diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index 315e63a..e2b90ae 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -356,7 +356,7 @@
 #define CFG_RSSI_CATEGORY_GAP_NAME             "gRssiCatGap"
 #define CFG_RSSI_CATEGORY_GAP_MIN              ( 5 )  
 #define CFG_RSSI_CATEGORY_GAP_MAX              ( 100 )  
-#define CFG_RSSI_CATEGORY_GAP_DEFAULT          ( 30 )
+#define CFG_RSSI_CATEGORY_GAP_DEFAULT          ( 5 )
 
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
 #define CFG_ROAM_PREFER_5GHZ                   "gRoamPrefer5GHz"
@@ -763,7 +763,7 @@
  * This check is not done if the value is Zero */
 #define CFG_ROAM_RSSI_DIFF_NAME                             "RoamRssiDiff"
 #define CFG_ROAM_RSSI_DIFF_MIN                              (0)
-#define CFG_ROAM_RSSI_DIFF_MAX                              (125)
+#define CFG_ROAM_RSSI_DIFF_MAX                              (30)
 #define CFG_ROAM_RSSI_DIFF_DEFAULT                          (0)
 
 /*
@@ -1108,6 +1108,11 @@
 #define CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MIN          (1000)
 #define CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MAX          (60000)
 #define CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_DEFAULT      (20000)
+
+#define CFG_EMPTY_SCAN_REFRESH_PERIOD_NAME         "gEmptyScanRefreshPeriod"
+#define CFG_EMPTY_SCAN_REFRESH_PERIOD_MIN          (1000)
+#define CFG_EMPTY_SCAN_REFRESH_PERIOD_MAX          (60000)
+#define CFG_EMPTY_SCAN_REFRESH_PERIOD_DEFAULT      (0)
 #endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 
 #define CFG_QOS_WMM_BURST_SIZE_DEFN_NAME                        "burstSizeDefinition" 
@@ -1761,13 +1766,14 @@
 
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
    v_U16_t       nNeighborScanPeriod;
-   v_U16_t       nNeighborReassocRssiThreshold;
-   v_U16_t       nNeighborLookupRssiThreshold;
-   char          neighborScanChanList[100];         
+   v_U8_t        nNeighborReassocRssiThreshold;
+   v_U8_t        nNeighborLookupRssiThreshold;
+   v_U8_t        neighborScanChanList[WNI_CFG_VALID_CHANNEL_LIST_LEN];
    v_U16_t       nNeighborScanMinChanTime; 
    v_U16_t       nNeighborScanMaxChanTime; 
    v_U16_t       nMaxNeighborReqTries;
-   v_U16_t       nNeighborResultsRefreshPeriod; 
+   v_U16_t       nNeighborResultsRefreshPeriod;
+   v_U16_t       nEmptyScanRefreshPeriod;
 #endif
 
    //Handoff Parameters
diff --git a/CORE/HDD/inc/wlan_hdd_wext.h b/CORE/HDD/inc/wlan_hdd_wext.h
index e418441..8b70b04 100644
--- a/CORE/HDD/inc/wlan_hdd_wext.h
+++ b/CORE/HDD/inc/wlan_hdd_wext.h
@@ -75,6 +75,12 @@
 
 #define MHZ 6
 
+#define WE_MAX_STR_LEN                                 1024
+#define WLAN_HDD_UI_BAND_AUTO                          0
+#define WLAN_HDD_UI_BAND_5_GHZ                         1
+#define WLAN_HDD_UI_BAND_2_4_GHZ                       2
+#define WLAN_HDD_UI_SET_BAND_VALUE_OFFSET              8
+
 typedef enum
 {
    HDD_WLAN_WMM_DIRECTION_UPSTREAM      = 0,
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index 03d9615..21d041f 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -82,10 +82,16 @@
 
 static void cbNotifySetImmediateRoamRssiDiff(hdd_context_t *pHddCtx, unsigned long NotifyId)
 {
-    sme_UpdateImmediateRoamRssiDiff((tHalHandle)(pHddCtx->hHal), 
+    sme_UpdateImmediateRoamRssiDiff((tHalHandle)(pHddCtx->hHal),
                                     pHddCtx->cfg_ini->nImmediateRoamRssiDiff);
 }
 
+static void cbNotifySetRoamRssiDiff(hdd_context_t *pHddCtx, unsigned long NotifyId)
+{
+    sme_UpdateRoamRssiDiff((tHalHandle)(pHddCtx->hHal),
+                                    pHddCtx->cfg_ini->RoamRssiDiff);
+}
+
 static void cbNotifySetFastTransitionEnabled(hdd_context_t *pHddCtx, unsigned long NotifyId)
 {
     sme_UpdateFastTransitionEnabled((tHalHandle)(pHddCtx->hHal), pHddCtx->cfg_ini->isFastTransitionEnabled);
@@ -114,6 +120,26 @@
     sme_UpdateConfigFwRssiMonitoring((tHalHandle)(pHddCtx->hHal), pHddCtx->cfg_ini->fEnableFwRssiMonitoring );
 }
 
+#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
+static void cbNotifySetNeighborLookupRssiThreshold(hdd_context_t *pHddCtx, unsigned long NotifyId)
+{
+    // at the point this routine is called, the value in the cfg_ini table has already been updated
+    sme_setNeighborLookupRssiThreshold((tHalHandle)(pHddCtx->hHal), pHddCtx->cfg_ini->nNeighborLookupRssiThreshold );
+}
+
+static void cbNotifySetNeighborResultsRefreshPeriod(hdd_context_t *pHddCtx, unsigned long NotifyId)
+{
+    // at the point this routine is called, the value in the cfg_ini table has already been updated
+    sme_setNeighborScanRefreshPeriod((tHalHandle)(pHddCtx->hHal), pHddCtx->cfg_ini->nNeighborResultsRefreshPeriod );
+}
+
+static void cbNotifySetEmptyScanRefreshPeriod(hdd_context_t *pHddCtx, unsigned long NotifyId)
+{
+    // at the point this routine is called, the value in the cfg_ini table has already been updated
+    sme_UpdateEmptyScanRefreshPeriod((tHalHandle)(pHddCtx->hHal), pHddCtx->cfg_ini->nEmptyScanRefreshPeriod);
+}
+#endif
+
 REG_TABLE_ENTRY g_registry_table[] =
 {
    REG_VARIABLE( CFG_RTS_THRESHOLD_NAME, WLAN_PARAM_Integer,
@@ -941,20 +967,21 @@
                  CFG_FAST_TRANSITION_ENABLED_NAME_MAX,
                  cbNotifySetFastTransitionEnabled, 0 ),
 
-   /* Variable to specify the delta/difference between the RSSI of current AP 
+   /* Variable to specify the delta/difference between the RSSI of current AP
     * and roamable AP while roaming */
-   REG_VARIABLE( CFG_ROAM_RSSI_DIFF_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, RoamRssiDiff, 
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT, 
-                 CFG_ROAM_RSSI_DIFF_DEFAULT, 
-                 CFG_ROAM_RSSI_DIFF_MIN, 
-                 CFG_ROAM_RSSI_DIFF_MAX),
+   REG_DYNAMIC_VARIABLE( CFG_ROAM_RSSI_DIFF_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, RoamRssiDiff,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_ROAM_RSSI_DIFF_DEFAULT,
+                 CFG_ROAM_RSSI_DIFF_MIN,
+                 CFG_ROAM_RSSI_DIFF_MAX,
+                 cbNotifySetRoamRssiDiff, 0),
 
    REG_DYNAMIC_VARIABLE( CFG_IMMEDIATE_ROAM_RSSI_DIFF_NAME, WLAN_PARAM_Integer,
-                         hdd_config_t, nImmediateRoamRssiDiff, 
-                         VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT, 
-                         CFG_IMMEDIATE_ROAM_RSSI_DIFF_DEFAULT, 
-                         CFG_IMMEDIATE_ROAM_RSSI_DIFF_MIN, 
+                         hdd_config_t, nImmediateRoamRssiDiff,
+                         VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                         CFG_IMMEDIATE_ROAM_RSSI_DIFF_DEFAULT,
+                         CFG_IMMEDIATE_ROAM_RSSI_DIFF_MIN,
                          CFG_IMMEDIATE_ROAM_RSSI_DIFF_MAX,
                          cbNotifySetImmediateRoamRssiDiff, 0),
 #endif
@@ -1349,12 +1376,13 @@
                  CFG_NEIGHBOR_REASSOC_RSSI_THRESHOLD_MIN, 
                  CFG_NEIGHBOR_REASSOC_RSSI_THRESHOLD_MAX ),
 
-   REG_VARIABLE( CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_NAME, WLAN_PARAM_Integer,
+   REG_DYNAMIC_VARIABLE( CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, nNeighborLookupRssiThreshold, 
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT, 
                  CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_DEFAULT, 
                  CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MIN, 
-                 CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MAX ),
+                 CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MAX,
+                 cbNotifySetNeighborLookupRssiThreshold, 0 ),
 
    REG_VARIABLE_STRING( CFG_NEIGHBOR_SCAN_CHAN_LIST_NAME, WLAN_PARAM_String,
                         hdd_config_t, neighborScanChanList, 
@@ -1382,12 +1410,21 @@
                  CFG_11R_NEIGHBOR_REQ_MAX_TRIES_MIN,
                  CFG_11R_NEIGHBOR_REQ_MAX_TRIES_MAX),
 
-   REG_VARIABLE( CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_NAME, WLAN_PARAM_Integer,
+   REG_DYNAMIC_VARIABLE( CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, nNeighborResultsRefreshPeriod, 
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT, 
                  CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_DEFAULT, 
                  CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MIN, 
-                 CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MAX ),
+                 CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MAX,
+                 cbNotifySetNeighborResultsRefreshPeriod, 0 ),
+
+   REG_DYNAMIC_VARIABLE( CFG_EMPTY_SCAN_REFRESH_PERIOD_NAME, WLAN_PARAM_Integer,
+                         hdd_config_t, nEmptyScanRefreshPeriod,
+                         VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                         CFG_EMPTY_SCAN_REFRESH_PERIOD_DEFAULT,
+                         CFG_EMPTY_SCAN_REFRESH_PERIOD_MIN,
+                         CFG_EMPTY_SCAN_REFRESH_PERIOD_MAX,
+                         cbNotifySetEmptyScanRefreshPeriod, 0 ),
 #endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 
    REG_VARIABLE( CFG_QOS_WMM_BURST_SIZE_DEFN_NAME , WLAN_PARAM_Integer,
@@ -2361,6 +2398,7 @@
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nMaxNeighborRetries] Value = [%lu] ",pHddCtx->cfg_ini->nMaxNeighborReqTries);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nNeighborScanPeriod] Value = [%lu] ",pHddCtx->cfg_ini->nNeighborScanPeriod);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nNeighborScanResultsRefreshPeriod] Value = [%lu] ",pHddCtx->cfg_ini->nNeighborResultsRefreshPeriod);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nEmptyScanRefreshPeriod] Value = [%lu] ",pHddCtx->cfg_ini->nEmptyScanRefreshPeriod);
 #endif
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [burstSizeDefinition] Value = [0x%x] ",pHddCtx->cfg_ini->burstSizeDefinition);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [tsInfoAckPolicy] Value = [0x%x] ",pHddCtx->cfg_ini->tsInfoAckPolicy);
@@ -3643,6 +3681,7 @@
    smeConfig.csrConfig.neighborRoamConfig.nNeighborScanTimerPeriod = pConfig->nNeighborScanPeriod;
    smeConfig.csrConfig.neighborRoamConfig.nMaxNeighborRetries = pConfig->nMaxNeighborReqTries; 
    smeConfig.csrConfig.neighborRoamConfig.nNeighborResultsRefreshPeriod = pConfig->nNeighborResultsRefreshPeriod;
+   smeConfig.csrConfig.neighborRoamConfig.nEmptyScanRefreshPeriod = pConfig->nEmptyScanRefreshPeriod;
    hdd_string_to_u8_array( pConfig->neighborScanChanList, 
                                         smeConfig.csrConfig.neighborRoamConfig.neighborScanChanList.channelList, 
                                         &smeConfig.csrConfig.neighborRoamConfig.neighborScanChanList.numChannels, 
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 64adfc1..b935fd2 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -199,7 +199,11 @@
 void hdd_wlan_initial_scan(hdd_adapter_t *pAdapter);
 
 extern int hdd_setBand_helper(struct net_device *dev, tANI_U8* ptr);
-
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+void hdd_getBand_helper(hdd_context_t *pHddCtx, int *pBand);
+static VOS_STATUS hdd_parse_channellist(tANI_U8 *pValue, tANI_U8 *pChannelList, tANI_U8 *pNumChannels);
+static VOS_STATUS hdd_parse_countryrev(tANI_U8 *pValue, tANI_U8 *pChannelList, tANI_U8 *pNumChannels);
+#endif
 static int hdd_netdev_notifier_call(struct notifier_block * nb,
                                          unsigned long state,
                                          void *ndev)
@@ -472,17 +476,16 @@
        {
            tANI_U8 *ptr = command ;
            int ret = 0 ;
-        
+
            /* Change band request received */
-   
-           /* First 8 bytes will have "SETBAND " and 
+
+           /* First 8 bytes will have "SETBAND " and
             * 9 byte will have band setting value */
            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                     "%s: SetBandCommand Info  comm %s UL %d, TL %d", __func__, command, priv_data.used_len, priv_data.total_len);
-        
            /* Change band request received */
-           ret = hdd_setBand_helper(dev, ptr);   
-       } 
+           ret = hdd_setBand_helper(dev, ptr);
+       }
        else if ( strncasecmp(command, "COUNTRY", 7) == 0 )
        {
            char *country_code;
@@ -497,6 +500,67 @@
 
            }
        }
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+       else if ( strncasecmp(command, "SETCOUNTRYREV", 13) == 0 )
+       {
+           tANI_U8 *value = command;
+           tANI_U8 countryCode[WNI_CFG_COUNTRY_CODE_LEN] = {0};
+           tANI_U8 revision = 0;
+           eHalStatus status = eHAL_STATUS_SUCCESS;
+           v_REGDOMAIN_t regId;
+
+           status = hdd_parse_countryrev(value, countryCode, &revision);
+           if (eHAL_STATUS_SUCCESS != status)
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Failed to parse country revision information", __func__);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           /* Validate country code */
+           status = sme_GetRegulatoryDomainForCountry(pHddCtx->hHal, countryCode, &regId);
+           if (eHAL_STATUS_SUCCESS != status)
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Invalid country code %s", __func__, countryCode);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           /* Validate revision */
+           if ((SME_KR_3 != revision) && (SME_KR_24 != revision) && (SME_KR_25 != revision))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Invalid revision %d", __func__, revision);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           ret = (int)sme_ChangeCountryCode(pHddCtx->hHal, NULL, countryCode,
+                    pAdapter, pHddCtx->pvosContext);
+           if (0 != ret)
+           {
+               VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                       "%s: SME Change Country code fail ret=%d", __func__, ret);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           if (0 == strncmp(countryCode, "KR", 2))
+           {
+               status = sme_ChangeCountryValidChannelListByRevision((tHalHandle)(pHddCtx->hHal),
+                                                       revision);
+               if (eHAL_STATUS_SUCCESS != status)
+               {
+                   VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                             "%s: Failed to build valid channel list", __func__);
+                   ret = -EINVAL;
+                   goto exit;
+               }
+           }
+       }
+#endif
        /*
           command should be a string having format
           SET_SAP_CHANNEL_LIST <num of channels> <the channels seperated by spaces>
@@ -518,6 +582,297 @@
            suspend = *ptr - '0';
            hdd_set_wlan_suspend_mode(suspend);
        }
+#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
+       else if (strncmp(command, "SETROAMTRIGGER", 14) == 0)
+       {
+           tANI_U8 *value = command;
+           int rssi = 0;
+           tANI_U8 lookUpThreshold = CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_DEFAULT;
+           eHalStatus status = eHAL_STATUS_SUCCESS;
+
+           /* Move pointer to ahead of SETROAMTRIGGER<delimiter> */
+           value = value + 15;
+
+           sscanf(value, "%d", &rssi);
+           lookUpThreshold = abs(rssi);
+           if ((lookUpThreshold < CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MIN) ||
+               (lookUpThreshold > CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MAX))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "Neighbor lookup threshold value %d is out of range"
+                      " (Min: %d Max: %d)", lookUpThreshold,
+                      CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MIN,
+                      CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MAX);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: Received Command to Set Roam trigger"
+                      " (Neighbor lookup threshold) = %d", __func__, lookUpThreshold);
+
+           pHddCtx->cfg_ini->nNeighborLookupRssiThreshold = lookUpThreshold;
+           status = sme_setNeighborLookupRssiThreshold((tHalHandle)(pHddCtx->hHal), lookUpThreshold);
+           if (eHAL_STATUS_SUCCESS != status)
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Failed to set roam trigger, try again", __func__);
+               ret = -EPERM;
+               goto exit;
+           }
+
+           /* Set Reassoc threshold to (lookup rssi threshold + 5 dBm) */
+           sme_setNeighborReassocRssiThreshold((tHalHandle)(pHddCtx->hHal), lookUpThreshold + 5);
+       }
+       else if (strncmp(command, "GETROAMTRIGGER", 14) == 0)
+       {
+           tANI_U8 lookUpThreshold = sme_getNeighborLookupRssiThreshold((tHalHandle)(pHddCtx->hHal));
+           int rssi = (-1) * lookUpThreshold;
+           char extra[32];
+           tANI_U8 len = 0;
+
+           len = snprintf(extra, sizeof(extra), "%s %d", command, rssi);
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
+       else if (strncmp(command, "SETROAMSCANPERIOD", 17) == 0)
+       {
+           tANI_U8 *value = command;
+           tANI_U16 neighborScanRefreshPeriod = CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_DEFAULT;
+           /* input refresh period is in terms of seconds */
+           /* Move pointer to ahead of SETROAMSCANPERIOD<delimiter> */
+           value = value + 18;
+           /* Convert the value from ascii to integer */
+           ret = kstrtou16(value, 10, &neighborScanRefreshPeriod);
+           if (ret < 0)
+           {
+               /* If the input value is greater than max value of datatype, then also
+                  kstrtou16 fails */
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: kstrtou16 failed ",
+                      "Input value may be out of range[%d - %d]",
+                      __func__,
+                      (CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MIN/1000),
+                      (CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MAX/1000));
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           neighborScanRefreshPeriod = neighborScanRefreshPeriod * 1000;
+           if ((neighborScanRefreshPeriod < CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MIN) ||
+               (neighborScanRefreshPeriod > CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MAX))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "Neighbor scan results refresh period value %d is out of range"
+                      " (Min: %d Max: %d)", neighborScanRefreshPeriod,
+                      (CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MIN/1000),
+                      (CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_MAX/1000));
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: Received Command to Set roam scan period"
+                      " (Neighbor Scan refresh period) = %d", __func__, neighborScanRefreshPeriod);
+
+           pHddCtx->cfg_ini->nEmptyScanRefreshPeriod = neighborScanRefreshPeriod;
+           sme_UpdateEmptyScanRefreshPeriod((tHalHandle)(pHddCtx->hHal), neighborScanRefreshPeriod);
+       }
+       else if (strncmp(command, "GETROAMSCANPERIOD", 17) == 0)
+       {
+           tANI_U16 nEmptyScanRefreshPeriod = sme_getEmptyScanRefreshPeriod((tHalHandle)(pHddCtx->hHal));
+           char extra[32];
+           tANI_U8 len = 0;
+
+           len = snprintf(extra, sizeof(extra), "%s %d", "GETROAMSCANPERIOD", (nEmptyScanRefreshPeriod/1000));
+           /* Returned value is in units of seconds */
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
+#endif
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+       else if (strncmp(command, "SETROAMDELTA", 12) == 0)
+       {
+           tANI_U8 *value = command;
+           tANI_U8 roamRssiDiff = CFG_ROAM_RSSI_DIFF_DEFAULT;
+
+           /* Move pointer to ahead of SETROAMDELTA<delimiter> */
+           value = value + 13;
+           /* Convert the value from ascii to integer */
+           ret = kstrtou8(value, 10, &roamRssiDiff);
+           if (ret < 0)
+           {
+               /* If the input value is greater than max value of datatype, then also
+                  kstrtou8 fails */
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: kstrtou8 failed range [%d - %d]", __func__,
+                      CFG_ROAM_RSSI_DIFF_MIN,
+                      CFG_ROAM_RSSI_DIFF_MAX);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           if ((roamRssiDiff < CFG_ROAM_RSSI_DIFF_MIN) ||
+               (roamRssiDiff > CFG_ROAM_RSSI_DIFF_MAX))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "Roam rssi diff value %d is out of range"
+                      " (Min: %d Max: %d)", roamRssiDiff,
+                      CFG_ROAM_RSSI_DIFF_MIN,
+                      CFG_ROAM_RSSI_DIFF_MAX);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: Received Command to Set roam rssi diff = %d", __func__, roamRssiDiff);
+
+           pHddCtx->cfg_ini->RoamRssiDiff = roamRssiDiff;
+           sme_UpdateRoamRssiDiff((tHalHandle)(pHddCtx->hHal), roamRssiDiff);
+       }
+       else if (strncmp(priv_data.buf, "GETROAMDELTA", 12) == 0)
+       {
+           tANI_U8 roamRssiDiff = sme_getRoamRssiDiff((tHalHandle)(pHddCtx->hHal));
+           char extra[32];
+           tANI_U8 len = 0;
+
+           len = snprintf(extra, sizeof(extra), "%s %d", command, roamRssiDiff);
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
+#endif
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+       else if (strncmp(command, "GETBAND", 7) == 0)
+       {
+           int band = -1;
+           char extra[32];
+           tANI_U8 len = 0;
+           hdd_getBand_helper(pHddCtx, &band);
+
+           len = snprintf(extra, sizeof(extra), "%s %d", command, band);
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
+       else if (strncmp(command, "GETCOUNTRYREV", 13) == 0)
+       {
+           tANI_U8 pBuf[WNI_CFG_COUNTRY_CODE_LEN];
+           tANI_U8 uBufLen = WNI_CFG_COUNTRY_CODE_LEN;
+           tANI_U8 revision = 0;
+           /* The format of the data copied to the user is GETCOUNTRYREV KR 25,
+              hence size of the array is country code + whitespace + 2 byte revision + ASCII NUL */
+           char extra[32] = {0};
+           tANI_U8 len = 0;
+
+           if (eHAL_STATUS_SUCCESS != sme_GetCountryCode( (tHalHandle)(pHddCtx->hHal), pBuf, &uBufLen ))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                  "%s: failed to get country code", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+           pBuf[uBufLen] = '\0';
+           sme_GetCountryRevision((tHalHandle)(pHddCtx->hHal), &revision);
+
+           if (0 == strncmp(pBuf, "KR", 2))
+               len = snprintf(extra, sizeof(extra), "%s %s %u", command, pBuf, revision);
+           else
+               len = snprintf(extra, sizeof(extra), "%s %s", command, pBuf);
+
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
+       else if (strncmp(command, "SETROAMSCANCHANNELS", 19) == 0)
+       {
+           tANI_U8 *value = command;
+           tANI_U8 ChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+           tANI_U8 numChannels = 0;
+           eHalStatus status = eHAL_STATUS_SUCCESS;
+
+           status = hdd_parse_channellist(value, ChannelList, &numChannels);
+           if (eHAL_STATUS_SUCCESS != status)
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Failed to parse channel list information", __func__);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           if (numChannels > WNI_CFG_VALID_CHANNEL_LIST_LEN)
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: number of channels (%d) supported exceeded max (%d)", __func__,
+                   numChannels, WNI_CFG_VALID_CHANNEL_LIST_LEN);
+               ret = -EINVAL;
+               goto exit;
+           }
+           status = sme_ChangeRoamScanChannelList((tHalHandle)(pHddCtx->hHal), ChannelList,
+                                                  numChannels);
+           if (eHAL_STATUS_SUCCESS != status)
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Failed to update channel list information", __func__);
+               ret = -EINVAL;
+               goto exit;
+           }
+       }
+       else if (strncmp(command, "GETROAMSCANCHANNELS", 19) == 0)
+       {
+           tANI_U8 ChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+           tANI_U8 numChannels = 0;
+           tANI_U8 len = 0, j = 0;
+           char extra[128] = {0};
+
+           if (eHAL_STATUS_SUCCESS != sme_getRoamScanChannelList( (tHalHandle)(pHddCtx->hHal),
+                                              ChannelList, &numChannels ))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                  "%s: failed to get roam scan channel list", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+           /* output channel list is of the format
+           [Number of roam scan channels][Channel1][Channel2]... */
+           /* copy the number of channels in the 0th index */
+           len = snprintf(extra, sizeof(extra), "%s %d", command, numChannels);
+           for (j = 0; (j < numChannels); j++)
+           {
+               len += snprintf(extra + len, sizeof(extra) - len, " %d", ChannelList[j]);
+           }
+
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
+#endif
        else {
            hddLog( VOS_TRACE_LEVEL_WARN, "%s: Unsupported GUI command %s",
                    __func__, command);
@@ -532,6 +887,201 @@
    return ret;
 }
 
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+void hdd_getBand_helper(hdd_context_t *pHddCtx, int *pBand)
+{
+    eCsrBand band = -1;
+    sme_GetFreqBand((tHalHandle)(pHddCtx->hHal), &band);
+    switch (band)
+    {
+        case eCSR_BAND_ALL:
+            *pBand = WLAN_HDD_UI_BAND_AUTO;
+            break;
+
+        case eCSR_BAND_24:
+            *pBand = WLAN_HDD_UI_BAND_2_4_GHZ;
+            break;
+
+        case eCSR_BAND_5G:
+            *pBand = WLAN_HDD_UI_BAND_5_GHZ;
+            break;
+
+        default:
+            hddLog( VOS_TRACE_LEVEL_WARN, "%s: Invalid Band %d", __func__, band);
+            *pBand = -1;
+            break;
+    }
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief hdd_parse_countryrev() - HDD Parse country code revision
+
+  This function parses the country code revision passed in the format
+  SETCOUNTRYREV<space><Country code><space>revision
+
+  \param  - pValue Pointer to input country code revision
+  \param  - pCountryCode Pointer to local output array to record country code
+  \param  - pRevision Pointer to store revision integer number
+
+  \return - 0 for success non-zero for failure
+
+  --------------------------------------------------------------------------*/
+VOS_STATUS hdd_parse_countryrev(tANI_U8 *pValue, tANI_U8 *pCountryCode, tANI_U8 *pRevision)
+{
+    tANI_U8 *inPtr = pValue;
+    int tempInt;
+
+    inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
+    /*no argument after the command*/
+    if (NULL == inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*no space after the command*/
+    else if (SPACE_ASCII_VALUE != *inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*removing empty spaces*/
+    while ((SPACE_ASCII_VALUE  == *inPtr)&& ('\0' !=  *inPtr) ) inPtr++;
+
+    /*no argument followed by spaces*/
+    if ('\0' == *inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*getting the first argument ie the country code */
+    sscanf(inPtr, "%s ", pCountryCode);
+
+    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+               "Country code is : %s", pCountryCode);
+
+    /*inPtr pointing to the beginning of first space after country code */
+    inPtr = strpbrk( inPtr, " " );
+    /*no revision number after the country code argument */
+    if (NULL == inPtr)
+    {
+        return -EINVAL;
+    }
+
+    inPtr++;
+
+    /*removing empty space*/
+    while ((SPACE_ASCII_VALUE == *inPtr) && ('\0' != *inPtr) ) inPtr++;
+
+    /*no channel list after the number of channels argument and spaces*/
+    if (0 == strncmp(pCountryCode, "KR", 2))
+    {
+        if ('\0' == *inPtr)
+        {
+            return -EINVAL;
+        }
+
+        sscanf(inPtr, "%d", &tempInt);
+        *pRevision = tempInt;
+    }
+    else
+    {
+        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+               "Revision input is required only for Country KR");
+        return -EINVAL;
+    }
+    return VOS_STATUS_SUCCESS;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief hdd_parse_channellist() - HDD Parse channel list
+
+  This function parses the channel list passed in the format
+  SETROAMSCANCHANNELS<space><Number of channels><space>Channel 1<space>Channel 2<space>Channel N
+
+  \param  - pValue Pointer to input channel list
+  \param  - ChannelList Pointer to local output array to record channel list
+  \param  - pNumChannels Pointer to number of roam scan channels
+
+  \return - 0 for success non-zero for failure
+
+  --------------------------------------------------------------------------*/
+VOS_STATUS hdd_parse_channellist(tANI_U8 *pValue, tANI_U8 *pChannelList, tANI_U8 *pNumChannels)
+{
+    tANI_U8 *inPtr = pValue;
+    int tempInt;
+    int j = 0;
+    int v = 0;
+    char buf[32];
+
+    inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
+    /*no argument after the command*/
+    if (NULL == inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*no space after the command*/
+    else if (SPACE_ASCII_VALUE != *inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*removing empty spaces*/
+    while ((SPACE_ASCII_VALUE  == *inPtr)&& ('\0' !=  *inPtr) ) inPtr++;
+
+    /*no argument followed by spaces*/
+    if ('\0' == *inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*getting the first argument ie the number of channels*/
+    sscanf(inPtr, "%s ", buf);
+    v = kstrtos32(buf, 10, &tempInt);
+    if ( v < 0) return -EINVAL;
+
+    *pNumChannels = tempInt;
+
+    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+               "Number of channels are: %d", *pNumChannels);
+
+    for (j = 0; j < (*pNumChannels); j++)
+    {
+        /*inPtr pointing to the beginning of first space after number of channels*/
+        inPtr = strpbrk( inPtr, " " );
+        /*no channel list after the number of channels argument*/
+        if (NULL == inPtr)
+        {
+            return -EINVAL;
+        }
+
+        /*removing empty space*/
+        while ((SPACE_ASCII_VALUE == *inPtr) && ('\0' != *inPtr) ) inPtr++;
+
+        /*no channel list after the number of channels argument and spaces*/
+        if ( '\0' == *inPtr )
+        {
+            return -EINVAL;
+        }
+
+        sscanf(inPtr, "%s ", buf);
+        v = kstrtos32(buf, 10, &tempInt);
+        if ( v < 0) return -EINVAL;
+        pChannelList[j] = tempInt;
+
+        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+                   "Channel %d added to preferred channel list",
+                   pChannelList[j] );
+    }
+
+    /* if the actual number of channels passed are more than
+       pNumChannels then ignore the rest; take only pNumChannels */
+    return VOS_STATUS_SUCCESS;
+}
+
+#endif
 /**---------------------------------------------------------------------------
 
   \brief hdd_open() - HDD Open function
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 5f4f3b6..43141a9 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -116,7 +116,6 @@
 
 #include "wlan_hdd_dev_pwr.h"
 #include "qc_sap_ioctl.h"
-#define WE_MAX_STR_LEN 1024
 
 #ifdef CONFIG_HAS_EARLYSUSPEND
 extern void hdd_suspend_wlan(struct early_suspend *wlan_suspend);
@@ -350,11 +349,6 @@
 #define TX_PER_TRACKING_MAX_RATIO                10
 #define TX_PER_TRACKING_DEFAULT_WATERMARK         5
 
-#define WLAN_HDD_UI_BAND_AUTO                     0
-#define WLAN_HDD_UI_BAND_5_GHZ                    1
-#define WLAN_HDD_UI_BAND_2_4_GHZ                  2
-#define WLAN_HDD_UI_SET_BAND_VALUE_OFFSET         8
-
 /*MCC Configuration parameters */
 enum {
     MCC_SCHEDULE_TIME_SLICE_CFG_PARAM = 1,
@@ -6014,6 +6008,9 @@
 
         hdd_abort_mac_scan(pHddCtx);
         sme_ScanFlushResult(hHal, pAdapter->sessionId);
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+        sme_UpdateBgScanConfigIniChannelList(hHal, (eCsrBand) band);
+#endif
         if(eHAL_STATUS_SUCCESS != sme_SetFreqBand(hHal, (eCsrBand)band))
         {
              VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index 02a1c8e..1cd94d0 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -165,6 +165,8 @@
 #endif //WLAN_FEATURE_CONCURRENT_P2P
 #endif //WLAN_FEATURE_P2P
 
+#define SPACE_ASCII_VALUE  32
+
 // -------------------------------------------------------------------
 // Change channel generic scheme
 typedef void (*CHANGE_CHANNEL_CALLBACK)(tpAniSirGlobal pMac, eHalStatus status, tANI_U32 *data,
diff --git a/CORE/MAC/src/pe/lim/limSessionUtils.c b/CORE/MAC/src/pe/lim/limSessionUtils.c
index 9192318..d6b0ef1 100644
--- a/CORE/MAC/src/pe/lim/limSessionUtils.c
+++ b/CORE/MAC/src/pe/lim/limSessionUtils.c
@@ -45,7 +45,6 @@
   \brief implementation for lim Session Utility  APIs
   \author Sunit Bhatia
   
-  Copyright 2008 (c) Qualcomm, Incorporated.  All Rights Reserved.
   ========================================================================*/
 
 
@@ -449,3 +448,32 @@
     return staCount;
 }
 
+#ifdef FEATURE_WLAN_LFR
+/*--------------------------------------------------------------------------
+  \brief limIsFastRoamEnabled() - Check LFR is enabled or not
+
+  This function returns the TRUE if LFR is enabled
+
+  \param pMac        - pointer to global adapter context
+  \param sessionId   - session ID is returned here, if session is found.
+
+  \return int        - TRUE if enabled or else FALSE
+
+  \sa
+  --------------------------------------------------------------------------*/
+
+tANI_U8 limIsFastRoamEnabled(tpAniSirGlobal pMac, tANI_U8 sessionId)
+{
+    if(TRUE == pMac->lim.gpSession[sessionId].valid)
+    {
+        if((eSIR_INFRASTRUCTURE_MODE == pMac->lim.gpSession[sessionId].bssType) &&
+           (pMac->lim.gpSession[sessionId].isFastRoamIniFeatureEnabled))
+        {
+            return TRUE;
+        }
+    }
+
+    return FALSE;
+}
+#endif
+
diff --git a/CORE/MAC/src/pe/lim/limSessionUtils.h b/CORE/MAC/src/pe/lim/limSessionUtils.h
index 61011ee..e4cd01c 100644
--- a/CORE/MAC/src/pe/lim/limSessionUtils.h
+++ b/CORE/MAC/src/pe/lim/limSessionUtils.h
@@ -43,6 +43,11 @@
 #if!defined( __LIM_SESSION_UTILS_H )
 #define __LIM_SESSION_UTILS_H
 
+/*
+* Copyright (c) 2012-2013 Qualcomm Atheros, Inc.
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
 
 /**=========================================================================
   
@@ -238,5 +243,21 @@
   --------------------------------------------------------------------------*/
 tANI_U8
 peGetCurrentSTAsCount(tpAniSirGlobal pMac);
+
+#ifdef FEATURE_WLAN_LFR
+/*--------------------------------------------------------------------------
+  \brief limIsFastRoamEnabled() - To check Fast roaming is enabled or not
+
+  \param pMac                   - pointer to global adapter context
+  \param sessionId              - session id
+  \return                       - TRUE or FALSE
+
+  \sa
+  --------------------------------------------------------------------------*/
+tANI_U8
+limIsFastRoamEnabled(tpAniSirGlobal pMac, tANI_U8 sessionId);
+#endif
+
+
 #endif //#if !defined( __LIM_SESSION_UTILS_H )
 
diff --git a/CORE/MAC/src/pe/pmm/pmmApi.c b/CORE/MAC/src/pe/pmm/pmmApi.c
index 9c8f343..4e1c009 100644
--- a/CORE/MAC/src/pe/pmm/pmmApi.c
+++ b/CORE/MAC/src/pe/pmm/pmmApi.c
@@ -38,7 +38,6 @@
  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
-
 /*
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file pmmApi.cc contains functions related to the API exposed
@@ -641,7 +640,7 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
     tpEnterBmpsParams pBmpsParams = NULL;
-
+    tANI_U8     i = 0;
     tANI_U32    rssiFilterPeriod = 5;
     tANI_U32    numBeaconPerRssiAverage = 5;
     tANI_U32    bRssiFilterEnable = FALSE;
@@ -669,10 +668,45 @@
     if(wlan_cfgGetInt(pMac, WNI_CFG_RSSI_FILTER_PERIOD, &rssiFilterPeriod) != eSIR_SUCCESS)
         pmmLog(pMac, LOGP, FL("pmmCfg: cfgGet failed for Rssi filter period"));
 
+    // This flag can be overwritten when 11r/CCXEnabled=1 or FastTransition=1
     if(wlan_cfgGetInt(pMac, WNI_CFG_PS_ENABLE_RSSI_MONITOR, &bRssiFilterEnable) != eSIR_SUCCESS)
         pmmLog(pMac, LOGP, FL("pmmCfg: cfgGet failed for Rssi monitor enable flag"));
     pBmpsParams->bRssiFilterEnable = bRssiFilterEnable;
 
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
+    // If there is a CCX assoc or 11r assoc we need to pick up the rssiFilterPeriod from the
+    // FT config value.
+    if (TRUE != pBmpsParams->bRssiFilterEnable)
+    {
+        for (i = 0; i < pMac->lim.maxBssId; i++)
+        {
+            if (limisFastTransitionRequired(pMac, i))
+            {
+                // We need to override the ini value to enable
+                // FW RSSI Monitoring. Basically if CCX or FT are enabled
+                // then enable FW RSSI Monitoring
+                pBmpsParams->bRssiFilterEnable = TRUE;
+                break;
+            }
+        }
+    }
+#endif
+
+#ifdef FEATURE_WLAN_LFR
+    /* if LFR is enabled, then enabled FW RSSI Monitoring */
+    if (TRUE != pBmpsParams->bRssiFilterEnable)
+    {
+        for (i = 0; i < pMac->lim.maxBssId; i++)
+        {
+            if (limIsFastRoamEnabled(pMac, i))
+            {
+                pBmpsParams->bRssiFilterEnable = TRUE;
+                break;
+            }
+        }
+    }
+#endif
+
     pBmpsParams->rssiFilterPeriod = (tANI_U8)rssiFilterPeriod;
 
     /* The numBeaconPerRssiAverage should be less than the max allowed (default set to 20 in CFG)
@@ -680,7 +714,7 @@
     if(wlan_cfgGetInt(pMac, WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE, &numBeaconPerRssiAverage) != eSIR_SUCCESS)
         pmmLog(pMac, LOGP, FL("pmmCfg: cfgGet failed for num beacon per rssi"));
 
-    pBmpsParams->numBeaconPerRssiAverage = 
+    pBmpsParams->numBeaconPerRssiAverage =
             (tANI_U8)GET_MIN_VALUE((tANI_U8) numBeaconPerRssiAverage, WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE_STAMAX);
 
     pmmLog (pMac, LOG1,
diff --git a/CORE/SAP/src/sapChSelect.h b/CORE/SAP/src/sapChSelect.h
index 5f02a53..2b1d4bb 100644
--- a/CORE/SAP/src/sapChSelect.h
+++ b/CORE/SAP/src/sapChSelect.h
@@ -41,6 +41,12 @@
 
 #if !defined( __SAP_CH_SELECT_H )
 #define __SAP_CH_SELECT_H
+
+/*
+* Copyright (c) 2012-2013 Qualcomm Atheros, Inc.
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
 /*===========================================================================
 
                       s a p C h S e l e c t . h
@@ -133,8 +139,6 @@
 * it contains the channel number, the computed weight
 */
 
-#define SPACE_ASCII_VALUE  32
-
 typedef struct sSapChannelListInfo{
     v_U8_t numChannel;
     v_U8_t *channelList;
diff --git a/CORE/SME/inc/csrApi.h b/CORE/SME/inc/csrApi.h
index c1d764f..87253a6 100644
--- a/CORE/SME/inc/csrApi.h
+++ b/CORE/SME/inc/csrApi.h
@@ -233,6 +233,14 @@
     tANI_U8 *ChannelList;   //it will be an array of channels
 }tCsrChannelInfo, *tpCsrChannelInfo;
 
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+typedef struct tagCsrCountryChannelInfo
+{
+    tCsrChannelInfo countryValidChannelList;
+    tANI_U8         revision; /* KR 25, 25 is the country revision index
+                                 to the list of valid channels */
+}tCsrCountryChannelInfo, *tpCsrCountryChannelInfo;
+#endif
 typedef struct tagCsrSSIDInfo
 {
    tSirMacSSid     SSID;   
@@ -924,6 +932,7 @@
     sCsrChannel    neighborScanChanList;
     tANI_U8        nMaxNeighborRetries;
     tANI_U16       nNeighborResultsRefreshPeriod;
+    tANI_U16       nEmptyScanRefreshPeriod;
 }tCsrNeighborRoamConfigParams;
 #endif
 
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index 73c58ef..3d29840 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -498,6 +498,7 @@
     sCsrChannel    neighborScanChanList;
     tANI_U8        nMaxNeighborRetries;
     tANI_U16       nNeighborResultsRefreshPeriod;
+    tANI_U16       nEmptyScanRefreshPeriod;
 }tCsrNeighborRoamConfig;
 #endif
 
@@ -1053,6 +1054,9 @@
 #define CSR_IS_CHANNEL_5GHZ(chnNum) \
         (((chnNum) >= CSR_MIN_5GHz_CHANNEL_NUMBER) && ((chnNum) <= CSR_MAX_5GHz_CHANNEL_NUMBER))
 
+#define CSR_IS_CHANNEL_DFS(chnNum) \
+         (NV_CHANNEL_ENABLE != vos_nv_getChannelEnabledState(chnNum))
+
 #define CSR_IS_CHANNEL_24GHZ(chnNum) \
         (((chnNum) > 0) && ((chnNum) <= CSR_MAX_24GHz_CHANNEL_NUMBER))
         
diff --git a/CORE/SME/inc/csrNeighborRoam.h b/CORE/SME/inc/csrNeighborRoam.h
index 1c3ff4d..7d2e2c6 100644
--- a/CORE/SME/inc/csrNeighborRoam.h
+++ b/CORE/SME/inc/csrNeighborRoam.h
@@ -84,6 +84,10 @@
     tANI_U32        minChannelScanTime;
     tANI_U32        maxChannelScanTime;
     tANI_U16        neighborResultsRefreshPeriod;
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+    tCsrCountryChannelInfo countryChannelInfo;
+#endif
+    tANI_U16        emptyScanRefreshPeriod;
 } tCsrNeighborRoamCfgParams, *tpCsrNeighborRoamCfgParams;
 
 #define CSR_NEIGHBOR_ROAM_INVALID_CHANNEL_INDEX    255
@@ -160,7 +164,14 @@
     eThirdEmptyScan,
     eFourthEmptyScan,
     eFifthEmptyScan,
+    eMaxEmptyScan=eFifthEmptyScan,
 } eNeighborRoamEmptyScanCount;
+
+typedef enum
+{
+    DEFAULT_SCAN=0,
+    SPLIT_SCAN_OCCUPIED_LIST=1,
+} eNeighborRoamScanMode;
 #endif
 
 /* Complete control information for neighbor roam algorithm */
@@ -173,6 +184,7 @@
     tANI_U8                     currAPoperationChannel; // current assoc AP
     tPalTimerHandle             neighborScanTimer;
     tPalTimerHandle             neighborResultsRefreshTimer;
+    tPalTimerHandle             emptyScanRefreshTimer;
     tCsrTimerInfo               neighborScanTimerInfo;
     tCsrNeighborRoamChannelInfo roamChannelInfo;
     tANI_U8                     currentNeighborLookupThreshold;
@@ -197,6 +209,7 @@
                                                     new profile does not match previous
                                                     we re-initialize occupied channel list */
     tANI_S8                     lookupDOWNRssi;
+    tANI_U8                     uScanMode;
 #endif
 } tCsrNeighborRoamControlInfo, *tpCsrNeighborRoamControlInfo;
 
@@ -221,7 +234,7 @@
 void csrNeighborRoamTranistionPreauthDoneToDisconnected(tpAniSirGlobal pMac);
 tANI_BOOLEAN csrNeighborRoamStatePreauthDone(tpAniSirGlobal pMac);
 tANI_BOOLEAN csrNeighborRoamScanRspPending(tHalHandle hHal);
-v_U8_t *csrNeighborRoamStateToString(v_U8_t state);
+VOS_STATUS csrNeighborRoamSetLookupRssiThreshold(tpAniSirGlobal pMac, v_U8_t neighborLookupRssiThreshold);
 
 
 #endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
diff --git a/CORE/SME/inc/smeInside.h b/CORE/SME/inc/smeInside.h
index abae34d..e99f94f 100644
--- a/CORE/SME/inc/smeInside.h
+++ b/CORE/SME/inc/smeInside.h
@@ -301,7 +301,16 @@
 eHalStatus csrTdlsTeardownReq(tHalHandle hHal, tANI_U8 sessionId,
                                          tCsrTdlsTeardownRequest *teardown);
 #endif
-
 #endif /* FEATURE_WLAN_TDLS */
 
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+eHalStatus csrFlushAndCreateBgScanRoamChannelList(tpAniSirGlobal pMac,
+                                                  const tANI_U8 *pChannelList,
+                                                  const tANI_U8 numChannels);
+eHalStatus csrUpdateBgScanConfigIniChannelList(tpAniSirGlobal pMac, eCsrBand eBand);
+eHalStatus csrInitCountryValidChannelList(tpAniSirGlobal pMac, tANI_U8 revision);
+void csr_SetRevision(tpAniSirGlobal pMac, tANI_U8 revision);
+#endif
+
+
 #endif //#if !defined( __SMEINSIDE_H )
diff --git a/CORE/SME/inc/smeInternal.h b/CORE/SME/inc/smeInternal.h
index 4a13731..bca3dc6 100644
--- a/CORE/SME/inc/smeInternal.h
+++ b/CORE/SME/inc/smeInternal.h
@@ -131,6 +131,16 @@
     SME_STATE_READY,
 } eSmeState;
 
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+/* enumeration for Korea country revision index,
+   index to the list of valid channels */
+typedef enum eSmeKRRevision
+{
+    SME_KR_3         = 3,
+    SME_KR_24        = 24,
+    SME_KR_25        = 25,
+} eSmeKRRevision;
+#endif
 
 #define SME_IS_START(pMac)  (SME_STATE_STOP != (pMac)->sme.state)
 #define SME_IS_READY(pMac)  (SME_STATE_READY == (pMac)->sme.state)
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index 12598c2..b37c141 100755
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -2257,6 +2257,20 @@
 
 eHalStatus sme_UpdateImmediateRoamRssiDiff(tHalHandle hHal, v_U8_t nImmediateRoamRssiDiff);
 
+/* ---------------------------------------------------------------------------
+    \fn sme_UpdateRoamRssiDiff
+    \brief  Update RoamRssiDiff
+            This function is called through dynamic setConfig callback function
+            to configure RoamRssiDiff
+            Usage: adb shell iwpriv wlan0 setConfig RoamRssiDiff=[0 .. 125]
+    \param  hHal - HAL handle for device
+    \param  RoamRssiDiff - minimum rssi difference between potential
+            candidate and current AP.
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+
+eHalStatus sme_UpdateRoamRssiDiff(tHalHandle hHal, v_U8_t RoamRssiDiff);
+
 /*--------------------------------------------------------------------------
   \brief sme_UpdateFastTransitionEnabled() - enable/disable Fast Transition support at runtime
   It is used at in the REG_DYNAMIC_VARIABLE macro definition of
@@ -2275,7 +2289,7 @@
 #ifdef FEATURE_WLAN_LFR
 /*--------------------------------------------------------------------------
   \brief sme_UpdateIsFastRoamIniFeatureEnabled() - enable/disable LFR support at runtime
-  It is used at in the REG_DYNAMIC_VARIABLE macro definition of 
+  It is used at in the REG_DYNAMIC_VARIABLE macro definition of
   isFastRoamIniFeatureEnabled.
   This is a synchronuous call
   \param hHal - The handle returned by macOpen.
@@ -2284,7 +2298,7 @@
   \sa
   --------------------------------------------------------------------------*/
 
-eHalStatus sme_UpdateIsFastRoamIniFeatureEnabled(tHalHandle hHal, 
+eHalStatus sme_UpdateIsFastRoamIniFeatureEnabled(tHalHandle hHal,
         v_BOOL_t isFastRoamIniFeatureEnabled);
 #endif /* FEATURE_WLAN_LFR */
 
@@ -2319,6 +2333,152 @@
 eHalStatus sme_UpdateConfigFwRssiMonitoring(tHalHandle hHal,
         v_BOOL_t fEnableFwRssiMonitoring);
 
+/*--------------------------------------------------------------------------
+  \brief sme_setNeighborLookupRssiThreshold() - update neighbor lookup rssi threshold
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_setNeighborLookupRssiThreshold(tHalHandle hHal,
+        v_U8_t neighborLookupRssiThreshold);
+
+/*--------------------------------------------------------------------------
+  \brief sme_setNeighborReassocRssiThreshold() - update neighbor reassoc rssi threshold
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_setNeighborReassocRssiThreshold(tHalHandle hHal,
+        v_U8_t neighborReassocRssiThreshold);
+
+/*--------------------------------------------------------------------------
+  \brief sme_getNeighborLookupRssiThreshold() - get neighbor lookup rssi threshold
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_getNeighborLookupRssiThreshold(tHalHandle hHal);
+
+/*--------------------------------------------------------------------------
+  \brief sme_setNeighborScanRefreshPeriod() - set neighbor scan results refresh period
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_setNeighborScanRefreshPeriod(tHalHandle hHal,
+        v_U16_t neighborScanResultsRefreshPeriod);
+
+/*--------------------------------------------------------------------------
+  \brief sme_getNeighborScanRefreshPeriod() - get neighbor scan results refresh period
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+v_U16_t sme_getNeighborScanRefreshPeriod(tHalHandle hHal);
+
+/*--------------------------------------------------------------------------
+  \brief sme_getEmptyScanRefreshPeriod() - get empty scan refresh period
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+v_U16_t sme_getEmptyScanRefreshPeriod(tHalHandle hHal);
+
+
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+/*--------------------------------------------------------------------------
+  \brief sme_getRoamRssiDiff() - get Roam rssi diff
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_getRoamRssiDiff(tHalHandle hHal);
+
+/*--------------------------------------------------------------------------
+  \brief sme_ChangeRoamScanChannelList() - Change roam scan channel list
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_ChangeRoamScanChannelList(tHalHandle hHal, tANI_U8 *pChannelList,
+                                         tANI_U8 numChannels);
+
+/*--------------------------------------------------------------------------
+  \brief sme_ChangeCountryValidChannelListByRevision() - Change Korea valid channel list
+  based on country revision number
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_ChangeCountryValidChannelListByRevision(tHalHandle hHal,
+                                         tANI_U8 Revision);
+
+/*--------------------------------------------------------------------------
+  \brief csrUpdateBgScanConfigIniChannelList() - Update bgscan roam cache
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_UpdateBgScanConfigIniChannelList(tHalHandle hHal,
+                                               eCsrBand eBand);
+
+
+/*--------------------------------------------------------------------------
+  \brief sme_getRoamScanChannelList() - get roam scan channel list
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_getRoamScanChannelList(tHalHandle hHal, tANI_U8 *pChannelList,
+                                         tANI_U8 *pNumChannels);
+
+/*--------------------------------------------------------------------------
+  \brief sme_GetCountryRevision() - get Country revision index
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_GetCountryRevision(tHalHandle hHal, tANI_U8 *pRevision);
+
+#endif
+
+/* ---------------------------------------------------------------------------
+    \fn sme_UpdateEmptyScanRefreshPeriod
+    \brief  Update nnEmptyScanRefreshPeriod
+            This function is called through dynamic setConfig callback function
+            to configure nnEmptyScanRefreshPeriod
+            Usage: adb shell iwpriv wlan0 setConfig nEmptyScanRefreshPeriod=[0 .. 60]
+    \param  hHal - HAL handle for device
+    \param  nEmptyScanRefreshPeriod - scan period following empty scan results.
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+
+eHalStatus sme_UpdateEmptyScanRefreshPeriod(tHalHandle hHal, v_U16_t nEmptyScanRefreshPeriod);
+
 /* ---------------------------------------------------------------------------
     \fn sme_IsFeatureSupportedByFW
     \brief  Check if an feature is enabled by FW
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 27d5519..d8a57aa 100755
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -123,6 +123,17 @@
   Static Type declarations
   ------------------------------------------------------------------------*/
 static tCsrRoamSession csrRoamRoamSession[CSR_ROAM_SESSION_MAX];
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+static const char KR_3[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
+                            36, 40, 44, 48, 52, 56, 60, 64, 100, 104,
+                            108, 112, 116, 120, 124, 149, 153, 157, 161};
+static const char KR_24[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
+                            36, 40, 44, 48, 52, 56, 60, 64, 100, 104,
+                            108, 112, 116, 120, 124, 149, 153, 157, 161};
+static const char KR_25[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
+                            36, 40, 44, 48, 149, 153, 157, 161};
+#endif
+
 /*-------------------------------------------------------------------------- 
   Type declarations
   ------------------------------------------------------------------------*/
@@ -966,6 +977,7 @@
     pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.channelList[1] = 6;
     pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.channelList[2] = 11;
     pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod = 20000; //20 seconds
+    pMac->roam.configParam.neighborRoamConfig.nEmptyScanRefreshPeriod = 0;
 #endif
 #ifdef WLAN_FEATURE_11AC
      pMac->roam.configParam.nVhtChannelWidth = WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ + 1;
@@ -984,6 +996,209 @@
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     return pMac->roam.configParam.bandCapability;
 }
+
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+tANI_BOOLEAN csrIsChannelInCountryValidList(tpAniSirGlobal pMac, tANI_U8 channel)
+{
+    /* Get country code from CFG */
+    tANI_U8 *pCountryCode = pMac->scan.countryCodeCurrent;
+    tANI_U8 i = 0;
+    v_BOOL_t retVal = FALSE;
+    tANI_U8 *pCountryValidChannelList = pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.ChannelList;
+    tANI_U8 *pNumChannels = &pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels;
+
+    /* Compare against KR valid list */
+    if ((0 == strncmp(pCountryCode, "KR", 2)) &&
+        (NULL != pCountryValidChannelList))
+    {
+        for (i = 0; i <(*pNumChannels); i++)
+        {
+            if (channel == pCountryValidChannelList[i])
+            {
+                retVal = TRUE;
+                break;
+            }
+        }
+    }
+    else
+    {
+        retVal = csrRoamIsChannelValid(pMac, channel);
+    }
+
+    return retVal;
+}
+
+void csr_SetRevision(tpAniSirGlobal pMac, tANI_U8 revision)
+{
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    pNeighborRoamInfo->cfgParams.countryChannelInfo.revision = revision;
+}
+
+/*
+ This function flushes the roam scan cache and creates fresh cache
+ based on the input channel list
+*/
+eHalStatus csrFlushAndCreateBgScanRoamChannelList(tpAniSirGlobal pMac,
+                                                  const tANI_U8 *pChannelList,
+                                                  const tANI_U8 numChannels)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+
+    /* Free up the memory first (if required) */
+    if (NULL != pNeighborRoamInfo->cfgParams.channelInfo.ChannelList)
+    {
+        vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
+        pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
+    }
+    pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels = numChannels;
+
+    pNeighborRoamInfo->cfgParams.channelInfo.ChannelList =
+            vos_mem_malloc(pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels);
+
+    if (NULL == pNeighborRoamInfo->cfgParams.channelInfo.ChannelList)
+    {
+        smsLog(pMac, LOGE, FL("Memory Allocation for CFG Channel List failed"));
+        pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels = 0;
+        return eHAL_STATUS_RESOURCES;
+    }
+
+    /* Update the roam global structure */
+    palCopyMemory(pMac->hHdd, pNeighborRoamInfo->cfgParams.channelInfo.ChannelList,
+                        pChannelList,
+                        pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels);
+    return status;
+}
+
+/* This function modifies the bgscan channel list set via config ini or
+   runtime, whenever the band changes.
+   if the band is auto, then no operation is performed on the channel list
+   if the band is 2.4G, then make sure channel list contains only 2.4G valid channels
+   if the band is 5G, then make sure channel list contains only 5G valid channels
+*/
+eHalStatus csrUpdateBgScanConfigIniChannelList(tpAniSirGlobal pMac,
+                                               eCsrBand eBand)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    tANI_U8 outNumChannels = 0;
+    tANI_U8 inNumChannels = 0;
+    tANI_U8 *inPtr = NULL;
+    tANI_U8 i = 0;
+    tANI_U8 ChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+
+    if (NULL == pNeighborRoamInfo->cfgParams.channelInfo.ChannelList)
+
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+            "No update required for channel list "
+            "either cfg.ini channel list is not set up or "
+            "auto band (Band %d)", eBand);
+        return status;
+    }
+
+    inNumChannels = pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels;
+    inPtr = pNeighborRoamInfo->cfgParams.channelInfo.ChannelList;
+    if (eCSR_BAND_24 == eBand)
+    {
+        for (i = 0; i < inNumChannels; i++)
+        {
+            if (CSR_IS_CHANNEL_24GHZ(inPtr[i]) && csrIsChannelInCountryValidList(pMac, inPtr[i]))
+            {
+                ChannelList[outNumChannels++] = inPtr[i];
+            }
+        }
+        csrFlushAndCreateBgScanRoamChannelList(pMac, ChannelList, outNumChannels);
+    }
+    else if (eCSR_BAND_5G == eBand)
+    {
+        for (i = 0; i < inNumChannels; i++)
+        {
+            /* Add 5G Non-DFS channel */
+            if (CSR_IS_CHANNEL_5GHZ(inPtr[i]) &&
+               csrIsChannelInCountryValidList(pMac, inPtr[i]) &&
+               !CSR_IS_CHANNEL_DFS(inPtr[i]))
+            {
+               ChannelList[outNumChannels++] = inPtr[i];
+            }
+        }
+        csrFlushAndCreateBgScanRoamChannelList(pMac, ChannelList, outNumChannels);
+    }
+    else if (eCSR_BAND_ALL == eBand)
+    {
+        for (i = 0; i < inNumChannels; i++)
+        {
+            if (csrIsChannelInCountryValidList(pMac, inPtr[i]) &&
+               !CSR_IS_CHANNEL_DFS(inPtr[i]))
+            {
+               ChannelList[outNumChannels++] = inPtr[i];
+            }
+        }
+        csrFlushAndCreateBgScanRoamChannelList(pMac, ChannelList, outNumChannels);
+    }
+    else
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
+            "Invalid band, No operation carried out (Band %d)", eBand);
+        status = eHAL_STATUS_INVALID_PARAMETER;
+    }
+
+    return status;
+}
+
+/*
+ This function initializes the valid channel list based on country code
+*/
+eHalStatus csrInitCountryValidChannelList(tpAniSirGlobal pMac,
+                                        tANI_U8 Revision)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    tANI_U8 *pOutChannelList = pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.ChannelList;
+    tANI_U8 *pNumChannels = &pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels;
+    const tANI_U8 *pChannelList = NULL;
+
+    if (SME_KR_3 == Revision)
+    {
+        pChannelList = KR_3;
+        *pNumChannels = sizeof(KR_3)/sizeof(KR_3[0]);
+    }
+    else if (SME_KR_24 == Revision)
+    {
+        pChannelList = KR_24;
+        *pNumChannels = sizeof(KR_24)/sizeof(KR_24[0]);
+    }
+    else if (SME_KR_25 == Revision)
+    {
+        pChannelList = KR_25;
+        *pNumChannels = sizeof(KR_25)/sizeof(KR_25[0]);
+    }
+    else
+        return eHAL_STATUS_INVALID_PARAMETER;
+
+    /* Free up the memory first */
+    if (NULL != pOutChannelList)
+    {
+        vos_mem_free(pOutChannelList);
+        pOutChannelList = NULL;
+    }
+
+    pOutChannelList = vos_mem_malloc(*pNumChannels);
+
+    if (NULL == pOutChannelList)
+    {
+        smsLog(pMac, LOGE, FL("Memory Allocation for CFG Channel List failed"));
+        *pNumChannels = 0;
+        return eHAL_STATUS_RESOURCES;
+    }
+
+    /* Update the roam global structure */
+    palCopyMemory(pMac->hHdd, pOutChannelList, pChannelList, *pNumChannels);
+    return status;
+}
+
+#endif
+
 eHalStatus csrSetBand(tHalHandle hHal, eCsrBand eBand)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
@@ -991,10 +1206,10 @@
     if (CSR_IS_PHY_MODE_A_ONLY(pMac) &&
             (eBand == eCSR_BAND_24))
     {
-        /* DOT11 mode configured to 11a only and received 
+        /* DOT11 mode configured to 11a only and received
            request to change the band to 2.4 GHz */
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
-            "failed to set band cfg80211 = %u, band = %u\n",  
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+            "failed to set band cfg80211 = %u, band = %u\n",
             pMac->roam.configParam.uCfgDot11Mode, eBand);
         return eHAL_STATUS_INVALID_PARAMETER;
     }
@@ -1002,23 +1217,28 @@
                 CSR_IS_PHY_MODE_G_ONLY(pMac)) &&
             (eBand == eCSR_BAND_5G))
     {
-        /* DOT11 mode configured to 11b/11g only and received 
+        /* DOT11 mode configured to 11b/11g only and received
            request to change the band to 5 GHz */
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
-            "failed to set band dot11mode = %u, band = %u\n",  
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+            "failed to set band dot11mode = %u, band = %u\n",
             pMac->roam.configParam.uCfgDot11Mode, eBand);
         return eHAL_STATUS_INVALID_PARAMETER;
     }
-    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, 
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
             "Band changed to %u (0 - ALL, 1 - 2.4 GHZ, 2 - 5GHZ)\n", eBand);
-    pMac->roam.configParam.eBand = eBand; 
-    pMac->roam.configParam.bandCapability = eBand; 
+    pMac->roam.configParam.eBand = eBand;
+    pMac->roam.configParam.bandCapability = eBand;
     csrScanGetSupportedChannels( pMac );
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+    csrUpdateBgScanConfigIniChannelList( pMac, eBand );
+#endif
     status = csrInitGetChannels( pMac );
     if (eHAL_STATUS_SUCCESS == status)
         csrInitChannelList( hHal );
     return status;
 }
+
+
 /* The funcns csrConvertCBIniValueToPhyCBState and csrConvertPhyCBStateToIniValue have been
  * introduced to convert the ini value to the ENUM used in csr and MAC for CB state
  * Ideally we should have kept the ini value and enum value same and representing the same
@@ -1323,8 +1543,9 @@
         smsLog( pMac, LOG1, "nNeighborLookupRssiThreshold = %d\n", pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold);  
         smsLog( pMac, LOG1, "nNeighborScanMinChanTime = %d\n", pMac->roam.configParam.neighborRoamConfig.nNeighborScanMinChanTime); 
         smsLog( pMac, LOG1, "nNeighborScanMaxChanTime = %d\n", pMac->roam.configParam.neighborRoamConfig.nNeighborScanMaxChanTime);
-        smsLog( pMac, LOG1, "nMaxNeighborRetries = %d\n", pMac->roam.configParam.neighborRoamConfig.nMaxNeighborRetries); 
-        smsLog( pMac, LOG1, "nNeighborResultsRefreshPeriod = %d\n", pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod); 
+        smsLog( pMac, LOG1, "nMaxNeighborRetries = %d\n", pMac->roam.configParam.neighborRoamConfig.nMaxNeighborRetries);
+        smsLog( pMac, LOG1, "nNeighborResultsRefreshPeriod = %d\n", pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod);
+        smsLog( pMac, LOG1, "nEmptyScanRefreshPeriod = %d\n", pMac->roam.configParam.neighborRoamConfig.nEmptyScanRefreshPeriod);
         {
            int i;
            smsLog( pMac, LOG1, FL("Num of Channels in CFG Channel List: %d\n"), pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels); 
diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index 970be45..59b6b07 100755
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -5503,8 +5503,7 @@
                                       */
                                      || ((eCSR_SCAN_HO_BG_SCAN == pSrcReq->requestType) &&
                                          (pSrcReq->ChannelInfo.numOfChannels > 1) &&
-                                         (pSrcReq->ChannelInfo.ChannelList[index] > 48 &&
-                                          pSrcReq->ChannelInfo.ChannelList[index] < 149))
+                                         (CSR_IS_CHANNEL_DFS(pSrcReq->ChannelInfo.ChannelList[index])))
 #endif
                                   )
                                 {
diff --git a/CORE/SME/src/csr/csrNeighborRoam.c b/CORE/SME/src/csr/csrNeighborRoam.c
index 7e8addd..706a8ee 100644
--- a/CORE/SME/src/csr/csrNeighborRoam.c
+++ b/CORE/SME/src/csr/csrNeighborRoam.c
@@ -328,6 +328,46 @@
             }
 }
 
+VOS_STATUS csrNeighborRoamSetLookupRssiThreshold(tpAniSirGlobal pMac, v_U8_t neighborLookupRssiThreshold)
+{
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
+
+    if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED == pNeighborRoamInfo->neighborRoamState)
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Currently in CONNECTED state, so deregister all and re-register for DOWN event again"));
+        /* De-register existing lookup UP/DOWN, Rssi indications */
+        csrNeighborRoamDeregAllRssiIndication(pMac);
+        pMac->roam.neighborRoamInfo.cfgParams.neighborLookupThreshold = neighborLookupRssiThreshold;
+        pNeighborRoamInfo->currentNeighborLookupThreshold = pMac->roam.neighborRoamInfo.cfgParams.neighborLookupThreshold;
+
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Registering neighbor lookup DOWN event with TL, RSSI = %d"), pNeighborRoamInfo->currentNeighborLookupThreshold);
+        /* Register Neighbor Lookup threshold callback with TL for DOWN event only */
+        vosStatus = WLANTL_RegRSSIIndicationCB(pMac->roam.gVosContext, (v_S7_t)pNeighborRoamInfo->currentNeighborLookupThreshold * (-1),
+                                                WLANTL_HO_THRESHOLD_DOWN,
+                                                csrNeighborRoamNeighborLookupDOWNCallback,
+                                                VOS_MODULE_ID_SME, pMac);
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+            //err msg
+            smsLog(pMac, LOGW, FL(" Couldn't register csrNeighborRoamNeighborLookupDOWNCallback with TL: Status = %d"), vosStatus);
+            vosStatus = VOS_STATUS_E_FAILURE;
+        }
+    }
+    else if (eCSR_NEIGHBOR_ROAM_STATE_INIT == pNeighborRoamInfo->neighborRoamState)
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Currently in INIT state, safe to set lookupRssi threshold"));
+        pMac->roam.neighborRoamInfo.cfgParams.neighborLookupThreshold = neighborLookupRssiThreshold;
+        pNeighborRoamInfo->currentNeighborLookupThreshold = pMac->roam.neighborRoamInfo.cfgParams.neighborLookupThreshold;
+    }
+    else
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac, LOGE, FL("Unexpected state %d, returning failure"), pNeighborRoamInfo->neighborRoamState);
+        vosStatus = VOS_STATUS_E_FAILURE;
+    }
+    return vosStatus;
+}
+
 /* ---------------------------------------------------------------------------
 
     \fn csrNeighborRoamReassocIndCallback
@@ -383,6 +423,7 @@
 
     /* We dont need to run this timer any more. */
     palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+    palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
 
     csrNeighborRoamTriggerHandoff(pMac, pNeighborRoamInfo);
 
@@ -421,6 +462,9 @@
         /* Stop neighbor scan results refresh timer */
         palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
 
+        /* Stop empty scan results refresh timer */
+        palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+
         /* Abort any ongoing scan */
         if (eANI_BOOLEAN_TRUE == pNeighborRoamInfo->scanRspPending)
         {
@@ -518,6 +562,7 @@
 #ifdef FEATURE_WLAN_LFR
         pNeighborRoamInfo->uEmptyScanCount = 0;
         pNeighborRoamInfo->lookupDOWNRssi = 0;
+        pNeighborRoamInfo->uScanMode = DEFAULT_SCAN;
 #endif
 }
 
@@ -543,6 +588,7 @@
     
  /* We dont need to run this timer any more. */
     palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);    
+    palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
     /* Do not free up the preauth done list here */
@@ -570,6 +616,8 @@
 
     /* Stop scan refresh timer */
     palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+    /* Stop empty scan results refresh timer */
+    palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
      /* Purge roamable AP list */
        csrNeighborRoamFreeRoamableBSSList(pMac, &pNeighborRoamInfo->roamableAPList); 
     return;
@@ -1357,12 +1405,16 @@
     VOS_STATUS  vosStatus = VOS_STATUS_SUCCESS;
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     eHalStatus  status = eHAL_STATUS_SUCCESS;
+#ifdef FEATURE_WLAN_LFR
+    tANI_BOOLEAN performPeriodicScan =
+        (pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod) ? TRUE : FALSE;
+#endif
 
     /* Stop neighbor scan timer */
     status = palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
     if (eHAL_STATUS_SUCCESS != status) 
     {
-        smsLog(pMac, LOGW, FL(" palTimerStop failed with status %d\n"), status);
+        smsLog(pMac, LOGW, FL("stopping neighborScanTimer failed with status %d\n"), status);
     }
 
     /*
@@ -1376,6 +1428,25 @@
     {
         pNeighborRoamInfo->uEmptyScanCount = eFifthEmptyScan;
     }
+    if ((abs(pNeighborRoamInfo->lookupDOWNRssi) >
+         abs(pNeighborRoamInfo->cfgParams.neighborReassocThreshold)) &&
+        ((pNeighborRoamInfo->uEmptyScanCount == eSecondEmptyScan) ||
+         (pNeighborRoamInfo->uEmptyScanCount == eFourthEmptyScan)))
+    {
+        /*
+         * If the scan was triggered due to lookupDOWNRssi > reassoc threshold,
+         * then it would be a contiguous scan on all valid non-DFS channels.
+         * In this mode, there is no need to trigger an immediate scan upon
+         * empty scan results for the second and fourth time (which would
+         * be equivalent to scanning on channels in non-occupied list).
+         * Incrementing uEmptyScanCount will correspond to skipping this step.
+         * NOTE: double increment of uEmptyScanCount corresponds to completion
+         * of scans on all valid channels.
+         */
+        ++pNeighborRoamInfo->uEmptyScanCount;
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG2, "Extra increment of empty scan count (=%d)"
+            " in contiguous scan mode", pNeighborRoamInfo->uEmptyScanCount);
+    }
 #endif
     if (((pNeighborRoamInfo->currentNeighborLookupThreshold+3) <
         pNeighborRoamInfo->cfgParams.neighborReassocThreshold)
@@ -1431,31 +1502,65 @@
         /* Immediately scan on channels in non-occupied list */
         csrNeighborRoamTransitToCFGChanScan(pMac);
     }
-    else if (pNeighborRoamInfo->uEmptyScanCount == eThirdEmptyScan)
+    else if (pNeighborRoamInfo->uEmptyScanCount >= eThirdEmptyScan)
     {
         /* Empty scan results for the third time */
+        if (performPeriodicScan)
+        {
+            smsLog(pMac, LOGE, FL("Performing periodic scan, uEmptyScanCount=%d"),
+                   pNeighborRoamInfo->uEmptyScanCount);
 
-    /* Start neighbor scan results refresh timer */
-    if (eHAL_STATUS_SUCCESS != 
-            palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer, 
-            pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT,
-            eANI_BOOLEAN_FALSE)) 
-    {
-            smsLog(pMac, LOGE, FL("Neighbor results refresh timer failed to start (%d)"),
-                   status);
-        vos_mem_free(pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList);
-        pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList = NULL;
-            vosStatus = VOS_STATUS_E_FAILURE;
+            /*
+             * Set uEmptyScanCount to MAX so that we always enter this
+             * condition on subsequent empty scan results
+             */
+            pNeighborRoamInfo->uEmptyScanCount = eMaxEmptyScan;
+
+            /* From here on, ONLY scan on channels in the occupied list */
+            pNeighborRoamInfo->uScanMode = SPLIT_SCAN_OCCUPIED_LIST;
+
+            /* Start empty scan refresh timer */
+            if (eHAL_STATUS_SUCCESS !=
+                palTimerStart(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer,
+                    pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod * PAL_TIMER_TO_MS_UNIT,
+                    eANI_BOOLEAN_FALSE))
+            {
+                smsLog(pMac, LOGE, FL("Empty scan refresh timer failed to start (%d)"),
+                        status);
+                vos_mem_free(pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList);
+                pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList = NULL;
+                vosStatus = VOS_STATUS_E_FAILURE;
+            }
+            else
+            {
+                smsLog(pMac, LOGE, FL("Empty scan refresh timer started (%ld ms)"),
+                        (pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod));
+            }
         }
         else
         {
-            smsLog(pMac, LOG2, FL("Neighbor results refresh timer started (%ld ms)"),
-            (pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT));
+            /* Start neighbor scan results refresh timer */
+            if (eHAL_STATUS_SUCCESS !=
+                    palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer,
+                        pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT,
+                        eANI_BOOLEAN_FALSE))
+            {
+                smsLog(pMac, LOGE, FL("Neighbor results refresh timer failed to start (%d)"),
+                        status);
+                vos_mem_free(pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList);
+                pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList = NULL;
+                vosStatus = VOS_STATUS_E_FAILURE;
+            }
+            else
+            {
+                smsLog(pMac, LOG2, FL("Neighbor results refresh timer started (%ld ms)"),
+                        (pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT));
+            }
         }
     }
 
-    NEIGHBOR_ROAM_DEBUG(pMac, LOG2, "Neighbor roam empty scan count=%d",
-        pNeighborRoamInfo->uEmptyScanCount);
+    NEIGHBOR_ROAM_DEBUG(pMac, LOG2, "Neighbor roam empty scan count=%d scan mode=%d",
+        pNeighborRoamInfo->uEmptyScanCount, pNeighborRoamInfo->uScanMode);
 #endif
     return vosStatus;
 }
@@ -1514,6 +1619,7 @@
                      * after the scan, reset empty scan count.
                      */
                     pNeighborRoamInfo->uEmptyScanCount = 0;
+                    pNeighborRoamInfo->uScanMode = DEFAULT_SCAN;
 #endif
 #ifdef WLAN_FEATURE_VOWIFI_11R
                     /* If this is a non-11r association, then we can register the reassoc callback here as we have some 
@@ -1748,6 +1854,12 @@
         return eHAL_STATUS_SUCCESS;
     }
 
+    if (eCSR_NEIGHBOR_ROAM_STATE_INIT == pNeighborRoamInfo->neighborRoamState)
+    {
+        smsLog(pMac, LOGE, FL("Received in INIT state. Must have disconnected. Ignore it"));
+        return eHAL_STATUS_SUCCESS;
+    }
+
     NEIGHBOR_ROAM_DEBUG(pMac, LOGW, "%s: process scan results", __func__);
     hstatus = csrNeighborRoamProcessScanComplete(pMac);
     
@@ -1943,35 +2055,46 @@
     tCsrBGScanRequest   bgScanParams;
     int numOfChannels = 0, i = 0;
     tANI_U8   *channelList = NULL;
+    tANI_U8   *pInChannelList = NULL;
 
     palZeroMemory(pMac->hHdd, &bgScanParams, sizeof(tCsrBGScanRequest));
 
     /* Contiguously scan all channels from valid list */
     NEIGHBOR_ROAM_DEBUG(pMac, LOG2, "%s: get valid channel list", __func__);
-    numOfChannels = sizeof(pMac->roam.validChannelList);
-    
-    if(!HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac,
-                          (tANI_U8 *)pMac->roam.validChannelList,
-                          (tANI_U32 *) &numOfChannels)))
+
+    if (NULL != pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.ChannelList)
     {
-        smsLog(pMac, LOGE, FL("Could not get valid channel list"));
-        return eHAL_STATUS_FAILURE;
+        /* this list is filled only if the country code is set to KR */
+        numOfChannels = pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels;
+        pInChannelList = pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.ChannelList;
     }
-    
+    else
+    {
+        numOfChannels = sizeof(pMac->roam.validChannelList);
+
+        if(!HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac,
+                              (tANI_U8 *)pMac->roam.validChannelList,
+                              (tANI_U32 *) &numOfChannels)))
+        {
+            smsLog(pMac, LOGE, FL("Could not get valid channel list"));
+            return eHAL_STATUS_FAILURE;
+        }
+        pInChannelList = pMac->roam.validChannelList;
+    }
     channelList = vos_mem_malloc( numOfChannels );
     if( NULL == channelList )
     {
         smsLog(pMac, LOGE, FL("could not allocate memory for channelList"));
         return eHAL_STATUS_FAILURE;
     }
-    vos_mem_copy(channelList, (tANI_U8 *)pMac->roam.validChannelList,
+    vos_mem_copy(channelList, (tANI_U8 *)pInChannelList,
                  numOfChannels * sizeof(tANI_U8));
 
     bgScanParams.ChannelInfo.numOfChannels = numOfChannels;
     bgScanParams.ChannelInfo.ChannelList = channelList;
     for (i = 0; i < numOfChannels; i++)
     {
-        NEIGHBOR_ROAM_DEBUG(pMac, LOGW, "%s: valid channel list = %d\n", 
+        NEIGHBOR_ROAM_DEBUG(pMac, LOGW, "%s: valid channel list = %d\n",
                 __func__, bgScanParams.ChannelInfo.ChannelList[i]);
     }
     csrNeighborRoamFillNonChannelBgScanParams(pMac, &bgScanParams);
@@ -2044,6 +2167,44 @@
     return;
 }
 
+void csrNeighborRoamEmptyScanRefreshTimerCallback(void *context)
+{
+    tCsrTimerInfo *pInfo = (tCsrTimerInfo *)context;
+    tpAniSirGlobal pMac = pInfo->pMac;
+    VOS_STATUS     vosStatus = VOS_STATUS_SUCCESS;
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+
+    /* Reset all the variables just as no scan had happened before */
+    csrNeighborRoamResetConnectedStateControlInfo(pMac);
+
+#if defined WLAN_FEATURE_VOWIFI_11R && defined WLAN_FEATURE_VOWIFI
+    if ((pNeighborRoamInfo->is11rAssoc) && (pMac->rrm.rrmSmeContext.rrmConfig.rrmEnabled))
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac, LOGE, FL("11R Association:Neighbor Lookup Down event received in CONNECTED state"));
+        vosStatus = csrNeighborRoamIssueNeighborRptRequest(pMac);
+        if (VOS_STATUS_SUCCESS != vosStatus)
+        {
+            smsLog(pMac, LOGE, FL("Neighbor report request failed. status = %d\n"), vosStatus);
+            return;
+        }
+        /* Increment the neighbor report retry count after sending the neighbor request successfully */
+        pNeighborRoamInfo->FTRoamInfo.currentNeighborRptRetryNum++;
+        pNeighborRoamInfo->FTRoamInfo.neighborRptPending = eANI_BOOLEAN_TRUE;
+        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_REPORT_QUERY)
+    }
+    else
+#endif
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac, LOGE, FL("Non 11R or CCX Association:empty scan refresh timer expired"));
+        vosStatus = csrNeighborRoamTransitToCFGChanScan(pMac);
+        if (VOS_STATUS_SUCCESS != vosStatus)
+        {
+            return;
+        }
+    }
+    return;
+}
+
 /* ---------------------------------------------------------------------------
 
     \fn csrNeighborRoamResultsRefreshTimerCallback
@@ -2671,8 +2832,9 @@
                   channelList, numOfChannels * sizeof(tANI_U8));
         } 
 #ifdef FEATURE_WLAN_LFR
-        else if (abs(pNeighborRoamInfo->lookupDOWNRssi) >
-                abs(pNeighborRoamInfo->cfgParams.neighborReassocThreshold))
+        else if ((pNeighborRoamInfo->uScanMode == DEFAULT_SCAN) &&
+                 (abs(pNeighborRoamInfo->lookupDOWNRssi) >
+                  abs(pNeighborRoamInfo->cfgParams.neighborReassocThreshold)))
         {
             /* 
              * Trigger a contiguous scan on all channels when the
@@ -2706,8 +2868,9 @@
             numOfChannels = pMac->scan.occupiedChannels.numChannels;
             if (numOfChannels
 #ifdef FEATURE_WLAN_LFR
-                && ((pNeighborRoamInfo->uEmptyScanCount == 0) ||
-                 ((pNeighborRoamInfo->uEmptyScanCount % 2) == 1))
+                && ((pNeighborRoamInfo->uScanMode == SPLIT_SCAN_OCCUPIED_LIST) ||
+                    (pNeighborRoamInfo->uEmptyScanCount == 0) ||
+                    ((pNeighborRoamInfo->uEmptyScanCount % 2) == 1))
 #endif
                 )
             {
@@ -2715,7 +2878,13 @@
                  * Always scan channels in the occupied channel list
                  * before scanning on the non-occupied list.
                  */
-                NEIGHBOR_ROAM_DEBUG(pMac, LOG1, "Switching to occupied channel list");
+                NEIGHBOR_ROAM_DEBUG(pMac, LOG2, "Switching to occupied channel list"
+#ifdef FEATURE_WLAN_LFR
+                    "-uScanMode=%d, uEmptyScanCount=%d",
+                    pNeighborRoamInfo->uScanMode,
+                    pNeighborRoamInfo->uEmptyScanCount
+#endif
+                 );
                 VOS_ASSERT(currChannelListInfo->ChannelList == NULL);
                 currChannelListInfo->ChannelList = vos_mem_malloc(numOfChannels);
 
@@ -2745,8 +2914,8 @@
                  * formed by CSR.
                  */
                 NEIGHBOR_ROAM_DEBUG(pMac, LOG1, "Switching to non-occupied channel list");
-                status = csrNeighborRoamPrepareNonOccupiedChannelList(pMac, 
-                            (tANI_U8 *)pMac->roam.validChannelList, 
+                status = csrNeighborRoamPrepareNonOccupiedChannelList(pMac,
+                            (tANI_U8 *)pMac->roam.validChannelList,
                             numOfChannels,
                             channelList,
                             &numOfChannels);
@@ -3094,6 +3263,7 @@
             // state.
             palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
             palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+            palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
             if (!CSR_IS_ROAM_SUBSTATE_DISASSOC_HO( pMac, sessionId )) {
                 /*
                  * Disconnect indication during Disassoc Handoff sub-state
@@ -3208,6 +3378,7 @@
 #ifdef FEATURE_WLAN_LFR
             pNeighborRoamInfo->uEmptyScanCount = 0;
             pNeighborRoamInfo->lookupDOWNRssi = 0;
+            pNeighborRoamInfo->uScanMode = DEFAULT_SCAN;
 #endif
 
             
@@ -3376,11 +3547,23 @@
     pNeighborRoamInfo->cfgParams.neighborReassocThreshold = pMac->roam.configParam.neighborRoamConfig.nNeighborReassocRssiThreshold;
     pNeighborRoamInfo->cfgParams.neighborScanPeriod = pMac->roam.configParam.neighborRoamConfig.nNeighborScanTimerPeriod;
     pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod = pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod;
-    
-    pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels   =   
+    pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod = pMac->roam.configParam.neighborRoamConfig.nEmptyScanRefreshPeriod;
+
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+    pNeighborRoamInfo->cfgParams.countryChannelInfo.revision = SME_KR_25;
+    pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.ChannelList = NULL;
+    pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels = 0;
+
+    if (0 == strncmp(pMac->scan.countryCodeCurrent, "KR", 2))
+    {
+       csrInitCountryValidChannelList(pMac, SME_KR_25);
+    }
+#endif
+
+    pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels   =
                         pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels;
 
-    pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = 
+    pNeighborRoamInfo->cfgParams.channelInfo.ChannelList =
                 vos_mem_malloc(pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels);
 
     if (NULL == pNeighborRoamInfo->cfgParams.channelInfo.ChannelList)
@@ -3390,7 +3573,7 @@
     }
 
     /* Update the roam global structure from CFG */
-    palCopyMemory(pMac->hHdd, pNeighborRoamInfo->cfgParams.channelInfo.ChannelList, 
+    palCopyMemory(pMac->hHdd, pNeighborRoamInfo->cfgParams.channelInfo.ChannelList,
                         pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.channelList,
                         pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels);
 
@@ -3399,6 +3582,7 @@
 #ifdef FEATURE_WLAN_LFR
     pNeighborRoamInfo->lookupDOWNRssi = 0;
     pNeighborRoamInfo->uEmptyScanCount = 0;
+    pNeighborRoamInfo->uScanMode = DEFAULT_SCAN;
     palZeroMemory(pMac->hHdd, &pNeighborRoamInfo->prevConnProfile,
                   sizeof(tCsrRoamConnectedProfile));
 #endif
@@ -3411,7 +3595,7 @@
 
     if (eHAL_STATUS_SUCCESS != status)
     {
-        smsLog(pMac, LOGE, FL("Response wait Timer allocation failed"));
+        smsLog(pMac, LOGE, FL("Neighbor scan timer allocation failed"));
         vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
         return eHAL_STATUS_RESOURCES;
@@ -3422,14 +3606,27 @@
 
     if (eHAL_STATUS_SUCCESS != status)
     {
-        smsLog(pMac, LOGE, FL("Response wait Timer allocation failed"));
-        smsLog(pMac, LOGE, FL("LL Open of roamable AP List failed"));
+        smsLog(pMac, LOGE, FL("Neighbor results refresh timer allocation failed"));
         vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
         palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
         return eHAL_STATUS_RESOURCES;
     }
 
+    status = palTimerAlloc(pMac->hHdd, &pNeighborRoamInfo->emptyScanRefreshTimer,
+                csrNeighborRoamEmptyScanRefreshTimerCallback,
+                (void *)&pNeighborRoamInfo->neighborScanTimerInfo);
+
+    if (eHAL_STATUS_SUCCESS != status)
+    {
+        smsLog(pMac, LOGE, FL("Empty scan refresh timer allocation failed"));
+        vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
+        pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
+        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
+        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+        return eHAL_STATUS_RESOURCES;
+    }
+
     status = csrLLOpen(pMac->hHdd, &pNeighborRoamInfo->roamableAPList);
     if (eHAL_STATUS_SUCCESS != status)
     {
@@ -3438,6 +3635,7 @@
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
         palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
         palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+        palTimerFree(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
         return eHAL_STATUS_RESOURCES;
     }
 
@@ -3456,6 +3654,7 @@
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
         palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
         palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);        
+        palTimerFree(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
         csrLLClose(&pNeighborRoamInfo->roamableAPList);
         return eHAL_STATUS_RESOURCES;
     }
@@ -3498,6 +3697,7 @@
     pNeighborRoamInfo->neighborScanTimerInfo.sessionId = CSR_SESSION_ID_INVALID;
     palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
     palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+    palTimerFree(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
 
     /* Should free up the nodes in the list before closing the double Linked list */
     csrNeighborRoamFreeRoamableBSSList(pMac, &pNeighborRoamInfo->roamableAPList);
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 78da5a8..35d1445 100755
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -892,7 +892,7 @@
 
   smeOpen must be called before any other SME APIs can be involved.
   smeOpen must be called after macOpen.
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
 
   \return eHAL_STATUS_SUCCESS - SME is successfully initialized.
@@ -1018,7 +1018,7 @@
    and there power using information from nvRAM
    This function is called only for AP.
 
-  This is a synchronuous call
+  This is a synchronous call
 
   \param hHal - The handle returned by macOpen.
   \Param pSmeConfigParams - a pointer to a caller allocated object of
@@ -1053,7 +1053,7 @@
 
   \brief sme_getSoftApDomain() - Get the current regulatory domain of softAp.
 
-  This is a synchronuous call
+  This is a synchronous call
 
   \param hHal - The handle returned by HostapdAdapter.
   \Param v_REGDOMAIN_t - The current Regulatory Domain requested for SoftAp.
@@ -1108,7 +1108,7 @@
   It is used at driver start up to inform RIVA of the default channel 
   configuration. 
 
-  This is a synchronuous call
+  This is a synchronous call
 
   \param hHal - The handle returned by macOpen.
   
@@ -1137,7 +1137,7 @@
 
   Modules inside SME apply the new configuration at the next transaction.
 
-  This is a synchronuous call
+  This is a synchronous call
 
   \param hHal - The handle returned by macOpen.
   \Param pSmeConfigParams - a pointer to a caller allocated object of
@@ -1208,7 +1208,7 @@
     API provides info regarding 11d only at reset but we can extend this for
     other params (PMC, QoS) which needs to be initialized again at reset.
 
-    This is a synchronuous call
+    This is a synchronous call
 
     \param hHal - The handle returned by macOpen.
 
@@ -1251,7 +1251,7 @@
   The function is called by HDD at the end of initialization stage so PE/HAL can
   enable the NIC to running state.
 
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
 
   \return eHAL_STATUS_SUCCESS - eWNI_SME_SYS_READY_IND is sent to PE
@@ -1344,7 +1344,7 @@
 
   The function starts each module in SME, PMC, CCM, CSR, etc. . Upon
   successfully return, all modules are ready to run.
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
 
   \return eHAL_STATUS_SUCCESS - SME is ready.
@@ -1447,7 +1447,7 @@
   The function is called by a message dispatcher when to process a message
   targeted for SME.
 
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
   \param pMsg - A pointer to a caller allocated object of tSirMsgQ.
 
@@ -1821,7 +1821,7 @@
   The function stops each module in SME, PMC, CCM, CSR, etc. . Upon
   return, all modules are at idle state ready to start.
 
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen
 
   \return eHAL_STATUS_SUCCESS - SME is stopped.
@@ -1887,7 +1887,7 @@
 
   No SME APIs can be involved after smeClose except smeOpen.
   smeClose must be called before macClose.
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen
 
   \return eHAL_STATUS_SUCCESS - SME is successfully close.
@@ -2013,7 +2013,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_ScanRequest
     \brief a wrapper function to Request a 11d or full scan from CSR.
-    This is an asynchronuous call
+    This is an asynchronous call
     \param pScanRequestID - pointer to an object to get back the request ID
     \param callback - a callback function that scan calls upon finish, will not
                       be called if csrScanRequest returns error
@@ -2076,7 +2076,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_ScanGetResult
     \brief a wrapper function to request scan results from CSR.
-    This is a synchronuous call
+    This is a synchronous call
     \param pFilter - If pFilter is NULL, all cached results are returned
     \param phResult - an object for the result.
     \return eHalStatus
@@ -2103,7 +2103,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_ScanFlushResult
     \brief a wrapper function to request CSR to clear scan results.
-    This is a synchronuous call
+    This is a synchronous call
     \return eHalStatus
   ---------------------------------------------------------------------------*/
 eHalStatus sme_ScanFlushResult(tHalHandle hHal, tANI_U8 sessionId)
@@ -2140,7 +2140,7 @@
     \fn sme_ScanResultGetFirst
     \brief a wrapper function to request CSR to returns the first element of
            scan result.
-    This is a synchronuous call
+    This is a synchronous call
     \param hScanResult - returned from csrScanGetResult
     \return tCsrScanResultInfo * - NULL if no result
   ---------------------------------------------------------------------------*/
@@ -2167,7 +2167,7 @@
     \brief a wrapper function to request CSR to returns the next element of
            scan result. It can be called without calling csrScanResultGetFirst
            first
-    This is a synchronuous call
+    This is a synchronous call
     \param hScanResult - returned from csrScanGetResult
     \return Null if no result or reach the end
   ---------------------------------------------------------------------------*/
@@ -2192,7 +2192,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_ScanSetBGScanparams
     \brief a wrapper function to request CSR to set BG scan params in PE
-    This is a synchronuous call
+    This is a synchronous call
     \param pScanReq - BG scan request structure
     \return eHalStatus
   ---------------------------------------------------------------------------*/
@@ -2219,7 +2219,7 @@
     \fn sme_ScanResultPurge
     \brief a wrapper function to request CSR to remove all items(tCsrScanResult)
            in the list and free memory for each item
-    This is a synchronuous call
+    This is a synchronous call
     \param hScanResult - returned from csrScanGetResult. hScanResult is
                          considered gone by
     calling this function and even before this function reutrns.
@@ -2243,7 +2243,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_ScanGetPMKIDCandidateList
     \brief a wrapper function to return the PMKID candidate list
-    This is a synchronuous call
+    This is a synchronous call
     \param pPmkidList - caller allocated buffer point to an array of
                         tPmkidCandidateInfo
     \param pNumItems - pointer to a variable that has the number of
@@ -2323,7 +2323,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_RoamConnect
     \brief a wrapper function to request CSR to inititiate an association
-    This is an asynchronuous call.
+    This is an asynchronous call.
     \param sessionId - the sessionId returned by sme_OpenSession.
     \param pProfile - description of the network to which to connect
     \param hBssListIn - a list of BSS descriptor to roam to. It is returned
@@ -2413,7 +2413,7 @@
     \fn sme_RoamConnectToLastProfile
     \brief a wrapper function to request CSR to disconnect and reconnect with
            the same profile
-    This is an asynchronuous call.
+    This is an asynchronous call.
     \return eHalStatus. It returns fail if currently connected
   ---------------------------------------------------------------------------*/
 eHalStatus sme_RoamConnectToLastProfile(tHalHandle hHal, tANI_U8 sessionId)
@@ -2441,7 +2441,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_RoamDisconnect
     \brief a wrapper function to request CSR to disconnect from a network
-    This is an asynchronuous call.
+    This is an asynchronous call.
     \param reason -- To indicate the reason for disconnecting. Currently, only
                      eCSR_DISCONNECT_REASON_MIC_ERROR is meanful.
     \return eHalStatus
@@ -2700,7 +2700,7 @@
     \fn sme_RoamGetConnectState
     \brief a wrapper function to request CSR to return the current connect state
            of Roaming
-    This is a synchronuous call.
+    This is a synchronous call.
     \return eHalStatus
   ---------------------------------------------------------------------------*/
 eHalStatus sme_RoamGetConnectState(tHalHandle hHal, tANI_U8 sessionId, eCsrConnectState *pState)
@@ -2730,7 +2730,7 @@
     \brief a wrapper function to request CSR to return the current connect
            profile. Caller must call csrRoamFreeConnectProfile after it is done
            and before reuse for another csrRoamGetConnectProfile call.
-    This is a synchronuous call.
+    This is a synchronous call.
     \param pProfile - pointer to a caller allocated structure
                       tCsrRoamConnectedProfile
     \return eHalStatus. Failure if not connected
@@ -2762,7 +2762,7 @@
     \fn sme_RoamFreeConnectProfile
     \brief a wrapper function to request CSR to free and reinitialize the
            profile returned previously by csrRoamGetConnectProfile.
-    This is a synchronuous call.
+    This is a synchronous call.
     \param pProfile - pointer to a caller allocated structure
                       tCsrRoamConnectedProfile
     \return eHalStatus.
@@ -2786,7 +2786,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_RoamSetPMKIDCache
     \brief a wrapper function to request CSR to return the PMKID candidate list
-    This is a synchronuous call.
+    This is a synchronous call.
     \param pPMKIDCache - caller allocated buffer point to an array of
                          tPmkidCacheInfo
     \param numItems - a variable that has the number of tPmkidCacheInfo
@@ -2825,7 +2825,7 @@
     \fn sme_RoamGetSecurityReqIE
     \brief a wrapper function to request CSR to return the WPA or RSN or WAPI IE CSR
            passes to PE to JOIN request or START_BSS request
-    This is a synchronuous call.
+    This is a synchronous call.
     \param pLen - caller allocated memory that has the length of pBuf as input.
                   Upon returned, *pLen has the needed or IE length in pBuf.
     \param pBuf - Caller allocated memory that contain the IE field, if any,
@@ -2861,7 +2861,7 @@
     \fn sme_RoamGetSecurityRspIE
     \brief a wrapper function to request CSR to return the WPA or RSN or WAPI IE from
            the beacon or probe rsp if connected
-    This is a synchronuous call.
+    This is a synchronous call.
     \param pLen - caller allocated memory that has the length of pBuf as input.
                   Upon returned, *pLen has the needed or IE length in pBuf.
     \param pBuf - Caller allocated memory that contain the IE field, if any,
@@ -2899,7 +2899,7 @@
     \fn sme_RoamGetNumPMKIDCache
     \brief a wrapper function to request CSR to return number of PMKID cache
            entries
-    This is a synchronuous call.
+    This is a synchronous call.
     \return tANI_U32 - the number of PMKID cache entries
   ---------------------------------------------------------------------------*/
 tANI_U32 sme_RoamGetNumPMKIDCache(tHalHandle hHal, tANI_U8 sessionId)
@@ -2929,7 +2929,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_RoamGetPMKIDCache
     \brief a wrapper function to request CSR to return PMKID cache from CSR
-    This is a synchronuous call.
+    This is a synchronous call.
     \param pNum - caller allocated memory that has the space of the number of
                   pBuf tPmkidCacheInfo as input. Upon returned, *pNum has the
                   needed or actually number in tPmkidCacheInfo.
@@ -2966,7 +2966,7 @@
     \fn sme_GetConfigParam
     \brief a wrapper function that HDD calls to get the global settings
            currently maintained by CSR.
-    This is a synchronuous call.
+    This is a synchronous call.
     \param pParam - caller allocated memory
     \return eHalStatus
   ---------------------------------------------------------------------------*/
@@ -3003,7 +3003,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_CfgSetInt
     \brief a wrapper function that HDD calls to set parameters in CFG.
-    This is a synchronuous call.
+    This is a synchronous call.
     \param cfgId - Configuration Parameter ID (type) for STA.
     \param ccmValue - The information related to Configuration Parameter ID
                       which needs to be saved in CFG
@@ -3022,7 +3022,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_CfgSetStr
     \brief a wrapper function that HDD calls to set parameters in CFG.
-    This is a synchronuous call.
+    This is a synchronous call.
     \param cfgId - Configuration Parameter ID (type) for STA.
     \param pStr - Pointer to the byte array which carries the information needs
                   to be saved in CFG
@@ -6879,8 +6879,20 @@
 eHalStatus sme_UpdateRoamPrefer5GHz(tHalHandle hHal, v_BOOL_t nRoamPrefer5GHz)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    pMac->roam.configParam.nRoamPrefer5GHz = nRoamPrefer5GHz;
-    return(eHAL_STATUS_SUCCESS);
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                     "%s: gRoamPrefer5GHz is changed from %d to %d", __func__,
+                      pMac->roam.configParam.nRoamPrefer5GHz,
+                      nRoamPrefer5GHz);
+        pMac->roam.configParam.nRoamPrefer5GHz = nRoamPrefer5GHz;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
 }
 
 /* ---------------------------------------------------------------------------
@@ -6898,15 +6910,60 @@
 eHalStatus sme_UpdateImmediateRoamRssiDiff(tHalHandle hHal, v_U8_t nImmediateRoamRssiDiff)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    pMac->roam.configParam.nImmediateRoamRssiDiff = nImmediateRoamRssiDiff;
-    return(eHAL_STATUS_SUCCESS);
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set immediate roam rssi diff to %d - old value is %d - roam state is %d",
+                     nImmediateRoamRssiDiff,
+                     pMac->roam.configParam.nImmediateRoamRssiDiff,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+        pMac->roam.configParam.nImmediateRoamRssiDiff = nImmediateRoamRssiDiff;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_UpdateRoamRssiDiff
+    \brief  Update RoamRssiDiff
+            This function is called through dynamic setConfig callback function
+            to configure RoamRssiDiff
+            Usage: adb shell iwpriv wlan0 setConfig RoamRssiDiff=[0 .. 125]
+    \param  hHal - HAL handle for device
+    \param  RoamRssiDiff - minimum rssi difference between potential
+            candidate and current AP.
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+
+eHalStatus sme_UpdateRoamRssiDiff(tHalHandle hHal, v_U8_t RoamRssiDiff)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set roam rssi diff to %d - old value is %d - roam state is %d",
+                     RoamRssiDiff,
+                     pMac->roam.configParam.RoamRssiDiff,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+        pMac->roam.configParam.RoamRssiDiff = RoamRssiDiff;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
 }
 
 /*--------------------------------------------------------------------------
   \brief sme_UpdateFastTransitionEnabled() - enable/disable Fast Transition support at runtime
   It is used at in the REG_DYNAMIC_VARIABLE macro definition of 
   isFastTransitionEnabled.
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
   \return eHAL_STATUS_SUCCESS - SME update isFastTransitionEnabled config successfully.
           Other status means SME is failed to update isFastTransitionEnabled.
@@ -6916,9 +6973,20 @@
         v_BOOL_t isFastTransitionEnabled)
 {
   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
 
-  pMac->roam.configParam.isFastTransitionEnabled = isFastTransitionEnabled;
-  return eHAL_STATUS_SUCCESS;
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                     "%s: FastTransitionEnabled is changed from %d to %d", __func__,
+                      pMac->roam.configParam.isFastTransitionEnabled,
+                      isFastTransitionEnabled);
+        pMac->roam.configParam.isFastTransitionEnabled = isFastTransitionEnabled;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
 }
 #endif /* (WLAN_FEATURE_VOWIFI_11R) || (FEATURE_WLAN_CCX) || (FEATURE_WLAN_LFR) */
 
@@ -6927,7 +6995,7 @@
   \brief sme_UpdateIsFastRoamIniFeatureEnabled() - enable/disable LFR support at runtime
   It is used at in the REG_DYNAMIC_VARIABLE macro definition of 
   isFastRoamIniFeatureEnabled.
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
   \return eHAL_STATUS_SUCCESS - SME update isFastRoamIniFeatureEnabled config successfully.
           Other status means SME is failed to update isFastRoamIniFeatureEnabled.
@@ -6938,24 +7006,26 @@
 {
   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+  VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                     "%s: FastRoamEnabled is changed from %d to %d", __func__,
+                      pMac->roam.configParam.isFastRoamIniFeatureEnabled,
+                      isFastRoamIniFeatureEnabled);
   pMac->roam.configParam.isFastRoamIniFeatureEnabled = isFastRoamIniFeatureEnabled;
 
   if(TRUE == isFastRoamIniFeatureEnabled)
   {
-      sme_UpdateFastTransitionEnabled(hHal, TRUE);
       sme_UpdateConfigFwRssiMonitoring(hHal, TRUE);
   }
   else
   {
-      /* CCX also depend on FW Monitoring/FastTransition.
-         Hence Disabling LFR should check for CCX enable before disabling FW Monitoring and Fast Transition */
+      /* CCX also depend on FW Monitoring.
+         Hence Disabling LFR should check for CCX enable before disabling FW Monitoring */
 #ifdef FEATURE_WLAN_CCX
       if(FALSE == pMac->roam.configParam.isCcxIniFeatureEnabled)
 #endif
       {
           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                     "%s: Turn off FW Monitoring/Fast Transition", __func__);
-          sme_UpdateFastTransitionEnabled(hHal, FALSE);
+                     "%s: Turn off FW Monitoring", __func__);
           sme_UpdateConfigFwRssiMonitoring(hHal, FALSE);
       }
   }
@@ -6969,7 +7039,7 @@
   \brief sme_UpdateIsCcxFeatureEnabled() - enable/disable CCX support at runtime
   It is used at in the REG_DYNAMIC_VARIABLE macro definition of
   isCcxIniFeatureEnabled.
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
   \return eHAL_STATUS_SUCCESS - SME update isCcxIniFeatureEnabled config successfully.
           Other status means SME is failed to update isCcxIniFeatureEnabled.
@@ -6981,6 +7051,10 @@
 {
   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+  VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                     "%s: CcxEnabled is changed from %d to %d", __func__,
+                      pMac->roam.configParam.isCcxIniFeatureEnabled,
+                      isCcxIniFeatureEnabled);
   pMac->roam.configParam.isCcxIniFeatureEnabled = isCcxIniFeatureEnabled;
 
   if(TRUE == isCcxIniFeatureEnabled)
@@ -6990,7 +7064,7 @@
   }
   else
   {
-      /* LFR also depend on FW Monitoring/FastTransition.
+      /* LFR also depend on FW Monitoring.
          Hence Disabling CCX should check for LFR enable before disabling FW Monitoring and Fast Transition */
 #ifdef FEATURE_WLAN_LFR
       if(FALSE == pMac->roam.configParam.isFastRoamIniFeatureEnabled)
@@ -7010,7 +7084,7 @@
   \brief sme_UpdateConfigFwRssiMonitoring() - enable/disable firmware RSSI Monitoring at runtime
   It is used at in the REG_DYNAMIC_VARIABLE macro definition of
   fEnableFwRssiMonitoring.
-  This is a synchronuous call
+  This is a synchronous call
   \param hHal - The handle returned by macOpen.
   \return eHAL_STATUS_SUCCESS - SME update fEnableFwRssiMonitoring. config successfully.
           Other status means SME is failed to update fEnableFwRssiMonitoring.
@@ -7022,7 +7096,6 @@
 {
     eHalStatus halStatus = eHAL_STATUS_SUCCESS;
 
-
     if (ccmCfgSetInt(hHal, WNI_CFG_PS_ENABLE_RSSI_MONITOR, fEnableFwRssiMonitoring,
                     NULL, eANI_BOOLEAN_FALSE)==eHAL_STATUS_FAILURE)
     {
@@ -7034,6 +7107,355 @@
     return (halStatus);
 }
 
+/*--------------------------------------------------------------------------
+  \brief sme_setNeighborLookupRssiThreshold() - update neighbor lookup rssi threshold
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_setNeighborLookupRssiThreshold(tHalHandle hHal,
+               v_U8_t neighborLookupRssiThreshold)
+{
+    tpAniSirGlobal pMac    = PMAC_STRUCT( hHal );
+    eHalStatus     status  = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        status = csrNeighborRoamSetLookupRssiThreshold(pMac, neighborLookupRssiThreshold);
+        if (HAL_STATUS_SUCCESS(status))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set Lookup threshold to %d - old value is %d - roam state is %d",
+                     neighborLookupRssiThreshold,
+                     pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+            pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold =
+                                            neighborLookupRssiThreshold;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status;
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_setNeighborReassocRssiThreshold() - update neighbor reassoc rssi threshold
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_setNeighborReassocRssiThreshold(tHalHandle hHal,
+        v_U8_t neighborReassocRssiThreshold)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set Reassoc threshold to %d - old value is %d - roam state is %d",
+                     neighborReassocRssiThreshold,
+                     pMac->roam.configParam.neighborRoamConfig.nNeighborReassocRssiThreshold,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+        pMac->roam.configParam.neighborRoamConfig.nNeighborReassocRssiThreshold =
+                                      neighborReassocRssiThreshold;
+        pMac->roam.neighborRoamInfo.cfgParams.neighborReassocThreshold =
+                                      neighborReassocRssiThreshold;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+}
+
+
+/*--------------------------------------------------------------------------
+  \brief sme_getNeighborLookupRssiThreshold() - get neighbor lookup rssi threshold
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_getNeighborLookupRssiThreshold(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold;
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_setNeighborScanRefreshPeriod() - set neighbor scan results refresh period
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_setNeighborScanRefreshPeriod(tHalHandle hHal,
+                 v_U16_t neighborScanResultsRefreshPeriod)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set roam scan refresh period to %d - old value is %d - roam state is %d",
+                     neighborScanResultsRefreshPeriod,
+                     pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+        pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod =
+                                  neighborScanResultsRefreshPeriod;
+        pMac->roam.neighborRoamInfo.cfgParams.neighborResultsRefreshPeriod =
+                                  neighborScanResultsRefreshPeriod;
+
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_getNeighborScanRefreshPeriod() - get neighbor scan results refresh period
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return v_U16_t - Neighbor scan results refresh period value
+  \sa
+  --------------------------------------------------------------------------*/
+v_U16_t sme_getNeighborScanRefreshPeriod(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod;
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_getEmptyScanRefreshPeriod() - get empty scan refresh period
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+v_U16_t sme_getEmptyScanRefreshPeriod(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.neighborRoamConfig.nEmptyScanRefreshPeriod;
+}
+
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+/*--------------------------------------------------------------------------
+  \brief sme_getRoamRssiDiff() - get Roam rssi diff
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return v_U16_t - Rssi diff value
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_getRoamRssiDiff(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.RoamRssiDiff;
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_ChangeRoamScanChannelList() - Change roam scan channel list
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_ChangeRoamScanChannelList(tHalHandle hHal, tANI_U8 *pChannelList,
+                                         tANI_U8 numChannels)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    tANI_U8 oldChannelList[128] = {0};
+    tANI_U8 newChannelList[128] = {0};
+    tANI_U8 i = 0, j = 0;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        if (NULL != pNeighborRoamInfo->cfgParams.channelInfo.ChannelList)
+        {
+            for (i = 0; i < pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels; i++)
+            {
+                j += snprintf(oldChannelList + j, sizeof(oldChannelList) - j," %d",
+                pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i]);
+            }
+        }
+        csrFlushAndCreateBgScanRoamChannelList(pMac, pChannelList, numChannels);
+        status = csrUpdateBgScanConfigIniChannelList(pMac, csrGetCurrentBand(hHal));
+
+        if (NULL != pNeighborRoamInfo->cfgParams.channelInfo.ChannelList)
+        {
+            j = 0;
+            for (i = 0; i < pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels; i++)
+            {
+                j += snprintf(newChannelList + j, sizeof(newChannelList) - j," %d",
+                pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i]);
+            }
+        }
+
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set roam scan channels to %s - old value is %s - roam state is %d",
+                     newChannelList, oldChannelList,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_ChangeCountryValidChannelListByRevision() - Change Korea valid channel list
+  based on country revision number
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_ChangeCountryValidChannelListByRevision(tHalHandle hHal,
+                                         tANI_U8 Revision)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set country/revision to %s/%d - old value is %s/%d - roam state is %d",
+                     "KR", Revision, "KR",
+                     pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.revision,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+        csr_SetRevision(pMac, Revision);
+        csrInitCountryValidChannelList(pMac, Revision);
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+}
+
+
+/*--------------------------------------------------------------------------
+  \brief csrUpdateBgScanConfigIniChannelList() - Update bgscan roam cache
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_UpdateBgScanConfigIniChannelList(tHalHandle hHal,
+                                               eCsrBand eBand)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return csrUpdateBgScanConfigIniChannelList(pMac, eBand);
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_getRoamScanChannelList() - get roam scan channel list
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_getRoamScanChannelList(tHalHandle hHal, tANI_U8 *pChannelList,
+                                         tANI_U8 *pNumChannels)
+{
+    int i  = 0;
+    tANI_U8 *pOutPtr = pChannelList;
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        if (NULL == pNeighborRoamInfo->cfgParams.channelInfo.ChannelList)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
+                     "Roam Scan channel list is NOT yet initialized");
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_NOT_INITIALIZED;
+        }
+
+        *pNumChannels = pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels;
+        for (i = 0; i < (*pNumChannels); i++)
+        {
+            pOutPtr[i] = pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i];
+        }
+        pOutPtr[i] = '\0';
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+}
+
+/*--------------------------------------------------------------------------
+  \brief sme_GetCountryRevision() - get Country revision index
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update config successful.
+          Other status means SME is failed to update
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_GetCountryRevision(tHalHandle hHal, tANI_U8 *pRevision)
+{
+    /* this is valid for Country KR only now */
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    *pRevision = pNeighborRoamInfo->cfgParams.countryChannelInfo.revision;
+
+    return status;
+}
+
+#endif
+
+/* ---------------------------------------------------------------------------
+    \fn sme_UpdateEmptyScanRefreshPeriod
+    \brief  Update nEmptyScanRefreshPeriod
+            This function is called through dynamic setConfig callback function
+            to configure nEmptyScanRefreshPeriod
+            Usage: adb shell iwpriv wlan0 setConfig nEmptyScanRefreshPeriod=[0 .. 60]
+    \param  hHal - HAL handle for device
+    \param  nEmptyScanRefreshPeriod - scan period following empty scan results.
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+
+eHalStatus sme_UpdateEmptyScanRefreshPeriod(tHalHandle hHal, v_U16_t nEmptyScanRefreshPeriod)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                     "LFR runtime successfully set roam scan period to %d - old value is %d - roam state is %d",
+                     nEmptyScanRefreshPeriod,
+                     pMac->roam.configParam.neighborRoamConfig.nEmptyScanRefreshPeriod,
+                     pMac->roam.neighborRoamInfo.neighborRoamState);
+        pMac->roam.configParam.neighborRoamConfig.nEmptyScanRefreshPeriod = nEmptyScanRefreshPeriod;
+        pMac->roam.neighborRoamInfo.cfgParams.emptyScanRefreshPeriod = nEmptyScanRefreshPeriod;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+
+}
+
 
 
 /* ---------------------------------------------------------------------------
diff --git a/firmware_bin/WCNSS_qcom_cfg.ini b/firmware_bin/WCNSS_qcom_cfg.ini
index 73ce6cf..91efbbd 100644
--- a/firmware_bin/WCNSS_qcom_cfg.ini
+++ b/firmware_bin/WCNSS_qcom_cfg.ini
@@ -64,11 +64,6 @@
 InfraUapsdBkSrvIntv=0
 
 
-# Disable RSSI FW filtering
-
-gEnableFWRssiMonitoring=1
-
-
 # Make 1x1 the default antenna configuration
 
 gNumRxAnt=1
@@ -172,8 +167,8 @@
 gMaxNeighborReqTries=3
 
 # Legacy (non-CCX, non-802.11r) Fast Roaming Support
-# To enable, set FastRoamEnabled=1, gEnableFWRssiMonitoring=1, FastTransitionEnabled=1
-# To disable, set FastRoamEnabled=0, gEnableFWRssiMonitoring=0, FastTransitionEnabled=0
+# To enable, set FastRoamEnabled=1
+# To disable, set FastRoamEnabled=0
 FastRoamEnabled=1
 
 #Check if the AP to which we are roaming is better than current AP in terms of RSSI.
@@ -181,12 +176,11 @@
 #the RSSI of the new/roamable AP should be for roaming
 RoamRssiDiff=3
 
-#Configure the RSSI gap that will be used to partition/categorize width of 
-#each  individual category (aka bucket).
-gRssiCatGap=5
-
-#Prefer 5GHz APs while roaming (default is gRoamPrefer5GHz=1)
-gRoamPrefer5GHz=1
+# If the RSSI of any available candidate is better than currently associated
+# AP by at least gImmediateRoamRssiDiff, then being to roam immediately (without
+# registering for reassoc threshold).
+# NOTE: Value of 0 means that we would register for reassoc threshold.
+gImmediateRoamRssiDiff=10
 
 # SAP Country code