prima: WLAN Driver Release 3.1.7.11

Incorporate Driver Releases 3.1.7.10 and 3.1.7.11

Release 3.1.7.10

Integrate the following CLs from Perforce:

633566: Do not drop beacons or probe response ever when in scan mode
If beacons or probe response is dropped for an AP, it can take upto 10
seconds to connect to an AP as the AP will not be discovered until
next scan cycle.  There was logic to throttle/drop incomming frames
even during scan and not overhwhelm PE and VOSS Message wrappers which
was done in Gen6 days. With the new MSMs, faster processing power and
and removal of SDIO, host should be able to handle and process all
frames fast enough.  Therefore do not ever drop beacons or probe
response frames when we are in scan mode.  (CR 368500)

633567: Fix BMPS issues which prevent disconnect after missed beacon
1. In missed beacon scenario, BMPS request from PMC must not be
allowed by PE. This is because DUT has exited BMPS to probe the AP and
if probe has not completed, BMPS must not be allowed.
2. When ENTER BMPS is rejected or ENTER BMPS fails, make sure
heartbeat timer is always running. This is just a fail safe check to
ensure we do not ever land in a situation where DUT is out of BMPS and
also out of AP's range but heartbeat timer is deactivated for some
reason. If that happens, link will never be torn down and device will
always keep trying to enter BMPS unsuccessfully.
3. Introduce a new eSIR_SME_BMPS_REQ_REJECT which implies that request
is rejected by PE.  eSIR_SME_BMPS_REQ_FAILED now implies that request
was denied by Riva. This will help us in debugging.  (CR 367659)

633809: Change value of MAX_SCAN_SSID
While doing cfg80211 interface registeration with kernel, we are
filling wiphy->max_scan_ssids parameter with MAX_SCAN_SSID value
(MAX_SCAN_SSID =2). So During combo scan wpa_supplicant is not able to
send more then 2 profile to host driver. As host driver supporting 9
max ssid. MAX_SCAN_SSID has value set to 9 while registering the
cfg80211 interface.  (CR 365219)

634012, 634018, 634021, 634163: Legacy Fast Roaming Feature (CR 362782)

634148: Fix SSR race condition in cfg80211 APIs and BTAMP
cfg80211 APIs are blocked when SSR is going on; there could be various
race conditions in WLAN driver if these APIs are not blocked during
SSR. Some of them are already SSR protected, adding protection to the
missing ones. Also fixing a BTAMP race condition during SSR in softap
mode.  (CR 370064)

634185: Fuzzing Fix - Vos Packet is Freed Twice
Fix issue seen in fuzzing test case #48518 for malformed data packet -
There is a bug where if WLANTL_GetEtherType fails, the vos packet is
returned twice.  (CR 369987)

634238: Fix for Timer Leak
While unloading host driver it is showing timer leak. In rrmClose
function, it is not destroying neighborRspWaitTimer. Same way it is
not destroying txSleepTimer in hddDevTmUnregisterNotifyCallback
function. this change is going to fix both timer leak issue.  (CR
369951)

634272: Fix of kernel Panic in P2P mode after including DXE TX ring empty fi
DXE TX ring is taking more than 3 seconds in some secarios to get
cleared and becasue of this after getting DEL BSS response sessionId
is getting changed and as a side effect of this dev is comign as Null
and any access to it is leading to Kernel Panic.  (CR 370441)

634397: SME Close Session wait timeout should be more than WDI timeout
SME Close Session is timing out before getting the call back from
WDI. Increased the WLAN_WAIT_TIME_SESSIONOPENCLOSE to 15 seconds which
is more than WDI timeout (10 seconds).  (CR 368821)

634422: Port config80211 softap interfaces to Kernel 3.4
The softap config80211 interfaces are changed in Kernel 3.4, some of
the interfaces are renamed; and also a new data structures is
introduced for softap interface. So the existing WLAN driver APIs are
modified to accomadate these changes.  (CR 371516)

634858: Fix typo in sirWrapper.h Copyright
Fix typo that was uncovered during Open Source legal scan

Release 3.1.7.11

Integrate the following CLs from Perforce:

634522: Make changeCountryCode ioctl completly synchronous
Implemented completion routine and callback function to make
changeCountryCode Ioctl completely Synchronous (CR 365094)

634543: Fix typo in WCNSS version log message

634791: Do not allow the second interface for the same type.
Currently two concurrent sessions of same type are not supported. The
new additional session is causing problems to existing session. Seeing
errors like sme_OpenSession() failure, disconnecting and reconnect the
existing session, but data transfer failure etc., As two P2P sessions
are currently not supported, restrict this, at HDD level. This can be
removed once concurrent P2P CLI sessions have to be supported.

634824: Set ERP protection bit when SoftAP overlaps with 11b AP.
SoftAP is not setting ERP protection bit when 11b AP operates in same
channel as that of SoftAP. Added this 11b OBSS overlap support. After
turning off 11b AP, ERP protection bit is cleared but not "OBSS non-HT
STA" persent bit. HT protection also remained "01". We need to disable
this HT protection also while disabling ERP protection.  (CR 368189)

634825: Fix for Memory Leak
While sending scan response from LIM to SME, it allocate memory of
8000 byte length for pSirSmeScanRsp. In case where scan results are
empty (bssCount=0) LIM send eWNI_SME_SCAN_RSP message with
statusCode. After posting message it is not freeing memroy which is
allocated previously which result into memory leak for 8000 byte when
we unload driver. Now After posting message we will check if
pSirSmeScanRsp is not NULL then free allocate memory.  (CR 371901)

634850: Fix for setband and country commands which occasionally enable dualb
Added a fix to check the INI settings for band (CR 368987)

634876: Max tx power value from ini is not reflected during initial assoc
check is added to pick up the lowest of regmax, ap and ini value  (CR 367780

635070: Fix issue with iwconfig for p2p session when concurrency is enabled

635072: Fix for leting device go to IMPS when p2p_client is disconnected
In case where p2p_client is the last session to be
deleted/disconnected, what happens is that csrScanTriggerIdleScan()
fails at vos_concurrent_sessions_running(). We add further check to
see if any session is in connect state. In case there are no sessions
in connect state, it is okie to go into IMPS.

635216: Fix SoftP and P2P porting issues on Kernel 3.4
When registering with config80211 interface, Kernel 3.4 expects to
announce the capability for "remain on channel" interface. So add this
flag when WLAN driver register with cfg80211. For SoftAP when cfg80211
new station interface is invoked, Kernel 3.4 expects an additional
flag in station info, to indicate that it has filled association
request IES.
diff --git a/CORE/SME/inc/csrApi.h b/CORE/SME/inc/csrApi.h
index 60d9da9..b2beaf7 100644
--- a/CORE/SME/inc/csrApi.h
+++ b/CORE/SME/inc/csrApi.h
@@ -410,6 +410,9 @@
     //this mean error happens before association_start or roaming_start is called.
     eCSR_ROAM_SESSION_OPENED,
     eCSR_ROAM_FT_REASSOC_FAILED,
+#ifdef FEATURE_WLAN_LFR
+    eCSR_ROAM_PMK_NOTIFY,
+#endif
 }eRoamCmdStatus;
 
 
@@ -949,8 +952,11 @@
 #ifdef FEATURE_WLAN_CCX
     tANI_U8   isCcxIniFeatureEnabled;
 #endif
+#ifdef FEATURE_WLAN_LFR
+    tANI_U8   isFastRoamIniFeatureEnabled;
+#endif
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
     tANI_U8   isFastTransitionEnabled;
 #endif
 
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index 9fc423d..ac548bb 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -539,11 +539,15 @@
     tCsr11rConfig csr11rConfig;
 #endif
 
+#ifdef FEATURE_WLAN_LFR
+    tANI_U8   isFastRoamIniFeatureEnabled;
+#endif
+
 #ifdef FEATURE_WLAN_CCX
     tANI_U8   isCcxIniFeatureEnabled;
 #endif
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
     tANI_U8   isFastTransitionEnabled;
 #endif
 
@@ -852,6 +856,9 @@
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING    
     tCsrNeighborRoamControlInfo neighborRoamInfo;
 #endif
+#ifdef FEATURE_WLAN_LFR
+    tANI_U8   isFastRoamIniFeatureEnabled;
+#endif
 #ifdef FEATURE_WLAN_CCX
     tANI_U8   isCcxIniFeatureEnabled;
 #endif
@@ -1174,4 +1181,10 @@
 tANI_BOOLEAN csrRoamIsCCXAssoc(tpAniSirGlobal pMac);
 #endif
 
+
 void csrDisconnectAllActiveSessions(tpAniSirGlobal pMac);
+#ifdef FEATURE_WLAN_LFR
+//Returns whether "Legacy Fast Roaming" is enabled...or not
+tANI_BOOLEAN csrRoamIsFastRoamEnabled(tpAniSirGlobal pMac);
+#endif
+
diff --git a/CORE/SME/inc/csrNeighborRoam.h b/CORE/SME/inc/csrNeighborRoam.h
index b5f535b..0eef2b8 100644
--- a/CORE/SME/inc/csrNeighborRoam.h
+++ b/CORE/SME/inc/csrNeighborRoam.h
@@ -87,7 +87,7 @@
 #define CSR_NEIGHBOR_ROAM_REPORT_QUERY_TIMEOUT  1000    //in milliseconds
 #define CSR_NEIGHBOR_ROAM_PREAUTH_RSP_WAIT_MULTIPLIER   5     //in milliseconds
 #define MAX_NUM_PREAUTH_FAIL_LIST_ADDRESS       10 //Max number of MAC addresses with which the pre-auth was failed
-#define MAX_BSS_IN_NEIGHBOR_RPT                 4
+#define MAX_BSS_IN_NEIGHBOR_RPT                 15
 #define CSR_NEIGHBOR_ROAM_MAX_NUM_PREAUTH_RETRIES 3
 
 /* Black listed APs. List of MAC Addresses with which the Preauthentication was failed. */
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index c14d3f9..c3e6216 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -81,13 +81,16 @@
 #if defined WLAN_FEATURE_VOWIFI
    tRrmConfigParam  rrmConfig;
 #endif
+#if defined FEATURE_WLAN_LFR
+    tANI_U8   isFastRoamIniFeatureEnabled;
+#endif
 #if defined FEATURE_WLAN_CCX
     tANI_U8   isCcxIniFeatureEnabled;
 #endif
 #if defined WLAN_FEATURE_P2P_INTERNAL
    tP2PConfigParam  p2pConfig;
 #endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
     tANI_U8   isFastTransitionEnabled;
 #endif
 } tSmeConfigParams, *tpSmeConfigParams;
@@ -1630,11 +1633,11 @@
    \fn sme_GetOperationChannel
    \brief API to get current channel on which STA is parked
    this function gives channel information only of infra station or IBSS station.
-   \param hHal and poiter to memory location 
+   \param hHal, pointer to memory location and sessionId 
    \returns eHAL_STATUS_SUCCESS
             eHAL_STATUS_FAILURE
 -------------------------------------------------------------------------------*/
-eHalStatus sme_GetOperationChannel(tHalHandle hHal, tANI_U32 *pChannel);
+eHalStatus sme_GetOperationChannel(tHalHandle hHal, tANI_U32 *pChannel, tANI_U8 sessionId);
 
 #ifdef WLAN_FEATURE_P2P
 /* ---------------------------------------------------------------------------
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index e1c81a0..22f9721 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -1217,10 +1217,14 @@
         smsLog( pMac, LOG1, "IsFTResourceReqSupp = %d\n", pMac->roam.configParam.csr11rConfig.IsFTResourceReqSupported); 
 #endif
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
         pMac->roam.configParam.isFastTransitionEnabled = pParam->isFastTransitionEnabled;
 #endif
 
+#ifdef FEATURE_WLAN_LFR 
+        pMac->roam.configParam.isFastRoamIniFeatureEnabled = pParam->isFastRoamIniFeatureEnabled;
+#endif
+
 #ifdef FEATURE_WLAN_CCX 
         pMac->roam.configParam.isCcxIniFeatureEnabled = pParam->isCcxIniFeatureEnabled;
 #endif
@@ -4355,6 +4359,14 @@
 }
 #endif
 
+#ifdef FEATURE_WLAN_LFR
+//Returns whether "Legacy Fast Roaming" is currently enabled...or not
+tANI_BOOLEAN csrRoamIsFastRoamEnabled(tpAniSirGlobal pMac)
+{
+    return pMac->roam.configParam.isFastRoamIniFeatureEnabled;
+}
+#endif
+
 //Return true means the command can be release, else not
 static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pCommand,
                                        eCsrRoamCompleteResult Result, void *Context )
@@ -6174,7 +6186,15 @@
     }
 #endif
 #ifdef FEATURE_WLAN_CCX
-    if ((csrIsProfileCCX(pProfile) || ((pIesTemp->CCXVersion.present) && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA)))) && (!(csrIsProfile11r( pProfile ))) && (pMac->roam.configParam.isCcxIniFeatureEnabled))
+    if ((csrIsProfileCCX(pProfile) || 
+         ((pIesTemp->CCXVersion.present) 
+          && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) 
+              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA) 
+              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA_PSK) 
+              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN) 
+              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN_PSK)))) 
+        && (!(csrIsProfile11r( pProfile ))) 
+        && (pMac->roam.configParam.isCcxIniFeatureEnabled))
     {
         pConnectProfile->isCCXAssoc = 1;
     }
@@ -6692,6 +6712,15 @@
                         }
                         else
 #endif
+#ifdef FEATURE_WLAN_LFR
+                        if (csrRoamIsHandoffInProgress(pMac) && 
+                                                csrRoamIsFastRoamEnabled(pMac))
+                        {
+                            // Now serialize the reassoc command.
+                            status = csrRoamIssueReassociateCmd(pMac, sessionId);
+                        }
+                        else
+#endif
                         // else we are not connected and attempting to Join.  Issue the
                         // Join request.
                         {
@@ -8089,6 +8118,12 @@
                     csrNeighborRoamTranistionPreauthDoneToDisconnected(pMac);
                 }
 #endif
+#ifdef FEATURE_WLAN_LFR
+                if (csrRoamIsFastRoamEnabled(pMac) && (csrNeighborRoamStatePreauthDone(pMac)))
+                {
+                    csrNeighborRoamTranistionPreauthDoneToDisconnected(pMac);
+                }
+#endif
                 pSession = CSR_GET_SESSION( pMac, sessionId );
 
                 if ( csrIsConnStateInfra( pMac, sessionId ) )
@@ -8143,6 +8178,12 @@
                     csrNeighborRoamTranistionPreauthDoneToDisconnected(pMac);
                 }
 #endif
+#ifdef FEATURE_WLAN_LFR
+                if (csrRoamIsFastRoamEnabled(pMac) && (csrNeighborRoamStatePreauthDone(pMac)))
+                {
+                    csrNeighborRoamTranistionPreauthDoneToDisconnected(pMac);
+                }
+#endif
                 pSession = CSR_GET_SESSION( pMac, sessionId );
 
                 if ( csrIsConnStateInfra( pMac, sessionId ) )
@@ -11202,7 +11243,15 @@
          * If we are associating explictly 11R only then we will get
          * 11R.
          */
-        if ((csrIsProfileCCX(pProfile) || ((pIes->CCXVersion.present) && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA)))) && (!(csrIsProfile11r( pProfile ))) && (pMac->roam.configParam.isCcxIniFeatureEnabled))
+        if ((csrIsProfileCCX(pProfile) || 
+             ((pIes->CCXVersion.present) 
+              && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) 
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA) 
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA_PSK) 
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN) 
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN_PSK)))) 
+            && (!(csrIsProfile11r( pProfile ))) 
+            && (pMac->roam.configParam.isCcxIniFeatureEnabled))
         {
             // isCCXconnection;
             dwTmp = pal_cpu_to_be32(TRUE); 
@@ -11226,9 +11275,13 @@
         }
 #endif
 
-#if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX
+#if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
         // Fill in isFastTransitionEnabled
-        if (pMac->roam.configParam.isFastTransitionEnabled)
+        if (pMac->roam.configParam.isFastTransitionEnabled
+#ifdef FEATURE_WLAN_LFR
+        || csrRoamIsFastRoamEnabled(pMac)
+#endif
+        )
         {
             dwTmp = pal_cpu_to_be32(TRUE); 
             palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
@@ -11582,14 +11635,31 @@
 #ifdef FEATURE_WLAN_CCX
         //isCCXconnection;
         //CCKM profile, ccxversion ie present, not 11r and ini file has CCX enabled
-        dwTmp = ((csrIsProfileCCX(pProfile) || ((pIes->CCXVersion.present) && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA)))) && (!(csrIsProfile11r( pProfile ))) && (pMac->roam.configParam.isCcxIniFeatureEnabled)) ? pal_cpu_to_be32(TRUE) : 0;
+        dwTmp = ( ((csrIsProfileCCX(pProfile) || 
+                  ((pIes->CCXVersion.present) 
+                   && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) 
+                       || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA)
+                       || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA_PSK)
+                       || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN)
+                       || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN_PSK)))) 
+                 && (!(csrIsProfile11r( pProfile ))) 
+                 && (pMac->roam.configParam.isCcxIniFeatureEnabled)) 
+                ? pal_cpu_to_be32(TRUE) : 0);
         palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
         pBuf += sizeof(tAniBool);        
 #endif // FEATURE_WLAN_CCX
 #endif // WLAN_FEATURE_VOWIFI_11R
 
 #ifdef FEATURE_WLAN_CCX
-        if ((csrIsProfileCCX(pProfile) || ((pIes->CCXVersion.present) && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA)))) && (!(csrIsProfile11r( pProfile ))) && (pMac->roam.configParam.isCcxIniFeatureEnabled))
+        if ((csrIsProfileCCX(pProfile) || 
+             ((pIes->CCXVersion.present) 
+              && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) 
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA)
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA_PSK)
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN)
+                  || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN_PSK)))) 
+            && (!(csrIsProfile11r( pProfile ))) 
+            && (pMac->roam.configParam.isCcxIniFeatureEnabled))
         {
            tCCXTspecInfo ccxTspec;
 
@@ -11618,9 +11688,13 @@
         }
 #endif // FEATURE_WLAN_CCX
 
-#if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX
+#if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
         // Fill in isFastTransitionEnabled
-        if (pMac->roam.configParam.isFastTransitionEnabled)
+        if (pMac->roam.configParam.isFastTransitionEnabled
+#ifdef FEATURE_WLAN_LFR
+         || csrRoamIsFastRoamEnabled(pMac)
+#endif
+         )
         {
             dwTmp = pal_cpu_to_be32(TRUE); 
             palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
@@ -14952,6 +15026,9 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus  status = eHAL_STATUS_SUCCESS;
+#ifdef FEATURE_WLAN_LFR
+    tCsrRoamInfo roamInfo;
+#endif
 
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
     smsLog( pMac, LOGE, FL("Preauth response status code %d"), pFTPreAuthRsp->status); 
@@ -14990,7 +15067,18 @@
                         eCSR_ROAM_FT_RESPONSE, eCSR_ROAM_RESULT_NONE);
 
     // Currently we dont do anything special for CCX connection.
-    
+
+#ifdef FEATURE_WLAN_LFR
+    // If Legacy Fast Roaming is enabled, signal the supplicant  
+    // So he can send us a PMK-ID for this candidate AP.
+    if (csrRoamIsFastRoamEnabled(pMac))
+    {
+        // Save the bssid from the received response 
+        palCopyMemory(pMac->hHdd, (void *)&roamInfo.bssid, (void *)pFTPreAuthRsp->preAuthbssId, sizeof(tCsrBssid));
+        csrRoamCallCallback(pMac, pFTPreAuthRsp->smeSessionId, &roamInfo, 0, eCSR_ROAM_PMK_NOTIFY, 0);
+    }
+
+#endif
 
     // Done with it, init it.
     pMac->ft.ftSmeContext.psavedFTPreAuthRsp = NULL;
diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index 3241cb4..3e4c472 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -117,6 +117,7 @@
 eHalStatus csrSetBGScanChannelList( tpAniSirGlobal pMac, tANI_U8 *pAdjustChannels, tANI_U8 NumAdjustChannels);
 void csrReleaseCmdSingle(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 tANI_BOOLEAN csrRoamIsValidChannel( tpAniSirGlobal pMac, tANI_U8 channel );
+void csrPruneChannelListForMode( tpAniSirGlobal pMac, tCsrChannel *pChannelList );
 
 //pResult is invalid calling this function.
 void csrFreeScanResultEntry( tpAniSirGlobal pMac, tCsrScanResult *pResult )
@@ -2703,6 +2704,10 @@
         {
             pMac->scan.curScanType = eSIR_PASSIVE_SCAN;
         }
+
+        csrPruneChannelListForMode(pMac, &pMac->scan.baseChannels);
+        csrPruneChannelListForMode(pMac, &pMac->scan.base20MHzChannels);
+
         csrSaveChannelPowerForBand(pMac, eANI_BOOLEAN_FALSE);
         csrSaveChannelPowerForBand(pMac, eANI_BOOLEAN_TRUE);
         // ... and apply the channel list, power settings, and the country code.
@@ -5369,8 +5374,11 @@
     eHalStatus status = eHAL_STATUS_CSR_WRONG_STATE;
 
     //Do not trigger IMPS in case of concurrency
-    if (vos_concurrent_sessions_running())
+    if (vos_concurrent_sessions_running() && csrIsAnySessionInConnectState(pMac))
+    {
+        smsLog( pMac, LOGW, FL("Cannot request IMPS because Concurrent Sessions Running\n") );
         return (status);
+    }
 
     if(pTimeInterval)
     {
diff --git a/CORE/SME/src/csr/csrNeighborRoam.c b/CORE/SME/src/csr/csrNeighborRoam.c
index 9ae1066..bc79a22 100644
--- a/CORE/SME/src/csr/csrNeighborRoam.c
+++ b/CORE/SME/src/csr/csrNeighborRoam.c
@@ -304,6 +304,21 @@
     }
     else
 #endif
+#ifdef FEATURE_WLAN_LFR
+    if (csrRoamIsFastRoamEnabled(pMac))
+    {
+        if (eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN == pNeighborRoamInfo->neighborRoamState)
+        {
+            csrNeighborRoamIssuePreauthReq(pMac);
+        }
+        else
+        {
+            smsLog(pMac, LOGE, FL("LFR Reassoc indication received in unexpected state %d"), pNeighborRoamInfo->neighborRoamState);
+            VOS_ASSERT(0);
+        }
+    }
+    else
+#endif
     {
         if (eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN == pNeighborRoamInfo->neighborRoamState)
         {
@@ -405,7 +420,7 @@
     vos_mem_set(pNeighborRoamInfo->currAPbssid, sizeof(tCsrBssid), 0);
     pNeighborRoamInfo->neighborScanTimerInfo.pMac = pMac;
     pNeighborRoamInfo->neighborScanTimerInfo.sessionId = CSR_SESSION_ID_INVALID;
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
     pNeighborRoamInfo->is11rAssoc = eANI_BOOLEAN_FALSE;
     pNeighborRoamInfo->FTRoamInfo.preAuthRspWaitTimerInfo.pMac = pMac;
     pNeighborRoamInfo->FTRoamInfo.preAuthRspWaitTimerInfo.sessionId = CSR_SESSION_ID_INVALID;
@@ -887,21 +902,23 @@
                         pScanResult->BssDescriptor.bssId[4],
                         pScanResult->BssDescriptor.bssId[5]);
 
-        if (VOS_TRUE == vos_mem_compare(pScanResult->BssDescriptor.bssId, 
+       if (VOS_TRUE == vos_mem_compare(pScanResult->BssDescriptor.bssId, 
                        pNeighborRoamInfo->currAPbssid, sizeof(tSirMacAddr)))
         {
             //currently associated AP. Do not have this in the roamable AP list
             continue;
         }
 
-        if (abs(pNeighborRoamInfo->cfgParams.neighborReassocThreshold) < abs(pScanResult->BssDescriptor.rssi))
-        {
+#if 0
+    if (abs(pNeighborRoamInfo->cfgParams.neighborReassocThreshold) < abs(pScanResult->BssDescriptor.rssi))
+    {
             VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                  "%s: [INFOLOG]Current reassoc threshold %d new ap rssi worse=%d\n", __func__,
-                      (int)pNeighborRoamInfo->cfgParams.neighborReassocThreshold * (-1),
-                      (int)pScanResult->BssDescriptor.rssi * (-1) );
-            continue;
-        }        
+                 "%s: [INFOLOG]Current reassoc threshold %d new ap rssi worse=%d\n", __func__,
+                     (int)pNeighborRoamInfo->cfgParams.neighborReassocThreshold * (-1),
+                     (int)pScanResult->BssDescriptor.rssi * (-1) );
+        continue;
+    }        
+#endif //0
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
         if (pNeighborRoamInfo->is11rAssoc)
@@ -962,6 +979,19 @@
         }
 #endif /* FEATURE_WLAN_CCX */
 
+#ifdef FEATURE_WLAN_LFR
+        // If we are supporting legacy roaming, and 
+        // if the candidate is on the "pre-auth failed" list, ignore it. 
+        if (csrRoamIsFastRoamEnabled(pMac))
+        {
+            if (!csrNeighborRoamIsPreauthCandidate(pMac, pScanResult->BssDescriptor.bssId))
+            {
+                smsLog(pMac, LOGE, FL("BSSID present in pre-auth fail list.. Ignoring"));
+                continue;
+            }
+        }
+#endif /* FEATURE_WLAN_LFR */
+
         /* If the received timestamp in BSS description is earlier than the scan request timestamp, skip 
          * this result */
         if (pNeighborRoamInfo->scanRequestTimeStamp >= pScanResult->BssDescriptor.nReceivedTime)
@@ -1126,7 +1156,7 @@
         NEIGHBOR_ROAM_DEBUG(pMac, LOGW, FL("Channel list scan completed. Current chan index = %d"), currentChanIndex);
         VOS_ASSERT(pNeighborRoamInfo->roamChannelInfo.currentChanIndex == 0);
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
         /* If the state is REPORT_SCAN, then this must be the scan after the REPORT_QUERY state. So, we 
            should use the BSSID filter made out of neighbor reports */
         if (eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN == pNeighborRoamInfo->neighborRoamState)
@@ -1181,6 +1211,16 @@
                     }
                     else
 #endif
+#ifdef FEATURE_WLAN_LFR
+                    /* If LFR is enabled, then we can register the reassoc callback here as we have some 
+                                        APs in the roamable AP list */
+                    if (csrRoamIsFastRoamEnabled(pMac))
+                    {
+                        /* Valid APs are found after scan. Now we can initiate pre-authentication */
+                        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN)
+                    }
+                    else
+#endif
                     {
                        
                         NEIGHBOR_ROAM_DEBUG(pMac, LOGE, FL("Completed scanning of CFG CHAN LIST in non-11r association. Registering reassoc callback"));
@@ -1837,10 +1877,10 @@
     int numOfChannels = 0;
     tANI_U8   channelList[MAX_BSS_IN_NEIGHBOR_RPT];
 
-    if (
+    if ( 
 #ifdef FEATURE_WLAN_CCX
         ((pNeighborRoamInfo->isCCXAssoc) && 
-        (pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived == eANI_BOOLEAN_FALSE)) ||
+                    (pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived == eANI_BOOLEAN_FALSE)) ||
         (pNeighborRoamInfo->isCCXAssoc == eANI_BOOLEAN_FALSE) || 
 #endif // CCX
         pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.numOfChannels == 0)
@@ -2260,7 +2300,7 @@
 {
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     eHalStatus  status = eHAL_STATUS_SUCCESS;
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
     int  init_ft_flag = FALSE;
 #endif
 
@@ -2289,7 +2329,7 @@
             pNeighborRoamInfo->neighborScanTimerInfo.pMac = pMac;
             pNeighborRoamInfo->neighborScanTimerInfo.sessionId = sessionId;
             
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
             /* Now we can clear the preauthDone that was saved as we are connected afresh */
             csrNeighborRoamFreeRoamableBSSList(pMac, &pMac->roam.neighborRoamInfo.FTRoamInfo.preAuthDoneList);
 #endif
@@ -2323,7 +2363,15 @@
                             
 #endif
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+#ifdef FEATURE_WLAN_LFR
+            // If "Legacy Fast Roaming" is enabled 
+            if (csrRoamIsFastRoamEnabled(pMac))
+            {
+                init_ft_flag = TRUE;
+            }
+#endif
+
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
             if ( init_ft_flag == TRUE )
             {
                 /* Initialize all the data structures needed for the 11r FT Preauth */
@@ -2791,6 +2839,15 @@
     }
     else
 #endif
+#ifdef FEATURE_WLAN_LFR
+    if (csrRoamIsFastRoamEnabled(pMac))
+    {
+        /* Always the BSS info in the head is the handoff candidate */
+        pBssNode = csrNeighborRoamGetRoamableAPListNextEntry(pMac, &pNeighborRoamInfo->FTRoamInfo.preAuthDoneList, NULL);
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Number of Handoff candidates = %d"), csrLLCount(&pNeighborRoamInfo->FTRoamInfo.preAuthDoneList));
+    }
+    else
+#endif
     {
         pBssNode = csrNeighborRoamGetRoamableAPListNextEntry(pMac, &pNeighborRoamInfo->roamableAPList, NULL);
         NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Number of Handoff candidates = %d"), csrLLCount(&pNeighborRoamInfo->roamableAPList));
diff --git a/CORE/SME/src/csr/csrUtil.c b/CORE/SME/src/csr/csrUtil.c
index 5910069..8c1a3cf 100644
--- a/CORE/SME/src/csr/csrUtil.c
+++ b/CORE/SME/src/csr/csrUtil.c
@@ -3124,6 +3124,8 @@
     tANI_U8 PMKId[CSR_RSN_PMKID_SIZE];
     tDot11fBeaconIEs *pIesLocal = pIes;
 
+    smsLog(pMac, LOGW, "%s called...", __FUNCTION__);
+
     do
     {
         if ( !csrIsProfileRSN( pProfile ) ) break;
@@ -3808,8 +3810,18 @@
     do
     {
         if ( !csrIsProfileRSN( pProfile ) ) break;
+#ifdef FEATURE_WLAN_LFR
+        if (csrRoamIsFastRoamEnabled(pMac))
+        {
+            // If "Legacy Fast Roaming" is enabled ALWAYS rebuild the RSN IE from 
+            // scratch. So it contains the current PMK-IDs
+            cbRsnIe = csrConstructRSNIe(pMac, sessionId, pProfile, pSirBssDesc, pIes, pRsnIe);
+        }
+        else 
+#endif
         if(pProfile->nRSNReqIELength && pProfile->pRSNReqIE)
         {
+            // If you have one started away, re-use it. 
             if(SIR_MAC_WPA_IE_MAX_LENGTH >= pProfile->nRSNReqIELength)
             {
                 cbRsnIe = (tANI_U8)pProfile->nRSNReqIELength;
diff --git a/CORE/SME/src/rrm/sme_rrm.c b/CORE/SME/src/rrm/sme_rrm.c
index 3ce9c0f..7e9d91c 100644
--- a/CORE/SME/src/rrm/sme_rrm.c
+++ b/CORE/SME/src/rrm/sme_rrm.c
@@ -1134,20 +1134,38 @@
    {
       vosStatus = vos_timer_stop( &pSmeRrmContext->IterMeasTimer );
       if(!VOS_IS_STATUS_SUCCESS(vosStatus))
-      { 
+      {
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("Timer stop fail") );
       }
-   } 
+   }
 
-   vosStatus = vos_timer_destroy( &pSmeRrmContext->IterMeasTimer ); 
-   if (!VOS_IS_STATUS_SUCCESS(vosStatus)) {
+   vosStatus = vos_timer_destroy( &pSmeRrmContext->IterMeasTimer );
+   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+   {
 
        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("Fail to destroy timer") );
 
    }
 
+   if( VOS_TIMER_STATE_RUNNING ==
+          vos_timer_getCurrentState( &pSmeRrmContext->neighborReqControlInfo.neighborRspWaitTimer ) )
+   {
+      vosStatus = vos_timer_stop( &pSmeRrmContext->neighborReqControlInfo.neighborRspWaitTimer );
+      if(!VOS_IS_STATUS_SUCCESS(vosStatus))
+      {
+         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL, FL("Timer stop fail") );
+      }
+   }
+
+   vosStatus = vos_timer_destroy( &pSmeRrmContext->neighborReqControlInfo.neighborRspWaitTimer );
+   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+   {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL, FL("Fail to destroy timer") );
+
+   }
+
    rrmLLPurgeNeighborCache(pMac, &pSmeRrmContext->neighborReportCache);
-      
+
    csrLLClose(&pSmeRrmContext->neighborReportCache);
 
    return vosStatus;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 642e8f0..0fca4d3 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -5073,29 +5073,28 @@
         \fn sme_GetOperationChannel
         \brief API to get current channel on which STA is parked
         this function gives channel information only of infra station or IBSS station
-        \param hHal and poiter to memory location
+        \param hHal, pointer to memory location and sessionId
         \returns eHAL_STATUS_SUCCESS
                 eHAL_STATUS_FAILURE
 -------------------------------------------------------------------------------*/
-eHalStatus sme_GetOperationChannel(tHalHandle hHal, tANI_U32 *pChannel)
+eHalStatus sme_GetOperationChannel(tHalHandle hHal, tANI_U32 *pChannel, tANI_U8 sessionId)
 {
-    tANI_U32 sessionId;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     tCsrRoamSession *pSession;
 
-    for (sessionId = 0; sessionId < CSR_ROAM_SESSION_MAX ; sessionId++)
+    if (CSR_IS_SESSION_VALID( pMac, sessionId ))
     {
-       if (CSR_IS_SESSION_VALID( pMac, sessionId ))
-       {
-          pSession = CSR_GET_SESSION( pMac, sessionId );
+       pSession = CSR_GET_SESSION( pMac, sessionId );
 
-          if(( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_INFRASTRUCTURE ) || 
-             ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_IBSS ) ||
-             ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_START_IBSS ))
-          {
-              *pChannel =pSession->connectedProfile.operationChannel;
-              return eHAL_STATUS_SUCCESS;
-          }
+       if(( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_INFRASTRUCTURE ) || 
+          ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_IBSS ) ||
+#ifdef WLAN_SOFTAP_FEATURE	  
+          ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_INFRA_AP ) ||
+#endif
+          ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_START_IBSS ))
+       {
+           *pChannel =pSession->connectedProfile.operationChannel;
+           return eHAL_STATUS_SUCCESS;
        }
     }
     return eHAL_STATUS_FAILURE;