YMD=		`date +%Y%m%d%H%M`
 
@@ -37,7 +39,7 @@ CONFIG_PCIE8897=n
 CONFIG_SD8977=n
 CONFIG_SD8978=n
 CONFIG_USB8978=n
-CONFIG_SD8997=n
+CONFIG_SD8997=y
 CONFIG_USB8997=n
 CONFIG_PCIE8997=y
 CONFIG_SD8987=y
@@ -46,7 +48,7 @@ CONFIG_USB9097=n
 CONFIG_PCIE9097=n
 CONFIG_SD9098=n
 CONFIG_USB9098=n
-CONFIG_PCIE9098=n
+CONFIG_PCIE9098=y
 
 
 # Debug Option
@@ -101,6 +103,7 @@ CONFIG_DFS_TESTING_SUPPORT=y
 
 
 # Use static link for app build
+export CONFIG_STATIC_LINK=y
 CONFIG_ANDROID_KERNEL=n
 
 #32bit app over 64bit kernel support
@@ -112,14 +115,24 @@ CONFIG_USERSPACE_32BIT_OVER_KERNEL_64BIT=n
 #############################################################################
 
 MODEXT = ko
-ccflags-y += -I$(M)/mlan
+ccflags-y += -I$(PWD)/mlan
 ccflags-y += -DLINUX
 
-KERNELVERSION_X86 :=   $(shell uname -r)
-KERNELDIR ?= /lib/modules/$(KERNELVERSION_X86)/build
+
+
+
+
+ARCH ?= arm64
+CONFIG_IMX_SUPPORT=y
+ifeq ($(CONFIG_IMX_SUPPORT),y)
+ccflags-y += -DIMX_SUPPORT
+endif
+KERNELDIR ?= /usr/src/arm/linux_5_10_y_kernel/linux-nxp
+CROSS_COMPILE ?= /opt/fsl-imx-internal-xwayland/5.10-gatesgarth/sysroots/x86_64-pokysdk-linux/usr/bin/aarch64-poky-linux/aarch64-poky-linux-
+
 LD += -S
 
-BINDIR = ../bin_mxm_wifiex
+BINDIR = ../bin_wlan
 APPDIR= $(shell if test -d "mapp"; then echo mapp; fi)
 
 #############################################################################
@@ -303,11 +316,14 @@ WimpGCC_VERSION := $(shell echo `gcc -dumpversion | cut -f1 -d.`| bc )
 ifeq ($(shell test $(WimpGCC_VERSION) -ge 7; echo $$?),0)
 ccflags-y += -Wimplicit-fallthrough=3
 endif
-ccflags-y += -Wno-stringop-overflow
-ccflags-y += -Wno-tautological-compare
-ccflags-y += -Wno-stringop-truncation
-ccflags-y += -Wno-packed-bitfield-compat
-
+#ccflags-y += -Wunused-but-set-variable
+#ccflags-y += -Wmissing-prototypes
+#ccflags-y += -Wold-style-definition
+#ccflags-y += -Wtype-limits
+#ccflags-y += -Wsuggest-attribute=format
+#ccflags-y += -Wmissing-include-dirs
+#ccflags-y += -Wshadow
+#ccflags-y += -Wsign-compare
 #############################################################################
 # Make Targets
 #############################################################################
@@ -568,7 +584,6 @@ clean:
 	-find . -name "*.ko" -exec rm {} \;
 	-find . -name ".*.cmd" -exec rm {} \;
 	-find . -name "*.mod.c" -exec rm {} \;
-	-find . -name "*.mod" -exec rm {} \;
 	-find . -name "Module.symvers" -exec rm {} \;
 	-find . -name "Module.markers" -exec rm {} \;
 	-find . -name "modules.order" -exec rm {} \;
diff --git a/mxm_wifiex/wlan_src/README_MLAN b/mxm_wifiex/wlan_src/README_MLAN
index 2dd9de7..f9ed20b 100644
--- a/mxm_wifiex/wlan_src/README_MLAN
+++ b/mxm_wifiex/wlan_src/README_MLAN
@@ -1,7 +1,7 @@
 ===============================================================================
 			U S E R  M A N U A L
 
- Copyright 2008-2020 NXP
+ Copyright 2008-2021 NXP
 
 
 1) FOR DRIVER BUILD
@@ -73,7 +73,10 @@
 	   e.g. copy dpd_data.conf to firmware directory, dpd_data_cfg=nxp/dpd_data.conf
 	  txpwrlimit_cfg=<Tx power limit config file name>
 		e.g. copy txpwrlimit_cfg_set.conf to firmware directory, txpwrlimit_cfg=nxp/txpwrlimit_cfg_set.conf
-	  cntry_txpwr=<Enable setting tx power table of country | Disable setting tx power table of country (default)>
+      cntry_txpwr=0|1|2
+                  0: Disable setting tx power table of country (default)
+                  1: Enable setting tx power table of country
+                  2: Enable setting rgpower table of country
 	  init_hostcmd_cfg=<init hostcmd config file name>
 		e.g. copy init_hostcmd_cfg.conf to firmware directory, init_hostcmd_cfg=nxp/init_hostcmd_cfg.conf
 	  band_steer_cfg=<band steer config file name>
@@ -101,7 +104,6 @@
 	  When low power mode is enabled, the output power will be clipped at ~+10dBm and the
 	  expected PA current is expected to be in the 80-90 mA range for b/g/n modes
 	wakelock_timeout=<set wakelock_timeout value (ms)>
-	defined(SD9098)||defined(USB9098) || defined(PCIE9098) || defined(SD9097) || defined(USB9097)|| defined(PCIE9097)||defined(SD8978)
 	pmic=0|1 <No pmic configure cmd sent to firmware | Send pmic configure cmd to firmware>
 	indication_gpio=0xXY <GPIO to indicate wakeup source and its level; high four bits X:
                   level(0/1) for normal wakeup; low four bits Y: GPIO pin number. This parameter
@@ -340,6 +342,9 @@
     Set RF channel
 	echo "channel=6" > /proc/mwlan/adapterX/config
 
+    Set Radio Mode
+        echo "radio_mode=14 4" > /proc/mwlan/adapterX/config
+
     Get and reset packet error rate
 	echo "get_and_reset_per" > /proc/mwlan/adapterX/config
 
@@ -407,6 +412,7 @@ SYNOPSIS
 	mlanutl mlanX verext
 	mlanutl mlanX version
 	mlanutl mlanX hostcmd <conf> generate_raw <raw_data_file>
+	mlanutl mlanX hostcmd <send_om.conf> send_om_set
 	mlanutl mlanX getdatarate
 	mlanutl uapX getdatarate
 	mlanutl mlanX drvdbg [n]
@@ -427,6 +433,10 @@ SYNOPSIS
 	mlanutl uapX vhtcfg <j> <k> [l] [m] [n] [o]
 	mlanutl mlanX httxcfg [<m>] [<n>]
 	mlanutl mlanX htcapinfo [<m>] [<n>]
+        mlanutl mlanX 11axcfg [config/11axcfg.conf]
+	mlanutl mlanX 11axcmd <subcmd> <value>
+	mlanutl mlanX txratecfg [l] [m] [n] [o]
+	mlanutl uapX txratecfg [l] [m] [n] [o]
 
 DESCRIPTION
 	Those commands are used to send additional commands to the NXP MLAN
@@ -501,6 +511,12 @@ hostcmd generate_raw
 	Usage:
 		mlanutl mlanX hostcmd <conf_file> generate_raw <raw_data_file>
 
+hostcmd send_om_set
+	This command is used to configure the STAUT to include OM control subfield
+
+	Usage:
+		mlanutl mlanX hostcmd <send_om.conf> send_om_set
+
 getdatarate
 	This command is used to get the data rate being used in last Tx
 	packet and last Rx packet.
@@ -1068,3 +1084,207 @@ htcapinfo
 	Note:- This command can be issued any time but it will only come to effect from
 	next association. (as HTCapInfo is sent only during Association).
 
+11axcfg
+	This command is used to config 11ax HE capability using conf file.
+
+     Usage:
+             mlanutl mlanX 11axcfg [conf file]
+
+     Example:
+        mlanutl mlan0 11axcfg config/11axcfg.conf
+        mlanutl uap0  11axcfg config/11axcfg.conf
+
+11axcmd
+    This command is used to config 11ax HE capability using command.
+
+    Usage:
+            mlanutl <mlanX|uapX> 11axcmd <subcmd> [value_1] [value_2]
+            <subcmd = tx_omi > :     set/get omi value
+                                     used for OMI transmission in MAC header HTC+ field, please see 11ax spec for OMI definition
+                                     set OMI when [value_1 = <omi>], where <omi> is defined as:
+                                       Bit 0-2: Rx NSS
+                                       Bit 3-4: Channel Width
+                                       Bit 6  : Tx NSTS (applies to client mode only)
+                                       All other bits are not supported currently.
+                                     get OMI without value_1 and value_2
+
+            <subcmd = obssnbru_toltime> :  set/get OBSS narrow band RU tolerance time value in seconds
+                                           set tolerance time when [value_1 = <time>], where <time> indicates:
+                                           the minimum time that needs to pass since the reception of the last beacon frame from an OBSS AP that
+                                           did not indicate tolerance to narrow bandwidth RU in OFDMA before the STA transmits an HE TB PPDU in a
+                                           26-tine RU allocated by a trigger frame from the HE AP.
+                                           valid value range [1..3600] in seconds. Any value more than 3600 will disable this feature.
+                                           By default this feature is currently disabled.
+    Example :
+            mlanutl mlan0 11axcmd tx_omi 0x41            : set omi value to 0x41
+            mlanutl mlan0 11axcmd tx_omi                 : get omi value
+            mlanutl mlan0 11axcmd obssnbru_toltime 1800  : set OBSSNBRU tolerance time to 1800 seconds
+            mlanutl mlan0 11axcmd obssnbru_toltime 3601  : disable OBSSNBRU tolerance time
+            mlanutl mlan0 11axcmd obssnbru_toltime       : get OBSSNBRU tolerance time
+
+txratecfg
+	This command is used to set/get the transmit data rate.
+
+	Note:
+	1) The data rate can be set only after association.
+
+	2) If the reassoc is OFF driver reset the data rate to auto if the connection state is disconnected.
+	Please note that user has to re-issue the set data rate command if the driver is disconnected.
+
+	3) If the reassoc is ON driver remembers the data rate set by the user, if the driver is
+	disconnected user does not have to re-issue the set data rate again.
+
+	4) Parameter [o] is optional. If [o] is not given, it will be set as 0xffff.
+
+	Where
+	[l] is <format>
+	<format> - This parameter specifies the data rate format used in this command
+		0:    LG
+		1:    HT
+		2:    VHT
+		3:    HE
+		0xff: Auto
+
+	[m] is <index>
+	<index> - This parameter specifies the rate or MCS index
+	If <format> is 0 (LG),
+		0	1 Mbps
+		1	2 Mbps
+		2	5.5 Mbps
+		3	11 Mbps
+		4	6 Mbps
+		5	9 Mbps
+		6	12 Mbps
+		7	18 Mbps
+		8	24 Mbps
+		9	36 Mbps
+		10	48 Mbps
+		11	54 Mbps
+	If <format> is 1 (HT),
+		0	MCS0
+		1	MCS1
+		2	MCS2
+		3	MCS3
+		4	MCS4
+		5	MCS5
+		6	MCS6
+		7	MCS7
+		8	MCS8
+		9	MCS9
+		10	MCS10
+		11	MCS11
+		12	MCS12
+		13	MCS13
+		14	MCS14
+		15	MCS15
+	If <format> is 2 (VHT),
+		0	MCS0
+		1	MCS1
+		2	MCS2
+		3	MCS3
+		4	MCS4
+		5	MCS5
+		6	MCS6
+		7	MCS7
+		8	MCS8
+		9	MCS9
+	If <format> is 3 (HE),
+		0	MCS0
+		1	MCS1
+		2	MCS2
+		3	MCS3
+		4	MCS4
+		5	MCS5
+		6	MCS6
+		7	MCS7
+		8	MCS8
+		9	MCS9
+		10	MCS10
+		11	MCS11
+	[n] is <nss>
+	<nss> - This parameter specifies the NSS. It is valid for VHT
+	If <format> is 2 (VHT),
+		1	NSS1
+		2	NSS2
+	[n] is <nss>
+	<nss> - This parameter specifies the NSS. It is valid for HE
+	If <format> is 3 (HE),
+		1	NSS1
+		2	NSS2
+	[o] is <rate setting, only support 9098/9097/9xxx chips>
+        Bit0 - 1: indicate preambleType
+          For legacy 11b: preemble type
+             00    = long
+             01    = short
+             10/11  = reserved
+          For legacy 11g: reserved
+          For 11n: Green field PPDU indicator
+             00 = HT-mix
+             01 = HT-GF
+             10/11 = reserved.
+          For 11ac: reserved.
+          For 11ax:
+             00 = HE-SU
+             01 = HE-EXT-SU
+             others are reserved
+
+        Bit 2 - 4 : indicate BW:
+          For HE ER:
+            0 = 242-tone RU
+            1 =  upper frequency 106-tone RU within the primary 20 MHz
+          Otherwise:
+            0 = 20 MHz
+            1 = 40 MHz
+            2 = 80 MHz
+            3 = 160 MHz
+
+        Bit 5 -6: indicate LTF + GI size
+          For HT:
+            0 = normal
+            1 = Short GI
+          For VHT:
+            01 = Short GI
+            11 = Short GI and Nsym mod 10=9
+            00 = otherwise
+          For HE:
+            0 = 1xHELTF + GI0.8us
+            1 = 2xHELTF + GI0.8us
+            2 = 2xHELTF + GI1.6us
+            3 = 4xHELTF + GI0.8us if DCM = 1 and STBC = 1
+                4xHELTF + GI3.2us, otherwise.
+
+        Bit 7: Indicate  STBC:
+            0 = no STBC
+            1 = STBC
+
+        Bit 8: indicate DCM:
+            0 = no DCM
+            1 = DCM
+
+        Bit 9: indicate coding:
+            0 = BCC
+            1 = LDPC
+
+        Bit 10 - 11: reserved.
+
+        Bit 12 - 13: Indicate maxPE
+            Max packet extension
+            0 - 0 usec
+            1 - 8 usec
+            2 - 16 usec.
+
+        Bit 14 - 15: reserved.
+
+        0xffff: Auto
+
+	Examples:
+		mlanutl mlan0 txratecfg          : Read the current data rate setting
+		mlanutl mlan0 txratecfg 0 3      : Set fixed Tx rate to 11 Mbps
+		mlanutl mlan0 txratecfg 0 11     : Set fixed Tx rate to 54 Mbps
+		mlanutl mlan0 txratecfg 1 3      : Set fixed Tx rate to MCS3
+		mlanutl mlan0 txratecfg 2 3 2    : Set fixed Tx rate to MCS3 for NSS2
+		mlanutl mlan0 txratecfg 3 3 2    : Set 11AX fixed Tx rate to MCS3 for NSS2
+		mlanutl mlan0 txratecfg 3 5 2 0x2282   : Set 11AX fixed Tx rate to MCS5 for NSS2, and Preamble type is 2, BW is 0, LTF + GI size 0
+                                                         STBC is 1, DMC is 0, Coding is 1, maxPE is 2.
+		mlanutl mlan0 txratecfg 0xff     : Disable fixed rate and uses auto rate
+
diff --git a/mxm_wifiex/wlan_src/mapp/mlanconfig/config/ed_mac_ctrl_V3_909x.conf b/mxm_wifiex/wlan_src/mapp/mlanconfig/config/ed_mac_ctrl_V3_909x.conf
new file mode 100755
index 0000000..b0e18b5
--- /dev/null
+++ b/mxm_wifiex/wlan_src/mapp/mlanconfig/config/ed_mac_ctrl_V3_909x.conf
@@ -0,0 +1,23 @@
+#       File : ed_mac_ctrl_V3_909x.conf
+#
+#   ed_mac_ctrl_v3 is used for 88W9098, 88W9097
+#   ./mlanutl mlan0 hostcmd config/ed_mac_ctrl_V3_909x.conf ed_mac_ctrl_v3
+#
+## Set Energy Detect Threshold for EU Adaptivity test
+
+ed_mac_ctrl_v3={
+        CmdCode=0x0130                 #Command code, DO NOT change this line
+        ed_ctrl_2g.enable:2=0x1        # 0       - disable EU adaptivity for 2.4GHz band
+                                       # 1       - enable EU adaptivity for 2.4GHz band
+
+        ed_ctrl_2g.offset:2=0x8        # 0       - Default Energy Detect threshold
+                                       #offset value range: 0x80 to 0x7F
+
+        ed_ctrl_5g.enable:2=0x1        # 0       - disable EU adaptivity for 5GHz band
+                                       # 1       - enable EU adaptivity for 5GHz band
+
+        ed_ctrl_5g.offset:2=0x8        # 0       - Default Energy Detect threshold
+                                       #offset value range: 0x80 to 0x7F
+
+        ed_ctrl_txq_lock:4=0x1e00FF    #DO NOT Change this line
+}
diff --git a/mxm_wifiex/wlan_src/mapp/mlanconfig/config/txpwrlimit_cfg_9098.conf b/mxm_wifiex/wlan_src/mapp/mlanconfig/config/txpwrlimit_cfg_9098.conf
new file mode 100755
index 0000000..20f0ea5
--- /dev/null
+++ b/mxm_wifiex/wlan_src/mapp/mlanconfig/config/txpwrlimit_cfg_9098.conf
@@ -0,0 +1,617 @@
+#       File : txpwrlimit_cfg.conf
+## Get CFG data for Tx power limitation
+txpwrlimit_2g_cfg_get={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=0              # 0 - GET
+        SubBand:2=0x00          # 0x00 2G subband  (2.4G: channel 1-14)
+                                # 0x10 5G subband0 (5G: channel 36,40,44,48,
+                                #                               52,56,60,64)
+                                # 0x11 5G subband1 (5G: channel 100,104,108,112,
+                                #                               116,120,124,128,
+                                #                               132,136,140,144)
+                                # 0x12 5G subband2 (5G: channel 149,153,157,161,165,172)
+                                # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
+                                #                               189, 192,196;
+                                #                   5G: channel 7,8,11,12,16,34)
+}
+
+
+txpwrlimit_5g_cfg_get_sub0={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=0              # 0 - GET
+        SubBand:2=0x10          # 0x00 2G subband  (2.4G: channel 1-14)
+                                # 0x10 5G subband0 (5G: channel 36,40,44,48,
+                                #                               52,56,60,64)
+                                # 0x11 5G subband1 (5G: channel 100,104,108,112,
+                                #                               116,120,124,128,
+                                #                               132,136,140,144)
+                                # 0x12 5G subband2 (5G: channel 149,153,157,161,165,172)
+                                # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
+                                #                               189, 192,196;
+                                #                   5G: channel 7,8,11,12,16,34)
+}
+
+
+txpwrlimit_5g_cfg_get_sub1={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=0              # 0 - GET
+        SubBand:2=0x11          # 0x00 2G subband  (2.4G: channel 1-14)
+                                # 0x10 5G subband0 (5G: channel 36,40,44,48,
+                                #                               52,56,60,64)
+                                # 0x11 5G subband1 (5G: channel 100,104,108,112,
+                                #                               116,120,124,128,
+                                #                               132,136,140,144)
+                                # 0x12 5G subband2 (5G: channel 149,153,157,161,165,172)
+                                # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
+                                #                               189, 192,196;
+                                #                   5G: channel 7,8,11,12,16,34)
+}
+
+
+txpwrlimit_5g_cfg_get_sub2={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=0              # 0 - GET
+        SubBand:2=0x12          # 0x00 2G subband  (2.4G: channel 1-14)
+                                # 0x10 5G subband0 (5G: channel 36,40,44,48,
+                                #                               52,56,60,64)
+                                # 0x11 5G subband1 (5G: channel 100,104,108,112,
+                                #                               116,120,124,128,
+                                #                               132,136,140,144)
+                                # 0x12 5G subband2 (5G: channel 149,153,157,161,165,172)
+                                # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
+                                #                               189, 192,196;
+                                #                   5G: channel 7,8,11,12,16,34)
+}
+
+
+txpwrlimit_5g_cfg_get_sub3={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=0              # 0 - GET
+        SubBand:2=0x13          # 0x00 2G subband  (2.4G: channel 1-14)
+                                # 0x10 5G subband0 (5G: channel 36,40,44,48,
+                                #                               52,56,60,64)
+                                # 0x11 5G subband1 (5G: channel 100,104,108,112,
+                                #                               116,120,124,128,
+                                #                               132,136,140,144)
+                                # 0x12 5G subband2 (5G: channel 149,153,157,161,165,172)
+                                # 0x13 5G subband3 (5G: channel 183,184,185,187,188,
+                                #                               189, 192,196;
+                                #                   5G: channel 7,8,11,12,16,34)
+}
+
+## Set CFG data for Tx power limitation
+##
+## TLVStartFreq: Starting Frequency of the band for this channel
+##                 2407, 2414 or 2400 for 2.4 GHz
+##                 5000
+##                 4000
+## TLVChanWidth: Channel Width
+##                 20
+## TLVChanNum  : Channel Number
+## TLVPwr[]    : ModulationGroup
+##                 0: CCK (1,2,5.5,11 Mbps)
+##                 1: OFDM (6,9,12,18 Mbps)
+##                 2: OFDM (24,36 Mbps)
+##                 3: OFDM (48,54 Mbps)
+##                 4: HT20 (MCS0,1,2)
+##                 5: HT20 (MCS3,4)
+##                 6: HT20 (MCS5,6,7)
+##                 7: HT40 (MCS0,1,2)
+##                 8: HT40 (MCS3,4)
+##                 9: HT40 (MCS5,6,7)
+##                 10: HT2_20 (MCS8,9,10)
+##                 11: HT2_20 (MCS11,12)
+##                 12: HT2_20 (MCS13,14,15)
+##                 13: HT2_40 (MCS8,9,10)
+##                 14: HT2_40 (MCS11,12)
+##                 15: HT2_40 (MCS13,14,15)
+##                 16: VHT_QAM256 (MCS8)
+##                 17: VHT_40_QAM256 (MCS8,9)
+##                 18: VHT_80_PSK (MCS0,1,2)
+##                 19: VHT_80_QAM16 (MCS3,4)
+##                 20: VHT_80_QAM64 (MCS5,6,7)
+##                 21: VHT_80_QAM256 (MCS8,9)
+##                 22: VHT2_20_QAM256 (MCS8,9)
+##                 23: VHT2_40_QAM256 (MCS8,9)
+##                 24: VHT2_80_PSK (MCS0, 1, 2)
+##                 25: VHT2_80_QAM16 (MCS3,4)
+##                 26: VHT2_80_QAM64 (MCS5,6,7)
+##                 27: VHT2_80_QAM256 (MCS8,9)
+##                 28: HE_20_QAM256 (MCS8,9)
+##                 29: HE_20_QAM1024 (MCS10,11)
+##                 30: HE_40_QAM1024 (MCS10,11)
+##                 31: HE_80_QAM1024 (MCS10,11)
+##                 32: HE2_20_QAM256 (MCS8,9)
+##                 33: HE2_20_QAM1024 (MCS10,11)
+##                 34: HE2_40_QAM1024 (MCS10,11)
+##                 35: HE2_80_QAM1024 (MCS10,11)
+##               Power Limit in dBm
+##
+## Note: For KF, add VHT 20/40/80 1SS/2SS mod group.
+
+## 2G subband0 Tx power limit CFG
+txpwrlimit_2g_cfg_set={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=1              # 1 - SET
+        SubBand:2=0             # do NOT use this member in set cmd
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=1
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=2
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=3
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=4
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=5
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=6
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=7
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=8
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=9
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=10
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=11
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=12
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=13
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=2407
+            TLVChanWidth:1=20
+            TLVChanNum:1=14
+            TLVPwr:72='0,10,1,10,2,10,3,10,4,10,5,10,6,10,7,10,8,10,9,10,10,10,11,10,12,10,13,10,14,10,15,10,16,0,17,0,18,0,19,0,20,0,21,0,22,0,23,0,24,0,25,0,26,0,27,0,28,10,29,10,30,10,31,0,32,10,33,10,34,10,35,0'
+        }
+}
+
+
+## 5G subband1 Tx power limit CFG
+txpwrlimit_5g_cfg_set_sub0={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=1              # 1 - SET
+        SubBand:2=0             # do NOT use this member in set cmd
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=36
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,18,10,20,11,20,12,18,13,20,14,20,15,18,16,17,17,17,18,20,19,19,20,17,21,16,22,17,23,17,24,20,25,19,26,17,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=40
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,18,10,20,11,20,12,18,13,20,14,20,15,18,16,17,17,17,18,20,19,19,20,17,21,16,22,17,23,17,24,20,25,19,26,17,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=44
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,18,10,20,11,20,12,18,13,20,14,20,15,18,16,18,17,17,18,20,19,19,20,17,21,16,22,18,23,17,24,20,25,19,26,17,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=48
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,18,10,20,11,20,12,18,13,20,14,20,15,18,16,18,17,17,18,20,19,19,20,17,21,16,22,18,23,17,24,20,25,19,26,17,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=52
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,19,10,20,11,20,12,18,13,20,14,20,15,19,16,18,17,17,18,19,19,19,20,18,21,17,22,18,23,17,24,19,25,19,26,18,27,17,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=56
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,19,10,20,11,20,12,18,13,20,14,20,15,19,16,18,17,17,18,19,19,19,20,18,21,17,22,18,23,17,24,19,25,19,26,18,27,17,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=60
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,19,10,20,11,20,12,18,13,20,14,20,15,19,16,18,17,17,18,19,19,19,20,18,21,17,22,18,23,17,24,19,25,19,26,18,27,17,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+ ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=64
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,20,5,20,6,18,7,20,8,20,9,19,10,20,11,20,12,18,13,20,14,20,15,19,16,18,17,17,18,19,19,19,20,18,21,17,22,18,23,17,24,19,25,19,26,18,27,17,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+}
+
+## 5G subband2 Tx power limit CFG
+txpwrlimit_5g_cfg_set_sub1={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=1              # 1 - SET
+        SubBand:2=0             # do NOT use this member in set cmd
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=100
+            TLVPwr:72='0,0,1,20,2,20,3,20,4,18,5,18,6,19,7,18,8,18,9,18,10,18,11,18,12,19,13,18,14,18,15,18,16,18,17,16,18,18,19,19,20,18,21,16,22,18,23,16,24,18,25,19,26,18,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=104
+            TLVPwr:72='0,0,1,20,2,20,3,20,4,18,5,18,6,18,7,18,8,18,9,18,10,18,11,18,12,18,13,18,14,18,15,18,16,18,17,16,18,18,19,19,20,18,21,16,22,18,23,16,24,18,25,19,26,18,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=108
+            TLVPwr:72='0,0,1,20,2,20,3,20,4,18,5,18,6,19,7,18,8,18,9,17,10,18,11,18,12,19,13,18,14,18,15,17,16,18,17,16,18,18,19,19,20,18,21,16,22,18,23,16,24,18,25,19,26,18,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=112
+            TLVPwr:72='0,0,1,20,2,20,3,20,4,18,5,18,6,19,7,18,8,18,9,17,10,18,11,18,12,19,13,18,14,18,15,17,16,17,17,16,18,18,19,19,20,18,21,16,22,17,23,16,24,18,25,19,26,18,27,16,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=116
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,18,9,17,10,18,11,18,12,18,13,18,14,18,15,17,16,16,17,15,18,18,19,18,20,17,21,15,22,16,23,15,24,18,25,18,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=120
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,18,9,17,10,18,11,18,12,18,13,18,14,18,15,17,16,17,17,15,18,18,19,18,20,17,21,15,22,17,23,15,24,18,25,18,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=124
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,18,9,18,10,18,11,18,12,18,13,18,14,18,15,18,16,17,17,15,18,18,19,18,20,17,21,15,22,17,23,15,24,18,25,18,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=128
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,18,9,18,10,18,11,18,12,18,13,18,14,18,15,18,16,17,17,15,18,18,19,18,20,17,21,15,22,17,23,15,24,18,25,18,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=132
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,17,9,18,10,18,11,18,12,18,13,18,14,17,15,18,16,16,17,15,18,18,19,18,20,18,21,15,22,16,23,15,24,18,25,18,26,18,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=136
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,17,9,18,10,18,11,18,12,18,13,18,14,17,15,18,16,17,17,15,18,18,19,18,20,18,21,15,22,17,23,15,24,18,25,18,26,18,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=140
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,17,9,17,10,18,11,18,12,18,13,18,14,17,15,17,16,18,17,16,18,18,19,18,20,18,21,15,22,18,23,16,24,18,25,18,26,18,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=144
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,18,6,18,7,18,8,17,9,17,10,18,11,18,12,18,13,18,14,17,15,17,16,18,17,16,18,18,19,18,20,18,21,15,22,18,23,16,24,18,25,18,26,18,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+}
+
+
+## 5G subband3 Tx power limit CFG
+txpwrlimit_5g_cfg_set_sub2={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=1              # 1 - SET
+        SubBand:2=0             # do NOT use this member in set cmd
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=149
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,18,7,18,8,18,9,18,10,18,11,19,12,18,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=153
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=157
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=161
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=165
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+}
+
+
+## 5G subband4 Tx power limit CFG
+txpwrlimit_5g_cfg_set_sub3={
+        CmdCode=0x00fb          # do NOT change this line
+        Action:2=1              # 1 - SET
+        SubBand:2=0             # do NOT use this in set cmd
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=183
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=184
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=185
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=187
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=188
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=189
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=192
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=4000
+            TLVChanWidth:1=20
+            TLVChanNum:1=196
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=7
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=8
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=11
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=12
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=16
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+
+
+        ChanTRPC.TlvType:2=0x0189
+        ChanTRPC.TlvLength:2={
+            TLVStartFreq:2=5000
+            TLVChanWidth:1=20
+            TLVChanNum:1=34
+            TLVPwr:72='0,0,1,20,2,20,3,19,4,18,5,19,6,19,7,18,8,18,9,18,10,18,11,19,12,19,13,18,14,18,15,18,16,17,17,17,18,18,19,19,20,17,21,15,22,17,23,17,24,18,25,19,26,17,27,15,28,5,29,5,30,5,31,5,32,5,33,5,34,5,35,5'
+        }
+ }
+
diff --git a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c
index 58695c6..a5b32ed 100644
--- a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c
+++ b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.c
@@ -3,7 +3,7 @@
  * @brief Program to control parameters in the mlandriver
  *
  *
- * Copyright 2011-2020 NXP
+ * Copyright 2011-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -117,6 +117,9 @@ static int process_signalext_cfg(int argc, char *argv[]);
 #endif
 static int process_vhtcfg(int argc, char *argv[]);
 static int process_dyn_bw(int argc, char *argv[]);
+static int process_11axcfg(int argc, char *argv[]);
+static int process_11axcmdcfg(int argc, char *argv[]);
+static int process_txratecfg(int argc, char *argv[]);
 static int process_httxcfg(int argc, char *argv[]);
 static int process_htcapinfo(int argc, char *argv[]);
 static int process_addbapara(int argc, char *argv[]);
@@ -141,6 +144,9 @@ struct command_node command_list[] = {
 #endif
 	{"vhtcfg", process_vhtcfg},
 	{"dyn_bw", process_dyn_bw},
+	{"11axcfg", process_11axcfg},
+	{"11axcmd", process_11axcmdcfg},
+	{"txratecfg", process_txratecfg},
 	{"addbapara", process_addbapara},
 	{"aggrpriotbl", process_aggrpriotbl},
 	{"addbareject", process_addbareject},
@@ -172,6 +178,9 @@ static char *usage[] = {
 #endif
 	"         vhtcfg",
 	"         dyn_bw",
+	"         11axcfg",
+	"         11axcmd",
+	"         txratecfg",
 	"         httxcfg",
 	"         htcapinfo",
 	"         aggrpriotbl",
@@ -204,7 +213,7 @@ int num_ssid_filter = 0;
  *  @param chr      Char to convert
  *  @return         Hex integer or 0
  */
-int hexval(t_s32 chr)
+static int hexval(t_s32 chr)
 {
 	if (chr >= '0' && chr <= '9')
 		return chr - '0';
@@ -250,7 +259,7 @@ t_void hexdump(char *prompt, t_void *p, t_s32 len, char delim)
  *  @param chr      Char
  *  @return         Hex integer
  */
-t_u8 hexc2bin(char chr)
+static t_u8 hexc2bin(char chr)
 {
 	if (chr >= '0' && chr <= '9')
 		chr -= '0';
@@ -268,7 +277,7 @@ t_u8 hexc2bin(char chr)
  *  @param s        A pointer string buffer
  *  @return         Hex integer
  */
-t_u32 a2hex(char *s)
+static t_u32 a2hex(char *s)
 {
 	t_u32 val = 0;
 
@@ -289,7 +298,7 @@ t_u32 a2hex(char *s)
  *  @param value    A pointer to string
  *  @return         Integer
  */
-t_u32 a2hex_or_atoi(char *value)
+static t_u32 a2hex_or_atoi(char *value)
 {
 	if (value[0] == '0' && (value[1] == 'X' || value[1] == 'x')) {
 		return a2hex(value + 2);
@@ -305,7 +314,7 @@ t_u32 a2hex_or_atoi(char *value)
  *  @param chr      A pointer to return integer
  *  @return         A pointer to next data field
  */
-char *convert2hex(char *ptr, t_u8 *chr)
+static char *convert2hex(char *ptr, t_u8 *chr)
 {
 	t_u8 val;
 
@@ -318,50 +327,6 @@ char *convert2hex(char *ptr, t_u8 *chr)
 	return ptr;
 }
 
-/**
- *  @brief Check the Hex String
- *  @param s  A pointer to the string
- *  @return   MLAN_STATUS_SUCCESS --HexString, MLAN_STATUS_FAILURE --not
- * HexString
- */
-int ishexstring(char *s)
-{
-	int ret = MLAN_STATUS_FAILURE;
-	t_s32 tmp;
-
-	if (!strncasecmp("0x", s, 2)) {
-		s += 2;
-	}
-	while (*s) {
-		tmp = toupper((unsigned char)*s);
-		if (((tmp >= 'A') && (tmp <= 'F')) ||
-		    ((tmp >= '0') && (tmp <= '9'))) {
-			ret = MLAN_STATUS_SUCCESS;
-		} else {
-			ret = MLAN_STATUS_FAILURE;
-			break;
-		}
-		s++;
-	}
-
-	return ret;
-}
-
-/**
- *  @brief Convert String to Integer
- *  @param buf      A pointer to the string
- *  @return         Integer
- */
-int atoval(char *buf)
-{
-	if (!strncasecmp(buf, "0x", 2))
-		return a2hex(buf + 2);
-	else if (!ishexstring(buf))
-		return a2hex(buf);
-	else
-		return atoi(buf);
-}
-
 /**
  *  @brief Display usage
  *
@@ -397,33 +362,6 @@ static int process_command(int argc, char *argv[])
 	return ret;
 }
 
-/**
- * @brief Converts a string to hex value
- *
- * @param str      A pointer to the string
- * @param raw      A pointer to the raw data buffer
- * @return         Number of bytes read
- **/
-int string2raw(char *str, unsigned char *raw)
-{
-	int len = (strlen(str) + 1) / 2;
-
-	do {
-		if (!isxdigit((unsigned char)*str)) {
-			return -1;
-		}
-		*str = toupper((unsigned char)*str);
-		*raw = CHAR2INT(*str) << 4;
-		++str;
-		*str = toupper((unsigned char)*str);
-		if (*str == '\0')
-			break;
-		*raw |= CHAR2INT(*str);
-		++raw;
-	} while (*++str != '\0');
-	return len;
-}
-
 /**
  *  @brief Prepare command buffer
  *  @param buffer   Command buffer to be filled
@@ -461,25 +399,12 @@ static int prepare_buffer(t_u8 *buffer, char *cmd, t_u32 num, char *args[])
 	return MLAN_STATUS_SUCCESS;
 }
 
-/**
- *  @brief Signal handler
- *
- *  @param sig      Received signal number
- *
- *  @return         N/A
- */
-void sig_handler(int sig)
-{
-	printf("Stopping application.\n");
-	terminate_flag = 1;
-}
-
 /**
  *  @brief Trims leading and traling spaces only
  *  @param str  A pointer to argument string
  *  @return     pointer to trimmed string
  */
-char *trim_spaces(char *str)
+static char *trim_spaces(char *str)
 {
 	char *str_end = NULL;
 
@@ -504,6 +429,86 @@ char *trim_spaces(char *str)
 	return str;
 }
 
+/**
+ *  @brief read current command
+ *  @param ptr      A pointer to data
+ *  @param curCmd   A pointer to the buf which will hold current command
+ *  @return         NULL or the pointer to the left command buf
+ */
+static t_s8 *readCurCmd(t_s8 *ptr, t_s8 *curCmd)
+{
+	t_s32 i = 0;
+#define MAX_CMD_SIZE 64 /**< Max command size */
+
+	while (*ptr != ']' && i < (MAX_CMD_SIZE - 1))
+		curCmd[i++] = *(++ptr);
+
+	if (*ptr != ']')
+		return NULL;
+
+	curCmd[i - 1] = '\0';
+
+	return ++ptr;
+}
+
+/**
+ *  @brief parse command and hex data
+ *  @param fp       A pointer to FILE stream
+ *  @param dst      A pointer to the dest buf
+ *  @param cmd      A pointer to command buf for search
+ *  @return         Length of hex data or MLAN_STATUS_FAILURE
+ */
+static int fparse_for_cmd_and_hex(FILE *fp, t_u8 *dst, t_u8 *cmd)
+{
+	t_s8 *ptr;
+	t_u8 *dptr;
+	t_s8 buf[256], curCmd[64] = {0};
+	t_s32 isCurCmd = 0;
+
+	dptr = dst;
+	while (fgets((char *)buf, sizeof(buf), fp)) {
+		ptr = buf;
+
+		while (*ptr) {
+			/* skip leading spaces */
+			while (*ptr && isspace((unsigned char)*ptr))
+				ptr++;
+
+			/* skip blank lines and lines beginning with '#' */
+			if (*ptr == '\0' || *ptr == '#')
+				break;
+
+			if (*ptr == '[' && *(ptr + 1) != '/') {
+				ptr = readCurCmd(ptr, curCmd);
+				if (!ptr)
+					return MLAN_STATUS_FAILURE;
+
+				if (strcasecmp((char *)curCmd,
+					       (char *)cmd)) /* Not equal */
+					isCurCmd = 0;
+				else
+					isCurCmd = 1;
+			}
+
+			/* Ignore the rest if it is not correct cmd */
+			if (!isCurCmd)
+				break;
+
+			if (*ptr == '[' && *(ptr + 1) == '/')
+				return dptr - dst;
+
+			if (isxdigit((unsigned char)*ptr)) {
+				ptr = (t_s8 *)convert2hex((char *)ptr, dptr++);
+			} else {
+				/* Invalid character on data line */
+				ptr++;
+			}
+		}
+	}
+
+	return MLAN_STATUS_FAILURE;
+}
+
 /**
  *  @brief Process version
  *  @param argc   Number of arguments
@@ -642,6 +647,8 @@ done:
 	return ret;
 }
 
+int process_host_cmd_resp(char *cmd_name, t_u8 *buf);
+
 /**
  *  @brief Get one line from the File
  *
@@ -651,7 +658,7 @@ done:
  *  @param lineno   A pointer to return current line number
  *  @return         returns string or NULL
  */
-char *mlan_config_get_line(FILE *fp, char *str, t_s32 size, int *lineno)
+static char *mlan_config_get_line(FILE *fp, char *str, t_s32 size, int *lineno)
 {
 	char *start, *end;
 	int out, next_line;
@@ -862,7 +869,7 @@ static int mlan_get_hostcmd_data(FILE *fp, int *ln, t_u8 *buf, t_u16 *size)
  *  @param buf      A pointer to comand buffer
  *  @return         MLAN_STATUS_SUCCESS--success, otherwise--fail
  */
-int prepare_host_cmd_buffer(FILE *fp, char *cmd_name, t_u8 *buf)
+static int prepare_host_cmd_buffer(FILE *fp, char *cmd_name, t_u8 *buf)
 {
 	char line[256], cmdname[256], *pos, cmdcode[10];
 	HostCmd_DS_GEN *hostcmd;
@@ -925,6 +932,21 @@ int prepare_host_cmd_buffer(FILE *fp, char *cmd_name, t_u8 *buf)
 	return MLAN_STATUS_SUCCESS;
 }
 
+#define SUBID_OFFSET 2
+static t_u16 supported_subcmd[] = {0x111, 0x11b, 0x11e};
+
+static int check_if_hostcmd_subcmd_allowed(t_u8 *buf)
+{
+	t_u32 maxcnt = sizeof(supported_subcmd) / sizeof(supported_subcmd[0]);
+
+	for (int i = 0; i < maxcnt; i++) {
+		if (!memcmp(buf + SUBID_OFFSET, (supported_subcmd + i),
+			    sizeof(t_u16)))
+			return MLAN_STATUS_SUCCESS;
+	}
+	return MLAN_STATUS_NOTFOUND;
+}
+
 /**
  *  @brief Process hostcmd command
  *  @param argc   Number of arguments
@@ -935,6 +957,7 @@ static int process_hostcmd(int argc, char *argv[])
 {
 	t_u8 *buffer = NULL, *raw_buf = NULL;
 	struct eth_priv_cmd *cmd = NULL;
+	struct ifreq ifr;
 	FILE *fp = NULL;
 	FILE *fp_raw = NULL;
 	FILE *fp_dtsi = NULL;
@@ -953,7 +976,7 @@ static int process_hostcmd(int argc, char *argv[])
 
 	if (argc < 5) {
 		printf("Error: invalid no of arguments\n");
-		printf("Syntax: ./mlanutl mlanX hostcmd <hostcmd.conf> generate_raw <raw_data_file>\n");
+		printf("Syntax: ./mlanutl mlanX hostcmd <hostcmd.conf> <cmdname>\n");
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
@@ -963,12 +986,6 @@ static int process_hostcmd(int argc, char *argv[])
 	if (!strcmp(cmdname, "generate_raw")) {
 		call_ioctl = FALSE;
 	}
-	if (call_ioctl) {
-		printf("Error: invalid no of arguments\n");
-		printf("Syntax: ./mlanutl mlanX hostcmd <hostcmd.conf> generate_raw <raw_data_file>\n");
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
 	if (!call_ioctl && argc != 6) {
 		printf("Error: invalid no of arguments\n");
 		printf("Syntax: ./mlanutl mlanX hostcmd <hostcmd.conf> %s <raw_data_file>\n",
@@ -994,7 +1011,19 @@ static int process_hostcmd(int argc, char *argv[])
 	}
 	memset(buffer, 0, BUFFER_LENGTH);
 
-	{
+	if (call_ioctl) {
+		/* Prepare the hostcmd buffer */
+		prepare_buffer(buffer, argv[2], 0, NULL);
+		if (MLAN_STATUS_FAILURE ==
+		    prepare_host_cmd_buffer(fp, cmdname,
+					    buffer + strlen(CMD_NXP) +
+						    strlen(argv[2]))) {
+			fclose(fp);
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+		fclose(fp);
+	} else {
 		line = (char *)malloc(MAX_CONFIG_LINE);
 		if (!line) {
 			printf("ERR:Cannot allocate memory for line\n");
@@ -1073,7 +1102,7 @@ static int process_hostcmd(int argc, char *argv[])
 			goto done;
 		}
 
-		for (k = 0; k < blk_count && command != NULL; k++) {
+		for (k = 0; k < (t_u32)blk_count && command != NULL; k++) {
 			if (MLAN_STATUS_FAILURE ==
 			    prepare_host_cmd_buffer(fp, command->cmd_string,
 						    buffer))
@@ -1125,6 +1154,48 @@ static int process_hostcmd(int argc, char *argv[])
 		fclose(fp);
 	}
 
+	if (call_ioctl) {
+		raw_buf = buffer + strlen(CMD_NXP) + strlen(argv[2]) +
+			  sizeof(t_u32) + S_DS_GEN; /* raw_buf points to start
+						       of actual <raw data> */
+		if (check_if_hostcmd_subcmd_allowed(raw_buf) !=
+		    MLAN_STATUS_SUCCESS) {
+			printf("ERR:Entered hostcmd not allowed!\n");
+			goto done;
+		}
+		cmd = (struct eth_priv_cmd *)malloc(
+			sizeof(struct eth_priv_cmd));
+		if (!cmd) {
+			printf("ERR:Cannot allocate buffer for command!\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+
+		/* Fill up buffer */
+#ifdef USERSPACE_32BIT_OVER_KERNEL_64BIT
+		memset(cmd, 0, sizeof(struct eth_priv_cmd));
+		memcpy(&cmd->buf, &buffer, sizeof(buffer));
+#else
+		cmd->buf = buffer;
+#endif
+		cmd->used_len = 0;
+		cmd->total_len = BUFFER_LENGTH;
+
+		/* Perform IOCTL */
+		memset(&ifr, 0, sizeof(struct ifreq));
+		strncpy(ifr.ifr_ifrn.ifrn_name, dev_name, strlen(dev_name));
+		ifr.ifr_ifru.ifru_data = (void *)cmd;
+
+		if (ioctl(sockfd, MLAN_ETH_PRIV, &ifr)) {
+			perror("mlanutl");
+			fprintf(stderr, "mlanutl: hostcmd fail\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+
+		/* Process result */
+		process_host_cmd_resp(argv[2], buffer);
+	}
 done:
 	while (header) {
 		command = header;
@@ -1500,26 +1571,36 @@ static int process_getlog(int argc, char *argv[])
 	       stats->wep_icv_error[2], stats->wep_icv_error[3],
 	       stats->bcn_rcv_cnt, stats->bcn_miss_cnt);
 
-	printf("rxStuckIssueCount-1                %u\n"
-	       "rxStuckIssueCount-2                %u\n"
-	       "rxStuckRecoveryCount               %u\n"
-	       "rxStuckTsf-1                       %llu\n"
-	       "rxStuckTsf-2                       %llu\n"
-	       "txWatchdogRecoveryCount            %u\n"
-	       "txWatchdogTsf-1                    %llu\n"
-	       "txWatchdogTsf-2                    %llu\n"
-	       "channelSwitchAnnouncementSent      %u\n"
-	       "channelSwitchState                 %u\n"
-	       "registerClass                      %u\n"
-	       "channelNumber                      %u\n"
-	       "channelSwitchMode                  %u\n",
-	       stats->rx_stuck_issue_cnt[0], stats->rx_stuck_issue_cnt[1],
-	       stats->rx_stuck_recovery_cnt, stats->rx_stuck_tsf[0],
-	       stats->rx_stuck_tsf[1], stats->tx_watchdog_recovery_cnt,
-	       stats->tx_watchdog_tsf[0], stats->tx_watchdog_tsf[1],
-	       stats->channel_switch_ann_sent, stats->channel_switch_state,
-	       stats->reg_class, stats->channel_number,
-	       stats->channel_switch_mode);
+	if (argc == 4 && !(strcmp(argv[3], "ext"))) {
+		printf("rxStuckIssueCount-1                %u\n"
+		       "rxStuckIssueCount-2                %u\n"
+		       "rxStuckRecoveryCount               %u\n"
+		       "rxStuckTsf-1                       %llu\n"
+		       "rxStuckTsf-2                       %llu\n"
+		       "txWatchdogRecoveryCount            %u\n"
+		       "txWatchdogTsf-1                    %llu\n"
+		       "txWatchdogTsf-2                    %llu\n"
+		       "channelSwitchAnnouncementSent      %u\n"
+		       "channelSwitchState                 %u\n"
+		       "registerClass                      %u\n"
+		       "channelNumber                      %u\n"
+		       "channelSwitchMode                  %u\n"
+		       "RxResetRecoveryCount               %u\n"
+		       "RxIsr2NotDoneCnt                   %u\n"
+		       "gdmaAbortCnt                       %u\n"
+		       "gResetRxMacCnt                     %u\n",
+		       stats->rx_stuck_issue_cnt[0],
+		       stats->rx_stuck_issue_cnt[1],
+		       stats->rx_stuck_recovery_cnt, stats->rx_stuck_tsf[0],
+		       stats->rx_stuck_tsf[1], stats->tx_watchdog_recovery_cnt,
+		       stats->tx_watchdog_tsf[0], stats->tx_watchdog_tsf[1],
+		       stats->channel_switch_ann_sent,
+		       stats->channel_switch_state, stats->reg_class,
+		       stats->channel_number, stats->channel_switch_mode,
+		       stats->rx_reset_mac_recovery_cnt,
+		       stats->rx_Isr2_NotDone_Cnt, stats->gdma_abort_cnt,
+		       stats->g_reset_rx_mac_cnt);
+	}
 
 	if (cmd->used_len == sizeof(struct eth_priv_get_log)) {
 		printf("dot11TransmittedFragmentCount      %u\n",
@@ -1613,7 +1694,6 @@ static int process_getlog(int argc, char *argv[])
 		       stats->rx_octets_in_ampdu_cnt,
 		       stats->ampdu_delimiter_crc_error_cnt);
 	}
-
 	if (buffer)
 		free(buffer);
 	if (cmd)
@@ -1687,7 +1767,8 @@ static int process_get_signal(int argc, char *argv[])
 	}
 
 	/* Process result */
-	copy_size = MIN(cmd->used_len, DATA_SIZE * sizeof(int));
+	copy_size =
+		(int)MIN((int)cmd->used_len, (int)(DATA_SIZE * sizeof(int)));
 	if (copy_size > 0)
 		memcpy(&data, buffer, copy_size);
 	printf("Get signal output is\t");
@@ -1951,7 +2032,7 @@ static int get_txpwrlimit(FILE *fp_raw, char *argv[], t_u16 sub_band,
 	       trcp_cfg->length);
 	pByte = trcp_cfg->trpc_buf + S_DS_GEN + 4;
 	left_len = trcp_cfg->length - S_DS_GEN - 4;
-	while (left_len >= sizeof(pTlvHdr->header)) {
+	while (left_len >= (int)sizeof(pTlvHdr->header)) {
 		pTlvHdr = (MrvlIEtypes_Data_t *)pByte;
 		pTlvHdr->header.len = le16_to_cpu(pTlvHdr->header.len);
 
@@ -2661,6 +2742,887 @@ static int process_addbareject(int argc, char *argv[])
 	return MLAN_STATUS_SUCCESS;
 }
 
+#define MASK_11AX_OM_CONTROL 0xFFF
+
+/**
+ * @brief      11ax HE capability and operation configure
+ *
+ * @param argc Number of arguments
+ * @param argv Pointer to the arguments array
+ *
+ * @return     MLAN_STATUS_SUCCESS/MLAN_STATUS_FAILURE
+ */
+
+static int process_11axcfg(int argc, char *argv[])
+{
+	t_u8 *buffer = NULL;
+	struct eth_priv_cmd *cmd;
+	struct ifreq ifr;
+	int id_len = 0;
+	FILE *fp = NULL;
+	int ret = 0, cmd_header_len = 0;
+	char config_id[20];
+	char filename[256];
+
+	if (argc != 3 && argc != 4) {
+		printf("Err: Invalid number of arguments\n");
+		printf("Usage: ./mlanutl <interface> 11axcfg [11axcfg.conf]\n");
+		return MLAN_STATUS_FAILURE;
+	}
+	/* Initialize buffer */
+	buffer = (t_u8 *)malloc(BUFFER_LENGTH);
+	if (!buffer) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		return MLAN_STATUS_FAILURE;
+	}
+
+	cmd_header_len = strlen(CMD_NXP) + strlen(argv[2]);
+	prepare_buffer(buffer, argv[2], 0, NULL);
+	cmd = (struct eth_priv_cmd *)malloc(sizeof(struct eth_priv_cmd));
+	if (!cmd) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Fill up buffer */
+#ifdef USERSPACE_32BIT_OVER_KERNEL_64BIT
+	memset(cmd, 0, sizeof(struct eth_priv_cmd));
+	memcpy(&cmd->buf, &buffer, sizeof(buffer));
+#else
+	cmd->buf = buffer;
+#endif
+	cmd->used_len = cmd_header_len;
+	cmd->total_len = BUFFER_LENGTH;
+
+	if (argc == 4) {
+		memset(filename, 0, sizeof(filename));
+		strncpy(filename, argv[3], sizeof(filename) - 1);
+
+		fp = fopen(filename, "r");
+		if (fp == NULL) {
+			perror("fopen");
+			fprintf(stderr, "Cannot open file %s\n", argv[3]);
+			ret = -EFAULT;
+			;
+			goto done;
+		}
+
+		snprintf(config_id, sizeof(config_id), "Band");
+		id_len = fparse_for_cmd_and_hex(fp, buffer + cmd_header_len,
+						(t_u8 *)config_id);
+
+		snprintf(config_id, sizeof(config_id), "HECap");
+		fparse_for_cmd_and_hex(fp, buffer + cmd_header_len + id_len,
+				       (t_u8 *)config_id);
+		hexdump("Set 11axcfg", buffer + cmd_header_len,
+			sizeof(mlan_ds_11ax_he_cfg), ' ');
+		cmd->used_len = cmd_header_len + sizeof(mlan_ds_11ax_he_cfg);
+	}
+	/* Initialize the ifr structure */
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_ifrn.ifrn_name, dev_name, strlen(dev_name));
+	ifr.ifr_ifru.ifru_data = (void *)cmd;
+
+	if (ioctl(sockfd, MLAN_ETH_PRIV, &ifr)) {
+		perror("mlanutl: 11axcfg");
+		ret = -EFAULT;
+		goto done;
+	}
+	hexdump("11axcfg", buffer + cmd_header_len, sizeof(mlan_ds_11ax_he_cfg),
+		' ');
+done:
+	if (fp)
+		fclose(fp);
+
+	if (buffer)
+		free(buffer);
+	if (cmd)
+		free(cmd);
+	return ret;
+}
+
+/**
+ *  @brief Process 11ax command
+ *  @param argc   Number of arguments
+ *  @param argv   A pointer to arguments array
+ *  @return     MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+static int process_11axcmdcfg(int argc, char *argv[])
+{
+	t_u8 *buffer = NULL;
+	struct eth_priv_cmd *cmd = NULL;
+	struct ifreq ifr;
+	mlan_ds_11ax_cmd_cfg *axcmd = NULL;
+	t_u32 action = 0;
+	t_u32 prefix_len = 0;
+
+	if (strcmp(argv[3], "tx_omi") == 0) {
+		sprintf(argv[3], "%d", MLAN_11AXCMD_CFG_ID_TX_OMI);
+	} else if (strcmp(argv[3], "obssnbru_toltime") == 0) {
+		sprintf(argv[3], "%d", MLAN_11AXCMD_CFG_ID_OBSSNBRU_TOLTIME);
+	} else {
+		printf("ERR:unknown command %s!\n", argv[3]);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Initialize buffer */
+	buffer = (t_u8 *)malloc(BUFFER_LENGTH);
+	if (!buffer) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		return MLAN_STATUS_FAILURE;
+	}
+
+	prepare_buffer(buffer, argv[2], (argc - 3), &argv[3]);
+
+	cmd = (struct eth_priv_cmd *)malloc(sizeof(struct eth_priv_cmd));
+	if (!cmd) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Fill up buffer */
+#ifdef USERSPACE_32BIT_OVER_KERNEL_64BIT
+	memset(cmd, 0, sizeof(struct eth_priv_cmd));
+	memcpy(&cmd->buf, &buffer, sizeof(buffer));
+#else
+	cmd->buf = buffer;
+#endif
+	cmd->used_len = strlen((char *)buffer);
+	cmd->total_len = BUFFER_LENGTH;
+
+	/* Perform IOCTL */
+	memset(&ifr, 0, sizeof(struct ifreq));
+	strncpy(ifr.ifr_ifrn.ifrn_name, dev_name, strlen(dev_name));
+	ifr.ifr_ifru.ifru_data = (void *)cmd;
+
+	if (ioctl(sockfd, MLAN_ETH_PRIV, &ifr)) {
+		perror("mlanutl");
+		fprintf(stderr, "mlanutl: 11axcmd fail\n");
+		if (cmd)
+			free(cmd);
+		if (buffer)
+			free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	prefix_len += strlen(CMD_NXP) + strlen(argv[2]);
+	action = *(t_u32 *)(buffer + prefix_len);
+	if (action == MLAN_ACT_SET) {
+		if (argv[4] == 0) {
+			printf("Invalid OBSSNBRU tolerance time: Valid range[1..3600]\n");
+			free(buffer);
+			return MLAN_STATUS_FAILURE;
+		}
+	}
+	if (action == MLAN_ACT_GET) {
+		axcmd = (mlan_ds_11ax_cmd_cfg *)(buffer + prefix_len +
+						 sizeof(t_u32));
+		switch (axcmd->sub_id) {
+		case MLAN_11AXCMD_TXOMI_SUBID:
+			printf("tx OMI: 0x%x\n", axcmd->param.txomi_cfg.omi &
+							 MASK_11AX_OM_CONTROL);
+			break;
+		case MLAN_11AXCMD_OBSS_TOLTIME_SUBID:
+			if (axcmd->param.toltime_cfg.tol_time > 3600 ||
+			    !axcmd->param.toltime_cfg.tol_time)
+				printf("OBSS Narrow Bandwidth RU tolerance Time: disabled\n");
+			else
+				printf("OBSS Narrow Bandwidth RU Tolerance Time: %d sec\n",
+				       axcmd->param.toltime_cfg.tol_time);
+			break;
+		default:
+			printf("Unknown sub_command 0x%x\n", axcmd->sub_id);
+			break;
+		}
+	}
+
+	if (buffer)
+		free(buffer);
+	if (cmd)
+		free(cmd);
+
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief Process tx rate configuration
+ *  @param argc   Number of arguments
+ *  @param argv   A pointer to arguments array
+ *  @return     MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+static int process_txratecfg(int argc, char *argv[])
+{
+	t_u8 *buffer = NULL;
+	struct eth_priv_cmd *cmd = NULL;
+	struct eth_priv_tx_rate_cfg *txratecfg = NULL;
+	struct ifreq ifr;
+
+	/* Initialize buffer */
+	buffer = (t_u8 *)malloc(BUFFER_LENGTH);
+	if (!buffer) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		return MLAN_STATUS_FAILURE;
+	}
+
+	prepare_buffer(buffer, argv[2], (argc - 3), &argv[3]);
+
+	cmd = (struct eth_priv_cmd *)malloc(sizeof(struct eth_priv_cmd));
+	if (!cmd) {
+		printf("ERR:Cannot allocate buffer for command!\n");
+		free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Fill up buffer */
+#ifdef USERSPACE_32BIT_OVER_KERNEL_64BIT
+	memset(cmd, 0, sizeof(struct eth_priv_cmd));
+	memcpy(&cmd->buf, &buffer, sizeof(buffer));
+#else
+	cmd->buf = buffer;
+#endif
+	cmd->used_len = 0;
+	cmd->total_len = BUFFER_LENGTH;
+
+	/* Perform IOCTL */
+	memset(&ifr, 0, sizeof(struct ifreq));
+	strncpy(ifr.ifr_ifrn.ifrn_name, dev_name, strlen(dev_name));
+	ifr.ifr_ifru.ifru_data = (void *)cmd;
+
+	if (ioctl(sockfd, MLAN_ETH_PRIV, &ifr)) {
+		perror("mlanutl");
+		fprintf(stderr, "mlanutl: txratecfg fail\n");
+		if (cmd)
+			free(cmd);
+		if (buffer)
+			free(buffer);
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Process result */
+	txratecfg = (struct eth_priv_tx_rate_cfg *)buffer;
+	if (argc == 3) {
+		/* GET operation */
+		printf("Tx Rate Configuration: \n");
+		/* format */
+		if (txratecfg->rate_format == 0xFF) {
+			printf("    Type:       0xFF (Auto)\n");
+		} else if (txratecfg->rate_format <= 3) {
+			printf("    Type:       %d (%s)\n",
+			       txratecfg->rate_format,
+			       rate_format[txratecfg->rate_format]);
+			if (txratecfg->rate_format == 0)
+				printf("    Rate Index: %d (%s)\n",
+				       txratecfg->rate_index,
+				       lg_rate[txratecfg->rate_index]);
+			else if (txratecfg->rate_format >= 1)
+				printf("    MCS Index:  %d\n",
+				       (int)txratecfg->rate_index);
+			if (txratecfg->rate_format == 2 ||
+			    txratecfg->rate_format == 3)
+				printf("    NSS:        %d\n",
+				       (int)txratecfg->nss);
+			if (txratecfg->rate_setting == 0xffff)
+				printf("Rate setting :Preamble type/BW/GI/STBC/.. : auto \n");
+			else {
+				printf("Preamble type: %x\n",
+				       (txratecfg->rate_setting & 0x0003));
+				printf("BW: %x\n",
+				       (txratecfg->rate_setting & 0x001C) >> 2);
+				printf("LTF + GI size %x\n",
+				       (txratecfg->rate_setting & 0x0060) >> 5);
+				printf("STBC %x\n",
+				       (txratecfg->rate_setting & 0x0080) >> 7);
+				printf("DCM %x\n",
+				       (txratecfg->rate_setting & 0x0100) >> 8);
+				printf("Coding %x\n",
+				       (txratecfg->rate_setting & 0x0200) >> 9);
+				printf("maxPE %x\n",
+				       (txratecfg->rate_setting & 0x3000) >>
+					       12);
+			}
+		} else {
+			printf("    Unknown rate format.\n");
+		}
+	}
+
+	if (buffer)
+		free(buffer);
+	if (cmd)
+		free(cmd);
+
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief Process host_cmd response
+ *  @param cmd_name Command name
+ *  @param buf      A pointer to the response buffer
+ *  @return         MLAN_STATUS_SUCCESS--success, otherwise--fail
+ */
+int process_host_cmd_resp(char *cmd_name, t_u8 *buf)
+{
+	t_u32 hostcmd_size = 0;
+	HostCmd_DS_GEN *hostcmd = NULL;
+	int ret = MLAN_STATUS_SUCCESS;
+
+	buf += strlen(CMD_NXP) + strlen(cmd_name);
+	memcpy((t_u8 *)&hostcmd_size, buf, sizeof(t_u32));
+	buf += sizeof(t_u32);
+
+	hostcmd = (HostCmd_DS_GEN *)buf;
+	hostcmd->command = le16_to_cpu(hostcmd->command);
+	hostcmd->size = le16_to_cpu(hostcmd->size);
+	hostcmd->seq_num = le16_to_cpu(hostcmd->seq_num);
+	hostcmd->result = le16_to_cpu(hostcmd->result);
+
+	hostcmd->command &= ~HostCmd_RET_BIT;
+	if (!hostcmd->result) {
+		switch (hostcmd->command) {
+		case HostCmd_CMD_CFG_DATA: {
+			HostCmd_DS_802_11_CFG_DATA *pstcfgData =
+				(HostCmd_DS_802_11_CFG_DATA *)(buf + S_DS_GEN);
+			pstcfgData->data_len =
+				le16_to_cpu(pstcfgData->data_len);
+			pstcfgData->action = le16_to_cpu(pstcfgData->action);
+
+			if (pstcfgData->action == HostCmd_ACT_GEN_GET) {
+				hexdump("cfgdata", pstcfgData->data,
+					pstcfgData->data_len, ' ');
+			}
+			break;
+		}
+		case HostCmd_CMD_802_11_TPC_ADAPT_REQ: {
+			mlan_ioctl_11h_tpc_resp *tpcIoctlResp =
+				(mlan_ioctl_11h_tpc_resp *)(buf + S_DS_GEN);
+			if (tpcIoctlResp->status_code == 0) {
+				printf("tpcrequest:  txPower(%d), linkMargin(%d), rssi(%d)\n",
+				       tpcIoctlResp->tx_power,
+				       tpcIoctlResp->link_margin,
+				       tpcIoctlResp->rssi);
+			} else {
+				printf("tpcrequest:  failure, status = %d\n",
+				       tpcIoctlResp->status_code);
+			}
+			break;
+		}
+		case HostCmd_CMD_802_11_CRYPTO: {
+			t_u16 alg = le16_to_cpu(
+				(t_u16) * (buf + S_DS_GEN + sizeof(t_u16)));
+			if (alg == CIPHER_TEST_AES_CCM ||
+			    alg == CIPHER_TEST_GCMP) {
+				HostCmd_DS_802_11_CRYPTO_AES_CCM *cmd_aes_ccm =
+					(HostCmd_DS_802_11_CRYPTO_AES_CCM
+						 *)(buf + S_DS_GEN);
+
+				cmd_aes_ccm->encdec =
+					le16_to_cpu(cmd_aes_ccm->encdec);
+				cmd_aes_ccm->algorithm =
+					le16_to_cpu(cmd_aes_ccm->algorithm);
+				cmd_aes_ccm->key_length =
+					le16_to_cpu(cmd_aes_ccm->key_length);
+				cmd_aes_ccm->nonce_length =
+					le16_to_cpu(cmd_aes_ccm->nonce_length);
+				cmd_aes_ccm->AAD_length =
+					le16_to_cpu(cmd_aes_ccm->AAD_length);
+				cmd_aes_ccm->data.header.type = le16_to_cpu(
+					cmd_aes_ccm->data.header.type);
+				cmd_aes_ccm->data.header.len = le16_to_cpu(
+					cmd_aes_ccm->data.header.len);
+
+				printf("crypto_result: encdec=%d algorithm=%d, KeyLen=%d,"
+				       " NonceLen=%d,AADLen=%d,dataLen=%d\n",
+				       cmd_aes_ccm->encdec,
+				       cmd_aes_ccm->algorithm,
+				       cmd_aes_ccm->key_length,
+				       cmd_aes_ccm->nonce_length,
+				       cmd_aes_ccm->AAD_length,
+				       cmd_aes_ccm->data.header.len);
+
+				hexdump("Key", cmd_aes_ccm->key,
+					cmd_aes_ccm->key_length, ' ');
+				hexdump("Nonce", cmd_aes_ccm->nonce,
+					cmd_aes_ccm->nonce_length, ' ');
+				hexdump("AAD", cmd_aes_ccm->AAD,
+					cmd_aes_ccm->AAD_length, ' ');
+				hexdump("Data", cmd_aes_ccm->data.data,
+					cmd_aes_ccm->data.header.len, ' ');
+			} else if (alg == CIPHER_TEST_WAPI) {
+				HostCmd_DS_802_11_CRYPTO_WAPI *cmd_wapi =
+					(HostCmd_DS_802_11_CRYPTO_WAPI
+						 *)(buf + S_DS_GEN);
+
+				cmd_wapi->encdec =
+					le16_to_cpu(cmd_wapi->encdec);
+				cmd_wapi->algorithm =
+					le16_to_cpu(cmd_wapi->algorithm);
+				cmd_wapi->key_length =
+					le16_to_cpu(cmd_wapi->key_length);
+				cmd_wapi->nonce_length =
+					le16_to_cpu(cmd_wapi->nonce_length);
+				cmd_wapi->AAD_length =
+					le16_to_cpu(cmd_wapi->AAD_length);
+
+				printf("crypto_result: encdec=%d algorithm=%d, KeyLen=%d,"
+				       " NonceLen=%d,AADLen=%d,dataLen=%d\n",
+				       cmd_wapi->encdec, cmd_wapi->algorithm,
+				       cmd_wapi->key_length,
+				       cmd_wapi->nonce_length,
+				       cmd_wapi->AAD_length,
+				       cmd_wapi->data_length);
+
+				hexdump("Key", cmd_wapi->key,
+					cmd_wapi->key_length, ' ');
+				hexdump("Nonce", cmd_wapi->nonce,
+					cmd_wapi->nonce_length, ' ');
+				hexdump("AAD", cmd_wapi->AAD,
+					cmd_wapi->AAD_length, ' ');
+			} else {
+				HostCmd_DS_802_11_CRYPTO *cmd =
+					(HostCmd_DS_802_11_CRYPTO *)(buf +
+								     S_DS_GEN);
+				cmd->encdec = le16_to_cpu(cmd->encdec);
+				cmd->algorithm = le16_to_cpu(cmd->algorithm);
+				cmd->key_IV_length =
+					le16_to_cpu(cmd->key_IV_length);
+				cmd->key_length = le16_to_cpu(cmd->key_length);
+				cmd->data.header.type =
+					le16_to_cpu(cmd->data.header.type);
+				cmd->data.header.len =
+					le16_to_cpu(cmd->data.header.len);
+
+				printf("crypto_result: encdec=%d algorithm=%d,KeyIVLen=%d,"
+				       " KeyLen=%d,dataLen=%d\n",
+				       cmd->encdec, cmd->algorithm,
+				       cmd->key_IV_length, cmd->key_length,
+				       cmd->data.header.len);
+				hexdump("KeyIV", cmd->keyIV, cmd->key_IV_length,
+					' ');
+				hexdump("Key", cmd->key, cmd->key_length, ' ');
+				hexdump("Data", cmd->data.data,
+					cmd->data.header.len, ' ');
+			}
+			break;
+		}
+		case HostCmd_CMD_802_11_AUTO_TX: {
+			HostCmd_DS_802_11_AUTO_TX *at =
+				(HostCmd_DS_802_11_AUTO_TX *)(buf + S_DS_GEN);
+
+			if (le16_to_cpu(at->action) == HostCmd_ACT_GEN_GET) {
+				if (S_DS_GEN + sizeof(at->action) ==
+				    hostcmd->size) {
+					printf("auto_tx not configured\n");
+
+				} else {
+					MrvlIEtypesHeader_t *header =
+						&at->auto_tx.header;
+
+					header->type =
+						le16_to_cpu(header->type);
+					header->len = le16_to_cpu(header->len);
+
+					if ((S_DS_GEN + sizeof(at->action) +
+						     sizeof(MrvlIEtypesHeader_t) +
+						     header->len ==
+					     hostcmd->size) &&
+					    (header->type ==
+					     TLV_TYPE_AUTO_TX)) {
+						AutoTx_MacFrame_t *atmf =
+							&at->auto_tx
+								 .auto_tx_mac_frame;
+
+						printf("Interval: %d second(s)\n",
+						       le16_to_cpu(
+							       atmf->interval));
+						printf("Priority: %#x\n",
+						       atmf->priority);
+						printf("Frame Length: %d\n",
+						       le16_to_cpu(
+							       atmf->frame_len));
+						printf("Dest Mac Address: "
+						       "%02x:%02x:%02x:%02x:%02x:%02x\n",
+						       atmf->dest_mac_addr[0],
+						       atmf->dest_mac_addr[1],
+						       atmf->dest_mac_addr[2],
+						       atmf->dest_mac_addr[3],
+						       atmf->dest_mac_addr[4],
+						       atmf->dest_mac_addr[5]);
+						printf("Src Mac Address: "
+						       "%02x:%02x:%02x:%02x:%02x:%02x\n",
+						       atmf->src_mac_addr[0],
+						       atmf->src_mac_addr[1],
+						       atmf->src_mac_addr[2],
+						       atmf->src_mac_addr[3],
+						       atmf->src_mac_addr[4],
+						       atmf->src_mac_addr[5]);
+
+						hexdump("Frame Payload",
+							atmf->payload,
+							le16_to_cpu(
+								atmf->frame_len) -
+								MLAN_MAC_ADDR_LENGTH *
+									2,
+							' ');
+					} else {
+						printf("incorrect auto_tx command response\n");
+					}
+				}
+			}
+			break;
+		}
+		case HostCmd_CMD_802_11_SUBSCRIBE_EVENT: {
+			HostCmd_DS_802_11_SUBSCRIBE_EVENT *se =
+				(HostCmd_DS_802_11_SUBSCRIBE_EVENT *)(buf +
+								      S_DS_GEN);
+			if (le16_to_cpu(se->action) == HostCmd_ACT_GEN_GET) {
+				int len =
+					S_DS_GEN +
+					sizeof(HostCmd_DS_802_11_SUBSCRIBE_EVENT);
+				printf("\nEvent\t\tValue\tFreq\tsubscribed\n\n");
+				while (len < hostcmd->size) {
+					MrvlIEtypesHeader_t *header =
+						(MrvlIEtypesHeader_t *)(buf +
+									len);
+					switch (le16_to_cpu(header->type)) {
+					case TLV_TYPE_RSSI_LOW: {
+						MrvlIEtypes_RssiThreshold_t *low_rssi =
+							(MrvlIEtypes_RssiThreshold_t
+								 *)(buf + len);
+						printf("Beacon Low RSSI\t%d\t%d\t%s\n",
+						       low_rssi->RSSI_value,
+						       low_rssi->RSSI_freq,
+						       (le16_to_cpu(se->events) &
+							0x0001) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_SNR_LOW: {
+						MrvlIEtypes_SnrThreshold_t *low_snr =
+							(MrvlIEtypes_SnrThreshold_t
+								 *)(buf + len);
+						printf("Beacon Low SNR\t%d\t%d\t%s\n",
+						       low_snr->SNR_value,
+						       low_snr->SNR_freq,
+						       (le16_to_cpu(se->events) &
+							0x0002) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_FAILCOUNT: {
+						MrvlIEtypes_FailureCount_t
+							*failure_count =
+								(MrvlIEtypes_FailureCount_t
+									 *)(buf +
+									    len);
+						printf("Failure Count\t%d\t%d\t%s\n",
+						       failure_count->fail_value,
+						       failure_count->fail_freq,
+						       (le16_to_cpu(se->events) &
+							0x0004) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_BCNMISS: {
+						MrvlIEtypes_BeaconsMissed_t
+							*bcn_missed =
+								(MrvlIEtypes_BeaconsMissed_t
+									 *)(buf +
+									    len);
+						printf("Beacon Missed\t%d\tN/A\t%s\n",
+						       bcn_missed->beacon_missed,
+						       (le16_to_cpu(se->events) &
+							0x0008) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_RSSI_HIGH: {
+						MrvlIEtypes_RssiThreshold_t
+							*high_rssi =
+								(MrvlIEtypes_RssiThreshold_t
+									 *)(buf +
+									    len);
+						printf("Bcn High RSSI\t%d\t%d\t%s\n",
+						       high_rssi->RSSI_value,
+						       high_rssi->RSSI_freq,
+						       (le16_to_cpu(se->events) &
+							0x0010) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+
+					case TLV_TYPE_SNR_HIGH: {
+						MrvlIEtypes_SnrThreshold_t *high_snr =
+							(MrvlIEtypes_SnrThreshold_t
+								 *)(buf + len);
+						printf("Beacon High SNR\t%d\t%d\t%s\n",
+						       high_snr->SNR_value,
+						       high_snr->SNR_freq,
+						       (le16_to_cpu(se->events) &
+							0x0020) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_RSSI_LOW_DATA: {
+						MrvlIEtypes_RssiThreshold_t *low_rssi =
+							(MrvlIEtypes_RssiThreshold_t
+								 *)(buf + len);
+						printf("Data Low RSSI\t%d\t%d\t%s\n",
+						       low_rssi->RSSI_value,
+						       low_rssi->RSSI_freq,
+						       (le16_to_cpu(se->events) &
+							0x0040) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_SNR_LOW_DATA: {
+						MrvlIEtypes_SnrThreshold_t *low_snr =
+							(MrvlIEtypes_SnrThreshold_t
+								 *)(buf + len);
+						printf("Data Low SNR\t%d\t%d\t%s\n",
+						       low_snr->SNR_value,
+						       low_snr->SNR_freq,
+						       (le16_to_cpu(se->events) &
+							0x0080) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_RSSI_HIGH_DATA: {
+						MrvlIEtypes_RssiThreshold_t
+							*high_rssi =
+								(MrvlIEtypes_RssiThreshold_t
+									 *)(buf +
+									    len);
+						printf("Data High RSSI\t%d\t%d\t%s\n",
+						       high_rssi->RSSI_value,
+						       high_rssi->RSSI_freq,
+						       (le16_to_cpu(se->events) &
+							0x0100) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_SNR_HIGH_DATA: {
+						MrvlIEtypes_SnrThreshold_t *high_snr =
+							(MrvlIEtypes_SnrThreshold_t
+								 *)(buf + len);
+						printf("Data High SNR\t%d\t%d\t%s\n",
+						       high_snr->SNR_value,
+						       high_snr->SNR_freq,
+						       (le16_to_cpu(se->events) &
+							0x0200) ?
+							       "yes" :
+							       "no");
+						break;
+					}
+					case TLV_TYPE_LINK_QUALITY: {
+						MrvlIEtypes_LinkQuality_t *link_qual =
+							(MrvlIEtypes_LinkQuality_t
+								 *)(buf + len);
+						printf("Link Quality Parameters:\n");
+						printf("------------------------\n");
+						printf("Link Quality Event Subscribed\t%s\n",
+						       (le16_to_cpu(se->events) &
+							0x0400) ?
+							       "yes" :
+							       "no");
+						printf("Link SNR Threshold   = %d\n",
+						       le16_to_cpu(
+							       link_qual
+								       ->link_SNR_thrs));
+						printf("Link SNR Frequency   = %d\n",
+						       le16_to_cpu(
+							       link_qual
+								       ->link_SNR_freq));
+						printf("Min Rate Value       = %d\n",
+						       le16_to_cpu(
+							       link_qual
+								       ->min_rate_val));
+						printf("Min Rate Frequency   = %d\n",
+						       le16_to_cpu(
+							       link_qual
+								       ->min_rate_freq));
+						printf("Tx Latency Value     = %d\n",
+						       le32_to_cpu(
+							       link_qual
+								       ->tx_latency_val));
+						printf("Tx Latency Threshold = %d\n",
+						       le32_to_cpu(
+							       link_qual
+								       ->tx_latency_thrs));
+
+						break;
+					}
+					case TLV_TYPE_PRE_BEACON_LOST: {
+						MrvlIEtypes_PreBeaconLost_t
+							*pre_bcn_lost =
+								(MrvlIEtypes_PreBeaconLost_t
+									 *)(buf +
+									    len);
+						printf("------------------------\n");
+						printf("Pre-Beacon Lost Event Subscribed\t%s\n",
+						       (le16_to_cpu(se->events) &
+							0x0800) ?
+							       "yes" :
+							       "no");
+						printf("Pre-Beacon Lost: %d\n",
+						       pre_bcn_lost
+							       ->pre_beacon_lost);
+						break;
+					}
+					default:
+						printf("Unknown subscribed event TLV Type=%#x,"
+						       " Len=%d\n",
+						       le16_to_cpu(
+							       header->type),
+						       le16_to_cpu(
+							       header->len));
+						break;
+					}
+
+					len += (sizeof(MrvlIEtypesHeader_t) +
+						le16_to_cpu(header->len));
+				}
+			}
+			break;
+		}
+		case HostCmd_CMD_MAC_REG_ACCESS:
+		case HostCmd_CMD_BBP_REG_ACCESS:
+		case HostCmd_CMD_RF_REG_ACCESS:
+		case HostCmd_CMD_CAU_REG_ACCESS: {
+			HostCmd_DS_REG *preg =
+				(HostCmd_DS_REG *)(buf + S_DS_GEN);
+			preg->action = le16_to_cpu(preg->action);
+			if (preg->action == HostCmd_ACT_GEN_GET) {
+				preg->value = le32_to_cpu(preg->value);
+				printf("value = 0x%08x\n", preg->value);
+			}
+			break;
+		}
+		case HostCmd_CMD_MEM_ACCESS: {
+			HostCmd_DS_MEM *pmem =
+				(HostCmd_DS_MEM *)(buf + S_DS_GEN);
+			pmem->action = le16_to_cpu(pmem->action);
+			if (pmem->action == HostCmd_ACT_GEN_GET) {
+				pmem->value = le32_to_cpu(pmem->value);
+				printf("value = 0x%08x\n", pmem->value);
+			}
+			break;
+		}
+		case HostCmd_CMD_LINK_STATS_SUMMARY: {
+			HostCmd_DS_LINK_STATS_SUMMARY *linkstats =
+				(HostCmd_DS_LINK_STATS_SUMMARY *)(buf +
+								  S_DS_GEN);
+			/* GET operation */
+			printf("Link Statistics: \n");
+			/* format */
+			printf("Duration:   %u\n",
+			       (int)le32_to_cpu(
+				       linkstats->timeSinceLastQuery_ms));
+
+			printf("Beacon count:     %u\n",
+			       le16_to_cpu(linkstats->bcnCnt));
+			printf("Beacon missing:   %u\n",
+			       le16_to_cpu(linkstats->bcnMiss));
+			printf("Beacon RSSI avg:  %d\n",
+			       le16_to_cpu(linkstats->bcnRssiAvg));
+			printf("Beacon SNR avg:   %d\n",
+			       le16_to_cpu(linkstats->bcnSnrAvg));
+
+			printf("Rx packets:       %u\n",
+			       (int)le32_to_cpu(linkstats->rxPkts));
+			printf("Rx RSSI avg:      %d\n",
+			       le16_to_cpu(linkstats->rxRssiAvg));
+			printf("Rx SNR avg:       %d\n",
+			       le16_to_cpu(linkstats->rxSnrAvg));
+
+			printf("Tx packets:       %u\n",
+			       (int)le32_to_cpu(linkstats->txPkts));
+			printf("Tx Attempts:      %u\n",
+			       (int)le32_to_cpu(linkstats->txAttempts));
+			printf("Tx Failures:      %u\n",
+			       (int)le32_to_cpu(linkstats->txFailures));
+			printf("Tx Initial Rate:  %s\n",
+			       rateIdStr[linkstats->txInitRate]);
+
+			printf("Tx AC VO:         %u [ %u ]\n",
+			       le16_to_cpu(linkstats->txQueuePktCnt[WMM_AC_VO]),
+			       (int)le32_to_cpu(
+				       linkstats->txQueueDelay[WMM_AC_VO]) /
+				       1000);
+			printf("Tx AC VI:         %u [ %u ]\n",
+			       le16_to_cpu(linkstats->txQueuePktCnt[WMM_AC_VI]),
+			       (int)le32_to_cpu(
+				       linkstats->txQueueDelay[WMM_AC_VI]) /
+				       1000);
+			printf("Tx AC BE:         %u [ %u ]\n",
+			       le16_to_cpu(linkstats->txQueuePktCnt[WMM_AC_BE]),
+			       (int)le32_to_cpu(
+				       linkstats->txQueueDelay[WMM_AC_BE]) /
+				       1000);
+			printf("Tx AC BK:         %u [ %u ]\n",
+			       le16_to_cpu(linkstats->txQueuePktCnt[WMM_AC_BK]),
+			       (int)le32_to_cpu(
+				       linkstats->txQueueDelay[WMM_AC_BK]) /
+				       1000);
+			break;
+		}
+		case HostCmd_CMD_WMM_PARAM_CONFIG: {
+			HostCmd_DS_WMM_PARAM_CONFIG *wmm_param =
+				(HostCmd_DS_WMM_PARAM_CONFIG *)(buf + S_DS_GEN);
+			printf("WMM Params: \n");
+			printf("\tBE: AIFSN=%d, CW_MAX=%d CW_MIN=%d, TXOP=%d\n",
+			       wmm_param->ac_params[AC_BE].aci_aifsn.aifsn,
+			       wmm_param->ac_params[AC_BE].ecw.ecw_max,
+			       wmm_param->ac_params[AC_BE].ecw.ecw_min,
+			       le16_to_cpu(
+				       wmm_param->ac_params[AC_BE].tx_op_limit));
+			printf("\tBK: AIFSN=%d, CW_MAX=%d CW_MIN=%d, TXOP=%d\n",
+			       wmm_param->ac_params[AC_BK].aci_aifsn.aifsn,
+			       wmm_param->ac_params[AC_BK].ecw.ecw_max,
+			       wmm_param->ac_params[AC_BK].ecw.ecw_min,
+			       le16_to_cpu(
+				       wmm_param->ac_params[AC_BK].tx_op_limit));
+			printf("\tVI: AIFSN=%d, CW_MAX=%d CW_MIN=%d, TXOP=%d\n",
+			       wmm_param->ac_params[AC_VI].aci_aifsn.aifsn,
+			       wmm_param->ac_params[AC_VI].ecw.ecw_max,
+			       wmm_param->ac_params[AC_VI].ecw.ecw_min,
+			       le16_to_cpu(
+				       wmm_param->ac_params[AC_VI].tx_op_limit));
+			printf("\tVO: AIFSN=%d, CW_MAX=%d CW_MIN=%d, TXOP=%d\n",
+			       wmm_param->ac_params[AC_VO].aci_aifsn.aifsn,
+			       wmm_param->ac_params[AC_VO].ecw.ecw_max,
+			       wmm_param->ac_params[AC_VO].ecw.ecw_min,
+			       le16_to_cpu(
+				       wmm_param->ac_params[AC_VO].tx_op_limit));
+			break;
+		}
+		default:
+			printf("HOSTCMD_RESP: CmdCode=%#04x, Size=%#04x,"
+			       " SeqNum=%#04x, Result=%#04x\n",
+			       hostcmd->command, hostcmd->size,
+			       hostcmd->seq_num, hostcmd->result);
+			hexdump("payload", (t_void *)(buf + S_DS_GEN),
+				hostcmd->size - S_DS_GEN, ' ');
+			break;
+		}
+	} else {
+		printf("HOSTCMD failed: CmdCode=%#04x, Size=%#04x,"
+		       " SeqNum=%#04x, Result=%#04x\n",
+		       hostcmd->command, hostcmd->size, hostcmd->seq_num,
+		       hostcmd->result);
+	}
+	return ret;
+}
+
 /********************************************************
 			Global Functions
 ********************************************************/
diff --git a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h
index c7b215f..319b5fa 100644
--- a/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h
+++ b/mxm_wifiex/wlan_src/mapp/mlanutl/mlanutl.h
@@ -3,7 +3,7 @@
  * @brief This file contains definitions for application
  *
  *
- * Copyright 2011-2020 NXP
+ * Copyright 2011-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -136,7 +136,7 @@ enum _mlan_act_ioctl {
 #define MLAN_ETH_PRIV (SIOCDEVPRIVATE + 14)
 
 /** Command buffer max length */
-#define BUFFER_LENGTH (3 * 1024)
+#define BUFFER_LENGTH (4 * 1024)
 
 /** Find number of elements */
 #define NELEMENTS(x) (sizeof(x) / sizeof(x[0]))
@@ -357,6 +357,14 @@ struct eth_priv_get_log {
 	t_u32 channel_number;
 	/** Channel Switch Mode */
 	t_u32 channel_switch_mode;
+	/** Reset Rx Mac Recovery Count */
+	t_u32 rx_reset_mac_recovery_cnt;
+	/** ISR2 Not Done Count*/
+	t_u32 rx_Isr2_NotDone_Cnt;
+	/** GDMA Abort Count */
+	t_u32 gdma_abort_cnt;
+	/** Rx Reset MAC Count */
+	t_u32 g_reset_rx_mac_cnt;
 };
 
 /** MLAN MAC Address Length */
@@ -712,4 +720,467 @@ struct eth_priv_vhtcfg {
 	t_u16 vht_tx_max_rate;
 };
 
+/** data structure for cmd txratecfg */
+struct eth_priv_tx_rate_cfg {
+	/* LG rate: 0, HT rate: 1, VHT rate: 2 */
+	t_u32 rate_format;
+	/** Rate/MCS index (0xFF: auto) */
+	t_u32 rate_index;
+	/** Rate rate */
+	t_u32 rate;
+	/** NSS */
+	t_u32 nss;
+	/** Rate Setting */
+	t_u16 rate_setting;
+};
+
+#define MLAN_11AXCMD_CFG_ID_TX_OMI 6
+#define MLAN_11AXCMD_CFG_ID_OBSSNBRU_TOLTIME 7
+
+#define MLAN_11AXCMD_TXOMI_SUBID 0x105
+#define MLAN_11AXCMD_OBSS_TOLTIME_SUBID 0x106
+
+/** Type definition of mlan_ds_11ax_he_capa for MLAN_OID_11AX_HE_CFG */
+typedef struct _mlan_ds_11ax_he_capa {
+	/** tlv id of he capability */
+	t_u16 id;
+	/** length of the payload */
+	t_u16 len;
+	/** extension id */
+	t_u8 ext_id;
+	/** he mac capability info */
+	t_u8 he_mac_cap[6];
+	/** he phy capability info */
+	t_u8 he_phy_cap[11];
+	/** he txrx mcs support for 80MHz */
+	t_u8 he_txrx_mcs_support[4];
+	/** val for txrx mcs 160Mhz or 80+80, and PPE thresholds */
+	t_u8 val[28];
+} __ATTRIB_PACK__ mlan_ds_11ax_he_capa, *pmlan_ds_11ax_he_capa;
+
+/** Type definition of mlan_ds_11ax_he_cfg for MLAN_OID_11AX_HE_CFG */
+typedef struct _mlan_ds_11ax_he_cfg {
+	/** band, BIT0:2.4G, BIT1:5G*/
+	t_u8 band;
+	/** mlan_ds_11ax_he_capa */
+	mlan_ds_11ax_he_capa he_cap;
+} __ATTRIB_PACK__ mlan_ds_11ax_he_cfg, *pmlan_ds_11ax_he_cfg;
+
+/** Type definition of mlan_11axcmdcfg_obss_pd_offset for MLAN_OID_11AX_CMD_CFG
+ */
+typedef struct _mlan_11axcmdcfg_obss_pd_offset {
+	/** <NON_SRG_OffSET, SRG_OFFSET> */
+	t_u8 offset[2];
+} __ATTRIB_PACK__ mlan_11axcmdcfg_obss_pd_offset;
+
+/** Type definition of mlan_11axcmdcfg_sr_control for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_11axcmdcfg_sr_control {
+	/** 1 enable, 0 disable */
+	t_u8 control;
+} __ATTRIB_PACK__ mlan_11axcmdcfg_sr_control;
+
+/** Type definition of mlan_ds_11ax_sr_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_sr_cmd {
+	/** type*/
+	t_u16 type;
+	/** length of TLV */
+	t_u16 len;
+	/** value */
+	union {
+		mlan_11axcmdcfg_obss_pd_offset obss_pd_offset;
+		mlan_11axcmdcfg_sr_control sr_control;
+	} param;
+} __ATTRIB_PACK__ mlan_ds_11ax_sr_cmd, *pmlan_ds_11ax_sr_cmd;
+
+/** Type definition of mlan_ds_11ax_beam_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_beam_cmd {
+	/** command value: 1 is disable, 0 is enable*/
+	t_u8 value;
+} mlan_ds_11ax_beam_cmd, *pmlan_ds_11ax_beam_cmd;
+
+/** Type definition of mlan_ds_11ax_htc_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_htc_cmd {
+	/** command value: 1 is enable, 0 is disable*/
+	t_u8 value;
+} mlan_ds_11ax_htc_cmd, *pmlan_ds_11ax_htc_cmd;
+
+/** Type definition of mlan_ds_11ax_txop_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_txop_cmd {
+	/** Two byte rts threshold value of which only 10 bits, bit 0 to bit 9
+	 * are valid */
+	t_u16 rts_thres;
+} mlan_ds_11ax_txop_cmd, *pmlan_ds_11ax_txop_cmd;
+
+/** Type definition of mlan_ds_11ax_txomi_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_txomi_cmd {
+	/* 11ax spec 9.2.4.6a.2 OM Control 12 bits. Bit 0 to bit 11 */
+	t_u16 omi;
+} mlan_ds_11ax_txomi_cmd, *pmlan_ds_11ax_txomi_cmd;
+
+/** Type definition of mlan_ds_11ax_toltime_cmd for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_toltime_cmd {
+	/* OBSS Narrow Bandwidth RU Tolerance Time */
+	t_u32 tol_time;
+} mlan_ds_11ax_toltime_cmd, *pmlan_ds_11ax_toltime_cmd;
+
+/** Type definition of mlan_ds_11ax_cmd_cfg for MLAN_OID_11AX_CMD_CFG */
+typedef struct _mlan_ds_11ax_cmd_cfg {
+	/** Sub-command */
+	t_u32 sub_command;
+	/** Sub-id */
+	t_u32 sub_id;
+	/** 802.11n configuration parameter */
+	union {
+		/** SR configuration for MLAN_11AXCMD_SR_SUBID */
+		mlan_ds_11ax_sr_cmd sr_cfg;
+		/** Beam configuration for MLAN_11AXCMD_BEAM_SUBID */
+		mlan_ds_11ax_beam_cmd beam_cfg;
+		/** HTC configuration for MLAN_11AXCMD_HTC_SUBID */
+		mlan_ds_11ax_htc_cmd htc_cfg;
+		/** HTC configuration for MLAN_11AXCMD_TXOPRTS_SUBID */
+		mlan_ds_11ax_txop_cmd txop_cfg;
+		/** HTC configuration for MLAN_11AXCMD_TXOMI_SUBID */
+		mlan_ds_11ax_txomi_cmd txomi_cfg;
+		/** HTC configuration for MLAN_11AXCMD_TXOMI_SUBID */
+		mlan_ds_11ax_toltime_cmd toltime_cfg;
+	} param;
+} mlan_ds_11ax_cmd_cfg, *pmlan_ds_11ax_cmd_cfg;
+
+/** Maximum number of AC QOS queues available in the driver/firmware */
+#define MAX_AC_QUEUES 4
+
+/** Read/Write Mac register */
+#define HostCmd_CMD_MAC_REG_ACCESS 0x0019
+/** Read/Write BBP register */
+#define HostCmd_CMD_BBP_REG_ACCESS 0x001a
+/** Read/Write RF register */
+#define HostCmd_CMD_RF_REG_ACCESS 0x001b
+
+/** Data structure of WMM Aci/Aifsn */
+typedef struct _IEEEtypes_WmmAciAifsn_t {
+#ifdef BIG_ENDIAN_SUPPORT
+	/** Reserved */
+	t_u8 reserved : 1;
+	/** Aci */
+	t_u8 aci : 2;
+	/** Acm */
+	t_u8 acm : 1;
+	/** Aifsn */
+	t_u8 aifsn : 4;
+#else
+	/** Aifsn */
+	t_u8 aifsn : 4;
+	/** Acm */
+	t_u8 acm : 1;
+	/** Aci */
+	t_u8 aci : 2;
+	/** Reserved */
+	t_u8 reserved : 1;
+#endif
+} __ATTRIB_PACK__ IEEEtypes_WmmAciAifsn_t, *pIEEEtypes_WmmAciAifsn_t;
+
+/** Data structure of WMM ECW */
+typedef struct _IEEEtypes_WmmEcw_t {
+#ifdef BIG_ENDIAN_SUPPORT
+	/** Maximum Ecw */
+	t_u8 ecw_max : 4;
+	/** Minimum Ecw */
+	t_u8 ecw_min : 4;
+#else
+	/** Minimum Ecw */
+	t_u8 ecw_min : 4;
+	/** Maximum Ecw */
+	t_u8 ecw_max : 4;
+#endif
+} __ATTRIB_PACK__ IEEEtypes_WmmEcw_t, *pIEEEtypes_WmmEcw_t;
+
+/** Data structure of WMM AC parameters  */
+typedef struct _IEEEtypes_WmmAcParameters_t {
+	IEEEtypes_WmmAciAifsn_t aci_aifsn; /**< AciAifSn */
+	IEEEtypes_WmmEcw_t ecw; /**< Ecw */
+	t_u16 tx_op_limit; /**< Tx op limit */
+} __ATTRIB_PACK__ IEEEtypes_WmmAcParameters_t, *pIEEEtypes_WmmAcParameters_t;
+
+/** HostCmd_DS_802_11_CFG_DATA */
+typedef struct MAPP_HostCmd_DS_802_11_CFG_DATA {
+	/** Action */
+	t_u16 action;
+	/** Type */
+	t_u16 type;
+	/** Data length */
+	t_u16 data_len;
+	/** Data */
+	t_u8 data[1];
+} __ATTRIB_PACK__ HostCmd_DS_802_11_CFG_DATA;
+
+/** Host Command ID : Configuration data */
+#define HostCmd_CMD_CFG_DATA 0x008f
+
+/** mlan_ioctl_11h_tpc_resp */
+typedef struct {
+	int status_code; /**< Firmware command result status code */
+	int tx_power; /**< Reported TX Power from the TPC Report */
+	int link_margin; /**< Reported Link margin from the TPC Report */
+	int rssi; /**< RSSI of the received TPC Report frame */
+} __ATTRIB_PACK__ mlan_ioctl_11h_tpc_resp;
+
+/** Host Command ID : 802.11 TPC adapt req */
+#define HostCmd_CMD_802_11_TPC_ADAPT_REQ 0x0060
+
+/** HostCmd_DS_802_11_CRYPTO */
+typedef struct MAPP_HostCmd_DS_802_11_CRYPTO {
+	t_u16 encdec; /**< Decrypt=0, Encrypt=1 */
+	t_u16 algorithm; /**< RC4=1 AES=2 , AES_KEY_WRAP=3 */
+	t_u16 key_IV_length; /**< Length of Key IV (bytes)   */
+	t_u8 keyIV[32]; /**< Key IV */
+	t_u16 key_length; /**< Length of Key (bytes) */
+	t_u8 key[32]; /**< Key */
+	MrvlIEtypes_Data_t data; /**< Plain text if encdec=Encrypt, Ciphertext
+				    data if encdec=Decrypt*/
+} __ATTRIB_PACK__ HostCmd_DS_802_11_CRYPTO;
+
+/** HostCmd_DS_802_11_CRYPTO_AES_CCM */
+typedef struct MAPP_HostCmd_DS_802_11_CRYPTO_AES_CCM {
+	t_u16 encdec; /**< Decrypt=0, Encrypt=1 */
+	t_u16 algorithm; /**< AES_CCM=4 */
+	t_u16 key_length; /**< Length of Key (bytes)  */
+	t_u8 key[32]; /**< Key  */
+	t_u16 nonce_length; /**< Length of Nonce (bytes) */
+	t_u8 nonce[14]; /**< Nonce */
+	t_u16 AAD_length; /**< Length of AAD (bytes) */
+	t_u8 AAD[32]; /**< AAD */
+	MrvlIEtypes_Data_t data; /**< Plain text if encdec=Encrypt, Ciphertext
+				    data if encdec=Decrypt*/
+} __ATTRIB_PACK__ HostCmd_DS_802_11_CRYPTO_AES_CCM;
+
+/** HostCmd_DS_802_11_CRYPTO_WAPI */
+typedef struct MAPP_HostCmd_DS_802_11_CRYPTO_WAPI {
+	t_u16 encdec; /**< Decrypt=0, Encrypt=1 */
+	t_u16 algorithm; /**< WAPI =5 */
+	t_u16 key_length; /**< Length of Key (bytes)  */
+	t_u8 key[32]; /**< Key  */
+	t_u16 nonce_length; /**< Length of Nonce (bytes) */
+	t_u8 nonce[16]; /**< Nonce */
+	t_u16 AAD_length; /**< Length of AAD (bytes) */
+	t_u8 AAD[48]; /**< AAD */
+	t_u16 data_length; /**< Length of data (bytes)  */
+} __ATTRIB_PACK__ HostCmd_DS_802_11_CRYPTO_WAPI;
+/** WAPI cipher test */
+#define CIPHER_TEST_WAPI (5)
+/** AES CCM cipher test */
+#define CIPHER_TEST_AES_CCM (4)
+/** GCMP cipher test */
+#define CIPHER_TEST_GCMP (6)
+/** Host Command ID : 802.11 crypto */
+#define HostCmd_CMD_802_11_CRYPTO 0x0078
+
+/** HostCmd_DS_802_11_SUBSCRIBE_EVENT */
+typedef struct MAPP_HostCmd_DS_802_11_SUBSCRIBE_EVENT {
+	/** Action */
+	t_u16 action;
+	/** Events */
+	t_u16 events;
+} __ATTRIB_PACK__ HostCmd_DS_802_11_SUBSCRIBE_EVENT;
+
+/** MrvlIEtypes_RssiParamSet_t */
+typedef struct MrvlIEtypes_RssiThreshold {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** RSSI value */
+	t_u8 RSSI_value;
+	/** RSSI frequency */
+	t_u8 RSSI_freq;
+} __ATTRIB_PACK__ MrvlIEtypes_RssiThreshold_t;
+
+/** MrvlIEtypes_SnrThreshold_t */
+typedef struct MrvlIEtypes_SnrThreshold {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** SNR value */
+	t_u8 SNR_value;
+	/** SNR frequency */
+	t_u8 SNR_freq;
+} __ATTRIB_PACK__ MrvlIEtypes_SnrThreshold_t;
+
+/** MrvlIEtypes_FailureCount_t */
+typedef struct MrvlIEtypes_FailureCount {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Failure value */
+	t_u8 fail_value;
+	/** Failure frequency */
+	t_u8 fail_freq;
+} __ATTRIB_PACK__ MrvlIEtypes_FailureCount_t;
+
+/** MrvlIEtypes_BeaconsMissed_t */
+typedef struct MrvlIEtypes_BeaconsMissed {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Number of beacons missed */
+	t_u8 beacon_missed;
+	/** Reserved */
+	t_u8 reserved;
+} __ATTRIB_PACK__ MrvlIEtypes_BeaconsMissed_t;
+
+/** MrvlIEtypes_LinkQuality_t */
+typedef struct MrvlIEtypes_LinkQuality {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Link SNR threshold */
+	t_u16 link_SNR_thrs;
+	/** Link SNR frequency */
+	t_u16 link_SNR_freq;
+	/** Minimum rate value */
+	t_u16 min_rate_val;
+	/** Minimum rate frequency */
+	t_u16 min_rate_freq;
+	/** Tx latency value */
+	t_u32 tx_latency_val;
+	/** Tx latency threshold */
+	t_u32 tx_latency_thrs;
+} __ATTRIB_PACK__ MrvlIEtypes_LinkQuality_t;
+
+/** Host Command ID : 802.11 subscribe event */
+#define HostCmd_CMD_802_11_SUBSCRIBE_EVENT 0x0075
+
+/** TLV type : Beacon RSSI low */
+#define TLV_TYPE_RSSI_LOW (PROPRIETARY_TLV_BASE_ID + 0x04) /* 0x0104 */
+/** TLV type : Beacon SNR low */
+#define TLV_TYPE_SNR_LOW (PROPRIETARY_TLV_BASE_ID + 0x05) /* 0x0105 */
+/** TLV type : Fail count */
+#define TLV_TYPE_FAILCOUNT (PROPRIETARY_TLV_BASE_ID + 0x06) /* 0x0106 */
+/** TLV type : BCN miss */
+#define TLV_TYPE_BCNMISS (PROPRIETARY_TLV_BASE_ID + 0x07) /* 0x0107 */
+/** TLV type : Beacon RSSI high */
+#define TLV_TYPE_RSSI_HIGH (PROPRIETARY_TLV_BASE_ID + 0x16) /* 0x0116 */
+/** TLV type : Beacon SNR high */
+#define TLV_TYPE_SNR_HIGH (PROPRIETARY_TLV_BASE_ID + 0x17) /* 0x0117 */
+
+/** TLV type :Link Quality */
+#define TLV_TYPE_LINK_QUALITY (PROPRIETARY_TLV_BASE_ID + 0x24) /* 0x0124 */
+
+/** TLV type : Data RSSI low */
+#define TLV_TYPE_RSSI_LOW_DATA (PROPRIETARY_TLV_BASE_ID + 0x26) /* 0x0126 */
+/** TLV type : Data SNR low */
+#define TLV_TYPE_SNR_LOW_DATA (PROPRIETARY_TLV_BASE_ID + 0x27) /* 0x0127 */
+/** TLV type : Data RSSI high */
+#define TLV_TYPE_RSSI_HIGH_DATA (PROPRIETARY_TLV_BASE_ID + 0x28) /* 0x0128 */
+/** TLV type : Data SNR high */
+#define TLV_TYPE_SNR_HIGH_DATA (PROPRIETARY_TLV_BASE_ID + 0x29) /* 0x0129 */
+
+/** MrvlIEtypes_PreBeaconLost_t */
+typedef struct MrvlIEtypes_PreBeaconLost {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Pre-Beacon Lost */
+	t_u8 pre_beacon_lost;
+	/** Reserved */
+	t_u8 reserved;
+} __ATTRIB_PACK__ MrvlIEtypes_PreBeaconLost_t;
+
+/** TLV type: Pre-Beacon Lost */
+#define TLV_TYPE_PRE_BEACON_LOST (PROPRIETARY_TLV_BASE_ID + 0x49) /* 0x0149 */
+
+/** AutoTx_MacFrame_t */
+typedef struct AutoTx_MacFrame {
+	t_u16 interval; /**< in seconds */
+	t_u8 priority; /**< User Priority: 0~7, ignored if non-WMM */
+	t_u8 reserved; /**< set to 0 */
+	t_u16 frame_len; /**< Length of MAC frame payload */
+	t_u8 dest_mac_addr[MLAN_MAC_ADDR_LENGTH]; /**< Destination MAC address
+						   */
+	t_u8 src_mac_addr[MLAN_MAC_ADDR_LENGTH]; /**< Source MAC address */
+	t_u8 payload[]; /**< Payload */
+} __ATTRIB_PACK__ AutoTx_MacFrame_t;
+
+/** MrvlIEtypes_AutoTx_t */
+typedef struct MrvlIEtypes_AutoTx {
+	MrvlIEtypesHeader_t header; /**< Header */
+	AutoTx_MacFrame_t auto_tx_mac_frame; /**< Auto Tx MAC frame */
+} __ATTRIB_PACK__ MrvlIEtypes_AutoTx_t;
+
+/** HostCmd_DS_802_11_AUTO_TX */
+typedef struct MAPP_HostCmd_DS_802_11_AUTO_TX {
+	/** Action */
+	t_u16 action; /* 0 = ACT_GET; 1 = ACT_SET; */
+	MrvlIEtypes_AutoTx_t auto_tx; /**< Auto Tx */
+} __ATTRIB_PACK__ HostCmd_DS_802_11_AUTO_TX;
+
+/** Host Command ID : 802.11 auto Tx */
+#define HostCmd_CMD_802_11_AUTO_TX 0x0082
+
+/** TLV type : Auto Tx */
+#define TLV_TYPE_AUTO_TX (PROPRIETARY_TLV_BASE_ID + 0x18) /* 0x0118 */
+
+/** Host Command ID : CAU register access */
+#define HostCmd_CMD_CAU_REG_ACCESS 0x00ed
+
+/** Host Command ID : Memory access */
+#define HostCmd_CMD_MEM_ACCESS 0x0086
+
+typedef struct {
+	t_u32 timeSinceLastQuery_ms; /**< Duration of stats collection */
+
+	t_u16 bcnCnt; /**< Number of beacons received */
+	t_u16 bcnMiss; /**< Estimate of beacons missed */
+	t_s16 bcnRssiAvg; /**< Avg beacon RSSI */
+	t_s16 bcnSnrAvg; /**< Avg beacon SNR */
+
+	t_u32 rxPkts; /**< Number of packets received */
+	t_s16 rxRssiAvg; /**< Avg received packet RSSI */
+	t_s16 rxSnrAvg; /**< Avg received packet SNR */
+
+	t_u32 txPkts; /**< Number of packets transmitted */
+	t_u32 txAttempts; /**< Number of attempts made */
+	t_u32 txFailures; /**< Number of pkts that failed */
+	t_u8 txInitRate; /**< Current rate adaptation TX rateid */
+	t_u8 reserved[3]; /**< Reserved */
+
+	t_u16 txQueuePktCnt[MAX_AC_QUEUES]; /**< Number of packets per AC */
+	t_u32 txQueueDelay[MAX_AC_QUEUES]; /**< Averge queue delay per AC*/
+} __ATTRIB_PACK__ HostCmd_DS_LINK_STATS_SUMMARY;
+
+#define HostCmd_CMD_LINK_STATS_SUMMARY 0x00d3
+
+/** Type enumeration of WMM AC_QUEUES */
+typedef enum _wmm_ac {
+	AC_BE,
+	AC_BK,
+	AC_VI,
+	AC_VO,
+} wmm_ac;
+
+/** Data structure of Host command WMM_PARAM_CFG  */
+typedef struct _HostCmd_DS_WMM_PARAM_CONFIG {
+	/** action */
+	t_u16 action;
+	/** AC Parameters Record WMM_AC_BE, WMM_AC_BK, WMM_AC_VI, WMM_AC_VO */
+	IEEEtypes_WmmAcParameters_t ac_params[MAX_AC_QUEUES];
+} __ATTRIB_PACK__ HostCmd_DS_WMM_PARAM_CONFIG;
+
+/** Host Command ID : Configure ADHOC_OVER_IP parameters */
+#define HostCmd_CMD_WMM_PARAM_CONFIG 0x023a
+
+/** HostCmd_DS_REG */
+typedef struct MAPP_HostCmd_DS_REG {
+	/** Read or write */
+	t_u16 action;
+	/** Register offset */
+	t_u16 offset;
+	/** Value */
+	t_u32 value;
+} __ATTRIB_PACK__ HostCmd_DS_REG;
+
+/** HostCmd_DS_MEM */
+typedef struct MAPP_HostCmd_DS_MEM {
+	/** Read or write */
+	t_u16 action;
+	/** Reserved */
+	t_u16 reserved;
+	/** Address */
+	t_u32 addr;
+	/** Value */
+	t_u32 value;
+} __ATTRIB_PACK__ HostCmd_DS_MEM;
+
 #endif /* _MLANUTL_H_ */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11ac.c b/mxm_wifiex/wlan_src/mlan/mlan_11ac.c
index 4023b5c..07d685d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11ac.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11ac.c
@@ -3,7 +3,7 @@
  *  @brief This file contains the functions for station ioctl.
  *
  *
- *  Copyright 2011-2020 NXP
+ *  Copyright 2011-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -27,6 +27,7 @@
 #include "mlan_main.h"
 #include "mlan_wmm.h"
 #include "mlan_11n.h"
+#include "mlan_11ac.h"
 
 #define NO_NSS_SUPPORT 0x3
 
@@ -372,7 +373,7 @@ static mlan_status wlan_11ac_ioctl_vhtcfg(pmlan_adapter pmadapter,
 					nss);
 #if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
 	defined(PCIE9097) || defined(SD9097) || defined(USB9097)
-				if ((rx_nss != 0) && (nss > rx_nss))
+				if ((tx_nss != 0) && (nss > tx_nss))
 					cfg_value = NO_NSS_SUPPORT;
 #endif
 				if ((hw_value == NO_NSS_SUPPORT) ||
@@ -592,15 +593,15 @@ void wlan_show_dot11acdevcap(pmlan_adapter pmadapter, t_u32 cap)
 	switch (GET_VHTCAP_MAXMPDULEN(cap)) {
 	case 0x0:
 		PRINTM(MINFO,
-		       "GET_HW_SPEC: Maximum MSDU length = 3895 octets\n");
+		       "GET_HW_SPEC: Maximum MPDU length = 3895 octets\n");
 		break;
 	case 0x1:
 		PRINTM(MINFO,
-		       "GET_HW_SPEC: Maximum MSDU length = 7991 octets\n");
+		       "GET_HW_SPEC: Maximum MPDU length = 7991 octets\n");
 		break;
 	case 0x2:
 		PRINTM(MINFO,
-		       "GET_HW_SPEC: Maximum MSDU length = 11454 octets\n");
+		       "GET_HW_SPEC: Maximum MPDU length = 11454 octets\n");
 		break;
 	default:
 		PRINTM(MINFO, "Unsupport value\n");
@@ -937,6 +938,146 @@ void wlan_fill_vht_cap_ie(mlan_private *priv, IEEEtypes_VHTCap_t *pvht_cap,
 	return;
 }
 
+/*
+ *  @brief This function check if AP is in 11ac mode
+ *
+ *  @param priv         A pointer to mlan_private structure
+ *
+ *  @return             MTRUE/MFALSE
+ */
+t_u8 wlan_is_ap_in_11ac_mode(mlan_private *priv)
+{
+	BSSDescriptor_t *pbss_desc;
+	IEEEtypes_VHTOprat_t *vht_oprat = MNULL;
+	pbss_desc = &priv->curr_bss_params.bss_descriptor;
+	vht_oprat = pbss_desc->pvht_oprat;
+	if (!pbss_desc->pvht_cap)
+		return MFALSE;
+	if (vht_oprat && (vht_oprat->ieee_hdr.element_id == VHT_OPERATION)) {
+		if (vht_oprat->chan_width == VHT_OPER_CHWD_20_40MHZ)
+			return MFALSE;
+		else
+			return MTRUE;
+	} else
+		return MFALSE;
+}
+
+/**
+ *  @brief This function fills the VHTOperation ie out put format is CPU
+ *
+ *  @param priv         A pointer to mlan_private structure
+ *  @param vht_oprat    A pointer to IEEEtypes_VHTOprat_t structure
+ *  @param sta_ptr      A pointer to sta_node
+ *
+ *  @return             N/A
+ */
+void wlan_fill_tdls_vht_oprat_ie(mlan_private *priv,
+				 IEEEtypes_VHTOprat_t *vht_oprat,
+				 sta_node *sta_ptr)
+{
+	t_u8 supp_chwd_set;
+	t_u8 peer_supp_chwd_set;
+	t_u8 ap_supp_chwd_set;
+	t_u32 usr_vht_cap_info;
+
+	t_u16 mcs_map_user = 0;
+	t_u16 mcs_map_resp = 0;
+	t_u16 mcs_map_result = 0;
+	t_u16 mcs_user = 0;
+	t_u16 mcs_resp = 0;
+	t_u16 nss;
+	t_u8 chan_bw = 0;
+	BSSDescriptor_t *pbss_desc;
+	IEEEtypes_VHTCap_t *pvht_cap = &sta_ptr->vht_cap;
+	IEEEtypes_VHTCap_t *ap_vht_cap = MNULL;
+	ENTER();
+
+	pbss_desc = &priv->curr_bss_params.bss_descriptor;
+
+	/* Check if AP is in 11ac mode */
+	if (MFALSE == wlan_is_ap_in_11ac_mode(priv)) {
+		if (sta_ptr->ExtCap.ieee_hdr.element_id != EXT_CAPABILITY) {
+			PRINTM(MMSG, "No Peer's Ext_cap info\n");
+			return;
+		}
+		if (!ISSUPP_EXTCAP_TDLS_WIDER_BANDWIDTH(
+			    sta_ptr->ExtCap.ext_cap)) {
+			PRINTM(MMSG,
+			       "Peer don't support Wider Bandwitch in Ext_cap\n");
+			return;
+		}
+	} else {
+		ap_vht_cap = pbss_desc->pvht_cap;
+	}
+
+	vht_oprat->ieee_hdr.element_id = VHT_OPERATION;
+	vht_oprat->ieee_hdr.len =
+		sizeof(IEEEtypes_VHTOprat_t) - sizeof(IEEEtypes_Header_t);
+
+	if (pbss_desc->bss_band & BAND_A)
+		usr_vht_cap_info = priv->usr_dot_11ac_dev_cap_a;
+	else
+		usr_vht_cap_info = priv->usr_dot_11ac_dev_cap_bg;
+
+	/* find the minmum bandwith between AP/TDLS peers */
+	supp_chwd_set = GET_VHTCAP_CHWDSET(usr_vht_cap_info);
+	peer_supp_chwd_set = GET_VHTCAP_CHWDSET(pvht_cap->vht_cap.vht_cap_info);
+	supp_chwd_set = MIN(supp_chwd_set, peer_supp_chwd_set);
+
+	/* We need check AP's bandwidth when TDLS_WIDER_BANDWIDTH is off */
+	if (ap_vht_cap &&
+	    !ISSUPP_EXTCAP_TDLS_WIDER_BANDWIDTH(sta_ptr->ExtCap.ext_cap)) {
+		ap_supp_chwd_set =
+			GET_VHTCAP_CHWDSET(ap_vht_cap->vht_cap.vht_cap_info);
+		supp_chwd_set = MIN(supp_chwd_set, ap_supp_chwd_set);
+	}
+	switch (supp_chwd_set) {
+	case VHT_CAP_CHWD_80MHZ:
+		vht_oprat->chan_width = VHT_OPER_CHWD_80MHZ;
+		break;
+	case VHT_CAP_CHWD_160MHZ:
+		vht_oprat->chan_width = VHT_OPER_CHWD_160MHZ;
+		break;
+	case VHT_CAP_CHWD_80_80MHZ:
+		vht_oprat->chan_width = VHT_OPER_CHWD_80_80MHZ;
+		break;
+	}
+
+	/* Fill BASIC VHT MCS and NSS Set */
+	/* rx MCS Set, find the minimum of the user rx mcs and peer rx mcs*/
+	mcs_map_user = GET_DEVRXMCSMAP(priv->usr_dot_11ac_mcs_support);
+	mcs_map_resp = pvht_cap->vht_cap.mcs_sets.rx_mcs_map;
+	mcs_map_result = 0;
+	for (nss = 1; nss <= 8; nss++) {
+		mcs_user = GET_VHTNSSMCS(mcs_map_user, nss);
+		mcs_resp = GET_VHTNSSMCS(mcs_map_resp, nss);
+		if ((mcs_user == NO_NSS_SUPPORT) ||
+		    (mcs_resp == NO_NSS_SUPPORT))
+			SET_VHTNSSMCS(mcs_map_result, nss, NO_NSS_SUPPORT);
+		else
+			SET_VHTNSSMCS(mcs_map_result, nss,
+				      MIN(mcs_user, mcs_resp));
+	}
+	/* Basic MCS map */
+	vht_oprat->basic_MCS_map = mcs_map_result;
+	switch (vht_oprat->chan_width) {
+	case VHT_OPER_CHWD_80MHZ:
+		chan_bw = CHANNEL_BW_80MHZ;
+		break;
+	case VHT_OPER_CHWD_160MHZ:
+		chan_bw = CHANNEL_BW_160MHZ;
+		break;
+	case VHT_OPER_CHWD_80_80MHZ:
+		chan_bw = CHANNEL_BW_80MHZ;
+		break;
+	}
+	vht_oprat->chan_center_freq_1 = wlan_get_center_freq_idx(
+		priv, BAND_AAC, pbss_desc->channel, chan_bw);
+
+	LEAVE();
+	return;
+}
+
 /**
  *  @brief This function would check whether support 80+80Mhz
  *
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11ac.h b/mxm_wifiex/wlan_src/mlan/mlan_11ac.h
index 7b56ed1..9db5f9c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11ac.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11ac.h
@@ -3,7 +3,7 @@
  *  @brief This file contains the functions for station ioctl.
  *
  *
- *  Copyright 2011-2020 NXP
+ *  Copyright 2011-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -35,12 +35,16 @@ void wlan_fill_vht_cap_tlv(mlan_private *priv, MrvlIETypes_VHTCap_t *pvht_cap,
 			   t_u16 bands, t_u8 flag, t_u8 bw_80p80);
 void wlan_fill_vht_cap_ie(mlan_private *priv, IEEEtypes_VHTCap_t *pvht_cap,
 			  t_u16 bands);
+void wlan_fill_tdls_vht_oprat_ie(mlan_private *priv,
+				 IEEEtypes_VHTOprat_t *vht_oprat,
+				 sta_node *sta_ptr);
+t_u8 wlan_is_ap_in_11ac_mode(mlan_private *priv);
 int wlan_cmd_append_11ac_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 			     t_u8 **ppbuffer);
 mlan_status wlan_11ac_cfg_ioctl(pmlan_adapter pmadapter,
 				pmlan_ioctl_req pioctl_req);
 void wlan_update_11ac_cap(mlan_private *pmpriv);
-t_u8 wlan_11ac_bandconfig_allowed(mlan_private *pmpriv, t_u8 bss_band);
+t_u8 wlan_11ac_bandconfig_allowed(mlan_private *pmpriv, t_u16 bss_band);
 t_u8 wlan_is_80_80_support(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc);
 
 mlan_status wlan_cmd_11ac_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11ax.c b/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
index eca6ffc..c8d729d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
@@ -3,7 +3,7 @@
  *  @brief This file contains the functions for 11ax related features.
  *
  *
- *  Copyright 2018-2020 NXP
+ *  Copyright 2018-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -47,6 +47,7 @@
 			Global Functions
 ********************************************************/
 
+#if 0
 /**
  *  @brief This function prints the 802.11ax HE mac capability
  *
@@ -55,13 +56,14 @@
  *
  *  @return        N/A
  */
-void wlan_show_dot11axmaccap(pmlan_adapter pmadapter, t_u32 cap)
+static void wlan_show_dot11axmaccap(pmlan_adapter pmadapter, t_u32 cap)
 {
 	ENTER();
 
 	LEAVE();
 	return;
 }
+#endif
 
 /**
  *  @brief This function check if AP support TWT Response.
@@ -70,7 +72,7 @@ void wlan_show_dot11axmaccap(pmlan_adapter pmadapter, t_u32 cap)
  *
  *  @return        MTRUE/MFALSE
  */
-t_u8 wlan_check_ap_11ax_twt_supported(BSSDescriptor_t *pbss_desc)
+static t_u8 wlan_check_ap_11ax_twt_supported(BSSDescriptor_t *pbss_desc)
 {
 	if (!pbss_desc->phe_cap)
 		return MFALSE;
@@ -123,6 +125,7 @@ t_u8 wlan_check_11ax_twt_supported(mlan_private *pmpriv,
 	return MFALSE;
 }
 
+#if 0
 /**
  *  @brief This function prints the 802.11ax HE PHY cap
  *
@@ -131,14 +134,14 @@ t_u8 wlan_check_11ax_twt_supported(mlan_private *pmpriv,
  *
  *  @return        N/A
  */
-void wlan_show_dot11axphycap(pmlan_adapter pmadapter, t_u32 support)
+static void wlan_show_dot11axphycap(pmlan_adapter pmadapter, t_u32 support)
 {
 	ENTER();
 
 	LEAVE();
 	return;
 }
-
+#endif
 /**
  *  @brief This function fills the HE cap tlv out put format is LE, not CPU
  *
@@ -718,7 +721,7 @@ mlan_status wlan_ret_11ax_cmd(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 	HostCmd_DS_11AX_CMD_CFG *axcmd = &resp->params.axcmd;
 	MrvlIEtypes_Data_t *tlv = MNULL;
 	t_s16 left_len = 0;
-	t_u16 tlv_type = 0, tlv_len = 0;
+	t_u16 tlv_len = 0;
 
 	ENTER();
 
@@ -735,8 +738,7 @@ mlan_status wlan_ret_11ax_cmd(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 			resp->size - sizeof(HostCmd_DS_11AX_CMD_CFG) - S_DS_GEN;
 		// tlv = (MrvlIEtypes_Extension_t *)axcfg->val;
 		tlv = (MrvlIEtypes_Data_t *)axcmd->val;
-		while (left_len > sizeof(MrvlIEtypesHeader_t)) {
-			tlv_type = wlan_le16_to_cpu(tlv->header.type);
+		while (left_len > (t_s16)sizeof(MrvlIEtypesHeader_t)) {
 			tlv_len = wlan_le16_to_cpu(tlv->header.len);
 			memcpy_ext(
 				pmadapter,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11h.c b/mxm_wifiex/wlan_src/mlan/mlan_11h.c
index 7e17f41..ef40e43 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11h.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11h.c
@@ -3,7 +3,7 @@
  *  @brief This file contains functions for 802.11H.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -3131,7 +3131,7 @@ mlan_status wlan_11h_handle_event_chanrpt_ready(mlan_private *priv,
 		evt_len -= sizeof(HostCmd_DS_CHAN_RPT_RSP) -
 			   sizeof(pchan_rpt_rsp->tlv_buffer);
 
-		while (evt_len >= sizeof(MrvlIEtypesHeader_t)) {
+		while (evt_len >= (t_s32)sizeof(MrvlIEtypesHeader_t)) {
 			ptlv = (MrvlIEtypes_Data_t *)pbuffer;
 			tlv_len = wlan_le16_to_cpu(ptlv->header.len);
 
@@ -3355,8 +3355,9 @@ void wlan_11h_update_bandcfg(Band_Config_t *uap_band_cfg, t_u8 new_channel)
  *
  * @return                 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_11h_get_priv_curr_idx(mlan_private *pmpriv,
-				       wlan_radar_det_hndlg_state_t *pstate_rdh)
+static mlan_status
+wlan_11h_get_priv_curr_idx(mlan_private *pmpriv,
+			   wlan_radar_det_hndlg_state_t *pstate_rdh)
 {
 	t_bool found = MFALSE;
 	ENTER();
@@ -4096,7 +4097,7 @@ mlan_status wlan_11h_dfs_event_preprocessing(mlan_adapter *pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_FAILURE;
 	mlan_private *pmpriv = MNULL;
-	mlan_private *priv_list[MLAN_MAX_BSS_NUM] = {0};
+	mlan_private *priv_list[MLAN_MAX_BSS_NUM] = {MNULL};
 
 	ENTER();
 	switch (pmadapter->event_cause & EVENT_ID_MASK) {
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n.c b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
index 114e7be..ed8c2ba 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
@@ -3,7 +3,7 @@
  *  @brief This file contains functions for 11n handling.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -354,6 +354,81 @@ static mlan_status wlan_11n_ioctl_coex_rx_winsize(pmlan_adapter pmadapter,
 	return ret;
 }
 
+/**
+ *  @brief This function will send delba request to
+ *          the peer in the TxBAStreamTbl
+ *
+ *  @param priv     A pointer to mlan_private
+ *  @param ra       MAC Address to send DELBA
+ *
+ *  @return         N/A
+ */
+void wlan_11n_send_delba_to_peer(mlan_private *priv, t_u8 *ra)
+{
+	TxBAStreamTbl *ptx_tbl;
+
+	ENTER();
+	wlan_request_ralist_lock(priv);
+	ptx_tbl = (TxBAStreamTbl *)util_peek_list(priv->adapter->pmoal_handle,
+						  &priv->tx_ba_stream_tbl_ptr,
+						  MNULL, MNULL);
+	if (!ptx_tbl) {
+		wlan_release_ralist_lock(priv);
+		LEAVE();
+		return;
+	}
+
+	while (ptx_tbl != (TxBAStreamTbl *)&priv->tx_ba_stream_tbl_ptr) {
+		if (!memcmp(priv->adapter, ptx_tbl->ra, ra,
+			    MLAN_MAC_ADDR_LENGTH)) {
+			PRINTM(MIOCTL, "Tx:Send delba to tid=%d, " MACSTR "\n",
+			       ptx_tbl->tid, MAC2STR(ptx_tbl->ra));
+			wlan_send_delba(priv, MNULL, ptx_tbl->tid, ptx_tbl->ra,
+					1);
+		}
+		ptx_tbl = ptx_tbl->pnext;
+	}
+	wlan_release_ralist_lock(priv);
+	/* Signal MOAL to trigger mlan_main_process */
+	wlan_recv_event(priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING, MNULL);
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief Set/Get control to TX AMPDU configuration on infra link
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   A pointer to ioctl request buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS --success, otherwise fail
+ */
+static mlan_status wlan_11n_ioctl_txaggrctrl(pmlan_adapter pmadapter,
+					     pmlan_ioctl_req pioctl_req)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_11n_cfg *cfg = MNULL;
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	ENTER();
+
+	cfg = (mlan_ds_11n_cfg *)pioctl_req->pbuf;
+	if (pioctl_req->action == MLAN_ACT_GET)
+		cfg->param.txaggrctrl = pmpriv->txaggrctrl;
+	else if (pioctl_req->action == MLAN_ACT_SET)
+		pmpriv->txaggrctrl = (t_u8)cfg->param.txaggrctrl;
+
+	if (pmpriv->media_connected == MTRUE) {
+		if (pioctl_req->action == MLAN_ACT_SET && !pmpriv->txaggrctrl &&
+		    pmpriv->adapter->tdls_status != TDLS_NOT_SETUP)
+			wlan_11n_send_delba_to_peer(
+				pmpriv, pmpriv->curr_bss_params.bss_descriptor
+						.mac_address);
+	}
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief This function will resend addba request to all
  *          the peer in the TxBAStreamTbl
@@ -956,7 +1031,7 @@ static void wlan_send_delba_txbastream_tbl(pmlan_private priv, t_u8 tid)
  *
  *  @return		N/A
  */
-void wlan_update_all_stations_ampdu(mlan_private *priv)
+static void wlan_update_all_stations_ampdu(mlan_private *priv)
 {
 	sta_node *sta_ptr;
 	mlan_adapter *pmadapter = priv->adapter;
@@ -1319,6 +1394,7 @@ static void wlan_fill_cap_info(mlan_private *priv, HTCap_t *ht_cap, t_u8 bands)
 
 	/* Need change to support 8k AMSDU receive */
 	RESETHT_MAXAMSDU(ht_cap->ht_cap_info);
+
 	/* SM power save */
 	if (ISSUPP_MIMOPS(priv->adapter->hw_dot_11n_dev_cap))
 		RESETHT_SM_POWERSAVE(ht_cap->ht_cap_info); /* Enable HT SMPS*/
@@ -1761,6 +1837,9 @@ mlan_status wlan_ret_11n_addba_req(mlan_private *priv, HostCmd_DS_COMMAND *resp)
 				disable_station_ampdu(
 					priv, tid, padd_ba_rsp->peer_mac_addr);
 #endif /* UAP_SUPPORT */
+			if (ra_list && ra_list->is_tdls_link)
+				disable_station_ampdu(
+					priv, tid, padd_ba_rsp->peer_mac_addr);
 			priv->aggr_prio_tbl[tid].ampdu_ap =
 				BA_STREAM_NOT_ALLOWED;
 
@@ -2159,7 +2238,7 @@ mlan_status wlan_ret_tx_bf_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 			txbf->no_of_peers = *(t_u8 *)&txbfcfg->body;
 			tx_bf_peer = (bf_peer_args *)((t_u8 *)&txbfcfg->body +
 						      sizeof(t_u8));
-			for (i = 0; i < txbf->no_of_peers; i++) {
+			for (i = 0; i < (int)txbf->no_of_peers; i++) {
 				memcpy_ext(pmadapter,
 					   txbf->body.tx_bf_peer[i].peer_mac,
 					   (t_u8 *)tx_bf_peer->peer_mac,
@@ -2178,7 +2257,7 @@ mlan_status wlan_ret_tx_bf_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 			txbf->no_of_peers = *(t_u8 *)&txbfcfg->body;
 			bf_snr = (bf_snr_thr_t *)((t_u8 *)&txbfcfg->body +
 						  sizeof(t_u8));
-			for (i = 0; i < txbf->no_of_peers; i++) {
+			for (i = 0; i < (int)txbf->no_of_peers; i++) {
 				memcpy_ext(pmadapter,
 					   txbf->body.bf_snr[i].peer_mac,
 					   (t_u8 *)bf_snr->peer_mac,
@@ -2387,7 +2466,6 @@ int wlan_cmd_append_11n_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	MrvlIETypes_2040BSSCo_t *p2040_bss_co;
 	MrvlIETypes_ExtCap_t *pext_cap;
 	t_u32 usr_dot_11n_dev_cap, orig_usr_dot_11n_dev_cap = 0;
-	t_u32 usr_vht_cap_info;
 	t_u8 usr_dot_11ac_bw;
 	int ret_len = 0;
 
@@ -2412,10 +2490,6 @@ int wlan_cmd_append_11n_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	else
 		usr_dot_11n_dev_cap = pmpriv->usr_dot_11n_dev_cap_bg;
 
-	if (pbss_desc->bss_band & BAND_A)
-		usr_vht_cap_info = pmpriv->usr_dot_11ac_dev_cap_a;
-	else
-		usr_vht_cap_info = pmpriv->usr_dot_11ac_dev_cap_bg;
 	if (pmpriv->bss_mode == MLAN_BSS_MODE_IBSS)
 		usr_dot_11ac_bw = BW_FOLLOW_VHTCAP;
 	else
@@ -2544,6 +2618,8 @@ int wlan_cmd_append_11n_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 			   (t_u8 *)pext_cap + sizeof(MrvlIEtypesHeader_t),
 			   (t_u8 *)&pmpriv->ext_cap, sizeof(ExtCap_t),
 			   pext_cap->header.len);
+		if (pbss_desc && pbss_desc->multi_bssid_ap)
+			SET_EXTCAP_MULTI_BSSID(pext_cap->ext_cap);
 		if (!pmadapter->ecsa_enable)
 			RESET_EXTCAP_EXT_CHANNEL_SWITCH(pext_cap->ext_cap);
 		else
@@ -2638,6 +2714,9 @@ mlan_status wlan_11n_cfg_ioctl(pmlan_adapter pmadapter,
 	case MLAN_OID_11N_CFG_COEX_RX_WINSIZE:
 		status = wlan_11n_ioctl_coex_rx_winsize(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_11N_CFG_TX_AGGR_CTRL:
+		status = wlan_11n_ioctl_txaggrctrl(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM:
 		status = wlan_11n_ioctl_ibss_ampdu_param(pmadapter, pioctl_req);
 		break;
@@ -3024,7 +3103,7 @@ int wlan_get_txbastream_tbl(mlan_private *priv, tx_ba_stream_tbl *buf)
 		ptxtbl = ptxtbl->pnext;
 		ptbl++;
 		count++;
-		if (count >= bastream_max)
+		if (count >= (int)bastream_max)
 			break;
 	}
 	wlan_release_ralist_lock(priv);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n.h b/mxm_wifiex/wlan_src/mlan/mlan_11n.h
index 81db7a2..af382b1 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n.h
@@ -234,6 +234,11 @@ static INLINE void reset_station_ampdu(mlan_private *priv, t_u8 tid, t_u8 *ra)
 static INLINE t_u8 wlan_is_ampdu_allowed(mlan_private *priv, raListTbl *ptr,
 					 int tid)
 {
+	if (ptr->is_tdls_link)
+		return is_station_ampdu_allowed(priv, ptr, tid);
+	if (priv->adapter->tdls_status != TDLS_NOT_SETUP && !priv->txaggrctrl)
+		return MFALSE;
+
 	if ((!priv->is_data_rate_auto) && IS_BG_RATE)
 		return MFALSE;
 #ifdef UAP_SUPPORT
@@ -272,6 +277,8 @@ static INLINE void wlan_update_del_ba_count(mlan_private *priv, raListTbl *ptr)
 		return wlan_update_station_del_ba_count(priv, ptr);
 #endif /* UAP_SUPPORT */
 #endif /* UAP_802_11N */
+	if (ptr->is_tdls_link)
+		return wlan_update_station_del_ba_count(priv, ptr);
 	rssi = priv->snr - priv->nf;
 	if (rssi > BA_RSSI_HIGH_THRESHOLD)
 		ptr->del_ba_count = 0;
@@ -304,6 +311,11 @@ static INLINE t_u8 wlan_is_amsdu_allowed(mlan_private *priv, raListTbl *ptr,
 		}
 	}
 #endif /* UAP_SUPPORT */
+	if (ptr->is_tdls_link)
+		return (priv->aggr_prio_tbl[tid].amsdu !=
+			BA_STREAM_NOT_ALLOWED) ?
+			       MTRUE :
+			       MFALSE;
 #define TXRATE_BITMAP_INDEX_MCS0_7 2
 	return ((priv->aggr_prio_tbl[tid].amsdu != BA_STREAM_NOT_ALLOWED) &&
 		((priv->is_data_rate_auto) ||
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c b/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
index c2aec78..7538899 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
@@ -3,7 +3,7 @@
  *  @brief This file contains functions for 11n Aggregation.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -127,6 +127,8 @@ static void wlan_11n_form_amsdu_txpd(mlan_private *priv, mlan_buffer *mbuf)
 	/* Always zero as the data is followed by TxPD */
 	ptx_pd->tx_pkt_offset = sizeof(TxPD);
 	ptx_pd->tx_pkt_type = PKT_TYPE_AMSDU;
+	if (mbuf->flags & MLAN_BUF_FLAG_TDLS)
+		ptx_pd->flags = MRVDRV_TxPD_FLAGS_TDLS_PACKET;
 	if (ptx_pd->tx_control == 0)
 		/* TxCtrl set by user or default */
 		ptx_pd->tx_control = priv->pkt_tx_ctrl;
@@ -227,6 +229,7 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 						      0x00, 0x00, 0x00};
 	t_u8 hdr_len = sizeof(Eth803Hdr_t);
 	t_u8 eapol_type[2] = {0x88, 0x8e};
+	t_u8 tdls_action_type[2] = {0x89, 0x0d};
 
 	ENTER();
 
@@ -250,7 +253,7 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 		}
 	}
 #endif
-	if (total_pkt_len > max_rx_data_size) {
+	if (total_pkt_len > (int)max_rx_data_size) {
 		PRINTM(MERROR,
 		       "Total packet length greater than tx buffer"
 		       " size %d\n",
@@ -261,9 +264,12 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 	pmbuf->use_count = wlan_11n_get_num_aggrpkts(data, total_pkt_len);
 
 	// rx_trace 7
-	if (pmadapter->tp_state_on)
+	if (pmadapter->tp_state_on) {
 		pmadapter->callbacks.moal_tp_accounting(
 			pmadapter->pmoal_handle, pmbuf, 7 /*RX_DROP_P3*/);
+		pmadapter->callbacks.moal_tp_accounting_rx_param(
+			pmadapter->pmoal_handle, 4, pmbuf->use_count);
+	}
 	if (pmadapter->tp_state_drop_point == 7 /*RX_DROP_P3*/)
 		goto done;
 
@@ -311,6 +317,8 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 		daggr_mbuf->data_len = pkt_len;
 		daggr_mbuf->in_ts_sec = pmbuf->in_ts_sec;
 		daggr_mbuf->in_ts_usec = pmbuf->in_ts_usec;
+		daggr_mbuf->extra_ts_sec = pmbuf->extra_ts_sec;
+		daggr_mbuf->extra_ts_usec = pmbuf->extra_ts_usec;
 		daggr_mbuf->pparent = pmbuf;
 		daggr_mbuf->priority = pmbuf->priority;
 		memcpy_ext(pmadapter,
@@ -341,6 +349,20 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 				data += pkt_len + pad;
 				continue;
 			}
+			/**process tdls packet*/
+			if (!memcmp(pmadapter,
+				    daggr_mbuf->pbuf + daggr_mbuf->data_offset +
+					    MLAN_ETHER_PKT_TYPE_OFFSET,
+				    tdls_action_type,
+				    sizeof(tdls_action_type))) {
+				PRINTM(MEVENT,
+				       "Recevie AMSDU TDLS action frame\n");
+				wlan_process_tdls_action_frame(
+					priv,
+					daggr_mbuf->pbuf +
+						daggr_mbuf->data_offset,
+					daggr_mbuf->data_len);
+			}
 
 			ret = pmadapter->callbacks.moal_recv_packet(
 				pmadapter->pmoal_handle, daggr_mbuf);
@@ -402,6 +424,7 @@ int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
 	TxPD *ptx_pd = MNULL;
 #endif
 	t_u32 max_amsdu_size = MIN(pra_list->max_amsdu, pmadapter->tx_buf_size);
+	t_u32 msdu_in_tx_amsdu_cnt = 0;
 	ENTER();
 
 	PRINTM(MDAT_D, "Handling Aggr packet\n");
@@ -429,6 +452,8 @@ int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
 		pmbuf_aggr->data_offset = 0;
 		pmbuf_aggr->in_ts_sec = pmbuf_src->in_ts_sec;
 		pmbuf_aggr->in_ts_usec = pmbuf_src->in_ts_usec;
+		if (pmbuf_src->flags & MLAN_BUF_FLAG_TDLS)
+			pmbuf_aggr->flags |= MLAN_BUF_FLAG_TDLS;
 		if (pmbuf_src->flags & MLAN_BUF_FLAG_TCP_ACK)
 			pmbuf_aggr->flags |= MLAN_BUF_FLAG_TCP_ACK;
 
@@ -494,6 +519,7 @@ int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
 						     &pra_list->buf_head, MNULL,
 						     MNULL);
 		priv->msdu_in_tx_amsdu_cnt++;
+		msdu_in_tx_amsdu_cnt++;
 	}
 
 	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
@@ -508,9 +534,12 @@ int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
 	tx_param.next_pkt_len =
 		((pmbuf_src) ? pmbuf_src->data_len + sizeof(TxPD) : 0);
 	/* Collects TP statistics */
-	if (pmadapter->tp_state_on)
+	if (pmadapter->tp_state_on) {
 		pmadapter->callbacks.moal_tp_accounting(pmadapter->pmoal_handle,
 							pmbuf_aggr, 4);
+		pmadapter->callbacks.moal_tp_accounting_rx_param(
+			pmadapter->pmoal_handle, 5, msdu_in_tx_amsdu_cnt);
+	}
 
 	/* Drop Tx packets at drop point 4 */
 	if (pmadapter->tp_state_drop_point == 4) {
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c b/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
index 2b1abed..185065c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
@@ -4,7 +4,7 @@
  *  driver.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -503,7 +503,11 @@ static t_void wlan_11n_create_rxreorder_tbl(mlan_private *priv, t_u8 *ta,
 		PRINTM(MINFO, "UAP/ADHOC:last_seq=%d start_win=%d\n", last_seq,
 		       new_node->start_win);
 	} else {
-		last_seq = priv->rx_seq[tid];
+		sta_ptr = wlan_get_station_entry(priv, ta);
+		if (sta_ptr)
+			last_seq = sta_ptr->rx_seq[tid];
+		else
+			last_seq = priv->rx_seq[tid];
 	}
 	new_node->last_seq = last_seq;
 	new_node->win_size = win_size;
@@ -603,7 +607,7 @@ mlan_status wlan_cmd_11n_addba_req(mlan_private *priv, HostCmd_DS_COMMAND *cmd,
  *
  *  @return            MTRUE/MFALSE
  */
-t_u8 wlan_is_addba_reject(mlan_private *priv, t_u8 tid)
+static t_u8 wlan_is_addba_reject(mlan_private *priv, t_u8 tid)
 {
 #ifdef STA_SUPPORT
 #endif
@@ -1206,7 +1210,7 @@ void wlan_11n_rxba_sync_event(mlan_private *priv, t_u8 *event_buf, t_u16 len)
 	ENTER();
 
 	DBG_HEXDUMP(MEVT_D, "RXBA_SYNC_EVT", event_buf, len);
-	while (tlv_buf_left >= sizeof(MrvlIEtypes_RxBaSync_t)) {
+	while (tlv_buf_left >= (int)sizeof(MrvlIEtypes_RxBaSync_t)) {
 		tlv_type = wlan_le16_to_cpu(tlv_rxba->header.type);
 		tlv_len = wlan_le16_to_cpu(tlv_rxba->header.len);
 		if (tlv_type != TLV_TYPE_RXBA_SYNC) {
@@ -1293,7 +1297,7 @@ void wlan_cleanup_reorder_tbl(mlan_private *priv, t_u8 *ta)
  *
  *  @return        N/A
  */
-void wlan_set_rxreorder_tbl_no_drop_flag(mlan_private *priv, t_u8 flag)
+static void wlan_set_rxreorder_tbl_no_drop_flag(mlan_private *priv, t_u8 flag)
 {
 	RxReorderTbl *rx_reor_tbl_ptr;
 
@@ -1345,7 +1349,7 @@ void wlan_update_rxreorder_tbl(pmlan_adapter pmadapter, t_u8 flag)
  *
  *  @return        N/A
  */
-void wlan_flush_priv_rxreorder_tbl(mlan_private *priv)
+static void wlan_flush_priv_rxreorder_tbl(mlan_private *priv)
 {
 	RxReorderTbl *rx_reor_tbl_ptr;
 
@@ -1399,7 +1403,7 @@ void wlan_flush_rxreorder_tbl(pmlan_adapter pmadapter)
  *
  *  @return             N/A
  */
-void wlan_update_ampdu_rxwinsize(pmlan_adapter pmadapter, t_u8 coex_flag)
+static void wlan_update_ampdu_rxwinsize(pmlan_adapter pmadapter, t_u8 coex_flag)
 {
 	t_u8 i;
 	t_u32 rx_win_size = 0;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
index f2f7ba0..de6dd2f 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
@@ -5,7 +5,7 @@
  *  related code
  *
  *
- *  Copyright 2009-2020 NXP
+ *  Copyright 2009-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -748,7 +748,7 @@ typedef struct _rate_map {
 /** If user configure to 1x1 or we found peer device only support 1x1,
  * then we need skip the nss1 part when map to Mrvl rate.
  */
-const rate_map rate_map_table_2x2[] = {
+static const rate_map rate_map_table_2x2[] = {
 	/* LG <--> Mrvl rate idx */
 	{2, 0, 0}, // RATEID_DBPSK1Mbps
 	{4, 1, 0}, // RATEID_DQPSK2Mbps
@@ -887,7 +887,7 @@ const rate_map rate_map_table_2x2[] = {
  * For the chip who only support 1x1, Mrvl rate idx define is different with 2x2
  * in FW We need redefine a bitrate to Mrvl rate idx table for 1x1 chip.
  */
-const rate_map rate_map_table_1x1[] = {
+static const rate_map rate_map_table_1x1[] = {
 	/* LG <--> Mrvl rate idx */
 	{2, 0, 0}, // RATEID_DBPSK1Mbps
 	{4, 1, 0}, // RATEID_DQPSK2Mbps
@@ -1019,7 +1019,7 @@ t_u8 SupportedRates_A[A_SUPPORTED_RATES] = {0x0c, 0x12, 0x18, 0x24, 0xb0,
 /**
  * The rates supported by the card
  */
-t_u16 WlanDataRates[WLAN_SUPPORTED_RATES_EXT] = {
+static t_u16 WlanDataRates[WLAN_SUPPORTED_RATES_EXT] = {
 	0x02, 0x04, 0x0B, 0x16, 0x00, 0x0C, 0x12, 0x18, 0x24,  0x30, 0x48,
 	0x60, 0x6C, 0x90, 0x0D, 0x1A, 0x27, 0x34, 0x4E, 0x68,  0x75, 0x82,
 	0x0C, 0x1B, 0x36, 0x51, 0x6C, 0xA2, 0xD8, 0xF3, 0x10E, 0x00};
@@ -1050,7 +1050,7 @@ t_u8 SupportedRates_N[N_SUPPORTED_RATES] = {0x02, 0x04, 0};
 #define MCS_NUM_AX 12
 // for MCS0/MCS1/MCS3/MCS4 have 4 additional DCM=1 value
 // note: the value in the table is 2 multiplier of the actual rate
-t_u16 ax_mcs_rate_nss1[12][MCS_NUM_AX + 4] = {
+static t_u16 ax_mcs_rate_nss1[12][MCS_NUM_AX + 4] = {
 	{0x90, 0x48, 0x120, 0x90, 0x1B0, 0x240, 0x120, 0x360, 0x1B0, 0x481,
 	 0x511, 0x5A1, 0x6C1, 0x781, 0x871, 0x962}, /*SG 160M*/
 	{0x88, 0x44, 0x110, 0x88, 0x198, 0x220, 0x110, 0x330, 0x198, 0x440,
@@ -1077,6 +1077,7 @@ t_u16 ax_mcs_rate_nss1[12][MCS_NUM_AX + 4] = {
 	 0xAF, 0xC3, 0xDB, 0xF3} /*LG 20M*/
 };
 
+#if 0
 // note: the value in the table is 2 multiplier of the actual rate
 t_u16 ax_tone_ru_rate_nss1[9][MCS_NUM_AX + 4] = {
 	{0x8, 0x4, 0xF, 0x8, 0x17, 0x1E, 0xF, 0x2D, 0x17, 0x3C, 0x44, 0x4B,
@@ -1098,9 +1099,10 @@ t_u16 ax_tone_ru_rate_nss1[9][MCS_NUM_AX + 4] = {
 	{0x2, 0x1, 0x3, 0x2, 0x5, 0x6, 0x3, 0x9, 0x4, 0xC, 0xE, 0xF, 0x12, 0x14,
 	 0x17, 0x19} /*LG 26-tone*/
 };
+#endif
 
 // note: the value in the table is 2 multiplier of the actual rate
-t_u16 ax_mcs_rate_nss2[12][MCS_NUM_AX + 4] = {
+static t_u16 ax_mcs_rate_nss2[12][MCS_NUM_AX + 4] = {
 	{0x120, 0x90, 0x240, 0x120, 0x360, 0x481, 0x240, 0x61C, 0x360, 0x901,
 	 0xA22, 0xB42, 0xD82, 0xF03, 0x10E3, 0x12C3}, /*SG 160M*/
 	{0x110, 0x88, 0x220, 0x110, 0x330, 0x440, 0x220, 0x661, 0x330, 0x881,
@@ -1127,6 +1129,7 @@ t_u16 ax_mcs_rate_nss2[12][MCS_NUM_AX + 4] = {
 	 0x124, 0x15F, 0x186, 0x1B6, 0x1E7} /*LG 20M*/
 };
 
+#if 0
 // note: the value in the table is 2 multiplier of the actual rate
 t_u16 ax_tone_ru_rate_nss2[9][MCS_NUM_AX + 4] = {
 	{0xF, 0x8, 0x1E, 0xF, 0x2D, 0x3C, 0x1E, 0x5A, 0x2D, 0x78, 0x87, 0x96,
@@ -1148,6 +1151,7 @@ t_u16 ax_tone_ru_rate_nss2[9][MCS_NUM_AX + 4] = {
 	{0x3, 0x2, 0x6, 0x3, 0x9, 0xC, 0x6, 0x12, 0x9, 0x18, 0x1B, 0x1E, 0x24,
 	 0x28, 0x2D, 0x32} /*LG 26-tone*/
 };
+#endif
 
 /********************************************************
  *			Local Functions
@@ -1563,7 +1567,7 @@ t_u32 wlan_index_to_data_rate(pmlan_adapter pmadapter, t_u8 index,
 	t_u32 rate = 0;
 	t_u8 mcs_index = 0;
 	t_u8 he_dcm = 0;
-	t_u8 he_tone = 0;
+	//	t_u8 he_tone = 0;
 	t_u8 stbc = 0;
 
 	t_u8 bw = 0;
@@ -1625,10 +1629,12 @@ t_u32 wlan_index_to_data_rate(pmlan_adapter pmadapter, t_u8 index,
 		if (gi > 0)
 			gi = gi - 1;
 
+		//#ifdef ENABLE_802_11AX
 		// TODO: hardcode he_tone here, wait for FW value ready.
-		he_tone = 4;
+		//		he_tone = 4;
 
 		// he_tone = (ext_rate_info & 0xE) >> 1;
+		//#endif
 
 		if ((index >> 4) == 1) {
 			switch (mcs_index) {
@@ -2364,8 +2370,8 @@ static oper_bw_chan oper_bw_chan_cn[] = {
  *
  *  @return                   A pointer to oper_bw_chan
  */
-oper_bw_chan *wlan_get_nonglobal_operclass_table(mlan_private *pmpriv,
-						 int *arraysize)
+static oper_bw_chan *wlan_get_nonglobal_operclass_table(mlan_private *pmpriv,
+							int *arraysize)
 {
 	t_u8 country_code[][COUNTRY_CODE_LEN] = {"US", "JP", "CN"};
 	int country_id = 0;
@@ -2428,7 +2434,7 @@ mlan_status wlan_check_operclass_validation(mlan_private *pmpriv, t_u8 channel,
 
 	ENTER();
 
-	for (i = 0; i < sizeof(center_freqs); i++) {
+	for (i = 0; i < (int)sizeof(center_freqs); i++) {
 		if (channel == center_freqs[i]) {
 			PRINTM(MERROR, "Invalid channel number %d!\n", channel);
 			LEAVE();
@@ -2453,11 +2459,12 @@ mlan_status wlan_check_operclass_validation(mlan_private *pmpriv, t_u8 channel,
 		return MLAN_STATUS_FAILURE;
 	}
 
-	for (i = 0; i < arraysize / sizeof(oper_bw_chan); i++) {
+	for (i = 0; i < (int)(arraysize / sizeof(oper_bw_chan)); i++) {
 		if (poper_bw_chan[i].oper_class == oper_class ||
 		    poper_bw_chan[i].global_oper_class == oper_class) {
 			for (channum = 0;
-			     channum < sizeof(poper_bw_chan[i].channel_list);
+			     channum <
+			     (int)sizeof(poper_bw_chan[i].channel_list);
 			     channum++) {
 				if (poper_bw_chan[i].channel_list[channum] &&
 				    poper_bw_chan[i].channel_list[channum] ==
@@ -2502,7 +2509,7 @@ mlan_status wlan_get_curr_oper_class(mlan_private *pmpriv, t_u8 channel,
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-	for (i = 0; i < sizeof(center_freqs); i++) {
+	for (i = 0; i < (int)sizeof(center_freqs); i++) {
 		if (channel == center_freqs[i]) {
 			PRINTM(MERROR, "Invalid channel number %d!\n", channel);
 			LEAVE();
@@ -2515,10 +2522,11 @@ mlan_status wlan_get_curr_oper_class(mlan_private *pmpriv, t_u8 channel,
 		channel = center_freq_idx;
 	}
 
-	for (i = 0; i < arraysize / sizeof(oper_bw_chan); i++) {
+	for (i = 0; i < (int)(arraysize / sizeof(oper_bw_chan)); i++) {
 		if (poper_bw_chan[i].bandwidth == bw) {
 			for (channum = 0;
-			     channum < sizeof(poper_bw_chan[i].channel_list);
+			     channum <
+			     (int)(sizeof(poper_bw_chan[i].channel_list));
 			     channum++) {
 				if (poper_bw_chan[i].channel_list[channum] &&
 				    poper_bw_chan[i].channel_list[channum] ==
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
index ce01006..0d8bd05 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
@@ -4,7 +4,7 @@
  *  @brief This file contains the handling of CMD/EVENT in MLAN
  *
  *
- *  Copyright 2009-2020 NXP
+ *  Copyright 2009-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -90,7 +90,7 @@ done:
  *
  *  @return             N/A
  */
-void wlan_check_scan_queue(pmlan_adapter pmadapter)
+static void wlan_check_scan_queue(pmlan_adapter pmadapter)
 {
 	cmd_ctrl_node *pcmd_node = MNULL;
 	t_u16 num = 0;
@@ -156,7 +156,7 @@ static void wlan_dump_pending_commands(pmlan_adapter pmadapter)
  *
  *  @return     N/A
  */
-t_void wlan_dump_info(mlan_adapter *pmadapter, t_u8 reason)
+static t_void wlan_dump_info(mlan_adapter *pmadapter, t_u8 reason)
 {
 	cmd_ctrl_node *pcmd_node = MNULL;
 #ifdef DEBUG_LEVEL1
@@ -165,7 +165,7 @@ t_void wlan_dump_info(mlan_adapter *pmadapter, t_u8 reason)
 	t_u8 i;
 #ifdef SDIO
 	t_u8 j;
-	t_u8 mp_aggr_pkt_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
+	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
 #endif
 	t_u16 cmd_id, cmd_act;
 	mlan_private *pmpriv = MNULL;
@@ -360,9 +360,9 @@ t_void wlan_dump_info(mlan_adapter *pmadapter, t_u8 reason)
 		       pmadapter->pcard_pcie->evtbd_wrptr);
 		PRINTM(MERROR, "last_wr_index:%d\n",
 		       pmadapter->pcard_pcie->txbd_wrptr &
-			       (MLAN_MAX_TXRX_BD - 1));
+			       (pmadapter->pcard_pcie->reg->txrx_bd_size - 1));
 		PRINTM(MERROR, "Tx pkt size:\n");
-		for (i = 0; i < MLAN_MAX_TXRX_BD; i++) {
+		for (i = 0; i < pmadapter->pcard_pcie->reg->txrx_bd_size; i++) {
 			PRINTM(MERROR, "%04d ",
 			       pmadapter->pcard_pcie->last_tx_pkt_size[i]);
 			if (((i + 1) % 16) == 0)
@@ -422,7 +422,7 @@ static t_u32 wlan_hexval(t_u8 chr)
  *  @return             The converted hex value if param a is a valid hex, else
  * 0
  */
-int wlan_atox(t_u8 *a)
+static int wlan_atox(t_u8 *a)
 {
 	int i = 0;
 
@@ -479,7 +479,7 @@ static t_u32 wlan_parse_cal_cfg(t_u8 *src, t_size len, t_u8 *dst)
  *  @return             Location of the first occurrence of the char
  *                      if found, else NULL
  */
-t_u8 *wlan_strchr(t_u8 *s, int c)
+static t_u8 *wlan_strchr(t_u8 *s, int c)
 {
 	t_u8 *pos = s;
 	while (*pos != '\0') {
@@ -950,6 +950,8 @@ static t_u16 wlan_get_cmd_timeout(t_u16 cmd_id)
 	case HostCmd_CMD_11N_ADDBA_RSP:
 	case HostCmd_CMD_11N_DELBA:
 	case HostCmd_CMD_802_11_REMAIN_ON_CHANNEL:
+	case HostCmd_CMD_TDLS_CONFIG:
+	case HostCmd_CMD_TDLS_OPERATION:
 	case HostCmd_CMD_SUPPLICANT_PMK:
 	case HostCmd_CMD_SUPPLICANT_PROFILE:
 	case HostCmd_CMD_SOFT_RESET:
@@ -1281,6 +1283,25 @@ done:
 	return ret;
 }
 
+/**
+ *  @brief Fetch bitmap rate index
+ *
+ *  @param rate_scope	A pointer to MrvlRateScope_t
+ *
+ *  @return		bitmap rate index
+ */
+static t_u16 wlan_get_bitmap_index(MrvlRateScope_t *rate_scope)
+{
+	t_u16 index = 0;
+
+	if (rate_scope != MNULL) {
+		index += NELEMENTS(rate_scope->ht_mcs_rate_bitmap);
+		index += NELEMENTS(rate_scope->vht_mcs_rate_bitmap);
+	}
+
+	return index;
+}
+
 /********************************************************
 			Global Functions
 ********************************************************/
@@ -2296,14 +2317,15 @@ mlan_status wlan_cancel_pending_scan_cmd(pmlan_adapter pmadapter,
 	if (pmadapter->scan_processing &&
 	    pmadapter->ext_scan_type == EXT_SCAN_ENHANCE) {
 		if (priv) {
-			if (MLAN_STATUS_FAILURE ==
+			if (MLAN_STATUS_SUCCESS ==
 			    wlan_prepare_cmd(priv, HostCmd_CMD_802_11_SCAN_EXT,
 					     HostCmd_ACT_GEN_SET, 0, pioctl_req,
-					     MNULL))
-				PRINTM(MERROR, "Failed to prepare command");
-			wlan_recv_event(priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
+					     MNULL)) {
+				wlan_recv_event(
+					priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
 					MNULL);
-			status = MLAN_STATUS_PENDING;
+				status = MLAN_STATUS_PENDING;
+			}
 		}
 	} else
 		/* Cancel all pending scan command */
@@ -2344,18 +2366,20 @@ t_void wlan_cancel_all_pending_cmd(pmlan_adapter pmadapter, t_u8 flag)
 					 MLAN_STATUS_FAILURE);
 	}
 #endif
-	if (pmadapter->curr_cmd && flag) {
+	if (pmadapter->curr_cmd) {
 		pcmd_node = pmadapter->curr_cmd;
 		if (pcmd_node->pioctl_buf) {
 			pioctl_buf = (mlan_ioctl_req *)pcmd_node->pioctl_buf;
+			pcmd_node->pioctl_buf = MNULL;
 			pioctl_buf->status_code = MLAN_ERROR_CMD_CANCEL;
 			pcb->moal_ioctl_complete(pmadapter->pmoal_handle,
 						 pioctl_buf,
 						 MLAN_STATUS_FAILURE);
-			pcmd_node->pioctl_buf = MNULL;
 		}
-		pmadapter->curr_cmd = MNULL;
-		wlan_insert_cmd_to_free_q(pmadapter, pcmd_node);
+		if (flag) {
+			pmadapter->curr_cmd = MNULL;
+			wlan_insert_cmd_to_free_q(pmadapter, pcmd_node);
+		}
 	}
 
 	/* Cancel all pending command */
@@ -3698,6 +3722,7 @@ mlan_status wlan_cmd_tx_rate_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_TX_RATE_CFG);
 
 	rate_cfg->action = wlan_cpu_to_le16(cmd_action);
+	rate_cfg->cfg_index = 0;
 
 	rate_scope = (MrvlRateScope_t *)rate_cfg->tlv_buf;
 	rate_scope->type = wlan_cpu_to_le16(TLV_TYPE_RATE_SCOPE);
@@ -3723,15 +3748,10 @@ mlan_status wlan_cmd_tx_rate_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 			     i < NELEMENTS(rate_scope->he_mcs_rate_bitmap); i++)
 				rate_scope->he_mcs_rate_bitmap
 					[i] = wlan_cpu_to_le16(
-					pbitmap_rates
-						[2 +
-						 NELEMENTS(
-							 rate_scope
-								 ->ht_mcs_rate_bitmap) +
-						 NELEMENTS(
-							 rate_scope
-								 ->vht_mcs_rate_bitmap) +
-						 i]);
+					pbitmap_rates[2 +
+						      wlan_get_bitmap_index(
+							      rate_scope) +
+						      i]);
 		} else {
 			rate_scope->length = wlan_cpu_to_le16(
 				sizeof(MrvlRateScope_t) -
@@ -3757,17 +3777,13 @@ mlan_status wlan_cmd_tx_rate_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 			for (i = 0;
 			     i < NELEMENTS(rate_scope->vht_mcs_rate_bitmap);
 			     i++)
-				rate_scope->he_mcs_rate_bitmap
-					[i] = wlan_cpu_to_le16(
-					pmpriv->bitmap_rates
-						[2 +
-						 NELEMENTS(
-							 rate_scope
-								 ->ht_mcs_rate_bitmap) +
-						 NELEMENTS(
-							 rate_scope
-								 ->vht_mcs_rate_bitmap) +
-						 i]);
+				rate_scope->he_mcs_rate_bitmap[i] =
+					wlan_cpu_to_le16(
+						pmpriv->bitmap_rates
+							[2 +
+							 wlan_get_bitmap_index(
+								 rate_scope) +
+							 i]);
 		} else {
 			rate_scope->length = wlan_cpu_to_le16(
 				sizeof(MrvlRateScope_t) -
@@ -4077,13 +4093,11 @@ mlan_status wlan_adapter_get_hw_spec(pmlan_adapter pmadapter)
 		pmadapter->cal_data_len = 0;
 	}
 	/* Get FW region and cfp tables */
-	if (pmadapter->init_para.fw_region) {
-		ret = wlan_prepare_cmd(priv, HostCmd_CMD_CHAN_REGION_CFG,
-				       HostCmd_ACT_GEN_GET, 0, MNULL, MNULL);
-		if (ret) {
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
+	ret = wlan_prepare_cmd(priv, HostCmd_CMD_CHAN_REGION_CFG,
+			       HostCmd_ACT_GEN_GET, 0, MNULL, MNULL);
+	if (ret) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
 	}
 	/*
 	 * Get HW spec
@@ -4174,6 +4188,17 @@ mlan_status wlan_adapter_init_cmd(pmlan_adapter pmadapter)
 		}
 	}
 
+#define DEF_AUTO_NULL_PKT_PERIOD 30
+	if (pmpriv_sta) {
+		t_u32 value = DEF_AUTO_NULL_PKT_PERIOD;
+		ret = wlan_prepare_cmd(pmpriv_sta, HostCmd_CMD_802_11_SNMP_MIB,
+				       HostCmd_ACT_GEN_SET, NullPktPeriod_i,
+				       MNULL, &value);
+		if (ret) {
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+	}
 	if (pmadapter->init_para.indrstcfg != 0xffffffff) {
 		mlan_ds_ind_rst_cfg ind_rst_cfg;
 		ind_rst_cfg.ir_mode = pmadapter->init_para.indrstcfg & 0xff;
@@ -4488,6 +4513,12 @@ mlan_status wlan_process_vdll_event(pmlan_private pmpriv, pmlan_buffer pevent)
 		PRINTM(MEVENT, "VDLL_IND (OFFSET): offset=0x%x\n", offset);
 		wlan_get_vdll_image(pmadapter, offset);
 		break;
+	case VDLL_IND_TYPE_ERR_SIG:
+		PRINTM(MERROR, "VDLL_IND (SIG ERR).\n");
+		break;
+	case VDLL_IND_TYPE_ERR_ID:
+		PRINTM(MERROR, "VDLL_IND (ID ERR).\n");
+		break;
 	default:
 		PRINTM(MERROR, "unknow vdll ind type=%d\n", ind->type);
 		break;
@@ -4879,11 +4910,11 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 		pmadapter->pcard_sd->mp_end_port =
 			wlan_le16_to_cpu(hw_spec->mp_end_port);
 
-		for (i = 1; i <= (unsigned)(MAX_PORT -
+		for (i = 1; i <= (unsigned)(pmadapter->pcard_sd->max_ports -
 					    pmadapter->pcard_sd->mp_end_port);
 		     i++)
 			pmadapter->pcard_sd->mp_data_port_mask &=
-				~(1 << (MAX_PORT - i));
+				~(1 << (pmadapter->pcard_sd->max_ports - i));
 	}
 #endif
 
@@ -6203,11 +6234,11 @@ void wlan_bt_coex_wlan_param_update_event(pmlan_private priv,
 
 	ENTER();
 
-	while (len >= sizeof(MrvlIEtypesHeader_t)) {
+	while (len >= (t_s32)sizeof(MrvlIEtypesHeader_t)) {
 		tlv = (MrvlIEtypesHeader_t *)pCurrent_ptr;
 		tlv_len = wlan_le16_to_cpu(tlv->len);
 		tlv_type = wlan_le16_to_cpu(tlv->type);
-		if ((tlv_len + sizeof(MrvlIEtypesHeader_t)) > len)
+		if ((tlv_len + (t_s32)sizeof(MrvlIEtypesHeader_t)) > len)
 			break;
 		switch (tlv_type) {
 		case TLV_BTCOEX_WL_AGGR_WINSIZE:
@@ -7877,6 +7908,63 @@ mlan_status wlan_ret_rxabortcfg_ext(pmlan_private pmpriv,
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ * @brief This function sets the hal/phy cfg params
+ *
+ * @param pmpriv       A pointer to mlan_private structure
+ * @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ * @param cmd_action   The action: GET or SET
+ * @param pdata_buf    A pointer to data buffer
+ *
+ * @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_hal_phy_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+				 t_u16 cmd_action, t_u16 *pdata_buf)
+{
+	HostCmd_DS_HAL_PHY_CFG *hal_phy_cfg_cmd =
+		&cmd->params.hal_phy_cfg_params;
+	mlan_ds_hal_phy_cfg_params *hal_phy_cfg_params = MNULL;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_HAL_PHY_CFG);
+	cmd->size = sizeof(HostCmd_DS_HAL_PHY_CFG) + S_DS_GEN;
+	hal_phy_cfg_cmd->action = wlan_cpu_to_le16(cmd_action);
+	hal_phy_cfg_params = (mlan_ds_hal_phy_cfg_params *)pdata_buf;
+	hal_phy_cfg_cmd->dot11b_psd_mask_cfg =
+		hal_phy_cfg_params->dot11b_psd_mask_cfg;
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of hal_phy_cfg
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_hal_phy_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				 mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_HAL_PHY_CFG *cfg_cmd =
+		(HostCmd_DS_HAL_PHY_CFG *)&resp->params.hal_phy_cfg_params;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+
+	ENTER();
+
+	if (pioctl_buf) {
+		misc_cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		misc_cfg->param.hal_phy_cfg_params.dot11b_psd_mask_cfg =
+			cfg_cmd->dot11b_psd_mask_cfg;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function prepares command of Dot11mc unassoc ftm cfg
  *
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_decl.h b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
index fc230b2..7d622e1 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
@@ -3,7 +3,7 @@
  *  @brief This file declares the generic data structures and APIs.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "214"
+#define MLAN_RELEASE_VERSION "241"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -233,12 +233,12 @@ typedef t_s32 t_sval;
 /** MU beamformer */
 #define DEFALUT_11AC_CAP_BEAMFORMING_RESET_MASK (MBIT(19))
 
-/** Size of rx data buffer 4096+256 */
-#define MLAN_RX_DATA_BUF_SIZE 4352
+/** Size of rx data buffer 3839+256 */
+#define MLAN_RX_DATA_BUF_SIZE 4096
 
 /** Size of command buffer */
 /** because cal_data_size 2.4 k */
-#define MRVDRV_SIZE_OF_CMD_BUFFER (4 * 1024)
+#define MRVDRV_SIZE_OF_CMD_BUFFER (3 * 1024)
 /** Size of rx command buffer */
 #define MLAN_RX_CMD_BUF_SIZE MRVDRV_SIZE_OF_CMD_BUFFER
 /** Upload size */
@@ -330,6 +330,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define ALLOC_BUF_SIZE MLAN_RX_DATA_BUF_SIZE
 /** SDIO MP aggr pkt limit */
 #define SDIO_MP_AGGR_DEF_PKT_LIMIT (16)
+/** SDIO MP aggr pkt limit 8 */
+#define SDIO_MP_AGGR_DEF_PKT_LIMIT_8 (8)
 /** max SDIO MP aggr pkt limit */
 #define SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX (16)
 
@@ -365,6 +367,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_9097 0x07
 /** 8978 card type */
 #define CARD_TYPE_8978 0x08
+/** 9177 card type */
+#define CARD_TYPE_9177 0x09
+/** 8801 card type */
+#define CARD_TYPE_8801 0x0a
 
 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
@@ -392,6 +398,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_SD9097 (CARD_TYPE_9097 | (INTF_SD << 8))
 /** SD9098 card type */
 #define CARD_TYPE_SD9098 (CARD_TYPE_9098 | (INTF_SD << 8))
+/** SD9177 card type */
+#define CARD_TYPE_SD9177 (CARD_TYPE_9177 | (INTF_SD << 8))
+/** SD8801 card type */
+#define CARD_TYPE_SD8801 (CARD_TYPE_8801 | (INTF_SD << 8))
 
 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@@ -401,6 +411,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_SD8987(ct) (CARD_TYPE_SD8987 == (ct))
 #define IS_SD9097(ct) (CARD_TYPE_SD9097 == (ct))
 #define IS_SD9098(ct) (CARD_TYPE_SD9098 == (ct))
+#define IS_SD9177(ct) (CARD_TYPE_SD9177 == (ct))
+#define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
 
 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@@ -418,6 +430,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SD9097 "SD9097"
 /** SD9098 Card */
 #define CARD_SD9098 "SD9098"
+/** SD9177 Card */
+#define CARD_SD9177 "SD9177"
+/** SD9177 Card */
+#define CARD_SD8801 "SD9177"
 #endif
 
 #ifdef PCIE
@@ -445,9 +461,13 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_PCIE9000S "PCIE9000S"
 /** PCIE9098 Card */
 #define CARD_PCIE9098 "PCIE9098"
+/** PCIEAW690 Card */
+#define CARD_PCIEAW690 "PCIEAW690"
 #endif
 
 #ifdef USB
+/** USB8801 card type */
+#define CARD_TYPE_USB8801 (CARD_TYPE_8801 | (INTF_USB << 8))
 /** USB8897 card type */
 #define CARD_TYPE_USB8897 (CARD_TYPE_8897 | (INTF_USB << 8))
 /** USB8997 card type */
@@ -459,12 +479,15 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 /** USB9097 card type */
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
 
+#define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
 #define IS_USB8997(ct) (CARD_TYPE_USB8997 == (ct))
 #define IS_USB8978(ct) (CARD_TYPE_USB8978 == (ct))
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
 
+/** USB8801 Card */
+#define CARD_USB8801 "USB8801"
 /** USB8897 Card */
 #define CARD_USB8897 "USB8897"
 /** USB8997 Card */
@@ -477,6 +500,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9097 "USB9097"
 #endif
 
+#define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
 #define IS_CARD8887(ct) (CARD_TYPE_8887 == ((ct)&0xf))
 #define IS_CARD8897(ct) (CARD_TYPE_8897 == ((ct)&0xf))
 #define IS_CARD8977(ct) (CARD_TYPE_8977 == ((ct)&0xf))
@@ -484,6 +508,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_CARD8987(ct) (CARD_TYPE_8987 == ((ct)&0xf))
 #define IS_CARD9098(ct) (CARD_TYPE_9098 == ((ct)&0xf))
 #define IS_CARD9097(ct) (CARD_TYPE_9097 == ((ct)&0xf))
+#define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
 
 typedef struct _card_type_entry {
 	t_u16 card_type;
@@ -534,6 +559,9 @@ typedef enum {
 #define MLAN_BUF_FLAG_USB_TX_AGGR MBIT(7)
 #endif
 
+/** Buffer flag for TDLS */
+#define MLAN_BUF_FLAG_TDLS MBIT(8)
+
 /** Buffer flag for TCP_ACK */
 #define MLAN_BUF_FLAG_TCP_ACK MBIT(9)
 
@@ -745,6 +773,7 @@ typedef enum _mlan_event_id {
 	MLAN_EVENT_ID_DRV_BGSCAN_RESULT = 0x80000013,
 	MLAN_EVENT_ID_DRV_FLUSH_RX_WORK = 0x80000015,
 	MLAN_EVENT_ID_DRV_DEFER_RX_WORK = 0x80000016,
+	MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ = 0x80000017,
 	MLAN_EVENT_ID_DRV_FT_RESPONSE = 0x80000018,
 	MLAN_EVENT_ID_DRV_FLUSH_MAIN_WORK = 0x80000019,
 #ifdef UAP_SUPPORT
@@ -918,7 +947,7 @@ typedef MLAN_PACK_START struct _chan_band_info {
 	t_u8 center_chan;
 	/** dfs channel flag */
 	t_u8 is_dfs_chan;
-} MLAN_PACK_END chan_band_info, *pchan_band_info;
+} MLAN_PACK_END chan_band_info;
 
 /** Channel usability flags */
 #define NXP_CHANNEL_NO_OFDM MBIT(9)
@@ -1109,7 +1138,10 @@ typedef struct _mlan_buffer {
 	t_u32 out_ts_usec;
 	/** tx_seq_num */
 	t_u32 tx_seq_num;
-
+	/** Time stamp when packet is deque from rx_q(seconds) */
+	t_u32 extra_ts_sec;
+	/** Time stamp when packet is dequed from rx_q(micro seconds) */
+	t_u32 extra_ts_usec;
 	/** Fields below are valid for MLAN module only */
 	/** Pointer to parent mlan_buffer */
 	struct _mlan_buffer *pparent;
@@ -1121,9 +1153,10 @@ typedef struct _mlan_buffer {
 	} u;
 } mlan_buffer, *pmlan_buffer, **ppmlan_buffer;
 
-/** mlan_fw_info data structure */
+/** mlan_hw_info data structure */
 typedef struct _mlan_hw_info {
 	t_u32 fw_cap;
+	t_u32 fw_cap_ext;
 } mlan_hw_info, *pmlan_hw_info;
 
 /** mlan_bss_attr data structure */
@@ -1262,6 +1295,242 @@ typedef MLAN_PACK_START struct _tlvbuf_custom_ie {
 	tlvbuf_max_mgmt_ie max_mgmt_ie;
 } MLAN_PACK_END mlan_ds_misc_custom_ie;
 
+/** Max TDLS config data length */
+#define MAX_TDLS_DATA_LEN 1024
+
+/** Action commands for TDLS enable/disable */
+#define WLAN_TDLS_CONFIG 0x00
+/** Action commands for TDLS configuration :Set */
+#define WLAN_TDLS_SET_INFO 0x01
+/** Action commands for TDLS configuration :Discovery Request */
+#define WLAN_TDLS_DISCOVERY_REQ 0x02
+/** Action commands for TDLS configuration :Setup Request */
+#define WLAN_TDLS_SETUP_REQ 0x03
+/** Action commands for TDLS configuration :Tear down Request */
+#define WLAN_TDLS_TEAR_DOWN_REQ 0x04
+/** Action ID for TDLS power mode */
+#define WLAN_TDLS_POWER_MODE 0x05
+/**Action ID for init TDLS Channel Switch*/
+#define WLAN_TDLS_INIT_CHAN_SWITCH 0x06
+/** Action ID for stop TDLS Channel Switch */
+#define WLAN_TDLS_STOP_CHAN_SWITCH 0x07
+/** Action ID for configure CS related parameters */
+#define WLAN_TDLS_CS_PARAMS 0x08
+/** Action ID for Disable CS */
+#define WLAN_TDLS_CS_DISABLE 0x09
+/** Action ID for TDLS link status */
+#define WLAN_TDLS_LINK_STATUS 0x0A
+/** Action ID for Host TDLS config uapsd and CS */
+#define WLAN_HOST_TDLS_CONFIG 0x0D
+/** Action ID for TDLS CS immediate return */
+#define WLAN_TDLS_DEBUG_CS_RET_IM 0xFFF7
+/** Action ID for TDLS Stop RX */
+#define WLAN_TDLS_DEBUG_STOP_RX 0xFFF8
+/** Action ID for TDLS Allow weak security for links establish */
+#define WLAN_TDLS_DEBUG_ALLOW_WEAK_SECURITY 0xFFF9
+/** Action ID for TDLS Ignore key lifetime expiry */
+#define WLAN_TDLS_DEBUG_IGNORE_KEY_EXPIRY 0xFFFA
+/** Action ID for TDLS Higher/Lower mac Test */
+#define WLAN_TDLS_DEBUG_HIGHER_LOWER_MAC 0xFFFB
+/** Action ID for TDLS Prohibited Test */
+#define WLAN_TDLS_DEBUG_SETUP_PROHIBITED 0xFFFC
+/** Action ID for TDLS Existing link Test */
+#define WLAN_TDLS_DEBUG_SETUP_SAME_LINK 0xFFFD
+/** Action ID for TDLS Fail Setup Confirm */
+#define WLAN_TDLS_DEBUG_FAIL_SETUP_CONFIRM 0xFFFE
+/** Action commands for TDLS debug: Wrong BSS Request */
+#define WLAN_TDLS_DEBUG_WRONG_BSS 0xFFFF
+
+/** tdls each link rate information */
+typedef MLAN_PACK_START struct _tdls_link_rate_info {
+	/** Tx Data Rate */
+	t_u8 tx_data_rate;
+	/** Tx Rate HT info*/
+	t_u8 tx_rate_htinfo;
+} MLAN_PACK_END tdls_link_rate_info;
+
+/** tdls each link status */
+typedef MLAN_PACK_START struct _tdls_each_link_status {
+	/** peer mac Address */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+	/** Link Flags */
+	t_u8 link_flags;
+	/** Traffic Status */
+	t_u8 traffic_status;
+	/** Tx Failure Count */
+	t_u8 tx_fail_count;
+	/** Channel Number */
+	t_u32 active_channel;
+	/** Last Data RSSI in dBm */
+	t_s16 data_rssi_last;
+	/** Last Data NF in dBm */
+	t_s16 data_nf_last;
+	/** AVG DATA RSSI in dBm */
+	t_s16 data_rssi_avg;
+	/** AVG DATA NF in dBm */
+	t_s16 data_nf_avg;
+	union {
+		/** tdls rate info */
+		tdls_link_rate_info rate_info;
+		/** tdls link final rate*/
+		t_u16 final_data_rate;
+	} u;
+	/** Security Method */
+	t_u8 security_method;
+	/** Key Lifetime in milliseconds */
+	t_u32 key_lifetime;
+	/** Key Length */
+	t_u8 key_length;
+	/** actual key */
+	t_u8 key[];
+} MLAN_PACK_END tdls_each_link_status;
+
+/** TDLS configuration data */
+typedef MLAN_PACK_START struct _tdls_all_config {
+	union {
+		/** TDLS state enable disable */
+		MLAN_PACK_START struct _tdls_config {
+			/** enable or disable */
+			t_u16 enable;
+		} MLAN_PACK_END tdls_config;
+		/** Host tdls config */
+		MLAN_PACK_START struct _host_tdls_cfg {
+			/** support uapsd */
+			t_u8 uapsd_support;
+			/** channel_switch */
+			t_u8 cs_support;
+			/** TLV  length */
+			t_u16 tlv_len;
+			/** tdls info */
+			t_u8 tlv_buffer[];
+		} MLAN_PACK_END host_tdls_cfg;
+		/** TDLS set info */
+		MLAN_PACK_START struct _tdls_set_data {
+			/** (tlv + capInfo) length */
+			t_u16 tlv_length;
+			/** Cap Info */
+			t_u16 cap_info;
+			/** TLV buffer */
+			t_u8 tlv_buffer[];
+		} MLAN_PACK_END tdls_set;
+
+		/** TDLS discovery and others having mac argument */
+		MLAN_PACK_START struct _tdls_discovery_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+		} MLAN_PACK_END tdls_discovery, tdls_stop_chan_switch,
+			tdls_link_status_req;
+
+		/** TDLS discovery Response */
+		MLAN_PACK_START struct _tdls_discovery_resp {
+			/** payload length */
+			t_u16 payload_len;
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** RSSI */
+			t_s8 rssi;
+			/** Cap Info */
+			t_u16 cap_info;
+			/** TLV buffer */
+			t_u8 tlv_buffer[];
+		} MLAN_PACK_END tdls_discovery_resp;
+
+		/** TDLS setup request */
+		MLAN_PACK_START struct _tdls_setup_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** timeout value in milliseconds */
+			t_u32 setup_timeout;
+			/** key lifetime in milliseconds */
+			t_u32 key_lifetime;
+		} MLAN_PACK_END tdls_setup;
+
+		/** TDLS tear down info */
+		MLAN_PACK_START struct _tdls_tear_down_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** reason code */
+			t_u16 reason_code;
+		} MLAN_PACK_END tdls_tear_down, tdls_cmd_resp;
+
+		/** TDLS power mode info */
+		MLAN_PACK_START struct _tdls_power_mode_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** Power Mode */
+			t_u16 power_mode;
+		} MLAN_PACK_END tdls_power_mode;
+
+		/** TDLS channel switch info */
+		MLAN_PACK_START struct _tdls_chan_switch {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** Channel Switch primary channel no */
+			t_u8 primary_channel;
+			/** Channel Switch secondary channel offset */
+			t_u8 secondary_channel_offset;
+			/** Channel Switch Band */
+			t_u8 band;
+			/** Channel Switch time in milliseconds */
+			t_u16 switch_time;
+			/** Channel Switch timeout in milliseconds */
+			t_u16 switch_timeout;
+			/** Channel Regulatory class*/
+			t_u8 regulatory_class;
+			/** peridicity flag*/
+			t_u8 periodicity;
+		} MLAN_PACK_END tdls_chan_switch;
+
+		/** TDLS channel switch paramters */
+		MLAN_PACK_START struct _tdls_cs_params {
+			/** unit time, multiples of 10ms */
+			t_u8 unit_time;
+			/** threshold for other link */
+			t_u8 threshold_otherlink;
+			/** threshold for direct link */
+			t_u8 threshold_directlink;
+		} MLAN_PACK_END tdls_cs_params;
+
+		/** tdls disable channel switch */
+		MLAN_PACK_START struct _tdls_disable_cs {
+			/** Data*/
+			t_u16 data;
+		} MLAN_PACK_END tdls_disable_cs;
+		/** TDLS debug data */
+		MLAN_PACK_START struct _tdls_debug_data {
+			/** debug data */
+			t_u16 debug_data;
+		} MLAN_PACK_END tdls_debug_data;
+
+		/** TDLS link status Response */
+		MLAN_PACK_START struct _tdls_link_status_resp {
+			/** payload length */
+			t_u16 payload_len;
+			/** number of links */
+			t_u8 active_links;
+			/** structure for link status */
+			tdls_each_link_status link_stats[1];
+		} MLAN_PACK_END tdls_link_status_resp;
+
+	} u;
+} MLAN_PACK_END tdls_all_config;
+
+/** TDLS configuration buffer */
+typedef MLAN_PACK_START struct _buf_tdls_config {
+	/** TDLS Action */
+	t_u16 tdls_action;
+	/** TDLS data */
+	t_u8 tdls_data[MAX_TDLS_DATA_LEN];
+} MLAN_PACK_END mlan_ds_misc_tdls_config;
+
+/** Event structure for tear down */
+typedef struct _tdls_tear_down_event {
+	/** Peer mac address */
+	t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+	/** Reason code */
+	t_u16 reason_code;
+} tdls_tear_down_event;
+
 /** channel width */
 typedef enum wifi_channel_width {
 	WIFI_CHAN_WIDTH_20 = 0,
@@ -1614,160 +1883,149 @@ typedef struct _sta_stats {
 /** mlan_callbacks data structure */
 typedef struct _mlan_callbacks {
 	/** moal_get_fw_data */
-	mlan_status (*moal_get_fw_data)(t_void *pmoal_handle, t_u32 offset,
-					t_u32 len, t_u8 *pbuf);
-	mlan_status (*moal_get_vdll_data)(t_void *pmoal_handle, t_u32 len,
-					  t_u8 *pbuf);
+	mlan_status (*moal_get_fw_data)(t_void *pmoal, t_u32 offset, t_u32 len,
+					t_u8 *pbuf);
+	mlan_status (*moal_get_vdll_data)(t_void *pmoal, t_u32 len, t_u8 *pbuf);
 	/** moal_get_hw_spec_complete */
-	mlan_status (*moal_get_hw_spec_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_get_hw_spec_complete)(t_void *pmoal,
 						 mlan_status status,
 						 pmlan_hw_info phw,
 						 pmlan_bss_tbl ptbl);
 	/** moal_init_fw_complete */
-	mlan_status (*moal_init_fw_complete)(t_void *pmoal_handle,
-					     mlan_status status);
+	mlan_status (*moal_init_fw_complete)(t_void *pmoal, mlan_status status);
 	/** moal_shutdown_fw_complete */
-	mlan_status (*moal_shutdown_fw_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_shutdown_fw_complete)(t_void *pmoal,
 						 mlan_status status);
 	/** moal_send_packet_complete */
-	mlan_status (*moal_send_packet_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_send_packet_complete)(t_void *pmoal,
 						 pmlan_buffer pmbuf,
 						 mlan_status status);
 	/** moal_recv_complete */
-	mlan_status (*moal_recv_complete)(t_void *pmoal_handle,
-					  pmlan_buffer pmbuf, t_u32 port,
-					  mlan_status status);
+	mlan_status (*moal_recv_complete)(t_void *pmoal, pmlan_buffer pmbuf,
+					  t_u32 port, mlan_status status);
 	/** moal_recv_packet */
-	mlan_status (*moal_recv_packet)(t_void *pmoal_handle,
-					pmlan_buffer pmbuf);
+	mlan_status (*moal_recv_packet)(t_void *pmoal, pmlan_buffer pmbuf);
 	/** moal_recv_event */
-	mlan_status (*moal_recv_event)(t_void *pmoal_handle,
-				       pmlan_event pmevent);
+	mlan_status (*moal_recv_event)(t_void *pmoal, pmlan_event pmevent);
 	/** moal_ioctl_complete */
-	mlan_status (*moal_ioctl_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_ioctl_complete)(t_void *pmoal,
 					   pmlan_ioctl_req pioctl_req,
 					   mlan_status status);
 
 	/** moal_alloc_mlan_buffer */
-	mlan_status (*moal_alloc_mlan_buffer)(t_void *pmoal_handle, t_u32 size,
+	mlan_status (*moal_alloc_mlan_buffer)(t_void *pmoal, t_u32 size,
 					      ppmlan_buffer pmbuf);
 	/** moal_free_mlan_buffer */
-	mlan_status (*moal_free_mlan_buffer)(t_void *pmoal_handle,
-					     pmlan_buffer pmbuf);
+	mlan_status (*moal_free_mlan_buffer)(t_void *pmoal, pmlan_buffer pmbuf);
 
 #ifdef USB
 	/** moal_write_data_async */
-	mlan_status (*moal_write_data_async)(t_void *pmoal_handle,
-					     pmlan_buffer pmbuf, t_u32 port);
+	mlan_status (*moal_write_data_async)(t_void *pmoal, pmlan_buffer pmbuf,
+					     t_u32 port);
 #endif /* USB */
 #if defined(SDIO) || defined(PCIE)
 	/** moal_write_reg */
-	mlan_status (*moal_write_reg)(t_void *pmoal_handle, t_u32 reg,
-				      t_u32 data);
+	mlan_status (*moal_write_reg)(t_void *pmoal, t_u32 reg, t_u32 data);
 	/** moal_read_reg */
-	mlan_status (*moal_read_reg)(t_void *pmoal_handle, t_u32 reg,
-				     t_u32 *data);
+	mlan_status (*moal_read_reg)(t_void *pmoal, t_u32 reg, t_u32 *data);
 #endif /* SDIO || PCIE */
 	/** moal_write_data_sync */
-	mlan_status (*moal_write_data_sync)(t_void *pmoal_handle,
-					    pmlan_buffer pmbuf, t_u32 port,
-					    t_u32 timeout);
+	mlan_status (*moal_write_data_sync)(t_void *pmoal, pmlan_buffer pmbuf,
+					    t_u32 port, t_u32 timeout);
 	/** moal_read_data_sync */
-	mlan_status (*moal_read_data_sync)(t_void *pmoal_handle,
-					   pmlan_buffer pmbuf, t_u32 port,
-					   t_u32 timeout);
+	mlan_status (*moal_read_data_sync)(t_void *pmoal, pmlan_buffer pmbuf,
+					   t_u32 port, t_u32 timeout);
 	/** moal_malloc */
-	mlan_status (*moal_malloc)(t_void *pmoal_handle, t_u32 size, t_u32 flag,
+	mlan_status (*moal_malloc)(t_void *pmoal, t_u32 size, t_u32 flag,
 				   t_u8 **ppbuf);
 	/** moal_mfree */
-	mlan_status (*moal_mfree)(t_void *pmoal_handle, t_u8 *pbuf);
+	mlan_status (*moal_mfree)(t_void *pmoal, t_u8 *pbuf);
 	/** moal_vmalloc */
-	mlan_status (*moal_vmalloc)(t_void *pmoal_handle, t_u32 size,
-				    t_u8 **ppbuf);
+	mlan_status (*moal_vmalloc)(t_void *pmoal, t_u32 size, t_u8 **ppbuf);
 	/** moal_vfree */
-	mlan_status (*moal_vfree)(t_void *pmoal_handle, t_u8 *pbuf);
+	mlan_status (*moal_vfree)(t_void *pmoal, t_u8 *pbuf);
 #ifdef PCIE
 	/** moal_malloc_consistent */
-	mlan_status (*moal_malloc_consistent)(t_void *pmoal_handle, t_u32 size,
+	mlan_status (*moal_malloc_consistent)(t_void *pmoal, t_u32 size,
 					      t_u8 **ppbuf, t_u64 *pbuf_pa);
 	/** moal_mfree_consistent */
-	mlan_status (*moal_mfree_consistent)(t_void *pmoal_handle, t_u32 size,
+	mlan_status (*moal_mfree_consistent)(t_void *pmoal, t_u32 size,
 					     t_u8 *pbuf, t_u64 buf_pa);
 	/** moal_map_memory */
-	mlan_status (*moal_map_memory)(t_void *pmoal_handle, t_u8 *pbuf,
+	mlan_status (*moal_map_memory)(t_void *pmoal, t_u8 *pbuf,
 				       t_u64 *pbuf_pa, t_u32 size, t_u32 flag);
 	/** moal_unmap_memory */
-	mlan_status (*moal_unmap_memory)(t_void *pmoal_handle, t_u8 *pbuf,
+	mlan_status (*moal_unmap_memory)(t_void *pmoal, t_u8 *pbuf,
 					 t_u64 buf_pa, t_u32 size, t_u32 flag);
 #endif /* PCIE */
 	/** moal_memset */
-	t_void *(*moal_memset)(t_void *pmoal_handle, t_void *pmem, t_u8 byte,
+	t_void *(*moal_memset)(t_void *pmoal, t_void *pmem, t_u8 byte,
 			       t_u32 num);
 	/** moal_memcpy */
-	t_void *(*moal_memcpy)(t_void *pmoal_handle, t_void *pdest,
-			       const t_void *psrc, t_u32 num);
+	t_void *(*moal_memcpy)(t_void *pmoal, t_void *pdest, const t_void *psrc,
+			       t_u32 num);
 	/** moal_memcpy_ext */
-	t_void *(*moal_memcpy_ext)(t_void *pmoal_handle, t_void *pdest,
+	t_void *(*moal_memcpy_ext)(t_void *pmoal, t_void *pdest,
 				   const t_void *psrc, t_u32 num,
 				   t_u32 dest_size);
 	/** moal_memmove */
-	t_void *(*moal_memmove)(t_void *pmoal_handle, t_void *pdest,
+	t_void *(*moal_memmove)(t_void *pmoal, t_void *pdest,
 				const t_void *psrc, t_u32 num);
 	/** moal_memcmp */
-	t_s32 (*moal_memcmp)(t_void *pmoal_handle, const t_void *pmem1,
+	t_s32 (*moal_memcmp)(t_void *pmoal, const t_void *pmem1,
 			     const t_void *pmem2, t_u32 num);
 	/** moal_udelay */
-	t_void (*moal_udelay)(t_void *pmoal_handle, t_u32 udelay);
+	t_void (*moal_udelay)(t_void *pmoal, t_u32 udelay);
 	/** moal_usleep_range */
-	t_void (*moal_usleep_range)(t_void *pmoal_handle, t_u32 min_delay,
+	t_void (*moal_usleep_range)(t_void *pmoal, t_u32 min_delay,
 				    t_u32 max_delay);
 	/** moal_get_boot_ktime */
-	mlan_status (*moal_get_boot_ktime)(t_void *pmoal_handle, t_u64 *pnsec);
+	mlan_status (*moal_get_boot_ktime)(t_void *pmoal, t_u64 *pnsec);
 	/** moal_get_system_time */
-	mlan_status (*moal_get_system_time)(t_void *pmoal_handle, t_u32 *psec,
+	mlan_status (*moal_get_system_time)(t_void *pmoal, t_u32 *psec,
 					    t_u32 *pusec);
 	/** moal_init_timer*/
-	mlan_status (*moal_init_timer)(t_void *pmoal_handle, t_void **pptimer,
+	mlan_status (*moal_init_timer)(t_void *pmoal, t_void **pptimer,
 				       IN t_void (*callback)(t_void *pcontext),
 				       t_void *pcontext);
 	/** moal_free_timer */
-	mlan_status (*moal_free_timer)(t_void *pmoal_handle, t_void *ptimer);
+	mlan_status (*moal_free_timer)(t_void *pmoal, t_void *ptimer);
 	/** moal_start_timer*/
-	mlan_status (*moal_start_timer)(t_void *pmoal_handle, t_void *ptimer,
+	mlan_status (*moal_start_timer)(t_void *pmoal, t_void *ptimer,
 					t_u8 periodic, t_u32 msec);
 	/** moal_stop_timer*/
-	mlan_status (*moal_stop_timer)(t_void *pmoal_handle, t_void *ptimer);
+	mlan_status (*moal_stop_timer)(t_void *pmoal, t_void *ptimer);
 	/** moal_init_lock */
-	mlan_status (*moal_init_lock)(t_void *pmoal_handle, t_void **pplock);
+	mlan_status (*moal_init_lock)(t_void *pmoal, t_void **pplock);
 	/** moal_free_lock */
-	mlan_status (*moal_free_lock)(t_void *pmoal_handle, t_void *plock);
+	mlan_status (*moal_free_lock)(t_void *pmoal, t_void *plock);
 	/** moal_spin_lock */
-	mlan_status (*moal_spin_lock)(t_void *pmoal_handle, t_void *plock);
+	mlan_status (*moal_spin_lock)(t_void *pmoal, t_void *plock);
 	/** moal_spin_unlock */
-	mlan_status (*moal_spin_unlock)(t_void *pmoal_handle, t_void *plock);
+	mlan_status (*moal_spin_unlock)(t_void *pmoal, t_void *plock);
 	/** moal_print */
-	t_void (*moal_print)(t_void *pmoal_handle, t_u32 level, char *pformat,
-			     IN...);
+	t_void (*moal_print)(t_void *pmoal, t_u32 level, char *pformat, IN...);
 	/** moal_print_netintf */
-	t_void (*moal_print_netintf)(t_void *pmoal_handle, t_u32 bss_index,
+	t_void (*moal_print_netintf)(t_void *pmoal, t_u32 bss_index,
 				     t_u32 level);
 	/** moal_assert */
-	t_void (*moal_assert)(t_void *pmoal_handle, t_u32 cond);
+	t_void (*moal_assert)(t_void *pmoal, t_u32 cond);
 
 	/** moal_hist_data_add */
-	t_void (*moal_hist_data_add)(t_void *pmoal_handle, t_u32 bss_index,
+	t_void (*moal_hist_data_add)(t_void *pmoal, t_u32 bss_index,
 				     t_u16 rx_rate, t_s8 snr, t_s8 nflr,
 				     t_u8 antenna);
+	t_void (*moal_updata_peer_signal)(t_void *pmoal, t_u32 bss_index,
+					  t_u8 *peer_addr, t_s8 snr, t_s8 nflr);
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal,
 						  t_u32 bss_index);
-	mlan_status (*moal_notify_hostcmd_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_notify_hostcmd_complete)(t_void *pmoal,
 						    t_u32 bss_index);
 #endif
-	void (*moal_tp_accounting)(t_void *pmoal_handle, t_void *buf,
+	void (*moal_tp_accounting)(t_void *pmoal, t_void *buf,
 				   t_u32 drop_point);
-	void (*moal_tp_accounting_rx_param)(t_void *pmoal_handle,
-					    unsigned int type,
+	void (*moal_tp_accounting_rx_param)(t_void *pmoal, unsigned int type,
 					    unsigned int rsvd1);
 
 } mlan_callbacks, *pmlan_callbacks;
@@ -1899,8 +2157,6 @@ typedef struct _mlan_device {
 	/** Tx data endpoint address */
 	t_u8 tx_data_ep;
 #endif
-	/** fw region */
-	t_bool fw_region;
 	/** passive to active scan */
 	t_u8 passive_to_active_scan;
 	/** uap max supported station per chip */
@@ -1919,51 +2175,50 @@ MLAN_API mlan_status mlan_register(pmlan_device pmdevice,
 				   t_void **ppmlan_adapter);
 
 /** Un-registration */
-MLAN_API mlan_status mlan_unregister(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_unregister(t_void *padapter);
 
 /** Firmware Downloading */
-MLAN_API mlan_status mlan_dnld_fw(t_void *pmlan_adapter, pmlan_fw_image pmfw);
+MLAN_API mlan_status mlan_dnld_fw(t_void *padapter, pmlan_fw_image pmfw);
 
 /** Custom data pass API */
-MLAN_API mlan_status mlan_set_init_param(t_void *pmlan_adapter,
+MLAN_API mlan_status mlan_set_init_param(t_void *padapter,
 					 pmlan_init_param pparam);
 
 /** Firmware Initialization */
-MLAN_API mlan_status mlan_init_fw(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_init_fw(t_void *padapter);
 
 /** Firmware Shutdown */
-MLAN_API mlan_status mlan_shutdown_fw(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_shutdown_fw(t_void *padapter);
 
 /** Main Process */
-MLAN_API mlan_status mlan_main_process(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_main_process(t_void *padapter);
 
 /** Rx process */
-mlan_status mlan_rx_process(t_void *pmlan_adapter, t_u8 *rx_pkts);
+mlan_status mlan_rx_process(t_void *padapter, t_u8 *rx_pkts);
 
 /** Packet Transmission */
-MLAN_API mlan_status mlan_send_packet(t_void *pmlan_adapter,
-				      pmlan_buffer pmbuf);
+MLAN_API mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf);
 
 #ifdef USB
 /** mlan_write_data_async_complete */
-MLAN_API mlan_status mlan_write_data_async_complete(t_void *pmlan_adapter,
+MLAN_API mlan_status mlan_write_data_async_complete(t_void *padapter,
 						    pmlan_buffer pmbuf,
 						    t_u32 port,
 						    mlan_status status);
 
 /** Packet Reception */
-MLAN_API mlan_status mlan_recv(t_void *pmlan_adapter, pmlan_buffer pmbuf,
+MLAN_API mlan_status mlan_recv(t_void *padapter, pmlan_buffer pmbuf,
 			       t_u32 port);
 #endif /* USB */
 
 /** Packet Reception complete callback */
-MLAN_API mlan_status mlan_recv_packet_complete(t_void *pmlan_adapter,
+MLAN_API mlan_status mlan_recv_packet_complete(t_void *padapter,
 					       pmlan_buffer pmbuf,
 					       mlan_status status);
 
 #if defined(SDIO) || defined(PCIE)
 /** interrupt handler */
-MLAN_API mlan_status mlan_interrupt(t_u16 msg_id, t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_interrupt(t_u16 msg_id, t_void *padapter);
 
 #if defined(SYSKT)
 /** GPIO IRQ callback function */
@@ -1971,7 +2226,7 @@ MLAN_API t_void mlan_hs_callback(t_void *pctx);
 #endif /* SYSKT_MULTI || SYSKT */
 #endif /* SDIO || PCIE */
 
-MLAN_API t_void mlan_pm_wakeup_card(t_void *pmlan_adapter, t_u8 keep_wakeup);
+MLAN_API t_void mlan_pm_wakeup_card(t_void *padapter, t_u8 keep_wakeup);
 
 MLAN_API t_u8 mlan_is_main_process_running(t_void *adapter);
 #ifdef PCIE
@@ -1979,10 +2234,8 @@ MLAN_API t_void mlan_set_int_mode(t_void *adapter, t_u32 int_mode,
 				  t_u8 func_num);
 #endif
 /** mlan ioctl */
-MLAN_API mlan_status mlan_ioctl(t_void *pmlan_adapter,
-				pmlan_ioctl_req pioctl_req);
+MLAN_API mlan_status mlan_ioctl(t_void *padapter, pmlan_ioctl_req pioctl_req);
 /** mlan select wmm queue */
-MLAN_API t_u8 mlan_select_wmm_queue(t_void *pmlan_adapter, t_u8 bss_num,
-				    t_u8 tid);
+MLAN_API t_u8 mlan_select_wmm_queue(t_void *padapter, t_u8 bss_num, t_u8 tid);
 
 #endif /* !_MLAN_DECL_H_ */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_fw.h b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
index 6469ad3..f593ac7 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_fw.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
@@ -5,7 +5,7 @@
  *  in MLAN module.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -439,6 +439,11 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 
 #define TLV_TYPE_DMCS_STATUS (PROPRIETARY_TLV_BASE_ID + 0x13A) /* 0x023A */
 
+/** TLV type : TDLS IDLE TIMEOUT */
+#define TLV_TYPE_TDLS_IDLE_TIMEOUT                                             \
+	(PROPRIETARY_TLV_BASE_ID + 0xC2) /* 0x01C2                             \
+					  */
+
 /** TLV type : HT Capabilities */
 #define TLV_TYPE_HT_CAP (PROPRIETARY_TLV_BASE_ID + 0x4a) /* 0x014a */
 /** TLV type : HT Information */
@@ -543,6 +548,8 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 /** Non green field station */
 #define NON_GREENFIELD_STAS 0x04
 
+/** Max AMSDU size support */
+#define HWSPEC_MAX_AMSDU_SUPP MBIT(31)
 /** Greenfield support */
 #define HWSPEC_GREENFIELD_SUPP MBIT(29)
 /** RX STBC support */
@@ -564,7 +571,8 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 /** Default 11n capability mask for 5GHz */
 #define DEFAULT_11N_CAP_MASK_A                                                 \
 	(HWSPEC_CHANBW40_SUPP | HWSPEC_SHORTGI20_SUPP |                        \
-	 HWSPEC_SHORTGI40_SUPP | HWSPEC_RXSTBC_SUPP | HWSPEC_LDPC_SUPP)
+	 HWSPEC_MAX_AMSDU_SUPP | HWSPEC_SHORTGI40_SUPP | HWSPEC_RXSTBC_SUPP |  \
+	 HWSPEC_LDPC_SUPP)
 
 /** Default 11n TX BF capability 2X2 chip **/
 #define DEFAULT_11N_TX_BF_CAP_2X2 0x19E74618
@@ -1273,6 +1281,11 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 
 #define HostCmd_CMD_802_11_BAND_STEERING 0x026f
 
+/** Host Command ID : TDLS configuration */
+#define HostCmd_CMD_TDLS_CONFIG 0x0100
+/** Host Command ID : TDLS operation */
+#define HostCmd_CMD_TDLS_OPERATION 0x0122
+
 #ifdef SDIO
 /** Host Command ID : SDIO single port RX aggr */
 #define HostCmd_CMD_SDIO_SP_RX_AGGR_CFG 0x0223
@@ -1326,6 +1339,8 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define FW_CAPINFO_EXT_802_11AX MBIT(7)
 /** FW cap info bit 8: 80MHZ disabled */
 #define FW_CAPINFO_EXT_NO_80MHZ MBIT(8)
+/** FW cap info bit 9: Multi BSSID Support */
+#define FW_CAPINFO_EXT_MULTI_BSSID MBIT(9)
 
 /** Check if 5G 1x1 only is supported by firmware */
 #define IS_FW_SUPPORT_5G_1X1_ONLY(_adapter)                                    \
@@ -1351,6 +1366,9 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 /** Check if 80MHZ disabled in firmware */
 #define IS_FW_SUPPORT_NO_80MHZ(_adapter)                                       \
 	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_NO_80MHZ)
+/** Check if Multi BSSID supported by firmware */
+#define IS_FW_SUPPORT_MULTIBSSID(_adapter)                                     \
+	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_MULTI_BSSID)
 
 /** FW cap info TLV */
 typedef MLAN_PACK_START struct _MrvlIEtypes_fw_cap_info_t {
@@ -1599,6 +1617,7 @@ typedef MLAN_PACK_START struct _power_table_attr {
 #define HostCmd_CMD_UAP_BEACON_STUCK_CFG 0x0271
 #define HostCmd_CMD_ARB_CONFIG 0x0273
 #define HostCmd_CMD_DOT11MC_UNASSOC_FTM_CFG 0x0275
+#define HostCmd_CMD_HAL_PHY_CFG 0x0276
 
 /** Enhanced PS modes */
 typedef enum _ENH_PS_MODES {
@@ -1839,6 +1858,9 @@ typedef enum _ENH_PS_MODES {
 /** Remain on Channel expired event */
 #define EVENT_REMAIN_ON_CHANNEL_EXPIRED 0x0000005f
 
+/** TDLS generic event */
+#define EVENT_TDLS_GENERIC_EVENT 0x00000052
+
 #define EVENT_MEF_HOST_WAKEUP 0x0000004f
 
 /** Card Event definition: Channel switch pending announcment */
@@ -1910,6 +1932,76 @@ typedef enum _ENH_PS_MODES {
 /** Get BSS type from event cause (bit 31:24) */
 #define EVENT_GET_BSS_TYPE(event_cause) (((event_cause) >> 24) & 0x00ff)
 
+/** event type for tdls setup failure */
+#define TDLS_EVENT_TYPE_SETUP_FAILURE 1
+/** event type for tdls setup request received */
+#define TDLS_EVENT_TYPE_SETUP_REQ 2
+/** event type for tdls link torn down */
+#define TDLS_EVENT_TYPE_LINK_TORN_DOWN 3
+/** event type for tdls link established */
+#define TDLS_EVENT_TYPE_LINK_ESTABLISHED 4
+/** event type for tdls debug */
+#define TDLS_EVENT_TYPE_DEBUG 5
+/** event type for tdls packet */
+#define TDLS_EVENT_TYPE_PACKET 6
+/** event type for channel switch result */
+#define TDLS_EVENT_TYPE_CHAN_SWITCH_RESULT 7
+/** event type for start channel switch */
+#define TDLS_EVENT_TYPE_START_CHAN_SWITCH 8
+/** event type for stop channel switch */
+#define TDLS_EVENT_TYPE_CHAN_SWITCH_STOPPED 9
+
+/** Packet received on direct link */
+#define RXPD_FLAG_PKT_DIRECT_LINK 1
+/** TDLS base channel */
+#define TDLS_BASE_CHANNEL 0
+/** TDLS off channel */
+#define TDLS_OFF_CHANNEL 1
+
+/** structure for channel switch result from TDLS FW */
+typedef MLAN_PACK_START struct _chan_switch_result {
+	/** current channel, 0 - base channel, 1 - off channel*/
+	t_u8 current_channel;
+	/** channel switch status*/
+	t_u8 status;
+	/** channel switch fauilure reason code*/
+	t_u8 reason;
+} MLAN_PACK_END chan_switch_result;
+
+typedef MLAN_PACK_START struct _ie_data {
+	/** IE Length */
+	t_u16 ie_length;
+	/** IE pointer */
+	t_u8 ie_ptr[];
+} MLAN_PACK_END tdls_ie_data;
+
+/** Event structure for generic events from TDLS FW */
+typedef MLAN_PACK_START struct _Event_tdls_generic {
+	/** Event Type */
+	t_u16 event_type;
+	/** Peer mac address */
+	t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+	union {
+		/** channel switch result structure*/
+		chan_switch_result switch_result;
+		/** channel switch stop reason*/
+		t_u8 cs_stop_reason;
+		/** Reason code */
+		t_u16 reason_code;
+		/** IE data */
+		tdls_ie_data ie_data;
+	} u;
+} MLAN_PACK_END Event_tdls_generic;
+
+typedef enum _tdls_error_code_e {
+	NO_ERROR = 0,
+	INTERNAL_ERROR,
+	MAX_TDLS_LINKS_EST,
+	TDLS_LINK_EXISTS,
+	TDLS_LINK_NONEXISTENT,
+	TDLS_PEER_STA_UNREACHABLE = 25,
+} tdls_error_code_e;
+
 /** Event_WEP_ICV_ERR structure */
 typedef MLAN_PACK_START struct _Event_WEP_ICV_ERR {
 	/** Reason code */
@@ -1945,6 +2037,15 @@ typedef MLAN_PACK_START struct _WLAN_802_11_VARIABLE_IEs {
 } MLAN_PACK_END WLAN_802_11_VARIABLE_IEs;
 
 /** TLV related data structures*/
+/*TDLS TIMEOUT VALUE (seconds)*/
+#define TDLS_IDLE_TIMEOUT 60
+/** MrvlIEtypes_Data_t */
+typedef MLAN_PACK_START struct _MrvlIEtypes_TDLS_Idle_Timeout_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** value */
+	t_u16 value;
+} MLAN_PACK_END MrvlIEtypes_TDLS_Idle_Timeout_t;
 #if defined(STA_SUPPORT)
 /** Pairwise Cipher Suite length */
 #define PAIRWISE_CIPHER_SUITE_LEN 4
@@ -1960,6 +2061,9 @@ typedef MLAN_PACK_START struct _WLAN_802_11_VARIABLE_IEs {
 /** Bit mask for TxPD status field for last packet */
 #define MRVDRV_TxPD_POWER_MGMT_LAST_PACKET 0x08
 
+/** Bit mask for TxPD flags field for TDLS packet */
+#define MRVDRV_TxPD_FLAGS_TDLS_PACKET MBIT(4)
+
 /** Bit mask for TxPD flags field for Tx status report */
 #define MRVDRV_TxPD_FLAGS_TX_PACKET_STATUS MBIT(5)
 
@@ -3556,6 +3660,14 @@ typedef MLAN_PACK_START struct _HostCmd_DS_802_11_GET_LOG {
 	t_u32 channel_number;
 	/** Channel Switch Mode */
 	t_u32 channel_switch_mode;
+	/** Reset Rx Mac Count */
+	t_u32 rx_reset_mac_recovery_cnt;
+	/** ISR2 Not Done Count*/
+	t_u32 rx_Isr2_NotDone_Cnt;
+	/** GDMA Abort Count */
+	t_u32 gdma_abort_cnt;
+	/** Rx Reset MAC Count */
+	t_u32 g_reset_rx_mac_cnt;
 } MLAN_PACK_END HostCmd_DS_802_11_GET_LOG;
 
 /* maln wifi rate */
@@ -3789,6 +3901,10 @@ typedef MLAN_PACK_START struct _HostCmd_DS_802_11_LINK_STATISTIC {
 typedef MLAN_PACK_START struct _HostCmd_TX_RATE_QUERY {
 	/** Tx rate */
 	t_u8 tx_rate;
+	/** V14 FW: Ht Info
+	 * [Bit 0] RxRate format: LG=0, HT=1
+	 * [Bit 1] HT Bandwidth: BW20 = 0, BW40 = 1
+	 * [Bit 2] HT Guard Interval: LGI = 0, SGI = 1 */
 	/** Tx Rate Info:
 	 * [Bit 0-1] tx rate formate: LG = 0, HT = 1, VHT = 2
 	 * [Bit 2-3] HT/VHT Bandwidth: BW20 = 0, BW40 = 1, BW80 = 2, BW160 = 3
@@ -3910,6 +4026,15 @@ typedef MLAN_PACK_START struct _HostCmd_DS_SSU_CFG {
 } MLAN_PACK_END HostCmd_DS_SSU_CFG;
 #endif
 
+typedef MLAN_PACK_START struct _HostCmd_DS_HAL_PHY_CFG {
+	/** Action */
+	t_u16 action;
+	/** 11b pwr spectral density mask enable/disable */
+	t_u8 dot11b_psd_mask_cfg;
+	/** reserved fields for future hal/phy cfg use */
+	t_u8 reserved[7];
+} MLAN_PACK_END HostCmd_DS_HAL_PHY_CFG;
+
 /** SNMP_MIB_INDEX */
 typedef enum _SNMP_MIB_INDEX {
 	OpRateSet_i = 1,
@@ -4004,7 +4129,9 @@ typedef MLAN_PACK_START struct _MrvlIETypes_rate_setting_t {
 typedef MLAN_PACK_START struct _HostCmd_DS_TX_RATE_CFG {
 	/** Action */
 	t_u16 action;
-	t_u16 reserved_1;
+	/** V14 FW: cfg_index */
+	/** V15+ FW: reserved_1 */
+	t_u16 cfg_index;
 	/* MrvlRateScope_t RateScope;
 	 * MrvlRateDropPattern_t RateDrop; */
 	t_u8 tlv_buf[];
@@ -5147,6 +5274,18 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_psk_t {
 } MLAN_PACK_END MrvlIEtypes_psk_t;
 #endif /* WIFI_DIRECT_SUPPORT */
 
+/** Data structure for Link ID */
+typedef MLAN_PACK_START struct _MrvlIETypes_LinkIDElement_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Bssid */
+	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
+	/** initial sta address*/
+	t_u8 init_sta[MLAN_MAC_ADDR_LENGTH];
+	/** respose sta address */
+	t_u8 resp_sta[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END MrvlIETypes_LinkIDElement_t;
+
 /** MrvlIEtypes_PMK_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_PMK_t {
 	/** Header */
@@ -5355,6 +5494,28 @@ typedef MLAN_PACK_START struct _HostCmd_DS_MGMT_IE_LIST {
 	mlan_ds_misc_custom_ie ds_mgmt_ie;
 } MLAN_PACK_END HostCmd_DS_MGMT_IE_LIST_CFG;
 
+/** HostCmd_DS_TDLS_CONFIG */
+typedef MLAN_PACK_START struct _HostCmd_DS_TDLS_CONFIG {
+	/** Set TDLS configuration */
+	mlan_ds_misc_tdls_config tdls_info;
+} MLAN_PACK_END HostCmd_DS_TDLS_CONFIG;
+
+/**Action ID for TDLS delete link*/
+#define TDLS_DELETE 0x00
+/**Action ID for TDLS create link*/
+#define TDLS_CREATE 0x01
+/**Action ID for TDLS config link*/
+#define TDLS_CONFIG 0x02
+/** HostCmd_DS_TDLS_OPER */
+typedef MLAN_PACK_START struct _HostCmd_DS_TDLS_OPER {
+	/** Action */
+	t_u16 tdls_action;
+	/**reason*/
+	t_u16 reason;
+	/** peer mac */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END HostCmd_DS_TDLS_OPER;
+
 /** HostCmd_CMD_MAC_REG_ACCESS */
 typedef MLAN_PACK_START struct _HostCmd_DS_MAC_REG_ACCESS {
 	/** Action */
@@ -5522,7 +5683,7 @@ typedef MLAN_PACK_START struct _dmcs_chan_status {
 	t_u8 sta_count;
 } MLAN_PACK_END dmcs_chan_status;
 
-typedef MLAN_PACK_START struct _dmcs_status {
+typedef MLAN_PACK_START struct _dmcs_status_data {
 	/** radio ID */
 	t_u8 radio_id;
 	/** Running mode
@@ -5533,7 +5694,7 @@ typedef MLAN_PACK_START struct _dmcs_status {
 	t_u8 running_mode;
 	/** Channel status of this radio */
 	dmcs_chan_status chan_status[2];
-} MLAN_PACK_END dmcs_status;
+} MLAN_PACK_END dmcs_status_data;
 
 /** MrvlIEtypes_DmcsConfig_t */
 typedef MLAN_PACK_START struct _MrvlIEtypes_DmcsConfig_t {
@@ -5542,7 +5703,7 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_DmcsConfig_t {
 	/** Mapping policy */
 	t_u8 mapping_policy;
 	/** Radio status of DMCS */
-	dmcs_status radio_status[MAX_NUM_MAC];
+	dmcs_status_data radio_status[MAX_NUM_MAC];
 } MLAN_PACK_END MrvlIEtypes_DmcsStatus_t;
 
 #define ANTMODE_FW_DECISION 0xff
@@ -7246,6 +7407,10 @@ typedef struct MLAN_PACK_START _HostCmd_DS_COMMAND {
 		HostCmd_DS_802_11_IBSS_STATUS ibss_coalescing;
 		/** Mgmt IE list configuration */
 		HostCmd_DS_MGMT_IE_LIST_CFG mgmt_ie_list;
+		/** TDLS configuration command */
+		HostCmd_DS_TDLS_CONFIG tdls_config_data;
+		/** TDLS operation command */
+		HostCmd_DS_TDLS_OPER tdls_oper_data;
 		/** System clock configuration */
 		HostCmd_DS_ECL_SYSTEM_CLOCK_CONFIG sys_clock_cfg;
 		/** MAC register access */
@@ -7358,8 +7523,10 @@ typedef struct MLAN_PACK_START _HostCmd_DS_COMMAND {
 		struct mfg_cmd_generic_cfg mfg_generic_cfg;
 		struct mfg_cmd_tx_cont mfg_tx_cont;
 		struct mfg_cmd_tx_frame2 mfg_tx_frame2;
+		struct mfg_Cmd_HE_TBTx_t mfg_he_power;
 		HostCmd_DS_CMD_ARB_CONFIG arb_cfg;
 		HostCmd_DS_CMD_DOT11MC_UNASSOC_FTM_CFG dot11mc_unassoc_ftm_cfg;
+		HostCmd_DS_HAL_PHY_CFG hal_phy_cfg_params;
 	} params;
 } MLAN_PACK_END HostCmd_DS_COMMAND, *pHostCmd_DS_COMMAND;
 
@@ -7391,6 +7558,10 @@ typedef struct MLAN_PACK_START _opt_sleep_confirm_buffer {
 #define VDLL_IND_TYPE_REQ 0
 /** notify vdll start offset in firmware image */
 #define VDLL_IND_TYPE_OFFSET 1
+/** notify vdll download error: signature error */
+#define VDLL_IND_TYPE_ERR_SIG 2
+/** notify vdll download error: ID error */
+#define VDLL_IND_TYPE_ERR_ID 3
 
 /** vdll indicate event structure */
 typedef MLAN_PACK_START struct _vdll_ind {
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ieee.h b/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
index a2a4d55..6f73424 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
@@ -4,7 +4,7 @@
  *  definitions used in MLAN and MOAL module.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -100,6 +100,7 @@ typedef MLAN_PACK_START enum _IEEEtypes_ElementId_e {
 	NONTX_BSSID_CAP = 83,
 	MBSSID_INDEX = 85,
 	EXT_CAPABILITY = 127,
+	LINK_ID = 101,
 	/*IEEE802.11r*/
 	MOBILITY_DOMAIN = 54,
 	FAST_BSS_TRANSITION = 55,
@@ -734,25 +735,27 @@ typedef MLAN_PACK_START struct {
 	t_u8 Schedule : 1;
 	IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e AckPolicy : 2;
 	t_u8 UserPri : 3; /* ! 802.1d User Priority */
-	IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /* !
-								    Legacy/Trigg
-								  */
+	// IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /*
+	// !Legacy/Trigg*/
+	t_u8 PowerSaveBehavior : 1;
 	t_u8 Aggregation : 1; /* ! Reserved */
 	t_u8 AccessPolicy2 : 1; /* ! */
 	t_u8 AccessPolicy1 : 1; /* ! */
 	IEEEtypes_WMM_TSPEC_TS_Info_Direction_e Direction : 2;
 	t_u8 TID : 4; /* ! Unique identifier */
-	IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	// IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	t_u8 TrafficType : 1;
 #else
-	IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	// IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	t_u8 TrafficType : 1;
 	t_u8 TID : 4; /* ! Unique identifier */
 	IEEEtypes_WMM_TSPEC_TS_Info_Direction_e Direction : 2;
 	t_u8 AccessPolicy1 : 1; /* ! */
 	t_u8 AccessPolicy2 : 1; /* ! */
 	t_u8 Aggregation : 1; /* ! Reserved */
-	IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /* !
-								    Legacy/Trigg
-								  */
+	// IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /* !
+	// Legacy/Trigg*/
+	t_u8 PowerSaveBehavior : 1;
 	t_u8 UserPri : 3; /* ! 802.1d User Priority */
 	IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e AckPolicy : 2;
 	t_u8 Schedule : 1;
@@ -938,6 +941,20 @@ typedef MLAN_PACK_START struct _IEEEtypes_CountryInfoFullSet_t {
 
 #endif /* STA_SUPPORT */
 
+/** Data structure for Link ID */
+typedef MLAN_PACK_START struct _IEEEtypes_LinkIDElement_t {
+	/** Element ID */
+	t_u8 element_id;
+	/** Length */
+	t_u8 len;
+	/** bssid */
+	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
+	/** initial sta address */
+	t_u8 init_sta[MLAN_MAC_ADDR_LENGTH];
+	/** respose sta address */
+	t_u8 resp_sta[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END IEEEtypes_LinkIDElement_t, *pIEEEtypes_LinkIDElement_t;
+
 /** HT Capabilities Data */
 typedef struct MLAN_PACK_START _HTCap_t {
 	/** HT Capabilities Info field */
@@ -1025,6 +1042,53 @@ typedef MLAN_PACK_START struct _IEEEtypes_HTInfo_t {
 	HTInfo_t ht_info;
 } MLAN_PACK_END IEEEtypes_HTInfo_t, *pIEEEtypes_HTInfo_t;
 
+/** the AP which send the multi_bssid IE */
+#define MULTI_BSSID_AP 1
+/** the AP which don't send beacon */
+#define MULTI_BSSID_SUB_AP 2
+/** IEEEtypes_NotxBssCap_t */
+typedef MLAN_PACK_START struct _IEEEtypes_NotxBssCap_t {
+	/** Nontransmitted BSSID Capability: Element ID */
+	t_u8 element_id;
+	/** Nontransmitted BSSID Capability : Length */
+	t_u8 len;
+	/** capability */
+	t_u16 cap;
+} MLAN_PACK_END IEEEtypes_NotxBssCap_t, *pIEEEtypes_NotxBssCap_t;
+
+/** Multi BSSID IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MultiBSSIDIndex_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** BSSID Index */
+	t_u8 bssid_index;
+	/** DTIM Period (Optional, not Present in ProbeRsp) */
+	t_u8 dtim_period;
+	/** DTIM Count (Optional, not Present in ProbeRsp) */
+	t_u8 dtim_count;
+} MLAN_PACK_END IEEEtypes_MultiBSSIDIndex_t, *pIEEEtypes_MultiBSSIDIndex_t;
+
+/** NonTransmitted BSSID Profile Subelement IE */
+/** SUBID for IEEEtypes_NonTransBSSIDCap_t */
+#define NONTRANS_BSSID_PROFILE_SUBELEM_ID 0
+
+/** NonTransmitted BSSID Capability IE */
+typedef MLAN_PACK_START struct _IEEEtypes_NonTransBSSIDProfile_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	t_u8 profile_data[];
+} MLAN_PACK_END IEEEtypes_NonTransBSSIDProfile_t,
+	*pIEEEtypes_NonTransBSSIDProfile_t;
+
+/** Multi BSSID IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MultiBSSID_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Max BSSID Indicator */
+	t_u8 max_bssid_indicator;
+	/** Optional Subelement data*/
+	t_u8 sub_elem_data[];
+} MLAN_PACK_END IEEEtypes_MultiBSSID_t, *pIEEEtypes_MultiBSSID_t;
 /** 20/40 BSS Coexistence IE */
 typedef MLAN_PACK_START struct _IEEEtypes_2040BSSCo_t {
 	/** Generic IE header */
@@ -1221,6 +1285,40 @@ typedef MLAN_PACK_START struct _IEEEtypes_HECap_t {
 	/** PPE Thresholds (optional) */
 } MLAN_PACK_END IEEEtypes_HECap_t, *pIEEEtypes_HECap_t;
 
+/** default channel switch count */
+#define DEF_CHAN_SWITCH_COUNT 5
+
+/*  IEEE Channel Switch Announcement Element (7.3.2.20) */
+/**
+ *  Provided in beacons and probe responses.  Used to advertise when
+ *    and to which channel it is changing to.  Only starting STAs in
+ *    an IBSS and APs are allowed to originate a chan switch element.
+ */
+typedef MLAN_PACK_START struct {
+	t_u8 element_id; /**< IEEE Element ID = 37 */
+	t_u8 len; /**< Element length after id and len */
+	t_u8 chan_switch_mode; /**< STA should not transmit any frames if 1 */
+	t_u8 new_channel_num; /**< Channel # that AP/IBSS is moving to */
+	t_u8 chan_switch_count; /**< # of TBTTs before channel switch */
+
+} MLAN_PACK_END IEEEtypes_ChanSwitchAnn_t;
+
+/** data structure for extended channel switch */
+typedef MLAN_PACK_START struct {
+	/** IEEE element ID = 60 */
+	t_u8 element_id;
+	/** Element length after id and len, set to 4 */
+	t_u8 len;
+	/** STA should not transmit any frames if 1 */
+	t_u8 chan_switch_mode;
+	/** Operate class # that AP/IBSS is moving to */
+	t_u8 new_oper_class;
+	/** Channel # that AP/IBSS is moving to */
+	t_u8 new_channel_num;
+	/** of TBTTs before channel switch */
+	t_u8 chan_switch_count;
+} MLAN_PACK_END IEEEtypes_ExtChanSwitchAnn_t;
+
 /** Maximum number of subbands in the IEEEtypes_SupportedChannels_t structure */
 #define WLAN_11H_MAX_SUBBANDS 5
 
@@ -1276,40 +1374,6 @@ typedef MLAN_PACK_START struct {
 
 } MLAN_PACK_END IEEEtypes_SupportedChannels_t;
 
-/** default channel switch count */
-#define DEF_CHAN_SWITCH_COUNT 5
-
-/*  IEEE Channel Switch Announcement Element (7.3.2.20) */
-/**
- *  Provided in beacons and probe responses.  Used to advertise when
- *    and to which channel it is changing to.  Only starting STAs in
- *    an IBSS and APs are allowed to originate a chan switch element.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 37 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 chan_switch_mode; /**< STA should not transmit any frames if 1 */
-	t_u8 new_channel_num; /**< Channel # that AP/IBSS is moving to */
-	t_u8 chan_switch_count; /**< # of TBTTs before channel switch */
-
-} MLAN_PACK_END IEEEtypes_ChanSwitchAnn_t;
-
-/** data structure for extended channel switch */
-typedef MLAN_PACK_START struct {
-	/** IEEE element ID = 60 */
-	t_u8 element_id;
-	/** Element length after id and len, set to 4 */
-	t_u8 len;
-	/** STA should not transmit any frames if 1 */
-	t_u8 chan_switch_mode;
-	/** Operate class # that AP/IBSS is moving to */
-	t_u8 new_oper_class;
-	/** Channel # that AP/IBSS is moving to */
-	t_u8 new_channel_num;
-	/** of TBTTs before channel switch */
-	t_u8 chan_switch_count;
-} MLAN_PACK_END IEEEtypes_ExtChanSwitchAnn_t;
-
 /*  IEEE Wide Bandwidth Channel Switch Element */
 /**
  *  Provided in beacons and probe responses.  Used to advertise when
@@ -1444,6 +1508,50 @@ typedef struct {
 
 } wlan_11h_bss_info_t;
 
+/** Ethernet packet type for TDLS */
+#define MLAN_ETHER_PKT_TYPE_TDLS_ACTION (0x890D)
+
+/*802.11z  TDLS action frame type and strcuct */
+typedef MLAN_PACK_START struct {
+	/*link indentifier ie =101*/
+	t_u8 element_id;
+	/*len = 18*/
+	t_u8 len;
+	/** bssid */
+	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
+	/** init sta mac address */
+	t_u8 init_sta[MLAN_MAC_ADDR_LENGTH];
+	/** resp sta mac address */
+	t_u8 resp_sta[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END IEEEtypes_tdls_linkie;
+
+/** action code for tdls setup request */
+#define TDLS_SETUP_REQUEST 0
+/** action code for tdls setup response */
+#define TDLS_SETUP_RESPONSE 1
+/** action code for tdls setup confirm */
+#define TDLS_SETUP_CONFIRM 2
+/** action code for tdls tear down */
+#define TDLS_TEARDOWN 3
+/** action code for tdls traffic indication */
+#define TDLS_PEER_TRAFFIC_INDICATION 4
+/** action code for tdls channel switch request */
+#define TDLS_CHANNEL_SWITCH_REQUEST 5
+/** action code for tdls channel switch response */
+#define TDLS_CHANNEL_SWITCH_RESPONSE 6
+/** action code for tdls psm request */
+#define TDLS_PEER_PSM_REQUEST 7
+/** action code for tdls psm response */
+#define TDLS_PEER_PSM_RESPONSE 8
+/** action code for tdls traffic response */
+#define TDLS_PEER_TRAFFIC_RESPONSE 9
+/** action code for tdls discovery request */
+#define TDLS_DISCOVERY_REQUEST 10
+/** action code for TDLS discovery response */
+#define TDLS_DISCOVERY_RESPONSE 14
+/** category public */
+#define CATEGORY_PUBLIC 4
+
 /** action code for 20/40 BSS Coexsitence Management frame */
 #define BSS_20_40_COEX 0
 
@@ -1799,6 +1907,10 @@ typedef struct _BSSDescriptor_t {
 	IEEEtypes_HTInfo_t *pht_info;
 	/** HT Information Offset */
 	t_u16 ht_info_offset;
+	/** Flag to indicate this is multi_bssid_ap */
+	t_u8 multi_bssid_ap;
+	/** the mac address of multi-bssid AP */
+	mlan_802_11_mac_addr multi_bssid_ap_addr;
 	/** 20/40 BSS Coexistence IE */
 	IEEEtypes_2040BSSCo_t *pbss_co_2040;
 	/** 20/40 BSS Coexistence Offset */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_init.c b/mxm_wifiex/wlan_src/mlan/mlan_init.c
index 5dd92ad..16a3cd7 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_init.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_init.c
@@ -4,7 +4,7 @@
  *  and HW.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -53,7 +53,7 @@ Change log:
 /********************************************************
 			Global Variables
 ********************************************************/
-extern pmlan_operations mlan_ops[];
+
 /*******************************************************
 			Local Functions
 ********************************************************/
@@ -255,8 +255,8 @@ mlan_status wlan_allocate_adapter(pmlan_adapter pmadapter)
 #ifdef SDIO
 	if (IS_SD(pmadapter->card_type)) {
 		max_mp_regs = pmadapter->pcard_sd->reg->max_mp_regs;
-		mp_tx_aggr_buf_size = SDIO_MP_AGGR_BUF_SIZE_MAX;
-		mp_rx_aggr_buf_size = SDIO_MP_AGGR_BUF_SIZE_MAX;
+		mp_tx_aggr_buf_size = pmadapter->pcard_sd->mp_tx_aggr_buf_size;
+		mp_rx_aggr_buf_size = pmadapter->pcard_sd->mp_rx_aggr_buf_size;
 	}
 #endif
 
@@ -362,7 +362,8 @@ mlan_status wlan_allocate_adapter(pmlan_adapter pmadapter)
 #ifdef DEBUG_LEVEL1
 		if (mlan_drvdbg & MMPA_D) {
 			pmadapter->pcard_sd->mpa_buf_size =
-				SDIO_MP_DBG_NUM * SDIO_MP_AGGR_DEF_PKT_LIMIT *
+				SDIO_MP_DBG_NUM *
+				pmadapter->pcard_sd->mp_aggr_pkt_limit *
 				MLAN_SDIO_BLOCK_SIZE;
 			if (pmadapter->callbacks.moal_vmalloc &&
 			    pmadapter->callbacks.moal_vfree)
@@ -521,12 +522,21 @@ mlan_status wlan_init_priv(pmlan_private priv)
 	priv->wmm_required = MTRUE;
 	priv->wmm_enabled = MFALSE;
 	priv->wmm_qosinfo = 0;
+	priv->saved_wmm_qosinfo = 0;
+	priv->host_tdls_cs_support = MTRUE;
+	priv->host_tdls_uapsd_support = MTRUE;
+	priv->tdls_cs_channel = 0;
+	priv->supp_regulatory_class_len = 0;
+	priv->chan_supp_len = 0;
+	priv->tdls_idle_time = TDLS_IDLE_TIMEOUT;
+	priv->txaggrctrl = MTRUE;
 #ifdef STA_SUPPORT
 	priv->pcurr_bcn_buf = MNULL;
 	priv->curr_bcn_size = 0;
 	memset(pmadapter, &priv->ext_cap, 0, sizeof(priv->ext_cap));
 
 	SET_EXTCAP_OPERMODENTF(priv->ext_cap);
+	SET_EXTCAP_TDLS(priv->ext_cap);
 	SET_EXTCAP_QOS_MAP(priv->ext_cap);
 	/* Save default Extended Capability */
 	memcpy_ext(priv->adapter, &priv->def_ext_cap, &priv->ext_cap,
@@ -626,8 +636,10 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 		pmadapter->data_sent = MTRUE;
 		pmadapter->pcard_sd->mp_rd_bitmap = 0;
 		pmadapter->pcard_sd->mp_wr_bitmap = 0;
-		pmadapter->pcard_sd->curr_rd_port = 0;
-		pmadapter->pcard_sd->curr_wr_port = 0;
+		pmadapter->pcard_sd->curr_rd_port =
+			pmadapter->pcard_sd->reg->start_rd_port;
+		pmadapter->pcard_sd->curr_wr_port =
+			pmadapter->pcard_sd->reg->start_wr_port;
 		pmadapter->pcard_sd->mp_data_port_mask =
 			pmadapter->pcard_sd->reg->data_port_mask;
 		pmadapter->pcard_sd->mp_invalid_update = 0;
@@ -635,7 +647,8 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 		       sizeof(pmadapter->pcard_sd->mp_update));
 		pmadapter->pcard_sd->mpa_tx.buf_len = 0;
 		pmadapter->pcard_sd->mpa_tx.pkt_cnt = 0;
-		pmadapter->pcard_sd->mpa_tx.start_port = 0;
+		pmadapter->pcard_sd->mpa_tx.start_port =
+			pmadapter->pcard_sd->reg->start_wr_port;
 
 		if (!pmadapter->init_para.mpa_tx_cfg)
 			pmadapter->pcard_sd->mpa_tx.enabled = MFALSE;
@@ -645,11 +658,12 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 		else
 			pmadapter->pcard_sd->mpa_tx.enabled = MTRUE;
 		pmadapter->pcard_sd->mpa_tx.pkt_aggr_limit =
-			SDIO_MP_AGGR_DEF_PKT_LIMIT;
+			pmadapter->pcard_sd->mp_aggr_pkt_limit;
 
 		pmadapter->pcard_sd->mpa_rx.buf_len = 0;
 		pmadapter->pcard_sd->mpa_rx.pkt_cnt = 0;
-		pmadapter->pcard_sd->mpa_rx.start_port = 0;
+		pmadapter->pcard_sd->mpa_rx.start_port =
+			pmadapter->pcard_sd->reg->start_rd_port;
 
 		if (!pmadapter->init_para.mpa_rx_cfg)
 			pmadapter->pcard_sd->mpa_rx.enabled = MFALSE;
@@ -659,7 +673,7 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 		else
 			pmadapter->pcard_sd->mpa_rx.enabled = MTRUE;
 		pmadapter->pcard_sd->mpa_rx.pkt_aggr_limit =
-			SDIO_MP_AGGR_DEF_PKT_LIMIT;
+			pmadapter->pcard_sd->mp_aggr_pkt_limit;
 	}
 #endif
 
@@ -807,6 +821,7 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 	pmadapter->coex_rx_winsize = 1;
 #ifdef STA_SUPPORT
 	pmadapter->chan_bandwidth = 0;
+	pmadapter->tdls_status = TDLS_NOT_SETUP;
 #endif /* STA_SUPPORT */
 
 	pmadapter->min_ba_threshold = MIN_BA_THRESHOLD;
@@ -847,6 +862,8 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 	       sizeof(pmadapter->sleep_params));
 	memset(pmadapter, &pmadapter->sleep_period, 0,
 	       sizeof(pmadapter->sleep_period));
+	memset(pmadapter, &pmadapter->saved_sleep_period, 0,
+	       sizeof(pmadapter->saved_sleep_period));
 	pmadapter->tx_lock_flag = MFALSE;
 	pmadapter->null_pkt_interval = 0;
 	pmadapter->fw_bands = 0;
@@ -884,7 +901,8 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 #endif
 #if defined(PCIE9098) || defined(PCIE9097)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
-			pmadapter->pcard_pcie->rxbd_wrptr = MLAN_MAX_TXRX_BD;
+			pmadapter->pcard_pcie->rxbd_wrptr =
+				pmadapter->pcard_pcie->reg->txrx_bd_size;
 			pmadapter->pcard_pcie->evtbd_wrptr = MLAN_MAX_EVT_BD;
 		}
 #endif
@@ -975,6 +993,11 @@ mlan_status wlan_init_priv_lock_list(pmlan_adapter pmadapter, t_u8 start_index)
 				(t_void *)pmadapter->pmoal_handle,
 				&priv->sta_list, MTRUE,
 				pmadapter->callbacks.moal_init_lock);
+			/* Initialize tdls_pending_txq */
+			util_init_list_head(
+				(t_void *)pmadapter->pmoal_handle,
+				&priv->tdls_pending_txq, MTRUE,
+				pmadapter->callbacks.moal_init_lock);
 			/* Initialize bypass_txq */
 			util_init_list_head(
 				(t_void *)pmadapter->pmoal_handle,
@@ -1181,6 +1204,10 @@ t_void wlan_free_lock_list(pmlan_adapter pmadapter)
 				(t_void *)pmadapter->pmoal_handle,
 				&priv->sta_list,
 				priv->adapter->callbacks.moal_free_lock);
+			util_free_list_head(
+				(t_void *)pmadapter->pmoal_handle,
+				&priv->tdls_pending_txq,
+				pmadapter->callbacks.moal_free_lock);
 			util_free_list_head(
 				(t_void *)pmadapter->pmoal_handle,
 				&priv->bypass_txq,
@@ -1371,7 +1398,7 @@ done:
  *  @return		MLAN_STATUS_SUCCESS, MLAN_STATUS_PENDING or
  * MLAN_STATUS_FAILURE
  */
-void wlan_update_hw_spec(pmlan_adapter pmadapter)
+static void wlan_update_hw_spec(pmlan_adapter pmadapter)
 {
 	t_u32 i;
 
@@ -1501,7 +1528,7 @@ void wlan_update_hw_spec(pmlan_adapter pmadapter)
  *  @return		MLAN_STATUS_SUCCESS, MLAN_STATUS_PENDING or
  * MLAN_STATUS_FAILURE
  */
-mlan_status wlan_init_priv_fw(pmlan_adapter pmadapter)
+static mlan_status wlan_init_priv_fw(pmlan_adapter pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_private priv = MNULL;
@@ -1757,7 +1784,7 @@ t_void wlan_free_priv(mlan_private *pmpriv)
  *
  *  @return             N/A
  */
-mlan_status wlan_init_interface(pmlan_adapter pmadapter)
+static mlan_status wlan_init_interface(pmlan_adapter pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = MNULL;
@@ -1874,6 +1901,7 @@ mlan_status wlan_get_hw_spec_complete(pmlan_adapter pmadapter)
 		else {
 			memset(pmadapter, &info, 0, sizeof(info));
 			info.fw_cap = pmadapter->fw_cap_info;
+			info.fw_cap_ext = pmadapter->fw_cap_ext;
 			memset(pmadapter, &bss_tbl, 0, sizeof(bss_tbl));
 			memcpy_ext(pmadapter, bss_tbl.bss_attr,
 				   pmadapter->bss_attr, sizeof(mlan_bss_tbl),
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
index 1f03bdc..29a8c02 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
@@ -3,7 +3,7 @@
  *  @brief This file declares the IOCTL data structures and APIs.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -198,6 +198,7 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_11N_CFG_DELBA = 0x000C000C,
 	MLAN_OID_11N_CFG_REJECT_ADDBA_REQ = 0x000C000D,
 	MLAN_OID_11N_CFG_COEX_RX_WINSIZE = 0x000C000E,
+	MLAN_OID_11N_CFG_TX_AGGR_CTRL = 0x000C000F,
 	MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM = 0x000C0010,
 	MLAN_OID_11N_CFG_MIN_BA_THRESHOLD = 0x000C0011,
 
@@ -257,6 +258,7 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_MISC_ASSOC_RSP = 0x0020000C,
 	MLAN_OID_MISC_INIT_SHUTDOWN = 0x0020000D,
 	MLAN_OID_MISC_CUSTOM_IE = 0x0020000F,
+	MLAN_OID_MISC_TDLS_CONFIG = 0x00200010,
 	MLAN_OID_MISC_TX_DATAPAUSE = 0x00200012,
 	MLAN_OID_MISC_IP_ADDR = 0x00200013,
 	MLAN_OID_MISC_MAC_CONTROL = 0x00200014,
@@ -284,13 +286,17 @@ enum _mlan_ioctl_req_id {
 #ifdef WIFI_DIRECT_SUPPORT
 	MLAN_OID_MISC_WIFI_DIRECT_CONFIG = 0x00200025,
 #endif
+	MLAN_OID_MISC_TDLS_OPER = 0x00200026,
+	MLAN_OID_MISC_GET_TDLS_IES = 0x00200027,
 	MLAN_OID_MISC_LOW_PWR_MODE = 0x00200029,
 	MLAN_OID_MISC_MEF_FLT_CFG = 0x0020002A,
 	MLAN_OID_MISC_DFS_REAPTER_MODE = 0x0020002B,
 #ifdef RX_PACKET_COALESCE
 	MLAN_OID_MISC_RX_PACKET_COALESCE = 0x0020002C,
 #endif
+	MLAN_OID_MISC_TDLS_CS_CHANNEL = 0x0020002D,
 	MLAN_OID_MISC_COALESCE_CFG = 0x0020002E,
+	MLAN_OID_MISC_TDLS_IDLE_TIME = 0x0020002F,
 	MLAN_OID_MISC_GET_SENSOR_TEMP = 0x00200030,
 	MLAN_OID_MISC_GTK_REKEY_OFFLOAD = 0x00200037,
 	MLAN_OID_MISC_OPER_CLASS = 0x00200038,
@@ -332,6 +338,8 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_MISC_RANGE_EXT = 0x0020007B,
 	MLAN_OID_MISC_DOT11MC_UNASSOC_FTM_CFG = 0x0020007C,
 	MLAN_OID_MISC_TP_STATE = 0x0020007D,
+	MLAN_OID_MISC_HAL_PHY_CFG = 0x0020007E,
+	MLAN_OID_MISC_RF_TEST_HE_POWER = 0X0020007F,
 };
 
 /** Sub command size */
@@ -1618,6 +1626,14 @@ typedef struct _mlan_ds_get_stats {
 	t_u32 channel_number;
 	/** Channel Switch Mode */
 	t_u32 channel_switch_mode;
+	/** Reset Rx Mac Count */
+	t_u32 rx_reset_mac_recovery_cnt;
+	/** ISR2 Not Done Count*/
+	t_u32 rx_Isr2_NotDone_Cnt;
+	/** GDMA Abort Count */
+	t_u32 gdma_abort_cnt;
+	/** Rx Reset MAC Count */
+	t_u32 g_reset_rx_mac_cnt;
 } mlan_ds_get_stats, *pmlan_ds_get_stats;
 
 /** Type definition of mlan_ds_uap_stats for MLAN_OID_GET_STATS */
@@ -2087,13 +2103,27 @@ typedef struct {
 #define SDIO_MP_DBG_NUM 10
 #endif
 
-#ifdef PCIE
-#define MLAN_MAX_TXRX_BD 0x20
-#endif
-
 /** Maximum size of IEEE Information Elements */
 #define IEEE_MAX_IE_SIZE 256
 
+/** support up to 8 TDLS peer */
+#define MLAN_MAX_TDLS_PEER_SUPPORTED 8
+/** TDLS peer info */
+typedef struct _tdls_peer_info {
+	/** station mac address */
+	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
+	/** SNR */
+	t_s8 snr;
+	/** Noise Floor */
+	t_s8 nf;
+	/** Extended Capabilities IE */
+	t_u8 ext_cap[IEEE_MAX_IE_SIZE];
+	/** HT Capabilities IE */
+	t_u8 ht_cap[IEEE_MAX_IE_SIZE];
+	/** VHT Capabilities IE */
+	t_u8 vht_cap[IEEE_MAX_IE_SIZE];
+} tdls_peer_info;
+
 /** max ralist num */
 #define MLAN_MAX_RALIST_NUM 8
 /** ralist info */
@@ -2132,6 +2162,10 @@ typedef struct _mlan_debug_info {
 	t_u32 rx_tbl_num;
 	/** Rx reorder table*/
 	rx_reorder_tbl rx_tbl[MLAN_MAX_RX_BASTREAM_SUPPORTED];
+	/** TDLS peer number */
+	t_u32 tdls_peer_num;
+	/** TDLS peer list*/
+	tdls_peer_info tdls_peer_list[MLAN_MAX_TDLS_PEER_SUPPORTED];
 	/** ralist num */
 	t_u32 ralist_num;
 	/** ralist info */
@@ -2281,6 +2315,8 @@ typedef struct _mlan_debug_info {
 	t_u32 dnld_cmd_in_secs;
 	/** Corresponds to data_sent member of mlan_adapter */
 	t_u8 data_sent;
+	/** Corresponds to data_sent_cnt member of mlan_adapter */
+	t_u32 data_sent_cnt;
 	/** Corresponds to cmd_sent member of mlan_adapter */
 	t_u8 cmd_sent;
 	/** SDIO multiple port read bitmap */
@@ -2304,8 +2340,8 @@ typedef struct _mlan_debug_info {
 	t_u32 eventbd_rdptr;
 	/** PCIE eventbd write pointer */
 	t_u32 eventbd_wrptr;
-	/** Last pkt size in transmit */
-	t_u32 last_tx_pkt_size[MLAN_MAX_TXRX_BD];
+	/** txrx_bd_size */
+	t_u16 txrx_bd_size;
 	/** txbd ring vbase */
 	t_u8 *txbd_ring_vbase;
 	/** txbd ring size */
@@ -2350,7 +2386,7 @@ typedef struct _mlan_debug_info {
 #define MAX_NUM_CLIENTS MAX_STA_COUNT
 
 /** station info */
-typedef struct _sta_info {
+typedef struct _sta_info_data {
 	/** STA MAC address */
 	t_u8 mac_address[MLAN_MAC_ADDR_LENGTH];
 	/** Power mgmt status */
@@ -2365,14 +2401,14 @@ typedef struct _sta_info {
 	t_u16 ie_len;
 	/** ie buffer */
 	t_u8 ie_buf[];
-} sta_info;
+} sta_info_data;
 
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
 typedef struct _mlan_ds_sta_list {
 	/** station count */
 	t_u16 sta_count;
 	/** station list */
-	sta_info info[MAX_NUM_CLIENTS];
+	sta_info_data info[MAX_NUM_CLIENTS];
 } mlan_ds_sta_list, *pmlan_ds_sta_list;
 #endif
 
@@ -3681,6 +3717,8 @@ typedef struct _mlan_ds_11n_cfg {
 		mlan_ds_reject_addba_req reject_addba_req;
 		/** Control coex RX window size configuration */
 		t_u32 coex_rx_winsize;
+		/** Control TX AMPDU configuration */
+		t_u32 txaggrctrl;
 		/** aggrprirotity table for MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM */
 		mlan_ds_ibss_ampdu_param ibss_ampdu;
 		/** Minimum BA Threshold for MLAN_OID_11N_CFG_MIN_BA_THRESHOLD
@@ -4519,7 +4557,7 @@ typedef struct _mlan_ds_misc_otp_user_data {
 	t_u8 user_data[MAX_OTP_USER_DATA_LEN];
 } mlan_ds_misc_otp_user_data;
 
-typedef struct _aggr_ctrl {
+typedef struct _aggr_ctrl_cfg {
 	/** Enable */
 	t_u16 enable;
 	/** Aggregation alignment */
@@ -4530,18 +4568,18 @@ typedef struct _aggr_ctrl {
 	t_u16 aggr_max_num;
 	/** Aggrgation timeout, in microseconds */
 	t_u16 aggr_tmo;
-} aggr_ctrl;
+} aggr_ctrl_cfg;
 
 /** Type definition of mlan_ds_misc_aggr_ctrl
  *  for MLAN_OID_MISC_AGGR_CTRL
  */
 typedef struct _mlan_ds_misc_aggr_ctrl {
 	/** Tx aggregation control */
-	aggr_ctrl tx;
+	aggr_ctrl_cfg tx;
 } mlan_ds_misc_aggr_ctrl;
 
 #ifdef USB
-typedef struct _usb_aggr_ctrl {
+typedef struct _usb_aggr_ctrl_cfg {
 	/** Enable */
 	t_u16 enable;
 	/** Aggregation mode */
@@ -4552,16 +4590,16 @@ typedef struct _usb_aggr_ctrl {
 	t_u16 aggr_max;
 	/** Aggrgation timeout, in microseconds */
 	t_u16 aggr_tmo;
-} usb_aggr_ctrl;
+} usb_aggr_ctrl_cfg;
 
 /** Type definition of mlan_ds_misc_usb_aggr_ctrl
  *  for MLAN_OID_MISC_USB_AGGR_CTRL
  */
 typedef struct _mlan_ds_misc_usb_aggr_ctrl {
 	/** Tx aggregation control */
-	usb_aggr_ctrl tx_aggr_ctrl;
+	usb_aggr_ctrl_cfg tx_aggr_ctrl;
 	/** Rx deaggregation control */
-	usb_aggr_ctrl rx_deaggr_ctrl;
+	usb_aggr_ctrl_cfg rx_deaggr_ctrl;
 } mlan_ds_misc_usb_aggr_ctrl;
 #endif
 
@@ -4605,6 +4643,85 @@ typedef struct _mlan_ds_misc_pmfcfg {
 #define MAX_SSID_NUM 16
 #define MAX_AP_LIST 8
 
+/**Action ID for TDLS disable link*/
+#define WLAN_TDLS_DISABLE_LINK 0x00
+/**Action ID for TDLS enable link*/
+#define WLAN_TDLS_ENABLE_LINK 0x01
+/**Action ID for TDLS create link*/
+#define WLAN_TDLS_CREATE_LINK 0x02
+/**Action ID for TDLS config link*/
+#define WLAN_TDLS_CONFIG_LINK 0x03
+/*reason code*/
+#define MLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED 26
+/** TDLS operation buffer */
+typedef struct _mlan_ds_misc_tdls_oper {
+	/** TDLS Action */
+	t_u16 tdls_action;
+	/** TDLS peer address */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+	/** peer capability */
+	t_u16 capability;
+	/** peer qos info */
+	t_u8 qos_info;
+	/** peer extend capability */
+	t_u8 *ext_capab;
+	/** extend capability len */
+	t_u8 ext_capab_len;
+	/** support rates */
+	t_u8 *supported_rates;
+	/** supported rates len */
+	t_u8 supported_rates_len;
+	/** peer ht_cap */
+	t_u8 *ht_capa;
+	/** peer vht capability */
+	t_u8 *vht_cap;
+} mlan_ds_misc_tdls_oper;
+
+/** flag for TDLS extcap */
+#define TDLS_IE_FLAGS_EXTCAP 0x0001
+/** flag for TDLS HTCAP */
+#define TDLS_IE_FLAGS_HTCAP 0x0002
+/** flag for TDLS HTINFO */
+#define TDLS_IE_FLAGS_HTINFO 0x0004
+/** flag for TDLS VHTCAP */
+#define TDLS_IE_FLAGS_VHTCAP 0x0008
+/** flag for TDLS VHTOPRAT */
+#define TDLS_IE_FLAGS_VHTOPRAT 0x0010
+/** flag for TDLS AID inof */
+#define TDLS_IE_FLAGS_AID 0x0020
+/** flag for TDLS Supported channels and regulatory class IE*/
+#define TDLS_IE_FLAGS_SUPP_CS_IE 0x0040
+/** flag for TDLS Qos info */
+#define TDLS_IE_FLAGS_QOS_INFO 0x0080
+/** flag for TDLS SETUP */
+#define TDLS_IE_FLAGS_SETUP 0x0100
+
+/** TDLS ie buffer */
+typedef struct _mlan_ds_misc_tdls_ies {
+	/** TDLS peer address */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+	/** flags for request IEs */
+	t_u16 flags;
+	/** Qos info */
+	t_u8 QosInfo;
+	/** Extended Capabilities IE */
+	t_u8 ext_cap[IEEE_MAX_IE_SIZE];
+	/** HT Capabilities IE */
+	t_u8 ht_cap[IEEE_MAX_IE_SIZE];
+	/** HT Information IE */
+	t_u8 ht_info[IEEE_MAX_IE_SIZE];
+	/** VHT Capabilities IE */
+	t_u8 vht_cap[IEEE_MAX_IE_SIZE];
+	/** VHT Operations IE */
+	t_u8 vht_oprat[IEEE_MAX_IE_SIZE];
+	/** aid Info */
+	t_u8 aid_info[IEEE_MAX_IE_SIZE];
+	/** supported channels */
+	t_u8 supp_chan[IEEE_MAX_IE_SIZE];
+	/** supported regulatory class */
+	t_u8 regulatory_class[IEEE_MAX_IE_SIZE];
+} mlan_ds_misc_tdls_ies;
+
 #ifdef RX_PACKET_COALESCE
 typedef struct _mlan_ds_misc_rx_packet_coalesce {
 	/** packet threshold */
@@ -4855,6 +4972,13 @@ typedef struct _mlan_ds_ssu_params {
 } mlan_ds_ssu_params;
 #endif
 
+typedef MLAN_PACK_START struct _mlan_ds_hal_phy_cfg_params {
+	/** 11b pwr spectral density mask enable/disable */
+	t_u8 dot11b_psd_mask_cfg;
+	/** reserved fields for future hal/phy cfg use */
+	t_u8 reserved[7];
+} MLAN_PACK_END mlan_ds_hal_phy_cfg_params;
+
 #define MAX_NUM_MAC 2
 /** Type definition of mlan_ds_misc_mapping_policy */
 typedef struct _mlan_ds_misc_mapping_policy {
@@ -4914,6 +5038,8 @@ typedef struct _mlan_ds_misc_chan_trpc_cfg {
 #define MFG_CMD_RFPWR 0x1033
 #define MFG_CMD_RF_BAND_AG 0x1034
 #define MFG_CMD_RF_CHANNELBW 0x1044
+#define MFG_CMD_RADIO_MODE_CFG 0x1211
+#define MFG_CMD_CONFIG_MAC_HE_TB_TX 0x110A
 /** MFG CMD generic cfg */
 struct MLAN_PACK_START mfg_cmd_generic_cfg {
 	/** MFG command code */
@@ -4972,6 +5098,21 @@ struct MLAN_PACK_START mfg_cmd_tx_frame2 {
 	t_u32 stbc;
 	/** power id */
 	t_u32 rsvd[2];
+	/** NumPkt */
+	t_u32 NumPkt;
+	/** MaxPE */
+	t_u32 MaxPE;
+	/** BeamChange */
+	t_u32 BeamChange;
+	/** Dcm */
+	t_u32 Dcm;
+	/** Doppler */
+	t_u32 Doppler;
+	/** MidP */
+	t_u32 MidP;
+	/** QNum */
+	t_u32 QNum;
+
 } MLAN_PACK_END;
 
 /* MFG CMD Tx Continuous */
@@ -5000,6 +5141,27 @@ struct MLAN_PACK_START mfg_cmd_tx_cont {
 	t_u32 rsvd;
 } MLAN_PACK_END;
 
+struct MLAN_PACK_START mfg_Cmd_HE_TBTx_t {
+	/** MFG command code */
+	t_u32 mfg_cmd;
+	/** Action */
+	t_u16 action;
+	/** Device ID */
+	t_u16 device_id;
+	/** MFG Error code */
+	t_u32 error;
+	/** Enable Tx */
+	t_u16 enable;
+	/** Q num */
+	t_u16 qnum;
+	/** AID */
+	t_u16 aid;
+	/** AXQ Mu Timer */
+	t_u16 axq_mu_timer;
+	/** Tx Power */
+	t_u16 tx_power;
+} MLAN_PACK_END;
+
 typedef struct _mlan_ds_misc_chnrgpwr_cfg {
 	/** length */
 	t_u16 length;
@@ -5043,8 +5205,17 @@ typedef struct _mlan_ds_misc_cfg {
 		t_u32 func_init_shutdown;
 		/** Custom IE for MLAN_OID_MISC_CUSTOM_IE */
 		mlan_ds_misc_custom_ie cust_ie;
+		t_u16 tdls_idle_time;
 		/** Config dynamic bandwidth*/
 		t_u16 dyn_bw;
+		/** TDLS configuration for MLAN_OID_MISC_TDLS_CONFIG */
+		mlan_ds_misc_tdls_config tdls_config;
+		/** TDLS operation for MLAN_OID_MISC_TDLS_OPER */
+		mlan_ds_misc_tdls_oper tdls_oper;
+		/** TDLS ies for  MLAN_OID_MISC_GET_TDLS_IES */
+		mlan_ds_misc_tdls_ies tdls_ies;
+		/**tdls cs off channel*/
+		t_u8 tdls_cs_channel;
 		/** Tx data pause for MLAN_OID_MISC_TX_DATAPAUSE */
 		mlan_ds_misc_tx_datapause tx_datapause;
 		/** IP address configuration */
@@ -5131,11 +5302,13 @@ typedef struct _mlan_ds_misc_cfg {
 		struct mfg_cmd_generic_cfg mfg_generic_cfg;
 		struct mfg_cmd_tx_cont mfg_tx_cont;
 		struct mfg_cmd_tx_frame2 mfg_tx_frame2;
+		struct mfg_Cmd_HE_TBTx_t mfg_he_power;
 		mlan_ds_misc_arb_cfg arb_cfg;
 		mlan_ds_misc_cfp_tbl cfp;
 		t_u8 range_ext_mode;
 		mlan_ds_misc_dot11mc_unassoc_ftm_cfg dot11mc_unassoc_ftm_cfg;
 		mlan_ds_misc_tp_state tp_state;
+		mlan_ds_hal_phy_cfg_params hal_phy_cfg_params;
 	} param;
 } mlan_ds_misc_cfg, *pmlan_ds_misc_cfg;
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_join.c b/mxm_wifiex/wlan_src/mlan/mlan_join.c
index f239c9f..36d099a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_join.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_join.c
@@ -7,7 +7,7 @@
  *  to the firmware.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -555,7 +555,7 @@ static int wlan_cmd_append_osen_ie(mlan_private *priv, t_u8 **ppbuffer)
  *  @param data         A pointer to rsn_ie data after IE header
  *  @param return       rsn_cap
  */
-t_u16 wlan_get_rsn_cap(t_u8 *data)
+static t_u16 wlan_get_rsn_cap(t_u8 *data)
 {
 	t_u16 rsn_cap = 0;
 	t_u16 *ptr;
@@ -589,7 +589,7 @@ t_u16 wlan_get_rsn_cap(t_u8 *data)
  *  @param BSSDescriptor_t      A pointer to BSSDescriptor_t data structure
  *  @param return       	MTRUE/MFALSE
  */
-t_u8 wlan_use_mfp(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc)
+static t_u8 wlan_use_mfp(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc)
 {
 	t_u16 ap_rsn_cap = 0;
 	t_u16 sta_rsn_cap = 0;
@@ -624,8 +624,8 @@ t_u8 wlan_use_mfp(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc)
  *
  *  @param ptlv_rsn_ie       A pointer to rsn_ie TLV
  */
-int wlan_update_rsn_ie(mlan_private *pmpriv,
-		       MrvlIEtypes_RsnParamSet_t *ptlv_rsn_ie)
+static int wlan_update_rsn_ie(mlan_private *pmpriv,
+			      MrvlIEtypes_RsnParamSet_t *ptlv_rsn_ie)
 {
 	t_u16 *prsn_cap;
 	t_u16 *ptr;
@@ -816,7 +816,7 @@ done:
  *
  *  @return     MFALSE if not found; MTURE if found
  */
-t_u8 wlan_find_ie(t_u8 *ie, t_u8 ie_len, t_u8 ie_type)
+static t_u8 wlan_find_ie(t_u8 *ie, t_u8 ie_len, t_u8 ie_type)
 {
 	IEEEtypes_Header_t *pheader = MNULL;
 	t_u8 *pos = MNULL;
@@ -829,7 +829,8 @@ t_u8 wlan_find_ie(t_u8 *ie, t_u8 ie_len, t_u8 ie_type)
 	ret_len = ie_len;
 	while (ret_len >= 2) {
 		pheader = (IEEEtypes_Header_t *)pos;
-		if (pheader->len + sizeof(IEEEtypes_Header_t) > ret_len) {
+		if ((t_s8)(pheader->len + sizeof(IEEEtypes_Header_t)) >
+		    ret_len) {
 			PRINTM(MMSG, "invalid IE length = %d left len %d\n",
 			       pheader->len, ret_len);
 			break;
@@ -879,7 +880,9 @@ mlan_status wlan_cmd_802_11_associate(mlan_private *pmpriv,
 #ifdef DRV_EMBEDDED_SUPPLICANT
 	void *rsn_wpa_ie_tmp = MNULL;
 #endif
-	t_u8 ft_akm = 0;
+	//#ifdef ENABLE_802_11R
+	//	t_u8 ft_akm = 0;
+	//#endif
 	t_u8 oper_class;
 	t_u8 oper_class_flag = MFALSE;
 	MrvlIEtypes_HostMlme_t *host_mlme_tlv = MNULL;
@@ -1038,8 +1041,10 @@ mlan_status wlan_cmd_802_11_associate(mlan_private *pmpriv,
 			       prsn_ie_tlv->header.len;
 			prsn_ie_tlv->header.len =
 				wlan_cpu_to_le16(prsn_ie_tlv->header.len);
+			//#ifdef ENABLE_802_11R
 			/** parse rsn ie to find whether ft akm is used*/
-			ft_akm = wlan_ft_akm_is_used(pmpriv, pmpriv->wpa_ie);
+			// ft_akm = wlan_ft_akm_is_used(pmpriv, pmpriv->wpa_ie);
+			//#endif
 			/* Append PMF Configuration coming from cfg80211 layer
 			 */
 			psecurity_cfg_ie = (MrvlIEtypes_SecurityCfg_t *)pos;
@@ -2318,7 +2323,7 @@ mlan_status wlan_ret_802_11_ad_hoc(mlan_private *pmpriv,
 	}
 
 	/** process wmm ie */
-	if (ie_len >= sizeof(IEEEtypes_VendorHeader_t)) {
+	if (ie_len >= (int)sizeof(IEEEtypes_VendorHeader_t)) {
 		if ((pwmm_param_ie->vend_hdr.element_id ==
 		     VENDOR_SPECIFIC_221) &&
 		    !memcmp(pmadapter, pwmm_param_ie->vend_hdr.oui, wmm_oui,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_main.h b/mxm_wifiex/wlan_src/mlan/mlan_main.h
index c98c691..5cff51a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_main.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_main.h
@@ -5,7 +5,7 @@
  *  in MLAN module.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -286,9 +286,6 @@ extern t_u32 mlan_drvdbg;
 		b = t;                                                         \
 	}
 
-/** MLAN MNULL pointer */
-#define MNULL (0)
-
 /** 16 bits byte swap */
 #define swap_byte_16(x)                                                        \
 	((t_u16)((((t_u16)(x)&0x00ffU) << 8) | (((t_u16)(x)&0xff00U) >> 8)))
@@ -564,6 +561,8 @@ extern t_void (*assert_callback)(t_void *pmoal_handle, t_u32 cond);
 #endif
 /** Maximum port */
 #define MAX_PORT 32
+/** Maximum port 16 */
+#define MAX_PORT_16 (16)
 
 /** max MP REGS */
 #define MAX_MP_REGS_MAX (196)
@@ -594,6 +593,8 @@ extern t_void (*assert_callback)(t_void *pmoal_handle, t_u32 cond);
 #define MFG_CMD_TX_FRAME 0x1021
 #define MFG_CMD_RF_BAND_AG 0x1034
 #define MFG_CMD_RF_CHANNELBW 0x1044
+#define MFG_CMD_RADIO_MODE_CFG 0x1211
+#define MFG_CMD_CONFIG_MAC_HE_TB_TX 0x110A
 
 /** Debug command number */
 #define DBG_CMD_NUM 10
@@ -757,6 +758,8 @@ struct _raListTbl {
 	t_u8 del_ba_count;
 	/** amsdu in ampdu flag */
 	t_u8 amsdu_in_ampdu;
+	/** tdls flag */
+	t_u8 is_tdls_link;
 	/** tx_pause flag */
 	t_u8 tx_pause;
 };
@@ -1209,6 +1212,9 @@ typedef struct _mlan_private {
 	t_u8 osen_ie_len;
 	/** Pointer to the station table */
 	mlan_list_head sta_list;
+	/** tdls pending queue */
+	mlan_list_head tdls_pending_txq;
+	t_u16 tdls_idle_time;
 
 	/** MGMT IE */
 	custom_ie mgmt_ie[MAX_MGMT_IE_INDEX];
@@ -1220,6 +1226,22 @@ typedef struct _mlan_private {
 	t_u8 wmm_enabled;
 	/** WMM qos info */
 	t_u8 wmm_qosinfo;
+	/** saved WMM qos info */
+	t_u8 saved_wmm_qosinfo;
+	/**host tdls uapsd support*/
+	t_u8 host_tdls_uapsd_support;
+	/**host tdls channel switch support*/
+	t_u8 host_tdls_cs_support;
+	/**supported channel IE len*/
+	t_u8 chan_supp_len;
+	/**save channel support IE*/
+	t_u8 chan_supp[MAX_IE_SIZE];
+	/**supported regulatory classl IE len*/
+	t_u8 supp_regulatory_class_len;
+	/**save support channel regulatory class IE*/
+	t_u8 supp_regulatory_class[MAX_IE_SIZE];
+	/**tdls cs off channel*/
+	t_u8 tdls_cs_channel;
 	/** WMM related variable*/
 	wmm_desc_t wmm;
 
@@ -1297,6 +1319,8 @@ typedef struct _mlan_private {
 	/** USB data port */
 	t_u32 port;
 #endif
+	/** Control TX AMPDU on infra link */
+	t_u8 txaggrctrl;
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
 	t_void *psapriv;
 #endif
@@ -1436,6 +1460,22 @@ struct _cmd_ctrl_node {
 #endif
 };
 
+/** default tdls wmm qosinfo */
+#define DEFAULT_TDLS_WMM_QOS_INFO 15
+/** default tdls sleep period */
+#define DEFAULT_TDLS_SLEEP_PERIOD 30
+
+/** TDLS status */
+typedef enum _tdlsStatus_e {
+	TDLS_NOT_SETUP = 0,
+	TDLS_SETUP_INPROGRESS,
+	TDLS_SETUP_COMPLETE,
+	TDLS_SETUP_FAILURE,
+	TDLS_TEAR_DOWN,
+	TDLS_SWITCHING_CHANNEL,
+	TDLS_IN_BASE_CHANNEL,
+	TDLS_IN_OFF_CHANNEL,
+} tdlsStatus_e;
 /** station node */
 typedef struct _sta_node sta_node, *psta_node;
 
@@ -1463,12 +1503,39 @@ struct _sta_node {
 	t_u8 is_11ac_enabled;
 	/** UAP 11ax flag */
 	t_u8 is_11ax_enabled;
+	IEEEtypes_HECap_t he_cap;
 	/** SNR */
 	t_s8 snr;
 	/** Noise Floor */
 	t_s8 nf;
 	/** peer capability */
 	t_u16 capability;
+	/** tdls status */
+	tdlsStatus_e status;
+	/** flag for host based tdls */
+	t_u8 external_tdls;
+	/** peer support rates */
+	t_u8 support_rate[32];
+	/** rate size */
+	t_u8 rate_len;
+	/*Qos capability info*/
+	t_u8 qos_info;
+	/** HT info in TDLS setup confirm*/
+	IEEEtypes_HTInfo_t HTInfo;
+	/** peer BSSCO_20_40*/
+	IEEEtypes_2040BSSCo_t BSSCO_20_40;
+	/*Extended capability*/
+	IEEEtypes_ExtCap_t ExtCap;
+	/*RSN IE*/
+	IEEEtypes_Generic_t rsn_ie;
+	/**Link ID*/
+	IEEEtypes_LinkIDElement_t link_ie;
+	/** AID info */
+	IEEEtypes_AID_t aid_info;
+	/** VHT Capabilities IE */
+	IEEEtypes_VHTCap_t vht_cap;
+	/** VHT Operations IE */
+	IEEEtypes_VHTOprat_t vht_oprat;
 	/** wapi key on off flag */
 	t_u8 wapi_key_on;
 	/** tx pause status */
@@ -1710,14 +1777,14 @@ typedef struct _sdio_mpa_rx {
 /** data structure for USB Rx Deaggregation */
 typedef struct _usb_rx_deaggr_params {
 	/** Rx aggregation control */
-	usb_aggr_ctrl aggr_ctrl;
+	usb_aggr_ctrl_cfg aggr_ctrl;
 } usb_rx_deaggr_params;
 
 #define MAX_USB_TX_PORT_NUM 1
 /** data structure for USB Tx Aggregation */
 typedef struct _usb_tx_aggr_params {
 	/** Tx aggregation control */
-	usb_aggr_ctrl aggr_ctrl;
+	usb_aggr_ctrl_cfg aggr_ctrl;
 	/** allocated pmbuf for tx aggreation */
 	pmlan_buffer pmbuf_aggr;
 	/** packet len used in pmbuf_aggr */
@@ -1738,14 +1805,14 @@ typedef struct _usb_tx_aggr_params {
 #endif
 
 /** Type definition of mef_entry*/
-typedef struct _mef_cfg {
+typedef struct _mef_cfg_data {
 	/** criteria*/
 	t_u32 criteria;
 	/** entry num*/
 	t_u16 entry_num;
 	/** entry pointer*/
 	mef_entry_t *pentry;
-} mef_cfg;
+} mef_cfg_data;
 
 /** Type definition of mef_entry*/
 typedef struct _mef_entry {
@@ -1814,8 +1881,6 @@ typedef struct _mlan_init_para {
 	t_u32 dev_cap_mask;
 	/** oob independent reset mode */
 	t_u32 indrstcfg;
-	/** fw region */
-	t_bool fw_region;
 	/** passive to active scan */
 	t_u8 passive_to_active_scan;
 	/** uap max sta */
@@ -1891,7 +1956,16 @@ typedef struct _mlan_sdio_card_reg {
 
 typedef struct _mlan_sdio_card {
 	const mlan_sdio_card_reg *reg;
-
+	/** maximum ports */
+	t_u8 max_ports;
+	/** mp aggregation packet limit */
+	t_u8 mp_aggr_pkt_limit;
+	/** sdio new mode support */
+	t_bool supports_sdio_new_mode;
+	/** max tx aggr buf size */
+	t_u32 mp_tx_aggr_buf_size;
+	/** max rx aggr buf size */
+	t_u32 mp_rx_aggr_buf_size;
 	/** IO port */
 	t_u32 ioport;
 	/** number of interrupt receive */
@@ -1976,12 +2050,15 @@ typedef struct _mlan_sdio_card {
 #endif
 
 #ifdef PCIE
-/** 8 Event buffer ring */
-#define MLAN_MAX_EVT_BD 0x08
-/** 32 entry will mapping to 5*/
-#define TX_RX_NUM_DESC 5
+#define MAX_TXRX_BD 32
+#define ADMA_MAX_TXRX_BD 512
+/** 512 entry will mapping to 9*/
+#define TX_RX_NUM_DESC 9
 /** 8 entry will mapping to 3 */
 #define EVT_NUM_DESC 3
+#define MLAN_MAX_TXRX_BD MAX(ADMA_MAX_TXRX_BD, MAX_TXRX_BD)
+/** 8 Event buffer ring */
+#define MLAN_MAX_EVT_BD 0x08
 typedef struct _mlan_pcie_card_reg {
 	/* TX buffer description rd pointer */
 	t_u32 reg_txbd_rdptr;
@@ -2046,6 +2123,8 @@ typedef struct _mlan_pcie_card_reg {
 	t_u8 use_adma;
 	/** write to clear interrupt status flag */
 	t_u8 msi_int_wr_clr;
+	/** txrx data dma ring size */
+	t_u16 txrx_bd_size;
 } mlan_pcie_card_reg, *pmlan_pcie_card_reg;
 
 typedef struct _mlan_pcie_card {
@@ -2302,6 +2381,8 @@ typedef struct _mlan_adapter {
 	 *       FALSE - Tx done received for previous Tx
 	 */
 	t_u8 data_sent;
+	/** Data sent cnt */
+	t_u32 data_sent_cnt;
 	/** CMD sent:
 	 *       TRUE - CMD is sent to fw, no CMD Done received
 	 *       FALSE - CMD done received for previous CMD
@@ -2486,6 +2567,8 @@ typedef struct _mlan_adapter {
 	sleep_params_t sleep_params;
 	/** sleep_period_t (Enhanced Power Save) */
 	sleep_period_t sleep_period;
+	/** saved sleep_period_t (Enhanced Power Save) */
+	sleep_period_t saved_sleep_period;
 
 	/** Power Save mode */
 	/**
@@ -2636,6 +2719,9 @@ typedef struct _mlan_adapter {
 	t_u8 *pcal_data;
 	/** Cal data length  */
 	t_u32 cal_data_len;
+	/** tdls status */
+	/* TDLS_NOT_SETUP|TDLS_SWITCHING_CHANNEL|TDLS_IN_BASE_CHANNEL|TDLS_IN_SWITCH_CHANNEL*/
+	tdlsStatus_e tdls_status;
 	/** Feature control bitmask */
 	t_u32 feature_control;
 
@@ -2717,7 +2803,10 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter);
 
 /** Initialize mlan_private structure */
 mlan_status wlan_init_priv(pmlan_private priv);
-
+#ifdef USB
+/** get pcie device from card type */
+mlan_status wlan_get_usb_device(pmlan_adapter pmadapter);
+#endif
 mlan_status wlan_download_vdll_block(mlan_adapter *pmadapter, t_u8 *block,
 				     t_u16 block_len);
 mlan_status wlan_process_vdll_event(pmlan_private pmpriv, pmlan_buffer pevent);
@@ -2759,6 +2848,7 @@ mlan_status wlan_get_info_debug_info(pmlan_adapter pmadapter,
 				     pmlan_ioctl_req pioctl_req);
 
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
+extern pmlan_operations mlan_ops[];
 /** Set/Get BSS role */
 mlan_status wlan_bss_ioctl_bss_role(pmlan_adapter pmadapter,
 				    pmlan_ioctl_req pioctl_req);
@@ -2768,6 +2858,9 @@ mlan_status wlan_bss_ioctl_bss_role(pmlan_adapter pmadapter,
 mlan_status wlan_misc_ssu(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req);
 #endif
 
+mlan_status wlan_misc_hal_phy_cfg(pmlan_adapter pmadapter,
+				  pmlan_ioctl_req pioctl_req);
+
 mlan_status wlan_set_ewpa_mode(mlan_private *priv, pmlan_ds_passphrase psec_pp);
 mlan_status wlan_find_bss(mlan_private *pmpriv, pmlan_ioctl_req pioctl_req);
 
@@ -3332,6 +3425,10 @@ mlan_status wlan_cmd_dot11mc_unassoc_ftm_cfg(pmlan_private pmpriv,
 mlan_status wlan_ret_dot11mc_unassoc_ftm_cfg(pmlan_private pmpriv,
 					     HostCmd_DS_COMMAND *resp,
 					     mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_cmd_hal_phy_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+				 t_u16 cmd_action, t_u16 *pdata_buf);
+mlan_status wlan_ret_hal_phy_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				 mlan_ioctl_req *pioctl_buf);
 
 mlan_status wlan_cmd_rate_adapt_cfg(pmlan_private pmpriv,
 				    HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
@@ -3480,6 +3577,77 @@ t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u8 ie_len,
 			   IEEEtypes_ElementId_e id, t_u8 ext_id);
 t_u8 wlan_is_wmm_ie_present(pmlan_adapter pmadapter, t_u8 *pbuf, t_u16 buf_len);
 
+/**
+ *  @brief This function checks whether a station TDLS link is enabled or not
+ *
+ *  @param priv     A pointer to mlan_private
+ *  @param mac      station mac address
+ *  @return
+ * TDLS_NOT_SETUP/TDLS_SETUP_INPROGRESS/TDLS_SETUP_COMPLETE/TDLS_SETUP_FAILURE/TDLS_TEAR_DOWN
+ */
+static INLINE tdlsStatus_e wlan_get_tdls_link_status(mlan_private *priv,
+						     t_u8 *mac)
+{
+	sta_node *sta_ptr = MNULL;
+	sta_ptr = wlan_get_station_entry(priv, mac);
+	if (sta_ptr)
+		return sta_ptr->status;
+	return TDLS_NOT_SETUP;
+}
+
+/**
+ *  @brief This function checks if TDLS link is in channel switching
+ *
+ *  @param status     tdls link status
+ *  @return         MTRUE/MFALSE
+ */
+static INLINE int wlan_is_tdls_link_chan_switching(tdlsStatus_e status)
+{
+	return (status == TDLS_SWITCHING_CHANNEL) ? MTRUE : MFALSE;
+}
+
+/**
+ *  @brief This function checks if send command to firmware is allowed
+ *
+ *  @param status     tdls link status
+ *  @return         MTRUE/MFALSE
+ */
+static INLINE int wlan_is_send_cmd_allowed(tdlsStatus_e status)
+{
+	int ret = MTRUE;
+	switch (status) {
+	case TDLS_SWITCHING_CHANNEL:
+	case TDLS_IN_OFF_CHANNEL:
+		ret = MFALSE;
+		break;
+	default:
+		break;
+	}
+	return ret;
+}
+
+/**
+ *  @brief This function checks if TDLS link is setup
+ *
+ *  @param status     tdls link status
+ *  @return         MTRUE/MFALSE
+ */
+static INLINE int wlan_is_tdls_link_setup(tdlsStatus_e status)
+{
+	int ret = MFALSE;
+	switch (status) {
+	case TDLS_SWITCHING_CHANNEL:
+	case TDLS_IN_OFF_CHANNEL:
+	case TDLS_IN_BASE_CHANNEL:
+	case TDLS_SETUP_COMPLETE:
+		ret = MTRUE;
+		break;
+	default:
+		break;
+	}
+	return ret;
+}
+
 /**
  *  @brief This function checks tx_pause flag for peer
  *
@@ -3573,6 +3741,28 @@ mlan_status wlan_ret_802_11_mac_address(pmlan_private pmpriv,
 					HostCmd_DS_COMMAND *resp,
 					mlan_ioctl_req *pioctl_buf);
 
+int wlan_get_tdls_list(mlan_private *priv, tdls_peer_info *buf);
+t_void wlan_hold_tdls_packets(pmlan_private priv, t_u8 *mac);
+t_void wlan_restore_tdls_packets(pmlan_private priv, t_u8 *mac,
+				 tdlsStatus_e status);
+t_void wlan_update_non_tdls_ralist(mlan_private *priv, t_u8 *mac,
+				   t_u8 tx_pause);
+mlan_status wlan_misc_ioctl_tdls_config(pmlan_adapter pmadapter,
+					pmlan_ioctl_req pioctl_req);
+void wlan_11n_send_delba_to_peer(mlan_private *priv, t_u8 *ra);
+void wlan_process_tdls_action_frame(pmlan_private priv, t_u8 *pbuf, t_u32 len);
+mlan_status wlan_misc_ioctl_tdls_oper(pmlan_adapter pmadapter,
+				      pmlan_ioctl_req pioctl_req);
+
+mlan_status wlan_misc_ioctl_tdls_get_ies(pmlan_adapter pmadapter,
+					 pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_ioctl_tdls_idle_time(pmlan_adapter pmadapter,
+					   pmlan_ioctl_req pioctl_req);
+
+t_void wlan_tdls_config(pmlan_private pmpriv, t_u8 enable);
+mlan_status wlan_misc_ioctl_tdls_cs_channel(pmlan_adapter pmadapter,
+					    pmlan_ioctl_req pioctl_req);
+
 mlan_status wlan_get_info_ver_ext(pmlan_adapter pmadapter,
 				  pmlan_ioctl_req pioctl_req);
 
@@ -3646,6 +3836,8 @@ mlan_status wlan_misc_otp_user_data(pmlan_adapter pmadapter,
 				    pmlan_ioctl_req pioctl_req);
 
 #ifdef USB
+extern mlan_adapter_operations mlan_usb_ops;
+
 mlan_status wlan_misc_ioctl_usb_aggr_ctrl(pmlan_adapter pmadapter,
 					  pmlan_ioctl_req pioctl_req);
 #endif
@@ -3690,7 +3882,7 @@ mlan_status wlan_misc_ioctl_cwmode_ctrl(pmlan_adapter pmadapter,
 					pmlan_ioctl_req pioctl_req);
 
 mlan_status wlan_set_mef_entry(mlan_private *pmpriv, pmlan_adapter pmadapter,
-			       mef_cfg *pmef);
+			       mef_cfg_data *pmef);
 mlan_status wlan_process_mef_cfg_cmd(mlan_private *pmpriv,
 				     pmlan_adapter pmadapter);
 mlan_status wlan_misc_ioctl_mef_flt_cfg(pmlan_adapter pmadapter,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_misc.c b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
index b9a8afd..b7709dc 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_misc.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
@@ -4,7 +4,7 @@
  *  @brief This file include miscellaneous functions for MLAN module
  *
  *
- *  Copyright 2009-2020 NXP
+ *  Copyright 2009-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -49,10 +49,6 @@ Change Log:
 /********************************************************
 			Global Variables
 ********************************************************/
-#if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
-extern pmlan_operations mlan_ops[];
-#endif
-extern t_u8 ac_to_tid[4][2];
 
 /********************************************************
 			Local Functions
@@ -65,7 +61,7 @@ extern t_u8 ac_to_tid[4][2];
  *
  *  @return        MTRUE/MFALSE;
  */
-t_u8 wlan_pending_interrupt(pmlan_adapter pmadapter)
+static t_u8 wlan_pending_interrupt(pmlan_adapter pmadapter)
 {
 	if (!IS_USB(pmadapter->card_type) && pmadapter->ireg)
 		return MTRUE;
@@ -425,6 +421,8 @@ mlan_status wlan_get_info_debug_info(pmlan_adapter pmadapter,
 			wlan_get_txbastream_tbl(pmpriv, debug_info->tx_tbl);
 		debug_info->ralist_num =
 			wlan_get_ralist_info(pmpriv, debug_info->ralist);
+		debug_info->tdls_peer_num =
+			wlan_get_tdls_list(pmpriv, debug_info->tdls_peer_list);
 		debug_info->ps_mode = pmadapter->ps_mode;
 		debug_info->ps_state = pmadapter->ps_state;
 #ifdef STA_SUPPORT
@@ -568,7 +566,7 @@ mlan_status wlan_get_info_debug_info(pmlan_adapter pmadapter,
 				   sizeof(pmadapter->pcard_sd->mpa_rx_count),
 				   sizeof(debug_info->mpa_rx_count));
 			debug_info->mp_aggr_pkt_limit =
-				SDIO_MP_AGGR_DEF_PKT_LIMIT;
+				pmadapter->pcard_sd->mp_aggr_pkt_limit;
 		}
 #endif
 #ifdef PCIE
@@ -597,14 +595,12 @@ mlan_status wlan_get_info_debug_info(pmlan_adapter pmadapter,
 				pmadapter->pcard_pcie->evtbd_ring_vbase;
 			debug_info->evtbd_ring_size =
 				pmadapter->pcard_pcie->evtbd_ring_size;
-			memcpy_ext(
-				pmadapter, debug_info->last_tx_pkt_size,
-				pmadapter->pcard_pcie->last_tx_pkt_size,
-				sizeof(pmadapter->pcard_pcie->last_tx_pkt_size),
-				sizeof(debug_info->last_tx_pkt_size));
+			debug_info->txrx_bd_size =
+				pmadapter->pcard_pcie->reg->txrx_bd_size;
 		}
 #endif
 		debug_info->data_sent = pmadapter->data_sent;
+		debug_info->data_sent_cnt = pmadapter->data_sent_cnt;
 		debug_info->cmd_sent = pmadapter->cmd_sent;
 		debug_info->cmd_resp_received = pmadapter->cmd_resp_received;
 		debug_info->tx_pkts_queued =
@@ -917,6 +913,37 @@ mlan_status wlan_misc_ssu(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req)
 }
 #endif
 
+/**
+ *  @brief Set the hal/phy cfg params.
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   A pointer to ioctl request buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success,
+ * otherwise fail
+ */
+mlan_status wlan_misc_hal_phy_cfg(pmlan_adapter pmadapter,
+				  pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *hal_phy_cfg = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	t_u16 cmd_act;
+
+	ENTER();
+
+	cmd_act = HostCmd_ACT_GEN_SET;
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_HAL_PHY_CFG, cmd_act, 0,
+			       (t_void *)pioctl_req,
+			       &hal_phy_cfg->param.hal_phy_cfg_params);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief This function allocates a mlan_buffer.
  *
@@ -1847,6 +1874,888 @@ t_void wlan_delete_station_list(pmlan_private priv)
 	return;
 }
 
+/**
+ *  @brief Get tdls peer list
+ *
+ *  @param priv         A pointer to mlan_private structure
+ *  @param buf          A pointer to tdls_peer_info buf
+ *  @return             number of tdls peer
+ */
+int wlan_get_tdls_list(mlan_private *priv, tdls_peer_info *buf)
+{
+	tdls_peer_info *peer_info = buf;
+	sta_node *sta_ptr = MNULL;
+	int count = 0;
+	ENTER();
+	if (priv->bss_type != MLAN_BSS_TYPE_STA) {
+		LEAVE();
+		return count;
+	}
+	sta_ptr = (sta_node *)util_peek_list(
+		priv->adapter->pmoal_handle, &priv->sta_list,
+		priv->adapter->callbacks.moal_spin_lock,
+		priv->adapter->callbacks.moal_spin_unlock);
+	if (!sta_ptr) {
+		LEAVE();
+		return count;
+	}
+	while (sta_ptr != (sta_node *)&priv->sta_list) {
+		if (sta_ptr->status == TDLS_SETUP_COMPLETE) {
+			peer_info->snr = sta_ptr->snr;
+			peer_info->nf = sta_ptr->nf;
+			memcpy_ext(priv->adapter, peer_info->mac_addr,
+				   sta_ptr->mac_addr, MLAN_MAC_ADDR_LENGTH,
+				   MLAN_MAC_ADDR_LENGTH);
+			memcpy_ext(priv->adapter, peer_info->ht_cap,
+				   &sta_ptr->HTcap, sizeof(IEEEtypes_HTCap_t),
+				   sizeof(peer_info->ht_cap));
+			memcpy_ext(priv->adapter, peer_info->ext_cap,
+				   &sta_ptr->ExtCap, sizeof(IEEEtypes_ExtCap_t),
+				   sizeof(peer_info->ext_cap));
+			memcpy_ext(priv->adapter, peer_info->vht_cap,
+				   &sta_ptr->vht_cap,
+				   sizeof(IEEEtypes_VHTCap_t),
+				   sizeof(peer_info->vht_cap));
+			peer_info++;
+			count++;
+		}
+		sta_ptr = sta_ptr->pnext;
+		if (count >= MLAN_MAX_TDLS_PEER_SUPPORTED)
+			break;
+	}
+	LEAVE();
+	return count;
+}
+
+/**
+ *  @brief Set the TDLS configuration to FW.
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_tdls_config(pmlan_adapter pmadapter,
+					pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	tdls_all_config *tdls_all_cfg =
+		(tdls_all_config *)misc->param.tdls_config.tdls_data;
+	t_u8 event_buf[100];
+	mlan_event *pevent = (mlan_event *)event_buf;
+	tdls_tear_down_event *tdls_evt =
+		(tdls_tear_down_event *)pevent->event_buf;
+	sta_node *sta_ptr = MNULL;
+	MrvlIEtypes_Data_t *pMrvlTlv = MNULL;
+	t_u8 *pos = MNULL;
+	t_u16 remain_len = 0;
+
+	ENTER();
+
+	if (misc->param.tdls_config.tdls_action == WLAN_TDLS_TEAR_DOWN_REQ) {
+		sta_ptr = wlan_get_station_entry(
+			pmpriv, tdls_all_cfg->u.tdls_tear_down.peer_mac_addr);
+		if (sta_ptr && sta_ptr->external_tdls) {
+			pevent->bss_index = pmpriv->bss_index;
+			pevent->event_id = MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ;
+			pevent->event_len = sizeof(tdls_tear_down_event);
+			memcpy_ext(pmpriv->adapter,
+				   (t_u8 *)tdls_evt->peer_mac_addr,
+				   tdls_all_cfg->u.tdls_tear_down.peer_mac_addr,
+				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+			tdls_evt->reason_code =
+				tdls_all_cfg->u.tdls_tear_down.reason_code;
+			wlan_recv_event(pmpriv,
+					MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ,
+					pevent);
+			LEAVE();
+			return ret;
+		}
+	}
+	if (misc->param.tdls_config.tdls_action == WLAN_HOST_TDLS_CONFIG) {
+		pmpriv->host_tdls_uapsd_support =
+			tdls_all_cfg->u.host_tdls_cfg.uapsd_support;
+		pmpriv->host_tdls_cs_support =
+			tdls_all_cfg->u.host_tdls_cfg.cs_support;
+		pos = tdls_all_cfg->u.host_tdls_cfg.tlv_buffer;
+		remain_len = tdls_all_cfg->u.host_tdls_cfg.tlv_len;
+		while (remain_len > sizeof(MrvlIEtypesHeader_t)) {
+			remain_len -= sizeof(MrvlIEtypesHeader_t);
+			pMrvlTlv = (MrvlIEtypes_Data_t *)pos;
+			switch (pMrvlTlv->header.type) {
+			case SUPPORTED_CHANNELS:
+				pmpriv->chan_supp_len = (t_u8)MIN(
+					pMrvlTlv->header.len, MAX_IE_SIZE);
+				memset(pmadapter, pmpriv->chan_supp, 0,
+				       sizeof(pmpriv->chan_supp));
+				memcpy_ext(pmadapter, pmpriv->chan_supp,
+					   pMrvlTlv->data, pMrvlTlv->header.len,
+					   MAX_IE_SIZE);
+				DBG_HEXDUMP(MCMD_D, "TDLS supported channel",
+					    pmpriv->chan_supp,
+					    pmpriv->chan_supp_len);
+				break;
+			case REGULATORY_CLASS:
+				pmpriv->supp_regulatory_class_len = (t_u8)MIN(
+					pMrvlTlv->header.len, MAX_IE_SIZE);
+				memset(pmadapter, pmpriv->supp_regulatory_class,
+				       0,
+				       sizeof(pmpriv->supp_regulatory_class));
+				memcpy_ext(pmadapter,
+					   pmpriv->supp_regulatory_class,
+					   pMrvlTlv->data, pMrvlTlv->header.len,
+					   MAX_IE_SIZE);
+				DBG_HEXDUMP(MCMD_D,
+					    "TDLS supported regulatory class",
+					    pmpriv->supp_regulatory_class,
+					    pmpriv->supp_regulatory_class_len);
+				break;
+			default:
+				break;
+			}
+			remain_len -= pMrvlTlv->header.len;
+			pos += sizeof(MrvlIEtypesHeader_t) +
+			       pMrvlTlv->header.len;
+		}
+		LEAVE();
+		return ret;
+	}
+	pioctl_req->action = MLAN_ACT_SET;
+
+	/* Send command to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_CONFIG,
+			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
+			       &misc->param.tdls_config);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief enable tdls config for cs and uapsd.
+ *
+ *  @param pmpriv	A pointer to mlan_private structure
+ *  @param enable   	MTRUE/MFALSE
+ *
+ *  @return
+ */
+t_void wlan_tdls_config(pmlan_private pmpriv, t_u8 enable)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
+	mlan_ds_misc_tdls_config *tdls_config = MNULL;
+	tdls_all_config *tdls_all_cfg = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	ret = pcb->moal_malloc(pmadapter->pmoal_handle,
+			       sizeof(mlan_ds_misc_tdls_config), MLAN_MEM_DEF,
+			       (t_u8 **)&tdls_config);
+	if (ret != MLAN_STATUS_SUCCESS || !tdls_config) {
+		PRINTM(MERROR, "Memory allocation for tdls_config failed!\n");
+		LEAVE();
+		return;
+	}
+	memset(pmadapter, (t_u8 *)tdls_config, 0,
+	       sizeof(mlan_ds_misc_tdls_config));
+	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
+	tdls_all_cfg->u.tdls_config.enable = enable;
+	tdls_config->tdls_action = WLAN_TDLS_CONFIG;
+	/* Send command to firmware */
+	wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_CONFIG, HostCmd_ACT_GEN_SET,
+			 0, MNULL, tdls_config);
+	PRINTM(MCMND, "tdls_config: enable=%d\n", enable);
+
+	if (tdls_config)
+		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)tdls_config);
+
+	LEAVE();
+}
+
+/**
+ *  @brief set tdls channel switch parameters.
+ *
+ *  @param pmpriv	A pointer to mlan_private structure
+ *
+ *  @return
+ */
+static t_void wlan_tdls_cs_param_config(pmlan_private pmpriv)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
+	mlan_ds_misc_tdls_config *tdls_config = MNULL;
+	tdls_all_config *tdls_all_cfg = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	ret = pcb->moal_malloc(pmadapter->pmoal_handle,
+			       sizeof(mlan_ds_misc_tdls_config), MLAN_MEM_DEF,
+			       (t_u8 **)&tdls_config);
+	if (ret != MLAN_STATUS_SUCCESS || !tdls_config) {
+		PRINTM(MERROR, "Memory allocation for tdls_config failed!\n");
+		LEAVE();
+		return;
+	}
+	memset(pmadapter, (t_u8 *)tdls_config, 0,
+	       sizeof(mlan_ds_misc_tdls_config));
+
+	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
+	tdls_config->tdls_action = WLAN_TDLS_CS_PARAMS;
+	tdls_all_cfg->u.tdls_cs_params.unit_time = 2;
+	tdls_all_cfg->u.tdls_cs_params.threshold_otherlink = 10;
+	tdls_all_cfg->u.tdls_cs_params.threshold_directlink = 0;
+
+	/* Send command to firmware */
+	wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_CONFIG, HostCmd_ACT_GEN_SET,
+			 0, MNULL, tdls_config);
+
+	if (tdls_config)
+		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)tdls_config);
+
+	LEAVE();
+}
+
+/**
+ *  @brief start tdls channel switch
+ *
+ *  @param pmpriv	A pointer to mlan_private structure
+ *  @param peer_mac_addr 	A pointer to peer mac address
+ *  @param pioctl_buf   A pointer to ioctl request buffer
+ *
+ *  @return
+ */
+static t_void wlan_tdls_cs_start(pmlan_private pmpriv, t_u8 *peer_mac_addr,
+				 pmlan_ioctl_req pioctl_buf)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
+	mlan_ds_misc_tdls_config *tdls_config = MNULL;
+	tdls_all_config *tdls_all_cfg = MNULL;
+	mlan_ds_misc_cfg *misc = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	ret = pcb->moal_malloc(pmadapter->pmoal_handle,
+			       sizeof(mlan_ds_misc_tdls_config), MLAN_MEM_DEF,
+			       (t_u8 **)&tdls_config);
+	if (ret != MLAN_STATUS_SUCCESS || !tdls_config) {
+		PRINTM(MERROR, "Memory allocation for tdls_config failed!\n");
+		LEAVE();
+		return;
+	}
+	memset(pmadapter, (t_u8 *)tdls_config, 0,
+	       sizeof(mlan_ds_misc_tdls_config));
+
+	if (pioctl_buf) {
+		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		memcpy_ext(pmpriv->adapter, tdls_config,
+			   &misc->param.tdls_config,
+			   sizeof(mlan_ds_misc_tdls_config),
+			   sizeof(mlan_ds_misc_tdls_config));
+		tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
+		if (tdls_all_cfg->u.tdls_chan_switch.primary_channel > 14) {
+			tdls_all_cfg->u.tdls_chan_switch
+				.secondary_channel_offset =
+				wlan_get_second_channel_offset(
+					tdls_all_cfg->u.tdls_chan_switch
+						.primary_channel);
+		}
+		PRINTM(MCMND, "Start TDLS CS: channel=%d\n",
+		       tdls_all_cfg->u.tdls_chan_switch.primary_channel);
+	} else {
+		tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
+		tdls_config->tdls_action = WLAN_TDLS_INIT_CHAN_SWITCH;
+		memcpy_ext(pmpriv->adapter,
+			   tdls_all_cfg->u.tdls_chan_switch.peer_mac_addr,
+			   peer_mac_addr, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+		tdls_all_cfg->u.tdls_chan_switch.primary_channel =
+			pmpriv->tdls_cs_channel;
+		if (pmpriv->tdls_cs_channel > 14) {
+			tdls_all_cfg->u.tdls_chan_switch.band = BAND_5GHZ;
+			tdls_all_cfg->u.tdls_chan_switch
+				.secondary_channel_offset =
+				wlan_get_second_channel_offset(
+					pmpriv->tdls_cs_channel);
+		} else {
+			tdls_all_cfg->u.tdls_chan_switch.band = BAND_2GHZ;
+		}
+		PRINTM(MCMND, "Start TDLS CS: channel=%d\n",
+		       pmpriv->tdls_cs_channel);
+	}
+	tdls_all_cfg->u.tdls_chan_switch.switch_time = 10;
+	tdls_all_cfg->u.tdls_chan_switch.switch_timeout = 16;
+	tdls_all_cfg->u.tdls_chan_switch.regulatory_class = 12;
+	tdls_all_cfg->u.tdls_chan_switch.periodicity = 1;
+
+	/* Send command to firmware */
+	wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_CONFIG, HostCmd_ACT_GEN_SET,
+			 0, MNULL, tdls_config);
+
+	if (tdls_config)
+		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)tdls_config);
+
+	LEAVE();
+}
+
+#if 0
+/**
+ *  @brief stop tdls channel switch
+ *
+ *  @param pmpriv	A pointer to mlan_private structure
+ *  @param peer_mac_addr 	A pointer to peer mac address
+ *  @param pioctl_buf   A pointer to command buffer
+ *  @return
+ */
+static t_void wlan_tdls_cs_stop(pmlan_private pmpriv, t_u8 *peer_mac_addr)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
+	mlan_ds_misc_tdls_config *tdls_config = MNULL;
+	tdls_all_config *tdls_all_cfg = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	ret = pcb->moal_malloc(pmadapter->pmoal_handle,
+			       sizeof(mlan_ds_misc_tdls_config), MLAN_MEM_DEF,
+			       (t_u8 **)&tdls_config);
+	if (ret != MLAN_STATUS_SUCCESS || !tdls_config) {
+		PRINTM(MERROR, "Memory allocation for tdls_config failed!\n");
+		LEAVE();
+		return;
+	}
+	memset(pmadapter, (t_u8 *)tdls_config, 0,
+	       sizeof(mlan_ds_misc_tdls_config));
+
+	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
+	tdls_config->tdls_action = WLAN_TDLS_STOP_CHAN_SWITCH;
+
+	memcpy_ext(pmpriv->adapter,
+		   tdls_all_cfg->u.tdls_stop_chan_switch.peer_mac_addr,
+		   peer_mac_addr, MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	PRINTM(MCMND, "Stop TDLS CS\n");
+	/* Send command to firmware */
+	wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_CONFIG, HostCmd_ACT_GEN_SET,
+			 0, MNULL, tdls_config);
+
+	if (tdls_config)
+		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)tdls_config);
+
+	LEAVE();
+}
+#endif
+
+/**
+ *  @brief Set/Get the TDLS off channel.
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_tdls_cs_channel(pmlan_adapter pmadapter,
+					    pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	ENTER();
+
+	if (MLAN_ACT_GET == pioctl_req->action)
+		misc->param.tdls_cs_channel = pmpriv->tdls_cs_channel;
+	else if (MLAN_ACT_SET == pioctl_req->action) {
+		pmpriv->tdls_cs_channel = misc->param.tdls_cs_channel;
+	}
+	LEAVE();
+	return ret;
+}
+/**
+ *  @brief Set/Get the TDLS idle time.
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_tdls_idle_time(pmlan_adapter pmadapter,
+					   pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	ENTER();
+
+	if (MLAN_ACT_GET == pioctl_req->action) {
+		misc->param.tdls_idle_time = pmpriv->tdls_idle_time;
+	} else if (MLAN_ACT_SET == pioctl_req->action) {
+		pmpriv->tdls_idle_time = misc->param.tdls_idle_time;
+	}
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief Set the TDLS operation to FW.
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_tdls_oper(pmlan_adapter pmadapter,
+				      pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_ds_misc_tdls_oper *ptdls_oper = &misc->param.tdls_oper;
+	t_u8 event_buf[100];
+	mlan_event *ptdls_event = (mlan_event *)event_buf;
+	tdls_tear_down_event *tdls_evt =
+		(tdls_tear_down_event *)ptdls_event->event_buf;
+	sta_node *sta_ptr = MNULL;
+	t_u8 i = 0;
+
+	ENTER();
+	sta_ptr = wlan_get_station_entry(pmpriv, ptdls_oper->peer_mac);
+	switch (ptdls_oper->tdls_action) {
+	case WLAN_TDLS_ENABLE_LINK:
+		if (sta_ptr && (sta_ptr->status != TDLS_SETUP_FAILURE)) {
+			PRINTM(MMSG, "TDLS: Enable link " MACSTR " success\n",
+			       MAC2STR(ptdls_oper->peer_mac));
+			sta_ptr->status = TDLS_SETUP_COMPLETE;
+			pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+			if (!pmpriv->txaggrctrl)
+				wlan_11n_send_delba_to_peer(
+					pmpriv,
+					pmpriv->curr_bss_params.bss_descriptor
+						.mac_address);
+			if (sta_ptr->HTcap.ieee_hdr.element_id ==
+			    HT_CAPABILITY) {
+				sta_ptr->is_11n_enabled = MTRUE;
+				if (GETHT_MAXAMSDU(
+					    sta_ptr->HTcap.ht_cap.ht_cap_info))
+					sta_ptr->max_amsdu =
+						MLAN_TX_DATA_BUF_SIZE_8K;
+				else
+					sta_ptr->max_amsdu =
+						MLAN_TX_DATA_BUF_SIZE_4K;
+				for (i = 0; i < MAX_NUM_TID; i++) {
+					if (sta_ptr->is_11n_enabled)
+						sta_ptr->ampdu_sta[i] =
+							pmpriv->aggr_prio_tbl[i]
+								.ampdu_user;
+					else
+						sta_ptr->ampdu_sta[i] =
+							BA_STREAM_NOT_ALLOWED;
+				}
+				memset(pmpriv->adapter, sta_ptr->rx_seq, 0xff,
+				       sizeof(sta_ptr->rx_seq));
+			}
+			wlan_restore_tdls_packets(pmpriv, ptdls_oper->peer_mac,
+						  TDLS_SETUP_COMPLETE);
+			if (ISSUPP_EXTCAP_TDLS_CHAN_SWITCH(
+				    sta_ptr->ExtCap.ext_cap)) {
+				wlan_tdls_config(pmpriv, MTRUE);
+				wlan_tdls_cs_param_config(pmpriv);
+				/**tdls cs start*/
+				if (pmpriv->tdls_cs_channel &&
+				    pmpriv->tdls_cs_channel !=
+					    pmpriv->curr_bss_params
+						    .bss_descriptor.channel)
+					wlan_tdls_cs_start(pmpriv,
+							   ptdls_oper->peer_mac,
+							   MNULL);
+			}
+		} else {
+			PRINTM(MMSG, "TDLS: Enable link " MACSTR " fail\n",
+			       MAC2STR(ptdls_oper->peer_mac));
+			/*for supplicant 2.0, we need send event to request
+			 *teardown, *for latest supplicant, we only need return
+			 *fail, and supplicant will send teardown packet and
+			 *disable tdls link*/
+			if (sta_ptr) {
+				ptdls_event->bss_index = pmpriv->bss_index;
+				ptdls_event->event_id =
+					MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ;
+				ptdls_event->event_len =
+					sizeof(tdls_tear_down_event);
+				memcpy_ext(pmpriv->adapter,
+					   (t_u8 *)tdls_evt->peer_mac_addr,
+					   ptdls_oper->peer_mac,
+					   MLAN_MAC_ADDR_LENGTH,
+					   MLAN_MAC_ADDR_LENGTH);
+				tdls_evt->reason_code =
+					MLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED;
+				wlan_recv_event(
+					pmpriv,
+					MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ,
+					ptdls_event);
+				wlan_restore_tdls_packets(pmpriv,
+							  ptdls_oper->peer_mac,
+							  TDLS_TEAR_DOWN);
+				if (sta_ptr->is_11n_enabled) {
+					wlan_cleanup_reorder_tbl(
+						pmpriv, ptdls_oper->peer_mac);
+					wlan_11n_cleanup_txbastream_tbl(
+						pmpriv, ptdls_oper->peer_mac);
+				}
+				wlan_delete_station_entry(pmpriv,
+							  ptdls_oper->peer_mac);
+				if (MTRUE == wlan_is_station_list_empty(pmpriv))
+					pmadapter->tdls_status = TDLS_NOT_SETUP;
+				else
+					pmadapter->tdls_status =
+						TDLS_IN_BASE_CHANNEL;
+			}
+			ret = MLAN_STATUS_FAILURE;
+		}
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
+				MNULL);
+		break;
+	case WLAN_TDLS_DISABLE_LINK:
+		/* Send command to firmware to delete tdls link*/
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_OPERATION,
+				       HostCmd_ACT_GEN_SET, 0,
+				       (t_void *)pioctl_req, ptdls_oper);
+		if (ret == MLAN_STATUS_SUCCESS)
+			ret = MLAN_STATUS_PENDING;
+		break;
+	case WLAN_TDLS_CREATE_LINK:
+		PRINTM(MIOCTL, "CREATE TDLS LINK\n");
+		if (sta_ptr && sta_ptr->status == TDLS_SETUP_INPROGRESS) {
+			PRINTM(MIOCTL, "We already create the link\n");
+			break;
+		}
+		if (!sta_ptr)
+			sta_ptr = wlan_add_station_entry(
+				pmpriv, misc->param.tdls_oper.peer_mac);
+		if (sta_ptr) {
+			sta_ptr->status = TDLS_SETUP_INPROGRESS;
+			sta_ptr->external_tdls = MTRUE;
+			wlan_hold_tdls_packets(pmpriv,
+					       misc->param.tdls_oper.peer_mac);
+		}
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_OPERATION,
+				       HostCmd_ACT_GEN_SET, 0,
+				       (t_void *)pioctl_req, ptdls_oper);
+		if (ret == MLAN_STATUS_SUCCESS)
+			ret = MLAN_STATUS_PENDING;
+		break;
+	case WLAN_TDLS_CONFIG_LINK:
+		if (!sta_ptr || sta_ptr->status == TDLS_SETUP_FAILURE) {
+			PRINTM(MERROR, "Can not CONFIG TDLS Link\n");
+			ret = MLAN_STATUS_FAILURE;
+			break;
+		}
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TDLS_OPERATION,
+				       HostCmd_ACT_GEN_SET, 0,
+				       (t_void *)pioctl_req, ptdls_oper);
+		if (ret == MLAN_STATUS_SUCCESS)
+			ret = MLAN_STATUS_PENDING;
+		break;
+	case WLAN_TDLS_INIT_CHAN_SWITCH:
+		if (sta_ptr &&
+		    ISSUPP_EXTCAP_TDLS_CHAN_SWITCH(sta_ptr->ExtCap.ext_cap)) {
+			wlan_tdls_config(pmpriv, MTRUE);
+			wlan_tdls_cs_param_config(pmpriv);
+			/**tdls cs start*/
+			wlan_tdls_cs_start(pmpriv, ptdls_oper->peer_mac,
+					   pioctl_req);
+		}
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
+				MNULL);
+		break;
+	default:
+		break;
+	}
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief Get AP's ext capability
+ *
+ *  @param pmpriv	A pointer to mlan_adapter structure
+ *  @param ext_cap  A pointer to ExtCap_t structure
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+static void wlan_get_ap_ext_cap(mlan_private *pmpriv, ExtCap_t *ext_cap)
+{
+	pmlan_adapter pmadapter = pmpriv->adapter;
+	BSSDescriptor_t *pbss_desc;
+	pbss_desc = &pmpriv->curr_bss_params.bss_descriptor;
+	memset(pmadapter, ext_cap, 0, sizeof(ExtCap_t));
+	if (pbss_desc->pext_cap) {
+		memcpy_ext(pmadapter, (t_u8 *)ext_cap,
+			   (t_u8 *)pbss_desc->pext_cap +
+				   sizeof(IEEEtypes_Header_t),
+			   pbss_desc->pext_cap->ieee_hdr.len, sizeof(ExtCap_t));
+	}
+	return;
+}
+
+/**
+ *  @brief Set the TDLS operation to FW.
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_tdls_get_ies(pmlan_adapter pmadapter,
+					 pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_ds_misc_tdls_ies *tdls_ies = &misc->param.tdls_ies;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	BSSDescriptor_t *pbss_desc;
+	t_u32 usr_dot_11n_dev_cap;
+	IEEEtypes_ExtCap_t *ext_cap = MNULL;
+	ExtCap_t ap_ext_cap;
+	IEEEtypes_HTCap_t *ht_cap = MNULL;
+	IEEEtypes_HTInfo_t *ht_info = MNULL;
+	IEEEtypes_VHTCap_t *vht_cap = MNULL;
+	IEEEtypes_VHTOprat_t *vht_oprat = MNULL;
+	IEEEtypes_AssocRsp_t *passoc_rsp = MNULL;
+	IEEEtypes_AID_t *aid_info = MNULL;
+	t_u8 supp_chan[] = {1, 11};
+	t_u8 regulatory_class[] = {1, /**current class*/
+				   1,  2,  3,  4,  12, 22, 23, 24,
+				   25, 27, 28, 29, 30, 32, 33}; /**list
+								   regulatory
+								   class*/
+	IEEEtypes_Generic_t *pSupp_chan = MNULL, *pRegulatory_class = MNULL;
+	sta_node *sta_ptr = MNULL;
+	ENTER();
+
+	/* We don't need peer information for TDLS setup */
+	if (!(tdls_ies->flags & TDLS_IE_FLAGS_SETUP))
+		sta_ptr = wlan_get_station_entry(pmpriv, tdls_ies->peer_mac);
+	pbss_desc = &pmpriv->curr_bss_params.bss_descriptor;
+	wlan_get_ap_ext_cap(pmpriv, &ap_ext_cap);
+	if (pbss_desc->bss_band & BAND_A)
+		usr_dot_11n_dev_cap = pmpriv->usr_dot_11n_dev_cap_a;
+	else
+		usr_dot_11n_dev_cap = pmpriv->usr_dot_11n_dev_cap_bg;
+
+	/** fill the extcap */
+	if (tdls_ies->flags & TDLS_IE_FLAGS_EXTCAP) {
+		ext_cap = (IEEEtypes_ExtCap_t *)tdls_ies->ext_cap;
+		ext_cap->ieee_hdr.element_id = EXT_CAPABILITY;
+		ext_cap->ieee_hdr.len = sizeof(ExtCap_t);
+		SET_EXTCAP_TDLS(ext_cap->ext_cap);
+		RESET_EXTCAP_TDLS_UAPSD(ext_cap->ext_cap);
+		RESET_EXTCAP_TDLS_CHAN_SWITCH(ext_cap->ext_cap);
+
+		if (pmpriv->host_tdls_uapsd_support) {
+			/* uapsd in tdls confirm frame*/
+			if (tdls_ies->flags & TDLS_IE_FLAGS_HTINFO) {
+				if (sta_ptr && ISSUPP_EXTCAP_TDLS_UAPSD(
+						       sta_ptr->ExtCap.ext_cap))
+					SET_EXTCAP_TDLS_UAPSD(ext_cap->ext_cap);
+			} else {
+				SET_EXTCAP_TDLS_UAPSD(ext_cap->ext_cap);
+			}
+		}
+		/*  channel switch support */
+		if (pmpriv->host_tdls_cs_support &&
+		    !IS_EXTCAP_TDLS_CHLSWITCHPROHIB(ap_ext_cap)) {
+			/* channel switch in tdls confirm frame*/
+			if (tdls_ies->flags & TDLS_IE_FLAGS_HTINFO) {
+				if (sta_ptr && ISSUPP_EXTCAP_TDLS_CHAN_SWITCH(
+						       sta_ptr->ExtCap.ext_cap))
+					SET_EXTCAP_TDLS_CHAN_SWITCH(
+						ext_cap->ext_cap);
+			} else {
+				SET_EXTCAP_TDLS_CHAN_SWITCH(ext_cap->ext_cap);
+			}
+		}
+
+		RESET_EXTCAP_TDLS_WIDER_BANDWIDTH(ext_cap->ext_cap);
+		if ((pmadapter->fw_bands & BAND_AAC) &&
+		    (MFALSE == wlan_is_ap_in_11ac_mode(pmpriv)))
+			SET_EXTCAP_TDLS_WIDER_BANDWIDTH(ext_cap->ext_cap);
+		/* if peer does not support wider bandwidth, don't set wider
+		 * bandwidth*/
+		if (sta_ptr && sta_ptr->rate_len &&
+		    !ISSUPP_EXTCAP_TDLS_WIDER_BANDWIDTH(
+			    sta_ptr->ExtCap.ext_cap))
+			RESET_EXTCAP_TDLS_WIDER_BANDWIDTH(ext_cap->ext_cap);
+		DBG_HEXDUMP(MCMD_D, "TDLS extcap", tdls_ies->ext_cap,
+			    sizeof(IEEEtypes_ExtCap_t));
+	}
+
+	/** default qos info is 0xf, compare with peer device qos info for tdls
+	 * confirm */
+	if (tdls_ies->flags & TDLS_IE_FLAGS_QOS_INFO) {
+		if (sta_ptr && sta_ptr->rate_len)
+			tdls_ies->QosInfo = sta_ptr->qos_info & 0xf;
+		PRINTM(MCMND, "TDLS Qos info=0x%x\n", tdls_ies->QosInfo);
+	}
+
+	/** fill the htcap based on hwspec */
+	if (tdls_ies->flags & TDLS_IE_FLAGS_HTCAP) {
+		ht_cap = (IEEEtypes_HTCap_t *)tdls_ies->ht_cap;
+		memset(pmadapter, ht_cap, 0, sizeof(IEEEtypes_HTCap_t));
+		if ((sta_ptr && !ISSUPP_EXTCAP_TDLS_CHAN_SWITCH(
+					sta_ptr->ExtCap.ext_cap)) ||
+		    IS_EXTCAP_TDLS_CHLSWITCHPROHIB(ap_ext_cap))
+			wlan_fill_ht_cap_ie(pmpriv, ht_cap,
+					    pbss_desc->bss_band);
+		else if (pmpriv->host_tdls_cs_support &&
+			 (pmadapter->fw_bands & BAND_A))
+			wlan_fill_ht_cap_ie(pmpriv, ht_cap, BAND_A);
+		else
+			wlan_fill_ht_cap_ie(pmpriv, ht_cap,
+					    pbss_desc->bss_band);
+		DBG_HEXDUMP(MCMD_D, "TDLS htcap", tdls_ies->ht_cap,
+			    sizeof(IEEEtypes_HTCap_t));
+	}
+	/** if peer did not support 11AC, do not add vht related ie */
+	if (sta_ptr && sta_ptr->rate_len &&
+	    (sta_ptr->vht_cap.ieee_hdr.element_id != VHT_CAPABILITY))
+		tdls_ies->flags &=
+			~(TDLS_IE_FLAGS_VHTCAP | TDLS_IE_FLAGS_VHTOPRAT |
+			  TDLS_IE_FLAGS_AID);
+	/** fill the vhtcap based on hwspec */
+	if (tdls_ies->flags & TDLS_IE_FLAGS_VHTCAP) {
+		vht_cap = (IEEEtypes_VHTCap_t *)tdls_ies->vht_cap;
+		memset(pmadapter, vht_cap, 0, sizeof(IEEEtypes_VHTCap_t));
+		wlan_fill_vht_cap_ie(pmpriv, vht_cap, pbss_desc->bss_band);
+		if (ht_cap)
+			SETHT_SUPPCHANWIDTH(ht_cap->ht_cap.ht_cap_info);
+		DBG_HEXDUMP(MCMD_D, "TDLS vhtcap", tdls_ies->vht_cap,
+			    sizeof(IEEEtypes_VHTCap_t));
+	}
+	/** fill the vhtoperation based on hwspec */
+	if (tdls_ies->flags & TDLS_IE_FLAGS_VHTOPRAT) {
+		vht_oprat = (IEEEtypes_VHTOprat_t *)tdls_ies->vht_oprat;
+		memset(pmadapter, vht_oprat, 0, sizeof(IEEEtypes_VHTOprat_t));
+		if (sta_ptr &&
+		    (sta_ptr->vht_cap.ieee_hdr.element_id == VHT_CAPABILITY) &&
+		    (pbss_desc->bss_band & BAND_A)) {
+			wlan_fill_tdls_vht_oprat_ie(pmpriv, vht_oprat, sta_ptr);
+		}
+		if (sta_ptr)
+			memcpy_ext(pmadapter, &sta_ptr->vht_oprat,
+				   tdls_ies->vht_oprat,
+				   sizeof(IEEEtypes_VHTOprat_t),
+				   sizeof(IEEEtypes_VHTOprat_t));
+		DBG_HEXDUMP(MCMD_D, "TDLS vht_oprat", tdls_ies->vht_oprat,
+			    sizeof(IEEEtypes_VHTOprat_t));
+	}
+	/** fill the AID info */
+	if (tdls_ies->flags & TDLS_IE_FLAGS_AID) {
+		if (pmpriv->curr_bss_params.host_mlme)
+			passoc_rsp = (IEEEtypes_AssocRsp_t
+					      *)(pmpriv->assoc_rsp_buf +
+						 sizeof(IEEEtypes_MgmtHdr_t));
+		else
+			passoc_rsp =
+				(IEEEtypes_AssocRsp_t *)pmpriv->assoc_rsp_buf;
+		aid_info = (IEEEtypes_AID_t *)tdls_ies->aid_info;
+		memset(pmadapter, aid_info, 0, sizeof(IEEEtypes_AID_t));
+		aid_info->ieee_hdr.element_id = AID_INFO;
+		aid_info->ieee_hdr.len = sizeof(t_u16);
+		aid_info->AID = wlan_le16_to_cpu(passoc_rsp->a_id);
+		PRINTM(MCMND, "TDLS AID=0x%x\n", aid_info->AID);
+	}
+	/** fill the htinfo */
+	if (tdls_ies->flags & TDLS_IE_FLAGS_HTINFO) {
+		ht_info = (IEEEtypes_HTInfo_t *)tdls_ies->ht_info;
+		pbss_desc = &pmpriv->curr_bss_params.bss_descriptor;
+		ht_info->ieee_hdr.element_id = HT_OPERATION;
+		ht_info->ieee_hdr.len = sizeof(HTInfo_t);
+		ht_info->ht_info.pri_chan = pbss_desc->channel;
+		/* follow AP's channel bandwidth */
+		if (ISSUPP_CHANWIDTH40(usr_dot_11n_dev_cap) &&
+		    pbss_desc->pht_info &&
+		    ISALLOWED_CHANWIDTH40(
+			    pbss_desc->pht_info->ht_info.field2)) {
+			ht_info->ht_info.field2 =
+				pbss_desc->pht_info->ht_info.field2;
+		} else {
+			ht_info->ht_info.field2 =
+				wlan_get_second_channel_offset(
+					pbss_desc->channel);
+		}
+		if (vht_oprat &&
+		    vht_oprat->ieee_hdr.element_id == VHT_OPERATION) {
+			ht_info->ht_info.field2 =
+				wlan_get_second_channel_offset(
+					pbss_desc->channel);
+			ht_info->ht_info.field2 |= MBIT(2);
+		}
+		if (sta_ptr)
+			memcpy_ext(pmadapter, &sta_ptr->HTInfo,
+				   tdls_ies->ht_info,
+				   sizeof(IEEEtypes_HTInfo_t),
+				   sizeof(IEEEtypes_HTInfo_t));
+		DBG_HEXDUMP(MCMD_D, "TDLS htinfo", tdls_ies->ht_info,
+			    sizeof(IEEEtypes_HTInfo_t));
+	}
+
+	/** supported channels andl regulatory IE*/
+	if (pmpriv->host_tdls_cs_support &&
+	    (tdls_ies->flags & TDLS_IE_FLAGS_SUPP_CS_IE) &&
+	    !IS_EXTCAP_TDLS_CHLSWITCHPROHIB(ap_ext_cap)) {
+		/** supported channels IE*/
+		pSupp_chan = (IEEEtypes_Generic_t *)tdls_ies->supp_chan;
+		pSupp_chan->ieee_hdr.element_id = SUPPORTED_CHANNELS;
+		if (pmpriv->chan_supp_len) {
+			pSupp_chan->ieee_hdr.len = pmpriv->chan_supp_len;
+			memcpy_ext(pmadapter, pSupp_chan->data,
+				   pmpriv->chan_supp, pmpriv->chan_supp_len,
+				   sizeof(pSupp_chan->data));
+		} else {
+			pSupp_chan->ieee_hdr.len = sizeof(supp_chan);
+			memcpy_ext(pmadapter, pSupp_chan->data, supp_chan,
+				   sizeof(supp_chan), sizeof(pSupp_chan->data));
+		}
+		DBG_HEXDUMP(
+			MCMD_D, "TDLS supported channel", tdls_ies->supp_chan,
+			pSupp_chan->ieee_hdr.len + sizeof(IEEEtypes_Header_t));
+
+		/**fill supported Regulatory Class IE*/
+		pRegulatory_class =
+			(IEEEtypes_Generic_t *)tdls_ies->regulatory_class;
+		pRegulatory_class->ieee_hdr.element_id = REGULATORY_CLASS;
+		if (pmpriv->supp_regulatory_class_len) {
+			pRegulatory_class->ieee_hdr.len =
+				pmpriv->supp_regulatory_class_len;
+			memcpy_ext(pmadapter, pRegulatory_class->data,
+				   pmpriv->supp_regulatory_class,
+				   pmpriv->supp_regulatory_class_len,
+				   sizeof(pRegulatory_class->data));
+		} else {
+			pRegulatory_class->ieee_hdr.len =
+				sizeof(regulatory_class);
+			memcpy_ext(pmadapter, pRegulatory_class->data,
+				   regulatory_class, sizeof(regulatory_class),
+				   sizeof(pRegulatory_class->data));
+		}
+		DBG_HEXDUMP(MCMD_D, "TDLS supported regulatory class",
+			    tdls_ies->regulatory_class,
+			    pRegulatory_class->ieee_hdr.len +
+				    sizeof(IEEEtypes_Header_t));
+	}
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Set mimo switch configuration
  *
@@ -2540,6 +3449,16 @@ mlan_status wlan_process_802dot11_mgmt_pkt(mlan_private *priv, t_u8 *payload,
 			LEAVE();
 			return ret;
 		}
+		if ((category == CATEGORY_PUBLIC) &&
+		    (action_code == TDLS_DISCOVERY_RESPONSE)) {
+			pcb->moal_updata_peer_signal(pmadapter->pmoal_handle,
+						     priv->bss_index,
+						     pieee_pkt_hdr->addr2,
+						     prx_pd->snr, prx_pd->nf);
+			PRINTM(MINFO,
+			       "Rx: TDLS discovery response, nf=%d, snr=%d\n",
+			       prx_pd->nf, prx_pd->snr);
+		}
 		if (memcmp(pmadapter, pieee_pkt_hdr->addr1, broadcast,
 			   MLAN_MAC_ADDR_LENGTH))
 			unicast = MTRUE;
@@ -2735,6 +3654,8 @@ void wlan_add_ext_capa_info_ie(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 		SET_EXTCAP_EXT_CHANNEL_SWITCH(pmpriv->ext_cap);
 	else
 		RESET_EXTCAP_EXT_CHANNEL_SWITCH(pmpriv->ext_cap);
+	if (pbss_desc && pbss_desc->multi_bssid_ap)
+		SET_EXTCAP_MULTI_BSSID(pmpriv->ext_cap);
 	if (wlan_check_11ax_twt_supported(pmpriv, pbss_desc))
 		SET_EXTCAP_TWT_REQ(pmpriv->ext_cap);
 	memcpy_ext(pmpriv->adapter, &pext_cap->ext_cap, &pmpriv->ext_cap,
@@ -2920,6 +3841,17 @@ void wlan_check_sta_capability(pmlan_private priv, pmlan_buffer pevent,
 				    (priv->is_11ax_enabled == MTRUE)) {
 					PRINTM(MCMND, "STA supports 11ax\n");
 					sta_ptr->is_11ax_enabled = MTRUE;
+					memcpy_ext(
+						priv->adapter,
+						(t_u8 *)&sta_ptr->he_cap,
+						phe_cap,
+						phe_cap->ieee_hdr.len +
+							sizeof(IEEEtypes_Header_t),
+						sizeof(IEEEtypes_HECap_t));
+					sta_ptr->he_cap.ieee_hdr.len = MIN(
+						phe_cap->ieee_hdr.len,
+						sizeof(IEEEtypes_HECap_t) -
+							sizeof(IEEEtypes_Header_t));
 				} else {
 					PRINTM(MCMND,
 					       "STA doesn't support 11ax\n");
@@ -4372,8 +5304,8 @@ inline mlan_status mef_push(pmlan_adapter pmadapter, mef_stack *s, mef_op *op)
  *
  *  @return             MLAN_STATUS_SUCCESS or FAIL
  */
-mlan_status push_filter_dnum_eq(pmlan_adapter pmadapter, mef_stack *s,
-				mef_filter_t *filter)
+static mlan_status push_filter_dnum_eq(pmlan_adapter pmadapter, mef_stack *s,
+				       mef_filter_t *filter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 dnum;
@@ -4443,8 +5375,8 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS or FAIL
  */
-mlan_status push_filter_byte_eq(pmlan_adapter pmadapter, mef_stack *s,
-				mef_filter_t *filter)
+static mlan_status push_filter_byte_eq(pmlan_adapter pmadapter, mef_stack *s,
+				       mef_filter_t *filter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 dnum;
@@ -4515,8 +5447,8 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS or FAIL
  */
-mlan_status push_filter_bit_eq(pmlan_adapter pmadapter, mef_stack *s,
-			       mef_filter_t *filter)
+static mlan_status push_filter_bit_eq(pmlan_adapter pmadapter, mef_stack *s,
+				      mef_filter_t *filter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 dnum;
@@ -4588,8 +5520,8 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS or FAIL
  */
-mlan_status wlan_push_filter(pmlan_adapter pmadapter, mef_stack *s,
-			     mef_filter_t *filter)
+static mlan_status wlan_push_filter(pmlan_adapter pmadapter, mef_stack *s,
+				    mef_filter_t *filter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
@@ -4620,8 +5552,9 @@ mlan_status wlan_push_filter(pmlan_adapter pmadapter, mef_stack *s,
  *
  *  @return             MLAN_STATUS_SUCCESS or FAIL
  */
-mlan_status wlan_generate_mef_filter_stack(pmlan_adapter pmadapter,
-					   mef_stack *s, mef_entry_t *entry)
+static mlan_status wlan_generate_mef_filter_stack(pmlan_adapter pmadapter,
+						  mef_stack *s,
+						  mef_entry_t *entry)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mef_op op;
@@ -4660,7 +5593,7 @@ done:
  *  @return             MLAN_STATUS_SUCCESS or FAIL
  */
 mlan_status wlan_set_mef_entry(mlan_private *pmpriv, pmlan_adapter pmadapter,
-			       mef_cfg *pmef)
+			       mef_cfg_data *pmef)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_misc_cmd *hostcmd;
@@ -4750,7 +5683,7 @@ mlan_status wlan_process_mef_cfg_cmd(mlan_private *pmpriv,
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb;
-	mef_cfg mef;
+	mef_cfg_data mef;
 	mef_entry_t *pentry;
 	mef_entry *pmef;
 	t_u16 entry_num = 0;
@@ -5191,11 +6124,9 @@ mlan_status wlan_get_rgchnpwr_cfg(pmlan_adapter pmadapter,
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u16 cmd_action = 0;
-	mlan_ds_misc_cfg *misc = MNULL;
 
 	ENTER();
 
-	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
 	cmd_action = HostCmd_ACT_GEN_GET;
 
 	/* Send request to firmware */
@@ -5303,14 +6234,11 @@ mlan_status wlan_misc_ioctl_fw_dump_event(pmlan_adapter pmadapter,
 					  mlan_ioctl_req *pioctl_req)
 {
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_misc_cfg *misc = MNULL;
 	t_u16 cmd_action = 0;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
 
-	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
-
 	if (pioctl_req->action == MLAN_ACT_SET)
 		cmd_action = HostCmd_ACT_GEN_SET;
 	else if (pioctl_req->action == MLAN_ACT_GET)
@@ -5825,7 +6753,20 @@ mlan_status wlan_misc_ioctl_rf_test_cfg(pmlan_adapter pmadapter,
 				       cmd_action, 0, (t_void *)pioctl_req,
 				       &(pmisc->param.mfg_tx_frame2));
 		break;
+	case MLAN_OID_MISC_RF_TEST_HE_POWER:
+		if (pioctl_req->action == MLAN_ACT_SET)
+			cmd_action = HostCmd_ACT_GEN_SET;
+		else {
+			PRINTM(MERROR, "Unsupported cmd_action\n");
+			ret = MLAN_STATUS_FAILURE;
+			goto done;
+		}
+		ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_MFG_COMMAND,
+				       cmd_action, 0, (t_void *)pioctl_req,
+				       &(pmisc->param.mfg_he_power));
+		break;
 	}
+
 	if (ret == MLAN_STATUS_SUCCESS)
 		ret = MLAN_STATUS_PENDING;
 done:
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
index e28a0f7..c265f29 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
@@ -3,7 +3,7 @@
  *  @brief This file contains PCI-E specific code
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -67,7 +67,7 @@ static mlan_status wlan_pcie_delete_rxbd_ring(pmlan_adapter pmadapter);
 static mlan_status wlan_init_adma(mlan_adapter *pmadapter, t_u8 type,
 				  t_u64 pbase, t_u16 size, t_u8 init)
 {
-	t_u32 dma_cfg, dma_cfg2, int_mapping;
+	t_u32 dma_cfg, dma_cfg2, dma_cfg3, int_mapping;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 q_addr = 0;
 	t_u8 direction = 0;
@@ -158,6 +158,25 @@ static mlan_status wlan_init_adma(mlan_adapter *pmadapter, t_u8 type,
 					dma_cfg2 |=
 						ADMA_MSI_LEGACY_SRC_DMA_DONE_INT_BYPASS_EN;
 			} else {
+				/* Read the dma_cfg3 register */
+				if (pcb->moal_read_reg(pmadapter->pmoal_handle,
+						       q_addr + ADMA_DMA_CFG3,
+						       &dma_cfg3)) {
+					PRINTM(MERROR,
+					       "Fail to read DMA CFG3 register\n");
+					ret = MLAN_STATUS_FAILURE;
+					goto done;
+				}
+				dma_cfg3 |= ADMA_Q_PTR_CLR;
+				if (pcb->moal_write_reg(pmadapter->pmoal_handle,
+							q_addr + ADMA_DMA_CFG3,
+							(t_u32)dma_cfg3)) {
+					PRINTM(MERROR,
+					       "Failed to write ADMA_DMA_CFG3.\n");
+					ret = MLAN_STATUS_FAILURE;
+					goto done;
+				}
+
 				dma_cfg2 |= ADMA_DST_DMA_DONE_INT_BYPASS_EN;
 				if (pmadapter->pcard_pcie->pcie_int_mode !=
 				    PCIE_INT_MODE_MSIX)
@@ -545,7 +564,7 @@ wlan_pcie_enable_host_int_status_mask(mlan_adapter *pmadapter, t_u8 enable)
  *
  *  @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_disable_pcie_host_int(mlan_adapter *pmadapter)
+static mlan_status wlan_disable_pcie_host_int(mlan_adapter *pmadapter)
 {
 	mlan_status ret;
 
@@ -578,7 +597,7 @@ mlan_status wlan_disable_pcie_host_int(mlan_adapter *pmadapter)
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_clear_pending_int_status(mlan_adapter *pmadapter)
+static mlan_status wlan_clear_pending_int_status(mlan_adapter *pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 pcie_ireg = 0;
@@ -621,7 +640,7 @@ done:
  *
  *  @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_enable_pcie_host_int(mlan_adapter *pmadapter)
+static mlan_status wlan_enable_pcie_host_int(mlan_adapter *pmadapter)
 {
 	mlan_status ret;
 
@@ -680,13 +699,15 @@ static mlan_status wlan_pcie_create_txbd_ring(mlan_adapter *pmadapter)
 #if defined(PCIE8997) || defined(PCIE8897)
 	if (!pmadapter->pcard_pcie->reg->use_adma)
 		pmadapter->pcard_pcie->txbd_ring_size =
-			sizeof(mlan_pcie_data_buf) * MLAN_MAX_TXRX_BD;
+			sizeof(mlan_pcie_data_buf) *
+			pmadapter->pcard_pcie->reg->txrx_bd_size;
 #endif
 
 #if defined(PCIE9098) || defined(PCIE9097)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		pmadapter->pcard_pcie->txbd_ring_size =
-			sizeof(adma_dual_desc_buf) * MLAN_MAX_TXRX_BD;
+			sizeof(adma_dual_desc_buf) *
+			pmadapter->pcard_pcie->reg->txrx_bd_size;
 #endif
 	PRINTM(MINFO, "TX ring: allocating %d bytes\n",
 	       pmadapter->pcard_pcie->txbd_ring_size);
@@ -711,7 +732,7 @@ static mlan_status wlan_pcie_create_txbd_ring(mlan_adapter *pmadapter)
 	       (t_u32)pmadapter->pcard_pcie->txbd_ring_pbase,
 	       pmadapter->pcard_pcie->txbd_ring_size);
 
-	for (i = 0; i < MLAN_MAX_TXRX_BD; i++) {
+	for (i = 0; i < pmadapter->pcard_pcie->reg->txrx_bd_size; i++) {
 		pmadapter->pcard_pcie->tx_buf_list[i] = MNULL;
 #if defined(PCIE9098) || defined(PCIE9097)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
@@ -774,7 +795,7 @@ static mlan_status wlan_pcie_delete_txbd_ring(mlan_adapter *pmadapter)
 
 	ENTER();
 
-	for (i = 0; i < MLAN_MAX_TXRX_BD; i++) {
+	for (i = 0; i < pmadapter->pcard_pcie->reg->txrx_bd_size; i++) {
 		if (pmadapter->pcard_pcie->tx_buf_list[i]) {
 			pmbuf = pmadapter->pcard_pcie->tx_buf_list[i];
 			pcb->moal_unmap_memory(pmadapter->pmoal_handle,
@@ -873,7 +894,8 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 		/* allocate shared memory for the BD ring and divide the same in
 		to several descriptors */
 		pmadapter->pcard_pcie->rxbd_ring_size =
-			sizeof(mlan_pcie_data_buf) * MLAN_MAX_TXRX_BD;
+			sizeof(mlan_pcie_data_buf) *
+			pmadapter->pcard_pcie->reg->txrx_bd_size;
 	}
 #endif
 
@@ -881,12 +903,14 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 	/*
 	 * driver maintaines the write pointer and firmware maintaines the read
 	 * pointer. The read pointer starts at 0 (zero) while the write pointer
-	 * starts at MLAN_MAX_TXRX_BD
+	 * starts at pmadapter->pcard_pcie->reg->txrx_bd_size;
 	 */
 	if (pmadapter->pcard_pcie->reg->use_adma) {
-		pmadapter->pcard_pcie->rxbd_wrptr = MLAN_MAX_TXRX_BD;
+		pmadapter->pcard_pcie->rxbd_wrptr =
+			pmadapter->pcard_pcie->reg->txrx_bd_size;
 		pmadapter->pcard_pcie->rxbd_ring_size =
-			sizeof(adma_dual_desc_buf) * MLAN_MAX_TXRX_BD;
+			sizeof(adma_dual_desc_buf) *
+			pmadapter->pcard_pcie->reg->txrx_bd_size;
 	}
 #endif
 
@@ -913,7 +937,7 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 	       (t_u32)pmadapter->pcard_pcie->rxbd_ring_pbase,
 	       pmadapter->pcard_pcie->rxbd_ring_size);
 
-	for (i = 0; i < MLAN_MAX_TXRX_BD; i++) {
+	for (i = 0; i < pmadapter->pcard_pcie->reg->txrx_bd_size; i++) {
 		/* Allocate buffer here so that firmware can DMA data on it */
 		pmbuf = wlan_alloc_mlan_buffer(pmadapter, MLAN_RX_DATA_BUF_SIZE,
 					       MLAN_RX_HEADER_LEN,
@@ -1008,7 +1032,7 @@ static mlan_status wlan_pcie_delete_rxbd_ring(mlan_adapter *pmadapter)
 #endif
 
 	ENTER();
-	for (i = 0; i < MLAN_MAX_TXRX_BD; i++) {
+	for (i = 0; i < pmadapter->pcard_pcie->reg->txrx_bd_size; i++) {
 		if (pmadapter->pcard_pcie->rx_buf_list[i]) {
 			pmbuf = pmadapter->pcard_pcie->rx_buf_list[i];
 			pcb->moal_unmap_memory(pmadapter->pmoal_handle,
@@ -1462,7 +1486,7 @@ static t_u8 wlan_check_tx_pending_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
  */
 static mlan_status wlan_pcie_send_data_complete(mlan_adapter *pmadapter)
 {
-	const t_u32 num_tx_buffs = MLAN_MAX_TXRX_BD;
+	const t_u32 num_tx_buffs = pmadapter->pcard_pcie->reg->txrx_bd_size;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	mlan_buffer *pmbuf;
@@ -1659,7 +1683,7 @@ static mlan_status wlan_pcie_send_data(mlan_adapter *pmadapter, t_u8 type,
 #if defined(PCIE9098) || defined(PCIE9097)
 	adma_dual_desc_buf *padma_bd_buf = MNULL;
 #endif
-	const t_u32 num_tx_buffs = MLAN_MAX_TXRX_BD;
+	const t_u32 num_tx_buffs = pmadapter->pcard_pcie->reg->txrx_bd_size;
 	mlan_status ret = MLAN_STATUS_PENDING;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	t_u32 rxbd_val = 0;
@@ -1777,6 +1801,10 @@ static mlan_status wlan_pcie_send_data(mlan_adapter *pmadapter, t_u8 type,
 
 		if (wlan_check_txbd_not_full(pmadapter))
 			pmadapter->data_sent = MFALSE;
+		else
+			wlan_pcie_send_data_complete(pmadapter);
+		if (pmadapter->data_sent)
+			pmadapter->data_sent_cnt++;
 
 		PRINTM(MINFO, "Sent packet to firmware successfully\n");
 	} else {
@@ -1875,6 +1903,56 @@ static t_u8 wlan_check_rx_pending_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
 	return MFALSE;
 }
 
+/**
+ *  @brief This function check if the rx pending buffer is full
+ *
+ *  @param pmadapter  A pointer to mlan_adapter structure
+ *  @param rdptr           rx rdptr
+ *  @param rxbd_rdptr      rxbd_rdptr
+ *
+ *  @return           MTRUE/MFALSE;
+ */
+static t_u8 wlan_is_rx_pending_full(mlan_adapter *pmadapter, t_u32 rdptr)
+{
+#if defined(PCIE8997) || defined(PCIE8897)
+	t_u32 txrx_rw_ptr_mask = pmadapter->pcard_pcie->reg->txrx_rw_ptr_mask;
+	t_u32 txrx_rw_ptr_rollover_ind =
+		pmadapter->pcard_pcie->reg->txrx_rw_ptr_rollover_ind;
+	if (!pmadapter->pcard_pcie->reg->use_adma) {
+		PRINTM(MDATA,
+		       "local wrptr: 0x%x(0x%x) -> reg rdptr: 0x%x(0x%x)\n",
+		       (pmadapter->pcard_pcie->rxbd_wrptr & txrx_rw_ptr_mask),
+		       (pmadapter->pcard_pcie->rxbd_wrptr &
+			txrx_rw_ptr_rollover_ind),
+		       (rdptr & txrx_rw_ptr_mask),
+		       (rdptr & txrx_rw_ptr_rollover_ind));
+		if (((rdptr & txrx_rw_ptr_mask) ==
+		     (pmadapter->pcard_pcie->rxbd_wrptr & txrx_rw_ptr_mask)) &&
+		    ((rdptr & txrx_rw_ptr_rollover_ind) ==
+		     (pmadapter->pcard_pcie->rxbd_wrptr &
+		      txrx_rw_ptr_rollover_ind)))
+			return MTRUE;
+		else
+			return MFALSE;
+	}
+#endif
+
+#if defined(PCIE9098) || defined(PCIE9097)
+	if (pmadapter->pcard_pcie->reg->use_adma) {
+		PRINTM(MDATA, "local wrptr: 0x%x -> reg rdptr: 0x%x\n",
+		       (pmadapter->pcard_pcie->rxbd_wrptr &
+			ADMA_RW_PTR_WRAP_MASK),
+		       (rdptr & ADMA_RW_PTR_WRAP_MASK));
+		if ((rdptr & ADMA_RW_PTR_WRAP_MASK) ==
+		    (pmadapter->pcard_pcie->rxbd_wrptr & ADMA_RW_PTR_WRAP_MASK))
+			return MTRUE;
+		else
+			return MFALSE;
+	}
+#endif
+	return MFALSE;
+}
+
 /**
  *  @brief This function handles received buffer ring and
  *  dispatches packets to upper
@@ -1891,7 +1969,7 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 	mlan_buffer *pmbuf = MNULL;
 	t_u32 txbd_val = 0;
 	t_u16 rx_len, rx_type;
-	const t_u32 num_rx_buffs = MLAN_MAX_TXRX_BD;
+	const t_u32 num_rx_buffs = pmadapter->pcard_pcie->reg->txrx_bd_size;
 	t_u32 reg_rxbd_rdptr = pmadapter->pcard_pcie->reg->reg_rxbd_rdptr;
 #if defined(PCIE8997) || defined(PCIE8897)
 	t_u32 txrx_rw_ptr_mask = pmadapter->pcard_pcie->reg->txrx_rw_ptr_mask;
@@ -1902,6 +1980,7 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 #if defined(PCIE9098) || defined(PCIE9097)
 	adma_dual_desc_buf *padma_bd_buf;
 #endif
+	t_u32 in_ts_sec, in_ts_usec;
 
 	ENTER();
 
@@ -1917,17 +1996,23 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 		rdptr = rdptr >> ADMA_RPTR_START;
 #endif
 
+	if (pmadapter->tp_state_on &&
+	    wlan_is_rx_pending_full(pmadapter, rdptr)) {
+		PRINTM(MDATA, "RX FULL!\n");
+		pmadapter->callbacks.moal_tp_accounting_rx_param(
+			pmadapter->pmoal_handle, 6, 0);
+	}
 	while (wlan_check_rx_pending_buffer(pmadapter, rdptr)) {
 		/* detach pmbuf (with data) from Rx Ring */
 		rd_index =
 			pmadapter->pcard_pcie->rxbd_rdptr & (num_rx_buffs - 1);
-		if (rd_index > MLAN_MAX_TXRX_BD - 1) {
+		if (rd_index >
+		    (t_u32)(pmadapter->pcard_pcie->reg->txrx_bd_size - 1)) {
 			PRINTM(MERROR, "RECV DATA: Invalid Rx buffer index.\n");
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
 		pmbuf = pmadapter->pcard_pcie->rx_buf_list[rd_index];
-
 		if (MLAN_STATUS_FAILURE ==
 		    pcb->moal_unmap_memory(pmadapter->pmoal_handle,
 					   pmbuf->pbuf + pmbuf->data_offset,
@@ -1960,10 +2045,16 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 			pmbuf->data_len = rx_len - PCIE_INTF_HEADER_LEN;
 			pmbuf->data_offset += PCIE_INTF_HEADER_LEN;
 			// rx_trace 5
-			if (pmadapter->tp_state_on)
+			if (pmadapter->tp_state_on) {
 				pmadapter->callbacks.moal_tp_accounting(
 					pmadapter->pmoal_handle, pmbuf,
 					5 /*RX_DROP_P1*/);
+				pcb->moal_get_system_time(
+					pmadapter->pmoal_handle, &in_ts_sec,
+					&in_ts_usec);
+				pmbuf->in_ts_sec = in_ts_sec;
+				pmbuf->in_ts_usec = in_ts_usec;
+			}
 			if (pmadapter->tp_state_drop_point ==
 			    5 /*RX_DROP_P1*/) {
 				pmadapter->ops.data_complete(pmadapter, pmbuf,
@@ -1979,9 +2070,13 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 					&pmadapter->rx_data_queue,
 					(pmlan_linked_list)pmbuf, MNULL, MNULL);
 				pmadapter->rx_pkts_queued++;
-				pmadapter->callbacks.moal_tp_accounting_rx_param(
-					pmadapter->pmoal_handle, 1,
-					pmadapter->rx_pkts_queued);
+				if (pmadapter->tp_state_on)
+					pmadapter->callbacks
+						.moal_tp_accounting_rx_param(
+							pmadapter->pmoal_handle,
+							1,
+							pmadapter
+								->rx_pkts_queued);
 				pmadapter->callbacks.moal_spin_unlock(
 					pmadapter->pmoal_handle,
 					pmadapter->rx_data_queue.plock);
@@ -2031,7 +2126,8 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 
 			/* update rxbd's rdptrs */
 			if ((++pmadapter->pcard_pcie->rxbd_rdptr &
-			     txrx_rw_ptr_mask) == MLAN_MAX_TXRX_BD) {
+			     txrx_rw_ptr_mask) ==
+			    pmadapter->pcard_pcie->reg->txrx_bd_size) {
 				pmadapter->pcard_pcie->rxbd_rdptr =
 					((pmadapter->pcard_pcie->rxbd_rdptr &
 					  txrx_rw_ptr_rollover_ind) ^
@@ -2040,7 +2136,8 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 
 			/* update rxbd's wrptrs */
 			if ((++pmadapter->pcard_pcie->rxbd_wrptr &
-			     txrx_rw_ptr_mask) == MLAN_MAX_TXRX_BD) {
+			     txrx_rw_ptr_mask) ==
+			    pmadapter->pcard_pcie->reg->txrx_bd_size) {
 				pmadapter->pcard_pcie->rxbd_wrptr =
 					((pmadapter->pcard_pcie->rxbd_wrptr &
 					  txrx_rw_ptr_rollover_ind) ^
@@ -2439,8 +2536,9 @@ done:
  *
  *  @return 	        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pcie_cmdrsp_complete(mlan_adapter *pmadapter,
-				      mlan_buffer *pmbuf, mlan_status status)
+static mlan_status wlan_pcie_cmdrsp_complete(mlan_adapter *pmadapter,
+					     mlan_buffer *pmbuf,
+					     mlan_status status)
 {
 	mlan_buffer *pcmdmbuf;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -2659,8 +2757,9 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)
  *
  *  @return 	        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pcie_event_complete(mlan_adapter *pmadapter,
-				     mlan_buffer *pmbuf, mlan_status status)
+static mlan_status wlan_pcie_event_complete(mlan_adapter *pmadapter,
+					    mlan_buffer *pmbuf,
+					    mlan_status status)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -2936,7 +3035,7 @@ static mlan_status wlan_pcie_prog_fw_w_helper(mlan_adapter *pmadapter,
 	t_u32 firmware_len = fw->fw_len;
 	t_u32 offset = 0;
 	mlan_buffer *pmbuf = MNULL;
-	t_u32 txlen, tx_blocks = 0, tries, len;
+	t_u32 txlen, tries, len;
 	t_u32 block_retry_cnt = 0;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 #if defined(PCIE9098)
@@ -3095,9 +3194,6 @@ static mlan_status wlan_pcie_prog_fw_w_helper(mlan_adapter *pmadapter,
 
 			PRINTM(MINFO, ".");
 
-			tx_blocks = (txlen + MLAN_PCIE_BLOCK_SIZE_FW_DNLD - 1) /
-				    MLAN_PCIE_BLOCK_SIZE_FW_DNLD;
-
 			/* Copy payload to buffer */
 			memmove(pmadapter, pmbuf->pbuf + pmbuf->data_offset,
 				&firmware[offset], txlen);
@@ -3261,7 +3357,7 @@ mlan_status wlan_pcie_wakeup(mlan_adapter *pmadapter)
  *  @param pmadapter  A pointer to mlan_adapter structure
  *  @return         MLAN_STATUS_FAILURE -- if the intererupt is not for us
  */
-mlan_status wlan_pcie_interrupt(t_u16 msg_id, pmlan_adapter pmadapter)
+static mlan_status wlan_pcie_interrupt(t_u16 msg_id, pmlan_adapter pmadapter)
 {
 	t_u32 pcie_ireg;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -3411,7 +3507,7 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
+static mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 pcie_ireg = 0;
@@ -3468,6 +3564,9 @@ mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
 			pcie_ireg &=
 				~pmadapter->pcard_pcie->reg->host_intr_dnld_done;
 			PRINTM(MINFO, "<--- DATA sent Interrupt --->\n");
+			pmadapter->callbacks.moal_tp_accounting_rx_param(
+				pmadapter->pmoal_handle, 3, 0);
+
 			ret = wlan_pcie_send_data_complete(pmadapter);
 			if (ret)
 				goto done;
@@ -3609,7 +3708,8 @@ mlan_status wlan_set_drv_ready_reg(mlan_adapter *pmadapter, t_u32 val)
  *  @return           MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  *
  */
-mlan_status wlan_pcie_check_winner_status(mlan_adapter *pmadapter, t_u32 *val)
+static mlan_status wlan_pcie_check_winner_status(mlan_adapter *pmadapter,
+						 t_u32 *val)
 {
 	t_u32 winner = 0;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -3638,7 +3738,8 @@ mlan_status wlan_pcie_check_winner_status(mlan_adapter *pmadapter, t_u32 *val)
  *
  *  @return           MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pcie_check_fw_status(mlan_adapter *pmadapter, t_u32 pollnum)
+static mlan_status wlan_pcie_check_fw_status(mlan_adapter *pmadapter,
+					     t_u32 pollnum)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -3699,7 +3800,8 @@ mlan_status wlan_pcie_init(mlan_adapter *pmadapter)
  *
  *  @return		MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pcie_dnld_fw(pmlan_adapter pmadapter, pmlan_fw_image pmfw)
+static mlan_status wlan_pcie_dnld_fw(pmlan_adapter pmadapter,
+				     pmlan_fw_image pmfw)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 poll_num = 1;
@@ -4035,12 +4137,12 @@ mlan_status wlan_set_pcie_buf_config(mlan_private *pmpriv)
 			(t_u32)(pmadapter->pcard_pcie->txbd_ring_pbase);
 		host_spec.txbd_addr_hi = (t_u32)(
 			((t_u64)pmadapter->pcard_pcie->txbd_ring_pbase) >> 32);
-		host_spec.txbd_count = MLAN_MAX_TXRX_BD;
+		host_spec.txbd_count = pmadapter->pcard_pcie->reg->txrx_bd_size;
 		host_spec.rxbd_addr_lo =
 			(t_u32)(pmadapter->pcard_pcie->rxbd_ring_pbase);
 		host_spec.rxbd_addr_hi = (t_u32)(
 			((t_u64)pmadapter->pcard_pcie->rxbd_ring_pbase) >> 32);
-		host_spec.rxbd_count = MLAN_MAX_TXRX_BD;
+		host_spec.rxbd_count = pmadapter->pcard_pcie->reg->txrx_bd_size;
 		host_spec.evtbd_addr_lo =
 			(t_u32)(pmadapter->pcard_pcie->evtbd_ring_pbase);
 		host_spec.evtbd_addr_hi = (t_u32)(
@@ -4128,7 +4230,8 @@ mlan_status wlan_cmd_pcie_host_buf_cfg(pmlan_private pmpriv,
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pm_pcie_wakeup_card(pmlan_adapter pmadapter, t_u8 timeout)
+static mlan_status wlan_pm_pcie_wakeup_card(pmlan_adapter pmadapter,
+					    t_u8 timeout)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 age_ts_usec;
@@ -4152,7 +4255,7 @@ mlan_status wlan_pm_pcie_wakeup_card(pmlan_adapter pmadapter, t_u8 timeout)
 	return ret;
 }
 
-mlan_status wlan_pcie_debug_dump(pmlan_adapter pmadapter)
+static mlan_status wlan_pcie_debug_dump(pmlan_adapter pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_buffer pmbuf = pmadapter->pcard_pcie->cmdrsp_buf;
@@ -4178,8 +4281,9 @@ mlan_status wlan_pcie_debug_dump(pmlan_adapter pmadapter)
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return          N/A
  */
-mlan_status wlan_pcie_data_complete(pmlan_adapter pmadapter, mlan_buffer *pmbuf,
-				    mlan_status status)
+static mlan_status wlan_pcie_data_complete(pmlan_adapter pmadapter,
+					   mlan_buffer *pmbuf,
+					   mlan_status status)
 {
 	ENTER();
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_pcie.h b/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
index 0fc42ce..b26d01f 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
@@ -4,7 +4,7 @@
  *  driver.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -135,6 +135,8 @@ Change log:
 
 /** DMA cfg3 register */
 #define ADMA_DMA_CFG3 0x0040
+/** ADMA Queue pointer clear */
+#define ADMA_Q_PTR_CLR MBIT(0)
 /** source rd ptr address low */
 #define ADMA_SRC_RD_PTR_LOW 0x0044
 /** source rd ptr address high */
@@ -152,9 +154,9 @@ Change log:
 /** write pointer start from bit 0 */
 #define ADMA_WPTR_START 0
 /** Tx/Rx Read/Write pointer's mask */
-#define TXRX_RW_PTR_MASK (MLAN_MAX_TXRX_BD - 1)
+#define TXRX_RW_PTR_MASK (ADMA_MAX_TXRX_BD - 1)
 /** Tx/Rx Read/Write pointer's rollover indicate bit */
-#define TXRX_RW_PTR_ROLLOVER_IND MLAN_MAX_TXRX_BD
+#define TXRX_RW_PTR_ROLLOVER_IND ADMA_MAX_TXRX_BD
 /** Start of packet flag */
 #define ADMA_BD_FLAG_SOP MBIT(0)
 /** End of packet flag */
@@ -485,6 +487,7 @@ static const struct _mlan_pcie_card_reg mlan_reg_pcie8897 = {
 	.txrx_rw_ptr_rollover_ind = MBIT(10),
 	.use_adma = MFALSE,
 	.msi_int_wr_clr = MTRUE,
+	.txrx_bd_size = MAX_TXRX_BD,
 };
 
 static const struct _mlan_card_info mlan_card_info_pcie8897 = {
@@ -524,6 +527,7 @@ static const struct _mlan_pcie_card_reg mlan_reg_pcie8997 = {
 	.txrx_rw_ptr_rollover_ind = MBIT(12),
 	.use_adma = MFALSE,
 	.msi_int_wr_clr = MTRUE,
+	.txrx_bd_size = MAX_TXRX_BD,
 };
 
 static const struct _mlan_card_info mlan_card_info_pcie8997 = {
@@ -565,6 +569,7 @@ static const struct _mlan_pcie_card_reg mlan_reg_pcie9098 = {
 	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
 	.use_adma = MTRUE,
 	.msi_int_wr_clr = MTRUE,
+	.txrx_bd_size = ADMA_MAX_TXRX_BD,
 };
 
 static const struct _mlan_card_info mlan_card_info_pcie9098 = {
@@ -607,8 +612,12 @@ static const struct _mlan_pcie_card_reg mlan_reg_pcie9097_b0 = {
 	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
 	.use_adma = MTRUE,
 	.msi_int_wr_clr = MTRUE,
+	.txrx_bd_size = ADMA_MAX_TXRX_BD,
 };
 #endif
+
+extern mlan_adapter_operations mlan_pcie_ops;
+
 /* Get pcie device from card type */
 mlan_status wlan_get_pcie_device(pmlan_adapter pmadapter);
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_scan.c b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
index 33f1acb..fccb410 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_scan.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
@@ -6,7 +6,7 @@
  *  for sending scan commands to the firmware.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -124,7 +124,7 @@ enum cipher_suite {
 	CIPHER_SUITE_MAX
 };
 
-static t_u8 wpa_oui[CIPHER_SUITE_MAX][4] = {
+static t_u8 wpa_ouis[CIPHER_SUITE_MAX][4] = {
 	{0x00, 0x50, 0xf2, 0x01}, /* WEP40 */
 	{0x00, 0x50, 0xf2, 0x02}, /* TKIP */
 	{0x00, 0x50, 0xf2, 0x04}, /* AES */
@@ -175,8 +175,9 @@ t_u8 radio_type_to_band(t_u8 radio_type)
  *
  *  @return                NA
  */
-void wlan_update_chan_statistics(mlan_private *pmpriv,
-				 MrvlIEtypes_ChannelStats_t *pchanstats_tlv)
+static void
+wlan_update_chan_statistics(mlan_private *pmpriv,
+			    MrvlIEtypes_ChannelStats_t *pchanstats_tlv)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	t_u8 i;
@@ -351,7 +352,7 @@ static t_u8 is_wpa_oui_present(mlan_adapter *pmadapter,
 	if (((pbss_desc->pwpa_ie) &&
 	     ((*(pbss_desc->pwpa_ie)).vend_hdr.element_id == WPA_IE))) {
 		ie_body = (IEBody *)pbss_desc->pwpa_ie->data;
-		oui = &wpa_oui[cipher_suite][0];
+		oui = &wpa_ouis[cipher_suite][0];
 		ret = search_oui_in_ie(pmadapter, ie_body, oui);
 		if (ret) {
 			LEAVE();
@@ -2069,6 +2070,13 @@ static mlan_status wlan_interpret_bss_desc_with_ie(pmlan_adapter pmadapter,
 				(*(pbss_entry->pwapi_ie)).ieee_hdr.len +
 					sizeof(IEEEtypes_Header_t));
 			break;
+		case MULTI_BSSID:
+			if (IS_FW_SUPPORT_MULTIBSSID(pmadapter)) {
+				pbss_entry->multi_bssid_ap = MULTI_BSSID_AP;
+				HEXDUMP("InterpretIE: Multi BSSID IE",
+					(t_u8 *)pcurrent_ptr, total_ie_len);
+			}
+			break;
 		case HT_CAPABILITY:
 			pbss_entry->pht_cap = (IEEEtypes_HTCap_t *)pcurrent_ptr;
 			pbss_entry->ht_cap_offset =
@@ -2962,7 +2970,7 @@ static t_u16 wlan_get_chan_load(mlan_adapter *pmadapter, t_u8 channel)
 {
 	t_u16 chan_load = 0;
 	int i;
-	for (i = 0; i < pmadapter->num_in_chan_stats; i++) {
+	for (i = 0; i < (int)pmadapter->num_in_chan_stats; i++) {
 		if ((pmadapter->pchan_stats[i].chan_num == channel) &&
 		    pmadapter->pchan_stats[i].cca_scan_duration) {
 			chan_load =
@@ -2988,7 +2996,7 @@ static t_u8 wlan_get_chan_rssi(mlan_adapter *pmadapter, t_u8 channel,
 {
 	t_u8 rssi = 0;
 	int i;
-	for (i = 0; i < pmadapter->num_in_scan_table; i++) {
+	for (i = 0; i < (int)pmadapter->num_in_scan_table; i++) {
 		if (pmadapter->pscan_table[i].channel == channel) {
 			if (rssi == 0)
 				rssi = (t_s32)pmadapter->pscan_table[i].rssi;
@@ -3019,7 +3027,7 @@ static t_void wlan_update_chan_rssi(mlan_adapter *pmadapter)
 	t_s8 min_rssi = 0;
 	t_s8 max_rssi = 0;
 	t_s8 rss = 0;
-	for (i = 0; i < pmadapter->num_in_chan_stats; i++) {
+	for (i = 0; i < (int)pmadapter->num_in_chan_stats; i++) {
 		if (pmadapter->pchan_stats[i].chan_num &&
 		    pmadapter->pchan_stats[i].cca_scan_duration) {
 			min_rssi = -wlan_get_chan_rssi(
@@ -4178,8 +4186,8 @@ mlan_status wlan_cmd_802_11_scan(mlan_private *pmpriv, HostCmd_DS_COMMAND *pcmd,
  *  @return             MTRUE/MFALSE
  */
 
-t_bool wlan_active_scan_req_for_passive_chan(mlan_private *pmpriv,
-					     mlan_ioctl_req *pioctl_buf)
+static t_bool wlan_active_scan_req_for_passive_chan(mlan_private *pmpriv,
+						    mlan_ioctl_req *pioctl_buf)
 {
 	t_bool ret = MFALSE;
 	mlan_adapter *pmadapter = pmpriv->adapter;
@@ -4763,6 +4771,11 @@ mlan_status wlan_cmd_802_11_scan_ext(mlan_private *pmpriv,
 			return MLAN_STATUS_SUCCESS;
 		}
 	}
+	if (!pdata_buf) {
+		PRINTM(MERROR, "wlan_cmd_802_11_scan_ext: pdata_buf is null\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
 	pscan_cfg = (wlan_scan_cmd_config *)pdata_buf;
 
 	memcpy_ext(pmpriv->adapter, pext_scan_cmd->tlv_buffer,
@@ -4866,9 +4879,9 @@ mlan_status wlan_ret_802_11_scan_ext(mlan_private *pmpriv,
  *
  *  @return             N/A
  */
-t_void wlan_add_new_entry_to_scan_table(mlan_private *pmpriv,
-					BSSDescriptor_t *bss_new_entry,
-					t_u32 *num_in_tbl)
+static t_void wlan_add_new_entry_to_scan_table(mlan_private *pmpriv,
+					       BSSDescriptor_t *bss_new_entry,
+					       t_u32 *num_in_tbl)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	t_u32 bss_idx;
@@ -4959,6 +4972,360 @@ done:
 	return;
 }
 
+/** 8 bytes timestamp, 2 bytest interval, 2 bytes capability */
+#define BEACON_FIX_SIZE 12
+
+/**
+ *  @brief This function realloc the beacon buffer and update ssid for new entry
+ *
+ *  @param pmadpater        A pointer to mlan_adapter structure
+ *  @param pbss_entry       A pointer to the bss_entry which has multi-bssid IE
+ *  @param pnew_entry       A pinter to new entry
+ *  @param pssid            A pointer to ssid IE
+ *
+ *  @return                MLAN_STATUS_FAILURE/MLAN_STATUS_SUCCESS
+ */
+static mlan_status wlan_update_ssid_in_beacon_buf(mlan_adapter *pmadapter,
+						  BSSDescriptor_t *pbss_entry,
+						  BSSDescriptor_t *pnew_entry,
+						  IEEEtypes_Ssid_t *pssid)
+{
+	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
+	t_u8 *pbeacon_buf = MNULL;
+	t_u32 beacon_buf_size = 0;
+	t_s8 offset = pnew_entry->ssid.ssid_len - pbss_entry->ssid.ssid_len;
+	mlan_status ret = MLAN_STATUS_FAILURE;
+
+	if (pnew_entry->ssid.ssid_len >= pbss_entry->ssid.ssid_len)
+		beacon_buf_size =
+			pbss_entry->beacon_buf_size +
+			(pnew_entry->ssid.ssid_len - pbss_entry->ssid.ssid_len);
+	else
+		beacon_buf_size =
+			pbss_entry->beacon_buf_size -
+			(pbss_entry->ssid.ssid_len - pnew_entry->ssid.ssid_len);
+
+	ret = pcb->moal_malloc(pmadapter->pmoal_handle, beacon_buf_size,
+			       MLAN_MEM_DEF, (t_u8 **)&pbeacon_buf);
+	if (ret != MLAN_STATUS_SUCCESS || !pbeacon_buf) {
+		PRINTM(MERROR,
+		       "Memory allocation for beacon buf for bss_new_entry\n");
+		goto done;
+	}
+	pnew_entry->beacon_buf_size = beacon_buf_size;
+	pnew_entry->pbeacon_buf = pbeacon_buf;
+	/** copy fixed IE */
+	memcpy_ext(pmadapter, pbeacon_buf, pbss_entry->pbeacon_buf,
+		   BEACON_FIX_SIZE, BEACON_FIX_SIZE);
+	/** copy new ssid ie */
+	memcpy_ext(pmadapter, pbeacon_buf + BEACON_FIX_SIZE, (t_u8 *)pssid,
+		   pssid->len + sizeof(IEEEtypes_Header_t),
+		   pssid->len + sizeof(IEEEtypes_Header_t));
+	/** copy left IE to new beacon buffer */
+	memcpy_ext(pmadapter,
+		   pbeacon_buf + BEACON_FIX_SIZE + pssid->len +
+			   sizeof(IEEEtypes_Header_t),
+		   pbss_entry->pbeacon_buf + BEACON_FIX_SIZE +
+			   pbss_entry->ssid.ssid_len +
+			   sizeof(IEEEtypes_Header_t),
+		   pbss_entry->beacon_buf_size - BEACON_FIX_SIZE -
+			   (pbss_entry->ssid.ssid_len +
+			    sizeof(IEEEtypes_Header_t)),
+		   pbss_entry->beacon_buf_size - BEACON_FIX_SIZE -
+			   (pbss_entry->ssid.ssid_len +
+			    sizeof(IEEEtypes_Header_t)));
+
+	/* adjust the ie pointer */
+	if (pnew_entry->pwpa_ie)
+		pnew_entry->wpa_offset += offset;
+	if (pnew_entry->prsn_ie)
+		pnew_entry->rsn_offset += offset;
+	if (pnew_entry->pwapi_ie)
+		pnew_entry->wapi_offset += offset;
+
+	if (pnew_entry->posen_ie)
+		pnew_entry->osen_offset += offset;
+	if (pnew_entry->pmd_ie)
+		pnew_entry->md_offset += offset;
+	if (pnew_entry->pht_cap)
+		pnew_entry->ht_cap_offset += offset;
+	if (pnew_entry->pht_info)
+		pnew_entry->ht_info_offset += offset;
+	if (pnew_entry->pbss_co_2040)
+		pnew_entry->bss_co_2040_offset += offset;
+	if (pnew_entry->pext_cap)
+		pnew_entry->ext_cap_offset += offset;
+	if (pnew_entry->poverlap_bss_scan_param)
+		pnew_entry->overlap_bss_offset += offset;
+	if (pnew_entry->pvht_cap)
+		pnew_entry->vht_cap_offset += offset;
+	if (pnew_entry->pvht_oprat)
+		pnew_entry->vht_oprat_offset += offset;
+	if (pnew_entry->pvht_txpower)
+		pnew_entry->vht_txpower_offset += offset;
+	if (pnew_entry->pext_pwer)
+		pnew_entry->ext_pwer_offset += offset;
+	if (pnew_entry->pext_bssload)
+		pnew_entry->ext_bssload_offset += offset;
+	if (pnew_entry->pquiet_chan)
+		pnew_entry->quiet_chan_offset += offset;
+	if (pnew_entry->poper_mode)
+		pnew_entry->oper_mode_offset += offset;
+	if (pnew_entry->phe_cap)
+		pnew_entry->he_cap_offset += offset;
+	if (pnew_entry->phe_oprat)
+		pnew_entry->he_oprat_offset += offset;
+	ret = MLAN_STATUS_SUCCESS;
+done:
+	return ret;
+}
+
+/**
+ *  @brief This function generate the bssid from bssid_idx
+ *
+ *  @param pmadpater        A pointer to mlan_adapter structure
+ *  @param pbss_entry       A pointer to the bss_entry which has multi-bssid IE
+ *  @param pnew_entry       A pinter to new entry
+ *  @param bssid_index      bssid_index from BSSID_IDX IE
+ *
+ *  @return                N/A
+ */
+static void wlan_gen_multi_bssid_by_bssid_index(pmlan_adapter pmadapter,
+						BSSDescriptor_t *pbss_entry,
+						BSSDescriptor_t *pnew_entry,
+						t_u8 bssid_index)
+{
+	t_u8 mask = 0xff;
+	t_u8 new_bssid[6];
+	memcpy_ext(pmadapter, (t_u8 *)new_bssid,
+		   (t_u8 *)&pbss_entry->mac_address,
+		   sizeof(mlan_802_11_mac_addr), sizeof(new_bssid));
+	new_bssid[5] = (new_bssid[5] + bssid_index) & mask;
+	memcpy_ext(pmadapter, (t_u8 *)&pnew_entry->mac_address, new_bssid,
+		   sizeof(new_bssid), sizeof(mlan_802_11_mac_addr));
+	memcpy_ext(pmadapter, (t_u8 *)&pnew_entry->multi_bssid_ap_addr,
+		   (t_u8 *)&pbss_entry->mac_address,
+		   sizeof(mlan_802_11_mac_addr), sizeof(mlan_802_11_mac_addr));
+}
+
+/**
+ *  @brief This function parse the non_trans_bssid_profile
+ *
+ *  @param pmadapter        A pointer to mlan_adapter structure
+ *  @param pbss_entry       A pointer to BSSDescriptor_t which has multi-bssid
+ * IE
+ *  @param pbss_profile     A pointer to IEEEtypes_NonTransBSSIDprofile_t
+ *  @param num_in_table     A pointer to buffer to save num of entry in scan
+ * table.
+ *
+ *  @return                 N/A
+ */
+static t_void wlan_parse_non_trans_bssid_profile(
+	mlan_private *pmpriv, BSSDescriptor_t *pbss_entry,
+	IEEEtypes_NonTransBSSIDProfile_t *pbss_profile, t_u32 *num_in_table)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	IEEEtypes_Header_t *pheader =
+		(IEEEtypes_Header_t *)pbss_profile->profile_data;
+	IEEEtypes_MultiBSSIDIndex_t *pbssid_index = MNULL;
+	IEEEtypes_Ssid_t *pssid = MNULL;
+	IEEEtypes_NotxBssCap_t *pcap =
+		(IEEEtypes_NotxBssCap_t *)pbss_profile->profile_data;
+	t_u8 *pos = pbss_profile->profile_data;
+	t_s8 left_len = pbss_profile->ieee_hdr.len;
+	t_u8 ret = MFALSE;
+	mlan_callbacks *pcb = (pmlan_callbacks)&pmadapter->callbacks;
+	BSSDescriptor_t *bss_new_entry = MNULL;
+	t_u8 *pbeacon_buf = MNULL;
+
+	ENTER();
+
+	/* The first element within the Nontransmitted
+	 * BSSID Profile is not the Nontransmitted
+	 * BSSID Capability element.
+	 */
+	if (pcap->element_id != NONTX_BSSID_CAP || pcap->len != 2) {
+		PRINTM(MERROR,
+		       "The first element within the Nontransmitted BSSID Profile is not the NontransmittedBSSID Capability element\n");
+		LEAVE();
+		return;
+	}
+
+	while (left_len >= 2) {
+		pheader = (IEEEtypes_Header_t *)pos;
+		if ((t_s8)(pheader->len + sizeof(IEEEtypes_Header_t)) >
+		    left_len) {
+			PRINTM(MMSG, "invalid IE length = %d left len %d\n",
+			       pheader->len, left_len);
+			break;
+		}
+		switch (pheader->element_id) {
+		case MBSSID_INDEX:
+			pbssid_index = (IEEEtypes_MultiBSSIDIndex_t *)pos;
+			if (pbssid_index->bssid_index == 0 ||
+			    pbssid_index->bssid_index > 46) {
+				PRINTM(MERROR,
+				       " No valid Multiple BSSID-Index element\n");
+				goto done;
+			}
+			PRINTM(MCMND, "MBSSID: Find mbssid_index=%d\n",
+			       pbssid_index->bssid_index);
+			ret = MTRUE;
+			break;
+		case SSID:
+			pssid = (IEEEtypes_Ssid_t *)pos;
+			PRINTM(MCMND, "MBSSID: Find mbssid ssid=%s\n",
+			       pssid->ssid);
+			break;
+		default:
+			break;
+		}
+		left_len -= pheader->len + sizeof(IEEEtypes_Header_t);
+		pos += pheader->len + sizeof(IEEEtypes_Header_t);
+	}
+	if (ret == MTRUE) {
+		ret = pcb->moal_malloc(pmadapter->pmoal_handle,
+				       sizeof(BSSDescriptor_t), MLAN_MEM_DEF,
+				       (t_u8 **)&bss_new_entry);
+		if (ret != MLAN_STATUS_SUCCESS || !bss_new_entry) {
+			PRINTM(MERROR,
+			       "Memory allocation for bss_new_entry failed!\n");
+			goto done;
+		}
+		memcpy_ext(pmadapter, bss_new_entry, pbss_entry,
+			   sizeof(BSSDescriptor_t), sizeof(BSSDescriptor_t));
+		wlan_gen_multi_bssid_by_bssid_index(pmadapter, pbss_entry,
+						    bss_new_entry,
+						    pbssid_index->bssid_index);
+		if (pssid) {
+			memset(pmadapter, (t_u8 *)&bss_new_entry->ssid, 0,
+			       sizeof(mlan_802_11_ssid));
+			bss_new_entry->ssid.ssid_len = pssid->len;
+			memcpy_ext(pmadapter, bss_new_entry->ssid.ssid,
+				   pssid->ssid, pssid->len,
+				   MLAN_MAX_SSID_LENGTH);
+			if (MLAN_STATUS_SUCCESS !=
+			    wlan_update_ssid_in_beacon_buf(
+				    pmadapter, pbss_entry, bss_new_entry,
+				    pssid)) {
+				PRINTM(MERROR,
+				       "Fail to update MBSSID beacon buf\n");
+				pcb->moal_mfree(pmadapter->pmoal_handle,
+						(t_u8 *)bss_new_entry);
+				goto done;
+			}
+			pbeacon_buf = bss_new_entry->pbeacon_buf;
+		}
+		memcpy_ext(pmadapter, &bss_new_entry->cap_info, &pcap->cap,
+			   sizeof(IEEEtypes_CapInfo_t),
+			   sizeof(IEEEtypes_CapInfo_t));
+		bss_new_entry->multi_bssid_ap = MULTI_BSSID_SUB_AP;
+		wlan_add_new_entry_to_scan_table(pmpriv, bss_new_entry,
+						 num_in_table);
+		if (pssid && pbeacon_buf)
+			pcb->moal_mfree(pmadapter->pmoal_handle,
+					(t_u8 *)pbeacon_buf);
+		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)bss_new_entry);
+	}
+done:
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function parse the multi_bssid IE from pbss_entry
+ *
+ *  @param pmpriv        A pointer to mlan_private structure
+ *  @param pbss_entry       A pointer to BSSDescriptor_t which has multi-bssid
+ * IE
+ *  @param num_in_table     A pointer to buffer to save num of entry in scan
+ * table.
+ *
+ *  @return                 number entry in scan table
+ */
+static t_void wlan_parse_multi_bssid_ie(mlan_private *pmpriv,
+					BSSDescriptor_t *pbss_entry,
+					IEEEtypes_MultiBSSID_t *pmulti_bssid,
+					t_u32 *num_in_table)
+{
+	t_u32 bytes_left = 0;
+	t_u8 *pcurrent_ptr = MNULL;
+	IEEEtypes_NonTransBSSIDProfile_t *pbssid_profile = MNULL;
+
+	if (!pmulti_bssid)
+		return;
+	bytes_left = pmulti_bssid->ieee_hdr.len - 1;
+	pcurrent_ptr = pmulti_bssid->sub_elem_data;
+	while (bytes_left >= 2) {
+		pbssid_profile =
+			(IEEEtypes_NonTransBSSIDProfile_t *)pcurrent_ptr;
+		if (pbssid_profile->ieee_hdr.element_id !=
+		    NONTRANS_BSSID_PROFILE_SUBELEM_ID) {
+			PRINTM(MERROR, "Invalid multi-bssid IE\n");
+			break;
+		}
+		if (bytes_left < (t_u32)(pbssid_profile->ieee_hdr.len + 2)) {
+			PRINTM(MERROR, "Invalid multi-bssid IE\n");
+			break;
+		}
+		wlan_parse_non_trans_bssid_profile(
+			pmpriv, pbss_entry, pbssid_profile, num_in_table);
+		pcurrent_ptr += pbssid_profile->ieee_hdr.len + 2;
+		bytes_left -= pbssid_profile->ieee_hdr.len + 2;
+	}
+	return;
+}
+
+/**
+ *  @brief This function search all the mbssid IE in the beacon buffer
+ *
+ *  @param pmpriv           A pointer to mlan_private structure
+ *  @param pbss_entry       A pointer to BSSDescriptor_t which has multi-bssid
+ * IE
+ *  @param num_in_table     A pointer to buffer to save num of entry in scan
+ * table.
+ *
+ *  @return                 N/A
+ */
+static void wlan_parse_multi_bssid_ap(mlan_private *pmpriv,
+				      BSSDescriptor_t *pbss_entry,
+				      t_u32 *num_in_table)
+{
+	IEEEtypes_ElementId_e element_id;
+	t_u8 element_len;
+	t_u16 total_ie_len;
+	t_u32 bytes_left = pbss_entry->beacon_buf_size - BEACON_FIX_SIZE;
+	t_u8 *pcurrent_ptr = pbss_entry->pbeacon_buf + BEACON_FIX_SIZE;
+	IEEEtypes_Ssid_t *pssid = (IEEEtypes_Ssid_t *)pcurrent_ptr;
+
+	if (pssid->element_id != SSID) {
+		PRINTM(MERROR,
+		       "Invalid beacon ie, ssid should be in the first element\n");
+		return;
+	}
+	/* Process variable IE */
+	while (bytes_left >= 2) {
+		element_id = (IEEEtypes_ElementId_e)(*((t_u8 *)pcurrent_ptr));
+		element_len = *((t_u8 *)pcurrent_ptr + 1);
+		total_ie_len = element_len + sizeof(IEEEtypes_Header_t);
+
+		if (bytes_left < total_ie_len) {
+			PRINTM(MERROR, "InterpretIE: Error in processing IE, "
+				       "bytes left < IE length\n");
+			bytes_left = 0;
+			continue;
+		}
+		if (element_id == MULTI_BSSID)
+			wlan_parse_multi_bssid_ie(
+				pmpriv, pbss_entry,
+				(IEEEtypes_MultiBSSID_t *)pcurrent_ptr,
+				num_in_table);
+		pcurrent_ptr += total_ie_len;
+		bytes_left -= total_ie_len;
+	}
+	return;
+}
+
 /**
  *  @brief This function parse and store the extended scan results
  *
@@ -5155,6 +5522,13 @@ static mlan_status wlan_parse_ext_scan_result(mlan_private *pmpriv,
 				       "EXT_SCAN: dropping entry on blacklist channel.\n");
 				continue;
 			}
+			if (IS_FW_SUPPORT_MULTIBSSID(pmadapter)) {
+				if (bss_new_entry->multi_bssid_ap ==
+				    MULTI_BSSID_AP)
+					wlan_parse_multi_bssid_ap(
+						pmpriv, bss_new_entry,
+						&num_in_table);
+			}
 			wlan_add_new_entry_to_scan_table(pmpriv, bss_new_entry,
 							 &num_in_table);
 
@@ -5392,7 +5766,6 @@ done:
 	/** Complete scan ioctl */
 	wlan_request_cmd_lock(pmadapter);
 	pmadapter->scan_processing = MFALSE;
-	pmadapter->ext_scan_type = EXT_SCAN_DEFAULT;
 	pioctl_req = pmadapter->pscan_ioctl_req;
 	pmadapter->pscan_ioctl_req = MNULL;
 	/* Need to indicate IOCTL complete */
@@ -6083,7 +6456,12 @@ mlan_status wlan_ret_802_11_bgscan_query(mlan_private *pmpriv,
 {
 	mlan_ds_scan *pscan = MNULL;
 	mlan_adapter *pmadapter = pmpriv->adapter;
+	t_u8 i;
 	ENTER();
+	for (i = 0; i < pmadapter->num_in_chan_stats; i++)
+		pmadapter->pchan_stats[i].cca_scan_duration = 0;
+	pmadapter->idx_chan_stats = 0;
+
 	wlan_ret_802_11_scan(pmpriv, resp, MNULL);
 	if (pioctl_buf) {
 		pscan = (mlan_ds_scan *)pioctl_buf->pbuf;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
index 0d6e70a..c6d13ce 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
@@ -3,7 +3,7 @@
  *  @brief This file contains SDIO specific code
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -68,41 +68,49 @@ static mlan_status wlan_sdio_init_ioport(mlan_adapter *pmadapter)
 	t_u8 cmd_config_1 = pmadapter->pcard_sd->reg->cmd_config_1;
 
 	ENTER();
-
-	pmadapter->pcard_sd->ioport = MEM_PORT;
+	if (pmadapter->pcard_sd->supports_sdio_new_mode) {
+		pmadapter->pcard_sd->ioport = MEM_PORT;
+	}
 	PRINTM(MINFO, "SDIO FUNC1 IO port: 0x%x\n",
 	       pmadapter->pcard_sd->ioport);
 
-	/* enable sdio cmd53 new mode */
-	if (MLAN_STATUS_SUCCESS == pcb->moal_read_reg(pmadapter->pmoal_handle,
-						      card_config_2_1_reg,
-						      &reg)) {
-		pcb->moal_write_reg(pmadapter->pmoal_handle,
-				    card_config_2_1_reg, reg | CMD53_NEW_MODE);
-	} else {
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
+	if (pmadapter->pcard_sd->supports_sdio_new_mode) {
+		/* enable sdio cmd53 new mode */
+		if (MLAN_STATUS_SUCCESS ==
+		    pcb->moal_read_reg(pmadapter->pmoal_handle,
+				       card_config_2_1_reg, &reg)) {
+			pcb->moal_write_reg(pmadapter->pmoal_handle,
+					    card_config_2_1_reg,
+					    reg | CMD53_NEW_MODE);
+		} else {
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
 
-	/* configure cmd port  */
-	/* enable reading rx length from the register  */
-	if (MLAN_STATUS_SUCCESS ==
-	    pcb->moal_read_reg(pmadapter->pmoal_handle, cmd_config_0, &reg)) {
-		pcb->moal_write_reg(pmadapter->pmoal_handle, cmd_config_0,
-				    reg | CMD_PORT_RD_LEN_EN);
-	} else {
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-	/* enable Dnld/Upld ready auto reset for cmd port
-	 * after cmd53 is completed */
-	if (MLAN_STATUS_SUCCESS ==
-	    pcb->moal_read_reg(pmadapter->pmoal_handle, cmd_config_1, &reg)) {
-		pcb->moal_write_reg(pmadapter->pmoal_handle, cmd_config_1,
-				    reg | CMD_PORT_AUTO_EN);
-	} else {
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
+		/* configure cmd port  */
+		/* enable reading rx length from the register  */
+		if (MLAN_STATUS_SUCCESS ==
+		    pcb->moal_read_reg(pmadapter->pmoal_handle, cmd_config_0,
+				       &reg)) {
+			pcb->moal_write_reg(pmadapter->pmoal_handle,
+					    cmd_config_0,
+					    reg | CMD_PORT_RD_LEN_EN);
+		} else {
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+		/* enable Dnld/Upld ready auto reset for cmd port
+		 * after cmd53 is completed */
+		if (MLAN_STATUS_SUCCESS ==
+		    pcb->moal_read_reg(pmadapter->pmoal_handle, cmd_config_1,
+				       &reg)) {
+			pcb->moal_write_reg(pmadapter->pmoal_handle,
+					    cmd_config_1,
+					    reg | CMD_PORT_AUTO_EN);
+		} else {
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
 	}
 
 #if defined(SD8977) || defined(SD8978)
@@ -196,17 +204,18 @@ static mlan_status wlan_get_rd_port(mlan_adapter *pmadapter, t_u8 *pport)
 {
 	t_u32 rd_bitmap = pmadapter->pcard_sd->mp_rd_bitmap;
 	const mlan_sdio_card_reg *reg = pmadapter->pcard_sd->reg;
-	t_u8 max_ports = MAX_PORT;
+	t_u8 max_ports = pmadapter->pcard_sd->max_ports;
+	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
 
 	ENTER();
 
 	PRINTM(MIF_D, "wlan_get_rd_port: mp_rd_bitmap=0x%08x\n", rd_bitmap);
-
-	if (!(rd_bitmap & reg->data_port_mask)) {
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
+	if (new_mode) {
+		if (!(rd_bitmap & reg->data_port_mask)) {
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
 	}
-
 	if (pmadapter->pcard_sd->mp_rd_bitmap &
 	    (1 << pmadapter->pcard_sd->curr_rd_port)) {
 		pmadapter->pcard_sd->mp_rd_bitmap &=
@@ -264,7 +273,6 @@ static mlan_status wlan_get_wr_port_data(mlan_adapter *pmadapter, t_u8 *pport)
 		LEAVE();
 		return MLAN_STATUS_RESOURCE;
 	}
-
 	PRINTM(MIF_D, "port=%d mp_wr_bitmap=0x%08x -> 0x%08x\n", *pport,
 	       wr_bitmap, pmadapter->pcard_sd->mp_wr_bitmap);
 	LEAVE();
@@ -1007,7 +1015,7 @@ static mlan_status wlan_decode_rx_packet(mlan_adapter *pmadapter,
  *  @param pmadapter A pointer to mlan_adapter structure
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_receive_single_packet(mlan_adapter *pmadapter)
+static mlan_status wlan_receive_single_packet(mlan_adapter *pmadapter)
 {
 	mlan_buffer *pmbuf;
 	t_u8 port;
@@ -1050,7 +1058,7 @@ done:
  *  @param pmadapter A pointer to mlan_adapter structure
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_receive_mp_aggr_buf(mlan_adapter *pmadapter)
+static mlan_status wlan_receive_mp_aggr_buf(mlan_adapter *pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -1062,6 +1070,7 @@ mlan_status wlan_receive_mp_aggr_buf(mlan_adapter *pmadapter)
 	t_u32 cmd53_port = 0;
 	t_u32 i = 0;
 	t_u32 port_count = 0;
+	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
 
 	/* do aggr RX now */
 	PRINTM(MINFO, "do_rx_aggr: num of packets: %d\n",
@@ -1088,11 +1097,13 @@ mlan_status wlan_receive_mp_aggr_buf(mlan_adapter *pmadapter)
 		mbuf_aggr.data_len = pmadapter->pcard_sd->mpa_rx.buf_len;
 	}
 
-	port_count = bitcount(pmadapter->pcard_sd->mpa_rx.ports) - 1;
-	/* port_count = pmadapter->mpa_rx.pkt_cnt - 1; */
-	cmd53_port = (pmadapter->pcard_sd->ioport | SDIO_MPA_ADDR_BASE |
-		      (port_count << 8)) +
-		     pmadapter->pcard_sd->mpa_rx.start_port;
+	if (new_mode) {
+		port_count = bitcount(pmadapter->pcard_sd->mpa_rx.ports) - 1;
+		/* port_count = pmadapter->mpa_rx.pkt_cnt - 1; */
+		cmd53_port = (pmadapter->pcard_sd->ioport | SDIO_MPA_ADDR_BASE |
+			      (port_count << 8)) +
+			     pmadapter->pcard_sd->mpa_rx.start_port;
+	}
 	do {
 		ret = pcb->moal_read_data_sync(pmadapter->pmoal_handle,
 					       &mbuf_aggr, cmd53_port, 0);
@@ -1208,6 +1219,7 @@ static mlan_status wlan_sdio_card_to_host_mp_aggr(mlan_adapter *pmadapter,
 	t_u32 pind = 0;
 	t_u32 pkt_type = 0;
 	const mlan_sdio_card_reg *reg = pmadapter->pcard_sd->reg;
+	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
 
 	ENTER();
 
@@ -1218,8 +1230,8 @@ static mlan_status wlan_sdio_card_to_host_mp_aggr(mlan_adapter *pmadapter,
 		f_do_rx_cur = 1;
 		goto rx_curr_single;
 	}
-
-	if (pmadapter->pcard_sd->mp_rd_bitmap & reg->data_port_mask) {
+	if ((new_mode &&
+	     (pmadapter->pcard_sd->mp_rd_bitmap & reg->data_port_mask))) {
 		/* Some more data RX pending */
 		PRINTM(MINFO, "card_2_host_mp_aggr: Not last packet\n");
 
@@ -1256,10 +1268,10 @@ static mlan_status wlan_sdio_card_to_host_mp_aggr(mlan_adapter *pmadapter,
 	if (f_aggr_cur) {
 		PRINTM(MINFO, "Current packet aggregation.\n");
 		/* Curr pkt can be aggregated */
-		MP_RX_AGGR_SETUP(pmadapter, pmbuf, port, rx_len);
-
+		if (new_mode)
+			MP_RX_AGGR_SETUP(pmadapter, pmbuf, port, rx_len);
 		if (MP_RX_AGGR_PKT_LIMIT_REACHED(pmadapter) ||
-		    MP_RX_AGGR_PORT_LIMIT_REACHED(pmadapter)) {
+		    ((new_mode && MP_RX_AGGR_PORT_LIMIT_REACHED(pmadapter)))) {
 			PRINTM(MINFO,
 			       "card_2_host_mp_aggr: Aggregation Packet limit reached\n");
 			/* No more pkts allowed in Aggr buf, rx it */
@@ -1288,24 +1300,28 @@ rx_curr_single:
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
-		if (pkt_type != MLAN_TYPE_DATA &&
-		    pkt_type != MLAN_TYPE_SPA_DATA) {
-			PRINTM(MERROR,
-			       "receive a wrong pkt from DATA PORT: type=%d, len=%dd\n",
-			       pkt_type, pmbuf->data_len);
-			pmbuf->status_code = MLAN_ERROR_DATA_RX_FAIL;
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
+		if (new_mode) {
+			if (pkt_type != MLAN_TYPE_DATA &&
+			    pkt_type != MLAN_TYPE_SPA_DATA) {
+				PRINTM(MERROR,
+				       "receive a wrong pkt from DATA PORT: type=%d, len=%dd\n",
+				       pkt_type, pmbuf->data_len);
+				pmbuf->status_code = MLAN_ERROR_DATA_RX_FAIL;
+				ret = MLAN_STATUS_FAILURE;
+				goto done;
+			}
 		}
 
-		pmadapter->pcard_sd->mpa_rx_count[0]++;
+		if (new_mode)
+			pmadapter->pcard_sd->mpa_rx_count[0]++;
 
 		wlan_decode_rx_packet(pmadapter, pmbuf, pkt_type, MTRUE);
 	}
 	if (f_post_aggr_cur) {
 		PRINTM(MINFO, "Current packet aggregation.\n");
 		/* Curr pkt can be aggregated */
-		MP_RX_AGGR_SETUP(pmadapter, pmbuf, port, rx_len);
+		if (new_mode)
+			MP_RX_AGGR_SETUP(pmadapter, pmbuf, port, rx_len);
 	}
 done:
 	if (ret == MLAN_STATUS_FAILURE) {
@@ -1345,7 +1361,8 @@ mlan_status wlan_send_mp_aggr_buf(mlan_adapter *pmadapter)
 	t_u32 port_count = 0;
 	mlan_buffer mbuf_aggr;
 	t_u8 i = 0;
-	t_u8 mp_aggr_pkt_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
+	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
+	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
 
 	ENTER();
 
@@ -1375,11 +1392,12 @@ mlan_status wlan_send_mp_aggr_buf(mlan_adapter *pmadapter)
 		mbuf_aggr.data_len = pmadapter->pcard_sd->mpa_tx.buf_len;
 	}
 
-	port_count = bitcount(pmadapter->pcard_sd->mpa_tx.ports) - 1;
-	cmd53_port = (pmadapter->pcard_sd->ioport | SDIO_MPA_ADDR_BASE |
-		      (port_count << 8)) +
-		     pmadapter->pcard_sd->mpa_tx.start_port;
-
+	if (new_mode) {
+		port_count = bitcount(pmadapter->pcard_sd->mpa_tx.ports) - 1;
+		cmd53_port = (pmadapter->pcard_sd->ioport | SDIO_MPA_ADDR_BASE |
+			      (port_count << 8)) +
+			     pmadapter->pcard_sd->mpa_tx.start_port;
+	}
 	if (pmadapter->pcard_sd->mpa_tx.pkt_cnt == 1)
 		cmd53_port = pmadapter->pcard_sd->ioport +
 			     pmadapter->pcard_sd->mpa_tx.start_port;
@@ -1452,7 +1470,8 @@ static mlan_status wlan_host_to_card_mp_aggr(mlan_adapter *pmadapter,
 	t_s32 f_precopy_cur_buf = 0;
 	t_s32 f_postcopy_cur_buf = 0;
 	t_u8 aggr_sg = 0;
-	t_u8 mp_aggr_pkt_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
+	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
+	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
 
 	ENTER();
 
@@ -1539,10 +1558,12 @@ static mlan_status wlan_host_to_card_mp_aggr(mlan_adapter *pmadapter,
 				mbuf->pbuf + mbuf->data_offset,
 				MLAN_SDIO_BLOCK_SIZE, MLAN_SDIO_BLOCK_SIZE);
 		if (!pmadapter->pcard_sd->mpa_tx.buf) {
-			MP_TX_AGGR_BUF_PUT_SG(pmadapter, mbuf, port);
+			if (new_mode)
+				MP_TX_AGGR_BUF_PUT_SG(pmadapter, mbuf, port);
 			aggr_sg = MTRUE;
 		} else {
-			MP_TX_AGGR_BUF_PUT(pmadapter, mbuf, port);
+			if (new_mode)
+				MP_TX_AGGR_BUF_PUT(pmadapter, mbuf, port);
 		}
 		if (MP_TX_AGGR_PKT_LIMIT_REACHED(pmadapter)) {
 			PRINTM(MIF_D,
@@ -1611,10 +1632,12 @@ tx_curr_single:
 				mbuf->pbuf + mbuf->data_offset,
 				MLAN_SDIO_BLOCK_SIZE, MLAN_SDIO_BLOCK_SIZE);
 		if (!pmadapter->pcard_sd->mpa_tx.buf) {
-			MP_TX_AGGR_BUF_PUT_SG(pmadapter, mbuf, port);
+			if (new_mode)
+				MP_TX_AGGR_BUF_PUT_SG(pmadapter, mbuf, port);
 			aggr_sg = MTRUE;
 		} else {
-			MP_TX_AGGR_BUF_PUT(pmadapter, mbuf, port);
+			if (new_mode)
+				MP_TX_AGGR_BUF_PUT(pmadapter, mbuf, port);
 		}
 	}
 	/* Always return PENDING in SG mode */
@@ -1638,7 +1661,8 @@ tx_curr_single:
  *  @return           MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  *
  */
-mlan_status wlan_sdio_check_winner_status(mlan_adapter *pmadapter, t_u32 *val)
+static mlan_status wlan_sdio_check_winner_status(mlan_adapter *pmadapter,
+						 t_u32 *val)
 {
 	t_u32 winner = 0;
 	pmlan_callbacks pcb;
@@ -1668,7 +1692,8 @@ mlan_status wlan_sdio_check_winner_status(mlan_adapter *pmadapter, t_u32 *val)
  *  @param pollnum    Maximum polling number
  *  @return           MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_sdio_check_fw_status(mlan_adapter *pmadapter, t_u32 pollnum)
+static mlan_status wlan_sdio_check_fw_status(mlan_adapter *pmadapter,
+					     t_u32 pollnum)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u16 firmwarestat = 0;
@@ -1709,7 +1734,7 @@ done:
  *  @param pmadapter A pointer to mlan_adapter structure
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_enable_sdio_host_int(pmlan_adapter pmadapter)
+static mlan_status wlan_enable_sdio_host_int(pmlan_adapter pmadapter)
 {
 	mlan_status ret;
 	t_u8 mask = pmadapter->pcard_sd->reg->host_int_enable;
@@ -1728,7 +1753,8 @@ mlan_status wlan_enable_sdio_host_int(pmlan_adapter pmadapter)
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_sdio_dnld_fw(pmlan_adapter pmadapter, pmlan_fw_image pmfw)
+static mlan_status wlan_sdio_dnld_fw(pmlan_adapter pmadapter,
+				     pmlan_fw_image pmfw)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 poll_num = 1;
@@ -1777,7 +1803,6 @@ mlan_status wlan_sdio_dnld_fw(pmlan_adapter pmadapter, pmlan_fw_image pmfw)
 #endif
 	}
 	poll_num = MAX_FIRMWARE_POLL_TRIES;
-
 	/* Check if other interface is downloading */
 	ret = wlan_sdio_check_winner_status(pmadapter, &winner);
 	if (ret == MLAN_STATUS_FAILURE) {
@@ -1875,6 +1900,11 @@ mlan_status wlan_get_sdio_device(pmlan_adapter pmadapter)
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
+	pmadapter->pcard_sd->max_ports = MAX_PORT;
+	pmadapter->pcard_sd->mp_aggr_pkt_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
+	pmadapter->pcard_sd->supports_sdio_new_mode = MTRUE;
+	pmadapter->pcard_sd->mp_tx_aggr_buf_size = SDIO_MP_AGGR_BUF_SIZE_MAX;
+	pmadapter->pcard_sd->mp_rx_aggr_buf_size = SDIO_MP_AGGR_BUF_SIZE_MAX;
 
 	switch (card_type) {
 #ifdef SD8887
@@ -1936,13 +1966,13 @@ mlan_status wlan_get_sdio_device(pmlan_adapter pmadapter)
  *  @param pmadapter    A pointer to mlan_adapter structure
  *  @return             MLAN_STATUS_SUCCESS
  */
-mlan_status wlan_sdio_interrupt(t_u16 msg_id, pmlan_adapter pmadapter)
+static mlan_status wlan_sdio_interrupt(t_u16 msg_id, pmlan_adapter pmadapter)
 {
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	mlan_buffer mbuf;
 	t_u32 sdio_ireg = 0;
 	t_u8 offset = 0;
-	t_u8 max_mp_regs = pmadapter->pcard_sd->reg->max_mp_regs;
+	int max_mp_regs = pmadapter->pcard_sd->reg->max_mp_regs;
 	t_u8 host_int_status_reg =
 		pmadapter->pcard_sd->reg->host_int_status_reg;
 
@@ -2014,7 +2044,6 @@ static mlan_status wlan_sdio_card_to_host_recovery(mlan_adapter *pmadapter,
 	t_u32 pkt_type = 0;
 	mlan_status ret = MLAN_STATUS_FAILURE;
 	ENTER();
-
 	if (MP_RX_AGGR_IN_PROGRESS(pmadapter)) {
 		PRINTM(MDATA, "Recovery:do Rx Aggr\n");
 		/* do aggr RX now */
@@ -2062,7 +2091,7 @@ done:
  *  @param pmadapter A pointer to mlan_adapter structure
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
+static mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -2082,6 +2111,7 @@ mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
 	t_u8 rd_len_p0_u = reg->rd_len_p0_u;
 	t_u8 cmd_rd_len_0 = reg->cmd_rd_len_0;
 	t_u8 cmd_rd_len_1 = reg->cmd_rd_len_1;
+	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
 
 	ENTER();
 
@@ -2093,66 +2123,74 @@ mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
 	if (!sdio_ireg)
 		goto done;
 
-	/* check the command port */
-	if (sdio_ireg & DN_LD_CMD_PORT_HOST_INT_STATUS) {
-		if (pmadapter->cmd_sent)
-			pmadapter->cmd_sent = MFALSE;
+	if (new_mode) {
+		/* check the command port */
+		if (sdio_ireg & DN_LD_CMD_PORT_HOST_INT_STATUS) {
+			if (pmadapter->cmd_sent)
+				pmadapter->cmd_sent = MFALSE;
 
-		PRINTM(MINFO, "cmd_sent=%d\n", pmadapter->cmd_sent);
-	}
-
-	if (sdio_ireg & UP_LD_CMD_PORT_HOST_INT_STATUS) {
-		/* read the len of control packet */
-		rx_len = ((t_u16)pmadapter->pcard_sd->mp_regs[cmd_rd_len_1])
-			 << 8;
-		rx_len |= (t_u16)pmadapter->pcard_sd->mp_regs[cmd_rd_len_0];
-		PRINTM(MINFO, "RX: cmd port rx_len=%u\n", rx_len);
-		rx_blocks = (rx_len + MLAN_SDIO_BLOCK_SIZE - 1) /
-			    MLAN_SDIO_BLOCK_SIZE;
-		if (rx_len <= SDIO_INTF_HEADER_LEN ||
-		    (rx_blocks * MLAN_SDIO_BLOCK_SIZE) > ALLOC_BUF_SIZE) {
-			PRINTM(MERROR, "invalid rx_len=%d\n", rx_len);
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-		rx_len = (t_u16)(rx_blocks * MLAN_SDIO_BLOCK_SIZE);
-		pmbuf = wlan_alloc_mlan_buffer(pmadapter, rx_len, 0,
-					       MOAL_MALLOC_BUFFER);
-		if (pmbuf == MNULL) {
-			PRINTM(MERROR, "Failed to allocate 'mlan_buffer'\n");
-			ret = MLAN_STATUS_FAILURE;
-			goto done;
-		}
-		PRINTM(MINFO, "cmd rx buffer rx_len = %d\n", rx_len);
-
-		/* Transfer data from card */
-		if (MLAN_STATUS_SUCCESS !=
-		    wlan_sdio_card_to_host(
-			    pmadapter, &upld_typ, (t_u32 *)&pmadapter->upld_len,
-			    pmbuf, rx_len,
-			    pmadapter->pcard_sd->ioport | CMD_PORT_SLCT)) {
-			pmadapter->dbg.num_cmdevt_card_to_host_failure++;
-			PRINTM(MERROR,
-			       "Card-to-host cmd failed: int status=0x%x\n",
-			       sdio_ireg);
-			wlan_free_mlan_buffer(pmadapter, pmbuf);
-			ret = MLAN_STATUS_FAILURE;
-			goto term_cmd53;
+			PRINTM(MINFO, "cmd_sent=%d\n", pmadapter->cmd_sent);
 		}
 
-		if ((upld_typ != MLAN_TYPE_CMD) &&
-		    (upld_typ != MLAN_TYPE_EVENT))
-			PRINTM(MERROR,
-			       "receive a wrong packet from CMD PORT. type =0x%x\n",
-			       upld_typ);
+		if (sdio_ireg & UP_LD_CMD_PORT_HOST_INT_STATUS) {
+			/* read the len of control packet */
+			rx_len = ((t_u16)pmadapter->pcard_sd
+					  ->mp_regs[cmd_rd_len_1])
+				 << 8;
+			rx_len |= (t_u16)pmadapter->pcard_sd
+					  ->mp_regs[cmd_rd_len_0];
+			PRINTM(MINFO, "RX: cmd port rx_len=%u\n", rx_len);
+			rx_blocks = (rx_len + MLAN_SDIO_BLOCK_SIZE - 1) /
+				    MLAN_SDIO_BLOCK_SIZE;
+			if (rx_len <= SDIO_INTF_HEADER_LEN ||
+			    (rx_blocks * MLAN_SDIO_BLOCK_SIZE) >
+				    ALLOC_BUF_SIZE) {
+				PRINTM(MERROR, "invalid rx_len=%d\n", rx_len);
+				ret = MLAN_STATUS_FAILURE;
+				goto done;
+			}
+			rx_len = (t_u16)(rx_blocks * MLAN_SDIO_BLOCK_SIZE);
+			pmbuf = wlan_alloc_mlan_buffer(pmadapter, rx_len, 0,
+						       MOAL_MALLOC_BUFFER);
+			if (pmbuf == MNULL) {
+				PRINTM(MERROR,
+				       "Failed to allocate 'mlan_buffer'\n");
+				ret = MLAN_STATUS_FAILURE;
+				goto done;
+			}
+			PRINTM(MINFO, "cmd rx buffer rx_len = %d\n", rx_len);
 
-		wlan_decode_rx_packet(pmadapter, pmbuf, upld_typ, MFALSE);
+			/* Transfer data from card */
+			if (MLAN_STATUS_SUCCESS !=
+			    wlan_sdio_card_to_host(pmadapter, &upld_typ,
+						   (t_u32 *)&pmadapter->upld_len,
+						   pmbuf, rx_len,
+						   pmadapter->pcard_sd->ioport |
+							   CMD_PORT_SLCT)) {
+				pmadapter->dbg.num_cmdevt_card_to_host_failure++;
+				PRINTM(MERROR,
+				       "Card-to-host cmd failed: int status=0x%x\n",
+				       sdio_ireg);
+				wlan_free_mlan_buffer(pmadapter, pmbuf);
+				ret = MLAN_STATUS_FAILURE;
+				goto term_cmd53;
+			}
 
-		/* We might receive data/sleep_cfm at the same time */
-		/* reset data_receive flag to avoid ps_state change */
-		if ((ps_state == PS_STATE_SLEEP_CFM) &&
-		    (pmadapter->ps_state == PS_STATE_SLEEP))
-			pmadapter->data_received = MFALSE;
+			if ((upld_typ != MLAN_TYPE_CMD) &&
+			    (upld_typ != MLAN_TYPE_EVENT))
+				PRINTM(MERROR,
+				       "receive a wrong packet from CMD PORT. type =0x%x\n",
+				       upld_typ);
+
+			wlan_decode_rx_packet(pmadapter, pmbuf, upld_typ,
+					      MFALSE);
+
+			/* We might receive data/sleep_cfm at the same time */
+			/* reset data_receive flag to avoid ps_state change */
+			if ((ps_state == PS_STATE_SLEEP_CFM) &&
+			    (pmadapter->ps_state == PS_STATE_SLEEP))
+				pmadapter->data_received = MFALSE;
+		}
 	}
 
 	if (sdio_ireg & DN_LD_HOST_INT_STATUS) {
@@ -2164,12 +2202,16 @@ mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
 		pmadapter->pcard_sd->mp_wr_bitmap |=
 			((t_u32)pmadapter->pcard_sd->mp_regs[reg->wr_bitmap_u])
 			<< 8;
-		pmadapter->pcard_sd->mp_wr_bitmap |=
-			((t_u32)pmadapter->pcard_sd->mp_regs[reg->wr_bitmap_1l])
-			<< 16;
-		pmadapter->pcard_sd->mp_wr_bitmap |=
-			((t_u32)pmadapter->pcard_sd->mp_regs[reg->wr_bitmap_1u])
-			<< 24;
+		if (new_mode) {
+			pmadapter->pcard_sd->mp_wr_bitmap |=
+				((t_u32)pmadapter->pcard_sd
+					 ->mp_regs[reg->wr_bitmap_1l])
+				<< 16;
+			pmadapter->pcard_sd->mp_wr_bitmap |=
+				((t_u32)pmadapter->pcard_sd
+					 ->mp_regs[reg->wr_bitmap_1u])
+				<< 24;
+		}
 		bit_count = bitcount(pmadapter->pcard_sd->mp_wr_bitmap &
 				     pmadapter->pcard_sd->mp_data_port_mask);
 		if (bit_count) {
@@ -2199,12 +2241,16 @@ mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
 		pmadapter->pcard_sd->mp_rd_bitmap |=
 			((t_u32)pmadapter->pcard_sd->mp_regs[reg->rd_bitmap_u])
 			<< 8;
-		pmadapter->pcard_sd->mp_rd_bitmap |=
-			((t_u32)pmadapter->pcard_sd->mp_regs[reg->rd_bitmap_1l])
-			<< 16;
-		pmadapter->pcard_sd->mp_rd_bitmap |=
-			((t_u32)pmadapter->pcard_sd->mp_regs[reg->rd_bitmap_1u])
-			<< 24;
+		if (new_mode) {
+			pmadapter->pcard_sd->mp_rd_bitmap |=
+				((t_u32)pmadapter->pcard_sd
+					 ->mp_regs[reg->rd_bitmap_1l])
+				<< 16;
+			pmadapter->pcard_sd->mp_rd_bitmap |=
+				((t_u32)pmadapter->pcard_sd
+					 ->mp_regs[reg->rd_bitmap_1u])
+				<< 24;
+		}
 		PRINTM(MINTR, "UPLD: rd_bitmap=0x%08x\n",
 		       pmadapter->pcard_sd->mp_rd_bitmap);
 
@@ -2233,7 +2279,8 @@ mlan_status wlan_process_sdio_int_status(mlan_adapter *pmadapter)
 				goto done;
 			}
 			rx_len = (t_u16)(rx_blocks * MLAN_SDIO_BLOCK_SIZE);
-			if (rx_len > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE)
+
+			if ((rx_len > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE))
 				pmbuf = wlan_alloc_mlan_buffer(
 					pmadapter, rx_len, 0,
 					MOAL_MALLOC_BUFFER);
@@ -2317,6 +2364,7 @@ mlan_status wlan_sdio_host_to_card(mlan_adapter *pmadapter, t_u8 type,
 	t_u8 port = 0;
 	t_u32 cmd53_port = 0;
 	t_u8 *payload = pmbuf->pbuf + pmbuf->data_offset;
+	t_bool new_mode = pmadapter->pcard_sd->supports_sdio_new_mode;
 
 	ENTER();
 
@@ -2360,7 +2408,9 @@ mlan_status wlan_sdio_host_to_card(mlan_adapter *pmadapter, t_u8 type,
 			       payload, pmbuf->data_len);
 		/* Transfer data to card */
 		pmbuf->data_len = buf_block_len * blksz;
-		cmd53_port = (pmadapter->pcard_sd->ioport) | CMD_PORT_SLCT;
+		if (new_mode)
+			cmd53_port =
+				(pmadapter->pcard_sd->ioport) | CMD_PORT_SLCT;
 		ret = wlan_write_data_sync(pmadapter, pmbuf, cmd53_port);
 	}
 
@@ -2387,7 +2437,7 @@ exit:
 	return ret;
 }
 
-#if (defined(SD9098) || defined(SD9097))
+#if defined(SD9098) || defined(SD9097)
 /**
  *  @brief This function sends vdll data to the card.
  *
@@ -2396,7 +2446,8 @@ exit:
  * SDIO header)
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_sdio_send_vdll(mlan_adapter *pmadapter, mlan_buffer *pmbuf)
+static mlan_status wlan_sdio_send_vdll(mlan_adapter *pmadapter,
+				       mlan_buffer *pmbuf)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 buf_block_len;
@@ -2440,14 +2491,14 @@ mlan_status wlan_sdio_send_vdll(mlan_adapter *pmadapter, mlan_buffer *pmbuf)
  *  @param tx_param  A pointer to mlan_tx_param
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_sdio_host_to_card_ext(pmlan_private pmpriv, t_u8 type,
-				       mlan_buffer *pmbuf,
-				       mlan_tx_param *tx_param)
+static mlan_status wlan_sdio_host_to_card_ext(pmlan_private pmpriv, t_u8 type,
+					      mlan_buffer *pmbuf,
+					      mlan_tx_param *tx_param)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_adapter *pmadapter = pmpriv->adapter;
 
-#if (defined(SD9098) || defined(SD9097))
+#if defined(SD9098) || defined(SD9097)
 	if (type == MLAN_TYPE_VDLL)
 		return wlan_sdio_send_vdll(pmadapter, pmbuf);
 #endif
@@ -2475,7 +2526,7 @@ void wlan_decode_spa_buffer(mlan_adapter *pmadapter, t_u8 *buf, t_u32 len)
 	t_u8 block_num = 0;
 	t_u16 block_size = 0;
 	t_u8 *data;
-	t_u32 pkt_len, pkt_type = 0;
+	t_u32 pkt_len;
 	mlan_buffer *mbuf_deaggr = MNULL;
 
 	ENTER();
@@ -2500,8 +2551,6 @@ void wlan_decode_spa_buffer(mlan_adapter *pmadapter, t_u8 *buf, t_u32 len)
 		}
 		pkt_len = wlan_le16_to_cpu(
 			*(t_u16 *)(data + OFFSET_OF_SDIO_HEADER));
-		pkt_type = wlan_le16_to_cpu(
-			*(t_u16 *)(data + OFFSET_OF_SDIO_HEADER + 2));
 		if ((pkt_len + OFFSET_OF_SDIO_HEADER) > block_size) {
 			PRINTM(MERROR,
 			       "Error in pkt, pkt_len=%d, block_size=%d\n",
@@ -2566,7 +2615,7 @@ mlan_status wlan_alloc_sdio_mpa_buffers(mlan_adapter *pmadapter,
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
-	t_u8 mp_aggr_pkt_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
+	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
 
 	ENTER();
 
@@ -2669,8 +2718,8 @@ mlan_status wlan_re_alloc_sdio_rx_mpa_buffer(mlan_adapter *pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
-	t_u8 mp_aggr_pkt_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
-	t_u32 mpa_rx_buf_size = SDIO_MP_AGGR_BUF_SIZE_MAX;
+	t_u8 mp_aggr_pkt_limit = pmadapter->pcard_sd->mp_aggr_pkt_limit;
+	t_u32 mpa_rx_buf_size = pmadapter->pcard_sd->mp_tx_aggr_buf_size;
 
 	if (pmadapter->pcard_sd->mpa_rx.buf) {
 		pcb->moal_mfree(pmadapter->pmoal_handle,
@@ -2740,7 +2789,8 @@ error:
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pm_sdio_wakeup_card(pmlan_adapter pmadapter, t_u8 timeout)
+static mlan_status wlan_pm_sdio_wakeup_card(pmlan_adapter pmadapter,
+					    t_u8 timeout)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 age_ts_usec;
@@ -2773,7 +2823,7 @@ mlan_status wlan_pm_sdio_wakeup_card(pmlan_adapter pmadapter, t_u8 timeout)
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pm_sdio_reset_card(pmlan_adapter pmadapter)
+static mlan_status wlan_pm_sdio_reset_card(pmlan_adapter pmadapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -2968,8 +3018,9 @@ done:
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return          N/A
  */
-mlan_status wlan_sdio_data_evt_complete(pmlan_adapter pmadapter,
-					mlan_buffer *pmbuf, mlan_status status)
+static mlan_status wlan_sdio_data_evt_complete(pmlan_adapter pmadapter,
+					       mlan_buffer *pmbuf,
+					       mlan_status status)
 {
 	ENTER();
 
@@ -2986,8 +3037,8 @@ mlan_status wlan_sdio_data_evt_complete(pmlan_adapter pmadapter,
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return
  */
-mlan_status wlan_sdio_handle_rx_packet(mlan_adapter *pmadapter,
-				       pmlan_buffer pmbuf)
+static mlan_status wlan_sdio_handle_rx_packet(mlan_adapter *pmadapter,
+					      pmlan_buffer pmbuf)
 {
 	ENTER();
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sdio.h b/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
index 539777d..328c782 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.h
@@ -4,7 +4,7 @@
  * driver.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -130,7 +130,6 @@ Change log:
 #define REG_PORT 0
 /** Port for memory */
 #define MEM_PORT 0x10000
-
 /** Card Control Registers : cmd53 new mode */
 #define CMD53_NEW_MODE (0x1U << 0)
 /** Card Control Registers : cmd53 tx len format 1 (0x10) */
@@ -204,6 +203,7 @@ Change log:
 		a->pcard_sd->mpa_tx.ports |= (1 << port);                      \
 		a->pcard_sd->mpa_tx.pkt_cnt++;                                 \
 	} while (0)
+
 /** SDIO Tx aggregation limit ? */
 #define MP_TX_AGGR_PKT_LIMIT_REACHED(a)                                        \
 	((a->pcard_sd->mpa_tx.pkt_cnt) == (a->pcard_sd->mpa_tx.pkt_aggr_limit))
@@ -231,7 +231,7 @@ Change log:
 /* note: hw rx wraps round only after port (MAX_PORT-1) */
 #define MP_RX_AGGR_PORT_LIMIT_REACHED(a)                                       \
 	(((a->pcard_sd->curr_rd_port < a->pcard_sd->mpa_rx.start_port) &&      \
-	  (((MAX_PORT - a->pcard_sd->mpa_rx.start_port) +                      \
+	  (((a->pcard_sd->max_ports - a->pcard_sd->mpa_rx.start_port) +        \
 	    a->pcard_sd->curr_rd_port) >= (a->pcard_sd->mp_end_port >> 1))) || \
 	 ((a->pcard_sd->curr_rd_port - a->pcard_sd->mpa_rx.start_port) >=      \
 	  (a->pcard_sd->mp_end_port >> 1)))
@@ -528,6 +528,8 @@ static const struct _mlan_card_info mlan_card_info_sd8987 = {
 #endif
 #endif
 
+extern mlan_adapter_operations mlan_sdio_ops;
+
 /** Probe and initialization function */
 mlan_status wlan_sdio_probe(pmlan_adapter pmadapter);
 mlan_status wlan_get_sdio_device(pmlan_adapter pmadapter);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_shim.c b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
index e9a6176..63c4ca9 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_shim.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
@@ -3,7 +3,7 @@
  *  @brief This file contains APIs to MOAL module.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -56,7 +56,7 @@ Change log:
 			Global Variables
 ********************************************************/
 #ifdef STA_SUPPORT
-mlan_operations mlan_sta_ops = {
+static mlan_operations mlan_sta_ops = {
 	/* init cmd handler */
 	wlan_ops_sta_init_cmd,
 	/* ioctl handler */
@@ -76,7 +76,7 @@ mlan_operations mlan_sta_ops = {
 };
 #endif
 #ifdef UAP_SUPPORT
-mlan_operations mlan_uap_ops = {
+static mlan_operations mlan_uap_ops = {
 	/* init cmd handler */
 	wlan_ops_uap_init_cmd,
 	/* ioctl handler */
@@ -140,7 +140,7 @@ extern mlan_status wlan_get_usb_device(pmlan_adapter pmadapter);
  *  @param pmadapter  A pointer to mlan_adapter structure
  *
  */
-void wlan_process_pending_ioctl(mlan_adapter *pmadapter)
+static void wlan_process_pending_ioctl(mlan_adapter *pmadapter)
 {
 	pmlan_ioctl_req pioctl_buf;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -192,15 +192,6 @@ void wlan_process_pending_ioctl(mlan_adapter *pmadapter)
 /********************************************************
 			Global Functions
 ********************************************************/
-#ifdef USB
-extern mlan_adapter_operations mlan_usb_ops;
-#endif
-#ifdef PCIE
-extern mlan_adapter_operations mlan_pcie_ops;
-#endif
-#ifdef SDIO
-extern mlan_adapter_operations mlan_sdio_ops;
-#endif
 
 /**
  *  @brief This function registers MOAL to MLAN module.
@@ -327,6 +318,7 @@ mlan_status mlan_register(pmlan_device pmdevice, t_void **ppmlan_adapter)
 	MASSERT(pcb->moal_spin_lock);
 	MASSERT(pcb->moal_spin_unlock);
 	MASSERT(pcb->moal_hist_data_add);
+	MASSERT(pcb->moal_updata_peer_signal);
 	/* Save pmoal_handle */
 	pmadapter->pmoal_handle = pmdevice->pmoal_handle;
 
@@ -444,7 +436,6 @@ mlan_status mlan_register(pmlan_device pmdevice, t_void **ppmlan_adapter)
 
 	pmadapter->multiple_dtim = pmdevice->multi_dtim;
 	pmadapter->inact_tmo = pmdevice->inact_tmo;
-	pmadapter->init_para.fw_region = pmdevice->fw_region;
 	pmadapter->hs_wake_interval = pmdevice->hs_wake_interval;
 	if (pmdevice->indication_gpio != 0xff) {
 		pmadapter->ind_gpio = pmdevice->indication_gpio & 0x0f;
@@ -573,20 +564,20 @@ exit_register:
 /**
  *  @brief This function unregisters MOAL from MLAN module.
  *
- *  @param pmlan_adapter   A pointer to a mlan_device structure
+ *  @param padapter  A pointer to a mlan_device structure
  *                         allocated in MOAL
  *
  *  @return                MLAN_STATUS_SUCCESS
  *                             The deregistration succeeded.
  */
-mlan_status mlan_unregister(t_void *pmlan_adapter)
+mlan_status mlan_unregister(t_void *padapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	pmlan_callbacks pcb;
 	t_s32 i = 0;
 
-	MASSERT(pmlan_adapter);
+	MASSERT(padapter);
 
 	ENTER();
 
@@ -620,7 +611,7 @@ mlan_status mlan_unregister(t_void *pmlan_adapter)
 /**
  *  @brief This function downloads the firmware
  *
- *  @param pmlan_adapter   A pointer to a t_void pointer to store
+ *  @param padapter   A pointer to a t_void pointer to store
  *                         mlan_adapter structure pointer
  *  @param pmfw            A pointer to firmware image
  *
@@ -629,13 +620,13 @@ mlan_status mlan_unregister(t_void *pmlan_adapter)
  *                         MLAN_STATUS_FAILURE
  *                             The firmware download failed.
  */
-mlan_status mlan_dnld_fw(t_void *pmlan_adapter, pmlan_fw_image pmfw)
+mlan_status mlan_dnld_fw(t_void *padapter, pmlan_fw_image pmfw)
 {
 	mlan_status ret = MLAN_STATUS_FAILURE;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 
 	ENTER();
-	MASSERT(pmlan_adapter);
+	MASSERT(padapter);
 
 	/* Download helper/firmware */
 	if (pmfw) {
@@ -654,20 +645,20 @@ mlan_status mlan_dnld_fw(t_void *pmlan_adapter, pmlan_fw_image pmfw)
 /**
  *  @brief This function pass init param to MLAN
  *
- *  @param pmlan_adapter  A pointer to a t_void pointer to store
+ *  @param padapter  A pointer to a t_void pointer to store
  *                        mlan_adapter structure pointer
  *  @param pparam         A pointer to mlan_init_param structure
  *
  *  @return               MLAN_STATUS_SUCCESS
  *
  */
-mlan_status mlan_set_init_param(t_void *pmlan_adapter, pmlan_init_param pparam)
+mlan_status mlan_set_init_param(t_void *padapter, pmlan_init_param pparam)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 
 	ENTER();
-	MASSERT(pmlan_adapter);
+	MASSERT(padapter);
 
 	/** Save DPD data in MLAN */
 	if ((pparam->pdpd_data_buf) || (pparam->dpd_data_len > 0)) {
@@ -691,7 +682,7 @@ mlan_status mlan_set_init_param(t_void *pmlan_adapter, pmlan_init_param pparam)
 /**
  *  @brief This function initializes the firmware
  *
- *  @param pmlan_adapter   A pointer to a t_void pointer to store
+ *  @param padapter   A pointer to a t_void pointer to store
  *                         mlan_adapter structure pointer
  *
  *  @return                MLAN_STATUS_SUCCESS
@@ -701,13 +692,13 @@ mlan_status mlan_set_init_param(t_void *pmlan_adapter, pmlan_init_param pparam)
  *                         MLAN_STATUS_FAILURE
  *                             The firmware initialization failed.
  */
-mlan_status mlan_init_fw(t_void *pmlan_adapter)
+mlan_status mlan_init_fw(t_void *padapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 
 	ENTER();
-	MASSERT(pmlan_adapter);
+	MASSERT(padapter);
 
 	pmadapter->hw_status = WlanHardwareStatusGetHwSpec;
 
@@ -722,7 +713,7 @@ mlan_status mlan_init_fw(t_void *pmlan_adapter)
 /**
  *  @brief Shutdown firmware
  *
- *  @param pmlan_adapter    A pointer to mlan_adapter structure
+ *  @param padapter    A pointer to mlan_adapter structure
  *
  *  @return     MLAN_STATUS_SUCCESS
  *                              The firmware shutdown call succeeded.
@@ -731,10 +722,10 @@ mlan_status mlan_init_fw(t_void *pmlan_adapter)
  *              MLAN_STATUS_FAILURE
  *                              The firmware shutdown call failed.
  */
-mlan_status mlan_shutdown_fw(t_void *pmlan_adapter)
+mlan_status mlan_shutdown_fw(t_void *padapter)
 {
 	mlan_status ret = MLAN_STATUS_PENDING;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	pmlan_buffer pmbuf;
 	pmlan_ioctl_req pioctl_buf;
 	pmlan_callbacks pcb;
@@ -742,7 +733,7 @@ mlan_status mlan_shutdown_fw(t_void *pmlan_adapter)
 
 	ENTER();
 
-	MASSERT(pmlan_adapter);
+	MASSERT(padapter);
 	/* MLAN already shutdown */
 	if (pmadapter->hw_status == WlanHardwareStatusNotReady) {
 		LEAVE();
@@ -934,23 +925,24 @@ void mlan_block_rx_process(mlan_adapter *pmadapter, t_u8 block)
 /**
  *  @brief The receive process
  *
- *  @param pmlan_adapter	A pointer to mlan_adapter structure
+ *  @param padapter	A pointer to mlan_adapter structure
  *  @param rx_pkts              A pointer to save receive pkts number
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status mlan_rx_process(t_void *pmlan_adapter, t_u8 *rx_pkts)
+mlan_status mlan_rx_process(t_void *padapter, t_u8 *rx_pkts)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	pmlan_callbacks pcb;
 	pmlan_buffer pmbuf;
 	t_u8 limit = 0;
 	t_u8 rx_num = 0;
+	t_u32 in_ts_sec, in_ts_usec;
 
 	ENTER();
 
-	MASSERT(pmlan_adapter);
+	MASSERT(padapter);
 	pcb = &pmadapter->callbacks;
 	pcb->moal_spin_lock(pmadapter->pmoal_handle, pmadapter->prx_proc_lock);
 	if (pmadapter->mlan_rx_processing || pmadapter->rx_lock_flag) {
@@ -1004,10 +996,15 @@ rx_process_start:
 			pmadapter->rx_data_queue.plock);
 
 		// rx_trace 6
-		if (pmadapter->tp_state_on)
+		if (pmadapter->tp_state_on) {
 			pmadapter->callbacks.moal_tp_accounting(
 				pmadapter->pmoal_handle, pmbuf,
 				6 /*RX_DROP_P2*/);
+			pcb->moal_get_system_time(pmadapter->pmoal_handle,
+						  &in_ts_sec, &in_ts_usec);
+			pmbuf->extra_ts_sec = in_ts_sec;
+			pmbuf->extra_ts_usec = in_ts_usec;
+		}
 		if (pmadapter->tp_state_drop_point == 6 /*RX_DROP_P2*/) {
 			pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
 			goto rx_process_start;
@@ -1043,19 +1040,19 @@ exit_rx_proc:
 /**
  *  @brief The main process
  *
- *  @param pmlan_adapter	A pointer to mlan_adapter structure
+ *  @param padapter	A pointer to mlan_adapter structure
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status mlan_main_process(t_void *pmlan_adapter)
+mlan_status mlan_main_process(t_void *padapter)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	pmlan_callbacks pcb;
 
 	ENTER();
 
-	MASSERT(pmlan_adapter);
+	MASSERT(padapter);
 
 	pcb = &pmadapter->callbacks;
 
@@ -1158,11 +1155,15 @@ process_start:
 				break;
 
 			if (pmadapter->data_sent ||
+			    wlan_is_tdls_link_chan_switching(
+				    pmadapter->tdls_status) ||
 			    (wlan_bypass_tx_list_empty(pmadapter) &&
 			     wlan_wmm_lists_empty(pmadapter)) ||
 			    wlan_11h_radar_detected_tx_blocked(pmadapter)) {
 				if (pmadapter->cmd_sent ||
 				    pmadapter->curr_cmd ||
+				    !wlan_is_send_cmd_allowed(
+					    pmadapter->tdls_status) ||
 				    !wlan_is_cmd_pending(pmadapter)) {
 					break;
 				}
@@ -1219,7 +1220,8 @@ process_start:
 				pmadapter->vdll_ctrl.pending_block_len);
 			pmadapter->vdll_ctrl.pending_block = MNULL;
 		}
-		if (!pmadapter->cmd_sent && !pmadapter->curr_cmd) {
+		if (!pmadapter->cmd_sent && !pmadapter->curr_cmd &&
+		    wlan_is_send_cmd_allowed(pmadapter->tdls_status)) {
 			if (wlan_exec_next_cmd(pmadapter) ==
 			    MLAN_STATUS_FAILURE) {
 				ret = MLAN_STATUS_FAILURE;
@@ -1229,6 +1231,7 @@ process_start:
 
 		if (!pmadapter->data_sent &&
 		    !wlan_11h_radar_detected_tx_blocked(pmadapter) &&
+		    !wlan_is_tdls_link_chan_switching(pmadapter->tdls_status) &&
 		    !wlan_bypass_tx_list_empty(pmadapter)) {
 			PRINTM(MINFO, "mlan_send_pkt(): deq(bybass_txq)\n");
 			wlan_process_bypass_tx(pmadapter);
@@ -1242,7 +1245,8 @@ process_start:
 		}
 
 		if (!pmadapter->data_sent && !wlan_wmm_lists_empty(pmadapter) &&
-		    !wlan_11h_radar_detected_tx_blocked(pmadapter)) {
+		    !wlan_11h_radar_detected_tx_blocked(pmadapter) &&
+		    !wlan_is_tdls_link_chan_switching(pmadapter->tdls_status)) {
 			wlan_wmm_process_tx(pmadapter);
 			if (pmadapter->hs_activated == MTRUE) {
 				pmadapter->is_hs_configured = MFALSE;
@@ -1293,22 +1297,24 @@ exit_main_proc:
 /**
  *  @brief Function to send packet
  *
- *  @param pmlan_adapter	A pointer to mlan_adapter structure
+ *  @param padapter	A pointer to mlan_adapter structure
  *  @param pmbuf		A pointer to mlan_buffer structure
  *
  *  @return			MLAN_STATUS_PENDING
  */
-mlan_status mlan_send_packet(t_void *pmlan_adapter, pmlan_buffer pmbuf)
+mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf)
 {
 	mlan_status ret = MLAN_STATUS_PENDING;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	mlan_private *pmpriv;
 	t_u16 eth_type = 0;
+	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
+	tdlsStatus_e tdls_status;
 
 	ENTER();
-	MASSERT(pmlan_adapter && pmbuf);
+	MASSERT(padapter && pmbuf);
 
-	if (!pmlan_adapter || !pmbuf) {
+	if (!padapter || !pmbuf) {
 		return MLAN_STATUS_FAILURE;
 	}
 
@@ -1323,9 +1329,19 @@ mlan_status mlan_send_packet(t_void *pmlan_adapter, pmlan_buffer pmbuf)
 	     ((eth_type == MLAN_ETHER_PKT_TYPE_EAPOL) ||
 	      (eth_type == MLAN_ETHER_PKT_TYPE_ARP) ||
 	      (eth_type == MLAN_ETHER_PKT_TYPE_WAPI))) ||
+	    (eth_type == MLAN_ETHER_PKT_TYPE_TDLS_ACTION) ||
 	    (pmbuf->buf_type == MLAN_BUF_TYPE_RAW_DATA)
 
 	) {
+		if (eth_type == MLAN_ETHER_PKT_TYPE_TDLS_ACTION) {
+			memcpy_ext(pmadapter, ra,
+				   pmbuf->pbuf + pmbuf->data_offset,
+				   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+			tdls_status = wlan_get_tdls_link_status(pmpriv, ra);
+			if (MTRUE == wlan_is_tdls_link_setup(tdls_status) ||
+			    !pmpriv->media_connected)
+				pmbuf->flags |= MLAN_BUF_FLAG_TDLS;
+		}
 		if (eth_type == MLAN_ETHER_PKT_TYPE_EAPOL) {
 			PRINTM_NETINTF(MMSG, pmpriv);
 			PRINTM(MMSG, "wlan: Send EAPOL pkt to " MACSTR "\n",
@@ -1391,19 +1407,18 @@ exit:
 /**
  *  @brief Packet send completion callback
  *
- *  @param pmlan_adapter	A pointer to mlan_adapter structure
+ *  @param padapter	A pointer to mlan_adapter structure
  *  @param pmbuf		A pointer to mlan_buffer structure
  *  @param port			Data port
  *  @param status		Callback status
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status mlan_write_data_async_complete(t_void *pmlan_adapter,
-					   pmlan_buffer pmbuf, t_u32 port,
-					   mlan_status status)
+mlan_status mlan_write_data_async_complete(t_void *padapter, pmlan_buffer pmbuf,
+					   t_u32 port, mlan_status status)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 
 	ENTER();
 
@@ -1424,17 +1439,17 @@ mlan_status mlan_write_data_async_complete(t_void *pmlan_adapter,
 /**
  *  @brief Packet receive handler
  *
- *  @param pmlan_adapter	A pointer to mlan_adapter structure
+ *  @param padapter	A pointer to mlan_adapter structure
  *  @param pmbuf		A pointer to mlan_buffer structure
  *  @param port			Data port
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE or
  * MLAN_STATUS_PENDING
  */
-mlan_status mlan_recv(t_void *pmlan_adapter, pmlan_buffer pmbuf, t_u32 port)
+mlan_status mlan_recv(t_void *padapter, pmlan_buffer pmbuf, t_u32 port)
 {
 	mlan_status ret = MLAN_STATUS_PENDING;
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	t_u8 *pbuf;
 	t_u32 len, recv_type;
 	t_u32 event_cause;
@@ -1445,7 +1460,7 @@ mlan_status mlan_recv(t_void *pmlan_adapter, pmlan_buffer pmbuf, t_u32 port)
 
 	ENTER();
 
-	MASSERT(pmlan_adapter && pmbuf);
+	MASSERT(padapter && pmbuf);
 
 	if (pmadapter->hs_activated == MTRUE)
 		wlan_process_hs_config(pmadapter);
@@ -1576,16 +1591,16 @@ mlan_status mlan_recv(t_void *pmlan_adapter, pmlan_buffer pmbuf, t_u32 port)
 /**
  *  @brief Packet receive completion callback handler
  *
- *  @param pmlan_adapter	A pointer to mlan_adapter structure
+ *  @param padapter	A pointer to mlan_adapter structure
  *  @param pmbuf		A pointer to mlan_buffer structure
  *  @param status		Callback status
  *
  *  @return			MLAN_STATUS_SUCCESS
  */
-mlan_status mlan_recv_packet_complete(t_void *pmlan_adapter, pmlan_buffer pmbuf,
+mlan_status mlan_recv_packet_complete(t_void *padapter, pmlan_buffer pmbuf,
 				      mlan_status status)
 {
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 
 	ENTER();
 	wlan_recv_packet_complete(pmadapter, pmbuf, status);
@@ -1596,15 +1611,15 @@ mlan_status mlan_recv_packet_complete(t_void *pmlan_adapter, pmlan_buffer pmbuf,
 /**
  *  @brief select wmm queue
  *
- *  @param pmlan_adapter	A pointer to mlan_adapter structure
+ *  @param padapter	A pointer to mlan_adapter structure
  *  @param bss_num		BSS number
  *  @param tid			TID
  *
  *  @return			wmm queue priority (0 - 3)
  */
-t_u8 mlan_select_wmm_queue(t_void *pmlan_adapter, t_u8 bss_num, t_u8 tid)
+t_u8 mlan_select_wmm_queue(t_void *padapter, t_u8 bss_num, t_u8 tid)
 {
-	mlan_adapter *pmadapter = (mlan_adapter *)pmlan_adapter;
+	mlan_adapter *pmadapter = (mlan_adapter *)padapter;
 	pmlan_private pmpriv = pmadapter->priv[bss_num];
 	t_u8 ret;
 	ENTER();
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
index 642ddc7..4785ed7 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
@@ -5,7 +5,7 @@
  *  it is ready.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -399,6 +399,13 @@ static mlan_status wlan_cmd_mfg_tx_frame(pmlan_private pmpriv,
 		mcmd->tx_bf = wlan_cpu_to_le32(cfg->tx_bf);
 		mcmd->gf_mode = wlan_cpu_to_le32(cfg->gf_mode);
 		mcmd->stbc = wlan_cpu_to_le32(cfg->stbc);
+		mcmd->NumPkt = wlan_cpu_to_le32(cfg->NumPkt);
+		mcmd->MaxPE = wlan_cpu_to_le32(cfg->MaxPE);
+		mcmd->BeamChange = wlan_cpu_to_le32(cfg->BeamChange);
+		mcmd->Dcm = wlan_cpu_to_le32(cfg->Dcm);
+		mcmd->Doppler = wlan_cpu_to_le32(cfg->Doppler);
+		mcmd->MidP = wlan_cpu_to_le32(cfg->MidP);
+		mcmd->QNum = wlan_cpu_to_le32(cfg->QNum);
 		memcpy_ext(pmpriv->adapter, mcmd->bssid, cfg->bssid,
 			   MLAN_MAC_ADDR_LENGTH, sizeof(mcmd->bssid));
 	}
@@ -407,6 +414,42 @@ static mlan_status wlan_cmd_mfg_tx_frame(pmlan_private pmpriv,
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ *  @brief This function prepares command of MFG HE TB Tx.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param action       The action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+
+mlan_status wlan_cmd_mfg_he_tb_tx(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
+				  t_u16 action, t_void *pdata_buf)
+{
+	struct mfg_Cmd_HE_TBTx_t *mcmd =
+		(struct mfg_Cmd_HE_TBTx_t *)&cmd->params.mfg_he_power;
+	struct mfg_Cmd_HE_TBTx_t *cfg = (struct mfg_Cmd_HE_TBTx_t *)pdata_buf;
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_MFG_COMMAND);
+	cmd->size =
+		wlan_cpu_to_le16(sizeof(struct mfg_Cmd_HE_TBTx_t) + S_DS_GEN);
+
+	mcmd->mfg_cmd = wlan_cpu_to_le32(cfg->mfg_cmd);
+	mcmd->action = wlan_cpu_to_le16(action);
+	if (action == HostCmd_ACT_GEN_SET) {
+		mcmd->enable = wlan_cpu_to_le16(cfg->enable);
+		mcmd->qnum = wlan_cpu_to_le16(cfg->qnum);
+		mcmd->aid = wlan_cpu_to_le16(cfg->aid);
+		mcmd->axq_mu_timer = wlan_cpu_to_le16(cfg->axq_mu_timer);
+		mcmd->tx_power = wlan_cpu_to_le16(cfg->tx_power);
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function prepares command of MFG cmd.
  *
@@ -439,6 +482,9 @@ mlan_status wlan_cmd_mfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	case MFG_CMD_TX_FRAME:
 		ret = wlan_cmd_mfg_tx_frame(pmpriv, cmd, action, pdata_buf);
 		goto cmd_mfg_done;
+	case MFG_CMD_CONFIG_MAC_HE_TB_TX:
+		ret = wlan_cmd_mfg_he_tb_tx(pmpriv, cmd, action, pdata_buf);
+		goto cmd_mfg_done;
 	case MFG_CMD_SET_TEST_MODE:
 	case MFG_CMD_UNSET_TEST_MODE:
 	case MFG_CMD_TX_ANT:
@@ -447,6 +493,7 @@ mlan_status wlan_cmd_mfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	case MFG_CMD_CLR_RX_ERR:
 	case MFG_CMD_RF_BAND_AG:
 	case MFG_CMD_RF_CHANNELBW:
+	case MFG_CMD_RADIO_MODE_CFG:
 	case MFG_CMD_RFPWR:
 		break;
 	default:
@@ -1552,6 +1599,495 @@ static mlan_status wlan_cmd_mgmt_ie_list(pmlan_private pmpriv,
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ *  @brief This function prepares command of TDLS configuration.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param pdata_buf	A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_cmd_tdls_config(pmlan_private pmpriv,
+					HostCmd_DS_COMMAND *cmd,
+					t_u16 cmd_action, t_void *pdata_buf)
+{
+	t_u16 travel_len = 0;
+	mlan_ds_misc_tdls_config *tdls_config = MNULL;
+	tdls_all_config *tdls_all_cfg = MNULL;
+	HostCmd_DS_TDLS_CONFIG *ptdls_config_data =
+		&(cmd->params.tdls_config_data);
+	t_u8 zero_mac[] = {0, 0, 0, 0, 0, 0};
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_TDLS_CONFIG);
+	cmd->size = sizeof(HostCmd_DS_TDLS_CONFIG) + S_DS_GEN;
+	cmd->result = 0;
+
+	tdls_config = (mlan_ds_misc_tdls_config *)pdata_buf;
+	ptdls_config_data->tdls_info.tdls_action =
+		wlan_cpu_to_le16(tdls_config->tdls_action);
+
+	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
+
+	switch (tdls_config->tdls_action) {
+	case WLAN_TDLS_CONFIG:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_config);
+		tdls_all_cfg->u.tdls_config.enable =
+			wlan_cpu_to_le16(tdls_all_cfg->u.tdls_config.enable);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_setup, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+
+	case WLAN_TDLS_SET_INFO:
+		travel_len = tdls_all_cfg->u.tdls_set.tlv_length;
+		if ((travel_len + sizeof(t_u16)) > MAX_TDLS_DATA_LEN) {
+			PRINTM(MERROR, "TDLS configuration overflow\n");
+			LEAVE();
+			return MLAN_STATUS_FAILURE;
+		}
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   (t_u8 *)&tdls_all_cfg->u.tdls_set.cap_info,
+			   sizeof(t_u16), sizeof(t_u16));
+		memcpy_ext(pmpriv->adapter,
+			   (t_u8 *)ptdls_config_data->tdls_info.tdls_data +
+				   sizeof(t_u16),
+			   &tdls_all_cfg->u.tdls_set.tlv_buffer, travel_len,
+			   MAX_TDLS_DATA_LEN - sizeof(t_u16));
+		travel_len += sizeof(t_u16);
+		break;
+	case WLAN_TDLS_DISCOVERY_REQ:
+		travel_len = MLAN_MAC_ADDR_LENGTH;
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   tdls_all_cfg->u.tdls_discovery.peer_mac_addr,
+			   travel_len, MAX_TDLS_DATA_LEN);
+		break;
+
+	case WLAN_TDLS_SETUP_REQ:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_setup);
+		tdls_all_cfg->u.tdls_setup.setup_timeout = wlan_cpu_to_le32(
+			tdls_all_cfg->u.tdls_setup.setup_timeout);
+		tdls_all_cfg->u.tdls_setup.key_lifetime = wlan_cpu_to_le32(
+			tdls_all_cfg->u.tdls_setup.key_lifetime);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_setup, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+
+	case WLAN_TDLS_TEAR_DOWN_REQ:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_tear_down);
+		tdls_all_cfg->u.tdls_tear_down.reason_code = wlan_cpu_to_le16(
+			tdls_all_cfg->u.tdls_tear_down.reason_code);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_tear_down, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+	case WLAN_TDLS_STOP_CHAN_SWITCH:
+		travel_len = MLAN_MAC_ADDR_LENGTH;
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   tdls_all_cfg->u.tdls_stop_chan_switch.peer_mac_addr,
+			   travel_len, MAX_TDLS_DATA_LEN);
+		break;
+	case WLAN_TDLS_INIT_CHAN_SWITCH:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_chan_switch);
+		tdls_all_cfg->u.tdls_chan_switch.switch_time = wlan_cpu_to_le16(
+			tdls_all_cfg->u.tdls_chan_switch.switch_time);
+		tdls_all_cfg->u.tdls_chan_switch.switch_timeout =
+			wlan_cpu_to_le16(
+				tdls_all_cfg->u.tdls_chan_switch.switch_timeout);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_chan_switch, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+	case WLAN_TDLS_CS_PARAMS:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_cs_params);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_cs_params, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+	case WLAN_TDLS_CS_DISABLE:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_disable_cs);
+		tdls_all_cfg->u.tdls_disable_cs.data =
+			wlan_cpu_to_le16(tdls_all_cfg->u.tdls_disable_cs.data);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_disable_cs, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+	case WLAN_TDLS_POWER_MODE:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_power_mode);
+		tdls_all_cfg->u.tdls_power_mode.power_mode = wlan_cpu_to_le16(
+			tdls_all_cfg->u.tdls_power_mode.power_mode);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_power_mode, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+
+	case WLAN_TDLS_LINK_STATUS:
+		travel_len = 0;
+		if (memcmp(pmpriv->adapter,
+			   tdls_all_cfg->u.tdls_link_status_req.peer_mac_addr,
+			   zero_mac, sizeof(zero_mac))) {
+			travel_len =
+				sizeof(tdls_all_cfg->u.tdls_link_status_req);
+			memcpy_ext(pmpriv->adapter,
+				   ptdls_config_data->tdls_info.tdls_data,
+				   tdls_all_cfg->u.tdls_link_status_req
+					   .peer_mac_addr,
+				   travel_len, MAX_TDLS_DATA_LEN);
+		}
+		break;
+
+	case WLAN_TDLS_DEBUG_ALLOW_WEAK_SECURITY:
+	case WLAN_TDLS_DEBUG_SETUP_SAME_LINK:
+	case WLAN_TDLS_DEBUG_FAIL_SETUP_CONFIRM:
+	case WLAN_TDLS_DEBUG_WRONG_BSS:
+	case WLAN_TDLS_DEBUG_SETUP_PROHIBITED:
+	case WLAN_TDLS_DEBUG_HIGHER_LOWER_MAC:
+	case WLAN_TDLS_DEBUG_IGNORE_KEY_EXPIRY:
+	case WLAN_TDLS_DEBUG_STOP_RX:
+	case WLAN_TDLS_DEBUG_CS_RET_IM:
+		travel_len = sizeof(tdls_all_cfg->u.tdls_debug_data);
+		tdls_all_cfg->u.tdls_debug_data.debug_data = wlan_cpu_to_le16(
+			tdls_all_cfg->u.tdls_debug_data.debug_data);
+		memcpy_ext(pmpriv->adapter,
+			   ptdls_config_data->tdls_info.tdls_data,
+			   &tdls_all_cfg->u.tdls_debug_data, travel_len,
+			   MAX_TDLS_DATA_LEN);
+		break;
+
+	default:
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	cmd->size += travel_len;
+	cmd->size -= MAX_TDLS_DATA_LEN;
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command of TDLS create/config/delete
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param pdata_buf	A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_cmd_tdls_oper(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				      t_void *pdata_buf)
+{
+	t_u16 travel_len = 0;
+	mlan_ds_misc_tdls_oper *tdls_oper = MNULL;
+	HostCmd_DS_TDLS_OPER *ptdls_oper = &(cmd->params.tdls_oper_data);
+	sta_node *sta_ptr;
+	t_u8 *pos;
+	MrvlIEtypes_RatesParamSet_t *Rate_tlv = MNULL;
+	MrvlIETypes_HTCap_t *HTcap_tlv = MNULL;
+	MrvlIETypes_HTInfo_t *HTInfo_tlv = MNULL;
+	MrvlIETypes_2040BSSCo_t *BSSCo = MNULL;
+	MrvlIETypes_ExtCap_t *ExCap = MNULL;
+	MrvlIEtypes_RsnParamSet_t *Rsn_ie = MNULL;
+	MrvlIETypes_qosinfo_t *qos_info = MNULL;
+	MrvlIETypes_LinkIDElement_t *LinkID = MNULL;
+	BSSDescriptor_t *pbss_desc = &pmpriv->curr_bss_params.bss_descriptor;
+	MrvlIETypes_VHTCap_t *VHTcap_tlv = MNULL;
+	MrvlIETypes_VHTOprat_t *VHTOper_tlv = MNULL;
+	MrvlIETypes_AID_t *AidInfo = MNULL;
+	MrvlIEtypes_TDLS_Idle_Timeout_t *TdlsIdleTimeout = MNULL;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_TDLS_OPERATION);
+	cmd->size = sizeof(HostCmd_DS_TDLS_OPER) + S_DS_GEN;
+	cmd->result = 0;
+
+	tdls_oper = (mlan_ds_misc_tdls_oper *)pdata_buf;
+	ptdls_oper->reason = 0;
+	memcpy_ext(pmpriv->adapter, ptdls_oper->peer_mac, tdls_oper->peer_mac,
+		   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	sta_ptr = wlan_get_station_entry(pmpriv, tdls_oper->peer_mac);
+	pos = (t_u8 *)ptdls_oper + sizeof(HostCmd_DS_TDLS_OPER);
+	switch (tdls_oper->tdls_action) {
+	case WLAN_TDLS_CREATE_LINK:
+		if (sta_ptr)
+			sta_ptr->status = TDLS_SETUP_INPROGRESS;
+		ptdls_oper->tdls_action = wlan_cpu_to_le16(TDLS_CREATE);
+		break;
+	case WLAN_TDLS_CONFIG_LINK:
+		if (sta_ptr) {
+			ptdls_oper->tdls_action = wlan_cpu_to_le16(TDLS_CONFIG);
+			/*capability*/
+			*(t_u16 *)pos = wlan_cpu_to_le16(sta_ptr->capability);
+			travel_len += sizeof(sta_ptr->capability);
+
+			/*supported rate*/
+			Rate_tlv = (MrvlIEtypes_RatesParamSet_t *)(pos +
+								   travel_len);
+			Rate_tlv->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_RATES);
+			Rate_tlv->header.len =
+				wlan_cpu_to_le16(sta_ptr->rate_len);
+			memcpy_ext(pmpriv->adapter,
+				   pos + travel_len +
+					   sizeof(MrvlIEtypesHeader_t),
+				   sta_ptr->support_rate, sta_ptr->rate_len,
+				   sta_ptr->rate_len);
+			travel_len +=
+				sizeof(MrvlIEtypesHeader_t) + sta_ptr->rate_len;
+
+			/*Extended capability */
+			if (sta_ptr->ExtCap.ieee_hdr.element_id ==
+			    EXT_CAPABILITY) {
+				ExCap = (MrvlIETypes_ExtCap_t *)(pos +
+								 travel_len);
+				ExCap->header.type =
+					wlan_cpu_to_le16(TLV_TYPE_EXTCAP);
+				ExCap->header.len = wlan_cpu_to_le16(
+					sta_ptr->ExtCap.ieee_hdr.len);
+				memcpy_ext(pmpriv->adapter, &ExCap->ext_cap,
+					   &sta_ptr->ExtCap.ext_cap,
+					   sta_ptr->ExtCap.ieee_hdr.len,
+					   sta_ptr->ExtCap.ieee_hdr.len);
+				travel_len += sta_ptr->ExtCap.ieee_hdr.len +
+					      sizeof(MrvlIEtypesHeader_t);
+			}
+			if (ExCap) {
+				if (pmpriv->host_tdls_uapsd_support &&
+				    ISSUPP_EXTCAP_TDLS_UAPSD(ExCap->ext_cap)) {
+					/* qos_info */
+					qos_info =
+						(MrvlIETypes_qosinfo_t
+							 *)(pos + travel_len);
+					qos_info->header.type =
+						wlan_cpu_to_le16(QOS_INFO);
+					qos_info->header.len =
+						wlan_cpu_to_le16(sizeof(t_u8));
+					qos_info->qos_info = sta_ptr->qos_info;
+					travel_len +=
+						sizeof(MrvlIETypes_qosinfo_t);
+				} else {
+					RESET_EXTCAP_TDLS_UAPSD(ExCap->ext_cap);
+				}
+
+				if (!(pmpriv->host_tdls_cs_support &&
+				      ISSUPP_EXTCAP_TDLS_CHAN_SWITCH(
+					      ExCap->ext_cap)))
+					RESET_EXTCAP_TDLS_CHAN_SWITCH(
+						ExCap->ext_cap);
+			}
+
+			/*RSN ie*/
+			if (sta_ptr->rsn_ie.ieee_hdr.element_id == RSN_IE) {
+				Rsn_ie = (MrvlIEtypes_RsnParamSet_t
+						  *)(pos + travel_len);
+				Rsn_ie->header.type = wlan_cpu_to_le16(
+					sta_ptr->rsn_ie.ieee_hdr.element_id);
+				Rsn_ie->header.len = wlan_cpu_to_le16(
+					sta_ptr->rsn_ie.ieee_hdr.len);
+				memcpy_ext(pmpriv->adapter, Rsn_ie->rsn_ie,
+					   sta_ptr->rsn_ie.data,
+					   sta_ptr->rsn_ie.ieee_hdr.len,
+					   sta_ptr->rsn_ie.ieee_hdr.len);
+				travel_len += sta_ptr->rsn_ie.ieee_hdr.len +
+					      sizeof(MrvlIEtypesHeader_t);
+			}
+			/*Link ID*/
+			if (sta_ptr->link_ie.element_id == LINK_ID) {
+				LinkID = (MrvlIETypes_LinkIDElement_t
+						  *)(pos + travel_len);
+				LinkID->header.type = wlan_cpu_to_le16(LINK_ID);
+				LinkID->header.len =
+					wlan_cpu_to_le16(sta_ptr->link_ie.len);
+				memcpy_ext(pmpriv->adapter, &LinkID->bssid,
+					   &sta_ptr->link_ie.bssid,
+					   sta_ptr->link_ie.len,
+					   sizeof(LinkID->bssid));
+				travel_len += sta_ptr->link_ie.len +
+					      sizeof(MrvlIEtypesHeader_t);
+			}
+			/*HT capability*/
+			if (sta_ptr->HTcap.ieee_hdr.element_id ==
+			    HT_CAPABILITY) {
+				HTcap_tlv = (MrvlIETypes_HTCap_t *)(pos +
+								    travel_len);
+				HTcap_tlv->header.type =
+					wlan_cpu_to_le16(TLV_TYPE_HT_CAP);
+				HTcap_tlv->header.len = wlan_cpu_to_le16(
+					sta_ptr->HTcap.ieee_hdr.len);
+				memcpy_ext(pmpriv->adapter, &HTcap_tlv->ht_cap,
+					   &sta_ptr->HTcap.ht_cap,
+					   sta_ptr->HTcap.ieee_hdr.len,
+					   sizeof(HTcap_tlv->ht_cap));
+				travel_len += sta_ptr->HTcap.ieee_hdr.len +
+					      sizeof(MrvlIEtypesHeader_t);
+			}
+			if (HTcap_tlv) {
+				if (pmpriv->host_tdls_cs_support &&
+				    (pmpriv->adapter->fw_bands & BAND_A))
+					wlan_fill_ht_cap_tlv(pmpriv, HTcap_tlv,
+							     BAND_A, MFALSE);
+				else
+					wlan_fill_ht_cap_tlv(
+						pmpriv, HTcap_tlv,
+						pbss_desc->bss_band, MFALSE);
+				DBG_HEXDUMP(MCMD_D, "FW htcap",
+					    (t_u8 *)HTcap_tlv,
+					    sizeof(MrvlIETypes_HTCap_t));
+			}
+
+			/*HT info*/
+			if (sta_ptr->HTInfo.ieee_hdr.element_id ==
+			    HT_OPERATION) {
+				HTInfo_tlv =
+					(MrvlIETypes_HTInfo_t *)(pos +
+								 travel_len);
+				HTInfo_tlv->header.type =
+					wlan_cpu_to_le16(TLV_TYPE_HT_INFO);
+				HTInfo_tlv->header.len = wlan_cpu_to_le16(
+					sta_ptr->HTInfo.ieee_hdr.len);
+				memcpy_ext(pmpriv->adapter,
+					   &HTInfo_tlv->ht_info,
+					   &sta_ptr->HTInfo.ht_info,
+					   sta_ptr->HTInfo.ieee_hdr.len,
+					   sizeof(HTInfo_tlv->ht_info));
+				travel_len += sta_ptr->HTInfo.ieee_hdr.len +
+					      sizeof(MrvlIEtypesHeader_t);
+				DBG_HEXDUMP(MCMD_D, "HT Info",
+					    (t_u8 *)HTInfo_tlv,
+					    sizeof(MrvlIETypes_HTInfo_t));
+			}
+			/*20/40 BSS co-exist*/
+			if (sta_ptr->BSSCO_20_40.ieee_hdr.element_id ==
+			    BSSCO_2040) {
+				BSSCo = (MrvlIETypes_2040BSSCo_t *)(pos +
+								    travel_len);
+				BSSCo->header.type = wlan_cpu_to_le16(
+					TLV_TYPE_2040BSS_COEXISTENCE);
+				BSSCo->header.len = wlan_cpu_to_le16(
+					sta_ptr->BSSCO_20_40.ieee_hdr.len);
+				memcpy_ext(pmpriv->adapter, &BSSCo->bss_co_2040,
+					   &sta_ptr->BSSCO_20_40.bss_co_2040,
+					   sta_ptr->BSSCO_20_40.ieee_hdr.len,
+					   sizeof(BSSCo->bss_co_2040));
+				travel_len +=
+					sta_ptr->BSSCO_20_40.ieee_hdr.len +
+					sizeof(MrvlIEtypesHeader_t);
+			}
+			/* Check if we need enable the 11AC */
+			if (sta_ptr && sta_ptr->vht_oprat.ieee_hdr.element_id ==
+					       VHT_OPERATION) {
+				/** AID */
+				if (sta_ptr->aid_info.ieee_hdr.element_id ==
+				    AID_INFO) {
+					AidInfo = (MrvlIETypes_AID_t
+							   *)(pos + travel_len);
+					AidInfo->header.type =
+						wlan_cpu_to_le16(AID_INFO);
+					AidInfo->header.len = wlan_cpu_to_le16(
+						sta_ptr->aid_info.ieee_hdr.len);
+					AidInfo->AID = wlan_cpu_to_le16(
+						sta_ptr->aid_info.AID);
+				}
+				/* Vht capability */
+				if (sta_ptr->vht_cap.ieee_hdr.element_id ==
+				    VHT_CAPABILITY) {
+					VHTcap_tlv =
+						(MrvlIETypes_VHTCap_t
+							 *)(pos + travel_len);
+					VHTcap_tlv->header.type =
+						wlan_cpu_to_le16(
+							VHT_CAPABILITY);
+					VHTcap_tlv->header
+						.len = wlan_cpu_to_le16(
+						sta_ptr->vht_cap.ieee_hdr.len);
+					memcpy_ext(
+						pmpriv->adapter,
+						&VHTcap_tlv->vht_cap,
+						&sta_ptr->vht_cap.vht_cap,
+						sta_ptr->vht_cap.ieee_hdr.len,
+						sizeof(VHTcap_tlv->vht_cap));
+					travel_len +=
+						sta_ptr->vht_cap.ieee_hdr.len +
+						sizeof(MrvlIEtypesHeader_t);
+				}
+				if (VHTcap_tlv) {
+					wlan_fill_vht_cap_tlv(
+						pmpriv, VHTcap_tlv,
+						pbss_desc->bss_band, MTRUE,
+						MTRUE);
+					DBG_HEXDUMP(
+						MCMD_D, "FW Vhtcap",
+						(t_u8 *)VHTcap_tlv,
+						sizeof(MrvlIETypes_VHTCap_t));
+				}
+
+				/*Vht operation*/
+				VHTOper_tlv =
+					(MrvlIETypes_VHTOprat_t *)(pos +
+								   travel_len);
+				VHTOper_tlv->header.type =
+					wlan_cpu_to_le16(VHT_OPERATION);
+				VHTOper_tlv->header.len = wlan_cpu_to_le16(
+					sta_ptr->vht_oprat.ieee_hdr.len);
+				memcpy_ext(pmpriv->adapter,
+					   &VHTOper_tlv->chan_width,
+					   &sta_ptr->vht_oprat.chan_width,
+					   sta_ptr->vht_oprat.ieee_hdr.len,
+					   sizeof(VHTOper_tlv->chan_width));
+				VHTOper_tlv->basic_MCS_map = wlan_cpu_to_le16(
+					VHTOper_tlv->basic_MCS_map);
+				travel_len += sta_ptr->vht_oprat.ieee_hdr.len +
+					      sizeof(MrvlIEtypesHeader_t);
+				DBG_HEXDUMP(MCMD_D, "VHT operation",
+					    (t_u8 *)VHTOper_tlv,
+					    sizeof(MrvlIETypes_VHTOprat_t));
+			}
+			TdlsIdleTimeout =
+				(MrvlIEtypes_TDLS_Idle_Timeout_t *)(pos +
+								    travel_len);
+			TdlsIdleTimeout->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_TDLS_IDLE_TIMEOUT);
+			TdlsIdleTimeout->header.len =
+				sizeof(TdlsIdleTimeout->value);
+			TdlsIdleTimeout->header.len =
+				wlan_cpu_to_le16(TdlsIdleTimeout->header.len);
+			TdlsIdleTimeout->value =
+				wlan_cpu_to_le16(pmpriv->tdls_idle_time);
+			travel_len += sizeof(MrvlIEtypes_TDLS_Idle_Timeout_t);
+		}
+		break;
+	case WLAN_TDLS_DISABLE_LINK:
+		ptdls_oper->tdls_action = wlan_cpu_to_le16(TDLS_DELETE);
+		break;
+	default:
+		break;
+	}
+	cmd->size += travel_len;
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function prepares system clock cfg command
  *
@@ -2004,9 +2540,9 @@ static mlan_status wlan_cmd_dfs_repeater_cfg(pmlan_private pmpriv,
  *
  *  @return             MLAN_STATUS_SUCCESS
  */
-mlan_status wlan_cmd_coalesce_config(pmlan_private pmpriv,
-				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
-				     t_void *pdata_buf)
+static mlan_status wlan_cmd_coalesce_config(pmlan_private pmpriv,
+					    HostCmd_DS_COMMAND *cmd,
+					    t_u16 cmd_action, t_void *pdata_buf)
 {
 	HostCmd_DS_COALESCE_CONFIG *coalesce_config =
 		&cmd->params.coalesce_config;
@@ -2319,7 +2855,7 @@ static mlan_status wlan_cmd_auto_tx(pmlan_private pmpriv,
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_is_cmd_allowed(mlan_private *priv, t_u16 cmd_no)
+static mlan_status wlan_is_cmd_allowed(mlan_private *priv, t_u16 cmd_no)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
@@ -2437,6 +2973,10 @@ mlan_status wlan_ops_sta_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_ssu(pmpriv, cmd_ptr, cmd_action, pdata_buf);
 		break;
 #endif
+	case HostCmd_CMD_HAL_PHY_CFG:
+		ret = wlan_cmd_hal_phy_cfg(pmpriv, cmd_ptr, cmd_action,
+					   pdata_buf);
+		break;
 	case HOST_CMD_PMIC_CONFIGURE:
 		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
 		cmd_ptr->size = wlan_cpu_to_le16(S_DS_GEN);
@@ -2640,6 +3180,14 @@ mlan_status wlan_ops_sta_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_mgmt_ie_list(pmpriv, cmd_ptr, cmd_action,
 					    pdata_buf);
 		break;
+	case HostCmd_CMD_TDLS_CONFIG:
+		ret = wlan_cmd_tdls_config(pmpriv, cmd_ptr, cmd_action,
+					   pdata_buf);
+		break;
+	case HostCmd_CMD_TDLS_OPERATION:
+		ret = wlan_cmd_tdls_oper(pmpriv, cmd_ptr, cmd_action,
+					 pdata_buf);
+		break;
 	case HostCmd_CMD_802_11_SCAN_EXT:
 		ret = wlan_cmd_802_11_scan_ext(pmpriv, cmd_ptr, pdata_buf);
 		break;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
index 0c6aacb..11cd55b 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
@@ -4,7 +4,7 @@
  *  responses generated by firmware.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -49,6 +49,86 @@
 /********************************************************
  *			Local Functions
  ********************************************************/
+/**
+ *  @brief This function handles the command response error for TDLS operation
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *
+ *  @return             N/A
+ */
+static void
+wlan_process_cmdreps_error_tdls_operation(mlan_private *pmpriv,
+					  HostCmd_DS_COMMAND *resp,
+					  mlan_ioctl_req *pioctl_buf)
+{
+	mlan_adapter *pmadapter = pmpriv->adapter;
+	HostCmd_DS_TDLS_OPER *ptdls_oper_data = &(resp->params.tdls_oper_data);
+	sta_node *sta_ptr = MNULL;
+	t_u16 reason;
+
+	ENTER();
+	ptdls_oper_data->tdls_action =
+		wlan_le16_to_cpu(ptdls_oper_data->tdls_action);
+	reason = wlan_le16_to_cpu(ptdls_oper_data->reason);
+	sta_ptr = wlan_get_station_entry(pmpriv, ptdls_oper_data->peer_mac);
+	switch (ptdls_oper_data->tdls_action) {
+	case TDLS_CREATE:
+		/* TDLS create command error */
+		if (reason != TDLS_LINK_EXISTS && sta_ptr) {
+			PRINTM(MERROR,
+			       "TDLS CREATE operation: cmd error reason %d\n",
+			       reason);
+			sta_ptr->status = TDLS_SETUP_FAILURE;
+		}
+		if (reason == TDLS_LINK_EXISTS && pioctl_buf)
+			pioctl_buf->status_code = MLAN_STATUS_SUCCESS;
+		break;
+	case TDLS_CONFIG:
+		/* TDLS config command error */
+		PRINTM(MERROR,
+		       "TDLS CONFIG operation: command error, reason %d\n",
+		       reason);
+		if (sta_ptr)
+			sta_ptr->status = TDLS_SETUP_FAILURE;
+		break;
+	case TDLS_DELETE:
+		/* TDLS delete command error */
+		wlan_restore_tdls_packets(pmpriv, ptdls_oper_data->peer_mac,
+					  TDLS_TEAR_DOWN);
+		if (sta_ptr) {
+			/**tdls cs stop*/
+			if (ISSUPP_EXTCAP_TDLS_CHAN_SWITCH(
+				    sta_ptr->ExtCap.ext_cap))
+				wlan_tdls_config(pmpriv, MFALSE);
+			if (sta_ptr->is_11n_enabled) {
+				wlan_cleanup_reorder_tbl(
+					pmpriv, ptdls_oper_data->peer_mac);
+				wlan_11n_cleanup_txbastream_tbl(
+					pmpriv, ptdls_oper_data->peer_mac);
+			}
+			if (sta_ptr->status >= TDLS_SETUP_INPROGRESS)
+				wlan_delete_station_entry(
+					pmpriv, ptdls_oper_data->peer_mac);
+		}
+		if (wlan_is_station_list_empty(pmpriv) == MTRUE)
+			pmadapter->tdls_status = TDLS_NOT_SETUP;
+		else
+			pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+
+		if (reason == TDLS_LINK_NONEXISTENT) {
+			if (pioctl_buf)
+				pioctl_buf->status_code = MLAN_STATUS_SUCCESS;
+		} else {
+			PRINTM(MERROR,
+			       "TDLS DELETE operation: cmd error, reason %d\n",
+			       reason);
+		}
+		break;
+	}
+	LEAVE();
+	return;
+}
 
 /**
  *  @brief This function handles the command response error
@@ -66,6 +146,10 @@ static mlan_status wlan_process_cmdresp_error(mlan_private *pmpriv,
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	pmlan_ioctl_req pscan_ioctl_req = MNULL;
 	mlan_callbacks *pcb = MNULL;
+	tdls_all_config *tdls_all_cfg = MNULL;
+	HostCmd_DS_TDLS_CONFIG *ptdls_config_data =
+		&(resp->params.tdls_config_data);
+
 #if defined(USB)
 	t_s32 i = 0;
 #endif
@@ -121,6 +205,37 @@ static mlan_status wlan_process_cmdresp_error(mlan_private *pmpriv,
 	case HostCmd_CMD_MAC_CONTROL:
 		break;
 
+	case HostCmd_CMD_TDLS_CONFIG:
+		ptdls_config_data->tdls_info.tdls_action = wlan_le16_to_cpu(
+			ptdls_config_data->tdls_info.tdls_action);
+		switch (ptdls_config_data->tdls_info.tdls_action) {
+		case WLAN_TDLS_SETUP_REQ:
+			/* TDLS link setup error ;display error in logs */
+			tdls_all_cfg =
+				(tdls_all_config *)
+					ptdls_config_data->tdls_info.tdls_data;
+			PRINTM(MERROR, "TDLS Setup Failed, error %d\n",
+			       wlan_le16_to_cpu(tdls_all_cfg->u.tdls_cmd_resp
+							.reason_code));
+			break;
+		case WLAN_TDLS_INIT_CHAN_SWITCH:
+			tdls_all_cfg =
+				(tdls_all_config *)
+					ptdls_config_data->tdls_info.tdls_data;
+			PRINTM(MERROR,
+			       "TDLS init channel switch failed," MACSTR
+			       ": reason=%d\n",
+			       MAC2STR(tdls_all_cfg->u.tdls_cmd_resp
+					       .peer_mac_addr),
+			       wlan_le16_to_cpu(tdls_all_cfg->u.tdls_cmd_resp
+							.reason_code));
+			break;
+		}
+		break;
+	case HostCmd_CMD_TDLS_OPERATION:
+		wlan_process_cmdreps_error_tdls_operation(pmpriv, resp,
+							  pioctl_buf);
+		break;
 	case HostCmd_CMD_PACKET_AGGR_CTRL:
 #ifdef USB
 		if (IS_USB(pmadapter->card_type)) {
@@ -619,6 +734,14 @@ static mlan_status wlan_ret_get_log(pmlan_private pmpriv,
 			wlan_le32_to_cpu(pget_log->channel_number);
 		pget_info->param.stats.channel_switch_mode =
 			wlan_le32_to_cpu(pget_log->channel_switch_mode);
+		pget_info->param.stats.rx_reset_mac_recovery_cnt =
+			wlan_le32_to_cpu(pget_log->rx_reset_mac_recovery_cnt);
+		pget_info->param.stats.rx_Isr2_NotDone_Cnt =
+			wlan_le32_to_cpu(pget_log->rx_Isr2_NotDone_Cnt);
+		pget_info->param.stats.gdma_abort_cnt =
+			wlan_le32_to_cpu(pget_log->gdma_abort_cnt);
+		pget_info->param.stats.g_reset_rx_mac_cnt =
+			wlan_le32_to_cpu(pget_log->g_reset_rx_mac_cnt);
 		if (pmpriv->adapter->getlog_enable) {
 			pget_info->param.stats.tx_frag_cnt =
 				wlan_le32_to_cpu(pget_log->tx_frag_cnt);
@@ -991,6 +1114,7 @@ static mlan_status wlan_ret_802_11_sleep_period(pmlan_private pmpriv,
 			MLAN_SUB_COMMAND_SIZE;
 	}
 	pmpriv->adapter->sleep_period.period = sleep_pd;
+	pmpriv->adapter->saved_sleep_period.period = sleep_pd;
 
 	pmpriv->adapter->pps_uapsd_mode = MFALSE;
 	if ((pmpriv->adapter->sleep_period.period != 0) &&
@@ -1551,6 +1675,349 @@ static mlan_status wlan_ret_mgmt_ie_list(pmlan_private pmpriv,
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ *  @brief This function enable/disable tdls powermode
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param powermode    1--enable, 0--disable
+ *
+ *  @return             N/A
+ */
+static void wlan_set_tdls_powermode(pmlan_private pmpriv, t_u8 powermode)
+{
+	ENTER();
+
+	if (powermode) {
+		pmpriv->wmm_qosinfo = DEFAULT_TDLS_WMM_QOS_INFO;
+		if (!pmpriv->adapter->sleep_period.period)
+			pmpriv->adapter->sleep_period.period =
+				DEFAULT_TDLS_SLEEP_PERIOD;
+	} else {
+		pmpriv->wmm_qosinfo = pmpriv->saved_wmm_qosinfo;
+		pmpriv->adapter->sleep_period.period =
+			pmpriv->adapter->saved_sleep_period.period;
+	}
+	pmpriv->adapter->pps_uapsd_mode = MFALSE;
+	if ((pmpriv->adapter->sleep_period.period != 0) &&
+	    (pmpriv->adapter->sleep_period.period !=
+	     SLEEP_PERIOD_RESERVED_FF)) {
+		pmpriv->adapter->gen_null_pkt = MTRUE;
+	} else {
+		pmpriv->adapter->delay_null_pkt = MFALSE;
+		pmpriv->adapter->gen_null_pkt = MFALSE;
+	}
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief This function handles the command response of TDLS_CONFIG
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_ret_tdls_config(pmlan_private pmpriv,
+					HostCmd_DS_COMMAND *resp,
+					mlan_ioctl_req *pioctl_buf)
+{
+	t_u8 i = 0;
+	t_u16 link_length = 0, final_data_rate = 0;
+	mlan_ds_misc_cfg *misc = MNULL;
+	tdls_all_config *tdls_all_cfg = MNULL;
+	sta_node *sta_ptr = MNULL;
+	HostCmd_DS_TDLS_CONFIG *ptdls_config_data =
+		&(resp->params.tdls_config_data);
+	pmlan_adapter pmadapter = pmpriv->adapter;
+	tdls_each_link_status *link_ptr = MNULL;
+
+	ENTER();
+
+	ptdls_config_data->tdls_info.tdls_action =
+		wlan_le16_to_cpu(ptdls_config_data->tdls_info.tdls_action);
+	switch (ptdls_config_data->tdls_info.tdls_action) {
+	case WLAN_TDLS_CONFIG:
+		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		if (pmpriv->host_tdls_cs_support ||
+		    pmpriv->host_tdls_uapsd_support)
+			break;
+		if (wlan_le16_to_cpu(tdls_all_cfg->u.tdls_config.enable) == 0) {
+			PRINTM(MINFO, "TDLS disable successful.\n");
+			wlan_delete_station_list(pmpriv);
+			pmadapter->tdls_status = TDLS_NOT_SETUP;
+			if (pmpriv->saved_wmm_qosinfo)
+				pmpriv->wmm_qosinfo = pmpriv->saved_wmm_qosinfo;
+			if (pmadapter->saved_sleep_period.period)
+				pmadapter->sleep_period.period =
+					pmadapter->saved_sleep_period.period;
+		}
+		break;
+
+	case WLAN_TDLS_SET_INFO:
+		break;
+
+	case WLAN_TDLS_DISCOVERY_REQ:
+		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		tdls_all_cfg->u.tdls_discovery_resp.payload_len =
+			wlan_le16_to_cpu(
+				tdls_all_cfg->u.tdls_discovery_resp.payload_len);
+		tdls_all_cfg->u.tdls_discovery_resp.cap_info = wlan_le16_to_cpu(
+			tdls_all_cfg->u.tdls_discovery_resp.cap_info);
+		memcpy_ext(pmpriv->adapter, &misc->param.tdls_config,
+			   &ptdls_config_data->tdls_info,
+			   (resp->size - S_DS_GEN),
+			   sizeof(mlan_ds_misc_tdls_config));
+		PRINTM(MCMND, "TDLS_DISCOVERY_REQ: " MACSTR "\n",
+		       MAC2STR(tdls_all_cfg->u.tdls_discovery_resp
+				       .peer_mac_addr));
+		break;
+
+	case WLAN_TDLS_SETUP_REQ:
+		/*
+		 * TDLS link being setup, block all data for this Peer
+		 */
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		PRINTM(MCMND, "TDLS_SETUP_REQ: " MACSTR "\n",
+		       MAC2STR(tdls_all_cfg->u.tdls_setup.peer_mac_addr));
+		sta_ptr = wlan_get_station_entry(
+			pmpriv, tdls_all_cfg->u.tdls_setup.peer_mac_addr);
+		if (!sta_ptr) {
+			sta_ptr = wlan_add_station_entry(
+				pmpriv,
+				tdls_all_cfg->u.tdls_setup.peer_mac_addr);
+			if (sta_ptr) {
+				sta_ptr->status = TDLS_SETUP_INPROGRESS;
+				wlan_hold_tdls_packets(
+					pmpriv, tdls_all_cfg->u.tdls_setup
+							.peer_mac_addr);
+			}
+		}
+		break;
+
+	case WLAN_TDLS_TEAR_DOWN_REQ:
+		/*
+		 * TDLS link torn down, open data ports if blocked
+		 */
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		wlan_restore_tdls_packets(
+			pmpriv, tdls_all_cfg->u.tdls_tear_down.peer_mac_addr,
+			TDLS_TEAR_DOWN);
+		PRINTM(MCMND, "TDLS_TEARDOWN_REQ: " MACSTR "\n",
+		       MAC2STR(tdls_all_cfg->u.tdls_tear_down.peer_mac_addr));
+		sta_ptr = wlan_get_station_entry(
+			pmpriv, tdls_all_cfg->u.tdls_tear_down.peer_mac_addr);
+		if (sta_ptr) {
+			if (sta_ptr->is_11n_enabled) {
+				wlan_cleanup_reorder_tbl(
+					pmpriv, tdls_all_cfg->u.tdls_tear_down
+							.peer_mac_addr);
+				wlan_11n_cleanup_txbastream_tbl(
+					pmpriv, tdls_all_cfg->u.tdls_tear_down
+							.peer_mac_addr);
+			}
+			wlan_delete_station_entry(
+				pmpriv,
+				tdls_all_cfg->u.tdls_tear_down.peer_mac_addr);
+			if (MTRUE == wlan_is_station_list_empty(pmpriv))
+				pmadapter->tdls_status = TDLS_NOT_SETUP;
+			else
+				pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+		}
+		break;
+	case WLAN_TDLS_INIT_CHAN_SWITCH:
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		PRINTM(MCMND,
+		       "TDLS_INIT_CHANNEL_SWITCH: " MACSTR
+		       " chan=%d periodicity=%d\n",
+		       MAC2STR(tdls_all_cfg->u.tdls_chan_switch.peer_mac_addr),
+		       (int)tdls_all_cfg->u.tdls_chan_switch.primary_channel,
+		       (int)tdls_all_cfg->u.tdls_chan_switch.periodicity);
+		break;
+
+	case WLAN_TDLS_LINK_STATUS:
+		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		tdls_all_cfg->u.tdls_link_status_resp.payload_len =
+			wlan_le16_to_cpu(tdls_all_cfg->u.tdls_link_status_resp
+						 .payload_len);
+		link_ptr = tdls_all_cfg->u.tdls_link_status_resp.link_stats;
+		for (i = 0;
+		     i < tdls_all_cfg->u.tdls_link_status_resp.active_links;
+		     i++) {
+			link_ptr->active_channel =
+				wlan_le32_to_cpu(link_ptr->active_channel);
+			link_ptr->data_rssi_last =
+				wlan_le16_to_cpu(link_ptr->data_rssi_last);
+			link_ptr->data_nf_last =
+				wlan_le16_to_cpu(link_ptr->data_nf_last);
+			link_ptr->data_rssi_avg =
+				wlan_le16_to_cpu(link_ptr->data_rssi_avg);
+			link_ptr->data_nf_avg =
+				wlan_le16_to_cpu(link_ptr->data_nf_avg);
+			link_length = sizeof(tdls_each_link_status);
+			/* adjust as per open or secure network */
+			if (link_ptr->link_flags & 0x02) {
+				link_ptr->key_lifetime = wlan_le32_to_cpu(
+					link_ptr->key_lifetime);
+				link_length += link_ptr->key_length;
+			} else {
+				link_length -=
+					sizeof(link_ptr->security_method) +
+					sizeof(link_ptr->key_lifetime) +
+					sizeof(link_ptr->key_length);
+			}
+			final_data_rate = (t_u16)wlan_index_to_data_rate(
+				pmadapter, link_ptr->u.rate_info.tx_data_rate,
+				link_ptr->u.rate_info.tx_rate_htinfo, 0);
+			link_ptr->u.final_data_rate = final_data_rate / 2;
+
+			link_ptr =
+				(tdls_each_link_status *)(((t_u8 *)link_ptr) +
+							  link_length);
+		}
+		memcpy_ext(pmpriv->adapter, &misc->param.tdls_config,
+			   &ptdls_config_data->tdls_info,
+			   (resp->size - S_DS_GEN),
+			   sizeof(mlan_ds_misc_tdls_config));
+		break;
+	case WLAN_TDLS_POWER_MODE:
+		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		tdls_all_cfg->u.tdls_power_mode.power_mode = wlan_le16_to_cpu(
+			tdls_all_cfg->u.tdls_power_mode.power_mode);
+		wlan_set_tdls_powermode(
+			pmpriv,
+			(t_u8)tdls_all_cfg->u.tdls_power_mode.power_mode);
+		break;
+	case WLAN_TDLS_STOP_CHAN_SWITCH:
+		tdls_all_cfg = (tdls_all_config *)
+				       ptdls_config_data->tdls_info.tdls_data;
+		PRINTM(MCMND, "TDLS_STOP_CHANNEL_SWITCH: " MACSTR "\n",
+		       MAC2STR(tdls_all_cfg->u.tdls_stop_chan_switch
+				       .peer_mac_addr));
+		break;
+	case WLAN_TDLS_CS_PARAMS:
+	case WLAN_TDLS_CS_DISABLE:
+	case WLAN_TDLS_DEBUG_STOP_RX:
+	case WLAN_TDLS_DEBUG_ALLOW_WEAK_SECURITY:
+	case WLAN_TDLS_DEBUG_SETUP_SAME_LINK:
+	case WLAN_TDLS_DEBUG_FAIL_SETUP_CONFIRM:
+	case WLAN_TDLS_DEBUG_WRONG_BSS:
+	case WLAN_TDLS_DEBUG_SETUP_PROHIBITED:
+	case WLAN_TDLS_DEBUG_HIGHER_LOWER_MAC:
+	case WLAN_TDLS_DEBUG_IGNORE_KEY_EXPIRY:
+	case WLAN_TDLS_DEBUG_CS_RET_IM:
+		break;
+	default:
+		if (pioctl_buf)
+			pioctl_buf->status_code = MLAN_ERROR_CMD_RESP_FAIL;
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of TDLS_OPERATION
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_ret_tdls_oper(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp,
+				      mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_TDLS_OPER *ptdls_oper = &(resp->params.tdls_oper_data);
+	sta_node *sta_ptr = MNULL;
+	t_u16 reason = 0;
+	pmlan_adapter pmadapter = pmpriv->adapter;
+
+	ENTER();
+
+	ptdls_oper->tdls_action = wlan_le16_to_cpu(ptdls_oper->tdls_action);
+
+	sta_ptr = wlan_get_station_entry(pmpriv, ptdls_oper->peer_mac);
+	reason = wlan_le16_to_cpu(ptdls_oper->reason);
+	switch (ptdls_oper->tdls_action) {
+	case TDLS_CREATE:
+		if (reason) {
+			PRINTM(MMSG,
+			       "TDLS: create link " MACSTR " fail, reason=%d\n",
+			       MAC2STR(ptdls_oper->peer_mac), reason);
+			if (reason != TDLS_LINK_EXISTS && sta_ptr)
+				sta_ptr->status = TDLS_SETUP_FAILURE;
+		} else {
+			PRINTM(MMSG, "TDLS: create link " MACSTR " success\n",
+			       MAC2STR(ptdls_oper->peer_mac), reason);
+		}
+		break;
+	case TDLS_CONFIG:
+		if (reason) {
+			PRINTM(MMSG,
+			       "TDLS: Config link " MACSTR " fail, reason=%d\n",
+			       MAC2STR(ptdls_oper->peer_mac), reason);
+			if (sta_ptr)
+				sta_ptr->status = TDLS_SETUP_FAILURE;
+		} else {
+			PRINTM(MMSG, "TDLS: Config link " MACSTR " success\n",
+			       MAC2STR(ptdls_oper->peer_mac));
+		}
+		break;
+	case TDLS_DELETE:
+		wlan_restore_tdls_packets(pmpriv, ptdls_oper->peer_mac,
+					  TDLS_TEAR_DOWN);
+		if (sta_ptr) {
+			/**tdls cs stop*/
+			if (ISSUPP_EXTCAP_TDLS_CHAN_SWITCH(
+				    sta_ptr->ExtCap.ext_cap))
+				wlan_tdls_config(pmpriv, MFALSE);
+			if (sta_ptr->is_11n_enabled) {
+				wlan_cleanup_reorder_tbl(pmpriv,
+							 ptdls_oper->peer_mac);
+				wlan_11n_cleanup_txbastream_tbl(
+					pmpriv, ptdls_oper->peer_mac);
+			}
+			if (sta_ptr->status >= TDLS_SETUP_INPROGRESS)
+				wlan_delete_station_entry(pmpriv,
+							  ptdls_oper->peer_mac);
+		}
+		if (MTRUE == wlan_is_station_list_empty(pmpriv))
+			pmadapter->tdls_status = TDLS_NOT_SETUP;
+		else
+			pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+
+		if (reason)
+			PRINTM(MMSG,
+			       "TDLS: Delete link " MACSTR " fail, reason=%d\n",
+			       MAC2STR(ptdls_oper->peer_mac), reason);
+		else
+			PRINTM(MMSG, "TDLS: Delete link " MACSTR " success\n",
+			       MAC2STR(ptdls_oper->peer_mac));
+		break;
+	default:
+		break;
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function handles the command response of sysclock
  *
@@ -1938,18 +2405,18 @@ static mlan_status wlan_ret_dfs_repeater_cfg(pmlan_private pmpriv,
  *
  *  @return             MLAN_STATUS_SUCCESS
  */
-mlan_status wlan_ret_coalesce_config(pmlan_private pmpriv,
-				     HostCmd_DS_COMMAND *resp,
-				     mlan_ioctl_req *pioctl_buf)
+static mlan_status wlan_ret_coalesce_config(pmlan_private pmpriv,
+					    HostCmd_DS_COMMAND *resp,
+					    mlan_ioctl_req *pioctl_buf)
 {
 	ENTER();
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
 
-mlan_status wlan_ret_get_sensor_temp(pmlan_private pmpriv,
-				     const HostCmd_DS_COMMAND *resp,
-				     mlan_ioctl_req *pioctl_buf)
+static mlan_status wlan_ret_get_sensor_temp(pmlan_private pmpriv,
+					    const HostCmd_DS_COMMAND *resp,
+					    mlan_ioctl_req *pioctl_buf)
 {
 	mlan_ds_misc_cfg *pcfg = MNULL;
 	const HostCmd_DS_SENSOR_TEMP *pSensorT = &resp->params.temp_sensor;
@@ -2238,6 +2705,13 @@ static mlan_status wlan_ret_mfg_tx_frame(pmlan_private pmpriv,
 	cfg->tx_bf = wlan_le32_to_cpu(mcmd->tx_bf);
 	cfg->gf_mode = wlan_le32_to_cpu(mcmd->gf_mode);
 	cfg->stbc = wlan_le32_to_cpu(mcmd->stbc);
+	cfg->NumPkt = wlan_le32_to_cpu(mcmd->NumPkt);
+	cfg->MaxPE = wlan_le32_to_cpu(mcmd->MaxPE);
+	cfg->BeamChange = wlan_le32_to_cpu(mcmd->BeamChange);
+	cfg->Dcm = wlan_le32_to_cpu(mcmd->Dcm);
+	cfg->Doppler = wlan_le32_to_cpu(mcmd->Doppler);
+	cfg->MidP = wlan_le32_to_cpu(mcmd->MidP);
+	cfg->QNum = wlan_le32_to_cpu(mcmd->QNum);
 	memcpy_ext(pmpriv->adapter, cfg->bssid, mcmd->bssid,
 		   MLAN_MAC_ADDR_LENGTH, sizeof(cfg->bssid));
 
@@ -2245,6 +2719,43 @@ static mlan_status wlan_ret_mfg_tx_frame(pmlan_private pmpriv,
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ *  @brief This function prepares command resp of MFG HE TB Tx
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+
+static mlan_status wlan_ret_mfg_he_tb_tx(pmlan_private pmpriv,
+					 HostCmd_DS_COMMAND *resp,
+					 mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc = MNULL;
+	struct mfg_Cmd_HE_TBTx_t *mcmd =
+		(struct mfg_Cmd_HE_TBTx_t *)&resp->params.mfg_he_power;
+	struct mfg_Cmd_HE_TBTx_t *cfg = MNULL;
+
+	ENTER();
+	if (!pioctl_buf) {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+	misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+	cfg = (struct mfg_Cmd_HE_TBTx_t *)&misc->param.mfg_he_power;
+
+	cfg->enable = wlan_le16_to_cpu(mcmd->enable);
+	cfg->qnum = wlan_le16_to_cpu(mcmd->qnum);
+	cfg->aid = wlan_le16_to_cpu(mcmd->aid);
+	cfg->axq_mu_timer = wlan_le16_to_cpu(mcmd->axq_mu_timer);
+	cfg->tx_power = wlan_le16_to_cpu(mcmd->tx_power);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function prepares command resp of MFG Cmd
  *
@@ -2275,6 +2786,9 @@ mlan_status wlan_ret_mfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 	case MFG_CMD_TX_FRAME:
 		ret = wlan_ret_mfg_tx_frame(pmpriv, resp, pioctl_buf);
 		goto cmd_mfg_done;
+	case MFG_CMD_CONFIG_MAC_HE_TB_TX:
+		ret = wlan_ret_mfg_he_tb_tx(pmpriv, resp, pioctl_buf);
+		goto cmd_mfg_done;
 	case MFG_CMD_SET_TEST_MODE:
 	case MFG_CMD_UNSET_TEST_MODE:
 	case MFG_CMD_TX_ANT:
@@ -2283,6 +2797,7 @@ mlan_status wlan_ret_mfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 	case MFG_CMD_CLR_RX_ERR:
 	case MFG_CMD_RF_BAND_AG:
 	case MFG_CMD_RF_CHANNELBW:
+	case MFG_CMD_RADIO_MODE_CFG:
 	case MFG_CMD_RFPWR:
 		break;
 	default:
@@ -2510,15 +3025,18 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 				pmadapter->pcard_sd->reg->data_port_mask;
 
 			for (ctr = 1;
-			     ctr <= MAX_PORT - pmadapter->pcard_sd->mp_end_port;
+			     ctr <= pmadapter->pcard_sd->max_ports -
+					    pmadapter->pcard_sd->mp_end_port;
 			     ctr++) {
 				pmadapter->pcard_sd->mp_data_port_mask &=
-					~(1 << (MAX_PORT - ctr));
+					~(1 << (pmadapter->pcard_sd->max_ports -
+						ctr));
 			}
 
-			pmadapter->pcard_sd->curr_wr_port = 0;
+			pmadapter->pcard_sd->curr_wr_port =
+				pmadapter->pcard_sd->reg->start_wr_port;
 			pmadapter->pcard_sd->mpa_tx.pkt_aggr_limit =
-				MIN(SDIO_MP_AGGR_DEF_PKT_LIMIT,
+				MIN(pmadapter->pcard_sd->mp_aggr_pkt_limit,
 				    (pmadapter->pcard_sd->mp_end_port >> 1));
 			PRINTM(MCMND, "end port %d, data port mask %x\n",
 			       wlan_le16_to_cpu(
@@ -2562,6 +3080,12 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_MGMT_IE_LIST:
 		ret = wlan_ret_mgmt_ie_list(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_TDLS_CONFIG:
+		ret = wlan_ret_tdls_config(pmpriv, resp, pioctl_buf);
+		break;
+	case HostCmd_CMD_TDLS_OPERATION:
+		ret = wlan_ret_tdls_oper(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_11N_CFG:
 		ret = wlan_ret_11n_cfg(pmpriv, resp, pioctl_buf);
 		break;
@@ -2722,6 +3246,9 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 		ret = wlan_ret_dot11mc_unassoc_ftm_cfg(pmpriv, resp,
 						       pioctl_buf);
 		break;
+	case HostCmd_CMD_HAL_PHY_CFG:
+		ret = wlan_ret_hal_phy_cfg(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_RATE_ADAPT_CFG:
 		ret = wlan_ret_rate_adapt_cfg(pmpriv, resp, pioctl_buf);
 		break;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
index 7060d0e..29bad5b 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
@@ -3,7 +3,7 @@
  *  @brief This file contains MLAN event handling.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -65,6 +65,272 @@ static t_void wlan_handle_disconnect_event(pmlan_private pmpriv)
 	LEAVE();
 }
 
+/**
+ *  @brief This function will parse the TDLS event for further wlan action
+ *
+ *  @param priv     A pointer to mlan_private
+ *  @param pevent   A pointer to event buf
+ *
+ *  @return         N/A
+ */
+static void wlan_parse_tdls_event(pmlan_private priv, pmlan_buffer pevent)
+{
+	Event_tdls_generic *tdls_event =
+		(Event_tdls_generic *)(pevent->pbuf + pevent->data_offset +
+				       sizeof(mlan_event_id));
+	sta_node *sta_ptr = MNULL;
+	pmlan_adapter pmadapter = priv->adapter;
+	t_u8 i = 0;
+	IEEEtypes_HTCap_t *pht_cap = MNULL;
+	t_u16 ie_len = 0;
+	mlan_ds_misc_tdls_oper tdls_oper;
+	t_u8 event_buf[100];
+	mlan_event *ptdls_event = (mlan_event *)event_buf;
+	tdls_tear_down_event *tdls_evt =
+		(tdls_tear_down_event *)ptdls_event->event_buf;
+	ENTER();
+
+	/* reason code is not mandatory, hence less by sizeof(t_u16) */
+	if (pevent->data_len < (sizeof(Event_tdls_generic) - sizeof(t_u16) -
+				sizeof(mlan_event_id))) {
+		PRINTM(MERROR, "Invalid length %d for TDLS event\n",
+		       pevent->data_len);
+		LEAVE();
+		return;
+	}
+	sta_ptr = wlan_get_station_entry(priv, tdls_event->peer_mac_addr);
+	PRINTM(MEVENT, "TDLS_EVENT: %d " MACSTR "\n",
+	       wlan_le16_to_cpu(tdls_event->event_type),
+	       MAC2STR(tdls_event->peer_mac_addr));
+	switch (wlan_le16_to_cpu(tdls_event->event_type)) {
+	case TDLS_EVENT_TYPE_SETUP_REQ:
+		if (sta_ptr == MNULL) {
+			sta_ptr = wlan_add_station_entry(
+				priv, tdls_event->peer_mac_addr);
+			if (sta_ptr) {
+				sta_ptr->status = TDLS_SETUP_INPROGRESS;
+				wlan_hold_tdls_packets(
+					priv, tdls_event->peer_mac_addr);
+			}
+		}
+		break;
+
+	case TDLS_EVENT_TYPE_LINK_ESTABLISHED:
+		if (sta_ptr) {
+			sta_ptr->status = TDLS_SETUP_COMPLETE;
+			/* parse the TLV for station's capability */
+			ie_len = wlan_le16_to_cpu(
+				tdls_event->u.ie_data.ie_length);
+			if (ie_len) {
+				pht_cap = (IEEEtypes_HTCap_t *)
+					wlan_get_specific_ie(
+						priv,
+						tdls_event->u.ie_data.ie_ptr,
+						ie_len, HT_CAPABILITY, 0);
+				if (pht_cap) {
+					sta_ptr->is_11n_enabled = MTRUE;
+					if (GETHT_MAXAMSDU(
+						    pht_cap->ht_cap.ht_cap_info))
+						sta_ptr->max_amsdu =
+							MLAN_TX_DATA_BUF_SIZE_8K;
+					else
+						sta_ptr->max_amsdu =
+							MLAN_TX_DATA_BUF_SIZE_4K;
+				}
+			}
+			for (i = 0; i < MAX_NUM_TID; i++) {
+				if (sta_ptr->is_11n_enabled)
+					sta_ptr->ampdu_sta[i] =
+						priv->aggr_prio_tbl[i]
+							.ampdu_user;
+				else
+					sta_ptr->ampdu_sta[i] =
+						BA_STREAM_NOT_ALLOWED;
+			}
+			memset(priv->adapter, sta_ptr->rx_seq, 0xff,
+			       sizeof(sta_ptr->rx_seq));
+			wlan_restore_tdls_packets(priv,
+						  tdls_event->peer_mac_addr,
+						  TDLS_SETUP_COMPLETE);
+			pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+		}
+		break;
+
+	case TDLS_EVENT_TYPE_SETUP_FAILURE:
+		wlan_restore_tdls_packets(priv, tdls_event->peer_mac_addr,
+					  TDLS_SETUP_FAILURE);
+		if (sta_ptr)
+			wlan_delete_station_entry(priv,
+						  tdls_event->peer_mac_addr);
+		if (MTRUE == wlan_is_station_list_empty(priv))
+			pmadapter->tdls_status = TDLS_NOT_SETUP;
+		else
+			pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+		break;
+	case TDLS_EVENT_TYPE_LINK_TORN_DOWN:
+		if (sta_ptr) {
+			if (sta_ptr->external_tdls) {
+				PRINTM(MMSG,
+				       "Receive TDLS TEAR DOWN event, Disable TDLS LINK\n");
+				pmadapter->tdls_status = TDLS_TEAR_DOWN;
+				memset(pmadapter, &tdls_oper, 0,
+				       sizeof(tdls_oper));
+				tdls_oper.tdls_action = WLAN_TDLS_DISABLE_LINK;
+				memcpy_ext(priv->adapter, tdls_oper.peer_mac,
+					   tdls_event->peer_mac_addr,
+					   MLAN_MAC_ADDR_LENGTH,
+					   MLAN_MAC_ADDR_LENGTH);
+				/* Send command to firmware to delete tdls
+				 * link*/
+				wlan_prepare_cmd(priv,
+						 HostCmd_CMD_TDLS_OPERATION,
+						 HostCmd_ACT_GEN_SET, 0,
+						 (t_void *)MNULL, &tdls_oper);
+				ptdls_event->bss_index = priv->bss_index;
+				ptdls_event->event_id =
+					MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ;
+				ptdls_event->event_len =
+					sizeof(tdls_tear_down_event);
+				memcpy_ext(priv->adapter,
+					   (t_u8 *)tdls_evt->peer_mac_addr,
+					   tdls_event->peer_mac_addr,
+					   MLAN_MAC_ADDR_LENGTH,
+					   MLAN_MAC_ADDR_LENGTH);
+				tdls_evt->reason_code = wlan_le16_to_cpu(
+					tdls_event->u.reason_code);
+				wlan_recv_event(
+					priv,
+					MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ,
+					ptdls_event);
+				/* Signal MOAL to trigger mlan_main_process */
+				wlan_recv_event(
+					priv, MLAN_EVENT_ID_DRV_DEFER_HANDLING,
+					MNULL);
+				LEAVE();
+				return;
+			}
+			wlan_restore_tdls_packets(priv,
+						  tdls_event->peer_mac_addr,
+						  TDLS_TEAR_DOWN);
+			if (sta_ptr->is_11n_enabled) {
+				wlan_cleanup_reorder_tbl(
+					priv, tdls_event->peer_mac_addr);
+				wlan_11n_cleanup_txbastream_tbl(
+					priv, tdls_event->peer_mac_addr);
+			}
+			wlan_delete_station_entry(priv,
+						  tdls_event->peer_mac_addr);
+			if (MTRUE == wlan_is_station_list_empty(priv))
+				pmadapter->tdls_status = TDLS_NOT_SETUP;
+			else
+				pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+		}
+		break;
+	case TDLS_EVENT_TYPE_CHAN_SWITCH_RESULT:
+		PRINTM(MEVENT,
+		       "TDLS_CHAN_SWITCH_RESULT: status=0x%x, reason=0x%x current_channel=%d\n",
+		       tdls_event->u.switch_result.status,
+		       tdls_event->u.switch_result.reason,
+		       (int)tdls_event->u.switch_result.current_channel);
+		if (tdls_event->u.switch_result.status == MLAN_STATUS_SUCCESS) {
+			if (tdls_event->u.switch_result.current_channel ==
+			    TDLS_BASE_CHANNEL) {
+				/* enable traffic to AP */
+				if (pmadapter->tdls_status !=
+				    TDLS_IN_BASE_CHANNEL) {
+					wlan_update_non_tdls_ralist(
+						priv, tdls_event->peer_mac_addr,
+						MFALSE);
+					pmadapter->tdls_status =
+						TDLS_IN_BASE_CHANNEL;
+				}
+			} else if (tdls_event->u.switch_result.current_channel ==
+				   TDLS_OFF_CHANNEL) {
+				/* pause traffic to AP */
+				if (pmadapter->tdls_status !=
+				    TDLS_IN_OFF_CHANNEL) {
+					wlan_update_non_tdls_ralist(
+						priv, tdls_event->peer_mac_addr,
+						MTRUE);
+					pmadapter->tdls_status =
+						TDLS_IN_OFF_CHANNEL;
+				}
+			}
+		} else {
+			if (tdls_event->u.switch_result.current_channel ==
+			    TDLS_BASE_CHANNEL)
+				pmadapter->tdls_status = TDLS_IN_BASE_CHANNEL;
+			else if (tdls_event->u.switch_result.current_channel ==
+				 TDLS_OFF_CHANNEL)
+				pmadapter->tdls_status = TDLS_IN_OFF_CHANNEL;
+		}
+		break;
+	case TDLS_EVENT_TYPE_START_CHAN_SWITCH:
+		PRINTM(MEVENT, "TDLS start channel switch....\n");
+		pmadapter->tdls_status = TDLS_SWITCHING_CHANNEL;
+		break;
+	case TDLS_EVENT_TYPE_CHAN_SWITCH_STOPPED:
+		PRINTM(MEVENT, "TDLS channel switch stopped, reason=%d\n",
+		       tdls_event->u.cs_stop_reason);
+		break;
+	case TDLS_EVENT_TYPE_DEBUG:
+	case TDLS_EVENT_TYPE_PACKET:
+		break;
+	default:
+		PRINTM(MERROR, "unknown event type %d\n",
+		       wlan_le16_to_cpu(tdls_event->event_type));
+		break;
+	}
+	LEAVE();
+}
+
+/**
+ *  @brief This function send the tdls teardown request event.
+ *
+ *  @param priv    A pointer to mlan_private
+ *
+ *  @return        N/A
+ */
+static void wlan_send_tdls_tear_down_request(pmlan_private priv)
+{
+	t_u8 event_buf[100];
+	mlan_event *ptdls_event = (mlan_event *)event_buf;
+	tdls_tear_down_event *tdls_evt =
+		(tdls_tear_down_event *)ptdls_event->event_buf;
+	sta_node *sta_ptr = MNULL;
+
+	ENTER();
+
+	sta_ptr = (sta_node *)util_peek_list(
+		priv->adapter->pmoal_handle, &priv->sta_list,
+		priv->adapter->callbacks.moal_spin_lock,
+		priv->adapter->callbacks.moal_spin_unlock);
+	if (!sta_ptr) {
+		LEAVE();
+		return;
+	}
+	while (sta_ptr != (sta_node *)&priv->sta_list) {
+		if (sta_ptr->external_tdls) {
+			ptdls_event->bss_index = priv->bss_index;
+			ptdls_event->event_id =
+				MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ;
+			ptdls_event->event_len = sizeof(tdls_tear_down_event);
+			memcpy_ext(priv->adapter,
+				   (t_u8 *)tdls_evt->peer_mac_addr,
+				   sta_ptr->mac_addr, MLAN_MAC_ADDR_LENGTH,
+				   MLAN_MAC_ADDR_LENGTH);
+			tdls_evt->reason_code =
+				MLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED;
+			wlan_recv_event(priv,
+					MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ,
+					ptdls_event);
+		}
+		sta_ptr = sta_ptr->pnext;
+	}
+	LEAVE();
+	return;
+}
+
 /********************************************************
 			Global Functions
 ********************************************************/
@@ -170,6 +436,11 @@ t_void wlan_reset_connect_state(pmlan_private priv, t_u8 drv_disconnect)
 		memset(pmadapter, &priv->curr_bss_params, 0x00,
 		       sizeof(priv->curr_bss_params));
 	}
+	wlan_send_tdls_tear_down_request(priv);
+	wlan_delete_station_list(priv);
+	pmadapter->tdls_status = TDLS_NOT_SETUP;
+	priv->wmm_qosinfo = priv->saved_wmm_qosinfo;
+	pmadapter->sleep_period.period = pmadapter->saved_sleep_period.period;
 	pmadapter->tx_lock_flag = MFALSE;
 	pmadapter->pps_uapsd_mode = MFALSE;
 	pmadapter->delay_null_pkt = MFALSE;
@@ -194,6 +465,11 @@ t_void wlan_reset_connect_state(pmlan_private priv, t_u8 drv_disconnect)
 		return;
 	}
 
+	if (pmadapter->pending_disconnect_priv) {
+		LEAVE();
+		return;
+	}
+
 	pevent->bss_index = priv->bss_index;
 	pevent->event_id = MLAN_EVENT_ID_FW_DISCONNECTED;
 	pevent->event_len = sizeof(priv->disconnect_reason_code);
@@ -258,6 +534,8 @@ static void wlan_process_sta_tx_pause_event(pmlan_private priv,
 		(MrvlIEtypesHeader_t *)(pevent->pbuf + pevent->data_offset +
 					sizeof(t_u32));
 	MrvlIEtypes_tx_pause_t *tx_pause_tlv;
+	sta_node *sta_ptr = MNULL;
+	tdlsStatus_e status;
 	t_u8 *bssid = MNULL;
 	ENTER();
 	if (priv->media_connected)
@@ -284,6 +562,27 @@ static void wlan_process_sta_tx_pause_event(pmlan_private priv,
 					priv->tx_pause = MTRUE;
 				else
 					priv->tx_pause = MFALSE;
+			} else {
+				status = wlan_get_tdls_link_status(
+					priv, tx_pause_tlv->peermac);
+				if (MTRUE == wlan_is_tdls_link_setup(status)) {
+					sta_ptr = wlan_get_station_entry(
+						priv, tx_pause_tlv->peermac);
+					if (sta_ptr) {
+						if (sta_ptr->tx_pause !=
+						    tx_pause_tlv->tx_pause) {
+							sta_ptr->tx_pause =
+								tx_pause_tlv
+									->tx_pause;
+							wlan_update_ralist_tx_pause(
+								priv,
+								tx_pause_tlv
+									->peermac,
+								tx_pause_tlv
+									->tx_pause);
+						}
+					}
+				}
 			}
 		}
 		tlv_buf_left -= (sizeof(MrvlIEtypesHeader_t) + tlv_len);
@@ -711,7 +1010,7 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 		PRINTM(MEVENT, "EVENT: Measurement Report Ready (%#x)\n",
 		       eventcause);
 		ret = wlan_prepare_cmd(priv, HostCmd_CMD_MEASUREMENT_REPORT,
-				       HostCmd_ACT_GEN_SET, 0, 0, MNULL);
+				       HostCmd_ACT_GEN_SET, 0, MNULL, MNULL);
 		break;
 	case EVENT_WMM_STATUS_CHANGE:
 		if (pmbuf &&
@@ -908,6 +1207,17 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 		wlan_recv_event(pmpriv, MLAN_EVENT_ID_FW_REMAIN_ON_CHAN_EXPIRED,
 				MNULL);
 		break;
+	case EVENT_TDLS_GENERIC_EVENT:
+		PRINTM(MEVENT, "EVENT: TDLS event %d\n", eventcause);
+		wlan_parse_tdls_event(pmpriv, pmbuf);
+		pevent->bss_index = pmpriv->bss_index;
+		pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
+		pevent->event_len = pmbuf->data_len;
+		memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
+			   pmbuf->pbuf + pmbuf->data_offset, pevent->event_len,
+			   pevent->event_len);
+		wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		break;
 
 	case EVENT_TX_DATA_PAUSE:
 		PRINTM(MEVENT, "EVENT: TX_DATA_PAUSE\n");
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
index 0b0d532..81fab2e 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
@@ -3,7 +3,7 @@
  *  @brief This file contains the functions for station ioctl.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -1377,8 +1377,8 @@ static mlan_status wlan_query_passphrase(mlan_private *priv,
  *  @return		MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success,
  * otherwise fail
  */
-mlan_status wlan_bss_ioctl_find_bss(pmlan_adapter pmadapter,
-				    pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_bss_ioctl_find_bss(pmlan_adapter pmadapter,
+					   pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -1421,8 +1421,8 @@ mlan_status wlan_bss_ioctl_find_bss(pmlan_adapter pmadapter,
  *  @return		MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success,
  * otherwise fail
  */
-mlan_status wlan_bss_ioctl_find_bssid(pmlan_adapter pmadapter,
-				      pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_bss_ioctl_find_bssid(pmlan_adapter pmadapter,
+					     pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_ds_bss *bss = MNULL;
@@ -1455,8 +1455,9 @@ mlan_status wlan_bss_ioctl_find_bssid(pmlan_adapter pmadapter,
  *  @return		MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success,
  * otherwise fail
  */
-mlan_status wlan_bss_ioctl_bss_11d_check_channel(pmlan_adapter pmadapter,
-						 pmlan_ioctl_req pioctl_req)
+static mlan_status
+wlan_bss_ioctl_bss_11d_check_channel(pmlan_adapter pmadapter,
+				     pmlan_ioctl_req pioctl_req)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_bss *bss = MNULL;
@@ -2716,7 +2717,7 @@ static mlan_status wlan_sec_ioctl_encrypt_mode(pmlan_adapter pmadapter,
  *
  *  @return		random charactor
  */
-t_u8 wlan_get_random_charactor(pmlan_adapter pmadapter)
+static t_u8 wlan_get_random_charactor(pmlan_adapter pmadapter)
 {
 	t_u32 sec, usec;
 	t_u8 ch = 0;
@@ -2842,7 +2843,8 @@ static mlan_status wlan_sec_ioctl_set_wep_key(pmlan_adapter pmadapter,
 				else
 					sec->param.encrypt_key.key_len =
 						WEP_104_BIT_LEN;
-				for (i = 0; i < sec->param.encrypt_key.key_len;
+				for (i = 0;
+				     i < (int)sec->param.encrypt_key.key_len;
 				     i++)
 					sec->param.encrypt_key.key_material[i] =
 						wlan_get_random_charactor(
@@ -4239,12 +4241,11 @@ static mlan_status wlan_misc_ioctl_soft_reset(pmlan_adapter pmadapter,
  *
  *  @return             MLAN_STATUS_PENDING -- success, otherwise fail
  */
-mlan_status wlan_misc_ioctl_thermal(pmlan_adapter pmadapter,
-				    pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_misc_ioctl_thermal(pmlan_adapter pmadapter,
+					   pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_ds_misc_cfg *misc = MNULL;
 	t_u16 cmd_action = 0;
 
 	ENTER();
@@ -4259,7 +4260,6 @@ mlan_status wlan_misc_ioctl_thermal(pmlan_adapter pmadapter,
 		return MLAN_STATUS_RESOURCE;
 	}
 
-	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
 	if (pioctl_req->action == MLAN_ACT_SET) {
 		PRINTM(MERROR, "Thermal reading setting is not allowed!\n");
 		LEAVE();
@@ -4287,8 +4287,8 @@ mlan_status wlan_misc_ioctl_thermal(pmlan_adapter pmadapter,
  *
  *  @return             MLAN_STATUS_PENDING -- success, otherwise fail
  */
-mlan_status wlan_misc_ioctl_subscribe_evt(pmlan_adapter pmadapter,
-					  pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_misc_ioctl_subscribe_evt(pmlan_adapter pmadapter,
+						 pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -4319,110 +4319,6 @@ mlan_status wlan_misc_ioctl_subscribe_evt(pmlan_adapter pmadapter,
 #define FLTR_BUF_IP_OFFSET_2_IP_1 9
 #define FLTR_BUF_IP_OFFSET_2_IP_2 26
 
-/**
- *  @brief Enable/Disable Auto ARP resonse
- *
- *  @param pmadapter    A pointer to mlan_adapter structure
- *  @param pioctl_req   A pointer to ioctl request buffer
- *  @param ipv4_addr    ipv4 Address
- *  @param num_ipv4     Number of ipv4 Addresses
- *
- *  @return             MLAN_STATUS_PENDING --success, otherwise fail
- */
-mlan_status wlan_ipaddr_auto_arp_resp(pmlan_adapter pmadapter,
-				      pmlan_ioctl_req pioctl_req,
-				      t_u32 *ipv4_addr, t_u8 num_ipv4)
-{
-	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_status ret = MLAN_STATUS_SUCCESS;
-	HostCmd_DS_GEN *hostcmd_hdr;
-	HostCmd_DS_MEF_CFG *mefcmd;
-	pmlan_callbacks pcb = &pmadapter->callbacks;
-	mlan_ds_misc_cmd *hostcmd;
-	t_u32 buf_len = 0;
-	t_u8 *buf, *filter;
-
-	t_u8 fltr_buf[] = {0x01, 0x10, 0x21, 0x00, 0x01, 0x00, 0x00, 0x00,
-			   0x01, 0x08, 0x06, 0x02, 0x02, 0x14, 0x00, 0x00,
-			   0x00, 0x01, 0x41, 0x01, 0x00, 0x00, 0x00, 0x01,
-			   0xc0, 0xa8, 0x01, 0x6d, 0x04, 0x02, 0x2e, 0x00,
-			   0x00, 0x00, 0x01, 0x41, 0x44};
-	t_u8 fltr_buf_2_ip[] = {0x01, 0x10, 0x33, 0x00, 0x01, 0x00, 0x00, 0x00,
-				0x01, 0xc0, 0xa8, 0x01, 0x6d, 0x04, 0x02, 0x2e,
-				0x00, 0x00, 0x00, 0x01, 0x41, 0x01, 0x00, 0x00,
-				0x00, 0x01, 0xc0, 0xa8, 0x02, 0x6d, 0x04, 0x02,
-				0x2e, 0x00, 0x00, 0x00, 0x01, 0x41, 0x45, 0x01,
-				0x00, 0x00, 0x00, 0x01, 0x08, 0x06, 0x02, 0x02,
-				0x14, 0x00, 0x00, 0x00, 0x01, 0x41, 0x44};
-
-	ENTER();
-
-	ret = pcb->moal_malloc(pmadapter->pmoal_handle,
-			       sizeof(mlan_ds_misc_cmd), MLAN_MEM_DEF,
-			       (t_u8 **)&hostcmd);
-
-	if (ret != MLAN_STATUS_SUCCESS || hostcmd == MNULL) {
-		PRINTM(MERROR, "Failed to allocate hostcmd  buffer\n");
-		pioctl_req->status_code = MLAN_ERROR_NO_MEM;
-		LEAVE();
-		return MLAN_STATUS_FAILURE;
-	}
-
-	memset(pmpriv->adapter, hostcmd, 0, sizeof(mlan_ds_misc_cmd));
-	buf = hostcmd->cmd;
-
-	/* Prepare hostcmd buffer */
-	hostcmd_hdr = (HostCmd_DS_GEN *)(buf);
-	hostcmd_hdr->command = wlan_cpu_to_le16(HostCmd_CMD_MEF_CFG);
-	mefcmd = (HostCmd_DS_MEF_CFG *)(buf + S_DS_GEN);
-	buf_len = S_DS_GEN;
-
-	if (!ipv4_addr) {
-		PRINTM(MINFO, "Disable Auto ARP Response\n");
-		mefcmd->criteria = wlan_cpu_to_le32(0);
-		mefcmd->nentries = wlan_cpu_to_le16(0);
-		buf_len += sizeof(HostCmd_DS_MEF_CFG);
-	} else {
-		/* Event bit (bit2) of HS conditions should be masked out */
-		mefcmd->criteria = wlan_cpu_to_le32(
-			pmpriv->adapter->hs_cfg.conditions & ~MBIT(2));
-		mefcmd->nentries = wlan_cpu_to_le16(1);
-		buf_len += sizeof(HostCmd_DS_MEF_CFG);
-		filter = buf + buf_len;
-		if (num_ipv4 == 1) {
-			memcpy_ext(pmpriv->adapter, filter, fltr_buf,
-				   sizeof(fltr_buf), sizeof(fltr_buf));
-			memcpy_ext(pmpriv->adapter, &filter[FLTR_BUF_IP_OFFSET],
-				   &ipv4_addr[0], sizeof(t_u32), sizeof(t_u32));
-			buf_len += sizeof(fltr_buf);
-		} else if (num_ipv4 >= 2) {
-			memcpy_ext(pmpriv->adapter, filter, fltr_buf_2_ip,
-				   sizeof(fltr_buf_2_ip),
-				   sizeof(fltr_buf_2_ip));
-			memcpy_ext(pmpriv->adapter,
-				   &filter[FLTR_BUF_IP_OFFSET_2_IP_1],
-				   &ipv4_addr[0], sizeof(t_u32), sizeof(t_u32));
-			memcpy_ext(pmpriv->adapter,
-				   &filter[FLTR_BUF_IP_OFFSET_2_IP_2],
-				   &ipv4_addr[1], sizeof(t_u32), sizeof(t_u32));
-			buf_len += sizeof(fltr_buf_2_ip);
-		}
-	}
-	hostcmd_hdr->size = wlan_cpu_to_le16(buf_len);
-	hostcmd->len = buf_len;
-
-	/* Send command to firmware */
-	ret = wlan_prepare_cmd(pmpriv, 0, 0, 0, (t_void *)pioctl_req,
-			       (t_void *)hostcmd);
-	if (ret == MLAN_STATUS_SUCCESS)
-		ret = MLAN_STATUS_PENDING;
-
-	pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)hostcmd);
-
-	LEAVE();
-	return ret;
-}
-
 /**
  *  @brief MEF configuration
  *
@@ -4431,8 +4327,8 @@ mlan_status wlan_ipaddr_auto_arp_resp(pmlan_adapter pmadapter,
  *
  *  @return             MLAN_STATUS_PENDING --success, otherwise fail
  */
-mlan_status wlan_misc_ioctl_mef_cfg(pmlan_adapter pmadapter,
-				    pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_misc_ioctl_mef_cfg(pmlan_adapter pmadapter,
+					   pmlan_ioctl_req pioctl_req)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
@@ -4540,8 +4436,8 @@ done:
  *
  *  @return             MLAN_STATUS_PENDING --success, otherwise fail
  */
-mlan_status wlan_misc_ioctl_ipaddr_cfg(pmlan_adapter pmadapter,
-				       pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_misc_ioctl_ipaddr_cfg(pmlan_adapter pmadapter,
+					      pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
@@ -4559,7 +4455,7 @@ mlan_status wlan_misc_ioctl_ipaddr_cfg(pmlan_adapter pmadapter,
 		goto done;
 	}
 	/* only one IP is supported in current firmware */
-	for (i = 0; i < misc->param.ipaddr_cfg.ip_addr_num; i++) {
+	for (i = 0; i < (int)misc->param.ipaddr_cfg.ip_addr_num; i++) {
 		memcpy_ext(pmadapter, &ipv4_addr[i],
 			   misc->param.ipaddr_cfg.ip_addr[i], sizeof(t_u32),
 			   sizeof(t_u32));
@@ -4594,8 +4490,8 @@ done:
  *
  *  @return             MLAN_STATUS_PENDING --success, otherwise fail
  */
-mlan_status wlan_misc_ioctl_cfp_code_cfg(pmlan_adapter pmadapter,
-					 pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_misc_ioctl_cfp_code_cfg(pmlan_adapter pmadapter,
+						pmlan_ioctl_req pioctl_req)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
@@ -4682,8 +4578,8 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_misc_ioctl_country_code(pmlan_adapter pmadapter,
-					 mlan_ioctl_req *pioctl_req)
+static mlan_status wlan_misc_ioctl_country_code(pmlan_adapter pmadapter,
+						mlan_ioctl_req *pioctl_req)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
@@ -4751,8 +4647,8 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_misc_pmfcfg(pmlan_adapter pmadapter,
-			     mlan_ioctl_req *pioctl_req)
+static mlan_status wlan_misc_pmfcfg(pmlan_adapter pmadapter,
+				    mlan_ioctl_req *pioctl_req)
 {
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -4829,18 +4725,15 @@ mlan_status wlan_misc_ioctl_tp_state(pmlan_adapter pmadapter,
 	return ret;
 }
 
-mlan_status wlan_misc_ioctl_get_sensor_temp(pmlan_adapter pmadapter,
-					    pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_misc_ioctl_get_sensor_temp(pmlan_adapter pmadapter,
+						   pmlan_ioctl_req pioctl_req)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	mlan_ds_misc_cfg *misc = MNULL;
 	t_u16 cmd_action = 0;
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 
 	ENTER();
 
-	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
-
 	if (pioctl_req->action == MLAN_ACT_GET)
 		cmd_action = HostCmd_ACT_GEN_GET;
 	else {
@@ -4868,8 +4761,8 @@ mlan_status wlan_misc_ioctl_get_sensor_temp(pmlan_adapter pmadapter,
  *
  *  @return		MLAN_STATUS_SUCCESS --success, otherwise fail
  */
-mlan_status wlan_misc_ioctl_gtk_rekey_offload(pmlan_adapter pmadapter,
-					      pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_misc_ioctl_gtk_rekey_offload(pmlan_adapter pmadapter,
+						     pmlan_ioctl_req pioctl_req)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_misc_cfg *misc_cfg = MNULL;
@@ -4914,8 +4807,8 @@ mlan_status wlan_misc_ioctl_gtk_rekey_offload(pmlan_adapter pmadapter,
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_misc_cloud_keep_alive(pmlan_adapter pmadapter,
-				       mlan_ioctl_req *pioctl_req)
+static mlan_status wlan_misc_cloud_keep_alive(pmlan_adapter pmadapter,
+					      mlan_ioctl_req *pioctl_req)
 {
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_ds_misc_cfg *misc = MNULL;
@@ -5022,6 +4915,21 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 		status = wlan_misc_ioctl_custom_ie_list(pmadapter, pioctl_req,
 							MTRUE);
 		break;
+	case MLAN_OID_MISC_TDLS_CONFIG:
+		status = wlan_misc_ioctl_tdls_config(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_TDLS_OPER:
+		status = wlan_misc_ioctl_tdls_oper(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_GET_TDLS_IES:
+		status = wlan_misc_ioctl_tdls_get_ies(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_TDLS_CS_CHANNEL:
+		status = wlan_misc_ioctl_tdls_cs_channel(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_TDLS_IDLE_TIME:
+		status = wlan_misc_ioctl_tdls_idle_time(pmadapter, pioctl_req);
+		break;
 
 	case MLAN_OID_MISC_MAC_CONTROL:
 		status = wlan_misc_ioctl_mac_control(pmadapter, pioctl_req);
@@ -5160,6 +5068,9 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 			status = wlan_misc_ssu(pmadapter, pioctl_req);
 		break;
 #endif
+	case MLAN_OID_MISC_HAL_PHY_CFG:
+		status = wlan_misc_hal_phy_cfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_RX_ABORT_CFG:
 		status = wlan_misc_ioctl_rxabortcfg(pmadapter, pioctl_req);
 		break;
@@ -5189,6 +5100,7 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 	case MLAN_OID_MISC_RF_TEST_GENERIC:
 	case MLAN_OID_MISC_RF_TEST_TX_CONT:
 	case MLAN_OID_MISC_RF_TEST_TX_FRAME:
+	case MLAN_OID_MISC_RF_TEST_HE_POWER:
 		status = wlan_misc_ioctl_rf_test_cfg(pmadapter, pioctl_req);
 		break;
 	case MLAN_OID_MISC_ARB_CONFIG:
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c
index a2a7006..9446c07 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c
@@ -4,7 +4,7 @@
  *  module.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -157,6 +157,208 @@ static t_u8 discard_gratuitous_ARP_msg(RxPacketHdr_t *prx_pkt,
 	return ret;
 }
 
+/**
+ *  @brief This function process tdls action frame
+ *
+ *  @param priv        A pointer to mlan_private structure
+ *  @param pbuf        A pointer to tdls action frame buffer
+ *  @param len         len of tdls action frame buffer
+ *  @return            N/A
+ */
+void wlan_process_tdls_action_frame(pmlan_private priv, t_u8 *pbuf, t_u32 len)
+{
+	sta_node *sta_ptr = MNULL;
+	IEEEtypes_VendorHeader_t *pvendor_ie = MNULL;
+	const t_u8 wmm_oui[] = {0x00, 0x50, 0xf2, 0x02};
+	t_u8 *peer;
+	t_u8 *pos, *end;
+	t_u8 action;
+	int ie_len = 0;
+	t_u8 i;
+	int rate_len;
+
+#define TDLS_PAYLOAD_TYPE 2
+#define TDLS_CATEGORY 0x0c
+#define TDLS_REQ_FIX_LEN 6
+#define TDLS_RESP_FIX_LEN 8
+#define TDLS_CONFIRM_FIX_LEN 6
+	if (len < (sizeof(EthII_Hdr_t) + 3))
+		return;
+	if (*(t_u8 *)(pbuf + sizeof(EthII_Hdr_t)) != TDLS_PAYLOAD_TYPE)
+		/*TDLS payload type = 2*/
+		return;
+	if (*(t_u8 *)(pbuf + sizeof(EthII_Hdr_t) + 1) != TDLS_CATEGORY)
+		/*TDLS category = 0xc */
+		return;
+	peer = pbuf + MLAN_MAC_ADDR_LENGTH;
+
+	action = *(t_u8 *)(pbuf + sizeof(EthII_Hdr_t) + 2);
+	/*2= payload type + category*/
+
+	if (action > TDLS_SETUP_CONFIRM) {
+		/*just handle TDLS setup request/response/confirm */
+		PRINTM(MMSG, "Recv TDLS Action: peer=" MACSTR ", action=%d\n",
+		       MAC2STR(peer), action);
+		return;
+	}
+
+	sta_ptr = wlan_add_station_entry(priv, peer);
+	if (!sta_ptr)
+		return;
+	if (action == TDLS_SETUP_REQUEST) { /*setup request*/
+		sta_ptr->status = TDLS_NOT_SETUP;
+		PRINTM(MMSG, "Recv TDLS SETUP Request: peer=" MACSTR "\n",
+		       MAC2STR(peer));
+		wlan_hold_tdls_packets(priv, peer);
+		if (len < (sizeof(EthII_Hdr_t) + TDLS_REQ_FIX_LEN))
+			return;
+		pos = pbuf + sizeof(EthII_Hdr_t) + 4;
+		/*payload 1+ category 1 + action 1 +dialog 1*/
+		sta_ptr->capability = mlan_ntohs(*(t_u16 *)pos);
+		ie_len = len - sizeof(EthII_Hdr_t) - TDLS_REQ_FIX_LEN;
+		pos += 2;
+	} else if (action == 1) { /*setup respons*/
+		PRINTM(MMSG, "Recv TDLS SETUP Response: peer=" MACSTR "\n",
+		       MAC2STR(peer));
+		if (len < (sizeof(EthII_Hdr_t) + TDLS_RESP_FIX_LEN))
+			return;
+		pos = pbuf + sizeof(EthII_Hdr_t) + 6;
+		/*payload 1+ category 1 + action 1 +dialog 1 +status 2*/
+		sta_ptr->capability = mlan_ntohs(*(t_u16 *)pos);
+		ie_len = len - sizeof(EthII_Hdr_t) - TDLS_RESP_FIX_LEN;
+		pos += 2;
+	} else { /*setup confirm*/
+		PRINTM(MMSG, "Recv TDLS SETUP Confirm: peer=" MACSTR "\n",
+		       MAC2STR(peer));
+		if (len < (sizeof(EthII_Hdr_t) + TDLS_CONFIRM_FIX_LEN))
+			return;
+		pos = pbuf + sizeof(EthII_Hdr_t) + TDLS_CONFIRM_FIX_LEN;
+		/*payload 1+ category 1 + action 1 +dialog 1 + status 2*/
+		ie_len = len - sizeof(EthII_Hdr_t) - TDLS_CONFIRM_FIX_LEN;
+	}
+	for (end = pos + ie_len; pos + 1 < end; pos += 2 + pos[1]) {
+		if (pos + 2 + pos[1] > end)
+			break;
+		switch (*pos) {
+		case SUPPORTED_RATES:
+			sta_ptr->rate_len =
+				MIN(pos[1], sizeof(sta_ptr->support_rate));
+			for (i = 0; i < sta_ptr->rate_len; i++)
+				sta_ptr->support_rate[i] = pos[2 + i];
+			break;
+		case EXTENDED_SUPPORTED_RATES:
+			rate_len = MIN(pos[1], sizeof(sta_ptr->support_rate) -
+						       sta_ptr->rate_len);
+			for (i = 0; i < rate_len; i++)
+				sta_ptr->support_rate[sta_ptr->rate_len + i] =
+					pos[2 + i];
+			sta_ptr->rate_len += rate_len;
+			break;
+		case HT_CAPABILITY:
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->HTcap, pos,
+				   sizeof(IEEEtypes_HTCap_t),
+				   sizeof(IEEEtypes_HTCap_t));
+			sta_ptr->is_11n_enabled = 1;
+			DBG_HEXDUMP(MDAT_D, "TDLS HT capability",
+				    (t_u8 *)(&sta_ptr->HTcap),
+				    MIN(sizeof(IEEEtypes_HTCap_t),
+					MAX_DATA_DUMP_LEN));
+			break;
+		case HT_OPERATION:
+			memcpy_ext(priv->adapter, &sta_ptr->HTInfo, pos,
+				   sizeof(IEEEtypes_HTInfo_t),
+				   sizeof(IEEEtypes_HTInfo_t));
+			DBG_HEXDUMP(MDAT_D, "TDLS HT info",
+				    (t_u8 *)(&sta_ptr->HTInfo),
+				    MIN(sizeof(IEEEtypes_HTInfo_t),
+					MAX_DATA_DUMP_LEN));
+			break;
+		case BSSCO_2040:
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->BSSCO_20_40,
+				   pos, sizeof(IEEEtypes_2040BSSCo_t),
+				   sizeof(IEEEtypes_2040BSSCo_t));
+			break;
+		case EXT_CAPABILITY:
+			sta_ptr->ExtCap.ieee_hdr.len =
+				MIN(pos[1], sizeof(ExtCap_t));
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->ExtCap, pos,
+				   sta_ptr->ExtCap.ieee_hdr.len +
+					   sizeof(IEEEtypes_Header_t),
+				   sizeof(IEEEtypes_ExtCap_t));
+			DBG_HEXDUMP(MDAT_D, "TDLS Extended capability",
+				    (t_u8 *)(&sta_ptr->ExtCap),
+				    sta_ptr->ExtCap.ieee_hdr.len + 2);
+			break;
+		case RSN_IE:
+			sta_ptr->rsn_ie.ieee_hdr.len =
+				MIN(pos[1], IEEE_MAX_IE_SIZE -
+						    sizeof(IEEEtypes_Header_t));
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->rsn_ie, pos,
+				   sta_ptr->rsn_ie.ieee_hdr.len +
+					   sizeof(IEEEtypes_Header_t),
+				   sizeof(IEEEtypes_Generic_t));
+			DBG_HEXDUMP(MDAT_D, "TDLS Rsn ie ",
+				    (t_u8 *)(&sta_ptr->rsn_ie),
+				    sta_ptr->rsn_ie.ieee_hdr.len +
+					    sizeof(IEEEtypes_Header_t));
+			break;
+		case QOS_INFO:
+			sta_ptr->qos_info = pos[2];
+			PRINTM(MDAT_D, "TDLS qos info %x\n", sta_ptr->qos_info);
+			break;
+		case VENDOR_SPECIFIC_221:
+			pvendor_ie = (IEEEtypes_VendorHeader_t *)pos;
+			if (!memcmp(priv->adapter, pvendor_ie->oui, wmm_oui,
+				    sizeof(wmm_oui))) {
+				sta_ptr->qos_info = pos[8]; /** qos info in wmm
+							       parameters in
+							       response and
+							       confirm */
+				PRINTM(MDAT_D, "TDLS qos info %x\n",
+				       sta_ptr->qos_info);
+			}
+			break;
+		case LINK_ID:
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->link_ie,
+				   pos, sizeof(IEEEtypes_LinkIDElement_t),
+				   sizeof(IEEEtypes_LinkIDElement_t));
+			break;
+
+		case VHT_CAPABILITY:
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->vht_cap,
+				   pos, sizeof(IEEEtypes_VHTCap_t),
+				   sizeof(IEEEtypes_VHTCap_t));
+			sta_ptr->is_11ac_enabled = 1;
+			DBG_HEXDUMP(MDAT_D, "TDLS VHT capability",
+				    (t_u8 *)(&sta_ptr->vht_cap),
+				    MIN(sizeof(IEEEtypes_VHTCap_t),
+					MAX_DATA_DUMP_LEN));
+			break;
+		case VHT_OPERATION:
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->vht_oprat,
+				   pos, sizeof(IEEEtypes_VHTOprat_t),
+				   sizeof(IEEEtypes_VHTOprat_t));
+			DBG_HEXDUMP(MDAT_D, "TDLS VHT Operation",
+				    (t_u8 *)(&sta_ptr->vht_oprat),
+				    MIN(sizeof(IEEEtypes_VHTOprat_t),
+					MAX_DATA_DUMP_LEN));
+			break;
+		case AID_INFO:
+			memcpy_ext(priv->adapter, (t_u8 *)&sta_ptr->aid_info,
+				   pos, sizeof(IEEEtypes_AID_t),
+				   sizeof(IEEEtypes_AID_t));
+			DBG_HEXDUMP(MDAT_D, "TDLS AID Info",
+				    (t_u8 *)(&sta_ptr->aid_info),
+				    MIN(sizeof(IEEEtypes_AID_t),
+					MAX_DATA_DUMP_LEN));
+			break;
+		default:
+			break;
+		}
+	}
+	return;
+}
+
 /**
  *  @brief This function processes received packet and forwards it
  *          to kernel/upper layer
@@ -180,6 +382,7 @@ mlan_status wlan_process_rx_packet(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
 						     0x00, 0x00, 0xf8};
 	t_u8 appletalk_aarp_type[2] = {0x80, 0xf3};
 	t_u8 ipx_snap_type[2] = {0x81, 0x37};
+	t_u8 tdls_action_type[2] = {0x89, 0x0d};
 #ifdef DRV_EMBEDDED_SUPPLICANT
 	t_u8 eapol_type[2] = {0x88, 0x8e};
 #endif
@@ -265,6 +468,12 @@ mlan_status wlan_process_rx_packet(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
 			       "Bypass sending Gratuitous ARP frame to Kernel.\n");
 			goto done;
 		}
+		if (!memcmp(pmadapter, &prx_pkt->eth803_hdr.h803_len,
+			    tdls_action_type, sizeof(tdls_action_type))) {
+			wlan_process_tdls_action_frame(
+				priv, ((t_u8 *)prx_pd + prx_pd->rx_pkt_offset),
+				prx_pd->rx_pkt_length);
+		}
 		/* Chop off the RxPD */
 		hdr_chop = (t_u32)((t_ptr)&prx_pkt->eth803_hdr - (t_ptr)prx_pd);
 	}
@@ -423,7 +632,8 @@ mlan_status wlan_ops_sta_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 	 * If the packet is not an unicast packet then send the packet
 	 * directly to os. Don't pass thru rx reordering
 	 */
-	if ((!IS_11N_ENABLED(priv)) ||
+	if ((!IS_11N_ENABLED(priv) &&
+	     !(prx_pd->flags & RXPD_FLAG_PKT_DIRECT_LINK)) ||
 	    memcmp(priv->adapter, priv->curr_addr,
 		   prx_pkt->eth803_hdr.dest_addr, MLAN_MAC_ADDR_LENGTH)) {
 		priv->snr = prx_pd->snr;
@@ -432,7 +642,8 @@ mlan_status wlan_ops_sta_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 		goto done;
 	}
 
-	if (queuing_ra_based(priv)) {
+	if (queuing_ra_based(priv) ||
+	    (prx_pd->flags & RXPD_FLAG_PKT_DIRECT_LINK)) {
 		memcpy_ext(pmadapter, ta, prx_pkt->eth803_hdr.src_addr,
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 		if (prx_pd->priority < MAX_NUM_TID) {
@@ -444,6 +655,14 @@ mlan_status wlan_ops_sta_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 					prx_pd->seq_num;
 				sta_ptr->snr = prx_pd->snr;
 				sta_ptr->nf = prx_pd->nf;
+				if (prx_pd->flags & RXPD_FLAG_PKT_DIRECT_LINK) {
+					pmadapter->callbacks
+						.moal_updata_peer_signal(
+							pmadapter->pmoal_handle,
+							pmbuf->bss_index, ta,
+							prx_pd->snr,
+							prx_pd->nf);
+				}
 			}
 			if (!sta_ptr || !sta_ptr->is_11n_enabled) {
 				wlan_process_rx_packet(pmadapter, pmbuf);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
index 4bfd401..6ef9ff6 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
@@ -125,6 +125,8 @@ t_void *wlan_ops_sta_process_txpd(t_void *priv, pmlan_buffer pmbuf)
 				MRVDRV_TxPD_POWER_MGMT_LAST_PACKET;
 		}
 	}
+	if (pmbuf->flags & MLAN_BUF_FLAG_TDLS)
+		plocal_tx_pd->flags |= MRVDRV_TxPD_FLAGS_TDLS_PACKET;
 	/* Offset of actual data */
 	plocal_tx_pd->tx_pkt_offset = (t_u16)(
 		(t_ptr)pmbuf->pbuf + pmbuf->data_offset - (t_ptr)plocal_tx_pd);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_txrx.c b/mxm_wifiex/wlan_src/mlan/mlan_txrx.c
index 444d5ac..c937e78 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_txrx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_txrx.c
@@ -4,7 +4,7 @@
  *  @brief This file contains the handling of TX/RX in MLAN
  *
  *
- *  Copyright 2009-2020 NXP
+ *  Copyright 2009-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -259,7 +259,6 @@ mlan_status wlan_recv_packet_complete(pmlan_adapter pmadapter,
 				      pmlan_buffer pmbuf, mlan_status status)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	pmlan_callbacks pcb;
 
 	ENTER();
 
@@ -269,7 +268,6 @@ mlan_status wlan_recv_packet_complete(pmlan_adapter pmadapter,
 		return MLAN_STATUS_FAILURE;
 	}
 
-	pcb = &pmadapter->callbacks;
 	MASSERT(pmbuf->bss_index < pmadapter->priv_num);
 
 	if (pmbuf->pparent) {
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
index 40aa7e5..37b1585 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
@@ -3,7 +3,7 @@
  *  @brief This file contains the handling of AP mode command and event
  *
  *
- *  Copyright 2009-2020 NXP
+ *  Copyright 2009-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -59,10 +59,10 @@ Change log:
  *  @param pdata_buf    A pointer to data buffer
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_cmd_set_get_band_steering_cfg(pmlan_private pmpriv,
-					       HostCmd_DS_COMMAND *cmd,
-					       t_u16 cmd_action,
-					       t_void *pdata_buf)
+static mlan_status wlan_cmd_set_get_band_steering_cfg(pmlan_private pmpriv,
+						      HostCmd_DS_COMMAND *cmd,
+						      t_u16 cmd_action,
+						      t_void *pdata_buf)
 {
 	mlan_ds_band_steer_cfg *pband_steer_cfg =
 		(mlan_ds_band_steer_cfg *)pdata_buf;
@@ -90,9 +90,10 @@ mlan_status wlan_cmd_set_get_band_steering_cfg(pmlan_private pmpriv,
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_ret_set_get_band_steering_cfg(mlan_private *pmpriv,
-					       HostCmd_DS_COMMAND *resp,
-					       mlan_ioctl_req *pioctl_buf)
+static mlan_status
+wlan_ret_set_get_band_steering_cfg(mlan_private *pmpriv,
+				   HostCmd_DS_COMMAND *resp,
+				   mlan_ioctl_req *pioctl_buf)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	HostCmd_DS_BAND_STEERING *pband_steer_info =
@@ -123,10 +124,10 @@ mlan_status wlan_ret_set_get_band_steering_cfg(mlan_private *pmpriv,
  *  @param pdata_buf    A pointer to data buffer
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_cmd_set_get_beacon_stuck_cfg(IN pmlan_private pmpriv,
-					      IN HostCmd_DS_COMMAND *cmd,
-					      IN t_u16 cmd_action,
-					      IN t_void *pdata_buf)
+static mlan_status wlan_cmd_set_get_beacon_stuck_cfg(IN pmlan_private pmpriv,
+						     IN HostCmd_DS_COMMAND *cmd,
+						     IN t_u16 cmd_action,
+						     IN t_void *pdata_buf)
 {
 	HostCmd_DS_BEACON_STUCK_CFG *pbeacon_stuck_param_cfg =
 		(HostCmd_DS_BEACON_STUCK_CFG *)(pdata_buf + sizeof(t_u32));
@@ -154,9 +155,9 @@ mlan_status wlan_cmd_set_get_beacon_stuck_cfg(IN pmlan_private pmpriv,
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_ret_set_get_beacon_stuck_cfg(mlan_private *pmpriv,
-					      HostCmd_DS_COMMAND *resp,
-					      mlan_ioctl_req *pioctl_buf)
+static mlan_status wlan_ret_set_get_beacon_stuck_cfg(mlan_private *pmpriv,
+						     HostCmd_DS_COMMAND *resp,
+						     mlan_ioctl_req *pioctl_buf)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	HostCmd_DS_BEACON_STUCK_CFG *pbeacon_stuck_param_cfg =
@@ -324,7 +325,7 @@ static mlan_status uap_process_cmdresp_error(mlan_private *pmpriv,
  *
  *  @return	   A pointer to structure sta_node
  */
-void wlan_notify_station_deauth(mlan_private *priv)
+static void wlan_notify_station_deauth(mlan_private *priv)
 {
 	sta_node *sta_ptr;
 	t_u8 event_buf[100];
@@ -2390,7 +2391,7 @@ static mlan_status wlan_uap_ret_sys_config(pmlan_private pmpriv,
 					   mlan_ioctl_req *pioctl_buf)
 {
 	int resp_len = 0, travel_len = 0;
-	int i = 0;
+	t_u32 i = 0;
 	custom_ie *cptr;
 	HostCmd_DS_SYS_CONFIG *sys_config =
 		(HostCmd_DS_SYS_CONFIG *)&resp->params.sys_config;
@@ -2532,7 +2533,7 @@ static mlan_status wlan_uap_ret_sys_config(pmlan_private pmpriv,
 						0;
 					for (i = 0;
 					     i <
-					     wlan_le16_to_cpu(
+					     (int)wlan_le16_to_cpu(
 						     tlv_chan_list->header.len) /
 						     sizeof(ChanScanParamSet_t);
 					     i++) {
@@ -2634,7 +2635,7 @@ static mlan_status wlan_uap_ret_sys_config(pmlan_private pmpriv,
 							cust_ie->ie_data_list[0]
 								.ie_index);
 
-				while (resp_len > sizeof(t_u16)) {
+				while (resp_len > (int)sizeof(t_u16)) {
 					cptr = (custom_ie
 							*)(((t_u8 *)cust_ie
 								    ->ie_data_list) +
@@ -3168,6 +3169,14 @@ static mlan_status wlan_uap_ret_get_log(pmlan_private pmpriv,
 			wlan_le32_to_cpu(pget_log->channel_number);
 		pget_info->param.stats.channel_switch_mode =
 			wlan_le32_to_cpu(pget_log->channel_switch_mode);
+		pget_info->param.stats.rx_reset_mac_recovery_cnt =
+			wlan_le32_to_cpu(pget_log->rx_reset_mac_recovery_cnt);
+		pget_info->param.stats.rx_Isr2_NotDone_Cnt =
+			wlan_le32_to_cpu(pget_log->rx_Isr2_NotDone_Cnt);
+		pget_info->param.stats.gdma_abort_cnt =
+			wlan_le32_to_cpu(pget_log->gdma_abort_cnt);
+		pget_info->param.stats.g_reset_rx_mac_cnt =
+			wlan_le32_to_cpu(pget_log->g_reset_rx_mac_cnt);
 		if (pmpriv->adapter->getlog_enable) {
 			pget_info->param.stats.tx_frag_cnt =
 				wlan_le32_to_cpu(pget_log->tx_frag_cnt);
@@ -3592,7 +3601,7 @@ static mlan_status wlan_uap_ret_sta_list(pmlan_private pmpriv,
 			} else
 				info->param.sta_list.info[i].bandmode = 0xFF;
 			pioctl_buf->data_read_written +=
-				sizeof(sta_info) +
+				sizeof(sta_info_data) +
 				info->param.sta_list.info[i].ie_len;
 			buf += sizeof(MrvlIEtypes_sta_info_t) +
 			       info->param.sta_list.info[i].ie_len;
@@ -3922,9 +3931,9 @@ static t_u32 wlan_process_sta_assoc_event(pmlan_private priv,
  *
  *  @return             MLAN_STATUS_SUCCESS
  */
-mlan_status wlan_ret_cmd_uap_acs_scan(pmlan_private pmpriv,
-				      const HostCmd_DS_COMMAND *resp,
-				      mlan_ioctl_req *pioctl_buf)
+static mlan_status wlan_ret_cmd_uap_acs_scan(pmlan_private pmpriv,
+					     const HostCmd_DS_COMMAND *resp,
+					     mlan_ioctl_req *pioctl_buf)
 {
 	HostCMD_DS_APCMD_ACS_SCAN *acs_scan =
 		(HostCMD_DS_APCMD_ACS_SCAN *)&resp->params.acs_scan;
@@ -4046,7 +4055,8 @@ static mlan_status wlan_uap_ret_oper_ctrl(pmlan_private pmpriv,
  *  @return MTRUE/MFALSE
  *
  */
-t_u8 wlan_check_11B_support_rates(MrvlIEtypes_RatesParamSet_t *prates_tlv)
+static t_u8
+wlan_check_11B_support_rates(MrvlIEtypes_RatesParamSet_t *prates_tlv)
 {
 	int i;
 	t_u8 rate;
@@ -4090,7 +4100,7 @@ static mlan_status wlan_uap_cmd_add_station(pmlan_private pmpriv,
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	MrvlIETypes_HTCap_t *phtcap;
 	MrvlIETypes_VHTCap_t *pvhtcap;
-	MrvlIEtypes_Extension_t *pext_tlv;
+	MrvlIEtypes_Extension_t *pext_tlv = MNULL;
 	MrvlIEtypes_StaFlag_t *pstaflag;
 	int i;
 
@@ -4199,6 +4209,8 @@ static mlan_status wlan_uap_cmd_add_station(pmlan_private pmpriv,
 			if (pext_tlv->ext_id == HE_CAPABILITY) {
 				sta_ptr->is_11ax_enabled = MTRUE;
 				PRINTM(MCMND, "STA supports 11ax\n");
+			} else {
+				pext_tlv = MNULL;
 			}
 			break;
 		default:
@@ -4216,6 +4228,22 @@ static mlan_status wlan_uap_cmd_add_station(pmlan_private pmpriv,
 		travel_len += sizeof(MrvlIEtypesHeader_t) + tlv_len;
 		tlv_buf_left -= sizeof(MrvlIEtypesHeader_t) + tlv_len;
 	}
+	if (sta_ptr->is_11ax_enabled) {
+		if (pext_tlv == MNULL) {
+			tlv = (MrvlIEtypesHeader_t *)pos;
+			tlv->type = wlan_cpu_to_le16(EXTENSION);
+			tlv->len = wlan_cpu_to_le16(
+				MIN(sta_ptr->he_cap.ieee_hdr.len,
+				    sizeof(IEEEtypes_HECap_t) -
+					    sizeof(IEEEtypes_Header_t)));
+
+			pos += sizeof(MrvlIEtypesHeader_t);
+			memcpy_ext(pmadapter, pos,
+				   (t_u8 *)&sta_ptr->he_cap.ext_id, tlv->len,
+				   tlv->len);
+			travel_len += sizeof(MrvlIEtypesHeader_t) + tlv->len;
+		}
+	}
 
 	if (sta_ptr->is_11n_enabled) {
 		if (pmpriv->uap_channel <= 14)
@@ -4625,6 +4653,10 @@ mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_set_get_beacon_stuck_cfg(pmpriv, cmd_ptr,
 							cmd_action, pdata_buf);
 		break;
+	case HostCmd_CMD_HAL_PHY_CFG:
+		ret = wlan_cmd_hal_phy_cfg(pmpriv, cmd_ptr, cmd_action,
+					   pdata_buf);
+		break;
 	default:
 		PRINTM(MERROR, "PREP_CMD: unknown command- %#x\n", cmd_no);
 		if (pioctl_req)
@@ -4816,15 +4848,18 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 				pmadapter->pcard_sd->reg->data_port_mask;
 
 			for (ctr = 1;
-			     ctr <= MAX_PORT - pmadapter->pcard_sd->mp_end_port;
+			     ctr <= pmadapter->pcard_sd->max_ports -
+					    pmadapter->pcard_sd->mp_end_port;
 			     ctr++) {
 				pmadapter->pcard_sd->mp_data_port_mask &=
-					~(1 << (MAX_PORT - ctr));
+					~(1 << (pmadapter->pcard_sd->max_ports -
+						ctr));
 			}
 
-			pmadapter->pcard_sd->curr_wr_port = 0;
+			pmadapter->pcard_sd->curr_wr_port =
+				pmadapter->pcard_sd->reg->start_wr_port;
 			pmadapter->pcard_sd->mpa_tx.pkt_aggr_limit =
-				MIN(SDIO_MP_AGGR_DEF_PKT_LIMIT,
+				MIN(pmadapter->pcard_sd->mp_aggr_pkt_limit,
 				    (pmadapter->pcard_sd->mp_end_port >> 1));
 			PRINTM(MCMND, "end port %d, data port mask %x\n",
 			       wlan_le16_to_cpu(
@@ -4975,6 +5010,9 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 		ret = wlan_ret_dot11mc_unassoc_ftm_cfg(pmpriv, resp,
 						       pioctl_buf);
 		break;
+	case HostCmd_CMD_HAL_PHY_CFG:
+		ret = wlan_ret_hal_phy_cfg(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_RATE_ADAPT_CFG:
 		ret = wlan_ret_rate_adapt_cfg(pmpriv, resp, pioctl_buf);
 		break;
@@ -5520,7 +5558,8 @@ done:
  *
  *  @return   MLAN_STATUS_SUCCESS or MLAN_STATUS_PENDING or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_uap_set_uap_max_sta(pmlan_private pmpriv, t_u8 uap_max_sta)
+static mlan_status wlan_uap_set_uap_max_sta(pmlan_private pmpriv,
+					    t_u8 uap_max_sta)
 {
 	MrvlIEtypes_uap_max_sta_cnt_t tlv_uap_max_sta;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
index ee69ca5..ec3071f 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
@@ -3,7 +3,7 @@
  *  @brief This file contains the handling of AP mode ioctls
  *
  *
- *  Copyright 2009-2020 NXP
+ *  Copyright 2009-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -42,7 +42,6 @@ Change log:
 /********************************************************
 			Global Variables
 ********************************************************/
-extern t_u8 tos_to_tid_inv[];
 
 /********************************************************
 			Local Functions
@@ -342,6 +341,9 @@ static mlan_status wlan_uap_bss_ioctl_reset(pmlan_adapter pmadapter,
 		pmpriv->aggr_prio_tbl[i].amsdu = tos_to_tid_inv[i];
 		pmpriv->addba_reject[i] = ADDBA_RSP_STATUS_ACCEPT;
 	}
+	pmpriv->aggr_prio_tbl[6].amsdu = BA_STREAM_NOT_ALLOWED;
+	pmpriv->aggr_prio_tbl[7].amsdu = BA_STREAM_NOT_ALLOWED;
+
 	pmpriv->aggr_prio_tbl[6].ampdu_user =
 		pmpriv->aggr_prio_tbl[7].ampdu_user = BA_STREAM_NOT_ALLOWED;
 	pmpriv->addba_reject[6] = pmpriv->addba_reject[7] =
@@ -371,8 +373,8 @@ static mlan_status wlan_uap_bss_ioctl_reset(pmlan_adapter pmadapter,
  *
  *  @return            	  MLAN_STATUS_SUCCESS/MLAN_STATUS_FAILURE
  */
-mlan_status wlan_uap_bss_ioctl_add_station(pmlan_adapter pmadapter,
-					   pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_uap_bss_ioctl_add_station(pmlan_adapter pmadapter,
+						  pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -437,13 +439,11 @@ static mlan_status wlan_uap_bss_ioctl_uap_wmm_param(pmlan_adapter pmadapter,
 						    pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_bss *bss = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u16 cmd_action = 0;
 
 	ENTER();
 
-	bss = (mlan_ds_bss *)pioctl_req->pbuf;
 	if (pioctl_req->action == MLAN_ACT_SET)
 		cmd_action = HostCmd_ACT_GEN_SET;
 	else
@@ -472,13 +472,11 @@ wlan_uap_bss_ioctl_uap_scan_channels(pmlan_adapter pmadapter,
 				     pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_bss *bss = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u16 cmd_action = 0;
 
 	ENTER();
 
-	bss = (mlan_ds_bss *)pioctl_req->pbuf;
 	if (pioctl_req->action == MLAN_ACT_SET)
 		cmd_action = HostCmd_ACT_GEN_SET;
 	else
@@ -506,13 +504,11 @@ static mlan_status wlan_uap_bss_ioctl_uap_channel(pmlan_adapter pmadapter,
 						  pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_bss *bss = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u16 cmd_action = 0;
 
 	ENTER();
 
-	bss = (mlan_ds_bss *)pioctl_req->pbuf;
 	if (pioctl_req->action == MLAN_ACT_SET)
 		cmd_action = HostCmd_ACT_GEN_SET;
 	else
@@ -540,7 +536,6 @@ static mlan_status wlan_uap_bss_ioctl_uap_oper_ctrl(pmlan_adapter pmadapter,
 						    pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
-	mlan_ds_bss *bss = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u16 cmd_action = 0;
 
@@ -548,7 +543,6 @@ static mlan_status wlan_uap_bss_ioctl_uap_oper_ctrl(pmlan_adapter pmadapter,
 
 	if (pmadapter->fw_ver == HOST_API_VERSION_V15 &&
 	    pmadapter->fw_min_ver >= FW_MINOR_VERSION_1) {
-		bss = (mlan_ds_bss *)pioctl_req->pbuf;
 		if (pioctl_req->action == MLAN_ACT_SET)
 			cmd_action = HostCmd_ACT_GEN_SET;
 		else
@@ -1763,8 +1757,8 @@ mlan_status wlan_uap_get_beacon_dtim(pmlan_private pmpriv)
  *
  *  @return		MLAN_STATUS_PENDING --success, otherwise fail
  */
-mlan_status wlan_uap_snmp_mib_ctrl_deauth(pmlan_adapter pmadapter,
-					  pmlan_ioctl_req pioctl_req)
+static mlan_status wlan_uap_snmp_mib_ctrl_deauth(pmlan_adapter pmadapter,
+						 pmlan_ioctl_req pioctl_req)
 {
 	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -2072,6 +2066,8 @@ mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 		if (misc->sub_command == MLAN_OID_MISC_DOT11MC_UNASSOC_FTM_CFG)
 			status = wlan_misc_ioctl_dot11mc_unassoc_ftm_cfg(
 				pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_HAL_PHY_CFG)
+			status = wlan_misc_hal_phy_cfg(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_RATE_ADAPT_CFG)
 			status = wlan_misc_ioctl_rate_adapt_cfg(pmadapter,
 								pioctl_req);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
index bbe08f8..1edee7d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
@@ -3,7 +3,7 @@
  *  @brief This file contains AP mode transmit and receive functions
  *
  *
- *  Copyright 2009-2020 NXP
+ *  Copyright 2009-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_usb.c b/mxm_wifiex/wlan_src/mlan/mlan_usb.c
index 8ecdf8c..b1a2abd 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_usb.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_usb.c
@@ -3,7 +3,7 @@
  *  @brief This file contains USB specific code
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -99,7 +99,8 @@ static const struct _mlan_card_info mlan_card_info_usb9097 = {
  *  @param rev_id         A pointer to chip revision id
  *  @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_usb_check_revision(mlan_adapter *pmadapter, t_u32 *rev_id)
+static mlan_status wlan_usb_check_revision(mlan_adapter *pmadapter,
+					   t_u32 *rev_id)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -416,7 +417,7 @@ static int wlan_usb_deaggr_rx_num_pkts(pmlan_adapter pmadapter, t_u8 *pdata,
 	RxPD *prx_pd;
 
 	ENTER();
-	while (aggr_pkt_len >= sizeof(RxPD)) {
+	while (aggr_pkt_len >= (int)sizeof(RxPD)) {
 		prx_pd = (RxPD *)pdata;
 		pkt_len = wlan_le16_to_cpu(prx_pd->rx_pkt_length) +
 			  wlan_le16_to_cpu(prx_pd->rx_pkt_offset);
@@ -771,7 +772,8 @@ mlan_status wlan_get_usb_device(pmlan_adapter pmadapter)
  *
  *  @return		MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_usb_dnld_fw(pmlan_adapter pmadapter, pmlan_fw_image pmfw)
+static mlan_status wlan_usb_dnld_fw(pmlan_adapter pmadapter,
+				    pmlan_fw_image pmfw)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
@@ -813,7 +815,7 @@ mlan_status wlan_usb_deaggr_rx_pkt(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
 		       wlan_le16_to_cpu(prx_pd->rx_pkt_offset);
 	/* if non-aggregate, just send through, don’t process here */
 	aggr_len = pmbuf->data_len;
-	if ((aggr_len == curr_pkt_len) ||
+	if ((aggr_len == (t_s32)curr_pkt_len) ||
 	    (wlan_usb_deaggr_rx_num_pkts(pmadapter, pdata, aggr_len) == 1) ||
 	    (pmadapter->pcard_usb->usb_rx_deaggr.aggr_ctrl.enable != MTRUE)) {
 		ret = wlan_handle_rx_packet(pmadapter, pmbuf);
@@ -821,7 +823,7 @@ mlan_status wlan_usb_deaggr_rx_pkt(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
 		return ret;
 	}
 
-	while (aggr_len >= sizeof(RxPD)) {
+	while (aggr_len >= (t_s32)sizeof(RxPD)) {
 		/* check for (all-zeroes) termination RxPD */
 		if (!memcmp(pmadapter, pdata, zero_rx_pd, sizeof(RxPD))) {
 			break;
@@ -855,7 +857,7 @@ mlan_status wlan_usb_deaggr_rx_pkt(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
 			break;
 		}
 		/* last block has no padding bytes */
-		if (aggr_len == curr_pkt_len) {
+		if (aggr_len == (t_s32)curr_pkt_len) {
 			break;
 		}
 
@@ -890,8 +892,8 @@ mlan_status wlan_usb_deaggr_rx_pkt(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
  *
  *  @return             MTRUE/MFALSE
  */
-t_u8 wlan_is_port_tx_paused(pmlan_adapter pmadapter,
-			    usb_tx_aggr_params *pusb_tx_aggr)
+static t_u8 wlan_is_port_tx_paused(pmlan_adapter pmadapter,
+				   usb_tx_aggr_params *pusb_tx_aggr)
 {
 	mlan_private *pmpriv = MNULL;
 	t_u8 i;
@@ -1097,7 +1099,8 @@ mlan_status wlan_usb_host_to_card_aggr(pmlan_adapter pmadapter,
  *
  *  @return			MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_pm_usb_wakeup_card(pmlan_adapter pmadapter, t_u8 timeout)
+static mlan_status wlan_pm_usb_wakeup_card(pmlan_adapter pmadapter,
+					   t_u8 timeout)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u32 age_ts_usec;
@@ -1135,8 +1138,9 @@ mlan_status wlan_pm_usb_wakeup_card(pmlan_adapter pmadapter, t_u8 timeout)
  *
  *  @return          MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status wlan_usb_host_to_card(pmlan_private pmpriv, t_u8 type,
-				  mlan_buffer *pmbuf, mlan_tx_param *tx_param)
+static mlan_status wlan_usb_host_to_card(pmlan_private pmpriv, t_u8 type,
+					 mlan_buffer *pmbuf,
+					 mlan_tx_param *tx_param)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	usb_tx_aggr_params *pusb_tx_aggr = MNULL;
@@ -1200,8 +1204,9 @@ mlan_status wlan_usb_host_to_card(pmlan_private pmpriv, t_u8 type,
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return          N/A
  */
-mlan_status wlan_usb_cmdevt_complete(pmlan_adapter pmadapter,
-				     mlan_buffer *pmbuf, mlan_status status)
+static mlan_status wlan_usb_cmdevt_complete(pmlan_adapter pmadapter,
+					    mlan_buffer *pmbuf,
+					    mlan_status status)
 {
 	ENTER();
 
@@ -1219,8 +1224,9 @@ mlan_status wlan_usb_cmdevt_complete(pmlan_adapter pmadapter,
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return          N/A
  */
-mlan_status wlan_usb_data_complete(pmlan_adapter pmadapter, mlan_buffer *pmbuf,
-				   mlan_status status)
+static mlan_status wlan_usb_data_complete(pmlan_adapter pmadapter,
+					  mlan_buffer *pmbuf,
+					  mlan_status status)
 {
 	ENTER();
 
@@ -1238,8 +1244,8 @@ mlan_status wlan_usb_data_complete(pmlan_adapter pmadapter, mlan_buffer *pmbuf,
  *  @param pmbuf     A pointer to the mlan_buffer
  *  @return
  */
-mlan_status wlan_usb_handle_rx_packet(mlan_adapter *pmadapter,
-				      pmlan_buffer pmbuf)
+static mlan_status wlan_usb_handle_rx_packet(mlan_adapter *pmadapter,
+					     pmlan_buffer pmbuf)
 {
 	ENTER();
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_util.h b/mxm_wifiex/wlan_src/mlan/mlan_util.h
index 2d22cae..9485f1a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_util.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_util.h
@@ -4,7 +4,7 @@
  *  spinlock and timer defines.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -47,6 +47,9 @@ typedef struct _mlan_list_head {
 	t_void *plock;
 } mlan_list_head, *pmlan_list_head;
 
+/** MLAN MNULL pointer */
+#define MNULL ((void *)0)
+
 /**
  *  @brief This function initializes a list without locking
  *
@@ -78,7 +81,7 @@ static INLINE t_void util_init_list_head(
 	if (lock_required)
 		moal_init_lock(pmoal_handle, &phead->plock);
 	else
-		phead->plock = 0;
+		phead->plock = MNULL;
 }
 
 /**
@@ -93,7 +96,7 @@ static INLINE t_void util_free_list_head(
 	t_void *pmoal_handle, pmlan_list_head phead,
 	mlan_status (*moal_free_lock)(t_void *handle, t_void *plock))
 {
-	phead->pprev = phead->pnext = 0;
+	phead->pprev = phead->pnext = MNULL;
 	if (phead->plock)
 		moal_free_lock(pmoal_handle, phead->plock);
 }
@@ -112,7 +115,7 @@ util_peek_list(t_void *pmoal_handle, pmlan_list_head phead,
 	       mlan_status (*moal_spin_lock)(t_void *handle, t_void *plock),
 	       mlan_status (*moal_spin_unlock)(t_void *handle, t_void *plock))
 {
-	pmlan_linked_list pnode = 0;
+	pmlan_linked_list pnode = MNULL;
 
 	if (moal_spin_lock)
 		moal_spin_lock(pmoal_handle, phead->plock);
@@ -204,7 +207,7 @@ static INLINE t_void util_unlink_list(
 	pmy_next->pprev = pmy_prev;
 	pmy_prev->pnext = pmy_next;
 
-	pnode->pnext = pnode->pprev = 0;
+	pnode->pnext = pnode->pprev = MNULL;
 	if (moal_spin_unlock)
 		moal_spin_unlock(pmoal_handle, phead->plock);
 }
@@ -229,9 +232,9 @@ static INLINE pmlan_linked_list util_dequeue_list(
 		moal_spin_lock(pmoal_handle, phead->plock);
 	pnode = phead->pnext;
 	if (pnode && (pnode != (pmlan_linked_list)phead))
-		util_unlink_list(pmoal_handle, phead, pnode, 0, 0);
+		util_unlink_list(pmoal_handle, phead, pnode, MNULL, MNULL);
 	else
-		pnode = 0;
+		pnode = MNULL;
 	if (moal_spin_unlock)
 		moal_spin_unlock(pmoal_handle, phead->plock);
 	return pnode;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_wmm.c b/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
index a878809..2e29079 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
@@ -3,7 +3,7 @@
  *  @brief This file contains functions for WMM.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -97,7 +97,7 @@ static const t_u8 wmm_aci_to_qidx_map[] = {WMM_AC_BE, WMM_AC_BK, WMM_AC_VI,
  * This table will be used to store the tid values based on ACs.
  * It is initialized to default values per TID.
  */
-t_u8 tos_to_tid[] = {
+static t_u8 tos_to_tid[] = {
 	/* TID        DSCP_P2   DSCP_P1  DSCP_P0   WMM_AC   */
 	0x01, /*    0         1        0       AC_BK   */
 	0x02, /*    0         0        0       AC_BK   */
@@ -124,7 +124,7 @@ t_u8 tos_to_tid_inv[] = {0x02, /* from tos_to_tid[2] = 0 */
  * change and will be used to copy back the default values to tos_to_tid in
  * case of disconnect.
  */
-const t_u8 ac_to_tid[4][2] = {{1, 2}, {0, 3}, {4, 5}, {6, 7}};
+t_u8 ac_to_tid[4][2] = {{1, 2}, {0, 3}, {4, 5}, {6, 7}};
 
 /* Map of TOS UP values to WMM AC */
 static const mlan_wmm_ac_e tos_to_ac[] = {WMM_AC_BE, WMM_AC_BK, WMM_AC_BK,
@@ -208,6 +208,53 @@ done:
 	return ra_list;
 }
 
+/**
+ *  @brief Add packet to TDLS pending TX queue
+ *
+ *  @param priv		  A pointer to mlan_private
+ *  @param pmbuf      Pointer to the mlan_buffer data struct
+ *
+ *  @return           N/A
+ */
+static t_void wlan_add_buf_tdls_txqueue(pmlan_private priv, pmlan_buffer pmbuf)
+{
+	mlan_adapter *pmadapter = priv->adapter;
+	ENTER();
+	util_enqueue_list_tail(pmadapter->pmoal_handle, &priv->tdls_pending_txq,
+			       (pmlan_linked_list)pmbuf,
+			       pmadapter->callbacks.moal_spin_lock,
+			       pmadapter->callbacks.moal_spin_unlock);
+	LEAVE();
+}
+
+/**
+ *  @brief Clean up the tdls pending TX queue
+ *
+ *  @param priv		A pointer to mlan_private
+ *
+ *  @return      N/A
+ */
+static t_void wlan_cleanup_tdls_txq(pmlan_private priv)
+{
+	pmlan_buffer pmbuf;
+	mlan_adapter *pmadapter = priv->adapter;
+	ENTER();
+
+	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+					    priv->tdls_pending_txq.plock);
+	while ((pmbuf = (pmlan_buffer)util_peek_list(pmadapter->pmoal_handle,
+						     &priv->tdls_pending_txq,
+						     MNULL, MNULL))) {
+		util_unlink_list(pmadapter->pmoal_handle,
+				 &priv->tdls_pending_txq,
+				 (pmlan_linked_list)pmbuf, MNULL, MNULL);
+		wlan_write_data_complete(pmadapter, pmbuf, MLAN_STATUS_FAILURE);
+	}
+	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
+					      priv->tdls_pending_txq.plock);
+	LEAVE();
+}
+
 /**
  * @brief Map ACs to TID
  *
@@ -1203,6 +1250,200 @@ t_u16 wlan_update_ralist_tx_pause(pmlan_private priv, t_u8 *mac, t_u8 tx_pause)
 }
 
 #ifdef STA_SUPPORT
+/**
+ *  @brief update tx_pause flag in none tdls ra_list
+ *
+ *  @param priv		  A pointer to mlan_private
+ *  @param mac        peer mac address
+ *  @param tx_pause   tx_pause flag (0/1)
+ *
+ *  @return           N/A
+ */
+t_void wlan_update_non_tdls_ralist(mlan_private *priv, t_u8 *mac, t_u8 tx_pause)
+{
+	raListTbl *ra_list;
+	int i;
+	pmlan_adapter pmadapter = priv->adapter;
+	t_u32 pkt_cnt = 0;
+	t_u32 tx_pkts_queued = 0;
+	ENTER();
+
+	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+					    priv->wmm.ra_list_spinlock);
+	for (i = 0; i < MAX_NUM_TID; ++i) {
+		ra_list = (raListTbl *)util_peek_list(
+			priv->adapter->pmoal_handle,
+			&priv->wmm.tid_tbl_ptr[i].ra_list, MNULL, MNULL);
+		while (ra_list &&
+		       (ra_list !=
+			(raListTbl *)&priv->wmm.tid_tbl_ptr[i].ra_list)) {
+			if (memcmp(priv->adapter, ra_list->ra, mac,
+				   MLAN_MAC_ADDR_LENGTH) &&
+			    ra_list->tx_pause != tx_pause) {
+				pkt_cnt += ra_list->total_pkts;
+				ra_list->tx_pause = tx_pause;
+				if (tx_pause)
+					priv->wmm.pkts_paused[i] +=
+						ra_list->total_pkts;
+				else
+					priv->wmm.pkts_paused[i] -=
+						ra_list->total_pkts;
+			}
+			ra_list = ra_list->pnext;
+		}
+	}
+	if (pkt_cnt) {
+		tx_pkts_queued = util_scalar_read(pmadapter->pmoal_handle,
+						  &priv->wmm.tx_pkts_queued,
+						  MNULL, MNULL);
+		if (tx_pause)
+			tx_pkts_queued -= pkt_cnt;
+		else
+			tx_pkts_queued += pkt_cnt;
+		util_scalar_write(priv->adapter->pmoal_handle,
+				  &priv->wmm.tx_pkts_queued, tx_pkts_queued,
+				  MNULL, MNULL);
+		util_scalar_write(priv->adapter->pmoal_handle,
+				  &priv->wmm.highest_queued_prio, HIGH_PRIO_TID,
+				  MNULL, MNULL);
+	}
+	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
+					      priv->wmm.ra_list_spinlock);
+	LEAVE();
+	return;
+}
+
+/**
+ *  @brief find tdls buffer from ralist
+ *
+ *  @param priv		  A pointer to mlan_private
+ *  @param ralist     A pointer to ralistTbl
+ *  @param mac        TDLS peer mac address
+ *
+ *  @return           pmlan_buffer or MNULL
+ */
+static pmlan_buffer wlan_find_tdls_packets(mlan_private *priv,
+					   raListTbl *ra_list, t_u8 *mac)
+{
+	pmlan_buffer pmbuf = MNULL;
+	mlan_adapter *pmadapter = priv->adapter;
+	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
+	ENTER();
+	pmbuf = (pmlan_buffer)util_peek_list(priv->adapter->pmoal_handle,
+					     &ra_list->buf_head, MNULL, MNULL);
+	if (!pmbuf) {
+		LEAVE();
+		return MNULL;
+	}
+	while (pmbuf != (pmlan_buffer)&ra_list->buf_head) {
+		memcpy_ext(pmadapter, ra, pmbuf->pbuf + pmbuf->data_offset,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		if (!memcmp(priv->adapter, ra, mac, MLAN_MAC_ADDR_LENGTH)) {
+			LEAVE();
+			return pmbuf;
+		}
+		pmbuf = pmbuf->pnext;
+	}
+	LEAVE();
+	return MNULL;
+}
+
+/**
+ *  @brief find tdls buffer from tdls pending queue
+ *
+ *  @param priv		  A pointer to mlan_private
+ *  @param mac        TDLS peer mac address
+ *
+ *  @return           pmlan_buffer or MNULL
+ */
+static pmlan_buffer wlan_find_packets_tdls_txq(mlan_private *priv, t_u8 *mac)
+{
+	pmlan_buffer pmbuf = MNULL;
+	mlan_adapter *pmadapter = priv->adapter;
+	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
+	ENTER();
+	pmbuf = (pmlan_buffer)util_peek_list(priv->adapter->pmoal_handle,
+					     &priv->tdls_pending_txq, MNULL,
+					     MNULL);
+	if (!pmbuf) {
+		LEAVE();
+		return MNULL;
+	}
+	while (pmbuf != (pmlan_buffer)&priv->tdls_pending_txq) {
+		memcpy_ext(pmadapter, ra, pmbuf->pbuf + pmbuf->data_offset,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		if (!memcmp(priv->adapter, ra, mac, MLAN_MAC_ADDR_LENGTH)) {
+			LEAVE();
+			return pmbuf;
+		}
+		pmbuf = pmbuf->pnext;
+	}
+	LEAVE();
+	return MNULL;
+}
+
+/**
+ *  @brief Remove TDLS ralist and move packets to AP's ralist
+ *
+ *  @param priv		  A pointer to mlan_private
+ *  @param mac        TDLS peer mac address
+ *
+ *  @return           N/A
+ */
+static t_void wlan_wmm_delete_tdls_ralist(pmlan_private priv, t_u8 *mac)
+{
+	raListTbl *ra_list;
+	raListTbl *ra_list_ap = MNULL;
+	int i;
+	pmlan_adapter pmadapter = priv->adapter;
+	pmlan_buffer pmbuf;
+	ENTER();
+
+	for (i = 0; i < MAX_NUM_TID; ++i) {
+		ra_list = wlan_wmm_get_ralist_node(priv, i, mac);
+		if (ra_list) {
+			PRINTM(MDATA, "delete TDLS ralist %p\n", ra_list);
+			ra_list_ap = (raListTbl *)util_peek_list(
+				pmadapter->pmoal_handle,
+				&priv->wmm.tid_tbl_ptr[i].ra_list, MNULL,
+				MNULL);
+			if (!ra_list_ap) {
+				LEAVE();
+				return;
+			}
+			while ((pmbuf = (pmlan_buffer)util_peek_list(
+					pmadapter->pmoal_handle,
+					&ra_list->buf_head, MNULL, MNULL))) {
+				util_unlink_list(pmadapter->pmoal_handle,
+						 &ra_list->buf_head,
+						 (pmlan_linked_list)pmbuf,
+						 MNULL, MNULL);
+				util_enqueue_list_tail(pmadapter->pmoal_handle,
+						       &ra_list_ap->buf_head,
+						       (pmlan_linked_list)pmbuf,
+						       MNULL, MNULL);
+				ra_list_ap->total_pkts++;
+				ra_list_ap->packet_count++;
+			}
+			util_free_list_head(
+				(t_void *)pmadapter->pmoal_handle,
+				&ra_list->buf_head,
+				pmadapter->callbacks.moal_free_lock);
+
+			util_unlink_list(pmadapter->pmoal_handle,
+					 &priv->wmm.tid_tbl_ptr[i].ra_list,
+					 (pmlan_linked_list)ra_list, MNULL,
+					 MNULL);
+			pmadapter->callbacks.moal_mfree(pmadapter->pmoal_handle,
+							(t_u8 *)ra_list);
+			if (priv->wmm.tid_tbl_ptr[i].ra_list_curr == ra_list)
+				priv->wmm.tid_tbl_ptr[i].ra_list_curr =
+					ra_list_ap;
+		}
+	}
+
+	LEAVE();
+}
 #endif /* STA_SUPPORT */
 /********************************************************
 			Global Functions
@@ -1257,6 +1498,9 @@ t_void wlan_clean_txrx(pmlan_private priv)
 
 	ENTER();
 	wlan_cleanup_bypass_txq(priv);
+	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
+		wlan_cleanup_tdls_txq(priv);
+	}
 	wlan_11n_cleanup_reorder_tbl(priv);
 	wlan_11n_deleteall_txbastream_tbl(priv);
 #if defined(USB)
@@ -1440,6 +1684,7 @@ void wlan_ralist_add(mlan_private *priv, t_u8 *ra)
 	int i;
 	raListTbl *ra_list;
 	pmlan_adapter pmadapter = priv->adapter;
+	tdlsStatus_e status;
 
 	ENTER();
 
@@ -1458,9 +1703,22 @@ void wlan_ralist_add(mlan_private *priv, t_u8 *ra)
 					get_station_max_amsdu_size(priv, ra);
 			ra_list->tx_pause = wlan_is_tx_pause(priv, ra);
 		} else {
-			ra_list->is_11n_enabled = IS_11N_ENABLED(priv);
-			if (ra_list->is_11n_enabled)
-				ra_list->max_amsdu = priv->max_amsdu;
+			ra_list->is_tdls_link = MFALSE;
+			ra_list->tx_pause = MFALSE;
+			status = wlan_get_tdls_link_status(priv, ra);
+			if (MTRUE == wlan_is_tdls_link_setup(status)) {
+				ra_list->is_11n_enabled =
+					is_station_11n_enabled(priv, ra);
+				if (ra_list->is_11n_enabled)
+					ra_list->max_amsdu =
+						get_station_max_amsdu_size(priv,
+									   ra);
+				ra_list->is_tdls_link = MTRUE;
+			} else {
+				ra_list->is_11n_enabled = IS_11N_ENABLED(priv);
+				if (ra_list->is_11n_enabled)
+					ra_list->max_amsdu = priv->max_amsdu;
+			}
 		}
 
 		PRINTM_NETINTF(MDATA, priv);
@@ -1641,7 +1899,7 @@ mlan_status wlan_cmd_wmm_status_change(pmlan_private priv)
 
 	ENTER();
 
-	ret = wlan_prepare_cmd(priv, HostCmd_CMD_WMM_GET_STATUS, 0, 0, 0,
+	ret = wlan_prepare_cmd(priv, HostCmd_CMD_WMM_GET_STATUS, 0, 0, MNULL,
 			       MNULL);
 	LEAVE();
 	return ret;
@@ -1826,6 +2084,7 @@ t_void wlan_wmm_add_buf_txqueue(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
 	t_u32 tid;
 	raListTbl *ra_list;
 	t_u8 ra[MLAN_MAC_ADDR_LENGTH], tid_down;
+	tdlsStatus_e status;
 #ifdef UAP_SUPPORT
 	psta_node sta_ptr = MNULL;
 #endif
@@ -1849,9 +2108,24 @@ t_void wlan_wmm_add_buf_txqueue(pmlan_adapter pmadapter, pmlan_buffer pmbuf)
 	   association we just don't have to call get_queue_raptr, we will have
 	   only 1 raptr for a tid in case of infra */
 	if (!queuing_ra_based(priv)) {
-		ra_list = (raListTbl *)util_peek_list(
-			pmadapter->pmoal_handle,
-			&priv->wmm.tid_tbl_ptr[tid_down].ra_list, MNULL, MNULL);
+		memcpy_ext(pmadapter, ra, pmbuf->pbuf + pmbuf->data_offset,
+			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		status = wlan_get_tdls_link_status(priv, ra);
+		if (MTRUE == wlan_is_tdls_link_setup(status)) {
+			ra_list = wlan_wmm_get_queue_raptr(priv, tid_down, ra);
+			pmbuf->flags |= MLAN_BUF_FLAG_TDLS;
+		} else if (status == TDLS_SETUP_INPROGRESS) {
+			wlan_add_buf_tdls_txqueue(priv, pmbuf);
+			pmadapter->callbacks.moal_spin_unlock(
+				pmadapter->pmoal_handle,
+				priv->wmm.ra_list_spinlock);
+			LEAVE();
+			return;
+		} else
+			ra_list = (raListTbl *)util_peek_list(
+				pmadapter->pmoal_handle,
+				&priv->wmm.tid_tbl_ptr[tid_down].ra_list, MNULL,
+				MNULL);
 	} else {
 		memcpy_ext(pmadapter, ra, pmbuf->pbuf + pmbuf->data_offset,
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
@@ -1962,10 +2236,10 @@ mlan_status wlan_ret_wmm_get_status(pmlan_private priv, t_u8 *ptlv,
 	PRINTM(MINFO, "WMM: WMM_GET_STATUS cmdresp received: %d\n", resp_len);
 	HEXDUMP("CMD_RESP: WMM_GET_STATUS", pcurrent, resp_len);
 
-	while (resp_len >= sizeof(ptlv_hdr->header)) {
+	while (resp_len >= (int)sizeof(ptlv_hdr->header)) {
 		ptlv_hdr = (MrvlIEtypes_Data_t *)pcurrent;
 		tlv_len = wlan_le16_to_cpu(ptlv_hdr->header.len);
-		if ((tlv_len + sizeof(ptlv_hdr->header)) > resp_len) {
+		if ((int)(tlv_len + sizeof(ptlv_hdr->header)) > resp_len) {
 			PRINTM(MERROR,
 			       "WMM get status: Error in processing  TLV buffer\n");
 			resp_len = 0;
@@ -2188,7 +2462,13 @@ t_u8 wlan_wmm_compute_driver_packet_delay(pmlan_private priv,
 
 	priv->adapter->callbacks.moal_get_system_time(
 		priv->adapter->pmoal_handle, &out_ts_sec, &out_ts_usec);
-
+	if (priv->adapter->tp_state_on) {
+		pmbuf->out_ts_sec = out_ts_sec;
+		pmbuf->out_ts_usec = out_ts_usec;
+		if (pmbuf->in_ts_sec)
+			priv->adapter->callbacks.moal_tp_accounting(
+				priv->adapter->pmoal_handle, pmbuf, 11);
+	}
 	queue_delay = (t_s32)(out_ts_sec - pmbuf->in_ts_sec) * 1000;
 	queue_delay += (t_s32)(out_ts_usec - pmbuf->in_ts_usec) / 1000;
 
@@ -2198,7 +2478,8 @@ t_u8 wlan_wmm_compute_driver_packet_delay(pmlan_private priv,
 	 *
 	 * Pass max value if queue_delay is beyond the uint8 range
 	 */
-	ret_val = (t_u8)(MIN(queue_delay, priv->wmm.drv_pkt_delay_max) >> 1);
+	ret_val = (t_u8)(MIN(queue_delay, (t_s32)priv->wmm.drv_pkt_delay_max) >>
+			 1);
 
 	PRINTM(MINFO, "WMM: Pkt Delay: %d ms, %d ms sent to FW\n", queue_delay,
 	       ret_val);
@@ -2420,6 +2701,125 @@ t_void wlan_wmm_delete_peer_ralist(pmlan_private priv, t_u8 *mac)
 }
 
 #ifdef STA_SUPPORT
+/**
+ *  @brief Hold TDLS packets to tdls pending queue
+ *
+ *  @param priv		A pointer to mlan_private
+ *  @param mac      station mac address
+ *
+ *  @return      N/A
+ */
+t_void wlan_hold_tdls_packets(pmlan_private priv, t_u8 *mac)
+{
+	pmlan_buffer pmbuf;
+	mlan_adapter *pmadapter = priv->adapter;
+	raListTbl *ra_list = MNULL;
+	t_u8 i;
+
+	ENTER();
+	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+					    priv->wmm.ra_list_spinlock);
+	PRINTM(MDATA, "wlan_hold_tdls_packets: " MACSTR "\n", MAC2STR(mac));
+	for (i = 0; i < MAX_NUM_TID; ++i) {
+		ra_list = (raListTbl *)util_peek_list(
+			pmadapter->pmoal_handle,
+			&priv->wmm.tid_tbl_ptr[i].ra_list, MNULL, MNULL);
+		if (ra_list) {
+			while ((pmbuf = wlan_find_tdls_packets(priv, ra_list,
+							       mac))) {
+				util_unlink_list(pmadapter->pmoal_handle,
+						 &ra_list->buf_head,
+						 (pmlan_linked_list)pmbuf,
+						 MNULL, MNULL);
+				ra_list->total_pkts--;
+				priv->wmm.pkts_queued[i]--;
+				util_scalar_decrement(pmadapter->pmoal_handle,
+						      &priv->wmm.tx_pkts_queued,
+						      MNULL, MNULL);
+				ra_list->packet_count--;
+				wlan_add_buf_tdls_txqueue(priv, pmbuf);
+				PRINTM(MDATA, "hold tdls packet=%p\n", pmbuf);
+			}
+		}
+	}
+	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
+					      priv->wmm.ra_list_spinlock);
+	LEAVE();
+}
+
+/**
+ *  @brief move TDLS packets back to ralist
+ *
+ *  @param priv		  A pointer to mlan_private
+ *  @param mac        TDLS peer mac address
+ *  @param status     tdlsStatus
+ *
+ *  @return           pmlan_buffer or MNULL
+ */
+t_void wlan_restore_tdls_packets(pmlan_private priv, t_u8 *mac,
+				 tdlsStatus_e status)
+{
+	pmlan_buffer pmbuf;
+	mlan_adapter *pmadapter = priv->adapter;
+	raListTbl *ra_list = MNULL;
+	t_u32 tid;
+	t_u32 tid_down;
+
+	ENTER();
+	PRINTM(MDATA, "wlan_restore_tdls_packets: " MACSTR " status=%d\n",
+	       MAC2STR(mac), status);
+
+	pmadapter->callbacks.moal_spin_lock(pmadapter->pmoal_handle,
+					    priv->wmm.ra_list_spinlock);
+
+	while ((pmbuf = wlan_find_packets_tdls_txq(priv, mac))) {
+		util_unlink_list(pmadapter->pmoal_handle,
+				 &priv->tdls_pending_txq,
+				 (pmlan_linked_list)pmbuf, MNULL, MNULL);
+		tid = pmbuf->priority;
+		tid_down = wlan_wmm_downgrade_tid(priv, tid);
+		if (status == TDLS_SETUP_COMPLETE) {
+			ra_list = wlan_wmm_get_queue_raptr(priv, tid_down, mac);
+			pmbuf->flags |= MLAN_BUF_FLAG_TDLS;
+		} else {
+			ra_list = (raListTbl *)util_peek_list(
+				pmadapter->pmoal_handle,
+				&priv->wmm.tid_tbl_ptr[tid_down].ra_list, MNULL,
+				MNULL);
+			pmbuf->flags &= ~MLAN_BUF_FLAG_TDLS;
+		}
+		if (!ra_list) {
+			PRINTM_NETINTF(MWARN, priv);
+			PRINTM(MWARN,
+			       "Drop packet %p, ra_list=%p media_connected=%d\n",
+			       pmbuf, ra_list, priv->media_connected);
+			wlan_write_data_complete(pmadapter, pmbuf,
+						 MLAN_STATUS_FAILURE);
+			continue;
+		}
+		PRINTM_NETINTF(MDATA, priv);
+		PRINTM(MDATA,
+		       "ADD TDLS pkt %p (priority=%d) back to ra_list %p\n",
+		       pmbuf, pmbuf->priority, ra_list);
+		util_enqueue_list_tail(pmadapter->pmoal_handle,
+				       &ra_list->buf_head,
+				       (pmlan_linked_list)pmbuf, MNULL, MNULL);
+		ra_list->total_pkts++;
+		ra_list->packet_count++;
+		priv->wmm.pkts_queued[tid_down]++;
+		util_scalar_increment(pmadapter->pmoal_handle,
+				      &priv->wmm.tx_pkts_queued, MNULL, MNULL);
+		util_scalar_conditional_write(
+			pmadapter->pmoal_handle, &priv->wmm.highest_queued_prio,
+			MLAN_SCALAR_COND_LESS_THAN, tos_to_tid_inv[tid_down],
+			tos_to_tid_inv[tid_down], MNULL, MNULL);
+	}
+	if (status != TDLS_SETUP_COMPLETE)
+		wlan_wmm_delete_tdls_ralist(priv, mac);
+	pmadapter->callbacks.moal_spin_unlock(pmadapter->pmoal_handle,
+					      priv->wmm.ra_list_spinlock);
+	LEAVE();
+}
 
 /**
  *  @brief This function prepares the command of ADDTS
@@ -2784,6 +3184,7 @@ static mlan_status wlan_wmm_ioctl_qos(pmlan_adapter pmadapter,
 		wmm->param.qos_cfg = pmpriv->wmm_qosinfo;
 	else {
 		pmpriv->wmm_qosinfo = wmm->param.qos_cfg;
+		pmpriv->saved_wmm_qosinfo = wmm->param.qos_cfg;
 	}
 
 	pioctl_req->data_read_written = sizeof(t_u8) + MLAN_SUB_COMMAND_SIZE;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_wmm.h b/mxm_wifiex/wlan_src/mlan/mlan_wmm.h
index 87878d7..b3103be 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_wmm.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_wmm.h
@@ -4,7 +4,7 @@
  *  of wmm functionalities
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -225,6 +225,9 @@ extern mlan_status wlan_ret_wmm_queue_stats(pmlan_private pmpriv,
 extern mlan_status wlan_ret_wmm_ts_status(pmlan_private pmpriv,
 					  HostCmd_DS_COMMAND *resp,
 					  mlan_ioctl_req *pioctl_buf);
+
+extern t_u8 tos_to_tid_inv[];
+extern t_u8 ac_to_tid[4][2];
 #endif /* STA_SUPPORT */
 
 /** WMM QUEUE_CONFIG command handler */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
index fc230b2..7d622e1 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
@@ -3,7 +3,7 @@
  *  @brief This file declares the generic data structures and APIs.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "214"
+#define MLAN_RELEASE_VERSION "241"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -233,12 +233,12 @@ typedef t_s32 t_sval;
 /** MU beamformer */
 #define DEFALUT_11AC_CAP_BEAMFORMING_RESET_MASK (MBIT(19))
 
-/** Size of rx data buffer 4096+256 */
-#define MLAN_RX_DATA_BUF_SIZE 4352
+/** Size of rx data buffer 3839+256 */
+#define MLAN_RX_DATA_BUF_SIZE 4096
 
 /** Size of command buffer */
 /** because cal_data_size 2.4 k */
-#define MRVDRV_SIZE_OF_CMD_BUFFER (4 * 1024)
+#define MRVDRV_SIZE_OF_CMD_BUFFER (3 * 1024)
 /** Size of rx command buffer */
 #define MLAN_RX_CMD_BUF_SIZE MRVDRV_SIZE_OF_CMD_BUFFER
 /** Upload size */
@@ -330,6 +330,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define ALLOC_BUF_SIZE MLAN_RX_DATA_BUF_SIZE
 /** SDIO MP aggr pkt limit */
 #define SDIO_MP_AGGR_DEF_PKT_LIMIT (16)
+/** SDIO MP aggr pkt limit 8 */
+#define SDIO_MP_AGGR_DEF_PKT_LIMIT_8 (8)
 /** max SDIO MP aggr pkt limit */
 #define SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX (16)
 
@@ -365,6 +367,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_9097 0x07
 /** 8978 card type */
 #define CARD_TYPE_8978 0x08
+/** 9177 card type */
+#define CARD_TYPE_9177 0x09
+/** 8801 card type */
+#define CARD_TYPE_8801 0x0a
 
 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
@@ -392,6 +398,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_SD9097 (CARD_TYPE_9097 | (INTF_SD << 8))
 /** SD9098 card type */
 #define CARD_TYPE_SD9098 (CARD_TYPE_9098 | (INTF_SD << 8))
+/** SD9177 card type */
+#define CARD_TYPE_SD9177 (CARD_TYPE_9177 | (INTF_SD << 8))
+/** SD8801 card type */
+#define CARD_TYPE_SD8801 (CARD_TYPE_8801 | (INTF_SD << 8))
 
 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@@ -401,6 +411,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_SD8987(ct) (CARD_TYPE_SD8987 == (ct))
 #define IS_SD9097(ct) (CARD_TYPE_SD9097 == (ct))
 #define IS_SD9098(ct) (CARD_TYPE_SD9098 == (ct))
+#define IS_SD9177(ct) (CARD_TYPE_SD9177 == (ct))
+#define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
 
 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@@ -418,6 +430,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SD9097 "SD9097"
 /** SD9098 Card */
 #define CARD_SD9098 "SD9098"
+/** SD9177 Card */
+#define CARD_SD9177 "SD9177"
+/** SD9177 Card */
+#define CARD_SD8801 "SD9177"
 #endif
 
 #ifdef PCIE
@@ -445,9 +461,13 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_PCIE9000S "PCIE9000S"
 /** PCIE9098 Card */
 #define CARD_PCIE9098 "PCIE9098"
+/** PCIEAW690 Card */
+#define CARD_PCIEAW690 "PCIEAW690"
 #endif
 
 #ifdef USB
+/** USB8801 card type */
+#define CARD_TYPE_USB8801 (CARD_TYPE_8801 | (INTF_USB << 8))
 /** USB8897 card type */
 #define CARD_TYPE_USB8897 (CARD_TYPE_8897 | (INTF_USB << 8))
 /** USB8997 card type */
@@ -459,12 +479,15 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 /** USB9097 card type */
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
 
+#define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
 #define IS_USB8997(ct) (CARD_TYPE_USB8997 == (ct))
 #define IS_USB8978(ct) (CARD_TYPE_USB8978 == (ct))
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
 
+/** USB8801 Card */
+#define CARD_USB8801 "USB8801"
 /** USB8897 Card */
 #define CARD_USB8897 "USB8897"
 /** USB8997 Card */
@@ -477,6 +500,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9097 "USB9097"
 #endif
 
+#define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
 #define IS_CARD8887(ct) (CARD_TYPE_8887 == ((ct)&0xf))
 #define IS_CARD8897(ct) (CARD_TYPE_8897 == ((ct)&0xf))
 #define IS_CARD8977(ct) (CARD_TYPE_8977 == ((ct)&0xf))
@@ -484,6 +508,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_CARD8987(ct) (CARD_TYPE_8987 == ((ct)&0xf))
 #define IS_CARD9098(ct) (CARD_TYPE_9098 == ((ct)&0xf))
 #define IS_CARD9097(ct) (CARD_TYPE_9097 == ((ct)&0xf))
+#define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
 
 typedef struct _card_type_entry {
 	t_u16 card_type;
@@ -534,6 +559,9 @@ typedef enum {
 #define MLAN_BUF_FLAG_USB_TX_AGGR MBIT(7)
 #endif
 
+/** Buffer flag for TDLS */
+#define MLAN_BUF_FLAG_TDLS MBIT(8)
+
 /** Buffer flag for TCP_ACK */
 #define MLAN_BUF_FLAG_TCP_ACK MBIT(9)
 
@@ -745,6 +773,7 @@ typedef enum _mlan_event_id {
 	MLAN_EVENT_ID_DRV_BGSCAN_RESULT = 0x80000013,
 	MLAN_EVENT_ID_DRV_FLUSH_RX_WORK = 0x80000015,
 	MLAN_EVENT_ID_DRV_DEFER_RX_WORK = 0x80000016,
+	MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ = 0x80000017,
 	MLAN_EVENT_ID_DRV_FT_RESPONSE = 0x80000018,
 	MLAN_EVENT_ID_DRV_FLUSH_MAIN_WORK = 0x80000019,
 #ifdef UAP_SUPPORT
@@ -918,7 +947,7 @@ typedef MLAN_PACK_START struct _chan_band_info {
 	t_u8 center_chan;
 	/** dfs channel flag */
 	t_u8 is_dfs_chan;
-} MLAN_PACK_END chan_band_info, *pchan_band_info;
+} MLAN_PACK_END chan_band_info;
 
 /** Channel usability flags */
 #define NXP_CHANNEL_NO_OFDM MBIT(9)
@@ -1109,7 +1138,10 @@ typedef struct _mlan_buffer {
 	t_u32 out_ts_usec;
 	/** tx_seq_num */
 	t_u32 tx_seq_num;
-
+	/** Time stamp when packet is deque from rx_q(seconds) */
+	t_u32 extra_ts_sec;
+	/** Time stamp when packet is dequed from rx_q(micro seconds) */
+	t_u32 extra_ts_usec;
 	/** Fields below are valid for MLAN module only */
 	/** Pointer to parent mlan_buffer */
 	struct _mlan_buffer *pparent;
@@ -1121,9 +1153,10 @@ typedef struct _mlan_buffer {
 	} u;
 } mlan_buffer, *pmlan_buffer, **ppmlan_buffer;
 
-/** mlan_fw_info data structure */
+/** mlan_hw_info data structure */
 typedef struct _mlan_hw_info {
 	t_u32 fw_cap;
+	t_u32 fw_cap_ext;
 } mlan_hw_info, *pmlan_hw_info;
 
 /** mlan_bss_attr data structure */
@@ -1262,6 +1295,242 @@ typedef MLAN_PACK_START struct _tlvbuf_custom_ie {
 	tlvbuf_max_mgmt_ie max_mgmt_ie;
 } MLAN_PACK_END mlan_ds_misc_custom_ie;
 
+/** Max TDLS config data length */
+#define MAX_TDLS_DATA_LEN 1024
+
+/** Action commands for TDLS enable/disable */
+#define WLAN_TDLS_CONFIG 0x00
+/** Action commands for TDLS configuration :Set */
+#define WLAN_TDLS_SET_INFO 0x01
+/** Action commands for TDLS configuration :Discovery Request */
+#define WLAN_TDLS_DISCOVERY_REQ 0x02
+/** Action commands for TDLS configuration :Setup Request */
+#define WLAN_TDLS_SETUP_REQ 0x03
+/** Action commands for TDLS configuration :Tear down Request */
+#define WLAN_TDLS_TEAR_DOWN_REQ 0x04
+/** Action ID for TDLS power mode */
+#define WLAN_TDLS_POWER_MODE 0x05
+/**Action ID for init TDLS Channel Switch*/
+#define WLAN_TDLS_INIT_CHAN_SWITCH 0x06
+/** Action ID for stop TDLS Channel Switch */
+#define WLAN_TDLS_STOP_CHAN_SWITCH 0x07
+/** Action ID for configure CS related parameters */
+#define WLAN_TDLS_CS_PARAMS 0x08
+/** Action ID for Disable CS */
+#define WLAN_TDLS_CS_DISABLE 0x09
+/** Action ID for TDLS link status */
+#define WLAN_TDLS_LINK_STATUS 0x0A
+/** Action ID for Host TDLS config uapsd and CS */
+#define WLAN_HOST_TDLS_CONFIG 0x0D
+/** Action ID for TDLS CS immediate return */
+#define WLAN_TDLS_DEBUG_CS_RET_IM 0xFFF7
+/** Action ID for TDLS Stop RX */
+#define WLAN_TDLS_DEBUG_STOP_RX 0xFFF8
+/** Action ID for TDLS Allow weak security for links establish */
+#define WLAN_TDLS_DEBUG_ALLOW_WEAK_SECURITY 0xFFF9
+/** Action ID for TDLS Ignore key lifetime expiry */
+#define WLAN_TDLS_DEBUG_IGNORE_KEY_EXPIRY 0xFFFA
+/** Action ID for TDLS Higher/Lower mac Test */
+#define WLAN_TDLS_DEBUG_HIGHER_LOWER_MAC 0xFFFB
+/** Action ID for TDLS Prohibited Test */
+#define WLAN_TDLS_DEBUG_SETUP_PROHIBITED 0xFFFC
+/** Action ID for TDLS Existing link Test */
+#define WLAN_TDLS_DEBUG_SETUP_SAME_LINK 0xFFFD
+/** Action ID for TDLS Fail Setup Confirm */
+#define WLAN_TDLS_DEBUG_FAIL_SETUP_CONFIRM 0xFFFE
+/** Action commands for TDLS debug: Wrong BSS Request */
+#define WLAN_TDLS_DEBUG_WRONG_BSS 0xFFFF
+
+/** tdls each link rate information */
+typedef MLAN_PACK_START struct _tdls_link_rate_info {
+	/** Tx Data Rate */
+	t_u8 tx_data_rate;
+	/** Tx Rate HT info*/
+	t_u8 tx_rate_htinfo;
+} MLAN_PACK_END tdls_link_rate_info;
+
+/** tdls each link status */
+typedef MLAN_PACK_START struct _tdls_each_link_status {
+	/** peer mac Address */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+	/** Link Flags */
+	t_u8 link_flags;
+	/** Traffic Status */
+	t_u8 traffic_status;
+	/** Tx Failure Count */
+	t_u8 tx_fail_count;
+	/** Channel Number */
+	t_u32 active_channel;
+	/** Last Data RSSI in dBm */
+	t_s16 data_rssi_last;
+	/** Last Data NF in dBm */
+	t_s16 data_nf_last;
+	/** AVG DATA RSSI in dBm */
+	t_s16 data_rssi_avg;
+	/** AVG DATA NF in dBm */
+	t_s16 data_nf_avg;
+	union {
+		/** tdls rate info */
+		tdls_link_rate_info rate_info;
+		/** tdls link final rate*/
+		t_u16 final_data_rate;
+	} u;
+	/** Security Method */
+	t_u8 security_method;
+	/** Key Lifetime in milliseconds */
+	t_u32 key_lifetime;
+	/** Key Length */
+	t_u8 key_length;
+	/** actual key */
+	t_u8 key[];
+} MLAN_PACK_END tdls_each_link_status;
+
+/** TDLS configuration data */
+typedef MLAN_PACK_START struct _tdls_all_config {
+	union {
+		/** TDLS state enable disable */
+		MLAN_PACK_START struct _tdls_config {
+			/** enable or disable */
+			t_u16 enable;
+		} MLAN_PACK_END tdls_config;
+		/** Host tdls config */
+		MLAN_PACK_START struct _host_tdls_cfg {
+			/** support uapsd */
+			t_u8 uapsd_support;
+			/** channel_switch */
+			t_u8 cs_support;
+			/** TLV  length */
+			t_u16 tlv_len;
+			/** tdls info */
+			t_u8 tlv_buffer[];
+		} MLAN_PACK_END host_tdls_cfg;
+		/** TDLS set info */
+		MLAN_PACK_START struct _tdls_set_data {
+			/** (tlv + capInfo) length */
+			t_u16 tlv_length;
+			/** Cap Info */
+			t_u16 cap_info;
+			/** TLV buffer */
+			t_u8 tlv_buffer[];
+		} MLAN_PACK_END tdls_set;
+
+		/** TDLS discovery and others having mac argument */
+		MLAN_PACK_START struct _tdls_discovery_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+		} MLAN_PACK_END tdls_discovery, tdls_stop_chan_switch,
+			tdls_link_status_req;
+
+		/** TDLS discovery Response */
+		MLAN_PACK_START struct _tdls_discovery_resp {
+			/** payload length */
+			t_u16 payload_len;
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** RSSI */
+			t_s8 rssi;
+			/** Cap Info */
+			t_u16 cap_info;
+			/** TLV buffer */
+			t_u8 tlv_buffer[];
+		} MLAN_PACK_END tdls_discovery_resp;
+
+		/** TDLS setup request */
+		MLAN_PACK_START struct _tdls_setup_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** timeout value in milliseconds */
+			t_u32 setup_timeout;
+			/** key lifetime in milliseconds */
+			t_u32 key_lifetime;
+		} MLAN_PACK_END tdls_setup;
+
+		/** TDLS tear down info */
+		MLAN_PACK_START struct _tdls_tear_down_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** reason code */
+			t_u16 reason_code;
+		} MLAN_PACK_END tdls_tear_down, tdls_cmd_resp;
+
+		/** TDLS power mode info */
+		MLAN_PACK_START struct _tdls_power_mode_data {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** Power Mode */
+			t_u16 power_mode;
+		} MLAN_PACK_END tdls_power_mode;
+
+		/** TDLS channel switch info */
+		MLAN_PACK_START struct _tdls_chan_switch {
+			/** peer mac Address */
+			t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+			/** Channel Switch primary channel no */
+			t_u8 primary_channel;
+			/** Channel Switch secondary channel offset */
+			t_u8 secondary_channel_offset;
+			/** Channel Switch Band */
+			t_u8 band;
+			/** Channel Switch time in milliseconds */
+			t_u16 switch_time;
+			/** Channel Switch timeout in milliseconds */
+			t_u16 switch_timeout;
+			/** Channel Regulatory class*/
+			t_u8 regulatory_class;
+			/** peridicity flag*/
+			t_u8 periodicity;
+		} MLAN_PACK_END tdls_chan_switch;
+
+		/** TDLS channel switch paramters */
+		MLAN_PACK_START struct _tdls_cs_params {
+			/** unit time, multiples of 10ms */
+			t_u8 unit_time;
+			/** threshold for other link */
+			t_u8 threshold_otherlink;
+			/** threshold for direct link */
+			t_u8 threshold_directlink;
+		} MLAN_PACK_END tdls_cs_params;
+
+		/** tdls disable channel switch */
+		MLAN_PACK_START struct _tdls_disable_cs {
+			/** Data*/
+			t_u16 data;
+		} MLAN_PACK_END tdls_disable_cs;
+		/** TDLS debug data */
+		MLAN_PACK_START struct _tdls_debug_data {
+			/** debug data */
+			t_u16 debug_data;
+		} MLAN_PACK_END tdls_debug_data;
+
+		/** TDLS link status Response */
+		MLAN_PACK_START struct _tdls_link_status_resp {
+			/** payload length */
+			t_u16 payload_len;
+			/** number of links */
+			t_u8 active_links;
+			/** structure for link status */
+			tdls_each_link_status link_stats[1];
+		} MLAN_PACK_END tdls_link_status_resp;
+
+	} u;
+} MLAN_PACK_END tdls_all_config;
+
+/** TDLS configuration buffer */
+typedef MLAN_PACK_START struct _buf_tdls_config {
+	/** TDLS Action */
+	t_u16 tdls_action;
+	/** TDLS data */
+	t_u8 tdls_data[MAX_TDLS_DATA_LEN];
+} MLAN_PACK_END mlan_ds_misc_tdls_config;
+
+/** Event structure for tear down */
+typedef struct _tdls_tear_down_event {
+	/** Peer mac address */
+	t_u8 peer_mac_addr[MLAN_MAC_ADDR_LENGTH];
+	/** Reason code */
+	t_u16 reason_code;
+} tdls_tear_down_event;
+
 /** channel width */
 typedef enum wifi_channel_width {
 	WIFI_CHAN_WIDTH_20 = 0,
@@ -1614,160 +1883,149 @@ typedef struct _sta_stats {
 /** mlan_callbacks data structure */
 typedef struct _mlan_callbacks {
 	/** moal_get_fw_data */
-	mlan_status (*moal_get_fw_data)(t_void *pmoal_handle, t_u32 offset,
-					t_u32 len, t_u8 *pbuf);
-	mlan_status (*moal_get_vdll_data)(t_void *pmoal_handle, t_u32 len,
-					  t_u8 *pbuf);
+	mlan_status (*moal_get_fw_data)(t_void *pmoal, t_u32 offset, t_u32 len,
+					t_u8 *pbuf);
+	mlan_status (*moal_get_vdll_data)(t_void *pmoal, t_u32 len, t_u8 *pbuf);
 	/** moal_get_hw_spec_complete */
-	mlan_status (*moal_get_hw_spec_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_get_hw_spec_complete)(t_void *pmoal,
 						 mlan_status status,
 						 pmlan_hw_info phw,
 						 pmlan_bss_tbl ptbl);
 	/** moal_init_fw_complete */
-	mlan_status (*moal_init_fw_complete)(t_void *pmoal_handle,
-					     mlan_status status);
+	mlan_status (*moal_init_fw_complete)(t_void *pmoal, mlan_status status);
 	/** moal_shutdown_fw_complete */
-	mlan_status (*moal_shutdown_fw_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_shutdown_fw_complete)(t_void *pmoal,
 						 mlan_status status);
 	/** moal_send_packet_complete */
-	mlan_status (*moal_send_packet_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_send_packet_complete)(t_void *pmoal,
 						 pmlan_buffer pmbuf,
 						 mlan_status status);
 	/** moal_recv_complete */
-	mlan_status (*moal_recv_complete)(t_void *pmoal_handle,
-					  pmlan_buffer pmbuf, t_u32 port,
-					  mlan_status status);
+	mlan_status (*moal_recv_complete)(t_void *pmoal, pmlan_buffer pmbuf,
+					  t_u32 port, mlan_status status);
 	/** moal_recv_packet */
-	mlan_status (*moal_recv_packet)(t_void *pmoal_handle,
-					pmlan_buffer pmbuf);
+	mlan_status (*moal_recv_packet)(t_void *pmoal, pmlan_buffer pmbuf);
 	/** moal_recv_event */
-	mlan_status (*moal_recv_event)(t_void *pmoal_handle,
-				       pmlan_event pmevent);
+	mlan_status (*moal_recv_event)(t_void *pmoal, pmlan_event pmevent);
 	/** moal_ioctl_complete */
-	mlan_status (*moal_ioctl_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_ioctl_complete)(t_void *pmoal,
 					   pmlan_ioctl_req pioctl_req,
 					   mlan_status status);
 
 	/** moal_alloc_mlan_buffer */
-	mlan_status (*moal_alloc_mlan_buffer)(t_void *pmoal_handle, t_u32 size,
+	mlan_status (*moal_alloc_mlan_buffer)(t_void *pmoal, t_u32 size,
 					      ppmlan_buffer pmbuf);
 	/** moal_free_mlan_buffer */
-	mlan_status (*moal_free_mlan_buffer)(t_void *pmoal_handle,
-					     pmlan_buffer pmbuf);
+	mlan_status (*moal_free_mlan_buffer)(t_void *pmoal, pmlan_buffer pmbuf);
 
 #ifdef USB
 	/** moal_write_data_async */
-	mlan_status (*moal_write_data_async)(t_void *pmoal_handle,
-					     pmlan_buffer pmbuf, t_u32 port);
+	mlan_status (*moal_write_data_async)(t_void *pmoal, pmlan_buffer pmbuf,
+					     t_u32 port);
 #endif /* USB */
 #if defined(SDIO) || defined(PCIE)
 	/** moal_write_reg */
-	mlan_status (*moal_write_reg)(t_void *pmoal_handle, t_u32 reg,
-				      t_u32 data);
+	mlan_status (*moal_write_reg)(t_void *pmoal, t_u32 reg, t_u32 data);
 	/** moal_read_reg */
-	mlan_status (*moal_read_reg)(t_void *pmoal_handle, t_u32 reg,
-				     t_u32 *data);
+	mlan_status (*moal_read_reg)(t_void *pmoal, t_u32 reg, t_u32 *data);
 #endif /* SDIO || PCIE */
 	/** moal_write_data_sync */
-	mlan_status (*moal_write_data_sync)(t_void *pmoal_handle,
-					    pmlan_buffer pmbuf, t_u32 port,
-					    t_u32 timeout);
+	mlan_status (*moal_write_data_sync)(t_void *pmoal, pmlan_buffer pmbuf,
+					    t_u32 port, t_u32 timeout);
 	/** moal_read_data_sync */
-	mlan_status (*moal_read_data_sync)(t_void *pmoal_handle,
-					   pmlan_buffer pmbuf, t_u32 port,
-					   t_u32 timeout);
+	mlan_status (*moal_read_data_sync)(t_void *pmoal, pmlan_buffer pmbuf,
+					   t_u32 port, t_u32 timeout);
 	/** moal_malloc */
-	mlan_status (*moal_malloc)(t_void *pmoal_handle, t_u32 size, t_u32 flag,
+	mlan_status (*moal_malloc)(t_void *pmoal, t_u32 size, t_u32 flag,
 				   t_u8 **ppbuf);
 	/** moal_mfree */
-	mlan_status (*moal_mfree)(t_void *pmoal_handle, t_u8 *pbuf);
+	mlan_status (*moal_mfree)(t_void *pmoal, t_u8 *pbuf);
 	/** moal_vmalloc */
-	mlan_status (*moal_vmalloc)(t_void *pmoal_handle, t_u32 size,
-				    t_u8 **ppbuf);
+	mlan_status (*moal_vmalloc)(t_void *pmoal, t_u32 size, t_u8 **ppbuf);
 	/** moal_vfree */
-	mlan_status (*moal_vfree)(t_void *pmoal_handle, t_u8 *pbuf);
+	mlan_status (*moal_vfree)(t_void *pmoal, t_u8 *pbuf);
 #ifdef PCIE
 	/** moal_malloc_consistent */
-	mlan_status (*moal_malloc_consistent)(t_void *pmoal_handle, t_u32 size,
+	mlan_status (*moal_malloc_consistent)(t_void *pmoal, t_u32 size,
 					      t_u8 **ppbuf, t_u64 *pbuf_pa);
 	/** moal_mfree_consistent */
-	mlan_status (*moal_mfree_consistent)(t_void *pmoal_handle, t_u32 size,
+	mlan_status (*moal_mfree_consistent)(t_void *pmoal, t_u32 size,
 					     t_u8 *pbuf, t_u64 buf_pa);
 	/** moal_map_memory */
-	mlan_status (*moal_map_memory)(t_void *pmoal_handle, t_u8 *pbuf,
+	mlan_status (*moal_map_memory)(t_void *pmoal, t_u8 *pbuf,
 				       t_u64 *pbuf_pa, t_u32 size, t_u32 flag);
 	/** moal_unmap_memory */
-	mlan_status (*moal_unmap_memory)(t_void *pmoal_handle, t_u8 *pbuf,
+	mlan_status (*moal_unmap_memory)(t_void *pmoal, t_u8 *pbuf,
 					 t_u64 buf_pa, t_u32 size, t_u32 flag);
 #endif /* PCIE */
 	/** moal_memset */
-	t_void *(*moal_memset)(t_void *pmoal_handle, t_void *pmem, t_u8 byte,
+	t_void *(*moal_memset)(t_void *pmoal, t_void *pmem, t_u8 byte,
 			       t_u32 num);
 	/** moal_memcpy */
-	t_void *(*moal_memcpy)(t_void *pmoal_handle, t_void *pdest,
-			       const t_void *psrc, t_u32 num);
+	t_void *(*moal_memcpy)(t_void *pmoal, t_void *pdest, const t_void *psrc,
+			       t_u32 num);
 	/** moal_memcpy_ext */
-	t_void *(*moal_memcpy_ext)(t_void *pmoal_handle, t_void *pdest,
+	t_void *(*moal_memcpy_ext)(t_void *pmoal, t_void *pdest,
 				   const t_void *psrc, t_u32 num,
 				   t_u32 dest_size);
 	/** moal_memmove */
-	t_void *(*moal_memmove)(t_void *pmoal_handle, t_void *pdest,
+	t_void *(*moal_memmove)(t_void *pmoal, t_void *pdest,
 				const t_void *psrc, t_u32 num);
 	/** moal_memcmp */
-	t_s32 (*moal_memcmp)(t_void *pmoal_handle, const t_void *pmem1,
+	t_s32 (*moal_memcmp)(t_void *pmoal, const t_void *pmem1,
 			     const t_void *pmem2, t_u32 num);
 	/** moal_udelay */
-	t_void (*moal_udelay)(t_void *pmoal_handle, t_u32 udelay);
+	t_void (*moal_udelay)(t_void *pmoal, t_u32 udelay);
 	/** moal_usleep_range */
-	t_void (*moal_usleep_range)(t_void *pmoal_handle, t_u32 min_delay,
+	t_void (*moal_usleep_range)(t_void *pmoal, t_u32 min_delay,
 				    t_u32 max_delay);
 	/** moal_get_boot_ktime */
-	mlan_status (*moal_get_boot_ktime)(t_void *pmoal_handle, t_u64 *pnsec);
+	mlan_status (*moal_get_boot_ktime)(t_void *pmoal, t_u64 *pnsec);
 	/** moal_get_system_time */
-	mlan_status (*moal_get_system_time)(t_void *pmoal_handle, t_u32 *psec,
+	mlan_status (*moal_get_system_time)(t_void *pmoal, t_u32 *psec,
 					    t_u32 *pusec);
 	/** moal_init_timer*/
-	mlan_status (*moal_init_timer)(t_void *pmoal_handle, t_void **pptimer,
+	mlan_status (*moal_init_timer)(t_void *pmoal, t_void **pptimer,
 				       IN t_void (*callback)(t_void *pcontext),
 				       t_void *pcontext);
 	/** moal_free_timer */
-	mlan_status (*moal_free_timer)(t_void *pmoal_handle, t_void *ptimer);
+	mlan_status (*moal_free_timer)(t_void *pmoal, t_void *ptimer);
 	/** moal_start_timer*/
-	mlan_status (*moal_start_timer)(t_void *pmoal_handle, t_void *ptimer,
+	mlan_status (*moal_start_timer)(t_void *pmoal, t_void *ptimer,
 					t_u8 periodic, t_u32 msec);
 	/** moal_stop_timer*/
-	mlan_status (*moal_stop_timer)(t_void *pmoal_handle, t_void *ptimer);
+	mlan_status (*moal_stop_timer)(t_void *pmoal, t_void *ptimer);
 	/** moal_init_lock */
-	mlan_status (*moal_init_lock)(t_void *pmoal_handle, t_void **pplock);
+	mlan_status (*moal_init_lock)(t_void *pmoal, t_void **pplock);
 	/** moal_free_lock */
-	mlan_status (*moal_free_lock)(t_void *pmoal_handle, t_void *plock);
+	mlan_status (*moal_free_lock)(t_void *pmoal, t_void *plock);
 	/** moal_spin_lock */
-	mlan_status (*moal_spin_lock)(t_void *pmoal_handle, t_void *plock);
+	mlan_status (*moal_spin_lock)(t_void *pmoal, t_void *plock);
 	/** moal_spin_unlock */
-	mlan_status (*moal_spin_unlock)(t_void *pmoal_handle, t_void *plock);
+	mlan_status (*moal_spin_unlock)(t_void *pmoal, t_void *plock);
 	/** moal_print */
-	t_void (*moal_print)(t_void *pmoal_handle, t_u32 level, char *pformat,
-			     IN...);
+	t_void (*moal_print)(t_void *pmoal, t_u32 level, char *pformat, IN...);
 	/** moal_print_netintf */
-	t_void (*moal_print_netintf)(t_void *pmoal_handle, t_u32 bss_index,
+	t_void (*moal_print_netintf)(t_void *pmoal, t_u32 bss_index,
 				     t_u32 level);
 	/** moal_assert */
-	t_void (*moal_assert)(t_void *pmoal_handle, t_u32 cond);
+	t_void (*moal_assert)(t_void *pmoal, t_u32 cond);
 
 	/** moal_hist_data_add */
-	t_void (*moal_hist_data_add)(t_void *pmoal_handle, t_u32 bss_index,
+	t_void (*moal_hist_data_add)(t_void *pmoal, t_u32 bss_index,
 				     t_u16 rx_rate, t_s8 snr, t_s8 nflr,
 				     t_u8 antenna);
+	t_void (*moal_updata_peer_signal)(t_void *pmoal, t_u32 bss_index,
+					  t_u8 *peer_addr, t_s8 snr, t_s8 nflr);
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_wait_hostcmd_complete)(t_void *pmoal,
 						  t_u32 bss_index);
-	mlan_status (*moal_notify_hostcmd_complete)(t_void *pmoal_handle,
+	mlan_status (*moal_notify_hostcmd_complete)(t_void *pmoal,
 						    t_u32 bss_index);
 #endif
-	void (*moal_tp_accounting)(t_void *pmoal_handle, t_void *buf,
+	void (*moal_tp_accounting)(t_void *pmoal, t_void *buf,
 				   t_u32 drop_point);
-	void (*moal_tp_accounting_rx_param)(t_void *pmoal_handle,
-					    unsigned int type,
+	void (*moal_tp_accounting_rx_param)(t_void *pmoal, unsigned int type,
 					    unsigned int rsvd1);
 
 } mlan_callbacks, *pmlan_callbacks;
@@ -1899,8 +2157,6 @@ typedef struct _mlan_device {
 	/** Tx data endpoint address */
 	t_u8 tx_data_ep;
 #endif
-	/** fw region */
-	t_bool fw_region;
 	/** passive to active scan */
 	t_u8 passive_to_active_scan;
 	/** uap max supported station per chip */
@@ -1919,51 +2175,50 @@ MLAN_API mlan_status mlan_register(pmlan_device pmdevice,
 				   t_void **ppmlan_adapter);
 
 /** Un-registration */
-MLAN_API mlan_status mlan_unregister(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_unregister(t_void *padapter);
 
 /** Firmware Downloading */
-MLAN_API mlan_status mlan_dnld_fw(t_void *pmlan_adapter, pmlan_fw_image pmfw);
+MLAN_API mlan_status mlan_dnld_fw(t_void *padapter, pmlan_fw_image pmfw);
 
 /** Custom data pass API */
-MLAN_API mlan_status mlan_set_init_param(t_void *pmlan_adapter,
+MLAN_API mlan_status mlan_set_init_param(t_void *padapter,
 					 pmlan_init_param pparam);
 
 /** Firmware Initialization */
-MLAN_API mlan_status mlan_init_fw(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_init_fw(t_void *padapter);
 
 /** Firmware Shutdown */
-MLAN_API mlan_status mlan_shutdown_fw(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_shutdown_fw(t_void *padapter);
 
 /** Main Process */
-MLAN_API mlan_status mlan_main_process(t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_main_process(t_void *padapter);
 
 /** Rx process */
-mlan_status mlan_rx_process(t_void *pmlan_adapter, t_u8 *rx_pkts);
+mlan_status mlan_rx_process(t_void *padapter, t_u8 *rx_pkts);
 
 /** Packet Transmission */
-MLAN_API mlan_status mlan_send_packet(t_void *pmlan_adapter,
-				      pmlan_buffer pmbuf);
+MLAN_API mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf);
 
 #ifdef USB
 /** mlan_write_data_async_complete */
-MLAN_API mlan_status mlan_write_data_async_complete(t_void *pmlan_adapter,
+MLAN_API mlan_status mlan_write_data_async_complete(t_void *padapter,
 						    pmlan_buffer pmbuf,
 						    t_u32 port,
 						    mlan_status status);
 
 /** Packet Reception */
-MLAN_API mlan_status mlan_recv(t_void *pmlan_adapter, pmlan_buffer pmbuf,
+MLAN_API mlan_status mlan_recv(t_void *padapter, pmlan_buffer pmbuf,
 			       t_u32 port);
 #endif /* USB */
 
 /** Packet Reception complete callback */
-MLAN_API mlan_status mlan_recv_packet_complete(t_void *pmlan_adapter,
+MLAN_API mlan_status mlan_recv_packet_complete(t_void *padapter,
 					       pmlan_buffer pmbuf,
 					       mlan_status status);
 
 #if defined(SDIO) || defined(PCIE)
 /** interrupt handler */
-MLAN_API mlan_status mlan_interrupt(t_u16 msg_id, t_void *pmlan_adapter);
+MLAN_API mlan_status mlan_interrupt(t_u16 msg_id, t_void *padapter);
 
 #if defined(SYSKT)
 /** GPIO IRQ callback function */
@@ -1971,7 +2226,7 @@ MLAN_API t_void mlan_hs_callback(t_void *pctx);
 #endif /* SYSKT_MULTI || SYSKT */
 #endif /* SDIO || PCIE */
 
-MLAN_API t_void mlan_pm_wakeup_card(t_void *pmlan_adapter, t_u8 keep_wakeup);
+MLAN_API t_void mlan_pm_wakeup_card(t_void *padapter, t_u8 keep_wakeup);
 
 MLAN_API t_u8 mlan_is_main_process_running(t_void *adapter);
 #ifdef PCIE
@@ -1979,10 +2234,8 @@ MLAN_API t_void mlan_set_int_mode(t_void *adapter, t_u32 int_mode,
 				  t_u8 func_num);
 #endif
 /** mlan ioctl */
-MLAN_API mlan_status mlan_ioctl(t_void *pmlan_adapter,
-				pmlan_ioctl_req pioctl_req);
+MLAN_API mlan_status mlan_ioctl(t_void *padapter, pmlan_ioctl_req pioctl_req);
 /** mlan select wmm queue */
-MLAN_API t_u8 mlan_select_wmm_queue(t_void *pmlan_adapter, t_u8 bss_num,
-				    t_u8 tid);
+MLAN_API t_u8 mlan_select_wmm_queue(t_void *padapter, t_u8 bss_num, t_u8 tid);
 
 #endif /* !_MLAN_DECL_H_ */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h b/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
index a2a4d55..6f73424 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
@@ -4,7 +4,7 @@
  *  definitions used in MLAN and MOAL module.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -100,6 +100,7 @@ typedef MLAN_PACK_START enum _IEEEtypes_ElementId_e {
 	NONTX_BSSID_CAP = 83,
 	MBSSID_INDEX = 85,
 	EXT_CAPABILITY = 127,
+	LINK_ID = 101,
 	/*IEEE802.11r*/
 	MOBILITY_DOMAIN = 54,
 	FAST_BSS_TRANSITION = 55,
@@ -734,25 +735,27 @@ typedef MLAN_PACK_START struct {
 	t_u8 Schedule : 1;
 	IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e AckPolicy : 2;
 	t_u8 UserPri : 3; /* ! 802.1d User Priority */
-	IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /* !
-								    Legacy/Trigg
-								  */
+	// IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /*
+	// !Legacy/Trigg*/
+	t_u8 PowerSaveBehavior : 1;
 	t_u8 Aggregation : 1; /* ! Reserved */
 	t_u8 AccessPolicy2 : 1; /* ! */
 	t_u8 AccessPolicy1 : 1; /* ! */
 	IEEEtypes_WMM_TSPEC_TS_Info_Direction_e Direction : 2;
 	t_u8 TID : 4; /* ! Unique identifier */
-	IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	// IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	t_u8 TrafficType : 1;
 #else
-	IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	// IEEEtypes_WMM_TSPEC_TS_TRAFFIC_TYPE_e TrafficType : 1;
+	t_u8 TrafficType : 1;
 	t_u8 TID : 4; /* ! Unique identifier */
 	IEEEtypes_WMM_TSPEC_TS_Info_Direction_e Direction : 2;
 	t_u8 AccessPolicy1 : 1; /* ! */
 	t_u8 AccessPolicy2 : 1; /* ! */
 	t_u8 Aggregation : 1; /* ! Reserved */
-	IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /* !
-								    Legacy/Trigg
-								  */
+	// IEEEtypes_WMM_TSPEC_TS_Info_PSB_e PowerSaveBehavior : 1; /* !
+	// Legacy/Trigg*/
+	t_u8 PowerSaveBehavior : 1;
 	t_u8 UserPri : 3; /* ! 802.1d User Priority */
 	IEEEtypes_WMM_TSPEC_TS_Info_AckPolicy_e AckPolicy : 2;
 	t_u8 Schedule : 1;
@@ -938,6 +941,20 @@ typedef MLAN_PACK_START struct _IEEEtypes_CountryInfoFullSet_t {
 
 #endif /* STA_SUPPORT */
 
+/** Data structure for Link ID */
+typedef MLAN_PACK_START struct _IEEEtypes_LinkIDElement_t {
+	/** Element ID */
+	t_u8 element_id;
+	/** Length */
+	t_u8 len;
+	/** bssid */
+	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
+	/** initial sta address */
+	t_u8 init_sta[MLAN_MAC_ADDR_LENGTH];
+	/** respose sta address */
+	t_u8 resp_sta[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END IEEEtypes_LinkIDElement_t, *pIEEEtypes_LinkIDElement_t;
+
 /** HT Capabilities Data */
 typedef struct MLAN_PACK_START _HTCap_t {
 	/** HT Capabilities Info field */
@@ -1025,6 +1042,53 @@ typedef MLAN_PACK_START struct _IEEEtypes_HTInfo_t {
 	HTInfo_t ht_info;
 } MLAN_PACK_END IEEEtypes_HTInfo_t, *pIEEEtypes_HTInfo_t;
 
+/** the AP which send the multi_bssid IE */
+#define MULTI_BSSID_AP 1
+/** the AP which don't send beacon */
+#define MULTI_BSSID_SUB_AP 2
+/** IEEEtypes_NotxBssCap_t */
+typedef MLAN_PACK_START struct _IEEEtypes_NotxBssCap_t {
+	/** Nontransmitted BSSID Capability: Element ID */
+	t_u8 element_id;
+	/** Nontransmitted BSSID Capability : Length */
+	t_u8 len;
+	/** capability */
+	t_u16 cap;
+} MLAN_PACK_END IEEEtypes_NotxBssCap_t, *pIEEEtypes_NotxBssCap_t;
+
+/** Multi BSSID IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MultiBSSIDIndex_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** BSSID Index */
+	t_u8 bssid_index;
+	/** DTIM Period (Optional, not Present in ProbeRsp) */
+	t_u8 dtim_period;
+	/** DTIM Count (Optional, not Present in ProbeRsp) */
+	t_u8 dtim_count;
+} MLAN_PACK_END IEEEtypes_MultiBSSIDIndex_t, *pIEEEtypes_MultiBSSIDIndex_t;
+
+/** NonTransmitted BSSID Profile Subelement IE */
+/** SUBID for IEEEtypes_NonTransBSSIDCap_t */
+#define NONTRANS_BSSID_PROFILE_SUBELEM_ID 0
+
+/** NonTransmitted BSSID Capability IE */
+typedef MLAN_PACK_START struct _IEEEtypes_NonTransBSSIDProfile_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	t_u8 profile_data[];
+} MLAN_PACK_END IEEEtypes_NonTransBSSIDProfile_t,
+	*pIEEEtypes_NonTransBSSIDProfile_t;
+
+/** Multi BSSID IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MultiBSSID_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Max BSSID Indicator */
+	t_u8 max_bssid_indicator;
+	/** Optional Subelement data*/
+	t_u8 sub_elem_data[];
+} MLAN_PACK_END IEEEtypes_MultiBSSID_t, *pIEEEtypes_MultiBSSID_t;
 /** 20/40 BSS Coexistence IE */
 typedef MLAN_PACK_START struct _IEEEtypes_2040BSSCo_t {
 	/** Generic IE header */
@@ -1221,6 +1285,40 @@ typedef MLAN_PACK_START struct _IEEEtypes_HECap_t {
 	/** PPE Thresholds (optional) */
 } MLAN_PACK_END IEEEtypes_HECap_t, *pIEEEtypes_HECap_t;
 
+/** default channel switch count */
+#define DEF_CHAN_SWITCH_COUNT 5
+
+/*  IEEE Channel Switch Announcement Element (7.3.2.20) */
+/**
+ *  Provided in beacons and probe responses.  Used to advertise when
+ *    and to which channel it is changing to.  Only starting STAs in
+ *    an IBSS and APs are allowed to originate a chan switch element.
+ */
+typedef MLAN_PACK_START struct {
+	t_u8 element_id; /**< IEEE Element ID = 37 */
+	t_u8 len; /**< Element length after id and len */
+	t_u8 chan_switch_mode; /**< STA should not transmit any frames if 1 */
+	t_u8 new_channel_num; /**< Channel # that AP/IBSS is moving to */
+	t_u8 chan_switch_count; /**< # of TBTTs before channel switch */
+
+} MLAN_PACK_END IEEEtypes_ChanSwitchAnn_t;
+
+/** data structure for extended channel switch */
+typedef MLAN_PACK_START struct {
+	/** IEEE element ID = 60 */
+	t_u8 element_id;
+	/** Element length after id and len, set to 4 */
+	t_u8 len;
+	/** STA should not transmit any frames if 1 */
+	t_u8 chan_switch_mode;
+	/** Operate class # that AP/IBSS is moving to */
+	t_u8 new_oper_class;
+	/** Channel # that AP/IBSS is moving to */
+	t_u8 new_channel_num;
+	/** of TBTTs before channel switch */
+	t_u8 chan_switch_count;
+} MLAN_PACK_END IEEEtypes_ExtChanSwitchAnn_t;
+
 /** Maximum number of subbands in the IEEEtypes_SupportedChannels_t structure */
 #define WLAN_11H_MAX_SUBBANDS 5
 
@@ -1276,40 +1374,6 @@ typedef MLAN_PACK_START struct {
 
 } MLAN_PACK_END IEEEtypes_SupportedChannels_t;
 
-/** default channel switch count */
-#define DEF_CHAN_SWITCH_COUNT 5
-
-/*  IEEE Channel Switch Announcement Element (7.3.2.20) */
-/**
- *  Provided in beacons and probe responses.  Used to advertise when
- *    and to which channel it is changing to.  Only starting STAs in
- *    an IBSS and APs are allowed to originate a chan switch element.
- */
-typedef MLAN_PACK_START struct {
-	t_u8 element_id; /**< IEEE Element ID = 37 */
-	t_u8 len; /**< Element length after id and len */
-	t_u8 chan_switch_mode; /**< STA should not transmit any frames if 1 */
-	t_u8 new_channel_num; /**< Channel # that AP/IBSS is moving to */
-	t_u8 chan_switch_count; /**< # of TBTTs before channel switch */
-
-} MLAN_PACK_END IEEEtypes_ChanSwitchAnn_t;
-
-/** data structure for extended channel switch */
-typedef MLAN_PACK_START struct {
-	/** IEEE element ID = 60 */
-	t_u8 element_id;
-	/** Element length after id and len, set to 4 */
-	t_u8 len;
-	/** STA should not transmit any frames if 1 */
-	t_u8 chan_switch_mode;
-	/** Operate class # that AP/IBSS is moving to */
-	t_u8 new_oper_class;
-	/** Channel # that AP/IBSS is moving to */
-	t_u8 new_channel_num;
-	/** of TBTTs before channel switch */
-	t_u8 chan_switch_count;
-} MLAN_PACK_END IEEEtypes_ExtChanSwitchAnn_t;
-
 /*  IEEE Wide Bandwidth Channel Switch Element */
 /**
  *  Provided in beacons and probe responses.  Used to advertise when
@@ -1444,6 +1508,50 @@ typedef struct {
 
 } wlan_11h_bss_info_t;
 
+/** Ethernet packet type for TDLS */
+#define MLAN_ETHER_PKT_TYPE_TDLS_ACTION (0x890D)
+
+/*802.11z  TDLS action frame type and strcuct */
+typedef MLAN_PACK_START struct {
+	/*link indentifier ie =101*/
+	t_u8 element_id;
+	/*len = 18*/
+	t_u8 len;
+	/** bssid */
+	t_u8 bssid[MLAN_MAC_ADDR_LENGTH];
+	/** init sta mac address */
+	t_u8 init_sta[MLAN_MAC_ADDR_LENGTH];
+	/** resp sta mac address */
+	t_u8 resp_sta[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END IEEEtypes_tdls_linkie;
+
+/** action code for tdls setup request */
+#define TDLS_SETUP_REQUEST 0
+/** action code for tdls setup response */
+#define TDLS_SETUP_RESPONSE 1
+/** action code for tdls setup confirm */
+#define TDLS_SETUP_CONFIRM 2
+/** action code for tdls tear down */
+#define TDLS_TEARDOWN 3
+/** action code for tdls traffic indication */
+#define TDLS_PEER_TRAFFIC_INDICATION 4
+/** action code for tdls channel switch request */
+#define TDLS_CHANNEL_SWITCH_REQUEST 5
+/** action code for tdls channel switch response */
+#define TDLS_CHANNEL_SWITCH_RESPONSE 6
+/** action code for tdls psm request */
+#define TDLS_PEER_PSM_REQUEST 7
+/** action code for tdls psm response */
+#define TDLS_PEER_PSM_RESPONSE 8
+/** action code for tdls traffic response */
+#define TDLS_PEER_TRAFFIC_RESPONSE 9
+/** action code for tdls discovery request */
+#define TDLS_DISCOVERY_REQUEST 10
+/** action code for TDLS discovery response */
+#define TDLS_DISCOVERY_RESPONSE 14
+/** category public */
+#define CATEGORY_PUBLIC 4
+
 /** action code for 20/40 BSS Coexsitence Management frame */
 #define BSS_20_40_COEX 0
 
@@ -1799,6 +1907,10 @@ typedef struct _BSSDescriptor_t {
 	IEEEtypes_HTInfo_t *pht_info;
 	/** HT Information Offset */
 	t_u16 ht_info_offset;
+	/** Flag to indicate this is multi_bssid_ap */
+	t_u8 multi_bssid_ap;
+	/** the mac address of multi-bssid AP */
+	mlan_802_11_mac_addr multi_bssid_ap_addr;
 	/** 20/40 BSS Coexistence IE */
 	IEEEtypes_2040BSSCo_t *pbss_co_2040;
 	/** 20/40 BSS Coexistence Offset */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
index 1f03bdc..29a8c02 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
@@ -3,7 +3,7 @@
  *  @brief This file declares the IOCTL data structures and APIs.
  *
  *
- *  Copyright 2008-2020 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -198,6 +198,7 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_11N_CFG_DELBA = 0x000C000C,
 	MLAN_OID_11N_CFG_REJECT_ADDBA_REQ = 0x000C000D,
 	MLAN_OID_11N_CFG_COEX_RX_WINSIZE = 0x000C000E,
+	MLAN_OID_11N_CFG_TX_AGGR_CTRL = 0x000C000F,
 	MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM = 0x000C0010,
 	MLAN_OID_11N_CFG_MIN_BA_THRESHOLD = 0x000C0011,
 
@@ -257,6 +258,7 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_MISC_ASSOC_RSP = 0x0020000C,
 	MLAN_OID_MISC_INIT_SHUTDOWN = 0x0020000D,
 	MLAN_OID_MISC_CUSTOM_IE = 0x0020000F,
+	MLAN_OID_MISC_TDLS_CONFIG = 0x00200010,
 	MLAN_OID_MISC_TX_DATAPAUSE = 0x00200012,
 	MLAN_OID_MISC_IP_ADDR = 0x00200013,
 	MLAN_OID_MISC_MAC_CONTROL = 0x00200014,
@@ -284,13 +286,17 @@ enum _mlan_ioctl_req_id {
 #ifdef WIFI_DIRECT_SUPPORT
 	MLAN_OID_MISC_WIFI_DIRECT_CONFIG = 0x00200025,
 #endif
+	MLAN_OID_MISC_TDLS_OPER = 0x00200026,
+	MLAN_OID_MISC_GET_TDLS_IES = 0x00200027,
 	MLAN_OID_MISC_LOW_PWR_MODE = 0x00200029,
 	MLAN_OID_MISC_MEF_FLT_CFG = 0x0020002A,
 	MLAN_OID_MISC_DFS_REAPTER_MODE = 0x0020002B,
 #ifdef RX_PACKET_COALESCE
 	MLAN_OID_MISC_RX_PACKET_COALESCE = 0x0020002C,
 #endif
+	MLAN_OID_MISC_TDLS_CS_CHANNEL = 0x0020002D,
 	MLAN_OID_MISC_COALESCE_CFG = 0x0020002E,
+	MLAN_OID_MISC_TDLS_IDLE_TIME = 0x0020002F,
 	MLAN_OID_MISC_GET_SENSOR_TEMP = 0x00200030,
 	MLAN_OID_MISC_GTK_REKEY_OFFLOAD = 0x00200037,
 	MLAN_OID_MISC_OPER_CLASS = 0x00200038,
@@ -332,6 +338,8 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_MISC_RANGE_EXT = 0x0020007B,
 	MLAN_OID_MISC_DOT11MC_UNASSOC_FTM_CFG = 0x0020007C,
 	MLAN_OID_MISC_TP_STATE = 0x0020007D,
+	MLAN_OID_MISC_HAL_PHY_CFG = 0x0020007E,
+	MLAN_OID_MISC_RF_TEST_HE_POWER = 0X0020007F,
 };
 
 /** Sub command size */
@@ -1618,6 +1626,14 @@ typedef struct _mlan_ds_get_stats {
 	t_u32 channel_number;
 	/** Channel Switch Mode */
 	t_u32 channel_switch_mode;
+	/** Reset Rx Mac Count */
+	t_u32 rx_reset_mac_recovery_cnt;
+	/** ISR2 Not Done Count*/
+	t_u32 rx_Isr2_NotDone_Cnt;
+	/** GDMA Abort Count */
+	t_u32 gdma_abort_cnt;
+	/** Rx Reset MAC Count */
+	t_u32 g_reset_rx_mac_cnt;
 } mlan_ds_get_stats, *pmlan_ds_get_stats;
 
 /** Type definition of mlan_ds_uap_stats for MLAN_OID_GET_STATS */
@@ -2087,13 +2103,27 @@ typedef struct {
 #define SDIO_MP_DBG_NUM 10
 #endif
 
-#ifdef PCIE
-#define MLAN_MAX_TXRX_BD 0x20
-#endif
-
 /** Maximum size of IEEE Information Elements */
 #define IEEE_MAX_IE_SIZE 256
 
+/** support up to 8 TDLS peer */
+#define MLAN_MAX_TDLS_PEER_SUPPORTED 8
+/** TDLS peer info */
+typedef struct _tdls_peer_info {
+	/** station mac address */
+	t_u8 mac_addr[MLAN_MAC_ADDR_LENGTH];
+	/** SNR */
+	t_s8 snr;
+	/** Noise Floor */
+	t_s8 nf;
+	/** Extended Capabilities IE */
+	t_u8 ext_cap[IEEE_MAX_IE_SIZE];
+	/** HT Capabilities IE */
+	t_u8 ht_cap[IEEE_MAX_IE_SIZE];
+	/** VHT Capabilities IE */
+	t_u8 vht_cap[IEEE_MAX_IE_SIZE];
+} tdls_peer_info;
+
 /** max ralist num */
 #define MLAN_MAX_RALIST_NUM 8
 /** ralist info */
@@ -2132,6 +2162,10 @@ typedef struct _mlan_debug_info {
 	t_u32 rx_tbl_num;
 	/** Rx reorder table*/
 	rx_reorder_tbl rx_tbl[MLAN_MAX_RX_BASTREAM_SUPPORTED];
+	/** TDLS peer number */
+	t_u32 tdls_peer_num;
+	/** TDLS peer list*/
+	tdls_peer_info tdls_peer_list[MLAN_MAX_TDLS_PEER_SUPPORTED];
 	/** ralist num */
 	t_u32 ralist_num;
 	/** ralist info */
@@ -2281,6 +2315,8 @@ typedef struct _mlan_debug_info {
 	t_u32 dnld_cmd_in_secs;
 	/** Corresponds to data_sent member of mlan_adapter */
 	t_u8 data_sent;
+	/** Corresponds to data_sent_cnt member of mlan_adapter */
+	t_u32 data_sent_cnt;
 	/** Corresponds to cmd_sent member of mlan_adapter */
 	t_u8 cmd_sent;
 	/** SDIO multiple port read bitmap */
@@ -2304,8 +2340,8 @@ typedef struct _mlan_debug_info {
 	t_u32 eventbd_rdptr;
 	/** PCIE eventbd write pointer */
 	t_u32 eventbd_wrptr;
-	/** Last pkt size in transmit */
-	t_u32 last_tx_pkt_size[MLAN_MAX_TXRX_BD];
+	/** txrx_bd_size */
+	t_u16 txrx_bd_size;
 	/** txbd ring vbase */
 	t_u8 *txbd_ring_vbase;
 	/** txbd ring size */
@@ -2350,7 +2386,7 @@ typedef struct _mlan_debug_info {
 #define MAX_NUM_CLIENTS MAX_STA_COUNT
 
 /** station info */
-typedef struct _sta_info {
+typedef struct _sta_info_data {
 	/** STA MAC address */
 	t_u8 mac_address[MLAN_MAC_ADDR_LENGTH];
 	/** Power mgmt status */
@@ -2365,14 +2401,14 @@ typedef struct _sta_info {
 	t_u16 ie_len;
 	/** ie buffer */
 	t_u8 ie_buf[];
-} sta_info;
+} sta_info_data;
 
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
 typedef struct _mlan_ds_sta_list {
 	/** station count */
 	t_u16 sta_count;
 	/** station list */
-	sta_info info[MAX_NUM_CLIENTS];
+	sta_info_data info[MAX_NUM_CLIENTS];
 } mlan_ds_sta_list, *pmlan_ds_sta_list;
 #endif
 
@@ -3681,6 +3717,8 @@ typedef struct _mlan_ds_11n_cfg {
 		mlan_ds_reject_addba_req reject_addba_req;
 		/** Control coex RX window size configuration */
 		t_u32 coex_rx_winsize;
+		/** Control TX AMPDU configuration */
+		t_u32 txaggrctrl;
 		/** aggrprirotity table for MLAN_OID_11N_CFG_IBSS_AMPDU_PARAM */
 		mlan_ds_ibss_ampdu_param ibss_ampdu;
 		/** Minimum BA Threshold for MLAN_OID_11N_CFG_MIN_BA_THRESHOLD
@@ -4519,7 +4557,7 @@ typedef struct _mlan_ds_misc_otp_user_data {
 	t_u8 user_data[MAX_OTP_USER_DATA_LEN];
 } mlan_ds_misc_otp_user_data;
 
-typedef struct _aggr_ctrl {
+typedef struct _aggr_ctrl_cfg {
 	/** Enable */
 	t_u16 enable;
 	/** Aggregation alignment */
@@ -4530,18 +4568,18 @@ typedef struct _aggr_ctrl {
 	t_u16 aggr_max_num;
 	/** Aggrgation timeout, in microseconds */
 	t_u16 aggr_tmo;
-} aggr_ctrl;
+} aggr_ctrl_cfg;
 
 /** Type definition of mlan_ds_misc_aggr_ctrl
  *  for MLAN_OID_MISC_AGGR_CTRL
  */
 typedef struct _mlan_ds_misc_aggr_ctrl {
 	/** Tx aggregation control */
-	aggr_ctrl tx;
+	aggr_ctrl_cfg tx;
 } mlan_ds_misc_aggr_ctrl;
 
 #ifdef USB
-typedef struct _usb_aggr_ctrl {
+typedef struct _usb_aggr_ctrl_cfg {
 	/** Enable */
 	t_u16 enable;
 	/** Aggregation mode */
@@ -4552,16 +4590,16 @@ typedef struct _usb_aggr_ctrl {
 	t_u16 aggr_max;
 	/** Aggrgation timeout, in microseconds */
 	t_u16 aggr_tmo;
-} usb_aggr_ctrl;
+} usb_aggr_ctrl_cfg;
 
 /** Type definition of mlan_ds_misc_usb_aggr_ctrl
  *  for MLAN_OID_MISC_USB_AGGR_CTRL
  */
 typedef struct _mlan_ds_misc_usb_aggr_ctrl {
 	/** Tx aggregation control */
-	usb_aggr_ctrl tx_aggr_ctrl;
+	usb_aggr_ctrl_cfg tx_aggr_ctrl;
 	/** Rx deaggregation control */
-	usb_aggr_ctrl rx_deaggr_ctrl;
+	usb_aggr_ctrl_cfg rx_deaggr_ctrl;
 } mlan_ds_misc_usb_aggr_ctrl;
 #endif
 
@@ -4605,6 +4643,85 @@ typedef struct _mlan_ds_misc_pmfcfg {
 #define MAX_SSID_NUM 16
 #define MAX_AP_LIST 8
 
+/**Action ID for TDLS disable link*/
+#define WLAN_TDLS_DISABLE_LINK 0x00
+/**Action ID for TDLS enable link*/
+#define WLAN_TDLS_ENABLE_LINK 0x01
+/**Action ID for TDLS create link*/
+#define WLAN_TDLS_CREATE_LINK 0x02
+/**Action ID for TDLS config link*/
+#define WLAN_TDLS_CONFIG_LINK 0x03
+/*reason code*/
+#define MLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED 26
+/** TDLS operation buffer */
+typedef struct _mlan_ds_misc_tdls_oper {
+	/** TDLS Action */
+	t_u16 tdls_action;
+	/** TDLS peer address */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+	/** peer capability */
+	t_u16 capability;
+	/** peer qos info */
+	t_u8 qos_info;
+	/** peer extend capability */
+	t_u8 *ext_capab;
+	/** extend capability len */
+	t_u8 ext_capab_len;
+	/** support rates */
+	t_u8 *supported_rates;
+	/** supported rates len */
+	t_u8 supported_rates_len;
+	/** peer ht_cap */
+	t_u8 *ht_capa;
+	/** peer vht capability */
+	t_u8 *vht_cap;
+} mlan_ds_misc_tdls_oper;
+
+/** flag for TDLS extcap */
+#define TDLS_IE_FLAGS_EXTCAP 0x0001
+/** flag for TDLS HTCAP */
+#define TDLS_IE_FLAGS_HTCAP 0x0002
+/** flag for TDLS HTINFO */
+#define TDLS_IE_FLAGS_HTINFO 0x0004
+/** flag for TDLS VHTCAP */
+#define TDLS_IE_FLAGS_VHTCAP 0x0008
+/** flag for TDLS VHTOPRAT */
+#define TDLS_IE_FLAGS_VHTOPRAT 0x0010
+/** flag for TDLS AID inof */
+#define TDLS_IE_FLAGS_AID 0x0020
+/** flag for TDLS Supported channels and regulatory class IE*/
+#define TDLS_IE_FLAGS_SUPP_CS_IE 0x0040
+/** flag for TDLS Qos info */
+#define TDLS_IE_FLAGS_QOS_INFO 0x0080
+/** flag for TDLS SETUP */
+#define TDLS_IE_FLAGS_SETUP 0x0100
+
+/** TDLS ie buffer */
+typedef struct _mlan_ds_misc_tdls_ies {
+	/** TDLS peer address */
+	t_u8 peer_mac[MLAN_MAC_ADDR_LENGTH];
+	/** flags for request IEs */
+	t_u16 flags;
+	/** Qos info */
+	t_u8 QosInfo;
+	/** Extended Capabilities IE */
+	t_u8 ext_cap[IEEE_MAX_IE_SIZE];
+	/** HT Capabilities IE */
+	t_u8 ht_cap[IEEE_MAX_IE_SIZE];
+	/** HT Information IE */
+	t_u8 ht_info[IEEE_MAX_IE_SIZE];
+	/** VHT Capabilities IE */
+	t_u8 vht_cap[IEEE_MAX_IE_SIZE];
+	/** VHT Operations IE */
+	t_u8 vht_oprat[IEEE_MAX_IE_SIZE];
+	/** aid Info */
+	t_u8 aid_info[IEEE_MAX_IE_SIZE];
+	/** supported channels */
+	t_u8 supp_chan[IEEE_MAX_IE_SIZE];
+	/** supported regulatory class */
+	t_u8 regulatory_class[IEEE_MAX_IE_SIZE];
+} mlan_ds_misc_tdls_ies;
+
 #ifdef RX_PACKET_COALESCE
 typedef struct _mlan_ds_misc_rx_packet_coalesce {
 	/** packet threshold */
@@ -4855,6 +4972,13 @@ typedef struct _mlan_ds_ssu_params {
 } mlan_ds_ssu_params;
 #endif
 
+typedef MLAN_PACK_START struct _mlan_ds_hal_phy_cfg_params {
+	/** 11b pwr spectral density mask enable/disable */
+	t_u8 dot11b_psd_mask_cfg;
+	/** reserved fields for future hal/phy cfg use */
+	t_u8 reserved[7];
+} MLAN_PACK_END mlan_ds_hal_phy_cfg_params;
+
 #define MAX_NUM_MAC 2
 /** Type definition of mlan_ds_misc_mapping_policy */
 typedef struct _mlan_ds_misc_mapping_policy {
@@ -4914,6 +5038,8 @@ typedef struct _mlan_ds_misc_chan_trpc_cfg {
 #define MFG_CMD_RFPWR 0x1033
 #define MFG_CMD_RF_BAND_AG 0x1034
 #define MFG_CMD_RF_CHANNELBW 0x1044
+#define MFG_CMD_RADIO_MODE_CFG 0x1211
+#define MFG_CMD_CONFIG_MAC_HE_TB_TX 0x110A
 /** MFG CMD generic cfg */
 struct MLAN_PACK_START mfg_cmd_generic_cfg {
 	/** MFG command code */
@@ -4972,6 +5098,21 @@ struct MLAN_PACK_START mfg_cmd_tx_frame2 {
 	t_u32 stbc;
 	/** power id */
 	t_u32 rsvd[2];
+	/** NumPkt */
+	t_u32 NumPkt;
+	/** MaxPE */
+	t_u32 MaxPE;
+	/** BeamChange */
+	t_u32 BeamChange;
+	/** Dcm */
+	t_u32 Dcm;
+	/** Doppler */
+	t_u32 Doppler;
+	/** MidP */
+	t_u32 MidP;
+	/** QNum */
+	t_u32 QNum;
+
 } MLAN_PACK_END;
 
 /* MFG CMD Tx Continuous */
@@ -5000,6 +5141,27 @@ struct MLAN_PACK_START mfg_cmd_tx_cont {
 	t_u32 rsvd;
 } MLAN_PACK_END;
 
+struct MLAN_PACK_START mfg_Cmd_HE_TBTx_t {
+	/** MFG command code */
+	t_u32 mfg_cmd;
+	/** Action */
+	t_u16 action;
+	/** Device ID */
+	t_u16 device_id;
+	/** MFG Error code */
+	t_u32 error;
+	/** Enable Tx */
+	t_u16 enable;
+	/** Q num */
+	t_u16 qnum;
+	/** AID */
+	t_u16 aid;
+	/** AXQ Mu Timer */
+	t_u16 axq_mu_timer;
+	/** Tx Power */
+	t_u16 tx_power;
+} MLAN_PACK_END;
+
 typedef struct _mlan_ds_misc_chnrgpwr_cfg {
 	/** length */
 	t_u16 length;
@@ -5043,8 +5205,17 @@ typedef struct _mlan_ds_misc_cfg {
 		t_u32 func_init_shutdown;
 		/** Custom IE for MLAN_OID_MISC_CUSTOM_IE */
 		mlan_ds_misc_custom_ie cust_ie;
+		t_u16 tdls_idle_time;
 		/** Config dynamic bandwidth*/
 		t_u16 dyn_bw;
+		/** TDLS configuration for MLAN_OID_MISC_TDLS_CONFIG */
+		mlan_ds_misc_tdls_config tdls_config;
+		/** TDLS operation for MLAN_OID_MISC_TDLS_OPER */
+		mlan_ds_misc_tdls_oper tdls_oper;
+		/** TDLS ies for  MLAN_OID_MISC_GET_TDLS_IES */
+		mlan_ds_misc_tdls_ies tdls_ies;
+		/**tdls cs off channel*/
+		t_u8 tdls_cs_channel;
 		/** Tx data pause for MLAN_OID_MISC_TX_DATAPAUSE */
 		mlan_ds_misc_tx_datapause tx_datapause;
 		/** IP address configuration */
@@ -5131,11 +5302,13 @@ typedef struct _mlan_ds_misc_cfg {
 		struct mfg_cmd_generic_cfg mfg_generic_cfg;
 		struct mfg_cmd_tx_cont mfg_tx_cont;
 		struct mfg_cmd_tx_frame2 mfg_tx_frame2;
+		struct mfg_Cmd_HE_TBTx_t mfg_he_power;
 		mlan_ds_misc_arb_cfg arb_cfg;
 		mlan_ds_misc_cfp_tbl cfp;
 		t_u8 range_ext_mode;
 		mlan_ds_misc_dot11mc_unassoc_ftm_cfg dot11mc_unassoc_ftm_cfg;
 		mlan_ds_misc_tp_state tp_state;
+		mlan_ds_hal_phy_cfg_params hal_phy_cfg_params;
 	} param;
 } mlan_ds_misc_cfg, *pmlan_ds_misc_cfg;
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
index 118b3bc..6508519 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
@@ -3,7 +3,7 @@
  * @brief This file contains the functions for CFG80211.
  *
  *
- * Copyright 2011-2020 NXP
+ * Copyright 2011-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -1265,9 +1265,9 @@ int woal_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 		LEAVE();
 		return -EFAULT;
 	}
-	if (rts_thr == MLAN_FRAG_RTS_DISABLED)
+	if (rts_thr == (int)MLAN_FRAG_RTS_DISABLED)
 		rts_thr = MLAN_RTS_MAX_VALUE;
-	if (frag_thr == MLAN_FRAG_RTS_DISABLED)
+	if (frag_thr == (int)MLAN_FRAG_RTS_DISABLED)
 		frag_thr = MLAN_FRAG_MAX_VALUE;
 
 #ifdef UAP_CFG80211
@@ -1980,8 +1980,8 @@ static int woal_fill_coalesce_rule_info(struct cfg80211_coalesce_rules *crule,
  *
  *  @return                 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_set_coalesce(moal_private *priv, t_u16 action,
-			      mlan_ds_coalesce_cfg *coalesce_cfg)
+static mlan_status woal_set_coalesce(moal_private *priv, t_u16 action,
+				     mlan_ds_coalesce_cfg *coalesce_cfg)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_misc_cfg *misc_cfg = NULL;
@@ -2301,7 +2301,6 @@ done:
  */
 void woal_mgmt_frame_register(moal_private *priv, u16 frame_type, bool reg)
 {
-	mlan_status status = MLAN_STATUS_SUCCESS;
 	t_u32 mgmt_subtype_mask = 0x0;
 	t_u32 last_mgmt_subtype_mask = priv->mgmt_subtype_mask;
 
@@ -2333,8 +2332,8 @@ void woal_mgmt_frame_register(moal_private *priv, u16 frame_type, bool reg)
 		 * Note that this callback may not sleep, and cannot run
 		 * concurrently with itself.
 		 */
-		status = woal_reg_rx_mgmt_ind(priv, MLAN_ACT_SET,
-					      &mgmt_subtype_mask, MOAL_NO_WAIT);
+		woal_reg_rx_mgmt_ind(priv, MLAN_ACT_SET, &mgmt_subtype_mask,
+				     MOAL_NO_WAIT);
 		priv->mgmt_subtype_mask = last_mgmt_subtype_mask;
 	}
 
@@ -2390,8 +2389,12 @@ void woal_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
 	     */
 	    && !moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
 		upd->interface_stypes &= ~BIT(IEEE80211_STYPE_AUTH >> 4);
-	woal_reg_rx_mgmt_ind(priv, MLAN_ACT_SET, &upd->interface_stypes,
-			     MOAL_NO_WAIT);
+
+	if (priv->mgmt_subtype_mask != upd->interface_stypes) {
+		priv->mgmt_subtype_mask = upd->interface_stypes;
+		woal_reg_rx_mgmt_ind(priv, MLAN_ACT_SET, &upd->interface_stypes,
+				     MOAL_NO_WAIT);
+	}
 #else
 	if (frame_type == IEEE80211_STYPE_AUTH
 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
@@ -2903,7 +2906,7 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 {
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
-	mlan_ds_misc_custom_ie *custom_ie = NULL;
+	mlan_ds_misc_custom_ie *pcustom_ie = NULL;
 	t_u8 *pos = NULL;
 	t_u16 len = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -2911,17 +2914,17 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 
 	ENTER();
 
-	custom_ie = kzalloc(sizeof(mlan_ds_misc_custom_ie), GFP_KERNEL);
-	if (!custom_ie) {
+	pcustom_ie = kzalloc(sizeof(mlan_ds_misc_custom_ie), GFP_KERNEL);
+	if (!pcustom_ie) {
 		PRINTM(MERROR, "Fail to allocate custome_ie\n");
 		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
-	custom_ie->type = TLV_TYPE_MGMT_IE;
+	pcustom_ie->type = TLV_TYPE_MGMT_IE;
 
-	pos = (t_u8 *)custom_ie->ie_data_list;
-	remain_len = sizeof(custom_ie->ie_data_list);
+	pos = (t_u8 *)pcustom_ie->ie_data_list;
+	remain_len = sizeof(pcustom_ie->ie_data_list);
 	if (beacon_ies_data) {
 		len = sizeof(*beacon_ies_data) - MAX_IE_SIZE +
 		      beacon_ies_data->ie_length;
@@ -2929,7 +2932,7 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 				remain_len);
 		pos += len;
 		remain_len -= len;
-		custom_ie->len += len;
+		pcustom_ie->len += len;
 	}
 
 	if (proberesp_ies_data) {
@@ -2939,7 +2942,7 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 				remain_len);
 		pos += len;
 		remain_len -= len;
-		custom_ie->len += len;
+		pcustom_ie->len += len;
 	}
 
 	if (assocresp_ies_data) {
@@ -2949,7 +2952,7 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 				remain_len);
 		pos += len;
 		remain_len -= len;
-		custom_ie->len += len;
+		pcustom_ie->len += len;
 	}
 
 	if (probereq_ies_data) {
@@ -2959,7 +2962,7 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 				remain_len);
 		pos += len;
 		remain_len -= len;
-		custom_ie->len += len;
+		pcustom_ie->len += len;
 	}
 	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (ioctl_req == NULL) {
@@ -2973,7 +2976,7 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
 	ioctl_req->action = MLAN_ACT_SET;
 
-	moal_memcpy_ext(priv->phandle, &misc->param.cust_ie, custom_ie,
+	moal_memcpy_ext(priv->phandle, &misc->param.cust_ie, pcustom_ie,
 			sizeof(mlan_ds_misc_custom_ie),
 			sizeof(mlan_ds_misc_custom_ie));
 
@@ -3024,7 +3027,7 @@ woal_cfg80211_custom_ie(moal_private *priv, custom_ie *beacon_ies_data,
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(ioctl_req);
-	kfree(custom_ie);
+	kfree(pcustom_ie);
 	LEAVE();
 	return status;
 }
@@ -3173,7 +3176,7 @@ static t_u16 woal_get_specific_ie(const t_u8 *ie, int len, t_u8 *ie_out,
 					   wps_oui[3]) {
 				if (mask & IE_MASK_WPS) {
 					if ((out_len + length + 2) <
-					    ie_out_len) {
+					    (int)ie_out_len) {
 						moal_memcpy_ext(
 							NULL, ie_out + out_len,
 							pos, length + 2,
@@ -3191,7 +3194,7 @@ static t_u16 woal_get_specific_ie(const t_u8 *ie, int len, t_u8 *ie_out,
 					   wfd_oui[3]) {
 				if (mask & IE_MASK_WFD) {
 					if ((out_len + length + 2) <
-					    ie_out_len) {
+					    (int)ie_out_len) {
 						moal_memcpy_ext(
 							NULL, ie_out + out_len,
 							pos, length + 2,
@@ -3204,7 +3207,7 @@ static t_u16 woal_get_specific_ie(const t_u8 *ie, int len, t_u8 *ie_out,
 					}
 				}
 			} else if (mask & IE_MASK_VENDOR) {
-				if ((out_len + length + 2) < ie_out_len) {
+				if ((out_len + length + 2) < (int)ie_out_len) {
 					moal_memcpy_ext(NULL, ie_out + out_len,
 							pos, length + 2,
 							ie_out_len - out_len);
@@ -3239,11 +3242,9 @@ static t_u8 woal_find_ie(const t_u8 *ie, int len, const t_u8 *spec_ie,
 	int left_len = len;
 	const t_u8 *pos = ie;
 	int length;
-	t_u8 id = 0;
 
 	while (left_len >= 2) {
 		length = *(pos + 1);
-		id = *pos;
 		if ((length + 2) > left_len)
 			break;
 		if ((length + 2) == spec_len) {
@@ -3308,7 +3309,7 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 		switch (id) {
 		case COUNTRY_INFO:
 			enable_11d = MTRUE;
-			if ((out_len + length + 2) < ie_out_len) {
+			if ((out_len + length + 2) < (int)ie_out_len) {
 				moal_memcpy_ext(priv->phandle, ie_out + out_len,
 						pos, length + 2,
 						ie_out_len - out_len);
@@ -3323,7 +3324,7 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 		case VHT_CAPABILITY:
 		case VHT_OPERATION:
 			if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME)) {
-				if ((out_len + length + 2) < ie_out_len) {
+				if ((out_len + length + 2) < (int)ie_out_len) {
 					moal_memcpy_ext(priv->phandle,
 							ie_out + out_len, pos,
 							length + 2,
@@ -3351,7 +3352,7 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 			    !moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
 				break;
 			else {
-				if ((out_len + length + 2) < ie_out_len) {
+				if ((out_len + length + 2) < (int)ie_out_len) {
 					moal_memcpy_ext(priv->phandle,
 							ie_out + out_len, pos,
 							length + 2,
@@ -3375,7 +3376,7 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 					       "Fail to set EXTCAP IE\n");
 				break;
 			}
-			if ((out_len + length + 2) < ie_out_len) {
+			if ((out_len + length + 2) < (int)ie_out_len) {
 				moal_memcpy_ext(priv->phandle, ie_out + out_len,
 						pos, length + 2,
 						ie_out_len - out_len);
@@ -3419,7 +3420,7 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 				// filter out vendor IE
 				break;
 			}
-			if ((out_len + length + 2) < ie_out_len) {
+			if ((out_len + length + 2) < (int)ie_out_len) {
 				moal_memcpy_ext(priv->phandle, ie_out + out_len,
 						pos, length + 2,
 						ie_out_len - out_len);
@@ -3430,7 +3431,7 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 			}
 			break;
 		default:
-			if ((out_len + length + 2) < ie_out_len) {
+			if ((out_len + length + 2) < (int)ie_out_len) {
 				moal_memcpy_ext(priv->phandle, ie_out + out_len,
 						pos, length + 2,
 						ie_out_len - out_len);
@@ -3459,7 +3460,7 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
  *
  * @return                MTRUE/MFALSE
  */
-t_u8 is_selected_registrar_on(const t_u8 *ie, int len)
+static t_u8 is_selected_registrar_on(const t_u8 *ie, int len)
 {
 #define WPS_IE_FIX_LEN 6
 #define TLV_ID_SELECTED_REGISTRAR 0x1041
@@ -3469,7 +3470,7 @@ t_u8 is_selected_registrar_on(const t_u8 *ie, int len)
 	u16 tlv_type, tlv_len;
 	u8 *pos = NULL;
 
-	while (left_len > sizeof(TLV_Generic_t)) {
+	while (left_len > (int)sizeof(TLV_Generic_t)) {
 		tlv_type = ntohs(tlv->type);
 		tlv_len = ntohs(tlv->len);
 		if (tlv_type == TLV_ID_SELECTED_REGISTRAR) {
@@ -4212,8 +4213,8 @@ Bit75: 0x1 (Rx 1024-QAM Support < 242-tone RU)
 #define UAP_HE_MAC_CAP0_MASK 0x00
 #define UAP_HE_MAC_CAP1_MASK 0x00
 #define UAP_HE_MAC_CAP2_MASK 0x00
-#define UAP_HE_MAC_CAP3_MASK 0x00
-#define UAP_HE_MAC_CAP4_MASK 0x02
+#define UAP_HE_MAC_CAP3_MASK 0x02
+#define UAP_HE_MAC_CAP4_MASK 0x00
 #define UAP_HE_MAC_CAP5_MASK 0x00
 #define UAP_HE_PHY_CAP0_MASK 0x04
 #define UAP_HE_PHY_CAP1_MASK 0x23
@@ -4260,8 +4261,8 @@ Bit75: 0x1 (Rx 1024-QAM Support < 242-tone RU)
 #define UAP_HE_2G_MAC_CAP0_MASK 0x00
 #define UAP_HE_2G_MAC_CAP1_MASK 0x00
 #define UAP_HE_2G_MAC_CAP2_MASK 0x00
-#define UAP_HE_2G_MAC_CAP3_MASK 0x00
-#define UAP_HE_2G_MAC_CAP4_MASK 0x02
+#define UAP_HE_2G_MAC_CAP3_MASK 0x02
+#define UAP_HE_2G_MAC_CAP4_MASK 0x00
 #define UAP_HE_2G_MAC_CAP5_MASK 0x00
 #define UAP_HE_2G_PHY_CAP0_MASK 0x04
 #define UAP_HE_2G_PHY_CAP1_MASK 0x20
@@ -4615,6 +4616,67 @@ void woal_cfg80211_notify_channel(moal_private *priv,
 }
 #endif
 
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+/**
+ * @brief Notify cfg80211 supplicant ant cfg changed
+ *
+ * @param priv          A pointer moal_private structure
+ * @param wiphy         A pointer structure wiphy
+ * @param radio         A pointer to radio cfg structure
+ *
+ * @return              N/A
+ */
+void woal_cfg80211_notify_antcfg(moal_private *priv, struct wiphy *wiphy,
+				 mlan_ds_radio_cfg *radio)
+{
+	if (IS_STA_OR_UAP_CFG80211(priv->phandle->params.cfg80211_wext) &&
+	    wiphy) {
+		if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
+			if (((radio->param.ant_cfg.tx_antenna & 0xFF) != 3 &&
+			     (radio->param.ant_cfg.tx_antenna & 0xFF) != 0) ||
+			    ((radio->param.ant_cfg.rx_antenna & 0xFF) != 3 &&
+			     (radio->param.ant_cfg.rx_antenna & 0xFF) != 0))
+				wiphy->bands[IEEE80211_BAND_2GHZ]
+					->ht_cap.mcs.rx_mask[1] = 0;
+			else if ((radio->param.ant_cfg.tx_antenna & 0xFF) ==
+					 3 ||
+				 (radio->param.ant_cfg.rx_antenna & 0xFF) == 3)
+				wiphy->bands[IEEE80211_BAND_2GHZ]
+					->ht_cap.mcs.rx_mask[1] = 0xff;
+
+			wiphy->bands[IEEE80211_BAND_2GHZ]
+				->ht_cap.mcs.rx_mask[4] = 0;
+		}
+
+		if (wiphy->bands[IEEE80211_BAND_5GHZ]) {
+			if (((radio->param.ant_cfg.tx_antenna & 0xFF00) !=
+				     0x300 &&
+			     (radio->param.ant_cfg.tx_antenna & 0xFF00) != 0) ||
+			    ((radio->param.ant_cfg.rx_antenna & 0xFF00) !=
+				     0x300 &&
+			     (radio->param.ant_cfg.rx_antenna & 0xFF00) != 0)) {
+				wiphy->bands[IEEE80211_BAND_5GHZ]
+					->ht_cap.mcs.rx_mask[1] = 0;
+				wiphy->bands[IEEE80211_BAND_5GHZ]
+					->vht_cap.vht_mcs.rx_mcs_map = 0xfffe;
+				wiphy->bands[IEEE80211_BAND_5GHZ]
+					->vht_cap.vht_mcs.tx_mcs_map = 0xfffe;
+			} else if ((radio->param.ant_cfg.tx_antenna & 0xFF00) ==
+					   0x300 ||
+				   (radio->param.ant_cfg.rx_antenna & 0xFF00) ==
+					   0x300) {
+				wiphy->bands[IEEE80211_BAND_5GHZ]
+					->ht_cap.mcs.rx_mask[1] = 0xff;
+				wiphy->bands[IEEE80211_BAND_5GHZ]
+					->vht_cap.vht_mcs.rx_mcs_map = 0xfffa;
+				wiphy->bands[IEEE80211_BAND_5GHZ]
+					->vht_cap.vht_mcs.tx_mcs_map = 0xfffa;
+			}
+		}
+	}
+}
+#endif
+
 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
 /**
  * @brief create cfg80211_chan_def structure based on chan_band info
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
index 736d845..b6850ec 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
@@ -3,7 +3,7 @@
  * @brief This file contains the CFG80211 specific defines.
  *
  *
- * Copyright 2011-2020 NXP
+ * Copyright 2011-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -64,6 +64,16 @@
 
 #define MRVL_PKT_TYPE_MGMT_FRAME 0xE5
 
+mlan_status woal_cfg80211_set_key(moal_private *priv, t_u8 is_enable_wep,
+				  t_u32 cipher, const t_u8 *key, int key_len,
+				  const t_u8 *seq, int seq_len, t_u8 key_index,
+				  const t_u8 *addr, int disable,
+				  t_u8 wait_option);
+
+mlan_status woal_cfg80211_set_wep_keys(moal_private *priv, const t_u8 *key,
+				       int key_len, t_u8 index,
+				       t_u8 wait_option);
+
 /**
  * If multiple wiphys are registered e.g. a regular netdev with
  * assigned ieee80211_ptr and you won't know whether it points
@@ -299,6 +309,10 @@ int woal_cfg80211_del_virtual_intf(struct wiphy *wiphy,
 int woal_cfg80211_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev);
 #endif
 
+#if defined(WIFI_DIRECT_SUPPORT)
+void woal_remove_virtual_interface(moal_handle *handle);
+#endif
+
 #ifdef WIFI_DIRECT_SUPPORT
 /* Group Owner Negotiation Req */
 #define P2P_GO_NEG_REQ 0
@@ -338,9 +352,6 @@ int woal_cfg80211_init_p2p_client(moal_private *priv);
 int woal_cfg80211_init_p2p_go(moal_private *priv);
 
 int woal_cfg80211_deinit_p2p(moal_private *priv);
-
-void woal_remove_virtual_interface(moal_handle *handle);
-
 #endif /* KERNEL_VERSION */
 #endif /* WIFI_DIRECT_SUPPORT */
 
@@ -430,7 +441,7 @@ void woal_csa_work_queue(struct work_struct *work);
 #if defined(UAP_CFG80211) || defined(STA_CFG80211)
 #if KERNEL_VERSION(3, 5, 0) <= CFG80211_VERSION_CODE
 void woal_cfg80211_notify_channel(moal_private *priv,
-				  pchan_band_info pchan_info);
+				  chan_band_info *pchan_info);
 void woal_channel_switch_event(moal_private *priv, chan_band_info *pchan_info);
 #endif
 #endif
@@ -442,6 +453,12 @@ void woal_cfg80211_notify_sched_scan_stop(moal_private *priv);
 #endif
 #endif
 
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+
+void woal_cfg80211_notify_antcfg(moal_private *priv, struct wiphy *wiphy,
+				 mlan_ds_radio_cfg *radio);
+#endif
+
 void woal_deauth_event(moal_private *priv, int reason_code);
 
 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
index dc88ecc..2479b97 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
@@ -3,7 +3,7 @@
  * @brief This file contains the functions for CFG80211 vendor.
  *
  *
- * Copyright 2015-2020 NXP
+ * Copyright 2015-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -43,7 +43,7 @@
 /**nxp vendor command and event*/
 #define MRVL_VENDOR_ID 0x005043
 /** vendor events */
-const struct nl80211_vendor_cmd_info vendor_events[] = {
+static const struct nl80211_vendor_cmd_info vendor_events[] = {
 	{
 		.vendor_id = MRVL_VENDOR_ID,
 		.subcmd = event_hang,
@@ -143,11 +143,9 @@ static const struct nla_policy
 	woal_fw_roaming_policy[MRVL_WLAN_VENDOR_ATTR_FW_ROAMING_MAX + 1] = {
 		[MRVL_WLAN_VENDOR_ATTR_FW_ROAMING_CONTROL] = {.type = NLA_U32},
 		[MRVL_WLAN_VENDOR_ATTR_FW_ROAMING_CONFIG_BSSID] = {
-			.type = NLA_BINARY,
-			.len = sizeof(int)},
+			.type = NLA_BINARY},
 		[MRVL_WLAN_VENDOR_ATTR_FW_ROAMING_CONFIG_SSID] = {
-			.type = NLA_BINARY,
-			.len = sizeof(int)},
+			.type = NLA_BINARY},
 };
 // clang-format on
 
@@ -155,7 +153,7 @@ static const struct nla_policy
 	woal_keep_alive_policy[MKEEP_ALIVE_ATTRIBUTE_MAX + 1] = {
 		[MKEEP_ALIVE_ATTRIBUTE_ID] = {.type = NLA_U8},
 		[MKEEP_ALIVE_ATTRIBUTE_ETHER_TYPE] = {.type = NLA_U16},
-		[MKEEP_ALIVE_ATTRIBUTE_IP_PKT] = {.type = NLA_BINARY, .len = 1},
+		[MKEEP_ALIVE_ATTRIBUTE_IP_PKT] = {.type = NLA_BINARY},
 		[MKEEP_ALIVE_ATTRIBUTE_IP_PKT_LEN] = {.type = NLA_U16},
 		[MKEEP_ALIVE_ATTRIBUTE_SRC_MAC_ADDR] = {.type = NLA_STRING,
 							.len = ETH_ALEN},
@@ -174,12 +172,12 @@ static const struct nla_policy
  *
  * @return    index of events array
  */
-int woal_get_event_id(int event)
+static int woal_get_event_id(int event)
 {
 	int i = 0;
 
-	for (i = 0; i < ARRAY_SIZE(vendor_events); i++) {
-		if (vendor_events[i].subcmd == event)
+	for (i = 0; i < (int)ARRAY_SIZE(vendor_events); i++) {
+		if ((int)vendor_events[i].subcmd == event)
 			return i;
 	}
 
@@ -244,54 +242,6 @@ int woal_cfg80211_vendor_event(moal_private *priv, int event, t_u8 *data,
 	return ret;
 }
 
-/**
- * @brief send vendor event to kernel
- *
- * @param priv       A pointer to moal_private
- * @param event    vendor event
- * @param  len     data length
- *
- * @return      0: success  1: fail
- */
-struct sk_buff *woal_cfg80211_alloc_vendor_event(moal_private *priv, int event,
-						 int len)
-{
-	struct wiphy *wiphy = NULL;
-	struct sk_buff *skb = NULL;
-	int event_id = 0;
-
-	ENTER();
-
-	if (!priv || !priv->wdev || !priv->wdev->wiphy) {
-		PRINTM(MERROR, "Not find this event %d\n", event_id);
-		goto done;
-	}
-	wiphy = priv->wdev->wiphy;
-	PRINTM(MEVENT, "vendor event :0x%x\n", event);
-	event_id = woal_get_event_id(event);
-	if (event_max == event_id) {
-		PRINTM(MERROR, "Not find this event %d\n", event_id);
-		goto done;
-	}
-
-	/**allocate skb*/
-#if KERNEL_VERSION(4, 1, 0) <= CFG80211_VERSION_CODE
-	skb = cfg80211_vendor_event_alloc(wiphy, priv->wdev, len, event_id,
-					  GFP_ATOMIC);
-#else
-	skb = cfg80211_vendor_event_alloc(wiphy, len, event_id, GFP_ATOMIC);
-#endif
-
-	if (!skb) {
-		PRINTM(MERROR, "allocate memory fail for vendor event\n");
-		goto done;
-	}
-
-done:
-	LEAVE();
-	return skb;
-}
-
 /**
  * @brief send dfs vendor event to kernel
  *
@@ -854,7 +804,7 @@ static int woal_cfg80211_subcmd_set_country_code(struct wiphy *wiphy,
 		switch (type) {
 		case ATTR_COUNTRY_CODE:
 			strncpy(country, nla_data(iter),
-				MIN(sizeof(country) - 1, nla_len(iter)));
+				MIN((int)sizeof(country) - 1, nla_len(iter)));
 			break;
 		default:
 			PRINTM(MERROR, "Unknown type: %d\n", type);
@@ -3835,7 +3785,7 @@ static int woal_cfg80211_subcmd_set_dfs_offload(struct wiphy *wiphy,
 }
 
 // clang-format off
-const struct wiphy_vendor_command vendor_commands[] = {
+static const struct wiphy_vendor_command vendor_commands[] = {
 	{
 		.info = {
 				.vendor_id = MRVL_VENDOR_ID,
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_debug.c b/mxm_wifiex/wlan_src/mlinux/moal_debug.c
index 66115db..3d31b65 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_debug.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_debug.c
@@ -3,7 +3,7 @@
  * @brief This file contains functions for debug proc file.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -184,6 +184,8 @@ static struct debug_data items[] = {
 	 item_addr(num_cons_assoc_failure), INFO_ADDR},
 	{"cmd_sent", item_size(cmd_sent), item_addr(cmd_sent), INFO_ADDR},
 	{"data_sent", item_size(data_sent), item_addr(data_sent), INFO_ADDR},
+	{"data_sent_cnt", item_size(data_sent_cnt), item_addr(data_sent_cnt),
+	 INFO_ADDR},
 	{"mp_rd_bitmap", item_size(mp_rd_bitmap), item_addr(mp_rd_bitmap),
 	 INFO_ADDR},
 	{"curr_rd_port", item_size(curr_rd_port), item_addr(curr_rd_port),
@@ -363,6 +365,8 @@ static struct debug_data uap_items[] = {
 #endif
 	{"cmd_sent", item_size(cmd_sent), item_addr(cmd_sent), INFO_ADDR},
 	{"data_sent", item_size(data_sent), item_addr(data_sent), INFO_ADDR},
+	{"data_sent_cnt", item_size(data_sent_cnt), item_addr(data_sent_cnt),
+	 INFO_ADDR},
 	{"mp_rd_bitmap", item_size(mp_rd_bitmap), item_addr(mp_rd_bitmap),
 	 INFO_ADDR},
 	{"curr_rd_port", item_size(curr_rd_port), item_addr(curr_rd_port),
@@ -968,8 +972,8 @@ static int woal_debug_read(struct seq_file *sfp, void *data)
 	moal_private *priv = items_priv->priv;
 	mlan_debug_info *info = NULL;
 	t_u32 intf_mask = INTF_MASK << 8;
-#ifdef SDIO
 	unsigned int j;
+#ifdef SDIO
 	t_u8 mp_aggr_pkt_limit = 0;
 #endif
 
@@ -1007,7 +1011,6 @@ static int woal_debug_read(struct seq_file *sfp, void *data)
 		else if (d[i].size == 4)
 			val = *((t_u32 *)d[i].addr);
 		else {
-			unsigned int j;
 			seq_printf(sfp, "%s=", d[i].name);
 			for (j = 0; j < d[i].size; j += 2) {
 				val = *(t_u16 *)(d[i].addr + j);
@@ -1061,14 +1064,15 @@ static int woal_debug_read(struct seq_file *sfp, void *data)
 #endif
 #ifdef PCIE
 	if (IS_PCIE(priv->phandle->card_type)) {
+		seq_printf(sfp, "txbd_rdptr=0x%x txbd_wrptr=0x%x\n",
+			   info->txbd_rdptr, info->txbd_wrptr);
+		seq_printf(sfp, "rxbd_rdptr=0x%x rxbd_wrptr=0x%x\n",
+			   info->rxbd_rdptr, info->rxbd_wrptr);
+		seq_printf(sfp, "eventbd_rdptr=0x%x event_wrptr=0x%x\n",
+			   info->eventbd_rdptr, info->eventbd_wrptr);
 		seq_printf(sfp, "last_wr_index:%d\n",
-			   info->txbd_wrptr & (MLAN_MAX_TXRX_BD - 1));
-		seq_printf(sfp, "Tx pkt size:\n");
-		for (i = 0; i < MLAN_MAX_TXRX_BD; i++) {
-			seq_printf(sfp, "%04d ", info->last_tx_pkt_size[i]);
-			if ((i + 1) % 16 == 0)
-				seq_printf(sfp, "\n");
-		}
+			   info->txbd_wrptr & (info->txrx_bd_size - 1));
+		seq_printf(sfp, "TxRx BD size:%d\n", info->txrx_bd_size);
 	}
 #endif
 	seq_printf(sfp, "tcp_ack_drop_cnt=%d\n", priv->tcp_ack_drop_cnt);
@@ -1094,8 +1098,6 @@ static int woal_debug_read(struct seq_file *sfp, void *data)
 	if (info->rx_tbl_num) {
 		seq_printf(sfp, "Rx reorder table:\n");
 		for (i = 0; i < info->rx_tbl_num; i++) {
-			unsigned int j;
-
 			seq_printf(
 				sfp,
 				"tid = %d, ta =  %02x:%02x:%02x:%02x:%02x:%02x, start_win = %d, "
@@ -1128,6 +1130,33 @@ static int woal_debug_read(struct seq_file *sfp, void *data)
 			info->ralist[i].tx_pause);
 	}
 
+	for (i = 0; i < info->tdls_peer_num; i++) {
+		seq_printf(
+			sfp,
+			"tdls peer: %02x:%02x:%02x:%02x:%02x:%02x snr=%d nf=%d\n",
+			info->tdls_peer_list[i].mac_addr[0],
+			info->tdls_peer_list[i].mac_addr[1],
+			info->tdls_peer_list[i].mac_addr[2],
+			info->tdls_peer_list[i].mac_addr[3],
+			info->tdls_peer_list[i].mac_addr[4],
+			info->tdls_peer_list[i].mac_addr[5],
+			info->tdls_peer_list[i].snr,
+			-info->tdls_peer_list[i].nf);
+		seq_printf(sfp, "htcap: ");
+		for (j = 0; j < sizeof(IEEEtypes_HTCap_t); j++)
+			seq_printf(sfp, "%02x ",
+				   info->tdls_peer_list[i].ht_cap[j]);
+		seq_printf(sfp, "\nExtcap: ");
+		for (j = 0; j < sizeof(IEEEtypes_ExtCap_t); j++)
+			seq_printf(sfp, "%02x ",
+				   info->tdls_peer_list[i].ext_cap[j]);
+		seq_printf(sfp, "\n");
+		seq_printf(sfp, "vhtcap: ");
+		for (j = 0; j < sizeof(IEEEtypes_VHTCap_t); j++)
+			seq_printf(sfp, "%02x ",
+				   info->tdls_peer_list[i].vht_cap[j]);
+		seq_printf(sfp, "\n");
+	}
 exit:
 	MODULE_PUT;
 	LEAVE();
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
index 60d229b..b89f470 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
@@ -4,7 +4,7 @@
   * @brief This file contains private ioctl functions
 
   *
-  * Copyright 2014-2020 NXP
+  * Copyright 2014-2021 NXP
   *
   * This software file (the File) is distributed by NXP
   * under the terms of the GNU General Public License Version 2, June 1991
@@ -128,10 +128,10 @@ extern const struct net_device_ops woal_netdev_ops;
  *
  * @return              MLAN_STATUS_SUCCESS
  */
-mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
-			    int *user_data_len)
+static mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
+				   int *user_data_len)
 {
-	unsigned int i, j, k;
+	int i, j, k;
 	char cdata[10];
 	int is_hex = 0;
 
@@ -141,8 +141,8 @@ mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
 	}
 
 	memset(cdata, 0, sizeof(cdata));
-	for (i = 0, j = 0, k = 0; i <= strlen(pos); i++) {
-		if ((k == 0) && (i <= (strlen(pos) - 2))) {
+	for (i = 0, j = 0, k = 0; i <= (int)strlen(pos); i++) {
+		if ((k == 0) && (i <= (int)(strlen(pos) - 2))) {
 			if ((pos[i] == '0') && (pos[i + 1] == 'x')) {
 				is_hex = 1;
 				i = i + 2;
@@ -165,7 +165,7 @@ mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
 			if (pos[i] == '\0')
 				break;
 		} else {
-			if (k >= sizeof(cdata)) {
+			if (k >= (int)sizeof(cdata)) {
 				PRINTM(MERROR, "Invalid numerical arguments\n");
 				break;
 			}
@@ -178,37 +178,6 @@ mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
 	return MLAN_STATUS_SUCCESS;
 }
 
-/** Convert character to integer */
-#define CHAR2INT(x) (((x) >= 'A') ? ((x) - 'A' + 10) : ((x) - '0'))
-/**
- * @brief Converts a string to hex value
- *
- * @param str      A pointer to the string
- * @param raw      A pointer to the raw data buffer
- * @param raw_size      raw data buffer size
- * @return         Number of bytes read
- **/
-int string2raw(unsigned char *str, unsigned char *raw, int raw_size)
-{
-	int len = (strlen(str) + 1) / 2;
-	int i = 0;
-
-	do {
-		if (strlen(str) < 2)
-			return -1;
-		if (!isxdigit(*str) || !isxdigit(*(str + 1)))
-			return -1;
-		*str = toupper(*str);
-		*raw = CHAR2INT(*str) << 4;
-		++str;
-		*str = toupper(*str);
-		*raw |= CHAR2INT(*str);
-		++raw;
-		i++;
-	} while (*++str != '\0' && i < raw_size);
-	return len;
-}
-
 #if defined(STA_CFG80211) && defined(UAP_CFG80211)
 /**
  *  @brief Set wps & p2p ie in AP mode
@@ -291,7 +260,8 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS -- success, otherwise fail
  */
-mlan_status woal_set_miracast_mode(moal_private *priv, t_u8 *pdata, size_t len)
+static mlan_status woal_set_miracast_mode(moal_private *priv, t_u8 *pdata,
+					  size_t len)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u8 *pos = pdata;
@@ -339,8 +309,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_get_priv_driver_version(moal_private *priv, t_u8 *respbuf,
-				 t_u32 respbuflen)
+static int woal_get_priv_driver_version(moal_private *priv, t_u8 *respbuf,
+					t_u32 respbuflen)
 {
 	int len = 0, ret = -1;
 	char buf[MLAN_MAX_VER_STR_LEN];
@@ -361,7 +331,7 @@ int woal_get_priv_driver_version(moal_private *priv, t_u8 *respbuf,
 	if (len) {
 		/* Copy back the retrieved version string */
 		PRINTM(MINFO, "MOAL VERSION: %s\n", buf);
-		ret = MIN(len, (respbuflen - 1));
+		ret = MIN(len, (int)(respbuflen - 1));
 		moal_memcpy_ext(priv->phandle, respbuf, buf, ret,
 				respbuflen - 1);
 	} else {
@@ -429,7 +399,7 @@ int woal_priv_hostcmd(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
 	}
 	ret = misc_cfg->param.hostcmd.len + sizeof(buf_len) + strlen(CMD_NXP) +
 	      strlen(PRIV_CMD_HOSTCMD);
-	if (ret > respbuflen) {
+	if (ret > (int)respbuflen) {
 		ret = -EFAULT;
 		goto error;
 	}
@@ -600,7 +570,7 @@ static int woal_setget_priv_range_ext(moal_private *priv, t_u8 *respbuf,
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_RANGE_EXT;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -650,19 +620,20 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_customie(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_customie(moal_private *priv, t_u8 *respbuf,
+			      t_u32 respbuflen)
 {
 	int ret = 0;
 	t_u8 *data_ptr;
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
-	mlan_ds_misc_custom_ie *custom_ie = NULL;
+	mlan_ds_misc_custom_ie *pcustom_ie = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
 	data_ptr = respbuf + (strlen(CMD_NXP) + strlen(PRIV_CMD_CUSTOMIE));
 
-	custom_ie = (mlan_ds_misc_custom_ie *)data_ptr;
+	pcustom_ie = (mlan_ds_misc_custom_ie *)data_ptr;
 	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
@@ -672,13 +643,13 @@ int woal_priv_customie(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_CUSTOM_IE;
 	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
-	if ((custom_ie->len == 0) ||
-	    (custom_ie->len == sizeof(custom_ie->ie_data_list[0].ie_index)))
+	if ((pcustom_ie->len == 0) ||
+	    (pcustom_ie->len == sizeof(pcustom_ie->ie_data_list[0].ie_index)))
 		ioctl_req->action = MLAN_ACT_GET;
 	else
 		ioctl_req->action = MLAN_ACT_SET;
 
-	moal_memcpy_ext(priv->phandle, &misc->param.cust_ie, custom_ie,
+	moal_memcpy_ext(priv->phandle, &misc->param.cust_ie, pcustom_ie,
 			sizeof(mlan_ds_misc_custom_ie),
 			sizeof(mlan_ds_misc_custom_ie));
 
@@ -687,8 +658,8 @@ int woal_priv_customie(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 		ret = -EFAULT;
 		goto done;
 	}
-	custom_ie = (mlan_ds_misc_custom_ie *)data_ptr;
-	moal_memcpy_ext(priv->phandle, custom_ie, &misc->param.cust_ie,
+	pcustom_ie = (mlan_ds_misc_custom_ie *)data_ptr;
+	moal_memcpy_ext(priv->phandle, pcustom_ie, &misc->param.cust_ie,
 			sizeof(mlan_ds_misc_custom_ie),
 			respbuflen -
 				(strlen(CMD_NXP) + strlen(PRIV_CMD_CUSTOMIE)));
@@ -713,8 +684,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_bandcfg(moal_private *priv, t_u8 *respbuf,
-			     t_u32 respbuflen)
+static int woal_setget_priv_bandcfg(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
 {
 	int ret = 0;
 	unsigned int i;
@@ -840,8 +811,8 @@ error:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_httxcfg(moal_private *priv, t_u8 *respbuf,
-			     t_u32 respbuflen)
+static int woal_setget_priv_httxcfg(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
 {
 	t_u32 data[2];
 	mlan_ioctl_req *req = NULL;
@@ -939,8 +910,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_htcapinfo(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_setget_priv_htcapinfo(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	int data[2];
 	mlan_ioctl_req *req = NULL;
@@ -1041,8 +1012,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_addbapara(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_setget_priv_addbapara(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	int data[5];
 	mlan_ioctl_req *req = NULL;
@@ -1147,7 +1118,7 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_delba(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_delba(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 {
 	t_u32 data[2] = {0xFF, 0xFF};
 	mlan_ioctl_req *req = NULL;
@@ -1164,7 +1135,7 @@ int woal_priv_delba(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_DELBA);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* Incorrect number of arguments */
 		PRINTM(MERROR, "%d: Invalid arguments\n", __LINE__);
 		ret = -EINVAL;
@@ -1243,8 +1214,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_rejectaddbareq(moal_private *priv, t_u8 *respbuf,
-			     t_u32 respbuflen)
+static int woal_priv_rejectaddbareq(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
 {
 	t_u32 data[1];
 	mlan_ioctl_req *req = NULL;
@@ -1323,8 +1294,8 @@ done:
  *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
  * otherwise fail
  */
-mlan_status woal_ioctl_addba_reject(moal_private *priv, t_u32 action,
-				    t_u8 *addba_reject)
+static mlan_status woal_ioctl_addba_reject(moal_private *priv, t_u32 action,
+					   t_u8 *addba_reject)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
@@ -1373,8 +1344,9 @@ done:
  *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
  * otherwise fail
  */
-mlan_status woal_ioctl_aggr_prio_tbl(moal_private *priv, t_u32 action,
-				     mlan_ds_11n_aggr_prio_tbl *aggr_prio_tbl)
+static mlan_status
+woal_ioctl_aggr_prio_tbl(moal_private *priv, t_u32 action,
+			 mlan_ds_11n_aggr_prio_tbl *aggr_prio_tbl)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
@@ -1424,8 +1396,8 @@ done:
  *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
  * otherwise fail
  */
-mlan_status woal_ioctl_addba_param(moal_private *priv, t_u32 action,
-				   mlan_ds_11n_addba_param *addba_param)
+static mlan_status woal_ioctl_addba_param(moal_private *priv, t_u32 action,
+					  mlan_ds_11n_addba_param *addba_param)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
@@ -1473,7 +1445,8 @@ done:
  *
  *  @return             0 --success, otherwise failure
  */
-int woal_set_rx_ba_winsize(moal_private *priv, t_u8 *respbuf, int respbuflen)
+static int woal_set_rx_ba_winsize(moal_private *priv, t_u8 *respbuf,
+				  int respbuflen)
 {
 	int data[2];
 	t_u8 addba_reject[MAX_NUM_TID];
@@ -1531,7 +1504,7 @@ int woal_set_rx_ba_winsize(moal_private *priv, t_u8 *respbuf, int respbuflen)
 			ret = -EFAULT;
 			goto done;
 		}
-		if (data[1] != addba_param.rxwinsize) {
+		if (data[1] != (int)addba_param.rxwinsize) {
 			addba_param.rxwinsize = data[1];
 			if (MLAN_STATUS_SUCCESS !=
 			    woal_ioctl_addba_param(priv, MLAN_ACT_SET,
@@ -1552,7 +1525,8 @@ done:
  *
  *  @return             0 --success, otherwise failure
  */
-int woal_set_tx_ba_winsize(moal_private *priv, t_u8 *respbuf, int respbuflen)
+static int woal_set_tx_ba_winsize(moal_private *priv, t_u8 *respbuf,
+				  int respbuflen)
 {
 	int data[2];
 	mlan_ds_11n_aggr_prio_tbl aggr_prio_tbl;
@@ -1615,7 +1589,7 @@ int woal_set_tx_ba_winsize(moal_private *priv, t_u8 *respbuf, int respbuflen)
 			ret = -EFAULT;
 			goto done;
 		}
-		if (data[1] != addba_param.txwinsize) {
+		if (data[1] != (int)addba_param.txwinsize) {
 			addba_param.txwinsize = data[1];
 			if (MLAN_STATUS_SUCCESS !=
 			    woal_ioctl_addba_param(priv, MLAN_ACT_SET,
@@ -1637,8 +1611,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_aggrpriotbl(moal_private *priv, t_u8 *respbuf,
-				 t_u32 respbuflen)
+static int woal_setget_priv_aggrpriotbl(moal_private *priv, t_u8 *respbuf,
+					t_u32 respbuflen)
 {
 	int data[MAX_NUM_TID * 2], i, j;
 	mlan_ioctl_req *req = NULL;
@@ -1725,8 +1699,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_addbareject(moal_private *priv, t_u8 *respbuf,
-				 t_u32 respbuflen)
+static int woal_setget_priv_addbareject(moal_private *priv, t_u8 *respbuf,
+					t_u32 respbuflen)
 {
 	int data[MAX_NUM_TID], i;
 	mlan_ioctl_req *req = NULL;
@@ -1808,7 +1782,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_vhtcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_setget_priv_vhtcfg(moal_private *priv, t_u8 *respbuf,
+				   t_u32 respbuflen)
 {
 	int data[6];
 	mlan_ioctl_req *req = NULL;
@@ -1963,8 +1938,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_opermodecfg(moal_private *priv, t_u8 *respbuf,
-				 t_u32 respbuflen)
+static int woal_setget_priv_opermodecfg(moal_private *priv, t_u8 *respbuf,
+					t_u32 respbuflen)
 {
 	int data[2];
 	mlan_ioctl_req *req = NULL;
@@ -2046,7 +2021,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_get_priv_datarate(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_get_priv_datarate(moal_private *priv, t_u8 *respbuf,
+				  t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_rate *rate = NULL;
@@ -2096,8 +2072,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_txratecfg(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_setget_priv_txratecfg(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	t_u32 data[4];
 	mlan_ioctl_req *req = NULL;
@@ -2222,7 +2198,7 @@ int woal_setget_priv_txratecfg(moal_private *priv, t_u8 *respbuf,
 						if (rate_setting->bandwidth ==
 						    HE_ER_SU_BANDWIDTH_TONE242) {
 							if ((data[1] >
-							     MLAN_RATE_INDEX_MCS4) ||
+							     MLAN_RATE_INDEX_MCS2) ||
 							    data[2] >
 								    MLAN_RATE_NSS1) {
 								PRINTM(MERROR,
@@ -2249,7 +2225,8 @@ int woal_setget_priv_txratecfg(moal_private *priv, t_u8 *respbuf,
 							goto done;
 						}
 					}
-					if (rate_setting->dcm) {
+					if ((rate_setting->dcm) &&
+					    (rate_setting->stbc == 0)) {
 						if ((data[1] ==
 						     MLAN_RATE_INDEX_MCS2) ||
 						    (data[1] >
@@ -2309,7 +2286,6 @@ done:
 mlan_status woal_get_stats_info(moal_private *priv, t_u8 wait_option,
 				mlan_ds_get_stats *stats)
 {
-	int ret = 0;
 	mlan_ds_get_info *info = NULL;
 	mlan_ioctl_req *req = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -2318,7 +2294,7 @@ mlan_status woal_get_stats_info(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_get_info));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -2361,7 +2337,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_get_priv_getlog(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_get_priv_getlog(moal_private *priv, t_u8 *respbuf,
+				t_u32 respbuflen)
 {
 	int ret = 0;
 	mlan_ds_get_stats *stats;
@@ -2401,8 +2378,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_esuppmode(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_setget_priv_esuppmode(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	t_u32 data[3];
 	mlan_ioctl_req *req = NULL;
@@ -2491,8 +2468,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_setget_priv_passphrase(moal_private *priv, t_u8 *respbuf,
-				t_u32 respbuflen)
+static int woal_setget_priv_passphrase(moal_private *priv, t_u8 *respbuf,
+				       t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
@@ -2696,7 +2673,7 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_deauth(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_deauth(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 {
 	int ret = 0;
 	t_u8 mac[ETH_ALEN];
@@ -2913,7 +2890,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_bssrole(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_bssrole(moal_private *priv, t_u8 *respbuf,
+			     t_u32 respbuflen)
 {
 	t_u32 data[1];
 	int ret = 0;
@@ -2994,7 +2972,8 @@ error:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_setuserscan(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_setuserscan(moal_private *priv, t_u8 *respbuf,
+				 t_u32 respbuflen)
 {
 	wlan_user_scan_cfg scan_cfg;
 	int ret = 0;
@@ -3028,7 +3007,8 @@ int woal_priv_setuserscan(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_get_chanstats(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_get_chanstats(moal_private *priv, t_u8 *respbuf,
+				   t_u32 respbuflen)
 {
 	mlan_scan_resp scan_resp;
 	chan_stats *stats = NULL;
@@ -3068,8 +3048,9 @@ done:
  *
  *  @return             MLAN_STATUS_SUCCESS --success, otherwise fail
  */
-int moal_ret_get_scan_table_ioctl(t_u8 *respbuf, t_u32 respbuflen,
-				  mlan_scan_resp *scan_resp, t_u32 scan_start)
+static int moal_ret_get_scan_table_ioctl(t_u8 *respbuf, t_u32 respbuflen,
+					 mlan_scan_resp *scan_resp,
+					 t_u32 scan_start)
 {
 	pBSSDescriptor_t pbss_desc, scan_table;
 	wlan_ioctl_get_scan_table_info *prsp_info;
@@ -3145,7 +3126,8 @@ int moal_ret_get_scan_table_ioctl(t_u8 *respbuf, t_u32 respbuflen,
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_getscantable(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_getscantable(moal_private *priv, t_u8 *respbuf,
+				  t_u32 respbuflen)
 {
 	int ret = 0;
 	mlan_ioctl_req *req = NULL;
@@ -3206,7 +3188,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_extcapcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_extcapcfg(moal_private *priv, t_u8 *respbuf,
+			       t_u32 respbuflen)
 {
 	int ret, header;
 	mlan_ioctl_req *req = NULL;
@@ -3231,7 +3214,7 @@ int woal_priv_extcapcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	cfg->sub_command = MLAN_OID_MISC_EXT_CAP_CFG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
 	header = strlen(CMD_NXP) + strlen(PRIV_CMD_EXTCAPCFG);
-	if (strlen(respbuf) == header)
+	if ((int)strlen(respbuf) == header)
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 	else {
@@ -3282,8 +3265,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_setgetdeepsleep(moal_private *priv, t_u8 *respbuf,
-			      t_u32 respbuflen)
+static int woal_priv_setgetdeepsleep(moal_private *priv, t_u8 *respbuf,
+				     t_u32 respbuflen)
 {
 	t_u32 data[2];
 	int ret = 0;
@@ -3356,7 +3339,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_setgetipaddr(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_setgetipaddr(moal_private *priv, t_u8 *respbuf,
+				  t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -3450,7 +3434,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_setwpssession(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_setwpssession(moal_private *priv, t_u8 *respbuf,
+				   t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_wps_cfg *pwps = NULL;
@@ -3518,7 +3503,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_otpuserdata(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_otpuserdata(moal_private *priv, t_u8 *respbuf,
+				 t_u32 respbuflen)
 {
 	int data[1];
 	int user_data_len = 0;
@@ -3588,8 +3574,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_set_get_countrycode(moal_private *priv, t_u8 *respbuf,
-				  t_u32 respbuflen)
+static int woal_priv_set_get_countrycode(moal_private *priv, t_u8 *respbuf,
+					 t_u32 respbuflen)
 {
 	int ret = 0;
 	/* char data[COUNTRY_CODE_LEN] = {0, 0, 0}; */
@@ -3665,13 +3651,13 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_get_cfpinfo(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_get_cfpinfo(moal_private *priv, t_u8 *respbuf,
+				 t_u32 respbuflen)
 {
 	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *cfp_misc = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
-	int header = 0, data_length = 0;
 
 	ENTER();
 
@@ -3680,8 +3666,6 @@ int woal_priv_get_cfpinfo(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 		ret = -EINVAL;
 		goto done;
 	}
-	header = strlen(CMD_NXP) + strlen(PRIV_CMD_CFPINFO);
-	data_length = strlen(respbuf) - header;
 
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
@@ -3727,8 +3711,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_setgettcpackenh(moal_private *priv, t_u8 *respbuf,
-			      t_u32 respbuflen)
+static int woal_priv_setgettcpackenh(moal_private *priv, t_u8 *respbuf,
+				     t_u32 respbuflen)
 {
 	t_u32 data[1];
 	int ret = 0;
@@ -3791,8 +3775,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_assocessid(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
-			 t_u8 bBSSID)
+static int woal_priv_assocessid(moal_private *priv, t_u8 *respbuf,
+				t_u32 respbuflen, t_u8 bBSSID)
 {
 	mlan_ssid_bssid ssid_bssid;
 	moal_handle *handle = priv->phandle;
@@ -3811,14 +3795,14 @@ int woal_priv_assocessid(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
 	else
 		header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_ASSOCESSID);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		PRINTM(MERROR, "No argument, invalid operation!\n");
 		ret = -EINVAL;
 		LEAVE();
 		return ret;
 	}
 	copy_len = strlen(respbuf) - header_len;
-	buflen = MIN(copy_len, (sizeof(buf) - 1));
+	buflen = MIN(copy_len, (int)(sizeof(buf) - 1));
 	memset(buf, 0, sizeof(buf));
 	memset(&ssid_bssid, 0, sizeof(mlan_ssid_bssid));
 	moal_memcpy_ext(handle, buf, respbuf + header_len, buflen, sizeof(buf));
@@ -3927,8 +3911,8 @@ setessid_ret:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_getwakeupreason(moal_private *priv, t_u8 *respbuf,
-			      t_u32 respbuflen)
+static int woal_priv_getwakeupreason(moal_private *priv, t_u8 *respbuf,
+				     t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_pm_cfg *pm_cfg = NULL;
@@ -3985,8 +3969,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_set_get_listeninterval(moal_private *priv, t_u8 *respbuf,
-				     t_u32 respbuflen)
+static int woal_priv_set_get_listeninterval(moal_private *priv, t_u8 *respbuf,
+					    t_u32 respbuflen)
 {
 	int data[1];
 	int user_data_len = 0;
@@ -4066,8 +4050,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_set_get_drvdbg(moal_private *priv, t_u8 *respbuf,
-			     t_u32 respbuflen)
+static int woal_priv_set_get_drvdbg(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
 {
 	int data[4];
 	int user_data_len = 0;
@@ -4164,7 +4148,8 @@ done:
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_priv_mgmt_filter(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_mgmt_filter(moal_private *priv, t_u8 *respbuf,
+				 t_u32 respbuflen)
 {
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_pm_cfg *pm_cfg = NULL;
@@ -4194,15 +4179,15 @@ int woal_priv_mgmt_filter(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 
 	header_len = strlen(PRIV_CMD_MGMT_FILTER) + strlen(CMD_NXP);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		action = MLAN_ACT_GET;
 	} else {
 		/* SET operation */
 		argument = (t_u8 *)(respbuf + header_len);
 		data_len = respbuflen - header_len;
-		if (data_len >
-		    MAX_MGMT_FRAME_FILTER * sizeof(mlan_mgmt_frame_wakeup)) {
+		if (data_len > (int)(MAX_MGMT_FRAME_FILTER *
+				     sizeof(mlan_mgmt_frame_wakeup))) {
 			PRINTM(MERROR, "%d: Invalid arguments\n", __LINE__);
 			ret = -EINVAL;
 			goto done;
@@ -4241,8 +4226,8 @@ done:
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_priv_hscfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
-		    BOOLEAN invoke_hostcmd)
+static int woal_priv_hscfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
+			   BOOLEAN invoke_hostcmd)
 {
 	int data[13] = {0};
 	int *temp_data, type;
@@ -4304,8 +4289,8 @@ int woal_priv_hscfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
 	}
 
 	/* HS config is blocked if HS is already activated */
-	if (user_data_len &&
-	    (data[0] != HOST_SLEEP_CFG_CANCEL || invoke_hostcmd == MFALSE)) {
+	if (user_data_len && (data[0] != (int)HOST_SLEEP_CFG_CANCEL ||
+			      invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
 		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
 		if (bss_info.is_hs_configured) {
@@ -4445,7 +4430,8 @@ done:
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_priv_hssetpara(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_hssetpara(moal_private *priv, t_u8 *respbuf,
+			       t_u32 respbuflen)
 {
 	int data[13] = {0};
 	int user_data_len = 0;
@@ -4493,8 +4479,8 @@ done:
  *
  * @return         0 --success, otherwise fail
  */
-int woal_priv_set_get_scancfg(moal_private *priv, t_u8 *respbuf,
-			      t_u32 respbuflen)
+static int woal_priv_set_get_scancfg(moal_private *priv, t_u8 *respbuf,
+				     t_u32 respbuflen)
 {
 	int ret = 0;
 	int user_data_len = 0;
@@ -4606,7 +4592,8 @@ done:
  *
  * @return         Number of bytes written, negative for failure.
  */
-int woal_priv_getnlnum(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_getnlnum(moal_private *priv, t_u8 *respbuf,
+			      t_u32 respbuflen)
 {
 	int ret = 0;
 	int data = 0;
@@ -4638,8 +4625,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_set_get_aggrctrl(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_priv_set_get_aggrctrl(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	int data[1];
 	int user_data_len = 0;
@@ -4734,8 +4721,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
-				  t_u32 respbuflen)
+static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
+					 t_u32 respbuflen)
 {
 	int data[8];
 	int user_data_len = 0;
@@ -4939,7 +4926,7 @@ int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 	/* Keep a copy of the latest Tx aggregation parameters in MOAL */
 	moal_memcpy_ext(handle, &cardp->tx_aggr_ctrl,
 			&pcfg_misc->param.usb_aggr_params.tx_aggr_ctrl,
-			sizeof(usb_aggr_ctrl), sizeof(usb_aggr_ctrl));
+			sizeof(usb_aggr_ctrl_cfg), sizeof(usb_aggr_ctrl_cfg));
 
 	if (usb_resubmit_urbs) {
 		/* Indicate resubmition from here */
@@ -4962,7 +4949,7 @@ int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 	/* Keep a copy of the latest Rx deaggregation parameters in MOAL */
 	moal_memcpy_ext(handle, &cardp->rx_deaggr_ctrl,
 			&pcfg_misc->param.usb_aggr_params.rx_deaggr_ctrl,
-			sizeof(usb_aggr_ctrl), sizeof(usb_aggr_ctrl));
+			sizeof(usb_aggr_ctrl_cfg), sizeof(usb_aggr_ctrl_cfg));
 
 	if (usb_resubmit_urbs) {
 		/* Ensure the next data URBs will use the modified parameters */
@@ -5545,7 +5532,7 @@ static int woal_priv_set_get_psmode(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_PSMODE);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		action = MLAN_ACT_GET;
@@ -5845,7 +5832,7 @@ static int woal_priv_pscfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_PSCFG);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -6047,7 +6034,7 @@ static int woal_priv_sleeppd(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SLEEPPD);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -6125,7 +6112,7 @@ static int woal_priv_txcontrol(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_TXCONTROL);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -6202,7 +6189,7 @@ static int woal_priv_regrdwr(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_REGRDWR);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		ret = -EINVAL;
 		goto done;
 	}
@@ -6296,7 +6283,7 @@ static int woal_priv_rdeeprom(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_RDEEPROM);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		ret = -EINVAL;
 		goto done;
 	}
@@ -6368,7 +6355,7 @@ static int woal_priv_memrdwr(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_MEMRDWR);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		ret = -EINVAL;
 		goto done;
 	}
@@ -6433,7 +6420,7 @@ static int woal_priv_sdcmd52rw(moal_private *priv, t_u8 *respbuf,
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SDCMD52RW);
 	memset((t_u8 *)buf, 0, sizeof(buf));
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		PRINTM(MERROR, "Invalid number of arguments\n");
 		ret = -EINVAL;
 		goto done;
@@ -6552,8 +6539,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_set_get_auto_arp(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_priv_set_get_auto_arp(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	int data[4];
 	int user_data_len = 0;
@@ -6632,7 +6619,7 @@ static int woal_priv_deauth_ctrl(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_DEAUTH_CTRL);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 	} else {
@@ -7066,7 +7053,8 @@ done:
  *
  *  @return         0 --success, otherwise fail
  */
-int woal_priv_hotspotcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_hotspotcfg(moal_private *priv, t_u8 *respbuf,
+				t_u32 respbuflen)
 {
 	int ret = 0;
 	mlan_ioctl_req *req = NULL;
@@ -7078,7 +7066,7 @@ int woal_priv_hotspotcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_HOTSPOTCFG);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -7133,8 +7121,8 @@ done:
  *
  *  @return         0 --success, otherwise fail
  */
-int woal_priv_mgmt_frame_passthru_ctrl(moal_private *priv, t_u8 *respbuf,
-				       t_u32 respbuflen)
+static int woal_priv_mgmt_frame_passthru_ctrl(moal_private *priv, t_u8 *respbuf,
+					      t_u32 respbuflen)
 {
 	int ret = 0;
 	int data = 0;
@@ -7145,7 +7133,7 @@ int woal_priv_mgmt_frame_passthru_ctrl(moal_private *priv, t_u8 *respbuf,
 
 	ENTER();
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_MGMT_FRAME_CTRL);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -7338,7 +7326,7 @@ static int woal_priv_wmm_delts_req_ioctl(moal_private *priv, t_u8 *respbuf,
 
 	memset(&delts_ioctl, 0x00, sizeof(delts_ioctl));
 
-	if (strlen(respbuf) > header_len) {
+	if ((int)strlen(respbuf) > header_len) {
 		copy_len = MIN(strlen(data_ptr), sizeof(delts_ioctl));
 		moal_memcpy_ext(priv->phandle, (t_u8 *)&delts_ioctl, data_ptr,
 				copy_len, sizeof(delts_ioctl));
@@ -7479,7 +7467,7 @@ static int woal_priv_wmm_queue_status_ioctl(moal_private *priv, t_u8 *respbuf,
 	pwmm = (mlan_ds_wmm_cfg *)req->pbuf;
 	pwmm->sub_command = MLAN_OID_WMM_CFG_QUEUE_STATUS;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 		if (status != MLAN_STATUS_SUCCESS) {
 			ret = -EFAULT;
@@ -7573,7 +7561,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_macctrl(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_macctrl(moal_private *priv, t_u8 *respbuf,
+			     t_u32 respbuflen)
 {
 	int data = 0;
 	mlan_ioctl_req *req = NULL;
@@ -7585,7 +7574,7 @@ int woal_priv_macctrl(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_MAC_CTRL);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -7641,7 +7630,7 @@ done:
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_priv_getwap(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_getwap(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 {
 	int ret = 0;
 #ifdef STA_SUPPORT
@@ -7690,7 +7679,8 @@ int woal_priv_getwap(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_region_code(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_region_code(moal_private *priv, t_u8 *respbuf,
+				 t_u32 respbuflen)
 {
 	int data = 0;
 	mlan_ioctl_req *req = NULL;
@@ -7702,7 +7692,7 @@ int woal_priv_region_code(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_REGION_CODE);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -7759,8 +7749,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_rx_pkt_coalesce_cfg(moal_private *priv, t_u8 *respbuf,
-				  t_u32 respbuflen)
+static int woal_priv_rx_pkt_coalesce_cfg(moal_private *priv, t_u8 *respbuf,
+					 t_u32 respbuflen)
 {
 	int ret = 0;
 	t_u32 data[2];
@@ -7774,7 +7764,7 @@ int woal_priv_rx_pkt_coalesce_cfg(moal_private *priv, t_u8 *respbuf,
 
 	data_ptr = respbuf + strlen(CMD_NXP) + strlen(PRIV_CMD_RX_COAL_CFG);
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_RX_COAL_CFG);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -7839,7 +7829,8 @@ done:
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_priv_fwmacaddr(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_fwmacaddr(moal_private *priv, t_u8 *respbuf,
+			       t_u32 respbuflen)
 {
 	t_u8 data[ETH_ALEN];
 	int ret = 0;
@@ -7863,7 +7854,7 @@ int woal_priv_fwmacaddr(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	bss->sub_command = MLAN_OID_BSS_MAC_ADDR;
 	req->req_id = MLAN_IOCTL_BSS;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 	} else {
@@ -7905,7 +7896,8 @@ done:
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_priv_offchannel(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_offchannel(moal_private *priv, t_u8 *respbuf,
+				t_u32 respbuflen)
 {
 	int data[4];
 	int ret = 0;
@@ -7919,7 +7911,7 @@ int woal_priv_offchannel(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_OFFCHANNEL);
 
-	if (header_len == strlen(respbuf)) {
+	if (header_len == (int)strlen(respbuf)) {
 		/* Query current remain on channel status */
 		if (priv->phandle->remain_on_channel)
 			ret = sprintf(respbuf,
@@ -8060,8 +8052,8 @@ done:
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_priv_set_get_dscp_map(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_priv_set_get_dscp_map(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	int ret = MLAN_STATUS_SUCCESS;
 	t_u8 *pos = NULL;
@@ -8070,7 +8062,7 @@ int woal_priv_set_get_dscp_map(moal_private *priv, t_u8 *respbuf,
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_DSCP_MAP);
-	if (strlen(respbuf) != header_len) {
+	if ((int)strlen(respbuf) != header_len) {
 		/* SET operation */
 		pos = respbuf + header_len;
 		moal_memcpy_ext(priv->phandle, priv->dscp_map, pos,
@@ -8095,8 +8087,8 @@ int woal_priv_set_get_dscp_map(moal_private *priv, t_u8 *respbuf,
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_get_driver_verext(moal_private *priv, t_u8 *respbuf,
-				t_u32 respbuflen)
+static int woal_priv_get_driver_verext(moal_private *priv, t_u8 *respbuf,
+				       t_u32 respbuflen)
 {
 	int data = 0;
 	mlan_ds_get_info *info = NULL;
@@ -8121,7 +8113,7 @@ int woal_priv_get_driver_verext(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_VEREXT);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -8238,7 +8230,7 @@ static int woal_priv_radio_ctrl(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_RADIO_CTRL);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -8308,7 +8300,7 @@ static int woal_priv_wmm_cfg(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_WMM_CFG);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 		user_data_len = 0;
@@ -8382,7 +8374,7 @@ static int woal_priv_min_ba_threshold_cfg(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_MIN_BA_THRESH_CFG);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 		user_data_len = 0;
@@ -8457,7 +8449,7 @@ static int woal_priv_11d_cfg(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_11D_CFG);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 		user_data_len = 0;
@@ -8526,7 +8518,7 @@ static int woal_priv_11d_clr_chan_tbl(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_11D_CLR_TBL);
 
-	if (strlen(respbuf) != header_len) {
+	if ((int)strlen(respbuf) != header_len) {
 		PRINTM(MERROR, "Too many arguments\n");
 		ret = -EINVAL;
 		goto done;
@@ -8584,7 +8576,7 @@ static int woal_priv_wws_cfg(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_WWS_CFG);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 		user_data_len = 0;
@@ -8646,7 +8638,7 @@ static int woal_priv_set_get_reassoc(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_REASSOCTRL);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		data = (int)(priv->reassoc_on);
@@ -8717,7 +8709,7 @@ static int woal_priv_txbuf_cfg(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_TXBUF_CFG);
 
-	if (strlen(respbuf) != header_len) {
+	if ((int)strlen(respbuf) != header_len) {
 		PRINTM(MERROR,
 		       "Don't support set Tx buffer size after driver loaded!\n");
 		ret = -EINVAL;
@@ -8766,7 +8758,7 @@ static int woal_priv_auth_type(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_AUTH_TYPE);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_get_auth_mode(priv, MOAL_IOCTL_WAIT, &auth_mode)) {
@@ -8843,7 +8835,7 @@ static int woal_priv_11h_local_pwr_constraint(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_POWER_CONS);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 		user_data_len = 0;
@@ -8913,7 +8905,7 @@ static int woal_priv_ht_stream_cfg(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_HT_STREAM_CFG);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 		user_data_len = 0;
@@ -8986,7 +8978,7 @@ static int woal_priv_mimo_switch(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_MIMO_SWITCH);
 
-	if (strlen(respbuf) > header_len) {
+	if ((int)strlen(respbuf) > header_len) {
 		/* SET operation */
 		req->action = MLAN_ACT_SET;
 		parse_arguments(respbuf + header_len, data, 2, &user_data_len);
@@ -9047,7 +9039,7 @@ static int woal_priv_thermal(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_THERMAL);
 
-	if (strlen(respbuf) != header_len) {
+	if ((int)strlen(respbuf) != header_len) {
 		PRINTM(MERROR, "Set is not supported for this command\n");
 		ret = -EINVAL;
 		goto done;
@@ -9105,7 +9097,7 @@ static int woal_priv_beacon_interval(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_BCN_INTERVAL);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		req->action = MLAN_ACT_GET;
 		user_data_len = 0;
@@ -9167,7 +9159,6 @@ static int woal_priv_get_signal(moal_private *priv, t_u8 *respbuf,
 	int out_data[OUT_DATA_SIZE];
 	mlan_ds_get_signal signal;
 	int data_length = 0;
-	int buflen = 0;
 	int user_data_len = 0, header_len = 0;
 
 	ENTER();
@@ -9177,10 +9168,9 @@ static int woal_priv_get_signal(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_GET_SIGNAL);
 
-	if (strlen(respbuf) != header_len)
+	if ((int)strlen(respbuf) != header_len)
 		parse_arguments(respbuf + header_len, in_data, IN_DATA_SIZE,
 				&user_data_len);
-	buflen = MIN(user_data_len, IN_DATA_SIZE);
 
 	if (priv->media_connected == MFALSE) {
 		PRINTM(MERROR, "Can not get RSSI in disconnected state\n");
@@ -9414,7 +9404,7 @@ static int woal_priv_get_signal_ext(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_GET_SIGNAL_EXT);
 
-	if (strlen(respbuf) != header_len) {
+	if ((int)strlen(respbuf) != header_len) {
 		parse_arguments(respbuf + header_len, &data,
 				sizeof(data) / sizeof(int), &user_data_len);
 	}
@@ -9563,7 +9553,7 @@ static int woal_priv_get_signal_ext_v2(moal_private *priv, t_u8 *respbuf,
 	}
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_GET_SIGNAL_EXT_V2);
-	if (strlen(respbuf) != header_len) {
+	if ((int)strlen(respbuf) != header_len) {
 		parse_arguments(respbuf + header_len, &data,
 				sizeof(data) / sizeof(int), &user_data_len);
 	}
@@ -9683,7 +9673,7 @@ static int woal_priv_signalext_cfg(moal_private *priv, t_u8 *respbuf,
 	int user_data_len = 0, header_len = 0;
 	ENTER();
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SIGNALEXT_CFG);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		PRINTM(MERROR, "Invalid arguments!\n");
 		ret = -EINVAL;
 		goto done;
@@ -9719,8 +9709,8 @@ done:
  *
  * @return              0 -- success, otherwise fail
  */
-int woal_priv_set_get_pmfcfg(moal_private *priv, t_u8 *respbuf,
-			     t_u32 respbuflen)
+static int woal_priv_set_get_pmfcfg(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
 {
 	int data[2] = {0, 0};
 	mlan_ioctl_req *req = NULL;
@@ -9739,7 +9729,7 @@ int woal_priv_set_get_pmfcfg(moal_private *priv, t_u8 *respbuf,
 	}
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_PMFCFG);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -9813,7 +9803,7 @@ static int woal_priv_inactivity_timeout_ext(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_INACTIVITYTO);
 	memset(data, 0, sizeof(data));
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -9907,7 +9897,7 @@ static int woal_priv_11n_amsdu_aggr_ctrl(moal_private *priv, t_u8 *respbuf,
 	cfg_11n->sub_command = MLAN_OID_11N_CFG_AMSDU_AGGR_CTRL;
 	req->req_id = MLAN_IOCTL_11N_CFG;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -9975,7 +9965,7 @@ static int woal_priv_tx_bf_cap_ioctl(moal_private *priv, t_u8 *respbuf,
 	bf_cfg->sub_command = MLAN_OID_11N_CFG_TX_BF_CAP;
 	req->req_id = MLAN_IOCTL_11N_CFG;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -10034,7 +10024,7 @@ static int woal_priv_sdio_clock_ioctl(moal_private *priv, t_u8 *respbuf,
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SDIO_CLOCK);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)&clock_state,
 				sizeof(clock_state), respbuflen);
@@ -10095,7 +10085,7 @@ static int woal_priv_sdio_mpa_ctrl(moal_private *priv, t_u8 *respbuf,
 
 	memset(data, 0, sizeof(data));
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_MPA_CTRL);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -10233,7 +10223,7 @@ static int woal_priv_sleep_params_ioctl(moal_private *priv, t_u8 *respbuf,
 	psleep_params = (pmlan_ds_sleep_params)&pm->param.sleep_params;
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SLEEP_PARAMS);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -10340,7 +10330,7 @@ static int woal_priv_dfs_testing(moal_private *priv, t_u8 *respbuf,
 	ds_11hcfg->sub_command = MLAN_OID_11H_DFS_TESTING;
 	req->req_id = MLAN_IOCTL_11H_CFG;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -10385,7 +10375,7 @@ static int woal_priv_dfs_testing(moal_private *priv, t_u8 *respbuf,
 		ds_11hcfg->param.dfs_testing.usr_fixed_new_chan = (t_u8)data[3];
 		ds_11hcfg->param.dfs_testing.usr_cac_restart = (t_u8)data[4];
 		priv->phandle->cac_restart = (t_u8)data[4];
-		priv->phandle->cac_period_jiffies = (t_u32)data[0] * HZ / 1000;
+		priv->phandle->cac_period_jiffies = (t_u32)data[0] * HZ;
 		priv->phandle->usr_nop_period_sec = (t_u16)data[1];
 		req->action = MLAN_ACT_SET;
 #ifdef UAP_SUPPORT
@@ -10455,7 +10445,7 @@ static int woal_priv_dfs53cfg(moal_private *priv, t_u8 *respbuf,
 	ds_11hcfg->sub_command = MLAN_OID_11H_DFS_W53_CFG;
 	req->req_id = MLAN_IOCTL_11H_CFG;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -10516,8 +10506,8 @@ done:
  *  @return             channel center frequency center, if found; O, otherwise
  */
 
-t_u8 woal_get_center_freq_idx(moal_private *priv, t_u8 band, t_u32 pri_chan,
-			      t_u8 chan_bw)
+static t_u8 woal_get_center_freq_idx(moal_private *priv, t_u8 band,
+				     t_u32 pri_chan, t_u8 chan_bw)
 {
 	t_u8 center_freq_idx = 0;
 
@@ -10721,6 +10711,7 @@ t_u8 woal_get_center_freq_idx(moal_private *priv, t_u8 band, t_u32 pri_chan,
 	return center_freq_idx;
 }
 
+#if defined(UAP_SUPPORT)
 /**
  *  @brief determine the center frquency center index for bandwidth
  *         of 80 MHz and 160 MHz
@@ -10915,6 +10906,7 @@ done:
 	LEAVE();
 	return ret;
 }
+#endif
 
 /**
  * @brief               Set/Get CFP table codes
@@ -10953,7 +10945,7 @@ static int woal_priv_cfp_code(moal_private *priv, t_u8 *respbuf,
 	misc_cfg->sub_command = MLAN_OID_MISC_CFP_CODE;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -11013,9 +11005,6 @@ static int woal_priv_set_get_tx_rx_ant(moal_private *priv, t_u8 *respbuf,
 	mlan_ioctl_req *req = NULL;
 	int data[3] = {0};
 	mlan_status status = MLAN_STATUS_SUCCESS;
-#if defined(STA_CFG80211) || defined(UAP_CFG80211)
-	struct wiphy *wiphy = priv->phandle->wiphy;
-#endif
 
 	ENTER();
 
@@ -11029,7 +11018,7 @@ static int woal_priv_set_get_tx_rx_ant(moal_private *priv, t_u8 *respbuf,
 	radio->sub_command = MLAN_OID_ANT_CFG;
 	req->req_id = MLAN_IOCTL_RADIO_CFG;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -11050,89 +11039,8 @@ static int woal_priv_set_get_tx_rx_ant(moal_private *priv, t_u8 *respbuf,
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 			if (IS_CARD9098(priv->phandle->card_type) ||
 			    IS_CARD9097(priv->phandle->card_type)) {
-				if (IS_STA_OR_UAP_CFG80211(
-					    priv->phandle->params
-						    .cfg80211_wext) &&
-				    wiphy) {
-					if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
-						if (((radio->param.ant_cfg
-							      .tx_antenna &
-						      0xFF) != 3 &&
-						     (radio->param.ant_cfg
-							      .tx_antenna &
-						      0xFF) != 0) ||
-						    ((radio->param.ant_cfg
-							      .rx_antenna &
-						      0xFF) != 3 &&
-						     (radio->param.ant_cfg
-							      .rx_antenna &
-						      0xFF) != 0))
-							wiphy->bands[IEEE80211_BAND_2GHZ]
-								->ht_cap.mcs
-								.rx_mask[1] = 0;
-						else if ((radio->param.ant_cfg
-								  .tx_antenna &
-							  0xFF) == 3 ||
-							 (radio->param.ant_cfg
-								  .rx_antenna &
-							  0xFF) == 3)
-							wiphy->bands[IEEE80211_BAND_2GHZ]
-								->ht_cap.mcs
-								.rx_mask[1] =
-								0xff;
-						wiphy->bands[IEEE80211_BAND_2GHZ]
-							->ht_cap.mcs.rx_mask[4] =
-							0;
-					}
-					if (wiphy->bands[IEEE80211_BAND_5GHZ]) {
-						if (((radio->param.ant_cfg
-							      .tx_antenna &
-						      0xFF00) != 0x300 &&
-						     (radio->param.ant_cfg
-							      .tx_antenna &
-						      0xFF00) != 0) ||
-						    ((radio->param.ant_cfg
-							      .rx_antenna &
-						      0xFF00) != 0x300 &&
-						     (radio->param.ant_cfg
-							      .rx_antenna &
-						      0xFF00) != 0)) {
-							wiphy->bands[IEEE80211_BAND_5GHZ]
-								->ht_cap.mcs
-								.rx_mask[1] = 0;
-							wiphy->bands[IEEE80211_BAND_5GHZ]
-								->vht_cap
-								.vht_mcs
-								.rx_mcs_map =
-								0xfffe;
-							wiphy->bands[IEEE80211_BAND_5GHZ]
-								->vht_cap
-								.vht_mcs
-								.tx_mcs_map =
-								0xfffe;
-						} else if ((radio->param.ant_cfg
-								    .tx_antenna &
-							    0xFF00) == 0x300 ||
-							   (radio->param.ant_cfg
-								    .rx_antenna &
-							    0xFF00) == 0x300) {
-							wiphy->bands[IEEE80211_BAND_5GHZ]
-								->ht_cap.mcs
-								.rx_mask[1] =
-								0xff;
-							wiphy->bands[IEEE80211_BAND_5GHZ]
-								->vht_cap
-								.vht_mcs
-								.rx_mcs_map =
-								0xfffa;
-							wiphy->bands[IEEE80211_BAND_5GHZ]
-								->vht_cap
-								.vht_mcs
-								.tx_mcs_map =
-								0xfffa;
-						}
-					}
-				}
+				woal_cfg80211_notify_antcfg(
+					priv, priv->phandle->wiphy, radio);
 			}
 #endif
 		} else {
@@ -11212,7 +11120,7 @@ static int woal_priv_set_get_cwmode(moal_private *priv, t_u8 *respbuf,
 	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_CWMODE);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		ioctl_req->action = MLAN_ACT_GET;
 	} else {
@@ -11279,7 +11187,7 @@ static int woal_priv_ind_rst_cfg(moal_private *priv, t_u8 *respbuf,
 	misc->sub_command = MLAN_OID_MISC_IND_RST_CFG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -11358,7 +11266,7 @@ static int woal_priv_sysclock(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_SYSCLOCK);
 	memset(data, 0, sizeof(data));
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 	} else {
@@ -11481,7 +11389,7 @@ static int woal_priv_get_key(moal_private *priv, t_u8 *respbuf,
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_GET_KEY);
-	if (strlen(respbuf) != header_len) {
+	if ((int)strlen(respbuf) != header_len) {
 		PRINTM(MERROR, "Invalid number of parameters\n");
 		ret = -EINVAL;
 		goto done;
@@ -11600,14 +11508,14 @@ static int woal_priv_associate_ssid_bssid(moal_private *priv, t_u8 *respbuf,
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_ASSOCIATE);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		PRINTM(MERROR, "Invalid number of parameters\n");
 		ret = -EINVAL;
 		goto done;
 	}
 	copy_len = strlen(respbuf) - header_len;
 	mac_idx = 0;
-	buflen = MIN(copy_len, (sizeof(buf) - 1));
+	buflen = MIN(copy_len, (int)(sizeof(buf) - 1));
 	memset(buf, 0, sizeof(buf));
 	memset(&ssid_bssid, 0, sizeof(ssid_bssid));
 
@@ -11676,7 +11584,7 @@ static int woal_priv_associate_ssid_bssid(moal_private *priv, t_u8 *respbuf,
 
 done:
 	LEAVE();
-	return 0;
+	return ret;
 }
 
 /* Maximum input output characters in group WOAL_SET_GET_256_CHAR */
@@ -11721,7 +11629,7 @@ static int woal_priv_tx_bf_cfg(moal_private *priv, t_u8 *respbuf,
 	ENTER();
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_TX_BF_CFG);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		PRINTM(MERROR, "Invalid number of parameters\n");
 		ret = -EINVAL;
 		goto done;
@@ -11739,7 +11647,7 @@ static int woal_priv_tx_bf_cfg(moal_private *priv, t_u8 *respbuf,
 	copy_len = char_count;
 	memset(buf, 0, sizeof(buf));
 	if (char_count) {
-		if (copy_len > sizeof(buf)) {
+		if (copy_len > (int)sizeof(buf)) {
 			PRINTM(MERROR, "Too many arguments\n");
 			ret = -EINVAL;
 			goto done;
@@ -11974,7 +11882,7 @@ static int woal_priv_cmd53rdwr(moal_private *priv, t_u8 *respbuf,
 	int ret = 0;
 	t_u8 *buf = NULL;
 	t_u8 *data = NULL;
-	t_u8 rw, func, mode;
+	t_u8 rw, mode;
 	t_u16 blklen = 0, blknum = 0;
 	int reg = 0;
 	t_u32 pattern_len = 0, total_len = 0;
@@ -11997,7 +11905,6 @@ static int woal_priv_cmd53rdwr(moal_private *priv, t_u8 *respbuf,
 	buf = respbuf + header_len + sizeof(cmd_len);
 
 	rw = buf[0]; /* read/write (0/1) */
-	func = buf[1]; /* func (0/1/2) */
 	reg = buf[5]; /* address */
 	reg = (reg << 8) | buf[4];
 	reg = (reg << 8) | buf[3];
@@ -12020,9 +11927,9 @@ static int woal_priv_cmd53rdwr(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 	PRINTM(MINFO,
-	       "CMD53 read/write, func = %d, addr = %#x, mode = %d, "
+	       "CMD53 read/write, addr = %#x, mode = %d, "
 	       "block size = %d, block(byte) number = %d\n",
-	       func, reg, mode, blklen, blknum);
+	       reg, mode, blklen, blknum);
 
 	if (!rw) {
 		sdio_claim_host(
@@ -12045,7 +11952,7 @@ static int woal_priv_cmd53rdwr(moal_private *priv, t_u8 *respbuf,
 			pattern_len = total_len;
 
 		/* Copy/duplicate the pattern to data buffer */
-		for (pos = 0; pos < total_len; pos++)
+		for (pos = 0; pos < (int)total_len; pos++)
 			data[pos] = buf[11 + (pos % pattern_len)];
 		sdio_claim_host(
 			((struct sdio_mmc_card *)priv->phandle->card)->func);
@@ -12097,7 +12004,7 @@ static int woal_priv_port_ctrl(moal_private *priv, t_u8 *respbuf,
 	req->req_id = MLAN_IOCTL_SEC_CFG;
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_PORT_CTRL);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -12386,7 +12293,7 @@ static int woal_priv_bootsleep(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_BOOTSLEEP);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		req->action = MLAN_ACT_GET;
 	} else {
 		req->action = MLAN_ACT_SET;
@@ -12497,6 +12404,57 @@ done:
 }
 #endif
 
+/**
+ * @brief               Configure the hal/phy cfg params
+ *
+ *  The command structure contains the following parameters
+ *      dot11b_psd_mask: 1: enable, 0: disable
+ *      Reserved : reserved 7 params for future such use
+ *
+ *  @param priv    Pointer to the mlan_private driver data struct
+ *  @param respbuf      A pointer to response buffer
+ *  @param respbuflen   Available length of response buffer
+ *
+ *  @return         Number of bytes written if successful else negative value
+ */
+static int woal_priv_hal_phy_cfg_cmd(moal_private *priv, t_u8 *respbuf,
+				     t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *cfg = NULL;
+	int ret = 0;
+	mlan_ds_hal_phy_cfg_params *data_ptr;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	data_ptr = (mlan_ds_hal_phy_cfg_params *)respbuf;
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	cfg = (mlan_ds_misc_cfg *)req->pbuf;
+	cfg->sub_command = MLAN_OID_MISC_HAL_PHY_CFG;
+
+	cfg->param.hal_phy_cfg_params.dot11b_psd_mask_cfg =
+		data_ptr->dot11b_psd_mask_cfg;
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
 /**
  * @brief               configure 11ax HE capability or HE operation
  *
@@ -12513,13 +12471,11 @@ static int woal_priv_11axcfg_cmd(moal_private *priv, t_u8 *respbuf, t_u8 len,
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11ax_cfg *cfg = NULL;
-	mlan_ds_11ax_he_cfg *data_ptr = NULL;
 	int ret = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
 
-	data_ptr = (mlan_ds_11ax_he_cfg *)respbuf;
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11ax_cfg));
 	if (req == NULL) {
 		ret = -ENOMEM;
@@ -12700,7 +12656,7 @@ static int woal_priv_cfg_noa(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		moal_memcpy_ext(priv->phandle, respbuf, &noa_cfg,
 				sizeof(noa_cfg), respbuflen);
@@ -12790,7 +12746,7 @@ static int woal_priv_cfg_opp_ps(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		moal_memcpy_ext(priv->phandle, respbuf, &opp_ps_cfg,
 				sizeof(opp_ps_cfg), respbuflen);
@@ -12916,7 +12872,7 @@ static int woal_priv_dfs_repeater_cfg(moal_private *priv, t_u8 *respbuf,
 	dfs_repeater =
 		(mlan_ds_misc_dfs_repeater *)&misc_cfg->param.dfs_repeater;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -12994,7 +12950,7 @@ static int woal_priv_miracast_cfg(moal_private *priv, t_u8 *respbuf,
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_MIRACAST_CFG);
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		data[0] = priv->phandle->miracast_mode;
 		data[1] = priv->phandle->miracast_scan_time;
@@ -13042,7 +12998,8 @@ done:
  *
  *  @return             0 --success, otherwise failure
  */
-int woal_set_scan_chan_gap(moal_private *priv, t_u8 *respbuf, int respbuflen)
+static int woal_set_scan_chan_gap(moal_private *priv, t_u8 *respbuf,
+				  int respbuflen)
 {
 	t_u32 data[2];
 	int ret = 0;
@@ -13110,7 +13067,7 @@ static int woal_priv_coex_rx_winsize(moal_private *priv, t_u8 *respbuf,
 	cfg_11n = (mlan_ds_11n_cfg *)req->pbuf;
 	cfg_11n->sub_command = MLAN_OID_11N_CFG_COEX_RX_WINSIZE;
 
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -13157,6 +13114,146 @@ done:
 	return ret;
 }
 
+/**
+ * @brief               Set/Get control to TX AMPDU configuration on infra link
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_txaggrctrl(moal_private *priv, t_u8 *respbuf,
+				t_u32 respbuflen)
+{
+	int ret = 0;
+	int user_data_len = 0, header_len = 0, data = 0;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_11n_cfg *cfg_11n = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_TX_AGGR_CTRL);
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11n_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	req->req_id = MLAN_IOCTL_11N_CFG;
+	cfg_11n = (mlan_ds_11n_cfg *)req->pbuf;
+	cfg_11n->sub_command = MLAN_OID_11N_CFG_TX_AGGR_CTRL;
+
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		user_data_len = 0;
+		req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, &data,
+				sizeof(data) / sizeof(int), &user_data_len);
+		if (user_data_len != 1) {
+			PRINTM(MERROR, "Invalid number of args! %d\n",
+			       user_data_len);
+			ret = -EINVAL;
+			goto done;
+		}
+		if ((data != MTRUE) && (data != MFALSE)) {
+			PRINTM(MERROR, "Invalid txaggrctrl parameter %d\n",
+			       data);
+			ret = -EINVAL;
+			goto done;
+		}
+		cfg_11n->param.txaggrctrl = data;
+		req->action = MLAN_ACT_SET;
+	}
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!user_data_len) {
+		moal_memcpy_ext(priv->phandle, respbuf,
+				(t_u8 *)&cfg_11n->param.txaggrctrl,
+				sizeof(t_u32), respbuflen);
+		ret = sizeof(t_u32);
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Set/Get control to enable/disable auto TDLS
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_auto_tdls(moal_private *priv, t_u8 *respbuf,
+			       t_u32 respbuflen)
+{
+	int ret = 0;
+	int user_data_len = 0, header_len = 0, data = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_AUTO_TDLS);
+
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		data = priv->enable_auto_tdls;
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)&data,
+				sizeof(data), respbuflen);
+		ret = sizeof(data);
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, &data,
+				sizeof(data) / sizeof(int), &user_data_len);
+		if (user_data_len != 1) {
+			PRINTM(MERROR, "Invalid number of args! %d\n",
+			       user_data_len);
+			ret = -EINVAL;
+			goto done;
+		}
+		if ((data != MTRUE) && (data != MFALSE)) {
+			PRINTM(MERROR, "Invalid autotdls parameter %d\n", data);
+			ret = -EINVAL;
+			goto done;
+		}
+		priv->enable_auto_tdls = (t_u8)data;
+	}
+
+done:
+	LEAVE();
+	return ret;
+}
+
 #ifdef PCIE
 /**
  * @brief               Read/Write PCIE register
@@ -13181,7 +13278,7 @@ static int woal_priv_pcie_reg_rw(moal_private *priv, t_u8 *respbuf,
 
 	memset(data, 0, sizeof(data));
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_PCIE_REG_RW);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		PRINTM(MERROR, "Invalid number of parameters\n");
 		ret = -EINVAL;
 		goto done;
@@ -13242,7 +13339,7 @@ static int woal_priv_pcie_bar0_reg_rw(moal_private *priv, t_u8 *respbuf,
 
 	memset(data, 0, sizeof(data));
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_PCIE_BAR0_REG_RW);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		PRINTM(MERROR, "Invalid number of parameters\n");
 		ret = -EINVAL;
 		goto done;
@@ -13391,6 +13488,152 @@ done:
 #endif
 #endif
 
+/**
+ * @brief               Set/Get TDLS CS off channel value
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_tdls_cs_chan(moal_private *priv, t_u8 *respbuf,
+				  t_u32 respbuflen)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	int ret = 0;
+	int user_data_len = 0, header_len = 0, data = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_TDLS_CS_CHANNEL;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	header_len = strlen("TDLS_CS_CHAN");
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		ioctl_req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len + 1, &data,
+				sizeof(data) / sizeof(int), &user_data_len);
+		if (user_data_len != 1) {
+			PRINTM(MERROR, "Invalid number of args! %d\n",
+			       user_data_len);
+			ret = -EINVAL;
+			goto done;
+		}
+		ioctl_req->action = MLAN_ACT_SET;
+		misc->param.tdls_cs_channel = (t_u8)data;
+	}
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ret = sprintf(respbuf, "off channel %d\n",
+		      misc->param.tdls_cs_channel) +
+	      1;
+
+	PRINTM(MIOCTL, "tdls CS channel %d\n", misc->param.tdls_cs_channel);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+/**
+ * @brief               Set/Get TDLS idle timeout value
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_tdls_idle_time(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	int ret = 0;
+	int user_data_len = 0, header_len = 0, data = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_TDLS_IDLE_TIME;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_TDLS_IDLE_TIME);
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		ioctl_req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, &data,
+				sizeof(data) / sizeof(int), &user_data_len);
+		if (user_data_len != 1) {
+			PRINTM(MERROR, "Invalid number of args! %d\n",
+			       user_data_len);
+			ret = -EINVAL;
+			goto done;
+		}
+		ioctl_req->action = MLAN_ACT_SET;
+		misc->param.tdls_idle_time = (t_u16)data;
+	}
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	moal_memcpy_ext(priv->phandle, respbuf,
+			(t_u8 *)&misc->param.tdls_idle_time, sizeof(t_u16),
+			respbuflen);
+	ret = sizeof(t_u16);
+
+	PRINTM(MIOCTL, "tdls idle time %d\n", misc->param.tdls_idle_time);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
 /**
  * @brief               Set/Get dynamic bandwidth
  *
@@ -13428,7 +13671,7 @@ static int woal_priv_config_dyn_bw(moal_private *priv, t_u8 *respbuf,
 	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
 
 	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_DYN_BW);
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		ioctl_req->action = MLAN_ACT_GET;
 	} else {
@@ -13721,7 +13964,6 @@ static int woal_priv_config_random_mac(moal_private *priv, t_u8 *respbuf,
 	int header_len = 0, space_len = 0, i;
 	t_u8 rand_data[3];
 	const t_u8 zero_mac[MLAN_MAC_ADDR_LENGTH] = {0, 0, 0, 0, 0, 0};
-	char fakemac_sts[16];
 
 	ENTER();
 
@@ -13732,8 +13974,8 @@ static int woal_priv_config_random_mac(moal_private *priv, t_u8 *respbuf,
 	}
 
 	header_len = strlen("FAKEMAC");
-	if (strlen(respbuf) >= header_len) {
-		for (i = 0; i < (strlen(respbuf) - header_len - 1); i++) {
+	if ((int)strlen(respbuf) >= header_len) {
+		for (i = 0; i < (int)(strlen(respbuf) - header_len - 1); i++) {
 			if (respbuf[header_len + 1 + i] != ' ')
 				break;
 		}
@@ -13754,9 +13996,11 @@ static int woal_priv_config_random_mac(moal_private *priv, t_u8 *respbuf,
 			get_random_bytes(rand_data, 3);
 			moal_memcpy_ext(priv->phandle, priv->random_mac + 3,
 					rand_data, 3, 3);
+			PRINTM(MMSG, "FAKEMAC parameter is On\n");
 		} else if (strncmp(respbuf + header_len + 1 + space_len, "Off",
 				   strlen("Off")) == 0) {
 			memset(priv->random_mac, 0, ETH_ALEN);
+			PRINTM(MMSG, "FAKEMAC parameter is Off\n");
 		} else {
 			PRINTM(MERROR, "Invalid parameter!\n");
 			ret = -EINVAL;
@@ -13768,15 +14012,6 @@ static int woal_priv_config_random_mac(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 
-	memset(fakemac_sts, 0, sizeof(fakemac_sts));
-	snprintf(fakemac_sts, sizeof(fakemac_sts), "%s",
-		 (respbuf + header_len + 1 + space_len));
-	ret = snprintf(respbuf, respbuflen, "FAKEMAC parameter is %s\n",
-		       fakemac_sts) +
-	      1;
-	PRINTM(MMSG, "FAKEMAC parameter is %s\n",
-	       (t_u8 *)(respbuf + header_len + 1 + space_len));
-
 done:
 	LEAVE();
 	return ret;
@@ -14107,7 +14342,8 @@ static int woal_priv_cloud_keep_alive(moal_private *priv, t_u8 *respbuf,
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_rx_abort_cfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_rx_abort_cfg(moal_private *priv, t_u8 *respbuf,
+				  t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -14137,7 +14373,7 @@ int woal_priv_rx_abort_cfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_RX_ABORT_CFG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -14190,8 +14426,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
-			       t_u32 respbuflen)
+static int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -14221,7 +14457,7 @@ int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_RX_ABORT_CFG_EXT;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -14287,8 +14523,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_dot11mc_unassoc_ftm_cfg(moal_private *priv, t_u8 *respbuf,
-				      t_u32 respbuflen)
+static int woal_priv_dot11mc_unassoc_ftm_cfg(moal_private *priv, t_u8 *respbuf,
+					     t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -14318,7 +14554,7 @@ int woal_priv_dot11mc_unassoc_ftm_cfg(moal_private *priv, t_u8 *respbuf,
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_DOT11MC_UNASSOC_FTM_CFG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -14367,8 +14603,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_tx_ampdu_prot_mode(moal_private *priv, t_u8 *respbuf,
-				 t_u32 respbuflen)
+static int woal_priv_tx_ampdu_prot_mode(moal_private *priv, t_u8 *respbuf,
+					t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -14398,7 +14634,7 @@ int woal_priv_tx_ampdu_prot_mode(moal_private *priv, t_u8 *respbuf,
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_TX_AMPDU_PROT_MODE;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -14447,8 +14683,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_rate_adapt_cfg(moal_private *priv, t_u8 *respbuf,
-			     t_u32 respbuflen)
+static int woal_priv_rate_adapt_cfg(moal_private *priv, t_u8 *respbuf,
+				    t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -14478,7 +14714,7 @@ int woal_priv_rate_adapt_cfg(moal_private *priv, t_u8 *respbuf,
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_RATE_ADAPT_CFG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -14553,8 +14789,8 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_cck_desense_cfg(moal_private *priv, t_u8 *respbuf,
-			      t_u32 respbuflen)
+static int woal_priv_cck_desense_cfg(moal_private *priv, t_u8 *respbuf,
+				     t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -14584,7 +14820,7 @@ int woal_priv_cck_desense_cfg(moal_private *priv, t_u8 *respbuf,
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_CCK_DESENSE_CFG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -14705,7 +14941,7 @@ static int woal_priv_set_get_lpm(moal_private *priv, t_u8 *respbuf,
 	if (IS_CARD9098(priv->phandle->card_type) ||
 	    IS_CARD9097(priv->phandle->card_type)) {
 		header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_LPM);
-		if (strlen(respbuf) == header_len) {
+		if ((int)strlen(respbuf) == header_len) {
 			/* GET operation */
 			user_data_len = 0;
 		} else {
@@ -14765,7 +15001,7 @@ done:
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_arbcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_arbcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -14794,7 +15030,7 @@ int woal_priv_arbcfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	misc = (mlan_ds_misc_cfg *)req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_ARB_CONFIG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
-	if (strlen(respbuf) == header_len) {
+	if ((int)strlen(respbuf) == header_len) {
 		/* GET operation */
 		user_data_len = 0;
 		req->action = MLAN_ACT_GET;
@@ -14856,6 +15092,11 @@ void woal_tp_acnt_timer_func(void *context)
 			phandle->tp_acnt.tx_bytes_last[i];
 		phandle->tp_acnt.tx_bytes_last[i] =
 			phandle->tp_acnt.tx_bytes[i];
+		phandle->tp_acnt.tx_packets_rate[i] =
+			phandle->tp_acnt.tx_packets[i] -
+			phandle->tp_acnt.tx_packets_last[i];
+		phandle->tp_acnt.tx_packets_last[i] =
+			phandle->tp_acnt.tx_packets[i];
 	}
 	phandle->tp_acnt.tx_pending = atomic_read(&phandle->tx_pending);
 	/* Tx Interrupt accounting */
@@ -14870,12 +15111,36 @@ void woal_tp_acnt_timer_func(void *context)
 			phandle->tp_acnt.rx_bytes_last[i];
 		phandle->tp_acnt.rx_bytes_last[i] =
 			phandle->tp_acnt.rx_bytes[i];
+		phandle->tp_acnt.rx_packets_rate[i] =
+			phandle->tp_acnt.rx_packets[i] -
+			phandle->tp_acnt.rx_packets_last[i];
+		phandle->tp_acnt.rx_packets_last[i] =
+			phandle->tp_acnt.rx_packets[i];
 	}
 	phandle->tp_acnt.rx_pending = atomic_read(&phandle->rx_pending);
 	// Interrupt accounting, RX
 	phandle->tp_acnt.rx_intr_rate =
 		phandle->tp_acnt.rx_intr_cnt - phandle->tp_acnt.rx_intr_last;
 	phandle->tp_acnt.rx_intr_last = phandle->tp_acnt.rx_intr_cnt;
+	phandle->tp_acnt.rx_amsdu_cnt_rate = phandle->tp_acnt.rx_amsdu_cnt -
+					     phandle->tp_acnt.rx_amsdu_cnt_last;
+	phandle->tp_acnt.rx_amsdu_cnt_last = phandle->tp_acnt.rx_amsdu_cnt;
+
+	phandle->tp_acnt.rx_amsdu_pkt_cnt_rate =
+		phandle->tp_acnt.rx_amsdu_pkt_cnt -
+		phandle->tp_acnt.rx_amsdu_pkt_cnt_last;
+	phandle->tp_acnt.rx_amsdu_pkt_cnt_last =
+		phandle->tp_acnt.rx_amsdu_pkt_cnt;
+
+	phandle->tp_acnt.tx_amsdu_cnt_rate = phandle->tp_acnt.tx_amsdu_cnt -
+					     phandle->tp_acnt.tx_amsdu_cnt_last;
+	phandle->tp_acnt.tx_amsdu_cnt_last = phandle->tp_acnt.tx_amsdu_cnt;
+
+	phandle->tp_acnt.tx_amsdu_pkt_cnt_rate =
+		phandle->tp_acnt.tx_amsdu_pkt_cnt -
+		phandle->tp_acnt.tx_amsdu_pkt_cnt_last;
+	phandle->tp_acnt.tx_amsdu_pkt_cnt_last =
+		phandle->tp_acnt.tx_amsdu_pkt_cnt;
 
 	/* re-arm timer */
 	woal_mod_timer(&phandle->tp_acnt.timer, 1000);
@@ -14920,7 +15185,8 @@ void woal_set_tp_state(moal_private *priv)
  *
  *  @return             Number of bytes written, negative for failure.
  */
-int woal_priv_set_tp_state(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
+static int woal_priv_set_tp_state(moal_private *priv, t_u8 *respbuf,
+				  t_u32 respbuflen)
 {
 	moal_handle *handle = priv->phandle;
 	int ret = 0;
@@ -15004,7 +15270,9 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 	int len = 0;
 	gfp_t flag;
 	char *cmd_buf = NULL;
+#if defined(STA_CFG80211) && defined(UAP_CFG80211)
 	int cfg80211_wext;
+#endif
 
 	ENTER();
 	if (!priv || !priv->phandle) {
@@ -15012,13 +15280,15 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		ret = -EFAULT;
 		goto done;
 	}
+#if defined(STA_CFG80211) && defined(UAP_CFG80211)
 	cfg80211_wext = priv->phandle->params.cfg80211_wext;
+#endif
 	if (copy_from_user(&priv_cmd, req->ifr_data,
 			   sizeof(android_wifi_priv_cmd))) {
 		ret = -EFAULT;
 		goto done;
 	}
-#define CMD_BUF_LEN 3072
+#define CMD_BUF_LEN 4096
 	if (priv_cmd.used_len < 0 || priv_cmd.total_len <= 0 ||
 	    priv_cmd.used_len > priv_cmd.total_len) {
 		PRINTM(MERROR,
@@ -15043,7 +15313,8 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 #else
 	cmd_buf = priv_cmd.buf;
 #endif
-	if (copy_from_user(buf, cmd_buf, priv_cmd.total_len)) {
+	if (copy_from_user(buf, (const void __user *)cmd_buf,
+			   priv_cmd.total_len)) {
 		ret = -EFAULT;
 		goto done;
 	}
@@ -15573,6 +15844,15 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 						priv_cmd.total_len);
 			goto handled;
 #endif
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_HAL_PHY_CFG,
+				    strlen(PRIV_CMD_HAL_PHY_CFG)) == 0) {
+			/* Set hal_phy config */
+			pdata = buf + strlen(CMD_NXP) +
+				strlen(PRIV_CMD_HAL_PHY_CFG);
+			len = priv_cmd.total_len -
+			      strlen(PRIV_CMD_HAL_PHY_CFG) - strlen(CMD_NXP);
+			len = woal_priv_hal_phy_cfg_cmd(priv, pdata, len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_AUTO_ARP,
 				    strlen(PRIV_CMD_AUTO_ARP)) == 0) {
 			/* Auto ARP enable/disable */
@@ -15989,6 +16269,19 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			len = woal_priv_coex_rx_winsize(priv, buf,
 							priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_TX_AGGR_CTRL,
+				    strlen(PRIV_CMD_TX_AGGR_CTRL)) == 0) {
+			/* Set/Get control to TX AMPDU on infra link */
+			len = woal_priv_txaggrctrl(priv, buf,
+						   priv_cmd.total_len);
+			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_AUTO_TDLS,
+				    strlen(PRIV_CMD_AUTO_TDLS)) == 0) {
+			/* Set/Get control to enable/disable auto TDLS */
+			len = woal_priv_auto_tdls(priv, buf,
+						  priv_cmd.total_len);
+			goto handled;
 #ifdef PCIE
 		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_PCIE_REG_RW,
 				    strlen(PRIV_CMD_PCIE_REG_RW)) == 0) {
@@ -16004,6 +16297,13 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 							 priv_cmd.total_len);
 			goto handled;
 #endif
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_TDLS_IDLE_TIME,
+				    strlen(PRIV_CMD_TDLS_IDLE_TIME)) == 0) {
+			/* Set/Get TDLS idle timeout value */
+			len = woal_priv_tdls_idle_time(priv, buf,
+						       priv_cmd.total_len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_GET_SENSOR_TEMP,
 				    strlen(PRIV_CMD_GET_SENSOR_TEMP)) == 0) {
@@ -16264,7 +16564,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 				buf + strlen("COUNTRY") + 1, copy_len,
 				COUNTRY_CODE_LEN);
 		PRINTM(MIOCTL, "Set COUNTRY %s\n", country_code);
-		if (moal_extflg_isset(priv->phandle, EXT_CNTRY_TXPWR)) {
+		if (priv->phandle->params.cntry_txpwr) {
 			if (MLAN_STATUS_SUCCESS !=
 			    woal_request_country_power_table(priv,
 							     country_code)) {
@@ -16331,7 +16631,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			goto done;
 		len = sprintf(buf, "OK\n") + 1;
 	} else if (strncmp(buf, "AP_SET_CFG", strlen("AP_SET_CFG")) == 0) {
-		if (priv_cmd.total_len <= strlen("AP_SET_CFG") + 1)
+		if (priv_cmd.total_len <= (int)strlen("AP_SET_CFG") + 1)
 			goto done;
 		pdata = buf + strlen("AP_SET_CFG") + 1;
 		ret = woal_uap_set_ap_cfg(priv, pdata,
@@ -16563,6 +16863,8 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 	else if (strncmp(buf, "WLS_BATCHING", strlen("WLS_BATCHING")) == 0) {
 		/* TODO */
 		len = sprintf(buf, "OK\n") + 1;
+	} else if (strncmp(buf, "TDLS_CS_CHAN", strlen("TDLS_CS_CHAN")) == 0) {
+		len = woal_priv_tdls_cs_chan(priv, buf, priv_cmd.total_len);
 	}
 #if defined(UAP_SUPPORT)
 	else if (strncmp(buf, "P2P_ECSA", strlen("P2P_ECSA")) == 0) {
@@ -16605,7 +16907,8 @@ handled:
 		if (priv_cmd.used_len <= priv_cmd.total_len) {
 			memset(buf + priv_cmd.used_len, 0,
 			       (size_t)(CMD_BUF_LEN - priv_cmd.used_len));
-			if (copy_to_user(cmd_buf, buf, priv_cmd.total_len)) {
+			if (copy_to_user((void __user *)cmd_buf, buf,
+					 priv_cmd.total_len)) {
 				PRINTM(MERROR,
 				       "%s: failed to copy data to user buffer\n",
 				       __FUNCTION__);
@@ -16871,6 +17174,9 @@ int woal_do_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
 	case WOAL_MGMT_FRAME_TX:
 		ret = woal_send_host_packet(dev, req);
 		break;
+	case WOAL_TDLS_CONFIG:
+		ret = woal_tdls_config_ioctl(dev, req);
+		break;
 	case WOAL_ANDROID_PRIV_CMD:
 		ret = woal_android_priv_cmd(dev, req);
 		break;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h
index ca4ca25..96a8eba 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h
@@ -4,7 +4,7 @@
  * @brief This file contains definition for private IOCTL call.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -242,6 +242,8 @@ typedef struct _chan_stats {
 #endif
 #endif
 #define PRIV_CMD_COEX_RX_WINSIZE "coex_rx_winsize"
+#define PRIV_CMD_TX_AGGR_CTRL "txaggrctrl"
+#define PRIV_CMD_AUTO_TDLS "autotdls"
 
 #ifdef PCIE
 #define PRIV_CMD_PCIE_REG_RW "pcieregrw"
@@ -257,6 +259,8 @@ typedef struct _chan_stats {
 #define PRIV_CMD_EXTEND_CHAN_SWITCH "channel_switch"
 #endif
 
+#define PRIV_CMD_TDLS_IDLE_TIME "tdls_idle_time"
+
 #define PRIV_CMD_DYN_BW "dyn_bw"
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
@@ -294,10 +298,14 @@ typedef struct _chan_stats {
 /**Private command to configure cck desense config */
 #define PRIV_CMD_CCK_DESENSE_CFG "cck_desense_cfg"
 #define PRIV_CMD_DOT11MC_UNASSOC_FTM_CFG "dot11mc_unassoc_ftm_cfg"
+#define PRIV_CMD_HAL_PHY_CFG "hal_phy_cfg"
 
 /** Private command ID for Android default commands */
 #define WOAL_ANDROID_DEF_CMD (SIOCDEVPRIVATE + 1)
 
+/** Private command ID to send TLD configuration */
+#define WOAL_TDLS_CONFIG (SIOCDEVPRIVATE + 5)
+
 /** Private command ID to pass mgmt frame */
 #define WOAL_MGMT_FRAME_TX WOAL_MGMT_FRAME_TX_IOCTL
 
@@ -592,8 +600,6 @@ typedef struct woal_priv_esuppmode_cfg {
 } woal_esuppmode_cfg;
 
 mlan_status woal_set_ap_wps_p2p_ie(moal_private *priv, t_u8 *ie, size_t len);
-mlan_status woal_ioctl_aggr_prio_tbl(moal_private *priv, t_u32 action,
-				     mlan_ds_11n_aggr_prio_tbl *aggr_prio_tbl);
 
 int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req);
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_init.c b/mxm_wifiex/wlan_src/mlinux/moal_init.c
index 86cd3f7..81de4f5 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_init.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_init.c
@@ -4,7 +4,7 @@
  * driver.
  *
  *
- * Copyright 2018-2020 NXP
+ * Copyright 2018-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -26,14 +26,14 @@
 extern pmoal_handle m_handle[];
 
 /** Firmware name */
-char *fw_name;
-int req_fw_nowait;
+static char *fw_name;
+static int req_fw_nowait;
 int fw_reload;
 
 /** MAC address */
-char *mac_addr;
+static char *mac_addr;
 /** Module param cfg file */
-char *mod_para;
+static char *mod_para;
 
 #ifdef MFG_CMD_SUPPORT
 /** Mfg mode */
@@ -42,138 +42,133 @@ int mfg_mode;
 
 #if defined(SDIO)
 /** SDIO interrupt mode (0: INT_MODE_SDIO, 1: INT_MODE_GPIO) */
-int intmode = INT_MODE_SDIO;
+static int intmode = INT_MODE_SDIO;
 /** GPIO interrupt pin number */
-int gpiopin;
+static int gpiopin;
 #endif
 
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
-int disable_regd_by_driver = 1;
+static int disable_regd_by_driver = 1;
 /** Region alpha2 string */
-char *reg_alpha2;
+static char *reg_alpha2;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-int country_ie_ignore;
-int beacon_hints;
+static int country_ie_ignore;
+static int beacon_hints;
 #endif
 #endif
 
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
-int host_mlme;
+static int host_mlme;
 #endif
 #endif
 
 /** Auto deep sleep */
-int auto_ds;
+static int auto_ds;
 
 /** IEEE PS mode */
-int ps_mode;
+static int ps_mode;
 /** passive to active scan */
-int p2a_scan;
+static int p2a_scan;
 /** scan chan gap */
-int scan_chan_gap;
+static int scan_chan_gap;
 /** Max Tx buffer size */
 int max_tx_buf;
 
 #ifdef STA_SUPPORT
 /** Max STA interfaces */
-int max_sta_bss = DEF_STA_BSS;
+static int max_sta_bss = DEF_STA_BSS;
 /** STA interface name */
-char *sta_name;
+static char *sta_name;
 #endif
 
 #ifdef UAP_SUPPORT
 /** Max uAP interfaces */
-int max_uap_bss = DEF_UAP_BSS;
+static int max_uap_bss = DEF_UAP_BSS;
 /** uAP interface name */
-char *uap_name;
+static char *uap_name;
 /** Max uAP station number */
-int uap_max_sta;
+static int uap_max_sta;
 #endif
 
 #ifdef WIFI_DIRECT_SUPPORT
 /** Max WIFIDIRECT interfaces */
-int max_wfd_bss = DEF_WIFIDIRECT_BSS;
+static int max_wfd_bss = DEF_WIFIDIRECT_BSS;
 /** WIFIDIRECT interface name */
-char *wfd_name;
+static char *wfd_name;
 #if defined(STA_CFG80211) && defined(UAP_CFG80211)
 /** max VIRTUAL bss */
-int max_vir_bss = DEF_VIRTUAL_BSS;
+static int max_vir_bss = DEF_VIRTUAL_BSS;
 #endif
 #endif
 
-#ifdef SDIO_SUSPEND_RESUME
 /** PM keep power */
-int pm_keep_power = 1;
+static int pm_keep_power = 1;
+#ifdef SDIO_SUSPEND_RESUME
 /** HS when shutdown */
-int shutdown_hs;
+static int shutdown_hs;
 #endif
 
 #if defined(SDIO)
 /** SDIO slew rate */
-int slew_rate = 3;
+static int slew_rate = 3;
 #endif
 int tx_work = 0;
+static int rps = 0;
 
 #if defined(STA_SUPPORT)
 /** 802.11d configuration */
-int cfg_11d;
+static int cfg_11d;
 #endif
 
 /** fw serial download check */
-int fw_serial = 1;
+static int fw_serial = 1;
 
 /** napi support*/
-int napi;
+static int napi;
 
 /** DPD data config file */
-char *dpd_data_cfg;
+static char *dpd_data_cfg;
 
 /** CAL data config file */
-char *cal_data_cfg;
+static char *cal_data_cfg;
 /** Init config file (MAC address, register etc.) */
-char *init_cfg;
+static char *init_cfg;
 
 /** Set configuration data of Tx power limitation */
-char *txpwrlimit_cfg;
+static char *txpwrlimit_cfg;
 /** Allow setting tx power table of country */
-int cntry_txpwr;
+static int cntry_txpwr;
 
 /** Init hostcmd file */
-char *init_hostcmd_cfg;
-char *band_steer_cfg;
+static char *init_hostcmd_cfg;
+static char *band_steer_cfg;
 
 #if defined(STA_WEXT) || defined(UAP_WEXT)
 /** CFG80211 and WEXT mode */
-int cfg80211_wext = STA_WEXT_MASK | UAP_WEXT_MASK;
+static int cfg80211_wext = STA_WEXT_MASK | UAP_WEXT_MASK;
 #else
 /** CFG80211 mode */
-int cfg80211_wext = STA_CFG80211_MASK | UAP_CFG80211_MASK;
-#endif
-
-#if defined(STA_CFG80211) || defined(UAP_CFG80211)
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-int fw_region = 1;
-#endif
+static int cfg80211_wext = STA_CFG80211_MASK | UAP_CFG80211_MASK;
 #endif
 
 /** Work queue priority */
-int wq_sched_prio;
+static int wq_sched_prio;
 /** Work queue scheduling policy */
-int wq_sched_policy = SCHED_NORMAL;
+static int wq_sched_policy = SCHED_NORMAL;
 /** rx_work flag */
-int rx_work;
+static int rx_work;
 
 #if defined(USB)
 int skip_fwdnld;
 #endif
 
 /* Enable/disable aggrctrl */
-int aggrctrl;
+static int aggrctrl;
 
 #ifdef USB
 /* Enable/disable USB aggregation feature */
-int usb_aggr;
+static int usb_aggr;
 #endif
 
 #ifdef PCIE
@@ -181,68 +176,66 @@ int usb_aggr;
 int pcie_int_mode = PCIE_INT_MODE_MSI;
 #endif /* PCIE */
 
-int low_power_mode_enable;
+static int low_power_mode_enable;
 
-int hw_test;
+static int hw_test;
 
 #ifdef CONFIG_OF
 int dts_enable = 1;
 #endif
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-int dfs_offload;
+static int dfs_offload;
 #endif
 
-#ifdef ANDROID_KERNEL
 int wakelock_timeout = WAKE_LOCK_TIMEOUT;
-#endif
 
 #if defined(STA_SUPPORT) && defined(UAP_SUPPORT)
 #ifdef WIFI_DIRECT_SUPPORT
-int drv_mode = (DRV_MODE_STA | DRV_MODE_UAP | DRV_MODE_WIFIDIRECT);
+static int drv_mode = (DRV_MODE_STA | DRV_MODE_UAP | DRV_MODE_WIFIDIRECT);
 #else
-int drv_mode = (DRV_MODE_STA | DRV_MODE_UAP);
+static int drv_mode = (DRV_MODE_STA | DRV_MODE_UAP);
 #endif /* WIFI_DIRECT_SUPPORT */
 #else
 #ifdef STA_SUPPORT
-int drv_mode = DRV_MODE_STA;
+static int drv_mode = DRV_MODE_STA;
 #else
-int drv_mode = DRV_MODE_UAP;
+static int drv_mode = DRV_MODE_UAP;
 #endif /* STA_SUPPORT */
 #endif /* STA_SUPPORT & UAP_SUPPORT */
 
-int gtk_rekey_offload = GTK_REKEY_OFFLOAD_DISABLE;
+static int gtk_rekey_offload = GTK_REKEY_OFFLOAD_DISABLE;
 
-int pmic;
+static int pmic;
 
-int antcfg;
+static int antcfg;
 
-t_u32 uap_oper_ctrl;
+static t_u32 uap_oper_ctrl;
 
-int hs_wake_interval = 400;
-int indication_gpio = 0xff;
-int disconnect_on_suspend;
-int hs_mimo_switch;
+static int hs_wake_interval = 400;
+static int indication_gpio = 0xff;
+static int disconnect_on_suspend;
+static int hs_mimo_switch;
 
-int indrstcfg = 0xffffffff;
+static int indrstcfg = 0xffffffff;
 
 /** all the feature are enabled */
 #define DEFAULT_DEV_CAP_MASK 0xffffffff
-t_u32 dev_cap_mask = DEFAULT_DEV_CAP_MASK;
+static t_u32 dev_cap_mask = DEFAULT_DEV_CAP_MASK;
 #ifdef SDIO
-int sdio_rx_aggr = MTRUE;
+static int sdio_rx_aggr = MTRUE;
 #endif
 
 /** The global variable of scan beacon buffer **/
-int fixed_beacon_buffer;
+static int fixed_beacon_buffer;
 
 #ifdef WIFI_DIRECT_SUPPORT
-int GoAgeoutTime;
+static int GoAgeoutTime;
 #endif
 
-t_u16 multi_dtim;
+static t_u16 multi_dtim;
 
-t_u16 inact_tmo;
+static t_u16 inact_tmo;
 
 #ifdef DEBUG_LEVEL1
 #ifdef DEBUG_LEVEL2
@@ -308,7 +301,7 @@ static card_type_entry card_type_map_tbl[] = {
 #endif
 };
 
-int dfs53cfg = DFS_W53_DEFAULT_FW;
+static int dfs53cfg = DFS_W53_DEFAULT_FW;
 
 /**
  *  @brief This function read a line in module parameter file
@@ -325,7 +318,7 @@ static t_size parse_cfg_get_line(t_u8 *data, t_size size, t_u8 *line_pos)
 
 	ENTER();
 
-	if (pos >= size) { /* reach the end */
+	if (pos >= (t_s32)size) { /* reach the end */
 		pos = 0; /* Reset position for rfkill */
 		LEAVE();
 		return -1;
@@ -334,7 +327,7 @@ static t_size parse_cfg_get_line(t_u8 *data, t_size size, t_u8 *line_pos)
 	src = data + pos;
 	dest = line_pos;
 
-	while (pos < size && *src != '\x0A' && *src != '\0') {
+	while (pos < (t_s32)size && *src != '\x0A' && *src != '\0') {
 		if (*src != ' ' && *src != '\t') /* parse space */
 			*dest++ = *src++;
 		else
@@ -499,12 +492,12 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 	moal_mod_para *params = &handle->params;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
-	while (parse_cfg_get_line(data, size, line) != -1) {
+	while ((int)parse_cfg_get_line(data, size, line) != -1) {
 		if (strncmp(line, "}", strlen("}")) == 0) {
 			end = 1;
 			break;
 		}
-		if (end == 0 && strstr(line, "{") != 0)
+		if (end == 0 && strstr(line, "{") != NULL)
 			break;
 		if (strncmp(line, "hw_test", strlen("hw_test")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
@@ -701,7 +694,6 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			PRINTM(MMSG, "gpiopin = %d\n", params->gpiopin);
 		}
 #endif
-#if defined(SDIO) && defined(SDIO_SUSPEND_RESUME)
 		else if (strncmp(line, "pm_keep_power",
 				 strlen("pm_keep_power")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
@@ -715,8 +707,10 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			       moal_extflg_isset(handle, EXT_PM_KEEP_POWER) ?
 				       "on" :
 				       "off");
-		} else if (strncmp(line, "shutdown_hs",
-				   strlen("shutdown_hs")) == 0) {
+		}
+#if defined(SDIO) && defined(SDIO_SUSPEND_RESUME)
+		else if (strncmp(line, "shutdown_hs", strlen("shutdown_hs")) ==
+			 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
@@ -781,14 +775,8 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
-			if (out_data)
-				moal_extflg_set(handle, EXT_CNTRY_TXPWR);
-			else
-				moal_extflg_clear(handle, EXT_CNTRY_TXPWR);
-			PRINTM(MMSG, "cntry_txpwr %s\n",
-			       moal_extflg_isset(handle, EXT_CNTRY_TXPWR) ?
-				       "on" :
-				       "off");
+			params->cntry_txpwr = out_data;
+			PRINTM(MMSG, "cntry_txpwr = %d\n", params->cntry_txpwr);
 		} else if (strncmp(line, "init_hostcmd_cfg",
 				   strlen("init_hostcmd_cfg")) == 0) {
 			if (parse_line_read_string(line, &out_str) !=
@@ -901,20 +889,16 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			       moal_extflg_isset(handle, EXT_LOW_PW_MODE) ?
 				       "on" :
 				       "off");
-		}
-#ifdef ANDROID_KERNEL
-		else if (strncmp(line, "wakelock_timeout",
-				 strlen("wakelock_timeout")) == 0) {
+		} else if (strncmp(line, "wakelock_timeout",
+				   strlen("wakelock_timeout")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
 			params->wakelock_timeout = out_data;
 			PRINTM(MMSG, "wakelock_timeout=%d\n",
 			       params->wakelock_timeout);
-		}
-#endif
-		else if (strncmp(line, "dev_cap_mask",
-				 strlen("dev_cap_mask")) == 0) {
+		} else if (strncmp(line, "dev_cap_mask",
+				   strlen("dev_cap_mask")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
 				goto err;
@@ -940,8 +924,7 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 #if defined(SD8997) || defined(PCIE8997) || defined(USB8997) ||                \
 	defined(SD8977) || defined(SD8987) || defined(SD9098) ||               \
 	defined(USB9098) || defined(PCIE9098) || defined(SD9097) ||            \
-	defined(USB9097) || defined(PCIE9097) || defined(SD8978) ||            \
-	defined(USB8978)
+	defined(USB9097) || defined(PCIE9097) || defined(SD8978)
 		else if (strncmp(line, "pmic", strlen("pmic")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
@@ -1089,6 +1072,17 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			PRINTM(MMSG, "tx_work %s\n",
 			       moal_extflg_isset(handle, EXT_TX_WORK) ? "on" :
 									"off");
+		} else if (strncmp(line, "rps", strlen("rps")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			if (out_data)
+				moal_extflg_set(handle, EXT_RPS);
+			else
+				moal_extflg_clear(handle, EXT_RPS);
+			PRINTM(MMSG, "rps %s\n",
+			       moal_extflg_isset(handle, EXT_RPS) ? "on" :
+								    "off");
 		}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 		else if (strncmp(line, "dfs_offload", strlen("dfs_offload")) ==
@@ -1121,8 +1115,8 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			PRINTM(MMSG, "reg domain set by driver=%s\n",
 			       moal_extflg_isset(handle,
 						 EXT_DISABLE_REGD_BY_DRIVER) ?
-				       "disable" :
-				       "enable");
+				       "enable" :
+				       "disable");
 		} else if (strncmp(line, "reg_alpha2", strlen("reg_alpha2")) ==
 			   0) {
 			if (parse_line_read_string(line, &out_str) !=
@@ -1158,8 +1152,8 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 				moal_extflg_clear(handle, EXT_BEACON_HINTS);
 			PRINTM(MMSG, "beacon_hints=%s\n",
 			       moal_extflg_isset(handle, EXT_BEACON_HINTS) ?
-				       "disable" :
-				       "enable");
+				       "enable" :
+				       "disable");
 		}
 #endif
 #endif
@@ -1185,8 +1179,8 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 				moal_extflg_clear(handle, EXT_HOST_MLME);
 			PRINTM(MMSG, "host_mlme=%s\n",
 			       moal_extflg_isset(handle, EXT_HOST_MLME) ?
-				       "disable" :
-				       "enable");
+				       "enable" :
+				       "disable");
 		}
 #endif
 #endif
@@ -1300,9 +1294,9 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 	if (params)
 		handle->params.gpiopin = params->gpiopin;
 #endif
-#if defined(SDIO) && defined(SDIO_SUSPEND_RESUME)
 	if (pm_keep_power)
 		moal_extflg_set(handle, EXT_PM_KEEP_POWER);
+#if defined(SDIO) && defined(SDIO_SUSPEND_RESUME)
 	if (shutdown_hs)
 		moal_extflg_set(handle, EXT_SHUTDOWN_HS);
 #endif
@@ -1313,6 +1307,8 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 #endif
 #if defined(SDIO)
 	handle->params.slew_rate = slew_rate;
+	if (params)
+		handle->params.slew_rate = params->slew_rate;
 #endif
 	woal_dup_string(&handle->params.dpd_data_cfg, dpd_data_cfg);
 	if (params)
@@ -1329,8 +1325,9 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 	if (params)
 		woal_dup_string(&handle->params.txpwrlimit_cfg,
 				params->txpwrlimit_cfg);
-	if (cntry_txpwr)
-		moal_extflg_set(handle, EXT_CNTRY_TXPWR);
+	handle->params.cntry_txpwr = cntry_txpwr;
+	if (params)
+		handle->params.cntry_txpwr = params->cntry_txpwr;
 	woal_dup_string(&handle->params.init_hostcmd_cfg, init_hostcmd_cfg);
 	if (params)
 		woal_dup_string(&handle->params.init_hostcmd_cfg,
@@ -1370,11 +1367,9 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 	if (low_power_mode_enable)
 		moal_extflg_set(handle, EXT_LOW_PW_MODE);
 
-#ifdef ANDROID_KERNEL
 	handle->params.wakelock_timeout = wakelock_timeout;
 	if (params)
 		handle->params.wakelock_timeout = params->wakelock_timeout;
-#endif
 	handle->params.dev_cap_mask = dev_cap_mask;
 	if (params)
 		handle->params.dev_cap_mask = params->dev_cap_mask;
@@ -1385,8 +1380,7 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 #if defined(SD8997) || defined(PCIE8997) || defined(USB8997) ||                \
 	defined(SD8977) || defined(SD8987) || defined(SD9098) ||               \
 	defined(USB9098) || defined(PCIE9098) || defined(SD9097) ||            \
-	defined(USB9097) || defined(PCIE9097) || defined(SD8978) ||            \
-	defined(USB8978)
+	defined(USB9097) || defined(PCIE9097) || defined(SD8978)
 	if (pmic)
 		moal_extflg_set(handle, EXT_PMIC);
 #endif
@@ -1429,6 +1423,8 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 		moal_extflg_set(handle, EXT_NAPI);
 	if (tx_work)
 		moal_extflg_set(handle, EXT_TX_WORK);
+	if (rps)
+		moal_extflg_set(handle, EXT_RPS);
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 	if (dfs_offload)
@@ -1642,6 +1638,11 @@ void woal_init_from_dev_tree(void)
 				PRINTM(MIOCTL, "tx_work=0x%x\n", data);
 				tx_work = data;
 			}
+		} else if (!strncmp(prop->name, "rps", strlen("rps"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MIOCTL, "rps=0x%x\n", data);
+				rps = data;
+			}
 		}
 #ifdef MFG_CMD_SUPPORT
 		else if (!strncmp(prop->name, "mfg_mode", strlen("mfg_mode"))) {
@@ -1906,7 +1907,7 @@ void woal_init_from_dev_tree(void)
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_validate_cfg_id(moal_handle *handle)
+static mlan_status woal_validate_cfg_id(moal_handle *handle)
 {
 	int i;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -1930,16 +1931,16 @@ mlan_status woal_validate_cfg_id(moal_handle *handle)
  *
  *  @return       MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status parse_skip_cfg_block(t_u8 *data, t_u32 size)
+static mlan_status parse_skip_cfg_block(t_u8 *data, t_u32 size)
 {
 	int end = 0;
 	t_u8 line[MAX_LINE_LEN];
-	while (parse_cfg_get_line(data, size, line) != -1) {
+	while ((int)parse_cfg_get_line(data, size, line) != -1) {
 		if (strncmp(line, "}", strlen("}")) == 0) {
 			end = 1;
 			break;
 		}
-		if (end == 0 && strstr(line, "{") != 0)
+		if (end == 0 && strstr(line, "{") != NULL)
 			break;
 	}
 	return (end == 1) ? MLAN_STATUS_SUCCESS : MLAN_STATUS_FAILURE;
@@ -1953,7 +1954,7 @@ mlan_status parse_skip_cfg_block(t_u8 *data, t_u32 size)
  *
  *  @return       MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_cfg_fallback_process(moal_handle *handle)
+static mlan_status woal_cfg_fallback_process(moal_handle *handle)
 {
 	int i, blk_id = 0x7fffffff, idx = -1;
 	mlan_status ret = MLAN_STATUS_FAILURE;
@@ -2019,7 +2020,7 @@ mlan_status woal_init_module_param(moal_handle *handle)
 	       card_type_map_tbl[i].name);
 	size = handle->param_data->size;
 	data = (t_u8 *)handle->param_data->data;
-	while (parse_cfg_get_line(data, size, line) != -1) {
+	while ((int)parse_cfg_get_line(data, size, line) != -1) {
 		if (line[0] == '#')
 			continue;
 		if (strstr(line, "={")) {
@@ -2161,9 +2162,9 @@ module_param(gpiopin, int, 0);
 MODULE_PARM_DESC(gpiopin, "255:new GPIO int mode, other vlue: gpio pin number");
 #endif
 
-#ifdef SDIO_SUSPEND_RESUME
 module_param(pm_keep_power, int, 0);
 MODULE_PARM_DESC(pm_keep_power, "1: PM keep power; 0: PM no power");
+#ifdef SDIO_SUSPEND_RESUME
 module_param(shutdown_hs, int, 0);
 MODULE_PARM_DESC(shutdown_hs,
 		 "1: Enable HS when shutdown; 0: No HS when shutdown");
@@ -2181,6 +2182,8 @@ MODULE_PARM_DESC(
 #endif
 module_param(tx_work, uint, 0660);
 MODULE_PARM_DESC(tx_work, "1: Enable tx_work; 0: Disable tx_work");
+module_param(rps, uint, 0660);
+MODULE_PARM_DESC(rps, "1: Enable rps; 0: Disable rps");
 module_param(dpd_data_cfg, charp, 0);
 MODULE_PARM_DESC(dpd_data_cfg, "DPD data file name");
 module_param(init_cfg, charp, 0);
@@ -2193,26 +2196,19 @@ MODULE_PARM_DESC(txpwrlimit_cfg,
 module_param(cntry_txpwr, int, 0);
 MODULE_PARM_DESC(
 	cntry_txpwr,
-	"Allow setting tx power table of country; 0: disable (default), 1: enable.");
+	"0: disable (default), 1: enable set country txpower table 2: enable set country rgpower table");
 module_param(init_hostcmd_cfg, charp, 0);
 MODULE_PARM_DESC(init_hostcmd_cfg, "Init hostcmd file name");
 module_param(band_steer_cfg, charp, 0);
 MODULE_PARM_DESC(band_steer_cfg, "band steer cfg file name");
 module_param(cfg80211_wext, int, 0660);
-MODULE_PARM_DESC(cfg80211_wext,
-#ifdef STA_WEXT
-		 "Bit 0: STA WEXT; "
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+MODULE_PARM_DESC(
+	cfg80211_wext,
+	"Bit 0: STA WEXT Bit 1: UAP WEXT Bit 2: STA CFG80211 Bit 3: UAP CFG80211");
+#else
+MODULE_PARM_DESC(cfg80211_wext, "Bit 0: STA WEXT Bit 1: UAP WEXT Bit 2");
 #endif
-#ifdef UAP_WEXT
-		 "Bit 1: UAP WEXT; "
-#endif
-#ifdef STA_CFG80211
-		 "Bit 2: STA CFG80211; "
-#endif
-#ifdef UAP_CFG80211
-		 "Bit 3: UAP CFG80211;"
-#endif
-);
 #if defined(USB)
 module_param(skip_fwdnld, int, 0);
 MODULE_PARM_DESC(skip_fwdnld, "0: Enable FW download; 1: Disable FW download");
@@ -2242,10 +2238,8 @@ MODULE_PARM_DESC(pcie_int_mode, "0: Legacy mode; 1: MSI mode; 2: MSI-X mode");
 module_param(low_power_mode_enable, int, 0);
 MODULE_PARM_DESC(low_power_mode_enable, "0/1: Disable/Enable Low Power Mode");
 
-#ifdef ANDROID_KERNEL
 module_param(wakelock_timeout, int, 0);
 MODULE_PARM_DESC(wakelock_timeout, "set wakelock_timeout value (ms)");
-#endif
 
 module_param(dev_cap_mask, uint, 0);
 MODULE_PARM_DESC(dev_cap_mask, "Device capability mask");
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c b/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
index cfab8bd..dfa5e2b 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
@@ -3,7 +3,7 @@
  * @brief This file contains ioctl function to MLAN
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -126,11 +126,6 @@ extern const struct net_device_ops woal_netdev_ops;
 #endif
 #endif
 
-#ifdef MFG_CMD_SUPPORT
-/** Mfg mode */
-extern int mfg_mode;
-#endif
-
 /********************************************************
 			Local Functions
 ********************************************************/
@@ -141,7 +136,7 @@ extern int mfg_mode;
  *
  *  @return                 Region code
  */
-t_bool woal_is_country_code_supported(t_u8 *country_code)
+static t_bool woal_is_country_code_supported(t_u8 *country_code)
 {
 	t_u8 i;
 	ENTER();
@@ -166,7 +161,7 @@ t_bool woal_is_country_code_supported(t_u8 *country_code)
  *
  *  @return                 Region code
  */
-t_u8 region_string_2_region_code(char *region_string)
+static t_u8 region_string_2_region_code(char *region_string)
 {
 	t_u8 i;
 
@@ -310,7 +305,7 @@ t_u8 woal_get_second_channel_offset(int chan)
 static inline void woal_copy_mc_addr(mlan_multicast_list *mlist,
 				     mlan_802_11_mac_addr mac)
 {
-	int i = 0;
+	t_u32 i = 0;
 	for (i = 0; i < mlist->num_multicast_addr; i++) {
 		if (!memcmp(&mlist->mac_list[i], mac, ETH_ALEN))
 			return;
@@ -644,7 +639,7 @@ mlan_status woal_request_ioctl(moal_private *priv, mlan_ioctl_req *req,
 		}
 #ifdef MFG_CMD_SUPPORT
 		if (mfg_mode && sub_command != MLAN_OID_MISC_HOST_CMD) {
-			PRINTM(MCMND, "IOCTL is not allowed while suspended\n");
+			PRINTM(MCMND, "Only HOST_CMD allowed in MFG mode\n");
 			LEAVE();
 			return MLAN_STATUS_FAILURE;
 		}
@@ -1654,7 +1649,7 @@ done:
  * @return         MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --success, otherwise
  * fail
  */
-int woal_set_countrycode(moal_private *priv, char *country)
+static int woal_set_countrycode(moal_private *priv, char *country)
 {
 	int ret = 0;
 	mlan_ioctl_req *req = NULL;
@@ -1988,7 +1983,6 @@ out:
 mlan_status woal_get_debug_info(moal_private *priv, t_u8 wait_option,
 				mlan_debug_info *debug_info)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_get_info *info = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -1998,7 +1992,7 @@ mlan_status woal_get_debug_info(moal_private *priv, t_u8 wait_option,
 	req = woal_alloc_mlan_ioctl_req(sizeof(t_u32) +
 					sizeof(mlan_debug_info));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -2221,7 +2215,7 @@ int woal_custom_ie_ioctl(struct net_device *dev, struct ifreq *req)
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
-	mlan_ds_misc_custom_ie *custom_ie = NULL;
+	mlan_ds_misc_custom_ie *pcustom_ie = NULL;
 	int ret = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	gfp_t flag;
@@ -2236,13 +2230,13 @@ int woal_custom_ie_ioctl(struct net_device *dev, struct ifreq *req)
 	}
 
 	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
-	custom_ie = kzalloc(sizeof(mlan_ds_misc_custom_ie), flag);
-	if (!custom_ie) {
+	pcustom_ie = kzalloc(sizeof(mlan_ds_misc_custom_ie), flag);
+	if (!pcustom_ie) {
 		ret = -ENOMEM;
 		goto done;
 	}
 
-	if (copy_from_user(custom_ie, req->ifr_data,
+	if (copy_from_user(pcustom_ie, req->ifr_data,
 			   sizeof(mlan_ds_misc_custom_ie))) {
 		PRINTM(MERROR, "Copy from user failed\n");
 		ret = -EFAULT;
@@ -2258,13 +2252,13 @@ int woal_custom_ie_ioctl(struct net_device *dev, struct ifreq *req)
 	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_CUSTOM_IE;
 	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
-	if ((custom_ie->len == 0) ||
-	    (custom_ie->len == sizeof(custom_ie->ie_data_list[0].ie_index)))
+	if ((pcustom_ie->len == 0) ||
+	    (pcustom_ie->len == sizeof(pcustom_ie->ie_data_list[0].ie_index)))
 		ioctl_req->action = MLAN_ACT_GET;
 	else
 		ioctl_req->action = MLAN_ACT_SET;
 
-	moal_memcpy_ext(priv->phandle, &misc->param.cust_ie, custom_ie,
+	moal_memcpy_ext(priv->phandle, &misc->param.cust_ie, pcustom_ie,
 			sizeof(mlan_ds_misc_custom_ie),
 			sizeof(mlan_ds_misc_custom_ie));
 
@@ -2289,7 +2283,7 @@ int woal_custom_ie_ioctl(struct net_device *dev, struct ifreq *req)
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(ioctl_req);
-	kfree(custom_ie);
+	kfree(pcustom_ie);
 	LEAVE();
 	return ret;
 }
@@ -2433,6 +2427,88 @@ int woal_set_get_custom_ie(moal_private *priv, t_u16 mask, t_u8 *ie, int ie_len)
 }
 #endif /* defined(HOST_TXRX_MGMT_FRAME) && defined(UAP_WEXT) */
 
+/**
+ *  @brief TDLS configuration ioctl handler
+ *
+ *  @param dev      A pointer to net_device structure
+ *  @param req      A pointer to ifreq structure
+ *  @return         0 --success, otherwise fail
+ */
+int woal_tdls_config_ioctl(struct net_device *dev, struct ifreq *req)
+{
+	moal_private *priv = (moal_private *)netdev_priv(dev);
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_ds_misc_tdls_config *tdls_data = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	gfp_t flag;
+
+	ENTER();
+
+	/* Sanity check */
+	if (req->ifr_data == NULL) {
+		PRINTM(MERROR, "woal_tdls_config_ioctl() corrupt data\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+	tdls_data = kzalloc(sizeof(mlan_ds_misc_tdls_config), flag);
+	if (!tdls_data) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	if (copy_from_user(tdls_data, req->ifr_data,
+			   sizeof(mlan_ds_misc_tdls_config))) {
+		PRINTM(MERROR, "Copy from user failed\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_TDLS_CONFIG;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	if (tdls_data->tdls_action == WLAN_TDLS_DISCOVERY_REQ ||
+	    tdls_data->tdls_action == WLAN_TDLS_LINK_STATUS)
+		ioctl_req->action = MLAN_ACT_GET;
+	else
+		ioctl_req->action = MLAN_ACT_SET;
+
+	moal_memcpy_ext(priv->phandle, &misc->param.tdls_config, tdls_data,
+			sizeof(mlan_ds_misc_tdls_config),
+			sizeof(mlan_ds_misc_tdls_config));
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (tdls_data->tdls_action == WLAN_TDLS_DISCOVERY_REQ ||
+	    tdls_data->tdls_action == WLAN_TDLS_LINK_STATUS) {
+		if (copy_to_user(req->ifr_data, &misc->param.tdls_config,
+				 sizeof(mlan_ds_misc_tdls_config))) {
+			PRINTM(MERROR, "Copy to user failed!\n");
+			ret = -EFAULT;
+			goto done;
+		}
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+	kfree(tdls_data);
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief ioctl function get BSS type
  *
@@ -2597,7 +2673,7 @@ int woal_set_get_bss_role(moal_private *priv, struct iwreq *wrq)
 			ret = -EINVAL;
 			goto done;
 		}
-		if (bss_role == GET_BSS_ROLE(priv)) {
+		if (bss_role == (int)GET_BSS_ROLE(priv)) {
 			PRINTM(MWARN, "Already BSS is in desired role\n");
 			ret = -EINVAL;
 			goto done;
@@ -2849,7 +2925,11 @@ done:
  */
 mlan_status woal_cancel_hs(moal_private *priv, t_u8 wait_option)
 {
+#ifdef STA_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
 	moal_handle *handle = NULL;
+#endif
+#endif
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_hs_cfg hscfg;
 #ifdef STA_CFG80211
@@ -2863,15 +2943,14 @@ mlan_status woal_cancel_hs(moal_private *priv, t_u8 wait_option)
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-	handle = priv->phandle;
 	/* Cancel Host Sleep */
-
 	hscfg.conditions = HOST_SLEEP_CFG_CANCEL;
 	hscfg.is_invoke_hostcmd = MTRUE;
 	ret = woal_set_get_hs_params(priv, MLAN_ACT_SET, wait_option, &hscfg);
 
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 1, 0)
+	handle = priv->phandle;
 	if (GTK_REKEY_OFFLOAD_SUSPEND == handle->params.gtk_rekey_offload) {
 		PRINTM(MIOCTL,
 		       "Cancel Host Sleep... clear gtk rekey offload of FW\n");
@@ -3128,7 +3207,6 @@ mlan_status woal_request_soft_reset(moal_handle *handle)
 mlan_status woal_set_wapi_enable(moal_private *priv, t_u8 wait_option,
 				 t_u32 enable)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -3137,7 +3215,7 @@ mlan_status woal_set_wapi_enable(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -3300,11 +3378,11 @@ done:
  *  @brief Set driver debug bit masks to mlan in order to enhance performance
  *
  *  @param priv         A pointer to moal_private structure
- *  @param drvdbg       Driver debug level
+ *  @param drv_dbg       Driver debug level
  *
  *  @return             0 --success, otherwise fail
  */
-int woal_set_drvdbg(moal_private *priv, t_u32 drvdbg)
+int woal_set_drvdbg(moal_private *priv, t_u32 drv_dbg)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
@@ -3322,7 +3400,7 @@ int woal_set_drvdbg(moal_private *priv, t_u32 drvdbg)
 	misc->sub_command = MLAN_OID_MISC_DRVDBG;
 	req->req_id = MLAN_IOCTL_MISC_CFG;
 	req->action = MLAN_ACT_SET;
-	misc->param.drvdbg = drvdbg;
+	misc->param.drvdbg = drv_dbg;
 
 	ret = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 
@@ -4006,7 +4084,6 @@ done:
 mlan_status woal_get_sta_channel(moal_private *priv, t_u8 wait_option,
 				 chan_band_info *channel)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_bss *bss = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4016,7 +4093,7 @@ mlan_status woal_get_sta_channel(moal_private *priv, t_u8 wait_option,
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
 	if (req == NULL) {
 		PRINTM(MERROR, "woal_get_sta_channel req alloc fail\n");
-		ret = MLAN_STATUS_FAILURE;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4053,7 +4130,6 @@ done:
 mlan_status woal_get_signal_info(moal_private *priv, t_u8 wait_option,
 				 mlan_ds_get_signal *signal)
 {
-	int ret = 0;
 	mlan_ds_get_info *info = NULL;
 	mlan_ioctl_req *req = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4063,7 +4139,7 @@ mlan_status woal_get_signal_info(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_get_info));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4113,7 +4189,6 @@ done:
 mlan_status woal_get_scan_table(moal_private *priv, t_u8 wait_option,
 				mlan_scan_resp *scan_resp)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_scan *scan = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4127,7 +4202,7 @@ mlan_status woal_get_scan_table(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_scan));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4343,7 +4418,6 @@ mlan_status woal_find_best_network(moal_private *priv, t_u8 wait_option,
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_bss *bss = NULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	t_u8 *mac = 0;
 
 	ENTER();
 
@@ -4374,9 +4448,9 @@ mlan_status woal_find_best_network(moal_private *priv, t_u8 wait_option,
 		moal_memcpy_ext(priv->phandle, ssid_bssid,
 				&bss->param.ssid_bssid, sizeof(mlan_ssid_bssid),
 				sizeof(mlan_ssid_bssid));
-		mac = (t_u8 *)&ssid_bssid->bssid;
 		PRINTM(MINFO, "Find network: ssid=%s, " MACSTR ", idx=%d\n",
-		       ssid_bssid->ssid.ssid, MAC2STR(mac),
+		       ssid_bssid->ssid.ssid,
+		       MAC2STR((t_u8 *)&ssid_bssid->bssid),
 		       (int)ssid_bssid->idx);
 	}
 
@@ -4445,7 +4519,6 @@ mlan_status woal_11d_check_ap_channel(moal_private *priv, t_u8 wait_option,
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_bss *bss = NULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-	t_u8 *mac = 0;
 
 	ENTER();
 
@@ -4470,9 +4543,8 @@ mlan_status woal_11d_check_ap_channel(moal_private *priv, t_u8 wait_option,
 	moal_memcpy_ext(priv->phandle, &bss->param.ssid_bssid, ssid_bssid,
 			sizeof(mlan_ssid_bssid), sizeof(mlan_ssid_bssid));
 
-	mac = (t_u8 *)&ssid_bssid->bssid;
 	PRINTM(MINFO, "ssid=%s, " MACSTR ", idx=%d\n", ssid_bssid->ssid.ssid,
-	       MAC2STR(mac), (int)ssid_bssid->idx);
+	       MAC2STR((t_u8 *)&ssid_bssid->bssid), (int)ssid_bssid->idx);
 
 	/* Send IOCTL request to MLAN */
 	ret = woal_request_ioctl(priv, req, wait_option);
@@ -4497,7 +4569,6 @@ done:
 mlan_status woal_get_auth_mode(moal_private *priv, t_u8 wait_option,
 			       t_u32 *auth_mode)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4506,7 +4577,7 @@ mlan_status woal_get_auth_mode(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4540,7 +4611,6 @@ done:
 mlan_status woal_get_encrypt_mode(moal_private *priv, t_u8 wait_option,
 				  t_u32 *encrypt_mode)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4550,7 +4620,7 @@ mlan_status woal_get_encrypt_mode(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4584,7 +4654,6 @@ done:
 mlan_status woal_get_wpa_enable(moal_private *priv, t_u8 wait_option,
 				t_u32 *enable)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4594,7 +4663,7 @@ mlan_status woal_get_wpa_enable(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4628,7 +4697,6 @@ done:
 mlan_status woal_set_auth_mode(moal_private *priv, t_u8 wait_option,
 			       t_u32 auth_mode)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4637,7 +4705,7 @@ mlan_status woal_set_auth_mode(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4670,7 +4738,6 @@ done:
 mlan_status woal_set_encrypt_mode(moal_private *priv, t_u8 wait_option,
 				  t_u32 encrypt_mode)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4679,7 +4746,7 @@ mlan_status woal_set_encrypt_mode(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4712,7 +4779,6 @@ done:
 mlan_status woal_set_wpa_enable(moal_private *priv, t_u8 wait_option,
 				t_u32 enable)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4721,7 +4787,7 @@ mlan_status woal_set_wpa_enable(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4752,7 +4818,6 @@ done:
  */
 mlan_status woal_enable_wep_key(moal_private *priv, t_u8 wait_option)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -4761,7 +4826,7 @@ mlan_status woal_enable_wep_key(moal_private *priv, t_u8 wait_option)
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -6289,7 +6354,8 @@ mlan_status woal_usb_aggr_init(moal_handle *handle)
 	else
 		moal_memcpy_ext(handle, &cardp->tx_aggr_ctrl,
 				&aggr_param->tx_aggr_ctrl,
-				sizeof(usb_aggr_ctrl), sizeof(usb_aggr_ctrl));
+				sizeof(usb_aggr_ctrl_cfg),
+				sizeof(usb_aggr_ctrl_cfg));
 
 	if (req->status_code) {
 		/* Disable the feature if FW return failure/unsupported */
@@ -6319,7 +6385,8 @@ mlan_status woal_usb_aggr_init(moal_handle *handle)
 		/* Default is disable, update only for enable case */
 		moal_memcpy_ext(handle, &cardp->rx_deaggr_ctrl,
 				&aggr_param->rx_deaggr_ctrl,
-				sizeof(usb_aggr_ctrl), sizeof(usb_aggr_ctrl));
+				sizeof(usb_aggr_ctrl_cfg),
+				sizeof(usb_aggr_ctrl_cfg));
 
 		/* Ensure the next data URBs will use the modified parameters */
 		if (!atomic_read(&cardp->rx_data_urb_pending)) {
@@ -6486,9 +6553,65 @@ void woal_ioctl_get_misc_conf(moal_private *priv, mlan_ds_misc_cfg *info)
 }
 
 #ifdef CONFIG_PROC_FS
+#define RADIO_MODE_STR_LEN 20
 #define TX_PWR_STR_LEN 20
 #define TX_CONT_STR_LEN 50
-#define TX_FRAME_STR_LEN 80
+#define TX_FRAME_STR_LEN 200
+#define HE_TB_TX_STR_LEN 30
+
+/*
+ *  @brief Parse mfg cmd radio mode string
+ *
+ *  @param s        A pointer to user buffer
+ *  @param len      Length of user buffer
+ *  @param d        A pointer to mfg_cmd_generic_cfg struct
+ *  @return         0 on success, -EINVAL otherwise
+ */
+static int parse_radio_mode_string(const char *s, size_t len,
+				   struct mfg_cmd_generic_cfg *d)
+{
+	int ret = MLAN_STATUS_SUCCESS;
+	char *string = NULL;
+	char *tmp = NULL;
+	char *pos = NULL;
+	gfp_t flag;
+
+	ENTER();
+	if (!s || !d) {
+		LEAVE();
+		return -EINVAL;
+	}
+	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+	string = kzalloc(RADIO_MODE_STR_LEN, flag);
+	if (string == NULL) {
+		LEAVE();
+		return -ENOMEM;
+	}
+
+	moal_memcpy_ext(NULL, string, s + strlen("radio_mode="),
+			len - strlen("radio_mode="), RADIO_MODE_STR_LEN - 1);
+
+	tmp = string;
+	string = strstrip(string);
+
+	/* radio mode index 0 */
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->data1 = (t_u32)woal_string_to_number(pos);
+
+	/* radio mode index 1 */
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->data2 = (t_u32)woal_string_to_number(pos);
+
+	if ((d->data1 > 14 || d->data1 < 0) || (d->data2 > 14 || d->data2 < 0))
+		ret = -EINVAL;
+
+	kfree(tmp);
+	LEAVE();
+	return ret;
+}
+
 /*
  *  @brief Parse mfg cmd tx pwr string
  *
@@ -6706,6 +6829,34 @@ static int parse_tx_frame_string(const char *s, size_t len,
 	if (pos)
 		d->stbc = (t_u32)woal_string_to_number(pos);
 
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->NumPkt = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->MaxPE = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->BeamChange = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->Dcm = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->Doppler = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->MidP = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->QNum = (t_u32)woal_string_to_number(pos);
+
 	pos = strsep(&string, " \t");
 	if (pos) {
 		for (i = 0; i < ETH_ALEN; i++) {
@@ -6727,7 +6878,68 @@ done:
 	LEAVE();
 	return ret;
 }
-/**
+
+/*
+ *  @brief Parse mfg cmd HE TB Tx string
+ *
+ *  @param s        A pointer to user buffer
+ *  @param len      Length of user buffer
+ *  @param d        A pointer to mfg_Cmd_HE_TBTx_t struct
+ *  @return         0 on success, -EINVAL otherwise
+ */
+static int parse_he_tb_tx_string(const char *s, size_t len,
+				 struct mfg_Cmd_HE_TBTx_t *d)
+{
+	int ret = MLAN_STATUS_SUCCESS;
+	char *string = NULL;
+	char *tmp = NULL;
+	char *pos = NULL;
+	gfp_t flag;
+
+	ENTER();
+	if (!s || !d) {
+		LEAVE();
+		return -EINVAL;
+	}
+	flag = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+	string = kzalloc(HE_TB_TX_STR_LEN, flag);
+	if (string == NULL)
+		return -ENOMEM;
+
+	moal_memcpy_ext(NULL, string, s + strlen("he_tb_tx="),
+			len - strlen("he_tb_tx="), HE_TB_TX_STR_LEN - 1);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->enable = (t_u32)woal_string_to_number(pos);
+
+	if (d->enable == MFALSE)
+		goto done;
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->qnum = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->aid = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->axq_mu_timer = (t_u32)woal_string_to_number(pos);
+
+	pos = strsep(&string, " \t");
+	if (pos)
+		d->tx_power = (t_u16)woal_string_to_number(pos);
+
+	if (d->enable > 1)
+		ret = -EINVAL;
+
+done:
+	kfree(tmp);
+	LEAVE();
+	return ret;
+}
+/*
  *  @brief This function enables/disables RF test mode in firmware
  *
  *  @param handle   A pointer to moal_handle structure
@@ -6851,6 +7063,11 @@ mlan_status woal_process_rf_test_mode_cmd(moal_handle *handle, t_u32 cmd,
 		break;
 	case MFG_CMD_CLR_RX_ERR:
 		break;
+	case MFG_CMD_RADIO_MODE_CFG:
+		if (parse_radio_mode_string(buffer, len,
+					    &misc->param.mfg_generic_cfg))
+			err = MTRUE;
+		break;
 	case MFG_CMD_RFPWR:
 		if (parse_tx_pwr_string(buffer, len,
 					&misc->param.mfg_generic_cfg))
@@ -6867,6 +7084,12 @@ mlan_status woal_process_rf_test_mode_cmd(moal_handle *handle, t_u32 cmd,
 					  &misc->param.mfg_tx_frame2))
 			err = MTRUE;
 		break;
+	case MFG_CMD_CONFIG_MAC_HE_TB_TX:
+		misc->sub_command = MLAN_OID_MISC_RF_TEST_HE_POWER;
+		if (parse_he_tb_tx_string(buffer, len,
+					  &misc->param.mfg_he_power))
+			err = MTRUE;
+		break;
 	default:
 		err = MTRUE;
 	}
@@ -6891,6 +7114,12 @@ mlan_status woal_process_rf_test_mode_cmd(moal_handle *handle, t_u32 cmd,
 	case MFG_CMD_RX_ANT:
 		handle->rf_data->rx_antenna = misc->param.mfg_generic_cfg.data1;
 		break;
+	case MFG_CMD_RADIO_MODE_CFG:
+		handle->rf_data->radio_mode[0] =
+			misc->param.mfg_generic_cfg.data1;
+		handle->rf_data->radio_mode[1] =
+			misc->param.mfg_generic_cfg.data2;
+		break;
 	case MFG_CMD_RF_BAND_AG:
 		handle->rf_data->band = misc->param.mfg_generic_cfg.data1;
 		/* set fw default bw and channel config on band change */
@@ -6963,11 +7192,34 @@ mlan_status woal_process_rf_test_mode_cmd(moal_handle *handle, t_u32 cmd,
 			misc->param.mfg_tx_frame2.gf_mode;
 		handle->rf_data->tx_frame_data[12] =
 			misc->param.mfg_tx_frame2.stbc;
+		handle->rf_data->tx_frame_data[13] =
+			misc->param.mfg_tx_frame2.NumPkt;
+		handle->rf_data->tx_frame_data[14] =
+			misc->param.mfg_tx_frame2.MaxPE;
+		handle->rf_data->tx_frame_data[15] =
+			misc->param.mfg_tx_frame2.BeamChange;
+		handle->rf_data->tx_frame_data[16] =
+			misc->param.mfg_tx_frame2.Dcm;
+		handle->rf_data->tx_frame_data[17] =
+			misc->param.mfg_tx_frame2.Doppler;
+		handle->rf_data->tx_frame_data[18] =
+			misc->param.mfg_tx_frame2.MidP;
+		handle->rf_data->tx_frame_data[19] =
+			misc->param.mfg_tx_frame2.QNum;
 		for (i = 0; i < ETH_ALEN; i++) {
 			handle->rf_data->bssid[i] =
 				misc->param.mfg_tx_frame2.bssid[i];
 		}
 		break;
+	case MFG_CMD_CONFIG_MAC_HE_TB_TX:
+		handle->rf_data->he_tb_tx[0] = misc->param.mfg_he_power.enable;
+		handle->rf_data->he_tb_tx[1] = misc->param.mfg_he_power.qnum;
+		handle->rf_data->he_tb_tx[2] = misc->param.mfg_he_power.aid;
+		handle->rf_data->he_tb_tx[3] =
+			misc->param.mfg_he_power.axq_mu_timer;
+		handle->rf_data->he_tb_tx[4] =
+			misc->param.mfg_he_power.tx_power;
+		break;
 	}
 done:
 	if (err || ret != MLAN_STATUS_PENDING)
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.c b/mxm_wifiex/wlan_src/mlinux/moal_main.c
index 18798ae..c1ced93 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.c
@@ -4,7 +4,7 @@
  * driver.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -69,7 +69,7 @@ Change log:
 		 Global Variables
  ********************************************************/
 /** the pointer of new fwdump fname for each dump**/
-char *fwdump_fname;
+static char *fwdump_fname;
 /** Semaphore for add/remove card */
 struct semaphore AddRemoveCardSem;
 /**
@@ -77,16 +77,7 @@ struct semaphore AddRemoveCardSem;
  * structure variable
  **/
 moal_handle *m_handle[MAX_MLAN_ADAPTER];
-/** Global veriable for usb independent reset */
-extern int fw_reload;
 
-extern int wifi_status;
-
-#if defined(STA_CFG80211) || defined(UAP_CFG80211)
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-extern int fw_region;
-#endif
-#endif
 /********************************************************
 		Local Variables
 ********************************************************/
@@ -631,6 +622,7 @@ static mlan_callbacks woal_callbacks = {
 	.moal_print_netintf = moal_print_netintf,
 	.moal_assert = moal_assert,
 	.moal_hist_data_add = moal_hist_data_add,
+	.moal_updata_peer_signal = moal_updata_peer_signal,
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
 	.moal_wait_hostcmd_complete = moal_wait_hostcmd_complete,
 	.moal_notify_hostcmd_complete = moal_notify_hostcmd_complete,
@@ -722,16 +714,19 @@ void woal_process_hang(moal_handle *handle)
 	if (reset_handle == NULL) {
 		PRINTM(MMSG, "Start to process hanging\n");
 		reset_handle = handle;
+		flush_workqueue(handle->workqueue);
+		flush_workqueue(handle->evt_workqueue);
+		if (handle->rx_workqueue) {
+			flush_workqueue(handle->rx_workqueue);
+		}
 		mlan_ioctl(handle->pmlan_adapter, NULL);
 		queue_work(hang_workqueue, &hang_work);
-#ifdef ANDROID_KERNEL
 #define WAKE_LOCK_HANG 5000
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 		__pm_wakeup_event(&reset_handle->ws, WAKE_LOCK_HANG);
 #else
 		wake_lock_timeout(&reset_handle->wake_lock,
 				  msecs_to_jiffies(WAKE_LOCK_HANG));
-#endif
 #endif
 	}
 	LEAVE();
@@ -749,6 +744,8 @@ t_u8 woal_is_any_interface_active(moal_handle *handle)
 {
 	int i;
 	for (i = 0; i < handle->priv_num; i++) {
+		if (!handle->priv[i])
+			continue;
 #ifdef STA_SUPPORT
 		if (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA) {
 			if (handle->priv[i]->media_connected == MTRUE)
@@ -989,7 +986,6 @@ const t_u8 *woal_parse_ext_ie_tlv(const t_u8 *ie, int len, t_u8 ext_id)
  */
 t_u32 woal_get_mode(moal_private *priv, t_u8 wait_option)
 {
-	int ret = 0;
 	mlan_ds_bss *bss = NULL;
 	mlan_ioctl_req *req = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -1003,7 +999,7 @@ t_u32 woal_get_mode(moal_private *priv, t_u8 wait_option)
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -1154,7 +1150,7 @@ mlan_status woal_update_drv_tbl(moal_handle *handle, int drv_mode_local)
 #ifdef STA_SUPPORT
 	if (drv_mode_local & DRV_MODE_STA) {
 		for (j = 0; j < max_sta_bss; j++) {
-			if (i >= intf_num)
+			if (i >= (int)intf_num)
 				break;
 			bss_tbl[i].bss_type = MLAN_BSS_TYPE_STA;
 			bss_tbl[i].frame_type = MLAN_DATA_FRAME_TYPE_ETH_II;
@@ -1170,7 +1166,7 @@ mlan_status woal_update_drv_tbl(moal_handle *handle, int drv_mode_local)
 #ifdef UAP_SUPPORT
 	if (drv_mode_local & DRV_MODE_UAP) {
 		for (j = 0; j < max_uap_bss; j++) {
-			if (i >= intf_num)
+			if (i >= (int)intf_num)
 				break;
 			bss_tbl[i].bss_type = MLAN_BSS_TYPE_UAP;
 			bss_tbl[i].frame_type = MLAN_DATA_FRAME_TYPE_ETH_II;
@@ -1186,7 +1182,7 @@ mlan_status woal_update_drv_tbl(moal_handle *handle, int drv_mode_local)
 #ifdef WIFI_DIRECT_SUPPORT
 	if (drv_mode_local & DRV_MODE_WIFIDIRECT) {
 		for (j = 0; j < max_wfd_bss; j++) {
-			if (i >= intf_num)
+			if (i >= (int)intf_num)
 				break;
 			bss_tbl[i].bss_type = MLAN_BSS_TYPE_WIFIDIRECT;
 			bss_tbl[i].frame_type = MLAN_DATA_FRAME_TYPE_ETH_II;
@@ -1206,7 +1202,7 @@ mlan_status woal_update_drv_tbl(moal_handle *handle, int drv_mode_local)
 #if defined(STA_CFG80211) && defined(UAP_CFG80211)
 	/** append virtual interface at the end of table */
 	for (j = 0; j < max_vir_bss; j++) {
-		if (i >= intf_num)
+		if (i >= (int)intf_num)
 			break;
 		bss_tbl[i].bss_type = MLAN_BSS_TYPE_WIFIDIRECT;
 		bss_tbl[i].frame_type = MLAN_DATA_FRAME_TYPE_ETH_II;
@@ -1504,11 +1500,6 @@ mlan_status woal_init_sw(moal_handle *handle)
 	}
 	moal_memcpy_ext(handle, &device.callbacks, &woal_callbacks,
 			sizeof(mlan_callbacks), sizeof(mlan_callbacks));
-#if defined(STA_CFG80211) || defined(UAP_CFG80211)
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-	device.fw_region = fw_region;
-#endif
-#endif
 	device.drv_mode = handle->params.drv_mode;
 	if (MLAN_STATUS_SUCCESS == mlan_register(&device, &pmlan))
 		handle->pmlan_adapter = pmlan;
@@ -1617,7 +1608,7 @@ static t_size parse_cfg_get_line(t_u8 *data, t_size size, t_u8 *line_pos)
 
 	ENTER();
 
-	if (pos >= size) { /* reach the end */
+	if (pos >= (t_s32)size) { /* reach the end */
 		pos = 0; /* Reset position for rfkill */
 		LEAVE();
 		return -1;
@@ -1626,7 +1617,7 @@ static t_size parse_cfg_get_line(t_u8 *data, t_size size, t_u8 *line_pos)
 	src = data + pos;
 	dest = line_pos;
 
-	while ((dest - line_pos < MAX_LINE_LEN - 1) && pos < size &&
+	while ((dest - line_pos < MAX_LINE_LEN - 1) && pos < (t_s32)size &&
 	       *src != '\x0A' && *src != '\0') {
 		if (*src != ' ' && *src != '\t') /* parse space */
 			*dest++ = *src++;
@@ -1884,7 +1875,7 @@ static t_u32 woal_process_init_cfg(moal_handle *handle, t_u8 *data, t_size size)
 
 	ENTER();
 
-	while ((line_len = parse_cfg_get_line(data, size, s)) != -1) {
+	while ((int)(line_len = parse_cfg_get_line(data, size, s)) != -1) {
 		pos = s;
 		while (*pos == ' ' || *pos == '\t')
 			pos++;
@@ -2149,8 +2140,9 @@ done:
  *
  * @return          N/A
  */
-void woal_request_init_user_conf_callback(const struct firmware *firmware,
-					  void *context)
+static void
+woal_request_init_user_conf_callback(const struct firmware *firmware,
+				     void *context)
 {
 	moal_handle *handle;
 
@@ -2642,6 +2634,83 @@ done:
 	return status;
 }
 
+static ssize_t woal_set_rps_map(struct netdev_rx_queue *queue, const char *buf,
+				size_t len)
+{
+	struct rps_map *old_map, *map;
+	cpumask_var_t mask;
+	int err, cpu, i;
+	static DEFINE_MUTEX(local_rps_map_mutex);
+
+	if (!queue || !queue->dev) {
+		PRINTM(MERROR, "%s: queue=%px or queue->dev is NULL\n",
+		       __func__, queue);
+		return -EINVAL;
+	}
+
+	if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
+		PRINTM(MERROR, "%s: alloc_cpumask_var fail.\n", __func__);
+		return -ENOMEM;
+	}
+
+	err = bitmap_parse(buf, len, cpumask_bits(mask), nr_cpumask_bits);
+	if (err) {
+		PRINTM(MERROR, "%s: bitmap_parse fail err=%d.\n", __func__,
+		       err);
+		free_cpumask_var(mask);
+		return err;
+	}
+
+	map = kzalloc(max_t(unsigned int, RPS_MAP_SIZE(cpumask_weight(mask)),
+			    L1_CACHE_BYTES),
+		      GFP_KERNEL);
+	if (!map) {
+		PRINTM(MERROR, "%s: kzalloc map fail.\n", __func__);
+		free_cpumask_var(mask);
+		return -ENOMEM;
+	}
+
+	i = 0;
+	for_each_cpu_and (cpu, mask, cpu_online_mask) {
+		PRINTM(MCMND, "map->cpus[%d]=%d\n", i, cpu);
+		map->cpus[i++] = cpu;
+	}
+
+	if (i) {
+		map->len = i;
+		PRINTM(MCMND, "map->len=%d\n", map->len);
+	} else {
+		kfree(map);
+		map = NULL;
+	}
+
+	mutex_lock(&local_rps_map_mutex);
+	old_map = rcu_dereference_protected(
+		queue->rps_map, mutex_is_locked(&local_rps_map_mutex));
+	rcu_assign_pointer(queue->rps_map, map);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 2, 0)
+	if (map)
+		static_branch_inc(&rps_needed);
+	if (old_map)
+		static_branch_dec(&rps_needed);
+#else
+	if (map)
+		static_key_slow_inc(&rps_needed);
+	if (old_map)
+		static_key_slow_dec(&rps_needed);
+
+#endif
+	mutex_unlock(&local_rps_map_mutex);
+
+	if (old_map)
+		kfree_rcu(old_map, rcu);
+
+	PRINTM(MMSG, "%s on %s: buf=%s(%u) (%d i=%d)\n", __func__,
+	       queue->dev->name, buf, (t_u32)len, nr_cpumask_bits, i);
+	free_cpumask_var(mask);
+	return len;
+}
+
 /**
  * @brief Add interfaces DPC
  *
@@ -2649,7 +2718,7 @@ done:
  *
  * @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_add_card_dpc(moal_handle *handle)
+static mlan_status woal_add_card_dpc(moal_handle *handle)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	int i;
@@ -2751,6 +2820,25 @@ mlan_status woal_add_card_dpc(moal_handle *handle)
 		woal_set_uap_operation_ctrl(handle);
 #endif
 
+	if (moal_extflg_isset(handle, EXT_RPS)) {
+		moal_private *priv_rps =
+			woal_get_priv_bss_type(handle, MLAN_BSS_TYPE_STA);
+		if (priv_rps) {
+			char *rps_buf = "f";
+			PRINTM(MCMND,
+			       "num_rx_queues=%u real_num_rx_queues=%u\n",
+			       priv_rps->netdev->num_rx_queues,
+			       priv_rps->netdev->real_num_rx_queues);
+			for (i = 0;
+			     i < (int)MIN(priv_rps->netdev->num_rx_queues,
+					  priv_rps->netdev->real_num_rx_queues);
+			     i++) {
+				woal_set_rps_map(&(priv_rps->netdev->_rx[i]),
+						 rps_buf, strlen(rps_buf));
+			}
+		}
+	}
+
 #ifdef MFG_CMD_SUPPORT
 done:
 #endif
@@ -3730,10 +3818,13 @@ moal_private *woal_add_interface(moal_handle *handle, t_u8 bss_index,
 
 	INIT_LIST_HEAD(&priv->tcp_sess_queue);
 	spin_lock_init(&priv->tcp_sess_lock);
+#ifdef STA_SUPPORT
+	INIT_LIST_HEAD(&priv->tdls_list);
+	spin_lock_init(&priv->tdls_lock);
+#endif
 
 	INIT_LIST_HEAD(&priv->tx_stat_queue);
 	spin_lock_init(&priv->tx_stat_lock);
-	skb_queue_head_init(&priv->tx_q);
 
 #ifdef STA_CFG80211
 #ifdef STA_SUPPORT
@@ -3994,6 +4085,11 @@ void woal_remove_interface(moal_handle *handle, t_u8 bss_index)
 
 	woal_flush_tx_stat_queue(priv);
 
+#ifdef STA_CFG80211
+	if (priv->bss_type == MLAN_BSS_TYPE_STA)
+		woal_flush_tdls_list(priv);
+#endif
+
 #ifdef STA_CFG80211
 	if (priv->bss_type == MLAN_BSS_TYPE_STA &&
 	    IS_STA_CFG80211(handle->params.cfg80211_wext)) {
@@ -4152,10 +4248,14 @@ mlan_status woal_set_user_antcfg(moal_handle *handle, t_u8 wait_option)
 
 	if (handle->feature_control & FEATURE_CTRL_STREAM_2X2) {
 		if (IS_CARD9098(handle->card_type) ||
-		    IS_CARD9097(handle->card_type))
+		    IS_CARD9097(handle->card_type)) {
 			radio->param.ant_cfg.tx_antenna =
 				radio->param.ant_cfg.rx_antenna = antcfg;
-		else {
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+			woal_cfg80211_notify_antcfg(priv, priv->phandle->wiphy,
+						    radio);
+#endif
+		} else {
 			radio->param.ant_cfg.tx_antenna =
 				(antcfg & 0x0030) >> 4;
 			radio->param.ant_cfg.rx_antenna = antcfg & 0x0003;
@@ -4289,7 +4389,7 @@ int woal_hexval(char chr)
  *
  *  @return          N/A
  */
-void woal_flush_evt_queue(moal_handle *handle)
+static void woal_flush_evt_queue(moal_handle *handle)
 {
 	struct woal_event *evt = NULL, *tmp_node;
 	unsigned long flags;
@@ -4356,10 +4456,13 @@ int woal_open(struct net_device *dev)
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 #if defined(USB)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 0, 0)
+	struct usb_device *udev =
+		((struct usb_card_rec *)(priv->phandle->card))->udev;
+#else
 	struct usb_interface *intf =
 		((struct usb_card_rec *)priv->phandle->card)->intf;
-#endif /* < 2.6.34 */
+#endif /* >= 5.0.0 */
 #endif /* USB_SUSPEND_RESUME */
 	t_u8 carrier_on = MFALSE;
 
@@ -4373,21 +4476,19 @@ int woal_open(struct net_device *dev)
 	}
 #if defined(USB)
 	if (IS_USB(priv->phandle->card_type)) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-		intf->pm_usage_cnt = 1;
+		/* Error enabling PM on interface */
+		if (usb_autopm_get_interface(intf)) {
+			LEAVE();
+			return -EIO;
+		}
 #else
 		atomic_set(&intf->pm_usage_cnt, 1);
-#endif /* < 2.6.32 */
-		usb_autopm_put_interface(intf);
-#else
-		struct usb_device *udev =
-			((struct usb_card_rec *)(priv->phandle->card))->udev;
-		usb_lock_device(udev);
-		atomic_set(&udev->dev.power.usage_count, 1);
-		usb_enable_autosuspend(udev);
-		usb_unlock_device(udev);
 #endif /* < 2.6.34 */
+#else
+		atomic_set(&udev->dev.power.usage_count, 1);
+#endif /* 5.0. 0 */
 	}
 #endif /* USB_SUSPEND_RESUME */
 
@@ -4458,10 +4559,13 @@ int woal_close(struct net_device *dev)
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 #if defined(USB)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+#if LINUX_VERSION_CODE > KERNEL_VERSION(5, 0, 0)
+	struct usb_device *udev =
+		((struct usb_card_rec *)(priv->phandle->card))->udev;
+#else
 	struct usb_interface *intf =
 		((struct usb_card_rec *)priv->phandle->card)->intf;
-#endif /* < 2.6.34 */
+#endif /* < 5.0.0 */
 #endif /* USB_SUSPEND_RESUME */
 #ifdef STA_CFG80211
 	int cfg80211_wext = priv->phandle->params.cfg80211_wext;
@@ -4509,21 +4613,15 @@ int woal_close(struct net_device *dev)
 	MODULE_PUT;
 #if defined(USB)
 	if (IS_USB(priv->phandle->card_type)) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-		intf->pm_usage_cnt = 0;
+		usb_autopm_put_interface(intf);
 #else
 		atomic_set(&intf->pm_usage_cnt, 0);
-#endif /* < 2.6.32 */
-		usb_autopm_get_interface(intf);
-#else
-		struct usb_device *udev =
-			((struct usb_card_rec *)(priv->phandle->card))->udev;
-		usb_lock_device(udev);
-		atomic_set(&udev->dev.power.usage_count, 0);
-		usb_disable_autosuspend(udev);
-		usb_unlock_device(udev);
 #endif /* < 2.6.34 */
+#else
+		atomic_set(&udev->dev.power.usage_count, 0);
+#endif /* < 5.0.0 */
 	}
 #endif /* USB_SUSPEND_RESUME */
 
@@ -4802,15 +4900,8 @@ void woal_mlan_debug_info(moal_private *priv)
 		PRINTM(MERROR, "eventbd_rdptr=0x%x event_wrptr=0x%x\n",
 		       info->eventbd_rdptr, info->eventbd_wrptr);
 		PRINTM(MERROR, "last_wr_index:%d\n",
-		       info->txbd_wrptr & (MLAN_MAX_TXRX_BD - 1));
-		PRINTM(MERROR, "Tx pkt size:\n");
-		for (s = str, i = 0; i < MLAN_MAX_TXRX_BD; i++) {
-			s += sprintf(s, "%d ", info->last_tx_pkt_size[i]);
-			if (((i + 1) % 16) == 0) {
-				PRINTM(MERROR, "%s\n", str);
-				s = str;
-			}
-		}
+		       info->txbd_wrptr & (info->txrx_bd_size - 1));
+		PRINTM(MERROR, "TxRx BD size:%d\n", info->txrx_bd_size);
 	}
 #endif
 	PRINTM(MERROR, "num_event_deauth = %d\n", info->num_event_deauth);
@@ -4832,6 +4923,7 @@ void woal_mlan_debug_info(moal_private *priv)
 
 	PRINTM(MERROR, "data_sent=%d cmd_sent=%d\n", info->data_sent,
 	       info->cmd_sent);
+	PRINTM(MERROR, "data_sent_cnt=%u\n", info->data_sent_cnt);
 
 	PRINTM(MERROR, "ps_mode=%d ps_state=%d\n", info->ps_mode,
 	       info->ps_state);
@@ -4845,7 +4937,7 @@ void woal_mlan_debug_info(moal_private *priv)
 	PRINTM(MERROR, "tx_lock_flag = %d\n", info->tx_lock_flag);
 	PRINTM(MERROR, "port_open = %d\n", info->port_open);
 	PRINTM(MERROR, "scan_processing = %d\n", info->scan_processing);
-	for (i = 0; i < info->ralist_num; i++) {
+	for (i = 0; i < (int)info->ralist_num; i++) {
 		PRINTM(MERROR,
 		       "ralist ra: %02x:%02x:%02x:%02x:%02x:%02x tid=%d pkts=%d pause=%d\n",
 		       info->ralist[i].ra[0], info->ralist[i].ra[1],
@@ -4876,7 +4968,7 @@ void woal_mlan_debug_info(moal_private *priv)
  *
  *  @return         N/A
  */
-void woal_ioctl_timeout(moal_handle *handle)
+static void woal_ioctl_timeout(moal_handle *handle)
 {
 	moal_private *priv = NULL;
 
@@ -5117,6 +5209,76 @@ void woal_remove_tx_info(moal_private *priv, t_u8 tx_seq_num)
 	LEAVE();
 }
 
+#ifdef STA_CFG80211
+/**
+ *  @brief This function flush tcp session queue
+ *
+ *  @param priv      A pointer to moal_private structure
+ *
+ *  @return          N/A
+ */
+void woal_flush_tdls_list(moal_private *priv)
+{
+	struct tdls_peer *peer = NULL, *tmp_node;
+	unsigned long flags;
+	spin_lock_irqsave(&priv->tdls_lock, flags);
+	list_for_each_entry_safe (peer, tmp_node, &priv->tdls_list, link) {
+		list_del(&peer->link);
+		kfree(peer);
+	}
+	INIT_LIST_HEAD(&priv->tdls_list);
+	spin_unlock_irqrestore(&priv->tdls_lock, flags);
+	priv->tdls_check_tx = MFALSE;
+}
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/**
+ *  @brief  check the tx packet for tdls auto set up
+ *
+ *  @param priv      A pointer to moal_private structure
+ *  @param skb       A pointer to skb buffer.
+ *
+ *  @return          N/A
+ */
+static void woal_tdls_check_tx(moal_private *priv, struct sk_buff *skb)
+{
+	struct tdls_peer *peer = NULL;
+	unsigned long flags;
+	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
+	ENTER();
+	moal_memcpy_ext(priv->phandle, ra, skb->data, MLAN_MAC_ADDR_LENGTH,
+			sizeof(ra));
+	spin_lock_irqsave(&priv->tdls_lock, flags);
+	list_for_each_entry (peer, &priv->tdls_list, link) {
+		if (!memcmp(peer->peer_addr, ra, ETH_ALEN)) {
+			if (peer->rssi &&
+			    (peer->rssi <= TDLS_RSSI_HIGH_THRESHOLD)) {
+				if ((peer->link_status == TDLS_NOT_SETUP) &&
+				    (peer->num_failure <
+				     TDLS_MAX_FAILURE_COUNT)) {
+					peer->link_status =
+						TDLS_SETUP_INPROGRESS;
+					PRINTM(MMSG,
+					       "Wlan: Set up TDLS link,peer=" MACSTR
+					       " rssi=%d\n",
+					       MAC2STR(peer->peer_addr),
+					       -peer->rssi);
+					cfg80211_tdls_oper_request(
+						priv->netdev, peer->peer_addr,
+						NL80211_TDLS_SETUP, 0,
+						GFP_ATOMIC);
+					priv->tdls_check_tx = MFALSE;
+				}
+			}
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&priv->tdls_lock, flags);
+	LEAVE();
+}
+#endif
+#endif
+
 /**
  *  @brief This function flush tcp session queue
  *
@@ -5185,7 +5347,7 @@ static inline struct tcp_sess *woal_get_tcp_sess(moal_private *priv,
  *  @param context  A pointer to context
  *  @return         N/A
  */
-void woal_tcp_ack_timer_func(void *context)
+static void woal_tcp_ack_timer_func(void *context)
 {
 	struct tcp_sess *tcp_session = (struct tcp_sess *)context;
 	moal_private *priv = (moal_private *)tcp_session->priv;
@@ -5217,6 +5379,8 @@ void woal_tcp_ack_timer_func(void *context)
 				struct netdev_queue *txq = netdev_get_tx_queue(
 					priv->netdev, index);
 				netif_tx_stop_queue(txq);
+				moal_tp_accounting_rx_param(
+					(t_void *)priv->phandle, 8, 0);
 				PRINTM(MINFO, "Stop Kernel Queue : %d\n",
 				       index);
 			}
@@ -5252,7 +5416,7 @@ void woal_tcp_ack_timer_func(void *context)
  *  @param tcp_session  A pointer to tcp_session
  *  @return         N/A
  */
-void woal_send_tcp_ack(moal_private *priv, struct tcp_sess *tcp_session)
+static void woal_send_tcp_ack(moal_private *priv, struct tcp_sess *tcp_session)
 {
 	mlan_status status;
 	struct sk_buff *skb = (struct sk_buff *)tcp_session->ack_skb;
@@ -5279,6 +5443,8 @@ void woal_send_tcp_ack(moal_private *priv, struct tcp_sess *tcp_session)
 			struct netdev_queue *txq =
 				netdev_get_tx_queue(priv->netdev, index);
 			netif_tx_stop_queue(txq);
+			moal_tp_accounting_rx_param((t_void *)priv->phandle, 8,
+						    0);
 			PRINTM(MINFO, "Stop Kernel Queue : %d\n", index);
 		}
 #else
@@ -5309,7 +5475,7 @@ void woal_send_tcp_ack(moal_private *priv, struct tcp_sess *tcp_session)
  *
  *  @return          1, if it's dropped; 0, if not dropped
  */
-int woal_process_tcp_ack(moal_private *priv, mlan_buffer *pmbuf)
+static int woal_process_tcp_ack(moal_private *priv, mlan_buffer *pmbuf)
 {
 	int ret = 0;
 	unsigned long flags;
@@ -5432,7 +5598,7 @@ done:
  *
  *  @return        0 --success
  */
-int woal_start_xmit(moal_private *priv, struct sk_buff *skb)
+static int woal_start_xmit(moal_private *priv, struct sk_buff *skb)
 {
 	mlan_buffer *pmbuf = NULL;
 	mlan_status status;
@@ -5452,9 +5618,15 @@ int woal_start_xmit(moal_private *priv, struct sk_buff *skb)
 		priv->stats.tx_dropped++;
 		goto done;
 	}
-	if (skb->cloned || (skb_headroom(skb) <
-			    (MLAN_MIN_DATA_HEADER_LEN + sizeof(mlan_buffer) +
-			     priv->extra_tx_head_len))) {
+	if ((skb->cloned &&
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
+	     (atomic_read(&skb->users.refs) > 1))
+#else
+	     (atomic_read(&skb->users) > 1))
+#endif
+	    || (skb_headroom(skb) <
+		(MLAN_MIN_DATA_HEADER_LEN + sizeof(mlan_buffer) +
+		 priv->extra_tx_head_len))) {
 		PRINTM(MWARN,
 		       "Tx: skb cloned %d or Insufficient skb headroom %d\n",
 		       skb->cloned, skb_headroom(skb));
@@ -5462,6 +5634,7 @@ int woal_start_xmit(moal_private *priv, struct sk_buff *skb)
 		new_skb = skb_realloc_headroom(
 			skb, MLAN_MIN_DATA_HEADER_LEN + sizeof(mlan_buffer) +
 				     priv->extra_tx_head_len);
+		moal_tp_accounting_rx_param((t_void *)priv->phandle, 7, 0);
 		if (unlikely(!new_skb)) {
 			PRINTM(MERROR, "Tx: Cannot allocate skb\n");
 			dev_kfree_skb_any(skb);
@@ -5482,6 +5655,12 @@ int woal_start_xmit(moal_private *priv, struct sk_buff *skb)
 		if (ret)
 			goto done;
 	}
+#ifdef STA_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	if (priv->enable_auto_tdls && priv->tdls_check_tx)
+		woal_tdls_check_tx(priv, skb);
+#endif
+#endif
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 	index = skb_get_queue_mapping(skb);
 #endif
@@ -5506,6 +5685,8 @@ int woal_start_xmit(moal_private *priv, struct sk_buff *skb)
 			struct netdev_queue *txq =
 				netdev_get_tx_queue(priv->netdev, index);
 			netif_tx_stop_queue(txq);
+			moal_tp_accounting_rx_param((t_void *)priv->phandle, 8,
+						    0);
 			PRINTM(MINFO, "Stop Kernel Queue : %d\n", index);
 		}
 #else
@@ -5840,6 +6021,7 @@ void woal_init_priv(moal_private *priv, t_u8 wait_option)
 	}
 #endif
 
+	skb_queue_head_init(&priv->tx_q);
 	memset(&priv->tx_protocols, 0, sizeof(dot11_protocol));
 	memset(&priv->rx_protocols, 0, sizeof(dot11_protocol));
 	priv->media_connected = MFALSE;
@@ -5861,6 +6043,9 @@ void woal_init_priv(moal_private *priv, t_u8 wait_option)
 
 	priv->enable_tcp_ack_enh = MTRUE;
 
+	priv->enable_auto_tdls = MFALSE;
+	priv->tdls_check_tx = MFALSE;
+
 	priv->gtk_data_ready = MFALSE;
 	memset(&priv->gtk_rekey_data, 0, sizeof(mlan_ds_misc_gtk_rekey_data));
 
@@ -6877,14 +7062,17 @@ t_void woal_send_disconnect_to_system(moal_private *priv,
 	mlan_ds_misc_gtk_rekey_data zero_gtk;
 #endif
 #endif
+#ifdef STA_CFG80211
 	t_u16 reason_code = 0;
-
+#endif
 	ENTER();
 	priv->media_connected = MFALSE;
+#ifdef STA_CFG80211
 	if (!disconnect_reason)
 		reason_code = MLAN_REASON_DEAUTH_LEAVING;
 	else
 		reason_code = disconnect_reason;
+#endif
 	woal_stop_queue(priv->netdev);
 	if (netif_carrier_ok(priv->netdev))
 		netif_carrier_off(priv->netdev);
@@ -6905,6 +7093,10 @@ t_void woal_send_disconnect_to_system(moal_private *priv,
 #endif
 #endif
 
+#ifdef STA_CFG80211
+	if (priv->bss_type == MLAN_BSS_TYPE_STA)
+		woal_flush_tdls_list(priv);
+#endif
 #ifdef STA_CFG80211
 	if (priv->bss_type == MLAN_BSS_TYPE_STA &&
 	    IS_STA_CFG80211(cfg80211_wext)) {
@@ -6971,7 +7163,7 @@ t_void woal_send_disconnect_to_system(moal_private *priv,
 	memset(event_buf, 0, sizeof(event_buf));
 	custom_len = strlen(CUS_EVT_AP_CONNECTED);
 	strncpy(event_buf, CUS_EVT_AP_CONNECTED,
-		MIN((sizeof(event_buf) - 1), custom_len));
+		MIN((int)(sizeof(event_buf) - 1), custom_len));
 	woal_broadcast_event(priv, event_buf, custom_len + ETH_ALEN);
 	LEAVE();
 }
@@ -7021,10 +7213,7 @@ save_ssudump:
 		return;
 	}
 	DBG_HEXDUMP(MEVT_D, "SSU addr", pmevent->event_buf, 8);
-	moal_memcpy_ext(phandle,
-			&tmpbuf,
-			pmevent->event_buf,
-			sizeof(t_ptr),
+	moal_memcpy_ext(phandle, &tmpbuf, pmevent->event_buf, sizeof(t_ptr),
 			sizeof(t_ptr));
 	PRINTM(MEVENT, "woal_store_ssu_dump: tmpbuf %p\n", tmpbuf);
 	for (i = 0; i < pmevent->event_len / 4; i++) {
@@ -7035,7 +7224,8 @@ save_ssudump:
 			snprintf(dw_string, sizeof(dw_string), "%08x ",
 				 *tmpbuf);
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
-		vfs_write(pfile_ssudump, dw_string, 9, &pos);
+		vfs_write(pfile_ssudump, (const char __user *)dw_string, 9,
+			  &pos);
 #else
 		kernel_write(pfile_ssudump, dw_string, 9, &pos);
 #endif
@@ -7123,16 +7313,20 @@ t_void woal_store_firmware_dump(moal_handle *phandle, mlan_event *pmevent)
 	}
 	phandle->fw_dump_len += pmevent->event_len - OFFSET_SEQNUM;
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
-	vfs_write(pfile_fwdump, pmevent->event_buf + OFFSET_SEQNUM,
+	vfs_write(pfile_fwdump,
+		  (const char __user *)pmevent->event_buf + OFFSET_SEQNUM,
 		  pmevent->event_len - OFFSET_SEQNUM, &pos);
 #else
 	kernel_write(pfile_fwdump, pmevent->event_buf + OFFSET_SEQNUM,
 		     pmevent->event_len - OFFSET_SEQNUM, &pos);
 #endif
 	filp_close(pfile_fwdump, NULL);
-	if (type == DUMP_TYPE_ENDE)
+	if (type == DUMP_TYPE_ENDE) {
 		PRINTM(MMSG, "==== FW DUMP END: %ld bytes ====\n",
 		       (long int)phandle->fw_dump_len);
+		phandle->fw_dump = MFALSE;
+		mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
+	}
 	LEAVE();
 	return;
 }
@@ -7164,7 +7358,7 @@ static int woal_save_hex_dump(int rowsize, const void *buf, size_t len,
 	if (rowsize != ROW_SIZE_16 && rowsize != ROW_SIZE_32)
 		rowsize = ROW_SIZE_16;
 
-	for (i = 0; i < len; i += rowsize) {
+	for (i = 0; i < (int)len; i += rowsize) {
 		linelen = min(remaining, rowsize);
 		remaining -= rowsize;
 
@@ -7225,7 +7419,8 @@ static int woal_dump_priv_drv_info(moal_handle *handle, t_u8 *buf)
 						"on" :
 						"off"));
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
-			for (i = 0; i < (priv->netdev->num_tx_queues); i++) {
+			for (i = 0; i < (int)(priv->netdev->num_tx_queues);
+			     i++) {
 				ptr += sprintf(
 					ptr, "tx queue %d: %s\n", i,
 					((netif_tx_queue_stopped(
@@ -7447,13 +7642,8 @@ static int woal_dump_mlan_drv_info(moal_private *priv, t_u8 *buf)
 		ptr += sprintf(ptr, "eventbd_rdptr=0x%x event_wrptr=0x%x\n",
 			       info->eventbd_rdptr, info->eventbd_wrptr);
 		ptr += sprintf(ptr, "last_wr_index:%d\n",
-			       info->txbd_wrptr & (MLAN_MAX_TXRX_BD - 1));
-		ptr += sprintf(ptr, "Tx pkt size:\n");
-		for (i = 0; i < MLAN_MAX_TXRX_BD; i++) {
-			ptr += sprintf(ptr, "%04d ", info->last_tx_pkt_size[i]);
-			if (((i + 1) % 16) == 0)
-				ptr += sprintf(ptr, "\n");
-		}
+			       info->txbd_wrptr & (info->txrx_bd_size - 1));
+		ptr += sprintf(ptr, "TxRx BD size:%d\n", info->txrx_bd_size);
 	}
 #endif
 	ptr += sprintf(ptr, "num_event_deauth = %d\n", info->num_event_deauth);
@@ -7477,6 +7667,7 @@ static int woal_dump_mlan_drv_info(moal_private *priv, t_u8 *buf)
 
 	ptr += sprintf(ptr, "data_sent=%d cmd_sent=%d\n", info->data_sent,
 		       info->cmd_sent);
+	ptr += sprintf(ptr, "data_sent_cnt=%u\n", info->data_sent_cnt);
 	ptr += sprintf(ptr, "ps_mode=%d ps_state=%d\n", info->ps_mode,
 		       info->ps_state);
 	ptr += sprintf(
@@ -7578,7 +7769,7 @@ t_void woal_save_host_cmdresp(moal_handle *phandle, mlan_cmdresp_event *pevent)
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
 	fs = get_fs();
 	set_fs(KERNEL_DS);
-	vfs_write(pfile, buf, len, &pos);
+	vfs_write(pfile, (const char __user *)buf, len, &pos);
 	set_fs(fs);
 #else
 	kernel_write(pfile, buf, len, &pos);
@@ -7819,7 +8010,7 @@ mlan_status woal_save_dump_info_to_file(char *dir_name, char *file_name,
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
 	fs = get_fs();
 	set_fs(KERNEL_DS);
-	vfs_write(pfile, buf, buf_len, &pos);
+	vfs_write(pfile, (const char __user *)buf, buf_len, &pos);
 	set_fs(fs);
 #else
 	kernel_write(pfile, buf, buf_len, &pos);
@@ -7903,7 +8094,8 @@ void woal_dump_drv_info(moal_handle *phandle, t_u8 *dir_name)
 		total_len += len;
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
-		vfs_write(pfile, drv_buf, total_len, &pfile->f_pos);
+		vfs_write(pfile, (const char __user *)drv_buf, total_len,
+			  &pfile->f_pos);
 #else
 		kernel_write(pfile, drv_buf, total_len, &pfile->f_pos);
 #endif
@@ -8010,7 +8202,7 @@ void woal_moal_debug_info(moal_private *priv, moal_handle *handle, u8 flag)
 		PRINTM(MERROR, "carrier %s\n",
 		       ((netif_carrier_ok(priv->netdev)) ? "on" : "off"));
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
-		for (i = 0; i < (priv->netdev->num_tx_queues); i++) {
+		for (i = 0; i < (int)(priv->netdev->num_tx_queues); i++) {
 			PRINTM(MERROR, "tx queue %d: %s\n", i,
 			       ((netif_tx_queue_stopped(
 					netdev_get_tx_queue(priv->netdev, i))) ?
@@ -8038,8 +8230,10 @@ void woal_moal_debug_info(moal_private *priv, moal_handle *handle, u8 flag)
 
 #ifdef PCIE
 	if (IS_PCIE(phandle->card_type)) {
-		if (phandle->ops.reg_dbg && (drvdbg & (MREG_D | MFW_D)))
-			phandle->ops.reg_dbg(phandle);
+		if (phandle->ops.reg_dbg && (drvdbg & (MREG_D | MFW_D))) {
+			if (!phandle->event_fw_dump)
+				phandle->ops.reg_dbg(phandle);
+		}
 	}
 #endif
 #ifdef SDIO
@@ -8098,14 +8292,14 @@ mlan_status woal_request_country_power_table(moal_private *priv, char *country)
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
+	handle = priv->phandle;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-	if (fw_region)
+	if (handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE)
 		strncpy(country_name, "rgpower_XX.bin",
 			strlen("rgpower_XX.bin"));
 #endif
 #endif
-	handle = priv->phandle;
 
 	/* Replace XX with ISO 3166-1 alpha-2 country code */
 	strncpy(strstr(country_name, "XX"), country, strlen(country));
@@ -8143,7 +8337,8 @@ mlan_status woal_request_country_power_table(moal_private *priv, char *country)
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 	/* Try download WW rgpowertable */
-	if (fw_region && (ret == MLAN_STATUS_FILE_ERR)) {
+	if ((handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE) &&
+	    (ret == MLAN_STATUS_FILE_ERR)) {
 		strncpy(country_name, "rgpower_WW.bin",
 			strlen("rgpower_WW.bin"));
 		last_slash = strrchr(file_path, '/');
@@ -8178,7 +8373,7 @@ mlan_status woal_request_country_power_table(moal_private *priv, char *country)
  *
  *  @return       packets received
  */
-int woal_netdev_poll_rx(struct napi_struct *napi, int budget)
+static int woal_netdev_poll_rx(struct napi_struct *napi, int budget)
 {
 	moal_handle *handle = container_of(napi, moal_handle, napi_rx);
 	t_u8 recv = budget;
@@ -8233,6 +8428,17 @@ t_void woal_evt_work_queue(struct work_struct *work)
 						     &evt->chan_info);
 #endif
 #endif
+#endif
+			break;
+		case WOAL_EVENT_RX_MGMT_PKT:
+#if defined(UAP_CFG80211) || defined(STA_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
+			priv = evt->priv;
+			mutex_lock(&priv->wdev->mtx);
+			cfg80211_rx_mlme_mgmt(priv->netdev, evt->evt.event_buf,
+					      evt->evt.event_len);
+			mutex_unlock(&priv->wdev->mtx);
+#endif
 #endif
 			break;
 		case WOAL_EVENT_BGSCAN_STOP:
@@ -8411,6 +8617,8 @@ t_void woal_main_work_queue(struct work_struct *work)
 		woal_usb_submit_rx_data_urbs(handle);
 	}
 #endif
+	if (atomic_read(&handle->tx_pending) == 1)
+		usleep_range(30, 30);
 	handle->main_state = MOAL_START_MAIN_PROCESS;
 	/* Call MLAN main process */
 	mlan_main_process(handle->pmlan_adapter);
@@ -8681,12 +8889,10 @@ moal_handle *woal_add_card(void *card, struct device *dev, moal_if_ops *if_ops,
 		goto err_registerdev;
 	}
 	woal_update_firmware_name(handle);
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 	wakeup_source_init(&handle->ws, "mwlan");
 #else
 	wake_lock_init(&handle->wake_lock, WAKE_LOCK_SUSPEND, "mwlan");
-#endif
 #endif
 
 	/* Init FW and HW */
@@ -8722,12 +8928,10 @@ err_init_fw:
 			wait_event_interruptible(handle->init_wait_q,
 						 handle->init_wait_q_woken);
 	}
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
-#endif
 #endif
 	/* Unregister device */
 	PRINTM(MINFO, "unregister device\n");
@@ -8912,12 +9116,10 @@ mlan_status woal_remove_card(void *card)
 	/* Unregister device */
 	PRINTM(MINFO, "unregister device\n");
 	handle->ops.unregister_dev(handle);
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
-#endif
 #endif
 	/* Free adapter structure */
 	PRINTM(MINFO, "Free Adapter\n");
@@ -9061,7 +9263,8 @@ static int woal_reset_and_reload_fw(moal_handle *handle)
 
 	ENTER();
 
-	if (!IS_SD9098(handle->card_type) && !IS_SD9097(handle->card_type)) {
+	if (!IS_SD9098(handle->card_type) && !IS_SD9097(handle->card_type) &&
+	    !IS_SD9177(handle->card_type)) {
 		mlan_pm_wakeup_card(handle->pmlan_adapter, MTRUE);
 		/** wait SOC fully wake up */
 		for (tries = 0; tries < FW_POLL_TRIES; ++tries) {
@@ -9084,7 +9287,8 @@ static int woal_reset_and_reload_fw(moal_handle *handle)
 		goto done;
 	}
 #if defined(SD9098) || defined(SD9097)
-	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type))
+	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
+	    IS_SD9177(handle->card_type))
 		handle->ops.write_reg(handle, 0x00, 0x10);
 #endif
 	/* Poll register around 100 ms */
@@ -9102,7 +9306,8 @@ static int woal_reset_and_reload_fw(moal_handle *handle)
 		ret = -EFAULT;
 		goto done;
 	}
-	if (!IS_SD9098(handle->card_type) && !IS_SD9097(handle->card_type))
+	if (!IS_SD9098(handle->card_type) && !IS_SD9097(handle->card_type) &&
+	    !IS_SD9177(handle->card_type))
 		mlan_pm_wakeup_card(handle->pmlan_adapter, MFALSE);
 	/* Download FW */
 	ret = woal_request_fw(handle);
@@ -9140,7 +9345,7 @@ done:
 	return ret;
 }
 
-void woal_pre_reset(moal_handle *handle)
+static void woal_pre_reset(moal_handle *handle)
 {
 	int intf_num;
 	ENTER();
@@ -9158,7 +9363,7 @@ void woal_pre_reset(moal_handle *handle)
 	LEAVE();
 }
 
-void woal_post_reset(moal_handle *handle)
+static void woal_post_reset(moal_handle *handle)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.h b/mxm_wifiex/wlan_src/mlinux/moal_main.h
index a1be9e4..201084f 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.h
@@ -3,7 +3,7 @@
  * @brief This file contains wlan driver specific defines etc.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -104,14 +104,12 @@ Change log:
 
 #include <linux/firmware.h>
 
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 #include <linux/pm_wakeup.h>
 #include <linux/device.h>
 #else
 #include <linux/wakelock.h>
 #endif
-#endif
 
 #include "mlan.h"
 #include "moal_shim.h"
@@ -212,13 +210,19 @@ Change log:
 #define default_11p_name "ocb%d"
 #define mwiphy_name "mwiphy%d"
 
+/** country txpower mode */
+#define CNTRY_TXPOWER_MODE 1
+/** country rgpower mode */
+#define CNTRY_RGPOWER_MODE 2
+
 /** Define BOOLEAN */
 typedef t_u8 BOOLEAN;
 
-#define INTF_CARDTYPE "---------%s-MXM"
+#define INTF_CARDTYPE "----------%s-MM"
 
 #define KERN_VERSION "5X"
 
+#define V14 "14"
 #define V15 "15"
 #define V16 "16"
 #define V17 "17"
@@ -243,6 +247,47 @@ typedef t_u8 BOOLEAN;
 /** Driver version */
 extern char driver_version[];
 
+extern struct semaphore AddRemoveCardSem;
+extern int wifi_status;
+extern int max_tx_buf;
+extern int pcie_int_mode;
+
+#ifdef STA_SUPPORT
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+extern const struct net_device_ops woal_netdev_ops;
+#endif
+#endif
+
+#ifdef UAP_SUPPORT
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+extern const struct net_device_ops woal_uap_netdev_ops;
+#endif
+#endif
+
+/** Global veriable for usb independent reset */
+extern int fw_reload;
+
+#ifdef MFG_CMD_SUPPORT
+/** Mfg mode */
+extern int mfg_mode;
+#endif
+
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+extern int fw_region;
+#endif
+#endif
+
+#if defined(USB)
+extern int skip_fwdnld;
+#endif
+#if defined(SDIO) || defined(PCIE)
+typedef enum {
+	RDWR_STATUS_SUCCESS = 0,
+	RDWR_STATUS_FAILURE = 1,
+	RDWR_STATUS_DONE = 2
+} rdwr_status;
+#endif
 /** Private structure for MOAL */
 typedef struct _moal_private moal_private, *pmoal_private;
 /** Handle data structure for MOAL  */
@@ -636,12 +681,10 @@ out:
 /* IOCTL Timeout */
 #define MOAL_IOCTL_TIMEOUT (20 * HZ)
 
-#ifdef ANDROID_KERNEL
 /** Wake lock timeout in msec */
 #define WAKE_LOCK_TIMEOUT 3000
 /** Roaming Wake lock timeout in msec */
 #define ROAMING_WAKE_LOCK_TIMEOUT 10000
-#endif
 
 /** Threshold value of number of times the Tx timeout happened */
 /* WAR For EDMAC Test */
@@ -649,6 +692,15 @@ out:
 /** Custom event : DRIVER HANG */
 #define CUS_EVT_DRIVER_HANG "EVENT=DRIVER_HANG"
 
+/** TDLS connected event */
+#define CUS_EVT_TDLS_CONNECTED "EVENT=TDLS_CONNECTED"
+/** TDLS tear down event */
+#define CUS_EVT_TDLS_TEARDOWN "EVENT=TDLS_TEARDOWN"
+/** wmm info */
+#define WMM_TYPE_INFO 0
+/** wmm parameter */
+#define WMM_TYPE_PARAMETER 1
+
 /** AP connected event */
 #define CUS_EVT_AP_CONNECTED "EVENT=AP_CONNECTED"
 
@@ -693,6 +745,8 @@ out:
 /** Custom event : Deep Sleep awake */
 #define CUS_EVT_DEEP_SLEEP_AWAKE "EVENT=DS_AWAKE"
 
+#define CUS_EVT_TOD_TOA "EVENT=TOD-TOA"
+
 /** Custom event : Host Sleep activated */
 #define CUS_EVT_HS_ACTIVATED "HS_ACTIVATED"
 /** Custom event : Host Sleep deactivated */
@@ -776,7 +830,7 @@ typedef enum {
 #define LOW_RX_PENDING 80
 
 /** MAX Tx Pending count */
-#define MAX_TX_PENDING 400
+#define MAX_TX_PENDING 800
 
 /** LOW Tx Pending count */
 #define LOW_TX_PENDING 380
@@ -908,6 +962,8 @@ typedef struct _moal_drv_mode {
 	char *fw_name;
 } moal_drv_mode;
 
+extern moal_handle *m_handle[MAX_MLAN_ADAPTER];
+
 /** Indicate if handle->info's address */
 #define INFO_ADDR BIT(0)
 #define IS_INFO_ADDR(attr) (attr & INFO_ADDR)
@@ -990,6 +1046,7 @@ struct tx_status_info {
 /** woal event type */
 enum woal_event_type {
 	WOAL_EVENT_CHAN_SWITCH,
+	WOAL_EVENT_RX_MGMT_PKT,
 	WOAL_EVENT_BGSCAN_STOP,
 #if defined(UAP_CFG80211) || defined(STA_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
@@ -999,6 +1056,13 @@ enum woal_event_type {
 #endif
 };
 
+typedef struct _woal_evt_buf {
+	/** Event len */
+	t_u16 event_len;
+	/** Event buffer */
+	t_u8 event_buf[1024];
+} woal_evt_buf;
+
 /** woal event */
 struct woal_event {
 	/*list head */
@@ -1009,6 +1073,7 @@ struct woal_event {
 	void *priv;
 	union {
 		chan_band_info chan_info;
+		woal_evt_buf evt;
 		mlan_ds_misc_assoc_rsp assoc_resp;
 		int reason_code;
 	};
@@ -1059,11 +1124,51 @@ struct pmksa_entry {
 	u8 pmkid[PMKID_LEN];
 };
 
+/** default rssi low threshold */
+#define TDLS_RSSI_LOW_THRESHOLD 55
+/** default rssi high threshold */
+#define TDLS_RSSI_HIGH_THRESHOLD 50
+/** TDLS idle time */
+#define TDLS_IDLE_TIME (10 * HZ)
+/** TDLS max failure count */
+#define TDLS_MAX_FAILURE_COUNT 4
+/** TDLS tear down reason */
+#define TDLS_TEARN_DOWN_REASON_UNSPECIFIC 26
+
+/** TDLS status */
+typedef enum _tdlsStatus_e {
+	TDLS_NOT_SETUP = 0,
+	TDLS_SETUP_INPROGRESS,
+	TDLS_SETUP_COMPLETE,
+	TDLS_SETUP_FAILURE,
+	TDLS_TEAR_DOWN,
+	TDLS_SWITCHING_CHANNEL,
+	TDLS_IN_BASE_CHANNEL,
+	TDLS_IN_OFF_CHANNEL,
+} tdlsStatus_e;
+
+/** tdls peer_info */
+struct tdls_peer {
+	struct list_head link;
+	/** MAC address information */
+	t_u8 peer_addr[ETH_ALEN];
+	/** rssi */
+	int rssi;
+	/** jiffies with rssi */
+	long rssi_jiffies;
+	/** link status */
+	tdlsStatus_e link_status;
+	/** num of set up failure */
+	t_u8 num_failure;
+};
+
 struct rf_test_mode_data {
 	/* tx antenna num */
 	t_u32 tx_antenna;
 	/* rx antenna num */
 	t_u32 rx_antenna;
+	/* radio mode */
+	t_u32 radio_mode[2];
 	/* RF band */
 	t_u32 band;
 	/* RF bandwidth */
@@ -1081,7 +1186,9 @@ struct rf_test_mode_data {
 	/* Tx continuous config values */
 	t_u32 tx_cont_data[6];
 	/* Tx frame config values */
-	t_u32 tx_frame_data[13];
+	t_u32 tx_frame_data[20];
+	/* HE TB Tx values */
+	t_u32 he_tb_tx[5];
 	/* BSSID */
 	t_u8 bssid[ETH_ALEN];
 };
@@ -1215,6 +1322,8 @@ struct _moal_private {
 	t_u8 conn_wep_key[MAX_WEP_KEY_SIZE];
 	/** connection param */
 	struct cfg80211_connect_params sme_current;
+	/* associcate bss */
+	struct cfg80211_bss *assoc_bss;
 #endif
 	t_u8 wait_target_ap_pmkid;
 	wait_queue_head_t okc_wait_q __ATTRIB_ALIGN__;
@@ -1389,6 +1498,14 @@ struct _moal_private {
 	t_u8 enable_tcp_ack_enh;
 	/** TCP session spin lock */
 	spinlock_t tcp_sess_lock;
+	/** tcp list */
+	struct list_head tdls_list;
+	/** tdls spin lock */
+	spinlock_t tdls_lock;
+	/** auto tdls  flag */
+	t_u8 enable_auto_tdls;
+	/** check tx packet for tdls peer */
+	t_u8 tdls_check_tx;
 #if CFG80211_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 	atomic_t wmm_tx_pending[4];
 #endif
@@ -1519,14 +1636,13 @@ enum ext_mod_params {
 #endif
 	EXT_REQ_FW_NOWAIT,
 	EXT_FW_SERIAL,
+	EXT_PM_KEEP_POWER,
 #ifdef SDIO
 	EXT_INTMODE,
 #ifdef SDIO_SUSPEND_RESUME
-	EXT_PM_KEEP_POWER,
 	EXT_SHUTDOWN_HS,
 #endif
 #endif
-	EXT_CNTRY_TXPWR,
 #if defined(USB)
 	EXT_SKIP_FWDNLD,
 #endif
@@ -1554,6 +1670,7 @@ enum ext_mod_params {
 #endif
 #endif
 	EXT_TX_WORK,
+	EXT_RPS,
 	EXT_MAX_PARAM,
 };
 
@@ -1604,6 +1721,7 @@ typedef struct _moal_mod_para {
 	char *init_cfg;
 	char *cal_data_cfg;
 	char *txpwrlimit_cfg;
+	int cntry_txpwr;
 	char *init_hostcmd_cfg;
 	char *band_steer_cfg;
 	int cfg80211_wext;
@@ -1616,15 +1734,12 @@ typedef struct _moal_mod_para {
 #ifdef PCIE
 	int pcie_int_mode;
 #endif /* PCIE */
-#ifdef ANDROID_KERNEL
 	int wakelock_timeout;
-#endif
 	unsigned int dev_cap_mask;
 #if defined(SD8997) || defined(PCIE8997) || defined(USB8997) ||                \
 	defined(SD8977) || defined(SD8987) || defined(SD9098) ||               \
 	defined(USB9098) || defined(PCIE9098) || defined(SD9097) ||            \
-	defined(USB9097) || defined(PCIE9097) || defined(SD8978) ||            \
-	defined(USB8978)
+	defined(USB9097) || defined(PCIE9097) || defined(SD8978)
 	int pmic;
 #endif
 	int antcfg;
@@ -1650,6 +1765,10 @@ void woal_set_tp_state(moal_private *priv);
 #define RX_DROP_P3 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 2)
 #define RX_DROP_P4 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 3)
 #define RX_DROP_P5 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 4)
+#define TXRX_MAX_SAMPLE 100
+#define RX_TIME_PKT (MAX_TP_ACCOUNT_DROP_POINT_NUM + 5)
+#define TX_TIME_PKT (MAX_TP_ACCOUNT_DROP_POINT_NUM + 6)
+
 typedef struct _moal_tp_acnt_t {
 	/* TX accounting */
 	unsigned long tx_packets[MAX_TP_ACCOUNT_DROP_POINT_NUM];
@@ -1658,10 +1777,20 @@ typedef struct _moal_tp_acnt_t {
 	unsigned long tx_bytes[MAX_TP_ACCOUNT_DROP_POINT_NUM];
 	unsigned long tx_bytes_last[MAX_TP_ACCOUNT_DROP_POINT_NUM];
 	unsigned long tx_bytes_rate[MAX_TP_ACCOUNT_DROP_POINT_NUM];
+	unsigned long tx_amsdu_cnt;
+	unsigned long tx_amsdu_cnt_last;
+	unsigned long tx_amsdu_cnt_rate;
+	unsigned long tx_amsdu_pkt_cnt;
+	unsigned long tx_amsdu_pkt_cnt_last;
+	unsigned long tx_amsdu_pkt_cnt_rate;
 	unsigned long tx_intr_cnt;
 	unsigned long tx_intr_last;
 	unsigned long tx_intr_rate;
 	unsigned long tx_pending;
+	unsigned long tx_xmit_skb_realloc_cnt;
+	unsigned long tx_stop_queue_cnt;
+	unsigned long tx_delay_driver[TXRX_MAX_SAMPLE];
+
 	/** RX accounting */
 	unsigned long rx_packets[MAX_TP_ACCOUNT_DROP_POINT_NUM];
 	unsigned long rx_packets_last[MAX_TP_ACCOUNT_DROP_POINT_NUM];
@@ -1669,11 +1798,23 @@ typedef struct _moal_tp_acnt_t {
 	unsigned long rx_bytes[MAX_TP_ACCOUNT_DROP_POINT_NUM];
 	unsigned long rx_bytes_last[MAX_TP_ACCOUNT_DROP_POINT_NUM];
 	unsigned long rx_bytes_rate[MAX_TP_ACCOUNT_DROP_POINT_NUM];
+	unsigned long rx_amsdu_cnt;
+	unsigned long rx_amsdu_cnt_last;
+	unsigned long rx_amsdu_cnt_rate;
+	unsigned long rx_amsdu_pkt_cnt;
+	unsigned long rx_amsdu_pkt_cnt_last;
+	unsigned long rx_amsdu_pkt_cnt_rate;
 	unsigned long rx_intr_cnt;
 	unsigned long rx_intr_last;
 	unsigned long rx_intr_rate;
 	unsigned long rx_pending;
 	unsigned long rx_paused_cnt;
+	unsigned long rx_rdptr_full_cnt;
+	unsigned long rx_delay1_driver[TXRX_MAX_SAMPLE];
+	unsigned long rx_delay2_driver[TXRX_MAX_SAMPLE];
+	unsigned long rx_delay_kernel[TXRX_MAX_SAMPLE];
+	t_u8 rx_index;
+	t_u8 tx_index;
 	/* TP account mode 0-disable 1-enable */
 	unsigned int on;
 	/* drop point */
@@ -1987,12 +2128,10 @@ struct _moal_handle {
 	/** Card specific driver version */
 	t_s8 driver_version[MLAN_MAX_VER_STR_LEN];
 	char *fwdump_fname;
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 	struct wakeup_source ws;
 #else
 	struct wake_lock wake_lock;
-#endif
 #endif
 	t_u16 dfs_repeater_mode;
 	/* feature_control */
@@ -2038,6 +2177,8 @@ struct _moal_handle {
 	/** TP accounting parameters */
 	moal_tp_acnt_t tp_acnt;
 	BOOLEAN is_tp_acnt_timer_set;
+
+	t_u8 request_pm;
 };
 
 /**
@@ -2642,7 +2783,6 @@ void woal_free_moal_handle(moal_handle *handle);
 /** shutdown fw */
 mlan_status woal_shutdown_fw(moal_private *priv, t_u8 wait_option);
 /* Functions in interface module */
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
 static inline void wakeup_source_init(struct wakeup_source *ws,
 				      const char *name)
@@ -2672,7 +2812,6 @@ static inline void wakeup_source_trash(struct wakeup_source *ws)
 	LEAVE();
 }
 #endif
-#endif
 /** Add card */
 moal_handle *woal_add_card(void *card, struct device *dev, moal_if_ops *if_ops,
 			   t_u16 card_type);
@@ -2700,7 +2839,7 @@ int woal_reg_rx_mgmt_ind(moal_private *priv, t_u16 action,
 			 t_u32 *pmgmt_subtype_mask, t_u8 wait_option);
 #ifdef DEBUG_LEVEL1
 /** Set driver debug bit masks */
-int woal_set_drvdbg(moal_private *priv, t_u32 drvdbg);
+int woal_set_drvdbg(moal_private *priv, t_u32 drv_dbg);
 #endif
 
 mlan_status woal_set_get_tx_bf_cap(moal_private *priv, t_u16 action,
@@ -2933,6 +3072,8 @@ int woal_priv_get_nonglobal_operclass_by_bw_channel(moal_private *priv,
 int woal_send_host_packet(struct net_device *dev, struct ifreq *req);
 /** Private command ID to pass mgmt frame */
 #define WOAL_MGMT_FRAME_TX_IOCTL (SIOCDEVPRIVATE + 12)
+/** common ioctl for TDLS */
+int woal_tdls_config_ioctl(struct net_device *dev, struct ifreq *req);
 
 int woal_get_bss_type(struct net_device *dev, struct ifreq *req);
 #if defined(STA_WEXT) || defined(UAP_WEXT)
@@ -3018,6 +3159,8 @@ mlan_status woal_init_sta_dev(struct net_device *dev, moal_private *priv);
 mlan_status woal_init_uap_dev(struct net_device *dev, moal_private *priv);
 #endif
 mlan_status woal_update_drv_tbl(moal_handle *handle, int drv_mode_local);
+void woal_fill_mlan_buffer(moal_private *priv, mlan_buffer *pmbuf,
+			   struct sk_buff *skb);
 moal_private *woal_add_interface(moal_handle *handle, t_u8 bss_num,
 				 t_u8 bss_type);
 void woal_remove_interface(moal_handle *handle, t_u8 bss_index);
@@ -3079,6 +3222,9 @@ void woal_clear_conn_params(moal_private *priv);
 #endif
 
 void woal_flush_tcp_sess_queue(moal_private *priv);
+#ifdef STA_CFG80211
+void woal_flush_tdls_list(moal_private *priv);
+#endif
 void wlan_scan_create_brief_table_entry(t_u8 **ppbuffer,
 					BSSDescriptor_t *pbss_desc);
 int wlan_get_scan_table_ret_entry(BSSDescriptor_t *pbss_desc, t_u8 **ppbuffer,
@@ -3111,9 +3257,6 @@ mlan_status woal_set_get_wowlan_config(moal_private *priv, t_u16 action,
 				       t_u8 wait_option,
 				       mlan_ds_misc_mef_flt_cfg *mefcfg);
 mlan_status woal_set_auto_arp_ext(moal_handle *handle, t_u8 enable);
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
-mlan_status woal_do_flr(moal_handle *handle, bool prepare);
-#endif
 mlan_status woal_delba_all(moal_private *priv, t_u8 wait_option);
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
index 2a24ccb..e692ccd 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
@@ -4,7 +4,7 @@
  *  related functions.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -35,18 +35,22 @@ Change log:
 #endif
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 70)
+#ifdef IMX_SUPPORT
 #include <linux/busfreq-imx.h>
 #endif
+#endif
+
 /********************************************************
 			Local Variables
 ********************************************************/
 #define DRV_NAME "NXP mdriver PCIe"
-
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 11, 0)
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+#ifdef IMX_SUPPORT
 static struct pm_qos_request woal_pcie_pm_qos_req;
 #endif
 #endif
+#endif
 
 /* PCIE resume handler */
 static int woal_pcie_resume(struct pci_dev *pdev);
@@ -54,9 +58,6 @@ static void woal_pcie_reg_dbg(moal_handle *phandle);
 static void woal_pcie_unregister_dev(moal_handle *handle);
 static void woal_pcie_cleanup(pcie_service_card *card);
 static mlan_status woal_pcie_init(pcie_service_card *card);
-extern int pcie_int_mode;
-extern struct semaphore AddRemoveCardSem;
-extern moal_handle **m_handle;
 
 /** WLAN IDs */
 static const struct pci_device_id wlan_ids[] = {
@@ -128,6 +129,51 @@ static moal_if_ops pcie_ops;
 /********************************************************
 			Local Functions
 ********************************************************/
+
+void woal_request_pmqos_busfreq_high(void)
+{
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+#ifdef IMX_SUPPORT
+	pm_qos_add_request(&woal_pcie_pm_qos_req, PM_QOS_CPU_DMA_LATENCY, 0);
+#endif
+#endif
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+#ifdef IMX_SUPPORT
+	cpu_latency_qos_add_request(&woal_pcie_pm_qos_req, 0);
+#endif
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 70)
+#ifdef IMX_SUPPORT
+	request_bus_freq(BUS_FREQ_HIGH);
+#endif
+#endif
+	return;
+}
+
+void woal_release_pmqos_busfreq_high(void)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 70)
+#ifdef IMX_SUPPORT
+	release_bus_freq(BUS_FREQ_HIGH);
+#endif
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+#ifdef IMX_SUPPORT
+	pm_qos_remove_request(&woal_pcie_pm_qos_req);
+#endif
+#endif
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
+#ifdef IMX_SUPPORT
+	cpu_latency_qos_remove_request(&woal_pcie_pm_qos_req);
+#endif
+#endif
+	return;
+}
+
 static mlan_status woal_pcie_preinit(struct pci_dev *pdev);
 
 /**  @brief This function updates the card types
@@ -206,6 +252,7 @@ static t_u16 woal_update_card_type(t_void *card)
  * @param handle    A pointer to moal_handle structure
  * @param prepare   True :- its a pre FLR call from the kernel
  *		    False :- its a post FLR call from the kernel
+ * @param flr       True: call from FLR
  *
  * Note: This function is mix of woal_switch_drv_mode() and
  * remove_card(). Idea is to cleanup the software only without
@@ -214,7 +261,7 @@ static t_u16 woal_update_card_type(t_void *card)
  *
  * @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_do_flr(moal_handle *handle, bool prepare)
+mlan_status woal_do_flr(moal_handle *handle, bool prepare, bool flr_flag)
 {
 	unsigned int i;
 	int index = 0;
@@ -321,9 +368,11 @@ perform_init:
 
 	/* Init FW and HW */
 	/* Load wlan only binary */
-	fw_serial_bkp = moal_extflg_isset(handle, EXT_FW_SERIAL);
-	moal_extflg_clear(handle, EXT_FW_SERIAL);
-	woal_update_firmware_name(handle);
+	if (flr_flag) {
+		fw_serial_bkp = moal_extflg_isset(handle, EXT_FW_SERIAL);
+		moal_extflg_clear(handle, EXT_FW_SERIAL);
+		woal_update_firmware_name(handle);
+	}
 	if (woal_init_fw(handle)) {
 		PRINTM(MFATAL, "Firmware Init Failed\n");
 		woal_pcie_reg_dbg(handle);
@@ -331,8 +380,10 @@ perform_init:
 			moal_extflg_set(handle, EXT_FW_SERIAL);
 		goto err_init_fw;
 	}
-	if (fw_serial_bkp)
+	if (flr_flag && fw_serial_bkp)
 		moal_extflg_set(handle, EXT_FW_SERIAL);
+	if (IS_PCIE9098(handle->card_type))
+		handle->event_fw_dump = MTRUE;
 exit:
 	MOAL_REL_SEMAPHORE(&AddRemoveCardSem);
 
@@ -350,13 +401,11 @@ err_init_fw:
 			wait_event_interruptible(handle->init_wait_q,
 						 handle->init_wait_q_woken);
 	}
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
 #endif
-#endif
 #ifdef CONFIG_PROC_FS
 	woal_proc_exit(handle);
 #endif
@@ -395,7 +444,7 @@ err_init_fw:
  *
  *  @return         error code
  */
-int woal_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+static int woal_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	pcie_service_card *card = NULL;
 	t_u16 card_type = 0;
@@ -500,6 +549,7 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 	int ret = MLAN_STATUS_SUCCESS;
 	int hs_actived;
 	mlan_ds_ps_info pm_info;
+	int keep_power = 0;
 
 	ENTER();
 	PRINTM(MCMND, "<--- Enter woal_pcie_suspend --->\n");
@@ -554,19 +604,26 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 
 	for (i = 0; i < handle->priv_num; i++)
 		netif_device_detach(handle->priv[i]->netdev);
+	if (moal_extflg_isset(handle, EXT_PM_KEEP_POWER))
+		keep_power = MTRUE;
+	else
+		keep_power = MFALSE;
 
-	/* Enable Host Sleep */
-	hs_actived = woal_enable_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
-	if (hs_actived == MTRUE) {
-		/* Indicate device suspended */
-		handle->is_suspended = MTRUE;
-	} else {
-		PRINTM(MMSG, "HS not actived, suspend fail!");
-		handle->suspend_fail = MTRUE;
-		for (i = 0; i < handle->priv_num; i++)
-			netif_device_attach(handle->priv[i]->netdev);
-		ret = -EBUSY;
-		goto done;
+	if (keep_power) {
+		/* Enable Host Sleep */
+		hs_actived = woal_enable_hs(
+			woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
+		if (hs_actived == MTRUE) {
+			/* Indicate device suspended */
+			handle->is_suspended = MTRUE;
+		} else {
+			PRINTM(MMSG, "HS not actived, suspend fail!");
+			handle->suspend_fail = MTRUE;
+			for (i = 0; i < handle->priv_num; i++)
+				netif_device_attach(handle->priv[i]->netdev);
+			ret = -EBUSY;
+			goto done;
+		}
 	}
 	flush_workqueue(handle->workqueue);
 	flush_workqueue(handle->evt_workqueue);
@@ -574,6 +631,11 @@ static int woal_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 		flush_workqueue(handle->rx_workqueue);
 	if (handle->tx_workqueue)
 		flush_workqueue(handle->tx_workqueue);
+	if (!keep_power) {
+		woal_do_flr(handle, true, false);
+		handle->surprise_removed = MTRUE;
+		handle->is_suspended = MTRUE;
+	}
 	pci_enable_wake(pdev, pci_choose_state(pdev, state), 1);
 	pci_save_state(pdev);
 	pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -593,15 +655,16 @@ done:
 static int woal_pcie_resume(struct pci_dev *pdev)
 {
 	moal_handle *handle;
-	pcie_service_card *card;
+	pcie_service_card *cardp;
+	int keep_power = 0;
 	int i;
 
 	ENTER();
 
 	PRINTM(MCMND, "<--- Enter woal_pcie_resume --->\n");
 	if (pdev) {
-		card = (pcie_service_card *)pci_get_drvdata(pdev);
-		if (!card || !card->handle) {
+		cardp = (pcie_service_card *)pci_get_drvdata(pdev);
+		if (!cardp || !cardp->handle) {
 			PRINTM(MERROR, "Card or handle is not valid\n");
 			LEAVE();
 			return MLAN_STATUS_SUCCESS;
@@ -611,29 +674,35 @@ static int woal_pcie_resume(struct pci_dev *pdev)
 		LEAVE();
 		return -ENOSYS;
 	}
-	pci_set_power_state(pdev, PCI_D0);
-	pci_restore_state(pdev);
-	pci_enable_wake(pdev, PCI_D0, 0);
-
-	handle = card->handle;
-
+	handle = cardp->handle;
 	if (handle->is_suspended == MFALSE) {
 		PRINTM(MWARN, "Device already resumed\n");
 		goto done;
 	}
-
 	handle->is_suspended = MFALSE;
 
-	if (woal_check_driver_status(handle)) {
-		PRINTM(MERROR, "Resuem, device is in hang state\n");
-		LEAVE();
-		return MLAN_STATUS_SUCCESS;
+	if (moal_extflg_isset(handle, EXT_PM_KEEP_POWER))
+		keep_power = MTRUE;
+	else
+		keep_power = MFALSE;
+	pci_set_power_state(pdev, PCI_D0);
+	pci_restore_state(pdev);
+	pci_enable_wake(pdev, PCI_D0, 0);
+	if (!keep_power) {
+		handle->surprise_removed = MFALSE;
+		woal_do_flr(handle, false, false);
+	} else {
+		if (woal_check_driver_status(handle)) {
+			PRINTM(MERROR, "Resuem, device is in hang state\n");
+			LEAVE();
+			return MLAN_STATUS_SUCCESS;
+		}
+		for (i = 0; i < handle->priv_num; i++)
+			netif_device_attach(handle->priv[i]->netdev);
+
+		woal_cancel_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY),
+			       MOAL_NO_WAIT);
 	}
-	for (i = 0; i < handle->priv_num; i++)
-		netif_device_attach(handle->priv[i]->netdev);
-
-	woal_cancel_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY), MOAL_NO_WAIT);
-
 done:
 	PRINTM(MCMND, "<--- Leave woal_pcie_resume --->\n");
 	LEAVE();
@@ -689,10 +758,10 @@ static void woal_pcie_reset_prepare(struct pci_dev *pdev)
 		}
 	}
 	handle->surprise_removed = MTRUE;
-	woal_do_flr(handle, true);
+	woal_do_flr(handle, true, true);
 	if (ref_handle) {
 		ref_handle->surprise_removed = MTRUE;
-		woal_do_flr(ref_handle, true);
+		woal_do_flr(ref_handle, true, true);
 	}
 
 	LEAVE();
@@ -741,16 +810,16 @@ static void woal_pcie_reset_done(struct pci_dev *pdev)
 		}
 	}
 	handle->surprise_removed = MFALSE;
-	woal_do_flr(handle, false);
+	woal_do_flr(handle, false, true);
 	if (ref_handle) {
 		ref_handle->surprise_removed = MFALSE;
-		woal_do_flr(ref_handle, false);
+		woal_do_flr(ref_handle, false, true);
 	}
 
 	LEAVE();
 }
 #else
-void woal_pcie_reset_notify(struct pci_dev *pdev, bool prepare)
+static void woal_pcie_reset_notify(struct pci_dev *pdev, bool prepare)
 {
 	pcie_service_card *card;
 	moal_handle *handle;
@@ -793,10 +862,10 @@ void woal_pcie_reset_notify(struct pci_dev *pdev, bool prepare)
 		 * Note. FW might not be healthy.
 		 */
 		handle->surprise_removed = MTRUE;
-		woal_do_flr(handle, prepare);
+		woal_do_flr(handle, prepare, true);
 		if (ref_handle) {
 			ref_handle->surprise_removed = MTRUE;
-			woal_do_flr(ref_handle, prepare);
+			woal_do_flr(ref_handle, prepare, true);
 		}
 	} else {
 		/* Kernel stores and restores PCIe function context before and
@@ -805,10 +874,10 @@ void woal_pcie_reset_notify(struct pci_dev *pdev, bool prepare)
 		 * Reconfigure the sw and fw including fw redownload
 		 */
 		handle->surprise_removed = MFALSE;
-		woal_do_flr(handle, prepare);
+		woal_do_flr(handle, prepare, true);
 		if (ref_handle) {
 			ref_handle->surprise_removed = MFALSE;
-			woal_do_flr(ref_handle, prepare);
+			woal_do_flr(ref_handle, prepare, true);
 		}
 	}
 	LEAVE();
@@ -899,8 +968,9 @@ static mlan_status woal_pcie_read_reg(moal_handle *handle, t_u32 reg,
  *
  *  @return    		MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_pcie_write_data_sync(moal_handle *handle, mlan_buffer *pmbuf,
-				      t_u32 port, t_u32 timeout)
+static mlan_status woal_pcie_write_data_sync(moal_handle *handle,
+					     mlan_buffer *pmbuf, t_u32 port,
+					     t_u32 timeout)
 {
 	return MLAN_STATUS_SUCCESS;
 }
@@ -915,8 +985,9 @@ mlan_status woal_pcie_write_data_sync(moal_handle *handle, mlan_buffer *pmbuf,
  *
  *  @return    		MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_pcie_read_data_sync(moal_handle *handle, mlan_buffer *pmbuf,
-				     t_u32 port, t_u32 timeout)
+static mlan_status woal_pcie_read_data_sync(moal_handle *handle,
+					    mlan_buffer *pmbuf, t_u32 port,
+					    t_u32 timeout)
 {
 	return MLAN_STATUS_SUCCESS;
 }
@@ -1029,7 +1100,8 @@ exit:
 static mlan_status woal_pcie_preinit(struct pci_dev *pdev)
 {
 	int ret;
-
+	if (pdev->multifunction)
+		device_disable_async_suspend(&pdev->dev);
 	ret = pci_enable_device(pdev);
 	if (ret)
 		goto err_enable_dev;
@@ -1064,7 +1136,7 @@ err_enable_dev:
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_pcie_init(pcie_service_card *card)
+static mlan_status woal_pcie_init(pcie_service_card *card)
 {
 	struct pci_dev *pdev = NULL;
 	int ret;
@@ -1267,7 +1339,7 @@ done:
  *
  *  @return         N/A
  */
-void woal_pcie_cleanup(pcie_service_card *card)
+static void woal_pcie_cleanup(pcie_service_card *card)
 {
 	struct pci_dev *pdev = NULL;
 	pdev = card->dev;
@@ -1350,23 +1422,9 @@ mlan_status woal_pcie_bus_register(void)
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	ENTER();
 
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
-	pm_qos_add_request(&woal_pcie_pm_qos_req, PM_QOS_CPU_DMA_LATENCY, 0);
-#endif
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 70)
-	request_bus_freq(BUS_FREQ_HIGH);
-#endif
 	/* API registers the NXP PCIE driver */
 	if (pci_register_driver(&wlan_pcie)) {
 		PRINTM(MFATAL, "PCIE Driver Registration Failed \n");
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
-		pm_qos_remove_request(&woal_pcie_pm_qos_req);
-#endif
-#endif
 		ret = MLAN_STATUS_FAILURE;
 	}
 
@@ -1383,16 +1441,8 @@ void woal_pcie_bus_unregister(void)
 {
 	ENTER();
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 70)
-	release_bus_freq(BUS_FREQ_HIGH);
-#endif
 	/* PCIE Driver Unregistration */
 	pci_unregister_driver(&wlan_pcie);
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(5, 6, 0)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
-	pm_qos_remove_request(&woal_pcie_pm_qos_req);
-#endif
-#endif
 
 	LEAVE();
 }
@@ -1431,7 +1481,7 @@ void woal_pcie_bus_unregister(void)
  *
  *  @return         The length of this log
  */
-int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
+static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 {
 	char *drv_ptr = (char *)buffer;
 	t_u32 reg = 0, value = 0;
@@ -1715,7 +1765,6 @@ typedef enum {
 
 #define MAX_NAME_LEN 8
 #define MAX_FULL_NAME_LEN 32
-t_u8 *name_prefix = "/data/file_";
 
 typedef struct {
 	t_u8 mem_name[MAX_NAME_LEN];
@@ -1725,16 +1774,10 @@ typedef struct {
 	t_u8 type;
 } memory_type_mapping;
 
-typedef enum {
-	RDWR_STATUS_SUCCESS = 0,
-	RDWR_STATUS_FAILURE = 1,
-	RDWR_STATUS_DONE = 2
-} rdwr_status;
-
 #ifdef PCIE8897
 #define DEBUG_HOST_READY_8897 0xEE
 #define DEBUG_MEMDUMP_FINISH_8897 0xFE
-memory_type_mapping mem_type_mapping_tbl_8897[] = {
+static memory_type_mapping mem_type_mapping_tbl_8897[] = {
 	{"ITCM", NULL, NULL, 0xF0, FW_DUMP_TYPE_MEM_ITCM},
 	{"DTCM", NULL, NULL, 0xF1, FW_DUMP_TYPE_MEM_DTCM},
 	{"SQRAM", NULL, NULL, 0xF2, FW_DUMP_TYPE_MEM_SQRAM},
@@ -1750,8 +1793,8 @@ memory_type_mapping mem_type_mapping_tbl_8897[] = {
 #define DEBUG_HOST_READY_8997 0xCC
 #define DEBUG_HOST_EVENT_READY 0xAA
 #define DEBUG_MEMDUMP_FINISH_8997 0xDD
-memory_type_mapping mem_type_mapping_tbl_8997 = {"DUMP", NULL, NULL, 0xDD,
-						 0x00};
+static memory_type_mapping mem_type_mapping_tbl_8997 = {"DUMP", NULL, NULL,
+							0xDD, 0x00};
 
 #endif
 
@@ -1766,7 +1809,8 @@ memory_type_mapping mem_type_mapping_tbl_8997 = {"DUMP", NULL, NULL, 0xDD,
  *
  *  @return    		MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_read_reg_eight_bit(moal_handle *handle, t_u32 reg, t_u8 *data)
+static mlan_status woal_read_reg_eight_bit(moal_handle *handle, t_u32 reg,
+					   t_u8 *data)
 {
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 	*data = ioread8(card->pci_mmap1 + reg);
@@ -1781,7 +1825,7 @@ mlan_status woal_read_reg_eight_bit(moal_handle *handle, t_u32 reg, t_u8 *data)
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
+static rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
 {
 	int ret = 0;
 	int tries = 0;
@@ -1819,6 +1863,13 @@ rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
 		PRINTM(MERROR, "PCIE Write ERR\n");
 		return RDWR_STATUS_FAILURE;
 	}
+#if defined(PCIE9098) || defined(PCIE9097)
+	if (IS_PCIE9098(phandle->card_type) ||
+	    IS_PCIE9097(phandle->card_type)) {
+		if (phandle->event_fw_dump)
+			return RDWR_STATUS_SUCCESS;
+	}
+#endif
 	ret = woal_pcie_read_reg(phandle, dump_ctrl_reg, &reg_data);
 	if (ret) {
 		PRINTM(MERROR, "PCIE Read DEBUG_DUMP_CTRL_REG fail\n");
@@ -1866,7 +1917,7 @@ rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
  *
  *  @return         N/A
  */
-void woal_pcie_dump_fw_info_v1(moal_handle *phandle)
+static void woal_pcie_dump_fw_info_v1(moal_handle *phandle)
 {
 	int ret = 0;
 	unsigned int reg, reg_start, reg_end;
@@ -2034,7 +2085,7 @@ done:
  *
  *  @return         N/A
  */
-void woal_pcie_dump_fw_info_v2(moal_handle *phandle)
+static void woal_pcie_dump_fw_info_v2(moal_handle *phandle)
 {
 	int ret = 0;
 	unsigned int reg, reg_start, reg_end;
@@ -2061,11 +2112,11 @@ void woal_pcie_dump_fw_info_v2(moal_handle *phandle)
 	    IS_PCIE9097(phandle->card_type)) {
 		if (phandle->event_fw_dump) {
 			if (RDWR_STATUS_FAILURE !=
-			    woal_pcie_rdwr_firmware(phandle, doneflag))
+			    woal_pcie_rdwr_firmware(phandle, doneflag)) {
 				PRINTM(MMSG,
 				       "====PCIE FW DUMP EVENT MODE START ====\n");
-			phandle->event_fw_dump = MFALSE;
-			return;
+				return;
+			}
 		}
 	}
 #endif
@@ -2165,15 +2216,19 @@ void woal_pcie_dump_fw_info_v2(moal_handle *phandle)
 			}
 		}
 		if (RDWR_STATUS_DONE == stat) {
+#ifdef MLAN_64BIT
 			PRINTM(MMSG,
 			       "%s done:"
-#ifdef MLAN_64BIT
 			       "size = 0x%lx\n",
-#else
-			       "size = 0x%x\n",
-#endif
 			       mem_type_mapping_tbl->mem_name,
 			       dbg_ptr - mem_type_mapping_tbl->mem_Ptr);
+#else
+			PRINTM(MMSG,
+			       "%s done:"
+			       "size = 0x%x\n",
+			       mem_type_mapping_tbl->mem_name,
+			       dbg_ptr - mem_type_mapping_tbl->mem_Ptr);
+#endif
 			memset(file_name, 0, sizeof(file_name));
 			sprintf(file_name, "%s%s", "file_pcie_",
 				mem_type_mapping_tbl->mem_name);
@@ -2225,7 +2280,7 @@ static t_u8 woal_pcie_is_second_mac(moal_handle *handle)
 	return MFALSE;
 }
 
-void woal_pcie_dump_fw_info(moal_handle *phandle)
+static void woal_pcie_dump_fw_info(moal_handle *phandle)
 {
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
 	phandle->fw_dump = MTRUE;
@@ -2235,8 +2290,15 @@ void woal_pcie_dump_fw_info(moal_handle *phandle)
 #endif
 #if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097)
 	if (IS_PCIE8997(phandle->card_type) ||
-	    IS_PCIE9098(phandle->card_type) || IS_PCIE9097(phandle->card_type))
+	    IS_PCIE9098(phandle->card_type) ||
+	    IS_PCIE9097(phandle->card_type)) {
 		woal_pcie_dump_fw_info_v2(phandle);
+		if (phandle->event_fw_dump) {
+			phandle->event_fw_dump = MFALSE;
+			queue_work(phandle->workqueue, &phandle->main_work);
+			return;
+		}
+	}
 #endif
 	phandle->fw_dump = MFALSE;
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_pcie.h b/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
index ae22f4d..1f3fd71 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
@@ -139,4 +139,10 @@ typedef struct _pcie_service_card {
 mlan_status woal_pcie_bus_register(void);
 /** Unregister from bus driver function */
 void woal_pcie_bus_unregister(void);
+
+/* pmqos busfreq request handler*/
+void woal_request_pmqos_busfreq_high(void);
+/* pmqos busfreq release handler*/
+void woal_release_pmqos_busfreq_high(void);
+
 #endif /* _MOAL_PCIE_H_ */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_priv.c b/mxm_wifiex/wlan_src/mlinux/moal_priv.c
index 8fa497b..c1ec0e6 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_priv.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_priv.c
@@ -3,7 +3,7 @@
  * @brief This file contains standard ioctl functions
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -586,7 +586,7 @@ static int woal_11n_htcap_cfg(moal_private *priv, struct iwreq *wrq)
 			ret = -EFAULT;
 			goto done;
 		}
-		if (cfg_11n->param.htcap_cfg.htcap != data[0]) {
+		if ((int)cfg_11n->param.htcap_cfg.htcap != data[0]) {
 			data_length = 2;
 			data[1] = cfg_11n->param.htcap_cfg.htcap;
 			PRINTM(MINFO, "GET: htcapinfo for 2.4GHz:0x%x\n",
@@ -1157,8 +1157,8 @@ static int woal_hs_cfg(moal_private *priv, struct iwreq *wrq,
 	}
 
 	/* HS config is blocked if HS is already activated */
-	if (data_length &&
-	    (data[0] != HOST_SLEEP_CFG_CANCEL || invoke_hostcmd == MFALSE)) {
+	if (data_length && (data[0] != (int)HOST_SLEEP_CFG_CANCEL ||
+			    invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
 		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
 		if (bss_info.is_hs_configured) {
@@ -2171,7 +2171,7 @@ static int woal_tx_power_cfg(moal_private *priv, struct iwreq *wrq)
 		i = 0;
 		power_ext_len = 0;
 		ptr = power_data;
-		while ((i < pcfg->param.power_ext.num_pwr_grp) &&
+		while ((i < (int)pcfg->param.power_ext.num_pwr_grp) &&
 		       ((power_ext_len + 5) < MAX_POWER_TABLE_SIZE)) {
 			pwr_grp = &pcfg->param.power_ext.power_group[i];
 			if (pwr_grp->rate_format == MLAN_RATE_FORMAT_HT) {
@@ -3565,7 +3565,7 @@ static int woal_passphrase(moal_private *priv, struct iwreq *wrq)
 		ret = -EOPNOTSUPP;
 		goto done;
 	}
-	if (!data_length || data_length >= sizeof(buf) - 1) {
+	if (!data_length || data_length >= (int)sizeof(buf) - 1) {
 		PRINTM(MERROR,
 		       "Argument missing or too long for setpassphrase\n");
 		ret = -EINVAL;
@@ -4103,7 +4103,7 @@ static int woal_tx_bf_cfg_ioctl(moal_private *priv, struct iwreq *wrq)
 	char_count = data_length - 1;
 	memset(buf, 0, sizeof(buf));
 	if (char_count) {
-		if (data_length > sizeof(buf)) {
+		if (data_length > (int)sizeof(buf)) {
 			PRINTM(MERROR, "Too many arguments\n");
 			ret = -EINVAL;
 			goto done;
@@ -4331,7 +4331,7 @@ static int woal_tx_bf_cfg_ioctl(moal_private *priv, struct iwreq *wrq)
 					       bf_periodicity->interval);
 			break;
 		case TX_BF_FOR_PEER_ENBL:
-			for (i = 0; i < bf_cfg.no_of_peers; i++) {
+			for (i = 0; i < (int)bf_cfg.no_of_peers; i++) {
 				data_length +=
 					sprintf(buf + data_length,
 						"%02x:%02x:%02x:%02x:%02x:%02x",
@@ -4354,7 +4354,7 @@ static int woal_tx_bf_cfg_ioctl(moal_private *priv, struct iwreq *wrq)
 			}
 			break;
 		case SET_SNR_THR_PEER:
-			for (i = 0; i < bf_cfg.no_of_peers; i++) {
+			for (i = 0; i < (int)bf_cfg.no_of_peers; i++) {
 				data_length +=
 					sprintf(buf + data_length,
 						"%02x:%02x:%02x:%02x:%02x:%02x",
@@ -4415,10 +4415,12 @@ static int moal_ret_get_scan_table_ioctl(struct iwreq *wrq,
 	num_scans_done = 0;
 	ret_code = MLAN_STATUS_SUCCESS;
 
-	prsp_info = (wlan_ioctl_get_scan_table_info *)wrq->u.data.pointer;
+	prsp_info =
+		(wlan_ioctl_get_scan_table_info __force *)wrq->u.data.pointer;
 	pcurrent = (t_u8 *)prsp_info->scan_table_entry_buf;
 
-	pbuffer_end = wrq->u.data.pointer + wrq->u.data.length - 1;
+	pbuffer_end =
+		(t_u8 __force *)wrq->u.data.pointer + wrq->u.data.length - 1;
 	space_left = pbuffer_end - pcurrent;
 	scan_table = (BSSDescriptor_t *)(scan_resp->pscan_table);
 
@@ -4459,7 +4461,7 @@ static int moal_ret_get_scan_table_ioctl(struct iwreq *wrq,
 	}
 
 	prsp_info->scan_number = num_scans_done;
-	ret_len = pcurrent - (t_u8 *)wrq->u.data.pointer;
+	ret_len = pcurrent - (t_u8 __force *)wrq->u.data.pointer;
 
 	wrq->u.data.length = ret_len;
 
@@ -4482,7 +4484,6 @@ static int moal_ret_get_scan_table_ioctl(struct iwreq *wrq,
 static mlan_status woal_get_scan_table_ioctl(moal_private *priv,
 					     struct iwreq *wrq)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_scan *scan = NULL;
 	int scan_start = 0;
@@ -4493,7 +4494,7 @@ static mlan_status woal_get_scan_table_ioctl(moal_private *priv,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_scan));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -4506,7 +4507,6 @@ static mlan_status woal_get_scan_table_ioctl(moal_private *priv,
 	if (copy_from_user(&scan_start, wrq->u.data.pointer,
 			   sizeof(scan_start))) {
 		PRINTM(MERROR, "copy from user failed\n");
-		ret = -EFAULT;
 		goto done;
 	}
 	if (scan_start > 0)
@@ -4760,7 +4760,7 @@ done:
 static int woal_cmd53rdwr_ioctl(moal_private *priv, struct iwreq *wrq)
 {
 	t_u8 *buf = NULL;
-	t_u8 rw, func, mode;
+	t_u8 rw, mode;
 	t_u16 blklen = 0, blknum = 0;
 	int reg = 0, pattern_len = 0, pos = 0, ret = MLAN_STATUS_SUCCESS;
 	t_u32 total_len = 0;
@@ -4792,7 +4792,6 @@ static int woal_cmd53rdwr_ioctl(moal_private *priv, struct iwreq *wrq)
 	}
 
 	rw = buf[0]; /* read/write (0/1) */
-	func = buf[1]; /* func (0/1/2) */
 	reg = buf[5]; /* address */
 	reg = (reg << 8) + buf[4];
 	reg = (reg << 8) + buf[3];
@@ -4812,8 +4811,8 @@ static int woal_cmd53rdwr_ioctl(moal_private *priv, struct iwreq *wrq)
 		goto done;
 	}
 	PRINTM(MINFO,
-	       "CMD53 read/write, func = %d, addr = %#x, mode = %d, block size = %d, block(byte) number = %d\n",
-	       func, reg, mode, blklen, blknum);
+	       "CMD53 read/write, addr = %#x, mode = %d, block size = %d, block(byte) number = %d\n",
+	       reg, mode, blklen, blknum);
 
 	if (!rw) {
 		sdio_claim_host(
@@ -4835,12 +4834,12 @@ static int woal_cmd53rdwr_ioctl(moal_private *priv, struct iwreq *wrq)
 		wrq->u.data.length = total_len;
 	} else {
 		pattern_len = wrq->u.data.length - 11;
-		if (pattern_len > total_len)
+		if (pattern_len > (int)total_len)
 			pattern_len = total_len;
 		memset(data, 0, WOAL_2K_BYTES);
 
 		/* Copy/duplicate the pattern to data buffer */
-		for (pos = 0; pos < total_len; pos++)
+		for (pos = 0; pos < (int)total_len; pos++)
 			data[pos] = buf[11 + (pos % pattern_len)];
 
 		sdio_claim_host(
@@ -5924,8 +5923,8 @@ static int woal_dfs_testing(moal_private *priv, struct iwreq *wrq)
 			ret = -EFAULT;
 			goto done;
 		}
-		if ((unsigned)data[0] > 0xFFFF) {
-			PRINTM(MERROR, "The maximum user CAC is 65535 msec.\n");
+		if ((unsigned)data[0] > 1800) {
+			PRINTM(MERROR, "The maximum user CAC is 1800 sec.\n");
 			ret = -EINVAL;
 			goto done;
 		}
@@ -5947,7 +5946,7 @@ static int woal_dfs_testing(moal_private *priv, struct iwreq *wrq)
 		ds_11hcfg->param.dfs_testing.usr_no_chan_change =
 			data[2] ? 1 : 0;
 		ds_11hcfg->param.dfs_testing.usr_fixed_new_chan = (t_u8)data[3];
-		priv->phandle->cac_period_jiffies = (t_u16)data[0] * HZ / 1000;
+		priv->phandle->cac_period_jiffies = (t_u16)data[0] * HZ;
 		req->action = MLAN_ACT_SET;
 	} else {
 		PRINTM(MERROR, "Invalid number of args!\n");
@@ -6716,7 +6715,6 @@ int woal_wext_do_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
 mlan_status woal_get_data_rates(moal_private *priv, t_u8 wait_option,
 				moal_802_11_rates *m_rates)
 {
-	int ret = 0;
 	mlan_ds_rate *rate = NULL;
 	mlan_ioctl_req *req = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -6725,7 +6723,7 @@ mlan_status woal_get_data_rates(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_rate));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
@@ -6763,7 +6761,6 @@ done:
 mlan_status woal_get_channel_list(moal_private *priv, t_u8 wait_option,
 				  mlan_chan_list *chan_list)
 {
-	int ret = 0;
 	mlan_ds_bss *bss = NULL;
 	mlan_ioctl_req *req = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -6772,7 +6769,7 @@ mlan_status woal_get_channel_list(moal_private *priv, t_u8 wait_option,
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_bss));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto done;
 	}
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_proc.c b/mxm_wifiex/wlan_src/mlinux/moal_proc.c
index b683133..867159e 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_proc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_proc.c
@@ -3,7 +3,7 @@
  * @brief This file contains functions for proc file.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -41,7 +41,7 @@ Change log:
 #define MWLAN_PROC "mwlan"
 #define WLAN_PROC "adapter%d"
 /** Proc mwlan directory entry */
-struct proc_dir_entry *proc_mwlan;
+static struct proc_dir_entry *proc_mwlan;
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 #define PROC_DIR NULL
@@ -220,7 +220,7 @@ static int woal_info_proc_read(struct seq_file *sfp, void *data)
 	seq_printf(sfp, "carrier %s\n",
 		   ((netif_carrier_ok(priv->netdev)) ? "on" : "off"));
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
-	for (i = 0; i < netdev->num_tx_queues; i++) {
+	for (i = 0; i < (int)netdev->num_tx_queues; i++) {
 		seq_printf(sfp, "tx queue %d:  %s\n", i,
 			   ((netif_tx_queue_stopped(
 				    netdev_get_tx_queue(netdev, 0))) ?
@@ -287,6 +287,18 @@ static int woal_info_proc_read(struct seq_file *sfp, void *data)
 		seq_printf(sfp, "[%d] Tx bytes rate  : %luMbps\n", i,
 			   handle->tp_acnt.tx_bytes_rate[i] * 8 / 1024 / 1024);
 	}
+	seq_printf(sfp, "Tx amsdu cnt		: %lu\n",
+		   handle->tp_acnt.tx_amsdu_cnt);
+	seq_printf(sfp, "Tx amsdu cnt last	: %lu\n",
+		   handle->tp_acnt.tx_amsdu_cnt_last);
+	seq_printf(sfp, "Tx amsdu cnt rate	: %lu\n",
+		   handle->tp_acnt.tx_amsdu_cnt_rate);
+	seq_printf(sfp, "Tx amsdu pkt cnt	: %lu\n",
+		   handle->tp_acnt.tx_amsdu_pkt_cnt);
+	seq_printf(sfp, "Tx amsdu pkt cnt last : %lu\n",
+		   handle->tp_acnt.tx_amsdu_pkt_cnt_last);
+	seq_printf(sfp, "Tx amsdu pkt cnt rate : %lu\n",
+		   handle->tp_acnt.tx_amsdu_pkt_cnt_rate);
 	seq_printf(sfp, "Tx intr cnt    		: %lu\n",
 		   handle->tp_acnt.tx_intr_cnt);
 	seq_printf(sfp, "Tx intr last        : %lu\n",
@@ -295,6 +307,10 @@ static int woal_info_proc_read(struct seq_file *sfp, void *data)
 		   handle->tp_acnt.tx_intr_rate);
 	seq_printf(sfp, "Tx pending          : %lu\n",
 		   handle->tp_acnt.tx_pending);
+	seq_printf(sfp, "Tx xmit skb realloc : %lu\n",
+		   handle->tp_acnt.tx_xmit_skb_realloc_cnt);
+	seq_printf(sfp, "Tx stop queue cnt : %lu\n",
+		   handle->tp_acnt.tx_stop_queue_cnt);
 	seq_printf(sfp, "====Rx accounting====\n");
 	for (i = 0; i < MAX_TP_ACCOUNT_DROP_POINT_NUM; i++) {
 		seq_printf(sfp, "[%d] Rx packets     : %lu\n", i,
@@ -310,6 +326,18 @@ static int woal_info_proc_read(struct seq_file *sfp, void *data)
 		seq_printf(sfp, "[%d] Rx bytes rate  : %luMbps\n", i,
 			   handle->tp_acnt.rx_bytes_rate[i] * 8 / 1024 / 1024);
 	}
+	seq_printf(sfp, "Rx amsdu cnt		 : %lu\n",
+		   handle->tp_acnt.rx_amsdu_cnt);
+	seq_printf(sfp, "Rx amsdu cnt last	 : %lu\n",
+		   handle->tp_acnt.rx_amsdu_cnt_last);
+	seq_printf(sfp, "Rx amsdu cnt rate	 : %lu\n",
+		   handle->tp_acnt.rx_amsdu_cnt_rate);
+	seq_printf(sfp, "Rx amsdu pkt cnt	 : %lu\n",
+		   handle->tp_acnt.rx_amsdu_pkt_cnt);
+	seq_printf(sfp, "Rx amsdu pkt cnt last : %lu\n",
+		   handle->tp_acnt.rx_amsdu_pkt_cnt_last);
+	seq_printf(sfp, "Rx amsdu pkt cnt rate : %lu\n",
+		   handle->tp_acnt.rx_amsdu_pkt_cnt_rate);
 	seq_printf(sfp, "Rx intr cnt    	 : %lu\n",
 		   handle->tp_acnt.rx_intr_cnt);
 	seq_printf(sfp, "Rx intr last        : %lu\n",
@@ -320,6 +348,8 @@ static int woal_info_proc_read(struct seq_file *sfp, void *data)
 		   handle->tp_acnt.rx_pending);
 	seq_printf(sfp, "Rx pause            : %lu\n",
 		   handle->tp_acnt.rx_paused_cnt);
+	seq_printf(sfp, "Rx rdptr full cnt   : %lu\n",
+		   handle->tp_acnt.rx_rdptr_full_cnt);
 exit:
 	LEAVE();
 	MODULE_PUT;
@@ -578,6 +608,11 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 		config_data = (t_u32)woal_string_to_number(line);
 		cmd = MFG_CMD_RX_ANT;
 	}
+	if (!strncmp(databuf, "radio_mode", strlen("radio_mode"))) {
+		line += strlen("radio_mode") + 1;
+		config_data = (t_u32)woal_string_to_number(line);
+		cmd = MFG_CMD_RADIO_MODE_CFG;
+	}
 	if (!strncmp(databuf, "channel", strlen("channel"))) {
 		line += strlen("channel") + 1;
 		config_data = (t_u32)woal_string_to_number(line);
@@ -604,6 +639,9 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 	if (!strncmp(databuf, "tx_continuous=", strlen("tx_continuous=")) &&
 	    count > strlen("tx_continuous="))
 		cmd = MFG_CMD_TX_CONT;
+	if (!strncmp(databuf, "he_tb_tx=", strlen("he_tb_tx=")) &&
+	    count > strlen("he_tb_tx="))
+		cmd = MFG_CMD_CONFIG_MAC_HE_TB_TX;
 
 	if (cmd && handle->rf_test_mode &&
 	    (woal_process_rf_test_mode_cmd(
@@ -659,6 +697,16 @@ static int woal_config_read(struct seq_file *sfp, void *data)
 				   handle->rf_data->channel);
 		else
 			seq_printf(sfp, "channel=\n");
+		if (handle->rf_data->radio_mode[0])
+			seq_printf(sfp, "radio_mode[0]=%u\n",
+				   handle->rf_data->radio_mode[0]);
+		else
+			seq_printf(sfp, "radio_mode[0]=\n");
+		if (handle->rf_data->radio_mode[1])
+			seq_printf(sfp, "radio_mode[1]=%u\n",
+				   handle->rf_data->radio_mode[1]);
+		else
+			seq_printf(sfp, "radio_mode[1]=\n");
 		seq_printf(sfp, "total rx pkt count=%u\n",
 			   handle->rf_data->rx_tot_pkt_count);
 		seq_printf(sfp, "rx multicast/broadcast pkt count=%u\n",
@@ -696,6 +744,9 @@ static int woal_config_read(struct seq_file *sfp, void *data)
 			for (i = 3; i < 13; i++)
 				seq_printf(sfp, " %u",
 					   handle->rf_data->tx_frame_data[i]);
+			for (i = 13; i < 20; i++)
+				seq_printf(sfp, " %u",
+					   handle->rf_data->tx_frame_data[i]);
 			seq_printf(sfp, " %02x:%02x:%02x:%02x:%02x:%02x",
 				   handle->rf_data->bssid[0],
 				   handle->rf_data->bssid[1],
@@ -705,6 +756,14 @@ static int woal_config_read(struct seq_file *sfp, void *data)
 				   handle->rf_data->bssid[5]);
 		}
 		seq_printf(sfp, "\n");
+		seq_printf(sfp, "he_tb_tx=%u", handle->rf_data->he_tb_tx[0]);
+		if (handle->rf_data->he_tb_tx[0] == MTRUE) {
+			seq_printf(sfp, " %u", handle->rf_data->he_tb_tx[1]);
+			seq_printf(sfp, " %u", handle->rf_data->he_tb_tx[2]);
+			seq_printf(sfp, " %u", handle->rf_data->he_tb_tx[3]);
+			seq_printf(sfp, " %u", handle->rf_data->he_tb_tx[4]);
+		}
+		seq_printf(sfp, "\n");
 	}
 	MODULE_PUT;
 	LEAVE();
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sdio.h b/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
index 939ab70..957f511 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
@@ -4,7 +4,7 @@
  * driver.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
index 96c4c8a..fab3955 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
@@ -4,7 +4,7 @@
  *  related functions.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -31,7 +31,8 @@ Change log:
 #include "moal_sdio.h"
 
 /** define nxp vendor id */
-#define NXP_VENDOR_ID 0x02df
+#define NXP_VENDOR_ID 0x0471
+#define MRVL_VENDOR_ID 0x02df
 
 /********************************************************
 		Local Variables
@@ -84,29 +85,29 @@ static moal_if_ops sdiommc_ops;
 /** WLAN IDs */
 static const struct sdio_device_id wlan_ids[] = {
 #ifdef SD8887
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_8887)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8887)},
 #endif
 #ifdef SD8897
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_8897)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8897)},
 #endif
 #ifdef SD8977
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_8977)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8977)},
 #endif
 #ifdef SD8978
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_8978)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8978)},
 #endif
 #ifdef SD8997
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_8997)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8997)},
 #endif
 #ifdef SD8987
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_8987)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8987)},
 #endif
 #ifdef SD9098
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_9098_FN1)},
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_9098_FN2)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN1)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN2)},
 #endif
 #ifdef SD9097
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_9097)},
+	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9097)},
 #endif
 	{},
 };
@@ -165,13 +166,13 @@ static struct sdio_driver REFDATA wlan_sdio = {
 		Local Functions
 ********************************************************/
 static void woal_sdiommc_dump_fw_info(moal_handle *phandle);
-
+#if 0
 /**  @brief This function dump the sdio register
  *
  *  @param handle   A Pointer to the moal_handle structure
  *  @return         N/A
  */
-void woal_dump_sdio_reg(moal_handle *handle)
+static void woal_dump_sdio_reg(moal_handle *handle)
 {
 	int ret = 0;
 	t_u8 data, i;
@@ -210,6 +211,7 @@ void woal_dump_sdio_reg(moal_handle *handle)
 	}
 	return;
 }
+#endif
 /********************************************************
 		Global Functions
 ********************************************************/
@@ -286,6 +288,7 @@ static t_u16 woal_update_card_type(t_void *card)
 				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
 	}
 #endif
+
 #ifdef SD8897
 	if (cardp_sd->func->device == SD_DEVICE_ID_8897) {
 		card_type = CARD_TYPE_SD8897;
@@ -525,7 +528,6 @@ void woal_sdio_shutdown(struct device *dev)
 	moal_handle *handle = NULL;
 	struct sdio_mmc_card *cardp;
 	mlan_ds_ps_info pm_info;
-	int timeout = 0;
 	int i, retry_num = 8;
 
 	ENTER();
@@ -562,7 +564,7 @@ void woal_sdio_shutdown(struct device *dev)
 		}
 		woal_enable_hs(woal_get_priv(handle, MLAN_BSS_ROLE_ANY));
 
-		timeout = wait_event_interruptible_timeout(
+		wait_event_interruptible_timeout(
 			handle->hs_activate_wait_q,
 			handle->hs_activate_wait_q_woken, HS_ACTIVE_TIMEOUT);
 		if (handle->hs_activated == MTRUE)
@@ -812,7 +814,7 @@ static mlan_status woal_sdiommc_read_reg(moal_handle *handle, t_u32 reg,
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_sdio_writeb(moal_handle *handle, t_u32 reg, t_u8 data)
+static mlan_status woal_sdio_writeb(moal_handle *handle, t_u32 reg, t_u8 data)
 {
 	mlan_status ret = MLAN_STATUS_FAILURE;
 	sdio_claim_host(((struct sdio_mmc_card *)handle->card)->func);
@@ -831,7 +833,7 @@ mlan_status woal_sdio_writeb(moal_handle *handle, t_u32 reg, t_u8 data)
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_sdio_readb(moal_handle *handle, t_u32 reg, t_u8 *data)
+static mlan_status woal_sdio_readb(moal_handle *handle, t_u32 reg, t_u8 *data)
 {
 	mlan_status ret = MLAN_STATUS_FAILURE;
 	t_u8 val;
@@ -853,7 +855,8 @@ mlan_status woal_sdio_readb(moal_handle *handle, t_u32 reg, t_u8 *data)
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_sdio_f0_readb(moal_handle *handle, t_u32 reg, t_u8 *data)
+static mlan_status woal_sdio_f0_readb(moal_handle *handle, t_u32 reg,
+				      t_u8 *data)
 {
 	mlan_status ret = MLAN_STATUS_FAILURE;
 	t_u8 val;
@@ -876,8 +879,8 @@ mlan_status woal_sdio_f0_readb(moal_handle *handle, t_u32 reg, t_u8 *data)
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_sdio_rw_mb(moal_handle *handle, pmlan_buffer pmbuf_list,
-			    t_u32 port, t_u8 write)
+static mlan_status woal_sdio_rw_mb(moal_handle *handle, pmlan_buffer pmbuf_list,
+				   t_u32 port, t_u8 write)
 {
 	struct scatterlist sg_list[SDIO_MP_AGGR_DEF_PKT_LIMIT_MAX];
 	int num_sg = pmbuf_list->use_count;
@@ -1477,7 +1480,7 @@ typedef struct {
 	t_u8 type;
 } memory_type_mapping;
 
-memory_type_mapping mem_type_mapping_tbl[] = {
+static memory_type_mapping mem_type_mapping_tbl[] = {
 	{"ITCM", NULL, NULL, 0xF0, FW_DUMP_TYPE_MEM_ITCM},
 	{"DTCM", NULL, NULL, 0xF1, FW_DUMP_TYPE_MEM_DTCM},
 	{"SQRAM", NULL, NULL, 0xF2, FW_DUMP_TYPE_MEM_SQRAM},
@@ -1494,15 +1497,8 @@ memory_type_mapping mem_type_mapping_tbl[] = {
 	{"EXT13", NULL, NULL, 0xFD, 0},
 	{"EXTLAST", NULL, NULL, 0xFE, 0},
 };
-memory_type_mapping mem_type_mapping_tbl_8977_8997 = {"DUMP", NULL, NULL, 0xDD,
-						      0};
-
-typedef enum {
-	RDWR_STATUS_SUCCESS = 0,
-	RDWR_STATUS_FAILURE = 1,
-	RDWR_STATUS_DONE = 2
-} rdwr_status;
-
+static memory_type_mapping mem_type_mapping_tbl_8977_8997 = {"DUMP", NULL, NULL,
+							     0xDD, 0};
 /**
  *  @brief This function read/write firmware via cmd52
  *
@@ -1511,7 +1507,7 @@ typedef enum {
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-rdwr_status woal_cmd52_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
+static rdwr_status woal_cmd52_rdwr_firmware(moal_handle *phandle, t_u8 doneflag)
 {
 	int ret = 0;
 	int tries = 0;
@@ -1677,16 +1673,21 @@ void woal_dump_firmware_info_v2(moal_handle *phandle)
 					       "pre-allocced buf is not enough\n");
 			}
 			if (RDWR_STATUS_DONE == stat) {
+#ifdef MLAN_64BIT
 				PRINTM(MMSG,
 				       "%s done:"
-#ifdef MLAN_64BIT
 				       "size = 0x%lx\n",
-#else
-				       "size = 0x%x\n",
-#endif
 				       mem_type_mapping_tbl[idx].mem_name,
 				       dbg_ptr - mem_type_mapping_tbl[idx]
 							 .mem_Ptr);
+#else
+				PRINTM(MMSG,
+				       "%s done:"
+				       "size = 0x%x\n",
+				       mem_type_mapping_tbl[idx].mem_name,
+				       dbg_ptr - mem_type_mapping_tbl[idx]
+							 .mem_Ptr);
+#endif
 				memset(file_name, 0, sizeof(file_name));
 				sprintf(file_name, "%s%s", "file_sdio_",
 					mem_type_mapping_tbl[idx].mem_name);
@@ -1853,15 +1854,20 @@ void woal_dump_firmware_info_v3(moal_handle *phandle)
 			}
 		}
 		if (RDWR_STATUS_DONE == stat) {
+#ifdef MLAN_64BIT
 			PRINTM(MMSG,
 			       "%s done:"
-#ifdef MLAN_64BIT
 			       "size = 0x%lx\n",
-#else
-			       "size = 0x%x\n",
-#endif
 			       pmem_type_mapping_tbl->mem_name,
 			       dbg_ptr - pmem_type_mapping_tbl->mem_Ptr);
+#else
+			PRINTM(MMSG,
+			       "%s done:"
+			       "size = 0x%x\n",
+			       pmem_type_mapping_tbl->mem_name,
+			       dbg_ptr - pmem_type_mapping_tbl->mem_Ptr);
+
+#endif
 			memset(file_name, 0, sizeof(file_name));
 			sprintf(file_name, "%s%s", "file_sdio_",
 				pmem_type_mapping_tbl->mem_name);
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_shim.c b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
index 4028cd3..84c0966 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_shim.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
@@ -3,7 +3,7 @@
  * @brief This file contains the callback functions registered to MLAN
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -71,7 +71,7 @@ extern int wifi_status;
 /**
  *  @brief Alloc a buffer
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param size     The size of the buffer to be allocated
  *  @param flag     The type of the buffer to be allocated
  *  @param ppbuf    Pointer to a buffer location to store buffer pointer
@@ -79,11 +79,10 @@ extern int wifi_status;
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_malloc(t_void *pmoal_handle, t_u32 size, t_u32 flag,
-			t_u8 **ppbuf)
+mlan_status moal_malloc(t_void *pmoal, t_u32 size, t_u32 flag, t_u8 **ppbuf)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
-	t_u32 mem_flag =
+	moal_handle *handle = (moal_handle *)pmoal;
+	gfp_t mem_flag =
 		(in_interrupt() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
 
 #ifdef USB
@@ -107,14 +106,14 @@ mlan_status moal_malloc(t_void *pmoal_handle, t_u32 size, t_u32 flag,
 /**
  *  @brief Free a buffer
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pbuf     Pointer to the buffer to be freed
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_mfree(t_void *pmoal_handle, t_u8 *pbuf)
+mlan_status moal_mfree(t_void *pmoal, t_u8 *pbuf)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 
 	if (!pbuf)
 		return MLAN_STATUS_FAILURE;
@@ -126,16 +125,16 @@ mlan_status moal_mfree(t_void *pmoal_handle, t_u8 *pbuf)
 /**
  *  @brief Alloc a vitual-address-continuous buffer
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param size     The size of the buffer to be allocated
  *  @param ppbuf    Pointer to a buffer location to store buffer pointer
  * allocated
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_vmalloc(t_void *pmoal_handle, t_u32 size, t_u8 **ppbuf)
+mlan_status moal_vmalloc(t_void *pmoal, t_u32 size, t_u8 **ppbuf)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 
 	*ppbuf = vmalloc(size);
 	if (*ppbuf == NULL) {
@@ -151,14 +150,14 @@ mlan_status moal_vmalloc(t_void *pmoal_handle, t_u32 size, t_u8 **ppbuf)
 /**
  *  @brief Free a buffer allocated by vmalloc
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pbuf     Pointer to the buffer to be freed
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_vfree(t_void *pmoal_handle, t_u8 *pbuf)
+mlan_status moal_vfree(t_void *pmoal, t_u8 *pbuf)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 
 	if (!pbuf)
 		return MLAN_STATUS_FAILURE;
@@ -171,7 +170,7 @@ mlan_status moal_vfree(t_void *pmoal_handle, t_u8 *pbuf)
 /**
  *  @brief Alloc a consistent block of memory
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param size         The size of the buffer to be allocated
  *  @param ppbuf        Pointer to a buffer location to store memory allocated
  *  @param pbuf_pa      Pointer to a buffer location to store physical address
@@ -179,10 +178,10 @@ mlan_status moal_vfree(t_void *pmoal_handle, t_u8 *pbuf)
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_malloc_consistent(t_void *pmoal_handle, t_u32 size,
-				   t_u8 **ppbuf, t_pu64 pbuf_pa)
+mlan_status moal_malloc_consistent(t_void *pmoal, t_u32 size, t_u8 **ppbuf,
+				   t_pu64 pbuf_pa)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 	*pbuf_pa = 0;
 	*ppbuf = (t_u8 *)pci_alloc_consistent(card->dev, size,
@@ -201,17 +200,17 @@ mlan_status moal_malloc_consistent(t_void *pmoal_handle, t_u32 size,
 /**
  *  @brief Free a consistent block of memory
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param size         Size of them memory to be freed
  *  @param pbuf         Pointer to the memory to be freed
  *  @param buf_pa       Physical address of the memory to be freed
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_mfree_consistent(t_void *pmoal_handle, t_u32 size, t_u8 *pbuf,
+mlan_status moal_mfree_consistent(t_void *pmoal, t_u32 size, t_u8 *pbuf,
 				  t_u64 buf_pa)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	pcie_service_card *card = handle->card;
 
 	if (!pbuf)
@@ -225,7 +224,7 @@ mlan_status moal_mfree_consistent(t_void *pmoal_handle, t_u32 size, t_u8 *pbuf,
 /**
  *  @brief Map a block of memory to device
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pbuf         Pointer to the buffer to be mapped
  *  @param pbuf_pa      Pointer to store the physical address of buffer
  *  @param size         Size of the buffer to be mapped
@@ -233,10 +232,10 @@ mlan_status moal_mfree_consistent(t_void *pmoal_handle, t_u32 size, t_u8 *pbuf,
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_map_memory(t_void *pmoal_handle, t_u8 *pbuf, t_u64 *pbuf_pa,
+mlan_status moal_map_memory(t_void *pmoal, t_u8 *pbuf, t_u64 *pbuf_pa,
 			    t_u32 size, t_u32 flag)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 
 	dma_addr_t dma;
@@ -259,7 +258,7 @@ mlan_status moal_map_memory(t_void *pmoal_handle, t_u8 *pbuf, t_u64 *pbuf_pa,
 /**
  *  @brief Unmap a block of memory from device
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pbuf         Pointer to the buffer to unmap
  *  @param buf_pa       Physical address of buffer to unmap
  *  @param size         Size of the buffer to unmap
@@ -267,10 +266,10 @@ mlan_status moal_map_memory(t_void *pmoal_handle, t_u8 *pbuf, t_u64 *pbuf_pa,
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_unmap_memory(t_void *pmoal_handle, t_u8 *pbuf, t_u64 buf_pa,
+mlan_status moal_unmap_memory(t_void *pmoal, t_u8 *pbuf, t_u64 buf_pa,
 			      t_u32 size, t_u32 flag)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 
 	pci_unmap_single(card->dev, buf_pa, size, flag);
@@ -282,14 +281,14 @@ mlan_status moal_unmap_memory(t_void *pmoal_handle, t_u8 *pbuf, t_u64 buf_pa,
 /**
  *  @brief Fill memory with constant byte
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmem     Pointer to the memory area
  *  @param byte     A constant byte
  *  @param num      Number of bytes to fill
  *
  *  @return         Pointer to the memory area
  */
-t_void *moal_memset(t_void *pmoal_handle, t_void *pmem, t_u8 byte, t_u32 num)
+t_void *moal_memset(t_void *pmoal, t_void *pmem, t_u8 byte, t_u32 num)
 {
 	t_void *p = pmem;
 
@@ -302,15 +301,14 @@ t_void *moal_memset(t_void *pmoal_handle, t_void *pmem, t_u8 byte, t_u32 num)
 /**
  *  @brief Copy memory from one area to another
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pdest    Pointer to the dest memory
  *  @param psrc     Pointer to the src memory
  *  @param num      Number of bytes to move
  *
  *  @return         Pointer to the dest memory
  */
-t_void *moal_memcpy(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
-		    t_u32 num)
+t_void *moal_memcpy(t_void *pmoal, t_void *pdest, const t_void *psrc, t_u32 num)
 {
 	t_void *p = pdest;
 
@@ -323,7 +321,7 @@ t_void *moal_memcpy(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
 /**
  *  @brief Copy memory from one area to another
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pdest    Pointer to the dest memory
  *  @param psrc     Pointer to the src memory
  *  @param num      Number of bytes to move
@@ -331,7 +329,7 @@ t_void *moal_memcpy(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
  *
  *  @return         Pointer to the dest memory
  */
-t_void *moal_memcpy_ext(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
+t_void *moal_memcpy_ext(t_void *pmoal, t_void *pdest, const t_void *psrc,
 			t_u32 num, t_u32 dest_size)
 {
 	t_void *p = pdest;
@@ -344,14 +342,14 @@ t_void *moal_memcpy_ext(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
 /**
  *  @brief Move memory from one area to another
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pdest    Pointer to the dest memory
  *  @param psrc     Pointer to the src memory
  *  @param num      Number of bytes to move
  *
  *  @return         Pointer to the dest memory
  */
-t_void *moal_memmove(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
+t_void *moal_memmove(t_void *pmoal, t_void *pdest, const t_void *psrc,
 		     t_u32 num)
 {
 	t_void *p = pdest;
@@ -365,15 +363,15 @@ t_void *moal_memmove(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
 /**
  *  @brief Compare two memory areas
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmem1    Pointer to the first memory
  *  @param pmem2    Pointer to the second memory
  *  @param num      Number of bytes to compare
  *
  *  @return         Compare result returns by memcmp
  */
-t_s32 moal_memcmp(t_void *pmoal_handle, const t_void *pmem1,
-		  const t_void *pmem2, t_u32 num)
+t_s32 moal_memcmp(t_void *pmoal, const t_void *pmem1, const t_void *pmem2,
+		  t_u32 num)
 {
 	t_s32 result;
 
@@ -385,12 +383,12 @@ t_s32 moal_memcmp(t_void *pmoal_handle, const t_void *pmem1,
 /**
  *  @brief Delay function
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param delay  delay in micro-second
  *
  *  @return       N/A
  */
-t_void moal_udelay(t_void *pmoal_handle, t_u32 delay)
+t_void moal_udelay(t_void *pmoal, t_u32 delay)
 {
 	if (delay >= 1000)
 		msleep(delay / 1000);
@@ -405,13 +403,13 @@ t_void moal_udelay(t_void *pmoal_handle, t_u32 delay)
 /**
  *  @brief  usleep_range function
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param min_delay  minimal delay in micro-second
  *  @param max_delay  delay in micro-second
  *
  *  @return       N/A
  */
-t_void moal_usleep_range(t_void *pmoal_handle, t_u32 min_delay, t_u32 max_delay)
+t_void moal_usleep_range(t_void *pmoal, t_u32 min_delay, t_u32 max_delay)
 {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
 	usleep_range(min_delay, max_delay);
@@ -420,14 +418,13 @@ t_void moal_usleep_range(t_void *pmoal_handle, t_u32 min_delay, t_u32 max_delay)
 /**
  *  @brief Retrieves the current system time
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param psec     Pointer to buf for the seconds of system time
  *  @param pusec    Pointer to buf the micro seconds of system time
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_get_system_time(t_void *pmoal_handle, t_u32 *psec,
-				 t_u32 *pusec)
+mlan_status moal_get_system_time(t_void *pmoal, t_u32 *psec, t_u32 *pusec)
 {
 	wifi_timeval t;
 
@@ -441,12 +438,12 @@ mlan_status moal_get_system_time(t_void *pmoal_handle, t_u32 *psec,
 /**
  *  @brief Retrieves the current boot time
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pnsec     Pointer to buf for the Nanoseconds of boot time
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_get_boot_ktime(t_void *pmoal_handle, t_u64 *pnsec)
+mlan_status moal_get_boot_ktime(t_void *pmoal, t_u64 *pnsec)
 {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
 	ktime_t time;
@@ -460,19 +457,19 @@ mlan_status moal_get_boot_ktime(t_void *pmoal_handle, t_u64 *pnsec)
 /**
  *  @brief Initializes the timer
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pptimer      Pointer to the timer
  *  @param callback     Pointer to callback function
  *  @param pcontext     Pointer to context
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_init_timer(t_void *pmoal_handle, t_void **pptimer,
+mlan_status moal_init_timer(t_void *pmoal, t_void **pptimer,
 			    IN t_void (*callback)(t_void *pcontext),
 			    t_void *pcontext)
 {
 	moal_drv_timer *timer = NULL;
-	t_u32 mem_flag =
+	gfp_t mem_flag =
 		(in_interrupt() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
 
 	timer = kmalloc(sizeof(moal_drv_timer), mem_flag);
@@ -487,12 +484,12 @@ mlan_status moal_init_timer(t_void *pmoal_handle, t_void **pptimer,
 /**
  *  @brief Free the timer
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param ptimer   Pointer to the timer
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_free_timer(t_void *pmoal_handle, t_void *ptimer)
+mlan_status moal_free_timer(t_void *pmoal, t_void *ptimer)
 {
 	moal_drv_timer *timer = (moal_drv_timer *)ptimer;
 
@@ -512,15 +509,15 @@ mlan_status moal_free_timer(t_void *pmoal_handle, t_void *ptimer)
 /**
  *  @brief Start the timer
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param ptimer       Pointer to the timer
  *  @param periodic     Periodic timer
  *  @param msec         Timer value in milliseconds
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_start_timer(t_void *pmoal_handle, t_void *ptimer,
-			     t_u8 periodic, t_u32 msec)
+mlan_status moal_start_timer(t_void *pmoal, t_void *ptimer, t_u8 periodic,
+			     t_u32 msec)
 {
 	if (!ptimer)
 		return MLAN_STATUS_FAILURE;
@@ -534,12 +531,12 @@ mlan_status moal_start_timer(t_void *pmoal_handle, t_void *ptimer,
 /**
  *  @brief Stop the timer
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param ptimer   Pointer to the timer
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_stop_timer(t_void *pmoal_handle, t_void *ptimer)
+mlan_status moal_stop_timer(t_void *pmoal, t_void *ptimer)
 {
 	if (!ptimer)
 		return MLAN_STATUS_FAILURE;
@@ -551,14 +548,14 @@ mlan_status moal_stop_timer(t_void *pmoal_handle, t_void *ptimer)
 /**
  *  @brief Initializes the lock
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pplock   Pointer to the lock
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_init_lock(t_void *pmoal_handle, t_void **pplock)
+mlan_status moal_init_lock(t_void *pmoal, t_void **pplock)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	moal_lock *mlock = NULL;
 
 	mlock = kmalloc(sizeof(moal_lock), GFP_ATOMIC);
@@ -575,14 +572,14 @@ mlan_status moal_init_lock(t_void *pmoal_handle, t_void **pplock)
 /**
  *  @brief Free the lock
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param plock    Lock
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_free_lock(t_void *pmoal_handle, t_void *plock)
+mlan_status moal_free_lock(t_void *pmoal, t_void *plock)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	moal_lock *mlock = plock;
 
 	kfree(mlock);
@@ -595,39 +592,53 @@ mlan_status moal_free_lock(t_void *pmoal_handle, t_void *plock)
 /**
  *  @brief Request a spin lock
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param plock    Pointer to the lock
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_spin_lock(t_void *pmoal_handle, t_void *plock)
+mlan_status moal_spin_lock(t_void *pmoal, t_void *plock)
+	__acquires(&plock->lock)
 {
 	moal_lock *mlock = plock;
 	unsigned long flags = 0;
+	spin_lock_irqsave(&mlock->lock, flags);
+	mlock->flags = flags;
+	return MLAN_STATUS_SUCCESS;
+}
 
-	if (mlock) {
-		spin_lock_irqsave(&mlock->lock, flags);
-		mlock->flags = flags;
-		return MLAN_STATUS_SUCCESS;
-	} else {
-		return MLAN_STATUS_FAILURE;
-	}
+/**
+ *  @brief Request a spin_unlock
+ *
+ *  @param pmoal Pointer to the MOAL context
+ *  @param plock    Pointer to the lock
+ *
+ *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+mlan_status moal_spin_unlock(t_void *pmoal, t_void *plock)
+	__releases(&plock->lock)
+{
+	moal_lock *mlock = (moal_lock *)plock;
+	spin_unlock_irqrestore(&mlock->lock, mlock->flags);
+	return MLAN_STATUS_SUCCESS;
 }
 
 /**
  *  @brief  This function collects TP statistics.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param buf          pointer to the buffer of a packet
  *  @param drop_point   Drop pointer user set
  *
  *  @return         N/A
  */
-void moal_tp_accounting(t_void *pmoal_handle, void *buf, t_u32 drop_point)
+void moal_tp_accounting(t_void *pmoal, void *buf, t_u32 drop_point)
 {
 	struct sk_buff *skb = NULL;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	pmlan_buffer pmbuf = (pmlan_buffer)buf;
+	t_s32 delay;
+	wifi_timeval t;
 
 	if (drop_point < MAX_TP_ACCOUNT_DROP_POINT_NUM) {
 		if (drop_point == 4) {
@@ -654,13 +665,43 @@ void moal_tp_accounting(t_void *pmoal_handle, void *buf, t_u32 drop_point)
 			rx_len;
 		handle->tp_acnt.rx_packets[drop_point -
 					   MAX_TP_ACCOUNT_DROP_POINT_NUM]++;
+	} else if (drop_point == RX_TIME_PKT) {
+		woal_get_monotonic_time(&t);
+		/* deque - pcie receive */
+		delay = (t_s32)(pmbuf->extra_ts_sec - pmbuf->in_ts_sec) *
+			1000000;
+		delay += (t_s32)(pmbuf->extra_ts_usec - pmbuf->in_ts_usec);
+		handle->tp_acnt.rx_delay1_driver[handle->tp_acnt.rx_index] =
+			delay;
+		/* before netif_rx - deque */
+		delay = (t_s32)(pmbuf->out_ts_sec - pmbuf->extra_ts_sec) *
+			1000000;
+		delay += (t_s32)(pmbuf->out_ts_usec - pmbuf->extra_ts_usec);
+		handle->tp_acnt.rx_delay2_driver[handle->tp_acnt.rx_index] =
+			delay;
+		/* netif_rx to netif_rx return */
+		delay = (t_s32)(t.time_sec - pmbuf->out_ts_sec) * 1000000;
+		delay += (t_s32)(t.time_usec - pmbuf->out_ts_usec);
+		handle->tp_acnt.rx_delay_kernel[handle->tp_acnt.rx_index] =
+			delay;
+		handle->tp_acnt.rx_index++;
+		if (handle->tp_acnt.rx_index >= TXRX_MAX_SAMPLE)
+			handle->tp_acnt.rx_index = 0;
+	} else if (drop_point == TX_TIME_PKT) {
+		delay = (t_s32)(pmbuf->out_ts_sec - pmbuf->in_ts_sec) * 1000000;
+		delay += (t_s32)(pmbuf->out_ts_usec - pmbuf->in_ts_usec);
+		handle->tp_acnt.tx_delay_driver[handle->tp_acnt.tx_index] =
+			delay;
+		handle->tp_acnt.tx_index++;
+		if (handle->tp_acnt.tx_index >= TXRX_MAX_SAMPLE)
+			handle->tp_acnt.tx_index = 0;
 	}
 }
 
-void moal_tp_accounting_rx_param(t_void *pmoal_handle, unsigned int type,
+void moal_tp_accounting_rx_param(t_void *pmoal, unsigned int type,
 				 unsigned int rsvd1)
 {
-	moal_handle *phandle = (moal_handle *)pmoal_handle;
+	moal_handle *phandle = (moal_handle *)pmoal;
 	switch (type) {
 	case 0: // Rx interrupt
 		phandle->tp_acnt.rx_intr_cnt++;
@@ -671,46 +712,45 @@ void moal_tp_accounting_rx_param(t_void *pmoal_handle, unsigned int type,
 	case 2: // paused
 		phandle->tp_acnt.rx_paused_cnt++;
 		break;
+	case 3: // tx interrupt count
+		phandle->tp_acnt.tx_intr_cnt++;
+		break;
+	case 4: // rx amsdu count
+		phandle->tp_acnt.rx_amsdu_cnt++;
+		phandle->tp_acnt.rx_amsdu_pkt_cnt += rsvd1;
+		break;
+	case 5: // tx amsdu count
+		phandle->tp_acnt.tx_amsdu_cnt++;
+		phandle->tp_acnt.tx_amsdu_pkt_cnt += rsvd1;
+		break;
+	case 6: // rxbd rdptr full count
+		phandle->tp_acnt.rx_rdptr_full_cnt++;
+		break;
+	case 7: // tx hard xmit skb realloc count
+		phandle->tp_acnt.tx_xmit_skb_realloc_cnt++;
+		break;
+	case 8: // tx stop queue count
+		phandle->tp_acnt.tx_stop_queue_cnt++;
+		break;
+
 	default:
 		break;
 	}
 }
 
-/**
- *  @brief Request a spin_unlock
- *
- *  @param pmoal_handle Pointer to the MOAL context
- *  @param plock    Pointer to the lock
- *
- *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
- */
-mlan_status moal_spin_unlock(t_void *pmoal_handle, t_void *plock)
-{
-	moal_lock *mlock = (moal_lock *)plock;
-
-	if (mlock) {
-		spin_unlock_irqrestore(&mlock->lock, mlock->flags);
-
-		return MLAN_STATUS_SUCCESS;
-	} else {
-		return MLAN_STATUS_FAILURE;
-	}
-}
-
 /**
  *  @brief This function reads one block of firmware data from MOAL
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param offset       Offset from where the data will be copied
  *  @param len          Length to be copied
  *  @param pbuf         Buffer where the data will be copied
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_get_fw_data(t_void *pmoal_handle, t_u32 offset, t_u32 len,
-			     t_u8 *pbuf)
+mlan_status moal_get_fw_data(t_void *pmoal, t_u32 offset, t_u32 len, t_u8 *pbuf)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 
 	if (!pbuf || !len || !handle->firmware)
 		return MLAN_STATUS_FAILURE;
@@ -727,15 +767,15 @@ mlan_status moal_get_fw_data(t_void *pmoal_handle, t_u32 offset, t_u32 len,
 /**
  *  @brief This function get vdll data from moal
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param len          Length to be copied
  *  @param pbuf         Buffer where the data will be copied
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_get_vdll_data(t_void *pmoal_handle, t_u32 len, t_u8 *pbuf)
+mlan_status moal_get_vdll_data(t_void *pmoal, t_u32 len, t_u8 *pbuf)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	mlan_status status = MLAN_STATUS_FAILURE;
 	t_u32 offset = 0;
 	t_u8 req_fw = MFALSE;
@@ -768,18 +808,41 @@ mlan_status moal_get_vdll_data(t_void *pmoal_handle, t_u32 len, t_u8 *pbuf)
  *  @brief This function is called when MLAN completes the initialization
  * firmware.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param status   The status code for mlan_init_fw request
  *  @param phw      pointer to mlan_hw_info
  *  @param ptbl     pointer to mplan_bss_tbl
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_get_hw_spec_complete(t_void *pmoal_handle, mlan_status status,
+mlan_status moal_get_hw_spec_complete(t_void *pmoal, mlan_status status,
 				      mlan_hw_info *phw, pmlan_bss_tbl ptbl)
 {
+	moal_handle *handle = (moal_handle *)pmoal;
+
 	ENTER();
 	if (status == MLAN_STATUS_SUCCESS) {
 		PRINTM(MCMND, "Get Hw Spec done, fw_cap=0x%x\n", phw->fw_cap);
+#ifdef PCIE9098
+		/** Special/Temporary handling to manage the driver version
+		 * string to identify Seahawk/AW690 (skyhawk based) based on
+		 * fw_cap_ext value set by Fw */
+		if (phw->fw_cap_ext & MBIT(31) &&
+		    IS_PCIE9098(handle->card_type)) {
+			moal_memcpy_ext(handle, driver_version, CARD_PCIEAW690,
+					strlen(CARD_PCIEAW690),
+					strlen(driver_version));
+			moal_memcpy_ext(handle,
+					driver_version + strlen(INTF_CARDTYPE) +
+						strlen(KERN_VERSION),
+					V17, strlen(V17),
+					strlen(driver_version) -
+						strlen(INTF_CARDTYPE) -
+						strlen(KERN_VERSION));
+			moal_memcpy_ext(handle, handle->driver_version,
+					driver_version, strlen(driver_version),
+					MLAN_MAX_VER_STR_LEN - 1);
+		}
+#endif
 	}
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -789,14 +852,14 @@ mlan_status moal_get_hw_spec_complete(t_void *pmoal_handle, mlan_status status,
  *  @brief This function is called when MLAN completes the initialization
  * firmware.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param status   The status code for mlan_init_fw request
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_init_fw_complete(t_void *pmoal_handle, mlan_status status)
+mlan_status moal_init_fw_complete(t_void *pmoal, mlan_status status)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	ENTER();
 	if (status == MLAN_STATUS_SUCCESS)
 		handle->hardware_status = HardwareStatusReady;
@@ -809,14 +872,14 @@ mlan_status moal_init_fw_complete(t_void *pmoal_handle, mlan_status status)
 /**
  *  @brief This function is called when MLAN shutdown firmware is completed.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param status   The status code for mlan_shutdown request
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_shutdown_fw_complete(t_void *pmoal_handle, mlan_status status)
+mlan_status moal_shutdown_fw_complete(t_void *pmoal, mlan_status status)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	ENTER();
 	handle->hardware_status = HardwareStatusNotReady;
 	handle->init_wait_q_woken = MTRUE;
@@ -828,16 +891,16 @@ mlan_status moal_shutdown_fw_complete(t_void *pmoal_handle, mlan_status status)
 /**
  *  @brief This function is called when an MLAN IOCTL is completed.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pioctl_req	pointer to structure mlan_ioctl_req
  *  @param status   The status code for mlan_ioctl request
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_ioctl_complete(t_void *pmoal_handle,
-				pmlan_ioctl_req pioctl_req, mlan_status status)
+mlan_status moal_ioctl_complete(t_void *pmoal, pmlan_ioctl_req pioctl_req,
+				mlan_status status)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	moal_private *priv = NULL;
 	wait_queue *wait;
 	unsigned long flags = 0;
@@ -901,16 +964,16 @@ mlan_status moal_ioctl_complete(t_void *pmoal_handle,
 /**
  *  @brief This function allocates mlan_buffer.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param size     allocation size requested
  *  @param pmbuf    pointer to pointer to the allocated buffer
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_alloc_mlan_buffer(t_void *pmoal_handle, t_u32 size,
+mlan_status moal_alloc_mlan_buffer(t_void *pmoal, t_u32 size,
 				   pmlan_buffer *pmbuf)
 {
-	*pmbuf = woal_alloc_mlan_buffer((moal_handle *)pmoal_handle, size);
+	*pmbuf = woal_alloc_mlan_buffer((moal_handle *)pmoal, size);
 	if (NULL == *pmbuf)
 		return MLAN_STATUS_FAILURE;
 	return MLAN_STATUS_SUCCESS;
@@ -919,33 +982,33 @@ mlan_status moal_alloc_mlan_buffer(t_void *pmoal_handle, t_u32 size,
 /**
  *  @brief This function frees mlan_buffer.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmbuf    pointer to buffer to be freed
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_free_mlan_buffer(t_void *pmoal_handle, pmlan_buffer pmbuf)
+mlan_status moal_free_mlan_buffer(t_void *pmoal, pmlan_buffer pmbuf)
 {
 	if (!pmbuf)
 		return MLAN_STATUS_FAILURE;
-	woal_free_mlan_buffer((moal_handle *)pmoal_handle, pmbuf);
+	woal_free_mlan_buffer((moal_handle *)pmoal, pmbuf);
 	return MLAN_STATUS_SUCCESS;
 }
 
 /**
  *  @brief This function is called when MLAN complete send data packet.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmbuf    Pointer to the mlan buffer structure
  *  @param status   The status code for mlan_send_packet request
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_send_packet_complete(t_void *pmoal_handle, pmlan_buffer pmbuf,
+mlan_status moal_send_packet_complete(t_void *pmoal, pmlan_buffer pmbuf,
 				      mlan_status status)
 {
 	moal_private *priv = NULL;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	struct sk_buff *skb = NULL;
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 	t_u32 index = 0;
@@ -958,7 +1021,7 @@ mlan_status moal_send_packet_complete(t_void *pmoal_handle, pmlan_buffer pmbuf,
 		goto done;
 	}
 	if (pmbuf) {
-		priv = woal_bss_index_to_priv(pmoal_handle, pmbuf->bss_index);
+		priv = woal_bss_index_to_priv(pmoal, pmbuf->bss_index);
 		skb = (struct sk_buff *)pmbuf->pdesc;
 		if (priv) {
 			woal_set_trans_start(priv->netdev);
@@ -1064,18 +1127,18 @@ done:
  *  @brief This function is called when MLAN complete receiving
  *         data/event/command
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmbuf    Pointer to the mlan buffer structure
  *  @param port     Port number for receive
  *  @param status   The status code for mlan_receive request
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_recv_complete(t_void *pmoal_handle, pmlan_buffer pmbuf,
-			       t_u32 port, mlan_status status)
+mlan_status moal_recv_complete(t_void *pmoal, pmlan_buffer pmbuf, t_u32 port,
+			       mlan_status status)
 {
 	moal_private *priv = NULL;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	struct usb_card_rec *cardp = (struct usb_card_rec *)handle->card;
 	ENTER();
 
@@ -1112,17 +1175,16 @@ mlan_status moal_recv_complete(t_void *pmoal_handle, pmlan_buffer pmbuf,
 /**
  *  @brief This function write a command/data packet to card.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmbuf    Pointer to the mlan buffer structure
  *  @param port     Port number for sent
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE or
  * MLAN_STATUS_PENDING or MLAN_STATUS_RESOURCE
  */
-mlan_status moal_write_data_async(t_void *pmoal_handle, pmlan_buffer pmbuf,
-				  t_u32 port)
+mlan_status moal_write_data_async(t_void *pmoal, pmlan_buffer pmbuf, t_u32 port)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	ENTER();
 	if (handle->is_suspended == MTRUE) {
@@ -1131,8 +1193,7 @@ mlan_status moal_write_data_async(t_void *pmoal_handle, pmlan_buffer pmbuf,
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-	ret = woal_write_data_async((moal_handle *)pmoal_handle, pmbuf,
-				    (t_u8)port);
+	ret = woal_write_data_async((moal_handle *)pmoal, pmbuf, (t_u8)port);
 	LEAVE();
 	return ret;
 }
@@ -1142,17 +1203,17 @@ mlan_status moal_write_data_async(t_void *pmoal_handle, pmlan_buffer pmbuf,
  *  @brief This function write a command/data packet to card.
  *         This function blocks the call until it finishes
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmbuf    Pointer to the mlan buffer structure
  *  @param port     Port number for sent
  *  @param timeout  Timeout value in milliseconds (if 0 the wait is forever)
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_write_data_sync(t_void *pmoal_handle, pmlan_buffer pmbuf,
-				 t_u32 port, t_u32 timeout)
+mlan_status moal_write_data_sync(t_void *pmoal, pmlan_buffer pmbuf, t_u32 port,
+				 t_u32 timeout)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	return handle->ops.write_data_sync(handle, pmbuf, port, timeout);
 }
 
@@ -1160,17 +1221,17 @@ mlan_status moal_write_data_sync(t_void *pmoal_handle, pmlan_buffer pmbuf,
  *  @brief This function read data packet/event/command from card.
  *         This function blocks the call until it finish
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmbuf    Pointer to the mlan buffer structure
  *  @param port     Port number for read
  *  @param timeout  Timeout value in milliseconds (if 0 the wait is forever)
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_read_data_sync(t_void *pmoal_handle, pmlan_buffer pmbuf,
-				t_u32 port, t_u32 timeout)
+mlan_status moal_read_data_sync(t_void *pmoal, pmlan_buffer pmbuf, t_u32 port,
+				t_u32 timeout)
 {
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	return handle->ops.read_data_sync(handle, pmbuf, port, timeout);
 }
 
@@ -1178,16 +1239,16 @@ mlan_status moal_read_data_sync(t_void *pmoal_handle, pmlan_buffer pmbuf,
 /**
  *  @brief This function writes data into card register.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param reg          register offset
  *  @param data         value
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_write_reg(t_void *pmoal_handle, t_u32 reg, t_u32 data)
+mlan_status moal_write_reg(t_void *pmoal, t_u32 reg, t_u32 data)
 {
 	int ret = MLAN_STATUS_FAILURE;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	if (handle->ops.write_reg)
 		ret = handle->ops.write_reg(handle, reg, data);
 	return ret;
@@ -1196,16 +1257,16 @@ mlan_status moal_write_reg(t_void *pmoal_handle, t_u32 reg, t_u32 data)
 /**
  *  @brief This function reads data from card register.
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param reg          register offset
  *  @param data         value
  *
  *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_read_reg(t_void *pmoal_handle, t_u32 reg, t_u32 *data)
+mlan_status moal_read_reg(t_void *pmoal, t_u32 reg, t_u32 *data)
 {
 	int ret = MLAN_STATUS_FAILURE;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	if (handle->ops.read_reg)
 		ret = handle->ops.read_reg(handle, reg, data);
 	return ret;
@@ -1216,17 +1277,17 @@ mlan_status moal_read_reg(t_void *pmoal_handle, t_u32 reg, t_u32 *data)
 /**
  *  @brief This function uploads the packet to the network stack
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmbuf    Pointer to the mlan buffer structure
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf)
+mlan_status moal_recv_packet(t_void *pmoal, pmlan_buffer pmbuf)
 {
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	moal_private *priv = NULL;
 	struct sk_buff *skb = NULL;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 #if defined(USB) || defined(PCIE)
 	t_u32 max_rx_data_size = MLAN_RX_DATA_BUF_SIZE;
 #endif
@@ -1260,12 +1321,12 @@ mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf)
 #endif
 #endif
 
-		priv = woal_bss_index_to_priv(pmoal_handle, pmbuf->bss_index);
+		priv = woal_bss_index_to_priv(pmoal, pmbuf->bss_index);
 		skb = (struct sk_buff *)pmbuf->pdesc;
 		if (priv) {
 			if (skb) {
 				skb_reserve(skb, pmbuf->data_offset);
-				if (skb_tailroom(skb) < pmbuf->data_len) {
+				if (skb_tailroom(skb) < (int)pmbuf->data_len) {
 					PRINTM(MERROR,
 					       "skb overflow: tail room=%d, data_len=%d\n",
 					       skb_tailroom(skb),
@@ -1381,7 +1442,6 @@ mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf)
 						 FRAME_TYPE_ETHERNET_II, 0, 0,
 						 skb->data, skb->len);
 #endif
-#ifdef ANDROID_KERNEL
 			if (handle->params.wakelock_timeout) {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 				__pm_wakeup_event(
@@ -1395,7 +1455,6 @@ mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf)
 							.wakelock_timeout));
 #endif
 			}
-#endif
 			if (priv->rx_protocols.protocol_num) {
 				for (j = 0; j < priv->rx_protocols.protocol_num;
 				     j++) {
@@ -1405,7 +1464,7 @@ mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf)
 				}
 			}
 			if (rx_info_flag &&
-			    (skb_tailroom(skb) > sizeof(rxcontrol))) {
+			    (skb_tailroom(skb) > (int)sizeof(rxcontrol))) {
 				memset(&rxcontrol, 0, sizeof(dot11_rxcontrol));
 				rxcontrol.datarate = pmbuf->u.rx_info.data_rate;
 				rxcontrol.channel = pmbuf->u.rx_info.channel;
@@ -1420,8 +1479,15 @@ mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf)
 						sizeof(dot11_rxcontrol));
 			}
 			// rx_trace 8
-			if (priv->phandle->tp_acnt.on)
+			if (priv->phandle->tp_acnt.on) {
+				wifi_timeval t;
 				moal_tp_accounting(handle, skb, RX_DROP_P4);
+				if (pmbuf && pmbuf->in_ts_sec) {
+					woal_get_monotonic_time(&t);
+					pmbuf->out_ts_sec = t.time_sec;
+					pmbuf->out_ts_usec = t.time_usec;
+				}
+			}
 			if (priv->phandle->tp_acnt.drop_point == RX_DROP_P4) {
 				status = MLAN_STATUS_PENDING;
 				dev_kfree_skb(skb);
@@ -1434,6 +1500,11 @@ mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf)
 				else
 					netif_rx_ni(skb);
 			}
+			if (priv->phandle->tp_acnt.on) {
+				if (pmbuf && pmbuf->in_ts_sec)
+					moal_tp_accounting(handle, pmbuf,
+							   RX_TIME_PKT);
+			}
 		}
 	}
 done:
@@ -1441,15 +1512,97 @@ done:
 	return status;
 }
 
+/**
+ *  @brief This function checks media_connected state for
+ *  BSS types UAP/STA/P2P_GO/GC
+ *
+ *  @param pmoal Pointer to the MOAL context
+ *
+ */
+static int woal_check_media_connected(t_void *pmoal)
+{
+	int i;
+	moal_handle *pmhandle = (moal_handle *)pmoal;
+	moal_private *pmpriv = NULL;
+	for (i = 0; i < pmhandle->priv_num && (pmpriv = pmhandle->priv[i]);
+	     i++) {
+		if (!pmpriv)
+			continue;
+		if ((pmpriv->media_connected == MTRUE)) {
+			return MTRUE;
+		}
+	}
+	return MFALSE;
+}
+
+/**
+ *  @brief This function checks connect and disconnect
+ *  events for BSS types UAP/STA/P2P_GO/GC
+ *
+ *  @param pmoal Pointer to the MOAL context
+ *
+ */
+static void moal_connection_status_check_pmqos(t_void *pmoal)
+{
+	moal_handle *pmhandle = (moal_handle *)pmoal;
+	if ((woal_check_media_connected(pmoal) == MTRUE)) {
+		if ((pmhandle->request_pm == MFALSE)) {
+			pmhandle->request_pm = MTRUE;
+#ifdef PCIE
+			if (IS_PCIE(pmhandle->card_type))
+				woal_request_pmqos_busfreq_high();
+#endif
+		}
+	} else {
+		if (pmhandle->request_pm == MTRUE) {
+			pmhandle->request_pm = MFALSE;
+#ifdef PCIE
+			if (IS_PCIE(pmhandle->card_type))
+				woal_release_pmqos_busfreq_high();
+#endif
+		}
+	}
+}
+
+/**
+ * @brief   Handle RX MGMT PKT event
+ *
+ * @param priv          A pointer moal_private structure
+ * @param pkt        A pointer to pkt
+ * @param len        length of pkt
+ *
+ * @return          N/A
+ */
+void woal_rx_mgmt_pkt_event(moal_private *priv, t_u8 *pkt, t_u16 len)
+{
+	struct woal_event *evt;
+	unsigned long flags;
+	moal_handle *handle = priv->phandle;
+
+	evt = kzalloc(sizeof(struct woal_event), GFP_ATOMIC);
+	if (evt) {
+		evt->priv = priv;
+		evt->type = WOAL_EVENT_RX_MGMT_PKT;
+		evt->evt.event_len = len;
+		moal_memcpy_ext(priv->phandle, evt->evt.event_buf, pkt,
+				evt->evt.event_len, sizeof(evt->evt.event_buf));
+		INIT_LIST_HEAD(&evt->link);
+		spin_lock_irqsave(&handle->evt_lock, flags);
+		list_add_tail(&evt->link, &handle->evt_queue);
+		spin_unlock_irqrestore(&handle->evt_lock, flags);
+		queue_work(handle->evt_workqueue, &handle->evt_work);
+	}
+}
+
 /**
  *  @brief This function handles event receive
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param pmevent  Pointer to the mlan event structure
  *
  *  @return         MLAN_STATUS_SUCCESS
  */
-mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
+mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 {
 #ifdef STA_SUPPORT
 	int custom_len = 0;
@@ -1469,7 +1622,9 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #endif
 #endif
 	mlan_ds_ps_info pm_info;
+#ifdef STA_CFG80211
 	t_u8 hw_test;
+#endif
 	int cfg80211_wext;
 
 #ifdef STA_CFG80211
@@ -1477,13 +1632,14 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 	moal_private *remain_priv = NULL;
 #endif
 #if defined(UAP_CFG80211) || defined(STA_CFG80211)
-	pchan_band_info pchan_info = NULL;
+	chan_band_info *pchan_info = NULL;
 #endif
 	t_u8 radar_detected;
 
 	ENTER();
 	if (pmevent->event_id == MLAN_EVENT_ID_FW_DUMP_INFO) {
-		woal_store_firmware_dump(pmoal_handle, pmevent);
+		woal_store_firmware_dump(pmoal, pmevent);
+		((moal_handle *)pmoal)->driver_status = MTRUE;
 		goto done;
 	}
 	if ((pmevent->event_id != MLAN_EVENT_ID_DRV_DEFER_RX_WORK) &&
@@ -1492,16 +1648,16 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 		PRINTM(MEVENT, "event id:0x%x\n", pmevent->event_id);
 #if defined(PCIE)
 	if (pmevent->event_id == MLAN_EVENT_ID_SSU_DUMP_FILE) {
-		woal_store_ssu_dump(pmoal_handle, pmevent);
+		woal_store_ssu_dump(pmoal, pmevent);
 		goto done;
 	}
 #endif /* SSU_SUPPORT */
 	if (pmevent->event_id == MLAN_EVENT_ID_STORE_HOST_CMD_RESP) {
-		woal_save_host_cmdresp((moal_handle *)pmoal_handle,
+		woal_save_host_cmdresp((moal_handle *)pmoal,
 				       (mlan_cmdresp_event *)pmevent);
 		goto done;
 	}
-	priv = woal_bss_index_to_priv(pmoal_handle, pmevent->bss_index);
+	priv = woal_bss_index_to_priv(pmoal, pmevent->bss_index);
 	if (priv == NULL) {
 		PRINTM(MERROR, "%s: priv is null\n", __func__);
 		goto done;
@@ -1512,7 +1668,9 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 	}
 
 	cfg80211_wext = priv->phandle->params.cfg80211_wext;
-	hw_test = moal_extflg_isset(pmoal_handle, EXT_HW_TEST);
+#ifdef STA_CFG80211
+	hw_test = moal_extflg_isset(pmoal, EXT_HW_TEST);
+#endif
 	switch (pmevent->event_id) {
 #ifdef STA_SUPPORT
 	case MLAN_EVENT_ID_FW_ADHOC_LINK_SENSED:
@@ -1578,7 +1736,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 		if (!netif_carrier_ok(priv->netdev))
 			netif_carrier_on(priv->netdev);
 		woal_wake_queue(priv->netdev);
-
+		moal_connection_status_check_pmqos(pmoal);
 		break;
 
 	case MLAN_EVENT_ID_DRV_ASSOC_SUCC_LOGGER:
@@ -1687,7 +1845,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #ifdef STA_WEXT
 		if (IS_STA_WEXT(cfg80211_wext)) {
 			memset(&wrqu, 0, sizeof(union iwreq_data));
-			wrqu.data.pointer = pmevent->event_buf;
+			wrqu.data.pointer = (t_u8 __user *)pmevent->event_buf;
 			wrqu.data.length = pmevent->event_len +
 					   strlen(CUS_EVT_OBSS_SCAN_PARAM) + 1;
 			wireless_send_event(priv->netdev, IWEVCUSTOM, &wrqu,
@@ -1710,7 +1868,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #ifdef STA_WEXT
 		if (IS_STA_WEXT(cfg80211_wext)) {
 			memset(&wrqu, 0, sizeof(union iwreq_data));
-			wrqu.data.pointer = pmevent->event_buf;
+			wrqu.data.pointer = (t_u8 __user *)pmevent->event_buf;
 			wrqu.data.length = pmevent->event_len +
 					   strlen(CUS_EVT_BW_CHANGED) + 1;
 			wireless_send_event(priv->netdev, IWEVCUSTOM, &wrqu,
@@ -1747,6 +1905,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 			priv->rate_index = AUTO_RATE;
 		}
 #endif /* REASSOCIATION */
+		moal_connection_status_check_pmqos(pmoal);
 		break;
 
 	case MLAN_EVENT_ID_FW_MIC_ERR_UNI:
@@ -1944,8 +2103,10 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 					       priv->cfg_bssid, NULL, 0,
 					       WLAN_CAPABILITY_ESS,
 					       WLAN_CAPABILITY_ESS);
-			if (bss)
+			if (bss) {
 				cfg80211_unlink_bss(priv->wdev->wiphy, bss);
+				cfg80211_put_bss(priv->wdev->wiphy, bss);
+			}
 			if (!hw_test && priv->roaming_enabled)
 				woal_config_bgscan_and_rssi(priv, MFALSE);
 			priv->last_event |= EVENT_PRE_BCN_LOST;
@@ -2071,7 +2232,6 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #endif
 			) {
 				priv->roaming_required = MTRUE;
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 				__pm_wakeup_event(&priv->phandle->ws,
 						  ROAMING_WAKE_LOCK_TIMEOUT);
@@ -2080,7 +2240,6 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 					&priv->phandle->wake_lock,
 					msecs_to_jiffies(
 						ROAMING_WAKE_LOCK_TIMEOUT));
-#endif
 #endif
 				wake_up_interruptible(
 					&priv->phandle->reassoc_thread.wait_q);
@@ -2309,8 +2468,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 		/* simulate HSCFG_CANCEL command */
 		woal_cancel_hs(priv, MOAL_NO_WAIT);
 #ifdef STA_SUPPORT
-		pmpriv = woal_get_priv((moal_handle *)pmoal_handle,
-				       MLAN_BSS_ROLE_STA);
+		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_STA);
 #ifdef STA_WEXT
 		if (IS_STA_WEXT(cfg80211_wext) && pmpriv)
 			woal_send_iwevcustom_event(pmpriv, CUS_EVT_HS_WAKEUP);
@@ -2320,8 +2478,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 					     strlen(CUS_EVT_HS_WAKEUP));
 #endif /*STA_SUPPORT */
 #ifdef UAP_SUPPORT
-		pmpriv = woal_get_priv((moal_handle *)pmoal_handle,
-				       MLAN_BSS_ROLE_UAP);
+		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_UAP);
 		if (pmpriv) {
 			pmevent->event_id = UAP_EVENT_ID_HS_WAKEUP;
 			woal_broadcast_event(pmpriv, (t_u8 *)&pmevent->event_id,
@@ -2331,8 +2488,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 		break;
 	case MLAN_EVENT_ID_DRV_HS_ACTIVATED:
 #ifdef STA_SUPPORT
-		pmpriv = woal_get_priv((moal_handle *)pmoal_handle,
-				       MLAN_BSS_ROLE_STA);
+		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_STA);
 #ifdef STA_WEXT
 		if (IS_STA_WEXT(cfg80211_wext) && pmpriv)
 			woal_send_iwevcustom_event(pmpriv,
@@ -2343,8 +2499,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 					     strlen(CUS_EVT_HS_ACTIVATED));
 #endif /* STA_SUPPORT */
 #if defined(UAP_SUPPORT)
-		pmpriv = woal_get_priv((moal_handle *)pmoal_handle,
-				       MLAN_BSS_ROLE_UAP);
+		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_UAP);
 		if (pmpriv) {
 			pmevent->event_id = UAP_EVENT_ID_DRV_HS_ACTIVATED;
 			woal_broadcast_event(pmpriv, (t_u8 *)&pmevent->event_id,
@@ -2366,8 +2521,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 		break;
 	case MLAN_EVENT_ID_DRV_HS_DEACTIVATED:
 #ifdef STA_SUPPORT
-		pmpriv = woal_get_priv((moal_handle *)pmoal_handle,
-				       MLAN_BSS_ROLE_STA);
+		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_STA);
 #ifdef STA_WEXT
 		if (IS_STA_WEXT(cfg80211_wext) && pmpriv)
 			woal_send_iwevcustom_event(pmpriv,
@@ -2378,8 +2532,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 					     strlen(CUS_EVT_HS_DEACTIVATED));
 #endif /* STA_SUPPORT */
 #if defined(UAP_SUPPORT)
-		pmpriv = woal_get_priv((moal_handle *)pmoal_handle,
-				       MLAN_BSS_ROLE_UAP);
+		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_UAP);
 		if (pmpriv) {
 			pmevent->event_id = UAP_EVENT_ID_DRV_HS_DEACTIVATED;
 			woal_broadcast_event(pmpriv, (t_u8 *)&pmevent->event_id,
@@ -2404,8 +2557,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 				     pmevent->event_len);
 #ifdef STA_SUPPORT
 #ifdef STA_CFG80211
-		pmpriv = woal_get_priv((moal_handle *)pmoal_handle,
-				       MLAN_BSS_ROLE_STA);
+		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_STA);
 		if (IS_STA_CFG80211(cfg80211_wext) && pmpriv)
 			woal_set_scan_time(pmpriv, ACTIVE_SCAN_CHAN_TIME,
 					   PASSIVE_SCAN_CHAN_TIME,
@@ -2428,8 +2580,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 	case MLAN_EVENT_ID_DRV_UAP_CHAN_INFO:
 #ifdef UAP_CFG80211
 		if (IS_UAP_CFG80211(cfg80211_wext)) {
-			chan_band_info *pchan_info =
-				(chan_band_info *)pmevent->event_buf;
+			pchan_info = (chan_band_info *)pmevent->event_buf;
 			PRINTM(MEVENT,
 			       "UAP: 11n=%d, chan=%d, center_chan=%d, band=%d, width=%d, 2Offset=%d\n",
 			       pchan_info->is_11n_enabled, pchan_info->channel,
@@ -2451,11 +2602,13 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 		woal_wake_queue(priv->netdev);
 		woal_broadcast_event(priv, pmevent->event_buf,
 				     pmevent->event_len);
+		moal_connection_status_check_pmqos(pmoal);
 		break;
 	case MLAN_EVENT_ID_UAP_FW_BSS_IDLE:
 		priv->media_connected = MFALSE;
 		woal_broadcast_event(priv, pmevent->event_buf,
 				     pmevent->event_len);
+		moal_connection_status_check_pmqos(pmoal);
 		break;
 	case MLAN_EVENT_ID_UAP_FW_MIC_COUNTERMEASURES: {
 		t_u16 status = 0;
@@ -2511,40 +2664,49 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 	case MLAN_EVENT_ID_UAP_FW_STA_CONNECT:
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		if (IS_STA_OR_UAP_CFG80211(cfg80211_wext)) {
-			struct station_info sinfo = {0};
+			struct station_info *sinfo = NULL;
 			t_u8 addr[ETH_ALEN];
-
-			sinfo.filled = 0;
-			sinfo.generation = 0;
-			/* copy the station mac address */
-			memset(addr, 0xFF, ETH_ALEN);
-			moal_memcpy_ext(priv->phandle, addr, pmevent->event_buf,
-					ETH_ALEN, ETH_ALEN);
-			/** these field add in kernel 3.2, but some
-			 * kernel do have the pacth to support it,
-			 * like T3T and pxa978T 3.0.31 JB, these
-			 * patch are needed to support
-			 * wpa_supplicant 2.x */
+			sinfo = kzalloc(sizeof(struct station_info),
+					GFP_ATOMIC);
+			if (sinfo) {
+				sinfo->filled = 0;
+				sinfo->generation = 0;
+				/* copy the station mac address */
+				memset(addr, 0xFF, ETH_ALEN);
+				moal_memcpy_ext(priv->phandle, addr,
+						pmevent->event_buf, ETH_ALEN,
+						ETH_ALEN);
+				/** these field add in kernel 3.2, but some
+				 * kernel do have the pacth to support it,
+				 * like T3T and pxa978T 3.0.31 JB, these
+				 * patch are needed to support
+				 * wpa_supplicant 2.x */
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 0, 31)
-			if (pmevent->event_len > ETH_ALEN) {
+				if (pmevent->event_len > ETH_ALEN) {
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
-				/* set station info filled flag */
-				sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
+					/* set station info filled flag */
+					sinfo->filled |=
+						STATION_INFO_ASSOC_REQ_IES;
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 18, 0)
-				sinfo.pertid = NULL;
+					sinfo->pertid = NULL;
 #endif
-				/* get the assoc request ies and length */
-				sinfo.assoc_req_ies =
-					(const t_u8 *)(pmevent->event_buf +
-						       ETH_ALEN);
-				sinfo.assoc_req_ies_len =
-					pmevent->event_len - ETH_ALEN;
-			}
+					/* get the assoc request ies and length
+					 */
+					sinfo->assoc_req_ies =
+						(const t_u8
+							 *)(pmevent->event_buf +
+							    ETH_ALEN);
+					sinfo->assoc_req_ies_len =
+						pmevent->event_len - ETH_ALEN;
+				}
 #endif /* KERNEL_VERSION */
-			if (priv->netdev && priv->wdev)
-				cfg80211_new_sta(priv->netdev, (t_u8 *)addr,
-						 &sinfo, GFP_KERNEL);
+				if (priv->netdev && priv->wdev)
+					cfg80211_new_sta(priv->netdev,
+							 (t_u8 *)addr, sinfo,
+							 GFP_KERNEL);
+				kfree(sinfo);
+			}
 		}
 #endif /* UAP_CFG80211 */
 		memmove((pmevent->event_buf + strlen(CUS_EVT_STA_CONNECTED) +
@@ -2561,7 +2723,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #ifdef UAP_WEXT
 		if (IS_UAP_WEXT(cfg80211_wext)) {
 			memset(&wrqu, 0, sizeof(union iwreq_data));
-			wrqu.data.pointer = pmevent->event_buf;
+			wrqu.data.pointer = (t_u8 __user *)pmevent->event_buf;
 			if ((pmevent->event_len +
 			     strlen(CUS_EVT_STA_CONNECTED) + 1) > IW_CUSTOM_MAX)
 				wrqu.data.length =
@@ -2617,7 +2779,7 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #ifdef UAP_WEXT
 		if (IS_UAP_WEXT(cfg80211_wext)) {
 			memset(&wrqu, 0, sizeof(union iwreq_data));
-			wrqu.data.pointer = pmevent->event_buf;
+			wrqu.data.pointer = (t_u8 __user *)pmevent->event_buf;
 			wrqu.data.length = pmevent->event_len +
 					   strlen(CUS_EVT_STA_DISCONNECTED) + 1;
 			wireless_send_event(priv->netdev, IWEVCUSTOM, &wrqu,
@@ -2741,6 +2903,9 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 							priv,
 							IEEE80211_STYPE_DISASSOC,
 							MFALSE);
+						woal_send_disconnect_to_system(
+							priv,
+							DEF_DEAUTH_REASON_CODE);
 						priv->host_mlme = MFALSE;
 						priv->auth_flag = 0;
 						priv->auth_alg = 0xFFFF;
@@ -2751,13 +2916,11 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 						}
 					}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
-					mutex_lock(&priv->wdev->mtx);
-					cfg80211_rx_mlme_mgmt(
-						priv->netdev, pkt,
+					woal_rx_mgmt_pkt_event(
+						priv, pkt,
 						pmevent->event_len -
 							sizeof(pmevent->event_id) -
 							MLAN_MAC_ADDR_LENGTH);
-					mutex_unlock(&priv->wdev->mtx);
 #else
 					if (ieee80211_is_deauth(
 						    ((struct ieee80211_mgmt *)
@@ -2921,6 +3084,21 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #endif
 		}
 		break;
+	case MLAN_EVENT_ID_DRV_TDLS_TEARDOWN_REQ:
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+#ifdef STA_CFG80211
+		if (IS_STA_CFG80211(cfg80211_wext)) {
+			tdls_tear_down_event *tdls_event =
+				(tdls_tear_down_event *)pmevent->event_buf;
+			cfg80211_tdls_oper_request(priv->netdev,
+						   tdls_event->peer_mac_addr,
+						   NL80211_TDLS_TEARDOWN,
+						   tdls_event->reason_code,
+						   GFP_KERNEL);
+		}
+#endif
+#endif
+		break;
 	case MLAN_EVENT_ID_FW_TX_STATUS: {
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		unsigned long flag;
@@ -2985,8 +3163,9 @@ mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent)
 #endif
 			dev_kfree_skb_any(skb);
 			kfree(tx_info);
-		} else
+		} else {
 			spin_unlock_irqrestore(&priv->tx_stat_lock, flag);
+		}
 #endif
 	} break;
 	case MLAN_EVENT_ID_DRV_FT_RESPONSE:
@@ -3039,13 +3218,14 @@ done:
 /**
  *  @brief This function prints the debug message in mlan
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param level    debug level
  *  @param pformat  point to string format buf
  *
  *  @return         N/A
  */
-t_void moal_print(t_void *pmoal_handle, t_u32 level, char *pformat, IN...)
+__attribute__((format(printf, 3, 4))) t_void
+moal_print(t_void *pmoal, t_u32 level, char *pformat, IN...)
 {
 #ifdef DEBUG_LEVEL1
 	va_list args;
@@ -3091,16 +3271,16 @@ t_void moal_print(t_void *pmoal_handle, t_u32 level, char *pformat, IN...)
 /**
  *  @brief This function prints the network interface name
  *
- *  @param pmoal_handle Pointer to the MOAL context
+ *  @param pmoal Pointer to the MOAL context
  *  @param bss_index    BSS index
  *  @param level        debug level
  *
  *  @return            N/A
  */
-t_void moal_print_netintf(t_void *pmoal_handle, t_u32 bss_index, t_u32 level)
+t_void moal_print_netintf(t_void *pmoal, t_u32 bss_index, t_u32 level)
 {
 #ifdef DEBUG_LEVEL1
-	moal_handle *phandle = (moal_handle *)pmoal_handle;
+	moal_handle *phandle = (moal_handle *)pmoal;
 
 	if (phandle) {
 		if ((bss_index < MLAN_MAX_BSS_NUM) &&
@@ -3117,12 +3297,12 @@ t_void moal_print_netintf(t_void *pmoal_handle, t_u32 bss_index, t_u32 level)
 /**
  *  @brief This function asserts the existence of the passed argument
  *
- *  @param pmoal_handle     A pointer to moal_private structure
+ *  @param pmoal     A pointer to moal_private structure
  *  @param cond             Condition to check
  *
  *  @return                 N/A
  */
-t_void moal_assert(t_void *pmoal_handle, t_u32 cond)
+t_void moal_assert(t_void *pmoal, t_u32 cond)
 {
 	if (!cond) {
 		panic("Assert failed: Panic!");
@@ -3132,7 +3312,7 @@ t_void moal_assert(t_void *pmoal_handle, t_u32 cond)
 /**
  *  @brief This function save the histogram data
  *
- *  @param pmoal_handle     A pointer to moal_private structure
+ *  @param pmoal     A pointer to moal_private structure
  *  @param bss_index        BSS index
  *  @param rx_rate          rx rate index
  *  @param snr              snr
@@ -3141,17 +3321,48 @@ t_void moal_assert(t_void *pmoal_handle, t_u32 cond)
  *
  *  @return                 N/A
  */
-t_void moal_hist_data_add(t_void *pmoal_handle, t_u32 bss_index, t_u16 rx_rate,
+t_void moal_hist_data_add(t_void *pmoal, t_u32 bss_index, t_u16 rx_rate,
 			  t_s8 snr, t_s8 nflr, t_u8 antenna)
 {
 	moal_private *priv = NULL;
-	priv = woal_bss_index_to_priv(pmoal_handle, bss_index);
+	priv = woal_bss_index_to_priv(pmoal, bss_index);
 	if (priv && antenna >= priv->phandle->card_info->histogram_table_num)
 		antenna = 0;
 	if (priv && priv->hist_data[antenna])
 		woal_hist_data_add(priv, rx_rate, snr, nflr, antenna);
 }
 
+/**
+ *  @brief This function update the peer signal
+ *
+ *  @param pmoal     A pointer to moal_private structure
+ *  @param bss_index        BSS index
+ *  @param peer_addr        peer address
+ *  @param snr              snr
+ *  @param nflr             noise floor
+ *
+ *  @return                 N/A
+ */
+t_void moal_updata_peer_signal(t_void *pmoal, t_u32 bss_index, t_u8 *peer_addr,
+			       t_s8 snr, t_s8 nflr)
+{
+	moal_private *priv = NULL;
+	struct tdls_peer *peer = NULL;
+	unsigned long flags;
+	priv = woal_bss_index_to_priv(pmoal, bss_index);
+	if (priv && priv->enable_auto_tdls) {
+		spin_lock_irqsave(&priv->tdls_lock, flags);
+		list_for_each_entry (peer, &priv->tdls_list, link) {
+			if (!memcmp(peer->peer_addr, peer_addr, ETH_ALEN)) {
+				peer->rssi = nflr - snr;
+				peer->rssi_jiffies = jiffies;
+				break;
+			}
+		}
+		spin_unlock_irqrestore(&priv->tdls_lock, flags);
+	}
+}
+
 /**
  *  @brief Performs division of 64-bit num with base
  *  @brief do_div does two things
@@ -3174,14 +3385,14 @@ t_u64 moal_do_div(t_u64 num, t_u32 base)
 /**
  *  @brief Performs wait event
  *
- *  @param pmoal_handle   t_void
+ *  @param pmoal   t_void
  *  @param bss_index      index of priv
  *  @return      MLAN_STATUS_SUCCESS
  */
-mlan_status moal_wait_hostcmd_complete(t_void *pmoal_handle, t_u32 bss_index)
+mlan_status moal_wait_hostcmd_complete(t_void *pmoal, t_u32 bss_index)
 {
 	mlan_status status = MLAN_STATUS_SUCCESS;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	moal_private *priv = woal_bss_index_to_priv(handle, bss_index);
 	long time_left = 0;
 
@@ -3210,14 +3421,14 @@ done:
 /**
  *  @brief wake up esa wait_q
  *
- *  @param pmoal_handle   t_void
+ *  @param pmoal   t_void
  *  @param bss_index      index of priv
  *  @return      MLAN_STATUS_SUCCESS
  */
-mlan_status moal_notify_hostcmd_complete(t_void *pmoal_handle, t_u32 bss_index)
+mlan_status moal_notify_hostcmd_complete(t_void *pmoal, t_u32 bss_index)
 {
 	mlan_status status = MLAN_STATUS_SUCCESS;
-	moal_handle *handle = (moal_handle *)pmoal_handle;
+	moal_handle *handle = (moal_handle *)pmoal;
 	moal_private *priv = woal_bss_index_to_priv(handle, bss_index);
 
 	ENTER();
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_shim.h b/mxm_wifiex/wlan_src/mlinux/moal_shim.h
index 02f2860..4eb85b5 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_shim.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_shim.h
@@ -28,95 +28,94 @@
 #ifndef _MOAL_H
 #define _MOAL_H
 
-mlan_status moal_get_fw_data(t_void *pmoal_handle, t_u32 offset, t_u32 len,
+mlan_status moal_get_fw_data(t_void *pmoal, t_u32 offset, t_u32 len,
 			     t_u8 *pbuf);
-mlan_status moal_get_vdll_data(t_void *pmoal_handle, t_u32 len, t_u8 *pbuf);
-mlan_status moal_get_hw_spec_complete(t_void *pmoal_handle, mlan_status status,
+mlan_status moal_get_vdll_data(t_void *pmoal, t_u32 len, t_u8 *pbuf);
+mlan_status moal_get_hw_spec_complete(t_void *pmoal, mlan_status status,
 				      mlan_hw_info *phw, pmlan_bss_tbl ptbl);
-mlan_status moal_init_fw_complete(t_void *pmoal_handle, mlan_status status);
-mlan_status moal_shutdown_fw_complete(t_void *pmoal_handle, mlan_status status);
-mlan_status moal_ioctl_complete(t_void *pmoal_handle,
-				pmlan_ioctl_req pioctl_req, mlan_status status);
-mlan_status moal_alloc_mlan_buffer(t_void *pmoal_handle, t_u32 size,
+mlan_status moal_init_fw_complete(t_void *pmoal, mlan_status status);
+mlan_status moal_shutdown_fw_complete(t_void *pmoal, mlan_status status);
+mlan_status moal_ioctl_complete(t_void *pmoal, pmlan_ioctl_req pioctl_req,
+				mlan_status status);
+mlan_status moal_alloc_mlan_buffer(t_void *pmoal, t_u32 size,
 				   pmlan_buffer *pmbuf);
-mlan_status moal_free_mlan_buffer(t_void *pmoal_handle, pmlan_buffer pmbuf);
-mlan_status moal_send_packet_complete(t_void *pmoal_handle, pmlan_buffer pmbuf,
+mlan_status moal_free_mlan_buffer(t_void *pmoal, pmlan_buffer pmbuf);
+mlan_status moal_send_packet_complete(t_void *pmoal, pmlan_buffer pmbuf,
 				      mlan_status status);
 #ifdef USB
-mlan_status moal_recv_complete(t_void *pmoal_handle, pmlan_buffer pmbuf,
-			       t_u32 port, mlan_status status);
-mlan_status moal_write_data_async(t_void *pmoal_handle, pmlan_buffer pmbuf,
+mlan_status moal_recv_complete(t_void *pmoal, pmlan_buffer pmbuf, t_u32 port,
+			       mlan_status status);
+mlan_status moal_write_data_async(t_void *pmoal, pmlan_buffer pmbuf,
 				  t_u32 port);
 #endif
 
 #if defined(SDIO) || defined(PCIE)
 /** moal_write_reg */
-mlan_status moal_write_reg(t_void *pmoal_handle, t_u32 reg, t_u32 data);
+mlan_status moal_write_reg(t_void *pmoal, t_u32 reg, t_u32 data);
 /** moal_read_reg */
-mlan_status moal_read_reg(t_void *pmoal_handle, t_u32 reg, t_u32 *data);
+mlan_status moal_read_reg(t_void *pmoal, t_u32 reg, t_u32 *data);
 #endif /* SDIO || PCIE */
-mlan_status moal_write_data_sync(t_void *pmoal_handle, pmlan_buffer pmbuf,
-				 t_u32 port, t_u32 timeout);
-mlan_status moal_read_data_sync(t_void *pmoal_handle, pmlan_buffer pmbuf,
-				t_u32 port, t_u32 timeout);
-mlan_status moal_recv_packet(t_void *pmoal_handle, pmlan_buffer pmbuf);
-mlan_status moal_recv_event(t_void *pmoal_handle, pmlan_event pmevent);
-mlan_status moal_malloc(t_void *pmoal_handle, t_u32 size, t_u32 flag,
-			t_u8 **ppbuf);
-mlan_status moal_mfree(t_void *pmoal_handle, t_u8 *pbuf);
-mlan_status moal_vmalloc(t_void *pmoal_handle, t_u32 size, t_u8 **ppbuf);
-mlan_status moal_vfree(t_void *pmoal_handle, t_u8 *pbuf);
+mlan_status moal_write_data_sync(t_void *pmoal, pmlan_buffer pmbuf, t_u32 port,
+				 t_u32 timeout);
+mlan_status moal_read_data_sync(t_void *pmoal, pmlan_buffer pmbuf, t_u32 port,
+				t_u32 timeout);
+mlan_status moal_recv_packet(t_void *pmoal, pmlan_buffer pmbuf);
+mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent);
+mlan_status moal_malloc(t_void *pmoal, t_u32 size, t_u32 flag, t_u8 **ppbuf);
+mlan_status moal_mfree(t_void *pmoal, t_u8 *pbuf);
+mlan_status moal_vmalloc(t_void *pmoal, t_u32 size, t_u8 **ppbuf);
+mlan_status moal_vfree(t_void *pmoal, t_u8 *pbuf);
 #ifdef PCIE
-mlan_status moal_malloc_consistent(t_void *pmoal_handle, t_u32 size,
-				   t_u8 **ppbuf, t_pu64 pbuf_pa);
-mlan_status moal_mfree_consistent(t_void *pmoal_handle, t_u32 size, t_u8 *pbuf,
+mlan_status moal_malloc_consistent(t_void *pmoal, t_u32 size, t_u8 **ppbuf,
+				   t_pu64 pbuf_pa);
+mlan_status moal_mfree_consistent(t_void *pmoal, t_u32 size, t_u8 *pbuf,
 				  t_u64 buf_pa);
-mlan_status moal_map_memory(t_void *pmoal_handle, t_u8 *pbuf, t_u64 *pbuf_pa,
+mlan_status moal_map_memory(t_void *pmoal, t_u8 *pbuf, t_u64 *pbuf_pa,
 			    t_u32 size, t_u32 flag);
-mlan_status moal_unmap_memory(t_void *pmoal_handle, t_u8 *pbuf, t_u64 buf_pa,
+mlan_status moal_unmap_memory(t_void *pmoal, t_u8 *pbuf, t_u64 buf_pa,
 			      t_u32 size, t_u32 flag);
 #endif /* PCIE */
-t_void *moal_memset(t_void *pmoal_handle, t_void *pmem, t_u8 byte, t_u32 num);
-t_void *moal_memcpy(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
+t_void *moal_memset(t_void *pmoal, t_void *pmem, t_u8 byte, t_u32 num);
+t_void *moal_memcpy(t_void *pmoal, t_void *pdest, const t_void *psrc,
 		    t_u32 num);
-t_void *moal_memcpy_ext(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
+t_void *moal_memcpy_ext(t_void *pmoal, t_void *pdest, const t_void *psrc,
 			t_u32 num, t_u32 dest_size);
 
-t_void *moal_memmove(t_void *pmoal_handle, t_void *pdest, const t_void *psrc,
+t_void *moal_memmove(t_void *pmoal, t_void *pdest, const t_void *psrc,
 		     t_u32 num);
-t_s32 moal_memcmp(t_void *pmoal_handle, const t_void *pmem1,
-		  const t_void *pmem2, t_u32 num);
+t_s32 moal_memcmp(t_void *pmoal, const t_void *pmem1, const t_void *pmem2,
+		  t_u32 num);
 /** moal_udelay */
-t_void moal_udelay(t_void *pmoal_handle, t_u32 udelay);
-t_void moal_usleep_range(t_void *pmoal_handle, t_u32 min_delay,
-			 t_u32 max_delay);
-mlan_status moal_get_boot_ktime(t_void *pmoal_handle, t_u64 *pnsec);
-mlan_status moal_get_system_time(t_void *pmoal_handle, t_u32 *psec,
-				 t_u32 *pusec);
-mlan_status moal_init_lock(t_void *pmoal_handle, t_void **pplock);
-mlan_status moal_free_lock(t_void *pmoal_handle, t_void *plock);
-mlan_status moal_spin_lock(t_void *pmoal_handle, t_void *plock);
-mlan_status moal_spin_unlock(t_void *pmoal_handle, t_void *plock);
+t_void moal_udelay(t_void *pmoal, t_u32 udelay);
+t_void moal_usleep_range(t_void *pmoal, t_u32 min_delay, t_u32 max_delay);
+mlan_status moal_get_boot_ktime(t_void *pmoal, t_u64 *pnsec);
+mlan_status moal_get_system_time(t_void *pmoal, t_u32 *psec, t_u32 *pusec);
+mlan_status moal_init_lock(t_void *pmoal, t_void **pplock);
+mlan_status moal_free_lock(t_void *pmoal, t_void *plock);
+mlan_status moal_spin_lock(t_void *pmoal, t_void *plock);
+mlan_status moal_spin_unlock(t_void *pmoal, t_void *plock);
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
-mlan_status moal_wait_hostcmd_complete(t_void *pmoal_handle, t_u32 bss_index);
-mlan_status moal_notify_hostcmd_complete(t_void *pmoal_handle, t_u32 bss_index);
+mlan_status moal_wait_hostcmd_complete(t_void *pmoal, t_u32 bss_index);
+mlan_status moal_notify_hostcmd_complete(t_void *pmoal, t_u32 bss_index);
 #endif
-t_void moal_print(t_void *pmoal_handle, t_u32 level, char *pformat, IN...);
-t_void moal_print_netintf(t_void *pmoal_handle, t_u32 bss_index, t_u32 level);
-t_void moal_assert(t_void *pmoal_handle, t_u32 cond);
-t_void moal_hist_data_add(t_void *pmoal_handle, t_u32 bss_index, t_u16 rx_rate,
+t_void moal_print(t_void *pmoal, t_u32 level, char *pformat, IN...);
+t_void moal_print_netintf(t_void *pmoal, t_u32 bss_index, t_u32 level);
+t_void moal_assert(t_void *pmoal, t_u32 cond);
+t_void moal_hist_data_add(t_void *pmoal, t_u32 bss_index, t_u16 rx_rate,
 			  t_s8 snr, t_s8 nflr, t_u8 antenna);
 
+t_void moal_updata_peer_signal(t_void *pmoal, t_u32 bss_index, t_u8 *peer_addr,
+			       t_s8 snr, t_s8 nflr);
 t_u64 moal_do_div(t_u64 num, t_u32 base);
 
-mlan_status moal_init_timer(t_void *pmoal_handle, t_void **pptimer,
+mlan_status moal_init_timer(t_void *pmoal, t_void **pptimer,
 			    IN t_void (*callback)(t_void *pcontext),
 			    t_void *pcontext);
-mlan_status moal_free_timer(t_void *pmoal_handle, t_void *ptimer);
-mlan_status moal_start_timer(t_void *pmoal_handle, t_void *ptimer,
-			     t_u8 periodic, t_u32 msec);
-mlan_status moal_stop_timer(t_void *pmoal_handle, t_void *ptimer);
-void moal_tp_accounting(t_void *pmoal_handle, void *buf, t_u32 drop_point);
-void moal_tp_accounting_rx_param(t_void *pmoal_handle, unsigned int type,
+mlan_status moal_free_timer(t_void *pmoal, t_void *ptimer);
+mlan_status moal_start_timer(t_void *pmoal, t_void *ptimer, t_u8 periodic,
+			     t_u32 msec);
+mlan_status moal_stop_timer(t_void *pmoal, t_void *ptimer);
+void moal_tp_accounting(t_void *pmoal, void *buf, t_u32 drop_point);
+void moal_tp_accounting_rx_param(t_void *pmoal, unsigned int type,
 				 unsigned int rsvd1);
 #endif /*_MOAL_H */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
index bde2558..b0e5825 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
@@ -3,7 +3,7 @@
  * @brief This file contains the functions for STA CFG80211.
  *
  *
- * Copyright 2011-2020 NXP
+ * Copyright 2011-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -35,7 +35,7 @@ extern int fw_region;
 #endif
 #endif
 /* Supported crypto cipher suits to be advertised to cfg80211 */
-const u32 cfg80211_cipher_suites[] = {
+static const u32 cfg80211_cipher_suites[] = {
 	WLAN_CIPHER_SUITE_WEP40,	WLAN_CIPHER_SUITE_WEP104,
 	WLAN_CIPHER_SUITE_TKIP,		WLAN_CIPHER_SUITE_CCMP,
 	WLAN_CIPHER_SUITE_SMS4,		WLAN_CIPHER_SUITE_AES_CMAC,
@@ -186,6 +186,40 @@ int woal_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
 static void woal_cfg80211_set_wakeup(struct wiphy *wiphy, bool enabled);
 #endif
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+void woal_check_auto_tdls(struct wiphy *wiphy, struct net_device *dev);
+int woal_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)
+			    const u8 *peer,
+#else
+			    u8 *peer,
+#endif
+			    enum nl80211_tdls_operation oper);
+int woal_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)
+			    const u8 *peer,
+#else
+			    u8 *peer,
+#endif
+			    u8 action_code, u8 dialog_token, u16 status_code,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+			    u32 peer_capability,
+#endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+			    bool initiator,
+#endif
+			    const u8 *extra_ies, size_t extra_ies_len);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+static int woal_cfg80211_tdls_channel_switch(struct wiphy *wiphy,
+					     struct net_device *dev,
+					     const u8 *addr, u8 oper_class,
+					     struct cfg80211_chan_def *chandef);
+
+void woal_cfg80211_tdls_cancel_channel_switch(struct wiphy *wiphy,
+					      struct net_device *dev,
+					      const u8 *addr);
+#endif
+#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 static int woal_cfg80211_change_station(struct wiphy *wiphy,
 					struct net_device *dev,
@@ -291,6 +325,14 @@ static struct cfg80211_ops woal_cfg80211_ops = {
 #if CFG80211_VERSION_CODE > KERNEL_VERSION(2, 6, 35)
 	.set_cqm_rssi_config = woal_cfg80211_set_cqm_rssi_config,
 #endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+	.tdls_oper = woal_cfg80211_tdls_oper,
+	.tdls_mgmt = woal_cfg80211_tdls_mgmt,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+	.tdls_channel_switch = woal_cfg80211_tdls_channel_switch,
+	.tdls_cancel_channel_switch = woal_cfg80211_tdls_cancel_channel_switch,
+#endif
+#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 	.change_station = woal_cfg80211_change_station,
 #endif
@@ -517,7 +559,7 @@ static const struct wiphy_coalesce_support coalesce_support = {
  *
  *  @return     MTRUE/MFALSE
  */
-t_u8 is_cfg80211_special_region_code(t_u8 *region_string)
+static t_u8 is_cfg80211_special_region_code(t_u8 *region_string)
 {
 	t_u8 i;
 	region_code_t cfg80211_special_region_code[] = {
@@ -1206,26 +1248,25 @@ done:
  *  @return                     MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING --
  * success, otherwise fail
  */
-mlan_status woal_set_ewpa_mode(moal_private *priv, t_u8 wait_option,
-			       mlan_ssid_bssid *ssid_bssid)
+static mlan_status woal_set_ewpa_mode(moal_private *priv, t_u8 wait_option,
+				      mlan_ssid_bssid *ssid_bssid)
 {
-	int ret = 0;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_sec_cfg *sec = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
 
-	if (!priv->phandle->card_info->embedded_supp) {
-		ret = -EOPNOTSUPP;
+	if (!priv->phandle->card_info->embedded_supp)
 		goto error;
-	}
+
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
 	if (req == NULL) {
-		ret = -ENOMEM;
+		status = MLAN_STATUS_FAILURE;
 		goto error;
 	}
+
 	/* Fill request buffer */
 	sec = (mlan_ds_sec_cfg *)req->pbuf;
 	sec->sub_command = MLAN_OID_SEC_CFG_PASSPHRASE;
@@ -1350,7 +1391,7 @@ mlan_status woal_inform_bss_from_scan_result(moal_private *priv,
 
 	if (scan_resp.num_in_scan_table) {
 		scan_table = (BSSDescriptor_t *)scan_resp.pscan_table;
-		for (i = 0; i < scan_resp.num_in_scan_table; i++) {
+		for (i = 0; i < (int)scan_resp.num_in_scan_table; i++) {
 			if (ssid_bssid) {
 				/* Inform specific BSS only */
 				if (memcmp(ssid_bssid->ssid.ssid,
@@ -1629,9 +1670,10 @@ done:
  *
  * @return                0 -- success, otherwise fail
  */
-int woal_cfg80211_connect_scan(moal_private *priv,
-			       struct cfg80211_connect_params *conn_param,
-			       t_u8 wait_option)
+static int
+woal_cfg80211_connect_scan(moal_private *priv,
+			   struct cfg80211_connect_params *conn_param,
+			   t_u8 wait_option)
 {
 	moal_handle *handle = priv->phandle;
 	int ret = 0;
@@ -1715,12 +1757,13 @@ int woal_cfg80211_connect_scan(moal_private *priv,
  * @param priv            A pointer to moal_private
  * @param req             A pointer to cfg80211_assoc_request structure
  */
-void woal_save_assoc_params(moal_private *priv,
-			    struct cfg80211_assoc_request *req,
-			    mlan_ssid_bssid *ssid_bssid)
+static void woal_save_assoc_params(moal_private *priv,
+				   struct cfg80211_assoc_request *req,
+				   mlan_ssid_bssid *ssid_bssid)
 {
 	ENTER();
 
+	priv->assoc_bss = req->bss;
 	if (req->bss->channel) {
 		priv->sme_current.channel = &priv->conn_chan;
 		moal_memcpy_ext(priv->phandle, priv->sme_current.channel,
@@ -1774,8 +1817,8 @@ void woal_save_assoc_params(moal_private *priv,
  * @param priv            A pointer to moal_private
  * @param req             A pointer to struct cfg80211_auth_request
  */
-void woal_save_auth_params(moal_private *priv,
-			   struct cfg80211_auth_request *req)
+static void woal_save_auth_params(moal_private *priv,
+				  struct cfg80211_auth_request *req)
 {
 	ENTER();
 	woal_clear_conn_params(priv);
@@ -2196,19 +2239,10 @@ void woal_host_mlme_process_assoc_resp(moal_private *priv,
 	if (priv) {
 		if (priv->auth_flag & HOST_MLME_ASSOC_DONE) {
 			priv->auth_flag = 0;
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
-			bss = cfg80211_get_bss(
-				priv->wdev->wiphy, NULL, priv->conn_bssid,
-				priv->conn_ssid, priv->conn_ssid_len,
-				IEEE80211_BSS_TYPE_ESS, IEEE80211_PRIVACY_ANY);
-#else
-			bss = cfg80211_get_bss(
-				priv->wdev->wiphy, NULL, priv->conn_bssid,
-				priv->conn_ssid, priv->conn_ssid_len,
-				WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-#endif
+			bss = priv->assoc_bss;
 			if (!bss) {
-				PRINTM(MERROR, "HostMlme %s:Fail to get bss\n",
+				PRINTM(MERROR,
+				       "HostMlme %s:assoc_bss is null\n",
 				       priv->netdev->name);
 				return;
 			}
@@ -2244,6 +2278,8 @@ void woal_host_mlme_process_assoc_resp(moal_private *priv,
 						    MLAN_BSS_TYPE_STA)
 							woal_clear_conn_params(
 								priv);
+					} else {
+						priv->cfg_disconnect = MFALSE;
 					}
 					spin_unlock_irqrestore(
 						&priv->connect_lock, flags);
@@ -2276,11 +2312,6 @@ void woal_host_mlme_process_assoc_resp(moal_private *priv,
 #endif
 				}
 			}
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
-			cfg80211_put_bss(priv->wdev->wiphy, bss);
-#else
-			cfg80211_put_bss(bss);
-#endif
 		}
 	}
 }
@@ -2294,8 +2325,8 @@ void woal_host_mlme_process_assoc_resp(moal_private *priv,
  * @return          N/A
  */
 
-void woal_assoc_resp_event(moal_private *priv,
-			   mlan_ds_misc_assoc_rsp *passoc_rsp)
+static void woal_assoc_resp_event(moal_private *priv,
+				  mlan_ds_misc_assoc_rsp *passoc_rsp)
 {
 	struct woal_event *evt;
 	unsigned long flags;
@@ -2561,13 +2592,10 @@ int woal_cfg80211_assoc(moal_private *priv, void *sme, t_u8 wait_option,
 	t_u8 *ssid, ssid_len = 0, *bssid;
 	t_u8 *ie = NULL;
 	int ie_len = 0;
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
-	struct cfg80211_chan_def *chan_def = NULL;
-#endif
 	struct ieee80211_channel *channel = NULL;
 	t_u16 beacon_interval = 0;
 	bool privacy;
-	struct cfg80211_bss *bss = NULL;
+	struct cfg80211_bss *pub = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -2587,7 +2615,6 @@ int woal_cfg80211_assoc(moal_private *priv, void *sme, t_u8 wait_option,
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
 		channel = ibss_param->channel;
 #else
-		chan_def = &ibss_param->chandef;
 		channel = ibss_param->chandef.chan;
 #endif
 		if (channel)
@@ -2611,15 +2638,15 @@ int woal_cfg80211_assoc(moal_private *priv, void *sme, t_u8 wait_option,
 		ie_len = conn_param->ie_len;
 		privacy = conn_param->privacy;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
-		bss = cfg80211_get_bss(priv->wdev->wiphy, channel, bssid, ssid,
+		pub = cfg80211_get_bss(priv->wdev->wiphy, channel, bssid, ssid,
 				       ssid_len, IEEE80211_BSS_TYPE_ESS,
 				       IEEE80211_PRIVACY_ANY);
 #else
-		bss = cfg80211_get_bss(priv->wdev->wiphy, channel, bssid, ssid,
+		pub = cfg80211_get_bss(priv->wdev->wiphy, channel, bssid, ssid,
 				       ssid_len, WLAN_CAPABILITY_ESS,
 				       WLAN_CAPABILITY_ESS);
 #endif
-		if (bss) {
+		if (pub) {
 			if ((!priv->phandle->params.reg_alpha2 ||
 			     strncmp(priv->phandle->params.reg_alpha2, "99",
 				     strlen("99")))
@@ -2628,11 +2655,11 @@ int woal_cfg80211_assoc(moal_private *priv, void *sme, t_u8 wait_option,
 						   EXT_COUNTRY_IE_IGNORE))
 #endif
 			)
-				woal_process_country_ie(priv, bss);
+				woal_process_country_ie(priv, pub);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
-			cfg80211_put_bss(priv->wdev->wiphy, bss);
+			cfg80211_put_bss(priv->wdev->wiphy, pub);
 #else
-			cfg80211_put_bss(bss);
+			cfg80211_put_bss(pub);
 #endif
 		} else
 			woal_send_domain_info_cmd_fw(priv, wait_option);
@@ -2956,8 +2983,8 @@ done:
  *
  * @return                0 -- success, otherwise fail
  */
-void woal_cfg80211_fill_rate_info(moal_private *priv,
-				  struct station_info *sinfo)
+static void woal_cfg80211_fill_rate_info(moal_private *priv,
+					 struct station_info *sinfo)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ioctl_req *req = NULL;
@@ -3423,7 +3450,7 @@ create_custom_regdomain(mlan_ds_custom_reg_domain *custom_reg)
 	}
 	PRINTM(MCMND, "create_custom_regdomain: %c%c rules=%d\n",
 	       regd->alpha2[0], regd->alpha2[1], valid_rules);
-	for (idx = 0; idx < regd->n_reg_rules; idx++) {
+	for (idx = 0; idx < (int)regd->n_reg_rules; idx++) {
 		rule = &regd->reg_rules[idx];
 		freq_range = &rule->freq_range;
 		PRINTM(MCMND,
@@ -3485,6 +3512,12 @@ static int woal_update_custom_regdomain(moal_private *priv, struct wiphy *wiphy)
 		country_code[0] = priv->phandle->country_code[0];
 		country_code[1] = priv->phandle->country_code[1];
 	}
+	if (misc->param.custom_reg_domain.region.country_code[0] == '\0' ||
+	    misc->param.custom_reg_domain.region.country_code[1] == '\0') {
+		PRINTM(MCMND, "FW country code not valid\n");
+		ret = -EFAULT;
+		goto done;
+	}
 	if (misc->param.custom_reg_domain.region.country_code[0] !=
 		    country_code[0] ||
 	    misc->param.custom_reg_domain.region.country_code[1] !=
@@ -3539,6 +3572,9 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
 	int ret = 0;
 #endif
 	mlan_fw_info fw_info;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+	char *reg_alpha2 = NULL;
+#endif
 
 	ENTER();
 
@@ -3580,7 +3616,7 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
 	region[2] = ' ';
 	if ((handle->country_code[0] != request->alpha2[0]) ||
 	    (handle->country_code[1] != request->alpha2[1])) {
-		if (moal_extflg_isset(handle, EXT_CNTRY_TXPWR)) {
+		if (handle->params.cntry_txpwr) {
 			t_u8 country_code[COUNTRY_CODE_LEN];
 			handle->country_code[0] = request->alpha2[0];
 			handle->country_code[1] = request->alpha2[1];
@@ -3605,7 +3641,7 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
 		}
 	}
 	if (MTRUE != is_cfg80211_special_region_code(region)) {
-		if (!moal_extflg_isset(handle, EXT_CNTRY_TXPWR)) {
+		if (!handle->params.cntry_txpwr) {
 			handle->country_code[0] = request->alpha2[0];
 			handle->country_code[1] = request->alpha2[1];
 			handle->country_code[2] = ' ';
@@ -3617,6 +3653,12 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
 	switch (request->initiator) {
 	case NL80211_REGDOM_SET_BY_DRIVER:
 		PRINTM(MCMND, "Regulatory domain BY_DRIVER\n");
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+		reg_alpha2 = priv->phandle->params.reg_alpha2;
+		if ((handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE) &&
+		    reg_alpha2 && woal_is_valid_alpha2(reg_alpha2))
+			woal_update_custom_regdomain(priv, wiphy);
+#endif
 		break;
 	case NL80211_REGDOM_SET_BY_CORE:
 		PRINTM(MCMND, "Regulatory domain BY_CORE\n");
@@ -3624,7 +3666,7 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
 	case NL80211_REGDOM_SET_BY_USER:
 		PRINTM(MCMND, "Regulatory domain BY_USER\n");
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
-		if (fw_region && moal_extflg_isset(handle, EXT_CNTRY_TXPWR))
+		if (handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE)
 			woal_update_custom_regdomain(priv, wiphy);
 #endif
 		break;
@@ -3659,8 +3701,8 @@ woal_cfg80211_reg_notifier(struct wiphy *wiphy,
  *
  * @return         0 --success, otherwise fail
  */
-mlan_status woal_role_switch(moal_private *priv, t_u8 wait_option,
-			     t_u8 bss_role)
+static mlan_status woal_role_switch(moal_private *priv, t_u8 wait_option,
+				    t_u8 bss_role)
 {
 	int ret = 0;
 	mlan_ds_bss *bss = NULL;
@@ -3749,7 +3791,8 @@ error:
  *
  *  @return                     MLAN_STATUS_SUCCESS -- success, otherwise fail
  */
-mlan_status woal_uap_scan(moal_private *priv, wlan_user_scan_cfg *scan_cfg)
+static mlan_status woal_uap_scan(moal_private *priv,
+				 wlan_user_scan_cfg *scan_cfg)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	moal_handle *handle = priv->phandle;
@@ -3836,7 +3879,7 @@ static int woal_find_wps_ie_in_probereq(const t_u8 *ie, int len)
  *
  *  @return             MTRUE/MFALSE;
  */
-t_u8 woal_is_scan_result_expired(moal_private *priv)
+static t_u8 woal_is_scan_result_expired(moal_private *priv)
 {
 	mlan_scan_resp scan_resp;
 	wifi_timeval t;
@@ -4036,8 +4079,8 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 	}
 #endif
 #endif
-	for (i = 0; i < MIN(WLAN_USER_SCAN_CHAN_MAX,
-			    priv->phandle->scan_request->n_channels);
+	for (i = 0; i < (int)MIN(WLAN_USER_SCAN_CHAN_MAX,
+				 priv->phandle->scan_request->n_channels);
 	     i++) {
 		chan = priv->phandle->scan_request->channels[i];
 		scan_req->chan_list[i].chan_number = chan->hw_value;
@@ -4838,12 +4881,6 @@ static int woal_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
 		return -EFAULT;
 	}
 
-	if (priv->cfg_disconnect) {
-		PRINTM(MERROR, "Disassociation already in progress\n");
-		LEAVE();
-		return 0;
-	}
-
 	if (priv->media_connected == MFALSE) {
 		PRINTM(MMSG, " Already disconnected\n");
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)
@@ -4862,6 +4899,12 @@ static int woal_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
 		return 0;
 	}
 
+	if (priv->cfg_disconnect) {
+		PRINTM(MERROR, "Disassociation already in progress\n");
+		LEAVE();
+		return 0;
+	}
+
 	priv->cfg_disconnect = MTRUE;
 	if (woal_disconnect(priv, MOAL_IOCTL_WAIT_TIMEOUT, priv->cfg_bssid,
 			    reason_code) != MLAN_STATUS_SUCCESS) {
@@ -5010,6 +5053,7 @@ static int woal_cfg80211_get_station(struct wiphy *wiphy,
 		ret = -EFAULT;
 	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+	woal_check_auto_tdls(wiphy, dev);
 #endif
 	LEAVE();
 	return ret;
@@ -5070,7 +5114,7 @@ static int woal_cfg80211_dump_station(struct wiphy *wiphy,
  *
  *  @return         IEEE band type
  */
-t_u8 woal_bandcfg_to_ieee_band(Band_Config_t bandcfg)
+static t_u8 woal_bandcfg_to_ieee_band(Band_Config_t bandcfg)
 {
 	t_u8 ret_radio_type = 0;
 
@@ -5119,11 +5163,11 @@ static int woal_cfg80211_dump_survey(struct wiphy *wiphy,
 		goto done;
 	}
 	pchan_stats = (ChanStatistics_t *)scan_resp.pchan_stats;
-	if (idx > scan_resp.num_in_chan_stats || idx < 0) {
+	if (idx > (int)scan_resp.num_in_chan_stats || idx < 0) {
 		ret = -EFAULT;
 		goto done;
 	}
-	if (idx == scan_resp.num_in_chan_stats ||
+	if (idx == (int)scan_resp.num_in_chan_stats ||
 	    !pchan_stats[idx].cca_scan_duration)
 		goto done;
 	ret = 0;
@@ -5815,7 +5859,8 @@ int woal_cfg80211_sched_scan_start(struct wiphy *wiphy, struct net_device *dev,
 	/** Add broadcast scan, when n_match_sets = 0 */
 	if (!request->n_match_sets)
 		priv->scan_cfg.ssid_list[0].max_len = 0xff;
-	for (i = 0; i < MIN(WLAN_BG_SCAN_CHAN_MAX, request->n_channels); i++) {
+	for (i = 0; i < (int)MIN(WLAN_BG_SCAN_CHAN_MAX, request->n_channels);
+	     i++) {
 		chan = request->channels[i];
 		priv->scan_cfg.chan_list[i].chan_number = chan->hw_value;
 		priv->scan_cfg.chan_list[i].radio_type = chan->band;
@@ -6013,7 +6058,6 @@ int woal_cfg80211_resume(struct wiphy *wiphy)
 				    handle->priv[i]->roaming_enabled) {
 					handle->priv[i]->roaming_required =
 						MTRUE;
-#ifdef ANDROID_KERNEL
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
 					__pm_wakeup_event(
 						&handle->ws,
@@ -6023,7 +6067,6 @@ int woal_cfg80211_resume(struct wiphy *wiphy)
 						&handle->wake_lock,
 						msecs_to_jiffies(
 							ROAMING_WAKE_LOCK_TIMEOUT));
-#endif
 #endif
 					wake_up_interruptible(
 						&handle->reassoc_thread.wait_q);
@@ -6355,6 +6398,1478 @@ static void woal_cfg80211_set_wakeup(struct wiphy *wiphy, bool enabled)
 }
 #endif
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+/**
+ *  @brief TDLS operation ioctl handler
+ *
+ *  @param priv     A pointer to moal_private structure
+ *  @param peer     A pointer to peer mac
+ *  @apram action   action for TDLS
+ *  @return         0 --success, otherwise fail
+ */
+static int woal_tdls_oper(moal_private *priv, u8 *peer, t_u8 action)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_TDLS_OPER;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	ioctl_req->action = MLAN_ACT_SET;
+	misc->param.tdls_oper.tdls_action = action;
+	moal_memcpy_ext(priv->phandle, misc->param.tdls_oper.peer_mac, peer,
+			ETH_ALEN, sizeof(misc->param.tdls_oper.peer_mac));
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief TDLS operation ioctl handler
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param peer         A pointer to peer mac
+ *  @param tdls_ies     A pointer to mlan_ds_misc_tdls_ies structure
+ *  @param flags        TDLS ie flags
+ *
+ *  @return         0 --success, otherwise fail
+ */
+static int woal_tdls_get_ies(moal_private *priv, u8 *peer,
+			     mlan_ds_misc_tdls_ies *tdls_ies, t_u16 flags)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_GET_TDLS_IES;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	ioctl_req->action = MLAN_ACT_GET;
+	misc->param.tdls_ies.flags = flags;
+	moal_memcpy_ext(priv->phandle, misc->param.tdls_ies.peer_mac, peer,
+			ETH_ALEN, sizeof(misc->param.tdls_ies.peer_mac));
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+	if (tdls_ies)
+		moal_memcpy_ext(priv->phandle, tdls_ies, &misc->param.tdls_ies,
+				sizeof(mlan_ds_misc_tdls_ies),
+				sizeof(mlan_ds_misc_tdls_ies));
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief append tdls ext_capability
+ *
+ * @param skb                   A pointer to sk_buff structure
+ *
+ * @return                      N/A
+ */
+static void woal_tdls_add_ext_capab(moal_private *priv, struct sk_buff *skb,
+				    mlan_ds_misc_tdls_ies *tdls_ies)
+{
+	u8 *pos = NULL;
+	if (tdls_ies->ext_cap[0] == WLAN_EID_EXT_CAPABILITY) {
+		pos = (void *)skb_put(skb, sizeof(IEEEtypes_ExtCap_t));
+		moal_memcpy_ext(priv->phandle, pos, tdls_ies->ext_cap,
+				sizeof(IEEEtypes_ExtCap_t),
+				sizeof(IEEEtypes_ExtCap_t));
+	} else {
+		PRINTM(MERROR, "Fail to append tdls ext_capability\n");
+	}
+}
+
+/**
+ * @brief append supported rates
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param skb                   A pointer to sk_buff structure
+ * @param band                  AP's band
+ *
+ * @return                      N/A
+ */
+static void woal_add_supported_rates_ie(moal_private *priv, struct sk_buff *skb,
+					enum ieee80211_band band)
+{
+	t_u8 basic_rates[] = {0x82, 0x84, 0x8b, 0x96, 0x0c, 0x12, 0x18, 0x24};
+	t_u8 basic_rates_5G[] = {0x0c, 0x12, 0x18, 0x24,
+				 0x30, 0x48, 0x60, 0x6c};
+	t_u8 *pos;
+	t_u8 rate_num = 0;
+	if (band == IEEE80211_BAND_2GHZ)
+		rate_num = sizeof(basic_rates);
+	else
+		rate_num = sizeof(basic_rates_5G);
+
+	if (skb_tailroom(skb) < rate_num + 2)
+		return;
+
+	pos = skb_put(skb, rate_num + 2);
+	*pos++ = WLAN_EID_SUPP_RATES;
+	*pos++ = rate_num;
+	if (band == IEEE80211_BAND_2GHZ)
+		moal_memcpy_ext(priv->phandle, pos, basic_rates, rate_num,
+				rate_num);
+	else
+		moal_memcpy_ext(priv->phandle, pos, basic_rates_5G, rate_num,
+				rate_num);
+	return;
+}
+
+/**
+ * @brief append ext_supported rates
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param skb                   A pointer to sk_buff structure
+ * @param band                  AP's band
+ *
+ * @return                      N/A
+ */
+static void woal_add_ext_supported_rates_ie(moal_private *priv,
+					    struct sk_buff *skb,
+					    enum ieee80211_band band)
+{
+	t_u8 ext_rates[] = {0x0c, 0x12, 0x18, 0x60};
+	t_u8 *pos;
+	t_u8 rate_num = sizeof(ext_rates);
+
+	if (band != IEEE80211_BAND_2GHZ)
+		return;
+
+	if (skb_tailroom(skb) < rate_num + 2)
+		return;
+
+	pos = skb_put(skb, rate_num + 2);
+	*pos++ = WLAN_EID_EXT_SUPP_RATES;
+	*pos++ = rate_num;
+	moal_memcpy_ext(priv->phandle, pos, ext_rates, rate_num, rate_num);
+	return;
+}
+
+/**
+ * @brief append wmm ie
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param skb                   A pointer to sk_buff structure
+ * @param wmm_type         WMM_TYPE_INFO/WMM_TYPE_PARAMETER
+ * @param pQosInfo           A pointer to qos info
+ *
+ * @return                      N/A
+ */
+static void woal_add_wmm_ie(moal_private *priv, struct sk_buff *skb,
+			    t_u8 wmm_type, t_u8 *pQosInfo)
+{
+	t_u8 wmmInfoElement[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
+	t_u8 wmmParamElement[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
+	t_u8 ac_vi[] = {0x42, 0x43, 0x5e, 0x00};
+	t_u8 ac_vo[] = {0x62, 0x32, 0x2f, 0x00};
+	t_u8 ac_be[] = {0x03, 0xa4, 0x00, 0x00};
+	t_u8 ac_bk[] = {0x27, 0xa4, 0x00, 0x00};
+	t_u8 qosInfo = 0x0;
+	t_u8 reserved = 0;
+	t_u8 wmm_id = 221;
+	t_u8 wmmParamIe_len = 25;
+	t_u8 wmmInfoIe_len = 7;
+	t_u8 len = 0;
+	t_u8 *pos;
+
+	qosInfo = (pQosInfo == NULL) ? 0xf : (*pQosInfo);
+	/*wmm parameter*/
+	if (wmm_type == WMM_TYPE_PARAMETER) {
+		if (skb_tailroom(skb) < (wmmParamIe_len + 2))
+			return;
+		pos = skb_put(skb, wmmParamIe_len + 2);
+		len = wmmParamIe_len;
+	} else {
+		if (skb_tailroom(skb) < (wmmInfoIe_len + 2))
+			return;
+		pos = skb_put(skb, wmmInfoIe_len + 2);
+		len = wmmInfoIe_len;
+	}
+
+	*pos++ = wmm_id;
+	*pos++ = len;
+	/*wmm parameter*/
+	if (wmm_type == WMM_TYPE_PARAMETER) {
+		moal_memcpy_ext(priv->phandle, pos, wmmParamElement,
+				sizeof(wmmParamElement),
+				sizeof(wmmParamElement));
+		pos += sizeof(wmmParamElement);
+	} else {
+		moal_memcpy_ext(priv->phandle, pos, wmmInfoElement,
+				sizeof(wmmInfoElement), sizeof(wmmInfoElement));
+		pos += sizeof(wmmInfoElement);
+	}
+	*pos++ = qosInfo;
+	/*wmm parameter*/
+	if (wmm_type == WMM_TYPE_PARAMETER) {
+		*pos++ = reserved;
+		moal_memcpy_ext(priv->phandle, pos, ac_be, sizeof(ac_be),
+				sizeof(ac_be));
+		pos += sizeof(ac_be);
+		moal_memcpy_ext(priv->phandle, pos, ac_bk, sizeof(ac_bk),
+				sizeof(ac_bk));
+		pos += sizeof(ac_bk);
+		moal_memcpy_ext(priv->phandle, pos, ac_vi, sizeof(ac_vi),
+				sizeof(ac_vi));
+		pos += sizeof(ac_vi);
+		moal_memcpy_ext(priv->phandle, pos, ac_vo, sizeof(ac_vo),
+				sizeof(ac_vo));
+	}
+	return;
+}
+
+/**
+ * @brief update tdls peer status
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param peer_addr             A point to peer mac address
+ * @param link_status           link status
+ *
+ * @return                      N/A
+ */
+static t_void woal_updata_peer_status(moal_private *priv, t_u8 *peer_addr,
+				      tdlsStatus_e link_status)
+{
+	struct tdls_peer *peer = NULL;
+	unsigned long flags;
+	if (priv && priv->enable_auto_tdls) {
+		spin_lock_irqsave(&priv->tdls_lock, flags);
+		list_for_each_entry (peer, &priv->tdls_list, link) {
+			if (!memcmp(peer->peer_addr, peer_addr, ETH_ALEN)) {
+				if ((link_status == TDLS_NOT_SETUP) &&
+				    (peer->link_status ==
+				     TDLS_SETUP_INPROGRESS))
+					peer->num_failure++;
+				else if (link_status == TDLS_SETUP_COMPLETE)
+					peer->num_failure = 0;
+				peer->link_status = link_status;
+				break;
+			}
+		}
+		spin_unlock_irqrestore(&priv->tdls_lock, flags);
+	}
+}
+
+/**
+ * @brief add tdls peer
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param peer                  A point to peer address
+ *
+ * @return                      N/A
+ */
+static t_void woal_add_tdls_peer(moal_private *priv, t_u8 *peer)
+{
+	struct tdls_peer *tdls_peer = NULL;
+	unsigned long flags;
+	t_u8 find_peer = MFALSE;
+	if (priv && priv->enable_auto_tdls) {
+		spin_lock_irqsave(&priv->tdls_lock, flags);
+		list_for_each_entry (tdls_peer, &priv->tdls_list, link) {
+			if (!memcmp(tdls_peer->peer_addr, peer, ETH_ALEN)) {
+				tdls_peer->link_status = TDLS_SETUP_INPROGRESS;
+				tdls_peer->rssi_jiffies = jiffies;
+				find_peer = MTRUE;
+				break;
+			}
+		}
+		if (!find_peer) {
+			/* create new TDLS peer */
+			tdls_peer =
+				kzalloc(sizeof(struct tdls_peer), GFP_ATOMIC);
+			if (tdls_peer) {
+				moal_memcpy_ext(priv->phandle,
+						tdls_peer->peer_addr, peer,
+						ETH_ALEN,
+						sizeof(tdls_peer->peer_addr));
+				tdls_peer->link_status = TDLS_SETUP_INPROGRESS;
+				tdls_peer->rssi_jiffies = jiffies;
+				INIT_LIST_HEAD(&tdls_peer->link);
+				list_add_tail(&tdls_peer->link,
+					      &priv->tdls_list);
+				PRINTM(MCMND,
+				       "Add to TDLS list: peer=" MACSTR "\n",
+				       MAC2STR(peer));
+			}
+		}
+		spin_unlock_irqrestore(&priv->tdls_lock, flags);
+	}
+}
+
+/**
+ * @brief check auto tdls
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ *
+ * @return                      N/A
+ */
+void woal_check_auto_tdls(struct wiphy *wiphy, struct net_device *dev)
+{
+	t_u8 bcast_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	struct tdls_peer *tdls_peer = NULL;
+	unsigned long flags;
+	t_u8 tdls_discovery = MFALSE;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+
+	ENTER();
+	if (priv && priv->enable_auto_tdls) {
+		priv->tdls_check_tx = MFALSE;
+		spin_lock_irqsave(&priv->tdls_lock, flags);
+		list_for_each_entry (tdls_peer, &priv->tdls_list, link) {
+			if ((jiffies - tdls_peer->rssi_jiffies) >
+			    TDLS_IDLE_TIME) {
+				tdls_peer->rssi = 0;
+				if (tdls_peer->num_failure <
+				    TDLS_MAX_FAILURE_COUNT)
+					tdls_discovery = MTRUE;
+			}
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+			if (tdls_peer->rssi &&
+			    (tdls_peer->rssi >= TDLS_RSSI_LOW_THRESHOLD)) {
+				if (tdls_peer->link_status ==
+				    TDLS_SETUP_COMPLETE) {
+					tdls_peer->link_status = TDLS_TEAR_DOWN;
+					PRINTM(MMSG,
+					       "Wlan: Tear down TDLS link, peer=" MACSTR
+					       " rssi=%d\n",
+					       MAC2STR(tdls_peer->peer_addr),
+					       -tdls_peer->rssi);
+					cfg80211_tdls_oper_request(
+						dev, tdls_peer->peer_addr,
+						NL80211_TDLS_TEARDOWN,
+						TDLS_TEARN_DOWN_REASON_UNSPECIFIC,
+						GFP_ATOMIC);
+				}
+			} else if (tdls_peer->rssi &&
+				   (tdls_peer->rssi <=
+				    TDLS_RSSI_HIGH_THRESHOLD)) {
+				if ((tdls_peer->link_status ==
+				     TDLS_NOT_SETUP) &&
+				    (tdls_peer->num_failure <
+				     TDLS_MAX_FAILURE_COUNT)) {
+					priv->tdls_check_tx = MTRUE;
+					PRINTM(MCMND,
+					       "Wlan: Find TDLS peer=" MACSTR
+					       " rssi=%d\n",
+					       MAC2STR(tdls_peer->peer_addr),
+					       -tdls_peer->rssi);
+				}
+			}
+#endif
+		}
+		spin_unlock_irqrestore(&priv->tdls_lock, flags);
+	}
+	if (tdls_discovery)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+		woal_cfg80211_tdls_mgmt(wiphy, dev, bcast_addr,
+					TDLS_DISCOVERY_REQUEST, 1, 0, 0, 0,
+					NULL, 0);
+#else
+		woal_cfg80211_tdls_mgmt(wiphy, dev, bcast_addr,
+					TDLS_DISCOVERY_REQUEST, 1, 0, 0, NULL,
+					0);
+#endif
+#else
+		woal_cfg80211_tdls_mgmt(wiphy, dev, bcast_addr,
+					TDLS_DISCOVERY_REQUEST, 1, 0, NULL, 0);
+#endif
+	LEAVE();
+}
+
+/**
+ * @brief woal construct tdls data frame
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param peer                  A pointer to peer mac
+ * @param action_code           tdls action code
+ * @param dialog_token          dialog_token
+ * @param status_code           status_code
+ * @param skb                   skb buffer
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+static int woal_construct_tdls_data_frame(moal_private *priv, t_u8 *peer,
+					  t_u8 action_code, t_u8 dialog_token,
+					  t_u16 status_code,
+					  struct sk_buff *skb)
+{
+	struct ieee80211_tdls_data *tdata;
+	t_u16 capability;
+	IEEEtypes_HTCap_t *HTcap;
+	IEEEtypes_HTInfo_t *HTInfo;
+	IEEEtypes_2040BSSCo_t *BSSCo;
+	IEEEtypes_VHTCap_t *VHTcap;
+	IEEEtypes_VHTOprat_t *vht_oprat;
+	IEEEtypes_AID_t *AidInfo;
+	IEEEtypes_Generic_t *pSupp_chan = NULL, *pRegulatory_class = NULL;
+	mlan_ds_misc_tdls_ies *tdls_ies = NULL;
+	int ret = 0;
+	mlan_bss_info bss_info;
+	enum ieee80211_band band;
+	mlan_fw_info fw_info;
+
+	ENTER();
+
+	memset(&bss_info, 0, sizeof(bss_info));
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MERROR, "Fail to get bss info\n");
+		LEAVE();
+		return -EFAULT;
+	}
+	band = woal_band_cfg_to_ieee_band(bss_info.bss_band);
+	tdls_ies = kzalloc(sizeof(mlan_ds_misc_tdls_ies), GFP_KERNEL);
+	if (!tdls_ies) {
+		PRINTM(MERROR, "Fail to alloc memory for tdls_ies\n");
+		LEAVE();
+		return -ENOMEM;
+	}
+
+	capability = 0x2421;
+
+	memset(&fw_info, 0, sizeof(mlan_fw_info));
+	tdata = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
+	moal_memcpy_ext(priv->phandle, tdata->da, peer, ETH_ALEN,
+			sizeof(tdata->da));
+	moal_memcpy_ext(priv->phandle, tdata->sa, priv->current_addr, ETH_ALEN,
+			sizeof(tdata->sa));
+	tdata->ether_type = cpu_to_be16(MLAN_ETHER_PKT_TYPE_TDLS_ACTION);
+	tdata->payload_type = WLAN_TDLS_SNAP_RFTYPE;
+	woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info);
+
+	switch (action_code) {
+	case WLAN_TDLS_SETUP_REQUEST:
+		if (fw_info.fw_bands & BAND_AAC)
+			woal_tdls_get_ies(priv, peer, tdls_ies,
+					  TDLS_IE_FLAGS_SETUP |
+						  TDLS_IE_FLAGS_EXTCAP |
+						  TDLS_IE_FLAGS_HTCAP |
+						  TDLS_IE_FLAGS_VHTCAP |
+						  TDLS_IE_FLAGS_AID |
+						  TDLS_IE_FLAGS_SUPP_CS_IE);
+		else
+			woal_tdls_get_ies(priv, peer, tdls_ies,
+					  TDLS_IE_FLAGS_SETUP |
+						  TDLS_IE_FLAGS_EXTCAP |
+						  TDLS_IE_FLAGS_HTCAP |
+						  TDLS_IE_FLAGS_SUPP_CS_IE);
+
+		tdata->category = WLAN_CATEGORY_TDLS;
+		tdata->action_code = WLAN_TDLS_SETUP_REQUEST;
+		skb_put(skb, sizeof(tdata->u.setup_req));
+		tdata->u.setup_req.dialog_token = dialog_token;
+		tdata->u.setup_req.capability = cpu_to_le16(capability);
+		woal_add_supported_rates_ie(priv, skb, band);
+		woal_add_ext_supported_rates_ie(priv, skb, band);
+		break;
+	case WLAN_TDLS_SETUP_RESPONSE:
+		if (fw_info.fw_bands & BAND_AAC)
+			woal_tdls_get_ies(priv, peer, tdls_ies,
+					  TDLS_IE_FLAGS_EXTCAP |
+						  TDLS_IE_FLAGS_HTCAP |
+						  TDLS_IE_FLAGS_VHTCAP |
+						  TDLS_IE_FLAGS_AID |
+						  TDLS_IE_FLAGS_SUPP_CS_IE);
+		else
+			woal_tdls_get_ies(priv, peer, tdls_ies,
+					  TDLS_IE_FLAGS_EXTCAP |
+						  TDLS_IE_FLAGS_HTCAP |
+						  TDLS_IE_FLAGS_SUPP_CS_IE);
+
+		tdata->category = WLAN_CATEGORY_TDLS;
+		tdata->action_code = WLAN_TDLS_SETUP_RESPONSE;
+
+		skb_put(skb, sizeof(tdata->u.setup_resp));
+		tdata->u.setup_resp.status_code = cpu_to_le16(status_code);
+		tdata->u.setup_resp.dialog_token = dialog_token;
+		tdata->u.setup_resp.capability = cpu_to_le16(capability);
+
+		woal_add_supported_rates_ie(priv, skb, band);
+		woal_add_ext_supported_rates_ie(priv, skb, band);
+		break;
+	case WLAN_TDLS_SETUP_CONFIRM:
+		if (fw_info.fw_bands & BAND_AAC)
+			woal_tdls_get_ies(priv, peer, tdls_ies,
+					  TDLS_IE_FLAGS_EXTCAP |
+						  TDLS_IE_FLAGS_HTINFO |
+						  TDLS_IE_FLAGS_VHTOPRAT |
+						  TDLS_IE_FLAGS_QOS_INFO);
+		else
+			woal_tdls_get_ies(priv, peer, tdls_ies,
+					  TDLS_IE_FLAGS_EXTCAP |
+						  TDLS_IE_FLAGS_HTINFO |
+						  TDLS_IE_FLAGS_QOS_INFO);
+
+		tdata->category = WLAN_CATEGORY_TDLS;
+		tdata->action_code = WLAN_TDLS_SETUP_CONFIRM;
+
+		skb_put(skb, sizeof(tdata->u.setup_cfm));
+		tdata->u.setup_cfm.status_code = cpu_to_le16(status_code);
+		tdata->u.setup_cfm.dialog_token = dialog_token;
+
+		break;
+	case WLAN_TDLS_TEARDOWN:
+		tdata->category = WLAN_CATEGORY_TDLS;
+		tdata->action_code = WLAN_TDLS_TEARDOWN;
+
+		skb_put(skb, sizeof(tdata->u.teardown));
+		tdata->u.teardown.reason_code = cpu_to_le16(status_code);
+		break;
+	case WLAN_TDLS_DISCOVERY_REQUEST:
+		tdata->category = WLAN_CATEGORY_TDLS;
+		tdata->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
+
+		skb_put(skb, sizeof(tdata->u.discover_req));
+		tdata->u.discover_req.dialog_token = dialog_token;
+		break;
+	default:
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (action_code == WLAN_TDLS_SETUP_REQUEST ||
+	    action_code == WLAN_TDLS_SETUP_RESPONSE) {
+		/* supported chanel ie*/
+		if (tdls_ies->supp_chan[0] == SUPPORTED_CHANNELS) {
+			pSupp_chan = (void *)skb_put(
+				skb, sizeof(IEEEtypes_Header_t) +
+					     tdls_ies->supp_chan[1]);
+			memset(pSupp_chan, 0,
+			       sizeof(IEEEtypes_Header_t) +
+				       tdls_ies->supp_chan[1]);
+			moal_memcpy_ext(priv->phandle, pSupp_chan,
+					tdls_ies->supp_chan,
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->supp_chan[1],
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->supp_chan[1]);
+		}
+		/* supported regulatory class ie*/
+		if (tdls_ies->regulatory_class[0] == REGULATORY_CLASS) {
+			pRegulatory_class = (void *)skb_put(
+				skb, sizeof(IEEEtypes_Header_t) +
+					     tdls_ies->regulatory_class[1]);
+			memset(pRegulatory_class, 0,
+			       sizeof(IEEEtypes_Header_t) +
+				       tdls_ies->regulatory_class[1]);
+			moal_memcpy_ext(priv->phandle, pRegulatory_class,
+					tdls_ies->regulatory_class,
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->regulatory_class[1],
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->regulatory_class[1]);
+		}
+		woal_tdls_add_ext_capab(priv, skb, tdls_ies);
+	}
+
+	/* TODO we should fill in ht_cap and htinfo with correct value */
+	switch (action_code) {
+	case WLAN_TDLS_SETUP_REQUEST:
+	case WLAN_TDLS_SETUP_RESPONSE:
+		/*HT capability*/
+		if (tdls_ies->ht_cap[0] == HT_CAPABILITY) {
+			HTcap = (void *)skb_put(skb, sizeof(IEEEtypes_HTCap_t));
+			memset(HTcap, 0, sizeof(IEEEtypes_HTCap_t));
+			moal_memcpy_ext(priv->phandle, HTcap, tdls_ies->ht_cap,
+					sizeof(IEEEtypes_HTCap_t),
+					sizeof(IEEEtypes_HTCap_t));
+		} else {
+			PRINTM(MIOCTL, "No TDLS HT capability\n");
+		}
+
+		/*20_40_bss_coexist*/
+		BSSCo = (void *)skb_put(skb, sizeof(IEEEtypes_2040BSSCo_t));
+		memset(BSSCo, 0, sizeof(IEEEtypes_2040BSSCo_t));
+		BSSCo->ieee_hdr.element_id = BSSCO_2040;
+		BSSCo->ieee_hdr.len = sizeof(IEEEtypes_2040BSSCo_t) -
+				      sizeof(IEEEtypes_Header_t);
+		BSSCo->bss_co_2040.bss_co_2040_value = 0x01;
+
+		/* VHT capability */
+		if (tdls_ies->vht_cap[0] == VHT_CAPABILITY) {
+			VHTcap = (void *)skb_put(skb,
+						 sizeof(IEEEtypes_VHTCap_t));
+			memset(VHTcap, 0, sizeof(IEEEtypes_VHTCap_t));
+			moal_memcpy_ext(priv->phandle, VHTcap,
+					tdls_ies->vht_cap,
+					sizeof(IEEEtypes_VHTCap_t),
+					sizeof(IEEEtypes_VHTCap_t));
+		} else {
+			PRINTM(MIOCTL, "NO TDLS VHT capability\n");
+		}
+		/* AID info */
+		if (tdls_ies->aid_info[0] == AID_INFO) {
+			AidInfo = (void *)skb_put(skb, sizeof(IEEEtypes_AID_t));
+			memset(AidInfo, 0, sizeof(IEEEtypes_AID_t));
+			moal_memcpy_ext(priv->phandle, AidInfo,
+					tdls_ies->aid_info,
+					sizeof(IEEEtypes_AID_t),
+					sizeof(IEEEtypes_AID_t));
+		} else {
+			PRINTM(MIOCTL, "No TDLS AID info\n");
+		}
+		break;
+	case WLAN_TDLS_SETUP_CONFIRM:
+		/*HT information*/
+		if (tdls_ies->ht_info[0] == HT_OPERATION) {
+			HTInfo = (void *)skb_put(skb,
+						 sizeof(IEEEtypes_HTInfo_t));
+			memset(HTInfo, 0, sizeof(IEEEtypes_HTInfo_t));
+			moal_memcpy_ext(priv->phandle, HTInfo,
+					tdls_ies->ht_info,
+					sizeof(IEEEtypes_HTInfo_t),
+					sizeof(IEEEtypes_HTInfo_t));
+		} else
+			PRINTM(MIOCTL, "No TDLS HT information\n");
+		/** VHT operation */
+		if (tdls_ies->vht_oprat[0] == VHT_OPERATION) {
+			vht_oprat = (void *)skb_put(
+				skb, sizeof(IEEEtypes_VHTOprat_t));
+			memset(vht_oprat, 0, sizeof(IEEEtypes_VHTOprat_t));
+			moal_memcpy_ext(priv->phandle, vht_oprat,
+					tdls_ies->vht_oprat,
+					sizeof(IEEEtypes_VHTOprat_t),
+					sizeof(IEEEtypes_VHTOprat_t));
+		} else
+			PRINTM(MIOCTL, "NO TDLS VHT Operation IE\n");
+		break;
+	default:
+		break;
+	}
+
+	if (action_code == WLAN_TDLS_SETUP_REQUEST ||
+	    action_code == WLAN_TDLS_SETUP_RESPONSE) {
+		/*wmm info*/
+		woal_add_wmm_ie(priv, skb, WMM_TYPE_INFO, NULL);
+	} else if (action_code == WLAN_TDLS_SETUP_CONFIRM) {
+		/*wmm parameter*/
+		woal_add_wmm_ie(priv, skb, WMM_TYPE_PARAMETER,
+				&tdls_ies->QosInfo);
+	}
+
+done:
+	kfree(tdls_ies);
+	return ret;
+}
+
+/**
+ * @brief woal construct tdls action frame
+ *
+ * @param priv                  A pointer to moal_private structure
+ * @param peer                  A pointer to peer mac
+ * @param action_code           tdls action code
+ * @param dialog_token          dialog_token
+ * @param status_code           status_code
+ * @param skb                   skb buffer
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+static int woal_construct_tdls_action_frame(moal_private *priv, t_u8 *peer,
+					    t_u8 action_code, t_u8 dialog_token,
+					    t_u16 status_code,
+					    struct sk_buff *skb)
+{
+	struct ieee80211_mgmt *mgmt;
+	t_u8 addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	t_u16 capability;
+	t_u8 *pos = NULL;
+	mlan_ds_misc_tdls_ies *tdls_ies = NULL;
+	mlan_bss_info bss_info;
+	enum ieee80211_band band;
+	IEEEtypes_Generic_t *pSupp_chan = NULL, *pRegulatory_class = NULL;
+
+	int ret = 0;
+
+	ENTER();
+
+	memset(&bss_info, 0, sizeof(bss_info));
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MERROR, "Fail to get bss info\n");
+		LEAVE();
+		return -EFAULT;
+	}
+	band = woal_band_cfg_to_ieee_band(bss_info.bss_band);
+
+	tdls_ies = kzalloc(sizeof(mlan_ds_misc_tdls_ies), GFP_KERNEL);
+	if (!tdls_ies) {
+		PRINTM(MERROR, "Fail to alloc memory for tdls_ies\n");
+		LEAVE();
+		return -ENOMEM;
+	}
+
+	mgmt = (void *)skb_put(skb, 24);
+	memset(mgmt, 0, 24);
+	moal_memcpy_ext(priv->phandle, mgmt->da, peer, ETH_ALEN,
+			sizeof(mgmt->da));
+	moal_memcpy_ext(priv->phandle, mgmt->sa, priv->current_addr, ETH_ALEN,
+			sizeof(mgmt->sa));
+	moal_memcpy_ext(priv->phandle, mgmt->bssid, priv->cfg_bssid, ETH_ALEN,
+			sizeof(mgmt->bssid));
+
+	mgmt->frame_control =
+		cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION);
+	/* add address 4*/
+	pos = skb_put(skb, ETH_ALEN);
+
+	capability = 0x2421;
+
+	switch (action_code) {
+	case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+		woal_tdls_get_ies(priv, peer, tdls_ies,
+				  TDLS_IE_FLAGS_EXTCAP |
+					  TDLS_IE_FLAGS_SUPP_CS_IE);
+		skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
+		mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
+		mgmt->u.action.u.tdls_discover_resp.action_code =
+			WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
+		mgmt->u.action.u.tdls_discover_resp.dialog_token = dialog_token;
+		mgmt->u.action.u.tdls_discover_resp.capability =
+			cpu_to_le16(capability);
+		/* move back for addr4 */
+		memmove(pos + ETH_ALEN, &mgmt->u.action,
+			1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
+		/** init address 4 */
+		moal_memcpy_ext(priv->phandle, pos, addr, ETH_ALEN, ETH_ALEN);
+
+		woal_add_supported_rates_ie(priv, skb, band);
+		woal_add_ext_supported_rates_ie(priv, skb, band);
+		woal_tdls_add_ext_capab(priv, skb, tdls_ies);
+		/* supported chanel ie*/
+		if (tdls_ies->supp_chan[0] == SUPPORTED_CHANNELS) {
+			pSupp_chan = (void *)skb_put(
+				skb, sizeof(IEEEtypes_Header_t) +
+					     tdls_ies->supp_chan[1]);
+			memset(pSupp_chan, 0,
+			       sizeof(IEEEtypes_Header_t) +
+				       tdls_ies->supp_chan[1]);
+			moal_memcpy_ext(priv->phandle, pSupp_chan,
+					tdls_ies->supp_chan,
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->supp_chan[1],
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->supp_chan[1]);
+		}
+		/* supported regulatory class ie*/
+		if (tdls_ies->regulatory_class[0] == REGULATORY_CLASS) {
+			pRegulatory_class = (void *)skb_put(
+				skb, sizeof(IEEEtypes_Header_t) +
+					     tdls_ies->regulatory_class[1]);
+			memset(pRegulatory_class, 0,
+			       sizeof(IEEEtypes_Header_t) +
+				       tdls_ies->regulatory_class[1]);
+			moal_memcpy_ext(priv->phandle, pRegulatory_class,
+					tdls_ies->regulatory_class,
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->regulatory_class[1],
+					sizeof(IEEEtypes_Header_t) +
+						tdls_ies->regulatory_class[1]);
+		}
+
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+	if (tdls_ies)
+		kfree(tdls_ies);
+	return ret;
+}
+
+/**
+ * @brief woal add tdls link identifier ie
+ *
+ * @param skb                   skb buffer
+ * @param src_addr              source address
+ * @param peer                  peer address
+ * @param bssid                 AP's bssid
+ *
+ * @return                      NA
+ */
+static void woal_tdls_add_link_ie(moal_private *priv, struct sk_buff *skb,
+				  u8 *src_addr, u8 *peer, u8 *bssid)
+{
+	struct ieee80211_tdls_lnkie *lnkid;
+
+	lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
+
+	lnkid->ie_type = WLAN_EID_LINK_ID;
+	lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
+
+	moal_memcpy_ext(priv->phandle, lnkid->bssid, bssid, ETH_ALEN,
+			sizeof(lnkid->bssid));
+	moal_memcpy_ext(priv->phandle, lnkid->init_sta, src_addr, ETH_ALEN,
+			sizeof(lnkid->init_sta));
+	moal_memcpy_ext(priv->phandle, lnkid->resp_sta, peer, ETH_ALEN,
+			sizeof(lnkid->resp_sta));
+}
+
+/**
+ * @brief woal send tdls action frame
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param peer                  A pointer to peer mac
+ * @param action_code           tdls action code
+ * @param dialog_token          dialog_token
+ * @param status_code           status_code
+ * @param extra_ies              A pointer to extra ie buffer
+ * @param extra_ies_len          etra ie len
+ * @param skb                   skb buffer
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+static int woal_send_tdls_action_frame(struct wiphy *wiphy,
+				       struct net_device *dev, t_u8 *peer,
+				       u8 action_code, t_u8 dialog_token,
+				       t_u16 status_code, const t_u8 *extra_ies,
+				       size_t extra_ies_len)
+{
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	pmlan_buffer pmbuf = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	struct sk_buff *skb = NULL;
+	t_u8 *pos;
+	t_u32 pkt_type;
+	t_u32 tx_control;
+	t_u16 pkt_len;
+	int ret = 0;
+
+	ENTER();
+
+#define HEADER_SIZE 8 /* pkt_type + tx_control */
+
+	pmbuf = woal_alloc_mlan_buffer(
+		priv->phandle,
+		MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE + sizeof(pkt_len) +
+			max(sizeof(struct ieee80211_mgmt),
+			    sizeof(struct ieee80211_tdls_data)) +
+			50 + /* supported rates */
+			sizeof(IEEEtypes_ExtCap_t) + /* ext capab */
+			extra_ies_len + sizeof(IEEEtypes_tdls_linkie));
+	if (!pmbuf) {
+		PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	skb = (struct sk_buff *)pmbuf->pdesc;
+
+	skb_put(skb, MLAN_MIN_DATA_HEADER_LEN);
+
+	pos = skb_put(skb, HEADER_SIZE + sizeof(pkt_len));
+	pkt_type = MRVL_PKT_TYPE_MGMT_FRAME;
+	tx_control = 0;
+	memset(pos, 0, HEADER_SIZE + sizeof(pkt_len));
+	moal_memcpy_ext(priv->phandle, pos, &pkt_type, sizeof(pkt_type),
+			sizeof(pkt_type));
+	moal_memcpy_ext(priv->phandle, pos + sizeof(pkt_type), &tx_control,
+			sizeof(tx_control), sizeof(tx_control));
+
+	woal_construct_tdls_action_frame(priv, peer, action_code, dialog_token,
+					 status_code, skb);
+
+	if (extra_ies_len)
+		moal_memcpy_ext(priv->phandle, skb_put(skb, extra_ies_len),
+				extra_ies, extra_ies_len, extra_ies_len);
+
+	/* the TDLS link IE is always added last */
+	/* we are the responder */
+	woal_tdls_add_link_ie(priv, skb, peer, priv->current_addr,
+			      priv->cfg_bssid);
+
+	/*
+	 * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
+	 * we should default to AC_VI.
+	 */
+	skb_set_queue_mapping(skb, WMM_AC_VI);
+	skb->priority = 5;
+
+	pmbuf->data_offset = MLAN_MIN_DATA_HEADER_LEN;
+	pmbuf->data_len = skb->len - pmbuf->data_offset;
+	pmbuf->priority = skb->priority;
+	pmbuf->buf_type = MLAN_BUF_TYPE_RAW_DATA;
+	pmbuf->bss_index = priv->bss_index;
+
+	pkt_len = pmbuf->data_len - HEADER_SIZE - sizeof(pkt_len);
+	moal_memcpy_ext(priv->phandle,
+			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
+			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
+
+	DBG_HEXDUMP(MDAT_D, "TDLS action:", pmbuf->pbuf + pmbuf->data_offset,
+		    pmbuf->data_len);
+
+	status = mlan_send_packet(priv->phandle->pmlan_adapter, pmbuf);
+
+	switch (status) {
+	case MLAN_STATUS_PENDING:
+		atomic_inc(&priv->phandle->tx_pending);
+		queue_work(priv->phandle->workqueue, &priv->phandle->main_work);
+		break;
+	case MLAN_STATUS_SUCCESS:
+		woal_free_mlan_buffer(priv->phandle, pmbuf);
+		break;
+	case MLAN_STATUS_FAILURE:
+	default:
+		woal_free_mlan_buffer(priv->phandle, pmbuf);
+		ret = -EFAULT;
+		break;
+	}
+
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief woal send tdls data frame
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param peer                  A pointer to peer mac
+ * @param action_code           tdls action code
+ * @param dialog_token          dialog_token
+ * @param status_code           status_code
+ * @param extra_ies              A pointer to extra ie buffer
+ * @param extra_ies_len          etra ie len
+ * @param skb                   skb buffer
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+static int woal_send_tdls_data_frame(struct wiphy *wiphy,
+				     struct net_device *dev, t_u8 *peer,
+				     u8 action_code, t_u8 dialog_token,
+				     t_u16 status_code, const t_u8 *extra_ies,
+				     size_t extra_ies_len)
+{
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	pmlan_buffer pmbuf = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	struct sk_buff *skb = NULL;
+	int ret = 0;
+#if CFG80211_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+	t_u32 index = 0;
+#endif
+
+	ENTER();
+
+	skb = dev_alloc_skb(
+		priv->extra_tx_head_len + MLAN_MIN_DATA_HEADER_LEN +
+		sizeof(mlan_buffer) +
+		max(sizeof(struct ieee80211_mgmt),
+		    sizeof(struct ieee80211_tdls_data)) +
+		50 + /* supported rates */
+		sizeof(IEEEtypes_ExtCap_t) + /* ext capab */
+		3 + /* Qos Info */
+		sizeof(IEEEtypes_WmmParameter_t) + /*wmm ie*/
+		sizeof(IEEEtypes_HTCap_t) + sizeof(IEEEtypes_2040BSSCo_t) +
+		sizeof(IEEEtypes_HTInfo_t) + sizeof(IEEEtypes_VHTCap_t) +
+		sizeof(IEEEtypes_VHTOprat_t) + sizeof(IEEEtypes_AID_t) +
+		extra_ies_len + sizeof(IEEEtypes_tdls_linkie));
+	if (!skb)
+		return -ENOMEM;
+
+	skb_reserve(skb, MLAN_MIN_DATA_HEADER_LEN + sizeof(mlan_buffer) +
+				 priv->extra_tx_head_len);
+
+	woal_construct_tdls_data_frame(priv, peer, action_code, dialog_token,
+				       status_code, skb);
+
+	if (extra_ies_len)
+		moal_memcpy_ext(priv->phandle, skb_put(skb, extra_ies_len),
+				extra_ies, extra_ies_len, extra_ies_len);
+
+	/* the TDLS link IE is always added last */
+	switch (action_code) {
+	case WLAN_TDLS_SETUP_REQUEST:
+	case WLAN_TDLS_SETUP_CONFIRM:
+	case WLAN_TDLS_TEARDOWN:
+	case WLAN_TDLS_DISCOVERY_REQUEST:
+		/* we are the initiator */
+		woal_tdls_add_link_ie(priv, skb, priv->current_addr, peer,
+				      priv->cfg_bssid);
+		break;
+	case WLAN_TDLS_SETUP_RESPONSE:
+		/* we are the responder */
+		woal_tdls_add_link_ie(priv, skb, peer, priv->current_addr,
+				      priv->cfg_bssid);
+		break;
+	default:
+		ret = -ENOTSUPP;
+		goto fail;
+	}
+
+	/*
+	 * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
+	 * we should default to AC_VI.
+	 */
+	switch (action_code) {
+	case WLAN_TDLS_SETUP_REQUEST:
+	case WLAN_TDLS_SETUP_RESPONSE:
+		skb_set_queue_mapping(skb, WMM_AC_BK);
+		skb->priority = 2;
+		break;
+	default:
+		skb_set_queue_mapping(skb, WMM_AC_VI);
+		skb->priority = 5;
+		break;
+	}
+
+	pmbuf = (mlan_buffer *)skb->head;
+	memset((t_u8 *)pmbuf, 0, sizeof(mlan_buffer));
+	pmbuf->bss_index = priv->bss_index;
+	pmbuf->pdesc = skb;
+	pmbuf->pbuf = skb->head + sizeof(mlan_buffer);
+
+	pmbuf->data_offset = skb->data - (skb->head + sizeof(mlan_buffer));
+	pmbuf->data_len = skb->len;
+	pmbuf->priority = skb->priority;
+	pmbuf->buf_type = MLAN_BUF_TYPE_DATA;
+
+	DBG_HEXDUMP(MDAT_D, "TDLS data:", pmbuf->pbuf + pmbuf->data_offset,
+		    pmbuf->data_len);
+
+	status = mlan_send_packet(priv->phandle->pmlan_adapter, pmbuf);
+
+	switch (status) {
+	case MLAN_STATUS_PENDING:
+		atomic_inc(&priv->phandle->tx_pending);
+#if CFG80211_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
+		index = skb_get_queue_mapping(skb);
+		atomic_inc(&priv->wmm_tx_pending[index]);
+#endif
+		queue_work(priv->phandle->workqueue, &priv->phandle->main_work);
+		/*delay 10 ms to guarantee the teardown/confirm frame can be
+		 * sent out before disalbe/enable tdls link if we don't delay
+		 * and return immediately, wpa_supplicant will call
+		 * disalbe/enable tdls link this may cause tdls link
+		 * disabled/enabled before teardown/confirm frame sent out */
+		if (action_code == WLAN_TDLS_TEARDOWN ||
+		    action_code == WLAN_TDLS_SETUP_CONFIRM)
+			woal_sched_timeout(10);
+		break;
+	case MLAN_STATUS_SUCCESS:
+		dev_kfree_skb(skb);
+		break;
+	case MLAN_STATUS_FAILURE:
+	default:
+		dev_kfree_skb(skb);
+		ret = -ENOTSUPP;
+		break;
+	}
+
+	LEAVE();
+	return ret;
+fail:
+	dev_kfree_skb(skb);
+	return ret;
+}
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+/**
+ * @brief Tx TDLS packet
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param peer                  A pointer to peer mac
+ * @param action_code           tdls action code
+ * @param dialog_token          dialog_token
+ * @param status_code           status_code
+ * @param peer_capability       peer capability
+ * @param initiator             initiator
+ * @param extra_ies              A pointer to extra ie buffer
+ * @param extra_ies_len          etra ie len
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+int woal_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+			    const t_u8 *peer, u8 action_code, t_u8 dialog_token,
+			    t_u16 status_code, t_u32 peer_capability,
+			    bool initiator, const t_u8 *extra_ies,
+			    size_t extra_ies_len)
+#else
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+/**
+ * @brief Tx TDLS packet
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param peer                  A pointer to peer mac
+ * @param action_code           tdls action code
+ * @param dialog_token          dialog_token
+ * @param status_code           status_code
+ * @param peer_capability       peer capability
+ * @param extra_ies              A pointer to extra ie buffer
+ * @param extra_ies_len          etra ie len
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+int woal_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)
+			    const t_u8 *peer,
+#else
+			    t_u8 *peer,
+#endif
+			    u8 action_code, t_u8 dialog_token,
+			    t_u16 status_code, t_u32 peer_capability,
+			    const t_u8 *extra_ies, size_t extra_ies_len)
+#else
+/**
+ * @brief Tx TDLS packet
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param peer                  A pointer to peer mac
+ * @param action_code           tdls action code
+ * @param dialog_token          dialog_token
+ * @param status_code           status_code
+ * @param extra_ies              A pointer to extra ie buffer
+ * @param extra_ies_len          etra ie len
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+int woal_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+			    t_u8 *peer, u8 action_code, t_u8 dialog_token,
+			    t_u16 status_code, const t_u8 *extra_ies,
+			    size_t extra_ies_len)
+#endif
+#endif
+{
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	int ret = 0;
+	mlan_bss_info bss_info;
+
+	ENTER();
+
+	if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) {
+		LEAVE();
+		return -ENOTSUPP;
+	}
+	/* make sure we are not in uAP mode and Go mode */
+	if (priv->bss_type != MLAN_BSS_TYPE_STA) {
+		LEAVE();
+		return -ENOTSUPP;
+	}
+
+	/* check if AP prohited TDLS */
+	memset(&bss_info, 0, sizeof(bss_info));
+	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (IS_EXTCAP_TDLS_PROHIBITED(bss_info.ext_cap)) {
+		PRINTM(MMSG, "TDLS is prohibited by AP\n");
+		LEAVE();
+		return -ENOTSUPP;
+	}
+
+	switch (action_code) {
+	case TDLS_SETUP_REQUEST:
+		woal_add_tdls_peer(priv, (t_u8 *)peer);
+		PRINTM(MMSG,
+		       "wlan: Send TDLS Setup Request to " MACSTR
+		       " status_code=%d\n",
+		       MAC2STR(peer), status_code);
+		ret = woal_send_tdls_data_frame(wiphy, dev, (t_u8 *)peer,
+						action_code, dialog_token,
+						status_code, extra_ies,
+						extra_ies_len);
+		break;
+	case TDLS_SETUP_RESPONSE:
+		PRINTM(MMSG,
+		       "wlan: Send TDLS Setup Response to " MACSTR
+		       " status_code=%d\n",
+		       MAC2STR(peer), status_code);
+		ret = woal_send_tdls_data_frame(wiphy, dev, (t_u8 *)peer,
+						action_code, dialog_token,
+						status_code, extra_ies,
+						extra_ies_len);
+		break;
+	case TDLS_SETUP_CONFIRM:
+		PRINTM(MMSG,
+		       "wlan: Send TDLS Confirm to " MACSTR " status_code=%d\n",
+		       MAC2STR(peer), status_code);
+		ret = woal_send_tdls_data_frame(wiphy, dev, (t_u8 *)peer,
+						action_code, dialog_token,
+						status_code, extra_ies,
+						extra_ies_len);
+		break;
+	case TDLS_TEARDOWN:
+		PRINTM(MMSG, "wlan: Send TDLS Tear down to " MACSTR "\n",
+		       MAC2STR(peer));
+		ret = woal_send_tdls_data_frame(wiphy, dev, (t_u8 *)peer,
+						action_code, dialog_token,
+						status_code, extra_ies,
+						extra_ies_len);
+		break;
+	case TDLS_DISCOVERY_REQUEST:
+		PRINTM(MMSG,
+		       "wlan: Send TDLS Discovery Request to " MACSTR "\n",
+		       MAC2STR(peer));
+		ret = woal_send_tdls_data_frame(wiphy, dev, (t_u8 *)peer,
+						action_code, dialog_token,
+						status_code, extra_ies,
+						extra_ies_len);
+		break;
+	case TDLS_DISCOVERY_RESPONSE:
+		PRINTM(MMSG,
+		       "wlan: Send TDLS Discovery Response to " MACSTR "\n",
+		       MAC2STR(peer));
+		ret = woal_send_tdls_action_frame(wiphy, dev, (t_u8 *)peer,
+						  action_code, dialog_token,
+						  status_code, extra_ies,
+						  extra_ies_len);
+		break;
+	default:
+		break;
+	}
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief cfg80211_tdls_oper handler
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param peer                  tdls peer mac
+ * @param oper                  tdls operation code
+ *
+ * @return                  	0 -- success, otherwise fail
+ */
+int woal_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)
+			    const u8 *peer,
+#else
+			    u8 *peer,
+#endif
+			    enum nl80211_tdls_operation oper)
+{
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	t_u8 action;
+	int ret = 0;
+	t_u8 event_buf[32];
+	int custom_len = 0;
+
+	ENTER();
+
+	if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
+		return -ENOTSUPP;
+
+	if (!(wiphy->flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
+		return -ENOTSUPP;
+	/* make sure we are in managed mode, and associated */
+	if (priv->bss_type != MLAN_BSS_TYPE_STA)
+		return -ENOTSUPP;
+
+	PRINTM(MIOCTL, "wlan: TDLS peer=" MACSTR ", oper=%d\n", MAC2STR(peer),
+	       oper);
+	switch (oper) {
+	case NL80211_TDLS_ENABLE_LINK:
+		/*Configure TDLS link first*/
+		woal_tdls_oper(priv, (u8 *)peer, WLAN_TDLS_CONFIG_LINK);
+		woal_updata_peer_status(priv, (t_u8 *)peer,
+					TDLS_SETUP_COMPLETE);
+		PRINTM(MMSG, "wlan: TDLS_ENABLE_LINK: peer=" MACSTR "\n",
+		       MAC2STR(peer));
+		action = WLAN_TDLS_ENABLE_LINK;
+		memset(event_buf, 0, sizeof(event_buf));
+		custom_len = strlen(CUS_EVT_TDLS_CONNECTED);
+		moal_memcpy_ext(priv->phandle, event_buf,
+				CUS_EVT_TDLS_CONNECTED, custom_len,
+				sizeof(event_buf));
+		moal_memcpy_ext(priv->phandle, event_buf + custom_len, peer,
+				ETH_ALEN, sizeof(event_buf) - custom_len);
+		woal_broadcast_event(priv, event_buf, custom_len + ETH_ALEN);
+		break;
+	case NL80211_TDLS_DISABLE_LINK:
+		woal_updata_peer_status(priv, (t_u8 *)peer, TDLS_NOT_SETUP);
+		PRINTM(MMSG, "wlan: TDLS_DISABLE_LINK: peer=" MACSTR "\n",
+		       MAC2STR(peer));
+		action = WLAN_TDLS_DISABLE_LINK;
+		memset(event_buf, 0, sizeof(event_buf));
+		custom_len = strlen(CUS_EVT_TDLS_TEARDOWN);
+		moal_memcpy_ext(priv->phandle, event_buf, CUS_EVT_TDLS_TEARDOWN,
+				custom_len, sizeof(event_buf));
+		moal_memcpy_ext(priv->phandle, event_buf + custom_len, peer,
+				ETH_ALEN, sizeof(event_buf) - custom_len);
+		woal_broadcast_event(priv, event_buf, custom_len + ETH_ALEN);
+		break;
+	case NL80211_TDLS_TEARDOWN:
+	case NL80211_TDLS_SETUP:
+	case NL80211_TDLS_DISCOVERY_REQ:
+		return 0;
+
+	default:
+		return -ENOTSUPP;
+	}
+	ret = woal_tdls_oper(priv, (u8 *)peer, action);
+
+	LEAVE();
+	return ret;
+}
+
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+/**
+ * @brief tdls channel switch
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param addr                  A pointer to peer addr
+ * @param oper_class            The operating class
+ * @param chandef               A pointer to cfg80211_chan_def structure
+ *
+ * @return                      0 -- success, otherwise fail
+ */
+static int woal_cfg80211_tdls_channel_switch(struct wiphy *wiphy,
+					     struct net_device *dev,
+					     const u8 *addr, u8 oper_class,
+					     struct cfg80211_chan_def *chandef)
+{
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_ds_misc_tdls_config *tdls_data = NULL;
+	tdls_all_config *tdls_all_cfg = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	mlan_bss_info bss_info;
+
+	ENTER();
+
+	/* check if AP prohited TDLS channel switch */
+	memset(&bss_info, 0, sizeof(bss_info));
+	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (IS_EXTCAP_TDLS_CHLSWITCHPROHIB(bss_info.ext_cap)) {
+		PRINTM(MMSG, "TDLS Channel Switching is prohibited by AP\n");
+		LEAVE();
+		return -ENOTSUPP;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_TDLS_OPER;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	ioctl_req->action = MLAN_ACT_SET;
+
+	tdls_data = &misc->param.tdls_config;
+	tdls_data->tdls_action = WLAN_TDLS_INIT_CHAN_SWITCH;
+
+	tdls_all_cfg = (tdls_all_config *)tdls_data->tdls_data;
+	moal_memcpy_ext(priv->phandle,
+			tdls_all_cfg->u.tdls_chan_switch.peer_mac_addr, addr,
+			ETH_ALEN,
+			sizeof(tdls_all_cfg->u.tdls_chan_switch.peer_mac_addr));
+	tdls_all_cfg->u.tdls_chan_switch.primary_channel =
+		chandef->chan->hw_value;
+	tdls_all_cfg->u.tdls_chan_switch.band = chandef->chan->band;
+	tdls_all_cfg->u.tdls_chan_switch.regulatory_class = oper_class;
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "TDLS channel switch request failed.\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief tdls cancel channel switch
+ *
+ * @param wiphy                 A pointer to wiphy structure
+ * @param dev                   A pointer to net_device structure
+ * @param addr                  A pointer to peer addr
+ *
+ */
+void woal_cfg80211_tdls_cancel_channel_switch(struct wiphy *wiphy,
+					      struct net_device *dev,
+					      const u8 *addr)
+{
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_ds_misc_tdls_config *tdls_data = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		status = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		status = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_TDLS_CONFIG;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	ioctl_req->action = MLAN_ACT_SET;
+
+	tdls_data = &misc->param.tdls_config;
+	tdls_data->tdls_action = WLAN_TDLS_STOP_CHAN_SWITCH;
+	moal_memcpy_ext(priv->phandle, tdls_data->tdls_data, addr, ETH_ALEN,
+			sizeof(tdls_data->tdls_data));
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS)
+		goto done;
+
+	PRINTM(MIOCTL, "Tdls channel switch stop!\n");
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+}
+#endif
+#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 /**
  * @brief change station info
@@ -6422,6 +7937,18 @@ static int woal_cfg80211_add_station(struct wiphy *wiphy,
 	}
 #endif
 #endif
+	if (!(params->sta_flags_set & MBIT(NL80211_STA_FLAG_TDLS_PEER)))
+		goto done;
+	/* make sure we are in connected mode */
+	if ((priv->bss_type != MLAN_BSS_TYPE_STA) ||
+	    (priv->media_connected == MFALSE)) {
+		ret = -ENOTSUPP;
+		goto done;
+	}
+	PRINTM(MMSG, "wlan: TDLS add peer station, address =" MACSTR "\n",
+	       MAC2STR(mac));
+	ret = woal_tdls_oper(priv, (u8 *)mac, WLAN_TDLS_CREATE_LINK);
+done:
 	LEAVE();
 	return ret;
 }
@@ -6665,6 +8192,7 @@ void woal_clear_conn_params(moal_private *priv)
 		kfree(priv->sme_current.ie);
 	memset(&priv->sme_current, 0, sizeof(struct cfg80211_connect_params));
 	priv->roaming_required = MFALSE;
+	priv->assoc_bss = NULL;
 	LEAVE();
 }
 
@@ -6674,7 +8202,8 @@ void woal_clear_conn_params(moal_private *priv)
  * @param priv            A pointer to moal_private
  * @param entry           A pointer to pmksa_entry
  **/
-int woal_update_okc_roaming_ie(moal_private *priv, struct pmksa_entry *entry)
+static int woal_update_okc_roaming_ie(moal_private *priv,
+				      struct pmksa_entry *entry)
 {
 	struct cfg80211_connect_params *sme = &priv->sme_current;
 	int ret = MLAN_STATUS_SUCCESS;
@@ -7353,15 +8882,16 @@ mlan_status woal_register_sta_cfg80211(struct net_device *dev, t_u8 bss_type)
  * @brief Initialize the wiphy
  *
  * @param priv            A pointer to moal_private structure
+ * @param wiphy 		  A pointer to structure wiphy
  * @param wait_option     Wait option
- *
  * @return                MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_cfg80211_init_wiphy(moal_private *priv, t_u8 wait_option)
+static mlan_status woal_cfg80211_init_wiphy(moal_private *priv,
+					    struct wiphy *wiphy,
+					    t_u8 wait_option)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	int retry_count, rts_thr, frag_thr;
-	struct wiphy *wiphy = NULL;
 	mlan_ioctl_req *req = NULL;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
 	mlan_ds_radio_cfg *radio = NULL;
@@ -7374,7 +8904,6 @@ mlan_status woal_cfg80211_init_wiphy(moal_private *priv, t_u8 wait_option)
 	int mcs_supp = 0;
 
 	ENTER();
-	wiphy = priv->phandle->wiphy;
 	/* Get 11n tx parameters from MLAN */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11n_cfg));
 	if (req == NULL) {
@@ -7456,8 +8985,11 @@ mlan_status woal_cfg80211_init_wiphy(moal_private *priv, t_u8 wait_option)
 	ret = woal_request_ioctl(priv, req, wait_option);
 	if (ret != MLAN_STATUS_SUCCESS)
 		goto done;
-
 	/* Set available antennas to wiphy */
+	if (IS_CARD9098(priv->phandle->card_type) ||
+	    IS_CARD9097(priv->phandle->card_type)) {
+		woal_cfg80211_notify_antcfg(priv, wiphy, radio);
+	}
 	wiphy->available_antennas_tx = radio->param.ant_cfg.tx_antenna;
 	wiphy->available_antennas_rx = radio->param.ant_cfg.rx_antenna;
 #endif /* CFG80211_VERSION_CODE */
@@ -7538,7 +9070,7 @@ done:
  *
  * @return                N/A
  */
-void woal_update_channel_flag(struct wiphy *wiphy, mlan_fw_info *fw_info)
+static void woal_update_channel_flag(struct wiphy *wiphy, mlan_fw_info *fw_info)
 {
 	enum ieee80211_band band;
 	struct ieee80211_supported_band *sband;
@@ -7727,12 +9259,10 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 #endif
 		wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
 #endif
-#ifdef ANDROID_KERNEL
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (!moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
 #endif
 		wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
-#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(4, 12, 0)
 	wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
@@ -7750,6 +9280,17 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
 	wiphy->features |= NL80211_FEATURE_INACTIVITY_TIMER;
 #endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+	wiphy->flags |=
+		WIPHY_FLAG_SUPPORTS_TDLS | WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
+#endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+	wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
+#endif
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 6, 0)
+	if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
+		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_RRM);
+#endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME))
 		wiphy->features |= NL80211_FEATURE_SAE;
@@ -7842,6 +9383,7 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 		(t_u8 *)&priv->extended_capabilities;
 	wiphy->extended_capabilities_len = sizeof(priv->extended_capabilities);
 #endif
+	woal_cfg80211_init_wiphy(priv, wiphy, MOAL_IOCTL_WAIT);
 	if (wiphy_register(wiphy) < 0) {
 		PRINTM(MERROR, "Wiphy device registration failed!\n");
 		ret = MLAN_STATUS_FAILURE;
@@ -7850,7 +9392,8 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
 	if (fw_info.force_reg ||
-	    (fw_region && priv->phandle->params.txpwrlimit_cfg)) {
+	    (priv->phandle->params.txpwrlimit_cfg &&
+	     priv->phandle->params.cntry_txpwr == CNTRY_RGPOWER_MODE)) {
 		PRINTM(MCMND, "FW region_code=%d force_reg=%d\n",
 		       fw_info.region_code, fw_info.force_reg);
 		country = region_code_2_string(fw_info.region_code);
@@ -7892,8 +9435,6 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 		}
 	}
 	priv->phandle->wiphy = wiphy;
-	woal_cfg80211_init_wiphy(priv, MOAL_IOCTL_WAIT);
-
 	return ret;
 err_wiphy:
 	if (wiphy)
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.h b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.h
index e8fb514..193c64e 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.h
@@ -3,7 +3,7 @@
  * @brief This file contains the STA CFG80211 specific defines.
  *
  *
- * Copyright 2011-2020 NXP
+ * Copyright 2011-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -28,14 +28,4 @@
 
 mlan_status woal_register_sta_cfg80211(struct net_device *dev, t_u8 bss_type);
 
-mlan_status woal_cfg80211_set_key(moal_private *priv, t_u8 is_enable_wep,
-				  t_u32 cipher, const t_u8 *key, int key_len,
-				  const t_u8 *seq, int seq_len, t_u8 key_index,
-				  const t_u8 *addr, int disable,
-				  t_u8 wait_option);
-
-mlan_status woal_cfg80211_set_wep_keys(moal_private *priv, const t_u8 *key,
-				       int key_len, t_u8 index,
-				       t_u8 wait_option);
-
 #endif /* _MOAL_STA_CFG80211_H_ */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap.c b/mxm_wifiex/wlan_src/mlinux/moal_uap.c
index b91d29e..a9095b7 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap.c
@@ -4,7 +4,7 @@
  * driver.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -58,7 +58,7 @@ static int woal_uap_addba_param(struct net_device *dev, struct ifreq *req)
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
-	addba_param param;
+	uap_addba_param param;
 	int ret = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
@@ -137,7 +137,7 @@ static int woal_uap_aggr_priotbl(struct net_device *dev, struct ifreq *req)
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
-	aggr_prio_tbl param;
+	uap_aggr_prio_tbl param;
 	int ret = 0;
 	int i = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
@@ -281,7 +281,7 @@ done:
 static int woal_uap_get_fw_info(struct net_device *dev, struct ifreq *req)
 {
 	moal_private *priv = (moal_private *)netdev_priv(dev);
-	fw_info fw;
+	uap_fw_info fw;
 	mlan_fw_info fw_info;
 	int ret = 0;
 
@@ -887,7 +887,7 @@ static int woal_uap_domain_info(struct net_device *dev, struct ifreq *req)
 			goto done;
 		}
 		tlv_data_len = ((t_u16 *)(tlv))[1];
-		if ((TLV_HEADER_LEN + tlv_data_len) > sizeof(tlv)) {
+		if ((TLV_HEADER_LEN + tlv_data_len) > (int)sizeof(tlv)) {
 			PRINTM(MERROR, "TLV buffer is overflowed");
 			ret = -EINVAL;
 			goto done;
@@ -1002,7 +1002,7 @@ static int woal_uap_dfs_testing(struct net_device *dev, struct ifreq *req)
 		/* Set mib value to MLAN */
 		ioctl_req->action = MLAN_ACT_SET;
 		cfg11h->param.dfs_testing.usr_cac_period_msec =
-			param.usr_cac_period;
+			param.usr_cac_period * 1000;
 		cfg11h->param.dfs_testing.usr_nop_period_sec =
 			param.usr_nop_period;
 		cfg11h->param.dfs_testing.usr_no_chan_change =
@@ -1011,8 +1011,7 @@ static int woal_uap_dfs_testing(struct net_device *dev, struct ifreq *req)
 			param.fixed_new_chan;
 		cfg11h->param.dfs_testing.usr_cac_restart = param.cac_restart;
 		priv->phandle->cac_restart = param.cac_restart;
-		priv->phandle->cac_period_jiffies =
-			param.usr_cac_period * HZ / 1000;
+		priv->phandle->cac_period_jiffies = param.usr_cac_period * HZ;
 		priv->user_cac_period_msec =
 			cfg11h->param.dfs_testing.usr_cac_period_msec;
 	}
@@ -1024,7 +1023,7 @@ static int woal_uap_dfs_testing(struct net_device *dev, struct ifreq *req)
 
 	if (!param.action) { /* GET */
 		param.usr_cac_period =
-			cfg11h->param.dfs_testing.usr_cac_period_msec;
+			cfg11h->param.dfs_testing.usr_cac_period_msec / 1000;
 		param.usr_nop_period =
 			cfg11h->param.dfs_testing.usr_nop_period_sec;
 		param.no_chan_change =
@@ -1883,6 +1882,15 @@ static int woal_uap_antenna_cfg(struct net_device *dev, struct ifreq *req)
 		mreq->action = MLAN_ACT_SET;
 		radio->param.ant_cfg.tx_antenna = antenna_config.tx_mode;
 		radio->param.ant_cfg.rx_antenna = antenna_config.rx_mode;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		if (IS_CARD9098(priv->phandle->card_type) ||
+		    IS_CARD9097(priv->phandle->card_type)) {
+			if (IS_STA_CFG80211(
+				    priv->phandle->params.cfg80211_wext))
+				woal_cfg80211_notify_antcfg(
+					priv, priv->phandle->wiphy, radio);
+		}
+#endif
 	}
 
 	status = woal_request_ioctl(priv, mreq, MOAL_IOCTL_WAIT);
@@ -3204,9 +3212,9 @@ done:
  *
  *  @return         MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_uap_get_bss_param(moal_private *priv,
-				   mlan_uap_bss_param *sys_cfg,
-				   t_u8 wait_option)
+static mlan_status woal_uap_get_bss_param(moal_private *priv,
+					  mlan_uap_bss_param *sys_cfg,
+					  t_u8 wait_option)
 {
 	mlan_ds_bss *info = NULL;
 	mlan_ioctl_req *req = NULL;
@@ -3556,8 +3564,8 @@ done:
  *
  *  @return         0 --success, otherwise fail
  */
-int woal_uap_ap_cfg_parse_data(moal_private *priv, mlan_uap_bss_param *ap_cfg,
-			       char *buf)
+static int woal_uap_ap_cfg_parse_data(moal_private *priv,
+				      mlan_uap_bss_param *ap_cfg, char *buf)
 {
 	int ret = 0, atoi_ret;
 	int set_sec = 0, set_key = 0, set_chan = 0;
@@ -3875,8 +3883,9 @@ done:
  *
  *  @return                 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_set_get_ap_scan_channels(moal_private *priv, t_u16 action,
-					  mlan_uap_scan_channels *scan_channels)
+static mlan_status
+woal_set_get_ap_scan_channels(moal_private *priv, t_u16 action,
+			      mlan_uap_scan_channels *scan_channels)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_bss *bss = NULL;
@@ -3971,7 +3980,7 @@ done:
  *
  *  @return                 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_start_acs_scan(moal_private *priv)
+static mlan_status woal_start_acs_scan(moal_private *priv)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_bss *bss = NULL;
@@ -4014,7 +4023,7 @@ done:
  *
  *  @return                 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_do_acs_check(moal_private *priv)
+static mlan_status woal_do_acs_check(moal_private *priv)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_uap_bss_param *sys_config = NULL;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap.h b/mxm_wifiex/wlan_src/mlinux/moal_uap.h
index 7e6d31a..006db2e 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap.h
@@ -298,7 +298,7 @@ typedef struct _ds_hs_cfg {
 #define UAP_GET_BSS_TYPE (SIOCDEVPRIVATE + 15)
 
 /** addba_param */
-typedef struct _addba_param {
+typedef struct _uap_addba_param {
 	/** subcmd */
 	t_u32 subcmd;
 	/** Set/Get */
@@ -313,10 +313,10 @@ typedef struct _addba_param {
 	t_u8 txamsdu;
 	/** amsdu for ADDBA response */
 	t_u8 rxamsdu;
-} addba_param;
+} uap_addba_param;
 
 /** aggr_prio_tbl */
-typedef struct _aggr_prio_tbl {
+typedef struct _uap_aggr_prio_tbl {
 	/** subcmd */
 	t_u32 subcmd;
 	/** Set/Get */
@@ -325,7 +325,7 @@ typedef struct _aggr_prio_tbl {
 	t_u8 ampdu[MAX_NUM_TID];
 	/** amsdu priority table */
 	t_u8 amsdu[MAX_NUM_TID];
-} aggr_prio_tbl;
+} uap_aggr_prio_tbl;
 
 /** addba_reject parameters */
 typedef struct _addba_reject_para {
@@ -338,7 +338,7 @@ typedef struct _addba_reject_para {
 } addba_reject_para;
 
 /** fw_info */
-typedef struct _fw_info {
+typedef struct _uap_fw_info {
 	/** subcmd */
 	t_u32 subcmd;
 	/** Get */
@@ -353,7 +353,7 @@ typedef struct _fw_info {
 	t_u16 region_code;
 	/** 802.11n device capabilities */
 	t_u32 hw_dot_11n_dev_cap;
-} fw_info;
+} uap_fw_info;
 
 typedef struct _ht_tx_cfg_para_hdr {
 	/** Sub command */
@@ -541,7 +541,7 @@ int woal_uap_get_channel_nop_info(moal_private *priv, t_u8 wait_option,
 #endif
 mlan_status woal_set_get_ap_channel(moal_private *priv, t_u16 action,
 				    t_u8 wait_option,
-				    pchan_band_info uap_channel);
+				    chan_band_info *uap_channel);
 #ifdef CONFIG_PROC_FS
 void woal_uap_get_version(moal_private *priv, char *version, int max_len);
 #endif
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
index b9d49f7..3b2bb4e 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
@@ -3,7 +3,7 @@
  * @brief This file contains the functions for uAP CFG80211.
  *
  *
- * Copyright 2011-2020 NXP
+ * Copyright 2011-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -154,7 +154,7 @@ static t_u8 woal_check_rsn_ie(IEEEtypes_Rsn_t *rsn_ie,
 	int i = 0;
 	wpa_suite_auth_key_mgmt_t *key_mgmt = NULL;
 	left = rsn_ie->len + 2;
-	if (left < sizeof(IEEEtypes_Rsn_t))
+	if (left < (int)sizeof(IEEEtypes_Rsn_t))
 		return MFALSE;
 	sys_config->wpa_cfg.group_cipher = 0;
 	sys_config->wpa_cfg.pairwise_cipher_wpa2 = 0;
@@ -185,15 +185,15 @@ static t_u8 woal_check_rsn_ie(IEEEtypes_Rsn_t *rsn_ie,
 		}
 	}
 	left -= sizeof(IEEEtypes_Rsn_t) + (count - 1) * sizeof(wpa_suite);
-	if (left < sizeof(wpa_suite_auth_key_mgmt_t))
+	if (left < (int)sizeof(wpa_suite_auth_key_mgmt_t))
 		return MFALSE;
 	key_mgmt =
 		(wpa_suite_auth_key_mgmt_t *)((u8 *)rsn_ie +
 					      sizeof(IEEEtypes_Rsn_t) +
 					      (count - 1) * sizeof(wpa_suite));
 	count = le16_to_cpu(key_mgmt->count);
-	if (left < (sizeof(wpa_suite_auth_key_mgmt_t) +
-		    (count - 1) * sizeof(wpa_suite)))
+	if (left < (int)(sizeof(wpa_suite_auth_key_mgmt_t) +
+			 (count - 1) * sizeof(wpa_suite)))
 		return MFALSE;
 	for (i = 0; i < count; i++) {
 		switch (key_mgmt->list[i].type) {
@@ -233,7 +233,7 @@ static t_u8 woal_check_wpa_ie(IEEEtypes_Wpa_t *wpa_ie,
 	int i = 0;
 	wpa_suite_auth_key_mgmt_t *key_mgmt = NULL;
 	left = wpa_ie->len + 2;
-	if (left < sizeof(IEEEtypes_Wpa_t))
+	if (left < (int)sizeof(IEEEtypes_Wpa_t))
 		return MFALSE;
 	sys_config->wpa_cfg.group_cipher = 0;
 	sys_config->wpa_cfg.pairwise_cipher_wpa = 0;
@@ -262,15 +262,15 @@ static t_u8 woal_check_wpa_ie(IEEEtypes_Wpa_t *wpa_ie,
 		}
 	}
 	left -= sizeof(IEEEtypes_Wpa_t) + (count - 1) * sizeof(wpa_suite);
-	if (left < sizeof(wpa_suite_auth_key_mgmt_t))
+	if (left < (int)sizeof(wpa_suite_auth_key_mgmt_t))
 		return MFALSE;
 	key_mgmt =
 		(wpa_suite_auth_key_mgmt_t *)((u8 *)wpa_ie +
 					      sizeof(IEEEtypes_Wpa_t) +
 					      (count - 1) * sizeof(wpa_suite));
 	count = le16_to_cpu(key_mgmt->count);
-	if (left < (sizeof(wpa_suite_auth_key_mgmt_t) +
-		    (count - 1) * sizeof(wpa_suite)))
+	if (left < (int)(sizeof(wpa_suite_auth_key_mgmt_t) +
+			 (count - 1) * sizeof(wpa_suite)))
 		return MFALSE;
 	for (i = 0; i < count; i++) {
 		switch (key_mgmt->list[i].type) {
@@ -426,8 +426,8 @@ static t_void woal_set_wmm_ies(moal_private *priv, const t_u8 *ie, int len,
  * @param params          A pointer to cfg80211_ap_settings structure
  * @return                0 -- success, otherwise fail
  */
-t_u8 woal_check_11ac_capability(moal_private *priv, t_u8 band,
-				struct cfg80211_ap_settings *params)
+static t_u8 woal_check_11ac_capability(moal_private *priv, t_u8 band,
+				       struct cfg80211_ap_settings *params)
 #else
 /**
  * @brief initialize AP or GO bss config
@@ -435,7 +435,7 @@ t_u8 woal_check_11ac_capability(moal_private *priv, t_u8 band,
  * @param priv            A pointer to moal private structure
  * @return                0 -- success, otherwise fail
  */
-t_u8 woal_check_11ac_capability(moal_private *priv, t_u8 band)
+static t_u8 woal_check_11ac_capability(moal_private *priv, t_u8 band)
 #endif
 {
 	mlan_fw_info fw_info;
@@ -478,8 +478,8 @@ t_u8 woal_check_11ac_capability(moal_private *priv, t_u8 band)
  * @param params          A pointer to cfg80211_ap_settings structure
  * @return                0 -- success, otherwise fail
  */
-t_u8 woal_check_11ax_capability(moal_private *priv, t_u8 band,
-				struct cfg80211_ap_settings *params)
+static t_u8 woal_check_11ax_capability(moal_private *priv, t_u8 band,
+				       struct cfg80211_ap_settings *params)
 {
 	mlan_fw_info fw_info;
 	t_u8 enable_11ax = MFALSE;
@@ -1338,9 +1338,10 @@ static void woal_virt_if_setup(struct net_device *dev)
  *
  *  @return                 A pointer to the new priv structure
  */
-moal_private *woal_alloc_virt_interface(moal_handle *handle, t_u8 bss_index,
-					unsigned char name_assign_type,
-					t_u8 bss_type, const char *name)
+static moal_private *woal_alloc_virt_interface(moal_handle *handle,
+					       t_u8 bss_index,
+					       unsigned char name_assign_type,
+					       t_u8 bss_type, const char *name)
 #else
 /**
  * @brief This function adds a new interface. It will
@@ -1441,11 +1442,11 @@ error:
  *
  * @return                  0 -- success, otherwise fail
  */
-int woal_cfg80211_add_virt_if(struct wiphy *wiphy, const char *name,
-			      unsigned char name_assign_type,
-			      enum nl80211_iftype type, u32 *flags,
-			      struct vif_params *params,
-			      struct net_device **new_dev)
+static int woal_cfg80211_add_virt_if(struct wiphy *wiphy, const char *name,
+				     unsigned char name_assign_type,
+				     enum nl80211_iftype type, u32 *flags,
+				     struct vif_params *params,
+				     struct net_device **new_dev)
 #else
 /**
  * @brief Request the driver to add a virtual interface
@@ -1587,7 +1588,7 @@ done:
  *  @return              MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
  * otherwise fail
  */
-mlan_status woal_bss_remove(moal_private *priv)
+static mlan_status woal_bss_remove(moal_private *priv)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_bss *bss = NULL;
@@ -2339,12 +2340,12 @@ int woal_cfg80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 #endif
 	/* if the bss is still running, then stop it */
 	if (priv->bss_started == MTRUE) {
-		if (MLAN_STATUS_FAILURE ==
+		if ((int)MLAN_STATUS_FAILURE ==
 		    woal_uap_bss_ctrl(priv, MOAL_NO_WAIT, UAP_BSS_STOP)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		if (MLAN_STATUS_FAILURE ==
+		if ((int)MLAN_STATUS_FAILURE ==
 		    woal_uap_bss_ctrl(priv, MOAL_NO_WAIT, UAP_BSS_RESET)) {
 			ret = -EFAULT;
 			goto done;
@@ -2911,7 +2912,7 @@ void woal_cac_timer_func(void *context)
  *
  * @return           N/A
  */
-void woal_switch_uap_channel(moal_private *priv, t_u8 wait_option)
+static void woal_switch_uap_channel(moal_private *priv, t_u8 wait_option)
 {
 	chan_band_info uap_channel;
 	t_u8 chan2Offset = SEC_CHAN_NONE;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.c
index f2f2564..e2da631 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_priv.c
@@ -3,7 +3,7 @@
  * @brief This file contains standard ioctl functions
  *
  *
- * Copyright 2010-2020 NXP
+ * Copyright 2010-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -102,8 +102,9 @@ int woal_uap_do_priv_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
 		case WOAL_WL_FW_RELOAD:
 			break;
 		case WOAL_AP_SET_CFG:
-			ret = woal_uap_set_ap_cfg(priv, wrq->u.data.pointer,
-						  wrq->u.data.length);
+			ret = woal_uap_set_ap_cfg(
+				priv, (t_u8 __force *)wrq->u.data.pointer,
+				wrq->u.data.length);
 			break;
 		default:
 			ret = -EINVAL;
@@ -141,7 +142,8 @@ int woal_uap_do_priv_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
 	case WOAL_UAP_FROYO_WL_FW_RELOAD:
 		break;
 	case WOAL_UAP_FROYO_AP_SET_CFG:
-		ret = woal_uap_set_ap_cfg(priv, wrq->u.data.pointer,
+		ret = woal_uap_set_ap_cfg(priv,
+					  (t_u8 __force *)wrq->u.data.pointer,
 					  wrq->u.data.length);
 		break;
 	default:
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
index 9aa369a..9ebfaa0 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
@@ -3,7 +3,7 @@
  * @brief This file contains wireless extension standard ioctl functions
  *
  *
- * Copyright 2010-2020 NXP
+ * Copyright 2010-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -42,7 +42,7 @@ typedef struct _chan_to_freq_t {
 	t_u8 band;
 } chan_to_freq_t;
 
-const chan_to_freq_t chan_to_freq[] = {
+static const chan_to_freq_t chan_to_freq[] = {
 	{1, 2412, 0},	{2, 2417, 0},	{3, 2422, 0},	{4, 2427, 0},
 	{5, 2432, 0},	{6, 2437, 0},	{7, 2442, 0},	{8, 2447, 0},
 	{9, 2452, 0},	{10, 2457, 0},	{11, 2462, 0},	{12, 2467, 0},
@@ -107,7 +107,7 @@ static int channel_to_frequency(t_u16 channel, t_u8 band)
 	int i = 0;
 
 	ENTER();
-	for (i = 0; i < ARRAY_SIZE(chan_to_freq); i++) {
+	for (i = 0; i < (int)ARRAY_SIZE(chan_to_freq); i++) {
 		if (channel == chan_to_freq[i].channel &&
 		    band == chan_to_freq[i].band) {
 			LEAVE();
@@ -297,10 +297,10 @@ static int woal_set_freq(struct net_device *dev, struct iw_request_info *info,
 		ret = -EINVAL;
 		goto done;
 	}
-	for (i = 0; i < ap_cfg->num_of_chan; i++)
+	for (i = 0; i < (int)ap_cfg->num_of_chan; i++)
 		if (ap_cfg->chan_list[i].chan_number == chan)
 			break;
-	if (i == ap_cfg->num_of_chan) {
+	if (i == (int)ap_cfg->num_of_chan) {
 		PRINTM(MERROR, "Channel %d is not supported\n", chan);
 		ret = -EINVAL;
 		goto done;
@@ -1170,7 +1170,6 @@ done:
 static int woal_set_auth(struct net_device *dev, struct iw_request_info *info,
 			 union iwreq_data *wrqu, char *extra)
 {
-	int ret = 0;
 	moal_private *priv = (moal_private *)netdev_priv(dev);
 	struct iw_param *vwrq = &wrqu->param;
 	mlan_uap_bss_param *sys_cfg = NULL;
@@ -1325,7 +1324,6 @@ static int woal_set_auth(struct net_device *dev, struct iw_request_info *info,
 							   MOAL_IOCTL_WAIT,
 							   sys_cfg)) {
 		PRINTM(MERROR, "Error setting AP confiruration\n");
-		ret = -EFAULT;
 		goto done;
 	}
 
@@ -1816,14 +1814,14 @@ static const iw_handler woal_private_handler[] = {
 // clang-format off
 /** wlan_handler_def */
 struct iw_handler_def woal_uap_handler_def = {
-	num_standard: ARRAY_SIZE(woal_handler),
-	num_private : ARRAY_SIZE(woal_private_handler),
-	num_private_args : ARRAY_SIZE(woal_uap_priv_args),
-	standard : (iw_handler *)woal_handler,
-	private : (iw_handler *)woal_private_handler,
-	private_args : (struct iw_priv_args *)woal_uap_priv_args,
+	.num_standard = ARRAY_SIZE(woal_handler),
+	.num_private = ARRAY_SIZE(woal_private_handler),
+	.num_private_args = ARRAY_SIZE(woal_uap_priv_args),
+	.standard = (iw_handler *)woal_handler,
+	.private = (iw_handler *)woal_private_handler,
+	.private_args = (struct iw_priv_args *)woal_uap_priv_args,
 #if WIRELESS_EXT > 20
-	get_wireless_stats : woal_get_uap_wireless_stats,
+	.get_wireless_stats = woal_get_uap_wireless_stats,
 #endif
 };
 // clang-format on
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_usb.c b/mxm_wifiex/wlan_src/mlinux/moal_usb.c
index dcf6318..4c7f900 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.c
@@ -4,7 +4,7 @@
  * driver.
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -55,10 +55,10 @@ typedef struct {
 	USB_DEVICE(vid, pid), .driver_info = (t_ptr)name
 
 /** Name of the USB driver */
-const char usbdriver_name[] = "usbxxx";
+static const char usbdriver_name[] = "usbxxx";
 
 /** This structure contains the device signature */
-struct usb_device_id woal_usb_table[] = {
+static struct usb_device_id woal_usb_table[] = {
 /* Enter the device signature inside */
 #ifdef USB8897
 	{NXP_USB_DEVICE(USB8897_VID_1, USB8897_PID_1, "NXP WLAN USB Adapter")},
@@ -95,7 +95,7 @@ struct usb_device_id woal_usb_table[] = {
 };
 
 /** This structure contains the device signature */
-struct usb_device_id woal_usb_table_skip_fwdnld[] = {
+static struct usb_device_id woal_usb_table_skip_fwdnld[] = {
 /* Enter the device signature inside */
 #ifdef USB8897
 	{NXP_USB_DEVICE(USB8897_VID_1, USB8897_PID_2, "NXP WLAN USB Adapter")},
@@ -173,9 +173,6 @@ static moal_if_ops usb_ops;
 		Global Variables
 ********************************************************/
 
-extern int skip_fwdnld;
-extern int max_tx_buf;
-
 /********************************************************
 		Local Functions
 ********************************************************/
@@ -489,13 +486,14 @@ rx_ret:
  *
  *  @return 	   	 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
-mlan_status woal_check_chip_revision(moal_handle *handle, t_u32 *usb_chip_rev,
-				     t_u32 *usb_strap)
+static mlan_status woal_check_chip_revision(moal_handle *handle,
+					    t_u32 *usb_chip_rev,
+					    t_u32 *usb_strap)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_buffer mbuf;
-	t_u8 *tx_buff = 0;
-	t_u8 *recv_buff = 0;
+	t_u8 *tx_buff = NULL;
+	t_u8 *recv_buff = NULL;
 	usb_ack_pkt ack_pkt;
 	t_u32 extend_ver;
 	t_u8 tx_size = CHIP_REV_TX_BUF_SIZE;
@@ -1217,21 +1215,18 @@ static int woal_usb_resume(struct usb_interface *intf)
 	struct usb_card_rec *cardp = usb_get_intfdata(intf);
 	moal_handle *handle = NULL;
 	int i;
-	int ret = 0;
 
 	ENTER();
 
 	PRINTM(MCMND, "<--- Enter woal_usb_resume --->\n");
 	if (!cardp || !cardp->phandle) {
 		PRINTM(MERROR, "Card or adapter structure is not valid\n");
-		ret = 0;
 		goto done;
 	}
 	handle = cardp->phandle;
 
 	if (handle->is_suspended == MFALSE) {
 		PRINTM(MWARN, "Device already resumed\n");
-		ret = 0;
 		goto done;
 	}
 
@@ -1862,7 +1857,7 @@ void woal_submit_rx_urb(moal_handle *handle, t_u8 ep)
  *
  *  @return         N/A
  */
-void woal_usb_dump_fw_info(moal_handle *phandle)
+static void woal_usb_dump_fw_info(moal_handle *phandle)
 {
 	moal_private *priv = NULL;
 	mlan_ioctl_req *req = NULL;
@@ -1873,13 +1868,13 @@ void woal_usb_dump_fw_info(moal_handle *phandle)
 
 	priv = woal_get_priv(phandle, MLAN_BSS_ROLE_ANY);
 	if (!priv) {
-		PRINTM(MERROR, "woal_dump_firmware_info get priv is NULL!\n");
+		PRINTM(MERROR, "woal_usb_dump_fw_info: priv is NULL!\n");
 		goto done;
 	}
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (req == NULL) {
-		PRINTM(MERROR, "woal_dump_firmware_info alloc req fail!\n");
+		PRINTM(MERROR, "woal_usb_dump_fw_info: alloc req fail!\n");
 		goto done;
 	}
 
@@ -1917,6 +1912,7 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 		goto done;
 	if (cardp->boot_state == USB_FW_READY)
 		goto done;
+
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) || defined(USB8978)
 	ret = woal_check_chip_revision(handle, &revision_id, &strap);
 	if (ret != MLAN_STATUS_SUCCESS) {
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_usb.h b/mxm_wifiex/wlan_src/mlinux/moal_usb.h
index 03e8786..5a0b393 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.h
@@ -210,8 +210,8 @@ struct usb_card_rec {
 	int tx_data_ix;
 	/** Pre-allocated urb for data */
 	urb_context tx_data_list[MVUSB_TX_HIGH_WMARK];
-	usb_aggr_ctrl tx_aggr_ctrl;
-	usb_aggr_ctrl rx_deaggr_ctrl;
+	usb_aggr_ctrl_cfg tx_aggr_ctrl;
+	usb_aggr_ctrl_cfg rx_deaggr_ctrl;
 	t_u8 resubmit_urbs;
 	/** USB card type */
 	t_u16 card_type;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_wext.c b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
index 6c52e7f..67d5799 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
@@ -3,7 +3,7 @@
  * @brief This file contains wireless extension standard ioctl functions
  *
  *
- * Copyright 2008-2020 NXP
+ * Copyright 2008-2021 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -2248,7 +2248,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 	}
 	PRINTM(MIOCTL, "PRIV Command return: %s, length=%d\n", buf, len);
 	dwrq->length = (t_u16)len;
-	if (copy_to_user(dwrq->pointer, buf, dwrq->length))
+	if (copy_to_user((void __user *)dwrq->pointer, buf, dwrq->length))
 		ret = -EFAULT;
 done:
 	kfree(buf);
@@ -2265,8 +2265,8 @@ done:
  *
  *  @return                     MLAN_STATUS_SUCCESS -- success, otherwise fail
  */
-mlan_status woal_wext_request_scan(moal_private *priv, t_u8 wait_option,
-				   mlan_802_11_ssid *req_ssid)
+static mlan_status woal_wext_request_scan(moal_private *priv, t_u8 wait_option,
+					  mlan_802_11_ssid *req_ssid)
 {
 	wlan_user_scan_cfg scan_req;
 	mlan_scan_cfg scan_cfg;
@@ -3056,7 +3056,7 @@ void woal_send_iwevcustom_event(moal_private *priv, char *str)
 
 	snprintf(buf, sizeof(buf) - 1, "%s", str);
 
-	iwrq.data.pointer = buf;
+	iwrq.data.pointer = (t_u8 __user *)buf;
 	iwrq.data.length = strlen(buf) + 1;
 
 	/* Send Event to upper layer */
@@ -3090,7 +3090,7 @@ void woal_send_mic_error_event(moal_private *priv, t_u32 event)
 		mic.flags = IW_MICFAILURE_PAIRWISE;
 	else
 		mic.flags = IW_MICFAILURE_GROUP;
-	iwrq.data.pointer = &mic;
+	iwrq.data.pointer = (t_u8 __user *)&mic;
 	iwrq.data.length = sizeof(mic);
 
 	wireless_send_event(priv->netdev, IWEVMICHAELMICFAILURE, &iwrq,
@@ -3105,14 +3105,14 @@ void woal_send_mic_error_event(moal_private *priv, t_u32 event)
 #ifdef STA_SUPPORT
 /** wlan_handler_def */
 struct iw_handler_def woal_handler_def = {
-	num_standard: ARRAY_SIZE(woal_handler),
-	num_private : ARRAY_SIZE(woal_private_handler),
-	num_private_args : ARRAY_SIZE(woal_private_args),
-	standard : (iw_handler *)woal_handler,
-	private : (iw_handler *)woal_private_handler,
-	private_args : (struct iw_priv_args *)woal_private_args,
+	.num_standard = ARRAY_SIZE(woal_handler),
+	.num_private = ARRAY_SIZE(woal_private_handler),
+	.num_private_args = ARRAY_SIZE(woal_private_args),
+	.standard = (iw_handler *)woal_handler,
+	.private = (iw_handler *)woal_private_handler,
+	.private_args = (struct iw_priv_args *)woal_private_args,
 #if WIRELESS_EXT > 20
-	get_wireless_stats : woal_get_wireless_stats,
+	.get_wireless_stats = woal_get_wireless_stats,
 #endif
 };
 // clang-format on