diff --git a/drivers/staging/qca-wifi-host-cmn/dp/inc/cdp_txrx_cmn_struct.h b/drivers/staging/qca-wifi-host-cmn/dp/inc/cdp_txrx_cmn_struct.h
index 3313ee325a95..2950d9077021 100644
--- a/drivers/staging/qca-wifi-host-cmn/dp/inc/cdp_txrx_cmn_struct.h
+++ b/drivers/staging/qca-wifi-host-cmn/dp/inc/cdp_txrx_cmn_struct.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2011-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -2333,6 +2333,7 @@ struct cdp_monitor_filter {
  * @cfg_dp_tso_enable: get TSO enable config
  * @cfg_dp_lro_enable: get LRO enable config
  * @cfg_dp_gro_enable: get GRP enable config
+ * @cfg_dp_force_gro_enable: get Force GRP enable config
  * @cfg_dp_tx_flow_start_queue_offset: get DP TX flow start queue offset
  * @cfg_dp_tx_flow_stop_queue_threshold: get DP TX flow stop queue threshold
  * @cfg_dp_ipa_uc_tx_buf_size: get IPA TX buf size config
@@ -2355,6 +2356,7 @@ enum cdp_dp_cfg {
 	cfg_dp_tso_enable,
 	cfg_dp_lro_enable,
 	cfg_dp_gro_enable,
+	cfg_dp_force_gro_enable,
 	cfg_dp_tx_flow_start_queue_offset,
 	cfg_dp_tx_flow_stop_queue_threshold,
 	cfg_dp_ipa_uc_tx_buf_size,
diff --git a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.c b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.c
index bd34e19662a0..a74194383be7 100644
--- a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.c
+++ b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -701,7 +702,7 @@ int dp_ipa_ring_resource_setup(struct dp_soc *soc,
 	 * Set DEST_RING_MAPPING_4 to SW2 as default value for
 	 * DESTINATION_RING_CTRL_IX_0.
 	 */
-	ix0 = HAL_REO_REMAP_IX0(REO_REMAP_TCL, 0) |
+	ix0 = HAL_REO_REMAP_IX0(REO_REMAP_SW1, 0) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW1, 1) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW2, 2) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW3, 3) |
@@ -988,7 +989,7 @@ QDF_STATUS dp_ipa_enable_autonomy(struct cdp_soc_t *soc_hdl, uint8_t pdev_id)
 		return QDF_STATUS_E_AGAIN;
 
 	/* Call HAL API to remap REO rings to REO2IPA ring */
-	ix0 = HAL_REO_REMAP_IX0(REO_REMAP_TCL, 0) |
+	ix0 = HAL_REO_REMAP_IX0(REO_REMAP_SW1, 0) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW4, 1) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW1, 2) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW4, 3) |
@@ -1025,6 +1026,7 @@ QDF_STATUS dp_ipa_disable_autonomy(struct cdp_soc_t *soc_hdl, uint8_t pdev_id)
 	struct dp_pdev *pdev =
 		dp_get_pdev_from_soc_pdev_id_wifi3(soc, pdev_id);
 	uint32_t ix0;
+	uint32_t ix1;
 	uint32_t ix2;
 	uint32_t ix3;
 
@@ -1040,7 +1042,7 @@ QDF_STATUS dp_ipa_disable_autonomy(struct cdp_soc_t *soc_hdl, uint8_t pdev_id)
 		return QDF_STATUS_E_AGAIN;
 
 	/* Call HAL API to remap REO rings to REO2IPA ring */
-	ix0 = HAL_REO_REMAP_IX0(REO_REMAP_TCL, 0) |
+	ix0 = HAL_REO_REMAP_IX0(REO_REMAP_SW1, 0) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW1, 1) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW2, 2) |
 	      HAL_REO_REMAP_IX0(REO_REMAP_SW3, 3) |
@@ -1050,7 +1052,7 @@ QDF_STATUS dp_ipa_disable_autonomy(struct cdp_soc_t *soc_hdl, uint8_t pdev_id)
 	      HAL_REO_REMAP_IX0(REO_REMAP_FW, 7);
 
 	if (wlan_cfg_is_rx_hash_enabled(soc->wlan_cfg_ctx)) {
-		dp_reo_remap_config(soc, &ix2, &ix3);
+		dp_reo_remap_config(soc, &ix1, &ix2, &ix3);
 
 		hal_reo_read_write_ctrl_ix(soc->hal_soc, false, &ix0, NULL,
 					   &ix2, &ix3);
diff --git a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.h b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.h
index aba3bc176c78..71769469ca9c 100644
--- a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.h
+++ b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_ipa.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -255,7 +256,7 @@ QDF_STATUS dp_ipa_handle_rx_buf_smmu_mapping(struct dp_soc *soc,
 					     uint32_t size,
 					     bool create);
 
-bool dp_reo_remap_config(struct dp_soc *soc, uint32_t *remap1,
+bool dp_reo_remap_config(struct dp_soc *soc,uint32_t *remap0, uint32_t *remap1,
 			 uint32_t *remap2);
 bool dp_ipa_is_mdm_platform(void);
 
diff --git a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_main.c b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_main.c
index 2ec38f9eb9ae..12b27e5bb9f2 100644
--- a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_main.c
+++ b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_main.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -3398,12 +3399,14 @@ static void dp_soc_reset_intr_mask(struct dp_soc *soc)
  * @remap2: output parameter indicates reo remap 2 register value
  * Return: bool type, true if remap is configured else false.
  */
-bool dp_reo_remap_config(struct dp_soc *soc, uint32_t *remap1, uint32_t *remap2)
+bool dp_reo_remap_config(struct dp_soc *soc, uint32_t *remap0,
+			 uint32_t *remap1, uint32_t *remap2)
 {
 	uint32_t ring[4] = {REO_REMAP_SW1, REO_REMAP_SW2,
 						REO_REMAP_SW3};
 	hal_compute_reo_remap_ix2_ix3(soc->hal_soc, ring,
 				      3, remap1, remap2);
+	hal_compute_reo_remap_ix0(soc->hal_soc, remap0);
 	dp_debug("remap1 %x remap2 %x", *remap1, *remap2);
 
 	return true;
@@ -3529,7 +3532,7 @@ static uint8_t dp_reo_ring_selection(uint32_t value, uint32_t *ring)
 	return num;
 }
 
-static bool dp_reo_remap_config(struct dp_soc *soc,
+static bool dp_reo_remap_config(struct dp_soc *soc, uint32_t *remap0,
 				uint32_t *remap1,
 				uint32_t *remap2)
 {
@@ -3547,6 +3550,7 @@ static bool dp_reo_remap_config(struct dp_soc *soc,
 		num = dp_reo_ring_selection(value, ring);
 		hal_compute_reo_remap_ix2_ix3(soc->hal_soc, ring,
 					      num, remap1, remap2);
+		hal_compute_reo_remap_ix0(soc->hal_soc, remap0);
 
 		break;
 	case dp_nss_cfg_first_radio:
@@ -11089,6 +11093,9 @@ static uint32_t dp_get_cfg(struct cdp_soc_t *soc, enum cdp_dp_cfg cfg)
 	case cfg_dp_gro_enable:
 		value = dpsoc->wlan_cfg_ctx->gro_enabled;
 		break;
+	case cfg_dp_force_gro_enable:
+		value = dpsoc->wlan_cfg_ctx->force_gro_enabled;
+		break;
 	case cfg_dp_tx_flow_start_queue_offset:
 		value = dpsoc->wlan_cfg_ctx->tx_flow_start_queue_offset;
 		break;
@@ -12537,6 +12544,7 @@ void *dp_soc_init(struct dp_soc *soc, HTC_HANDLE htc_handle,
 		 * are offloaded to NSS
 		 */
 		if (dp_reo_remap_config(soc,
+					&reo_params.remap0,
 					&reo_params.remap1,
 					&reo_params.remap2))
 			reo_params.rx_hash_enabled = true;
diff --git a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_peer.c b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_peer.c
index f8014bfb8997..1da11b1e418f 100644
--- a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_peer.c
+++ b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_peer.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -3529,9 +3530,7 @@ int dp_addba_requestprocess_wifi3(struct cdp_soc_t *cdp_soc,
 
 		buffersize = rx_tid->rx_ba_win_size_override;
 	} else {
-		QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_INFO,
-			  "%s restore BA win %d based on addba req",
-			    __func__, buffersize);
+		dp_info("restore BA win %d based on addba req", buffersize);
 	}
 
 	dp_check_ba_buffersize(peer, tid, buffersize);
diff --git a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_stats.c b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_stats.c
index 979b23b7e6f9..b3453fe4a2da 100644
--- a/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_stats.c
+++ b/drivers/staging/qca-wifi-host-cmn/dp/wifi3.0/dp_stats.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -4916,6 +4917,8 @@ void dp_print_soc_cfg_params(struct dp_soc *soc)
 		       soc_cfg_ctx->sg_enabled);
 	DP_PRINT_STATS("Gro enabled: %u ",
 		       soc_cfg_ctx->gro_enabled);
+	DP_PRINT_STATS("Force Gro enabled: %u ",
+		       soc_cfg_ctx->force_gro_enabled);
 	DP_PRINT_STATS("rawmode enabled: %u ",
 		       soc_cfg_ctx->rawmode_enabled);
 	DP_PRINT_STATS("peer flow ctrl enabled: %u ",
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_api.h b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_api.h
index a07ffc269803..691b2328defc 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_api.h
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_api.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -2417,6 +2418,15 @@ void hal_compute_reo_remap_ix2_ix3(hal_soc_handle_t hal_soc_hdl,
 					num_rings, remap1, remap2);
 }
 
+static inline
+void hal_compute_reo_remap_ix0(hal_soc_handle_t hal_soc_hdl, uint32_t *remap0)
+{
+	struct hal_soc *hal_soc = (struct hal_soc *)hal_soc_hdl;
+
+	if (hal_soc->ops->hal_compute_reo_remap_ix0)
+		hal_soc->ops->hal_compute_reo_remap_ix0(remap0);
+}
+
 /**
  * hal_setup_link_idle_list - Setup scattered idle list using the
  * buffer list provided
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_generic_api.h b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_generic_api.h
index 159bb076fa2f..2ecaaa06c8a1 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_generic_api.h
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_generic_api.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1700,6 +1701,17 @@ static void hal_reo_setup_generic(struct hal_soc *soc,
 	 * 7: NOT_USED.
 	*/
 	if (reo_params->rx_hash_enabled) {
+		if (reo_params->remap0)
+			HAL_REG_WRITE(soc,
+				      HWIO_REO_R0_DESTINATION_RING_CTRL_IX_0_ADDR(
+				      SEQ_WCSS_UMAC_REO_REG_OFFSET),
+				      reo_params->remap0);
+
+		hal_debug("HWIO_REO_R0_DESTINATION_RING_CTRL_IX_0_ADDR 0x%x",
+			HAL_REG_READ(soc,
+				     HWIO_REO_R0_DESTINATION_RING_CTRL_IX_0_ADDR(
+				     SEQ_WCSS_UMAC_REO_REG_OFFSET)));
+
 		HAL_REG_WRITE(soc,
 			HWIO_REO_R0_DESTINATION_RING_CTRL_IX_2_ADDR(
 			SEQ_WCSS_UMAC_REO_REG_OFFSET),
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_internal.h b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_internal.h
index e1aec3aa0d18..c1e9db008a94 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_internal.h
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/hal_internal.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -508,6 +509,8 @@ struct shadow_reg_config {
 struct hal_reo_params {
 	/** rx hash steering enabled or disabled */
 	bool rx_hash_enabled;
+	/** reo remap 0 register */
+	uint32_t remap0;
 	/** reo remap 1 register */
 	uint32_t remap1;
 	/** reo remap 2 register */
@@ -675,6 +678,7 @@ struct hal_hw_txrx_ops {
 					      uint32_t num_rings,
 					      uint32_t *remap1,
 					      uint32_t *remap2);
+	void (*hal_compute_reo_remap_ix0)(uint32_t *remap0);
 	uint32_t (*hal_rx_flow_setup_cmem_fse)(
 				struct hal_soc *soc, uint32_t cmem_ba,
 				uint32_t table_offset, uint8_t *rx_flow);
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca5018/hal_5018.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca5018/hal_5018.c
index 73e1957b846d..eb0d46c77fe6 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca5018/hal_5018.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca5018/hal_5018.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1771,6 +1772,7 @@ struct hal_hw_txrx_ops qca5018_hal_hw_txrx_ops = {
 	NULL,
 	NULL,
 	NULL,
+	NULL,
 	NULL
 };
 
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6290/hal_6290.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6290/hal_6290.c
index a33b2d7fa564..5cfaf197c077 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6290/hal_6290.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6290/hal_6290.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1152,6 +1153,7 @@ struct hal_hw_txrx_ops qca6290_hal_hw_txrx_ops = {
 	NULL,
 	NULL,
 	NULL,
+	NULL,
 	NULL
 };
 
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6390/hal_6390.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6390/hal_6390.c
index c1696e8ca9cf..dc91de82b9fb 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6390/hal_6390.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6390/hal_6390.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1090,6 +1091,19 @@ void hal_compute_reo_remap_ix2_ix3_6390(uint32_t *ring, uint32_t num_rings,
 	}
 }
 
+static
+void hal_compute_reo_remap_ix0_6390(uint32_t *remap0)
+{
+	*remap0 = HAL_REO_REMAP_IX0(REO_REMAP_SW1, 0) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW1, 1) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW2, 2) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW3, 3) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW2, 4) |
+			HAL_REO_REMAP_IX0(REO_REMAP_RELEASE, 5) |
+			HAL_REO_REMAP_IX0(REO_REMAP_FW, 6) |
+			HAL_REO_REMAP_IX0(REO_REMAP_FW, 7);
+}
+
 struct hal_hw_txrx_ops qca6390_hal_hw_txrx_ops = {
 	/* init and setup */
 	hal_srng_dst_hw_init_generic,
@@ -1202,6 +1216,7 @@ struct hal_hw_txrx_ops qca6390_hal_hw_txrx_ops = {
 	hal_rx_mpdu_end_offset_get_generic,
 	NULL,
 	hal_compute_reo_remap_ix2_ix3_6390,
+	hal_compute_reo_remap_ix0_6390,
 	NULL,
 	NULL,
 	NULL,
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6490/hal_6490.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6490/hal_6490.c
index 00d2a7a2f34b..6041255976fa 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6490/hal_6490.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6490/hal_6490.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2019-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1666,6 +1667,19 @@ void hal_compute_reo_remap_ix2_ix3_6490(uint32_t *ring, uint32_t num_rings,
 	}
 }
 
+static
+void hal_compute_reo_remap_ix0_6490(uint32_t *remap0)
+{
+	*remap0 = HAL_REO_REMAP_IX0(REO_REMAP_SW1, 0) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW1, 1) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW2, 2) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW3, 3) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW2, 4) |
+			HAL_REO_REMAP_IX0(REO_REMAP_RELEASE, 5) |
+			HAL_REO_REMAP_IX0(REO_REMAP_FW, 6) |
+			HAL_REO_REMAP_IX0(REO_REMAP_FW, 7);
+}
+
 struct hal_hw_txrx_ops qca6490_hal_hw_txrx_ops = {
 	/* init and setup */
 	hal_srng_dst_hw_init_generic,
@@ -1784,6 +1798,7 @@ struct hal_hw_txrx_ops qca6490_hal_hw_txrx_ops = {
 	hal_rx_mpdu_end_offset_get_generic,
 	hal_rx_flow_setup_fse_6490,
 	hal_compute_reo_remap_ix2_ix3_6490,
+	hal_compute_reo_remap_ix0_6490,
 	NULL,
 	NULL,
 	NULL,
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6750/hal_6750.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6750/hal_6750.c
index 2706a080ec7b..06503a1ac392 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6750/hal_6750.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca6750/hal_6750.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1824,6 +1825,19 @@ void hal_compute_reo_remap_ix2_ix3_6750(uint32_t *ring, uint32_t num_rings,
 	}
 }
 
+static
+void hal_compute_reo_remap_ix0_6750(uint32_t *remap0)
+{
+	*remap0 = HAL_REO_REMAP_IX0(REO_REMAP_SW1, 0) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW1, 1) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW2, 2) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW3, 3) |
+			HAL_REO_REMAP_IX0(REO_REMAP_SW2, 4) |
+			HAL_REO_REMAP_IX0(REO_REMAP_RELEASE, 5) |
+			HAL_REO_REMAP_IX0(REO_REMAP_FW, 6) |
+			HAL_REO_REMAP_IX0(REO_REMAP_FW, 7);
+}
+
 struct hal_hw_txrx_ops qca6750_hal_hw_txrx_ops = {
 	/* init and setup */
 	hal_srng_dst_hw_init_generic,
@@ -1942,6 +1956,7 @@ struct hal_hw_txrx_ops qca6750_hal_hw_txrx_ops = {
 	hal_rx_mpdu_end_offset_get_generic,
 	hal_rx_flow_setup_fse_6750,
 	hal_compute_reo_remap_ix2_ix3_6750,
+	hal_compute_reo_remap_ix0_6750,
 
 	/* CMEM FSE */
 	hal_rx_flow_setup_cmem_fse_6750,
@@ -2227,7 +2242,11 @@ struct hal_hw_srng_config hw_srng_table_6750[] = {
 	},
 	{ /* WBM2SW_RELEASE */
 		.start_ring_id = HAL_SRNG_WBM2SW0_RELEASE,
+#ifdef CONFIG_PLD_IPCIE_FW_SIM
+		.max_rings = 5,
+#else
 		.max_rings = 4,
+#endif
 		.entry_size = sizeof(struct wbm_release_ring) >> 2,
 		.lmac_ring = FALSE,
 		.ring_dir = HAL_SRNG_DST_RING,
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v1/hal_8074v1.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v1/hal_8074v1.c
index 194f0d801070..1de3781a0d6d 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v1/hal_8074v1.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v1/hal_8074v1.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1328,6 +1329,7 @@ struct hal_hw_txrx_ops qca8074_hal_hw_txrx_ops = {
 	NULL,
 	NULL,
 	NULL,
+	NULL,
 	NULL
 };
 
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v2/hal_8074v2.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v2/hal_8074v2.c
index d361c0c641d6..7c92563a7772 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v2/hal_8074v2.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qca8074v2/hal_8074v2.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1331,6 +1332,7 @@ struct hal_hw_txrx_ops qca8074v2_hal_hw_txrx_ops = {
 	NULL,
 	NULL,
 	NULL,
+	NULL,
 	NULL
 };
 
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9000/hal_9000.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9000/hal_9000.c
index 025aca716c37..9d23118caa59 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9000/hal_9000.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9000/hal_9000.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1862,6 +1863,7 @@ struct hal_hw_txrx_ops qcn9000_hal_hw_txrx_ops = {
 	NULL,
 	NULL,
 	NULL,
+	NULL,
 	NULL
 };
 
diff --git a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9100/hal_qcn9100.c b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9100/hal_qcn9100.c
index 92693027ccda..c94699f296b8 100644
--- a/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9100/hal_qcn9100.c
+++ b/drivers/staging/qca-wifi-host-cmn/hal/wifi3.0/qcn9100/hal_qcn9100.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -1778,6 +1779,7 @@ struct hal_hw_txrx_ops qcn9100_hal_hw_txrx_ops = {
 	NULL,
 	NULL,
 	NULL,
+	NULL,
 	NULL
 };
 
diff --git a/drivers/staging/qca-wifi-host-cmn/hif/inc/hif.h b/drivers/staging/qca-wifi-host-cmn/hif/inc/hif.h
index e338ed73800c..41af54de528f 100644
--- a/drivers/staging/qca-wifi-host-cmn/hif/inc/hif.h
+++ b/drivers/staging/qca-wifi-host-cmn/hif/inc/hif.h
@@ -1657,36 +1657,6 @@ ssize_t hif_ce_en_desc_hist(struct hif_softc *scn,
 				const char *buf, size_t size);
 ssize_t hif_disp_ce_enable_desc_data_hist(struct hif_softc *scn, char *buf);
 ssize_t hif_dump_desc_event(struct hif_softc *scn, char *buf);
-/**
- * hif_ce_debug_history_prealloc_init() - alloc ce debug history memory
- *
- * alloc ce debug history memory with driver init, so such memory can
- * be existed even after stop module.
- * on ini value.
- *
- * Return: QDF_STATUS_SUCCESS for success, other for fail.
- */
-QDF_STATUS hif_ce_debug_history_prealloc_init(void);
-/**
- * hif_ce_debug_history_prealloc_deinit() - free ce debug history memory
- *
- * free ce debug history memory when driver deinit.
- *
- * Return: QDF_STATUS_SUCCESS for success, other for fail.
- */
-QDF_STATUS hif_ce_debug_history_prealloc_deinit(void);
-#else
-static inline
-QDF_STATUS hif_ce_debug_history_prealloc_init(void)
-{
-	return QDF_STATUS_SUCCESS;
-}
-
-static inline
-QDF_STATUS hif_ce_debug_history_prealloc_deinit(void)
-{
-	return QDF_STATUS_SUCCESS;
-}
 #endif/*#if defined(HIF_CONFIG_SLUB_DEBUG_ON)||defined(HIF_CE_DEBUG_DATA_BUF)*/
 
 /**
diff --git a/drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_main.c b/drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_main.c
index 1fc8bb03c7fe..9a8fc114bbdd 100644
--- a/drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_main.c
+++ b/drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_main.c
@@ -1453,71 +1453,41 @@ void free_mem_ce_debug_hist_data(struct hif_softc *scn, uint32_t ce_id)
 
 #ifndef HIF_CE_DEBUG_DATA_DYNAMIC_BUF
 #if defined(HIF_CONFIG_SLUB_DEBUG_ON) || defined(HIF_CE_DEBUG_DATA_BUF)
-struct hif_ce_desc_event *hif_ce_desc_history[CE_COUNT_MAX];
 
-/* define this variable for crashscope parse */
+/* define below variables for crashscope parse */
+struct hif_ce_desc_event *hif_ce_desc_history[CE_COUNT_MAX];
 uint32_t hif_ce_history_max = HIF_CE_HISTORY_MAX;
 
 /**
- * hif_ce_debug_only_enable_ce2_ce3() - if only enable ce2/ce3 debug
- * This is different config for perf/debug buid version.
  * for debug build, it will enable ce history for all ce, but for
  * perf build(if CONFIG_SLUB_DEBUG_ON is N), it only enable for
  * ce2(wmi event) & ce3(wmi cmd) history.
- *
- * Return: true if only enable ce2/ce3 debug, otherwise false.
  */
 #if defined(CONFIG_SLUB_DEBUG_ON)
-static inline bool hif_ce_debug_only_enable_ce2_ce3(void)
-{
-	return false;
-}
+#define CE_DESC_HISTORY_BUFF_CNT  CE_COUNT_MAX
+#define IS_CE_DEBUG_ONLY_FOR_CE2_CE3  FALSE
 #else
-static inline bool hif_ce_debug_only_enable_ce2_ce3(void)
-{
-	return true;
-}
+#define CE_DESC_HISTORY_BUFF_CNT  2
+#define IS_CE_DEBUG_ONLY_FOR_CE2_CE3  TRUE
 #endif
+struct hif_ce_desc_event
+	hif_ce_desc_history_buff[CE_DESC_HISTORY_BUFF_CNT][HIF_CE_HISTORY_MAX];
 
-QDF_STATUS hif_ce_debug_history_prealloc_deinit(void)
+static struct hif_ce_desc_event *
+	hif_ce_debug_history_buf_get(unsigned int ce_id)
 {
-	int ce_id;
-
-	for (ce_id = 0; ce_id < CE_COUNT_MAX; ce_id++) {
-		if (hif_ce_desc_history[ce_id]) {
-			qdf_mem_free(hif_ce_desc_history[ce_id]);
-			hif_ce_desc_history[ce_id] = NULL;
-		}
-	}
-	hif_debug("ce debug memory freed");
-
-	return QDF_STATUS_SUCCESS;
-}
-
-QDF_STATUS hif_ce_debug_history_prealloc_init(void)
-{
-	int ce_id;
-
-	hif_debug("alloc ce debug memory, only_ce2/ce3 %d",
-		  hif_ce_debug_only_enable_ce2_ce3());
-	for (ce_id = 0; ce_id < CE_COUNT_MAX; ce_id++) {
-		if (hif_ce_debug_only_enable_ce2_ce3() &&
-		    ce_id != CE_ID_2 &&
-		    ce_id != CE_ID_3) {
-			hif_ce_desc_history[ce_id] = NULL;
-			continue;
-		}
-
+	hif_debug("get ce debug buffer ce_id %u, only_ce2/ce3=%d",
+		  ce_id, IS_CE_DEBUG_ONLY_FOR_CE2_CE3);
+	if (IS_CE_DEBUG_ONLY_FOR_CE2_CE3 &&
+	    (ce_id == CE_ID_2 || ce_id == CE_ID_3)) {
 		hif_ce_desc_history[ce_id] =
-			qdf_mem_malloc(HIF_CE_HISTORY_MAX *
-				       sizeof(struct hif_ce_desc_event));
-		if (!hif_ce_desc_history[ce_id]) {
-			hif_ce_debug_history_prealloc_deinit();
-			return QDF_STATUS_E_NOMEM;
-		}
+			hif_ce_desc_history_buff[ce_id - CE_ID_2];
+	} else {
+		hif_ce_desc_history[ce_id] =
+			hif_ce_desc_history_buff[ce_id];
 	}
 
-	return QDF_STATUS_SUCCESS;
+	return hif_ce_desc_history[ce_id];
 }
 
 /**
@@ -1534,7 +1504,8 @@ alloc_mem_ce_debug_history(struct hif_softc *scn, unsigned int ce_id,
 	struct ce_desc_hist *ce_hist = &scn->hif_ce_desc_hist;
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 
-	if (hif_ce_debug_only_enable_ce2_ce3() &&
+	/* For perf build, return directly for non ce2/ce3 */
+	if (IS_CE_DEBUG_ONLY_FOR_CE2_CE3 &&
 	    ce_id != CE_ID_2 &&
 	    ce_id != CE_ID_3) {
 		ce_hist->enable[ce_id] = false;
@@ -1542,11 +1513,7 @@ alloc_mem_ce_debug_history(struct hif_softc *scn, unsigned int ce_id,
 		return QDF_STATUS_SUCCESS;
 	}
 
-	if (!hif_ce_desc_history[ce_id]) {
-		hif_err("prealloc memory failed");
-		return QDF_STATUS_E_NOMEM;
-	}
-	ce_hist->hist_ev[ce_id] = hif_ce_desc_history[ce_id];
+	ce_hist->hist_ev[ce_id] = hif_ce_debug_history_buf_get(ce_id);
 	ce_hist->enable[ce_id] = true;
 
 	if (src_nentries) {
diff --git a/drivers/staging/qca-wifi-host-cmn/hif/src/hif_main.c b/drivers/staging/qca-wifi-host-cmn/hif/src/hif_main.c
index 0bb16f7bb7a8..15f7d94eced3 100644
--- a/drivers/staging/qca-wifi-host-cmn/hif/src/hif_main.c
+++ b/drivers/staging/qca-wifi-host-cmn/hif/src/hif_main.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2015-2021 The Linux Foundation. All rights reserved.
- *
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all
@@ -1056,6 +1057,9 @@ QDF_STATUS hif_try_prevent_ep_vote_access(struct hif_opaque_softc *hif_ctx)
 		qdf_sleep(10);
 	}
 
+	if (pld_is_pci_ep_awake(scn->qdf_dev->dev) == -ENOTSUPP)
+		return QDF_STATUS_SUCCESS;
+
 	while (pld_is_pci_ep_awake(scn->qdf_dev->dev)) {
 		if (++wait_cnt > HIF_EP_WAKE_RESET_WAIT_CNT) {
 			hif_err("Release EP vote is not proceed by Fw");
diff --git a/drivers/staging/qca-wifi-host-cmn/os_if/linux/qca_vendor.h b/drivers/staging/qca-wifi-host-cmn/os_if/linux/qca_vendor.h
index 97309a331915..6bc43a97f3b6 100644
--- a/drivers/staging/qca-wifi-host-cmn/os_if/linux/qca_vendor.h
+++ b/drivers/staging/qca-wifi-host-cmn/os_if/linux/qca_vendor.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -4753,6 +4754,33 @@ enum qca_wlan_vendor_attr_config {
 	 * will update the RX NSS based on QCA_WLAN_VENDOR_ATTR_CONFIG_RX_NSS.
 	 */
 	QCA_WLAN_VENDOR_ATTR_CONFIG_RX_NSS = 78,
+
+	/*
+	 * 8-bit unsigned value. This attribute, when set, indicates whether the
+	 * specified interface is the primary STA interface when there are more
+	 * than one STA interfaces concurrently active.
+	 *
+	 * This configuration helps the firmware/hardware to support certain
+	 * features (e.g., roaming) on this primary interface, if the same
+	 * cannot be supported on the concurrent STA interfaces simultaneously.
+	 *
+	 * This configuration is only applicable for a single STA interface on
+	 * a device and gives the priority for it only over other concurrent STA
+	 * interfaces.
+	 *
+	 * If the device is a multi wiphy/soc, this configuration applies to a
+	 * single STA interface across the wiphys.
+	 *
+	 * 1-Enable (is the primary STA), 0-Disable (is not the primary STA)
+	 */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_CONCURRENT_STA_PRIMARY = 79,
+
+	/*
+	 * 8-bit unsigned value. This attribute can be used to configure the
+	 * driver to enable/disable FT-over-DS feature. Possible values for
+	 * this attribute are 1-Enable and 0-Disable.
+	 */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_FT_OVER_DS = 80,
 	/* keep last */
 	QCA_WLAN_VENDOR_ATTR_CONFIG_AFTER_LAST,
 	QCA_WLAN_VENDOR_ATTR_CONFIG_MAX =
@@ -10891,6 +10919,58 @@ enum qca_wlan_vendor_oci_override_frame_type {
 	QCA_WLAN_VENDOR_OCI_OVERRIDE_FRAME_FILS_REASSOC_REQ = 4,
 };
 
+/**
+ * enum qca_wlan_concurrent_sta_policy_config - Concurrent STA policies
+ *
+ * @QCA_WLAN_CONCURRENT_STA_POLICY_PREFER_PRIMARY: Preference to the primary
+ * STA interface has to be given while selecting the connection policies
+ * (e.g., BSSID, band, TX/RX chains, etc.) for the subsequent STA interface.
+ * An interface is set as primary through the attribute
+ * QCA_WLAN_VENDOR_ATTR_CONFIG_CONCURRENT_STA_PRIMARY. This policy is not
+ * applicable if the primary interface has not been set earlier.
+ *
+ * The intention is not to downgrade the primary STA performance, such as:
+ * - Do not reduce the number of TX/RX chains of primary connection.
+ * - Do not optimize DBS vs. MCC/SCC, if DBS ends up reducing the number of
+ *   chains.
+ * - If using MCC, should set the MCC duty cycle of the primary connection to
+ *   be higher than the secondary connection.
+ *
+ * @QCA_WLAN_CONCURRENT_STA_POLICY_UNBIASED: The connection policies for the
+ * subsequent STA connection shall be chosen to balance with the existing
+ * concurrent STA's performance.
+ * Such as
+ * - Can choose MCC or DBS mode depending on the MCC efficiency and hardware
+ *   capability.
+ * - If using MCC, set the MCC duty cycle of the primary connection to be equal
+ *   to the secondary.
+ * - Prefer BSSID candidates which will help provide the best "overall"
+ *   performance for all the STA connections.
+ */
+enum qca_wlan_concurrent_sta_policy_config {
+	QCA_WLAN_CONCURRENT_STA_POLICY_PREFER_PRIMARY = 0,
+	QCA_WLAN_CONCURRENT_STA_POLICY_UNBIASED = 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_concurrent_sta_policy - Defines attributes
+ * used by QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_MULTI_STA_POLICY vendor command.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_CONCURRENT_STA_POLICY_CONFIG:
+ * u8 attribute. Configures the concurrent STA policy configuration.
+ * Possible values are defined in enum qca_wlan_concurrent_sta_policy_config.
+ */
+enum qca_wlan_vendor_attr_concurrent_sta_policy {
+	QCA_WLAN_VENDOR_ATTR_CONCURRENT_STA_POLICY_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_CONCURRENT_STA_POLICY_CONFIG = 1,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_CONCURRENT_STA_POLICY_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_CONCURRENT_STA_POLICY_MAX =
+	QCA_WLAN_VENDOR_ATTR_CONCURRENT_STA_POLICY_AFTER_LAST - 1,
+
+};
+
 /**
  * enum qca_sta_connect_fail_reason_codes - Defines values carried
  * by QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_CONNECT_FAIL_REASON_CODE vendor
diff --git a/drivers/staging/qca-wifi-host-cmn/os_if/linux/scan/src/wlan_cfg80211_scan.c b/drivers/staging/qca-wifi-host-cmn/os_if/linux/scan/src/wlan_cfg80211_scan.c
index 74c7b6e4347a..b58563d998c4 100644
--- a/drivers/staging/qca-wifi-host-cmn/os_if/linux/scan/src/wlan_cfg80211_scan.c
+++ b/drivers/staging/qca-wifi-host-cmn/os_if/linux/scan/src/wlan_cfg80211_scan.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -51,6 +52,27 @@ const struct nla_policy cfg80211_scan_policy[
 	[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE] = {.type = NLA_U64},
 };
 
+/**
+ * wlan_cfg80211_is_colocated_6ghz_scan_supported() - Check whether colocated
+ * 6ghz scan flag present in scan request or not
+ * @scan_flag: Flags bitmap coming from kernel
+ *
+ * Return: True if colocated 6ghz scan flag present in scan req
+ */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0))
+static bool
+wlan_cfg80211_is_colocated_6ghz_scan_supported(uint32_t scan_flag)
+{
+	return !!(scan_flag & NL80211_SCAN_FLAG_COLOCATED_6GHZ);
+}
+#else
+static inline bool
+wlan_cfg80211_is_colocated_6ghz_scan_supported(uint32_t scan_flag)
+{
+	return false;
+}
+#endif
+
 #if defined(CFG80211_SCAN_RANDOM_MAC_ADDR) || \
 	(LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0))
 /**
@@ -429,6 +451,9 @@ int wlan_cfg80211_sched_scan_start(struct wlan_objmgr_vdev *vdev,
 
 	req->networks_cnt = request->n_match_sets;
 	req->vdev_id = wlan_vdev_get_id(vdev);
+	req->vdev = vdev;
+	req->scan_policy_colocated_6ghz =
+		 wlan_cfg80211_is_colocated_6ghz_scan_supported(request->flags);
 
 	if ((!req->networks_cnt) ||
 	    (req->networks_cnt > SCAN_PNO_MAX_SUPP_NETWORKS)) {
@@ -523,9 +548,15 @@ int wlan_cfg80211_sched_scan_start(struct wlan_objmgr_vdev *vdev,
 		req->networks_list[i].bc_new_type = 0;    /*eBCAST_UNKNOWN */
 
 		/*Copying list of valid channel into request */
-		qdf_mem_copy(req->networks_list[i].channels, valid_ch,
-			num_chan * sizeof(uint32_t));
-		req->networks_list[i].channel_cnt = num_chan;
+		for (j = 0; j < num_chan; j++)
+			req->networks_list[i].pno_chan_list.chan[j].freq =
+								valid_ch[j];
+		req->networks_list[i].pno_chan_list.num_chan = num_chan;
+
+		if (ucfg_is_6ghz_pno_scan_optimization_supported(psoc))
+			ucfg_scan_pno_add_all_valid_6g_channels(vdev, req,
+								&num_chan);
+
 		req->networks_list[i].rssi_thresh =
 			request->match_sets[i].rssi_thold;
 	}
@@ -1322,6 +1353,8 @@ static void wlan_cfg80211_update_scan_policy_type_flags(
 		scan_req->scan_policy_low_span = true;
 	if (req->flags & NL80211_SCAN_FLAG_LOW_POWER)
 		scan_req->scan_policy_low_power = true;
+	if (wlan_cfg80211_is_colocated_6ghz_scan_supported(req->flags))
+		scan_req->scan_policy_colocated_6ghz = true;
 }
 #else
 static inline void wlan_cfg80211_update_scan_policy_type_flags(
diff --git a/drivers/staging/qca-wifi-host-cmn/target_if/direct_buf_rx/src/target_if_direct_buf_rx_main.c b/drivers/staging/qca-wifi-host-cmn/target_if/direct_buf_rx/src/target_if_direct_buf_rx_main.c
index d8a8c5359a76..acc6ad3dee4b 100644
--- a/drivers/staging/qca-wifi-host-cmn/target_if/direct_buf_rx/src/target_if_direct_buf_rx_main.c
+++ b/drivers/staging/qca-wifi-host-cmn/target_if/direct_buf_rx/src/target_if_direct_buf_rx_main.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1023,6 +1024,11 @@ static QDF_STATUS target_if_dbr_replenish_ring(struct wlan_objmgr_pdev *pdev,
 		return QDF_STATUS_E_FAILURE;
 	}
 
+	if (cookie >= mod_param->dbr_ring_cfg->num_ptr) {
+		direct_buf_rx_err("invalid cookie %d", cookie);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	dbr_psoc_obj = wlan_objmgr_psoc_get_comp_private_obj(psoc,
 				WLAN_TARGET_IF_COMP_DIRECT_BUF_RX);
 
@@ -1504,6 +1510,11 @@ static void *target_if_dbr_vaddr_lookup(
 
 	dbr_buf_pool = mod_param->dbr_buf_pool;
 
+	if (cookie >= mod_param->dbr_ring_cfg->num_ptr) {
+		direct_buf_rx_err("invalid cookie %d", cookie);
+		return NULL;
+	}
+
 	if (dbr_buf_pool[cookie].paddr == paddr) {
 		return dbr_buf_pool[cookie].vaddr +
 				dbr_buf_pool[cookie].offset;
diff --git a/drivers/staging/qca-wifi-host-cmn/target_if/init_deinit/src/init_event_handler.c b/drivers/staging/qca-wifi-host-cmn/target_if/init_deinit/src/init_event_handler.c
index 0f5b9b45683c..3b18e3d71bee 100644
--- a/drivers/staging/qca-wifi-host-cmn/target_if/init_deinit/src/init_event_handler.c
+++ b/drivers/staging/qca-wifi-host-cmn/target_if/init_deinit/src/init_event_handler.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -173,6 +174,11 @@ static int init_deinit_service_ready_event_handler(ol_scn_t scn_handle,
 		wlan_psoc_nif_fw_ext_cap_set(psoc,
 					     WLAN_SOC_CEXT_SCAN_PER_CH_CONFIG);
 
+	if (wmi_service_enabled(wmi_handle,
+				wmi_service_pno_scan_conf_per_ch_support))
+		wlan_psoc_nif_fw_ext_cap_set(psoc,
+					WLAN_SOC_PNO_SCAN_CONFIG_PER_CHANNEL);
+
 	if (wmi_service_enabled(wmi_handle, wmi_service_csa_beacon_template))
 		wlan_psoc_nif_fw_ext_cap_set(psoc,
 					     WLAN_SOC_CEXT_CSA_TX_OFFLOAD);
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/cmn_services/obj_mgr/inc/wlan_objmgr_psoc_obj.h b/drivers/staging/qca-wifi-host-cmn/umac/cmn_services/obj_mgr/inc/wlan_objmgr_psoc_obj.h
index 453fec522438..b9354044764a 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/cmn_services/obj_mgr/inc/wlan_objmgr_psoc_obj.h
+++ b/drivers/staging/qca-wifi-host-cmn/umac/cmn_services/obj_mgr/inc/wlan_objmgr_psoc_obj.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -149,6 +150,9 @@
 	/* ext event supported by fw */
 #define WLAN_SOC_EXT_EVENT_SUPPORTED      0x04000000
 
+/* check 31st bit for per channel pno scan config flags support */
+#define WLAN_SOC_PNO_SCAN_CONFIG_PER_CHANNEL   0x40000000
+
 /* feature_flags */
 	/* CONF: ATH FF enabled */
 #define WLAN_SOC_F_FF                   0x00000001
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.c b/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.c
index d97385474663..319cdbd82675 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.c
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -244,6 +245,105 @@ scm_is_scan_type_exempted_from_optimization(struct scan_start_request *req)
 	return (req->scan_req.scan_type == SCAN_TYPE_RRM);
 }
 
+/**
+ * scm_add_all_valid_6g_channels() - Add all valid 6g channels to scan request
+ * @vdev: vdev on which scan request is issued
+ * @chan_list: channel list from userspace
+ * @num_scan_ch: Total number of scan channels
+ * @is_colocated_6ghz_scan_enabled: colocated 6ghz scan flag enabled in scan req
+ *
+ * If colocated 6ghz scan flag present in host scan request or at least one 6G
+ * channel is present in the host scan request, then this API
+ * fills all remaining (other than channel(s) resent in host scan req) valid
+ * 6 GHz channel(s) to scan requests channel list and set the flag
+ * FLAG_SCAN_ONLY_IF_RNR_FOUND for each of those added channels.
+ * By this driver allows Firmware to scan 6G channels based on RNR IEs only.
+ *
+ * Return: None
+ */
+void scm_add_all_valid_6g_channels(struct wlan_objmgr_pdev *pdev,
+				   struct chan_list *chan_list,
+				   uint8_t *num_scan_ch,
+				   bool is_colocated_6ghz_scan_enabled)
+{
+	uint8_t i, j;
+	enum channel_enum freq_idx;
+	struct regulatory_channel *cur_chan_list;
+	bool is_6g_ch_present = false, found;
+	QDF_STATUS status;
+	uint8_t temp_num_chan = 0;
+
+	for (i = 0; i < chan_list->num_chan; i++) {
+		if (wlan_reg_is_6ghz_chan_freq(chan_list->chan[i].freq)) {
+			scm_debug("At least one 6G chan present in scan req:%d",
+				  chan_list->chan[i].freq);
+			is_6g_ch_present = true;
+			break;
+		}
+	}
+
+	if (!is_6g_ch_present && !is_colocated_6ghz_scan_enabled) {
+
+		scm_debug("Neither 6G chan present nor flag set in scan req");
+		return;
+	}
+
+	cur_chan_list = qdf_mem_malloc(NUM_CHANNELS *
+				sizeof(struct regulatory_channel));
+	if (!cur_chan_list)
+		return;
+
+	status = wlan_reg_get_current_chan_list(pdev, cur_chan_list);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		qdf_mem_free(cur_chan_list);
+		scm_debug("Failed to get cur_chan list");
+		return;
+	}
+
+	freq_idx =
+		wlan_reg_get_chan_enum_for_freq(wlan_reg_min_6ghz_chan_freq());
+	if (freq_idx == INVALID_CHANNEL)
+		return;
+
+	scm_debug("freq_idx:%d", freq_idx);
+	temp_num_chan = chan_list->num_chan;
+	for (i = freq_idx; i < NUM_CHANNELS; i++) {
+		found = false;
+		for (j = 0; j < temp_num_chan; j++) {
+			if (cur_chan_list[i].center_freq ==
+			    chan_list->chan[j].freq) {
+				found = true;
+				break;
+			}
+		}
+		if (!found && cur_chan_list[i].state != CHANNEL_STATE_DISABLE &&
+		    cur_chan_list[i].state != CHANNEL_STATE_INVALID) {
+			chan_list->chan[chan_list->num_chan].freq =
+						cur_chan_list[i].center_freq;
+			chan_list->chan[chan_list->num_chan].flags =
+						FLAG_SCAN_ONLY_IF_RNR_FOUND;
+			chan_list->num_chan++;
+		}
+	}
+
+	scm_debug("prev num_chan:%d, current num_chan:%d", temp_num_chan,
+		  chan_list->num_chan);
+	*num_scan_ch = chan_list->num_chan;
+	qdf_mem_free(cur_chan_list);
+}
+
+static void scm_scan_add_all_valid_6g_channels(struct wlan_objmgr_pdev *pdev,
+					       struct scan_start_request *req,
+					       uint8_t *num_scan_ch)
+{
+	bool is_colocated_6ghz_scan_enabled =
+		req->scan_req.scan_policy_colocated_6ghz;
+
+	scm_add_all_valid_6g_channels(pdev, &req->scan_req.chan_list,
+				      num_scan_ch,
+				      is_colocated_6ghz_scan_enabled);
+}
+
 static void
 scm_copy_valid_channels(struct wlan_objmgr_psoc *psoc,
 			enum scan_mode_6ghz scan_mode,
@@ -418,6 +518,16 @@ scm_update_6ghz_channel_list(struct scan_start_request *req,
 			scm_set_rnr_flag_non_psc_6g_ch(&chan_list->chan[0],
 						       num_scan_ch);
 		break;
+	case SCAN_MODE_6G_ALL_CHANNEL:
+		/*
+		 * When the ini is set to SCAN_MODE_6G_ALL_CHANNEL,
+		 * Host fills all remaining (other than channel(s) present in
+		 * host scan req) valid 6 GHz channel(s) to scan requests and
+		 * set the flag FLAG_SCAN_ONLY_IF_RNR_FOUND for each remaining
+		 * channels.
+		 */
+		scm_scan_add_all_valid_6g_channels(pdev, req, &num_scan_ch);
+		break;
 	default:
 		/*
 		 * Don't set the RNR flag for SCAN_MODE_6G_NO_CHANNEL/
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.h b/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.h
index faee20e44c44..4f4114d10229 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.h
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/core/src/wlan_scan_manager_6ghz.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -70,6 +71,27 @@ scm_update_6ghz_channel_list(struct scan_start_request *req,
  */
 bool
 scm_is_6ghz_scan_optimization_supported(struct wlan_objmgr_psoc *psoc);
+
+/**
+ * scm_add_all_valid_6g_channels() - Add all valid 6g channels to scan request
+ * @vdev: vdev on which scan request is issued
+ * @req: Scan start request
+ * @num_scan_ch: Total number of scan channels
+ *
+ * If colocated 6ghz scan flag present in host scan request or at least one 6G
+ * channel is present in the host scan request, then this API
+ * fills all remaining (other than channel(s) resent in host scan req) valid
+ * 6 GHz channel(s) to scan requests channel list and set the flag
+ * FLAG_SCAN_ONLY_IF_RNR_FOUND for each of those added channels.
+ * By this driver allows Firmware to scan 6G channels based on RNR IEs only.
+ *
+ * Return: None
+ */
+void scm_add_all_valid_6g_channels(struct wlan_objmgr_pdev *pdev,
+				   struct chan_list *chan_list,
+				   uint8_t *num_scan_ch,
+				   bool is_colocated_6ghz);
+
 #else
 static inline void
 scm_update_6ghz_channel_list(struct scan_start_request *req,
@@ -82,6 +104,13 @@ scm_is_6ghz_scan_optimization_supported(struct wlan_objmgr_psoc *psoc)
 {
 	return false;
 }
+
+static inline void scm_add_all_valid_6g_channels(struct wlan_objmgr_pdev *pdev,
+						 struct chan_list *chan_list,
+						 uint8_t *num_scan_ch,
+						 bool is_colocated_6ghz)
+{
+}
 #endif
 
 #endif
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_api.h b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_api.h
index 5b9bbd00291b..4a39af7d2e18 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_api.h
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_api.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -89,6 +90,22 @@ QDF_STATUS wlan_scan_cfg_set_passive_6g_dwelltime(struct wlan_objmgr_psoc *psoc,
  */
 QDF_STATUS wlan_scan_cfg_get_passive_6g_dwelltime(struct wlan_objmgr_psoc *psoc,
 						  uint32_t *dwell_time);
+
+/**
+ * wlan_scan_cfg_get_min_dwelltime_6g() - API to get minimum 6g dwelltime
+ * @psoc: pointer to psoc object
+ * @min_dwell_time_6ghz: minimum dwelltime 6g
+ *
+ * Return: QDF_STATUS
+ */
+void wlan_scan_cfg_get_min_dwelltime_6g(struct wlan_objmgr_psoc *psoc,
+					uint32_t *min_dwell_time_6ghz);
+#else
+static inline
+void wlan_scan_cfg_get_min_dwelltime_6g(struct wlan_objmgr_psoc *psoc,
+					uint32_t *min_dwell_time_6ghz)
+{
+}
 #endif
 
 /**
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_public_structs.h b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_public_structs.h
index 2fbff59675bf..cb87e61c0547 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_public_structs.h
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_public_structs.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1023,7 +1024,8 @@ struct scan_req_params {
 		struct {
 			uint32_t scan_policy_high_accuracy:1,
 				 scan_policy_low_span:1,
-				 scan_policy_low_power:1;
+				 scan_policy_low_power:1,
+				 scan_policy_colocated_6ghz:1;
 		};
 		uint32_t scan_policy_type;
 	};
@@ -1284,18 +1286,17 @@ enum ssid_bc_type {
  * @ssid: ssid
  * @authentication: authentication type
  * @encryption: encryption type
- * @bcastNetwType: broadcast nw type
- * @ucChannelCount: uc channel count
- * @aChannels: pno channel
- * @rssiThreshold: rssi threshold
+ * @bc_new_type: broadcast nw type
+ * @pno_chan_list: pno channel list info
+ * @rssi_thresh: rssi threshold
  */
 struct pno_nw_type {
 	struct wlan_ssid ssid;
 	uint32_t authentication;
 	uint32_t encryption;
 	uint32_t bc_new_type;
-	uint8_t channel_cnt;
-	uint32_t channels[SCAN_PNO_MAX_NETW_CHANNELS_EX];
+	struct chan_list pno_chan_list;
+
 	int32_t rssi_thresh;
 };
 
@@ -1329,6 +1330,7 @@ struct nlo_mawc_params {
 
 /**
  * struct pno_scan_req_params - PNO Scan request structure
+ * @vdev: vdev object
  * @networks_cnt: Number of networks
  * @do_passive_scan: Flag to request passive scan to fw
  * @vdev_id: vdev id
@@ -1359,8 +1361,10 @@ struct nlo_mawc_params {
  *	  slow_scan_period=1800, scan_backoff_multiplier=2 }
  *	Result: 120s x2, 240s x2, 480s x2, 960s x2, 1800s xN
  * @mawc_params: Configuration parameters for NLO MAWC.
+ * @scan_policy_colocated_6ghz: colocated_6ghz flag is set in pno scan req
  */
 struct pno_scan_req_params {
+	struct wlan_objmgr_vdev *vdev;
 	uint32_t networks_cnt;
 	bool     do_passive_scan;
 	uint32_t vdev_id;
@@ -1383,6 +1387,7 @@ struct pno_scan_req_params {
 	int8_t relative_rssi;
 	struct cpno_band_rssi_pref band_rssi_pref;
 	struct nlo_mawc_params mawc_params;
+	bool scan_policy_colocated_6ghz;
 };
 
 /**
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_ucfg_api.h b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_ucfg_api.h
index e05baa4cf094..70cda95abf46 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_ucfg_api.h
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_ucfg_api.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -98,7 +99,30 @@ ucfg_scan_get_scan_id(struct wlan_objmgr_psoc *psoc);
  * Return: 0 for success or error code.
  */
 QDF_STATUS ucfg_scan_pno_start(struct wlan_objmgr_vdev *vdev,
-struct pno_scan_req_params *req);
+			       struct pno_scan_req_params *req);
+
+/**
+ * ucfg_scan_pno_add_all_valid_6g_channels() - This API to update all valid 6g
+ * channels to pno scan request
+ * @vdev: vdev pointer
+ * @req: pno req params
+ * @num_scan_ch: total number of channels present in pno scan request
+ *
+ * Return: None
+ */
+void ucfg_scan_pno_add_all_valid_6g_channels(struct wlan_objmgr_vdev *vdev,
+					     struct pno_scan_req_params *req,
+					     uint8_t *num_scan_ch);
+
+/**
+ * ucfg_is_6ghz_pno_scan_optimization_supported() - Public API to check
+ * 6ghz pno scan optimization supported in fw
+ * @psoc: psoc object
+ *
+ * Return: 0 for success.
+ */
+bool
+ucfg_is_6ghz_pno_scan_optimization_supported(struct wlan_objmgr_psoc *psoc);
 
 /**
  * ucfg_scan_pno_stop() - Public API to stop PNO
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_api.c b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_api.c
index 696679b00aa8..c4b77a972071 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_api.c
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_api.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -147,6 +148,17 @@ QDF_STATUS wlan_scan_cfg_set_passive_6g_dwelltime(struct wlan_objmgr_psoc *psoc,
 
 	return QDF_STATUS_SUCCESS;
 }
+
+void wlan_scan_cfg_get_min_dwelltime_6g(struct wlan_objmgr_psoc *psoc,
+					uint32_t *min_dwell_time_6ghz)
+{
+	struct wlan_scan_obj *scan_obj;
+
+	scan_obj = wlan_psoc_get_scan_obj(psoc);
+	if (!scan_obj)
+		return;
+	*min_dwell_time_6ghz = scan_obj->scan_def.min_dwell_time_6g;
+}
 #endif
 
 void wlan_scan_cfg_get_conc_active_dwelltime(struct wlan_objmgr_psoc *psoc,
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c
index dc64d59faee5..189b8d07a879 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_ucfg_api.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -152,6 +153,12 @@ QDF_STATUS ucfg_scan_deinit(void)
 }
 
 #ifdef FEATURE_WLAN_SCAN_PNO
+bool
+ucfg_is_6ghz_pno_scan_optimization_supported(struct wlan_objmgr_psoc *psoc)
+{
+	return wlan_psoc_nif_fw_ext_cap_get(psoc,
+					WLAN_SOC_PNO_SCAN_CONFIG_PER_CHANNEL);
+}
 
 QDF_STATUS ucfg_scan_pno_start(struct wlan_objmgr_vdev *vdev,
 	struct pno_scan_req_params *req)
@@ -178,6 +185,22 @@ QDF_STATUS ucfg_scan_pno_start(struct wlan_objmgr_vdev *vdev,
 	return status;
 }
 
+void ucfg_scan_pno_add_all_valid_6g_channels(struct wlan_objmgr_vdev *vdev,
+					     struct pno_scan_req_params *req,
+					     uint8_t *num_scan_ch)
+{
+	struct wlan_objmgr_pdev *pdev;
+	struct chan_list *pno_chan_list = &req->networks_list[0].pno_chan_list;
+	bool is_colocated_6ghz = req->scan_policy_colocated_6ghz;
+
+	pdev = wlan_vdev_get_pdev(vdev);
+	if (!pdev)
+		return;
+
+	scm_add_all_valid_6g_channels(pdev, pno_chan_list, num_scan_ch,
+				      is_colocated_6ghz);
+}
+
 QDF_STATUS ucfg_scan_pno_stop(struct wlan_objmgr_vdev *vdev)
 {
 	struct scan_vdev_obj *scan_vdev_obj;
diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c
index e98e19d05e84..a7130b60551c 100644
--- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c
+++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -2597,9 +2597,9 @@ util_scan_parse_beacon_frame(struct wlan_objmgr_pdev *pdev,
 {
 	struct wlan_bcn_frame *bcn;
 	struct wlan_frame_hdr *hdr;
-	uint8_t *mbssid_ie = NULL;
+	uint8_t *mbssid_ie = NULL, *extcap_ie;
 	uint32_t ie_len = 0;
-	QDF_STATUS status;
+	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 	struct scan_mbssid_info mbssid_info = { 0 };
 
 	hdr = (struct wlan_frame_hdr *)frame;
@@ -2609,12 +2609,24 @@ util_scan_parse_beacon_frame(struct wlan_objmgr_pdev *pdev,
 		sizeof(struct wlan_frame_hdr) -
 		offsetof(struct wlan_bcn_frame, ie));
 
-	mbssid_ie = util_scan_find_ie(WLAN_ELEMID_MULTIPLE_BSSID,
+	extcap_ie = util_scan_find_ie(WLAN_ELEMID_XCAPS,
 				      (uint8_t *)&bcn->ie, ie_len);
-	if (mbssid_ie) {
-		qdf_mem_copy(&mbssid_info.trans_bssid,
-			     hdr->i_addr3, QDF_MAC_ADDR_SIZE);
-		mbssid_info.profile_count = 1 << mbssid_ie[2];
+	/* Process MBSSID when Multiple BSSID (Bit 22) is set in Ext Caps */
+	if (extcap_ie &&
+	    extcap_ie[1] >= 3 && extcap_ie[1] <= WLAN_EXTCAP_IE_MAX_LEN &&
+	    (extcap_ie[4] & 0x40)) {
+		mbssid_ie = util_scan_find_ie(WLAN_ELEMID_MULTIPLE_BSSID,
+					      (uint8_t *)&bcn->ie, ie_len);
+		if (mbssid_ie) {
+			if (mbssid_ie[1] <= 0) {
+				scm_debug("MBSSID IE length is wrong %d",
+					  mbssid_ie[1]);
+				return status;
+			}
+			qdf_mem_copy(&mbssid_info.trans_bssid,
+				     hdr->i_addr3, QDF_MAC_ADDR_SIZE);
+			mbssid_info.profile_count = 1 << mbssid_ie[2];
+		}
 	}
 
 	status = util_scan_gen_scan_entry(pdev, frame, frame_len,
diff --git a/drivers/staging/qca-wifi-host-cmn/wlan_cfg/cfg_dp.h b/drivers/staging/qca-wifi-host-cmn/wlan_cfg/cfg_dp.h
index 30011c1ad811..482963db3ce1 100644
--- a/drivers/staging/qca-wifi-host-cmn/wlan_cfg/cfg_dp.h
+++ b/drivers/staging/qca-wifi-host-cmn/wlan_cfg/cfg_dp.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -614,9 +615,34 @@
 	CFG_INI_BOOL("dp_sg_support", false, \
 	"DP SG Enable")
 
+#define WLAN_CFG_GRO_ENABLE_MIN 0
+#define WLAN_CFG_GRO_ENABLE_MAX 3
+#define WLAN_CFG_GRO_ENABLE_DEFAULT 0
+#define DP_GRO_ENABLE_BIT_SET     BIT(0)
+#define DP_FORCE_USE_GRO_BIT_SET  BIT(1)
+/*
+ * <ini>
+ * CFG_DP_GRO - Enable the GRO feature standalonely
+ * @Min: 0
+ * @Max: 3
+ * @Default: 0
+ *
+ * This ini entry is used to enable/disable GRO feature standalonely.
+ * Value 0: Disable GRO feature
+ * Value 1: Enable Dynamic GRO feature, TC rule can control GRO
+ *          behavior of STA mode
+ * Value 3: Enable GRO feature forcibly
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
 #define CFG_DP_GRO \
-	CFG_INI_BOOL("GROEnable", false, \
-	"DP GRO Enable")
+		CFG_INI_UINT("GROEnable", \
+		WLAN_CFG_GRO_ENABLE_MIN, \
+		WLAN_CFG_GRO_ENABLE_MAX, \
+		WLAN_CFG_GRO_ENABLE_DEFAULT, \
+		CFG_VALUE_OR_DEFAULT, "DP GRO Enable")
 
 #define CFG_DP_OL_TX_CSUM \
 	CFG_INI_BOOL("dp_offload_tx_csum_support", false, \
diff --git a/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.c b/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.c
index 1a7a1958fa9d..28a64b5903f5 100644
--- a/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.c
+++ b/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -502,6 +503,7 @@ wlan_cfg_soc_attach(struct cdp_ctrl_objmgr_psoc *psoc)
 {
 	struct wlan_cfg_dp_soc_ctxt *wlan_cfg_ctx =
 		qdf_mem_malloc(sizeof(struct wlan_cfg_dp_soc_ctxt));
+	uint32_t gro_bit_set;
 
 	if (!wlan_cfg_ctx)
 		return NULL;
@@ -560,7 +562,12 @@ wlan_cfg_soc_attach(struct cdp_ctrl_objmgr_psoc *psoc)
 	wlan_cfg_ctx->tso_enabled = cfg_get(psoc, CFG_DP_TSO);
 	wlan_cfg_ctx->lro_enabled = cfg_get(psoc, CFG_DP_LRO);
 	wlan_cfg_ctx->sg_enabled = cfg_get(psoc, CFG_DP_SG);
-	wlan_cfg_ctx->gro_enabled = cfg_get(psoc, CFG_DP_GRO);
+	gro_bit_set = cfg_get(psoc, CFG_DP_GRO);
+	if (gro_bit_set & DP_GRO_ENABLE_BIT_SET) {
+		wlan_cfg_ctx->gro_enabled = true;
+		if (gro_bit_set & DP_FORCE_USE_GRO_BIT_SET)
+			wlan_cfg_ctx->force_gro_enabled = true;
+	}
 	wlan_cfg_ctx->ol_tx_csum_enabled = cfg_get(psoc, CFG_DP_OL_TX_CSUM);
 	wlan_cfg_ctx->ol_rx_csum_enabled = cfg_get(psoc, CFG_DP_OL_RX_CSUM);
 	wlan_cfg_ctx->rawmode_enabled = cfg_get(psoc, CFG_DP_RAWMODE);
diff --git a/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.h b/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.h
index 0be13218df9a..98ffb9a4dda8 100644
--- a/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.h
+++ b/drivers/staging/qca-wifi-host-cmn/wlan_cfg/wlan_cfg.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -134,6 +135,7 @@ struct wlan_srng_cfg {
  * @lro_enabled: enable/disable LRO feature
  * @sg_enabled: enable disable scatter gather feature
  * @gro_enabled: enable disable GRO feature
+ * @force_gro_enabled: force enable GRO feature
  * @ipa_enabled: Flag indicating if IPA is enabled
  * @ol_tx_csum_enabled: Flag indicating if TX csum is enabled
  * @ol_rx_csum_enabled: Flag indicating if Rx csum is enabled
@@ -244,6 +246,7 @@ struct wlan_cfg_dp_soc_ctxt {
 	bool lro_enabled;
 	bool sg_enabled;
 	bool gro_enabled;
+	bool force_gro_enabled;
 	bool ipa_enabled;
 	bool ol_tx_csum_enabled;
 	bool ol_rx_csum_enabled;
diff --git a/drivers/staging/qca-wifi-host-cmn/wmi/inc/wmi_unified_param.h b/drivers/staging/qca-wifi-host-cmn/wmi/inc/wmi_unified_param.h
index 4ee01ee2886f..87bc26ff2175 100644
--- a/drivers/staging/qca-wifi-host-cmn/wmi/inc/wmi_unified_param.h
+++ b/drivers/staging/qca-wifi-host-cmn/wmi/inc/wmi_unified_param.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -5271,6 +5272,7 @@ typedef enum {
 #ifdef THERMAL_STATS_SUPPORT
 	wmi_service_thermal_stats_temp_range_supported,
 #endif
+	wmi_service_pno_scan_conf_per_ch_support,
 	wmi_services_max,
 } wmi_conv_service_ids;
 #define WMI_SERVICE_UNAVAILABLE 0xFFFF
diff --git a/drivers/staging/qca-wifi-host-cmn/wmi/src/wmi_unified_tlv.c b/drivers/staging/qca-wifi-host-cmn/wmi/src/wmi_unified_tlv.c
index 5ee0bf55b03d..534a0371b750 100644
--- a/drivers/staging/qca-wifi-host-cmn/wmi/src/wmi_unified_tlv.c
+++ b/drivers/staging/qca-wifi-host-cmn/wmi/src/wmi_unified_tlv.c
@@ -4880,6 +4880,40 @@ static QDF_STATUS send_nlo_mawc_cmd_tlv(wmi_unified_t wmi_handle,
 	return QDF_STATUS_SUCCESS;
 }
 
+/**
+ * wmi_dump_pno_scan_freq_list() - dump frequency list associated with pno
+ * scan
+ * @scan_freq_list: frequency list for pno scan
+ *
+ * Return: void
+ */
+static void wmi_dump_pno_scan_freq_list(struct chan_list *scan_freq_list)
+{
+	uint32_t i;
+	uint8_t info[WMI_MAX_CHAN_INFO_LOG];
+	uint32_t len = 0;
+	struct chan_info *chan_info;
+	int ret;
+
+	wmi_debug("[PNO_SCAN] Total freq %d", scan_freq_list->num_chan);
+	for (i = 0; i < scan_freq_list->num_chan; i++) {
+		chan_info = &scan_freq_list->chan[i];
+		ret = qdf_scnprintf(info + len, sizeof(info) - len,
+				    " %d[%d]", chan_info->freq,
+				    chan_info->flags);
+		if (ret <= 0)
+			break;
+		len += ret;
+		if (len >= (sizeof(info) - 20)) {
+			wmi_nofl_debug("Freq[flag]:%s",
+				       info);
+			len = 0;
+		}
+	}
+	if (len)
+		wmi_nofl_debug("Freq[flag]:%s", info);
+}
+
 /**
  * send_pno_start_cmd_tlv() - PNO start request
  * @wmi_handle: wmi handle
@@ -4895,6 +4929,7 @@ static QDF_STATUS send_pno_start_cmd_tlv(wmi_unified_t wmi_handle,
 	nlo_configured_parameters *nlo_list;
 	uint32_t *channel_list;
 	int32_t len;
+	qdf_freq_t freq;
 	wmi_buf_t buf;
 	uint8_t *buf_ptr;
 	uint8_t i;
@@ -4914,7 +4949,7 @@ static QDF_STATUS send_pno_start_cmd_tlv(wmi_unified_t wmi_handle,
 		WMI_TLV_HDR_SIZE + WMI_TLV_HDR_SIZE + WMI_TLV_HDR_SIZE +
 		WMI_TLV_HDR_SIZE + WMI_TLV_HDR_SIZE;
 
-	len += sizeof(uint32_t) * pno->networks_list[0].channel_cnt;
+	len += sizeof(uint32_t) * pno->networks_list[0].pno_chan_list.num_chan;
 	len += sizeof(nlo_configured_parameters) *
 	       QDF_MIN(pno->networks_cnt, WMI_NLO_MAX_SSIDS);
 	len += sizeof(nlo_channel_prediction_cfg);
@@ -5001,20 +5036,28 @@ static QDF_STATUS send_pno_start_cmd_tlv(wmi_unified_t wmi_handle,
 	buf_ptr += cmd->no_of_ssids * sizeof(nlo_configured_parameters);
 
 	/* Copy channel info */
-	cmd->num_of_channels = pno->networks_list[0].channel_cnt;
+	cmd->num_of_channels = pno->networks_list[0].pno_chan_list.num_chan;
 	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_UINT32,
 		       (cmd->num_of_channels * sizeof(uint32_t)));
 	buf_ptr += WMI_TLV_HDR_SIZE;
 
 	channel_list = (uint32_t *) buf_ptr;
 	for (i = 0; i < cmd->num_of_channels; i++) {
-		channel_list[i] = pno->networks_list[0].channels[i];
+		TARGET_SET_FREQ_IN_CHAN_LIST_TLV(channel_list[i],
+			pno->networks_list[0].pno_chan_list.chan[i].freq);
 
-		if (channel_list[i] < WMI_NLO_FREQ_THRESH)
-			channel_list[i] =
-				wlan_chan_to_freq(pno->
-					networks_list[0].channels[i]);
+		if (channel_list[i] < WMI_NLO_FREQ_THRESH) {
+			freq = pno->networks_list[0].pno_chan_list.chan[i].freq;
+			TARGET_SET_FREQ_IN_CHAN_LIST_TLV(channel_list[i],
+						     wlan_chan_to_freq(freq));
+		}
+
+		TARGET_SET_FLAGS_IN_CHAN_LIST_TLV(channel_list[i],
+			pno->networks_list[0].pno_chan_list.chan[i].flags);
 	}
+
+	wmi_dump_pno_scan_freq_list(&pno->networks_list[0].pno_chan_list);
+
 	buf_ptr += cmd->num_of_channels * sizeof(uint32_t);
 	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
 			sizeof(nlo_channel_prediction_cfg));
@@ -15907,6 +15950,8 @@ static void populate_tlv_service(uint32_t *wmi_service)
 	wmi_service[wmi_service_thermal_stats_temp_range_supported] =
 			WMI_SERVICE_THERMAL_THROT_STATS_TEMP_RANGE_SUPPORT;
 #endif
+	wmi_service[wmi_service_pno_scan_conf_per_ch_support] =
+			WMI_SERVICE_PNO_SCAN_CONFIG_PER_CHANNEL;
 }
 
 /**