diff --git a/dp/inc/cdp_txrx_cmn.h b/dp/inc/cdp_txrx_cmn.h
index fae142f96a..77232be543 100644
--- a/dp/inc/cdp_txrx_cmn.h
+++ b/dp/inc/cdp_txrx_cmn.h
@@ -542,4 +542,21 @@ cdp_display_stats(ol_txrx_soc_handle soc, uint16_t value)
 
 	return 0;
 }
+
+
+/**
+  * cdp_set_pn_check(): function to set pn check
+  * @soc: soc handle
+  * @sec_type: security type
+  * #rx_pn: receive pn
+  */
+static inline int cdp_set_pn_check(ol_txrx_soc_handle soc,
+	struct cdp_vdev *vdev, struct cdp_peer *peer_handle, enum cdp_sec_type sec_type,  uint32_t *rx_pn)
+{
+	if (soc->ops->cmn_drv_ops->set_pn_check)
+		soc->ops->cmn_drv_ops->set_pn_check(vdev, peer_handle,
+			sec_type, rx_pn);
+	return 0;
+}
+
 #endif /* _CDP_TXRX_CMN_H_ */
diff --git a/dp/inc/cdp_txrx_cmn_struct.h b/dp/inc/cdp_txrx_cmn_struct.h
index dba86835a4..fcd3e5e320 100644
--- a/dp/inc/cdp_txrx_cmn_struct.h
+++ b/dp/inc/cdp_txrx_cmn_struct.h
@@ -210,6 +210,27 @@ enum ol_txrx_peer_state {
 	OL_TXRX_PEER_STATE_AUTH,    /* authentication successful */
 };
 
+
+/**
+ * struct cdp_sec_type - security type information
+ */
+enum cdp_sec_type {
+    cdp_sec_type_none,
+    cdp_sec_type_wep128,
+    cdp_sec_type_wep104,
+    cdp_sec_type_wep40,
+    cdp_sec_type_tkip,
+    cdp_sec_type_tkip_nomic,
+    cdp_sec_type_aes_ccmp,
+    cdp_sec_type_wapi,
+    cdp_sec_type_aes_ccmp_256,
+    cdp_sec_type_aes_gcmp,
+    cdp_sec_type_aes_gcmp_256,
+
+    /* keep this last! */
+    cdp_num_sec_types
+};
+
 typedef struct cdp_soc_t *ol_txrx_soc_handle;
 
 /**
diff --git a/dp/inc/cdp_txrx_handle.h b/dp/inc/cdp_txrx_handle.h
index 000e62d400..570947db85 100644
--- a/dp/inc/cdp_txrx_handle.h
+++ b/dp/inc/cdp_txrx_handle.h
@@ -29,6 +29,7 @@
 struct cdp_cfg;
 struct cdp_pdev;
 struct cdp_vdev;
+struct cdp_peer;
 struct cdp_raw_ast;
 
 #endif
diff --git a/dp/inc/cdp_txrx_ops.h b/dp/inc/cdp_txrx_ops.h
index fd8ad388f0..c88fff7908 100644
--- a/dp/inc/cdp_txrx_ops.h
+++ b/dp/inc/cdp_txrx_ops.h
@@ -208,6 +208,9 @@ struct cdp_cmn_ops {
 	int(*txrx_soc_get_nss_cfg)(ol_txrx_soc_handle soc);
 	QDF_STATUS (*txrx_intr_attach)(void *soc);
 	void (*txrx_intr_detach)(void *soc);
+	void  (*set_pn_check)(struct cdp_vdev *vdev,
+		struct cdp_peer *peer_handle, enum cdp_sec_type sec_type,
+		 uint32_t *rx_pn);
 };
 
 struct cdp_ctrl_ops {
diff --git a/dp/wifi3.0/dp_internal.h b/dp/wifi3.0/dp_internal.h
index 5feacf88c5..b57eb9e20f 100644
--- a/dp/wifi3.0/dp_internal.h
+++ b/dp/wifi3.0/dp_internal.h
@@ -285,4 +285,7 @@ QDF_STATUS dp_h2t_ext_stats_msg_send(struct dp_pdev *pdev,
 		uint32_t config_param_3);
 void dp_htt_stats_print_tag(uint8_t tag_type, uint32_t *tag_buf);
 int dp_peer_rxtid_stats(struct dp_peer *peer);
+void dp_set_pn_check_wifi3(struct cdp_vdev *vdev_handle,
+	struct cdp_peer *peer_handle, enum cdp_sec_type sec_type,
+	 uint32_t *rx_pn);
 #endif /* #ifndef _DP_INTERNAL_H_ */
diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c
index 6efeee3164..9c31016e90 100644
--- a/dp/wifi3.0/dp_main.c
+++ b/dp/wifi3.0/dp_main.c
@@ -3813,6 +3813,7 @@ static struct cdp_cmn_ops dp_ops_cmn = {
 	.txrx_soc_get_nss_cfg = dp_soc_get_nss_cfg_wifi3,
 	.txrx_intr_attach = dp_soc_interrupt_attach,
 	.txrx_intr_detach = dp_soc_interrupt_detach,
+	.set_pn_check = dp_set_pn_check_wifi3,
 	/* TODO: Add other functions */
 };
 
diff --git a/dp/wifi3.0/dp_peer.c b/dp/wifi3.0/dp_peer.c
index 59d7ed82c4..fad111494b 100644
--- a/dp/wifi3.0/dp_peer.c
+++ b/dp/wifi3.0/dp_peer.c
@@ -806,14 +806,14 @@ try_desc_alloc:
 	 * HTT_T2H_MSG_TYPE_SEC_IND from target
 	 */
 	switch (peer->security[dp_sec_ucast].sec_type) {
-	case htt_sec_type_tkip_nomic:
-	case htt_sec_type_aes_ccmp:
-	case htt_sec_type_aes_ccmp_256:
-	case htt_sec_type_aes_gcmp:
-	case htt_sec_type_aes_gcmp_256:
+	case cdp_sec_type_tkip_nomic:
+	case cdp_sec_type_aes_ccmp:
+	case cdp_sec_type_aes_ccmp_256:
+	case cdp_sec_type_aes_gcmp:
+	case cdp_sec_type_aes_gcmp_256:
 		hal_pn_type = HAL_PN_WPA;
 		break;
-	case htt_sec_type_wapi:
+	case cdp_sec_type_wapi:
 		if (vdev->opmode == wlan_op_mode_ap)
 			hal_pn_type = HAL_PN_WAPI_EVEN;
 		else
@@ -990,7 +990,7 @@ void dp_peer_rx_init(struct dp_pdev *pdev, struct dp_peer *peer)
 	 * send a HTT SEC_IND message to overwrite these defaults.
 	 */
 	peer->security[dp_sec_ucast].sec_type =
-		peer->security[dp_sec_mcast].sec_type = htt_sec_type_none;
+		peer->security[dp_sec_mcast].sec_type = cdp_sec_type_none;
 }
 
 /*
@@ -1140,6 +1140,102 @@ void dp_rx_discard(struct dp_vdev *vdev, struct dp_peer *peer, unsigned tid,
 	}
 }
 
+
+/**
+ * dp_set_pn_check_wifi3() - enable PN check in REO for security
+ * @peer: Datapath peer handle
+ * @vdev: Datapath vdev
+ * @pdev - data path device instance
+ * @sec_type - security type
+ * @rx_pn - Receive pn starting number
+ *
+ */
+
+void
+dp_set_pn_check_wifi3(struct cdp_vdev *vdev_handle, struct cdp_peer *peer_handle, enum cdp_sec_type sec_type,  uint32_t *rx_pn)
+{
+	struct dp_peer *peer =  (struct dp_peer *)peer_handle;
+	struct dp_vdev *vdev = (struct dp_vdev *)vdev_handle;
+	struct dp_pdev *pdev;
+	struct dp_soc *soc;
+	int i;
+	struct hal_reo_cmd_params params;
+
+	/* preconditions */
+	qdf_assert(vdev);
+
+	pdev = vdev->pdev;
+	soc = pdev->soc;
+
+
+	qdf_mem_zero(&params, sizeof(params));
+
+	params.std.need_status = 1;
+	params.u.upd_queue_params.update_pn_valid = 1;
+	params.u.upd_queue_params.update_pn_size = 1;
+	params.u.upd_queue_params.update_pn = 1;
+	params.u.upd_queue_params.update_pn_check_needed = 1;
+
+	peer->security[dp_sec_ucast].sec_type = sec_type;
+
+	switch (sec_type) {
+	case cdp_sec_type_tkip_nomic:
+	case cdp_sec_type_aes_ccmp:
+	case cdp_sec_type_aes_ccmp_256:
+	case cdp_sec_type_aes_gcmp:
+	case cdp_sec_type_aes_gcmp_256:
+		params.u.upd_queue_params.pn_check_needed = 1;
+		params.u.upd_queue_params.pn_size = 48;
+		break;
+	case cdp_sec_type_wapi:
+		params.u.upd_queue_params.pn_check_needed = 1;
+		params.u.upd_queue_params.pn_size = 128;
+		if (vdev->opmode == wlan_op_mode_ap) {
+			params.u.upd_queue_params.pn_even = 1;
+			params.u.upd_queue_params.update_pn_even = 1;
+		} else {
+			params.u.upd_queue_params.pn_uneven = 1;
+			params.u.upd_queue_params.update_pn_uneven = 1;
+		}
+		break;
+	default:
+		params.u.upd_queue_params.pn_check_needed = 0;
+		break;
+	}
+
+
+	for (i = 0; i < DP_MAX_TIDS; i++) {
+		struct dp_rx_tid *rx_tid = &peer->rx_tid[i];
+		if (rx_tid->hw_qdesc_vaddr_unaligned != NULL) {
+			params.std.addr_lo =
+				rx_tid->hw_qdesc_paddr & 0xffffffff;
+			params.std.addr_hi =
+				(uint64_t)(rx_tid->hw_qdesc_paddr) >> 32;
+
+			if (sec_type != cdp_sec_type_wapi) {
+				params.u.upd_queue_params.update_pn_valid = 0;
+			} else {
+				/*
+				 * Setting PN valid bit for WAPI sec_type,
+				 * since WAPI PN has to be started with
+				 * predefined value
+				 */
+				params.u.upd_queue_params.update_pn_valid = 1;
+				params.u.upd_queue_params.pn_31_0 = rx_pn[0];
+				params.u.upd_queue_params.pn_63_32 = rx_pn[1];
+				params.u.upd_queue_params.pn_95_64 = rx_pn[2];
+				params.u.upd_queue_params.pn_127_96 = rx_pn[3];
+			}
+			dp_reo_send_cmd(soc, CMD_UPDATE_RX_REO_QUEUE, &params,
+				dp_rx_tid_update_cb, rx_tid);
+		} else {
+			QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_INFO_HIGH,
+				"PN Check not setup for TID :%d \n", i);
+		}
+	}
+}
+
+
 void
 dp_rx_sec_ind_handler(void *soc_handle, uint16_t peer_id,
 	enum htt_sec_type sec_type, int is_unicast, u_int32_t *michael_key,
diff --git a/dp/wifi3.0/dp_rx_err.c b/dp/wifi3.0/dp_rx_err.c
index cfd054eb44..09a0d7cc83 100644
--- a/dp/wifi3.0/dp_rx_err.c
+++ b/dp/wifi3.0/dp_rx_err.c
@@ -72,6 +72,8 @@ static uint32_t dp_rx_msdus_drop(struct dp_soc *soc, void *ring_desc,
 	struct hal_buf_info buf_info;
 	struct hal_rx_msdu_list msdu_list; /* MSDU's per MPDU */
 	int i;
+	uint8_t *rx_tlv_hdr;
+	uint32_t tid;
 
 	hal_rx_reo_buf_paddr_get(ring_desc, &buf_info);
 
@@ -96,6 +98,13 @@ static uint32_t dp_rx_msdus_drop(struct dp_soc *soc, void *ring_desc,
 		}
 
 		rx_bufs_used++;
+		tid = hal_rx_mpdu_start_tid_get(rx_desc->rx_buf_start);
+		QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
+			"Packet received with PN error for tid :%d", tid);
+
+		rx_tlv_hdr = qdf_nbuf_data(rx_desc->nbuf);
+		if (hal_rx_encryption_info_valid(rx_tlv_hdr))
+			hal_rx_print_pn(rx_tlv_hdr);
 
 		/* Just free the buffers */
 		qdf_nbuf_free(rx_desc->nbuf);
@@ -139,6 +148,7 @@ dp_rx_pn_error_handle(struct dp_soc *soc, void *ring_desc,
 	peer_id = DP_PEER_METADATA_PEER_ID_GET(
 				mpdu_desc_info->peer_meta_data);
 
+
 	peer = dp_peer_find_by_id(soc, peer_id);
 
 	if (qdf_likely(peer)) {
@@ -146,7 +156,16 @@ dp_rx_pn_error_handle(struct dp_soc *soc, void *ring_desc,
 		 * TODO: Check for peer specific policies & set peer_pn_policy
 		 */
 	}
+	QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
+		"Packet received with PN error");
 
+	QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
+		"discard rx due to PN error for peer  %p  "
+		"(%02x:%02x:%02x:%02x:%02x:%02x)\n",
+		peer,
+		peer->mac_addr.raw[0], peer->mac_addr.raw[1],
+		peer->mac_addr.raw[2], peer->mac_addr.raw[3],
+		peer->mac_addr.raw[4], peer->mac_addr.raw[5]);
 
 	/* No peer PN policy -- definitely drop */
 	if (!peer_pn_policy)
diff --git a/dp/wifi3.0/hal_rx.h b/dp/wifi3.0/hal_rx.h
index cb53401274..f807592e51 100644
--- a/dp/wifi3.0/hal_rx.h
+++ b/dp/wifi3.0/hal_rx.h
@@ -338,6 +338,46 @@ enum hal_rx_ret_buf_manager {
 	_OFFSET_TO_BYTE_PTR(msdu_details_ptr,		\
 RX_MSDU_DETAILS_2_RX_MSDU_DESC_INFO_RX_MSDU_DESC_INFO_DETAILS_OFFSET))
 
+
+#define HAL_RX_MPDU_PN_31_0_GET(_rx_mpdu_info)		\
+	(_HAL_MS((*_OFFSET_TO_WORD_PTR(_rx_mpdu_info,	\
+	RX_MPDU_INFO_4_PN_31_0_OFFSET)),		\
+	RX_MPDU_INFO_4_PN_31_0_MASK,			\
+	RX_MPDU_INFO_4_PN_31_0_LSB))
+
+#define HAL_RX_MPDU_PN_63_32_GET(_rx_mpdu_info)		\
+	(_HAL_MS((*_OFFSET_TO_WORD_PTR(_rx_mpdu_info,	\
+	RX_MPDU_INFO_5_PN_63_32_OFFSET)),		\
+	RX_MPDU_INFO_5_PN_63_32_MASK,			\
+	RX_MPDU_INFO_5_PN_63_32_LSB))
+
+#define HAL_RX_MPDU_PN_95_64_GET(_rx_mpdu_info)		\
+	(_HAL_MS((*_OFFSET_TO_WORD_PTR(_rx_mpdu_info,	\
+	RX_MPDU_INFO_6_PN_95_64_OFFSET)),		\
+	RX_MPDU_INFO_6_PN_95_64_MASK,			\
+	RX_MPDU_INFO_6_PN_95_64_LSB))
+
+#define HAL_RX_MPDU_PN_127_96_GET(_rx_mpdu_info)	\
+	(_HAL_MS((*_OFFSET_TO_WORD_PTR(_rx_mpdu_info,	\
+	RX_MPDU_INFO_7_PN_127_96_OFFSET)),		\
+	RX_MPDU_INFO_7_PN_127_96_MASK,			\
+	RX_MPDU_INFO_7_PN_127_96_LSB))
+
+#define HAL_RX_MPDU_ENCRYPT_TYPE_GET(_rx_mpdu_info)	\
+	(_HAL_MS((*_OFFSET_TO_WORD_PTR(_rx_mpdu_info,	\
+	RX_MPDU_INFO_3_ENCRYPT_TYPE_OFFSET)),		\
+	RX_MPDU_INFO_3_ENCRYPT_TYPE_MASK,		\
+	RX_MPDU_INFO_3_ENCRYPT_TYPE_LSB))
+
+#define HAL_RX_MPDU_ENCRYPTION_INFO_VALID(_rx_mpdu_info)	\
+	(_HAL_MS((*_OFFSET_TO_WORD_PTR(_rx_mpdu_info,		\
+	RX_MPDU_INFO_2_FRAME_ENCRYPTION_INFO_VALID_OFFSET)),	\
+	RX_MPDU_INFO_2_FRAME_ENCRYPTION_INFO_VALID_MASK,	\
+	RX_MPDU_INFO_2_FRAME_ENCRYPTION_INFO_VALID_LSB))
+
+
+
+
 static inline void hal_rx_mpdu_desc_info_get(void *desc_addr,
 				struct hal_rx_mpdu_desc_info *mpdu_desc_info)
 {
@@ -537,6 +577,47 @@ static inline uint8_t
 
 }
 
+/*
+ * @ hal_rx_encryption_info_valid: Returns encryption type.
+ *
+ * @ buf: rx_tlv_hdr of the received packet
+ * @ Return: encryption type
+ */
+static inline uint32_t
+hal_rx_encryption_info_valid(uint8_t *buf)
+{
+	struct rx_pkt_tlvs *pkt_tlvs = (struct rx_pkt_tlvs *)buf;
+	struct rx_mpdu_start *mpdu_start =
+				 &pkt_tlvs->mpdu_start_tlv.rx_mpdu_start;
+	struct rx_mpdu_info *mpdu_info = &(mpdu_start->rx_mpdu_info_details);
+	uint32_t encryption_info = HAL_RX_MPDU_ENCRYPTION_INFO_VALID(mpdu_info);
+
+	return encryption_info;
+}
+
+/*
+ * @ hal_rx_print_pn: Prints the PN of rx packet.
+ *
+ * @ buf: rx_tlv_hdr of the received packet
+ * @ Return: void
+ */
+static inline void
+hal_rx_print_pn(uint8_t *buf)
+{
+	struct rx_pkt_tlvs *pkt_tlvs = (struct rx_pkt_tlvs *)buf;
+	struct rx_mpdu_start *mpdu_start =
+				 &pkt_tlvs->mpdu_start_tlv.rx_mpdu_start;
+	struct rx_mpdu_info *mpdu_info = &(mpdu_start->rx_mpdu_info_details);
+
+	uint32_t pn_31_0 = HAL_RX_MPDU_PN_31_0_GET(mpdu_info);
+	uint32_t pn_63_32 = HAL_RX_MPDU_PN_63_32_GET(mpdu_info);
+	uint32_t pn_95_64 = HAL_RX_MPDU_PN_95_64_GET(mpdu_info);
+	uint32_t pn_127_96 = HAL_RX_MPDU_PN_127_96_GET(mpdu_info);
+	QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
+		"PN number pn_127_96 0x%x pn_95_64 0x%x pn_63_32 0x%x pn_31_0 0x%x \n",
+			pn_127_96, pn_95_64, pn_63_32, pn_31_0);
+}
+
 /*
  * Get msdu_done bit from the RX_ATTENTION TLV
  */
diff --git a/hal/wifi3.0/hal_api.h b/hal/wifi3.0/hal_api.h
index 58c3549b34..eb69a41403 100644
--- a/hal/wifi3.0/hal_api.h
+++ b/hal/wifi3.0/hal_api.h
@@ -170,6 +170,10 @@ enum hal_ring_type {
 #define HAL_SRNG_LOW_THRES_INTR_ENABLE	0x00010000
 #define HAL_SRNG_MSI_INTR				0x00020000
 
+#define PN_SIZE_24 0
+#define PN_SIZE_48 1
+#define PN_SIZE_128 2
+
 /**
  * hal_srng_get_entrysize - Returns size of ring entry in bytes. Should be
  * used by callers for calculating the size of memory to be allocated before
diff --git a/hal/wifi3.0/hal_internal.h b/hal/wifi3.0/hal_internal.h
index 3fe719800e..9efbc1d326 100644
--- a/hal/wifi3.0/hal_internal.h
+++ b/hal/wifi3.0/hal_internal.h
@@ -181,8 +181,8 @@ enum hal_srng_dir {
 /* Lock wrappers for SRNG */
 #define hal_srng_lock_t qdf_spinlock_t
 #define SRNG_LOCK_INIT(_lock) qdf_spinlock_create(_lock)
-#define SRNG_LOCK(_lock) qdf_spinlock_acquire(_lock)
-#define SRNG_UNLOCK(_lock) qdf_spinlock_release(_lock)
+#define SRNG_LOCK(_lock) qdf_spin_lock_bh(_lock)
+#define SRNG_UNLOCK(_lock) qdf_spin_unlock_bh(_lock)
 #define SRNG_LOCK_DESTROY(_lock) qdf_spinlock_destroy(_lock)
 
 #define MAX_SRNG_REG_GROUPS 2
diff --git a/hal/wifi3.0/hal_reo.c b/hal/wifi3.0/hal_reo.c
index 5757712bb9..e617fae3de 100644
--- a/hal/wifi3.0/hal_reo.c
+++ b/hal/wifi3.0/hal_reo.c
@@ -491,6 +491,13 @@ inline int hal_reo_cmd_update_rx_queue(void *reo_ring, struct hal_soc *soc,
 	HAL_DESC_SET_FIELD(reo_desc, REO_UPDATE_RX_REO_QUEUE_4,
 		BA_WINDOW_SIZE, p->ba_window_size - 1);
 
+	if (p->pn_size == 24)
+		p->pn_size = PN_SIZE_24;
+	else if (p->pn_size == 48)
+		p->pn_size = PN_SIZE_48;
+	else if (p->pn_size == 128)
+		p->pn_size = PN_SIZE_128;
+
 	HAL_DESC_SET_FIELD(reo_desc, REO_UPDATE_RX_REO_QUEUE_4,
 		PN_SIZE, p->pn_size);
 
diff --git a/hal/wifi3.0/hal_reo.h b/hal/wifi3.0/hal_reo.h
index 713304d28e..3b4c02d463 100644
--- a/hal/wifi3.0/hal_reo.h
+++ b/hal/wifi3.0/hal_reo.h
@@ -322,7 +322,7 @@ struct hal_reo_cmd_update_queue_params {
 		pn_hand_enab:1,
 		ignore_ampdu:1;
 	uint32_t ba_window_size:8,
-		pn_size:2,
+		pn_size:8,
 		svld:1,
 		ssn:12,
 		seq_2k_err_detect:1,
diff --git a/hal/wifi3.0/hal_rx.c b/hal/wifi3.0/hal_rx.c
index f5795b9284..89e6e21c9d 100644
--- a/hal/wifi3.0/hal_rx.c
+++ b/hal/wifi3.0/hal_rx.c
@@ -23,10 +23,6 @@
 #define HAL_REO_QUEUE_DESC 8
 #define HAL_REO_QUEUE_EXT_DESC 9
 
-#define PN_SIZE_24 0
-#define PN_SIZE_48 1
-#define PN_SIZE_128 2
-
 /* TODO: Using associated link desc counter 1 for Rx. Check with FW on
  * how these counters are assigned
  */