diff --git a/dp/inc/cdp_txrx_cmn_reg.h b/dp/inc/cdp_txrx_cmn_reg.h
index 2957c64acd..97dbf8a885 100644
--- a/dp/inc/cdp_txrx_cmn_reg.h
+++ b/dp/inc/cdp_txrx_cmn_reg.h
@@ -98,6 +98,7 @@ static inline ol_txrx_soc_handle cdp_soc_attach(
 	case QCA8074_DEVICE_ID: /* Hawekeye */
 	case QCA8074V2_DEVICE_ID: /* Hawekeye V2*/
 	case QCA6290_DEVICE_ID:
+	case QCN9000_DEVICE_ID:
 	case QCA6390_DEVICE_ID:
 	case QCA6390_EMULATION_DEVICE_ID:
 	case RUMIM2M_DEVICE_ID_NODE0: /*lithium emulation */
diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c
index dcc91f1758..8b93963bb2 100644
--- a/dp/wifi3.0/dp_main.c
+++ b/dp/wifi3.0/dp_main.c
@@ -2348,8 +2348,10 @@ static void dp_hw_link_desc_pool_cleanup(struct dp_soc *soc)
 #define REO_DST_RING_SIZE_QCA6290 1023
 #ifndef QCA_WIFI_QCA8074_VP
 #define REO_DST_RING_SIZE_QCA8074 1023
+#define REO_DST_RING_SIZE_QCN9000 2048
 #else
 #define REO_DST_RING_SIZE_QCA8074 8
+#define REO_DST_RING_SIZE_QCN9000 8
 #endif /* QCA_WIFI_QCA8074_VP */
 
 #else
@@ -2357,8 +2359,10 @@ static void dp_hw_link_desc_pool_cleanup(struct dp_soc *soc)
 #define REO_DST_RING_SIZE_QCA6290 1024
 #ifndef QCA_WIFI_QCA8074_VP
 #define REO_DST_RING_SIZE_QCA8074 2048
+#define REO_DST_RING_SIZE_QCN9000 2048
 #else
 #define REO_DST_RING_SIZE_QCA8074 8
+#define REO_DST_RING_SIZE_QCN9000 8
 #endif /* QCA_WIFI_QCA8074_VP */
 #endif /* IPA_OFFLOAD */
 
@@ -9825,6 +9829,16 @@ void *dp_soc_init(void *dpsoc, HTC_HANDLE htc_handle,
 		soc->da_war_enabled = false;
 		soc->is_rx_fse_full_cache_invalidate_war_enabled = true;
 		break;
+	case TARGET_TYPE_QCN9000:
+		wlan_cfg_set_reo_dst_ring_size(soc->wlan_cfg_ctx,
+					       REO_DST_RING_SIZE_QCN9000);
+		soc->ast_override_support = 1;
+		soc->da_war_enabled = false;
+		wlan_cfg_set_raw_mode_war(soc->wlan_cfg_ctx, false);
+		soc->hw_nac_monitor_support = 1;
+		soc->per_tid_basize_max_tid = 8;
+		soc->num_hw_dscp_tid_map = HAL_MAX_HW_DSCP_TID_V2_MAPS;
+		break;
 	default:
 		qdf_print("%s: Unknown tgt type %d\n", __func__, target_type);
 		qdf_assert_always(0);
diff --git a/dp/wifi3.0/dp_rx.h b/dp/wifi3.0/dp_rx.h
index 6c9b2e84d1..7e7a1eb9c8 100644
--- a/dp/wifi3.0/dp_rx.h
+++ b/dp/wifi3.0/dp_rx.h
@@ -597,7 +597,8 @@ void dp_2k_jump_handle(struct dp_soc *soc, qdf_nbuf_t nbuf, uint8_t *rx_tlv_hdr,
 		qdf_nbuf_set_next((tail), NULL);                      \
 	} while (0)
 
-#ifndef BUILD_X86
+/*for qcn9000 emulation the pcie is complete phy and no address restrictions*/
+#if !defined(BUILD_X86) || defined(QCA_WIFI_QCN9000)
 static inline int check_x86_paddr(struct dp_soc *dp_soc, qdf_nbuf_t *rx_netbuf,
 		qdf_dma_addr_t *paddr, struct dp_pdev *pdev)
 {
diff --git a/hal/wifi3.0/hal_generic_api.h b/hal/wifi3.0/hal_generic_api.h
index 6ac4dee079..cb282f6867 100644
--- a/hal/wifi3.0/hal_generic_api.h
+++ b/hal/wifi3.0/hal_generic_api.h
@@ -738,6 +738,7 @@ hal_rx_status_get_tlv_info_generic(void *rx_tlv_hdr, void *ppduinfo,
 		case TARGET_TYPE_QCA8074:
 		case TARGET_TYPE_QCA8074V2:
 		case TARGET_TYPE_QCA6018:
+		case TARGET_TYPE_QCN9000:
 #ifdef QCA_WIFI_QCA6390
 		case TARGET_TYPE_QCA6390:
 #endif
diff --git a/hal/wifi3.0/hal_srng.c b/hal/wifi3.0/hal_srng.c
index 1f4f7e84ae..9ed6c3523c 100644
--- a/hal/wifi3.0/hal_srng.c
+++ b/hal/wifi3.0/hal_srng.c
@@ -33,6 +33,9 @@ void hal_qca8074v2_attach(struct hal_soc *hal);
 #ifdef QCA_WIFI_QCA6390
 void hal_qca6390_attach(struct hal_soc *hal);
 #endif
+#ifdef QCA_WIFI_QCN9000
+void hal_qcn9000_attach(struct hal_soc *hal);
+#endif
 
 #ifdef ENABLE_VERBOSE_DEBUG
 bool is_hal_verbose_debug_enabled;
@@ -260,6 +263,13 @@ static void hal_target_based_configure(struct hal_soc *hal)
 		hal_qca8074v2_attach(hal);
 	break;
 #endif
+
+#ifdef QCA_WIFI_QCN9000
+	case TARGET_TYPE_QCN9000:
+		hal->use_register_windowing = true;
+		hal_qcn9000_attach(hal);
+	break;
+#endif
 	default:
 	break;
 	}
diff --git a/hif/inc/hif.h b/hif/inc/hif.h
index dd213837a0..6185b10369 100644
--- a/hif/inc/hif.h
+++ b/hif/inc/hif.h
@@ -62,6 +62,7 @@ typedef void *hif_handle_t;
 #define HIF_TYPE_QCA6390 18
 #define HIF_TYPE_QCA8074V2 19
 #define HIF_TYPE_QCA6018  20
+#define HIF_TYPE_QCN9000 21
 
 #ifdef IPA_OFFLOAD
 #define DMA_COHERENT_MASK_IPA_VER_3_AND_ABOVE   37
diff --git a/hif/inc/hostdef.h b/hif/inc/hostdef.h
index 9b0e4d1874..6dd1d2466c 100644
--- a/hif/inc/hostdef.h
+++ b/hif/inc/hostdef.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016,2018 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016,2018-2019 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -41,5 +41,5 @@ extern struct hostdef_s *IPQ4019_HOSTdef;
 extern struct hostdef_s *QCA8074_HOSTdef;
 extern struct hostdef_s *QCA8074V2_HOSTDEF;
 extern struct hostdef_s *QCA6018_HOSTDEF;
-
+extern struct hostdef_s *QCN9000_HOSTDEF;
 #endif
diff --git a/hif/inc/target_type.h b/hif/inc/target_type.h
index d071c490e1..6f1469edf1 100644
--- a/hif/inc/target_type.h
+++ b/hif/inc/target_type.h
@@ -51,6 +51,9 @@ extern "C" {
 #ifndef TARGET_TYPE_QCA6018
 #define TARGET_TYPE_QCA6018      25
 #endif
+#ifndef TARGET_TYPE_QCN9000
+#define TARGET_TYPE_QCN9000      26
+#endif
 
 #ifdef __cplusplus
 }
diff --git a/hif/inc/targetdef.h b/hif/inc/targetdef.h
index 180ac8ab31..6bb6dcc740 100644
--- a/hif/inc/targetdef.h
+++ b/hif/inc/targetdef.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016,2018 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016,2018-2019 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -41,6 +41,7 @@ extern struct targetdef_s *IPQ4019_TARGETdef;
 extern struct targetdef_s *QCA8074_TARGETdef;
 extern struct targetdef_s *QCA8074V2_TARGETDEF;
 extern struct targetdef_s *QCA6018_TARGETDEF;
+extern struct targetdef_s *QCN9000_TARGETDEF;
 
 extern struct ce_reg_def *AR6002_CE_TARGETdef;
 extern struct ce_reg_def *AR6003_CE_TARGETdef;
@@ -59,6 +60,7 @@ extern struct ce_reg_def *IPQ4019_CE_TARGETdef;
 extern struct ce_reg_def *QCA8074_CE_TARGETdef;
 extern struct ce_reg_def *QCA8074V2_CE_TARGETDEF;
 extern struct ce_reg_def *QCA6018_CE_TARGETDEF;
+extern struct ce_reg_def *QCN9000_CE_TARGETDEF;
 
 
 #endif
diff --git a/hif/src/ath_procfs.c b/hif/src/ath_procfs.c
index 16a707fd4a..e37bc8b507 100644
--- a/hif/src/ath_procfs.c
+++ b/hif/src/ath_procfs.c
@@ -85,6 +85,7 @@ static ssize_t ath_procfs_diag_read(struct file *file, char __user *buf,
 	     (tgt_info->target_type == TARGET_TYPE_QCA6390) ||
 	     (tgt_info->target_type == TARGET_TYPE_QCA8074) ||
 	     (tgt_info->target_type == TARGET_TYPE_QCA8074V2) ||
+	     (tgt_info->target_type == TARGET_TYPE_QCN9000) ||
 	     (tgt_info->target_type == TARGET_TYPE_QCA6018)))) {
 		memtype = ((uint32_t)(*pos) & 0xff000000) >> 24;
 		offset = (uint32_t)(*pos) & 0xffffff;
@@ -160,6 +161,7 @@ static ssize_t ath_procfs_diag_write(struct file *file,
 	      (tgt_info->target_type == TARGET_TYPE_QCA6390) ||
 	      (tgt_info->target_type == TARGET_TYPE_QCA8074) ||
 	      (tgt_info->target_type == TARGET_TYPE_QCA8074V2) ||
+	      (tgt_info->target_type == TARGET_TYPE_QCN9000) ||
 	      (tgt_info->target_type == TARGET_TYPE_QCA6018)))) {
 		memtype = ((uint32_t)(*pos) & 0xff000000) >> 24;
 		offset = (uint32_t)(*pos) & 0xffffff;
diff --git a/hif/src/ce/ce_assignment.h b/hif/src/ce/ce_assignment.h
index 9a73c9fc48..037e609d82 100644
--- a/hif/src/ce/ce_assignment.h
+++ b/hif/src/ce/ce_assignment.h
@@ -919,6 +919,58 @@ static struct CE_pipe_config target_ce_config_wlan_adrastea[] = {
 	{ /* CE11 */ 11, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
 };
 
+#define QCN_9000_CE_COUNT 9
+/* QCN9000 enable polling mode */
+static struct CE_attr host_ce_config_wlan_qcn9000[] = {
+	/* host->target HTC control and raw streams */
+	{ /* CE0 */ CE_ATTR_FLAGS, 0, 16, 2048, 0, NULL,},
+	/* target->host HTT + HTC control */
+	{ /* CE1 */ (CE_ATTR_FLAGS | CE_ATTR_ENABLE_POLL), 0, 0,  2048,
+		512, NULL,},
+	/* target->host WMI */
+	{ /* CE2 */ (CE_ATTR_FLAGS | CE_ATTR_ENABLE_POLL), 0, 0,  2048,
+		32, NULL,},
+	/* host->target WMI */
+	{ /* CE3 */ CE_ATTR_FLAGS, 0, 32, 2048, 0, NULL,},
+	/* host->target HTT */
+	{ /* CE4 */ (CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,
+		CE_HTT_H2T_MSG_SRC_NENTRIES, 256, 0, NULL,},
+	/* target -> host PKTLOG */
+	{ /* CE5 */ (CE_ATTR_FLAGS | CE_ATTR_ENABLE_POLL), 0, 0, 2048,
+		512, NULL,},
+	/* Target autonomous HIF_memcpy */
+	{ /* CE6 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
+	/* host->target WMI (mac1) */
+	{ /* CE7 */ CE_ATTR_FLAGS, 0, 32, 2048, 0, NULL,},
+	/* Reserved for target */
+	{ /* CE8 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
+	/* CE 9, 10, 11 belong to CoreBsp & MHI driver */
+};
+
+static struct CE_pipe_config target_ce_config_wlan_qcn9000[] = {
+	/* host->target HTC control and raw streams */
+	{ /* CE0 */ 0, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
+	/* target->host HTT */
+	{ /* CE1 */ 1, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
+	/* target->host WMI  + HTC control */
+	{ /* CE2 */ 2, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
+	/* host->target WMI */
+	{ /* CE3 */ 3, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
+	/* host->target HTT */
+	{ /* CE4 */ 4, PIPEDIR_OUT, 256, 256,
+		(CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,},
+	/* Target -> host PKTLOG */
+	{ /* CE5 */ 5, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
+	/* Reserved for target autonomous HIF_memcpy */
+	{ /* CE6 */ 6, PIPEDIR_INOUT, 32, 16384, CE_ATTR_FLAGS, 0,},
+	/* CE7 used only by Host */
+	{ /* CE7 */ 7, PIPEDIR_OUT, 32, 2048,
+		8192, 0,},
+	/* Reserved for target */
+	{ /* CE8 */ 8, PIPEDIR_INOUT, 32, 16384, CE_ATTR_FLAGS, 0,},
+	/* CE 9, 10, 11 belong to CoreBsp & MHI driver */
+};
+
 #define QCA_6290_CE_COUNT 9
 #ifdef QCA_6290_AP_MODE
 static struct CE_attr host_ce_config_wlan_qca6290[] = {
diff --git a/hif/src/ce/ce_main.c b/hif/src/ce/ce_main.c
index eea4836aa4..54b8252b6f 100644
--- a/hif/src/ce/ce_main.c
+++ b/hif/src/ce/ce_main.c
@@ -479,6 +479,33 @@ static struct service_to_pipe target_service_to_ce_map_qca6018[] = {
 };
 #endif
 
+#if (defined(QCA_WIFI_QCN9000))
+static struct service_to_pipe target_service_to_ce_map_qcn9000[] = {
+	{ WMI_DATA_VO_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_VO_SVC, PIPEDIR_IN, 2, },
+	{ WMI_DATA_BK_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_BK_SVC, PIPEDIR_IN, 2, },
+	{ WMI_DATA_BE_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_BE_SVC, PIPEDIR_IN, 2, },
+	{ WMI_DATA_VI_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_VI_SVC, PIPEDIR_IN, 2, },
+	{ WMI_CONTROL_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_CONTROL_SVC, PIPEDIR_IN, 2, },
+	{ HTC_CTRL_RSVD_SVC, PIPEDIR_OUT, 0, },
+	{ HTC_CTRL_RSVD_SVC, PIPEDIR_IN, 1, },
+	{ HTC_RAW_STREAMS_SVC, PIPEDIR_OUT, 0},
+	{ HTC_RAW_STREAMS_SVC, PIPEDIR_IN, 1 },
+	{ HTT_DATA_MSG_SVC, PIPEDIR_OUT, 4, },
+	{ HTT_DATA_MSG_SVC, PIPEDIR_IN, 1, },
+	{ PACKET_LOG_SVC, PIPEDIR_IN, 5, },
+	/* (Additions here) */
+	{ 0, 0, 0, },
+};
+#else
+static struct service_to_pipe target_service_to_ce_map_qcn9000[] = {
+};
+#endif
+
 /* PIPEDIR_OUT = HOST to Target */
 /* PIPEDIR_IN  = TARGET to HOST */
 #ifdef QCN7605_SUPPORT
@@ -792,6 +819,12 @@ static void hif_select_service_to_pipe_map(struct hif_softc *scn,
 			*sz_tgt_svc_map_to_use =
 				sizeof(target_service_to_ce_map_qca6018);
 			break;
+		case TARGET_TYPE_QCN9000:
+			*tgt_svc_map_to_use =
+				target_service_to_ce_map_qcn9000;
+			*sz_tgt_svc_map_to_use =
+				sizeof(target_service_to_ce_map_qcn9000);
+			break;
 		}
 	}
 }
@@ -1000,6 +1033,7 @@ bool ce_srng_based(struct hif_softc *scn)
 	case TARGET_TYPE_QCA6290:
 	case TARGET_TYPE_QCA6390:
 	case TARGET_TYPE_QCA6018:
+	case TARGET_TYPE_QCN9000:
 		return true;
 	default:
 		return false;
@@ -3125,6 +3159,13 @@ void hif_ce_prepare_config(struct hif_softc *scn)
 
 		scn->ce_count = QCA_6290_CE_COUNT;
 		break;
+	case TARGET_TYPE_QCN9000:
+		hif_state->host_ce_config = host_ce_config_wlan_qcn9000;
+		hif_state->target_ce_config = target_ce_config_wlan_qcn9000;
+		hif_state->target_ce_config_sz =
+					sizeof(target_ce_config_wlan_qcn9000);
+		scn->ce_count = QCN_9000_CE_COUNT;
+		break;
 	case TARGET_TYPE_QCA6390:
 		hif_state->host_ce_config = host_ce_config_wlan_qca6390;
 		hif_state->target_ce_config = target_ce_config_wlan_qca6390;
diff --git a/hif/src/hif_main.c b/hif/src/hif_main.c
index 69b2d379db..df4283aac1 100644
--- a/hif/src/hif_main.c
+++ b/hif/src/hif_main.c
@@ -488,7 +488,8 @@ void hif_close(struct hif_opaque_softc *hif_ctx)
 }
 
 #if defined(QCA_WIFI_QCA8074) || defined(QCA_WIFI_QCA6018) || \
-	defined(QCA_WIFI_QCA6290) || defined(QCA_WIFI_QCA6390)
+	defined(QCA_WIFI_QCA6290) || defined(QCA_WIFI_QCA6390) || \
+	defined(QCA_WIFI_QCN9000)
 static QDF_STATUS hif_hal_attach(struct hif_softc *scn)
 {
 	if (ce_srng_based(scn)) {
@@ -815,6 +816,12 @@ int hif_get_device_type(uint32_t device_id,
 		HIF_INFO(" *********** QCA6290EMU *************\n");
 		break;
 
+	case QCN9000_DEVICE_ID:
+		*hif_type = HIF_TYPE_QCN9000;
+		*target_type = TARGET_TYPE_QCN9000;
+		HIF_INFO(" *********** QCN9000 *************\n");
+		break;
+
 	case QCN7605_DEVICE_ID:
 	case QCN7605_COMPOSITE:
 	case QCN7605_STANDALONE:
diff --git a/hif/src/hif_main.h b/hif/src/hif_main.h
index 911363c0fb..b1c4162664 100644
--- a/hif/src/hif_main.h
+++ b/hif/src/hif_main.h
@@ -80,6 +80,7 @@
 #define AR6320_FW_3_2  (0x32)
 #define QCA6290_EMULATION_DEVICE_ID (0xabcd)
 #define QCA6290_DEVICE_ID (0x1100)
+#define QCN9000_DEVICE_ID (0x1104)
 #define QCA6390_EMULATION_DEVICE_ID (0x0108)
 #define QCA6390_DEVICE_ID (0x1101)
 #define ADRASTEA_DEVICE_ID_P2_E12 (0x7021)
diff --git a/hif/src/pcie/if_pci.c b/hif/src/pcie/if_pci.c
index 96d04f5b83..7c18f3c612 100644
--- a/hif/src/pcie/if_pci.c
+++ b/hif/src/pcie/if_pci.c
@@ -3642,6 +3642,7 @@ static bool hif_is_pld_based_target(struct hif_pci_softc *sc,
 
 	switch (device_id) {
 	case QCA6290_DEVICE_ID:
+	case QCN9000_DEVICE_ID:
 	case QCA6290_EMULATION_DEVICE_ID:
 #ifdef QCA_WIFI_QCA6390
 	case QCA6390_DEVICE_ID:
diff --git a/hif/src/regtable.c b/hif/src/regtable.c
index 82d2feae11..f0634113a1 100644
--- a/hif/src/regtable.c
+++ b/hif/src/regtable.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2019 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -126,6 +126,14 @@ void hif_target_register_tbl_attach(struct hif_softc *scn, u32 target_type)
 		break;
 #endif
 
+#if defined(QCN9000_HEADERS_DEF)
+	case TARGET_TYPE_QCN9000:
+		scn->targetdef = QCN9000_TARGETDEF;
+		scn->target_ce_def = QCN9000_CE_TARGETDEF;
+		HIF_TRACE("%s: TARGET_TYPE_QCN9000", __func__);
+		break;
+#endif
+
 #if defined(QCA6390_HEADERS_DEF)
 	case TARGET_TYPE_QCA6390:
 		scn->targetdef = QCA6390_TARGETdef;
@@ -222,6 +230,11 @@ void hif_register_tbl_attach(struct hif_softc *scn, u32 hif_type)
 		scn->hostdef = QCA6290_HOSTdef;
 		break;
 #endif
+#if defined(QCN9000_HEADERS_DEF)
+	case HIF_TYPE_QCN9000:
+		scn->hostdef = QCN9000_HOSTDEF;
+		break;
+#endif
 
 #if defined(QCA6390_HEADERS_DEF)
 	case HIF_TYPE_QCA6390:
diff --git a/qdf/linux/src/qdf_mem.c b/qdf/linux/src/qdf_mem.c
index d29e14ce36..19455feb08 100644
--- a/qdf/linux/src/qdf_mem.c
+++ b/qdf/linux/src/qdf_mem.c
@@ -1696,7 +1696,9 @@ static inline void *qdf_mem_dma_alloc(qdf_device_t osdev, void *dev,
 	return vaddr;
 }
 
-#elif defined(QCA_WIFI_QCA8074_VP) && defined(BUILD_X86)
+#elif defined(QCA_WIFI_QCA8074_VP) && defined(BUILD_X86) && \
+	!defined(QCA_WIFI_QCN9000)
+
 #define QCA8074_RAM_BASE 0x50000000
 #define QDF_MEM_ALLOC_X86_MAX_RETRIES 10
 void *qdf_mem_dma_alloc(qdf_device_t osdev, void *dev, qdf_size_t size,
diff --git a/qdf/linux/src/qdf_nbuf.c b/qdf/linux/src/qdf_nbuf.c
index 96f2f5bd71..c6f88c54cd 100644
--- a/qdf/linux/src/qdf_nbuf.c
+++ b/qdf/linux/src/qdf_nbuf.c
@@ -377,7 +377,8 @@ void __qdf_nbuf_count_dec(__qdf_nbuf_t nbuf)
 qdf_export_symbol(__qdf_nbuf_count_dec);
 #endif
 
-#if defined(QCA_WIFI_QCA8074_VP) && defined(BUILD_X86)
+#if defined(QCA_WIFI_QCA8074_VP) && defined(BUILD_X86) && \
+	!defined(QCA_WIFI_QCN9000)
 struct sk_buff *__qdf_nbuf_alloc(qdf_device_t osdev, size_t size, int reserve,
 				 int align, int prio, const char *func,
 				 uint32_t line)
@@ -3213,7 +3214,7 @@ uint32_t __qdf_nbuf_get_tso_num_seg(struct sk_buff *skb)
 
 	return num_segs;
 }
-#else
+#elif !defined(QCA_WIFI_QCN9000)
 uint32_t __qdf_nbuf_get_tso_num_seg(struct sk_buff *skb)
 {
 	uint32_t i, gso_size, tmp_len, num_segs = 0;
@@ -3242,6 +3243,42 @@ uint32_t __qdf_nbuf_get_tso_num_seg(struct sk_buff *skb)
 	}
 
 
+	gso_size = skb_shinfo(skb)->gso_size;
+	tmp_len = skb->len - ((skb_transport_header(skb) - skb_mac_header(skb))
+			+ tcp_hdrlen(skb));
+	while (tmp_len) {
+		num_segs++;
+		if (tmp_len > gso_size)
+			tmp_len -= gso_size;
+		else
+			break;
+	}
+
+	return num_segs;
+
+	/*
+	 * Do not free this frame, just do socket level accounting
+	 * so that this is not reused.
+	 */
+fail:
+	if (skb->sk)
+		atomic_sub(skb->truesize, &(skb->sk->sk_wmem_alloc));
+
+	return 0;
+}
+#else
+uint32_t __qdf_nbuf_get_tso_num_seg(struct sk_buff *skb)
+{
+	uint32_t i, gso_size, tmp_len, num_segs = 0;
+	struct skb_frag_struct *frag = NULL;
+
+	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+		frag = &skb_shinfo(skb)->frags[i];
+
+		if (!frag)
+			goto fail;
+	}
+
 	gso_size = skb_shinfo(skb)->gso_size;
 	tmp_len = skb->len - ((skb_transport_header(skb) - skb_mac_header(skb))
 			+ tcp_hdrlen(skb));
diff --git a/target_if/spectral/target_if_spectral.c b/target_if/spectral/target_if_spectral.c
index c369a611a8..70ae22a771 100644
--- a/target_if/spectral/target_if_spectral.c
+++ b/target_if/spectral/target_if_spectral.c
@@ -2019,6 +2019,7 @@ target_if_pdev_spectral_init(struct wlan_objmgr_pdev *pdev)
 	if ((target_type == TARGET_TYPE_QCA8074) ||
 	    (target_type == TARGET_TYPE_QCA8074V2) ||
 	    (target_type == TARGET_TYPE_QCA6018) ||
+	    (target_type == TARGET_TYPE_QCN9000) ||
 	    (target_type == TARGET_TYPE_QCA6290)) {
 		spectral->spectral_gen = SPECTRAL_GEN3;
 		spectral->hdr_sig_exp = SPECTRAL_PHYERR_SIGNATURE_GEN3;