diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11ac.c b/mxm_wifiex/wlan_src/mlan/mlan_11ac.c
index 5b0243d..298629c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11ac.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11ac.c
@@ -53,105 +53,84 @@ t_u16 wlan_convert_mcsmap_to_maxrate(mlan_private *priv, t_u16 bands,
  *
  *  @return             channel center frequency center, if found; O, otherwise
  */
-
 t_u8 wlan_get_center_freq_idx(mlan_private *pmpriv, t_u16 band, t_u32 pri_chan,
 			      t_u8 chan_bw)
 {
-	t_u8 center_freq_idx = 0;
+	struct center_freq_desc {
+		t_u8 pri_chan;
+		t_u8 ch_40;
+		t_u8 ch_80;
+		t_u8 ch_160;
+	};
 
-	if (band & BAND_AAC) {
-		switch (pri_chan) {
-		case 36:
-		case 40:
-		case 44:
-		case 48:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 42;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 52:
-		case 56:
-		case 60:
-		case 64:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 58;
-				break;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 50;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 100:
-		case 104:
-		case 108:
-		case 112:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 106;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 116:
-		case 120:
-		case 124:
-		case 128:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 122;
-				break;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 114;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 132:
-		case 136:
-		case 140:
-		case 144:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 138;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 149:
-		case 153:
-		case 157:
-		case 161:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 155;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 165:
-		case 169:
-		case 173:
-		case 177:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 171;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 184:
-		case 188:
-		case 192:
-		case 196:
-			if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 190;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		default: /* error. go to the default */
-			center_freq_idx = 42;
+	static const struct center_freq_desc center_freq_idx_map_5g[] = {
+		{.pri_chan = 36, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 40, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 44, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 48, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 52, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 56, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 60, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 64, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 68, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 72, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 76, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 80, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 84, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 88, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 92, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 96, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 100, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 104, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 108, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 112, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 116, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 120, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 124, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 128, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 132, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 136, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 140, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 144, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 149, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 153, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 157, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 161, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 165, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 169, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 173, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 177, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 184, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 188, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 192, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 196, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 0,
+		 .ch_40 = 42 /* terminator with default cfreq */}};
+
+	const struct center_freq_desc *map = MNULL;
+
+	if (band == BAND_5GHZ)
+		map = center_freq_idx_map_5g;
+
+	for (; map != MNULL; map++) {
+		/* reached end of map, return default value for that map */
+		if (map->pri_chan == 0)
+			return map->ch_40;
+
+		if (map->pri_chan == pri_chan) {
+			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
+			    chan_bw == CHANNEL_BW_40MHZ_BELOW)
+				return map->ch_40;
+
+			if (chan_bw == CHANNEL_BW_80MHZ)
+				return map->ch_80;
+
+			if (chan_bw == CHANNEL_BW_160MHZ)
+				return map->ch_160;
 		}
 	}
-	return center_freq_idx;
+
+	return 0;
 }
 
 /**
@@ -235,12 +214,8 @@ static mlan_status wlan_11ac_ioctl_vhtcfg(pmlan_adapter pmadapter,
 	t_u32 cfg_value = 0;
 	t_u32 hw_value = 0;
 	t_u8 nss = 0;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	t_u16 rx_nss = 0;
 	t_u16 tx_nss = 0;
-#endif
 
 	ENTER();
 
@@ -319,11 +294,8 @@ static mlan_status wlan_11ac_ioctl_vhtcfg(pmlan_adapter pmadapter,
 
 		/** update the RX MCS map */
 		if (cfg->param.vht_cfg.txrx & MLAN_RADIO_RX) {
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 			if (IS_CARD9098(pmadapter->card_type) ||
-			    IS_CARDNW62X(pmadapter->card_type) ||
+			    IS_CARDIW62X(pmadapter->card_type) ||
 			    IS_CARD9097(pmadapter->card_type)) {
 				if (cfg->param.vht_cfg.band == BAND_SELECT_A) {
 					rx_nss = GET_RXMCSSUPP(
@@ -342,7 +314,6 @@ static mlan_status wlan_11ac_ioctl_vhtcfg(pmlan_adapter pmadapter,
 						0x0f;
 				}
 			}
-#endif
 			/* use the previous user value */
 			if (cfg->param.vht_cfg.vht_rx_mcs == 0xffffffff)
 				cfg->param.vht_cfg.vht_rx_mcs = GET_VHTMCS(
@@ -353,12 +324,8 @@ static mlan_status wlan_11ac_ioctl_vhtcfg(pmlan_adapter pmadapter,
 				hw_value = GET_DEVNSSRXMCS(
 					pmadapter->hw_dot_11ac_mcs_support,
 					nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 				if ((rx_nss != 0) && (nss > rx_nss))
 					cfg_value = NO_NSS_SUPPORT;
-#endif
 				if ((hw_value == NO_NSS_SUPPORT) ||
 				    (cfg_value == NO_NSS_SUPPORT))
 					SET_VHTNSSMCS(
@@ -381,12 +348,8 @@ static mlan_status wlan_11ac_ioctl_vhtcfg(pmlan_adapter pmadapter,
 				hw_value = GET_DEVNSSTXMCS(
 					pmadapter->hw_dot_11ac_mcs_support,
 					nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 				if ((tx_nss != 0) && (nss > tx_nss))
 					cfg_value = NO_NSS_SUPPORT;
-#endif
 				if ((hw_value == NO_NSS_SUPPORT) ||
 				    (cfg_value == NO_NSS_SUPPORT))
 					SET_VHTNSSMCS(
@@ -807,11 +770,7 @@ void wlan_fill_vht_cap_tlv(mlan_private *priv, MrvlIETypes_VHTCap_t *pvht_cap,
 	t_u16 mcs_user = 0;
 	t_u16 mcs_resp = 0;
 	t_u16 nss;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	t_u16 rx_nss = 0, tx_nss = 0;
-#endif
 	ENTER();
 
 	/* Fill VHT cap info */
@@ -829,11 +788,8 @@ void wlan_fill_vht_cap_tlv(mlan_private *priv, MrvlIETypes_VHTCap_t *pvht_cap,
 	if (flag)
 		mcs_map_resp =
 			wlan_le16_to_cpu(pvht_cap->vht_cap.mcs_sets.rx_mcs_map);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	if (IS_CARD9098(priv->adapter->card_type) ||
-	    IS_CARDNW62X(priv->adapter->card_type) ||
+	    IS_CARDIW62X(priv->adapter->card_type) ||
 	    IS_CARD9097(priv->adapter->card_type)) {
 		if (bands & BAND_A) {
 			rx_nss = GET_RXMCSSUPP(priv->adapter->user_htstream >>
@@ -850,17 +806,12 @@ void wlan_fill_vht_cap_tlv(mlan_private *priv, MrvlIETypes_VHTCap_t *pvht_cap,
 		if (bw_80p80)
 			rx_nss = tx_nss = 1;
 	}
-#endif
 	mcs_map_result = 0;
 	for (nss = 1; nss <= 8; nss++) {
 		mcs_user = GET_VHTNSSMCS(mcs_map_user, nss);
 		mcs_resp = GET_VHTNSSMCS(mcs_map_resp, nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if ((rx_nss != 0) && (nss > rx_nss))
 			mcs_user = NO_NSS_SUPPORT;
-#endif
 		if ((mcs_user == NO_NSS_SUPPORT) ||
 		    (mcs_resp == NO_NSS_SUPPORT))
 			SET_VHTNSSMCS(mcs_map_result, nss, NO_NSS_SUPPORT);
@@ -888,12 +839,8 @@ void wlan_fill_vht_cap_tlv(mlan_private *priv, MrvlIETypes_VHTCap_t *pvht_cap,
 	for (nss = 1; nss <= 8; nss++) {
 		mcs_user = GET_VHTNSSMCS(mcs_map_user, nss);
 		mcs_resp = GET_VHTNSSMCS(mcs_map_resp, nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if ((tx_nss != 0) && (nss > tx_nss))
 			mcs_user = NO_NSS_SUPPORT;
-#endif
 		if ((mcs_user == NO_NSS_SUPPORT) ||
 		    (mcs_resp == NO_NSS_SUPPORT))
 			SET_VHTNSSMCS(mcs_map_result, nss, NO_NSS_SUPPORT);
@@ -1088,7 +1035,7 @@ void wlan_fill_tdls_vht_oprat_ie(mlan_private *priv,
 		break;
 	}
 	vht_oprat->chan_center_freq_1 = wlan_get_center_freq_idx(
-		priv, BAND_AAC, pbss_desc->channel, chan_bw);
+		priv, BAND_5GHZ, pbss_desc->channel, chan_bw);
 
 	LEAVE();
 	return;
@@ -1105,22 +1052,15 @@ void wlan_fill_tdls_vht_oprat_ie(mlan_private *priv,
 t_u8 wlan_is_80_80_support(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc)
 {
 	t_u8 ret = MFALSE;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	t_u16 rx_nss = 0, tx_nss = 0;
 	IEEEtypes_VHTCap_t *pvht_cap = pbss_desc->pvht_cap;
 	MrvlIEtypes_He_cap_t *phecap = MNULL;
 	IEEEtypes_HECap_t *pBsshecap = MNULL;
-#endif
 
 	ENTER();
 
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	if (!IS_CARD9098(pmpriv->adapter->card_type) &&
-	    !IS_CARDNW62X(pmpriv->adapter->card_type) &&
+	    !IS_CARDIW62X(pmpriv->adapter->card_type) &&
 	    !IS_CARD9097(pmpriv->adapter->card_type))
 		return ret;
 	/** check band A */
@@ -1147,7 +1087,6 @@ t_u8 wlan_is_80_80_support(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc)
 		else
 			ret = MFALSE;
 	}
-#endif
 	LEAVE();
 	return ret;
 }
@@ -1171,11 +1110,7 @@ int wlan_cmd_append_11ac_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	t_u16 nss;
 	int ret_len = 0;
 	t_u8 bw_80p80 = MFALSE;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	t_u16 rx_nss = 0;
-#endif
 
 	ENTER();
 
@@ -1243,11 +1178,8 @@ int wlan_cmd_append_11ac_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	} else {
 		/** set default bandwidth:80M*/
 		SET_OPER_MODE_80M(pmrvl_oper_mode->oper_mode);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if (IS_CARD9098(pmadapter->card_type) ||
-		    IS_CARDNW62X(pmadapter->card_type) ||
+		    IS_CARDIW62X(pmadapter->card_type) ||
 		    IS_CARD9097(pmadapter->card_type)) {
 			if (pbss_desc->bss_band & BAND_A)
 				rx_nss = GET_RXMCSSUPP(
@@ -1256,21 +1188,16 @@ int wlan_cmd_append_11ac_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 				rx_nss =
 					GET_RXMCSSUPP(pmadapter->user_htstream);
 		}
-#endif
 		mcs_map_user =
 			GET_DEVRXMCSMAP(pmpriv->usr_dot_11ac_mcs_support);
 		nss = wlan_get_nss_num_vht_mcs(mcs_map_user);
 
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if (IS_CARD9098(pmadapter->card_type) ||
-		    IS_CARDNW62X(pmadapter->card_type) ||
+		    IS_CARDIW62X(pmadapter->card_type) ||
 		    IS_CARD9097(pmadapter->card_type)) {
 			PRINTM(MCMND, "rx_nss=%d nss=%d\n", rx_nss, nss);
 			nss = MIN(rx_nss, nss);
 		}
-#endif
 
 		pmrvl_oper_mode->oper_mode |= (nss - 1) << 4;
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11ax.c b/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
index 38b903d..4599535 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11ax.c
@@ -295,11 +295,7 @@ t_u16 wlan_fill_he_cap_tlv(mlan_private *pmpriv, t_u16 band,
 {
 	pmlan_adapter pmadapter = pmpriv->adapter;
 	t_u16 len = 0;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	t_u16 rx_nss = 0, tx_nss = 0;
-#endif
 	MrvlIEtypes_He_cap_t *phecap = MNULL;
 	t_u8 nss = 0;
 	t_u16 cfg_value = 0;
@@ -325,9 +321,6 @@ t_u16 wlan_fill_he_cap_tlv(mlan_private *pmpriv, t_u16 band,
 	}
 	phe_cap->type = wlan_cpu_to_le16(phe_cap->type);
 	phe_cap->len = wlan_cpu_to_le16(phe_cap->len);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	if (IS_CARD9098(pmpriv->adapter->card_type) ||
 	    IS_CARD9097(pmpriv->adapter->card_type)) {
 		if (band & BAND_AAX) {
@@ -342,17 +335,12 @@ t_u16 wlan_fill_he_cap_tlv(mlan_private *pmpriv, t_u16 band,
 				 0x0f;
 		}
 	}
-#endif
 	phecap = (MrvlIEtypes_He_cap_t *)phe_cap;
 	for (nss = 1; nss <= 8; nss++) {
 		cfg_value = GET_HE_NSSMCS(phecap->rx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->rx_mcs_80, nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if ((rx_nss != 0) && (nss > rx_nss))
 			cfg_value = NO_NSS_SUPPORT;
-#endif
 		if ((hw_value == NO_NSS_SUPPORT) ||
 		    (cfg_value == NO_NSS_SUPPORT))
 			SET_HE_NSSMCS(phecap->rx_mcs_80, nss, NO_NSS_SUPPORT);
@@ -363,12 +351,8 @@ t_u16 wlan_fill_he_cap_tlv(mlan_private *pmpriv, t_u16 band,
 	for (nss = 1; nss <= 8; nss++) {
 		cfg_value = GET_HE_NSSMCS(phecap->tx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->tx_mcs_80, nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if ((tx_nss != 0) && (nss > tx_nss))
 			cfg_value = NO_NSS_SUPPORT;
-#endif
 		if ((hw_value == NO_NSS_SUPPORT) ||
 		    (cfg_value == NO_NSS_SUPPORT))
 			SET_HE_NSSMCS(phecap->tx_mcs_80, nss, NO_NSS_SUPPORT);
@@ -400,11 +384,7 @@ int wlan_cmd_append_11ax_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	MrvlIEtypes_He_cap_t *phecap = MNULL;
 	int len = 0;
 	t_u8 bw_80p80 = MFALSE;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	t_u16 rx_nss = 0, tx_nss = 0;
-#endif
 	t_u8 nss = 0;
 	t_u16 cfg_value = 0;
 	t_u16 hw_value = 0;
@@ -445,11 +425,8 @@ int wlan_cmd_append_11ax_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	}
 	phecap->type = wlan_cpu_to_le16(phecap->type);
 	phecap->len = wlan_cpu_to_le16(phecap->len);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	if (IS_CARD9098(pmpriv->adapter->card_type) ||
-	    IS_CARDNW62X(pmpriv->adapter->card_type) ||
+	    IS_CARDIW62X(pmpriv->adapter->card_type) ||
 	    IS_CARD9097(pmpriv->adapter->card_type)) {
 		if (pbss_desc->bss_band & band_selected) {
 			rx_nss = GET_RXMCSSUPP(pmpriv->adapter->user_htstream >>
@@ -466,16 +443,11 @@ int wlan_cmd_append_11ax_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 		if (bw_80p80)
 			rx_nss = tx_nss = 1;
 	}
-#endif
 	for (nss = 1; nss <= 8; nss++) {
 		cfg_value = GET_HE_NSSMCS(phecap->rx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->rx_mcs_80, nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if ((rx_nss != 0) && (nss > rx_nss))
 			cfg_value = NO_NSS_SUPPORT;
-#endif
 		if ((hw_value == NO_NSS_SUPPORT) ||
 		    (cfg_value == NO_NSS_SUPPORT))
 			SET_HE_NSSMCS(phecap->rx_mcs_80, nss, NO_NSS_SUPPORT);
@@ -486,12 +458,8 @@ int wlan_cmd_append_11ax_tlv(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 	for (nss = 1; nss <= 8; nss++) {
 		cfg_value = GET_HE_NSSMCS(phecap->tx_mcs_80, nss);
 		hw_value = GET_HE_NSSMCS(phw_hecap->tx_mcs_80, nss);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if ((tx_nss != 0) && (nss > tx_nss))
 			cfg_value = NO_NSS_SUPPORT;
-#endif
 		if ((hw_value == NO_NSS_SUPPORT) ||
 		    (cfg_value == NO_NSS_SUPPORT))
 			SET_HE_NSSMCS(phecap->tx_mcs_80, nss, NO_NSS_SUPPORT);
@@ -1071,6 +1039,7 @@ mlan_status wlan_cmd_twt_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	mlan_ds_twtcfg *ds_twtcfg = (mlan_ds_twtcfg *)pdata_buf;
 	hostcmd_twt_setup *twt_setup_params = MNULL;
 	hostcmd_twt_teardown *twt_teardown_params = MNULL;
+	hostcmd_twt_report *twt_report_params = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -1123,6 +1092,13 @@ mlan_status wlan_cmd_twt_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 			ds_twtcfg->param.twt_teardown.teardown_all_twt;
 		cmd->size += sizeof(hostcmd_twtcfg->param.twt_teardown);
 		break;
+	case MLAN_11AX_TWT_REPORT_SUBID:
+		twt_report_params = &hostcmd_twtcfg->param.twt_report;
+		memset(pmpriv->adapter, twt_report_params, 0x00,
+		       sizeof(hostcmd_twtcfg->param.twt_report));
+		twt_report_params->type = ds_twtcfg->param.twt_report.type;
+		cmd->size += sizeof(hostcmd_twtcfg->param.twt_report);
+		break;
 	default:
 		PRINTM(MERROR, "Unknown subcmd %x\n", ds_twtcfg->sub_id);
 		ret = MLAN_STATUS_FAILURE;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11h.c b/mxm_wifiex/wlan_src/mlan/mlan_11h.c
index 78be434..f5d8ea6 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11h.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11h.c
@@ -279,7 +279,7 @@ t_void wlan_11h_set_chan_dfs_state(mlan_private *priv, t_u8 chan, t_u8 bw,
 				   dfs_state_t dfs_state)
 {
 	t_u8 n_chan;
-	t_u8 chan_list[4];
+	t_u8 chan_list[4] = {0};
 	t_u8 i;
 	n_chan = woal_get_bonded_channels(chan, bw, chan_list);
 	for (i = 0; i < n_chan; i++)
@@ -1369,14 +1369,12 @@ wlan_11h_prepare_custom_ie_chansw(mlan_adapter *pmadapter,
 					    sizeof(mlan_ioctl_req));
 
 	/* prepare mlan_ioctl_req */
-	memset(pmadapter, pioctl_req, 0x00, sizeof(mlan_ioctl_req));
 	pioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
 	pioctl_req->action = MLAN_ACT_SET;
 	pioctl_req->pbuf = (t_u8 *)pds_misc_cfg;
 	pioctl_req->buf_len = sizeof(mlan_ds_misc_cfg);
 
 	/* prepare mlan_ds_misc_cfg */
-	memset(pmadapter, pds_misc_cfg, 0x00, sizeof(mlan_ds_misc_cfg));
 	pds_misc_cfg->sub_command = MLAN_OID_MISC_CUSTOM_IE;
 	pds_misc_cfg->param.cust_ie.type = TLV_TYPE_MGMT_IE;
 	pds_misc_cfg->param.cust_ie.len = (sizeof(custom_ie) - MAX_IE_SIZE);
@@ -1731,9 +1729,6 @@ static mlan_status wlan_11h_add_dfs_timestamp(mlan_adapter *pmadapter,
 			return MLAN_STATUS_FAILURE;
 		}
 
-		memset(pmadapter, (t_u8 *)pdfs_ts, 0,
-		       sizeof(wlan_dfs_timestamp_t));
-
 		util_enqueue_list_tail(pmadapter->pmoal_handle,
 				       &pmadapter->state_dfs.dfs_ts_head,
 				       (pmlan_linked_list)pdfs_ts, MNULL,
@@ -1772,7 +1767,7 @@ static void wlan_11h_add_all_dfs_timestamp(mlan_adapter *pmadapter, t_u8 repr,
 					   t_u8 channel, t_u8 bandwidth)
 {
 	t_u8 n_chan;
-	t_u8 chan_list[4];
+	t_u8 chan_list[4] = {0};
 	t_u8 i;
 	n_chan = woal_get_bonded_channels(channel, bandwidth, chan_list);
 	for (i = 0; i < n_chan; i++)
@@ -2764,8 +2759,9 @@ t_s32 wlan_11h_process_start(mlan_private *priv, t_u8 **ppbuffer,
 				return ret;
 			}
 #ifdef STA_SUPPORT
-			wlan_11d_create_dnld_countryinfo(
-				priv, adapter->adhoc_start_band);
+			if (wlan_11d_create_dnld_countryinfo(
+				    priv, adapter->adhoc_start_band))
+				PRINTM(MERROR, "Dnld_countryinfo_11d failed\n");
 #endif
 		}
 
@@ -3421,7 +3417,10 @@ mlan_status wlan_11h_ioctl_channel_nop_info(pmlan_adapter pmadapter,
 				if (ch_nop_info->chan_width == CHAN_BW_80MHZ)
 					ch_nop_info->new_chan.center_chan =
 						wlan_get_center_freq_idx(
-							pmpriv, BAND_AAC,
+							pmpriv,
+							ch_nop_info->new_chan
+								.bandcfg
+								.chanBand,
 							ch_nop_info->new_chan
 								.channel,
 							ch_nop_info->chan_width);
@@ -4076,7 +4075,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_STOP_TRAFFIC;
 		/* fall through */
-		fallthrough;
 
 	case RDH_STOP_TRAFFIC:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s\n", __func__,
@@ -4090,7 +4088,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_GET_INFO_CHANNEL;
 		/* fall through */
-		fallthrough;
 
 	case RDH_GET_INFO_CHANNEL:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s, priv_idx=%d\n", __func__,
@@ -4207,7 +4204,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_GET_INFO_BEACON_DTIM;
 		/* fall through */
-		fallthrough;
 
 	case RDH_GET_INFO_BEACON_DTIM:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s, priv_idx=%d\n", __func__,
@@ -4283,7 +4279,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_SET_CUSTOM_IE;
 		/* fall through */
-		fallthrough;
 
 	case RDH_SET_CUSTOM_IE:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s, priv_idx=%d\n", __func__,
@@ -4335,7 +4330,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_REM_CUSTOM_IE;
 		/* fall through */
-		fallthrough;
 
 	case RDH_REM_CUSTOM_IE:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s, priv_idx=%d\n", __func__,
@@ -4403,7 +4397,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_STOP_INTFS;
 		/* fall through */
-		fallthrough;
 
 	case RDH_STOP_INTFS:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s, priv_idx=%d\n", __func__,
@@ -4458,7 +4451,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 			goto rdh_restart_intfs; /* skip next stage */
 		}
 		/* fall through */
-		fallthrough;
 
 	case RDH_SET_NEW_CHANNEL:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s, priv_idx=%d\n", __func__,
@@ -4501,7 +4493,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_RESTART_INTFS;
 		/* fall through */
-		fallthrough;
 
 	case RDH_RESTART_INTFS:
 	rdh_restart_intfs:
@@ -4596,7 +4587,6 @@ mlan_status wlan_11h_radar_detected_handling(mlan_adapter *pmadapter,
 		pstate_rdh->priv_curr_idx = RDH_STAGE_FIRST_ENTRY_PRIV_IDX;
 		pstate_rdh->stage = RDH_RESTART_TRAFFIC;
 		/* fall through */
-		fallthrough;
 
 	case RDH_RESTART_TRAFFIC:
 		PRINTM(MCMD_D, "%s(): stage(%d)=%s\n", __func__,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n.c b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
index 473f5c4..ce5e49b 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n.c
@@ -1526,14 +1526,12 @@ void wlan_fill_ht_cap_tlv(mlan_private *priv, MrvlIETypes_HTCap_t *pht_cap,
 
 	/* Set ampdu param */
 	SETAMPDU_SIZE(pht_cap->ht_cap.ampdu_param, AMPDU_FACTOR_64K);
-	SETAMPDU_SPACING(pht_cap->ht_cap.ampdu_param, 0);
+	SETAMPDU_SPACING(pht_cap->ht_cap.ampdu_param,
+			 pmadapter->hw_mpdu_density);
 
 	rx_mcs_supp = GET_RXMCSSUPP(priv->usr_dev_mcs_support);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	if (IS_CARD9098(pmadapter->card_type) ||
-	    IS_CARDNW62X(pmadapter->card_type) ||
+	    IS_CARDIW62X(pmadapter->card_type) ||
 	    IS_CARD9097(pmadapter->card_type)) {
 		if (bands & BAND_A)
 			rx_mcs_supp = MIN(
@@ -1544,7 +1542,6 @@ void wlan_fill_ht_cap_tlv(mlan_private *priv, MrvlIETypes_HTCap_t *pht_cap,
 				MIN(rx_mcs_supp,
 				    GET_RXMCSSUPP(pmadapter->user_htstream));
 	}
-#endif
 	memset(pmadapter, (t_u8 *)pht_cap->ht_cap.supported_mcs_set, 0xff,
 	       rx_mcs_supp);
 	/* Clear all the other values to get the minimum mcs set btw STA and AP
@@ -1606,11 +1603,8 @@ void wlan_fill_ht_cap_ie(mlan_private *priv, IEEEtypes_HTCap_t *pht_cap,
 	SETAMPDU_SPACING(pht_cap->ht_cap.ampdu_param, 0);
 
 	rx_mcs_supp = GET_RXMCSSUPP(priv->usr_dev_mcs_support);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	if (IS_CARD9098(pmadapter->card_type) ||
-	    IS_CARDNW62X(pmadapter->card_type) ||
+	    IS_CARDIW62X(pmadapter->card_type) ||
 	    IS_CARD9097(pmadapter->card_type)) {
 		if (bands & BAND_A)
 			rx_mcs_supp = MIN(
@@ -1621,7 +1615,6 @@ void wlan_fill_ht_cap_ie(mlan_private *priv, IEEEtypes_HTCap_t *pht_cap,
 				MIN(rx_mcs_supp,
 				    GET_RXMCSSUPP(pmadapter->user_htstream));
 	}
-#endif
 	memset(pmadapter, (t_u8 *)pht_cap->ht_cap.supported_mcs_set, 0xff,
 	       rx_mcs_supp);
 	/* Clear all the other values to get the minimum mcs set btw STA and AP
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c b/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
index 60a6bfc..1151166 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n_aggr.c
@@ -120,8 +120,6 @@ static void wlan_11n_form_amsdu_txpd(mlan_private *priv, mlan_buffer *mbuf)
 	 * Original priority has been overwritten
 	 */
 	ptx_pd->priority = (t_u8)mbuf->priority;
-	ptx_pd->pkt_delay_2ms =
-		wlan_wmm_compute_driver_packet_delay(priv, mbuf);
 	ptx_pd->bss_num = GET_BSS_NUM(priv);
 	ptx_pd->bss_type = priv->bss_type;
 	/* Always zero as the data is followed by TxPD */
@@ -156,6 +154,9 @@ static INLINE void wlan_11n_update_pktlen_amsdu_txpd(mlan_private *priv,
 	ptx_pd = (TxPD *)mbuf->pbuf;
 	ptx_pd->tx_pkt_length =
 		(t_u16)wlan_cpu_to_le16(mbuf->data_len - sizeof(TxPD));
+	ptx_pd->pkt_delay_2ms =
+		wlan_wmm_compute_driver_packet_delay(priv, mbuf);
+
 #ifdef STA_SUPPORT
 	if ((GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) &&
 	    (priv->adapter->pps_uapsd_mode)) {
@@ -410,7 +411,6 @@ mlan_status wlan_11n_deaggregate_pkt(mlan_private *priv, pmlan_buffer pmbuf)
 			PRINTM(MERROR, "Deaggr, send to moal failed\n");
 			daggr_mbuf->status_code = MLAN_ERROR_PKT_INVALID;
 			/* fall through */
-			fallthrough;
 		case MLAN_STATUS_SUCCESS:
 			wlan_recv_packet_complete(pmadapter, daggr_mbuf, ret);
 			break;
@@ -495,6 +495,8 @@ int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
 		pmbuf_aggr->data_offset = 0;
 		pmbuf_aggr->in_ts_sec = pmbuf_src->in_ts_sec;
 		pmbuf_aggr->in_ts_usec = pmbuf_src->in_ts_usec;
+		pmbuf_aggr->extra_ts_sec = pmbuf_src->extra_ts_sec;
+		pmbuf_aggr->extra_ts_usec = pmbuf_src->extra_ts_usec;
 		if (pmbuf_src->flags & MLAN_BUF_FLAG_TDLS)
 			pmbuf_aggr->flags |= MLAN_BUF_FLAG_TDLS;
 		if (pmbuf_src->flags & MLAN_BUF_FLAG_TCP_ACK)
@@ -523,7 +525,7 @@ int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
 		/* Collects TP statistics */
 		if (pmadapter->tp_state_on && (pkt_size > sizeof(TxPD)))
 			pmadapter->callbacks.moal_tp_accounting(
-				pmadapter->pmoal_handle, pmbuf_src->pdesc, 3);
+				pmadapter->pmoal_handle, pmbuf_src, 3);
 		pra_list->total_pkts--;
 
 		/* decrement for every PDU taken from the list */
@@ -671,5 +673,5 @@ int wlan_11n_aggregate_pkt(mlan_private *priv, raListTbl *pra_list,
 
 exit:
 	LEAVE();
-	return pkt_size + headroom;
+	return MIN((pkt_size + headroom), INT_MAX);
 }
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c b/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
index 27b94bf..023700e 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_11n_rxreorder.c
@@ -134,13 +134,14 @@ static mlan_status wlan_11n_dispatch_pkt(t_void *priv, t_void *payload,
 static void mlan_11n_rxreorder_timer_restart(pmlan_adapter pmadapter,
 					     RxReorderTbl *rx_reor_tbl_ptr)
 {
-	t_u16 min_flush_time = 0;
+	t_u16 min_flush_time = DEF_FLUSH_TIME_AC_BE_BK;
+	mlan_wmm_ac_e wmm_ac;
 	ENTER();
 
-	if (rx_reor_tbl_ptr->win_size >= 32)
-		min_flush_time = MIN_FLUSH_TIMER_15_MS;
-	else
-		min_flush_time = MIN_FLUSH_TIMER_MS;
+	wmm_ac = wlan_wmm_convert_tos_to_ac(pmadapter, rx_reor_tbl_ptr->tid);
+	if ((WMM_AC_VI == wmm_ac) || (WMM_AC_VO == wmm_ac)) {
+		min_flush_time = DEF_FLUSH_TIME_AC_VI_VO;
+	}
 
 	if (rx_reor_tbl_ptr->timer_context.timer_is_set)
 		pmadapter->callbacks.moal_stop_timer(
@@ -149,7 +150,7 @@ static void mlan_11n_rxreorder_timer_restart(pmlan_adapter pmadapter,
 
 	pmadapter->callbacks.moal_start_timer(
 		pmadapter->pmoal_handle, rx_reor_tbl_ptr->timer_context.timer,
-		MFALSE, (rx_reor_tbl_ptr->win_size * min_flush_time));
+		MFALSE, min_flush_time);
 
 	rx_reor_tbl_ptr->timer_context.timer_is_set = MTRUE;
 	LEAVE();
@@ -168,7 +169,7 @@ static void mlan_11n_rxreorder_timer_restart(pmlan_adapter pmadapter,
 static mlan_status wlan_11n_dispatch_pkt_until_start_win(
 	t_void *priv, RxReorderTbl *rx_reor_tbl_ptr, int start_win)
 {
-	int no_pkt_to_send, i, xchg;
+	t_u32 no_pkt_to_send, i, xchg;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	void *rx_tmp_ptr = MNULL;
 	mlan_private *pmpriv = (mlan_private *)priv;
@@ -208,6 +209,9 @@ static mlan_status wlan_11n_dispatch_pkt_until_start_win(
 		rx_reor_tbl_ptr->rx_reorder_ptr[no_pkt_to_send + i] = MNULL;
 	}
 
+	/* clear the bits of reorder bitmap that has been dispatched */
+	rx_reor_tbl_ptr->bitmap = rx_reor_tbl_ptr->bitmap >> no_pkt_to_send;
+
 	rx_reor_tbl_ptr->start_win = start_win;
 	pmpriv->adapter->callbacks.moal_spin_unlock(
 		pmpriv->adapter->pmoal_handle, pmpriv->rx_pkt_lock);
@@ -286,6 +290,9 @@ static mlan_status wlan_11n_scan_and_dispatch(t_void *priv,
 		}
 	}
 
+	/* clear the bits of reorder bitmap that has been dispatched */
+	rx_reor_tbl_ptr->bitmap = rx_reor_tbl_ptr->bitmap >> i;
+
 	rx_reor_tbl_ptr->start_win =
 		(rx_reor_tbl_ptr->start_win + i) & (MAX_TID_VALUE - 1);
 
@@ -517,6 +524,8 @@ static t_void wlan_11n_create_rxreorder_tbl(mlan_private *priv, t_u8 *ta,
 	new_node->win_size = win_size;
 	new_node->force_no_drop = MFALSE;
 	new_node->check_start_win = MTRUE;
+	new_node->bitmap = 0;
+
 	new_node->ba_status = BA_STREAM_SETUP_INPROGRESS;
 	for (i = 0; i < win_size; ++i)
 		new_node->rx_reorder_ptr[i] = MNULL;
@@ -640,7 +649,7 @@ mlan_status wlan_cmd_11n_addba_rspgen(mlan_private *priv,
 	HostCmd_DS_11N_ADDBA_REQ *pevt_addba_req =
 		(HostCmd_DS_11N_ADDBA_REQ *)pdata_buf;
 	t_u8 tid = 0;
-	int win_size = 0;
+	t_u32 win_size = 0;
 
 	ENTER();
 
@@ -685,21 +694,26 @@ mlan_status wlan_cmd_11n_addba_rspgen(mlan_private *priv,
 	else
 		padd_ba_rsp->status_code =
 			wlan_cpu_to_le16(ADDBA_RSP_STATUS_ACCEPT);
+
+	win_size = (padd_ba_rsp->block_ack_param_set &
+		    BLOCKACKPARAM_WINSIZE_MASK) >>
+		   BLOCKACKPARAM_WINSIZE_POS;
+
 	padd_ba_rsp->block_ack_param_set &= ~BLOCKACKPARAM_WINSIZE_MASK;
 	if (!priv->add_ba_param.rx_amsdu)
 		/* We do not support AMSDU inside AMPDU, hence reset the bit */
 		padd_ba_rsp->block_ack_param_set &=
 			~BLOCKACKPARAM_AMSDU_SUPP_MASK;
 
-	padd_ba_rsp->block_ack_param_set |=
-		(priv->add_ba_param.rx_win_size << BLOCKACKPARAM_WINSIZE_POS);
-	win_size = (padd_ba_rsp->block_ack_param_set &
-		    BLOCKACKPARAM_WINSIZE_MASK) >>
-		   BLOCKACKPARAM_WINSIZE_POS;
+	/*cert failure observed due to BA setup failure
+	 if win_size requested from client is 0 */
+	if (win_size)
+		win_size = MIN(win_size, priv->add_ba_param.rx_win_size);
+	else
+		win_size = priv->add_ba_param.rx_win_size;
 
-	if (win_size == 0)
-		padd_ba_rsp->status_code =
-			wlan_cpu_to_le16(ADDBA_RSP_STATUS_DECLINED);
+	padd_ba_rsp->block_ack_param_set |= win_size
+					    << BLOCKACKPARAM_WINSIZE_POS;
 
 	padd_ba_rsp->block_ack_param_set =
 		wlan_cpu_to_le16(padd_ba_rsp->block_ack_param_set);
@@ -960,6 +974,8 @@ mlan_status mlan_11n_rxreorder_pkt(void *priv, t_u16 seq_num, t_u16 tid,
 				rx_reor_tbl_ptr
 					->rx_reorder_ptr[seq_num - start_win] =
 					payload;
+				MLAN_SET_BIT(rx_reor_tbl_ptr->bitmap,
+					     seq_num - start_win);
 			} else { /* Wrap condition */
 				if (rx_reor_tbl_ptr
 					    ->rx_reorder_ptr[(seq_num +
@@ -973,6 +989,9 @@ mlan_status mlan_11n_rxreorder_pkt(void *priv, t_u16 seq_num, t_u16 tid,
 					->rx_reorder_ptr[(seq_num +
 							  (MAX_TID_VALUE)) -
 							 start_win] = payload;
+				MLAN_SET_BIT(rx_reor_tbl_ptr->bitmap,
+					     (seq_num + (MAX_TID_VALUE)) -
+						     start_win);
 			}
 		}
 
@@ -988,11 +1007,20 @@ mlan_status mlan_11n_rxreorder_pkt(void *priv, t_u16 seq_num, t_u16 tid,
 	}
 
 done:
-	if (!rx_reor_tbl_ptr->timer_context.timer_is_set ||
-	    (prev_start_win != rx_reor_tbl_ptr->start_win)) {
-		mlan_11n_rxreorder_timer_restart(pmadapter, rx_reor_tbl_ptr);
+	if (rx_reor_tbl_ptr->bitmap == 0) {
+		if (rx_reor_tbl_ptr->timer_context.timer_is_set) {
+			pmadapter->callbacks.moal_stop_timer(
+				pmadapter->pmoal_handle,
+				rx_reor_tbl_ptr->timer_context.timer);
+			rx_reor_tbl_ptr->timer_context.timer_is_set = MFALSE;
+		}
+	} else {
+		if (!rx_reor_tbl_ptr->timer_context.timer_is_set ||
+		    (prev_start_win != rx_reor_tbl_ptr->start_win)) {
+			mlan_11n_rxreorder_timer_restart(pmadapter,
+							 rx_reor_tbl_ptr);
+		}
 	}
-
 	LEAVE();
 	return ret;
 }
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
index f981114..e9be852 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cfp.c
@@ -5,7 +5,7 @@
  *  related code
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -32,6 +32,7 @@
 #include "mlan_fw.h"
 #include "mlan_join.h"
 #include "mlan_main.h"
+#include "mlan_11h.h"
 
 /********************************************************
  *			Local Variables
@@ -87,7 +88,7 @@ static country_code_mapping_t country_code_mapping[] = {
 	{"IN", 0x10, 0x06}, /* India       */
 	{"MY", 0x30, 0x06}, /* Malaysia    */
 	{"NZ", 0x30, 0x30}, /* New Zeland  */
-	{"MX", 0x10, 0x07}, /* Mexico */
+	{"MX", 0x30, 0x07}, /* Mexico */
 };
 
 /** Country code for ETSI */
@@ -2458,11 +2459,12 @@ static oper_bw_chan *wlan_get_nonglobal_operclass_table(mlan_private *pmpriv,
  *  @param pmpriv             A pointer to mlan_private structure
  *  @param channel            Channel number
  *  @param oper_class         operating class
+ *  @param bandwidth          band width
  *
  *  @return                   MLAN_STATUS_PENDING --success, otherwise fail
  */
 mlan_status wlan_check_operclass_validation(mlan_private *pmpriv, t_u8 channel,
-					    t_u8 oper_class)
+					    t_u8 oper_class, t_u8 bandwidth)
 {
 	int arraysize = 0, i = 0, channum = 0;
 	oper_bw_chan *poper_bw_chan = MNULL;
@@ -2485,7 +2487,7 @@ mlan_status wlan_check_operclass_validation(mlan_private *pmpriv, t_u8 channel,
 	}
 	if (oper_class >= 128) {
 		center_freq_idx = wlan_get_center_freq_idx(
-			pmpriv, BAND_AAC, channel, CHANNEL_BW_80MHZ);
+			pmpriv, BAND_5GHZ, channel, CHANNEL_BW_80MHZ);
 		channel = center_freq_idx;
 	}
 	poper_bw_chan = wlan_get_nonglobal_operclass_table(pmpriv, &arraysize);
@@ -2555,7 +2557,7 @@ mlan_status wlan_get_curr_oper_class(mlan_private *pmpriv, t_u8 channel,
 	}
 	if (bw == BW_80MHZ) {
 		center_freq_idx = wlan_get_center_freq_idx(
-			pmpriv, BAND_AAC, channel, CHANNEL_BW_80MHZ);
+			pmpriv, BAND_5GHZ, channel, CHANNEL_BW_80MHZ);
 		channel = center_freq_idx;
 	}
 
@@ -2593,14 +2595,16 @@ mlan_status wlan_get_curr_oper_class(mlan_private *pmpriv, t_u8 channel,
 int wlan_add_supported_oper_class_ie(mlan_private *pmpriv, t_u8 **pptlv_out,
 				     t_u8 curr_oper_class)
 {
-	t_u8 oper_class_us[] = {1,  2,	3,  4,	5,  12, 22, 23,	 24,  25, 26,
-				27, 28, 29, 30, 31, 32, 33, 128, 129, 130};
-	t_u8 oper_class_eu[] = {1, 2,  3,  4,  5,  6,	7,   8,
-				9, 10, 11, 12, 17, 128, 129, 130};
-	t_u8 oper_class_jp[] = {1,  30, 31, 32, 33,  34,  35, 36,
-				37, 38, 39, 40, 41,  42,  43, 44,
-				45, 56, 57, 58, 128, 129, 130};
-	t_u8 oper_class_cn[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 128, 129, 130};
+	t_u8 oper_class_us[] = {115, 118, 124, 121, 125, 81,  116,
+				119, 122, 126, 126, 117, 120, 123,
+				127, 127, 83,  84,  128, 129, 130};
+	t_u8 oper_class_eu[] = {115, 118, 121, 81, 116, 119, 122, 117,
+				120, 123, 83,  84, 125, 128, 129, 130};
+	t_u8 oper_class_jp[] = {115, 81,  82,  118, 118, 121, 121, 116,
+				119, 119, 122, 122, 117, 120, 120, 123,
+				123, 83,  84,  121, 128, 129, 130};
+	t_u8 oper_class_cn[] = {115, 118, 125, 116, 119, 126,
+				81,  83,  84,  128, 129, 130};
 	t_u8 country_code[][COUNTRY_CODE_LEN] = {"US", "JP", "CN"};
 	int country_id = 0, ret = 0;
 	MrvlIETypes_SuppOperClass_t *poper_class = MNULL;
@@ -2710,11 +2714,12 @@ mlan_status wlan_set_regiontable(mlan_private *pmpriv, t_u8 region, t_u16 band)
 
 		if ((j < MAX_REGION_CHANNEL_NUM) &&
 		    (region_chan_old[j].valid == MTRUE)) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no,
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
 					      region_chan_old[j].pcfp,
 					      region_chan_old[j].num_cfp);
 		} else if (cfp) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no, MNULL, 0);
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
+					      MNULL, 0);
 		}
 		i++;
 	}
@@ -2742,11 +2747,12 @@ mlan_status wlan_set_regiontable(mlan_private *pmpriv, t_u8 region, t_u16 band)
 				break;
 		}
 		if ((j < MAX_REGION_CHANNEL_NUM) && region_chan_old[j].valid) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no,
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
 					      region_chan_old[j].pcfp,
 					      region_chan_old[j].num_cfp);
 		} else if (cfp) {
-			wlan_cfp_copy_dynamic(pmadapter, cfp, cfp_no, MNULL, 0);
+			wlan_cfp_copy_dynamic(pmadapter, cfp, (t_u8)cfp_no,
+					      MNULL, 0);
 		}
 		i++;
 	}
@@ -3699,6 +3705,13 @@ mlan_status wlan_get_cfpinfo(pmlan_adapter pmadapter,
 		ret = MLAN_STATUS_FAILURE;
 		goto out;
 	}
+	ret = wlan_11h_ioctl_nop_channel_list(pmadapter, pioctl_req);
+	if (ret) {
+		PRINTM(MERROR,
+		       "cfpinfo wlan_11h_ioctl_nop_channel_list failed!\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto out;
+	}
 	/* Calculate the total response size required to return region,
 	 * country codes, cfp tables and power tables
 	 */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
index 8755c4b..499f7bc 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
@@ -403,9 +403,13 @@ static t_void wlan_dump_info(mlan_adapter *pmadapter, t_u8 reason)
 				pcmd_buf = pcmd_node->cmdbuf->pbuf +
 					   pcmd_node->cmdbuf->data_offset +
 					   pmadapter->ops.intf_header_len;
-				for (i = 0; i < 16; i++)
-					PRINTM(MERROR, "%02x ", *pcmd_buf++);
-				PRINTM(MERROR, "\n");
+				if ((pmadapter->ops.intf_header_len + 16) >
+				    pcmd_node->cmdbuf->data_len) {
+					for (i = 0; i < 16; i++)
+						PRINTM(MERROR, "%02x ",
+						       *pcmd_buf++);
+					PRINTM(MERROR, "\n");
+				}
 			}
 #endif
 			pmpriv = pcmd_node->priv;
@@ -1489,12 +1493,18 @@ static mlan_status wlan_dnld_sleep_confirm_cmd(mlan_adapter *pmadapter)
 		}
 #endif /* STA_SUPPORT */
 
-		PRINTM_NETINTF(MEVENT, pmpriv);
 #define NUM_SC_PER_LINE 16
-		if (++i % NUM_SC_PER_LINE == 0)
-			PRINTM(MEVENT, "+\n");
-		else
-			PRINTM(MEVENT, "+");
+		if (++i % NUM_SC_PER_LINE == 0) {
+			if (pmadapter->second_mac)
+				PRINTM(MEVENT, "++\n");
+			else
+				PRINTM(MEVENT, "+\n");
+		} else {
+			if (pmadapter->second_mac)
+				PRINTM(MEVENT, "++");
+			else
+				PRINTM(MEVENT, "+");
+		}
 	}
 
 done:
@@ -1597,7 +1607,6 @@ mlan_status wlan_alloc_cmd_buffer(mlan_adapter *pmadapter)
 	}
 
 	pmadapter->cmd_pool = pcmd_array;
-	memset(pmadapter, pmadapter->cmd_pool, 0, buf_size);
 
 #if defined(PCIE) || defined(SDIO)
 	if (!IS_USB(pmadapter->card_type)) {
@@ -2310,9 +2319,7 @@ mlan_status wlan_process_cmdresp(mlan_adapter *pmadapter)
 		if (IS_PCIE(pmadapter->card_type) &&
 		    cmdresp_no == HostCmd_CMD_FUNC_SHUTDOWN &&
 		    pmadapter->pwarm_reset_ioctl_req) {
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 			if (pmadapter->pcard_pcie->reg->use_adma)
-#endif
 				wlan_pcie_init_fw(pmadapter);
 		}
 #endif
@@ -2435,9 +2442,12 @@ t_void wlan_cmd_timeout_func(t_void *function_context)
 		pcmd_buf = pcmd_node->cmdbuf->pbuf +
 			   pcmd_node->cmdbuf->data_offset +
 			   pmadapter->ops.intf_header_len;
-		for (i = 0; i < 16; i++)
-			PRINTM(MERROR, "%02x ", *pcmd_buf++);
-		PRINTM(MERROR, "\n");
+		if ((pmadapter->ops.intf_header_len + 16) <
+		    pcmd_node->cmdbuf->data_len) {
+			for (i = 0; i < 16; i++)
+				PRINTM(MERROR, "%02x ", *pcmd_buf++);
+			PRINTM(MERROR, "\n");
+		}
 	}
 #endif
 #ifdef PCIE
@@ -2892,6 +2902,466 @@ t_void wlan_fill_hal_wifi_rate(pmlan_private pmpriv, mlan_wifi_rate *pmlan_rate,
 	LEAVE();
 }
 
+/**
+ *  @brief This function prepares command of ftm config session params.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param cmd_oid      OID: CONFIG or CANCEL
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_802_11_ftm_config_session_params(pmlan_private pmpriv,
+						      HostCmd_DS_COMMAND *cmd,
+						      t_u16 cmd_action,
+						      t_u32 cmd_oid,
+						      t_void *pdata_buf)
+{
+	HostCmd_DS_FTM_CONFIG_SESSION_PARAMS *ftm_config =
+		&cmd->params.ftm_config;
+	t_u8 *tlv = MNULL;
+	mlan_rtt_config_params *rtt_params = MNULL;
+	MrvlIEtypes_RTTRangeRequest_t *tlv_rtt_rr = MNULL;
+	mlan_rtt_cancel_params *rtt_cancel = MNULL;
+	MrvlIEtypes_RTTRangeCancel_t *tlv_rtt_rc = MNULL;
+	t_u32 i = 0;
+
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS);
+	cmd->size = S_DS_GEN + sizeof(HostCmd_DS_FTM_CONFIG_SESSION_PARAMS);
+
+	ftm_config->action = wlan_cpu_to_le16(HostCmd_ACT_GEN_SET);
+	tlv = ftm_config->tlv_buffer;
+
+	if (cmd_oid == OID_RTT_REQUEST) {
+		rtt_params = (mlan_rtt_config_params *)pdata_buf;
+		for (i = 0; i < rtt_params->rtt_config_num; i++) {
+			tlv_rtt_rr = (MrvlIEtypes_RTTRangeRequest_t *)tlv;
+			tlv_rtt_rr->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_RTT_RANGE_REQUEST);
+			tlv_rtt_rr->header.len =
+				wlan_cpu_to_le16((sizeof(*tlv_rtt_rr) -
+						  sizeof(MrvlIEtypesHeader_t)));
+			memcpy_ext(pmpriv->adapter, tlv_rtt_rr->addr,
+				   rtt_params->rtt_config[i].addr,
+				   sizeof(rtt_params->rtt_config[i].addr),
+				   sizeof(tlv_rtt_rr->addr));
+			tlv_rtt_rr->type = rtt_params->rtt_config[i].type;
+			tlv_rtt_rr->peer = rtt_params->rtt_config[i].peer;
+			tlv_rtt_rr->channel = rtt_params->rtt_config[i].channel;
+			tlv_rtt_rr->bandcfg = rtt_params->rtt_config[i].bandcfg;
+			tlv_rtt_rr->burst_period =
+				rtt_params->rtt_config[i].burst_period;
+			tlv_rtt_rr->num_burst =
+				rtt_params->rtt_config[i].num_burst;
+			tlv_rtt_rr->num_frames_per_burst =
+				rtt_params->rtt_config[i].num_frames_per_burst;
+			tlv_rtt_rr->num_retries_per_rtt_frame =
+				rtt_params->rtt_config[i]
+					.num_retries_per_rtt_frame;
+			tlv_rtt_rr->num_retries_per_ftmr =
+				rtt_params->rtt_config[i].num_retries_per_ftmr;
+			tlv_rtt_rr->LCI_request =
+				rtt_params->rtt_config[i].LCI_request;
+			tlv_rtt_rr->LCR_request =
+				rtt_params->rtt_config[i].LCR_request;
+			tlv_rtt_rr->burst_duration =
+				rtt_params->rtt_config[i].burst_duration;
+			tlv_rtt_rr->preamble =
+				rtt_params->rtt_config[i].preamble;
+			tlv_rtt_rr->bw = rtt_params->rtt_config[i].bw;
+			cmd->size += sizeof(*tlv_rtt_rr);
+			tlv += sizeof(*tlv_rtt_rr);
+		}
+	} else if (cmd_oid == OID_RTT_CANCEL) {
+		rtt_cancel = (mlan_rtt_cancel_params *)pdata_buf;
+		for (i = 0; i < rtt_cancel->rtt_cancel_num; i++) {
+			tlv_rtt_rc = (MrvlIEtypes_RTTRangeCancel_t *)tlv;
+			tlv_rtt_rc->header.type =
+				wlan_cpu_to_le16(TLV_TYPE_RTT_RANGE_CANCEL);
+			tlv_rtt_rc->header.len =
+				wlan_cpu_to_le16(sizeof(*tlv_rtt_rc) -
+						 sizeof(MrvlIEtypesHeader_t));
+			memcpy_ext(pmpriv->adapter, tlv_rtt_rc->addr,
+				   rtt_cancel->rtt_cancel[i],
+				   sizeof(rtt_cancel->rtt_cancel[i]),
+				   sizeof(tlv_rtt_rc->addr));
+			cmd->size += sizeof(*tlv_rtt_rc);
+			tlv += sizeof(*tlv_rtt_rc);
+		}
+	} else {
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of ftm config session
+ * params.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status
+wlan_ret_802_11_ftm_config_session_params(pmlan_private pmpriv,
+					  HostCmd_DS_COMMAND *resp,
+					  mlan_ioctl_req *pioctl_buf)
+{
+	ENTER();
+
+	PRINTM(MCMND, "ftm config successfully\n");
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function transform Event_WLS_FTM_t to wifi_rtt_result in
+ * mlan_event.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param event_ftm  A pointer to Event_WLS_FTM_t
+ *  @param event_ftm_len   length of event_ftm
+ *  @param pevent       A pointer to mlan_event
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_fill_hal_rtt_results(pmlan_private pmpriv,
+				      Event_WLS_FTM_t *event_ftm,
+				      t_u32 event_ftm_len, mlan_event *pevent)
+{
+	/** For input buffer Event_WLS_FTM_t */
+	t_u8 *tlv = event_ftm->u.rtt_results.tlv_buffer;
+	int event_left_len = event_ftm_len - (tlv - (t_u8 *)event_ftm);
+	MrvlIEtypes_RTTResult_t *tlv_rtt_result = MNULL;
+	t_u16 tlv_rtt_result_len = 0;
+	IEEEtypes_Header_t *tlv_ie = MNULL;
+	int tlv_ie_len = 0;
+	int tlv_left_len = 0;
+	t_u8 *tlv_pos = MNULL;
+	/** For output buffer mlan_event */
+	t_u8 *pos = pevent->event_buf;
+	wifi_rtt_result_element *rtt_result_elem = MNULL;
+	wifi_rtt_result *rtt_result = MNULL;
+	t_u32 i = 0;
+
+	ENTER();
+	PRINTM(MCMND,
+	       "wlan_fill_hal_rtt_results event_ftm_len=%d event_left_len=%d event_ftm=%p tlv=%p\n",
+	       event_ftm_len, event_left_len, event_ftm, tlv);
+
+	pevent->event_id = MLAN_EVENT_ID_DRV_RTT_RESULT;
+
+	/** Event format for moal is: [complete(u8)] + [multiple number of rtt
+	 * result(len(u16) + body)] */
+
+	/** [complete(u8)] */
+	*pos = event_ftm->u.rtt_results.complete;
+	pos += sizeof(event_ftm->u.rtt_results.complete);
+
+	/** multiple number of rtt result(wifi_rtt_result_element) */
+	/** Fill rtt results, 1 tlv at least contain 1 MrvlIEtypes_RTTResult_t
+	 */
+	while (event_left_len >= sizeof(MrvlIEtypes_RTTResult_t)) {
+		PRINTM(MCMND, "[%d] event_left_len=%d tlv=%p\n", i,
+		       event_left_len, tlv);
+		tlv_rtt_result = (MrvlIEtypes_RTTResult_t *)tlv;
+		tlv_rtt_result_len =
+			wlan_le16_to_cpu(tlv_rtt_result->header.len);
+
+		rtt_result_elem = (wifi_rtt_result_element *)pos;
+		pos += sizeof(*rtt_result_elem);
+
+		rtt_result = (wifi_rtt_result *)(rtt_result_elem->data);
+		memcpy_ext(pmpriv->adapter, rtt_result->addr,
+			   tlv_rtt_result->addr, sizeof(tlv_rtt_result->addr),
+			   sizeof(rtt_result->addr));
+		rtt_result->burst_num =
+			wlan_le32_to_cpu(tlv_rtt_result->burst_num);
+		rtt_result->measurement_number =
+			wlan_le32_to_cpu(tlv_rtt_result->measurement_number);
+		rtt_result->success_number =
+			wlan_le32_to_cpu(tlv_rtt_result->success_number);
+		rtt_result->number_per_burst_peer =
+			tlv_rtt_result->number_per_burst_peer;
+		rtt_result->status = tlv_rtt_result->status;
+		rtt_result->retry_after_duration =
+			tlv_rtt_result->retry_after_duration;
+		rtt_result->type = tlv_rtt_result->type;
+		rtt_result->rssi = wlan_le32_to_cpu(tlv_rtt_result->rssi);
+		rtt_result->rssi_spread =
+			wlan_le32_to_cpu(tlv_rtt_result->rssi_spread);
+		wlan_fill_hal_wifi_rate(pmpriv, &tlv_rtt_result->tx_rate,
+					&rtt_result->tx_rate);
+		wlan_fill_hal_wifi_rate(pmpriv, &tlv_rtt_result->rx_rate,
+					&rtt_result->rx_rate);
+		rtt_result->rtt = wlan_le64_to_cpu(tlv_rtt_result->rtt);
+		rtt_result->rtt_sd = wlan_le64_to_cpu(tlv_rtt_result->rtt_sd);
+		rtt_result->rtt_spread =
+			wlan_le64_to_cpu(tlv_rtt_result->rtt_spread);
+		rtt_result->distance_mm =
+			wlan_le32_to_cpu(tlv_rtt_result->distance_mm);
+		rtt_result->distance_sd_mm =
+			wlan_le32_to_cpu(tlv_rtt_result->distance_sd_mm);
+		rtt_result->distance_spread_mm =
+			wlan_le32_to_cpu(tlv_rtt_result->distance_spread_mm);
+		rtt_result->ts = wlan_le64_to_cpu(tlv_rtt_result->ts);
+		rtt_result->burst_duration =
+			wlan_le32_to_cpu(tlv_rtt_result->burst_duration);
+		rtt_result->negotiated_burst_num =
+			wlan_le32_to_cpu(tlv_rtt_result->negotiated_burst_num);
+		pos += sizeof(*rtt_result);
+
+		tlv_ie = (IEEEtypes_Header_t *)(tlv_rtt_result->tlv_buffer);
+		tlv_pos = (t_u8 *)tlv_ie;
+		tlv_left_len =
+			tlv_rtt_result_len - (sizeof(*tlv_rtt_result) -
+					      sizeof(tlv_rtt_result->header));
+		PRINTM(MCMND, "tlv_ie=%p tlv_left_len=%d\n", tlv_ie,
+		       tlv_left_len);
+		/** Get the standard IEEEIE: MEASUREMENT_REPORT for LCI/LCR*/
+		while ((tlv_left_len > 0) && (tlv_left_len > sizeof(*tlv_ie))) {
+			tlv_ie_len = tlv_ie->len;
+			PRINTM(MCMND,
+			       "[-] tlv_ie=%p tlv_ie_len=%d   tlv_left_len=%d  jump=%d\n",
+			       tlv_ie, tlv_ie_len, tlv_left_len,
+			       sizeof(*tlv_ie) + tlv_ie_len);
+			if ((tlv_ie_len > 0) &&
+			    (tlv_ie->element_id == MEASUREMENT_REPORT)) {
+				PRINTM(MCMND, "LCI/LCR IE: id=%d len=%d\n",
+				       tlv_ie->element_id, tlv_ie->len);
+				memcpy_ext(pmpriv->adapter, pos, (t_u8 *)tlv_ie,
+					   sizeof(*tlv_ie) + tlv_ie_len,
+					   sizeof(*tlv_ie) + tlv_ie_len);
+				pos += sizeof(*tlv_ie) + tlv_ie_len;
+			}
+			tlv_left_len -= sizeof(*tlv_ie) + tlv_ie_len;
+			tlv_pos += sizeof(*tlv_ie) + tlv_ie_len;
+			tlv_ie = (IEEEtypes_Header_t *)tlv_pos;
+			PRINTM(MCMND,
+			       "[+] tlv_ie=%p tlv_ie_len=%d   tlv_left_len=%d \n",
+			       tlv_ie, tlv_ie_len, tlv_left_len);
+		}
+
+		rtt_result_elem->len = pos - rtt_result_elem->data;
+
+		tlv += tlv_rtt_result_len + sizeof(tlv_rtt_result->header);
+		event_left_len -=
+			tlv_rtt_result_len + sizeof(tlv_rtt_result->header);
+		i++;
+	}
+
+	/** event_len include the mlan_event header and payload */
+	pevent->event_len = pos - pevent->event_buf;
+	PRINTM(MCMND, "pevent->event_len=%d \n", pevent->event_len);
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function prepares command of ftm config responder.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param pdata_buf    A pointer to data buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *cmd,
+						 t_u16 cmd_action,
+						 t_u32 cmd_oid,
+						 t_void *pdata_buf)
+{
+	mlan_rtt_responder *rtt_rsp_cfg = (mlan_rtt_responder *)pdata_buf;
+	HostCmd_DS_FTM_CONFIG_RESPONDER *responder =
+		&cmd->params.ftm_rtt_responder;
+	t_u8 *tlv = responder->tlv_buffer;
+	MrvlIEtypes_RTTResponderEnCfg_t *tlv_rsp_en = MNULL;
+	MrvlIEtypes_RTTLCICfg_t *tlv_lci = MNULL;
+	MrvlIEtypes_RTTLCRCfg_t *tlv_lcr = MNULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_FTM_CONFIG_RESPONDER);
+	cmd->size = S_DS_GEN + sizeof(HostCmd_DS_FTM_CONFIG_RESPONDER);
+
+	switch (rtt_rsp_cfg->action) {
+	case RTT_GET_RESPONDER_INFO:
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_GET_RSP_INFO);
+		break;
+	case RTT_SET_RESPONDER_ENABLE:
+		tlv_rsp_en = (MrvlIEtypes_RTTResponderEnCfg_t *)tlv;
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_EN);
+		tlv_rsp_en->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_RTT_RESPONDER_EN_CFG);
+		tlv_rsp_en->header.len = wlan_cpu_to_le16(
+			sizeof(*tlv_rsp_en) - sizeof(MrvlIEtypesHeader_t));
+		tlv_rsp_en->channel = rtt_rsp_cfg->u.encfg.channel;
+		tlv_rsp_en->bandcfg = rtt_rsp_cfg->u.encfg.bandcfg;
+		tlv_rsp_en->max_duration_seconds =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.encfg.max_dur_sec);
+		cmd->size += sizeof(*tlv_rsp_en);
+		break;
+	case RTT_SET_RESPONDER_DISABLE:
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_DIS);
+		break;
+	case RTT_SET_RESPONDER_LCI:
+		tlv_lci = (MrvlIEtypes_RTTLCICfg_t *)tlv;
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_LCI);
+		tlv_lci->header.type = wlan_cpu_to_le16(TLV_TYPE_RTT_LCI_CFG);
+		tlv_lci->header.len = wlan_cpu_to_le16(
+			sizeof(*tlv_lci) - sizeof(MrvlIEtypesHeader_t));
+		tlv_lci->latitude =
+			wlan_cpu_to_le64(rtt_rsp_cfg->u.lci.latitude);
+		tlv_lci->longitude =
+			wlan_cpu_to_le64(rtt_rsp_cfg->u.lci.longitude);
+		tlv_lci->altitude =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.altitude);
+		tlv_lci->latitude_unc = rtt_rsp_cfg->u.lci.latitude_unc;
+		tlv_lci->longitude_unc = rtt_rsp_cfg->u.lci.longitude_unc;
+		tlv_lci->altitude_unc = rtt_rsp_cfg->u.lci.altitude_unc;
+		tlv_lci->motion_pattern = rtt_rsp_cfg->u.lci.motion_pattern;
+		tlv_lci->floor = wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.floor);
+		tlv_lci->height_above_floor =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.height_above_floor);
+		tlv_lci->height_unc =
+			wlan_cpu_to_le32(rtt_rsp_cfg->u.lci.height_unc);
+		cmd->size += sizeof(*tlv_lci);
+		break;
+	case RTT_SET_RESPONDER_LCR:
+		tlv_lcr = (MrvlIEtypes_RTTLCRCfg_t *)tlv;
+		responder->action =
+			wlan_cpu_to_le16(HostCmd_ACT_RTT_SET_RSP_LCR);
+		tlv_lcr->header.type = wlan_cpu_to_le16(TLV_TYPE_RTT_LCR_CFG);
+		tlv_lcr->header.len = wlan_cpu_to_le16(
+			sizeof(*tlv_lcr) - sizeof(MrvlIEtypesHeader_t));
+		memcpy_ext(pmpriv->adapter, tlv_lcr->country_code,
+			   rtt_rsp_cfg->u.lcr.country_code,
+			   sizeof(rtt_rsp_cfg->u.lcr.country_code),
+			   sizeof(tlv_lcr->country_code));
+		tlv_lcr->length = wlan_cpu_to_le32(rtt_rsp_cfg->u.lcr.length);
+		memcpy_ext(pmpriv->adapter, tlv_lcr->civic_info,
+			   rtt_rsp_cfg->u.lcr.civic_info,
+			   sizeof(rtt_rsp_cfg->u.lcr.civic_info),
+			   sizeof(tlv_lcr->civic_info));
+		cmd->size += sizeof(*tlv_lcr);
+		break;
+	default:
+		PRINTM(MERROR,
+		       "wlan_cmd_802_11_ftm_config_responder: action not found\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+		break;
+	}
+
+	cmd->size = wlan_cpu_to_le16(cmd->size);
+
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief This function handles the command response of ftm config responder
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *resp,
+						 mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)(pioctl_buf->pbuf);
+	mlan_rtt_responder *rtt_rsp_cfg = &(misc->param.rtt_rsp_cfg);
+	HostCmd_DS_FTM_CONFIG_RESPONDER *responder = MNULL;
+	t_u32 cmdrsp_len = wlan_le16_to_cpu(resp->size);
+	int left_len = 0;
+	t_u8 *tlv = MNULL;
+	MrvlIEtypes_RTTResponderInfo_t *tlv_rsp_info = MNULL;
+
+	ENTER();
+
+	PRINTM(MCMND, "ftm config responder successfully cmdrsp_len=%d\n",
+	       cmdrsp_len);
+
+	if ((cmdrsp_len < S_DS_GEN) ||
+	    (cmdrsp_len - S_DS_GEN < sizeof(HostCmd_DS_FTM_CONFIG_RESPONDER)))
+		goto done;
+
+	responder = &resp->params.ftm_rtt_responder;
+	left_len = cmdrsp_len - (S_DS_GEN + sizeof(*responder));
+	PRINTM(MCMND, "left_len=%d\n", left_len);
+
+	tlv = responder->tlv_buffer;
+	while ((left_len > 0) && (left_len > sizeof(MrvlIEtypesHeader_t))) {
+		PRINTM(MCMND, "left_len=%d tlv: type=0x%x len=%d\n", left_len,
+		       ((MrvlIEtypesHeader_t *)tlv)->type,
+		       ((MrvlIEtypesHeader_t *)tlv)->len);
+		if (((MrvlIEtypesHeader_t *)tlv)->type ==
+		    TLV_TYPE_RTT_RESPONDER_INFO) {
+			if (((MrvlIEtypesHeader_t *)tlv)->len >=
+			    (sizeof(MrvlIEtypes_RTTResponderInfo_t) -
+			     sizeof(MrvlIEtypesHeader_t))) {
+				tlv_rsp_info =
+					(MrvlIEtypes_RTTResponderInfo_t *)tlv;
+				PRINTM(MCMND, "rtt_rsp_cfg->action=0x%x\n",
+				       rtt_rsp_cfg->action);
+				if (rtt_rsp_cfg->action ==
+					    RTT_GET_RESPONDER_INFO ||
+				    rtt_rsp_cfg->action ==
+					    RTT_SET_RESPONDER_ENABLE) {
+					rtt_rsp_cfg->u.info.channel =
+						tlv_rsp_info->channel;
+					rtt_rsp_cfg->u.info.bandcfg =
+						tlv_rsp_info->bandcfg;
+					rtt_rsp_cfg->u.info.preamble =
+						tlv_rsp_info->preamble;
+					PRINTM(MCMND,
+					       "set to rtt_rsp_cfg channel=%d bandcfg=%d %d %d %d preamble=%d\n",
+					       rtt_rsp_cfg->u.info.channel,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chanBand,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chanWidth,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chan2Offset,
+					       rtt_rsp_cfg->u.info.bandcfg
+						       .chan2Offset,
+					       rtt_rsp_cfg->u.info.preamble);
+					break;
+				}
+			}
+		}
+		left_len -= ((MrvlIEtypesHeader_t *)tlv)->len +
+			    sizeof(MrvlIEtypesHeader_t);
+		tlv += ((MrvlIEtypesHeader_t *)tlv)->len +
+		       sizeof(MrvlIEtypesHeader_t);
+	}
+
+done:
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief Handle the version_ext resp
  *
@@ -3141,8 +3611,10 @@ void wlan_process_sleep_confirm_resp(pmlan_adapter pmadapter, t_u8 *pbuf,
 		LEAVE();
 		return;
 	}
-	PRINTM_NETINTF(MEVENT, pmpriv);
-	PRINTM(MEVENT, "#\n");
+	if (pmadapter->second_mac)
+		PRINTM(MEVENT, "##\n");
+	else
+		PRINTM(MEVENT, "#\n");
 	if (cmd->result != MLAN_STATUS_SUCCESS) {
 		PRINTM(MERROR, "Sleep confirm command failed\n");
 		pmadapter->pm_wakeup_card_req = MFALSE;
@@ -4566,6 +5038,10 @@ mlan_status wlan_download_vdll_block(mlan_adapter *pmadapter, t_u8 *block,
 		PRINTM(MERROR, "dnld vdll: Fail to alloc vdll buf");
 		goto done;
 	}
+	if (!pmpriv) {
+		PRINTM(MERROR, "dnld vdll: Fail to get pmpriv");
+		goto done;
+	}
 	cmd_hdr = (HostCmd_DS_GEN *)(pmbuf->pbuf + pmbuf->data_offset);
 	cmd_hdr->command = wlan_cpu_to_le16(HostCmd_CMD_VDLL);
 	cmd_hdr->seq_num = wlan_cpu_to_le16(0xFF00);
@@ -5292,7 +5768,7 @@ mlan_status wlan_cmd_sdio_rx_aggr_cfg(HostCmd_DS_COMMAND *pcmd,
 	pcmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_SDIO_SP_RX_AGGR_CFG) +
 				      S_DS_GEN);
 	cfg->action = cmd_action;
-	if (cmd_action == HostCmd_ACT_GEN_SET)
+	if (pdata_buf && (cmd_action == HostCmd_ACT_GEN_SET))
 		cfg->enable = *(t_u8 *)pdata_buf;
 	return MLAN_STATUS_SUCCESS;
 }
@@ -5415,7 +5891,7 @@ mlan_status wlan_ret_cfg_data(IN pmlan_private pmpriv,
 			pevent->bss_index = pmpriv->bss_index;
 			pevent->event_id = MLAN_EVENT_ID_STORE_HOST_CMD_RESP;
 			pevent->resp = (t_u8 *)resp;
-			pevent->event_len = wlan_le16_to_cpu(resp->size);
+			pevent->event_len = resp->size;
 			wlan_recv_event(pmpriv,
 					MLAN_EVENT_ID_STORE_HOST_CMD_RESP,
 					(mlan_event *)pevent);
@@ -5440,7 +5916,7 @@ mlan_status wlan_cmd_mac_control(pmlan_private pmpriv, HostCmd_DS_COMMAND *pcmd,
 				 t_u16 cmd_action, t_void *pdata_buf)
 {
 	HostCmd_DS_MAC_CONTROL *pmac = &pcmd->params.mac_ctrl;
-	t_u32 action = *((t_u32 *)pdata_buf);
+	t_u32 action = 0;
 
 	ENTER();
 
@@ -5453,7 +5929,10 @@ mlan_status wlan_cmd_mac_control(pmlan_private pmpriv, HostCmd_DS_COMMAND *pcmd,
 	pcmd->command = wlan_cpu_to_le16(HostCmd_CMD_MAC_CONTROL);
 	pcmd->size =
 		wlan_cpu_to_le16(sizeof(HostCmd_DS_MAC_CONTROL) + S_DS_GEN);
-	pmac->action = wlan_cpu_to_le32(action);
+	if (pdata_buf) {
+		action = *((t_u32 *)pdata_buf);
+		pmac->action = wlan_cpu_to_le32(action);
+	}
 
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -5591,6 +6070,9 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 	pmadapter->hw_dot_11n_dev_cap =
 		wlan_le32_to_cpu(hw_spec->dot_11n_dev_cap);
 	pmadapter->hw_dev_mcs_support = hw_spec->dev_mcs_support;
+	pmadapter->hw_mpdu_density = GET_MPDU_DENSITY(hw_spec->hw_dev_cap);
+	PRINTM(MCMND, "GET_HW_SPEC: hw_mpdu_density=%d dev_mcs_support=0x%x\n",
+	       pmadapter->hw_mpdu_density, hw_spec->dev_mcs_support);
 	for (i = 0; i < pmadapter->priv_num; i++) {
 		if (pmadapter->priv[i])
 			wlan_update_11n_cap(pmadapter->priv[i]);
@@ -5598,16 +6080,12 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 
 	wlan_show_dot11ndevcap(pmadapter, pmadapter->hw_dot_11n_dev_cap);
 	wlan_show_devmcssupport(pmadapter, pmadapter->hw_dev_mcs_support);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	pmadapter->user_htstream = pmadapter->hw_dev_mcs_support;
 	/** separate stream config for 2.4G and 5G, will be changed according to
 	 * antenna cfg*/
 	if (pmadapter->fw_bands & BAND_A)
 		pmadapter->user_htstream |= (pmadapter->user_htstream << 8);
 	PRINTM(MCMND, "user_htstream=0x%x\n", pmadapter->user_htstream);
-#endif
 
 	if (ISSUPP_BEAMFORMING(pmadapter->hw_dot_11n_dev_cap)) {
 		PRINTM(MCMND, "Enable Beamforming\n");
@@ -5691,18 +6169,10 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 		}
 	}
 #endif
-
-	if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
-				 pmadapter->fw_bands)) {
-		if (pioctl_req)
-			pioctl_req->status_code = MLAN_ERROR_CMD_SCAN_FAIL;
-		ret = MLAN_STATUS_FAILURE;
-		goto done;
-	}
 #ifdef STA_SUPPORT
 	if (wlan_11d_set_universaltable(pmpriv, pmadapter->fw_bands)) {
 		if (pioctl_req)
-			pioctl_req->status_code = MLAN_ERROR_CMD_SCAN_FAIL;
+			pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
@@ -5815,6 +6285,13 @@ mlan_status wlan_ret_get_hw_spec(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 		tlv = (MrvlIEtypesHeader_t *)((t_u8 *)tlv + tlv_len +
 					      sizeof(MrvlIEtypesHeader_t));
 	}
+	if (wlan_set_regiontable(pmpriv, (t_u8)pmadapter->region_code,
+				 pmadapter->fw_bands)) {
+		if (pioctl_req)
+			pioctl_req->status_code = MLAN_ERROR_IOCTL_FAIL;
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
 done:
 	LEAVE();
 	return ret;
@@ -6433,6 +6910,84 @@ mlan_status wlan_ret_gpio_tsf_latch(pmlan_private pmpriv,
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ *  @brief This function prepares command of CROSS CHIP SYNCH.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   The action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				      t_void *pdata_buf)
+{
+	HostCmd_DS_CROSS_CHIP_SYNCH *cross_chip_synch =
+		&cmd->params.cross_chip_synch;
+	mlan_ds_cross_chip_synch *cfg = (mlan_ds_cross_chip_synch *)pdata_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_CROSS_CHIP_SYNCH);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_CROSS_CHIP_SYNCH) +
+				     S_DS_GEN);
+	cross_chip_synch->action = wlan_cpu_to_le16(cmd_action);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		cross_chip_synch->start_stop = cfg->start_stop;
+		cross_chip_synch->role = cfg->role;
+		cross_chip_synch->period = wlan_cpu_to_le32(cfg->period);
+		cross_chip_synch->init_tsf_low =
+			wlan_cpu_to_le32(cfg->init_tsf_low);
+		cross_chip_synch->init_tsf_high =
+			wlan_cpu_to_le32(cfg->init_tsf_high);
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
+/**
+ *  @brief This function handles the command response of CROSS CHIP SYNCH.
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND structure
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req buf
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp,
+				      mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_CROSS_CHIP_SYNCH *cross_chip_synch =
+		&resp->params.cross_chip_synch;
+	mlan_ds_misc_cfg *cfg = MNULL;
+	ENTER();
+	if (pioctl_buf) {
+		cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+
+		if (wlan_le16_to_cpu(cross_chip_synch->action) ==
+		    HostCmd_ACT_GEN_GET) {
+			cfg->param.cross_chip_synch.start_stop =
+				cross_chip_synch->start_stop;
+			cfg->param.cross_chip_synch.role =
+				cross_chip_synch->role;
+			cfg->param.cross_chip_synch.period =
+				wlan_le32_to_cpu(cross_chip_synch->period);
+			cfg->param.cross_chip_synch.init_tsf_low =
+				wlan_le32_to_cpu(
+					cross_chip_synch->init_tsf_low);
+			cfg->param.cross_chip_synch.init_tsf_high =
+				wlan_le32_to_cpu(
+					cross_chip_synch->init_tsf_high);
+		}
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function prepares command of mimo switch configuration.
  *
@@ -6563,7 +7118,8 @@ mlan_status wlan_ret_tx_rx_pkt_stats(pmlan_private pmpriv,
 	HostCmd_DS_TX_RX_HISTOGRAM *ptx_rx_histogram =
 		&resp->params.tx_rx_histogram;
 	mlan_ds_misc_cfg *info;
-	t_u16 cmdsize = wlan_le16_to_cpu(resp->size), length;
+	t_u16 cmdsize = resp->size;
+	t_u16 length;
 	t_u32 *pos, count = 0;
 
 	ENTER();
@@ -6751,11 +7307,7 @@ mlan_status wlan_ret_802_11_rf_antenna(pmlan_private pmpriv,
 	HostCmd_DS_802_11_RF_ANTENNA *pantenna = &resp->params.antenna;
 	t_u16 tx_ant_mode = wlan_le16_to_cpu(pantenna->tx_antenna_mode);
 	t_u16 rx_ant_mode = wlan_le16_to_cpu(pantenna->rx_antenna_mode);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	mlan_adapter *pmadapter = pmpriv->adapter;
-#endif
 	typedef struct _HostCmd_DS_802_11_RF_ANTENNA_1X1 {
 		/** Action */
 		t_u16 action;
@@ -6781,11 +7333,9 @@ mlan_status wlan_ret_802_11_rf_antenna(pmlan_private pmpriv,
 		       " Rx action = 0x%x, Rx Mode = 0x%04x\n",
 		       wlan_le16_to_cpu(pantenna->action_tx), tx_ant_mode,
 		       wlan_le16_to_cpu(pantenna->action_rx), rx_ant_mode);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if (IS_CARD9098(pmadapter->card_type) ||
-		    IS_CARDNW62X(pmadapter->card_type) ||
+		    IS_CARDIW62X(pmadapter->card_type) ||
+		    IS_CARDAW693(pmadapter->card_type) ||
 		    IS_CARD9097(pmadapter->card_type)) {
 			tx_ant_mode &= 0x0303;
 			rx_ant_mode &= 0x0303;
@@ -6818,7 +7368,6 @@ mlan_status wlan_ret_802_11_rf_antenna(pmlan_private pmpriv,
 			       pmadapter->user_htstream, tx_ant_mode,
 			       rx_ant_mode);
 		}
-#endif
 	} else
 		PRINTM(MINFO,
 		       "RF_ANT_RESP: action = 0x%x, Mode = 0x%04x, Evaluate time = %d, Current antenna = %d\n",
@@ -6855,12 +7404,8 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				t_u16 cmd_action, t_void *pdata_buf)
 {
 	mlan_ds_reg_rw *reg_rw;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	MrvlIEtypes_Reg_type_t *tlv;
 	mlan_adapter *pmadapter = pmpriv->adapter;
-#endif
 
 	ENTER();
 
@@ -6874,12 +7419,10 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 		mac_reg->action = wlan_cpu_to_le16(cmd_action);
 		mac_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		mac_reg->value = wlan_cpu_to_le32(reg_rw->value);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_MAC2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW62X(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -6893,7 +7436,6 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				sizeof(HostCmd_DS_MAC_REG_ACCESS) + S_DS_GEN +
 				sizeof(MrvlIEtypes_Reg_type_t));
 		}
-#endif
 		break;
 	}
 	case HostCmd_CMD_REG_ACCESS: {
@@ -6915,12 +7457,10 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 		bbp_reg->action = wlan_cpu_to_le16(cmd_action);
 		bbp_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		bbp_reg->value = (t_u8)reg_rw->value;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_BBP2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW62X(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -6934,7 +7474,6 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				sizeof(HostCmd_DS_BBP_REG_ACCESS) + S_DS_GEN +
 				sizeof(MrvlIEtypes_Reg_type_t));
 		}
-#endif
 		break;
 	}
 	case HostCmd_CMD_RF_REG_ACCESS: {
@@ -6945,12 +7484,10 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 		rf_reg->action = wlan_cpu_to_le16(cmd_action);
 		rf_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		rf_reg->value = (t_u8)reg_rw->value;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_RF2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW62X(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -6964,7 +7501,6 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				sizeof(HostCmd_DS_RF_REG_ACCESS) + S_DS_GEN +
 				sizeof(MrvlIEtypes_Reg_type_t));
 		}
-#endif
 		break;
 	}
 	case HostCmd_CMD_CAU_REG_ACCESS: {
@@ -7010,12 +7546,10 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 		bca_reg->action = wlan_cpu_to_le16(cmd_action);
 		bca_reg->offset = wlan_cpu_to_le16((t_u16)reg_rw->offset);
 		bca_reg->value = wlan_cpu_to_le32(reg_rw->value);
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 		if ((reg_rw->type == MLAN_REG_BCA2) &&
 		    (IS_CARD9098(pmadapter->card_type) ||
-		     IS_CARDNW62X(pmadapter->card_type) ||
+		     IS_CARDIW62X(pmadapter->card_type) ||
+		     IS_CARDAW693(pmadapter->card_type) ||
 		     IS_CARD9097(pmadapter->card_type))) {
 			tlv = (MrvlIEtypes_Reg_type_t
 				       *)((t_u8 *)cmd +
@@ -7029,7 +7563,6 @@ mlan_status wlan_cmd_reg_access(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				sizeof(HostCmd_DS_BCA_REG_ACCESS) + S_DS_GEN +
 				sizeof(MrvlIEtypes_Reg_type_t));
 		}
-#endif
 		break;
 	}
 	default:
@@ -7883,7 +8416,7 @@ mlan_status wlan_ret_chan_region_cfg(pmlan_private pmpriv,
 	t_u16 action;
 	HostCmd_DS_CHAN_REGION_CFG *reg = MNULL;
 	t_u8 *tlv_buf = MNULL;
-	t_u16 tlv_buf_left;
+	t_u16 tlv_buf_left = 0;
 	mlan_ds_misc_cfg *misc_cfg = MNULL;
 	mlan_ds_misc_chnrgpwr_cfg *cfg = MNULL;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -7903,7 +8436,11 @@ mlan_status wlan_ret_chan_region_cfg(pmlan_private pmpriv,
 	}
 
 	tlv_buf = (t_u8 *)reg + sizeof(*reg);
-	tlv_buf_left = wlan_le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*reg);
+	if (resp->size > (S_DS_GEN + sizeof(*reg))) {
+		tlv_buf_left = resp->size - S_DS_GEN - sizeof(*reg);
+	} else {
+		PRINTM(MERROR, "Region size calculation ERROR.\n");
+	}
 
 	/* Add FW cfp tables and region info */
 	wlan_add_fw_cfp_tables(pmpriv, tlv_buf, tlv_buf_left);
@@ -7928,7 +8465,7 @@ mlan_status wlan_ret_chan_region_cfg(pmlan_private pmpriv,
 	if (misc_cfg->sub_command == MLAN_OID_MISC_GET_REGIONPWR_CFG) {
 		cfg = (mlan_ds_misc_chnrgpwr_cfg *)&(
 			misc_cfg->param.rgchnpwr_cfg);
-		cfg->length = wlan_le16_to_cpu(resp->size);
+		cfg->length = resp->size;
 		memcpy_ext(pmpriv->adapter, cfg->chnrgpwr_buf, (t_u8 *)resp,
 			   cfg->length, sizeof(cfg->chnrgpwr_buf));
 	} else {
@@ -8548,7 +9085,7 @@ mlan_status wlan_cmd_boot_sleep(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	boot_sleep->action = wlan_cpu_to_le16(cmd_action);
 	boot_sleep->enable = wlan_cpu_to_le16(enable);
 
-	cmd->size = S_DS_GEN + sizeof(HostCmd_DS_BOOT_SLEEP);
+	cmd->size = wlan_cpu_to_le16(S_DS_GEN + sizeof(HostCmd_DS_BOOT_SLEEP));
 
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -8926,6 +9463,40 @@ mlan_status wlan_cmd_rxabortcfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	return MLAN_STATUS_SUCCESS;
 }
 
+/**
+ *  @brief This function prepares command of OFDM DESENSE cfg
+ *
+ *  @param pmpriv      A pointer to mlan_private structure
+ *  @param cmd          A pointer to HostCmd_DS_COMMAND structure
+ *  @param cmd_action   the action: GET or SET
+ *  @param pdata_buf    A pointer to data buffer
+ *  @return         MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_cmd_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_void *pdata_buf)
+{
+	HostCmd_DS_CMD_OFDM_DESENSE_CFG *cfg_cmd =
+		(HostCmd_DS_CMD_OFDM_DESENSE_CFG *)&cmd->params.ofdm_desense_cfg;
+	mlan_ds_misc_ofdm_desense_cfg *cfg =
+		(mlan_ds_misc_ofdm_desense_cfg *)pdata_buf;
+
+	ENTER();
+
+	cmd->command = wlan_cpu_to_le16(HostCmd_CMD_OFDM_DESENSE_CFG);
+	cmd->size = wlan_cpu_to_le16(sizeof(HostCmd_DS_CMD_OFDM_DESENSE_CFG) +
+				     S_DS_GEN);
+	cfg_cmd->action = wlan_cpu_to_le16(cmd_action);
+
+	if (cmd_action == HostCmd_ACT_GEN_SET) {
+		cfg_cmd->enable = (t_u8)cfg->enable;
+		cfg_cmd->cca_threshold = (t_s8)cfg->cca_threshold;
+	}
+
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function handles the command response of Rx Abort Cfg
  *
@@ -8953,6 +9524,35 @@ mlan_status wlan_ret_rxabortcfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
+/**
+ *  @brief This function handles the command response of OFDM DESENSE CFG
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to mlan_ioctl_req structure
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *resp,
+				     mlan_ioctl_req *pioctl_buf)
+{
+	HostCmd_DS_CMD_OFDM_DESENSE_CFG *cfg_cmd =
+		(HostCmd_DS_CMD_OFDM_DESENSE_CFG *)&resp->params
+			.ofdm_desense_cfg;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+
+	ENTER();
+
+	if (pioctl_buf) {
+		misc_cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+		misc_cfg->param.ofdm_desense_cfg.enable = (t_u8)cfg_cmd->enable;
+		misc_cfg->param.ofdm_desense_cfg.cca_threshold =
+			(t_s8)cfg_cmd->cca_threshold;
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
 
 /**
  *  @brief This function prepares command of Rx abort cfg ext
@@ -8983,6 +9583,11 @@ mlan_status wlan_cmd_rxabortcfg_ext(pmlan_private pmpriv,
 		cfg_cmd->enable = (t_u8)cfg->enable;
 		cfg_cmd->rssi_margin = (t_s8)cfg->rssi_margin;
 		cfg_cmd->ceil_rssi_threshold = (t_s8)cfg->ceil_rssi_threshold;
+		cfg_cmd->floor_rssi_threshold = (t_s8)cfg->floor_rssi_threshold;
+		cfg_cmd->current_dynamic_rssi_threshold =
+			(t_s8)cfg->current_dynamic_rssi_threshold;
+		cfg_cmd->rssi_default_config = (t_u8)cfg->rssi_default_config;
+		cfg_cmd->edmac_enable = (t_u8)cfg->edmac_enable;
 	}
 
 	LEAVE();
@@ -9016,6 +9621,14 @@ mlan_status wlan_ret_rxabortcfg_ext(pmlan_private pmpriv,
 			cfg_cmd->rssi_margin;
 		misc_cfg->param.rx_abort_cfg_ext.ceil_rssi_threshold =
 			cfg_cmd->ceil_rssi_threshold;
+		misc_cfg->param.rx_abort_cfg_ext.floor_rssi_threshold =
+			cfg_cmd->floor_rssi_threshold;
+		misc_cfg->param.rx_abort_cfg_ext.current_dynamic_rssi_threshold =
+			cfg_cmd->current_dynamic_rssi_threshold;
+		misc_cfg->param.rx_abort_cfg_ext.rssi_default_config =
+			cfg_cmd->rssi_default_config;
+		misc_cfg->param.rx_abort_cfg_ext.edmac_enable =
+			cfg_cmd->edmac_enable;
 	}
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
@@ -9535,7 +10148,7 @@ mlan_status wlan_ret_get_chan_trpc_config(pmlan_private pmpriv,
 		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
 		cfg = (mlan_ds_misc_chan_trpc_cfg *)&(misc->param.trpc_cfg);
 		cfg->sub_band = wlan_le16_to_cpu(trpc_cfg->sub_band);
-		cfg->length = wlan_le16_to_cpu(resp->size);
+		cfg->length = resp->size;
 		memcpy_ext(pmadapter, cfg->trpc_buf, (t_u8 *)resp, cfg->length,
 			   sizeof(cfg->trpc_buf));
 	}
@@ -9628,7 +10241,6 @@ mlan_status wlan_cmd_get_ch_load(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	cfg_cmd->noise = wlan_cpu_to_le16(cfg->noise);
 	cfg_cmd->rx_quality = wlan_cpu_to_le16(cfg->rx_quality);
 	cfg_cmd->duration = wlan_cpu_to_le16(cfg->duration);
-	cfg_cmd->cca_th = wlan_cpu_to_le16(cfg->cca_th);
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_decl.h b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
index 2b496fe..e1b1d42 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "368.p2"
+#define MLAN_RELEASE_VERSION "391"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -262,11 +262,12 @@ typedef t_s32 t_sval;
 #define FW_RELOAD_NO_EMULATION 2
 /** out band reset with interface re-emulation */
 #define FW_RELOAD_WITH_EMULATION 3
-#ifdef PCIE
 /** pcie card reset */
 #define FW_RELOAD_PCIE_RESET 4
-#endif
+/** sdio hw reset */
 #define FW_RELOAD_SDIO_HW_RESET 5
+/** pcie inband reset */
+#define FW_RELOAD_PCIE_INBAND_RESET 6
 
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
@@ -373,7 +374,9 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 /** 8801 card type */
 #define CARD_TYPE_8801 0x0a
 /** OWL card type */
-#define CARD_TYPE_NW62X 0x0b
+#define CARD_TYPE_IW62X 0x0b
+/** Black bird card type */
+#define CARD_TYPE_AW693 0x0c
 
 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
@@ -405,8 +408,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_SD9177 (CARD_TYPE_9177 | (INTF_SD << 8))
 /** SD8801 card type */
 #define CARD_TYPE_SD8801 (CARD_TYPE_8801 | (INTF_SD << 8))
-/** SD_NW62X card type */
-#define CARD_TYPE_SDNW62X (CARD_TYPE_NW62X | (INTF_SD << 8))
+/** SD_IW62X card type */
+#define CARD_TYPE_SDIW62X (CARD_TYPE_IW62X | (INTF_SD << 8))
+/** SD_IW62X card type */
+#define CARD_TYPE_SDAW693 (CARD_TYPE_AW693 | (INTF_SD << 8))
 
 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@@ -418,7 +423,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_SD9098(ct) (CARD_TYPE_SD9098 == (ct))
 #define IS_SD9177(ct) (CARD_TYPE_SD9177 == (ct))
 #define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
-#define IS_SDNW62X(ct) (CARD_TYPE_SDNW62X == (ct))
+#define IS_SDIW62X(ct) (CARD_TYPE_SDIW62X == (ct))
+#define IS_SDAW693(ct) (CARD_TYPE_SDAW693 == (ct))
 
 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@@ -440,8 +446,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SD9177 "SDIW612"
 /** SD8801 Card */
 #define CARD_SD8801 "SD8801"
-/** SDNW62X Card */
-#define CARD_SDNW62X "SDNW62X"
+/** SDIW62X Card */
+#define CARD_SDIW62X "SDIW62X"
+/** SDAW693 Card */
+#define CARD_SDAW693 "SDAW693"
 #endif
 
 #ifdef PCIE
@@ -453,14 +461,17 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_PCIE9097 (CARD_TYPE_9097 | (INTF_PCIE << 8))
 /** PCIE9098 card type */
 #define CARD_TYPE_PCIE9098 (CARD_TYPE_9098 | (INTF_PCIE << 8))
-/** PCIENW62X card type */
-#define CARD_TYPE_PCIENW62X (CARD_TYPE_NW62X | (INTF_PCIE << 8))
+/** PCIEIW62X card type */
+#define CARD_TYPE_PCIEIW62X (CARD_TYPE_IW62X | (INTF_PCIE << 8))
+/** PCIEAW693 card type */
+#define CARD_TYPE_PCIEAW693 (CARD_TYPE_AW693 | (INTF_PCIE << 8))
 
 #define IS_PCIE8897(ct) (CARD_TYPE_PCIE8897 == (ct))
 #define IS_PCIE8997(ct) (CARD_TYPE_PCIE8997 == (ct))
 #define IS_PCIE9097(ct) (CARD_TYPE_PCIE9097 == (ct))
 #define IS_PCIE9098(ct) (CARD_TYPE_PCIE9098 == (ct))
-#define IS_PCIENW62X(ct) (CARD_TYPE_PCIENW62X == (ct))
+#define IS_PCIEIW62X(ct) (CARD_TYPE_PCIEIW62X == (ct))
+#define IS_PCIEAW693(ct) (CARD_TYPE_PCIEAW693 == (ct))
 
 /** PCIE8897 Card */
 #define CARD_PCIE8897 "PCIE8897"
@@ -474,8 +485,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_PCIE9098 "PCIE9098"
 /** PCIEAW690 Card */
 #define CARD_PCIEAW690 "PCIEAW690"
-/** PCIENW62X Card */
-#define CARD_PCIENW62X "PCIENW62X"
+/** PCIEIW62X Card */
+#define CARD_PCIEIW62X "PCIEIW62X"
+/** PCIEAW693 Card */
+#define CARD_PCIEAW693 "PCIEAW693"
 /** PCIEIW629 Card */
 #define CARD_PCIEIW629 "PCIEIW629"
 #endif
@@ -493,8 +506,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_USB9098 (CARD_TYPE_9098 | (INTF_USB << 8))
 /** USB9097 card type */
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
-/** USBNW62X card type */
-#define CARD_TYPE_USBNW62X (CARD_TYPE_NW62X | (INTF_USB << 8))
+/** USBIW62X card type */
+#define CARD_TYPE_USBIW62X (CARD_TYPE_IW62X | (INTF_USB << 8))
 
 #define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
@@ -502,7 +515,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_USB8978(ct) (CARD_TYPE_USB8978 == (ct))
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
-#define IS_USBNW62X(ct) (CARD_TYPE_USBNW62X == (ct))
+#define IS_USBIW62X(ct) (CARD_TYPE_USBIW62X == (ct))
 
 /** USB8801 Card */
 #define CARD_USB8801 "USB8801"
@@ -516,8 +529,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9098 "USB9098"
 /** USB9097 Card */
 #define CARD_USB9097 "USBIW620"
-/** USBNW62X Card */
-#define CARD_USBNW62X "USBNW62X"
+/** USBIW62X Card */
+#define CARD_USBIW62X "USBIW62X"
 #endif
 
 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
@@ -529,7 +542,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_CARD9098(ct) (CARD_TYPE_9098 == ((ct)&0xf))
 #define IS_CARD9097(ct) (CARD_TYPE_9097 == ((ct)&0xf))
 #define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
-#define IS_CARDNW62X(ct) (CARD_TYPE_NW62X == ((ct)&0xf))
+#define IS_CARDIW62X(ct) (CARD_TYPE_IW62X == ((ct)&0xf))
+#define IS_CARDAW693(ct) (CARD_TYPE_AW693 == ((ct)&0xf))
 
 typedef struct _card_type_entry {
 	t_u16 card_type;
@@ -822,6 +836,7 @@ typedef enum _mlan_event_id {
 	MLAN_EVENT_ID_DRV_UAP_CHAN_INFO = 0x80000020,
 #endif
 	MLAN_EVENT_ID_FW_ROAM_OFFLOAD_RESULT = 0x80000023,
+	MLAN_EVENT_ID_DRV_RTT_RESULT = 0x80000025,
 	MLAN_EVENT_ID_DRV_ASSOC_FAILURE_LOGGER = 0x80000026,
 	MLAN_EVENT_ID_DRV_ASSOC_SUCC_LOGGER = 0x80000027,
 	MLAN_EVENT_ID_DRV_DISCONNECT_LOGGER = 0x80000028,
@@ -974,10 +989,10 @@ typedef MLAN_PACK_START struct _Band_Config_t {
 	t_u8 chan2Offset : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 #else
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
@@ -1152,6 +1167,10 @@ typedef MLAN_PACK_START struct _mix_rate_info {
 	t_u8 mcs_index;
 	/** bitrate, in 500Kbps */
 	t_u16 bitrate;
+	/** NSS */
+	t_u8 nss_index;
+	/** DCM */
+	t_u8 dcm;
 } MLAN_PACK_END mix_rate_info, *pmix_rate_info;
 
 typedef MLAN_PACK_START struct _rxpd_extra_info {
@@ -1163,10 +1182,12 @@ typedef MLAN_PACK_START struct _rxpd_extra_info {
 	t_u8 mcs_known;
 	/** mcs.flags */
 	t_u8 mcs_flags;
-	/** vht sig1 */
-	t_u32 vht_sig1;
-	/** vht sig2 */
-	t_u32 vht_sig2;
+	/** vht/he sig1 */
+	t_u32 vht_he_sig1;
+	/** vht/he sig2 */
+	t_u32 vht_he_sig2;
+	/** HE user idx */
+	t_u32 user_idx;
 } MLAN_PACK_END rxpd_extra_info, *prxpd_extra_info;
 
 typedef MLAN_PACK_START struct _radiotap_info {
@@ -2030,6 +2051,308 @@ typedef struct {
 	0x00000080 /** all contention (min, max, avg) statistics (within ac    \
 		      statisctics) */
 
+/** =========== Define Copied from HAL START =========== */
+/** Ranging status */
+typedef enum {
+	RTT_STATUS_SUCCESS = 0,
+	/** general failure status */
+	RTT_STATUS_FAILURE = 1,
+	/** target STA does not respond to request */
+	RTT_STATUS_FAIL_NO_RSP = 2,
+	/** request rejected. Applies to 2-sided RTT only */
+	RTT_STATUS_FAIL_REJECTED = 3,
+	RTT_STATUS_FAIL_NOT_SCHEDULED_YET = 4,
+	/** timing measurement times out */
+	RTT_STATUS_FAIL_TM_TIMEOUT = 5,
+	/** Target on different channel, cannot range */
+	RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6,
+	/** ranging not supported */
+	RTT_STATUS_FAIL_NO_CAPABILITY = 7,
+	/** request aborted for unknown reason */
+	RTT_STATUS_ABORTED = 8,
+	/** Invalid T1-T4 timestamp */
+	RTT_STATUS_FAIL_INVALID_TS = 9,
+	/** 11mc protocol failed */
+	RTT_STATUS_FAIL_PROTOCOL = 10,
+	/** request could not be scheduled */
+	RTT_STATUS_FAIL_SCHEDULE = 11,
+	/** responder cannot collaborate at time of request */
+	RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,
+	/** bad request args */
+	RTT_STATUS_INVALID_REQ = 13,
+	/** WiFi not enabled */
+	RTT_STATUS_NO_WIFI = 14,
+	/** Responder overrides param info, cannot range with new params */
+	RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE = 15
+} wifi_rtt_status;
+
+/** RTT peer type */
+typedef enum {
+	RTT_PEER_AP = 0x1,
+	RTT_PEER_STA = 0x2,
+	RTT_PEER_P2P_GO = 0x3,
+	RTT_PEER_P2P_CLIENT = 0x4,
+	RTT_PEER_NAN = 0x5
+} rtt_peer_type;
+
+/** RTT Measurement Bandwidth */
+typedef enum {
+	WIFI_RTT_BW_5 = 0x01,
+	WIFI_RTT_BW_10 = 0x02,
+	WIFI_RTT_BW_20 = 0x04,
+	WIFI_RTT_BW_40 = 0x08,
+	WIFI_RTT_BW_80 = 0x10,
+	WIFI_RTT_BW_160 = 0x20
+} wifi_rtt_bw;
+
+/** RTT Type */
+typedef enum {
+	RTT_TYPE_1_SIDED = 0x1,
+	RTT_TYPE_2_SIDED = 0x2,
+} wifi_rtt_type;
+
+/** RTT configuration */
+typedef struct {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	wifi_rtt_type type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	rtt_peer_type peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	wifi_channel_info channel;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u32 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u32 num_burst;
+	/** num of frames per burst. Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames to be attempted in a
+	 * single burst. This also equals the number of FTM frames that the
+	 * initiator will request that the responder send in a single frame. */
+	t_u32 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can retry an FTMR
+	 * frame. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u32 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	wifi_preamble preamble;
+	/** RTT BW to be used in the RTT frames */
+	wifi_rtt_bw bw;
+} wifi_rtt_config;
+
+/** Format of information elements found in the beacon */
+typedef struct {
+	/** element identifier */
+	t_u8 id;
+	/** number of bytes to follow */
+	t_u8 len;
+	t_u8 data[];
+} wifi_information_element;
+
+/** RTT results */
+typedef struct {
+	/** device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** burst number in a multi-burst request */
+	t_u32 burst_num;
+	/** Total RTT measurement frames attempted */
+	t_u32 measurement_number;
+	/** Total successful RTT measurement frames */
+	t_u32 success_number;
+	/** Maximum number of "FTM frames per burst" supported by
+	 * the responder STA. Applies to 2-sided RTT only.
+	 * If reponder overrides with larger value:
+	 * - for single-burst request initiator will truncate the
+	 * larger value and send a TMR_STOP after receiving as
+	 * many frames as originally requested.
+	 * - for multi-burst request, initiator will return
+	 * failure right away */
+	t_u8 number_per_burst_peer;
+	/** ranging status */
+	wifi_rtt_status status;
+	/** When status == RTT_STATUS_FAIL_BUSY_TRY_LATER,
+	 * this will be the time provided by the responder as to
+	 * when the request can be tried again. Applies to 2-sided
+	 * RTT only. In sec, 1-31sec. */
+	t_u8 retry_after_duration;
+	/** RTT type */
+	wifi_rtt_type type;
+	/** average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB */
+	int rssi;
+	/** rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
+	 */
+	int rssi_spread;
+	/** 1-sided RTT: TX rate of RTT frame.
+	 * 2-sided RTT: TX rate of initiator's Ack in response to FTM frame. */
+	wifi_rate tx_rate;
+	/** 1-sided RTT: TX rate of Ack from other side.
+	 * 2-sided RTT: TX rate of FTM frame coming from responder. */
+	wifi_rate rx_rate;
+	/** round trip time in picoseconds */
+	t_s64 rtt;
+	/** rtt standard deviation in picoseconds */
+	t_s64 rtt_sd;
+	/** difference between max and min rtt times recorded in picoseconds */
+	t_s64 rtt_spread;
+	/** distance in mm (optional) */
+	int distance_mm;
+	/** standard deviation in mm (optional) */
+	int distance_sd_mm;
+	/** difference between max and min distance recorded in mm (optional) */
+	int distance_spread_mm;
+	/** time of the measurement (in microseconds since boot) */
+	t_s64 ts;
+	/** in ms, actual time taken by the FW to finish one burst
+	 * measurement. Applies to 1-sided and 2-sided RTT. */
+	int burst_duration;
+	/** Number of bursts allowed by the responder. Applies
+	 * to 2-sided RTT only. */
+	int negotiated_burst_num;
+	/** for 11mc only */
+	wifi_information_element *LCI;
+	/** for 11mc only */
+	wifi_information_element *LCR;
+} wifi_rtt_result;
+
+/** Preamble definition for bit mask used in wifi_rtt_capabilities */
+#define PREAMBLE_LEGACY 0x1
+#define PREAMBLE_HT 0x2
+#define PREAMBLE_VHT 0x4
+
+/** BW definition for bit mask used in wifi_rtt_capabilities */
+#define BW_5_SUPPORT 0x1
+#define BW_10_SUPPORT 0x2
+#define BW_20_SUPPORT 0x4
+#define BW_40_SUPPORT 0x8
+#define BW_80_SUPPORT 0x10
+#define BW_160_SUPPORT 0x20
+
+/** RTT Capabilities */
+typedef struct {
+	/** if 1-sided rtt data collection is supported */
+	t_u8 rtt_one_sided_supported;
+	/** if ftm rtt data collection is supported */
+	t_u8 rtt_ftm_supported;
+	/** if initiator supports LCI request. Applies to 2-sided RTT */
+	t_u8 lci_support;
+	/** if initiator supports LCR request. Applies to 2-sided RTT */
+	t_u8 lcr_support;
+	/** bit mask indicates what preamble is supported by initiator */
+	t_u8 preamble_support;
+	/** bit mask indicates what BW is supported by initiator */
+	t_u8 bw_support;
+	/** if 11mc responder mode is supported */
+	t_u8 responder_supported;
+	/** draft 11mc spec version supported by chip. For instance,
+	 * version 4.0 should be 40 and version 4.3 should be 43 etc. */
+	t_u8 mc_version;
+} wifi_rtt_capabilities;
+
+/** API for setting LCI/LCR information to be provided to a requestor */
+typedef enum {
+	/** Not expected to change location */
+	WIFI_MOTION_NOT_EXPECTED = 0,
+	/** Expected to change location */
+	WIFI_MOTION_EXPECTED = 1,
+	/** Movement pattern unknown */
+	WIFI_MOTION_UNKNOWN = 2,
+} wifi_motion_pattern;
+
+/** LCI information */
+typedef struct {
+	/** latitude in degrees * 2^25 , 2's complement */
+	long latitude;
+	/** latitude in degrees * 2^25 , 2's complement */
+	long longitude;
+	/** Altitude in units of 1/256 m */
+	int altitude;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 latitude_unc;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 longitude_unc;
+	/** As defined in Section 2.4.5 from IETF RFC 6225: */
+	t_u8 altitude_unc;
+	/** Following element for configuring the Z subelement */
+	wifi_motion_pattern motion_pattern;
+	/** floor in units of 1/16th of floor. 0x80000000 if unknown. */
+	int floor;
+	/** in units of 1/64 m */
+	int height_above_floor;
+	/** in units of 1/64 m. 0 if unknown */
+	int height_unc;
+} wifi_lci_information;
+
+/** LCR information */
+typedef struct {
+	/** country code */
+	char country_code[2];
+	/** length of the info field */
+	int length;
+	/** Civic info to be copied in FTM frame */
+	char civic_info[256];
+} wifi_lcr_information;
+
+/**
+ * RTT Responder information
+ */
+typedef struct {
+	wifi_channel_info channel;
+	wifi_preamble preamble;
+} wifi_rtt_responder;
+
+/** =========== Define Copied from HAL END =========== */
+
+#define MAX_RTT_CONFIG_NUM 10
+
+/** RTT config params */
+typedef struct wifi_rtt_config_params {
+	t_u8 rtt_config_num;
+	wifi_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} wifi_rtt_config_params_t;
+
+#define OID_RTT_REQUEST 0
+#define OID_RTT_CANCEL 1
+
+/** Pass RTT result element between mlan and moal */
+typedef struct {
+	/** element identifier  */
+	t_u16 id;
+	/** number of bytes to follow  */
+	t_u16 len;
+	/** data: fill with one wifi_rtt_result  */
+	t_u8 data[];
+} wifi_rtt_result_element;
+
 /** station stats */
 typedef struct _sta_stats {
 	/** last_rx_in_msec */
@@ -2351,6 +2674,8 @@ typedef struct _mlan_device {
 	t_u8 ext_scan;
 	/* mcs32 setting */
 	t_u8 mcs32;
+	/** second mac flag */
+	t_u8 second_mac;
 } mlan_device, *pmlan_device;
 
 /** MLAN API function prototype */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_fw.h b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
index ccb2204..fe66b5d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_fw.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_fw.h
@@ -5,7 +5,7 @@
  *  in MLAN module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -248,14 +248,14 @@ typedef enum _KEY_INFO_WAPI {
 #define MRVDRV_SNAP_HEADER_LEN 8
 
 /** The number of times to try when polling for status bits */
-#define MAX_POLL_TRIES 300
+#define MAX_POLL_TRIES 100
 
 /** The number of times to try when waiting for downloaded firmware to
      become active when multiple interface is present */
 #define MAX_MULTI_INTERFACE_POLL_TRIES 150
 /** The number of times to try when waiting for downloaded firmware to
      become active. (polling the scratch register). */
-#define MAX_FIRMWARE_POLL_TRIES 100
+#define MAX_FIRMWARE_POLL_TRIES 300
 
 /** FW fill in rx_len with extra 204 bytes */
 #define EXTRA_LEN 256
@@ -708,6 +708,9 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 /** DevMCSSupported : Rx MCS supported */
 #define GET_RXMCSSUPP(DevMCSSupported) (DevMCSSupported & 0x0f)
 
+/** hw_dev_cap : MPDU DENSITY */
+#define GET_MPDU_DENSITY(hw_dev_cap) (hw_dev_cap & 0x7)
+
 /** GET HTCapInfo : Supported Channel BW */
 #define GETHT_SUPPCHANWIDTH(HTCapInfo) (HTCapInfo & MBIT(1))
 /** GET HTCapInfo : Support for Greenfield */
@@ -889,7 +892,14 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define SET_EXTCAP_TWT_REQ(ext_cap) (ext_cap.TWTReq = 1)
 /** ExtCap : ReSet support Ext TWT REQ */
 #define RESET_EXTCAP_TWT_REQ(ext_cap) (ext_cap.TWTReq = 0)
+/** ExtCap : Support for Beacon Protection */
+#define ISSUPP_EXTCAP_EXT_BEACON_PROT(ext_cap) (ext_cap.beacon_prot)
+/** ExtCap : Set support Beacon Protection */
+#define SET_EXTCAP_BEACON_PROT(ext_cap) (ext_cap.beacon_prot = 1)
 
+/** ExtCap : Set FTMI bit(bit 71) */
+#define SET_EXTCAP_FTMI(ext_cap) (ext_cap.FTMI = 1)
+#define SET_EXTCAP_INTERNETWORKING(ext_cap) (ext_cap.Interworking = 1)
 /** LLC/SNAP header len   */
 #define LLC_SNAP_LEN 8
 
@@ -1368,6 +1378,9 @@ typedef enum _WLAN_802_11_WEP_STATUS {
 #define HostCmd_CMD_802_11_STATS 0x0014
 #define HostCmd_CMD_GET_CH_LOAD 0x027b
 
+/** Host Command ID: CROSS CHIP SYNCH */
+#define HostCmd_CMD_CROSS_CHIP_SYNCH 0x027d
+
 /** Host Command ID : TDLS configuration */
 #define HostCmd_CMD_TDLS_CONFIG 0x0100
 /** Host Command ID : TDLS operation */
@@ -1678,9 +1691,6 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_He_Op_t {
 /** Host Command ID : GPIO independent reset configure */
 #define HostCmd_CMD_INDEPENDENT_RESET_CFG 0x0243
 
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 /* TLV type: reg type */
 #define TLV_TYPE_REG_ACCESS_CTRL (PROPRIETARY_TLV_BASE_ID + 0x13C) /* 0x023c*/
 /** MrvlIEtypes_Reg_type_t*/
@@ -1690,7 +1700,6 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_Reg_type_t {
 	/** type: 0x81/0x82/0x83 */
 	t_u8 type;
 } MLAN_PACK_END MrvlIEtypes_Reg_type_t;
-#endif
 /** use to query chan region cfg setting in firmware */
 #define HostCmd_CMD_CHAN_REGION_CFG 0x0242
 /** used in hostcmd to download region power cfg setting to firmware */
@@ -1755,6 +1764,17 @@ typedef MLAN_PACK_START struct _power_table_attr {
 #define HostCmd_CMD_TX_AMPDU_PROT_MODE 0x0263
 #define HostCmd_CMD_RATE_ADAPT_CFG 0x0264
 #define HostCmd_CMD_CCK_DESENSE_CFG 0x0265
+#define HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS 0x024d
+#define HostCmd_CMD_FTM_SESSION_CTRL 0x024e
+#define HostCmd_CMD_FTM_FEATURE_CTRL 0x024f
+#define HostCmd_CMD_WLS_REQ_FTM_RANGE 0x0250
+
+#define HostCmd_CMD_FTM_CONFIG_RESPONDER 0x0255
+#define HostCmd_ACT_RTT_GET_RSP_INFO 0x0000
+#define HostCmd_ACT_RTT_SET_RSP_EN 0x0001
+#define HostCmd_ACT_RTT_SET_RSP_DIS 0x0002
+#define HostCmd_ACT_RTT_SET_RSP_LCI 0x0003
+#define HostCmd_ACT_RTT_SET_RSP_LCR 0x0004
 
 #define HostCmd_CMD_VDLL 0x0240
 #if defined(PCIE)
@@ -1783,7 +1803,7 @@ typedef MLAN_PACK_START struct _power_table_attr {
 
 /** Host Command ID : IPS Config */
 #define HostCmd_CMD_IPS_CONFIG 0x0279
-
+#define HostCmd_CMD_OFDM_DESENSE_CFG 0x027f
 typedef MLAN_PACK_START struct {
 	t_u32 enable;
 } MLAN_PACK_END HostCmd_DS_IPS_CONFIG;
@@ -2088,6 +2108,14 @@ typedef enum _ENH_PS_MODES {
 
 #define EVENT_ROAM_OFFLOAD 0x00000083
 
+#define EVENT_WLS_FTM_COMPLETE 0x00000086
+
+#define WLS_SUB_EVENT_FTM_COMPLETE 0
+#define WLS_SUB_EVENT_RADIO_RECEIVED 1
+#define WLS_SUB_EVENT_RADIO_RPT_RECEIVED 2
+#define WLS_SUB_EVENT_ANQP_RESP_RECEIVED 3
+#define WLS_SUB_EVENT_RTT_RESULTS 4
+
 #define EVENT_EXCEED_MAX_P2P_CONN 0x00000089
 
 #if defined(PCIE)
@@ -2275,6 +2303,8 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_TDLS_Idle_Timeout_t {
 #define RXPD_CHAN_MASK 0x3FE0
 /** Rate control mask  15-23 */
 #define TXPD_RATE_MASK 0xff8000
+/** DCM at bit 16 */
+#define RXPD_DCM_MASK 0x10000
 /** enable bw ctrl in TxPD */
 #define TXPD_BW_ENABLE MBIT(20)
 /** enable tx power ctrl in TxPD */
@@ -2604,8 +2634,8 @@ typedef MLAN_PACK_START struct _parsed_region_chan_11d {
 /** ChanScanMode_t */
 typedef MLAN_PACK_START struct _ChanScanMode_t {
 #ifdef BIG_ENDIAN_SUPPORT
-	/** Reserved */
-	t_u8 reserved_7 : 1;
+	/** rnr_flag, host use only */
+	t_u8 rnr_flag : 1;
 	/** First passive scan then active scan */
 	t_u8 passive_to_active_scan : 1;
 	/** First channel in scan */
@@ -2635,8 +2665,8 @@ typedef MLAN_PACK_START struct _ChanScanMode_t {
 	t_u8 first_chan : 1;
 	/** First passive scan then active scan */
 	t_u8 passive_to_active_scan : 1;
-	/** Reserved */
-	t_u8 reserved_7 : 1;
+	/** rnr_flag, host use only */
+	t_u8 rnr_flag : 1;
 #endif
 } MLAN_PACK_END ChanScanMode_t;
 
@@ -3063,6 +3093,7 @@ typedef MLAN_PACK_START struct _MrvlIEtype_KeyParamSetV2_t {
 		wapi_param wapi;
 		/** IGTK key param */
 		cmac_aes_param cmac_aes;
+		gmac_aes_256_param gmac_aes;
 		/** gcmp key param */
 		gcmp_param gcmp;
 		/** ccmp 256 key parameters */
@@ -3525,8 +3556,8 @@ typedef MLAN_PACK_START struct _HostCmd_DS_GET_HW_SPEC {
 	t_u16 number_of_antenna;
 	/** FW release number, example 0x1234=1.2.3.4 */
 	t_u32 fw_release_number;
-	/** Reserved field */
-	t_u32 reserved_1;
+	/** hw dev cap */
+	t_u32 hw_dev_cap;
 	/** Reserved field */
 	t_u32 reserved_2;
 	/** Reserved field */
@@ -3666,7 +3697,6 @@ typedef MLAN_PACK_START struct _HostCmd_DS_GET_CH_LOAD {
 	t_s16 noise;
 	t_u16 rx_quality;
 	t_u16 duration;
-	t_u16 cca_th;
 } MLAN_PACK_END HostCmd_DS_GET_CH_LOAD;
 
 /**  HostCmd_DS_CMD_802_11_RSSI_INFO */
@@ -4747,6 +4777,22 @@ typedef MLAN_PACK_START struct _HostCmd_DS_GPIO_TSF_LATCH_PARAM_CONFIG {
 	t_u8 tlv_buf[];
 } MLAN_PACK_END HostCmd_DS_GPIO_TSF_LATCH_PARAM_CONFIG;
 
+/** MrvlIEtypes_CROSS_CHIP_SYNCH_CONFIG */
+typedef MLAN_PACK_START struct _HostCmd_DS_CROSS_CHIP_SYNCH {
+	/** Action 0-GET, 1-SET */
+	t_u16 action;
+	/**cross chip sync start/stop */
+	t_u8 start_stop;
+	/**cross chip synch role, master or slave */
+	t_u8 role;
+	/**cross chip synch periodicty of toggle in us */
+	t_u32 period;
+	/**cross chip synch initial TSF low */
+	t_u32 init_tsf_low;
+	/**cross chip synch intial TSF high */
+	t_u32 init_tsf_high;
+} MLAN_PACK_END HostCmd_DS_CROSS_CHIP_SYNCH;
+
 MLAN_PACK_START struct coalesce_filt_field_param {
 	t_u8 operation;
 	t_u8 operand_len;
@@ -5287,6 +5333,16 @@ typedef struct MLAN_PACK_START _hostcmd_twt_teardown {
 	t_u8 reserved[3];
 } MLAN_PACK_END hostcmd_twt_teardown, *phostcmd_twt_teardown;
 
+/** Type definition of hostcmd_twt_report */
+typedef MLAN_PACK_START struct _hostcmd_twt_report {
+	/** TWT report type, 0: BTWT id */
+	t_u8 type;
+	/** TWT report length of value in data */
+	t_u8 length;
+	t_u8 reserve[2];
+	/** TWT report payload for FW response to fill */
+	t_u8 data[36];
+} MLAN_PACK_END hostcmd_twt_report, *phostcmd_twt_report;
 /** HostCmd_DS_TWT_CFG */
 typedef MLAN_PACK_START struct _HostCmd_DS_TWT_CFG {
 	/** Action */
@@ -5300,6 +5356,8 @@ typedef MLAN_PACK_START struct _HostCmd_DS_TWT_CFG {
 		/** TWT Teardown config for Sub ID: MLAN_11AX_TWT_TEARDOWN_SUBID
 		 */
 		hostcmd_twt_teardown twt_teardown;
+		/** TWT report for Sub ID: MLAN_11AX_TWT_REPORT_SUBID */
+		hostcmd_twt_report twt_report;
 	} param;
 } MLAN_PACK_END HostCmd_DS_TWT_CFG;
 
@@ -5535,6 +5593,16 @@ typedef MLAN_PACK_START struct _MrvlIETypes_SuppOperClass_t {
 	t_u8 oper_class[1];
 } MLAN_PACK_END MrvlIETypes_SuppOperClass_t;
 
+/*  Supported Transmit Power Envelope Element */
+typedef MLAN_PACK_START struct {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Transmit Power Information */
+	t_u8 tpc_info;
+	/** Maximum Transmit Power Spectral Density */
+	t_u8 max_tp_spectral_density;
+} MLAN_PACK_END MrvlIETypes_TpcEnvelope_t;
+
 /** Oper_class channel bandwidth element */
 typedef MLAN_PACK_START struct _MrvlIEtypes_chan_bw_oper_t {
 	/** Header */
@@ -7790,6 +7858,22 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_Keep_Alive_Pkt_t {
 	t_u8 ip_packet[];
 } MLAN_PACK_END MrvlIEtypes_Keep_Alive_Pkt_t;
 
+#define OID_CLOUD_KEEP_ALIVE_ACK 1
+#define TLV_TYPE_CLOUD_KEEP_ALIVE_ACK                                          \
+	(PROPRIETARY_TLV_BASE_ID + 0x15D) /* 0x0100 + 349 */
+
+typedef MLAN_PACK_START struct _MrvlIEtypes_Cloud_Keep_Alive_Rx_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** ID for cloud keep alive */
+	t_u8 keep_alive_id;
+	/** Enable/disable for this ID */
+	t_u8 enable;
+	/** Ethernet Header */
+	Eth803Hdr_t eth_header;
+	/** packet buffer*/
+	t_u8 ip_packet[];
+} MLAN_PACK_END MrvlIEtypes_Cloud_Keep_Alive_Rx_t;
 /** TLV to indicate firmware only keep probe response while scan */
 #define TLV_TYPE_ONLYPROBERESP (PROPRIETARY_TLV_BASE_ID + 0xE9) /* 0x01E9 */
 typedef MLAN_PACK_START struct _MrvlIEtypes_OnlyProberesp_t {
@@ -7799,6 +7883,230 @@ typedef MLAN_PACK_START struct _MrvlIEtypes_OnlyProberesp_t {
 	t_u8 proberesp_only;
 } MLAN_PACK_END MrvlIEtypes_OnlyProberesp_t;
 
+/** TLV for RTT Range Request */
+#define TLV_TYPE_RTT_RANGE_REQUEST                                             \
+	(PROPRIETARY_TLV_BASE_ID + 0x125) /* 0x0100 + 0x125 */
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTRangeRequest_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Peer device MAC address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	t_u8 type;
+	/** peer device hint (STA, P2P, AP) */
+	t_u8 peer;
+	/** channel number */
+	t_u8 channel;
+	/** Band Config */
+	Band_Config_t bandcfg;
+	/** Time interval between bursts (units: 100 ms) */
+	t_u8 burst_period;
+	/** Total number of RTT bursts to be executed. */
+	t_u8 num_burst;
+	/** num of frames per burst. */
+	t_u8 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. */
+	t_u8 num_retries_per_rtt_frame;
+	/** Maximum number of retries that the initiator can retry an FTMR
+	 * frame. */
+	t_u8 num_retries_per_ftmr;
+	/** LCI request */
+	t_u8 LCI_request;
+	/** LCR request */
+	t_u8 LCR_request;
+	/** burst duration */
+	t_u8 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	t_u8 preamble;
+	/** RTT BW to be used in the RTT frames */
+	t_u8 bw;
+} MLAN_PACK_END MrvlIEtypes_RTTRangeRequest_t;
+
+/** TLV for RTT Range Cancel */
+#define TLV_TYPE_RTT_RANGE_CANCEL                                              \
+	(PROPRIETARY_TLV_BASE_ID + 0x126) /* 0x0100 + 0x126 */
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTRangeCancel_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Peer device MAC address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+} MLAN_PACK_END MrvlIEtypes_RTTRangeCancel_t;
+
+typedef MLAN_PACK_START struct _HostCmd_DS_FTM_CONFIG_SESSION_PARAMS {
+	/** Action */
+	t_u16 action;
+	/** TLV buffer */
+	/** MrvlIEtypes_RTTRangeRequest_t */
+	/** MrvlIEtypes_RTTRangeCancel_t */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END HostCmd_DS_FTM_CONFIG_SESSION_PARAMS;
+
+typedef MLAN_PACK_START struct _WLS_Sub_Event_RTTResults_t {
+	/** complete */
+	t_u8 complete;
+	/** tlv buffer */
+	/** MrvlIEtypes_RTTResult_t */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END WLS_SUB_EVENT_RTTResults_t;
+
+/** TLV for RTT Result */
+#define TLV_TYPE_RTT_RESULT                                                    \
+	(PROPRIETARY_TLV_BASE_ID + 0x127) /* 0x0100 + 0x127 */
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTResult_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** Peer device MAC address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** burst number in a multi-burst request */
+	t_u32 burst_num;
+	/** Total RTT measurement frames attempted */
+	t_u32 measurement_number;
+	/** Total successful RTT measurement frames */
+	t_u32 success_number;
+	/** Maximum number of "FTM frames per burst" supported by the responder
+	 * STA. */
+	t_u8 number_per_burst_peer;
+	/** ranging status */
+	t_u8 status;
+	/** The time provided by the responder when the request can be tried
+	 * again. */
+	t_u8 retry_after_duration;
+	/** RTT type */
+	t_u8 type;
+	/** average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB */
+	t_s32 rssi;
+	/** rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
+	 */
+	t_s32 rssi_spread;
+	/** TX rate */
+	mlan_wifi_rate tx_rate;
+	/** RX rate */
+	mlan_wifi_rate rx_rate;
+	/** round trip time in picoseconds */
+	t_s64 rtt;
+	/** rtt standard deviation in picoseconds */
+	t_s64 rtt_sd;
+	/** difference between max and min rtt times recorded in picoseconds */
+	t_s64 rtt_spread;
+	/** distance in mm (optional) */
+	t_s32 distance_mm;
+	/** standard deviation in mm (optional) */
+	t_s32 distance_sd_mm;
+	/** difference between max and min distance recorded in mm (optional) */
+	t_s32 distance_spread_mm;
+	/** time of the measurement (in microseconds since boot) */
+	t_s64 ts;
+	/** in ms, actual time taken by the FW to finish one burst */
+	t_s32 burst_duration;
+	/** Number of bursts allowed by the responder. */
+	t_s32 negotiated_burst_num;
+	/** tlv buffer */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END MrvlIEtypes_RTTResult_t;
+
+/** TLV for IEEEI IE */
+typedef MLAN_PACK_START struct _MrvlIEtypes_IEEEIE_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** data */
+	t_u8 data[];
+} MLAN_PACK_END MrvlIEtypes_IEEEIE_t;
+
+/** auto link switch network info */
+typedef MLAN_PACK_START struct _Event_WLS_FTM_t {
+	/** Event ID */
+	t_u16 event_id;
+	/** BSS index number for multiple BSS support */
+	t_u8 bss_index;
+	/** BSS type */
+	t_u8 bss_type;
+	/** sub event id */
+	t_u8 sub_event_id;
+	union {
+		/** RTT Results Sub Event */
+		WLS_SUB_EVENT_RTTResults_t rtt_results;
+	} u;
+} MLAN_PACK_END Event_WLS_FTM_t;
+
+typedef MLAN_PACK_START struct _HostCmd_DS_FTM_CONFIG_RESPONDER {
+	/** Action */
+	t_u16 action;
+	/** TLV buffer */
+	/** MrvlIEtypes_RTTResponderInfo_t */
+	/** MrvlIEtypes_RTTResponderEnCfg_t */
+	t_u8 tlv_buffer[];
+} MLAN_PACK_END HostCmd_DS_FTM_CONFIG_RESPONDER;
+
+/** TLV for RTTResponderInfo */
+#define TLV_TYPE_RTT_RESPONDER_INFO                                            \
+	(PROPRIETARY_TLV_BASE_ID + 0x128) /* 0x0100 + 0x128 */
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTResponderInfo_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** channel */
+	t_u8 channel;
+	/** bandcfg */
+	Band_Config_t bandcfg;
+	/** bandcfg */
+	t_u8 preamble;
+} MLAN_PACK_END MrvlIEtypes_RTTResponderInfo_t;
+
+/** TLV for RTTResponderEnCfg */
+#define TLV_TYPE_RTT_RESPONDER_EN_CFG                                          \
+	(PROPRIETARY_TLV_BASE_ID + 0x129) /* 0x0100 + 0x129 */
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTResponderEnCfg_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** channel */
+	t_u8 channel;
+	/** bandcfg */
+	Band_Config_t bandcfg;
+	/** bandcfg */
+	t_u32 max_duration_seconds;
+} MLAN_PACK_END MrvlIEtypes_RTTResponderEnCfg_t;
+
+/** TLV for RTTLCICfg */
+#define TLV_TYPE_RTT_LCI_CFG                                                   \
+	(PROPRIETARY_TLV_BASE_ID + 0x12A) /* 0x0100 + 0x12A */
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTLCICfg_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** latitude */
+	t_u64 latitude;
+	/** longitude */
+	t_u64 longitude;
+	/** altitude */
+	t_u32 altitude;
+	/** latitude_unc */
+	t_u8 latitude_unc;
+	/** longitude_unc */
+	t_u8 longitude_unc;
+	/** altitude_unc */
+	t_u8 altitude_unc;
+	/** motion_pattern */
+	t_u8 motion_pattern;
+	/** floor */
+	t_u32 floor;
+	/** height_above_floor */
+	t_u32 height_above_floor;
+	/** height_unc */
+	t_u32 height_unc;
+} MLAN_PACK_END MrvlIEtypes_RTTLCICfg_t;
+
+/** TLV for RTTLCRCfg */
+#define TLV_TYPE_RTT_LCR_CFG                                                   \
+	(PROPRIETARY_TLV_BASE_ID + 0x12B) /* 0x0100 + 0x12B */
+typedef MLAN_PACK_START struct _MrvlIEtypes_RTTLCRCfg_t {
+	/** Header */
+	MrvlIEtypesHeader_t header;
+	/** country_code */
+	char country_code[2];
+	/** length of the info field */
+	t_u32 length;
+	/** Civic info to be copied in FTM frame */
+	char civic_info[256];
+} MLAN_PACK_END MrvlIEtypes_RTTLCRCfg_t;
+
 #if defined(DRV_EMBEDDED_AUTHENTICATOR) || defined(DRV_EMBEDDED_SUPPLICANT)
 #define HostCmd_CMD_CRYPTO 0x025e
 
@@ -7942,6 +8250,16 @@ typedef MLAN_PACK_START struct _HostCmd_DS_CMD_RX_ABORT_CFG {
 	/** rx weak rssi pkt threshold */
 	t_s8 rssi_threshold;
 } MLAN_PACK_END HostCmd_DS_CMD_RX_ABORT_CFG;
+
+/** HostCmd_CMD_OFDM_DESENSE_CFG */
+typedef MLAN_PACK_START struct _HostCmd_DS_CMD_OFDM_DESENSE_CFG {
+	/** Action */
+	t_u16 action;
+	/** Enable/disable cca desense on pkt  */
+	t_u8 enable;
+	/**  cca pkt threshold */
+	t_s8 cca_threshold;
+} MLAN_PACK_END HostCmd_DS_CMD_OFDM_DESENSE_CFG;
 /** HostCmd_CMD_RX_ABORT_CFG_EXT */
 typedef MLAN_PACK_START struct _HostCmd_DS_CMD_RX_ABORT_CFG_EXT {
 	/** Action */
@@ -7952,6 +8270,14 @@ typedef MLAN_PACK_START struct _HostCmd_DS_CMD_RX_ABORT_CFG_EXT {
 	t_s8 rssi_margin;
 	/** specify ceil rssi threshold */
 	t_s8 ceil_rssi_threshold;
+	/** specify floor rssi threshold */
+	t_s8 floor_rssi_threshold;
+	/** current dynamic rssi threshold */
+	t_s8 current_dynamic_rssi_threshold;
+	/** rssi config: default or user configured */
+	t_u8 rssi_default_config;
+	/** EDMAC status */
+	t_u8 edmac_enable;
 } MLAN_PACK_END HostCmd_DS_CMD_RX_ABORT_CFG_EXT;
 
 /** HostCmd_CMD_ARB_CONFIG */
@@ -8247,6 +8573,8 @@ typedef struct MLAN_PACK_START _HostCmd_DS_COMMAND {
 		HostCmd_DS_ROAM_OFFLOAD roam_offload;
 		HostCmd_DS_CHAN_REGION_CFG reg_cfg;
 		HostCmd_DS_AUTO_TX auto_tx;
+		HostCmd_DS_FTM_CONFIG_SESSION_PARAMS ftm_config;
+		HostCmd_DS_FTM_CONFIG_RESPONDER ftm_rtt_responder;
 		HostCmd_DS_DYN_BW dyn_bw;
 		HostCmd_DS_802_11_ROBUSTCOEX robustcoexparams;
 		HostCmd_DS_DMCS_CFG dmcs;
@@ -8273,6 +8601,7 @@ typedef struct MLAN_PACK_START _HostCmd_DS_COMMAND {
 		HostCmd_DS_TWT_CFG twtcfg;
 
 		HostCmd_DS_CMD_RX_ABORT_CFG rx_abort_cfg;
+		HostCmd_DS_CMD_OFDM_DESENSE_CFG ofdm_desense_cfg;
 		HostCmd_DS_CMD_RX_ABORT_CFG_EXT rx_abort_cfg_ext;
 		HostCmd_DS_CMD_TX_AMPDU_PROT_MODE tx_ampdu_prot_mode;
 		HostCmd_DS_CMD_RATE_ADAPT_CFG rate_adapt_cfg;
@@ -8294,6 +8623,7 @@ typedef struct MLAN_PACK_START _HostCmd_DS_COMMAND {
 		HostCmd_DS_MC_AGGR_CFG mc_aggr_cfg;
 		HostCmd_DS_STATS stats;
 		HostCmd_DS_GET_CH_LOAD ch_load;
+		HostCmd_DS_CROSS_CHIP_SYNCH cross_chip_synch;
 	} params;
 } MLAN_PACK_END HostCmd_DS_COMMAND, *pHostCmd_DS_COMMAND;
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ieee.h b/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
index cf2ef85..e0a73ad 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ieee.h
@@ -4,7 +4,7 @@
  *  definitions used in MLAN and MOAL module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -48,7 +48,7 @@ typedef enum _WLAN_802_11_NETWORK_TYPE {
 
 #ifdef BIG_ENDIAN_SUPPORT
 /** Frame control: Type Mgmt frame */
-#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x3000
+#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x0c00
 /** Frame control: SubType Mgmt frame */
 #define IEEE80211_GET_FC_MGMT_FRAME_SUBTYPE(fc) (((fc)&0xF000) >> 12)
 #else
@@ -90,6 +90,8 @@ typedef MLAN_PACK_START enum _IEEEtypes_ElementId_e {
 	EXTEND_CHANNEL_SWITCH_ANN = 60,
 	QUIET = 40,
 	IBSS_DFS = 41,
+	MEASUREMENT_REQUEST = 38,
+	MEASUREMENT_REPORT = 39,
 	SUPPORTED_CHANNELS = 36,
 	REGULATORY_CLASS = 59,
 	HT_CAPABILITY = 45,
@@ -177,6 +179,33 @@ typedef MLAN_PACK_START struct _IEEEtypes_Generic_t {
 	t_u8 data[IEEE_MAX_IE_SIZE - sizeof(IEEEtypes_Header_t)];
 } MLAN_PACK_END IEEEtypes_Generic_t, *pIEEEtypes_Generic_t;
 
+#define MEASURE_TYPE_CLI 8
+#define MEASURE_TYPE_LOCATION_CIVIC 9
+
+/** Measurement Report IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MeasurementReport_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Measurement Token */
+	t_u8 ms_token;
+	/** Measurement Report Mode */
+	t_u8 ms_rp_mode;
+	/** Measurement Type, value in MEASURE_TYPE_XXX */
+	t_u8 ms_type;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_MeasurementReport_t;
+
+/** Report */
+typedef MLAN_PACK_START struct _IEEEtypes_Report_t {
+	/** Subelement ID */
+	t_u8 subelement_id;
+	/** length */
+	t_u8 length;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_Report_t;
+
 /**ft capability policy*/
 typedef MLAN_PACK_START struct _IEEEtypes_FtCapPolicy_t {
 #ifdef BIG_ENDIAN_SUPPORT
@@ -1718,8 +1747,8 @@ typedef MLAN_PACK_START struct _wlan_user_scan_chan {
 	t_u8 radio_type;
 	/** Scan type: Active = 1, Passive = 2 */
 	t_u8 scan_type;
-	/** Reserved */
-	t_u8 reserved;
+	/** rnr_flag */
+	t_u8 rnr_flag;
 	/** Scan duration in milliseconds; if 0 default used */
 	t_u32 scan_time;
 } MLAN_PACK_END wlan_user_scan_chan;
@@ -1834,11 +1863,14 @@ typedef MLAN_PACK_START struct {
 #define BG_SCAN_SSID_RSSI_MATCH 0x0004
 /**wait for all channel scan to complete to report scan result*/
 #define BG_SCAN_WAIT_ALL_CHAN_DONE 0x80000000
-/** Maximum number of channels that can be sent in bg scan config */
-#define CHAN_MAX_24G 14
-#define CHAN_MAX_5G 24
-#define CHAN_MAX_UNII4 3
-#define WLAN_BG_SCAN_CHAN_MAX (CHAN_MAX_24G + CHAN_MAX_5G + CHAN_MAX_UNII4)
+
+#define CHAN_MAX_6G 0
+
+/** max bgscan chan number */
+#define WLAN_BG_SCAN_CHAN_MAX 38
+
+/** max bgscan chan number, include UNII_4 channel */
+#define WLAN_BG_SCAN_CHAN_MAX_UNII_4 41
 
 /** Enumeration definition */
 /** EES MODE */
@@ -1906,7 +1938,7 @@ typedef MLAN_PACK_START struct {
 	/** SSID filter list used in the to limit the scan results */
 	wlan_user_scan_ssid ssid_list[MRVDRV_MAX_SSID_LIST_LENGTH];
 	/** Variable number (fixed maximum) of channels to scan up */
-	wlan_user_scan_chan chan_list[WLAN_BG_SCAN_CHAN_MAX];
+	wlan_user_scan_chan chan_list[WLAN_USER_SCAN_CHAN_MAX];
 	/** scan channel gap */
 	t_u16 scan_chan_gap;
 	/** Enable EES configuration */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_init.c b/mxm_wifiex/wlan_src/mlan/mlan_init.c
index a9fd9cd..38f70f6 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_init.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_init.c
@@ -317,6 +317,20 @@ mlan_status wlan_allocate_adapter(pmlan_adapter pmadapter)
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
+	if (pmadapter->callbacks.moal_vmalloc &&
+	    pmadapter->callbacks.moal_vfree)
+		ret = pmadapter->callbacks.moal_vmalloc(
+			pmadapter->pmoal_handle, buf_size,
+			(t_u8 **)&pmadapter->pold_chan_stats);
+	else
+		ret = pmadapter->callbacks.moal_malloc(
+			pmadapter->pmoal_handle, buf_size, MLAN_MEM_DEF,
+			(t_u8 **)&pmadapter->pold_chan_stats);
+	if (ret != MLAN_STATUS_SUCCESS || !pmadapter->pold_chan_stats) {
+		PRINTM(MERROR, "Failed to allocate old channel statistics\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
 #endif
 
 	/* Allocate command buffer */
@@ -967,13 +981,11 @@ t_void wlan_init_adapter(pmlan_adapter pmadapter)
 				EVT_RW_PTR_ROLLOVER_IND;
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			pmadapter->pcard_pcie->rxbd_wrptr =
 				pmadapter->pcard_pcie->txrx_bd_size;
 			pmadapter->pcard_pcie->evtbd_wrptr = MLAN_MAX_EVT_BD;
 		}
-#endif
 	}
 #endif
 	LEAVE();
@@ -1763,6 +1775,15 @@ t_void wlan_free_adapter(pmlan_adapter pmadapter)
 					(t_u8 *)pmadapter->pchan_stats);
 		pmadapter->pchan_stats = MNULL;
 	}
+	if (pmadapter->pold_chan_stats) {
+		if (pcb->moal_vmalloc && pcb->moal_vfree)
+			pcb->moal_vfree(pmadapter->pmoal_handle,
+					(t_u8 *)pmadapter->pold_chan_stats);
+		else
+			pcb->moal_mfree(pmadapter->pmoal_handle,
+					(t_u8 *)pmadapter->pold_chan_stats);
+		pmadapter->pold_chan_stats = MNULL;
+	}
 	if (pmadapter->bcn_buf) {
 		if (pcb->moal_vmalloc && pcb->moal_vfree)
 			pcb->moal_vfree(pmadapter->pmoal_handle,
@@ -2055,11 +2076,16 @@ mlan_status wlan_init_fw_complete(pmlan_adapter pmadapter)
 	/* Reconfigure wmm parameter*/
 	if (status == MLAN_STATUS_SUCCESS) {
 		pmpriv = wlan_get_priv(pmadapter, MLAN_BSS_ROLE_STA);
-		if (pmpriv)
+		if (pmpriv) {
 			status = wlan_prepare_cmd(pmpriv,
 						  HostCmd_CMD_WMM_PARAM_CONFIG,
 						  HostCmd_ACT_GEN_SET, 0, MNULL,
 						  &pmadapter->ac_params);
+			if (status != MLAN_STATUS_SUCCESS)
+				PRINTM(MERROR,
+				       "ERR: wlan_prepare_cmd returned status=0x%x\n",
+				       status);
+		}
 	}
 	/* Invoke callback */
 	ret = pcb->moal_init_fw_complete(pmadapter->pmoal_handle, status);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
index 7790db9..062b239 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
@@ -3,7 +3,7 @@
  *  @brief This file declares the IOCTL data structures and APIs.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -328,6 +328,9 @@ enum _mlan_ioctl_req_id {
 
 	MLAN_OID_MISC_ROBUSTCOEX = 0x00200056,
 	MLAN_OID_MISC_GET_TX_RX_HISTOGRAM = 0x00200057,
+	MLAN_OID_MISC_CONFIG_RTT = 0x00200059,
+	MLAN_OID_MISC_CANCEL_RTT = 0x0020005A,
+	MLAN_OID_MISC_RTT_RESPONDER_CFG = 0x0020005B,
 	MLAN_OID_MISC_CFP_INFO = 0x00200060,
 	MLAN_OID_MISC_BOOT_SLEEP = 0x00200061,
 #if defined(PCIE)
@@ -365,6 +368,10 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_MISC_CH_LOAD = 0x00200087,
 	MLAN_OID_MISC_STATS = 0x00200088,
 	MLAN_OID_MISC_CH_LOAD_RESULTS = 0x00200089,
+	MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX = 0x0020008A,
+	MLAN_OID_MISC_CROSS_CHIP_SYNCH = 0x0020008B,
+	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
+	MLAN_OID_MISC_OFDM_DESENSE_CFG = 0x0020008D,
 };
 
 /** Sub command size */
@@ -1181,6 +1188,11 @@ typedef struct _mlan_uap_scan_channels {
 
 #define MAX_NUM_PKTS 9
 #define DEF_NUM_PKTS 3
+
+/** Default channel mode and retry packets for channel switch */
+#define DEFAULT_RETRY_PKTS 9
+#define DEFAULT_CHAN_MODE_MASK 3
+
 /** mlan_chan_switch_param */
 typedef struct _mlan_action_chan_switch {
 	/** mode*/
@@ -1372,8 +1384,6 @@ enum _mlan_band_def {
 	BAND_AAC = 64,
 	BAND_GAX = 256,
 	BAND_AAX = 512,
-	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
-
 };
 
 /** Channel bandwidth */
@@ -1885,6 +1895,8 @@ typedef struct _mlan_fw_info {
 	t_u32 hw_dot_11n_dev_cap;
 	/** Device support for MIMO abstraction of MCSs */
 	t_u8 hw_dev_mcs_support;
+	/** mpdu density */
+	t_u8 hw_mpdu_density;
 	/** user's MCS setting */
 	t_u8 usr_dev_mcs_support;
 	/** 802.11ac device capabilities */
@@ -1927,6 +1939,8 @@ typedef struct _mlan_fw_info {
 	t_u8 prohibit_80mhz;
 	/** FW support beacon protection */
 	t_u8 fw_beacon_prot;
+	/** FW RTT support */
+	t_u8 rtt_support;
 
 	/* lower 8 bytes of uuid */
 	t_u64 uuid_lo;
@@ -2548,6 +2562,9 @@ typedef struct _sta_info_data {
 	t_u16 ie_len;
 } sta_info_data;
 
+/** Per station Maximum IE buffer SIZE */
+#define MAX_STA_LIST_IE_SIZE 13
+
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
 typedef struct _mlan_ds_sta_list {
 	/** station count */
@@ -4017,6 +4034,7 @@ typedef struct _mlan_ds_11ax_cfg {
 
 #define MLAN_11AX_TWT_SETUP_SUBID 0x114
 #define MLAN_11AX_TWT_TEARDOWN_SUBID 0x115
+#define MLAN_11AX_TWT_REPORT_SUBID 0x116
 
 #define MRVL_DOT11AX_ENABLE_SR_TLV_ID (PROPRIETARY_TLV_BASE_ID + 322)
 #define MRVL_DOT11AX_OBSS_PD_OFFSET_TLV_ID (PROPRIETARY_TLV_BASE_ID + 323)
@@ -4153,6 +4171,17 @@ typedef struct MLAN_PACK_START _mlan_ds_twt_teardown {
 	t_u8 teardown_all_twt;
 } MLAN_PACK_END mlan_ds_twt_teardown, *pmlan_ds_twt_teardown;
 
+/** Type definition of mlan_ds_twt_report for MLAN_OID_11AX_TWT_CFG */
+typedef MLAN_PACK_START struct _mlan_ds_twt_report {
+	/** TWT report type, 0: BTWT id */
+	t_u8 type;
+	/** TWT report length of value in data */
+	t_u8 length;
+	t_u8 reserve[2];
+	/** TWT report payload for FW response to fill */
+	t_u8 data[36];
+} MLAN_PACK_END mlan_ds_twt_report, *pmlan_ds_twt_report;
+
 /** Type definition of mlan_ds_twtcfg for MLAN_OID_11AX_TWT_CFG */
 typedef struct MLAN_PACK_START _mlan_ds_twtcfg {
 	/** Sub-command */
@@ -4166,6 +4195,8 @@ typedef struct MLAN_PACK_START _mlan_ds_twtcfg {
 		/** TWT Teardown config for Sub ID: MLAN_11AX_TWT_TEARDOWN_SUBID
 		 */
 		mlan_ds_twt_teardown twt_teardown;
+		/** TWT report for Sub ID: MLAN_11AX_TWT_REPORT_SUBID */
+		mlan_ds_twt_report twt_report;
 	} param;
 } MLAN_PACK_END mlan_ds_twtcfg, *pmlan_ds_twtcfg;
 
@@ -4243,20 +4274,11 @@ enum _mlan_reg_type {
 	MLAN_REG_CAU = 5,
 	MLAN_REG_PSU = 6,
 	MLAN_REG_BCA = 7,
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097) ||          \
-	defined(SD9177)
 	MLAN_REG_CIU = 8,
-#endif
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	MLAN_REG_MAC2 = 0x81,
 	MLAN_REG_BBP2 = 0x82,
 	MLAN_REG_RF2 = 0x83,
 	MLAN_REG_BCA2 = 0x87
-#endif
 };
 
 /** Type definition of mlan_ds_reg_rw for MLAN_OID_REG_RW */
@@ -4489,6 +4511,12 @@ enum _mlan_func_cmd {
 #define MLAN_NETMON_CONTROL MBIT(1)
 /* data frame */
 #define MLAN_NETMON_DATA MBIT(2)
+/* only unicast destined frame (no promiscuous) */
+#define MLAN_NETMON_NOPROM MBIT(3)
+/* capture non-bss Rx beacons */
+#define MLAN_NETMON_NON_BSS_BCN MBIT(5)
+/* capture Tx frames */
+#define MLAN_NETMON_TX MBIT(6)
 
 typedef struct _mlan_ds_misc_net_monitor {
 	/** Enable/disable network monitor */
@@ -4522,6 +4550,15 @@ typedef struct _mlan_ds_misc_rx_abort_cfg {
 	/** Rx weak RSSI pkt threshold */
 	t_s8 rssi_threshold;
 } mlan_ds_misc_rx_abort_cfg;
+/** Type definition of mlan_ds_misc_ofdm_desense_cfg
+ * for MLAN_OID_MISC_OFDM_DESENSE_CFG
+ */
+typedef struct _mlan_ds_misc_ofdm_desense_cfg {
+	/** enable/disable ofdm desense cfg */
+	t_u8 enable;
+	/** OFDM  CCA pkt threshold */
+	t_s8 cca_threshold;
+} mlan_ds_misc_ofdm_desense_cfg;
 
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
  * for MLAN_OID_MISC_RX_ABORT_CFG_EXT
@@ -4533,6 +4570,14 @@ typedef struct _mlan_ds_misc_rx_abort_cfg_ext {
 	t_s8 rssi_margin;
 	/** specify ceil rssi threshold */
 	t_s8 ceil_rssi_threshold;
+	/** specify floor rssi threshold */
+	t_s8 floor_rssi_threshold;
+	/** current dynamic rssi threshold */
+	t_s8 current_dynamic_rssi_threshold;
+	/** rssi config: default or user configured */
+	t_u8 rssi_default_config;
+	/** EDMAC status */
+	t_u8 edmac_enable;
 } mlan_ds_misc_rx_abort_cfg_ext;
 
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
@@ -5373,6 +5418,21 @@ typedef struct _mlan_ds_misc_keep_alive {
 	t_u16 ether_type;
 } mlan_ds_misc_keep_alive, *pmlan_ds_misc_keep_alive;
 
+#define MKEEP_ALIVE_ACK_PKT_MAX 100
+typedef struct _mlan_ds_misc_keep_alive_rx {
+	t_u8 mkeep_alive_id;
+	t_u8 enable;
+	/** enable/disable tcp reset*/
+	t_u8 reset;
+	/**True means saved in driver, false means not saved or download*/
+	t_u8 cached;
+	t_u8 dst_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u8 src_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u16 pkt_len;
+	t_u8 packet[MKEEP_ALIVE_ACK_PKT_MAX];
+	/** Ethernet type */
+	t_u16 ether_type;
+} mlan_ds_misc_keep_alive_rx, *pmlan_ds_misc_keep_alive_rx;
 /** TX and RX histogram statistic parameters*/
 typedef MLAN_PACK_START struct _mlan_ds_misc_tx_rx_histogram {
 	/** Enable or disable get tx/rx histogram statistic */
@@ -5427,6 +5487,115 @@ typedef struct _mlan_ds_misc_robustcoex_params {
 	t_u8 gpio_polarity;
 } mlan_ds_misc_robustcoex_params;
 
+/** RTT configuration */
+typedef struct _mlan_rtt_config {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	t_u8 type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	t_u8 peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	t_u8 channel;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	Band_Config_t bandcfg;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u8 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u8 num_burst;
+	/** num of frames per burst.
+	 * Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames
+	 * to be attempted in a single burst. This also
+	 * equals the number of FTM frames that the
+	 * initiator will request that the responder send
+	 * in a single frame. */
+	t_u8 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can
+	 * retry an FTMR frame.
+	 * Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u8 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	t_u8 preamble;
+	/** RTT BW to be used in the RTT frames */
+	t_u8 bw;
+} mlan_rtt_config, *pmlan_rtt_config;
+
+/** RTT config params */
+typedef struct _mlan_rtt_config_params {
+	t_u8 rtt_config_num;
+	mlan_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} mlan_rtt_config_params;
+
+/** RTT cancel params */
+typedef struct _mlan_rtt_cancel_params {
+	t_u8 rtt_cancel_num;
+	t_u8 rtt_cancel[MAX_RTT_CONFIG_NUM][MLAN_MAC_ADDR_LENGTH];
+} mlan_rtt_cancel_params;
+
+/** RTT responder info */
+typedef struct _rtt_responder_info {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u8 preamble;
+} rtt_responder_info;
+
+/** RTT responder enable configure */
+typedef struct _rtt_responder_encfg {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u32 max_dur_sec;
+} rtt_responder_encfg;
+
+/** Define for mlan_rtt_responder.action */
+#define RTT_GET_RESPONDER_INFO 0
+#define RTT_SET_RESPONDER_ENABLE 1
+#define RTT_SET_RESPONDER_DISABLE 2
+#define RTT_SET_RESPONDER_LCI 3
+#define RTT_SET_RESPONDER_LCR 4
+
+/** RTT responder configure for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+typedef struct _mlan_rtt_responder {
+	t_u8 action;
+	union {
+		rtt_responder_info info;
+		rtt_responder_encfg encfg;
+		wifi_lci_information lci;
+		wifi_lcr_information lcr;
+	} u;
+} mlan_rtt_responder;
+
 #if defined(PCIE)
 typedef struct _mlan_ds_ssu_params {
 	t_u32 nskip;
@@ -5885,9 +6054,24 @@ typedef struct _mlan_ds_ch_load {
 	t_s16 noise;
 	t_u16 rx_quality;
 	t_u16 duration;
-	t_u16 cca_th;
 } mlan_ds_ch_load;
 
+/** Type definition of mlan_ds_cross_chip_synch */
+typedef struct _mlan_ds_cross_chip_synch {
+	/**cross chip sync action 0-GET, 1-SET */
+	t_u16 action;
+	/**cross chip sync start or stop */
+	t_u8 start_stop;
+	/**cross chip sync role, master or slave */
+	t_u8 role;
+	/**cross chip sync periodicty of toggle in us */
+	t_u32 period;
+	/**cross chip sync initial TSF low */
+	t_u32 init_tsf_low;
+	/**cross chip sync intial TSF high */
+	t_u32 init_tsf_high;
+} mlan_ds_cross_chip_synch;
+
 /** Type definition of mlan_ds_misc_cfg for MLAN_IOCTL_MISC_CFG */
 typedef struct _mlan_ds_misc_cfg {
 	/** Sub-command */
@@ -6001,11 +6185,18 @@ typedef struct _mlan_ds_misc_cfg {
 		t_u64 misc_tsf;
 		mlan_ds_custom_reg_domain custom_reg_domain;
 		mlan_ds_misc_keep_alive keep_alive;
+		mlan_ds_misc_keep_alive_rx keep_alive_rx;
 		mlan_ds_misc_tx_rx_histogram tx_rx_histogram;
 		mlan_ds_cw_mode_ctrl cwmode;
 		/**  Tx/Rx per-packet control */
 		t_u8 txrx_pkt_ctrl;
 		mlan_ds_misc_robustcoex_params robustcoexparams;
+		/** config RTT for MLAN_OID_MISC_CONFIG_RTT */
+		mlan_rtt_config_params rtt_params;
+		/** cancel RTT for MLAN_OID_MISC_CANCEL_RTT */
+		mlan_rtt_cancel_params rtt_cancel;
+		/** config RTT responder for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+		mlan_rtt_responder rtt_rsp_cfg;
 #if defined(PCIE)
 		mlan_ds_ssu_params ssu_params;
 #endif
@@ -6016,6 +6207,7 @@ typedef struct _mlan_ds_misc_cfg {
 		mlan_ds_misc_mapping_policy dmcs_policy;
 		mlan_ds_misc_dmcs_status dmcs_status;
 		mlan_ds_misc_rx_abort_cfg rx_abort_cfg;
+		mlan_ds_misc_ofdm_desense_cfg ofdm_desense_cfg;
 		mlan_ds_misc_rx_abort_cfg_ext rx_abort_cfg_ext;
 		mlan_ds_misc_tx_ampdu_prot_mode tx_ampdu_prot_mode;
 		mlan_ds_misc_rate_adapt_cfg rate_adapt_cfg;
@@ -6033,6 +6225,7 @@ typedef struct _mlan_ds_misc_cfg {
 		mlan_ds_misc_arb_cfg arb_cfg;
 		mlan_ds_misc_cfp_tbl cfp;
 		t_u8 range_ext_mode;
+		mlan_ds_twt_report twt_report_info;
 		mlan_ds_misc_dot11mc_unassoc_ftm_cfg dot11mc_unassoc_ftm_cfg;
 		mlan_ds_misc_tp_state tp_state;
 		mlan_ds_hal_phy_cfg_params hal_phy_cfg_params;
@@ -6043,6 +6236,7 @@ typedef struct _mlan_ds_misc_cfg {
 #endif
 		t_u32 ips_ctrl;
 		mlan_ds_ch_load ch_load;
+		mlan_ds_cross_chip_synch cross_chip_synch;
 	} param;
 } mlan_ds_misc_cfg, *pmlan_ds_misc_cfg;
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_join.c b/mxm_wifiex/wlan_src/mlan/mlan_join.c
index fd92ed8..b63c45c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_join.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_join.c
@@ -309,12 +309,13 @@ static mlan_status wlan_get_common_rates(mlan_private *pmpriv, t_u8 *rate1,
 	PRINTM(MINFO, "Tx DataRate is set to 0x%X\n", pmpriv->data_rate);
 
 	if (!pmpriv->is_data_rate_auto) {
-		while (*ptr) {
+		while (rate1_size && *ptr) {
 			if ((*ptr & 0x7f) == pmpriv->data_rate) {
 				ret = MLAN_STATUS_SUCCESS;
 				goto done;
 			}
 			ptr++;
+			rate1_size--;
 		}
 		PRINTM(MMSG,
 		       "Previously set fixed data rate %#x is not "
@@ -1168,8 +1169,8 @@ mlan_status wlan_cmd_802_11_associate(mlan_private *pmpriv,
 			psae_pwe_mode_tlv = (MrvlIEtypes_SAE_PWE_Mode_t *)pos;
 			psae_pwe_mode_tlv->header.type = wlan_cpu_to_le16(
 				TLV_TYPE_WPA3_SAE_PWE_DERIVATION_MODE);
-			psae_pwe_mode_tlv->header.len =
-				sizeof(psae_pwe_mode_tlv->pwe);
+			psae_pwe_mode_tlv->header.len = wlan_cpu_to_le16(
+				sizeof(psae_pwe_mode_tlv->pwe));
 			psae_pwe_mode_tlv->pwe[0] =
 				pbss_desc->prsnx_ie->data[0];
 			pos += sizeof(psae_pwe_mode_tlv->header) +
@@ -1254,6 +1255,8 @@ mlan_status wlan_cmd_802_11_associate(mlan_private *pmpriv,
 			psecurity_cfg_ie->header.len = sizeof(t_u8);
 			pos += sizeof(psecurity_cfg_ie->header) +
 			       psecurity_cfg_ie->header.len;
+			psecurity_cfg_ie->header.len =
+				wlan_cpu_to_le16(psecurity_cfg_ie->header.len);
 		}
 #ifdef DRV_EMBEDDED_SUPPLICANT
 		else if (supplicantIsEnabled(pmpriv->psapriv)) {
@@ -1462,18 +1465,20 @@ mlan_status wlan_cmd_802_11_associate(mlan_private *pmpriv,
 		host_mlme_tlv = (MrvlIEtypes_HostMlme_t *)pos;
 		host_mlme_tlv->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_HOST_MLME);
-		host_mlme_tlv->header.len =
-			wlan_cpu_to_le16(sizeof(host_mlme_tlv->host_mlme));
+		host_mlme_tlv->header.len = sizeof(host_mlme_tlv->host_mlme);
 		host_mlme_tlv->host_mlme = MTRUE;
 		pos += sizeof(host_mlme_tlv->header) +
 		       host_mlme_tlv->header.len;
+		host_mlme_tlv->header.len =
+			wlan_cpu_to_le16(host_mlme_tlv->header.len);
 	}
 	if (memcmp(pmadapter, &pmpriv->curr_bss_params.prev_bssid, zero_mac,
 		   MLAN_MAC_ADDR_LENGTH)) {
 		prev_bssid_tlv = (MrvlIEtypes_PrevBssid_t *)pos;
 		prev_bssid_tlv->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_PREV_BSSID);
-		prev_bssid_tlv->header.len = MLAN_MAC_ADDR_LENGTH;
+		prev_bssid_tlv->header.len =
+			wlan_cpu_to_le16(MLAN_MAC_ADDR_LENGTH);
 		memcpy_ext(pmadapter, prev_bssid_tlv->prev_bssid,
 			   &pmpriv->curr_bss_params.prev_bssid,
 			   MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
@@ -1511,6 +1516,9 @@ mlan_status wlan_cmd_802_11_associate(mlan_private *pmpriv,
 	if (pmpriv->config_bands == BAND_B)
 		SHORT_SLOT_TIME_DISABLED(tmp_cap);
 
+	if (pmpriv->adapter->pcard_info->support_11mc)
+		RADIO_MEASUREMENT_ENABLED(tmp_cap);
+
 	tmp_cap &= CAPINFO_MASK;
 	PRINTM(MINFO, "ASSOC_CMD: tmp_cap=%4X CAPINFO_MASK=%4lX\n", tmp_cap,
 	       CAPINFO_MASK);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_main.h b/mxm_wifiex/wlan_src/mlan/mlan_main.h
index 643db9a..0e19825 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_main.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_main.h
@@ -353,8 +353,9 @@ extern t_u32 mlan_drvdbg;
 #define endian_convert_RxPD_extra_header(x)                                    \
 	do {                                                                   \
 		(x)->channel_flags = wlan_le16_to_cpu((x)->channel_flags);     \
-		(x)->vht_sig1 = wlan_le32_to_cpu((x)->vht_sig1);               \
-		(x)->vht_sig2 = wlan_le32_to_cpu((x)->vht_sig2);               \
+		(x)->vht_he_sig1 = wlan_le32_to_cpu((x)->vht_he_sig1);         \
+		(x)->vht_he_sig2 = wlan_le32_to_cpu((x)->vht_he_sig2);         \
+		(x)->user_idx = wlan_le32_to_cpu((x)->user_idx);               \
 	} while (0)
 #else
 /** Convert ulong n/w to host */
@@ -567,14 +568,7 @@ extern t_void (*assert_callback)(t_void *pmoal_handle, t_u32 cond);
 #define SDIO_CMD53_MAX_SIZE 65280
 #define MAX_SUPPORT_AMSDU_SIZE 4096
 /** Maximum numbfer of registers to read for multiple port */
-#if defined(SD8887) || defined(SD8997) || defined(SD8977) ||                   \
-	defined(SD8987) || defined(SD9098) || defined(SD9097) ||               \
-	defined(SDNW62X) || defined(SD8978) || defined(SD9177)
 #define MAX_MP_REGS 196
-#else
-/* upto 0xB7 */
-#define MAX_MP_REGS 184
-#endif
 /** Maximum port */
 #define MAX_PORT 32
 /** Maximum port 16 */
@@ -616,6 +610,9 @@ extern t_void (*assert_callback)(t_void *pmoal_handle, t_u32 cond);
 /** Debug command number */
 #define DBG_CMD_NUM 10
 
+/** scan GAP value is optional */
+#define GAP_FLAG_OPTIONAL MBIT(15)
+
 /** Info for debug purpose */
 typedef struct _wlan_dbg {
 	/** Number of host to card command failures */
@@ -1408,6 +1405,12 @@ typedef struct {
 	mlan_private *priv;
 } reorder_tmr_cnxt_t;
 
+#define MLAN_SET_BIT(x, val) ((x) |= (1U << (val)))
+#define MLAN_CLEAR_BIT(x, val) ((x) &= ~(1U << (val)))
+/** default RX reorder table flush time 128 ms for AC_VI, AC_VO*/
+#define DEF_FLUSH_TIME_AC_VI_VO 128
+/** default RX reorder table flush time 500 ms for AC_BE, AC_BK*/
+#define DEF_FLUSH_TIME_AC_BE_BK 500
 /** RX reorder table */
 struct _RxReorderTbl {
 	/** RxReorderTbl previous node */
@@ -1439,6 +1442,8 @@ struct _RxReorderTbl {
 	t_u8 pkt_count;
 	/** flush data flag */
 	t_u8 flush_data;
+	/** BA window bitmap */
+	t_u64 bitmap;
 };
 
 /** BSS priority node */
@@ -2167,7 +2172,12 @@ typedef struct _mlan_pcie_card_reg {
 	t_u32 host_intr_cmd_done;
 	/** Event ready interrupt for host */
 	t_u32 host_intr_event_rdy;
+	/** cmd dnld interrupt for host */
 	t_u32 host_intr_cmd_dnld;
+	/** adma align size */
+	t_u8 adma_align_size;
+	/** adma min pkt size */
+	t_u8 adma_min_pkt_size;
 	/* TX/RX buffer description mask */
 	t_u32 txrx_rw_ptr_mask;
 	/* TX/RX buffer description wrap mask */
@@ -2282,6 +2292,7 @@ typedef struct _mlan_card_info {
 	t_u8 supp_ps_handshake;
 	/** DEFAULT_11N_TX_BF_CAP */
 	t_u32 default_11n_tx_bf_cap;
+	t_u8 support_11mc;
 } mlan_card_info, *pmlan_card_info;
 
 typedef struct _mlan_adapter mlan_adapter, *pmlan_adapter;
@@ -2406,13 +2417,9 @@ struct _mlan_adapter {
 	t_u32 fw_cap_info;
 	/** Extended firmware capability information */
 	t_u32 fw_cap_ext;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	/** High byte for 5G, low byte for 2G, like 0x2211 0x22 for 5G, 0x11 for
 	 * 2G */
 	t_u16 user_htstream;
-#endif
 	/** vdll ctrl */
 	vdll_dnld_ctrl vdll_ctrl;
 #if defined(SDIO) || defined(PCIE)
@@ -2582,6 +2589,9 @@ struct _mlan_adapter {
 	t_u32 num_in_chan_stats;
 	/** index of chan stats */
 	t_u32 idx_chan_stats;
+	ChanStatistics_t *pold_chan_stats;
+	/** index of chan stats */
+	t_u32 old_idx_chan_stats;
 	t_u8 bgscan_reported;
 
 	/** Number of records in the scan table */
@@ -2729,6 +2739,8 @@ struct _mlan_adapter {
 	t_u32 hw_dot_11n_dev_cap;
 	/** Device support for MIMO abstraction of MCSs */
 	t_u8 hw_dev_mcs_support;
+	/** mpdu density */
+	t_u8 hw_mpdu_density;
 #ifdef STA_SUPPORT
 	/** Adhoc Secondary Channel Bandwidth */
 	t_u8 chan_bandwidth;
@@ -2852,6 +2864,8 @@ struct _mlan_adapter {
 	t_u32 tp_state_on;
 	/** Packet drop point */
 	t_u32 tp_state_drop_point;
+	/** second mac flag */
+	t_u8 second_mac;
 	/* lower 8 bytes of uuid */
 	t_u64 uuid_lo;
 
@@ -3246,6 +3260,14 @@ mlan_status wlan_misc_gpio_tsf_latch_config(pmlan_adapter pmadapter,
 					    pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_get_tsf_info(pmlan_adapter pmadapter,
 				   pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				      t_void *pdata_buf);
+mlan_status wlan_ret_cross_chip_synch(pmlan_private pmpriv,
+				      HostCmd_DS_COMMAND *resp,
+				      mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_misc_ioctl_cross_chip_synch(pmlan_adapter pmadapter,
+					     pmlan_ioctl_req pioctl_req);
 /** get ralist info */
 int wlan_get_ralist_info(mlan_private *priv, pralist_info buf);
 /** dump ralist */
@@ -3594,6 +3616,12 @@ mlan_status wlan_cmd_rxabortcfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 				t_u16 cmd_action, t_void *pdata_buf);
 mlan_status wlan_ret_rxabortcfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 				mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_cmd_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
+				     t_void *pdata_buf);
+mlan_status wlan_ret_ofdmdesense_cfg(pmlan_private pmpriv,
+				     HostCmd_DS_COMMAND *resp,
+				     mlan_ioctl_req *pioctl_buf);
 mlan_status wlan_cmd_rxabortcfg_ext(pmlan_private pmpriv,
 				    HostCmd_DS_COMMAND *cmd, t_u16 cmd_action,
 				    t_void *pdata_buf);
@@ -3642,6 +3670,8 @@ mlan_status wlan_ret_arb_cfg(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
 
 mlan_status wlan_misc_ioctl_rxabortcfg(pmlan_adapter pmadapter,
 				       pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_ioctl_ofdmdesense_cfg(pmlan_adapter pmadapter,
+					    pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_rxabortcfg_ext(pmlan_adapter pmadapter,
 					   pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_tx_ampdu_prot_mode(pmlan_adapter pmadapter,
@@ -3660,6 +3690,10 @@ mlan_status wlan_misc_ioctl_rf_test_cfg(pmlan_adapter pmadapter,
 					pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_range_ext(pmlan_adapter pmadapter,
 				      pmlan_ioctl_req pioctl_req);
+mlan_status wlan_misc_ioctl_twt_report(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req);
+mlan_status wlan_ret_twt_report(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf);
 mlan_status wlan_misc_ioctl_arb_cfg(pmlan_adapter pmadapter,
 				    pmlan_ioctl_req pioctl_req);
 mlan_status wlan_misc_ioctl_tp_state(pmlan_adapter pmadapter,
@@ -3767,7 +3801,7 @@ sta_node *wlan_add_station_entry(mlan_private *priv, t_u8 *mac);
 void wlan_check_sta_capability(pmlan_private priv, pmlan_buffer pevent,
 			       sta_node *sta_ptr);
 /** find specific ie */
-t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u8 ie_len,
+t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u16 ie_len,
 			   IEEEtypes_ElementId_e id, t_u8 ext_id);
 t_u8 wlan_is_wmm_ie_present(pmlan_adapter pmadapter, t_u8 *pbuf, t_u16 buf_len);
 /** Ethernet II header */
@@ -3987,6 +4021,33 @@ t_void wlan_tdls_config(pmlan_private pmpriv, t_u8 enable);
 mlan_status wlan_misc_ioctl_tdls_cs_channel(pmlan_adapter pmadapter,
 					    pmlan_ioctl_req pioctl_req);
 
+mlan_status wlan_config_rtt(pmlan_adapter pmadapter,
+			    pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cancel_rtt(pmlan_adapter pmadapter,
+			    pmlan_ioctl_req pioctl_req);
+mlan_status wlan_rtt_responder_cfg(pmlan_adapter pmadapter,
+				   pmlan_ioctl_req pioctl_req);
+mlan_status wlan_cmd_802_11_ftm_config_session_params(pmlan_private pmpriv,
+						      HostCmd_DS_COMMAND *cmd,
+						      t_u16 cmd_action,
+						      t_u32 cmd_oid,
+						      t_void *pdata_buf);
+mlan_status
+wlan_ret_802_11_ftm_config_session_params(pmlan_private pmpriv,
+					  HostCmd_DS_COMMAND *resp,
+					  mlan_ioctl_req *pioctl_buf);
+mlan_status wlan_fill_hal_rtt_results(pmlan_private pmpriv,
+				      Event_WLS_FTM_t *event_ftm,
+				      t_u32 event_ftm_len, mlan_event *pevent);
+mlan_status wlan_cmd_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *cmd,
+						 t_u16 cmd_action,
+						 t_u32 cmd_oid,
+						 t_void *pdata_buf);
+mlan_status wlan_ret_802_11_ftm_config_responder(pmlan_private pmpriv,
+						 HostCmd_DS_COMMAND *resp,
+						 mlan_ioctl_req *pioctl_buf);
+
 mlan_status wlan_get_info_ver_ext(pmlan_adapter pmadapter,
 				  pmlan_ioctl_req pioctl_req);
 
@@ -4048,7 +4109,7 @@ int wlan_add_supported_oper_class_ie(mlan_private *pmpriv, t_u8 **pptlv_out,
 mlan_status wlan_get_curr_oper_class(mlan_private *pmpriv, t_u8 channel,
 				     t_u8 bw, t_u8 *oper_class);
 mlan_status wlan_check_operclass_validation(mlan_private *pmpriv, t_u8 channel,
-					    t_u8 oper_class);
+					    t_u8 oper_class, t_u8 bandwidth);
 mlan_status wlan_misc_ioctl_operclass_validation(pmlan_adapter pmadapter,
 						 mlan_ioctl_req *pioctl_req);
 mlan_status wlan_misc_ioctl_oper_class(pmlan_adapter pmadapter,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_misc.c b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
index 3ffa5bb..f53e4fc 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_misc.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_misc.c
@@ -4,7 +4,7 @@
  *  @brief This file include miscellaneous functions for MLAN module
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -695,7 +695,8 @@ t_void wlan_wakeup_card_timeout_func(void *function_context)
 	PRINTM(MERROR, "%s: ps_state=%d\n", __FUNCTION__, pmadapter->ps_state);
 	if (pmadapter->ps_state != PS_STATE_AWAKE) {
 		PRINTM_NETINTF(MERROR, pmpriv);
-		PRINTM(MERROR, "Wakeup card timeout!\n");
+		PRINTM(MERROR, "Wakeup card timeout(%d)!\n",
+		       pmadapter->pm_wakeup_timeout);
 		pmadapter->pm_wakeup_timeout++;
 		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_DBG_DUMP, MNULL);
 	}
@@ -1031,7 +1032,8 @@ pmlan_buffer wlan_alloc_mlan_buffer(mlan_adapter *pmadapter, t_u32 data_len,
 
 	/* head_room is not implemented for malloc mlan buffer */
 	if (malloc_flag & MOAL_MALLOC_BUFFER) {
-		buf_size = sizeof(mlan_buffer) + data_len + DMA_ALIGNMENT;
+		buf_size =
+			(t_u32)(sizeof(mlan_buffer) + data_len + DMA_ALIGNMENT);
 		if (malloc_flag & MOAL_MEM_FLAG_ATOMIC)
 			mem_flags |= MLAN_MEM_FLAG_ATOMIC;
 		ret = pcb->moal_malloc(pmadapter->pmoal_handle, buf_size,
@@ -1040,7 +1042,6 @@ pmlan_buffer wlan_alloc_mlan_buffer(mlan_adapter *pmadapter, t_u32 data_len,
 			pmbuf = MNULL;
 			goto exit;
 		}
-		memset(pmadapter, pmbuf, 0, sizeof(mlan_buffer));
 
 		pmbuf->pdesc = MNULL;
 		/* Align address */
@@ -1640,27 +1641,15 @@ mlan_status wlan_reg_mem_ioctl_reg_rw(pmlan_adapter pmadapter,
 
 	switch (reg_mem->param.reg_rw.type) {
 	case MLAN_REG_MAC:
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	case MLAN_REG_MAC2:
-#endif
 		cmd_no = HostCmd_CMD_MAC_REG_ACCESS;
 		break;
 	case MLAN_REG_BBP:
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	case MLAN_REG_BBP2:
-#endif
 		cmd_no = HostCmd_CMD_BBP_REG_ACCESS;
 		break;
 	case MLAN_REG_RF:
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	case MLAN_REG_RF2:
-#endif
 		cmd_no = HostCmd_CMD_RF_REG_ACCESS;
 		break;
 	case MLAN_REG_CAU:
@@ -1670,21 +1659,12 @@ mlan_status wlan_reg_mem_ioctl_reg_rw(pmlan_adapter pmadapter,
 		cmd_no = HostCmd_CMD_TARGET_ACCESS;
 		break;
 	case MLAN_REG_BCA:
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	case MLAN_REG_BCA2:
-#endif
 		cmd_no = HostCmd_CMD_BCA_REG_ACCESS;
 		break;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097) ||          \
-	defined(SD9177)
 	case MLAN_REG_CIU:
 		cmd_no = HostCmd_CMD_REG_ACCESS;
 		break;
-#endif
 	default:
 		pioctl_req->status_code = MLAN_ERROR_IOCTL_INVALID;
 		ret = MLAN_STATUS_FAILURE;
@@ -1853,7 +1833,6 @@ sta_node *wlan_add_station_entry(mlan_private *priv, t_u8 *mac)
 		LEAVE();
 		return MNULL;
 	}
-	memset(priv->adapter, sta_ptr, 0, sizeof(sta_node));
 	memcpy_ext(priv->adapter, sta_ptr->mac_addr, mac, MLAN_MAC_ADDR_LENGTH,
 		   MLAN_MAC_ADDR_LENGTH);
 	util_enqueue_list_tail(priv->adapter->pmoal_handle, &priv->sta_list,
@@ -1945,7 +1924,7 @@ int wlan_get_tdls_list(mlan_private *priv, tdls_peer_info *buf)
 	tdls_peer_info *peer_info = buf;
 	sta_node *sta_ptr = MNULL;
 	int count = 0;
-	IEEEtypes_Header_t *ieee_hdr;
+
 	ENTER();
 	if (priv->bss_type != MLAN_BSS_TYPE_STA) {
 		LEAVE();
@@ -1976,10 +1955,8 @@ int wlan_get_tdls_list(mlan_private *priv, tdls_peer_info *buf)
 				   &sta_ptr->vht_cap,
 				   sizeof(IEEEtypes_VHTCap_t),
 				   sizeof(peer_info->vht_cap));
-			ieee_hdr = (IEEEtypes_Header_t *)peer_info->he_cap;
 			memcpy_ext(priv->adapter, peer_info->he_cap,
-				   &sta_ptr->he_cap,
-				   sizeof(IEEEtypes_Header_t) + ieee_hdr->len,
+				   &sta_ptr->he_cap, sizeof(IEEEtypes_HECap_t),
 				   sizeof(peer_info->he_cap));
 			peer_info++;
 			count++;
@@ -2126,8 +2103,6 @@ t_void wlan_tdls_config(pmlan_private pmpriv, t_u8 enable)
 		LEAVE();
 		return;
 	}
-	memset(pmadapter, (t_u8 *)tdls_config, 0,
-	       sizeof(mlan_ds_misc_tdls_config));
 	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
 	tdls_all_cfg->u.tdls_config.enable = enable;
 	tdls_config->tdls_action = WLAN_TDLS_CONFIG;
@@ -2170,8 +2145,6 @@ static t_void wlan_tdls_cs_param_config(pmlan_private pmpriv)
 		LEAVE();
 		return;
 	}
-	memset(pmadapter, (t_u8 *)tdls_config, 0,
-	       sizeof(mlan_ds_misc_tdls_config));
 
 	tdls_all_cfg = (tdls_all_config *)tdls_config->tdls_data;
 	tdls_config->tdls_action = WLAN_TDLS_CS_PARAMS;
@@ -2220,8 +2193,6 @@ static t_void wlan_tdls_cs_start(pmlan_private pmpriv, t_u8 *peer_mac_addr,
 		LEAVE();
 		return;
 	}
-	memset(pmadapter, (t_u8 *)tdls_config, 0,
-	       sizeof(mlan_ds_misc_tdls_config));
 
 	if (pioctl_buf) {
 		misc = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
@@ -2964,6 +2935,118 @@ exit:
 	return ret;
 }
 
+/**
+ *  @brief config rtt
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_config_rtt(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req)
+{
+	pmlan_private pmpriv = MNULL;
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!pioctl_req) {
+		PRINTM(MERROR, "MLAN IOCTL information is not present\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto exit;
+	}
+
+	pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS,
+			       HostCmd_ACT_GEN_SET, OID_RTT_REQUEST,
+			       (t_void *)pioctl_req, &(misc->param.rtt_params));
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+exit:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief cancel rtt
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_cancel_rtt(pmlan_adapter pmadapter, pmlan_ioctl_req pioctl_req)
+{
+	pmlan_private pmpriv = MNULL;
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!pioctl_req) {
+		PRINTM(MERROR, "MLAN IOCTL information is not present\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto exit;
+	}
+
+	pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS,
+			       HostCmd_ACT_GEN_SET, OID_RTT_CANCEL,
+			       (t_void *)pioctl_req, &(misc->param.rtt_cancel));
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+exit:
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief rtt responder cfg
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_rtt_responder_cfg(pmlan_adapter pmadapter,
+				   pmlan_ioctl_req pioctl_req)
+{
+	pmlan_private pmpriv = MNULL;
+	mlan_ds_misc_cfg *misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!pioctl_req) {
+		PRINTM(MERROR, "MLAN IOCTL information is not present\n");
+		ret = MLAN_STATUS_FAILURE;
+		goto exit;
+	}
+
+	pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_FTM_CONFIG_RESPONDER,
+			       HostCmd_ACT_GEN_SET, 0, (t_void *)pioctl_req,
+			       &(misc->param.rtt_rsp_cfg));
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+exit:
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Get TX/RX histogram statistic
  *
@@ -3289,7 +3372,8 @@ mlan_status wlan_process_802dot11_mgmt_pkt(mlan_private *priv, t_u8 *payload,
 	pevent = (pmlan_event)event_buf;
 	pevent->bss_index = priv->bss_index;
 	mgmt = (IEEE80211_MGMT *)payload;
-	if (!priv->curr_bss_params.host_mlme && sub_type == SUBTYPE_ACTION &&
+	if (priv->bss_role == MLAN_BSS_ROLE_STA &&
+	    !priv->curr_bss_params.host_mlme && sub_type == SUBTYPE_ACTION &&
 	    mgmt->u.ft_resp.category == FT_CATEGORY &&
 	    mgmt->u.ft_resp.action == FT_ACTION_RESPONSE &&
 	    mgmt->u.ft_resp.status_code == 0) {
@@ -3306,7 +3390,8 @@ mlan_status wlan_process_802dot11_mgmt_pkt(mlan_private *priv, t_u8 *payload,
 			   payload + FT_ACTION_HEAD_LEN,
 			   payload_len - FT_ACTION_HEAD_LEN,
 			   pevent->event_len - MLAN_MAC_ADDR_LENGTH);
-	} else if (!priv->curr_bss_params.host_mlme &&
+	} else if (priv->bss_role == MLAN_BSS_ROLE_STA &&
+		   !priv->curr_bss_params.host_mlme &&
 		   sub_type == SUBTYPE_AUTH &&
 		   mgmt->u.auth.auth_alg == MLAN_AUTH_MODE_FT &&
 		   mgmt->u.auth.auth_transaction == 2 &&
@@ -3431,6 +3516,28 @@ mlan_status wlan_misc_hotspot_cfg(pmlan_adapter pmadapter,
 }
 
 #ifdef STA_SUPPORT
+/**
+ *  @brief This function check if we should enable beacon protection support
+ *
+ *  @param pbss_desc    A pointer to BSSDescriptor_t structure
+ *
+ *  @return        MTRUE/MFALSE
+ */
+t_u8 wlan_check_beacon_prot_supported(mlan_private *pmpriv,
+				      BSSDescriptor_t *pbss_desc)
+{
+	if (pbss_desc && pbss_desc->pext_cap) {
+		if (pbss_desc->pext_cap->ieee_hdr.len < 11)
+			return MFALSE;
+		if (!ISSUPP_EXTCAP_EXT_BEACON_PROT(
+			    pbss_desc->pext_cap->ext_cap))
+			return MFALSE;
+	}
+	if (!IS_FW_SUPPORT_BEACON_PROT(pmpriv->adapter))
+		return MFALSE;
+	return MTRUE;
+}
+
 /**
  *  @brief Add Extended Capabilities IE
  *
@@ -3455,10 +3562,18 @@ void wlan_add_ext_capa_info_ie(mlan_private *pmpriv, BSSDescriptor_t *pbss_desc,
 		SET_EXTCAP_EXT_CHANNEL_SWITCH(pmpriv->ext_cap);
 	else
 		RESET_EXTCAP_EXT_CHANNEL_SWITCH(pmpriv->ext_cap);
+	if (pmpriv->adapter->pcard_info->support_11mc) {
+		SET_EXTCAP_FTMI(pmpriv->ext_cap);
+		SET_EXTCAP_INTERNETWORKING(pmpriv->ext_cap);
+	}
 	if (pbss_desc && pbss_desc->multi_bssid_ap)
 		SET_EXTCAP_MULTI_BSSID(pmpriv->ext_cap);
 	if (wlan_check_11ax_twt_supported(pmpriv, pbss_desc))
 		SET_EXTCAP_TWT_REQ(pmpriv->ext_cap);
+
+	if (wlan_check_beacon_prot_supported(pmpriv, pbss_desc))
+		SET_EXTCAP_BEACON_PROT(pmpriv->ext_cap);
+
 	memcpy_ext(pmpriv->adapter, &pext_cap->ext_cap, &pmpriv->ext_cap,
 		   sizeof(pmpriv->ext_cap), sizeof(pext_cap->ext_cap));
 	*pptlv_out += sizeof(MrvlIETypes_ExtCap_t);
@@ -3804,7 +3919,7 @@ t_u8 wlan_is_wmm_ie_present(pmlan_adapter pmadapter, t_u8 *pbuf, t_u16 buf_len)
  *
  *  @return	       ie's poiner or MNULL
  */
-t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u8 ie_len,
+t_u8 *wlan_get_specific_ie(pmlan_private priv, t_u8 *ie_buf, t_u16 ie_len,
 			   IEEEtypes_ElementId_e id, t_u8 ext_id)
 {
 	t_u32 bytes_left = ie_len;
@@ -4000,12 +4115,10 @@ mlan_status wlan_radio_ioctl_ant_cfg(pmlan_adapter pmadapter,
 	if (pioctl_req->action == MLAN_ACT_SET) {
 		/* User input validation */
 		if (IS_STREAM_2X2(pmadapter->feature_control)) {
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 			if (IS_CARD9098(pmadapter->card_type) ||
 			    IS_CARD9097(pmadapter->card_type) ||
-			    IS_CARDNW62X(pmadapter->card_type)) {
+			    IS_CARDAW693(pmadapter->card_type) ||
+			    IS_CARDIW62X(pmadapter->card_type)) {
 				ant_cfg->tx_antenna &= 0x0303;
 				ant_cfg->rx_antenna &= 0x0303;
 				/** 2G antcfg TX */
@@ -4044,15 +4157,9 @@ mlan_status wlan_radio_ioctl_ant_cfg(pmlan_adapter pmadapter,
 				       ant_cfg->tx_antenna,
 				       ant_cfg->rx_antenna);
 			} else {
-#endif
-
 				ant_cfg->tx_antenna &= 0x0003;
 				ant_cfg->rx_antenna &= 0x0003;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 			}
-#endif
 			if (!ant_cfg->tx_antenna ||
 			    bitcount(ant_cfg->tx_antenna & 0x00FF) >
 				    pmadapter->number_of_antenna ||
@@ -4766,6 +4873,47 @@ mlan_status wlan_misc_get_tsf_info(pmlan_adapter pmadapter,
 	return ret;
 }
 
+/**
+ *  @brief Set/Get CROSS CHIP SYNCH config
+ *
+ *  @param pmadapter	A pointer to mlan_adapter structure
+ *  @param pioctl_req	A pointer to ioctl request buffer
+ *
+ *  @return		MLAN_STATUS_SUCCESS --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_cross_chip_synch(pmlan_adapter pmadapter,
+					     pmlan_ioctl_req pioctl_req)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+	t_u16 cmd_action = 0;
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+
+	ENTER();
+
+	misc_cfg = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else if (pioctl_req->action == MLAN_ACT_GET)
+		cmd_action = HostCmd_ACT_GEN_GET;
+	else {
+		PRINTM(MERROR, "Unsupported cmd_action\n");
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_CROSS_CHIP_SYNCH, cmd_action,
+			       0, (t_void *)pioctl_req,
+			       &misc_cfg->param.gpio_tsf_latch_config);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Set coalesce config
  *
@@ -5606,7 +5754,6 @@ mlan_status wlan_set_mef_entry(mlan_private *pmpriv, pmlan_adapter pmadapter,
 	}
 
 	/** Fill the cmd header data*/
-	memset(pmadapter, hostcmd, 0, sizeof(mlan_ds_misc_cmd));
 	buf = hostcmd->cmd;
 	hostcmd_hdr = (HostCmd_DS_GEN *)buf;
 	hostcmd_hdr->command = wlan_cpu_to_le16(HostCmd_CMD_MEF_CFG);
@@ -5698,7 +5845,6 @@ mlan_status wlan_process_mef_cfg_cmd(mlan_private *pmpriv,
 	/** Fill mef_cfg structure*/
 	mef.criteria = pmef->criteria;
 	mef.entry_num = entry_num;
-	memset(pmadapter, mef.pentry, 0, sizeof(mef_entry_t) * entry_num);
 	pentry = mef.pentry;
 	/** Fill mef_entry_t structure*/
 	/** Copy Auto arp response entry*/
@@ -6119,6 +6265,7 @@ mlan_status wlan_misc_ioctl_operclass_validation(pmlan_adapter pmadapter,
 	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	mlan_ds_misc_cfg *misc = MNULL;
 	t_u8 channel, oper_class;
+	t_u8 bandwidth;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -6126,9 +6273,11 @@ mlan_status wlan_misc_ioctl_operclass_validation(pmlan_adapter pmadapter,
 	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
 	channel = misc->param.bw_chan_oper.channel;
 	oper_class = misc->param.bw_chan_oper.oper_class;
+	bandwidth = misc->param.bw_chan_oper.bandwidth;
+
 	if (pioctl_req->action == MLAN_ACT_GET) {
 		ret = wlan_check_operclass_validation(pmpriv, channel,
-						      oper_class);
+						      oper_class, bandwidth);
 	} else {
 		PRINTM(MERROR, "Unsupported cmd_action\n");
 		LEAVE();
@@ -6635,6 +6784,38 @@ mlan_status wlan_misc_ioctl_rxabortcfg(pmlan_adapter pmadapter,
 	LEAVE();
 	return ret;
 }
+
+/**
+ *  @brief OFDM DESENSE CFG
+ *
+ *  @param pmadapter   A pointer to mlan_adapter structure
+ *  @param pioctl_req  A pointer to ioctl request buffer
+ *
+ *  @return        MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_ofdmdesense_cfg(pmlan_adapter pmadapter,
+					    pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *pmisc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else
+		cmd_action = HostCmd_ACT_GEN_GET;
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_OFDM_DESENSE_CFG, cmd_action,
+			       0, (t_void *)pioctl_req,
+			       &(pmisc->param.ofdm_desense_cfg));
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
 /**
  *  @brief Rx Abort Cfg ext
  *
@@ -6995,6 +7176,34 @@ mlan_status wlan_misc_ioctl_range_ext(pmlan_adapter pmadapter,
 	return ret;
 }
 
+/**
+ *   @brief twt_report cmd
+ *   @param pmadapter   A pointer to mlan_adapter structure
+ *   @param pioctl_req  A pointer to ioctl request buffer
+ *
+ *   @return        MLAN_STATUS_PENDING --success, otherwise fail
+ */
+mlan_status wlan_misc_ioctl_twt_report(pmlan_adapter pmadapter,
+				       pmlan_ioctl_req pioctl_req)
+{
+	mlan_private *pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *pmisc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u16 cmd_action = 0;
+
+	ENTER();
+
+	cmd_action = HostCmd_ACT_GEN_GET;
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_TWT_CFG, cmd_action, 0,
+			       (t_void *)pioctl_req,
+			       &(pmisc->param.twt_report_info));
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Perform warm reset
  *
@@ -7039,8 +7248,16 @@ mlan_status wlan_misc_ioctl_warm_reset(pmlan_adapter pmadapter,
 
 	/* Initialize private structures */
 	for (i = 0; i < pmadapter->priv_num; i++) {
-		if (pmadapter->priv[i])
+		if (pmadapter->priv[i]) {
+			/* Reset to sta role */
+#ifdef WIFI_DIRECT_SUPPORT
+			if (pmadapter->priv[i]->bss_type ==
+			    MLAN_BSS_TYPE_WIFIDIRECT)
+				pmadapter->priv[i]->bss_role =
+					MLAN_BSS_ROLE_STA;
+#endif
 			wlan_init_priv(pmadapter->priv[i]);
+		}
 	}
 	mlan_block_rx_process(pmadapter, MFALSE);
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
index a4a1a07..8196170 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.c
@@ -76,6 +76,7 @@ static const struct _mlan_card_info mlan_card_info_pcie8897 = {
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 0,
 };
 #endif
 
@@ -115,10 +116,45 @@ static const struct _mlan_card_info mlan_card_info_pcie8997 = {
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
-#if defined(PCIE9097) || defined(PCIENW62X)
+static const struct _mlan_pcie_card_reg mlan_reg_pcieaw693 = {
+	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
+	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
+	.reg_rxbd_rdptr = PCIE9098_RXBD_RDPTR,
+	.reg_rxbd_wrptr = PCIE9098_RXBD_WRPTR,
+	.reg_evtbd_rdptr = PCIE9098_EVTBD_RDPTR,
+	.reg_evtbd_wrptr = PCIE9098_EVTBD_WRPTR,
+	.reg_host_int_mask = PCIE9097_B0_HOST_INT_MASK,
+	.reg_host_int_status_mask = PCIE9097_B0_HOST_INT_STATUS_MASK,
+	.reg_host_int_status = PCIE9097_B0_HOST_INT_STATUS,
+	.reg_host_int_clr_sel = PCIE9097_B0_HOST_INT_CLR_SEL,
+	.reg_cpu_int_event = PCIE9098_CPU_INT_EVENT,
+	.reg_ip_rev = PCIE9098_DEV_ID_REG,
+	.reg_drv_ready = PCIE9098_DRV_READY,
+	.reg_cpu_int_status = PCIE9098_CPU_INT_STATUS,
+	.reg_rev_id = PCIE9098_REV_ID_REG,
+	.reg_scratch_0 = PCIE9098_SCRATCH_0_REG,
+	.reg_scratch_1 = PCIE9098_SCRATCH_1_REG,
+	.reg_scratch_2 = PCIE9098_SCRATCH_2_REG,
+	.reg_scratch_3 = PCIE9098_SCRATCH_3_REG,
+	.reg_scratch_6 = PCIE9098_SCRATCH_6_REG,
+	.reg_scratch_7 = PCIE9098_SCRATCH_7_REG,
+	.host_intr_mask = PCIE9098_HOST_INTR_MASK,
+	.host_intr_dnld_done = PCIE9098_HOST_INTR_DNLD_DONE,
+	.host_intr_upld_rdy = PCIE9098_HOST_INTR_UPLD_RDY,
+	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
+	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
+	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.adma_align_size = ADMA_ALIGN_SIZE_1,
+	.adma_min_pkt_size = ADMA_MIN_PKT_SIZE_32,
+	.use_adma = MTRUE,
+	.msi_int_wr_clr = MTRUE,
+};
+
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEIW62X)
 static const struct _mlan_pcie_card_reg mlan_reg_pcie9097_b0 = {
 	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
 	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
@@ -147,12 +183,13 @@ static const struct _mlan_pcie_card_reg mlan_reg_pcie9097_b0 = {
 	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
 	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
 	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.adma_align_size = ADMA_ALIGN_SIZE,
+	.adma_min_pkt_size = ADMA_MIN_PKT_SIZE,
 	.use_adma = MTRUE,
 	.msi_int_wr_clr = MTRUE,
 };
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 static const struct _mlan_pcie_card_reg mlan_reg_pcie9098 = {
 	.reg_txbd_rdptr = PCIE9098_TXBD_RDPTR,
 	.reg_txbd_wrptr = PCIE9098_TXBD_WRPTR,
@@ -181,6 +218,8 @@ static const struct _mlan_pcie_card_reg mlan_reg_pcie9098 = {
 	.host_intr_cmd_done = PCIE9098_HOST_INTR_CMD_DONE,
 	.host_intr_event_rdy = PCIE9098_HOST_INTR_EVENT_RDY,
 	.host_intr_cmd_dnld = PCIE9098_HOST_INTR_CMD_DNLD,
+	.adma_align_size = ADMA_ALIGN_SIZE,
+	.adma_min_pkt_size = ADMA_MIN_PKT_SIZE,
 	.use_adma = MTRUE,
 	.msi_int_wr_clr = MTRUE,
 };
@@ -191,8 +230,8 @@ static const struct _mlan_card_info mlan_card_info_pcie9098 = {
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
-#endif
 /********************************************************
 			Global Variables
 ********************************************************/
@@ -204,7 +243,6 @@ static const struct _mlan_card_info mlan_card_info_pcie9098 = {
 static mlan_status wlan_pcie_delete_evtbd_ring(pmlan_adapter pmadapter);
 static mlan_status wlan_pcie_delete_rxbd_ring(pmlan_adapter pmadapter);
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 /**
  *  @brief This function init the adma setting
  *
@@ -540,9 +578,6 @@ static void wlan_pcie_init_adma_ring_size(mlan_adapter *pmadapter)
 	return;
 }
 
-#endif
-
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 /**
  *  @brief This function set the host interrupt select mask
  *
@@ -588,9 +623,7 @@ static mlan_status wlan_pcie_set_host_int_select_mask(mlan_adapter *pmadapter,
 	LEAVE();
 	return MLAN_STATUS_SUCCESS;
 }
-#endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 /**
  *  @brief This function handles command response completion
  *
@@ -666,7 +699,6 @@ done:
 	LEAVE();
 	return ret;
 }
-#endif
 
 /**
  *  @brief This function disables the host interrupt
@@ -761,9 +793,9 @@ static mlan_status wlan_disable_pcie_host_int(mlan_adapter *pmadapter)
 		LEAVE();
 		return ret;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
-	    (pmadapter->card_type == CARD_TYPE_PCIENW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEIW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type == CARD_TYPE_PCIE9097)) {
 		ret = wlan_pcie_set_host_int_select_mask(pmadapter, MFALSE);
 		if (ret) {
@@ -771,7 +803,6 @@ static mlan_status wlan_disable_pcie_host_int(mlan_adapter *pmadapter)
 			return ret;
 		}
 	}
-#endif
 	ret = wlan_pcie_disable_host_int_mask(pmadapter);
 	LEAVE();
 	return ret;
@@ -839,9 +870,9 @@ static mlan_status wlan_enable_pcie_host_int(mlan_adapter *pmadapter)
 		LEAVE();
 		return ret;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
-	    (pmadapter->card_type == CARD_TYPE_PCIENW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEIW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type == CARD_TYPE_PCIE9097)) {
 		ret = wlan_pcie_set_host_int_select_mask(pmadapter, MTRUE);
 		if (ret) {
@@ -849,7 +880,6 @@ static mlan_status wlan_enable_pcie_host_int(mlan_adapter *pmadapter)
 			return ret;
 		}
 	}
-#endif
 	ret = wlan_pcie_enable_host_int_mask(pmadapter);
 	LEAVE();
 	return ret;
@@ -870,9 +900,7 @@ static mlan_status wlan_pcie_create_txbd_ring(mlan_adapter *pmadapter)
 #if defined(PCIE8997) || defined(PCIE8897)
 	pmlan_pcie_data_buf ptx_bd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	padma_dual_desc_buf padma_bd_buf;
-#endif
 
 	ENTER();
 	/*
@@ -892,12 +920,10 @@ static mlan_status wlan_pcie_create_txbd_ring(mlan_adapter *pmadapter)
 			pmadapter->pcard_pcie->txrx_bd_size;
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		pmadapter->pcard_pcie->txbd_ring_size =
 			sizeof(adma_dual_desc_buf) *
 			pmadapter->pcard_pcie->txrx_bd_size;
-#endif
 	PRINTM(MINFO, "TX ring: allocating %d bytes\n",
 	       pmadapter->pcard_pcie->txbd_ring_size);
 
@@ -923,7 +949,6 @@ static mlan_status wlan_pcie_create_txbd_ring(mlan_adapter *pmadapter)
 
 	for (i = 0; i < pmadapter->pcard_pcie->txrx_bd_size; i++) {
 		pmadapter->pcard_pcie->tx_buf_list[i] = MNULL;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf
@@ -940,7 +965,6 @@ static mlan_status wlan_pcie_create_txbd_ring(mlan_adapter *pmadapter)
 			padma_bd_buf->pkt_size = 0;
 			padma_bd_buf->reserved = 0;
 		}
-#endif
 
 #if defined(PCIE8997) || defined(PCIE8897)
 		if (!pmadapter->pcard_pcie->reg->use_adma) {
@@ -978,9 +1002,7 @@ static mlan_status wlan_pcie_delete_txbd_ring(mlan_adapter *pmadapter)
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_data_buf *ptx_bd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 
 	ENTER();
 
@@ -1012,7 +1034,6 @@ static mlan_status wlan_pcie_delete_txbd_ring(mlan_adapter *pmadapter)
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)
@@ -1026,7 +1047,6 @@ static mlan_status wlan_pcie_delete_txbd_ring(mlan_adapter *pmadapter)
 				padma_bd_buf->reserved = 0;
 			}
 		}
-#endif
 		pmadapter->pcard_pcie->txbd_ring[i] = MNULL;
 	}
 
@@ -1064,9 +1084,7 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_data_buf *prxbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 
 	ENTER();
 
@@ -1088,7 +1106,6 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	/*
 	 * driver maintaines the write pointer and firmware maintaines the read
 	 * pointer. The read pointer starts at 0 (zero) while the write pointer
@@ -1101,7 +1118,6 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 			sizeof(adma_dual_desc_buf) *
 			pmadapter->pcard_pcie->txrx_bd_size;
 	}
-#endif
 
 	PRINTM(MINFO, "RX ring: allocating %d bytes\n",
 	       pmadapter->pcard_pcie->rxbd_ring_size);
@@ -1180,7 +1196,6 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf
@@ -1190,14 +1205,14 @@ static mlan_status wlan_pcie_create_rxbd_ring(mlan_adapter *pmadapter)
 			pmadapter->pcard_pcie->rxbd_ring[i] =
 				(t_void *)padma_bd_buf;
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(ALIGN_SZ(
+				pmbuf->data_len,
+				pmadapter->pcard_pcie->reg->adma_align_size));
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
 			padma_bd_buf->pkt_size = 0;
 			padma_bd_buf->reserved = 0;
 		}
-#endif
 	}
 
 	LEAVE();
@@ -1219,9 +1234,7 @@ static mlan_status wlan_pcie_delete_rxbd_ring(mlan_adapter *pmadapter)
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_data_buf *prxbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 
 	ENTER();
 	for (i = 0; i < pmadapter->pcard_pcie->txrx_bd_size; i++) {
@@ -1250,7 +1263,6 @@ static mlan_status wlan_pcie_delete_rxbd_ring(mlan_adapter *pmadapter)
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)
@@ -1264,7 +1276,6 @@ static mlan_status wlan_pcie_delete_rxbd_ring(mlan_adapter *pmadapter)
 				padma_bd_buf->len = 0;
 			}
 		}
-#endif
 		pmadapter->pcard_pcie->rxbd_ring[i] = MNULL;
 	}
 
@@ -1301,9 +1312,7 @@ static mlan_status wlan_pcie_create_evtbd_ring(mlan_adapter *pmadapter)
 	pmlan_pcie_evt_buf pevtbd_buf;
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 
 	ENTER();
 	/*
@@ -1320,13 +1329,11 @@ static mlan_status wlan_pcie_create_evtbd_ring(mlan_adapter *pmadapter)
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		pmadapter->pcard_pcie->evtbd_wrptr = MLAN_MAX_EVT_BD;
 		pmadapter->pcard_pcie->evtbd_ring_size =
 			sizeof(adma_dual_desc_buf) * MLAN_MAX_EVT_BD;
 	}
-#endif
 	PRINTM(MINFO, "Evt ring: allocating %d bytes\n",
 	       pmadapter->pcard_pcie->evtbd_ring_size);
 
@@ -1392,7 +1399,6 @@ static mlan_status wlan_pcie_create_evtbd_ring(mlan_adapter *pmadapter)
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf
@@ -1402,14 +1408,14 @@ static mlan_status wlan_pcie_create_evtbd_ring(mlan_adapter *pmadapter)
 			pmadapter->pcard_pcie->evtbd_ring[i] =
 				(t_void *)padma_bd_buf;
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(ALIGN_SZ(
+				pmbuf->data_len,
+				pmadapter->pcard_pcie->reg->adma_align_size));
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
 			padma_bd_buf->pkt_size = 0;
 			padma_bd_buf->reserved = 0;
 		}
-#endif
 	}
 
 	LEAVE();
@@ -1431,9 +1437,7 @@ static mlan_status wlan_pcie_delete_evtbd_ring(mlan_adapter *pmadapter)
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_evt_buf *pevtbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 
 	ENTER();
 	for (i = 0; i < MLAN_MAX_EVT_BD; i++) {
@@ -1461,7 +1465,6 @@ static mlan_status wlan_pcie_delete_evtbd_ring(mlan_adapter *pmadapter)
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)
@@ -1475,7 +1478,6 @@ static mlan_status wlan_pcie_delete_evtbd_ring(mlan_adapter *pmadapter)
 				padma_bd_buf->reserved = 0;
 			}
 		}
-#endif
 		pmadapter->pcard_pcie->evtbd_ring[i] = MNULL;
 	}
 
@@ -1658,7 +1660,6 @@ static t_u8 wlan_check_tx_pending_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
 			return MFALSE;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		if ((pmadapter->pcard_pcie->txbd_rdptr &
 		     ADMA_RW_PTR_WRAP_MASK) != (rdptr & ADMA_RW_PTR_WRAP_MASK))
@@ -1666,7 +1667,6 @@ static t_u8 wlan_check_tx_pending_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
 		else
 			return MFALSE;
 	}
-#endif
 	return MFALSE;
 }
 
@@ -1692,10 +1692,8 @@ static mlan_status wlan_pcie_send_data_complete(mlan_adapter *pmadapter)
 		pmadapter->pcard_pcie->reg->txrx_rw_ptr_rollover_ind;
 	mlan_pcie_data_buf *ptx_bd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
 	t_u32 wrptr;
-#endif
 
 	ENTER();
 
@@ -1716,7 +1714,6 @@ static mlan_status wlan_pcie_send_data_complete(mlan_adapter *pmadapter)
 		rdptr = rdptr >> TXBD_RW_PTR_START;
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		wrptr = rdptr & 0xffff;
 		rdptr = rdptr >> ADMA_RPTR_START;
@@ -1724,7 +1721,6 @@ static mlan_status wlan_pcie_send_data_complete(mlan_adapter *pmadapter)
 			PRINTM(MERROR, "wlan: Unexpected wrptr 0x%x 0x%x\n",
 			       wrptr, pmadapter->pcard_pcie->txbd_wrptr);
 	}
-#endif
 
 	/* free from previous txbd_rdptr to current txbd_rdptr */
 	while (wlan_check_tx_pending_buffer(pmadapter, rdptr)) {
@@ -1776,7 +1772,6 @@ static mlan_status wlan_pcie_send_data_complete(mlan_adapter *pmadapter)
 					 txrx_rw_ptr_rollover_ind);
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)pmadapter->pcard_pcie
@@ -1790,7 +1785,6 @@ static mlan_status wlan_pcie_send_data_complete(mlan_adapter *pmadapter)
 			pmadapter->pcard_pcie->txbd_rdptr &=
 				ADMA_RW_PTR_WRAP_MASK;
 		}
-#endif
 	}
 
 	if (unmap_count)
@@ -1816,11 +1810,9 @@ done:
 	 ((wrptr & rollover_ind) == (rdptr & rollover_ind)))
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 #define ADMA_TXBD_IS_FULL(wrptr, rdptr, mask, rollover_ind)                    \
 	(((wrptr & mask) == (rdptr & mask)) &&                                 \
 	 ((wrptr & rollover_ind) != (rdptr & rollover_ind)))
-#endif
 
 static t_u8 wlan_check_txbd_not_full(mlan_adapter *pmadapter)
 {
@@ -1840,7 +1832,6 @@ static t_u8 wlan_check_txbd_not_full(mlan_adapter *pmadapter)
 			return MFALSE;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		txrx_rw_ptr_mask = pmadapter->pcard_pcie->txrx_bd_size - 1;
 		txrx_rw_ptr_rollover_ind = pmadapter->pcard_pcie->txrx_bd_size;
@@ -1852,7 +1843,6 @@ static t_u8 wlan_check_txbd_not_full(mlan_adapter *pmadapter)
 		else
 			return MFALSE;
 	}
-#endif
 	return MFALSE;
 }
 
@@ -1878,9 +1868,7 @@ static mlan_status wlan_pcie_send_data(mlan_adapter *pmadapter, t_u8 type,
 		pmadapter->pcard_pcie->reg->txrx_rw_ptr_rollover_ind;
 	mlan_pcie_data_buf *ptx_bd_buf = MNULL;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf = MNULL;
-#endif
 	const t_u32 num_tx_buffs = pmadapter->pcard_pcie->txrx_bd_size;
 	mlan_status ret = MLAN_STATUS_PENDING;
 	pmlan_callbacks pcb = &pmadapter->callbacks;
@@ -1961,19 +1949,21 @@ static mlan_status wlan_pcie_send_data(mlan_adapter *pmadapter, t_u8 type,
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			wr_ptr_start = ADMA_WPTR_START;
 			padma_bd_buf = (adma_dual_desc_buf *)pmadapter
 					       ->pcard_pcie->txbd_ring[wrindx];
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len =
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE);
+			padma_bd_buf->len = ALIGN_SZ(
+				pmbuf->data_len,
+				pmadapter->pcard_pcie->reg->adma_align_size);
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_SOP | ADMA_BD_FLAG_EOP |
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_SRC_HOST);
-			if (padma_bd_buf->len < ADMA_MIN_PKT_SIZE)
-				padma_bd_buf->len = ADMA_MIN_PKT_SIZE;
+			if (padma_bd_buf->len <
+			    pmadapter->pcard_pcie->reg->adma_min_pkt_size)
+				padma_bd_buf->len = pmadapter->pcard_pcie->reg
+							    ->adma_min_pkt_size;
 			padma_bd_buf->len = wlan_cpu_to_le16(padma_bd_buf->len);
 			padma_bd_buf->pkt_size = padma_bd_buf->len;
 			pmadapter->pcard_pcie->last_tx_pkt_size[wrindx] =
@@ -1982,7 +1972,6 @@ static mlan_status wlan_pcie_send_data(mlan_adapter *pmadapter, t_u8 type,
 			pmadapter->pcard_pcie->txbd_wrptr &=
 				ADMA_RW_PTR_WRAP_MASK;
 		}
-#endif
 		pmadapter->pcard_pcie->txbd_pending++;
 		PRINTM(MINFO, "REG_TXBD_WRPT(0x%x) = 0x%x\n", reg_txbd_wrptr,
 		       ((pmadapter->pcard_pcie->txbd_wrptr << wr_ptr_start) |
@@ -2053,7 +2042,6 @@ done_unmap:
 		ptx_bd_buf->offset = 0;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma && padma_bd_buf) {
 		padma_bd_buf->paddr = 0;
 		padma_bd_buf->len = 0;
@@ -2061,7 +2049,6 @@ done_unmap:
 		padma_bd_buf->pkt_size = 0;
 		padma_bd_buf->reserved = 0;
 	}
-#endif
 done:
 	LEAVE();
 	return ret;
@@ -2093,7 +2080,6 @@ static t_u8 wlan_check_rx_pending_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		if ((pmadapter->pcard_pcie->rxbd_rdptr &
 		     ADMA_RW_PTR_WRAP_MASK) != (rdptr & ADMA_RW_PTR_WRAP_MASK))
@@ -2101,7 +2087,6 @@ static t_u8 wlan_check_rx_pending_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
 		else
 			return MFALSE;
 	}
-#endif
 	return MFALSE;
 }
 
@@ -2139,7 +2124,6 @@ static t_u8 wlan_is_rx_pending_full(mlan_adapter *pmadapter, t_u32 rdptr)
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		PRINTM(MDATA, "local wrptr: 0x%x -> reg rdptr: 0x%x\n",
 		       (pmadapter->pcard_pcie->rxbd_wrptr &
@@ -2151,7 +2135,6 @@ static t_u8 wlan_is_rx_pending_full(mlan_adapter *pmadapter, t_u32 rdptr)
 		else
 			return MFALSE;
 	}
-#endif
 	return MFALSE;
 }
 
@@ -2179,9 +2162,7 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 		pmadapter->pcard_pcie->reg->txrx_rw_ptr_rollover_ind;
 	mlan_pcie_data_buf *prxbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 	t_u32 in_ts_sec, in_ts_usec;
 
 	ENTER();
@@ -2193,10 +2174,8 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		rdptr = rdptr >> ADMA_RPTR_START;
-#endif
 
 	if (pmadapter->tp_state_on &&
 	    wlan_is_rx_pending_full(pmadapter, rdptr)) {
@@ -2354,14 +2333,14 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 			txbd_val = txbd_val << TXBD_RW_PTR_START;
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)pmadapter->pcard_pcie
 					->rxbd_ring[rd_index];
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(ALIGN_SZ(
+				pmbuf->data_len,
+				pmadapter->pcard_pcie->reg->adma_align_size));
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
 			padma_bd_buf->pkt_size = 0;
@@ -2373,7 +2352,6 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 			pmadapter->pcard_pcie->rxbd_wrptr &=
 				ADMA_RW_PTR_WRAP_MASK;
 		}
-#endif
 		PRINTM(MINFO, "RECV DATA: Updated <Wr: %#x, Rd: %#x>\n",
 		       pmadapter->pcard_pcie->rxbd_wrptr, rdptr);
 
@@ -2396,10 +2374,8 @@ static mlan_status wlan_pcie_process_recv_data(mlan_adapter *pmadapter)
 			ret = MLAN_STATUS_FAILURE;
 			goto done;
 		}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma)
 			rdptr = rdptr >> ADMA_RPTR_START;
-#endif
 	}
 
 done:
@@ -2542,7 +2518,6 @@ static mlan_status wlan_pcie_send_cmd(mlan_adapter *pmadapter,
 		}
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		/* To send a command, the driver will:
 		   1. driver prepare the cmdrep buffer for adma
@@ -2560,7 +2535,6 @@ static mlan_status wlan_pcie_send_cmd(mlan_adapter *pmadapter,
 			       pmadapter->pcard_pcie->cmd_buf->data_len,
 			       MFALSE);
 	}
-#endif
 done:
 	if ((ret == MLAN_STATUS_FAILURE) && pmadapter)
 		pmadapter->cmd_sent = MFALSE;
@@ -2710,7 +2684,6 @@ static mlan_status wlan_pcie_process_cmd_resp(mlan_adapter *pmadapter)
 			}
 		}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			/* Clear the cmd-rsp buffer address in adma registers.
 			   This will prevent firmware from writing to the same
@@ -2723,7 +2696,6 @@ static mlan_status wlan_pcie_process_cmd_resp(mlan_adapter *pmadapter)
 				goto done;
 			}
 		}
-#endif
 	}
 
 done:
@@ -2778,7 +2750,6 @@ static t_u8 wlan_check_evt_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
 			return MFALSE;
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		if ((pmadapter->pcard_pcie->evtbd_rdptr &
 		     ADMA_RW_PTR_WRAP_MASK) != (rdptr & ADMA_RW_PTR_WRAP_MASK))
@@ -2786,7 +2757,6 @@ static t_u8 wlan_check_evt_buffer(mlan_adapter *pmadapter, t_u32 rdptr)
 		else
 			return MFALSE;
 	}
-#endif
 	return MFALSE;
 }
 
@@ -2806,9 +2776,7 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_evt_buf *pevtbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 	ENTER();
 
 	if (pmadapter->event_received) {
@@ -2832,10 +2800,8 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		rdptr = rdptr >> ADMA_RPTR_START;
-#endif
 	PRINTM(MINFO, "EvtRdy: Initial <Wr: 0x%x, Rd: 0x%x>\n",
 	       pmadapter->pcard_pcie->evtbd_wrptr, rdptr);
 	if (wlan_check_evt_buffer(pmadapter, rdptr)) {
@@ -2863,7 +2829,6 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf =
 				(adma_dual_desc_buf *)pmadapter->pcard_pcie
@@ -2874,7 +2839,6 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)
 			padma_bd_buf->pkt_size = 0;
 			padma_bd_buf->reserved = 0;
 		}
-#endif
 		pmadapter->pcard_pcie->evt_buf_list[rd_index] = MNULL;
 
 		event = *((t_u32 *)&pmbuf_evt->pbuf[pmbuf_evt->data_offset +
@@ -2912,11 +2876,9 @@ static mlan_status wlan_pcie_process_event_ready(mlan_adapter *pmadapter)
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma)
 			pmadapter->pcard_pcie->evtbd_rdptr &=
 				ADMA_RW_PTR_WRAP_MASK;
-#endif
 
 		/* Do not update the event write pointer here, wait till the
 		   buffer is released. This is just to make things simpler,
@@ -2957,9 +2919,7 @@ static mlan_status wlan_pcie_event_complete(mlan_adapter *pmadapter,
 #if defined(PCIE8997) || defined(PCIE8897)
 	mlan_pcie_evt_buf *pevtbd_buf;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	adma_dual_desc_buf *padma_bd_buf;
-#endif
 
 	ENTER();
 	if (!pmbuf) {
@@ -2981,10 +2941,8 @@ static mlan_status wlan_pcie_event_complete(mlan_adapter *pmadapter,
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		rdptr = rdptr >> ADMA_RPTR_START;
-#endif
 
 	if (!pmadapter->pcard_pcie->evt_buf_list[wrptr]) {
 		pmbuf->data_len = MAX_EVENT_SIZE;
@@ -3012,20 +2970,19 @@ static mlan_status wlan_pcie_event_complete(mlan_adapter *pmadapter,
 		}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->use_adma) {
 			padma_bd_buf = (adma_dual_desc_buf *)pmadapter
 					       ->pcard_pcie->evtbd_ring[wrptr];
 			padma_bd_buf->paddr = wlan_cpu_to_le64(pmbuf->buf_pa);
-			padma_bd_buf->len = wlan_cpu_to_le16(
-				ALIGN_SZ(pmbuf->data_len, ADMA_ALIGN_SIZE));
+			padma_bd_buf->len = wlan_cpu_to_le16(ALIGN_SZ(
+				pmbuf->data_len,
+				pmadapter->pcard_pcie->reg->adma_align_size));
 			padma_bd_buf->flags = 0;
 			padma_bd_buf->flags = wlan_cpu_to_le16(
 				ADMA_BD_FLAG_INT_EN | ADMA_BD_FLAG_DST_HOST);
 			padma_bd_buf->pkt_size = 0;
 			padma_bd_buf->reserved = 0;
 		}
-#endif
 		pmbuf = MNULL;
 	} else {
 		PRINTM(MINFO,
@@ -3048,10 +3005,8 @@ static mlan_status wlan_pcie_event_complete(mlan_adapter *pmadapter,
 		}
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma)
 		pmadapter->pcard_pcie->evtbd_wrptr &= ADMA_RW_PTR_WRAP_MASK;
-#endif
 	PRINTM(MINFO, "EvtCom: Updated <Wr: 0x%x, Rd: 0x%x>\n",
 	       pmadapter->pcard_pcie->evtbd_wrptr, rdptr);
 
@@ -3281,8 +3236,8 @@ static mlan_status wlan_pcie_prog_fw_w_helper(mlan_adapter *pmadapter,
 	if (IS_PCIE9097(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
-#if defined(PCIENW62X)
-	if (IS_PCIENW62X(pmadapter->card_type))
+#if defined(PCIEIW62X)
+	if (IS_PCIEIW62X(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
 
@@ -3493,23 +3448,29 @@ mlan_status wlan_get_pcie_device(pmlan_adapter pmadapter)
 		pmadapter->pcard_pcie->txrx_bd_size = MAX_TXRX_BD;
 		break;
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIEIW62X)
 	case CARD_TYPE_PCIE9097:
 	case CARD_TYPE_PCIE9098:
-	case CARD_TYPE_PCIENW62X:
+	case CARD_TYPE_PCIEIW62X:
 		pmadapter->pcard_pcie->reg = &mlan_reg_pcie9098;
 		pmadapter->pcard_info = &mlan_card_info_pcie9098;
 		pmadapter->pcard_pcie->txrx_bd_size = ADMA_DEF_TXRX_BD;
 		pmadapter->pcard_pcie->txrx_num_desc = TXRX_DEF_NUM_DESC;
-#if defined(PCIE9097) || defined(PCIENW62X)
+#if defined(PCIE9097) || defined(PCIEIW62X)
 		if ((card_type == CARD_TYPE_PCIE9097 &&
 		     pmadapter->card_rev == CHIP_9097_REV_B0) ||
-		    (card_type == CARD_TYPE_PCIENW62X))
+		    (card_type == CARD_TYPE_PCIEIW62X))
 			pmadapter->pcard_pcie->reg = &mlan_reg_pcie9097_b0;
 #endif
 
 		break;
 #endif
+	case CARD_TYPE_PCIEAW693:
+		pmadapter->pcard_pcie->reg = &mlan_reg_pcieaw693;
+		pmadapter->pcard_info = &mlan_card_info_pcie9098;
+		pmadapter->pcard_pcie->txrx_bd_size = ADMA_DEF_TXRX_BD;
+		pmadapter->pcard_pcie->txrx_num_desc = TXRX_DEF_NUM_DESC;
+		break;
 	default:
 		PRINTM(MERROR, "can't get right pcie card type \n");
 		ret = MLAN_STATUS_FAILURE;
@@ -3675,7 +3636,7 @@ mlan_status wlan_process_msix_int(mlan_adapter *pmadapter)
 			goto done;
 	}
 	if (pcie_ireg & pmadapter->pcard_pcie->reg->host_intr_cmd_done) {
-		if (pmadapter->cmd_sent) {
+		if (pmadapter->cmd_sent && !pmadapter->vdll_ctrl.vdll_len) {
 			PRINTM(MINFO, "<--- CMD sent Interrupt --->\n");
 			pmadapter->cmd_sent = MFALSE;
 		}
@@ -3683,7 +3644,6 @@ mlan_status wlan_process_msix_int(mlan_adapter *pmadapter)
 		if (ret)
 			goto done;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->host_intr_cmd_dnld &&
 	    (pcie_ireg & pmadapter->pcard_pcie->reg->host_intr_cmd_dnld)) {
 		if (pmadapter->cmd_sent)
@@ -3692,7 +3652,6 @@ mlan_status wlan_process_msix_int(mlan_adapter *pmadapter)
 			wlan_pcie_send_vdll_complete(pmadapter);
 		PRINTM(MINFO, "<--- CMD DNLD DONE Interrupt --->\n");
 	}
-#endif
 	PRINTM(MINFO, "cmd_sent=%d data_sent=%d\n", pmadapter->cmd_sent,
 	       pmadapter->data_sent);
 
@@ -3799,7 +3758,8 @@ static mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
 		    pmadapter->pcard_pcie->reg->host_intr_cmd_done) {
 			pcie_ireg &=
 				~pmadapter->pcard_pcie->reg->host_intr_cmd_done;
-			if (pmadapter->cmd_sent) {
+			if (pmadapter->cmd_sent &&
+			    !pmadapter->vdll_ctrl.vdll_len) {
 				PRINTM(MINFO, "<--- CMD sent Interrupt --->\n");
 				pmadapter->cmd_sent = MFALSE;
 			}
@@ -3807,7 +3767,6 @@ static mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
 			if (ret)
 				goto done;
 		}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 		if (pmadapter->pcard_pcie->reg->host_intr_cmd_dnld &&
 		    (pcie_ireg &
 		     pmadapter->pcard_pcie->reg->host_intr_cmd_dnld)) {
@@ -3819,7 +3778,6 @@ static mlan_status wlan_process_pcie_int_status(mlan_adapter *pmadapter)
 				wlan_pcie_send_vdll_complete(pmadapter);
 			PRINTM(MINFO, "<--- CMD DNLD DONE Interrupt --->\n");
 		}
-#endif
 		if (pmadapter->pcard_pcie->pcie_int_mode == PCIE_INT_MODE_MSI) {
 			pcb->moal_spin_lock(pmadapter->pmoal_handle,
 					    pmadapter->pint_lock);
@@ -4103,10 +4061,8 @@ mlan_status wlan_pcie_host_to_card(pmlan_private pmpriv, t_u8 type,
 		ret = wlan_pcie_send_data(pmadapter, type, pmbuf, tx_param);
 	else if (type == MLAN_TYPE_CMD)
 		ret = wlan_pcie_send_cmd(pmadapter, pmbuf);
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	else if (type == MLAN_TYPE_VDLL)
 		ret = wlan_pcie_send_vdll(pmadapter, pmbuf);
-#endif
 	LEAVE();
 	return ret;
 }
@@ -4231,13 +4187,12 @@ mlan_status wlan_alloc_pcie_ring_buf(pmlan_adapter pmadapter)
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
-	    (pmadapter->card_type == CARD_TYPE_PCIENW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEIW62X) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type == CARD_TYPE_PCIE9097)) {
 		wlan_pcie_init_adma_ring_size(pmadapter);
 	}
-#endif
 	pmadapter->pcard_pcie->cmdrsp_buf = MNULL;
 	ret = wlan_pcie_create_txbd_ring(pmadapter);
 	if (ret)
@@ -4289,8 +4244,9 @@ mlan_status wlan_free_pcie_ring_buf(pmlan_adapter pmadapter)
 	pmadapter->pcard_pcie->cmdrsp_buf = MNULL;
 #ifdef RPTR_MEM_COP
 	if ((pmadapter->card_type == CARD_TYPE_PCIE9098) ||
+	    (pmadapter->card_type == CARD_TYPE_PCIEAW693) ||
 	    (pmadapter->card_type ==
-	     CARD_TYPE_PCIENW62X)(pmadapter->card_type == CARD_TYPE_PCIE9097))
+	     CARD_TYPE_PCIEIW62X)(pmadapter->card_type == CARD_TYPE_PCIE9097))
 		wlan_pcie_free_rdptrs(pmadapter);
 #endif
 
@@ -4377,7 +4333,6 @@ mlan_status wlan_set_pcie_buf_config(mlan_private *pmpriv)
 		}
 	}
 #endif
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (pmadapter->pcard_pcie->reg->use_adma) {
 		/** config ADMA for Tx Data */
 		wlan_init_adma(pmadapter, ADMA_TX_DATA,
@@ -4398,7 +4353,6 @@ mlan_status wlan_set_pcie_buf_config(mlan_private *pmpriv)
 			       pmadapter->pcard_pcie->cmdrsp_buf->buf_pa, 0,
 			       MTRUE);
 	}
-#endif
 	wlan_pcie_init_fw(pmadapter);
 	LEAVE();
 	return ret;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_pcie.h b/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
index bd17a18..54f1c5c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_pcie.h
@@ -169,8 +169,12 @@ Change log:
 #define ADMA_BD_FLAG_DST_HOST MBIT(4)
 /** ADMA MIN PKT SIZE */
 #define ADMA_MIN_PKT_SIZE 128
+/** ADMA MIN PKT SIZE 32 */
+#define ADMA_MIN_PKT_SIZE_32 32
 /** ADMA dual descriptor mode requir 8 bytes alignment in buf size */
 #define ADMA_ALIGN_SIZE 8
+/** ADMA dual descriptor mode requir 8 bytes alignment in buf size */
+#define ADMA_ALIGN_SIZE_1 1
 /** ADMA RW_PTR wrap mask */
 #define ADMA_RW_PTR_WRAP_MASK 0x00001FFF
 /** ADMA MSIX DOORBEEL DATA */
@@ -182,7 +186,6 @@ Change log:
 /** PF start bit */
 #define ADMA_MSIX_PF_BIT 24
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 /** PCIE9098 dev_id/vendor id reg */
 #define PCIE9098_DEV_ID_REG 0x0000
 /** PCIE revision ID register */
@@ -319,7 +322,6 @@ Change log:
 #define PCIE9098_HOST_INTR_SEL_MASK                                            \
 	(PCIE9098_HOST_INTR_DNLD_DONE | PCIE9098_HOST_INTR_UPLD_RDY |          \
 	 PCIE9098_HOST_INTR_CMD_DONE | PCIE9098_HOST_INTR_EVENT_RDY)
-#endif
 
 #if defined(PCIE8997) || defined(PCIE8897)
 /* PCIE INTERNAL REGISTERS */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_scan.c b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
index 75beff5..f950e9c 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_scan.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_scan.c
@@ -6,7 +6,7 @@
  *  for sending scan commands to the firmware.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -508,6 +508,7 @@ static t_u8 wlan_scan_create_channel_list(
 			band = pmpriv->config_bands;
 		if (!wlan_is_band_compatible(band, pscan_region->band))
 			continue;
+
 		for (next_chan = 0; next_chan < pscan_region->num_cfp;
 		     next_chan++) {
 			/* Set the default scan type to the user specified type,
@@ -688,6 +689,7 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 	MrvlIEtypes_Extension_t *phe_cap;
 	t_u16 len = 0;
 	t_u8 radio_type = 0;
+	t_u8 channel = 0;
 
 	mlan_callbacks *pcb = (mlan_callbacks *)&pmadapter->callbacks;
 
@@ -711,7 +713,6 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 
 	/* check expiry before preparing scan list - may affect blacklist */
 	wlan_11h_get_csa_closed_channel(pmpriv);
-
 	pchan_tlv_out->header.type = wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
 
 	/* Set the temp channel struct pointer to the start of the desired list
@@ -763,12 +764,15 @@ wlan_scan_channel_list(mlan_private *pmpriv, t_void *pioctl_buf,
 				first_chan = 0;
 			}
 			radio_type = ptmp_chan_list->bandcfg.chanBand;
+			channel = ptmp_chan_list->chan_number;
 			PRINTM(MCMD_D,
-			       "Scan: Chan(%3d), bandcfg(%x), Mode(%d,%d), Dur(%d)\n",
+			       "Scan: Chan(%3d), bandcfg(%x), Mode(%d,%d,%d), Dur(%d)\n",
 			       ptmp_chan_list->chan_number,
 			       ptmp_chan_list->bandcfg,
 			       ptmp_chan_list->chan_scan_mode.passive_scan,
 			       ptmp_chan_list->chan_scan_mode.disable_chan_filt,
+			       ptmp_chan_list->chan_scan_mode
+				       .passive_to_active_scan,
 			       wlan_le16_to_cpu(ptmp_chan_list->max_scan_time));
 
 			if (foundJPch14 == MTRUE) {
@@ -1128,7 +1132,7 @@ static mlan_status wlan_scan_setup_scan_config(
 	t_u8 *ptlv_pos;
 	t_u32 num_probes;
 	t_u32 ssid_len;
-	t_u32 chan_idx;
+	t_u32 chan_idx = 0;
 	t_u32 chan_list_idx = 0;
 	t_u32 scan_type;
 	t_u16 scan_dur;
@@ -1594,7 +1598,6 @@ static mlan_status wlan_scan_setup_scan_config(
 			*pscan_current_only = MTRUE;
 			PRINTM(MINFO, "Scan: Scanning current channel only\n");
 		}
-
 	} else {
 		num_of_channel =
 			wlan_scan_create_channel_list(pmpriv, puser_scan_in,
@@ -4199,6 +4202,7 @@ mlan_status wlan_scan_networks(mlan_private *pmpriv, t_void *pioctl_buf,
 	t_u8 filtered_scan;
 	t_u8 scan_current_chan_only;
 	t_u8 max_chan_per_scan;
+	t_u8 i;
 
 	ENTER();
 
@@ -4229,10 +4233,6 @@ mlan_status wlan_scan_networks(mlan_private *pmpriv, t_void *pioctl_buf,
 		return MLAN_STATUS_FAILURE;
 	}
 
-	memset(pmadapter, pscan_chan_list, 0x00, buf_size);
-	memset(pmadapter, pscan_cfg_out, 0x00,
-	       sizeof(wlan_scan_cmd_config_tlv));
-
 	keep_previous_scan = MFALSE;
 
 	ret = wlan_scan_setup_scan_config(pmpriv, puser_scan_in,
@@ -4265,6 +4265,17 @@ mlan_status wlan_scan_networks(mlan_private *pmpriv, t_void *pioctl_buf,
 	} else {
 		wlan_scan_delete_ageout_entry(pmpriv);
 	}
+
+	// back up the pchan_stats before reset it
+	memset(pmadapter, pmadapter->pold_chan_stats, 0x00,
+	       sizeof(ChanStatistics_t) * pmadapter->num_in_chan_stats);
+	memcpy_ext(pmpriv->adapter, pmadapter->pold_chan_stats,
+		   pmadapter->pchan_stats,
+		   sizeof(ChanStatistics_t) * pmadapter->num_in_chan_stats,
+		   sizeof(ChanStatistics_t) * pmadapter->num_in_chan_stats);
+	pmadapter->old_idx_chan_stats = pmadapter->idx_chan_stats;
+	for (i = 0; i < pmadapter->num_in_chan_stats; i++)
+		pmadapter->pchan_stats[i].cca_scan_duration = 0;
 	pmadapter->idx_chan_stats = 0;
 
 	ret = wlan_scan_channel_list(pmpriv, pioctl_buf, max_chan_per_scan,
@@ -4365,10 +4376,11 @@ static t_bool wlan_active_scan_req_for_passive_chan(mlan_private *pmpriv,
 	t_u32 bss_idx, i;
 	t_u8 null_ssid[MLAN_MAX_SSID_LENGTH] = {0};
 	mlan_callbacks *pcb = (mlan_callbacks *)&pmpriv->adapter->callbacks;
-	wlan_user_scan_cfg *user_scan_cfg;
+	wlan_user_scan_cfg *user_scan_cfg = MNULL;
 	mlan_ds_scan *pscan = (mlan_ds_scan *)pioctl_buf->pbuf;
 	mlan_scan_req *pscan_req = MNULL;
 	wlan_user_scan_cfg *puser_scan_in = MNULL;
+	t_u16 band;
 
 	ENTER();
 
@@ -4392,7 +4404,6 @@ static t_bool wlan_active_scan_req_for_passive_chan(mlan_private *pmpriv,
 		PRINTM(MERROR, "Memory allocation for user_scan_cfg failed\n");
 		goto done;
 	}
-	memset(pmadapter, user_scan_cfg, 0, sizeof(wlan_user_scan_cfg));
 	for (bss_idx = 0; bss_idx < pmadapter->num_in_scan_table; bss_idx++) {
 		scan_reqd = MFALSE;
 		if (!memcmp(pmadapter,
@@ -4439,12 +4450,15 @@ static t_bool wlan_active_scan_req_for_passive_chan(mlan_private *pmpriv,
 			if (scan_reqd) {
 				chan_listed = MFALSE;
 				for (i = 0; i < id; i++) {
+					band = radio_type_to_band(
+						user_scan_cfg->chan_list[i]
+							.radio_type);
+
 					if ((user_scan_cfg->chan_list[i]
 						     .chan_number ==
 					     pmadapter->pscan_table[bss_idx]
 						     .channel) &&
-					    (user_scan_cfg->chan_list[i]
-						     .radio_type &
+					    (band &
 					     pmadapter->pscan_table[bss_idx]
 						     .bss_band)) {
 						chan_listed = MTRUE;
@@ -4466,6 +4480,9 @@ static t_bool wlan_active_scan_req_for_passive_chan(mlan_private *pmpriv,
 				user_scan_cfg->chan_list[id].scan_type =
 					MLAN_SCAN_TYPE_ACTIVE;
 				id++;
+
+				if (id >= WLAN_USER_SCAN_CHAN_MAX)
+					break;
 			}
 		}
 	}
@@ -4485,16 +4502,20 @@ static t_bool wlan_active_scan_req_for_passive_chan(mlan_private *pmpriv,
 				   MLAN_MAX_SSID_LENGTH);
 		}
 		user_scan_cfg->keep_previous_scan = MTRUE;
+		if (pmadapter->ext_scan_type == EXT_SCAN_ENHANCE)
+			user_scan_cfg->ext_scan_type = EXT_SCAN_ENHANCE;
+		PRINTM(MCMND, "active scan request for passive channel %d\n",
+		       id);
 		if (MLAN_STATUS_SUCCESS !=
 		    wlan_scan_networks(pmpriv, pioctl_buf, user_scan_cfg)) {
 			goto done;
 		}
 		ret = MTRUE;
 	}
+done:
 	if (user_scan_cfg)
 		pcb->moal_mfree(pmadapter->pmoal_handle, (t_u8 *)user_scan_cfg);
 
-done:
 	LEAVE();
 	return ret;
 }
@@ -4542,7 +4563,7 @@ mlan_status wlan_ret_802_11_scan(mlan_private *pmpriv, HostCmd_DS_COMMAND *resp,
 	t_u32 num_in_table;
 	t_u32 bss_idx;
 	t_u32 idx;
-	t_u32 tlv_buf_size;
+	t_u32 tlv_buf_size = 0;
 	t_u64 tsf_val;
 	chan_freq_power_t *cfp;
 	MrvlIEtypes_ChanBandListParamSet_t *pchan_band_tlv = MNULL;
@@ -4593,10 +4614,21 @@ mlan_status wlan_ret_802_11_scan(mlan_private *pmpriv, HostCmd_DS_COMMAND *resp,
 	 *   BSS Descriptions (bss_descript_size as bytesLef) and the command
 	 *   response header (S_DS_GEN)
 	 */
-	tlv_buf_size = scan_resp_size -
-		       (bytes_left + sizeof(pscan_rsp->bss_descript_size) +
-			sizeof(pscan_rsp->number_of_sets) + S_DS_GEN);
-	if (is_bgscan_resp)
+	if (scan_resp_size >
+	    (bytes_left + sizeof(pscan_rsp->bss_descript_size) +
+	     sizeof(pscan_rsp->number_of_sets) + S_DS_GEN)) {
+		tlv_buf_size =
+			(scan_resp_size -
+			 (bytes_left + sizeof(pscan_rsp->bss_descript_size) +
+			  sizeof(pscan_rsp->number_of_sets) + S_DS_GEN));
+	} else {
+		PRINTM(MERROR,
+		       "scan_resp_size: Incorrect size of TLV buff size.\n");
+	}
+
+	if (is_bgscan_resp &&
+	    (tlv_buf_size >
+	     sizeof(resp->params.bg_scan_query_resp.report_condition)))
 		tlv_buf_size -= sizeof(
 			resp->params.bg_scan_query_resp.report_condition);
 
@@ -5952,7 +5984,7 @@ mlan_status wlan_handle_event_ext_scan_status(mlan_private *pmpriv,
 	t_u16 tlv_buf_left, tlv_len, tlv_type;
 	MrvlIEtypesHeader_t *tlv;
 	MrvlIEtypes_ChannelStats_t *tlv_chan_stats;
-	t_u8 status;
+	t_u8 status = 0;
 	cmd_ctrl_node *pcmd_node = MNULL;
 
 	ENTER();
@@ -6083,7 +6115,8 @@ done:
 	wlan_release_cmd_lock(pmadapter);
 	wlan_move_cmd_to_cmd_pending_q(pmadapter);
 	pmadapter->bgscan_reported = MFALSE;
-	wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_SCAN_REPORT, MNULL);
+	if (!status)
+		wlan_recv_event(pmpriv, MLAN_EVENT_ID_DRV_SCAN_REPORT, MNULL);
 	LEAVE();
 	return ret;
 }
@@ -6130,10 +6163,9 @@ mlan_status wlan_cmd_802_11_bg_scan_query(mlan_private *pmpriv,
  *
  *  @return                 channel number
  */
-static t_u8
-wlan_bgscan_create_channel_list(mlan_private *pmpriv,
-				const wlan_bgscan_cfg *pbg_scan_in,
-				MrvlIEtypes_ChanListParamSet_t *tlv_chan_list)
+static t_u8 wlan_bgscan_create_channel_list(
+	mlan_private *pmpriv, const wlan_bgscan_cfg *pbg_scan_in,
+	MrvlIEtypes_ChanListParamSet_t *tlv_chan_list, t_u8 max_bgscan_chan)
 {
 	mlan_adapter *pmadapter = pmpriv->adapter;
 	region_chan_t *pscan_region;
@@ -6182,7 +6214,7 @@ wlan_bgscan_create_channel_list(mlan_private *pmpriv,
 			continue;
 		for (next_chan = 0; next_chan < pscan_region->num_cfp;
 		     next_chan++, chan_idx++) {
-			if (chan_idx >= WLAN_BG_SCAN_CHAN_MAX)
+			if (chan_idx >= max_bgscan_chan)
 				break;
 			/*
 			 * Set the default scan type to ACTIVE SCAN type, will
@@ -6290,6 +6322,7 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 	MrvlIETypes_HTCap_t *pht_cap = MNULL;
 	MrvlIETypes_VHTCap_t *pvht_cap = MNULL;
 	MrvlIEtypes_Extension_t *phe_cap = MNULL;
+	MrvlIEtypes_ScanChanGap_t *pscan_gap_tlv;
 	t_u16 len = 0;
 
 	t_u8 index;
@@ -6303,10 +6336,21 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 	t_u16 scan_dur;
 	t_u8 scan_type;
 	t_u16 band;
+	t_u8 max_bgscan_chan = 0;
+	t_u16 scan_chan_gap = 0;
 	const t_u8 zero_mac[6] = {0, 0, 0, 0, 0, 0};
 
 	ENTER();
 
+	max_bgscan_chan = WLAN_BG_SCAN_CHAN_MAX;
+
+#if defined(SD9177)
+	if (IS_CARD9177(pmadapter->card_type))
+		max_bgscan_chan = WLAN_BG_SCAN_CHAN_MAX_UNII_4;
+#endif
+
+	PRINTM(MCMND, "max_bgscan_chan=%d\n", max_bgscan_chan);
+
 	pcmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_BG_SCAN_CONFIG);
 	bg_scan->action = wlan_cpu_to_le16(bg_scan_in->action);
 	bg_scan->enable = bg_scan_in->enable;
@@ -6374,6 +6418,22 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 		tlv += sizeof(MrvlIEtypes_RepeatCount_t);
 		cmd_size += sizeof(MrvlIEtypes_RepeatCount_t);
 	}
+	scan_chan_gap = (bg_scan_in->scan_chan_gap ? bg_scan_in->scan_chan_gap :
+						     pmadapter->scan_chan_gap);
+	if (scan_chan_gap) {
+		pscan_gap_tlv = (MrvlIEtypes_ScanChanGap_t *)tlv;
+		PRINTM(MCMND, "bgScan: channel gap = 0x%x\n", scan_chan_gap);
+		pscan_gap_tlv->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_SCAN_CHANNEL_GAP);
+		pscan_gap_tlv->header.len = sizeof(pscan_gap_tlv->gap);
+		pscan_gap_tlv->gap =
+			wlan_cpu_to_le16((t_u16)pmadapter->scan_chan_gap);
+		/** indicate FW, gap is optional */
+		pscan_gap_tlv->gap |= GAP_FLAG_OPTIONAL;
+		tlv += sizeof(pscan_gap_tlv->header) +
+		       pscan_gap_tlv->header.len;
+		cmd_size += sizeof(MrvlIEtypes_ScanChanGap_t);
+	}
 	for (ssid_idx = 0; ((ssid_idx < NELEMENTS(bg_scan_in->ssid_list)) &&
 			    (*bg_scan_in->ssid_list[ssid_idx].ssid ||
 			     bg_scan_in->ssid_list[ssid_idx].max_len));
@@ -6404,7 +6464,7 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 		tlv_chan_list = (MrvlIEtypes_ChanListParamSet_t *)tlv;
 		PRINTM(MINFO, "Scan: Using supplied channel list\n");
 		chan_num = 0;
-		for (chan_idx = 0; chan_idx < WLAN_BG_SCAN_CHAN_MAX &&
+		for (chan_idx = 0; chan_idx < max_bgscan_chan &&
 				   bg_scan_in->chan_list[chan_idx].chan_number;
 		     chan_idx++) {
 			radio_type = bg_scan_in->chan_list[chan_idx].radio_type;
@@ -6460,6 +6520,15 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 						pmadapter->specific_scan_time;
 				}
 			}
+			PRINTM(MCMD_D,
+			       "BGScan: Chan(%3d), bandcfg(%x), Mode(%d), Dur(%d)\n",
+			       tlv_chan_list->chan_scan_param[chan_num]
+				       .chan_number,
+			       tlv_chan_list->chan_scan_param[chan_num].bandcfg,
+			       tlv_chan_list->chan_scan_param[chan_num]
+				       .chan_scan_mode.passive_scan,
+			       scan_dur);
+
 			tlv_chan_list->chan_scan_param[chan_num].min_scan_time =
 				wlan_cpu_to_le16(scan_dur);
 			tlv_chan_list->chan_scan_param[chan_num].max_scan_time =
@@ -6476,8 +6545,8 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 			    sizeof(ChanScanParamSet_t) * chan_num;
 	} else {
 		tlv_chan_list = (MrvlIEtypes_ChanListParamSet_t *)tlv;
-		chan_num = wlan_bgscan_create_channel_list(pmpriv, bg_scan_in,
-							   tlv_chan_list);
+		chan_num = wlan_bgscan_create_channel_list(
+			pmpriv, bg_scan_in, tlv_chan_list, max_bgscan_chan);
 		tlv_chan_list->header.type =
 			wlan_cpu_to_le16(TLV_TYPE_CHANLIST);
 		tlv_chan_list->header.len =
@@ -6488,7 +6557,8 @@ mlan_status wlan_cmd_bgscan_config(mlan_private *pmpriv,
 			    sizeof(ChanScanParamSet_t) * chan_num;
 	}
 	if (bg_scan_in->chan_per_scan) {
-		bg_scan->chan_per_scan = bg_scan_in->chan_per_scan;
+		bg_scan->chan_per_scan =
+			MIN(max_bgscan_chan, bg_scan_in->chan_per_scan);
 	} else {
 		if (bg_scan_in->report_condition & BG_SCAN_WAIT_ALL_CHAN_DONE)
 			bg_scan->chan_per_scan = chan_num;
@@ -7057,8 +7127,6 @@ mlan_status wlan_scan_specific_ssid(mlan_private *pmpriv, t_void *pioctl_buf,
 		goto done;
 	}
 
-	memset(pmpriv->adapter, pscan_cfg, 0x00, sizeof(wlan_user_scan_cfg));
-
 	memcpy_ext(pmpriv->adapter, pscan_cfg->ssid_list[0].ssid,
 		   preq_ssid->ssid, preq_ssid->ssid_len, MLAN_MAX_SSID_LENGTH);
 	pscan_cfg->keep_previous_scan = MFALSE;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
index 8d7436b..bfcb1cb 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sdio.c
@@ -3,7 +3,7 @@
  *  @brief This file contains SDIO specific code
  *
  *
- *  Copyright 2008-2021, 2023 NXP
+ *  Copyright 2008-2021 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -107,6 +107,7 @@ static const struct _mlan_card_info mlan_card_info_sd8887 = {
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 0,
 };
 #endif
 
@@ -147,6 +148,7 @@ static const struct _mlan_card_info mlan_card_info_sd8801 = {
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 0,
 };
 #endif
 
@@ -217,12 +219,10 @@ static const struct _mlan_card_info mlan_card_info_sd8897 = {
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 0,
 };
 #endif
 
-#if defined(SD8977) || defined(SD8997) || defined(SD8987) ||                   \
-	defined(SD9098) || defined(SD9097) || defined(SDNW62X) ||              \
-	defined(SD8978) || defined(SD9177)
 static const struct _mlan_sdio_card_reg mlan_reg_sd8977_sd8997 = {
 	.start_rd_port = 0,
 	.start_wr_port = 0,
@@ -289,7 +289,6 @@ static const struct _mlan_sdio_card_reg mlan_reg_sd8977_sd8997 = {
 	.fw_dnld_status_1_reg = 0xE9,
 	.winner_check_reg = 0xFC,
 };
-#endif
 
 #ifdef SD8997
 static const struct _mlan_card_info mlan_card_info_sd8997 = {
@@ -297,6 +296,7 @@ static const struct _mlan_card_info mlan_card_info_sd8997 = {
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -307,19 +307,30 @@ static const struct _mlan_card_info mlan_card_info_sd9097 = {
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
-#ifdef SDNW62X
-static const struct _mlan_card_info mlan_card_info_sdnw62x = {
+#ifdef SDIW62X
+static const struct _mlan_card_info mlan_card_info_sdiw62x = {
 	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
 	.v16_fw_api = 1,
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
+static const struct _mlan_card_info mlan_card_info_sdaw693 = {
+	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.supp_ps_handshake = 0,
+	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
+};
+
 #ifdef SD9098
 static const struct _mlan_card_info mlan_card_info_sd9098 = {
 	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
@@ -327,6 +338,7 @@ static const struct _mlan_card_info mlan_card_info_sd9098 = {
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 #ifdef SD9177
@@ -336,6 +348,7 @@ static const struct _mlan_card_info mlan_card_info_sd9177 = {
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
 };
 #endif
 
@@ -345,6 +358,7 @@ static const struct _mlan_card_info mlan_card_info_sd8977 = {
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
 };
 #endif
 
@@ -354,6 +368,7 @@ static const struct _mlan_card_info mlan_card_info_sd8987 = {
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 0,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 1,
 };
 #endif
 
@@ -976,7 +991,7 @@ static mlan_status wlan_sdio_prog_fw_w_helper(pmlan_adapter pmadapter, t_u8 *fw,
 	t_u8 *firmware = fw;
 	t_u32 firmwarelen = fw_len;
 	t_u32 offset = 0;
-	t_u32 base0 = 0, base1;
+	t_u32 base0 = 0, base1 = 0;
 	t_void *tmpfwbuf = MNULL;
 	t_u32 tmpfwbufsz;
 	t_u8 *fwbuf;
@@ -1015,7 +1030,6 @@ static mlan_status wlan_sdio_prog_fw_w_helper(pmlan_adapter pmadapter, t_u8 *fw,
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-	memset(pmadapter, tmpfwbuf, 0, tmpfwbufsz);
 	/* Ensure 8-byte aligned firmware buffer */
 	fwbuf = (t_u8 *)ALIGN_ADDR(tmpfwbuf, DMA_ALIGNMENT);
 #if defined(SD9098)
@@ -1035,11 +1049,10 @@ static mlan_status wlan_sdio_prog_fw_w_helper(pmlan_adapter pmadapter, t_u8 *fw,
 			check_fw_status = MTRUE;
 	}
 #endif
-#if defined(SD9097) || defined(SD9177) || defined(SDNW62X)
 	if (IS_SD9097(pmadapter->card_type) ||
-	    IS_SDNW62X(pmadapter->card_type) || IS_SD9177(pmadapter->card_type))
+	    IS_SDIW62X(pmadapter->card_type) ||
+	    IS_SDAW693(pmadapter->card_type) || IS_SD9177(pmadapter->card_type))
 		check_fw_status = MTRUE;
-#endif
 
 	/* Perform firmware data transfer */
 	do {
@@ -1163,7 +1176,7 @@ static mlan_status wlan_sdio_prog_fw_w_helper(pmlan_adapter pmadapter, t_u8 *fw,
 			 * for last block */
 			if (firmwarelen && firmwarelen - offset < txlen)
 				txlen = firmwarelen - offset;
-			PRINTM(MINFO, ".");
+			PRINTM(MINFO, ".\n");
 
 			tx_blocks = (txlen + MLAN_SDIO_BLOCK_SIZE_FW_DNLD - 1) /
 				    MLAN_SDIO_BLOCK_SIZE_FW_DNLD;
@@ -1334,7 +1347,7 @@ static mlan_status wlan_decode_rx_packet(mlan_adapter *pmadapter,
 
 	case MLAN_TYPE_CMD:
 		PRINTM(MINFO, "--- Rx: Cmd Response ---\n");
-		if (pmadapter->cmd_sent)
+		if (pmadapter->cmd_sent && !pmadapter->vdll_ctrl.vdll_len)
 			pmadapter->cmd_sent = MFALSE;
 		/* take care of curr_cmd = NULL case */
 		if (!pmadapter->curr_cmd) {
@@ -2419,12 +2432,16 @@ mlan_status wlan_get_sdio_device(pmlan_adapter pmadapter)
 		pmadapter->pcard_info = &mlan_card_info_sd9097;
 		break;
 #endif
-#ifdef SDNW62X
-	case CARD_TYPE_SDNW62X:
+#ifdef SDIW62X
+	case CARD_TYPE_SDIW62X:
 		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
-		pmadapter->pcard_info = &mlan_card_info_sdnw62x;
+		pmadapter->pcard_info = &mlan_card_info_sdiw62x;
 		break;
 #endif
+	case CARD_TYPE_SDAW693:
+		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
+		pmadapter->pcard_info = &mlan_card_info_sdaw693;
+		break;
 #ifdef SD9177
 	case CARD_TYPE_SD9177:
 		pmadapter->pcard_sd->reg = &mlan_reg_sd8977_sd8997;
@@ -3037,7 +3054,6 @@ exit:
 	return ret;
 }
 
-#if (defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177))
 /**
  *  @brief This function sends vdll data to the card.
  *
@@ -3079,7 +3095,6 @@ static mlan_status wlan_sdio_send_vdll(mlan_adapter *pmadapter,
 	LEAVE();
 	return ret;
 }
-#endif
 
 /**
  *  @brief This function sends data to the card.
@@ -3098,10 +3113,8 @@ static mlan_status wlan_sdio_host_to_card_ext(pmlan_private pmpriv, t_u8 type,
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_adapter *pmadapter = pmpriv->adapter;
 
-#if (defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177))
 	if (type == MLAN_TYPE_VDLL)
 		return wlan_sdio_send_vdll(pmadapter, pmbuf);
-#endif
 	ret = wlan_sdio_host_to_card(pmadapter, type, pmbuf, tx_param);
 
 	if (type == MLAN_TYPE_DATA && ret == MLAN_STATUS_FAILURE)
@@ -3397,7 +3410,10 @@ static mlan_status wlan_pm_sdio_wakeup_card(pmlan_adapter pmadapter,
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 
 	ENTER();
-	PRINTM(MEVENT, "Wakeup device...\n");
+	if (pmadapter->second_mac)
+		PRINTM(MEVENT, "#2 Wakeup device...\n");
+	else
+		PRINTM(MEVENT, "Wakeup device...\n");
 	pmadapter->callbacks.moal_get_system_time(pmadapter->pmoal_handle,
 						  &pmadapter->pm_wakeup_in_secs,
 						  &age_ts_usec);
@@ -3560,9 +3576,6 @@ mlan_status wlan_reset_fw(pmlan_adapter pmadapter)
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
 	}
-#if defined(SD8997) || defined(SD8977) || defined(SD8987) ||                   \
-	defined(SD9098) || defined(SD9097) || defined(SDNW62X) ||              \
-	defined(SD8978) || defined(SD9177)
 	if (MFALSE
 #ifdef SD8997
 	    || IS_SD8997(pmadapter->card_type)
@@ -3582,9 +3595,10 @@ mlan_status wlan_reset_fw(pmlan_adapter pmadapter)
 #ifdef SD9097
 	    || IS_SD9097(pmadapter->card_type)
 #endif
-#ifdef SDNW62X
-	    || IS_SDNW62X(pmadapter->card_type)
+#ifdef SDIW62X
+	    || IS_SDIW62X(pmadapter->card_type)
 #endif
+	    || IS_SDAW693(pmadapter->card_type)
 #ifdef SD9177
 	    || IS_SD9177(pmadapter->card_type)
 #endif
@@ -3595,7 +3609,6 @@ mlan_status wlan_reset_fw(pmlan_adapter pmadapter)
 				    HOST_TO_CARD_EVENT_REG,
 				    value | HOST_POWER_UP);
 	}
-#endif
 	/* Poll register around 100 ms */
 	for (tries = 0; tries < MAX_POLL_TRIES; ++tries) {
 		pcb->moal_read_reg(pmadapter->pmoal_handle, reset_reg, &value);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_shim.c b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
index fdd7140..45ba817 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_shim.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
@@ -441,6 +441,7 @@ mlan_status mlan_register(pmlan_device pmdevice, t_void **ppmlan_adapter)
 	pmadapter->multiple_dtim = pmdevice->multi_dtim;
 	pmadapter->inact_tmo = pmdevice->inact_tmo;
 	pmadapter->init_para.drcs_chantime_mode = pmdevice->drcs_chantime_mode;
+	pmadapter->second_mac = pmdevice->second_mac;
 	pmadapter->hs_wake_interval = pmdevice->hs_wake_interval;
 	if (pmdevice->indication_gpio != 0xff) {
 		pmadapter->ind_gpio = pmdevice->indication_gpio & 0x0f;
@@ -1386,7 +1387,8 @@ process_start:
 
 exit_main_proc:
 	if (pmadapter->hw_status == WlanHardwareStatusClosing)
-		mlan_shutdown_fw(pmadapter);
+		if (MLAN_STATUS_SUCCESS != mlan_shutdown_fw(pmadapter))
+			PRINTM(MERROR, "ERR:mlan_shutdown_fw failed\n");
 	LEAVE();
 	return ret;
 }
@@ -1488,11 +1490,6 @@ mlan_status mlan_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 		wlan_cancel_all_pending_cmd(pmadapter, MFALSE);
 		goto exit;
 	}
-	if (pioctl_req->action == MLAN_ACT_CANCEL) {
-		wlan_cancel_pending_ioctl(pmadapter, pioctl_req);
-		ret = MLAN_STATUS_SUCCESS;
-		goto exit;
-	}
 	pmpriv = pmadapter->priv[pioctl_req->bss_index];
 	ret = pmpriv->ops.ioctl(adapter, pioctl_req);
 exit:
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
index ad04dd8..62b6a85 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmd.c
@@ -1281,7 +1281,7 @@ static mlan_status wlan_cmd_802_11_key_material(pmlan_private pmpriv,
 					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
 					     sizeof(gcmp_param) +
 					     sizeof(pkey_material->action));
-
+		PRINTM(MCMND, "Set GCMP Key\n");
 		goto done;
 	}
 	if (pkey->key_flags & KEY_FLAG_CCMP_256) {
@@ -1305,7 +1305,7 @@ static mlan_status wlan_cmd_802_11_key_material(pmlan_private pmpriv,
 					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
 					     sizeof(ccmp_256_param) +
 					     sizeof(pkey_material->action));
-
+		PRINTM(MCMND, "Set CCMP256 Key\n");
 		goto done;
 	}
 	if (pkey->key_len == WPA_AES_KEY_LEN &&
@@ -1372,7 +1372,7 @@ static mlan_status wlan_cmd_802_11_key_material(pmlan_private pmpriv,
 		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID))
 			memcpy_ext(pmpriv->adapter,
 				   pkey_material->key_param_set.key_params
-					   .cmac_aes.ipn,
+					   .gmac_aes.ipn,
 				   pkey->pn, SEQ_MAX_SIZE, IGTK_PN_SIZE);
 		pkey_material->key_param_set.key_info &=
 			~(wlan_cpu_to_le16(KEY_INFO_MCAST_KEY));
@@ -1380,10 +1380,10 @@ static mlan_status wlan_cmd_802_11_key_material(pmlan_private pmpriv,
 			wlan_cpu_to_le16(KEY_INFO_AES_MCAST_IGTK);
 		pkey_material->key_param_set.key_type =
 			KEY_TYPE_ID_BIP_GMAC_256;
-		pkey_material->key_param_set.key_params.cmac_aes.key_len =
+		pkey_material->key_param_set.key_params.gmac_aes.key_len =
 			wlan_cpu_to_le16(pkey->key_len);
 		memcpy_ext(pmpriv->adapter,
-			   pkey_material->key_param_set.key_params.cmac_aes.key,
+			   pkey_material->key_param_set.key_params.gmac_aes.key,
 			   pkey->key_material, pkey->key_len,
 			   WPA_IGTK_256_KEY_LEN);
 		pkey_material->key_param_set.length = wlan_cpu_to_le16(
@@ -2724,7 +2724,7 @@ mlan_status wlan_cmd_net_monitor(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	if (cmd_action == HostCmd_ACT_GEN_SET) {
 		if (net_mon->enable_net_mon) {
 			cmd_net_mon->enable_net_mon =
-				wlan_cpu_to_le16((t_u16)NET_MON_MODE1);
+				wlan_cpu_to_le16((t_u16)NET_MON_MODE3);
 			cmd_net_mon->filter_flag =
 				wlan_cpu_to_le16((t_u16)net_mon->filter_flag);
 		}
@@ -3315,7 +3315,7 @@ static t_u16 mlan_prepare_roam_offload_tlv(pmlan_private pmpriv, t_u32 type,
 		pos += sizeof(MrvlIEtypes_RepeatCount_t);
 	}
 	LEAVE();
-	return (pos - begin);
+	return ((t_u16)(pos - begin));
 }
 /**
  *  @brief This function sends enable/disable roam offload command to firmware.
@@ -3458,6 +3458,8 @@ static mlan_status wlan_cmd_auto_tx(pmlan_private pmpriv,
 	MrvlIEtypes_Keep_Alive_Ctrl_t *ctrl_tlv = MNULL;
 	MrvlIEtypes_Keep_Alive_Pkt_t *pkt_tlv = MNULL;
 	mlan_ds_misc_keep_alive *misc_keep_alive = MNULL;
+	MrvlIEtypes_Cloud_Keep_Alive_Rx_t *keep_alive_Rx_tlv = MNULL;
+	mlan_ds_misc_keep_alive_rx *misc_keep_alive_rx = MNULL;
 	t_u8 eth_ip[] = {0x08, 0x00};
 
 	ENTER();
@@ -3552,6 +3554,46 @@ static mlan_status wlan_cmd_auto_tx(pmlan_private pmpriv,
 		}
 		keep_alive_tlv->header.len = wlan_cpu_to_le16(len);
 
+		cmd->size = cmd->size + len + sizeof(MrvlIEtypesHeader_t);
+		cmd->size = wlan_cpu_to_le16(cmd->size);
+		break;
+	case OID_CLOUD_KEEP_ALIVE_ACK:
+		misc_keep_alive_rx = (mlan_ds_misc_keep_alive_rx *)pdata_buf;
+		keep_alive_Rx_tlv = (MrvlIEtypes_Cloud_Keep_Alive_Rx_t *)pos;
+		keep_alive_Rx_tlv->header.type =
+			wlan_cpu_to_le16(TLV_TYPE_CLOUD_KEEP_ALIVE_ACK);
+		keep_alive_Rx_tlv->keep_alive_id =
+			misc_keep_alive_rx->mkeep_alive_id;
+		keep_alive_Rx_tlv->enable = misc_keep_alive_rx->enable;
+		memcpy_ext(pmpriv->adapter,
+			   keep_alive_Rx_tlv->eth_header.dest_addr,
+			   misc_keep_alive_rx->dst_mac, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+		memcpy_ext(pmpriv->adapter,
+			   keep_alive_Rx_tlv->eth_header.src_addr,
+			   misc_keep_alive_rx->src_mac, MLAN_MAC_ADDR_LENGTH,
+			   MLAN_MAC_ADDR_LENGTH);
+		memcpy_ext(pmpriv->adapter,
+			   (t_u8 *)&keep_alive_Rx_tlv->eth_header.h803_len,
+			   eth_ip, sizeof(t_u16), sizeof(t_u16));
+		if (misc_keep_alive_rx->ether_type)
+			keep_alive_Rx_tlv->eth_header.h803_len =
+				mlan_htons(misc_keep_alive_rx->ether_type);
+		else
+			memcpy_ext(
+				pmpriv->adapter,
+				(t_u8 *)&keep_alive_Rx_tlv->eth_header.h803_len,
+				eth_ip, sizeof(t_u16), sizeof(t_u16));
+		memcpy_ext(pmpriv->adapter,
+			   (t_u8 *)&keep_alive_Rx_tlv->ip_packet,
+			   misc_keep_alive_rx->packet,
+			   misc_keep_alive_rx->pkt_len,
+			   MKEEP_ALIVE_ACK_PKT_MAX);
+
+		len = sizeof(MrvlIEtypes_Cloud_Keep_Alive_Rx_t) +
+		      misc_keep_alive_rx->pkt_len - sizeof(MrvlIEtypesHeader_t);
+		keep_alive_Rx_tlv->header.len = wlan_cpu_to_le16(len);
+
 		cmd->size = cmd->size + len + sizeof(MrvlIEtypesHeader_t);
 		cmd->size = wlan_cpu_to_le16(cmd->size);
 		break;
@@ -3636,7 +3678,6 @@ static mlan_status wlan_cmd_csi(pmlan_private pmpriv, HostCmd_DS_COMMAND *cmd,
 	case CSI_CMD_DISABLE:
 		DBG_HEXDUMP(MCMD_D, "Disable CSI", csi_cfg_cmd,
 			    sizeof(HostCmd_DS_CSI_CFG));
-		fallthrough;
 	default:
 		break;
 	}
@@ -3795,6 +3836,14 @@ mlan_status wlan_ops_sta_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_802_11_link_statistic(pmpriv, cmd_ptr,
 						     cmd_action, pioctl_buf);
 		break;
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_cmd_802_11_ftm_config_session_params(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_cmd_802_11_ftm_config_responder(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
 	case HostCmd_CMD_RSSI_INFO:
 		ret = wlan_cmd_802_11_rssi_info(pmpriv, cmd_ptr, cmd_action);
 		break;
@@ -4170,6 +4219,10 @@ mlan_status wlan_ops_sta_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_rxabortcfg(pmpriv, cmd_ptr, cmd_action,
 					  pdata_buf);
 		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_cmd_ofdmdesense_cfg(pmpriv, cmd_ptr, cmd_action,
+					       pdata_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_cmd_rxabortcfg_ext(pmpriv, cmd_ptr, cmd_action,
 					      pdata_buf);
@@ -4212,6 +4265,10 @@ mlan_status wlan_ops_sta_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_get_ch_load(pmpriv, cmd_ptr, cmd_action,
 					   pdata_buf);
 		break;
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_cmd_cross_chip_synch(pmpriv, cmd_ptr, cmd_action,
+						pdata_buf);
+		break;
 	default:
 		PRINTM(MERROR, "PREP_CMD: unknown command- %#x\n", cmd_no);
 		ret = MLAN_STATUS_FAILURE;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
index a70b71c..2dce752 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_cmdresp.c
@@ -888,7 +888,7 @@ static mlan_status wlan_ret_get_log(pmlan_private pmpriv,
  */
 static mlan_status wlan_get_power_level(pmlan_private pmpriv, void *pdata_buf)
 {
-	t_u16 length = 0;
+	t_s32 length = 0;
 	t_s8 max_power = -1, min_power = -1;
 	MrvlTypes_Power_Group_t *ppg_tlv = MNULL;
 	Power_Group_t *pg = MNULL;
@@ -907,7 +907,7 @@ static mlan_status wlan_get_power_level(pmlan_private pmpriv, void *pdata_buf)
 			min_power = pg->power_min;
 			length -= sizeof(Power_Group_t);
 		}
-		while (length) {
+		while (length > 0) {
 			pg++;
 			if (max_power < pg->power_max)
 				max_power = pg->power_max;
@@ -2632,20 +2632,22 @@ static mlan_status wlan_ret_sta_config(pmlan_private pmpriv,
 		if (pioctl_buf->req_id == MLAN_IOCTL_BSS) {
 			bss = (mlan_ds_bss *)pioctl_buf->pbuf;
 			if (bss->sub_command == MLAN_OID_BSS_CHAN_INFO) {
+				Band_Config_t *bandcfg =
+					&bss->param.sta_channel.bandcfg;
+
 				tlv_band_channel =
 					(MrvlIEtypes_channel_band_t *)
 						cmdrsp_sta_cfg->tlv_buffer;
-				bss->param.sta_channel.bandcfg =
-					tlv_band_channel->bandcfg;
+				*bandcfg = tlv_band_channel->bandcfg;
 				bss->param.sta_channel.channel =
 					tlv_band_channel->channel;
 				bss->param.sta_channel.is_11n_enabled =
 					IS_11N_ENABLED(pmpriv);
-				if (bss->param.sta_channel.bandcfg.chanWidth ==
-				    CHAN_BW_80MHZ)
+				if (bandcfg->chanWidth == CHAN_BW_80MHZ)
 					bss->param.sta_channel.center_chan =
 						wlan_get_center_freq_idx(
-							pmpriv, BAND_AAC,
+							pmpriv,
+							bandcfg->chanBand,
 							bss->param.sta_channel
 								.channel,
 							CHANNEL_BW_80MHZ);
@@ -2752,6 +2754,8 @@ static mlan_status wlan_ret_auto_tx(pmlan_private pmpriv,
 	MrvlIEtypes_Cloud_Keep_Alive_t *keep_alive_tlv = MNULL;
 	MrvlIEtypes_Keep_Alive_Pkt_t *pkt_tlv = MNULL;
 	mlan_ds_misc_keep_alive *misc_keep_alive = MNULL;
+	MrvlIEtypes_Cloud_Keep_Alive_Rx_t *keep_alive_Rx_tlv = MNULL;
+	mlan_ds_misc_keep_alive_rx *misc_keep_alive_rx = MNULL;
 
 	ENTER();
 
@@ -2828,6 +2832,65 @@ static mlan_status wlan_ret_auto_tx(pmlan_private pmpriv,
 				}
 			}
 		}
+		if (header->type == TLV_TYPE_CLOUD_KEEP_ALIVE_ACK) {
+			keep_alive_Rx_tlv =
+				(MrvlIEtypes_Cloud_Keep_Alive_Rx_t *)
+					cmdrsp_auto_tx->tlv_buffer;
+			misc_keep_alive_rx = (mlan_ds_misc_keep_alive_rx *)&misc
+						     ->param.keep_alive_rx;
+			misc_keep_alive_rx->mkeep_alive_id =
+				keep_alive_Rx_tlv->keep_alive_id;
+			misc_keep_alive_rx->enable = keep_alive_Rx_tlv->enable;
+			if (((action == HostCmd_ACT_GEN_SET) ||
+			     (action == HostCmd_ACT_GEN_RESET)) &&
+			    !keep_alive_Rx_tlv->enable) {
+				len = len -
+				      sizeof(keep_alive_Rx_tlv->keep_alive_id) -
+				      sizeof(keep_alive_Rx_tlv->enable);
+				if (len > sizeof(MrvlIEtypesHeader_t)) {
+					header = (MrvlIEtypesHeader_t *)
+						keep_alive_Rx_tlv;
+					header->type =
+						wlan_le16_to_cpu(header->type);
+					len = wlan_le16_to_cpu(header->len) -
+					      sizeof(Eth803Hdr_t);
+					if (header->type ==
+					    TLV_TYPE_CLOUD_KEEP_ALIVE_ACK) {
+						memcpy_ext(
+							pmpriv->adapter,
+							misc_keep_alive_rx
+								->dst_mac,
+							keep_alive_Rx_tlv
+								->eth_header
+								.dest_addr,
+							MLAN_MAC_ADDR_LENGTH,
+							sizeof(misc_keep_alive_rx
+								       ->dst_mac));
+						memcpy_ext(
+							pmpriv->adapter,
+							misc_keep_alive_rx
+								->src_mac,
+							keep_alive_Rx_tlv
+								->eth_header
+								.src_addr,
+							MLAN_MAC_ADDR_LENGTH,
+							sizeof(misc_keep_alive
+								       ->src_mac));
+						memcpy_ext(
+							pmpriv->adapter,
+							misc_keep_alive_rx
+								->packet,
+							keep_alive_Rx_tlv
+								->ip_packet,
+							len,
+							sizeof(misc_keep_alive
+								       ->packet));
+						misc_keep_alive_rx->pkt_len =
+							len;
+					}
+				}
+			}
+		}
 	}
 
 	LEAVE();
@@ -3093,6 +3156,39 @@ cmd_mfg_done:
 	return ret;
 }
 
+/**
+ *  @brief This function handles the command response of TWT_REPORT
+ *
+ *  @param pmpriv       A pointer to mlan_private structure
+ *  @param resp         A pointer to HostCmd_DS_COMMAND
+ *  @param pioctl_buf   A pointer to command buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS
+ */
+mlan_status wlan_ret_twt_report(pmlan_private pmpriv, HostCmd_DS_COMMAND *resp,
+				mlan_ioctl_req *pioctl_buf)
+{
+	mlan_ds_misc_cfg *misc_cfg = MNULL;
+	HostCmd_DS_TWT_CFG *twt_recfg = &resp->params.twtcfg;
+
+	ENTER();
+
+	if ((wlan_le16_to_cpu(twt_recfg->action) == HostCmd_ACT_GEN_GET) &&
+	    (wlan_le16_to_cpu(twt_recfg->sub_id) ==
+	     MLAN_11AX_TWT_REPORT_SUBID)) {
+		if (pioctl_buf) {
+			misc_cfg = (mlan_ds_misc_cfg *)pioctl_buf->pbuf;
+			memcpy_ext(pmpriv->adapter,
+				   &misc_cfg->param.twt_report_info,
+				   &resp->params.twtcfg.param.twt_report,
+				   sizeof(mlan_ds_twt_report),
+				   sizeof(mlan_ds_twt_report));
+		}
+	}
+	LEAVE();
+	return MLAN_STATUS_SUCCESS;
+}
+
 /**
  *  @brief This function handles the station command response
  *
@@ -3230,6 +3326,14 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_802_11_LINK_STATS:
 		ret = wlan_ret_get_link_statistic(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_ret_802_11_ftm_config_session_params(pmpriv, resp,
+								pioctl_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_ret_802_11_ftm_config_responder(pmpriv, resp,
+							   pioctl_buf);
+		break;
 	case HostCmd_CMD_RSSI_INFO_EXT:
 		ret = wlan_ret_802_11_rssi_info_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -3536,6 +3640,7 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 		ret = wlan_ret_range_ext(pmpriv, resp, pioctl_buf);
 		break;
 	case HostCmd_CMD_TWT_CFG:
+		ret = wlan_ret_twt_report(pmpriv, resp, pioctl_buf);
 		break;
 	case HOST_CMD_GPIO_TSF_LATCH_PARAM_CONFIG:
 		ret = wlan_ret_gpio_tsf_latch(pmpriv, resp, pioctl_buf);
@@ -3543,6 +3648,9 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_RX_ABORT_CFG:
 		ret = wlan_ret_rxabortcfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_ret_ofdmdesense_cfg(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_ret_rxabortcfg_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -3584,6 +3692,9 @@ mlan_status wlan_ops_sta_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_GET_CH_LOAD:
 		ret = wlan_ret_ch_load(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_ret_cross_chip_synch(pmpriv, resp, pioctl_buf);
+		break;
 	default:
 		PRINTM(MERROR, "CMD_RESP: Unknown command response %#x\n",
 		       resp->command);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
index effe3cc..9d3b8fe 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_event.c
@@ -474,11 +474,6 @@ t_void wlan_reset_connect_state(pmlan_private priv, t_u8 drv_disconnect)
 		return;
 	}
 
-	if (pmadapter->pending_disconnect_priv) {
-		LEAVE();
-		return;
-	}
-
 	pevent->bss_index = priv->bss_index;
 	pevent->event_id = MLAN_EVENT_ID_FW_DISCONNECTED;
 	pevent->event_len = sizeof(priv->disconnect_reason_code);
@@ -679,8 +674,10 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 	pmlan_callbacks pcb = &pmadapter->callbacks;
 	mlan_event *pevent = MNULL;
 	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	Event_WLS_FTM_t *event_ftm = MNULL;
 	chan_band_info *pchan_band_info = MNULL;
 	t_u8 radar_chan;
+	t_u8 bandwidth;
 	t_u16 enable = 0;
 
 	ENTER();
@@ -775,8 +772,10 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 
 	case EVENT_PS_SLEEP:
 		PRINTM(MINFO, "EVENT: SLEEP\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "_");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "__");
+		else
+			PRINTM(MEVENT, "_");
 
 		/* Handle unexpected PS SLEEP event */
 		if (pmadapter->ps_state == PS_STATE_SLEEP_CFM)
@@ -788,8 +787,10 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 
 	case EVENT_PS_AWAKE:
 		PRINTM(MINFO, "EVENT: AWAKE\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "|");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "||");
+		else
+			PRINTM(MEVENT, "|");
 		if (!pmadapter->pps_uapsd_mode && pmpriv->media_connected &&
 		    (pmpriv->port_open || !pmpriv->port_ctrl_mode) &&
 		    pmadapter->sleep_period.period) {
@@ -958,11 +959,10 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 				   sizeof(pchan_band_info->bandcfg));
 			pchan_band_info->channel = pchan_info->channel;
 			if (pchan_band_info->bandcfg.chanWidth == CHAN_BW_80MHZ)
-				pchan_band_info->center_chan =
-					wlan_get_center_freq_idx(
-						priv, BAND_AAC,
-						pchan_info->channel,
-						CHANNEL_BW_80MHZ);
+				pchan_band_info
+					->center_chan = wlan_get_center_freq_idx(
+					priv, pchan_band_info->bandcfg.chanBand,
+					pchan_info->channel, CHANNEL_BW_80MHZ);
 			wlan_recv_event(pmpriv,
 					MLAN_EVENT_ID_FW_CHAN_SWITCH_COMPLETE,
 					pevent);
@@ -1011,8 +1011,8 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 				   sizeof(eventcause),
 			   pevent->event_len, pevent->event_len);
 		/* Handle / pass event data */
-		ret = wlan_11h_handle_event_chanrpt_ready(pmpriv, pevent,
-							  &radar_chan, 0);
+		ret = wlan_11h_handle_event_chanrpt_ready(
+			pmpriv, pevent, &radar_chan, &bandwidth);
 		/* Also send this event as passthru */
 		pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
 		pevent->event_len = pmbuf->data_len;
@@ -1370,14 +1370,37 @@ mlan_status wlan_ops_sta_process_event(t_void *priv)
 		pevent->bss_index = pmpriv->bss_index;
 		pevent->event_id = MLAN_EVENT_ID_FW_ROAM_OFFLOAD_RESULT;
 		/** Drop event id length and 2 bytes reverved length*/
-		pevent->event_len = pmbuf->data_len - sizeof(eventcause) - 2;
-		memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
-			   pmadapter->event_body + 2, pevent->event_len,
-			   pevent->event_len);
-		wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		if ((pmbuf->data_len - sizeof(eventcause)) > 2) {
+			pevent->event_len =
+				pmbuf->data_len - sizeof(eventcause) - 2;
+			memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
+				   pmadapter->event_body + 2, pevent->event_len,
+				   pevent->event_len);
+			wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		} else {
+			PRINTM(MERROR,
+			       "EVENT: ERR:: ROAM OFFLOAD IN FW has invalid length\n");
+		}
 		break;
 	case EVENT_CLOUD_KEEP_ALIVE_RETRY_FAIL:
 		break;
+	case EVENT_WLS_FTM_COMPLETE:
+		PRINTM(MEVENT, "EVENT: FTM_GENERIC_EVENT\n");
+		pevent->bss_index = pmpriv->bss_index;
+		event_ftm =
+			(Event_WLS_FTM_t *)(pmbuf->pbuf + pmbuf->data_offset);
+		if (event_ftm->sub_event_id == WLS_SUB_EVENT_RTT_RESULTS)
+			wlan_fill_hal_rtt_results(pmpriv, event_ftm,
+						  pmbuf->data_len, pevent);
+		else {
+			pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
+			pevent->event_len = pmbuf->data_len;
+			memcpy_ext(pmadapter, (t_u8 *)pevent->event_buf,
+				   pmbuf->pbuf + pmbuf->data_offset,
+				   pevent->event_len, pevent->event_len);
+		}
+		wlan_recv_event(pmpriv, pevent->event_id, pevent);
+		break;
 	case EVENT_VDLL_IND:
 		wlan_process_vdll_event(pmpriv, pmbuf);
 		break;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
index 8639106..8959f6a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
@@ -3,7 +3,7 @@
  *  @brief This file contains the functions for station ioctl.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -428,6 +428,8 @@ static mlan_status wlan_get_info_ioctl(pmlan_adapter pmadapter,
 			pmadapter->getlog_enable;
 		pget_info->param.fw_info.hw_dev_mcs_support =
 			pmadapter->hw_dev_mcs_support;
+		pget_info->param.fw_info.hw_mpdu_density =
+			pmadapter->hw_mpdu_density;
 		pget_info->param.fw_info.hw_dot_11n_dev_cap =
 			pmadapter->hw_dot_11n_dev_cap;
 		pget_info->param.fw_info.usr_dev_mcs_support =
@@ -467,6 +469,8 @@ static mlan_status wlan_get_info_ioctl(pmlan_adapter pmadapter,
 									0x00;
 		pget_info->param.fw_info.fw_beacon_prot =
 			IS_FW_SUPPORT_BEACON_PROT(pmadapter) ? 0x01 : 0x00;
+		pget_info->param.fw_info.rtt_support =
+			IS_FW_SUPPORT_RTT(pmadapter) ? 0x01 : 0x00;
 		break;
 	case MLAN_OID_GET_BSS_INFO:
 		status = wlan_get_info_bss_info(pmadapter, pioctl_req);
@@ -1356,7 +1360,6 @@ static mlan_status wlan_query_passphrase(mlan_private *priv,
 		LEAVE();
 		return ret;
 	}
-	memset(pmadapter, sec, 0, sizeof(mlan_ds_sec_cfg));
 	sec_pp = (mlan_ds_passphrase *)&sec->param.passphrase;
 	sec_pp->psk_type = MLAN_PSK_QUERY;
 	if (ssid_bssid->ssid.ssid_len == 0) {
@@ -1772,7 +1775,6 @@ static mlan_status wlan_power_ioctl_set_power(pmlan_adapter pmadapter,
 		ret = MLAN_STATUS_FAILURE;
 		goto exit;
 	}
-	memset(pmadapter, buf, 0, MRVDRV_SIZE_OF_CMD_BUFFER);
 	txp_cfg = (HostCmd_DS_TXPWR_CFG *)buf;
 	txp_cfg->action = HostCmd_ACT_GEN_SET;
 	if (!power->param.power_cfg.is_power_auto) {
@@ -1867,7 +1869,6 @@ static mlan_status wlan_power_ioctl_set_power_ext(pmlan_adapter pmadapter,
 		ret = MLAN_STATUS_FAILURE;
 		goto exit;
 	}
-	memset(pmadapter, buf, 0, MRVDRV_SIZE_OF_CMD_BUFFER);
 	txp_cfg = (HostCmd_DS_TXPWR_CFG *)buf;
 	txp_cfg->action = HostCmd_ACT_GEN_SET;
 	pwr_grp = &power->param.power_ext.power_group[0];
@@ -5007,6 +5008,48 @@ static mlan_status wlan_misc_cloud_keep_alive(pmlan_adapter pmadapter,
 	return ret;
 }
 
+/**
+ *  @brief cloud keep alive rx
+ *
+ *  @param pmadapter    A pointer to mlan_adapter structure
+ *  @param pioctl_req   Pointer to the IOCTL request buffer
+ *
+ *  @return             MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
+ */
+static mlan_status wlan_misc_cloud_keep_alive_rx(pmlan_adapter pmadapter,
+						 mlan_ioctl_req *pioctl_req)
+{
+	pmlan_private pmpriv = pmadapter->priv[pioctl_req->bss_index];
+	mlan_ds_misc_cfg *misc = MNULL;
+	t_u16 cmd_action = 0;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	misc = (mlan_ds_misc_cfg *)pioctl_req->pbuf;
+
+	if (pioctl_req->action == MLAN_ACT_SET)
+		cmd_action = HostCmd_ACT_GEN_SET;
+	else if (pioctl_req->action == MLAN_ACT_GET) {
+		cmd_action = HostCmd_ACT_GEN_GET;
+	} else if (pioctl_req->action == MLAN_ACT_RESET) {
+		cmd_action = HostCmd_ACT_GEN_RESET;
+	} else {
+		cmd_action = HostCmd_ACT_GEN_REMOVE;
+	}
+
+	/* Send request to firmware */
+	ret = wlan_prepare_cmd(pmpriv, HostCmd_CMD_AUTO_TX, cmd_action,
+			       OID_CLOUD_KEEP_ALIVE_ACK, (t_void *)pioctl_req,
+			       &misc->param.keep_alive_rx);
+
+	if (ret == MLAN_STATUS_SUCCESS)
+		ret = MLAN_STATUS_PENDING;
+
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Miscellaneous configuration handler
  *
@@ -5224,6 +5267,10 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 	case MLAN_OID_MISC_GET_TSF:
 		status = wlan_misc_ioctl_get_tsf(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_CROSS_CHIP_SYNCH:
+		status =
+			wlan_misc_ioctl_cross_chip_synch(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_ROAM_OFFLOAD:
 		status = wlan_misc_roam_offload(pmadapter, pioctl_req);
 		break;
@@ -5236,6 +5283,9 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 	case MLAN_OID_MISC_CLOUD_KEEP_ALIVE:
 		status = wlan_misc_cloud_keep_alive(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX:
+		status = wlan_misc_cloud_keep_alive_rx(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_DYN_BW:
 		status = wlan_misc_ioctl_dyn_bw(pmadapter, pioctl_req);
 		break;
@@ -5251,6 +5301,15 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 	case MLAN_OID_MISC_DMCS_CONFIG:
 		status = wlan_misc_dmcs_config(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_CONFIG_RTT:
+		status = wlan_config_rtt(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_CANCEL_RTT:
+		status = wlan_cancel_rtt(pmadapter, pioctl_req);
+		break;
+	case MLAN_OID_MISC_RTT_RESPONDER_CFG:
+		status = wlan_rtt_responder_cfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_GET_TX_RX_HISTOGRAM:
 		status = wlan_get_tx_rx_histogram(pmadapter, pioctl_req);
 		break;
@@ -5283,6 +5342,9 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 	case MLAN_OID_MISC_RX_ABORT_CFG:
 		status = wlan_misc_ioctl_rxabortcfg(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_MISC_OFDM_DESENSE_CFG:
+		status = wlan_misc_ioctl_ofdmdesense_cfg(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_RX_ABORT_CFG_EXT:
 		status = wlan_misc_ioctl_rxabortcfg_ext(pmadapter, pioctl_req);
 		break;
@@ -5319,6 +5381,9 @@ static mlan_status wlan_misc_cfg_ioctl(pmlan_adapter pmadapter,
 	case MLAN_OID_MISC_RANGE_EXT:
 		status = wlan_misc_ioctl_range_ext(pmadapter, pioctl_req);
 		break;
+	case MLAN_OID_11AX_TWT_CFG:
+		status = wlan_misc_ioctl_twt_report(pmadapter, pioctl_req);
+		break;
 	case MLAN_OID_MISC_TP_STATE:
 		status = wlan_misc_ioctl_tp_state(pmadapter, pioctl_req);
 		break;
@@ -5527,10 +5592,20 @@ start_config:
 				pioctl_req->data_read_written =
 					sizeof(mlan_scan_resp) +
 					MLAN_SUB_COMMAND_SIZE;
-				pscan->param.scan_resp.pchan_stats =
-					(t_u8 *)pmadapter->pchan_stats;
-				pscan->param.scan_resp.num_in_chan_stats =
-					pmadapter->num_in_chan_stats;
+				if (pmadapter->scan_processing) {
+					pscan->param.scan_resp.pchan_stats =
+						(t_u8 *)pmadapter
+							->pold_chan_stats;
+					pscan->param.scan_resp
+						.num_in_chan_stats =
+						pmadapter->old_idx_chan_stats;
+				} else {
+					pscan->param.scan_resp.pchan_stats =
+						(t_u8 *)pmadapter->pchan_stats;
+					pscan->param.scan_resp
+						.num_in_chan_stats =
+						pmadapter->idx_chan_stats;
+				}
 			}
 		}
 	}
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c
index bb9920a..5e49e0a 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_rx.c
@@ -408,6 +408,8 @@ void wlan_rxpdinfo_to_radiotapinfo(pmlan_private priv, RxPD *prx_pd,
 	t_u8 gi = 0;
 	t_u8 ldpc = 0;
 	t_u8 ext_rate_info = 0;
+	t_u8 nss = 0;
+	t_u8 dcm = 0;
 
 	memset(priv->adapter, &rt_info_tmp, 0x00, sizeof(rt_info_tmp));
 	rt_info_tmp.snr = prx_pd->snr;
@@ -418,10 +420,25 @@ void wlan_rxpdinfo_to_radiotapinfo(pmlan_private priv, RxPD *prx_pd,
 
 	rt_info_tmp.antenna = prx_pd->antenna;
 	rx_rate_info = prx_pd->rate_info;
-	if ((rx_rate_info & 0x3) == MLAN_RATE_FORMAT_VHT) {
+	if ((rx_rate_info & 0x3) == MLAN_RATE_FORMAT_HE) {
+		t_u8 gi_he = 0;
+		/* HE rate */
+		format = MLAN_RATE_FORMAT_HE;
+		mcs_index = MIN(prx_pd->rx_rate & 0xF, 0xb);
+		nss = ((prx_pd->rx_rate & 0xF0) >> 4);
+		nss = MIN(nss + 1, 2);
+		/* 20M: bw=0, 40M: bw=1, 80M: bw=2, 160M: bw=3 */
+		bw = (rx_rate_info & 0xC) >> 2;
+		gi = (rx_rate_info & 0x10) >> 4;
+		gi_he = (rx_rate_info & 0x80) >> 7;
+		gi = gi | gi_he;
+		dcm = (prx_pd->rx_info & RXPD_DCM_MASK) >> 16;
+	} else if ((rx_rate_info & 0x3) == MLAN_RATE_FORMAT_VHT) {
 		/* VHT rate */
 		format = MLAN_RATE_FORMAT_VHT;
 		mcs_index = MIN(prx_pd->rx_rate & 0xF, 9);
+		nss = ((prx_pd->rx_rate & 0xF0) >> 4);
+		nss = MIN(nss + 1, 2);
 		/* 20M: bw=0, 40M: bw=1, 80M: bw=2, 160M: bw=3 */
 		bw = (rx_rate_info & 0xC) >> 2;
 		/* LGI: gi =0, SGI: gi = 1 */
@@ -444,8 +461,14 @@ void wlan_rxpdinfo_to_radiotapinfo(pmlan_private priv, RxPD *prx_pd,
 	ldpc = rx_rate_info & 0x40;
 
 	rt_info_tmp.rate_info.mcs_index = mcs_index;
-	rt_info_tmp.rate_info.rate_info =
-		(ldpc << 5) | (format << 3) | (bw << 1) | gi;
+	rt_info_tmp.rate_info.nss_index = nss;
+	rt_info_tmp.rate_info.dcm = dcm;
+	if (format == MLAN_RATE_FORMAT_HE) {
+		rt_info_tmp.rate_info.rate_info =
+			(ldpc << 5) | (format << 3) | (bw << 1) | (gi << 6);
+	} else
+		rt_info_tmp.rate_info.rate_info =
+			(ldpc << 5) | (format << 3) | (bw << 1) | gi;
 	rt_info_tmp.rate_info.bitrate =
 		wlan_index_to_data_rate(priv->adapter, prx_pd->rx_rate,
 					prx_pd->rate_info, ext_rate_info);
@@ -683,6 +706,14 @@ mlan_status wlan_ops_sta_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	RxPD *prx_pd;
 	RxPacketHdr_t *prx_pkt;
+	RxPD *prx_pd2;
+	EthII_Hdr_t *peth_hdr2;
+	wlan_802_11_header *pwlan_hdr;
+	IEEEtypes_FrameCtl_t *frmctl;
+	pmlan_buffer pmbuf2 = MNULL;
+	mlan_802_11_mac_addr src_addr, dest_addr;
+	t_u16 hdr_len;
+	t_u8 snap_eth_hdr[5] = {0xaa, 0xaa, 0x03, 0x00, 0x00};
 	pmlan_private priv = pmadapter->priv[pmbuf->bss_index];
 	t_u8 ta[MLAN_MAC_ADDR_LENGTH];
 	t_u16 rx_pkt_type = 0;
@@ -761,6 +792,112 @@ mlan_status wlan_ops_sta_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 		}
 	}
 
+	if (pmadapter->enable_net_mon &&
+	    (prx_pd->flags & RXPD_FLAG_UCAST_PKT)) {
+		pwlan_hdr = (wlan_802_11_header *)((t_u8 *)prx_pd +
+						   prx_pd->rx_pkt_offset);
+		frmctl = (IEEEtypes_FrameCtl_t *)pwlan_hdr;
+		if (frmctl->type == 0x02) {
+			/* This is a valid unicast destined data packet, with
+			 * 802.11 and rtap headers attached. Duplicate this
+			 * packet and process this copy as a sniffed packet,
+			 * meant for monitor iface
+			 */
+			pmbuf2 = wlan_alloc_mlan_buffer(pmadapter,
+							pmbuf->data_len,
+							MLAN_RX_HEADER_LEN,
+							MOAL_ALLOC_MLAN_BUFFER);
+			if (!pmbuf2) {
+				PRINTM(MERROR,
+				       "Unable to allocate mlan_buffer for Rx");
+				PRINTM(MERROR, "sniffed packet\n");
+			} else {
+				pmbuf2->bss_index = pmbuf->bss_index;
+				pmbuf2->buf_type = pmbuf->buf_type;
+				pmbuf2->priority = pmbuf->priority;
+				pmbuf2->in_ts_sec = pmbuf->in_ts_sec;
+				pmbuf2->in_ts_usec = pmbuf->in_ts_usec;
+				pmbuf2->data_len = pmbuf->data_len;
+				memcpy(pmadapter,
+				       pmbuf2->pbuf + pmbuf2->data_offset,
+				       pmbuf->pbuf + pmbuf->data_offset,
+				       pmbuf->data_len);
+
+				prx_pd2 = (RxPD *)(pmbuf2->pbuf +
+						   pmbuf2->data_offset);
+				/* set pkt type of duplicated pkt to 802.11 */
+				prx_pd2->rx_pkt_type = PKT_TYPE_802DOT11;
+				wlan_process_rx_packet(pmadapter, pmbuf2);
+			}
+
+			/* Now, process this pkt as a normal data packet.
+			 * rx_pkt_offset points to the 802.11 hdr. Construct
+			 * 802.3 header from 802.11 hdr fields and attach it
+			 * just before the payload.
+			 */
+			memcpy(pmadapter, (t_u8 *)&dest_addr, pwlan_hdr->addr1,
+			       sizeof(pwlan_hdr->addr1));
+			memcpy(pmadapter, (t_u8 *)&src_addr, pwlan_hdr->addr2,
+			       sizeof(pwlan_hdr->addr2));
+
+			hdr_len = sizeof(wlan_802_11_header);
+
+			/* subtract mac addr field size for 3 address mac80211
+			 * header */
+			if (!(frmctl->from_ds && frmctl->to_ds))
+				hdr_len -= sizeof(mlan_802_11_mac_addr);
+
+			/* add 2 bytes of qos ctrl flags */
+			if (frmctl->sub_type & QOS_DATA)
+				hdr_len += 2;
+
+			if (prx_pd->rx_pkt_type == PKT_TYPE_AMSDU) {
+				/* no need to generate 802.3 hdr, update pkt
+				 * offset */
+				prx_pd->rx_pkt_offset += hdr_len;
+				prx_pd->rx_pkt_length -= hdr_len;
+			} else {
+				/* skip 6-byte snap and 2-byte type */
+				if (memcmp(pmadapter,
+					   (t_u8 *)pwlan_hdr + hdr_len,
+					   snap_eth_hdr,
+					   sizeof(snap_eth_hdr)) == 0)
+					hdr_len += 8;
+
+				peth_hdr2 =
+					(EthII_Hdr_t *)((t_u8 *)prx_pd +
+							prx_pd->rx_pkt_offset +
+							hdr_len -
+							sizeof(EthII_Hdr_t));
+				memcpy(pmadapter, peth_hdr2->dest_addr,
+				       (t_u8 *)&dest_addr,
+				       sizeof(peth_hdr2->dest_addr));
+				memcpy(pmadapter, peth_hdr2->src_addr,
+				       (t_u8 *)&src_addr,
+				       sizeof(peth_hdr2->src_addr));
+
+				/* Update the rx_pkt_offset to point the 802.3
+				 * hdr */
+				prx_pd->rx_pkt_offset +=
+					(hdr_len - sizeof(EthII_Hdr_t));
+				prx_pd->rx_pkt_length -=
+					(hdr_len - sizeof(EthII_Hdr_t));
+			}
+			/* update the prx_pkt pointer */
+			prx_pkt = (RxPacketHdr_t *)((t_u8 *)prx_pd +
+						    prx_pd->rx_pkt_offset);
+		} else {
+			pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
+			ret = MLAN_STATUS_FAILURE;
+			PRINTM(MERROR,
+			       "Drop invalid unicast sniffer pkt, subType=0x%x, flag=0x%x, pkt_type=%d\n",
+			       frmctl->sub_type, prx_pd->flags,
+			       prx_pd->rx_pkt_type);
+			wlan_free_mlan_buffer(pmadapter, pmbuf);
+			goto done;
+		}
+	}
+
 	/*
 	 * If the packet is not an unicast packet then send the packet
 	 * directly to os. Don't pass thru rx reordering
@@ -815,9 +952,14 @@ mlan_status wlan_ops_sta_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 	}
 	if ((priv->port_ctrl_mode == MTRUE && priv->port_open == MFALSE) &&
 	    (rx_pkt_type != PKT_TYPE_BAR)) {
-		mlan_11n_rxreorder_pkt(priv, prx_pd->seq_num, prx_pd->priority,
-				       ta, (t_u8)prx_pd->rx_pkt_type,
-				       (t_void *)RX_PKT_DROPPED_IN_FW);
+		if (MLAN_STATUS_SUCCESS !=
+		    mlan_11n_rxreorder_pkt(priv, prx_pd->seq_num,
+					   prx_pd->priority, ta,
+					   (t_u8)prx_pd->rx_pkt_type,
+					   (t_void *)RX_PKT_DROPPED_IN_FW))
+			PRINTM(MINFO, "RX pkt reordering failure seq_num:%d\n",
+			       prx_pd->seq_num);
+
 		if (rx_pkt_type == PKT_TYPE_AMSDU) {
 			pmbuf->data_len = prx_pd->rx_pkt_length;
 			pmbuf->data_offset += prx_pd->rx_pkt_offset;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
index 8f2b0ef..12cc203 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
@@ -3,7 +3,7 @@
  *  @brief This file contains the handling of AP mode command and event
  *
  *
- *  Copyright 2009-2022 NXP
+ *  Copyright 2009-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -713,11 +713,7 @@ static mlan_status wlan_uap_cmd_ap_config(pmlan_private pmpriv,
 	t_u8 zero_mac[] = {0, 0, 0, 0, 0, 0};
 	t_u16 i;
 	t_u16 ac;
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 	int rx_mcs_supp = 0;
-#endif
 
 	ENTER();
 	if (pioctl_buf == MNULL) {
@@ -1344,11 +1340,8 @@ static mlan_status wlan_uap_cmd_ap_config(pmlan_private pmpriv,
 		memcpy_ext(pmpriv->adapter, tlv_htcap->ht_cap.supported_mcs_set,
 			   bss->param.bss_config.supported_mcs_set, 16,
 			   sizeof(tlv_htcap->ht_cap.supported_mcs_set));
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(SD9097) || defined(USB9097) ||            \
-	defined(SDNW62X) || defined(PCIENW62X) || defined(USBNW62X)
 		if (IS_CARD9098(pmpriv->adapter->card_type) ||
-		    IS_CARDNW62X(pmpriv->adapter->card_type) ||
+		    IS_CARDIW62X(pmpriv->adapter->card_type) ||
 		    IS_CARD9097(pmpriv->adapter->card_type)) {
 			if (bss->param.bss_config.supported_mcs_set[0]) {
 				if (bss->param.bss_config.bandcfg.chanBand ==
@@ -1373,7 +1366,6 @@ static mlan_status wlan_uap_cmd_ap_config(pmlan_private pmpriv,
 				}
 			}
 		}
-#endif
 		tlv_htcap->ht_cap.ht_ext_cap =
 			wlan_cpu_to_le16(bss->param.bss_config.ht_ext_cap);
 		tlv_htcap->ht_cap.tx_bf_cap =
@@ -1462,7 +1454,7 @@ static mlan_status wlan_uap_cmd_ap_config(pmlan_private pmpriv,
 			wlan_cpu_to_le16(sizeof(MrvlIEtypes_preamble_t) -
 					 sizeof(MrvlIEtypesHeader_t));
 		tlv_preamble->preamble_type =
-			wlan_cpu_to_le16(bss->param.bss_config.preamble_type);
+			bss->param.bss_config.preamble_type;
 
 		cmd_size += sizeof(MrvlIEtypes_preamble_t);
 		tlv += sizeof(MrvlIEtypes_preamble_t);
@@ -1845,8 +1837,7 @@ static mlan_status wlan_uap_cmd_sys_configure(pmlan_private pmpriv,
 						  sys_config->tlv_buffer;
 			tlv_chan_switch->header.type = wlan_cpu_to_le16(
 				MRVL_ACTION_CHAN_SWITCH_ANNOUNCE);
-			// mode reserve for future use
-			tlv_chan_switch->mode = 0;
+			tlv_chan_switch->mode = bss->param.chanswitch.mode;
 			tlv_chan_switch->num_pkt =
 				bss->param.chanswitch.chan_switch_count;
 			if (bss->param.chanswitch.new_oper_class) {
@@ -2697,7 +2688,9 @@ static mlan_status wlan_uap_ret_sys_config(pmlan_private pmpriv,
 							.center_chan =
 							wlan_get_center_freq_idx(
 								pmpriv,
-								BAND_AAC,
+								chan_band_tlv
+									->bandcfg
+									.chanBand,
 								chan_band_tlv
 									->channel,
 								CHANNEL_BW_80MHZ);
@@ -3593,6 +3586,59 @@ static mlan_status wlan_uap_cmd_key_material(pmlan_private pmpriv,
 	pkey_material->key_param_set.key_info |= KEY_INFO_DEFAULT_KEY;
 	pkey_material->key_param_set.key_info =
 		wlan_cpu_to_le16(pkey_material->key_param_set.key_info);
+	if (pkey->key_flags & KEY_FLAG_GCMP ||
+	    pkey->key_flags & KEY_FLAG_GCMP_256) {
+		if (pkey->key_flags &
+		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID)) {
+			memcpy_ext(
+				pmpriv->adapter,
+				pkey_material->key_param_set.key_params.gcmp.pn,
+				pkey->pn, SEQ_MAX_SIZE, WPA_PN_SIZE);
+		}
+		if (pkey->key_flags & KEY_FLAG_GCMP)
+			pkey_material->key_param_set.key_type =
+				KEY_TYPE_ID_GCMP;
+		else
+			pkey_material->key_param_set.key_type =
+				KEY_TYPE_ID_GCMP_256;
+		pkey_material->key_param_set.key_params.gcmp.key_len =
+			wlan_cpu_to_le16(pkey->key_len);
+		memcpy_ext(pmpriv->adapter,
+			   pkey_material->key_param_set.key_params.gcmp.key,
+			   pkey->key_material, pkey->key_len, WPA_GCMP_KEY_LEN);
+		pkey_material->key_param_set.length = wlan_cpu_to_le16(
+			KEY_PARAMS_FIXED_LEN + sizeof(gcmp_param));
+		cmd->size = wlan_cpu_to_le16(sizeof(MrvlIEtypesHeader_t) +
+					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
+					     sizeof(gcmp_param) +
+					     sizeof(pkey_material->action));
+		PRINTM(MCMND, "Set GCMP Key\n");
+		goto done;
+	}
+	if (pkey->key_flags & KEY_FLAG_CCMP_256) {
+		if (pkey->key_flags &
+		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID)) {
+			memcpy_ext(pmpriv->adapter,
+				   pkey_material->key_param_set.key_params
+					   .ccmp256.pn,
+				   pkey->pn, SEQ_MAX_SIZE, WPA_PN_SIZE);
+		}
+		pkey_material->key_param_set.key_type = KEY_TYPE_ID_CCMP_256;
+		pkey_material->key_param_set.key_params.ccmp256.key_len =
+			wlan_cpu_to_le16(pkey->key_len);
+		memcpy_ext(pmpriv->adapter,
+			   pkey_material->key_param_set.key_params.ccmp256.key,
+			   pkey->key_material, pkey->key_len,
+			   WPA_CCMP_256_KEY_LEN);
+		pkey_material->key_param_set.length = wlan_cpu_to_le16(
+			KEY_PARAMS_FIXED_LEN + sizeof(ccmp_256_param));
+		cmd->size = wlan_cpu_to_le16(sizeof(MrvlIEtypesHeader_t) +
+					     S_DS_GEN + KEY_PARAMS_FIXED_LEN +
+					     sizeof(ccmp_256_param) +
+					     sizeof(pkey_material->action));
+		PRINTM(MCMND, "Set CCMP256 Key\n");
+		goto done;
+	}
 	if (pkey->key_len == WPA_AES_KEY_LEN &&
 	    !(pkey->key_flags & KEY_FLAG_AES_MCAST_IGTK)) {
 		if (pkey->key_flags &
@@ -3657,7 +3703,7 @@ static mlan_status wlan_uap_cmd_key_material(pmlan_private pmpriv,
 		    (KEY_FLAG_RX_SEQ_VALID | KEY_FLAG_TX_SEQ_VALID))
 			memcpy_ext(pmpriv->adapter,
 				   pkey_material->key_param_set.key_params
-					   .cmac_aes.ipn,
+					   .gmac_aes.ipn,
 				   pkey->pn, SEQ_MAX_SIZE, IGTK_PN_SIZE);
 		pkey_material->key_param_set.key_info &=
 			~(wlan_cpu_to_le16(KEY_INFO_MCAST_KEY));
@@ -3665,10 +3711,10 @@ static mlan_status wlan_uap_cmd_key_material(pmlan_private pmpriv,
 			wlan_cpu_to_le16(KEY_INFO_AES_MCAST_IGTK);
 		pkey_material->key_param_set.key_type =
 			KEY_TYPE_ID_BIP_GMAC_256;
-		pkey_material->key_param_set.key_params.cmac_aes.key_len =
+		pkey_material->key_param_set.key_params.gmac_aes.key_len =
 			wlan_cpu_to_le16(pkey->key_len);
 		memcpy_ext(pmpriv->adapter,
-			   pkey_material->key_param_set.key_params.cmac_aes.key,
+			   pkey_material->key_param_set.key_params.gmac_aes.key,
 			   pkey->key_material, pkey->key_len,
 			   WPA_IGTK_256_KEY_LEN);
 		pkey_material->key_param_set.length = wlan_cpu_to_le16(
@@ -3893,8 +3939,9 @@ static void wlan_check_uap_capability(pmlan_private priv, pmlan_buffer pevent)
 			priv->uap_bandwidth = pchan_info->bandcfg.chanWidth;
 			priv->uap_state_chan_cb.channel = pchan_info->channel;
 			priv->uap_state_chan_cb.bandcfg = pchan_info->bandcfg;
-			PRINTM(MCMND, "uap_channel FW: 0x%x bw=%d\n",
-			       priv->uap_channel, priv->uap_bandwidth);
+			PRINTM(MCMND, "uap_channel FW: 0x%x band=%d bw=%d\n",
+			       priv->uap_channel, pchan_info->bandcfg.chanBand,
+			       priv->uap_bandwidth);
 			event->bss_index = priv->bss_index;
 			event->event_id = MLAN_EVENT_ID_DRV_UAP_CHAN_INFO;
 			event->event_len = sizeof(chan_band_info);
@@ -3903,11 +3950,10 @@ static void wlan_check_uap_capability(pmlan_private priv, pmlan_buffer pevent)
 				   (t_u8 *)&pchan_info->bandcfg, tlv_len,
 				   tlv_len);
 			if (pchan_band_info->bandcfg.chanWidth == CHAN_BW_80MHZ)
-				pchan_band_info->center_chan =
-					wlan_get_center_freq_idx(
-						priv, BAND_AAC,
-						pchan_info->channel,
-						CHANNEL_BW_80MHZ);
+				pchan_band_info
+					->center_chan = wlan_get_center_freq_idx(
+					priv, pchan_band_info->bandcfg.chanBand,
+					pchan_info->channel, CHANNEL_BW_80MHZ);
 			if (priv->adapter->ecsa_enable) {
 				int ret;
 				t_u8 bandwidth = BW_20MHZ;
@@ -4709,6 +4755,14 @@ mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = MLAN_STATUS_SUCCESS;
 		break;
 #endif
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_cmd_802_11_ftm_config_session_params(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_cmd_802_11_ftm_config_responder(
+			pmpriv, cmd_ptr, cmd_action, cmd_oid, pdata_buf);
+		break;
 	case HostCmd_CMD_VERSION_EXT:
 		cmd_ptr->command = wlan_cpu_to_le16(cmd_no);
 		cmd_ptr->params.verext.version_str_sel =
@@ -4722,7 +4776,7 @@ mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		cmd_ptr->params.rx_mgmt_ind.action =
 			wlan_cpu_to_le16(cmd_action);
 		cmd_ptr->params.rx_mgmt_ind.mgmt_subtype_mask =
-			(t_u32)(*((t_u32 *)pdata_buf));
+			wlan_cpu_to_le32((t_u32)(*((t_u32 *)pdata_buf)));
 		cmd_ptr->size = wlan_cpu_to_le16(
 			sizeof(HostCmd_DS_RX_MGMT_IND) + S_DS_GEN);
 		break;
@@ -4885,6 +4939,10 @@ mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_rxabortcfg(pmpriv, cmd_ptr, cmd_action,
 					  pdata_buf);
 		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_cmd_ofdmdesense_cfg(pmpriv, cmd_ptr, cmd_action,
+					       pdata_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_cmd_rxabortcfg_ext(pmpriv, cmd_ptr, cmd_action,
 					      pdata_buf);
@@ -4936,6 +4994,10 @@ mlan_status wlan_ops_uap_prepare_cmd(t_void *priv, t_u16 cmd_no,
 		ret = wlan_cmd_get_ch_load(pmpriv, cmd_ptr, cmd_action,
 					   pdata_buf);
 		break;
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_cmd_cross_chip_synch(pmpriv, cmd_ptr, cmd_action,
+						pdata_buf);
+		break;
 	case HostCmd_DS_GET_SENSOR_TEMP:
 		wlan_cmd_get_sensor_temp(pmpriv, cmd_ptr, cmd_action);
 		break;
@@ -4998,7 +5060,6 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 				pmpriv->adapter->pmoal_handle, &sec, &usec);
 			pstate_dfs->dfs_report_time_sec = sec;
 		}
-		wlan_reset_all_chan_dfs_state(priv, BAND_A, DFS_USABLE);
 		if (pmpriv->intf_state_11h.is_11h_host)
 			pmpriv->intf_state_11h.tx_disabled = MFALSE;
 		else {
@@ -5040,6 +5101,7 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 		AuthenitcatorInitBssConfig(pmpriv->psapriv);
 #endif
 		ret = wlan_uap_ret_sys_reset(pmpriv, resp, pioctl_buf);
+		wlan_reset_all_chan_dfs_state(priv, BAND_A, DFS_USABLE);
 		wlan_11h_check_update_radar_det_state(pmpriv);
 		wlan_coex_ampdu_rxwinsize(pmadapter);
 		break;
@@ -5173,6 +5235,14 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_TX_BF_CFG:
 		ret = wlan_ret_tx_bf_cfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_FTM_CONFIG_SESSION_PARAMS:
+		ret = wlan_ret_802_11_ftm_config_session_params(pmpriv, resp,
+								pioctl_buf);
+		break;
+	case HostCmd_CMD_FTM_CONFIG_RESPONDER:
+		ret = wlan_ret_802_11_ftm_config_responder(pmpriv, resp,
+							   pioctl_buf);
+		break;
 	case HostCmd_CMD_VERSION_EXT:
 		ret = wlan_ret_ver_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -5298,6 +5368,9 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_RX_ABORT_CFG:
 		ret = wlan_ret_rxabortcfg(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_OFDM_DESENSE_CFG:
+		ret = wlan_ret_ofdmdesense_cfg(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_CMD_RX_ABORT_CFG_EXT:
 		ret = wlan_ret_rxabortcfg_ext(pmpriv, resp, pioctl_buf);
 		break;
@@ -5341,6 +5414,9 @@ mlan_status wlan_ops_uap_process_cmdresp(t_void *priv, t_u16 cmdresp_no,
 	case HostCmd_CMD_GET_CH_LOAD:
 		ret = wlan_ret_ch_load(pmpriv, resp, pioctl_buf);
 		break;
+	case HostCmd_CMD_CROSS_CHIP_SYNCH:
+		ret = wlan_ret_cross_chip_synch(pmpriv, resp, pioctl_buf);
+		break;
 	case HostCmd_DS_GET_SENSOR_TEMP:
 		ret = wlan_ret_get_sensor_temp(pmpriv, resp, pioctl_buf);
 		break;
@@ -5380,6 +5456,7 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 	MrvlIEtypes_channel_band_t *pchan_info = MNULL;
 	chan_band_info *pchan_band_info = MNULL;
 	event_exceed_max_p2p_conn *event_excd_p2p = MNULL;
+	Event_WLS_FTM_t *event_ftm = MNULL;
 	t_u16 enable;
 
 	ENTER();
@@ -5457,8 +5534,10 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 		break;
 	case EVENT_PS_AWAKE:
 		PRINTM(MINFO, "EVENT: AWAKE\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "||");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "||");
+		else
+			PRINTM(MEVENT, "|");
 		/* Handle unexpected PS AWAKE event */
 		if (pmadapter->ps_state == PS_STATE_SLEEP_CFM)
 			break;
@@ -5469,8 +5548,10 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 		break;
 	case EVENT_PS_SLEEP:
 		PRINTM(MINFO, "EVENT: SLEEP\n");
-		PRINTM_NETINTF(MEVENT, pmpriv);
-		PRINTM(MEVENT, "__");
+		if (pmadapter->second_mac)
+			PRINTM(MEVENT, "__");
+		else
+			PRINTM(MEVENT, "_");
 		/* Handle unexpected PS SLEEP event */
 		if (pmadapter->ps_state == PS_STATE_SLEEP_CFM)
 			break;
@@ -5607,10 +5688,11 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 		if (pmpriv->adapter->dfs_test_params.cac_restart &&
 		    pmpriv->adapter->state_dfs.dfs_check_pending) {
 			wlan_11h_cancel_radar_detect(pmpriv);
-			wlan_11h_issue_radar_detect(
-				pmpriv, MNULL,
-				pmpriv->adapter->dfs_test_params.chan,
-				pmpriv->adapter->dfs_test_params.bandcfg);
+			if (wlan_11h_issue_radar_detect(
+				    pmpriv, MNULL,
+				    pmpriv->adapter->dfs_test_params.chan,
+				    pmpriv->adapter->dfs_test_params.bandcfg))
+				PRINTM(MINFO, "RADAR detect returned FALSE\n");
 			pevent->event_id = 0;
 			break;
 		}
@@ -5625,7 +5707,6 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 		wlan_recv_event(pmpriv, pevent->event_id, pevent);
 		pevent->event_id = 0; /* clear to avoid resending at end of fcn
 				       */
-
 		/* Print event data */
 		pevent->event_id = MLAN_EVENT_ID_FW_RADAR_DETECTED;
 		pevent->event_len = pmbuf->data_len - sizeof(eventcause);
@@ -5638,11 +5719,14 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 		*((t_u8 *)pevent->event_buf) = channel;
 		*((t_u8 *)pevent->event_buf + 1) = bandwidth;
 		if (pmpriv->bss_type == MLAN_BSS_TYPE_DFS) {
-			wlan_recv_event(priv, MLAN_EVENT_ID_FW_RADAR_DETECTED,
-					pevent);
-			pevent->event_id = 0; /* clear to avoid
-						 resending at end of fcn
-					       */
+			if (!pmpriv->adapter->dfs_test_params
+				     .no_channel_change_on_radar) {
+				wlan_recv_event(priv,
+						MLAN_EVENT_ID_FW_RADAR_DETECTED,
+						pevent);
+			}
+			pevent->event_id = 0; /* clear to avoid resending at end
+						 of fcn */
 			break;
 		}
 		if (!pmpriv->intf_state_11h.is_11h_host) {
@@ -5774,7 +5858,8 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 			if (pchan_band_info->bandcfg.chanWidth == CHAN_BW_80MHZ)
 				pchan_band_info->center_chan =
 					wlan_get_center_freq_idx(
-						priv, BAND_AAC,
+						priv,
+						pchan_info->bandcfg.chanBand,
 						pchan_info->channel,
 						CHANNEL_BW_80MHZ);
 			pchan_band_info->is_11n_enabled =
@@ -5837,6 +5922,22 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 		wlan_process_csi_event(pmpriv);
 		break;
 
+	case EVENT_WLS_FTM_COMPLETE:
+		PRINTM(MEVENT, "EVENT: FTM_GENERIC_EVENT\n");
+		pevent = (pmlan_event)event_buf;
+		pevent->bss_index = pmpriv->bss_index;
+		event_ftm =
+			(Event_WLS_FTM_t *)(pmbuf->pbuf + pmbuf->data_offset);
+		if (event_ftm->sub_event_id == WLS_SUB_EVENT_RTT_RESULTS) {
+			wlan_fill_hal_rtt_results(pmpriv, event_ftm,
+						  pmbuf->data_len, pevent);
+			wlan_recv_event(pmpriv, pevent->event_id, pevent);
+			pevent->event_id = 0; /* clear to avoid resending at end
+						 of fcn */
+			goto done;
+		} else
+			pevent->event_id = MLAN_EVENT_ID_DRV_PASSTHRU;
+		break;
 	case EVENT_FW_HANG_REPORT:
 		if (pmbuf->data_len < (sizeof(eventcause) + sizeof(t_u16))) {
 			PRINTM(MEVENT,
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
index 439dc01..acb1dc1 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_ioctl.c
@@ -2095,6 +2095,8 @@ mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 				pmadapter->getlog_enable;
 			pget_info->param.fw_info.hw_dev_mcs_support =
 				pmadapter->hw_dev_mcs_support;
+			pget_info->param.fw_info.hw_mpdu_density =
+				pmadapter->hw_mpdu_density;
 			pget_info->param.fw_info.hw_dot_11n_dev_cap =
 				pmadapter->hw_dot_11n_dev_cap;
 			pget_info->param.fw_info.usr_dev_mcs_support =
@@ -2242,6 +2244,10 @@ mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 								 pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_GET_TSF)
 			status = wlan_misc_ioctl_get_tsf(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_CROSS_CHIP_SYNCH) {
+			status = wlan_misc_ioctl_cross_chip_synch(pmadapter,
+								  pioctl_req);
+		}
 		if (misc->sub_command == MLAN_OID_MISC_GET_CHAN_REGION_CFG)
 			status = wlan_misc_chan_reg_cfg(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_OPER_CLASS_CHECK)
@@ -2264,6 +2270,9 @@ mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 		if (misc->sub_command == MLAN_OID_MISC_RX_ABORT_CFG)
 			status = wlan_misc_ioctl_rxabortcfg(pmadapter,
 							    pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_OFDM_DESENSE_CFG)
+			status = wlan_misc_ioctl_ofdmdesense_cfg(pmadapter,
+								 pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_RX_ABORT_CFG_EXT)
 			status = wlan_misc_ioctl_rxabortcfg_ext(pmadapter,
 								pioctl_req);
@@ -2285,6 +2294,12 @@ mlan_status wlan_ops_uap_ioctl(t_void *adapter, pmlan_ioctl_req pioctl_req)
 			status = wlan_misc_robustcoex(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_DMCS_CONFIG)
 			status = wlan_misc_dmcs_config(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_CONFIG_RTT)
+			status = wlan_config_rtt(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_CANCEL_RTT)
+			status = wlan_cancel_rtt(pmadapter, pioctl_req);
+		if (misc->sub_command == MLAN_OID_MISC_RTT_RESPONDER_CFG)
+			status = wlan_rtt_responder_cfg(pmadapter, pioctl_req);
 		if (misc->sub_command == MLAN_OID_MISC_GET_TX_RX_HISTOGRAM)
 			status =
 				wlan_get_tx_rx_histogram(pmadapter, pioctl_req);
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
index d2aaa9a..b68ae09 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_txrx.c
@@ -65,7 +65,13 @@ static mlan_status wlan_upload_uap_rx_packet(pmlan_adapter pmadapter,
 	prx_pd = (RxPD *)(pmbuf->pbuf + pmbuf->data_offset);
 
 	/* Chop off RxPD */
-	pmbuf->data_len -= prx_pd->rx_pkt_offset;
+	if (pmbuf->data_len > prx_pd->rx_pkt_offset) {
+		pmbuf->data_len -= prx_pd->rx_pkt_offset;
+	} else {
+		PRINTM(MERROR,
+		       "pmbuf->data_len is smaller than prx_pd->rx_pkt_offset\n");
+		pmbuf->status_code = MLAN_ERROR_PKT_INVALID;
+	}
 	pmbuf->data_offset += prx_pd->rx_pkt_offset;
 	pmbuf->pparent = MNULL;
 
@@ -89,7 +95,6 @@ static mlan_status wlan_upload_uap_rx_packet(pmlan_adapter pmadapter,
 		       "uAP Rx Error: moal_recv_packet returned error\n");
 		pmbuf->status_code = MLAN_ERROR_PKT_INVALID;
 	}
-
 	if (ret != MLAN_STATUS_PENDING)
 		pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
 #ifdef USB
@@ -344,6 +349,14 @@ mlan_status wlan_ops_uap_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 
 	t_u32 last_rx_sec = 0;
 	t_u32 last_rx_usec = 0;
+	RxPD *prx_pd2;
+	EthII_Hdr_t *peth_hdr2;
+	wlan_802_11_header *pwlan_hdr;
+	IEEEtypes_FrameCtl_t *frmctl;
+	pmlan_buffer pmbuf2 = MNULL;
+	mlan_802_11_mac_addr src_addr, dest_addr;
+	t_u16 hdr_len;
+	t_u8 snap_eth_hdr[5] = {0xaa, 0xaa, 0x03, 0x00, 0x00};
 	t_u8 ext_rate_info = 0;
 
 	ENTER();
@@ -420,6 +433,111 @@ mlan_status wlan_ops_uap_process_rx_packet(t_void *adapter, pmlan_buffer pmbuf)
 		pmadapter->ops.data_complete(pmadapter, pmbuf, ret);
 		goto done;
 	}
+	if (pmadapter->enable_net_mon &&
+	    (prx_pd->flags & RXPD_FLAG_UCAST_PKT)) {
+		pwlan_hdr = (wlan_802_11_header *)((t_u8 *)prx_pd +
+						   prx_pd->rx_pkt_offset);
+		frmctl = (IEEEtypes_FrameCtl_t *)pwlan_hdr;
+		if (frmctl->type == 0x02) {
+			/* This is a valid unicast destined data packet, with
+			 * 802.11 and rtap headers attached. Duplicate this
+			 * packet and process this copy as a sniffed packet,
+			 * meant for monitor iface
+			 */
+			pmbuf2 = wlan_alloc_mlan_buffer(pmadapter,
+							MLAN_RX_DATA_BUF_SIZE,
+							MLAN_RX_HEADER_LEN,
+							MOAL_ALLOC_MLAN_BUFFER);
+			if (!pmbuf2) {
+				PRINTM(MERROR,
+				       "Unable to allocate mlan_buffer for Rx");
+				PRINTM(MERROR, "sniffed packet\n");
+			} else {
+				pmbuf2->bss_index = pmbuf->bss_index;
+				pmbuf2->buf_type = pmbuf->buf_type;
+				pmbuf2->priority = pmbuf->priority;
+				pmbuf2->in_ts_sec = pmbuf->in_ts_sec;
+				pmbuf2->in_ts_usec = pmbuf->in_ts_usec;
+				pmbuf2->data_len = pmbuf->data_len;
+				memcpy(pmadapter,
+				       pmbuf2->pbuf + pmbuf2->data_offset,
+				       pmbuf->pbuf + pmbuf->data_offset,
+				       pmbuf->data_len);
+
+				prx_pd2 = (RxPD *)(pmbuf2->pbuf +
+						   pmbuf2->data_offset);
+				/* set pkt type of duplicated pkt to 802.11 */
+				prx_pd2->rx_pkt_type = PKT_TYPE_802DOT11;
+				wlan_process_uap_rx_packet(priv, pmbuf2);
+			}
+
+			/* Now, process this pkt as a normal data packet.
+			 * rx_pkt_offset points to the 802.11 hdr. Construct
+			 * 802.3 header from 802.11 hdr fields and attach it
+			 * just before the payload.
+			 */
+			memcpy(pmadapter, (t_u8 *)&dest_addr, pwlan_hdr->addr1,
+			       sizeof(pwlan_hdr->addr1));
+			memcpy(pmadapter, (t_u8 *)&src_addr, pwlan_hdr->addr2,
+			       sizeof(pwlan_hdr->addr2));
+
+			hdr_len = sizeof(wlan_802_11_header);
+
+			/* subtract mac addr field size for 3 address mac80211
+			 * header */
+			if (!(frmctl->from_ds && frmctl->to_ds))
+				hdr_len -= sizeof(mlan_802_11_mac_addr);
+
+			/* add 2 bytes of qos ctrl flags */
+			if (frmctl->sub_type & QOS_DATA)
+				hdr_len += 2;
+
+			if (prx_pd->rx_pkt_type == PKT_TYPE_AMSDU) {
+				/* no need to generate 802.3 hdr, update pkt
+				 * offset */
+				prx_pd->rx_pkt_offset += hdr_len;
+				prx_pd->rx_pkt_length -= hdr_len;
+			} else {
+				/* skip 6-byte snap and 2-byte type */
+				if (memcmp(pmadapter,
+					   (t_u8 *)pwlan_hdr + hdr_len,
+					   snap_eth_hdr,
+					   sizeof(snap_eth_hdr)) == 0)
+					hdr_len += 8;
+
+				peth_hdr2 =
+					(EthII_Hdr_t *)((t_u8 *)prx_pd +
+							prx_pd->rx_pkt_offset +
+							hdr_len -
+							sizeof(EthII_Hdr_t));
+				memcpy(pmadapter, peth_hdr2->dest_addr,
+				       (t_u8 *)&dest_addr,
+				       sizeof(peth_hdr2->dest_addr));
+				memcpy(pmadapter, peth_hdr2->src_addr,
+				       (t_u8 *)&src_addr,
+				       sizeof(peth_hdr2->src_addr));
+
+				/* Update the rx_pkt_offset to point the 802.3
+				 * hdr */
+				prx_pd->rx_pkt_offset +=
+					(hdr_len - sizeof(EthII_Hdr_t));
+				prx_pd->rx_pkt_length -=
+					(hdr_len - sizeof(EthII_Hdr_t));
+			}
+			/* update the prx_pkt pointer */
+			prx_pkt = (RxPacketHdr_t *)((t_u8 *)prx_pd +
+						    prx_pd->rx_pkt_offset);
+		} else {
+			pmbuf->status_code = MLAN_ERROR_PKT_SIZE_INVALID;
+			ret = MLAN_STATUS_FAILURE;
+			PRINTM(MERROR,
+			       "Drop invalid unicast sniffer pkt, subType=0x%x, flag=0x%x, pkt_type=%d\n",
+			       frmctl->sub_type, prx_pd->flags,
+			       prx_pd->rx_pkt_type);
+			wlan_free_mlan_buffer(pmadapter, pmbuf);
+			goto done;
+		}
+	}
 
 	if (rx_pkt_type != PKT_TYPE_BAR) {
 		priv->rxpd_rate = prx_pd->rx_rate;
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_usb.c b/mxm_wifiex/wlan_src/mlan/mlan_usb.c
index 48be972..4a72647 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_usb.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_usb.c
@@ -44,6 +44,7 @@ static const struct _mlan_card_info mlan_card_info_usb8801 = {
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_1X1,
+	.support_11mc = 0,
 };
 #endif
 #ifdef USB8897
@@ -52,6 +53,7 @@ static const struct _mlan_card_info mlan_card_info_usb8897 = {
 	.v16_fw_api = 0,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 0,
 };
 #endif
 
@@ -61,6 +63,7 @@ static const struct _mlan_card_info mlan_card_info_usb8997 = {
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -70,6 +73,7 @@ static const struct _mlan_card_info mlan_card_info_usb8978 = {
 	.v16_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -80,6 +84,7 @@ static const struct _mlan_card_info mlan_card_info_usb9098 = {
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -90,16 +95,18 @@ static const struct _mlan_card_info mlan_card_info_usb9097 = {
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
-#ifdef USBNW62X
-static const struct _mlan_card_info mlan_card_info_usbNW62X = {
+#ifdef USBIW62X
+static const struct _mlan_card_info mlan_card_info_usbIW62X = {
 	.max_tx_buf_size = MLAN_TX_DATA_BUF_SIZE_4K,
 	.v16_fw_api = 1,
 	.v17_fw_api = 1,
 	.supp_ps_handshake = 1,
 	.default_11n_tx_bf_cap = DEFAULT_11N_TX_BF_CAP_2X2,
+	.support_11mc = 1,
 };
 #endif
 
@@ -255,8 +262,8 @@ static mlan_status wlan_usb_prog_fw_w_helper(pmlan_adapter pmadapter,
 	if (IS_USB9097(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
-#if defined(USBNW62X)
-	if (IS_USBNW62X(pmadapter->card_type))
+#if defined(USBIW62X)
+	if (IS_USBIW62X(pmadapter->card_type))
 		check_fw_status = MTRUE;
 #endif
 
@@ -480,10 +487,11 @@ static int wlan_usb_deaggr_rx_num_pkts(pmlan_adapter pmadapter, t_u8 *pdata,
 static inline t_u32 usb_tx_aggr_pad_len(t_u32 len,
 					usb_tx_aggr_params *pusb_tx_aggr)
 {
-	return (len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
-		       (len + (pusb_tx_aggr->aggr_ctrl.aggr_align -
-			       (len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
-		       len;
+	return (t_u32)(
+		(len % pusb_tx_aggr->aggr_ctrl.aggr_align) ?
+			(len + (pusb_tx_aggr->aggr_ctrl.aggr_align -
+				(len % pusb_tx_aggr->aggr_ctrl.aggr_align))) :
+			len);
 }
 
 /**
@@ -798,9 +806,9 @@ mlan_status wlan_get_usb_device(pmlan_adapter pmadapter)
 		pmadapter->pcard_info = &mlan_card_info_usb9097;
 		break;
 #endif
-#ifdef USBNW62X
-	case CARD_TYPE_USBNW62X:
-		pmadapter->pcard_info = &mlan_card_info_usbNW62X;
+#ifdef USBIW62X
+	case CARD_TYPE_USBIW62X:
+		pmadapter->pcard_info = &mlan_card_info_usbIW62X;
 		break;
 #endif
 	default:
@@ -1297,7 +1305,7 @@ static mlan_status wlan_usb_host_to_card(pmlan_private pmpriv, t_u8 type,
 		return MLAN_STATUS_FAILURE;
 	}
 	if (type == MLAN_TYPE_CMD
-#if (defined(USB9098) || defined(USB9097) || defined(USBNW62X))
+#if (defined(USB9098) || defined(USB9097) || defined(USBIW62X))
 	    || type == MLAN_TYPE_VDLL
 #endif
 	) {
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_util.h b/mxm_wifiex/wlan_src/mlan/mlan_util.h
index 9485f1a..5f96256 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_util.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_util.h
@@ -403,8 +403,10 @@ static INLINE t_void util_scalar_decrement(
  *  @param moal_spin_lock	A pointer to spin lock handler
  *  @param moal_spin_unlock	A pointer to spin unlock handler
  *
- *  @return					Value after offset
+ *  @return			Value after offset or 0 if (scalar_value + offset)
+ * overflows
  */
+#define INT_MAX 2147483647
 static INLINE t_s32 util_scalar_offset(
 	t_void *pmoal_handle, pmlan_scalar pscalar, t_s32 offset,
 	mlan_status (*moal_spin_lock)(t_void *handle, t_void *plock),
@@ -414,7 +416,10 @@ static INLINE t_s32 util_scalar_offset(
 
 	if (moal_spin_lock)
 		moal_spin_lock(pmoal_handle, pscalar->plock);
-	newval = (pscalar->value += offset);
+	if (pscalar->value < (INT_MAX - offset))
+		newval = (pscalar->value += offset);
+	else
+		newval = 0;
 	if (moal_spin_unlock)
 		moal_spin_unlock(pmoal_handle, pscalar->plock);
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_wmm.c b/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
index c8aab0f..1f345c0 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_wmm.c
@@ -317,8 +317,7 @@ static mlan_wmm_ac_e wlan_wmm_eval_downgrade_ac(pmlan_private priv,
  *
  *  @return     WMM AC Queue mapping of the IP TOS field
  */
-static INLINE mlan_wmm_ac_e wlan_wmm_convert_tos_to_ac(pmlan_adapter pmadapter,
-						       t_u32 tos)
+mlan_wmm_ac_e wlan_wmm_convert_tos_to_ac(pmlan_adapter pmadapter, t_u32 tos)
 {
 	ENTER();
 
@@ -1101,7 +1100,7 @@ static int wlan_dequeue_tx_packet(pmlan_adapter pmadapter)
 			pmadapter->pmoal_handle, &ptr->buf_head, MNULL, MNULL);
 		if (pmbuf) {
 			pmadapter->callbacks.moal_tp_accounting(
-				pmadapter->pmoal_handle, pmbuf->pdesc, 3);
+				pmadapter->pmoal_handle, pmbuf, 3);
 			if (pmadapter->tp_state_drop_point == 3) {
 				pmbuf = (pmlan_buffer)util_dequeue_list(
 					pmadapter->pmoal_handle, &ptr->buf_head,
@@ -1458,8 +1457,9 @@ t_u8 wlan_get_random_ba_threshold(pmlan_adapter pmadapter)
 	sec = (sec & 0xFFFF) + (sec >> 16);
 	usec = (usec & 0xFFFF) + (usec >> 16);
 
-	ba_threshold = (((sec << 16) + usec) % BA_SETUP_MAX_PACKET_THRESHOLD) +
-		       pmadapter->min_ba_threshold;
+	ba_threshold =
+		(t_u8)((((sec << 16) + usec) % BA_SETUP_MAX_PACKET_THRESHOLD) +
+		       pmadapter->min_ba_threshold);
 	PRINTM(MINFO, "pmadapter->min_ba_threshold = %d\n",
 	       pmadapter->min_ba_threshold);
 	PRINTM(MINFO, "setup BA after %d packets\n", ba_threshold);
@@ -2263,7 +2263,13 @@ mlan_status wlan_ret_wmm_get_status(pmlan_private priv, t_u8 *ptlv,
 	ENTER();
 
 	send_wmm_event = MFALSE;
-
+	if (resp_len < (int)sizeof(ptlv_hdr->header)) {
+		PRINTM(MINFO,
+		       "WMM: WMM_GET_STATUS err: cmdresp low length received: %d\n",
+		       resp_len);
+		LEAVE();
+		return MLAN_STATUS_FAILURE;
+	}
 	PRINTM(MINFO, "WMM: WMM_GET_STATUS cmdresp received: %d\n", resp_len);
 	HEXDUMP("CMD_RESP: WMM_GET_STATUS", pcurrent, resp_len);
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_wmm.h b/mxm_wifiex/wlan_src/mlan/mlan_wmm.h
index 64fcc22..a458948 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_wmm.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_wmm.h
@@ -180,6 +180,8 @@ void wlan_wmm_setup_ac_downgrade(pmlan_private priv);
 /** select WMM queue */
 t_u8 wlan_wmm_select_queue(mlan_private *pmpriv, t_u8 tid);
 t_void wlan_wmm_delete_peer_ralist(pmlan_private priv, t_u8 *mac);
+/** Convert the IP TOS to an WMM AC Queue assignment */
+mlan_wmm_ac_e wlan_wmm_convert_tos_to_ac(pmlan_adapter pmadapter, t_u32 tos);
 
 #ifdef STA_SUPPORT
 /*
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
index 2b496fe..e1b1d42 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
@@ -24,7 +24,7 @@
 #define _MLAN_DECL_H_
 
 /** MLAN release version */
-#define MLAN_RELEASE_VERSION "368.p2"
+#define MLAN_RELEASE_VERSION "391"
 
 /** Re-define generic data types for MLAN/MOAL */
 /** Signed char (1-byte) */
@@ -262,11 +262,12 @@ typedef t_s32 t_sval;
 #define FW_RELOAD_NO_EMULATION 2
 /** out band reset with interface re-emulation */
 #define FW_RELOAD_WITH_EMULATION 3
-#ifdef PCIE
 /** pcie card reset */
 #define FW_RELOAD_PCIE_RESET 4
-#endif
+/** sdio hw reset */
 #define FW_RELOAD_SDIO_HW_RESET 5
+/** pcie inband reset */
+#define FW_RELOAD_PCIE_INBAND_RESET 6
 
 #ifdef USB
 #define MLAN_USB_BLOCK_SIZE (512)
@@ -373,7 +374,9 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 /** 8801 card type */
 #define CARD_TYPE_8801 0x0a
 /** OWL card type */
-#define CARD_TYPE_NW62X 0x0b
+#define CARD_TYPE_IW62X 0x0b
+/** Black bird card type */
+#define CARD_TYPE_AW693 0x0c
 
 /** 9098 A0 reverion num */
 #define CHIP_9098_REV_A0 1
@@ -405,8 +408,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_SD9177 (CARD_TYPE_9177 | (INTF_SD << 8))
 /** SD8801 card type */
 #define CARD_TYPE_SD8801 (CARD_TYPE_8801 | (INTF_SD << 8))
-/** SD_NW62X card type */
-#define CARD_TYPE_SDNW62X (CARD_TYPE_NW62X | (INTF_SD << 8))
+/** SD_IW62X card type */
+#define CARD_TYPE_SDIW62X (CARD_TYPE_IW62X | (INTF_SD << 8))
+/** SD_IW62X card type */
+#define CARD_TYPE_SDAW693 (CARD_TYPE_AW693 | (INTF_SD << 8))
 
 #define IS_SD8887(ct) (CARD_TYPE_SD8887 == (ct))
 #define IS_SD8897(ct) (CARD_TYPE_SD8897 == (ct))
@@ -418,7 +423,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_SD9098(ct) (CARD_TYPE_SD9098 == (ct))
 #define IS_SD9177(ct) (CARD_TYPE_SD9177 == (ct))
 #define IS_SD8801(ct) (CARD_TYPE_SD8801 == (ct))
-#define IS_SDNW62X(ct) (CARD_TYPE_SDNW62X == (ct))
+#define IS_SDIW62X(ct) (CARD_TYPE_SDIW62X == (ct))
+#define IS_SDAW693(ct) (CARD_TYPE_SDAW693 == (ct))
 
 /** SD8887 Card */
 #define CARD_SD8887 "SD8887"
@@ -440,8 +446,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_SD9177 "SDIW612"
 /** SD8801 Card */
 #define CARD_SD8801 "SD8801"
-/** SDNW62X Card */
-#define CARD_SDNW62X "SDNW62X"
+/** SDIW62X Card */
+#define CARD_SDIW62X "SDIW62X"
+/** SDAW693 Card */
+#define CARD_SDAW693 "SDAW693"
 #endif
 
 #ifdef PCIE
@@ -453,14 +461,17 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_PCIE9097 (CARD_TYPE_9097 | (INTF_PCIE << 8))
 /** PCIE9098 card type */
 #define CARD_TYPE_PCIE9098 (CARD_TYPE_9098 | (INTF_PCIE << 8))
-/** PCIENW62X card type */
-#define CARD_TYPE_PCIENW62X (CARD_TYPE_NW62X | (INTF_PCIE << 8))
+/** PCIEIW62X card type */
+#define CARD_TYPE_PCIEIW62X (CARD_TYPE_IW62X | (INTF_PCIE << 8))
+/** PCIEAW693 card type */
+#define CARD_TYPE_PCIEAW693 (CARD_TYPE_AW693 | (INTF_PCIE << 8))
 
 #define IS_PCIE8897(ct) (CARD_TYPE_PCIE8897 == (ct))
 #define IS_PCIE8997(ct) (CARD_TYPE_PCIE8997 == (ct))
 #define IS_PCIE9097(ct) (CARD_TYPE_PCIE9097 == (ct))
 #define IS_PCIE9098(ct) (CARD_TYPE_PCIE9098 == (ct))
-#define IS_PCIENW62X(ct) (CARD_TYPE_PCIENW62X == (ct))
+#define IS_PCIEIW62X(ct) (CARD_TYPE_PCIEIW62X == (ct))
+#define IS_PCIEAW693(ct) (CARD_TYPE_PCIEAW693 == (ct))
 
 /** PCIE8897 Card */
 #define CARD_PCIE8897 "PCIE8897"
@@ -474,8 +485,10 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_PCIE9098 "PCIE9098"
 /** PCIEAW690 Card */
 #define CARD_PCIEAW690 "PCIEAW690"
-/** PCIENW62X Card */
-#define CARD_PCIENW62X "PCIENW62X"
+/** PCIEIW62X Card */
+#define CARD_PCIEIW62X "PCIEIW62X"
+/** PCIEAW693 Card */
+#define CARD_PCIEAW693 "PCIEAW693"
 /** PCIEIW629 Card */
 #define CARD_PCIEIW629 "PCIEIW629"
 #endif
@@ -493,8 +506,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_TYPE_USB9098 (CARD_TYPE_9098 | (INTF_USB << 8))
 /** USB9097 card type */
 #define CARD_TYPE_USB9097 (CARD_TYPE_9097 | (INTF_USB << 8))
-/** USBNW62X card type */
-#define CARD_TYPE_USBNW62X (CARD_TYPE_NW62X | (INTF_USB << 8))
+/** USBIW62X card type */
+#define CARD_TYPE_USBIW62X (CARD_TYPE_IW62X | (INTF_USB << 8))
 
 #define IS_USB8801(ct) (CARD_TYPE_USB8801 == (ct))
 #define IS_USB8897(ct) (CARD_TYPE_USB8897 == (ct))
@@ -502,7 +515,7 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_USB8978(ct) (CARD_TYPE_USB8978 == (ct))
 #define IS_USB9098(ct) (CARD_TYPE_USB9098 == (ct))
 #define IS_USB9097(ct) (CARD_TYPE_USB9097 == (ct))
-#define IS_USBNW62X(ct) (CARD_TYPE_USBNW62X == (ct))
+#define IS_USBIW62X(ct) (CARD_TYPE_USBIW62X == (ct))
 
 /** USB8801 Card */
 #define CARD_USB8801 "USB8801"
@@ -516,8 +529,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define CARD_USB9098 "USB9098"
 /** USB9097 Card */
 #define CARD_USB9097 "USBIW620"
-/** USBNW62X Card */
-#define CARD_USBNW62X "USBNW62X"
+/** USBIW62X Card */
+#define CARD_USBIW62X "USBIW62X"
 #endif
 
 #define IS_CARD8801(ct) (CARD_TYPE_8801 == ((ct)&0xf))
@@ -529,7 +542,8 @@ typedef t_u8 mlan_802_11_mac_addr[MLAN_MAC_ADDR_LENGTH];
 #define IS_CARD9098(ct) (CARD_TYPE_9098 == ((ct)&0xf))
 #define IS_CARD9097(ct) (CARD_TYPE_9097 == ((ct)&0xf))
 #define IS_CARD9177(ct) (CARD_TYPE_9177 == ((ct)&0xf))
-#define IS_CARDNW62X(ct) (CARD_TYPE_NW62X == ((ct)&0xf))
+#define IS_CARDIW62X(ct) (CARD_TYPE_IW62X == ((ct)&0xf))
+#define IS_CARDAW693(ct) (CARD_TYPE_AW693 == ((ct)&0xf))
 
 typedef struct _card_type_entry {
 	t_u16 card_type;
@@ -822,6 +836,7 @@ typedef enum _mlan_event_id {
 	MLAN_EVENT_ID_DRV_UAP_CHAN_INFO = 0x80000020,
 #endif
 	MLAN_EVENT_ID_FW_ROAM_OFFLOAD_RESULT = 0x80000023,
+	MLAN_EVENT_ID_DRV_RTT_RESULT = 0x80000025,
 	MLAN_EVENT_ID_DRV_ASSOC_FAILURE_LOGGER = 0x80000026,
 	MLAN_EVENT_ID_DRV_ASSOC_SUCC_LOGGER = 0x80000027,
 	MLAN_EVENT_ID_DRV_DISCONNECT_LOGGER = 0x80000028,
@@ -974,10 +989,10 @@ typedef MLAN_PACK_START struct _Band_Config_t {
 	t_u8 chan2Offset : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 #else
-	/** Band Info - (00)=2.4GHz, (01)=5GHz */
+	/** Band Info - (00)=2.4GHz, (01)=5GHz, (10)=6GHz */
 	t_u8 chanBand : 2;
 	/** Channel Width - (00)=20MHz, (10)=40MHz, (11)=80MHz */
 	t_u8 chanWidth : 2;
@@ -1152,6 +1167,10 @@ typedef MLAN_PACK_START struct _mix_rate_info {
 	t_u8 mcs_index;
 	/** bitrate, in 500Kbps */
 	t_u16 bitrate;
+	/** NSS */
+	t_u8 nss_index;
+	/** DCM */
+	t_u8 dcm;
 } MLAN_PACK_END mix_rate_info, *pmix_rate_info;
 
 typedef MLAN_PACK_START struct _rxpd_extra_info {
@@ -1163,10 +1182,12 @@ typedef MLAN_PACK_START struct _rxpd_extra_info {
 	t_u8 mcs_known;
 	/** mcs.flags */
 	t_u8 mcs_flags;
-	/** vht sig1 */
-	t_u32 vht_sig1;
-	/** vht sig2 */
-	t_u32 vht_sig2;
+	/** vht/he sig1 */
+	t_u32 vht_he_sig1;
+	/** vht/he sig2 */
+	t_u32 vht_he_sig2;
+	/** HE user idx */
+	t_u32 user_idx;
 } MLAN_PACK_END rxpd_extra_info, *prxpd_extra_info;
 
 typedef MLAN_PACK_START struct _radiotap_info {
@@ -2030,6 +2051,308 @@ typedef struct {
 	0x00000080 /** all contention (min, max, avg) statistics (within ac    \
 		      statisctics) */
 
+/** =========== Define Copied from HAL START =========== */
+/** Ranging status */
+typedef enum {
+	RTT_STATUS_SUCCESS = 0,
+	/** general failure status */
+	RTT_STATUS_FAILURE = 1,
+	/** target STA does not respond to request */
+	RTT_STATUS_FAIL_NO_RSP = 2,
+	/** request rejected. Applies to 2-sided RTT only */
+	RTT_STATUS_FAIL_REJECTED = 3,
+	RTT_STATUS_FAIL_NOT_SCHEDULED_YET = 4,
+	/** timing measurement times out */
+	RTT_STATUS_FAIL_TM_TIMEOUT = 5,
+	/** Target on different channel, cannot range */
+	RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6,
+	/** ranging not supported */
+	RTT_STATUS_FAIL_NO_CAPABILITY = 7,
+	/** request aborted for unknown reason */
+	RTT_STATUS_ABORTED = 8,
+	/** Invalid T1-T4 timestamp */
+	RTT_STATUS_FAIL_INVALID_TS = 9,
+	/** 11mc protocol failed */
+	RTT_STATUS_FAIL_PROTOCOL = 10,
+	/** request could not be scheduled */
+	RTT_STATUS_FAIL_SCHEDULE = 11,
+	/** responder cannot collaborate at time of request */
+	RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,
+	/** bad request args */
+	RTT_STATUS_INVALID_REQ = 13,
+	/** WiFi not enabled */
+	RTT_STATUS_NO_WIFI = 14,
+	/** Responder overrides param info, cannot range with new params */
+	RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE = 15
+} wifi_rtt_status;
+
+/** RTT peer type */
+typedef enum {
+	RTT_PEER_AP = 0x1,
+	RTT_PEER_STA = 0x2,
+	RTT_PEER_P2P_GO = 0x3,
+	RTT_PEER_P2P_CLIENT = 0x4,
+	RTT_PEER_NAN = 0x5
+} rtt_peer_type;
+
+/** RTT Measurement Bandwidth */
+typedef enum {
+	WIFI_RTT_BW_5 = 0x01,
+	WIFI_RTT_BW_10 = 0x02,
+	WIFI_RTT_BW_20 = 0x04,
+	WIFI_RTT_BW_40 = 0x08,
+	WIFI_RTT_BW_80 = 0x10,
+	WIFI_RTT_BW_160 = 0x20
+} wifi_rtt_bw;
+
+/** RTT Type */
+typedef enum {
+	RTT_TYPE_1_SIDED = 0x1,
+	RTT_TYPE_2_SIDED = 0x2,
+} wifi_rtt_type;
+
+/** RTT configuration */
+typedef struct {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	wifi_rtt_type type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	rtt_peer_type peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	wifi_channel_info channel;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u32 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u32 num_burst;
+	/** num of frames per burst. Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames to be attempted in a
+	 * single burst. This also equals the number of FTM frames that the
+	 * initiator will request that the responder send in a single frame. */
+	t_u32 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can retry an FTMR
+	 * frame. Minimum value = 0, Maximum value = 3 */
+	t_u32 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u32 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	wifi_preamble preamble;
+	/** RTT BW to be used in the RTT frames */
+	wifi_rtt_bw bw;
+} wifi_rtt_config;
+
+/** Format of information elements found in the beacon */
+typedef struct {
+	/** element identifier */
+	t_u8 id;
+	/** number of bytes to follow */
+	t_u8 len;
+	t_u8 data[];
+} wifi_information_element;
+
+/** RTT results */
+typedef struct {
+	/** device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** burst number in a multi-burst request */
+	t_u32 burst_num;
+	/** Total RTT measurement frames attempted */
+	t_u32 measurement_number;
+	/** Total successful RTT measurement frames */
+	t_u32 success_number;
+	/** Maximum number of "FTM frames per burst" supported by
+	 * the responder STA. Applies to 2-sided RTT only.
+	 * If reponder overrides with larger value:
+	 * - for single-burst request initiator will truncate the
+	 * larger value and send a TMR_STOP after receiving as
+	 * many frames as originally requested.
+	 * - for multi-burst request, initiator will return
+	 * failure right away */
+	t_u8 number_per_burst_peer;
+	/** ranging status */
+	wifi_rtt_status status;
+	/** When status == RTT_STATUS_FAIL_BUSY_TRY_LATER,
+	 * this will be the time provided by the responder as to
+	 * when the request can be tried again. Applies to 2-sided
+	 * RTT only. In sec, 1-31sec. */
+	t_u8 retry_after_duration;
+	/** RTT type */
+	wifi_rtt_type type;
+	/** average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB */
+	int rssi;
+	/** rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
+	 */
+	int rssi_spread;
+	/** 1-sided RTT: TX rate of RTT frame.
+	 * 2-sided RTT: TX rate of initiator's Ack in response to FTM frame. */
+	wifi_rate tx_rate;
+	/** 1-sided RTT: TX rate of Ack from other side.
+	 * 2-sided RTT: TX rate of FTM frame coming from responder. */
+	wifi_rate rx_rate;
+	/** round trip time in picoseconds */
+	t_s64 rtt;
+	/** rtt standard deviation in picoseconds */
+	t_s64 rtt_sd;
+	/** difference between max and min rtt times recorded in picoseconds */
+	t_s64 rtt_spread;
+	/** distance in mm (optional) */
+	int distance_mm;
+	/** standard deviation in mm (optional) */
+	int distance_sd_mm;
+	/** difference between max and min distance recorded in mm (optional) */
+	int distance_spread_mm;
+	/** time of the measurement (in microseconds since boot) */
+	t_s64 ts;
+	/** in ms, actual time taken by the FW to finish one burst
+	 * measurement. Applies to 1-sided and 2-sided RTT. */
+	int burst_duration;
+	/** Number of bursts allowed by the responder. Applies
+	 * to 2-sided RTT only. */
+	int negotiated_burst_num;
+	/** for 11mc only */
+	wifi_information_element *LCI;
+	/** for 11mc only */
+	wifi_information_element *LCR;
+} wifi_rtt_result;
+
+/** Preamble definition for bit mask used in wifi_rtt_capabilities */
+#define PREAMBLE_LEGACY 0x1
+#define PREAMBLE_HT 0x2
+#define PREAMBLE_VHT 0x4
+
+/** BW definition for bit mask used in wifi_rtt_capabilities */
+#define BW_5_SUPPORT 0x1
+#define BW_10_SUPPORT 0x2
+#define BW_20_SUPPORT 0x4
+#define BW_40_SUPPORT 0x8
+#define BW_80_SUPPORT 0x10
+#define BW_160_SUPPORT 0x20
+
+/** RTT Capabilities */
+typedef struct {
+	/** if 1-sided rtt data collection is supported */
+	t_u8 rtt_one_sided_supported;
+	/** if ftm rtt data collection is supported */
+	t_u8 rtt_ftm_supported;
+	/** if initiator supports LCI request. Applies to 2-sided RTT */
+	t_u8 lci_support;
+	/** if initiator supports LCR request. Applies to 2-sided RTT */
+	t_u8 lcr_support;
+	/** bit mask indicates what preamble is supported by initiator */
+	t_u8 preamble_support;
+	/** bit mask indicates what BW is supported by initiator */
+	t_u8 bw_support;
+	/** if 11mc responder mode is supported */
+	t_u8 responder_supported;
+	/** draft 11mc spec version supported by chip. For instance,
+	 * version 4.0 should be 40 and version 4.3 should be 43 etc. */
+	t_u8 mc_version;
+} wifi_rtt_capabilities;
+
+/** API for setting LCI/LCR information to be provided to a requestor */
+typedef enum {
+	/** Not expected to change location */
+	WIFI_MOTION_NOT_EXPECTED = 0,
+	/** Expected to change location */
+	WIFI_MOTION_EXPECTED = 1,
+	/** Movement pattern unknown */
+	WIFI_MOTION_UNKNOWN = 2,
+} wifi_motion_pattern;
+
+/** LCI information */
+typedef struct {
+	/** latitude in degrees * 2^25 , 2's complement */
+	long latitude;
+	/** latitude in degrees * 2^25 , 2's complement */
+	long longitude;
+	/** Altitude in units of 1/256 m */
+	int altitude;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 latitude_unc;
+	/** As defined in Section 2.3.2 of IETF RFC 6225 */
+	t_u8 longitude_unc;
+	/** As defined in Section 2.4.5 from IETF RFC 6225: */
+	t_u8 altitude_unc;
+	/** Following element for configuring the Z subelement */
+	wifi_motion_pattern motion_pattern;
+	/** floor in units of 1/16th of floor. 0x80000000 if unknown. */
+	int floor;
+	/** in units of 1/64 m */
+	int height_above_floor;
+	/** in units of 1/64 m. 0 if unknown */
+	int height_unc;
+} wifi_lci_information;
+
+/** LCR information */
+typedef struct {
+	/** country code */
+	char country_code[2];
+	/** length of the info field */
+	int length;
+	/** Civic info to be copied in FTM frame */
+	char civic_info[256];
+} wifi_lcr_information;
+
+/**
+ * RTT Responder information
+ */
+typedef struct {
+	wifi_channel_info channel;
+	wifi_preamble preamble;
+} wifi_rtt_responder;
+
+/** =========== Define Copied from HAL END =========== */
+
+#define MAX_RTT_CONFIG_NUM 10
+
+/** RTT config params */
+typedef struct wifi_rtt_config_params {
+	t_u8 rtt_config_num;
+	wifi_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} wifi_rtt_config_params_t;
+
+#define OID_RTT_REQUEST 0
+#define OID_RTT_CANCEL 1
+
+/** Pass RTT result element between mlan and moal */
+typedef struct {
+	/** element identifier  */
+	t_u16 id;
+	/** number of bytes to follow  */
+	t_u16 len;
+	/** data: fill with one wifi_rtt_result  */
+	t_u8 data[];
+} wifi_rtt_result_element;
+
 /** station stats */
 typedef struct _sta_stats {
 	/** last_rx_in_msec */
@@ -2351,6 +2674,8 @@ typedef struct _mlan_device {
 	t_u8 ext_scan;
 	/* mcs32 setting */
 	t_u8 mcs32;
+	/** second mac flag */
+	t_u8 second_mac;
 } mlan_device, *pmlan_device;
 
 /** MLAN API function prototype */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h b/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
index cf2ef85..e0a73ad 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ieee.h
@@ -4,7 +4,7 @@
  *  definitions used in MLAN and MOAL module.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -48,7 +48,7 @@ typedef enum _WLAN_802_11_NETWORK_TYPE {
 
 #ifdef BIG_ENDIAN_SUPPORT
 /** Frame control: Type Mgmt frame */
-#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x3000
+#define IEEE80211_FC_MGMT_FRAME_TYPE_MASK 0x0c00
 /** Frame control: SubType Mgmt frame */
 #define IEEE80211_GET_FC_MGMT_FRAME_SUBTYPE(fc) (((fc)&0xF000) >> 12)
 #else
@@ -90,6 +90,8 @@ typedef MLAN_PACK_START enum _IEEEtypes_ElementId_e {
 	EXTEND_CHANNEL_SWITCH_ANN = 60,
 	QUIET = 40,
 	IBSS_DFS = 41,
+	MEASUREMENT_REQUEST = 38,
+	MEASUREMENT_REPORT = 39,
 	SUPPORTED_CHANNELS = 36,
 	REGULATORY_CLASS = 59,
 	HT_CAPABILITY = 45,
@@ -177,6 +179,33 @@ typedef MLAN_PACK_START struct _IEEEtypes_Generic_t {
 	t_u8 data[IEEE_MAX_IE_SIZE - sizeof(IEEEtypes_Header_t)];
 } MLAN_PACK_END IEEEtypes_Generic_t, *pIEEEtypes_Generic_t;
 
+#define MEASURE_TYPE_CLI 8
+#define MEASURE_TYPE_LOCATION_CIVIC 9
+
+/** Measurement Report IE */
+typedef MLAN_PACK_START struct _IEEEtypes_MeasurementReport_t {
+	/** Generic IE header */
+	IEEEtypes_Header_t ieee_hdr;
+	/** Measurement Token */
+	t_u8 ms_token;
+	/** Measurement Report Mode */
+	t_u8 ms_rp_mode;
+	/** Measurement Type, value in MEASURE_TYPE_XXX */
+	t_u8 ms_type;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_MeasurementReport_t;
+
+/** Report */
+typedef MLAN_PACK_START struct _IEEEtypes_Report_t {
+	/** Subelement ID */
+	t_u8 subelement_id;
+	/** length */
+	t_u8 length;
+	/** variable */
+	t_u8 variable[];
+} MLAN_PACK_END IEEEtypes_Report_t;
+
 /**ft capability policy*/
 typedef MLAN_PACK_START struct _IEEEtypes_FtCapPolicy_t {
 #ifdef BIG_ENDIAN_SUPPORT
@@ -1718,8 +1747,8 @@ typedef MLAN_PACK_START struct _wlan_user_scan_chan {
 	t_u8 radio_type;
 	/** Scan type: Active = 1, Passive = 2 */
 	t_u8 scan_type;
-	/** Reserved */
-	t_u8 reserved;
+	/** rnr_flag */
+	t_u8 rnr_flag;
 	/** Scan duration in milliseconds; if 0 default used */
 	t_u32 scan_time;
 } MLAN_PACK_END wlan_user_scan_chan;
@@ -1834,11 +1863,14 @@ typedef MLAN_PACK_START struct {
 #define BG_SCAN_SSID_RSSI_MATCH 0x0004
 /**wait for all channel scan to complete to report scan result*/
 #define BG_SCAN_WAIT_ALL_CHAN_DONE 0x80000000
-/** Maximum number of channels that can be sent in bg scan config */
-#define CHAN_MAX_24G 14
-#define CHAN_MAX_5G 24
-#define CHAN_MAX_UNII4 3
-#define WLAN_BG_SCAN_CHAN_MAX (CHAN_MAX_24G + CHAN_MAX_5G + CHAN_MAX_UNII4)
+
+#define CHAN_MAX_6G 0
+
+/** max bgscan chan number */
+#define WLAN_BG_SCAN_CHAN_MAX 38
+
+/** max bgscan chan number, include UNII_4 channel */
+#define WLAN_BG_SCAN_CHAN_MAX_UNII_4 41
 
 /** Enumeration definition */
 /** EES MODE */
@@ -1906,7 +1938,7 @@ typedef MLAN_PACK_START struct {
 	/** SSID filter list used in the to limit the scan results */
 	wlan_user_scan_ssid ssid_list[MRVDRV_MAX_SSID_LIST_LENGTH];
 	/** Variable number (fixed maximum) of channels to scan up */
-	wlan_user_scan_chan chan_list[WLAN_BG_SCAN_CHAN_MAX];
+	wlan_user_scan_chan chan_list[WLAN_USER_SCAN_CHAN_MAX];
 	/** scan channel gap */
 	t_u16 scan_chan_gap;
 	/** Enable EES configuration */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
index 7790db9..062b239 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
@@ -3,7 +3,7 @@
  *  @brief This file declares the IOCTL data structures and APIs.
  *
  *
- *  Copyright 2008-2022 NXP
+ *  Copyright 2008-2023 NXP
  *
  *  This software file (the File) is distributed by NXP
  *  under the terms of the GNU General Public License Version 2, June 1991
@@ -328,6 +328,9 @@ enum _mlan_ioctl_req_id {
 
 	MLAN_OID_MISC_ROBUSTCOEX = 0x00200056,
 	MLAN_OID_MISC_GET_TX_RX_HISTOGRAM = 0x00200057,
+	MLAN_OID_MISC_CONFIG_RTT = 0x00200059,
+	MLAN_OID_MISC_CANCEL_RTT = 0x0020005A,
+	MLAN_OID_MISC_RTT_RESPONDER_CFG = 0x0020005B,
 	MLAN_OID_MISC_CFP_INFO = 0x00200060,
 	MLAN_OID_MISC_BOOT_SLEEP = 0x00200061,
 #if defined(PCIE)
@@ -365,6 +368,10 @@ enum _mlan_ioctl_req_id {
 	MLAN_OID_MISC_CH_LOAD = 0x00200087,
 	MLAN_OID_MISC_STATS = 0x00200088,
 	MLAN_OID_MISC_CH_LOAD_RESULTS = 0x00200089,
+	MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX = 0x0020008A,
+	MLAN_OID_MISC_CROSS_CHIP_SYNCH = 0x0020008B,
+	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
+	MLAN_OID_MISC_OFDM_DESENSE_CFG = 0x0020008D,
 };
 
 /** Sub command size */
@@ -1181,6 +1188,11 @@ typedef struct _mlan_uap_scan_channels {
 
 #define MAX_NUM_PKTS 9
 #define DEF_NUM_PKTS 3
+
+/** Default channel mode and retry packets for channel switch */
+#define DEFAULT_RETRY_PKTS 9
+#define DEFAULT_CHAN_MODE_MASK 3
+
 /** mlan_chan_switch_param */
 typedef struct _mlan_action_chan_switch {
 	/** mode*/
@@ -1372,8 +1384,6 @@ enum _mlan_band_def {
 	BAND_AAC = 64,
 	BAND_GAX = 256,
 	BAND_AAX = 512,
-	MLAN_OID_MISC_RF_TEST_CONFIG_TRIGGER_FRAME = 0x0020008C,
-
 };
 
 /** Channel bandwidth */
@@ -1885,6 +1895,8 @@ typedef struct _mlan_fw_info {
 	t_u32 hw_dot_11n_dev_cap;
 	/** Device support for MIMO abstraction of MCSs */
 	t_u8 hw_dev_mcs_support;
+	/** mpdu density */
+	t_u8 hw_mpdu_density;
 	/** user's MCS setting */
 	t_u8 usr_dev_mcs_support;
 	/** 802.11ac device capabilities */
@@ -1927,6 +1939,8 @@ typedef struct _mlan_fw_info {
 	t_u8 prohibit_80mhz;
 	/** FW support beacon protection */
 	t_u8 fw_beacon_prot;
+	/** FW RTT support */
+	t_u8 rtt_support;
 
 	/* lower 8 bytes of uuid */
 	t_u64 uuid_lo;
@@ -2548,6 +2562,9 @@ typedef struct _sta_info_data {
 	t_u16 ie_len;
 } sta_info_data;
 
+/** Per station Maximum IE buffer SIZE */
+#define MAX_STA_LIST_IE_SIZE 13
+
 /** mlan_ds_sta_list structure for MLAN_OID_UAP_STA_LIST */
 typedef struct _mlan_ds_sta_list {
 	/** station count */
@@ -4017,6 +4034,7 @@ typedef struct _mlan_ds_11ax_cfg {
 
 #define MLAN_11AX_TWT_SETUP_SUBID 0x114
 #define MLAN_11AX_TWT_TEARDOWN_SUBID 0x115
+#define MLAN_11AX_TWT_REPORT_SUBID 0x116
 
 #define MRVL_DOT11AX_ENABLE_SR_TLV_ID (PROPRIETARY_TLV_BASE_ID + 322)
 #define MRVL_DOT11AX_OBSS_PD_OFFSET_TLV_ID (PROPRIETARY_TLV_BASE_ID + 323)
@@ -4153,6 +4171,17 @@ typedef struct MLAN_PACK_START _mlan_ds_twt_teardown {
 	t_u8 teardown_all_twt;
 } MLAN_PACK_END mlan_ds_twt_teardown, *pmlan_ds_twt_teardown;
 
+/** Type definition of mlan_ds_twt_report for MLAN_OID_11AX_TWT_CFG */
+typedef MLAN_PACK_START struct _mlan_ds_twt_report {
+	/** TWT report type, 0: BTWT id */
+	t_u8 type;
+	/** TWT report length of value in data */
+	t_u8 length;
+	t_u8 reserve[2];
+	/** TWT report payload for FW response to fill */
+	t_u8 data[36];
+} MLAN_PACK_END mlan_ds_twt_report, *pmlan_ds_twt_report;
+
 /** Type definition of mlan_ds_twtcfg for MLAN_OID_11AX_TWT_CFG */
 typedef struct MLAN_PACK_START _mlan_ds_twtcfg {
 	/** Sub-command */
@@ -4166,6 +4195,8 @@ typedef struct MLAN_PACK_START _mlan_ds_twtcfg {
 		/** TWT Teardown config for Sub ID: MLAN_11AX_TWT_TEARDOWN_SUBID
 		 */
 		mlan_ds_twt_teardown twt_teardown;
+		/** TWT report for Sub ID: MLAN_11AX_TWT_REPORT_SUBID */
+		mlan_ds_twt_report twt_report;
 	} param;
 } MLAN_PACK_END mlan_ds_twtcfg, *pmlan_ds_twtcfg;
 
@@ -4243,20 +4274,11 @@ enum _mlan_reg_type {
 	MLAN_REG_CAU = 5,
 	MLAN_REG_PSU = 6,
 	MLAN_REG_BCA = 7,
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097) ||          \
-	defined(SD9177)
 	MLAN_REG_CIU = 8,
-#endif
-#if defined(PCIE9098) || defined(SD9098) || defined(USB9098) ||                \
-	defined(PCIE9097) || defined(USB9097) || defined(SDNW62X) ||           \
-	defined(PCIENW62X) || defined(USBNW62X) || defined(SD9097)
 	MLAN_REG_MAC2 = 0x81,
 	MLAN_REG_BBP2 = 0x82,
 	MLAN_REG_RF2 = 0x83,
 	MLAN_REG_BCA2 = 0x87
-#endif
 };
 
 /** Type definition of mlan_ds_reg_rw for MLAN_OID_REG_RW */
@@ -4489,6 +4511,12 @@ enum _mlan_func_cmd {
 #define MLAN_NETMON_CONTROL MBIT(1)
 /* data frame */
 #define MLAN_NETMON_DATA MBIT(2)
+/* only unicast destined frame (no promiscuous) */
+#define MLAN_NETMON_NOPROM MBIT(3)
+/* capture non-bss Rx beacons */
+#define MLAN_NETMON_NON_BSS_BCN MBIT(5)
+/* capture Tx frames */
+#define MLAN_NETMON_TX MBIT(6)
 
 typedef struct _mlan_ds_misc_net_monitor {
 	/** Enable/disable network monitor */
@@ -4522,6 +4550,15 @@ typedef struct _mlan_ds_misc_rx_abort_cfg {
 	/** Rx weak RSSI pkt threshold */
 	t_s8 rssi_threshold;
 } mlan_ds_misc_rx_abort_cfg;
+/** Type definition of mlan_ds_misc_ofdm_desense_cfg
+ * for MLAN_OID_MISC_OFDM_DESENSE_CFG
+ */
+typedef struct _mlan_ds_misc_ofdm_desense_cfg {
+	/** enable/disable ofdm desense cfg */
+	t_u8 enable;
+	/** OFDM  CCA pkt threshold */
+	t_s8 cca_threshold;
+} mlan_ds_misc_ofdm_desense_cfg;
 
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
  * for MLAN_OID_MISC_RX_ABORT_CFG_EXT
@@ -4533,6 +4570,14 @@ typedef struct _mlan_ds_misc_rx_abort_cfg_ext {
 	t_s8 rssi_margin;
 	/** specify ceil rssi threshold */
 	t_s8 ceil_rssi_threshold;
+	/** specify floor rssi threshold */
+	t_s8 floor_rssi_threshold;
+	/** current dynamic rssi threshold */
+	t_s8 current_dynamic_rssi_threshold;
+	/** rssi config: default or user configured */
+	t_u8 rssi_default_config;
+	/** EDMAC status */
+	t_u8 edmac_enable;
 } mlan_ds_misc_rx_abort_cfg_ext;
 
 /** Type definition of mlan_ds_misc_rx_abort_cfg_ext
@@ -5373,6 +5418,21 @@ typedef struct _mlan_ds_misc_keep_alive {
 	t_u16 ether_type;
 } mlan_ds_misc_keep_alive, *pmlan_ds_misc_keep_alive;
 
+#define MKEEP_ALIVE_ACK_PKT_MAX 100
+typedef struct _mlan_ds_misc_keep_alive_rx {
+	t_u8 mkeep_alive_id;
+	t_u8 enable;
+	/** enable/disable tcp reset*/
+	t_u8 reset;
+	/**True means saved in driver, false means not saved or download*/
+	t_u8 cached;
+	t_u8 dst_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u8 src_mac[MLAN_MAC_ADDR_LENGTH];
+	t_u16 pkt_len;
+	t_u8 packet[MKEEP_ALIVE_ACK_PKT_MAX];
+	/** Ethernet type */
+	t_u16 ether_type;
+} mlan_ds_misc_keep_alive_rx, *pmlan_ds_misc_keep_alive_rx;
 /** TX and RX histogram statistic parameters*/
 typedef MLAN_PACK_START struct _mlan_ds_misc_tx_rx_histogram {
 	/** Enable or disable get tx/rx histogram statistic */
@@ -5427,6 +5487,115 @@ typedef struct _mlan_ds_misc_robustcoex_params {
 	t_u8 gpio_polarity;
 } mlan_ds_misc_robustcoex_params;
 
+/** RTT configuration */
+typedef struct _mlan_rtt_config {
+	/** peer device mac address */
+	t_u8 addr[MLAN_MAC_ADDR_LENGTH];
+	/** 1-sided or 2-sided RTT */
+	t_u8 type;
+	/** optional - peer device hint (STA, P2P, AP) */
+	t_u8 peer;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	t_u8 channel;
+	/** Required for STA-AP mode, optional for P2P, NBD etc. */
+	Band_Config_t bandcfg;
+	/** Time interval between bursts (units: 100 ms).
+	 * Applies to 1-sided and 2-sided RTT multi-burst requests.
+	 * Range: 0-31, 0: no preference by initiator (2-sided RTT) */
+	t_u8 burst_period;
+	/** Total number of RTT bursts to be executed. It will be
+	 * specified in the same way as the parameter "Number of
+	 * Burst Exponent" found in the FTM frame format. It
+	 * applies to both: 1-sided RTT and 2-sided RTT. Valid
+	 * values are 0 to 15 as defined in 802.11mc std.
+	 * 0 means single shot
+	 * The implication of this parameter on the maximum
+	 * number of RTT results is the following:
+	 * for 1-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst)
+	 * for 2-sided RTT: max num of RTT results =
+	 * (2^num_burst)*(num_frames_per_burst - 1) */
+	t_u8 num_burst;
+	/** num of frames per burst.
+	 * Minimum value = 1, Maximum value = 31
+	 * For 2-sided this equals the number of FTM frames
+	 * to be attempted in a single burst. This also
+	 * equals the number of FTM frames that the
+	 * initiator will request that the responder send
+	 * in a single frame. */
+	t_u8 num_frames_per_burst;
+	/** number of retries for a failed RTT frame. Applies
+	 * to 1-sided RTT only. Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_rtt_frame;
+
+	/** following fields are only valid for 2-side RTT */
+	/** Maximum number of retries that the initiator can
+	 * retry an FTMR frame.
+	 * Minimum value = 0, Maximum value = 3 */
+	t_u8 num_retries_per_ftmr;
+	/** 1: request LCI, 0: do not request LCI */
+	t_u8 LCI_request;
+	/** 1: request LCR, 0: do not request LCR */
+	t_u8 LCR_request;
+	/** Applies to 1-sided and 2-sided RTT. Valid values will
+	 * be 2-11 and 15 as specified by the 802.11mc std for
+	 * the FTM parameter burst duration. In a multi-burst
+	 * request, if responder overrides with larger value,
+	 * the initiator will return failure. In a single-burst
+	 * request if responder overrides with larger value,
+	 * the initiator will sent TMR_STOP to terminate RTT
+	 * at the end of the burst_duration it requested. */
+	t_u8 burst_duration;
+	/** RTT preamble to be used in the RTT frames */
+	t_u8 preamble;
+	/** RTT BW to be used in the RTT frames */
+	t_u8 bw;
+} mlan_rtt_config, *pmlan_rtt_config;
+
+/** RTT config params */
+typedef struct _mlan_rtt_config_params {
+	t_u8 rtt_config_num;
+	mlan_rtt_config rtt_config[MAX_RTT_CONFIG_NUM];
+} mlan_rtt_config_params;
+
+/** RTT cancel params */
+typedef struct _mlan_rtt_cancel_params {
+	t_u8 rtt_cancel_num;
+	t_u8 rtt_cancel[MAX_RTT_CONFIG_NUM][MLAN_MAC_ADDR_LENGTH];
+} mlan_rtt_cancel_params;
+
+/** RTT responder info */
+typedef struct _rtt_responder_info {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u8 preamble;
+} rtt_responder_info;
+
+/** RTT responder enable configure */
+typedef struct _rtt_responder_encfg {
+	t_u8 channel;
+	Band_Config_t bandcfg;
+	t_u32 max_dur_sec;
+} rtt_responder_encfg;
+
+/** Define for mlan_rtt_responder.action */
+#define RTT_GET_RESPONDER_INFO 0
+#define RTT_SET_RESPONDER_ENABLE 1
+#define RTT_SET_RESPONDER_DISABLE 2
+#define RTT_SET_RESPONDER_LCI 3
+#define RTT_SET_RESPONDER_LCR 4
+
+/** RTT responder configure for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+typedef struct _mlan_rtt_responder {
+	t_u8 action;
+	union {
+		rtt_responder_info info;
+		rtt_responder_encfg encfg;
+		wifi_lci_information lci;
+		wifi_lcr_information lcr;
+	} u;
+} mlan_rtt_responder;
+
 #if defined(PCIE)
 typedef struct _mlan_ds_ssu_params {
 	t_u32 nskip;
@@ -5885,9 +6054,24 @@ typedef struct _mlan_ds_ch_load {
 	t_s16 noise;
 	t_u16 rx_quality;
 	t_u16 duration;
-	t_u16 cca_th;
 } mlan_ds_ch_load;
 
+/** Type definition of mlan_ds_cross_chip_synch */
+typedef struct _mlan_ds_cross_chip_synch {
+	/**cross chip sync action 0-GET, 1-SET */
+	t_u16 action;
+	/**cross chip sync start or stop */
+	t_u8 start_stop;
+	/**cross chip sync role, master or slave */
+	t_u8 role;
+	/**cross chip sync periodicty of toggle in us */
+	t_u32 period;
+	/**cross chip sync initial TSF low */
+	t_u32 init_tsf_low;
+	/**cross chip sync intial TSF high */
+	t_u32 init_tsf_high;
+} mlan_ds_cross_chip_synch;
+
 /** Type definition of mlan_ds_misc_cfg for MLAN_IOCTL_MISC_CFG */
 typedef struct _mlan_ds_misc_cfg {
 	/** Sub-command */
@@ -6001,11 +6185,18 @@ typedef struct _mlan_ds_misc_cfg {
 		t_u64 misc_tsf;
 		mlan_ds_custom_reg_domain custom_reg_domain;
 		mlan_ds_misc_keep_alive keep_alive;
+		mlan_ds_misc_keep_alive_rx keep_alive_rx;
 		mlan_ds_misc_tx_rx_histogram tx_rx_histogram;
 		mlan_ds_cw_mode_ctrl cwmode;
 		/**  Tx/Rx per-packet control */
 		t_u8 txrx_pkt_ctrl;
 		mlan_ds_misc_robustcoex_params robustcoexparams;
+		/** config RTT for MLAN_OID_MISC_CONFIG_RTT */
+		mlan_rtt_config_params rtt_params;
+		/** cancel RTT for MLAN_OID_MISC_CANCEL_RTT */
+		mlan_rtt_cancel_params rtt_cancel;
+		/** config RTT responder for MLAN_OID_MISC_RTT_RESPONDER_CFG */
+		mlan_rtt_responder rtt_rsp_cfg;
 #if defined(PCIE)
 		mlan_ds_ssu_params ssu_params;
 #endif
@@ -6016,6 +6207,7 @@ typedef struct _mlan_ds_misc_cfg {
 		mlan_ds_misc_mapping_policy dmcs_policy;
 		mlan_ds_misc_dmcs_status dmcs_status;
 		mlan_ds_misc_rx_abort_cfg rx_abort_cfg;
+		mlan_ds_misc_ofdm_desense_cfg ofdm_desense_cfg;
 		mlan_ds_misc_rx_abort_cfg_ext rx_abort_cfg_ext;
 		mlan_ds_misc_tx_ampdu_prot_mode tx_ampdu_prot_mode;
 		mlan_ds_misc_rate_adapt_cfg rate_adapt_cfg;
@@ -6033,6 +6225,7 @@ typedef struct _mlan_ds_misc_cfg {
 		mlan_ds_misc_arb_cfg arb_cfg;
 		mlan_ds_misc_cfp_tbl cfp;
 		t_u8 range_ext_mode;
+		mlan_ds_twt_report twt_report_info;
 		mlan_ds_misc_dot11mc_unassoc_ftm_cfg dot11mc_unassoc_ftm_cfg;
 		mlan_ds_misc_tp_state tp_state;
 		mlan_ds_hal_phy_cfg_params hal_phy_cfg_params;
@@ -6043,6 +6236,7 @@ typedef struct _mlan_ds_misc_cfg {
 #endif
 		t_u32 ips_ctrl;
 		mlan_ds_ch_load ch_load;
+		mlan_ds_cross_chip_synch cross_chip_synch;
 	} param;
 } mlan_ds_misc_cfg, *pmlan_ds_misc_cfg;
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
index de92cad..32e41bf 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.c
@@ -3,7 +3,7 @@
  * @brief This file contains the functions for CFG80211.
  *
  *
- * Copyright 2011-2022 NXP
+ * Copyright 2011-2023 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -198,6 +198,27 @@ void *woal_get_netdev_priv(struct net_device *dev)
 	return (void *)netdev_priv(dev);
 }
 
+/**
+ *  @brief get ieee80211_channel
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param pchan_info   A pointer to chan_band_info structure
+ *
+ *  @return           radio_type
+ */
+struct ieee80211_channel *woal_get_ieee80211_channel(moal_private *priv,
+						     chan_band_info *pchan_info)
+{
+	enum ieee80211_band band = IEEE80211_BAND_2GHZ;
+	int freq = 0;
+	if (pchan_info->bandcfg.chanBand == BAND_2GHZ)
+		band = IEEE80211_BAND_2GHZ;
+	else if (pchan_info->bandcfg.chanBand == BAND_5GHZ)
+		band = IEEE80211_BAND_5GHZ;
+	freq = ieee80211_channel_to_frequency(pchan_info->channel, band);
+	return ieee80211_get_channel(priv->wdev->wiphy, freq);
+}
+
 /**
  *  @brief Get current frequency of active interface
  *
@@ -207,53 +228,20 @@ void *woal_get_netdev_priv(struct net_device *dev)
  */
 int woal_get_active_intf_freq(moal_private *priv)
 {
-	moal_handle *handle = priv->phandle;
-	int i;
-
-	if (priv->media_connected == MTRUE
 #ifdef UAP_SUPPORT
-	    || priv->bss_started == MTRUE
-#endif
-	)
-		return ieee80211_channel_to_frequency(
-			priv->channel
-#if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
-			,
-			(priv->channel <= 14 ? IEEE80211_BAND_2GHZ :
-					       IEEE80211_BAND_5GHZ)
-#endif
-		);
-
-	for (i = 0; i < handle->priv_num; i++) {
-#ifdef STA_SUPPORT
-		if (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_STA) {
-			if (handle->priv[i]->media_connected == MTRUE)
-				return ieee80211_channel_to_frequency(
-					handle->priv[i]->channel
-#if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
-					,
-					(handle->priv[i]->channel <= 14 ?
-						 IEEE80211_BAND_2GHZ :
-						 IEEE80211_BAND_5GHZ)
-#endif
-				);
-		}
-#endif
-#ifdef UAP_SUPPORT
-		if (GET_BSS_ROLE(handle->priv[i]) == MLAN_BSS_ROLE_UAP) {
-			if (handle->priv[i]->bss_started == MTRUE)
-				return ieee80211_channel_to_frequency(
-					handle->priv[i]->channel
-#if KERNEL_VERSION(2, 6, 39) <= CFG80211_VERSION_CODE
-					,
-					(handle->priv[i]->channel <= 14 ?
-						 IEEE80211_BAND_2GHZ :
-						 IEEE80211_BAND_5GHZ)
-#endif
-				);
-		}
+	if (priv->bss_role == MLAN_BSS_ROLE_UAP && priv->bss_started &&
+	    priv->uap_host_based) {
+#if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
+		return priv->chan.chan->center_freq;
 #endif
 	}
+#endif
+#ifdef STA_SUPPORT
+	if (priv->bss_role == MLAN_BSS_ROLE_STA &&
+	    priv->media_connected == MTRUE && priv->sme_current.ssid_len) {
+		return priv->conn_chan.center_freq;
+	}
+#endif
 	return 0;
 }
 
@@ -801,7 +789,7 @@ int woal_cfg80211_init_p2p_client(moal_private *priv)
 	if (bss_role != MLAN_BSS_ROLE_STA) {
 		bss_role = MLAN_BSS_ROLE_STA;
 		if (MLAN_STATUS_SUCCESS !=
-			woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET, &bss_role)) {
+		    woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET, &bss_role)) {
 			ret = -EFAULT;
 			goto done;
 		}
@@ -891,12 +879,11 @@ int woal_cfg80211_init_p2p_go(moal_private *priv)
 	if (bss_role != MLAN_BSS_ROLE_UAP) {
 		bss_role = MLAN_BSS_ROLE_UAP;
 		if (MLAN_STATUS_SUCCESS !=
-			woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET, &bss_role)) {
+		    woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET, &bss_role)) {
 			ret = -EFAULT;
 			goto done;
 		}
 	}
-
 /* NoA:-- Interval = 100TUs and Duration= 50TUs, count=255*/
 #define DEF_NOA_COUNT 255
 	if (priv->phandle->noa_duration && priv->phandle->card_info->go_noa) {
@@ -1257,8 +1244,13 @@ int woal_cfg80211_change_virtual_intf(struct wiphy *wiphy,
 			woal_cfg80211_del_beacon(wiphy, dev);
 #endif
 			bss_role = MLAN_BSS_ROLE_STA;
-			woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET,
-						   &bss_role);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_cfg80211_bss_role_cfg(priv, MLAN_ACT_SET,
+						       &bss_role)) {
+				PRINTM(MERROR,
+				       "%s: WLAN set bss role config failed. \n",
+				       __func__);
+			}
 			PRINTM(MIOCTL, "set bss role for STA\n");
 		}
 #endif
@@ -1620,7 +1612,11 @@ int woal_cfg80211_set_default_key(struct wiphy *wiphy,
 	ENTER();
 	memset(&bss_info, 0, sizeof(mlan_bss_info));
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "%s: WLAN get bss info failed. \n",
+			       __func__);
+		}
 		if (!bss_info.wep_status) {
 			LEAVE();
 			return ret;
@@ -2601,6 +2597,31 @@ void woal_cancel_chanrpt_event(moal_private *priv)
 #endif
 #endif
 
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
+/*
+ * @brief  check if we need set remain_on_channel
+ *
+ * @param priv           A pointer moal_private structure
+ * @param wait           Duration to wait
+ *
+ * @return          MFALSE-no need set remain_on_channel
+ */
+t_u8 woal_check_mgmt_tx_channel(moal_private *priv,
+				struct ieee80211_channel *chan,
+				unsigned int wait)
+{
+	int freq;
+	if (priv->bss_type == MLAN_BSS_TYPE_UAP)
+		return MFALSE;
+	if (wait)
+		return MTRUE;
+	freq = woal_get_active_intf_freq(priv);
+	if (chan->center_freq == freq)
+		return MFALSE;
+	return MTRUE;
+}
+#endif
+
 #if KERNEL_VERSION(3, 2, 0) <= CFG80211_VERSION_CODE
 #if KERNEL_VERSION(3, 3, 0) <= CFG80211_VERSION_CODE
 #if KERNEL_VERSION(3, 6, 0) <= CFG80211_VERSION_CODE
@@ -2749,6 +2770,7 @@ int woal_cfg80211_mgmt_tx(struct wiphy *wiphy,
 	pmlan_buffer pmbuf = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	t_u16 packet_len = 0;
+	t_u16 pkt_len = 0;
 	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 	t_u32 pkt_type;
 	t_u32 tx_control;
@@ -2800,7 +2822,11 @@ int woal_cfg80211_mgmt_tx(struct wiphy *wiphy,
 				if (!priv->bss_started) {
 					PRINTM(MCMND,
 					       "Drop deauth packet before AP started\n");
-					woal_cancel_cac(priv);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+					if (!moal_extflg_isset(priv->phandle,
+							       EXT_DFS_OFFLOAD))
+#endif
+						woal_cancel_cac(priv);
 					goto done;
 				}
 #endif
@@ -2877,7 +2903,7 @@ int woal_cfg80211_mgmt_tx(struct wiphy *wiphy,
 		woal_cancel_scan(priv, MOAL_IOCTL_WAIT);
 #endif
 
-		if (chan && priv->bss_type != MLAN_BSS_ROLE_UAP) {
+		if (chan && woal_check_mgmt_tx_channel(priv, chan, wait)) {
 			duration = (wait > MGMT_TX_DEFAULT_WAIT_TIME) ?
 					   wait :
 					   MGMT_TX_DEFAULT_WAIT_TIME;
@@ -2945,10 +2971,8 @@ int woal_cfg80211_mgmt_tx(struct wiphy *wiphy,
 		ret = -ENOMEM;
 		goto done;
 	}
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+#if KERNEL_VERSION(3, 8, 0) > LINUX_VERSION_CODE
 	*cookie = random32() | 1;
-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
-	*cookie = get_random_u32() | 1;
 #else
 #if KERNEL_VERSION(6, 1, 0) > LINUX_VERSION_CODE
 	*cookie = prandom_u32() | 1;
@@ -2970,9 +2994,10 @@ int woal_cfg80211_mgmt_tx(struct wiphy *wiphy,
 	remain_len -= sizeof(tx_control);
 	/* frmctl + durationid + addr1 + addr2 + addr3 + seqctl */
 #define PACKET_ADDR4_POS (2 + 2 + 6 + 6 + 6 + 2)
+	pkt_len = woal_cpu_to_le16(packet_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), remain_len);
+			&pkt_len, sizeof(pkt_len), remain_len);
 	remain_len -= sizeof(packet_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE +
@@ -3476,8 +3501,8 @@ static t_u8 woal_find_ie(const t_u8 *ie, int len, const t_u8 *spec_ie,
  *
  * @return                out IE length
  */
-static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
-				    t_u8 *ie_out, t_u32 ie_out_len,
+static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie,
+				    size_t len, t_u8 *ie_out, t_u32 ie_out_len,
 				    t_u16 wps_flag, const t_u8 *dup_ie,
 				    int dup_ie_len)
 {
@@ -3546,8 +3571,6 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 		case EXTENDED_SUPPORTED_RATES:
 		case WLAN_EID_ERP_INFO:
 		/* Fall Through */
-		case REGULATORY_CLASS:
-		/* Fall Through */
 		case OVERLAPBSSSCANPARAM:
 		/* Fall Through */
 		case WAPI_IE:
@@ -3689,6 +3712,9 @@ static t_u16 woal_filter_beacon_ies(moal_private *priv, const t_u8 *ie, int len,
 				       "IE too big, fail copy VENDOR_SPECIFIC_221 IE\n");
 			}
 			break;
+		case REGULATORY_CLASS:
+			break;
+			// fall thru to default to add IE
 		default:
 			if ((out_len + length + 2) < (int)ie_out_len) {
 				moal_memcpy_ext(priv->phandle, ie_out + out_len,
@@ -4047,7 +4073,8 @@ int woal_cfg80211_mgmt_frame_ie(
 		     beacon_ies_data->ie_length) ||
 		    (beacon_ies_data->mgmt_subtype_mask ==
 			     MLAN_CUSTOM_IE_DELETE_MASK &&
-		     beacon_vendor_index != MLAN_CUSTOM_IE_AUTO_IDX_MASK)) {
+		     priv->beacon_vendor_index !=
+			     MLAN_CUSTOM_IE_AUTO_IDX_MASK)) {
 			if (MLAN_STATUS_FAILURE ==
 			    woal_cfg80211_custom_ie(
 				    priv, beacon_ies_data, &beacon_vendor_index,
@@ -4406,13 +4433,13 @@ struct ieee80211_supported_band *woal_setup_wiphy_bands(t_u8 ieee_band)
  *  @return             N/A
  */
 void woal_cfg80211_setup_ht_cap(struct ieee80211_sta_ht_cap *ht_info,
-				t_u32 dev_cap, t_u8 *mcs_set)
+				t_u32 dev_cap, t_u8 *mcs_set, t_u8 mpdu_density)
 {
 	ENTER();
 
 	ht_info->ht_supported = true;
 	ht_info->ampdu_factor = 0x3;
-	ht_info->ampdu_density = 0;
+	ht_info->ampdu_density = mpdu_density;
 
 	memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
 	ht_info->cap = 0;
@@ -4487,14 +4514,14 @@ void woal_cfg80211_setup_vht_cap(moal_private *priv,
 	}
 	vht_cap->vht_supported = true;
 	vht_cap->cap = cfg_11ac->param.vht_cfg.vht_cap_info;
-	vht_cap->vht_mcs.rx_mcs_map =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_rx_mcs;
-	vht_cap->vht_mcs.rx_highest =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_rx_max_rate;
-	vht_cap->vht_mcs.tx_mcs_map =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_tx_mcs;
-	vht_cap->vht_mcs.tx_highest =
-		(__force __le16)cfg_11ac->param.vht_cfg.vht_tx_max_rate;
+	vht_cap->vht_mcs.rx_mcs_map = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_rx_mcs);
+	vht_cap->vht_mcs.rx_highest = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_rx_max_rate);
+	vht_cap->vht_mcs.tx_mcs_map = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_tx_mcs);
+	vht_cap->vht_mcs.tx_highest = (__force __le16)woal_cpu_to_le16(
+		cfg_11ac->param.vht_cfg.vht_tx_max_rate);
 	PRINTM(MCMND,
 	       "vht_cap=0x%x rx_mcs_map=0x%x rx_max=0x%x tx_mcs_map=0x%x tx_max=0x%x\n",
 	       vht_cap->cap, vht_cap->vht_mcs.rx_mcs_map,
@@ -4680,6 +4707,8 @@ void woal_cfg80211_setup_he_cap(moal_private *priv,
 	mlan_ds_11ax_he_capa *phe_cap = NULL;
 	t_u8 hw_hecap_len;
 
+	memset(&fw_info, 0, sizeof(mlan_fw_info));
+
 	woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info);
 	if (band->band == NL80211_BAND_5GHZ) {
 		phe_cap = (mlan_ds_11ax_he_capa *)fw_info.hw_he_cap;
@@ -4994,17 +5023,26 @@ void woal_cfg80211_notify_channel(moal_private *priv,
 	int freq = 0;
 #endif
 #endif
+	struct ieee80211_channel *chan;
 	ENTER();
 
+	/* save the new channel for station interface */
+	if (priv->sme_current.ssid_len) {
+		chan = woal_get_ieee80211_channel(priv, pchan_info);
+		if (chan) {
+			moal_memcpy_ext(priv->phandle, &priv->conn_chan, chan,
+					sizeof(struct ieee80211_channel),
+					sizeof(struct ieee80211_channel));
+		}
+	}
+
 #if KERNEL_VERSION(3, 8, 0) <= CFG80211_VERSION_CODE
 	if (MLAN_STATUS_SUCCESS ==
 	    woal_chandef_create(priv, &chandef, pchan_info)) {
 #if KERNEL_VERSION(3, 14, 0) <= CFG80211_VERSION_CODE
 		mutex_lock(&priv->wdev->mtx);
 #endif
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
-		cfg80211_ch_switch_notify(priv->netdev, &chandef, 0, 0);
-#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 1, 0) && IMX_ANDROID_13))
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
 		cfg80211_ch_switch_notify(priv->netdev, &chandef, 0, 0);
 #elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
 		cfg80211_ch_switch_notify(priv->netdev, &chandef, 0);
@@ -5146,13 +5184,15 @@ void woal_cfg80211_notify_antcfg(moal_private *priv, struct wiphy *wiphy,
 				bands->ht_cap.mcs.rx_mask[1] = 0;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 				bands->vht_cap.vht_mcs.rx_mcs_map =
-					(__force __le16)0xfffe;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffe);
 				bands->vht_cap.vht_mcs.tx_mcs_map =
-					(__force __le16)0xfffe;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffe);
 				bands->vht_cap.vht_mcs.rx_highest =
-					(__force __le16)0x186;
+					(__force __le16)woal_cpu_to_le16(0x186);
 				bands->vht_cap.vht_mcs.tx_highest =
-					(__force __le16)0x186;
+					(__force __le16)woal_cpu_to_le16(0x186);
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 				if (bands->n_iftype_data &&
@@ -5182,13 +5222,15 @@ void woal_cfg80211_notify_antcfg(moal_private *priv, struct wiphy *wiphy,
 				bands->ht_cap.mcs.rx_mask[1] = 0xff;
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 				bands->vht_cap.vht_mcs.rx_mcs_map =
-					(__force __le16)0xfffa;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffa);
 				bands->vht_cap.vht_mcs.tx_mcs_map =
-					(__force __le16)0xfffa;
+					(__force __le16)woal_cpu_to_le16(
+						0xfffa);
 				bands->vht_cap.vht_mcs.rx_highest =
-					(__force __le16)0x30c;
+					(__force __le16)woal_cpu_to_le16(0x30c);
 				bands->vht_cap.vht_mcs.tx_highest =
-					(__force __le16)0x30c;
+					(__force __le16)woal_cpu_to_le16(0x30c);
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 				if (bands->n_iftype_data &&
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
index d9ca184..d658442 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211.h
@@ -58,7 +58,6 @@
 
 /* define for custom ie operation */
 #define MLAN_CUSTOM_IE_AUTO_IDX_MASK 0xffff
-#define MLAN_CUSTOM_IE_NEW_MASK 0x8000
 #define IE_MASK_WPS 0x0001
 #define IE_MASK_P2P 0x0002
 #define IE_MASK_WFD 0x0004
@@ -532,7 +531,8 @@ int woal_cfg80211_mgmt_frame_ie(
 int woal_get_active_intf_freq(moal_private *priv);
 
 void woal_cfg80211_setup_ht_cap(struct ieee80211_sta_ht_cap *ht_info,
-				t_u32 dev_cap, t_u8 *mcs_set);
+				t_u32 dev_cap, t_u8 *mcs_set,
+				t_u8 mpdu_density);
 #if KERNEL_VERSION(3, 6, 0) <= CFG80211_VERSION_CODE
 void woal_cfg80211_setup_vht_cap(moal_private *priv,
 				 struct ieee80211_sta_vht_cap *vht_cap);
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
index 0b885aa..3a01621 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.c
@@ -116,6 +116,10 @@ static const struct nl80211_vendor_cmd_info vendor_events[] = {
 		.vendor_id = MRVL_VENDOR_ID,
 		.subcmd = event_wake_reason_report,
 	},
+	{
+		.vendor_id = MRVL_VENDOR_ID,
+		.subcmd = event_rtt_result,
+	}, /*event_id ???*/
 	/**add vendor event here*/
 };
 
@@ -149,6 +153,17 @@ static const struct nla_policy
 };
 // clang-format on
 
+static const struct nla_policy woal_rtt_policy[ATTR_RTT_MAX + 1] = {
+	[ATTR_RTT_TARGET_NUM] = {.type = NLA_U8},
+	[ATTR_RTT_TARGET_CONFIG] = {.type = NLA_BINARY},
+	[ATTR_RTT_TARGET_ADDR] = {.type = NLA_STRING, .len = ETH_ALEN},
+	[ATTR_RTT_CHANNEL_INFO] = {.type = NLA_BINARY},
+	[ATTR_RTT_MAX_DUR_SEC] = {.type = NLA_U32},
+	[ATTR_RTT_LCI_INFO] = {.type = NLA_BINARY},
+	[ATTR_RTT_LCR_INFO] = {.type = NLA_BINARY},
+
+};
+
 static const struct nla_policy
 	woal_rssi_monitor_policy[ATTR_RSSI_MONITOR_MAX + 1] = {
 		[ATTR_RSSI_MONITOR_CONTROL] = {.type = NLA_U32},
@@ -282,6 +297,54 @@ void woal_cfg80211_vendor_event_fw_dump(moal_private *priv)
 }
 #endif
 
+/**
+ * @brief send vendor event to kernel
+ *
+ * @param priv       A pointer to moal_private
+ * @param event    vendor event
+ * @param  len     data length
+ *
+ * @return      0: success  1: fail
+ */
+static struct sk_buff *woal_cfg80211_alloc_vendor_event(moal_private *priv,
+							int event, int len)
+{
+	struct wiphy *wiphy = NULL;
+	struct sk_buff *skb = NULL;
+	int event_id = 0;
+
+	ENTER();
+
+	if (!priv || !priv->wdev || !priv->wdev->wiphy) {
+		PRINTM(MERROR, "Not find this event %d\n", event_id);
+		goto done;
+	}
+	wiphy = priv->wdev->wiphy;
+	PRINTM(MEVENT, "vendor event :0x%x\n", event);
+	event_id = woal_get_event_id(event);
+	if (event_max == event_id) {
+		PRINTM(MERROR, "Not find this event %d\n", event_id);
+		goto done;
+	}
+
+	/**allocate skb*/
+#if KERNEL_VERSION(4, 1, 0) <= CFG80211_VERSION_CODE
+	skb = cfg80211_vendor_event_alloc(wiphy, priv->wdev, len, event_id,
+					  GFP_ATOMIC);
+#else
+	skb = cfg80211_vendor_event_alloc(wiphy, len, event_id, GFP_ATOMIC);
+#endif
+
+	if (!skb) {
+		PRINTM(MERROR, "allocate memory fail for vendor event\n");
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return skb;
+}
+
 /**
  * @brief send dfs vendor event to kernel
  *
@@ -734,11 +797,13 @@ static int woal_cfg80211_subcmd_get_drv_dump(struct wiphy *wiphy,
 	priv = (moal_private *)woal_get_netdev_priv(dev);
 	handle = priv->phandle;
 	memset(driver_dump_file, 0, sizeof(driver_dump_file));
-	sprintf(driver_dump_file, "/proc/mwlan/");
+	snprintf(driver_dump_file, sizeof(driver_dump_file), "/proc/mwlan/");
 	if (handle->handle_idx)
-		sprintf(driver_dump_file, "drv_dump%d", handle->handle_idx);
+		snprintf(driver_dump_file, sizeof(driver_dump_file),
+			 "drv_dump%d", handle->handle_idx);
 	else
-		sprintf(driver_dump_file, "drv_dump");
+		snprintf(driver_dump_file, sizeof(driver_dump_file),
+			 "drv_dump");
 	PRINTM(MMSG, "driver dump file is %s\n", driver_dump_file);
 	length = sizeof(driver_dump_file);
 	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, length);
@@ -806,6 +871,8 @@ static int woal_cfg80211_subcmd_get_supp_feature_set(struct wiphy *wiphy,
 	}
 	if (fw_info.fw_bands & BAND_A)
 		supp_feature_set |= WLAN_FEATURE_INFRA_5G;
+	if (fw_info.rtt_support)
+		supp_feature_set |= WLAN_FEATURE_D2AP_RTT;
 	if (fw_info.fw_roaming_support)
 		supp_feature_set |= WLAN_FEATURE_CONTROL_ROAMING;
 
@@ -1653,6 +1720,7 @@ int woal_ring_push_data(moal_private *priv, int ring_id,
 
 	if ((ring->wp + w_len) > ring->ring_size ||
 	    (ring->ctrl.written_bytes + w_len) > ring->ring_size) {
+		spin_unlock_irqrestore(&ring->lock, flags);
 		PRINTM(MERROR,
 		       "Ring push buffer overflow: rp=%d  wp=%d, write_bytes=%d\n",
 		       ring->rp, ring->wp, ring->ctrl.written_bytes);
@@ -2339,7 +2407,7 @@ static int woal_cfg80211_subcmd_set_packet_filter(struct wiphy *wiphy,
 				nla_data(iter),
 				MIN(packet_filter_len, nla_len(iter)));
 			pkt_filter->packet_filter_len =
-				MIN(packet_filter_len, nla_len(iter));
+				(t_u8)MIN(packet_filter_len, nla_len(iter));
 			pkt_filter->state = PACKET_FILTER_STATE_START;
 			spin_unlock_irqrestore(&pkt_filter->lock, flags);
 			DBG_HEXDUMP(MDAT_D, "packet_filter_program",
@@ -3283,7 +3351,47 @@ void woal_cfg80211_rssi_monitor_event(moal_private *priv, t_s16 rssi)
 done:
 	LEAVE();
 }
-#endif
+
+/**
+ * @brief send driver hang vendor event to kernel
+ *
+ * @param priv          A pointer to moal_private
+ * @param reload_mode   reload mode
+ *
+ * @return      N/A
+ */
+void woal_cfg80211_driver_hang_event(moal_private *priv, t_u8 reload_mode)
+{
+	struct sk_buff *skb = NULL;
+
+	ENTER();
+
+	skb = dev_alloc_skb(NLA_HDRLEN + sizeof(t_u8));
+	if (!skb) {
+		PRINTM(MERROR,
+		       "woal_cfg80211_driver_hang_event: Failed to allocate skb");
+		goto done;
+	}
+
+	if (nla_put_u8(skb, ATTR_FW_RELOAD_MODE, reload_mode)) {
+		PRINTM(MERROR,
+		       "woal_cfg80211_driver_hang_event: nla_put failed!\n");
+		kfree(skb);
+		goto done;
+	}
+
+	PRINTM(MMSG,
+	       "woal_cfg80211_driver_hang_event: Send event_hang with reload mode: %d",
+	       reload_mode);
+	woal_cfg80211_vendor_event(priv, event_hang, (t_u8 *)skb->data,
+				   skb->len);
+
+	kfree(skb);
+done:
+	LEAVE();
+}
+
+#endif // STA_CFG80211
 
 /**
  * @brief vendor command to key_mgmt_set_key
@@ -3771,7 +3879,7 @@ static int woal_cfg80211_subcmd_set_scan_mac_oui(struct wiphy *wiphy,
 	struct net_device *dev = NULL;
 	moal_private *priv = NULL;
 	struct nlattr *tb_vendor[ATTR_WIFI_MAX + 1];
-	t_u8 mac_oui[3];
+	t_u8 mac_oui[3] = {0};
 	int ret = MLAN_STATUS_SUCCESS;
 
 	ENTER();
@@ -4075,6 +4183,793 @@ static int woal_cfg80211_subcmd_set_dfs_offload(struct wiphy *wiphy,
 	return ret;
 }
 
+/**
+ * @brief vendor command to get rtt capability
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_get_capa(struct wiphy *wiphy,
+					     struct wireless_dev *wdev,
+					     const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_handle *handle = priv->phandle;
+	struct sk_buff *skb = NULL;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "CfgVendor: cfg80211_subcmd_rtt_get_capa\n");
+
+	DBG_HEXDUMP(MCMD_D, "input data", (t_u8 *)data, len);
+
+	/* Alloc the SKB for vendor_event */
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(
+		wiphy, nla_total_size(sizeof(handle->rtt_capa)) +
+			       VENDOR_REPLY_OVERHEAD);
+	if (unlikely(!skb)) {
+		PRINTM(MERROR, "skb alloc failed in %s\n", __func__);
+		goto done;
+	}
+
+	/* Put the attribute to the skb */
+	nla_put(skb, ATTR_RTT_CAPA, sizeof(handle->rtt_capa),
+		&(handle->rtt_capa));
+
+	PRINTM(MCMND, "NL80211_CMD_VENDOR=0x%x\n", NL80211_CMD_VENDOR);
+	PRINTM(MCMND, "NL80211_ATTR_WIPHY=0x%x\n", NL80211_ATTR_WIPHY);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_ID=0x%x\n", NL80211_ATTR_VENDOR_ID);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_SUBCMD=0x%x\n",
+	       NL80211_ATTR_VENDOR_SUBCMD);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_DATA=0x%x\n",
+	       NL80211_ATTR_VENDOR_DATA);
+	PRINTM(MCMND, "NL80211_ATTR_VENDOR_EVENTS=0x%x\n",
+	       NL80211_ATTR_VENDOR_EVENTS);
+
+	DBG_HEXDUMP(MCMD_D, "output data skb->head", (t_u8 *)skb->head, 50);
+	DBG_HEXDUMP(MCMD_D, "output data skb->data", (t_u8 *)skb->data, 50);
+	err = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(err))
+		PRINTM(MERROR, "Vendor Command reply failed err:%d\n", err);
+
+done:
+	LEAVE();
+	return err;
+}
+
+static void woal_dump_rtt_params(wifi_rtt_config_params_t *rtt_params)
+{
+	int i = 0;
+
+	PRINTM(MMSG, "===== Start DUMP RTT Params =====\n");
+	PRINTM(MMSG, "rtt_config_num=%d\n\n", rtt_params->rtt_config_num);
+
+	for (i = 0; i < rtt_params->rtt_config_num; i++) {
+		PRINTM(MMSG, "----------[%d]----------\n", i);
+		PRINTM(MMSG, "rtt_config[%d].addr=" MACSTR "\n", i,
+		       MAC2STR(rtt_params->rtt_config[i].addr));
+		PRINTM(MMSG, "rtt_config[%d].type=%d\n", i,
+		       rtt_params->rtt_config[i].type);
+		PRINTM(MMSG, "rtt_config[%d].peer=%d\n", i,
+		       rtt_params->rtt_config[i].peer);
+		PRINTM(MMSG, "rtt_config[%d].channel=[%d %d %d %d]\n", i,
+		       rtt_params->rtt_config[i].channel.width,
+		       rtt_params->rtt_config[i].channel.center_freq,
+		       rtt_params->rtt_config[i].channel.center_freq0,
+		       rtt_params->rtt_config[i].channel.center_freq1);
+		PRINTM(MMSG, "rtt_config[%d].burst_period=%d\n", i,
+		       rtt_params->rtt_config[i].burst_period);
+		PRINTM(MMSG, "rtt_config[%d].num_burst=%d\n", i,
+		       rtt_params->rtt_config[i].num_burst);
+		PRINTM(MMSG, "rtt_config[%d].num_frames_per_burst=%d\n", i,
+		       rtt_params->rtt_config[i].num_frames_per_burst);
+		PRINTM(MMSG, "rtt_config[%d].num_retries_per_rtt_frame=%d\n", i,
+		       rtt_params->rtt_config[i].num_retries_per_rtt_frame);
+		PRINTM(MMSG, "rtt_config[%d].num_retries_per_ftmr=%d\n", i,
+		       rtt_params->rtt_config[i].num_retries_per_ftmr);
+		PRINTM(MMSG, "rtt_config[%d].LCI_request=%d\n", i,
+		       rtt_params->rtt_config[i].LCI_request);
+		PRINTM(MMSG, "rtt_config[%d].LCR_request=%d\n", i,
+		       rtt_params->rtt_config[i].LCR_request);
+		PRINTM(MMSG, "rtt_config[%d].burst_duration=%d\n", i,
+		       rtt_params->rtt_config[i].burst_duration);
+		PRINTM(MMSG, "rtt_config[%d].preamble=%d\n", i,
+		       rtt_params->rtt_config[i].preamble);
+		PRINTM(MMSG, "rtt_config[%d].bw=%d\n", i,
+		       rtt_params->rtt_config[i].bw);
+		PRINTM(MMSG, "\n");
+	}
+}
+
+/**
+ * @brief vendor command to request rtt range
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_range_request(struct wiphy *wiphy,
+						  struct wireless_dev *wdev,
+						  const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_handle *handle = priv->phandle;
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	t_u8 zero_mac[MLAN_MAC_ADDR_LENGTH] = {0};
+	t_u8 rtt_config_num = 0;
+	wifi_rtt_config *rtt_config = NULL;
+	t_u8 i = 0, j = 0;
+	wifi_rtt_config_params_t rtt_params;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_TARGET_NUM] || !tb[ATTR_RTT_TARGET_CONFIG]) {
+		PRINTM(MERROR,
+		       "%s: null attr: tb[ATTR_RTT_TARGET_NUM]=%p tb[ATTR_RTT_TARGET_CONFIG]=%p\n",
+		       __func__, tb[ATTR_RTT_TARGET_NUM],
+		       tb[ATTR_RTT_TARGET_CONFIG]);
+		err = -EINVAL;
+		goto done;
+	}
+
+	rtt_config_num = nla_get_u8(tb[ATTR_RTT_TARGET_NUM]);
+
+	if ((rtt_config_num == 0) || ((handle->rtt_params.rtt_config_num +
+				       rtt_config_num) > MAX_RTT_CONFIG_NUM)) {
+		PRINTM(MERROR, "%s: invalid num=%d  num in handle=%d  MAX=%d\n",
+		       __func__, rtt_config_num,
+		       handle->rtt_params.rtt_config_num, MAX_RTT_CONFIG_NUM);
+		err = -EINVAL;
+		goto done;
+	}
+	if (nla_len(tb[ATTR_RTT_TARGET_CONFIG]) !=
+	    sizeof(rtt_params.rtt_config[0]) * rtt_config_num) {
+		PRINTM(MERROR, "%s: invalid %d(total) != %d(num) * %lu(each)\n",
+		       __func__, nla_len(tb[ATTR_RTT_TARGET_CONFIG]),
+		       rtt_config_num, sizeof(rtt_params.rtt_config[0]));
+		err = -EINVAL;
+		goto done;
+	}
+
+	rtt_config = (wifi_rtt_config *)nla_data(tb[ATTR_RTT_TARGET_CONFIG]);
+	memset(&rtt_params, 0, sizeof(rtt_params));
+	/** Strip the zero mac config */
+	for (i = 0; i < rtt_config_num; i++) {
+		if (!memcmp(rtt_config[i].addr, zero_mac,
+			    sizeof(rtt_config[i].addr)))
+			continue;
+		else {
+			moal_memcpy_ext(
+				handle,
+				&rtt_params
+					 .rtt_config[rtt_params.rtt_config_num],
+				&rtt_config[i],
+				sizeof(rtt_params.rtt_config
+					       [rtt_params.rtt_config_num]),
+				sizeof(wifi_rtt_config));
+			rtt_params.rtt_config_num++;
+		}
+	}
+	if (!rtt_params.rtt_config_num) {
+		PRINTM(MERROR, "%s: no valid mac addr\n", __func__);
+		goto done;
+	}
+	woal_dump_rtt_params(&rtt_params);
+
+	ret = woal_config_rtt(priv, MOAL_IOCTL_WAIT, &rtt_params);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_config_rtt() failed\n", __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+	for (i = 0; i < rtt_params.rtt_config_num; i++) {
+		for (j = 0; j < handle->rtt_params.rtt_config_num; j++) {
+			if (!memcmp(handle->rtt_params.rtt_config[j].addr,
+				    rtt_params.rtt_config[i].addr,
+				    sizeof(handle->rtt_params.rtt_config[j]
+						   .addr)))
+				break;
+		}
+		moal_memcpy_ext(handle, &(handle->rtt_params.rtt_config[j]),
+				&(rtt_params.rtt_config[i]),
+				sizeof(handle->rtt_params.rtt_config[j]),
+				sizeof(wifi_rtt_config));
+		if (j == handle->rtt_params.rtt_config_num)
+			handle->rtt_params.rtt_config_num++;
+	}
+
+	woal_dump_rtt_params(&(handle->rtt_params));
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to cancel rtt range
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_range_cancel(struct wiphy *wiphy,
+						 struct wireless_dev *wdev,
+						 const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	moal_handle *handle = priv->phandle;
+	t_u8 rtt_config_num = handle->rtt_params.rtt_config_num;
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	t_u32 target_num = 0;
+	t_u8 addr[MAX_RTT_CONFIG_NUM][MLAN_MAC_ADDR_LENGTH];
+	int i = 0, j = 0;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_TARGET_NUM] || !tb[ATTR_RTT_TARGET_ADDR]) {
+		PRINTM(MERROR,
+		       "%s: null attr: tb[ATTR_RTT_TARGET_NUM]=%p tb[ATTR_RTT_TARGET_ADDR]=%p\n",
+		       __func__, tb[ATTR_RTT_TARGET_NUM],
+		       tb[ATTR_RTT_TARGET_ADDR]);
+		err = -EINVAL;
+		goto done;
+	}
+
+	target_num = nla_get_u8(tb[ATTR_RTT_TARGET_NUM]);
+
+	if ((target_num <= 0 || target_num > MAX_RTT_CONFIG_NUM) ||
+	    (nla_len(tb[ATTR_RTT_TARGET_ADDR]) !=
+	     sizeof(t_u8) * MLAN_MAC_ADDR_LENGTH * target_num)) {
+		PRINTM(MERROR, "%s: Check if %din[1-%d] or %d*%lu=%d\n",
+		       __func__, target_num, MAX_RTT_CONFIG_NUM, target_num,
+		       sizeof(t_u8) * MLAN_MAC_ADDR_LENGTH,
+		       nla_len(tb[ATTR_RTT_TARGET_ADDR]));
+		err = -EINVAL;
+		goto done;
+	}
+	woal_dump_rtt_params(&(handle->rtt_params));
+
+	moal_memcpy_ext(handle, addr, nla_data(tb[ATTR_RTT_TARGET_ADDR]),
+			nla_len(tb[ATTR_RTT_TARGET_ADDR]), sizeof(addr));
+
+	for (i = 0; i < target_num; i++)
+		PRINTM(MMSG, "cancel[%d].addr=" MACSTR "\n", i,
+		       MAC2STR(addr[i]));
+
+	for (i = 0; i < target_num; i++) {
+		for (j = 0; j < handle->rtt_params.rtt_config_num; j++) {
+			if (!memcmp(addr[i],
+				    handle->rtt_params.rtt_config[j].addr,
+				    sizeof(addr[0]))) {
+				memset(&(handle->rtt_params.rtt_config[j]),
+				       0x00,
+				       sizeof(handle->rtt_params.rtt_config[0]));
+				if ((j + 1) <
+				    handle->rtt_params.rtt_config_num) {
+					memmove(&(handle->rtt_params
+							  .rtt_config[j]),
+						&(handle->rtt_params
+							  .rtt_config[j + 1]),
+						sizeof(handle->rtt_params
+							       .rtt_config[0]) *
+							(handle->rtt_params
+								 .rtt_config_num -
+							 (j + 1)));
+					memset(&(handle->rtt_params.rtt_config
+							 [handle->rtt_params
+								  .rtt_config_num -
+							  1]),
+					       0x00,
+					       sizeof(handle->rtt_params
+							      .rtt_config[0]));
+				}
+				handle->rtt_params.rtt_config_num--;
+				continue;
+			}
+		}
+	}
+
+	if (handle->rtt_params.rtt_config_num >= rtt_config_num) {
+		PRINTM(MERROR, "%s: No matched mac addr in rtt_config\n",
+		       __func__);
+		goto done;
+	}
+
+	ret = woal_cancel_rtt(priv, MOAL_IOCTL_WAIT, target_num, addr);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_cancel_rtt() failed\n", __func__);
+		err = -EFAULT;
+		goto done;
+	}
+	woal_dump_rtt_params(&(handle->rtt_params));
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor event to report RTT Results
+ *
+ * @param priv     A pointer to moal_private
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      mlan_status
+ */
+mlan_status woal_cfg80211_event_rtt_result(moal_private *priv, t_u8 *data,
+					   int len)
+{
+	// moal_handle *handle = priv->phandle;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	t_u8 *pos = data;
+	t_u32 event_left_len = len;
+	struct sk_buff *skb = NULL;
+	t_u32 vdr_event_len = 0;
+	t_u32 complete = 0;
+	wifi_rtt_result_element *rtt_result_elem = NULL;
+	t_u32 num_results = 0;
+
+	ENTER();
+
+	PRINTM(MEVENT, "Enter %s()\n", __func__);
+
+	vdr_event_len = nla_total_size(sizeof(complete)) +
+			nla_total_size(sizeof(num_results)) +
+			nla_total_size(len) + NLA_ALIGNTO * num_results +
+			VENDOR_REPLY_OVERHEAD;
+	PRINTM(MEVENT, "vdr_event_len = %d\n", vdr_event_len);
+	skb = woal_cfg80211_alloc_vendor_event(priv, event_rtt_result,
+					       vdr_event_len);
+	if (!skb)
+		goto done;
+
+	complete = *pos;
+	nla_put(skb, ATTR_RTT_RESULT_COMPLETE, sizeof(complete), &complete);
+	pos++;
+	event_left_len--;
+
+	while (event_left_len > sizeof(wifi_rtt_result_element)) {
+		rtt_result_elem = (wifi_rtt_result_element *)pos;
+
+		nla_put(skb, ATTR_RTT_RESULT_FULL, rtt_result_elem->len,
+			rtt_result_elem->data);
+		num_results++;
+
+		pos += sizeof(*rtt_result_elem) + rtt_result_elem->len;
+		event_left_len -=
+			sizeof(*rtt_result_elem) + rtt_result_elem->len;
+	}
+
+	nla_put(skb, ATTR_RTT_RESULT_NUM, sizeof(num_results), &num_results);
+
+	DBG_HEXDUMP(MEVT_D, "output data skb->data", (t_u8 *)skb->data,
+		    skb->len);
+	/**send event*/
+	cfg80211_vendor_event(skb, GFP_KERNEL);
+
+done:
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief vendor command to get rtt responder info
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int
+woal_cfg80211_subcmd_rtt_get_responder_info(struct wiphy *wiphy,
+					    struct wireless_dev *wdev,
+					    const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_rtt_responder rtt_rsp_cfg;
+	struct sk_buff *skb = NULL;
+	wifi_rtt_responder rtt_rsp;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_GET_RESPONDER_INFO;
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+	PRINTM(MCMD_D,
+	       "mlan_rtt_responder from FW: channel=%d bandcfg=%d %d %d %d preamble=%d\n",
+	       rtt_rsp_cfg.u.info.channel, rtt_rsp_cfg.u.info.bandcfg.chanBand,
+	       rtt_rsp_cfg.u.info.bandcfg.chanWidth,
+	       rtt_rsp_cfg.u.info.bandcfg.chan2Offset,
+	       rtt_rsp_cfg.u.info.bandcfg.scanMode,
+	       rtt_rsp_cfg.u.info.preamble);
+
+	memset(&rtt_rsp, 0x00, sizeof(rtt_rsp));
+	woal_bandcfg_to_channel_info(priv, &(rtt_rsp_cfg.u.info.bandcfg),
+				     rtt_rsp_cfg.u.info.channel,
+				     &(rtt_rsp.channel));
+	rtt_rsp.preamble = rtt_rsp_cfg.u.info.preamble;
+	PRINTM(MCMD_D, "wifi_rtt_responder report to HAL:\n");
+	PRINTM(MCMD_D,
+	       "channel: width=%d center_freq=%d center_freq0=%d center_freq1=%d\n",
+	       rtt_rsp.channel.width, rtt_rsp.channel.center_freq,
+	       rtt_rsp.channel.center_freq0, rtt_rsp.channel.center_freq1);
+	PRINTM(MCMD_D, "preamble=%d\n", rtt_rsp.preamble);
+
+	/* Alloc the SKB for vendor_event */
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(
+		wiphy, nla_total_size(sizeof(rtt_rsp)) + VENDOR_REPLY_OVERHEAD);
+	if (unlikely(!skb)) {
+		PRINTM(MERROR, "skb alloc failed in %s\n", __func__);
+		goto done;
+	}
+
+	/* Put the attribute to the skb */
+	nla_put(skb, ATTR_RTT_CHANNEL_INFO, sizeof(rtt_rsp.channel),
+		&(rtt_rsp.channel));
+	nla_put(skb, ATTR_RTT_PREAMBLE, sizeof(rtt_rsp.preamble),
+		&(rtt_rsp.preamble));
+	DBG_HEXDUMP(MCMD_D, "output data skb->data", (t_u8 *)skb->data,
+		    skb->len);
+
+	err = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(err))
+		PRINTM(MERROR, "Vendor Command reply failed err:%d\n", err);
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to enable rtt responder
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_enable_responder(struct wiphy *wiphy,
+						     struct wireless_dev *wdev,
+						     const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	wifi_channel_info *ch_info = NULL;
+	t_u32 max_dur_sec = 0;
+	mlan_rtt_responder rtt_rsp_cfg;
+	wifi_rtt_responder rtt_rsp;
+	struct sk_buff *skb = NULL;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_CHANNEL_INFO] || !tb[ATTR_RTT_MAX_DUR_SEC]) {
+		PRINTM(MERROR,
+		       "%s: null attr: tb[ATTR_RTT_TARGET_NUM]=%p tb[ATTR_RTT_TARGET_CONFIG]=%p\n",
+		       __func__, tb[ATTR_RTT_CHANNEL_INFO],
+		       tb[ATTR_RTT_MAX_DUR_SEC]);
+		err = -EINVAL;
+		goto done;
+	}
+	ch_info = (wifi_channel_info *)nla_data(tb[ATTR_RTT_CHANNEL_INFO]);
+	max_dur_sec = nla_get_u32(tb[ATTR_RTT_MAX_DUR_SEC]);
+	PRINTM(MCMD_D, "HAL input:\n");
+	PRINTM(MCMD_D,
+	       "wifi_channel_info: width=%d center_freq=%d center_freq0=%d center_freq1=%d\n",
+	       ch_info->width, ch_info->center_freq, ch_info->center_freq0,
+	       ch_info->center_freq1);
+	PRINTM(MCMD_D, "max_dur_sec=%d\n", max_dur_sec);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_ENABLE;
+	rtt_rsp_cfg.u.encfg.channel =
+		ieee80211_frequency_to_channel(ch_info->center_freq);
+	woal_channel_info_to_bandcfg(priv, ch_info,
+				     &(rtt_rsp_cfg.u.encfg.bandcfg));
+	rtt_rsp_cfg.u.encfg.max_dur_sec = max_dur_sec;
+	PRINTM(MCMD_D, "HAL input to rtt_responder_encfg:\n");
+	PRINTM(MCMD_D,
+	       "channel=%d bandcfg=[chanBand=%d chanWidth=%d chan2Offset=%d scanMode=%d]\n",
+	       rtt_rsp_cfg.u.encfg.channel,
+	       rtt_rsp_cfg.u.encfg.bandcfg.chanBand,
+	       rtt_rsp_cfg.u.encfg.bandcfg.chanWidth,
+	       rtt_rsp_cfg.u.encfg.bandcfg.chan2Offset,
+	       rtt_rsp_cfg.u.encfg.bandcfg.scanMode);
+	PRINTM(MCMD_D, "max_dur_sec=%d\n", rtt_rsp_cfg.u.encfg.max_dur_sec);
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+	memset(&rtt_rsp, 0x00, sizeof(rtt_rsp));
+	woal_bandcfg_to_channel_info(priv, &(rtt_rsp_cfg.u.info.bandcfg),
+				     rtt_rsp_cfg.u.info.channel,
+				     &(rtt_rsp.channel));
+	rtt_rsp.preamble = rtt_rsp_cfg.u.info.preamble;
+	PRINTM(MCMD_D, "wifi_rtt_responder report to HAL:\n");
+	PRINTM(MCMD_D,
+	       "channel: width=%d center_freq=%d center_freq0=%d center_freq1=%d\n",
+	       rtt_rsp.channel.width, rtt_rsp.channel.center_freq,
+	       rtt_rsp.channel.center_freq0, rtt_rsp.channel.center_freq1);
+	PRINTM(MCMD_D, "preamble=%d\n", rtt_rsp.preamble);
+
+	/* Alloc the SKB for vendor_event */
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(
+		wiphy, nla_total_size(sizeof(rtt_rsp)) + VENDOR_REPLY_OVERHEAD);
+	if (unlikely(!skb)) {
+		PRINTM(MERROR, "skb alloc failed in %s\n", __func__);
+		goto done;
+	}
+
+	/* Put the attribute to the skb */
+	nla_put(skb, ATTR_RTT_CHANNEL_INFO, sizeof(rtt_rsp.channel),
+		&(rtt_rsp.channel));
+	nla_put(skb, ATTR_RTT_PREAMBLE, sizeof(rtt_rsp.preamble),
+		&(rtt_rsp.preamble));
+	DBG_HEXDUMP(MCMD_D, "output data skb->data", (t_u8 *)skb->data,
+		    skb->len);
+
+	err = cfg80211_vendor_cmd_reply(skb);
+	if (unlikely(err))
+		PRINTM(MERROR, "Vendor Command reply failed err:%d\n", err);
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to disable rtt responder
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_disable_responder(struct wiphy *wiphy,
+						      struct wireless_dev *wdev,
+						      const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	mlan_rtt_responder rtt_rsp_cfg;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_DISABLE;
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to set rtt lci
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_set_lci(struct wiphy *wiphy,
+					    struct wireless_dev *wdev,
+					    const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	mlan_rtt_responder rtt_rsp_cfg;
+	wifi_lci_information *lci_info;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_LCI_INFO]) {
+		PRINTM(MERROR, "%s: null attr: tb[ATTR_RTT_LCI_INFO]=%p\n",
+		       __func__, tb[ATTR_RTT_LCI_INFO]);
+		err = -EINVAL;
+		goto done;
+	}
+	lci_info = (wifi_lci_information *)nla_data(tb[ATTR_RTT_LCI_INFO]);
+	PRINTM(MCMD_D, "HAL input:\n");
+	PRINTM(MCMD_D,
+	       "wifi_lci_information: latitude=%lu longitude=%lu altitude=%d latitude_unc=%d longitude_unc=%d altitude_unc=%d\n",
+	       lci_info->latitude, lci_info->longitude, lci_info->altitude,
+	       lci_info->latitude_unc, lci_info->longitude_unc,
+	       lci_info->altitude_unc);
+	PRINTM(MCMD_D,
+	       "wifi_lci_information: motion_pattern=%d floor=%d height_above_floor=%d height_unc=%d\n",
+	       lci_info->motion_pattern, lci_info->floor,
+	       lci_info->height_above_floor, lci_info->height_unc);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_LCI;
+	moal_memcpy_ext(priv->phandle, &(rtt_rsp_cfg.u.lci), lci_info,
+			sizeof(rtt_rsp_cfg.u.lci), sizeof(rtt_rsp_cfg.u.lci));
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return err;
+}
+
+/**
+ * @brief vendor command to set rtt lcr
+ *
+ * @param wiphy    A pointer to wiphy struct
+ * @param wdev     A pointer to wireless_dev struct
+ * @param data     a pointer to data
+ * @param  len     data length
+ *
+ * @return      0: success  -1: fail
+ */
+static int woal_cfg80211_subcmd_rtt_set_lcr(struct wiphy *wiphy,
+					    struct wireless_dev *wdev,
+					    const void *data, int len)
+{
+	struct net_device *dev = wdev->netdev;
+	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
+	struct nlattr *tb[ATTR_RTT_MAX + 1];
+	mlan_rtt_responder rtt_rsp_cfg;
+	wifi_lcr_information *lcr_info;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	int err = 0;
+
+	ENTER();
+	PRINTM(MCMND, "Enter %s()\n", __func__);
+
+	err = nla_parse(tb, ATTR_RTT_MAX, data, len, NULL
+#if KERNEL_VERSION(4, 12, 0) <= CFG80211_VERSION_CODE
+			,
+			NULL
+#endif
+	);
+	if (err) {
+		err = -EFAULT;
+		PRINTM(MERROR, "%s: nla_parse fail\n", __func__);
+		goto done;
+	}
+
+	if (!tb[ATTR_RTT_LCR_INFO]) {
+		PRINTM(MERROR, "%s: null attr: tb[ATTR_RTT_LCR_INFO]=%p\n",
+		       __func__, tb[ATTR_RTT_LCR_INFO]);
+		err = -EINVAL;
+		goto done;
+	}
+	lcr_info = (wifi_lcr_information *)nla_data(tb[ATTR_RTT_LCR_INFO]);
+	PRINTM(MCMD_D, "HAL input:\n");
+	PRINTM(MCMD_D, "wifi_lcr_information: country_code='%c' '%c'\n",
+	       lcr_info->country_code[0], lcr_info->country_code[1]);
+	PRINTM(MCMD_D, "wifi_lci_information: length=%d civic_info=%s\n",
+	       lcr_info->length, lcr_info->civic_info);
+
+	memset(&rtt_rsp_cfg, 0x00, sizeof(rtt_rsp_cfg));
+	rtt_rsp_cfg.action = RTT_SET_RESPONDER_LCR;
+	moal_memcpy_ext(priv->phandle, &(rtt_rsp_cfg.u.lcr), lcr_info,
+			sizeof(rtt_rsp_cfg.u.lcr), sizeof(rtt_rsp_cfg.u.lcr));
+	ret = woal_rtt_responder_cfg(priv, MOAL_IOCTL_WAIT, &rtt_rsp_cfg);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "%s: woal_rtt_responder_cfg() failed\n",
+		       __func__);
+		err = -EFAULT;
+		goto done;
+	}
+
+done:
+	LEAVE();
+	return err;
+}
+
 #define CSI_DUMP_FILE_MAX 1200000
 
 /**
@@ -4392,11 +5287,11 @@ mlan_status woal_cfg80211_event_csi_dump(moal_private *priv, t_u8 *data,
 	ENTER();
 
 	DBG_HEXDUMP(MCMD_D, "CSI dump data", data, len);
-	sprintf(path_name, "/data");
+	snprintf(path_name, sizeof(path_name), "/data");
 	if (priv->csi_dump_format == 1)
-		sprintf(file_name, "csi_dump.bin");
+		snprintf(file_name, sizeof(file_name), "csi_dump.bin");
 	else
-		sprintf(file_name, "csi_dump.txt");
+		snprintf(file_name, sizeof(file_name), "csi_dump.txt");
 	priv->csi_dump_len += len;
 	if (priv->csi_dump_len > CSI_DUMP_FILE_MAX) {
 		PRINTM(MERROR,
@@ -4599,6 +5494,112 @@ static const struct wiphy_vendor_command vendor_commands[] = {
 	},
 
 
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_GET_CAPA,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_get_capa,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_RANGE_REQUEST,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_range_request,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_RANGE_CANCEL,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_range_cancel,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_GET_RESPONDER_INFO,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_get_responder_info,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_ENABLE_RESPONDER,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_enable_responder,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_DISABLE_RESPONDER,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_disable_responder,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_SET_LCI,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_set_lci,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+	{
+		.info = {
+				.vendor_id = MRVL_VENDOR_ID,
+				.subcmd = SUBCMD_RTT_SET_LCR,
+			},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = woal_cfg80211_subcmd_rtt_set_lcr,
+#if KERNEL_VERSION(5, 3, 0) <= CFG80211_VERSION_CODE
+                .policy = woal_rtt_policy,
+                .maxattr = ATTR_RTT_MAX,
+#endif
+	},
+
 	{
 		.info = {
 				.vendor_id = MRVL_VENDOR_ID,
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
index 8908bc8..bf29b69 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
@@ -620,6 +620,15 @@ enum mrvl_wlan_vendor_attr_wifi_logger {
 	MRVL_WLAN_VENDOR_ATTR_NAME = 10,
 };
 
+enum ATTR_FW_RELOAD {
+	ATTR_FW_RELOAD_INVALID = 0,
+	ATTR_FW_RELOAD_MODE = 1,
+	ATTR_FW_RELOAD_AFTER_LAST,
+	ATTR_FW_RELOAD_MAX = ATTR_FW_RELOAD_AFTER_LAST - 1,
+};
+
+void woal_cfg80211_driver_hang_event(moal_private *priv, t_u8 reload_mode);
+
 /**vendor event*/
 enum vendor_event {
 	event_hang = 0,
@@ -628,6 +637,7 @@ enum vendor_event {
 	event_fw_reset_failure = 3,
 	event_fw_reset_start = 4,
 	event_rssi_monitor = 0x1501,
+	event_rtt_result = 0x07,
 	event_set_key_mgmt_offload = 0x10001,
 	event_fw_roam_success = 0x10002,
 	event_cloud_keep_alive = 0x10003,
@@ -700,6 +710,14 @@ enum vendor_sub_command {
 	sub_cmd_set_packet_filter = 0x0011,
 	sub_cmd_get_packet_filter_capability,
 	sub_cmd_nd_offload = 0x0100,
+	SUBCMD_RTT_GET_CAPA = 0x1100,
+	SUBCMD_RTT_RANGE_REQUEST,
+	SUBCMD_RTT_RANGE_CANCEL,
+	SUBCMD_RTT_GET_RESPONDER_INFO,
+	SUBCMD_RTT_ENABLE_RESPONDER,
+	SUBCMD_RTT_DISABLE_RESPONDER,
+	SUBCMD_RTT_SET_LCI,
+	SUBCMD_RTT_SET_LCR,
 	sub_cmd_link_statistic_set = 0x1200,
 	sub_cmd_link_statistic_get = 0x1201,
 	sub_cmd_link_statistic_clr = 0x1202,
@@ -828,6 +846,29 @@ enum mrvl_wlan_vendor_attr_fw_roaming {
 		MRVL_WLAN_VENDOR_ATTR_FW_ROAMING_AFTER_LAST - 1
 };
 
+enum attr_rtt {
+	ATTR_RTT_INVALID = 0,
+	ATTR_RTT_CAPA,
+	ATTR_RTT_TARGET_NUM,
+	ATTR_RTT_TARGET_CONFIG,
+	ATTR_RTT_TARGET_ADDR,
+	ATTR_RTT_RESULT_COMPLETE,
+	ATTR_RTT_RESULT_NUM,
+	ATTR_RTT_RESULT_FULL,
+	ATTR_RTT_CHANNEL_INFO,
+	ATTR_RTT_MAX_DUR_SEC,
+	ATTR_RTT_PREAMBLE,
+	ATTR_RTT_LCI_INFO,
+	ATTR_RTT_LCR_INFO,
+
+	/* keep last */
+	ATTR_RTT_AFTER_LAST,
+	ATTR_RTT_MAX = ATTR_RTT_AFTER_LAST - 1
+};
+
+mlan_status woal_cfg80211_event_rtt_result(moal_private *priv, t_u8 *data,
+					   int len);
+
 enum attr_csi {
 	ATTR_CSI_INVALID = 0,
 	ATTR_CSI_CONFIG,
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
index 519f762..dbad2ed 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.c
@@ -4,7 +4,7 @@
   * @brief This file contains private ioctl functions
 
   *
-  * Copyright 2014-2022 NXP
+  * Copyright 2014-2023 NXP
   *
   * This software file (the File) is distributed by NXP
   * under the terms of the GNU General Public License Version 2, June 1991
@@ -60,6 +60,8 @@ Change log:
 #include <linux/compat.h>
 #endif
 
+#define CMD_BUF_LEN 4096
+
 /********************************************************
 			Local Variables
 ********************************************************/
@@ -160,7 +162,9 @@ mlan_status parse_arguments(t_u8 *pos, int *data, int datalen,
 				data[j] = woal_atox(cdata);
 				is_hex = 0;
 			} else {
-				woal_atoi(&data[j], cdata);
+				if (woal_atoi(&data[j], cdata) !=
+				    MLAN_STATUS_SUCCESS)
+					;
 			}
 			j++;
 			k = 0;
@@ -1208,7 +1212,8 @@ static int woal_priv_delba(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 		goto done;
 	}
 
-	ret = sprintf(respbuf, "OK. BA deleted successfully.\n") + 1;
+	ret = snprintf(respbuf, CMD_BUF_LEN, "OK. BA deleted successfully.\n") +
+	      1;
 
 done:
 	if (status != MLAN_STATUS_PENDING)
@@ -1282,11 +1287,11 @@ static int woal_priv_rejectaddbareq(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 	if (req->action == MLAN_ACT_GET) {
-		sprintf(respbuf, "0x%x",
-			cfg_11n->param.reject_addba_req.conditions);
+		snprintf(respbuf, CMD_BUF_LEN, "0x%x",
+			 cfg_11n->param.reject_addba_req.conditions);
 		ret = strlen(respbuf) + 1;
 	} else {
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -2637,34 +2642,36 @@ static int woal_setget_priv_passphrase(moal_private *priv, t_u8 *respbuf,
 
 	memset(respbuf, 0, respbuflen);
 	if (sec->param.passphrase.ssid.ssid_len) {
-		len += sprintf(respbuf + len, "ssid:");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "ssid:");
 		moal_memcpy_ext(priv->phandle, respbuf + len,
 				sec->param.passphrase.ssid.ssid,
 				sec->param.passphrase.ssid.ssid_len,
 				respbuflen - len);
 		len += sec->param.passphrase.ssid.ssid_len;
-		len += sprintf(respbuf + len, " ");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, " ");
 	}
 	if (memcmp(&sec->param.passphrase.bssid, zero_mac, sizeof(zero_mac))) {
 		mac = (t_u8 *)&sec->param.passphrase.bssid;
-		len += sprintf(respbuf + len, "bssid:");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "bssid:");
 		for (i = 0; i < ETH_ALEN - 1; ++i)
-			len += sprintf(respbuf + len, "%02x:", mac[i]);
-		len += sprintf(respbuf + len, "%02x ", mac[i]);
+			len += snprintf(respbuf + len, CMD_BUF_LEN,
+					"%02x:", mac[i]);
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "%02x ", mac[i]);
 	}
 	if (sec->param.passphrase.psk_type == MLAN_PSK_PMK) {
-		len += sprintf(respbuf + len, "psk:");
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "psk:");
 		for (i = 0; i < MLAN_MAX_KEY_LENGTH; ++i)
-			len += sprintf(respbuf + len, "%02x",
-				       sec->param.passphrase.psk.pmk.pmk[i]);
-		len += sprintf(respbuf + len, "\n");
+			len += snprintf(respbuf + len, CMD_BUF_LEN, "%02x",
+					sec->param.passphrase.psk.pmk.pmk[i]);
+		len += snprintf(respbuf + len, CMD_BUF_LEN, "\n");
 	}
 	if (sec->param.passphrase.psk_type == MLAN_PSK_PASSPHRASE)
-		len += sprintf(respbuf + len, "passphrase:%s\n",
-			       sec->param.passphrase.psk.passphrase.passphrase);
+		len += snprintf(
+			respbuf + len, CMD_BUF_LEN, "passphrase:%s\n",
+			sec->param.passphrase.psk.passphrase.passphrase);
 	if (sec->param.passphrase.psk_type == MLAN_PSK_SAE_PASSWORD)
-		len += sprintf(
-			respbuf + len, "sae_password:%s\n",
+		len += snprintf(
+			respbuf + len, CMD_BUF_LEN, "sae_password:%s\n",
 			sec->param.passphrase.psk.sae_password.sae_password);
 
 	ret = len;
@@ -2793,7 +2800,8 @@ static int woal_priv_get_sta_list(moal_private *priv, t_u8 *respbuf,
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -3138,7 +3146,7 @@ static int moal_ret_get_scan_table_ioctl(t_u8 *respbuf, t_u32 respbuflen,
 	}
 
 	prsp_info->scan_number = num_scans_done;
-	ret_len = pcurrent - respbuf;
+	ret_len = (int)(pcurrent - respbuf);
 
 	LEAVE();
 	return ret_len;
@@ -3323,7 +3331,7 @@ static int woal_priv_setgetdeepsleep(moal_private *priv, t_u8 *respbuf,
 			ret = -EFAULT;
 			goto done;
 		}
-		sprintf(respbuf, "%d %d", data[0], data[1]);
+		snprintf(respbuf, CMD_BUF_LEN, "%d %d", data[0], data[1]);
 		ret = strlen(respbuf) + 1;
 	} else {
 		if (data[0] == DEEP_SLEEP_OFF) {
@@ -3349,7 +3357,7 @@ static int woal_priv_setgetdeepsleep(moal_private *priv, t_u8 *respbuf,
 			ret = -EINVAL;
 			goto done;
 		}
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -3379,7 +3387,7 @@ static int woal_priv_setgetipaddr(moal_private *priv, t_u8 *respbuf,
 	if (priv->bss_type != MLAN_BSS_TYPE_STA) {
 		PRINTM(MIOCTL, "Bss type[%d]: Not STA, ignore it\n",
 		       priv->bss_type);
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 		goto done;
 	}
 
@@ -3442,7 +3450,7 @@ static int woal_priv_setgetipaddr(moal_private *priv, t_u8 *respbuf,
 			 misc->param.ipaddr_cfg.ip_addr[0][3]);
 		ret = IPADDR_MAX_BUF + 1;
 	} else {
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -3513,7 +3521,7 @@ static int woal_priv_setwpssession(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 
-	ret = sprintf(respbuf, "OK\n") + 1;
+	ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 done:
 	if (status != MLAN_STATUS_PENDING)
 		kfree(req);
@@ -3968,8 +3976,8 @@ static int woal_priv_assocessid(moal_private *priv, t_u8 *respbuf,
 
 	if (MTRUE == woal_is_connected(priv, &ssid_bssid)) {
 		PRINTM(MIOCTL, "Already connect to the network\n");
-		ret = sprintf(respbuf,
-			      "Has already connected to this ESSID!\n") +
+		ret = snprintf(respbuf, CMD_BUF_LEN,
+			       "Has already connected to this ESSID!\n") +
 		      1;
 		goto setessid_ret;
 	}
@@ -3988,7 +3996,7 @@ static int woal_priv_assocessid(moal_private *priv, t_u8 *respbuf,
 	priv->reassoc_required = MTRUE;
 	priv->phandle->is_reassoc_timer_set = MTRUE;
 	woal_mod_timer(&priv->phandle->reassoc_timer, 0);
-	ret = sprintf(respbuf, "%s\n", buf) + 1;
+	ret = snprintf(respbuf, CMD_BUF_LEN, "%s\n", buf) + 1;
 
 setessid_ret:
 	if (priv->scan_type == MLAN_SCAN_TYPE_PASSIVE)
@@ -4077,8 +4085,8 @@ static int woal_priv_setgetautoassoc(moal_private *priv, t_u8 *respbuf,
 						  .fw_reconn_counter;
 				if (data[2] == 0) {
 					data[1] = 0;
-					sprintf(respbuf, "%d %d", data[0],
-						data[1]);
+					snprintf(respbuf, CMD_BUF_LEN, "%d %d",
+						 data[0], data[1]);
 					ret = strlen(respbuf) + 1;
 				} else {
 					data[1] = 1;
@@ -4086,9 +4094,10 @@ static int woal_priv_setgetautoassoc(moal_private *priv, t_u8 *respbuf,
 							  .fw_reconn_interval;
 					data[4] = misc->param.fw_auto_reconnect
 							  .fw_reconn_flags;
-					sprintf(respbuf, "%d %d 0x%x 0x%x 0x%x",
-						data[0], data[1], data[2],
-						data[3], data[4]);
+					snprintf(respbuf, CMD_BUF_LEN,
+						 "%d %d 0x%x 0x%x 0x%x",
+						 data[0], data[1], data[2],
+						 data[3], data[4]);
 					ret = strlen(respbuf) + 1;
 				}
 				kfree(req);
@@ -4115,12 +4124,14 @@ static int woal_priv_setgetautoassoc(moal_private *priv, t_u8 *respbuf,
 						priv->auto_assoc_priv.drv_assoc
 							.retry_interval;
 				}
-				sprintf(respbuf, "%d %d 0x%x 0x%x", data[0],
-					data[1], data[2], data[3]);
+				snprintf(respbuf, CMD_BUF_LEN,
+					 "%d %d 0x%x 0x%x", data[0], data[1],
+					 data[2], data[3]);
 				ret = strlen(respbuf) + 1;
 			} else {
 				data[1] = 0;
-				sprintf(respbuf, "%d %d", data[0], data[1]);
+				snprintf(respbuf, CMD_BUF_LEN, "%d %d", data[0],
+					 data[1]);
 				ret = strlen(respbuf) + 1;
 			}
 		}
@@ -4313,7 +4324,7 @@ static int woal_priv_setgetautoassoc(moal_private *priv, t_u8 *respbuf,
 					data[3];
 			}
 		}
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -4363,7 +4374,7 @@ static int woal_priv_getwakeupreason(moal_private *priv, t_u8 *respbuf,
 			goto done;
 		} else {
 			data = pm_cfg->param.wakeup_reason.hs_wakeup_reason;
-			sprintf(respbuf, " %d", data);
+			snprintf(respbuf, CMD_BUF_LEN, " %d", data);
 			ret = strlen(respbuf) + 1;
 			kfree(req);
 		}
@@ -4444,10 +4455,11 @@ static int woal_priv_set_get_listeninterval(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 	if (req->action == MLAN_ACT_GET) {
-		sprintf(respbuf, "%d", pcfg_bss->param.listen_interval);
+		snprintf(respbuf, CMD_BUF_LEN, "%d",
+			 pcfg_bss->param.listen_interval);
 		ret = strlen(respbuf) + 1;
 	} else {
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 
 done:
@@ -4712,7 +4724,11 @@ static int woal_priv_hscfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
 	if (user_data_len && (data[0] != (int)HOST_SLEEP_CFG_CANCEL ||
 			      invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (ret != MLAN_STATUS_SUCCESS) {
+			ret = -EFAULT;
+			goto done;
+		}
 		if (bss_info.is_hs_configured) {
 			PRINTM(MERROR, "HS already configured\n");
 			ret = -EFAULT;
@@ -4722,8 +4738,11 @@ static int woal_priv_hscfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen,
 
 	/* Do a GET first if some arguments are not provided */
 	if (user_data_len >= 1 && user_data_len < 11) {
-		woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
-				       &hscfg_temp);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
+					   &hscfg_temp)) {
+			PRINTM(MERROR, "Unable to get HS params\n");
+		}
 	}
 	hscfg.conditions = hscfg_temp.conditions;
 	hscfg.gpio = hscfg_temp.gpio;
@@ -4883,7 +4902,7 @@ int woal_process_proc_hssetpara(moal_handle *handle, t_u8 *buf)
 		return -EINVAL;
 	}
 	if (user_data_len >= 1 && user_data_len <= 15) {
-		sprintf(respbuf, "%s%s%s", CMD_NXP, PRIV_CMD_HSCFG, buf);
+		snprintf(respbuf, 500, "%s%s%s", CMD_NXP, PRIV_CMD_HSCFG, buf);
 		ret = woal_priv_hscfg(priv, respbuf, sizeof(respbuf), MFALSE);
 	}
 	LEAVE();
@@ -4927,9 +4946,10 @@ static int woal_priv_hssetpara(moal_private *priv, t_u8 *respbuf,
 	}
 
 	if (user_data_len >= 1 && user_data_len <= 15) {
-		sprintf(respbuf, "%s%s%s", CMD_NXP, PRIV_CMD_HSCFG,
-			respbuf +
-				(strlen(CMD_NXP) + strlen(PRIV_CMD_HSSETPARA)));
+		snprintf(respbuf, CMD_BUF_LEN, "%s%s%s", CMD_NXP,
+			 PRIV_CMD_HSCFG,
+			 respbuf + (strlen(CMD_NXP) +
+				    strlen(PRIV_CMD_HSSETPARA)));
 		respbuflen = strlen(respbuf);
 		ret = woal_priv_hscfg(priv, respbuf, respbuflen, MFALSE);
 		goto done;
@@ -5040,7 +5060,10 @@ static int woal_priv_set_get_scancfg(moal_private *priv, t_u8 *respbuf,
 				sizeof(data), sizeof(scan->param.scan_cfg));
 	} else
 		req->action = MLAN_ACT_GET;
-
+	if (scan->param.scan_cfg.scan_time.specific_scan_time &&
+	    req->action == MLAN_ACT_SET) {
+		priv->phandle->user_scan_cfg = MTRUE;
+	}
 	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
 		ret = -EFAULT;
@@ -5279,7 +5302,6 @@ static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 		pcfg_misc->param.usb_aggr_params.rx_deaggr_ctrl.aggr_tmo =
 			(t_u16)data[7];
 		/* fall through */
-		fallthrough;
 	case 7:
 		if (data[6] < 0 || (data[6] > 10000 &&
 				    data[6] != MLAN_USB_TX_AGGR_TIMEOUT_DYN)) {
@@ -5291,7 +5313,6 @@ static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 		pcfg_misc->param.usb_aggr_params.tx_aggr_ctrl.aggr_tmo =
 			(t_u16)data[6];
 		/* fall through */
-		fallthrough;
 	case 6:
 		if ((data[5] < 512) || ((data[5] % 512) != 0)) {
 			PRINTM(MERROR, "Invalid Rx alignment value (%d)\n",
@@ -5306,7 +5327,6 @@ static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 		pcfg_misc->param.usb_aggr_params.rx_deaggr_ctrl.aggr_align =
 			(t_u16)data[5];
 		/* fall through */
-		fallthrough;
 	case 5:
 		if ((data[4] < 2048) || ((data[4] % 2048) != 0)) {
 			PRINTM(MERROR, "Invalid Tx alignment value (%d)\n",
@@ -5317,7 +5337,6 @@ static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 		pcfg_misc->param.usb_aggr_params.tx_aggr_ctrl.aggr_align =
 			(t_u16)data[4];
 		/* fall through */
-		fallthrough;
 	case 4:
 		if ((data[3] == 2) || (data[3] == 4) || (data[3] == 8) ||
 		    (data[3] == 16)) {
@@ -5340,7 +5359,6 @@ static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 		pcfg_misc->param.usb_aggr_params.rx_deaggr_ctrl.aggr_max =
 			(t_u16)data[3];
 		/* fall through */
-		fallthrough;
 	case 3:
 		if ((data[2] == 2) || (data[2] == 4) || (data[2] == 8) ||
 		    (data[2] == 16)) {
@@ -5359,7 +5377,6 @@ static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 		pcfg_misc->param.usb_aggr_params.tx_aggr_ctrl.aggr_max =
 			(t_u16)data[2];
 		/* fall through */
-		fallthrough;
 	case 2:
 		if ((data[1] != 0) && (data[1] != 1)) {
 			PRINTM(MERROR, "Invalid Rx enable value (%d)\n",
@@ -5373,7 +5390,6 @@ static int woal_priv_set_get_usbaggrctrl(moal_private *priv, t_u8 *respbuf,
 		pcfg_misc->param.usb_aggr_params.rx_deaggr_ctrl.enable =
 			(t_u16)data[1];
 		/* fall through */
-		fallthrough;
 	case 1:
 		if ((data[0] != 0) && (data[0] != 1)) {
 			PRINTM(MERROR, "Invalid Tx enable value (%d)\n",
@@ -5972,7 +5988,11 @@ static int woal_priv_get_ap(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	if (bss_info.media_connected == MTRUE) {
 		moal_memcpy_ext(priv->phandle, mwr->u.ap_addr.sa_data,
 				&bss_info.bssid, MLAN_MAC_ADDR_LENGTH,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				sizeof(mwr->u.ap_addr.sa_data_min));
+#else
 				sizeof(mwr->u.ap_addr.sa_data));
+#endif
 	} else {
 		memset(mwr->u.ap_addr.sa_data, 0, MLAN_MAC_ADDR_LENGTH);
 	}
@@ -6151,7 +6171,9 @@ static int woal_priv_txpowercfg(moal_private *priv, t_u8 *respbuf,
 
 	memset(data, 0, sizeof(data));
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (ret != MLAN_STATUS_SUCCESS)
+		return -EFAULT;
 
 	if (strlen(respbuf) ==
 	    (strlen(CMD_NXP) + strlen(PRIV_CMD_TXPOWERCFG))) {
@@ -6719,7 +6741,8 @@ static int woal_priv_regrdwr(moal_private *priv, t_u8 *respbuf,
 		ret = -ENOMEM;
 		goto done;
 	}
-	strcpy(arguments, respbuf + header_len);
+	strncpy(arguments, respbuf + header_len,
+		strlen(respbuf) * sizeof(char));
 	space_ind = strstr((char *)arguments, " ");
 	if (space_ind)
 		space_ind = strstr(space_ind + 1, " ");
@@ -6727,7 +6750,8 @@ static int woal_priv_regrdwr(moal_private *priv, t_u8 *respbuf,
 		if (*(char *)(space_ind + 1) == '-') {
 			is_negative_val = MTRUE;
 			arguments[space_ind + 1 - arguments] = '\0';
-			strcat(arguments, space_ind + 2);
+			strncat(arguments, space_ind + 2,
+				(strlen(respbuf) * sizeof(char)) - 1);
 		}
 	}
 	parse_arguments(arguments, data, ARRAY_SIZE(data), &user_data_len);
@@ -7434,7 +7458,11 @@ static int woal_priv_get_txpwrlimit(moal_private *priv, t_u8 *respbuf,
 	trpc_cfg = (mlan_ds_misc_chan_trpc_cfg *)(respbuf + header_len);
 	if ((trpc_cfg->sub_band != 0) && (trpc_cfg->sub_band != 0x10) &&
 	    (trpc_cfg->sub_band != 0x11) && (trpc_cfg->sub_band != 0x12) &&
-	    (trpc_cfg->sub_band != 0x13)) {
+	    (trpc_cfg->sub_band != 0x13) && (trpc_cfg->sub_band != 0x20) &&
+	    (trpc_cfg->sub_band != 0x21) && (trpc_cfg->sub_band != 0x22) &&
+	    (trpc_cfg->sub_band != 0x23) && (trpc_cfg->sub_band != 0x24) &&
+	    (trpc_cfg->sub_band != 0x25) && (trpc_cfg->sub_band != 0x26) &&
+	    (trpc_cfg->sub_band != 0x27)) {
 		PRINTM(MERROR, "Invalid subband=0x%x\n", trpc_cfg->sub_band);
 		ret = -EINVAL;
 		goto done;
@@ -7486,6 +7514,7 @@ static int woal_priv_getcfgchanlist(moal_private *priv, t_u8 *respbuf,
 	wlan_ieee80211_chan_list *plist = NULL;
 	struct ieee80211_supported_band *sband;
 	struct wiphy *wiphy = NULL;
+	t_u8 band;
 	int i;
 
 	ENTER();
@@ -7497,36 +7526,25 @@ static int woal_priv_getcfgchanlist(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 	plist = (wlan_ieee80211_chan_list *)respbuf;
-	sband = wiphy->bands[NL80211_BAND_2GHZ];
-	if (sband) {
-		num_chan += sband->n_channels;
-		for (i = 0; i < sband->n_channels; i++) {
-			plist->chan_list[i].center_freq =
-				sband->channels[i].center_freq;
-			plist->chan_list[i].hw_value =
-				sband->channels[i].hw_value;
-			plist->chan_list[i].flags = sband->channels[i].flags;
-			plist->chan_list[i].max_power =
-				sband->channels[i].max_power;
-		}
-	}
-	sband = wiphy->bands[NL80211_BAND_5GHZ];
-	if (sband) {
-		for (i = 0; i < sband->n_channels; i++) {
-			plist->chan_list[i + num_chan].center_freq =
-				sband->channels[i].center_freq;
-			plist->chan_list[i + num_chan].hw_value =
-				sband->channels[i].hw_value;
-			plist->chan_list[i + num_chan].flags =
-				sband->channels[i].flags;
-			plist->chan_list[i + num_chan].max_power =
-				sband->channels[i].max_power;
+	for (band = NL80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; ++band) {
+		sband = wiphy->bands[band];
+		if (sband) {
+			for (i = 0; i < sband->n_channels; i++) {
+				plist->chan_list[i + num_chan].center_freq =
+					sband->channels[i].center_freq;
+				plist->chan_list[i + num_chan].hw_value =
+					sband->channels[i].hw_value;
+				plist->chan_list[i + num_chan].flags =
+					sband->channels[i].flags;
+				plist->chan_list[i + num_chan].max_power =
+					sband->channels[i].max_power;
 #if CFG80211_VERSION_CODE > KERNEL_VERSION(3, 8, 13)
-			plist->chan_list[i + num_chan].dfs_state =
-				sband->channels[i].dfs_state;
+				plist->chan_list[i + num_chan].dfs_state =
+					sband->channels[i].dfs_state;
 #endif
+			}
+			num_chan += sband->n_channels;
 		}
-		num_chan += sband->n_channels;
 	}
 	plist->num_chan = num_chan;
 	ret = sizeof(wlan_ieee80211_chan_list) +
@@ -8214,7 +8232,9 @@ static int woal_priv_getwap(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_STA) {
 		memset(&bss_info, 0, sizeof(bss_info));
 
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (ret != MLAN_STATUS_SUCCESS)
+			return -EFAULT;
 
 		if (bss_info.media_connected == MTRUE) {
 			moal_memcpy_ext(priv->phandle, respbuf,
@@ -8614,12 +8634,14 @@ static int woal_priv_offchannel(moal_private *priv, t_u8 *respbuf,
 	if (header_len == (int)strlen(respbuf)) {
 		/* Query current remain on channel status */
 		if (priv->phandle->remain_on_channel)
-			ret = sprintf(respbuf,
+			ret = snprintf(
+				      respbuf, CMD_BUF_LEN,
 				      "There is pending remain on channel from bss %d\n",
 				      priv->phandle->remain_bss_index) +
 			      1;
 		else
-			ret = sprintf(respbuf,
+			ret = snprintf(
+				      respbuf, CMD_BUF_LEN,
 				      "There is no pending remain on channel\n") +
 			      1;
 		goto done;
@@ -8692,7 +8714,8 @@ static int woal_priv_offchannel(moal_private *priv, t_u8 *respbuf,
 
 	if (data[0] == 0) {
 		if (!priv->phandle->remain_on_channel) {
-			ret = sprintf(respbuf,
+			ret = snprintf(
+				      respbuf, CMD_BUF_LEN,
 				      "There is no pending remain on channel to be canceled\n") +
 			      1;
 			goto done;
@@ -8734,7 +8757,7 @@ static int woal_priv_offchannel(moal_private *priv, t_u8 *respbuf,
 	if (status != MLAN_STATUS_SUCCESS)
 		ret = -EFAULT;
 	else
-		ret = sprintf(respbuf, "OK\n") + 1;
+		ret = snprintf(respbuf, CMD_BUF_LEN, "OK\n") + 1;
 
 done:
 	LEAVE();
@@ -8956,7 +8979,9 @@ static int woal_priv_radio_ctrl(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	} else {
 		/* Get radio status */
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		ret = woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (ret != MLAN_STATUS_SUCCESS)
+			return -EFAULT;
 		moal_memcpy_ext(priv->phandle, respbuf, &bss_info.radio_on,
 				sizeof(bss_info.radio_on), respbuflen);
 		ret = sizeof(bss_info.radio_on);
@@ -9346,6 +9371,19 @@ static int woal_priv_set_get_reassoc(moal_private *priv, t_u8 *respbuf,
 				respbuflen);
 		ret = sizeof(data);
 	} else {
+#ifdef STA_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		if (moal_extflg_isset(priv->phandle, EXT_HOST_MLME)) {
+			if (priv->host_mlme) {
+				PRINTM(MERROR,
+				       "Don't support reassoctrl in host_mlme mode\n");
+				ret = -EFAULT;
+				LEAVE();
+				return ret;
+			}
+		}
+#endif
+#endif
 		/* SET operation */
 		parse_arguments(respbuf + header_len, &data, 1, &user_data_len);
 		if (user_data_len == 1) {
@@ -9895,7 +9933,6 @@ static int woal_priv_get_signal(moal_private *priv, t_u8 *respbuf,
 			goto done;
 		}
 		/* Fall through */
-		fallthrough;
 	case 1: /* Check type range */
 		if (in_data[0] < 1 || in_data[0] > 3) {
 			ret = -EINVAL;
@@ -10841,23 +10878,18 @@ static int woal_priv_sdio_mpa_ctrl(moal_private *priv, t_u8 *respbuf,
 	case 6:
 		misc->param.mpa_ctrl.rx_max_ports = data[5];
 		/* fall through */
-		fallthrough;
 	case 5:
 		misc->param.mpa_ctrl.tx_max_ports = data[4];
 		/* fall through */
-		fallthrough;
 	case 4:
 		misc->param.mpa_ctrl.rx_buf_size = data[3];
 		/* fall through */
-		fallthrough;
 	case 3:
 		misc->param.mpa_ctrl.tx_buf_size = data[2];
 		/* fall through */
-		fallthrough;
 	case 2:
 		misc->param.mpa_ctrl.rx_enable = data[1];
 		/* fall through */
-		fallthrough;
 	case 1:
 		/* Set cmd */
 		req->action = MLAN_ACT_SET;
@@ -11072,7 +11104,10 @@ static int woal_priv_net_monitor_ioctl(moal_private *priv, t_u8 *respbuf,
 				if (!data[1] ||
 				    data[1] & ~(MLAN_NETMON_DATA |
 						MLAN_NETMON_MANAGEMENT |
-						MLAN_NETMON_CONTROL)) {
+						MLAN_NETMON_CONTROL |
+						MLAN_NETMON_NOPROM |
+						MLAN_NETMON_NON_BSS_BCN |
+						MLAN_NETMON_TX)) {
 					PRINTM(MERROR,
 					       "NET_MON: Invalid filter flag\n");
 					ret = -EINVAL;
@@ -11652,240 +11687,98 @@ done:
 }
 
 #ifdef UAP_SUPPORT
+
 /**
- *  @brief determine the center frquency center index for bandwidth
- *         of 80 MHz and 160 MHz
+ *  @brief determine the center frequency center index for bandwidth
+ *         of 40/80/160 MHz
  *
- ** @param priv          Pointer to moal_private structure
+ ** @param priv         Pointer to moal_private structure
  *  @param band         band
  *  @param pri_chan     primary channel
  *  @param chan_bw      channel bandwidth
  *
  *  @return             channel center frequency center, if found; O, otherwise
  */
-
 static t_u8 woal_get_center_freq_idx(moal_private *priv, t_u16 band,
 				     t_u32 pri_chan, t_u8 chan_bw)
 {
-	t_u8 center_freq_idx = 0;
+	struct center_freq_desc {
+		t_u8 pri_chan;
+		t_u8 ch_40;
+		t_u8 ch_80;
+		t_u8 ch_160;
+	};
 
-	if (band & BAND_AAC) {
-		switch (pri_chan) {
-		case 36:
-		case 40:
+	static const struct center_freq_desc center_freq_idx_map_5g[] = {
+		{.pri_chan = 36, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 40, .ch_40 = 38, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 44, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 48, .ch_40 = 46, .ch_80 = 42, .ch_160 = 50},
+		{.pri_chan = 52, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 56, .ch_40 = 54, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 60, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 64, .ch_40 = 62, .ch_80 = 58, .ch_160 = 50},
+		{.pri_chan = 68, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 72, .ch_40 = 70, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 76, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 80, .ch_40 = 78, .ch_80 = 74, .ch_160 = 0},
+		{.pri_chan = 84, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 88, .ch_40 = 86, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 92, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 96, .ch_40 = 94, .ch_80 = 90, .ch_160 = 0},
+		{.pri_chan = 100, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 104, .ch_40 = 102, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 108, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 112, .ch_40 = 110, .ch_80 = 106, .ch_160 = 114},
+		{.pri_chan = 116, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 120, .ch_40 = 118, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 124, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 128, .ch_40 = 126, .ch_80 = 122, .ch_160 = 114},
+		{.pri_chan = 132, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 136, .ch_40 = 134, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 140, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 144, .ch_40 = 142, .ch_80 = 138, .ch_160 = 0},
+		{.pri_chan = 149, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 153, .ch_40 = 151, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 157, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 161, .ch_40 = 159, .ch_80 = 155, .ch_160 = 163},
+		{.pri_chan = 165, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 169, .ch_40 = 167, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 173, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 177, .ch_40 = 175, .ch_80 = 171, .ch_160 = 163},
+		{.pri_chan = 184, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 188, .ch_40 = 186, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 192, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 196, .ch_40 = 194, .ch_80 = 190, .ch_160 = 0},
+		{.pri_chan = 0,
+		 .ch_40 = 42 /* terminator with default cfreq */}};
+
+	const struct center_freq_desc *map = NULL;
+
+	if (band == BAND_5GHZ)
+		map = center_freq_idx_map_5g;
+
+	for (; map != NULL; map++) {
+		/* reached end of map, return default value for that map */
+		if (map->pri_chan == 0)
+			return map->ch_40;
+
+		if (map->pri_chan == pri_chan) {
 			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 38;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 44:
-		case 48:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 46;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 42;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 52:
-		case 56:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 54;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 60:
-		case 64:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 62;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 58;
-				break;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 50;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 68:
-		case 72:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 70;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 76:
-		case 80:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 78;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 74;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 84:
-		case 88:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 86;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 92:
-		case 96:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 94;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 90;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 100:
-		case 104:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 102;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 108:
-		case 112:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 110;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 106;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 116:
-		case 120:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 118;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 124:
-		case 128:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 126;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 122;
-			} else if (chan_bw == CHANNEL_BW_160MHZ) {
-				center_freq_idx = 114;
-			}
-			break;
-		case 132:
-		case 136:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 134;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 140:
-		case 144:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 126;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 138;
-			}
-			break;
-		case 149:
-		case 153:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 151;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 157:
-		case 161:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 159;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 155;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 165:
-		case 169:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 167;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 173:
-		case 177:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 175;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 171;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 184:
-		case 188:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 186;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		case 192:
-		case 196:
-			if (chan_bw == CHANNEL_BW_40MHZ_ABOVE ||
-			    chan_bw == CHANNEL_BW_40MHZ_BELOW) {
-				center_freq_idx = 194;
-				break;
-			} else if (chan_bw == CHANNEL_BW_80MHZ) {
-				center_freq_idx = 190;
-				break;
-			}
-			/* fall through */
-			fallthrough;
-		default: /* error. go to the default */
-			center_freq_idx = 42;
+			    chan_bw == CHANNEL_BW_40MHZ_BELOW)
+				return map->ch_40;
+
+			if (chan_bw == CHANNEL_BW_80MHZ)
+				return map->ch_80;
+
+			if (chan_bw == CHANNEL_BW_160MHZ)
+				return map->ch_160;
 		}
 	}
-	return center_freq_idx;
+
+	return 0;
 }
+
 #endif
 
 #if defined(UAP_SUPPORT)
@@ -11897,6 +11790,7 @@ static t_u8 woal_get_center_freq_idx(moal_private *priv, t_u16 band,
  *  @param oper_class    oper_class
  *  @param channel       channel
  *  @param switch count  how many csa/ecsa beacon will send out
+ *  @param band          see BAND_5GHZ/BAND_6GHZ enum
  *  @param band_width    1-40Mhz above, 3-40Mhz below, 4-80Mhz, 5-160Mhz
  *  @param ecsa          MTRUE/MFALSE;
  *
@@ -11904,7 +11798,7 @@ static t_u8 woal_get_center_freq_idx(moal_private *priv, t_u16 band,
  */
 static int woal_channel_switch(moal_private *priv, t_u8 block_tx,
 			       t_u8 oper_class, t_u8 channel, t_u8 switch_count,
-			       t_u8 band_width, t_u8 ecsa)
+			       t_u8 band, t_u8 band_width, t_u8 ecsa)
 {
 	IEEEtypes_ExtChanSwitchAnn_t *ext_chan_switch = NULL;
 	IEEEtypes_ChanSwitchAnn_t *chan_switch = NULL;
@@ -11936,18 +11830,25 @@ static int woal_channel_switch(moal_private *priv, t_u8 block_tx,
 
 	pcust_chansw_ie = (custom_ie *)&misc->param.cust_ie.ie_data_list[0];
 	pcust_chansw_ie->ie_index = 0xffff; /*Auto index */
-	pcust_chansw_ie->ie_length = sizeof(IEEEtypes_ChanSwitchAnn_t);
+	pcust_chansw_ie->ie_length = 0;
 	pcust_chansw_ie->mgmt_subtype_mask =
 		MGMT_MASK_BEACON | MGMT_MASK_PROBE_RESP; /*Add IE for
 							    BEACON/probe resp*/
-	chan_switch = (IEEEtypes_ChanSwitchAnn_t *)pcust_chansw_ie->ie_buffer;
-	chan_switch->element_id = CHANNEL_SWITCH_ANN;
-	chan_switch->len = 3;
-	chan_switch->chan_switch_mode = block_tx;
-	chan_switch->new_channel_num = channel;
-	chan_switch->chan_switch_count = switch_count;
-	DBG_HEXDUMP(MCMD_D, "CSA IE", (t_u8 *)pcust_chansw_ie->ie_buffer,
-		    pcust_chansw_ie->ie_length);
+	pcust_chansw_ie->mgmt_subtype_mask |= MLAN_CUSTOM_IE_NEW_MASK;
+
+	if (band == BAND_2GHZ || band == BAND_5GHZ) {
+		pcust_chansw_ie->ie_length = sizeof(IEEEtypes_ChanSwitchAnn_t);
+		chan_switch =
+			(IEEEtypes_ChanSwitchAnn_t *)pcust_chansw_ie->ie_buffer;
+		chan_switch->element_id = CHANNEL_SWITCH_ANN;
+		chan_switch->len = 3;
+		chan_switch->chan_switch_mode = block_tx;
+		chan_switch->new_channel_num = channel;
+		chan_switch->chan_switch_count = switch_count;
+		DBG_HEXDUMP(MCMD_D, "CSA IE",
+			    (t_u8 *)pcust_chansw_ie->ie_buffer,
+			    pcust_chansw_ie->ie_length);
+	}
 	switch (band_width) {
 	case CHANNEL_BW_40MHZ_ABOVE:
 	case CHANNEL_BW_40MHZ_BELOW:
@@ -11967,27 +11868,23 @@ static int woal_channel_switch(moal_private *priv, t_u8 block_tx,
 		woal_priv_get_nonglobal_operclass_by_bw_channel(
 			priv, bw, channel, &new_oper_class);
 	if (new_oper_class) {
-		pcust_chansw_ie->ie_length +=
-			sizeof(IEEEtypes_ExtChanSwitchAnn_t);
-		ext_chan_switch =
-			(IEEEtypes_ExtChanSwitchAnn_t
-				 *)(pcust_chansw_ie->ie_buffer +
-				    sizeof(IEEEtypes_ChanSwitchAnn_t));
+		ext_chan_switch = (IEEEtypes_ExtChanSwitchAnn_t
+					   *)(pcust_chansw_ie->ie_buffer +
+					      pcust_chansw_ie->ie_length);
 		ext_chan_switch->element_id = EXTEND_CHANNEL_SWITCH_ANN;
 		ext_chan_switch->len = 4;
 		ext_chan_switch->chan_switch_mode = block_tx;
 		ext_chan_switch->new_oper_class = new_oper_class;
 		ext_chan_switch->new_channel_num = channel;
 		ext_chan_switch->chan_switch_count = switch_count;
-		DBG_HEXDUMP(MCMD_D, "ECSA IE",
-			    (t_u8 *)(pcust_chansw_ie->ie_buffer +
-				     sizeof(IEEEtypes_ChanSwitchAnn_t)),
-			    pcust_chansw_ie->ie_length -
-				    sizeof(IEEEtypes_ChanSwitchAnn_t));
+		pcust_chansw_ie->ie_length +=
+			sizeof(IEEEtypes_ExtChanSwitchAnn_t);
+		DBG_HEXDUMP(MCMD_D, "ECSA IE", (t_u8 *)ext_chan_switch,
+			    sizeof(IEEEtypes_ExtChanSwitchAnn_t));
 	}
 	/* bandwidth 40/80/160 should set channel switch wrapper ie for 11ac 5G
 	 * channel*/
-	if (band_width && channel > 14) {
+	if (band_width && (band == BAND_5GHZ)) {
 		pChanSwWrap_ie =
 			(IEEEtypes_Header_t *)(pcust_chansw_ie->ie_buffer +
 					       pcust_chansw_ie->ie_length);
@@ -12002,8 +11899,8 @@ static int woal_channel_switch(moal_private *priv, t_u8 block_tx,
 			sizeof(IEEEtypes_WideBWChanSwitch_t) -
 			sizeof(IEEEtypes_Header_t);
 
-		center_freq_idx = woal_get_center_freq_idx(priv, BAND_AAC,
-							   channel, band_width);
+		center_freq_idx = woal_get_center_freq_idx(priv, band, channel,
+							   band_width);
 		if (band_width == CHANNEL_BW_40MHZ_ABOVE ||
 		    band_width == CHANNEL_BW_40MHZ_BELOW) {
 			pbwchansw_ie->new_channel_width = 0;
@@ -12409,6 +12306,7 @@ static void woal_auto_uap_channel_switch(moal_private *priv, t_u8 channel)
 {
 	moal_private *pmpriv = NULL;
 	chan_band_info chaninfo;
+	t_u8 band = BAND_2GHZ;
 	moal_handle *ref_handle;
 	t_u8 band_width = CHANNEL_BW_20MHZ;
 
@@ -12443,9 +12341,11 @@ static void woal_auto_uap_channel_switch(moal_private *priv, t_u8 channel)
 				band_width = CHANNEL_BW_20MHZ;
 				break;
 			}
+			if (channel > MAX_BG_CHANNEL)
+				band = BAND_5GHZ;
 #define DEF_SWITCH_COUNT 10
 			woal_channel_switch(pmpriv, MTRUE, 0, channel,
-					    DEF_SWITCH_COUNT, band_width,
+					    DEF_SWITCH_COUNT, band, band_width,
 					    MTRUE);
 		}
 	}
@@ -12581,12 +12481,24 @@ static int woal_priv_do_dfs_cac(moal_private *priv, t_u8 *respbuf,
 #ifdef UAP_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 				if (!data[0] && priv->chan_rpt_req.chanNum) {
-					woal_update_channels_dfs_state(
-						priv,
-						priv->chan_rpt_req.chanNum,
-						priv->chan_rpt_req.bandcfg
-							.chanWidth,
-						DFS_USABLE);
+					memset(&ch_dfs_state, 0,
+					       sizeof(ch_dfs_state));
+					ch_dfs_state.channel =
+						priv->chan_rpt_req.chanNum;
+					if (!woal_11h_chan_dfs_state(
+						    priv, MLAN_ACT_GET,
+						    &ch_dfs_state)) {
+						if (ch_dfs_state.dfs_state ==
+						    DFS_AVAILABLE)
+							woal_update_channels_dfs_state(
+								priv,
+								priv->chan_rpt_req
+									.chanNum,
+								priv->chan_rpt_req
+									.bandcfg
+									.chanWidth,
+								DFS_USABLE);
+					}
 				}
 #endif
 #endif
@@ -13215,7 +13127,6 @@ static int woal_priv_get_ch_load(moal_private *priv, t_u8 *respbuf,
 	misc->param.ch_load.noise = cl_cfg->noise;
 	misc->param.ch_load.rx_quality = cl_cfg->rx_quality;
 	misc->param.ch_load.duration = cl_cfg->duration;
-	misc->param.ch_load.cca_th = cl_cfg->cca_th;
 	status = woal_request_ioctl(priv, ioctl_req, MOAL_NO_WAIT);
 	if (status != MLAN_STATUS_SUCCESS && status != MLAN_STATUS_PENDING) {
 		ret = -EFAULT;
@@ -13283,7 +13194,8 @@ static int woal_priv_set_get_tx_rx_ant(moal_private *priv, t_u8 *respbuf,
 				radio->param.ant_cfg.rx_antenna = data[1];
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 			if (IS_CARD9098(priv->phandle->card_type) ||
-			    IS_CARD9097(priv->phandle->card_type)) {
+			    IS_CARD9097(priv->phandle->card_type) ||
+			    IS_CARDIW62X(priv->phandle->card_type)) {
 				woal_cfg80211_notify_antcfg(
 					priv, priv->phandle->wiphy, radio);
 			}
@@ -13667,11 +13579,11 @@ static int woal_priv_get_key(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "PTK: ");
+		snprintf((char *)tmp, CMD_BUF_LEN, "\n%s", "PTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, CMD_BUF_LEN, "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get Multicase Key */
@@ -13688,11 +13600,11 @@ static int woal_priv_get_key(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "GTK: ");
+		snprintf((char *)tmp, CMD_BUF_LEN, "\n%s", "GTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, CMD_BUF_LEN, "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get IGTK Key */
@@ -13709,11 +13621,11 @@ static int woal_priv_get_key(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "IGTK: ");
+		snprintf((char *)tmp, CMD_BUF_LEN, "\n%s", "IGTK: ");
 		tmp += 6;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, CMD_BUF_LEN, "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	copy_len = tmp - key_ascii;
@@ -13932,7 +13844,7 @@ static int woal_priv_tx_bf_cfg(moal_private *priv, t_u8 *respbuf,
 						*token = '\0';
 						str = token + 1;
 					}
-					woal_atoi(&tmp_val, pos);
+					(void)woal_atoi(&tmp_val, pos);
 					switch (i) {
 					case BF_ENABLE_PARAM:
 						bf_global->bf_enbl =
@@ -14023,11 +13935,11 @@ static int woal_priv_tx_bf_cfg(moal_private *priv, t_u8 *respbuf,
 				bf_cfg.action = BF_CFG_ACT_GET;
 			} else {
 				woal_mac2u8(tx_bf_peer->peer_mac, &buf[2]);
-				woal_atoi(&tmp_val, &buf[20]);
+				(void)woal_atoi(&tmp_val, &buf[20]);
 				tx_bf_peer->bf_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[22]);
+				(void)woal_atoi(&tmp_val, &buf[22]);
 				tx_bf_peer->sounding_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[24]);
+				(void)woal_atoi(&tmp_val, &buf[24]);
 				tx_bf_peer->fb_type = (t_u8)tmp_val;
 				action = MLAN_ACT_SET;
 				bf_cfg.action = BF_CFG_ACT_SET;
@@ -14980,6 +14892,60 @@ done:
 	return ret;
 }
 
+/**
+* @brief               Configure TWT Report parameters
+
+ *@param priv          Pointer to the mlan_private driver data struct
+ *@param respbuf       A pointer to response buffer
+ *@param len           Length used
+ *@param respbuflen    Available length of response buffer
+
+ *@return              Number of bytes written if successful else negative value
+*/
+static int woal_priv_twt_report(moal_private *priv, t_u8 *respbuf, t_u8 len,
+				t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_twtcfg *cfg = NULL;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_twtcfg));
+	if (req == NULL) {
+		PRINTM(MERROR, "Failed to allocate ioctl_req!\n");
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	req->req_id = MLAN_IOCTL_11AX_CFG;
+	req->action = MLAN_ACT_GET;
+	cfg = (mlan_ds_twtcfg *)req->pbuf;
+	cfg->sub_command = MLAN_OID_11AX_TWT_CFG;
+	cfg->sub_id = MLAN_11AX_TWT_REPORT_SUBID;
+
+	if (len) {
+		moal_memcpy_ext(priv->phandle, (t_u8 *)&cfg->param.twt_report,
+				respbuf, len, sizeof(mlan_ds_twt_report));
+	}
+
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "woal_request_ioctl failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ret = sizeof(mlan_ds_twt_report);
+done:
+	if (status != MLAN_STATUS_PENDING) {
+		kfree(req);
+	}
+	LEAVE();
+	return ret;
+}
+
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(UAP_CFG80211)
 /**
@@ -15031,11 +14997,9 @@ static int woal_priv_cfg_noa(moal_private *priv, t_u8 *respbuf,
 		case 5:
 			noa_cfg.noa_interval = (t_u32)data[4];
 			/* fall through */
-			fallthrough;
 		case 4:
 			noa_cfg.noa_duration = (t_u32)data[3];
 			/* fall through */
-			fallthrough;
 		case 3:
 			if (data[2] < 1 || data[2] > 255) {
 				PRINTM(MERROR,
@@ -15045,7 +15009,6 @@ static int woal_priv_cfg_noa(moal_private *priv, t_u8 *respbuf,
 			}
 			noa_cfg.noa_count = (t_u8)data[2];
 			/* fall through */
-			fallthrough;
 		case 2:
 			if (data[1] < 0 || data[1] > 255) {
 				PRINTM(MERROR, "Invalid Index\n");
@@ -15054,7 +15017,6 @@ static int woal_priv_cfg_noa(moal_private *priv, t_u8 *respbuf,
 			}
 			noa_cfg.index = (t_u16)data[1];
 			/* fall through */
-			fallthrough;
 		case 1:
 			if (data[0] < 0 || data[0] > 1) {
 				PRINTM(MERROR, "Invalid noa enable\n");
@@ -15129,7 +15091,6 @@ static int woal_priv_cfg_opp_ps(moal_private *priv, t_u8 *respbuf,
 		case 2:
 			opp_ps_cfg.ct_window = (t_u8)data[1];
 			/* fall through */
-			fallthrough;
 		case 1:
 			if (data[0] < 0 || data[0] > 1) {
 				PRINTM(MERROR, "Invalid ps enable\n");
@@ -15139,7 +15100,6 @@ static int woal_priv_cfg_opp_ps(moal_private *priv, t_u8 *respbuf,
 			opp_ps_cfg.opp_ps_enable = (t_u8)data[0];
 			opp_ps_cfg.flags |= WIFI_DIRECT_OPP_PS;
 			/* fall through */
-			fallthrough;
 		default:
 			break;
 		}
@@ -15214,7 +15174,6 @@ static int woal_priv_cfg_clock_sync(moal_private *priv, t_u8 *respbuf,
 			clock_sync_cfg->clock_sync_gpio_pulse_width =
 				(t_u16)data[4];
 			/* fall through */
-			fallthrough;
 		case 4:
 			if (data[3] < 0 || data[3] > 1) {
 				PRINTM(MERROR, "Invalid Level/Trigger\n");
@@ -15224,7 +15183,6 @@ static int woal_priv_cfg_clock_sync(moal_private *priv, t_u8 *respbuf,
 			clock_sync_cfg->clock_sync_gpio_level_toggle =
 				(t_u8)data[3];
 			/* fall through */
-			fallthrough;
 		case 3:
 			if (data[2] < 1 || data[2] > 255) {
 				PRINTM(MERROR,
@@ -15235,7 +15193,6 @@ static int woal_priv_cfg_clock_sync(moal_private *priv, t_u8 *respbuf,
 			clock_sync_cfg->clock_sync_gpio_pin_number =
 				(t_u8)data[2];
 			/* fall through */
-			fallthrough;
 		case 2:
 			if (data[1] < 0 || data[1] > 2) {
 				PRINTM(MERROR, "Invalid Role\n");
@@ -15244,7 +15201,6 @@ static int woal_priv_cfg_clock_sync(moal_private *priv, t_u8 *respbuf,
 			}
 			clock_sync_cfg->clock_sync_Role = (t_u8)data[1];
 			/* fall through */
-			fallthrough;
 		case 1:
 			if (data[0] < 0 || data[0] > 2) {
 				PRINTM(MERROR, "Invalid Mode\n");
@@ -15347,6 +15303,112 @@ done:
 	return ret;
 }
 
+/**
+ * @brief               Set/Get cross chip sync config parameters
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_cross_chip_synch(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
+{
+	mlan_ds_cross_chip_synch *cross_chip_sync = NULL;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc_cfg = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	int data[5] = {0};
+	int header_len = 0;
+	int user_data_len = 0;
+	int ret = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_CROSS_CHIP_SYNCH);
+
+	memset(data, 0, sizeof(data));
+	parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+			&user_data_len);
+
+	if (user_data_len > 5) {
+		PRINTM(MERROR, "invalid parameters\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	misc_cfg = (mlan_ds_misc_cfg *)req->pbuf;
+	misc_cfg->sub_command = MLAN_OID_MISC_CROSS_CHIP_SYNCH;
+	cross_chip_sync = &misc_cfg->param.cross_chip_synch;
+	memset(cross_chip_sync, 0, sizeof(mlan_ds_cross_chip_synch));
+
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		req->action = MLAN_ACT_GET;
+		user_data_len = 0;
+	} else {
+		req->action = MLAN_ACT_SET;
+
+		if (data[0] < 0 || data[0] > 1) {
+			PRINTM(MERROR, "Invalid start_stop value\n");
+			ret = -EINVAL;
+			goto done;
+		} else if (data[1] < 1 || data[1] > 2) {
+			PRINTM(MERROR, "Invalid role value\n");
+			ret = -EINVAL;
+			goto done;
+		} else {
+			cross_chip_sync->start_stop = (t_u8)data[0];
+			cross_chip_sync->role = (t_u8)data[1];
+			cross_chip_sync->period = (t_u32)data[2];
+			cross_chip_sync->init_tsf_low = (t_u32)data[3];
+			cross_chip_sync->init_tsf_high = (t_u32)data[4];
+		}
+	}
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!user_data_len) {
+		/* Copy back to userspace call */
+		moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)cross_chip_sync,
+				sizeof(mlan_ds_cross_chip_synch), respbuflen);
+		ret = sizeof(mlan_ds_cross_chip_synch);
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
+
 #ifdef UAP_SUPPORT
 /**
  * @brief               Set/Get target channel
@@ -16211,8 +16273,8 @@ static int woal_priv_tdls_cs_chan(moal_private *priv, t_u8 *respbuf,
 		goto done;
 	}
 
-	ret = sprintf(respbuf, "off channel %d\n",
-		      misc->param.tdls_cs_channel) +
+	ret = snprintf(respbuf, CMD_BUF_LEN, "off channel %d\n",
+		       misc->param.tdls_cs_channel) +
 	      1;
 
 	PRINTM(MIOCTL, "tdls CS channel %d\n", misc->param.tdls_cs_channel);
@@ -16377,16 +16439,18 @@ done:
  * @param priv          Pointer to moal_private structure
  * @param channel       channel
  * @param oper_class    oper_class
-
+ * @param bandwidth     band width
+ *
  *  @return             SUCCESS/FAIL
  */
 static int woal_check_valid_channel_operclass(moal_private *priv, int channel,
-					      int oper_class)
+					      int oper_class, t_u8 bandwidth)
 {
 	int ret = 0;
 	mlan_ioctl_req *ioctl_req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
+	t_u8 bw;
 
 	ENTER();
 
@@ -16395,6 +16459,18 @@ static int woal_check_valid_channel_operclass(moal_private *priv, int channel,
 		ret = -ENOMEM;
 		goto done;
 	}
+	switch (bandwidth) {
+	case CHANNEL_BW_40MHZ_ABOVE:
+	case CHANNEL_BW_40MHZ_BELOW:
+		bw = CHAN_BW_40MHZ;
+		break;
+	case CHANNEL_BW_80MHZ:
+		bw = CHAN_BW_80MHZ;
+		break;
+	default:
+		bw = CHAN_BW_20MHZ;
+		break;
+	}
 
 	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
 	misc->sub_command = MLAN_OID_MISC_OPER_CLASS_CHECK;
@@ -16402,6 +16478,7 @@ static int woal_check_valid_channel_operclass(moal_private *priv, int channel,
 	ioctl_req->action = MLAN_ACT_GET;
 	misc->param.bw_chan_oper.oper_class = (t_u8)oper_class;
 	misc->param.bw_chan_oper.channel = (t_u8)channel;
+	misc->param.bw_chan_oper.bandwidth = (t_u8)bw;
 
 	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
 	if (status != MLAN_STATUS_SUCCESS) {
@@ -16470,7 +16547,8 @@ static void woal_enable_dfs(moal_private *priv, t_u8 channel, t_u8 wait_option)
  */
 static int woal_action_channel_switch(moal_private *priv, t_u8 block_tx,
 				      t_u8 oper_class, t_u8 channel,
-				      t_u8 switch_count, t_u8 wait_option)
+				      t_u8 switch_count, t_u8 mode,
+				      t_u8 wait_option)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_ds_bss *bss = NULL;
@@ -16488,13 +16566,16 @@ static int woal_action_channel_switch(moal_private *priv, t_u8 block_tx,
 	bss->sub_command = MLAN_OID_ACTION_CHAN_SWITCH;
 	req->req_id = MLAN_IOCTL_BSS;
 	req->action = MLAN_ACT_SET;
+	bss->param.chanswitch.mode = mode;
 	bss->param.chanswitch.chan_switch_mode = block_tx;
 	bss->param.chanswitch.new_channel_num = channel;
 	if (!switch_count)
 		bss->param.chanswitch.chan_switch_count = DEF_NUM_PKTS;
-	else
+	else if (!mode) /* bcast action frame */
 		bss->param.chanswitch.chan_switch_count =
 			MIN(switch_count, MAX_NUM_PKTS);
+	else /* ucast action frame */
+		bss->param.chanswitch.chan_switch_count = switch_count;
 	bss->param.chanswitch.new_oper_class = oper_class;
 	ret = woal_request_ioctl(priv, req, wait_option);
 done:
@@ -16531,7 +16612,9 @@ void woal_move_to_next_channel(moal_private *priv)
 		       __func__);
 	if (ch_dfs.dfs_required)
 		woal_enable_dfs(priv, next_chan, MOAL_NO_WAIT);
-	woal_action_channel_switch(priv, MTRUE, 0, next_chan, 0, MOAL_NO_WAIT);
+	woal_action_channel_switch(priv, MTRUE, 0, next_chan,
+				   priv->chan_num_pkts, priv->chan_mode,
+				   MOAL_NO_WAIT);
 	return;
 }
 #endif
@@ -16550,9 +16633,11 @@ static int woal_priv_extend_channel_switch(moal_private *priv, t_u8 *respbuf,
 {
 	int ret = 0;
 	int user_data_len = 0;
-	int data[5] = {0};
+	int data[6] = {0};
+	t_u8 band = BAND_2GHZ;
 	t_u8 channel;
 	mlan_ds_11h_chan_dfs_state ch_dfs;
+
 	ENTER();
 
 	if (!priv || !priv->phandle || (priv->bss_role != MLAN_BSS_ROLE_UAP) ||
@@ -16581,10 +16666,20 @@ static int woal_priv_extend_channel_switch(moal_private *priv, t_u8 *respbuf,
 		LEAVE();
 		return ret;
 	}
-
-	/* For 2.4G channels skip the DFS checks */
 	channel = data[2];
-	if (channel > MAX_BG_CHANNEL) {
+	if (data[1]) {
+		if (woal_check_valid_channel_operclass(priv, data[2], data[1],
+						       data[4])) {
+			PRINTM(MERROR, "Wrong channel switch parameters!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+	}
+
+	if (channel > MAX_BG_CHANNEL)
+		band = BAND_5GHZ;
+	/* For 2.4G/6G channels skip the DFS checks */
+	if (band == BAND_5GHZ) {
 		memset(&ch_dfs, 0, sizeof(ch_dfs));
 		ch_dfs.channel = data[2];
 
@@ -16607,23 +16702,41 @@ static int woal_priv_extend_channel_switch(moal_private *priv, t_u8 *respbuf,
 			return ret;
 		}
 
-		if (ch_dfs.dfs_required)
+		if (ch_dfs.dfs_required) {
+#ifdef UAP_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+			woal_update_channels_dfs_state(priv, channel, data[4],
+						       DFS_AVAILABLE);
+#endif
+#endif
 			woal_enable_dfs(priv, data[2], MOAL_IOCTL_WAIT);
+		}
 	}
-	if (data[1]) {
-		if (woal_check_valid_channel_operclass(priv, data[2],
-						       data[1])) {
-			PRINTM(MERROR, "Wrong channel switch parameters!\n");
+	if (data[5] && (data[5] < 0 || data[5] > 3)) {
+		PRINTM(MERROR,
+		       "Wrong channel switch parameters for ucast action frame!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (!data[3]) {
+		if (!data[5] && (data[4] < 0 || data[4] > MAX_NUM_PKTS)) {
+			PRINTM(MERROR,
+			       "Bcast action frame count exceeds maximum %d!\n",
+			       MAX_NUM_PKTS);
 			ret = -EINVAL;
 			goto done;
 		}
+		priv->chan_mode = data[5] & DEFAULT_CHAN_MODE_MASK;
+		priv->chan_num_pkts = data[4];
 	}
+
 	if (data[3])
 		woal_channel_switch(priv, data[0], data[1], data[2], data[3],
-				    data[4], MFALSE);
+				    band, data[4], MFALSE);
 	else
 		woal_action_channel_switch(priv, data[0], data[1], data[2],
-					   data[4], MOAL_IOCTL_WAIT);
+					   data[4], data[5], MOAL_IOCTL_WAIT);
 done:
 	LEAVE();
 	return ret;
@@ -16750,7 +16863,7 @@ static int woal_priv_p2p_ecsa(moal_private *priv, t_u8 *respbuf,
 
 	priv->phandle->chsw_wait_q_woken = MFALSE;
 	/* wait for channel switch to complete  */
-	wait_event_interruptible_timeout(
+	(void)wait_event_interruptible_timeout(
 		priv->phandle->chsw_wait_q, priv->phandle->chsw_wait_q_woken,
 		(u32)HZ * (ext_chan_switch->chan_switch_count + 2) * 110 /
 			1000);
@@ -16807,8 +16920,8 @@ static int woal_priv_config_random_mac(moal_private *priv, t_u8 *respbuf,
 			    strlen("On")) == 0) {
 			if (memcmp(priv->random_mac, zero_mac,
 				   MLAN_MAC_ADDR_LENGTH)) {
-				ret = sprintf(respbuf,
-					      "FAKEMAC has been On\n") +
+				ret = snprintf(respbuf, CMD_BUF_LEN,
+					       "FAKEMAC has been On\n") +
 				      1;
 				goto done;
 			}
@@ -17118,7 +17231,7 @@ static int woal_priv_roam_offload_cfg(moal_private *priv, t_u8 *respbuf,
 			*end = '\0';
 		if (pvariable_name && begin) {
 			if (strcmp(pvariable_name, "AUTO_RECONNECT") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 			} else if (strcmp(pvariable_name, "BSSID") == 0) {
 				woal_mac2u8(mac_addr, begin);
 				moal_memcpy_ext(priv->phandle,
@@ -17222,106 +17335,106 @@ static int woal_priv_roam_offload_cfg(moal_private *priv, t_u8 *respbuf,
 					goto done;
 				}
 			} else if (strcmp(pvariable_name, "RETRY_COUNT") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.retry_count = (t_u8)data;
 			} else if (strcmp(pvariable_name,
 					  "TRIGGER_CONDITION") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.trigger_condition =
 					(t_u16)data;
 			} else if (strcmp(pvariable_name, "MAX_RSSI") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.max_rssi = (t_u8)data;
 				roam_offload_cfg.rssi_param_set_flag = 1;
 			} else if (strcmp(pvariable_name, "MIN_RSSI") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.min_rssi = (t_u8)data;
 				roam_offload_cfg.rssi_param_set_flag = 1;
 			} else if (strcmp(pvariable_name, "STEP_RSSI") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.step_rssi = (t_u8)data;
 				roam_offload_cfg.rssi_param_set_flag = 1;
 			} else if (strcmp(pvariable_name, "BAND_PREFER") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.band_rssi.band_preferred =
 					(t_u8)data;
 				roam_offload_cfg.band_rssi_flag = 1;
 			} else if (strcmp(pvariable_name, "RSSI_HYSTERESIS") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.band_rssi.rssi_hysteresis =
 					(t_u8)data;
 				roam_offload_cfg.band_rssi_flag = 1;
 			}
 
 			else if (strcmp(pvariable_name, "BSSTYPE") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.bss_type =
 					(t_u8)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			} else if (strcmp(pvariable_name, "CHANSPERSCAN") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.channels_per_scan =
 					(t_u8)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			} else if (strcmp(pvariable_name, "BGRPTCONDITION") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.bg_rpt_condition =
 					(t_u32)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			} else if (strcmp(pvariable_name, "SCANINTERVAL") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bgscan_cfg.scan_interval =
 					(t_u32)data;
 				roam_offload_cfg.bgscan_set_flag++;
 			}
 
 			else if (strcmp(pvariable_name, "EESMODE") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.ees_mode = (t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "EESRPTCONDITION") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.ees_rpt_condition =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "HIGHSCANPERIOD") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.high_scan_period =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "HIGHSCANCOUNT") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.high_scan_count =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "MIDSCANPERIOD") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.mid_scan_period =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "MIDSCANCOUNT") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.mid_scan_count =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "LOWSCANPERIOD") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.low_scan_period =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
 			} else if (strcmp(pvariable_name, "LOWSCANCOUNT") ==
 				   0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.ees_cfg.low_scan_count =
 					(t_u16)data;
 				roam_offload_cfg.ees_param_set_flag++;
@@ -17329,18 +17442,18 @@ static int woal_priv_roam_offload_cfg(moal_private *priv, t_u8 *respbuf,
 
 			else if (strcmp(pvariable_name, "BCNMISSTHRESHOLD") ==
 				 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.bcn_miss_threshold =
 					(t_u8)data;
 			}
 
 			else if (strcmp(pvariable_name,
 					"PREBCNMISSTHRESHOLD") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.pre_bcn_miss_threshold =
 					(t_u8)data;
 			} else if (strcmp(pvariable_name, "REPEATCOUNT") == 0) {
-				woal_atoi(&data, begin);
+				(void)woal_atoi(&data, begin);
 				roam_offload_cfg.repeat_count = (t_u16)data;
 			} else {
 				PRINTM(MERROR, "Un-support parameter: %s\n",
@@ -17877,13 +17990,307 @@ static int woal_priv_cloud_keep_alive(moal_private *priv, t_u8 *respbuf,
 	return ret;
 }
 
+/**
+ * @brief               Download start keep alive rx parameters
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param mkeep_alive_id       keep alive ID number
+ * @param ip_pke        IP packet from host
+ * @param ip_pke_len    IP packet length from host
+ * @param src_mac       Source MAC address
+ * @param dst_mac       Destination MAC address
+
+ * @return      0: success  fail otherwise
+ */
+int woal_start_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			      t_u8 *ip_pkt, t_u16 ip_pkt_len, t_u8 *src_mac,
+			      t_u8 *dst_mac)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	int ret = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	if (mkeep_alive_id >= MAX_KEEP_ALIVE_RX_ID) {
+		PRINTM(MERROR, "Invalid parameters\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* SET operation */
+	ioctl_req->action = MLAN_ACT_SET;
+	misc->param.keep_alive_rx.mkeep_alive_id = mkeep_alive_id;
+	misc->param.keep_alive_rx.enable = true;
+	moal_memcpy_ext(priv->phandle, misc->param.keep_alive_rx.dst_mac,
+			dst_mac, MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	moal_memcpy_ext(priv->phandle, misc->param.keep_alive_rx.src_mac,
+			src_mac, MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+	misc->param.keep_alive_rx.pkt_len =
+		MIN(ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+	moal_memcpy_ext(priv->phandle, misc->param.keep_alive_rx.packet, ip_pkt,
+			ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Download stop keep alive rx parameters
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param mkeep_alive_id       keep alive ID number
+ * @param ip_pkt        Last packet
+ * @param ip_pkt_len    Last packet length
+
+ * @return      0: success  fail otherwise
+ */
+int woal_stop_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			     t_u8 reset, t_u8 *ip_pkt, t_u8 *pkt_len)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+	mlan_ds_misc_keep_alive_rx *misc_keep_alive_rx = NULL;
+	int ret = 0;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	misc_keep_alive_rx = &misc->param.keep_alive_rx;
+
+	if (mkeep_alive_id >= MAX_KEEP_ALIVE_RX_ID) {
+		PRINTM(MERROR, "Invalid parameters\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* GET operation */
+	ioctl_req->action = MLAN_ACT_GET;
+	misc_keep_alive_rx->mkeep_alive_id = mkeep_alive_id;
+	misc_keep_alive_rx->enable = false;
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (!misc_keep_alive_rx->enable) {
+		PRINTM(MERROR, "ID %d is already stop\n", mkeep_alive_id);
+		goto done;
+	}
+
+	if (reset)
+		ioctl_req->action = MLAN_ACT_RESET;
+	else
+		/* SET operation */
+		ioctl_req->action = MLAN_ACT_SET;
+	misc_keep_alive_rx->mkeep_alive_id = mkeep_alive_id;
+	misc_keep_alive_rx->enable = false;
+
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+	if (pkt_len) {
+		*pkt_len = MIN(misc_keep_alive_rx->pkt_len,
+			       (MKEEP_ALIVE_ACK_PKT_MAX - 1));
+		PRINTM(MINFO, "keep alive rx stop pkt_len is %d\n", *pkt_len);
+	}
+	if (*pkt_len && ip_pkt)
+		moal_memcpy_ext(priv->phandle, ip_pkt,
+				misc_keep_alive_rx->packet, *pkt_len, *pkt_len);
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Save cloud keep alive params in driver handle
+ *
+ * @param priv          Pointer to moal_private structure
+ * @params              Other params for keep alive
+
+ *  @return             Number of bytes written, negative for failure.
+ */
+int woal_priv_save_cloud_keep_alive_params_rx(moal_private *priv,
+					      t_u8 mkeep_alive_id, t_u8 enable,
+					      t_u16 ether_type, t_u8 *ip_pkt,
+					      t_u16 ip_pkt_len, t_u8 *src_mac,
+					      t_u8 *dst_mac)
+{
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0;
+	mlan_ds_misc_keep_alive_rx *keep_alive_rx = NULL;
+	moal_handle *phandle = NULL;
+
+	ENTER();
+
+	if (!priv || !priv->phandle) {
+		PRINTM(MERROR, "priv or handle is null\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	phandle = priv->phandle;
+
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CLOUD_KEEP_ALIVE_RX;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	if (mkeep_alive_id >= MAX_KEEP_ALIVE_RX_ID) {
+		PRINTM(MERROR, "Invalid parameters\n");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	/* GET operation */
+	ioctl_req->action = MLAN_ACT_GET;
+	misc->param.keep_alive_rx.mkeep_alive_id = mkeep_alive_id;
+	misc->param.keep_alive_rx.enable = true;
+
+	ret = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (ret != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	if (misc->param.keep_alive_rx.enable) {
+		PRINTM(MERROR, "ID %d is in use\n", mkeep_alive_id);
+		ret = -EINVAL;
+		goto done;
+	}
+
+	keep_alive_rx = &phandle->keep_alive_rx[mkeep_alive_id];
+	keep_alive_rx->mkeep_alive_id = mkeep_alive_id;
+	keep_alive_rx->enable = enable;
+	if (enable) {
+		keep_alive_rx->cached = true;
+		moal_memcpy_ext(phandle, keep_alive_rx->dst_mac, dst_mac,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		moal_memcpy_ext(phandle, keep_alive_rx->src_mac, src_mac,
+				MLAN_MAC_ADDR_LENGTH, MLAN_MAC_ADDR_LENGTH);
+		keep_alive_rx->pkt_len =
+			MIN(ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+		moal_memcpy_ext(phandle, keep_alive_rx->packet, ip_pkt,
+				ip_pkt_len, MKEEP_ALIVE_ACK_PKT_MAX);
+		if (ether_type)
+			keep_alive_rx->ether_type = ether_type;
+		else
+			keep_alive_rx->ether_type = 0;
+	}
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+
+	LEAVE();
+	return ret;
+}
+
+/**
+ * @brief               Cloud keep alive rx feature
+ *
+ * @param priv          Pointer to moal_private structure
+ * @param respbuf       Pointer to response buffer
+ * @param resplen       Response buffer length
+
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_cloud_keep_alive_rx(moal_private *priv, t_u8 *respbuf,
+					 t_u32 respbuflen)
+{
+	int ret = 0;
+	cloud_keep_alive_rx *keep_alive_rx = NULL;
+	int header_len = 0;
+
+	ENTER();
+
+	header_len = strlen(PRIV_CMD_CLOUD_KEEP_ALIVE_RX);
+
+	keep_alive_rx = (cloud_keep_alive_rx *)(respbuf + header_len);
+
+	if (keep_alive_rx->enable) {
+		ret = woal_priv_save_cloud_keep_alive_params_rx(
+			priv, keep_alive_rx->mkeep_alive_id,
+			keep_alive_rx->enable, 0, keep_alive_rx->pkt,
+			keep_alive_rx->pkt_len, keep_alive_rx->src_mac,
+			keep_alive_rx->dst_mac);
+	} else {
+		if (0 != woal_stop_mkeep_alive_rx(
+				 priv, keep_alive_rx->mkeep_alive_id,
+				 keep_alive_rx->reset, keep_alive_rx->pkt,
+				 &keep_alive_rx->pkt_len)) {
+			ret = -EFAULT;
+			return ret;
+		}
+		ret = respbuflen;
+	}
+
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Set/Get static rx abort config
  *
  *  @param priv         A pointer to moal_private structure
  *  @param respbuf      A pointer to response buffer
  *  @param respbuflen   Available length of response buffer
- *
+
  *  @return             Number of bytes written, negative for failure.
  */
 static int woal_priv_rx_abort_cfg(moal_private *priv, t_u8 *respbuf,
@@ -17960,6 +18367,90 @@ done:
 	LEAVE();
 	return ret;
 }
+/**
+ *  @brief Set/Get static OFDM DESENSE CFG
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param respbuf      A pointer to response buffer
+ *  @param respbuflen   Available length of response buffer
+ *
+ *  @return             Number of bytes written, negative for failure.
+ */
+static int woal_priv_ofdm_desense_cfg(moal_private *priv, t_u8 *respbuf,
+				      t_u32 respbuflen)
+{
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	int ret = 0;
+	int data[2] = {0};
+	int header_len = 0, user_data_len = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	if (!respbuf) {
+		PRINTM(MERROR, "response buffer is not available!\n");
+		ret = -EINVAL;
+		goto done;
+	}
+	header_len = strlen(CMD_NXP) + strlen(PRIV_CMD_OFDM_DESENSE_CFG);
+	user_data_len = strlen(respbuf) - header_len;
+
+	/* Allocate an IOCTL request buffer */
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_OFDM_DESENSE_CFG;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+	if ((int)strlen(respbuf) == header_len) {
+		/* GET operation */
+		user_data_len = 0;
+		req->action = MLAN_ACT_GET;
+	} else {
+		/* SET operation */
+		parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
+				&user_data_len);
+		if (user_data_len > 2 ||
+		    (data[0] == MTRUE && user_data_len != 2)) {
+			PRINTM(MERROR, "Invalid number of args!\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		if (data[0] == MTRUE && data[1] > 0x7f) {
+			PRINTM(MERROR, "Invalid threshold value\n");
+			ret = -EINVAL;
+			goto done;
+		}
+		misc->param.ofdm_desense_cfg.enable = (t_u8)data[0];
+		if (user_data_len == 2)
+			misc->param.ofdm_desense_cfg.cca_threshold =
+				(t_s8)data[1];
+		req->action = MLAN_ACT_SET;
+	}
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	data[0] = misc->param.ofdm_desense_cfg.enable;
+	data[1] = misc->param.ofdm_desense_cfg.cca_threshold;
+	moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data, sizeof(data),
+			respbuflen);
+	ret = sizeof(data);
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(req);
+
+	LEAVE();
+	return ret;
+}
 
 /**
  *  @brief Set/Get dynamic rx abort config
@@ -17976,7 +18467,7 @@ static int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc = NULL;
 	int ret = 0;
-	int data[3] = {0};
+	int data[7] = {0};
 	int header_len = 0, user_data_len = 0;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 
@@ -18009,8 +18500,9 @@ static int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
 		/* SET operation */
 		parse_arguments(respbuf + header_len, data, ARRAY_SIZE(data),
 				&user_data_len);
-		if (user_data_len > 3 ||
-		    (data[0] == MTRUE && user_data_len != 3)) {
+		if (user_data_len > 4 ||
+		    ((data[0] == MTRUE && user_data_len != 3) &&
+		     (data[0] == MTRUE && user_data_len != 4))) {
 			PRINTM(MERROR, "Invalid number of args!\n");
 			ret = -EINVAL;
 			goto done;
@@ -18021,12 +18513,18 @@ static int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
 				ret = -EINVAL;
 				goto done;
 			}
-			if (data[2] > 0x7f) {
+			if (data[2] > 0x7f && data[2] != 0xff) {
 				PRINTM(MERROR,
 				       "Invalid ceil threshold value\n");
 				ret = -EINVAL;
 				goto done;
 			}
+			if (data[3] > 0x7f) {
+				PRINTM(MERROR,
+				       "Invalid floor threshold value\n");
+				ret = -EINVAL;
+				goto done;
+			}
 		}
 		misc->param.rx_abort_cfg_ext.enable = (t_u8)data[0];
 		if (user_data_len > 1) {
@@ -18034,6 +18532,19 @@ static int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
 				(t_s8)data[1];
 			misc->param.rx_abort_cfg_ext.ceil_rssi_threshold =
 				(t_s8)data[2];
+			/** not to update floor_rssi_threshold if not included
+			 * in coammnd */
+			if (user_data_len == 3)
+				misc->param.rx_abort_cfg_ext
+					.floor_rssi_threshold = 0xff;
+			else
+				misc->param.rx_abort_cfg_ext
+					.floor_rssi_threshold = (t_s8)data[3];
+
+			misc->param.rx_abort_cfg_ext
+				.current_dynamic_rssi_threshold = 0;
+			misc->param.rx_abort_cfg_ext.rssi_default_config = 0;
+			misc->param.rx_abort_cfg_ext.edmac_enable = 0;
 		}
 		req->action = MLAN_ACT_SET;
 	}
@@ -18047,6 +18558,11 @@ static int woal_priv_rx_abort_cfg_ext(moal_private *priv, t_u8 *respbuf,
 	data[0] = misc->param.rx_abort_cfg_ext.enable;
 	data[1] = misc->param.rx_abort_cfg_ext.rssi_margin;
 	data[2] = misc->param.rx_abort_cfg_ext.ceil_rssi_threshold;
+	data[3] = misc->param.rx_abort_cfg_ext.floor_rssi_threshold;
+	data[4] = misc->param.rx_abort_cfg_ext.current_dynamic_rssi_threshold;
+	data[5] = misc->param.rx_abort_cfg_ext.rssi_default_config;
+	data[6] = misc->param.rx_abort_cfg_ext.edmac_enable;
+
 	moal_memcpy_ext(priv->phandle, respbuf, (t_u8 *)data, sizeof(data),
 			respbuflen);
 	ret = sizeof(data);
@@ -18911,7 +19427,6 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		ret = -EFAULT;
 		goto done;
 	}
-#define CMD_BUF_LEN 4096
 	if (priv_cmd.used_len < 0 || priv_cmd.total_len <= 0 ||
 	    priv_cmd.used_len > priv_cmd.total_len) {
 		PRINTM(MERROR,
@@ -19353,6 +19868,14 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			len = woal_priv_rx_abort_cfg(priv, buf,
 						     priv_cmd.total_len);
 			goto handled;
+
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_OFDM_DESENSE_CFG,
+				    strlen(PRIV_CMD_OFDM_DESENSE_CFG)) == 0) {
+			/* OFDM DESENSE config */
+			len = woal_priv_ofdm_desense_cfg(priv, buf,
+							 priv_cmd.total_len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_TX_AMPDU_PROT_MODE,
 				    strlen(PRIV_CMD_TX_AMPDU_PROT_MODE)) == 0) {
@@ -19620,8 +20143,8 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 				len = woal_priv_offchannel(priv, buf,
 							   priv_cmd.total_len);
 			} else
-				len = sprintf(buf,
-					      "CFG80211 is not enabled\n") +
+				len = snprintf(buf, CMD_BUF_LEN,
+					       "CFG80211 is not enabled\n") +
 				      1;
 			goto handled;
 #endif
@@ -19824,6 +20347,12 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			len = woal_priv_get_ch_load(priv, buf,
 						    priv_cmd.total_len);
 			goto handled;
+		} else if (strnicmp(buf + strlen(CMD_NXP),
+				    PRIV_CMD_CROSS_CHIP_SYNCH,
+				    strlen(PRIV_CMD_CROSS_CHIP_SYNCH)) == 0) {
+			len = woal_priv_cross_chip_synch(priv, buf,
+							 priv_cmd.total_len);
+			goto handled;
 		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_CH_LOAD_RESULTS,
 				    strlen(PRIV_CMD_CH_LOAD_RESULTS)) == 0) {
@@ -20087,8 +20616,8 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 				len = woal_priv_dfs_offload_enable(
 					priv, buf, priv_cmd.total_len);
 			else
-				len = sprintf(buf,
-					      "CFG80211 is not enabled\n") +
+				len = snprintf(buf, CMD_BUF_LEN,
+					       "CFG80211 is not enabled\n") +
 				      1;
 			goto handled;
 #endif
@@ -20157,6 +20686,17 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 						     priv_cmd.total_len);
 			len += strlen(PRIV_CMD_TWT_TEARDOWN) + strlen(CMD_NXP);
 			goto handled;
+
+		} else if (strnicmp(buf + strlen(CMD_NXP), PRIV_CMD_TWT_REPORT,
+				    strlen(PRIV_CMD_TWT_REPORT)) == 0) {
+			pdata = buf + strlen(CMD_NXP) +
+				strlen(PRIV_CMD_TWT_REPORT);
+			len = priv_cmd.used_len - strlen(PRIV_CMD_TWT_REPORT) -
+			      strlen(CMD_NXP);
+			len = woal_priv_twt_report(priv, pdata, len,
+						   priv_cmd.total_len);
+			len += strlen(PRIV_CMD_TWT_REPORT) + strlen(CMD_NXP);
+			goto handled;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		} else if (strnicmp(buf + strlen(CMD_NXP),
 				    PRIV_CMD_GET_CFG_CHAN_LIST,
@@ -20166,8 +20706,8 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 				len = woal_priv_getcfgchanlist(
 					priv, buf, priv_cmd.total_len);
 			else
-				len = sprintf(buf,
-					      "CFG80211 is not enabled\n") +
+				len = snprintf(buf, CMD_BUF_LEN,
+					       "CFG80211 is not enabled\n") +
 				      1;
 			goto handled;
 #endif
@@ -20208,7 +20748,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SCAN-CFG", strlen("SCAN-CFG")) == 0) {
 		PRINTM(MIOCTL, "Set SCAN CFG\n");
 		if (MLAN_STATUS_SUCCESS !=
@@ -20216,7 +20756,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RSSI", strlen("RSSI")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
@@ -20230,11 +20770,12 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "%.32s rssi %d\n",
-				      bss_info.ssid.ssid, signal.bcn_rssi_avg) +
+			len = snprintf(buf, CMD_BUF_LEN, "%.32s rssi %d\n",
+				       bss_info.ssid.ssid,
+				       signal.bcn_rssi_avg) +
 			      1;
 		} else {
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 		}
 	} else if (strncmp(buf, "LINKSPEED", strlen("LINKSPEED")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -20243,16 +20784,17 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			goto done;
 		}
 		PRINTM(MIOCTL, "tx rate=%d\n", (int)rate.rate);
-		len = sprintf(buf, "LinkSpeed %d\n",
-			      (int)(rate.rate * 500000 / 1000000)) +
+		len = snprintf(buf, CMD_BUF_LEN, "LinkSpeed %d\n",
+			       (int)(rate.rate * 500000 / 1000000)) +
 		      1;
 	} else
 #endif
 		if (strncmp(buf, "MACADDR", strlen("MACADDR")) == 0) {
-		len = sprintf(buf, "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
-			      priv->current_addr[0], priv->current_addr[1],
-			      priv->current_addr[2], priv->current_addr[3],
-			      priv->current_addr[4], priv->current_addr[5]) +
+		len = snprintf(buf, CMD_BUF_LEN,
+			       "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
+			       priv->current_addr[0], priv->current_addr[1],
+			       priv->current_addr[2], priv->current_addr[3],
+			       priv->current_addr[4], priv->current_addr[5]) +
 		      1;
 	}
 #ifdef STA_SUPPORT
@@ -20262,7 +20804,9 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "powermode = %d\n", power_mode) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "powermode = %d\n",
+			       power_mode) +
+		      1;
 	} else if (strncmp(buf, "SCAN-ACTIVE", strlen("SCAN-ACTIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_ACTIVE)) {
@@ -20271,7 +20815,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_ACTIVE;
 		PRINTM(MIOCTL, "Set Active Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SCAN-PASSIVE", strlen("SCAN-PASSIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_PASSIVE)) {
@@ -20280,7 +20824,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_PASSIVE;
 		PRINTM(MIOCTL, "Set Passive Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "POWERMODE", strlen("POWERMODE")) == 0) {
 		pdata = buf + strlen("POWERMODE") + 1;
 		if (!moal_extflg_isset(priv->phandle, EXT_HW_TEST)) {
@@ -20290,7 +20834,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 				goto done;
 			}
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SETROAMING", strlen("SETROAMING")) == 0) {
 		pdata = buf + strlen("SETROAMING") + 1;
 #ifdef STA_CFG80211
@@ -20308,7 +20852,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			PRINTM(MIOCTL, "Roaming disabled\n");
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "ROAM", strlen("ROAM")) == 0) {
 		pdata = buf + strlen("ROAM") + 1;
 #ifdef STA_CFG80211
@@ -20326,7 +20870,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			PRINTM(MIOCTL, "Roaming disabled\n");
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "COUNTRYCODE", strlen("COUNTRYCODE")) == 0) {
 		memset(country_code, 0, sizeof(country_code));
 		if (MLAN_STATUS_SUCCESS !=
@@ -20334,7 +20878,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "%s\n", country_code) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "%s\n", country_code) + 1;
 	} else if (strncmp(buf, "COUNTRY", strlen("COUNTRY")) == 0) {
 		copy_len = strlen(buf) - strlen("COUNTRY") - 1;
 		if (copy_len > COUNTRY_CODE_LEN || copy_len <= 0) {
@@ -20364,7 +20908,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 
 				regulatory_hint(priv->wdev->wiphy,
 						country_code);
-				len = sprintf(buf, "OK\n") + 1;
+				len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 				goto done;
 			}
 		}
@@ -20374,7 +20918,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (memcmp(buf, WEXT_CSCAN_HEADER, WEXT_CSCAN_HEADER_SIZE) ==
 		   0) {
 		PRINTM(MIOCTL, "Set Combo Scan\n");
@@ -20383,38 +20927,38 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "GETBAND", strlen("GETBAND")) == 0) {
 		if (MLAN_STATUS_SUCCESS != woal_get_band(priv, &band)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "Band %d\n", band) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "Band %d\n", band) + 1;
 	} else if (strncmp(buf, "SETBAND", strlen("SETBAND")) == 0) {
 		pband = buf + strlen("SETBAND") + 1;
 		if (MLAN_STATUS_SUCCESS != woal_set_band(priv, pband)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 	else if (strncmp(buf, "START", strlen("START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "STOP", strlen("STOP")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #ifdef UAP_SUPPORT
 	else if (strncmp(buf, "AP_BSS_START", strlen("AP_BSS_START")) == 0) {
 		ret = woal_uap_bss_ctrl(priv, MOAL_IOCTL_WAIT, UAP_BSS_START);
 		if (ret)
 			goto done;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "AP_BSS_STOP", strlen("AP_BSS_STOP")) == 0) {
 		ret = woal_uap_bss_ctrl(priv, MOAL_IOCTL_WAIT, UAP_BSS_STOP);
 		if (ret)
 			goto done;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "AP_SET_CFG", strlen("AP_SET_CFG")) == 0) {
 		if (priv_cmd.total_len <= (int)strlen("AP_SET_CFG") + 1)
 			goto done;
@@ -20424,34 +20968,34 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 						  strlen("AP_SET_CFG") - 1);
 		if (ret)
 			goto done;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "WL_FW_RELOAD", strlen("WL_FW_RELOAD")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "AP_GET_STA_LIST", strlen("AP_GET_STA_LIST")) ==
 		   0) {
 		/* TODO Add STA list support */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 	else if (strncmp(buf, "SETSUSPENDOPT", strlen("SETSUSPENDOPT")) == 0) {
 		/* it will be done by GUI */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SETSUSPENDMODE", strlen("SETSUSPENDMODE")) ==
 		   0) {
 		/* it will be done by GUI */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXMODE", strlen("BTCOEXMODE")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-START",
 			   strlen("BTCOEXSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-STOP", strlen("BTCOEXSCAN-STOP")) ==
 		   0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #ifdef STA_SUPPORT
 	else if (strncmp(buf, "BGSCAN-START", strlen("BGSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-CONFIG", strlen("BGSCAN-CONFIG")) ==
 		   0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -20461,7 +21005,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		}
 		priv->bg_scan_start = MTRUE;
 		priv->bg_scan_reported = MFALSE;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-STOP", strlen("BGSCAN-STOP")) == 0) {
 		if (priv->bg_scan_start && !priv->scan_cfg.rssi_threshold) {
 			if (MLAN_STATUS_FAILURE ==
@@ -20472,7 +21016,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			priv->bg_scan_start = MFALSE;
 			priv->bg_scan_reported = MFALSE;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-START", strlen("RXFILTER-START")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -20480,7 +21024,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-STOP", strlen("RXFILTER-STOP")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -20488,7 +21032,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #ifdef STA_CFG80211
 	else if (strncmp(buf, "GET_EVENT", strlen("GET_EVENT")) == 0) {
@@ -20497,10 +21041,12 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 				woal_inform_bss_from_scan_result(
 					priv, NULL, MOAL_IOCTL_WAIT);
 		}
-		len = sprintf(buf, "EVENT=%d\n", priv->last_event) + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "EVENT=%d\n",
+			       priv->last_event) +
+		      1;
 		priv->last_event = 0;
 	} else if (strncmp(buf, "GET_802_11W", strlen("GET_802_11W")) == 0) {
-		len = sprintf(buf, "802_11W=ENABLED\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "802_11W=ENABLED\n") + 1;
 	}
 #endif /* STA_CFG80211 */
 	else if (strncmp(buf, "RXFILTER-ADD", strlen("RXFILTER-ADD")) == 0) {
@@ -20509,7 +21055,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-REMOVE", strlen("RXFILTER-REMOVE")) ==
 		   0) {
 		pdata = buf + strlen("RXFILTER-REMOVE") + 1;
@@ -20517,7 +21063,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "QOSINFO", strlen("QOSINFO")) == 0) {
 		pdata = buf + strlen("QOSINFO") + 1;
 #ifdef STA_SUPPORT
@@ -20527,14 +21073,14 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			goto done;
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SLEEPPD", strlen("SLEEPPD")) == 0) {
 		pdata = buf + strlen("SLEEPPD") + 1;
 		if (MLAN_STATUS_SUCCESS != woal_set_sleeppd(priv, pdata)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SET_AP_WPS_P2P_IE",
 			   strlen("SET_AP_WPS_P2P_IE")) == 0) {
 		pdata = buf + strlen("SET_AP_WPS_P2P_IE") + 1;
@@ -20555,7 +21101,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		}
 #endif
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 	else if (strncmp(buf, "P2P_DEV_ADDR", strlen("P2P_DEV_ADDR")) == 0) {
@@ -20588,7 +21134,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		}
 #endif
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strnicmp(buf, "SCAN_TIMING", strlen("SCAN_TIMING")) == 0) {
 #ifdef WIFI_DIRECT_SUPPORT
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
@@ -20599,7 +21145,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 		}
 #endif
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strnicmp(buf, "BA_WSIZE_RX", strlen("BA_WSIZE_RX")) == 0) {
 		pdata = buf + strlen("BA_WSIZE_RX") + 1;
 		len = priv_cmd.total_len - strlen("BA_WSIZE_RX") - 1;
@@ -20608,7 +21154,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strnicmp(buf, "BA_WSIZE_TX", strlen("BA_WSIZE_TX")) == 0) {
 		pdata = buf + strlen("BA_WSIZE_TX") + 1;
 		len = priv_cmd.total_len - strlen("BA_WSIZE_TX") - 1;
@@ -20617,7 +21163,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "FAKE_SCAN_COMPLETE",
 			   strlen("FAKE_SCAN_COMPLETE")) == 0) {
 		pdata = buf + strlen("FAKE_SCAN_COMPLETE") + 1;
@@ -20630,7 +21176,7 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			PRINTM(MIOCTL, "fake scan complete disabled\n");
 		}
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #ifdef WIFI_DIRECT_SUPPORT
@@ -20641,13 +21187,13 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	}
 #endif
 #endif
 	else if (strncmp(buf, "WLS_BATCHING", strlen("WLS_BATCHING")) == 0) {
 		/* TODO */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, CMD_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "TDLS_CS_CHAN", strlen("TDLS_CS_CHAN")) == 0) {
 		len = woal_priv_tdls_cs_chan(priv, buf, priv_cmd.total_len);
 	}
@@ -20673,6 +21219,10 @@ int woal_android_priv_cmd(struct net_device *dev, struct ifreq *req)
 			   strlen("SETROAMPASSPHRASE")) == 0) {
 		len = woal_priv_set_roam_passphrase(priv, buf,
 						    priv_cmd.total_len);
+	} else if (strncmp(buf, PRIV_CMD_CLOUD_KEEP_ALIVE_RX,
+			   strlen(PRIV_CMD_CLOUD_KEEP_ALIVE_RX)) == 0) {
+		len = woal_priv_cloud_keep_alive_rx(priv, buf,
+						    priv_cmd.total_len);
 	} else if (strncmp(buf, PRIV_CMD_CLOUD_KEEP_ALIVE,
 			   strlen(PRIV_CMD_CLOUD_KEEP_ALIVE)) == 0) {
 		len = woal_priv_cloud_keep_alive(priv, buf, priv_cmd.total_len);
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h
index 3013769..e9a09b9 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_eth_ioctl.h
@@ -4,7 +4,7 @@
  * @brief This file contains definition for private IOCTL call.
  *
  *
- * Copyright 2008-2022 NXP
+ * Copyright 2008-2023 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -297,11 +297,14 @@ typedef struct _chan_stats {
 #define PRIV_CMD_STATS "stats"
 #define PRIV_CMD_CH_LOAD "getchload"
 #define PRIV_CMD_CH_LOAD_RESULTS "getloadresults"
+#define PRIV_CMD_CROSS_CHIP_SYNCH "crosssynch"
 
 #define PRIV_CMD_ARB_CFG "arb"
 
 /**Private command to configure static rx abort config */
 #define PRIV_CMD_RX_ABORT_CFG "rx_abort_cfg"
+/**Private command to configure static OFDM DESENSE config */
+#define PRIV_CMD_OFDM_DESENSE_CFG "ofdm_desense_cfg"
 /**Private command to configure dynamic rx abort config */
 #define PRIV_CMD_RX_ABORT_CFG_EXT "rx_abort_cfg_ext"
 #define TX_AMPDU_RTS_CTS 0
@@ -390,6 +393,8 @@ typedef struct _ssu_params_cfg {
 #define PRIV_CMD_TWT_SETUP "twt_setup"
 /** Private command: TWT Teardown Cfg */
 #define PRIV_CMD_TWT_TEARDOWN "twt_teardown"
+/** Private command: TWT report Cfg */
+#define PRIV_CMD_TWT_REPORT "twt_report"
 
 #define PRIV_CMD_LPM "lpm"
 
@@ -684,6 +689,26 @@ typedef struct _cloud_keep_alive {
 	/** packet content */
 	t_u8 pkt[255];
 } __ATTRIB_PACK__ cloud_keep_alive;
+/** cloud keep alive parameters */
+#define PRIV_CMD_CLOUD_KEEP_ALIVE_RX "cloud_keep_alive_rx"
+typedef struct _cloud_keep_alive_rx {
+	/** id */
+	t_u8 mkeep_alive_id;
+	/** enable/disable of this id */
+	t_u8 enable;
+	/** enable/disable reset*/
+	t_u8 reset;
+	/** Reserved */
+	t_u8 reserved;
+	/** Destination MAC address */
+	t_u8 dst_mac[ETH_ALEN];
+	/** Source MAC address */
+	t_u8 src_mac[ETH_ALEN];
+	/** packet length */
+	t_u8 pkt_len;
+	/** packet content */
+	t_u8 pkt[100];
+} __ATTRIB_PACK__ cloud_keep_alive_rx;
 
 #define TLV_TYPE_PER_PKT_CFG 0x0001
 #define TX_PKT_CTRL MBIT(0)
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_init.c b/mxm_wifiex/wlan_src/mlinux/moal_init.c
index cdc57a3..71b087f 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_init.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_init.c
@@ -136,7 +136,7 @@ static int slew_rate = 3;
 int tx_work = 0;
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 /**
  * RPS to steer packets to specific CPU
  * Default value of 0 keeps rps disabled by default
@@ -161,6 +161,8 @@ static int pmqos = 0;
 
 static int chan_track = 0;
 static int mcs32 = 1;
+/** hs_auto_arp setting */
+static int hs_auto_arp = 0;
 
 #if defined(STA_SUPPORT)
 /** 802.11d configuration */
@@ -287,6 +289,19 @@ static t_u16 multi_dtim;
 
 static t_u16 inact_tmo;
 
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/* default filter flag 0x27 Stands for
+  (MLAN_NETMON_NON_BSS_BCN | \
+   MLAN_NETMON_DATA | \
+   MLAN_NETMON_CONTROL | \
+   MLAN_NETMON_MANAGEMENT)
+*/
+#define DEFAULT_NETMON_FILTER 0x27
+static int mon_filter = DEFAULT_NETMON_FILTER;
+#endif
+#endif
+
 #ifdef DEBUG_LEVEL1
 #ifdef DEBUG_LEVEL2
 #define DEFAULT_DEBUG_MASK (0xffffffff)
@@ -328,9 +343,10 @@ static card_type_entry card_type_map_tbl[] = {
 #ifdef SD9177
 	{CARD_TYPE_SD9177, 0, CARD_SD9177},
 #endif
-#ifdef SDNW62X
-	{CARD_TYPE_SDNW62X, 0, CARD_SDNW62X},
+#ifdef SDIW62X
+	{CARD_TYPE_SDIW62X, 0, CARD_SDIW62X},
 #endif
+	{CARD_TYPE_SDAW693, 0, CARD_SDAW693},
 #ifdef PCIE8897
 	{CARD_TYPE_PCIE8897, 0, CARD_PCIE8897},
 #endif
@@ -343,8 +359,9 @@ static card_type_entry card_type_map_tbl[] = {
 #ifdef PCIE9098
 	{CARD_TYPE_PCIE9098, 0, CARD_PCIE9098},
 #endif
-#ifdef PCIENW62X
-	{CARD_TYPE_PCIENW62X, 0, CARD_PCIENW62X},
+	{CARD_TYPE_PCIEAW693, 0, CARD_PCIEAW693},
+#ifdef PCIEIW62X
+	{CARD_TYPE_PCIEIW62X, 0, CARD_PCIEIW62X},
 #endif
 #ifdef USB8801
 	{CARD_TYPE_USB8801, 0, CARD_USB8801},
@@ -365,8 +382,8 @@ static card_type_entry card_type_map_tbl[] = {
 #ifdef USB9097
 	{CARD_TYPE_USB9097, 0, CARD_USB9097},
 #endif
-#ifdef USBNW62X
-	{CARD_TYPE_USBNW62X, 0, CARD_USBNW62X},
+#ifdef USBIW62X
+	{CARD_TYPE_USBIW62X, 0, CARD_USBIW62X},
 #endif
 
 };
@@ -374,7 +391,7 @@ static card_type_entry card_type_map_tbl[] = {
 static int dfs53cfg = DFS_W53_DEFAULT_FW;
 
 static int keep_previous_scan = 1;
-
+static int auto_11ax = 1;
 /**
  *  @brief This function read a line in module parameter file
  *
@@ -390,7 +407,8 @@ static t_size parse_cfg_get_line(t_u8 *data, t_size size, t_u8 *line_pos)
 
 	ENTER();
 
-	if (pos >= (t_s32)size) { /* reach the end */
+	if ((pos >= (t_s32)size) || (data == NULL) ||
+	    (line_pos == NULL)) { /* reach the end */
 		pos = 0; /* Reset position for rfkill */
 		LEAVE();
 		return -1;
@@ -535,7 +553,7 @@ static mlan_status parse_line_read_card_info(t_u8 *line, char **type,
 	*p = '\0';
 
 	p = strstr(line, "_");
-	if (p != NULL) {
+	if ((p != NULL) && ((p + 1) != NULL)) {
 		*p++ = '\0';
 		*if_id = p;
 	} else {
@@ -683,6 +701,18 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			params->drv_mode = out_data;
 			PRINTM(MMSG, "drv_mode = %d\n", params->drv_mode);
 		}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		else if (strncmp(line, "mon_filter", strlen("mon_filter")) ==
+			 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->mon_filter = out_data;
+			PRINTM(MMSG, "mon_filter = %d\n", params->mon_filter);
+		}
+#endif
+#endif
 #ifdef DEBUG_LEVEL1
 		else if (strncmp(line, "drvdbg", strlen("drvdbg")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
@@ -1210,7 +1240,7 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 									"off");
 		}
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 		else if (strncmp(line, "rps", strlen("rps")) == 0) {
 			if (parse_line_read_int(line, &out_data) !=
 			    MLAN_STATUS_SUCCESS)
@@ -1380,6 +1410,13 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 				goto err;
 			params->mcs32 = out_data;
 			PRINTM(MMSG, "mcs32=%d\n", params->mcs32);
+		} else if (strncmp(line, "hs_auto_arp",
+				   strlen("hs_auto_arp")) == 0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->hs_auto_arp = out_data;
+			PRINTM(MMSG, "hs_auto_arp=%d\n", params->hs_auto_arp);
 		}
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
@@ -1423,6 +1460,13 @@ static mlan_status parse_cfg_read_block(t_u8 *data, t_u32 size,
 			params->keep_previous_scan = out_data;
 			PRINTM(MMSG, "keep_previous_scan=%d\n",
 			       params->keep_previous_scan);
+		} else if (strncmp(line, "auto_11ax", strlen("auto_11ax")) ==
+			   0) {
+			if (parse_line_read_int(line, &out_data) !=
+			    MLAN_STATUS_SUCCESS)
+				goto err;
+			params->auto_11ax = out_data;
+			PRINTM(MMSG, "auto_11ax=%d\n", params->auto_11ax);
 		}
 	}
 	if (end)
@@ -1488,6 +1532,13 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 	handle->params.drv_mode = drv_mode;
 	if (params)
 		handle->params.drv_mode = params->drv_mode;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	handle->params.mon_filter = mon_filter;
+	if (params)
+		handle->params.mon_filter = params->mon_filter;
+#endif
+#endif
 #ifdef DEBUG_LEVEL1
 	handle->params.drvdbg = drvdbg;
 	if (params)
@@ -1516,6 +1567,11 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 		handle->params.mcs32 = params->mcs32;
 	}
 #endif /* UAP_SUPPORT */
+
+	handle->params.hs_auto_arp = hs_auto_arp;
+	if (params) {
+		handle->params.hs_auto_arp = params->hs_auto_arp;
+	}
 #ifdef WIFI_DIRECT_SUPPORT
 	handle->params.max_wfd_bss = max_wfd_bss;
 	woal_dup_string(&handle->params.wfd_name, wfd_name);
@@ -1694,7 +1750,7 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 		moal_extflg_set(handle, EXT_TX_WORK);
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 	handle->params.rps = rps & RPS_CPU_MASK;
 	PRINTM(MMSG, "rps set to %x from module param\n", handle->params.rps);
 #endif
@@ -1764,6 +1820,7 @@ static void woal_setup_module_param(moal_handle *handle, moal_mod_para *params)
 			handle->params.dfs53cfg = params->dfs53cfg;
 	}
 	handle->params.keep_previous_scan = keep_previous_scan;
+	handle->params.auto_11ax = auto_11ax;
 }
 
 /**
@@ -1850,6 +1907,7 @@ static mlan_status woal_req_mod_param(moal_handle *handle, char *mod_file)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	struct device *dev = handle->hotplug_device;
+	int status;
 
 	if (dev == NULL) {
 		PRINTM(MERROR, "No device attached\n");
@@ -1857,10 +1915,12 @@ static mlan_status woal_req_mod_param(moal_handle *handle, char *mod_file)
 		goto out;
 	}
 
-	ret = request_firmware(&handle->param_data, mod_file, dev);
-	if (ret < 0)
+	status = request_firmware(&handle->param_data, mod_file, dev);
+	if (status < 0) {
 		PRINTM(MERROR, "Request firmware: %s failed, error: %d\n",
 		       mod_file, ret);
+		ret = MLAN_STATUS_FAILURE;
+	}
 out:
 	return ret;
 }
@@ -1935,7 +1995,7 @@ void woal_init_from_dev_tree(void)
 			}
 		}
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 		else if (!strncmp(prop->name, "rps", strlen("rps"))) {
 			if (!of_property_read_u32(dt_node, prop->name, &data)) {
 				PRINTM(MIOCTL, "rps=0x%x\n", data);
@@ -1961,6 +2021,14 @@ void woal_init_from_dev_tree(void)
 				mcs32 = data;
 			}
 		}
+
+		else if (!strncmp(prop->name, "hs_auto_arp",
+				  strlen("hs_auto_arp"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MIOCTL, "hs_auto_arp=0x%x\n", data);
+				hs_auto_arp = data;
+			}
+		}
 #ifdef MFG_CMD_SUPPORT
 		else if (!strncmp(prop->name, "mfg_mode", strlen("mfg_mode"))) {
 			if (!of_property_read_u32(dt_node, prop->name, &data)) {
@@ -2274,7 +2342,24 @@ void woal_init_from_dev_tree(void)
 				       data);
 				keep_previous_scan = data;
 			}
+		} else if (!strncmp(prop->name, "auto_11ax",
+				    strlen("auto_11ax"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MERROR, "auto_11ax=0x%x\n", data);
+				auto_11ax = data;
+			}
 		}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		else if (!strncmp(prop->name, "mon_filter",
+				  strlen("mon_filter"))) {
+			if (!of_property_read_u32(dt_node, prop->name, &data)) {
+				PRINTM(MERROR, "mon_filter=0x%x\n", data);
+				mon_filter = data;
+			}
+		}
+#endif
+#endif
 	}
 	LEAVE();
 	return;
@@ -2417,7 +2502,8 @@ mlan_status woal_init_module_param(moal_handle *handle)
 				if (blk_id == NULL)
 					handle->blk_id = 0;
 				else
-					woal_atoi(&handle->blk_id, blk_id);
+					(void)woal_atoi(&handle->blk_id,
+							blk_id);
 				PRINTM(MINFO,
 				       "Validation check, %s, config block: %d\n",
 				       card_type, handle->blk_id);
@@ -2450,7 +2536,7 @@ out:
 	if (handle->param_data) {
 		release_firmware(handle->param_data);
 		/* rewind pos */
-		parse_cfg_get_line(NULL, 0, NULL);
+		(void)parse_cfg_get_line(NULL, 0, NULL);
 	}
 	if (ret != MLAN_STATUS_SUCCESS) {
 		PRINTM(MERROR, "Invalid block: %s\n", line);
@@ -2481,8 +2567,13 @@ module_param(fw_reload, int, 0);
 MODULE_PARM_DESC(fw_reload,
 		 "0: disable fw_reload; 1: enable fw reload feature");
 module_param(auto_fw_reload, int, 0);
+#ifdef PCIE
 MODULE_PARM_DESC(auto_fw_reload,
-		 "0: disable auto_fw_reload; 1: enable auto fw reload feature");
+		 "BIT0: enable auto fw_reload; BIT1:enable PCIe in-band reset");
+#else
+MODULE_PARM_DESC(auto_fw_reload, "BIT0: enable auto fw_reload");
+#endif
+
 module_param(fw_serial, int, 0);
 MODULE_PARM_DESC(
 	fw_serial,
@@ -2582,7 +2673,7 @@ MODULE_PARM_DESC(
 module_param(tx_work, uint, 0660);
 MODULE_PARM_DESC(tx_work, "1: Enable tx_work; 0: Disable tx_work");
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 module_param(rps, uint, 0660);
 MODULE_PARM_DESC(
 	rps,
@@ -2596,6 +2687,8 @@ module_param(pmqos, uint, 0660);
 MODULE_PARM_DESC(pmqos, "1: Enable pmqos; 0: Disable pmqos");
 module_param(mcs32, uint, 0660);
 MODULE_PARM_DESC(mcs32, "1: Enable mcs32; 0: Disable mcs32");
+module_param(hs_auto_arp, uint, 0660);
+MODULE_PARM_DESC(hs_auto_arp, "1: Enable hs_auto_arp; 0: Disable hs_auto_arp");
 
 module_param(dpd_data_cfg, charp, 0);
 MODULE_PARM_DESC(dpd_data_cfg, "DPD data file name");
@@ -2799,3 +2892,15 @@ module_param(keep_previous_scan, int, 0);
 MODULE_PARM_DESC(
 	keep_previous_scan,
 	"1: keep previous scan result; 0: flush previous scan result before start scan ");
+
+module_param(auto_11ax, int, 0);
+MODULE_PARM_DESC(auto_11ax, "1: enable auto_11ax; 0: disable auto_11ax ");
+
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+module_param(mon_filter, int, 0);
+MODULE_PARM_DESC(
+	mon_filter,
+	"Bit6:TX frames excluding control; Bit5:non-bss beacons; Bit3:unicast destined non-promiscuous frames only; Bit2:data frames; Bit1:control frames; Bit0:management frames");
+#endif
+#endif
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c b/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
index 18a154b..4fc7873 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_ioctl.c
@@ -269,7 +269,9 @@ t_u8 woal_get_second_channel_offset(moal_private *priv, int chan)
 
 	memset(&bss_info, 0, sizeof(bss_info));
 	/* Special Case: 20Mhz-only Channel */
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+		return chan2Offset;
 	if (bss_info.region_code != COUNTRY_CODE_US && chan == 165)
 		return chan2Offset;
 
@@ -3618,6 +3620,8 @@ mlan_status woal_cancel_hs(moal_private *priv, t_u8 wait_option)
 #endif
 	ENTER();
 
+	memset(&hscfg, 0, sizeof(mlan_ds_hs_cfg));
+
 	if (!priv) {
 		LEAVE();
 		return MLAN_STATUS_FAILURE;
@@ -3862,6 +3866,7 @@ int woal_enable_hs(moal_private *priv)
 	mlan_ds_ps_info pm_info;
 #endif
 	pmlan_ds_misc_keep_alive keep_alive = NULL;
+	pmlan_ds_misc_keep_alive_rx keep_alive_rx = NULL;
 	t_u8 media_connected = MFALSE;
 
 	ENTER();
@@ -3883,8 +3888,13 @@ int woal_enable_hs(moal_private *priv)
 					      EXT_DISCONNECT_ON_SUSPEND) &&
 			    handle->priv[i]->media_connected == MTRUE) {
 				PRINTM(MIOCTL, "disconnect on suspend\n");
-				woal_disconnect(handle->priv[i], MOAL_NO_WAIT,
-						NULL, DEF_DEAUTH_REASON_CODE);
+				if (MLAN_STATUS_SUCCESS !=
+				    woal_disconnect(handle->priv[i],
+						    MOAL_NO_WAIT, NULL,
+						    DEF_DEAUTH_REASON_CODE)) {
+					PRINTM(MIOCTL,
+					       "disconnect on suspend failed\n");
+				}
 			}
 		}
 		if (handle->priv[i]) {
@@ -3905,10 +3915,12 @@ int woal_enable_hs(moal_private *priv)
 		moal_private *remain_priv =
 			priv->phandle->priv[priv->phandle->remain_bss_index];
 		if (remain_priv) {
-			woal_cfg80211_remain_on_channel_cfg(remain_priv,
-							    MOAL_NO_WAIT, MTRUE,
-							    &channel_status,
-							    NULL, 0, 0);
+			if (woal_cfg80211_remain_on_channel_cfg(
+				    remain_priv, MOAL_NO_WAIT, MTRUE,
+				    &channel_status, NULL, 0, 0)) {
+				PRINTM(MIOCTL,
+				       "Failed to cancel pending remain on channel\n");
+			}
 			if (priv->phandle->cookie) {
 				cfg80211_remain_on_channel_expired(
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
@@ -4012,6 +4024,21 @@ int woal_enable_hs(moal_private *priv)
 			memset(keep_alive->packet, 0, MKEEP_ALIVE_IP_PKT_MAX);
 		}
 	}
+	for (i = 0; i < MAX_KEEP_ALIVE_RX_ID; i++) {
+		keep_alive_rx = &handle->keep_alive_rx[i];
+		if (keep_alive_rx && keep_alive_rx->cached &&
+		    keep_alive_rx->enable) {
+			keep_alive_rx->cached = MFALSE;
+			woal_start_mkeep_alive_rx(
+				woal_get_priv(handle, MLAN_BSS_ROLE_ANY),
+				keep_alive_rx->mkeep_alive_id,
+				keep_alive_rx->packet, keep_alive_rx->pkt_len,
+				keep_alive_rx->src_mac, keep_alive_rx->dst_mac);
+			keep_alive_rx->pkt_len = 0;
+			memset(keep_alive_rx->packet, 0,
+			       MKEEP_ALIVE_ACK_PKT_MAX);
+		}
+	}
 	/* Enable Host Sleep */
 	handle->hs_activate_wait_q_woken = MFALSE;
 	memset(&hscfg, 0, sizeof(mlan_ds_hs_cfg));
@@ -4552,7 +4579,6 @@ void woal_process_ioctl_resp(moal_private *priv, mlan_ioctl_req *req)
 #endif
 	case MLAN_IOCTL_MISC_CFG:
 		woal_ioctl_get_misc_conf(priv, (mlan_ds_misc_cfg *)req->pbuf);
-		fallthrough;
 	default:
 		break;
 	}
@@ -6085,6 +6111,8 @@ int woal_find_essid(moal_private *priv, mlan_ssid_bssid *ssid_bssid,
 	wifi_timeval t;
 	ENTER();
 
+	memset(&scan_resp, 0, sizeof(scan_resp));
+
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_get_scan_table(priv, wait_option, &scan_resp)) {
 		LEAVE();
@@ -6423,7 +6451,12 @@ void woal_config_bgscan_and_rssi(moal_private *priv, t_u8 set_rssi)
 		return;
 	}
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MIOCTL, "Get BSS Info Failed\n");
+		LEAVE();
+		return;
+	}
 	if (!bss_info.media_connected) {
 		PRINTM(MIOCTL, "We already lost connection\n");
 		LEAVE();
@@ -6488,15 +6521,20 @@ void woal_config_bgscan_and_rssi(moal_private *priv, t_u8 set_rssi)
  */
 mlan_status woal_stop_bg_scan(moal_private *priv, t_u8 wait_option)
 {
-	wlan_bgscan_cfg scan_cfg;
+	wlan_bgscan_cfg *scan_cfg;
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	ENTER();
 
-	memset(&scan_cfg, 0, sizeof(scan_cfg));
-	scan_cfg.action = BG_SCAN_ACT_SET;
-	scan_cfg.enable = MFALSE;
-	ret = woal_request_bgscan(priv, wait_option, &scan_cfg);
-
+	scan_cfg = kmalloc(sizeof(wlan_bgscan_cfg), GFP_KERNEL);
+	if (!scan_cfg) {
+		LEAVE();
+		return ret;
+	}
+	memset(scan_cfg, 0, sizeof(wlan_bgscan_cfg));
+	scan_cfg->action = BG_SCAN_ACT_SET;
+	scan_cfg->enable = MFALSE;
+	ret = woal_request_bgscan(priv, wait_option, scan_cfg);
+	kfree(scan_cfg);
 	LEAVE();
 	return ret;
 }
@@ -6600,8 +6638,7 @@ mlan_status woal_set_rssi_threshold(moal_private *priv, t_u32 event_id,
 	mlan_ds_misc_cfg *misc = NULL;
 
 	ENTER();
-	if (priv->media_connected == MFALSE)
-		goto done;
+
 	if (priv->mrvl_rssi_low || !priv->cqm_rssi_thold)
 		goto done;
 	if (event_id == MLAN_EVENT_ID_FW_BCN_RSSI_LOW) {
@@ -7731,6 +7768,279 @@ done:
 	return ret;
 }
 
+/**
+ *  @brief config RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param ch_info   A pointer to wifi_channel_info
+ *  @param bandcfg  A pointer to Band_Config_t
+ *
+ *  @return            void
+ */
+void woal_channel_info_to_bandcfg(moal_private *priv,
+				  wifi_channel_info *ch_info,
+				  Band_Config_t *bandcfg)
+{
+	t_u8 channel = 0;
+
+	if (!ch_info || !bandcfg)
+		return;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	channel = ieee80211_frequency_to_channel(ch_info->center_freq);
+#endif
+
+	switch (ch_info->width) {
+	case WIFI_CHAN_WIDTH_10:
+		bandcfg->chanWidth = CHAN_BW_10MHZ;
+		break;
+	case WIFI_CHAN_WIDTH_20:
+		bandcfg->chanWidth = CHAN_BW_20MHZ;
+		break;
+	case WIFI_CHAN_WIDTH_40:
+		bandcfg->chanWidth = CHAN_BW_40MHZ;
+		break;
+	case WIFI_CHAN_WIDTH_80:
+		bandcfg->chanWidth = CHAN_BW_80MHZ;
+		break;
+	default:
+		bandcfg->chanWidth = CHAN_BW_20MHZ;
+		break;
+	}
+	bandcfg->chan2Offset = SEC_CHAN_NONE;
+	if (bandcfg->chanWidth == CHAN_BW_40MHZ) {
+		if (ch_info->center_freq0 < ch_info->center_freq)
+			bandcfg->chan2Offset = SEC_CHAN_BELOW;
+		else
+			bandcfg->chan2Offset = SEC_CHAN_ABOVE;
+	} else if (bandcfg->chanWidth == CHAN_BW_80MHZ)
+		bandcfg->chan2Offset =
+			woal_get_second_channel_offset(priv, channel);
+	bandcfg->chanBand = (channel <= MAX_BG_CHANNEL) ? BAND_2GHZ : BAND_5GHZ;
+	bandcfg->scanMode = SCAN_MODE_MANUAL;
+
+	return;
+}
+
+/**
+ *  @brief config RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param ch_info   A pointer to wifi_channel_info
+ *  @param bandcfg  A pointer to Band_Config_t
+ *
+ *  @return            void
+ */
+void woal_bandcfg_to_channel_info(moal_private *priv, Band_Config_t *bandcfg,
+				  t_u8 channel, wifi_channel_info *ch_info)
+{
+	if (!ch_info || !bandcfg)
+		return;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	ch_info->center_freq = ieee80211_channel_to_frequency(
+		channel, (channel <= MAX_BG_CHANNEL) ? NL80211_BAND_2GHZ :
+						       NL80211_BAND_5GHZ);
+#endif
+
+	switch (bandcfg->chanWidth) {
+	case CHAN_BW_10MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_10;
+		break;
+	case CHAN_BW_20MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_20;
+		break;
+	case CHAN_BW_40MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_40;
+		break;
+	case CHAN_BW_80MHZ:
+		ch_info->width = WIFI_CHAN_WIDTH_80;
+		break;
+	default:
+		ch_info->width = WIFI_CHAN_WIDTH_20;
+		break;
+	}
+
+	return;
+}
+
+/**
+ *  @brief config RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param wait_option  wait option
+ *  @param hotspotcfg   A pointer to rtt_config_params_t
+ *
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
+ * otherwise fail
+ */
+mlan_status woal_config_rtt(moal_private *priv, t_u8 wait_option,
+			    wifi_rtt_config_params_t *rtt_params_in)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_rtt_config_params *rtt_params = NULL;
+	t_u32 i = 0;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CONFIG_RTT;
+	rtt_params = &(misc->param.rtt_params);
+	rtt_params->rtt_config_num = rtt_params_in->rtt_config_num;
+	for (i = 0; i < MIN(rtt_params->rtt_config_num, MAX_RTT_CONFIG_NUM);
+	     i++) {
+		moal_memcpy_ext(priv->phandle, rtt_params->rtt_config[i].addr,
+				rtt_params_in->rtt_config[i].addr,
+				sizeof(rtt_params->rtt_config[i].addr),
+				sizeof(rtt_params->rtt_config[i].addr));
+		rtt_params->rtt_config[i].type =
+			rtt_params_in->rtt_config[i].type;
+		rtt_params->rtt_config[i].peer =
+			rtt_params_in->rtt_config[i].peer;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		rtt_params->rtt_config[i]
+			.channel = ieee80211_frequency_to_channel(
+			rtt_params_in->rtt_config[i].channel.center_freq);
+#endif
+		woal_channel_info_to_bandcfg(
+			priv, &(rtt_params_in->rtt_config[i].channel),
+			&(rtt_params->rtt_config[i].bandcfg));
+		rtt_params->rtt_config[i].burst_period =
+			rtt_params_in->rtt_config[i].burst_period;
+		rtt_params->rtt_config[i].num_burst =
+			rtt_params_in->rtt_config[i].num_burst;
+		rtt_params->rtt_config[i].num_frames_per_burst =
+			rtt_params_in->rtt_config[i].num_frames_per_burst;
+		rtt_params->rtt_config[i].num_retries_per_rtt_frame =
+			rtt_params_in->rtt_config[i].num_retries_per_rtt_frame;
+		rtt_params->rtt_config[i].num_retries_per_ftmr =
+			rtt_params_in->rtt_config[i].num_retries_per_ftmr;
+		rtt_params->rtt_config[i].LCI_request =
+			rtt_params_in->rtt_config[i].LCI_request;
+		rtt_params->rtt_config[i].LCR_request =
+			rtt_params_in->rtt_config[i].LCR_request;
+		rtt_params->rtt_config[i].burst_duration =
+			rtt_params_in->rtt_config[i].burst_duration;
+		rtt_params->rtt_config[i].preamble =
+			rtt_params_in->rtt_config[i].preamble;
+		rtt_params->rtt_config[i].bw = rtt_params_in->rtt_config[i].bw;
+	}
+
+	ret = woal_request_ioctl(priv, req, wait_option);
+	if (ret != MLAN_STATUS_SUCCESS)
+		goto done;
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief cancel RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param wait_option  wait option
+ *  @param hotspotcfg   A pointer to rtt_config_params_t
+ *
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
+ * otherwise fail
+ */
+mlan_status woal_cancel_rtt(moal_private *priv, t_u8 wait_option,
+			    t_u32 addr_num, t_u8 addr[][MLAN_MAC_ADDR_LENGTH])
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+	mlan_rtt_cancel_params *rtt_cancel = NULL;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_CANCEL_RTT;
+	rtt_cancel = &(misc->param.rtt_cancel);
+	rtt_cancel->rtt_cancel_num = addr_num;
+	moal_memcpy_ext(priv->phandle, rtt_cancel->rtt_cancel, addr,
+			sizeof(rtt_cancel->rtt_cancel[0]) *
+				rtt_cancel->rtt_cancel_num,
+			sizeof(rtt_cancel->rtt_cancel[0]) * MAX_RTT_CONFIG_NUM);
+	ret = woal_request_ioctl(priv, req, wait_option);
+	if (ret != MLAN_STATUS_SUCCESS)
+		goto done;
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
+/**
+ *  @brief cancel RTT to mlan layer
+ *
+ *  @param priv         A pointer to moal_private structure
+ *  @param wait_option  wait option
+ *  @param hotspotcfg   A pointer to rtt_config_params_t
+ *
+ *  @return             MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING -- success,
+ * otherwise fail
+ */
+mlan_status woal_rtt_responder_cfg(moal_private *priv, t_u8 wait_option,
+				   mlan_rtt_responder *rtt_rsp_cfg)
+{
+	mlan_status ret = MLAN_STATUS_SUCCESS;
+	mlan_ioctl_req *req = NULL;
+	mlan_ds_misc_cfg *misc = NULL;
+
+	ENTER();
+
+	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (req == NULL) {
+		ret = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	req->action = MLAN_ACT_SET;
+	req->req_id = MLAN_IOCTL_MISC_CFG;
+
+	misc = (mlan_ds_misc_cfg *)req->pbuf;
+	misc->sub_command = MLAN_OID_MISC_RTT_RESPONDER_CFG;
+	moal_memcpy_ext(priv->phandle, &(misc->param.rtt_rsp_cfg), rtt_rsp_cfg,
+			sizeof(misc->param.rtt_rsp_cfg),
+			sizeof(misc->param.rtt_rsp_cfg));
+
+	ret = woal_request_ioctl(priv, req, wait_option);
+	if (ret != MLAN_STATUS_SUCCESS)
+		goto done;
+	moal_memcpy_ext(priv->phandle, rtt_rsp_cfg, &(misc->param.rtt_rsp_cfg),
+			sizeof(*rtt_rsp_cfg), sizeof(*rtt_rsp_cfg));
+
+done:
+	if (ret != MLAN_STATUS_PENDING)
+		kfree(req);
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief Send 11d enable/disable command to firmware.
  *
@@ -7945,9 +8255,10 @@ static int parse_tx_pwr_string(moal_handle *handle, const char *s, size_t len,
 		d->data3 = (t_u32)woal_string_to_number(pos);
 
 #ifdef SD9177
-	if (((!fc_card) && (d->data1 > 24)) || (d->data2 > 2))
+	if (((!fc_card) && ((d->data1 > 24) && (d->data1 != 0xffffffff))) ||
+	    (d->data2 > 2))
 #else
-	if ((d->data1 > 24) || (d->data2 > 2))
+	if (((d->data1 > 24) && (d->data1 != 0xffffffff)) || (d->data2 > 2))
 #endif
 		ret = -EINVAL;
 
@@ -8384,6 +8695,7 @@ static int parse_he_tb_tx_string(const char *s, size_t len,
 	int ret = MLAN_STATUS_SUCCESS;
 	char *string = NULL;
 	char *pos = NULL;
+	char *tmp = NULL;
 	gfp_t flag;
 
 	ENTER();
@@ -8399,6 +8711,7 @@ static int parse_he_tb_tx_string(const char *s, size_t len,
 	moal_memcpy_ext(NULL, string, s + strlen("he_tb_tx="),
 			len - strlen("he_tb_tx="), HE_TB_TX_STR_LEN - 1);
 
+	tmp = string;
 	pos = strsep(&string, " \t");
 	if (pos)
 		d->enable = (t_u32)woal_string_to_number(pos);
@@ -8425,7 +8738,7 @@ static int parse_he_tb_tx_string(const char *s, size_t len,
 		ret = -EINVAL;
 
 done:
-	kfree(string);
+	kfree(tmp);
 	LEAVE();
 	return ret;
 }
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.c b/mxm_wifiex/wlan_src/mlinux/moal_main.c
index 8d3c16d..0286c43 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.c
@@ -437,8 +437,8 @@ static struct _card_info card_info_SD9097 = {
 };
 #endif
 
-#ifdef SDNW62X
-static struct _card_info card_info_SDNW62X = {
+#ifdef SDIW62X
+static struct _card_info card_info_SDIW62X = {
 	.embedded_supp = 1,
 	.drcs = 1,
 	.go_noa = 1,
@@ -453,8 +453,8 @@ static struct _card_info card_info_SDNW62X = {
 	.rev_id_reg = 0xc8,
 	.host_strap_reg = 0xf4,
 	.magic_reg = 0xf0,
-	.fw_name = SDNW62X_DEFAULT_COMBO_FW_NAME,
-	.fw_name_wlan = SDNW62X_DEFAULT_WLAN_FW_NAME,
+	.fw_name = SDIW62X_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = SDIW62X_DEFAULT_WLAN_FW_NAME,
 #ifdef SDIO
 	.dump_fw_info = DUMP_FW_SDIO_V3,
 	.dump_fw_ctrl_reg = 0xf9,
@@ -477,6 +477,44 @@ static struct _card_info card_info_SDNW62X = {
 };
 #endif
 
+static struct _card_info card_info_SDAW693 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.histogram_table_num = 3,
+	.feature_control = FEATURE_CTRL_DEFAULT,
+	.rev_id_reg = 0xc8,
+	.host_strap_reg = 0xf4,
+	.magic_reg = 0xf0,
+	.fw_name = SDAW693_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = SDAW693_DEFAULT_WLAN_FW_NAME,
+#ifdef SDIO
+	.dump_fw_info = DUMP_FW_SDIO_V3,
+	.dump_fw_ctrl_reg = 0xf9,
+	.dump_fw_start_reg = 0xf1,
+	.dump_fw_end_reg = 0xf8,
+	.dump_fw_host_ready = 0xcc,
+	.dump_reg.reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60, 0x61, 0x62, 0x64,
+			       0x65, 0x66, 0x68, 0x69, 0x6a},
+	.dump_reg.reg_table_size = 13,
+	.scratch_reg = 0xe8,
+	.func1_reg_start = 0x10,
+	.func1_reg_end = 0x17,
+	.fw_reset_reg = 0x0EE,
+	.fw_reset_val = 0x99,
+	.slew_rate_reg = 0x90002328,
+	.slew_rate_bit_offset = 12,
+#endif
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
+};
+
 #ifdef SD9177
 static struct _card_info card_info_SD9177 = {
 	.embedded_supp = 1,
@@ -557,6 +595,8 @@ static struct _card_info card_info_PCIE9097 = {
 	.magic_reg = 0x1c74,
 	.fw_name = PCIE9097_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE9097_DEFAULT_WLAN_FW_NAME,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
 };
@@ -580,13 +620,15 @@ static struct _card_info card_info_PCIE9098 = {
 	.magic_reg = 0x1c74,
 	.fw_name = PCIE9098_DEFAULT_COMBO_FW_NAME,
 	.fw_name_wlan = PCIE9098_DEFAULT_WLAN_FW_NAME,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
 };
 #endif
 
-#ifdef PCIENW62X
-static struct _card_info card_info_PCIENW62X = {
+#ifdef PCIEIW62X
+static struct _card_info card_info_PCIEIW62X = {
 	.embedded_supp = 1,
 	.drcs = 1,
 	.go_noa = 1,
@@ -601,13 +643,39 @@ static struct _card_info card_info_PCIENW62X = {
 	.rev_id_reg = 0x8,
 	.host_strap_reg = 0x1c70,
 	.magic_reg = 0x1c74,
-	.fw_name = PCIENW62X_DEFAULT_COMBO_FW_NAME,
-	.fw_name_wlan = PCIENW62X_DEFAULT_WLAN_FW_NAME,
+	.boot_mode_reg = 0x1c8c,
+	.fw_name = PCIEIW62X_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = PCIEIW62X_DEFAULT_WLAN_FW_NAME,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
 };
 #endif
 
+static struct _card_info card_info_PCIEAW693 = {
+	.embedded_supp = 1,
+	.drcs = 1,
+	.go_noa = 1,
+	.v16_fw_api = 1,
+	.v17_fw_api = 1,
+	.pmic = 1,
+	.cal_data_cfg = 0,
+	.low_power_enable = 0,
+	.rx_rate_max = 412,
+	.histogram_table_num = 3,
+	.feature_control = FEATURE_CTRL_DEFAULT,
+	.rev_id_reg = 0x8,
+	.host_strap_reg = 0x1c70,
+	.magic_reg = 0x1c74,
+	.fw_name = PCIEAW693_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = PCIEAW693_DEFAULT_WLAN_FW_NAME,
+	.fw_reset_reg = 0x1c94,
+	.fw_reset_val = 0x98,
+	.sniffer_support = 1,
+	.per_pkt_cfg_support = 1,
+};
+
 #ifdef USB8801
 static struct _card_info card_info_USB8801 = {
 	.embedded_supp = 0,
@@ -707,8 +775,8 @@ static struct _card_info card_info_USB9097 = {
 };
 #endif
 
-#ifdef USBNW62X
-static struct _card_info card_info_USBNW62X = {
+#ifdef USBIW62X
+static struct _card_info card_info_USBIW62X = {
 	.embedded_supp = 1,
 	.drcs = 1,
 	.go_noa = 1,
@@ -720,8 +788,8 @@ static struct _card_info card_info_USBNW62X = {
 	.rx_rate_max = 412,
 	.feature_control = FEATURE_CTRL_DEFAULT,
 	.histogram_table_num = 3,
-	.fw_name = USBNW62X_DEFAULT_COMBO_FW_NAME,
-	.fw_name_wlan = USBNW62X_DEFAULT_WLAN_FW_NAME,
+	.fw_name = USBIW62X_DEFAULT_COMBO_FW_NAME,
+	.fw_name_wlan = USBIW62X_DEFAULT_WLAN_FW_NAME,
 	.sniffer_support = 1,
 	.per_pkt_cfg_support = 1,
 };
@@ -1014,6 +1082,7 @@ static void woal_hang_work_queue(struct work_struct *work)
 	moal_private *priv;
 	int cfg80211_wext = 0;
 	int ret = 0;
+	t_u8 reload_mode = 0;
 	ENTER();
 	if (!reset_handle) {
 		LEAVE();
@@ -1080,7 +1149,7 @@ static void woal_hang_work_queue(struct work_struct *work)
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
 			if (IS_STA_CFG80211(cfg80211_wext) &&
-			    priv->sched_scanning) {
+			    priv->sched_scanning && priv->wdev) {
 				priv->bg_scan_start = MFALSE;
 				priv->bg_scan_reported = MFALSE;
 				cfg80211_sched_scan_stopped(priv->wdev->wiphy
@@ -1118,19 +1187,30 @@ static void woal_hang_work_queue(struct work_struct *work)
 		}
 #ifdef PCIE
 		else if (IS_PCIE(reset_handle->card_type)) {
-			reset_handle->init_wait_q_woken = MFALSE;
-			PRINTM(MMSG, "WIFI auto_fw_reload: fw_reload=4\n");
-			ret = woal_request_fw_reload(reset_handle,
-						     FW_RELOAD_PCIE_RESET);
-			if (!ret) {
-				/* Wait for FLR to complete */
-				wait_event_timeout(
-					reset_handle->init_wait_q,
-					reset_handle->init_wait_q_woken,
-					10 * HZ);
-				if (reset_handle->hardware_status !=
-				    HardwareStatusReady)
-					ret = -1;
+#define FW_RELOAD_PCIE_IN_BAND_RESET 3
+			if (reset_handle->params.auto_fw_reload ==
+			    FW_RELOAD_PCIE_IN_BAND_RESET) {
+				PRINTM(MMSG,
+				       "WIFI auto_fw_reload: fw_reload=6\n");
+				ret = woal_request_fw_reload(
+					reset_handle,
+					FW_RELOAD_PCIE_INBAND_RESET);
+			} else {
+				reset_handle->init_wait_q_woken = MFALSE;
+				PRINTM(MMSG,
+				       "WIFI auto_fw_reload: fw_reload=4\n");
+				ret = woal_request_fw_reload(
+					reset_handle, FW_RELOAD_PCIE_RESET);
+				if (!ret) {
+					/* Wait for FLR to complete */
+					wait_event_timeout(
+						reset_handle->init_wait_q,
+						reset_handle->init_wait_q_woken,
+						10 * HZ);
+					if (reset_handle->hardware_status !=
+					    HardwareStatusReady)
+						ret = -1;
+				}
 			}
 		}
 #endif
@@ -1174,10 +1254,17 @@ static void woal_hang_work_queue(struct work_struct *work)
 				     strlen(CUS_EVT_DRIVER_HANG));
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-		if (IS_STA_OR_UAP_CFG80211(cfg80211_wext))
-			woal_cfg80211_vendor_event(priv, event_hang,
-						   CUS_EVT_DRIVER_HANG,
-						   strlen(CUS_EVT_DRIVER_HANG));
+		if (IS_STA_OR_UAP_CFG80211(cfg80211_wext)) {
+			PRINTM(MMSG, "Send event_hang(0x0) vendor event");
+			if (IS_SD(reset_handle->card_type)) {
+				reload_mode = FW_RELOAD_SDIO_INBAND_RESET;
+			} else if (IS_PCIE(reset_handle->card_type)) {
+				reload_mode = FW_RELOAD_PCIE_INBAND_RESET;
+				// Todo: add check for FW_RELOAD_PCIE_RESET -
+				// FLR
+			}
+			woal_cfg80211_driver_hang_event(priv, reload_mode);
+		}
 #endif
 #endif
 	}
@@ -1201,7 +1288,7 @@ void woal_process_hang(moal_handle *handle)
 		queue_work(hang_workqueue, &hang_work);
 #ifdef ANDROID_KERNEL
 #define WAKE_LOCK_HANG 5000
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 		__pm_wakeup_event(&reset_handle->ws, WAKE_LOCK_HANG);
 #else
 		wake_lock_timeout(&reset_handle->wake_lock,
@@ -2057,7 +2144,7 @@ mlan_status woal_init_sw(moal_handle *handle)
 
 	handle->is_suspended = MFALSE;
 	handle->hs_activated = MFALSE;
-	handle->hs_auto_arp = MFALSE;
+	handle->hs_auto_arp = (t_u8)handle->params.hs_auto_arp;
 	handle->suspend_fail = MFALSE;
 	handle->hs_skip_count = 0;
 	handle->hs_force_count = 0;
@@ -2157,6 +2244,17 @@ mlan_status woal_init_sw(moal_handle *handle)
 #endif
 #endif
 
+	handle->rtt_capa.rtt_one_sided_supported = MTRUE;
+	handle->rtt_capa.rtt_ftm_supported = MTRUE;
+	handle->rtt_capa.lci_support = MTRUE;
+	handle->rtt_capa.lcr_support = MTRUE;
+	handle->rtt_capa.preamble_support =
+		PREAMBLE_LEGACY | PREAMBLE_HT | PREAMBLE_VHT;
+	handle->rtt_capa.bw_support =
+		BW_20_SUPPORT | BW_40_SUPPORT | BW_80_SUPPORT;
+	handle->rtt_capa.responder_supported = MTRUE;
+	handle->rtt_capa.mc_version = 60;
+
 	/* Register to MLAN */
 	memset(&device, 0, sizeof(mlan_device));
 	device.pmoal_handle = handle;
@@ -2257,6 +2355,7 @@ mlan_status woal_init_sw(moal_handle *handle)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 	device.dfs_offload = moal_extflg_isset(handle, EXT_DFS_OFFLOAD);
 #endif
+	device.second_mac = handle->second_mac;
 
 	for (i = 0; i < handle->drv_mode.intf_num; i++) {
 		device.bss_attr[i].bss_type =
@@ -2533,6 +2632,7 @@ static t_u32 woal_set_sdio_slew_rate(moal_handle *handle)
 	moal_private *priv = NULL;
 	t_u32 new_value = 0;
 	t_u32 reg_type = MLAN_REG_MAC;
+	int status;
 
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 	if (!priv)
@@ -2541,15 +2641,13 @@ static t_u32 woal_set_sdio_slew_rate(moal_handle *handle)
 	if ((handle->card_info->slew_rate_reg != 0) &&
 	    (handle->params.slew_rate > 3 || handle->params.slew_rate < 0))
 		return MLAN_STATUS_FAILURE;
-#if defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177)
 	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
-	    IS_SDNW62X(handle->card_type) || IS_SD9177(handle->card_type))
+	    IS_SDIW62X(handle->card_type) || IS_SD9177(handle->card_type))
 		reg_type = MLAN_REG_CIU;
-#endif
 
-	ret = woal_getset_regrdwr(priv, MLAN_ACT_GET, reg_type,
-				  handle->card_info->slew_rate_reg, &value);
-	if (ret < 0) {
+	status = woal_getset_regrdwr(priv, MLAN_ACT_GET, reg_type,
+				     handle->card_info->slew_rate_reg, &value);
+	if (status < 0) {
 		PRINTM(MERROR, "woal_getset_regrdwr get REG_MAC failed\n");
 		ret = MLAN_STATUS_FAILURE;
 		goto done;
@@ -2562,10 +2660,10 @@ static t_u32 woal_set_sdio_slew_rate(moal_handle *handle)
 		PRINTM(MMSG, "Set REG 0x%8x: 0x%x slew_rate=%d\n",
 		       handle->card_info->slew_rate_reg, new_value,
 		       handle->params.slew_rate);
-		ret = woal_getset_regrdwr(priv, MLAN_ACT_SET, reg_type,
-					  handle->card_info->slew_rate_reg,
-					  &new_value);
-		if (ret < 0) {
+		status = woal_getset_regrdwr(priv, MLAN_ACT_SET, reg_type,
+					     handle->card_info->slew_rate_reg,
+					     &new_value);
+		if (status < 0) {
 			PRINTM(MERROR,
 			       "woal_getset_regrdwr get REG_MAC failed\n");
 			ret = MLAN_STATUS_FAILURE;
@@ -2846,7 +2944,7 @@ static mlan_status woal_process_hostcmd_cfg(moal_handle *handle, t_u8 *data,
 		goto done;
 	}
 	ptr = buf;
-	strcpy(ptr, CMD_STR);
+	strncpy(ptr, CMD_STR, CMD_BUF_LEN);
 	ptr = buf + strlen(CMD_STR) + sizeof(t_u32);
 	while ((pos - data) < size) {
 		while (*pos == ' ' || *pos == '\t')
@@ -3399,7 +3497,7 @@ static t_u32 woal_set_user_init_data(moal_handle *handle, int type,
 	}
 	if (handle->user_data) {
 		cfg_data = (t_u8 *)(handle->user_data)->data;
-		len = (handle->user_data)->size;
+		len = (t_size)((handle->user_data)->size);
 		if (type == INIT_HOSTCMD_CFG_DATA ||
 		    type == BAND_STEER_CFG_DATA ||
 		    type == COUNTRY_POWER_TABLE) {
@@ -3520,7 +3618,7 @@ done:
 }
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 static ssize_t woal_set_rps_map(struct netdev_rx_queue *queue, const char *buf,
 				size_t len)
 {
@@ -3545,7 +3643,7 @@ static ssize_t woal_set_rps_map(struct netdev_rx_queue *queue, const char *buf,
 		PRINTM(MERROR, "%s: bitmap_parse fail err=%d.\n", __func__,
 		       err);
 		free_cpumask_var(mask);
-		return err;
+		return -EINVAL;
 	}
 
 	map = kzalloc(max_t(unsigned int, RPS_MAP_SIZE(cpumask_weight(mask)),
@@ -3614,7 +3712,7 @@ static mlan_status woal_add_card_dpc(moal_handle *handle)
 	char str_buf[MLAN_MAX_VER_STR_LEN];
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 	moal_private *priv_rps = NULL;
 	t_u8 rps_buf[2];
 #endif
@@ -3738,10 +3836,10 @@ static mlan_status woal_add_card_dpc(moal_handle *handle)
 #endif
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 	if (handle->params.rps) {
 		priv_rps = woal_get_priv_bss_type(handle, MLAN_BSS_TYPE_STA);
-		sprintf(rps_buf, "%x", handle->params.rps);
+		snprintf(rps_buf, sizeof(rps_buf), "%x", handle->params.rps);
 		if (priv_rps) {
 			PRINTM(MCMND,
 			       "num_rx_queues=%u real_num_rx_queues=%u\n",
@@ -3797,10 +3895,10 @@ err:
 static mlan_status woal_req_dpd_data(moal_handle *handle,
 				     mlan_init_param *param)
 {
-	int ret = MLAN_STATUS_SUCCESS;
+	mlan_status ret = MLAN_STATUS_SUCCESS;
 	t_u8 req_fw_nowait = moal_extflg_isset(handle, EXT_REQ_FW_NOWAIT);
 	char *dpd_data_cfg = handle->params.dpd_data_cfg;
-	mlan_status status = MLAN_STATUS_SUCCESS;
+	int status = MLAN_STATUS_SUCCESS;
 
 	ENTER();
 
@@ -4123,7 +4221,7 @@ static mlan_status woal_init_fw_dpc(moal_handle *handle)
 			if (!IS_USB8997(handle->card_type) &&
 			    !IS_USB9098(handle->card_type) &&
 			    !IS_USB9097(handle->card_type) &&
-			    !IS_USBNW62X(handle->card_type) &&
+			    !IS_USBIW62X(handle->card_type) &&
 			    !IS_USB8978(handle->card_type))
 				ret = woal_reset_usb_dev(handle);
 			goto done;
@@ -5247,8 +5345,8 @@ moal_private *woal_add_interface(moal_handle *handle, t_u8 bss_index,
 		}
 	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
-	strcpy(csa_str, "CSA");
-	strcat(csa_str, name);
+	strncpy(csa_str, "CSA", sizeof(csa_str));
+	strncat(csa_str, name, sizeof(csa_str) - 1);
 	priv->csa_workqueue = alloc_workqueue(
 		csa_str, WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
 	if (!priv->csa_workqueue) {
@@ -5297,25 +5395,34 @@ moal_private *woal_add_interface(moal_handle *handle, t_u8 bss_index,
 
 	if (bss_type == MLAN_BSS_TYPE_STA ||
 	    priv->bss_type == MLAN_BSS_TYPE_UAP) {
+#ifdef MFG_CMD_SUPPORT
+		if (priv->phandle->params.mfg_mode != MLAN_INIT_PARA_ENABLED) {
+#endif
 #if defined(SD8887) || defined(SD8987)
-		mlan_fw_info fw_info;
-		memset(&fw_info, 0, sizeof(mlan_fw_info));
-		if (MLAN_STATUS_SUCCESS !=
-		    woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info)) {
-			PRINTM(MERROR, "%s: get_fw_info failed \n", __func__);
-			goto error;
-		}
-		if (MFALSE
+			mlan_fw_info fw_info;
+			memset(&fw_info, 0, sizeof(mlan_fw_info));
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT,
+						     &fw_info)) {
+				PRINTM(MERROR, "%s: get_fw_info failed \n",
+				       __func__);
+				goto error;
+			}
+			if (MFALSE
 #ifdef SD8887
-		    || IS_SD8887(handle->card_type)
+			    || IS_SD8887(handle->card_type)
 #endif
 #ifdef SD8987
-		    || IS_SD8987(handle->card_type)
+			    || IS_SD8987(handle->card_type)
 #endif
-		) {
-			if ((fw_info.antinfo & ANT_DIVERSITY_2G) &&
-			    (fw_info.antinfo & ANT_DIVERSITY_5G))
-				handle->card_info->histogram_table_num = 4;
+			) {
+				if ((fw_info.antinfo & ANT_DIVERSITY_2G) &&
+				    (fw_info.antinfo & ANT_DIVERSITY_5G))
+					handle->card_info->histogram_table_num =
+						4;
+			}
+#endif
+#ifdef MFG_CMD_SUPPORT
 		}
 #endif
 
@@ -5586,7 +5693,8 @@ mlan_status woal_set_user_antcfg(moal_handle *handle, t_u8 wait_option)
 
 	if (handle->feature_control & FEATURE_CTRL_STREAM_2X2) {
 		if (IS_CARD9098(handle->card_type) ||
-		    IS_CARD9097(handle->card_type)) {
+		    IS_CARD9097(handle->card_type) ||
+		    IS_CARDIW62X(handle->card_type)) {
 			radio->param.ant_cfg.tx_antenna =
 				radio->param.ant_cfg.rx_antenna = antcfg;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
@@ -6304,18 +6412,19 @@ void woal_mlan_debug_info(moal_private *priv)
 
 	PRINTM(MERROR, "last_cmd_index = %d\n", info->last_cmd_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_id[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_id[i]);
 	PRINTM(MERROR, "last_cmd_id = %s\n", str);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_act[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_act[i]);
 	PRINTM(MERROR, "last_cmd_act = %s\n", str);
 	PRINTM(MERROR, "last_cmd_resp_index = %d\n", info->last_cmd_resp_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_resp_id[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ",
+			      info->last_cmd_resp_id[i]);
 	PRINTM(MERROR, "last_cmd_resp_id = %s\n", str);
 	PRINTM(MERROR, "last_event_index = %d\n", info->last_event_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_event[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_event[i]);
 	PRINTM(MERROR, "last_event = %s", str);
 
 	PRINTM(MERROR, "num_data_h2c_failure = %d\n",
@@ -6350,8 +6459,8 @@ void woal_mlan_debug_info(moal_private *priv)
 		       info->last_recv_wr_bitmap, info->last_mp_index);
 		for (i = 0; i < SDIO_MP_DBG_NUM; i++) {
 			for (s = str, j = 0; j < mp_aggr_pkt_limit; j++)
-				s += sprintf(
-					s, "0x%02x ",
+				s += snprintf(
+					s, MAX_BUF_LEN, "0x%02x ",
 					info->last_mp_wr_info
 						[i * mp_aggr_pkt_limit + j]);
 
@@ -6779,7 +6888,7 @@ t_u8 woal_find_mcast_node_tx(moal_private *priv, struct sk_buff *skb)
 	struct mcast_node *node = NULL;
 	unsigned long flags;
 	t_u8 ret = MFALSE;
-	t_u8 ra[MLAN_MAC_ADDR_LENGTH];
+	t_u8 ra[MLAN_MAC_ADDR_LENGTH] = {0};
 	ENTER();
 	moal_memcpy_ext(priv->phandle, ra, skb->data, MLAN_MAC_ADDR_LENGTH,
 			sizeof(ra));
@@ -7290,6 +7399,112 @@ done:
 	return ret;
 }
 
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/**
+ *  @brief This function sends Tx pkt to monitor iface
+ *
+ *  @param priv      A pointer to moal_private structure
+ *
+ *  @param pmbuf     A mlan buffer
+ *  @return          N/A
+ */
+void woal_send_tx_pkt_to_mon_if(moal_private *priv, pmlan_buffer pmbuf)
+{
+	struct ieee80211_hdr *dot11_hdr = NULL;
+	struct radiotap_info *rt = NULL;
+	pmlan_buffer pmbuf2 = NULL;
+	t_u8 *ptr = NULL;
+	int len, hdr_len;
+	t_u16 fc;
+	t_u8 rfc1042_eth_hdr[ETH_ALEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+	moal_handle *handle = priv->phandle;
+
+	if (!priv || !pmbuf)
+		return;
+
+	/* Only STA and uAP mode are supported */
+	if (!(priv->bss_type == MLAN_BSS_TYPE_STA ||
+	      priv->bss_type == MLAN_BSS_TYPE_UAP))
+		return;
+
+	ENTER();
+	pmbuf2 = woal_alloc_mlan_buffer(handle, pmbuf->data_len + 64);
+	if (!pmbuf2) {
+		PRINTM(MERROR,
+		       "Failed to allocate mlan_buffer for Tx sniffer packet");
+		goto done;
+	}
+	pmbuf2->bss_index = pmbuf->bss_index;
+	pmbuf2->buf_type = pmbuf->buf_type;
+	pmbuf2->priority = pmbuf->priority;
+	pmbuf2->in_ts_sec = pmbuf->in_ts_sec;
+	pmbuf2->in_ts_usec = pmbuf->in_ts_usec;
+	pmbuf2->flags |= MLAN_BUF_FLAG_NET_MONITOR;
+
+	/* attach 802.11 hdr */
+	dot11_hdr = (struct ieee80211_hdr *)((t_u8 *)pmbuf2->pbuf +
+					     pmbuf2->data_offset);
+	memset((t_u8 *)dot11_hdr, 0, sizeof(struct ieee80211_hdr));
+
+	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA);
+
+	ptr = (t_u8 *)pmbuf->pbuf + pmbuf->data_offset;
+	hdr_len = sizeof(struct ieee80211_hdr);
+
+	switch (priv->bss_type) {
+	case MLAN_BSS_TYPE_STA:
+		fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
+		/* BSSID SA DA */
+		memcpy(dot11_hdr->addr1, priv->cfg_bssid, ETH_ALEN);
+		memcpy(dot11_hdr->addr2, ptr + ETH_ALEN, ETH_ALEN);
+		memcpy(dot11_hdr->addr3, ptr, ETH_ALEN);
+		hdr_len -= ETH_ALEN;
+		break;
+	case MLAN_BSS_TYPE_UAP:
+		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+		/* DA BSSID SA */
+		memcpy(dot11_hdr->addr1, ptr, ETH_ALEN);
+		memcpy(dot11_hdr->addr2, priv->current_addr, ETH_ALEN);
+		memcpy(dot11_hdr->addr3, ptr + ETH_ALEN, ETH_ALEN);
+		/* subtract mac addr field size for 3 address 802.11 header */
+		hdr_len -= ETH_ALEN;
+		break;
+	default:
+		woal_free_mlan_buffer(priv->phandle, pmbuf2);
+		goto done;
+	}
+
+	dot11_hdr->frame_control = fc;
+	/* add 2 bytes for qos ctrl flags */
+	hdr_len += 2;
+
+	/* Add LLC/SNAP rfc1042 header after 802.11 hdr */
+	memcpy((t_u8 *)dot11_hdr + hdr_len, &rfc1042_eth_hdr, ETH_ALEN);
+
+	/* Copy out rest of the data frame */
+	len = pmbuf->data_len - 2 * ETH_ALEN;
+	ptr += 2 * ETH_ALEN;
+	memcpy(pmbuf2->pbuf + pmbuf2->data_offset + hdr_len +
+		       sizeof(rfc1042_eth_hdr),
+	       ptr, len);
+
+	pmbuf2->data_len = hdr_len + sizeof(rfc1042_eth_hdr) + len;
+
+	rt = (struct radiotap_info *)((t_u8 *)pmbuf2->pbuf +
+				      pmbuf2->data_offset -
+				      sizeof(radiotap_info));
+	memset(rt, 0x00, sizeof(radiotap_info));
+	/* TODO: Fill radiotap header here */
+	/* Send this duplicated packet to Rx monitor pkt handler */
+	if (moal_recv_packet(handle, pmbuf2) != MLAN_STATUS_PENDING)
+		woal_free_mlan_buffer(priv->phandle, pmbuf2);
+done:
+	LEAVE();
+}
+#endif
+#endif
+
 /**
  *  @brief This function handles packet transmission
  *
@@ -7357,6 +7572,14 @@ static void woal_start_xmit(moal_private *priv, struct sk_buff *skb)
 		if (ret)
 			goto done;
 	}
+#if defined(STA_CFG80211) && defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	if (priv->phandle->mon_if &&
+	    (priv->phandle->mon_if->flag & MLAN_NETMON_DATA) &&
+	    (priv->phandle->mon_if->flag & MLAN_NETMON_TX))
+		woal_send_tx_pkt_to_mon_if(priv, pmbuf);
+#endif
+#endif
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 	if (priv->enable_auto_tdls && priv->tdls_check_tx)
@@ -7869,6 +8092,8 @@ void woal_init_priv(moal_private *priv, t_u8 wait_option)
 #ifdef UAP_SUPPORT
 	priv->target_chan = 0;
 	priv->backup_chan = 0;
+	priv->chan_mode = DEFAULT_CHAN_MODE_MASK;
+	priv->chan_num_pkts = DEFAULT_RETRY_PKTS;
 	priv->user_cac_period_msec = 0;
 	priv->chan_under_nop = MFALSE;
 #endif
@@ -8064,12 +8289,12 @@ done:
  *
  *  @return             moal_private pointer or NULL
  */
-moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u8 bss_index)
+moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u32 bss_index)
 {
 	int i;
 
 	ENTER();
-	if (!handle || !handle->priv_num) {
+	if (!handle) {
 		LEAVE();
 		return NULL;
 	}
@@ -8241,9 +8466,12 @@ static int woal_get_card_info(moal_handle *phandle)
 		phandle->card_info = &card_info_SD9097;
 		break;
 #endif
-#ifdef SDNW62X
-	case CARD_TYPE_SDNW62X:
-		phandle->card_info = &card_info_SDNW62X;
+	case CARD_TYPE_SDAW693:
+		phandle->card_info = &card_info_SDAW693;
+		break;
+#ifdef SDIW62X
+	case CARD_TYPE_SDIW62X:
+		phandle->card_info = &card_info_SDIW62X;
 		break;
 #endif
 #ifdef SD9177
@@ -8262,9 +8490,12 @@ static int woal_get_card_info(moal_handle *phandle)
 		phandle->card_info = &card_info_PCIE9097;
 		break;
 #endif
-#ifdef PCIENW62X
-	case CARD_TYPE_PCIENW62X:
-		phandle->card_info = &card_info_PCIENW62X;
+	case CARD_TYPE_PCIEAW693:
+		phandle->card_info = &card_info_PCIEAW693;
+		break;
+#ifdef PCIEIW62X
+	case CARD_TYPE_PCIEIW62X:
+		phandle->card_info = &card_info_PCIEIW62X;
 		break;
 #endif
 #ifdef PCIE9098
@@ -8298,9 +8529,9 @@ static int woal_get_card_info(moal_handle *phandle)
 		phandle->card_info = &card_info_USB9097;
 		break;
 #endif
-#ifdef USBNW62X
-	case CARD_TYPE_USBNW62X:
-		phandle->card_info = &card_info_USBNW62X;
+#ifdef USBIW62X
+	case CARD_TYPE_USBIW62X:
+		phandle->card_info = &card_info_USBIW62X;
 		break;
 #endif
 #ifdef SD8987
@@ -9182,6 +9413,7 @@ t_void woal_store_firmware_dump(moal_handle *phandle, mlan_event *pmevent)
 	t_u16 seqnum;
 	t_u16 type = 0;
 	t_u8 *pos;
+	moal_private *priv = NULL;
 
 	ENTER();
 
@@ -9247,8 +9479,9 @@ t_void woal_store_firmware_dump(moal_handle *phandle, mlan_event *pmevent)
 			phandle->is_fw_dump_timer_set = MFALSE;
 		}
 		if (phandle->priv_num) {
-			woal_send_fw_dump_complete_event(
-				woal_get_priv(phandle, MLAN_BSS_ROLE_ANY));
+			priv = woal_get_priv(phandle, MLAN_BSS_ROLE_ANY);
+			if (priv)
+				woal_send_fw_dump_complete_event(priv);
 			mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
 			woal_process_hang(phandle);
 		}
@@ -9292,10 +9525,10 @@ static int woal_save_hex_dump(int rowsize, const void *buf, size_t len,
 		hex_dump_to_buffer(ptr + i, linelen, rowsize, 1, linebuf,
 				   sizeof(linebuf), false);
 
-		pos += sprintf(pos, "%s\n", linebuf);
+		pos += snprintf(pos, MAX_BUF_LEN, "%s\n", linebuf);
 	}
 
-	return pos - (char *)save_buf;
+	return (int)(pos - (char *)save_buf);
 }
 
 /**
@@ -9325,31 +9558,37 @@ static int woal_dump_priv_drv_info(moal_handle *handle, t_u8 *buf)
 	     index++) {
 		priv = handle->priv[index];
 		if (priv) {
-			ptr += sprintf(ptr, "[Interface : %s]\n",
-				       priv->proc_entry_name);
+			ptr += snprintf(ptr, MAX_BUF_LEN, "[Interface : %s]\n",
+					priv->proc_entry_name);
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
-			ptr += sprintf(ptr, "wmm_tx_pending[0] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[0]));
-			ptr += sprintf(ptr, "wmm_tx_pending[1] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[1]));
-			ptr += sprintf(ptr, "wmm_tx_pending[2] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[2]));
-			ptr += sprintf(ptr, "wmm_tx_pending[3] = %d\n",
-				       atomic_read(&priv->wmm_tx_pending[3]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[0] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[0]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[1] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[1]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[2] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[2]));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"wmm_tx_pending[3] = %d\n",
+					atomic_read(&priv->wmm_tx_pending[3]));
 #endif
-			ptr += sprintf(ptr, "Media state = \"%s\"\n",
-				       ((priv->media_connected == MFALSE) ?
-						"Disconnected" :
-						"Connected"));
-			ptr += sprintf(ptr, "carrier %s\n",
-				       ((netif_carrier_ok(priv->netdev)) ?
-						"on" :
-						"off"));
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"Media state = \"%s\"\n",
+					((priv->media_connected == MFALSE) ?
+						 "Disconnected" :
+						 "Connected"));
+			ptr += snprintf(ptr, MAX_BUF_LEN, "carrier %s\n",
+					((netif_carrier_ok(priv->netdev)) ?
+						 "on" :
+						 "off"));
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 29)
 			for (i = 0; i < (int)(priv->netdev->num_tx_queues);
 			     i++) {
-				ptr += sprintf(
-					ptr, "tx queue %d: %s\n", i,
+				ptr += snprintf(
+					ptr, MAX_BUF_LEN, "tx queue %d: %s\n",
+					i,
 					((netif_tx_queue_stopped(
 						 netdev_get_tx_queue(
 							 priv->netdev, i))) ?
@@ -9357,19 +9596,20 @@ static int woal_dump_priv_drv_info(moal_handle *handle, t_u8 *buf)
 						 "started"));
 			}
 #else
-			ptr += sprintf(ptr, "tx queue %s\n",
-				       ((netif_queue_stopped(priv->netdev)) ?
-						"stopped" :
-						"started"));
+			ptr += snprintf(ptr, MAX_BUF_LEN, "tx queue %s\n",
+					((netif_queue_stopped(priv->netdev)) ?
+						 "stopped" :
+						 "started"));
 #endif
-			ptr += sprintf(ptr, "%s: num_tx_timeout = %d\n",
-				       priv->netdev->name,
-				       priv->num_tx_timeout);
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"%s: num_tx_timeout = %d\n",
+					priv->netdev->name,
+					priv->num_tx_timeout);
 		}
 	}
 
 	LEAVE();
-	return ptr - (char *)buf;
+	return (int)(ptr - (char *)buf);
 }
 
 /**
@@ -9399,55 +9639,60 @@ static int woal_dump_moal_drv_info(moal_handle *phandle, t_u8 *buf)
 		cardp = (struct usb_card_rec *)phandle->card;
 #endif
 	ptr = (char *)buf;
-	ptr += sprintf(ptr, "------------moal_debug_info-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------moal_debug_info-------------\n");
 	woal_get_version(phandle, str_buf, sizeof(str_buf) - 1);
-	ptr += sprintf(ptr, "Driver version = %s\n", str_buf);
-	ptr += sprintf(ptr, "main_state = %d\n", phandle->main_state);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "Driver version = %s\n", str_buf);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "main_state = %d\n",
+			phandle->main_state);
 #ifdef USB
 	if (IS_USB(phandle->card_type)) {
-		ptr += sprintf(ptr, "tx_cmd_urb_pending = %d\n",
-			       atomic_read(&cardp->tx_cmd_urb_pending));
-		ptr += sprintf(ptr, "tx_data_urb_pending = %d\n",
-			       atomic_read(&cardp->tx_data_urb_pending));
-		ptr += sprintf(ptr, "tx_data2_urb_pending = %d\n",
-			       atomic_read(&cardp->tx_data2_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "tx_cmd_urb_pending = %d\n",
+				atomic_read(&cardp->tx_cmd_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "tx_data_urb_pending = %d\n",
+				atomic_read(&cardp->tx_data_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "tx_data2_urb_pending = %d\n",
+				atomic_read(&cardp->tx_data2_urb_pending));
 #ifdef USB_CMD_DATA_EP
-		ptr += sprintf(ptr, "rx_cmd_urb_pending = %d\n",
-			       atomic_read(&cardp->rx_cmd_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "rx_cmd_urb_pending = %d\n",
+				atomic_read(&cardp->rx_cmd_urb_pending));
 #endif
-		ptr += sprintf(ptr, "rx_data_urb_pending = %d\n",
-			       atomic_read(&cardp->rx_data_urb_pending));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "rx_data_urb_pending = %d\n",
+				atomic_read(&cardp->rx_data_urb_pending));
 	}
 #endif
-	ptr += sprintf(ptr, "ioctl_pending = %d\n",
-		       atomic_read(&phandle->ioctl_pending));
-	ptr += sprintf(ptr, "tx_pending = %d\n",
-		       atomic_read(&phandle->tx_pending));
-	ptr += sprintf(ptr, "rx_pending = %d\n",
-		       atomic_read(&phandle->rx_pending));
-	ptr += sprintf(ptr, "lock_count = %d\n",
-		       atomic_read(&phandle->lock_count));
-	ptr += sprintf(ptr, "malloc_count = %d\n",
-		       atomic_read(&phandle->malloc_count));
-	ptr += sprintf(ptr, "mbufalloc_count = %d\n",
-		       atomic_read(&phandle->mbufalloc_count));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "ioctl_pending = %d\n",
+			atomic_read(&phandle->ioctl_pending));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_pending = %d\n",
+			atomic_read(&phandle->tx_pending));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "rx_pending = %d\n",
+			atomic_read(&phandle->rx_pending));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "lock_count = %d\n",
+			atomic_read(&phandle->lock_count));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "malloc_count = %d\n",
+			atomic_read(&phandle->malloc_count));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mbufalloc_count = %d\n",
+			atomic_read(&phandle->mbufalloc_count));
 #ifdef PCIE
 	if (IS_PCIE(phandle->card_type)) {
-		ptr += sprintf(ptr, "malloc_cons_count = %d\n",
-			       atomic_read(&phandle->malloc_cons_count));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "malloc_cons_count = %d\n",
+				atomic_read(&phandle->malloc_cons_count));
 	}
 #endif
-	ptr += sprintf(ptr, "hs_skip_count = %u\n", phandle->hs_skip_count);
-	ptr += sprintf(ptr, "hs_force_count = %u\n", phandle->hs_force_count);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "hs_skip_count = %u\n",
+			phandle->hs_skip_count);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "hs_force_count = %u\n",
+			phandle->hs_force_count);
 
 	ptr += woal_dump_priv_drv_info(phandle, ptr);
-	ptr += sprintf(ptr, "------------moal_debug_info End-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------moal_debug_info End-------------\n");
 
 	if (phandle->ops.dump_reg_info)
 		ptr += phandle->ops.dump_reg_info(phandle, ptr);
 
 	LEAVE();
-	return ptr - (char *)buf;
+	return (int)(ptr - (char *)buf);
 }
 
 /**
@@ -9483,80 +9728,97 @@ static int woal_dump_mlan_drv_info(moal_private *priv, t_u8 *buf)
 		LEAVE();
 		return 0;
 	}
-	ptr += sprintf(ptr, "------------mlan_debug_info-------------\n");
-	ptr += sprintf(ptr, "mlan_processing =%d\n", info->mlan_processing);
-	ptr += sprintf(ptr, "main_lock_flag =%d\n", info->main_lock_flag);
-	ptr += sprintf(ptr, "main_process_cnt =%d\n", info->main_process_cnt);
-	ptr += sprintf(ptr, "delay_task_flag =%d\n", info->delay_task_flag);
-	ptr += sprintf(ptr, "mlan_rx_processing =%d\n",
-		       info->mlan_rx_processing);
-	ptr += sprintf(ptr, "rx_pkts_queued =%d\n", info->rx_pkts_queued);
-	ptr += sprintf(ptr, "tx_pkts_queued =%d\n", info->tx_pkts_queued);
-	ptr += sprintf(ptr, "fw_hang_report = %d\n", info->fw_hang_report);
-	ptr += sprintf(ptr, "num_cmd_timeout = %d\n", info->num_cmd_timeout);
-	ptr += sprintf(ptr, "Timeout cmd id = 0x%x, act = 0x%x\n",
-		       info->timeout_cmd_id, info->timeout_cmd_act);
-	ptr += sprintf(ptr, "last_cmd_index = %d\n", info->last_cmd_index);
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------mlan_debug_info-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mlan_processing =%d\n",
+			info->mlan_processing);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "main_lock_flag =%d\n",
+			info->main_lock_flag);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "main_process_cnt =%d\n",
+			info->main_process_cnt);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "delay_task_flag =%d\n",
+			info->delay_task_flag);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mlan_rx_processing =%d\n",
+			info->mlan_rx_processing);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "rx_pkts_queued =%d\n",
+			info->rx_pkts_queued);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_pkts_queued =%d\n",
+			info->tx_pkts_queued);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "fw_hang_report = %d\n",
+			info->fw_hang_report);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_timeout = %d\n",
+			info->num_cmd_timeout);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "Timeout cmd id = 0x%x, act = 0x%x\n",
+			info->timeout_cmd_id, info->timeout_cmd_act);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_index = %d\n",
+			info->last_cmd_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_id[i]);
-	ptr += sprintf(ptr, "last_cmd_id = %s\n", str);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_id[i]);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_id = %s\n", str);
 
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_act[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_cmd_act[i]);
 
-	ptr += sprintf(ptr, "last_cmd_act = %s\n", str);
-	ptr += sprintf(ptr, "last_cmd_resp_index = %d\n",
-		       info->last_cmd_resp_index);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_act = %s\n", str);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_resp_index = %d\n",
+			info->last_cmd_resp_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_cmd_resp_id[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ",
+			      info->last_cmd_resp_id[i]);
 
-	ptr += sprintf(ptr, "last_cmd_resp_id = %s\n", str);
-	ptr += sprintf(ptr, "last_event_index = %d\n", info->last_event_index);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_cmd_resp_id = %s\n", str);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_event_index = %d\n",
+			info->last_event_index);
 	for (s = str, i = 0; i < DBG_CMD_NUM; i++)
-		s += sprintf(s, "0x%x ", info->last_event[i]);
+		s += snprintf(s, MAX_BUF_LEN, "0x%x ", info->last_event[i]);
 
-	ptr += sprintf(ptr, "last_event = %s\n", str);
-	ptr += sprintf(ptr, "num_data_h2c_failure = %d\n",
-		       info->num_tx_host_to_card_failure);
-	ptr += sprintf(ptr, "num_cmd_h2c_failure = %d\n",
-		       info->num_cmd_host_to_card_failure);
-	ptr += sprintf(ptr, "num_alloc_buffer_failure = %d\n",
-		       info->num_alloc_buffer_failure);
-	ptr += sprintf(ptr, "num_pkt_dropped = %d\n", info->num_pkt_dropped);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "last_event = %s\n", str);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_data_h2c_failure = %d\n",
+			info->num_tx_host_to_card_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_h2c_failure = %d\n",
+			info->num_cmd_host_to_card_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_alloc_buffer_failure = %d\n",
+			info->num_alloc_buffer_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_pkt_dropped = %d\n",
+			info->num_pkt_dropped);
 #ifdef SDIO
 	if (IS_SD(priv->phandle->card_type)) {
-		ptr += sprintf(ptr, "num_data_c2h_failure = %d\n",
-			       info->num_rx_card_to_host_failure);
-		ptr += sprintf(ptr, "num_cmdevt_c2h_failure = %d\n",
-			       info->num_cmdevt_card_to_host_failure);
-		ptr += sprintf(ptr, "num_int_read_failure = %d\n",
-			       info->num_int_read_failure);
-		ptr += sprintf(ptr, "last_int_status = %d\n",
-			       info->last_int_status);
-		ptr += sprintf(ptr, "mp_rd_bitmap=0x%x curr_rd_port=0x%x\n",
-			       (unsigned int)info->mp_rd_bitmap,
-			       info->curr_rd_port);
-		ptr += sprintf(ptr, "mp_wr_bitmap=0x%x curr_wr_port=0x%x\n",
-			       (unsigned int)info->mp_wr_bitmap,
-			       info->curr_wr_port);
-		ptr += sprintf(ptr, "mp_data_port_mask=0x%x\n",
-			       info->mp_data_port_mask);
-		ptr += sprintf(
-			ptr, "last_recv_rd_bitmap=0x%x mp_invalid_update=%d\n",
+		ptr += snprintf(ptr, MAX_BUF_LEN, "num_data_c2h_failure = %d\n",
+				info->num_rx_card_to_host_failure);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"num_cmdevt_c2h_failure = %d\n",
+				info->num_cmdevt_card_to_host_failure);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "num_int_read_failure = %d\n",
+				info->num_int_read_failure);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "last_int_status = %d\n",
+				info->last_int_status);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mp_rd_bitmap=0x%x curr_rd_port=0x%x\n",
+				(unsigned int)info->mp_rd_bitmap,
+				info->curr_rd_port);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mp_wr_bitmap=0x%x curr_wr_port=0x%x\n",
+				(unsigned int)info->mp_wr_bitmap,
+				info->curr_wr_port);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "mp_data_port_mask=0x%x\n",
+				info->mp_data_port_mask);
+		ptr += snprintf(
+			ptr, MAX_BUF_LEN,
+			"last_recv_rd_bitmap=0x%x mp_invalid_update=%d\n",
 			info->last_recv_rd_bitmap, info->mp_invalid_update);
 		mp_aggr_pkt_limit = info->mp_aggr_pkt_limit;
-		ptr += sprintf(ptr,
-			       "last_recv_wr_bitmap=0x%x last_mp_index = %d\n",
-			       info->last_recv_wr_bitmap, info->last_mp_index);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"last_recv_wr_bitmap=0x%x last_mp_index = %d\n",
+				info->last_recv_wr_bitmap, info->last_mp_index);
 		for (i = 0; i < SDIO_MP_DBG_NUM; i++) {
 			for (s = str, j = 0; j < mp_aggr_pkt_limit; j++)
-				s += sprintf(
-					s, "0x%02x ",
+				s += snprintf(
+					s, MAX_BUF_LEN, "0x%02x ",
 					info->last_mp_wr_info
 						[i * mp_aggr_pkt_limit + j]);
 
-			ptr += sprintf(
-				ptr,
+			ptr += snprintf(
+				ptr, MAX_BUF_LEN,
 				"mp_wr_bitmap: 0x%x mp_wr_ports=0x%x len=%d curr_wr_port=0x%x\n%s\n",
 				info->last_mp_wr_bitmap[i],
 				info->last_mp_wr_ports[i],
@@ -9567,75 +9829,95 @@ static int woal_dump_mlan_drv_info(moal_private *priv, t_u8 *buf)
 #endif
 #ifdef PCIE
 	if (IS_PCIE(priv->phandle->card_type)) {
-		ptr += sprintf(ptr, "txbd_rdptr=0x%x txbd_wrptr=0x%x\n",
-			       info->txbd_rdptr, info->txbd_wrptr);
-		ptr += sprintf(ptr, "rxbd_rdptr=0x%x rxbd_wrptr=0x%x\n",
-			       info->rxbd_rdptr, info->rxbd_wrptr);
-		ptr += sprintf(ptr, "eventbd_rdptr=0x%x event_wrptr=0x%x\n",
-			       info->eventbd_rdptr, info->eventbd_wrptr);
-		ptr += sprintf(ptr, "last_wr_index:%d\n",
-			       info->txbd_wrptr & (info->txrx_bd_size - 1));
-		ptr += sprintf(ptr, "TxRx BD size:%d\n", info->txrx_bd_size);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"txbd_rdptr=0x%x txbd_wrptr=0x%x\n",
+				info->txbd_rdptr, info->txbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"rxbd_rdptr=0x%x rxbd_wrptr=0x%x\n",
+				info->rxbd_rdptr, info->rxbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"eventbd_rdptr=0x%x event_wrptr=0x%x\n",
+				info->eventbd_rdptr, info->eventbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "last_wr_index:%d\n",
+				info->txbd_wrptr & (info->txrx_bd_size - 1));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "TxRx BD size:%d\n",
+				info->txrx_bd_size);
 	}
 #endif
-	ptr += sprintf(ptr, "num_event_deauth = %d\n", info->num_event_deauth);
-	ptr += sprintf(ptr, "num_event_disassoc = %d\n",
-		       info->num_event_disassoc);
-	ptr += sprintf(ptr, "num_event_link_lost = %d\n",
-		       info->num_event_link_lost);
-	ptr += sprintf(ptr, "num_cmd_deauth = %d\n", info->num_cmd_deauth);
-	ptr += sprintf(ptr, "num_cmd_assoc_success = %d\n",
-		       info->num_cmd_assoc_success);
-	ptr += sprintf(ptr, "num_cmd_assoc_failure = %d\n",
-		       info->num_cmd_assoc_failure);
-	ptr += sprintf(ptr, "num_cons_assoc_failure = %d\n",
-		       info->num_cons_assoc_failure);
-	ptr += sprintf(ptr, "cmd_resp_received = %d\n",
-		       info->cmd_resp_received);
-	ptr += sprintf(ptr, "event_received = %d\n", info->event_received);
-	ptr += sprintf(ptr, "max_tx_buf_size = %d\n", info->max_tx_buf_size);
-	ptr += sprintf(ptr, "tx_buf_size = %d\n", info->tx_buf_size);
-	ptr += sprintf(ptr, "curr_tx_buf_size = %d\n", info->curr_tx_buf_size);
-	ptr += sprintf(ptr, "bypass_pkt_count=%d\n", info->bypass_pkt_count);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_event_deauth = %d\n",
+			info->num_event_deauth);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_event_disassoc = %d\n",
+			info->num_event_disassoc);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_event_link_lost = %d\n",
+			info->num_event_link_lost);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_deauth = %d\n",
+			info->num_cmd_deauth);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_assoc_success = %d\n",
+			info->num_cmd_assoc_success);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cmd_assoc_failure = %d\n",
+			info->num_cmd_assoc_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "num_cons_assoc_failure = %d\n",
+			info->num_cons_assoc_failure);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "cmd_resp_received = %d\n",
+			info->cmd_resp_received);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "event_received = %d\n",
+			info->event_received);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "max_tx_buf_size = %d\n",
+			info->max_tx_buf_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_buf_size = %d\n",
+			info->tx_buf_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "curr_tx_buf_size = %d\n",
+			info->curr_tx_buf_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "bypass_pkt_count=%d\n",
+			info->bypass_pkt_count);
 
-	ptr += sprintf(ptr, "data_sent=%d cmd_sent=%d\n", info->data_sent,
-		       info->cmd_sent);
-	ptr += sprintf(ptr, "data_sent_cnt=%u\n", info->data_sent_cnt);
-	ptr += sprintf(ptr, "ps_mode=%d ps_state=%d\n", info->ps_mode,
-		       info->ps_state);
-	ptr += sprintf(
-		ptr, "wakeup_dev_req=%d wakeup_tries=%d pm_wakeup_timeout=%d\n",
+	ptr += snprintf(ptr, MAX_BUF_LEN, "data_sent=%d cmd_sent=%d\n",
+			info->data_sent, info->cmd_sent);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "data_sent_cnt=%u\n",
+			info->data_sent_cnt);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "ps_mode=%d ps_state=%d\n",
+			info->ps_mode, info->ps_state);
+	ptr += snprintf(
+		ptr, MAX_BUF_LEN,
+		"wakeup_dev_req=%d wakeup_tries=%d pm_wakeup_timeout=%d\n",
 		info->pm_wakeup_card_req, info->pm_wakeup_fw_try,
 		info->pm_wakeup_timeout);
-	ptr += sprintf(ptr, "hs_configured=%d hs_activated=%d\n",
-		       info->is_hs_configured, info->hs_activated);
-	ptr += sprintf(ptr, "pps_uapsd_mode=%d sleep_pd=%d\n",
-		       info->pps_uapsd_mode, info->sleep_pd);
-	ptr += sprintf(ptr, "tx_lock_flag = %d\n", info->tx_lock_flag);
-	ptr += sprintf(ptr, "port_open = %d\n", info->port_open);
-	ptr += sprintf(ptr, "scan_processing = %d\n", info->scan_processing);
-	ptr += sprintf(ptr, "scan_state = %d\n", info->scan_state);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "hs_configured=%d hs_activated=%d\n",
+			info->is_hs_configured, info->hs_activated);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "pps_uapsd_mode=%d sleep_pd=%d\n",
+			info->pps_uapsd_mode, info->sleep_pd);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "tx_lock_flag = %d\n",
+			info->tx_lock_flag);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "port_open = %d\n", info->port_open);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "scan_processing = %d\n",
+			info->scan_processing);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "scan_state = %d\n",
+			info->scan_state);
 
 #ifdef PCIE
 	if (IS_PCIE(priv->phandle->card_type)) {
-		ptr += sprintf(ptr, "txbd: rdptr=0x%x wrptr=0x%x\n",
-			       info->txbd_rdptr, info->txbd_wrptr);
-		ptr += sprintf(ptr, "rxbd: rdptr=0x%x wrptr=0x%x\n",
-			       info->rxbd_rdptr, info->rxbd_wrptr);
-		ptr += sprintf(ptr, "eventbd: rdptr=0x%x wrptr=0x%x\n",
-			       info->eventbd_rdptr, info->eventbd_wrptr);
-		ptr += sprintf(ptr, "TXBD Ring:\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"txbd: rdptr=0x%x wrptr=0x%x\n",
+				info->txbd_rdptr, info->txbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"rxbd: rdptr=0x%x wrptr=0x%x\n",
+				info->rxbd_rdptr, info->rxbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"eventbd: rdptr=0x%x wrptr=0x%x\n",
+				info->eventbd_rdptr, info->eventbd_wrptr);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "TXBD Ring:\n");
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->txbd_ring_vbase,
 					  info->txbd_ring_size, MTRUE, ptr);
-		ptr += sprintf(ptr, "RXBD Ring:\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "RXBD Ring:\n");
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->rxbd_ring_vbase,
 					  info->rxbd_ring_size, MTRUE, ptr);
-		ptr += sprintf(ptr, "EVTBD Ring:\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "EVTBD Ring:\n");
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->evtbd_ring_vbase,
 					  info->evtbd_ring_size, MTRUE, ptr);
 	}
 #endif
-	ptr += sprintf(ptr, "------------mlan_debug_info End-------------\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN,
+			"------------mlan_debug_info End-------------\n");
 
 	LEAVE();
 	return ptr - (char *)buf;
@@ -9661,30 +9943,32 @@ static int woal_dump_moal_hex(moal_handle *phandle, t_u8 *buf)
 		return 0;
 	}
 
-	ptr += sprintf(ptr, "<--moal_handle-->\n");
-	ptr += sprintf(ptr, "moal_handle=%p, size=%ld(0x%lx)\n", phandle,
-		       (long int)sizeof(*phandle),
-		       (long unsigned int)sizeof(*phandle));
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--moal_handle-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "moal_handle=%p, size=%ld(0x%lx)\n",
+			phandle, (long int)sizeof(*phandle),
+			(long unsigned int)sizeof(*phandle));
 	ptr += woal_save_hex_dump(ROW_SIZE_16, phandle, sizeof(*phandle), MTRUE,
 				  ptr);
-	ptr += sprintf(ptr, "<--moal_handle End-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--moal_handle End-->\n");
 
 	for (i = 0; i < phandle->priv_num; i++) {
 		if (!phandle->priv[i])
 			continue;
-		ptr += sprintf(ptr, "<--moal_private(%d) %s-->\n", i,
-			       phandle->priv[i]->netdev->name);
-		ptr += sprintf(ptr, "moal_private=%p, size=%ld(0x%lx)\n",
-			       phandle->priv[i],
-			       (long int)sizeof(*(phandle->priv[i])),
-			       (long unsigned int)sizeof(*(phandle->priv[i])));
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--moal_private(%d) %s-->\n",
+				i, phandle->priv[i]->netdev->name);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"moal_private=%p, size=%ld(0x%lx)\n",
+				phandle->priv[i],
+				(long int)sizeof(*(phandle->priv[i])),
+				(long unsigned int)sizeof(*(phandle->priv[i])));
 		ptr += woal_save_hex_dump(ROW_SIZE_16, phandle->priv[i],
 					  sizeof(*(phandle->priv[i])), MTRUE,
 					  ptr);
-		ptr += sprintf(ptr, "<--moal_private(%d) End-->\n", i);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"<--moal_private(%d) End-->\n", i);
 	}
 	LEAVE();
-	return ptr - (char *)buf;
+	return (int)(ptr - (char *)buf);
 }
 
 /**
@@ -9715,33 +9999,37 @@ static int woal_dump_mlan_hex(moal_private *priv, t_u8 *buf)
 		return 0;
 	}
 
-	ptr += sprintf(ptr, "<--mlan_adapter-->\n");
-	ptr += sprintf(ptr, "mlan_adapter=%p, size=%d(0x%x)\n",
-		       info->mlan_adapter, info->mlan_adapter_size,
-		       info->mlan_adapter_size);
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_adapter-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "mlan_adapter=%p, size=%d(0x%x)\n",
+			info->mlan_adapter, info->mlan_adapter_size,
+			info->mlan_adapter_size);
 	ptr += woal_save_hex_dump(ROW_SIZE_16, info->mlan_adapter,
 				  info->mlan_adapter_size, MTRUE, ptr);
-	ptr += sprintf(ptr, "<--mlan_adapter End-->\n");
+	ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_adapter End-->\n");
 #ifdef SDIO
 	if (IS_SD(priv->phandle->card_type) && info->mpa_buf &&
 	    info->mpa_buf_size) {
-		ptr += sprintf(ptr, "<--mlan_mpa_buf-->\n");
-		ptr += sprintf(ptr, "mlan_mpa_buf=%p, size=%d(0x%x)\n",
-			       info->mpa_buf, info->mpa_buf_size,
-			       info->mpa_buf_size);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_mpa_buf-->\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mlan_mpa_buf=%p, size=%d(0x%x)\n",
+				info->mpa_buf, info->mpa_buf_size,
+				info->mpa_buf_size);
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->mpa_buf,
 					  info->mpa_buf_size, MTRUE, ptr);
-		ptr += sprintf(ptr, "<--mlan_mpa_buf End-->\n");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_mpa_buf End-->\n");
 	}
 #endif
 	for (i = 0; i < info->mlan_priv_num; i++) {
-		ptr += sprintf(ptr, "<--mlan_private(%d)-->\n", i);
-		ptr += sprintf(ptr, "mlan_private=%p, size=%d(0x%x)\n",
-			       info->mlan_priv[i], info->mlan_priv_size[i],
-			       info->mlan_priv_size[i]);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "<--mlan_private(%d)-->\n",
+				i);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"mlan_private=%p, size=%d(0x%x)\n",
+				info->mlan_priv[i], info->mlan_priv_size[i],
+				info->mlan_priv_size[i]);
 		ptr += woal_save_hex_dump(ROW_SIZE_16, info->mlan_priv[i],
 					  info->mlan_priv_size[i], MTRUE, ptr);
-		ptr += sprintf(ptr, "<--mlan_private(%d) End-->\n", i);
+		ptr += snprintf(ptr, MAX_BUF_LEN,
+				"<--mlan_private(%d) End-->\n", i);
 	}
 
 	LEAVE();
@@ -10063,8 +10351,8 @@ mlan_status woal_request_country_power_table(moal_private *priv, char *country)
 	handle = priv->phandle;
 	memset(country_name, 0, sizeof(country_name));
 	if (handle->params.hw_name)
-		sprintf(country_name, "%s_txpower_XX.bin",
-			handle->params.hw_name);
+		snprintf(country_name, sizeof(country_name),
+			 "%s_txpower_XX.bin", handle->params.hw_name);
 	else
 		memcpy(country_name, "txpower_XX.bin",
 		       strlen("txpower_XX.bin"));
@@ -10073,8 +10361,8 @@ mlan_status woal_request_country_power_table(moal_private *priv, char *country)
 	if (handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE) {
 		memset(country_name, 0, sizeof(country_name));
 		if (handle->params.hw_name)
-			sprintf(country_name, "%s_rgpower_XX.bin",
-				handle->params.hw_name);
+			snprintf(country_name, sizeof(country_name),
+				 "%s_rgpower_XX.bin", handle->params.hw_name);
 		else
 			memcpy(country_name, "rgpower_XX.bin",
 			       strlen("rgpower_XX.bin"));
@@ -10122,8 +10410,8 @@ mlan_status woal_request_country_power_table(moal_private *priv, char *country)
 	    (ret == MLAN_STATUS_FILE_ERR)) {
 		memset(country_name, 0, sizeof(country_name));
 		if (handle->params.hw_name)
-			sprintf(country_name, "%s_rgpower_WW.bin",
-				handle->params.hw_name);
+			snprintf(country_name, sizeof(country_name),
+				 "%s_rgpower_WW.bin", handle->params.hw_name);
 		else
 			memcpy(country_name, "rgpower_WW.bin",
 			       strlen("rgpower_WW.bin"));
@@ -10517,7 +10805,7 @@ t_void woal_main_work_queue(struct work_struct *work)
 #endif
 	handle->main_state = MOAL_START_MAIN_PROCESS;
 	/* Call MLAN main process */
-	mlan_main_process(handle->pmlan_adapter);
+	(void)mlan_main_process(handle->pmlan_adapter);
 	handle->main_state = MOAL_END_MAIN_PROCESS;
 
 	LEAVE();
@@ -10961,7 +11249,7 @@ moal_handle *woal_add_card(void *card, struct device *dev, moal_if_ops *if_ops,
 	}
 	woal_update_firmware_name(handle);
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_init(&handle->ws, "mwlan");
 #else
 	wake_lock_init(&handle->wake_lock, WAKE_LOCK_SUSPEND, "mwlan");
@@ -11002,7 +11290,7 @@ err_init_fw:
 						 handle->init_wait_q_woken);
 	}
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
@@ -11211,7 +11499,7 @@ mlan_status woal_remove_card(void *card)
 	PRINTM(MINFO, "unregister device\n");
 	handle->ops.unregister_dev(handle);
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
@@ -11351,8 +11639,8 @@ exit_sem_err:
 }
 #endif
 
-#ifdef SDIO_MMC
 #define FW_POLL_TRIES 100
+#ifdef SDIO
 
 /**
  *  @brief This function reload fw
@@ -11370,11 +11658,13 @@ static int woal_reset_and_reload_fw(moal_handle *handle, t_u8 mode)
 	t_u8 reset_val = handle->card_info->fw_reset_val;
 
 	ENTER();
+#ifdef SDIO_MMC
 	if (mode == FW_RELOAD_SDIO_HW_RESET) {
 		PRINTM(MCMND, "woal_sdio_reset_fw...\n");
 		woal_sdio_reset_hw(handle);
 		goto reload_fw;
 	}
+#endif
 	mlan_pm_wakeup_card(handle->pmlan_adapter, MTRUE);
 	/** wait SOC fully wake up */
 	for (tries = 0; tries < FW_POLL_TRIES; ++tries) {
@@ -11395,11 +11685,10 @@ static int woal_reset_and_reload_fw(moal_handle *handle, t_u8 mode)
 		ret = -EFAULT;
 		goto done;
 	}
-#if defined(SD9098) || defined(SD9097) || defined(SDNW62X) || defined(SD9177)
 	if (IS_SD9098(handle->card_type) || IS_SD9097(handle->card_type) ||
-	    IS_SDNW62X(handle->card_type) || IS_SD9177(handle->card_type))
+	    IS_SDIW62X(handle->card_type) || IS_SD9177(handle->card_type) ||
+	    IS_SDAW693(handle->card_type))
 		handle->ops.write_reg(handle, 0x00, 0x10);
-#endif
 	/* Poll register around 100 ms */
 	for (tries = 0; tries < FW_POLL_TRIES; ++tries) {
 		handle->ops.read_reg(handle, reset_reg, &value);
@@ -11430,6 +11719,68 @@ done:
 }
 #endif
 
+#ifdef PCIE
+/**
+ *  @brief This function reload fw for pcie
+ *
+ *  @param handle   A pointer to moal_handle structure
+ *
+ *  @return        0--success, otherwise failure
+ */
+static int woal_pcie_reset_and_reload_fw(moal_handle *handle)
+{
+	int ret = 0, tries = 0;
+	t_u32 value = 1;
+	t_u32 reset_reg = handle->card_info->fw_reset_reg;
+	t_u8 reset_val = handle->card_info->fw_reset_val;
+
+	ENTER();
+	if (!IS_PCIE9098(handle->card_type) &&
+	    !IS_PCIEIW62X(handle->card_type) &&
+	    !IS_PCIEAW693(handle->card_type) &&
+	    !IS_PCIE9097(handle->card_type)) {
+		PRINTM(MERROR, "HW don't support PCIE in-band reset\n");
+		return -EFAULT;
+	}
+
+	mlan_pm_wakeup_card(handle->pmlan_adapter, MTRUE);
+
+	/* Write register to notify FW */
+	if (handle->ops.write_reg(handle, reset_reg, reset_val) !=
+	    MLAN_STATUS_SUCCESS) {
+		PRINTM(MERROR, "Failed to write reregister.\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	/* Poll register around 100 ms */
+	for (tries = 0; tries < FW_POLL_TRIES; ++tries) {
+		handle->ops.read_reg(handle, reset_reg, &value);
+		if (value == 0)
+			/* FW is ready */
+			break;
+		udelay(1000);
+	}
+
+	if (value) {
+		PRINTM(MERROR, "Failed to poll FW reset register %X=0x%x\n",
+		       reset_reg, value);
+		ret = -EFAULT;
+		goto done;
+	}
+	mlan_pm_wakeup_card(handle->pmlan_adapter, MFALSE);
+	/* Download FW */
+	ret = woal_request_fw(handle);
+	if (ret) {
+		ret = -EFAULT;
+		goto done;
+	}
+	PRINTM(MMSG, "PCIE FW Reload successfully.");
+done:
+	LEAVE();
+	return ret;
+}
+#endif
+
 /**
  *  @brief This function reload fw
  *
@@ -11571,8 +11922,9 @@ static void woal_post_reset(moal_handle *handle)
 #ifdef STA_CFG80211
 	handle->scan_timeout = SCAN_TIMEOUT_25S;
 #endif
-	if (MLAN_STATUS_SUCCESS !=
-	    woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info)) {
+	if (priv &&
+	    (MLAN_STATUS_SUCCESS !=
+	     woal_request_get_fw_info(priv, MOAL_IOCTL_WAIT, &fw_info))) {
 		PRINTM(MERROR, "%s: get_fw_info failed \n", __func__);
 	}
 	woal_get_version(handle, str_buf, sizeof(str_buf) - 1);
@@ -11663,7 +12015,12 @@ static void woal_post_reset(moal_handle *handle)
 		}
 
 		if (handle->params.cntry_txpwr && priv)
-			woal_request_country_power_table(priv, country_code);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_request_country_power_table(priv,
+							     country_code)) {
+				PRINTM(MERROR,
+				       "Failed to get country power table\n");
+			}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
 		if (handle->params.cntry_txpwr == CNTRY_RGPOWER_MODE)
 			queue_work(handle->evt_workqueue,
@@ -11757,7 +12114,7 @@ int woal_request_fw_reload(moal_handle *phandle, t_u8 mode)
 			}
 		}
 	}
-#ifdef SDIO_MMC
+#ifdef SDIO
 	else if ((mode == FW_RELOAD_SDIO_INBAND_RESET ||
 		  mode == FW_RELOAD_SDIO_HW_RESET) &&
 		 IS_SD(handle->card_type)) {
@@ -11774,6 +12131,23 @@ int woal_request_fw_reload(moal_handle *phandle, t_u8 mode)
 			}
 		}
 	}
+#endif
+#ifdef PCIE
+	else if (mode == FW_RELOAD_PCIE_INBAND_RESET &&
+		 IS_PCIE(handle->card_type)) {
+		ret = woal_pcie_reset_and_reload_fw(handle);
+		if (ret) {
+			PRINTM(MERROR, "woal_pcie_reset_and_reload_fw fail\n");
+			goto done;
+		}
+		if (ref_handle) {
+			ret = woal_reload_fw(ref_handle);
+			if (ret) {
+				PRINTM(MERROR, "woal_reload_fw fail\n");
+				goto done;
+			}
+		}
+	}
 #endif
 	else
 		ret = -EFAULT;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.h b/mxm_wifiex/wlan_src/mlinux/moal_main.h
index 8fa4eac..69f7db7 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.h
@@ -105,7 +105,7 @@ Change log:
 #include <linux/firmware.h>
 
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 #include <linux/pm_wakeup.h>
 #include <linux/device.h>
 #else
@@ -160,7 +160,7 @@ Change log:
 
 #if defined(IMX_SUPPORT)
 #if defined(IMX_ANDROID)
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 41)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 15, 52)
 #undef IMX_ANDROID_13
 #define IMX_ANDROID_13 1
 #endif
@@ -278,6 +278,9 @@ typedef t_u8 BOOLEAN;
 /** card type SD9177_UART */
 #define CARD_TYPE_SD9177_UART 1 // As per datasheet/SoC design
 
+/* Max buffer size */
+#define MAX_BUF_LEN 512
+
 /** Driver version */
 extern char driver_version[];
 
@@ -423,7 +426,6 @@ static inline void woal_timer_handler(unsigned long fcontext)
 		mod_timer(&timer->tl,
 			  jiffies + ((timer->time_period * HZ) / 1000));
 	} else {
-		timer->timer_is_canceled = MTRUE;
 		timer->time_period = 0;
 	}
 }
@@ -848,6 +850,8 @@ typedef enum {
 #define CUS_EVT_RADAR_DETECTED "EVENT=RADAR_DETECTED"
 /** Custom event : CAC finished */
 #define CUS_EVT_CAC_FINISHED "EVENT=CAC_FINISHED"
+/** Custom event : CAC start */
+#define CUS_EVT_CAC_START "EVENT=CAC_START"
 #ifdef UAP_SUPPORT
 void woal_move_to_next_channel(moal_private *priv);
 void woal_chan_event(moal_private *priv, t_u8 type, t_u8 channel, t_u8 radar);
@@ -1445,6 +1449,10 @@ struct _moal_private {
 	t_u8 target_chan;
 	/** backup channel */
 	t_u8 backup_chan;
+	/** channel mode for channel switch */
+	t_u8 chan_mode;
+	/** number of csa for channel switch */
+	t_u8 chan_num_pkts;
 	/** uAP skip CAC*/
 	BOOLEAN skip_cac;
 	/** tx block flag */
@@ -1828,6 +1836,8 @@ typedef struct _card_info {
 	t_u32 host_strap_reg;
 	/* Chip Magic Register */
 	t_u32 magic_reg;
+	/** Chip boot mode reg */
+	t_u32 boot_mode_reg;
 	/* FW Name */
 	char fw_name[FW_NAMW_MAX_LEN];
 	char fw_name_wlan[FW_NAMW_MAX_LEN];
@@ -1841,10 +1851,12 @@ typedef struct _card_info {
 	t_u8 scratch_reg;
 	t_u8 func1_reg_start;
 	t_u8 func1_reg_end;
-	t_u32 fw_reset_reg;
-	t_u8 fw_reset_val;
 	t_u32 slew_rate_reg;
 	t_u8 slew_rate_bit_offset;
+#endif
+#if defined(SDIO) || defined(PCIE)
+	t_u32 fw_reset_reg;
+	t_u8 fw_reset_val;
 #endif
 	t_u8 sniffer_support;
 	t_u8 per_pkt_cfg_support;
@@ -1881,6 +1893,10 @@ struct channel_field {
 #define RX_BW_20L 2
 #define RX_BW_20U 3
 #define RX_BW_80 4
+#define RX_HE_BW_20 0
+#define RX_HE_BW_40 1
+#define RX_HE_BW_80 2
+#define RX_HE_BW_160 3
 /** mcs_field.flags
 The flags field is any combination of the following:
 0x03    bandwidth - 0: 20, 1: 40, 2: 20L, 3: 20U
@@ -1943,6 +1959,165 @@ struct vht_field {
 	t_u16 partial_aid;
 } __packed;
 
+#define HE_BSS_COLOR_KNOWN 0x0002
+#define HE_BEAM_CHANGE_KNOWN 0x0004
+#define HE_UL_DL_KNOWN 0x0008
+#define HE_MCS_KNOWN 0x0020
+#define HE_DCM_KNOWN 0x0040
+#define HE_CODING_KNOWN 0x0080
+#define HE_BW_KNOWN 0x4000
+#define HE_DATA_GI_KNOWN 0x0002
+#define HE_MU_DATA 0x0002
+#define HE_CODING_LDPC_USER0 0x2000
+/** he_field - COCO */
+struct he_field {
+	t_u8 pad;
+	t_u16 data1;
+	t_u16 data2;
+	t_u16 data3;
+	t_u16 data4;
+	t_u16 data5;
+	t_u16 data6;
+} __packed;
+
+extern t_u8 ru_signal[16][9];
+extern t_u8 ru_signal_106[14][9];
+extern t_u8 ru_signal_52[9];
+
+#define MLAN_20_BIT_CH1P 0xC0000000
+#define MLAN_20_BIT_CH1S 0x0000003F
+#define MLAN_20_BIT_CH2 0x007F8000
+#define MLAN_80_CENTER_RU 0x00004000
+#define MLAN_160_CENTER_RU 0x40000000
+#define MLAN_20_BIT_CH3 0x00003FC0
+#define MLAN_20_BIT_CH4 0x7F800000
+#define MLAN_BIT_160_CH3 0x003FC000
+#define MLAN_BIT_160_CH4 0x03FC0000
+
+#define MLAN_DECODE_RU_SIGNALING_CH1(out, x, y)                                \
+	{                                                                      \
+		x = (((x << 8) & MLAN_20_BIT_CH1P)) >> 30;                     \
+		out = x | ((y & MLAN_20_BIT_CH1S) << 2);                       \
+	}
+
+#define MLAN_DECODE_RU_SIGNALING_CH3(out, x, y)                                \
+	{                                                                      \
+		out = ((y & MLAN_20_BIT_CH3) >> 6);                            \
+	}
+
+#define MLAN_DECODE_RU_SIGNALING_CH2(out, x, y)                                \
+	{                                                                      \
+		out = ((y & MLAN_20_BIT_CH2) >> 15);                           \
+	}
+
+#define MLAN_DECODE_RU_SIGNALING_CH4(out, x, y)                                \
+	{                                                                      \
+		out = ((y & MLAN_20_BIT_CH4) >> 23);                           \
+	}
+
+#define MLAN_DECODING_160_RU_CH3(out, x, y)                                    \
+	{                                                                      \
+		out = ((y & MLAN_BIT_160_CH3) >> 5);                           \
+	}
+
+#define MLAN_DECODING_160_RU_CH4(out, x, y)                                    \
+	{                                                                      \
+		out = ((y & MLAN_BIT_160_CH4) >> 22);                          \
+	}
+
+#define RU_SIGNAL_52_TONE 112
+#define TONE_MAX_USERS_52 4
+#define TONE_MAX_USERS_242 3
+#define RU_SIGNAL_26_TONE 0
+#define TONE_MAX_USERS_26 8
+#define RU_26_TONE_LIMIT 15
+#define RU_TONE_LIMIT 96
+#define RU_80_106_TONE 128
+#define RU_40_242_TONE 192
+#define RU_80_484_TONE 200
+#define RU_160_996_TONE 208
+#define RU_TONE_26 4
+#define RU_TONE_52 5
+#define RU_TONE_106 6
+#define RU_TONE_242 7
+#define RU_TONE_484 8
+#define RU_TONE_996 9
+
+#define MLAN_DECODE_RU_TONE(x, y, tone)                                           \
+	{                                                                         \
+		if ((x == RU_SIGNAL_52_TONE)) {                                   \
+			if (((y + 1) <= TONE_MAX_USERS_52)) {                     \
+				tone = RU_TONE_52;                                \
+			} else {                                                  \
+				y = (y + 1) - TONE_MAX_USERS_52;                  \
+			}                                                         \
+		} else if (x == RU_SIGNAL_26_TONE) {                              \
+			if ((y + 1) <= TONE_MAX_USERS_26) {                       \
+				tone = RU_TONE_26;                                \
+			} else {                                                  \
+				y = (y + 1) - TONE_MAX_USERS_26;                  \
+			}                                                         \
+		} else if (x <= RU_TONE_LIMIT) {                                  \
+			t_u32 ru_arr_idx;                                         \
+			ru_arr_idx = x > RU_26_TONE_LIMIT ? 1 : 0;                \
+			if ((y + 1) > (ru_arr_idx ? ru_signal_106[x / 8][8] :     \
+						    ru_signal[x][8])) {           \
+				y = (y + 1) -                                     \
+				    (ru_arr_idx ? ru_signal_106[x / 8][8] :       \
+						  ru_signal[x][8]);               \
+			} else {                                                  \
+				t_u32 ind = 0;                                    \
+				t_u32 idx = 0;                                    \
+				while (ind < 8) {                                 \
+					t_u32 tn =                                \
+						ru_arr_idx ?                      \
+							ru_signal_106[x / 8]      \
+								     [7 - ind] :  \
+							ru_signal[x][7 - ind];    \
+					ind++;                                    \
+					if (tn == 0x1 || tn == 0x0 ||             \
+					    tn == 0x2) {                          \
+						if (idx == y) {                   \
+							tone = tn ? (tn ==        \
+								     2) ?         \
+								    RU_TONE_106 : \
+								    RU_TONE_52 :  \
+								    RU_TONE_26;   \
+							break;                    \
+						} else {                          \
+							idx++;                    \
+						}                                 \
+					}                                         \
+				}                                                 \
+			}                                                         \
+		} else if (x == RU_80_106_TONE) {                                 \
+			if ((y + 1) > TONE_MAX_USERS_242) {                       \
+				y = (y + 1) - TONE_MAX_USERS_242;                 \
+			} else {                                                  \
+				tone = (y == 2) ? RU_TONE_106 :                   \
+						  (y == 1) ? 0 : RU_TONE_106;     \
+			}                                                         \
+		} else if (x == RU_40_242_TONE) {                                 \
+			if (!y) {                                                 \
+				tone = RU_TONE_242;                               \
+			} else {                                                  \
+				y--;                                              \
+			}                                                         \
+		} else if (x == RU_80_484_TONE) {                                 \
+			if (!y) {                                                 \
+				tone = RU_TONE_484;                               \
+			} else {                                                  \
+				y--;                                              \
+			}                                                         \
+		} else if (x == RU_160_996_TONE) {                                \
+			if (!y) {                                                 \
+				tone = RU_TONE_996;                               \
+			} else {                                                  \
+				y--;                                              \
+			}                                                         \
+		}                                                                 \
+	}
+
 /** radiotap_body.flags */
 #define RADIOTAP_FLAGS_DURING_CFG 0x01
 #define RADIOTAP_FLAGS_SHORT_PREAMBLE 0x02
@@ -1975,6 +2150,8 @@ struct radiotap_body {
 		struct mcs_field mcs;
 		/** vht field */
 		struct vht_field vht;
+		/** he field */
+		struct he_field he;
 	} u;
 } __packed;
 
@@ -2076,6 +2253,7 @@ typedef struct _monitor_iface {
 #endif
 
 #define MAX_KEEP_ALIVE_ID 4
+#define MAX_KEEP_ALIVE_RX_ID 4
 
 /** Operation data structure for MOAL bus interfaces */
 typedef struct _moal_if_ops {
@@ -2161,6 +2339,9 @@ typedef struct _moal_mod_para {
 	int rf_test_mode;
 	char *hw_name;
 	int drv_mode;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	int mon_filter;
+#endif
 #ifdef DEBUG_LEVEL1
 	int drvdbg;
 #endif
@@ -2240,12 +2421,15 @@ typedef struct _moal_mod_para {
 	t_u8 mcs32;
 
 #if defined(CONFIG_RPS)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
 	/* rps module param */
 	int rps;
 #endif
 #endif
 	int keep_previous_scan;
+	int auto_11ax;
+	/** hs_auto_arp setting */
+	int hs_auto_arp;
 } moal_mod_para;
 
 void woal_tp_acnt_timer_func(void *context);
@@ -2256,7 +2440,7 @@ void woal_set_tp_state(moal_private *priv);
 #define RX_DROP_P3 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 2)
 #define RX_DROP_P4 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 3)
 #define RX_DROP_P5 (MAX_TP_ACCOUNT_DROP_POINT_NUM + 4)
-#define TXRX_MAX_SAMPLE 60
+#define TXRX_MAX_SAMPLE 50
 #define RX_TIME_PKT (MAX_TP_ACCOUNT_DROP_POINT_NUM + 5)
 #define TX_TIME_PKT (MAX_TP_ACCOUNT_DROP_POINT_NUM + 6)
 
@@ -2281,6 +2465,8 @@ typedef struct _moal_tp_acnt_t {
 	unsigned long tx_xmit_skb_realloc_cnt;
 	unsigned long tx_stop_queue_cnt;
 	unsigned long tx_delay_driver[TXRX_MAX_SAMPLE];
+	/* drop_point1 to drop_point3 time */
+	unsigned long tx_delay1_driver[TXRX_MAX_SAMPLE];
 
 	/** RX accounting */
 	unsigned long rx_packets[MAX_TP_ACCOUNT_DROP_POINT_NUM];
@@ -2463,6 +2649,10 @@ struct _moal_handle {
 	/** Bitmap for re-association on/off */
 	t_u8 reassoc_on;
 #endif /* REASSOCIATION */
+	/** RTT capability */
+	wifi_rtt_capabilities rtt_capa;
+	/** RTT config */
+	wifi_rtt_config_params_t rtt_params;
 	/** Driver workqueue */
 	struct workqueue_struct *workqueue;
 	/** main work */
@@ -2612,6 +2802,8 @@ struct _moal_handle {
 	struct semaphore async_sem;
 	/** scan channel gap */
 	t_u16 scan_chan_gap;
+	/** flag to check if specific scan time set by scancfg */
+	t_u8 user_scan_cfg;
 #ifdef STA_CFG80211
 	/** CFG80211 scan request description */
 	struct cfg80211_scan_request *scan_request;
@@ -2680,7 +2872,7 @@ struct _moal_handle {
 	t_s8 driver_version[MLAN_MAX_VER_STR_LEN];
 	char *fwdump_fname;
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	struct wakeup_source ws;
 #else
 	struct wake_lock wake_lock;
@@ -2696,6 +2888,7 @@ struct _moal_handle {
 #endif
 #endif
 	mlan_ds_misc_keep_alive keep_alive[MAX_KEEP_ALIVE_ID];
+	mlan_ds_misc_keep_alive_rx keep_alive_rx[MAX_KEEP_ALIVE_RX_ID];
 	struct net_device napi_dev;
 	struct napi_struct napi_rx;
 	/* bus interface operations */
@@ -3338,7 +3531,7 @@ pmlan_ioctl_req woal_alloc_mlan_ioctl_req(int size);
 /** Free buffer */
 void woal_free_mlan_buffer(moal_handle *handle, pmlan_buffer pmbuf);
 /** Get private structure of a BSS by index */
-moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u8 bss_index);
+moal_private *woal_bss_index_to_priv(moal_handle *handle, t_u32 bss_index);
 /* Functions in init module */
 /** init module parameters */
 mlan_status woal_init_module_param(moal_handle *handle);
@@ -3653,6 +3846,8 @@ mlan_status woal_reset_intf(moal_private *priv, t_u8 wait_option, int all_intf);
 #define MGMT_MASK_ASSOC_RESP_QOS_MAP 0x4000
 #define MGMT_MASK_BEACON_WPS_P2P 0x8000
 #define MLAN_CUSTOM_IE_DELETE_MASK 0x0
+#define MLAN_CUSTOM_IE_NEW_MASK 0x8000
+
 /** common ioctl for uap, station */
 int woal_custom_ie_ioctl(struct net_device *dev, struct ifreq *req);
 #ifdef UAP_SUPPORT
@@ -3890,6 +4085,27 @@ int woal_priv_save_cloud_keep_alive_params(
 	moal_private *priv, t_u8 mkeep_alive_id, t_u8 enable, t_u16 ether_type,
 	t_u8 *ip_pkt, t_u16 ip_pkt_len, t_u8 *src_mac, t_u8 *dst_mac,
 	t_u32 period_msec, t_u32 retry_interval, t_u8 retry_cnt);
+int woal_start_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			      t_u8 *ip_pkt, t_u16 ip_pkt_len, t_u8 *src_mac,
+			      t_u8 *dst_mac);
+int woal_stop_mkeep_alive_rx(moal_private *priv, t_u8 mkeep_alive_id,
+			     t_u8 reset, t_u8 *ip_pkt, t_u8 *pkt_len);
+int woal_priv_save_cloud_keep_alive_params_rx(moal_private *priv,
+					      t_u8 mkeep_alive_id, t_u8 enable,
+					      t_u16 ether_type, t_u8 *ip_pkt,
+					      t_u16 ip_pkt_len, t_u8 *src_mac,
+					      t_u8 *dst_mac);
+void woal_channel_info_to_bandcfg(moal_private *priv,
+				  wifi_channel_info *ch_info,
+				  Band_Config_t *bandcfg);
+void woal_bandcfg_to_channel_info(moal_private *priv, Band_Config_t *bandcfg,
+				  t_u8 channel, wifi_channel_info *ch_info);
+mlan_status woal_config_rtt(moal_private *priv, t_u8 wait_option,
+			    wifi_rtt_config_params_t *rtt_params);
+mlan_status woal_cancel_rtt(moal_private *priv, t_u8 wait_option,
+			    t_u32 addr_num, t_u8 addr[][MLAN_MAC_ADDR_LENGTH]);
+mlan_status woal_rtt_responder_cfg(moal_private *priv, t_u8 wait_option,
+				   mlan_rtt_responder *rtt_rsp_cfg);
 #ifdef UAP_SUPPORT
 mlan_status woal_set_wacp_mode(moal_private *priv, t_u8 wait_option);
 #endif
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
index e16d490..8813cdd 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.c
@@ -116,10 +116,26 @@ static const struct pci_device_id wlan_ids[] = {
 		0,
 	},
 #endif
-#ifdef PCIENW62X
 	{
 		PCIE_VENDOR_ID_NXP,
-		PCIE_DEVICE_ID_88WNW62X,
+		PCIE_DEVICE_ID_88WAW693_FN0,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+	},
+	{
+		PCIE_VENDOR_ID_NXP,
+		PCIE_DEVICE_ID_88WAW693_FN1,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+	},
+#ifdef PCIEIW62X
+	{
+		PCIE_VENDOR_ID_NXP,
+		PCIE_DEVICE_ID_88WIW62X,
 		PCI_ANY_ID,
 		PCI_ANY_ID,
 		0,
@@ -132,6 +148,8 @@ static const struct pci_device_id wlan_ids[] = {
 /* moal interface ops */
 static moal_if_ops pcie_ops;
 
+MODULE_DEVICE_TABLE(pci, wlan_ids);
+
 /********************************************************
 			Global Variables
 ********************************************************/
@@ -141,11 +159,8 @@ static moal_if_ops pcie_ops;
 ********************************************************/
 
 static mlan_status woal_pcie_preinit(struct pci_dev *pdev);
-#if defined(PCIE8897) || defined(PCIE8997) || defined(PCIE9098) ||             \
-	defined(PCIE9097) || defined(PCIENW62X)
 static rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag,
 					   t_u8 resetflag);
-#endif
 
 /**  @brief This function updates the card types
  *
@@ -213,11 +228,11 @@ static t_u16 woal_update_card_type(t_void *card)
 					strlen(KERN_VERSION));
 	}
 #endif
-#ifdef PCIENW62X
-	if (cardp_pcie->dev->device == PCIE_DEVICE_ID_88WNW62X) {
-		card_type = CARD_TYPE_PCIENW62X;
-		moal_memcpy_ext(NULL, driver_version, CARD_PCIENW62X,
-				strlen(CARD_PCIENW62X), strlen(driver_version));
+	if (cardp_pcie->dev->device == PCIE_DEVICE_ID_88WAW693_FN0 ||
+	    cardp_pcie->dev->device == PCIE_DEVICE_ID_88WAW693_FN1) {
+		card_type = CARD_TYPE_PCIEAW693;
+		moal_memcpy_ext(NULL, driver_version, CARD_PCIEAW693,
+				strlen(CARD_PCIEAW693), strlen(driver_version));
 		moal_memcpy_ext(NULL,
 				driver_version + strlen(INTF_CARDTYPE) +
 					strlen(KERN_VERSION),
@@ -225,6 +240,18 @@ static t_u16 woal_update_card_type(t_void *card)
 				strlen(driver_version) - strlen(INTF_CARDTYPE) -
 					strlen(KERN_VERSION));
 	}
+#ifdef PCIEIW62X
+	if (cardp_pcie->dev->device == PCIE_DEVICE_ID_88WIW62X) {
+		card_type = CARD_TYPE_PCIEIW62X;
+		moal_memcpy_ext(NULL, driver_version, CARD_PCIEIW62X,
+				strlen(CARD_PCIEIW62X), strlen(driver_version));
+		moal_memcpy_ext(NULL,
+				driver_version + strlen(INTF_CARDTYPE) +
+					strlen(KERN_VERSION),
+				V18, strlen(V18),
+				strlen(driver_version) - strlen(INTF_CARDTYPE) -
+					strlen(KERN_VERSION));
+	}
 #endif
 
 	return card_type;
@@ -273,7 +300,8 @@ static mlan_status woal_do_flr(moal_handle *handle, bool prepare, bool flr_flag)
 
 	if (!IS_PCIE8997(handle->card_type) &&
 	    !IS_PCIE9097(handle->card_type) &&
-	    !IS_PCIENW62X(handle->card_type) &&
+	    !IS_PCIEIW62X(handle->card_type) &&
+	    !IS_PCIEAW693(handle->card_type) &&
 	    !IS_PCIE9098(handle->card_type)) {
 		LEAVE();
 		return status;
@@ -359,11 +387,10 @@ perform_init:
 		goto err_init_fw;
 	}
 
-#ifdef PCIE9098
-	if (card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1)
+	if ((card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1) ||
+	    (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN1))
 		mlan_set_int_mode(handle->pmlan_adapter, pcie_int_mode, 1);
 	else
-#endif
 		/* Update pcie_int_mode in mlan adapter */
 		mlan_set_int_mode(handle->pmlan_adapter,
 				  handle->params.pcie_int_mode, 0);
@@ -404,7 +431,7 @@ err_init_fw:
 						 handle->init_wait_q_woken);
 	}
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	wakeup_source_trash(&handle->ws);
 #else
 	wake_lock_destroy(&handle->wake_lock);
@@ -573,14 +600,12 @@ static void woal_pcie_shutdown(struct pci_dev *dev)
 	handle = card->handle;
 	if (handle->second_mac)
 		goto done;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
-	if (IS_PCIE9098(handle->card_type) || IS_PCIENW62X(handle->card_type) ||
-	    IS_PCIE9097(handle->card_type)) {
+	if (IS_PCIE9098(handle->card_type) || IS_PCIEIW62X(handle->card_type) ||
+	    IS_PCIEAW693(handle->card_type) || IS_PCIE9097(handle->card_type)) {
 		if (RDWR_STATUS_FAILURE !=
 		    woal_pcie_rdwr_firmware(handle, 0, 1))
 			PRINTM(MMSG, "wlan: start in-bound IR...\n");
 	}
-#endif
 done:
 	handle->surprise_removed = MTRUE;
 	pci_disable_device(dev);
@@ -1380,7 +1405,7 @@ static mlan_status woal_pcie_register_dev(moal_handle *handle)
 				break;
 		}
 		// follow through
-		fallthrough;
+
 		/* fall through */
 	case PCIE_INT_MODE_MSI:
 		pcie_int_mode = PCIE_INT_MODE_MSI;
@@ -1397,7 +1422,7 @@ static mlan_status woal_pcie_register_dev(moal_handle *handle)
 			}
 		}
 		// follow through
-		fallthrough;
+
 		/* fall through */
 	case PCIE_INT_MODE_LEGACY:
 		pcie_int_mode = PCIE_INT_MODE_LEGACY;
@@ -1418,11 +1443,10 @@ static mlan_status woal_pcie_register_dev(moal_handle *handle)
 		break;
 	}
 
-#ifdef PCIE9098
-	if (card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1)
+	if ((card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1) ||
+	    (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN1))
 		mlan_set_int_mode(handle->pmlan_adapter, pcie_int_mode, 1);
 	else
-#endif
 		mlan_set_int_mode(handle->pmlan_adapter, pcie_int_mode, 0);
 
 done:
@@ -1545,24 +1569,20 @@ void woal_pcie_bus_unregister(void)
 	LEAVE();
 }
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 #define PCIE9098_DUMP_CTRL_REG 0x1C94
 #define PCIE9098_DUMP_START_REG 0x1C98
 #define PCIE9098_DUMP_END_REG 0x1C9F
-#endif
 #if defined(PCIE8897) || defined(PCIE8997)
 #define DEBUG_DUMP_CTRL_REG 0xCF4
 #define DEBUG_DUMP_START_REG 0xCF8
 #define DEBUG_DUMP_END_REG 0xCFF
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 #define PCIE9098_SCRATCH_12_REG 0x1C90
 #define PCIE9098_SCRATCH_14_REG 0x1C98
 #define PCIE9098_SCRATCH_15_REG 0x1C9C
 #define PCIE9098_DUMP_REG_START 0x1C20
 #define PCIE9098_DUMP_REG_END 0x1C9C
-#endif
 
 #if defined(PCIE8997) || defined(PCIE8897)
 #define PCIE_SCRATCH_12_REG 0x0CF0;
@@ -1592,11 +1612,9 @@ static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 	t_u32 dump_end_reg = 0;
 	t_u32 scratch_14_reg = 0;
 	t_u32 scratch_15_reg = 0;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	/* Tx/Rx/Event AMDA start address */
 	t_u32 adma_reg_table[] = {0x10000, 0x10800, 0x10880, 0x11000, 0x11080};
 	t_u8 j;
-#endif
 	ENTER();
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
 	drv_ptr += sprintf(drv_ptr,
@@ -1620,9 +1638,9 @@ static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		reg = PCIE9098_SCRATCH_12_REG;
 		dump_start_reg = PCIE9098_DUMP_REG_START;
@@ -1630,7 +1648,6 @@ static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 		scratch_14_reg = PCIE9098_SCRATCH_14_REG;
 		scratch_15_reg = PCIE9098_SCRATCH_15_REG;
 	}
-#endif
 
 	woal_pcie_read_reg(phandle, reg, &value);
 	drv_ptr += sprintf(drv_ptr, "reg:0x%x value=0x%x\n", reg, value);
@@ -1664,9 +1681,9 @@ static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 		}
 		i++;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		drv_ptr += sprintf(
 			drv_ptr,
@@ -1687,7 +1704,8 @@ static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 		drv_ptr += sprintf(drv_ptr, "%s\n", buf);
 	}
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		drv_ptr += sprintf(drv_ptr,
 				   "ADMA Tx/Rx/Event/Cmd/CmdResp registers:\n");
@@ -1714,7 +1732,6 @@ static int woal_pcie_dump_reg_info(moal_handle *phandle, t_u8 *buffer)
 			drv_ptr += sprintf(drv_ptr, "%s\n", buf);
 		}
 	}
-#endif
 	drv_ptr += sprintf(drv_ptr,
 			   "-----------PCIe Registers dump End-----------\n");
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
@@ -1741,11 +1758,9 @@ static void woal_pcie_reg_dbg(moal_handle *phandle)
 	t_u32 dump_end_reg = 0;
 	t_u32 scratch_14_reg = 0;
 	t_u32 scratch_15_reg = 0;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	/* Tx/Rx/Event AMDA start address */
 	t_u32 adma_reg_table[] = {0x10000, 0x10800, 0x10880, 0x11000, 0x11080};
 	t_u8 j;
-#endif
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
 	PRINTM(MMSG, "Config Space Registers:\n");
 	for (i = 0; i < ARRAY_SIZE(config_reg_table); i++) {
@@ -1765,9 +1780,9 @@ static void woal_pcie_reg_dbg(moal_handle *phandle)
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		reg = PCIE9098_SCRATCH_12_REG;
 		dump_start_reg = PCIE9098_DUMP_START_REG;
@@ -1775,7 +1790,6 @@ static void woal_pcie_reg_dbg(moal_handle *phandle)
 		scratch_14_reg = PCIE9098_SCRATCH_14_REG;
 		scratch_15_reg = PCIE9098_SCRATCH_15_REG;
 	}
-#endif
 	woal_pcie_read_reg(phandle, reg, &value);
 	PRINTM(MERROR, "reg:0x%x value=0x%x\n", reg, value);
 	for (i = 0; i < 2; i++) {
@@ -1804,9 +1818,9 @@ static void woal_pcie_reg_dbg(moal_handle *phandle)
 		}
 		i++;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		PRINTM(MMSG, "PCIE registers from offset 0x1c20 to 0x1c9c:\n");
 		memset(buf, 0, sizeof(buf));
@@ -1825,7 +1839,8 @@ static void woal_pcie_reg_dbg(moal_handle *phandle)
 		PRINTM(MMSG, "%s\n", buf);
 	}
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		PRINTM(MMSG, "ADMA Tx/Rx/Event/Cmd/CmdResp registers:\n");
 		for (j = 0; j < ARRAY_SIZE(adma_reg_table); j++) {
@@ -1849,7 +1864,6 @@ static void woal_pcie_reg_dbg(moal_handle *phandle)
 			PRINTM(MMSG, "%s\n", buf);
 		}
 	}
-#endif
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
 }
 
@@ -1892,18 +1906,12 @@ static memory_type_mapping mem_type_mapping_tbl_8897[] = {
 };
 #endif
 
-#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
 #define DEBUG_HOST_READY_8997 0xCC
 #define DEBUG_HOST_EVENT_READY 0xAA
 #define DEBUG_HOST_RESET_READY 0x99
 static memory_type_mapping mem_type_mapping_tbl_8997 = {"DUMP", NULL, NULL,
 							0xDD, 0x00};
 
-#endif
-
-#if defined(PCIE8897) || defined(PCIE8997) || defined(PCIE9098) ||             \
-	defined(PCIE9097) || defined(PCIENW62X)
 /**
  *  @brief This function reads data by 8 bit from card register
  *
@@ -1953,9 +1961,9 @@ static rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag,
 	}
 #endif
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		if (phandle->event_fw_dump)
 			debug_host_ready = DEBUG_HOST_EVENT_READY;
@@ -1965,7 +1973,6 @@ static rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag,
 			debug_host_ready = DEBUG_HOST_RESET_READY;
 		dump_ctrl_reg = PCIE9098_DUMP_CTRL_REG;
 	}
-#endif
 
 	ret = woal_pcie_write_reg(phandle, dump_ctrl_reg, debug_host_ready);
 	if (ret) {
@@ -1973,14 +1980,13 @@ static rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag,
 		       dump_ctrl_reg, debug_host_ready);
 		return RDWR_STATUS_FAILURE;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		if (phandle->event_fw_dump || resetflag)
 			return RDWR_STATUS_SUCCESS;
 	}
-#endif
 	ret = woal_pcie_read_reg(phandle, dump_ctrl_reg, &reg_data);
 	if (ret) {
 		PRINTM(MERROR, "PCIE Read DEBUG_DUMP_CTRL_REG 0x%x fail\n",
@@ -2023,7 +2029,6 @@ static rdwr_status woal_pcie_rdwr_firmware(moal_handle *phandle, t_u8 doneflag,
 	}
 	return RDWR_STATUS_SUCCESS;
 }
-#endif
 
 #ifdef PCIE8897
 /**
@@ -2185,8 +2190,6 @@ done:
 }
 #endif
 
-#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
 /**
  *  @brief This function dump firmware memory to file
  *
@@ -2214,9 +2217,9 @@ static void woal_pcie_dump_fw_info_v2(moal_handle *phandle)
 		PRINTM(MERROR, "Could not dump firmwware info\n");
 		return;
 	}
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		if (phandle->event_fw_dump) {
 			if (RDWR_STATUS_FAILURE !=
@@ -2227,7 +2230,6 @@ static void woal_pcie_dump_fw_info_v2(moal_handle *phandle)
 			}
 		}
 	}
-#endif
 
 	/* start dump fw memory	*/
 	moal_get_system_time(phandle, &sec, &usec);
@@ -2237,14 +2239,13 @@ static void woal_pcie_dump_fw_info_v2(moal_handle *phandle)
 	if (RDWR_STATUS_FAILURE ==
 	    woal_pcie_rdwr_firmware(phandle, doneflag, 0))
 		goto done;
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 	if (IS_PCIE9098(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		dump_start_reg = PCIE9098_DUMP_START_REG;
 		dump_end_reg = PCIE9098_DUMP_END_REG;
 	}
-#endif
 #ifdef PCIE8997
 	if (IS_PCIE8997(phandle->card_type)) {
 		dump_start_reg = DEBUG_DUMP_START_REG;
@@ -2351,7 +2352,6 @@ done:
 
 	return;
 }
-#endif
 
 /**
  *  @brief This function check if this is second mac
@@ -2362,26 +2362,28 @@ done:
  */
 static t_u8 woal_pcie_is_second_mac(moal_handle *handle)
 {
-#ifdef PCIE9098
 	pcie_service_card *card = (pcie_service_card *)handle->card;
-	if (card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1)
+	if ((card->dev->device == PCIE_DEVICE_ID_88W9098P_FN1) ||
+	    (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN1))
 		return MTRUE;
-#endif
 	return MFALSE;
 }
 
 static void woal_pcie_dump_fw_info(moal_handle *phandle)
 {
+	if (phandle->fw_dump_buf) {
+		PRINTM(MERROR, "FW dump already exist\n");
+		return;
+	}
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
 	phandle->fw_dump = MTRUE;
 #ifdef PCIE8897
 	if (IS_PCIE8897(phandle->card_type))
 		woal_pcie_dump_fw_info_v1(phandle);
 #endif
-#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
 	if (IS_PCIE8997(phandle->card_type) ||
-	    IS_PCIENW62X(phandle->card_type) ||
+	    IS_PCIEAW693(phandle->card_type) ||
+	    IS_PCIEIW62X(phandle->card_type) ||
 	    IS_PCIE9098(phandle->card_type) ||
 	    IS_PCIE9097(phandle->card_type)) {
 		woal_pcie_dump_fw_info_v2(phandle);
@@ -2393,7 +2395,6 @@ static void woal_pcie_dump_fw_info(moal_handle *phandle)
 			return;
 		}
 	}
-#endif
 	phandle->fw_dump = MFALSE;
 	if (!phandle->priv_num)
 		return;
@@ -2407,23 +2408,19 @@ static void woal_pcie_dump_fw_info(moal_handle *phandle)
 static mlan_status woal_pcie_get_fw_name(moal_handle *handle)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
-#ifdef PCIE9098
 	pcie_service_card *card = (pcie_service_card *)handle->card;
 	moal_handle *ref_handle = NULL;
-#endif
 
-#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
 	t_u32 rev_id_reg = handle->card_info->rev_id_reg;
 	t_u32 revision_id = 0;
-#endif
 
-#if defined(PCIE8997) || defined(PCIE9098) || defined(PCIE9097) ||             \
-	defined(PCIENW62X)
 	t_u32 host_strap_reg = handle->card_info->host_strap_reg;
 	t_u32 magic_reg = handle->card_info->magic_reg;
 	t_u32 strap = 0;
 	t_u32 magic = 0;
+#ifdef PCIEIW62X
+	t_u32 boot_mode_reg = handle->card_info->boot_mode_reg;
+	t_u32 boot_mode;
 #endif
 
 	ENTER();
@@ -2577,24 +2574,56 @@ static mlan_status woal_pcie_get_fw_name(moal_handle *handle)
 		}
 	}
 #endif
-#ifdef PCIENW62X
-	if (IS_PCIENW62X(handle->card_type)) {
+	if (IS_PCIEAW693(handle->card_type)) {
+		if (card->dev->device == PCIE_DEVICE_ID_88WAW693_FN0) {
+			woal_pcie_read_reg(handle, rev_id_reg, &revision_id);
+			woal_pcie_read_reg(handle, host_strap_reg, &strap);
+			woal_pcie_read_reg(handle, magic_reg, &magic);
+			revision_id &= 0xff;
+			strap &= 0x7;
+			magic &= 0xff;
+			PRINTM(MCMND,
+			       "magic=0x%x, strap=0x%x, revision_id=0x%x\n",
+			       magic, strap, revision_id);
+			if (magic == CHIP_MAGIC_VALUE) {
+				if (strap == CARD_TYPE_PCIE_UART)
+					strcpy(handle->card_info->fw_name,
+					       PCIEUARTAW693_DEFAULT_COMBO_FW_NAME);
+				else
+					strcpy(handle->card_info->fw_name,
+					       PCIEAW693_DEFAULT_COMBO_FW_NAME);
+			}
+		} else {
+			ref_handle = (moal_handle *)handle->pref_mac;
+			if (ref_handle) {
+				strcpy(handle->card_info->fw_name,
+				       ref_handle->card_info->fw_name);
+				strcpy(handle->card_info->fw_name_wlan,
+				       ref_handle->card_info->fw_name_wlan);
+			}
+		}
+	}
+#ifdef PCIEIW62X
+	if (IS_PCIEIW62X(handle->card_type)) {
 		woal_pcie_read_reg(handle, rev_id_reg, &revision_id);
 		woal_pcie_read_reg(handle, host_strap_reg, &strap);
 		woal_pcie_read_reg(handle, magic_reg, &magic);
+		woal_pcie_read_reg(handle, boot_mode_reg, &boot_mode);
 		revision_id &= 0xff;
 		strap &= 0x7;
 		magic &= 0xff;
-		PRINTM(MCMND, "magic=0x%x, strap=0x%x, revision_id=0x%x\n",
-		       magic, strap, revision_id);
-		if (magic == CHIP_MAGIC_VALUE) {
-			if (strap == CARD_TYPE_PCIE_UART)
-				strcpy(handle->card_info->fw_name,
-				       PCIEUARTNW62X_DEFAULT_COMBO_FW_NAME);
-			else
-				strcpy(handle->card_info->fw_name,
-				       PCIEUSBNW62X_DEFAULT_COMBO_FW_NAME);
-		}
+		boot_mode &= 0x03;
+		PRINTM(MCMND,
+		       "magic=0x%x boot_mode=0x%x, strap=0x%x, revision_id=0x%x\n",
+		       magic, boot_mode, strap, revision_id);
+		if (boot_mode == 0x03)
+			PRINTM(MMSG, "wlan: PCIE-IW62X in secure-boot mode\n");
+		if (strap == CARD_TYPE_PCIE_UART)
+			strcpy(handle->card_info->fw_name,
+			       PCIEUARTIW62X_DEFAULT_COMBO_FW_NAME);
+		else
+			strcpy(handle->card_info->fw_name,
+			       PCIEUSBIW62X_DEFAULT_COMBO_FW_NAME);
 	}
 #endif
 done:
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_pcie.h b/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
index dfa1e2e..006fc5d 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_pcie.h
@@ -47,17 +47,20 @@ Change log:
 #define PCIE_DEVICE_ID_88W9097 (0x2b56)
 #endif
 
-#ifdef PCIE9098
 /** PCIE device ID for 9098 card FN0 */
 #define PCIE_DEVICE_ID_88W9098P_FN0 (0x2b43)
 /** PCIE device ID for 9098 card FN1 */
 #define PCIE_DEVICE_ID_88W9098P_FN1 (0x2b44)
+
+#ifdef PCIEIW62X
+/** PCIE device ID for IW62X card FN0 */
+#define PCIE_DEVICE_ID_88WIW62X (0x3000)
 #endif
 
-#ifdef PCIENW62X
-/** PCIE device ID for NW62X card FN0 */
-#define PCIE_DEVICE_ID_88WNW62X (0x3000)
-#endif
+/** PCIE device ID for AW693 card FN0 */
+#define PCIE_DEVICE_ID_88WAW693_FN0 (0x3003)
+/** PCIE device ID for AW693 card FN1 */
+#define PCIE_DEVICE_ID_88WAW693_FN1 (0x3004)
 
 #include <linux/version.h>
 #include <linux/pci.h>
@@ -84,6 +87,10 @@ Change log:
 #define PCIE8897_DEFAULT_WLAN_FW_NAME "nxp/pcie8897_wlan.bin"
 #endif /* PCIE8897*/
 
+#define PCIEUARTAW693_DEFAULT_COMBO_FW_NAME "nxp/pcieuartAW693_combo.bin"
+#define PCIEAW693_DEFAULT_COMBO_FW_NAME "nxp/pcieAW693_wlan.bin"
+#define PCIEAW693_DEFAULT_WLAN_FW_NAME "nxp/pcieAW693_wlan.bin"
+
 #ifdef PCIE9098
 #define PCIE9098_Z1Z2 0x00
 #define PCIE9098_A0 0x01
@@ -113,18 +120,14 @@ Change log:
 #define PCIE9097_WLAN_V1_FW_NAME "nxp/pcieiw620_wlan_v1.bin"
 #endif /* PCIE9097 */
 
-#ifdef PCIENW62X
-#define PCIENW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieusbnw62x_combo.bin"
-#define PCIEUARTNW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieuartnw62x_combo.bin"
-#define PCIEUSBNW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieusbnw62x_combo.bin"
-#define PCIENW62X_DEFAULT_WLAN_FW_NAME "nxp/pcienw62x_wlan.bin"
-#endif /* PCIENW62X */
+#ifdef PCIEIW62X
+#define PCIEIW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw62x_combo.bin"
+#define PCIEUARTIW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieuartiw62x_combo.bin"
+#define PCIEUSBIW62X_DEFAULT_COMBO_FW_NAME "nxp/pcieusbiw62x_combo.bin"
+#define PCIEIW62X_DEFAULT_WLAN_FW_NAME "nxp/pcieiw62x_wlan.bin"
+#endif /* PCIEIW62X */
 
-#if defined(PCIE9098) || defined(PCIE9097) || defined(PCIENW62X)
 #define PCIE_NUM_MSIX_VECTORS 32
-#else
-#define PCIE_NUM_MSIX_VECTORS 4
-#endif
 
 typedef struct _msix_context {
 	/** pci_dev structure pointer */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_priv.c b/mxm_wifiex/wlan_src/mlinux/moal_priv.c
index 56f0387..ce182ab 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_priv.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_priv.c
@@ -286,7 +286,6 @@ static int woal_get_signal(moal_private *priv, struct iwreq *wrq)
 			goto done;
 		}
 		/* Fall through */
-		fallthrough;
 	case 1: /* Check type range */
 		if (in_data[0] < 1 || in_data[0] > 3) {
 			ret = -EINVAL;
@@ -516,7 +515,7 @@ static int woal_deep_sleep_ioctl(moal_private *priv, struct iwreq *wrq)
  */
 static int woal_11n_htcap_cfg(moal_private *priv, struct iwreq *wrq)
 {
-	int data[2], copy_len;
+	int data[2] = {0}, copy_len;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
 	int ret = 0;
@@ -887,7 +886,7 @@ error:
  */
 static int woal_addba_reject(moal_private *priv, struct iwreq *wrq)
 {
-	int data[MAX_NUM_TID], ret = 0, i, copy_len;
+	int data[MAX_NUM_TID] = {0}, ret = 0, i, copy_len;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11n_cfg *cfg_11n = NULL;
 	int data_length = wrq->u.data.length;
@@ -1161,7 +1160,9 @@ static int woal_hs_cfg(moal_private *priv, struct iwreq *wrq,
 	if (data_length && (data[0] != (int)HOST_SLEEP_CFG_CANCEL ||
 			    invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+			PRINTM(MINFO, "Fail to get bss_info\n");
 		if (bss_info.is_hs_configured) {
 			PRINTM(MERROR, "HS already configured\n");
 			ret = -EFAULT;
@@ -1171,8 +1172,11 @@ static int woal_hs_cfg(moal_private *priv, struct iwreq *wrq,
 
 	/* Do a GET first if some arguments are not provided */
 	if (data_length >= 1 && data_length < 3) {
-		woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
-				       &hscfg);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
+					   &hscfg)) {
+			PRINTM(MERROR, "Unable to get HS params\n");
+		}
 	}
 
 	if (data_length)
@@ -1964,130 +1968,144 @@ static int woal_get_log(moal_private *priv, struct iwreq *wrq)
 	}
 
 	if (wrq->u.data.pointer) {
-		sprintf(buf,
-			"\n"
-			"mcasttxframe     %u\n"
-			"failed           %u\n"
-			"retry            %u\n"
-			"multiretry       %u\n"
-			"framedup         %u\n"
-			"rtssuccess       %u\n"
-			"rtsfailure       %u\n"
-			"ackfailure       %u\n"
-			"rxfrag           %u\n"
-			"mcastrxframe     %u\n"
-			"fcserror         %u\n"
-			"txframe          %u\n"
-			"wepicverrcnt-1   %u\n"
-			"wepicverrcnt-2   %u\n"
-			"wepicverrcnt-3   %u\n"
-			"wepicverrcnt-4   %u\n"
-			"beacon_rcnt      %u\n"
-			"beacon_mcnt      %u\n",
-			stats.mcast_tx_frame, stats.failed, stats.retry,
-			stats.multi_retry, stats.frame_dup, stats.rts_success,
-			stats.rts_failure, stats.ack_failure, stats.rx_frag,
-			stats.mcast_rx_frame, stats.fcs_error, stats.tx_frame,
-			stats.wep_icv_error[0], stats.wep_icv_error[1],
-			stats.wep_icv_error[2], stats.wep_icv_error[3],
-			stats.bcn_rcv_cnt, stats.bcn_miss_cnt);
+		snprintf(buf, GETLOG_BUFSIZE,
+			 "\n"
+			 "mcasttxframe     %u\n"
+			 "failed           %u\n"
+			 "retry            %u\n"
+			 "multiretry       %u\n"
+			 "framedup         %u\n"
+			 "rtssuccess       %u\n"
+			 "rtsfailure       %u\n"
+			 "ackfailure       %u\n"
+			 "rxfrag           %u\n"
+			 "mcastrxframe     %u\n"
+			 "fcserror         %u\n"
+			 "txframe          %u\n"
+			 "wepicverrcnt-1   %u\n"
+			 "wepicverrcnt-2   %u\n"
+			 "wepicverrcnt-3   %u\n"
+			 "wepicverrcnt-4   %u\n"
+			 "beacon_rcnt      %u\n"
+			 "beacon_mcnt      %u\n",
+			 stats.mcast_tx_frame, stats.failed, stats.retry,
+			 stats.multi_retry, stats.frame_dup, stats.rts_success,
+			 stats.rts_failure, stats.ack_failure, stats.rx_frag,
+			 stats.mcast_rx_frame, stats.fcs_error, stats.tx_frame,
+			 stats.wep_icv_error[0], stats.wep_icv_error[1],
+			 stats.wep_icv_error[2], stats.wep_icv_error[3],
+			 stats.bcn_rcv_cnt, stats.bcn_miss_cnt);
 		if (priv->phandle->fw_getlog_enable) {
-			sprintf(buf + strlen(buf), "tx_frag_cnt       %u\n",
-				stats.tx_frag_cnt);
-			sprintf(buf + strlen(buf), "qos_tx_frag_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "tx_frag_cnt       %u\n", stats.tx_frag_cnt);
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "qos_tx_frag_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_tx_frag_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_tx_frag_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_failed_cnt         ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_failed_cnt         ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_failed_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_failed_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_retry_cnt          ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_retry_cnt          ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_retry_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_retry_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_multi_retry_cnt    ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_multi_retry_cnt    ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_multi_retry_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_multi_retry_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_frm_dup_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_frm_dup_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_frm_dup_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_frm_dup_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_rts_suc_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_rts_suc_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_rts_suc_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_rts_suc_cnt[i]);
 			}
-			sprintf(buf + strlen(buf),
-				"\nqos_rts_failure_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_rts_failure_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_rts_failure_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_rts_failure_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_ack_failure_cnt    ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_ack_failure_cnt    ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_ack_failure_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_ack_failure_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_rx_frag_cnt        ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_rx_frag_cnt        ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_rx_frag_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_rx_frag_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_tx_frm_cnt         ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_tx_frm_cnt         ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_tx_frm_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_tx_frm_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_discarded_frm_cnt  ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_discarded_frm_cnt  ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_discarded_frm_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_discarded_frm_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_mpdus_rx_cnt       ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_mpdus_rx_cnt       ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_mpdus_rx_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_mpdus_rx_cnt[i]);
 			}
-			sprintf(buf + strlen(buf), "\nqos_retries_rx_cnt     ");
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nqos_retries_rx_cnt     ");
 			for (i = 0; i < 8; i++) {
-				sprintf(buf + strlen(buf), "%u ",
-					stats.qos_retries_rx_cnt[i]);
+				snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+					 "%u ", stats.qos_retries_rx_cnt[i]);
 			}
-			sprintf(buf + strlen(buf),
-				"\nmgmt_ccmp_replays      %u\n"
-				"tx_amsdu_cnt           %u\n"
-				"failed_amsdu_cnt       %u\n"
-				"retry_amsdu_cnt        %u\n"
-				"multi_retry_amsdu_cnt  %u\n"
-				"tx_octets_in_amsdu_cnt %llu\n"
-				"amsdu_ack_failure_cnt  %u\n"
-				"rx_amsdu_cnt           %u\n"
-				"rx_octets_in_amsdu_cnt %llu\n"
-				"tx_ampdu_cnt           %u\n"
-				"tx_mpdus_in_ampdu_cnt  %u\n"
-				"tx_octets_in_ampdu_cnt %llu\n"
-				"ampdu_rx_cnt           %u\n"
-				"mpdu_in_rx_ampdu_cnt   %u\n"
-				"rx_octets_in_ampdu_cnt %llu\n"
-				"ampdu_delimiter_crc_error_cnt      %u\n",
-				stats.mgmt_ccmp_replays, stats.tx_amsdu_cnt,
-				stats.failed_amsdu_cnt, stats.retry_amsdu_cnt,
-				stats.multi_retry_amsdu_cnt,
-				stats.tx_octets_in_amsdu_cnt,
-				stats.amsdu_ack_failure_cnt, stats.rx_amsdu_cnt,
-				stats.rx_octets_in_amsdu_cnt,
-				stats.tx_ampdu_cnt, stats.tx_mpdus_in_ampdu_cnt,
-				stats.tx_octets_in_ampdu_cnt,
-				stats.ampdu_rx_cnt, stats.mpdu_in_rx_ampdu_cnt,
-				stats.rx_octets_in_ampdu_cnt,
-				stats.ampdu_delimiter_crc_error_cnt);
+			snprintf(buf + strlen(buf), GETLOG_BUFSIZE,
+				 "\nmgmt_ccmp_replays      %u\n"
+				 "tx_amsdu_cnt           %u\n"
+				 "failed_amsdu_cnt       %u\n"
+				 "retry_amsdu_cnt        %u\n"
+				 "multi_retry_amsdu_cnt  %u\n"
+				 "tx_octets_in_amsdu_cnt %llu\n"
+				 "amsdu_ack_failure_cnt  %u\n"
+				 "rx_amsdu_cnt           %u\n"
+				 "rx_octets_in_amsdu_cnt %llu\n"
+				 "tx_ampdu_cnt           %u\n"
+				 "tx_mpdus_in_ampdu_cnt  %u\n"
+				 "tx_octets_in_ampdu_cnt %llu\n"
+				 "ampdu_rx_cnt           %u\n"
+				 "mpdu_in_rx_ampdu_cnt   %u\n"
+				 "rx_octets_in_ampdu_cnt %llu\n"
+				 "ampdu_delimiter_crc_error_cnt      %u\n",
+				 stats.mgmt_ccmp_replays, stats.tx_amsdu_cnt,
+				 stats.failed_amsdu_cnt, stats.retry_amsdu_cnt,
+				 stats.multi_retry_amsdu_cnt,
+				 stats.tx_octets_in_amsdu_cnt,
+				 stats.amsdu_ack_failure_cnt,
+				 stats.rx_amsdu_cnt,
+				 stats.rx_octets_in_amsdu_cnt,
+				 stats.tx_ampdu_cnt,
+				 stats.tx_mpdus_in_ampdu_cnt,
+				 stats.tx_octets_in_ampdu_cnt,
+				 stats.ampdu_rx_cnt, stats.mpdu_in_rx_ampdu_cnt,
+				 stats.rx_octets_in_ampdu_cnt,
+				 stats.ampdu_delimiter_crc_error_cnt);
 		}
 		wrq->u.data.length = MIN(GETLOG_BUFSIZE - 1, strlen(buf) + 1);
 		if (copy_to_user(wrq->u.data.pointer, buf,
@@ -2165,8 +2183,9 @@ static int woal_tx_power_cfg(moal_private *priv, struct iwreq *wrq)
 	ENTER();
 
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
-
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+		PRINTM(MINFO, "Fail to get bss_info\n");
 	memset(data, 0, sizeof(data));
 	user_data_len = wrq->u.data.length;
 	copy_len = MIN(sizeof(data), sizeof(int) * user_data_len);
@@ -2687,7 +2706,9 @@ static int woal_set_get_radio(moal_private *priv, struct iwreq *wrq)
 			ret = -EFAULT;
 	} else {
 		/* Get radio status */
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info))
+			PRINTM(MINFO, "Fail to get bss_info\n");
 		wrq->u.data.length = 1;
 		if (copy_to_user(wrq->u.data.pointer, &bss_info.radio_on,
 				 sizeof(bss_info.radio_on))) {
@@ -3826,33 +3847,35 @@ static int woal_passphrase(moal_private *priv, struct iwreq *wrq)
 	if (action == 0) {
 		memset(buf, 0, sizeof(buf));
 		if (sec->param.passphrase.ssid.ssid_len) {
-			len += sprintf(buf + len, "ssid:");
+			len += snprintf(buf + len, sizeof(buf), "ssid:");
 			moal_memcpy_ext(priv->phandle, buf + len,
 					sec->param.passphrase.ssid.ssid,
 					sec->param.passphrase.ssid.ssid_len,
 					sizeof(buf) - len);
 			len += sec->param.passphrase.ssid.ssid_len;
-			len += sprintf(buf + len, " ");
+			len += snprintf(buf + len, sizeof(buf), " ");
 		}
 		if (memcmp(&sec->param.passphrase.bssid, zero_mac,
 			   sizeof(zero_mac))) {
 			mac = (t_u8 *)&sec->param.passphrase.bssid;
-			len += sprintf(buf + len, "bssid:");
+			len += snprintf(buf + len, sizeof(buf), "bssid:");
 			for (i = 0; i < ETH_ALEN - 1; ++i)
-				len += sprintf(buf + len, "%02x:", mac[i]);
-			len += sprintf(buf + len, "%02x ", mac[i]);
+				len += snprintf(buf + len, sizeof(buf),
+						"%02x:", mac[i]);
+			len += snprintf(buf + len, sizeof(buf), "%02x ",
+					mac[i]);
 		}
 		if (sec->param.passphrase.psk_type == MLAN_PSK_PMK) {
-			len += sprintf(buf + len, "psk:");
+			len += snprintf(buf + len, sizeof(buf), "psk:");
 			for (i = 0; i < MLAN_MAX_KEY_LENGTH; ++i)
-				len += sprintf(
-					buf + len, "%02x",
+				len += snprintf(
+					buf + len, sizeof(buf), "%02x",
 					sec->param.passphrase.psk.pmk.pmk[i]);
-			len += sprintf(buf + len, "\n");
+			len += snprintf(buf + len, sizeof(buf), "\n");
 		}
 		if (sec->param.passphrase.psk_type == MLAN_PSK_PASSPHRASE) {
-			len += sprintf(
-				buf + len, "passphrase:%s\n",
+			len += snprintf(
+				buf + len, sizeof(buf), "passphrase:%s\n",
 				sec->param.passphrase.psk.passphrase.passphrase);
 		}
 		if (wrq->u.data.pointer) {
@@ -3972,11 +3995,11 @@ static int woal_get_key_ioctl(moal_private *priv, struct iwreq *wrq)
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "PTK: ");
+		snprintf((char *)tmp, sizeof(key_ascii), "\n%s", "PTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, sizeof(key_ascii), "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get Multicase Key */
@@ -3993,11 +4016,11 @@ static int woal_get_key_ioctl(moal_private *priv, struct iwreq *wrq)
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "GTK: ");
+		snprintf((char *)tmp, sizeof(key_ascii), "\n%s", "GTK: ");
 		tmp += 5;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, sizeof(key_ascii), "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	/* Get IGTK Key */
@@ -4014,11 +4037,11 @@ static int woal_get_key_ioctl(moal_private *priv, struct iwreq *wrq)
 		goto done;
 	}
 	if (sec->param.encrypt_key.key_len) {
-		sprintf((char *)tmp, "\n%s", "IGTK: ");
+		snprintf((char *)tmp, sizeof(key_ascii), "\n%s", "IGTK: ");
 		tmp += 6;
 		for (i = 0; i < sec->param.encrypt_key.key_len; i++)
-			tmp += sprintf((char *)tmp, "%02x",
-				       sec->param.encrypt_key.key_material[i]);
+			tmp += snprintf((char *)tmp, sizeof(key_ascii), "%02x",
+					sec->param.encrypt_key.key_material[i]);
 	}
 
 	wrq->u.data.length = sizeof(key_ascii) + 1;
@@ -4336,7 +4359,7 @@ static int woal_tx_bf_cfg_ioctl(moal_private *priv, struct iwreq *wrq)
 						*token = '\0';
 						str = token + 1;
 					}
-					woal_atoi(&tmp_val, pos);
+					(void)woal_atoi(&tmp_val, pos);
 					switch (i) {
 					case BF_ENABLE_PARAM:
 						bf_global->bf_enbl =
@@ -4433,11 +4456,11 @@ static int woal_tx_bf_cfg_ioctl(moal_private *priv, struct iwreq *wrq)
 				bf_cfg.action = BF_CFG_ACT_GET;
 			} else {
 				woal_mac2u8(tx_bf_peer->peer_mac, &buf[2]);
-				woal_atoi(&tmp_val, &buf[20]);
+				(void)woal_atoi(&tmp_val, &buf[20]);
 				tx_bf_peer->bf_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[22]);
+				(void)woal_atoi(&tmp_val, &buf[22]);
 				tx_bf_peer->sounding_enbl = (t_u8)tmp_val;
-				woal_atoi(&tmp_val, &buf[24]);
+				(void)woal_atoi(&tmp_val, &buf[24]);
 				tx_bf_peer->fb_type = (t_u8)tmp_val;
 				action = MLAN_ACT_SET;
 				bf_cfg.action = BF_CFG_ACT_SET;
@@ -4492,73 +4515,89 @@ static int woal_tx_bf_cfg_ioctl(moal_private *priv, struct iwreq *wrq)
 		memset(buf, 0, sizeof(buf));
 		switch (bf_action) {
 		case BF_GLOBAL_CONFIGURATION:
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->bf_enbl);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->sounding_enbl);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->fb_type);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->snr_threshold);
 			data_length +=
-				sprintf(buf + data_length, "%d ",
-					(int)bf_global->sounding_interval);
-			data_length += sprintf(buf + data_length, "%d ",
-					       (int)bf_global->bf_mode);
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->bf_enbl);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->sounding_enbl);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->fb_type);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->snr_threshold);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ",
+					 (int)bf_global->sounding_interval);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d ", (int)bf_global->bf_mode);
 			break;
 		case SET_GET_BF_PERIODICITY:
-			data_length += sprintf(buf + data_length,
-					       "%02x:%02x:%02x:%02x:%02x:%02x",
-					       bf_periodicity->peer_mac[0],
-					       bf_periodicity->peer_mac[1],
-					       bf_periodicity->peer_mac[2],
-					       bf_periodicity->peer_mac[3],
-					       bf_periodicity->peer_mac[4],
-					       bf_periodicity->peer_mac[5]);
-			data_length += sprintf(buf + data_length, "%c", ' ');
-			data_length += sprintf(buf + data_length, "%d",
-					       bf_periodicity->interval);
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%02x:%02x:%02x:%02x:%02x:%02x",
+					 bf_periodicity->peer_mac[0],
+					 bf_periodicity->peer_mac[1],
+					 bf_periodicity->peer_mac[2],
+					 bf_periodicity->peer_mac[3],
+					 bf_periodicity->peer_mac[4],
+					 bf_periodicity->peer_mac[5]);
+			data_length += snprintf(buf + data_length,
+						MAX_IN_OUT_CHAR, "%c", ' ');
+			data_length +=
+				snprintf(buf + data_length, MAX_IN_OUT_CHAR,
+					 "%d", bf_periodicity->interval);
 			break;
 		case TX_BF_FOR_PEER_ENBL:
 			for (i = 0; i < (int)bf_cfg.no_of_peers; i++) {
+				data_length += snprintf(
+					buf + data_length, MAX_IN_OUT_CHAR,
+					"%02x:%02x:%02x:%02x:%02x:%02x",
+					tx_bf_peer->peer_mac[0],
+					tx_bf_peer->peer_mac[1],
+					tx_bf_peer->peer_mac[2],
+					tx_bf_peer->peer_mac[3],
+					tx_bf_peer->peer_mac[4],
+					tx_bf_peer->peer_mac[5]);
 				data_length +=
-					sprintf(buf + data_length,
-						"%02x:%02x:%02x:%02x:%02x:%02x",
-						tx_bf_peer->peer_mac[0],
-						tx_bf_peer->peer_mac[1],
-						tx_bf_peer->peer_mac[2],
-						tx_bf_peer->peer_mac[3],
-						tx_bf_peer->peer_mac[4],
-						tx_bf_peer->peer_mac[5]);
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%c", ' ');
+				data_length += snprintf(buf + data_length,
+							MAX_IN_OUT_CHAR, "%d;",
+							tx_bf_peer->bf_enbl);
 				data_length +=
-					sprintf(buf + data_length, "%c", ' ');
-				data_length += sprintf(buf + data_length, "%d;",
-						       tx_bf_peer->bf_enbl);
-				data_length +=
-					sprintf(buf + data_length, "%d;",
-						tx_bf_peer->sounding_enbl);
-				data_length += sprintf(buf + data_length, "%d ",
-						       tx_bf_peer->fb_type);
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%d;",
+						 tx_bf_peer->sounding_enbl);
+				data_length += snprintf(buf + data_length,
+							MAX_IN_OUT_CHAR, "%d ",
+							tx_bf_peer->fb_type);
 				tx_bf_peer++;
 			}
 			break;
 		case SET_SNR_THR_PEER:
 			for (i = 0; i < (int)bf_cfg.no_of_peers; i++) {
+				data_length += snprintf(
+					buf + data_length, MAX_IN_OUT_CHAR,
+					"%02x:%02x:%02x:%02x:%02x:%02x",
+					bf_snr->peer_mac[0],
+					bf_snr->peer_mac[1],
+					bf_snr->peer_mac[2],
+					bf_snr->peer_mac[3],
+					bf_snr->peer_mac[4],
+					bf_snr->peer_mac[5]);
 				data_length +=
-					sprintf(buf + data_length,
-						"%02x:%02x:%02x:%02x:%02x:%02x",
-						bf_snr->peer_mac[0],
-						bf_snr->peer_mac[1],
-						bf_snr->peer_mac[2],
-						bf_snr->peer_mac[3],
-						bf_snr->peer_mac[4],
-						bf_snr->peer_mac[5]);
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%c", ';');
+				data_length += snprintf(buf + data_length,
+							MAX_IN_OUT_CHAR, "%d",
+							bf_snr->snr);
 				data_length +=
-					sprintf(buf + data_length, "%c", ';');
-				data_length += sprintf(buf + data_length, "%d",
-						       bf_snr->snr);
-				data_length +=
-					sprintf(buf + data_length, "%c", ' ');
+					snprintf(buf + data_length,
+						 MAX_IN_OUT_CHAR, "%c", ' ');
 				bf_snr++;
 			}
 			break;
@@ -5138,23 +5177,18 @@ static int woal_do_sdio_mpa_ctrl(moal_private *priv, struct iwreq *wrq)
 	case 6:
 		misc->param.mpa_ctrl.rx_max_ports = data[5];
 		/* fall through */
-		fallthrough;
 	case 5:
 		misc->param.mpa_ctrl.tx_max_ports = data[4];
 		/* fall through */
-		fallthrough;
 	case 4:
 		misc->param.mpa_ctrl.rx_buf_size = data[3];
 		/* fall through */
-		fallthrough;
 	case 3:
 		misc->param.mpa_ctrl.tx_buf_size = data[2];
 		/* fall through */
-		fallthrough;
 	case 2:
 		misc->param.mpa_ctrl.rx_enable = data[1];
 		/* fall through */
-		fallthrough;
 	case 1:
 		/* Set cmd */
 		req->action = MLAN_ACT_SET;
@@ -6101,7 +6135,7 @@ static int woal_dfs_testing(moal_private *priv, struct iwreq *wrq)
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11h_cfg *ds_11hcfg = NULL;
 	int ret = 0;
-	int data[4], copy_len;
+	int data[4] = {0}, copy_len;
 	int data_length = wrq->u.data.length;
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	ENTER();
@@ -6264,7 +6298,7 @@ done:
 static int woal_cfp_code(moal_private *priv, struct iwreq *wrq)
 {
 	int ret = 0;
-	int data[2], copy_len;
+	int data[2] = {0}, copy_len;
 	int data_length = wrq->u.data.length;
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_misc_cfg *misc_cfg = NULL;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_proc.c b/mxm_wifiex/wlan_src/mlinux/moal_proc.c
index 8cff3c5..93f9708 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_proc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_proc.c
@@ -565,7 +565,8 @@ mlan_status woal_priv_set_tx_rx_ant(moal_handle *handle, char *line)
 			radio->param.ant_cfg.rx_antenna = data[1];
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		if (IS_CARD9098(priv->phandle->card_type) ||
-		    IS_CARD9097(priv->phandle->card_type)) {
+		    IS_CARD9097(priv->phandle->card_type) ||
+		    IS_CARDIW62X(priv->phandle->card_type)) {
 			woal_cfg80211_notify_antcfg(priv, priv->phandle->wiphy,
 						    radio);
 		}
@@ -597,6 +598,7 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 {
 	char databuf[200];
 	char *line = NULL;
+	int ret = 0;
 	t_u32 config_data = 0;
 	struct seq_file *sfp = f->private_data;
 	moal_handle *handle = (moal_handle *)sfp->private;
@@ -706,7 +708,7 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 			config_data = FW_RELOAD_SDIO_INBAND_RESET;
 #endif
 		PRINTM(MMSG, "Request fw_reload=%d\n", config_data);
-		woal_request_fw_reload(handle, config_data);
+		ret = woal_request_fw_reload(handle, config_data);
 	}
 	if (!strncmp(databuf, "drop_point=", strlen("drop_point="))) {
 		line += strlen("drop_point") + 1;
@@ -814,6 +816,8 @@ static ssize_t woal_config_write(struct file *f, const char __user *buf,
 
 	MODULE_PUT;
 	LEAVE();
+	if (ret < 0)
+		return ret;
 	return (int)count;
 }
 
@@ -844,8 +848,8 @@ static int woal_config_read(struct seq_file *sfp, void *data)
 	seq_printf(sfp, "drv_mode=%d\n", (int)handle->params.drv_mode);
 	if (priv) {
 		memset(&hscfg, 0, sizeof(mlan_ds_hs_cfg));
-		woal_set_get_hs_params(priv, MLAN_ACT_GET, MOAL_IOCTL_WAIT,
-				       &hscfg);
+		(void)woal_set_get_hs_params(priv, MLAN_ACT_GET,
+					     MOAL_IOCTL_WAIT, &hscfg);
 		seq_printf(sfp, "hssetpara=%d,0x%x,%d,%d\n", hscfg.conditions,
 			   hscfg.gpio, hscfg.gap, hscfg.hs_wake_interval);
 	}
@@ -1426,7 +1430,7 @@ void woal_proc_init(moal_handle *handle)
 		goto done;
 	}
 
-	strcpy(config_proc_dir, "config");
+	strncpy(config_proc_dir, "config", sizeof(config_proc_dir));
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 	r = proc_create_data(config_proc_dir, 0666, handle->proc_wlan,
 			     &config_proc_fops, handle);
@@ -1440,7 +1444,7 @@ void woal_proc_init(moal_handle *handle)
 	if (!r)
 		PRINTM(MERROR, "Fail to create proc config\n");
 
-	strcpy(drv_dump_dir, "drv_dump");
+	strncpy(drv_dump_dir, "drv_dump", sizeof(drv_dump_dir));
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 	r = proc_create_data(drv_dump_dir, 0644, handle->proc_wlan,
 			     &drv_dump_fops, handle);
@@ -1454,7 +1458,7 @@ void woal_proc_init(moal_handle *handle)
 	if (!r)
 		PRINTM(MERROR, "Failed to create proc drv dump\n");
 
-	strcpy(fw_dump_dir, "fw_dump");
+	strncpy(fw_dump_dir, "fw_dump", sizeof(fw_dump_dir));
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 	r = proc_create_data(fw_dump_dir, 0644, handle->proc_wlan,
 			     &fw_dump_fops, handle);
@@ -1489,11 +1493,11 @@ void woal_proc_exit(moal_handle *handle)
 
 	PRINTM(MINFO, "Remove Proc Interface %s\n", handle->proc_wlan_name);
 	if (handle->proc_wlan) {
-		strcpy(config_proc_dir, "config");
+		strncpy(config_proc_dir, "config", sizeof(config_proc_dir));
 		remove_proc_entry(config_proc_dir, handle->proc_wlan);
-		strcpy(drv_dump_dir, "drv_dump");
+		strncpy(drv_dump_dir, "drv_dump", sizeof(drv_dump_dir));
 		remove_proc_entry(drv_dump_dir, handle->proc_wlan);
-		strcpy(fw_dump_dir, "fw_dump");
+		strncpy(fw_dump_dir, "fw_dump", sizeof(fw_dump_dir));
 		remove_proc_entry(fw_dump_dir, handle->proc_wlan);
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
@@ -1556,7 +1560,7 @@ void woal_create_proc_entry(moal_private *priv)
 			LEAVE();
 			return;
 		}
-		strcat(proc_dir_name, dev->name);
+		strncat(proc_dir_name, dev->name, sizeof(proc_dir_name) - 1);
 		/* Try to create adapterX/dev_name directory first under
 		 * /proc/mwlan/ */
 		priv->proc_entry = proc_mkdir(proc_dir_name, proc_mwlan);
@@ -1595,7 +1599,7 @@ void woal_create_proc_entry(moal_private *priv)
 		atomic_inc(&(priv->phandle->proc_wlan->count));
 #endif /* < 3.10.0 */
 #endif /* < 2.6.26 */
-		strcpy(priv->proc_entry_name, dev->name);
+		strncpy(priv->proc_entry_name, dev->name, IFNAMSIZ);
 		if (priv->proc_entry) {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
 			r = proc_create_data("info", 0, priv->proc_entry,
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sdio.h b/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
index 139a45e..550d56b 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio.h
@@ -139,12 +139,17 @@ Change log:
 #define SD9097_WLAN_V1_FW_NAME "nxp/sdiw620_wlan_v1.bin"
 #endif /* SD9097 */
 
-#ifdef SDNW62X
-#define SDNW62X_DEFAULT_COMBO_FW_NAME "nxp/sdsd_nw62x.bin"
-#define SDUARTNW62X_COMBO_FW_NAME "nxp/sduart_nw62x.bin"
-#define SDSDNW62X_COMBO_FW_NAME "sdsd_nw62x.bin"
-#define SDNW62X_DEFAULT_WLAN_FW_NAME "nxp/sd_nw62x.bin"
-#endif /* SDNW62X */
+#ifdef SDIW62X
+#define SDIW62X_DEFAULT_COMBO_FW_NAME "nxp/sdsd_iw62x.bin"
+#define SDUARTIW62X_COMBO_FW_NAME "nxp/sduart_iw62x.bin"
+#define SDSDIW62X_COMBO_FW_NAME "sdsd_iw62x.bin"
+#define SDIW62X_DEFAULT_WLAN_FW_NAME "nxp/sd_iw62x.bin"
+#endif /* SDIW62X */
+
+#define SDAW693_DEFAULT_COMBO_FW_NAME "nxp/sdsd_aw693.bin"
+#define SDUARTAW693_COMBO_FW_NAME "nxp/sduart_aw693.bin"
+#define SDSDAW693_COMBO_FW_NAME "sdsd_aw693.bin"
+#define SDAW693_DEFAULT_WLAN_FW_NAME "nxp/sd_aw693.bin"
 
 #ifdef SD9177
 #define SD9177_A0 0x00
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
index 28b1267..077dcf0 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c
@@ -71,6 +71,10 @@ static moal_if_ops sdiommc_ops;
 /** Device ID for SD8987 */
 #define SD_DEVICE_ID_8987 (0x9149)
 #endif
+/** Device ID for SDAW693 */
+#define SD_DEVICE_ID_AW693_FN1 (0x0211)
+/** Device ID for SDAW693 */
+#define SD_DEVICE_ID_AW693_FN2 (0x0212)
 #ifdef SD9098
 /** Device ID for SD9098 */
 #define SD_DEVICE_ID_9098_FN1 (0x914D)
@@ -85,9 +89,9 @@ static moal_if_ops sdiommc_ops;
 /** Device ID for SD9177 */
 #define SD_DEVICE_ID_9177 (0x0205)
 #endif
-#ifdef SDNW62X
-/** Device ID for SDNW62X */
-#define SD_DEVICE_ID_NW62X (0x020D)
+#ifdef SDIW62X
+/** Device ID for SDIW62X */
+#define SD_DEVICE_ID_IW62X (0x020D)
 #endif
 
 /** WLAN IDs */
@@ -113,6 +117,8 @@ static const struct sdio_device_id wlan_ids[] = {
 #ifdef SD8987
 	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_8987)},
 #endif
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_AW693_FN1)},
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_AW693_FN2)},
 #ifdef SD9098
 	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN1)},
 	{SDIO_DEVICE(MRVL_VENDOR_ID, SD_DEVICE_ID_9098_FN2)},
@@ -123,12 +129,14 @@ static const struct sdio_device_id wlan_ids[] = {
 #ifdef SD9177
 	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_9177)},
 #endif
-#ifdef SDNW62X
-	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_NW62X)},
+#ifdef SDIW62X
+	{SDIO_DEVICE(NXP_VENDOR_ID, SD_DEVICE_ID_IW62X)},
 #endif
 	{},
 };
 
+MODULE_DEVICE_TABLE(sdio, wlan_ids);
+
 int woal_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id);
 void woal_sdio_remove(struct sdio_func *func);
 #ifdef SDIO
@@ -390,11 +398,25 @@ static t_u16 woal_update_card_type(t_void *card)
 				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
 	}
 #endif
-#ifdef SDNW62X
-	if (cardp_sd->func->device == SD_DEVICE_ID_NW62X) {
-		card_type = CARD_TYPE_SDNW62X;
-		moal_memcpy_ext(NULL, driver_version, CARD_SDNW62X,
-				strlen(CARD_SDNW62X), strlen(driver_version));
+#ifdef SDIW62X
+	if (cardp_sd->func->device == SD_DEVICE_ID_IW62X) {
+		card_type = CARD_TYPE_SDIW62X;
+		moal_memcpy_ext(NULL, driver_version, CARD_SDIW62X,
+				strlen(CARD_SDIW62X), strlen(driver_version));
+		moal_memcpy_ext(
+			NULL,
+			driver_version + strlen(INTF_CARDTYPE) +
+				strlen(KERN_VERSION),
+			V18, strlen(V18),
+			strlen(driver_version) -
+				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
+	}
+#endif
+	if (cardp_sd->func->device == SD_DEVICE_ID_AW693_FN1 ||
+	    cardp_sd->func->device == SD_DEVICE_ID_AW693_FN2) {
+		card_type = CARD_TYPE_SDAW693;
+		moal_memcpy_ext(NULL, driver_version, CARD_SDAW693,
+				strlen(CARD_SDAW693), strlen(driver_version));
 		moal_memcpy_ext(
 			NULL,
 			driver_version + strlen(INTF_CARDTYPE) +
@@ -403,7 +425,6 @@ static t_u16 woal_update_card_type(t_void *card)
 			strlen(driver_version) -
 				(strlen(INTF_CARDTYPE) + strlen(KERN_VERSION)));
 	}
-#endif
 #ifdef SD9097
 	if (cardp_sd->func->device == SD_DEVICE_ID_9097) {
 		card_type = CARD_TYPE_SD9097;
@@ -1346,8 +1367,11 @@ int woal_sdio_read_write_cmd52(moal_handle *handle, int func, int reg, int val)
  */
 static t_u8 woal_sdiommc_is_second_mac(moal_handle *handle)
 {
-#ifdef SD9098
 	struct sdio_mmc_card *card = (struct sdio_mmc_card *)handle->card;
+
+	if (card->func->device == SD_DEVICE_ID_AW693_FN2)
+		return MTRUE;
+#ifdef SD9098
 	if (card->func->device == SD_DEVICE_ID_9098_FN2)
 		return MTRUE;
 #endif
@@ -1363,14 +1387,10 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 	t_u32 revision_id = 0;
 	t_u32 rev_id_reg = handle->card_info->rev_id_reg;
 
-#if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
-	defined(SD9097) || defined(SDNW62X) || defined(SD8978) ||              \
-	defined(SD9177)
 	t_u32 magic_reg = handle->card_info->magic_reg;
 	t_u32 magic = 0;
 	t_u32 host_strap_reg = handle->card_info->host_strap_reg;
 	t_u32 strap = 0;
-#endif
 
 	ENTER();
 
@@ -1384,9 +1404,6 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 	woal_sdiommc_read_reg(handle, rev_id_reg, &revision_id);
 	PRINTM(MCMND, "revision_id=0x%x\n", revision_id);
 
-#if defined(SD8987) || defined(SD8997) || defined(SD9098) ||                   \
-	defined(SD9097) || defined(SDNW62X) || defined(SD8978) ||              \
-	defined(SD9177)
 	/** Revision ID register */
 	woal_sdiommc_read_reg(handle, magic_reg, &magic);
 	/** Revision ID register */
@@ -1395,24 +1412,26 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 	magic &= 0xFF;
 	/* 1 = SDSD, 0 --SD UART */
 	PRINTM(MCMND, "magic=0x%x strap=0x%x\n", magic, strap);
-#endif
 #if defined(SD8977)
 	if (IS_SD8977(handle->card_type)) {
 		switch (revision_id) {
 		case SD8977_V0:
-			strcpy(handle->card_info->fw_name, SD8977_V0_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8977_WLAN_V0_FW_NAME);
+			strncpy(handle->card_info->fw_name, SD8977_V0_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8977_WLAN_V0_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		case SD8977_V1:
-			strcpy(handle->card_info->fw_name, SD8977_V1_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8977_WLAN_V1_FW_NAME);
+			strncpy(handle->card_info->fw_name, SD8977_V1_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8977_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		case SD8977_V2:
-			strcpy(handle->card_info->fw_name, SD8977_V2_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8977_WLAN_V2_FW_NAME);
+			strncpy(handle->card_info->fw_name, SD8977_V2_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8977_WLAN_V2_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		default:
 			break;
@@ -1424,14 +1443,16 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 		/* Check revision ID */
 		switch (revision_id) {
 		case SD8887_A0:
-			strcpy(handle->card_info->fw_name, SD8887_A0_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8887_WLAN_A0_FW_NAME);
+			strncpy(handle->card_info->fw_name, SD8887_A0_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8887_WLAN_A0_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		case SD8887_A2:
-			strcpy(handle->card_info->fw_name, SD8887_A2_FW_NAME);
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD8887_WLAN_A2_FW_NAME);
+			strncpy(handle->card_info->fw_name, SD8887_A2_FW_NAME,
+				FW_NAMW_MAX_LEN);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD8887_WLAN_A2_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		default:
 			break;
@@ -1443,11 +1464,13 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 	if (IS_SD8997(handle->card_type)) {
 		if (magic == CHIP_MAGIC_VALUE) {
 			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUART8997_DEFAULT_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDUART8997_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 			else
-				strcpy(handle->card_info->fw_name,
-				       SDSD8997_DEFAULT_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDSD8997_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 		}
 	}
 #endif
@@ -1456,11 +1479,13 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 	if (IS_SD8987(handle->card_type)) {
 		if (magic == CHIP_MAGIC_VALUE) {
 			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUART8987_DEFAULT_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDUART8987_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 			else
-				strcpy(handle->card_info->fw_name,
-				       SDSD8987_DEFAULT_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDSD8987_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 		}
 	}
 #endif
@@ -1469,11 +1494,13 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 	if (IS_SD8978(handle->card_type)) {
 		if (magic == CHIP_MAGIC_VALUE) {
 			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUART8978_DEFAULT_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDUART8978_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 			else
-				strcpy(handle->card_info->fw_name,
-				       SDSD8978_DEFAULT_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDSD8978_DEFAULT_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 		}
 	}
 #endif
@@ -1485,28 +1512,32 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 		case SD9098_Z1Z2:
 			if (magic == CHIP_MAGIC_VALUE) {
 				if (strap == CARD_TYPE_SD_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9098_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDUART9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9098_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDSD9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9098_DEFAULT_WLAN_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9098_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		case SD9098_A0:
 		case SD9098_A1:
 		case SD9098_A2:
 			if (magic == CHIP_MAGIC_VALUE) {
 				if (strap == CARD_TYPE_SD_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9098_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDUART9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9098_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDSD9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9098_WLAN_V1_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9098_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		default:
 			break;
@@ -1520,31 +1551,47 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 		case SD9097_B1:
 			if (magic == CHIP_MAGIC_VALUE) {
 				if (strap == CARD_TYPE_SD_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9097_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDUART9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9097_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDSD9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9097_WLAN_V1_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9097_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		default:
 			break;
 		}
 	}
 #endif
-#ifdef SDNW62X
-	if (IS_SDNW62X(handle->card_type)) {
+	if (IS_SDAW693(handle->card_type)) {
 		if (magic == CHIP_MAGIC_VALUE) {
 			if (strap == CARD_TYPE_SD_UART)
-				strcpy(handle->card_info->fw_name,
-				       SDUARTNW62X_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDUARTAW693_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 			else
-				strcpy(handle->card_info->fw_name,
-				       SDSDNW62X_COMBO_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SDSDAW693_COMBO_FW_NAME,
+					FW_NAMW_MAX_LEN);
 		}
 	}
+
+#ifdef SDIW62X
+	if (IS_SDIW62X(handle->card_type)) {
+		magic &= 0x03;
+		if (magic == 0x03)
+			PRINTM(MMSG, "wlan: SDIW62X in secure-boot mode\n");
+		if (strap == CARD_TYPE_SD_UART)
+			strncpy(handle->card_info->fw_name,
+				SDUARTIW62X_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
+		else
+			strncpy(handle->card_info->fw_name,
+				SDSDIW62X_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
+	}
 #endif
 
 #ifdef SD9177
@@ -1553,43 +1600,51 @@ static mlan_status woal_sdiommc_get_fw_name(moal_handle *handle)
 		case SD9177_A0:
 			if (magic == CHIP_MAGIC_VALUE) {
 				if (strap == CARD_TYPE_SD9177_UART)
-					strcpy(handle->card_info->fw_name,
-					       SDUART9177_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDUART9177_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       SDSD9177_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						SDSD9177_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       SD9177_DEFAULT_WLAN_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				SD9177_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		case SD9177_A1:
 			if (magic == CHIP_MAGIC_VALUE) {
 				if (strap == CARD_TYPE_SD9177_UART) {
 					if (handle->params.rf_test_mode)
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME);
+						strncpy(handle->card_info
+								->fw_name,
+							SDUART9177_DEFAULT_RFTM_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
 					else
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDUART9177_DEFAULT_COMBO_V1_FW_NAME);
+						strncpy(handle->card_info
+								->fw_name,
+							SDUART9177_DEFAULT_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
 				} else {
 					if (handle->params.rf_test_mode)
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME);
+						strncpy(handle->card_info
+								->fw_name,
+							SDSD9177_DEFAULT_RFTM_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
 					else
-						strcpy(handle->card_info
-							       ->fw_name,
-						       SDSD9177_DEFAULT_COMBO_V1_FW_NAME);
+						strncpy(handle->card_info
+								->fw_name,
+							SDSD9177_DEFAULT_COMBO_V1_FW_NAME,
+							FW_NAMW_MAX_LEN);
 				}
 			}
 			if (handle->params.rf_test_mode)
-				strcpy(handle->card_info->fw_name,
-				       SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME);
+				strncpy(handle->card_info->fw_name,
+					SD9177_DEFAULT_RFTM_WLAN_V1_FW_NAME,
+					FW_NAMW_MAX_LEN);
 			else
-				strcpy(handle->card_info->fw_name_wlan,
-				       SD9177_DEFAULT_WLAN_V1_FW_NAME);
+				strncpy(handle->card_info->fw_name_wlan,
+					SD9177_DEFAULT_WLAN_V1_FW_NAME,
+					FW_NAMW_MAX_LEN);
 			break;
 		default:
 			break;
@@ -2311,21 +2366,25 @@ static void woal_sdiommc_reg_dbg(moal_handle *phandle)
 			reg_end = scratch_reg + 10;
 		}
 		if (loop != 2)
-			ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ", func,
-				       reg_start, reg_end);
+			ptr += snprintf(ptr, sizeof(buf),
+					"SDIO Func%d (%#x-%#x): ", func,
+					reg_start, reg_end);
 		else
-			ptr += sprintf(ptr, "SDIO Func%d: ", func);
+			ptr += snprintf(ptr, sizeof(buf),
+					"SDIO Func%d: ", func);
 		for (reg = reg_start; reg <= reg_end;) {
 			if (func == 0)
 				ret = woal_sdio_f0_readb(phandle, reg, &data);
 			else
 				ret = woal_sdio_readb(phandle, reg, &data);
 			if (loop == 2)
-				ptr += sprintf(ptr, "(%#x) ", reg);
+				ptr += snprintf(ptr, sizeof(buf), "(%#x) ",
+						reg);
 			if (!ret)
-				ptr += sprintf(ptr, "%02x ", data);
+				ptr += snprintf(ptr, sizeof(buf), "%02x ",
+						data);
 			else {
-				ptr += sprintf(ptr, "ERR");
+				ptr += snprintf(ptr, sizeof(buf), "ERR");
 				break;
 			}
 			if (loop == 2 && reg < reg_end)
@@ -2351,6 +2410,10 @@ static void woal_sdiommc_dump_fw_info(moal_handle *phandle)
 		PRINTM(MERROR, "Could not dump firmwware info\n");
 		return;
 	}
+	if (phandle->fw_dump_buf) {
+		PRINTM(MERROR, "FW dump already exist\n");
+		return;
+	}
 	/** cancel all pending commands */
 	mlan_ioctl(phandle->pmlan_adapter, NULL);
 
@@ -2417,7 +2480,8 @@ static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)
 
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MTRUE);
 
-	drv_ptr += sprintf(drv_ptr, "--------sdio_reg_debug_info---------\n");
+	drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN,
+			    "--------sdio_reg_debug_info---------\n");
 	for (loop = 0; loop < 5; loop++) {
 		memset(buf, 0, sizeof(buf));
 		ptr = buf;
@@ -2447,10 +2511,12 @@ static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)
 			reg_end = scratch_reg + 10;
 		}
 		if (loop != 2)
-			ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ", func,
-				       reg_start, reg_end);
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"SDIO Func%d (%#x-%#x): ", func,
+					reg_start, reg_end);
 		else
-			ptr += sprintf(ptr, "SDIO Func%d: ", func);
+			ptr += snprintf(ptr, MAX_BUF_LEN,
+					"SDIO Func%d: ", func);
 		for (reg = reg_start; reg <= reg_end;) {
 			if (func == 0)
 				ret = woal_sdio_f0_readb(phandle, reg, &data);
@@ -2458,11 +2524,13 @@ static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)
 				ret = woal_sdio_readb(phandle, reg, &data);
 
 			if (loop == 2)
-				ptr += sprintf(ptr, "(%#x) ", reg);
+				ptr += snprintf(ptr, MAX_BUF_LEN, "(%#x) ",
+						reg);
 			if (!ret)
-				ptr += sprintf(ptr, "%02x ", data);
+				ptr += snprintf(ptr, MAX_BUF_LEN, "%02x ",
+						data);
 			else {
-				ptr += sprintf(ptr, "ERR");
+				ptr += snprintf(ptr, MAX_BUF_LEN, "ERR");
 				break;
 			}
 			if (loop == 2 && reg < reg_end)
@@ -2470,11 +2538,11 @@ static int woal_sdiommc_dump_reg_info(moal_handle *phandle, t_u8 *drv_buf)
 			else
 				reg++;
 		}
-		drv_ptr += sprintf(drv_ptr, "%s\n", buf);
+		drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN, "%s\n", buf);
 	}
 
-	drv_ptr +=
-		sprintf(drv_ptr, "--------sdio_reg_debug_info End---------\n");
+	drv_ptr += snprintf(drv_ptr, MAX_BUF_LEN,
+			    "--------sdio_reg_debug_info End---------\n");
 	mlan_pm_wakeup_card(phandle->pmlan_adapter, MFALSE);
 
 	LEAVE();
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_shim.c b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
index e827d7b..ec5395b 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_shim.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
@@ -708,13 +708,18 @@ void moal_tp_accounting(t_void *pmoal, void *buf, t_u32 drop_point)
 	wifi_timeval t;
 
 	if (drop_point < MAX_TP_ACCOUNT_DROP_POINT_NUM) {
-		if (drop_point == 4) {
+		if (drop_point == 4 || drop_point == 3) {
 			handle->tp_acnt.tx_bytes[drop_point] += pmbuf->data_len;
 		} else {
 			skb = (struct sk_buff *)buf;
 			handle->tp_acnt.tx_bytes[drop_point] += skb->len;
 		}
 		handle->tp_acnt.tx_packets[drop_point]++;
+		if (drop_point == 3) {
+			woal_get_monotonic_time(&t);
+			pmbuf->extra_ts_sec = t.time_sec;
+			pmbuf->extra_ts_usec = t.time_usec;
+		}
 	} else if (drop_point <= RX_DROP_P5) {
 		t_u16 rx_len = 0;
 		if (drop_point == RX_DROP_P1 || drop_point == RX_DROP_P2)
@@ -755,10 +760,17 @@ void moal_tp_accounting(t_void *pmoal, void *buf, t_u32 drop_point)
 		if (handle->tp_acnt.rx_index >= TXRX_MAX_SAMPLE)
 			handle->tp_acnt.rx_index = 0;
 	} else if (drop_point == TX_TIME_PKT) {
+		delay = (t_s32)(pmbuf->extra_ts_sec - pmbuf->in_ts_sec) *
+			1000000;
+		delay += (t_s32)(pmbuf->extra_ts_usec - pmbuf->in_ts_usec);
+		handle->tp_acnt.tx_delay1_driver[handle->tp_acnt.tx_index] =
+			delay;
+
 		delay = (t_s32)(pmbuf->out_ts_sec - pmbuf->in_ts_sec) * 1000000;
 		delay += (t_s32)(pmbuf->out_ts_usec - pmbuf->in_ts_usec);
 		handle->tp_acnt.tx_delay_driver[handle->tp_acnt.tx_index] =
 			delay;
+
 		handle->tp_acnt.tx_index++;
 		if (handle->tp_acnt.tx_index >= TXRX_MAX_SAMPLE)
 			handle->tp_acnt.tx_index = 0;
@@ -1389,6 +1401,45 @@ mlan_status moal_read_reg(t_void *pmoal, t_u32 reg, t_u32 *data)
 
 #if defined(STA_CFG80211) && defined(UAP_CFG80211)
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+
+#define DOT11_MAX_PRIORITY 8
+#define IEEE80211_RADIOTAP_HE 23
+
+t_u8 ru_signal[16][9] = {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08},
+			 {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x07},
+			 {0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0x07},
+			 {0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0x06},
+			 {0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07},
+			 {0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0x06},
+			 {0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0x06},
+			 {0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x05},
+			 {0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07},
+			 {0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x06},
+			 {0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0x00, 0x00, 0x06},
+			 {0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0xff, 0x01, 0x05},
+			 {0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x06},
+			 {0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0xff, 0x01, 0x05},
+			 {0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x00, 0x00, 0x05},
+			 {0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01,
+			  0x04}};
+
+t_u8 ru_signal_106[14][9] = {
+	{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
+	{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
+	{0xff, 0x01, 0xff, 0x01, 0xff, 0xff, 0xff, 0x02, 0x03},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0x01, 0xff, 0x01, 0x03},
+	{0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0x02, 0x05},
+	{0x00, 0x00, 0xff, 0x01, 0xff, 0xff, 0xff, 0x02, 0x04},
+	{0xff, 0x01, 0x00, 0x00, 0xff, 0xff, 0xff, 0x02, 0x04},
+	{0xff, 0x01, 0xff, 0x01, 0xff, 0xff, 0xff, 0x02, 0x03},
+	{0xff, 0xff, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x05},
+	{0xff, 0xff, 0xff, 0x02, 0x00, 0x00, 0xff, 0x01, 0x04},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0x01, 0x00, 0x00, 0x04},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0x01, 0xff, 0x01, 0x03},
+	{0xff, 0xff, 0xff, 0x02, 0xff, 0xff, 0xff, 0x02, 0x02},
+	{0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x04}};
+
+t_u8 ru_signal_52[9] = {0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0xff, 0x01, 0x04};
 /**
  *  @brief This function uploads the packet to the network stack monitor
  * interface
@@ -1406,6 +1457,8 @@ static mlan_status moal_recv_packet_to_mon_if(moal_handle *handle,
 	struct radiotap_header *rth = NULL;
 	radiotap_info rt_info = {};
 	t_u8 format = 0;
+	t_u8 mcs = 0;
+	t_u8 nss = 0;
 	t_u8 bw = 0;
 	t_u8 gi = 0;
 	t_u8 ldpc = 0;
@@ -1415,6 +1468,12 @@ static mlan_status moal_recv_packet_to_mon_if(moal_handle *handle,
 	t_u8 *payload = NULL;
 	t_u32 vht_sig1 = 0;
 	t_u32 vht_sig2 = 0;
+	t_u32 he_sig1 = 0;
+	t_u32 he_sig2 = 0;
+	t_u32 usr_idx = 0;
+	t_u32 out = 0;
+	t_u32 tone = 0;
+	t_u8 dcm = 0;
 	ENTER();
 	if (!pmbuf->pdesc) {
 		LEAVE();
@@ -1443,7 +1502,15 @@ static mlan_status moal_recv_packet_to_mon_if(moal_handle *handle,
 			ldpc = (rt_info.rate_info.rate_info & 0x20) >> 5;
 			format = (rt_info.rate_info.rate_info & 0x18) >> 3;
 			bw = (rt_info.rate_info.rate_info & 0x06) >> 1;
-			gi = rt_info.rate_info.rate_info & 0x01;
+			dcm = rt_info.rate_info.dcm;
+			if (format == MLAN_RATE_FORMAT_HE)
+				gi = (rt_info.rate_info.rate_info & 0xC0) >> 6;
+			else
+
+				gi = rt_info.rate_info.rate_info & 0x01;
+			mcs = rt_info.rate_info.mcs_index;
+			nss = rt_info.rate_info.nss_index;
+
 			skb_push(skb, sizeof(*rth));
 			rth = (struct radiotap_header *)skb->data;
 			memset(skb->data, 0, sizeof(*rth));
@@ -1500,13 +1567,19 @@ static mlan_status moal_recv_packet_to_mon_if(moal_handle *handle,
 			}
 			/** Channel */
 			rth->body.channel.flags = 0;
-			if (rt_info.chan_num)
-				chan_num = rt_info.chan_num;
-			else
-				chan_num =
-					handle->mon_if->band_chan_cfg.channel;
+			if (rt_info.chan_num &&
+			    (handle->mon_if->band_chan_cfg.channel !=
+			     rt_info.chan_num))
+				handle->mon_if->band_chan_cfg.channel =
+					rt_info.chan_num;
+			chan_num = handle->mon_if->band_chan_cfg.channel;
+
 			band = (chan_num <= 14) ? IEEE80211_BAND_2GHZ :
 						  IEEE80211_BAND_5GHZ;
+			/** update the band, if different in the Rx frame */
+			if (handle->mon_if->band_chan_cfg.band != band)
+				handle->mon_if->band_chan_cfg.band = band;
+
 			rth->body.channel.frequency = woal_cpu_to_le16(
 				ieee80211_channel_to_frequency(chan_num, band));
 			rth->body.channel.flags |=
@@ -1565,8 +1638,8 @@ static mlan_status moal_recv_packet_to_mon_if(moal_handle *handle,
 			}
 			/** VHT */
 			if (format == MLAN_RATE_FORMAT_VHT) {
-				vht_sig1 = rt_info.extra_info.vht_sig1;
-				vht_sig2 = rt_info.extra_info.vht_sig2;
+				vht_sig1 = rt_info.extra_info.vht_he_sig1;
+				vht_sig2 = rt_info.extra_info.vht_he_sig2;
 				/** Present Flag */
 				rth->hdr.it_present |= cpu_to_le32(
 					1 << IEEE80211_RADIOTAP_VHT);
@@ -1615,11 +1688,173 @@ static mlan_status moal_recv_packet_to_mon_if(moal_handle *handle,
 				/* Convert FW NSS value to radiotap spec */
 				rth->body.u.vht.mcs_nss[0] |=
 					((vht_sig1 & (0x1C00)) >> 10) + 1;
+				/** gi */
+				rth->body.u.vht.known |=
+					woal_cpu_to_le16(VHT_KNOWN_GI);
+				if (gi)
+					rth->body.u.vht.flags |= VHT_FLAG_SGI;
 				/** coding */
 				if (vht_sig2 & MBIT(2))
 					rth->body.u.vht.coding |=
 						VHT_CODING_LDPC_USER0;
 			}
+			if (format == MLAN_RATE_FORMAT_HE) {
+				he_sig1 = rt_info.extra_info.vht_he_sig1;
+				he_sig2 = rt_info.extra_info.vht_he_sig2;
+				usr_idx = rt_info.extra_info.user_idx;
+				rth->hdr.it_present |=
+					cpu_to_le32(1 << IEEE80211_RADIOTAP_HE);
+				rth->body.u.he.data1 |= (HE_CODING_KNOWN);
+				if (ldpc)
+					rth->body.u.he.data3 |=
+						HE_CODING_LDPC_USER0;
+				rth->body.u.he.data1 |= (HE_BW_KNOWN);
+				if (he_sig1)
+					rth->body.u.he.data1 |= (HE_MU_DATA);
+				if (bw == 1) {
+					rth->body.u.he.data5 |= RX_HE_BW_40;
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (tone != 0) {
+							rth->body.u.he.data5 &=
+								~RX_HE_BW_40;
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				} else if (bw == 2) {
+					rth->body.u.he.data5 |= RX_HE_BW_80;
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH2(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							if ((he_sig2 &
+							     MLAN_80_CENTER_RU) &&
+							    !usr_idx) {
+								tone = RU_TONE_26;
+							} else {
+								usr_idx--;
+							}
+						}
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH4(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (tone != 0) {
+							rth->body.u.he.data5 &=
+								~RX_HE_BW_80;
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				} else if (bw == 3) {
+					rth->body.u.he.data5 |= RX_HE_BW_160;
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (!tone) {
+							MLAN_DECODE_RU_SIGNALING_CH2(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							if ((he_sig2 &
+							     MLAN_160_CENTER_RU) &&
+							    !usr_idx) {
+								tone = RU_TONE_26;
+							} else {
+								usr_idx--;
+							}
+						}
+						if (!tone) {
+							MLAN_DECODING_160_RU_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (!tone) {
+							MLAN_DECODING_160_RU_CH3(
+								out, he_sig1,
+								he_sig2);
+							MLAN_DECODE_RU_TONE(
+								out, usr_idx,
+								tone);
+						}
+						if (tone != 0) {
+							rth->body.u.he.data5 &=
+								~RX_HE_BW_160;
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				} else {
+					if (he_sig2) {
+						MLAN_DECODE_RU_SIGNALING_CH1(
+							out, he_sig1, he_sig2);
+						MLAN_DECODE_RU_TONE(
+							out, usr_idx, tone);
+						if (tone) {
+							rth->body.u.he.data5 |=
+								tone;
+						}
+					}
+				}
+
+				rth->body.u.he.data2 |= (HE_DATA_GI_KNOWN);
+				rth->body.u.he.data5 |= ((gi & 3) << 4);
+				rth->body.u.he.data1 |= (HE_MCS_KNOWN);
+
+				rth->body.u.he.data3 |= (mcs << 8);
+				rth->body.u.he.data6 |= nss;
+				rth->body.u.he.data1 |= (HE_DCM_KNOWN);
+				rth->body.u.he.data1 =
+					cpu_to_le16(rth->body.u.he.data1);
+				rth->body.u.he.data5 |= (dcm << 12);
+				rth->body.u.he.data5 =
+					cpu_to_le16(rth->body.u.he.data5);
+				rth->body.u.he.data3 =
+					cpu_to_le16(rth->body.u.he.data3);
+			}
 		}
 		skb_set_mac_header(skb, 0);
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1752,6 +1987,12 @@ mlan_status moal_recv_amsdu_packet(t_void *pmoal, pmlan_buffer pmbuf)
 			status = MLAN_STATUS_PENDING;
 		} else {
 			frame = skb_clone(skb, GFP_ATOMIC);
+			if (!frame) {
+				PRINTM(MERROR,
+				       " AMSDU RECV:skb_clone returned NULL\n");
+				break;
+			}
+
 			skb_trim(frame, len);
 			eth = (struct ethhdr *)skb_pull(skb, len + padding);
 			if (!eth) {
@@ -2425,7 +2666,11 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 			memset(wrqu.ap_addr.sa_data, 0x00, ETH_ALEN);
 			moal_memcpy_ext(priv->phandle, wrqu.ap_addr.sa_data,
 					pmevent->event_buf, ETH_ALEN,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+					sizeof(wrqu.ap_addr.sa_data_min));
+#else
 					sizeof(wrqu.ap_addr.sa_data));
+#endif
 			wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 			wireless_send_event(priv->netdev, SIOCGIWAP, &wrqu,
 					    NULL);
@@ -2435,9 +2680,11 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 		if (IS_STA_CFG80211(cfg80211_wext)) {
 			moal_memcpy_ext(priv->phandle, priv->cfg_bssid,
 					pmevent->event_buf, ETH_ALEN, ETH_ALEN);
-			woal_set_scan_time(priv, ACTIVE_SCAN_CHAN_TIME,
-					   PASSIVE_SCAN_CHAN_TIME,
-					   MIN_SPECIFIC_SCAN_CHAN_TIME);
+
+			if (!priv->phandle->user_scan_cfg)
+				woal_set_scan_time(priv, ACTIVE_SCAN_CHAN_TIME,
+						   PASSIVE_SCAN_CHAN_TIME,
+						   MIN_SPECIFIC_SCAN_CHAN_TIME);
 		}
 #endif
 		custom_len = strlen(CUS_EVT_AP_CONNECTED);
@@ -2470,6 +2717,12 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 	case MLAN_EVENT_ID_DRV_SCAN_REPORT:
 		PRINTM(MINFO, "Scan report\n");
 
+		if (priv->phandle->scan_pending_on_block == MTRUE) {
+			priv->phandle->scan_pending_on_block = MFALSE;
+			priv->phandle->scan_priv = NULL;
+			MOAL_REL_SEMAPHORE(&priv->phandle->async_sem);
+		}
+
 		if (priv->report_scan_result) {
 			priv->report_scan_result = MFALSE;
 #ifdef STA_CFG80211
@@ -2482,11 +2735,13 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 					if (!priv->phandle->first_scan_done) {
 						priv->phandle->first_scan_done =
 							MTRUE;
-						woal_set_scan_time(
-							priv,
-							ACTIVE_SCAN_CHAN_TIME,
-							PASSIVE_SCAN_CHAN_TIME,
-							SPECIFIC_SCAN_CHAN_TIME);
+						if (!priv->phandle
+							     ->user_scan_cfg)
+							woal_set_scan_time(
+								priv,
+								ACTIVE_SCAN_CHAN_TIME,
+								PASSIVE_SCAN_CHAN_TIME,
+								SPECIFIC_SCAN_CHAN_TIME);
 					}
 					spin_lock_irqsave(
 						&priv->phandle->scan_req_lock,
@@ -2542,11 +2797,6 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 			priv->phandle->scan_time_start.time_usec = 0;
 		}
 
-		if (priv->phandle->scan_pending_on_block == MTRUE) {
-			priv->phandle->scan_pending_on_block = MFALSE;
-			priv->phandle->scan_priv = NULL;
-			MOAL_REL_SEMAPHORE(&priv->phandle->async_sem);
-		}
 		break;
 
 	case MLAN_EVENT_ID_DRV_OBSS_SCAN_PARAM:
@@ -2598,8 +2848,9 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 		break;
 
 	case MLAN_EVENT_ID_FW_DISCONNECTED:
-		woal_send_disconnect_to_system(priv,
-					       (t_u16)*pmevent->event_buf);
+		if (priv->media_connected)
+			woal_send_disconnect_to_system(
+				priv, (t_u16)*pmevent->event_buf);
 #ifdef STA_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 		priv->auth_flag = 0;
@@ -2985,7 +3236,7 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 			) {
 				priv->roaming_required = MTRUE;
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 				__pm_wakeup_event(&priv->phandle->ws,
 						  ROAMING_WAKE_LOCK_TIMEOUT);
 #else
@@ -3187,7 +3438,14 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 		snprintf(event_buf, sizeof(event_buf) - 1, "%s %d",
 			 CUS_EVT_RADAR_DETECTED, radar_chan);
 		woal_broadcast_event(priv, event_buf, strlen(event_buf));
-		PRINTM(MEVENT, "Radar detected on channel %d\n", radar_chan);
+		PRINTM(MEVENT, "%s: Radar detected on channel %d\n",
+		       priv->netdev->name, radar_chan);
+#ifdef UAP_SUPPORT
+		if (priv->chan_rpt_req.chanNum && priv->chan_rpt_pending) {
+			woal_11h_cancel_chan_report_ioctl(priv, MOAL_NO_WAIT);
+			priv->chan_rpt_pending = MFALSE;
+		}
+#endif
 
 #ifdef UAP_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)
@@ -3209,9 +3467,9 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 						       DFS_UNAVAILABLE);
 #endif
 #ifdef UAP_SUPPORT
-		if ((priv->target_chan && priv->bss_started &&
-		     (priv->target_chan != radar_chan)) ||
-		    priv->backup_chan) {
+		if (priv->bss_started &&
+		    ((priv->target_chan && (priv->target_chan != radar_chan)) ||
+		     priv->backup_chan)) {
 			PRINTM(MEVENT, "Move to target or backup chan %d %d\n",
 			       priv->target_chan, priv->backup_chan);
 			woal_move_to_next_channel(priv);
@@ -3322,6 +3580,11 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 #endif
 			if (priv->channel == pchan_info->channel)
 				break;
+#ifdef UAP_CFG80211
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+			woal_update_uap_channel_dfs_state(priv);
+#endif
+#endif
 			priv->channel = pchan_info->channel;
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
@@ -3330,7 +3593,11 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 			    || priv->uap_host_based
 #endif
 #ifdef STA_CFG80211
-			    || priv->sme_current.ssid_len
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
+			    || priv->wdev->connected
+#else
+			    || priv->wdev->current_bss
+#endif
 #endif
 			) {
 				PRINTM(MEVENT,
@@ -3455,10 +3722,14 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 #ifdef STA_SUPPORT
 #ifdef STA_CFG80211
 		pmpriv = woal_get_priv((moal_handle *)pmoal, MLAN_BSS_ROLE_STA);
-		if (IS_STA_CFG80211(cfg80211_wext) && pmpriv)
-			woal_set_scan_time(pmpriv, ACTIVE_SCAN_CHAN_TIME,
-					   PASSIVE_SCAN_CHAN_TIME,
-					   MIN_SPECIFIC_SCAN_CHAN_TIME);
+		if (IS_STA_CFG80211(cfg80211_wext) && pmpriv) {
+			if (!priv->phandle->user_scan_cfg) {
+				woal_set_scan_time(pmpriv,
+						   ACTIVE_SCAN_CHAN_TIME,
+						   PASSIVE_SCAN_CHAN_TIME,
+						   MIN_SPECIFIC_SCAN_CHAN_TIME);
+			}
+		}
 #endif
 #endif
 #ifdef UAP_CFG80211
@@ -3467,10 +3738,9 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 			PRINTM(MMSG,
 			       "Channel Under Nop: notify cfg80211 new channel=%d\n",
 			       priv->channel);
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
-			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0, 0);
-#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 1, 0) && IMX_ANDROID_13))
-			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0, 0);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
+			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0,
+						  0);
 #elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
 			cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0);
 #else
@@ -4066,10 +4336,13 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 					priv->phandle->priv
 						[priv->phandle->remain_bss_index];
 				if (remain_priv) {
-					woal_cfg80211_remain_on_channel_cfg(
-						remain_priv, MOAL_NO_WAIT,
-						MTRUE, &channel_status, NULL, 0,
-						0);
+					if (woal_cfg80211_remain_on_channel_cfg(
+						    remain_priv, MOAL_NO_WAIT,
+						    MTRUE, &channel_status,
+						    NULL, 0, 0))
+						PRINTM(MERROR,
+						       "remain_on_channel: Failed to cancel\n");
+
 					priv->phandle->remain_on_channel =
 						MFALSE;
 				}
@@ -4231,6 +4504,17 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 		PRINTM(MMSG, "FW Roamed to bssid " MACSTR " successfully\n",
 		       MAC2STR(pmevent->event_buf));
 		break;
+	case MLAN_EVENT_ID_DRV_RTT_RESULT:
+		DBG_HEXDUMP(MEVT_D, "RTT result", pmevent->event_buf,
+			    pmevent->event_len);
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+#ifdef STA_CFG80211
+		if (IS_STA_CFG80211(cfg80211_wext))
+			woal_cfg80211_event_rtt_result(priv, pmevent->event_buf,
+						       pmevent->event_len);
+#endif
+#endif
+		break;
 	case MLAN_EVENT_ID_CSI:
 		DBG_HEXDUMP(MEVT_D, "CSI dump", pmevent->event_buf,
 			    pmevent->event_len);
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
index 07c7c7d..84ab167 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
@@ -3,7 +3,7 @@
  * @brief This file contains the functions for STA CFG80211.
  *
  *
- * Copyright 2011-2022 NXP
+ * Copyright 2011-2023 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -894,8 +894,8 @@ done:
  *
  * @return                  0 -- success, otherwise fail
  */
-static int woal_cfg80211_assoc_ies_cfg(moal_private *priv, t_u8 *ie, int ie_len,
-				       t_u8 wait_option)
+static int woal_cfg80211_assoc_ies_cfg(moal_private *priv, t_u8 *ie,
+				       size_t ie_len, t_u8 wait_option)
 {
 	int bytes_left = ie_len;
 	t_u8 *pcurrent_ptr = ie;
@@ -2148,17 +2148,29 @@ static int woal_cfg80211_authenticate(struct wiphy *wiphy,
 	pmlan_buffer pmbuf = NULL;
 	t_u32 pkt_type, tx_control;
 	t_u16 packet_len = 0, auth_alg;
+	t_u16 pkt_len;
 	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 	int ret = 0;
 
 	t_u8 trans = 1, status_code = 0;
 	t_u8 *varptr = NULL;
-	mlan_ssid_bssid *ssid_bssid;
 	moal_handle *handle = priv->phandle;
+	mlan_ssid_bssid *ssid_bssid;
 	int i;
 
 	ENTER();
 
+#ifdef REASSOCIATION
+	// disable reassoc_on
+	handle->reassoc_on &= ~MBIT(priv->bss_index);
+	priv->reassoc_on = MFALSE;
+	priv->reassoc_required = MFALSE;
+	if (!handle->reassoc_on && handle->is_reassoc_timer_set == MTRUE) {
+		woal_cancel_timer(&handle->reassoc_timer);
+		handle->is_reassoc_timer_set = MFALSE;
+	}
+#endif
+
 	priv->cfg_disconnect = MFALSE;
 #ifdef UAP_CFG80211
 	if (GET_BSS_ROLE(priv) == MLAN_BSS_ROLE_UAP) {
@@ -2423,15 +2435,16 @@ static int woal_cfg80211_authenticate(struct wiphy *wiphy,
 	}
 #endif
 	/*Add packet len*/
+	pkt_len = woal_cpu_to_le16(packet_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), sizeof(packet_len));
+			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
 
 	/**Authentication Frame: Authentication Alg*/
 	mgmt->u.auth.auth_alg = woal_cpu_to_le16(auth_alg);
-	mgmt->u.auth.auth_transaction = trans;
+	mgmt->u.auth.auth_transaction = woal_cpu_to_le16(trans);
 	/**Authentication Frame: Status code*/
-	mgmt->u.auth.status_code = status_code;
+	mgmt->u.auth.status_code = woal_cpu_to_le16(status_code);
 
 	if (req->ie && req->ie_len) {
 		if (!varptr) {
@@ -2488,9 +2501,12 @@ done:
 	if (ret) {
 		woal_mgmt_frame_register(priv, IEEE80211_STYPE_AUTH, MFALSE);
 		if (priv->phandle->remain_on_channel) {
-			woal_cfg80211_remain_on_channel_cfg(
-				priv, MOAL_IOCTL_WAIT, MTRUE, (t_u8 *)&status,
-				NULL, 0, 0);
+			if (woal_cfg80211_remain_on_channel_cfg(
+				    priv, MOAL_IOCTL_WAIT, MTRUE,
+				    (t_u8 *)&status, NULL, 0, 0)) {
+				PRINTM(MERROR,
+				       "Fail to cancel remain on channel\n");
+			}
 			priv->phandle->remain_on_channel = MFALSE;
 		}
 	}
@@ -2519,9 +2535,12 @@ void woal_host_mlme_work_queue(struct work_struct *work)
 						 MFALSE);
 
 			if (priv->phandle->remain_on_channel) {
-				woal_cfg80211_remain_on_channel_cfg(
-					priv, MOAL_IOCTL_WAIT, MTRUE,
-					(t_u8 *)&status, NULL, 0, 0);
+				if (woal_cfg80211_remain_on_channel_cfg(
+					    priv, MOAL_IOCTL_WAIT, MTRUE,
+					    (t_u8 *)&status, NULL, 0, 0)) {
+					PRINTM(MERROR,
+					       "failed to cancel remain on channel\n");
+				}
 				priv->phandle->remain_on_channel = MFALSE;
 			}
 			PRINTM(MCMND, "wlan: HostMlme %s auth success\n",
@@ -2879,7 +2898,11 @@ done:
 		woal_save_assoc_params(priv, req, ssid_bssid);
 
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR,
+			       "woal_get_bss_info Fails to get bss info\n");
+		}
 		priv->channel = bss_info.bss_chan;
 	}
 
@@ -4255,6 +4278,9 @@ static mlan_status woal_uap_scan(moal_private *priv,
 	mlan_ds_band_cfg bandcfg;
 	u8 band_change = MFALSE;
 	ENTER();
+	memset(&org_bandcfg, 0, sizeof(mlan_ds_band_cfg));
+	memset(&bandcfg, 0, sizeof(mlan_ds_band_cfg));
+
 	if (priv->bss_index > 0)
 		tmp_priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 	else
@@ -4326,7 +4352,7 @@ done:
 }
 #endif
 
-static int woal_find_wps_ie_in_probereq(const t_u8 *ie, int len)
+static int woal_find_wps_ie_in_probereq(const t_u8 *ie, size_t len)
 {
 	int left_len = len;
 	const t_u8 *pos = ie;
@@ -4556,7 +4582,9 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 #endif
 
 	memset(&scan_cfg, 0, sizeof(mlan_scan_cfg));
-	woal_get_scan_config(priv, &scan_cfg);
+	if (MLAN_STATUS_SUCCESS != woal_get_scan_config(priv, &scan_cfg)) {
+		PRINTM(MERROR, "Fail to get scan request IE\n");
+	}
 #ifdef WIFI_DIRECT_SUPPORT
 	if (priv->phandle->miracast_mode)
 		scan_req->scan_chan_gap = priv->phandle->scan_chan_gap;
@@ -4643,8 +4671,9 @@ static int woal_cfg80211_scan(struct wiphy *wiphy, struct net_device *dev,
 				scan_req->chan_list[i].scan_time =
 					INIT_PASSIVE_SCAN_CHAN_TIME;
 			else
-				scan_req->chan_list[i].scan_time =
-					MIN_SPECIFIC_SCAN_CHAN_TIME;
+				scan_req->chan_list[i].scan_time = MIN(
+					MIN_SPECIFIC_SCAN_CHAN_TIME,
+					scan_cfg.scan_time.specific_scan_time);
 		}
 #endif
 #ifdef UAP_CFG80211
@@ -4783,6 +4812,7 @@ static int woal_send_ft_action_requst(moal_private *priv, t_u8 *ie, t_u8 len,
 	t_u32 pkt_type;
 	t_u32 tx_control;
 	t_u16 packet_len = 0;
+	t_u16 pkt_len = 0;
 	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 	int ret = 0;
 
@@ -4814,9 +4844,10 @@ static int woal_send_ft_action_requst(moal_private *priv, t_u8 *ie, t_u8 len,
 			pmbuf->pbuf + pmbuf->data_offset + sizeof(pkt_type),
 			&tx_control, sizeof(tx_control), sizeof(tx_control));
 	/*Add packet len*/
+	pkt_len = woal_cpu_to_le16(packet_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), sizeof(packet_len));
+			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
 
 	mgmt = (IEEE80211_MGMT *)(pmbuf->pbuf + pmbuf->data_offset +
 				  HEADER_SIZE + sizeof(packet_len));
@@ -4890,6 +4921,7 @@ static int woal_send_ft_auth_requst(moal_private *priv, t_u8 *ie, t_u8 len,
 	t_u32 pkt_type;
 	t_u32 tx_control;
 	t_u16 packet_len = 0;
+	t_u16 pkt_len;
 	t_u8 addr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 	int ret = 0;
 
@@ -4920,9 +4952,10 @@ static int woal_send_ft_auth_requst(moal_private *priv, t_u8 *ie, t_u8 len,
 			pmbuf->pbuf + pmbuf->data_offset + sizeof(pkt_type),
 			&tx_control, sizeof(tx_control), sizeof(tx_control));
 	/*Add packet len*/
+	pkt_len = woal_cpu_to_le16(packet_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&packet_len, sizeof(packet_len), sizeof(packet_len));
+			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
 
 	mgmt = (IEEE80211_MGMT *)(pmbuf->pbuf + pmbuf->data_offset +
 				  HEADER_SIZE + sizeof(packet_len));
@@ -5005,8 +5038,11 @@ static int woal_connect_ft_over_air(moal_private *priv, t_u8 *bssid,
 	woal_mgmt_frame_register(priv, IEEE80211_STYPE_AUTH, MTRUE);
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-	woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MFALSE, &status,
-					    chan, 0, AUTH_TX_DEFAULT_WAIT_TIME);
+	if (woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MFALSE,
+						&status, chan, 0,
+						AUTH_TX_DEFAULT_WAIT_TIME)) {
+		PRINTM(MERROR, "Failed remain on channel config\n");
+	}
 #endif
 
 	/*construct auth request and send out*/
@@ -5036,8 +5072,10 @@ static int woal_connect_ft_over_air(moal_private *priv, t_u8 *bssid,
 	}
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-	woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MTRUE, &status,
-					    NULL, 0, 0);
+	if (woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MTRUE,
+						&status, NULL, 0, 0)) {
+		PRINTM(MERROR, "Failed to cancel remain on channel\n");
+	}
 #endif
 
 	woal_mgmt_frame_register(priv, IEEE80211_STYPE_AUTH, MFALSE);
@@ -5069,8 +5107,12 @@ static int woal_connect_ft_over_ds(moal_private *priv, t_u8 *bssid,
 
 	if (priv->media_connected) {
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-		woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MFALSE,
-						    &status, pchan, 0, 1200);
+		if (woal_cfg80211_remain_on_channel_cfg(priv, wait_option,
+							MFALSE, &status, pchan,
+							0, 1200)) {
+			PRINTM(MERROR,
+			       "Failed to configure remain on channel\n");
+		}
 #endif
 		/*construct ft action request and send out*/
 		woal_send_ft_action_requst(priv, priv->ft_ie, priv->ft_ie_len,
@@ -5085,8 +5127,12 @@ static int woal_connect_ft_over_ds(moal_private *priv, t_u8 *bssid,
 			/*go over air, as current AP may be unreachable */
 			PRINTM(MMSG, "wlan: go over air\n");
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-			woal_cfg80211_remain_on_channel_cfg(
-				priv, wait_option, MTRUE, &status, NULL, 0, 0);
+			if (woal_cfg80211_remain_on_channel_cfg(
+				    priv, wait_option, MTRUE, &status, NULL, 0,
+				    0)) {
+				PRINTM(MERROR,
+				       "Failed to cancel remain on channel\n");
+			}
 #endif
 			woal_connect_ft_over_air(priv, bssid, pchan);
 			LEAVE();
@@ -5098,8 +5144,10 @@ static int woal_connect_ft_over_ds(moal_private *priv, t_u8 *bssid,
 					sizeof(priv->target_ap_bssid));
 		}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
-		woal_cfg80211_remain_on_channel_cfg(priv, wait_option, MTRUE,
-						    &status, NULL, 0, 0);
+		if (woal_cfg80211_remain_on_channel_cfg(
+			    priv, wait_option, MTRUE, &status, NULL, 0, 0)) {
+			PRINTM(MERROR, "Failed to cancel remain on channel\n");
+		}
 #endif
 	}
 
@@ -5260,7 +5308,10 @@ static int woal_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 	    !(priv->ft_cap & MBIT(0))) {
 		/** get current bss info */
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "Fail to get bss info\n");
+		}
 		/** get target bss info */
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_find_essid(priv, ssid_bssid, MOAL_IOCTL_WAIT)) {
@@ -5966,6 +6017,7 @@ static int woal_cfg80211_set_tx_power(struct wiphy *wiphy,
 	mlan_power_cfg_t power_cfg;
 
 	ENTER();
+	memset(&power_cfg, 0, sizeof(power_cfg));
 
 	priv = woal_get_priv(handle, MLAN_BSS_ROLE_ANY);
 	if (!priv) {
@@ -6002,6 +6054,7 @@ static int woal_cfg80211_set_cqm_rssi_config(struct wiphy *wiphy,
 					     struct net_device *dev,
 					     s32 rssi_thold, u32 rssi_hyst)
 {
+	int ret = 0;
 	moal_private *priv = (moal_private *)woal_get_netdev_priv(dev);
 	ENTER();
 	priv->cqm_rssi_thold = rssi_thold;
@@ -6010,9 +6063,12 @@ static int woal_cfg80211_set_cqm_rssi_config(struct wiphy *wiphy,
 
 	PRINTM(MIOCTL, "rssi_thold=%d rssi_hyst=%d\n", (int)rssi_thold,
 	       (int)rssi_hyst);
-	woal_set_rssi_threshold(priv, 0, MOAL_IOCTL_WAIT);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_set_rssi_threshold(priv, 0, MOAL_IOCTL_WAIT)) {
+		PRINTM(MERROR, "Fail to set rssi thresold.\n");
+	}
 	LEAVE();
-	return 0;
+	return ret;
 }
 #endif
 
@@ -6280,8 +6336,6 @@ woal_cfg80211_remain_on_channel(struct wiphy *wiphy, struct net_device *dev,
 	/* we need update the value cookie */
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
 	*cookie = (u64)random32() | 1;
-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
-	*cookie = (u64)get_random_u32() | 1;
 #else
 #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
 	*cookie = (u64)prandom_u32() | 1;
@@ -6447,7 +6501,7 @@ int woal_cfg80211_sched_scan_start(struct wiphy *wiphy, struct net_device *dev,
 	/** Add broadcast scan, when n_match_sets = 0 */
 	if (!request->n_match_sets)
 		priv->scan_cfg.ssid_list[0].max_len = 0xff;
-	for (i = 0; i < (int)MIN(WLAN_BG_SCAN_CHAN_MAX, request->n_channels);
+	for (i = 0; i < (int)MIN(WLAN_USER_SCAN_CHAN_MAX, request->n_channels);
 	     i++) {
 		chan = request->channels[i];
 		priv->scan_cfg.chan_list[i].chan_number = chan->hw_value;
@@ -6460,6 +6514,8 @@ int woal_cfg80211_sched_scan_start(struct wiphy *wiphy, struct net_device *dev,
 		else
 			priv->scan_cfg.chan_list[i].scan_type =
 				MLAN_SCAN_TYPE_ACTIVE;
+		PRINTM(MCMD_D, "cfg80211_sched_scan: chan=%d chan->flag=0x%x\n",
+		       chan->hw_value, chan->flags);
 		priv->scan_cfg.chan_list[i].scan_time = 0;
 #ifdef WIFI_DIRECT_SUPPORT
 		if (priv->phandle->miracast_mode)
@@ -6468,7 +6524,7 @@ int woal_cfg80211_sched_scan_start(struct wiphy *wiphy, struct net_device *dev,
 #endif
 	}
 	priv->scan_cfg.chan_per_scan =
-		MIN(WLAN_BG_SCAN_CHAN_MAX, request->n_channels);
+		MIN(WLAN_USER_SCAN_CHAN_MAX, request->n_channels);
 
 	/** set scan request IES */
 	if (request->ie && request->ie_len) {
@@ -6655,7 +6711,7 @@ int woal_cfg80211_resume(struct wiphy *wiphy)
 					handle->priv[i]->roaming_required =
 						MTRUE;
 #ifdef ANDROID_KERNEL
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 					__pm_wakeup_event(
 						&handle->ws,
 						ROAMING_WAKE_LOCK_TIMEOUT);
@@ -7901,6 +7957,7 @@ static int woal_send_tdls_action_frame(struct wiphy *wiphy,
 	t_u32 pkt_type;
 	t_u32 tx_control;
 	t_u16 pkt_len;
+	t_u16 packet_len;
 	int ret = 0;
 
 	ENTER();
@@ -7960,9 +8017,10 @@ static int woal_send_tdls_action_frame(struct wiphy *wiphy,
 	pmbuf->bss_index = priv->bss_index;
 
 	pkt_len = pmbuf->data_len - HEADER_SIZE - sizeof(pkt_len);
+	packet_len = woal_cpu_to_le16(pkt_len);
 	moal_memcpy_ext(priv->phandle,
 			pmbuf->pbuf + pmbuf->data_offset + HEADER_SIZE,
-			&pkt_len, sizeof(pkt_len), sizeof(pkt_len));
+			&packet_len, sizeof(packet_len), sizeof(packet_len));
 
 	DBG_HEXDUMP(MDAT_D, "TDLS action:", pmbuf->pbuf + pmbuf->data_offset,
 		    pmbuf->data_len);
@@ -8224,7 +8282,10 @@ int woal_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
 
 	/* check if AP prohited TDLS */
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MERROR, "WLAN, %s: Failed to get bss info.\n", __func__);
+	}
 	if (IS_EXTCAP_TDLS_PROHIBITED(bss_info.ext_cap)) {
 		PRINTM(MMSG, "TDLS is prohibited by AP\n");
 		LEAVE();
@@ -8408,7 +8469,10 @@ static int woal_cfg80211_tdls_channel_switch(struct wiphy *wiphy,
 
 	/* check if AP prohited TDLS channel switch */
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		PRINTM(MERROR, "WLAN, %s: Failed to get bss info.\n", __func__);
+	}
 	if (IS_EXTCAP_TDLS_CHLSWITCHPROHIB(bss_info.ext_cap)) {
 		PRINTM(MMSG, "TDLS Channel Switching is prohibited by AP\n");
 		LEAVE();
@@ -8633,7 +8697,7 @@ int woal_cfg80211_update_ft_ies(struct wiphy *wiphy, struct net_device *dev,
 	PRINTM(MINFO, "==>woal_cfg80211_update_ft_ies %x \n", ftie->ie_len);
 #endif
 	md_ie = (IEEEtypes_MobilityDomain_t *)woal_parse_ie_tlv(
-		ftie->ie, ftie->ie_len, MOBILITY_DOMAIN);
+		ftie->ie, (int)ftie->ie_len, MOBILITY_DOMAIN);
 	if (!md_ie) {
 		PRINTM(MERROR, "No Mobility domain IE\n");
 		kfree(assoc_rsp);
@@ -9195,7 +9259,7 @@ done:
 	/* config rssi low threshold again */
 	priv->last_event = 0;
 	priv->rssi_low = DEFAULT_RSSI_LOW_THRESHOLD;
-	sprintf(rssi_low, "%d", priv->rssi_low);
+	snprintf(rssi_low, sizeof(rssi_low), "%d", priv->rssi_low);
 	if (MLAN_STATUS_FAILURE ==
 	    woal_set_rssi_low_threshold(priv, rssi_low, MOAL_IOCTL_WAIT))
 		PRINTM(MERROR, "set_rssi_low_threshold fail\n");
@@ -9446,6 +9510,7 @@ int woal_cfg80211_uap_add_station(struct wiphy *wiphy, struct net_device *dev,
 			params->link_sta_params.he_capa_len;
 		tlv = (MrvlIEtypes_Data_t *)pos;
 	}
+
 #elif CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 	if (params->he_capa_len) {
 		ext_tlv = (MrvlExtIEtypes_Data_t *)pos;
@@ -9667,11 +9732,13 @@ mlan_status woal_register_sta_cfg80211(struct net_device *dev, t_u8 bss_type)
  *
  * @param priv            A pointer to moal_private structure
  * @param wiphy 		  A pointer to structure wiphy
+ * @param fw_info         A pointer to mlan_fw_info
  * @param wait_option     Wait option
  * @return                MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
 static mlan_status woal_cfg80211_init_wiphy(moal_private *priv,
 					    struct wiphy *wiphy,
+					    mlan_fw_info *fw_info,
 					    t_u8 wait_option)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
@@ -9728,7 +9795,8 @@ static mlan_status woal_cfg80211_init_wiphy(moal_private *priv,
 		}
 		woal_cfg80211_setup_ht_cap(
 			&wiphy->bands[IEEE80211_BAND_2GHZ]->ht_cap, hw_dev_cap,
-			cfg_11n->param.supported_mcs_set);
+			cfg_11n->param.supported_mcs_set,
+			fw_info->hw_mpdu_density);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 		woal_cfg80211_setup_vht_cap(
 			priv, &wiphy->bands[IEEE80211_BAND_2GHZ]->vht_cap);
@@ -9748,7 +9816,8 @@ static mlan_status woal_cfg80211_init_wiphy(moal_private *priv,
 		}
 		woal_cfg80211_setup_ht_cap(
 			&wiphy->bands[IEEE80211_BAND_5GHZ]->ht_cap, hw_dev_cap,
-			cfg_11n->param.supported_mcs_set);
+			cfg_11n->param.supported_mcs_set,
+			fw_info->hw_mpdu_density);
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
 		woal_cfg80211_setup_vht_cap(
 			priv, &wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap);
@@ -9784,7 +9853,8 @@ static mlan_status woal_cfg80211_init_wiphy(moal_private *priv,
 	}
 #endif
 	if (IS_CARD9098(priv->phandle->card_type) ||
-	    IS_CARD9097(priv->phandle->card_type)) {
+	    IS_CARD9097(priv->phandle->card_type) ||
+	    IS_CARDIW62X(priv->phandle->card_type)) {
 		woal_cfg80211_notify_antcfg(priv, wiphy, radio);
 	}
 	wiphy->available_antennas_tx = radio->param.ant_cfg.tx_antenna;
@@ -10248,7 +10318,8 @@ mlan_status woal_register_cfg80211(moal_private *priv)
 		(t_u8 *)&priv->extended_capabilities;
 	wiphy->extended_capabilities_len = sizeof(priv->extended_capabilities);
 #endif
-	woal_cfg80211_init_wiphy(priv, wiphy, MOAL_IOCTL_WAIT);
+
+	woal_cfg80211_init_wiphy(priv, wiphy, &fw_info, MOAL_IOCTL_WAIT);
 	if (wiphy_register(wiphy) < 0) {
 		PRINTM(MERROR, "Wiphy device registration failed!\n");
 		ret = MLAN_STATUS_FAILURE;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap.c b/mxm_wifiex/wlan_src/mlinux/moal_uap.c
index 8a033ba..fe5d259 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap.c
@@ -432,7 +432,7 @@ static int woal_uap_band_steer(struct net_device *dev, struct ifreq *req)
 	}
 	DBG_HEXDUMP(MCMD_D, "band_steer_para", (t_u8 *)&param, sizeof(param));
 
-	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_band_steer_cfg));
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (ioctl_req == NULL) {
 		LEAVE();
 		return -ENOMEM;
@@ -508,8 +508,7 @@ static int woal_uap_beacon_stuck(struct net_device *dev, struct ifreq *req)
 	DBG_HEXDUMP(MCMD_D, "beacon_stuck_detect_para", (t_u8 *)&param,
 		    sizeof(param));
 
-	ioctl_req = woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_beacon_stuck_param_cfg));
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
 	if (ioctl_req == NULL) {
 		LEAVE();
 		return -ENOMEM;
@@ -918,7 +917,7 @@ static int woal_uap_domain_info(struct net_device *dev, struct ifreq *req)
 	DBG_HEXDUMP(MCMD_D, "domain_info_para", (t_u8 *)&param, sizeof(param));
 	if (param.action) {
 		/* get tlv header */
-		if (copy_from_user(tlv, req->ifr_data + sizeof(param),
+		if (copy_from_user(&tlv[0], req->ifr_data + sizeof(param),
 				   TLV_HEADER_LEN)) {
 			PRINTM(MERROR, "Copy from user failed\n");
 			ret = -EFAULT;
@@ -1550,7 +1549,12 @@ static int woal_uap_hs_cfg(struct net_device *dev, struct ifreq *req,
 	    (hs_cfg.conditions != HOST_SLEEP_CFG_CANCEL ||
 	     invoke_hostcmd == MFALSE)) {
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "ERR: failed in getting bss info\n");
+			ret = -EFAULT;
+			goto done;
+		}
 		if (bss_info.is_hs_configured) {
 			PRINTM(MERROR, "HS already configured\n");
 			ret = -EFAULT;
@@ -1561,8 +1565,12 @@ static int woal_uap_hs_cfg(struct net_device *dev, struct ifreq *req,
 	if (hs_cfg.flags & HS_CFG_FLAG_SET) {
 		action = MLAN_ACT_SET;
 		if (hs_cfg.flags != HS_CFG_FLAG_ALL) {
-			woal_set_get_hs_params(priv, MLAN_ACT_GET,
-					       MOAL_IOCTL_WAIT, &hscfg);
+			if (MLAN_STATUS_SUCCESS !=
+			    woal_set_get_hs_params(priv, MLAN_ACT_GET,
+						   MOAL_IOCTL_WAIT, &hscfg)) {
+				PRINTM(MERROR,
+				       "Unable to get HS Configuration\n");
+			}
 		}
 		if (hs_cfg.flags & HS_CFG_FLAG_CONDITION)
 			hscfg.conditions = hs_cfg.conditions;
@@ -1919,7 +1927,8 @@ static int woal_uap_antenna_cfg(struct net_device *dev, struct ifreq *req)
 		radio->param.ant_cfg.rx_antenna = antenna_config.rx_mode;
 #if defined(STA_CFG80211) || defined(UAP_CFG80211)
 		if (IS_CARD9098(priv->phandle->card_type) ||
-		    IS_CARD9097(priv->phandle->card_type)) {
+		    IS_CARD9097(priv->phandle->card_type) ||
+		    IS_CARDIW62X(priv->phandle->card_type)) {
 			if (IS_STA_CFG80211(
 				    priv->phandle->params.cfg80211_wext))
 				woal_cfg80211_notify_antcfg(
@@ -2103,27 +2112,8 @@ int woal_11h_chan_dfs_state(moal_private *priv, t_u8 action,
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_11h_cfg *ds_11hcfg = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
-#ifdef UAP_CFG80211
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-	int cfg80211_wext = priv->phandle->params.cfg80211_wext;
-#endif
-#endif
 
 	ENTER();
-#ifdef UAP_CFG80211
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
-	if (action == MLAN_ACT_GET) {
-		if (IS_UAP_CFG80211(cfg80211_wext)) {
-			ret = woal_get_wiphy_chan_dfs_state(
-				priv->phandle->wiphy, ch_dfs_state);
-			if (!ret) {
-				LEAVE();
-				return ret;
-			}
-		}
-	}
-#endif
-#endif
 	req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_11h_cfg));
 	if (req == NULL) {
 		ret = -ENOMEM;
@@ -2222,9 +2212,41 @@ static int woal_uap_get_dfs_chan(t_u8 pri_chan, t_u8 bw,
 
 #ifdef UAP_CFG80211
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+/**
+ * @brief update channel dfs state in mlan module
+ *
+ * @param channel         given radar channel
+ * @param dfs_state       dfs_state
+ *
+ * @return                N/A
+ */
+void woal_set_channel_dfs_state(t_u8 channel, t_u8 dfs_state)
+{
+	int index;
+	mlan_ds_11h_chan_dfs_state ch_dfs_state;
+	moal_private *priv;
+	memset(&ch_dfs_state, 0, sizeof(ch_dfs_state));
+	ch_dfs_state.channel = channel;
+	ch_dfs_state.dfs_state = dfs_state;
+	for (index = 0; index < MAX_MLAN_ADAPTER; index++) {
+		if (m_handle[index]) {
+			priv = woal_get_priv(m_handle[index],
+					     MLAN_BSS_ROLE_UAP);
+			if (priv) {
+				if (woal_11h_chan_dfs_state(priv, MLAN_ACT_SET,
+							    &ch_dfs_state))
+					PRINTM(MERROR,
+					       "Set DFS state for chan:%d failed\n",
+					       ch_dfs_state.channel);
+			}
+		}
+	}
+}
+
 /**
  * @brief update channel dfs state to all wiphy
  *
+ * @param priv     Pointer to the moal_private driver data struct
  * @param channel         given radar channel
  * @param bandwidth       channel's bandwidth
  * @param dfs_state       dfs_state
@@ -2247,9 +2269,62 @@ void woal_update_channels_dfs_state(moal_private *priv, t_u8 channel,
 						      dfs_state);
 		}
 	}
+	for (i = 0; i < n_chan; i++) {
+		woal_set_channel_dfs_state(ch_dfs_state[i].channel, dfs_state);
+	}
 	LEAVE();
 	return;
 }
+
+/**
+ * @brief reset uap channel dfs_state to DFS_USABLE
+ *
+ * @param priv     Pointer to the moal_private driver data struct
+ *
+ * @return                N/A
+ */
+void woal_update_uap_channel_dfs_state(moal_private *priv)
+{
+	mlan_ds_11h_chan_dfs_state ch_dfs_state;
+	t_u8 channel;
+	t_u8 bandwidth;
+	ENTER();
+	if (woal_is_etsi_country(priv->phandle->country_code)) {
+		LEAVE();
+		return;
+	}
+	if (priv->bss_role == MLAN_BSS_ROLE_UAP && priv->bss_started &&
+	    priv->uap_host_based) {
+		channel = priv->chan.chan->hw_value;
+		memset(&ch_dfs_state, 0, sizeof(ch_dfs_state));
+		ch_dfs_state.channel = channel;
+		if (woal_11h_chan_dfs_state(priv, MLAN_ACT_GET,
+					    &ch_dfs_state)) {
+			PRINTM(MERROR, "%s: woal_11h_chan_dfs_state failed \n",
+			       __func__);
+			LEAVE();
+			return;
+		}
+
+		if (ch_dfs_state.dfs_required &&
+		    ch_dfs_state.dfs_state == DFS_AVAILABLE) {
+			switch (priv->chan.width) {
+			case NL80211_CHAN_WIDTH_40:
+				bandwidth = CHAN_BW_40MHZ;
+				break;
+			case NL80211_CHAN_WIDTH_80:
+				bandwidth = CHAN_BW_80MHZ;
+				break;
+			default:
+				bandwidth = CHAN_BW_20MHZ;
+				break;
+			}
+			woal_update_channels_dfs_state(priv, channel, bandwidth,
+						       DFS_USABLE);
+		}
+	}
+	LEAVE();
+}
 #endif
 #endif
 
@@ -2713,7 +2788,12 @@ static int woal_uap_radio_ctl(struct net_device *dev, struct ifreq *req)
 	} else {
 		/* Get radio status */
 		memset(&bss_info, 0, sizeof(bss_info));
-		woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+			PRINTM(MERROR, "ERR: failed in getting bss info\n");
+			ret = -EFAULT;
+			goto done;
+		}
 
 		data[1] = bss_info.radio_on;
 		if (copy_to_user(req->ifr_data, data, sizeof(data))) {
@@ -3160,7 +3240,8 @@ static int woal_uap_get_sta_list_ioctl(struct net_device *dev,
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap.h b/mxm_wifiex/wlan_src/mlinux/moal_uap.h
index 8f5b699..5719f66 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap.h
@@ -28,9 +28,6 @@ Change log:
 #ifndef _MOAL_UAP_H
 #define _MOAL_UAP_H
 
-/** Maximum buffer length for WOAL_UAP_SET_GET_256_CHAR */
-#define MAX_BUF_LEN 256
-
 /** Private command ID to send ioctl */
 #define UAP_IOCTL_CMD (SIOCDEVPRIVATE + 2)
 /** Updating ADDBA variables */
@@ -546,6 +543,7 @@ int woal_11h_chan_dfs_state(moal_private *priv, t_u8 action,
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 void woal_update_channels_dfs_state(moal_private *priv, t_u8 channel,
 				    t_u8 bandwidth, t_u8 dfs_state);
+void woal_update_uap_channel_dfs_state(moal_private *priv);
 #endif
 #endif
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
index 27cb610..798a8b9 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
@@ -3,7 +3,7 @@
  * @brief This file contains the functions for uAP CFG80211.
  *
  *
- * Copyright 2011-2022 NXP
+ * Copyright 2011-2023 NXP
  *
  * This software file (the File) is distributed by NXP
  * under the terms of the GNU General Public License Version 2, June 1991
@@ -108,7 +108,8 @@ static int woal_deauth_assoc_station(moal_private *priv, u8 *mac_addr,
 	}
 
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		LEAVE();
 		return -ENOMEM;
@@ -178,7 +179,8 @@ static int woal_deauth_all_station(moal_private *priv)
 	PRINTM(MIOCTL, "del all station\n");
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -241,6 +243,9 @@ static t_u8 woal_check_rsn_ie(IEEEtypes_Rsn_t *rsn_ie,
 		break;
 	}
 	count = woal_le16_to_cpu(rsn_ie->pairwise_cipher.count);
+	if (count < 1)
+		return MFALSE;
+
 	for (i = 0; i < count; i++) {
 		switch (rsn_ie->pairwise_cipher.list[i].type) {
 		case WPA_CIPHER_TKIP:
@@ -318,6 +323,9 @@ static t_u8 woal_check_wpa_ie(IEEEtypes_Wpa_t *wpa_ie,
 		break;
 	}
 	count = woal_le16_to_cpu(wpa_ie->pairwise_cipher.count);
+	if (count < 1)
+		return MFALSE;
+
 	for (i = 0; i < count; i++) {
 		switch (wpa_ie->pairwise_cipher.list[i].type) {
 		case WPA_CIPHER_TKIP:
@@ -576,6 +584,11 @@ static t_u8 woal_check_11ax_capability(moal_private *priv, t_u8 band,
 	else
 		enable_11ax = MFALSE;
 #else
+	if (priv->phandle->params.auto_11ax == 0) {
+		PRINTM(MCMND, "auto_11ax is disabled\n");
+		LEAVE();
+		return enable_11ax;
+	}
 	memset(&he_cfg, 0, sizeof(he_cfg));
 	if (band == BAND_5GHZ)
 		he_cfg.band = MBIT(1);
@@ -788,9 +801,12 @@ static void woal_set_uap_rates(moal_private *priv, mlan_uap_bss_param *bss_cfg,
 	pIEEEtypes_Header_t ext_rate_ie;
 	int var_offset = offsetof(struct ieee80211_mgmt, u.beacon.variable);
 	const u8 *var_pos = head_ie + var_offset;
-	int len = head_len - var_offset;
+	int len = 0;
 	int rate_len = 0;
 
+	if (var_offset > head_len)
+		return;
+	len = head_len - var_offset;
 	rate_ie = (void *)woal_parse_ie_tlv(var_pos, len, WLAN_EID_SUPP_RATES);
 	if (rate_ie) {
 		memset(bss_cfg->rates, 0, sizeof(bss_cfg->rates));
@@ -880,17 +896,16 @@ static int woal_cfg80211_beacon_config(moal_private *priv,
 	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
 	ie = ((struct cfg80211_ap_settings *)params)->beacon.tail;
-	ie_len = ((struct cfg80211_ap_settings *)params)->beacon.tail_len;
+	ie_len = (int)((struct cfg80211_ap_settings *)params)->beacon.tail_len;
 #else
 	ie = ((struct beacon_parameters *)params)->tail;
-	ie_len = ((struct beacon_parameters *)params)->tail_len;
+	ie_len = (int)((struct beacon_parameters *)params)->tail_len;
 #endif
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
-	wapi_ie = (t_u8 *)woal_parse_ie_tlv(params->beacon.tail,
-					    params->beacon.tail_len, WAPI_IE);
+	wapi_ie =
+		(t_u8 *)woal_parse_ie_tlv(params->beacon.tail, ie_len, WAPI_IE);
 #else
-	wapi_ie = (t_u8 *)woal_parse_ie_tlv(params->tail, params->tail_len,
-					    WAPI_IE);
+	wapi_ie = (t_u8 *)woal_parse_ie_tlv(params->tail, ie_len, WAPI_IE);
 #endif
 	if (wapi_ie) {
 		wapi_ie_len = *(wapi_ie + 1) + 2;
@@ -1357,12 +1372,23 @@ static int woal_cfg80211_beacon_config(moal_private *priv,
 		/*find and set wmm ie*/
 		woal_set_wmm_ies(priv, ie, ie_len, sys_config);
 	}
-	/* If the security mode is configured as WEP or WPA-PSK,
-	 * it will disable 11n automatically, and if configured as
-	 * open(off) or wpa2-psk, it will automatically enable 11n */
-	if ((sys_config->protocol == PROTOCOL_STATIC_WEP) ||
-	    (sys_config->protocol == PROTOCOL_WPA))
+
+	/** If the security mode is configured as WEP or
+	 * WPA/WPA2 with TKIP only, disable 11n*/
+	if (sys_config->protocol == PROTOCOL_STATIC_WEP)
 		enable_11n = MFALSE;
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+	else if (sys_config->protocol & (PROTOCOL_WPA | PROTOCOL_WPA2)) {
+		if ((params->crypto.wpa_versions & NL80211_WPA_VERSION_1) &&
+		    sys_config->wpa_cfg.pairwise_cipher_wpa == CIPHER_TKIP)
+			enable_11n = MFALSE;
+
+		if ((params->crypto.wpa_versions & NL80211_WPA_VERSION_2) &&
+		    sys_config->wpa_cfg.pairwise_cipher_wpa2 == CIPHER_TKIP)
+			enable_11n = MFALSE;
+	}
+#endif
+
 	if (!enable_11n) {
 		if (woal_set_uap_ht_tx_cfg(priv, sys_config->bandcfg, ht_cap,
 					   MFALSE)) {
@@ -1394,7 +1420,7 @@ static int woal_cfg80211_beacon_config(moal_private *priv,
 		woal_uap_set_11ac_status(priv, MLAN_ACT_DISABLE, vht20_40,
 					 NULL);
 	}
-	if (enable_11ax && enable_11n) {
+	if (enable_11ax) {
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
 		hecap_ie = (IEEEtypes_HECap_t *)woal_parse_ext_ie_tlv(
 			ie, ie_len, HE_CAPABILITY);
@@ -1548,7 +1574,7 @@ static int woal_cfg80211_add_mon_if(struct wiphy *wiphy,
 		chan_info.channel = 1;
 		chan_info.is_11n_enabled = MTRUE;
 	}
-	mon_if->flag = 0x7;
+	mon_if->flag = handle->params.mon_filter;
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_set_net_monitor(priv, MOAL_IOCTL_WAIT, MTRUE, mon_if->flag,
 				 &mon_if->band_chan_cfg)) {
@@ -1860,10 +1886,13 @@ int woal_cfg80211_add_virt_if(struct wiphy *wiphy,
 	/* Initialize priv structure */
 	woal_init_priv(new_priv, MOAL_IOCTL_WAIT);
 	/** Init to GO/CLIENT mode */
-	if (type == NL80211_IFTYPE_P2P_CLIENT)
-		woal_cfg80211_init_p2p_client(new_priv);
-	else if (type == NL80211_IFTYPE_P2P_GO)
-		woal_cfg80211_init_p2p_go(new_priv);
+	if (type == NL80211_IFTYPE_P2P_CLIENT) {
+		if (woal_cfg80211_init_p2p_client(new_priv))
+			PRINTM(MERROR, "%s: Fail to init p2p go", __func__);
+	} else if (type == NL80211_IFTYPE_P2P_GO) {
+		if (woal_cfg80211_init_p2p_go(new_priv))
+			PRINTM(MERROR, "%s: Fail to init p2p client", __func__);
+	}
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
 	ret = cfg80211_register_netdevice(ndev);
 #else
@@ -2730,19 +2759,16 @@ int woal_cfg80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 	if (priv->bss_started == MTRUE) {
 		if (woal_uap_bss_ctrl(priv, MOAL_NO_WAIT, UAP_BSS_STOP)) {
 			PRINTM(MERROR, "%s: stop uap failed \n", __func__);
-			ret = -EFAULT;
 			goto done;
 		}
 		if (woal_uap_bss_ctrl(priv, MOAL_NO_WAIT, UAP_BSS_RESET)) {
 			PRINTM(MERROR, "%s: reset uap failed \n", __func__);
-			ret = -EFAULT;
 			goto done;
 		}
 		/* Set WLAN MAC addresses */
 		if (MLAN_STATUS_FAILURE ==
 		    woal_request_set_mac_address(priv, MOAL_NO_WAIT)) {
 			PRINTM(MERROR, "Set MAC address failed\n");
-			ret = -EFAULT;
 			goto done;
 		}
 #if CFG80211_VERSION_CODE < KERNEL_VERSION(4, 20, 0)
@@ -2754,10 +2780,11 @@ int woal_cfg80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 	if (!woal_is_any_interface_active(priv->phandle)) {
 		pmpriv = woal_get_priv((moal_handle *)priv->phandle,
 				       MLAN_BSS_ROLE_STA);
-		if (pmpriv)
+		if (pmpriv && !priv->phandle->user_scan_cfg) {
 			woal_set_scan_time(pmpriv, ACTIVE_SCAN_CHAN_TIME,
 					   PASSIVE_SCAN_CHAN_TIME,
 					   SPECIFIC_SCAN_CHAN_TIME);
+		}
 	}
 #endif
 
@@ -2829,12 +2856,14 @@ int woal_cfg80211_change_bss(struct wiphy *wiphy, struct net_device *dev,
 				PRINTM(MERROR, "%s: stop uap failed \n",
 				       __func__);
 		}
+
 		if (params->use_short_preamble == 1)
 			sys_config->preamble_type = 1;
 		else if (params->use_short_preamble == 0)
 			sys_config->preamble_type = 2;
 		else
 			sys_config->preamble_type = 0;
+
 		if (MLAN_STATUS_SUCCESS ==
 		    woal_set_get_sys_config(priv, MLAN_ACT_SET, MOAL_IOCTL_WAIT,
 					    sys_config))
@@ -2966,7 +2995,8 @@ int woal_uap_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -3065,7 +3095,8 @@ int woal_uap_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
 
 	/* Allocate an IOCTL request buffer */
 	ioctl_req = (mlan_ioctl_req *)woal_alloc_mlan_ioctl_req(
-		sizeof(mlan_ds_get_info));
+		sizeof(mlan_ds_get_info) +
+		(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 	if (ioctl_req == NULL) {
 		ret = -ENOMEM;
 		goto done;
@@ -3467,9 +3498,7 @@ static void woal_switch_uap_channel(moal_private *priv, t_u8 wait_option)
 	priv->channel = uap_channel.channel;
 	moal_memcpy_ext(priv->phandle, &priv->chan, &priv->csa_chan,
 			sizeof(struct cfg80211_chan_def), sizeof(priv->chan));
-#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
-	cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0, 0);
-#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 1, 0) && IMX_ANDROID_13))
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
 	cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0, 0);
 #elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(5, 19, 2)) || IMX_ANDROID_13)
 	cfg80211_ch_switch_notify(priv->netdev, &priv->chan, 0);
@@ -3575,7 +3604,7 @@ int woal_cfg80211_start_radar_detection(struct wiphy *wiphy,
 	mlan_status status = MLAN_STATUS_SUCCESS;
 	chan_band_info channel;
 	t_u16 enable = 0;
-
+	t_u8 event_buf[64] = {0};
 	ENTER();
 
 #if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
@@ -3597,6 +3626,9 @@ int woal_cfg80211_start_radar_detection(struct wiphy *wiphy,
 		ret = -EBUSY;
 		goto done;
 	}
+	snprintf(event_buf, sizeof(event_buf) - 1, "%s %d", CUS_EVT_CAC_START,
+		 chandef->chan->hw_value);
+	woal_broadcast_event(priv, event_buf, strlen(event_buf));
 	if (MLAN_STATUS_SUCCESS ==
 	    woal_mc_policy_cfg(priv, &enable, MOAL_IOCTL_WAIT, MLAN_ACT_GET)) {
 		if (enable) {
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
index c74e542..aa4dc78 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_wext.c
@@ -197,7 +197,7 @@ static int woal_get_name(struct net_device *dev, struct iw_request_info *info,
 {
 	char *cwrq = wrqu->name;
 	ENTER();
-	strcpy(cwrq, "IEEE 802.11-DS");
+	strncpy(cwrq, "IEEE 802.11-DS", IFNAMSIZ);
 	LEAVE();
 	return 0;
 }
@@ -224,7 +224,11 @@ static int woal_get_wap(struct net_device *dev, struct iw_request_info *info,
 	if (priv->bss_started)
 		moal_memcpy_ext(priv->phandle, awrq->sa_data,
 				priv->current_addr, MLAN_MAC_ADDR_LENGTH,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				sizeof(awrq->sa_data_min));
+#else
 				sizeof(awrq->sa_data));
+#endif
 	else
 		memset(awrq->sa_data, 0, MLAN_MAC_ADDR_LENGTH);
 	awrq->sa_family = ARPHRD_ETHER;
@@ -401,7 +405,7 @@ static int woal_get_freq(struct net_device *dev, struct iw_request_info *info,
 		return -EFAULT;
 	}
 
-	band = (ap_cfg->bandcfg.chanBand == BAND_5GHZ);
+	band = (((ap_cfg->bandcfg.chanBand == BAND_5GHZ) ? 1 : 0));
 	fwrq->m = (long)channel_to_frequency(ap_cfg->channel, band);
 	fwrq->i = (long)ap_cfg->channel;
 	fwrq->e = 6;
@@ -1126,7 +1130,8 @@ static int woal_set_mlme(struct net_device *dev, struct iw_request_info *info,
 		if (!memcmp(bc_addr, sta_addr, ETH_ALEN)) {
 			PRINTM(MIOCTL, "Deauth all stations\n");
 			req = woal_alloc_mlan_ioctl_req(
-				sizeof(mlan_ds_get_info));
+				sizeof(mlan_ds_get_info) +
+				(MAX_STA_LIST_IE_SIZE * MAX_NUM_CLIENTS));
 			if (req == NULL) {
 				LEAVE();
 				return -ENOMEM;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_usb.c b/mxm_wifiex/wlan_src/mlinux/moal_usb.c
index 0f5d3fd..16ccf1a 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.c
@@ -35,7 +35,7 @@ extern struct semaphore AddRemoveCardSem;
 ********************************************************/
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
+	defined(USB8978) || defined(USBIW62X)
 /** Card-type detection frame response */
 typedef struct {
 	/** 32-bit ACK+WINNER field */
@@ -95,10 +95,10 @@ static struct usb_device_id woal_usb_table[] = {
 	{NXP_USB_DEVICE(USB9097_VID_1, USB9097_PID_1, "NXP WLAN USB Adapter")},
 	{NXP_USB_DEVICE(USB9097_VID_1, USB9097_PID_2, "NXP WLAN USB Adapter")},
 #endif
-#ifdef USBNW62X
-	{NXP_USB_DEVICE(USBNW62X_VID_1, USBNW62X_PID_1,
+#ifdef USBIW62X
+	{NXP_USB_DEVICE(USBIW62X_VID_1, USBIW62X_PID_1,
 			"NXP WLAN USB Adapter")},
-	{NXP_USB_DEVICE(USBNW62X_VID_1, USBNW62X_PID_2,
+	{NXP_USB_DEVICE(USBIW62X_VID_1, USBIW62X_PID_2,
 			"NXP WLAN USB Adapter")},
 #endif
 	/* Terminating entry */
@@ -128,8 +128,8 @@ static struct usb_device_id woal_usb_table_skip_fwdnld[] = {
 #ifdef USB9097
 	{NXP_USB_DEVICE(USB9097_VID_1, USB9097_PID_2, "NXP WLAN USB Adapter")},
 #endif
-#ifdef USBNW62X
-	{NXP_USB_DEVICE(USBNW62X_VID_1, USBNW62X_PID_2,
+#ifdef USBIW62X
+	{NXP_USB_DEVICE(USBIW62X_VID_1, USBIW62X_PID_2,
 			"NXP WLAN USB Adapter")},
 #endif
 	/* Terminating entry */
@@ -497,19 +497,20 @@ rx_ret:
 ********************************************************/
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
+	defined(USB8978) || defined(USBIW62X)
 /**
  *  @brief  Check chip revision
  *
  *  @param handle        A pointer to moal_handle structure
  *  @param usb_chip_rev  A pointer to usb_chip_rev variable
  *  @param usb_strap     A pointer to usb_strap
+ *  @param boot_mode     A pointer to boot_mode
  *
  *  @return 	   	 MLAN_STATUS_SUCCESS or MLAN_STATUS_FAILURE
  */
 static mlan_status woal_check_chip_revision(moal_handle *handle,
 					    t_u32 *usb_chip_rev,
-					    t_u32 *usb_strap)
+					    t_u32 *usb_strap, t_u32 *boot_mode)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 	mlan_buffer mbuf;
@@ -582,7 +583,7 @@ static mlan_status woal_check_chip_revision(moal_handle *handle,
 	ack_pkt.strap = woal_le32_to_cpu(ack_pkt.strap);
 
 	if ((ack_pkt.extend & 0xffff0000) == EXTEND_HDR) {
-		extend_ver = ack_pkt.extend & 0x0000ffff;
+		extend_ver = ack_pkt.extend & 0x000000ff;
 		*usb_chip_rev = ack_pkt.chip_rev & 0x000000ff;
 		if (extend_ver >= EXTEND_V2) {
 			PRINTM(MINFO, "chip_rev=0x%x, strap=0x%x\n",
@@ -590,6 +591,8 @@ static mlan_status woal_check_chip_revision(moal_handle *handle,
 			*usb_strap = ack_pkt.strap & 0x7;
 		} else
 			PRINTM(MINFO, "chip_rev=0x%x\n", *usb_chip_rev);
+		if (extend_ver >= EXTEND_V3)
+			*boot_mode = (ack_pkt.extend & 0x0000ff00) >> 8;
 	}
 cleanup:
 	kfree(recv_buff);
@@ -807,18 +810,18 @@ static t_u16 woal_update_card_type(t_void *card)
 					strlen(KERN_VERSION));
 	}
 #endif
-#ifdef USBNW62X
+#ifdef USBIW62X
 	if (woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    (__force __le16)USBNW62X_PID_1 ||
+		    (__force __le16)USBIW62X_PID_1 ||
 	    woal_cpu_to_le16(cardp_usb->udev->descriptor.idProduct) ==
-		    (__force __le16)USBNW62X_PID_2) {
-		card_type = CARD_TYPE_USBNW62X;
-		moal_memcpy_ext(NULL, driver_version, CARD_USBNW62X,
-				strlen(CARD_USBNW62X), strlen(driver_version));
+		    (__force __le16)USBIW62X_PID_2) {
+		card_type = CARD_TYPE_USBIW62X;
+		moal_memcpy_ext(NULL, driver_version, CARD_USBIW62X,
+				strlen(CARD_USBIW62X), strlen(driver_version));
 		moal_memcpy_ext(NULL,
 				driver_version + strlen(INTF_CARDTYPE) +
 					strlen(KERN_VERSION),
-				V17, strlen(V17),
+				V18, strlen(V18),
 				strlen(driver_version) - strlen(INTF_CARDTYPE) -
 					strlen(KERN_VERSION));
 	}
@@ -890,9 +893,9 @@ static int woal_usb_probe(struct usb_interface *intf,
 #ifdef USB9097
 			case (__force __le16)USB9097_PID_1:
 #endif /* USB9097 */
-#ifdef USBNW62X
-			case (__force __le16)USBNW62X_PID_1:
-#endif /* USBNW62X */
+#ifdef USBIW62X
+			case (__force __le16)USBIW62X_PID_1:
+#endif /* USBIW62X */
 
 				/* If skip FW is set, we must return error so
 				 * the next driver can download the FW */
@@ -920,9 +923,9 @@ static int woal_usb_probe(struct usb_interface *intf,
 #ifdef USB9097
 			case (__force __le16)USB9097_PID_2:
 #endif /* USB9097 */
-#ifdef USBNW62X
-			case (__force __le16)USBNW62X_PID_2:
-#endif /* USBNW62X */
+#ifdef USBIW62X
+			case (__force __le16)USBIW62X_PID_2:
+#endif /* USBIW62X */
 
 				usb_cardp->boot_state = USB_FW_READY;
 				break;
@@ -2040,9 +2043,10 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 {
 	mlan_status ret = MLAN_STATUS_SUCCESS;
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
+	defined(USB8978) || defined(USBIW62X)
 	t_u32 revision_id = 0;
 	t_u32 strap = 0;
+	t_u32 boot_mode = 0;
 #endif
 	struct usb_card_rec *cardp = (struct usb_card_rec *)handle->card;
 #if defined(USB9098)
@@ -2060,8 +2064,9 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 #endif
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USBNW62X)
-	ret = woal_check_chip_revision(handle, &revision_id, &strap);
+	defined(USB8978) || defined(USBIW62X)
+	ret = woal_check_chip_revision(handle, &revision_id, &strap,
+				       &boot_mode);
 	if (ret != MLAN_STATUS_SUCCESS) {
 		PRINTM(MFATAL, "Chip revision check failure!\n");
 		ret = MLAN_STATUS_FAILURE;
@@ -2073,22 +2078,26 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 #ifdef USB8997
 	if (IS_USB8997(handle->card_type)) {
 		if (strap == CARD_TYPE_USB_UART)
-			strcpy(handle->card_info->fw_name,
-			       USBUART8997_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUART8997_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 		else if (strap != 0)
-			strcpy(handle->card_info->fw_name,
-			       USBUSB8997_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUSB8997_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 	}
 #endif
 
 #ifdef USB8978
 	if (IS_USB8978(handle->card_type)) {
 		if (strap == CARD_TYPE_USB_UART)
-			strcpy(handle->card_info->fw_name,
-			       USBUART8978_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUART8978_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 		else if (strap != 0)
-			strcpy(handle->card_info->fw_name,
-			       USBUSB8978_DEFAULT_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUSB8978_DEFAULT_COMBO_FW_NAME,
+				FW_NAMW_MAX_LEN);
 	}
 #endif
 
@@ -2097,10 +2106,12 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 		if (cardp->second_mac) {
 			ref_handle = (moal_handle *)handle->pref_mac;
 			if (ref_handle) {
-				strcpy(handle->card_info->fw_name,
-				       ref_handle->card_info->fw_name);
-				strcpy(handle->card_info->fw_name_wlan,
-				       ref_handle->card_info->fw_name_wlan);
+				strncpy(handle->card_info->fw_name,
+					ref_handle->card_info->fw_name,
+					FW_NAMW_MAX_LEN);
+				strncpy(handle->card_info->fw_name_wlan,
+					ref_handle->card_info->fw_name_wlan,
+					FW_NAMW_MAX_LEN);
 			}
 			goto done;
 		}
@@ -2108,28 +2119,32 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 		case USB9098_Z1Z2:
 			if (strap != 0) {
 				if (strap == CARD_TYPE_USB_UART)
-					strcpy(handle->card_info->fw_name,
-					       USBUART9098_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUART9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       USBUSB9098_DEFAULT_COMBO_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUSB9098_DEFAULT_COMBO_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       USB9098_DEFAULT_WLAN_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				USB9098_DEFAULT_WLAN_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		case USB9098_A0:
 		case USB9098_A1:
 		case USB9098_A2:
 			if (strap != 0) {
 				if (strap == CARD_TYPE_USB_UART)
-					strcpy(handle->card_info->fw_name,
-					       USBUART9098_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUART9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       USBUSB9098_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUSB9098_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       USB9098_WLAN_V1_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				USB9098_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		}
 	}
@@ -2141,26 +2156,30 @@ static mlan_status woal_usb_get_fw_name(moal_handle *handle)
 		case USB9097_B1:
 			if (strap != 0) {
 				if (strap == CARD_TYPE_USB_UART)
-					strcpy(handle->card_info->fw_name,
-					       USBUART9097_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUART9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 				else
-					strcpy(handle->card_info->fw_name,
-					       USBUSB9097_COMBO_V1_FW_NAME);
+					strncpy(handle->card_info->fw_name,
+						USBUSB9097_COMBO_V1_FW_NAME,
+						FW_NAMW_MAX_LEN);
 			}
-			strcpy(handle->card_info->fw_name_wlan,
-			       USB9097_WLAN_V1_FW_NAME);
+			strncpy(handle->card_info->fw_name_wlan,
+				USB9097_WLAN_V1_FW_NAME, FW_NAMW_MAX_LEN);
 			break;
 		}
 	}
 #endif
-#ifdef USBNW62X
-	if (IS_USBNW62X(handle->card_type)) {
+#ifdef USBIW62X
+	if (IS_USBIW62X(handle->card_type)) {
+		if (boot_mode == 0x03)
+			PRINTM(MMSG, "wlan: USB-IW62X in secure-boot mode\n");
 		if (strap == CARD_TYPE_USB_UART)
-			strcpy(handle->card_info->fw_name,
-			       USBUARTNW62X_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUARTIW62X_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
 		else
-			strcpy(handle->card_info->fw_name,
-			       USBUSBNW62X_COMBO_FW_NAME);
+			strncpy(handle->card_info->fw_name,
+				USBUSBIW62X_COMBO_FW_NAME, FW_NAMW_MAX_LEN);
 	}
 #endif
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_usb.h b/mxm_wifiex/wlan_src/mlinux/moal_usb.h
index 5e10133..7a03364 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_usb.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_usb.h
@@ -89,14 +89,14 @@ Change Log:
 #define USB9097_PID_2 0x2061
 #endif /* USB9097 */
 
-#ifdef USBNW62X
+#ifdef USBIW62X
 /** USB VID 1 */
-#define USBNW62X_VID_1 0x0471
+#define USBIW62X_VID_1 0x0471
 /** USB PID 1 */
-#define USBNW62X_PID_1 0x020E
+#define USBIW62X_PID_1 0x020E
 /** USB PID 2 */
-#define USBNW62X_PID_2 0x020F
-#endif /* USBNW62X */
+#define USBIW62X_PID_2 0x020F
+#endif /* USBIW62X */
 
 /** Boot state: FW download */
 #define USB_FW_DNLD 1
@@ -110,7 +110,7 @@ Change Log:
 #define MVUSB_RX_DATA_URB 6
 
 #if defined(USB8997) || defined(USB9098) || defined(USB9097) ||                \
-	defined(USB8978) || defined(USB8801) || defined(USBNW62X)
+	defined(USB8978) || defined(USB8801) || defined(USBIW62X)
 /* Transmit buffer size for chip revision check */
 #define CHIP_REV_TX_BUF_SIZE 16
 /* Receive buffer size for chip revision check */
@@ -120,6 +120,7 @@ Change Log:
 #define EXTEND_HDR (0xAB950000)
 #define EXTEND_V1 (0x00000001)
 #define EXTEND_V2 (0x00000002)
+#define EXTEND_V3 (0x00000003)
 #ifdef USB8801
 #define USB8801_DEFAULT_WLAN_FW_NAME "nxp/usb8801_uapsta.bin"
 #endif /* USB8801 */
@@ -171,12 +172,12 @@ Change Log:
 #define USBUSB9097_COMBO_V1_FW_NAME "nxp/usbusbiw620_combo_v1.bin"
 #endif /* USB9097 */
 
-#ifdef USBNW62X
-#define USBNW62X_DEFAULT_COMBO_FW_NAME "nxp/usbusbnw62x_combo.bin"
-#define USBUARTNW62X_COMBO_FW_NAME "nxp/usbuartnw62x_combo.bin"
-#define USBUSBNW62X_COMBO_FW_NAME "nxp/usbusbnw62x_combo.bin"
-#define USBNW62X_DEFAULT_WLAN_FW_NAME "nxp/usbnw62x_wlan.bin"
-#endif /* USBNW62X */
+#ifdef USBIW62X
+#define USBIW62X_DEFAULT_COMBO_FW_NAME "nxp/usbusbiw62x_combo.bin"
+#define USBUARTIW62X_COMBO_FW_NAME "nxp/usbuartiw62x_combo.bin"
+#define USBUSBIW62X_COMBO_FW_NAME "nxp/usbusbiw62x_combo.bin"
+#define USBIW62X_DEFAULT_WLAN_FW_NAME "nxp/usbiw62x_wlan.bin"
+#endif /* USBIW62X */
 
 /** urb context */
 typedef struct _urb_context {
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_wext.c b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
index 60697ac..f37f485 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_wext.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_wext.c
@@ -417,7 +417,7 @@ static int woal_get_name(struct net_device *dev, struct iw_request_info *info,
 {
 	char *cwrq = wrqu->name;
 	ENTER();
-	strcpy(cwrq, "IEEE 802.11-DS");
+	strncpy(cwrq, "IEEE 802.11-DS", IFNAMSIZ);
 	LEAVE();
 	return 0;
 }
@@ -608,15 +608,24 @@ static int woal_get_wap(struct net_device *dev, struct iw_request_info *info,
 
 	memset(&bss_info, 0, sizeof(bss_info));
 
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		ret = -EFAULT;
+		goto done;
+	}
 
 	if (bss_info.media_connected == MTRUE)
 		moal_memcpy_ext(priv->phandle, awrq->sa_data, &bss_info.bssid,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				MLAN_MAC_ADDR_LENGTH,
+				sizeof(awrq->sa_data_min));
+#else
 				MLAN_MAC_ADDR_LENGTH, sizeof(awrq->sa_data));
+#endif
 	else
 		memset(awrq->sa_data, 0, MLAN_MAC_ADDR_LENGTH);
 	awrq->sa_family = ARPHRD_ETHER;
-
+done:
 	LEAVE();
 	return ret;
 }
@@ -804,6 +813,7 @@ static int woal_set_txpow(struct net_device *dev, struct iw_request_info *info,
 	mlan_power_cfg_t power_cfg;
 
 	ENTER();
+	memset(&power_cfg, 0, sizeof(mlan_power_cfg_t));
 	if (vwrq_->disabled) {
 		woal_set_radio(priv, 0);
 		goto done;
@@ -851,7 +861,11 @@ static int woal_get_txpow(struct net_device *dev, struct iw_request_info *info,
 
 	memset(&power_cfg, 0, sizeof(mlan_power_cfg_t));
 	memset(&bss_info, 0, sizeof(bss_info));
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		ret = -EFAULT;
+		goto done;
+	}
 
 	if (MLAN_STATUS_SUCCESS !=
 	    woal_set_get_tx_power(priv, MLAN_ACT_GET, &power_cfg)) {
@@ -1264,6 +1278,8 @@ static int woal_set_rate(struct net_device *dev, struct iw_request_info *info,
 
 	ENTER();
 
+	memset(&rate_cfg, 0, sizeof(mlan_rate_cfg_t));
+
 	if (vwrq->value == -1) {
 		rate_cfg.is_rate_auto = 1;
 	} else {
@@ -1972,6 +1988,7 @@ static int woal_get_range(struct net_device *dev, struct iw_request_info *info,
 	mlan_chan_list *pchan_list = NULL;
 	mlan_bss_info bss_info;
 	gfp_t flag;
+	int ret = 0;
 
 	ENTER();
 
@@ -2101,7 +2118,11 @@ static int woal_get_range(struct net_device *dev, struct iw_request_info *info,
 
 	memset(&bss_info, 0, sizeof(bss_info));
 
-	woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info);
+	if (MLAN_STATUS_SUCCESS !=
+	    woal_get_bss_info(priv, MOAL_IOCTL_WAIT, &bss_info)) {
+		ret = -EFAULT;
+		goto done;
+	}
 
 	range->txpower[0] = bss_info.min_power_level;
 	range->txpower[1] = bss_info.max_power_level;
@@ -2112,8 +2133,9 @@ static int woal_get_range(struct net_device *dev, struct iw_request_info *info,
 	range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
 			  IW_ENC_CAPA_CIPHER_CCMP | IW_ENC_CAPA_CIPHER_TKIP;
 #endif
+done:
 	LEAVE();
-	return 0;
+	return ret;
 }
 
 #ifdef MEF_CFG_RX_FILTER
@@ -2216,7 +2238,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2234,11 +2256,12 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "%s rssi %d\n", bss_info.ssid.ssid,
-				      signal.bcn_rssi_avg) +
+			len = snprintf(buf, MAX_BUF_LEN, "%s rssi %d\n",
+				       bss_info.ssid.ssid,
+				       signal.bcn_rssi_avg) +
 			      1;
 		} else {
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		}
 	} else if (strncmp(buf, "LINKSPEED", strlen("LINKSPEED")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -2247,14 +2270,15 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 			goto done;
 		}
 		PRINTM(MIOCTL, "tx rate=%d\n", (int)rate.rate);
-		len = sprintf(buf, "LinkSpeed %d\n",
-			      (int)(rate.rate * 500000 / 1000000)) +
+		len = snprintf(buf, MAX_BUF_LEN, "LinkSpeed %d\n",
+			       (int)(rate.rate * 500000 / 1000000)) +
 		      1;
 	} else if (strncmp(buf, "MACADDR", strlen("MACADDR")) == 0) {
-		len = sprintf(buf, "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
-			      priv->current_addr[0], priv->current_addr[1],
-			      priv->current_addr[2], priv->current_addr[3],
-			      priv->current_addr[4], priv->current_addr[5]) +
+		len = snprintf(buf, MAX_BUF_LEN,
+			       "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
+			       priv->current_addr[0], priv->current_addr[1],
+			       priv->current_addr[2], priv->current_addr[3],
+			       priv->current_addr[4], priv->current_addr[5]) +
 		      1;
 	} else if (strncmp(buf, "GETPOWER", strlen("GETPOWER")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -2262,7 +2286,9 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "powermode = %d\n", power_mode) + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "powermode = %d\n",
+			       power_mode) +
+		      1;
 	} else if (strncmp(buf, "SCAN-ACTIVE", strlen("SCAN-ACTIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_ACTIVE)) {
@@ -2271,7 +2297,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_ACTIVE;
 		PRINTM(MIOCTL, "Set Active Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SCAN-PASSIVE", strlen("SCAN-PASSIVE")) == 0) {
 		if (MLAN_STATUS_SUCCESS !=
 		    woal_set_scan_type(priv, MLAN_SCAN_TYPE_PASSIVE)) {
@@ -2280,7 +2306,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 		}
 		priv->scan_type = MLAN_SCAN_TYPE_PASSIVE;
 		PRINTM(MIOCTL, "Set Passive Scan\n");
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "POWERMODE", strlen("POWERMODE")) == 0) {
 		if (dwrq->length > strlen("POWERMODE") + 1) {
 			pdata = buf + strlen("POWERMODE") + 1;
@@ -2291,7 +2317,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 					goto done;
 				}
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2311,7 +2337,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (memcmp(buf, WEXT_CSCAN_HEADER, strlen(WEXT_CSCAN_HEADER)) ==
 		   0) {
 		PRINTM(MIOCTL, "Set Combo Scan\n");
@@ -2320,38 +2346,38 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "GETBAND", strlen("GETBAND")) == 0) {
 		if (MLAN_STATUS_SUCCESS != woal_get_band(priv, &band)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "Band %d\n", band) + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "Band %d\n", band) + 1;
 	} else if (strncmp(buf, "SETBAND", strlen("SETBAND")) == 0) {
 		pband = buf + strlen("SETBAND") + 1;
 		if (MLAN_STATUS_SUCCESS != woal_set_band(priv, pband)) {
 			ret = -EFAULT;
 			goto done;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "START", strlen("START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "STOP", strlen("STOP")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "SETSUSPENDOPT", strlen("SETSUSPENDOPT")) ==
 		   0) {
 		/* it will be done by GUI */
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXMODE", strlen("BTCOEXMODE")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-START",
 			   strlen("BTCOEXSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BTCOEXSCAN-STOP", strlen("BTCOEXSCAN-STOP")) ==
 		   0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-START", strlen("BGSCAN-START")) == 0) {
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-CONFIG", strlen("BGSCAN-CONFIG")) ==
 		   0) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -2361,7 +2387,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 		}
 		priv->bg_scan_start = MTRUE;
 		priv->bg_scan_reported = MFALSE;
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "BGSCAN-STOP", strlen("BGSCAN-STOP")) == 0) {
 		if (priv->bg_scan_start && !priv->scan_cfg.rssi_threshold) {
 			if (MLAN_STATUS_SUCCESS !=
@@ -2372,7 +2398,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 			priv->bg_scan_start = MFALSE;
 			priv->bg_scan_reported = MFALSE;
 		}
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-START", strlen("RXFILTER-START")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -2380,7 +2406,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-STOP", strlen("RXFILTER-STOP")) ==
 		   0) {
 #ifdef MEF_CFG_RX_FILTER
@@ -2388,7 +2414,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 		if (ret)
 			goto done;
 #endif
-		len = sprintf(buf, "OK\n") + 1;
+		len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 	} else if (strncmp(buf, "RXFILTER-ADD", strlen("RXFILTER-ADD")) == 0) {
 		if (dwrq->length > strlen("RXFILTER-ADD") + 1) {
 			pdata = buf + strlen("RXFILTER-ADD") + 1;
@@ -2397,7 +2423,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2411,7 +2437,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2424,7 +2450,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2437,7 +2463,7 @@ static int woal_set_priv(struct net_device *dev, struct iw_request_info *info,
 				ret = -EFAULT;
 				goto done;
 			}
-			len = sprintf(buf, "OK\n") + 1;
+			len = snprintf(buf, MAX_BUF_LEN, "OK\n") + 1;
 		} else {
 			ret = -EFAULT;
 			goto done;
@@ -2493,7 +2519,9 @@ static mlan_status woal_wext_request_scan(moal_private *priv, t_u8 wait_option,
 				MLAN_MAX_SSID_LENGTH);
 		scan_req->ssid_list[0].max_len = 0;
 	}
-	woal_get_scan_config(priv, &scan_cfg);
+	if (MLAN_STATUS_SUCCESS != woal_get_scan_config(priv, &scan_cfg)) {
+		PRINTM(MERROR, "Unable to get scan configuration\n");
+	}
 	if (scan_cfg.scan_chan_gap)
 		scan_req->scan_chan_gap = scan_cfg.scan_chan_gap;
 	else
@@ -2621,7 +2649,8 @@ static int woal_owe_specific_scan(moal_private *priv,
 	scan_req->keep_previous_scan = MTRUE;
 	moal_memcpy_ext(priv->phandle, scan_req->ssid_list[0].ssid,
 			ssid_bssid->trans_ssid.ssid,
-			ssid_bssid->trans_ssid.ssid_len,
+			MIN(ssid_bssid->trans_ssid.ssid_len,
+			    MLAN_MAX_SSID_LENGTH),
 			sizeof(scan_req->ssid_list[0].ssid));
 	scan_req->ssid_list[0].max_len = 0;
 	scan_req->chan_list[0].chan_number = ssid_bssid->channel;
@@ -2786,8 +2815,12 @@ static int woal_set_essid(struct net_device *dev, struct iw_request_info *info,
 	mode = woal_get_mode(priv, MOAL_IOCTL_WAIT);
 	if (mode == IW_MODE_ADHOC)
 		/* disconnect before try to associate */
-		woal_disconnect(priv, MOAL_IOCTL_WAIT, NULL,
-				DEF_DEAUTH_REASON_CODE);
+		if (MLAN_STATUS_SUCCESS !=
+		    woal_disconnect(priv, MOAL_IOCTL_WAIT, NULL,
+				    DEF_DEAUTH_REASON_CODE)) {
+			PRINTM(MERROR,
+			       "Disconnect before association failed\n");
+		}
 
 	if (mode != IW_MODE_ADHOC) {
 		if (MLAN_STATUS_SUCCESS !=
@@ -3032,7 +3065,11 @@ static int woal_get_scan(struct net_device *dev, struct iw_request_info *info,
 		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
 		moal_memcpy_ext(priv->phandle, iwe.u.ap_addr.sa_data,
 				&scan_table[i].mac_address, ETH_ALEN,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
+				sizeof(iwe.u.ap_addr.sa_data_min));
+#else
 				sizeof(iwe.u.ap_addr.sa_data));
+#endif
 
 		iwe.len = IW_EV_ADDR_LEN;
 		current_ev = IWE_STREAM_ADD_EVENT(info, current_ev, end_buf,
@@ -3150,8 +3187,8 @@ static int woal_get_scan(struct net_device *dev, struct iw_request_info *info,
 		/* Beacon Interval */
 		memset(&iwe, 0, sizeof(iwe));
 		ptr = buf;
-		ptr += sprintf(ptr, "Beacon interval=%d",
-			       scan_table[i].beacon_period);
+		ptr += snprintf(ptr, MAX_BUF_LEN, "Beacon interval=%d",
+				scan_table[i].beacon_period);
 
 		iwe.u.data.length = strlen(buf);
 		iwe.cmd = IWEVCUSTOM;
@@ -3226,12 +3263,12 @@ static int woal_get_scan(struct net_device *dev, struct iw_request_info *info,
 		memset(&iwe, 0, sizeof(iwe));
 		memset(buf, 0, buf_size);
 		ptr = buf;
-		ptr += sprintf(ptr, "band=");
+		ptr += snprintf(ptr, MAX_BUF_LEN, "band=");
 		memset(&iwe, 0, sizeof(iwe));
 		if (scan_table[i].bss_band == BAND_A)
-			sprintf(ptr, "a");
+			snprintf(ptr, MAX_BUF_LEN, "a");
 		else
-			sprintf(ptr, "bg");
+			snprintf(ptr, MAX_BUF_LEN, "bg");
 		iwe.u.data.length = strlen(buf);
 		PRINTM(MINFO, "iwe.u.data.length %d\n", iwe.u.data.length);
 		PRINTM(MINFO, "BUF: %s\n", buf);