diff --git a/mxm_wifiex/wlan_src/README b/mxm_wifiex/wlan_src/README
index bfc3767..ad858d2 100755
--- a/mxm_wifiex/wlan_src/README
+++ b/mxm_wifiex/wlan_src/README
@@ -9,7 +9,7 @@
 	Goto source code directory wlan_src/.
 	make [clean] build
 	The driver and utility binaries can be found in ../bin_xxxx directory.
-	The driver code supports Linux kernel from 2.6.32 to 6.4.7.
+	The driver code supports Linux kernel from 2.6.32 to 6.5.4.
 
 2) FOR DRIVER INSTALL
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11d.c b/mxm_wifiex/wlan_src/mlan/mlan_11d.c
index e1cc67a..9b9d917 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11d.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11d.c
@@ -954,9 +954,9 @@ mlan_status wlan_ret_802_11d_domain_info(mlan_private *pmpriv,
 	/* Dump domain info response data */
 	HEXDUMP("11D: DOMAIN Info Rsp Data", (t_u8 *)resp, resp->size);
 
-	no_of_sub_band = (t_u8)((wlan_le16_to_cpu(domain->header.len) -
-				 COUNTRY_CODE_LEN) /
-				sizeof(IEEEtypes_SubbandSet_t));
+	no_of_sub_band = (t_u8)(
+		(wlan_le16_to_cpu(domain->header.len) - COUNTRY_CODE_LEN) /
+		sizeof(IEEEtypes_SubbandSet_t));
 
 	PRINTM(MINFO, "11D Domain Info Resp: number of sub-band=%d\n",
 	       no_of_sub_band);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11h.c b/mxm_wifiex/wlan_src/mlan/mlan_11h.c
index 8252b8b..bcb0b78 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11h.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11h.c
@@ -3535,6 +3535,15 @@ mlan_status wlan_11h_ioctl_chan_dfs_state(pmlan_adapter pmadapter,
 				wlan_11h_add_dfs_timestamp(
 					pmadapter, DFS_TS_REPR_NOP_START,
 					ds_11hcfg->param.ch_dfs_state.channel);
+			} else if (ds_11hcfg->param.ch_dfs_state.dfs_state ==
+				   DFS_AVAILABLE) {
+				if (MFALSE ==
+				    wlan_11h_is_channel_under_nop(
+					    pmadapter,
+					    ds_11hcfg->param.ch_dfs_state
+						    .channel))
+					PRINTM(MINFO,
+					       "Channel is not in NOP\n");
 			}
 			wlan_set_chan_dfs_state(
 				priv, BAND_A,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n.c b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
index 9598d93..f106ea3 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
@@ -3029,11 +3029,10 @@ int wlan_send_addba(mlan_private *priv, int tid, t_u8 *peer_mac)
 	PRINTM(MCMND, "Send addba: TID %d, " MACSTR "\n", tid,
 	       MAC2STR(peer_mac));
 
-	add_ba_req.block_ack_param_set =
-		(t_u16)((tid << BLOCKACKPARAM_TID_POS) |
-			(priv->add_ba_param.tx_win_size
-			 << BLOCKACKPARAM_WINSIZE_POS) |
-			IMMEDIATE_BLOCK_ACK);
+	add_ba_req.block_ack_param_set = (t_u16)(
+		(tid << BLOCKACKPARAM_TID_POS) |
+		(priv->add_ba_param.tx_win_size << BLOCKACKPARAM_WINSIZE_POS) |
+		IMMEDIATE_BLOCK_ACK);
 	/** enable AMSDU inside AMPDU */
 	if (priv->add_ba_param.tx_amsdu &&
 	    (priv->aggr_prio_tbl[tid].amsdu != BA_STREAM_NOT_ALLOWED))
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c b/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
index 1151166..b0f96ed 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
@@ -169,21 +169,48 @@ static INLINE void wlan_11n_update_pktlen_amsdu_txpd(mlan_private *priv,
 	LEAVE();
 }
 
+/**
+ *  @brief check if UAP AMSDU packet need forward out to connected peers
+ *
+ *  @param priv       A pointer to mlan_private
+ *
+ *  @return			  MTRUE--packet need forward
+ *
+ */
+static t_u8 wlan_uap_check_forward(mlan_private *priv, Eth803Hdr_t *hdr)
+{
+	/** include multicast packet */
+	if (hdr->dest_addr[0] & 0x01)
+		return MTRUE;
+	/** include unicast packet to another station */
+	if (wlan_get_station_entry(priv, hdr->dest_addr))
+		return MTRUE;
+	return MFALSE;
+}
+
 /**
  *  @brief Get number of aggregated packets
  *
+ *  @param priv		A pointer to mlan_private structure
  *  @param data			A pointer to packet data
  *  @param total_pkt_len	Total packet length
+ *  @param forward      A pointer forward flag
  *
  *  @return			Number of packets
  */
-static int wlan_11n_get_num_aggrpkts(t_u8 *data, int total_pkt_len)
+static int wlan_11n_get_num_aggrpkts(mlan_private *priv, t_u8 *data,
+				     int total_pkt_len, t_u8 *forward)
 {
 	int pkt_count = 0, pkt_len, pad;
 	t_u8 hdr_len = sizeof(Eth803Hdr_t);
 
+	t_u8 forward_flag = MFALSE;
+
 	ENTER();
 	while (total_pkt_len >= hdr_len) {
+		if (priv->bss_role == MLAN_BSS_ROLE_UAP &&
+		    wlan_uap_check_forward(priv, (Eth803Hdr_t *)data))
+			forward_flag = MTRUE;
 		/* Length will be in network format, change it to host */
 		pkt_len = mlan_ntohs(
 			(*(t_u16 *)(data + (2 * MLAN_MAC_ADDR_LENGTH))));
@@ -199,6 +226,7 @@ static int wlan_11n_get_num_aggrpkts(t_u8 *data, int total_pkt_len)
 		total_pkt_len -= pkt_len + pad + sizeof(Eth803Hdr_t);
 		++pkt_count;
 	}
+	*forward = forward_flag;
 	LEAVE();
 	return pkt_count;
 }
@@ -229,6 +257,7 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 	t_u8 rfc1042_eth_hdr[MLAN_MAC_ADDR_LENGTH] = {0xaa, 0xaa, 0x03,
 						      0x00, 0x00, 0x00};
 	t_u8 hdr_len = sizeof(Eth803Hdr_t);
+	t_u8 forward = MFALSE;
 	t_u8 eapol_type[2] = {0x88, 0x8e};
 	t_u8 tdls_action_type[2] = {0x89, 0x0d};
 	t_u32 in_ts_sec, in_ts_usec;
@@ -237,6 +266,7 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 	t_u32 out_copy_ts_sec, out_copy_ts_usec;
 	t_u32 copy_delay = 0;
 	t_u32 delay = 0;
+	t_u8 num_subframes = 0;
 
 	ENTER();
 
@@ -270,7 +300,8 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 	if (pmadapter->tp_state_on)
 		pmadapter->callbacks.moal_get_system_time(
 			pmadapter->pmoal_handle, &in_ts_sec, &in_ts_usec);
-	pmbuf->use_count = wlan_11n_get_num_aggrpkts(data, total_pkt_len);
+	num_subframes = pmbuf->use_count =
+		wlan_11n_get_num_aggrpkts(priv, data, total_pkt_len, &forward);
 
 	// rx_trace 7
 	if (pmadapter->tp_state_on) {
@@ -282,13 +313,13 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 	if (pmadapter->tp_state_drop_point == 7 /*RX_DROP_P3*/)
 		goto done;
 	prx_pkt = (RxPacketHdr_t *)data;
-	if (pmbuf->pdesc && !memcmp(pmadapter, prx_pkt->eth803_hdr.dest_addr,
-				    priv->curr_addr, MLAN_MAC_ADDR_LENGTH)) {
+	/**  check if packet need send to host only */
+	if (pmbuf->pdesc && !forward) {
 		if (pmadapter->callbacks.moal_recv_amsdu_packet) {
 			ret = pmadapter->callbacks.moal_recv_amsdu_packet(
 				pmadapter->pmoal_handle, pmbuf);
 			if (ret == MLAN_STATUS_PENDING) {
-				priv->msdu_in_rx_amsdu_cnt += pmbuf->use_count;
+				priv->msdu_in_rx_amsdu_cnt += num_subframes;
 				priv->amsdu_rx_cnt++;
 				return ret;
 			}
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
index 6c58696..d4ff63a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
@@ -691,21 +691,20 @@ static cfp_table_t cfp_table_A[] = {
 /** Number of the CFP tables for 5GHz */
 #define MLAN_CFP_TABLE_SIZE_A (NELEMENTS(cfp_table_A))
 
-enum {
-	RATEID_DBPSK1Mbps, //(0)
-	RATEID_DQPSK2Mbps, //(1)
-	RATEID_CCK5_5Mbps, //(2)
-	RATEID_CCK11Mbps, //(3)
-	RATEID_CCK22Mbps, //(4)
-	RATEID_OFDM6Mbps, //(5)
-	RATEID_OFDM9Mbps, //(6)
-	RATEID_OFDM12Mbps, //(7)
-	RATEID_OFDM18Mbps, //(8)
-	RATEID_OFDM24Mbps, //(9)
-	RATEID_OFDM36Mbps, //(10)
-	RATEID_OFDM48Mbps, //(11)
-	RATEID_OFDM54Mbps, //(12)
-	RATEID_OFDM72Mbps, //(13)
+enum { RATEID_DBPSK1Mbps, //(0)
+       RATEID_DQPSK2Mbps, //(1)
+       RATEID_CCK5_5Mbps, //(2)
+       RATEID_CCK11Mbps, //(3)
+       RATEID_CCK22Mbps, //(4)
+       RATEID_OFDM6Mbps, //(5)
+       RATEID_OFDM9Mbps, //(6)
+       RATEID_OFDM12Mbps, //(7)
+       RATEID_OFDM18Mbps, //(8)
+       RATEID_OFDM24Mbps, //(9)
+       RATEID_OFDM36Mbps, //(10)
+       RATEID_OFDM48Mbps, //(11)
+       RATEID_OFDM54Mbps, //(12)
+       RATEID_OFDM72Mbps, //(13)
 };
 
 static const t_u8 rateUnit_500Kbps[] = {
@@ -1686,12 +1685,12 @@ t_u32 wlan_index_to_data_rate(pmlan_adapter pmadapter, t_u8 index,
 		if (gi > 0)
 			gi = gi - 1;
 
-		// #ifdef ENABLE_802_11AX
-		//  TODO: hardcode he_tone here, wait for FW value ready.
+		//#ifdef ENABLE_802_11AX
+		// TODO: hardcode he_tone here, wait for FW value ready.
 		//		he_tone = 4;
 
 		// he_tone = (ext_rate_info & 0xE) >> 1;
-		// #endif
+		//#endif
 
 		if ((index >> 4) == 1) {
 			switch (mcs_index) {
@@ -1937,9 +1936,9 @@ t_u8 wlan_get_txpwr_of_chan_from_cfp(mlan_private *pmpriv, t_u16 band,
 							(cfp_a + j)
 								->max_tx_power);
 					else
-						tx_power =
-							(t_u8)((cfp_a + j)
-								       ->max_tx_power);
+						tx_power = (t_u8)(
+							(cfp_a + j)
+								->max_tx_power);
 					break;
 				}
 			}
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
index cf33377..7bc55f3 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
@@ -5380,9 +5380,8 @@ mlan_status wlan_process_csi_event(pmlan_private pmpriv)
 				  MLAN_MEM_DEF, &evt_buf);
 	if ((status == MLAN_STATUS_SUCCESS) && evt_buf) {
 		t_u16 csi_sig;
-		pcsi_record_ds csi_record =
-			(pcsi_record_ds)(pmbuf->pbuf + pmbuf->data_offset +
-					 sizeof(eventcause));
+		pcsi_record_ds csi_record = (pcsi_record_ds)(
+			pmbuf->pbuf + pmbuf->data_offset + sizeof(eventcause));
 		/* Check CSI signature */
 		csi_sig = csi_record->CSI_Sign;
 		if (csi_sig != CSI_SIGNATURE) {
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_decl.h b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
index 7956c25..29eb7f6 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "423.p1"
+#define MLAN_RELEASE_VERSION "423.p6"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -950,34 +950,29 @@ enum mlan_channel_type {
 };
 
 /** channel band */
-enum {
-	BAND_2GHZ = 0,
-	BAND_5GHZ = 1,
-	BAND_6GHZ = 2,
-	BAND_4GHZ = 3,
+enum { BAND_2GHZ = 0,
+       BAND_5GHZ = 1,
+       BAND_6GHZ = 2,
+       BAND_4GHZ = 3,
 };
 
 /** channel offset */
-enum {
-	SEC_CHAN_NONE = 0,
-	SEC_CHAN_ABOVE = 1,
-	SEC_CHAN_5MHZ = 2,
-	SEC_CHAN_BELOW = 3
-};
+enum { SEC_CHAN_NONE = 0,
+       SEC_CHAN_ABOVE = 1,
+       SEC_CHAN_5MHZ = 2,
+       SEC_CHAN_BELOW = 3 };
 
 /** channel bandwidth */
-enum {
-	CHAN_BW_20MHZ = 0,
-	CHAN_BW_10MHZ,
-	CHAN_BW_40MHZ,
-	CHAN_BW_80MHZ,
+enum { CHAN_BW_20MHZ = 0,
+       CHAN_BW_10MHZ,
+       CHAN_BW_40MHZ,
+       CHAN_BW_80MHZ,
 };
 
 /** scan mode */
-enum {
-	SCAN_MODE_MANUAL = 0,
-	SCAN_MODE_ACS,
-	SCAN_MODE_USER,
+enum { SCAN_MODE_MANUAL = 0,
+       SCAN_MODE_ACS,
+       SCAN_MODE_USER,
 };
 
 /** DFS state */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_fw.h b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
index c696843..02be5d1 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_fw.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
@@ -1219,7 +1219,7 @@ enum host_cmd_id {
 #define FW_CAPINFO_EXT_CHAN_TRACK MBIT(13)
 /** FW cap info bit 14: 6G Support */
 #define FW_CAPINFO_EXT_6G MBIT(14)
-/** FW cap info bit 16: 6G Support */
+/** FW cap info bit 16: Tx mgmt pkt with command*/
 #define FW_CAPINFO_EXT_CMD_TX_DATA MBIT(16)
 /** FW cap info bit 19: security rgpower table */
 #define FW_CAPINFO_EXT_SEC_RG_POWER MBIT(19)
@@ -1261,8 +1261,10 @@ enum host_cmd_id {
 	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_CHAN_TRACK)
 /** Check if 6G supported by firmware */
 #define IS_FW_SUPPORT_6G(_adapter) (_adapter->fw_cap_ext & FW_CAPINFO_EXT_6G)
+/** Check if transmit mgmt pkt through command supported by firmware */
 #define IS_FW_SUPPORT_CMD_TX_DATA(_adapter)                                    \
 	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_CMD_TX_DATA)
+/** Check if security rgpower table supported by firmware */
 #define IS_FW_SUPPORT_SEC_RG_POWER(_adapter)                                   \
 	(_adapter->fw_cap_ext & FW_CAPINFO_EXT_SEC_RG_POWER)
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
index 2d679d3..fa0e679 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
@@ -395,6 +395,8 @@ enum _mlan_act_ioctl {
 	MLAN_ACT_RESET,
 	MLAN_ACT_DEFAULT
 };
+#define MLAN_ACT_PASN_KEY_DNLD 7
+#define MLAN_ACT_PASN_SET_KEY 0
 /** Enumeration for generic enable/disable */
 enum _mlan_act_generic { MLAN_ACT_DISABLE = 0, MLAN_ACT_ENABLE = 1 };
 
@@ -2380,6 +2382,8 @@ typedef struct _mlan_debug_info {
 	t_u8 tx_lock_flag;
 	/** Corresponds to port_open member of mlan_private */
 	t_u8 port_open;
+	/** Corresponds to tx_pause member of mlan_private */
+	t_u8 tx_pause;
 	/** bypass pkt count */
 	t_u32 bypass_pkt_count;
 	/** Corresponds to scan_processing member of mlan_adapter */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_join.c b/mxm_wifiex/wlan_src/mlan/mlan_join.c
index f70106c..9537f06 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_join.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_join.c
@@ -672,7 +672,7 @@ static int wlan_update_rsn_ie(mlan_private *pmpriv,
 	t_u8 preference_selected;
 	t_u8 cipher_selected_id;
 #if 0 // defined(ENABLE_GCMP_SUPPORT)
-      //  embedded supplicant doesn't support GCMP yet
+      // embedded supplicant doesn't support GCMP yet
 	t_u8 cipher_preference[11] = {0, 0, 1, 0, 2, 0, 0, 0, 4, 5, 3};
 #else
 	t_u8 cipher_preference[5] = {0, 0, 1, 0, 2};
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_misc.c b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
index 1da74c3..dc923ab 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_misc.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
@@ -465,6 +465,7 @@ mlan_status wlan_get_info_debug_info(pmlan_adapter pmadapter,
 		debug_info->qos_cfg = pmpriv->wmm_qosinfo;
 		debug_info->tx_lock_flag = pmadapter->tx_lock_flag;
 		debug_info->port_open = pmpriv->port_open;
+		debug_info->tx_pause = pmpriv->tx_pause;
 		debug_info->bypass_pkt_count = pmadapter->bypass_pkt_count;
 		debug_info->scan_processing = pmadapter->scan_processing;
 		debug_info->scan_state = pmadapter->scan_state;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
index 9742db8..fb05805 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
@@ -4542,24 +4542,21 @@ mlan_status wlan_set_pcie_buf_config(mlan_private *pmpriv)
 		/* Send the ring base addresses and count to firmware */
 		host_spec.txbd_addr_lo = wlan_cpu_to_le32(
 			(t_u32)(pmadapter->pcard_pcie->txbd_ring_pbase));
-		host_spec.txbd_addr_hi = wlan_cpu_to_le32((
-			t_u32)(((t_u64)pmadapter->pcard_pcie->txbd_ring_pbase) >>
-			       32));
+		host_spec.txbd_addr_hi = wlan_cpu_to_le32((t_u32)(
+			((t_u64)pmadapter->pcard_pcie->txbd_ring_pbase) >> 32));
 		host_spec.txbd_count =
 			wlan_cpu_to_le32(pmadapter->pcard_pcie->txrx_bd_size);
 		host_spec.rxbd_addr_lo = wlan_cpu_to_le32(
 			(t_u32)(pmadapter->pcard_pcie->rxbd_ring_pbase));
-		host_spec.rxbd_addr_hi = wlan_cpu_to_le32((
-			t_u32)(((t_u64)pmadapter->pcard_pcie->rxbd_ring_pbase) >>
-			       32));
+		host_spec.rxbd_addr_hi = wlan_cpu_to_le32((t_u32)(
+			((t_u64)pmadapter->pcard_pcie->rxbd_ring_pbase) >> 32));
 		host_spec.rxbd_count =
 			wlan_cpu_to_le32(pmadapter->pcard_pcie->txrx_bd_size);
 		host_spec.evtbd_addr_lo = wlan_cpu_to_le32(
 			(t_u32)(pmadapter->pcard_pcie->evtbd_ring_pbase));
-		host_spec.evtbd_addr_hi =
-			wlan_cpu_to_le32((t_u32)(((t_u64)pmadapter->pcard_pcie
-							  ->evtbd_ring_pbase) >>
-						 32));
+		host_spec.evtbd_addr_hi = wlan_cpu_to_le32((t_u32)(
+			((t_u64)pmadapter->pcard_pcie->evtbd_ring_pbase) >>
+			32));
 		host_spec.evtbd_count = wlan_cpu_to_le32(MLAN_MAX_EVT_BD);
 
 		ret = wlan_prepare_cmd(pmpriv,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_scan.c b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
index cafb1a9..6c50265 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_scan.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
@@ -904,9 +904,8 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 			 * compensates for any TLVs that were appended
 			 * before the channel list.
 			 */
-			pscan_cfg_out->tlv_buf_len =
-				(t_u32)((t_u8 *)pchan_tlv_out -
-					pscan_cfg_out->tlv_buf);
+			pscan_cfg_out->tlv_buf_len = (t_u32)(
+				(t_u8 *)pchan_tlv_out - pscan_cfg_out->tlv_buf);
 
 			/* Add the size of the channel tlv header and the data
 			 * length */
@@ -1247,10 +1246,9 @@ static mlan_status wlan_scan_setup_scan_config(
 				(MrvlIEtypes_WildCardSsIdParamSet_t *)ptlv_pos;
 			pwildcard_ssid_tlv->header.type =
 				wlan_cpu_to_le16(TLV_TYPE_WILDCARDSSID);
-			pwildcard_ssid_tlv->header.len =
-				(t_u16)(ssid_len +
-					sizeof(pwildcard_ssid_tlv
-						       ->max_ssid_length));
+			pwildcard_ssid_tlv->header.len = (t_u16)(
+				ssid_len +
+				sizeof(pwildcard_ssid_tlv->max_ssid_length));
 			pwildcard_ssid_tlv->max_ssid_length =
 				puser_scan_in->ssid_list[ssid_idx].max_len;
 
@@ -2057,9 +2055,8 @@ static mlan_status wlan_interpret_bss_desc_with_ie(pmlan_adapter pmadapter,
 				pbss_entry->pwpa_ie =
 					(IEEEtypes_VendorSpecific_t *)
 						pcurrent_ptr;
-				pbss_entry->wpa_offset =
-					(t_u16)(pcurrent_ptr -
-						pbss_entry->pbeacon_buf);
+				pbss_entry->wpa_offset = (t_u16)(
+					pcurrent_ptr - pbss_entry->pbeacon_buf);
 				HEXDUMP("InterpretIE: Resp WPA_IE",
 					(t_u8 *)pbss_entry->pwpa_ie,
 					((*(pbss_entry->pwpa_ie)).vend_hdr.len +
@@ -2135,9 +2132,8 @@ static mlan_status wlan_interpret_bss_desc_with_ie(pmlan_adapter pmadapter,
 					   osen_oui, sizeof(osen_oui))) {
 				pbss_entry->posen_ie =
 					(IEEEtypes_Generic_t *)pcurrent_ptr;
-				pbss_entry->osen_offset =
-					(t_u16)(pcurrent_ptr -
-						pbss_entry->pbeacon_buf);
+				pbss_entry->osen_offset = (t_u16)(
+					pcurrent_ptr - pbss_entry->pbeacon_buf);
 				HEXDUMP("InterpretIE: Resp OSEN_IE",
 					(t_u8 *)pbss_entry->posen_ie,
 					(*(pbss_entry->posen_ie)).ieee_hdr.len +
@@ -2312,15 +2308,13 @@ static mlan_status wlan_interpret_bss_desc_with_ie(pmlan_adapter pmadapter,
 			case HE_CAPABILITY:
 				pbss_entry->phe_cap =
 					(IEEEtypes_HECap_t *)pcurrent_ptr;
-				pbss_entry->he_cap_offset =
-					(t_u16)(pcurrent_ptr -
-						pbss_entry->pbeacon_buf);
+				pbss_entry->he_cap_offset = (t_u16)(
+					pcurrent_ptr - pbss_entry->pbeacon_buf);
 				break;
 			case HE_OPERATION:
 				pbss_entry->phe_oprat = pext_tlv;
-				pbss_entry->he_oprat_offset =
-					(t_u16)(pcurrent_ptr -
-						pbss_entry->pbeacon_buf);
+				pbss_entry->he_oprat_offset = (t_u16)(
+					pcurrent_ptr - pbss_entry->pbeacon_buf);
 				break;
 			default:
 				break;
@@ -3133,14 +3127,14 @@ static t_u8 wlan_get_chan_rssi(mlan_adapter *pmadapter, t_u8 channel,
 	for (i = 0; i < (int)pmadapter->num_in_scan_table; i++) {
 		if (pmadapter->pscan_table[i].channel == channel) {
 			if (rssi == 0)
-				rssi = (t_s32)pmadapter->pscan_table[i].rssi;
+				rssi = (t_u8)pmadapter->pscan_table[i].rssi;
 			else {
 				if (min_flag)
-					rssi = MIN(
+					rssi = (t_u8)MIN(
 						rssi,
 						pmadapter->pscan_table[i].rssi);
 				else
-					rssi = MAX(
+					rssi = (t_u8)MAX(
 						rssi,
 						pmadapter->pscan_table[i].rssi);
 			}
@@ -4984,10 +4978,10 @@ mlan_status wlan_cmd_802_11_scan_ext(mlan_private *pmpriv,
 			else
 				pext_scan_cmd->ext_scan_type = EXT_SCAN_DEFAULT;
 		} else {
-			pcmd->size = wlan_cpu_to_le16((
-				t_u16)(sizeof(pext_scan_cmd->ext_scan_type) +
-				       (t_u16)(sizeof(pext_scan_cmd->reserved)) +
-				       S_DS_GEN));
+			pcmd->size = wlan_cpu_to_le16((t_u16)(
+				sizeof(pext_scan_cmd->ext_scan_type) +
+				(t_u16)(sizeof(pext_scan_cmd->reserved)) +
+				S_DS_GEN));
 			pext_scan_cmd->ext_scan_type = EXT_SCAN_CANCEL;
 			LEAVE();
 			return MLAN_STATUS_SUCCESS;
@@ -5767,8 +5761,8 @@ static mlan_status wlan_parse_ext_scan_result(mlan_private *pmpriv,
 			 */
 			if (pscan_info_tlv) {
 				/* RSSI is 2 byte long */
-				bss_new_entry->rssi = -(t_s32)(wlan_le16_to_cpu(
-					pscan_info_tlv->rssi));
+				bss_new_entry->rssi = -(t_s32)(
+					wlan_le16_to_cpu(pscan_info_tlv->rssi));
 				PRINTM(MINFO, "EXT_SCAN: RSSI=%d\n",
 				       bss_new_entry->rssi);
 				memcpy_ext(pmpriv->adapter, &tsf_val,
@@ -6444,9 +6438,8 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 		pwildcard_ssid_tlv = (MrvlIEtypes_WildCardSsIdParamSet_t *)tlv;
 		pwildcard_ssid_tlv->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_WILDCARDSSID);
-		pwildcard_ssid_tlv->header.len =
-			(t_u16)(ssid_len +
-				sizeof(pwildcard_ssid_tlv->max_ssid_length));
+		pwildcard_ssid_tlv->header.len = (t_u16)(
+			ssid_len + sizeof(pwildcard_ssid_tlv->max_ssid_length));
 		pwildcard_ssid_tlv->max_ssid_length =
 			bg_scan_in->ssid_list[ssid_idx].max_len;
 		memcpy_ext(pmadapter, pwildcard_ssid_tlv->ssid,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
index 2e76291..474f2e4 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
@@ -583,8 +583,8 @@ static mlan_status wlan_get_rd_port(mlan_adapter *pmadapter, t_u8 *pport)
 	} else {
 		if (pmadapter->pcard_sd->mp_rd_bitmap &
 		    (1 << pmadapter->pcard_sd->curr_rd_port)) {
-			pmadapter->pcard_sd->mp_rd_bitmap &= (t_u32)(~(
-				1 << pmadapter->pcard_sd->curr_rd_port));
+			pmadapter->pcard_sd->mp_rd_bitmap &= (t_u32)(
+				~(1 << pmadapter->pcard_sd->curr_rd_port));
 			*pport = pmadapter->pcard_sd->curr_rd_port;
 
 			/* hw rx wraps round only after port (MAX_PORT-1) */
@@ -2269,10 +2269,6 @@ poll_fw:
 		LEAVE();
 		return ret;
 	}
-#ifdef SD9177
-	if (IS_SD9177(pmadapter->card_type))
-		wlan_mdelay(pmadapter, 1000);
-#endif
 done:
 
 	/* re-enable host interrupt for mlan after fw dnld is successful */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_shim.c b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
index dd32094..7742e7d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_shim.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
@@ -1494,6 +1494,22 @@ mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf)
 	return ret;
 }
 
+/**
+ *  @brief clean up txrx
+ *
+ *  @param adapter	A pointer to mlan_adapter structure
+ *
+ *  @return		N/A
+ */
+static t_void wlan_free_txrx(pmlan_adapter pmadapter)
+{
+	t_u8 i;
+	for (i = 0; i < pmadapter->priv_num; i++) {
+		if (pmadapter->priv[i])
+			wlan_clean_txrx(pmadapter->priv[i]);
+	}
+}
+
 /**
  *  @brief MLAN ioctl handler
  *
@@ -1512,8 +1528,9 @@ mlan_status mlan_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 	ENTER();
 
 	if (pioctl_req == MNULL) {
-		PRINTM(MMSG, "Cancel all pending cmd!\n");
+		PRINTM(MMSG, "Cancel all pending cmd and txrx queue\n");
 		wlan_cancel_all_pending_cmd(pmadapter, MFALSE);
+		wlan_free_txrx(pmadapter);
 		goto exit;
 	}
 	pmpriv = pmadapter->priv[pioctl_req->bss_index];
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
index 1586fa8..6f5cf65 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
@@ -663,17 +663,9 @@ static void wlan_process_sta_tx_pause_event(pmlan_private priv,
 			PRINTM(MCMND, "TxPause: " MACSTR " pause=%d, pkts=%d\n",
 			       MAC2STR(tx_pause_tlv->peermac),
 			       tx_pause_tlv->tx_pause, tx_pause_tlv->pkt_cnt);
-
-			if (bssid &&
-			    !memcmp(priv->adapter, bssid, tx_pause_tlv->peermac,
-				    MLAN_MAC_ADDR_LENGTH)) {
-				if (tx_pause_tlv->tx_pause)
-					priv->tx_pause = MTRUE;
-				else
-					priv->tx_pause = MFALSE;
-			} else {
-				status = wlan_get_tdls_link_status(
-					priv, tx_pause_tlv->peermac);
+			status = wlan_get_tdls_link_status(
+				priv, tx_pause_tlv->peermac);
+			if (status != TDLS_NOT_SETUP) {
 				if (MTRUE == wlan_is_tdls_link_setup(status)) {
 					sta_ptr = wlan_get_station_entry(
 						priv, tx_pause_tlv->peermac);
@@ -692,6 +684,11 @@ static void wlan_process_sta_tx_pause_event(pmlan_private priv,
 						}
 					}
 				}
+			} else {
+				if (tx_pause_tlv->tx_pause)
+					priv->tx_pause = MTRUE;
+				else
+					priv->tx_pause = MFALSE;
 			}
 		}
 		tlv_buf_left -= (sizeof(MrvlIEtypesHeader_t) + tlv_len);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
index c0adaaf..d9d5198 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
@@ -3122,6 +3122,7 @@ static mlan_status wlan_sec_ioctl_encrypt_key(pmlan_adapter pmadapter,
 	ENTER();
 	sec = (mlan_ds_sec_cfg *)pioctl_req->pbuf;
 	if ((pioctl_req->action == MLAN_ACT_SET) ||
+	    (pioctl_req->action == MLAN_ACT_PASN_KEY_DNLD) ||
 	    (pioctl_req->action == MLAN_ACT_CLEAR)) {
 		if (sec->param.encrypt_key.is_wapi_key)
 			status = wlan_sec_ioctl_set_wapi_key(pmadapter,
@@ -3403,93 +3404,76 @@ static mlan_status wlan_set_gen_ie_helper(mlan_private *priv, t_u8 *ie_data_ptr,
 			     (!memcmp(priv->adapter, pvendor_ie->oui, wpa_oui,
 				      sizeof(wpa_oui)))) ||
 			    (pvendor_ie->element_id == RSN_IE)) {
-				/* IE is a WPA/WPA2 IE so call set_wpa function
-				 */
-				ret = wlan_set_wpa_ie_helper(priv, ie_data_ptr,
-							     ie_len);
-				priv->wps.session_enable = MFALSE;
-			} else if (pvendor_ie->element_id == WAPI_IE) {
-				/* IE is a WAPI IE so call set_wapi function */
-				ret = wlan_set_wapi_ie(priv, ie_data_ptr,
-						       ie_len);
-			} else if ((pvendor_ie->element_id ==
-				    VENDOR_SPECIFIC_221) &&
-				   (!memcmp(priv->adapter, pvendor_ie->oui,
-					    osen_oui, sizeof(osen_oui)))) {
-				/* IE is a OSEN IE so call set_osen function */
-				ret = wlan_set_osen_ie(priv, ie_data_ptr,
-						       ie_len);
+			/* IE is a WPA/WPA2 IE so call set_wpa function */
+			ret = wlan_set_wpa_ie_helper(priv, ie_data_ptr, ie_len);
+			priv->wps.session_enable = MFALSE;
+		} else if (pvendor_ie->element_id == WAPI_IE) {
+			/* IE is a WAPI IE so call set_wapi function */
+			ret = wlan_set_wapi_ie(priv, ie_data_ptr, ie_len);
+		} else if ((pvendor_ie->element_id == VENDOR_SPECIFIC_221) &&
+			   (!memcmp(priv->adapter, pvendor_ie->oui, osen_oui,
+				    sizeof(osen_oui)))) {
+			/* IE is a OSEN IE so call set_osen function */
+			ret = wlan_set_osen_ie(priv, ie_data_ptr, ie_len);
 
-			} else if ((pvendor_ie->element_id == WPS_IE) &&
-				   (priv->wps.session_enable == MFALSE) &&
-				   (!memcmp(priv->adapter, pvendor_ie->oui,
-					    wps_oui, sizeof(wps_oui)))) {
-				/*
-				 * Discard first two byte (Element ID and
-				 * Length) because they are not needed in the
-				 * case of setting WPS_IE
-				 */
-				if (pvendor_ie->len > 4) {
-					memcpy_ext(
-						priv->adapter,
-						(t_u8 *)&priv->wps.wps_ie,
-						ie_data_ptr, ie_len,
-						sizeof(IEEEtypes_VendorSpecific_t));
-					HEXDUMP("wps_ie",
-						(t_u8 *)&priv->wps.wps_ie,
-						priv->wps.wps_ie.vend_hdr.len +
-							2);
-				} else {
-					/* Only wps oui exist, reset driver wps
-					 * buffer
-					 */
-					memset(priv->adapter,
-					       (t_u8 *)&priv->wps.wps_ie, 0x00,
-					       sizeof(priv->wps.wps_ie));
-					PRINTM(MINFO, "wps_ie cleared\n");
-				}
+		} else if ((pvendor_ie->element_id == WPS_IE) &&
+			   (priv->wps.session_enable == MFALSE) &&
+			   (!memcmp(priv->adapter, pvendor_ie->oui, wps_oui,
+				    sizeof(wps_oui)))) {
+			/*
+			 * Discard first two byte (Element ID and Length)
+			 * because they are not needed in the case of setting
+			 * WPS_IE
+			 */
+			if (pvendor_ie->len > 4) {
+				memcpy_ext(priv->adapter,
+					   (t_u8 *)&priv->wps.wps_ie,
+					   ie_data_ptr, ie_len,
+					   sizeof(IEEEtypes_VendorSpecific_t));
+				HEXDUMP("wps_ie", (t_u8 *)&priv->wps.wps_ie,
+					priv->wps.wps_ie.vend_hdr.len + 2);
 			} else {
-				/*
-				 * Verify that the passed length is not larger
-				 * than the available space remaining in the
-				 * buffer
+				/* Only wps oui exist, reset driver wps buffer
 				 */
-				if (ie_len < (sizeof(priv->gen_ie_buf) -
-					      priv->gen_ie_buf_len)) {
-					/* Test to see if it is a WPS IE, if so,
-					 * enable wps session flag */
-					pvendor_ie =
-						(IEEEtypes_VendorHeader_t *)
-							ie_data_ptr;
-					if ((pvendor_ie->element_id ==
-					     WPS_IE) &&
-					    (!memcmp(priv->adapter,
-						     pvendor_ie->oui, wps_oui,
-						     sizeof(wps_oui)))) {
-						priv->wps.session_enable =
-							MTRUE;
-						PRINTM(MINFO,
-						       "WPS Session Enabled.\n");
-					}
-
-					/* Append the passed data to the end of
-					 * the genIeBuffer */
-					memcpy_ext(
-						priv->adapter,
-						priv->gen_ie_buf +
-							priv->gen_ie_buf_len,
-						ie_data_ptr, ie_len,
-						MRVDRV_GENIE_BUF_SIZE -
-							priv->gen_ie_buf_len);
-					/* Increment the stored buffer length by
-					 * the size passed */
-					priv->gen_ie_buf_len += ie_len;
-				} else {
-					/* Passed data does not fit in the
-					 * remaining buffer space */
-					ret = MLAN_STATUS_FAILURE;
-				}
+				memset(priv->adapter, (t_u8 *)&priv->wps.wps_ie,
+				       0x00, sizeof(priv->wps.wps_ie));
+				PRINTM(MINFO, "wps_ie cleared\n");
 			}
+		} else {
+			/*
+			 * Verify that the passed length is not larger than
+			 * the available space remaining in the buffer
+			 */
+			if (ie_len <
+			    (sizeof(priv->gen_ie_buf) - priv->gen_ie_buf_len)) {
+				/* Test to see if it is a WPS IE, if so, enable
+				 * wps session flag */
+				pvendor_ie =
+					(IEEEtypes_VendorHeader_t *)ie_data_ptr;
+				if ((pvendor_ie->element_id == WPS_IE) &&
+				    (!memcmp(priv->adapter, pvendor_ie->oui,
+					     wps_oui, sizeof(wps_oui)))) {
+					priv->wps.session_enable = MTRUE;
+					PRINTM(MINFO, "WPS Session Enabled.\n");
+				}
+
+				/* Append the passed data to the end of
+				 * the genIeBuffer */
+				memcpy_ext(priv->adapter,
+					   priv->gen_ie_buf +
+						   priv->gen_ie_buf_len,
+					   ie_data_ptr, ie_len,
+					   MRVDRV_GENIE_BUF_SIZE -
+						   priv->gen_ie_buf_len);
+				/* Increment the stored buffer length by
+				 * the size passed */
+				priv->gen_ie_buf_len += ie_len;
+			} else {
+				/* Passed data does not fit in the
+				 * remaining buffer space */
+				ret = MLAN_STATUS_FAILURE;
+			}
+		}
 	}
 
 	/* Return MLAN_STATUS_SUCCESS, or MLAN_STATUS_FAILURE for error case */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
index 1ad0c21..7f274b0 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_tx.c
@@ -133,9 +133,8 @@ t_void *wlan_ops_sta_process_txpd(t_void *priv, pmlan_buffer pmbuf)
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
 	}
 	/* Offset of actual data */
-	plocal_tx_pd->tx_pkt_offset =
-		(t_u16)((t_ptr)pmbuf->pbuf + pmbuf->data_offset -
-			(t_ptr)plocal_tx_pd);
+	plocal_tx_pd->tx_pkt_offset = (t_u16)(
+		(t_ptr)pmbuf->pbuf + pmbuf->data_offset - (t_ptr)plocal_tx_pd);
 
 	if (!plocal_tx_pd->tx_control) {
 		/* TxCtrl set by user or default */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
index ca16562..50f6e0c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
@@ -718,6 +718,13 @@ static mlan_status wlan_uap_bss_ioctl_deauth_sta(pmlan_adapter pmadapter,
 	ENTER();
 
 	bss = (mlan_ds_bss *)pioctl_req->pbuf;
+
+	/*
+	 * Clean up station's ralist, to stop and flush pending traffic
+	 * before uAP sending deauth command to FW.
+	 */
+	wlan_wmm_delete_peer_ralist(pmpriv, bss->param.deauth_param.mac_addr);
+
 	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_APCMD_STA_DEAUTH,
 			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
 			       (t_void *)&bss->param.deauth_param);
@@ -1042,7 +1049,8 @@ wlan_uap_sec_ioctl_set_encrypt_key(pmlan_adapter pmadapter,
 
 	ENTER();
 	sec = (mlan_ds_sec_cfg *)pioctl_req->pbuf;
-	if ((pioctl_req->action != MLAN_ACT_SET)) {
+	if ((pioctl_req->action != MLAN_ACT_SET) &&
+	    (pioctl_req->action != MLAN_ACT_PASN_KEY_DNLD)) {
 		pioctl_req->status_code = MLAN_ERROR_IOCTL_INVALID;
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
index 8449630..db5ff56 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
@@ -234,9 +234,8 @@ t_void *wlan_ops_uap_process_txpd(t_void *priv, pmlan_buffer pmbuf)
 	}
 
 	/* Offset of actual data */
-	plocal_tx_pd->tx_pkt_offset =
-		(t_u16)((t_ptr)pmbuf->pbuf + pmbuf->data_offset -
-			(t_ptr)plocal_tx_pd);
+	plocal_tx_pd->tx_pkt_offset = (t_u16)(
+		(t_ptr)pmbuf->pbuf + pmbuf->data_offset - (t_ptr)plocal_tx_pd);
 
 	if (!plocal_tx_pd->tx_control) {
 		/* TxCtrl set by user or default */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_usb.c b/mxm_wifiex/wlan_src/mlan/mlan_usb.c
index 9fc5ab6..d1b3d5d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_usb.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_usb.c
@@ -487,11 +487,11 @@ static int wlan_usb_deaggr_rx_num_pkts(pmlan_adapter pmadapter, t_u8 *pdata,
 static inline t_u32 usb_tx_aggr_pad_len(t_u32 len,
 					usb_tx_aggr_params *pusb_tx_aggr)
 {
-	return (t_u32)((len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
-			       (len +
-				(pusb_tx_aggr->aggr_ctrl.aggr_align -
-				 (len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
-			       len);
+	return (t_u32)(
+		(len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
+			(len + (pusb_tx_aggr->aggr_ctrl.aggr_align -
+				(len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
+			len);
 }
 
 /**
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_wmm.c b/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
index 077c038..245ea1f 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
@@ -3703,8 +3703,8 @@ void wlan_dump_ralist(mlan_private *priv)
 	tx_pkts_queued =
 		util_scalar_read(pmadapter->pmoal_handle,
 				 &priv->wmm.tx_pkts_queued, MNULL, MNULL);
-	PRINTM(MERROR, "bss_index = %d, tx_pkts_queued = %d\n", priv->bss_index,
-	       tx_pkts_queued);
+	PRINTM(MERROR, "bss_index = %d, tx_pkts_queued = %d tx_pause\n",
+	       priv->bss_index, tx_pkts_queued, priv->tx_pause);
 	if (!tx_pkts_queued)
 		return;
 	for (i = 0; i < MAX_NUM_TID; i++) {
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
index 7956c25..29eb7f6 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "423.p1"
+#define MLAN_RELEASE_VERSION "423.p6"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -950,34 +950,29 @@ enum mlan_channel_type {
 };
 
 /** channel band */
-enum {
-	BAND_2GHZ = 0,
-	BAND_5GHZ = 1,
-	BAND_6GHZ = 2,
-	BAND_4GHZ = 3,
+enum { BAND_2GHZ = 0,
+       BAND_5GHZ = 1,
+       BAND_6GHZ = 2,
+       BAND_4GHZ = 3,
 };
 
 /** channel offset */
-enum {
-	SEC_CHAN_NONE = 0,
-	SEC_CHAN_ABOVE = 1,
-	SEC_CHAN_5MHZ = 2,
-	SEC_CHAN_BELOW = 3
-};
+enum { SEC_CHAN_NONE = 0,
+       SEC_CHAN_ABOVE = 1,
+       SEC_CHAN_5MHZ = 2,
+       SEC_CHAN_BELOW = 3 };
 
 /** channel bandwidth */
-enum {
-	CHAN_BW_20MHZ = 0,
-	CHAN_BW_10MHZ,
-	CHAN_BW_40MHZ,
-	CHAN_BW_80MHZ,
+enum { CHAN_BW_20MHZ = 0,
+       CHAN_BW_10MHZ,
+       CHAN_BW_40MHZ,
+       CHAN_BW_80MHZ,
 };
 
 /** scan mode */
-enum {
-	SCAN_MODE_MANUAL = 0,
-	SCAN_MODE_ACS,
-	SCAN_MODE_USER,
+enum { SCAN_MODE_MANUAL = 0,
+       SCAN_MODE_ACS,
+       SCAN_MODE_USER,
 };
 
 /** DFS state */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
index 2d679d3..fa0e679 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
@@ -395,6 +395,8 @@ enum _mlan_act_ioctl {
 	MLAN_ACT_RESET,
 	MLAN_ACT_DEFAULT
 };
+#define MLAN_ACT_PASN_KEY_DNLD 7
+#define MLAN_ACT_PASN_SET_KEY 0
 /** Enumeration for generic enable/disable */
 enum _mlan_act_generic { MLAN_ACT_DISABLE = 0, MLAN_ACT_ENABLE = 1 };
 
@@ -2380,6 +2382,8 @@ typedef struct _mlan_debug_info {
 	t_u8 tx_lock_flag;
 	/** Corresponds to port_open member of mlan_private */
 	t_u8 port_open;
+	/** Corresponds to tx_pause member of mlan_private */
+	t_u8 tx_pause;
 	/** bypass pkt count */
 	t_u32 bypass_pkt_count;
 	/** Corresponds to scan_processing member of mlan_adapter */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
index e881d67..ba8d664 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
@@ -146,6 +146,23 @@ static const struct nla_policy woal_attr_policy[ATTR_WIFI_MAX + 1] = {
 	[ATTR_GET_CONCURRENCY_MATRIX_SET_SIZE_MAX] = {.type = NLA_U32},
 	[ATTR_SCAN_BAND_SET] = {.type = NLA_U8},
 };
+static const struct nla_policy woal_secure_ranging_ctx_policy
+	[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_MAX + 1] = {
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_ACTION] =
+			{.type = NLA_U32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SRC_ADDR] =
+			{.type = NLA_STRING, .len = ETH_ALEN},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_PEER_MAC_ADDR] =
+			{.type = NLA_STRING, .len = ETH_ALEN},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SHA_TYPE] =
+			{.type = NLA_U32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_TK] =
+			{.type = NLA_STRING, .len = 32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_CIPHER] =
+			{.type = NLA_U32},
+		[MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_LTF_KEYSEED] =
+			{.type = NLA_STRING, .len = 48},
+};
 // clang-format off
 static const struct nla_policy
         woal_nd_offload_policy[ATTR_ND_OFFLOAD_MAX + 1] = {
@@ -2899,11 +2916,6 @@ static int woal_cfg80211_subcmd_link_statistic_get(struct wiphy *wiphy,
 	t_u64 inter_msec = 0;
 	t_u64 max_msec = (t_u64)24 * (t_u64)24 * (t_u64)3600 * (t_u64)1000;
 	moal_handle *handle = priv->phandle;
-	if (!priv->media_connected) {
-		PRINTM(MERROR,
-		       "Block get_link_statistics in disconnected state!\n");
-		return -EINVAL;
-	}
 
 	/* Allocate an IOCTL request buffer */
 	req = woal_alloc_mlan_ioctl_req(sizeof(t_u32) + BUF_MAXLEN);
@@ -3934,6 +3946,181 @@ done:
 	LEAVE();
 	return ret;
 }
+/**
+ * @brief vendor command to start
+ *     woal_cfg80211_subcmd_secure_ranging_ctx
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  fail otherwise
+ */
+static int woal_cfg80211_subcmd_secure_ranging_ctx(struct wiphy *wiphy,
+						   struct wireless_dev *wdev,
+						   const void *data, int len)
+{
+	moal_private *priv;
+	struct net_device *dev;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_sec_cfg *sec = NULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int type, rem;
+	t_u32 action = 0;
+	int key_len = 0;
+	int peer_addr_set = 0;
+	t_u8 peer_addr[ETH_ALEN];
+	t_u8 own_addr[ETH_ALEN];
+	t_u32 cipher = 0;
+	t_u32 sha_type = 0;
+	t_u8 key[MLAN_MAX_KEY_LENGTH] = {0};
+	t_u8 *ltf_keyseed = NULL;
+	t_u8 bcast_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	const struct nlattr *iter;
+
+	ENTER();
+
+	if (!wdev || !wdev->netdev) {
+		LEAVE();
+		return -EFAULT;
+	}
+
+	dev = wdev->netdev;
+	priv = (moal_private *)woal_get_netdev_priv(dev);
+	if (!priv) {
+		LEAVE();
+		return -EFAULT;
+	}
+
+	nla_for_each_attr (iter, data, len, rem) {
+		type = nla_type(iter);
+		switch (type) {
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_ACTION:
+			action = nla_get_u32(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SRC_ADDR:
+			moal_memcpy_ext(priv->phandle, own_addr, nla_data(iter),
+					nla_len(iter), ETH_ALEN);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_PEER_MAC_ADDR:
+			moal_memcpy_ext(priv->phandle, peer_addr,
+					nla_data(iter), nla_len(iter),
+					ETH_ALEN);
+			peer_addr_set = 1;
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SHA_TYPE:
+			sha_type = nla_get_u32(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_TK:
+			moal_memcpy_ext(priv->phandle, key, nla_data(iter),
+					nla_len(iter), MLAN_MAX_KEY_LENGTH);
+			key_len = nla_len(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_CIPHER:
+			cipher = nla_get_u32(iter);
+			break;
+		case MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_LTF_KEYSEED:
+			moal_memcpy_ext(priv->phandle, ltf_keyseed,
+					nla_data(iter), nla_len(iter), 48);
+			break;
+		default:
+			PRINTM(MERROR, "Unknown type: %d\n", type);
+			ret = -EINVAL;
+		}
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_sec_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	sec = (mlan_ds_sec_cfg *)req->pbuf;
+	sec->sub_command = MLAN_OID_SEC_CFG_ENCRYPT_KEY;
+	req->req_id = MLAN_IOCTL_SEC_CFG;
+	if (action == MLAN_ACT_PASN_SET_KEY) {
+		req->action = MLAN_ACT_PASN_KEY_DNLD;
+		if (key_len) {
+			moal_memcpy_ext(priv->phandle,
+					sec->param.encrypt_key.key_material,
+					key, key_len, MLAN_MAX_KEY_LENGTH);
+			sec->param.encrypt_key.key_len = key_len;
+		}
+		if (peer_addr_set) {
+			moal_memcpy_ext(priv->phandle,
+					sec->param.encrypt_key.mac_addr,
+					peer_addr, ETH_ALEN,
+					MLAN_MAC_ADDR_LENGTH);
+			if (memcmp(sec->param.encrypt_key.mac_addr, bcast_addr,
+				   ETH_ALEN) == 0)
+				sec->param.encrypt_key.key_flags =
+					KEY_FLAG_GROUP_KEY;
+			else
+				sec->param.encrypt_key.key_flags =
+					KEY_FLAG_SET_TX_KEY;
+		} else {
+			moal_memcpy_ext(priv->phandle,
+					sec->param.encrypt_key.mac_addr,
+					bcast_addr, ETH_ALEN,
+					MLAN_MAC_ADDR_LENGTH);
+			sec->param.encrypt_key.key_flags =
+				KEY_FLAG_GROUP_KEY | KEY_FLAG_SET_TX_KEY;
+		}
+
+#if KERNEL_VERSION(3, 6, 0) <= CFG80211_VERSION_CODE
+		if (cipher == WLAN_CIPHER_SUITE_GCMP)
+			sec->param.encrypt_key.key_flags |= KEY_FLAG_GCMP;
+#endif
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+		else if (cipher == WLAN_CIPHER_SUITE_GCMP_256)
+			sec->param.encrypt_key.key_flags |= KEY_FLAG_GCMP_256;
+#endif
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+		if (cipher == WLAN_CIPHER_SUITE_CCMP_256)
+			sec->param.encrypt_key.key_flags |= KEY_FLAG_CCMP_256;
+#endif
+
+		if (cipher == WLAN_CIPHER_SUITE_AES_CMAC
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+		    || cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+		    cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256
+#endif
+		) {
+			sec->param.encrypt_key.key_flags |=
+				KEY_FLAG_AES_MCAST_IGTK;
+
+#if KERNEL_VERSION(4, 0, 0) <= CFG80211_VERSION_CODE
+			if (cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128)
+				sec->param.encrypt_key.key_flags |=
+					KEY_FLAG_GMAC_128;
+			else if (cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+				sec->param.encrypt_key.key_flags |=
+					KEY_FLAG_GMAC_256;
+#endif
+		}
+	} else {
+		req->action = MLAN_ACT_CLEAR;
+		sec->param.encrypt_key.key_len = MLAN_MAX_KEY_LENGTH;
+		sec->param.encrypt_key.key_index = MLAN_KEY_INDEX_UNICAST;
+		sec->param.encrypt_key.key_flags = KEY_FLAG_REMOVE_KEY;
+		moal_memcpy_ext(priv->phandle, sec->param.encrypt_key.mac_addr,
+				(u8 *)peer_addr, ETH_ALEN,
+				MLAN_MAC_ADDR_LENGTH);
+		memset(sec->param.encrypt_key.key_material, 0,
+		       sizeof(sec->param.encrypt_key.key_material));
+	}
+	/* Send IOCTL request to MLAN */
+	ret = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
 /**
  * @brief vendor command to
  *
@@ -5487,6 +5674,19 @@ static const struct wiphy_vendor_command vendor_commands[] = {
 #if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
 		.policy = woal_attr_policy,
 		.maxattr = ATTR_WIFI_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = sub_cmd_secure_ranging_ctx,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_secure_ranging_ctx,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+		.policy = woal_secure_ranging_ctx_policy,
+		.maxattr = MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_MAX,
 #endif
 	},
 	{
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
index 4624787..c92b6a1 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
@@ -163,10 +163,9 @@ enum logger_attributes {
 
 /* Below events refer to the wifi_connectivity_event ring and shall be supported
  */
-enum {
-	WIFI_EVENT_ASSOCIATION_REQUESTED = 0,
-	WIFI_EVENT_AUTH_COMPLETE,
-	WIFI_EVENT_ASSOC_COMPLETE,
+enum { WIFI_EVENT_ASSOCIATION_REQUESTED = 0,
+       WIFI_EVENT_AUTH_COMPLETE,
+       WIFI_EVENT_ASSOC_COMPLETE,
 };
 
 enum {
@@ -176,13 +175,11 @@ enum {
 	RING_BUFFER_ENTRY_FLAGS_HAS_TIMESTAMP = (1 << (1))
 };
 
-enum {
-	ENTRY_TYPE_CONNECT_EVENT = 1,
-	ENTRY_TYPE_PKT,
-	ENTRY_TYPE_WAKE_LOCK,
-	ENTRY_TYPE_POWER_EVENT,
-	ENTRY_TYPE_DATA
-};
+enum { ENTRY_TYPE_CONNECT_EVENT = 1,
+       ENTRY_TYPE_PKT,
+       ENTRY_TYPE_WAKE_LOCK,
+       ENTRY_TYPE_POWER_EVENT,
+       ENTRY_TYPE_DATA };
 
 /** WiFi ring buffer entry structure */
 typedef struct {
@@ -509,10 +506,9 @@ int woal_packet_fate_monitor(moal_private *priv,
 #define APF_FRAME_HEADER_SIZE 14
 #define PACKET_FILTER_MAX_LEN 1024
 
-enum {
-	PACKET_FILTER_STATE_INIT = 0,
-	PACKET_FILTER_STATE_STOP,
-	PACKET_FILTER_STATE_START,
+enum { PACKET_FILTER_STATE_INIT = 0,
+       PACKET_FILTER_STATE_STOP,
+       PACKET_FILTER_STATE_START,
 };
 
 enum wifi_attr_packet_filter {
@@ -620,6 +616,21 @@ typedef enum wifi_attr {
 	ATTR_WIFI_AFTER_LAST,
 	ATTR_WIFI_MAX = ATTR_WIFI_AFTER_LAST - 1
 } wifi_attr_t;
+enum mrvl_wlan_vendor_attr_secure_ranging_ctx {
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_INVALID = 0,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_ACTION = 1,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SRC_ADDR = 2,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_PEER_MAC_ADDR = 3,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_SHA_TYPE = 4,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_TK = 5,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_CIPHER = 6,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_LTF_KEYSEED = 7,
+
+	/* keep last */
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_AFTER_LAST,
+	MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_MAX =
+		MRVL_WLAN_VENDOR_ATTR_SECURE_RANGING_CTX_AFTER_LAST - 1,
+};
 enum mrvl_wlan_vendor_attr_wifi_logger {
 	MRVL_WLAN_VENDOR_ATTR_NAME = 10,
 };
@@ -712,6 +723,7 @@ enum vendor_sub_command {
 	sub_cmd_dfs_capability = 0x0005,
 	sub_cmd_set_scan_mac_oui = 0x0007,
 	sub_cmd_set_scan_band = 0x0008,
+	sub_cmd_secure_ranging_ctx = 0x0009,
 	sub_cmd_set_packet_filter = 0x0011,
 	sub_cmd_get_packet_filter_capability,
 	sub_cmd_nd_offload = 0x0100,
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_debug.c b/mxm_wifiex/wlan_src/mlinux/moal_debug.c
index be67a56..b72737a 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_debug.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_debug.c
@@ -113,6 +113,7 @@ static struct debug_data items[] = {
 	{"tx_lock_flag", item_size(tx_lock_flag), item_addr(tx_lock_flag),
 	 INFO_ADDR},
 	{"port_open", item_size(port_open), item_addr(port_open), INFO_ADDR},
+	{"tx_pause", item_size(tx_pause), item_addr(tx_pause), INFO_ADDR},
 	{"bypass_pkt_count", item_size(bypass_pkt_count),
 	 item_addr(bypass_pkt_count), INFO_ADDR},
 	{"scan_processing", item_size(scan_processing),
@@ -309,6 +310,7 @@ static struct debug_data uap_items[] = {
 	 INFO_ADDR},
 	{"tx_pkts_queued", item_size(tx_pkts_queued), item_addr(tx_pkts_queued),
 	 INFO_ADDR},
+	{"tx_pause", item_size(tx_pause), item_addr(tx_pause), INFO_ADDR},
 	{"bypass_pkt_count", item_size(bypass_pkt_count),
 	 item_addr(bypass_pkt_count), INFO_ADDR},
 	{"num_bridge_pkts", item_size(num_bridge_pkts),
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
index a6cf9c0..378701e 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
@@ -2220,7 +2220,7 @@ static int woal_setget_priv_txratecfg(moal_private *priv, t_u8 *respbuf,
 				       data[3]);
 
 /* HE Preamble type */
-// #define HE_SU_PREAMBLE 0
+//#define HE_SU_PREAMBLE 0
 #define HE_ER_PREAMBLE 1
 
 /* HE ER SU Type */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.c b/mxm_wifiex/wlan_src/mlinux/moal_main.c
index 4f20fa9..82a66b0 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.c
@@ -5593,6 +5593,7 @@ void woal_remove_interface(moal_handle *handle, t_u8 bss_index)
 	if (dev->reg_state == NETREG_REGISTERED)
 		unregister_netdev(dev);
 
+	woal_sched_timeout(100);
 	if (priv->mclist_workqueue) {
 		flush_workqueue(priv->mclist_workqueue);
 		destroy_workqueue(priv->mclist_workqueue);
@@ -6690,6 +6691,7 @@ void woal_mlan_debug_info(moal_private *priv)
 	       info->sleep_pd);
 	PRINTM(MERROR, "tx_lock_flag = %d\n", info->tx_lock_flag);
 	PRINTM(MERROR, "port_open = %d\n", info->port_open);
+	PRINTM(MERROR, "tx_pause = %d\n", info->tx_pause);
 	PRINTM(MERROR, "scan_processing = %d\n", info->scan_processing);
 	PRINTM(MERROR, "scan_state = 0x%x\n", info->scan_state);
 	for (i = 0; i < (int)info->ralist_num; i++) {
@@ -6761,6 +6763,12 @@ void woal_tx_timeout(struct net_device *dev
 	priv->num_tx_timeout++;
 	PRINTM(MERROR, "%lu : %s (bss=%d): Tx timeout (%d)\n", jiffies,
 	       dev->name, priv->bss_index, priv->num_tx_timeout);
+	PRINTM(MERROR, "num_tx_pkts = %lu\n", priv->stats.tx_packets);
+	PRINTM(MERROR, "tx_pending = %d\n",
+	       atomic_read(&priv->phandle->tx_pending));
+	if (priv->num_tx_timeout < NUM_TX_TIMEOUT_THRESHOLD)
+		woal_mlan_debug_info(priv);
+
 	woal_set_trans_start(dev);
 
 	if (priv->num_tx_timeout == NUM_TX_TIMEOUT_THRESHOLD &&
@@ -10384,6 +10392,7 @@ static int woal_dump_mlan_drv_info(moal_private *priv, t_u8 *buf)
 	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_lock_flag = %d\n",
 			info->tx_lock_flag);
 	ptr += snprintf(ptr, MAX_BUF_LEN, "port_open = %d\n", info->port_open);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_pause = %d\n", info->tx_pause);
 	ptr += snprintf(ptr, MAX_BUF_LEN, "scan_processing = %d\n",
 			info->scan_processing);
 	ptr += snprintf(ptr, MAX_BUF_LEN, "scan_state = %d\n",
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.h b/mxm_wifiex/wlan_src/mlinux/moal_main.h
index b4b9645..79b0b6a 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.h
@@ -166,6 +166,10 @@ Change log:
 #define IMX_ANDROID_13 0
 #define IMX_ANDROID_12_BACKPORT 0
 
+#if defined(IMX_SUPPORT)
+
+#if defined(IMX_ANDROID)
+
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 52)
 #undef IMX_ANDROID_13
 #define IMX_ANDROID_13 1
@@ -174,6 +178,8 @@ Change log:
 #undef IMX_ANDROID_12_BACKPORT
 #define IMX_ANDROID_12_BACKPORT 1
 #endif
+#endif
+#endif
 
 /**
  * Reason Code 3: STA is leaving (or has left) IBSS or ESS
@@ -387,13 +393,11 @@ typedef enum _MOAL_HARDWARE_STATUS {
 enum { MOAL_NO_WAIT, MOAL_IOCTL_WAIT, MOAL_IOCTL_WAIT_TIMEOUT };
 
 /** moal_main_state */
-enum {
-	MOAL_STATE_IDLE,
-	MOAL_RECV_INT,
-	MOAL_ENTER_WORK_QUEUE,
-	MOAL_START_MAIN_PROCESS,
-	MOAL_END_MAIN_PROCESS
-};
+enum { MOAL_STATE_IDLE,
+       MOAL_RECV_INT,
+       MOAL_ENTER_WORK_QUEUE,
+       MOAL_START_MAIN_PROCESS,
+       MOAL_END_MAIN_PROCESS };
 
 /** HostCmd_Header */
 typedef struct _HostCmd_Header {
@@ -2170,8 +2174,7 @@ extern t_u8 ru_signal_52[9];
 				y = (y + 1) - TONE_MAX_USERS_242;                 \
 			} else {                                                  \
 				tone = (y == 2) ? RU_TONE_106 :                   \
-				       (y == 1) ? 0 :                             \
-						  RU_TONE_106;                    \
+						  (y == 1) ? 0 : RU_TONE_106;     \
 			}                                                         \
 		} else if (x == RU_40_242_TONE) {                                 \
 			if (!y) {                                                 \
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
index 9f8b037..67fd4bc 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
@@ -233,6 +233,49 @@ static t_u16 woal_update_card_type(t_void *card)
 }
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
+/**
+ * @brief Function to program scratch register to ask device to clear ADMA
+ *
+ * @param handle    A pointer to moal_handle structure
+ *
+ * @return        MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+
+static mlan_status woal_reset_adma(moal_handle *handle)
+{
+	int tries = 0;
+	int ret = MLAN_STATUS_SUCCESS;
+	t_u32 value;
+	t_u32 reset_reg = handle->card_info->fw_reset_reg;
+	t_u8 reset_adma_val = 0x97;
+
+	if (handle->ops.write_reg(handle, reset_reg, reset_adma_val) !=
+	    MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to write register.\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	for (tries = 0; tries < 100; ++tries) {
+		ret = handle->ops.read_reg(handle, reset_reg, &value);
+		if (value == 0) {
+			break;
+		}
+		moal_usleep_range(handle, 100, 200);
+	}
+
+	if (value == 0) {
+		PRINTM(MMSG, "%s:ADMA reset done\n", __func__);
+		ret = MLAN_STATUS_SUCCESS;
+	} else {
+		PRINTM(MERROR, "%s:ADMA reset failed(value:%x)\n", __func__,
+		       value);
+		ret = MLAN_STATUS_FAILURE;
+	}
+done:
+	return ret;
+}
+
 /**
  * @brief Function to process pre/post PCIe function level reset
  *
@@ -292,6 +335,7 @@ static mlan_status woal_do_flr(moal_handle *handle, bool prepare, bool flr_flag)
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 	woal_reset_intf(priv, MOAL_IOCTL_WAIT, MTRUE);
 	woal_clean_up(handle);
+	mlan_ioctl(handle->pmlan_adapter, NULL);
 
 	/* Shutdown firmware */
 	handle->init_wait_q_woken = MFALSE;
@@ -832,6 +876,12 @@ static void woal_pcie_reset_prepare(struct pci_dev *pdev)
 		}
 	}
 	handle->surprise_removed = MTRUE;
+	// TODO: Can add more chips once the related code has been ported to fw
+	// v18
+	if (IS_PCIE9097(handle->card_type) || IS_PCIE9098(handle->card_type)) {
+		woal_reset_adma(handle);
+	}
+
 	woal_do_flr(handle, true, true);
 	if (ref_handle) {
 		ref_handle->surprise_removed = MTRUE;
@@ -936,6 +986,12 @@ static void woal_pcie_reset_notify(struct pci_dev *pdev, bool prepare)
 		 * Note. FW might not be healthy.
 		 */
 		handle->surprise_removed = MTRUE;
+		// TODO: Can add more chips once the related code has been
+		// ported to fw v18
+		if (IS_PCIE9097(handle->card_type) ||
+		    IS_PCIE9098(handle->card_type)) {
+			woal_reset_adma(handle);
+		}
 		woal_do_flr(handle, prepare, true);
 		if (ref_handle) {
 			ref_handle->surprise_removed = MTRUE;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
index 20c868d..96155dd 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
@@ -557,6 +557,28 @@ void woal_sdio_remove(struct sdio_func *func)
 		PRINTM(MINFO, "SDIO func=%d\n", func->num);
 		card = sdio_get_drvdata(func);
 		if (card) {
+			/* We need to advance the time to set surprise_removed
+			 * to MTRUE as fast as possible to avoid race condition
+			 * with woal_sdio_interrupt()
+			 *
+			 * @todo: Due to woal_sdio_interrupt() is called in
+			 * Linux's work queue, cannot be suspended to impact
+			 * other works. Need a lock in these two functions:
+			 * woal_sdio_remove() waits until woal_sdio_interrupt
+			 * ends. woal_sdio_interrupt() returns if
+			 * woal_sdio_remove() is running.
+			 */
+			if (card->handle != NULL) {
+				card->handle->surprise_removed = MTRUE;
+
+				/* check if woal_sdio_interrupt() is running */
+				while (card->handle->main_state !=
+				       MOAL_END_MAIN_PROCESS)
+					woal_sched_timeout(2); /* wait until
+								  woal_sdio_interrupt
+								  ends */
+			}
+
 #ifdef IMX_SUPPORT
 			woal_unregist_oob_wakeup_irq(card->handle);
 #endif /* IMX_SUPPORT */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_shim.c b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
index 4e0546c..4afc986 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_shim.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
@@ -2972,11 +2972,10 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 
 		if (!is_zero_timeval(priv->phandle->scan_time_start)) {
 			woal_get_monotonic_time(&priv->phandle->scan_time_end);
-			priv->phandle->scan_time +=
-				(t_u64)(timeval_to_usec(
-						priv->phandle->scan_time_end) -
-					timeval_to_usec(
-						priv->phandle->scan_time_start));
+			priv->phandle->scan_time += (t_u64)(
+				timeval_to_usec(priv->phandle->scan_time_end) -
+				timeval_to_usec(
+					priv->phandle->scan_time_start));
 			PRINTM(MINFO,
 			       "%s : start_timeval=%d:%d end_timeval=%d:%d inter=%llu scan_time=%llu\n",
 			       __func__,
@@ -4589,8 +4588,8 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 		tx_status_event *tx_status =
 			(tx_status_event *)(pmevent->event_buf + 4);
 		struct tx_status_info *tx_info = NULL;
-		PRINTM(MINFO,
-		       "Receive Tx status: tx_token=%d, pkt_type=0x%x, status=%d tx_seq_num=%d\n",
+		PRINTM(MEVENT,
+		       "Wlan: Tx status: tx_token=%d, pkt_type=0x%x, status=%d priv->tx_seq_num=%d\n",
 		       tx_status->tx_token_id, tx_status->packet_type,
 		       tx_status->status, priv->tx_seq_num);
 		spin_lock_irqsave(&priv->tx_stat_lock, flag);
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
index 49f9620..8031096 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
@@ -4584,6 +4584,15 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 		return -EBUSY;
 	}
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	/* This check is to prevent the situation where
+	 * new scan request comes while Auth is not completed */
+	if (priv->auth_flag & HOST_MLME_AUTH_PENDING) {
+		PRINTM(MCMND, "Block scan as auth is pending\n");
+		LEAVE();
+		return -EAGAIN;
+	}
+#endif
 	spin_lock_irqsave(&priv->phandle->scan_req_lock, flags);
 	priv->phandle->scan_request = request;
 	spin_unlock_irqrestore(&priv->phandle->scan_req_lock, flags);
@@ -8036,12 +8045,13 @@ static int woal_send_tdls_action_frame(struct wiphy *wiphy,
 
 	pmbuf = woal_alloc_mlan_buffer(
 		priv->phandle,
-		MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE + sizeof(pkt_len) +
+		((int)((MLAN_MIN_DATA_HEADER_LEN + HEADER_SIZE +
+			sizeof(pkt_len) +
 			max(sizeof(struct ieee80211_mgmt),
-			    sizeof(struct ieee80211_tdls_data)) +
-			50 + /* supported rates */
-			sizeof(IEEEtypes_ExtCap_t) + /* ext capab */
-			extra_ies_len + sizeof(IEEEtypes_tdls_linkie));
+			    sizeof(struct ieee80211_tdls_data))) +
+		       50 + /* supported rates */
+		       sizeof(IEEEtypes_ExtCap_t) + /* ext capab */
+		       extra_ies_len + sizeof(IEEEtypes_tdls_linkie))));
 	if (!pmbuf) {
 		PRINTM(MERROR, "Fail to allocate mlan_buffer\n");
 		ret = -ENOMEM;
@@ -10422,7 +10432,8 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 		PRINTM(MIOCTL, "Follow countryIE provided by AP.\n");
 	}
 #endif
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0) && CFG80211_VERSION_CODE < KERNEL_VERSION(6, 1, 39)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+#if CFG80211_VERSION_CODE <= KERNEL_VERSION(6, 1, 38)
 	/*REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make
 	 * sure all interfaces on this wiphy reside on allowed channels. If this
 	 * flag is not set, upon a regdomain change, the interfaces are given a
@@ -10430,7 +10441,18 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 	 * allowed channel.*/
 	wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
 #endif
+#endif
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+#if CFG80211_VERSION_CODE <= KERNEL_VERSION(6, 3, 12)
+	/*REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make
+	 * sure all interfaces on this wiphy reside on allowed channels. If this
+	 * flag is not set, upon a regdomain change, the interfaces are given a
+	 * grace period (currently 60 seconds) to disconnect or move to an
+	 * allowed channel.*/
+	wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
+#endif
+#endif
 	memset(&priv->phandle->country_code, 0,
 	       sizeof(priv->phandle->country_code));
 	priv->phandle->dfs_region = NXP_DFS_UNKNOWN;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
index 0f6d726..fc65003 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
@@ -3402,9 +3402,9 @@ int woal_uap_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
 	if (info->param.sta_list.info[idx].stats.last_rx_in_msec) {
 		moal_get_system_time(priv->phandle, &sec, &usec);
 		cur_msec = (t_u64)sec * 1000 + (t_u64)usec / 1000;
-		sinfo->inactive_time =
-			(t_u32)(cur_msec - info->param.sta_list.info[idx]
-						   .stats.last_rx_in_msec);
+		sinfo->inactive_time = (t_u32)(
+			cur_msec -
+			info->param.sta_list.info[idx].stats.last_rx_in_msec);
 		PRINTM(MIOCTL,
 		       "cur:%llu - [%d].last_rx:%llu = inactive_time:%d\n",
 		       cur_msec, idx,
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_wext.c b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
index b3a6848..90020c5 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
@@ -3212,8 +3212,8 @@ static int woal_get_scan(struct net_device *dev, struct iw_request_info *info,
 
 			while ((unsigned int)beacon_size >=
 			       sizeof(IEEEtypes_Header_t)) {
-				element_id = (IEEEtypes_ElementId_e)(*(
-					t_u8 *)pbeacon);
+				element_id = (IEEEtypes_ElementId_e)(
+					*(t_u8 *)pbeacon);
 				element_len = *((t_u8 *)pbeacon + 1);
 				if ((unsigned int)beacon_size <
 				    (unsigned int)element_len +