diff --git a/dp/inc/cdp_txrx_cmn_reg.h b/dp/inc/cdp_txrx_cmn_reg.h
index 1bfb1d70ea..510515551e 100644
--- a/dp/inc/cdp_txrx_cmn_reg.h
+++ b/dp/inc/cdp_txrx_cmn_reg.h
@@ -27,7 +27,7 @@
 #include "hif_main.h"
 
 #define MOB_DRV_LEGACY_DP	0xdeed/*FIXME Add MCL device IDs */
-#define LITHIUM_DP		0xfffe/*FIXME Add Litium device ID */
+#define LITHIUM_DP		0xfffd/*FIXME Add Litium device ID */
 /* Use these device IDs for attach in future */
 
 ol_txrx_soc_handle ol_txrx_soc_attach(void *scn_handle, struct ol_if_ops *dp_ol_if_ops);
@@ -65,6 +65,7 @@ static inline ol_txrx_soc_handle cdp_soc_attach(u_int16_t devid,
 	switch (devid) {
 	case LITHIUM_DP: /*FIXME Add lithium devide IDs */
 	case QCA8074_DEVICE_ID: /* Hawekeye */
+	case QCA8074V2_DEVICE_ID: /* Hawekeye V2*/
 	case QCA6290_DEVICE_ID:
 	case QCA6390_DEVICE_ID:
 	case QCA6390_EMULATION_DEVICE_ID:
diff --git a/dp/inc/cdp_txrx_cmn_struct.h b/dp/inc/cdp_txrx_cmn_struct.h
index 5e5e681183..4f34b2a266 100644
--- a/dp/inc/cdp_txrx_cmn_struct.h
+++ b/dp/inc/cdp_txrx_cmn_struct.h
@@ -312,6 +312,7 @@ enum cdp_txrx_ast_entry_type {
 	CDP_TXRX_AST_TYPE_WDS,	/* WDS peer ast entry type*/
 	CDP_TXRX_AST_TYPE_MEC,	/* Multicast echo ast entry type */
 	CDP_TXRX_AST_TYPE_WDS_HM, /* HM WDS entry */
+	CDP_TXRX_AST_TYPE_STA_BSS,	 /* BSS entry(STA mode) */
 	CDP_TXRX_AST_TYPE_MAX
 };
 
diff --git a/dp/inc/cdp_txrx_ops.h b/dp/inc/cdp_txrx_ops.h
index eae5b563a0..6a4a77cf2a 100644
--- a/dp/inc/cdp_txrx_ops.h
+++ b/dp/inc/cdp_txrx_ops.h
@@ -739,6 +739,9 @@ struct cdp_host_stats_ops {
 	int
 		(*txrx_get_vdev_extd_stats)(struct cdp_vdev *vdev_handle,
 					    void *buffer);
+	void
+		(*txrx_update_vdev_stats)(struct cdp_vdev *vdev, void *buf,
+					  uint16_t stats_id);
 };
 
 struct cdp_wds_ops {
diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c
index e7815ca5d4..53f07c854e 100644
--- a/dp/wifi3.0/dp_main.c
+++ b/dp/wifi3.0/dp_main.c
@@ -517,7 +517,8 @@ static void dp_wds_reset_ast_wifi3(struct cdp_soc_t *soc_hdl,
 
 	if (ast_entry) {
 		if ((ast_entry->type != CDP_TXRX_AST_TYPE_STATIC) &&
-		    (ast_entry->type != CDP_TXRX_AST_TYPE_SELF)) {
+			(ast_entry->type != CDP_TXRX_AST_TYPE_SELF) &&
+			(ast_entry->type != CDP_TXRX_AST_TYPE_STA_BSS)) {
 			ast_entry->is_active = TRUE;
 		}
 	}
@@ -550,9 +551,11 @@ static void dp_wds_reset_ast_table_wifi3(struct cdp_soc_t  *soc_hdl,
 			DP_VDEV_ITERATE_PEER_LIST(vdev, peer) {
 				DP_PEER_ITERATE_ASE_LIST(peer, ase, temp_ase) {
 					if ((ase->type ==
-					     CDP_TXRX_AST_TYPE_STATIC) ||
-					    (ase->type ==
-					     CDP_TXRX_AST_TYPE_SELF))
+						CDP_TXRX_AST_TYPE_STATIC) ||
+						(ase->type ==
+						CDP_TXRX_AST_TYPE_SELF) ||
+						(ase->type ==
+						CDP_TXRX_AST_TYPE_STA_BSS))
 						continue;
 					ase->is_active = TRUE;
 				}
@@ -588,9 +591,11 @@ static void dp_wds_flush_ast_table_wifi3(struct cdp_soc_t  *soc_hdl)
 			DP_VDEV_ITERATE_PEER_LIST(vdev, peer) {
 				DP_PEER_ITERATE_ASE_LIST(peer, ase, temp_ase) {
 					if ((ase->type ==
-					     CDP_TXRX_AST_TYPE_STATIC) ||
-					    (ase->type ==
-					     CDP_TXRX_AST_TYPE_SELF))
+						CDP_TXRX_AST_TYPE_STATIC) ||
+						(ase->type ==
+						 CDP_TXRX_AST_TYPE_SELF) ||
+						(ase->type ==
+						 CDP_TXRX_AST_TYPE_STA_BSS))
 						continue;
 					dp_peer_del_ast(soc, ase);
 				}
@@ -867,7 +872,7 @@ static void dp_print_ast_stats(struct dp_soc *soc)
 	struct dp_peer *peer;
 	struct dp_ast_entry *ase, *tmp_ase;
 	char type[CDP_TXRX_AST_TYPE_MAX][10] = {
-			"NONE", "STATIC", "SELF", "WDS", "MEC", "HMWDS"};
+			"NONE", "STATIC", "SELF", "WDS", "MEC", "HMWDS", "BSS"};
 
 	DP_PRINT_STATS("AST Stats:");
 	DP_PRINT_STATS("	Entries Added   = %d", soc->stats.ast.added);
@@ -2618,14 +2623,21 @@ static inline void
 dp_dscp_tid_map_setup(struct dp_pdev *pdev)
 {
 	uint8_t map_id;
+	struct dp_soc *soc = pdev->soc;
+
+	if (!soc)
+		return;
+
 	for (map_id = 0; map_id < DP_MAX_TID_MAPS; map_id++) {
-		qdf_mem_copy(pdev->dscp_tid_map[map_id], default_dscp_tid_map,
-				sizeof(default_dscp_tid_map));
+		qdf_mem_copy(pdev->dscp_tid_map[map_id],
+			     default_dscp_tid_map,
+			     sizeof(default_dscp_tid_map));
 	}
-	for (map_id = 0; map_id < HAL_MAX_HW_DSCP_TID_MAPS; map_id++) {
-		hal_tx_set_dscp_tid_map(pdev->soc->hal_soc,
-				pdev->dscp_tid_map[map_id],
-				map_id);
+
+	for (map_id = 0; map_id < soc->num_hw_dscp_tid_map; map_id++) {
+		hal_tx_set_dscp_tid_map(soc->hal_soc,
+					default_dscp_tid_map,
+					map_id);
 	}
 }
 
@@ -6716,7 +6728,8 @@ dp_enable_enhanced_stats(struct cdp_pdev *pdev_handle)
 
 	pdev->enhanced_stats_en = 1;
 
-	if (!pdev->mcopy_mode && !pdev->neighbour_peers_added)
+	if (!pdev->mcopy_mode && !pdev->neighbour_peers_added &&
+	    !pdev->monitor_vdev)
 		dp_ppdu_ring_cfg(pdev);
 
 	if (is_ppdu_txrx_capture_enabled(pdev) && !pdev->bpr_enable) {
@@ -6752,7 +6765,8 @@ dp_disable_enhanced_stats(struct cdp_pdev *pdev_handle)
 					  pdev->pdev_id);
 	}
 
-	if (!pdev->mcopy_mode && !pdev->neighbour_peers_added)
+	if (!pdev->mcopy_mode && !pdev->neighbour_peers_added &&
+	    !pdev->monitor_vdev)
 		dp_ppdu_ring_reset(pdev);
 }
 
@@ -7043,11 +7057,17 @@ static void dp_set_pdev_dscp_tid_map_wifi3(struct cdp_pdev *pdev_handle,
 {
 	uint8_t dscp;
 	struct dp_pdev *pdev = (struct dp_pdev *) pdev_handle;
+	struct dp_soc *soc = pdev->soc;
+
+	if (!soc)
+		return;
+
 	dscp = (tos >> DP_IP_DSCP_SHIFT) & DP_IP_DSCP_MASK;
 	pdev->dscp_tid_map[map_id][dscp] = tid;
-	if (map_id < HAL_MAX_HW_DSCP_TID_MAPS)
-		hal_tx_update_dscp_tid(pdev->soc->hal_soc, tid,
-			map_id, dscp);
+
+	if (map_id < soc->num_hw_dscp_tid_map)
+		hal_tx_update_dscp_tid(soc->hal_soc, tid,
+				       map_id, dscp);
 	return;
 }
 
@@ -8193,6 +8213,8 @@ void *dp_soc_attach_wifi3(void *ctrl_psoc, void *hif_handle,
 	soc->hal_soc = hif_get_hal_handle(hif_handle);
 	soc->htt_handle = htt_soc_attach(soc, ctrl_psoc, htc_handle,
 		soc->hal_soc, qdf_osdev);
+	soc->num_hw_dscp_tid_map = HAL_MAX_HW_DSCP_TID_MAPS;
+
 	if (!soc->htt_handle) {
 		QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
 			FL("HTT attach failed"));
@@ -8232,6 +8254,7 @@ void *dp_soc_attach_wifi3(void *ctrl_psoc, void *hif_handle,
 		wlan_cfg_set_raw_mode_war(soc->wlan_cfg_ctx, false);
 		soc->hw_nac_monitor_support = 1;
 		soc->ast_override_support = 1;
+		soc->num_hw_dscp_tid_map = HAL_MAX_HW_DSCP_TID_V2_MAPS;
 		break;
 	default:
 		qdf_print("%s: Unknown tgt type %d\n", __func__, target_type);
diff --git a/dp/wifi3.0/dp_peer.c b/dp/wifi3.0/dp_peer.c
index 448a0bc398..6c5c6f75e2 100644
--- a/dp/wifi3.0/dp_peer.c
+++ b/dp/wifi3.0/dp_peer.c
@@ -515,6 +515,8 @@ int dp_peer_add_ast(struct dp_soc *soc,
 	case CDP_TXRX_AST_TYPE_STATIC:
 		peer->self_ast_entry = ast_entry;
 		ast_entry->type = CDP_TXRX_AST_TYPE_STATIC;
+		if (peer->vdev->opmode == wlan_op_mode_sta)
+			ast_entry->type = CDP_TXRX_AST_TYPE_STA_BSS;
 		break;
 	case CDP_TXRX_AST_TYPE_SELF:
 		peer->self_ast_entry = ast_entry;
@@ -549,7 +551,8 @@ int dp_peer_add_ast(struct dp_soc *soc,
 		qdf_mem_copy(next_node_mac, peer->mac_addr.raw, 6);
 
 	if ((ast_entry->type != CDP_TXRX_AST_TYPE_STATIC) &&
-	    (ast_entry->type != CDP_TXRX_AST_TYPE_SELF)) {
+	    (ast_entry->type != CDP_TXRX_AST_TYPE_SELF) &&
+	    (ast_entry->type != CDP_TXRX_AST_TYPE_STA_BSS)) {
 		if (QDF_STATUS_SUCCESS ==
 				soc->cdp_soc.ol_ops->peer_add_wds_entry(
 				peer->vdev->osif_vdev,
@@ -630,7 +633,8 @@ int dp_peer_update_ast(struct dp_soc *soc, struct dp_peer *peer,
 	struct dp_peer *old_peer;
 
 	if ((ast_entry->type == CDP_TXRX_AST_TYPE_STATIC) ||
-	    (ast_entry->type == CDP_TXRX_AST_TYPE_SELF))
+		(ast_entry->type == CDP_TXRX_AST_TYPE_SELF) ||
+		(ast_entry->type == CDP_TXRX_AST_TYPE_STA_BSS))
 		return 0;
 
 	old_peer = ast_entry->peer;
diff --git a/dp/wifi3.0/dp_rx.h b/dp/wifi3.0/dp_rx.h
index d51f8d5f8c..099a81fc96 100644
--- a/dp/wifi3.0/dp_rx.h
+++ b/dp/wifi3.0/dp_rx.h
@@ -464,7 +464,8 @@ dp_rx_wds_srcport_learn(struct dp_soc *soc,
 		sa_peer = ast->peer;
 
 		if ((ast->type != CDP_TXRX_AST_TYPE_STATIC) &&
-		    (ast->type != CDP_TXRX_AST_TYPE_SELF)) {
+		    (ast->type != CDP_TXRX_AST_TYPE_SELF) &&
+			(ast->type != CDP_TXRX_AST_TYPE_STA_BSS)) {
 			if (ast->pdev_id != ta_peer->vdev->pdev->pdev_id) {
 				ret = dp_peer_add_ast(soc,
 						      ta_peer, wds_src_mac,
diff --git a/dp/wifi3.0/dp_tx.c b/dp/wifi3.0/dp_tx.c
index ae768f02d2..529d76cc5d 100644
--- a/dp/wifi3.0/dp_tx.c
+++ b/dp/wifi3.0/dp_tx.c
@@ -1115,7 +1115,7 @@ static void dp_tx_classify_tid(struct dp_vdev *vdev, qdf_nbuf_t nbuf,
 
 	DP_TX_TID_OVERRIDE(msdu_info, nbuf);
 
-	if (vdev->dscp_tid_map_id <= 1)
+	if (pdev->soc && vdev->dscp_tid_map_id < pdev->soc->num_hw_dscp_tid_map)
 		return;
 
 	/* for mesh packets don't do any classification */
@@ -3200,6 +3200,8 @@ QDF_STATUS dp_tx_vdev_attach(struct dp_vdev *vdev)
  */
 void dp_tx_vdev_update_search_flags(struct dp_vdev *vdev)
 {
+	struct dp_soc *soc = vdev->pdev->soc;
+
 	/*
 	 * Enable both AddrY (SA based search) and AddrX (Da based search)
 	 * for TDLS link
@@ -3220,7 +3222,11 @@ void dp_tx_vdev_update_search_flags(struct dp_vdev *vdev)
 	else
 		vdev->hal_desc_addr_search_flags = HAL_TX_DESC_ADDRX_EN;
 
-	if (vdev->opmode == wlan_op_mode_sta)
+	/* Set search type only when peer map v2 messaging is enabled
+	 * as we will have the search index (AST hash) only when v2 is
+	 * enabled
+	 */
+	if (soc->is_peer_map_unmap_v2 && vdev->opmode == wlan_op_mode_sta)
 		vdev->search_type = HAL_TX_ADDR_INDEX_SEARCH;
 	else
 		vdev->search_type = HAL_TX_ADDR_SEARCH_DEFAULT;
diff --git a/dp/wifi3.0/dp_types.h b/dp/wifi3.0/dp_types.h
index 2f1043be68..7b56c175ae 100644
--- a/dp/wifi3.0/dp_types.h
+++ b/dp/wifi3.0/dp_types.h
@@ -697,6 +697,9 @@ struct dp_soc {
 	/*ast override support in HW*/
 	bool ast_override_support;
 
+	/*number of hw dscp tid map*/
+	uint8_t num_hw_dscp_tid_map;
+
 	/* Link descriptor memory banks */
 	struct {
 		void *base_vaddr_unaligned;
diff --git a/hal/wifi3.0/hal_tx.h b/hal/wifi3.0/hal_tx.h
index 66839c6529..3f5d77c762 100644
--- a/hal/wifi3.0/hal_tx.h
+++ b/hal/wifi3.0/hal_tx.h
@@ -80,6 +80,7 @@ do {                                            \
 #define HAL_MAX_HW_DSCP_TID_MAPS 2
 #define HAL_MAX_HW_DSCP_TID_MAPS_11AX 32
 
+#define HAL_MAX_HW_DSCP_TID_V2_MAPS 48
 #define HTT_META_HEADER_LEN_BYTES 64
 #define HAL_TX_EXT_DESC_WITH_META_DATA \
 	(HTT_META_HEADER_LEN_BYTES + HAL_TX_EXTENSION_DESC_LEN_BYTES)
diff --git a/hal/wifi3.0/qca8074v2/hal_8074v2_tx.h b/hal/wifi3.0/qca8074v2/hal_8074v2_tx.h
index b39ff9295d..9f2a22c1da 100644
--- a/hal/wifi3.0/qca8074v2/hal_8074v2_tx.h
+++ b/hal/wifi3.0/qca8074v2/hal_8074v2_tx.h
@@ -68,7 +68,7 @@ static void hal_tx_set_dscp_tid_map_8074v2(void *hal_soc, uint8_t *map,
 
 	struct hal_soc *soc = (struct hal_soc *)hal_soc;
 
-	if (id >= HAL_MAX_HW_DSCP_TID_MAPS_11AX)
+	if (id >= HAL_MAX_HW_DSCP_TID_V2_MAPS)
 		return;
 
 	cmn_reg_addr = HWIO_TCL_R0_CONS_RING_CMN_CTRL_REG_ADDR(
diff --git a/hif/inc/reg_struct.h b/hif/inc/reg_struct.h
index d3cb668d4b..422b00146e 100644
--- a/hif/inc/reg_struct.h
+++ b/hif/inc/reg_struct.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -231,6 +231,7 @@ struct targetdef_s {
 	uint32_t d_CPU_INTR_ADDRESS;
 	uint32_t d_SOC_LF_TIMER_CONTROL0_ADDRESS;
 	uint32_t d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK;
+	uint32_t d_SOC_LF_TIMER_STATUS0_ADDRESS;
 
 	/* chip id start */
 	uint32_t d_SI_CONFIG_ERR_INT_MASK;
diff --git a/hif/inc/regtable_pcie.h b/hif/inc/regtable_pcie.h
index cb05adab3c..ca455ef15e 100644
--- a/hif/inc/regtable_pcie.h
+++ b/hif/inc/regtable_pcie.h
@@ -170,6 +170,8 @@
 	(scn->targetdef->d_SOC_LF_TIMER_CONTROL0_ADDRESS)
 #define SOC_LF_TIMER_CONTROL0_ENABLE_MASK \
 	(scn->targetdef->d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK)
+#define SOC_LF_TIMER_STATUS0_ADDRESS \
+	(scn->targetdef->d_SOC_LF_TIMER_STATUS0_ADDRESS)
 #define SOC_RESET_CONTROL_PCIE_RST_SHORT_OVRD_LSB \
 	(scn->targetdef->d_SOC_RESET_CONTROL_PCIE_RST_SHORT_OVRD_LSB)
 #define SOC_RESET_CONTROL_PCIE_RST_SHORT_OVRD_MASK \
diff --git a/hif/inc/target_reg_init.h b/hif/inc/target_reg_init.h
index efd09f308d..607a5cc1e3 100644
--- a/hif/inc/target_reg_init.h
+++ b/hif/inc/target_reg_init.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -83,6 +83,10 @@ struct targetdef_s;
 #define SOC_LF_TIMER_CONTROL0_ENABLE_MASK        ATH_UNSUPPORTED_REG_OFFSET
 #endif
 
+#if !defined(SOC_LF_TIMER_STATUS0_ADDRESS)
+#define SOC_LF_TIMER_STATUS0_ADDRESS        ATH_UNSUPPORTED_REG_OFFSET
+#endif
+
 #if !defined(SOC_RESET_CONTROL_ADDRESS)
 #define SOC_RESET_CONTROL_ADDRESS    ATH_UNSUPPORTED_REG_OFFSET
 #define SOC_RESET_CONTROL_CE_RST_MASK    ATH_UNSUPPORTED_REG_OFFSET
@@ -290,6 +294,7 @@ static struct targetdef_s my_target_def = {
 	.d_SOC_LF_TIMER_CONTROL0_ADDRESS = SOC_LF_TIMER_CONTROL0_ADDRESS,
 	.d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK
 		= SOC_LF_TIMER_CONTROL0_ENABLE_MASK,
+	.d_SOC_LF_TIMER_STATUS0_ADDRESS = SOC_LF_TIMER_STATUS0_ADDRESS,
 	.d_SI_CONFIG_ERR_INT_MASK = SI_CONFIG_ERR_INT_MASK,
 	.d_SI_CONFIG_ERR_INT_LSB = SI_CONFIG_ERR_INT_LSB,
 	.d_GPIO_ENABLE_W1TS_LOW_ADDRESS = GPIO_ENABLE_W1TS_LOW_ADDRESS,
diff --git a/hif/src/adrastea_reg_def.h b/hif/src/adrastea_reg_def.h
index ab399fed86..6b7e2e1aa5 100644
--- a/hif/src/adrastea_reg_def.h
+++ b/hif/src/adrastea_reg_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016, 2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1512,6 +1512,7 @@
 #define ADRASTEA_CPU_INTR_ADDRESS                            0xffffffff
 #define ADRASTEA_SOC_LF_TIMER_CONTROL0_ADDRESS               0xffffffff
 #define ADRASTEA_SOC_LF_TIMER_CONTROL0_ENABLE_MASK           0xffffffff
+#define ADRASTEA_SOC_LF_TIMER_STATUS0_ADDRESS                0xffffffff
 #define ADRASTEA_SOC_RESET_CONTROL_ADDRESS \
 	(0x00000000 + ADRASTEA_RTC_SOC_REG_BASE_ADDRESS)
 #define ADRASTEA_SOC_RESET_CONTROL_CE_RST_MASK            0x0100
@@ -2023,6 +2024,8 @@ struct targetdef_s adrastea_targetdef = {
 		ADRASTEA_SOC_LF_TIMER_CONTROL0_ADDRESS,
 	.d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK =
 		ADRASTEA_SOC_LF_TIMER_CONTROL0_ENABLE_MASK,
+	.d_SOC_LF_TIMER_STATUS0_ADDRESS =
+		ADRASTEA_SOC_LF_TIMER_STATUS0_ADDRESS,
 	/* chip id start */
 	.d_SOC_CHIP_ID_ADDRESS = ADRASTEA_SOC_CHIP_ID_ADDRESS,
 	.d_SOC_CHIP_ID_VERSION_MASK = ADRASTEA_SOC_CHIP_ID_VERSION_MASK,
diff --git a/hif/src/ar6320def.h b/hif/src/ar6320def.h
index 77ab1c5272..3014f6549b 100644
--- a/hif/src/ar6320def.h
+++ b/hif/src/ar6320def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -204,6 +204,7 @@
 #define AR6320_CPU_INTR_ADDRESS                         0x0010
 #define AR6320_SOC_LF_TIMER_CONTROL0_ADDRESS            0x00000050
 #define AR6320_SOC_LF_TIMER_CONTROL0_ENABLE_MASK        0x00000004
+#define AR6320_SOC_LF_TIMER_STATUS0_ADDRESS             0x00000054
 #define AR6320_SOC_RESET_CONTROL_ADDRESS                0x00000000
 #define AR6320_SOC_RESET_CONTROL_CPU_WARM_RST_MASK      0x00000040
 #define AR6320_CORE_CTRL_ADDRESS                        0x0000
@@ -599,6 +600,8 @@ struct targetdef_s ar6320_targetdef = {
 		AR6320_SOC_LF_TIMER_CONTROL0_ADDRESS,
 	.d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK =
 		AR6320_SOC_LF_TIMER_CONTROL0_ENABLE_MASK,
+	.d_SOC_LF_TIMER_STATUS0_ADDRESS =
+		AR6320_SOC_LF_TIMER_STATUS0_ADDRESS,
 
 	.d_WLAN_DEBUG_INPUT_SEL_OFFSET = AR6320_WLAN_DEBUG_INPUT_SEL_OFFSET,
 	.d_WLAN_DEBUG_INPUT_SEL_SRC_MSB = AR6320_WLAN_DEBUG_INPUT_SEL_SRC_MSB,
diff --git a/hif/src/ar6320v2def.h b/hif/src/ar6320v2def.h
index 5ad0b98fd4..fdb4e92ae3 100644
--- a/hif/src/ar6320v2def.h
+++ b/hif/src/ar6320v2def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -165,6 +165,7 @@
 #define AR6320V2_CPU_INTR_ADDRESS                         0x0010
 #define AR6320V2_SOC_LF_TIMER_CONTROL0_ADDRESS            0x00000050
 #define AR6320V2_SOC_LF_TIMER_CONTROL0_ENABLE_MASK        0x00000004
+#define AR6320V2_SOC_LF_TIMER_STATUS0_ADDRESS             0x00000054
 #define AR6320V2_SOC_RESET_CONTROL_ADDRESS                0x00000000
 #define AR6320V2_SOC_RESET_CONTROL_CPU_WARM_RST_MASK      0x00000040
 #define AR6320V2_CORE_CTRL_ADDRESS                        0x0000
@@ -645,6 +646,8 @@ struct targetdef_s ar6320v2_targetdef = {
 		AR6320V2_SOC_LF_TIMER_CONTROL0_ADDRESS,
 	.d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK =
 		AR6320V2_SOC_LF_TIMER_CONTROL0_ENABLE_MASK,
+	.d_SOC_LF_TIMER_STATUS0_ADDRESS =
+		AR6320V2_SOC_LF_TIMER_STATUS0_ADDRESS,
 	/* chip id start */
 	.d_SOC_CHIP_ID_ADDRESS = AR6320V2_SOC_CHIP_ID_ADDRESS,
 	.d_SOC_CHIP_ID_VERSION_MASK = AR6320V2_SOC_CHIP_ID_VERSION_MASK,
diff --git a/hif/src/ar9888def.h b/hif/src/ar9888def.h
index ce2e891c9f..9ce32937f4 100644
--- a/hif/src/ar9888def.h
+++ b/hif/src/ar9888def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016, 2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -203,6 +203,7 @@
 #define AR9888_CPU_INTR_ADDRESS                         0x0010
 #define AR9888_SOC_LF_TIMER_CONTROL0_ADDRESS            0x00000050
 #define AR9888_SOC_LF_TIMER_CONTROL0_ENABLE_MASK        0x00000004
+#define AR9888_SOC_LF_TIMER_STATUS0_ADDRESS             0x00000054
 #define AR9888_SOC_RESET_CONTROL_ADDRESS                0x00000000
 #define AR9888_SOC_RESET_CONTROL_CPU_WARM_RST_MASK      0x00000040
 #define AR9888_CORE_CTRL_ADDRESS                        0x0000
@@ -438,6 +439,8 @@ struct targetdef_s ar9888_targetdef = {
 		AR9888_SOC_LF_TIMER_CONTROL0_ADDRESS,
 	.d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK =
 		AR9888_SOC_LF_TIMER_CONTROL0_ENABLE_MASK,
+	.d_SOC_LF_TIMER_STATUS0_ADDRESS =
+		AR9888_SOC_LF_TIMER_STATUS0_ADDRESS,
 };
 
 struct hostdef_s ar9888_hostdef = {
diff --git a/hif/src/ce/ce_main.c b/hif/src/ce/ce_main.c
index 1b561e9c6c..a323390272 100644
--- a/hif/src/ce/ce_main.c
+++ b/hif/src/ce/ce_main.c
@@ -422,6 +422,37 @@ static struct service_to_pipe target_service_to_ce_map_qca8074[] = {
 };
 #endif
 
+#if (defined(QCA_WIFI_QCA8074V2))
+static struct service_to_pipe target_service_to_ce_map_qca8074_v2[] = {
+	{ WMI_DATA_VO_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_VO_SVC, PIPEDIR_IN, 2, },
+	{ WMI_DATA_BK_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_BK_SVC, PIPEDIR_IN, 2, },
+	{ WMI_DATA_BE_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_BE_SVC, PIPEDIR_IN, 2, },
+	{ WMI_DATA_VI_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_DATA_VI_SVC, PIPEDIR_IN, 2, },
+	{ WMI_CONTROL_SVC, PIPEDIR_OUT, 3, },
+	{ WMI_CONTROL_SVC, PIPEDIR_IN, 2, },
+	{ WMI_CONTROL_SVC_WMAC1, PIPEDIR_OUT, 7},
+	{ WMI_CONTROL_SVC_WMAC1, PIPEDIR_IN, 2},
+	{ WMI_CONTROL_SVC_WMAC2, PIPEDIR_OUT, 9},
+	{ WMI_CONTROL_SVC_WMAC2, PIPEDIR_IN, 2},
+	{ HTC_CTRL_RSVD_SVC, PIPEDIR_OUT, 0, },
+	{ HTC_CTRL_RSVD_SVC, PIPEDIR_IN, 1, },
+	{ HTC_RAW_STREAMS_SVC, PIPEDIR_OUT, 0},
+	{ HTC_RAW_STREAMS_SVC, PIPEDIR_IN, 1 },
+	{ HTT_DATA_MSG_SVC, PIPEDIR_OUT, 4, },
+	{ HTT_DATA_MSG_SVC, PIPEDIR_IN, 1, },
+	{ PACKET_LOG_SVC, PIPEDIR_IN, 5, },
+	/* (Additions here) */
+	{ 0, 0, 0, },
+};
+#else
+static struct service_to_pipe target_service_to_ce_map_qca8074_v2[] = {
+};
+#endif
+
 /* PIPEDIR_OUT = HOST to Target */
 /* PIPEDIR_IN  = TARGET to HOST */
 #ifdef QCN7605_SUPPORT
@@ -718,11 +749,16 @@ static void hif_select_service_to_pipe_map(struct hif_softc *scn,
 				sizeof(target_service_to_ce_map_qca6390);
 			break;
 		case TARGET_TYPE_QCA8074:
-		case TARGET_TYPE_QCA8074V2:
 			*tgt_svc_map_to_use = target_service_to_ce_map_qca8074;
 			*sz_tgt_svc_map_to_use =
 				sizeof(target_service_to_ce_map_qca8074);
 			break;
+		case TARGET_TYPE_QCA8074V2:
+			*tgt_svc_map_to_use =
+				target_service_to_ce_map_qca8074_v2;
+			*sz_tgt_svc_map_to_use =
+				sizeof(target_service_to_ce_map_qca8074_v2);
+			break;
 		}
 	}
 }
diff --git a/hif/src/pcie/if_pci.c b/hif/src/pcie/if_pci.c
index 4dcffc886e..efd999068d 100644
--- a/hif/src/pcie/if_pci.c
+++ b/hif/src/pcie/if_pci.c
@@ -3531,6 +3531,30 @@ end:
 	return 0;
 }
 
+/**
+ * hif_trigger_timer_irq() : Triggers interrupt on LF_Timer 0
+ * @scn: hif control structure
+ *
+ * Sets IRQ bit in LF Timer Status Address to awake peregrine/swift
+ * stuck at a polling loop in pcie_address_config in FW
+ *
+ * Return: none
+ */
+static void hif_trigger_timer_irq(struct hif_softc *scn)
+{
+	int tmp;
+	/* Trigger IRQ on Peregrine/Swift by setting
+	 * IRQ Bit of LF_TIMER 0
+	 */
+	tmp = hif_read32_mb(scn, scn->mem + (RTC_SOC_BASE_ADDRESS +
+						SOC_LF_TIMER_STATUS0_ADDRESS));
+	/* Set Raw IRQ Bit */
+	tmp |= 1;
+	/* SOC_LF_TIMER_STATUS0 */
+	hif_write32_mb(scn, scn->mem + (RTC_SOC_BASE_ADDRESS +
+		       SOC_LF_TIMER_STATUS0_ADDRESS), tmp);
+}
+
 /**
  * hif_target_sync() : ensure the target is ready
  * @scn: hif control structure
@@ -3560,7 +3584,9 @@ static void hif_target_sync(struct hif_softc *scn)
 	if (HAS_FW_INDICATOR) {
 		int wait_limit = 500;
 		int fw_ind = 0;
-
+		int retry_count = 0;
+		uint32_t target_type = scn->target_info.target_type;
+fw_retry:
 		HIF_TRACE("%s: Loop checking FW signal", __func__);
 		while (1) {
 			fw_ind = hif_read32_mb(scn, scn->mem +
@@ -3578,12 +3604,20 @@ static void hif_target_sync(struct hif_softc *scn)
 
 			qdf_mdelay(10);
 		}
-		if (wait_limit < 0)
+		if (wait_limit < 0) {
+			if (target_type == TARGET_TYPE_AR9888 &&
+			    retry_count++ < 2) {
+				hif_trigger_timer_irq(scn);
+				wait_limit = 500;
+				goto fw_retry;
+			}
 			HIF_TRACE("%s: FW signal timed out",
 					__func__);
-		else
+			qdf_assert_always(0);
+		} else {
 			HIF_TRACE("%s: Got FW signal, retries = %x",
 					__func__, 500-wait_limit);
+		}
 	}
 	hif_write32_mb(scn, scn->mem + PCIE_LOCAL_BASE_ADDRESS +
 			PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
diff --git a/hif/src/sdio/regtable_sdio.h b/hif/src/sdio/regtable_sdio.h
index 185d11bbf7..dfc6a31907 100644
--- a/hif/src/sdio/regtable_sdio.h
+++ b/hif/src/sdio/regtable_sdio.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -197,6 +197,7 @@ struct targetdef_s {
 	uint32_t d_CPU_INTR_ADDRESS;
 	uint32_t d_SOC_LF_TIMER_CONTROL0_ADDRESS;
 	uint32_t d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK;
+	uint32_t d_SOC_LF_TIMER_STATUS0_ADDRESS;
 
 	/* chip id start */
 	uint32_t d_SOC_CHIP_ID_ADDRESS;
@@ -361,6 +362,8 @@ struct targetdef_s {
 	(scn->targetdef->d_SOC_LF_TIMER_CONTROL0_ADDRESS)
 #define SOC_LF_TIMER_CONTROL0_ENABLE_MASK \
 	(scn->targetdef->d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK)
+#define SOC_LF_TIMER_STATUS0_ADDRESS \
+	(scn->targetdef->d_SOC_LF_TIMER_STATUS0_ADDRESS)
 
 
 #define CHIP_ID_ADDRESS           (scn->targetdef->d_SOC_CHIP_ID_ADDRESS)
diff --git a/hif/src/usb/regtable_usb.h b/hif/src/usb/regtable_usb.h
index f3bf559c27..d59cd08ca7 100644
--- a/hif/src/usb/regtable_usb.h
+++ b/hif/src/usb/regtable_usb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -278,6 +278,7 @@ struct targetdef_s {
 	u_int32_t d_CPU_INTR_ADDRESS;
 	u_int32_t d_SOC_LF_TIMER_CONTROL0_ADDRESS;
 	u_int32_t d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK;
+	u_int32_t d_SOC_LF_TIMER_STATUS0_ADDRESS;
 	/* chip id start */
 	u_int32_t d_SOC_CHIP_ID_ADDRESS;
 	u_int32_t d_SOC_CHIP_ID_VERSION_MASK;
@@ -455,6 +456,8 @@ struct targetdef_s {
 		(scn->targetdef->d_SOC_LF_TIMER_CONTROL0_ADDRESS)
 #define SOC_LF_TIMER_CONTROL0_ENABLE_MASK  \
 		(scn->targetdef->d_SOC_LF_TIMER_CONTROL0_ENABLE_MASK)
+#define SOC_LF_TIMER_STATUS0_ADDRESS      \
+		(scn->targetdef->d_SOC_LF_TIMER_STATUS0_ADDRESS)
 #define SOC_RESET_CONTROL_PCIE_RST_SHORT_OVRD_LSB \
 		(scn->targetdef->d_SOC_RESET_CONTROL_PCIE_RST_SHORT_OVRD_LSB)
 #define SOC_RESET_CONTROL_PCIE_RST_SHORT_OVRD_MASK \
diff --git a/umac/cmn_services/crypto/src/wlan_crypto_global_api.c b/umac/cmn_services/crypto/src/wlan_crypto_global_api.c
index b6e21f333b..ab7976578e 100644
--- a/umac/cmn_services/crypto/src/wlan_crypto_global_api.c
+++ b/umac/cmn_services/crypto/src/wlan_crypto_global_api.c
@@ -2379,6 +2379,13 @@ uint8_t *wlan_crypto_build_wpaie(struct wlan_objmgr_vdev *vdev,
 		selcnt[0]++;
 		WPA_ADD_KEYMGMT_TO_SUITE(frm, WLAN_CRYPTO_KEY_MGMT_NONE);
 	}
+
+	/* optional capabilities */
+	if (crypto_params->rsn_caps != 0 &&
+	    crypto_params->rsn_caps != WLAN_CRYPTO_RSN_CAP_PREAUTH) {
+		WLAN_CRYPTO_ADDSHORT(frm, crypto_params->rsn_caps);
+	}
+
 	/* calculate element length */
 	iebuf[1] = frm - iebuf - 2;
 
diff --git a/umac/cmn_services/serialization/src/wlan_serialization_api.c b/umac/cmn_services/serialization/src/wlan_serialization_api.c
index c8613cd3b2..379425a772 100644
--- a/umac/cmn_services/serialization/src/wlan_serialization_api.c
+++ b/umac/cmn_services/serialization/src/wlan_serialization_api.c
@@ -617,7 +617,7 @@ wlan_serialization_non_scan_cmd_status(
 	/* Look in the pdev non scan active queue */
 	queue = &pdev_q->active_list;
 
-	wlan_serialization_acquire_lock(pdev_q);
+	wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 	node = wlan_serialization_find_cmd(
 			queue, WLAN_SER_MATCH_CMD_TYPE,
@@ -641,7 +641,7 @@ wlan_serialization_non_scan_cmd_status(
 	cmd_status = wlan_serialization_is_cmd_in_active_pending(
 			cmd_in_active, cmd_in_pending);
 
-	wlan_serialization_release_lock(pdev_q);
+	wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 
 	ser_exit();
 	return cmd_status;
@@ -813,7 +813,7 @@ wlan_serialization_vdev_scan_status(struct wlan_objmgr_vdev *vdev)
 
 	pdev_q = &ser_pdev_obj->pdev_q[SER_PDEV_QUEUE_COMP_SCAN];
 
-	wlan_serialization_acquire_lock(pdev_q);
+	wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 	cmd_in_active =
 	wlan_serialization_is_cmd_in_vdev_list(
@@ -826,7 +826,7 @@ wlan_serialization_vdev_scan_status(struct wlan_objmgr_vdev *vdev)
 	status = wlan_serialization_is_cmd_in_active_pending(
 			cmd_in_active, cmd_in_pending);
 
-	wlan_serialization_release_lock(pdev_q);
+	wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 	ser_exit();
 
 	return status;
@@ -857,7 +857,7 @@ wlan_serialization_pdev_scan_status(struct wlan_objmgr_pdev *pdev)
 
 	pdev_q = &ser_pdev_obj->pdev_q[SER_PDEV_QUEUE_COMP_SCAN];
 
-	wlan_serialization_acquire_lock(pdev_q);
+	wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 	cmd_in_active = !qdf_list_empty(&pdev_q->active_list);
 	cmd_in_pending = !qdf_list_empty(&pdev_q->pending_list);
@@ -865,7 +865,7 @@ wlan_serialization_pdev_scan_status(struct wlan_objmgr_pdev *pdev)
 	status = wlan_serialization_is_cmd_in_active_pending(
 			cmd_in_active, cmd_in_pending);
 
-	wlan_serialization_release_lock(pdev_q);
+	wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 
 	return status;
 }
@@ -910,7 +910,7 @@ wlan_serialization_get_scan_cmd_using_scan_id(
 
 	pdev_q = &ser_pdev_obj->pdev_q[SER_PDEV_QUEUE_COMP_SCAN];
 
-	wlan_serialization_acquire_lock(pdev_q);
+	wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 	if (is_scan_cmd_from_active_queue)
 		queue = &pdev_q->active_list;
@@ -931,7 +931,7 @@ wlan_serialization_get_scan_cmd_using_scan_id(
 		}
 	}
 
-	wlan_serialization_release_lock(pdev_q);
+	wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 
 release_vdev_ref:
 	wlan_objmgr_vdev_release_ref(vdev, WLAN_SERIALIZATION_ID);
@@ -980,7 +980,7 @@ void *wlan_serialization_get_active_cmd(
 
 	pdev_q = wlan_serialization_get_pdev_queue_obj(ser_pdev_obj, cmd_type);
 
-	wlan_serialization_acquire_lock(pdev_q);
+	wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 	queue = &pdev_q->active_list;
 
@@ -997,7 +997,7 @@ void *wlan_serialization_get_active_cmd(
 		umac_cmd = cmd_list->cmd.umac_cmd;
 	}
 
-	wlan_serialization_release_lock(pdev_q);
+	wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 
 release_vdev_ref:
 	wlan_objmgr_vdev_release_ref(vdev, WLAN_SERIALIZATION_ID);
diff --git a/umac/cmn_services/serialization/src/wlan_serialization_internal.c b/umac/cmn_services/serialization/src/wlan_serialization_internal.c
index bfa31a8102..2285f5f351 100644
--- a/umac/cmn_services/serialization/src/wlan_serialization_internal.c
+++ b/umac/cmn_services/serialization/src/wlan_serialization_internal.c
@@ -164,12 +164,12 @@ wlan_serialization_enqueue_cmd(struct wlan_serialization_command *cmd)
 		  cmd->is_high_priority,
 		  cmd->is_blocking);
 
-	wlan_serialization_acquire_lock(pdev_queue);
+	wlan_serialization_acquire_lock(&pdev_queue->pdev_queue_lock);
 
 	active_queue = wlan_serialization_is_active_cmd_allowed(cmd);
 
 	if (wlan_serialization_is_cmd_present_queue(cmd, active_queue)) {
-		wlan_serialization_release_lock(pdev_queue);
+		wlan_serialization_release_lock(&pdev_queue->pdev_queue_lock);
 		ser_err("duplicate command, can't enqueue");
 		goto error;
 	}
@@ -177,7 +177,7 @@ wlan_serialization_enqueue_cmd(struct wlan_serialization_command *cmd)
 	if (wlan_serialization_remove_front(
 				&pdev_queue->cmd_pool_list,
 				&nnode) != QDF_STATUS_SUCCESS) {
-		wlan_serialization_release_lock(pdev_queue);
+		wlan_serialization_release_lock(&pdev_queue->pdev_queue_lock);
 		ser_err("Failed to get cmd buffer from global pool");
 		goto error;
 	}
@@ -216,7 +216,7 @@ wlan_serialization_enqueue_cmd(struct wlan_serialization_command *cmd)
 				   &cmd_list->cmd_in_use);
 	}
 
-	wlan_serialization_release_lock(pdev_queue);
+	wlan_serialization_release_lock(&pdev_queue->pdev_queue_lock);
 
 	if (WLAN_SER_CMD_ACTIVE == status)
 		wlan_serialization_activate_cmd(cmd_list,
@@ -463,7 +463,7 @@ wlan_serialization_dequeue_cmd(struct wlan_serialization_command *cmd,
 		  cmd->is_high_priority,
 		  cmd->is_blocking);
 
-	wlan_serialization_acquire_lock(pdev_queue);
+	wlan_serialization_acquire_lock(&pdev_queue->pdev_queue_lock);
 
 	if (cmd->cmd_type < WLAN_SER_CMD_NONSCAN)
 		qdf_status = wlan_ser_remove_scan_cmd(
@@ -474,7 +474,7 @@ wlan_serialization_dequeue_cmd(struct wlan_serialization_command *cmd,
 	}
 
 	if (qdf_status != QDF_STATUS_SUCCESS) {
-		wlan_serialization_release_lock(pdev_queue);
+		wlan_serialization_release_lock(&pdev_queue->pdev_queue_lock);
 		status = WLAN_SER_CMD_NOT_FOUND;
 		goto error;
 	}
@@ -520,7 +520,7 @@ wlan_serialization_dequeue_cmd(struct wlan_serialization_command *cmd,
 			blocking_cmd_waiting);
 	}
 
-	wlan_serialization_release_lock(pdev_queue);
+	wlan_serialization_release_lock(&pdev_queue->pdev_queue_lock);
 
 	/* Call cmd cb for remove request*/
 	if (cmd_bkup.cmd_cb) {
@@ -674,6 +674,8 @@ wlan_serialization_find_and_stop_timer(struct wlan_objmgr_psoc *psoc,
 	 * be unique and For non-scan command, there should be only one active
 	 * command per pdev
 	 */
+	wlan_serialization_acquire_lock(&psoc_ser_obj->timer_lock);
+
 	for (i = 0; psoc_ser_obj->max_active_cmds > i; i++) {
 		ser_timer = &psoc_ser_obj->timers[i];
 		if (!(ser_timer->cmd) ||
@@ -681,14 +683,21 @@ wlan_serialization_find_and_stop_timer(struct wlan_objmgr_psoc *psoc,
 		    (ser_timer->cmd->cmd_type != cmd->cmd_type) ||
 		    (ser_timer->cmd->vdev != cmd->vdev))
 			continue;
-		status = wlan_serialization_stop_timer(ser_timer);
-		ser_debug("\n Stopping timer for cmd type:%d, id: %d",
-			  cmd->cmd_type, cmd->cmd_id);
+
+		status = QDF_STATUS_SUCCESS;
 		break;
 	}
 
-	if (QDF_STATUS_SUCCESS != status)
+	wlan_serialization_release_lock(&psoc_ser_obj->timer_lock);
+
+	if (QDF_IS_STATUS_SUCCESS(status)) {
+		status = wlan_serialization_stop_timer(ser_timer);
+		ser_debug("\n Stopping timer for cmd type:%d, id: %d",
+			  cmd->cmd_type, cmd->cmd_id);
+	} else {
 		ser_err("Can't find timer for cmd_type[%d]", cmd->cmd_type);
+	}
+
 
 error:
 exit:
@@ -721,6 +730,8 @@ wlan_serialization_find_and_start_timer(struct wlan_objmgr_psoc *psoc,
 
 	psoc_ser_obj = wlan_serialization_get_psoc_obj(psoc);
 
+	wlan_serialization_acquire_lock(&psoc_ser_obj->timer_lock);
+
 	for (i = 0; psoc_ser_obj->max_active_cmds > i; i++) {
 		/* Keep trying timer */
 		ser_timer = &psoc_ser_obj->timers[i];
@@ -729,22 +740,26 @@ wlan_serialization_find_and_start_timer(struct wlan_objmgr_psoc *psoc,
 
 		/* Remember timer is pointing to command */
 		ser_timer->cmd = cmd;
+		status = QDF_STATUS_SUCCESS;
+		break;
+	}
+
+	wlan_serialization_release_lock(&psoc_ser_obj->timer_lock);
+
+	if (QDF_IS_STATUS_SUCCESS(status)) {
 		qdf_timer_init(NULL,
 			       &ser_timer->timer,
 			       wlan_serialization_timer_handler,
 			       ser_timer,
 			       QDF_TIMER_TYPE_SW);
 			       qdf_timer_mod(&ser_timer->timer,
-					     cmd->cmd_timeout_duration);
+			       cmd->cmd_timeout_duration);
 
 		ser_debug("starting timer for cmd: type[%d] id[%d] high_priority[%d] blocking[%d]",
 			  cmd->cmd_type,
 			  cmd->cmd_id,
 			  cmd->is_high_priority,
 			  cmd->is_blocking);
-
-		status = QDF_STATUS_SUCCESS;
-		break;
 	}
 
 error:
diff --git a/umac/cmn_services/serialization/src/wlan_serialization_main.c b/umac/cmn_services/serialization/src/wlan_serialization_main.c
index d31c1b1e5a..4c6554967a 100644
--- a/umac/cmn_services/serialization/src/wlan_serialization_main.c
+++ b/umac/cmn_services/serialization/src/wlan_serialization_main.c
@@ -520,6 +520,7 @@ QDF_STATUS wlan_serialization_psoc_close(struct wlan_objmgr_psoc *psoc)
 	ser_soc_obj->timers = NULL;
 	ser_soc_obj->max_active_cmds = 0;
 
+	wlan_serialization_destroy_lock(&ser_soc_obj->timer_lock);
 error:
 	ser_exit();
 	return status;
@@ -550,6 +551,7 @@ QDF_STATUS wlan_serialization_psoc_open(struct wlan_objmgr_psoc *psoc)
 		goto error;
 	}
 
+	wlan_serialization_create_lock(&ser_soc_obj->timer_lock);
 	status = QDF_STATUS_SUCCESS;
 
 error:
@@ -708,7 +710,7 @@ static QDF_STATUS wlan_serialization_pdev_create_handler(
 	for (index = 0; index < SER_PDEV_QUEUE_COMP_MAX; index++) {
 		pdev_queue = &ser_pdev_obj->pdev_q[index];
 
-		qdf_spinlock_create(&pdev_queue->pdev_queue_lock);
+		wlan_serialization_create_lock(&pdev_queue->pdev_queue_lock);
 
 		switch (index) {
 		case SER_PDEV_QUEUE_COMP_SCAN:
@@ -825,7 +827,7 @@ static QDF_STATUS wlan_serialization_pdev_destroy_handler(
 		wlan_serialization_destroy_pdev_list(pdev_queue);
 		wlan_serialization_destroy_cmd_pool(pdev_queue);
 
-		qdf_spinlock_destroy(&pdev_queue->pdev_queue_lock);
+		wlan_serialization_destroy_lock(&pdev_queue->pdev_queue_lock);
 	}
 
 	qdf_mem_free(ser_pdev_obj);
diff --git a/umac/cmn_services/serialization/src/wlan_serialization_non_scan.c b/umac/cmn_services/serialization/src/wlan_serialization_non_scan.c
index 83a24070ea..33830b00f6 100644
--- a/umac/cmn_services/serialization/src/wlan_serialization_non_scan.c
+++ b/umac/cmn_services/serialization/src/wlan_serialization_non_scan.c
@@ -498,7 +498,7 @@ wlan_ser_cancel_non_scan_cmd(
 	else
 		ser_debug("Can't find psoc");
 
-	wlan_serialization_acquire_lock(pdev_q);
+	wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 	qsize = wlan_serialization_list_size(pdev_queue);
 	while (!wlan_serialization_list_empty(pdev_queue) && qsize--) {
@@ -554,7 +554,8 @@ wlan_ser_cancel_non_scan_cmd(
 			 */
 			if (qdf_atomic_test_bit(CMD_MARKED_FOR_ACTIVATION,
 						&cmd_list->cmd_in_use)) {
-				wlan_serialization_release_lock(pdev_q);
+				wlan_serialization_release_lock(
+						&pdev_q->pdev_queue_lock);
 				status = WLAN_SER_CMD_MARKED_FOR_ACTIVATION;
 				goto error;
 			}
@@ -607,7 +608,7 @@ wlan_ser_cancel_non_scan_cmd(
 		}
 		nnode = pnode;
 
-		wlan_serialization_release_lock(pdev_q);
+		wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 		/*
 		 * call pending cmd's callback to notify that
 		 * it is being removed
@@ -626,7 +627,7 @@ wlan_ser_cancel_non_scan_cmd(
 					WLAN_SER_CB_RELEASE_MEM_CMD);
 		}
 
-		wlan_serialization_acquire_lock(pdev_q);
+		wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 		if (!is_active_queue)
 			status = WLAN_SER_CMD_IN_PENDING_LIST;
@@ -635,7 +636,7 @@ wlan_ser_cancel_non_scan_cmd(
 			break;
 	}
 
-	wlan_serialization_release_lock(pdev_q);
+	wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 
 error:
 	ser_exit();
diff --git a/umac/cmn_services/serialization/src/wlan_serialization_scan.c b/umac/cmn_services/serialization/src/wlan_serialization_scan.c
index 292fcf1acf..e748f8bdd9 100644
--- a/umac/cmn_services/serialization/src/wlan_serialization_scan.c
+++ b/umac/cmn_services/serialization/src/wlan_serialization_scan.c
@@ -186,7 +186,7 @@ wlan_ser_cancel_scan_cmd(
 	else
 		ser_debug("Can't find psoc");
 
-	wlan_serialization_acquire_lock(pdev_q);
+	wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 	qsize = wlan_serialization_list_size(queue);
 	while (!wlan_serialization_list_empty(queue) && qsize--) {
@@ -242,7 +242,8 @@ wlan_ser_cancel_scan_cmd(
 			 */
 			if (qdf_atomic_test_bit(CMD_MARKED_FOR_ACTIVATION,
 						&cmd_list->cmd_in_use)) {
-				wlan_serialization_release_lock(pdev_q);
+				wlan_serialization_release_lock(
+						&pdev_q->pdev_queue_lock);
 				status = WLAN_SER_CMD_MARKED_FOR_ACTIVATION;
 				goto error;
 			}
@@ -284,7 +285,7 @@ wlan_ser_cancel_scan_cmd(
 		}
 		nnode = pnode;
 
-		wlan_serialization_release_lock(pdev_q);
+		wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 		/*
 		 * call pending cmd's callback to notify that
 		 * it is being removed
@@ -303,13 +304,13 @@ wlan_ser_cancel_scan_cmd(
 					WLAN_SER_CB_RELEASE_MEM_CMD);
 		}
 
-		wlan_serialization_acquire_lock(pdev_q);
+		wlan_serialization_acquire_lock(&pdev_q->pdev_queue_lock);
 
 		if (!is_active_queue)
 			status = WLAN_SER_CMD_IN_PENDING_LIST;
 	}
 
-	wlan_serialization_release_lock(pdev_q);
+	wlan_serialization_release_lock(&pdev_q->pdev_queue_lock);
 
 error:
 	ser_exit();
diff --git a/umac/cmn_services/serialization/src/wlan_serialization_utils.c b/umac/cmn_services/serialization/src/wlan_serialization_utils.c
index 13c480bf91..5fc615d8d5 100644
--- a/umac/cmn_services/serialization/src/wlan_serialization_utils.c
+++ b/umac/cmn_services/serialization/src/wlan_serialization_utils.c
@@ -1140,6 +1140,8 @@ QDF_STATUS wlan_serialization_cleanup_all_timers(
 		goto error;
 	}
 
+	wlan_serialization_acquire_lock(&psoc_ser_obj->timer_lock);
+
 	for (i = 0; psoc_ser_obj->max_active_cmds > i; i++) {
 		ser_timer = &psoc_ser_obj->timers[i];
 		if (!ser_timer->cmd)
@@ -1151,6 +1153,7 @@ QDF_STATUS wlan_serialization_cleanup_all_timers(
 		}
 	}
 
+	wlan_serialization_release_lock(&psoc_ser_obj->timer_lock);
 error:
 	ser_exit();
 	return status;
@@ -1783,53 +1786,33 @@ error:
 }
 
 QDF_STATUS
-wlan_serialization_acquire_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue)
+wlan_serialization_acquire_lock(qdf_spinlock_t *lock)
 {
-	if (!pdev_queue) {
-		ser_err("invalid object");
-		return QDF_STATUS_E_FAILURE;
-	}
-	qdf_spin_lock_bh(&pdev_queue->pdev_queue_lock);
+	qdf_spin_lock_bh(lock);
 
 	return QDF_STATUS_SUCCESS;
 }
 
 QDF_STATUS
-wlan_serialization_release_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue)
+wlan_serialization_release_lock(qdf_spinlock_t *lock)
 {
-	if (!pdev_queue) {
-		ser_err("invalid object");
-		return QDF_STATUS_E_FAILURE;
-	}
-	qdf_spin_unlock_bh(&pdev_queue->pdev_queue_lock);
+	qdf_spin_unlock_bh(lock);
 
 	return QDF_STATUS_SUCCESS;
 }
 
 QDF_STATUS
-wlan_serialization_create_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue)
+wlan_serialization_create_lock(qdf_spinlock_t *lock)
 {
-	if (!pdev_queue) {
-		ser_err("invalid object");
-		return QDF_STATUS_E_FAILURE;
-	}
-	qdf_spinlock_create(&pdev_queue->pdev_queue_lock);
+	qdf_spinlock_create(lock);
 
 	return QDF_STATUS_SUCCESS;
 }
 
 QDF_STATUS
-wlan_serialization_destroy_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue)
+wlan_serialization_destroy_lock(qdf_spinlock_t *lock)
 {
-	if (!pdev_queue) {
-		ser_err("invalid object");
-		return QDF_STATUS_E_FAILURE;
-	}
-	qdf_spinlock_destroy(&pdev_queue->pdev_queue_lock);
+	qdf_spinlock_destroy(lock);
 
 	return QDF_STATUS_SUCCESS;
 }
diff --git a/umac/cmn_services/serialization/src/wlan_serialization_utils_i.h b/umac/cmn_services/serialization/src/wlan_serialization_utils_i.h
index 4382680112..b324c86176 100644
--- a/umac/cmn_services/serialization/src/wlan_serialization_utils_i.h
+++ b/umac/cmn_services/serialization/src/wlan_serialization_utils_i.h
@@ -784,6 +784,7 @@ struct wlan_ser_psoc_obj {
 	wlan_serialization_apply_rules_cb apply_rules_cb[WLAN_SER_CMD_MAX];
 	struct wlan_serialization_timer *timers;
 	uint8_t max_active_cmds;
+	qdf_spinlock_t timer_lock;
 };
 
 /**
@@ -1202,42 +1203,38 @@ QDF_STATUS wlan_serialization_peek_next(
 
 /**
  * wlan_serialization_acquire_lock() - Acquire lock to the given queue
- * @pdev_queue: Pointer to the pdev queue
+ * @lock: Pointer to the lock
  *
  * Return: QDF_STATUS success or failure
  */
 QDF_STATUS
-wlan_serialization_acquire_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue);
+wlan_serialization_acquire_lock(qdf_spinlock_t *lock);
 
 /**
  * wlan_serialization_release_lock() - Release lock to the given queue
- * @pdev_queue: Pointer to the pdev queue
+ * @lock: Pointer to the lock
  *
  * Return: QDF_STATUS success or failure
  */
 QDF_STATUS
-wlan_serialization_release_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue);
+wlan_serialization_release_lock(qdf_spinlock_t *lock);
 
 /**
  * wlan_serialization_create_lock() - Init the lock to the given queue
- * @pdev_queue: Pointer to the pdev queue
+ * @lock: Pointer to the lock
  *
  * Return: QDF_STATUS success or failure
  */
 QDF_STATUS
-wlan_serialization_create_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue);
+wlan_serialization_create_lock(qdf_spinlock_t *lock);
 
 /**
  * wlan_serialization_destroy_lock() - Deinit the lock to the given queue
- * @pdev_queue: Pointer to the pdev queue
+ * @lock: Pointer to the lock
  *
  * Return: QDF_STATUS success or failure
  */
 QDF_STATUS
-wlan_serialization_destroy_lock(
-		struct wlan_serialization_pdev_queue *pdev_queue);
+wlan_serialization_destroy_lock(qdf_spinlock_t *lock);
 #endif
 #endif
diff --git a/umac/dfs/core/src/misc/dfs_nol.c b/umac/dfs/core/src/misc/dfs_nol.c
index ea3e37b59b..8d203aa54a 100644
--- a/umac/dfs/core/src/misc/dfs_nol.c
+++ b/umac/dfs/core/src/misc/dfs_nol.c
@@ -475,6 +475,11 @@ void dfs_nol_update(struct wlan_dfs *dfs)
 	struct dfsreq_nolelem *dfs_nol;
 	int nlen;
 
+	if (!dfs->dfs_nol_count) {
+		dfs_debug(dfs, WLAN_DEBUG_DFS_NOL, "dfs_nol_count is zero");
+		return;
+	}
+
 	/*
 	 * Allocate enough entries to store the NOL. At least on Linux
 	 * (don't ask why), if you allocate a 0 entry array, the
diff --git a/umac/dfs/core/src/misc/dfs_zero_cac.c b/umac/dfs/core/src/misc/dfs_zero_cac.c
index f531369efb..a1075198dc 100644
--- a/umac/dfs/core/src/misc/dfs_zero_cac.c
+++ b/umac/dfs/core/src/misc/dfs_zero_cac.c
@@ -798,14 +798,16 @@ void dfs_start_precac_timer(struct wlan_dfs *dfs, uint8_t precac_chan)
 	 * So CAC expiry does not happen and moreover a new CAC is started.
 	 * Therefore do not disturb the CAC by channel restart (vdev_restart).
 	 *
-	 * If CAC was already completed on primary, then we do not need to
-	 * calculate which CAC timeout is maximum.
+	 * If CAC/preCAC was already completed on primary, then we do not need
+	 * to calculate which CAC timeout is maximum.
 	 * For example: If primary's CAC is 600 seconds and secondary's CAC
 	 * is 60 seconds then maximum gives 600 seconds which is not needed
-	 * if CAC was already completed on primary. It is to be noted that
-	 * etsi_precac/cac is done on primary segment.
+	 * if CAC/preCAC was already completed on primary. It is to be noted
+	 * that etsi_precac/cac is done on primary segment.
 	 */
-	if (!dfs_is_etsi_precac_done(dfs))
+	if (WLAN_IS_CHAN_DFS(dfs->dfs_curchan) &&
+	    !dfs_is_etsi_precac_done(dfs) &&
+	    !dfs_is_precac_done(dfs, dfs->dfs_curchan))
 		precac_timeout = QDF_MAX(primary_cac_timeout,
 					 secondary_cac_timeout) +
 				 EXTRA_TIME_IN_SEC;
diff --git a/wmi/inc/wmi_unified_priv.h b/wmi/inc/wmi_unified_priv.h
index ea5d37aaea..96224ac81a 100644
--- a/wmi/inc/wmi_unified_priv.h
+++ b/wmi/inc/wmi_unified_priv.h
@@ -1874,6 +1874,24 @@ struct wmi_soc {
 	uint32_t soc_idx;
 };
 
+/**
+ * wmi_mtrace() - Wrappper function for qdf_mtrace api
+ * @message_id: 32-Bit Wmi message ID
+ * @vdev_id: Vdev ID
+ * @data: Actual message contents
+ *
+ * This function converts the 32-bit WMI message ID in 15-bit message ID
+ * format for qdf_mtrace as in qdf_mtrace message there are only 15
+ * bits reserved for message ID.
+ * out of these 15-bits, 8-bits (From MSB) specifies the WMI_GRP_ID
+ * and remaining 7-bits specifies the actual WMI command. With this
+ * notation there can be maximum 256 groups and each group can have
+ * max 128 commands can be supported.
+ *
+ * Return: None
+ */
+void wmi_mtrace(uint32_t message_id, uint16_t vdev_id, uint32_t data);
+
 void wmi_unified_register_module(enum wmi_target_type target_type,
 			void (*wmi_attach)(wmi_unified_t wmi_handle));
 void wmi_tlv_init(void);
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c
index 4f2038188e..f4be4fd8d4 100644
--- a/wmi/src/wmi_unified_tlv.c
+++ b/wmi/src/wmi_unified_tlv.c
@@ -143,23 +143,7 @@ static inline void copy_vdev_create_pdev_id(
 }
 #endif
 
-/**
- * wmi_mtrace() - Wrappper function for qdf_mtrace api
- * @message_id: 32-Bit Wmi message ID
- * @vdev_id: Vdev ID
- * @data: Actual message contents
- *
- * This function converts the 32-bit WMI message ID in 15-bit message ID
- * format for qdf_mtrace as in qdf_mtrace message there are only 15
- * bits reserved for message ID.
- * out of these 15-bits, 8-bits (From MSB) specifies the WMI_GRP_ID
- * and remaining 7-bits specifies the actual WMI command. With this
- * notation there can be maximum 256 groups and each group can have
- * max 128 commands can be supported.
- *
- * Return: None
- */
-static void wmi_mtrace(uint32_t message_id, uint16_t vdev_id, uint32_t data)
+void wmi_mtrace(uint32_t message_id, uint16_t vdev_id, uint32_t data)
 {
 	uint16_t mtrace_message_id;
 
@@ -170,6 +154,8 @@ static void wmi_mtrace(uint32_t message_id, uint16_t vdev_id, uint32_t data)
 		   mtrace_message_id, vdev_id, data);
 }
 
+qdf_export_symbol(wmi_mtrace);
+
 /**
  * send_vdev_create_cmd_tlv() - send VDEV create command to fw
  * @wmi_handle: wmi handle
diff --git a/wmi/src/wmi_unified_twt_tlv.c b/wmi/src/wmi_unified_twt_tlv.c
index 17aaa68da9..45befcda38 100644
--- a/wmi/src/wmi_unified_twt_tlv.c
+++ b/wmi/src/wmi_unified_twt_tlv.c
@@ -238,6 +238,7 @@ static QDF_STATUS send_twt_resume_dialog_cmd_tlv(wmi_unified_t wmi_handle,
 	WMI_CHAR_ARRAY_TO_MAC_ADDR(params->peer_macaddr, &cmd->peer_macaddr);
 	cmd->dialog_id = params->dialog_id;
 	cmd->sp_offset_us = params->sp_offset_us;
+	cmd->next_twt_size = params->next_twt_size;
 
 	status = wmi_unified_cmd_send(wmi_handle, buf, sizeof(*cmd),
 						WMI_TWT_RESUME_DIALOG_CMDID);