diff --git a/dp/inc/cdp_txrx_cmn_struct.h b/dp/inc/cdp_txrx_cmn_struct.h
index aea884c06c32..90c17afcc46c 100644
--- a/dp/inc/cdp_txrx_cmn_struct.h
+++ b/dp/inc/cdp_txrx_cmn_struct.h
@@ -1398,6 +1398,7 @@ struct cdp_tx_completion_ppdu {
  * @rx_packets: Rx total packets transmitted
  * @rx_bytes  : Rx total bytes transmitted
  * @rx_errors : Rx erros
+ * @rx_dropped: Rx dropped stats
  */
 struct cdp_dev_stats {
 	uint32_t tx_packets;
@@ -1407,6 +1408,7 @@ struct cdp_dev_stats {
 	uint32_t rx_packets;
 	uint32_t rx_bytes;
 	uint32_t rx_errors;
+	uint32_t rx_dropped;
 };
 
 /**
diff --git a/dp/inc/cdp_txrx_stats_struct.h b/dp/inc/cdp_txrx_stats_struct.h
index b5349482c2cd..e6eaca6a84a6 100644
--- a/dp/inc/cdp_txrx_stats_struct.h
+++ b/dp/inc/cdp_txrx_stats_struct.h
@@ -1282,6 +1282,8 @@ struct cdp_pdev_stats {
 		uint32_t desc_alloc_fail;
 		uint32_t ip_csum_err;
 		uint32_t tcp_udp_csum_err;
+		uint32_t rxdma_error;
+		uint32_t reo_error;
 	} err;
 
 	uint32_t buf_freelist;
diff --git a/dp/wifi3.0/dp_internal.h b/dp/wifi3.0/dp_internal.h
index dfea615a13e0..b42741a1ad4a 100644
--- a/dp/wifi3.0/dp_internal.h
+++ b/dp/wifi3.0/dp_internal.h
@@ -816,8 +816,9 @@ extern int dp_delba_process_wifi3(void *peer_handle,
  */
 int dp_delba_tx_completion_wifi3(void *peer_handle, uint8_t tid,
 				  int status);
-extern int dp_rx_tid_setup_wifi3(struct dp_peer *peer, int tid,
-	uint32_t ba_window_size, uint32_t start_seq);
+extern QDF_STATUS dp_rx_tid_setup_wifi3(struct dp_peer *peer, int tid,
+					uint32_t ba_window_size,
+					uint32_t start_seq);
 
 extern QDF_STATUS dp_reo_send_cmd(struct dp_soc *soc,
 	enum hal_reo_cmd_type type, struct hal_reo_cmd_params *params,
diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c
index 867fffa51a2c..76777c9c1379 100644
--- a/dp/wifi3.0/dp_main.c
+++ b/dp/wifi3.0/dp_main.c
@@ -6845,9 +6845,16 @@ static void dp_pdev_getstats(void *pdev_handle,
 	stats->rx_errors = pdev->stats.err.desc_alloc_fail +
 		pdev->stats.err.ip_csum_err +
 		pdev->stats.err.tcp_udp_csum_err +
-		pdev->stats.rx.err. mic_err +
-		pdev->stats.rx.err. decrypt_err +
-		pdev->stats.rx.err. fcserr;
+		pdev->stats.rx.err.mic_err +
+		pdev->stats.rx.err.decrypt_err +
+		pdev->stats.err.rxdma_error +
+		pdev->stats.err.reo_error;
+	stats->rx_dropped = pdev->stats.dropped.msdu_not_done +
+		pdev->stats.dropped.mec +
+		pdev->stats.dropped.mesh_filter +
+		pdev->stats.dropped.wifi_parse +
+		pdev->stats.dropped.mon_rx_drop +
+		pdev->stats.dropped.mon_radiotap_update_err;
 }
 
 /**
diff --git a/dp/wifi3.0/dp_peer.c b/dp/wifi3.0/dp_peer.c
index 12c58392519a..d58b2a35b064 100644
--- a/dp/wifi3.0/dp_peer.c
+++ b/dp/wifi3.0/dp_peer.c
@@ -1677,6 +1677,29 @@ void *dp_find_peer_by_addr(struct cdp_pdev *dev, uint8_t *peer_mac_addr,
 	return peer;
 }
 
+static bool dp_get_peer_vdev_roaming_in_progress(struct dp_peer *peer)
+{
+	struct ol_if_ops *ol_ops = NULL;
+	bool is_roaming = false;
+	uint8_t vdev_id = -1;
+
+	if (!peer) {
+		dp_info("Peer is NULL. No roaming possible");
+		return false;
+	}
+	ol_ops = peer->vdev->pdev->soc->cdp_soc.ol_ops;
+
+	if (ol_ops && ol_ops->is_roam_inprogress) {
+		dp_get_vdevid(peer, &vdev_id);
+		is_roaming = ol_ops->is_roam_inprogress(vdev_id);
+	}
+
+	dp_info("peer: %pM, vdev_id: %d, is_roaming: %d",
+		peer->mac_addr.raw, vdev_id, is_roaming);
+
+	return is_roaming;
+}
+
 /*
  * dp_rx_tid_update_wifi3() – Update receive TID state
  * @peer: Datapath peer handle
@@ -1684,10 +1707,10 @@ void *dp_find_peer_by_addr(struct cdp_pdev *dev, uint8_t *peer_mac_addr,
  * @ba_window_size: BlockAck window size
  * @start_seq: Starting sequence number
  *
- * Return: 0 on success, error code on failure
+ * Return: QDF_STATUS code
  */
-static int dp_rx_tid_update_wifi3(struct dp_peer *peer, int tid, uint32_t
-				  ba_window_size, uint32_t start_seq)
+static QDF_STATUS dp_rx_tid_update_wifi3(struct dp_peer *peer, int tid, uint32_t
+					 ba_window_size, uint32_t start_seq)
 {
 	struct dp_rx_tid *rx_tid = &peer->rx_tid[tid];
 	struct dp_soc *soc = peer->vdev->pdev->soc;
@@ -1712,14 +1735,16 @@ static int dp_rx_tid_update_wifi3(struct dp_peer *peer, int tid, uint32_t
 
 	rx_tid->ba_win_size = ba_window_size;
 
-	if (soc->cdp_soc.ol_ops->peer_rx_reorder_queue_setup) {
+	if (dp_get_peer_vdev_roaming_in_progress(peer))
+		return QDF_STATUS_E_PERM;
+
+	if (soc->cdp_soc.ol_ops->peer_rx_reorder_queue_setup)
 		soc->cdp_soc.ol_ops->peer_rx_reorder_queue_setup(
 			peer->vdev->pdev->ctrl_pdev,
 			peer->vdev->vdev_id, peer->mac_addr.raw,
 			rx_tid->hw_qdesc_paddr, tid, tid, 1, ba_window_size);
-	}
 
-	return 0;
+	return QDF_STATUS_SUCCESS;
 }
 
 /*
@@ -1782,10 +1807,10 @@ static inline int dp_reo_desc_addr_chk(qdf_dma_addr_t dma_addr)
  * @ba_window_size: BlockAck window size
  * @start_seq: Starting sequence number
  *
- * Return: 0 on success, error code on failure
+ * Return: QDF_STATUS code
  */
-int dp_rx_tid_setup_wifi3(struct dp_peer *peer, int tid,
-	uint32_t ba_window_size, uint32_t start_seq)
+QDF_STATUS dp_rx_tid_setup_wifi3(struct dp_peer *peer, int tid,
+				 uint32_t ba_window_size, uint32_t start_seq)
 {
 	struct dp_rx_tid *rx_tid = &peer->rx_tid[tid];
 	struct dp_vdev *vdev = peer->vdev;
@@ -1795,7 +1820,7 @@ int dp_rx_tid_setup_wifi3(struct dp_peer *peer, int tid,
 	int hal_pn_type;
 	void *hw_qdesc_vaddr;
 	uint32_t alloc_tries = 0;
-	int err = QDF_STATUS_SUCCESS;
+	QDF_STATUS err = QDF_STATUS_SUCCESS;
 
 	if (peer->delete_in_progress ||
 	    !qdf_atomic_read(&peer->is_default_route_set))
@@ -1923,6 +1948,11 @@ try_desc_alloc:
 		}
 	}
 
+	if (dp_get_peer_vdev_roaming_in_progress(peer)) {
+		err = QDF_STATUS_E_PERM;
+		goto error;
+	}
+
 	if (soc->cdp_soc.ol_ops->peer_rx_reorder_queue_setup) {
 		if (soc->cdp_soc.ol_ops->peer_rx_reorder_queue_setup(
 		    vdev->pdev->ctrl_pdev, peer->vdev->vdev_id,
@@ -2352,6 +2382,7 @@ int dp_addba_resp_tx_completion_wifi3(void *peer_handle,
 {
 	struct dp_peer *peer = (struct dp_peer *)peer_handle;
 	struct dp_rx_tid *rx_tid = NULL;
+	QDF_STATUS qdf_status;
 
 	if (!peer || peer->delete_in_progress) {
 		QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_DEBUG,
@@ -2361,26 +2392,13 @@ int dp_addba_resp_tx_completion_wifi3(void *peer_handle,
 	rx_tid = &peer->rx_tid[tid];
 	qdf_spin_lock_bh(&rx_tid->tid_lock);
 	if (status) {
-		struct ol_if_ops *ol_ops = NULL;
-		bool is_roaming = false;
-		uint8_t vdev_id = -1;
-
 		rx_tid->num_addba_rsp_failed++;
-		ol_ops = peer->vdev->pdev->soc->cdp_soc.ol_ops;
-
-		if (ol_ops && ol_ops->is_roam_inprogress) {
-			dp_get_vdevid(peer, &vdev_id);
-			is_roaming = ol_ops->is_roam_inprogress(vdev_id);
-		}
-
-		if (!is_roaming) {
-			dp_rx_tid_update_wifi3(peer, tid, 1, IEEE80211_SEQ_MAX);
+		qdf_status = dp_rx_tid_update_wifi3(peer, tid, 1,
+						    IEEE80211_SEQ_MAX);
+		if (qdf_status == QDF_STATUS_SUCCESS)
 			rx_tid->ba_status = DP_RX_BA_INACTIVE;
-		}
-
 		qdf_spin_unlock_bh(&rx_tid->tid_lock);
-		dp_err("RxTid- %d addba rsp tx completion failed, is_roaming %d",
-		       tid, is_roaming);
+		dp_err("RxTid- %d addba rsp tx completion failed", tid);
 		return QDF_STATUS_SUCCESS;
 	}
 
diff --git a/dp/wifi3.0/dp_rx_err.c b/dp/wifi3.0/dp_rx_err.c
index 2de3c6375807..c38d7327a9e8 100644
--- a/dp/wifi3.0/dp_rx_err.c
+++ b/dp/wifi3.0/dp_rx_err.c
@@ -1223,6 +1223,10 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc,
 				rx.err.
 				reo_error[HAL_REO_ERR_PN_CHECK_FAILED],
 				1);
+			/* increment @pdev level */
+			dp_pdev = dp_get_pdev_for_mac_id(soc, mac_id);
+			if (dp_pdev)
+				DP_STATS_INC(dp_pdev, err.reo_error, 1);
 			count = dp_rx_pn_error_handle(soc,
 						      ring_desc,
 						      &mpdu_desc_info, &mac_id,
@@ -1238,6 +1242,10 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc,
 				rx.err.
 				reo_error[HAL_REO_ERR_REGULAR_FRAME_2K_JUMP],
 				1);
+			/* increment @pdev level */
+			dp_pdev = dp_get_pdev_for_mac_id(soc, mac_id);
+			if (dp_pdev)
+				DP_STATS_INC(dp_pdev, err.reo_error, 1);
 
 			count = dp_rx_2k_jump_handle(soc,
 						     ring_desc, &mpdu_desc_info,
@@ -1442,6 +1450,12 @@ done:
 				DP_STATS_INC(soc,
 					rx.err.reo_error
 					[wbm_err_info.reo_err_code], 1);
+				/* increment @pdev level */
+				pool_id = wbm_err_info.pool_id;
+				dp_pdev = dp_get_pdev_for_mac_id(soc, pool_id);
+				if (dp_pdev)
+					DP_STATS_INC(dp_pdev, err.reo_error,
+						     1);
 
 				switch (wbm_err_info.reo_err_code) {
 				/*
@@ -1489,6 +1503,12 @@ done:
 				DP_STATS_INC(soc,
 					rx.err.rxdma_error
 					[wbm_err_info.rxdma_err_code], 1);
+				/* increment @pdev level */
+				pool_id = wbm_err_info.pool_id;
+				dp_pdev = dp_get_pdev_for_mac_id(soc, pool_id);
+				if (dp_pdev)
+					DP_STATS_INC(dp_pdev,
+						     err.rxdma_error, 1);
 
 				switch (wbm_err_info.rxdma_err_code) {
 				case HAL_RXDMA_ERR_UNENCRYPTED:
@@ -1708,6 +1728,8 @@ dp_rx_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
 	} while (buf_info.paddr);
 
 	DP_STATS_INC(soc, rx.err.rxdma_error[rxdma_error_code], 1);
+	if (pdev)
+		DP_STATS_INC(pdev, err.rxdma_error, 1);
 
 	if (rxdma_error_code == HAL_RXDMA_ERR_DECRYPT) {
 		QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
diff --git a/dp/wifi3.0/dp_tx.c b/dp/wifi3.0/dp_tx.c
index dda29bad2595..32230c2222ba 100644
--- a/dp/wifi3.0/dp_tx.c
+++ b/dp/wifi3.0/dp_tx.c
@@ -397,6 +397,9 @@ static void dp_tx_prepare_tso_ext_desc(struct qdf_tso_seg_t *tso_seg,
 		uint32_t lo = 0;
 		uint32_t hi = 0;
 
+		qdf_assert_always((tso_seg->tso_frags[num_frag].paddr) &&
+				  (tso_seg->tso_frags[num_frag].length));
+
 		qdf_dmaaddr_to_32s(
 			tso_seg->tso_frags[num_frag].paddr, &lo, &hi);
 		hal_tx_ext_desc_set_buffer(ext_desc, num_frag, lo, hi,
@@ -1082,6 +1085,8 @@ static QDF_STATUS dp_tx_hw_enqueue(struct dp_soc *soc, struct dp_vdev *vdev,
 		dma_addr = qdf_nbuf_mapped_paddr_get(tx_desc->nbuf);
 	}
 
+	qdf_assert_always(dma_addr);
+
 	hal_tx_desc_set_fw_metadata(hal_tx_desc_cached, fw_metadata);
 	hal_tx_desc_set_buf_addr(hal_tx_desc_cached,
 					dma_addr, bm_id, tx_desc->id,
diff --git a/hal/wifi3.0/qca8074v2/hal_8074v2_rx.h b/hal/wifi3.0/qca8074v2/hal_8074v2_rx.h
index 917bffc723fa..f37c06cd3c34 100644
--- a/hal/wifi3.0/qca8074v2/hal_8074v2_rx.h
+++ b/hal/wifi3.0/qca8074v2/hal_8074v2_rx.h
@@ -189,8 +189,6 @@ void hal_rx_proc_phyrx_other_receive_info_tlv_8074v2(void *rx_tlv_hdr,
 				SU_EVM_DETAILS_0_NSS_COUNT);
 		hal_rx_update_su_evm_info(rx_tlv, ppdu_info_hdl);
 	break;
-	default:
-		qdf_err("TLV tag not found");
 	}
 }
 #else
diff --git a/qdf/linux/src/qdf_nbuf.c b/qdf/linux/src/qdf_nbuf.c
index 30553f902c24..96f2f5bd71b0 100644
--- a/qdf/linux/src/qdf_nbuf.c
+++ b/qdf/linux/src/qdf_nbuf.c
@@ -334,7 +334,16 @@ qdf_export_symbol(__qdf_nbuf_count_get);
  */
 void __qdf_nbuf_count_inc(qdf_nbuf_t nbuf)
 {
-	qdf_atomic_inc(&nbuf_count);
+	int num_nbuf = 1;
+	qdf_nbuf_t ext_list = qdf_nbuf_get_ext_list(nbuf);
+
+	/* Take care to account for frag_list */
+	while (ext_list) {
+		++num_nbuf;
+		ext_list = qdf_nbuf_queue_next(ext_list);
+	}
+
+	qdf_atomic_add(num_nbuf, &nbuf_count);
 }
 qdf_export_symbol(__qdf_nbuf_count_inc);
 
@@ -347,7 +356,23 @@ qdf_export_symbol(__qdf_nbuf_count_inc);
  */
 void __qdf_nbuf_count_dec(__qdf_nbuf_t nbuf)
 {
-	qdf_atomic_dec(&nbuf_count);
+	qdf_nbuf_t ext_list;
+	int num_nbuf;
+
+	if (qdf_nbuf_get_users(nbuf) > 1)
+		return;
+
+	num_nbuf = 1;
+
+	/* Take care to account for frag_list */
+	ext_list = qdf_nbuf_get_ext_list(nbuf);
+	while (ext_list) {
+		if (qdf_nbuf_get_users(ext_list) == 1)
+			++num_nbuf;
+		ext_list = qdf_nbuf_queue_next(ext_list);
+	}
+
+	qdf_atomic_sub(num_nbuf, &nbuf_count);
 }
 qdf_export_symbol(__qdf_nbuf_count_dec);
 #endif
@@ -2567,6 +2592,8 @@ qdf_export_symbol(qdf_nbuf_alloc_debug);
 
 void qdf_nbuf_free_debug(qdf_nbuf_t nbuf, const char *func, uint32_t line)
 {
+	qdf_nbuf_t ext_list;
+
 	if (qdf_unlikely(!nbuf))
 		return;
 
@@ -2578,6 +2605,17 @@ void qdf_nbuf_free_debug(qdf_nbuf_t nbuf, const char *func, uint32_t line)
 	qdf_net_buf_debug_delete_node(nbuf);
 	qdf_nbuf_history_add(nbuf, func, line, QDF_NBUF_FREE);
 
+	/* Take care to delete the debug entries for frag_list */
+	ext_list = qdf_nbuf_get_ext_list(nbuf);
+	while (ext_list) {
+		if (qdf_nbuf_get_users(ext_list) == 1) {
+			qdf_nbuf_panic_on_free_if_mapped(ext_list, func, line);
+			qdf_net_buf_debug_delete_node(ext_list);
+		}
+
+		ext_list = qdf_nbuf_queue_next(ext_list);
+	}
+
 free_buf:
 	__qdf_nbuf_free(nbuf);
 }
diff --git a/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_rx_ops.h b/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_rx_ops.h
index fbfd8f45e0c2..991c653771e4 100644
--- a/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_rx_ops.h
+++ b/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_rx_ops.h
@@ -39,6 +39,59 @@ static inline bool target_if_vdev_mgr_is_driver_unloading(void)
 	return false;
 }
 
+/**
+ * target_if_vdev_mgr_delete_response_handler() - API to handle vdev delete
+ * response
+ * @scn: pointer to scan object
+ * @data: pointer to data
+ * @datalen: length of data
+ *
+ * Return: QDF_STATUS_SUCCESS on success, QDF_STATUS_E_** on error
+ */
+int target_if_vdev_mgr_delete_response_handler(
+						ol_scn_t scn,
+						uint8_t *data,
+						uint32_t datalen);
+
+/**
+ * target_if_vdev_mgr_offload_bcn_tx_status_handler() - API to handle beacon
+ * tx status event
+ * @scn: pointer to scan object
+ * @data: pointer to data
+ * @datalen: length of data
+ *
+ * Return: QDF_STATUS_SUCCESS on success, QDF_STATUS_E_** on error
+ */
+int target_if_vdev_mgr_offload_bcn_tx_status_handler(ol_scn_t scn,
+						     uint8_t *data,
+						     uint32_t datalen);
+
+/**
+ * target_if_vdev_mgr_tbttoffset_update_handler() - API to handle tbtt offset
+ * update event
+ * @scn: pointer to scan object
+ * @data: pointer to data
+ * @datalen: length of data
+ *
+ * Return: QDF_STATUS_SUCCESS on success, QDF_STATUS_E_** on error
+ */
+int target_if_vdev_mgr_tbttoffset_update_handler(ol_scn_t scn,
+						 uint8_t *data,
+						 uint32_t datalen);
+
+/**
+ * target_if_vdev_mgr_ext_tbttoffset_update_handler() - API to handle ext tbtt
+ * offset update event
+ * @scn: pointer to scan object
+ * @data: pointer to data
+ * @datalen: length of data
+ *
+ * Return: QDF_STATUS_SUCCESS on success, QDF_STATUS_E_** on error
+ */
+int target_if_vdev_mgr_ext_tbttoffset_update_handler(ol_scn_t scn,
+						     uint8_t *data,
+						     uint32_t datalen);
+
 /**
  * target_if_vdev_mgr_is_panic_on_bug: API to get panic on bug
  *
diff --git a/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_tx_ops.h b/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_tx_ops.h
index fb643fa91e3b..0707c9632b2c 100644
--- a/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_tx_ops.h
+++ b/target_if/mlme/vdev_mgr/inc/target_if_vdev_mgr_tx_ops.h
@@ -71,14 +71,14 @@ target_if_vdev_mgr_register_tx_ops(struct wlan_lmac_if_tx_ops *tx_ops);
  * Return: NA
  */
 #ifdef VDEV_ASSERT_MANAGEMENT
-static void target_if_vdev_mgr_assert_mgmt(
+static inline void target_if_vdev_mgr_assert_mgmt(
 					struct wlan_objmgr_vdev *vdev,
 					struct vdev_response_timer *vdev_rsp,
 					uint8_t set_bit)
 {
 }
 #else
-static void target_if_vdev_mgr_assert_mgmt(
+static inline void target_if_vdev_mgr_assert_mgmt(
 					struct wlan_objmgr_vdev *vdev,
 					struct vdev_response_timer *vdev_rsp,
 					uint8_t set_bit)
diff --git a/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_rx_ops.c b/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_rx_ops.c
index f78f75f2c6b7..275c709c2169 100644
--- a/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_rx_ops.c
+++ b/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_rx_ops.c
@@ -31,6 +31,7 @@
 #include <target_if.h>
 #include <qdf_platform.h>
 #include <wlan_vdev_mlme_main.h>
+#include <wmi_unified_vdev_api.h>
 
 void target_if_vdev_mgr_rsp_timer_mgmt_cb(void *arg)
 {
@@ -322,7 +323,7 @@ release_vdev_target_if_ref:
 	return qdf_status_to_os_return(status);
 }
 
-static int target_if_vdev_mgr_delete_response_handler(
+int target_if_vdev_mgr_delete_response_handler(
 						ol_scn_t scn,
 						uint8_t *data,
 						uint32_t datalen)
@@ -482,10 +483,10 @@ release_vdev_target_if_ref:
 	return qdf_status_to_os_return(status);
 }
 
-static int target_if_vdev_mgr_offload_bcn_tx_status_handler(
-							ol_scn_t scn,
-							uint8_t *data,
-							uint32_t datalen)
+int target_if_vdev_mgr_offload_bcn_tx_status_handler(
+					ol_scn_t scn,
+					uint8_t *data,
+					uint32_t datalen)
 {
 	QDF_STATUS status;
 	struct wlan_objmgr_psoc *psoc;
@@ -528,9 +529,8 @@ static int target_if_vdev_mgr_offload_bcn_tx_status_handler(
 	return qdf_status_to_os_return(status);
 }
 
-static int target_if_vdev_mgr_tbttoffset_update_handler(
-						ol_scn_t scn,
-						uint8_t *data,
+int target_if_vdev_mgr_tbttoffset_update_handler(
+						ol_scn_t scn, uint8_t *data,
 						uint32_t datalen)
 {
 	QDF_STATUS status;
@@ -572,7 +572,7 @@ static int target_if_vdev_mgr_tbttoffset_update_handler(
 	return qdf_status_to_os_return(status);
 }
 
-static int target_if_vdev_mgr_ext_tbttoffset_update_handler(
+int target_if_vdev_mgr_ext_tbttoffset_update_handler(
 						ol_scn_t scn,
 						uint8_t *data,
 						uint32_t datalen)
diff --git a/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c b/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c
index 49b6ddaa7d07..c1c032649c88 100644
--- a/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c
+++ b/target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c
@@ -35,6 +35,7 @@
 #include <wlan_vdev_mgr_tgt_if_tx_defs.h>
 #include <wlan_vdev_mgr_utils_api.h>
 #include <wlan_cmn.h>
+#include <wmi_unified_vdev_api.h>
 
 static QDF_STATUS target_if_vdev_mgr_register_event_handler(
 					struct wlan_objmgr_psoc *psoc)
@@ -760,7 +761,6 @@ static QDF_STATUS target_if_vdev_mgr_config_ratemask_cmd_send(
 
 	status = wmi_unified_vdev_config_ratemask_cmd_send(wmi_handle,
 							   param);
-
 	return status;
 }
 
diff --git a/target_if/spectral/target_if_spectral.c b/target_if/spectral/target_if_spectral.c
index e417c2354982..c369a611a89d 100644
--- a/target_if/spectral/target_if_spectral.c
+++ b/target_if/spectral/target_if_spectral.c
@@ -345,7 +345,7 @@ target_if_log_read_spectral_params(
 	const char *function_name,
 	struct spectral_config *pparam)
 {
-	spectral_debug("%s: TARGET_IF_SPECTRAL_INFO_PARAMS. Returning following params:\nss_count = %u\nss_period = %u\nss_spectral_pri = %u\nss_fft_size = %u\nss_gc_ena = %u\nss_restart_ena = %u\nss_noise_floor_ref = %d\nss_init_delay = %u\nss_nb_tone_thr = %u\nss_str_bin_thr = %u\nss_wb_rpt_mode = %u\nss_rssi_rpt_mode = %u\nss_rssi_thr = %d\nss_pwr_format = %u\nss_rpt_mode = %u\nss_bin_scale = %u\nss_dbm_adj = %u\nss_chn_mask = %u\n",
+	spectral_debug("%s: TARGET_IF_SPECTRAL_INFO_PARAMS. Returning following params:\nss_count = %u\nss_period = %u\nss_spectral_pri = %u\nss_fft_size = %u\nss_gc_ena = %u\nss_restart_ena = %u\nss_noise_floor_ref = %d\nss_init_delay = %u\nss_nb_tone_thr = %u\nss_str_bin_thr = %u\nss_wb_rpt_mode = %u\nss_rssi_rpt_mode = %u\nss_rssi_thr = %d\nss_pwr_format = %u\nss_rpt_mode = %u\nss_bin_scale = %u\nss_dbm_adj = %u\nss_chn_mask = %u\nss_frequency=%u\n",
 		       function_name,
 		       pparam->ss_count,
 		       pparam->ss_period,
@@ -364,7 +364,8 @@ target_if_log_read_spectral_params(
 		       pparam->ss_rpt_mode,
 		       pparam->ss_bin_scale,
 		       pparam->ss_dbm_adj,
-		       pparam->ss_chn_mask);
+		       pparam->ss_chn_mask,
+		       pparam->ss_frequency);
 }
 
 /**
@@ -666,7 +667,7 @@ target_if_log_write_spectral_params(
 	const char *function_name,
 	int ret)
 {
-	spectral_debug("%s: TARGET_IF_SPECTRAL_INFO_PARAMS. Params:\nss_count = %u\nss_period = %u\nss_spectral_pri = %u\nss_fft_size = %u\nss_gc_ena = %u\nss_restart_ena = %u\nss_noise_floor_ref = %d\nss_init_delay = %u\nss_nb_tone_thr = %u\nss_str_bin_thr = %u\nss_wb_rpt_mode = %u\nss_rssi_rpt_mode = %u\nss_rssi_thr = %d\nss_pwr_format = %u\nss_rpt_mode = %u\nss_bin_scale = %u\nss_dbm_adj = %u\nss_chn_mask = %u\nstatus = %d",
+	spectral_debug("%s: TARGET_IF_SPECTRAL_INFO_PARAMS. Params:\nss_count = %u\nss_period = %u\nss_spectral_pri = %u\nss_fft_size = %u\nss_gc_ena = %u\nss_restart_ena = %u\nss_noise_floor_ref = %d\nss_init_delay = %u\nss_nb_tone_thr = %u\nss_str_bin_thr = %u\nss_wb_rpt_mode = %u\nss_rssi_rpt_mode = %u\nss_rssi_thr = %d\nss_pwr_format = %u\nss_rpt_mode = %u\nss_bin_scale = %u\nss_dbm_adj = %u\nss_chn_mask = %u\nss_frequency=%u\nstatus = %d",
 		       function_name,
 		       param->ss_count,
 		       param->ss_period,
@@ -684,7 +685,10 @@ target_if_log_write_spectral_params(
 		       param->ss_pwr_format,
 		       param->ss_rpt_mode,
 		       param->ss_bin_scale,
-		       param->ss_dbm_adj, param->ss_chn_mask, ret);
+		       param->ss_dbm_adj,
+		       param->ss_chn_mask,
+		       param->ss_frequency,
+		       ret);
 }
 
 /**
diff --git a/target_if/spectral/target_if_spectral_phyerr.c b/target_if/spectral/target_if_spectral_phyerr.c
index 95e79df82f84..997c23f58a4c 100644
--- a/target_if/spectral/target_if_spectral_phyerr.c
+++ b/target_if/spectral/target_if_spectral_phyerr.c
@@ -35,30 +35,82 @@ extern int spectral_debug_level;
 
 #ifdef WLAN_CONV_SPECTRAL_ENABLE
 
+#define SPECTRAL_HEXDUMP_OCTET_PRINT_SIZE           (3)
+#define SPECTRAL_HEXDUMP_NUM_OCTETS_PER_LINE        (16)
+#define SPECTRAL_HEXDUMP_EXTRA_BUFFER_PER_LINE      (16)
+
+/*
+ * Provision for the expected hexdump line size as follows:
+ *
+ * Size per octet multiplied by number of octets per line
+ * +
+ * ASCII representation which is equivalent in print size to number of octets
+ * per line
+ * +
+ * Some extra buffer
+ */
+#define SPECTRAL_HEXDUMP_LINESIZE                           \
+		((SPECTRAL_HEXDUMP_OCTET_PRINT_SIZE *       \
+		  SPECTRAL_HEXDUMP_NUM_OCTETS_PER_LINE) +   \
+		 SPECTRAL_HEXDUMP_NUM_OCTETS_PER_LINE +     \
+		 SPECTRAL_HEXDUMP_EXTRA_BUFFER_PER_LINE)
+
+/**
+ * target_if_spectral_hexdump() - Print hexdump of the given buffer
+ * @_buf: Pointer to buffer
+ * @_len: Length of the buffer
+ *
+ * Print the hexdump of buffer upto given length. Print upto
+ * SPECTRAL_HEXDUMP_NUM_OCTETS_PER_LINE per line, followed by the ASCII
+ * representation of these octets.
+ */
 static inline void target_if_spectral_hexdump(unsigned char *_buf, int _len)
 {
 	int i, mod;
-	unsigned char ascii[17];
+	unsigned char ascii[SPECTRAL_HEXDUMP_NUM_OCTETS_PER_LINE + 1];
 	unsigned char *pc = (_buf);
+	char hexdump_line[SPECTRAL_HEXDUMP_LINESIZE + 1];
+	int loc = 0;
+
+	qdf_mem_zero(hexdump_line, sizeof(hexdump_line));
 
 	for (i = 0; i < _len; i++) {
-		mod = i % 16;
+		mod = i % SPECTRAL_HEXDUMP_NUM_OCTETS_PER_LINE;
+
 		if (!mod) {
-			if (i)
-				spectral_debug("  %s\n", ascii);
+			if (i) {
+				qdf_assert_always(loc < sizeof(hexdump_line));
+				loc += snprintf(&hexdump_line[loc],
+						sizeof(hexdump_line) - loc,
+						"  %s", ascii);
+				spectral_debug("%s", hexdump_line);
+				qdf_mem_zero(hexdump_line,
+					     sizeof(hexdump_line));
+				loc = 0;
+			}
 		}
-		spectral_debug(" %02x", pc[i]);
+
+		qdf_assert_always(loc < sizeof(hexdump_line));
+		loc += snprintf(&hexdump_line[loc], sizeof(hexdump_line) - loc,
+				" %02x", pc[i]);
+
 		if ((pc[i] < 0x20) || (pc[i] > 0x7e))
 			ascii[mod] = '.';
 		else
 			ascii[mod] = pc[i];
 		ascii[(mod) + 1] = '\0';
 	}
-	while ((i % 16) != 0) {
-		spectral_debug("   ");
+
+	while ((i % SPECTRAL_HEXDUMP_NUM_OCTETS_PER_LINE) != 0) {
+		qdf_assert_always(loc < sizeof(hexdump_line));
+		loc += snprintf(&hexdump_line[loc], sizeof(hexdump_line) - loc,
+				"   ");
 		i++;
 	}
-	spectral_debug("  %s\n", ascii);
+
+	qdf_assert_always(loc < sizeof(hexdump_line));
+	snprintf(&hexdump_line[loc], sizeof(hexdump_line) - loc, "  %s", ascii);
+	spectral_debug("%s", hexdump_line);
 }
 
 /**
diff --git a/umac/cmn_services/mgmt_txrx/configs/ap_mgmt_txrx.config b/umac/cmn_services/mgmt_txrx/configs/ap_mgmt_txrx.config
new file mode 100644
index 000000000000..ce93ede94736
--- /dev/null
+++ b/umac/cmn_services/mgmt_txrx/configs/ap_mgmt_txrx.config
@@ -0,0 +1,7 @@
+ifeq ($(strip ${CONFIG_WIFI_IPQ_MEM_PROFILE}),256)
+EXTRA_CFLAGS += -DMGMT_DESC_POOL_MAX=256
+else ifeq ($(strip ${CONFIG_WIFI_IPQ_MEM_PROFILE}),512)
+EXTRA_CFLAGS += -DMGMT_DESC_POOL_MAX=384
+else
+EXTRA_CFLAGS += -DMGMT_DESC_POOL_MAX=512
+endif
diff --git a/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main.c b/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main.c
index 68b82def309e..54a4ef4ca080 100644
--- a/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main.c
+++ b/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main.c
@@ -127,6 +127,8 @@ struct mgmt_txrx_desc_elem_t *wlan_mgmt_txrx_desc_get(
 	/* acquire the wakelock when there are pending mgmt tx frames */
 	qdf_wake_lock_timeout_acquire(&mgmt_txrx_pdev_ctx->wakelock_tx_cmp,
 				      MGMT_TXRX_WAKELOCK_TIMEOUT_TX_CMP);
+	qdf_runtime_pm_prevent_suspend(
+		&mgmt_txrx_pdev_ctx->wakelock_tx_runtime_cmp);
 
 	qdf_spin_unlock_bh(&mgmt_txrx_pdev_ctx->mgmt_desc_pool.desc_pool_lock);
 
@@ -160,9 +162,12 @@ void wlan_mgmt_txrx_desc_put(
 
 	/* release the wakelock if there are no pending mgmt tx frames */
 	if (mgmt_txrx_pdev_ctx->mgmt_desc_pool.free_list.count ==
-	    mgmt_txrx_pdev_ctx->mgmt_desc_pool.free_list.max_size)
+	    mgmt_txrx_pdev_ctx->mgmt_desc_pool.free_list.max_size) {
+		qdf_runtime_pm_allow_suspend(
+			&mgmt_txrx_pdev_ctx->wakelock_tx_runtime_cmp);
 		qdf_wake_lock_release(&mgmt_txrx_pdev_ctx->wakelock_tx_cmp,
 				      MGMT_TXRX_WAKELOCK_REASON_TX_CMP);
+	}
 
 	qdf_spin_unlock_bh(&mgmt_txrx_pdev_ctx->mgmt_desc_pool.desc_pool_lock);
 
diff --git a/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main_i.h b/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main_i.h
index cdaa897233fd..8aea6aff8eb8 100644
--- a/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main_i.h
+++ b/umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main_i.h
@@ -186,12 +186,14 @@ struct mgmt_txrx_priv_psoc_context {
  * @mgmt_desc_pool:   pointer to mgmt desc. pool
  * @mgmt_txrx_stats:  pointer to mgmt txrx stats
  * @wakelock_tx_cmp:  mgmt tx complete wake lock
+ * @wakelock_tx_runtime_cmp: mgmt tx runtime complete wake lock
  */
 struct mgmt_txrx_priv_pdev_context {
 	struct wlan_objmgr_pdev *pdev;
 	struct mgmt_desc_pool_t mgmt_desc_pool;
 	struct mgmt_txrx_stats_t *mgmt_txrx_stats;
 	qdf_wake_lock_t wakelock_tx_cmp;
+	qdf_runtime_lock_t wakelock_tx_runtime_cmp;
 };
 
 
diff --git a/umac/cmn_services/mgmt_txrx/dispatcher/inc/wlan_mgmt_txrx_utils_api.h b/umac/cmn_services/mgmt_txrx/dispatcher/inc/wlan_mgmt_txrx_utils_api.h
index 8737a01ce3d6..622a263e8fce 100644
--- a/umac/cmn_services/mgmt_txrx/dispatcher/inc/wlan_mgmt_txrx_utils_api.h
+++ b/umac/cmn_services/mgmt_txrx/dispatcher/inc/wlan_mgmt_txrx_utils_api.h
@@ -30,18 +30,6 @@
 #include "wlan_objmgr_cmn.h"
 #include "qdf_nbuf.h"
 
-#ifdef CONFIG_MCL
-#define MGMT_DESC_POOL_MAX 64
-#else
-#ifdef QCA_LOWMEM_CONFIG
-#define MGMT_DESC_POOL_MAX 256
-#elif defined QCA_512M_CONFIG
-#define MGMT_DESC_POOL_MAX 384
-#else
-#define MGMT_DESC_POOL_MAX 512
-#endif
-#endif
-
 #define mgmt_txrx_alert(params...) \
 	QDF_TRACE_FATAL(QDF_MODULE_ID_MGMT_TXRX, params)
 #define mgmt_txrx_err(params...) \
diff --git a/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_utils_api.c b/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_utils_api.c
index e3e2edfb7a55..4e5b493dd09d 100644
--- a/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_utils_api.c
+++ b/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_utils_api.c
@@ -184,6 +184,7 @@ static QDF_STATUS wlan_mgmt_txrx_pdev_obj_create_notification(
 
 	qdf_wake_lock_create(&mgmt_txrx_pdev_ctx->wakelock_tx_cmp,
 			     "mgmt_txrx tx_cmp");
+	qdf_runtime_lock_init(&mgmt_txrx_pdev_ctx->wakelock_tx_runtime_cmp);
 
 	if (wlan_objmgr_pdev_component_obj_attach(pdev,
 			WLAN_UMAC_COMP_MGMT_TXRX,
@@ -201,6 +202,7 @@ static QDF_STATUS wlan_mgmt_txrx_pdev_obj_create_notification(
 	return QDF_STATUS_SUCCESS;
 
 err_pdev_attach:
+	qdf_runtime_lock_deinit(&mgmt_txrx_pdev_ctx->wakelock_tx_runtime_cmp);
 	qdf_wake_lock_destroy(&mgmt_txrx_pdev_ctx->wakelock_tx_cmp);
 	qdf_mem_free(mgmt_txrx_stats);
 err_mgmt_txrx_stats:
@@ -251,6 +253,7 @@ static QDF_STATUS wlan_mgmt_txrx_pdev_obj_destroy_notification(
 
 	wlan_mgmt_txrx_desc_pool_deinit(mgmt_txrx_pdev_ctx);
 	qdf_mem_free(mgmt_txrx_pdev_ctx->mgmt_txrx_stats);
+	qdf_runtime_lock_deinit(&mgmt_txrx_pdev_ctx->wakelock_tx_runtime_cmp);
 	qdf_wake_lock_destroy(&mgmt_txrx_pdev_ctx->wakelock_tx_cmp);
 	qdf_mem_free(mgmt_txrx_pdev_ctx);
 
diff --git a/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c b/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c
index ca85ca149e8b..8c629782835c 100644
--- a/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c
+++ b/umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c
@@ -156,6 +156,7 @@ QDF_STATUS ucfg_mc_cp_stats_inc_wake_lock_stats_by_protocol(
 	vdev_mc_stats = vdev_cp_stats_priv->vdev_stats;
 	stats = &vdev_mc_stats->wow_stats;
 	switch (protocol) {
+	case QDF_PROTO_ICMP_REQ:
 	case QDF_PROTO_ICMP_RES:
 		stats->icmpv4_count++;
 		break;
diff --git a/umac/dfs/core/src/misc/dfs_process_radar_found_ind.c b/umac/dfs/core/src/misc/dfs_process_radar_found_ind.c
index 80ecc784dc80..4c3612279ad9 100644
--- a/umac/dfs/core/src/misc/dfs_process_radar_found_ind.c
+++ b/umac/dfs/core/src/misc/dfs_process_radar_found_ind.c
@@ -858,20 +858,20 @@ QDF_STATUS dfs_process_radar_ind(struct wlan_dfs *dfs,
 		  dfs->is_radar_found_on_secondary_seg,
 		  dfs_is_precac_timer_running(dfs));
 	/*
-	 * Even if radar found on primary, we need to move the channel
-	 * from precac-required-list and precac-done-list to
-	 * precac-nol-list.
+	 * Even if radar found on primary, we need to mark the channel as NOL
+	 * in preCAC list. The preCAC list also maintains the current CAC
+	 * channels as part of pre-cleared DFS. Hence call the API
+	 * to mark channels as NOL irrespective of preCAC being enabled or not.
 	 */
 
-	if (dfs->dfs_precac_enable || dfs->dfs_agile_precac_enable) {
-		dfs_debug(dfs, WLAN_DEBUG_DFS,
-			  "%s: %d Radar found on dfs detector:%d",
-			  __func__, __LINE__, radar_found->detector_id);
-		dfs_mark_precac_nol(dfs,
-				    dfs->is_radar_found_on_secondary_seg,
-				    radar_found->detector_id, channels,
-				    num_channels);
-	}
+	dfs_debug(dfs, WLAN_DEBUG_DFS,
+		  "%s: %d Radar found on dfs detector:%d",
+		  __func__, __LINE__, radar_found->detector_id);
+	dfs_mark_precac_nol(dfs,
+			    dfs->is_radar_found_on_secondary_seg,
+			    radar_found->detector_id,
+			    channels,
+			    num_channels);
 
 	if (utils_get_dfsdomain(dfs->dfs_pdev_obj) == DFS_ETSI_DOMAIN) {
 		/* Remove chan from ETSI Pre-CAC Cleared List*/
diff --git a/umac/mlme/include/wlan_vdev_mlme.h b/umac/mlme/include/wlan_vdev_mlme.h
index d18466dbea35..12d0017b58c3 100644
--- a/umac/mlme/include/wlan_vdev_mlme.h
+++ b/umac/mlme/include/wlan_vdev_mlme.h
@@ -35,6 +35,9 @@ struct vdev_mlme_obj;
 #define WLAN_VDEV_MLME_TYPE_STA  0x2
 #define WLAN_VDEV_MLME_TYPE_IBSS 0x3
 #define WLAN_VDEV_MLME_TYPE_MONITOR 0x4
+#define WLAN_VDEV_MLME_TYPE_NAN 0x5
+#define WLAN_VDEV_MLME_TYPE_OCB 0x6
+#define WLAN_VDEV_MLME_TYPE_NDI 0x7
 
 /* values for vdev_subtype */
 #define WLAN_VDEV_MLME_SUBTYPE_P2P_DEVICE 0x1
diff --git a/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.c b/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.c
index 70404a156791..493a73f4eaac 100644
--- a/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.c
+++ b/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.c
@@ -34,6 +34,7 @@
 #include <wlan_dfs_tgt_api.h>
 #include <wlan_dfs_utils_api.h>
 #include <wlan_vdev_mgr_ucfg_api.h>
+#include <qdf_module.h>
 
 static QDF_STATUS vdev_mgr_create_param_update(
 					struct vdev_mlme_obj *mlme_obj,
diff --git a/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.h b/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.h
index 06ba4193b97c..df683dc63f05 100644
--- a/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.h
+++ b/umac/mlme/vdev_mgr/core/src/vdev_mgr_ops.h
@@ -223,11 +223,11 @@ QDF_STATUS vdev_mgr_bcn_miss_offload_send(struct vdev_mlme_obj *mlme_obj);
  *
  * Return: QDF_STATUS - Success or Failure
  */
-QDF_STATUS vdev_mlme_multiple_restart_send(struct wlan_objmgr_pdev *pdev,
-					   struct mlme_channel_param *chan,
-					   uint32_t disable_hw_ack,
-					   uint32_t *vdev_ids,
-					   uint32_t num_vdevs);
+QDF_STATUS vdev_mgr_multiple_restart_send(struct wlan_objmgr_pdev *pdev,
+					  struct mlme_channel_param *chan,
+					  uint32_t disable_hw_ack,
+					  uint32_t *vdev_ids,
+					  uint32_t num_vdevs);
 
 /**
  * vdev_mgr_peer_delete_all_send() – MLME API to send peer delete all request
diff --git a/umac/mlme/vdev_mgr/dispatcher/inc/wlan_vdev_mgr_tgt_if_rx_api.h b/umac/mlme/vdev_mgr/dispatcher/inc/wlan_vdev_mgr_tgt_if_rx_api.h
index b8b650566f50..92669e53efcf 100644
--- a/umac/mlme/vdev_mgr/dispatcher/inc/wlan_vdev_mgr_tgt_if_rx_api.h
+++ b/umac/mlme/vdev_mgr/dispatcher/inc/wlan_vdev_mgr_tgt_if_rx_api.h
@@ -30,15 +30,27 @@
 #include <wlan_vdev_mgr_tgt_if_rx_defs.h>
 
 /**
- * tgt_vdev_mgr_register_rx_ops(): API to register rx ops with lmac
+ * tgt_vdev_mgr_register_rx_ops() - API to register rx ops with lmac
  * @rx_ops: rx ops struct
  *
  * Return: none
  */
 void tgt_vdev_mgr_register_rx_ops(struct wlan_lmac_if_rx_ops *rx_ops);
+
+/**
+ * tgt_vdev_mgr_ext_tbttoffset_update_handle() - API to handle ext tbtt offset
+ * update event
+ * @num_vdevs: number of vdevs
+ * @is_ext: ext is set/reset
+ *
+ * Return: QDF_STATUS_SUCCESS on success, QDF_STATUS_E_** on error
+ */
+QDF_STATUS
+tgt_vdev_mgr_ext_tbttoffset_update_handle(uint32_t num_vdevs, bool is_ext);
+
 #else
 /**
- * tgt_vdev_mgr_register_rx_ops(): API to register rx ops with lmac
+ * tgt_vdev_mgr_register_rx_ops() - API to register rx ops with lmac
  * @rx_ops: rx ops struct
  *
  * Return: none
diff --git a/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_tgt_if_rx_api.c b/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_tgt_if_rx_api.c
index 6dfba4e5bebf..674c16022740 100644
--- a/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_tgt_if_rx_api.c
+++ b/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_tgt_if_rx_api.c
@@ -208,7 +208,7 @@ tgt_vdev_mgr_tbttoffset_update_handler(uint32_t num_vdevs, bool is_ext)
 	return status;
 }
 
-static QDF_STATUS
+QDF_STATUS
 tgt_vdev_mgr_ext_tbttoffset_update_handle(uint32_t num_vdevs, bool is_ext)
 {
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
diff --git a/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_ucfg_api.c b/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_ucfg_api.c
index 779755df8178..6582f3cc7e70 100644
--- a/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_ucfg_api.c
+++ b/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_ucfg_api.c
@@ -28,6 +28,7 @@
 #include <wlan_mlme_dbg.h>
 #include <wlan_vdev_mgr_utils_api.h>
 #include <wlan_vdev_mlme_api.h>
+#include <qdf_module.h>
 
 void ucfg_wlan_vdev_mgr_get_param_bssid(
 				struct wlan_objmgr_vdev *vdev,
diff --git a/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_utils_api.c b/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_utils_api.c
index 87f89e8e8642..192c6ad07be2 100644
--- a/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_utils_api.c
+++ b/umac/mlme/vdev_mgr/dispatcher/src/wlan_vdev_mgr_utils_api.c
@@ -26,6 +26,7 @@
 #include <wlan_vdev_mgr_tgt_if_tx_api.h>
 #include <cdp_txrx_cmn_struct.h>
 #include <wlan_mlme_dbg.h>
+#include <qdf_module.h>
 
 static QDF_STATUS vdev_mgr_config_ratemask_update(
 				struct vdev_mlme_obj *mlme_obj,
@@ -60,6 +61,24 @@ wlan_util_vdev_get_cdp_txrx_opmode(struct wlan_objmgr_vdev *vdev)
 	case QDF_MONITOR_MODE:
 		cdp_txrx_opmode = wlan_op_mode_monitor;
 		break;
+	case QDF_P2P_DEVICE_MODE:
+		cdp_txrx_opmode = wlan_op_mode_ap;
+		break;
+	case QDF_P2P_CLIENT_MODE:
+		cdp_txrx_opmode = wlan_op_mode_sta;
+		break;
+	case QDF_P2P_GO_MODE:
+		cdp_txrx_opmode = wlan_op_mode_ap;
+		break;
+	case QDF_OCB_MODE:
+		cdp_txrx_opmode = wlan_op_mode_ocb;
+		break;
+	case QDF_IBSS_MODE:
+		cdp_txrx_opmode = wlan_op_mode_ibss;
+		break;
+	case QDF_NDI_MODE:
+		cdp_txrx_opmode = wlan_op_mode_ndi;
+		break;
 	default:
 		cdp_txrx_opmode = wlan_op_mode_unknown;
 	};
diff --git a/wmi/inc/wmi_unified_param.h b/wmi/inc/wmi_unified_param.h
index 2d23dfdd3bd3..b2b10bbf03e1 100644
--- a/wmi/inc/wmi_unified_param.h
+++ b/wmi/inc/wmi_unified_param.h
@@ -5023,6 +5023,7 @@ typedef enum {
 	wmi_pdev_param_set_mu_ppdu_duration,
 	wmi_pdev_param_set_tbtt_ctrl,
 	wmi_pdev_param_set_cmd_obss_pd_threshold,
+	wmi_pdev_param_set_cmd_obss_pd_per_ac,
 	wmi_pdev_param_max,
 } wmi_conv_pdev_params_id;
 
@@ -5348,6 +5349,7 @@ typedef enum {
 	wmi_service_data_stall_recovery_support,
 	wmi_service_tx_compl_tsf64,
 	wmi_service_vdev_delete_all_peer,
+	wmi_service_three_way_coex_config_legacy,
 	wmi_services_max,
 } wmi_conv_service_ids;
 #define WMI_SERVICE_UNAVAILABLE 0xFFFF
@@ -5469,6 +5471,7 @@ struct wmi_host_fw_abi_ver {
  * @twt_ap_sta_count: Max no of STA with which TWT sessions can be formed
  *                    by the AP
  * @max_bssid_indicator: max number of MBSS VAPs
+ * @three_way_coex_config_legacy_en: enable three way coex legacy feature
  */
 typedef struct {
 	uint32_t num_vdevs;
@@ -5551,6 +5554,7 @@ typedef struct {
 	uint32_t eapol_minrate_set:1,
 		 eapol_minrate_ac_set:2;
 	bool tstamp64_en;
+	bool three_way_coex_config_legacy_en;
 } target_resource_config;
 
 /**
diff --git a/wmi/src/wmi_unified_api.c b/wmi/src/wmi_unified_api.c
index 860032db85f0..899567ca36d5 100644
--- a/wmi/src/wmi_unified_api.c
+++ b/wmi/src/wmi_unified_api.c
@@ -20,6 +20,7 @@
 #include "wmi_unified_param.h"
 #include "qdf_module.h"
 #include "cdp_txrx_cmn_struct.h"
+#include <wmi_unified_vdev_api.h>
 
 static const wmi_host_channel_width mode_to_width[WMI_HOST_MODE_MAX] = {
 	[WMI_HOST_MODE_11A]           = WMI_HOST_CHAN_WIDTH_20,
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c
index 6fe44ecef3c9..5e0e05395b57 100644
--- a/wmi/src/wmi_unified_tlv.c
+++ b/wmi/src/wmi_unified_tlv.c
@@ -60,6 +60,7 @@
 #ifdef WMI_AP_SUPPORT
 #include "wmi_unified_ap_api.h"
 #endif
+#include <wmi_unified_vdev_api.h>
 
 /* HTC service ids for WMI for multi-radio */
 static const uint32_t multi_svc_ids[] = {WMI_CONTROL_SVC,
@@ -316,6 +317,8 @@ static const uint32_t pdev_param_tlv[] = {
 			WMI_PDEV_PARAM_SET_TBTT_CTRL,
 	[wmi_pdev_param_set_cmd_obss_pd_threshold] =
 			WMI_PDEV_PARAM_SET_CMD_OBSS_PD_THRESHOLD,
+	[wmi_pdev_param_set_cmd_obss_pd_per_ac] =
+			WMI_PDEV_PARAM_SET_CMD_OBSS_PD_PER_AC,
 };
 
 /**
@@ -6501,6 +6504,10 @@ void wmi_copy_resource_config(wmi_resource_config *resource_cfg,
 		WMI_RSRC_CFG_FLAG_TX_COMPLETION_TX_TSF64_ENABLE_SET(
 						resource_cfg->flag1, 1);
 
+	if (tgt_res_cfg->three_way_coex_config_legacy_en)
+		WMI_RSRC_CFG_FLAG_THREE_WAY_COEX_CONFIG_LEGACY_SUPPORT_SET(
+						resource_cfg->flag1, 1);
+
 	wmi_copy_twt_resource_config(resource_cfg, tgt_res_cfg);
 	resource_cfg->peer_map_unmap_v2_support =
 		tgt_res_cfg->peer_map_unmap_v2;
@@ -11938,6 +11945,9 @@ struct wmi_ops tlv_ops =  {
 #ifdef WLAN_MWS_INFO_DEBUGFS
 	.send_mws_coex_status_req_cmd = send_mws_coex_status_req_cmd_tlv,
 #endif
+#ifdef TGT_IF_VDEV_MGR_CONV
+	.extract_vdev_delete_resp = extract_vdev_delete_resp_tlv,
+#endif
 };
 
 /**
@@ -12540,6 +12550,8 @@ static void populate_tlv_service(uint32_t *wmi_service)
 			WMI_SERVICE_DSM_ROAM_FILTER;
 	wmi_service[wmi_service_vdev_delete_all_peer] =
 			WMI_SERVICE_DELETE_ALL_PEER_SUPPORT;
+	wmi_service[wmi_service_three_way_coex_config_legacy] =
+			WMI_SERVICE_THREE_WAY_COEX_CONFIG_LEGACY;
 }
 
 /**