wl1271: M5.04 Driver update + Android patches

Change-Id: I9f7a3ac7336b88577b572db1016dd33774225744
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
diff --git a/wl1271/CUDK/configurationutility/inc/cu_cmd.h b/wl1271/CUDK/configurationutility/inc/cu_cmd.h
index 67cde77..eb4e4bc 100644
--- a/wl1271/CUDK/configurationutility/inc/cu_cmd.h
+++ b/wl1271/CUDK/configurationutility/inc/cu_cmd.h
@@ -103,6 +103,8 @@
 VOID CuCmd_ScanAppChannelConfig(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_ScanAppClear(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_ScanAppDisplay(THandle hCuCmd, ConParm_t parm[], U16 nParms);
+VOID CuCmd_ScanSetSra(THandle hCuCmd, ConParm_t parm[], U16 nParms);
+VOID CuCmd_ScanSetRssi(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_StartScan(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_StopScan (THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_WextStartScan(THandle hCuCmd, ConParm_t parm[], U16 nParms);
@@ -188,6 +190,8 @@
 VOID CuCmd_SetRateMngDebug(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_GetRateMngDebug(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 
+
+VOID CuCmd_SetArpIPFilter (THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_ShowAbout(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 VOID CuCmd_Quit(THandle hCuCmd, ConParm_t parm[], U16 nParms);
 
diff --git a/wl1271/CUDK/configurationutility/inc/cu_common.h b/wl1271/CUDK/configurationutility/inc/cu_common.h
index 94ac7f1..656dcd7 100644
--- a/wl1271/CUDK/configurationutility/inc/cu_common.h
+++ b/wl1271/CUDK/configurationutility/inc/cu_common.h
@@ -1,7 +1,7 @@
 /*
  * cu_common.h
  *
- * Copyright 2001-2009 Texas Instruments, Inc. - http://www.ti.com/
+ * Copyright 2001-2010 Texas Instruments, Inc. - http://www.ti.com/
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/wl1271/CUDK/configurationutility/makefile b/wl1271/CUDK/configurationutility/makefile
index 02bc28f..70b6d92 100644
--- a/wl1271/CUDK/configurationutility/makefile
+++ b/wl1271/CUDK/configurationutility/makefile
@@ -1,6 +1,7 @@
 STATIC_LIB ?= y
 DEBUG ?= y
 BUILD_SUPPL ?= y
+SUPPL ?= WPA
 WPA_ENTERPRISE ?= y
 XCC ?= n
 #enable/disable wireless simple config (WPS) support
@@ -28,6 +29,9 @@
 ifeq ($(XCC), y)
 	DK_DEFINES = -D XCC_MODULE_INCLUDED 
 endif    
+ifeq ($(GEM), y)
+	DK_DEFINES += -D GEM_SUPPORTED 
+endif  
 ifeq ($(WPA_ENTERPRISE), y)
 	DK_DEFINES += -D WPA_ENTERPRISE
 endif
diff --git a/wl1271/CUDK/configurationutility/src/cu_cmd.c b/wl1271/CUDK/configurationutility/src/cu_cmd.c
index 85f3206..3b7eafe 100644
--- a/wl1271/CUDK/configurationutility/src/cu_cmd.c
+++ b/wl1271/CUDK/configurationutility/src/cu_cmd.c
@@ -1,7 +1,7 @@
 /*
  * cu_cmd.c
  *
- * Copyright 2001-2009 Texas Instruments, Inc. - http://www.ti.com/
+ * Copyright 2001-2010 Texas Instruments, Inc. - http://www.ti.com/
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -297,7 +297,12 @@
     { FILE_ID_130 ,  (PS8)"queue                   " },
     { FILE_ID_131 ,  (PS8)"rate                    " },
     { FILE_ID_132 ,  (PS8)"report                  " },
-    { FILE_ID_133 ,  (PS8)"stack                   " }
+    { FILE_ID_133 ,  (PS8)"stack                   " },
+	{ FILE_ID_134 ,  (PS8)"externalSec             " },
+	{ FILE_ID_135 ,  (PS8)"roamingMngr_autoSM      " },
+	{ FILE_ID_136 ,  (PS8)"roamingMngr_manualSM    " },
+	{ FILE_ID_137 ,  (PS8)"cmdinterpretoid         " },
+	{ FILE_ID_138 ,  (PS8)"WlanDrvIf               " }
 };
 
 static named_value_t report_severity[] = {
@@ -1362,7 +1367,7 @@
 VOID CuCmd_ModifyBssType(THandle hCuCmd, ConParm_t parm[], U16 nParms)
 {
     CuCmd_t* pCuCmd = (CuCmd_t*)hCuCmd;
-    U32 BssType;
+    U32 BssType = 0;
     S32 i;
     
     if( nParms == 0 )
@@ -1403,6 +1408,7 @@
         if(pCuCmd->hWpaCore == NULL)
         {
             CuCommon_SetU32(pCuCmd->hCuCommon, CTRL_DATA_CURRENT_BSS_TYPE_PARAM, BssType);
+            CuCommon_SetU32(pCuCmd->hCuCommon, SME_DESIRED_BSS_TYPE_PARAM, BssType);
         }
         else
         {
@@ -2342,6 +2348,28 @@
     os_error_printf(CU_MSG_INFO2, (PS8)"\n");
 }
 
+VOID CuCmd_ScanSetSra(THandle hCuCmd, ConParm_t parm[], U16 nParms)
+{
+    CuCmd_t* pCuCmd = (CuCmd_t*)hCuCmd;
+
+    if (OK != CuCommon_SetU32(pCuCmd->hCuCommon, SCAN_CNCN_SET_SRA, parm[0].value) )
+    {
+        os_error_printf(CU_MSG_INFO2, (PS8) "Failed setting Scan Result Aging");
+    }
+    os_error_printf(CU_MSG_INFO2, (PS8) "Scan Result Aging set succesfully to %d seconds", parm[0].value);
+}
+
+VOID CuCmd_ScanSetRssi(THandle hCuCmd, ConParm_t parm[], U16 nParms)
+{
+    CuCmd_t* pCuCmd = (CuCmd_t*)hCuCmd;
+
+    if (OK != CuCommon_SetU32(pCuCmd->hCuCommon, SCAN_CNCN_SET_RSSI, parm[0].value) )
+    {
+        os_error_printf(CU_MSG_INFO2, (PS8) "Failed setting Rssi filter threshold");
+    }
+    os_error_printf(CU_MSG_INFO2, (PS8) "Rssi filter set succesfully to %d", parm[0].value);
+}
+
 VOID CuCmd_StartScan(THandle hCuCmd, ConParm_t parm[], U16 nParms)
 {
     CuCmd_t* pCuCmd = (CuCmd_t*)hCuCmd;
@@ -5283,7 +5311,7 @@
 #ifdef _WINDOWS
     PS8 nvsFilePath = (PS8)"/windows/nvs_map.bin";
 #else
-    PS8 nvsFilePath = (PS8)"/system/etc/wifi/nvs_map.bin";
+    PS8 nvsFilePath = (PS8)"./nvs_map.bin";
 #endif /*_WINDOWS*/
 	TI_UINT8		currentNVSbuffer[1500];
 	TI_UINT16		lengthOfCurrentNVSBufer;
@@ -6297,6 +6325,34 @@
     }
 }
 
+
+VOID CuCmd_SetArpIPFilter (THandle hCuCmd, ConParm_t parm[], U16 nParms)
+{
+
+    TIpAddr     staIp;
+    CuCmd_t     *pCuCmd = (CuCmd_t*)hCuCmd;
+    TI_UINT8    length = 4;
+
+    if (length != nParms)
+    {
+        os_error_printf (CU_MSG_ERROR, (PS8)"Error! IP format requires 4 parameters as follows: <Part1> <Part2> <Part3> <Part4>  \n");
+        os_error_printf (CU_MSG_ERROR, (PS8)"Please note! IP of 0 0 0 0 will disable the arp filtering feature \n");
+        return;
+    }
+
+    staIp[0] = (TI_UINT8)parm[0].value;
+    staIp[1] = (TI_UINT8)parm[1].value;
+    staIp[2] = (TI_UINT8)parm[2].value;
+    staIp[3] = (TI_UINT8)parm[3].value;
+
+
+     if (OK != CuCommon_SetBuffer (pCuCmd->hCuCommon, SITE_MGR_SET_WLAN_IP_PARAM, staIp, length))
+    {
+        os_error_printf (CU_MSG_ERROR, (PS8)"Unable to configure ARP IP filter \n");
+    }
+
+}
+
 VOID CuCmd_ShowAbout(THandle hCuCmd, ConParm_t parm[], U16 nParms)
 {
     CuCmd_t* pCuCmd = (CuCmd_t*)hCuCmd;
diff --git a/wl1271/CUDK/configurationutility/src/ticon.c b/wl1271/CUDK/configurationutility/src/ticon.c
index 9e0ce26..1d4baf5 100644
--- a/wl1271/CUDK/configurationutility/src/ticon.c
+++ b/wl1271/CUDK/configurationutility/src/ticon.c
@@ -1,7 +1,7 @@
 /*
  * ticon.c
  *
- * Copyright 2001-2009 Texas Instruments, Inc. - http://www.ti.com/
+ * Copyright 2001-2010 Texas Instruments, Inc. - http://www.ti.com/
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -409,6 +409,17 @@
 	Console_AddToken(pTiCon->hConsole,h1, (PS8)"cLear", (PS8)"Clear All Params", (FuncToken_t) CuCmd_ScanAppClear, NULL );
 	Console_AddToken(pTiCon->hConsole,h1, (PS8)"Display", (PS8)"Display Params", (FuncToken_t) CuCmd_ScanAppDisplay, NULL );
 	
+    {
+        ConParm_t aaa[]  = {
+            {(PS8)"Aging threshold", CON_PARM_RANGE, 0, 1000, 60 } };
+        Console_AddToken(pTiCon->hConsole,h1, (PS8)"Aging", (PS8)"Set aging threshiold", (FuncToken_t) CuCmd_ScanSetSra, aaa );
+    }
+    {
+        ConParm_t aaa[]  = {
+            {(PS8)"Rssi threshold", CON_PARM_RANGE | CON_PARM_SIGN, -100, 0, -80 } };
+        Console_AddToken(pTiCon->hConsole,h1, (PS8)"Rssi", (PS8)"Set rssi threshiold", (FuncToken_t) CuCmd_ScanSetRssi, aaa );
+    }
+
     CHK_NULL(h1 = (THandle) Console_AddDirExt (pTiCon->hConsole, (THandle)h, (PS8)"configpEriodic", (PS8)"Configure Periodic Application Scan" ) );
     {
         ConParm_t aaa[]  = {
@@ -923,7 +934,16 @@
          ConParm_t aaa[]  = { {(PS8)"Index", CON_PARM_OPTIONAL,0,4096,0},
                               {(PS8)"Value", CON_PARM_OPTIONAL,0,4096,0}, CON_LAST_PARM };
           Console_AddToken(pTiCon->hConsole, h1, (PS8)"Get rate managment",  (PS8)"rate managment", (FuncToken_t) CuCmd_GetRateMngDebug, aaa );
+      }
 
+      {
+         ConParm_t aaa[]  = { {(PS8)"IpPart1", CON_PARM_OPTIONAL,0,255,0},
+                              {(PS8)"IpPart2", CON_PARM_OPTIONAL,0,255,0},
+                              {(PS8)"IpPart3", CON_PARM_OPTIONAL,0,255,0},
+                              {(PS8)"IpPart4", CON_PARM_OPTIONAL,0,255,0},
+                              CON_LAST_PARM };
+
+          Console_AddToken(pTiCon->hConsole, h1, (PS8)"set Arp ip filter",  (PS8)"arp ip filter", (FuncToken_t) CuCmd_SetArpIPFilter, aaa );
       }
 
      }
diff --git a/wl1271/CUDK/configurationutility/src/wpa_core.c b/wl1271/CUDK/configurationutility/src/wpa_core.c
index f4b0a86..d008ca2 100644
--- a/wl1271/CUDK/configurationutility/src/wpa_core.c
+++ b/wl1271/CUDK/configurationutility/src/wpa_core.c
@@ -1,7 +1,7 @@
 /*
  * wpa_core.c
  *
- * Copyright 2001-2009 Texas Instruments, Inc. - http://www.ti.com/
+ * Copyright 2001-2010 Texas Instruments, Inc. - http://www.ti.com/
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -160,12 +160,6 @@
 {
 	TWpaCore* pWpaCore = (TWpaCore*)hWpaCore;
 
-#ifdef ANDROID
-	/* Restore configuration back to AP_SCAN 1 for Android */
-	IpcWpa_Command(pWpaCore->hIpcWpa, (PS8)"AP_SCAN 1", FALSE);
-	IpcWpa_Command(pWpaCore->hIpcWpa, (PS8)"SAVE_CONFIG", FALSE);
-#endif
-
 	if(pWpaCore->hIpcWpa)
 		IpcWpa_Destroy(pWpaCore->hIpcWpa);
 #ifdef CONFIG_WPS
diff --git a/wl1271/TWD/Ctrl/CmdBld.c b/wl1271/TWD/Ctrl/CmdBld.c
index 2ef38ef..82b3d0c 100644
--- a/wl1271/TWD/Ctrl/CmdBld.c
+++ b/wl1271/TWD/Ctrl/CmdBld.c
@@ -1,7 +1,7 @@
 /*
  * CmdBld.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -297,6 +297,9 @@
 
     pDmaParams->PacketMemoryPoolStart = (TI_UINT32)pMemMap->packetMemoryPoolStart;
 
+    /* Indicate that the reconfig process is over. */
+    pCmdBld->bReconfigInProgress = TI_FALSE;
+
     /* Call the upper layer callback */
     (*((TConfigFwCb)pCmdBld->fConfigFwCb)) (pCmdBld->hConfigFwCb, TI_OK);
 }
@@ -320,6 +323,7 @@
     pCmdBld->fConfigFwCb = fConfigFwCb;
     pCmdBld->hConfigFwCb = hConfigFwCb; 
     pCmdBld->uIniSeq = 0;
+    pCmdBld->bReconfigInProgress = TI_TRUE;
     /* should be re-initialized for recovery,   pCmdBld->uLastElpCtrlMode = ELPCTRL_MODE_KEEP_AWAKE; */
 
     /* Start configuration sequence */
@@ -378,23 +382,6 @@
 }
 
 
-static TI_STATUS __cmd_smart_reflex_debug (TI_HANDLE hCmdBld)
-{
-    return cmdBld_CfgIeSRDebug (hCmdBld,
-							   &(DB_SR(hCmdBld).tSmartReflexDebugParams),
-							   (void *)cmdBld_ConfigSeq,
-							   hCmdBld);
-}
-
-
-static TI_STATUS __cmd_smart_reflex_state (TI_HANDLE hCmdBld)
-{
-	return cmdBld_CfgIeSRState (hCmdBld,
-							   (uint8) DB_SR(hCmdBld).tSmartReflexState.enable,
-							   (void *)cmdBld_ConfigSeq,
-							   hCmdBld);
-}
-
 static TI_STATUS __cmd_disconn (TI_HANDLE hCmdBld)
 {
     return cmdBld_CmdIeConfigureTemplateFrame (hCmdBld, 
@@ -790,7 +777,7 @@
 {
     return cmdBld_CfgIeArpIpFilter (hCmdBld, 
                                     DB_WLAN(hCmdBld).arp_IP_addr, 
-                                    (TI_BOOL)DB_WLAN(hCmdBld).arpFilterType, 
+                                    (EArpFilterType)DB_WLAN(hCmdBld).arpFilterType, 
                                     (void *)cmdBld_ConfigSeq, 
                                     hCmdBld);
 }
@@ -935,7 +922,7 @@
 static TI_STATUS __cfg_cca_threshold (TI_HANDLE hCmdBld)
 {
     return cmdBld_CfgIeCcaThreshold (hCmdBld, 
-                                     DB_WLAN(hCmdBld).EnergyDetection, 
+                                     DB_WLAN(hCmdBld).ch14TelecCca, 
                                      (void *)cmdBld_ConfigSeq, 
                                      hCmdBld);
 }
@@ -1166,6 +1153,16 @@
                                     hCmdBld);
 }
 
+
+static TI_STATUS __cfg_extended_radio_params (TI_HANDLE hCmdBld)
+{
+    return cmdBld_CfgIeExtendedRadioParams (hCmdBld,
+											&DB_EXT_RADIO(hCmdBld),
+											(void *)cmdBld_ConfigSeq,
+											hCmdBld);
+}
+
+
 static TI_STATUS __cfg_platform_params (TI_HANDLE hCmdBld)
 {
     return cmdBld_CfgPlatformGenParams(hCmdBld, 
@@ -1472,7 +1469,7 @@
          * Call the hardware to start/join the bss 
          */
         return cmdBld_CmdStartJoin (hCmdBld, 
-                                    DB_BSS(hCmdBld).ReqBssType, 
+                                    (ScanBssType_e)DB_BSS(hCmdBld).ReqBssType, 
                                     (void *)cmdBld_DummyCb, 
                                     hCmdBld);
     }
@@ -1521,7 +1518,7 @@
     if (DB_WLAN(hCmdBld).bJoin)
     {
         /* Preamble type must be set after doing join */
-        return cmdBld_CfgPreamble (hCmdBld, DB_WLAN(hCmdBld).preamble, (void *)cmdBld_ConfigSeq, hCmdBld);              
+        return cmdBld_CfgPreamble (hCmdBld, (Preamble_e) DB_WLAN(hCmdBld).preamble, (void *)cmdBld_ConfigSeq, hCmdBld);              
     }
 
     return TI_NOK;
@@ -1793,7 +1790,7 @@
 
 static TI_STATUS __cfg_rate_management (TI_HANDLE hCmdBld)
 {
-	DB_RM(hCmdBld).rateMngParams.paramIndex = 0xFF;
+	DB_RM(hCmdBld).rateMngParams.paramIndex = (rateAdaptParam_e) 0xFF;
 
 	return cmdBld_CfgIeRateMngDbg(hCmdBld,
 						   &DB_RM(hCmdBld).rateMngParams,
@@ -1821,6 +1818,7 @@
 {
     __cfg_platform_params,
     __cfg_radio_params,
+	__cfg_extended_radio_params,
     __cmd_probe_req,
     __cmd_null_data,
     __cmd_disconn,
@@ -1905,8 +1903,6 @@
     __cmd_sta_state,
     __cmd_power_auth,
 	__cmd_burst_mode_enable,
-    __cmd_smart_reflex_state,
-    __cmd_smart_reflex_debug,
 	__cfg_rate_management,
     __cmd_arp_rsp_join,
     /* Interrogate command -> must be last!! */
diff --git a/wl1271/TWD/Ctrl/CmdBld.h b/wl1271/TWD/Ctrl/CmdBld.h
index b30bce1..dbc1084 100644
--- a/wl1271/TWD/Ctrl/CmdBld.h
+++ b/wl1271/TWD/Ctrl/CmdBld.h
@@ -1,7 +1,7 @@
 /*
  * CmdBld.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -225,6 +225,7 @@
     TI_HANDLE                  hJoinCmpltOriginalCbHndl;
 
     TI_UINT32                  uIniSeq;         /* Init sequence counter */
+    TI_BOOL                    bReconfigInProgress;
 
     TI_UINT32                  uLastElpCtrlMode;/* Init sleep mode */
 
@@ -256,8 +257,8 @@
 #define DB_KEYS(HCMDBLD)            (((TCmdBld *)HCMDBLD)->tDb.keys)
 #define DB_RX_DATA_FLTR(HCMDBLD)    (((TCmdBld *)HCMDBLD)->tDb.rxDataFilters)
 #define DB_RADIO(HCMDBLD)    (((TCmdBld *)HCMDBLD)->tDb.tRadioIniParams)
+#define DB_EXT_RADIO(HCMDBLD)		(((TCmdBld *)HCMDBLD)->tDb.tExtRadioIniParams)
 #define DB_GEN(HCMDBLD)    (((TCmdBld *)HCMDBLD)->tDb.tPlatformGenParams)
-#define DB_SR(HCMDBLD)    (((TCmdBld *)HCMDBLD)->tDb.tSmartReflex)
 #define DB_RM(HCMDBLD)    (((TCmdBld *)HCMDBLD)->tDb.tRateMngParams)
 
 
diff --git a/wl1271/TWD/Ctrl/CmdBldCfgIE.c b/wl1271/TWD/Ctrl/CmdBldCfgIE.c
index d03227c..495770a 100644
--- a/wl1271/TWD/Ctrl/CmdBldCfgIE.c
+++ b/wl1271/TWD/Ctrl/CmdBldCfgIE.c
@@ -1,7 +1,7 @@
 /*
  * CmdBldCfgIE.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -1883,6 +1883,47 @@
 }
 
 
+/** 
+ * \fn     cmdBld_CfgIeExtendedRadioParams 
+ * \brief  configure extended radio parameters setting in the
+ * FW.
+ *
+ * \note    
+ * \return TI_OK on success or TI_NOK on failure 
+ * \sa 
+ */ 
+TI_STATUS cmdBld_CfgIeExtendedRadioParams (TI_HANDLE hCmdBld,
+										   IniFileExtendedRadioParam *pIniFileExtRadioParams,
+										   void *fCb,
+										   TI_HANDLE hCb)
+{
+    TCmdBld *pCmdBld = (TCmdBld *)hCmdBld;
+    TI_STATUS status = TI_NOK;
+    TTestCmd *pTestCmd;
+
+    pTestCmd = os_memoryAlloc(pCmdBld->hOs, sizeof(TTestCmd));
+    if (!pTestCmd)
+    {
+        return status;
+    }
+
+    pTestCmd->testCmdId = TEST_CMD_INI_FILE_RF_EXTENDED_PARAM;
+    
+    os_memoryCopy(pCmdBld->hOs, &pTestCmd->testCmd_u.IniFileExtendedRadioParams,
+				  pIniFileExtRadioParams, sizeof(IniFileExtendedRadioParam));
+
+    status = cmdQueue_SendCommand (pCmdBld->hCmdQueue, 
+                             CMD_TEST, 
+                             (void *)pTestCmd, 
+                             sizeof(IniFileExtendedRadioParam) + 4,
+                             fCb, 
+                             hCb, 
+                             NULL);
+    os_memoryFree(pCmdBld->hOs, pTestCmd, sizeof(TTestCmd));
+    return status;
+}
+
+
 TI_STATUS cmdBld_CfgPlatformGenParams (TI_HANDLE hCmdBld, IniFileGeneralParam *pGenParams, void *fCb, TI_HANDLE hCb)
 {
     TCmdBld *pCmdBld = (TCmdBld *)hCmdBld;
@@ -1942,74 +1983,6 @@
 	return cmdQueue_SendCommand (pCmdBld->hCmdQueue, CMD_CONFIGURE, pCfg, sizeof(*pCfg), fCb, hCb, NULL);
 }
 
-/****************************************************************************
- *                      cmdBld_CfgIeSRstate()
- ****************************************************************************
- * DESCRIPTION: Configure sart reflex state
- *
- * INPUTS:  hCmdBld     - handle to command builder object
- *          bEnabled    - is enabled flag
- *          fCB         - callback function for command complete
- *          hCb         - handle to be apssed to callback function
- *
- * OUTPUT:  None
- *
- * RETURNS: OK or NOK
- ****************************************************************************/
-
-TI_STATUS cmdBld_CfgIeSRState (TI_HANDLE hCmdBld, uint8 SRstate, void *fCb, TI_HANDLE hCb)
-{
-    TCmdBld *pCmdBld = (TCmdBld *)hCmdBld;
-    ACXSmartReflexState_t tSmartReflexState;
-    ACXSmartReflexState_t *pCfg = &tSmartReflexState;
-
-    /* set IE header */
-    pCfg->EleHdr.id = ACX_SET_SMART_REFLEX_STATE;
-    pCfg->EleHdr.len = sizeof(*pCfg) - sizeof(EleHdrStruct);
-
-    /* set smart refelx state */
-    pCfg->enable = SRstate;
-
-    /* send the command to the FW */
-    return cmdQueue_SendCommand (pCmdBld->hCmdQueue, CMD_CONFIGURE, pCfg, sizeof(*pCfg), fCb, hCb, NULL);
-
-}
-
-/****************************************************************************
- *                      cmdBld_CfgIeSRDebug()
- ****************************************************************************
- * DESCRIPTION: Send debug param just if it's configured in ini file
- * INPUTS:  hCmdBld     - handle to command builder object
- *          bEnabled    - is enabled flag
- *          fCB         - callback function for command complete
- *          hCb         - handle to be apssed to callback function
- *
- * OUTPUT:  None
- *
- * RETURNS: OK or NOK
- ****************************************************************************/
-TI_STATUS cmdBld_CfgIeSRDebug (TI_HANDLE hCmdBld, ACXSmartReflexDebugParams_t *pSRDebug, void *fCb, TI_HANDLE hCb)
-{
-    TCmdBld *pCmdBld = (TCmdBld *)hCmdBld;
-    ACXSmartReflexDebugParams_t tSmartReflexDebug;
-    ACXSmartReflexDebugParams_t *pCfg = &tSmartReflexDebug;
-
-   /* send this command to FW just in case it's initialize in ini file */
-    if (pSRDebug->senNRN == 0) {
-        return TI_NOK;
-    }
-
-    /* copy smart reflex debug params*/
-    os_memoryCopy(pCmdBld->hOs, pCfg, pSRDebug, sizeof(ACXSmartReflexDebugParams_t));
-
-    /* set IE header */
-    pCfg->EleHdr.id = ACX_SET_SMART_REFLEX_DEBUG;
-    pCfg->EleHdr.len = sizeof(*pCfg) - sizeof(EleHdrStruct);
-
-    /* send the command to the FW */
-    return cmdQueue_SendCommand (pCmdBld->hCmdQueue, CMD_CONFIGURE, pCfg, sizeof(*pCfg), fCb, hCb, NULL);
-
-}
 
 /****************************************************************************
  *                      cmdBld_CfgIeDcoItrimParams()
diff --git a/wl1271/TWD/Ctrl/CmdBldCfgIE.h b/wl1271/TWD/Ctrl/CmdBldCfgIE.h
index af86f53..60b8c5c 100644
--- a/wl1271/TWD/Ctrl/CmdBldCfgIE.h
+++ b/wl1271/TWD/Ctrl/CmdBldCfgIE.h
@@ -1,7 +1,7 @@
 /*
  * CmdBldCfgIE.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -97,11 +97,10 @@
 TI_STATUS cmdBld_CfgIeSetFwHtCapabilities       (TI_HANDLE hCmdBld, TI_UINT32 uHtCapabilites, TMacAddr tMacAddress, TI_UINT8 uAmpduMaxLeng, TI_UINT8 uAmpduMinSpac, void *fCb, TI_HANDLE hCb);
 TI_STATUS cmdBld_CfgIeSetFwHtInformation        (TI_HANDLE hCmdBld, TI_UINT8 uRifsMode, TI_UINT8 uHtProtection, TI_UINT8 uGfProtection, TI_UINT8 uHtTxBurstLimit, TI_UINT8 uDualCtsProtection, void *fCb,TI_HANDLE hCb);
 TI_STATUS cmdBld_CfgIeRadioParams               (TI_HANDLE hCmdBld, IniFileRadioParam *pIniFileRadioParams, void *fCb, TI_HANDLE hCb);
+TI_STATUS cmdBld_CfgIeExtendedRadioParams 		(TI_HANDLE hCmdBld, IniFileExtendedRadioParam *pIniFileExtRadioParams, void *fCb, TI_HANDLE hCb);
 TI_STATUS cmdBld_CfgPlatformGenParams           (TI_HANDLE hCmdBld, IniFileGeneralParam *pGenParams, void *fCb, TI_HANDLE hCb);
 TI_STATUS cmdBld_CfgIeCoexActivity              (TI_HANDLE hCmdBld, TCoexActivity *pCoexActivity, void *fCb, TI_HANDLE hCb);
 TI_STATUS cmdBld_CfgIeBurstMode 				(TI_HANDLE hCmdBld, TI_BOOL bEnabled, void *fCb, TI_HANDLE hCb);
-TI_STATUS cmdBld_CfgIeSRDebug                   (TI_HANDLE hCmdBld, ACXSmartReflexDebugParams_t *pSRDebug, void *fCb, TI_HANDLE hCb);
-TI_STATUS cmdBld_CfgIeSRState                   (TI_HANDLE hCmdBld, uint8 SRstate, void *fCb, TI_HANDLE hCb);
 TI_STATUS cmdBld_CfgIeRateMngDbg 				(TI_HANDLE hCmdBld, RateMangeParams_t *pRateMngParams, void *fCb, TI_HANDLE hCb);
 #endif
 
diff --git a/wl1271/TWD/Ctrl/CmdBldCmdIE.c b/wl1271/TWD/Ctrl/CmdBldCmdIE.c
index 053c10d..f5edb52 100644
--- a/wl1271/TWD/Ctrl/CmdBldCmdIE.c
+++ b/wl1271/TWD/Ctrl/CmdBldCmdIE.c
@@ -1,7 +1,7 @@
 /*
  * CmdBldCmdIE.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -200,14 +200,18 @@
 TI_STATUS cmdBld_CmdIeEnableRx (TI_HANDLE hCmdBld, void *fCb, TI_HANDLE hCb)
 {
     TCmdBld  *pCmdBld = (TCmdBld *)hCmdBld;
-    TI_UINT8  uChannelNumber;
+    TI_UINT8  aEnableRx_buf[4];
 
-    uChannelNumber = DB_DEFAULT_CHANNEL (hCmdBld);
+    aEnableRx_buf[0] = DB_DEFAULT_CHANNEL (hCmdBld);
+    aEnableRx_buf[1] = 0; /* padding */
+    aEnableRx_buf[2] = 0; /* padding */
+    aEnableRx_buf[3] = 0; /* padding */
+
 
     return cmdQueue_SendCommand (pCmdBld->hCmdQueue, 
                              CMD_ENABLE_RX, 
-                             (TI_CHAR *)&uChannelNumber, 
-                             sizeof(TI_UINT8),
+                             (TI_CHAR *)aEnableRx_buf, 
+                             sizeof(aEnableRx_buf),
                              fCb,
                              hCb,
                              NULL);
@@ -230,11 +234,17 @@
 TI_STATUS cmdBld_CmdIeEnableTx (TI_HANDLE hCmdBld, TI_UINT8 channel, void *fCb, TI_HANDLE hCb)
 {
     TCmdBld *pCmdBld = (TCmdBld *)hCmdBld;
+    TI_UINT8  aEnableTx_buf[4];
+
+    aEnableTx_buf[0] = channel;
+    aEnableTx_buf[1] = 0; /* padding */
+    aEnableTx_buf[2] = 0; /* padding */
+    aEnableTx_buf[3] = 0; /* padding */
 
     return cmdQueue_SendCommand (pCmdBld->hCmdQueue, 
                              CMD_ENABLE_TX, 
-                             (TI_CHAR *)&channel, 
-                             sizeof(TI_UINT8),
+                             (TI_CHAR *)aEnableTx_buf, 
+                             sizeof(aEnableTx_buf),
                              fCb,
                              hCb,
                              NULL);
@@ -396,9 +406,14 @@
 
     /* 
      * Preserve TKIP/AES security sequence number after recovery.
+     * If not in reconfig set to 0 so the FW will ignore it and keep its own number.
      * Note that our STA Tx is currently using only one sequence-counter 
      * for all ACs (unlike the Rx which is separated per AC).  
      */
+    if (pCmdBld->bReconfigInProgress == TI_FALSE)
+    {
+        uSecuritySeqNumLow = uSecuritySeqNumHigh = 0;
+    }
     pCmd->AcSeqNum16[0] = ENDIAN_HANDLE_WORD((TI_UINT16)uSecuritySeqNumLow);
     pCmd->AcSeqNum16[1] = 0;
     pCmd->AcSeqNum16[2] = 0;
diff --git a/wl1271/TWD/Ctrl/CmdBldDb.h b/wl1271/TWD/Ctrl/CmdBldDb.h
index deeb9b3..a3c438f 100644
--- a/wl1271/TWD/Ctrl/CmdBldDb.h
+++ b/wl1271/TWD/Ctrl/CmdBldDb.h
@@ -1,7 +1,7 @@
 /*
  * CmdBldDb.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -111,7 +111,7 @@
     TI_UINT32                  PsPollTemplateSize;
     TI_UINT32                  qosNullDataTemplateSize;
     TI_UINT32                  ArpRspTemplateSize;
-    TI_BOOL                    EnergyDetection;
+    TI_BOOL                    ch14TelecCca;
     TI_UINT8                   PacketDetectionThreshold;
     TI_UINT8                   FcsErrThrsh;
     TI_UINT8                   UseDeviceErrorInterrupt;
@@ -310,14 +310,6 @@
 
 typedef struct
 {
- ACXSmartReflexConfigParams_t     tSmartReflexParams;
- ACXSmartReflexDebugParams_t      tSmartReflexDebugParams;
- ACXSmartReflexState_t            tSmartReflexState;
-
-}TSmartReflexParams ;
-
-typedef struct
-{
 	RateMangeParams_t rateMngParams;
 
 } TRateMngParams;
@@ -343,9 +335,9 @@
     TKeepAliveList             klvList;             /* Keep-Alive paramters     */  
     TSecurReconf               keys;                /* Security keys            */
     TRxDataFiltersTable        rxDataFilters;       /* Rx data filters          */
-    IniFileGeneralParam        tPlatformGenParams;  /* platfrom gen params from public_radio.h  */
+    IniFileGeneralParam        tPlatformGenParams;  /* platfrom gen params from public_radio.h  */   
     IniFileRadioParam          tRadioIniParams;     /* Radio ini params from public_radio.h     */
-    TSmartReflexParams         tSmartReflex;
+	IniFileExtendedRadioParam  tExtRadioIniParams;  /* Extended Radio ini params from public_radio.h     */
 	TRateMngParams		       tRateMngParams;      /* rate management params */
 } TCmdBldDb;
 
diff --git a/wl1271/TWD/Data_Service/Export_Inc/RxQueue_api.h b/wl1271/TWD/Data_Service/Export_Inc/RxQueue_api.h
index 4695d41..1c49749 100644
--- a/wl1271/TWD/Data_Service/Export_Inc/RxQueue_api.h
+++ b/wl1271/TWD/Data_Service/Export_Inc/RxQueue_api.h
@@ -1,7 +1,7 @@
 /*
  * RxQueue_api.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -48,7 +48,7 @@
  */
 TI_HANDLE RxQueue_Create        (TI_HANDLE hOs);
 TI_STATUS RxQueue_Destroy       (TI_HANDLE hRxQueue);
-TI_STATUS RxQueue_Init          (TI_HANDLE hRxQueue, TI_HANDLE hReport);
+TI_STATUS RxQueue_Init          (TI_HANDLE hRxQueue, TI_HANDLE hReport, TI_HANDLE hTimerModule);
 void      RxQueue_CloseBaSession(TI_HANDLE hRxQueue, TI_UINT8 uFrameTid);
 void      RxQueue_ReceivePacket (TI_HANDLE hRxQueue, const void *aFrame);
 void      RxQueue_Register_CB   (TI_HANDLE hRxQueue, TI_UINT32 CallBackID, void *CBFunc, TI_HANDLE CBObj);
diff --git a/wl1271/TWD/Data_Service/RxQueue.c b/wl1271/TWD/Data_Service/RxQueue.c
index 7f627be..67989a8 100644
--- a/wl1271/TWD/Data_Service/RxQueue.c
+++ b/wl1271/TWD/Data_Service/RxQueue.c
@@ -1,7 +1,7 @@
 /*
  * RxQueue.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -44,11 +44,13 @@
 #include "RxBuf.h"
 #include "TWDriver.h"
 #include "public_descriptors.h"
+#include "timer.h"
 
 /************************ static definition declaration *****************************/
 #define RX_QUEUE_ARRAY_SIZE		                            8
 #define RX_QUEUE_ARRAY_SIZE_BIT_MASK                        0x7 /* RX_QUEUE_ARRAY_SIZE -1 */
 #define RX_QUEUE_WIN_SIZE		                            RX_QUEUE_ARRAY_SIZE
+#define BA_SESSION_TIME_TO_SLEEP		                    (50)
 
 #define BA_SESSION_IS_A_BIGGER_THAN_B(A,B)       (((((A)-(B)) & 0xFFF) < 0x7FF) && ((A)!=(B)))
 #define BA_SESSION_IS_A_BIGGER_EQUAL_THAN_B(A,B) (((((A)-(B)) & 0xFFF) < 0x7FF))
@@ -86,19 +88,30 @@
     TRxQueueTidDataBase tSa1ArrayMng [MAX_NUM_OF_802_1d_TAGS];
 } TRxQueueArraysMng;	
 
+typedef struct
+{
+    TI_BOOL             bPacketMiss;                /* True - Wait for missing packets start timer
+                                                       False - all packets received in order */ 
+    TI_UINT16           aPacketsStored;             /* Represent the number of packets in Queue, 0 - Queue is empty */
+    TI_UINT8            aFrameTid;                  /* save the TID of the missing packet */
+} TPacketTimeout;
+
+
 /* main RxQueue structure in order to management the packets disordered array. */
 typedef struct 
 {
     TI_HANDLE           hOs;                        /* OS handler */
     TI_HANDLE           hReport;                    /* Report handler */
+	TI_HANDLE           hTimer;                     /* Timer Handle */
     TRxQueueArraysMng   tRxQueueArraysMng;          /* manage each Source Address RxQueue arrays */
     TPacketReceiveCb    tReceivePacketCB;           /* Receive packets CB address */
     TI_HANDLE           hReceivePacketCB_handle;    /* Receive packets CB handler */
-
+	TPacketTimeout      tPacketTimeout;             /* save information about the missing packet */
 } TRxQueue;	
 
 /************************ static function declaration *****************************/
 static TI_STATUS RxQueue_PassPacket (TI_HANDLE hRxQueue, TI_STATUS tStatus, const void *pBuffer);
+static void RxQueue_PacketTimeOut (TI_HANDLE hRxQueue, TI_BOOL bTwdInitOccured);
 
 /** 
  * \fn     RxQueue_Create() 
@@ -143,12 +156,23 @@
  */ 
 TI_STATUS RxQueue_Destroy (TI_HANDLE hRxQueue)
 {
-    TRxQueue *pRxQueue = (TRxQueue *)hRxQueue;
-
-    /* free module object */
-	os_memoryFree (pRxQueue->hOs, pRxQueue, sizeof(TRxQueue));
-	
-    return TI_OK;
+    TRxQueue *pRxQueue;
+    
+    if (hRxQueue) {
+        pRxQueue = (TRxQueue *)hRxQueue;
+        
+        if (pRxQueue->hTimer) {
+            tmr_DestroyTimer (pRxQueue->hTimer);
+            pRxQueue->hTimer = NULL;
+        }
+        
+        /* free module object */
+        os_memoryFree (pRxQueue->hOs, pRxQueue, sizeof(TRxQueue));
+        
+        return TI_OK;
+    }
+    
+    return TI_NOK;
 }
 
 
@@ -164,12 +188,14 @@
  * \return TI_OK on success or TI_NOK on failure  
  * \sa     
  */ 
-TI_STATUS RxQueue_Init (TI_HANDLE hRxQueue, TI_HANDLE hReport)
+TI_STATUS RxQueue_Init (TI_HANDLE hRxQueue, TI_HANDLE hReport, TI_HANDLE hTimerModule)
 {
 	TRxQueue *pRxQueue = (TRxQueue *)hRxQueue;
     
     pRxQueue->hReport   = hReport;
 
+	pRxQueue->hTimer = tmr_CreateTimer (hTimerModule);
+
 	return TI_OK;
 }
 
@@ -245,6 +271,8 @@
                                     pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket);
 
                 pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket = NULL;
+
+                pRxQueue->tPacketTimeout.aPacketsStored--;
             }
 
             pTidDataBase->aWinStartArrayInex ++;
@@ -252,6 +280,12 @@
             /* aWinStartArrayInex % RX_QUEUE_ARRAY_SIZE */
             pTidDataBase->aWinStartArrayInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
         }
+
+        if (pRxQueue->tPacketTimeout.bPacketMiss) 
+        {
+                tmr_StopTimer (pRxQueue->hTimer);
+                pRxQueue->tPacketTimeout.bPacketMiss = TI_FALSE;
+        }
     }
 }
 
@@ -308,7 +342,7 @@
  * Call from RxXfer in order to pass packet to uppers layers.
  * In order to save disordered packets the module use array of structures per TID 
  * that each entry describe a packet. The array elements is sorted in the way that 
- * the winStart array index represent always the winStar packet and the lowest SN. 
+ * the winStart array index represent always the winStart packet and the lowest SN. 
  * Each increment index represent index at the BA window. Array index winEnd  always 
  * represent winEnd packet. The indexes of winStart and winEnd handled in cyclic manner.
  * The function functionality devided to parts:
@@ -321,7 +355,7 @@
  * in case the modulo receive packet that SN between winStart to winEnd: 
  * "	Save it sorted at the array at index: Save index = ((SN - winStart) + index array winStart) % arraySize.
  *   Part 3: 
- * in case the modulo receive packet that SN higher then winEnd: 
+ * in case the modulo receive packet that SN higher than winEnd: 
  * "	Update winStart and WinEnd. 
  * "	Save it sorted at the array in index winEnd index.
  * "	Pass to the upper layers all packets at the array indexes from old winStart index to the updated winStart index.
@@ -349,13 +383,15 @@
 
     COPY_WLAN_WORD(&uQosControl, &pHdr->qosControl); /* copy with endianess handling. */
 
+    TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: packet_class_tag = 0x%x(%d)",pRxParams->packet_class_tag,pRxParams->packet_class_tag);
+
     /* 
      * Retrieving the TAG from the packet itself and not from the Rx Descriptor since by now it is not correct
      * Note: in the DR TAG_CLASS_EAPOL packet handled as TAG_CLASS_QOS_DATA   
      */
     if (IS_QOS_FRAME(*(TI_UINT16*)pFrame) && (pRxParams->packet_class_tag != TAG_CLASS_QOS_DATA) && (pRxParams->packet_class_tag != TAG_CLASS_AMSDU))
 	{
-        TRACE1(pRxQueue->hReport, REPORT_SEVERITY_WARNING, "RxQueue_ReceivePacket: BAD CLASS TAG =0x%x from FW.\n", pRxParams->packet_class_tag);
+        TRACE1(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: BAD CLASS TAG =0x%x from FW.\n", pRxParams->packet_class_tag);
 		
         /* Get AMSDU bit from frame */
         if( uQosControl & DOT11_QOS_CONTROL_FIELD_A_MSDU_BITS)
@@ -394,6 +430,9 @@
         /* Get TID from frame */
         uFrameTid = uQosControl & DOT11_QOS_CONTROL_FIELD_TID_BITS;
 
+        TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: QoS Packet received");
+        TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: uFrameTid = 0x%x(%d)",uFrameTid,uFrameTid);
+
         /* TID illegal value ? */
         if (uFrameTid >= MAX_NUM_OF_802_1d_TAGS)
         {
@@ -404,11 +443,11 @@
             return;
         }
 
-        /*set the SA Tid pointer */
+        /* Set the SA Tid pointer */
         pTidDataBase = &(pRxQueue->tRxQueueArraysMng.tSa1ArrayMng[uFrameTid]);
 
         /* TID legal value */
-        /* packet TID BA not established ? */ 
+        /* Packet TID BA session not established ? */ 
         if (pTidDataBase->aTidBaEstablished != TI_TRUE)
         {
             TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: pass packet without reorder.\n");
@@ -423,31 +462,52 @@
         COPY_WLAN_WORD(&uSequenceControl, &pHdr->seqCtrl); /* copy with endianess handling. */
         uFrameSn = (uSequenceControl & DOT11_SC_SEQ_NUM_MASK) >> 4;
 
+        TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: uFrameSn = 0x%x(%d)", uFrameSn, uFrameSn);
+        TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: aTidExpectedSn = 0x%x(%d)",pTidDataBase->aTidExpectedSn, pTidDataBase->aTidExpectedSn);
+
         /* 
-         * note: 
-         * the FW never send paket, in establish TID BA, that the SN less then ESN !!! 
+         * Note: 
+         * The FW never sends packet, in establish TID BA, with SN less than ESN !!! 
          */
 
-        /* frame Sequence Number is the expected one ? */
+        /* Part 1 - Frame Sequence Number is the expected one ? */
         if (uFrameSn == pTidDataBase->aTidExpectedSn)
         {
             TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: frame Sequence Number == expected one Sequence Number.\n");
 
-            /* pass the packet */
+			/* Stop timer in case that the expected SN received and timer was running */
+
+
+            /* If we wait for 2 consecutive packets we should not stop the timer - This is why we are checking after the while loop, if we have 
+               more packets stored, and if we have, we start the timer again.
+            */
+            if (pRxQueue->tPacketTimeout.bPacketMiss)
+            {
+                tmr_StopTimer (pRxQueue->hTimer);
+                pRxQueue->tPacketTimeout.bPacketMiss = TI_FALSE;
+            }
+
+
+            /* Pass the packet */
             RxQueue_PassPacket (pRxQueue, tStatus, pBuffer);
 
+            /* Increase expected SN to the next */
             pTidDataBase->aTidExpectedSn++;
-            pTidDataBase->aTidExpectedSn &= 0xfff;
+            pTidDataBase->aTidExpectedSn &= 0xfff;  /* SN is 12 bits long */
 
-            /* increase the ArrayInex to the next */
+            /* Increase the ArrayInex to the next */
             pTidDataBase->aWinStartArrayInex++;
 
             /* aWinStartArrayInex % RX_QUEUE_ARRAY_SIZE */
             pTidDataBase->aWinStartArrayInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
 
-            /* pass all saved queue packets with SN higher then the expected one */
+            /* Pass all saved queue packets with SN higher than the expected one */
             while (pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket != NULL)
             {
+                TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Pass all saved queue packets with SN higher than the expected one that was just received.");
+                TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: aTidExpectedSn = 0x%x(%d)", pTidDataBase->aTidExpectedSn, pTidDataBase->aTidExpectedSn);
+                TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: aWinStartArrayInex = 0x%x(%d)", pTidDataBase->aWinStartArrayInex, pTidDataBase->aWinStartArrayInex);
+
                 RxQueue_PassPacket (pRxQueue, 
                                     pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].tStatus,
                                     pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket);
@@ -460,45 +520,77 @@
                 pTidDataBase->aWinStartArrayInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
 
                  pTidDataBase->aTidExpectedSn++;
-				 pTidDataBase->aTidExpectedSn &= 0xfff;
+				 pTidDataBase->aTidExpectedSn &= 0xfff; /* SN is 12 bits long */
+
+				 /* Decrease the packets in queue */
+                pRxQueue->tPacketTimeout.aPacketsStored--;
+            }
+
+
+            /* aTidExpectedSn % 0xfff in order to tack care of wrap around */
+            pTidDataBase->aTidExpectedSn &= 0xfff; 
+
+            /* If there are still packets stored in the queue - start timer */
+			if (pRxQueue->tPacketTimeout.aPacketsStored)
+            {
+                tmr_StartTimer (pRxQueue->hTimer, RxQueue_PacketTimeOut, pRxQueue, BA_SESSION_TIME_TO_SLEEP, TI_FALSE);
+
+                pRxQueue->tPacketTimeout.bPacketMiss = TI_TRUE;
+                pRxQueue->tPacketTimeout.aFrameTid   = uFrameTid;
             }
 
             return;
         }
 
-        /* frame Sequence Number is lower then Expected sequence number (ISN) ? */ 
-        if (! BA_SESSION_IS_A_BIGGER_THAN_B (uFrameSn, pTidDataBase->aTidExpectedSn))
+        /* Frame Sequence Number is lower than Expected sequence number (ISN) ? */ 
+        if (! BA_SESSION_IS_A_BIGGER_THAN_B (uFrameSn, pTidDataBase->aTidExpectedSn))			
         {
-			/* WLAN_OS_REPORT(("%s: ERROR - SN=%u is less than ESN=%u\n", __FUNCTION__, uFrameSn, pTidDataBase->aTidExpectedSn)); */
+            /* WLAN_OS_REPORT(("%s: ERROR - SN=%u is less than ESN=%u\n", __FUNCTION__, uFrameSn, pTidDataBase->aTidExpectedSn)); */
+            TRACE0(pRxQueue->hReport, REPORT_SEVERITY_ERROR, "RxQueue_ReceivePacket: frame Sequence Number is lower than expected sequence number.\n");
 
-			TRACE2(pRxQueue->hReport, REPORT_SEVERITY_ERROR,
-				   "RxQueue_ReceivePacket: frame SN=%u is less than ESN=%u\n",uFrameSn,pTidDataBase->aTidExpectedSn);
-
-			RxQueue_PassPacket (pRxQueue, TI_NOK, pBuffer);
+            RxQueue_PassPacket (pRxQueue, tStatus, pBuffer);
 
             return;
         }
 
-        /* frame Sequence Number between winStart and winEnd ? */
+        /* Part 2 - Frame Sequence Number between winStart and winEnd ? */
         if ((BA_SESSION_IS_A_BIGGER_THAN_B (uFrameSn, pTidDataBase->aTidExpectedSn)) &&
             /* mean: uFrameSn <= pTidDataBase->aTidExpectedSn + pTidDataBase->aTidWinSize) */
             ( ! BA_SESSION_IS_A_BIGGER_THAN_B (uFrameSn,(pTidDataBase->aTidExpectedSn + pTidDataBase->aTidWinSize - 1))))
         {
-            TI_UINT16 uSaveInex = pTidDataBase->aWinStartArrayInex + (TI_UINT16)((uFrameSn + SEQ_NUM_WRAP - pTidDataBase->aTidExpectedSn) & SEQ_NUM_MASK);
-            /* uSaveInex % RX_QUEUE_ARRAY_SIZE */
-            uSaveInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK; 
+            TI_UINT16 uSaveIndex = pTidDataBase->aWinStartArrayInex + (TI_UINT16)((uFrameSn + SEQ_NUM_WRAP - pTidDataBase->aTidExpectedSn) & SEQ_NUM_MASK);
+        
+            /* uSaveIndex % RX_QUEUE_ARRAY_SIZE */
+            uSaveIndex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK; 
 
+            TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: frame Sequence Number between winStart and winEnd.\n");
+            TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: uSaveIndex = 0x%x(%d)",uSaveIndex,uSaveIndex);
 
-			if (pTidDataBase->aPaketsQueue[uSaveInex].pPacket == NULL)
+            /* Before storing packet in queue, make sure the place in the queue is vacant */
+			if (pTidDataBase->aPaketsQueue[uSaveIndex].pPacket == NULL)
 			{
-                /* save the packet in the queue */
-                pTidDataBase->aPaketsQueue[uSaveInex].tStatus = tStatus;
-                pTidDataBase->aPaketsQueue[uSaveInex].pPacket = (void *)pBuffer;
-                pTidDataBase->aPaketsQueue[uSaveInex].uFrameSn = uFrameSn;
-			}
+                TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Enter packet to Reorder Queue");
+                
+                /* Store the packet in the queue */
+                pTidDataBase->aPaketsQueue[uSaveIndex].tStatus  = tStatus;
+                pTidDataBase->aPaketsQueue[uSaveIndex].pPacket  = (void *)pBuffer;
+                pTidDataBase->aPaketsQueue[uSaveIndex].uFrameSn = uFrameSn;
+
+				pRxQueue->tPacketTimeout.aPacketsStored++;
+
+           
+				/* Start Timer [only if timer is not already started - according to bPacketMiss] */
+                if(pRxQueue->tPacketTimeout.bPacketMiss == TI_FALSE)
+                {     
+				    tmr_StartTimer (pRxQueue->hTimer, RxQueue_PacketTimeOut, pRxQueue, BA_SESSION_TIME_TO_SLEEP, TI_FALSE);
+				    pRxQueue->tPacketTimeout.bPacketMiss = TI_TRUE;
+				    pRxQueue->tPacketTimeout.aFrameTid   = uFrameTid;
+			    }
+            }
 			else
 			{
-				 TRACE1(pRxQueue->hReport, REPORT_SEVERITY_ERROR, "RxQueue_ReceivePacket: frame Sequence has allready saved. uFrameSn = %d\n",uFrameSn);
+ 				 TRACE1(pRxQueue->hReport, REPORT_SEVERITY_ERROR, "RxQueue_ReceivePacket: frame Sequence has already saved. uFrameSn = %d\n", uFrameSn);
+
 				 RxQueue_PassPacket (pRxQueue, TI_NOK, pBuffer);
 				 return;
 			}
@@ -507,40 +599,55 @@
 
 
         /* 
-        frame Sequence Number higher then winEnd ? 
+        Part 3 - Frame Sequence Number higher than winEnd ? 
         */
         if ( BA_SESSION_IS_A_BIGGER_THAN_B (uFrameSn, (pTidDataBase->aTidExpectedSn + pTidDataBase->aTidWinSize - 1)) )
         {
             TI_UINT32 i;
             TI_UINT16 uNewWinStartSn = (uFrameSn + SEQ_NUM_WRAP - pTidDataBase->aTidWinSize + 1) & SEQ_NUM_MASK;
-            TI_UINT16 uSaveInex;
+            TI_UINT16 uSaveIndex;
             
-			TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: frame Sequence Number higher then winEnd.\n");
+            
+			TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: frame Sequence Number higher than winEnd.\n");
+            TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: uNewWinStartSn = 0x%x(%d) STOP TIMER",uNewWinStartSn,uNewWinStartSn);
 
-            /* increase the ArrayInex to the next */
+            /* If timer is on - stop it */
+			if (pRxQueue->tPacketTimeout.bPacketMiss) 
+            {
+                tmr_StopTimer (pRxQueue->hTimer);
+                pRxQueue->tPacketTimeout.bPacketMiss = TI_FALSE;
+            }
+
+            /* Increase the ArrayInex to the next */
             pTidDataBase->aWinStartArrayInex++;
 
             /* aWinStartArrayInex % RX_QUEUE_ARRAY_SIZE */
             pTidDataBase->aWinStartArrayInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
 
-            /* update the Expected SN since the current one is lost */
+            /* Update the Expected SN since the current one is lost */
             pTidDataBase->aTidExpectedSn++;
             pTidDataBase->aTidExpectedSn &= 0xFFF;
 
-            /* pass all saved queue packets with SN lower then the new win start */
+            /* Pass all saved queue packets with SN lower than the new win start */
             for (i = 0;
-                 BA_SESSION_IS_A_BIGGER_THAN_B(uNewWinStartSn,pTidDataBase->aTidExpectedSn) &&
+                 BA_SESSION_IS_A_BIGGER_THAN_B(uNewWinStartSn,pTidDataBase->aTidExpectedSn) && 
                   (i < RX_QUEUE_ARRAY_SIZE) && 
                   (i < pTidDataBase->aTidWinSize);
                  i++)
             {
+                TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: aTidExpectedSn = 0x%x(%d)",pTidDataBase->aTidExpectedSn,pTidDataBase->aTidExpectedSn);
+                TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: aWinStartArrayInex = 0x%x(%d)",pTidDataBase->aWinStartArrayInex,pTidDataBase->aWinStartArrayInex);
+
                 if (pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket != NULL)
                 {
+                    TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Send Packet to Upper layer");
                     RxQueue_PassPacket (pRxQueue, 
                                         pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].tStatus,
                                         pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket);
 
                     pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket = NULL;
+
+					pRxQueue->tPacketTimeout.aPacketsStored--;
                 }
 
                 pTidDataBase->aWinStartArrayInex++;
@@ -553,19 +660,28 @@
 
             }
 
+            TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: aTidExpectedSn = 0x%x(%d)",pTidDataBase->aTidExpectedSn,pTidDataBase->aTidExpectedSn);
+            TRACE1(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: i = %d",i);
+
             /* Calculate the new Expected SN */
             if (i == pTidDataBase->aTidWinSize)
             {
+                TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Set aTidExpectedSn to uNewWinStartSn");
                 pTidDataBase->aTidExpectedSn = uNewWinStartSn;
             }
             else
             {
-                /* Incase the uWinStartDelta lower than aTidWinSize check if ther are packets stored in Array */
-                while (pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket != NULL) {
-                    RxQueue_PassPacket (pRxQueue,
-                                            pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].tStatus,
-                                            pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket);
-
+                TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Send all saved packets");
+                /* In case the uWinStartDelta lower than aTidWinSize check if ther are packets stored in Array */
+ 
+                while (pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket != NULL) 
+                {
+                    TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Send packet with SN = 0x%x(%d)",pTidDataBase->aTidExpectedSn,pTidDataBase->aTidExpectedSn);
+                
+                    RxQueue_PassPacket ( pRxQueue, 
+                                         pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].tStatus,
+                                         pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket
+                                       );
                     pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket = NULL;
 
                     pTidDataBase->aWinStartArrayInex++;
@@ -575,11 +691,16 @@
 
                     pTidDataBase->aTidExpectedSn++;
                     pTidDataBase->aTidExpectedSn &= 0xFFF;
+
+                    pRxQueue->tPacketTimeout.aPacketsStored--;
                 }
             }
 
+            TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: aTidExpectedSn = 0x%x(%d)",pTidDataBase->aTidExpectedSn,pTidDataBase->aTidExpectedSn);
+
             if(pTidDataBase->aTidExpectedSn == uFrameSn)
             {
+                TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Send current packet to uper layer");
                 /* pass the packet */
                 RxQueue_PassPacket (pRxQueue, tStatus, pBuffer);
                 pTidDataBase->aTidExpectedSn++;
@@ -587,15 +708,32 @@
             }
             else
             {
-                uSaveInex = pTidDataBase->aWinStartArrayInex + (TI_UINT16)((uFrameSn + SEQ_NUM_WRAP - pTidDataBase->aTidExpectedSn) & SEQ_NUM_MASK);
+                uSaveIndex = pTidDataBase->aWinStartArrayInex + (TI_UINT16)((uFrameSn + SEQ_NUM_WRAP - pTidDataBase->aTidExpectedSn) & SEQ_NUM_MASK);  
 
-				/* uSaveInex % RX_QUEUE_ARRAY_SIZE */
-				uSaveInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
+                TRACE0(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: Enter current packet to Reorder Queue");
+                TRACE2(pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: uSaveIndex = 0x%x(%d)", uSaveIndex, uSaveIndex);
 
-            /* save the packet in the last entry of the queue */
-               pTidDataBase->aPaketsQueue[uSaveInex].tStatus = tStatus;
-               pTidDataBase->aPaketsQueue[uSaveInex].pPacket = (void *)pBuffer;
-               pTidDataBase->aPaketsQueue[uSaveInex].pPacket = (void *)pBuffer;
+				/* uSaveIndex % RX_QUEUE_ARRAY_SIZE */
+				uSaveIndex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK; 
+
+				/* Save the packet in the last entry of the queue */
+				pTidDataBase->aPaketsQueue[uSaveIndex].tStatus = tStatus;
+				pTidDataBase->aPaketsQueue[uSaveIndex].pPacket = (void *)pBuffer;
+				pTidDataBase->aPaketsQueue[uSaveIndex].pPacket = (void *)pBuffer;
+
+               pRxQueue->tPacketTimeout.aPacketsStored++;
+            }
+
+
+            /* aTidExpectedSn % 0xfff in order to tack care of wrap around */
+            pTidDataBase->aTidExpectedSn &= 0xfff; 
+
+            /* If there are still packets stored in the queue - start timer */
+			if (pRxQueue->tPacketTimeout.aPacketsStored) 
+            {
+                tmr_StartTimer (pRxQueue->hTimer, RxQueue_PacketTimeOut, pRxQueue, BA_SESSION_TIME_TO_SLEEP, TI_FALSE);
+                pRxQueue->tPacketTimeout.bPacketMiss = TI_TRUE;
+                pRxQueue->tPacketTimeout.aFrameTid   = uFrameTid;
             }
 
             return;
@@ -664,12 +802,17 @@
             COPY_WLAN_WORD (&uBaStartingSequenceControlField, (TI_UINT16 *)pDataFrameBody); /* copy with endianess handling. */
             uStartingSequenceNumber = (uBaStartingSequenceControlField & DOT11_SC_SEQ_NUM_MASK) >> 4;
 
-            /* Starting Sequence Number is higher then winStart ? */
+            /* Starting Sequence Number is higher than winStart ? */
             if ( BA_SESSION_IS_A_BIGGER_THAN_B (uStartingSequenceNumber, pTidDataBase->aTidExpectedSn) )
             {
-                uWinStartDelta = (uStartingSequenceNumber + SEQ_NUM_WRAP - pTidDataBase->aTidExpectedSn) & SEQ_NUM_MASK;
+                uWinStartDelta = uStartingSequenceNumber - pTidDataBase->aTidExpectedSn;
+                if (pRxQueue->tPacketTimeout.bPacketMiss) 
+                {
+                    tmr_StopTimer (pRxQueue->hTimer);
+                    pRxQueue->tPacketTimeout.bPacketMiss = TI_FALSE;
+                }
 
-                /* pass all saved queue packets with SN lower then the new win start */
+                /* pass all saved queue packets with SN lower than the new win start */
                 for (i = 0;
                      ((i < uWinStartDelta) || (pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket != NULL)) &&
                       (i < RX_QUEUE_ARRAY_SIZE) && 
@@ -683,6 +826,7 @@
                                             pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket);
 
                         pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket = NULL;
+                        pRxQueue->tPacketTimeout.aPacketsStored--;
                     }
 
                     pTidDataBase->aWinStartArrayInex++;
@@ -691,6 +835,14 @@
                     pTidDataBase->aWinStartArrayInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
                 }
 
+                if (pRxQueue->tPacketTimeout.aPacketsStored) 
+                {
+                    tmr_StartTimer (pRxQueue->hTimer, RxQueue_PacketTimeOut, pRxQueue, BA_SESSION_TIME_TO_SLEEP, TI_FALSE);
+                    pRxQueue->tPacketTimeout.bPacketMiss = TI_TRUE;
+                    pRxQueue->tPacketTimeout.aFrameTid = uFrameTid;
+                }
+
+
                 pTidDataBase->aTidExpectedSn = uStartingSequenceNumber;
             }
             break;
@@ -706,7 +858,6 @@
             {
             case DOT11_BA_ACTION_ADDBA:
 
-                TRACE0( pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: BA event - ADDBA frame.\n");
 
                 /* get TID field and winSize from ADDBA action frame */
                 pDataFrameBody = pDataFrameBody + 2;
@@ -743,7 +894,7 @@
                 /* winSize illegal value ? */ 
                 if (pTidDataBase->aTidWinSize > RX_QUEUE_WIN_SIZE)
                 {
-                    /* In case the win Size is higher then 8 the driver and the FW set it to 8 and inform the AP in ADDBA respond */
+                    /* In case the win Size is higher than 8 the driver and the FW set it to 8 and inform the AP in ADDBA respond */
                     pTidDataBase->aTidWinSize = RX_QUEUE_WIN_SIZE;
                 }
 
@@ -761,10 +912,9 @@
 
             case DOT11_BA_ACTION_DELBA:
 
-                TRACE0( pRxQueue->hReport, REPORT_SEVERITY_INFORMATION, "RxQueue_ReceivePacket: BA event - DELBA frame.\n");
 
                 /* get TID field and winSize from ADDBA action frame */
-                pDataFrameBody = pDataFrameBody + 2;
+                pDataFrameBody = pDataFrameBody + 1;
                 COPY_WLAN_WORD(&uBAParameterField, (TI_UINT16 *)pDataFrameBody); /* copy with endianess handling. */
                 uFrameTid = (uBAParameterField & DOT11_DELBA_PARAMETER_FIELD_TID_BITS) >> 12;
 
@@ -821,3 +971,74 @@
     return;
 }
 
+
+/*
+Function Name : RxQueue_PacketTimeOut
+
+Description   : This function sends all consecutive old packets stored in a specific TID queue to the upper layer.
+
+                This function is called on timer wake up. 
+                [The timer is started when we have stored packets in the RxQueue].
+                
+
+Parameters    : hRxQueue        - A handle to the RxQueue structure.
+                bTwdInitOccured - Not used.
+
+Returned Value: void
+*/
+static void RxQueue_PacketTimeOut (TI_HANDLE hRxQueue, TI_BOOL bTwdInitOccured)
+{
+    TRxQueue            *pRxQueue   = (TRxQueue *)hRxQueue;
+    TRxQueueTidDataBase *pTidDataBase;
+
+    pRxQueue->tPacketTimeout.bPacketMiss = TI_FALSE;
+
+    /* Set the SA Tid pointer */
+    pTidDataBase = &(pRxQueue->tRxQueueArraysMng.tSa1ArrayMng[pRxQueue->tPacketTimeout.aFrameTid]);
+
+
+    if (pRxQueue->tPacketTimeout.aPacketsStored) 
+    {
+
+        /* Find the first stored packet */
+        while (pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket == NULL) 
+        {
+            pTidDataBase->aWinStartArrayInex++;
+    
+            /* aWinStartArrayInex % RX_QUEUE_ARRAY_SIZE */
+            pTidDataBase->aWinStartArrayInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
+        
+            pTidDataBase->aTidExpectedSn++;
+            pTidDataBase->aTidExpectedSn &= 0xFFF;
+        }
+
+
+        /* Send all packets in order */
+        while ((pRxQueue->tPacketTimeout.aPacketsStored > 0) && (pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket != NULL)) 
+        {
+
+            RxQueue_PassPacket (pRxQueue, 
+                                pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].tStatus,
+                                pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket);
+    
+            pTidDataBase->aPaketsQueue[pTidDataBase->aWinStartArrayInex].pPacket = NULL;
+
+            pTidDataBase->aWinStartArrayInex++;
+
+            /* aWinStartArrayInex % RX_QUEUE_ARRAY_SIZE */
+            pTidDataBase->aWinStartArrayInex &= RX_QUEUE_ARRAY_SIZE_BIT_MASK;
+
+            pTidDataBase->aTidExpectedSn++;
+            pTidDataBase->aTidExpectedSn &= 0xFFF;
+
+            pRxQueue->tPacketTimeout.aPacketsStored--;
+            
+        }
+    }
+
+    if (pRxQueue->tPacketTimeout.aPacketsStored) 
+    {
+        tmr_StartTimer (pRxQueue->hTimer, RxQueue_PacketTimeOut, pRxQueue, BA_SESSION_TIME_TO_SLEEP, TI_FALSE);
+        pRxQueue->tPacketTimeout.bPacketMiss = TI_TRUE;
+    }
+}
diff --git a/wl1271/TWD/Data_Service/txCtrlBlk.c b/wl1271/TWD/Data_Service/txCtrlBlk.c
index a3029da..41b867b 100644
--- a/wl1271/TWD/Data_Service/txCtrlBlk.c
+++ b/wl1271/TWD/Data_Service/txCtrlBlk.c
@@ -217,7 +217,8 @@
 	TTxCtrlBlkObj   *pTxCtrlBlk = (TTxCtrlBlkObj *)hTxCtrlBlk;
 	TTxCtrlBlk *pFirstFreeEntry = &(pTxCtrlBlk->aTxCtrlBlkTbl[0]);
 
-	if (!pTxCtrlBlk) {
+	if (!pTxCtrlBlk)
+    {
 		return;
 	}
 
diff --git a/wl1271/TWD/FW_Transfer/CmdMBox.c b/wl1271/TWD/FW_Transfer/CmdMBox.c
index e8232e4..4c3dfa7 100644
--- a/wl1271/TWD/FW_Transfer/CmdMBox.c
+++ b/wl1271/TWD/FW_Transfer/CmdMBox.c
@@ -1,7 +1,7 @@
 /*
  * CmdMBox.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -153,7 +153,6 @@
     pCmdMbox->hCmdQueue = hCmdQueue;
     pCmdMbox->hTwIf = hTwIf;
     pCmdMbox->hReport = hReport;
-    pCmdMbox->hCmdMboxTimer = hTimer;
 
     pCmdMbox->uFwAddr = 0;
     pCmdMbox->uReadLen = 0;
diff --git a/wl1271/TWD/FW_Transfer/CmdMBox.h b/wl1271/TWD/FW_Transfer/CmdMBox.h
index 74b0e65..1e5db43 100644
--- a/wl1271/TWD/FW_Transfer/CmdMBox.h
+++ b/wl1271/TWD/FW_Transfer/CmdMBox.h
@@ -1,7 +1,7 @@
 /*
  * CmdMBox.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -83,7 +83,6 @@
     TI_HANDLE           hOs;
     TI_HANDLE           hReport;
     TI_HANDLE           hTwIf;
-    TI_HANDLE           hTimer; 
     TI_HANDLE           hCmdQueue;
     TI_HANDLE           hCmdMboxTimer;
     fnotify_t           fCb;
diff --git a/wl1271/TWD/FW_Transfer/Export_Inc/HwInit_api.h b/wl1271/TWD/FW_Transfer/Export_Inc/HwInit_api.h
index 78bee3a..5222001 100644
--- a/wl1271/TWD/FW_Transfer/Export_Inc/HwInit_api.h
+++ b/wl1271/TWD/FW_Transfer/Export_Inc/HwInit_api.h
@@ -1,7 +1,7 @@
 /*
  * HwInit_api.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -61,6 +61,7 @@
 TI_HANDLE hwInit_Create (TI_HANDLE hOs);
 TI_STATUS hwInit_Init   (TI_HANDLE hHwInit,
                          TI_HANDLE hReport, 
+                         TI_HANDLE hTimer, 
                          TI_HANDLE hTWD, 
                          TI_HANDLE hFinalizeDownload, 
                          TFinalizeCb fFinalizeDownload, 
diff --git a/wl1271/TWD/FW_Transfer/HwInit.c b/wl1271/TWD/FW_Transfer/HwInit.c
index cdb6c00..8e7b3dc 100644
--- a/wl1271/TWD/FW_Transfer/HwInit.c
+++ b/wl1271/TWD/FW_Transfer/HwInit.c
@@ -1,7 +1,7 @@
 /*
  * HwInit.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -48,6 +48,7 @@
 #include "tidef.h"
 #include "osApi.h"
 #include "report.h"
+#include "timer.h"
 #include "HwInit_api.h"
 #include "FwEvent_api.h"
 #include "TwIf.h"
@@ -128,6 +129,21 @@
 #define DRPw_MASK_CHECK  0xc0
 #define DRPw_MASK_SET    0x2000000
 
+/* time to wait till we check if fw is running */
+#define STALL_TIMEOUT   7
+
+#ifdef DOWNLOAD_TIMER_REQUIERD
+#define FIN_LOOP 10
+#endif
+
+
+#ifdef _VLCT_
+#define FIN_LOOP 10
+#else
+#define FIN_LOOP 20000
+#endif
+
+
 /************************************************************************
  * Macros
  ************************************************************************/
@@ -334,7 +350,8 @@
      TI_UINT32               uRegStage;
     TI_UINT32               uRegLoop;
     TI_UINT32               uRegSeqStage;
-    TI_UINT32               uRegData;  
+    TI_UINT32               uRegData;
+	TI_HANDLE               hStallTimer;
 
     /* Top register Read/Write SM temporary data*/
     TI_UINT32               uTopRegAddr;
@@ -375,8 +392,9 @@
 static TI_STATUS hwInit_InitTopRegisterRead(TI_HANDLE hHwInit, TI_UINT32 uAddress);
 static TI_STATUS hwInit_TopRegisterWrite(TI_HANDLE hHwInit);
 static TI_STATUS hwInit_InitTopRegisterWrite(TI_HANDLE hHwInit, TI_UINT32 uAddress, TI_UINT32 uValue);
-
-
+#ifdef DOWNLOAD_TIMER_REQUIERD
+static void      hwInit_StallTimerCb                (TI_HANDLE hHwInit, TI_BOOL bTwdInitOccured);
+#endif
 
 
 /*******************************************************************************
@@ -431,6 +449,13 @@
 {
     THwInit *pHwInit = (THwInit *)hHwInit;
 
+    if (pHwInit->hStallTimer)
+    {
+#ifdef DOWNLOAD_TIMER_REQUIERD
+		tmr_DestroyTimer (pHwInit->hStallTimer);
+#endif
+    }        
+
     /* Free HwInit Module */
     os_memoryFree (pHwInit->hOs, pHwInit, sizeof(THwInit));
 
@@ -447,11 +472,12 @@
 *               TI_NOK - Configuration unsuccessful
 ***************************************************************************/
 TI_STATUS hwInit_Init (TI_HANDLE      hHwInit,
-                         TI_HANDLE      hReport,
-                         TI_HANDLE      hTWD,
-                         TI_HANDLE 	hFinalizeDownload, 
-			 TFinalizeCb    fFinalizeDownload, 
-                         TEndOfHwInitCb fInitHwCb)
+                       TI_HANDLE      hReport,
+                       TI_HANDLE      hTimer,
+                       TI_HANDLE      hTWD,
+                       TI_HANDLE 	  hFinalizeDownload, 
+                       TFinalizeCb    fFinalizeDownload, 
+                       TEndOfHwInitCb fInitHwCb)
 {
     THwInit   *pHwInit = (THwInit *)hHwInit;
     TTxnStruct* pTxn;
@@ -485,6 +511,14 @@
         TXN_PARAM_SET(pTxn, TXN_LOW_PRIORITY, TXN_FUNC_ID_WLAN, TXN_DIRECTION_WRITE, TXN_INC_ADDR)
     }
 
+#ifdef DOWNLOAD_TIMER_REQUIERD
+	pHwInit->hStallTimer = tmr_CreateTimer (hTimer);
+	if (pHwInit->hStallTimer == NULL) 
+	{
+		return TI_NOK;
+	}
+#endif
+
     TRACE0(pHwInit->hReport, REPORT_SEVERITY_INIT, ".....HwInit configured successfully\n");
     
     return TI_OK;
@@ -1021,11 +1055,6 @@
     TI_STATUS status = TI_OK;
     TTxnStruct* pTxn;
 
-#ifdef _VLCT_
-    #define FIN_LOOP 10
-#else
-    #define FIN_LOOP 20000
-#endif
 
     while (TI_TRUE)
     {
@@ -1092,7 +1121,9 @@
             {           
                 pHwInit->uFinStage = 4;
 
-                os_StalluSec (pHwInit->hOs, 50);
+#ifndef DOWNLOAD_TIMER_REQUIERD
+				os_StalluSec (pHwInit->hOs, 50);
+#endif
 
                 /* Read interrupt status register */
                 BUILD_HW_INIT_TXN_DATA(pHwInit, pTxn, ACX_REG_INTERRUPT_NO_CLEAR, 0, 
@@ -1136,8 +1167,15 @@
             {
                 pHwInit->uFinStage = 3;
                 pHwInit->uFinLoop ++;
+
+#ifdef DOWNLOAD_TIMER_REQUIERD
+                tmr_StartTimer (pHwInit->hStallTimer, hwInit_StallTimerCb, hHwInit, STALL_TIMEOUT, TI_FALSE);
+                return TXN_STATUS_PENDING;
+#endif
             }
+#ifndef DOWNLOAD_TIMER_REQUIERD
             continue;
+#endif
 
         case 5:  
             pHwInit->uFinStage++;
@@ -1231,16 +1269,9 @@
         /* Disable Rx/Tx */
     BUILD_HW_INIT_TXN_DATA(pHwInit, pTxn, REG_ENABLE_TX_RX, 0x0, 
                                REGISTER_SIZE, TXN_DIRECTION_WRITE, NULL, NULL)
-    twIf_Transact(pHwInit->hTwIf, pTxn);
-
-    pHwInit->uTxnIndex++;
-
-        /* Disable auto calibration on start */
-    BUILD_HW_INIT_TXN_DATA(pHwInit, pTxn, SPARE_A2, 0xFFFF, 
-                               REGISTER_SIZE, TXN_DIRECTION_WRITE,(TTxnDoneCb)hwInit_BootSm, hHwInit)
     status = twIf_Transact(pHwInit->hTwIf, pTxn);
-
-    return status;
+	pHwInit->uTxnIndex++;
+	return status;
 }
 
 
@@ -2309,3 +2340,21 @@
      } /* End while */
 
  }
+
+
+/****************************************************************************
+*                      hwInit_StallTimerCb ()
+****************************************************************************
+* DESCRIPTION: CB timer function in fTimerFunction format that calls hwInit_StallTimerCb
+* INPUTS:  TI_HANDLE hHwInit    
+* 
+* OUTPUT:  None
+* 
+* RETURNS: None
+****************************************************************************/
+#ifdef DOWNLOAD_TIMER_REQUIERD
+ static void hwInit_StallTimerCb (TI_HANDLE hHwInit, TI_BOOL bTwdInitOccured)
+{
+	hwInit_FinalizeDownloadSm (hHwInit);
+}
+#endif
diff --git a/wl1271/TWD/FW_Transfer/RxXfer.c b/wl1271/TWD/FW_Transfer/RxXfer.c
index c5d2a26..9e82964 100644
--- a/wl1271/TWD/FW_Transfer/RxXfer.c
+++ b/wl1271/TWD/FW_Transfer/RxXfer.c
@@ -1,7 +1,7 @@
 /*
  * RxXfer.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -312,8 +312,8 @@
 static void rxXfer_ForwardPacket (TRxXfer *pRxXfer, TTxnStruct *pTxn)
 {
     TI_UINT32 uBufNum;
-#ifdef TI_DBG   /* for packet sanity check */
     RxIfDescriptor_t *pRxInfo  = (RxIfDescriptor_t*)(pTxn->aBuf[0]);
+#ifdef TI_DBG   /* for packet sanity check */
     TI_UINT16        uLenFromRxInfo;
 #endif
 
diff --git a/wl1271/TWD/FirmwareApi/public_infoele.h b/wl1271/TWD/FirmwareApi/public_infoele.h
index b818e49..96696df 100644
--- a/wl1271/TWD/FirmwareApi/public_infoele.h
+++ b/wl1271/TWD/FirmwareApi/public_infoele.h
@@ -1,7 +1,7 @@
 /*
  * public_infoele.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -120,9 +120,6 @@
     ACX_PEER_HT_CAP             = 0x0057,
     ACX_HT_BSS_OPERATION        = 0x0058,
     ACX_COEX_ACTIVITY           = 0x0059,
-    ACX_SET_SMART_REFLEX_DEBUG  = 0x005A,
-	ACX_SET_SMART_REFLEX_STATE  = 0x005B,
-	ACX_SET_SMART_REFLEX_PARAMS = 0x005F,
 	ACX_BURST_MODE				= 0x005C,
 
     ACX_SET_RATE_MAMAGEMENT_PARAMS = 0x005D,
@@ -1956,6 +1953,7 @@
     uint8       enable;     /* 1 - enable, 0 - disable the data data filtering feature */
     filter_e    action;     /* default action that should be implemented for packets that wont
                                match any of the filters, or in case no filter is configured */
+    uint8   padding[2];     /* alignment to 32bits boundary   */        
 } DataFilterDefault_t;
 
 
@@ -2380,69 +2378,6 @@
 }AcxRateMangeReadParams;
 
 
-
-/******************************************************************************
-
-    Name:	ACX_SET_SMART_REFLEX_STATE
-    Desc:   Configure smart reflex state (enable/disable).
-    Type:   Configuration
-    Access: Write Only
-    Length:
-
-******************************************************************************/
-
-typedef struct
-{
-	INFO_ELE_HDR
-    Bool_e  enable;
-    uint8 padding [3];
-}ACXSmartReflexState_t;
-
-
-/******************************************************************************
-
-    Name:	ACX_SET_SMART_REFLEX_DEBUG
-    Desc:   Configure smart reflex mechanism parameters - for debug mode.
-    Type:   Configuration
-    Access: Write Only
-    Length:
-
-******************************************************************************/
-typedef struct
-{
-	uint8 len; //maximum length is 14
-	int8 upperLimit;
-	int8 values[14]; //this is the maximum length (in rows) of the error table
-}SmartReflexErrTable_t;
-
-typedef struct
-{
-	INFO_ELE_HDR
-	SmartReflexErrTable_t errorTable;
-	uint16 senN_P;
-	uint16 senNRN;
-	uint16 senPRN;
-	uint16 senN_P_Gain;
-}ACXSmartReflexDebugParams_t;
-
-
-/******************************************************************************
-
-    Name:	ACX_SET_SMART_REFLEX_PARAMS
-    Desc:   Configure smart reflex mechanism tables - 1 for each FAB.
-			The FW will choose the correct FAB, according to what is burned in the Efuse.
-    Type:   Configuration
-    Access: Write Only
-    Length:
-
-******************************************************************************/
-
-typedef struct
-{
-	INFO_ELE_HDR
-	SmartReflexErrTable_t errorTable[3];
-}ACXSmartReflexConfigParams_t;
-
 /******************************************************************************
 
     Name:   ACX_SET_DCO_ITRIM_PARAMS    
diff --git a/wl1271/TWD/FirmwareApi/public_radio.h b/wl1271/TWD/FirmwareApi/public_radio.h
index 88e983d..47ddfc3 100644
--- a/wl1271/TWD/FirmwareApi/public_radio.h
+++ b/wl1271/TWD/FirmwareApi/public_radio.h
@@ -1,7 +1,7 @@
 /*
  * public_radio.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -59,6 +59,7 @@
 #include "public_types.h"
 #define MAC_ADDR_SIZE 6
 /* typedef uint8 TMacAddr[MAC_ADDR_SIZE]; */
+/*defined in tiDefs.h*/
 /************************************************************************/
 /*																		*/	
 /*							Definitions section                         */
@@ -434,8 +435,10 @@
 
 }RADIO_CHANNEL_INDEX_ENM;
 
-#define NUMBER_OF_2_4_G_CHANNELS    (NUMBER_OF_2_4_G_CHANNEL_INDICES_E + 1)
-#define NUMBER_OF_5G_CHANNELS       (NUMBER_OF_RADIO_CHANNEL_INDEXS_E - NUMBER_OF_2_4_G_CHANNELS)
+#define NUMBER_OF_2_4_G_CHANNELS    	(NUMBER_OF_2_4_G_CHANNEL_INDICES_E + 1)
+#define NUMBER_OF_5G_CHANNELS       	(NUMBER_OF_RADIO_CHANNEL_INDEXS_E - NUMBER_OF_2_4_G_CHANNELS)
+#define HALF_NUMBER_OF_2_4_G_CHANNELS 	(NUMBER_OF_2_4_G_CHANNELS / 2)
+#define HALF_NUMBER_OF_5G_CHANNELS  	((NUMBER_OF_5G_CHANNELS + 1) / 2)
 
 typedef enum RADIO_RATE_GROUPS_ENMT
 {		
@@ -710,6 +713,7 @@
 /*	0x23	*/	TEST_CMD_SMART_REFLEX,
 /*	0x24	*/	TEST_CMD_CHANNEL_RESPONSE,
 /*	0x25	*/	TEST_CMD_DCO_ITRIM_FEATURE,
+/*	0x26	*/	TEST_CMD_INI_FILE_RF_EXTENDED_PARAM,
 
     MAX_TEST_CMD_ID = 0xFF	/* Dummy - must be last!!! (make sure that Enum variables are type of int) */
         
@@ -1551,6 +1555,14 @@
 
 }IniFileRadioParam;  
 
+typedef struct 
+{
+	int8  TxPerChannelPowerCompensation_2_4G[HALF_NUMBER_OF_2_4_G_CHANNELS]; /* 7 */	
+	int8  TxPerChannelPowerCompensation_5G_OFDM[HALF_NUMBER_OF_5G_CHANNELS]; /* 18 */
+	uint8 Padding[3];
+
+}IniFileExtendedRadioParam;  
+	
 /*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\*/
 
 /* Describes a reference design supported by the HDK Module */
@@ -1616,13 +1628,14 @@
 		TFWVerisons						fwVersions;
 		TTestCmdRunCalibration			RunCalibration;
         IniFileRadioParam				IniFileRadioParams;
-        IniFileGeneralParam				IniFileGeneralParams;
+		IniFileExtendedRadioParam		IniFileExtendedRadioParams;
+		IniFileGeneralParam				IniFileGeneralParams;
 		EfuseParameters_t				EfuseParams;
 		TestToneParams_t				TestToneParams;
 		TTestCmdPowerMode				powerMode;
         TTestCmdFreeRSSI                freeRSSI;
 		TTestCmdCLPCCommands			clpcCommands;
-        TTestCmdDCOItrimOnOff              DCOitrimFeatureOnOff;
+		TTestCmdDCOItrimOnOff           DCOitrimFeatureOnOff;
 
 		TTestCmdDebug					testDebug;
     }testCmd_u;
diff --git a/wl1271/TWD/TWDriver/TWDriver.c b/wl1271/TWD/TWDriver/TWDriver.c
index 59787ad..eebfcee 100644
--- a/wl1271/TWD/TWDriver/TWDriver.c
+++ b/wl1271/TWD/TWDriver/TWDriver.c
@@ -1,7 +1,7 @@
 /*
  * TWDriver.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -59,7 +59,6 @@
 #include "CmdBld.h"
 #include "RxQueue_api.h"
 
-void TWD_CheckSRConfigParams(TTwd  *pTWD, ACXSmartReflexConfigParams_t *tSmartReflexParams);
 
 
 #define TWD_CB_MODULE_OWNER_MASK    0xff00
@@ -433,11 +432,12 @@
                    pTWD->hTwIf);
 
     hwInit_Init (pTWD->hHwInit,
-                   pTWD->hReport, 
-                   hTWD, 
-	               hTWD, 
-		           (TFinalizeCb)TWD_FinalizeDownload, 
-                   TWD_InitHwCb);
+                 pTWD->hReport, 
+                 pTWD->hTimer, 
+                 hTWD, 
+	             hTWD, 
+		         (TFinalizeCb)TWD_FinalizeDownload, 
+                 TWD_InitHwCb);
 
     /*
      * Initialize the FW-Transfer modules
@@ -448,7 +448,7 @@
 
     rxXfer_Init (pTWD->hRxXfer, pTWD->hFwEvent, pTWD->hReport, pTWD->hTwIf, pTWD->hRxQueue);
 
-    RxQueue_Init (pTWD->hRxQueue, pTWD->hReport);
+    RxQueue_Init (pTWD->hRxQueue, pTWD->hReport, pTWD->hTimer);
 
 #ifdef TI_DBG
     fwDbg_Init (pTWD->hFwDbg, pTWD->hReport, pTWD->hTwIf);
@@ -617,16 +617,17 @@
 {
     TTwd         *pTWD = (TTwd *)hTWD;
 
-    TWlanParams         *pWlanParams = &DB_WLAN(pTWD->hCmdBld);
-    TKeepAliveList      *pKlvParams = &DB_KLV(pTWD->hCmdBld);
-    IniFileRadioParam   *pRadioParams = &DB_RADIO(pTWD->hCmdBld);
-    IniFileGeneralParam *pGenParams = &DB_GEN(pTWD->hCmdBld);
-	TRateMngParams      *pRateMngParams = &DB_RM(pTWD->hCmdBld);
-    TDmaParams          *pDmaParams = &DB_DMA(pTWD->hCmdBld);
+    TWlanParams         		*pWlanParams = &DB_WLAN(pTWD->hCmdBld);
+    TKeepAliveList      		*pKlvParams = &DB_KLV(pTWD->hCmdBld);
+    IniFileRadioParam   		*pRadioParams = &DB_RADIO(pTWD->hCmdBld);
+	IniFileExtendedRadioParam   *pExtRadioParams = &DB_EXT_RADIO(pTWD->hCmdBld);
+    IniFileGeneralParam 		*pGenParams = &DB_GEN(pTWD->hCmdBld);
+	TRateMngParams      		*pRateMngParams = &DB_RM(pTWD->hCmdBld);
+    TDmaParams          		*pDmaParams = &DB_DMA(pTWD->hCmdBld);
 
     TI_UINT32            k, uIndex;
     int iParam;
-   
+
     TRACE0(pTWD->hReport, REPORT_SEVERITY_INIT , "TWD_SetDefaults: called\n");
 
     pTWD->bRecoveryEnabled = pInitParams->tGeneral.halCtrlRecoveryEnable;
@@ -678,7 +679,9 @@
     pWlanParams->ListenInterval             = (TI_UINT8)pInitParams->tGeneral.halCtrlListenInterval;
     pWlanParams->RateFallback               = pInitParams->tGeneral.halCtrlRateFallbackRetry;        
     pWlanParams->MacClock                   = pInitParams->tGeneral.halCtrlMacClock;     
-    pWlanParams->ArmClock                   = pInitParams->tGeneral.halCtrlArmClock;     
+    pWlanParams->ArmClock                   = pInitParams->tGeneral.halCtrlArmClock;
+
+	pWlanParams->ch14TelecCca = pInitParams->tGeneral.halCtrlCh14TelecCca;
 
     /* Data interrupts pacing */
     pWlanParams->TxCompletePacingThreshold  = pInitParams->tGeneral.TxCompletePacingThreshold; 
@@ -762,11 +765,13 @@
      * 802.11n
      */
     pWlanParams->tTwdHtCapabilities.b11nEnable =            pInitParams->tGeneral.b11nEnable;
+    
     /* Configure HT capabilities setting */
-    pWlanParams->tTwdHtCapabilities.uChannelWidth =         CHANNEL_WIDTH_20MHZ;                  
-    pWlanParams->tTwdHtCapabilities.uRxSTBC =               RXSTBC_SUPPORTED_ONE_SPATIAL_STREAM;
-    pWlanParams->tTwdHtCapabilities.uMaxAMSDU =             MAX_MSDU_3839_OCTETS;                         
-    pWlanParams->tTwdHtCapabilities.uMaxAMPDU =             MAX_MPDU_8191_OCTETS;
+    pWlanParams->tTwdHtCapabilities.uChannelWidth = CHANNEL_WIDTH_20MHZ;                  
+    pWlanParams->tTwdHtCapabilities.uRxSTBC       = RXSTBC_NOT_SUPPORTED;
+    pWlanParams->tTwdHtCapabilities.uMaxAMSDU     = MAX_MSDU_3839_OCTETS;                         
+    pWlanParams->tTwdHtCapabilities.uMaxAMPDU     = pInitParams->tGeneral.uMaxAMPDU;
+
     pWlanParams->tTwdHtCapabilities.uAMPDUSpacing =         AMPDU_SPC_8_MICROSECONDS;
     pWlanParams->tTwdHtCapabilities.aRxMCS[0] =             (MCS_SUPPORT_MCS_0 |
                                                              MCS_SUPPORT_MCS_1 |
@@ -793,6 +798,7 @@
     pWlanParams->tTwdHtCapabilities.uMCSFeedback =           MCS_FEEDBACK_NO; 
 
     os_memoryCopy(pTWD->hOs, (void*)pRadioParams, (void*)&pInitParams->tIniFileRadioParams, sizeof(IniFileRadioParam));
+	os_memoryCopy(pTWD->hOs, (void*)pExtRadioParams, (void*)&pInitParams->tIniFileExtRadioParams, sizeof(IniFileExtendedRadioParam));
     os_memoryCopy(pTWD->hOs, (void*)pGenParams, (void*)&pInitParams->tPlatformGenParams, sizeof(IniFileGeneralParam));
     
     os_memoryCopy (pTWD->hOs,
@@ -829,40 +835,6 @@
     return TI_OK;
 }
 
-/*
-#define MAX_SR_PARAM_LEN  14
-
-void TWD_CheckSRConfigParams(TTwd  *pTWD, ACXSmartReflexConfigParams_t *tSmartReflexParams)
-{
-  int i,j;
-  TI_UINT8 len;
-  TI_BOOL flag = TI_FALSE;
-
-
-  for (i = 0; i<3; i++)
-  {
-    len = tSmartReflexParams->errorTable[i].len;
-     if (len > MAX_SR_PARAM_LEN)
-          flag = TI_TRUE;
-     for (j=0;j<len-1;j++)
-     {
-      if (tSmartReflexParams->errorTable[i].values[j] == 0)
-         flag = TI_TRUE;
-     }
-     if (flag == TI_TRUE)
-      {
-        tSmartReflexParams->errorTable[i].len= 0 ;
-        tSmartReflexParams->errorTable[i].upperLimit = 0;
-        os_memoryZero(pTWD->hOs,tSmartReflexParams->errorTable[i].values,MAX_SR_PARAM_LEN) ;
-      }
-
-  }
-
-
-
-} */
-
-
 TI_STATUS TWD_ConfigFw (TI_HANDLE hTWD)
 {
     TTwd *pTWD = (TTwd *)hTWD;
diff --git a/wl1271/TWD/TWDriver/TWDriver.h b/wl1271/TWD/TWDriver/TWDriver.h
index 23182e9..225a103 100644
--- a/wl1271/TWD/TWDriver/TWDriver.h
+++ b/wl1271/TWD/TWDriver/TWDriver.h
@@ -1,7 +1,7 @@
 /*
  * TWDriver.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -71,7 +71,6 @@
 #ifndef TWDRIVER_H
 #define TWDRIVER_H
 
-#define MAX_NUM_OF_802_1d_TAGS          8
 
 #include "802_11Defs.h"
 #include "TWDriverMsr.h"
@@ -226,11 +225,10 @@
 #define SMART_REFLEX_STATE_MAX        TI_TRUE
 #define SMART_REFLEX_STATE_DEF        TI_TRUE
 
-#define SMART_REFLEX_DEBUG_MIN        0
-#define SMART_REFLEX_DEBUG_MAX        0xFFFF
-#define SMART_REFLEX_DEBUG_DEF        0
-
 #define SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE  "0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"
+#define SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE_SRF1  "07,03,18,10,05,fb,f0,e8, 0,0,0,0,0,0,0f,3f"
+#define SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE_SRF2  "07,03,18,10,05,f6,f0,e8"
+#define SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE_SRF3  "07,03,18,10,05,fb,f0,e8"
 
 #define TWD_FRAG_THRESHOLD_MIN          256
 #define TWD_FRAG_THRESHOLD_MAX          4096
@@ -292,7 +290,7 @@
 #define TWD_RX_AGGREG_PKTS_LIMIT_MAX    4
 
 /* Tx aggregation packets number limit (max packets in one aggregation) */
-#define TWD_TX_AGGREG_PKTS_LIMIT_DEF    8
+#define TWD_TX_AGGREG_PKTS_LIMIT_DEF    0
 #define TWD_TX_AGGREG_PKTS_LIMIT_MIN    0 
 #define TWD_TX_AGGREG_PKTS_LIMIT_MAX    32
 
@@ -452,6 +450,7 @@
 #define HT_INF_NON_GF_PRES_BITMASK             0x04
 #define HT_INF_TX_BURST_LIMIT_BITMASK          0x08
 #define HT_INF_DUAL_BEACON_BITMASK             0x40
+#define HT_INF_DUAL_CTS_PROTECTION_BITMASK     0x80
 
 /* 
  * TWD HT capabilities, physical capabilities of the STA.
@@ -1213,15 +1212,28 @@
  * 
  * \sa TWD_SetDefaults, TTwdHtCapabilities
  */
+
+/*
+ ==============
+
+ IMPORTANT NOTE - Changes to this enumeration must check weather MIN and MAX values 
+                  should be updated
+ ==============
+*/
 typedef enum
 {   
-/*	0	*/	MAX_MPDU_8191_OCTETS = 0,	/**< Maximum MPDU Octets Number: 8191	*/
-/*	1	*/  MAX_MPDU_16383_OCTETS,		/**< Maximum MPDU Octets Number: 16383	*/
-/*	2	*/  MAX_MPDU_32767_OCTETS,		/**< Maximum MPDU Octets Number: 32767	*/
-/*	3	*/  MAX_MPDU_65535_OCTETS		/**< Maximum MPDU Octets Number: 65535	*/
+            MAX_MPDU_MIN_VALUE = 0,
+
+/*	0	*/	MAX_MPDU_8191_OCTETS = MAX_MPDU_MIN_VALUE,	/**< Maximum MPDU Octets Number: 8191	*/
+/*	1	*/  MAX_MPDU_16383_OCTETS,		                /**< Maximum MPDU Octets Number: 16383	*/
+/*	2	*/  MAX_MPDU_32767_OCTETS,		                /**< Maximum MPDU Octets Number: 32767	*/
+/*	3	*/  MAX_MPDU_65535_OCTETS,		                /**< Maximum MPDU Octets Number: 65535	*/
+
+            MAX_MPDU_MAX_VALUE = MAX_MPDU_65535_OCTETS
 
 } ETwdMaxAMPDU;
 
+
 /** \enum ETwdAMPDUSpacing
  * \brief TWD AMPDU Spacing
  * 
@@ -2518,7 +2530,7 @@
  */ 
 typedef struct
 {
-    PacketClassTag_enum                 ePacketType;    /**< */
+    PacketClassTag_e                    ePacketType;    /**< */
     TI_STATUS                           status;			/**< */
     ERate                               Rate;   		/**< */
     TI_UINT8                            SNR;			/**< */
@@ -2554,7 +2566,7 @@
     TI_UINT8                            halCtrlArmClock;					/**< */
     TI_UINT16                           halCtrlBcnRxTime;					/**< */
     TI_BOOL                             halCtrlRxEnergyDetection;    		/**< */
-    TI_BOOL                             halCtrlTxEnergyDetection;			/**< */
+    TI_BOOL                             halCtrlCh14TelecCca;				/**< */
     TI_BOOL                             halCtrlEepromLessEnable;			/**< */
     TI_BOOL                             halCtrlRxDisableBroadcast;			/**< */
     TI_BOOL                             halCtrlRecoveryEnable;				/**< */
@@ -2605,6 +2617,7 @@
     TI_UINT8                            uHostFastWakeupSupport;             /**< */
     THalCoexActivityTable               halCoexActivityTable;               /**< */
     TFmCoexParams                       tFmCoexParams;                      /**< */
+    TI_UINT8                            uMaxAMPDU;                          /**< */
 
 } TGeneralInitParams;
 
@@ -2717,12 +2730,10 @@
     TArpIpFilterInitParams              tArpIpFilter;		 /**< ARP IP filter Initialization Parameters	*/
     TMacAddrFilterInitParams            tMacAddrFilter;		 /**< MAC Address Initialization Parameters		*/
     IniFileRadioParam                   tIniFileRadioParams; /**< Radio Initialization Parameters   		*/
-    IniFileGeneralParam                 tPlatformGenParams; /**< Radio Initialization Parameters   	        */
-    ACXSmartReflexConfigParams_t        tSmartReflexParams;       /**< Smart Refelx Parameters   	        */
-    ACXSmartReflexDebugParams_t         tSmartReflexDebugParams;  /**< Smart Refelx Debug Parameters   	    */
-    ACXSmartReflexState_t               tSmartReflexState;        /**< Smart Refelx state   	            */
+	IniFileExtendedRadioParam			tIniFileExtRadioParams; /**< Radio Initialization Parameters   		*/
+    IniFileGeneralParam                 tPlatformGenParams;  /**< Radio Initialization Parameters           */
 	RateMangeParams_t					tRateMngParams;			  
-    DcoItrimParams_t                    tDcoItrimParams;          /**< Dco Itrim Parameters   	            */
+    DcoItrimParams_t                    tDcoItrimParams;     /**< Dco Itrim Parameters                      */
    
 } TTwdInitParams;
 
diff --git a/wl1271/TWD/TWDriver/TWDriverCtrl.c b/wl1271/TWD/TWDriver/TWDriverCtrl.c
index 1707fda..8cb89e9 100644
--- a/wl1271/TWD/TWDriver/TWDriverCtrl.c
+++ b/wl1271/TWD/TWDriver/TWDriverCtrl.c
@@ -1,7 +1,7 @@
 /*
  * TWDriverCtrl.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -836,11 +836,11 @@
 
     uHtProtection = (pHtInformationIe->aHtInformationIe[2] & HT_INF_OPERATION_MOD_BITMASK);
 
-    uGfProtection = (pHtInformationIe->aHtInformationIe[3] & HT_INF_NON_GF_PRES_BITMASK) >> 2; 
+    uGfProtection = (pHtInformationIe->aHtInformationIe[2] & HT_INF_NON_GF_PRES_BITMASK) >> 2; 
 
-    uHtTxBurstLimit = (pHtInformationIe->aHtInformationIe[3] & HT_INF_TX_BURST_LIMIT_BITMASK) >> 3; 
+    uHtTxBurstLimit = 0; /* not in use */
 
-    uDualCtsProtection = (pHtInformationIe->aHtInformationIe[4] & HT_INF_DUAL_BEACON_BITMASK) >> 6; 
+    uDualCtsProtection = (pHtInformationIe->aHtInformationIe[4] & HT_INF_DUAL_CTS_PROTECTION_BITMASK) >> 7; 
 
     return cmdBld_CfgSetFwHtInformation (pTWD->hCmdBld,
                                          uRifsMode,
diff --git a/wl1271/TWD/TWDriver/TWDriverScan.h b/wl1271/TWD/TWDriver/TWDriverScan.h
index 2aa7a4b..4bc4619 100644
--- a/wl1271/TWD/TWDriver/TWDriverScan.h
+++ b/wl1271/TWD/TWDriver/TWDriverScan.h
@@ -1,7 +1,7 @@
 /*
  * TWDriverScan.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -68,7 +68,6 @@
 #define PERIODIC_SCAN_MAX_INTERVAL_NUM  					16
 #define PERIODIC_SCAN_MAX_CHANNEL_NUM   					37 /* G-14 + A-23 */
 
-#define MAX_SSID_LEN  										32
 
  /*
  ***********************************************************************
diff --git a/wl1271/Txn/BusDrv.h b/wl1271/Txn/BusDrv.h
index d29965d..64a92d7 100644
--- a/wl1271/Txn/BusDrv.h
+++ b/wl1271/Txn/BusDrv.h
@@ -1,7 +1,7 @@
 /*
  * BusDrv.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -116,7 +116,7 @@
     pTxn->aLen[1] = 0;                 \
     pTxn->uHwAddr = uAddr;             \
     pTxn->hCbHandle = (void*)hCB;      \
-    pTxn->fTxnDoneCb = (void*)fCB;
+    pTxn->fTxnDoneCb = (TTxnDoneCb)fCB;
 
 
 /************************************************************************
diff --git a/wl1271/Txn/SdioBusDrv.c b/wl1271/Txn/SdioBusDrv.c
index 20efe78..55a6462 100644
--- a/wl1271/Txn/SdioBusDrv.c
+++ b/wl1271/Txn/SdioBusDrv.c
@@ -1,7 +1,7 @@
 /*
  * SdioBusDrv.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -238,7 +238,7 @@
      *           SDIO driver into pBusDrv->pDmaBuffer.
      */
 
-    iStatus = sdioAdapt_ConnectBus (busDrv_TxnDoneCb, 
+    iStatus = sdioAdapt_ConnectBus ((void *)busDrv_TxnDoneCb, 
                                     hBusDrv, 
                                     pBusDrv->uBlkSizeShift, 
                                     pBusDrvCfg->tSdioCfg.uBusDrvThreadPriority,
diff --git a/wl1271/config/tiwlan.ini b/wl1271/config/tiwlan.ini
index 569dd3f..87bfbff 100644
--- a/wl1271/config/tiwlan.ini
+++ b/wl1271/config/tiwlan.ini
@@ -1,13 +1,7 @@
 # The letters in this file are case sensitive, use lower case only !!!
 
-coexWlanActiveBtAclMasterMinEDR = 20
-coexWlanActiveBtAclMasterMaxEDR = 50
-coexWlanActiveMaxBtAclMasterEDR = 10
-coexWlanActiveBtAclSlaveMinEDR = 20
-coexWlanActiveBtAclSlaveMinEDR = 50
-coexWlanActiveMaxBtAclSlaveEDR = 10
-
 SmeConnectMode = 1               #0 - auto, 1 - manual
+ScanResultAging = 0              # in Second - range 0..1000
 WME_Enable = 1                   #0=diable WME support / 1=Enable
 dot11NetworkType = 3             #2 - A only mode, 3 - B/G mode, 4 - A/G Dual mode
 SmeScanGChannelList = 1,2,3,4,5,6,7,8,9,10,11,12,13,14
@@ -50,7 +44,6 @@
 DcoItrimModerationTimeout = 50000
 
 TxPower = 205           #set Default Tx Power Level in DBM * 10
-TriggerFcs = 0          # 0 - Disabled  1 - Enabled
 dot11FragmentationThreshold = 4096
 dot11RTSThreshold = 4096
 WPAMixedMode= 1
@@ -196,11 +189,16 @@
 RoamScanEnable = 0              # 1- roaming and immidate scan enable by deafult 0- allowing roaming & scannig due to CLI confguration
 RoamingOperationalMode = 1      # 0=Manual , 1=Auto
 RSNExternalMode = 0             # 0=Internal , 1=External
+SendTspecInReassPkt = 0 # 0=do not send, 1=send
+
 
 FmCoexuSwallowPeriod = 5
 FmCoexuNDividerFrefSet2 = 12
 FmCoexuMDividerFrefSet2 = 148
 
+BaPolicyTid_0 = 3
+
+
 ##############################################################################################################################
 ################################################## Radio parameters data - Start ############################################# 
 ##############################################################################################################################
diff --git a/wl1271/platforms/hw/linux/host_platform.h b/wl1271/platforms/hw/linux/host_platform.h
index 362267e..db9d6b0 100644
--- a/wl1271/platforms/hw/linux/host_platform.h
+++ b/wl1271/platforms/hw/linux/host_platform.h
@@ -1,7 +1,7 @@
 /*
  * host_platform.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -44,7 +44,6 @@
 
 #include <mach/hardware.h>
 
-//OMAP343X_CTRL_BASE =  0x48002000
 
 #define OMAP_HSMMC1_BASE		0x4809C000
 #define OMAP_HSMMC2_BASE		0x480B4000
diff --git a/wl1271/platforms/os/common/build/linux/common.inc b/wl1271/platforms/os/common/build/linux/common.inc
index 86e9235..65fba0a 100644
--- a/wl1271/platforms/os/common/build/linux/common.inc
+++ b/wl1271/platforms/os/common/build/linux/common.inc
@@ -76,6 +76,9 @@
 ## Driver Compilation Directives
 ##
 ##
+ifeq "$(HOST_PLATFORM)" "omap2430"	
+	DK_DEFINES += -D HOST_PLATFORM_OMAP2430
+endif
 ifeq "$(HOST_PLATFORM)" "omap3430"
 	DK_DEFINES += -D HOST_PLATFORM_OMAP3430
 endif
diff --git a/wl1271/platforms/os/common/src/osRgstry.c b/wl1271/platforms/os/common/src/osRgstry.c
index f2cc731..a4988de 100644
--- a/wl1271/platforms/os/common/src/osRgstry.c
+++ b/wl1271/platforms/os/common/src/osRgstry.c
@@ -1,7 +1,7 @@
 /*
  * osRgstry.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -161,10 +161,8 @@
 NDIS_STRING STRdot11SupportedRateMask_A       = NDIS_STRING_CONST( "dot11SupportedRateMaskA");
 NDIS_STRING STRdot11BasicRateMask_AG           = NDIS_STRING_CONST( "dot11BasicRateMaskAG");
 NDIS_STRING STRdot11SupportedRateMask_AG       = NDIS_STRING_CONST( "dot11SupportedRateMaskAG");
-/*** MODS_BEGIN_FOR_11N_RATE_REPORTING ***/
-NDIS_STRING STRdot11BasicRateMask_N           = NDIS_STRING_CONST( "dot11BasicRateMask_N");
-NDIS_STRING STRdot11SupportedRateMask_N       = NDIS_STRING_CONST( "dot11SupportedRateMask_N");
-/*** MODS_END_FOR_11N_RATE_REPORTING ***/
+NDIS_STRING STRdot11BasicRateMask_N           = NDIS_STRING_CONST( "dot11BasicRateMaskN");
+NDIS_STRING STRdot11SupportedRateMask_N       = NDIS_STRING_CONST( "dot11SupportedRateMaskN");
 
 NDIS_STRING STRRadio11_RxLevel              = NDIS_STRING_CONST( "Radio11_RxLevel");
 NDIS_STRING STRRadio11_LNA                  = NDIS_STRING_CONST( "Radio11_LNA");
@@ -179,8 +177,8 @@
 NDIS_STRING STRdot11IbssProtection          = NDIS_STRING_CONST( "IbssProtectionType");
 NDIS_STRING STRdot11RtsCtsProtection        = NDIS_STRING_CONST( "dot11RtsCtsProtection");
 
-NDIS_STRING STRRxEnergyDetection              = NDIS_STRING_CONST( "RxEnergyDetection" );
-NDIS_STRING STRTxEnergyDetection              = NDIS_STRING_CONST( "TxEnergyDetection" );
+NDIS_STRING STRRxEnergyDetection            = NDIS_STRING_CONST( "RxEnergyDetection" );
+NDIS_STRING STRCh14TelecCca                 = NDIS_STRING_CONST( "Ch14TelecCCA" );
 NDIS_STRING STRCrtCalibrationInterval       = NDIS_STRING_CONST( "CrtCalibrationInterval" );
 NDIS_STRING STRTddCalibrationInterval       = NDIS_STRING_CONST( "TddCalibrationInterval" );
 NDIS_STRING STRMacClockRate                 = NDIS_STRING_CONST( "MacClockRate" );
@@ -246,11 +244,6 @@
 NDIS_STRING STRSRConfigParam1               = NDIS_STRING_CONST( "SRF1" );
 NDIS_STRING STRSRConfigParam2               = NDIS_STRING_CONST( "SRF2" );
 NDIS_STRING STRSRConfigParam3               = NDIS_STRING_CONST( "SRF3" );
-NDIS_STRING STRSRSenNP                      = NDIS_STRING_CONST( "SR_SEN_N_P" );
-NDIS_STRING STRSRSenNPGain                  = NDIS_STRING_CONST( "SR_SEN_N_P_Gain" );
-NDIS_STRING STRSRSenPrn                     = NDIS_STRING_CONST( "SR_SEN_PRN" );
-NDIS_STRING STRSRSenNrn                     = NDIS_STRING_CONST( "SR_SEN_NRN" );
-NDIS_STRING STRSRDebugTable                 = NDIS_STRING_CONST( "SR_Debug_Table" );
 
 
 /*
@@ -473,11 +466,16 @@
 NDIS_STRING STRTrafficIntensityThresholdEnabled = NDIS_STRING_CONST("TrafficIntensityThresholdEnabled");
 NDIS_STRING STRTrafficMonitorMinIntervalPercentage = NDIS_STRING_CONST("TrafficMonitorMinIntervalPercent");
 
-
 /* Packet Burst parameters */
 NDIS_STRING STRQOSPacketBurstEnable             = NDIS_STRING_CONST("QOS_PacketBurstEnable");
 NDIS_STRING STRQOSPacketBurstTxOpLimit          = NDIS_STRING_CONST("QOS_PacketBurstTxOpLimit");
 
+/* Performance Boost (for speed or for QoS) */
+NDIS_STRING STRPerformanceBoost                 = NDIS_STRING_CONST("PerformanceBoost");
+
+/* Maximum AMPDU Size */
+NDIS_STRING STRMaxAMPDU                         = NDIS_STRING_CONST("MaxAMPDU");
+
 /*-----------------------------------*/
 /*        QOS classifier Parameters  */
 /*-----------------------------------*/
@@ -675,6 +673,9 @@
 NDIS_STRING STRDfsPassiveDwellTimeMs             = NDIS_STRING_CONST( "DfsPassiveDwellTimeMs" );
 NDIS_STRING STRScanPushMode                      = NDIS_STRING_CONST( "ScanPushMode" );
 
+NDIS_STRING STRScanResultAging                   = NDIS_STRING_CONST( "ScanResultAging" );
+NDIS_STRING STRScanCncnRssiThreshold             = NDIS_STRING_CONST( "ScanCncnRssiThreshold" );
+
 NDIS_STRING STRParseWSCInBeacons      = NDIS_STRING_CONST( "ParseWSCInBeacons" );
 
 /*-----------------------------------*/
@@ -736,6 +737,9 @@
 NDIS_STRING STRSingle_Dual_Band_Solution =          NDIS_STRING_CONST("Single_Dual_Band_Solution");
 NDIS_STRING STRSettings = 							NDIS_STRING_CONST("Settings");
 
+NDIS_STRING STRTxPerChannelPowerCompensation_2_4G =    NDIS_STRING_CONST("TxPerChannelPowerCompensation_2_4G");
+NDIS_STRING STRTxPerChannelPowerCompensation_5G_OFDM =    NDIS_STRING_CONST("TxPerChannelPowerCompensation_5G_OFDM");
+
 /*-----------------------------------*/
 /*      Driver-Main parameters       */
 /*-----------------------------------*/
@@ -748,6 +752,7 @@
 /*      Roaming parameters    */
 /*-----------------------------------*/
 NDIS_STRING STRRoamingOperationalMode = NDIS_STRING_CONST("RoamingOperationalMode");
+NDIS_STRING STRSendTspecInReassPkt    = NDIS_STRING_CONST("SendTspecInReassPkt");
 
 /*-----------------------------------*/
 /*      FM Coexistence parameters    */
@@ -786,14 +791,9 @@
 
 NDIS_STRING STRincludeWSCinProbeReq                 = NDIS_STRING_CONST("IncludeWSCinProbeReq");
 
-/*
-NDIS_STRING STRPctACXRxMemoryPool       = NDIS_STRING_CONST( "PctACXRxMemoryPool" );
-NDIS_STRING STRSendPacketsPerOID        = NDIS_STRING_CONST( "Dot11SendPacketsPerOID" );
-NDIS_STRING STRFragCacheSize            = NDIS_STRING_CONST( "FragCacheSize" );
-*/
 
-static void regConvertStringtoMACAddress(TI_UINT8 *staMACAddressString,TI_UINT8 *MacAddressArray);
-static void regConvertStringtoBeaconIETable(TI_UINT8 *staIpAddressString,TI_UINT8 *BeaconIEArray, TI_UINT8 size);
+static void parseTwoDigitsSequenceHex (TI_UINT8 *sInString, TI_UINT8 *uOutArray, TI_UINT8 uSize);
+
 static void regConvertStringtoCoexActivityTable(TI_UINT8 *strCoexActivityTable, TI_UINT32 numOfElements, TCoexActivity *CoexActivityArray, TI_UINT8 strSize);
 
 static int decryptWEP( TI_INT8* pSrc, TI_INT8* pDst, TI_UINT32 len);
@@ -916,73 +916,6 @@
   return value;
 }
 
-/*-----------------------------------------------------------------------------
-
-Routine Name:
-
-    regConvertStringtoMACAddress
-
-Routine Description: Converts the MAC Adrress in a form of string readen from the Registry
-to the MAC Address Array to be stored in the init_table struct
-
-
-Arguments:
-
-
-Return Value:
-
-    None
-
------------------------------------------------------------------------------*/
-static void regConvertStringtoMACAddress(TI_UINT8 *staMACAddressString, TI_UINT8 *MacAddressArray)
-{
-    char *ptr;
-    TI_UINT8 *tmpMacAddr;
-    TI_UINT8 value = 0, value_l, value_h, add_value;
-    int i, str_len;
-
-    /* Take the pointer to the string MAC Address to convert it to the Array MAC Address */
-    ptr = (char *)staMACAddressString;
-    tmpMacAddr = MacAddressArray;
-    str_len = 3 * MAC_ADDR_LEN - 1;
-
-    for(i=0;(i < MAC_ADDR_LEN);ptr++,str_len--)
-    {
-        if (str_len > 0) {
-            /* The value can be or "0-9" or from "a-f" */
-            value_l = (*ptr - '0');
-            value_h = (*ptr - 'a');
-        }
-        else { /* last element */
-            value_l = value_h = 16;
-        }
-        /*PRINTF(DBG_REGISTRY,("value_l [%d] value_h [%d] *ptr %c value %d\n",value_l,value_h,*ptr,value));*/
-
-        if( (value_l <= 9) || (value_h <= 15 ) )
-        {
-            /* We are in an expected range */
-            /* Check if 0-9 */
-            if(value_l <= 9 )
-            {
-                add_value = value_l;
-            }
-            /* Check if a-f */
-            else
-            {
-                /* 'a' is in fact 10 decimal in hexa */
-                add_value = value_h + 10;
-            }
-            value = value * 16 + add_value;
-        }
-        else
-        {
-            tmpMacAddr[i] = value;
-            value = 0;
-            i++;
-        }
-    }
-}
-
 
 /*-----------------------------------------------------------------------------
 
@@ -1014,10 +947,10 @@
     /* EEPROM-less : MAC address */
     static TI_UINT8 regMACstrLen = REG_MAC_ADDR_STR_LEN;
     static TI_UINT8 staMACAddress[REG_MAC_ADDR_STR_LEN];
-    static TI_UINT8 defStaMacAddress0[]= "00 22 11 33 44 55";
+    static TI_UINT8 defStaMacAddress0[]= "10 01 02 03 04 05";
     static TI_UINT8 regArpIpStrLen = REG_ARP_IP_ADDR_STR_LEN;
     static TI_UINT8 staArpIpAddress[REG_ARP_IP_ADDR_STR_LEN];
-    static TI_UINT8 defArpIpAddress[] =  "0a 00 00 0a" ;       /*value by default*/
+    static TI_UINT8 defArpIpAddress[] =  "0a 02 0a b7" ;       /*value by default*/
 
     /*defaults values for beacon IE table*/
     /*TI_UINT8 defBeaconIETableSize = 0 ;*/
@@ -1051,8 +984,9 @@
     static    TI_UINT16  reportSeverityTableLen;
 
     static    TI_UINT32  uWiFiMode = 0;
-    static    TI_INT8    SRConfigParams[14];
-    static    TI_UINT8   len,TempSRCnt;
+    static    TI_UINT32  uPerformanceBoostMode = PERFORMANCE_BOOST_MODE_DEF;
+    TI_INT8    SRConfigParams[MAX_SMART_REFLEX_PARAM];
+    static    TI_UINT32   len,TempSRCnt;
     static    TI_UINT8   uTempRatePolicyList[RATE_MNG_MAX_RETRY_POLICY_PARAMS_LEN];
     static    TI_UINT32  uTempRatePolicyCnt=0;
 
@@ -1113,7 +1047,7 @@
                             (TI_INT8*)(defBeaconIETable), strSize,
                             (TI_UINT8*)staBeaconFilterIETable, &strSize);
 
-            regConvertStringtoBeaconIETable(staBeaconFilterIETable, (TI_UINT8*)&p->siteMgrInitParams.beaconFilterParams.IETable[0]/*(TI_UINT8*)&(tmpIeTable[0] )*/, tmpIeTableSize);
+            parseTwoDigitsSequenceHex (staBeaconFilterIETable, (TI_UINT8*)&p->siteMgrInitParams.beaconFilterParams.IETable[0], tmpIeTableSize);
             os_memoryFree(pAdapter, staBeaconFilterIETable, BEACON_FILTER_STRING_MAX_LEN);
         }
     }
@@ -1152,7 +1086,7 @@
                                 (TI_INT8*)(defStaMacAddress7), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[7]);
+            parseTwoDigitsSequenceHex (staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[7], MAC_ADDR_LEN);
             --macIndex;
             }
 
@@ -1163,7 +1097,7 @@
                                 (TI_INT8*)(defStaMacAddress6), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[6]);
+        parseTwoDigitsSequenceHex (staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[6], MAC_ADDR_LEN);   
             --macIndex;
             }
 
@@ -1174,7 +1108,7 @@
                                 (TI_INT8*)(defStaMacAddress5), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[5]);
+        parseTwoDigitsSequenceHex (staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[5], MAC_ADDR_LEN);   
             --macIndex;
             }
 
@@ -1185,7 +1119,7 @@
                                 (TI_INT8*)(defStaMacAddress4), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[4]);
+        parseTwoDigitsSequenceHex (staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[4], MAC_ADDR_LEN);   
             --macIndex;
             }
 
@@ -1196,7 +1130,7 @@
                                 (TI_INT8*)(defStaMacAddress3), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress, (TI_UINT8*)&p->twdInitParams.tMacAddrFilter.macAddrTable[3]);
+        parseTwoDigitsSequenceHex (staMACAddress, (TI_UINT8*)&p->twdInitParams.tMacAddrFilter.macAddrTable[3], MAC_ADDR_LEN);       
             --macIndex;
             }
 
@@ -1207,7 +1141,7 @@
                                 (TI_INT8*)(defStaMacAddress2), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[2]);
+        parseTwoDigitsSequenceHex (staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[2], MAC_ADDR_LEN);   
             --macIndex;
             }
 
@@ -1218,7 +1152,7 @@
                                 (TI_INT8*)(defStaMacAddress1), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[1]);
+        parseTwoDigitsSequenceHex (staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[1], MAC_ADDR_LEN);   
             --macIndex;
             }
 
@@ -1229,7 +1163,7 @@
                                 (TI_INT8*)(defStaMacAddress0), REG_MAC_ADDR_STR_LEN,
                                 (TI_UINT8*)staMACAddress, &regMACstrLen);
 
-            regConvertStringtoMACAddress(staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[0]);
+        parseTwoDigitsSequenceHex (staMACAddress,(TI_UINT8*) &p->twdInitParams.tMacAddrFilter.macAddrTable[0], MAC_ADDR_LEN);   
             }
 
         default:
@@ -1320,10 +1254,10 @@
             sizeof p->twdInitParams.tGeneral.halCtrlRxEnergyDetection,
             (TI_UINT8*)&p->twdInitParams.tGeneral.halCtrlRxEnergyDetection);
 
-   regReadIntegerParameter(pAdapter, &STRTxEnergyDetection,
+   regReadIntegerParameter(pAdapter, &STRCh14TelecCca,
             TI_FALSE, TI_FALSE, TI_TRUE, 
-            sizeof p->twdInitParams.tGeneral.halCtrlTxEnergyDetection,
-            (TI_UINT8*)&p->twdInitParams.tGeneral.halCtrlTxEnergyDetection);
+            sizeof p->twdInitParams.tGeneral.halCtrlCh14TelecCca,
+            (TI_UINT8*)&p->twdInitParams.tGeneral.halCtrlCh14TelecCca);
 
     regReadIntegerParameter(pAdapter, &STRTddCalibrationInterval,
             300, 1, 0xFFFFFFFF, 
@@ -2487,113 +2421,66 @@
                      NUMBER_OF_RATE_GROUPS_E, NULL, (TI_INT8*)&p->twdInitParams.tIniFileRadioParams.tDynRadioParams.TxPerRatePowerLimits_5G_Extreme, 
                      (TI_UINT32*)&uTempEntriesCount, sizeof (TI_UINT8),TI_TRUE);
 
+/*--------------- Extended Radio Parameters --------------------------*/
+
+regReadIntegerTable (pAdapter, &STRTxPerChannelPowerCompensation_2_4G, RADIO_TX_PER_CH_POWER_COMPENSATION_2_4_DEF,
+                     HALF_NUMBER_OF_2_4_G_CHANNELS, NULL, (TI_INT8*)&p->twdInitParams.tIniFileExtRadioParams.TxPerChannelPowerCompensation_2_4G, 
+                     (TI_UINT32*)&uTempEntriesCount, sizeof (TI_UINT8),TI_TRUE);
+
+regReadIntegerTable (pAdapter, &STRTxPerChannelPowerCompensation_5G_OFDM, RADIO_TX_PER_CH_POWER_COMPENSATION_5_DEF,
+                     HALF_NUMBER_OF_5G_CHANNELS, NULL, (TI_INT8*)&p->twdInitParams.tIniFileExtRadioParams.TxPerChannelPowerCompensation_5G_OFDM, 
+                     (TI_UINT32*)&uTempEntriesCount, sizeof (TI_UINT8),TI_TRUE);
+
+
 regReadIntegerParameter(pAdapter, &STRSettings,
-						1,0,255,
+						65,0,255,
                         sizeof p->twdInitParams.tPlatformGenParams.GeneralSettings,
                         (TI_UINT8*)&p->twdInitParams.tPlatformGenParams.GeneralSettings);
 
 /*---------------------- Smart Reflex Configration -----------------------*/
-      regReadIntegerParameter(pAdapter,
-                            &STRSRState,
-                            SMART_REFLEX_STATE_DEF,
-                            SMART_REFLEX_STATE_MIN,
-                            SMART_REFLEX_STATE_MAX,
-                            sizeof p->twdInitParams.tPlatformGenParams.SRState,
-                            (TI_UINT8*)&p->twdInitParams.tPlatformGenParams.SRState);
-
-
-      NdisZeroMemory(&SRConfigParams[0],MAX_SMART_REFLEX_PARAM );
-
-      regReadIntegerTable (pAdapter, &STRSRConfigParam1, SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE,
-                           MAX_SMART_REFLEX_PARAM, NULL, (TI_INT8*)&SRConfigParams, 
-                          (TI_UINT32*)&TempSRCnt, sizeof (TI_INT8),TI_TRUE);
-
-	  len = SRConfigParams[0];
-      
-		  NdisZeroMemory(&(p->twdInitParams.tPlatformGenParams.SRF1[0]),MAX_SMART_REFLEX_PARAM);
-
-      if ((len < MAX_SMART_REFLEX_PARAM) &&
-          ((TempSRCnt <= len + 1) || (TempSRCnt == MAX_SMART_REFLEX_PARAM)))
-	  {
-		  memcpy(&(p->twdInitParams.tPlatformGenParams.SRF1[0]), &SRConfigParams[0],TempSRCnt);
-	  }
-
-      NdisZeroMemory(&SRConfigParams[0],MAX_SMART_REFLEX_PARAM );
-     
-      regReadIntegerTable (pAdapter, &STRSRConfigParam2, SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE,
-                           MAX_SR_PARAM_LEN, NULL, (TI_INT8*)&SRConfigParams,
-                          (TI_UINT32*)&TempSRCnt, sizeof (TI_INT8),TI_TRUE);
-
-	  len = SRConfigParams[0];
-	 
-      if ((len > MAX_SR_PARAM_LEN)|| (TempSRCnt > len + 1))
-      {
-		  NdisZeroMemory(&(p->twdInitParams.tPlatformGenParams.SRF2[0]),MAX_SMART_REFLEX_PARAM);
-      }
-      else
-	  {
-		 memcpy(&(p->twdInitParams.tPlatformGenParams.SRF2[0]), &SRConfigParams[0],TempSRCnt);
-	  }
-
-	  NdisZeroMemory(&SRConfigParams[0],MAX_SMART_REFLEX_PARAM );
-
-      regReadIntegerTable (pAdapter, &STRSRConfigParam3, SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE,
-                           MAX_SR_PARAM_LEN, NULL, (TI_INT8*)&SRConfigParams, 
-                          (TI_UINT32*)&TempSRCnt, sizeof (TI_INT8),TI_TRUE);
-
-      len = SRConfigParams[0];
-
-      if ((len > MAX_SR_PARAM_LEN)|| (TempSRCnt > len + 1))
-      {
-		  NdisZeroMemory(&(p->twdInitParams.tPlatformGenParams.SRF3[0]),MAX_SMART_REFLEX_PARAM );
-      }
-      else
-	  {
-		  memcpy(&(p->twdInitParams.tPlatformGenParams.SRF3[0]), &SRConfigParams[0],TempSRCnt);
-	  }
-
-
-      regReadIntegerParameter(pAdapter,
-                            &STRSRSenNP,
-                            SMART_REFLEX_DEBUG_DEF,
-                            SMART_REFLEX_DEBUG_MIN,
-                            SMART_REFLEX_DEBUG_MAX,
-                            sizeof p->twdInitParams.tSmartReflexDebugParams.senN_P,
-                            (TI_UINT8*)&p->twdInitParams.tSmartReflexDebugParams.senN_P);
-
-      regReadIntegerParameter(pAdapter,
-                            &STRSRSenNPGain,
-                            SMART_REFLEX_DEBUG_DEF,
-                            SMART_REFLEX_DEBUG_MIN,
-                            SMART_REFLEX_DEBUG_MAX,
-                            sizeof p->twdInitParams.tSmartReflexDebugParams.senN_P_Gain,
-                            (TI_UINT8*)&p->twdInitParams.tSmartReflexDebugParams.senN_P_Gain);
-
-      regReadIntegerParameter(pAdapter,
-                            &STRSRSenPrn,
-                            SMART_REFLEX_DEBUG_DEF,
-                            SMART_REFLEX_DEBUG_MIN,
-                            SMART_REFLEX_DEBUG_MAX,
-                            sizeof p->twdInitParams.tSmartReflexDebugParams.senPRN,
-                            (TI_UINT8*)&p->twdInitParams.tSmartReflexDebugParams.senPRN);
-
-      regReadIntegerParameter(pAdapter,
-                            &STRSRSenNrn,
-                            SMART_REFLEX_DEBUG_DEF,
-                            SMART_REFLEX_DEBUG_MIN,
-                            SMART_REFLEX_DEBUG_MAX,
-                            sizeof (p->twdInitParams.tSmartReflexDebugParams.senNRN),
-                            (TI_UINT8*)&p->twdInitParams.tSmartReflexDebugParams.senNRN);
-
-
-      regReadIntegerTable (pAdapter, &STRSRDebugTable, SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE,
-                           MAX_SR_PARAM_LEN, NULL, (TI_INT8*)&p->twdInitParams.tSmartReflexDebugParams.errorTable,
-                           (TI_UINT32 *)&TempSRCnt, sizeof (TI_UINT8),TI_FALSE);
-
-
-
-
-
+    regReadIntegerParameter(pAdapter, &STRSRState,
+                          SMART_REFLEX_STATE_DEF, SMART_REFLEX_STATE_MIN, SMART_REFLEX_STATE_MAX,
+                          sizeof p->twdInitParams.tPlatformGenParams.SRState,
+                          (TI_UINT8*)&p->twdInitParams.tPlatformGenParams.SRState);
+    
+    NdisZeroMemory(&SRConfigParams[0],MAX_SMART_REFLEX_PARAM );
+    regReadIntegerTable (pAdapter, &STRSRConfigParam1, SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE_SRF1,
+                         MAX_SMART_REFLEX_PARAM, NULL, (TI_INT8*)&SRConfigParams, 
+                        (TI_UINT32*)&TempSRCnt, sizeof (TI_INT8),TI_TRUE);
+    len = SRConfigParams[0];
+    NdisZeroMemory(&(p->twdInitParams.tPlatformGenParams.SRF1[0]),MAX_SMART_REFLEX_PARAM);
+    if ((len < MAX_SMART_REFLEX_PARAM) && ((TempSRCnt <= len + 1) || (TempSRCnt == MAX_SMART_REFLEX_PARAM)))
+    {
+        memcpy(&(p->twdInitParams.tPlatformGenParams.SRF1[0]), &SRConfigParams[0],TempSRCnt);
+    }
+    
+    NdisZeroMemory(&SRConfigParams[0],MAX_SMART_REFLEX_PARAM );
+    regReadIntegerTable (pAdapter, &STRSRConfigParam2, SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE_SRF2,
+                         MAX_SR_PARAM_LEN, NULL, (TI_INT8*)&SRConfigParams, 
+                         (TI_UINT32*)&TempSRCnt, sizeof (TI_INT8),TI_TRUE);
+    len = SRConfigParams[0];
+    if ((len > MAX_SR_PARAM_LEN) || (TempSRCnt > len + 1))
+    {
+        NdisZeroMemory(&(p->twdInitParams.tPlatformGenParams.SRF2[0]),MAX_SMART_REFLEX_PARAM);
+    }
+    else
+    {
+       memcpy(&(p->twdInitParams.tPlatformGenParams.SRF2[0]), &SRConfigParams[0],TempSRCnt);
+    }
+    
+    NdisZeroMemory(&SRConfigParams[0],MAX_SMART_REFLEX_PARAM);
+    regReadIntegerTable (pAdapter, &STRSRConfigParam3, SMART_REFLEX_CONFIG_PARAMS_DEF_TABLE_SRF3,
+                         MAX_SR_PARAM_LEN, NULL, (TI_INT8*)&SRConfigParams, 
+                         (TI_UINT32*)&TempSRCnt, sizeof (TI_INT8), TI_TRUE);
+    len = SRConfigParams[0];
+    if ((len > MAX_SR_PARAM_LEN)|| (TempSRCnt > len + 1))
+    {
+        NdisZeroMemory(&(p->twdInitParams.tPlatformGenParams.SRF3[0]),MAX_SMART_REFLEX_PARAM );
+    }
+    else
+    {
+        memcpy(&(p->twdInitParams.tPlatformGenParams.SRF3[0]), &SRConfigParams[0],TempSRCnt);
+    }
 
 /*---------------------- Power Management Configuration -----------------------*/
     regReadIntegerParameter(pAdapter,
@@ -2840,22 +2727,22 @@
                             sizeof p->txDataInitParams.ClsfrInitParam.uNumActiveEntries,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.uNumActiveEntries);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier00_CodePoint,
-                            DSCP_CLASSIFIER_CODE_POINT_DEF, CLASSIFIER_CODE_POINT_MIN, 
+                            DSCP_CLASSIFIER_CODE_POINT_00, CLASSIFIER_CODE_POINT_MIN, 
                             CLASSIFIER_CODE_POINT_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[0].Dscp.CodePoint,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[0].Dscp.CodePoint);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier01_CodePoint,
-                            DSCP_CLASSIFIER_CODE_POINT_DEF, CLASSIFIER_CODE_POINT_MIN, 
+                            DSCP_CLASSIFIER_CODE_POINT_01, CLASSIFIER_CODE_POINT_MIN, 
                             CLASSIFIER_CODE_POINT_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[1].Dscp.CodePoint,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[1].Dscp.CodePoint);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier02_CodePoint,
-                            DSCP_CLASSIFIER_CODE_POINT_DEF, CLASSIFIER_CODE_POINT_MIN, 
+                            DSCP_CLASSIFIER_CODE_POINT_02, CLASSIFIER_CODE_POINT_MIN, 
                             CLASSIFIER_CODE_POINT_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[2].Dscp.CodePoint,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[2].Dscp.CodePoint);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier03_CodePoint,
-                            DSCP_CLASSIFIER_CODE_POINT_DEF, CLASSIFIER_CODE_POINT_MIN, 
+                            DSCP_CLASSIFIER_CODE_POINT_03, CLASSIFIER_CODE_POINT_MIN, 
                             CLASSIFIER_CODE_POINT_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[3].Dscp.CodePoint,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[3].Dscp.CodePoint);
@@ -2925,22 +2812,22 @@
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[0].DTag,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[0].DTag);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier01_DTag,
-                            DSCP_CLASSIFIER_DTAG_DEF, CLASSIFIER_DTAG_MIN, 
+                            DSCP_CLASSIFIER_DTAG_00, CLASSIFIER_DTAG_MIN, 
                             CLASSIFIER_DTAG_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[1].DTag,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[1].DTag);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier02_DTag,
-                            DSCP_CLASSIFIER_DTAG_DEF, CLASSIFIER_DTAG_MIN, 
+                            DSCP_CLASSIFIER_DTAG_01, CLASSIFIER_DTAG_MIN, 
                             CLASSIFIER_DTAG_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[2].DTag,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[2].DTag);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier03_DTag,
-                            DSCP_CLASSIFIER_DTAG_DEF, CLASSIFIER_DTAG_MIN, 
+                            DSCP_CLASSIFIER_DTAG_02, CLASSIFIER_DTAG_MIN, 
                             CLASSIFIER_DTAG_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[3].DTag,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[3].DTag);
             regReadIntegerParameter(pAdapter, &STRDSCPClassifier04_DTag,
-                            DSCP_CLASSIFIER_DTAG_DEF, CLASSIFIER_DTAG_MIN, 
+                            DSCP_CLASSIFIER_DTAG_03, CLASSIFIER_DTAG_MIN, 
                             CLASSIFIER_DTAG_MAX,                         
                             sizeof p->txDataInitParams.ClsfrInitParam.ClsfrTable[4].DTag,
                             (TI_UINT8*)&p->txDataInitParams.ClsfrInitParam.ClsfrTable[4].DTag);
@@ -3557,7 +3444,17 @@
                             sizeof uWiFiMode,
                             (TI_UINT8*)&uWiFiMode);
 
-	regReadIntegerParameter(pAdapter, &STRStopNetStackTx,
+    regReadIntegerParameter(pAdapter, &STRPerformanceBoost,
+                            PERFORMANCE_BOOST_MODE_DEF, PERFORMANCE_BOOST_MODE_MIN, PERFORMANCE_BOOST_MODE_MAX,                         
+                            sizeof uPerformanceBoostMode,
+                            (TI_UINT8*)&uPerformanceBoostMode);
+
+    regReadIntegerParameter(pAdapter, &STRMaxAMPDU,
+                            MAX_MPDU_DEF, MAX_MPDU_MIN_VALUE, MAX_MPDU_MAX_VALUE,
+                            sizeof p->twdInitParams.tGeneral.uMaxAMPDU,
+                            (TI_UINT8*)&p->twdInitParams.tGeneral.uMaxAMPDU);
+
+    regReadIntegerParameter(pAdapter, &STRStopNetStackTx,
                             STOP_NET_STACK_TX_DEF, STOP_NET_STACK_TX_MIN,
                             STOP_NET_STACK_TX_MAX,
 							sizeof p->txDataInitParams.bStopNetStackTx,
@@ -3588,7 +3485,7 @@
         p->qosMngrInitParams.MsduLifeTime[QOS_AC_VI] = QOS_MSDU_LIFE_TIME_VI_DEF_WIFI_MODE;
         p->qosMngrInitParams.MsduLifeTime[QOS_AC_VO] = QOS_MSDU_LIFE_TIME_VO_DEF_WIFI_MODE;
 
-        p->twdInitParams.tGeneral.uRxMemBlksNum = RX_MEM_BLKS_NUM_DEF_WIFI_MODE;
+        p->twdInitParams.tGeneral.uRxMemBlksNum         = RX_MEM_BLKS_NUM_DEF_WIFI_MODE;
         p->twdInitParams.tGeneral.RxIntrPacingThreshold = TWD_RX_INTR_THRESHOLD_DEF_WIFI_MODE; 
         p->txDataInitParams.bStopNetStackTx             = STOP_NET_STACK_TX_DEF_WIFI_MODE;
         p->txDataInitParams.uTxSendPaceThresh           = TX_SEND_PACE_THRESH_DEF_WIFI_MODE;
@@ -3596,7 +3493,18 @@
         /* remove the flags of DRPw mode when WiFi active */
         p->twdInitParams.tPlatformGenParams.GeneralSettings &= ~DRPw_MASK_CHECK;
     }
-    
+
+    /* If NOT in WiFi mode and IN performance-boost mode, optimize some traffic params for speed (on expense of QoS)  */
+    else if (uPerformanceBoostMode == BOOST_MODE_OPTIMIZE_FOR_SPEED)
+    {
+        p->twdInitParams.tGeneral.TxBlocksThresholdPerAc[QOS_AC_BE] = QOS_TX_BLKS_THRESHOLD_BE_DEF_BOOST_MODE;
+        p->twdInitParams.tGeneral.TxBlocksThresholdPerAc[QOS_AC_BK] = QOS_TX_BLKS_THRESHOLD_BK_DEF_BOOST_MODE;
+        p->twdInitParams.tGeneral.TxBlocksThresholdPerAc[QOS_AC_VI] = QOS_TX_BLKS_THRESHOLD_VI_DEF_BOOST_MODE;
+        p->twdInitParams.tGeneral.TxBlocksThresholdPerAc[QOS_AC_VO] = QOS_TX_BLKS_THRESHOLD_VO_DEF_BOOST_MODE;
+
+        p->twdInitParams.tGeneral.uRxMemBlksNum = RX_MEM_BLKS_NUM_DEF_BOOST_MODE;
+    }
+
     regReadIntegerParameter(pAdapter, &STRQOSShortRetryLimitBE,
                             QOS_SHORT_RETRY_LIMIT_BE_DEF, QOS_SHORT_RETRY_LIMIT_BE_MIN,
                             QOS_SHORT_RETRY_LIMIT_BE_MAX,
@@ -3701,7 +3609,7 @@
                             QOS_PACKET_BURST_ENABLE_MAX,                         
                             sizeof p->qosMngrInitParams.PacketBurstEnable,
                             (TI_UINT8*)&p->qosMngrInitParams.PacketBurstEnable); 
-    PRINTF(DBG_REGISTRY,( "STRQOSPacketBurstEnable = %d\n", p->qosMngrInitParams.PacketBurstEnable));
+
     regReadIntegerParameter(pAdapter, &STRQOSPacketBurstTxOpLimit,
                             QOS_PACKET_BURST_TXOP_LIMIT_DEF, QOS_PACKET_BURST_TXOP_LIMIT_MIN, 
                             QOS_PACKET_BURST_TXOP_LIMIT_MAX,                         
@@ -3709,7 +3617,6 @@
                             (TI_UINT8*)&p->qosMngrInitParams.PacketBurstTxOpLimit); 
 
 
-
     /*---------------------------
         Measurement parameters
     -----------------------------*/
@@ -3891,6 +3798,17 @@
                              sizeof p->tScanCncnInitParams.bPushMode,
                              (TI_UINT8*)&p->tScanCncnInitParams.bPushMode);
 
+    regReadIntegerParameter(pAdapter, &STRScanResultAging,
+                            SCAN_CNCN_APP_SRA_DEF, SCAN_CNCN_APP_SRA_MIN, SCAN_CNCN_APP_SRA_MAX,
+                            sizeof p->tScanCncnInitParams.uSraThreshold,
+                            (TI_UINT8*)&p->tScanCncnInitParams.uSraThreshold);
+
+
+    regReadIntegerParameter(pAdapter, &STRScanCncnRssiThreshold,
+                            SCAN_CNCN_RSSI_DEF, SCAN_CNCN_RSSI_MIN, SCAN_CNCN_RSSI_MAX,
+                            sizeof p->tScanCncnInitParams.nRssiThreshold,
+                            (TI_UINT8*)&p->tScanCncnInitParams.nRssiThreshold);
+
 /*----------------------------------
  WSC 
 ------------------------------------*/
@@ -4077,9 +3995,9 @@
                             (TI_INT8*)(defRxRssiAndProcessCompensation_2_4G), RssiSize,
                             (TI_UINT8*)staRssiAndProcessCompensation, &RssiSize);
 
-        regConvertStringtoBeaconIETable(staRssiAndProcessCompensation , 
-                                        (TI_UINT8*)&p->twdInitParams.tIniFileRadioParams.tStatRadioParams.RxRssiAndProcessCompensation_2_4G, 
-                                        RSSI_AND_PROCESS_COMPENSATION_TABLE_SIZE);
+        parseTwoDigitsSequenceHex (staRssiAndProcessCompensation , 
+                                      (TI_UINT8*)&p->twdInitParams.tIniFileRadioParams.tStatRadioParams.RxRssiAndProcessCompensation_2_4G, 
+                                      RSSI_AND_PROCESS_COMPENSATION_TABLE_SIZE);
  
 
 
@@ -4210,6 +4128,13 @@
                         (TI_UINT8*)&p->tRoamScanMngrInitParams.RoamingOperationalMode);
 
 
+regReadIntegerParameter(pAdapter, & STRSendTspecInReassPkt,
+                        ROAMING_MNGR_SEND_TSPEC_IN_REASSO_PKT_DEF,
+                        ROAMING_MNGR_SEND_TSPEC_IN_REASSO_PKT_MIN,
+                        ROAMING_MNGR_SEND_TSPEC_IN_REASSO_PKT_MAX,
+                        sizeof p->tRoamScanMngrInitParams.bSendTspecInReassPkt,
+                        (TI_UINT8*)&p->tRoamScanMngrInitParams.bSendTspecInReassPkt);
+
 /*-----------------------------------*/
 /*      currBss parameters           */
 /*-----------------------------------*/
@@ -4278,7 +4203,7 @@
 
 
 /*----------------------------------------------*/
-/*          Rate Management parameters          */
+/* 			Rate Management parameters	        */
 /*----------------------------------------------*/
 
 regReadIntegerParameter(pAdapter, &STRRateMngRateRetryScore,
@@ -4509,7 +4434,7 @@
 
     if (paramFound) 
     {
-        value = tiwlnstrtoi_hex (pParameter, parameterSize);
+        value = tiwlnstrtoi_hex ((TI_UINT8 *)pParameter, parameterSize);
 
         if (value < minValue || value > maxValue)
         {
@@ -5171,6 +5096,12 @@
                 case 'd':
                 case 'e':
                 case 'f':
+                case 'A':
+                case 'B':
+                case 'C':
+                case 'D':
+                case 'E':
+                case 'F':
                     if (bHex)
                     {
                         pTempBuffer[tempBufferIndex] = pBuffer[index];
@@ -5241,7 +5172,7 @@
             }
             else
             {
-                myNumber = tiwlnstrtoi_hex(pTempBuffer,tempBufferIndex-1);
+                myNumber = tiwlnstrtoi_hex((TI_UINT8 *)pTempBuffer,tempBufferIndex-1);
             }
             myNumber = -(myNumber);
         }
@@ -5253,7 +5184,7 @@
         }
             else
             {
-                myNumber = tiwlnstrtoi_hex(pTempBuffer,tempBufferIndex);
+                myNumber = tiwlnstrtoi_hex((TI_UINT8 *)pTempBuffer,tempBufferIndex);
             }
         }
 
@@ -5299,7 +5230,7 @@
         }
 
         ++parameterIndex;
- 
+
     }while ((index<bufferSize)&&(endOfLine==TI_FALSE));
 
     *pEntriesNumber = parameterIndex; /* return number of entries read */
@@ -5329,75 +5260,34 @@
     }
   }
 
+
 /*-----------------------------------------------------------------------------
-
-Routine Name:
-
-    regConvertStringtoBeaconIETable
+Routine Name:   parseTwoDigitsSequenceHex
     
-Routine Description: Converts the Ip Adrress in a form of string readen from the Registry 
-to the Ip Address Array to be stored in the init_table struct 
+Routine Description: Parse a sequence of two digit hex numbers from the input string to the output array.
 
+Arguments:  sInString - The input string - a sequence of two digit hex numbers with seperators between them (comma or space)
+            uOutArray - The output array containing the translated values (each index contains one two digit value)
+            uSize     - The number of two digit items.
 
-Arguments:
-
-
-Return Value:
-
-    None
-
+Return Value:  None
 -----------------------------------------------------------------------------*/
-static void regConvertStringtoBeaconIETable(TI_UINT8 *staIpAddressString, TI_UINT8 *IpAddressArray, TI_UINT8 size)
+static void parseTwoDigitsSequenceHex (TI_UINT8 *sInString, TI_UINT8 *uOutArray, TI_UINT8 uSize)
 {
-    char *ptr;
-    TI_UINT8 *tmpIpAddr;
-    TI_UINT8 value = 0, value_l, value_h, add_value;
-    int i, str_len;
+    int i;
 
-    /* Take the pointer to the string MAC Address to convert it to the Array MAC Address */
-    ptr = (char *)staIpAddressString;
-    tmpIpAddr = IpAddressArray;
-    str_len = 3 * size - 1;
-
-    for(i=0;(i < size);ptr++,str_len--)
+    /* Convert the MAC Address string into the MAC Address array */
+    for (i = 0; i < uSize; i++)
     {
-        if (str_len > 0) {
-            /* The value can be or "0-9" or from "a-f" */
-            value_l = (*ptr - '0');
-            value_h = (*ptr - 'a');
-        }
-        else { /* last element */
-            value_l = value_h = 16;
-        }
-        /*PRINTF(DBG_REGISTRY,("value_l [%d] value_h [%d] *ptr %c value %d\n",value_l,value_h,*ptr,value));*/
+        /* translate two digit string to value */
+        uOutArray[i] = tiwlnstrtoi_hex (sInString, 2);
 
-        if( (value_l <= 9) || (value_h <= 15 ) )
-        {
-            /* We are in an expected range */
-            /* Check if 0-9 */
-            if(value_l <= 9 )
-            {
-                add_value = value_l;
-            }
-            /* Check if a-f */
-            else
-            {
-                /* 'a' is in fact 10 decimal in hexa */
-                add_value = value_h + 10;
-            }
-            value = value * 16 + add_value;
-            /*PRINTF(DBG_REGISTRY,("value %d add_value %d  \n",value,add_value));*/
-        }
-        else
-        {
-            tmpIpAddr[i] = value;
-            /*PRINTF(DBG_REGISTRY,("tmpMacAddr[%d]  is %x\n",i,tmpMacAddr[i]));*/
-            value = 0;
-            i++;
-        }
+        /* progress to next two digits (plus space) */
+        sInString += 3;
     }
 }
 
+
 /*-----------------------------------------------------------------------------
 
 Routine Name:
diff --git a/wl1271/platforms/os/linux/build/common.inc b/wl1271/platforms/os/linux/build/common.inc
index 407c2ca..40126a5 100644
--- a/wl1271/platforms/os/linux/build/common.inc
+++ b/wl1271/platforms/os/linux/build/common.inc
@@ -75,6 +75,9 @@
 ## Driver Compilation Directives
 ##
 ##
+ifeq "$(HOST_PLATFORM)" "omap2430"	
+	DK_DEFINES += -D HOST_PLATFORM_OMAP2430
+endif
 ifeq "$(HOST_PLATFORM)" "omap3430"
 	DK_DEFINES += -D HOST_PLATFORM_OMAP3430
 endif
diff --git a/wl1271/platforms/os/linux/inc/windows_types.h b/wl1271/platforms/os/linux/inc/windows_types.h
index 1cc83bf..e94602f 100644
--- a/wl1271/platforms/os/linux/inc/windows_types.h
+++ b/wl1271/platforms/os/linux/inc/windows_types.h
@@ -1,7 +1,7 @@
 /*
  * windows_types.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -160,7 +160,7 @@
             NDIS_802_11_AUTHENTICATION_REQUEST Request[1];
 		} AuthenticationEvent;
 		NDIS_802_11_RSSI RssiTrigger;
-	};
+	} UNION_NDIS_TEST;
 } NDIS_802_11_TEST, *PNDIS_802_11_TEST;
 
 /* Added new encryption types*/
diff --git a/wl1271/platforms/os/linux/src/CmdInterpretWext.c b/wl1271/platforms/os/linux/src/CmdInterpretWext.c
index 01e4451..08f6bb2 100644
--- a/wl1271/platforms/os/linux/src/CmdInterpretWext.c
+++ b/wl1271/platforms/os/linux/src/CmdInterpretWext.c
@@ -1,7 +1,7 @@
 /*
  * CmdInterpretWext.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -55,13 +55,21 @@
 #include "CmdDispatcher.h"
 #include "EvHandler.h"
 #include "admCtrl.h"
+#include "freq.h"
 
 static TI_INT32 cmdInterpret_Event(IPC_EV_DATA* pData);
 static int cmdInterpret_setSecurityParams (TI_HANDLE hCmdInterpret);
 static int cmdInterpret_initEvents(TI_HANDLE hCmdInterpret);
 static int cmdInterpret_unregisterEvents(TI_HANDLE hCmdInterpret, TI_HANDLE hEvHandler);
 
+#define WEXT_FREQ_CHANNEL_NUM_MAX_VAL	1000
+#define WEXT_FREQ_KHZ_CONVERT			3
+#define WEXT_FREQ_MUL_VALUE				500000
+#define WEXT_MAX_RATE_VALUE				63500000
+#define WEXT_MAX_RATE_REAL_VALUE		65000000
+
 #define CHECK_PENDING_RESULT(x,y)     if (x == COMMAND_PENDING) { os_printf ("Unexpected COMMAND PENDING result (cmd = 0x%x)\n",y->paramType);  break; }
+#define CALCULATE_RATE_VALUE(x)                   ((x & 0x7f) * WEXT_FREQ_MUL_VALUE);
 
 static const char *ieee80211_modes[] = {
     "?", "IEEE 802.11 B", "IEEE 802.11 A", "IEEE 802.11 BG", "IEEE 802.11 ABG"
@@ -161,12 +169,39 @@
         /* Set channel / frequency */
     case SIOCSIWFREQ:
         {
+			int freq = wrqu->freq.m;
+
+            /* If the input is frequency convert it to channel number -
+				See explanation in [struct iw_freq] definition in wireless_copy.h*/
+            if (freq >= WEXT_FREQ_CHANNEL_NUM_MAX_VAL)
+            {
+				int div = WEXT_FREQ_KHZ_CONVERT - wrqu->freq.e;
+                /* Convert received frequency to a value in KHz*/
+				if (div >= 0)
+                {
+                    while (div-- > 0)
+                    {
+                        freq /= 10;             /* down convert to KHz */
+                    }
+                }
+                else
+                {
+                    while (div++ < 0)          /* up convert to KHz */
+                    {
+                        freq *= 10;
+                    }
+                }
+				
+                /* Convert KHz frequency to channel number*/
+                freq = Freq2Chan(freq); /* convert to chan num */
+            }
+                
             /* If there is a given channel */
-            if (wrqu->freq.m != 0)
+            if (freq != 0)
             {
                 pParam->paramType = SITE_MGR_DESIRED_CHANNEL_PARAM;
                 pParam->paramLength = sizeof(TI_UINT32);
-                pParam->content.siteMgrDesiredChannel = wrqu->freq.m;
+                pParam->content.siteMgrDesiredChannel = freq;
 
                 res = cmdDispatch_SetParam (pCmdInterpret->hCmdDispatch, pParam);
                 CHECK_PENDING_RESULT(res,pParam)
@@ -300,10 +335,8 @@
             struct iw_point *data = (struct iw_point *) cmdObj->buffer1;
             struct iw_range *range = (struct iw_range *) cmdObj->buffer2;
             int i;
-/* MODS_BEGIN_FOR_11N_RATE_REPORTING */
             ScanBssType_e smeDesiredBssType = BSS_ANY;
             paramInfo_t *pParam2;
-/* MODS_END_FOR_11N_RATE_REPORTING */
 
             /* Reset structure */
             data->length = sizeof(struct iw_range);
@@ -337,7 +370,6 @@
             res = cmdDispatch_GetParam (pCmdInterpret->hCmdDispatch, pParam );
 
             CHECK_PENDING_RESULT(res,pParam)
-/* MODS_BEGIN_FOR_11N_RATE_REPORTING */
             pParam2 = (paramInfo_t *)os_memoryAlloc(pCmdInterpret->hOs, sizeof(paramInfo_t));
             if (pParam2)
             {
@@ -348,13 +380,10 @@
                 smeDesiredBssType = pParam2->content.smeDesiredBSSType;
                 os_memoryFree(pCmdInterpret->hOs, pParam2, sizeof(paramInfo_t));
             }
-/* MODS_END_FOR_11N_RATE_REPORTING */
-
             /* Number of entries in the rates list */
             range->num_bitrates = pParam->content.siteMgrDesiredSupportedRateSet.len;
             for (i=0; i<pParam->content.siteMgrDesiredSupportedRateSet.len; i++)
             {
-/* MODS_BEGIN_FOR_11N_RATE_REPORTING */
                 switch(pParam->content.siteMgrDesiredSupportedRateSet.ratesString[i] & 0x7F)
                 {
                     case NET_RATE_MCS0:
@@ -368,14 +397,13 @@
                          if (BSS_INDEPENDENT == smeDesiredBssType)
                              continue;
                     default:
-                        range->bitrate[i] = ((pParam->content.siteMgrDesiredSupportedRateSet.ratesString[i] & 0x7F) * 500000);
-                        if (63500000 == range->bitrate[i])
-                        {
-                            range->bitrate[i] = 65000000;   /* convert special code 0x7F to 65Mbps */
-                        }
-                        break;
+                         range->bitrate[i] = CALCULATE_RATE_VALUE(pParam->content.siteMgrDesiredSupportedRateSet.ratesString[i])
+                         if (WEXT_MAX_RATE_VALUE == range->bitrate[i])
+                         {
+                             range->bitrate[i] = WEXT_MAX_RATE_REAL_VALUE;   /* convert special code 0x7F to 65Mbps */
+                         }
+                         break;
                 }
-/* MODS_END_FOR_11N_RATE_REPORTING */
             }
 
             /* RTS threshold */
@@ -551,23 +579,27 @@
         /* trigger scanning (list cells) */
     case SIOCSIWSCAN:
         {
-            struct iw_scan_req scanReq;
+            struct iw_scan_req pScanReq;
             TScanParams scanParams;
 
             pParam->content.pScanParams = &scanParams;
 
             /* Init the parameters in case the Supplicant doesn't support them*/
             pParam->content.pScanParams->desiredSsid.len = 0;
-            scanReq.scan_type = SCAN_TYPE_TRIGGERED_ACTIVE;
+            pScanReq.scan_type = SCAN_TYPE_TRIGGERED_ACTIVE;
 
-            if (cmdObj->param3)
+            if (wrqu->data.pointer)
             {
-                os_memoryCopy(pCmdInterpret->hOs, &scanReq, cmdObj->param3, sizeof(scanReq));
-
+                if ( copy_from_user( &pScanReq, wrqu->data.pointer, sizeof(pScanReq)) )
+                {
+                    printk("CRITICAL: Could not copy data from user space!!!");
+                    res = -EFAULT;
+                    goto cmd_end;
+                }
                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID)
                 {
-                    pParam->content.pScanParams->desiredSsid.len = scanReq.essid_len;
-                    os_memoryCopy(pCmdInterpret->hOs,pParam->content.pScanParams->desiredSsid.str, scanReq.essid, scanReq.essid_len);
+                    pParam->content.pScanParams->desiredSsid.len = pScanReq.essid_len;
+                    os_memoryCopy(pCmdInterpret->hOs,pParam->content.pScanParams->desiredSsid.str, pScanReq.essid, pScanReq.essid_len);
                 }
                 else
                 {
@@ -576,7 +608,7 @@
             }
 
             /* set the scan type according to driver trigger scan */
-            if (IW_SCAN_TYPE_PASSIVE == scanReq.scan_type)
+            if (IW_SCAN_TYPE_PASSIVE == pScanReq.scan_type)
             {
                 pParam->content.pScanParams->scanType = SCAN_TYPE_TRIGGERED_PASSIVE;
             }
@@ -599,9 +631,11 @@
             char *event = (char *)cmdObj->buffer2;
             struct iw_event iwe;
             char *end_buf, *current_val;
-            int allocated_size;
+            int allocated_size, rates_allocated_size;
             OS_802_11_BSSID_LIST_EX *my_list;
             OS_802_11_BSSID_EX *my_current;
+			OS_802_11_N_RATES *rate_list;
+			TI_UINT8 *current_rates;
             int offset;
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
@@ -633,8 +667,32 @@
             res = cmdDispatch_GetParam (pCmdInterpret->hCmdDispatch, pParam );
             CHECK_PENDING_RESULT(res,pParam)
 
+            /* Get the number of entries in the scan result list and allocate enough memory to hold rate list
+               for every entry. This rate list is extended to include 11n rates */
+            pParam->paramType = SCAN_CNCN_NUM_BSSID_IN_LIST_PARAM;
+            pParam->paramLength = 0;
+            res = cmdDispatch_GetParam (pCmdInterpret->hCmdDispatch, pParam );
+            CHECK_PENDING_RESULT(res,pParam)
+
+            rates_allocated_size = pParam->content.uNumBssidInList * sizeof(OS_802_11_N_RATES);
+
+            /* Allocate required memory */
+            rate_list = os_memoryAlloc (pCmdInterpret->hOs, rates_allocated_size);
+            if (!rate_list) {
+                os_memoryFree (pCmdInterpret->hOs, my_list, allocated_size);
+                res = -ENOMEM;
+                goto cmd_end;
+            }
+
+            /* And retrieve the list */
+            pParam->paramType = SCAN_CNCN_BSSID_RATE_LIST_PARAM;
+            pParam->content.pRateList = rate_list;
+            pParam->paramLength = rates_allocated_size;
+            res = cmdDispatch_GetParam (pCmdInterpret->hCmdDispatch, pParam );
+            CHECK_PENDING_RESULT(res,pParam)
+
             my_current = &my_list->Bssid[0];
-            i=0;
+            i = 0;
             if(wrqu->data.flags)
             {
                 for (i=0; i<wrqu->data.flags; i++)
@@ -644,7 +702,6 @@
 
             for (; i<my_list->NumberOfItems; i++)
             {
-
                 if (event + my_current->Length > end_buf)
                 {
                     break;
@@ -746,21 +803,21 @@
                 os_memorySet (pCmdInterpret->hOs, &iwe, 0, sizeof(iwe));
                 iwe.cmd = SIOCGIWRATE;
                 current_val = event + IW_EV_LCP_LEN;
-/* MODS_BEGIN_FOR_11N_RATE_REPORTING */
+
+                current_rates = (TI_UINT8 *)(rate_list[i]);
+
                 for (j=0; j<32; j++)
-		{
-                    if (my_current->SupportedRates[j])
+                {
+                    if (current_rates[j])
                     {
-                        if ((my_current->SupportedRates[j] & 0x7f) == NET_RATE_MCS7)
+                        if ((current_rates[j] & 0x7f) == NET_RATE_MCS7)
                         {
-                            iwe.u.bitrate.value = 65000000;  /* convert the special code 0x7f to 65Mbps */
+                            iwe.u.bitrate.value = WEXT_MAX_RATE_REAL_VALUE;  /* convert the special code 0x7f to 65Mbps */
                         }
                         else
                         {
-                            iwe.u.bitrate.value = ((my_current->SupportedRates[j] & 0x7f) * 500000);
+                            iwe.u.bitrate.value = CALCULATE_RATE_VALUE(current_rates[j])
                         }
-                        /* printk("Supported Rates [%d] = %d\n", j, iwe.u.bitrate.value); */
-/* MODS_END_FOR_11N_RATE_REPORTING */
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27)
                         current_val = iwe_stream_add_value(event, current_val, end_buf, &iwe,IW_EV_PARAM_LEN);
 #else
@@ -788,8 +845,8 @@
                 offset = sizeof(OS_802_11_FIXED_IEs);
                 while(offset < my_current->IELength)
                 {
-						OS_802_11_VARIABLE_IEs *pIE;
-						pIE = (OS_802_11_VARIABLE_IEs*)&(my_current->IEs[offset]);
+                        OS_802_11_VARIABLE_IEs *pIE;
+                        pIE = (OS_802_11_VARIABLE_IEs*)&(my_current->IEs[offset]);
                         iwe.u.data.flags = 1;
                         iwe.u.data.length = pIE->Length + 2;
 
@@ -815,6 +872,7 @@
             }
 
             os_memoryFree (pCmdInterpret->hOs, my_list, allocated_size);
+            os_memoryFree (pCmdInterpret->hOs, rate_list, rates_allocated_size);
             cmdObj->return_code = WEXT_OK;
         }
 
diff --git a/wl1271/platforms/os/linux/src/osRgstry_parser.c b/wl1271/platforms/os/linux/src/osRgstry_parser.c
index 8aa108b..c568da2 100644
--- a/wl1271/platforms/os/linux/src/osRgstry_parser.c
+++ b/wl1271/platforms/os/linux/src/osRgstry_parser.c
@@ -1,7 +1,7 @@
 /*
  * osRgstry_parser.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -137,7 +137,8 @@
     while(buf < end_buf)
     {
         buf = ltrim(buf);
-        if( !(s = mem_str(buf, name, end_buf)) )
+        s = mem_str(buf, name, end_buf);
+        if( !s )
             break;
 
         buf = ltrim(s + strlen(name));
diff --git a/wl1271/platforms/os/linux/src/osapi.c b/wl1271/platforms/os/linux/src/osapi.c
index e1af9c7..a40da48 100644
--- a/wl1271/platforms/os/linux/src/osapi.c
+++ b/wl1271/platforms/os/linux/src/osapi.c
@@ -1,7 +1,7 @@
 /*
  * osapi.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -159,7 +159,8 @@
 		printk(&msg[0]);
         }
         
-        from_new_line = ( msg[message_len] == '\n' );
+	from_new_line = ( msg[message_len - 1] == '\n' );
+
 	va_end(ap);
 }
 
diff --git a/wl1271/platforms/os/linux/wl_env.bash b/wl1271/platforms/os/linux/wl_env.bash
index 234e0b3..9bce082 100644
--- a/wl1271/platforms/os/linux/wl_env.bash
+++ b/wl1271/platforms/os/linux/wl_env.bash
@@ -2,5 +2,5 @@
 export CROSS_COMPILE=arm-eabi-
 export ARCH=arm
 export HOST_PLATFORM=sholes
-export KERNEL_DIR=/usr/local/google/android/master/kernel
+export KERNEL_DIR=/usr/local/google/android/froyo/kernel
 
diff --git a/wl1271/stad/Export_Inc/STADExternalIf.h b/wl1271/stad/Export_Inc/STADExternalIf.h
index ddb79d6..4058767 100644
--- a/wl1271/stad/Export_Inc/STADExternalIf.h
+++ b/wl1271/stad/Export_Inc/STADExternalIf.h
@@ -1,7 +1,7 @@
 /*
  * STADExternalIf.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -342,6 +342,7 @@
 typedef struct 
 {
     TIWLN_SIMPLE_CONFIG_MODE  WSCMode;						/**< WiFi Simple Configuration mode 			   			*/
+    TI_UINT32 uWscIeSize; 						            /**< Simple Config IE actual size (the part after the OUI) */
     TI_UINT8 probeReqWSCIE[DOT11_WSC_PROBE_REQ_MAX_LENGTH];	/**< Buffer which holds the parameters of ProbeReq - WSC IE	*/
 }  TWscMode;
 
diff --git a/wl1271/stad/Export_Inc/coreDefaultParams.h b/wl1271/stad/Export_Inc/coreDefaultParams.h
index 8fa6a85..1482f95 100644
--- a/wl1271/stad/Export_Inc/coreDefaultParams.h
+++ b/wl1271/stad/Export_Inc/coreDefaultParams.h
@@ -1,7 +1,7 @@
 /*
  * coreDefaultParams.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -148,7 +148,7 @@
 
 /* 1 - Dtag, 2 - Port, 3 - IP & port */ 
 #define CLSFR_TYPE_MIN                          1 
-#define CLSFR_TYPE_DEF                      3
+#define CLSFR_TYPE_DEF                      1
 #define CLSFR_TYPE_MAX                      3
 
 /* general values of D-tags */
@@ -183,13 +183,21 @@
 
 #define NUM_OF_CODE_POINTS_MIN              0
 #define NUM_OF_CODE_POINTS_MAX              16
-#define NUM_OF_CODE_POINTS_DEF              0
+#define NUM_OF_CODE_POINTS_DEF              4
 
 /* def values of code points in the DSCP classification table*/
 #define DSCP_CLASSIFIER_CODE_POINT_DEF  0x0
+#define DSCP_CLASSIFIER_CODE_POINT_00  0
+#define DSCP_CLASSIFIER_CODE_POINT_01  8
+#define DSCP_CLASSIFIER_CODE_POINT_02  40
+#define DSCP_CLASSIFIER_CODE_POINT_03  56
 
 /* def values of D-tags in the DSCP classification table*/
 #define DSCP_CLASSIFIER_DTAG_DEF            0
+#define DSCP_CLASSIFIER_DTAG_00            0
+#define DSCP_CLASSIFIER_DTAG_01            1
+#define DSCP_CLASSIFIER_DTAG_02            5
+#define DSCP_CLASSIFIER_DTAG_03            6
 
 /* Port Classifier parameters 
 --------------------------------*/
@@ -312,27 +320,46 @@
 #define  QOS_WME_PS_MODE_VO_DEF                 PS_SCHEME_UPSD_TRIGGER
 
 
-/* Minimum reserved Tx mem block in FW per AC */
+/* Minimum reserved Tx mem block in FW per AC: */
+/***********************************************/
+/* By default, partially optimize for Tx QoS on expense of Rx throughput */
 #define  QOS_TX_BLKS_THRESHOLD_BK_DEF           0
-#define  QOS_TX_BLKS_THRESHOLD_BE_DEF           10
-#define  QOS_TX_BLKS_THRESHOLD_VI_DEF           10
-#define  QOS_TX_BLKS_THRESHOLD_VO_DEF           10
-#define  QOS_TX_BLKS_THRESHOLD_BK_DEF_WIFI_MODE           0
+#define  QOS_TX_BLKS_THRESHOLD_BE_DEF           20
+#define  QOS_TX_BLKS_THRESHOLD_VI_DEF           20
+#define  QOS_TX_BLKS_THRESHOLD_VO_DEF           20
+/* In WiFi mode, fully optimized for Tx QoS on expense of Rx throughput */
+#define  QOS_TX_BLKS_THRESHOLD_BK_DEF_WIFI_MODE 0
 #define  QOS_TX_BLKS_THRESHOLD_BE_DEF_WIFI_MODE 30
-#define  QOS_TX_BLKS_THRESHOLD_VI_DEF_WIFI_MODE           30
-#define  QOS_TX_BLKS_THRESHOLD_VO_DEF_WIFI_MODE           30
+#define  QOS_TX_BLKS_THRESHOLD_VI_DEF_WIFI_MODE 30
+#define  QOS_TX_BLKS_THRESHOLD_VO_DEF_WIFI_MODE 30
+/* In performance-boost, optimize for Rx throughput on expense of Tx QoS */
+#define  QOS_TX_BLKS_THRESHOLD_BK_DEF_BOOST_MODE 0
+#define  QOS_TX_BLKS_THRESHOLD_BE_DEF_BOOST_MODE 10
+#define  QOS_TX_BLKS_THRESHOLD_VI_DEF_BOOST_MODE 10
+#define  QOS_TX_BLKS_THRESHOLD_VO_DEF_BOOST_MODE 10
 
 /* HW Rx mem-blocks Number */
-#define  RX_MEM_BLKS_NUM_DEF                    70
 #define  RX_MEM_BLKS_NUM_MIN                    20
 #define  RX_MEM_BLKS_NUM_MAX                    120
-#define  RX_MEM_BLKS_NUM_DEF_WIFI_MODE          40
+#define  RX_MEM_BLKS_NUM_DEF                    50   /* By default, partially optimize for Tx QoS on expense of Rx throughput */
+#define  RX_MEM_BLKS_NUM_DEF_WIFI_MODE          40   /* In WiFi mode, fully optimize for Tx QoS on expense of Rx throughput */
+#define  RX_MEM_BLKS_NUM_DEF_BOOST_MODE         70   /* In performance-boost, optimize for Rx throughput on expense of Tx QoS */
 
 /* WiFi mode on/off */
 #define  WIFI_MODE_DEF                          0
 #define  WIFI_MODE_MIN                          0
 #define  WIFI_MODE_MAX                          1
 
+/* Performance-boost mode (QoS/Speed tradeoff) */
+#define  BOOST_MODE_OPTIMIZE_FOR_QOS            0   /* Optimize for Tx QoS on expense of Rx throughput */
+#define  BOOST_MODE_OPTIMIZE_FOR_SPEED          1   /* Optimize for Rx throughput on expense of Tx QoS */
+#define  PERFORMANCE_BOOST_MODE_DEF             BOOST_MODE_OPTIMIZE_FOR_QOS
+#define  PERFORMANCE_BOOST_MODE_MIN             BOOST_MODE_OPTIMIZE_FOR_QOS
+#define  PERFORMANCE_BOOST_MODE_MAX             BOOST_MODE_OPTIMIZE_FOR_SPEED
+
+/* Maximum AMPDU Size */
+#define MAX_MPDU_DEF                            MAX_MPDU_8191_OCTETS
+
 /* STOP NETWORK STACK TX mode defines */
 #define  STOP_NET_STACK_TX_DEF                  0
 #define  STOP_NET_STACK_TX_MIN                  0
@@ -465,7 +492,7 @@
 
 #define QOS_CW_CWMIN_MIN                        QOS_CWMIN_MIN
 #define QOS_CW_CWMIN_MAX                        QOS_CWMIN_MAX
-#define QOS_CW_CWMIN_DEF                        CW_MIN_MAX
+#define QOS_CW_CWMIN_DEF                        CW_MIN_DEF
 
 #define QOS_CW_CWMAX_MIN                        QOS_CWMAX_MIN
 #define QOS_CW_CWMAX_MAX                        QOS_CWMAX_MAX
@@ -531,6 +558,11 @@
 #define ROAMING_MNGR_OPERATIONAL_MODE_MAX       1
 #define ROAMING_MNGR_OPERATIONAL_MODE_DEF       1
 
+#define ROAMING_MNGR_SEND_TSPEC_IN_REASSO_PKT_MIN       0 /* 0 - do not send , 1 - send */
+#define ROAMING_MNGR_SEND_TSPEC_IN_REASSO_PKT_MAX       1
+#define ROAMING_MNGR_SEND_TSPEC_IN_REASSO_PKT_DEF       1
+
+
 /*---------------------------
     Measurement parameters
 -----------------------------*/
@@ -880,6 +912,14 @@
 #define SCAN_CNCN_APP_PUSH_MODE_MIN             TI_FALSE
 #define SCAN_CNCN_APP_PUSH_MODE_MAX             TI_TRUE
 
+#define SCAN_CNCN_APP_SRA_DEF                   20
+#define SCAN_CNCN_APP_SRA_MIN                   0
+#define SCAN_CNCN_APP_SRA_MAX                   1000
+
+#define SCAN_CNCN_RSSI_DEF                      (-100)
+#define SCAN_CNCN_RSSI_MIN                      (-100)
+#define SCAN_CNCN_RSSI_MAX                      0
+
 /* Current BSS init paramaters - keep alive default interval */
 #define NULL_KL_PERIOD_DEF      10
 #define NULL_KL_PERIOD_MIN      0
@@ -895,7 +935,7 @@
 #define WSC_PARSE_IN_BEACON_MIN 0
 #define WSC_PARSE_IN_BEACON_MAX 1
 
-#define WSC_INCLUDE_IN_BEACON_DEF 0
+#define WSC_INCLUDE_IN_BEACON_DEF 1
 #define WSC_INCLUDE_IN_BEACON_MIN 0
 #define WSC_INCLUDE_IN_BEACON_MAX 1
 
@@ -928,8 +968,8 @@
 #define SOFT_GEMINI_PARAMS_NFS_SAMPLE_INTERVAL_DEF	400
 
 #define SOFT_GEMINI_PARAMS_LOAD_RATIO_MIN				0
-#define SOFT_GEMINI_PARAMS_LOAD_RATIO_MAX				100
-#define SOFT_GEMINI_PARAMS_LOAD_RATIO_DEF				50
+#define SOFT_GEMINI_PARAMS_LOAD_RATIO_MAX				65000
+#define SOFT_GEMINI_PARAMS_LOAD_RATIO_DEF				200
 
 #define SOFT_GEMINI_PARAMS_AUTO_PS_MODE_MIN				0
 #define SOFT_GEMINI_PARAMS_AUTO_PS_MODE_MAX				1
@@ -1118,11 +1158,11 @@
 
 #define SOFT_GEMINI_TEMP_PARAM_4_MIN    0
 #define SOFT_GEMINI_TEMP_PARAM_4_MAX 	100000
-#define SOFT_GEMINI_TEMP_PARAM_4_DEF 	0
+#define SOFT_GEMINI_TEMP_PARAM_4_DEF 	23
 
 #define SOFT_GEMINI_TEMP_PARAM_5_MIN    0
 #define SOFT_GEMINI_TEMP_PARAM_5_MAX 	100000
-#define SOFT_GEMINI_TEMP_PARAM_5_DEF 	0
+#define SOFT_GEMINI_TEMP_PARAM_5_DEF 	22
 
 
 #define WIFI_WMM_PS_MIN                         0  
@@ -1186,7 +1226,7 @@
 #define FM_COEX_ENABLE_MIN                             TI_FALSE  
 #define FM_COEX_ENABLE_MAX                             TI_TRUE 
 
-#define FM_COEX_SWALLOW_PERIOD_DEF                     0xFF
+#define FM_COEX_SWALLOW_PERIOD_DEF                     5
 #define FM_COEX_SWALLOW_PERIOD_MIN                     0
 #define FM_COEX_SWALLOW_PERIOD_MAX                     0xFF
 
@@ -1194,11 +1234,11 @@
 #define FM_COEX_N_DIVIDER_FREF_SET1_MIN                0
 #define FM_COEX_N_DIVIDER_FREF_SET1_MAX                0xFF
 
-#define FM_COEX_N_DIVIDER_FREF_SET2_DEF                0xFF                  
+#define FM_COEX_N_DIVIDER_FREF_SET2_DEF                12                  
 #define FM_COEX_N_DIVIDER_FREF_SET2_MIN                0   
 #define FM_COEX_N_DIVIDER_FREF_SET2_MAX                0xFF
 
-#define FM_COEX_M_DIVIDER_FREF_SET1_DEF                0xFFFF   
+#define FM_COEX_M_DIVIDER_FREF_SET1_DEF                148   
 #define FM_COEX_M_DIVIDER_FREF_SET1_MIN                0   
 #define FM_COEX_M_DIVIDER_FREF_SET1_MAX                0xFFFF
 
@@ -1317,16 +1357,16 @@
 
 
 /* Configurable radio parameters */
-#define RADIO_TX_PER_POWER_LIMITS_2_4_NORMAL_DEF_TABLE      "1c,1f,22,24,28,29"
-#define RADIO_TX_PER_POWER_LIMITS_2_4_DEGRADED_DEF_TABLE    "19,1f,22,23,27,28"
-#define RADIO_TX_PER_POWER_LIMITS_2_4_EXTREME_DEF_TABLE     "19,1c,1e,20,24,25"
+#define RADIO_TX_PER_POWER_LIMITS_2_4_NORMAL_DEF_TABLE      "1d,1f,22,26,28,29"
+#define RADIO_TX_PER_POWER_LIMITS_2_4_DEGRADED_DEF_TABLE    "1a,1f,22,24,26,28"
+#define RADIO_TX_PER_POWER_LIMITS_2_4_EXTREME_DEF_TABLE     "16,1d,1e,20,24,25"
 
 
 #define RADIO_TX_PER_POWER_LIMITS_2_4_11B_DEF_TABLE         "50,50,50,50,50,50,50,50,50,50,50,50,50,50"
 #define RADIO_TX_PER_POWER_LIMITS_2_4_OFDM_DEF_TABLE        "50,50,50,50,50,50,50,50,50,50,50,50,50,50"
 #define RADIO_TX_PA_GAIN_VS_BIAS_OFFSET_2_4_DEF_TABLE       "f3,54,55,56,57,58"
-#define RADIO_TX_PD_VS_RATE_OFFSET_2_4_DEF_TABLE            "00,00,00,00,00,00 "
-#define RADIO_TX_BIAS_2_4_DEF_TABLE                         "11,11,15,11,15,15"
+#define RADIO_TX_PD_VS_RATE_OFFSET_2_4_DEF_TABLE            "01,02,02,02,02,00"
+#define RADIO_TX_BIAS_2_4_DEF_TABLE                         "11,11,15,11,15,0f"
 #define RADIO_TX_BIP_REF_VOLTAGE_DEF_TABLE_5G               "173,188,187,18b,18a,186,18c"
 #define RADIO_TX_BIP_REF_POWER_DEF_TABLE_5G                 "80,80,80,80,80,80,80"
 #define RADIO_TX_BIP_OFF_BD_5G                              "00,00,00,00,00,00"
@@ -1344,7 +1384,7 @@
 #define RADIO_TX_TRACE_LOSS_5_DEF_TABLE                     "00,00,00,00,00,00,00"
 
 #define RADIO_RX_FEM_INSERT_LOSS_2_4_MIN                    0
-#define RADIO_RX_FEM_INSERT_LOSS_2_4_DEF                    350  /* 0x15e
+#define RADIO_RX_FEM_INSERT_LOSS_2_4_DEF                    375  /* 0x15e
  */
 #define RADIO_RX_FEM_INSERT_LOSS_2_4_MAX                    0xffff
 
@@ -1373,6 +1413,9 @@
 #define RADIO_RX_RSSI_PROCESS_2_4_DEF_TABLE                 "7a,7b,7c,7d,7e,7f,80,81,82,83,84,85,86,87,88"
 #define RADIO_RX_RSSI_PROCESS_5_DEF_TABLE                   "00,00,00,00,00,00,00,00,00,00,00,00,00,00,00"
 
+#define RADIO_TX_PER_CH_POWER_COMPENSATION_2_4_DEF	       "00,00,00,00,00,00,00"
+#define RADIO_TX_PER_CH_POWER_COMPENSATION_5_DEF	       "00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00"
+
 #define RADIO_FREF_CLOCK_SETTING_TIME_MIN    				0
 #define RADIO_FREF_CLOCK_SETTING_TIME_DEF    				5
 #define RADIO_FREF_CLOCK_SETTING_TIME_MAX    				15
diff --git a/wl1271/stad/Export_Inc/paramOut.h b/wl1271/stad/Export_Inc/paramOut.h
index 57a7340..91536e9 100644
--- a/wl1271/stad/Export_Inc/paramOut.h
+++ b/wl1271/stad/Export_Inc/paramOut.h
@@ -1,7 +1,7 @@
 /*
  * paramOut.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -750,9 +750,14 @@
         TScanParams                 		*pScanParams;
         TPeriodicScanParams         		*pPeriodicScanParams;
         TI_UINT32                   		uBssidListSize;
+		TI_UINT32                   		uNumBssidInList;
         OS_802_11_BSSID_LIST_EX     		*pBssidList;
+		OS_802_11_N_RATES					*pRateList;
         TSsid                   			tScanDesiredSSID;
 
+        TI_UINT32                           uSraThreshold;
+        TI_INT32                            nRssiThreshold;
+
         /* tx data qos related parameters */
         TTxDataQosParams           			txDataQosParams;
 
@@ -926,6 +931,7 @@
 {
     TI_BOOL  RoamingScanning_2_4G_enable;
 	TI_UINT8 RoamingOperationalMode;
+    TI_UINT8 bSendTspecInReassPkt;
 }   TRoamScanMngrInitParams;
 
 typedef struct
@@ -1121,6 +1127,9 @@
     TI_UINT32       uMinimumDurationBetweenOsScans;
     TI_UINT32       uDfsPassiveDwellTimeMs;
     TI_BOOL	        bPushMode; /*  True means Push mode. False is the default mode, storing scan results in table. */
+    TI_UINT32       uSraThreshold;
+    TI_INT32        nRssiThreshold;
+
 } TScanCncnInitParams;
 
 typedef struct
diff --git a/wl1271/stad/build/linux/common.inc b/wl1271/stad/build/linux/common.inc
index 27f8f25..feb6ff2 100644
--- a/wl1271/stad/build/linux/common.inc
+++ b/wl1271/stad/build/linux/common.inc
@@ -75,6 +75,9 @@
 ## Driver Compilation Directives
 ##
 ##
+ifeq "$(HOST_PLATFORM)" "omap2430"	
+	DK_DEFINES += -D HOST_PLATFORM_OMAP2430
+endif
 ifeq "$(HOST_PLATFORM)" "omap3430"
 	DK_DEFINES += -D HOST_PLATFORM_OMAP3430
 endif
diff --git a/wl1271/stad/src/AirLink_Managment/SwitchChannel.c b/wl1271/stad/src/AirLink_Managment/SwitchChannel.c
index 0e5739a..6831a55 100644
--- a/wl1271/stad/src/AirLink_Managment/SwitchChannel.c
+++ b/wl1271/stad/src/AirLink_Managment/SwitchChannel.c
@@ -1,7 +1,7 @@
 /*
  * SwitchChannel.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -528,7 +528,12 @@
                 param.content.channelValidity.channelValidity = TI_FALSE;
                 regulatoryDomain_setParam(pSwitchChannel->hRegulatoryDomain, &param);
             }
-            apConn_reportRoamingEvent(pSwitchChannel->hApConn, ROAMING_TRIGGER_SWITCH_CHANNEL, NULL);
+            
+            if (TI_TRUE == pSwitchChannel->switchChannelStarted) 
+            {
+                   apConn_reportRoamingEvent(pSwitchChannel->hApConn, ROAMING_TRIGGER_SWITCH_CHANNEL, NULL); 
+            }
+            
         }
         else
         {   /* Invoke Switch Channel command */
diff --git a/wl1271/stad/src/AirLink_Managment/measurementMgr.c b/wl1271/stad/src/AirLink_Managment/measurementMgr.c
index c2841cd..6af3660 100644
--- a/wl1271/stad/src/AirLink_Managment/measurementMgr.c
+++ b/wl1271/stad/src/AirLink_Managment/measurementMgr.c
@@ -1,7 +1,7 @@
 /*
  * measurementMgr.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -189,6 +189,7 @@
     pMeasurementMgr->currentFrameType = MSR_FRAME_TYPE_NO_ACTIVE;
     pMeasurementMgr->measuredChannelID = 0;
     pMeasurementMgr->currentNumOfRequestsInParallel = 0;
+    pMeasurementMgr->bMeasurementScanExecuted = TI_FALSE;
     
     /* config sub modules */
     RequestHandler_config(pMeasurementMgr->hRequestH, pStadHandles->hReport, pStadHandles->hOs);
@@ -470,15 +471,12 @@
 TI_STATUS measurementMgr_destroy(TI_HANDLE hMeasurementMgr)
 {
     measurementMgr_t *pMeasurementMgr = (measurementMgr_t *) hMeasurementMgr;
-    TI_UINT32 initVec;
 
     if (pMeasurementMgr == NULL)
         return TI_OK;
 
     TRACE0(pMeasurementMgr->hReport, REPORT_SEVERITY_INFORMATION, ": MeasurementMgr is being destroyed\n");
 
-    initVec = 0xFFFF;   /* release everything */
-
     measurementMgr_releaseModule (pMeasurementMgr);
 
     return TI_OK;
diff --git a/wl1271/stad/src/AirLink_Managment/measurementMgr.h b/wl1271/stad/src/AirLink_Managment/measurementMgr.h
index 038b0a9..ec6659a 100644
--- a/wl1271/stad/src/AirLink_Managment/measurementMgr.h
+++ b/wl1271/stad/src/AirLink_Managment/measurementMgr.h
@@ -1,7 +1,7 @@
 /*
  * measurementMgr.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -107,6 +107,8 @@
     TI_UINT16                   trafficIntensityThreshold;
     TI_UINT16                   maxDurationOnNonServingChannel;
 
+    TI_BOOL                     bMeasurementScanExecuted; /* flag indicating if measurment scan was 
+                                                      executed by AP after the last connection */
 
     /* State Machine Params */
     fsm_stateMachine_t *        pMeasurementMgrSm;
diff --git a/wl1271/stad/src/AirLink_Managment/measurementMgrSM.c b/wl1271/stad/src/AirLink_Managment/measurementMgrSM.c
index 6687d40..22c8dc2 100644
--- a/wl1271/stad/src/AirLink_Managment/measurementMgrSM.c
+++ b/wl1271/stad/src/AirLink_Managment/measurementMgrSM.c
@@ -1,7 +1,7 @@
 /*
  * measurementMgrSM.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -336,6 +336,9 @@
 
     TRACE0(pMeasurementMgr->hReport, REPORT_SEVERITY_INFORMATION, ": Connected flag has been set\n");
 
+    /* upon connection to a new AP set the measurment scan flag to FALSE */
+    pMeasurementMgr->bMeasurementScanExecuted = TI_FALSE;
+
 	/* get the current serving channel */
 	param.paramType = SITE_MGR_CURRENT_CHANNEL_PARAM;
 	siteMgr_getParam(pMeasurementMgr->hSiteMgr, &param);
@@ -956,6 +959,9 @@
 				MEASUREMENTMGR_EVENT_COMPLETE, pMeasurementMgr);  
 	}
 
+    /* set the measurement scan executed flag to TRUE */
+    pMeasurementMgr->bMeasurementScanExecuted = TI_TRUE;
+
 	/* Yalla, start measuring */
     TRACE0(pMeasurementMgr->hReport, REPORT_SEVERITY_INFORMATION, ": Finished preparing request. Handing over to MeasurementSRV...\n");
 
diff --git a/wl1271/stad/src/AirLink_Managment/regulatoryDomain.c b/wl1271/stad/src/AirLink_Managment/regulatoryDomain.c
index d25e6ac..1714593 100644
--- a/wl1271/stad/src/AirLink_Managment/regulatoryDomain.c
+++ b/wl1271/stad/src/AirLink_Managment/regulatoryDomain.c
@@ -1,7 +1,7 @@
 /*
  * regulatoryDomain.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
diff --git a/wl1271/stad/src/Application/roamingMngr.c b/wl1271/stad/src/Application/roamingMngr.c
index 0655aad..c5939d5 100644
--- a/wl1271/stad/src/Application/roamingMngr.c
+++ b/wl1271/stad/src/Application/roamingMngr.c
@@ -1,7 +1,7 @@
 /*
  * roamingMngr.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -358,18 +358,18 @@
     {
          switch (connStatus)
          {
-          case CONN_STATUS_CONNECTED:
-        		roamingEvent = ROAMING_MANUAL_EVENT_START;
-                apConn_getStaCapabilities(pRoamingMngr->hAPConnection,&pRoamingMngr->staCapabilities);
-                break;
+          case CONN_STATUS_CONNECTED: 
+        		roamingEvent = (roamingMngr_smEvents)ROAMING_MANUAL_EVENT_START;
+                apConn_getStaCapabilities(pRoamingMngr->hAPConnection,&pRoamingMngr->staCapabilities); 
+                break;     
           case CONN_STATUS_NOT_CONNECTED:
-                roamingEvent = ROAMING_MANUAL_EVENT_STOP;
+                roamingEvent = (roamingMngr_smEvents)ROAMING_MANUAL_EVENT_STOP;
                 break;
           case CONN_STATUS_HANDOVER_SUCCESS:
-                roamingEvent = ROAMING_MANUAL_EVENT_SUCCESS;
+                roamingEvent = (roamingMngr_smEvents)ROAMING_MANUAL_EVENT_SUCCESS;
                 break;
           case CONN_STATUS_HANDOVER_FAILURE:
-                roamingEvent = ROAMING_MANUAL_EVENT_FAIL;
+                roamingEvent = (roamingMngr_smEvents)ROAMING_MANUAL_EVENT_FAIL;
                 break;
           default:
         	return TI_NOK;
@@ -730,6 +730,7 @@
     pRoamingMngr->listOfCandidateAps.numOfPreAuthBSS = 0;
     pRoamingMngr->listOfCandidateAps.numOfRegularBSS = 0;
     pRoamingMngr->RoamingOperationalMode =  pInitParam->RoamingOperationalMode;
+    pRoamingMngr->bSendTspecInReassPkt = pInitParam->bSendTspecInReassPkt;
 
 	if (pInitParam->RoamingScanning_2_4G_enable)
     {
diff --git a/wl1271/stad/src/Application/roamingMngrApi.h b/wl1271/stad/src/Application/roamingMngrApi.h
index bc29797..41334d4 100644
--- a/wl1271/stad/src/Application/roamingMngrApi.h
+++ b/wl1271/stad/src/Application/roamingMngrApi.h
@@ -1,7 +1,7 @@
 /*
  * roamingMngrApi.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -151,6 +151,7 @@
 #endif
 
     TI_UINT8	                   RoamingOperationalMode; /* 0 - manual, 1 - auto*/
+    TI_UINT8                       bSendTspecInReassPkt;   
     TargetAp_t                     targetAP;               /* holds the AP to connect with in manual mode */
 }; /* _roamingMngr_t */
 
diff --git a/wl1271/stad/src/Application/roamingMngr_autoSM.c b/wl1271/stad/src/Application/roamingMngr_autoSM.c
index 585b203..5bc1623 100644
--- a/wl1271/stad/src/Application/roamingMngr_autoSM.c
+++ b/wl1271/stad/src/Application/roamingMngr_autoSM.c
@@ -1,7 +1,7 @@
 /*
  * roamingMngr_autoSM.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -511,7 +511,12 @@
     TRACE3(pRoamingMngr->hReport, REPORT_SEVERITY_INFORMATION, "roamingMngr_smHandover, candidateApIndex=%d, requestType = %d, channel=%d \n", 							 pRoamingMngr->candidateApIndex, requestToApConn.requestType, pApToConnect->channel);
 
     requestToApConn.dataBufLength = 0;
+
+#ifdef XCC_MODULE_INCLUDED
+    apConn_connectToAP(pRoamingMngr->hAPConnection, pApToConnect, &requestToApConn, pRoamingMngr->bSendTspecInReassPkt);
+#else
     apConn_connectToAP(pRoamingMngr->hAPConnection, pApToConnect, &requestToApConn, TI_TRUE);
+#endif
 }
 
 /**
diff --git a/wl1271/stad/src/Application/scanMngr.c b/wl1271/stad/src/Application/scanMngr.c
index ac5a280..64108e1 100644
--- a/wl1271/stad/src/Application/scanMngr.c
+++ b/wl1271/stad/src/Application/scanMngr.c
@@ -1,7 +1,7 @@
 /*
  * scanMngr.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -102,7 +102,7 @@
     pScanMngr->manualScanParams.scanType= SCAN_TYPE_NORMAL_ACTIVE;
     pScanMngr->manualScanParams.band = RADIO_BAND_2_4_GHZ;
     pScanMngr->manualScanParams.probeReqNumber =  3;
-    pScanMngr->manualScanParams.probeRequestRate = RATE_MASK_UNSPECIFIED;
+    pScanMngr->manualScanParams.probeRequestRate = (ERateMask)RATE_MASK_UNSPECIFIED;
 }
 
 
@@ -4043,7 +4043,7 @@
         defaultScanPolicy.bandScanPolicy[ 0 ].trackingMethod.method.basicMethodParams.maxChannelDwellTime = 0;
         defaultScanPolicy.bandScanPolicy[ 0 ].trackingMethod.method.basicMethodParams.minChannelDwellTime = 0;
 
-        defaultScanPolicy.bandScanPolicy[ 0 ].trackingMethod.method.basicMethodParams.probReqParams.bitrate = RATE_MASK_UNSPECIFIED; /* Let the FW select */
+        defaultScanPolicy.bandScanPolicy[ 0 ].trackingMethod.method.basicMethodParams.probReqParams.bitrate = (ERateMask)RATE_MASK_UNSPECIFIED; /* Let the FW select */
         defaultScanPolicy.bandScanPolicy[ 0 ].trackingMethod.method.basicMethodParams.probReqParams.numOfProbeReqs = 0;
         defaultScanPolicy.bandScanPolicy[ 0 ].trackingMethod.method.basicMethodParams.probReqParams.txPowerDbm = 0;
 
@@ -4052,7 +4052,7 @@
         defaultScanPolicy.bandScanPolicy[ 0 ].discoveryMethod.method.basicMethodParams.ETMaxNumberOfApFrames = 0;
         defaultScanPolicy.bandScanPolicy[ 0 ].discoveryMethod.method.basicMethodParams.maxChannelDwellTime = 0;
         defaultScanPolicy.bandScanPolicy[ 0 ].discoveryMethod.method.basicMethodParams.minChannelDwellTime = 0;
-        defaultScanPolicy.bandScanPolicy[ 0 ].discoveryMethod.method.basicMethodParams.probReqParams.bitrate = RATE_MASK_UNSPECIFIED; /* Let the FW select */
+        defaultScanPolicy.bandScanPolicy[ 0 ].discoveryMethod.method.basicMethodParams.probReqParams.bitrate = (ERateMask)RATE_MASK_UNSPECIFIED; /* Let the FW select */
         defaultScanPolicy.bandScanPolicy[ 0 ].discoveryMethod.method.basicMethodParams.probReqParams.numOfProbeReqs = 0;
         defaultScanPolicy.bandScanPolicy[ 0 ].discoveryMethod.method.basicMethodParams.probReqParams.txPowerDbm = 0;
 
@@ -4062,7 +4062,7 @@
         defaultScanPolicy.bandScanPolicy[0].immediateScanMethod.method.basicMethodParams.earlyTerminationEvent = SCAN_ET_COND_DISABLE;
         defaultScanPolicy.bandScanPolicy[0].immediateScanMethod.method.basicMethodParams.ETMaxNumberOfApFrames = 0;
         defaultScanPolicy.bandScanPolicy[0].immediateScanMethod.method.basicMethodParams.probReqParams.numOfProbeReqs = 3;
-        defaultScanPolicy.bandScanPolicy[0].immediateScanMethod.method.basicMethodParams.probReqParams.bitrate = 4;//RATE_MASK_UNSPECIFIED; /* Let the FW select */
+        defaultScanPolicy.bandScanPolicy[0].immediateScanMethod.method.basicMethodParams.probReqParams.bitrate = (ERateMask)4;//RATE_MASK_UNSPECIFIED; /* Let the FW select */
         defaultScanPolicy.bandScanPolicy[0].immediateScanMethod.method.basicMethodParams.probReqParams.txPowerDbm = MAX_TX_POWER;
 
         pParam->paramType = SCAN_MNGR_SET_CONFIGURATION;
@@ -4094,7 +4094,6 @@
 void scanMngr_startManual(TI_HANDLE hScanMngr)
 {
 	scanMngr_t* pScanMngr = (scanMngr_t*)hScanMngr;
-    TScanBandPolicy* gPolicy;
 
     pScanMngr->scanningOperationalMode = SCANNING_OPERATIONAL_MODE_MANUAL;
     pScanMngr->connStatus = CONNECTION_STATUS_CONNECTED;
@@ -4103,7 +4102,7 @@
     TRACE0(pScanMngr->hReport,REPORT_SEVERITY_INFORMATION, "scanMngr_startManual() called. \n");
 
     /* get policies by band */
-    gPolicy = scanMngrGetPolicyByBand( hScanMngr, RADIO_BAND_2_4_GHZ ); /* TODO: check if neccessary!!!*/
+    scanMngrGetPolicyByBand( hScanMngr, RADIO_BAND_2_4_GHZ ); /* TODO: check if neccessary!!!*/
 }
 
 /**
diff --git a/wl1271/stad/src/Application/scanMngrApi.h b/wl1271/stad/src/Application/scanMngrApi.h
index 792c25d..33d6226 100644
--- a/wl1271/stad/src/Application/scanMngrApi.h
+++ b/wl1271/stad/src/Application/scanMngrApi.h
@@ -1,7 +1,7 @@
 /*
  * scanMngrApi.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -329,6 +329,8 @@
 
 TI_STATUS scanMngr_stopContinuousScanByApp (TI_HANDLE hScanMngr);
 
+void scanMngr_SetDefaults (TI_HANDLE hScanMngr, TRoamScanMngrInitParams *pInitParams);
+
 /********** New APIs added for EMP manual scan support ******/
 
 
@@ -391,6 +393,4 @@
 
 #endif /* TI_DBG */
 
-void scanMngr_SetDefaults (TI_HANDLE hScanMngr, TRoamScanMngrInitParams *pInitParams);
-
 #endif /* __SCAN_MNGR_API_H__ */
diff --git a/wl1271/stad/src/Connection_Managment/admCtrlWpa.c b/wl1271/stad/src/Connection_Managment/admCtrlWpa.c
index 8bd486c..4eaa0f5 100644
--- a/wl1271/stad/src/Connection_Managment/admCtrlWpa.c
+++ b/wl1271/stad/src/Connection_Managment/admCtrlWpa.c
@@ -1,7 +1,7 @@
 /*
  * admCtrlWpa.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -527,11 +527,10 @@
     wpaIePacket_t   *pWpaIePacket;
     TI_UINT8        length;
     TI_UINT16       tempInt;
-    TI_STATUS       status;
     TIWLN_SIMPLE_CONFIG_MODE wscMode;
 
     /* Get Simple-Config state */
-    status = siteMgr_getParamWSC(pAdmCtrl->pRsn->hSiteMgr, &wscMode); /* SITE_MGR_SIMPLE_CONFIG_MODE */
+    siteMgr_getParamWSC(pAdmCtrl->pRsn->hSiteMgr, &wscMode); /* SITE_MGR_SIMPLE_CONFIG_MODE */
 
     if (pIe==NULL)
     {
@@ -621,11 +620,11 @@
 		case RSN_EXT_AUTH_MODE_WPA:
 			{
 #ifdef XCC_MODULE_INCLUDED
-				TI_UINT8	akmSuite[DOT11_OUI_LEN+1];
+				TI_UINT8	akmSuite[DOT11_OUI_LEN];
 
 				if (admCtrlXCC_getCckmAkm(pAdmCtrl, akmSuite))
 				{
-					os_memoryCopy(pAdmCtrl->hOs, (void*)pWpaIePacket->authKeyMngSuite, akmSuite, DOT11_OUI_LEN+1);
+					os_memoryCopy(pAdmCtrl->hOs, (void*)pWpaIePacket->authKeyMngSuite, akmSuite, DOT11_OUI_LEN);
 				}
 				else
 #endif
@@ -1071,14 +1070,7 @@
         wpaData.unicastSuite[0] = admCtrlWpa_validity.unicast;
         *pEvaluation = admCtrlWpa_validity.evaluation;
     }
-/*** OMAPS00214746_CHANGE_START ***/
-#if 0
-    if ((encryptionStatus == TWD_CIPHER_TKIP) && (pRsnSiteParams->pHTCapabilities->tHdr[0] != TI_FALSE) && (pRsnSiteParams->pHTInfo->tHdr[0] != TI_FALSE))
-	{
-		TRACE0(pAdmCtrl->hReport, REPORT_SEVERITY_INFORMATION,"Dismiss AP - HT with TKIP is not valid");
-        return TI_NOK; /* if the encyption is TKIP and the site does support HT(11n) the site can not be a candidate */
-	}
-#endif
+
 	/* Check privacy bit if not in mixed mode */
     if (!pAdmCtrl->mixedMode)
     {   /* There's no mixed mode, so make sure that the privacy Bit matches the privacy mode*/
@@ -1217,7 +1209,7 @@
     {
         TI_UINT16              keyMngSuiteCnt = ENDIAN_HANDLE_WORD(*curWpaIe);
         TI_UINT16              index;
-        ERsnKeyMngSuite   maxKeyMngSuite = WPA_IE_KEY_MNG_NONE;
+        ERsnKeyMngSuite   maxKeyMngSuite = (ERsnKeyMngSuite)WPA_IE_KEY_MNG_NONE;
 
         /* Include all AP key management supported suites in the wpaData structure */
         pWpaData->KeyMngSuiteCnt = keyMngSuiteCnt;
diff --git a/wl1271/stad/src/Connection_Managment/admCtrlWpa.h b/wl1271/stad/src/Connection_Managment/admCtrlWpa.h
index 4a4a3b9..1da616b 100644
--- a/wl1271/stad/src/Connection_Managment/admCtrlWpa.h
+++ b/wl1271/stad/src/Connection_Managment/admCtrlWpa.h
@@ -1,7 +1,7 @@
 /*
  * admCtrlWpa.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -96,14 +96,14 @@
 
 	TI_UINT8  				elementid;	   /* WPA information element id is 0xDD */	   
 	TI_UINT8  				length;			   
-    TI_UINT8  				oui[DOT11_OUI_LEN];
+    TI_UINT8  				oui[DOT11_OUI_LEN - 1];
 	TI_UINT8  				ouiType;
     TI_UINT16 				version;
-    TI_UINT8 				groupSuite[DOT11_OUI_LEN+1];
+    TI_UINT8 				groupSuite[DOT11_OUI_LEN];
     TI_UINT16 				pairwiseSuiteCnt;
-	TI_UINT8				pairwiseSuite[DOT11_OUI_LEN+1];
+	TI_UINT8				pairwiseSuite[DOT11_OUI_LEN];
 	TI_UINT16 				authKeyMngSuiteCnt;
-	TI_UINT8				authKeyMngSuite[DOT11_OUI_LEN+1];
+	TI_UINT8				authKeyMngSuite[DOT11_OUI_LEN];
     TI_UINT16				capabilities;
 } wpaIePacket_t;
 
diff --git a/wl1271/stad/src/Connection_Managment/admCtrlWpa2.c b/wl1271/stad/src/Connection_Managment/admCtrlWpa2.c
index 57eaedf..1f68caf 100644
--- a/wl1271/stad/src/Connection_Managment/admCtrlWpa2.c
+++ b/wl1271/stad/src/Connection_Managment/admCtrlWpa2.c
@@ -1,7 +1,7 @@
 /*
  * admCtrlWpa2.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -568,11 +568,11 @@
     case RSN_EXT_AUTH_MODE_WPA:   /* for Any-WPA/WPA-Mixed mode */
         {
 #ifdef XCC_MODULE_INCLUDED
-            TI_UINT8   akmSuite[DOT11_OUI_LEN+1];
+            TI_UINT8   akmSuite[DOT11_OUI_LEN];
 
             if (admCtrlXCC_getCckmAkm(pAdmCtrl, akmSuite))
             {
-                os_memoryCopy(pAdmCtrl->hOs, (void*)pWpa2IePacket->authKeyMngSuite, akmSuite, DOT11_OUI_LEN+1);
+                os_memoryCopy(pAdmCtrl->hOs, (void*)pWpa2IePacket->authKeyMngSuite, akmSuite, DOT11_OUI_LEN);
             }
             else
 #endif
@@ -820,13 +820,7 @@
     TI_STATUS               status;
     wpa2IeData_t            wpa2Data;
     TI_UINT8                *pWpa2Ie;
-/*** OMAPS00214746_CHANGE_START ***/
-#if 0
-    ECipherSuite            uSuite, bSuite,encryptionStatus;
-#else
     ECipherSuite            uSuite, bSuite; 
-#endif
-/*** OMAPS00214746_CHANGE_END ***/
     TI_UINT8                i = 0;
     TIWLN_SIMPLE_CONFIG_MODE  wscMode = TIWLN_SIMPLE_CONFIG_OFF;
 
@@ -845,17 +839,6 @@
     {
         return TI_NOK;
     }
-/*** OMAPS00214746_CHANGE_START ***/
-#if 0  /*** Delete the following check ***/
-
-	pAdmCtrl->getCipherSuite(pAdmCtrl, &encryptionStatus);
-	if ((encryptionStatus == TWD_CIPHER_TKIP) && (pRsnSiteParams->pHTCapabilities->tHdr[0] != TI_FALSE) && (pRsnSiteParams->pHTInfo->tHdr[0] != TI_FALSE))
-	{
-		TRACE0(pAdmCtrl->hReport, REPORT_SEVERITY_INFORMATION,"Dismiss AP - HT with TKIP is not valid");
-        return TI_NOK; /* if the encyption is TKIP and the site does support HT(11n) the site can not be a candidate */
-	}
-#endif /*** End of Deletion ***/
-/*** OMAPS00214746_CHANGE_END ***/
 
     /* Get Simple-Config state */
     siteMgr_getParamWSC(pAdmCtrl->pRsn->hSiteMgr, &wscMode); /* SITE_MGR_SIMPLE_CONFIG_MODE */
diff --git a/wl1271/stad/src/Connection_Managment/apConn.c b/wl1271/stad/src/Connection_Managment/apConn.c
index 39fbacb..0a19900 100644
--- a/wl1271/stad/src/Connection_Managment/apConn.c
+++ b/wl1271/stad/src/Connection_Managment/apConn.c
@@ -1,7 +1,7 @@
 /*
  * apConn.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -1231,10 +1231,9 @@
         if (pAPConnection->APDisconnect.uStatusCode == STATUS_CODE_802_1X_AUTHENTICATION_FAILED)
         {
           #ifdef XCC_MODULE_INCLUDED
-            TI_STATUS    status;
 
             /* Raise the EAP-Failure as event */
-            status = XCCMngr_rogueApDetected (pAPConnection->hXCCMngr, RSN_AUTH_STATUS_CHALLENGE_FROM_AP_FAILED);
+            XCCMngr_rogueApDetected (pAPConnection->hXCCMngr, RSN_AUTH_STATUS_CHALLENGE_FROM_AP_FAILED);
           #endif
 
             
@@ -1289,7 +1288,7 @@
         else
         {
             /* Infra-structure BSS case - disconnect the link */
-            if (roamingEventType >= ROAMING_TRIGGER_AP_DISCONNECT)
+            if (roamingEventType >= ROAMING_TRIGGER_AP_DISCONNECT && (roamingEventType != ROAMING_TRIGGER_TSPEC_REJECTED))
             {
                 pAPConnection->removeKeys = TI_TRUE;
             }
@@ -1324,6 +1323,14 @@
             EvHandlerSendEvent(pAPConnection->hEvHandler, IPC_EVENT_LOW_RSSI, NULL,0);
         }
         /* Report to Roaming Manager */
+
+#ifdef XCC_MODULE_INCLUDED
+        /* For XCC only - if the is reason is TSPEC reject - mark this as BssLoss - To be changed later */
+        if (roamingEventType == ROAMING_TRIGGER_TSPEC_REJECTED)
+        {
+            roamingEventType = ROAMING_TRIGGER_BSS_LOSS;
+        }
+#endif        
         pAPConnection->roamEventCallb(pAPConnection->hRoamMng, &roamingEventType, reasonCode);
     }
 
@@ -1579,9 +1586,12 @@
     apConn_t  *pAPConnection = (apConn_t *)data;
     TGenSM    *pGenSM = (TGenSM*)pAPConnection->hAPConnSM;
 
+	TRACE2(pAPConnection->hReport, REPORT_SEVERITY_INFORMATION, "apConn_smEvent: currState = %d, event = %d\n", pGenSM->uCurrentState, event);
     genSM_Event (pAPConnection->hAPConnSM, (TI_UINT32)event, data);
     pAPConnection->currentState = pGenSM->uCurrentState;
 
+	TRACE1(pAPConnection->hReport, REPORT_SEVERITY_INFORMATION, "apConn_smEvent: newState = %d\n", pAPConnection->currentState);
+
     return TI_OK;
 }
 
@@ -1802,7 +1812,7 @@
 	/* Stop Connection state machine - always immediate TBD */
 	conn_stop(pAPConnection->hConnSm, 
 			  disConnType,
-			  pAPConnection->deauthPacketReasonCode,
+			  (mgmtStatus_e)pAPConnection->deauthPacketReasonCode,
 			  pAPConnection->removeKeys, /* for Roaming, do not remove the keys */
 			  apConn_DisconnCompleteInd,
 			  pAPConnection);
@@ -2053,7 +2063,12 @@
     staPrivacySupported = (param.content.rsnEncryptionStatus == TWD_CIPHER_NONE) ? TI_FALSE : TI_TRUE;
     apPrivacySupported  = ((pAPConnection->newAP->capabilities >> CAP_PRIVACY_SHIFT) & CAP_PRIVACY_MASK) ? TI_TRUE : TI_FALSE;
 
+#ifdef GEM_SUPPORTED
+	// For GEM – ignore the privacy bit of the AP. Some GEM AP’s don’t turn on the privacy
+ if ((staPrivacySupported != apPrivacySupported) && (param.content.rsnEncryptionStatus != TWD_CIPHER_GEM))
+#else 
     if (staPrivacySupported != apPrivacySupported)
+#endif
     {
         param.paramType = RSN_MIXED_MODE;
         rsn_getParam(pAPConnection->hPrivacy, &param);
@@ -2077,7 +2092,7 @@
     }
 
     /* Update re-associate parameter of MLME */
-    if (pAPConnection->requestType == AP_CONNECT_FAST_TO_AP)
+    if (pAPConnection->requestType == AP_CONNECT_FAST_TO_AP || pAPConnection->requestType == AP_CONNECT_RECONNECT_CURR_AP)
     {
         connType = CONN_TYPE_ROAM;
     }
@@ -2265,8 +2280,13 @@
     apConn_t *pAPConnection = (apConn_t *)pData;
     paramInfo_t param;
 
-    if (pAPConnection->voiceTspecConfigured && pAPConnection->reNegotiateTSPEC)
-    {
+    if (pAPConnection->voiceTspecConfigured
+#ifndef XCC_MODULE_INCLUDED
+          && pAPConnection->reNegotiateTSPEC
+#endif
+        )
+        {
+#ifndef XCC_MODULE_INCLUDED        
         param.paramType = QOS_MNGR_VOICE_RE_NEGOTIATE_TSPEC;
         qosMngr_getParams(pAPConnection->hQos, &param);
 
@@ -2276,6 +2296,7 @@
             apConn_smEvent(&(pAPConnection->currentState), AP_CONNECT_EVENT_FINISHED_OK, pAPConnection);
         }
         else
+#endif
         {
             param.paramType = QOS_MNGR_RESEND_TSPEC_REQUEST;
             param.content.qosRenegotiateTspecRequest.callback = (void *)apConn_qosMngrReportResultCallb;
diff --git a/wl1271/stad/src/Connection_Managment/apConnApi.h b/wl1271/stad/src/Connection_Managment/apConnApi.h
index 12bed1c..4b8556d 100644
--- a/wl1271/stad/src/Connection_Managment/apConnApi.h
+++ b/wl1271/stad/src/Connection_Managment/apConnApi.h
@@ -1,7 +1,7 @@
 /*
  * apConnApi.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -111,8 +111,9 @@
 
 /*	9	*/	ROAMING_TRIGGER_AP_DISCONNECT, 					/**< AP disconnect (de-authenticate or disassociate)	*/
 /*	10	*/	ROAMING_TRIGGER_SECURITY_ATTACK,				/**< Security attack	*/
-
-/*	11	*/	ROAMING_TRIGGER_LAST							/**< Maximum roaming trigger - must be last!!!	*/
+/*	11	*/	ROAMING_TRIGGER_TSPEC_REJECTED,	                /**< TSPEC Rejected	*/
+    
+/*	12	*/	ROAMING_TRIGGER_LAST							/**< Maximum roaming trigger - must be last!!!	*/
 
 } apConn_roamingTrigger_e;
 
diff --git a/wl1271/stad/src/Connection_Managment/conn.c b/wl1271/stad/src/Connection_Managment/conn.c
index 7772a4b..f92f04e 100644
--- a/wl1271/stad/src/Connection_Managment/conn.c
+++ b/wl1271/stad/src/Connection_Managment/conn.c
@@ -1,7 +1,7 @@
 /*
  * conn.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
diff --git a/wl1271/stad/src/Connection_Managment/connIbss.c b/wl1271/stad/src/Connection_Managment/connIbss.c
index 3583abb..2c30011 100644
--- a/wl1271/stad/src/Connection_Managment/connIbss.c
+++ b/wl1271/stad/src/Connection_Managment/connIbss.c
@@ -1,7 +1,7 @@
 /*
  * connIbss.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -238,11 +238,6 @@
 	/* Update TxMgmtQueue SM to enable EAPOL packets. */
 	txMgmtQ_SetConnState (pConn->hTxMgmtQ, TX_CONN_STATE_EAPOL);
 
-    /*
-     *  Notify that the driver is associated to the supplicant\IP stack. 
-     */
-    EvHandlerSendEvent (pConn->hEvHandler, IPC_EVENT_ASSOCIATED, NULL, 0);
-
     return rsn_start (pConn->hRsn);
 }
 
@@ -304,11 +299,6 @@
 	/* Update TxMgmtQueue SM to enable EAPOL packets. */
 	txMgmtQ_SetConnState (pConn->hTxMgmtQ, TX_CONN_STATE_EAPOL);
 
-    /*
-     *  Notify that the driver is associated to the supplicant\IP stack. 
-     */
-    EvHandlerSendEvent (pConn->hEvHandler, IPC_EVENT_ASSOCIATED, NULL, 0);
-
     return rsn_start (pConn->hRsn);
 
 }
@@ -447,7 +437,7 @@
 ************************************************************************/
 static TI_STATUS rsnWait_to_waitToDisconnCmplt(void *pData)
 {
-    paramInfo_t     param;  
+    paramInfo_t     param;
 	TI_STATUS		tStatus;
 
     tStatus = rsn_stop(((conn_t *)pData)->hRsn, TI_FALSE);
@@ -531,6 +521,9 @@
                     pConn->timeout + randomTime,
                     TI_FALSE);
 
+	/*  Notify that the driver is associated to the supplicant\IP stack. */
+    EvHandlerSendEvent (pConn->hEvHandler, IPC_EVENT_ASSOCIATED, NULL, 0);
+
     return TI_OK;
 }
 
diff --git a/wl1271/stad/src/Connection_Managment/connInfra.c b/wl1271/stad/src/Connection_Managment/connInfra.c
index d2f63a0..1f02b7d 100644
--- a/wl1271/stad/src/Connection_Managment/connInfra.c
+++ b/wl1271/stad/src/Connection_Managment/connInfra.c
@@ -1,7 +1,7 @@
 /*
  * connInfra.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -633,7 +633,7 @@
     PowerMgr_startPS(pConn->hPwrMngr);
     
     TRACE1(pConn->hReport, REPORT_SEVERITY_INFORMATION, "rsnWait_to_configHW: setStaStatus %d\n",STA_STATE_CONNECTED);
-    TWD_CmdSetStaState(pConn->hTWD, STA_STATE_CONNECTED, conn_ConfigHwFinishCb, pData);
+    TWD_CmdSetStaState(pConn->hTWD, STA_STATE_CONNECTED, (void *)conn_ConfigHwFinishCb, pData);
 
     return TI_OK;
 }
diff --git a/wl1271/stad/src/Connection_Managment/rsn.c b/wl1271/stad/src/Connection_Managment/rsn.c
index 70fcd29..ac18623 100644
--- a/wl1271/stad/src/Connection_Managment/rsn.c
+++ b/wl1271/stad/src/Connection_Managment/rsn.c
@@ -1,7 +1,7 @@
 /*
  * rsn.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -1252,6 +1252,7 @@
 
 		if (pRsn->bRsnExternalMode) {
 				param.content.txDataCurrentPrivacyInvokedMode = TI_TRUE;
+                txCtrlParams_setEapolEncryptionStatus (pRsn->hTxCtrl, TI_FALSE);
 		}
 
 		txCtrlParams_setCurrentPrivacyInvokedMode(pRsn->hTxCtrl, param.content.txDataCurrentPrivacyInvokedMode);
@@ -1610,6 +1611,8 @@
 #ifdef GEM_SUPPORTED
 					case KEY_GEM:
 							tTwdParam.content.rsnEncryptionStatus = (ECipherSuite)TWD_CIPHER_GEM;
+							status = pRsn->pAdmCtrl->setUcastSuite (pRsn->pAdmCtrl, TWD_CIPHER_GEM);
+							status = pRsn->pAdmCtrl->setBcastSuite (pRsn->pAdmCtrl, TWD_CIPHER_GEM);
 							break;
 #endif
 					case KEY_WEP:
diff --git a/wl1271/stad/src/Connection_Managment/sme.c b/wl1271/stad/src/Connection_Managment/sme.c
index c02893e..9e0d542 100644
--- a/wl1271/stad/src/Connection_Managment/sme.c
+++ b/wl1271/stad/src/Connection_Managment/sme.c
@@ -1,7 +1,7 @@
 /*
  * sme.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -86,8 +86,8 @@
     }
 
     /* Create SME scan result table */
-    pSme->hScanResultTable = scanResultTable_Create (hOS);
-    if (NULL == pSme->hScanResultTable)
+    pSme->hSmeScanResultTable = scanResultTable_Create (hOS, SME_SCAN_TABLE_ENTRIES);
+    if (NULL == pSme->hSmeScanResultTable)
     {
         WLAN_OS_REPORT (("sme_Create: unable to create scan result table. SME creation failed\n"));
         sme_Destroy ((TI_HANDLE)pSme);
@@ -126,7 +126,7 @@
 
 
     /* Initialize the scan result table object */
-    scanResultTable_Init (pSme->hScanResultTable, pStadHandles);
+    scanResultTable_Init (pSme->hSmeScanResultTable, pStadHandles, SCAN_RESULT_TABLE_CLEAR);
 
     /* Initialize the SME state-machine object */
     genSM_Init (pSme->hSmeSm, pStadHandles->hReport);
@@ -153,20 +153,25 @@
     /* initialize SME varaibles */   
     pSme->bRadioOn = pModifiedInitParams->bRadioOn;
     pSme->eConnectMode = pModifiedInitParams->eConnectMode;
+    if (CONNECT_MODE_AUTO == pSme->eConnectMode)
+    {
+        pSme->hScanResultTable = pSme->hSmeScanResultTable;
+    }
+    else if (CONNECT_MODE_MANUAL == pSme->eConnectMode) 
+    {
+        pSme->hScanResultTable = pSme->hScanCncnScanResulTable;
+    }
+
     pSme->eBssType = pModifiedInitParams->eDesiredBssType;
     MAC_COPY (pSme->tBssid, pModifiedInitParams->tDesiredBssid);
 
     pSme->tSsid.len = pModifiedInitParams->tDesiredSsid.len;
-    /* It looks like it never happens. Anyway decided to check */
     if ( pSme->tSsid.len > MAX_SSID_LEN )
     {
-        TRACE2( pSme->hReport, REPORT_SEVERITY_ERROR,
-               "sme_SetDefaults. pSme->tSsid.len=%d exceeds the limit %d\n",
-                   pSme->tSsid.len, MAX_SSID_LEN);
-        handleRunProblem(PROBLEM_BUF_SIZE_VIOLATION);
-        return;
+        TRACE2( pSme->hReport, REPORT_SEVERITY_ERROR, "sme_SetDefaults. pSme->tSsid.len=%d exceeds the limit %d\n", pSme->tSsid.len, MAX_SSID_LEN);
+        pSme->tSsid.len = MAX_SSID_LEN;
     }
-    os_memoryCopy (pSme->hOS, &(pSme->tSsid.str[ 0 ]), &(pModifiedInitParams->tDesiredSsid.str[ 0 ]), pModifiedInitParams->tDesiredSsid.len);
+    os_memoryCopy (pSme->hOS, &(pSme->tSsid.str[ 0 ]), &(pModifiedInitParams->tDesiredSsid.str[ 0 ]), pSme->tSsid.len);
     if (OS_802_11_SSID_JUNK (pSme->tSsid.str, pSme->tSsid.len))
     {
         pSme->eSsidType = SSID_TYPE_INVALID;
@@ -198,6 +203,24 @@
 }
 
 /** 
+ * \fn      sme_setScanResultTable
+ * \brief   Sets the scanResultTable pointer for the manual mode.
+ * \param   hSme - handle to the SME object
+ * \param   hScanResultTable - pointer to ScanResultTable
+ * \return  none
+ */
+void sme_SetScanResultTable(TI_HANDLE hSme, TI_HANDLE hScanResultTable)
+{
+    TSme        *pSme = (TSme*)hSme;
+
+    pSme->hScanCncnScanResulTable = hScanResultTable;
+    if (CONNECT_MODE_MANUAL == pSme->eConnectMode) 
+    {
+        pSme->hScanResultTable = pSme->hScanCncnScanResulTable;
+    }
+}
+
+/** 
  * \fn     sme_Destroy
  * \brief  Destroys the SME object. De-allocates system resources
  * 
@@ -212,9 +235,9 @@
     TSme        *pSme = (TSme*)hSme;
 
     /* destroy the scan result table */
-    if (NULL != pSme->hScanResultTable)
+    if (NULL != pSme->hSmeScanResultTable)
     {
-        scanResultTable_Destroy (pSme->hScanResultTable);
+        scanResultTable_Destroy (pSme->hSmeScanResultTable);
     }
 
     /* destroy the SME generic state machine */
@@ -255,7 +278,7 @@
     /* if radio is on, start the SM */
     if (TI_TRUE == pSme->bRadioOn)
     {
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_START, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_START, hSme);
     }
 }
 
@@ -280,7 +303,7 @@
     pSme->bRunning = TI_FALSE;
 
     /* mark that running flag is send a stop event to the SM */
-    genSM_Event (pSme->hSmeSm, SME_SM_EVENT_STOP, hSme);
+    sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_STOP, hSme);
 }
 
 /** 
@@ -301,7 +324,7 @@
 
     pSme->uScanCount = 0;
 
-    genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+    sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
 }
 
 /** 
@@ -334,21 +357,27 @@
             {
                 if(TI_TRUE == pSme->bRunning)
                 {
-                    genSM_Event (pSme->hSmeSm, SME_SM_EVENT_START, hSme);
+                    sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_START, hSme);
                 }
             }
             else
             {
-                genSM_Event (pSme->hSmeSm, SME_SM_EVENT_STOP, hSme);
+                sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_STOP, hSme);
             }
         }
         break;
 
     case SME_DESIRED_SSID_PARAM:
+
+        if (pParam->content.smeDesiredSSID.len > MAX_SSID_LEN)
+        {
+            return PARAM_VALUE_NOT_VALID;   /* SSID length is out of range */
+        }
+
         /* if new value is different than current one */
         if ((pSme->tSsid.len != pParam->content.smeDesiredSSID.len) || 
-            (0 != os_memoryCompare (pSme->hOS, &(pSme->tSsid.str[ 0 ]),
-                                    &(pParam->content.smeDesiredSSID.str[ 0 ]), pSme->tSsid.len)))
+            (0 != os_memoryCompare (pSme->hOS, (TI_UINT8 *)&(pSme->tSsid.str[ 0 ]),
+                                    (TI_UINT8 *)&(pParam->content.smeDesiredSSID.str[ 0 ]), pSme->tSsid.len)))
         {
             /* set new desired SSID */
             os_memoryCopy (pSme->hOS, &(pSme->tSsid.str[ 0 ]), &(pParam->content.smeDesiredSSID.str[ 0 ]), pParam->content.smeDesiredSSID.len);
@@ -357,23 +386,23 @@
             pSme->uScanCount = 0;
 
             /* now send a disconnect event */
-            genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+            sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
         }
         break;
 
     case SME_DESIRED_SSID_ACT_PARAM:
+
         if (pParam->content.smeDesiredSSID.len > MAX_SSID_LEN)
         {
-            /* printk("SSID length(%d) is out of range. Discard it.\n", pParam->content.smeDesiredSSID.len);*/
-            return PARAM_VALUE_NOT_VALID; /* ssid length is out of range */
+            return PARAM_VALUE_NOT_VALID;   /* SSID length is out of range */
         }
 
         pSme->bRadioOn = TI_TRUE;
 
         /* if new value is different than current one */
         if ((pSme->tSsid.len != pParam->content.smeDesiredSSID.len) || 
-            (0 != os_memoryCompare (pSme->hOS, &(pSme->tSsid.str[ 0 ]),
-                                    &(pParam->content.smeDesiredSSID.str[ 0 ]), pSme->tSsid.len)))
+            (0 != os_memoryCompare (pSme->hOS, (TI_UINT8 *)&(pSme->tSsid.str[ 0 ]),
+                                    (TI_UINT8 *)&(pParam->content.smeDesiredSSID.str[ 0 ]), pSme->tSsid.len)))
         {
             /* set new desired SSID */
             os_memoryCopy (pSme->hOS, &(pSme->tSsid.str[ 0 ]), &(pParam->content.smeDesiredSSID.str[ 0 ]), pParam->content.smeDesiredSSID.len);
@@ -403,11 +432,8 @@
             pSme->bConstantScan = TI_FALSE;
         }
 
-        /* printk("SME_DESIRED_SSID_ACT_PARAM: bRadioOn = %d, bRunning = %d\n", pSme->bRadioOn, pSme->bRunning); */
-        pSme->bRunning = TI_TRUE; /* set it to TRUE in case it's accidentally altered. */
-
         /* now send a disconnect event */
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
         break;
 
     case SME_DESIRED_BSSID_PARAM:
@@ -417,8 +443,8 @@
             /* set new BSSID */
             MAC_COPY (pSme->tBssid, pParam->content.smeDesiredBSSID);
             pSme->uScanCount = 0;
-        /* now send a disconnect event */
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+            /* now send a disconnect event */
+            sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
         }
         break;
 
@@ -429,8 +455,16 @@
             /* set new connection mode */
             pSme->eConnectMode = pParam->content.smeConnectionMode;
             pSme->uScanCount = 0;
+            if (CONNECT_MODE_AUTO == pSme->eConnectMode)
+            {
+                pSme->hScanResultTable = pSme->hSmeScanResultTable;
+            }
+            else if (CONNECT_MODE_MANUAL == pSme->eConnectMode) 
+            {
+                pSme->hScanResultTable = pSme->hScanCncnScanResulTable;
+            }
         /* now send a disconnect event */
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
         }
         break;
 
@@ -442,7 +476,7 @@
             pSme->eBssType = pParam->content.smeDesiredBSSType;
             pSme->uScanCount = 0;
             /* now send a disconnect event */
-            genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+            sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
         }
         break;
 
@@ -453,7 +487,7 @@
          pSme->bConstantScan = TI_TRUE;
          pSme->uScanCount = 0;
          /* now send a disconnect event */
-         genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+         sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
         }
         else
         {
@@ -580,8 +614,8 @@
             {
 #ifndef XCC_MODULE_INCLUDED
                 if ((pSme->tSsid.len == pFrameInfo->parsedIEs->content.iePacket.pSsid->hdr[ 1 ]) &&
-                    (0 == os_memoryCompare (pSme->hOS, &(pSme->tSsid.str[ 0 ]),
-                                            &(pFrameInfo->parsedIEs->content.iePacket.pSsid->serviceSetId[ 0 ]),
+                    (0 == os_memoryCompare (pSme->hOS, (TI_UINT8 *)&(pSme->tSsid.str[ 0 ]),
+                                            (TI_UINT8 *)&(pFrameInfo->parsedIEs->content.iePacket.pSsid->serviceSetId[ 0 ]),
                                             pSme->tSsid.len)))
 #endif
                 {
@@ -602,7 +636,7 @@
         else
         /* manual mode */
         {
-            if (TI_OK != scanResultTable_UpdateEntry (pSme->hScanResultTable, pFrameInfo->bssId, pFrameInfo))
+            if (TI_OK != scanResultTable_UpdateEntry (pSme->hSmeScanResultTable, pFrameInfo->bssId, pFrameInfo))
             {
                 TRACE6(pSme->hReport, REPORT_SEVERITY_ERROR , "sme_ScanResultCB: unable to update application scan entry for BSSID %02x:%02x:%02x:%02x:%02x:%02x\n", (*pFrameInfo->bssId)[ 0 ], (*pFrameInfo->bssId)[ 1 ], (*pFrameInfo->bssId)[ 2 ], (*pFrameInfo->bssId)[ 3 ], (*pFrameInfo->bssId)[ 4 ], (*pFrameInfo->bssId)[ 5 ]);
             }
@@ -635,7 +669,7 @@
                {
                    TRACE0(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_ScanResultCB: No candidate available, sending connect failure\n");
 
-                   genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+                   sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
                    break;
                }
 
@@ -668,7 +702,7 @@
                    {
                        TRACE0(pSme->hReport, REPORT_SEVERITY_INFORMATION , "IBSS SELECT FAILURE  - No channel !!!\n\n");
 
-                       genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+                       sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
 
                        break;
                    }
@@ -679,7 +713,7 @@
                    {
                        TRACE0(pSme->hReport, REPORT_SEVERITY_ERROR , "IBSS SELECT FAILURE  - could not open self site !!!\n\n");
 
-                       genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+                       sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
 
                        break;
                    }
@@ -692,7 +726,7 @@
            }
 
            /* a connection candidate is available, send a connect event */
-           genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
+           sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
         }
         break;        
 
@@ -702,7 +736,7 @@
      */
     case SCAN_CRS_SCAN_STOPPED:
         TRACE0(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_ScanResultCB: received scan stopped indication\n");
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
         break;
 
     default:
@@ -712,61 +746,6 @@
 }
 
 /** 
- * \fn     sme_AppScanResult
- * \brief  Callback function from scan concentrator app for results and scan complete indications
- * 
- * Callback function from scan concentrator app for results and scan complete indications, used
- * for scans wehen the SME is in manual.
- * 
- * \param  hSme - handle to the SME object
- * \param  eStatus - the reason for calling the CB  
- * \param  pFrameInfo - frame information (if the CB is called due to received frame)
- * \param  uResultCount - number of results rceived
- * \return None
- */ 
-void sme_AppScanResult (TI_HANDLE hSme, EScanCncnResultStatus eStatus,
-                        TScanFrameInfo* pFrameInfo)
-{
-    TSme                *pSme = (TSme*)hSme;
-
-    /* in manual mode, store the frame in the SME scan result table */
-    if (CONNECT_MODE_MANUAL == pSme->eConnectMode)
-    { 
-        switch (eStatus)
-        {
-        /* a frame was received - update the scan result table */
-        case SCAN_CRS_RECEIVED_FRAME:
-            TRACE6(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_AppScanResult: received frame from BSSID %02x:%02x:%02x:%02x:%02x:%02x\n", (*pFrameInfo->bssId)[ 0 ], (*pFrameInfo->bssId)[ 1 ], (*pFrameInfo->bssId)[ 2 ], (*pFrameInfo->bssId)[ 3 ], (*pFrameInfo->bssId)[ 4 ], (*pFrameInfo->bssId)[ 5 ]);
-    
-            if (TI_OK != scanResultTable_UpdateEntry (pSme->hScanResultTable, pFrameInfo->bssId, pFrameInfo))
-            {
-                TRACE6(pSme->hReport, REPORT_SEVERITY_ERROR , "sme_AppScanResult: unable to update entry for BSSID %02x:%02x:%02x:%02x:%02x:%02x because table is full\n", (*pFrameInfo->bssId)[ 0 ], (*pFrameInfo->bssId)[ 1 ], (*pFrameInfo->bssId)[ 2 ], (*pFrameInfo->bssId)[ 3 ], (*pFrameInfo->bssId)[ 4 ], (*pFrameInfo->bssId)[ 5 ]);
-            }
-            break;
-    
-        /* scan was completed successfully */
-        case SCAN_CRS_SCAN_COMPLETE_OK:
-        /* an error occured, try selecting a site anyway */
-        case SCAN_CRS_SCAN_ABORTED_FW_RESET:
-        case SCAN_CRS_SCAN_STOPPED:
-        case SCAN_CRS_SCAN_ABORTED_HIGHER_PRIORITY:
-        case SCAN_CRS_SCAN_FAILED:
-        case SCAN_CRS_TSF_ERROR:
-            TRACE1(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_AppScanResult: received scan complete indication with status %d\n", eStatus);
-    
-            /* stablizie the scan result table - delete its contenst if no results were recived during last scan */
-            scanResultTable_SetStableState (pSme->hScanResultTable);
-            break;
-
-        default:
-            TRACE1(pSme->hReport, REPORT_SEVERITY_ERROR , "sme_AppScanResult: received unrecognized status %d\n", eStatus);
-            break;
-        }
-    }
-}
-
-
-/** 
  * \fn     sme_MeansurementScanResult
  * \brief  Callback function from Meansurement for results
  * 
@@ -786,7 +765,7 @@
     case SCAN_CRS_RECEIVED_FRAME:
         TRACE6(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_MeansurementScanResult: received frame from BSSID %02x:%02x:%02x:%02x:%02x:%02x\n", (*pFrameInfo->bssId)[ 0 ], (*pFrameInfo->bssId)[ 1 ], (*pFrameInfo->bssId)[ 2 ], (*pFrameInfo->bssId)[ 3 ], (*pFrameInfo->bssId)[ 4 ], (*pFrameInfo->bssId)[ 5 ]);
     
-        if (TI_OK != scanResultTable_UpdateEntry (pSme->hScanResultTable, pFrameInfo->bssId, pFrameInfo))
+        if (TI_OK != scanResultTable_UpdateEntry (pSme->hSmeScanResultTable, pFrameInfo->bssId, pFrameInfo))
         {
             TRACE6(pSme->hReport, REPORT_SEVERITY_ERROR , "sme_MeansurementScanResult: unable to update entry for BSSID %02x:%02x:%02x:%02x:%02x:%02x because table is full\n", (*pFrameInfo->bssId)[ 0 ], (*pFrameInfo->bssId)[ 1 ], (*pFrameInfo->bssId)[ 2 ], (*pFrameInfo->bssId)[ 3 ], (*pFrameInfo->bssId)[ 4 ], (*pFrameInfo->bssId)[ 5 ]);
         }
@@ -803,7 +782,7 @@
         TRACE1(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_MeansurementScanResult: received scan complete indication with status %d\n", eStatus);
 
         /* stablizie the scan result table - delete its contenst if no results were recived during last scan */
-        scanResultTable_SetStableState (pSme->hScanResultTable);
+        scanResultTable_SetStableState (pSme->hSmeScanResultTable);
         break;
 
     default:
@@ -838,7 +817,7 @@
     /* connection was successful */
     case STATUS_SUCCESSFUL:
         pSme->bAuthSent = TI_TRUE;
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_SUCCESS, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_SUCCESS, hSme);
         break;
 
     case STATUS_ASSOC_REJECT:
@@ -859,11 +838,11 @@
         /* if the next connection candidate exists */
         if (NULL != pSme->pCandidate)
         {
-            genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
+            sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
         }
         else
         {
-            genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+            sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
         }
         break;
 
@@ -872,7 +851,7 @@
         /* we use this status at SME, if != 0 means that assoc frame sent */
     case STATUS_UNSPECIFIED:
             pSme->bAuthSent = TI_TRUE;
-            genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
         break;
 
     default:
@@ -907,7 +886,7 @@
     case STATUS_SG_RESELECT:
         pSme->bReselect = TI_TRUE;
         pSme->bConnectRequired = TI_TRUE;
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
         break;
 
     /* shouldn't happen (not from AP conn) */
@@ -926,11 +905,11 @@
         /* keep the disassociation status and code, for sending event to user-mode */
         pSme->tDisAssoc.eMgmtStatus = eStatusType;
         pSme->tDisAssoc.uStatusCode = uStatusCode;
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
         break;
 
     case STATUS_DISCONNECT_DURING_CONNECT:
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
         break;
 
     default:
@@ -940,15 +919,14 @@
 }
 
 /** 
- * \fn     sme_GetSmeScanResultTableHandler
- * \brief  get the handler to the Sme Scan Result Table.
+ * \fn     sme_ConnectScanReport
+ * \brief  get the handler to the Scan Result Table used for connection to AP.
  * 
  * \param  hSme - handle to the SME object
  * \param  uStatus code - extended status information (if available)
  * \return None
- * \sa     sme_ReportConnStatus
  */
-void sme_GetSmeScanResultTableHandler (TI_HANDLE hSme, TI_HANDLE *hScanResultTable)
+void sme_ConnectScanReport (TI_HANDLE hSme, TI_HANDLE *hScanResultTable)
 {
     TSme                *pSme = (TSme*)hSme;
 
@@ -956,6 +934,22 @@
 }
 
 /** 
+ * \fn     sme_MeasureScanReport
+ * \brief  get the handler to the Sme Scan Result Table.
+ * 
+ * \param  hSme - handle to the SME object
+ * \param  uStatus code - extended status information (if available)
+ * \return None
+ */
+void sme_MeasureScanReport (TI_HANDLE hSme, TI_HANDLE *hScanResultTable)
+{
+    TSme                *pSme = (TSme*)hSme;
+
+    *hScanResultTable = pSme->hSmeScanResultTable;
+}
+
+
+/** 
  * \fn     SME_ConnectRequired
  * \brief  start connection sequence by set the flag ConnectRequired and issue DISCONNECT event.
  *         called by CommandDispatcher in OSE OS.
@@ -973,7 +967,7 @@
     pSme->bConnectRequired = TI_TRUE;
 
     /* now send a disconnect event */
-    genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+    sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
 }
 
 /** 
@@ -993,5 +987,14 @@
     pSme->bConstantScan = TI_FALSE;
 
     /* now send a disconnect event */
-    genSM_Event (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+    sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_DISCONNECT, hSme);
+}
+
+void sme_SmEvent(TI_HANDLE hGenSm, TI_UINT32 uEvent, void* pData)
+{
+    TSme *pSme = (TSme*)pData;
+    TGenSM    *pGenSM = (TGenSM*)hGenSm;
+
+    TRACE2(pSme->hReport, REPORT_SEVERITY_INFORMATION, "sme_SmEvent: Current State = %d, sending event %d\n", (pGenSM->uCurrentState), (uEvent));
+    genSM_Event(pGenSM, uEvent, pData);
 }
diff --git a/wl1271/stad/src/Connection_Managment/sme.h b/wl1271/stad/src/Connection_Managment/sme.h
index 73391a6..327ca92 100644
--- a/wl1271/stad/src/Connection_Managment/sme.h
+++ b/wl1271/stad/src/Connection_Managment/sme.h
@@ -1,7 +1,7 @@
 /*
  * sme.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -46,6 +46,8 @@
 #include "ScanCncn.h"
 #include "paramOut.h"
 
+#define SME_SCAN_TABLE_ENTRIES 32
+
 typedef enum
 {
     SSID_TYPE_ANY = 0,
@@ -73,7 +75,9 @@
 void        sme_MeansurementScanResult (TI_HANDLE hSme, EScanCncnResultStatus eStatus, TScanFrameInfo* pFrameInfo);
 void        sme_ReportConnStatus (TI_HANDLE hSme, mgmtStatus_e eStatusType, TI_UINT32 uStatusCode);
 void        sme_ReportApConnStatus (TI_HANDLE hSme, mgmtStatus_e eStatusType, TI_UINT32 uStatusCode);
-void        sme_GetSmeScanResultTableHandler (TI_HANDLE hSme, TI_HANDLE *hScanResultTable);
+
+void        sme_ConnectScanReport (TI_HANDLE hSme, TI_HANDLE *hScanResultTable);
+void        sme_MeasureScanReport (TI_HANDLE hSme, TI_HANDLE *hScanResultTable);
 
 #endif /* __SME_H__ */
 
diff --git a/wl1271/stad/src/Connection_Managment/smeApi.h b/wl1271/stad/src/Connection_Managment/smeApi.h
index 60f7b34..d22b6f7 100644
--- a/wl1271/stad/src/Connection_Managment/smeApi.h
+++ b/wl1271/stad/src/Connection_Managment/smeApi.h
@@ -1,7 +1,7 @@
 /*
  * smeApi.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -64,5 +64,5 @@
 TI_STATUS   sme_GetParam (TI_HANDLE hSme, paramInfo_t *pParam);
 void        SME_ConnectRequired (TI_HANDLE hSme);
 void        SME_Disconnect (TI_HANDLE hSme);
-void        sme_AppScanResult (TI_HANDLE hSme, EScanCncnResultStatus eStatus,TScanFrameInfo* pFrameInfo);
+void        sme_SetScanResultTable(TI_HANDLE hSme, TI_HANDLE hScanResultTable);
 #endif /* __SME_API_H__ */
diff --git a/wl1271/stad/src/Connection_Managment/smePrivate.h b/wl1271/stad/src/Connection_Managment/smePrivate.h
index 90e8c12..a36973f 100644
--- a/wl1271/stad/src/Connection_Managment/smePrivate.h
+++ b/wl1271/stad/src/Connection_Managment/smePrivate.h
@@ -1,7 +1,7 @@
 /*
  * smePrivate.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -65,7 +65,9 @@
     TI_HANDLE       hEvHandler;
     TI_HANDLE       hSiteMgr;
     TI_HANDLE       hRsn;
-    TI_HANDLE       hScanResultTable;
+    TI_HANDLE       hScanResultTable;          /* Working table - points to one of the next two tables */
+    TI_HANDLE       hSmeScanResultTable;       /* Sme local table */
+    TI_HANDLE       hScanCncnScanResulTable;   /* Scan Cncn table - table used by the application */
     TI_HANDLE       hSmeSm;
     TI_HANDLE       hDrvMain;
     TI_HANDLE       hTwd;
@@ -88,6 +90,7 @@
 
     TI_BOOL         bConstantScan;  /* scan constantly, for WSC PB mode */
     TSiteEntry      *pCandidate;
+	TSiteEntry      tCandidate;     /* used to store the selected entry of sme_Select*/
     TDisAssocReason tDisAssoc;
 
     TSmeInitParams  tInitParams;
diff --git a/wl1271/stad/src/Connection_Managment/smeSelect.c b/wl1271/stad/src/Connection_Managment/smeSelect.c
index 7475889..332d541 100644
--- a/wl1271/stad/src/Connection_Managment/smeSelect.c
+++ b/wl1271/stad/src/Connection_Managment/smeSelect.c
@@ -1,7 +1,7 @@
 /*
  * smeSelect.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -76,6 +76,7 @@
     TI_INT8         iSelectedSiteRssi = -127; /* minimum RSSI */
     TI_BOOL         bWscPbAbort, pWscPbApFound = TI_FALSE;
     int             apFoundCtr =0;
+    TIWLN_SIMPLE_CONFIG_MODE eWscMode;
 
     TRACE0(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_Select called\n");
 
@@ -182,7 +183,10 @@
         }
 
         /* and security match */
-        if (pCurrentSite->WSCSiteMode == TIWLN_SIMPLE_CONFIG_OFF) /* we don't need to check RSN match while WSC is active */
+        siteMgr_getParamWSC(pSme->hSiteMgr, &eWscMode); 
+
+        /* we don't need to check RSN match while WSC is active */
+        if ((pCurrentSite->WSCSiteMode == TIWLN_SIMPLE_CONFIG_OFF) || (pCurrentSite->WSCSiteMode != eWscMode))
         {
             if (TI_FALSE == sme_SelectRsnMatch (hSme, pCurrentSite))
             /* site doesn't match */
@@ -205,6 +209,16 @@
             pCurrentSite = scanResultTable_GetNext (pSme->hScanResultTable);
             continue;
         }
+
+        if (TI_TRUE == pCurrentSite->bChannelSwitchAnnoncIEFound)
+        {
+            TRACE6(pSme->hReport, REPORT_SEVERITY_INFORMATION , "sme_Select: BSSID: %02x:%02x:%02x:%02x:%02x:%02x has channel switch IE so ignore it \n", pCurrentSite->bssid[ 0 ], pCurrentSite->bssid[ 1 ], pCurrentSite->bssid[ 2 ], pCurrentSite->bssid[ 3 ], pCurrentSite->bssid[ 4 ], pCurrentSite->bssid[ 5 ]);
+            pCurrentSite->bConsideredForSelect = TI_TRUE; /* don't try this site again */
+            /* get the next site and continue the loop */
+            pCurrentSite = scanResultTable_GetNext (pSme->hScanResultTable);
+            continue;
+        }
+
         /* if this site RSSI is higher than current maximum, select it */
         if (pCurrentSite->rssi > iSelectedSiteRssi)
         {
@@ -231,10 +245,17 @@
          * copy candidate AP to Site module site Table.
          */
         siteMgr_CopyToPrimarySite(pSme->hSiteMgr, pSelectedSite);
+
+		/* copy the result, rather than returning a pointer to the entry in the scan result table.
+		 * This is done since the table might change durring the connection process, and the pointer 
+		 * will point to the wrong entry in the table, causing connection/disconnection problems */
+		os_memoryCopy(pSme->hOS, &(pSme->tCandidate), pSelectedSite, sizeof(TSiteEntry));
+
+		return &(pSme->tCandidate);
     }
 
-    /* return the selected site (or NULL, if no site was selected) */
-    return pSelectedSite;
+    /* return NULL if no site was selected */
+    return NULL;
 }
 
 /** 
@@ -278,7 +299,7 @@
     }
     /* otherwise, check if the SSIDs match */
     if ((pSiteSsid->len == pDesiredSsid->len) && /* lngth match */
-        (0 == os_memoryCompare (pSme->hOS, &(pSiteSsid->str[ 0 ]), &(pDesiredSsid->str[ 0 ]), pSiteSsid->len))) /* content match */
+        (0 == os_memoryCompare (pSme->hOS, (TI_UINT8 *)&(pSiteSsid->str[ 0 ]), (TI_UINT8 *)&(pDesiredSsid->str[ 0 ]), pSiteSsid->len))) /* content match */
     {
         return TI_TRUE;
     }
diff --git a/wl1271/stad/src/Connection_Managment/smeSm.c b/wl1271/stad/src/Connection_Managment/smeSm.c
index dc673fe..f582c7f 100644
--- a/wl1271/stad/src/Connection_Managment/smeSm.c
+++ b/wl1271/stad/src/Connection_Managment/smeSm.c
@@ -1,7 +1,7 @@
 /*
  * smeSm.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -196,12 +196,12 @@
     if ((TI_FALSE == pSme->bRadioOn) || (TI_FALSE == pSme->bRunning)) 
     {
         /* Radio is off so send stop event */
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_STOP, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_STOP, hSme);
     }
     else if (TI_TRUE == pSme->bConnectRequired)
     {
         /* if connection was required, start the process */
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
     }
 }
 
@@ -255,7 +255,7 @@
     if (NULL != pSme->pCandidate)
     {
         /* candidate is available - attempt connection */
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
     }
     /* no candidate */
     else
@@ -267,7 +267,7 @@
             {
                 TRACE0(pSme->hReport, REPORT_SEVERITY_ERROR , "smeSm_PreConnect: unable to start scan, stopping the SME\n");
                 pSme->bRadioOn = TI_FALSE;
-                genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+                sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
             }
 
             /* update scan count counter */
@@ -287,7 +287,7 @@
 
 				TRACE0(pSme->hReport, REPORT_SEVERITY_INFORMATION , "smeSm_PreConnect: No candidate available, sending connect failure\n");
                 /* manual mode and no connection candidate is available - connection failed */
-                genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+                sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
 			}
 
 			else		/* IBSS */
@@ -331,7 +331,7 @@
 				{
 				   TRACE0(pSme->hReport, REPORT_SEVERITY_INFORMATION , "IBSS SELECT FAILURE  - No channel !!!\n\n");
 
-				   genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+				   sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
 
 				   return;
 				}
@@ -342,7 +342,7 @@
 				{
 				   TRACE0(pSme->hReport, REPORT_SEVERITY_ERROR , "IBSS SELECT FAILURE  - could not open self site !!!\n\n");
 
-				   genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+				   sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
 
 				   return;
 				}
@@ -352,7 +352,7 @@
                 WLAN_OS_REPORT (("%%%%%%%%%%%%%%	SELF SELECT SUCCESS, bssid: %02x.%02x.%02x.%02x.%02x.%02x %%%%%%%%%%%%%%\n\n", pSme->pCandidate->bssid[0], pSme->pCandidate->bssid[1], pSme->pCandidate->bssid[2], pSme->pCandidate->bssid[3], pSme->pCandidate->bssid[4], pSme->pCandidate->bssid[5]));
 #endif
 				/* a connection candidate is available, send a connect event */
-				genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
+				sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT, hSme);
 			}
         }
     }
@@ -378,7 +378,7 @@
     if (NULL == pSme->pCandidate)
     {
         TRACE0(pSme->hReport, REPORT_SEVERITY_ERROR , "smeSm_Connect: No candidate available, sending connect failure\n");
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_CONNECT_FAILURE, hSme);
     }
     else
     {
@@ -620,7 +620,7 @@
     if ((TI_TRUE == pSme->bRunning) && (TI_TRUE == pSme->bRadioOn))
     {
         /* send a start event */
-        genSM_Event (pSme->hSmeSm, SME_SM_EVENT_START, hSme);
+        sme_SmEvent (pSme->hSmeSm, SME_SM_EVENT_START, hSme);
     }
 }
 
@@ -667,7 +667,7 @@
     /* get country validity for all bands */
     for (uIndex = 0; uIndex < RADIO_BAND_NUM_OF_BANDS; uIndex++)
     {
-        pParam->content.eRadioBand = uIndex;
+        pParam->content.eRadioBand = (ERadioBand)uIndex;
         regulatoryDomain_getParam (pSme->hRegDomain, pParam);
         bBandCountryFound[ uIndex ] = pParam->content.bIsCountryFound;
         /* also nullify the channel exist indication for this band */
diff --git a/wl1271/stad/src/Connection_Managment/smeSm.h b/wl1271/stad/src/Connection_Managment/smeSm.h
index 7c8b68f..8ab0a16 100644
--- a/wl1271/stad/src/Connection_Managment/smeSm.h
+++ b/wl1271/stad/src/Connection_Managment/smeSm.h
@@ -1,7 +1,7 @@
 /*
  * smeSm.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -42,6 +42,8 @@
 
 #include "GenSM.h"
 
+void sme_SmEvent(TI_HANDLE hGenSm, TI_UINT32 uEvent, void* pData);
+
 typedef enum
 {
     SME_SM_STATE_IDLE = 0,
diff --git a/wl1271/stad/src/Ctrl_Interface/DrvMain.c b/wl1271/stad/src/Ctrl_Interface/DrvMain.c
index 6dc69a6..a19af48 100644
--- a/wl1271/stad/src/Ctrl_Interface/DrvMain.c
+++ b/wl1271/stad/src/Ctrl_Interface/DrvMain.c
@@ -1,7 +1,7 @@
 /*
  * DrvMain.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -82,6 +82,8 @@
 
 #define SDIO_CONNECT_THRESHOLD  8
 
+/* This is used to prevent endless recovery loops */
+#define MAX_NUM_OF_RECOVERY_TRIGGERS 5
 
 /* Handle failure status from the SM callbacks by triggering the SM with FAILURE event */
 #define HANDLE_CALLBACKS_FAILURE_STATUS(hDrvMain, eStatus)      \
@@ -129,9 +131,10 @@
 typedef struct
 {
     TStadHandlesList  tStadHandles; /* All STAD modules handles (distributed in driver init process) */
-    TI_BOOL           bRecovery;    /* Indicates if we are during recovery process */
-    ESmState          eSmState;     /* The DrvMain SM state. */
-    ESmEvent          ePendingEvent;/* A pending event issued when the SM is busy */
+	TI_BOOL           bRecovery;    /* Indicates if we are during recovery process */
+	TI_UINT32         uNumOfRecoveryAttempts;    /* Indicates if we are during recovery process */
+	ESmState          eSmState;     /* The DrvMain SM state. */
+	ESmEvent          ePendingEvent;/* A pending event issued when the SM is busy */
     TI_UINT32         uPendingEventsCount; /* Counts the number of events pending for SM execution */
     TFileInfo         tFileInfo;    /* Information of last file retrieved by os_GetFile() */
     TI_UINT32         uContextId;   /* ID allocated to this module on registration to context module */
@@ -1036,8 +1039,9 @@
     pDrvMain->tFileInfo.hCbHndl     = (TI_HANDLE)pDrvMain;
     pDrvMain->eSmState              = SM_STATE_IDLE;
     pDrvMain->uPendingEventsCount   = 0;
-    pDrvMain->bRecovery             = TI_FALSE; 
-    pDrvMain->eAction               = ACTION_TYPE_NONE; 
+	pDrvMain->bRecovery             = TI_FALSE; 
+	pDrvMain->uNumOfRecoveryAttempts = 0;
+	pDrvMain->eAction               = ACTION_TYPE_NONE; 
 
     /* Register the Action callback to the context engine and get the client ID */
     pDrvMain->uContextId = context_RegisterClient (pDrvMain->tStadHandles.hContext,
@@ -1228,7 +1232,7 @@
         context_LeaveCriticalSection(pDrvMain->tStadHandles.hContext);
         TRACE0(pDrvMain->tStadHandles.hReport, REPORT_SEVERITY_CONSOLE, "Action is identical to last action!\n");
         WLAN_OS_REPORT(("Action %d is identical to last action!\n", eAction));
-        return TI_NOK;
+        return TI_OK;
     }
 
     /* Save the requested action */
@@ -1282,6 +1286,7 @@
 {
     TDrvMain         *pDrvMain = (TDrvMain *) hDrvMain;
 
+	pDrvMain->uNumOfRecoveryAttempts++;
     if (!pDrvMain->bRecovery)
     {
         TRACE1(pDrvMain->tStadHandles.hReport, REPORT_SEVERITY_CONSOLE,".....drvMain_Recovery, ts=%d\n", os_timeStampMs(pDrvMain->tStadHandles.hOs));
@@ -1297,6 +1302,9 @@
     else
     {
         TRACE0(pDrvMain->tStadHandles.hReport, REPORT_SEVERITY_ERROR, "drvMain_Recovery: ****  Recovery already in progress!  ****\n");
+
+		/* nesting recoveries... Try again */
+		drvMain_SmEvent (hDrvMain, SM_EVENT_RECOVERY);
         return TI_NOK;
     }
 }
@@ -1598,6 +1606,7 @@
             pDrvMain->eSmState = SM_STATE_OPERATIONAL;
             if (pDrvMain->bRecovery) 
             {
+				pDrvMain->uNumOfRecoveryAttempts = 0;
                 drvMain_RecoveryNotify (pDrvMain);
                 pDrvMain->bRecovery = TI_FALSE;
             }
@@ -1718,7 +1727,12 @@
         if (!pDrvMain->bRecovery) 
         {
             os_SignalObjectSet (hOs, pDrvMain->hSignalObj);
-        }
+		}
+		else if (pDrvMain->uNumOfRecoveryAttempts < MAX_NUM_OF_RECOVERY_TRIGGERS) 
+		{
+			pDrvMain->eSmState = SM_STATE_STOPPING;
+			eStatus = drvMain_StopActivities (pDrvMain);
+		}
         break;
     case SM_STATE_FAILED:
         /* Nothing to do except waiting for Destroy */
diff --git a/wl1271/stad/src/Ctrl_Interface/EvHandler.c b/wl1271/stad/src/Ctrl_Interface/EvHandler.c
index 99205b4..91b594d 100644
--- a/wl1271/stad/src/Ctrl_Interface/EvHandler.c
+++ b/wl1271/stad/src/Ctrl_Interface/EvHandler.c
@@ -1,7 +1,7 @@
 /*
  * EvHandler.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -55,6 +55,13 @@
 
     PRINT(DBG_INIT_LOUD, (" EvHandlerInit\n"));
     pEvHandler = os_memoryAlloc(hOs,sizeof(TEvHandlerObj));
+
+    if(NULL == pEvHandler)
+    {
+        PRINT(DBG_INIT_LOUD, ("EvHandler_Create() - Allocation failed! Returning NULL.\n"));
+        return NULL;
+    }
+
     os_memoryZero(hOs,pEvHandler,sizeof(TEvHandlerObj));
 
     #ifdef EV_HANDLER_DEBUG
diff --git a/wl1271/stad/src/Data_link/Ctrl.c b/wl1271/stad/src/Data_link/Ctrl.c
index 876d6d2..6e04ede 100644
--- a/wl1271/stad/src/Data_link/Ctrl.c
+++ b/wl1271/stad/src/Data_link/Ctrl.c
@@ -1,7 +1,7 @@
 /*
  * Ctrl.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -1074,15 +1074,9 @@
 static void ctrlData_storeTSRateSet(ctrlData_t *pCtrlData, TTxDataQosParams *tsrsParams)
 {
     TI_UINT32 rateCount;
-    TI_UINT32 acID, rateID;
+    TI_UINT32 acID;
     TI_UINT32 tsrsRequestedMap;
     ERate rateNumber;
-    ETxRateClassId  rate_e_to_txRateClassId_e[DRV_RATE_MAX + 1] = 
-    {
-        txPolicy1,  txPolicy1, txPolicy2, txPolicy5_5, txPolicy11,
-        txPolicy22, txPolicy6, txPolicy9, txPolicy12,  txPolicy18,
-        txPolicy24, txPolicy36, txPolicy48, txPolicy54
-    };
 
     acID = tsrsParams->acID;
     os_memoryZero(pCtrlData->hOs, 
@@ -1097,7 +1091,6 @@
         /* Convert multiplication of 500kb/sec to ERate and then to ETxRateClassId */
         /* and update retransmission map in accordance to rate definitions */
         rateNumber = rate_NumberToDrv ((tsrsParams->tsrsArr[rateCount] & 0x7F) >> 1);
-        rateID = rate_e_to_txRateClassId_e[rateNumber];
 
         pCtrlData->tsrsParameters[acID].policyClassRateMask = pCtrlData->uCurrPolicyEnabledRatesMask;
 
diff --git a/wl1271/stad/src/Data_link/rx.c b/wl1271/stad/src/Data_link/rx.c
index 9b5a4ab..504387a 100644
--- a/wl1271/stad/src/Data_link/rx.c
+++ b/wl1271/stad/src/Data_link/rx.c
@@ -1,7 +1,7 @@
 /*
  * rx.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -966,7 +966,7 @@
         /* distribute mgmt pBuffer to mlme */
         if( mlmeParser_recv(pRxData->hMlme, pBuffer, pRxAttr) != TI_OK )
         {
-            TRACE0(pRxData->hReport, REPORT_SEVERITY_WARNING, " rxData_receivePacketFromWlan() : MLME returned error \n");
+            TRACE0(pRxData->hReport, REPORT_SEVERITY_ERROR, " rxData_receivePacketFromWlan() : MLME returned error \n");
         }
         break;
 
@@ -985,7 +985,7 @@
         }
 
     default:
-        TRACE0(pRxData->hReport, REPORT_SEVERITY_WARNING, " rxData_receivePacketFromWlan(): Received unspecified packet type !!! \n");
+        TRACE0(pRxData->hReport, REPORT_SEVERITY_ERROR, " rxData_receivePacketFromWlan(): Received unspecified packet type !!! \n");
         RxBufFree(pRxData->hOs, pBuffer); 
         break;
     }
@@ -1176,7 +1176,7 @@
 {
     rxData_t *pRxData = (rxData_t *)hRxData;
 
-    TRACE0(pRxData->hReport, REPORT_SEVERITY_WARNING, " rxData_rcvPacketInOpenNotify: receiving data packet while in rx port status is open notify\n");
+    TRACE0(pRxData->hReport, REPORT_SEVERITY_ERROR, " rxData_rcvPacketInOpenNotify: receiving data packet while in rx port status is open notify\n");
 
     pRxData->rxDataDbgCounters.rcvUnicastFrameInOpenNotify++;
 
@@ -1719,7 +1719,7 @@
 
         TRACE0(pRxData->hReport, REPORT_SEVERITY_INFORMATION , "Receive good Packet\n");
         
-        if (rate_PolicyToDrv (pRxParams->rate, &appRate) != TI_OK)
+        if (rate_PolicyToDrv ((ETxRateClassId)(pRxParams->rate), &appRate) != TI_OK)
         {
             TRACE1(pRxData->hReport, REPORT_SEVERITY_ERROR , "rxData_ReceivePacket: can't convert hwRate=0x%x\n", pRxParams->rate);
         }
@@ -1737,7 +1737,7 @@
         /* for now J band not implemented */
         RxAttr.band       = ((pRxParams->flags & RX_DESC_BAND_MASK) == RX_DESC_BAND_A) ? 
                             RADIO_BAND_5_0_GHZ : RADIO_BAND_2_4_GHZ ;
-        RxAttr.eScanTag   = pRxParams->proccess_id_tag;
+        RxAttr.eScanTag   = (EScanResultTag)(pRxParams->proccess_id_tag);
         /* timestamp is 32 bit so do bytes copy to avoid exception in case the RxInfo is in 2 bytes offset */
         os_memoryCopy (pRxData->hOs,
                        (void *)&(RxAttr.TimeStamp), 
diff --git a/wl1271/stad/src/Data_link/txCtrl.c b/wl1271/stad/src/Data_link/txCtrl.c
index ae45342..22977cd 100644
--- a/wl1271/stad/src/Data_link/txCtrl.c
+++ b/wl1271/stad/src/Data_link/txCtrl.c
@@ -1,7 +1,7 @@
 /*
  * txCtrl.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -1044,7 +1044,7 @@
 	for (tid = 0; tid < MAX_NUM_OF_802_1d_TAGS; tid++)
 	{
 		/* Find the AC that is used for transmitting this TID. */
-		inputAc = WMEQosTagToACTable[tid];					/* Standard translation from TID to AC. */
+		inputAc = (EAcTrfcType)WMEQosTagToACTable[tid];					/* Standard translation from TID to AC. */
 		admittedAc = pTxCtrl->highestAdmittedAc[inputAc];	/* The actual AC that is used for Tx. */
 
 		/* Set the bit related to the TID in the correlated AC. */
@@ -1255,8 +1255,8 @@
         else 
         {
             /* Save last data Tx rate for applications' query */
-            EHwBitRate eHwTxRate = ENDIAN_HANDLE_LONG(pTxResultInfo->rate); 
-            rate_PolicyToDrv ((TI_UINT32)eHwTxRate, &pTxCtrl->eCurrentTxRate);
+            EHwBitRate eHwTxRate = ENDIAN_HANDLE_LONG((EHwBitRate)(pTxResultInfo->rate)); 
+            rate_PolicyToDrv (eHwTxRate, &pTxCtrl->eCurrentTxRate);
 
             /* Directed frame statistics */
             pTxCtrl->txDataCounters[ac].DirectedFramesXmit++;
diff --git a/wl1271/stad/src/Data_link/txCtrlParams.c b/wl1271/stad/src/Data_link/txCtrlParams.c
index cb9c1e4..9fdee31 100644
--- a/wl1271/stad/src/Data_link/txCtrlParams.c
+++ b/wl1271/stad/src/Data_link/txCtrlParams.c
@@ -1,7 +1,7 @@
 /*
  * txCtrlParams.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -235,13 +235,12 @@
 ****************************************************************************/
 TI_STATUS txCtrlParams_UnRegNotif(TI_HANDLE hTxCtrl, TI_HANDLE RegEventHandle)
 {
-    TI_STATUS status;
     txCtrl_t *pTxCtrl = (txCtrl_t *)hTxCtrl;
 
     if (!hTxCtrl)
         return TI_NOK;
 
-    return (status = DistributorMgr_UnReg(pTxCtrl->TxEventDistributor,RegEventHandle));
+    return (DistributorMgr_UnReg(pTxCtrl->TxEventDistributor,RegEventHandle));
 }
 
 
@@ -377,7 +376,6 @@
     default:
         TRACE0(pTxCtrl->hReport, REPORT_SEVERITY_ERROR, ": PARAMETER NOT SUPPORTED\n");
         return PARAM_NOT_SUPPORTED;
-        break;
     }
 
     return TI_OK;
diff --git a/wl1271/stad/src/Data_link/txDataQueue.c b/wl1271/stad/src/Data_link/txDataQueue.c
index 127f8ca..ac5ef43 100644
--- a/wl1271/stad/src/Data_link/txDataQueue.c
+++ b/wl1271/stad/src/Data_link/txDataQueue.c
@@ -1,7 +1,7 @@
 /*
  * txDataQueue.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
diff --git a/wl1271/stad/src/Data_link/txPort.c b/wl1271/stad/src/Data_link/txPort.c
index f6595e4..eeba41f 100644
--- a/wl1271/stad/src/Data_link/txPort.c
+++ b/wl1271/stad/src/Data_link/txPort.c
@@ -1,7 +1,7 @@
 /*
  * txPort.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -85,12 +85,6 @@
  * The txPort local functions:
  */
 static void updateQueuesStates(TTxPortObj *pTxPort);
-#ifdef TI_DBG
-static char *txPortMuxStateNameStr(EQueuesMuxState queuesMuxState);
-static char *txPortActionNameStr(EQueueAction queueAction);
-#endif
-
-
 
 /****************************************************************************
  *                      txPort_Create()
@@ -235,10 +229,6 @@
 {
 	EQueueAction mgmtQueueAction = QUEUE_ACTION_NONE;
 	EQueueAction dataQueueAction = QUEUE_ACTION_NONE;
-#ifdef TI_DBG
-	char *pMuxStateNameStr;
-	char *pPortActionNameStr;
-#endif
 
 	/* 
 	 * If the Tx path is not suspended:
@@ -278,10 +268,8 @@
 
 
 #ifdef TI_DBG
-	pMuxStateNameStr = txPortMuxStateNameStr(pTxPort->queuesMuxState);
 	TRACE1(pTxPort->hReport, REPORT_SEVERITY_INFORMATION, ":  queuesMuxState = , TxSuspend = %d\n", pTxPort->txSuspended);
 		
-	pPortActionNameStr = txPortActionNameStr (mgmtQueueAction);
 	TRACE2(pTxPort->hReport, REPORT_SEVERITY_INFORMATION, ":  PrevMgmtEnabled = %d,  PrevDataEnabled = %d, MgmtAction = , DataAction = \n", pTxPort->mgmtQueueEnabled, pTxPort->dataQueueEnabled);
 #endif /* TI_DBG */
 
@@ -312,35 +300,3 @@
 	}
 }
 
-
-
-#ifdef TI_DBG
-
-/****************************************************************************
- *	Debug functions:	txPortMuxStateNameStr()
- *                      txPortActionNameStr()
- ****************************************************************************/ 
-static char *txPortMuxStateNameStr(EQueuesMuxState queuesMuxState)
-{
-	switch (queuesMuxState)
-	{
-		case MUX_MGMT_QUEUES:	return "MUX_MGMT_QUEUES";
-		case MUX_DATA_QUEUES:	return "MUX_DATA_QUEUES";
-		default:				return "UNKNOWN STATE";
-	}
-}
-
-static char *txPortActionNameStr(EQueueAction queueAction)
-{
-	switch (queueAction)
-	{
-		case QUEUE_ACTION_NONE:	return "QUEUE_ACTION_NONE";
-		case QUEUE_ACTION_STOP:	return "QUEUE_ACTION_STOP";
-		case QUEUE_ACTION_WAKE:	return "QUEUE_ACTION_WAKE";
-		default:				return "UNKNOWN ACTION";
-	}
-} 
-		
-#endif /* TI_DBG */
-
-
diff --git a/wl1271/stad/src/Sta_Management/PowerMgr.c b/wl1271/stad/src/Sta_Management/PowerMgr.c
index 4fb21e4..117820c 100644
--- a/wl1271/stad/src/Sta_Management/PowerMgr.c
+++ b/wl1271/stad/src/Sta_Management/PowerMgr.c
@@ -1,7 +1,7 @@
 /*
  * PowerMgr.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -720,7 +720,6 @@
     case POWER_MGR_KEEP_ALIVE_ENA_DIS:
     case POWER_MGR_KEEP_ALIVE_ADD_REM:
         return powerMgrKL_setParam (pPowerMgr->hPowerMgrKeepAlive, theParamP);
-        break;
 
     default:
         TRACE1(pPowerMgr->hReport, REPORT_SEVERITY_ERROR, "PowerMgr_setParam - ERROR - Param is not supported, %d\n\n", theParamP->paramType);
@@ -758,7 +757,6 @@
 
     case POWER_MGR_KEEP_ALIVE_GET_CONFIG:
         return powerMgrKL_getParam (pPowerMgr->hPowerMgrKeepAlive, theParamP);
-        break;
 
     case POWER_MGR_GET_POWER_CONSUMPTION_STATISTICS:
        
@@ -769,7 +767,6 @@
 
 
 
-             break;
 
 
     default:
@@ -974,17 +971,16 @@
 static void powerMgrRetryPsTimeout(TI_HANDLE hPowerMgr, TI_BOOL bTwdInitOccured)
 {
     PowerMgr_t *pPowerMgr = (PowerMgr_t*)hPowerMgr;
-    TI_STATUS powerStatus;
 
     TRACE0( pPowerMgr->hReport, REPORT_SEVERITY_INFORMATION, "powerMgrRetryPsTimeout: timer expired.\n");
 
     if ( pPowerMgr->lastPsTransaction == ENTER_POWER_SAVE_FAIL )
     {
-        powerStatus = TWD_SetPsMode (pPowerMgr->hTWD, POWER_SAVE_ON, TI_TRUE, hPowerMgr,powerSaveCompleteCB, NULL);/*NULL as GWSI callback*/
+        TWD_SetPsMode (pPowerMgr->hTWD, POWER_SAVE_ON, TI_TRUE, hPowerMgr,powerSaveCompleteCB, NULL);/*NULL as GWSI callback*/
     }
     else
     {
-        powerStatus = TWD_SetPsMode (pPowerMgr->hTWD, POWER_SAVE_OFF, TI_TRUE, hPowerMgr, powerSaveCompleteCB, NULL);/*NULL as GWSI callback*/
+        TWD_SetPsMode (pPowerMgr->hTWD, POWER_SAVE_OFF, TI_TRUE, hPowerMgr, powerSaveCompleteCB, NULL);/*NULL as GWSI callback*/
     }
 	return;
 }
@@ -1003,7 +999,6 @@
 static void powerMgrPowerProfileConfiguration(TI_HANDLE hPowerMgr, PowerMgr_PowerMode_e desiredPowerMode)
 {
     PowerMgr_t *pPowerMgr = (PowerMgr_t*)hPowerMgr;
-    TI_STATUS powerStatus;
 
     tmr_StopTimer (pPowerMgr->hRetryPsTimer);
 
@@ -1017,7 +1012,7 @@
 
     case POWER_MODE_ACTIVE:
         /* set AWAKE through */
-        powerStatus = TWD_SetPsMode (pPowerMgr->hTWD,
+        TWD_SetPsMode (pPowerMgr->hTWD,
                                           POWER_SAVE_OFF, 
                                           TI_TRUE, 
                                           hPowerMgr,
@@ -1037,7 +1032,7 @@
             powerMgrSendMBXWakeUpConditions(hPowerMgr,pPowerMgr->beaconListenInterval,TNET_WAKE_ON_BEACON);     
         }
 
-        powerStatus = TWD_SetPsMode (pPowerMgr->hTWD, 
+        TWD_SetPsMode (pPowerMgr->hTWD, 
                                           POWER_SAVE_ON, 
                                           TI_TRUE, 
                                           hPowerMgr,
@@ -1056,7 +1051,7 @@
         {
             powerMgrSendMBXWakeUpConditions(hPowerMgr,pPowerMgr->dtimListenInterval,TNET_WAKE_ON_DTIM);     
         }
-        powerStatus = TWD_SetPsMode (pPowerMgr->hTWD, 
+        TWD_SetPsMode (pPowerMgr->hTWD, 
                                           POWER_SAVE_ON, 
                                           TI_TRUE, 
                                           hPowerMgr,
@@ -1070,7 +1065,7 @@
 		/* When in SG PS mode, configure the user desired wake-up condition */
 		powerMgr_SGSetUserDesiredwakeUpCond(pPowerMgr);
 
-        powerStatus = TWD_SetPsMode (pPowerMgr->hTWD, 
+        TWD_SetPsMode (pPowerMgr->hTWD, 
                                           POWER_SAVE_ON, 
                                           TI_TRUE, 
                                           hPowerMgr,
diff --git a/wl1271/stad/src/Sta_Management/ScanCncn.c b/wl1271/stad/src/Sta_Management/ScanCncn.c
index 1081652..b44da4c 100644
--- a/wl1271/stad/src/Sta_Management/ScanCncn.c
+++ b/wl1271/stad/src/Sta_Management/ScanCncn.c
@@ -1,7 +1,7 @@
 /*
  * ScanCncn.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -119,7 +119,7 @@
     }
 
     /* create the app scan result table */
-    pScanCncn->hScanResultTable = scanResultTable_Create (hOS);
+    pScanCncn->hScanResultTable = scanResultTable_Create (hOS, SCAN_CNCN_APP_SCAN_TABLE_ENTRIES);
     if (NULL == pScanCncn->hScanResultTable)
     {
         WLAN_OS_REPORT (("scanCncn_Create: Unable to create application scan result table\n"));
@@ -222,7 +222,7 @@
     scanCncnOsSm_Init ((TI_HANDLE)pScanCncn);
 
     /* initlaize the application scan result table */
-    scanResultTable_Init (pScanCncn->hScanResultTable, pStadHandles);
+    scanResultTable_Init (pScanCncn->hScanResultTable, pStadHandles, SCAN_RESULT_TABLE_DONT_CLEAR);
 }
 
 /** 
@@ -257,17 +257,23 @@
                                 (TI_HANDLE)pScanCncn);
     /* register and enable periodic scan complete event with TWD */
     TWD_RegisterEvent (pScanCncn->hTWD, TWD_OWN_EVENT_PERIODIC_SCAN_COMPLETE,
-                       scanCncn_PeriodicScanCompleteCB, (TI_HANDLE)pScanCncn);
+                       (void *)scanCncn_PeriodicScanCompleteCB, (TI_HANDLE)pScanCncn);
     TWD_EnableEvent (pScanCncn->hTWD, TWD_OWN_EVENT_PERIODIC_SCAN_COMPLETE);
 
     /* and periodic scan report */
     TWD_RegisterEvent (pScanCncn->hTWD, TWD_OWN_EVENT_PERIODIC_SCAN_REPORT,
-                       scanCncn_PeriodicScanReportCB, (TI_HANDLE)pScanCncn);
+                       (void *)scanCncn_PeriodicScanReportCB, (TI_HANDLE)pScanCncn);
     TWD_EnableEvent (pScanCncn->hTWD, TWD_OWN_EVENT_PERIODIC_SCAN_REPORT);
 
     /* "register" the application scan result callback */
     scanCncn_RegisterScanResultCB ((TI_HANDLE)pScanCncn, SCAN_SCC_APP_ONE_SHOT, scanCncn_AppScanResultCB, (TI_HANDLE)pScanCncn);
     scanCncn_RegisterScanResultCB ((TI_HANDLE)pScanCncn, SCAN_SCC_APP_PERIODIC, scanCncn_AppScanResultCB, (TI_HANDLE)pScanCncn);
+
+    /* set the Scan Result Aging threshold for the scan concentrator's Scan Result Table */
+    scanResultTable_SetSraThreshold(pScanCncn->hScanResultTable, pScanCncnInitParams->uSraThreshold);
+
+    /* set to the sme the handler of the scan concentrator Scan Result Table */
+    sme_SetScanResultTable(pScanCncn->hSme, pScanCncn->hScanResultTable);
 }
 
 /** 
@@ -631,7 +637,7 @@
 {
     TScanCncn           *pScanCncn = (TScanCncn*)hScanCncn;
     EScanCncnClient     eClient;
-    EScanResultTag      eTag = str[ 1 ];
+    EScanResultTag      eTag = (EScanResultTag)str[ 1 ];
     TI_UINT32           uResultCount = str[ 0 ];
 
     TRACE2(pScanCncn->hReport, REPORT_SEVERITY_INFORMATION , "scanCncn_PeriodicScanReportCB: tag: %d, result count: %d\n", eTag, uResultCount);
@@ -658,8 +664,8 @@
 {
     TScanCncn           *pScanCncn = (TScanCncn*)hScanCncn;
     EScanCncnClient     eClient;
-    EScanResultTag      eTag = str[ 1 ];
-    TI_UINT32           uResultCount = str[ 0 ];
+    EScanResultTag      eTag = (EScanResultTag)str[1];
+    TI_UINT32           uResultCount = (TI_UINT8)(str[0]);
 
     TRACE2(pScanCncn->hReport, REPORT_SEVERITY_INFORMATION , "scanCncn_PeriodicScanCompleteCB: tag: %d, result count: %d\n", eTag, uResultCount);
 
@@ -736,16 +742,16 @@
             bValidResult = TI_FALSE;
         }
 
-        /* If SSID length is 0 (hidden SSID), discard the frame */
+        /* If SSID length is 0 (hidden SSID) */
         else if (frameInfo->content.iePacket.pSsid->hdr[1] == 0)
         {
-			/*Unless it is application scan for any SSID - In this case we want to see also the hidden SSIDs*/
+			/* Discard the frame unless it is application scan for any SSID - In this case we want to see also the hidden SSIDs*/
             if  (!(((SCAN_SCC_APP_ONE_SHOT == eClient) || (SCAN_SCC_APP_PERIODIC == eClient)) &&
 				    pScanCncn->pScanClients[ eClient ]->uScanParams.tOneShotScanParams.desiredSsid.len == 0))
-            {
-                TRACE6(pScanCncn->hReport, REPORT_SEVERITY_INFORMATION , "scanCncn_MlmeResultCB: discarding frame from BSSID: %02x:%02x:%02x:%02x:%02x:%02x, because SSID is hidden (len=0)\n", (*bssid)[ 0 ], (*bssid)[ 1 ], (*bssid)[ 2 ], (*bssid)[ 3 ], (*bssid)[ 4 ], (*bssid)[ 5 ]);
-                bValidResult = TI_FALSE;
-            }
+			{
+				TRACE6(pScanCncn->hReport, REPORT_SEVERITY_INFORMATION , "scanCncn_MlmeResultCB: discarding frame from BSSID: %02x:%02x:%02x:%02x:%02x:%02x, because SSID is hidden (len=0)\n", (*bssid)[ 0 ], (*bssid)[ 1 ], (*bssid)[ 2 ], (*bssid)[ 3 ], (*bssid)[ 4 ], (*bssid)[ 5 ]);
+				bValidResult = TI_FALSE;
+			}
         }
 
        /* 
@@ -754,7 +760,7 @@
         */
         else if ((SCAN_SCC_ROAMING_CONT == eClient) || (SCAN_SCC_ROAMING_IMMED == eClient))
         {
-            bssEntry_t          *pCurrentAP;
+            bssEntry_t *pCurrentAP;
 
             pCurrentAP = apConn_getBSSParams(pScanCncn->hAPConn);
             if(MAC_EQUAL(*bssid, pCurrentAP->BSSID) ||
@@ -765,13 +771,17 @@
                 pScanCncn->pScanClients[ eClient ]->uScanParams.tOneShotScanParams.scanType != SCAN_TYPE_SPS))
             {
                 TRACE6(pScanCncn->hReport, REPORT_SEVERITY_INFORMATION , "scanCncn_MlmeResultCB: discarding frame from SSID: , BSSID: %02x:%02x:%02x:%02x:%02x:%02x, because SSID different from desired or from current AP!\n", (*bssid)[ 0 ], (*bssid)[ 1 ], (*bssid)[ 2 ], (*bssid)[ 3 ], (*bssid)[ 4 ], (*bssid)[ 5 ]);
-
-                /* invalid resuilt */
                 bValidResult = TI_FALSE;
             }
 
         }
 
+        /* if rssi is lower than the Rssi threshold, discard frame */
+        if ( pRxAttr->Rssi < pScanCncn->tInitParams.nRssiThreshold )
+        {
+            TRACE7(pScanCncn->hReport, REPORT_SEVERITY_INFORMATION , "scanCncn_MlmeResultCB: discarding frame from BSSID: %02x:%02x:%02x:%02x:%02x:%02x, because RSSI = %d\n", (*bssid)[ 0 ], (*bssid)[ 1 ], (*bssid)[ 2 ], (*bssid)[ 3 ], (*bssid)[ 4 ], (*bssid)[ 5 ], pRxAttr->Rssi);
+            bValidResult = TI_FALSE;
+        }
 
         if(TI_TRUE == bValidResult)
         {
diff --git a/wl1271/stad/src/Sta_Management/ScanCncn.h b/wl1271/stad/src/Sta_Management/ScanCncn.h
index 3082448..1c1fe0c 100644
--- a/wl1271/stad/src/Sta_Management/ScanCncn.h
+++ b/wl1271/stad/src/Sta_Management/ScanCncn.h
@@ -1,7 +1,7 @@
 /*
  * ScanCncn.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -45,6 +45,8 @@
 #include "scrApi.h"
 #include "mlmeApi.h"
 
+#define SCAN_CNCN_APP_SCAN_TABLE_ENTRIES 64
+
 /** \enum EScanCncnClient
  * \brief	Scan Concentrator Client
  * 
diff --git a/wl1271/stad/src/Sta_Management/ScanCncnApp.c b/wl1271/stad/src/Sta_Management/ScanCncnApp.c
index 0e20066..57998fb 100644
--- a/wl1271/stad/src/Sta_Management/ScanCncnApp.c
+++ b/wl1271/stad/src/Sta_Management/ScanCncnApp.c
@@ -1,7 +1,7 @@
 /*
  * ScanCncnApp.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -82,6 +82,9 @@
         /* set one-shot scan as running app scan client */
         pScanCncn->eCurrentRunningAppScanClient = SCAN_SCC_APP_ONE_SHOT;
 
+        /* Perform aging process before the scan */
+        scanResultTable_PerformAging(pScanCncn->hScanResultTable);
+
         /* start the scan */
         if (SCAN_CRS_SCAN_RUNNING != 
             scanCncn_Start1ShotScan (hScanCncn, SCAN_SCC_APP_ONE_SHOT, pParam->content.pScanParams))
@@ -112,6 +115,9 @@
         /* set one-shot scan as running app scan client */
         pScanCncn->eCurrentRunningAppScanClient = SCAN_SCC_APP_PERIODIC;
 
+        /* Perform aging process before the scan */
+        scanResultTable_PerformAging(pScanCncn->hScanResultTable);
+
         /* start the scan */
         if (SCAN_CRS_SCAN_RUNNING !=
             scanCncn_StartPeriodicScan (hScanCncn, SCAN_SCC_APP_PERIODIC, pParam->content.pPeriodicScanParams))
@@ -183,6 +189,14 @@
 
         break;
 
+    case SCAN_CNCN_SET_SRA:
+        scanResultTable_SetSraThreshold(pScanCncn->hScanResultTable, pParam->content.uSraThreshold);
+        break;
+
+    case SCAN_CNCN_SET_RSSI:
+        pScanCncn->tInitParams.nRssiThreshold = pParam->content.nRssiThreshold;
+        break;
+
     default:
         TRACE1(pScanCncn->hReport, REPORT_SEVERITY_ERROR , "scanCncnApp_SetParam: unrecognized param type :%d\n", pParam->paramType);
         return PARAM_NOT_SUPPORTED;
@@ -210,6 +224,13 @@
 
     switch (pParam->paramType)
     {
+
+	case SCAN_CNCN_NUM_BSSID_IN_LIST_PARAM:
+        /* retrieve the number of BSSID's in the scan result table*/
+		pParam->paramLength = sizeof(TI_UINT32);
+		pParam->content.uNumBssidInList = scanResultTable_GetNumOfBSSIDInTheList (pScanCncn->hScanResultTable);
+        break;
+        
     case SCAN_CNCN_BSSID_LIST_SIZE_PARAM:
         /* retrieves the size to allocate for the app scan result taBle BBSID list (see next code) */
         pParam->paramLength = sizeof(TI_UINT32);
@@ -218,9 +239,14 @@
 
     case SCAN_CNCN_BSSID_LIST_PARAM:
         /* retrieve the app scan result table */
-        return scanResultTable_GetBssidList (pScanCncn->hScanResultTable, pParam->content.pBssidList, 
+  		return scanResultTable_GetBssidList (pScanCncn->hScanResultTable, pParam->content.pBssidList, 
                                              &pParam->paramLength, TI_TRUE);
-        break;
+
+	case SCAN_CNCN_BSSID_RATE_LIST_PARAM:
+        /* retrieve supported rates list equivalent to the supported rates list
+		 in the scan result table, but is extended to include 11n rates as well*/
+		return scanResultTable_GetBssidSupportedRatesList (pScanCncn->hScanResultTable, pParam->content.pRateList,
+														   &pParam->paramLength);
 
     default:
         TRACE1(pScanCncn->hReport, REPORT_SEVERITY_ERROR , "scanCncnApp_GetParam: unrecognized param type :%d\n", pParam->paramType);
@@ -248,8 +274,8 @@
     TScanCncn   *pScanCncn = (TScanCncn*)hScanCncn;
     TI_UINT32	statusData;
 
-    /* forward all data to SME */
-    sme_AppScanResult (pScanCncn->hSme, status, frameInfo);
+    /* Since in Manual Mode the app and the SME use the same table
+     * there is no need to forward data to SME */
 
     switch (status)
     {
@@ -273,7 +299,7 @@
         }
         else
         {
-            /* move the scan result table to stable state, clear it if no results were received */
+            /* move the scan result table to stable state */
             scanResultTable_SetStableState (pScanCncn->hScanResultTable);
 
             /* mark that no app scan is running */
@@ -299,7 +325,7 @@
         }
         else
         {
-            /* move the scan result table to stable state, clear it if no results were received */
+            /* move the scan result table to stable state */
             scanResultTable_SetStableState (pScanCncn->hScanResultTable);
 
             /* mark that no app scan is running */
@@ -329,7 +355,7 @@
         }
         else
         {
-            /* move the scan result table to stable state, clear it if no results were received */
+            /* move the scan result table to stable state */
             scanResultTable_SetStableState (pScanCncn->hScanResultTable);
 
             /* mark that no app scan is running */
diff --git a/wl1271/stad/src/Sta_Management/ScanCncnOsSm.c b/wl1271/stad/src/Sta_Management/ScanCncnOsSm.c
index 7a0c768..efa4a8b 100644
--- a/wl1271/stad/src/Sta_Management/ScanCncnOsSm.c
+++ b/wl1271/stad/src/Sta_Management/ScanCncnOsSm.c
@@ -1,7 +1,7 @@
 /*
  * ScanCncnOsSm.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -219,7 +219,7 @@
         pScanCncn->tOsScanParams.scanType = SCAN_TYPE_TRIGGERED_ACTIVE;
         /* also set number and rate of probe requests */
         pScanCncn->tOsScanParams.probeReqNumber = SCAN_OID_DEFAULT_PROBE_REQUEST_NUMBER_G;
-        pScanCncn->tOsScanParams.probeRequestRate = SCAN_OID_DEFAULT_PROBE_REQUEST_RATE_G;
+        pScanCncn->tOsScanParams.probeRequestRate = (ERateMask)SCAN_OID_DEFAULT_PROBE_REQUEST_RATE_G;
     }
     
     /* add supported channels on G */
@@ -318,7 +318,7 @@
         pScanCncn->tOsScanParams.scanType = SCAN_TYPE_TRIGGERED_ACTIVE;
         /* also set number and rate of probe requests */
         pScanCncn->tOsScanParams.probeReqNumber = SCAN_OID_DEFAULT_PROBE_REQUEST_NUMBER_A;
-        pScanCncn->tOsScanParams.probeRequestRate = SCAN_OID_DEFAULT_PROBE_REQUEST_RATE_A;
+        pScanCncn->tOsScanParams.probeRequestRate = (ERateMask)SCAN_OID_DEFAULT_PROBE_REQUEST_RATE_A;
     }
     
     /* add supported channels on G */
@@ -389,7 +389,7 @@
      * SME connection mode. However, it is expected that the SME will NOT attempt to connect when an OID
      * scan request will be received
      */
-    scanResultTable_SetStableState (pScanCncn->hScanResultTable);
+		  scanResultTable_SetStableState (pScanCncn->hScanResultTable);
 	 }
 	 else
 	 {
diff --git a/wl1271/stad/src/Sta_Management/StaCap.c b/wl1271/stad/src/Sta_Management/StaCap.c
index 7e6915d..cf8fb9e 100644
--- a/wl1271/stad/src/Sta_Management/StaCap.c
+++ b/wl1271/stad/src/Sta_Management/StaCap.c
@@ -1,7 +1,7 @@
 /*
  * StaCap.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -265,8 +265,7 @@
     tHtCapabilities.uExteCapabilities |= ((pTwdHtCapabilities->uMCSFeedback << 8) |
                                           (HTC_SUPPORT_NO                   << 10));
 
-    tHtCapabilities.uTxBfCapabilities = ((IMPLICIT_TXBF_REC_CAPABLE             << 0) |
-                                         (TRANSMIT_STAGGERED_SOUNDING_CAPABLE   << 2));
+	tHtCapabilities.uTxBfCapabilities = 0x0;
 
     tHtCapabilities.uAselCapabilities = 0x0;
 
diff --git a/wl1271/stad/src/Sta_Management/assocSM.c b/wl1271/stad/src/Sta_Management/assocSM.c
index cdff5ba..a4740fb 100644
--- a/wl1271/stad/src/Sta_Management/assocSM.c
+++ b/wl1271/stad/src/Sta_Management/assocSM.c
@@ -1,7 +1,7 @@
 /*
  * assocSM.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -1361,12 +1361,9 @@
     paramInfo_t     param;
     TTwdParamInfo   tTwdParam;
     TI_UINT16       capabilities;
-
-/*** OMAPS00214746_CHANGE_START ***/
     ECipherSuite    eCipherSuite = TWD_CIPHER_NONE; /* To be used for checking whether 
                                                        AP supports HT rates and TKIP 
                                                      */
-/*** OMAPS00214746_CHANGE_END ***/  
 
     pRequest = reqBuf;
     *reqLen = 0;
@@ -1532,7 +1529,6 @@
 	*reqLen += len;
   }
 
-/*** OMAPS00214746_CHANGE_START ***/
     /* Privacy - Used later on HT */
     param.paramType = RSN_ENCRYPTION_STATUS_PARAM;
     status          = rsn_getParam(pCtx->hRsn, &param);
@@ -1541,20 +1537,14 @@
     {
         eCipherSuite = param.content.rsnEncryptionStatus;
     } 
-/*** OMAPS00214746_CHANGE_END ***/
+
 
     /* Primary Site support HT ? */
     param.paramType = SITE_MGR_PRIMARY_SITE_HT_SUPPORT;
     siteMgr_getParam(pCtx->hSiteMgr, &param);
 
-/*** OMAPS00214746_CHANGE_START ***/
-#if 0
-    if(TI_TRUE == param.content.bPrimarySiteHtSupport)
-#else
     /* Disallow TKIP with HT Rates: If this is the case - discard HT rates from Association Request */
     if((TI_TRUE == param.content.bPrimarySiteHtSupport) && (eCipherSuite != TWD_CIPHER_TKIP))
-#endif
-/*** OMAPS00214746_CHANGE_END ***/
     {
         status = StaCap_GetHtCapabilitiesIe (pCtx->hStaCap, pRequest, &len);
     	if (status != TI_OK)
diff --git a/wl1271/stad/src/Sta_Management/currBss.c b/wl1271/stad/src/Sta_Management/currBss.c
index aac2ffe..0ce4f40 100644
--- a/wl1271/stad/src/Sta_Management/currBss.c
+++ b/wl1271/stad/src/Sta_Management/currBss.c
@@ -1,7 +1,7 @@
 /*
  * currBss.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -81,14 +81,13 @@
 #include "apConn.h"
 #include "scanMngrApi.h" 
 #include "MacServices_api.h"
-#include "smePrivate.h"
-#include "conn.h"
 #include "smeApi.h"
 #include "sme.h"
 #include "TWDriver.h"
 #include "EvHandler.h"
 #include "DrvMainModules.h"
 #include "siteMgrApi.h"
+#include "connApi.h"
 #include "roamingMngrTypes.h"
 
 /* Constants */
@@ -231,6 +230,7 @@
     pCurrBSS->hPowerMngr    = pStadHandles->hPowerMgr;
     pCurrBSS->hSme          = pStadHandles->hSme;
     pCurrBSS->hSiteMgr      = pStadHandles->hSiteMgr;
+	pCurrBSS->hConn         = pStadHandles->hConn;
     pCurrBSS->hReport       = pStadHandles->hReport;
     pCurrBSS->hScanMngr     = pStadHandles->hScanMngr;
     pCurrBSS->hEvHandler    = pStadHandles->hEvHandler;
@@ -548,11 +548,40 @@
 void currBSS_updateBSSLoss(currBSS_t   *pCurrBSS)
 {
     TRroamingTriggerParams roamingTriggersParams;
+	TI_UINT16 desiredBeaconInterval = 0;
+	TI_UINT32 connSelfTimeout = 0;
+	paramInfo_t *pParam;
 
-    /* In Ad-Hoc we use default parameter */
+	pParam = (paramInfo_t *)os_memoryAlloc(pCurrBSS->hOs, sizeof(paramInfo_t));
+    if (pParam)
+    {
+		pParam->paramType = SITE_MGR_DESIRED_BEACON_INTERVAL_PARAM;
+		siteMgr_getParam(pCurrBSS->hSiteMgr, pParam);
+		desiredBeaconInterval = pParam->content.siteMgrDesiredBeaconInterval;
+
+		pParam->paramType = CONN_SELF_TIMEOUT_PARAM;
+		conn_getParam(pCurrBSS->hConn, pParam);
+		connSelfTimeout = pParam->content.connSelfTimeout;
+
+		os_memoryFree(pCurrBSS->hOs, pParam, sizeof(paramInfo_t));
+	}
+	else
+	{
+		TRACE0(pCurrBSS->hReport, REPORT_SEVERITY_ERROR, "currBSS_updateBSSLoss: Error allocating paramInfo_t\n");
+	}
+
     if (pCurrBSS->type == BSS_INDEPENDENT)
     {
-       roamingTriggersParams.TsfMissThreshold = OUT_OF_SYNC_IBSS_THRESHOLD; 
+       if (desiredBeaconInterval > 0)
+       {
+		   /* Calculate the number of beacons for miss timeout */
+           roamingTriggersParams.TsfMissThreshold = connSelfTimeout / desiredBeaconInterval;
+       }
+	   else
+	   {
+		   /* Use default parameter */
+		   roamingTriggersParams.TsfMissThreshold = OUT_OF_SYNC_IBSS_THRESHOLD; 
+	   }
     }
     else /* In Infra we use the saved parameter */
     {
@@ -563,7 +592,6 @@
     
     TRACE2(pCurrBSS->hReport, REPORT_SEVERITY_INFORMATION, ": SG=%d, Band=%d\n", pCurrBSS->bUseSGParams, pCurrBSS->currAPInfo.band);
 
-
     /* if Soft Gemini is enabled - increase the BSSLoss value (because BT activity might over-run beacons) */
     if ((pCurrBSS->bUseSGParams) && (pCurrBSS->currAPInfo.band == RADIO_BAND_2_4_GHZ))
     {
@@ -708,6 +736,7 @@
     currBSS_t           *pCurrBSS = (currBSS_t *)hCurrBSS;
     paramInfo_t         *pParam;
     ScanBssType_e       eFrameBssType, eCurrentBSSType;
+	TMacAddr            desiredBSSID;
 
     pParam = (paramInfo_t *)os_memoryAlloc(pCurrBSS->hOs, sizeof(paramInfo_t));
     if (!pParam)
@@ -725,21 +754,54 @@
     /* Get current BSSID */
     pParam->paramType = SITE_MGR_CURRENT_BSSID_PARAM;
     siteMgr_getParam(pCurrBSS->hSiteMgr, pParam);   
+	TRACE12(pCurrBSS->hReport, REPORT_SEVERITY_INFORMATION,
+			"currBSS_beaconReceivedCallb: bssid = %02x.%02x.%02x.%02x.%02x.%02x, siteMgrDesiredBSSID = %02x.%02x.%02x.%02x.%02x.%02x\n",
+			(*bssid)[0], (*bssid)[1], (*bssid)[2], (*bssid)[3], (*bssid)[4], (*bssid)[5],
+			pParam->content.siteMgrDesiredBSSID[0],
+			pParam->content.siteMgrDesiredBSSID[1],
+			pParam->content.siteMgrDesiredBSSID[2],
+			pParam->content.siteMgrDesiredBSSID[3],
+			pParam->content.siteMgrDesiredBSSID[4],
+			pParam->content.siteMgrDesiredBSSID[5]);
+	MAC_COPY(desiredBSSID, pParam->content.siteMgrDesiredBSSID);
 
     if (pCurrBSS->isConnected && (eCurrentBSSType == eFrameBssType))
     {
-        if (MAC_EQUAL(pParam->content.siteMgrDesiredBSSID, *bssid))
+		TI_BOOL bFramePrivacy = 0, bCurrentSitePrivacy = 0;
+        /* if the bss type is ibss save set the current site privacy (the beacons transimted by STA)
+		   and set the privacy from the received frame, so that if the privacy is different there will
+		   be no connection */
+		if (eFrameBssType == BSS_INDEPENDENT)
+		{
+			pParam->paramType = SITE_MGR_SITE_CAPABILITY_PARAM;
+			siteMgr_getParam(pCurrBSS->hSiteMgr, pParam);
+
+			bCurrentSitePrivacy = ((pParam->content.siteMgrSiteCapability >> CAP_PRIVACY_SHIFT) & CAP_PRIVACY_MASK) ? TI_TRUE : TI_FALSE;
+			bFramePrivacy       = ((pFrameInfo->content.iePacket.capabilities >> CAP_PRIVACY_SHIFT) & CAP_PRIVACY_MASK) ? TI_TRUE : TI_FALSE;
+		}
+
+        if (MAC_EQUAL(desiredBSSID, *bssid))
         {
-            siteMgr_updateSite(pCurrBSS->hSiteMgr, bssid, pFrameInfo, pRxAttr->channel, (ERadioBand)pRxAttr->band, TI_FALSE);
-            /* Save the IE part of the beacon buffer in the site table */
-            siteMgr_saveBeaconBuffer(pCurrBSS->hSiteMgr, bssid, (TI_UINT8 *)dataBuffer, bufLength);
+            if ((eFrameBssType == BSS_INFRASTRUCTURE) || 
+			    ((eFrameBssType == BSS_INDEPENDENT) && (bCurrentSitePrivacy == bFramePrivacy)) )
+			{
+				siteMgr_updateSite(pCurrBSS->hSiteMgr, bssid, pFrameInfo, pRxAttr->channel, (ERadioBand)pRxAttr->band, TI_FALSE);
+				/* Save the IE part of the beacon buffer in the site table */
+				siteMgr_saveBeaconBuffer(pCurrBSS->hSiteMgr, bssid, (TI_UINT8 *)dataBuffer, bufLength);
+			}
         }
     	else if (eFrameBssType == BSS_INDEPENDENT)
         {
-    		siteMgr_IbssMerge(pCurrBSS->hSiteMgr, pParam->content.siteMgrDesiredBSSID, *bssid,
-    						  pFrameInfo, pRxAttr->channel, (ERadioBand)pRxAttr->band);
-            siteMgr_updateSite(pCurrBSS->hSiteMgr, bssid, pFrameInfo, pRxAttr->channel, (ERadioBand)pRxAttr->band, TI_FALSE);
-    		siteMgr_saveBeaconBuffer(pCurrBSS->hSiteMgr, bssid, (TI_UINT8 *)dataBuffer, bufLength);
+           /* Check if the Station sending the beacon uses privacy for the ibss and
+			   compare it to the self site. If privacy usage mathces, merge ibss
+			   and if not continue using self site */
+			if (bCurrentSitePrivacy == bFramePrivacy) 
+			{
+				siteMgr_IbssMerge(pCurrBSS->hSiteMgr, desiredBSSID, *bssid,
+								  pFrameInfo, pRxAttr->channel, (ERadioBand)pRxAttr->band);
+				siteMgr_updateSite(pCurrBSS->hSiteMgr, bssid, pFrameInfo, pRxAttr->channel, (ERadioBand)pRxAttr->band, TI_FALSE);
+				siteMgr_saveBeaconBuffer(pCurrBSS->hSiteMgr, bssid, (TI_UINT8 *)dataBuffer, bufLength);
+			}
     	}
     }
 
@@ -1020,9 +1082,6 @@
                                        apConn_roamingTrigger_e roamingEventType,
                                        roamingEventData_u *pRoamingEventData)
 {
-    TSme   *pSme = (TSme*)pCurrBSS->hSme;
-    conn_t *pConn = (conn_t *)pSme->hConn;
-
     TRACE1(pCurrBSS->hReport, REPORT_SEVERITY_INFORMATION, "currBSS_reportRoamingEvent: trigger %d\n", roamingEventType);
 
     if (pCurrBSS->isConnected)
@@ -1033,19 +1092,12 @@
         }
         else /* IBSS */
         { 
-            if (roamingEventType == ROAMING_TRIGGER_BSS_LOSS)
+            if( roamingEventType == ROAMING_TRIGGER_BSS_LOSS )
             {
                 /* If in IBSS call the SME restart function, this logic issues a DISCONNECT 
                  * event and tries to connect to other STA or establish self connection.
                  */
-                if (pConn->currentConnType == CONNECTION_SELF)
-                {
-                    return;
-                }
-                else 
-                {
-                    sme_Restart (pCurrBSS->hSme);
-                }
+                sme_Restart (pCurrBSS->hSme);
             }
         }
     }
diff --git a/wl1271/stad/src/Sta_Management/currBss.h b/wl1271/stad/src/Sta_Management/currBss.h
index 0da461b..30829b7 100644
--- a/wl1271/stad/src/Sta_Management/currBss.h
+++ b/wl1271/stad/src/Sta_Management/currBss.h
@@ -1,7 +1,7 @@
 /*
  * currBss.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -134,6 +134,7 @@
     TI_HANDLE   hReport;
     TI_HANDLE   hRegulatoryDomain;
     TI_HANDLE   hSiteMgr;
+	TI_HANDLE   hConn;
     TI_HANDLE   hScanMngr;
     TI_HANDLE   hEvHandler;
     TI_HANDLE   hTxCtrl;
diff --git a/wl1271/stad/src/Sta_Management/healthMonitor.c b/wl1271/stad/src/Sta_Management/healthMonitor.c
index 132d406..ed7d8e4 100644
--- a/wl1271/stad/src/Sta_Management/healthMonitor.c
+++ b/wl1271/stad/src/Sta_Management/healthMonitor.c
@@ -1,7 +1,7 @@
 /*
  * healthMonitor.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
diff --git a/wl1271/stad/src/Sta_Management/mlmeParser.c b/wl1271/stad/src/Sta_Management/mlmeParser.c
index c1914db..70d6596 100644
--- a/wl1271/stad/src/Sta_Management/mlmeParser.c
+++ b/wl1271/stad/src/Sta_Management/mlmeParser.c
@@ -1,7 +1,7 @@
 /*
  * mlmeParser.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -281,7 +281,7 @@
                 */
 
                 /* check if this is WME IE */
-                if((os_memoryCompare(pHandle->hOs, wpaIeOuiIe, pData+2, DOT11_OUI_LEN) == 0) && 
+                if((os_memoryCompare(pHandle->hOs, wpaIeOuiIe, pData+2, DOT11_OUI_LEN - 1) == 0) && 
 						((*(TI_UINT8*)(pData+5)) == dot11_WME_OUI_TYPE))
                 {
                     pHandle->tempFrameInfo.frame.content.assocRsp.WMEParams = &(pHandle->tempFrameInfo.WMEParams);
@@ -296,7 +296,7 @@
                 }
 #ifdef XCC_MODULE_INCLUDED
 				/* check if this is XCC vendor specific OUI */
-				else if (os_memoryCompare(pHandle->hOs, XCC_oui, pData+2, DOT11_OUI_LEN) == 0) 
+				else if (os_memoryCompare(pHandle->hOs, XCC_oui, pData+2, DOT11_OUI_LEN - 1) == 0) 
 				{
 					pXCCIeParameter = &(pHandle->tempFrameInfo.frame.content.assocRsp.XCCIEs[WMEQosTagToACTable[*(pData+6)]]);
 					mlmeParser_readXCCOui(pData, bodyDataLen, &readLen, pXCCIeParameter);
@@ -504,7 +504,7 @@
                                           pRxAttr, 
                                           &(pHandle->tempFrameInfo.bssid), 
                                           &(pHandle->tempFrameInfo.frame), 
-                                          (char *)pMgmtFrame->body+TIME_STAMP_LEN+4, 
+                                          (TI_UINT8 *)(pMgmtFrame->body+TIME_STAMP_LEN+4), 
                                           RX_BUF_LEN(pBuffer)-WLAN_HDR_LEN-TIME_STAMP_LEN-4);
         }
 
@@ -631,7 +631,7 @@
 			currBSS_beaconReceivedCallb(pHandle->hCurrBss, pRxAttr, 
                                     &(pHandle->tempFrameInfo.bssid), 
                                     &(pHandle->tempFrameInfo.frame), 
-                                    (char *)pMgmtFrame->body+TIME_STAMP_LEN+4, 
+                                    (TI_UINT8 *)(pMgmtFrame->body+TIME_STAMP_LEN+4), 
                                     RX_BUF_LEN(pBuffer)-WLAN_HDR_LEN-TIME_STAMP_LEN-4);
         }
 
@@ -1109,14 +1109,14 @@
 
 	if (dataLen < *pReadLen)
 	{
-		TRACE2(pMlme->hReport, REPORT_SEVERITY_WARNING, "MLME_PARSER: WME Parameter: eleLen=%d is too long (%d)\n", *pReadLen, dataLen);
+		TRACE2(pMlme->hReport, REPORT_SEVERITY_ERROR, "MLME_PARSER: WME Parameter: eleLen=%d is too long (%d)\n", *pReadLen, dataLen);
 		*pReadLen = dataLen;
 		return TI_NOK;
 	}
 
 	if ((pWMEParamIE->hdr[1]> WME_TSPEC_IE_LEN) || (pWMEParamIE->hdr[1]< DOT11_WME_ELE_LEN))
 	{
-		TRACE1(pMlme->hReport, REPORT_SEVERITY_WARNING, "MLME_PARSER: WME Parameter IE error: eleLen=%d\n", pWMEParamIE->hdr[1]);
+        TRACE1(pMlme->hReport, REPORT_SEVERITY_ERROR, "MLME_PARSER: WME Parameter IE error: eleLen=%d\n", pWMEParamIE->hdr[1]);
 		return TI_NOK;
 	}
 
@@ -1549,13 +1549,13 @@
 			CHECK_PARSING_ERROR_CONDITION((status != TI_OK), ("MLME_PARSER: error reading DS parameters\n"),TI_TRUE);
 			if (RADIO_BAND_2_4_GHZ == params->band )
 			{
-#if CHECK_PARSING_ERROR_CONDITION_PRINT
 				if (frame->pDSParamsSet->currChannel != params->rxChannel)
 				{
 					TRACE2(pHandle->hReport, REPORT_SEVERITY_ERROR, "Channel ERROR - incompatible channel source information: Frame=%d Vs Radio=%d.\nparser ABORTED!!!\n",
 						frame->pDSParamsSet->currChannel , params->rxChannel);
+
+					return TI_NOK;
 				}
-#endif
 			}
 			break;
 		/* read CF parameter set */
@@ -1596,11 +1596,13 @@
 			break;
 
 		/* read Channel Switch Mode */
-		case CHANNEL_SWITCH_ANNOUNCEMENT_IE_ID:
-			if (params->myBssid)
+        case CHANNEL_SWITCH_ANNOUNCEMENT_IE_ID:
+            
+            frame->channelSwitch = &params->channelSwitch;
+
+            if (params->myBssid)
 			{   /* Ignore Switch Channel commands from non my BSSID */
 				params->recvChannelSwitchAnnoncIE = TI_TRUE;
-				frame->channelSwitch = &params->channelSwitch;
 				status = mlmeParser_readChannelSwitch(pHandle, pData, bodyDataLen, &readLen, frame->channelSwitch, params->rxChannel);
 				if (status != TI_OK)
 				{
diff --git a/wl1271/stad/src/Sta_Management/qosMngr.c b/wl1271/stad/src/Sta_Management/qosMngr.c
index ece2da8..6c885f8 100644
--- a/wl1271/stad/src/Sta_Management/qosMngr.c
+++ b/wl1271/stad/src/Sta_Management/qosMngr.c
@@ -1,7 +1,7 @@
 /*
  * qosMngr.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -60,6 +60,7 @@
 #include "TWDriver.h"
 #include "DrvMainModules.h"
 #include "StaCap.h"
+#include "roamingMngrApi.h"
 
 
 extern int WMEQosTagToACTable[MAX_NUM_OF_802_1d_TAGS];
@@ -73,6 +74,9 @@
 /* Used to indicate no user priority is assigned for AC */
 #define INACTIVE_USER_PRIORITY 0xFF
 
+/* Used for TSPEC nominal fixed size */
+#define FIXED_NOMINAL_MSDU_SIZE_MASK 0x8000
+
 
 /********************************************************************************/
 /*						Internal functions prototypes.							*/
@@ -227,6 +231,7 @@
 	pQosMngr->hXCCMgr          = pStadHandles->hXCCMngr;
 	pQosMngr->hTimer           = pStadHandles->hTimer;
     pQosMngr->hStaCap          = pStadHandles->hStaCap;
+    pQosMngr->hRoamMng         = pStadHandles->hRoamingMngr;
 
     pQosMngr->isConnected = TI_FALSE;
 }
@@ -2131,15 +2136,6 @@
 		return NOT_CONNECTED;
 	}
 
-#if 0
-	/* Verify that the AP supports QOS_WME */
-	if (pQosMngr->activeProtocol != QOS_WME)
-	{
-TRACE0(pQosMngr->hReport, REPORT_SEVERITY_ERROR, "qosMngr_SetPsRxStreaming: Not connected to a QOS AP - Ignoring request !!!\n");
-		return NO_QOS_AP;
-	}
-#endif
-
 	/* Check TID validity */
 	if (uCurrTid > MAX_USER_PRIORITY)
 	{
@@ -2264,7 +2260,7 @@
 	}
 
 	/* check msdu size validity */
-	if( addTspecParams->uNominalMSDUsize > MAX_DATA_BODY_LENGTH)
+	if( (addTspecParams->uNominalMSDUsize & (~FIXED_NOMINAL_MSDU_SIZE_MASK)) > MAX_DATA_BODY_LENGTH)
 	{
 TRACE1(pQosMngr->hReport, REPORT_SEVERITY_ERROR, "uNominalMSDUsize = %d > 2312, !!!\n",addTspecParams->uNominalMSDUsize);
 		return TI_NOK;
@@ -2588,7 +2584,7 @@
         addtsReasonCode.uMinimumServiceInterval = pTspecInfo->uMinimumServiceInterval;
         addtsReasonCode.uMaximumServiceInterval = pTspecInfo->uMaximumServiceInterval;
         addtsReasonCode.uUserPriority = pTspecInfo->userPriority;
-        addtsReasonCode.uNominalMSDUsize = pTspecInfo->nominalMsduSize;
+        addtsReasonCode.uNominalMSDUsize = pTspecInfo->nominalMsduSize & ~FIXED_NOMINAL_MSDU_SIZE_MASK;
         addtsReasonCode.uMeanDataRate = pTspecInfo->meanDataRate;   
         addtsReasonCode.uMinimumPHYRate = pTspecInfo->minimumPHYRate;
         addtsReasonCode.uSurplusBandwidthAllowance = pTspecInfo->surplausBwAllowance;
@@ -2713,7 +2709,7 @@
         addtsReasonCode.uMinimumServiceInterval = pTspecInfo->uMinimumServiceInterval;
         addtsReasonCode.uMaximumServiceInterval = pTspecInfo->uMaximumServiceInterval;
         addtsReasonCode.uUserPriority = pQosMngr->resourceMgmtTable.candidateTspecInfo[acID].userPriority;
-        addtsReasonCode.uNominalMSDUsize = pTspecInfo->nominalMsduSize;
+        addtsReasonCode.uNominalMSDUsize = pTspecInfo->nominalMsduSize & ~FIXED_NOMINAL_MSDU_SIZE_MASK;
         addtsReasonCode.uMeanDataRate = pTspecInfo->meanDataRate;   
         addtsReasonCode.uMinimumPHYRate = pTspecInfo->minimumPHYRate;
         addtsReasonCode.uSurplusBandwidthAllowance = pTspecInfo->surplausBwAllowance;
@@ -2767,12 +2763,14 @@
 ************************************************************************/
 TI_STATUS QosMngr_receiveActionFrames(TI_HANDLE hQosMngr, TI_UINT8* pData, TI_UINT8 action, TI_UINT32 bodyLen)
 {
-	TI_UINT8					acID;
-	tsInfo_t				tsInfo;
-	TI_UINT8					userPriority;
-    OS_802_11_QOS_TSPEC_PARAMS addtsReasonCode;
-
-
+	TI_UINT8					    acID;
+	tsInfo_t				        tsInfo;
+	TI_UINT8					    userPriority;
+    OS_802_11_QOS_TSPEC_PARAMS      addtsReasonCode;
+    TI_UINT8                        statusCode = 0;
+#ifdef XCC_MODULE_INCLUDED
+	paramInfo_t                     param;
+#endif
     qosMngr_t *pQosMngr = (qosMngr_t *)hQosMngr;
 
 	/* check if STA is already connected to AP */
@@ -2838,6 +2836,35 @@
 	/* if action code is ADDTS call trafficAdmCtrl object API function */
 	else if (action == ADDTS_RESPONSE_ACTION) 
 	{
+        statusCode = *(pData+1);
+
+#ifdef XCC_MODULE_INCLUDED
+
+        if (ADDTS_STATUS_CODE_SUCCESS != statusCode)
+        {
+            tspecInfo_t tspecInfo;
+            param.paramType = ROAMING_MNGR_TRIGGER_EVENT;
+            param.content.roamingTriggerType =  ROAMING_TRIGGER_TSPEC_REJECTED;
+            roamingMngr_setParam(pQosMngr->hRoamMng, &param);
+
+                       
+            trafficAdmCtrl_parseTspecIE(&tspecInfo, pData+2);
+            
+            addtsReasonCode.uAPSDFlag = tspecInfo.UPSDFlag;
+            addtsReasonCode.uMinimumServiceInterval = tspecInfo.uMinimumServiceInterval;
+            addtsReasonCode.uMaximumServiceInterval = tspecInfo.uMaximumServiceInterval;
+            addtsReasonCode.uUserPriority = (TI_UINT32)tspecInfo.userPriority;
+            addtsReasonCode.uReasonCode = ADDTS_RESPONSE_REJECT;
+            addtsReasonCode.uNominalMSDUsize = (TI_UINT32)tspecInfo.nominalMsduSize & ~FIXED_NOMINAL_MSDU_SIZE_MASK;
+            addtsReasonCode.uMeanDataRate = tspecInfo.meanDataRate;	
+            addtsReasonCode.uMinimumPHYRate = tspecInfo.minimumPHYRate;
+            addtsReasonCode.uSurplusBandwidthAllowance = (TI_UINT32)tspecInfo.surplausBwAllowance;
+            addtsReasonCode.uMediumTime = (TI_UINT32)tspecInfo.mediumTime;
+            
+            EvHandlerSendEvent(pQosMngr->hEvHandler, IPC_EVENT_TSPEC_STATUS, (TI_UINT8*)(&addtsReasonCode), sizeof(OS_802_11_QOS_TSPEC_PARAMS));
+        }
+#endif
+        
 		if (trafficAdmCtrl_recv(pQosMngr->pTrafficAdmCtrl, pData, action) == TI_OK)
 		{
 #ifdef XCC_MODULE_INCLUDED
@@ -2965,7 +2992,7 @@
 	pCandidateParams->tid = (TI_UINT8)pTSPECParams->uUserPriority;
 	pCandidateParams->userPriority = (TI_UINT8)pTSPECParams->uUserPriority;
 	pCandidateParams->meanDataRate = pTSPECParams->uMeanDataRate;
-	pCandidateParams->nominalMsduSize = (TI_UINT16)pTSPECParams->uNominalMSDUsize;
+	pCandidateParams->nominalMsduSize = ((TI_UINT16)pTSPECParams->uNominalMSDUsize) | FIXED_NOMINAL_MSDU_SIZE_MASK;
 	pCandidateParams->UPSDFlag = (TI_BOOL)pTSPECParams->uAPSDFlag;
 	pCandidateParams->uMinimumServiceInterval = pTSPECParams->uMinimumServiceInterval;
 	pCandidateParams->uMaximumServiceInterval = pTSPECParams->uMaximumServiceInterval;
diff --git a/wl1271/stad/src/Sta_Management/qosMngr.h b/wl1271/stad/src/Sta_Management/qosMngr.h
index b65a3e6..5b2c699 100644
--- a/wl1271/stad/src/Sta_Management/qosMngr.h
+++ b/wl1271/stad/src/Sta_Management/qosMngr.h
@@ -1,7 +1,7 @@
 /*
  * qosMngr.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -130,6 +130,7 @@
     TI_HANDLE           hTxCtrl;
     TI_HANDLE           hTxMgmtQ;
     TI_HANDLE           hEvHandler;
+    TI_HANDLE           hRoamMng;
 
     TI_HANDLE           hMeasurementMngr;
     TI_HANDLE           hSmeSm;
diff --git a/wl1271/stad/src/Sta_Management/scanResultTable.c b/wl1271/stad/src/Sta_Management/scanResultTable.c
index ecbb749..370e763 100644
--- a/wl1271/stad/src/Sta_Management/scanResultTable.c
+++ b/wl1271/stad/src/Sta_Management/scanResultTable.c
@@ -1,7 +1,7 @@
 /*
  * scanResultTable.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -46,7 +46,10 @@
 #include "freq.h"
 
 
-#define TABLE_ENTRIES_NUMBER    32
+//#define TABLE_ENTRIES_NUMBER    32
+
+#define MILISECONDS(seconds)                            (seconds * 1000)
+#define UPDATE_LOCAL_TIMESTAMP(pSite, hOs)              pSite->localTimeStamp = os_timeStampMs(hOs);
 
 #define UPDATE_BSSID(pSite, pFrame)                     MAC_COPY((pSite)->bssid, *((pFrame)->bssId))
 #define UPDATE_BAND(pSite, pFrame)                      (pSite)->eBand = (pFrame)->band
@@ -56,22 +59,6 @@
 #define UPDATE_AGILITY(pSite, pFrame)                   pSite->agility = (((pFrame)->parsedIEs->content.iePacket.capabilities >> CAP_AGILE_SHIFT) & CAP_AGILE_MASK) ? TI_TRUE : TI_FALSE
 #define UPDATE_SLOT_TIME(pSite, pFrame)                 pSite->newSlotTime = (((pFrame)->parsedIEs->content.iePacket.capabilities >> CAP_SLOT_TIME_SHIFT) & CAP_SLOT_TIME_MASK) ? PHY_SLOT_TIME_SHORT : PHY_SLOT_TIME_LONG
 #define UPDATE_PROTECTION(pSite, pFrame)                pSite->useProtection = ((pFrame)->parsedIEs->content.iePacket.useProtection)
-#define UPDATE_SSID(pScanResultTable, pSite, pFrame)    if ((pFrame)->parsedIEs->content.iePacket.pSsid != NULL) { \
-                                                            pSite->ssid.len = (pFrame)->parsedIEs->content.iePacket.pSsid->hdr[1]; \
-                                                            if (pSite->ssid.len > MAX_SSID_LEN) { \
-                                                               TRACE2( pScanResultTable->hReport, REPORT_SEVERITY_ERROR, \
-                                                                  "UPDATE_SSID. pSite->ssid.len=%d exceeds the limit. Set to limit value %d\n", \
-                                                                  pSite->ssid.len, MAX_SSID_LEN); \
-                                                               handleRunProblem(PROBLEM_BUF_SIZE_VIOLATION); \
-                                                               pSite->ssid.len = MAX_SSID_LEN; \
-                                                            } \
-                                                            os_memoryCopy(pScanResultTable->hOS, \
-                                                                (void *)pSite->ssid.str, \
-                                                                (void *)(pFrame)->parsedIEs->content.iePacket.pSsid->serviceSetId, \
-                                                                pSite->ssid.len); \
-                                                            if (pSite->ssid.len < MAX_SSID_LEN) { \
-                                                               pSite->ssid.str[pSite->ssid.len] = '\0';} \
-                                                        }
 #define UPDATE_CHANNEL(pSite, pFrame, rxChannel)        if ((pFrame)->parsedIEs->content.iePacket.pDSParamsSet == NULL) \
                                                             pSite->channel = rxChannel; \
                                                         else \
@@ -144,15 +131,19 @@
     TI_HANDLE       hSiteMgr;               /**< Handle to the site manager object */
     TSiteEntry      *pTable;                /**< site table */
     TI_UINT32       uCurrentSiteNumber;     /**< number of sites currently in the table */
+    TI_UINT32       uEntriesNumber;         /**< max size of the table */
     TI_UINT32       uIterator;              /**< table iterator used for getFirst / getNext */
+    TI_UINT32       uSraThreshold;          /**< Rssi threshold for frame filtering */
     TI_BOOL         bStable;                /**< table status (updating / stable) */
+    EScanResultTableClear  eClearTable;     /** inicates if table should be cleared at scan */
 } TScanResultTable;
 
 static TSiteEntry  *scanResultTbale_AllocateNewEntry (TI_HANDLE hScanResultTable);
 static void         scanResultTable_UpdateSiteData (TI_HANDLE hScanResultTable, TSiteEntry *pSite, TScanFrameInfo *pFrame);
 static void         scanResultTable_updateRates(TI_HANDLE hScanResultTable, TSiteEntry *pSite, TScanFrameInfo *pFrame);
 static void         scanResultTable_UpdateWSCParams (TSiteEntry *pSite, TScanFrameInfo *pFrame);
-static TI_STATUS scanResultTable_CheckRxSignalValidity(TScanResultTable *pScanResultTable, siteEntry_t *pSite, TI_INT8 rxLevel, TI_UINT8 channel);
+static TI_STATUS    scanResultTable_CheckRxSignalValidity(TScanResultTable *pScanResultTable, siteEntry_t *pSite, TI_INT8 rxLevel, TI_UINT8 channel);
+static void         scanResultTable_RemoveEntry(TI_HANDLE hScanResultTable, TI_UINT32 uIndex);
 
 
 /** 
@@ -166,7 +157,7 @@
  * \return Handle to the newly created scan result table object, NULL if an error occured.
  * \sa     scanResultTable_Init, scanResultTable_Destroy
  */ 
-TI_HANDLE scanResultTable_Create (TI_HANDLE hOS)
+TI_HANDLE scanResultTable_Create (TI_HANDLE hOS, TI_UINT32 uEntriesNumber)
 {
     TScanResultTable    *pScanResultTable = NULL;
 
@@ -183,16 +174,17 @@
     pScanResultTable->hOS = hOS;
     /* allocate memory for sites' data */
     pScanResultTable->pTable = 
-        (TSiteEntry *)os_memoryAlloc (pScanResultTable->hOS, sizeof (TSiteEntry) * TABLE_ENTRIES_NUMBER);
+        (TSiteEntry *)os_memoryAlloc (pScanResultTable->hOS, sizeof (TSiteEntry) * uEntriesNumber);
     if (NULL == pScanResultTable->pTable)
     {
-        TRACE2(pScanResultTable->hReport, REPORT_SEVERITY_ERROR ,
-			   "scanResultTable_Create: Unable to allocate memory for %d entries of %d bytes\n",
-			   TABLE_ENTRIES_NUMBER, sizeof (TSiteEntry));
+        TRACE2(pScanResultTable->hReport, REPORT_SEVERITY_ERROR , 
+			   "scanResultTable_Create: Unable to allocate memory for %d entries of %d bytes\n", 
+			   uEntriesNumber , sizeof (TSiteEntry));
         os_memoryFree(pScanResultTable->hOS, pScanResultTable, sizeof(TScanResultTable));
         return NULL;
     }
-    os_memoryZero(pScanResultTable->hOS, pScanResultTable->pTable, sizeof(TSiteEntry) * TABLE_ENTRIES_NUMBER);
+    pScanResultTable->uEntriesNumber = uEntriesNumber;
+    os_memoryZero(pScanResultTable->hOS, pScanResultTable->pTable, sizeof(TSiteEntry) * uEntriesNumber);
     return (TI_HANDLE)pScanResultTable;
 }
 
@@ -204,10 +196,12 @@
  * 
  * \param  hScanResultTable - handle to the scan result table object
  * \param  pStadHandles - modules handles table
+ * \param  eClearTable - indicates if the table should be cleared, used when a frame arrives 
+ *                       or setStable is called and the table is in stable state
  * \return None
  * \sa     scanResultTable_Create
  */ 
-void        scanResultTable_Init (TI_HANDLE hScanResultTable, TStadHandlesList *pStadHandles)
+void        scanResultTable_Init (TI_HANDLE hScanResultTable, TStadHandlesList *pStadHandles, EScanResultTableClear eClearTable)
 {
     TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
 
@@ -219,6 +213,9 @@
     pScanResultTable->uCurrentSiteNumber = 0;
     pScanResultTable->bStable = TI_TRUE;
     pScanResultTable->uIterator = 0;
+    pScanResultTable->eClearTable = eClearTable;
+    /* default Scan Result Aging threshold is 60 second */
+    pScanResultTable->uSraThreshold = 60;
 }
 
 
@@ -241,7 +238,7 @@
     {
         /* free table memory */
         os_memoryFree (pScanResultTable->hOS, (void*)pScanResultTable->pTable, 
-                       sizeof (TSiteEntry) * TABLE_ENTRIES_NUMBER);
+                       sizeof (TSiteEntry) * pScanResultTable->uEntriesNumber);
     }
 
     /* free scan result table object memeory */
@@ -249,11 +246,27 @@
 }
 
 /** 
+ * \fn     scanResultTable_SetSraThreshold
+ * \brief  set Scan Result Aging threshold 
+ *  
+ * \param  hScanResultTable - handle to the scan result table object
+ * \param  uSraThreshold - Scan Result Aging threshold
+ * \return None
+ * \sa     scanResultTable_performAging
+ */ 
+void scanResultTable_SetSraThreshold(TI_HANDLE hScanResultTable, TI_UINT32 uSraThreshold)
+{
+    TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
+    pScanResultTable->uSraThreshold = uSraThreshold;
+}
+
+/** 
  * \fn     scanResultTable_UpdateEntry
  * \brief  Update or insert a site data. 
  * 
- * Update a site's data in the table if it already exists, or create an antry if the site doesn't exist.
- * If the table is in stable state, will move it to updating state and clear its contents.
+ * Update a site's data in the table if it already exists, or create an entry if the site doesn't exist.
+ * If the table is in stable state, will move it to updating state and clear its contents if bClearTable
+ * is eClearTable.
  * 
  * \param  hScanResultTable - handle to the scan result table object
  * \param  pBssid - a pointer to the site BSSID
@@ -275,8 +288,12 @@
         TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTable_UpdateEntry: table is stable, clearing table and moving to updating state\n");
         /* move the table to updating state */
         pScanResultTable->bStable = TI_FALSE;
-        /* and clear its contents */
-        pScanResultTable->uCurrentSiteNumber = 0;
+
+        if (SCAN_RESULT_TABLE_CLEAR == pScanResultTable->eClearTable) 
+        {
+            /* clear table contents */
+            pScanResultTable->uCurrentSiteNumber = 0;
+        }
     }
 
     /* Verify that the SSID IE is available (if not return NOK) */
@@ -286,18 +303,15 @@
         return TI_NOK;
     }
 
-    /* use temporary SSID structure */
+    /* use temporary SSID structure, and verify SSID length */
     tTempSsid.len = pFrame->parsedIEs->content.iePacket.pSsid->hdr[1];
-    /* The change is made to "close" the issue 414 in KlockWork.
-       This is tricky for incorrect data case.
-       At least it looks better than running out of buffer in os_memoryCopy below */
-    if (MAX_SSID_LEN < tTempSsid.len)
+    if (tTempSsid.len > MAX_SSID_LEN)
     {
-        TRACE2(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION, "scanResultTable_UpdateEntry: SSID len=%d out of range. replaced by %d\n", tTempSsid.len, MAX_SSID_LEN);
-        handleRunProblem(PROBLEM_BUF_SIZE_VIOLATION);
-        tTempSsid.len = MAX_SSID_LEN;
+        TRACE2(pScanResultTable->hReport, REPORT_SEVERITY_WARNING, "scanResultTable_UpdateEntry: SSID len=%d out of range. replaced by %d\n", tTempSsid.len, MAX_SSID_LEN);
+        return TI_NOK;
     }
-    os_memoryCopy(pScanResultTable->hOS, (void *)&(tTempSsid.str[ 0 ]), 
+    os_memoryCopy(pScanResultTable->hOS, 
+                  (void *)&(tTempSsid.str[ 0 ]), 
                   (void *)&(pFrame->parsedIEs->content.iePacket.pSsid->serviceSetId[ 0 ]),
                   tTempSsid.len);
     if (MAX_SSID_LEN > tTempSsid.len)
@@ -341,17 +355,19 @@
  * Moves the table to stable state. Also clears the tabel contents if required.
  * 
  * \param  hScanResultTable - handle to the scan result table object
+ * \param  eClearTable - indicates if the table should be cleared in case the table
+ *                       is in stable state (no result where received in last scan).
  * \return None
  * \sa     scanResultTable_UpdateEntry 
  */ 
-void        scanResultTable_SetStableState (TI_HANDLE hScanResultTable)
+void    scanResultTable_SetStableState (TI_HANDLE hScanResultTable)
 {
     TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
 
     TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTable_SetStableState: setting stable state\n");
 
     /* if also asked to clear the table, if it is at Stable mode means that no results were received, clear it! */
-    if (TI_TRUE == pScanResultTable->bStable)
+    if ((TI_TRUE == pScanResultTable->bStable) && (SCAN_RESULT_TABLE_CLEAR == pScanResultTable->eClearTable))
     {
         TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTable_SetStableState: also clearing table contents\n");
 
@@ -432,8 +448,8 @@
         /* if the BSSID and SSID match */
         if (MAC_EQUAL (*pBssid, pScanResultTable->pTable[ uIndex ].bssid) &&
             ((pSsid->len == pScanResultTable->pTable[ uIndex ].ssid.len) &&
-             (0 == os_memoryCompare (pScanResultTable->hOS, &(pSsid->str[ 0 ]),
-                                     &(pScanResultTable->pTable[ uIndex ].ssid.str[ 0 ]),
+             (0 == os_memoryCompare (pScanResultTable->hOS, (TI_UINT8 *)(&(pSsid->str[ 0 ])),
+                                     (TI_UINT8 *)(&(pScanResultTable->pTable[ uIndex ].ssid.str[ 0 ])),
                                      pSsid->len))))
         {
             TRACE1(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "Entry found at index %d\n", uIndex);
@@ -447,6 +463,107 @@
 }
 
 /** 
+ * \fn     scanResultTable_FindHidden
+ * \brief  find entry with hidden SSID anfd return it's index
+ * 
+ * \param  hScanResultTable - handle to the scan result table object
+ * \param  uHiddenSsidIndex - entry index to return
+ * \return TI_OK if found, TI_NOT if not. 
+ */ 
+static TI_STATUS scanResultTable_FindHidden (TScanResultTable *pScanResultTable, TI_UINT32 *uHiddenSsidIndex)
+{
+    TI_UINT32 uIndex;
+
+    TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTable_FindHidden: Searching for hidden SSID\n");
+    
+    /* check all entries in the table */
+    for (uIndex = 0; uIndex < pScanResultTable->uCurrentSiteNumber; uIndex++)
+    {
+        /* check if entry is with hidden SSID */
+        if ( (pScanResultTable->pTable[ uIndex ].ssid.len == 0) ||
+            ((pScanResultTable->pTable[ uIndex ].ssid.len == 1) && (pScanResultTable->pTable[ uIndex ].ssid.str[0] == 0)))
+        {
+            TRACE1(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTable_FindHidden: Entry found at index %d\n", uIndex);
+            *uHiddenSsidIndex = uIndex;
+            return TI_OK;
+        }
+    }
+
+    /* site wasn't found: return NULL */
+    TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTable_FindHidden: Entry was not found\n");
+    return TI_NOK;
+}
+
+/** 
+ * \fn     scanResultTable_performAging 
+ * \brief  Deletes from table all entries which are older than the Sra threshold
+ * 
+ * \param  hScanResultTable - handle to the scan result table object
+ * \return None
+ * \sa     scanResultTable_SetSraThreshold
+ */ 
+void   scanResultTable_PerformAging(TI_HANDLE hScanResultTable)
+{
+    TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
+    TI_UINT32           uIndex = 0;
+
+    /* check all entries in the table */
+    while (uIndex < pScanResultTable->uCurrentSiteNumber)
+    {
+        /* check if the entry's age is old if it remove it */
+        if (pScanResultTable->pTable[uIndex].localTimeStamp < 
+            os_timeStampMs(pScanResultTable->hOS) - MILISECONDS(pScanResultTable->uSraThreshold))
+        {
+            /* The removeEntry places the last entry instead of the deleted entry
+             * in order to preserve the table's continuity. For this reason the
+             * uIndex is not incremented because we want to check the entry that 
+             * was placed instead of the entry deleted */
+            scanResultTable_RemoveEntry(hScanResultTable, uIndex);
+        }
+        else
+        {
+            /* If the entry was not deleted check the next entry */
+            uIndex++;
+        }
+    }
+}
+
+/** 
+ * \fn     scanResultTable_removeEntry 
+ * \brief  Deletes entry from table
+ *         the function keeps a continuty in the table by copying the last
+ *         entry in the table to the place the entry was deleted from
+ * 
+ * \param  hScanResultTable - handle to the scan result table object
+ * \param  uIndex           - index of the entry to be deleted
+ * \return TI_OK if entry deleted successfully TI_NOK otherwise
+ */ 
+void   scanResultTable_RemoveEntry(TI_HANDLE hScanResultTable, TI_UINT32 uIndex)
+{
+    TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
+
+    if (uIndex >= pScanResultTable->uCurrentSiteNumber) 
+    {
+        TRACE1(pScanResultTable->hReport, REPORT_SEVERITY_ERROR , "scanResultTable_removeEntry: %d out of bound entry index\n", uIndex);
+        return;
+    }
+
+    /* if uIndex is not the last entry, then copy the last entry in the table to the uIndex entry */
+    if (uIndex < (pScanResultTable->uCurrentSiteNumber - 1))
+    {
+        os_memoryCopy(pScanResultTable->hOS, 
+                      &(pScanResultTable->pTable[uIndex]), 
+                      &(pScanResultTable->pTable[pScanResultTable->uCurrentSiteNumber - 1]),
+                      sizeof(TSiteEntry));
+    }
+
+    /* clear the last entry */
+    os_memoryZero(pScanResultTable->hOS, &(pScanResultTable->pTable[pScanResultTable->uCurrentSiteNumber - 1]), sizeof(TSiteEntry));
+    /* decrease the current table size */
+    pScanResultTable->uCurrentSiteNumber--;
+}
+
+/** 
  * \fn     scanresultTbale_AllocateNewEntry 
  * \brief  Allocates an empty entry for a new site
  * 
@@ -458,11 +575,24 @@
 TSiteEntry *scanResultTbale_AllocateNewEntry (TI_HANDLE hScanResultTable)
 {
     TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
+    TI_UINT32 uHiddenSsidIndex;
 
     /* if the table is full */
-    if (pScanResultTable->uCurrentSiteNumber >= TABLE_ENTRIES_NUMBER)
+    if (pScanResultTable->uCurrentSiteNumber >= pScanResultTable->uEntriesNumber)
     {
-        TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTbale_AllocateNewEntry: Table is full, can't allocate new entry\n");
+        /* replace hidden SSID entry with the new result */
+        if (scanResultTable_FindHidden(pScanResultTable, &uHiddenSsidIndex) == TI_OK)
+        {
+            TRACE1(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTbale_AllocateNewEntry: Table is full, found hidden SSID at index %d to replace with\n", uHiddenSsidIndex);
+            
+            /* Nullify new site data */
+            os_memoryZero(pScanResultTable->hOS, &(pScanResultTable->pTable[ uHiddenSsidIndex ]), sizeof (TSiteEntry));
+
+            /* return the site */
+            return &(pScanResultTable->pTable[ uHiddenSsidIndex ]);
+        }
+
+        TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTbale_AllocateNewEntry: Table is full, no Hidden SSDI to replace, can't allocate new entry\n");
         return NULL;
     }
 
@@ -492,11 +622,33 @@
     TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
     paramInfo_t         param;
 
+    /* Update SSID */
+    if (pFrame->parsedIEs->content.iePacket.pSsid != NULL) 
+    {
+        pSite->ssid.len = pFrame->parsedIEs->content.iePacket.pSsid->hdr[1];
+        if (pSite->ssid.len > MAX_SSID_LEN) 
+        {
+           TRACE2( pScanResultTable->hReport, REPORT_SEVERITY_ERROR, "scanResultTable_UpdateSiteData: pSite->ssid.len=%d exceeds the limit. Set to limit value %d\n", pSite->ssid.len, MAX_SSID_LEN);
+           pSite->ssid.len = MAX_SSID_LEN;
+        }
+        os_memoryCopy(pScanResultTable->hOS,
+            (void *)pSite->ssid.str,
+            (void *)pFrame->parsedIEs->content.iePacket.pSsid->serviceSetId,
+            pSite->ssid.len);
+        if (pSite->ssid.len < MAX_SSID_LEN) 
+        {
+            pSite->ssid.str[pSite->ssid.len] = '\0';
+        }
+    }
+
+	/* Since a new scan was initiated the entry can be selected again */
+	pSite->bConsideredForSelect = TI_FALSE;
+    UPDATE_LOCAL_TIMESTAMP(pSite, pScanResultTable->hOS);
+
     UPDATE_BSSID (pSite, pFrame);
     UPDATE_BAND (pSite, pFrame);
     UPDATE_BEACON_INTERVAL (pSite, pFrame);
     UPDATE_CAPABILITIES (pSite, pFrame);
-    UPDATE_SSID (pScanResultTable, pSite, pFrame);
     UPDATE_PRIVACY (pSite, pFrame);
     UPDATE_RSN_IE (pScanResultTable, pSite, pFrame->parsedIEs->content.iePacket.pRsnIe, pFrame->parsedIEs->content.iePacket.rsnIeLen);
     UPDATE_APSD (pSite, pFrame);
@@ -520,7 +672,7 @@
     if ((pFrame->parsedIEs->content.iePacket.pDSParamsSet != NULL)  &&
         (pFrame->parsedIEs->content.iePacket.pDSParamsSet->currChannel != pFrame->channel))
     {
-        TRACE2(pScanResultTable->hReport, REPORT_SEVERITY_WARNING, "scanResultTable_UpdateSiteData: wrong channels, radio channel=%d, frame channel=%d\n", pFrame->channel, pFrame->parsedIEs->content.iePacket.pDSParamsSet->currChannel);
+        TRACE2(pScanResultTable->hReport, REPORT_SEVERITY_ERROR , "scanResultTable_UpdateSiteData: wrong channels, radio channel=%d, frame channel=%d\n", pFrame->channel, pFrame->parsedIEs->content.iePacket.pDSParamsSet->currChannel);
     }
     else
         UPDATE_CHANNEL (pSite, pFrame , pFrame->channel);
@@ -550,6 +702,8 @@
             UPDATE_PROBE_MODULATION (pSite, pFrame);
         }
 
+        pSite->bChannelSwitchAnnoncIEFound = (pFrame->parsedIEs->content.iePacket.channelSwitch != NULL)?TI_TRUE:TI_FALSE;
+
         UPDATE_BEACON_RECV (pSite);
         UPDATE_FRAME_BUFFER (pScanResultTable, (pSite->beaconBuffer), (pSite->beaconLength), pFrame); 
     }
@@ -564,6 +718,8 @@
 
         UPDATE_PROBE_RECV (pSite);
         UPDATE_FRAME_BUFFER (pScanResultTable, (pSite->probeRespBuffer), (pSite->probeRespLength), pFrame);
+
+        pSite->bChannelSwitchAnnoncIEFound = TI_FALSE;
     }
     else
     {
@@ -594,9 +750,7 @@
     TScanResultTable    *pScanResultTable = (TScanResultTable*)hScanResultTable;
     TI_UINT8            maxBasicRate = 0, maxActiveRate = 0;
     TI_UINT32           bitMapExtSupp = 0;
-/*** MODS_BEGIN_FOR_11N_RATE_REPORTING ***/
-    TI_UINT32           uMcsSupportedRateMask = 0, uMcsbasicRateMask=0;
-/*** MODS_END_FOR_11N_RATE_REPORTING ***/
+	TI_UINT32           uMcsSupportedRateMask = 0, uMcsbasicRateMask = 0;
 
     if (pFrame->parsedIEs->content.iePacket.pRates == NULL)
     {
@@ -607,17 +761,17 @@
     }
 
     /* Update the rate elements */
-    maxBasicRate = rate_GetMaxBasicFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pRates->rates, 
-                                            pFrame->parsedIEs->content.iePacket.pRates->hdr[1], maxBasicRate);
-    maxActiveRate = rate_GetMaxActiveFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pRates->rates,
-                                              pFrame->parsedIEs->content.iePacket.pRates->hdr[1], maxActiveRate);
+    maxBasicRate = (TI_UINT8)rate_GetMaxBasicFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pRates->rates, 
+                                            pFrame->parsedIEs->content.iePacket.pRates->hdr[1], (ENetRate)maxBasicRate);
+    maxActiveRate = (TI_UINT8)rate_GetMaxActiveFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pRates->rates,
+                                              pFrame->parsedIEs->content.iePacket.pRates->hdr[1], (ENetRate)maxActiveRate);
 
     if (pFrame->parsedIEs->content.iePacket.pExtRates)
     {
-        maxBasicRate = rate_GetMaxBasicFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pExtRates->rates,
-                                                pFrame->parsedIEs->content.iePacket.pExtRates->hdr[1], maxBasicRate);
-        maxActiveRate = rate_GetMaxActiveFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pExtRates->rates,
-                                                  pFrame->parsedIEs->content.iePacket.pExtRates->hdr[1], maxActiveRate);
+        maxBasicRate = (TI_UINT8)rate_GetMaxBasicFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pExtRates->rates,
+                                                pFrame->parsedIEs->content.iePacket.pExtRates->hdr[1], (ENetRate)maxBasicRate);
+        maxActiveRate = (TI_UINT8)rate_GetMaxActiveFromStr ((TI_UINT8 *)pFrame->parsedIEs->content.iePacket.pExtRates->rates,
+                                                  pFrame->parsedIEs->content.iePacket.pExtRates->hdr[1], (ENetRate)maxActiveRate);
     }
 
     if (maxActiveRate == 0)
@@ -665,8 +819,7 @@
         pSite->rateMask.basicRateMask |= bitMapExtSupp;
     }
 
-/*** MODS_BEGIN_FOR_11N_RATE_REPORTING ***/
-    if (pFrame->parsedIEs->content.iePacket.pHtCapabilities != NULL)
+	if (pFrame->parsedIEs->content.iePacket.pHtCapabilities != NULL)
     {
         /* MCS build rates bit map */
         rate_McsNetStrToDrvBitmap (&uMcsSupportedRateMask,
@@ -683,7 +836,6 @@
 
         pSite->rateMask.basicRateMask |= uMcsbasicRateMask;
     }
-/*** MODS_END_FOR_11N_RATE_REPORTING ***/
 }
 
 /** 
@@ -706,7 +858,7 @@
         TI_UINT16   tlvPtrType,tlvPtrLen,selectedMethod=0;
     
         tlvPtr = (TI_UINT8*)pFrame->parsedIEs->content.iePacket.WSCParams->WSCBeaconOrProbIE;
-        endPtr = tlvPtr + pFrame->parsedIEs->content.iePacket.WSCParams->hdr[1] - (DOT11_OUI_LEN + 1);
+        endPtr = tlvPtr + pFrame->parsedIEs->content.iePacket.WSCParams->hdr[1] - DOT11_OUI_LEN;
     
         do
         {
@@ -747,6 +899,19 @@
 }
 
 /** 
+ * \fn     scanResultTable_GetNumOfBSSIDInTheList
+ * \brief  Returns the number of BSSID's in the scan result list
+ * 
+ * \param  hScanResultTable - handle to the scan result table
+ * \return The number of BSSID's in the list
+ * \sa scanResultTable_GetBssidSupportedRatesList
+ */ 
+TI_UINT32 scanResultTable_GetNumOfBSSIDInTheList (TI_HANDLE hScanResultTable)
+{
+	return ((TScanResultTable*)hScanResultTable)->uCurrentSiteNumber;
+}
+
+/** 
  * \fn     scanResultTable_CalculateBssidListSize
  * \brief  Calculates the size required for BSSID list storage
  * 
@@ -1101,6 +1266,58 @@
 }
 
 
+/** 
+ * \fn     scanResultTable_GetBssidSupportedRatesList
+ * \brief  Retrieves the Rate table corresponding with the site
+ * table
+ * 
+ * 
+ * \param  hScanResultTable - handle to the scan result table object
+ * \param  pRateList - pointer to a buffer large enough to hols
+ * the rate list
+ * \param  pLength - length of the supplied buffer,
+ * \return TI_STATUS
+ * \sa scanResultTable_GetBssidSupportedRatesList
+ */ 
+TI_STATUS scanResultTable_GetBssidSupportedRatesList (TI_HANDLE hScanResultTable,
+													  OS_802_11_N_RATES *pRateList,
+													  TI_UINT32 *pLength)
+{
+    TScanResultTable        *pScanResultTable = (TScanResultTable*)hScanResultTable;
+	TSiteEntry              *pSiteEntry;
+    TI_UINT32                uSiteIndex, firstOFDMloc = 0;
+	TI_UINT32                requiredLength;
+	OS_802_11_N_RATES	 	*pCurrRateString;
+
+    TRACE0(pScanResultTable->hReport, REPORT_SEVERITY_INFORMATION , "scanResultTable_GetBssidSupportedRatesList called");
+
+    /* Verify the supplied length is enough*/
+	requiredLength = pScanResultTable->uCurrentSiteNumber*sizeof(OS_802_11_N_RATES);
+	if (requiredLength > *pLength)
+    {
+        TRACE2(pScanResultTable->hReport, REPORT_SEVERITY_ERROR , "scanResultTable_GetBssidSupportedRatesList: received length %d, insufficient to hold list of size %d\n", *pLength, requiredLength);
+        *pLength = requiredLength;
+        return TI_NOK;
+    }
+
+    /* Create the rate list*/
+    for (uSiteIndex = 0; uSiteIndex < pScanResultTable->uCurrentSiteNumber; uSiteIndex++)
+    {
+		pCurrRateString = &(pRateList[uSiteIndex]);
+        pSiteEntry = &(pScanResultTable->pTable[ uSiteIndex ]);
+
+        /* Supported Rates */
+        os_memoryZero (pScanResultTable->hOS, (void *)pCurrRateString, sizeof(OS_802_11_N_RATES));
+        rate_DrvBitmapToNetStrIncluding11n (pSiteEntry->rateMask.supportedRateMask,
+												  pSiteEntry->rateMask.basicRateMask,
+												  (TI_UINT8*)pCurrRateString,
+												  &firstOFDMloc);
+	}
+
+    return TI_OK;
+}
+
+
 /***********************************************************************
  *                        siteMgr_CheckRxSignalValidity
  ***********************************************************************
diff --git a/wl1271/stad/src/Sta_Management/scanResultTable.h b/wl1271/stad/src/Sta_Management/scanResultTable.h
index 0b8ef97..846ad9e 100644
--- a/wl1271/stad/src/Sta_Management/scanResultTable.h
+++ b/wl1271/stad/src/Sta_Management/scanResultTable.h
@@ -1,7 +1,7 @@
 /*
  * scanResultTable.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -122,6 +122,9 @@
     dot11_RSN_t                pRsnIe[MAX_RSN_IE];
     TI_UINT8                   rsnIeLen;
 
+    /* 80211h beacon  - Switch Channel IE included */
+    TI_BOOL                    bChannelSwitchAnnoncIEFound;
+
 	TI_UINT8                   pUnknownIe[MAX_BEACON_BODY_LENGTH];
     TI_UINT16                  unknownIeLen;
 
@@ -135,10 +138,15 @@
 } TSiteEntry;
 
 
+typedef enum 
+{
+    SCAN_RESULT_TABLE_DONT_CLEAR,
+    SCAN_RESULT_TABLE_CLEAR
 
+} EScanResultTableClear;
 
-TI_HANDLE   scanResultTable_Create (TI_HANDLE hOS);
-void        scanResultTable_Init (TI_HANDLE hScanResultTable, TStadHandlesList *pStadHandles);
+TI_HANDLE   scanResultTable_Create (TI_HANDLE hOS, TI_UINT32 uEntriesNumber);
+void        scanResultTable_Init (TI_HANDLE hScanResultTable, TStadHandlesList *pStadHandles, EScanResultTableClear eClearTable);
 void        scanResultTable_Destroy (TI_HANDLE hScanResultTable);
 TI_STATUS   scanResultTable_UpdateEntry (TI_HANDLE hScanResultTable, TMacAddr *pBssid, TScanFrameInfo* pFrame);
 void        scanResultTable_SetStableState (TI_HANDLE hScanResultTable);
@@ -146,8 +154,12 @@
 TSiteEntry  *scanResultTable_GetNext (TI_HANDLE hScanResultTable);
 TSiteEntry  *scanResultTable_GetBySsidBssidPair (TI_HANDLE hScanResultTable, TSsid *pSsid, TMacAddr *pBssid);
 TI_UINT32   scanResultTable_CalculateBssidListSize (TI_HANDLE hScanResultTable, TI_BOOL bAllVarIes);
+TI_UINT32 scanResultTable_GetNumOfBSSIDInTheList (TI_HANDLE hScanResultTable);
 TI_STATUS   scanResultTable_GetBssidList (TI_HANDLE hScanResultTable, OS_802_11_BSSID_LIST_EX *pBssidList, 
                                           TI_UINT32 *pLength, TI_BOOL bAllVarIes);
+TI_STATUS scanResultTable_GetBssidSupportedRatesList (TI_HANDLE hScanResultTable, OS_802_11_N_RATES *pRateList, TI_UINT32 *pLength);
 
+void        scanResultTable_PerformAging(TI_HANDLE hScanResultTable);
+void        scanResultTable_SetSraThreshold(TI_HANDLE hScanResultTable, TI_UINT32 uSraThreshold);
 #endif /* __SCAN_RESULT_TABLE_H__ */
 
diff --git a/wl1271/stad/src/Sta_Management/scr.c b/wl1271/stad/src/Sta_Management/scr.c
index db86593..4d164fe 100644
--- a/wl1271/stad/src/Sta_Management/scr.c
+++ b/wl1271/stad/src/Sta_Management/scr.c
@@ -1,7 +1,7 @@
 /*
  * scr.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -441,7 +441,7 @@
             if ( NULL != pScr->clientArray[ pScr->runningClient[ uResourceIndex ] ].clientRequestCB )
             {
                 pScr->clientArray[ pScr->runningClient[ uResourceIndex ] ].clientRequestCB( pScr->clientArray[ pScr->runningClient[ uResourceIndex ] ].ClientRequestCBObj,
-                                                                                          SCR_CRS_FW_RESET, uResourceIndex, SCR_PR_NONE );
+                                                                                          SCR_CRS_FW_RESET, (EScrResourceId)uResourceIndex, SCR_PR_NONE );
             }
             else
             {
@@ -503,7 +503,7 @@
                 if ( NULL != pScr->clientArray[ i ].clientRequestCB )
                 {
                     pScr->clientArray[ i ].clientRequestCB( pScr->clientArray[ i ].ClientRequestCBObj, 
-                                                            SCR_CRS_PEND, uResourceIndex, SCR_PR_DIFFERENT_GROUP_RUNNING );
+                                                            SCR_CRS_PEND, (EScrResourceId)uResourceIndex, SCR_PR_DIFFERENT_GROUP_RUNNING );
                 }
                 else
                 {
@@ -529,7 +529,7 @@
                 if ( NULL != pScr->clientArray[ highestPending ].clientRequestCB )
                 {
                     pScr->clientArray[ highestPending ].clientRequestCB( pScr->clientArray[ highestPending ].ClientRequestCBObj, 
-                                                                         SCR_CRS_RUN, uResourceIndex, SCR_PR_NONE );
+                                                                         SCR_CRS_RUN, (EScrResourceId)uResourceIndex, SCR_PR_NONE );
                 }
                 else
                 {
@@ -585,7 +585,7 @@
                 TRACE2( pScr->hReport, REPORT_SEVERITY_INFORMATION, "Sending abort request to client %d for resource %d\n", pScr->runningClient[ uResourceIndex ], uResourceIndex);
                 pScr->clientArray[ pScr->runningClient[ uResourceIndex ] ].clientRequestCB( pScr->clientArray[ pScr->runningClient[ uResourceIndex ] ].ClientRequestCBObj,
                                                                                             SCR_CRS_ABORT,
-                                                                                            uResourceIndex,
+                                                                                            (EScrResourceId)uResourceIndex,
                                                                                             SCR_PR_NONE );
             }
             else
@@ -610,7 +610,7 @@
                 if ( NULL != pScr->clientArray[ i ].clientRequestCB )
                 {
                     pScr->clientArray[ i ].clientRequestCB( pScr->clientArray[ i ].ClientRequestCBObj, 
-                                                            SCR_CRS_PEND, uResourceIndex, 
+                                                            SCR_CRS_PEND, (EScrResourceId)uResourceIndex, 
                                                             SCR_PR_DIFFERENT_GROUP_RUNNING );
                 }
                 else
@@ -634,7 +634,7 @@
                 if ( NULL != pScr->clientArray[ highestPending ].clientRequestCB )
                 {
                     pScr->clientArray[ highestPending ].clientRequestCB( pScr->clientArray[ highestPending ].ClientRequestCBObj, 
-                                                                         SCR_CRS_RUN, uResourceIndex,
+                                                                         SCR_CRS_RUN, (EScrResourceId)uResourceIndex,
                                                                          SCR_PR_NONE );
                 }
                 else
@@ -925,7 +925,7 @@
              (requiredState == pScr->clientArray[ i ].state[ eResource ])) /* client is in required state */
         {
             /* and if so, return the client index */
-            return i;
+            return (EScrClientId)i;
         }
     }
 
diff --git a/wl1271/stad/src/Sta_Management/siteHash.h b/wl1271/stad/src/Sta_Management/siteHash.h
index 5abded4..0df8cf0 100644
--- a/wl1271/stad/src/Sta_Management/siteHash.h
+++ b/wl1271/stad/src/Sta_Management/siteHash.h
@@ -1,7 +1,7 @@
 /*
  * siteHash.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -141,6 +141,7 @@
 
     /* Wifi Simple Config */
     TIWLN_SIMPLE_CONFIG_MODE  siteMgrWSCCurrMode; /* indicates the current WiFi Simple Config mode */
+    TI_UINT32           uWscIeSize; 			  /* Simple Config IE actual size (the part after the OUI) */
     char                siteMgrWSCProbeReqParams[DOT11_WSC_PROBE_REQ_MAX_LENGTH]; /* Contains the params to be used in the ProbeReq - WSC IE */ 
 
     TI_UINT8            includeWSCinProbeReq;
diff --git a/wl1271/stad/src/Sta_Management/siteMgr.c b/wl1271/stad/src/Sta_Management/siteMgr.c
index 6ca2dc4..ed54b80 100644
--- a/wl1271/stad/src/Sta_Management/siteMgr.c
+++ b/wl1271/stad/src/Sta_Management/siteMgr.c
@@ -1,7 +1,7 @@
 /*
  * siteMgr.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -228,7 +228,6 @@
 static void siteMgr_TxPowerLowThreshold(TI_HANDLE hSiteMgr, TI_UINT8 *data, TI_UINT8 dataLength);
 static void siteMgr_TxPowerHighThreshold(TI_HANDLE hSiteMgr, TI_UINT8 *data, TI_UINT8 dataLength);
 
-
 /************************************************************************
 *                        siteMgr_setTemporaryTxPower                    *
 *************************************************************************
@@ -714,16 +713,16 @@
 
     case SITE_MGR_SIMPLE_CONFIG_MODE: /* Setting the WiFiSimpleConfig mode */
 		
-		/* Modify the current mode */
+        /* Modify the current mode and IE size */
 		pSiteMgr->siteMgrWSCCurrMode = pParam->content.siteMgrWSCMode.WSCMode;
+		pSiteMgr->uWscIeSize = pParam->content.siteMgrWSCMode.uWscIeSize;
 
-        TRACE1(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "Setting SimpleConfig Mode to %d\n", pSiteMgr->siteMgrWSCCurrMode);
+        TRACE2(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "Setting SimpleConfig Mode to %d, IE Size = %d\n", pSiteMgr->siteMgrWSCCurrMode, pSiteMgr->uWscIeSize);
 
 		/* In case the WSC is on ,the ProbeReq WSC IE need to be updated */
-
-		if(pSiteMgr->siteMgrWSCCurrMode != TIWLN_SIMPLE_CONFIG_OFF)
+        if(pSiteMgr->siteMgrWSCCurrMode != TIWLN_SIMPLE_CONFIG_OFF)
 		{
-			os_memoryCopy(pSiteMgr->hOs, &pSiteMgr->siteMgrWSCProbeReqParams, &pParam->content.siteMgrWSCMode.probeReqWSCIE, DOT11_WSC_PROBE_REQ_MAX_LENGTH);
+			os_memoryCopy(pSiteMgr->hOs, &pSiteMgr->siteMgrWSCProbeReqParams, &pParam->content.siteMgrWSCMode.probeReqWSCIE, pSiteMgr->uWscIeSize);
 
 			param.paramType = RSN_WPA_PROMOTE_OPTIONS;	
            	param.content.rsnWPAPromoteFlags = ADMCTRL_WPA_OPTION_ENABLE_PROMOTE_AUTH_MODE;
@@ -753,6 +752,9 @@
             powerMgr_setParam(pSiteMgr->hPowerMgr,&param);
 		}
 
+        /* Update the FW prob request templates to reflect the new WSC state */
+        setDefaultProbeReqTemplate (hSiteMgr);
+
         /* update the SME on the WPS mode */
         param.paramType = SME_WSC_PB_MODE_PARAM;
         sme_SetParam (pSiteMgr->hSmeSm, &param);
@@ -981,7 +983,7 @@
             TWD_CmdTemplate (pSiteMgr->hTWD, &templateStruct, NULL, NULL);
 
             /* configuring the IP to 0.0.0.0 by app means disable filtering */
-            if ((staIp[0] | staIp[0] | staIp[1] | staIp[0]) == 0) 
+            if ((staIp[0] | staIp[1] | staIp[2] | staIp[3]) == 0) 
             {
                 filterType = ArpFilterDisabled;
             }
@@ -2580,14 +2582,12 @@
 ************************************************************************/
 static void updateWSCParams(siteMgr_t *pSiteMgr, siteEntry_t *pSite, mlmeFrameInfo_t *pFrameInfo)
 {
-   int res;
-
    TRACE6(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "updateWSCParams called (BSSID: %X-%X-%X-%X-%X-%X)\n",pSite->bssid[0], pSite->bssid[1], pSite->bssid[2], pSite->bssid[3], pSite->bssid[4], pSite->bssid[5]);
 
 	/* if the IE is not null => the WSC is on - check which method is supported */
 	if (pFrameInfo->content.iePacket.WSCParams  != NULL)
 	{
-         res = parseWscMethodFromIE (pSiteMgr, pFrameInfo->content.iePacket.WSCParams, &pSite->WSCSiteMode);
+         parseWscMethodFromIE (pSiteMgr, pFrameInfo->content.iePacket.WSCParams, &pSite->WSCSiteMode);
 
          TRACE1(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "pSite->WSCSiteMode = %d\n",pSite->WSCSiteMode);
 	}
@@ -2604,7 +2604,7 @@
    TI_UINT16   tlvPtrType,tlvPtrLen,selectedMethod=0;
 
    tlvPtr = (TI_UINT8*)WSCParams->WSCBeaconOrProbIE;
-   endPtr = tlvPtr + WSCParams->hdr[1] - (DOT11_OUI_LEN + 1);
+   endPtr = tlvPtr + WSCParams->hdr[1] - DOT11_OUI_LEN;
 
    do
    {
@@ -3136,8 +3136,7 @@
 ************************************************************************/
 static ERate translateRateMaskToValue(siteMgr_t *pSiteMgr, TI_UINT32 rateMask)
 {
- /* MODS_BEGIN_FOR_11N_RATE_REPORTING */
-    if (rateMask & DRV_RATE_MASK_MCS_7_OFDM)
+	if (rateMask & DRV_RATE_MASK_MCS_7_OFDM)
         return DRV_RATE_MCS_7;
     if (rateMask & DRV_RATE_MASK_MCS_6_OFDM)
         return DRV_RATE_MCS_6;
@@ -3153,7 +3152,6 @@
         return DRV_RATE_MCS_1;
     if (rateMask & DRV_RATE_MASK_MCS_0_OFDM)
         return DRV_RATE_MCS_0;
-/* MODS_END_FOR_11N_RATE_REPORTING */
     if (rateMask & DRV_RATE_MASK_54_OFDM)
         return DRV_RATE_54M;
     if (rateMask & DRV_RATE_MASK_48_OFDM)
@@ -3608,8 +3606,6 @@
 TI_BOOL siteMgr_SelectRateMatch (TI_HANDLE hSiteMgr, TSiteEntry *pCurrentSite)
 {
     siteMgr_t *pSiteMgr = (siteMgr_t *)hSiteMgr;
-    TI_UINT32 MatchedBasicRateMask;
-    TI_UINT32 MatchedSupportedRateMask;
 	TI_UINT32 StaTotalRates;
 	TI_UINT32 SiteTotalRates;
 
@@ -3636,12 +3632,6 @@
 
 	SiteTotalRates = pCurrentSite->rateMask.basicRateMask | pCurrentSite->rateMask.supportedRateMask;
     
-	MatchedBasicRateMask = SiteTotalRates 
-				& pSiteMgr->pDesiredParams->siteMgrCurrentDesiredRateMask.basicRateMask;
- 
-    MatchedSupportedRateMask = SiteTotalRates &
-				pSiteMgr->pDesiredParams->siteMgrCurrentDesiredRateMask.supportedRateMask;
-
     if ((StaTotalRates & pCurrentSite->rateMask.basicRateMask) != pCurrentSite->rateMask.basicRateMask)
     {
         TRACE0(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "siteMgr_SelectRateMatch: Basic or Supported Rates Doesn't Match \n");
@@ -3722,30 +3712,23 @@
             pSiteMgr->pDesiredParams->siteMgrRegstrySuppRate[OperationMode] = SUPPORTED_RATE_SET_1_2_5_5_11;
     }
 
-/* MODS_BEGIN_FOR_11N_RATE_REPORTING */
-#if 0
     /* use HT MCS rates */
-    StaCap_IsHtEnable (pSiteMgr->hStaCap, &b11nEnable);
-#else
-    {
-        if (pSiteMgr->pDesiredParams->siteMgrDesiredBSSType == BSS_INFRASTRUCTURE)
-            b11nEnable = TI_TRUE;
-        else
-            b11nEnable = TI_FALSE;
-    }
-#endif
-/* MODS_END_FOR_11N_RATE_REPORTING */
-
-    if (TI_TRUE == b11nEnable)
-    {
-        OperationMode = DOT11_N_MODE;
-    }
+    if (pSiteMgr->pDesiredParams->siteMgrDesiredBSSType == BSS_INFRASTRUCTURE)
+	{
+		b11nEnable = TI_TRUE;
+		OperationMode = DOT11_N_MODE;
+	}
+	else
+	{
+		b11nEnable = TI_FALSE;
+	}
+    
 
     pSiteMgr->pDesiredParams->siteMgrRegstryBasicRateMask =
-        rate_BasicToDrvBitmap (pSiteMgr->pDesiredParams->siteMgrRegstryBasicRate[OperationMode], dot11a);
+        rate_BasicToDrvBitmap ((EBasicRateSet)(pSiteMgr->pDesiredParams->siteMgrRegstryBasicRate[OperationMode]), dot11a);
 
     pSiteMgr->pDesiredParams->siteMgrRegstrySuppRateMask =
-        rate_SupportedToDrvBitmap (pSiteMgr->pDesiredParams->siteMgrRegstrySuppRate[OperationMode], dot11a);
+        rate_SupportedToDrvBitmap ((EBasicRateSet)(pSiteMgr->pDesiredParams->siteMgrRegstrySuppRate[OperationMode]), dot11a);
 
     siteMgr_updateRates(pSiteMgr, dot11a, TI_TRUE);
 
diff --git a/wl1271/stad/src/Sta_Management/systemConfig.c b/wl1271/stad/src/Sta_Management/systemConfig.c
index 85d2fcd..37c3e42 100644
--- a/wl1271/stad/src/Sta_Management/systemConfig.c
+++ b/wl1271/stad/src/Sta_Management/systemConfig.c
@@ -1,7 +1,7 @@
 /*
  * systemConfig.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -184,7 +184,8 @@
 	if (OS_802_11_SSID_JUNK (pSsid->str, pSsid->len))
 		return NULL;
 
-	if (MAC_BROADCAST (pSiteMgr->pDesiredParams->siteMgrDesiredBSSID))
+	if ((MAC_BROADCAST (pSiteMgr->pDesiredParams->siteMgrDesiredBSSID)) ||
+		(BSS_INDEPENDENT == pSiteMgr->pDesiredParams->siteMgrDesiredBSSType))
 	{
 		MAC_COPY (bssid, pSiteMgr->ibssBssid);
 	}
@@ -280,7 +281,9 @@
 	if (rsnStatus == TWD_CIPHER_NONE)
 	{
 		frame.content.iePacket.capabilities |= (TI_FALSE << CAP_PRIVACY_SHIFT);
-	} else {
+	} 
+    else 
+    {
 		frame.content.iePacket.capabilities |= (TI_TRUE << CAP_PRIVACY_SHIFT);
 	}
 	
@@ -296,22 +299,15 @@
 	/* Build ssid */
 	os_memoryZero(pSiteMgr->hOs, (void *)ssid.serviceSetId, MAX_SSID_LEN);
 
-	if (pSiteMgr->pDesiredParams->siteMgrDesiredSSID.len == 0)
-		ssid.hdr[1] = 0;
-    /* It looks like it never happens. Anyway decided to check */
-    else  if ( pSiteMgr->pDesiredParams->siteMgrDesiredSSID.len > DOT11_SSID_MAX_LEN )
+    ssid.hdr[1] = pSiteMgr->pDesiredParams->siteMgrDesiredSSID.len;   
+    if (ssid.hdr[1] > MAX_SSID_LEN)
     {
-        TRACE2( pSiteMgr->hReport, REPORT_SEVERITY_ERROR,
+        TRACE2(pSiteMgr->hReport, REPORT_SEVERITY_ERROR,
                "sendProbeResponse. siteMgrDesiredSSID.len=%d exceeds the limit %d\n",
-                   pSiteMgr->pDesiredParams->siteMgrDesiredSSID.len, DOT11_SSID_MAX_LEN);
-        handleRunProblem(PROBLEM_BUF_SIZE_VIOLATION);
-        return TI_NOK;
+               pSiteMgr->pDesiredParams->siteMgrDesiredSSID.len, MAX_SSID_LEN);
+        ssid.hdr[1] = MAX_SSID_LEN;
     }
-	else
-	{
-		os_memoryCopy(pSiteMgr->hOs, (void *)ssid.serviceSetId, (void *)pSiteMgr->pDesiredParams->siteMgrDesiredSSID.str, pSiteMgr->pDesiredParams->siteMgrDesiredSSID.len);
-		ssid.hdr[1] = pSiteMgr->pDesiredParams->siteMgrDesiredSSID.len;
-	}
+    os_memoryCopy(pSiteMgr->hOs, (void *)ssid.serviceSetId, (void *)pSiteMgr->pDesiredParams->siteMgrDesiredSSID.str, ssid.hdr[1]);
 	
 	if(pSiteMgr->pDesiredParams->siteMgrDesiredChannel <= MAX_GB_MODE_CHANEL)
 		siteMgr_updateRates(pSiteMgr, TI_FALSE, TI_TRUE);
@@ -667,7 +663,7 @@
 	
 #ifdef XCC_MODULE_INCLUDED
 	/* set XCC TPC if present */
-	if(XCC_ParseClientTP(pSiteMgr->hOs,pPrimarySite,&ExternTxPower,pIeBuffer,PktLength) == TI_OK)
+	if(XCC_ParseClientTP(pSiteMgr->hOs,pPrimarySite,(TI_INT8 *)&ExternTxPower,pIeBuffer,PktLength) == TI_OK)
     {
         TRACE1(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "Select XCC_ParseClientTP == OK: Dbm = %d\n",ExternTxPower);
         pParam->paramType = REGULATORY_DOMAIN_EXTERN_TX_POWER_PREFERRED;
diff --git a/wl1271/stad/src/Sta_Management/templates.c b/wl1271/stad/src/Sta_Management/templates.c
index 43a3b95..c6d3d36 100644
--- a/wl1271/stad/src/Sta_Management/templates.c
+++ b/wl1271/stad/src/Sta_Management/templates.c
@@ -1,7 +1,7 @@
 /*
  * templates.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -229,7 +229,7 @@
 	TI_UINT32			 len = 0, ofdmIndex = 0;
 	TI_UINT32			 suppRatesLen, extSuppRatesLen;
 	TI_UINT8			 ratesBuf[DOT11_MAX_SUPPORTED_RATES];
-	TI_UINT8             WSCOuiIe[DOT11_OUI_LEN+1] = { 0x00, 0x50, 0xf2, 0x04};
+	TI_UINT8             WSCOuiIe[DOT11_OUI_LEN] = { 0x00, 0x50, 0xf2, 0x04};
 	TI_UINT32			 supportedRateMask,basicRateMask;	
 	TI_UINT16			 fc = DOT11_FC_PROBE_REQ;
 
@@ -287,15 +287,15 @@
     if (radioBand == RADIO_BAND_2_4_GHZ)
 	{
         /* Basic rates: 1,2,5.5,11 */  
-		basicRateMask = rate_BasicToDrvBitmap(pSiteMgr->pDesiredParams->siteMgrRegstryBasicRate[DOT11_G_MODE], TI_FALSE);
+		basicRateMask = rate_BasicToDrvBitmap((EBasicRateSet)(pSiteMgr->pDesiredParams->siteMgrRegstryBasicRate[DOT11_G_MODE]), TI_FALSE);
         /* Extended: 6,9,12,18,24,36,48,54 */
-        supportedRateMask = rate_SupportedToDrvBitmap(pSiteMgr->pDesiredParams->siteMgrRegstrySuppRate[DOT11_G_MODE], TI_FALSE);
+        supportedRateMask = rate_SupportedToDrvBitmap((ESupportedRateSet)(pSiteMgr->pDesiredParams->siteMgrRegstrySuppRate[DOT11_G_MODE]), TI_FALSE);
     }
     else if (radioBand == RADIO_BAND_5_0_GHZ)
     {   /* Basic rates: 6,12,24 */
-        basicRateMask = rate_BasicToDrvBitmap(pSiteMgr->pDesiredParams->siteMgrRegstryBasicRate[DOT11_A_MODE], TI_TRUE);
+        basicRateMask = rate_BasicToDrvBitmap((EBasicRateSet)(pSiteMgr->pDesiredParams->siteMgrRegstryBasicRate[DOT11_A_MODE]), TI_TRUE);
          /* Extended: 9,18,24,36,48,54 */
-        supportedRateMask = rate_SupportedToDrvBitmap(pSiteMgr->pDesiredParams->siteMgrRegstrySuppRate[DOT11_A_MODE], TI_TRUE);
+        supportedRateMask = rate_SupportedToDrvBitmap((ESupportedRateSet)(pSiteMgr->pDesiredParams->siteMgrRegstrySuppRate[DOT11_A_MODE]), TI_TRUE);
 	}
 	else
 	{
@@ -309,7 +309,8 @@
 	
 	rate_DrvBitmapToNetStr (supportedRateMask, basicRateMask, ratesBuf, &len, &ofdmIndex);
 
-TRACE5(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "buildProbeReqTemplate, supportedRateMask=0x%x, basicRateMask=0x%x, len=%d, ofdmIndex=%d, radioBand =%d\n",							 supportedRateMask,basicRateMask,len, ofdmIndex, radioBand);
+    TRACE5(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "buildProbeReqTemplate, supportedRateMask=0x%x, basicRateMask=0x%x, len=%d, ofdmIndex=%d, radioBand =%d\n",							 supportedRateMask,basicRateMask,len, ofdmIndex, radioBand);
+
     /* It looks like it never happens. Anyway decided to check */
     if ( len > DOT11_MAX_SUPPORTED_RATES )
     {
@@ -346,27 +347,25 @@
 
 
     /* add HT capabilities IE */
-    StaCap_GetHtCapabilitiesIe (pSiteMgr->hStaCap, pBuf, &len);
+    StaCap_GetHtCapabilitiesIe (pSiteMgr->hStaCap, (TI_UINT8 *)pBuf, &len);
     size += len;
     pBuf += len;
 
-
-	/* WiFi Simple Config */
-	if (pSiteMgr->includeWSCinProbeReq)
+    /* WiFi Simple Config */
+    if (pSiteMgr->includeWSCinProbeReq && (pSiteMgr->siteMgrWSCCurrMode != TIWLN_SIMPLE_CONFIG_OFF))
     {
-	if(pSiteMgr->siteMgrWSCCurrMode != TIWLN_SIMPLE_CONFIG_OFF)
-	{
-		 ((dot11_WSC_t *)(pBuf))->hdr[0] = DOT11_WSC_PARAM_ELE_ID;
-		 ((dot11_WSC_t *)(pBuf))->hdr[1] = DOT11_WSC_PROBE_REQ_MAX_LENGTH + DOT11_OUI_LEN + 1;
-         pBuf += sizeof(dot11_eleHdr_t);
-         /* This looks like a typo: 5 bytes are copied from an array of 4 bytes. Then the last byte is overriten by the next command 
-         os_memoryCopy(pSiteMgr->hOs, pBuf, &WSCOuiIe, DOT11_OUI_LEN+2);*/
-         os_memoryCopy(pSiteMgr->hOs, pBuf, &WSCOuiIe, DOT11_OUI_LEN+1);
-		 os_memoryCopy(pSiteMgr->hOs, pBuf + DOT11_OUI_LEN+1, &pSiteMgr->siteMgrWSCProbeReqParams, DOT11_WSC_PROBE_REQ_MAX_LENGTH - (DOT11_OUI_LEN+2));
-		 size += sizeof(dot11_eleHdr_t) + DOT11_WSC_PROBE_REQ_MAX_LENGTH + DOT11_OUI_LEN + 1;
-		 pBuf += sizeof(dot11_eleHdr_t) + DOT11_WSC_PROBE_REQ_MAX_LENGTH + DOT11_OUI_LEN + 1;	
-	  }
-	}
+        ((dot11_WSC_t *)pBuf)->hdr[0] = DOT11_WSC_PARAM_ELE_ID;
+        ((dot11_WSC_t *)pBuf)->hdr[1] = pSiteMgr->uWscIeSize + DOT11_OUI_LEN;
+        pBuf += sizeof(dot11_eleHdr_t);
+        os_memoryCopy(pSiteMgr->hOs, pBuf, &WSCOuiIe, DOT11_OUI_LEN);
+        os_memoryCopy(pSiteMgr->hOs, 
+                      pBuf + DOT11_OUI_LEN, 
+                      &pSiteMgr->siteMgrWSCProbeReqParams, 
+                      pSiteMgr->uWscIeSize);
+        size += sizeof(dot11_eleHdr_t) + pSiteMgr->uWscIeSize + DOT11_OUI_LEN;
+        pBuf += sizeof(dot11_eleHdr_t) + pSiteMgr->uWscIeSize + DOT11_OUI_LEN;	
+    }
+
 	pTemplate->len = size;
 	
 	return TI_OK;
@@ -739,15 +738,18 @@
 
 
 /************************************************************************
- *                        buildArpRspTemplate								*
+ *                        buildArpRspTemplate							*
  ************************************************************************
-DESCRIPTION: This function build a ARP Response template to set to the HAL 
-				when joining an infrastructure network
-				performs the following:
-				-	Build a template & set the template len, the template type is set in the site mgr
-                                                                                                   
-INPUT:      pSiteMgr	-	Handle to site manager	
-			pTemplate	-	Pointer to the template structure		
+DESCRIPTION: This function builds an ARP Response template to set to 
+			 the HAL when joining an infrastructure network.
+
+             The function's steps:
+             - It builds the template & set the template len. 
+             - If QoS is inactive, it discards the QoS Control Field.
+             ** The template type is set in the site mgr.
+                                           
+INPUT:       pSiteMgr  - Handle to site manager.
+			 pTemplate - Pointer to the template structure.
 
 
 OUTPUT:		
@@ -758,53 +760,116 @@
 ************************************************************************/
 TI_STATUS buildArpRspTemplate(siteMgr_t *pSiteMgr, TSetTemplate *pTemplate, TIpAddr staIp)
 {
-    ArpRspTemplate_t   *pBuffer = (ArpRspTemplate_t *)pTemplate->ptr;
-    paramInfo_t param;
-    TI_UINT16 fc; 
-    TI_UINT8 *ptr = (TI_UINT8 *)pBuffer;
-    TI_UINT16 offset, len;
-    
-    os_memoryZero(pSiteMgr->hOs, pBuffer, sizeof(ArpRspTemplate_t));
-    /* Fill the WLAN header fields as in the NULL template */
-    buildQosNullDataTemplate(pSiteMgr, pTemplate, 0 /* userPriority*/);
-    /* overwrite the fc bytes by data_QOS */
-    fc = DOT11_FC_DATA_QOS | (1 << DOT11_FC_TO_DS_SHIFT);
-	COPY_WLAN_WORD(&pBuffer->hdr.fc, &fc); /* copy with endianess handling. */
+	siteEntry_t		   *pPrimarySite = pSiteMgr->pSitesMgmtParams->pPrimarySite;
+	ArpRspTemplate_t   *pBuffer      = (ArpRspTemplate_t *)pTemplate->ptr;
+	TI_UINT8           *ptr          = (TI_UINT8 *)pBuffer;
 
-    pBuffer->LLC.DSAP = 0xaa;
-    pBuffer->LLC.SSAP = 0xaa;
+	paramInfo_t         param;          /* To get Site and QoS params */
+	TI_UINT16           fc;             /* Frame Control field in MAC header */
+	TI_UINT16           macAddrItr;
+	TI_BOOL   			privacyInvoked;
+	TI_UINT8  			encryptionFieldSize, copyPayloadOffset, lenToCopy;
+
+
+
+	/* Reset the buffer */
+	os_memoryZero(pSiteMgr->hOs, pBuffer, sizeof(ArpRspTemplate_t));
+
+
+	/* Turn on the To_DS bit in the Frame Control field */
+	fc = (1 << DOT11_FC_TO_DS_SHIFT);
+
+    /* Set MAC header address fields:
+		-----------------------------
+		Since To_DS is on and From_DS is off the address meaning is as follows:
+		Address1 - BSSID
+		Address2 - Source Address
+		Address3 - Destination Address
+		Address4 - Not present */
+
+	/* - Set BSSID */
+    if (pPrimarySite)
+	{
+		MAC_COPY (pBuffer->hdr.address1, pPrimarySite->bssid);
+	}
+	else
+	{
+		TRACE0(pSiteMgr->hReport, REPORT_SEVERITY_INFORMATION, "No Primary site so cannot fill QosNullData template.\n");
+	}
+    /* - Set Source Address */
+    param.paramType = CTRL_DATA_MAC_ADDRESS;
+    ctrlData_getParam(pSiteMgr->hCtrlData, &param);
+	MAC_COPY (pBuffer->hdr.address2, param.content.ctrlDataDeviceMacAddress);
+	/* - Set Destination Address: ARP response should be sent with broadcast DA - Set accordingly */
+	for (macAddrItr = 0; macAddrItr < MAC_ADDR_LEN; macAddrItr++)
+    {
+        pBuffer->hdr.address3[macAddrItr] = 0xFF;
+    }
+
+    pBuffer->LLC.DSAP    = 0xaa;
+    pBuffer->LLC.SSAP    = 0xaa;
     pBuffer->LLC.Control = 0x03;
-    /* pBuffer->LLC.Control.OUI these 3 bytes are zeroed already */
-    pBuffer->LLC.Type = WLANTOHS((TI_UINT16)0x806);
 
+	/* pBuffer->LLC.Control.OUI these 3 bytes are zeroed already */
+    pBuffer->LLC.Type = WLANTOHS((TI_UINT16)0x806);
     pBuffer->hardType = WLANTOHS((TI_UINT16)1);
     pBuffer->protType = WLANTOHS((TI_UINT16)0x800);
     pBuffer->hardSize = 6;
     pBuffer->protSize = 4;
-    pBuffer->op = WLANTOHS((TI_UINT16)2); /*filled as for ARP-RSP, not for RARP_RSP */
-    MAC_COPY (pBuffer->StaMac, pBuffer->hdr.address2);
+    pBuffer->op       = WLANTOHS((TI_UINT16)2); /*filled as for ARP-RSP, not for RARP_RSP */
+
+	MAC_COPY(pBuffer->StaMac, pBuffer->hdr.address2);
     IP_COPY(pBuffer->StaIp, staIp);
     
     pTemplate->len = sizeof(ArpRspTemplate_t);
 
-    /* Get QoS type */
+
+	/* Get encryption status */
+    txCtrlParams_getCurrentEncryptionInfo (pSiteMgr->hTxCtrl,  &privacyInvoked, &encryptionFieldSize);
+
+    /* If no encryption is used, encryptionFieldSize has garbage value */
+    encryptionFieldSize = privacyInvoked ? encryptionFieldSize : 0;
+
+	/* Set the subtype field of fc with WEP_BIT */
+	fc |= (privacyInvoked << DOT11_FC_WEP_SHIFT);
+	
+
+    /* Get QoS type to check if QoS is active */
     param.paramType = QOS_MNGR_ACTIVE_PROTOCOL;
     qosMngr_getParams(pSiteMgr->hQosMngr, &param);
 
-    if(param.content.qosSiteProtocol == QOS_NONE)
+
+    if(param.content.qosSiteProtocol == QOS_NONE)   /* QoS is not active */
     {
-        /* if QOS is inactive the QoS Control field MUST be absent.
-           Remove the field and move the rest of the packet accordingly */
-        offset = sizeof(dot11_header_t);
-        len = sizeof(ArpRspTemplate_t) - sizeof(dot11_header_t);
-        ptr= (TI_UINT8 *)&pBuffer->LLC.DSAP;
-        /* hope this will work in spite of buffers overlap */
-        os_memoryCopy(pSiteMgr->hOs, ptr-2, ptr, len);
-        pTemplate->len -=2;
+		copyPayloadOffset = sizeof(pBuffer->hdr.qosControl) + AES_AFTER_HEADER_FIELD_SIZE - encryptionFieldSize;
+        /* Set the subtype field of fc with DATA value (non Qos) */
+        fc |= DOT11_FC_DATA;
     }
-     return TI_OK;
-} 
-   
+    else    /* QoS is active */
+    {
+		copyPayloadOffset = AES_AFTER_HEADER_FIELD_SIZE - encryptionFieldSize;
+        /* Set the subtype field of fc with DATA_QOS */
+        fc |= DOT11_FC_DATA_QOS;
+    }
+
+        
+    /* Need to copy backward to overwrite security or QoS offset */
+    if (copyPayloadOffset > 0)   
+    {  
+		ptr = (TI_UINT8 *)&pBuffer->LLC.DSAP;
+        /* Copy back the actual payload without header & security */
+        lenToCopy = sizeof(ArpRspTemplate_t) - sizeof(dot11_header_t) - AES_AFTER_HEADER_FIELD_SIZE;
+
+        os_memoryCopy(pSiteMgr->hOs, ptr - copyPayloadOffset, ptr, lenToCopy);  
+        pTemplate->len -= copyPayloadOffset;   
+    }
+
+
+    COPY_WLAN_WORD(&pBuffer->hdr.fc, &fc); /* copy with endianess handling. */
+
+	return TI_OK;
+}
+
    
    
    
diff --git a/wl1271/stad/src/Sta_Management/trafficAdmControl.c b/wl1271/stad/src/Sta_Management/trafficAdmControl.c
index 8ccabc2..180117f 100644
--- a/wl1271/stad/src/Sta_Management/trafficAdmControl.c
+++ b/wl1271/stad/src/Sta_Management/trafficAdmControl.c
@@ -1,7 +1,7 @@
 /*
  * trafficAdmControl.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -1167,7 +1167,7 @@
 							   TI_UINT32		*len)
 {
 	tsInfo_t			tsInfo;
-	TI_UINT16		nominalMSDUSize;
+	TI_UINT16		nominalMSDUSize, maxMSDUSize;
 	TI_UINT32		suspensionInterval = 0;   /* disable */
 
 
@@ -1219,8 +1219,10 @@
     if (pTrafficAdmCtrl->useFixedMsduSize)
 		nominalMSDUSize |= FIX_MSDU_SIZE;
 
+    maxMSDUSize = (nominalMSDUSize & (~FIX_MSDU_SIZE));
+    
 	COPY_WLAN_WORD(pDataBuf,      &nominalMSDUSize);			/* Nominal-MSDU-size. */
-	COPY_WLAN_WORD(pDataBuf +  2, &nominalMSDUSize);			/* Maximum-MSDU-size. */
+	COPY_WLAN_WORD(pDataBuf +  2, &maxMSDUSize);			    /* Maximum-MSDU-size. */
 	COPY_WLAN_LONG(pDataBuf +  4, &pTSpecInfo->uMinimumServiceInterval); /* Minimum service interval */
 	COPY_WLAN_LONG(pDataBuf +  8, &pTSpecInfo->uMaximumServiceInterval); /* Maximum service interval */
 	COPY_WLAN_LONG(pDataBuf + 16, &suspensionInterval);
diff --git a/wl1271/utils/802_11Defs.h b/wl1271/utils/802_11Defs.h
index 3b53369..1895af0 100644
--- a/wl1271/utils/802_11Defs.h
+++ b/wl1271/utils/802_11Defs.h
@@ -1,7 +1,7 @@
 /*
  * 802_11Defs.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -48,7 +48,7 @@
 #include "osDot11XCC.h"
 #endif
 
-#define DOT11_OUI_LEN                       3
+#define DOT11_OUI_LEN                       4
 #define DOT11_COUNTRY_STRING_LEN            3
 #define DOT11_MAX_SUPPORTED_RATES           32
 
@@ -457,12 +457,12 @@
 #define DOT11_SSID_ELE_ID   0
 
 /* Max SSID length */
-#define DOT11_SSID_MAX_LEN  32
+#define MAX_SSID_LEN        32
 
 typedef struct 
 {
-  dot11_eleHdr_t    hdr;
-  char              serviceSetId[DOT11_SSID_MAX_LEN];
+    dot11_eleHdr_t    hdr;
+    char              serviceSetId[MAX_SSID_LEN];
 }  dot11_SSID_t;
 
 
@@ -504,7 +504,6 @@
 #define TKIP_AFTER_HEADER_FIELD_SIZE (IV_FIELD_SIZE + EIV_FIELD_SIZE)
 #define AES_AFTER_HEADER_FIELD_SIZE  8
 
-
 /* DS params Information Element */
 #define DOT11_DS_PARAMS_ELE_ID      3
 #define DOT11_DS_PARAMS_ELE_LEN     1
@@ -1043,7 +1042,7 @@
                                          sizeof( dot11_RATES_t ) +
                                          sizeof( dot11_RATES_t ) +
                                          sizeof( Tdot11HtCapabilitiesUnparse ) +
-                                         sizeof( DOT11_WSC_PROBE_REQ_MAX_LENGTH ) +
+                                         DOT11_WSC_PROBE_REQ_MAX_LENGTH +
                                          sizeof( XCC_radioManagmentCapability_IE_t )
                                         ];
     } probeReqTemplate_t;
@@ -1057,7 +1056,7 @@
                                          sizeof( dot11_RATES_t ) +
                                          sizeof( dot11_RATES_t ) +
                                          sizeof( Tdot11HtCapabilitiesUnparse ) +
-                                         sizeof( DOT11_WSC_PROBE_REQ_MAX_LENGTH )
+                                         DOT11_WSC_PROBE_REQ_MAX_LENGTH
                                         ];
     } probeReqTemplate_t;
 
@@ -1091,6 +1090,7 @@
 typedef struct
 {
     dot11_header_t   hdr;
+	TI_UINT8 	securityOverhead[AES_AFTER_HEADER_FIELD_SIZE];
     Wlan_LlcHeader_T LLC;
     TI_UINT16 hardType;
     TI_UINT16 protType;
diff --git a/wl1271/utils/CmdInterfaceCodes.h b/wl1271/utils/CmdInterfaceCodes.h
index 82cccf2..ce579db 100644
--- a/wl1271/utils/CmdInterfaceCodes.h
+++ b/wl1271/utils/CmdInterfaceCodes.h
@@ -1,7 +1,7 @@
 /*
  * CmdInterfaceCodes.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -282,7 +282,7 @@
 																										* Allocate Bit: OFF	\n
 																										* GET Bit: ON	\n
 																										* SET Bit: ON	\n
-*/
+																										*/
     
     SITE_MGRT_SET_RATE_MANAGMENT             = SET_BIT | SITE_MGR_MODULE_PARAM | 0x06 ,                 /**< Site Manager Desired Preamble Type Parameter (Site Manager Module Set/Get Command): \n 
                                                                                                         * Used for Setting/Getting Desired Preamble Type to/from OS abstraction layer\n
@@ -308,7 +308,7 @@
 */
 
 
-
+																									   
 	SITE_MGR_CURRENT_CHANNEL_PARAM              = 	SET_BIT | GET_BIT | SITE_MGR_MODULE_PARAM | 0x0E,	/**< Site Manager Current Channel Parameter (Site Manager Module Set/Get Command): \n 
 																										* Used for Setting/Getting Current Channel to/from OS abstraction layer\n
 																										* Done Sync with no memory allocation\n 
@@ -452,9 +452,9 @@
 																										* GET Bit: ON	\n
 																										* SET Bit: OFF	\n
 																										*/
-    SITE_MGR_SET_WLAN_IP_PARAM				=             SET_BIT | SITE_MGR_MODULE_PARAM | 0x43,	/**< Site Manager WLAN interface IP Parameter (Site Manager Module Set Command): \n
+    SITE_MGR_SET_WLAN_IP_PARAM				=             SET_BIT | SITE_MGR_MODULE_PARAM | 0x43,	/**< Site Manager WLAN interface IP Parameter (Site Manager Module Set Command): \n  
 																										* Used for Setting the WLAN interface IP from OS abstraction layer\n
-																										* Done Sync with no memory allocation\n
+																										* Done Sync with no memory allocation\n 
 																										* Parameter Number:	0x43	\n
 																										* Module Number: Site Manager Module Number \n
 																										* Async Bit: OFF	\n
@@ -638,7 +638,7 @@
 																														* GET Bit: OFF	\n
 																														* SET Bit: ON	\n
 																														*/
-    SCAN_CNCN_BSSID_LIST_SIZE_PARAM             =   GET_BIT |           SCAN_CNCN_PARAM | 0x06,							/**< Scan Concentrator BSSID List Size Parameter (Scan Concentrator Module Get Command): \n  
+	SCAN_CNCN_NUM_BSSID_IN_LIST_PARAM           =   GET_BIT |           SCAN_CNCN_PARAM | 0x06,							/**< Scan Concentrator BSSID List Size Parameter (Scan Concentrator Module Get Command): \n  
 																														* Used for retrieving the size to allocate for the application scan result list\n
 																														* Done Sync with no memory allocation\n 
 																														* Parameter Number:	0x06	\n
@@ -648,7 +648,17 @@
 																														* GET Bit: ON	\n
 																														* SET Bit: OFF	\n
 																														*/
-    SCAN_CNCN_BSSID_LIST_PARAM                  =   GET_BIT |           SCAN_CNCN_PARAM | 0x07,							/**< Scan Concentrator BSSID List Parameter (Scan Concentrator Module Get Command): \n  
+    SCAN_CNCN_BSSID_LIST_SIZE_PARAM             =   GET_BIT |           SCAN_CNCN_PARAM | 0x07,							/**< Scan Concentrator BSSID List Size Parameter (Scan Concentrator Module Get Command): \n  
+																														* Used for retrieving the size to allocate for the application scan result list\n
+																														* Done Sync with no memory allocation\n 
+																														* Parameter Number:	0x06	\n
+																														* Module Number: Scan Concentrator Module Number \n
+																														* Async Bit: OFF	\n
+																														* Allocate Bit: OFF	\n
+																														* GET Bit: ON	\n
+																														* SET Bit: OFF	\n
+																														*/
+    SCAN_CNCN_BSSID_LIST_PARAM                  =   GET_BIT |           SCAN_CNCN_PARAM | 0x08,							/**< Scan Concentrator BSSID List Parameter (Scan Concentrator Module Get Command): \n  
 																														* Used for retrieving the application scan result table\n
 																														* Done Sync with no memory allocation\n 
 																														* Parameter Number:	0x07	\n
@@ -658,6 +668,35 @@
 																														* GET Bit: ON	\n
 																														* SET Bit: OFF	\n
 																														*/
+	SCAN_CNCN_BSSID_RATE_LIST_PARAM             =   GET_BIT |           SCAN_CNCN_PARAM | 0x09,							/**< Scan Concentrator Rate List Parameter (Scan Concentrator Module Get Command): \n  
+																														* Used for retrieving the application scan rates result table\n
+																														* Done Sync with no memory allocation\n 
+																														* Parameter Number:	0x08	\n
+																														* Module Number: Scan Concentrator Module Number \n
+																														* Async Bit: OFF	\n
+																														* Allocate Bit: OFF	\n
+																														* GET Bit: ON	\n
+																														* SET Bit: OFF	\n
+																														*/
+    SCAN_CNCN_SET_SRA                           =   SET_BIT |           SCAN_CNCN_PARAM | 0x0A,                         /**< Scan Concentrator set scan result aging (Scan Concentrator Module Get Command): \n  
+																														* Used for aging threshold\n
+																														* Parameter Number:	0x09	\n
+																														* Module Number: Scan Concentrator Module Number \n
+																														* Async Bit: OFF	\n
+																														* Allocate Bit: OFF	\n
+																														* GET Bit: OFF	\n
+																														* SET Bit: ON	\n
+																														*/
+
+    SCAN_CNCN_SET_RSSI                          =   SET_BIT |           SCAN_CNCN_PARAM | 0x0B,                         /**< Scan Concentrator set rssi filter threshold (Scan Concentrator Module Get Command): \n  
+																														* Used for rssi threshold\n
+																														* Parameter Number:	0x0A	\n
+																														* Module Number: Scan Concentrator Module Number \n
+																														* Async Bit: OFF	\n
+																														* Allocate Bit: OFF	\n
+																														* GET Bit: OFF	\n
+																														* SET Bit: ON	\n
+																														*/
 
 	/* Scan Manager module */
     SCAN_MNGR_SET_CONFIGURATION                 =	SET_BIT |           SCAN_MNGR_PARAM | 0x01 | ALLOC_NEEDED_PARAM,	/**< Scan Manager Set Configuration Parameter (Scan Manager Module Set Command): \n  
@@ -957,7 +996,7 @@
 
     RSN_SET_PROTECTION_RX_PARAM					=	SET_BIT | RSN_MODULE_PARAM | ASYNC_PARAM | 0x0C,					        /**< Robust Security NW (RSN) Set Protection RX Parameter (RSN Module Set/Get Command): \n  
                                                                                                                                 * Used for setting protection for RX during external RSN mode to RSN Module\n
-                                                                                                                                * Done ASync with no memory allocation\n
+                                                                                                                                * Done ASync with no memory allocation\n 
                                                                                                                                 * Parameter Number:	0x0C	\n
                                                                                                                                 * Module Number: RSN Module Number \n
                                                                                                                                 * Async Bit: ON	\n
@@ -967,9 +1006,9 @@
                                                                                                                                 */
 
 
-    RSN_SET_PROTECTION_RX_TX_PARAM					=	SET_BIT | RSN_MODULE_PARAM | 0x0D,							            /**< Robust Security NW (RSN) Set Protection RX TX Parameter (RSN Module Set/Get Command): \n
+    RSN_SET_PROTECTION_RX_TX_PARAM					=	SET_BIT | RSN_MODULE_PARAM | 0x0D,							            /**< Robust Security NW (RSN) Set Protection RX TX Parameter (RSN Module Set/Get Command): \n  
                                                                                                                                 * Used for setting protection for both RX and TX during external RSN mode to RSN Module\n
-                                                                                                                                * Done Sync with no memory allocation\n
+                                                                                                                                * Done Sync with no memory allocation\n 
                                                                                                                                 * Parameter Number:	0x0C	\n
                                                                                                                                 * Module Number: RSN Module Number \n
                                                                                                                                 * Async Bit: OFF	\n
@@ -978,9 +1017,9 @@
                                                                                                                                 * SET Bit: ON	\n
                                                                                                                                 */
 
-    RSN_PORT_STATUS_PARAM		 			    =	SET_BIT | GET_BIT | RSN_MODULE_PARAM | 0x0D,							    /**< Robust Security NW (RSN)  Port Status (RSN Module Set/Get Command): \n
+    RSN_PORT_STATUS_PARAM		 			    =	SET_BIT | GET_BIT | RSN_MODULE_PARAM | 0x0D,							    /**< Robust Security NW (RSN)  Port Status (RSN Module Set/Get Command): \n  
                                                                                                                                 * Used for setting port status during external RSN mode to RSN Module\n
-                                                                                                                                * Done Sync with no memory allocation\n
+                                                                                                                                * Done Sync with no memory allocation\n 
                                                                                                                                 * Parameter Number:	0x0D	\n
                                                                                                                                 * Module Number: RSN Module Number \n
                                                                                                                                 * Async Bit: OFF	\n
@@ -989,9 +1028,9 @@
                                                                                                                                 * SET Bit: ON	\n
                                                                                                                                 */
 
-    RSN_GENERIC_IE_PARAM		 			      = SET_BIT           | RSN_MODULE_PARAM | 0x0E,							    /**< Robust Security NW (RSN)  Generic IE (RSN Module Set Command): \n
+    RSN_GENERIC_IE_PARAM		 			      = SET_BIT           | RSN_MODULE_PARAM | 0x0E,							    /**< Robust Security NW (RSN)  Generic IE (RSN Module Set Command): \n  
                                                                                                                                 * Used for setting the Generic IE passed to the AP during association to RSN Module\n
-                                                                                                                                * Done Sync with no memory allocation\n
+                                                                                                                                * Done Sync with no memory allocation\n 
                                                                                                                                 * Parameter Number:	0x0E	\n
                                                                                                                                 * Module Number: RSN Module Number \n
                                                                                                                                 * Async Bit: OFF	\n
@@ -1000,9 +1039,9 @@
                                                                                                                                 * SET Bit: ON	\n
                                                                                                                                 */
 
-    RSN_EXTERNAL_MODE_PARAM		 			      =          SET_BIT | GET_BIT | RSN_MODULE_PARAM | 0x0F,							    /**< Robust Security NW (RSN)  External Mode Parameter: \n
+    RSN_EXTERNAL_MODE_PARAM		 			      =          SET_BIT | GET_BIT | RSN_MODULE_PARAM | 0x0F,							    /**< Robust Security NW (RSN)  External Mode Parameter: \n  
                                                                                                                                 * Used for getting the RSN External Mode\n
-                                                                                                                                * Done Sync with no memory allocation\n
+                                                                                                                                * Done Sync with no memory allocation\n 
                                                                                                                                 * Parameter Number:     0x0F    \n
                                                                                                                                 * Module Number: RSN Module Number \n
                                                                                                                                 * Async Bit: OFF        \n
@@ -1011,9 +1050,9 @@
                                                                                                                                 * SET Bit: ON   \n
                                                                                                                                 */
 
-    RSN_GEM_DATA_PARAM                                                =                     RSN_MODULE_PARAM | 0x10,                                                        /**< Robust Security NW (RSN)  External Mode Parameter: \n
+    RSN_GEM_DATA_PARAM                                                =                     RSN_MODULE_PARAM | 0x10,                                                        /**< Robust Security NW (RSN)  External Mode Parameter: \n  
                                                                                                                                 * Used for setting GEM data\n
-                                                                                                                                * Done Sync with no memory allocation\n
+                                                                                                                                * Done Sync with no memory allocation\n 
                                                                                                                                 * Parameter Number:     0x10    \n
                                                                                                                                 * Module Number: RSN Module Number \n
                                                                                                                                 * Async Bit: OFF	\n
@@ -1076,7 +1115,7 @@
 																																				* GET Bit: ON	\n
 																																				* SET Bit: ON	\n
 																																				*/
-
+	
 	TWD_FM_COEX_PARAM               						=   SET_BIT |    TWD_MODULE_PARAM | TWD_FM_COEX_PARAM_ID,	                        /**< TWD Control FM-Coexistence Parameters (TWD Control Module Set/Get Command): \n  
 																																				* Used for setting the FM-Coexistence Parameters\n
 																																				* Done Async with no memory allocation\n 
@@ -1088,9 +1127,9 @@
 																																				* SET Bit: ON	\n
 																																				*/
 
-    TWD_DCO_ITRIM_PARAMS                			=   SET_BIT | GET_BIT | TWD_MODULE_PARAM | TWD_DCO_ITRIM_PARAMS_ID,		/**< TWD Control DCO Itrim Parameters (TWD Control Module Set/Get Command): \n
+    TWD_DCO_ITRIM_PARAMS                			=   SET_BIT | GET_BIT | TWD_MODULE_PARAM | TWD_DCO_ITRIM_PARAMS_ID,		/**< TWD Control DCO Itrim Parameters (TWD Control Module Set/Get Command): \n  
 																																* Used for getting DCO Itrim Parameters from TWD Control Module or setting DCO Itrim Parameters to FW and TWD Control Module\n
-																																* Done Sync with no memory allocation\n
+																																* Done Sync with no memory allocation\n 
 																																* Parameter Number:	TWD_DCO_ITRIM_PARAMS_ID	\n
 																																* Module Number: TWD Control Module Number \n
 																																* Async Bit: OFF	\n
@@ -1098,7 +1137,7 @@
 																																* GET Bit: ON	\n
 																																* SET Bit: ON	\n
 																																*/
-	/* Roaming manager */
+    /* Roaming manager */
     ROAMING_MNGR_APPLICATION_CONFIGURATION		= 	SET_BIT | GET_BIT | ROAMING_MANAGER_MODULE_PARAM | 0x01,	/**< Roaming Manager Application Configuration Parameter (Roaming Manager Module Set/Get Command): \n  
 																												* Used for setting/getting Roaming Manager Application Configuration to/from Roaming Manager Module and State-Machine\n
 																												* Done Sync with no memory allocation\n 
diff --git a/wl1271/utils/GenSM.c b/wl1271/utils/GenSM.c
index 2527e3b..9c9c4ef 100644
--- a/wl1271/utils/GenSM.c
+++ b/wl1271/utils/GenSM.c
@@ -149,7 +149,6 @@
 void genSM_Event (TI_HANDLE hGenSM, TI_UINT32 uEvent, void *pData)
 {
     TGenSM              *pGenSM =       (TGenSM*)hGenSM;
-    TI_UINT32           uCurrentState;
     TGenSM_actionCell   *pCell;
 
 	if (pGenSM == NULL)
@@ -200,9 +199,6 @@
         /* mark that pending event is being handled */
         pGenSM->bEventPending = TI_FALSE;
         
-        /* keep current state */
-        uCurrentState = pGenSM->uCurrentState;
-
         /* update current state */
         pGenSM->uCurrentState = pCell->uNextState;
 
diff --git a/wl1271/utils/osDot11.h b/wl1271/utils/osDot11.h
index cc7cc25..ec1e2cc 100644
--- a/wl1271/utils/osDot11.h
+++ b/wl1271/utils/osDot11.h
@@ -1,7 +1,7 @@
 /*
  * osDot11.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -201,9 +201,9 @@
 /**/
 typedef TI_UINT8 OS_802_11_RATES[8];
 
-/* MODS_BEGIN_FOR_11N_RATE_REPORTING */
-typedef TI_UINT8 OS_802_11_RATES_EX[32];
-/* MODS_END_FOR_11N_RATE_REPORTING */
+typedef TI_UINT8 OS_802_11_RATES_EX[16];
+
+typedef TI_UINT8 OS_802_11_N_RATES[32];
 
 typedef struct _OS_802_11_FIXED_IEs 
 {
diff --git a/wl1271/utils/queue.c b/wl1271/utils/queue.c
index cce06d3..059a348 100644
--- a/wl1271/utils/queue.c
+++ b/wl1271/utils/queue.c
@@ -1,7 +1,7 @@
 /*
  * queue.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
diff --git a/wl1271/utils/rate.c b/wl1271/utils/rate.c
index fe5928a..bbccb2b 100644
--- a/wl1271/utils/rate.c
+++ b/wl1271/utils/rate.c
@@ -1,7 +1,7 @@
 /*
  * rate.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -152,7 +152,7 @@
     switch (rate)
     {
         case DRV_RATE_AUTO:
-            return 0;
+            return NET_RATE_AUTO;
 
         case DRV_RATE_1M:
             return NET_RATE_1M;
@@ -218,7 +218,7 @@
             return NET_RATE_MCS7;
 
         default:
-            return 0;
+            return NET_RATE_AUTO;
     }
 }
 
@@ -412,9 +412,9 @@
     
     for (i = 0; i < len; i++)
     {
-        if (NET_BASIC_RATE (pRatesString[i]) && rate_ValidateNet (pRatesString[i]) == TI_OK)
+        if (NET_BASIC_RATE (pRatesString[i]) && rate_ValidateNet ((ENetRate)pRatesString[i]) == TI_OK)
         {
-            eMaxRate = TI_MAX (pRatesString[i], eMaxRate);
+            eMaxRate = TI_MAX ((ENetRate)pRatesString[i], eMaxRate);
         }
     }
 
@@ -440,9 +440,9 @@
     
     for (i = 0; i < len; i++)
     {
-        if (NET_ACTIVE_RATE (pRatesString[i]) && rate_ValidateNet (pRatesString[i]) == TI_OK)
+        if (NET_ACTIVE_RATE (pRatesString[i]) && rate_ValidateNet ((ENetRate)pRatesString[i]) == TI_OK)
         {
-            eMaxRate = TI_MAX (pRatesString[i], eMaxRate);
+            eMaxRate = TI_MAX ((ENetRate)pRatesString[i], eMaxRate);
         }
     }
 
@@ -703,14 +703,38 @@
         }
     }
 
-/* 
- * Don't convert MCS rates, 
- * it is only for basic and extended rates, otherwise it will exceed 16 bytes string 
- * the code below is a sample and can be used in the future, if need to parse MCS rates bit map to string
- */
-/* MODS_BEGIN_FOR_11N_RATE_REPORTING */
-#if 1   // enable the 11n rate conversions
-/* MODS_END_FOR_11N_RATE_REPORTING */
+    *len = i;
+    
+    return TI_OK;
+}
+
+
+/************************************************************************
+ *                        bitMapToNetworkStringRates                    *
+ ************************************************************************
+DESCRIPTION: Converts bit map to the rates string
+                                                                                                   
+INPUT:      suppRatesBitMap     -   bit map of supported rates
+            basicRatesBitMap    -   bit map of basic rates
+
+OUTPUT:     string - network format rates array,
+            len - rates array length
+            firstOFDMrateLoc - the index of first OFDM rate in the rates array.
+
+
+RETURN:     None
+
+************************************************************************/
+TI_STATUS rate_DrvBitmapToNetStrIncluding11n (TI_UINT32   uSuppRatesBitMap,
+											  TI_UINT32   uBasicRatesBitMap,
+											  TI_UINT8    *string,
+											  TI_UINT32   *pFirstOfdmRate)
+{
+    TI_UINT32   i = 0;
+
+
+	rate_DrvBitmapToNetStr (uSuppRatesBitMap, uBasicRatesBitMap, string, &i, pFirstOfdmRate);
+
     if (uSuppRatesBitMap & DRV_RATE_MASK_MCS_0_OFDM)
     {
         if (uBasicRatesBitMap & DRV_RATE_MASK_MCS_0_OFDM)
@@ -806,8 +830,7 @@
             string[i++] = NET_RATE_MCS7;
         }
     }
-#endif
-    *len = i;
+
     
     return TI_OK;
 }
@@ -1204,7 +1227,7 @@
 
 TI_STATUS rate_PolicyToDrv (ETxRateClassId ePolicyRate, ERate *eAppRate)
 {
-    TI_UINT8     Rate = 0;
+    ERate     Rate = DRV_RATE_AUTO;
     TI_STATUS status = TI_OK;
 
     switch (ePolicyRate)
diff --git a/wl1271/utils/rate.h b/wl1271/utils/rate.h
index b0e587d..435d3d5 100644
--- a/wl1271/utils/rate.h
+++ b/wl1271/utils/rate.h
@@ -1,7 +1,7 @@
 /*
  * rate.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -47,6 +47,7 @@
 typedef enum
 {
     NET_BASIC_MASK      = 0x80,
+    NET_RATE_AUTO       = 0x00,
     NET_RATE_1M         = 0x02,
     NET_RATE_2M         = 0x04,
     NET_RATE_5_5M       = 0x0B,
@@ -153,6 +154,7 @@
 ERate     rate_NetToDrv (TI_UINT32 rate);
 ENetRate  rate_DrvToNet (ERate eRate);
 TI_STATUS rate_DrvBitmapToNetStr (TI_UINT32 uSuppRatesBitMap, TI_UINT32 uBasicRatesBitMap, TI_UINT8 *string, TI_UINT32 *len, TI_UINT32 *pFirstOfdmRate);
+TI_STATUS rate_DrvBitmapToNetStrIncluding11n (TI_UINT32 uSuppRatesBitMap, TI_UINT32 uBasicRatesBitMap, TI_UINT8 *string, TI_UINT32 *pFirstOfdmRate);
 TI_STATUS rate_NetStrToDrvBitmap (TI_UINT32 *pBitMap, TI_UINT8 *string, TI_UINT32 len);
 TI_STATUS rate_NetBasicStrToDrvBitmap (TI_UINT32 *pBitMap, TI_UINT8 *string, TI_UINT32 len);
 TI_STATUS rate_McsNetStrToDrvBitmap (TI_UINT32 *pBitMap, TI_UINT8 *string);
diff --git a/wl1271/utils/tiQosTypes.h b/wl1271/utils/tiQosTypes.h
index 7e79186..14b2428 100644
--- a/wl1271/utils/tiQosTypes.h
+++ b/wl1271/utils/tiQosTypes.h
@@ -1,7 +1,7 @@
 /*
  * tiQosTypes.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -43,7 +43,7 @@
 #define TI_QOS_TYPES_H
 
 
-#include "TWDriver.h"
+#define MAX_NUM_OF_802_1d_TAGS          8
 
 /*
  * This enum defines the protocol modes of the QOS management object
@@ -228,7 +228,7 @@
 typedef enum
 {
     ADDTS_RESPONSE_ACCEPT = 0,
-/*  ADDTS_RESPONSE_REJECT,  - according to the standard*/
+    ADDTS_RESPONSE_REJECT = 3,
     ADDTS_RESPONSE_AP_PARAM_INVALID = 253,
     ADDTS_RESPONSE_TIMEOUT = 254,
     TSPEC_DELETED_BY_AP = 255
diff --git a/wl1271/utils/tidef.h b/wl1271/utils/tidef.h
index ee825be..e06a186 100644
--- a/wl1271/utils/tidef.h
+++ b/wl1271/utils/tidef.h
@@ -1,7 +1,7 @@
 /*
  * tidef.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -71,11 +71,6 @@
  */
 #define TI_NOK                      1
 /**
- * \def TI_PENDING
- * \brief Pending return value
- */
-#define TI_PENDING					2
-/**
  * \def MAC_ADDR_LEN
  * \brief Length of Standart MAC address
  */
diff --git a/wl1271/utils/timer.c b/wl1271/utils/timer.c
index e5e474e..7be2426 100644
--- a/wl1271/utils/timer.c
+++ b/wl1271/utils/timer.c
@@ -1,7 +1,7 @@
 /*
  * timer.c
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -135,11 +135,7 @@
     {
         WLAN_OS_REPORT (("tmr_Destroy():  ERROR - Destroying Timer module but not all timers were destroyed!!\n"));
     }
-#if 0
-    /* Clear queues (critical section is used inside these functions) */
-    tmr_ClearInitQueue (hTimerModule);
-    tmr_ClearOperQueue (hTimerModule);
-#endif
+
     /* Destroy the module's queues (protect in critical section)) */
     context_EnterCriticalSection (pTimerModule->hContext);
     que_Destroy (pTimerModule->hInitQueue);
diff --git a/wl1271/utils/version.h b/wl1271/utils/version.h
index bf8edcb..4f0f058 100644
--- a/wl1271/utils/version.h
+++ b/wl1271/utils/version.h
@@ -1,7 +1,7 @@
 /*
  * version.h
  *
- * Copyright(c) 1998 - 2009 Texas Instruments. All rights reserved.      
+ * Copyright(c) 1998 - 2010 Texas Instruments. All rights reserved.      
  * All rights reserved.                                                  
  *                                                                       
  * Redistribution and use in source and binary forms, with or without    
@@ -43,11 +43,11 @@
 #ifndef _VERSION_H_                                                                                                             
 #define _VERSION_H_                                                                                                             
 
-#define SW_VERSION_STR      "WiLink_Driver_6.1.0.0.115"
+#define SW_VERSION_STR      "WiLink_Driver_6.1.0.0.131"
 
-#define SW_RELEASE_MONTH    11
-#define SW_RELEASE_DAY      10
-#define SW_RELEASE_YEAR     2009
+#define SW_RELEASE_MONTH    03
+#define SW_RELEASE_DAY      21
+#define SW_RELEASE_YEAR     2010
 
 #endif /* _VERSION_H_ */