diff --git a/hif/src/ce/ce_assignment.h b/hif/src/ce/ce_assignment.h
index a0790e6bb3a6..d5feb2621cf3 100644
--- a/hif/src/ce/ce_assignment.h
+++ b/hif/src/ce/ce_assignment.h
@@ -49,8 +49,9 @@ ATH_DEBUG_INSTANTIATE_MODULE_VAR(hif, "hif", "PCIe Host Interface",
 #endif
 
 #ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+/* globals are initialized to 0 by the compiler */;
 spinlock_t pcie_access_log_lock;
-unsigned int pcie_access_log_seqnum = 0;
+unsigned int pcie_access_log_seqnum;
 HIF_ACCESS_LOG pcie_access_log[PCIE_ACCESS_LOG_NUM];
 static void hif_target_dump_access_log(void);
 #endif
@@ -94,9 +95,11 @@ static struct CE_attr host_ce_config_wlan[] = {
 		2, DIAG_TRANSFER_LIMIT, 2, NULL,},
 	/* Target to uMC */
 	{ /* CE8 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
-	/* The following CEs are not being used yet */
-	{ /* CE9 */ CE_ATTR_FLAGS, 0, 0,  0, 0, NULL,},
-	{ /* CE10 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
+	/* target->host HTT */
+	{ /* CE9 */ CE_ATTR_FLAGS, 0, 0,  2048, 512, NULL,},
+	/* target->host HTT */
+	{ /* CE10 */ CE_ATTR_FLAGS, 0, 0,  2048, 512, NULL,},
+	/*The following CEs are not being used yet */
 	{ /* CE11 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
 };
 
@@ -123,10 +126,12 @@ static struct CE_pipe_config target_ce_config_wlan[] = {
 		(CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,},
 	/* CE8 used only by IPA */
 	{ /* CE8 */ 8, PIPEDIR_IN, 32, 2048, CE_ATTR_FLAGS, 0,},
-	/* The following CEs are not being used yet*/
-	{ /* CE9 */ 9, PIPEDIR_IN,  0, 0, CE_ATTR_FLAGS, 0,},
-	{ /* CE10 */ 9, PIPEDIR_IN,  0, 0, CE_ATTR_FLAGS, 0,},
-	{ /* CE11 */ 9, PIPEDIR_IN,  0, 0, CE_ATTR_FLAGS, 0,},
+	/* CE9 target->host HTT */
+	{ /* CE9 */ 9, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
+	/* CE10 target->host HTT */
+	{ /* CE10 */ 10, PIPEDIR_IN,  32, 2048, CE_ATTR_FLAGS, 0,},
+	/*The following CEs are not being used yet*/
+	{ /* CE11 */ 11, PIPEDIR_IN,  0, 0, CE_ATTR_FLAGS, 0,},
 };
 
 static struct CE_attr host_ce_config_wlan_epping_poll[] = {
diff --git a/hif/src/ce/ce_main.c b/hif/src/ce/ce_main.c
index 6c99148cb949..0e70c5b2bcfc 100644
--- a/hif/src/ce/ce_main.c
+++ b/hif/src/ce/ce_main.c
@@ -115,6 +115,10 @@ static struct shadow_reg_cfg target_shadow_reg_cfg_map[] = {
 	{ 2, ADRASTEA_DST_WR_INDEX_OFFSET},
 	{ 7, ADRASTEA_DST_WR_INDEX_OFFSET},
 	{ 8, ADRASTEA_DST_WR_INDEX_OFFSET},
+#ifdef QCA_WIFI_3_0_ADRASTEA
+	{ 9, ADRASTEA_DST_WR_INDEX_OFFSET},
+	{ 10, ADRASTEA_DST_WR_INDEX_OFFSET},
+#endif
 };
 
 static struct shadow_reg_cfg target_shadow_reg_cfg_epping[] = {
@@ -286,6 +290,18 @@ static struct service_to_pipe target_service_to_ce_map_wlan[] = {
 		PIPEDIR_OUT,    /* in = DL = target -> host */
 		5,
 	},
+#if defined(QCA_WIFI_3_0_ADRASTEA)
+	{
+		HTT_DATA2_MSG_SVC,
+		PIPEDIR_IN,    /* in = DL = target -> host */
+		9,
+	},
+	{
+		HTT_DATA3_MSG_SVC,
+		PIPEDIR_IN,    /* in = DL = target -> host */
+		10,
+	},
+#endif
 	/* (Additions here) */
 
 	{                       /* Must be last */
@@ -2083,8 +2099,9 @@ void hif_ipa_get_ce_resource(struct hif_opaque_softc *hif_ctx,
 u32 shadow_sr_wr_ind_addr(struct hif_softc *scn, u32 ctrl_addr)
 {
 	u32 addr = 0;
+	u32 ce = COPY_ENGINE_ID(ctrl_addr);
 
-	switch (COPY_ENGINE_ID(ctrl_addr)) {
+	switch (ce) {
 	case 0:
 		addr = SHADOW_VALUE0;
 		break;
@@ -2101,10 +2118,8 @@ u32 shadow_sr_wr_ind_addr(struct hif_softc *scn, u32 ctrl_addr)
 		addr = SHADOW_VALUE7;
 		break;
 	default:
-		HIF_ERROR("invalid CE ctrl_addr %d",
-			COPY_ENGINE_ID(ctrl_addr));
+		HIF_ERROR("invalid CE ctrl_addr (CE=%d)", ce);
 		QDF_ASSERT(0);
-
 	}
 	return addr;
 
@@ -2113,8 +2128,9 @@ u32 shadow_sr_wr_ind_addr(struct hif_softc *scn, u32 ctrl_addr)
 u32 shadow_dst_wr_ind_addr(struct hif_softc *scn, u32 ctrl_addr)
 {
 	u32 addr = 0;
+	u32 ce = COPY_ENGINE_ID(ctrl_addr);
 
-	switch (COPY_ENGINE_ID(ctrl_addr)) {
+	switch (ce) {
 	case 1:
 		addr = SHADOW_VALUE13;
 		break;
@@ -2130,9 +2146,14 @@ u32 shadow_dst_wr_ind_addr(struct hif_softc *scn, u32 ctrl_addr)
 	case 8:
 		addr = SHADOW_VALUE20;
 		break;
+	case 9:
+		addr = SHADOW_VALUE21;
+		break;
+	case 10:
+		addr = SHADOW_VALUE22;
+		break;
 	default:
-		HIF_ERROR("invalid CE ctrl_addr %d",
-			COPY_ENGINE_ID(ctrl_addr));
+		HIF_ERROR("invalid CE ctrl_addr (CE=%d)", ce);
 		QDF_ASSERT(0);
 	}
 
diff --git a/htc/htc_services.c b/htc/htc_services.c
index b4ccb7c1f3a7..932bf70fa794 100644
--- a/htc/htc_services.c
+++ b/htc/htc_services.c
@@ -219,10 +219,12 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 						 rsp_msg_serv_id,
 						 rsp_msg_status));
 				status = A_EPROTO;
+/* TODO: restore the ifdef when FW supports services 301 and 302 (HTT_MSG_DATA[23]_MSG_SVC)
 #ifdef QCA_TX_HTT2_SUPPORT
+*/
 				/* Keep work and not to block the control message. */
 				target->CtrlResponseProcessing = false;
-#endif /* QCA_TX_HTT2_SUPPORT */
+/*#endif */ /* QCA_TX_HTT2_SUPPORT */
 				break;
 			}