Merge "dxe: Update setting Kick DXE, ring empty sequence"
diff --git a/CORE/HDD/inc/wlan_hdd_assoc.h b/CORE/HDD/inc/wlan_hdd_assoc.h
index 979addb..10f3c62 100644
--- a/CORE/HDD/inc/wlan_hdd_assoc.h
+++ b/CORE/HDD/inc/wlan_hdd_assoc.h
@@ -131,6 +131,7 @@
 VOS_STATUS hdd_roamRegisterTDLSSTA( hdd_adapter_t *pAdapter,
                                     tANI_U8 *peerMac, tANI_U16 staId, tANI_U8 ucastSig);
 void hdd_PerformRoamSetKeyComplete(hdd_adapter_t *pAdapter);
+VOS_STATUS hdd_roamDeregisterTDLSSTA(hdd_adapter_t *pAdapter, tANI_U8 staId);
 
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 void hdd_indicateEseBcnReportNoResults(const hdd_adapter_t *pAdapter,
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index 61b4e03..a965faf 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -103,7 +103,6 @@
 /** Maximum time(ms)to wait for disconnect to complete **/
 #define WLAN_WAIT_TIME_DISCONNECT  2000
 #define WLAN_WAIT_TIME_STATS       800
-#define WLAN_WAIT_TIME_FRAME_LOG   2000
 #define WLAN_WAIT_TIME_POWER       800
 #define WLAN_WAIT_TIME_COUNTRY     1000
 #define WLAN_WAIT_TIME_CHANNEL_UPDATE   600
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index 3e4d5ba..bed4281 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -505,6 +505,7 @@
     if (auth_resp_len == 0)
     {
         hddLog(LOGE, "%s: AuthRsp FTIES is of length 0", __func__);
+        kfree(buff);
         return;
     }
 
@@ -1068,6 +1069,10 @@
                 }
             }
 #endif
+               if ((roamStatus == eCSR_ROAM_LOSTLINK) &&
+                    !pRoamInfo->reasonCode)
+                   wlan_hdd_get_frame_logs(pAdapter,
+                                WLAN_HDD_GET_FRAME_LOG_CMD_SEND_AND_CLEAR);
             /*Only send indication to kernel if not initiated by kernel*/
             if ( sendDisconInd )
             {
@@ -1892,7 +1897,8 @@
                     MAC_ADDR_ARRAY(pWextState->req_bssId),
                     roamResult, roamStatus);
 
-        wlan_hdd_get_frame_logs(pAdapter,
+        if ( eCSR_ROAM_ASSOCIATION_FAILURE == roamStatus)
+            wlan_hdd_get_frame_logs(pAdapter,
                                 WLAN_HDD_GET_FRAME_LOG_CMD_SEND_AND_CLEAR);
 
         /* Set connection state to eConnectionState_NotConnected only when CSR
@@ -2831,7 +2837,7 @@
     return( vosStatus );
 }
 
-static VOS_STATUS hdd_roamDeregisterTDLSSTA( hdd_adapter_t *pAdapter, tANI_U8 staId )
+VOS_STATUS hdd_roamDeregisterTDLSSTA( hdd_adapter_t *pAdapter, tANI_U8 staId )
 {
     VOS_STATUS vosStatus;
     vosStatus = WLANTL_ClearSTAClient( (WLAN_HDD_GET_CTX(pAdapter))->pvosContext, staId );
@@ -3300,7 +3306,6 @@
                        before the ENTER_BMPS_REQ ensures Listen Interval is
                        regained back to LI * Modulated DTIM */
                     hdd_set_pwrparams(pHddCtx);
-                    pHddStaCtx->hdd_ReassocScenario = VOS_FALSE;
 
                     /* At this point, device should not be in BMPS;
                        if due to unexpected scenario, if we are in BMPS,
@@ -3315,6 +3320,21 @@
                                          eSME_FULL_PWR_NEEDED_BY_HDD);
                     }
                 }
+
+                if ((pHddCtx) &&
+                     FULL_POWER == pmcGetPmcState(pHddCtx->hHal) &&
+                     VOS_TRUE == pHddStaCtx->hdd_ReassocScenario)
+                {
+                    hddLog( LOG1, FL("Device in full power."
+                           "Stop and start traffic timer for roaming"));
+                    pmcStopTrafficTimer(pHddCtx->hHal);
+                    if (pmcStartTrafficTimer(pHddCtx->hHal,
+                        TRAFFIC_TIMER_ROAMING) != eHAL_STATUS_SUCCESS)
+                    {
+                       hddLog(LOGP, FL("Cannot start traffic timer"));
+                    }
+                }
+
                 halStatus = hdd_RoamSetKeyCompleteHandler( pAdapter, pRoamInfo, roamId, roamStatus, roamResult );
                 pHddStaCtx->hdd_ReassocScenario = FALSE;
             }
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 136c39c..98ba4c4 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -2310,11 +2310,14 @@
             * 9 byte will have band setting value */
            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                     "%s: SetBandCommand Info  comm %s UL %d, TL %d", __func__, command, priv_data.used_len, priv_data.total_len);
-           /* Change band request received */
-           ret = hdd_setBand_helper(pAdapter->dev, ptr);
-           if(ret < 0)
-               VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                   "%s: failed to set band ret=%d", __func__, ret);
+           if(VOS_FTM_MODE != hdd_get_conparam())
+           {
+               /* Change band request received */
+               ret = hdd_setBand_helper(pAdapter->dev, ptr);
+               if(ret < 0)
+                   VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                       "%s: failed to set band ret=%d", __func__, ret);
+           }
        }
        else if(strncmp(command, "SETWMMPS", 8) == 0)
        {
@@ -2457,7 +2460,8 @@
                             TRACE_CODE_HDD_GETROAMTRIGGER_IOCTL,
                             pAdapter->sessionId, lookUpThreshold));
            len = scnprintf(extra, sizeof(extra), "%s %d", command, rssi);
-           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           len = VOS_MIN(priv_data.total_len, len + 1);
+           if (copy_to_user(priv_data.buf, &extra, len))
            {
                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "%s: failed to copy data to user buffer", __func__);
diff --git a/CORE/HDD/src/wlan_hdd_p2p.c b/CORE/HDD/src/wlan_hdd_p2p.c
index a4448a9..8210ed2 100644
--- a/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/CORE/HDD/src/wlan_hdd_p2p.c
@@ -194,7 +194,6 @@
             pRemainChanCtx->rem_on_chan_request,
             pRemainChanCtx->chan.center_freq,
             pRemainChanCtx->cookie);
-    cfgState->remain_on_chan_ctx = NULL;
     vos_timer_stop(&pRemainChanCtx->hdd_remain_on_chan_timer);
     vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
     mutex_unlock(&pHddCtx->roc_lock);
@@ -250,6 +249,7 @@
     }
     vos_mem_free( pRemainChanCtx );
     pRemainChanCtx = NULL;
+    cfgState->remain_on_chan_ctx = NULL;
     if (eHAL_STATUS_SUCCESS != status)
         complete(&pAdapter->rem_on_chan_ready_event);
     complete(&pAdapter->cancel_rem_on_chan_var);
diff --git a/CORE/HDD/src/wlan_hdd_tdls.c b/CORE/HDD/src/wlan_hdd_tdls.c
index f3ce0f7..78ff6d7 100644
--- a/CORE/HDD/src/wlan_hdd_tdls.c
+++ b/CORE/HDD/src/wlan_hdd_tdls.c
@@ -43,6 +43,8 @@
 #include <net/ieee80211_radiotap.h>
 #include "wlan_hdd_tdls.h"
 #include "wlan_hdd_cfg80211.h"
+#include "wlan_hdd_assoc.h"
+#include "sme_Api.h"
 #include "vos_sched.h"
 
 static tANI_S32 wlan_hdd_get_tdls_discovery_peer_cnt(tdlsCtx_t *pHddTdlsCtx);
@@ -75,8 +77,7 @@
 void wlan_hdd_tdls_disable_offchan_and_teardown_links(hdd_context_t *hddctx)
 {
     u16 connected_tdls_peers = 0;
-    u8 staidx;
-    hddTdlsPeer_t *curr_peer = NULL;
+    u8 staIdx;
     hdd_adapter_t *adapter = NULL;
 
     if (eTDLS_SUPPORT_NOT_ENABLED == hddctx->tdls_mode) {
@@ -92,51 +93,36 @@
     }
 
     connected_tdls_peers = wlan_hdd_tdlsConnectedPeers(adapter);
+    if (!connected_tdls_peers) {
+         hddLog(LOG1, FL("No TDLS connected peers to delete TDLS peers"));
+         return;
+    }
 
-    if (!connected_tdls_peers)
-        return ;
+    /*Send Msg to PE for deleting all the TDLS peers*/
+    sme_DeleteAllTDLSPeers(hddctx->hHal, adapter->sessionId);
+    /* 0 staIdx is assigned to AP we dont want to touch that */
+    for ( staIdx = 0; staIdx < HDD_MAX_NUM_TDLS_STA; staIdx++ )
+    {
+        if (hddctx->tdlsConnInfo[staIdx].staId)
+        {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
+                    ("hdd_tdlsStatusUpdate: staIdx %d " MAC_ADDRESS_STR),
+                    hddctx->tdlsConnInfo[staIdx].staId,
+                    MAC_ADDR_ARRAY(hddctx->tdlsConnInfo[staIdx].peerMac.bytes));
+            wlan_hdd_tdls_reset_peer(
+                                adapter,
+                                hddctx->tdlsConnInfo[staIdx].peerMac.bytes);
+            hdd_roamDeregisterTDLSSTA(adapter,
+                                      hddctx->tdlsConnInfo[staIdx].staId );
+            wlan_hdd_tdls_decrement_peer_count(adapter);
 
-    /* TDLS is not supported in case of concurrency
-     * Disable TDLS Offchannel to avoid more than two concurrent channels.
-     */
-    if (connected_tdls_peers == 1) {
-        curr_peer = wlan_hdd_tdls_get_connected_peer(adapter);
-        if (curr_peer && (curr_peer->isOffChannelConfigured == TRUE)) {
-            hddLog(LOG1, FL("%s: Concurrency detected, Disable "
-                                 "TDLS channel switch"), __func__);
-
-            curr_peer->isOffChannelEstablished = FALSE;
-            sme_SendTdlsChanSwitchReq(WLAN_HDD_GET_HAL_CTX(adapter),
-                                         adapter->sessionId,
-                                         curr_peer->peerMac,
-                                         curr_peer->peerParams.channel,
-                                         TDLS_OFF_CHANNEL_BW_OFFSET,
-                                         TDLS_CHANNEL_SWITCH_DISABLE);
+            vos_mem_zero(&hddctx->tdlsConnInfo[staIdx].peerMac,
+                    sizeof(v_MACADDR_t)) ;
+            hddctx->tdlsConnInfo[staIdx].staId = 0 ;
+            hddctx->tdlsConnInfo[staIdx].sessionId = 255;
         }
     }
-
-    /* As mentioned above TDLS is not supported in case of concurrency
-     * Find the connected peer and generate TDLS teardown indication to
-     * supplicant.
-     */
-    for (staidx = 0; staidx < HDD_MAX_NUM_TDLS_STA; staidx++) {
-        if (!hddctx->tdlsConnInfo[staidx].staId)
-            continue;
-
-        curr_peer = wlan_hdd_tdls_find_all_peer(hddctx,
-                                   hddctx->tdlsConnInfo[staidx].peerMac.bytes);
-
-        if (!curr_peer)
-            continue;
-
-        hddLog(LOG1, FL("indicate TDLS teardown (staId %d)"),
-                                         curr_peer->staId);
-
-        wlan_hdd_tdls_indicate_teardown(
-                                    curr_peer->pHddTdlsCtx->pAdapter,
-                                    curr_peer,
-                                    eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
-    }
+    wlan_hdd_tdls_check_bmps(adapter);
     wlan_hdd_tdls_set_mode(hddctx, eTDLS_SUPPORT_DISABLED, FALSE);
     hddLog(LOG1, FL("TDLS Support Disabled"));
 }
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 644865f..52fc9ac 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -925,50 +925,6 @@
 
    return VOS_STATUS_SUCCESS;
 }
-
-static void hdd_GetFrameLogCB( void *pContext )
-{
-   struct getFrameLogCtx *pGetFrameLogCtx;
-   hdd_adapter_t *pAdapter;
-
-   if (NULL == pContext)
-   {
-      hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pContext [%p]", __func__, pContext);
-      return;
-   }
-
-   pGetFrameLogCtx = pContext;
-   pAdapter        = pGetFrameLogCtx->pAdapter;
-
-   /* there is a race condition that exists between this callback
-      function and the caller since the caller could time out either
-      before or while this code is executing.  we use a spinlock to
-      serialize these actions */
-   spin_lock(&hdd_context_lock);
-
-   if (GET_FRAME_LOG_MAGIC != pGetFrameLogCtx->magic)
-   {
-      /* the caller presumably timed out so there is nothing we can do */
-      spin_unlock(&hdd_context_lock);
-      hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
-              __func__, pAdapter, pGetFrameLogCtx->magic);
-      return;
-   }
-
-   /* context is valid so caller is still waiting */
-
-   /* paranoia: invalidate the magic */
-   pGetFrameLogCtx->magic = 0;
-
-   /* notify the caller */
-   complete(&pGetFrameLogCtx->completion);
-
-   /* serialization is complete */
-   spin_unlock(&hdd_context_lock);
-}
-
 /**---------------------------------------------------------------------------
 
   \brief wlan_hdd_get_frame_logs() -
@@ -984,10 +940,8 @@
   --------------------------------------------------------------------------*/
 VOS_STATUS wlan_hdd_get_frame_logs(hdd_adapter_t *pAdapter, v_U8_t flag)
 {
-   struct getFrameLogCtx context;
    hdd_context_t *pHddCtx;
    eHalStatus hstatus;
-   long lrc;
 
    if (NULL == pAdapter)
    {
@@ -1018,31 +972,12 @@
       return VOS_STATUS_E_INVAL;
    }
 
-   init_completion(&context.completion);
-   context.pAdapter = pAdapter;
-   context.magic = GET_FRAME_LOG_MAGIC;
-
-   hstatus = sme_GetFramesLog(pHddCtx->hHal, hdd_GetFrameLogCB,
-                         flag, &context);
+   hstatus = sme_GetFramesLog(pHddCtx->hHal, flag);
    if (eHAL_STATUS_SUCCESS != hstatus)
    {
        hddLog(VOS_TRACE_LEVEL_ERROR,"%s: Unable to get Frame Logs", __func__);
+       return VOS_STATUS_E_FAILURE;
    }
-   else
-   {
-       /* request was sent -- wait for the response */
-       lrc = wait_for_completion_interruptible_timeout(&context.completion,
-                                    msecs_to_jiffies(WLAN_WAIT_TIME_FRAME_LOG));
-       if (lrc <= 0)
-       {
-          hddLog(VOS_TRACE_LEVEL_ERROR, "%s: SME %s while fetching Frame logs",
-                 __func__, (0 == lrc) ? "timeout" : "interrupt");
-       }
-   }
-
-   spin_lock(&hdd_context_lock);
-   context.magic = 0;
-   spin_unlock(&hdd_context_lock);
 
    return VOS_STATUS_SUCCESS;
 }
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index 8ad7d2e..4b14650 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -3728,10 +3728,7 @@
 {
     tANI_U16               msgType;
     tANI_U16               msgLen;
-    tGetFrameLogCallback   getFramelogCallback;
-    void                   *pDevContext;       //device context
     tANI_U8                getFrameLogCmdFlag;
-    tANI_U32               rspStatus;
 } tAniGetFrameLogReq,      *tpAniGetFrameLogReq;
 
 
@@ -5579,4 +5576,11 @@
     tANI_U16    msgLen;     // length of the entire request
     tANI_U8     SetTdls2040BSSCoex; //enabled or disabled
 } tAniSetTdls2040BSSCoex, *tpAniSetTdls2040BSSCoex;
+
+typedef struct
+{
+    tANI_U16   mesgType;
+    tANI_U16   mesgLen;
+    tSirMacAddr bssid;
+}tSirDelAllTdlsPeers, *ptSirDelAllTdlsPeers;
 #endif /* __SIR_API_H */
diff --git a/CORE/MAC/inc/wniApi.h b/CORE/MAC/inc/wniApi.h
index f55c15e..f76249c 100644
--- a/CORE/MAC/inc/wniApi.h
+++ b/CORE/MAC/inc/wniApi.h
@@ -378,6 +378,7 @@
     eWNI_SME_UPDATE_MAX_RATE_IND,
     eWNI_SME_NAN_EVENT,
     eWNI_SME_SET_TDLS_2040_BSSCOEX_REQ,
+    eWNI_SME_DEL_ALL_TDLS_PEERS,
     eWNI_SME_MSG_TYPES_END
 };
 
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index f72c3dd..10c0a7b 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -2229,6 +2229,12 @@
          limMsg->bodyptr = NULL;
         break;
 
+    case eWNI_SME_DEL_ALL_TDLS_PEERS:
+         limProcessSmeDelAllTdlsPeers(pMac, limMsg->bodyptr);
+         vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+         limMsg->bodyptr = NULL;
+         break;
+
     default:
         vos_mem_free((v_VOID_t*)limMsg->bodyptr);
         limMsg->bodyptr = NULL;
diff --git a/CORE/MAC/src/pe/lim/limProcessTdls.c b/CORE/MAC/src/pe/lim/limProcessTdls.c
index 3528d0e..eb2b694 100644
--- a/CORE/MAC/src/pe/lim/limProcessTdls.c
+++ b/CORE/MAC/src/pe/lim/limProcessTdls.c
@@ -3847,3 +3847,59 @@
     return eSIR_SUCCESS;
 }
 
+tSirRetStatus limProcessSmeDelAllTdlsPeers(tpAniSirGlobal pMac,
+                                                 tANI_U32 *pMsgBuf)
+{
+    tSirDelAllTdlsPeers *pMsg = NULL;
+    tpDphHashNode pStaDs = NULL ;
+    tpPESession psessionEntry = NULL;
+    uint8_t sessionId;
+    int i, aid;
+    pMsg = (tSirDelAllTdlsPeers*) pMsgBuf ;
+
+    if (pMsg == NULL) {
+        limLog(pMac, LOGE, FL("NULL pMsg"));
+        return eSIR_FAILURE;
+    }
+
+    psessionEntry = peFindSessionByBssid(pMac, pMsg->bssid, &sessionId);
+    if (NULL == psessionEntry)
+    {
+        limLog(pMac, LOGE, FL("NULL psessionEntry"));
+        return eSIR_FAILURE;
+    }
+
+    /* Check all the set bit in peerAIDBitmap and delete the
+     * peer (with that aid) entry from the hash table and add
+     * the aid in free pool
+     */
+    for (i = 0; i < sizeof(psessionEntry->peerAIDBitmap)/sizeof(tANI_U32); i++)
+    {
+        for (aid = 0; aid < (sizeof(tANI_U32) << 3); aid++)
+        {
+            if (CHECK_BIT(psessionEntry->peerAIDBitmap[i], aid))
+            {
+                pStaDs = dphGetHashEntry(pMac,
+                                         (aid + i*(sizeof(tANI_U32) << 3)),
+                                         &psessionEntry->dph.dphHashTable);
+                if (NULL != pStaDs)
+                {
+                    limLog(pMac, LOGE, FL("Deleting "MAC_ADDRESS_STR),
+                           MAC_ADDR_ARRAY(pStaDs->staAddr));
+
+                    limSendDeauthMgmtFrame(pMac,
+                                           eSIR_MAC_DEAUTH_LEAVING_BSS_REASON,
+                                           pStaDs->staAddr, psessionEntry,
+                                           FALSE);
+                    dphDeleteHashEntry(pMac, pStaDs->staAddr, pStaDs->assocId,
+                                       &psessionEntry->dph.dphHashTable);
+                }
+                limReleasePeerIdx(pMac, (aid + i*(sizeof(tANI_U32) << 3)),
+                                  psessionEntry) ;
+                CLEAR_BIT(psessionEntry->peerAIDBitmap[i], aid);
+            }
+        }
+    }
+
+    return eSIR_SUCCESS;
+}
diff --git a/CORE/MAC/src/pe/lim/limTypes.h b/CORE/MAC/src/pe/lim/limTypes.h
index f7847ac..f3ee585 100644
--- a/CORE/MAC/src/pe/lim/limTypes.h
+++ b/CORE/MAC/src/pe/lim/limTypes.h
@@ -1085,5 +1085,7 @@
 void limProcessMlmSpoofMacAddrRsp(tpAniSirGlobal pMac, tSirRetStatus rspStatus);
 tSirRetStatus limProcessSmeSetTdls2040BSSCoexReq(tpAniSirGlobal pMac,
                                                  tANI_U32 *pMsgBuf);
+tSirRetStatus limProcessSmeDelAllTdlsPeers(tpAniSirGlobal pMac,
+                                           tANI_U32 *pMsgBuf);
 #endif /* __LIM_TYPES_H */
 
diff --git a/CORE/SAP/src/sapApiLinkCntl.c b/CORE/SAP/src/sapApiLinkCntl.c
index c3caaf5..91258cd 100644
--- a/CORE/SAP/src/sapApiLinkCntl.c
+++ b/CORE/SAP/src/sapApiLinkCntl.c
@@ -99,6 +99,9 @@
 /*----------------------------------------------------------------------------
  * Externalized Function Definitions
  * -------------------------------------------------------------------------*/
+#ifdef FEATURE_WLAN_CH_AVOID
+   extern safeChannelType safeChannels[];
+#endif /* FEATURE_WLAN_CH_AVOID */
 
 /*----------------------------------------------------------------------------
  * Function Declarations and Documentation
@@ -161,6 +164,19 @@
                    BAND(2.4GHz) as 2.4 channels are available in all the
                    countries*/
                    psapContext->channel = SAP_DEFAULT_CHANNEL;
+
+#ifdef FEATURE_WLAN_CH_AVOID
+                for( i = 0; i < NUM_20MHZ_RF_CHANNELS; i++ )
+                {
+                    if((NV_CHANNEL_ENABLE ==
+                        vos_nv_getChannelEnabledState(safeChannels[i].channelNumber))
+                            && (VOS_TRUE == safeChannels[i].isSafe))
+                    {
+                        psapContext->channel = safeChannels[i].channelNumber;
+                        break;
+                    }
+                }
+#endif
             }
         }
         else
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 87b4eb6..f7590c2 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -261,6 +261,10 @@
     tHalHandle hHal;
     tANI_U8   channel;
 
+#ifdef FEATURE_WLAN_CH_AVOID
+    v_U8_t i;
+#endif
+
     hHal = (tHalHandle)vos_get_context( VOS_MODULE_ID_SME, sapContext->pvosGCtx);
     if (NULL == hHal)
     {
@@ -347,14 +351,33 @@
                   sapContext->channel);
             /* In case of error, switch to default channel */
             sapContext->channel = SAP_DEFAULT_CHANNEL;
-
 #ifdef SOFTAP_CHANNEL_RANGE
             if(sapContext->channelList != NULL)
             {
-                sapContext->channel = sapContext->channelList[0];
-                vos_mem_free(sapContext->channelList);
-                sapContext->channelList = NULL;
+                for ( i = 0 ; i < sapContext->numofChannel ; i++)
+                    if (NV_CHANNEL_ENABLE ==
+                        vos_nv_getChannelEnabledState(sapContext->channelList[i]))
+                    {
+                        sapContext->channel = sapContext->channelList[i];
+                    }
+                    vos_mem_free(sapContext->channelList);
+                    sapContext->channelList = NULL;
             }
+#ifdef FEATURE_WLAN_CH_AVOID
+            else
+            {
+                for( i = 0; i < NUM_20MHZ_RF_CHANNELS; i++ )
+                {
+                    if((NV_CHANNEL_ENABLE ==
+                        vos_nv_getChannelEnabledState(safeChannels[i].channelNumber))
+                            && (VOS_TRUE == safeChannels[i].isSafe))
+                    {
+                        sapContext->channel = safeChannels[i].channelNumber;
+                        break;
+                    }
+                }
+            }
+#endif
 #endif
             /* Fill in the event structure */
             sapEventInit(sapEvent);
diff --git a/CORE/SME/inc/pmcApi.h b/CORE/SME/inc/pmcApi.h
index 7cabdde..4a1915f 100644
--- a/CORE/SME/inc/pmcApi.h
+++ b/CORE/SME/inc/pmcApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -56,6 +56,11 @@
 //should be large enough to allow the auth, DHCP handshake to complete
 #define BMPS_TRAFFIC_TIMER_ALLOW_SECURITY_DHCP 8000  //unit = ms
 
+//This timer value is used to start the timer right after key completion
+//during roaming. This should be small enough to allow STA to enter PS
+//immediately after key completion as no DHCP phase during roaming.
+#define TRAFFIC_TIMER_ROAMING 100  //unit = ms
+
 #define PMC_IS_CHIP_ACCESSIBLE(pmcState) ( (IMPS != (pmcState)) && (REQUEST_IMPS != (pmcState)) && \
        (STANDBY != (pmcState)) && (REQUEST_STANDBY != (pmcState)) )
 
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index dd6f005..86f7f1e 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -2179,14 +2179,10 @@
     \fn sme_GetFramesLog
     \brief a wrapper function that client calls to register a callback to get
            mgmt frames logged
-    \param callback - SME sends back the context using the callback
     \param flag - flag tells to clear OR send the frame log buffer
-    \param pContext - user context to be passed back along with the callback
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_GetFramesLog(tHalHandle hHal,
-                             tGetFrameLogCallback callback,
-                             tANI_U8 flag, void *pContext);
+eHalStatus sme_GetFramesLog(tHalHandle hHal, tANI_U8 flag);
 /* ---------------------------------------------------------------------------
 
   \fn    sme_InitMgmtFrameLogging
@@ -3702,5 +3698,5 @@
 tANI_BOOLEAN sme_handleSetFccChannel(tHalHandle hHal,
                                       tANI_U8 fcc_constraint);
 
-
+eHalStatus sme_DeleteAllTDLSPeers(tHalHandle hHal, uint8_t sessionId);
 #endif //#if !defined( __SME_API_H )
diff --git a/CORE/SME/src/csr/csrUtil.c b/CORE/SME/src/csr/csrUtil.c
index 49cfbbc..43df13a 100644
--- a/CORE/SME/src/csr/csrUtil.c
+++ b/CORE/SME/src/csr/csrUtil.c
@@ -2081,8 +2081,6 @@
    pMsg->msgType= pal_cpu_to_be16((tANI_U16)WDA_GET_FRAME_LOG_REQ);
    pMsg->msgLen= pal_cpu_to_be16(msgLen);
 
-   pMsg->pDevContext = pCommand->u.getFramelogCmd.pDevContext;
-   pMsg->getFramelogCallback= pCommand->u.getFramelogCmd.getFramelogCallback;
    pMsg->getFrameLogCmdFlag = pCommand->u.getFramelogCmd.getFrameLogCmdFlag;
 
    status = palSendMBMessage(pMac->hHdd, pMsg);
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 14776fd..e6d46a2 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -7495,14 +7495,10 @@
     \fn sme_GetFramesLog
     \brief a wrapper function that client calls to register a callback to get
            mgmt frames logged
-    \param callback - SME sends back the context using the callback
     \param flag - flag tells to clear OR send the frame log buffer
-    \param pContext - user context to be passed back along with the callback
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_GetFramesLog(tHalHandle hHal,
-                             tGetFrameLogCallback callback,
-                             tANI_U8 flag, void *pContext)
+eHalStatus sme_GetFramesLog(tHalHandle hHal, tANI_U8 flag)
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
    eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -7512,8 +7508,6 @@
    if (pGetFrameLogCmd)
    {
        pGetFrameLogCmd->command = eSmeCommandGetFrameLogRequest;
-       pGetFrameLogCmd->u.getFramelogCmd.pDevContext= pContext;
-       pGetFrameLogCmd->u.getFramelogCmd.getFramelogCallback= callback;
        pGetFrameLogCmd->u.getFramelogCmd.getFrameLogCmdFlag= flag;
 
        status = csrQueueSmeCommand(pMac, pGetFrameLogCmd, eANI_BOOLEAN_TRUE);
@@ -12681,3 +12675,25 @@
 
     return status;
 }
+
+eHalStatus sme_DeleteAllTDLSPeers(tHalHandle hHal, uint8_t sessionId)
+{
+    tSirDelAllTdlsPeers *pMsg;
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+
+    pMsg = vos_mem_malloc(sizeof(tSirDelAllTdlsPeers));
+    if (NULL == pMsg)
+    {
+        smsLog(pMac, LOGE, FL("memory alloc failed"));
+        return eHAL_STATUS_FAILURE;
+    }
+    vos_mem_set(pMsg, sizeof( tSirDelAllTdlsPeers ), 0);
+    pMsg->mesgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DEL_ALL_TDLS_PEERS);
+    pMsg->mesgLen = pal_cpu_to_be16((tANI_U16)sizeof( tSirDelAllTdlsPeers ));
+    vos_mem_copy(pMsg->bssid, pSession->connectedProfile.bssid,
+                 sizeof(tSirMacAddr));
+    status = palSendMBMessage( pMac->hHdd, pMsg );
+    return status;
+}
diff --git a/CORE/TL/src/wlan_qct_tl.c b/CORE/TL/src/wlan_qct_tl.c
index d49f151..dea51f9 100644
--- a/CORE/TL/src/wlan_qct_tl.c
+++ b/CORE/TL/src/wlan_qct_tl.c
@@ -1368,6 +1368,7 @@
      data to calculate RSSI. So to avoid reporting zero, we are initializing
      RSSI with RSSI saved in BssDescription during scanning. */
   pClientSTA->rssiAvg = rssi;
+  pClientSTA->rssiAvgBmps = rssi;
 #ifdef FEATURE_WLAN_TDLS
   if(WLAN_STA_TDLS == pClientSTA->wSTADesc.wSTAType)
   {
diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index 5dacc4e..486aaf1 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -5252,21 +5252,10 @@
       return;
    }
 
-   pGetFrameLogReqParams->rspStatus = wdiRsp->wdiStatus;
    if (wdiRsp->wdiStatus != WDI_STATUS_SUCCESS) {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
-              "%s:GetFrameLog with rsp status %d", __func__, wdiRsp->wdiStatus);
-   }
-
-   if(pGetFrameLogReqParams->getFramelogCallback)
-   {
-      pGetFrameLogReqParams->getFramelogCallback(
-                                       pGetFrameLogReqParams->pDevContext);
-   }
-   else
-   {
-      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
-                  "%s: pGetFrameLogReqParams callback is NULL", __func__);
+              "%s:GetFrameLog with rsp status %d flag %d", __func__,
+               wdiRsp->wdiStatus,pGetFrameLogReqParams->getFrameLogCmdFlag);
    }
 
    /* free WDI command buffer only */