diff --git a/dp/inc/cdp_txrx_cmn_struct.h b/dp/inc/cdp_txrx_cmn_struct.h
index e8dd3a280abc..3313ee325a95 100644
--- a/dp/inc/cdp_txrx_cmn_struct.h
+++ b/dp/inc/cdp_txrx_cmn_struct.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (c) 2011-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1138,8 +1139,6 @@ enum cdp_pdev_param_type {
  *
  * @cdp_psoc_param_en_rate_stats: set rate stats enable/disable
  * @cdp_psoc_param_en_nss_cfg: set nss cfg
- *
- * @cdp_enable_tx_checksum: Flag to specify if HW Tx checksum enabled
  */
 typedef union cdp_config_param_t {
 	/* peer params */
@@ -1209,7 +1208,6 @@ typedef union cdp_config_param_t {
 	int cdp_psoc_param_preferred_hw_mode;
 	bool cdp_psoc_param_pext_stats;
 
-	bool cdp_enable_tx_checksum;
 } cdp_config_param_type;
 
 /**
@@ -1307,7 +1305,6 @@ enum cdp_vdev_param_type {
 #endif
 	CDP_SAFEMODE,
 	CDP_DROP_UNENC,
-	CDP_ENABLE_CSUM,
 	CDP_ENABLE_IGMP_MCAST_EN,
 	CDP_ENABLE_HLOS_TID_OVERRIDE,
 #ifdef QCA_SUPPORT_WDS_EXTENDED
diff --git a/dp/inc/cdp_txrx_stats_struct.h b/dp/inc/cdp_txrx_stats_struct.h
index 34bd143389c5..813de47f98eb 100644
--- a/dp/inc/cdp_txrx_stats_struct.h
+++ b/dp/inc/cdp_txrx_stats_struct.h
@@ -914,6 +914,7 @@ struct protocol_trace_count {
  * @stbc: Packets in STBC
  * @ldpc: Packets in LDPC
  * @retries: Packet retries
+ * @retries_mpdu: mpdu number of successfully transmitted after retries
  * @non_amsdu_cnt: Number of MSDUs with no MSDU level aggregation
  * @amsdu_cnt: Number of MSDUs part of AMSDU
  * @tx_rate: Tx Rate
@@ -995,6 +996,7 @@ struct cdp_tx_stats {
 	uint32_t stbc;
 	uint32_t ldpc;
 	uint32_t retries;
+	uint32_t retries_mpdu;
 	uint32_t non_amsdu_cnt;
 	uint32_t amsdu_cnt;
 	uint32_t tx_rate;
diff --git a/dp/wifi3.0/dp_internal.h b/dp/wifi3.0/dp_internal.h
index 13e4a851611c..e9f8de7431e7 100644
--- a/dp/wifi3.0/dp_internal.h
+++ b/dp/wifi3.0/dp_internal.h
@@ -853,6 +853,7 @@ static inline void dp_update_vdev_stats(struct dp_soc *soc,
 	tgtobj->tx.ldpc += srcobj->stats.tx.ldpc;
 	tgtobj->tx.pream_punct_cnt += srcobj->stats.tx.pream_punct_cnt;
 	tgtobj->tx.retries += srcobj->stats.tx.retries;
+	tgtobj->tx.retries_mpdu += srcobj->stats.tx.retries_mpdu;
 	tgtobj->tx.non_amsdu_cnt += srcobj->stats.tx.non_amsdu_cnt;
 	tgtobj->tx.amsdu_cnt += srcobj->stats.tx.amsdu_cnt;
 	tgtobj->tx.non_ampdu_cnt += srcobj->stats.tx.non_ampdu_cnt;
diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c
index 6067336cb479..2ec38f9eb9ae 100644
--- a/dp/wifi3.0/dp_main.c
+++ b/dp/wifi3.0/dp_main.c
@@ -9324,11 +9324,6 @@ dp_set_vdev_param(struct cdp_soc_t *cdp_soc, uint8_t vdev_id,
 				      val.cdp_vdev_param_mesh_mode);
 		break;
 #endif
-	case CDP_ENABLE_CSUM:
-		dp_info("vdev_id %d enable Checksum %d", vdev_id,
-			val.cdp_enable_tx_checksum);
-		vdev->csum_enabled = val.cdp_enable_tx_checksum;
-		break;
 	case CDP_ENABLE_HLOS_TID_OVERRIDE:
 		dp_info("vdev_id %d enable hlod tid override %d", vdev_id,
 			val.cdp_vdev_param_hlos_tid_override);
diff --git a/dp/wifi3.0/dp_rx_err.c b/dp/wifi3.0/dp_rx_err.c
index dfd7f0b62e04..ddf45223cf7f 100644
--- a/dp/wifi3.0/dp_rx_err.c
+++ b/dp/wifi3.0/dp_rx_err.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1624,6 +1625,124 @@ fail:
 	return;
 }
 
+/**
+ * dp_rx_err_route_hdl() - Function to send EAPOL frames to stack
+ *                            Free any other packet which comes in
+ *                            this path.
+ *
+ * @soc: core DP main context
+ * @nbuf: buffer pointer
+ * @peer: peer handle
+ * @rx_tlv_hdr: start of rx tlv header
+ * @err_src: rxdma/reo
+ *
+ * This function indicates EAPOL frame received in wbm error ring to stack.
+ * Any other frame should be dropped.
+ *
+ * Return: SUCCESS if delivered to stack
+ */
+static void
+dp_rx_err_route_hdl(struct dp_soc *soc, qdf_nbuf_t nbuf,
+		    struct dp_peer *peer, uint8_t *rx_tlv_hdr,
+		    enum hal_rx_wbm_error_source err_src)
+{
+	uint32_t pkt_len;
+	uint16_t msdu_len;
+	struct dp_vdev *vdev;
+	struct hal_rx_msdu_metadata msdu_metadata;
+	bool is_eapol;
+
+	hal_rx_msdu_metadata_get(soc->hal_soc, rx_tlv_hdr, &msdu_metadata);
+	msdu_len = hal_rx_msdu_start_msdu_len_get(rx_tlv_hdr);
+	pkt_len = msdu_len + msdu_metadata.l3_hdr_pad + RX_PKT_TLVS_LEN;
+
+	if (qdf_likely(!qdf_nbuf_is_frag(nbuf))) {
+		if (dp_rx_check_pkt_len(soc, pkt_len))
+			goto drop_nbuf;
+
+		/* Set length in nbuf */
+		qdf_nbuf_set_pktlen(
+			nbuf, qdf_min(pkt_len, (uint32_t)RX_DATA_BUFFER_SIZE));
+		qdf_assert_always(nbuf->data == rx_tlv_hdr);
+	}
+
+	/*
+	 * Check if DMA completed -- msdu_done is the last bit
+	 * to be written
+	 */
+	if (!hal_rx_attn_msdu_done_get(rx_tlv_hdr)) {
+		dp_err_rl("MSDU DONE failure");
+		hal_rx_dump_pkt_tlvs(soc->hal_soc, rx_tlv_hdr,
+				     QDF_TRACE_LEVEL_INFO);
+		qdf_assert(0);
+	}
+
+	if (!peer)
+		goto drop_nbuf;
+
+	vdev = peer->vdev;
+	if (!vdev) {
+		dp_err_rl("Null vdev!");
+		DP_STATS_INC(soc, rx.err.invalid_vdev, 1);
+		goto drop_nbuf;
+	}
+
+	/*
+	 * Advance the packet start pointer by total size of
+	 * pre-header TLV's
+	 */
+	if (qdf_nbuf_is_frag(nbuf))
+		qdf_nbuf_pull_head(nbuf, RX_PKT_TLVS_LEN);
+	else
+		qdf_nbuf_pull_head(nbuf, (msdu_metadata.l3_hdr_pad +
+					  RX_PKT_TLVS_LEN));
+
+	dp_vdev_peer_stats_update_protocol_cnt(vdev, nbuf, NULL, 0, 1);
+
+	/*
+	 * Indicate EAPOL frame to stack only when vap mac address
+	 * matches the destination address.
+	 */
+	is_eapol = qdf_nbuf_is_ipv4_eapol_pkt(nbuf);
+	if (is_eapol || qdf_nbuf_is_ipv4_wapi_pkt(nbuf)) {
+		qdf_ether_header_t *eh =
+			(qdf_ether_header_t *)qdf_nbuf_data(nbuf);
+		if (qdf_mem_cmp(eh->ether_dhost, &vdev->mac_addr.raw[0],
+				QDF_MAC_ADDR_SIZE) == 0) {
+			DP_STATS_INC_PKT(vdev, rx.to_stack, 1,
+					 qdf_nbuf_len(nbuf));
+
+			/*
+			 * Update the protocol tag in SKB based on
+			 * CCE metadata.
+			 */
+			dp_rx_update_protocol_tag(soc, vdev, nbuf, rx_tlv_hdr,
+						  EXCEPTION_DEST_RING_ID,
+						  true, true);
+			/* Update the flow tag in SKB based on FSE metadata */
+			dp_rx_update_flow_tag(soc, vdev, nbuf, rx_tlv_hdr,
+					      true);
+			DP_STATS_INC_PKT(peer, rx.to_stack, 1,
+					 qdf_nbuf_len(nbuf));
+			qdf_nbuf_set_exc_frame(nbuf, 1);
+			qdf_nbuf_set_next(nbuf, NULL);
+
+			dp_rx_deliver_to_stack(soc, vdev, peer, nbuf, NULL);
+
+			return;
+		}
+	}
+
+drop_nbuf:
+
+	DP_STATS_INCC(soc, rx.reo2rel_route_drop, 1,
+		      err_src == HAL_RX_WBM_ERR_SRC_REO);
+	DP_STATS_INCC(soc, rx.rxdma2rel_route_drop, 1,
+		      err_src == HAL_RX_WBM_ERR_SRC_RXDMA);
+
+	qdf_nbuf_free(nbuf);
+}
+
 #ifdef DP_RX_DESC_COOKIE_INVALIDATE
 /**
  * dp_rx_link_cookie_check() - Validate link desc cookie
@@ -2466,6 +2585,17 @@ done:
 						   wbm_err_info.reo_err_code);
 					qdf_nbuf_free(nbuf);
 				}
+			} else if (wbm_err_info.reo_psh_rsn
+					== HAL_RX_WBM_REO_PSH_RSN_ROUTE) {
+				dp_rx_err_route_hdl(soc, nbuf, peer,
+						    rx_tlv_hdr,
+						    HAL_RX_WBM_ERR_SRC_REO);
+			} else {
+				/* should not enter here */
+				dp_alert("invalid reo push reason %u",
+					 wbm_err_info.reo_psh_rsn);
+				qdf_nbuf_free(nbuf);
+				qdf_assert_always(0);
 			}
 		} else if (wbm_err_info.wbm_err_src ==
 					HAL_RX_WBM_ERR_SRC_RXDMA) {
@@ -2530,6 +2660,17 @@ done:
 					dp_err_rl("RXDMA error %d",
 						  wbm_err_info.rxdma_err_code);
 				}
+			} else if (wbm_err_info.rxdma_psh_rsn
+					== HAL_RX_WBM_RXDMA_PSH_RSN_ROUTE) {
+				dp_rx_err_route_hdl(soc, nbuf, peer,
+						    rx_tlv_hdr,
+						    HAL_RX_WBM_ERR_SRC_RXDMA);
+			} else {
+				/* should not enter here */
+				dp_alert("invalid rxdma push reason %u",
+					 wbm_err_info.rxdma_psh_rsn);
+				qdf_nbuf_free(nbuf);
+				qdf_assert_always(0);
 			}
 		} else {
 			/* Should not come here */
diff --git a/dp/wifi3.0/dp_stats.c b/dp/wifi3.0/dp_stats.c
index 2d96e52c477c..979b23b7e6f9 100644
--- a/dp/wifi3.0/dp_stats.c
+++ b/dp/wifi3.0/dp_stats.c
@@ -6652,6 +6652,10 @@ dp_print_soc_rx_stats(struct dp_soc *soc)
 		       soc->stats.rx.err.reo_cmd_send_fail);
 
 	DP_PRINT_STATS("Rx BAR frames:%d", soc->stats.rx.bar_frame);
+	DP_PRINT_STATS("Rxdma2rel route drop:%d",
+		       soc->stats.rx.rxdma2rel_route_drop);
+	DP_PRINT_STATS("Reo2rel route drop:%d",
+		       soc->stats.rx.reo2rel_route_drop);
 }
 
 #ifdef FEATURE_TSO_STATS
diff --git a/dp/wifi3.0/dp_tx.c b/dp/wifi3.0/dp_tx.c
index 9438be28a218..a499384d3dd4 100644
--- a/dp/wifi3.0/dp_tx.c
+++ b/dp/wifi3.0/dp_tx.c
@@ -1696,9 +1696,8 @@ dp_tx_hw_enqueue(struct dp_soc *soc, struct dp_vdev *vdev,
 		hal_tx_desc_set_to_fw(hal_tx_desc_cached, 1);
 
 	/* verify checksum offload configuration*/
-	if (vdev->csum_enabled &&
-	    ((qdf_nbuf_get_tx_cksum(tx_desc->nbuf) == QDF_NBUF_TX_CKSUM_TCP_UDP)
-		|| qdf_nbuf_is_tso(tx_desc->nbuf)))  {
+	if ((qdf_nbuf_get_tx_cksum(tx_desc->nbuf) == QDF_NBUF_TX_CKSUM_TCP_UDP)
+		|| qdf_nbuf_is_tso(tx_desc->nbuf))  {
 		hal_tx_desc_set_l3_checksum_en(hal_tx_desc_cached, 1);
 		hal_tx_desc_set_l4_checksum_en(hal_tx_desc_cached, 1);
 	}
@@ -4117,15 +4116,18 @@ dp_tx_update_peer_stats(struct dp_tx_desc_s *tx_desc,
 	DP_STATS_INCC(peer, tx.stbc, 1, ts->stbc);
 	DP_STATS_INCC(peer, tx.ldpc, 1, ts->ldpc);
 	DP_STATS_INCC(peer, tx.retries, 1, ts->transmit_cnt > 1);
+
 #if defined(FEATURE_PERPKT_INFO) && WDI_EVENT_ENABLE
 	dp_wdi_event_handler(WDI_EVENT_UPDATE_DP_STATS, pdev->soc,
 			     &peer->stats, ts->peer_id,
 			     UPDATE_PEER_STATS, pdev->pdev_id);
 #endif
-	if (ts->first_msdu)
+	if (ts->first_msdu) {
 		DP_STATS_INCC(peer, tx.mpdu_success_with_retries,
 			      qdf_do_div(ts->transmit_cnt, DP_RETRY_COUNT),
 			      ts->transmit_cnt > DP_RETRY_COUNT);
+		DP_STATS_INCC(peer, tx.retries_mpdu, 1, ts->transmit_cnt > 1);
+	}
 }
 
 #ifdef QCA_LL_TX_FLOW_CONTROL_V2
@@ -5015,30 +5017,6 @@ qdf_nbuf_t dp_tx_non_std(struct cdp_soc_t *soc_hdl, uint8_t vdev_id,
 }
 #endif
 
-static void dp_tx_vdev_update_feature_flags(struct dp_vdev *vdev)
-{
-	struct wlan_cfg_dp_soc_ctxt *cfg;
-
-	struct dp_soc *soc;
-
-	soc = vdev->pdev->soc;
-	if (!soc)
-		return;
-
-	cfg = soc->wlan_cfg_ctx;
-	if (!cfg)
-		return;
-
-	if (vdev->opmode == wlan_op_mode_ndi)
-		vdev->csum_enabled = wlan_cfg_get_nan_checksum_offload(cfg);
-	else if ((vdev->subtype == wlan_op_subtype_p2p_device) ||
-		 (vdev->subtype == wlan_op_subtype_p2p_cli) ||
-		 (vdev->subtype == wlan_op_subtype_p2p_go))
-		vdev->csum_enabled = wlan_cfg_get_p2p_checksum_offload(cfg);
-	else
-		vdev->csum_enabled = wlan_cfg_get_checksum_offload(cfg);
-}
-
 /**
  * dp_tx_vdev_attach() - attach vdev to dp tx
  * @vdev: virtual device instance
@@ -5070,8 +5048,6 @@ QDF_STATUS dp_tx_vdev_attach(struct dp_vdev *vdev)
 
 	dp_tx_vdev_update_search_flags(vdev);
 
-	dp_tx_vdev_update_feature_flags(vdev);
-
 	return QDF_STATUS_SUCCESS;
 }
 
diff --git a/dp/wifi3.0/dp_tx_flow_control.c b/dp/wifi3.0/dp_tx_flow_control.c
index 341e7945904d..41654aa1e7af 100644
--- a/dp/wifi3.0/dp_tx_flow_control.c
+++ b/dp/wifi3.0/dp_tx_flow_control.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2015-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -73,9 +73,8 @@ dp_tx_initialize_threshold(struct dp_tx_desc_pool_s *pool,
 	pool->stop_th[DP_TH_HI] = (pool->stop_th[DP_TH_BE_BK]
 					* FL_TH_HI_PERCENTAGE) / 100;
 
-	QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
-		  "%s: tx flow control threshold is set, pool size is %d",
-		  __func__, flow_pool_size);
+	dp_info("tx flow control threshold is set, pool size is %d",
+		flow_pool_size);
 }
 
 /**
diff --git a/dp/wifi3.0/dp_types.h b/dp/wifi3.0/dp_types.h
index 87587b070bfc..51184b9f8e87 100644
--- a/dp/wifi3.0/dp_types.h
+++ b/dp/wifi3.0/dp_types.h
@@ -972,6 +972,10 @@ struct dp_soc_stats {
 		uint32_t msdu_scatter_wait_break;
 		/* Number of bar frames received */
 		uint32_t bar_frame;
+		/* Number of frames routed from rxdma */
+		uint32_t rxdma2rel_route_drop;
+		/* Number of frames routed from reo*/
+		uint32_t reo2rel_route_drop;
 
 		struct {
 			/* Invalid RBM error count */
@@ -2579,9 +2583,6 @@ struct dp_vdev {
 	/* IGMP multicast enhancement enabled */
 	uint8_t igmp_mcast_enhanc_en;
 
-	/* HW TX Checksum Enabled Flag */
-	uint8_t csum_enabled;
-
 	/* vdev_id - ID used to specify a particular vdev to the target */
 	uint8_t vdev_id;
 
diff --git a/hal/wifi3.0/qca6750/hal_6750_rx.h b/hal/wifi3.0/qca6750/hal_6750_rx.h
index 2563993227cf..386ad9441a82 100644
--- a/hal/wifi3.0/qca6750/hal_6750_rx.h
+++ b/hal/wifi3.0/qca6750/hal_6750_rx.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -462,6 +463,45 @@ void hal_rx_get_rtt_info_6750(void *rx_tlv,
 	HAL_RX_GET(rx_tlv,
 		   PHYRX_PKT_END_13_RX_PKT_END_DETAILS_RX_LOCATION_INFO_DETAILS,
 		   RESERVED_8);
+	ppdu_info->cfr_info.rx_start_ts =
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_9_RX_PKT_END_DETAILS_RX_LOCATION_INFO_DETAILS,
+		   RX_START_TS);
+
+	ppdu_info->cfr_info.rtt_cfo_measurement = (int16_t)
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_13_RX_PKT_END_DETAILS_RX_LOCATION_INFO_DETAILS,
+		   RTT_CFO_MEASUREMENT);
+
+	ppdu_info->cfr_info.agc_gain_info0 =
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_1_RX_PKT_END_DETAILS,
+		   PHY_TIMESTAMP_1_LOWER_32);
+
+	ppdu_info->cfr_info.agc_gain_info1 =
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_2_RX_PKT_END_DETAILS,
+		   PHY_TIMESTAMP_1_UPPER_32);
+
+	ppdu_info->cfr_info.agc_gain_info2 =
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_3_RX_PKT_END_DETAILS,
+		   PHY_TIMESTAMP_2_LOWER_32);
+
+	ppdu_info->cfr_info.agc_gain_info3 =
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_4_RX_PKT_END_DETAILS,
+		   PHY_TIMESTAMP_2_UPPER_32);
+
+	ppdu_info->cfr_info.mcs_rate =
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_8_RX_PKT_END_DETAILS_RX_LOCATION_INFO_DETAILS,
+		   RTT_MCS_RATE);
+
+	ppdu_info->cfr_info.gi_type =
+	HAL_RX_GET(rx_tlv,
+		   PHYRX_PKT_END_8_RX_PKT_END_DETAILS_RX_LOCATION_INFO_DETAILS,
+		   RTT_GI_TYPE);
 }
 #endif
 #endif
diff --git a/hif/inc/hif.h b/hif/inc/hif.h
index 9786f4aa6d4e..e338ed73800c 100644
--- a/hif/inc/hif.h
+++ b/hif/inc/hif.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1656,6 +1657,36 @@ ssize_t hif_ce_en_desc_hist(struct hif_softc *scn,
 				const char *buf, size_t size);
 ssize_t hif_disp_ce_enable_desc_data_hist(struct hif_softc *scn, char *buf);
 ssize_t hif_dump_desc_event(struct hif_softc *scn, char *buf);
+/**
+ * hif_ce_debug_history_prealloc_init() - alloc ce debug history memory
+ *
+ * alloc ce debug history memory with driver init, so such memory can
+ * be existed even after stop module.
+ * on ini value.
+ *
+ * Return: QDF_STATUS_SUCCESS for success, other for fail.
+ */
+QDF_STATUS hif_ce_debug_history_prealloc_init(void);
+/**
+ * hif_ce_debug_history_prealloc_deinit() - free ce debug history memory
+ *
+ * free ce debug history memory when driver deinit.
+ *
+ * Return: QDF_STATUS_SUCCESS for success, other for fail.
+ */
+QDF_STATUS hif_ce_debug_history_prealloc_deinit(void);
+#else
+static inline
+QDF_STATUS hif_ce_debug_history_prealloc_init(void)
+{
+	return QDF_STATUS_SUCCESS;
+}
+
+static inline
+QDF_STATUS hif_ce_debug_history_prealloc_deinit(void)
+{
+	return QDF_STATUS_SUCCESS;
+}
 #endif/*#if defined(HIF_CONFIG_SLUB_DEBUG_ON)||defined(HIF_CE_DEBUG_DATA_BUF)*/
 
 /**
diff --git a/hif/src/ce/ce_assignment.h b/hif/src/ce/ce_assignment.h
index 14adecfeb3bf..1d911f9a6391 100644
--- a/hif/src/ce/ce_assignment.h
+++ b/hif/src/ce/ce_assignment.h
@@ -1263,9 +1263,9 @@ static struct CE_attr host_ce_config_wlan_qca6490[] = {
 	/* target->host HTT + HTC control */
 	{ /* CE1 */ CE_ATTR_FLAGS, 0, 0,  2048, 512, NULL,},
 	/* target->host WMI */
-	{ /* CE2 */ CE_ATTR_FLAGS, 0, 0,  3200, 64, NULL,},
+	{ /* CE2 */ CE_ATTR_FLAGS, 0, 0,  3520, 64, NULL,},
 	/* host->target WMI */
-	{ /* CE3 */ CE_ATTR_FLAGS, 0, 32, 2048, 0, NULL,},
+	{ /* CE3 */ CE_ATTR_FLAGS, 0, 32, 3520, 0, NULL,},
 	/* host->target HTT */
 	{ /* CE4 */ (CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,
 		CE_HTT_H2T_MSG_SRC_NENTRIES_QCA6490, 256, 0, NULL,},
@@ -1288,9 +1288,9 @@ static struct CE_pipe_config target_ce_config_wlan_qca6490[] = {
 	/* target->host HTT */
 	{ /* CE1 */ 1, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
 	/* target->host WMI  + HTC control */
-	{ /* CE2 */ 2, PIPEDIR_IN,  32, 3200, CE_ATTR_FLAGS, 0,},
+	{ /* CE2 */ 2, PIPEDIR_IN,  32, 3520, CE_ATTR_FLAGS, 0,},
 	/* host->target WMI */
-	{ /* CE3 */ 3, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
+	{ /* CE3 */ 3, PIPEDIR_OUT, 32, 3520, CE_ATTR_FLAGS, 0,},
 	/* host->target HTT */
 	{ /* CE4 */ 4, PIPEDIR_OUT, 256, 256,
 		(CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,},
@@ -1313,9 +1313,9 @@ static struct CE_attr host_ce_config_wlan_qca6750[] = {
 	/* target->host HTT + HTC control */
 	{ /* CE1 */ CE_ATTR_FLAGS, 0, 0,  2048, 512, NULL,},
 	/* target->host WMI */
-	{ /* CE2 */ CE_ATTR_FLAGS | CE_ATTR_HI_TASKLET, 0, 0,  2048, 32, NULL,},
+	{ /* CE2 */ CE_ATTR_FLAGS | CE_ATTR_HI_TASKLET, 0, 0,  3520, 32, NULL,},
 	/* host->target WMI */
-	{ /* CE3 */ CE_ATTR_FLAGS, 0, 32, 2048, 0, NULL,},
+	{ /* CE3 */ CE_ATTR_FLAGS, 0, 32, 3520, 0, NULL,},
 	/* host->target HTT */
 	{ /* CE4 */ (CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,
 		CE_HTT_H2T_MSG_SRC_NENTRIES, 256, 0, NULL,},
@@ -1343,9 +1343,9 @@ static struct CE_pipe_config target_ce_config_wlan_qca6750[] = {
 	/* target->host HTT */
 	{ /* CE1 */ 1, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
 	/* target->host WMI  + HTC control */
-	{ /* CE2 */ 2, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
+	{ /* CE2 */ 2, PIPEDIR_IN,  32, 3520, CE_ATTR_FLAGS, 0,},
 	/* host->target WMI */
-	{ /* CE3 */ 3, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
+	{ /* CE3 */ 3, PIPEDIR_OUT, 32, 3520, CE_ATTR_FLAGS, 0,},
 	/* host->target HTT */
 	{ /* CE4 */ 4, PIPEDIR_OUT, 256, 256,
 		(CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,},
diff --git a/hif/src/ce/ce_main.c b/hif/src/ce/ce_main.c
index 9a0dd3f17d0e..1fc8bb03c7fe 100644
--- a/hif/src/ce/ce_main.c
+++ b/hif/src/ce/ce_main.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1412,6 +1413,7 @@ QDF_STATUS alloc_mem_ce_debug_hist_data(struct hif_softc *scn, uint32_t ce_id)
 			(uint8_t *)qdf_mem_malloc(CE_DEBUG_MAX_DATA_BUF_SIZE);
 		if (!event->data) {
 			hif_err_rl("ce debug data alloc failed");
+			scn->hif_ce_desc_hist.data_enable[ce_id] = false;
 			return QDF_STATUS_E_NOMEM;
 		}
 	}
@@ -1451,7 +1453,72 @@ void free_mem_ce_debug_hist_data(struct hif_softc *scn, uint32_t ce_id)
 
 #ifndef HIF_CE_DEBUG_DATA_DYNAMIC_BUF
 #if defined(HIF_CONFIG_SLUB_DEBUG_ON) || defined(HIF_CE_DEBUG_DATA_BUF)
-struct hif_ce_desc_event hif_ce_desc_history[CE_COUNT_MAX][HIF_CE_HISTORY_MAX];
+struct hif_ce_desc_event *hif_ce_desc_history[CE_COUNT_MAX];
+
+/* define this variable for crashscope parse */
+uint32_t hif_ce_history_max = HIF_CE_HISTORY_MAX;
+
+/**
+ * hif_ce_debug_only_enable_ce2_ce3() - if only enable ce2/ce3 debug
+ * This is different config for perf/debug buid version.
+ * for debug build, it will enable ce history for all ce, but for
+ * perf build(if CONFIG_SLUB_DEBUG_ON is N), it only enable for
+ * ce2(wmi event) & ce3(wmi cmd) history.
+ *
+ * Return: true if only enable ce2/ce3 debug, otherwise false.
+ */
+#if defined(CONFIG_SLUB_DEBUG_ON)
+static inline bool hif_ce_debug_only_enable_ce2_ce3(void)
+{
+	return false;
+}
+#else
+static inline bool hif_ce_debug_only_enable_ce2_ce3(void)
+{
+	return true;
+}
+#endif
+
+QDF_STATUS hif_ce_debug_history_prealloc_deinit(void)
+{
+	int ce_id;
+
+	for (ce_id = 0; ce_id < CE_COUNT_MAX; ce_id++) {
+		if (hif_ce_desc_history[ce_id]) {
+			qdf_mem_free(hif_ce_desc_history[ce_id]);
+			hif_ce_desc_history[ce_id] = NULL;
+		}
+	}
+	hif_debug("ce debug memory freed");
+
+	return QDF_STATUS_SUCCESS;
+}
+
+QDF_STATUS hif_ce_debug_history_prealloc_init(void)
+{
+	int ce_id;
+
+	hif_debug("alloc ce debug memory, only_ce2/ce3 %d",
+		  hif_ce_debug_only_enable_ce2_ce3());
+	for (ce_id = 0; ce_id < CE_COUNT_MAX; ce_id++) {
+		if (hif_ce_debug_only_enable_ce2_ce3() &&
+		    ce_id != CE_ID_2 &&
+		    ce_id != CE_ID_3) {
+			hif_ce_desc_history[ce_id] = NULL;
+			continue;
+		}
+
+		hif_ce_desc_history[ce_id] =
+			qdf_mem_malloc(HIF_CE_HISTORY_MAX *
+				       sizeof(struct hif_ce_desc_event));
+		if (!hif_ce_desc_history[ce_id]) {
+			hif_ce_debug_history_prealloc_deinit();
+			return QDF_STATUS_E_NOMEM;
+		}
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
 
 /**
  * alloc_mem_ce_debug_history() - Allocate CE descriptor history
@@ -1465,14 +1532,33 @@ alloc_mem_ce_debug_history(struct hif_softc *scn, unsigned int ce_id,
 			   uint32_t src_nentries)
 {
 	struct ce_desc_hist *ce_hist = &scn->hif_ce_desc_hist;
+	QDF_STATUS status = QDF_STATUS_SUCCESS;
 
-	ce_hist->hist_ev[ce_id] = hif_ce_desc_history[ce_id];
-	ce_hist->enable[ce_id] = 1;
-
-	if (src_nentries)
-		alloc_mem_ce_debug_hist_data(scn, ce_id);
-	else
+	if (hif_ce_debug_only_enable_ce2_ce3() &&
+	    ce_id != CE_ID_2 &&
+	    ce_id != CE_ID_3) {
+		ce_hist->enable[ce_id] = false;
 		ce_hist->data_enable[ce_id] = false;
+		return QDF_STATUS_SUCCESS;
+	}
+
+	if (!hif_ce_desc_history[ce_id]) {
+		hif_err("prealloc memory failed");
+		return QDF_STATUS_E_NOMEM;
+	}
+	ce_hist->hist_ev[ce_id] = hif_ce_desc_history[ce_id];
+	ce_hist->enable[ce_id] = true;
+
+	if (src_nentries) {
+		status = alloc_mem_ce_debug_hist_data(scn, ce_id);
+		if (status != QDF_STATUS_SUCCESS) {
+			ce_hist->enable[ce_id] = false;
+			ce_hist->hist_ev[ce_id] = NULL;
+			return status;
+		}
+	} else {
+		ce_hist->data_enable[ce_id] = false;
+	}
 
 	return QDF_STATUS_SUCCESS;
 }
@@ -1488,7 +1574,10 @@ static void free_mem_ce_debug_history(struct hif_softc *scn, unsigned int ce_id)
 {
 	struct ce_desc_hist *ce_hist = &scn->hif_ce_desc_hist;
 
-	ce_hist->enable[ce_id] = 0;
+	if (!ce_hist->enable[ce_id])
+		return;
+
+	ce_hist->enable[ce_id] = false;
 	if (ce_hist->data_enable[ce_id]) {
 		ce_hist->data_enable[ce_id] = false;
 		free_mem_ce_debug_hist_data(scn, ce_id);
@@ -1538,7 +1627,7 @@ static void free_mem_ce_debug_history(struct hif_softc *scn, unsigned int CE_id)
 		free_mem_ce_debug_hist_data(scn, CE_id);
 	}
 
-	ce_hist->enable[CE_id] = 0;
+	ce_hist->enable[CE_id] = false;
 	qdf_mem_free(ce_hist->hist_ev[CE_id]);
 	ce_hist->hist_ev[CE_id] = NULL;
 }
diff --git a/hif/src/hif_main.h b/hif/src/hif_main.h
index e6bcaaba16d7..5dbea7f4ab4a 100644
--- a/hif/src/hif_main.h
+++ b/hif/src/hif_main.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -166,7 +167,7 @@ struct hif_latency_detect {
 #if defined(HIF_CONFIG_SLUB_DEBUG_ON) || defined(HIF_CE_DEBUG_DATA_BUF)
 struct ce_desc_hist {
 	qdf_atomic_t history_index[CE_COUNT_MAX];
-	uint32_t enable[CE_COUNT_MAX];
+	bool enable[CE_COUNT_MAX];
 	bool data_enable[CE_COUNT_MAX];
 	qdf_mutex_t ce_dbg_datamem_lock[CE_COUNT_MAX];
 	uint32_t hist_index;
diff --git a/hif/src/hif_runtime_pm.c b/hif/src/hif_runtime_pm.c
index 061558aca878..b6f76644901b 100644
--- a/hif/src/hif_runtime_pm.c
+++ b/hif/src/hif_runtime_pm.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -1366,6 +1367,7 @@ static int __hif_pm_runtime_prevent_suspend(struct hif_softc *scn,
 		return 0;
 
 	ret = __hif_pm_runtime_get(dev);
+	hif_debug("request runtime PM resume, rtpm_dbgid %s", lock->name);
 
 	/**
 	 * The ret can be -EINPROGRESS, if Runtime status is RPM_RESUMING or
diff --git a/hif/src/ipcie/if_ipci.c b/hif/src/ipcie/if_ipci.c
index 8be39b1aa248..349ab37bcb29 100644
--- a/hif/src/ipcie/if_ipci.c
+++ b/hif/src/ipcie/if_ipci.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -115,21 +116,14 @@ static int hif_ce_msi_map_ce_to_irq(struct hif_softc *scn, int ce_id)
 int hif_ipci_bus_configure(struct hif_softc *hif_sc)
 {
 	int status = 0;
-	struct HIF_CE_state *hif_state = HIF_GET_CE_STATE(hif_sc);
 	uint8_t wake_ce_id;
 
 	hif_ce_prepare_config(hif_sc);
 
-	/* initialize sleep state adjust variables */
-	hif_state->sleep_timer_init = true;
-	hif_state->keep_awake_count = 0;
-	hif_state->fake_sleep = false;
-	hif_state->sleep_ticks = 0;
-
 	status = hif_wlan_enable(hif_sc);
 	if (status) {
 		hif_err("hif_wlan_enable error = %d", status);
-		goto timer_free;
+		return status;
 	}
 
 	A_TARGET_ACCESS_LIKELY(hif_sc);
@@ -162,11 +156,6 @@ disable_wlan:
 	A_TARGET_ACCESS_UNLIKELY(hif_sc);
 	hif_wlan_disable(hif_sc);
 
-timer_free:
-	qdf_timer_stop(&hif_state->sleep_timer);
-	qdf_timer_free(&hif_state->sleep_timer);
-	hif_state->sleep_timer_init = false;
-
 	hif_err("Failed, status = %d", status);
 	return status;
 }
@@ -905,6 +894,14 @@ int hif_prevent_link_low_power_states(struct hif_opaque_softc *hif)
 	if (pld_is_pci_ep_awake(scn->qdf_dev->dev) == -ENOTSUPP)
 		return 0;
 
+	if ((qdf_atomic_read(&scn->dp_ep_vote_access) ==
+	     HIF_EP_VOTE_ACCESS_DISABLE) &&
+	    (qdf_atomic_read(&scn->ep_vote_access) ==
+	    HIF_EP_VOTE_ACCESS_DISABLE)) {
+		hif_info_high("EP access disabled in flight skip vote");
+		return 0;
+	}
+
 	start_time = curr_time = qdf_system_ticks_to_msecs(qdf_system_ticks());
 	while (pld_is_pci_ep_awake(scn->qdf_dev->dev) &&
 	       curr_time <= start_time + EP_WAKE_RESET_DELAY_TIMEOUT_MS) {
diff --git a/target_if/cfr/src/target_if_cfr.c b/target_if/cfr/src/target_if_cfr.c
index dce4c5c37a7a..3601054b0d1c 100644
--- a/target_if/cfr/src/target_if_cfr.c
+++ b/target_if/cfr/src/target_if_cfr.c
@@ -227,7 +227,8 @@ void target_if_cfr_fill_header(struct csi_cfr_header *hdr,
 		hdr->cmn.chip_type = CFR_CAPTURE_RADIO_HKV2;
 	} else {
 		if (target_type == TARGET_TYPE_QCN9000 ||
-		    target_type == TARGET_TYPE_QCA6490)
+		    target_type == TARGET_TYPE_QCA6490 ||
+		    target_type == TARGET_TYPE_QCA6750)
 			hdr->cmn.cfr_metadata_version = CFR_META_VERSION_7;
 		else if ((target_type == TARGET_TYPE_QCA6018) ||
 			 ((target_type == TARGET_TYPE_QCA5018) && (!is_rcc)))
diff --git a/umac/regulatory/core/src/reg_build_chan_list.c b/umac/regulatory/core/src/reg_build_chan_list.c
index 1e781c36e7c2..d20271009038 100644
--- a/umac/regulatory/core/src/reg_build_chan_list.c
+++ b/umac/regulatory/core/src/reg_build_chan_list.c
@@ -1988,6 +1988,30 @@ QDF_STATUS reg_process_master_chan_list_ext(
 
 	return QDF_STATUS_SUCCESS;
 }
+
+QDF_STATUS reg_get_6g_ap_master_chan_list(struct wlan_objmgr_pdev *pdev,
+					  enum reg_6g_ap_type ap_pwr_type,
+					  struct regulatory_channel *chan_list)
+{
+	struct wlan_regulatory_pdev_priv_obj *pdev_priv_obj;
+	struct regulatory_channel *master_chan_list_6g;
+
+	pdev_priv_obj = reg_get_pdev_obj(pdev);
+
+	if (!IS_VALID_PDEV_REG_OBJ(pdev_priv_obj)) {
+		reg_err("reg pdev private obj is NULL");
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	if (ap_pwr_type >= REG_CURRENT_MAX_AP_TYPE)
+		return QDF_STATUS_E_FAILURE;
+
+	master_chan_list_6g = pdev_priv_obj->mas_chan_list_6g_ap[ap_pwr_type];
+	qdf_mem_copy(chan_list, master_chan_list_6g,
+		     NUM_6GHZ_CHANNELS * sizeof(struct regulatory_channel));
+
+	return QDF_STATUS_SUCCESS;
+}
 #endif /* CONFIG_BAND_6GHZ */
 
 QDF_STATUS reg_process_master_chan_list(
diff --git a/umac/regulatory/core/src/reg_build_chan_list.h b/umac/regulatory/core/src/reg_build_chan_list.h
index 4245e3a73c9f..3b1923903e97 100644
--- a/umac/regulatory/core/src/reg_build_chan_list.h
+++ b/umac/regulatory/core/src/reg_build_chan_list.h
@@ -88,7 +88,29 @@ void reg_propagate_mas_chan_list_to_pdev(struct wlan_objmgr_psoc *psoc,
  */
 QDF_STATUS
 reg_process_master_chan_list_ext(struct cur_regulatory_info *reg_info);
-#endif
+
+/**
+ * reg_get_6g_ap_master_chan_list() - Get  an ap  master channel list depending
+ * on * ap power type
+ * @ap_pwr_type: Power type (LPI/VLP/SP)
+ * @chan_list: Pointer to the channel list. The output channel list
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS reg_get_6g_ap_master_chan_list(struct wlan_objmgr_pdev *pdev,
+					  enum reg_6g_ap_type ap_pwr_type,
+					  struct regulatory_channel *chan_list);
+
+#else /* CONFIG_BAND_6GHZ */
+static inline QDF_STATUS
+reg_get_6g_ap_master_chan_list(struct wlan_objmgr_pdev *pdev,
+			       enum reg_6g_ap_type ap_pwr_type,
+			       struct regulatory_channel *chan_list)
+{
+	return QDF_STATUS_E_FAILURE;
+}
+#endif /* CONFIG_BAND_6GHZ */
+
 /**
  * reg_process_master_chan_list() - Compute master channel list based on the
  * regulatory rules.
diff --git a/umac/regulatory/dispatcher/inc/wlan_reg_services_api.h b/umac/regulatory/dispatcher/inc/wlan_reg_services_api.h
index 1b0a7875208c..711d673bc046 100644
--- a/umac/regulatory/dispatcher/inc/wlan_reg_services_api.h
+++ b/umac/regulatory/dispatcher/inc/wlan_reg_services_api.h
@@ -227,6 +227,19 @@ static inline bool wlan_reg_is_range_overlap_6g(qdf_freq_t low_freq,
 }
 #endif
 
+/**
+ * wlan_reg_get_6g_ap_master_chan_list() - provide  the appropriate ap master
+ * channel list
+ * @pdev: pdev pointer
+ * @ap_pwr_type: The ap power type (LPI/VLP/SP)
+ * @chan_list: channel list pointer
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS wlan_reg_get_6g_ap_master_chan_list(
+					struct wlan_objmgr_pdev *pdev,
+					enum reg_6g_ap_type ap_pwr_type,
+					struct regulatory_channel *chan_list);
 /**
  * wlan_reg_is_6ghz_psc_chan_freq() - Check if the given 6GHz channel frequency
  * is preferred scanning channel frequency.
@@ -337,6 +350,14 @@ wlan_reg_get_max_txpower_for_6g_tpe(struct wlan_objmgr_pdev *pdev,
 {
 	return QDF_STATUS_E_FAILURE;
 }
+
+static inline QDF_STATUS
+wlan_reg_get_6g_ap_master_chan_list(struct wlan_objmgr_pdev *pdev,
+				    enum reg_6g_ap_type ap_pwr_type,
+				    struct regulatory_channel *chan_list)
+{
+	return QDF_STATUS_E_FAILURE;
+}
 #endif /* CONFIG_BAND_6GHZ */
 
 /**
diff --git a/umac/regulatory/dispatcher/src/wlan_reg_services_api.c b/umac/regulatory/dispatcher/src/wlan_reg_services_api.c
index ddd2f93b61c8..4251c50326e5 100644
--- a/umac/regulatory/dispatcher/src/wlan_reg_services_api.c
+++ b/umac/regulatory/dispatcher/src/wlan_reg_services_api.c
@@ -476,6 +476,16 @@ regulatory_assign_unregister_master_ext_handler(struct wlan_objmgr_psoc *psoc,
 	if (tx_ops->unregister_master_ext_handler)
 		tx_ops->unregister_master_ext_handler(psoc, NULL);
 }
+
+QDF_STATUS wlan_reg_get_6g_ap_master_chan_list(
+					struct wlan_objmgr_pdev *pdev,
+					enum reg_6g_ap_type ap_pwr_type,
+					struct regulatory_channel *chan_list)
+{
+	return  reg_get_6g_ap_master_chan_list(pdev, ap_pwr_type, chan_list);
+}
+
+qdf_export_symbol(wlan_reg_get_6g_ap_master_chan_list);
 #else
 static inline void
 regulatory_assign_register_master_ext_handler(struct wlan_objmgr_psoc *psoc,
diff --git a/wmi/src/wmi_unified.c b/wmi/src/wmi_unified.c
index 5c9ba8e5166c..7bed514cbdb7 100644
--- a/wmi/src/wmi_unified.c
+++ b/wmi/src/wmi_unified.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2015-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1648,7 +1649,10 @@ wmi_buf_alloc_debug(wmi_unified_t wmi_handle, uint32_t len,
 {
 	wmi_buf_t wmi_buf;
 
-	if (roundup(len + sizeof(WMI_CMD_HDR), 4) > wmi_handle->max_msg_len) {
+	if (roundup(len, 4) > wmi_handle->max_msg_len) {
+		wmi_err("Invalid length %u (via %s:%u) max size: %u",
+			len, func_name, line_num,
+			wmi_handle->max_msg_len);
 		QDF_ASSERT(0);
 		return NULL;
 	}
@@ -1689,9 +1693,9 @@ wmi_buf_t wmi_buf_alloc_fl(wmi_unified_t wmi_handle, uint32_t len,
 {
 	wmi_buf_t wmi_buf;
 
-	if (roundup(len + sizeof(WMI_CMD_HDR), 4) > wmi_handle->max_msg_len) {
-		QDF_DEBUG_PANIC("Invalid length %u (via %s:%u)",
-				len, func, line);
+	if (roundup(len, 4) > wmi_handle->max_msg_len) {
+		QDF_DEBUG_PANIC("Invalid length %u (via %s:%u) max size: %u",
+				len, func, line, wmi_handle->max_msg_len);
 		return NULL;
 	}
 
@@ -3567,6 +3571,7 @@ void wmi_set_target_suspend(wmi_unified_t wmi_handle, A_BOOL val)
 void wmi_set_target_suspend_acked(wmi_unified_t wmi_handle, A_BOOL val)
 {
 	qdf_atomic_set(&wmi_handle->is_target_suspend_acked, val);
+	qdf_atomic_set(&wmi_handle->num_stats_over_qmi, 0);
 }
 
 /**
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c
index df3781218048..23487b0be26b 100644
--- a/wmi/src/wmi_unified_tlv.c
+++ b/wmi/src/wmi_unified_tlv.c
@@ -3194,13 +3194,15 @@ static void wmi_scan_chanlist_dump(struct scan_chan_list_params *scan_chan_list)
 	for (i = 0; i < scan_chan_list->nallchans; i++) {
 		chan = &scan_chan_list->ch_param[i];
 		ret = qdf_scnprintf(info + len, sizeof(info) - len,
-				    " %d[%d][%d]", chan->mhz, chan->maxregpower,
-				    chan->dfs_set);
+				    " %d[%d][%d][%d]", chan->mhz,
+				    chan->maxregpower,
+				    chan->dfs_set, chan->nan_disabled);
 		if (ret <= 0)
 			break;
 		len += ret;
 		if (len >= (sizeof(info) - 20)) {
-			wmi_nofl_debug("Chan[TXPwr][DFS]:%s", info);
+			wmi_nofl_debug("Chan[TXPwr][DFS][nan_disabled]:%s",
+				       info);
 			len = 0;
 		}
 	}