From 5a0685583b9bf50548341815ee61cec53926ba01 Mon Sep 17 00:00:00 2001
From: Michael Benedict <michaelbt@live.com>
Date: Sat, 5 Oct 2019 20:03:32 +1000
Subject: [PATCH] source: G950FXXS5DSI1

Signed-off-by: Michael Benedict <michaelbt@live.com>
---
 .../exynos/battery_data_dreamlte_common.dtsi  |   1 +
 .../configs/exynos8895-dreamlte_defconfig     |   3 +
 drivers/android/Kconfig                       |  15 +-
 drivers/android/binder.c                      | 165 +++--
 drivers/android/binder_alloc.c                |  18 +-
 drivers/android/binder_alloc.h                |   2 +-
 .../battery_v2/include/charger/mfc_charger.h  |   2 +
 .../battery_v2/include/sec_charging_common.h  |   1 +
 drivers/battery_v2/mfc_charger.c              |  57 +-
 drivers/battery_v2/sec_battery.c              |  10 +
 drivers/clk/clk.c                             |   2 +-
 .../platform/exynos/gpu_custom_interface.c    |   4 +
 .../arm/b_r16p0/platform/exynos/gpu_pmqos.c   |   2 +
 drivers/net/wireless/bcmdhd4361/Kconfig       |  21 +-
 drivers/net/wireless/bcmdhd4361/Makefile      |  62 +-
 drivers/net/wireless/bcmdhd4361/Makefile.kk   |  53 +-
 drivers/net/wireless/bcmdhd4361/Makefile.lp   |  53 +-
 .../wireless/bcmdhd4361/bcmsdh_sdmmc_linux.c  |   8 +-
 drivers/net/wireless/bcmdhd4361/bcmutils.c    |  12 +-
 drivers/net/wireless/bcmdhd4361/dhd.h         | 116 ++--
 drivers/net/wireless/bcmdhd4361/dhd_common.c  |  23 +-
 .../net/wireless/bcmdhd4361/dhd_custom_sec.c  |  12 +-
 drivers/net/wireless/bcmdhd4361/dhd_linux.c   |  59 +-
 drivers/net/wireless/bcmdhd4361/dhd_linux.h   |   6 +-
 .../wireless/bcmdhd4361/dhd_linux_exportfs.c  |  37 +-
 drivers/net/wireless/bcmdhd4361/dhd_msgbuf.c  |   7 +-
 drivers/net/wireless/bcmdhd4361/dhd_pcie.c    |  67 +-
 .../net/wireless/bcmdhd4361/dhd_pcie_linux.c  |  12 +-
 drivers/net/wireless/bcmdhd4361/dhd_sdio.c    | 114 +++-
 .../bcmdhd4361/document/ChangeHistory.txt     |  88 ++-
 .../net/wireless/bcmdhd4361/include/802.11.h  |  26 +-
 .../wireless/bcmdhd4361/include/bcmevent.h    |  49 +-
 .../wireless/bcmdhd4361/include/bcmmsgbuf.h   |  87 ++-
 .../net/wireless/bcmdhd4361/include/bcmpcie.h |  15 +-
 .../wireless/bcmdhd4361/include/bcmutils.h    |  10 +-
 .../net/wireless/bcmdhd4361/include/eapol.h   |  86 ++-
 .../net/wireless/bcmdhd4361/include/epivers.h |  10 +-
 .../bcmdhd4361/include/event_log_payload.h    | 116 +++-
 .../bcmdhd4361/include/event_log_set.h        |  98 +--
 .../bcmdhd4361/include/event_log_tag.h        |  54 +-
 .../net/wireless/bcmdhd4361/include/fils.h    |  11 +
 drivers/net/wireless/bcmdhd4361/include/nan.h |  11 +-
 .../net/wireless/bcmdhd4361/include/wlioctl.h |  54 +-
 drivers/net/wireless/bcmdhd4361/include/wpa.h |   8 +-
 drivers/net/wireless/bcmdhd4361/linux_pkt.c   |  18 +-
 drivers/net/wireless/bcmdhd4361/wl_android.c  | 633 +++++++++++++++--
 drivers/net/wireless/bcmdhd4361/wl_android.h  |  11 +-
 drivers/net/wireless/bcmdhd4361/wl_cfg80211.c | 635 ++++++++++--------
 drivers/net/wireless/bcmdhd4361/wl_cfg80211.h |  85 ++-
 drivers/net/wireless/bcmdhd4361/wl_cfgp2p.c   |  13 +-
 .../net/wireless/bcmdhd4361/wl_cfgvendor.c    | 273 +++++++-
 .../net/wireless/bcmdhd4361/wl_cfgvendor.h    |  24 +-
 .../net/wireless/bcmdhd4361/wldev_common.h    |   3 +-
 drivers/staging/sti/abc/abc_common.c          |  16 +-
 include/linux/sti/abc_common.h                |   1 +
 security/defex_lsm/file_list                  | 581 ++++++++--------
 tools/dtbtool                                 | Bin 59375 -> 59327 bytes
 57 files changed, 2947 insertions(+), 1013 deletions(-)

diff --git a/arch/arm64/boot/dts/exynos/battery_data_dreamlte_common.dtsi b/arch/arm64/boot/dts/exynos/battery_data_dreamlte_common.dtsi
index baa707f2b52e..3e0e76168611 100755
--- a/arch/arm64/boot/dts/exynos/battery_data_dreamlte_common.dtsi
+++ b/arch/arm64/boot/dts/exynos/battery_data_dreamlte_common.dtsi
@@ -207,6 +207,7 @@
 		battery,sleep_mode_limit_current = <500>;
 		battery,wc_full_input_limit_current = <100>;
 		battery,wc_cv_current = <820>;
+		battery,wc_cv_tx_current = <650>;
 		battery,wc_cv_pack_current = <630>;
 		battery,wc_hero_stand_cc_cv = <70>;
 		battery,wc_hero_stand_cv_current = <600>;
diff --git a/arch/arm64/configs/exynos8895-dreamlte_defconfig b/arch/arm64/configs/exynos8895-dreamlte_defconfig
index 4aa6509a1f4b..8897e81cc293 100644
--- a/arch/arm64/configs/exynos8895-dreamlte_defconfig
+++ b/arch/arm64/configs/exynos8895-dreamlte_defconfig
@@ -1793,6 +1793,7 @@ CONFIG_WLAN=y
 CONFIG_BROADCOM_WIFI=y
 # CONFIG_BCM4330 is not set
 # CONFIG_BCM4343 is not set
+# CONFIG_BCM43436 is not set
 # CONFIG_BCM4334 is not set
 # CONFIG_BCM4335 is not set
 # CONFIG_BCM4339 is not set
@@ -1821,6 +1822,8 @@ CONFIG_BCMDHD_PREALLOC_MEMDUMP=y
 # CONFIG_WLAN_HERO2 is not set
 CONFIG_BCMDHD_OOB_HOST_WAKE=y
 CONFIG_SPLIT_ARGOS_SET=y
+# CONFIG_WLAN_GRACE is not set
+# CONFIG_WLAN_GREAT is not set
 # CONFIG_BCM_DETECT_CONSECUTIVE_HANG is not set
 # CONFIG_WLAN_TSQ_MULTIPLIER is not set
 # CONFIG_DHD_DRIVEN_RANDOM_MAC_SCAN is not set
diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
index 01de42c8b74b..63ed9ceebf7b 100644
--- a/drivers/android/Kconfig
+++ b/drivers/android/Kconfig
@@ -9,7 +9,7 @@ if ANDROID
 
 config ANDROID_BINDER_IPC
 	bool "Android Binder IPC Driver"
-	depends on MMU
+	depends on MMU && !M68K
 	default n
 	---help---
 	  Binder is used in Android for both communication between processes,
@@ -31,19 +31,6 @@ config ANDROID_BINDER_DEVICES
 	  created. Each binder device has its own context manager, and is
 	  therefore logically separated from the other devices.
 
-config ANDROID_BINDER_IPC_32BIT
-	bool
-	depends on !64BIT && ANDROID_BINDER_IPC
-	default y
-	---help---
-	  The Binder API has been changed to support both 32 and 64bit
-	  applications in a mixed environment.
-
-	  Enable this to support an old 32-bit Android user-space (v4.4 and
-	  earlier).
-
-	  Note that enabling this will break newer Android user-space.
-
 config ANDROID_BINDER_IPC_SELFTEST
 	bool "Android Binder IPC Driver Selftest"
 	depends on ANDROID_BINDER_IPC
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index ba8872fc9211..7b0f7459da42 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -71,10 +71,6 @@
 #include <linux/security.h>
 #include <linux/spinlock.h>
 
-#ifdef CONFIG_ANDROID_BINDER_IPC_32BIT
-#define BINDER_IPC_32BIT 1
-#endif
-
 #include <uapi/linux/android/binder.h>
 #include "binder_alloc.h"
 #include "binder_trace.h"
@@ -145,7 +141,7 @@ enum {
 };
 static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
 	BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
-module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO);
+module_param_named(debug_mask, binder_debug_mask, uint, 0644);
 
 static char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
 module_param_named(devices, binder_devices_param, charp, S_IRUGO);
@@ -164,7 +160,7 @@ static int binder_set_stop_on_user_error(const char *val,
 	return ret;
 }
 module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
-	param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO);
+	param_get_int, &binder_stop_on_user_error, 0644);
 
 #define binder_debug(mask, x...) \
 	do { \
@@ -253,7 +249,7 @@ static struct binder_transaction_log_entry *binder_transaction_log_add(
 	unsigned int cur = atomic_inc_return(&log->cur);
 
 	if (cur >= ARRAY_SIZE(log->entry))
-		log->full = 1;
+		log->full = true;
 	e = &log->entry[cur % ARRAY_SIZE(log->entry)];
 	WRITE_ONCE(e->debug_id_done, 0);
 	/*
@@ -472,8 +468,9 @@ struct binder_ref {
 };
 
 enum binder_deferred_state {
-	BINDER_DEFERRED_FLUSH        = 0x01,
-	BINDER_DEFERRED_RELEASE      = 0x02,
+	BINDER_DEFERRED_PUT_FILES    = 0x01,
+	BINDER_DEFERRED_FLUSH        = 0x02,
+	BINDER_DEFERRED_RELEASE      = 0x04,
 };
 
 /**
@@ -510,6 +507,9 @@ struct binder_priority {
  *                        (invariant after initialized)
  * @tsk                   task_struct for group_leader of process
  *                        (invariant after initialized)
+ * @files                 files_struct for process
+ *                        (protected by @files_lock)
+ * @files_lock            mutex to protect @files
  * @deferred_work_node:   element for binder_deferred_list
  *                        (protected by binder_deferred_lock)
  * @deferred_work:        bitmap of deferred work to perform
@@ -554,6 +554,8 @@ struct binder_proc {
 	struct list_head waiting_threads;
 	int pid;
 	struct task_struct *tsk;
+	struct files_struct *files;
+	struct mutex files_lock;
 	struct hlist_node deferred_work_node;
 	int deferred_work;
 	bool is_dead;
@@ -949,33 +951,27 @@ static void binder_free_thread(struct binder_thread *thread);
 static void binder_free_proc(struct binder_proc *proc);
 static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
 
-struct files_struct *binder_get_files_struct(struct binder_proc *proc)
-{
-	return get_files_struct(proc->tsk);
-}
-
 static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
 {
-	struct files_struct *files;
 	unsigned long rlim_cur;
 	unsigned long irqs;
 	int ret;
 
-	files = binder_get_files_struct(proc);
-	if (files == NULL)
-		return -ESRCH;
-
+	mutex_lock(&proc->files_lock);
+	if (proc->files == NULL) {
+		ret = -ESRCH;
+		goto err;
+	}
 	if (!lock_task_sighand(proc->tsk, &irqs)) {
 		ret = -EMFILE;
 		goto err;
 	}
-
 	rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
 	unlock_task_sighand(proc->tsk, &irqs);
 
-	ret = __alloc_fd(files, 0, rlim_cur, flags);
+	ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
 err:
-	put_files_struct(files);
+	mutex_unlock(&proc->files_lock);
 	return ret;
 }
 
@@ -985,12 +981,10 @@ err:
 static void task_fd_install(
 	struct binder_proc *proc, unsigned int fd, struct file *file)
 {
-	struct files_struct *files = binder_get_files_struct(proc);
-
-	if (files) {
-		__fd_install(files, fd, file);
-		put_files_struct(files);
-	}
+	mutex_lock(&proc->files_lock);
+	if (proc->files)
+		__fd_install(proc->files, fd, file);
+	mutex_unlock(&proc->files_lock);
 }
 
 /*
@@ -998,21 +992,22 @@ static void task_fd_install(
  */
 static long task_close_fd(struct binder_proc *proc, unsigned int fd)
 {
-	struct files_struct *files = binder_get_files_struct(proc);
 	int retval;
 
-	if (files == NULL)
-		return -ESRCH;
-
-	retval = __close_fd(files, fd);
+	mutex_lock(&proc->files_lock);
+	if (proc->files == NULL) {
+		retval = -ESRCH;
+		goto err;
+	}
+	retval = __close_fd(proc->files, fd);
 	/* can't restart close syscall because file table entry was cleared */
 	if (unlikely(retval == -ERESTARTSYS ||
 		     retval == -ERESTARTNOINTR ||
 		     retval == -ERESTARTNOHAND ||
 		     retval == -ERESTART_RESTARTBLOCK))
 		retval = -EINTR;
-	put_files_struct(files);
-
+err:
+	mutex_unlock(&proc->files_lock);
 	return retval;
 }
 
@@ -2156,8 +2151,14 @@ static void binder_send_failed_reply(struct binder_transaction *t,
 					&target_thread->reply_error.work);
 				wake_up_interruptible(&target_thread->wait);
 			} else {
-				WARN(1, "Unexpected reply error: %u\n",
-						target_thread->reply_error.cmd);
+				/*
+				 * Cannot get here for normal operation, but
+				 * we can if multiple synchronous transactions
+				 * are sent without blocking for responses.
+				 * Just ignore the 2nd error in this case.
+				 */
+				pr_warn("Unexpected reply error: %u\n",
+					target_thread->reply_error.cmd);
 			}
 			binder_inner_proc_unlock(target_thread->proc);
 			binder_thread_dec_tmpref(target_thread);
@@ -2217,8 +2218,8 @@ static size_t binder_validate_object(struct binder_buffer *buffer, u64 offset)
 	struct binder_object_header *hdr;
 	size_t object_size = 0;
 
-	if (offset > buffer->data_size - sizeof(*hdr) ||
-	    buffer->data_size < sizeof(*hdr) ||
+	if (buffer->data_size < sizeof(*hdr) ||
+	    offset > buffer->data_size - sizeof(*hdr) ||
 	    !IS_ALIGNED(offset, sizeof(u32)))
 		return 0;
 
@@ -2807,7 +2808,7 @@ static bool binder_proc_transaction(struct binder_transaction *t,
 		if (node->has_async_transaction) {
 			pending_async = true;
 		} else {
-			node->has_async_transaction = 1;
+			node->has_async_transaction = true;
 		}
 	}
 
@@ -3006,6 +3007,14 @@ static void binder_transaction(struct binder_proc *proc,
 			else
 				return_error = BR_DEAD_REPLY;
 			mutex_unlock(&context->context_mgr_node_lock);
+			if (target_node && target_proc == proc) {
+				binder_user_error("%d:%d got transaction to context manager from process owning it\n",
+						  proc->pid, thread->pid);
+				return_error = BR_FAILED_REPLY;
+				return_error_param = -EINVAL;
+				return_error_line = __LINE__;
+				goto err_invalid_target_handle;
+			}
 		}
 		if (!target_node) {
 			/*
@@ -3708,7 +3717,7 @@ static int binder_thread_write(struct binder_proc *proc,
 				w = binder_dequeue_work_head_ilocked(
 						&buf_node->async_todo);
 				if (!w) {
-					buf_node->has_async_transaction = 0;
+					buf_node->has_async_transaction = false;
 				} else {
 					binder_enqueue_work_ilocked(
 							w, &proc->todo);
@@ -4139,6 +4148,7 @@ retry:
 			binder_inner_proc_unlock(proc);
 			if (put_user(e->cmd, (uint32_t __user *)ptr))
 				return -EFAULT;
+			cmd = e->cmd;
 			e->cmd = BR_OK;
 			ptr += sizeof(uint32_t);
 
@@ -4600,8 +4610,29 @@ static int binder_thread_release(struct binder_proc *proc,
 		if (t)
 			spin_lock(&t->lock);
 	}
+
+	/*
+	 * If this thread used poll, make sure we remove the waitqueue
+	 * from any epoll data structures holding it with POLLFREE.
+	 * waitqueue_active() is safe to use here because we're holding
+	 * the inner lock.
+	 */
+	if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
+	    waitqueue_active(&thread->wait)) {
+		wake_up_poll(&thread->wait, POLLHUP | POLLFREE);
+	}
+
 	binder_inner_proc_unlock(thread->proc);
 
+	/*
+	 * This is needed to avoid races between wake_up_poll() above and
+	 * and ep_remove_waitqueue() called for other reasons (eg the epoll file
+	 * descriptor being closed); ep_remove_waitqueue() holds an RCU read
+	 * lock, so we can be sure it's done after calling synchronize_rcu().
+	 */
+	if (thread->looper & BINDER_LOOPER_STATE_POLL)
+		synchronize_rcu();
+
 	if (send_reply)
 		binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
 	binder_release_work(proc, &thread->todo);
@@ -4617,6 +4648,8 @@ static unsigned int binder_poll(struct file *filp,
 	bool wait_for_proc_work;
 
 	thread = binder_get_thread(proc);
+	if (!thread)
+		return POLLERR;
 
 	binder_inner_proc_lock(thread->proc);
 	thread->looper |= BINDER_LOOPER_STATE_POLL;
@@ -4908,6 +4941,7 @@ static void binder_vma_close(struct vm_area_struct *vma)
 		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
 		     (unsigned long)pgprot_val(vma->vm_page_prot));
 	binder_alloc_vma_close(&proc->alloc);
+	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
 }
 
 static int binder_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
@@ -4944,16 +4978,22 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 		failure_string = "bad vm_flags";
 		goto err_bad_arg;
 	}
-	vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
+	vma->vm_flags |= VM_DONTCOPY | VM_MIXEDMAP;
+	vma->vm_flags &= ~VM_MAYWRITE;
+
 	vma->vm_ops = &binder_vm_ops;
 	vma->vm_private_data = proc;
 
 	ret = binder_alloc_mmap_handler(&proc->alloc, vma);
-
-	return ret;
+	if (ret)
+		return ret;
+	mutex_lock(&proc->files_lock);
+	proc->files = get_files_struct(current);
+	mutex_unlock(&proc->files_lock);
+	return 0;
 
 err_bad_arg:
-	pr_err("binder_mmap: %d %lx-%lx %s failed %d\n",
+	pr_err("%s: %d %lx-%lx %s failed %d\n", __func__,
 	       proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
 	return ret;
 }
@@ -4963,7 +5003,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
 	struct binder_proc *proc;
 	struct binder_device *binder_dev;
 
-	binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n",
+	binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
 		     current->group_leader->pid, current->pid);
 
 	proc = kzalloc(sizeof(*proc), GFP_KERNEL);
@@ -4973,6 +5013,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
 	spin_lock_init(&proc->outer_lock);
 	get_task_struct(current->group_leader);
 	proc->tsk = current->group_leader;
+	mutex_init(&proc->files_lock);
 	INIT_LIST_HEAD(&proc->todo);
 	if (binder_supported_policy(current->policy)) {
 		proc->default_priority.sched_policy = current->policy;
@@ -5008,7 +5049,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
 		 * anyway print all contexts that a given PID has, so this
 		 * is not a problem.
 		 */
-		proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO,
+		proc->debugfs_entry = debugfs_create_file(strbuf, 0444,
 			binder_debugfs_dir_entry_proc,
 			(void *)(unsigned long)proc->pid,
 			&binder_proc_fops);
@@ -5129,6 +5170,8 @@ static void binder_deferred_release(struct binder_proc *proc)
 	struct rb_node *n;
 	int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
 
+	BUG_ON(proc->files);
+
 	mutex_lock(&binder_procs_lock);
 	hlist_del(&proc->proc_node);
 	mutex_unlock(&binder_procs_lock);
@@ -5210,6 +5253,8 @@ static void binder_deferred_release(struct binder_proc *proc)
 static void binder_deferred_func(struct work_struct *work)
 {
 	struct binder_proc *proc;
+	struct files_struct *files;
+
 	int defer;
 
 	do {
@@ -5226,11 +5271,23 @@ static void binder_deferred_func(struct work_struct *work)
 		}
 		mutex_unlock(&binder_deferred_lock);
 
+		files = NULL;
+		if (defer & BINDER_DEFERRED_PUT_FILES) {
+			mutex_lock(&proc->files_lock);
+			files = proc->files;
+			if (files)
+				proc->files = NULL;
+			mutex_unlock(&proc->files_lock);
+		}
+
 		if (defer & BINDER_DEFERRED_FLUSH)
 			binder_deferred_flush(proc);
 
 		if (defer & BINDER_DEFERRED_RELEASE)
 			binder_deferred_release(proc); /* frees proc */
+
+		if (files)
+			put_files_struct(files);
 	} while (proc);
 }
 static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
@@ -5898,7 +5955,9 @@ static int __init binder_init(void)
 	struct binder_device *device;
 	struct hlist_node *tmp;
 
-	binder_alloc_shrinker_init();
+	ret = binder_alloc_shrinker_init();
+	if (ret)
+		return ret;
 
 	atomic_set(&binder_transaction_log.cur, ~0U);
 	atomic_set(&binder_transaction_log_failed.cur, ~0U);
@@ -5910,27 +5969,27 @@ static int __init binder_init(void)
 
 	if (binder_debugfs_dir_entry_root) {
 		debugfs_create_file("state",
-				    S_IRUGO,
+				    0444,
 				    binder_debugfs_dir_entry_root,
 				    NULL,
 				    &binder_state_fops);
 		debugfs_create_file("stats",
-				    S_IRUGO,
+				    0444,
 				    binder_debugfs_dir_entry_root,
 				    NULL,
 				    &binder_stats_fops);
 		debugfs_create_file("transactions",
-				    S_IRUGO,
+				    0444,
 				    binder_debugfs_dir_entry_root,
 				    NULL,
 				    &binder_transactions_fops);
 		debugfs_create_file("transaction_log",
-				    S_IRUGO,
+				    0444,
 				    binder_debugfs_dir_entry_root,
 				    &binder_transaction_log,
 				    &binder_transaction_log_fops);
 		debugfs_create_file("failed_transaction_log",
-				    S_IRUGO,
+				    0444,
 				    binder_debugfs_dir_entry_root,
 				    &binder_transaction_log_failed,
 				    &binder_transaction_log_fops);
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index f13def03ca5b..bbd59c336cc9 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -218,7 +218,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
 		mm = alloc->vma_vm_mm;
 
 	if (mm) {
-		down_write(&mm->mmap_sem);
+		down_read(&mm->mmap_sem);
 		vma = alloc->vma;
 	}
 
@@ -287,7 +287,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
 		/* vm_insert_page does not seem to increment the refcount */
 	}
 	if (mm) {
-		up_write(&mm->mmap_sem);
+		up_read(&mm->mmap_sem);
 		mmput(mm);
 	}
 	return 0;
@@ -320,7 +320,7 @@ err_page_ptr_cleared:
 	}
 err_no_vma:
 	if (mm) {
-		up_write(&mm->mmap_sem);
+		up_read(&mm->mmap_sem);
 		mmput(mm);
 	}
 	return vma ? -ENOMEM : -ESRCH;
@@ -1005,8 +1005,14 @@ void binder_alloc_init(struct binder_alloc *alloc)
 	INIT_LIST_HEAD(&alloc->buffers);
 }
 
-void binder_alloc_shrinker_init(void)
+int binder_alloc_shrinker_init(void)
 {
-	list_lru_init(&binder_alloc_lru);
-	register_shrinker(&binder_shrinker);
+	int ret = list_lru_init(&binder_alloc_lru);
+
+	if (ret == 0) {
+		ret = register_shrinker(&binder_shrinker);
+		if (ret)
+			list_lru_destroy(&binder_alloc_lru);
+	}
+	return ret;
 }
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index c4b49e24e5fa..fb3238c74c8a 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -129,7 +129,7 @@ extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
 						  size_t extra_buffers_size,
 						  int is_async);
 extern void binder_alloc_init(struct binder_alloc *alloc);
-void binder_alloc_shrinker_init(void);
+extern int binder_alloc_shrinker_init(void);
 extern void binder_alloc_vma_close(struct binder_alloc *alloc);
 extern struct binder_buffer *
 binder_alloc_prepare_to_free(struct binder_alloc *alloc,
diff --git a/drivers/battery_v2/include/charger/mfc_charger.h b/drivers/battery_v2/include/charger/mfc_charger.h
index 1e4913e5e5c7..d2281e30631d 100755
--- a/drivers/battery_v2/include/charger/mfc_charger.h
+++ b/drivers/battery_v2/include/charger/mfc_charger.h
@@ -700,6 +700,7 @@ struct mfc_charger_data {
 	struct wake_lock wpc_opfq_lock;
 	struct wake_lock wpc_afc_vout_lock;
 	struct wake_lock wpc_vout_mode_lock;
+	struct wake_lock wpc_tx_id_lock;
 	struct workqueue_struct *wqueue;
 	struct work_struct	wcin_work;
 	struct delayed_work	wpc_det_work;
@@ -731,6 +732,7 @@ struct mfc_charger_data {
 	bool is_afc_tx;
 	bool tx_id_done;
 	int tx_id;
+	int tx_id_cnt;
 	u8 device_event;
 
 	int i2c_error_count;
diff --git a/drivers/battery_v2/include/sec_charging_common.h b/drivers/battery_v2/include/sec_charging_common.h
index ec9ce8b5f89d..66ed5d90d1b1 100755
--- a/drivers/battery_v2/include/sec_charging_common.h
+++ b/drivers/battery_v2/include/sec_charging_common.h
@@ -789,6 +789,7 @@ struct sec_battery_platform_data {
 	unsigned int sleep_mode_limit_current;
 	unsigned int wc_full_input_limit_current;
 	unsigned int wc_cv_current;
+	unsigned int wc_cv_tx_current;
 	unsigned int wc_cv_pack_current;
 	unsigned int max_charging_current;
 	int mix_high_temp;
diff --git a/drivers/battery_v2/mfc_charger.c b/drivers/battery_v2/mfc_charger.c
index 827dd8e6c50c..5c5ae23aa129 100755
--- a/drivers/battery_v2/mfc_charger.c
+++ b/drivers/battery_v2/mfc_charger.c
@@ -2492,24 +2492,18 @@ static void mfc_wpc_det_work(struct work_struct *work)
 				value.intval = SEC_WIRELESS_PAD_WPC_HV;
 				psy_do_property("wireless", set,
 					POWER_SUPPLY_PROP_ONLINE, value);
-
-				/* request tx id */
-				queue_delayed_work(charger->wqueue, &charger->wpc_tx_id_work, msecs_to_jiffies(500));
 			} else {
 				/* send request afc_tx */
 				mfc_send_command(charger, MFC_REQUEST_AFC_TX);
 			}
-		} else {
-			/* request tx id */
-			queue_delayed_work(charger->wqueue, &charger->wpc_tx_id_work, msecs_to_jiffies(500));
 		}
 #endif
 		/* set rpp scaling factor for LED cover */
 		mfc_rpp_set(charger);
-#if 0
-		/* set request TX_ID */
-		mfc_send_command(charger, MFC_REQUEST_TX_ID);
-#endif
+
+		wake_lock(&charger->wpc_tx_id_lock);
+		/* request tx id */
+		queue_delayed_work(charger->wqueue, &charger->wpc_tx_id_work, msecs_to_jiffies(2500));
 
 		charger->pdata->is_charging = 1;
 	} else if ((charger->wc_w_state == 1) && (wc_w_state == 0)) {
@@ -2527,6 +2521,7 @@ static void mfc_wpc_det_work(struct work_struct *work)
 		charger->is_afc_tx = false;
 		charger->tx_id = 0;
 		charger->i2c_error_count = 0;
+		charger->tx_id_cnt = 0;
 		charger->tx_id_done = false;
 		charger->device_event = 0;
 
@@ -2561,6 +2556,7 @@ static void mfc_wpc_det_work(struct work_struct *work)
 		cancel_delayed_work(&charger->wpc_opfq_work);
 		cancel_delayed_work(&charger->wpc_tx_id_work);
 		cancel_delayed_work(&charger->wpc_i2c_error_work);
+		wake_unlock(&charger->wpc_tx_id_lock);
 	}
 
 	pr_info("%s: w(%d to %d)\n", __func__,
@@ -2740,8 +2736,6 @@ static void mfc_wpc_isr_work(struct work_struct *work)
 				pr_info("%s: unsupport : 0x%x", __func__, val_data);
 				break;
 			}
-
-			queue_delayed_work(charger->wqueue, &charger->wpc_tx_id_work, msecs_to_jiffies(500));
 		} else if (cmd_data == WPC_TX_COM_TX_ID) {
 			if (!charger->tx_id_done) {
 				switch (val_data) {
@@ -2878,8 +2872,22 @@ static void mfc_wpc_tx_id_work(struct work_struct *work)
 		container_of(work, struct mfc_charger_data, wpc_tx_id_work.work);
 
 	pr_info("%s\n",__func__);
-	
+
 	mfc_send_command(charger, MFC_REQUEST_TX_ID);
+	charger->tx_id_cnt++;
+
+	if ((charger->tx_id_cnt <= 10) && !charger->tx_id) {
+		pr_info("%s: request TX ID (%d)\n", __func__, charger->tx_id_cnt);
+		queue_delayed_work(charger->wqueue, &charger->wpc_tx_id_work, msecs_to_jiffies(1500));
+		return;
+	} else {
+		if (charger->tx_id)
+			pr_info("%s: TX ID (0x%x)\n", __func__, charger->tx_id);
+		else
+			pr_info("%s: TX ID not Received\n", __func__);
+		charger->tx_id_cnt = 0;
+	}
+	wake_unlock(&charger->wpc_tx_id_lock);
 }
 
 /*
@@ -3523,6 +3531,8 @@ static int mfc_charger_probe(
 			"wpc_afc_vout_lock");
 	wake_lock_init(&charger->wpc_vout_mode_lock, WAKE_LOCK_SUSPEND,
 			"wpc_vout_mode_lock");
+	wake_lock_init(&charger->wpc_tx_id_lock, WAKE_LOCK_SUSPEND,
+			"wpc_tx_id_lock");
 
 	/* Enable interrupts after battery driver load */
 	/* wpc_det */
@@ -3539,20 +3549,12 @@ static int mfc_charger_probe(
 	}
 
 	/* wpc_irq */
-	queue_delayed_work(charger->wqueue, &charger->wpc_int_req_work, msecs_to_jiffies(100));
+	queue_delayed_work(charger->wqueue, &charger->wpc_int_req_work, 0);
 
 	wc_w_state_irq = gpio_get_value(charger->pdata->wpc_int);
 	pr_info("%s wc_w_state_irq = %d\n", __func__, wc_w_state_irq);
 	if (gpio_get_value(charger->pdata->wpc_det)) {
-		u8 irq_src[2];
 		pr_info("%s: Charger interrupt occured during lpm \n", __func__);
-
-		mfc_reg_read(charger->client, MFC_INT_A_L_REG, &irq_src[0]);
-		mfc_reg_read(charger->client, MFC_INT_A_H_REG, &irq_src[1]);
-		/* clear intterupt */
-		mfc_reg_write(charger->client, MFC_INT_A_CLEAR_L_REG, irq_src[0]); // clear int
-		mfc_reg_write(charger->client, MFC_INT_A_CLEAR_H_REG, irq_src[1]); // clear int
-		mfc_set_cmd_l_reg(charger, 0x20, MFC_CMD_CLEAR_INT_MASK); // command
 		queue_delayed_work(charger->wqueue, &charger->wpc_det_work, 0);
 		if(!wc_w_state_irq && !delayed_work_pending(&charger->wpc_isr_work))
 			queue_delayed_work(charger->wqueue, &charger->wpc_isr_work, msecs_to_jiffies(2000));
@@ -3634,13 +3636,12 @@ static void mfc_charger_shutdown(struct i2c_client *client)
 	struct mfc_charger_data *charger = i2c_get_clientdata(client);
 
 	pr_info("%s\n", __func__);
-	if (charger->pdata->is_charging) {
-		mfc_set_vrect_adjust(charger, MFC_HEADROOM_1);
 
-		if (charger->pad_vout == PAD_VOUT_5V &&
-			charger->pdata->vout_status == MFC_VOUT_5_5V) {
-			mfc_set_vout(charger, MFC_VOUT_5V);
-		}
+	if (gpio_get_value(charger->pdata->wpc_det)) {
+		mfc_set_vrect_adjust(charger, MFC_HEADROOM_1);
+		mfc_set_vout(charger, MFC_VOUT_5V);
+		pr_info("%s: forced 5V Vout, wc_w_state_irq = %d\n",
+			__func__, gpio_get_value(charger->pdata->wpc_int));
 	}
 }
 
diff --git a/drivers/battery_v2/sec_battery.c b/drivers/battery_v2/sec_battery.c
index 7ff91a9321ea..8af67d97cead 100755
--- a/drivers/battery_v2/sec_battery.c
+++ b/drivers/battery_v2/sec_battery.c
@@ -401,6 +401,9 @@ static int sec_bat_get_wireless_current(struct sec_battery_info *battery, int in
 			if (battery->cable_type == SEC_BATTERY_CABLE_WIRELESS_PACK) {
 				if (incurr > battery->pdata->wc_cv_pack_current)
 					incurr = battery->pdata->wc_cv_pack_current;
+			} else if (battery->cable_type == SEC_BATTERY_CABLE_WIRELESS_TX) {
+				if (incurr > battery->pdata->wc_cv_tx_current)
+					incurr = battery->pdata->wc_cv_tx_current;
 			} else if (incurr > battery->pdata->wc_cv_current) {
 				incurr = battery->pdata->wc_cv_current;
 			}
@@ -8352,6 +8355,13 @@ static int sec_bat_parse_dt(struct device *dev,
 		pdata->wc_cv_current = 820;
 	}
 
+	ret = of_property_read_u32(np, "battery,wc_cv_tx_current",
+		&pdata->wc_cv_tx_current);
+	if (ret) {
+		pr_info("%s : wc_cv_tx_current is Empty\n", __func__);
+		pdata->wc_cv_tx_current = 650;
+	}
+
 	ret = of_property_read_u32(np, "battery,wc_cv_pack_current",
 		&pdata->wc_cv_pack_current);
 	if (ret) {
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 77b9ba892bfd..a140c48e2299 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1951,7 +1951,7 @@ EXPORT_SYMBOL_GPL(clk_is_match);
 
 /***        debugfs support        ***/
 
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) && !defined(CONFIG_ARCH_EXYNOS)
 #include <linux/debugfs.h>
 
 static struct dentry *rootdir;
diff --git a/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_custom_interface.c b/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_custom_interface.c
index 856f3890d027..60176d52b23d 100644
--- a/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_custom_interface.c
+++ b/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_custom_interface.c
@@ -1176,6 +1176,10 @@ static ssize_t show_trace_dump(struct device *dev, struct device_attribute *attr
 
 		kbasep_trace_format_msg(trace_msg, buffer, KBASE_TRACE_SIZE);
 		ret += snprintf(buf+ret, PAGE_SIZE-ret, "%s\n", buffer);
+
+        if (ret >= PAGE_SIZE - 1)
+            break;
+
 		start = (start + 1) & KBASE_TRACE_MASK;
 	}
 
diff --git a/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_pmqos.c b/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_pmqos.c
index 5f804fd0af9b..14700cf07bb0 100644
--- a/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_pmqos.c
+++ b/drivers/gpu/arm/b_r16p0/platform/exynos/gpu_pmqos.c
@@ -66,8 +66,10 @@ int gpu_pm_qos_command(struct exynos_context *platform, gpu_pmqos_state state)
 			pm_qos_add_request(&exynos5_g3d_mif_max_qos, PM_QOS_BUS_THROUGHPUT_MAX, PM_QOS_BUS_THROUGHPUT_MAX_DEFAULT_VALUE);
 		pm_qos_add_request(&exynos5_g3d_cpu_cluster0_min_qos, PM_QOS_CLUSTER0_FREQ_MIN, 0);
 		pm_qos_add_request(&exynos5_g3d_cpu_cluster1_max_qos, PM_QOS_CLUSTER1_FREQ_MAX, PM_QOS_CLUSTER1_FREQ_MAX_DEFAULT_VALUE);
+#if PM_QOS_CPU_CLUSTER_NUM == 2
 		if (platform->boost_egl_min_lock)
 			pm_qos_add_request(&exynos5_g3d_cpu_cluster1_min_qos, PM_QOS_CLUSTER1_FREQ_MIN, 0);
+#endif
 #if PM_QOS_CPU_CLUSTER_NUM == 3
 		pm_qos_add_request(&exynos5_g3d_cpu_cluster1_min_qos, PM_QOS_CLUSTER1_FREQ_MIN, 0);
 		pm_qos_add_request(&exynos5_g3d_cpu_cluster2_max_qos, PM_QOS_CLUSTER2_FREQ_MAX, PM_QOS_CLUSTER2_FREQ_MAX_DEFAULT_VALUE);
diff --git a/drivers/net/wireless/bcmdhd4361/Kconfig b/drivers/net/wireless/bcmdhd4361/Kconfig
index ea96171fe7e5..0d56cb340b08 100644
--- a/drivers/net/wireless/bcmdhd4361/Kconfig
+++ b/drivers/net/wireless/bcmdhd4361/Kconfig
@@ -19,6 +19,13 @@ config BCM4343
 	  This module adds support for wireless adapters based on
 	  Broadcom 4343 chipset.
 
+config BCM43436
+        tristate "Broadcom 43436 wireless cards support"
+        depends on BROADCOM_WIFI
+        ---help---
+          This module adds support for wireless adapters based on
+          Broadcom 43436 chipset.
+
 config BCM4334
 	tristate "Broadcom 4334 wireless cards support"
 	depends on BROADCOM_WIFI
@@ -139,7 +146,7 @@ config BROADCOM_WIFI_RESERVED_MEM
 
 config WIFI_BROADCOM_COB
         bool "BROADCOM WIFI COB"
-        depends on (BCM43456 || BCM43455 || BCM4343 || BCM43454 || BCM43012)
+        depends on (BCM43456 || BCM43455 || BCM4343 || BCM43436 || BCM43454 || BCM43012)
         ---help---
           This is a configuration for Broadcom WIFI COB Type.
 
@@ -230,6 +237,18 @@ config SPLIT_ARGOS_SET
 	---help---
 	To support SPLIT_ARGOS_SET
 
+config WLAN_GRACE
+	bool "Model code for GRACE"
+	depends on BROADCOM_WIFI
+	---help---
+	  This is configuration for Grace feature
+
+config WLAN_GREAT
+	bool "model code for GREAT"
+	depends on BROADCOM_WIFI
+	---help---
+	  This is configuration for Great feature
+
 config BCM_DETECT_CONSECUTIVE_HANG
 	bool "Detect consecutive hang event"
 	depends on BROADCOM_WIFI
diff --git a/drivers/net/wireless/bcmdhd4361/Makefile b/drivers/net/wireless/bcmdhd4361/Makefile
index a89c70c55d72..7bef80f365df 100644
--- a/drivers/net/wireless/bcmdhd4361/Makefile
+++ b/drivers/net/wireless/bcmdhd4361/Makefile
@@ -102,12 +102,10 @@ endif
 ifeq ($(filter y,$(CONFIG_ARCH_SM8150) $(CONFIG_SOC_EXYNOS8890)),y)
 	DHDCFLAGS += -DWAKEUP_KSOFTIRQD_POST_NAPI_SCHEDULE
 endif
-	# Extended HANG event with reason codes
-	DHDCFLAGS += -DDHD_USE_EXTENDED_HANG_REASON
 	# DHDCFLAGS += -DDHD_RECOVER_TIMEOUT
 	# HEAP ASLR
 	DHDCFLAGS += -DBCM_ASLR_HEAP
-ifeq ($(filter y,$(CONFIG_SOC_EXYNOS8895) $(CONFIG_SOC_EXYNOS9810) $(CONFIG_ARCH_SDM845)),y)
+ifeq ($(filter y,$(CONFIG_SOC_EXYNOS8895) $(CONFIG_ARCH_MSM8998) $(CONFIG_SOC_EXYNOS9810) $(CONFIG_ARCH_SDM845)),y)
 	# Default Tx LB Enable
 	DHDCFLAGS += -DDHD_LB_TXP_DEFAULT_ENAB
 endif
@@ -174,6 +172,7 @@ DHDCFLAGS += -DROAM_ENABLE -DROAM_CHANNEL_CACHE -DROAM_API
 DHDCFLAGS += -DENABLE_FW_ROAM_SUSPEND
 DHDCFLAGS += -DDHD_LOSSLESS_ROAMING
 DHDCFLAGS += -DSKIP_ROAM_TRIGGER_RESET
+DHDCFLAGS += -DROAM_EVT_DISABLE
 
 # Enable Roam time thresh
 DHDCFLAGS += -DENABLE_MAX_DTIM_IN_SUSPEND
@@ -214,6 +213,8 @@ DHDCFLAGS += -DUNSET_FW_ROAM_WIPHY_FLAG
 DHDCFLAGS += -DCUSTOM_LONG_RETRY_LIMIT=12
 DHDCFLAGS += -DDISABLE_ANDROID_PNO
 DHDCFLAGS += -DSUPPORT_SET_TID
+# Extended HANG event with reason codes
+DHDCFLAGS += -DDHD_USE_EXTENDED_HANG_REASON
 
 # For special PNO Event keep wake lock for 10sec
 DHDCFLAGS += -DCUSTOM_PNO_EVENT_LOCK_xTIME=10
@@ -436,6 +437,7 @@ endif
   DHDCFLAGS += -DWL11U -DMFP
   DHDCFLAGS += -DBCMCCX
   DHDCFLAGS += -DWES_SUPPORT
+  DHDCFLAGS += -DSUPPORT_RESTORE_SCAN_PARAMS
   DHDCFLAGS += -DOKC_SUPPORT
   DHDCFLAGS += -DWLTDLS
   DHDCFLAGS += -DWLFBT
@@ -542,6 +544,8 @@ ifeq ($(CONFIG_SEC_FACTORY),y)
   DHDCFLAGS += -DDHD_NON_DMA_M2M_CORRUPTION
 # Detect FW Memory Corruption
   DHDCFLAGS += -DDHD_FW_MEM_CORRUPTION
+# Detect turn on failure
+  DHDCFLAGS += -DBCM_DETECT_TURN_ON_FAILURE
 endif # CONFIG_SEC_FACTORY
 
 ifeq ($(CONFIG_BCM4375),y)
@@ -577,12 +581,11 @@ endif
  DHDCFLAGS += -DCUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE
 # Customer ocl disabe
  DHDCFLAGS += -DCUSTOM_SET_OCLOFF
+#FAKEAP
+ DHDCFLAGS += -DWL_BCNRECV
  DHDCFLAGS += -DWL_STATIC_IF
  DHDCFLAGS += -DWL_STATIC_IFNAME_PREFIX="\"swlan0\""
 
-#Iface force dev close
-DHDCFLAGS += -DIFACE_HANG_FORCE_DEV_CLOSE
-
 # tput enhancement for PCIE
 ifeq ($(BUS_IFACE_PCIE),y)
   DHDCFLAGS += -DCUSTOM_TCPACK_SUPP_RATIO=15
@@ -616,6 +619,7 @@ endif
   DHDCFLAGS += -DWL11U -DMFP
   DHDCFLAGS += -DBCMCCX
   DHDCFLAGS += -DWES_SUPPORT
+  DHDCFLAGS += -DSUPPORT_RESTORE_SCAN_PARAMS
   DHDCFLAGS += -DOKC_SUPPORT
   DHDCFLAGS += -DWLTDLS
   DHDCFLAGS += -DWLFBT
@@ -706,6 +710,8 @@ ifeq ($(filter y,$(CONFIG_WLAN_GREAT) $(CONFIG_SEC_GREATQLTE_PROJECT) $(CONFIG_S
   DHDCFLAGS += -DBIGDATA_SOFTAP
 # Enable DHD_DUMP_MNGR
   DHDCFLAGS += -DDHD_DUMP_MNGR
+# Iface force dev close
+  DHDCFLAGS += -DIFACE_HANG_FORCE_DEV_CLOSE
 endif
 
 # Use Legacy dump path
@@ -728,6 +734,8 @@ ifeq ($(CONFIG_SEC_FACTORY),y)
   DHDCFLAGS += -DDHD_NON_DMA_M2M_CORRUPTION
 # Detect FW Memory Corruption
   DHDCFLAGS += -DDHD_FW_MEM_CORRUPTION
+# Detect turn on failure
+  DHDCFLAGS += -DBCM_DETECT_TURN_ON_FAILURE
 endif # CONFIG_SEC_FACTORY
 
 ifeq ($(CONFIG_BCM4361),y)
@@ -752,8 +760,6 @@ ifneq ($(CONFIG_BCM4359),)
   DHDCFLAGS += -DDISABLE_PM_BCNRX
   DHDCFLAGS += -DWL_STATIC_IF
   DHDCFLAGS += -DWL_STATIC_IFNAME_PREFIX="\"swlan0\""
- #Iface force dev close
-  DHDCFLAGS += -DIFACE_HANG_FORCE_DEV_CLOSE
 
 # Use Legacy dump path
 ifneq ($(USE_LEGACY_DUMP_PATH),)
@@ -858,7 +864,7 @@ endif
 # HANG simulation
   DHDCFLAGS += -DDHD_HANG_SEND_UP_TEST
 
-ifneq ($(CONFIG_WLAN_GRACE),)
+ifeq ($(filter y,$(CONFIG_WLAN_GRACE) $(CONFIG_SEC_KELLYLTE_PROJECT)),y)
   DHDCFLAGS += -DWBTEXT
   DHDCFLAGS += -DDHD_USE_CLMINFO_PARSER
 endif
@@ -869,6 +875,8 @@ endif
 
 # Enable concate blob path
     DHDCFLAGS += -DCONCATE_BLOB
+# Generate .softap.info
+  DHDCFLAGS += -DGEN_SOFTAP_INFO_FILE
 
 # For Samsung factory mode only
 ifeq ($(CONFIG_SEC_FACTORY),y)
@@ -1160,6 +1168,10 @@ ifneq ($(CONFIG_BCM43456),)
   DHDCFLAGS += -DAPSTA_RESTRICTED_CHANNEL
 # Block ARP during DHCP on STA/SoftAP concurrent mode
   DHDCFLAGS += -DAPSTA_BLOCK_ARP_DURING_DHCP
+  DHDCFLAGS += -DWL_STATIC_IF
+  DHDCFLAGS += -DWL_STATIC_IFNAME_PREFIX="\"swlan0\""
+# Iface force dev close
+  DHDCFLAGS += -DIFACE_HANG_FORCE_DEV_CLOSE
 endif
 endif
 endif
@@ -1265,14 +1277,26 @@ endif
 ifneq ($(CONFIG_BCM4343),)
   DHDCFLAGS += -DBCM43430_CHIP -DSUPPORT_MULTIPLE_REVISION -DHW_OOB
   DHDCFLAGS += -DUSE_CID_CHECK
-  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=0
   DHDCFLAGS += -DCUSTOM_ASSOC_RETRY_MAX=7
+  DHDCFLAGS += -DENABLE_BCN_LI_BCN_WAKEUP
 # tput enhancement
   DHDCFLAGS += -DUSE_DYNAMIC_F2_BLKSIZE -DDYNAMIC_F2_BLKSIZE_FOR_NONLEGACY=128
   DHDCFLAGS += -DRXFRAME_THREAD -DRXTHREAD_ONLYSTA
   DHDCFLAGS += -DMAX_HDR_READ=128
   DHDCFLAGS += -DDHD_FIRSTREAD=128
   DHDCFLAGS += -DCUSTOM_AMPDU_BA_WSIZE=64 -DCUSTOM_IBSS_AMPDU_BA_WSIZE=16
+ifeq ($(CONFIG_BCM43436),y)
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=8
+  DHDCFLAGS += -DCUSTOM_DPC_CPUCORE=0
+  DHDCFLAGS += -DCUSTOM_FRAMEBURST_SET=1
+# Enable Firmware Coredump
+  DHDCFLAGS += -DDHD_FW_COREDUMP
+ifeq ($(CONFIG_BCMDHD_PREALLOC_MEMDUMP),y)
+  DHDCFLAGS += -DDHD_USE_STATIC_MEMDUMP
+endif
+else
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=0
+endif
   # New Features
   DHDCFLAGS += -DDHD_RANDOM_MAC_SCAN
   DHDCFLAGS += -DWL11U
@@ -1286,11 +1310,26 @@ ifeq ($(CONFIG_BCM4343),y)
   DHDCFLAGS += -DUSE_LATE_INITCALL_SYNC
   DRIVER_TYPE = y
 endif
-  # Remove common feature for BCM4343
+# FCC power limit control on ch12/13.
+  DHDCFLAGS += -DFCC_PWR_LIMIT_2G
+# Enable Roam time thresh
+  DHDCFLAGS += -DENABLE_MAX_DTIM_IN_SUSPEND
+  DHDCFLAGS += -DCUSTOM_BCN_TIMEOUT_IN_SUSPEND=10
+  DHDCFLAGS += -DCUSTOM_ROAM_TIME_THRESH_IN_SUSPEND=6000
+  DHDCFLAGS += -DMAX_DTIM_ALLOWED_INTERVAL=925
+# Remove common feature for BCM4343
   DHDCFLAGS :=$(filter-out -DROAM_AP_ENV_DETECTION,$(DHDCFLAGS))
   DHDCFLAGS :=$(filter-out -DDISABLE_11H_SOFTAP,$(DHDCFLAGS))
+  DHDCFLAGS :=$(filter-out -DSUPPORT_P2P_GO_PS,$(DHDCFLAGS))
 # Generate .softap.info
   DHDCFLAGS += -DGEN_SOFTAP_INFO_FILE
+ifneq ($(PLATFORM_VERSION),)
+# Android O OS use below features
+ifeq ($(shell expr $(PLATFORM_VERSION) \>= 8.0),1)
+# Use single nvram file
+  DHDCFLAGS += -DDHD_USE_SINGLE_NVRAM_FILE
+endif
+endif
 endif
 
 ifneq ($(CONFIG_BCM43012),)
@@ -1464,6 +1503,7 @@ DHDCFLAGS := $(filter-out -DGSCAN_SUPPORT,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DRTT_SUPPORT,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DDHD_LB_IRQSET,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DSET_PCIE_IRQ_CPU_CORE,$(DHDCFLAGS))
+DHDCFLAGS := $(filter-out -DWL_BCNRECV,$(DHDCFLAGS))
 DHD_ANDROID_OFILES := $(filter-out wl_cfgvendor.o,$(DHD_ANDROID_OFILES))
 DHD_ANDROID_OFILES := $(filter-out dhd_rtt.o,$(DHD_ANDROID_OFILES))
 endif
diff --git a/drivers/net/wireless/bcmdhd4361/Makefile.kk b/drivers/net/wireless/bcmdhd4361/Makefile.kk
index 8cc3ae24d924..290af474e9dd 100644
--- a/drivers/net/wireless/bcmdhd4361/Makefile.kk
+++ b/drivers/net/wireless/bcmdhd4361/Makefile.kk
@@ -107,7 +107,7 @@ endif
 	# DHDCFLAGS += -DDHD_RECOVER_TIMEOUT
 	# HEAP ASLR
 	DHDCFLAGS += -DBCM_ASLR_HEAP
-ifeq ($(filter y,$(CONFIG_SOC_EXYNOS8895) $(CONFIG_SOC_EXYNOS9810) $(CONFIG_ARCH_SDM845)),y)
+ifeq ($(filter y,$(CONFIG_SOC_EXYNOS8895) $(CONFIG_ARCH_MSM8998) $(CONFIG_SOC_EXYNOS9810) $(CONFIG_ARCH_SDM845)),y)
 	# Default Tx LB Enable
 	DHDCFLAGS += -DDHD_LB_TXP_DEFAULT_ENAB
 endif
@@ -174,6 +174,7 @@ DHDCFLAGS += -DROAM_ENABLE -DROAM_CHANNEL_CACHE -DROAM_API
 DHDCFLAGS += -DENABLE_FW_ROAM_SUSPEND
 DHDCFLAGS += -DDHD_LOSSLESS_ROAMING
 DHDCFLAGS += -DSKIP_ROAM_TRIGGER_RESET
+DHDCFLAGS += -DROAM_EVT_DISABLE
 
 # Enable Roam time thresh
 DHDCFLAGS += -DENABLE_MAX_DTIM_IN_SUSPEND
@@ -409,6 +410,7 @@ endif
   DHDCFLAGS += -DWL11U -DMFP
   DHDCFLAGS += -DBCMCCX
   DHDCFLAGS += -DWES_SUPPORT
+  DHDCFLAGS += -DSUPPORT_RESTORE_SCAN_PARAMS
   DHDCFLAGS += -DOKC_SUPPORT
   DHDCFLAGS += -DWLTDLS
   DHDCFLAGS += -DWLFBT
@@ -515,6 +517,8 @@ ifeq ($(CONFIG_SEC_FACTORY),y)
   DHDCFLAGS += -DDHD_NON_DMA_M2M_CORRUPTION
 # Detect FW Memory Corruption
   DHDCFLAGS += -DDHD_FW_MEM_CORRUPTION
+# Detect turn on failure
+  DHDCFLAGS += -DBCM_DETECT_TURN_ON_FAILURE
 endif # CONFIG_SEC_FACTORY
 
 ifeq ($(CONFIG_BCM4375),y)
@@ -538,9 +542,7 @@ ifneq ($(CONFIG_BCM4361),)
  DHDCFLAGS += -DUSE_WL_TXBF
  DHDCFLAGS += -DUSE_WL_FRAMEBURST
  DHDCFLAGS += -DDISABLE_FRAMEBURST_VSDB
-ifeq ($(filter y,$(CONFIG_ARCH_SDM845) $(CONFIG_SOC_EXYNOS9810)),y)
  DHDCFLAGS += -DDISABLE_WL_FRAMEBURST_SOFTAP
-endif
  DHDCFLAGS += -DDISABLE_PM_BCNRX
 # Debugability
  DHDCFLAGS += -DDEBUGABILITY_ECNTRS_LOGGING
@@ -550,6 +552,8 @@ endif
  DHDCFLAGS += -DCUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE
 # Customer ocl disabe
  DHDCFLAGS += -DCUSTOM_SET_OCLOFF
+#FAKEAP
+ DHDCFLAGS += -DWL_BCNRECV
  DHDCFLAGS += -DWL_STATIC_IF
  DHDCFLAGS += -DWL_STATIC_IFNAME_PREFIX="\"swlan0\""
 
@@ -589,6 +593,7 @@ endif
   DHDCFLAGS += -DWL11U -DMFP
   DHDCFLAGS += -DBCMCCX
   DHDCFLAGS += -DWES_SUPPORT
+  DHDCFLAGS += -DSUPPORT_RESTORE_SCAN_PARAMS
   DHDCFLAGS += -DOKC_SUPPORT
   DHDCFLAGS += -DWLTDLS
   DHDCFLAGS += -DWLFBT
@@ -701,6 +706,8 @@ ifeq ($(CONFIG_SEC_FACTORY),y)
   DHDCFLAGS += -DDHD_NON_DMA_M2M_CORRUPTION
 # Detect FW Memory Corruption
   DHDCFLAGS += -DDHD_FW_MEM_CORRUPTION
+# Detect turn on failure
+  DHDCFLAGS += -DBCM_DETECT_TURN_ON_FAILURE
 endif # CONFIG_SEC_FACTORY
 
 ifeq ($(CONFIG_BCM4361),y)
@@ -831,7 +838,7 @@ endif
 # HANG simulation
   DHDCFLAGS += -DDHD_HANG_SEND_UP_TEST
 
-ifneq ($(CONFIG_WLAN_GRACE),)
+ifeq ($(filter y,$(CONFIG_WLAN_GRACE) $(CONFIG_SEC_KELLYLTE_PROJECT)),y)
   DHDCFLAGS += -DWBTEXT
   DHDCFLAGS += -DDHD_USE_CLMINFO_PARSER
 endif
@@ -842,6 +849,8 @@ endif
 
 # Enable concate blob path
     DHDCFLAGS += -DCONCATE_BLOB
+# Generate .softap.info
+  DHDCFLAGS += -DGEN_SOFTAP_INFO_FILE
 
 # For Samsung factory mode only
 ifeq ($(CONFIG_SEC_FACTORY),y)
@@ -1133,6 +1142,10 @@ ifneq ($(CONFIG_BCM43456),)
   DHDCFLAGS += -DAPSTA_RESTRICTED_CHANNEL
 # Block ARP during DHCP on STA/SoftAP concurrent mode
   DHDCFLAGS += -DAPSTA_BLOCK_ARP_DURING_DHCP
+  DHDCFLAGS += -DWL_STATIC_IF
+  DHDCFLAGS += -DWL_STATIC_IFNAME_PREFIX="\"swlan0\""
+# Iface force dev close
+  DHDCFLAGS += -DIFACE_HANG_FORCE_DEV_CLOSE
 endif
 endif
 endif
@@ -1238,14 +1251,26 @@ endif
 ifneq ($(CONFIG_BCM4343),)
   DHDCFLAGS += -DBCM43430_CHIP -DSUPPORT_MULTIPLE_REVISION -DHW_OOB
   DHDCFLAGS += -DUSE_CID_CHECK
-  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=0
   DHDCFLAGS += -DCUSTOM_ASSOC_RETRY_MAX=7
+  DHDCFLAGS += -DENABLE_BCN_LI_BCN_WAKEUP
 # tput enhancement
   DHDCFLAGS += -DUSE_DYNAMIC_F2_BLKSIZE -DDYNAMIC_F2_BLKSIZE_FOR_NONLEGACY=128
   DHDCFLAGS += -DRXFRAME_THREAD -DRXTHREAD_ONLYSTA
   DHDCFLAGS += -DMAX_HDR_READ=128
   DHDCFLAGS += -DDHD_FIRSTREAD=128
   DHDCFLAGS += -DCUSTOM_AMPDU_BA_WSIZE=64 -DCUSTOM_IBSS_AMPDU_BA_WSIZE=16
+ifeq ($(CONFIG_BCM43436),y)
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=8
+  DHDCFLAGS += -DCUSTOM_DPC_CPUCORE=0
+  DHDCFLAGS += -DCUSTOM_FRAMEBURST_SET=1
+# Enable Firmware Coredump
+  DHDCFLAGS += -DDHD_FW_COREDUMP
+ifeq ($(CONFIG_BCMDHD_PREALLOC_MEMDUMP),y)
+  DHDCFLAGS += -DDHD_USE_STATIC_MEMDUMP
+endif
+else
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=0
+endif
   # New Features
   DHDCFLAGS += -DDHD_RANDOM_MAC_SCAN
   DHDCFLAGS += -DWL11U
@@ -1259,11 +1284,26 @@ ifeq ($(CONFIG_BCM4343),y)
   DHDCFLAGS += -DUSE_LATE_INITCALL_SYNC
   DRIVER_TYPE = y
 endif
-  # Remove common feature for BCM4343
+# FCC power limit control on ch12/13.
+  DHDCFLAGS += -DFCC_PWR_LIMIT_2G
+# Enable Roam time thresh
+  DHDCFLAGS += -DENABLE_MAX_DTIM_IN_SUSPEND
+  DHDCFLAGS += -DCUSTOM_BCN_TIMEOUT_IN_SUSPEND=10
+  DHDCFLAGS += -DCUSTOM_ROAM_TIME_THRESH_IN_SUSPEND=6000
+  DHDCFLAGS += -DMAX_DTIM_ALLOWED_INTERVAL=925
+# Remove common feature for BCM4343
   DHDCFLAGS :=$(filter-out -DROAM_AP_ENV_DETECTION,$(DHDCFLAGS))
   DHDCFLAGS :=$(filter-out -DDISABLE_11H_SOFTAP,$(DHDCFLAGS))
+  DHDCFLAGS :=$(filter-out -DSUPPORT_P2P_GO_PS,$(DHDCFLAGS))
 # Generate .softap.info
   DHDCFLAGS += -DGEN_SOFTAP_INFO_FILE
+ifneq ($(PLATFORM_VERSION),)
+# Android O OS use below features
+ifeq ($(shell expr $(PLATFORM_VERSION) \>= 8.0),1)
+# Use single nvram file
+  DHDCFLAGS += -DDHD_USE_SINGLE_NVRAM_FILE
+endif
+endif
 endif
 
 ifneq ($(CONFIG_BCM43012),)
@@ -1437,6 +1477,7 @@ DHDCFLAGS := $(filter-out -DGSCAN_SUPPORT,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DRTT_SUPPORT,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DDHD_LB_IRQSET,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DSET_PCIE_IRQ_CPU_CORE,$(DHDCFLAGS))
+DHDCFLAGS := $(filter-out -DWL_BCNRECV,$(DHDCFLAGS))
 DHD_ANDROID_OFILES := $(filter-out wl_cfgvendor.o,$(DHD_ANDROID_OFILES))
 DHD_ANDROID_OFILES := $(filter-out dhd_rtt.o,$(DHD_ANDROID_OFILES))
 endif
diff --git a/drivers/net/wireless/bcmdhd4361/Makefile.lp b/drivers/net/wireless/bcmdhd4361/Makefile.lp
index e14b34064421..4ff778f8393b 100644
--- a/drivers/net/wireless/bcmdhd4361/Makefile.lp
+++ b/drivers/net/wireless/bcmdhd4361/Makefile.lp
@@ -107,7 +107,7 @@ endif
 	# DHDCFLAGS += -DDHD_RECOVER_TIMEOUT
 	# HEAP ASLR
 	DHDCFLAGS += -DBCM_ASLR_HEAP
-ifeq ($(filter y,$(CONFIG_SOC_EXYNOS8895) $(CONFIG_SOC_EXYNOS9810) $(CONFIG_ARCH_SDM845)),y)
+ifeq ($(filter y,$(CONFIG_SOC_EXYNOS8895) $(CONFIG_ARCH_MSM8998) $(CONFIG_SOC_EXYNOS9810) $(CONFIG_ARCH_SDM845)),y)
 	# Default Tx LB Enable
 	DHDCFLAGS += -DDHD_LB_TXP_DEFAULT_ENAB
 endif
@@ -174,6 +174,7 @@ DHDCFLAGS += -DROAM_ENABLE -DROAM_CHANNEL_CACHE -DROAM_API
 DHDCFLAGS += -DENABLE_FW_ROAM_SUSPEND
 DHDCFLAGS += -DDHD_LOSSLESS_ROAMING
 DHDCFLAGS += -DSKIP_ROAM_TRIGGER_RESET
+DHDCFLAGS += -DROAM_EVT_DISABLE
 
 # Enable Roam time thresh
 DHDCFLAGS += -DENABLE_MAX_DTIM_IN_SUSPEND
@@ -432,6 +433,7 @@ endif
   DHDCFLAGS += -DWL11U -DMFP
   DHDCFLAGS += -DBCMCCX
   DHDCFLAGS += -DWES_SUPPORT
+  DHDCFLAGS += -DSUPPORT_RESTORE_SCAN_PARAMS
   DHDCFLAGS += -DOKC_SUPPORT
   DHDCFLAGS += -DWLTDLS
   DHDCFLAGS += -DWLFBT
@@ -538,6 +540,8 @@ ifeq ($(CONFIG_SEC_FACTORY),y)
   DHDCFLAGS += -DDHD_NON_DMA_M2M_CORRUPTION
 # Detect FW Memory Corruption
   DHDCFLAGS += -DDHD_FW_MEM_CORRUPTION
+# Detect turn on failure
+  DHDCFLAGS += -DBCM_DETECT_TURN_ON_FAILURE
 endif # CONFIG_SEC_FACTORY
 
 ifeq ($(CONFIG_BCM4375),y)
@@ -561,9 +565,7 @@ ifneq ($(CONFIG_BCM4361),)
  DHDCFLAGS += -DUSE_WL_TXBF
  DHDCFLAGS += -DUSE_WL_FRAMEBURST
  DHDCFLAGS += -DDISABLE_FRAMEBURST_VSDB
-ifeq ($(filter y,$(CONFIG_ARCH_SDM845) $(CONFIG_SOC_EXYNOS9810)),y)
  DHDCFLAGS += -DDISABLE_WL_FRAMEBURST_SOFTAP
-endif
  DHDCFLAGS += -DDISABLE_PM_BCNRX
 # Debugability
  DHDCFLAGS += -DDEBUGABILITY_ECNTRS_LOGGING
@@ -573,6 +575,8 @@ endif
  DHDCFLAGS += -DCUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE
 # Customer ocl disabe
  DHDCFLAGS += -DCUSTOM_SET_OCLOFF
+#FAKEAP
+ DHDCFLAGS += -DWL_BCNRECV
  DHDCFLAGS += -DWL_STATIC_IF
  DHDCFLAGS += -DWL_STATIC_IFNAME_PREFIX="\"swlan0\""
 
@@ -612,6 +616,7 @@ endif
   DHDCFLAGS += -DWL11U -DMFP
   DHDCFLAGS += -DBCMCCX
   DHDCFLAGS += -DWES_SUPPORT
+  DHDCFLAGS += -DSUPPORT_RESTORE_SCAN_PARAMS
   DHDCFLAGS += -DOKC_SUPPORT
   DHDCFLAGS += -DWLTDLS
   DHDCFLAGS += -DWLFBT
@@ -724,6 +729,8 @@ ifeq ($(CONFIG_SEC_FACTORY),y)
   DHDCFLAGS += -DDHD_NON_DMA_M2M_CORRUPTION
 # Detect FW Memory Corruption
   DHDCFLAGS += -DDHD_FW_MEM_CORRUPTION
+# Detect turn on failure
+  DHDCFLAGS += -DBCM_DETECT_TURN_ON_FAILURE
 endif # CONFIG_SEC_FACTORY
 
 ifeq ($(CONFIG_BCM4361),y)
@@ -854,7 +861,7 @@ endif
 # HANG simulation
   DHDCFLAGS += -DDHD_HANG_SEND_UP_TEST
 
-ifneq ($(CONFIG_WLAN_GRACE),)
+ifeq ($(filter y,$(CONFIG_WLAN_GRACE) $(CONFIG_SEC_KELLYLTE_PROJECT)),y)
   DHDCFLAGS += -DWBTEXT
   DHDCFLAGS += -DDHD_USE_CLMINFO_PARSER
 endif
@@ -865,6 +872,8 @@ endif
 
 # Enable concate blob path
     DHDCFLAGS += -DCONCATE_BLOB
+# Generate .softap.info
+  DHDCFLAGS += -DGEN_SOFTAP_INFO_FILE
 
 # For Samsung factory mode only
 ifeq ($(CONFIG_SEC_FACTORY),y)
@@ -1156,6 +1165,10 @@ ifneq ($(CONFIG_BCM43456),)
   DHDCFLAGS += -DAPSTA_RESTRICTED_CHANNEL
 # Block ARP during DHCP on STA/SoftAP concurrent mode
   DHDCFLAGS += -DAPSTA_BLOCK_ARP_DURING_DHCP
+  DHDCFLAGS += -DWL_STATIC_IF
+  DHDCFLAGS += -DWL_STATIC_IFNAME_PREFIX="\"swlan0\""
+# Iface force dev close
+  DHDCFLAGS += -DIFACE_HANG_FORCE_DEV_CLOSE
 endif
 endif
 endif
@@ -1261,14 +1274,26 @@ endif
 ifneq ($(CONFIG_BCM4343),)
   DHDCFLAGS += -DBCM43430_CHIP -DSUPPORT_MULTIPLE_REVISION -DHW_OOB
   DHDCFLAGS += -DUSE_CID_CHECK
-  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=0
   DHDCFLAGS += -DCUSTOM_ASSOC_RETRY_MAX=7
+  DHDCFLAGS += -DENABLE_BCN_LI_BCN_WAKEUP
 # tput enhancement
   DHDCFLAGS += -DUSE_DYNAMIC_F2_BLKSIZE -DDYNAMIC_F2_BLKSIZE_FOR_NONLEGACY=128
   DHDCFLAGS += -DRXFRAME_THREAD -DRXTHREAD_ONLYSTA
   DHDCFLAGS += -DMAX_HDR_READ=128
   DHDCFLAGS += -DDHD_FIRSTREAD=128
   DHDCFLAGS += -DCUSTOM_AMPDU_BA_WSIZE=64 -DCUSTOM_IBSS_AMPDU_BA_WSIZE=16
+ifeq ($(CONFIG_BCM43436),y)
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=8
+  DHDCFLAGS += -DCUSTOM_DPC_CPUCORE=0
+  DHDCFLAGS += -DCUSTOM_FRAMEBURST_SET=1
+# Enable Firmware Coredump
+  DHDCFLAGS += -DDHD_FW_COREDUMP
+ifeq ($(CONFIG_BCMDHD_PREALLOC_MEMDUMP),y)
+  DHDCFLAGS += -DDHD_USE_STATIC_MEMDUMP
+endif
+else
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=0
+endif
   # New Features
   DHDCFLAGS += -DDHD_RANDOM_MAC_SCAN
   DHDCFLAGS += -DWL11U
@@ -1282,11 +1307,26 @@ ifeq ($(CONFIG_BCM4343),y)
   DHDCFLAGS += -DUSE_LATE_INITCALL_SYNC
   DRIVER_TYPE = y
 endif
-  # Remove common feature for BCM4343
+# FCC power limit control on ch12/13.
+  DHDCFLAGS += -DFCC_PWR_LIMIT_2G
+# Enable Roam time thresh
+  DHDCFLAGS += -DENABLE_MAX_DTIM_IN_SUSPEND
+  DHDCFLAGS += -DCUSTOM_BCN_TIMEOUT_IN_SUSPEND=10
+  DHDCFLAGS += -DCUSTOM_ROAM_TIME_THRESH_IN_SUSPEND=6000
+  DHDCFLAGS += -DMAX_DTIM_ALLOWED_INTERVAL=925
+# Remove common feature for BCM4343
   DHDCFLAGS :=$(filter-out -DROAM_AP_ENV_DETECTION,$(DHDCFLAGS))
   DHDCFLAGS :=$(filter-out -DDISABLE_11H_SOFTAP,$(DHDCFLAGS))
+  DHDCFLAGS :=$(filter-out -DSUPPORT_P2P_GO_PS,$(DHDCFLAGS))
 # Generate .softap.info
   DHDCFLAGS += -DGEN_SOFTAP_INFO_FILE
+ifneq ($(PLATFORM_VERSION),)
+# Android O OS use below features
+ifeq ($(shell expr $(PLATFORM_VERSION) \>= 8.0),1)
+# Use single nvram file
+  DHDCFLAGS += -DDHD_USE_SINGLE_NVRAM_FILE
+endif
+endif
 endif
 
 ifneq ($(CONFIG_BCM43012),)
@@ -1460,6 +1500,7 @@ DHDCFLAGS := $(filter-out -DGSCAN_SUPPORT,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DRTT_SUPPORT,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DDHD_LB_IRQSET,$(DHDCFLAGS))
 DHDCFLAGS := $(filter-out -DSET_PCIE_IRQ_CPU_CORE,$(DHDCFLAGS))
+DHDCFLAGS := $(filter-out -DWL_BCNRECV,$(DHDCFLAGS))
 DHD_ANDROID_OFILES := $(filter-out wl_cfgvendor.o,$(DHD_ANDROID_OFILES))
 DHD_ANDROID_OFILES := $(filter-out dhd_rtt.o,$(DHD_ANDROID_OFILES))
 endif
diff --git a/drivers/net/wireless/bcmdhd4361/bcmsdh_sdmmc_linux.c b/drivers/net/wireless/bcmdhd4361/bcmsdh_sdmmc_linux.c
index 8df2e414ac4d..5fb3f8f9efdf 100644
--- a/drivers/net/wireless/bcmdhd4361/bcmsdh_sdmmc_linux.c
+++ b/drivers/net/wireless/bcmdhd4361/bcmsdh_sdmmc_linux.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Proprietary,Open:>>
  *
- * $Id: bcmsdh_sdmmc_linux.c 796833 2018-12-27 05:52:37Z $
+ * $Id: bcmsdh_sdmmc_linux.c 801673 2019-01-29 04:29:43Z $
  */
 
 #include <typedefs.h>
@@ -80,7 +80,10 @@
 
 #if !defined(SDIO_DEVICE_ID_BROADCOM_4362)
 #define SDIO_DEVICE_ID_BROADCOM_4362    0x4362
-#endif // endif
+#endif  /* !defined(SDIO_DEVICE_ID_BROADCOM_4362) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_43430)
+#define SDIO_DEVICE_ID_BROADCOM_43430	43430
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_43430) */
 
 extern void wl_cfg80211_set_parent_dev(void *dev);
 extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
@@ -222,6 +225,7 @@ static const struct sdio_device_id bcmsdh_sdmmc_ids[] = {
 	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4324) },
 	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43239) },
 	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4345) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43430) },
 	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4362) },
 	{ SDIO_DEVICE_CLASS(SDIO_CLASS_NONE)		},
 	{ 0, 0, 0, 0 /* end: all zeroes */
diff --git a/drivers/net/wireless/bcmdhd4361/bcmutils.c b/drivers/net/wireless/bcmdhd4361/bcmutils.c
index 61168892c40b..dff9cd9fc00b 100644
--- a/drivers/net/wireless/bcmdhd4361/bcmutils.c
+++ b/drivers/net/wireless/bcmdhd4361/bcmutils.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: bcmutils.c 759570 2018-04-26 00:14:59Z $
+ * $Id: bcmutils.c 813756 2019-04-08 05:18:14Z $
  */
 
 #include <bcm_cfg.h>
@@ -316,20 +316,28 @@ pktsetprio(void *pkt, bool update_vtag)
 		uint8 dscp = tos_tc >> IPV4_TOS_DSCP_SHIFT;
 		switch (dscp) {
 		case DSCP_EF:
+		case DSCP_VA:
 			priority = PRIO_8021D_VO;
 			break;
 		case DSCP_AF31:
 		case DSCP_AF32:
 		case DSCP_AF33:
+		case DSCP_CS3:
 			priority = PRIO_8021D_CL;
 			break;
 		case DSCP_AF21:
 		case DSCP_AF22:
 		case DSCP_AF23:
+			priority = PRIO_8021D_EE;
+			break;
 		case DSCP_AF11:
 		case DSCP_AF12:
 		case DSCP_AF13:
-			priority = PRIO_8021D_EE;
+		case DSCP_CS2:
+			priority = PRIO_8021D_BE;
+			break;
+		case DSCP_CS6:
+			priority = PRIO_8021D_NC;
 			break;
 		default:
 			priority = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
diff --git a/drivers/net/wireless/bcmdhd4361/dhd.h b/drivers/net/wireless/bcmdhd4361/dhd.h
index bfca7496365a..df9f668aa1c8 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd.h
+++ b/drivers/net/wireless/bcmdhd4361/dhd.h
@@ -27,7 +27,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd.h 798183 2019-01-07 09:51:58Z $
+ * $Id: dhd.h 815855 2019-04-22 05:16:49Z $
  */
 
 /****************
@@ -427,65 +427,63 @@ enum dhd_prealloc_index {
 };
 
 enum dhd_dongledump_mode {
-	DUMP_DISABLED = 0,
-	DUMP_MEMONLY,
-	DUMP_MEMFILE,
-	DUMP_MEMFILE_BUGON,
-	DUMP_MEMFILE_MAX
+	DUMP_DISABLED		= 0,
+	DUMP_MEMONLY		= 1,
+	DUMP_MEMFILE		= 2,
+	DUMP_MEMFILE_BUGON	= 3,
+	DUMP_MEMFILE_MAX	= 4
 };
 
 enum dhd_dongledump_type {
-	DUMP_TYPE_RESUMED_ON_TIMEOUT = 1,
-	DUMP_TYPE_D3_ACK_TIMEOUT,
-	DUMP_TYPE_DONGLE_TRAP,
-	DUMP_TYPE_MEMORY_CORRUPTION,
-	DUMP_TYPE_PKTID_AUDIT_FAILURE,
-	DUMP_TYPE_PKTID_INVALID,
-	DUMP_TYPE_SCAN_TIMEOUT,
-	DUMP_TYPE_SCAN_BUSY,
-	DUMP_TYPE_BY_SYSDUMP,
-	DUMP_TYPE_BY_LIVELOCK,
-	DUMP_TYPE_AP_LINKUP_FAILURE,
-	DUMP_TYPE_AP_ABNORMAL_ACCESS,
-	DUMP_TYPE_CFG_VENDOR_TRIGGERED,
-	DUMP_TYPE_RESUMED_ON_TIMEOUT_TX,
-	DUMP_TYPE_RESUMED_ON_TIMEOUT_RX,
-	DUMP_TYPE_RESUMED_ON_INVALID_RING_RDWR,
-	DUMP_TYPE_TRANS_ID_MISMATCH,
-	DUMP_TYPE_IFACE_OP_FAILURE,
-#ifdef DEBUG_DNGL_INIT_FAIL
-	DUMP_TYPE_DONGLE_INIT_FAILURE,
-#endif /* DEBUG_DNGL_INIT_FAIL */
-#ifdef SUPPORT_LINKDOWN_RECOVERY
-	DUMP_TYPE_READ_SHM_FAIL,
-#endif /* SUPPORT_LINKDOWN_RECOVERY */
-	DUMP_TYPE_DONGLE_HOST_EVENT,
-	DUMP_TYPE_SMMU_FAULT,
-	DUMP_TYPE_RESUMED_UNKNOWN,
-#ifdef DHD_ERPOM
-	DUMP_TYPE_DUE_TO_BT,
-#endif /* DHD_ERPOM */
-	DUMP_TYPE_BY_USER
+	DUMP_TYPE_RESUMED_ON_TIMEOUT		= 1,
+	DUMP_TYPE_D3_ACK_TIMEOUT		= 2,
+	DUMP_TYPE_DONGLE_TRAP			= 3,
+	DUMP_TYPE_MEMORY_CORRUPTION		= 4,
+	DUMP_TYPE_PKTID_AUDIT_FAILURE		= 5,
+	DUMP_TYPE_PKTID_INVALID			= 6,
+	DUMP_TYPE_SCAN_TIMEOUT			= 7,
+	DUMP_TYPE_SCAN_BUSY			= 8,
+	DUMP_TYPE_BY_SYSDUMP			= 9,
+	DUMP_TYPE_BY_LIVELOCK			= 10,
+	DUMP_TYPE_AP_LINKUP_FAILURE		= 11,
+	DUMP_TYPE_AP_ABNORMAL_ACCESS		= 12,
+	DUMP_TYPE_CFG_VENDOR_TRIGGERED		= 13,
+	DUMP_TYPE_RESUMED_ON_TIMEOUT_TX		= 14,
+	DUMP_TYPE_RESUMED_ON_TIMEOUT_RX		= 15,
+	DUMP_TYPE_RESUMED_ON_INVALID_RING_RDWR	= 16,
+	DUMP_TYPE_TRANS_ID_MISMATCH		= 17,
+	DUMP_TYPE_IFACE_OP_FAILURE		= 18,
+	DUMP_TYPE_DONGLE_INIT_FAILURE		= 19,
+	DUMP_TYPE_READ_SHM_FAIL			= 20,
+	DUMP_TYPE_DONGLE_HOST_EVENT		= 21,
+	DUMP_TYPE_SMMU_FAULT			= 22,
+	DUMP_TYPE_RESUMED_UNKNOWN		= 23,
+	DUMP_TYPE_DUE_TO_BT			= 24,
+	DUMP_TYPE_LOGSET_BEYOND_RANGE		= 25,
+	DUMP_TYPE_BY_USER			= 26,
+	DUMP_TYPE_CTO_RECOVERY			= 27,
+	DUMP_TYPE_SEQUENTIAL_PRIVCMD_ERROR	= 28
 };
 
 enum dhd_hang_reason {
-	HANG_REASON_MASK = 0x8000,
-	HANG_REASON_IOCTL_RESP_TIMEOUT = 0x8001,
-	HANG_REASON_DONGLE_TRAP = 0x8002,
-	HANG_REASON_D3_ACK_TIMEOUT = 0x8003,
-	HANG_REASON_BUS_DOWN = 0x8004,
-	HANG_REASON_MSGBUF_LIVELOCK = 0x8006,
-	HANG_REASON_IFACE_DEL_FAILURE = 0x8007,
-	HANG_REASON_HT_AVAIL_ERROR = 0x8008,
-	HANG_REASON_PCIE_RC_LINK_UP_FAIL = 0x8009,
-	HANG_REASON_PCIE_PKTID_ERROR = 0x800A,
-	HANG_REASON_IFACE_ADD_FAILURE = 0x800B,
-	HANG_REASON_IOCTL_RESP_TIMEOUT_SCHED_ERROR = 0x800C,
-	HANG_REASON_D3_ACK_TIMEOUT_SCHED_ERROR = 0x800D,
-	HANG_REASON_PCIE_LINK_DOWN = 0x8805,
-	HANG_REASON_INVALID_EVENT_OR_DATA = 0x8806,
-	HANG_REASON_UNKNOWN = 0x8807,
-	HANG_REASON_MAX = 0x8808
+	HANG_REASON_MASK 				= 0x8000,
+	HANG_REASON_IOCTL_RESP_TIMEOUT 			= 0x8001,
+	HANG_REASON_DONGLE_TRAP				= 0x8002,
+	HANG_REASON_D3_ACK_TIMEOUT			= 0x8003,
+	HANG_REASON_BUS_DOWN				= 0x8004,
+	HANG_REASON_MSGBUF_LIVELOCK			= 0x8006,
+	HANG_REASON_IFACE_DEL_FAILURE			= 0x8007,
+	HANG_REASON_HT_AVAIL_ERROR			= 0x8008,
+	HANG_REASON_PCIE_RC_LINK_UP_FAIL		= 0x8009,
+	HANG_REASON_PCIE_PKTID_ERROR			= 0x800A,
+	HANG_REASON_IFACE_ADD_FAILURE			= 0x800B,
+	HANG_REASON_IOCTL_RESP_TIMEOUT_SCHED_ERROR	= 0x800C,
+	HANG_REASON_D3_ACK_TIMEOUT_SCHED_ERROR		= 0x800D,
+	HANG_REASON_SEQUENTIAL_PRIVCMD_ERROR		= 0x800E,
+	HANG_REASON_PCIE_LINK_DOWN			= 0x8805,
+	HANG_REASON_INVALID_EVENT_OR_DATA		= 0x8806,
+	HANG_REASON_UNKNOWN				= 0x8807,
+	HANG_REASON_MAX					= 0x8808
 };
 
 #define WLC_E_DEAUTH_MAX_REASON 0x0FFF
@@ -1241,6 +1239,7 @@ typedef struct dhd_pub {
 #ifdef DHD_USE_CLMINFO_PARSER
 	bool is_clm_mult_regrev;	/* Checking for CLM single/multiple regrev */
 #endif /* DHD_USE_CLMINFO_PARSER */
+	bool disable_dtim_in_suspend;	/* Disable set bcn_li_dtim in suspend */
 } dhd_pub_t;
 
 typedef struct {
@@ -1890,6 +1889,7 @@ extern int net_os_rxfilter_add_remove(struct net_device *dev, int val, int num);
 #define MAX_PKTFLT_FIXED_PATTERN_SIZE	32
 #define MAX_PKTFLT_FIXED_BUF_SIZE	\
 	(WL_PKT_FILTER_FIXED_LEN + MAX_PKTFLT_FIXED_PATTERN_SIZE * 2)
+#define MAXPKT_ARG	16
 #endif /* PKT_FILTER_SUPPORT */
 
 #if defined(BCMPCIE)
@@ -2383,6 +2383,9 @@ extern char fw_path2[MOD_PARAM_PATHLEN];
 #ifdef WL_STATIC_IFNAME_PREFIX
 #undef WL_STATIC_IFNAME_PREFIX
 #endif /* WL_STATIC_IFNAME_PREFIX */
+#ifdef IFACE_HANG_FORCE_DEV_CLOSE
+#undef IFACE_HANG_FORCE_DEV_CLOSE
+#endif /* IFACE_HANG_FORCE_DEV_CLOSE */
 #endif /* ANDROID_PLATFORM_VERSION < 9 */
 #endif /* ANDROID_PLATFORM_VERSION */
 
@@ -2395,11 +2398,12 @@ extern char fw_path2[MOD_PARAM_PATHLEN];
 #if (ANDROID_PLATFORM_VERSION >= 9)
 #define PLATFORM_PATH	"/data/vendor/conn/"
 #define DHD_MAC_ADDR_EXPORT
-#if !defined(CONFIG_BCM4359)
+#if defined(WL_BAM)
 #define DHD_ADPS_BAM_EXPORT
-#endif	/* CONFIG_BCM4359 */
+#endif	/* WL_BAM */
 #define DHD_EXPORT_CNTL_FILE
 #define DHD_SOFTAP_DUAL_IF_INFO
+#define DHD_SEND_HANG_PRIVCMD_ERRORS
 /* ANDROID P(9.0) and later, always use single nvram file */
 #ifndef DHD_USE_SINGLE_NVRAM_FILE
 #define DHD_USE_SINGLE_NVRAM_FILE
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_common.c b/drivers/net/wireless/bcmdhd4361/dhd_common.c
index cfba55c49362..c8cedd87c228 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_common.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_common.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_common.c 796845 2018-12-27 06:24:52Z $
+ * $Id: dhd_common.c 815855 2019-04-22 05:16:49Z $
  */
 #include <typedefs.h>
 #include <osl.h>
@@ -3638,7 +3638,7 @@ dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg)
 	int 				rc;
 	uint32				mask_size;
 	uint32				pattern_size;
-	char				*argv[16], * buf = 0;
+	char				*argv[MAXPKT_ARG] = {0}, * buf = 0;
 	int					i = 0;
 	char				*arg_save = 0, *arg_org = 0;
 
@@ -3666,8 +3666,13 @@ dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg)
 	}
 
 	argv[i] = bcmstrtok(&arg_save, " ", 0);
-	while (argv[i++])
+	while (argv[i++]) {
+		if (i >= MAXPKT_ARG) {
+			DHD_ERROR(("Invalid args provided\n"));
+			goto fail;
+		}
 		argv[i] = bcmstrtok(&arg_save, " ", 0);
+	}
 
 	i = 0;
 	if (argv[i] == NULL) {
@@ -4598,6 +4603,12 @@ dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd, int *dtim_period, int *bcn_interval)
 	int ret = -1;
 	int allowed_skip_dtim_cnt = 0;
 
+	if (dhd->disable_dtim_in_suspend) {
+		DHD_ERROR(("%s Disable bcn_li_dtim in suspend\n", __FUNCTION__));
+		bcn_li_dtim = 0;
+		return bcn_li_dtim;
+	}
+
 	/* Check if associated */
 	if (dhd_is_associated(dhd, 0, NULL) == FALSE) {
 		DHD_TRACE(("%s NOT assoc ret %d\n", __FUNCTION__, ret));
@@ -4674,6 +4685,12 @@ dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd)
 	int ap_beacon = 0;
 	int allowed_skip_dtim_cnt = 0;
 
+	if (dhd->disable_dtim_in_suspend) {
+		DHD_ERROR(("%s Disable bcn_li_dtim in suspend\n", __FUNCTION__));
+		bcn_li_dtim = 0;
+		goto exit;
+	}
+
 	/* Check if associated */
 	if (dhd_is_associated(dhd, 0, NULL) == FALSE) {
 		DHD_TRACE(("%s NOT assoc ret %d\n", __FUNCTION__, ret));
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_custom_sec.c b/drivers/net/wireless/bcmdhd4361/dhd_custom_sec.c
index 3ca97ad00c7f..80e1fc8368e3 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_custom_sec.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_custom_sec.c
@@ -903,8 +903,10 @@ early_param("androidboot.hw_rev", get_hw_rev);
 #ifdef GEN_SOFTAP_INFO_FILE
 #define SOFTAP_INFO_FILE_FIRST_LINE    "#.softap.info"
 /*
- * # Whether both wifi and hotspot can be turned on at the same time?
+ * # Does RSDB Wifi sharing support?
  * DualBandConcurrency
+ * # Both wifi and hotspot can be turned on at the same time?
+ * DualInterface
  * # 5Ghz band support?
  * 5G
  * # How many clients can be connected?
@@ -936,21 +938,17 @@ const char *softap_info_values[] = {
 const char *softap_info_values[] = {
 	"yes",
 #ifdef DHD_SOFTAP_DUAL_IF_INFO
-#ifdef CONFIG_WLAN_GRACE
+#if defined(CONFIG_WLAN_GRACE) || defined(CONFIG_SEC_KELLYLTE_PROJECT)
 	"yes",
 #else
 	"no",
-#endif /* CONFIG_WLAN_GRACE */
+#endif /* CONFIG_WLAN_GRACE || CONFIG_SEC_KELLYLTE_PROJECT */
 #endif /* DHD_SOFTAP_DUAL_IF_INFO */
 	"yes", "10", "yes", "yes", "yes", NULL
 };
 #elif defined(BCM43454_CHIP) || defined(BCM43455_CHIP) || defined(BCM43456_CHIP)
 const char *softap_info_values[] = {
-#ifdef WL_RESTRICTED_APSTA_SCC
-	"yes",
-#else
 	"no",
-#endif /* WL_RESTRICTED_APSTA_SCC */
 #ifdef DHD_SOFTAP_DUAL_IF_INFO
 #ifdef WL_RESTRICTED_APSTA_SCC
 	"yes",
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_linux.c b/drivers/net/wireless/bcmdhd4361/dhd_linux.c
index d11d908cf906..4d318d0cb85d 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_linux.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_linux.c
@@ -25,7 +25,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_linux.c 796863 2018-12-27 07:39:27Z $
+ * $Id: dhd_linux.c 818247 2019-05-07 04:15:13Z $
  */
 
 #include <typedefs.h>
@@ -2906,7 +2906,7 @@ static int dhd_set_suspend(int value, dhd_pub_t *dhd)
 	uint roamvar = 1;
 #endif /* ENABLE_FW_ROAM_SUSPEND */
 #ifdef ENABLE_BCN_LI_BCN_WAKEUP
-	int bcn_li_bcn;
+	int bcn_li_bcn = 1;
 #endif /* ENABLE_BCN_LI_BCN_WAKEUP */
 	uint nd_ra_filter = 0;
 #ifdef ENABLE_IPMCAST_FILTER
@@ -3087,13 +3087,22 @@ static int dhd_set_suspend(int value, dhd_pub_t *dhd)
 				}
 #endif /* ENABLE_FW_ROAM_SUSPEND */
 #ifdef ENABLE_BCN_LI_BCN_WAKEUP
-				bcn_li_bcn = 0;
+				if (bcn_li_dtim) {
+					bcn_li_bcn = 0;
+				}
 				ret = dhd_iovar(dhd, 0, "bcn_li_bcn", (char *)&bcn_li_bcn,
 						sizeof(bcn_li_bcn), NULL, 0, TRUE);
 				if (ret < 0) {
 					DHD_ERROR(("%s bcn_li_bcn failed %d\n", __FUNCTION__, ret));
 				}
 #endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+#if defined(WL_CFG80211) && defined(WL_BCNRECV)
+				ret = wl_android_bcnrecv_suspend(dhd_linux_get_primary_netdev(dhd));
+				if (ret != BCME_OK) {
+					DHD_ERROR(("failed to stop beacon recv event on"
+						" suspend state (%d)\n", ret));
+				}
+#endif /* WL_CFG80211 && WL_BCNRECV */
 #ifdef NDO_CONFIG_SUPPORT
 				if (dhd->ndo_enable) {
 					if (!dhd->ndo_host_ip_overflow) {
@@ -3171,6 +3180,13 @@ static int dhd_set_suspend(int value, dhd_pub_t *dhd)
 				dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
 				                 sizeof(power_mode), TRUE, 0);
 #endif /* SUPPORT_PM2_ONLY */
+#if defined(WL_CFG80211) && defined(WL_BCNRECV)
+				ret = wl_android_bcnrecv_resume(dhd_linux_get_primary_netdev(dhd));
+				if (ret != BCME_OK) {
+					DHD_ERROR(("failed to resume beacon recv state (%d)\n",
+							ret));
+				}
+#endif /* WL_CF80211 && WL_BCNRECV */
 #ifdef PKT_FILTER_SUPPORT
 				/* disable pkt filter */
 				dhd_enable_packet_filter(0, dhd);
@@ -3254,7 +3270,6 @@ static int dhd_set_suspend(int value, dhd_pub_t *dhd)
 				}
 #endif /* ENABLE_FW_ROAM_SUSPEND */
 #ifdef ENABLE_BCN_LI_BCN_WAKEUP
-				bcn_li_bcn = 1;
 				ret = dhd_iovar(dhd, 0, "bcn_li_bcn", (char *)&bcn_li_bcn,
 						sizeof(bcn_li_bcn), NULL, 0, TRUE);
 				if (ret < 0) {
@@ -7188,6 +7203,7 @@ dhd_add_monitor_if(dhd_info_t *dhd)
 		DHD_ERROR(("%s, register_netdev failed for %s\n",
 			__FUNCTION__, dev->name));
 		free_netdev(dev);
+		return;
 	}
 
 	if (FW_SUPPORTED((&dhd->pub), monitor)) {
@@ -11034,6 +11050,7 @@ dhd_preinit_ioctls(dhd_pub_t *dhd)
 #else
 	dhd->max_dtim_enable = FALSE;
 #endif /* ENABLE_MAX_DTIM_IN_SUSPEND */
+	dhd->disable_dtim_in_suspend = FALSE;
 #ifdef CUSTOM_SET_OCLOFF
 	dhd->ocl_off = FALSE;
 #endif /* CUSTOM_SET_OCLOFF */
@@ -11717,7 +11734,9 @@ dhd_preinit_ioctls(dhd_pub_t *dhd)
 #endif /* PNO_SUPPORT */
 	/* enable dongle roaming event */
 #ifdef WL_CFG80211
+#if !defined(ROAM_EVT_DISABLE)
 	setbit(eventmask, WLC_E_ROAM);
+#endif /* !ROAM_EVT_DISABLE */
 	setbit(eventmask, WLC_E_BSSID);
 #endif /* WL_CFG80211 */
 #ifdef BCMCCX
@@ -11824,6 +11843,9 @@ dhd_preinit_ioctls(dhd_pub_t *dhd)
 #ifdef SUPPORT_EVT_SDB_LOG
 		setbit(eventmask_msg->mask, WLC_E_SDB_TRANSITION);
 #endif /* SUPPORT_EVT_SDB_LOG */
+#ifdef WL_BCNRECV
+		setbit(eventmask_msg->mask, WLC_E_BCNRECV_ABORTED);
+#endif /* WL_BCNRECV */
 		/* Write updated Event mask */
 		eventmask_msg->ver = EVENTMSGS_VER;
 		eventmask_msg->command = EVENTMSGS_SET_MASK;
@@ -14573,6 +14595,26 @@ int net_os_set_max_dtim_enable(struct net_device *dev, int val)
 	return 0;
 }
 
+int
+net_os_set_disable_dtim_in_suspend(struct net_device *dev, int val)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	if (dhd) {
+		DHD_ERROR(("%s: Disable bcn_li_dtim in suspend : %s\n",
+			__FUNCTION__, (val ? "Enable" : "Disable")));
+		if (val) {
+			dhd->pub.disable_dtim_in_suspend = TRUE;
+		} else {
+			dhd->pub.disable_dtim_in_suspend = FALSE;
+		}
+	} else {
+		return -1;
+	}
+
+	return 0;
+}
+
 #ifdef PKT_FILTER_SUPPORT
 int net_os_rxfilter_add_remove(struct net_device *dev, int add_remove, int num)
 {
@@ -16723,6 +16765,15 @@ dhd_convert_memdump_type_to_str(uint32 type, char *buf, int substr_type)
 			type_str = "DUE_TO_BT";
 			break;
 #endif /* DHD_ERPOM */
+		case DUMP_TYPE_LOGSET_BEYOND_RANGE:
+			type_str = "LOGSET_BEYOND_RANGE";
+			break;
+		case DUMP_TYPE_CTO_RECOVERY:
+			type_str = "CTO_RECOVERY";
+			break;
+		case DUMP_TYPE_SEQUENTIAL_PRIVCMD_ERROR:
+			type_str = "SEQUENTIAL_PRIVCMD_ERROR";
+			break;
 		default:
 			type_str = "Unknown_type";
 			break;
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_linux.h b/drivers/net/wireless/bcmdhd4361/dhd_linux.h
index 671d2f97b3ab..5bf17a699df1 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_linux.h
+++ b/drivers/net/wireless/bcmdhd4361/dhd_linux.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_linux.h 798171 2019-01-07 09:10:40Z $
+ * $Id: dhd_linux.h 798798 2019-01-10 10:24:21Z $
  */
 
 /* wifi platform functions for power, interrupt and pre-alloc, either
@@ -302,6 +302,10 @@ extern uint32 sec_save_softap_info(void);
 #endif /* GEN_SOFTAP_INFO_FILE */
 #endif /* CUSTOMER_HW4 */
 
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+extern uint32 report_hang_privcmd_err;
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
 #if defined(ARGOS_CPU_SCHEDULER) && !defined(DHD_LB_IRQSET) && \
 	!defined(CONFIG_SOC_EXYNOS7870)
 extern int argos_task_affinity_setup_label(struct task_struct *p, const char *label,
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_linux_exportfs.c b/drivers/net/wireless/bcmdhd4361/dhd_linux_exportfs.c
index b406bad2eb8d..057f0e545975 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_linux_exportfs.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_linux_exportfs.c
@@ -25,7 +25,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_linux_exportfs.c 793750 2018-12-11 02:12:38Z $
+ * $Id: dhd_linux_exportfs.c 808910 2019-03-11 10:44:36Z $
  */
 #include <linux/kobject.h>
 #include <linux/proc_fs.h>
@@ -916,7 +916,7 @@ set_proptx(struct dhd_info *dev, const char *buf, size_t count)
 
 	proptx = onoff;
 	DHD_ERROR(("[WIFI_SEC] %s: FRAMEBURST On/Off from sysfs = %u\n",
-		__FUNCTION__, txbf));
+		__FUNCTION__, proptx));
 	return count;
 }
 
@@ -1012,6 +1012,36 @@ static struct dhd_attr dhd_attr_adps_bam =
 	__ATTR(bad_ap_list, 0660, show_adps_bam_list, store_adps_bam_list);
 #endif	/* DHD_ADPS_BAM_EXPORT && WL_BAM */
 
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+uint32 report_hang_privcmd_err = 1;
+
+static ssize_t
+show_hang_privcmd_err(struct dhd_info *dev, char *buf)
+{
+	ssize_t ret = 0;
+
+	ret = scnprintf(buf, PAGE_SIZE - 1, "%u\n", report_hang_privcmd_err);
+	return ret;
+}
+
+static ssize_t
+set_hang_privcmd_err(struct dhd_info *dev, const char *buf, size_t count)
+{
+	uint32 val;
+
+	val = bcm_atoi(buf);
+	sscanf(buf, "%u", &val);
+
+	report_hang_privcmd_err = val ? 1 : 0;
+	DHD_INFO(("%s: Set report HANG for private cmd error: %d\n",
+		__FUNCTION__, report_hang_privcmd_err));
+	return count;
+}
+
+static struct dhd_attr dhd_attr_hang_privcmd_err =
+	__ATTR(hang_privcmd_err, 0660, show_hang_privcmd_err, set_hang_privcmd_err);
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
 /* Attribute object that gets registered with "wifi" kobject tree */
 static struct attribute *control_file_attrs[] = {
 #ifdef DHD_MAC_ADDR_EXPORT
@@ -1061,6 +1091,9 @@ static struct attribute *control_file_attrs[] = {
 #ifdef DHD_ADPS_BAM_EXPORT
 	&dhd_attr_adps_bam.attr,
 #endif	/* DHD_ADPS_BAM_EXPORT */
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+	&dhd_attr_hang_privcmd_err.attr,
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
 	NULL
 };
 
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_msgbuf.c b/drivers/net/wireless/bcmdhd4361/dhd_msgbuf.c
index b49a178c43e6..aa5e530fea7d 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_msgbuf.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_msgbuf.c
@@ -26,7 +26,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_msgbuf.c 796673 2018-12-26 08:34:38Z $
+ * $Id: dhd_msgbuf.c 818370 2019-05-07 11:39:47Z $
  */
 
 #include <typedefs.h>
@@ -8940,6 +8940,11 @@ dhd_prot_debug_info_print(dhd_pub_t *dhd)
 	DHD_ERROR(("DHD: %s\n", dhd_version));
 	DHD_ERROR(("Firmware: %s\n", fw_version));
 
+#ifdef DHD_FW_COREDUMP
+	DHD_ERROR(("\n ------- DUMPING CONFIGURATION INFORMATION ------ \r\n"));
+	DHD_ERROR(("memdump mode: %d\n", dhd->memdump_enabled));
+#endif /* DHD_FW_COREDUMP */
+
 	DHD_ERROR(("\n ------- DUMPING PROTOCOL INFORMATION ------- \r\n"));
 	DHD_ERROR(("ICPrevs: Dev %d, Host %d, active %d\n",
 		prot->device_ipc_version,
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_pcie.c b/drivers/net/wireless/bcmdhd4361/dhd_pcie.c
index 8fbd3ea567cd..8aeacde1029f 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_pcie.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_pcie.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_pcie.c 797197 2018-12-29 03:31:21Z $
+ * $Id: dhd_pcie.c 802450 2019-02-01 14:05:56Z $
  */
 
 /* include files */
@@ -159,13 +159,10 @@ static void dhdpcie_bus_reg_unmap(osl_t *osh, volatile char *addr, int size);
 static int dhdpcie_cc_nvmshadow(dhd_bus_t *bus, struct bcmstrbuf *b);
 static void dhdpcie_fw_trap(dhd_bus_t *bus);
 static void dhd_fillup_ring_sharedptr_info(dhd_bus_t *bus, ring_info_t *ring_info);
+static void dhdpcie_handle_mb_data(dhd_bus_t *bus);
 extern void dhd_dpc_enable(dhd_pub_t *dhdp);
 extern void dhd_dpc_kill(dhd_pub_t *dhdp);
 
-#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
-static void dhdpcie_handle_mb_data(dhd_bus_t *bus);
-#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
-
 #ifdef IDLE_TX_FLOW_MGMT
 static void dhd_bus_check_idle_scan(dhd_bus_t *bus);
 static void dhd_bus_idle_scan(dhd_bus_t *bus);
@@ -754,16 +751,59 @@ dhd_bus_query_dpc_sched_errors(dhd_pub_t *dhdp)
 		/* print out minimum timestamp info */
 		DHD_ERROR(("isr_entry_time="SEC_USEC_FMT
 			" isr_exit_time="SEC_USEC_FMT
-			" dpc_entry_time="SEC_USEC_FMT
-			"\ndpc_exit_time="SEC_USEC_FMT
+			" last_non_ours_irq_time="SEC_USEC_FMT
+			" \ndpc_entry_time="SEC_USEC_FMT
+			" dpc_exit_time="SEC_USEC_FMT
 			" dpc_sched_time="SEC_USEC_FMT
 			" resched_dpc_time="SEC_USEC_FMT"\n",
 			GET_SEC_USEC(bus->isr_entry_time),
 			GET_SEC_USEC(bus->isr_exit_time),
+			GET_SEC_USEC(bus->last_non_ours_irq_time),
 			GET_SEC_USEC(bus->dpc_entry_time),
 			GET_SEC_USEC(bus->dpc_exit_time),
 			GET_SEC_USEC(bus->dpc_sched_time),
 			GET_SEC_USEC(bus->resched_dpc_time)));
+		/* Added more log to debug un-scheduling from isr */
+		DHD_ERROR(("donglereset=%d, busstate=%d instatus=0x%x intr_enabled=%d \n",
+			dhdp->dongle_reset, dhdp->busstate, bus->intstatus, bus->intr_enabled));
+
+		dhd_pcie_dump_rc_conf_space_cap(dhdp);
+#ifdef EXTENDED_PCIE_DEBUG_DUMP
+	DHD_ERROR(("Pcie EP Uncorrectable Error Status Val=0x%x\n",
+		dhdpcie_ep_access_cap(bus, PCIE_EXTCAP_ID_ERR,
+		PCIE_EXTCAP_AER_UCERR_OFFSET, TRUE, FALSE, 0)));
+	DHD_ERROR(("hdrlog0(0x%x)=0x%08x hdrlog1(0x%x)=0x%08x hdrlog2(0x%x)=0x%08x "
+		"hdrlog3(0x%x)=0x%08x\n", PCI_TLP_HDR_LOG1,
+		dhd_pcie_config_read(bus->osh, PCI_TLP_HDR_LOG1, sizeof(uint32)),
+		PCI_TLP_HDR_LOG2,
+		dhd_pcie_config_read(bus->osh, PCI_TLP_HDR_LOG2, sizeof(uint32)),
+		PCI_TLP_HDR_LOG3,
+		dhd_pcie_config_read(bus->osh, PCI_TLP_HDR_LOG3, sizeof(uint32)),
+		PCI_TLP_HDR_LOG4,
+		dhd_pcie_config_read(bus->osh, PCI_TLP_HDR_LOG4, sizeof(uint32))));
+		if (bus->sih->buscorerev >= 24) {
+			DHD_ERROR(("DeviceStatusControl(0x%x)=0x%x SubsystemControl(0x%x)=0x%x "
+			"L1SSControl2(0x%x)=0x%x\n", PCIECFGREG_DEV_STATUS_CTRL,
+			dhd_pcie_config_read(bus->osh, PCIECFGREG_DEV_STATUS_CTRL,
+			sizeof(uint32)), PCIE_CFG_SUBSYSTEM_CONTROL,
+			dhd_pcie_config_read(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL,
+			sizeof(uint32)), PCIECFGREG_PML1_SUB_CTRL2,
+			dhd_pcie_config_read(bus->osh, PCIECFGREG_PML1_SUB_CTRL2,
+			sizeof(uint32))));
+
+			DHD_ERROR(("\n ------- DUMPING PCIE DAR Registers ------- \r\n"));
+			DHD_ERROR(("clkctl(0x%x)=0x%x pwrctl(0x%x)=0x%x H2D_DB0(0x%x)=0x%x\n",
+			PCIDARClkCtl(bus->sih->buscorerev),
+			si_corereg(bus->sih, bus->sih->buscoreidx,
+			PCIDARClkCtl(bus->sih->buscorerev), 0, 0),
+			PCIDARPwrCtl(bus->sih->buscorerev),
+			si_corereg(bus->sih, bus->sih->buscoreidx,
+			PCIDARPwrCtl(bus->sih->buscorerev), 0, 0),
+			PCIDARH2D_DB0(bus->sih->buscorerev),
+			si_corereg(bus->sih, bus->sih->buscoreidx,
+			PCIDARH2D_DB0(bus->sih->buscorerev), 0, 0)));
+		}
+#endif /* EXTENDED_PCIE_DEBUG_DUMP */
 	}
 
 	return sched_err;
@@ -869,7 +909,9 @@ dhdpcie_bus_isr(dhd_bus_t *bus)
 			DHD_INFO(("%s, not ready to receive interrupts\n", __FUNCTION__));
 			break;
 		}
-
+#ifdef DHD_PCIE_RUNTIMEPM
+		bus->idlecount = 0;
+#endif /* DHD_PCIE_RUNTIMEPM */
 		if (PCIECTO_ENAB(bus)) {
 			/* read pci_intstatus */
 			intstatus = dhdpcie_bus_cfg_read_dword(bus, PCI_INT_STATUS, 4);
@@ -5808,7 +5850,12 @@ dhdpcie_bus_suspend(struct dhd_bus *bus, bool state)
 					__FUNCTION__, intstatus, host_irq_disabled));
 				dhd_pcie_intr_count_dump(bus->dhd);
 				dhd_print_tasklet_status(bus->dhd);
-				dhd_prot_process_ctrlbuf(bus->dhd);
+				if (bus->api.fw_rev >= PCIE_SHARED_VERSION_6 &&
+					!bus->use_mailbox) {
+					dhd_prot_process_ctrlbuf(bus->dhd);
+				} else {
+					dhdpcie_handle_mb_data(bus);
+				}
 				timeleft = dhd_os_d3ack_wait(bus->dhd, &bus->wait_for_d3_ack);
 				/* Clear Interrupts */
 				dhdpcie_bus_clear_intstatus(bus);
@@ -6567,7 +6614,7 @@ dhdpcie_downloadvars(dhd_bus_t *bus, void *arg, int len)
 		bus->dhd->vars_ccode[0] = 0;
 		bus->dhd->vars_regrev = 0;
 		if ((pos = strstr(tmpbuf, "ccode"))) {
-			sscanf(pos, "ccode=%s\n", bus->dhd->vars_ccode);
+			sscanf(pos, "ccode=%3s\n", bus->dhd->vars_ccode);
 		}
 		if ((pos = strstr(tmpbuf, "regrev"))) {
 			sscanf(pos, "regrev=%u\n", &(bus->dhd->vars_regrev));
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_pcie_linux.c b/drivers/net/wireless/bcmdhd4361/dhd_pcie_linux.c
index d812ec409189..2727b7d7d184 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_pcie_linux.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_pcie_linux.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_pcie_linux.c 797197 2018-12-29 03:31:21Z $
+ * $Id: dhd_pcie_linux.c 800754 2019-01-23 08:38:54Z $
  */
 
 /* include files */
@@ -80,16 +80,6 @@
 #define OS_HANDLE_MAGIC		0x1234abcd	/* Magic # to recognize osh */
 #define BCM_MEM_FILENAME_LEN 	24		/* Mem. filename length */
 
-#define OSL_PKTTAG_CLEAR(p) \
-do { \
-	struct sk_buff *s = (struct sk_buff *)(p); \
-	ASSERT(OSL_PKTTAG_SZ == 32); \
-	*(uint32 *)(&s->cb[0]) = 0; *(uint32 *)(&s->cb[4]) = 0; \
-	*(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
-	*(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
-	*(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
-} while (0)
-
 /* user defined data structures  */
 
 typedef struct dhd_pc_res {
diff --git a/drivers/net/wireless/bcmdhd4361/dhd_sdio.c b/drivers/net/wireless/bcmdhd4361/dhd_sdio.c
index 07bb0fde9117..be60ac7a8d72 100644
--- a/drivers/net/wireless/bcmdhd4361/dhd_sdio.c
+++ b/drivers/net/wireless/bcmdhd4361/dhd_sdio.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: dhd_sdio.c 796833 2018-12-27 05:52:37Z $
+ * $Id: dhd_sdio.c 814373 2019-04-11 02:01:55Z $
  */
 
 #include <typedefs.h>
@@ -252,6 +252,8 @@ typedef struct dhd_console {
 
 #endif /* defined (BT_OVER_SDIO) */
 
+#define SBSDIO_CIS_TINY_SIZE_LIMIT 26
+
 /* Private data for SDIO bus interaction */
 typedef struct dhd_bus {
 	dhd_pub_t	*dhd;
@@ -7759,7 +7761,7 @@ dhdsdio_probe_attach(struct dhd_bus *bus, osl_t *osh, void *sdh, void *regsva,
 	uint8 clkctl = 0;
 #endif /* !BCMSPI */
 	uint fn, numfn;
-	uint8 *cis[SDIOD_MAX_IOFUNCS];
+	uint8 *cis = NULL;
 	int32 value;
 	int err = 0;
 
@@ -7809,47 +7811,56 @@ dhdsdio_probe_attach(struct dhd_bus *bus, osl_t *osh, void *sdh, void *regsva,
 		numfn = 0; /* internally func is hardcoded to 1 as gSPI has cis on F1 only */
 #endif /* !BCMSPI */
 #ifndef BCMSDIOLITE
+		if (!(cis = MALLOC(osh, SBSDIO_CIS_SIZE_LIMIT))) {
+			DHD_INFO(("dhdsdio_probe: cis malloc failed\n"));
+			goto fail;
+		}
+		bzero(cis, SBSDIO_CIS_SIZE_LIMIT);
+
 		for (fn = 0; fn <= numfn; fn++) {
-			if (!(cis[fn] = MALLOC(osh, SBSDIO_CIS_SIZE_LIMIT))) {
-				DHD_INFO(("dhdsdio_probe: fn %d cis malloc failed\n", fn));
-				break;
+			if (DHD_INFO_ON()) {
+				if ((err = bcmsdh_cis_read(sdh, fn, cis,
+						SBSDIO_CIS_SIZE_LIMIT))) {
+					DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n",
+						fn, err));
+					break;
+				}
+#ifdef DHD_DEBUG
+				dhd_dump_cis(fn, cis);
+#endif /* DHD_DEBUG */
 			}
-			bzero(cis[fn], SBSDIO_CIS_SIZE_LIMIT);
-
-			if ((err = bcmsdh_cis_read(sdh, fn, cis[fn],
-			                                 SBSDIO_CIS_SIZE_LIMIT))) {
-				DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n", fn, err));
-				MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
-				break;
+			else
+			{
+				if (fn > 0) {
+					if ((err = bcmsdh_cis_read(sdh, fn, cis,
+							SBSDIO_CIS_TINY_SIZE_LIMIT))) {
+						DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n",
+							fn, err));
+						break;
+					}
+				}
 			}
 
-		/* Reading the F1, F2 and F3 max blocksize values from CIS
-		  * and writing into the F1, F2 and F3	block size registers.
-		  * There is no max block size register value available for F0 in CIS register.
-		  * So, setting default value for F0 block size as 32 (which was set earlier
-		  * in iovar). IOVAR takes only one arguement.
-		  * So, we are passing the function number alongwith the value (fn<<16)
-		*/
+			/* Reading the F1, F2 and F3 max blocksize values from CIS
+			 * and writing into the F1, F2 and F3	block size registers.
+			 * There is no max block size register value available for F0 in CIS
+			 * register.
+			 * So, setting default value for F0 block size as 32 (which was set earlier
+			 * in iovar). IOVAR takes only one arguement.
+			 * So, we are passing the function number alongwith the value (fn<<16)
+			 */
 			if (!fn)
 				value = F0_BLOCK_SIZE;
 			else
-				value = (cis[fn][25]<<8) | cis[fn][24] | (fn<<16);
+				value = (cis[25]<<8) | cis[24] | (fn<<16);
 			if (bcmsdh_iovar_op(sdh, "sd_blocksize", NULL, 0, &value,
-				sizeof(value), TRUE) != BCME_OK) {
+					sizeof(value), TRUE) != BCME_OK) {
 				bus->blocksize = 0;
 				DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__,
 					"sd_blocksize"));
 			}
-#ifdef DHD_DEBUG
-			if (DHD_INFO_ON()) {
-				dhd_dump_cis(fn, cis[fn]);
-			}
-#endif /* DHD_DEBUG */
 		}
-	while (fn-- > 0) {
-		ASSERT(cis[fn]);
-		MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
-	}
+		MFREE(osh, cis, SBSDIO_CIS_SIZE_LIMIT);
 #else
 	BCM_REFERENCE(cis);
 	BCM_REFERENCE(fn);
@@ -8365,10 +8376,14 @@ dhdsdio_suspend(void *context)
 	}
 
 	DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+	/* stop all interface network queue. */
+	dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
 	bus->dhd->busstate = DHD_BUS_SUSPEND;
 	if (DHD_BUS_BUSY_CHECK_IN_TX(bus->dhd)) {
 		DHD_ERROR(("Tx Request is not ended\n"));
 		bus->dhd->busstate = DHD_BUS_DATA;
+		/* resume all interface network queue. */
+		dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
 		DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
 		return -EBUSY;
 	}
@@ -8394,6 +8409,8 @@ dhdsdio_suspend(void *context)
 	DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
 	if (ret) {
 		bus->dhd->busstate = DHD_BUS_DATA;
+		/* resume all interface network queue. */
+		dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
 	}
 	DHD_BUS_BUSY_CLEAR_SUSPEND_IN_PROGRESS(bus->dhd);
 	dhd_os_busbusy_wake(bus->dhd);
@@ -8426,6 +8443,8 @@ dhdsdio_resume(void *context)
 	DHD_BUS_BUSY_CLEAR_RESUME_IN_PROGRESS(bus->dhd);
 	bus->dhd->busstate = DHD_BUS_DATA;
 	dhd_os_busbusy_wake(bus->dhd);
+	/* resume all interface network queue. */
+	dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
 	DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
 
 	return 0;
@@ -9330,6 +9349,38 @@ concate_revision_bcm43455(dhd_bus_t *bus, char *fw_path, char *nv_path)
 }
 #endif /* SUPPORT_MULTIPLE_CHIP_4345X */
 
+static int
+concate_revision_bcm43430(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+
+	uint chipver;
+	char chipver_tag[4] = {0, };
+
+	DHD_TRACE(("%s: BCM43430 Multiple Revision Check\n", __FUNCTION__));
+	if (bus->sih->chip != BCM43430_CHIP_ID) {
+		DHD_ERROR(("%s:Chip is not BCM43430\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	chipver = bus->sih->chiprev;
+	DHD_ERROR(("CHIP VER = [0x%x]\n", chipver));
+	if (chipver == 0x0) {
+		DHD_ERROR(("----- CHIP bcm4343S -----\n"));
+		strcat(chipver_tag, "_3s");
+	} else if (chipver == 0x1) {
+		DHD_ERROR(("----- CHIP bcm43438 -----\n"));
+	} else if (chipver == 0x2) {
+		DHD_ERROR(("----- CHIP bcm43436L -----\n"));
+		strcat(chipver_tag, "_36");
+	} else {
+		DHD_ERROR(("----- CHIP bcm43430 unknown revision %d -----\n",
+			chipver));
+	}
+
+	strcat(fw_path, chipver_tag);
+	strcat(nv_path, chipver_tag);
+	return 0;
+}
+
 int
 concate_revision(dhd_bus_t *bus, char *fw_path, char *nv_path)
 {
@@ -9366,6 +9417,9 @@ concate_revision(dhd_bus_t *bus, char *fw_path, char *nv_path)
 		res = concate_revision_bcm43455(bus, fw_path, nv_path);
 		break;
 #endif /* SUPPORT_MULTIPLE_CHIP_4345X */
+	case BCM43430_CHIP_ID:
+		res = concate_revision_bcm43430(bus, fw_path, nv_path);
+		break;
 
 	default:
 		DHD_ERROR(("REVISION SPECIFIC feature is not required\n"));
diff --git a/drivers/net/wireless/bcmdhd4361/document/ChangeHistory.txt b/drivers/net/wireless/bcmdhd4361/document/ChangeHistory.txt
index 399054f1c8f6..6dfc2a17a4fb 100644
--- a/drivers/net/wireless/bcmdhd4361/document/ChangeHistory.txt
+++ b/drivers/net/wireless/bcmdhd4361/document/ChangeHistory.txt
@@ -1,6 +1,92 @@
-BCM4361 DHD 100.13.21 for Android Crown Project
+DHD 100.13.36 for Android P Projects
 (Notes: 100.13.x is twigged off from 100.10.246)
 
+DHD 100.13.36 - 2019.05.24
+New Feature
+ - CS5350346(By Jung Junyeop) Fake AP - Fixed to provide correct channel information for beacon receive result
+ - Enable to support Fake AP
+   (This patch should be sync up with FW 13.38.60(4361B0), FW 13.50.10(4361B2) or higher version)
+ - WIPS attack warning reporting
+   (This patch should be sync up with FW 13.38.60(4361B0), FW 13.50.10(4361B2) or higher version)
+
+Security Patch
+ - CS8069399(By Kang Hyung Wook) SI-13926 Fixed use-after-free in the wl_cfg80211_set_mgmt_vndr_ies function
+
+Others
+ - CS7939107(By Kim Tae-Yong) Included memdump value prints in the dump information
+ - Added missing options into the Kconfig file
+
+
+DHD 100.13.32 - 2019.04.26
+Kernel Panic
+ - CS7696936(By Min SungBin) Fix misspelling of CUSTOMER_HW4_DEBUG definition
+ - CS7706946(By Min SungBin) Fixed to avoid kernel panic due to race condition of cfg->scan_request
+
+Security Patch
+ - CS7860687(By Kang Hyung Wook) SI-12455: Fixed use-after-free write in dhd_set_monitor() function
+ - CS7949699(By Choi Hyeonu) SI-14074: Fixed Security issue, Potential stack-based buffer overflow in dhd_pktfilter_offload_set
+ - CS7956197(By Choi Hyeonu) SI-14130: Fixed the multiple NULL pointer dereference in wl_cfgvendor.c
+
+Others
+ - CS6844193(By MinSoo Kim) Changed log level of LQCM report
+ - CS7099653(By Nitesh Suthar) Enabled frameburst to enhance throughput for BCM43436 projects
+ - CS7362375(By Gu Ja Heon) Added Private command in order to receive every beacon in Suspend
+ - CS7526157(By Suthar Nitesh) Fixed DualBandConcurrency field in .softap.info
+ - CS7765577(By Park Heebae) Wifi-on time reduction by reading necessary CIS information
+ - CS7827257(By Choi Hyeonu) Fixed kernel panic caused by invalid memory access
+ - CS7834653(By Kang MinHo) Removed redundant TX error prints during suspend in SDIO
+ - CS7884436(By Beom Jip Kim) Fixed to cancel p2p listen offloading by framework scan request
+ - CS7892037(By Sun Yinghan) Fixed to support W2018/KELLY Android P OS upgrade
+
+
+DHD 100.13.31.1 - 2019.04.19
+Others
+ - CS4726130(By Min Hyun-Ki) Added User priority to AC mapping in case of various DSCP types that may not compatible with RFC8325
+ - CS6951980(By Min Hyun-Ki) Changed the UP to AC mapping of CS6 based on the RFC8325
+
+
+DHD 100.13.31 - 2019.02.15
+Others
+ - CS7241767(By LEE EONJI) Added more logs for the DPC schedule error debugging
+ - CS7299641(By Kim MinSoo) Enabled LB_TXP for MSM8998 Platform
+ - CS7323375(By kwon Jaecheol) Enabled the softap.info file support in BCM4359 platform
+ - CS7362527(By Hyeonu Choi) Cancel P2P listen offloading operation when SoftAP brings up
+ - CS7363197(By Junhak Lim) Fixed prevent issues
+ - CS7386068(By Lee Gibum) Disabled frameburst for "2.4Ghz + SoftAP" (Drame & Great projects)
+ - Fixed the scan failure when p2p listen offload is triggered
+ - Fixed to abort scan when connection/disconnection requested
+ - Prevented the bus suspend by the PCIe Runtime PM from abnormal ISR status
+
+
+DHD 100.13.28 - 2019.01.25
+Others
+ - CS7111512(By LEE EONJI) Detect turn on failure in factory binary
+ - CS7299329(By Kim Yu-Kyoung) Fixed SoftAP CTS fail due to interface creation failure
+ - Blocked WLC_E_ROAM event to fix wakes-up frequently under weak signal AP
+ - Changed error results of GETSTAINFO private command to BCME_UNSUPPORTED if the BIGDATA_SOFTAP is not supported
+
+
+DHD 100.13.23 - 2019.01.18
+Kernel Panic
+ - Fixed kernel panic during mfg mode interface creation
+
+Security Patch
+ - CS7091164(By Kang Hyung Wook) SI-13561: Fixed kernel heap overflow security issue at dhdpcie_downloadvars
+ - CS7091371(By Kang Hyung Wook) SI-13584: Fixed kernel panic due to access to not allocated memory
+
+Others
+ - CS6785460(By Jeong Min Cheol) Send HANG event to the framework for the sequential private command failure
+ - CS7003600(By Kang MinHo) Support android private command for restoring roam/scan parameters
+ - CS7094302(By Yoon YeJi) Fixed connect failure caused by connection information not initialized
+ - CS7103552(By LEE EONJI) Fixed the recovery routine to fix the D3_ACK timeout issue
+ - CS7119174(By Kim Seong Hwan) Avoid HANG event indication due to sequential private command failures in case of unsupported error
+ - CS7137399(By Yoon YeJi) Fixed connect failure caused by connection information not initialized
+ - CS7141596(By Suthar Nitesh) Fixed MHS operates with STA mac address
+ - Control HANG report for consecutive Android private command failure by sysfs
+ - Increased the NUMBER_SEQUENTIAL_PRIVCMD_ERRORS from 4 to 7
+ - Taking a SOCRAM dump in the sequential private command error case
+
+
 DHD 100.13.21 - 2019.01.11
 Security Patch
  - CS6935603(By Hong Min Whoa) SI-13638: Fixed Kernel warning message by restructuring the DMA_LOCK and DMA_UNLOCK
diff --git a/drivers/net/wireless/bcmdhd4361/include/802.11.h b/drivers/net/wireless/bcmdhd4361/include/802.11.h
index 58ef8e536fd3..c62b76b4ea4a 100644
--- a/drivers/net/wireless/bcmdhd4361/include/802.11.h
+++ b/drivers/net/wireless/bcmdhd4361/include/802.11.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: 802.11.h 759325 2018-04-25 00:30:00Z $
+ * $Id: 802.11.h 778668 2018-08-29 01:12:46Z $
  */
 
 #ifndef _802_11_H_
@@ -257,7 +257,7 @@ BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
 	uint16			capability;
 } BWL_POST_PACKED_STRUCT;
 #define	DOT11_BCN_PRB_LEN	12		/* 802.11 beacon/probe frame fixed length */
-#define	DOT11_BCN_PRB_FIXED_LEN	12		/* 802.11 beacon/probe frame fixed length */
+#define	DOT11_BCN_PRB_FIXED_LEN	12u		/* 802.11 beacon/probe frame fixed length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_auth {
 	uint16			alg;		/* algorithm */
@@ -355,6 +355,7 @@ BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
 	uint8 margin;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_tpc_rep dot11_tpc_rep_t;
+#define DOT11_MNG_IE_TPC_REPORT_SIZE	(sizeof(dot11_tpc_rep_t))
 #define DOT11_MNG_IE_TPC_REPORT_LEN	2 	/* length of IE data, not including 2 byte header */
 
 BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
@@ -1552,6 +1553,9 @@ typedef struct ccx_qfl_ie ccx_qfl_ie_t;
 #define FILS_EXTID_MNG_HLP_CONTAINER_ID		5u	/* FILS HLP Container element */
 #define DOT11_MNG_FILS_HLP_CONTAINER		(DOT11_MNG_ID_EXT_ID +\
 							FILS_EXTID_MNG_HLP_CONTAINER_ID)
+#define FILS_EXTID_MNG_KEY_DELIVERY_ID		7u	/* FILS Key Delivery element */
+#define DOT11_MNG_FILS_KEY_DELIVERY		(DOT11_MNG_ID_EXT_ID +\
+								FILS_EXTID_MNG_KEY_DELIVERY_ID)
 #define FILS_EXTID_MNG_WRAPPED_DATA_ID		8u	/* FILS Wrapped Data element */
 #define DOT11_MNG_FILS_WRAPPED_DATA		(DOT11_MNG_ID_EXT_ID +\
 							FILS_EXTID_MNG_WRAPPED_DATA_ID)
@@ -1993,6 +1997,7 @@ BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
 #define DOT11_BSSTRANS_REQ_LEN 7	/* Fixed length */
+#define DOT11_BSSTRANS_REQ_FIXED_LEN 7u	/* Fixed length */
 
 /* BSS Mgmt Transition Request Mode Field - 802.11v */
 #define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL		0x01
@@ -2886,7 +2891,7 @@ BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
 	struct ether_addr	bssid;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
-#define DOT11_RMREQ_BCN_LEN	18
+#define DOT11_RMREQ_BCN_LEN	18u
 
 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
 	uint8 reg;
@@ -4326,6 +4331,8 @@ typedef enum vht_op_chan_width {
 	VHT_OP_CHAN_WIDTH_80_80	= 3  /* deprecated - IEEE 802.11 REVmc D8.0 Table 11-25 */
 } vht_op_chan_width_t;
 
+#define VHT_OP_INFO_LEN		3
+
 /* AID length */
 #define AID_IE_LEN		2
 /**
@@ -4400,7 +4407,7 @@ typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
 #ifdef WL_LEGACY_P2P
 #define APPLE_OUI           "\x00\x17\xF2"	/* MACOSX OUI */
 #define APPLE_OUI_LEN		3
-#define APPLE_OUI_TYPE_P2P	9
+#define APPLE_OUI_TYPE_P2P	5
 #endif /* WL_LEGACY_P2P */
 
 #ifndef WL_LEGACY_P2P
@@ -4974,6 +4981,17 @@ BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie {
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_ftm_vs_ie dot11_ftm_vs_ie_t;
 
+/* same as payload of dot11_ftm_vs_ie.
+* This definition helps in having struct access
+* of pay load while building FTM VS IE from other modules(NAN)
+*/
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie_pyld {
+	uint8 sub_type;					/* BRCM_FTM_IE_TYPE (or Customer) */
+	uint8 version;
+	ftm_vs_tlv_t	tlvs[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_vs_ie_pyld dot11_ftm_vs_ie_pyld_t;
+
 /* ftm vs api version */
 #define BCM_FTM_VS_PARAMS_VERSION 0x01
 
diff --git a/drivers/net/wireless/bcmdhd4361/include/bcmevent.h b/drivers/net/wireless/bcmdhd4361/include/bcmevent.h
index 194aa27d37d7..c7c2b7ac98e9 100644
--- a/drivers/net/wireless/bcmdhd4361/include/bcmevent.h
+++ b/drivers/net/wireless/bcmdhd4361/include/bcmevent.h
@@ -26,7 +26,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: bcmevent.h 759112 2018-04-24 01:34:08Z $
+ * $Id: bcmevent.h 779385 2018-09-03 17:35:01Z $
  *
  */
 
@@ -292,9 +292,12 @@ typedef union bcm_event_msg_u {
 #define WLC_E_ADPS		176	/* ADPS event */
 #define WLC_E_SLOTTED_BSS_PEER_OP	177	/* Per peer SCB delete */
 #define WLC_E_HWA                178	/* HWA events */
-#define WLC_E_LAST			179	/* highest val + 1 for range checking */
-#if (WLC_E_LAST > 179)
-#error "WLC_E_LAST: Invalid value for last event; must be <= 178."
+#define WLC_E_GTK_KEYROT_NO_CHANSW      179     /* Avoid Chanswitch while GTK key rotation */
+#define WLC_E_ONBODY_STATUS_CHANGE	180	/* Indication of onbody status change */
+#define WLC_E_BCNRECV_ABORTED		181	/* Fake AP bcnrecv aborted roam event */
+#define WLC_E_LAST			182	/* highest val + 1 for range checking */
+#if (WLC_E_LAST > 182)
+#error "WLC_E_LAST: Invalid value for last event; must be <= 182."
 #endif /* WLC_E_LAST */
 
 /* define an API for getting the string name of an event */
@@ -332,6 +335,8 @@ void wl_event_to_network_order(wl_event_msg_t * evt);
 #define WLC_E_STATUS_ERROR		16	/* request failed due to error */
 #define WLC_E_STATUS_SLOTTED_PEER_ADD	17	/* Slotted scb for peer addition status */
 #define WLC_E_STATUS_SLOTTED_PEER_DEL	18	/* Slotted scb for peer deletion status */
+#define WLC_E_STATUS_RXBCN		19	/* Rx Beacon event for FAKEAP feature	*/
+#define WLC_E_STATUS_RXBCN_ABORT	20	/* Rx Beacon abort event for FAKEAP feature */
 #define WLC_E_STATUS_INVALID 0xff  /* Invalid status code to init variables. */
 
 /* 4-way handshake event type */
@@ -382,6 +387,11 @@ typedef struct wl_event_sdb_trans {
 	struct wl_event_sdb_data values[WL_MAX_BSSCFG];
 } wl_event_sdb_trans_t;
 
+/* reason codes for WLC_E_GTK_KEYROT_NO_CHANSW event */
+#define WLC_E_GTKKEYROT_SCANDELAY       0       /* Delay scan while gtk in progress */
+#define WLC_E_GTKKEYROT_SKIPCHANSW_AWDL 1       /* Avoid chansw by awdl while gtk in progress */
+#define WLC_E_GTKKEYROT_SKIPCHANSW_P2P  2       /* Avoid chansw by p2p while gtk in progress */
+
 /* roam reason codes */
 #define WLC_E_REASON_INITIAL_ASSOC	0	/* initial assoc */
 #define WLC_E_REASON_LOW_RSSI		1	/* roamed due to low RSSI */
@@ -431,6 +441,8 @@ typedef struct wl_event_sdb_trans {
 #define WLC_E_PRUNE_NO_DIAG_SUPPORT	19	/* prune due to diagnostic mode not supported */
 #endif /* BCMCCX */
 #define WLC_E_PRUNE_AUTH_RESP_MAC	20	/* suppress auth resp by MAC filter */
+#define WLC_E_PRUNE_ASSOC_RETRY_DELAY	21	/* MBO assoc retry delay */
+#define WLC_E_PRUNE_RSSI_ASSOC_REJ	22	/* OCE RSSI-based assoc rejection */
 
 /* WPA failure reason codes carried in the WLC_E_PSK_SUP event */
 #define WLC_E_SUP_OTHER			0	/* Other reason */
@@ -451,6 +463,9 @@ typedef struct wl_event_sdb_trans {
 #define WLC_E_SUP_WPA_PSK_TMO		15	/* WPA PSK 4-way handshake timeout */
 #define WLC_E_SUP_WPA_PSK_M1_TMO	16	/* WPA PSK 4-way handshake M1 timeout */
 #define WLC_E_SUP_WPA_PSK_M3_TMO	17	/* WPA PSK 4-way handshake M3 timeout */
+#define WLC_E_SUP_GTK_UPDATE_FAIL	18  /* GTK update failure */
+#define WLC_E_SUP_TK_UPDATE_FAIL	19  /* TK update failure */
+#define WLC_E_SUP_KEY_INSTALL_FAIL	20  /* Buffered key install failure */
 
 /* Ucode reason codes carried in the WLC_E_MACDBG event */
 #define WLC_E_MACDBG_LIST_PSM		0	/* Dump list update for PSM registers */
@@ -1100,8 +1115,9 @@ typedef struct {
 
 typedef enum wl_mbo_event_type {
 	WL_MBO_E_CELLULAR_NW_SWITCH = 1,
+	WL_MBO_E_BTM_RCVD = 2,
 	/* ADD before this */
-	WL_MBO_E_LAST = 2,  /* highest val + 1 for range checking */
+	WL_MBO_E_LAST = 3  /* highest val + 1 for range checking */
 } wl_mbo_event_type_t;
 
 /* WLC_E_MBO event structure version */
@@ -1133,6 +1149,29 @@ struct wl_event_mbo_cell_nw_switch {
 	uint32 assoc_time_remain;
 };
 
+/* WLC_E_MBO_BTM_RCVD event structure version */
+#define WL_BTM_EVENT_DATA_VER_1       1
+/* Specific btm event type data */
+struct wl_btm_event_type_data {
+	uint16	version;
+	uint16	len;
+	uint8	transition_reason;	/* transition reason code */
+	uint8	pad[3];			/* pad */
+};
+
+/* WLC_E_PRUNE event structure version */
+#define WL_BSSID_PRUNE_EVT_VER_1	1
+/* MBO-OCE params */
+struct wl_bssid_prune_evt_info {
+	uint16 version;
+	uint16 len;
+	uint8	SSID[32];
+	uint32	time_remaining;		/* Time remaining */
+	struct ether_addr BSSID;
+	uint8	SSID_len;
+	uint8	reason;			/* Reason code */
+};
+
 /* WLC_E_HWA Event structure */
 typedef struct wl_event_hwa {
 	uint16 version; /* structure version */
diff --git a/drivers/net/wireless/bcmdhd4361/include/bcmmsgbuf.h b/drivers/net/wireless/bcmdhd4361/include/bcmmsgbuf.h
index 46d2e28b717f..93d6fd33996c 100644
--- a/drivers/net/wireless/bcmdhd4361/include/bcmmsgbuf.h
+++ b/drivers/net/wireless/bcmdhd4361/include/bcmmsgbuf.h
@@ -27,7 +27,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: bcmmsgbuf.h 739442 2018-01-08 17:45:01Z $
+ * $Id: bcmmsgbuf.h 777047 2018-08-17 01:01:33Z $
  */
 #ifndef _bcmmsgbuf_h_
 #define	_bcmmsgbuf_h_
@@ -69,6 +69,10 @@
 #define H2DRING_DYNAMIC_INFO_MAX_ITEM          32
 #define D2HRING_DYNAMIC_INFO_MAX_ITEM          32
 
+#define D2HRING_EDL_ITEMSIZE			2048u
+#define D2HRING_EDL_MAX_ITEM			256u
+#define D2HRING_EDL_WATERMARK			(D2HRING_EDL_MAX_ITEM >> 5u)
+
 #define D2HRING_CTRL_CMPLT_MAX_ITEM		64
 
 enum {
@@ -576,8 +580,15 @@ typedef struct info_ring_submit_item {
 
 /** Control Completion messages (20 bytes) */
 typedef struct compl_msg_hdr {
-	/** status for the completion */
-	int16	status;
+	union {
+		/** status for the completion */
+		int16	status;
+
+		/* mutually exclusive with pkt fate debug feature */
+		struct pktts_compl_hdr {
+			uint16 d_t4; /* Delta TimeStamp 3: T4-tref */
+		} tx_pktts;
+	};
 	/** submisison flow ring id which generated this status */
 	union {
 	    uint16	ring_id;
@@ -629,6 +640,12 @@ typedef ts_timestamp_t ts_timestamp_ns_64_t;
 typedef ts_timestamp_t ts_correction_m_t;
 typedef ts_timestamp_t ts_correction_b_t;
 
+typedef struct _pktts {
+	uint32 tref; /* Ref Clk in uSec (currently, tsf) */
+	uint16 d_t2; /* Delta TimeStamp 1: T2-tref */
+	uint16 d_t3; /* Delta TimeStamp 2: T3-tref */
+} pktts_t;
+
 /* completion header status codes */
 #define	BCMPCIE_SUCCESS			0
 #define BCMPCIE_NOTFOUND		1
@@ -809,8 +826,10 @@ typedef struct info_buf_resp {
 	uint16			info_data_len;
 	/* sequence number */
 	uint16			seqnum;
+	/* destination */
+	uint8			dest;
 	/* rsvd	*/
-	uint32			rsvd;
+	uint8			rsvd[3];
 	/* XOR checksum or a magic number to audit DMA done */
 	dma_done_t		marker;
 } info_buf_resp_t;
@@ -918,11 +937,23 @@ typedef struct host_rxbuf_cmpl {
 	/** rx status */
 	uint32		rx_status_0;
 	uint32		rx_status_1;
-	/** XOR checksum or a magic number to audit DMA done */
-	/* This is for rev6 only. For IPC rev7, this is a reserved field */
-	dma_done_t	marker;
-	/* timestamp */
-	ipc_timestamp_t ts;
+
+	union { /* size per IPC = (3 x uint32) bytes */
+		struct {
+			/* used by Monitor mode */
+			uint32 marker;
+			/* timestamp */
+			ipc_timestamp_t ts;
+		};
+
+		/* LatTS_With_XORCSUM */
+		struct {
+			/* latency timestamp */
+			pktts_t rx_pktts;
+			/* XOR checksum or a magic number to audit DMA done */
+			dma_done_t marker_ext;
+		};
+	};
 } host_rxbuf_cmpl_t;
 
 typedef union rxbuf_complete_item {
@@ -1001,23 +1032,33 @@ typedef struct host_txbuf_cmpl {
 	cmn_msg_hdr_t	cmn_hdr;
 	/** completion message header */
 	compl_msg_hdr_t	compl_hdr;
-	union {
+
+	union { /* size per IPC = (3 x uint32) bytes */
+		/* Usage 1: TxS_With_TimeSync */
+		struct {
+			 struct {
+				union {
+					/** provided meta data len */
+					uint16	metadata_len;
+					/** provided extended TX status */
+					uint16	tx_status_ext;
+				}; /*Ext_TxStatus */
+
+				/** WLAN side txstatus */
+				uint16	tx_status;
+			}; /* TxS */
+			/* timestamp */
+			ipc_timestamp_t ts;
+		}; /* TxS_with_TS */
+
+		/* Usage 2: LatTS_With_XORCSUM */
 		struct {
-			union {
-				/** provided meta data len */
-				uint16	metadata_len;
-				/** provided extended TX status */
-				uint16	tx_status_ext;
-			};
-			/** WLAN side txstatus */
-			uint16	tx_status;
+			/* latency timestamp */
+			pktts_t tx_pktts;
+			/* XOR checksum or a magic number to audit DMA done */
+			dma_done_t marker_ext;
 		};
-		/** XOR checksum or a magic number to audit DMA done */
-		/* This is for rev6 only. For IPC rev7, this is not used */
-		dma_done_t	marker;
 	};
-	/* timestamp */
-	ipc_timestamp_t ts;
 
 } host_txbuf_cmpl_t;
 
diff --git a/drivers/net/wireless/bcmdhd4361/include/bcmpcie.h b/drivers/net/wireless/bcmdhd4361/include/bcmpcie.h
index 109873ef8055..f4994f9bd736 100644
--- a/drivers/net/wireless/bcmdhd4361/include/bcmpcie.h
+++ b/drivers/net/wireless/bcmdhd4361/include/bcmpcie.h
@@ -26,7 +26,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: bcmpcie.h 755866 2018-04-05 05:07:41Z $
+ * $Id: bcmpcie.h 775339 2018-08-07 02:14:37Z $
  */
 
 #ifndef	_bcmpcie_h_
@@ -87,6 +87,7 @@ typedef struct {
 #define PCIE_SHARED2_SNAPSHOT_UPLOAD	0x00000008	/* BT/WLAN snapshot upload support */
 #define PCIE_SHARED2_SUBMIT_COUNT_WAR	0x00000010	/* submission count WAR */
 #define PCIE_SHARED2_FW_SMALL_MEMDUMP	0x00000200      /* FW small memdump */
+#define PCIE_SHARED2_DEBUG_BUF_DEST	0x00002000	/* debug buf dest support */
 #define PCIE_SHARED_FAST_DELETE_RING	0x00000020      /* Fast Delete Ring */
 #define PCIE_SHARED_EVENT_BUF_POOL_MAX	0x000000c0      /* event buffer pool max bits */
 #define PCIE_SHARED_EVENT_BUF_POOL_MAX_POS     6       /* event buffer pool max bit position */
@@ -161,6 +162,12 @@ typedef struct {
 							   firmware support added to reuse
 							   timesync to update PKT txstatus
 							   */
+/* Support Enhanced Debug Lane */
+#define PCIE_SHARED2_EDL_RING		0x00001000
+
+/* BT producer index reset WAR */
+#define PCIE_SHARED2_PCIE_ENUM_RESET_FLR		0x00004000
+
 /**
  * Message rings convey messages between host and device. They are unidirectional, and are located
  * in host memory.
@@ -195,6 +202,7 @@ typedef struct {
 #define BCMPCIE_D2H_RING_TYPE_DBGBUF_CPL		0x4
 #define BCMPCIE_D2H_RING_TYPE_AC_RX_COMPLETE		0x5
 #define BCMPCIE_D2H_RING_TYPE_BTLOG_CPL		0x6
+#define BCMPCIE_D2H_RING_TYPE_EDL                       0x7
 
 /**
  * H2D and D2H, WR and RD index, are maintained in the following arrays:
@@ -263,8 +271,6 @@ enum d2hring_idx {
 #define BCMPCIE_D2H_RW_INDEX_ARRAY_SZ(rw_index_sz) \
 	((rw_index_sz) * BCMPCIE_D2H_COMMON_MSGRINGS)
 
-#define HOFFLOAD_MODULES_ENAB(shmem) (0)
-
 /**
  * This type is used by a 'message buffer' (which is a FIFO for messages). Message buffers are used
  * for host<->device communication and are instantiated on both sides. ring_mem_t is instantiated
@@ -409,6 +415,8 @@ typedef struct {
 #define HOSTCAP_HSCB				0x02000000
 /* Host support for extended device trap debug buffer */
 #define HOSTCAP_EXT_TRAP_DBGBUF			0x04000000
+/* Host support for enhanced debug lane */
+#define HOSTCAP_EDL_RING			0x10000000
 
 /* extended trap debug buffer allocation sizes. Note that this buffer can be used for
  * other trap related purposes also.
@@ -450,6 +458,7 @@ typedef struct {
 #define D2HMB_DS_HOST_SLEEP_EXIT_ACK	0x00000008
 #define D2H_DEV_IDMA_INITED				0x00000010
 #define D2H_DEV_FWHALT					0x10000000
+#define D2H_DEV_TRAP_PING_HOST_FAILURE  0x08000000
 #define D2H_DEV_EXT_TRAP_DATA			0x20000000
 #define D2H_DEV_TRAP_IN_TRAP			0x40000000
 #define D2H_DEV_TRAP_DUE_TO_BT			0x01000000
diff --git a/drivers/net/wireless/bcmdhd4361/include/bcmutils.h b/drivers/net/wireless/bcmdhd4361/include/bcmutils.h
index 80ae2510edbe..0323cbae1975 100644
--- a/drivers/net/wireless/bcmdhd4361/include/bcmutils.h
+++ b/drivers/net/wireless/bcmdhd4361/include/bcmutils.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: bcmutils.h 784503 2018-10-12 06:07:30Z $
+ * $Id: bcmutils.h 813756 2019-04-08 05:18:14Z $
  */
 
 #ifndef	_bcmutils_h_
@@ -163,12 +163,20 @@ extern void *pktoffset(osl_t *osh, void *p,  uint offset);
 #define DSCP_AF21	0x12
 #define DSCP_AF22	0x14
 #define DSCP_AF23	0x16
+/* CS2: OAM (RFC2474) */
+#define DSCP_CS2	0x10
 /* AF3x: Multimedia Streaming (RFC2597) */
 #define DSCP_AF31	0x1A
 #define DSCP_AF32	0x1C
 #define DSCP_AF33	0x1E
+/* CS3: Broadcast Video (RFC2474) */
+#define DSCP_CS3	0x18
+/* VA: VOCIE-ADMIT (RFC5865) */
+#define DSCP_VA		0x2C
 /* EF: Telephony (RFC3246) */
 #define DSCP_EF		0x2E
+/* CS6: Network Control (RFC2474) */
+#define DSCP_CS6	0x30
 
 extern uint pktsetprio(void *pkt, bool update_vtag);
 extern uint pktsetprio_qms(void *pkt, uint8* up_table, bool update_vtag);
diff --git a/drivers/net/wireless/bcmdhd4361/include/eapol.h b/drivers/net/wireless/bcmdhd4361/include/eapol.h
index 6227dbe02c7f..903cf3dba787 100755
--- a/drivers/net/wireless/bcmdhd4361/include/eapol.h
+++ b/drivers/net/wireless/bcmdhd4361/include/eapol.h
@@ -28,7 +28,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: eapol.h 758863 2018-04-21 00:29:12Z $
+ * $Id: eapol.h 767212 2018-06-13 00:17:23Z $
  */
 
 #ifndef _eapol_h_
@@ -62,30 +62,30 @@ typedef struct {
 	unsigned short length;		/* Length of body */
 } eapol_hdr_t;
 
-#define EAPOL_HDR_LEN 4
+#define EAPOL_HDR_LEN 4u
 
 /* EAPOL version */
-#define WPA2_EAPOL_VERSION	2
-#define WPA_EAPOL_VERSION	1
-#define LEAP_EAPOL_VERSION	1
-#define SES_EAPOL_VERSION	1
+#define WPA2_EAPOL_VERSION	2u
+#define WPA_EAPOL_VERSION	1u
+#define LEAP_EAPOL_VERSION	1u
+#define SES_EAPOL_VERSION	1u
 
 /* EAPOL types */
 #define EAP_PACKET		0
-#define EAPOL_START		1
-#define EAPOL_LOGOFF		2
-#define EAPOL_KEY		3
-#define EAPOL_ASF		4
+#define EAPOL_START		1u
+#define EAPOL_LOGOFF		2u
+#define EAPOL_KEY		3u
+#define EAPOL_ASF		4u
 
 /* EAPOL-Key types */
-#define EAPOL_RC4_KEY		1
-#define EAPOL_WPA2_KEY		2	/* 802.11i/WPA2 */
-#define EAPOL_WPA_KEY		254	/* WPA */
+#define EAPOL_RC4_KEY		1u
+#define EAPOL_WPA2_KEY		2u	/* 802.11i/WPA2 */
+#define EAPOL_WPA_KEY		254u	/* WPA */
 
 /* RC4 EAPOL-Key header field sizes */
-#define EAPOL_KEY_REPLAY_LEN	8
-#define EAPOL_KEY_IV_LEN	16
-#define EAPOL_KEY_SIG_LEN	16
+#define EAPOL_KEY_REPLAY_LEN	8u
+#define EAPOL_KEY_IV_LEN	16u
+#define EAPOL_KEY_SIG_LEN	16u
 
 /* RC4 EAPOL-Key */
 typedef BWL_PRE_PACKED_STRUCT struct {
@@ -98,27 +98,42 @@ typedef BWL_PRE_PACKED_STRUCT struct {
 	unsigned char key[1];				/* Key (optional) */
 } BWL_POST_PACKED_STRUCT eapol_key_header_t;
 
-#define EAPOL_KEY_HEADER_LEN 	44
+#define EAPOL_KEY_HEADER_LEN	44u
 
 /* RC4 EAPOL-Key flags */
-#define EAPOL_KEY_FLAGS_MASK	0x80
-#define EAPOL_KEY_BROADCAST	0
-#define EAPOL_KEY_UNICAST	0x80
+#define EAPOL_KEY_FLAGS_MASK	0x80u
+#define EAPOL_KEY_BROADCAST	0u
+#define EAPOL_KEY_UNICAST	0x80u
 
 /* RC4 EAPOL-Key index */
-#define EAPOL_KEY_INDEX_MASK	0x7f
+#define EAPOL_KEY_INDEX_MASK	0x7fu
 
 /* WPA/802.11i/WPA2 EAPOL-Key header field sizes */
 #define EAPOL_AKW_BLOCK_LEN 8
-#define EAPOL_WPA_KEY_REPLAY_LEN	8
-#define EAPOL_WPA_KEY_NONCE_LEN		32
-#define EAPOL_WPA_KEY_IV_LEN		16
-#define EAPOL_WPA_KEY_RSC_LEN		8
-#define EAPOL_WPA_KEY_ID_LEN		8
-#define EAPOL_WPA_KEY_MIC_LEN		16 /* deprecated */
+#define EAPOL_WPA_KEY_REPLAY_LEN	8u
+#define EAPOL_WPA_KEY_NONCE_LEN		32u
+#define EAPOL_WPA_KEY_IV_LEN		16u
+#define EAPOL_WPA_KEY_RSC_LEN		8u
+#define EAPOL_WPA_KEY_ID_LEN		8u
 #define EAPOL_WPA_KEY_DATA_LEN		(EAPOL_WPA_MAX_KEY_SIZE + EAPOL_AKW_BLOCK_LEN)
-#define EAPOL_WPA_MAX_KEY_SIZE		32
+#define EAPOL_WPA_MAX_KEY_SIZE		32u
+#define EAPOL_WPA_KEY_MAX_MIC_LEN	32u
+#define EAPOL_WPA_ENCR_KEY_MAX_LEN	64u
+#define EAPOL_WPA_TEMP_ENCR_KEY_MAX_LEN	32u
+
+#define EAPOL_WPA_PMK_MAX_LEN           64u
+#define EAPOL_WPA_PMK_SHA384_LEN        48u
+#define EAPOL_WPA_PMK_DEFAULT_LEN	32u
+#define EAPOL_WPA_KCK_DEFAULT_LEN	16u
+#define EAPOL_WPA_KCK_MIC_DEFAULT_LEN	16u
+#define EAPOL_WPA_ENCR_KEY_DEFAULT_LEN	16u
+
+#ifndef EAPOL_KEY_HDR_VER_V2
+#define EAPOL_WPA_KEY_MIC_LEN		16u /* deprecated */
+#define EAPOL_WPA_KEY_LEN		95u /* deprecated */
+#endif // endif
 
+#ifndef EAPOL_KEY_HDR_VER_V2
 /* WPA EAPOL-Key : deprecated */
 typedef BWL_PRE_PACKED_STRUCT struct {
 	unsigned char type;		/* Key Descriptor Type */
@@ -133,7 +148,7 @@ typedef BWL_PRE_PACKED_STRUCT struct {
 	unsigned short data_len;			/* Key Data Length */
 	unsigned char data[EAPOL_WPA_KEY_DATA_LEN];	/* Key data */
 } BWL_POST_PACKED_STRUCT eapol_wpa_key_header_t;
-
+#else
 /* WPA EAPOL-Key : new structure to consider dynamic MIC length */
 typedef BWL_PRE_PACKED_STRUCT struct {
 	unsigned char type;             /* Key Descriptor Type */
@@ -146,9 +161,12 @@ typedef BWL_PRE_PACKED_STRUCT struct {
 	unsigned char id[EAPOL_WPA_KEY_ID_LEN];         /* WPA:Key ID, 802.11i/WPA2: Reserved */
 } BWL_POST_PACKED_STRUCT eapol_wpa_key_header_v2_t;
 
-#define EAPOL_WPA_KEY_LEN		95 /* deprecated */
-#define EAPOL_WPA_KEY_DATA_LEN_SIZE	2
+typedef eapol_wpa_key_header_v2_t eapol_wpa_key_header_t;
+#endif /* EAPOL_KEY_HDR_VER_V2 */
+
+#define EAPOL_WPA_KEY_DATA_LEN_SIZE	2u
 
+#ifdef  EAPOL_KEY_HDR_VER_V2
 #define EAPOL_WPA_KEY_HDR_SIZE(mic_len) (sizeof(eapol_wpa_key_header_v2_t) \
 	+ mic_len + EAPOL_WPA_KEY_DATA_LEN_SIZE)
 
@@ -158,6 +176,12 @@ typedef BWL_PRE_PACKED_STRUCT struct {
 	((uint8 *)pos + sizeof(eapol_wpa_key_header_v2_t) + mic_len)
 #define EAPOL_WPA_KEY_HDR_DATA_PTR(pos, mic_len) \
 	((uint8 *)pos + EAPOL_WPA_KEY_HDR_SIZE(mic_len))
+#else
+#define EAPOL_WPA_KEY_HDR_SIZE(mic_len) EAPOL_WPA_KEY_LEN
+#define EAPOL_WPA_KEY_HDR_MIC_PTR(pos) ((uint8 *)&pos->mic)
+#define EAPOL_WPA_KEY_HDR_DATA_LEN_PTR(pos, mic_len) ((uint8 *)&pos->data_len)
+#define EAPOL_WPA_KEY_HDR_DATA_PTR(pos, mic_len) ((uint8 *)&pos->data)
+#endif /* EAPOL_KEY_HDR_VER_V2 */
 
 /* WPA/802.11i/WPA2 KEY KEY_INFO bits */
 #define WPA_KEY_DESC_OSEN	0x0
diff --git a/drivers/net/wireless/bcmdhd4361/include/epivers.h b/drivers/net/wireless/bcmdhd4361/include/epivers.h
index acbbeee1383a..9776cbcc03d9 100644
--- a/drivers/net/wireless/bcmdhd4361/include/epivers.h
+++ b/drivers/net/wireless/bcmdhd4361/include/epivers.h
@@ -33,19 +33,19 @@
 
 #define	EPI_MINOR_VERSION	13
 
-#define	EPI_RC_NUMBER		21
+#define	EPI_RC_NUMBER		36
 
 #define	EPI_INCREMENTAL_NUMBER	0
 
 #define	EPI_BUILD_NUMBER	0
 
-#define	EPI_VERSION		100, 13, 21, 0
+#define	EPI_VERSION		100, 13, 36, 0
 
-#define	EPI_VERSION_NUM		0x640d1500
+#define	EPI_VERSION_NUM		0x640d2400
 
-#define EPI_VERSION_DEV		100.13.21
+#define EPI_VERSION_DEV		100.13.36
 
 /* Driver Version String, ASCII, 32 chars max */
-#define	EPI_VERSION_STR		"100.13.21 (r)"
+#define	EPI_VERSION_STR		"100.13.36 (r)"
 
 #endif /* _epivers_h_ */
diff --git a/drivers/net/wireless/bcmdhd4361/include/event_log_payload.h b/drivers/net/wireless/bcmdhd4361/include/event_log_payload.h
index 8b80646ae4a5..763aea4e8d9c 100755
--- a/drivers/net/wireless/bcmdhd4361/include/event_log_payload.h
+++ b/drivers/net/wireless/bcmdhd4361/include/event_log_payload.h
@@ -27,7 +27,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: event_log_payload.h 738285 2017-12-28 01:28:18Z $
+ * $Id: event_log_payload.h 768232 2018-06-19 05:28:22Z $
  */
 
 #ifndef _EVENT_LOG_PAYLOAD_H_
@@ -682,4 +682,118 @@ typedef struct msch_register_params	{
 	uint16 chanspec_list[WL_MSCH_NUMCHANNELS];
 } msch_register_params_t;
 
+typedef struct {
+	uint32	txallfrm;	/**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+				* Control Management (includes retransmissions)
+				*/
+	uint32	rxrsptmout;	/**< number of response timeouts for transmitted frames
+				* expecting a response
+				*/
+	uint32	rxstrt;		/**< number of received frames with a good PLCP */
+	uint32  rxbadplcp;	/**< number of parity check of the PLCP header failed */
+	uint32  rxcrsglitch;	/**< PHY was able to correlate the preamble but not the header */
+	uint32  rxnodelim;	/**< number of no valid delimiter detected by ampdu parser */
+	uint32  bphy_badplcp;	/**< number of bad PLCP reception on BPHY rate */
+	uint32  bphy_rxcrsglitch;	/**< PHY count of bphy glitches */
+	uint32  rxbadfcs;	/**< number of frames for which the CRC check failed in the MAC */
+	uint32	rxanyerr;	/**< Any RX error that is not counted by other counters. */
+	uint32	rxbeaconmbss;	/**< beacons received from member of BSS */
+	uint32	rxdtucastmbss;	/**< number of received DATA frames with good FCS and matching RA */
+	uint32	rxdtocast;	/**< number of received DATA frames (good FCS and no matching RA) */
+	uint32  rxtoolate;	/**< receive too late */
+	uint32  goodfcs;        /**< Good fcs counters  */
+	uint32  rxf0ovfl;	/** < Rx FIFO0 overflow counters information */
+	uint32  rxf1ovfl;	/** < Rx FIFO1 overflow counters information */
+} phy_periodic_counters_v1_t;
+
+typedef struct phycal_log_cmn {
+	uint16 chanspec; /* Current phy chanspec */
+	uint8  last_cal_reason;  /* Last Cal Reason */
+	uint8  pad1;  /* Padding byte to align with word */
+	uint   last_cal_time; /* Last cal time in sec */
+} phycal_log_cmn_t;
+
+typedef struct phycal_log_core {
+	uint16 ofdm_txa; /* OFDM Tx IQ Cal a coeff */
+	uint16 ofdm_txb; /* OFDM Tx IQ Cal b coeff */
+	uint16 ofdm_txd; /* contain di & dq */
+	uint16 bphy_txa; /* BPHY Tx IQ Cal a coeff */
+	uint16 bphy_txb; /* BPHY Tx IQ Cal b coeff */
+	uint16 bphy_txd; /* contain di & dq */
+
+	uint16 rxa; /* Rx IQ Cal A coeffecient */
+	uint16 rxb; /* Rx IQ Cal B coeffecient */
+	int32 rxs;  /* FDIQ Slope coeffecient */
+
+	uint8 baseidx; /* TPC Base index */
+	uint8 adc_coeff_cap0_adcI; /* ADC CAP Cal Cap0 I */
+	uint8 adc_coeff_cap1_adcI; /* ADC CAP Cal Cap1 I */
+	uint8 adc_coeff_cap2_adcI; /* ADC CAP Cal Cap2 I */
+	uint8 adc_coeff_cap0_adcQ; /* ADC CAP Cal Cap0 Q */
+	uint8 adc_coeff_cap1_adcQ; /* ADC CAP Cal Cap1 Q */
+	uint8 adc_coeff_cap2_adcQ; /* ADC CAP Cal Cap2 Q */
+	uint8 pad; /* Padding byte to align with word */
+} phycal_log_core_t;
+
+#define PHYCAL_LOG_VER1         (1u)
+
+typedef struct phycal_log_v1 {
+	uint8  version; /* Logging structure version */
+	uint8  numcores; /* Numbe of cores for which core specific data present */
+	uint16 length;  /* Length of the entire structure */
+	phycal_log_cmn_t phycal_log_cmn; /* Logging common structure */
+	/* This will be a variable length based on the numcores field defined above */
+	phycal_log_core_t phycal_log_core[1];
+} phycal_log_v1_t;
+
+typedef struct phy_periodic_log_cmn {
+	uint16  chanspec; /* Current phy chanspec */
+	uint16  vbatmeas; /* Measured VBAT sense value */
+	uint16  featureflag; /* Currently active feature flags */
+	int8    chiptemp; /* Chip temparature */
+	int8    femtemp;  /* Fem temparature */
+
+	uint32  nrate; /* Current Tx nrate */
+
+	uint8   cal_phase_id; /* Current Multi phase cal ID */
+	uint8   rxchain; /* Rx Chain */
+	uint8   txchain; /* Tx Chain */
+	uint8   ofdm_desense; /* OFDM desense */
+
+	uint8   bphy_desense; /* BPHY desense */
+	uint8   pll_lockstatus; /* PLL Lock status */
+	uint8   pad1; /* Padding byte to align with word */
+	uint8   pad2; /* Padding byte to align with word */
+
+	uint32 duration;	/**< millisecs spent sampling this channel */
+	uint32 congest_ibss;	/**< millisecs in our bss (presumably this traffic will */
+				/**<  move if cur bss moves channels) */
+	uint32 congest_obss;	/**< traffic not in our bss */
+	uint32 interference;	/**< millisecs detecting a non 802.11 interferer. */
+
+} phy_periodic_log_cmn_t;
+
+typedef struct phy_periodic_log_core {
+	uint8	baseindxval; /* TPC Base index */
+	int8	tgt_pwr; /* Programmed Target power */
+	int8	estpwradj; /* Current Est Power Adjust value */
+	int8	crsmin_pwr; /* CRS Min/Noise power */
+	int8	rssi_per_ant; /* RSSI Per antenna */
+	int8	snr_per_ant; /* SNR Per antenna */
+	int8	pad1; /* Padding byte to align with word */
+	int8	pad2; /* Padding byte to align with word */
+} phy_periodic_log_core_t;
+
+#define PHY_PERIODIC_LOG_VER1         (1u)
+
+typedef struct phy_periodic_log_v1 {
+	uint8  version; /* Logging structure version */
+	uint8  numcores; /* Numbe of cores for which core specific data present */
+	uint16 length;  /* Length of the entire structure */
+	phy_periodic_log_cmn_t phy_perilog_cmn;
+	phy_periodic_counters_v1_t counters_peri_log;
+	/* This will be a variable length based on the numcores field defined above */
+	phy_periodic_log_core_t phy_perilog_core[1];
+} phy_periodic_log_v1_t;
+
 #endif /* _EVENT_LOG_PAYLOAD_H_ */
diff --git a/drivers/net/wireless/bcmdhd4361/include/event_log_set.h b/drivers/net/wireless/bcmdhd4361/include/event_log_set.h
index 42500b612a23..be9e8a02460b 100644
--- a/drivers/net/wireless/bcmdhd4361/include/event_log_set.h
+++ b/drivers/net/wireless/bcmdhd4361/include/event_log_set.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: event_log_set.h 744920 2018-02-06 06:25:40Z $
+ * $Id: event_log_set.h 771154 2018-07-09 05:46:33Z $
  */
 
 #ifndef _EVENT_LOG_SET_H_
@@ -36,50 +36,72 @@
  * this to an appropriat enumber in their makefiles to reduce
  * ROM invalidation
  */
-#define NUM_EVENT_LOG_SETS 11
+#define NUM_EVENT_LOG_SETS (24)
 #endif // endif
 
-/* Legacy implementation does not have these sets. So make them 0. */
-#if (NUM_EVENT_LOG_SETS <= 8)
-#define NUM_EVENT_LOG_DBG_SETS	0
-#elif (NUM_EVENT_LOG_SETS == 9)
-#define NUM_EVENT_LOG_DBG_SETS	1
-#else
-#define NUM_EVENT_LOG_DBG_SETS	2
-#endif // endif
+/* Set assignments */
+#define EVENT_LOG_SET_BUS		(0u)
+#define EVENT_LOG_SET_WL		(1u)
+#define EVENT_LOG_SET_PSM		(2u)
+#define EVENT_LOG_SET_ERROR		(3u)
 
-/* Debug log sets start from this log set and are always the last few ones */
-/* Note that these log sets are not reserved for debug builds. They can be used
- * for other purpose as well. If used for other purpose, the debug log set
- * allocation code will check if there is a free one available out of
- * NUM_EVENT_LOG_DBG_SETS starting from EVENT_LOG_DBG_START_SET
- */
-#define EVENT_LOG_DBG_START_SET	(NUM_EVENT_LOG_SETS - NUM_EVENT_LOG_DBG_SETS)
-
-/* Define new event log sets here */
-#define EVENT_LOG_SET_BUS	0
-#define EVENT_LOG_SET_WL	1
-#define EVENT_LOG_SET_PSM	2
-#define EVENT_LOG_SET_ERROR	3
-#define EVENT_LOG_SET_MEM_API	4
-/* Share the set with MEM_API for now to limit ROM invalidation.
- * The above set is used in dingo only
- * On trunk, MSCH should move to a different set.
+/* MSCH logging */
+#define EVENT_LOG_SET_MSCH_PROFILER	(4u)
+
+#define EVENT_LOG_SET_5			(5u)
+#define EVENT_LOG_SET_ECOUNTERS		(EVENT_LOG_SET_5)
+#define EVENT_LOG_SET_6			(6u)
+#define EVENT_LOG_SET_7			(7u)
+
+#define EVENT_LOG_SET_8			(8u)
+#define EVENT_LOG_SET_PRSRV		(EVENT_LOG_SET_8)
+
+#define EVENT_LOG_SET_9			(9u)
+/* General purpose preserve chatty.
+ * EVENT_LOG_SET_PRSRV_CHATTY log set should not be used by FW as it is
+ * used by customer host. FW should use EVENT_LOG_SET_GP_PRSRV_CHATTY
+ * for general purpose preserve chatty logs.
  */
-#define EVENT_LOG_SET_MSCH_PROFILER	4
-#define EVENT_LOG_SET_ECOUNTERS 5	/* Host to instantiate this for ecounters. */
-#define EVENT_LOG_SET_6	6	/* Instantiated by host for channel switch logs */
-#define EVENT_LOG_SET_7	7	/* Instantiated by host for AMPDU stats */
+#define EVENT_LOG_SET_GP_PRSRV_CHATTY	(EVENT_LOG_SET_9)
+#define EVENT_LOG_SET_PRSRV_CHATTY	(EVENT_LOG_SET_6)
+
+/* BUS preserve */
+#define EVENT_LOG_SET_PRSRV_BUS		(10u)
+
+/* WL preserve */
+#define EVENT_LOG_SET_PRSRV_WL		(11u)
 
-/* The following ones could be used for debug builds. Always the last few ones */
-#define EVENT_LOG_SET_8 8
-#define EVENT_LOG_SET_9	9
+/* Slotted BSS set */
+#define EVENT_LOG_SET_WL_SLOTTED_BSS    (12u)
 
-#define EVENT_LOG_SET_PRSRV    7 /* The logtag set flushed only on error. Share with 7 to avoid
-				    * abandons.
-				    */
+/* PHY entity logging */
+#define EVENT_LOG_SET_PHY		(13u)
+
+/* PHY preserve */
+#define EVENT_LOG_SET_PRSRV_PHY		(14u)
+
+/* RTE entity */
+#define EVENT_LOG_SET_RTE		(15u)
+
+/* Malloc and free logging */
+#define EVENT_LOG_SET_MEM_API		(16u)
+
+/* Console buffer */
+#define EVENT_LOG_SET_RTE_CONS_BUF	(17u)
+
+/* three log sets for general debug purposes */
+#define EVENT_LOG_SET_GENERAL_DBG_1	(18u)
+#define EVENT_LOG_SET_GENERAL_DBG_2	(19u)
+#define EVENT_LOG_SET_GENERAL_DBG_3	(20u)
+
+/* Log sets for capturing power related logs. Note that these sets
+ * are to be used across entire system and not just WL.
+ */
+#define EVENT_LOG_SET_POWER_1		(21u)
+#define EVENT_LOG_SET_POWER_2		(22u)
 
-#define EVENT_LOG_SET_PRSRV_BUS	10
+/* Used for timestamp plotting, TS_LOG() */
+#define EVENT_LOG_SET_TS_LOG		(23u)
 
 /* send delayed logs when >= 50% of buffer is full */
 #ifndef ECOUNTERS_DELAYED_FLUSH_PERCENTAGE
diff --git a/drivers/net/wireless/bcmdhd4361/include/event_log_tag.h b/drivers/net/wireless/bcmdhd4361/include/event_log_tag.h
index 8573ac7c0b5e..fcb998ac2867 100644
--- a/drivers/net/wireless/bcmdhd4361/include/event_log_tag.h
+++ b/drivers/net/wireless/bcmdhd4361/include/event_log_tag.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: event_log_tag.h 759112 2018-04-24 01:34:08Z $
+ * $Id: event_log_tag.h 779150 2018-08-31 10:04:22Z $
  */
 
 #ifndef _EVENT_LOG_TAG_H_
@@ -52,9 +52,11 @@
 #define EVENT_LOG_TAG_SRSCAN		22
 #define EVENT_LOG_TAG_PWRSTATS_INFO	23
 
+/* Timestamp logging for plotting. */
+#define EVENT_LOG_TAG_TSLOG		26
+
 /* Possible candidates for reuse */
-#define EVENT_LOG_TAG_UCODE_WATCHDOG 	26
-#define EVENT_LOG_TAG_UCODE_FIFO 	27
+#define EVENT_LOG_TAG_UCODE_FIFO	27
 
 #define EVENT_LOG_TAG_SCAN_TRACE_LOW	28
 #define EVENT_LOG_TAG_SCAN_TRACE_HIGH	29
@@ -242,6 +244,14 @@
 #define EVENT_LOG_TAG_FILS_ERROR		221
 #define EVENT_LOG_TAG_HWA_TXPOST		222
 #define EVENT_LOG_TAG_HWA_TXDMA			223
+/* Arbitrator callback log tags */
+#define EVENT_LOG_TAG_STF_ARB_CB_TRACE		224
+#define EVENT_LOG_TAG_STF_ARB_CB_ERROR		225
+#define EVENT_LOG_TAG_PHY_PERIODIC_SEC		226
+#define EVENT_LOG_TAG_RTE_ERROR			227
+#define EVENT_LOG_TAG_CPLT_ERROR		228
+#define EVENT_LOG_TAG_DNGL_ERROR		229
+#define EVENT_LOG_TAG_NVRAM_ERROR		230
 
 /* Debug tags for making debug builds */
 #define EVENT_LOG_TAG_DBG1			251
@@ -307,10 +317,39 @@
 #define EVENT_LOG_TAG_WL_HEB_ERROR              300
 #define EVENT_LOG_TAG_WL_HEB_TRACE              301
 
+/* RRM EVENT_LOG_TAG */
+#define EVENT_LOG_TAG_RRM_DBG                   302
+#define EVENT_LOG_TAG_RRM_INFO                  303
+#define EVENT_LOG_TAG_RRM_ERR                   304
+
+/* scan core */
+#define EVENT_LOG_TAG_SC			305
+
+#define EVENT_LOG_TAG_ESP_DBG			306
+#define EVENT_LOG_TAG_ESP_INFO			307
+#define EVENT_LOG_TAG_ESP_ERR			308
+
+/* SDC */
+#define EVENT_LOG_TAG_SDC_DBG			309
+#define EVENT_LOG_TAG_SDC_INFO			310
+#define EVENT_LOG_TAG_SDC_ERR			311
+
+/* RTE */
+#define EVENT_LOG_TAG_RTE_ERR			312
+
+/* TX FIFO */
+#define EVENT_LOG_TAG_FIFO_INFO			313
+
+/* PKTTS */
+#define EVENT_LOG_TAG_LATENCY_INFO		314
+
+/* TDLS */
+#define EVENT_LOG_TAG_WL_TDLS_INFO              315
+#define EVENT_LOG_TAG_WL_TDLS_DBG               316
+#define EVENT_LOG_TAG_WL_TDLS_ERR               317
+
 /* EVENT_LOG_TAG_MAX	= Set to the same value of last tag, not last tag + 1 */
-#define EVENT_LOG_TAG_MAX			301
-#define EVENT_LOG_TAG_MAX_LEGACY_FORMAT		255
-/* Note: New event should be added/reserved in trunk before adding it to branches */
+#define EVENT_LOG_TAG_MAX			317
 
 typedef enum wl_el_set_type_def {
 	EVENT_LOG_SET_TYPE_DEFAULT = 0, /* flush the log buffer when it is full - Default option */
@@ -363,6 +402,9 @@ typedef union event_log_hdr {
 	uint32 t;			/* Type cheat */
 } event_log_hdr_t;
 
+/* for internal use - legacy max. tag */
+#define EVENT_LOG_TAG_MAX_LEGACY_FORMAT		255
+
 /*
  * The position of the extended header in the event log stream will be as follows:
  * <event log payload><ARM cycle count timestamp><extended header><regular header>
diff --git a/drivers/net/wireless/bcmdhd4361/include/fils.h b/drivers/net/wireless/bcmdhd4361/include/fils.h
index cf12c5324326..0f033f1a4e51 100755
--- a/drivers/net/wireless/bcmdhd4361/include/fils.h
+++ b/drivers/net/wireless/bcmdhd4361/include/fils.h
@@ -136,6 +136,17 @@ typedef BWL_PRE_PACKED_STRUCT struct fils_nonce_element {
 	uint8		fils_nonce[FILS_NONCE_LENGTH];
 } BWL_POST_PACKED_STRUCT fils_nonce_element_t;
 
+/* 11ai 9.4.2.186 FILS Key Delivery element */
+#define FILS_KEY_RSC_LENGTH 8u
+
+typedef BWL_PRE_PACKED_STRUCT struct fils_key_delivery_element {
+	uint8		elementid;
+	uint8		length;
+	uint8		element_id_ext;
+	uint8		key_rsc[FILS_KEY_RSC_LENGTH];
+	uint8		kde_list[];	/* Key Data Elements */
+} BWL_POST_PACKED_STRUCT fils_key_delivery_element_t;
+
 /* 8.4.2.175 FILS Session element */
 #define FILS_SESSION_LENGTH 8u
 
diff --git a/drivers/net/wireless/bcmdhd4361/include/nan.h b/drivers/net/wireless/bcmdhd4361/include/nan.h
index 2d24051a04c7..1f5d38aa1fdf 100644
--- a/drivers/net/wireless/bcmdhd4361/include/nan.h
+++ b/drivers/net/wireless/bcmdhd4361/include/nan.h
@@ -25,7 +25,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: nan.h 758133 2018-04-17 19:07:15Z $
+ * $Id: nan.h 773122 2018-07-20 08:27:36Z $
  */
 #ifndef _NAN_H_
 #define _NAN_H_
@@ -1143,6 +1143,15 @@ typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndp_attr_s {
 #define NAN_NDP_SETUP_STATUS_FAIL	0
 #define NAN_NDP_SETUP_STATUS_REJECT	2
 
+/* NDPE TLV list */
+#define NDPE_TLV_TYPE_IPV6		0x00
+#define NDPE_TLV_TYPE_SVC_INFO		0x01
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndpe_tlv_s {
+	uint8 type;		/* Operating Class */
+	uint16 length;		/* Channel Bitmap */
+	uint8 data[];
+} BWL_POST_PACKED_STRUCT wifi_nan_ndpe_tlv_t;
+
 /* Rng setup attribute type and status macros */
 #define NAN_RNG_TYPE_MASK	0x0F
 #define NAN_RNG_TYPE_REQUEST	0x0
diff --git a/drivers/net/wireless/bcmdhd4361/include/wlioctl.h b/drivers/net/wireless/bcmdhd4361/include/wlioctl.h
index 3b03b75bdb34..2306a3245b5c 100644
--- a/drivers/net/wireless/bcmdhd4361/include/wlioctl.h
+++ b/drivers/net/wireless/bcmdhd4361/include/wlioctl.h
@@ -29,7 +29,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wlioctl.h 787944 2018-11-07 13:13:27Z $
+ * $Id: wlioctl.h 816311 2019-04-24 07:19:37Z $
  */
 
 #ifndef _wlioctl_h_
@@ -468,6 +468,58 @@ typedef struct wl_bss_info_v109_1 {
 	uint32		he_txmcsmap;	/**< HE tx mcs map (802.11ax IE, HE_CAP_MCS_MAP_*) */
 } wl_bss_info_v109_1_t;
 
+/**
+ * BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info_v109_2 {
+	uint32		version;		/**< version field */
+	uint32		length;			/**< byte length of data in this record,
+						 * starting at version and including IEs
+						 */
+	struct ether_addr BSSID;
+	uint16		beacon_period;		/**< units are Kusec */
+	uint16		capability;		/**< Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
+	uint8		bcnflags;		/* additional flags w.r.t. beacon */
+	struct {
+		uint32	count;			/**< # rates in this set */
+		uint8	rates[16];		/**< rates in 500kbps units w/hi bit set if basic */
+	} rateset;				/**< supported rates */
+	chanspec_t	chanspec;		/**< chanspec for bss */
+	uint16		atim_window;		/**< units are Kusec */
+	uint8		dtim_period;		/**< DTIM period */
+	uint8		accessnet;		/* from beacon interwork IE (if bcnflags) */
+	int16		RSSI;			/**< receive signal strength (in dBm) */
+	int8		phy_noise;		/**< noise (in dBm) */
+	uint8		n_cap;			/**< BSS is 802.11N Capable */
+	uint8		he_cap;			/**< BSS is he capable */
+	uint8		freespace1;		/* make implicit padding explicit */
+	uint32		nbss_cap;		/**< 802.11N+AC BSS Capabilities */
+	uint8		ctl_ch;			/**< 802.11N BSS control channel number */
+	uint8		padding1[3];		/**< explicit struct alignment padding */
+	uint16		vht_rxmcsmap;	/**< VHT rx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+	uint16		vht_txmcsmap;	/**< VHT tx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+	uint8		flags;			/**< flags */
+	uint8		vht_cap;		/**< BSS is vht capable */
+	uint8		reserved[2];		/**< Reserved for expansion of BSS properties */
+	uint8		basic_mcs[MCSSET_LEN];	/**< 802.11N BSS required MCS set */
+
+	uint16		ie_offset;		/**< offset at which IEs start, from beginning */
+	uint16		freespace2;		/* making implicit padding explicit */
+	uint32		ie_length;		/**< byte length of Information Elements */
+	int16		SNR;			/**< average SNR of during frame reception */
+	uint16		vht_mcsmap;		/**< STA's Associated vhtmcsmap */
+	uint16		vht_mcsmap_prop;	/**< STA's Associated prop vhtmcsmap */
+	uint16		vht_txmcsmap_prop;	/**< prop VHT tx mcs prop */
+	uint32		he_mcsmap;	/**< STA's Associated hemcsmap */
+	uint32		he_rxmcsmap;	/**< HE rx mcs map (802.11ax IE, HE_CAP_MCS_MAP_*) */
+	uint32		he_txmcsmap;	/**< HE tx mcs map (802.11ax IE, HE_CAP_MCS_MAP_*) */
+	uint32		timestamp[2];  /* Beacon Timestamp for FAKEAP req */
+} wl_bss_info_v109_2_t;
+
 #ifndef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
 typedef wl_bss_info_v109_t wl_bss_info_t;
 #endif // endif
diff --git a/drivers/net/wireless/bcmdhd4361/include/wpa.h b/drivers/net/wireless/bcmdhd4361/include/wpa.h
index 545d4da7c7fa..d659d28fdb02 100644
--- a/drivers/net/wireless/bcmdhd4361/include/wpa.h
+++ b/drivers/net/wireless/bcmdhd4361/include/wpa.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wpa.h 758863 2018-04-21 00:29:12Z $
+ * $Id: wpa.h 761317 2018-05-07 21:33:58Z $
  */
 
 #ifndef _proto_wpa_h_
@@ -180,10 +180,12 @@ typedef BWL_PRE_PACKED_STRUCT struct
 			(akm) == RSN_AKM_SHA256_PSK || \
 			(akm) == RSN_AKM_TPK || \
 			(akm) == RSN_AKM_SAE_PSK || \
-			(akm) == RSN_AKM_SAE_PSK || \
+			(akm) == RSN_AKM_SAE_FBT || \
 			(akm) == RSN_AKM_FILS_SHA256 || \
 			(akm) == RSN_AKM_FILS_SHA384 || \
-			(akm) == RSN_AKM_OWE)
+			(akm) == RSN_AKM_OWE || \
+			(akm) == RSN_AKM_SUITEB_SHA256_1X || \
+			(akm) == RSN_AKM_SUITEB_SHA384_1X)
 
 #define IS_VALID_BIP_CIPHER(cipher) ((cipher) == WPA_CIPHER_BIP || \
 					(cipher) == WPA_CIPHER_BIP_GMAC_128 || \
diff --git a/drivers/net/wireless/bcmdhd4361/linux_pkt.c b/drivers/net/wireless/bcmdhd4361/linux_pkt.c
index 15ab16c53e23..8231e583e6ab 100755
--- a/drivers/net/wireless/bcmdhd4361/linux_pkt.c
+++ b/drivers/net/wireless/bcmdhd4361/linux_pkt.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: linux_pkt.c 769679 2018-06-27 07:14:30Z $
+ * $Id: linux_pkt.c 800754 2019-01-23 08:38:54Z $
  */
 
 #include <typedefs.h>
@@ -54,21 +54,17 @@ void* wifi_platform_prealloc(void *adapter, int section, unsigned long size);
 #define OSL_PKTTAG_CLEAR(p) \
 do { \
 	struct sk_buff *s = (struct sk_buff *)(p); \
-	ASSERT(OSL_PKTTAG_SZ == 32); \
-	*(uint32 *)(&s->cb[4]) = 0; \
-	*(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
-	*(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
-	*(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
+	uint tagsz = sizeof(s->cb); \
+	ASSERT(OSL_PKTTAG_SZ <= tagsz); \
+	memset(s->cb + 4, 0, tagsz - 4); \
 } while (0)
 #else
 #define OSL_PKTTAG_CLEAR(p) \
 do { \
 	struct sk_buff *s = (struct sk_buff *)(p); \
-	ASSERT(OSL_PKTTAG_SZ == 32); \
-	*(uint32 *)(&s->cb[0]) = 0; *(uint32 *)(&s->cb[4]) = 0; \
-	*(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
-	*(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
-	*(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
+	uint tagsz = sizeof(s->cb); \
+	ASSERT(OSL_PKTTAG_SZ <= tagsz); \
+	memset(s->cb, 0, tagsz); \
 } while (0)
 #endif /* BCM_OBJECT_TRACE */
 
diff --git a/drivers/net/wireless/bcmdhd4361/wl_android.c b/drivers/net/wireless/bcmdhd4361/wl_android.c
index 170047244e0c..27ce4d5bf0d8 100644
--- a/drivers/net/wireless/bcmdhd4361/wl_android.c
+++ b/drivers/net/wireless/bcmdhd4361/wl_android.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wl_android.c 796872 2018-12-27 08:23:42Z $
+ * $Id: wl_android.c 818247 2019-05-07 04:15:13Z $
  */
 
 #include <linux/module.h>
@@ -70,7 +70,10 @@
 #ifdef WL_STATIC_IF
 #define WL_BSSIDX_MAX	16
 #endif /* WL_STATIC_IF */
-
+#ifdef WL_BCNRECV
+#include <wl_cfgvendor.h>
+#include <brcm_nl80211.h>
+#endif /* WL_BCNRECV */
 /*
  * Android private command strings, PLEASE define new private commands here
  * so they can be updated easily in the future (if needed)
@@ -93,6 +96,7 @@
 #define CMD_SETSUSPENDMODE      "SETSUSPENDMODE"
 #define CMD_SETDTIM_IN_SUSPEND  "SET_DTIM_IN_SUSPEND"
 #define CMD_MAXDTIM_IN_SUSPEND  "MAX_DTIM_IN_SUSPEND"
+#define CMD_DISDTIM_IN_SUSPEND  "DISABLE_DTIM_IN_SUSPEND"
 #define CMD_P2P_DEV_ADDR	"P2P_DEV_ADDR"
 #define CMD_SETFWPATH		"SETFWPATH"
 #define CMD_SETBAND		"SETBAND"
@@ -156,10 +160,6 @@
 #define CMD_SET_TID		"SET_TID"
 #define CMD_GET_TID		"GET_TID"
 #endif /* SUPPORT_SET_TID */
-#ifdef APSTA_RESTRICTED_CHANNEL
-#define CMD_SET_INDOOR_CHANNELS	"SET_INDOOR_CHANNELS"
-#define CMD_GET_INDOOR_CHANNELS	"GET_INDOOR_CHANNELS"
-#endif /* APSTA_RESTRICTED_CHANNEL */
 #endif /* CUSTOMER_HW4_PRIVATE_CMD */
 #define CMD_KEEP_ALIVE		"KEEPALIVE"
 
@@ -284,12 +284,6 @@ typedef struct android_wifi_af_params {
 #define CUSTOMER_HW4_DISABLE	-1
 #define CUSTOMER_HW4_EN_CONVERT(i)	(i += 1)
 #endif /* FCC_PWR_LIMIT_2G */
-
-#ifdef APSTA_RESTRICTED_CHANNEL
-#define CMD_SET_INDOOR_CHANNELS	"SET_INDOOR_CHANNELS"
-#define CMD_GET_INDOOR_CHANNELS	"GET_INDOOR_CHANNELS"
-#endif /* APSTA_RESTRICTED_CHANNEL */
-
 #endif /* CUSTOMER_HW4_PRIVATE_CMD */
 
 #ifdef WLFBT
@@ -361,6 +355,11 @@ typedef struct android_wifi_af_params {
 #define CMD_GET_RSSI_PER_ANT				"GET_RSSI_PER_ANT"
 #endif /* SUPPORT_RSSI_SUM_REPORT */
 
+#ifdef APSTA_RESTRICTED_CHANNEL
+#define CMD_SET_INDOOR_CHANNELS		"SET_INDOOR_CHANNELS"
+#define CMD_GET_INDOOR_CHANNELS		"GET_INDOOR_CHANNELS"
+#endif /* APSTA_RESTRICTED_CHANNEL */
+
 #define CMD_GET_SNR							"GET_SNR"
 
 #ifdef SUPPORT_SET_CAC
@@ -538,6 +537,10 @@ static const wl_natoe_sub_cmd_t natoe_cmd_list[] = {
 #define CMD_EWP_FILTER		"EWP_FILTER"
 #endif /* DHD_EVENT_LOG_FILTER */
 
+#ifdef WL_BCNRECV
+#define CMD_BEACON_RECV "BEACON_RECV"
+#endif /* WL_BCNRECV */
+
 #ifdef WL_GENL
 static s32 wl_genl_handle_msg(struct sk_buff *skb, struct genl_info *info);
 static int wl_genl_init(void);
@@ -605,6 +608,11 @@ static struct genl_multicast_group wl_genl_mcast = {
 #define LQCM_RX_INDEX_SHIFT		16	/* LQCM rx index shift */
 #endif /* SUPPORT_LQCM */
 
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+#define NUMBER_SEQUENTIAL_PRIVCMD_ERRORS	7
+static int priv_cmd_errors = 0;
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
 /**
  * Extern function declarations (TODO: move them to dhd_linux.h)
  */
@@ -663,6 +671,117 @@ extern char iface_name[IFNAMSIZ];
 extern bool g_pm_control;
 #endif	/* DHD_PM_CONTROL_FROM_FILE */
 
+/* private command support for restoring roam/scan parameters */
+#ifdef SUPPORT_RESTORE_SCAN_PARAMS
+#define CMD_RESTORE_SCAN_PARAMS "RESTORE_SCAN_PARAMS"
+
+typedef int (*PRIV_CMD_HANDLER) (struct net_device *dev, char *command);
+typedef int (*PRIV_CMD_HANDLER_WITH_LEN) (struct net_device *dev, char *command, int total_len);
+
+enum {
+	RESTORE_TYPE_UNSPECIFIED = 0,
+	RESTORE_TYPE_PRIV_CMD = 1,
+	RESTORE_TYPE_PRIV_CMD_WITH_LEN = 2
+};
+
+typedef struct android_restore_scan_params {
+	char command[64];
+	int parameter;
+	int cmd_type;
+	union {
+		PRIV_CMD_HANDLER cmd_handler;
+		PRIV_CMD_HANDLER_WITH_LEN cmd_handler_w_len;
+	};
+} android_restore_scan_params_t;
+
+/* function prototypes of private command handler */
+static int wl_android_set_roam_trigger(struct net_device *dev, char* command);
+int wl_android_set_roam_delta(struct net_device *dev, char* command);
+int wl_android_set_roam_scan_period(struct net_device *dev, char* command);
+int wl_android_set_full_roam_scan_period(struct net_device *dev, char* command, int total_len);
+int wl_android_set_roam_scan_control(struct net_device *dev, char *command);
+int wl_android_set_scan_channel_time(struct net_device *dev, char *command);
+int wl_android_set_scan_home_time(struct net_device *dev, char *command);
+int wl_android_set_scan_home_away_time(struct net_device *dev, char *command);
+int wl_android_set_scan_nprobes(struct net_device *dev, char *command);
+static int wl_android_set_band(struct net_device *dev, char *command);
+int wl_android_set_scan_dfs_channel_mode(struct net_device *dev, char *command);
+int wl_android_set_wes_mode(struct net_device *dev, char *command);
+int wl_android_set_okc_mode(struct net_device *dev, char *command);
+
+/* default values */
+#ifdef ROAM_API
+#define DEFAULT_ROAM_TIRGGER -75
+#define DEFAULT_ROAM_DELTA 10
+#define DEFAULT_ROAMSCANPERIOD 10
+#define DEFAULT_FULLROAMSCANPERIOD_SET 120
+#endif /* ROAM_API */
+#ifdef WES_SUPPORT
+#define DEFAULT_ROAMSCANCONTROL 0
+#define DEFAULT_SCANCHANNELTIME 40
+#ifdef BCM4361_CHIP
+#define DEFAULT_SCANHOMETIME 60
+#else
+#define DEFAULT_SCANHOMETIME 45
+#endif /* BCM4361_CHIP */
+#define DEFAULT_SCANHOMEAWAYTIME 100
+#define DEFAULT_SCANPROBES 2
+#define DEFAULT_DFSSCANMODE 1
+#define DEFAULT_WESMODE 0
+#define DEFAULT_OKCMODE 1
+#endif /* WES_SUPPORT */
+#define DEFAULT_BAND 0
+#ifdef WBTEXT
+#define DEFAULT_WBTEXT_ENABLE 1
+#endif /* WBTEXT */
+
+/* restoring parameter list, please don't change order */
+static android_restore_scan_params_t restore_params[] =
+{
+/* wbtext need to be disabled while updating roam/scan parameters */
+#ifdef WBTEXT
+	{ CMD_WBTEXT_ENABLE, 0, RESTORE_TYPE_PRIV_CMD_WITH_LEN,
+		.cmd_handler_w_len = wl_android_wbtext},
+#endif /* WBTEXT */
+#ifdef ROAM_API
+	{ CMD_ROAMTRIGGER_SET, DEFAULT_ROAM_TIRGGER,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_trigger},
+	{ CMD_ROAMDELTA_SET, DEFAULT_ROAM_DELTA,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_delta},
+	{ CMD_ROAMSCANPERIOD_SET, DEFAULT_ROAMSCANPERIOD,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_scan_period},
+	{ CMD_FULLROAMSCANPERIOD_SET, DEFAULT_FULLROAMSCANPERIOD_SET,
+		RESTORE_TYPE_PRIV_CMD_WITH_LEN,
+		.cmd_handler_w_len = wl_android_set_full_roam_scan_period},
+#endif /* ROAM_API */
+#ifdef WES_SUPPORT
+	{ CMD_SETROAMSCANCONTROL, DEFAULT_ROAMSCANCONTROL,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_scan_control},
+	{ CMD_SETSCANCHANNELTIME, DEFAULT_SCANCHANNELTIME,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_channel_time},
+	{ CMD_SETSCANHOMETIME, DEFAULT_SCANHOMETIME,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_home_time},
+	{ CMD_GETSCANHOMEAWAYTIME, DEFAULT_SCANHOMEAWAYTIME,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_home_away_time},
+	{ CMD_SETSCANNPROBES, DEFAULT_SCANPROBES,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_nprobes},
+	{ CMD_SETDFSSCANMODE, DEFAULT_DFSSCANMODE,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_dfs_channel_mode},
+	{ CMD_SETWESMODE, DEFAULT_WESMODE,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_wes_mode},
+	{ CMD_SETOKCMODE, DEFAULT_OKCMODE,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_okc_mode},
+#endif /* WES_SUPPORT */
+	{ CMD_SETBAND, DEFAULT_BAND,
+		RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_band},
+#ifdef WBTEXT
+	{ CMD_WBTEXT_ENABLE, DEFAULT_WBTEXT_ENABLE,
+		RESTORE_TYPE_PRIV_CMD_WITH_LEN, .cmd_handler_w_len = wl_android_wbtext},
+#endif /* WBTEXT */
+	{ "\0", 0, RESTORE_TYPE_UNSPECIFIED, .cmd_handler = NULL}
+};
+#endif /* SUPPORT_RESTORE_SCAN_PARAMS */
+
 /**
  * Local (static) functions and variables
  */
@@ -1118,6 +1237,24 @@ wl_android_set_max_dtim(struct net_device *dev, char *command)
 	return ret;
 }
 
+static int
+wl_android_set_disable_dtim_in_suspend(struct net_device *dev, char *command)
+{
+	int ret = 0;
+	int dtim_flag;
+
+	dtim_flag = *(command + strlen(CMD_DISDTIM_IN_SUSPEND) + 1) - '0';
+
+	if (!(ret = net_os_set_disable_dtim_in_suspend(dev, dtim_flag))) {
+		DHD_TRACE(("%s: use Disable bcn_li_dtim in suspend %s\n",
+			__FUNCTION__, (dtim_flag ? "Enable" : "Disable")));
+	} else {
+		DHD_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+	}
+
+	return ret;
+}
+
 static int wl_android_get_band(struct net_device *dev, char *command, int total_len)
 {
 	uint band;
@@ -1131,6 +1268,35 @@ static int wl_android_get_band(struct net_device *dev, char *command, int total_
 	return bytes_written;
 }
 
+static int
+wl_android_set_band(struct net_device *dev, char *command)
+{
+	int error = 0;
+	uint band = *(command + strlen(CMD_SETBAND) + 1) - '0';
+#ifdef WL_HOST_BAND_MGMT
+	int ret = 0;
+	if ((ret = wl_cfg80211_set_band(dev, band)) < 0) {
+		if (ret == BCME_UNSUPPORTED) {
+			/* If roam_var is unsupported, fallback to the original method */
+			WL_ERR(("WL_HOST_BAND_MGMT defined, "
+				"but roam_band iovar unsupported in the firmware\n"));
+		} else {
+			error = -1;
+		}
+	}
+	if (((ret == 0) && (band == WLC_BAND_AUTO)) || (ret == BCME_UNSUPPORTED)) {
+		/* Apply if roam_band iovar is not supported or band setting is AUTO */
+		error = wldev_set_band(dev, band);
+	}
+#else
+	error = wl_cfg80211_set_if_band(dev, band);
+#endif /* WL_HOST_BAND_MGMT */
+#ifdef ROAM_CHANNEL_CACHE
+	wl_update_roamscan_cache_by_band(dev, band);
+#endif /* ROAM_CHANNEL_CACHE */
+	return error;
+}
+
 #ifdef CUSTOMER_HW4_PRIVATE_CMD
 #ifdef ROAM_API
 static bool wl_android_check_wbtext(struct net_device *dev)
@@ -2114,6 +2280,46 @@ wl_android_okc_enable(struct net_device *dev, char *command)
 	return error;
 }
 #endif /* WES_SUPPORT */
+
+#ifdef SUPPORT_RESTORE_SCAN_PARAMS
+static int
+wl_android_restore_scan_params(struct net_device *dev, char *command, int total_len)
+{
+	int error = 0;
+	uint error_cnt = 0;
+	int cnt = 0;
+	char restore_command[WLC_IOCTL_SMLEN];
+
+	while (strlen(restore_params[cnt].command) > 0 && restore_params[cnt].cmd_handler) {
+		sprintf(restore_command, "%s %d", restore_params[cnt].command,
+			restore_params[cnt].parameter);
+		printk("CNT : %d\n", cnt);
+		printk("COMMAND : %s\n", restore_command);
+		if (restore_params[cnt].cmd_type == RESTORE_TYPE_PRIV_CMD) {
+		error = restore_params[cnt].cmd_handler(dev, restore_command);
+		}  else if (restore_params[cnt].cmd_type == RESTORE_TYPE_PRIV_CMD_WITH_LEN) {
+			error = restore_params[cnt].cmd_handler_w_len(dev,
+				restore_command, total_len);
+		} else {
+			DHD_ERROR(("Unknown restore command handler\n"));
+			error = -1;
+		}
+		if (error) {
+			DHD_ERROR(("Failed to restore scan parameters %s, error : %d\n",
+				restore_command, error));
+			error_cnt++;
+		}
+		cnt++;
+	}
+	if (error_cnt > 0) {
+		DHD_ERROR(("Got %d error(s) while restoring scan parameters\n",
+			error_cnt));
+		error = -1;
+	}
+	return error;
+}
+#endif /* SUPPORT_RESTORE_SCAN_PARAMS */
+
 #ifdef WLTDLS
 int wl_android_tdls_reset(struct net_device *dev)
 {
@@ -2229,10 +2435,15 @@ wl_cfg80211_get_sta_info(struct net_device *dev, char* command, int total_len)
 #endif /* BIGDATA_SOFTAP */
 			if (ret < 0) {
 				WL_ERR(("Get sta_info ERR %d\n", ret));
-#ifndef BIGDATA_SOFTAP
-				goto error;
-#else
+#ifdef BIGDATA_SOFTAP
 				goto get_bigdata;
+#else
+				/* In case framework assumes the BIGDATA_SOFTAP
+				 * is enabled in DHD, the return value causes
+				 * triggering HANG event.
+				 */
+				bytes_written = BCME_UNSUPPORTED;
+				goto error;
 #endif /* BIGDATA_SOFTAP */
 			}
 
@@ -2957,6 +3168,9 @@ int wl_android_wifi_on(struct net_device *dev)
 		} while (retry-- > 0);
 		if (ret != 0) {
 			DHD_ERROR(("\nfailed to power up wifi chip, max retry reached **\n\n"));
+#ifdef BCM_DETECT_TURN_ON_FAILURE
+			BUG_ON(1);
+#endif /* BCM_DETECT_TURN_ON_FAILURE */
 			goto exit;
 		}
 #ifdef BCMSDIO
@@ -5626,7 +5840,6 @@ wl_cfg80211_p2plo_deinit(struct bcm_cfg80211 *cfg)
 {
 	s32 bssidx;
 	int ret = 0;
-	int p2plo_pause = 0;
 	dhd_pub_t *dhd = NULL;
 	if (!cfg || !cfg->p2p) {
 		WL_ERR(("Wl %p or cfg->p2p %p is null\n",
@@ -5642,7 +5855,7 @@ wl_cfg80211_p2plo_deinit(struct bcm_cfg80211 *cfg)
 
 	bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
 	ret = wldev_iovar_setbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg),
-			"p2po_stop", (void*)&p2plo_pause, sizeof(p2plo_pause),
+			"p2po_stop", NULL, 0,
 			cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
 	if (ret < 0) {
 		WL_ERR(("p2po_stop Failed :%d\n", ret));
@@ -5763,6 +5976,35 @@ wl_cfg80211_p2plo_offload(struct net_device *dev, char *cmd, char* buf, int len)
 	}
 	return ret;
 }
+void
+wl_cfg80211_cancel_p2plo(struct bcm_cfg80211 *cfg)
+{
+	struct wireless_dev *wdev;
+	if (!cfg) {
+		return;
+	}
+
+	wdev = bcmcfg_to_p2p_wdev(cfg);
+
+	if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+		WL_INFORM_MEM(("P2P_FIND: Discovery offload is already in progress."
+				"it aborted\n"));
+		wl_clr_p2p_status(cfg, DISC_IN_PROGRESS);
+		if (wdev != NULL) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+			cfg80211_remain_on_channel_expired(wdev,
+					cfg->last_roc_id,
+					&cfg->remain_on_chan, GFP_KERNEL);
+#else
+			cfg80211_remain_on_channel_expired(wdev,
+					cfg->last_roc_id,
+					&cfg->remain_on_chan,
+					cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+		}
+		wl_cfg80211_p2plo_deinit(cfg);
+	}
+}
 #endif /* P2P_LISTEN_OFFLOADING */
 
 #ifdef DYNAMIC_MUMIMO_CONTROL
@@ -6039,7 +6281,7 @@ wl_android_get_lqcm_report(struct net_device *dev, char *command, int total_len)
 	tx_lqcm_idx = (lqcm_report & LQCM_TX_INDEX_MASK) >> LQCM_TX_INDEX_SHIFT;
 	rx_lqcm_idx = (lqcm_report & LQCM_RX_INDEX_MASK) >> LQCM_RX_INDEX_SHIFT;
 
-	WL_ERR(("lqcm report EN:%d, TX:%d, RX:%d\n", lqcm_enable, tx_lqcm_idx, rx_lqcm_idx));
+	WL_DBG(("lqcm report EN:%d, TX:%d, RX:%d\n", lqcm_enable, tx_lqcm_idx, rx_lqcm_idx));
 
 	bytes_written = snprintf(command, total_len, "%s %d",
 			CMD_GET_LQCM_REPORT, lqcm_report);
@@ -6286,6 +6528,55 @@ wl_android_make_hang_with_reason(struct net_device *dev, const char *string_num)
 }
 #endif /* DHD_HANG_SEND_UP_TEST */
 
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+static void
+wl_android_check_priv_cmd_errors(struct net_device *dev)
+{
+	dhd_pub_t *dhdp;
+	int memdump_mode;
+
+	if (!dev) {
+		WL_ERR(("dev is NULL\n"));
+		return;
+	}
+
+	dhdp = wl_cfg80211_get_dhdp(dev);
+	if (!dhdp) {
+		WL_ERR(("dhdp is NULL\n"));
+		return;
+	}
+
+#ifdef DHD_FW_COREDUMP
+	memdump_mode = dhdp->memdump_enabled;
+#else
+	/* Default enable if DHD doesn't support SOCRAM dump */
+	memdump_mode = 1;
+#endif /* DHD_FW_COREDUMP */
+
+	if (report_hang_privcmd_err) {
+		priv_cmd_errors++;
+	} else {
+		priv_cmd_errors = 0;
+	}
+
+	/* Trigger HANG event only if memdump mode is enabled
+	 * due to customer's request
+	 */
+	if (memdump_mode && (priv_cmd_errors > NUMBER_SEQUENTIAL_PRIVCMD_ERRORS)) {
+		WL_ERR(("Send HANG event due to sequential private cmd errors\n"));
+		priv_cmd_errors = 0;
+#ifdef DHD_FW_COREDUMP
+		/* Take a SOCRAM dump */
+		dhdp->memdump_type = DUMP_TYPE_SEQUENTIAL_PRIVCMD_ERROR;
+		dhd_common_socram_dump(dhdp);
+#endif /* DHD_FW_COREDUMP */
+		/* Send the HANG event to upper layer */
+		dhdp->hang_reason = HANG_REASON_SEQUENTIAL_PRIVCMD_ERROR;
+		dhd_os_check_hang(dhdp, 0, -EREMOTEIO);
+	}
+}
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
 #ifdef DHD_PKT_LOGGING
 static int
 wl_android_pktlog_filter_enable(struct net_device *dev, char *command, int total_len)
@@ -6784,6 +7075,16 @@ int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr)
 	}
 
 exit:
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+	if (ret) {
+		/* Avoid incrementing priv_cmd_errors in case of unsupported feature */
+		if (ret != BCME_UNSUPPORTED) {
+			wl_android_check_priv_cmd_errors(net);
+		}
+	} else {
+		priv_cmd_errors = 0;
+	}
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
 	net_os_wake_unlock(net);
 	MFREE(cfg->osh, command, (buf_size + 1));
 	return ret;
@@ -6863,6 +7164,263 @@ wl_android_get_adps_mode(
 }
 #endif /* WLADPS_PRIVATE_CMD */
 
+#ifdef WL_BCNRECV
+#define BCNRECV_ATTR_HDR_LEN 30
+int
+wl_android_bcnrecv_event(struct net_device *ndev, uint attr_type,
+		uint status, uint reason, uint8 *data, uint data_len)
+{
+	s32 err = BCME_OK;
+	struct sk_buff *skb;
+	gfp_t kflags;
+	struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+	struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+	uint len;
+
+	len = BCNRECV_ATTR_HDR_LEN + data_len;
+
+	kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+	skb = CFG80211_VENDOR_EVENT_ALLOC(wiphy, ndev_to_wdev(ndev), len,
+		BRCM_VENDOR_EVENT_BEACON_RECV, kflags);
+	if (!skb) {
+		WL_ERR(("skb alloc failed"));
+		return -ENOMEM;
+	}
+	if ((attr_type == BCNRECV_ATTR_BCNINFO) && (data)) {
+		/* send bcn info to upper layer */
+		nla_put(skb, BCNRECV_ATTR_BCNINFO, data_len, data);
+	} else if (attr_type == BCNRECV_ATTR_STATUS) {
+		nla_put_u32(skb, BCNRECV_ATTR_STATUS, status);
+		if (reason) {
+			nla_put_u32(skb, BCNRECV_ATTR_REASON, reason);
+		}
+	} else {
+		WL_ERR(("UNKNOWN ATTR_TYPE. attr_type:%d\n", attr_type));
+		kfree_skb(skb);
+		return -EINVAL;
+	}
+	cfg80211_vendor_event(skb, kflags);
+	return err;
+}
+
+static int
+_wl_android_bcnrecv_start(struct bcm_cfg80211 *cfg, struct net_device *ndev, bool user_trigger)
+{
+	s32 err = BCME_OK;
+
+	/* check any scan is in progress before beacon recv scan trigger IOVAR */
+	if (wl_get_drv_status_all(cfg, SCANNING)) {
+		err = BCME_UNSUPPORTED;
+		WL_ERR(("Scan in progress, Aborting beacon recv start, "
+			"error:%d\n", err));
+		goto exit;
+	}
+
+	if (wl_get_p2p_status(cfg, SCANNING)) {
+		err = BCME_UNSUPPORTED;
+		WL_ERR(("P2P Scan in progress, Aborting beacon recv start, "
+			"error:%d\n", err));
+		goto exit;
+	}
+
+	if (wl_get_drv_status(cfg, REMAINING_ON_CHANNEL, ndev)) {
+		err = BCME_UNSUPPORTED;
+		WL_ERR(("P2P remain on channel, Aborting beacon recv start, "
+			"error:%d\n", err));
+		goto exit;
+	}
+
+	/* check STA is in connected state, Beacon recv required connected state
+	 * else exit from beacon recv scan
+	 */
+	if (!wl_get_drv_status(cfg, CONNECTED, ndev)) {
+		err = BCME_UNSUPPORTED;
+		WL_ERR(("STA is in not associated state error:%d\n", err));
+		goto exit;
+	}
+
+#ifdef WL_NAN
+	/* Check NAN is enabled, if enabled exit else continue */
+	if (wl_cfgnan_check_state(cfg)) {
+		err = BCME_UNSUPPORTED;
+		WL_ERR(("Nan is enabled, NAN+STA+FAKEAP concurrency is not supported\n"));
+		goto exit;
+	}
+#endif /* WL_NAN */
+
+	/* Triggering an sendup_bcn iovar */
+	err = wldev_iovar_setint(ndev, "sendup_bcn", 1);
+	if (unlikely(err)) {
+		WL_ERR(("sendup_bcn failed to set, error:%d\n", err));
+	} else {
+		cfg->bcnrecv_info.bcnrecv_state = BEACON_RECV_STARTED;
+		WL_INFORM_MEM(("bcnrecv started\n"));
+		if (user_trigger) {
+			WL_INFORM_MEM(("BCN-RECV-STARTED"));
+			if ((err = wl_android_bcnrecv_event(ndev, BCNRECV_ATTR_STATUS,
+					WL_BCNRECV_STARTED, 0, NULL, 0)) != BCME_OK) {
+				WL_ERR(("failed to send bcnrecv event, error:%d\n", err));
+			}
+		}
+	}
+exit:
+	/*
+	 * BCNRECV start request can be rejected from dongle
+	 * in various conditions.
+	 * Error code need to be overridden to BCME_UNSUPPORTED
+	 * to avoid hang event from continous private
+	 * command error
+	 */
+	if (err) {
+		err = BCME_UNSUPPORTED;
+	}
+	return err;
+}
+
+int
+_wl_android_bcnrecv_stop(struct bcm_cfg80211 *cfg, struct net_device *ndev, uint reason)
+{
+	s32 err = BCME_OK;
+	u32 status;
+
+	/* Send sendup_bcn iovar for all cases except W_BCNRECV_ROAMABORT reason -
+	 * fw generates roam abort event after aborting the bcnrecv.
+	 */
+	if (reason != WL_BCNRECV_ROAMABORT) {
+		/* Triggering an sendup_bcn iovar */
+		err = wldev_iovar_setint(ndev, "sendup_bcn", 0);
+		if (unlikely(err)) {
+			WL_ERR(("sendup_bcn failed to set error:%d\n", err));
+			goto exit;
+		}
+	}
+
+	/* Send notification for all cases */
+	if (reason == WL_BCNRECV_SUSPEND) {
+		cfg->bcnrecv_info.bcnrecv_state = BEACON_RECV_SUSPENDED;
+		status = WL_BCNRECV_SUSPENDED;
+	} else {
+		cfg->bcnrecv_info.bcnrecv_state = BEACON_RECV_STOPPED;
+		WL_INFORM_MEM(("bcnrecv stopped\n"));
+		if (reason == WL_BCNRECV_USER_TRIGGER) {
+			status = WL_BCNRECV_STOPPED;
+		} else {
+			status = WL_BCNRECV_ABORTED;
+		}
+	}
+	if ((err = wl_android_bcnrecv_event(ndev, BCNRECV_ATTR_STATUS, status,
+		reason, NULL, 0)) != BCME_OK) {
+		WL_ERR(("failed to send bcnrecv event, error:%d\n", err));
+	}
+exit:
+	return err;
+}
+
+static int
+wl_android_bcnrecv_start(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	s32 err = BCME_OK;
+
+	/* Adding scan_sync mutex to avoid race condition in b/w scan_req and bcn recv */
+	mutex_lock(&cfg->scan_sync);
+	mutex_lock(&cfg->bcn_sync);
+	err = _wl_android_bcnrecv_start(cfg, ndev, true);
+	mutex_unlock(&cfg->bcn_sync);
+	mutex_unlock(&cfg->scan_sync);
+	return err;
+}
+
+int
+wl_android_bcnrecv_stop(struct net_device *ndev, uint reason)
+{
+	s32 err = BCME_OK;
+	struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+	mutex_lock(&cfg->bcn_sync);
+	if ((cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED) ||
+	   (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_SUSPENDED)) {
+		err = _wl_android_bcnrecv_stop(cfg, ndev, reason);
+	}
+	mutex_unlock(&cfg->bcn_sync);
+	return err;
+}
+
+int
+wl_android_bcnrecv_suspend(struct net_device *ndev)
+{
+	s32 ret = BCME_OK;
+	struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+	mutex_lock(&cfg->bcn_sync);
+	if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED) {
+		WL_INFORM_MEM(("bcnrecv suspend\n"));
+		ret = _wl_android_bcnrecv_stop(cfg, ndev, WL_BCNRECV_SUSPEND);
+	}
+	mutex_unlock(&cfg->bcn_sync);
+	return ret;
+}
+
+int
+wl_android_bcnrecv_resume(struct net_device *ndev)
+{
+	s32 ret = BCME_OK;
+	struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+	/* Adding scan_sync mutex to avoid race condition in b/w scan_req and bcn recv */
+	mutex_lock(&cfg->scan_sync);
+	mutex_lock(&cfg->bcn_sync);
+	if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_SUSPENDED) {
+		WL_INFORM_MEM(("bcnrecv resume\n"));
+		ret = _wl_android_bcnrecv_start(cfg, ndev, false);
+	}
+	mutex_unlock(&cfg->bcn_sync);
+	mutex_unlock(&cfg->scan_sync);
+	return ret;
+}
+
+/* Beacon recv functionality code implementation */
+int
+wl_android_bcnrecv_config(struct net_device *ndev, char *cmd_argv, int total_len)
+{
+	struct bcm_cfg80211 *cfg = NULL;
+	uint err = BCME_OK;
+
+	if (!ndev) {
+		WL_ERR(("ndev is NULL\n"));
+		return -EINVAL;
+	}
+
+	cfg = wl_get_cfg(ndev);
+	if (!cfg) {
+		WL_ERR(("cfg is NULL\n"));
+		return -EINVAL;
+	}
+
+	/* sync commands from user space */
+	mutex_lock(&cfg->usr_sync);
+	if (strncmp(cmd_argv, "start", strlen("start")) == 0) {
+		WL_INFORM(("BCNRECV start\n"));
+		err = wl_android_bcnrecv_start(cfg, ndev);
+		if (err != BCME_OK) {
+			WL_ERR(("Failed to process the start command, error:%d\n", err));
+			goto exit;
+		}
+	} else if (strncmp(cmd_argv, "stop", strlen("stop")) == 0) {
+		WL_INFORM(("BCNRECV stop\n"));
+		err = wl_android_bcnrecv_stop(ndev, WL_BCNRECV_USER_TRIGGER);
+		if (err != BCME_OK) {
+			WL_ERR(("Failed to stop the bcn recv, error:%d\n", err));
+			goto exit;
+		}
+	} else {
+		err = BCME_ERROR;
+	}
+exit:
+	mutex_unlock(&cfg->usr_sync);
+	return err;
+}
+#endif /* WL_BCNRECV */
+
 int
 wl_handle_private_cmd(struct net_device *net, char *command, u32 cmd_len)
 {
@@ -6966,29 +7524,11 @@ wl_handle_private_cmd(struct net_device *net, char *command, u32 cmd_len)
 	else if (strnicmp(command, CMD_MAXDTIM_IN_SUSPEND, strlen(CMD_MAXDTIM_IN_SUSPEND)) == 0) {
 		bytes_written = wl_android_set_max_dtim(net, command);
 	}
+	else if (strnicmp(command, CMD_DISDTIM_IN_SUSPEND, strlen(CMD_DISDTIM_IN_SUSPEND)) == 0) {
+		bytes_written = wl_android_set_disable_dtim_in_suspend(net, command);
+	}
 	else if (strnicmp(command, CMD_SETBAND, strlen(CMD_SETBAND)) == 0) {
-		uint band = *(command + strlen(CMD_SETBAND) + 1) - '0';
-#ifdef WL_HOST_BAND_MGMT
-		s32 ret = 0;
-		if ((ret = wl_cfg80211_set_band(net, band)) < 0) {
-			if (ret == BCME_UNSUPPORTED) {
-				/* If roam_var is unsupported, fallback to the original method */
-				WL_ERR(("WL_HOST_BAND_MGMT defined, "
-					"but roam_band iovar unsupported in the firmware\n"));
-			} else {
-				bytes_written = -1;
-			}
-		}
-		if (((ret == 0) && (band == WLC_BAND_AUTO)) || (ret == BCME_UNSUPPORTED)) {
-			/* Apply if roam_band iovar is not supported or band setting is AUTO */
-			bytes_written = wldev_set_band(net, band);
-		}
-#else
-		bytes_written = wl_cfg80211_set_if_band(net, band);
-#endif /* WL_HOST_BAND_MGMT */
-#ifdef ROAM_CHANNEL_CACHE
-		wl_update_roamscan_cache_by_band(net, band);
-#endif /* ROAM_CHANNEL_CACHE */
+		bytes_written = wl_android_set_band(net, command);
 	}
 	else if (strnicmp(command, CMD_GETBAND, strlen(CMD_GETBAND)) == 0) {
 		bytes_written = wl_android_get_band(net, command, priv_cmd.total_len);
@@ -7181,6 +7721,11 @@ wl_handle_private_cmd(struct net_device *net, char *command, u32 cmd_len)
 		bytes_written = wl_android_okc_enable(net, command);
 	}
 #endif /* WES_SUPPORT */
+#ifdef SUPPORT_RESTORE_SCAN_PARAMS
+	else if (strnicmp(command, CMD_RESTORE_SCAN_PARAMS, strlen(CMD_RESTORE_SCAN_PARAMS)) == 0) {
+		bytes_written = wl_android_restore_scan_params(net, command, priv_cmd.total_len);
+	}
+#endif /* SUPPORT_RESTORE_SCAN_PARAMS */
 #ifdef WLTDLS
 	else if (strnicmp(command, CMD_TDLS_RESET, strlen(CMD_TDLS_RESET)) == 0) {
 		bytes_written = wl_android_tdls_reset(net);
@@ -7760,6 +8305,14 @@ wl_handle_private_cmd(struct net_device *net, char *command, u32 cmd_len)
 		bytes_written = wl_cfg80211_enable_cac(net, enable);
 	}
 #endif	/* SUPPORT_SET_CAC */
+#ifdef WL_BCNRECV
+	else if (strnicmp(command, CMD_BEACON_RECV,
+		strlen(CMD_BEACON_RECV)) == 0) {
+		char *data = (command + strlen(CMD_BEACON_RECV) + 1);
+		bytes_written = wl_android_bcnrecv_config(net,
+				data, priv_cmd.total_len);
+	}
+#endif /* WL_BCNRECV */
 	else {
 		DHD_ERROR(("Unknown PRIVATE command %s - ignored\n", command));
 		bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
diff --git a/drivers/net/wireless/bcmdhd4361/wl_android.h b/drivers/net/wireless/bcmdhd4361/wl_android.h
index 40e430b4f0bb..0d8dff42e23c 100644
--- a/drivers/net/wireless/bcmdhd4361/wl_android.h
+++ b/drivers/net/wireless/bcmdhd4361/wl_android.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wl_android.h 695651 2017-04-21 10:48:20Z $
+ * $Id: wl_android.h 818247 2019-05-07 04:15:13Z $
  */
 
 #include <linux/module.h>
@@ -137,3 +137,12 @@ s32 wl_netlink_send_msg(int pid, int type, int seq, const void *data, size_t siz
 #define MAX_NUM_MAC_FILT        10
 
 int wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist);
+#ifdef WL_BCNRECV
+extern int wl_android_bcnrecv_config(struct net_device *ndev, char *data,
+		int total_len);
+extern int wl_android_bcnrecv_stop(struct net_device *ndev, uint reason);
+extern int wl_android_bcnrecv_resume(struct net_device *ndev);
+extern int wl_android_bcnrecv_suspend(struct net_device *ndev);
+extern int wl_android_bcnrecv_event(struct net_device *ndev,
+		uint attr_type, uint status, uint reason, uint8 *data, uint data_len);
+#endif /* WL_BCNRECV */
diff --git a/drivers/net/wireless/bcmdhd4361/wl_cfg80211.c b/drivers/net/wireless/bcmdhd4361/wl_cfg80211.c
index 0fd4ff1fefa7..b6e4c04ef186 100644
--- a/drivers/net/wireless/bcmdhd4361/wl_cfg80211.c
+++ b/drivers/net/wireless/bcmdhd4361/wl_cfg80211.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wl_cfg80211.c 798171 2019-01-07 09:10:40Z $
+ * $Id: wl_cfg80211.c 820080 2019-05-16 03:05:46Z $
  */
 /* */
 #include <typedefs.h>
@@ -909,12 +909,6 @@ static s32 __wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify);
 static s32 wl_check_vif_support(struct bcm_cfg80211 *cfg, wl_iftype_t wl_iftype);
 bool wl_is_wps_enrollee_active(struct net_device *ndev, const u8 *ie_ptr, u16 len);
 
-#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
-static void wl_cfgvendor_send_hang_event(struct net_device *dev, u16 reason,
-		char *string, int hang_info_cnt);
-static void wl_copy_hang_info_if_falure(struct net_device *dev, u16 reason, s32 err);
-#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
-
 #ifdef WL_WPS_SYNC
 static void wl_init_wps_reauth_sm(struct bcm_cfg80211 *cfg);
 static void wl_deinit_wps_reauth_sm(struct bcm_cfg80211 *cfg);
@@ -928,6 +922,11 @@ static void wl_wps_handle_ifdel(struct net_device *ndev);
 #endif /* WL_WPS_SYNC */
 const u8 *wl_find_attribute(const u8 *buf, u16 len, u16 element_id);
 
+#ifdef WL_BCNRECV
+static s32 wl_bcnrecv_aborted_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+		const wl_event_msg_t *e, void *data);
+#endif /* WL_BCNRECV */
+
 static int bw2cap[] = { 0, 0, WLC_BW_CAP_20MHZ, WLC_BW_CAP_40MHZ, WLC_BW_CAP_80MHZ,
 	WLC_BW_CAP_160MHZ, WLC_BW_CAP_160MHZ };
 
@@ -953,20 +952,35 @@ static int bw2cap[] = { 0, 0, WLC_BW_CAP_20MHZ, WLC_BW_CAP_40MHZ, WLC_BW_CAP_80M
 #endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)) */
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)) || (defined(CONFIG_ARCH_MSM) && \
-	defined(CFG80211_CONNECT_TIMEOUT_REASON_CODE))
-#define CFG80211_CONNECT_BSS(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)) || \
+	defined(CFG80211_CONNECT_TIMEOUT_REASON_CODE)
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
 		resp_ie_len, status, gfp) \
 	cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
 		resp_ie_len, status, gfp, NL80211_TIMEOUT_UNSPECIFIED);
 #else
-#define CFG80211_CONNECT_BSS(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
 		resp_ie_len, status, gfp) \
 	cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
 		resp_ie_len, status, gfp);
 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0) || \
-	* (CONFIG_ARCH_MSM && CFG80211_CONNECT_TIMEOUT_REASON_CODE)
+	  (CFG80211_CONNECT_TIMEOUT_REASON_CODE)
 	*/
+#elif defined(CFG80211_CONNECT_TIMEOUT_REASON_CODE)
+/* There are customer kernels with backported changes for
+ *  connect timeout. CFG80211_CONNECT_TIMEOUT_REASON_CODE define
+ * is available for kernels < 4.7 in such cases.
+ */
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+		resp_ie_len, status, gfp) \
+	cfg80211_connect_bss(dev, bssid, NULL, req_ie, req_ie_len, resp_ie, \
+		resp_ie_len, status, gfp, NL80211_TIMEOUT_UNSPECIFIED);
+#else
+/* Kernels < 4.7 doesn't support cfg80211_connect_bss */
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+		resp_ie_len, status, gfp) \
+	cfg80211_connect_result(dev, bssid, req_ie, req_ie_len, resp_ie, \
+		resp_ie_len, status, gfp);
 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0) */
 
 #ifdef RSSI_OFFSET
@@ -1183,6 +1197,10 @@ static const struct {
 
 #define SOFT_AP_IF_NAME         "swlan0"
 
+#ifdef P2P_LISTEN_OFFLOADING
+void wl_cfg80211_cancel_p2plo(struct bcm_cfg80211 *cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
 #ifdef CUSTOMER_HW4_DEBUG
 uint prev_dhd_console_ms = 0;
 u32 prev_wl_dbg_level = 0;
@@ -1759,7 +1777,6 @@ wl_cfg80211_p2p_if_add(struct bcm_cfg80211 *cfg,
 #if defined(WL_CFG80211_P2P_DEV_IF)
 	if (wl_iftype == WL_IF_TYPE_P2P_DISC) {
 		/* Handle Dedicated P2P discovery Interface */
-		cfg->down_disc_if = FALSE;
 		return wl_cfgp2p_add_p2p_disc_if(cfg);
 	}
 #endif /* WL_CFG80211_P2P_DEV_IF */
@@ -1931,6 +1948,10 @@ wl_cfg80211_iface_state_ops(struct wireless_dev *wdev,
 
 	switch (state) {
 		case WL_IF_CREATE_REQ:
+#ifdef WL_BCNRECV
+			/* check fakeapscan in progress then abort */
+			wl_android_bcnrecv_stop(ndev, WL_BCNRECV_CONCURRENCY);
+#endif /* WL_BCNRECV */
 			wl_cfg80211_scan_abort(cfg);
 			wl_wlfc_enable(cfg, true);
 
@@ -2017,17 +2038,7 @@ wl_cfg80211_p2p_if_del(struct wiphy *wiphy, struct wireless_dev *wdev)
 #ifdef WL_CFG80211_P2P_DEV_IF
 	if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
 		/* Handle dedicated P2P discovery interface. */
-#ifdef CUSTOMER_HW4
-		if (dhd_download_fw_on_driverload) {
-			return wl_cfgp2p_del_p2p_disc_if(wdev, cfg);
-		} else {
-			WL_INFORM_MEM(("skipping del p2p discovery\n"));
-			cfg->down_disc_if = TRUE;
-			return 0;
-		}
-#else
 		return wl_cfgp2p_del_p2p_disc_if(wdev, cfg);
-#endif /* CUSTOMER_HW4 */
 	}
 #endif /* WL_CFG80211_P2P_DEV_IF */
 
@@ -2784,6 +2795,11 @@ wl_cfg80211_change_virtual_iface(struct wiphy *wiphy, struct net_device *ndev,
 		return -EINVAL;
 	}
 
+	/* If any scan is going on, abort it */
+	if (wl_abort_scan_and_check(cfg) != TRUE) {
+		wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+	}
+
 	mutex_lock(&cfg->if_sync);
 	netinfo = wl_get_netinfo_by_wdev(cfg, ndev->ieee80211_ptr);
 	if (unlikely(!netinfo)) {
@@ -2805,11 +2821,6 @@ wl_cfg80211_change_virtual_iface(struct wiphy *wiphy, struct net_device *ndev,
 		goto fail;
 	}
 
-	/* If any scan is going on, abort it */
-	if (wl_abort_scan_and_check(cfg) != TRUE) {
-		wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
-	}
-
 	/* perform pre-if-change tasks */
 	wl_cfg80211_iface_state_ops(ndev->ieee80211_ptr,
 		WL_IF_CHANGE_REQ, wl_iftype, wl_mode);
@@ -3637,6 +3648,10 @@ __wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
 		WL_ERR(("request null or n_ssids > WL_SCAN_PARAMS_SSID_MAX\n"));
 		return -EOPNOTSUPP;
 	}
+#ifdef WL_BCNRECV
+	/* check fakeapscan in progress then abort */
+	wl_android_bcnrecv_stop(ndev, WL_BCNRECV_SCANBUSY);
+#endif /* WL_BCNRECV */
 
 #ifdef P2P_LISTEN_OFFLOADING
 	if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
@@ -3930,7 +3945,7 @@ wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
 		}
 	}
 
-	mutex_lock(&cfg->usr_sync);
+	mutex_lock(&cfg->scan_sync);
 	err = __wl_cfg80211_scan(wiphy, ndev, request, NULL);
 	if (unlikely(err)) {
 		WL_ERR(("scan error (%d)\n", err));
@@ -3939,7 +3954,7 @@ wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
 		mod_timer(&cfg->scan_timeout,
 			jiffies + msecs_to_jiffies(wl_get_scan_timeout_val(cfg)));
 	}
-	mutex_unlock(&cfg->usr_sync);
+	mutex_unlock(&cfg->scan_sync);
 #ifdef WL_DRV_AVOID_SCANCACHE
 	/* Reset roam cache after successful scan request */
 #ifdef ROAM_CHANNEL_CACHE
@@ -4786,6 +4801,7 @@ wl_cfg80211_post_ifcreate(struct net_device *ndev,
 	u16 wl_iftype;
 #ifdef WL_STATIC_IF
 	int need_legacy_war = 0;
+	dhd_pub_t *dhd = NULL;
 #endif /* WL_STATIC_IF */
 
 	if (!ndev || !event) {
@@ -4801,12 +4817,16 @@ wl_cfg80211_post_ifcreate(struct net_device *ndev,
 
 #ifdef WL_STATIC_IF
 	{
-		need_legacy_war = ((wl_legacy_chip_check(cfg) ||
-			wl_check_interface_create_v0(cfg)) &&
-			!strnicmp(name, SOFT_AP_IF_NAME, strlen(SOFT_AP_IF_NAME)));
-		if (need_legacy_war) {
-			event->role = WLC_E_IF_ROLE_AP;
+		dhd = (dhd_pub_t *)(cfg->pub);
+		if (!DHD_OPMODE_SUPPORTED(dhd, DHD_FLAG_MFG_MODE) && name) {
+			need_legacy_war = ((wl_legacy_chip_check(cfg) ||
+				wl_check_interface_create_v0(cfg)) &&
+				!strnicmp(name, SOFT_AP_IF_NAME, strlen(SOFT_AP_IF_NAME)));
+			if (need_legacy_war) {
+				event->role = WLC_E_IF_ROLE_AP;
+			}
 		}
+		WL_DBG(("name: %s\n", name));
 	}
 #endif /* WL_STATIC_IF */
 
@@ -4855,8 +4875,23 @@ wl_cfg80211_post_ifcreate(struct net_device *ndev,
 		wdev = new_ndev->ieee80211_ptr;
 
 		if (need_legacy_war) {
-			s32 err;
+			/* Check whether mac addr is in sync with fw. If not,
+			 * apply it using cur_etheraddr.
+			 */
+			if (memcmp(addr, event->mac, ETH_ALEN) != 0) {
+				ret = wldev_iovar_setbuf_bsscfg(new_ndev, "cur_etheraddr",
+						addr, ETH_ALEN, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+						event->bssidx, &cfg->ioctl_buf_sync);
+				if (unlikely(ret)) {
+					WL_ERR(("set cur_etheraddr Error (%d)\n", ret));
+					goto fail;
+				}
+				memcpy(new_ndev->dev_addr, addr, ETH_ALEN);
+				WL_ERR(("Applying updated mac address to firmware\n"));
+			}
+
 			if (!wl_get_drv_status(cfg, AP_CREATED, new_ndev)) {
+				s32 err;
 				WL_INFORM_MEM(("[%s] Bringup SoftAP on bssidx:%d \n",
 					new_ndev->name, event->bssidx));
 				if ((err = wl_cfg80211_add_del_bss(cfg, new_ndev,
@@ -6259,9 +6294,7 @@ wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 #ifdef ESCAN_CHANNEL_CACHE
 	chanspec_t chanspec_list[MAX_ROAM_CHANNEL];
 #endif /* ESCAN_CHANNEL_CACHE */
-#if (defined(BCM4334_CHIP) || defined(BCM4359_CHIP) || !defined(ESCAN_RESULT_PATCH))
 	int wait_cnt;
-#endif // endif
 
 	WL_DBG(("In\n"));
 	if (!dev) {
@@ -6317,7 +6350,6 @@ wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 	/*
 	 * Cancel ongoing scan to sync up with sme state machine of cfg80211.
 	 */
-#if (defined(BCM4359_CHIP) || !defined(ESCAN_RESULT_PATCH))
 	if (cfg->scan_request) {
 		WL_TRACE_HW4(("Aborting the scan! \n"));
 		wl_cfg80211_scan_abort(cfg);
@@ -6331,7 +6363,6 @@ wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 			wl_cfg80211_cancel_scan(cfg);
 		}
 	}
-#endif // endif
 #ifdef WL_SCHED_SCAN
 	/* Locks are taken in wl_cfg80211_sched_scan_stop()
 	 * A start scan occuring during connect is unlikely
@@ -6372,6 +6403,12 @@ wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 		}
 	}
 
+	if (sme->bssid) {
+		wl_update_prof(cfg, dev, NULL, sme->bssid, WL_PROF_LATEST_BSSID);
+	} else {
+		wl_update_prof(cfg, dev, NULL, &ether_bcast, WL_PROF_LATEST_BSSID);
+	}
+
 	/* 'connect' request received */
 	wl_set_drv_status(cfg, CONNECTING, dev);
 	/* clear nested connect bit on proceeding for connection */
@@ -6768,13 +6805,11 @@ wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
 		/*
 		* Cancel ongoing scan to sync up with sme state machine of cfg80211.
 		*/
-#if !defined(ESCAN_RESULT_PATCH)
 		/* Let scan aborted by F/W */
 		if (cfg->scan_request) {
 			WL_TRACE_HW4(("Aborting the scan! \n"));
 			wl_cfg80211_cancel_scan(cfg);
 		}
-#endif /* ESCAN_RESULT_PATCH */
 		if (wl_get_drv_status(cfg, CONNECTING, dev) ||
 			wl_get_drv_status(cfg, CONNECTED, dev)) {
 				wl_set_drv_status(cfg, DISCONNECTING, dev);
@@ -6802,8 +6837,19 @@ wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
 		}
 #endif /* WPS_SYNC */
 		wl_cfg80211_wait_for_disconnection(cfg, dev);
+		if (wl_get_drv_status(cfg, DISCONNECTING, dev)) {
+			CFG80211_CONNECT_RESULT(dev, NULL, NULL,
+				NULL, 0, NULL, 0,
+				WLAN_STATUS_UNSPECIFIED_FAILURE,
+				GFP_KERNEL);
+			wl_clr_drv_status(cfg, DISCONNECTING, dev);
+		}
 	} else {
 		WL_INFORM_MEM(("act is false\n"));
+		CFG80211_CONNECT_RESULT(dev, NULL, NULL,
+			NULL, 0, NULL, 0,
+			WLAN_STATUS_UNSPECIFIED_FAILURE,
+			GFP_KERNEL);
 	}
 #ifdef CUSTOM_SET_CPUCORE
 	/* set default cpucore */
@@ -8280,6 +8326,7 @@ wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
 	struct net_device *ndev = NULL;
 	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
 
+	RETURN_EIO_IF_NOT_UP(cfg);
 #ifdef DHD_IFDEBUG
 	PRINT_WDEV_INFO(cfgdev);
 #endif /* DHD_IFDEBUG */
@@ -8293,6 +8340,7 @@ wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
 	}
 #endif /* WL_NAN */
 
+	mutex_lock(&cfg->usr_sync);
 	WL_DBG(("Enter, channel: %d, duration ms (%d) SCANNING ?? %s \n",
 		ieee80211_frequency_to_channel(channel->center_freq),
 		duration, (wl_get_drv_status(cfg, SCANNING, ndev)) ? "YES":"NO"));
@@ -8303,19 +8351,16 @@ wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
 		goto exit;
 	}
 
-#ifdef P2P_LISTEN_OFFLOADING
-	if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
-		WL_ERR(("P2P_FIND: Discovery offload is in progress\n"));
-		return -EAGAIN;
-	}
-#endif /* P2P_LISTEN_OFFLOADING */
-
 #ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
 	if (wl_get_drv_status_all(cfg, SCANNING)) {
 		wl_cfg80211_cancel_scan(cfg);
 	}
 #endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
 
+#ifdef P2P_LISTEN_OFFLOADING
+	wl_cfg80211_cancel_p2plo(cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
 	target_channel = ieee80211_frequency_to_channel(channel->center_freq);
 	memcpy(&cfg->remain_on_chan, channel, sizeof(struct ieee80211_channel));
 #if defined(WL_ENABLE_P2P_IF)
@@ -8352,6 +8397,10 @@ wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
 	}
 #endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
 
+#ifdef WL_BCNRECV
+	/* check fakeapscan in progress then abort */
+	wl_android_bcnrecv_stop(ndev, WL_BCNRECV_LISTENBUSY);
+#endif /* WL_BCNRECV */
 #ifdef WL_CFG80211_SYNC_GON
 	if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
 		/* do not enter listen mode again if we are in listen mode already for next af.
@@ -8418,6 +8467,7 @@ exit:
 	} else {
 		WL_ERR(("Fail to Set (err=%d cookie:%llu)\n", err, *cookie));
 	}
+	mutex_unlock(&cfg->usr_sync);
 	return err;
 }
 
@@ -13030,6 +13080,10 @@ wl_notify_connect_status_ap(struct bcm_cfg80211 *cfg, struct net_device *ndev,
 #ifdef BIGDATA_SOFTAP
 			wl_ap_stainfo_init(cfg);
 #endif /* BIGDATA_SOFTAP */
+#ifdef WL_BCNRECV
+			/* check fakeapscan is in progress, if progress then abort */
+			wl_android_bcnrecv_stop(ndev, WL_BCNRECV_CONCURRENCY);
+#endif /* WL_BCNRECV */
 			return 0;
 		}
 	}
@@ -14039,6 +14093,11 @@ wl_notify_connect_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 				scb_val_t scbval;
 				u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
 				uint32 reason = 0;
+				bcm_tlv_t *deauth_info = NULL;
+				wips_detect_inform_t *wips_detect_info;
+				uint8 wips_bssid[ETHER_ADDR_LEN];
+				u32 len = ntoh32(e->datalen) + TLV_HDR_LEN;
+
 				struct ether_addr bssid_dongle = {{0, 0, 0, 0, 0, 0}};
 				struct ether_addr bssid_null = {{0, 0, 0, 0, 0, 0}};
 
@@ -14049,6 +14108,23 @@ wl_notify_connect_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 							"changed 0xFF\n", event, reason));
 						reason = WLC_E_DEAUTH_MAX_REASON;
 					}
+					if ((deauth_info = bcm_parse_tlvs(data, len,
+						TAG_DEAUTH_TLV_WIPS)) != NULL) {
+						wips_detect_info =
+							(wips_detect_inform_t *)deauth_info->data;
+						memcpy(wips_bssid, &wips_detect_info->ea,
+							ETHER_ADDR_LEN);
+						if (wips_detect_info->misdeauth > 1) {
+							WL_ERR(("WIPS attack!! cnt=%d, curRSSI=%d, "
+								"deauthRSSI=%d, time=%d, "
+								"MAC="MACDBG"\n",
+								wips_detect_info->misdeauth,
+								wips_detect_info->cur_bsscfg_rssi,
+								wips_detect_info->deauth_rssi,
+								wips_detect_info->timestamp,
+								MAC2STRDBG(wips_bssid)));
+						}
+					}
 				}
 #ifdef SET_SSID_FAIL_CUSTOM_RC
 				if (event == WLC_E_SET_SSID) {
@@ -14203,19 +14279,25 @@ wl_notify_connect_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 			/* Dump FW preserve buffer content */
 			wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
 
-			if (wl_get_drv_status(cfg, DISCONNECTING, ndev) &&
-				wl_get_drv_status(cfg, CONNECTING, ndev)) {
-				wl_clr_drv_status(cfg, DISCONNECTING, ndev);
-				wl_clr_drv_status(cfg, CONNECTING, ndev);
-				wl_cfg80211_scan_abort(cfg);
-				DHD_ENABLE_RUNTIME_PM((dhd_pub_t *)cfg->pub);
-				return err;
-			}
 			/* Clean up any pending scan request */
 			wl_cfg80211_cancel_scan(cfg);
 
-			if (wl_get_drv_status(cfg, CONNECTING, ndev))
+			if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+				if (!wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+					WL_INFORM_MEM(("wl dissassoc\n"));
+					err = wldev_ioctl_set(ndev, WLC_DISASSOC, NULL, 0);
+					if (err < 0) {
+						WL_ERR(("WLC_DISASSOC error %d\n", err));
+						err = 0;
+					}
+				} else {
+					WL_DBG(("connect fail. clear disconnecting bit\n"));
+					wl_clr_drv_status(cfg, DISCONNECTING, ndev);
+				}
 				wl_bss_connect_done(cfg, ndev, e, data, false);
+				wl_clr_drv_status(cfg, CONNECTING, ndev);
+				WL_INFORM_MEM(("connect fail reported\n"));
+			}
 		} else {
 			WL_DBG(("%s nothing\n", __FUNCTION__));
 		}
@@ -15202,8 +15284,8 @@ wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
 			completed = false;
 			sec->auth_assoc_res_status = WLAN_STATUS_UNSPECIFIED_FAILURE;
 		}
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
-		CFG80211_CONNECT_BSS(ndev,
+
+		CFG80211_CONNECT_RESULT(ndev,
 			curbssid,
 			bss,
 			conn_info->req_ie,
@@ -15215,19 +15297,7 @@ wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
 			sec->auth_assoc_res_status :
 			WLAN_STATUS_UNSPECIFIED_FAILURE,
 			GFP_KERNEL);
-#else
-		cfg80211_connect_result(ndev,
-			curbssid,
-			conn_info->req_ie,
-			conn_info->req_ie_len,
-			conn_info->resp_ie,
-			conn_info->resp_ie_len,
-			completed ? WLAN_STATUS_SUCCESS :
-			(sec->auth_assoc_res_status) ?
-			sec->auth_assoc_res_status :
-			WLAN_STATUS_UNSPECIFIED_FAILURE,
-			GFP_KERNEL);
-#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0) */
+
 		if (completed) {
 			WL_INFORM_MEM(("[%s] Report connect result - "
 				"connection succeeded\n", ndev->name));
@@ -15459,7 +15529,7 @@ wl_notify_scan_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 	}
 	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
 
-	mutex_lock(&cfg->usr_sync);
+	mutex_lock(&cfg->scan_sync);
 	wl_clr_drv_status(cfg, SCANNING, ndev);
 	memset(&channel_inform, 0, sizeof(channel_inform));
 	err = wldev_ioctl_get(ndev, WLC_GET_CHANNEL, &channel_inform,
@@ -15499,7 +15569,7 @@ scan_done_out:
 	}
 	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
 	WL_DBG(("cfg80211_scan_done\n"));
-	mutex_unlock(&cfg->usr_sync);
+	mutex_unlock(&cfg->scan_sync);
 	return err;
 }
 
@@ -16533,6 +16603,9 @@ static void wl_init_event_handler(struct bcm_cfg80211 *cfg)
 #ifdef WL_BAM
 	cfg->evt_handler[WLC_E_ADPS] = wl_adps_event_handler;
 #endif	/* WL_BAM */
+#ifdef WL_BCNRECV
+	cfg->evt_handler[WLC_E_BCNRECV_ABORTED] = wl_bcnrecv_aborted_event_handler;
+#endif /* WL_BCNRECV */
 }
 
 #if defined(STATIC_WL_PRIV_STRUCT)
@@ -16758,10 +16831,27 @@ static void wl_scan_timeout(unsigned long data)
 #ifdef DHD_FW_COREDUMP
 	uint32 prev_memdump_mode = dhdp->memdump_enabled;
 #endif /* DHD_FW_COREDUMP */
+	unsigned long flags;
 
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
 	if (!(cfg->scan_request)) {
 		WL_ERR(("timer expired but no scan request\n"));
+		spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
 		return;
+	} else {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+		if (cfg->scan_request->dev) {
+			wdev = cfg->scan_request->dev->ieee80211_ptr;
+		}
+#else
+		wdev = cfg->scan_request->wdev;
+#endif /* LINUX_VERSION < KERNEL_VERSION(3, 6, 0) */
+		spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+		if (!wdev) {
+			WL_ERR(("No wireless_dev present\n"));
+			return;
+		}
 	}
 
 #if defined(DHD_KERNEL_SCHED_DEBUG) && defined(DHD_FW_COREDUMP)
@@ -16792,7 +16882,7 @@ static void wl_scan_timeout(unsigned long data)
 		mutex_is_locked(&cfg->if_sync),
 		mutex_is_locked(&cfg->usr_sync),
 		mutex_is_locked(&cfg->pm_sync),
-		mutex_is_locked(&cfg->scan_complete),
+		mutex_is_locked(&cfg->scan_sync),
 		spin_is_locked(&cfg->cfgdrv_lock),
 		spin_is_locked(&cfg->eq_lock)));
 	dhd_bus_intr_count_dump(dhdp);
@@ -16816,18 +16906,7 @@ static void wl_scan_timeout(unsigned long data)
 		}
 	}
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-	if (cfg->scan_request->dev)
-		wdev = cfg->scan_request->dev->ieee80211_ptr;
-#else
-	wdev = cfg->scan_request->wdev;
-#endif /* LINUX_VERSION < KERNEL_VERSION(3, 6, 0) */
-	if (!wdev) {
-		WL_ERR(("No wireless_dev present\n"));
-		return;
-	}
 	ndev = wdev_to_wlc_ndev(wdev, cfg);
-
 	bzero(&msg, sizeof(wl_event_msg_t));
 	WL_ERR(("timer expired\n"));
 #ifdef BCMPCIE
@@ -16984,8 +17063,10 @@ static void wl_cfg80211_cancel_scan(struct bcm_cfg80211 *cfg)
 	struct wireless_dev *wdev = NULL;
 	struct net_device *ndev = NULL;
 
-	if (!cfg->scan_request)
-		return;
+	mutex_lock(&cfg->scan_sync);
+	if (!cfg->scan_request) {
+		goto exit;
+	}
 
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
 	if (cfg->scan_request->dev)
@@ -16996,12 +17077,14 @@ static void wl_cfg80211_cancel_scan(struct bcm_cfg80211 *cfg)
 
 	if (!wdev) {
 		WL_ERR(("No wireless_dev present\n"));
-		return;
+		goto exit;
 	}
 
 	ndev = wdev_to_wlc_ndev(wdev, cfg);
 	wl_notify_escan_complete(cfg, ndev, true, true);
 	WL_INFORM_MEM(("Scan aborted! \n"));
+exit:
+	mutex_unlock(&cfg->scan_sync);
 }
 
 void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg)
@@ -17047,7 +17130,6 @@ static s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
 	WL_DBG(("Enter \n"));
 	BCM_REFERENCE(dhdp);
 
-	mutex_lock(&cfg->scan_complete);
 	if (!ndev) {
 		WL_ERR(("ndev is null\n"));
 		err = BCME_ERROR;
@@ -17122,7 +17204,6 @@ static s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
 	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
 
 out:
-	mutex_unlock(&cfg->scan_complete);
 	return err;
 }
 
@@ -17371,6 +17452,69 @@ exit:
 
 }
 #endif /* WL_DRV_AVOID_SCANCACHE */
+
+#ifdef WL_BCNRECV
+/* Beacon recv results handler sending to upper layer */
+static s32
+wl_bcnrecv_result_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+		wl_bss_info_v109_2_t *bi, uint32 scan_status)
+{
+	s32 err = BCME_OK;
+	struct wiphy *wiphy = NULL;
+	wl_bcnrecv_result_t *bcn_recv = NULL;
+	struct timespec ts;
+	if (!bi) {
+		WL_ERR(("%s: bi is NULL\n", __func__));
+		err = BCME_NORESOURCE;
+		goto exit;
+	}
+	if ((bi->length - bi->ie_length) < sizeof(wl_bss_info_v109_2_t)) {
+		WL_ERR(("bi info version doesn't support bcn_recv attributes\n"));
+		goto exit;
+	}
+
+	if (scan_status == WLC_E_STATUS_RXBCN) {
+		wiphy = cfg->wdev->wiphy;
+		if (!wiphy) {
+			 WL_ERR(("wiphy is NULL\n"));
+			 err = BCME_NORESOURCE;
+			 goto exit;
+		}
+		bcn_recv = (wl_bcnrecv_result_t *)MALLOCZ(cfg->osh, sizeof(*bcn_recv));
+		if (unlikely(!bcn_recv)) {
+			WL_ERR(("Failed to allocate memory\n"));
+			return -ENOMEM;
+		}
+		memcpy((char *)bcn_recv->SSID, (char *)bi->SSID, DOT11_MAX_SSID_LEN);
+		memcpy(&bcn_recv->BSSID, &bi->BSSID, ETH_ALEN);
+		bcn_recv->channel = wf_chspec_ctlchan(
+			wl_chspec_driver_to_host(bi->chanspec));
+		bcn_recv->beacon_interval = bi->beacon_period;
+
+		/* kernal timestamp */
+		get_monotonic_boottime(&ts);
+		bcn_recv->system_time = ((u64)ts.tv_sec*1000000)
+				+ ts.tv_nsec / 1000;
+		bcn_recv->timestamp[0] = bi->timestamp[0];
+		bcn_recv->timestamp[1] = bi->timestamp[1];
+		if (bcn_recv) {
+			if ((err = wl_android_bcnrecv_event(cfgdev_to_wlc_ndev(cfgdev, cfg),
+				BCNRECV_ATTR_BCNINFO, 0, 0, (uint8 *)bcn_recv, sizeof(*bcn_recv)))
+						!= BCME_OK) {
+				WL_ERR(("failed to send bcnrecv event, error:%d\n", err));
+			}
+		}
+	} else {
+		WL_DBG(("Ignoring Escan Event:%d \n", scan_status));
+	}
+exit:
+	if (bcn_recv) {
+		MFREE(cfg->osh, bcn_recv, sizeof(*bcn_recv));
+	}
+	return err;
+}
+#endif /* WL_BCNRECV */
+
 static s32 wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 	const wl_event_msg_t *e, void *data)
 {
@@ -17393,15 +17537,25 @@ static s32 wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 
 	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
 
-	mutex_lock(&cfg->usr_sync);
+	mutex_lock(&cfg->scan_sync);
 	/* P2P SCAN is coming from primary interface */
 	if (wl_get_p2p_status(cfg, SCANNING)) {
 		if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM))
 			ndev = cfg->afx_hdl->dev;
 		else
 			ndev = cfg->escan_info.ndev;
-
 	}
+	escan_result = (wl_escan_result_t *)data;
+#ifdef WL_BCNRECV
+	if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED &&
+		status == WLC_E_STATUS_RXBCN) {
+		/* handle beacon recv scan results */
+		wl_bss_info_v109_2_t *bi_info;
+		bi_info = (wl_bss_info_v109_2_t *)escan_result->bss_info;
+		err = wl_bcnrecv_result_handler(cfg, cfgdev, bi_info, status);
+		goto exit;
+	}
+#endif /* WL_BCNRECV */
 	if (!ndev || (!wl_get_drv_status(cfg, SCANNING, ndev) && !cfg->sched_scan_running)) {
 		WL_ERR_RLMT(("escan is not ready. drv_scan_status 0x%x"
 		" e_type %d e_states %d\n",
@@ -17409,7 +17563,6 @@ static s32 wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 		ntoh32(e->event_type), ntoh32(e->status)));
 		goto exit;
 	}
-	escan_result = (wl_escan_result_t *)data;
 
 #ifndef WL_DRV_AVOID_SCANCACHE
 	if (status == WLC_E_STATUS_PARTIAL) {
@@ -17762,7 +17915,7 @@ static s32 wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
 	err = wl_escan_without_scan_cache(cfg, escan_result, ndev, e, status);
 #endif /* WL_DRV_AVOID_SCANCACHE */
 exit:
-	mutex_unlock(&cfg->usr_sync);
+	mutex_unlock(&cfg->scan_sync);
 	return err;
 }
 
@@ -18108,11 +18261,14 @@ static s32 wl_init_priv(struct bcm_cfg80211 *cfg)
 	wl_init_event_handler(cfg);
 	mutex_init(&cfg->usr_sync);
 	mutex_init(&cfg->event_sync);
-	mutex_init(&cfg->scan_complete);
 	mutex_init(&cfg->if_sync);
+	mutex_init(&cfg->scan_sync);
 #ifdef WLTDLS
 	mutex_init(&cfg->tdls_sync);
 #endif	/* WLTDLS */
+#ifdef WL_BCNRECV
+	mutex_init(&cfg->bcn_sync);
+#endif /* WL_BCNRECV */
 #ifdef WL_WPS_SYNC
 	wl_init_wps_reauth_sm(cfg);
 #endif /* WL_WPS_SYNC */
@@ -19231,6 +19387,78 @@ static s32 __wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify)
 	return 0;
 }
 
+#ifdef WL_BCNRECV
+static s32
+wl_bcnrecv_aborted_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+		const wl_event_msg_t *e, void *data)
+{
+	s32 status = ntoh32(e->status);
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	/* Abort fakeapscan, when Roam is in progress */
+	if (status == WLC_E_STATUS_RXBCN_ABORT) {
+		wl_android_bcnrecv_stop(ndev, WL_BCNRECV_ROAMABORT);
+	} else {
+		WL_ERR(("UNKNOWN STATUS. status:%d\n", status));
+	}
+	return BCME_OK;
+}
+#endif /* WL_BCNRECV */
+
+/* Get the concurrency mode */
+int wl_cfg80211_get_concurrency_mode(struct bcm_cfg80211 *cfg)
+{
+	struct net_info *iter, *next;
+	uint cmode = CONCURRENCY_MODE_NONE;
+	u32 connected_cnt = 0;
+	u32 pre_channel = 0, channel = 0;
+	u32 pre_band = 0;
+	u32 chanspec = 0;
+	u32 band = 0;
+
+	connected_cnt = wl_get_drv_status_all(cfg, CONNECTED);
+	if (connected_cnt <= 1) {
+		return cmode;
+	}
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+	4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif // endif
+	for_each_ndev(cfg, iter, next) {
+		if (iter->ndev) {
+			if (wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
+				if (wldev_iovar_getint(iter->ndev, "chanspec",
+					(s32 *)&chanspec) == BCME_OK) {
+					channel = wf_chspec_ctlchan(
+						wl_chspec_driver_to_host(chanspec));
+					band = (channel <= CH_MAX_2G_CHANNEL) ?
+						IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+				}
+				if ((!pre_channel && channel)) {
+					pre_band = band;
+					pre_channel = channel;
+				} else if (pre_channel) {
+					if ((pre_band == band) && (pre_channel == channel)) {
+						cmode = CONCURRENCY_SCC_MODE;
+						goto exit;
+					} else if ((pre_band == band) && (pre_channel != channel)) {
+						cmode = CONCURRENCY_VSDB_MODE;
+						goto exit;
+					} else if (pre_band != band) {
+						cmode = CONCURRENCY_RSDB_MODE;
+						goto exit;
+					}
+				}
+			}
+		}
+	}
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+	4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif // endif
+exit:
+	return cmode;
+}
 s32 wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify)
 {
 	s32 err;
@@ -19471,10 +19699,36 @@ _Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
 		if (iter->ndev == NULL)
 			continue;
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+		WL_INFORM_MEM(("wl_cfg80211_down. connection state bit status: [%u:%u:%u:%u]\n",
+			wl_get_drv_status(cfg, CONNECTING, ndev),
+			wl_get_drv_status(cfg, CONNECTED, ndev),
+			wl_get_drv_status(cfg, DISCONNECTING, ndev),
+			wl_get_drv_status(cfg, NESTED_CONNECT, ndev)));
+
 		if ((iter->ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION) &&
 			wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
 			CFG80211_DISCONNECTED(iter->ndev, 0, NULL, 0, false, GFP_KERNEL);
 		}
+
+		if ((iter->ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION) &&
+			wl_get_drv_status(cfg, CONNECTING, iter->ndev)) {
+			u8 *latest_bssid = wl_read_prof(cfg, ndev, WL_PROF_LATEST_BSSID);
+			struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+			struct wireless_dev *wdev = ndev->ieee80211_ptr;
+			struct cfg80211_bss *bss = CFG80211_GET_BSS(wiphy, NULL, latest_bssid,
+				wdev->ssid, wdev->ssid_len);
+
+			prhex("bssid:", (uchar *)latest_bssid, ETHER_ADDR_LEN);
+			prhex("ssid:", (uchar *)wdev->ssid, wdev->ssid_len);
+			if (!bss) {
+				WL_DBG(("null bss\n"));
+			}
+
+			CFG80211_CONNECT_RESULT(ndev,
+					latest_bssid, bss, NULL, 0, NULL, 0,
+					WLAN_STATUS_UNSPECIFIED_FAILURE,
+					GFP_KERNEL);
+		}
 #endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) */
 		wl_clr_drv_status(cfg, READY, iter->ndev);
 		wl_clr_drv_status(cfg, SCANNING, iter->ndev);
@@ -19767,6 +20021,9 @@ static void *wl_read_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32
 	case WL_PROF_CHAN:
 		rptr = &profile->channel;
 		break;
+	case WL_PROF_LATEST_BSSID:
+		rptr = profile->latest_bssid;
+		break;
 	}
 	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
 	if (!rptr)
@@ -19815,6 +20072,13 @@ wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev,
 	case WL_PROF_CHAN:
 		profile->channel = *(const u32*)data;
 		break;
+	case WL_PROF_LATEST_BSSID:
+		if (data) {
+			memcpy(profile->latest_bssid, data, ETHER_ADDR_LEN);
+		} else {
+			memset(profile->latest_bssid, 0, ETHER_ADDR_LEN);
+		}
+		break;
 	default:
 		err = -EOPNOTSUPP;
 		break;
@@ -22267,6 +22531,11 @@ wl_cfg80211_set_mgmt_vndr_ies(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgde
 	struct net_info *netinfo;
 	struct wireless_dev *wdev;
 
+	if (!cfgdev) {
+		WL_ERR(("cfgdev is NULL\n"));
+		return -EINVAL;
+	}
+
 	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
 	wdev = cfgdev_to_wdev(cfgdev);
 
@@ -22768,9 +23037,8 @@ void wl_cfg80211_del_p2p_wdev(struct net_device *dev)
 		wdev = cfg->p2p_wdev;
 	}
 
-	if (wdev && cfg->down_disc_if) {
+	if (wdev) {
 		wl_cfgp2p_del_p2p_disc_if(wdev, cfg);
-		cfg->down_disc_if = FALSE;
 	}
 }
 #endif /* WL_CFG80211_P2P_DEV_IF */
@@ -24738,175 +25006,6 @@ wl_flush_fw_log_buffer(struct net_device *dev, uint32 logset_mask)
 }
 #endif /* DHD_LOG_DUMP */
 
-#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
-static void
-wl_cfgvendor_send_hang_event(struct net_device *dev, u16 reason, char *string, int hang_info_cnt)
-{
-	struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
-	struct wiphy *wiphy;
-	char *hang_info;
-	int len = 0;
-	int bytes_written;
-	uint32 dumy_data = 0;
-	int reason_hang_info = 0;
-	int cnt = 0;
-	dhd_pub_t *dhd;
-	int hang_reason_mismatch = FALSE;
-
-	if (!cfg || !cfg->wdev) {
-		WL_ERR(("cfg=%p wdev=%p\n", cfg, (cfg ? cfg->wdev : NULL)));
-		return;
-	}
-
-	wiphy = cfg->wdev->wiphy;
-
-	if (!wiphy) {
-		WL_ERR(("wiphy is NULL\n"));
-		return;
-	}
-
-	hang_info = MALLOCZ(cfg->osh, VENDOR_SEND_HANG_EXT_INFO_LEN);
-	if (hang_info == NULL) {
-		WL_ERR(("alloc hang_info failed\n"));
-		return;
-	}
-
-	dhd = (dhd_pub_t *)(cfg->pub);
-
-	sscanf(string, "%d", &reason_hang_info);
-	bytes_written = 0;
-	len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
-	if (strlen(string) == 0 || (reason_hang_info != reason)) {
-		WL_ERR(("hang reason mismatch: string len %d reason_hang_info %d\n",
-			(int)strlen(string), reason_hang_info));
-		hang_reason_mismatch = TRUE;
-		if (dhd) {
-			get_debug_dump_time(dhd->debug_dump_time_hang_str);
-			copy_debug_dump_time(dhd->debug_dump_time_str,
-					dhd->debug_dump_time_hang_str);
-		}
-		bytes_written += scnprintf(&hang_info[bytes_written], len,
-				"%d %d %s %08x %08x %08x %08x %08x %08x %08x",
-				reason, VENDOR_SEND_HANG_EXT_INFO_VER,
-				dhd->debug_dump_time_hang_str,
-				0, 0, 0, 0, 0, 0, 0);
-		if (dhd) {
-			clear_debug_dump_time(dhd->debug_dump_time_hang_str);
-		}
-	} else {
-		bytes_written += scnprintf(&hang_info[bytes_written], len, "%s", string);
-	}
-
-	WL_ERR(("hang reason: %d info cnt: %d\n", reason, hang_info_cnt));
-
-	if (hang_reason_mismatch == FALSE) {
-		cnt = hang_info_cnt;
-	} else {
-		cnt = HANG_FIELD_MISMATCH_CNT;
-	}
-
-	while (cnt < HANG_FIELD_CNT_MAX) {
-		len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
-		bytes_written += scnprintf(&hang_info[bytes_written], len,
-				"%c%08x", HANG_RAW_DEL, dumy_data);
-		cnt++;
-	}
-
-	WL_ERR(("hang info cnt: %d len: %d\n", cnt, (int)strlen(hang_info)));
-	WL_ERR(("hang info data: %s\n", hang_info));
-
-	wl_cfgvendor_send_async_event(wiphy,
-			bcmcfg_to_prmry_ndev(cfg), BRCM_VENDOR_EVENT_HANGED,
-			hang_info, (int)strlen(hang_info));
-
-	memset(string, 0, VENDOR_SEND_HANG_EXT_INFO_LEN);
-
-	if (hang_info) {
-		MFREE(cfg->osh, hang_info, VENDOR_SEND_HANG_EXT_INFO_LEN);
-	}
-
-#ifdef DHD_LOG_DUMP
-	if (dhd->debug_dump_time_hang_str) {
-		dhd_logdump_cookie_save(dhd, dhd->debug_dump_time_hang_str, "HANG");
-	}
-#endif /* DHD_LOG_DUMP */
-
-	if (dhd) {
-		clear_debug_dump_time(dhd->debug_dump_time_str);
-	}
-}
-
-void
-wl_copy_hang_info_if_falure(struct net_device *dev, u16 reason, s32 ret)
-{
-	struct bcm_cfg80211 *cfg = NULL;
-	dhd_pub_t *dhd;
-	s32 err = 0;
-	char ioctl_buf[WLC_IOCTL_SMLEN];
-	memuse_info_t mu;
-	int bytes_written = 0;
-	int remain_len = 0;
-
-	if (!dev) {
-		WL_ERR(("dev is null"));
-		return;
-
-	}
-
-	cfg = wl_get_cfg(dev);
-	if (!cfg) {
-		WL_ERR(("dev=%p cfg=%p\n", dev, cfg));
-		return;
-	}
-
-	dhd = (dhd_pub_t *)(cfg->pub);
-
-	if (!dhd || !dhd->hang_info) {
-		WL_ERR(("%s dhd=%p hang_info=%p\n", __FUNCTION__,
-			dhd, (dhd ? dhd->hang_info : NULL)));
-		return;
-	}
-
-	err = wldev_iovar_getbuf_bsscfg(dev, "memuse",
-			NULL, 0, ioctl_buf, WLC_IOCTL_SMLEN, 0, NULL);
-	if (unlikely(err)) {
-		WL_ERR(("error (%d)\n", err));
-		return;
-	}
-
-	memcpy(&mu, ioctl_buf, sizeof(memuse_info_t));
-
-	if (mu.len >= sizeof(memuse_info_t)) {
-		WL_ERR(("Heap Total: %d(%dK)\n", mu.arena_size, KB(mu.arena_size)));
-		WL_ERR(("Free: %d(%dK), LWM: %d(%dK)\n",
-			mu.arena_free, KB(mu.arena_free),
-			mu.free_lwm, KB(mu.free_lwm)));
-		WL_ERR(("In use: %d(%dK), HWM: %d(%dK)\n",
-			mu.inuse_size, KB(mu.inuse_size),
-			mu.inuse_hwm, KB(mu.inuse_hwm)));
-		WL_ERR(("Malloc failure count: %d\n", mu.mf_count));
-	}
-
-	memset(dhd->hang_info, 0, VENDOR_SEND_HANG_EXT_INFO_LEN);
-	remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
-
-	get_debug_dump_time(dhd->debug_dump_time_hang_str);
-	copy_debug_dump_time(dhd->debug_dump_time_str, dhd->debug_dump_time_hang_str);
-
-	bytes_written += scnprintf(&dhd->hang_info[bytes_written], remain_len,
-			"%d %d %s %d %d %d %d %d %08x %08x",
-			reason, VENDOR_SEND_HANG_EXT_INFO_VER,
-			dhd->debug_dump_time_hang_str,
-			ret, mu.arena_size, mu.arena_free, mu.inuse_size, mu.mf_count, 0, 0);
-
-	dhd->hang_info_cnt = HANG_FIELD_IF_FAILURE_CNT;
-
-	clear_debug_dump_time(dhd->debug_dump_time_hang_str);
-
-	return;
-}
-#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
-
 s32
 wl_cfg80211_set_dbg_verbose(struct net_device *ndev, u32 level)
 {
diff --git a/drivers/net/wireless/bcmdhd4361/wl_cfg80211.h b/drivers/net/wireless/bcmdhd4361/wl_cfg80211.h
index c35541fd8647..6382384acf58 100644
--- a/drivers/net/wireless/bcmdhd4361/wl_cfg80211.h
+++ b/drivers/net/wireless/bcmdhd4361/wl_cfg80211.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wl_cfg80211.h 796900 2018-12-27 09:37:28Z $
+ * $Id: wl_cfg80211.h 819372 2019-05-13 06:41:30Z $
  */
 
 /**
@@ -476,7 +476,8 @@ enum wl_prof_list {
 	WL_PROF_BSSID,
 	WL_PROF_ACT,
 	WL_PROF_BEACONINT,
-	WL_PROF_DTIMPERIOD
+	WL_PROF_DTIMPERIOD,
+	WL_PROF_LATEST_BSSID
 };
 
 /* donlge escan state */
@@ -617,6 +618,7 @@ struct wl_profile {
 	u16 beacon_interval;
 	u8 dtim_period;
 	bool active;
+	u8 latest_bssid[ETHER_ADDR_LEN];
 };
 
 struct wl_wps_ie {
@@ -660,6 +662,54 @@ struct net_info {
 	struct list_head list; /* list of all net_info structure */
 };
 
+#ifdef WL_BCNRECV
+/* PERIODIC Beacon receive for detecting FakeAPs */
+typedef struct wl_bcnrecv_result {
+	uint8      SSID[DOT11_MAX_SSID_LEN];    /**< SSID String */
+	struct ether_addr BSSID;                /**< Network BSSID */
+	uint8      channel;                     /**< Channel */
+	uint16     beacon_interval;
+	uint32	   timestamp[2];		/**< Beacon Timestamp */
+	uint64     system_time;
+} wl_bcnrecv_result_t;
+
+typedef struct wl_bcnrecv_info {
+	uint bcnrecv_state;		/* TO know the fakeap state */
+} wl_bcnrecv_info_t;
+
+typedef enum wl_bcnrecv_state {
+	BEACON_RECV_IDLE = 0,
+	BEACON_RECV_STARTED,
+	BEACON_RECV_STOPPED,
+	BEACON_RECV_SUSPENDED
+} wl_bcnrecv_state_t;
+
+typedef enum wl_bcnrecv_reason {
+	WL_BCNRECV_INVALID = 0,
+	WL_BCNRECV_USER_TRIGGER,
+	WL_BCNRECV_SUSPEND,
+	WL_BCNRECV_SCANBUSY,
+	WL_BCNRECV_CONCURRENCY,
+	WL_BCNRECV_LISTENBUSY,
+	WL_BCNRECV_ROAMABORT,
+	WL_BCNRECV_HANG
+} wl_bcnrecv_reason_t;
+
+typedef enum wl_bcnrecv_status {
+	WL_BCNRECV_STARTED = 0,
+	WL_BCNRECV_STOPPED,
+	WL_BCNRECV_ABORTED,
+	WL_BCNRECV_SUSPENDED,
+	WL_BCNRECV_MAX
+} wl_bcnrecv_status_t;
+
+typedef enum wl_bcnrecv_attr_type {
+	BCNRECV_ATTR_STATUS = 1,
+	BCNRECV_ATTR_REASON,
+	BCNRECV_ATTR_BCNINFO
+} wl_bcnrecv_attr_type_t;
+#endif /* WL_BCNRECV */
+
 /* association inform */
 #define MAX_REQ_LINE 1024u
 struct wl_connect_info {
@@ -955,7 +1005,7 @@ struct bcm_cfg80211 {
 	struct completion wait_next_af;
 	struct mutex usr_sync;	/* maily for up/down synchronization */
 	struct mutex if_sync;	/* maily for iface op synchronization */
-	struct mutex scan_complete;	/* serialize scan_complete call */
+	struct mutex scan_sync;	/* scan sync from different scan contexts  */
 	struct wl_scan_results *bss_list;
 	struct wl_scan_results *scan_results;
 
@@ -1089,9 +1139,6 @@ struct bcm_cfg80211 {
 	nan_ranging_inst_t nan_ranging_info[NAN_MAX_RANGING_INST];
 #endif /* WL_NAN_DISC_CACHE  */
 #endif /* WL_NAN */
-#ifdef WL_CFG80211_P2P_DEV_IF
-	bool down_disc_if;
-#endif /* WL_CFG80211_P2P_DEV_IF */
 #ifdef P2PLISTEN_AP_SAMECHN
 	bool p2p_resp_apchn_status;
 #endif /* P2PLISTEN_AP_SAMECHN */
@@ -1175,6 +1222,12 @@ struct bcm_cfg80211 {
 #ifdef SUPPORT_CUSTOM_SET_CAC
 	int enable_cac;
 #endif	/* SUPPORT_CUSTOM_SET_CAC */
+
+#ifdef WL_BCNRECV
+	/* structure used for fake ap detection info */
+	struct mutex bcn_sync;	/* mainly for bcn resume/suspend synchronization */
+	wl_bcnrecv_info_t bcnrecv_info;
+#endif /* WL_BCNRECV */
 };
 
 #define WL_STATIC_IFIDX	(DHD_MAX_IFS + DHD_MAX_STATIC_IFS - 1)
@@ -1193,8 +1246,27 @@ enum static_ndev_states {
 #define IS_CFG80211_STATIC_IF_NAME(cfg, name) \
 	((cfg && !strcmp(cfg->static_ndev->name, name)))
 
+typedef enum wl_concurrency_mode {
+	CONCURRENCY_MODE_NONE = 0,
+	CONCURRENCY_SCC_MODE,
+	CONCURRENCY_VSDB_MODE,
+	CONCURRENCY_RSDB_MODE
+} wl_concurrency_mode_t;
+
 s32 wl_iftype_to_mode(wl_iftype_t iftype);
 
+typedef struct wips_detect_inform {
+	uint16	misdeauth;		/* wrong deauth count every 1sec */
+	int16	cur_bsscfg_rssi;	/* current bss rssi */
+	int16	deauth_rssi;		/* wrong deauth pkt rssi */
+	struct	ether_addr ea;		/* MAC address for misdeauth */
+	uint32	timestamp;		/* start timestamp for misdeauth */
+} wips_detect_inform_t;
+
+enum {
+	TAG_DEAUTH_TLV_WIPS = 0 /* Deauth info for WIPS */
+};
+
 #if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
 	4 && __GNUC_MINOR__ >= 6))
 #define GCC_DIAGNOSTIC_PUSH() \
@@ -2167,4 +2239,5 @@ extern bool wl_cfg80211_check_indoor_channels(struct net_device *ndev, int chann
 extern int wl_cfg80211_enable_cac(struct net_device *dev, int enable);
 extern void wl_cfg80211_set_cac(struct bcm_cfg80211 *cfg, int enable);
 #endif /* SUPPORT_SET_CAC */
+extern int wl_cfg80211_get_concurrency_mode(struct bcm_cfg80211 *cfg);
 #endif /* _wl_cfg80211_h_ */
diff --git a/drivers/net/wireless/bcmdhd4361/wl_cfgp2p.c b/drivers/net/wireless/bcmdhd4361/wl_cfgp2p.c
index dba9a70fc016..cf8ec965eab9 100644
--- a/drivers/net/wireless/bcmdhd4361/wl_cfgp2p.c
+++ b/drivers/net/wireless/bcmdhd4361/wl_cfgp2p.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wl_cfgp2p.c 783638 2018-10-08 02:24:49Z $
+ * $Id: wl_cfgp2p.c 819437 2019-05-13 12:34:56Z $
  *
  */
 #include <typedefs.h>
@@ -2561,6 +2561,10 @@ wl_cfgp2p_stop_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev)
 	if (!cfg->p2p)
 		return;
 
+#ifdef P2P_LISTEN_OFFLOADING
+	wl_cfg80211_p2plo_deinit(cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
 	/* Cancel any on-going listen */
 	wl_cfgp2p_cancel_listen(cfg, bcmcfg_to_prmry_ndev(cfg), wdev, TRUE);
 
@@ -2582,12 +2586,17 @@ wl_cfgp2p_del_p2p_disc_if(struct wireless_dev *wdev, struct bcm_cfg80211 *cfg)
 	bool rollback_lock = false;
 
 	if (!wdev || !cfg) {
-		WL_ERR(("null ptr. wdev:%p cfg:%p\n", wdev, cfg));
+		WL_ERR(("wdev or cfg is NULL\n"));
 		return -EINVAL;
 	}
 
 	WL_INFORM(("Enter\n"));
 
+	if (!cfg->p2p_wdev) {
+		WL_ERR(("Already deleted p2p_wdev\n"));
+		return -EINVAL;
+	}
+
 	if (!rtnl_is_locked()) {
 		rtnl_lock();
 		rollback_lock = true;
diff --git a/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.c b/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.c
index dd915b9569b9..96bfeeac2779 100644
--- a/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.c
+++ b/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.c
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wl_cfgvendor.c 797501 2019-01-02 04:57:12Z $
+ * $Id: wl_cfgvendor.c 818247 2019-05-07 04:15:13Z $
  */
 
 /*
@@ -267,25 +267,31 @@ static int
 wl_cfgvendor_set_rand_mac_oui(struct wiphy *wiphy,
 	struct wireless_dev *wdev, const void  *data, int len)
 {
-	int err = 0;
+	int err = -EINVAL;
 	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
 	int type;
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		goto exit;
+	}
+
+	if (len <= 0) {
+		WL_ERR(("invalid len %d\n", len));
+		goto exit;
+	}
+
 	type = nla_type(data);
 
 	if (type == ANDR_WIFI_ATTRIBUTE_RANDOM_MAC_OUI) {
 		if (nla_len(data) != DOT11_OUI_LEN) {
 			WL_ERR(("nla_len not matched.\n"));
-			err = -EINVAL;
 			goto exit;
 		}
 		err = dhd_dev_cfg_rand_mac_oui(bcmcfg_to_prmry_ndev(cfg), nla_data(data));
 
 		if (unlikely(err))
 			WL_ERR(("Bad OUI, could not set:%d \n", err));
-
-	} else {
-		err = -EINVAL;
 	}
 exit:
 	return err;
@@ -295,18 +301,27 @@ static int
 wl_cfgvendor_set_nodfs_flag(struct wiphy *wiphy,
 	struct wireless_dev *wdev, const void *data, int len)
 {
-	int err = 0;
+	int err = -EINVAL;
 	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
 	int type;
 	u32 nodfs;
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		return -EINVAL;
+	}
+
+	if (len <= 0) {
+		WL_ERR(("invalid len %d\n", len));
+		return -EINVAL;
+	}
+
 	type = nla_type(data);
 	if (type == ANDR_WIFI_ATTRIBUTE_NODFS_SET) {
 		nodfs = nla_get_u32(data);
 		err = dhd_dev_set_nodfs(bcmcfg_to_prmry_ndev(cfg), nodfs);
-	} else {
-		err = -1;
 	}
+
 	return err;
 }
 #endif /* CUSTOM_FORCE_NODFS_FLAG */
@@ -570,6 +585,16 @@ wl_cfgvendor_enable_full_scan_result(struct wiphy *wiphy,
 	int type;
 	bool real_time = FALSE;
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		return -EINVAL;
+	}
+
+	if (len <= 0) {
+		WL_ERR(("invalid len %d\n", len));
+		return -EINVAL;
+	}
+
 	type = nla_type(data);
 
 	if (type == GSCAN_ATTRIBUTE_ENABLE_FULL_SCAN_RESULTS) {
@@ -1101,6 +1126,16 @@ wl_cfgvendor_gscan_get_channel_list(struct wiphy *wiphy,
 	uint32 reply_len = 0, num_channels, mem_needed;
 	struct sk_buff *skb;
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		return -EINVAL;
+	}
+
+	if (len <= 0) {
+		WL_ERR(("invalid len %d\n", len));
+		return -EINVAL;
+	}
+
 	type = nla_type(data);
 
 	if (type == GSCAN_ATTRIBUTE_BAND) {
@@ -1184,6 +1219,12 @@ wl_cfgvendor_set_tcpack_sup_mode(struct wiphy *wiphy,
 	struct net_device *ndev = wdev_to_wlc_ndev(wdev, cfg);
 	uint8 enable = 0;
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		err = BCME_BADARG;
+		goto exit;
+	}
+
 	if (len <= 0) {
 		WL_ERR(("Length of the nlattr is not valid len : %d\n", len));
 		err = BCME_BADARG;
@@ -1761,6 +1802,16 @@ static int wl_cfgvendor_enable_lazy_roam(struct wiphy *wiphy,
 	int type;
 	uint32 lazy_roam_enable_flag;
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		return -EINVAL;
+	}
+
+	if (len <= 0) {
+		WL_ERR(("invaild len %d\n", len));
+		return -EINVAL;
+	}
+
 	type = nla_type(data);
 
 	if (type == GSCAN_ATTRIBUTE_LAZY_ROAM_ENABLE) {
@@ -1771,6 +1822,7 @@ static int wl_cfgvendor_enable_lazy_roam(struct wiphy *wiphy,
 		if (unlikely(err))
 			WL_ERR(("Could not enable lazy roam:%d \n", err));
 	}
+
 	return err;
 }
 
@@ -2216,6 +2268,16 @@ wl_cfgvendor_set_fw_roaming_state(struct wiphy *wiphy,
 	int type;
 	int err = 0;
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		return -EINVAL;
+	}
+
+	if (len <= 0) {
+		WL_ERR(("invalid len %d\n", len));
+		return -EINVAL;
+	}
+
 	/* Get the requested fw roaming state */
 	type = nla_type(data);
 	if (type != GSCAN_ATTRIBUTE_ROAM_STATE_SET) {
@@ -2272,8 +2334,6 @@ wl_cfgvendor_priv_string_handler(struct wiphy *wiphy,
 	struct sk_buff *reply;
 	dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(wdev->netdev);
 
-	WL_DBG(("entry: cmd = %d\n", nlioc->cmd));
-
 	/* send to dongle only if we are not waiting for reload already */
 	if (dhdp && dhdp->hang_was_sent) {
 		WL_INFORM(("Bus down. HANG was sent up earlier\n"));
@@ -2282,6 +2342,18 @@ wl_cfgvendor_priv_string_handler(struct wiphy *wiphy,
 		return OSL_ERROR(BCME_DONGLE_DOWN);
 	}
 
+	if (!data) {
+		WL_ERR(("data is not available\n"));
+		return BCME_BADARG;
+	}
+
+	if (len <= 0) {
+		WL_ERR(("invalid len %d\n", len));
+		return BCME_BADARG;
+	}
+
+	WL_DBG(("entry: cmd = %d\n", nlioc->cmd));
+
 	if (nlioc->offset != sizeof(struct bcm_nlmsg_hdr) ||
 		len <= sizeof(struct bcm_nlmsg_hdr)) {
 		WL_ERR(("invalid offset %d\n", nlioc->offset));
@@ -7151,7 +7223,9 @@ static const struct  nl80211_vendor_cmd_info wl_vendor_events [] = {
 		{ OUI_GOOGLE, GOOGLE_NAN_EVENT_SUBSCRIBE_UNMATCH},
 		{ OUI_GOOGLE, GOOGLE_NAN_EVENT_UNKNOWN},
 		{ OUI_GOOGLE, GOOGLE_ROAM_EVENT_START},
-		{ OUI_BRCM, BRCM_VENDOR_EVENT_HANGED}
+		{ OUI_BRCM, BRCM_VENDOR_EVENT_HANGED},
+		{ OUI_BRCM, BRCM_VENDOR_EVENT_SAE_KEY},
+		{ OUI_BRCM, BRCM_VENDOR_EVENT_BEACON_RECV}
 };
 
 int wl_cfgvendor_attach(struct wiphy *wiphy, dhd_pub_t *dhd)
@@ -7188,3 +7262,178 @@ int wl_cfgvendor_detach(struct wiphy *wiphy)
 	return 0;
 }
 #endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+void
+wl_cfgvendor_send_hang_event(struct net_device *dev, u16 reason, char *string, int hang_info_cnt)
+{
+	struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+	struct wiphy *wiphy;
+	char *hang_info;
+	int len = 0;
+	int bytes_written;
+	uint32 dumy_data = 0;
+	int reason_hang_info = 0;
+	int cnt = 0;
+	dhd_pub_t *dhd;
+	int hang_reason_mismatch = FALSE;
+
+	if (!cfg || !cfg->wdev) {
+		WL_ERR(("cfg=%p wdev=%p\n", cfg, (cfg ? cfg->wdev : NULL)));
+		return;
+	}
+
+	wiphy = cfg->wdev->wiphy;
+
+	if (!wiphy) {
+		WL_ERR(("wiphy is NULL\n"));
+		return;
+	}
+
+	hang_info = MALLOCZ(cfg->osh, VENDOR_SEND_HANG_EXT_INFO_LEN);
+	if (hang_info == NULL) {
+		WL_ERR(("alloc hang_info failed\n"));
+		return;
+	}
+
+	dhd = (dhd_pub_t *)(cfg->pub);
+
+#ifdef WL_BCNRECV
+	/* check fakeapscan in progress then stop scan */
+	if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED) {
+		wl_android_bcnrecv_stop(dev, WL_BCNRECV_HANG);
+	}
+#endif /* WL_BCNRECV */
+	sscanf(string, "%d", &reason_hang_info);
+	bytes_written = 0;
+	len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+	if (strlen(string) == 0 || (reason_hang_info != reason)) {
+		WL_ERR(("hang reason mismatch: string len %d reason_hang_info %d\n",
+			(int)strlen(string), reason_hang_info));
+		hang_reason_mismatch = TRUE;
+		if (dhd) {
+			get_debug_dump_time(dhd->debug_dump_time_hang_str);
+			copy_debug_dump_time(dhd->debug_dump_time_str,
+					dhd->debug_dump_time_hang_str);
+		}
+		bytes_written += scnprintf(&hang_info[bytes_written], len,
+				"%d %d %s %08x %08x %08x %08x %08x %08x %08x",
+				reason, VENDOR_SEND_HANG_EXT_INFO_VER,
+				dhd->debug_dump_time_hang_str,
+				0, 0, 0, 0, 0, 0, 0);
+		if (dhd) {
+			clear_debug_dump_time(dhd->debug_dump_time_hang_str);
+		}
+	} else {
+		bytes_written += scnprintf(&hang_info[bytes_written], len, "%s", string);
+	}
+
+	WL_ERR(("hang reason: %d info cnt: %d\n", reason, hang_info_cnt));
+
+	if (hang_reason_mismatch == FALSE) {
+		cnt = hang_info_cnt;
+	} else {
+		cnt = HANG_FIELD_MISMATCH_CNT;
+	}
+
+	while (cnt < HANG_FIELD_CNT_MAX) {
+		len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+		bytes_written += scnprintf(&hang_info[bytes_written], len,
+				"%c%08x", HANG_RAW_DEL, dumy_data);
+		cnt++;
+	}
+
+	WL_ERR(("hang info cnt: %d len: %d\n", cnt, (int)strlen(hang_info)));
+	WL_ERR(("hang info data: %s\n", hang_info));
+
+	wl_cfgvendor_send_async_event(wiphy,
+			bcmcfg_to_prmry_ndev(cfg), BRCM_VENDOR_EVENT_HANGED,
+			hang_info, (int)strlen(hang_info));
+
+	memset(string, 0, VENDOR_SEND_HANG_EXT_INFO_LEN);
+
+	if (hang_info) {
+		MFREE(cfg->osh, hang_info, VENDOR_SEND_HANG_EXT_INFO_LEN);
+	}
+
+#ifdef DHD_LOG_DUMP
+	if (dhd->debug_dump_time_hang_str) {
+		dhd_logdump_cookie_save(dhd, dhd->debug_dump_time_hang_str, "HANG");
+	}
+#endif /* DHD_LOG_DUMP */
+
+	if (dhd) {
+		clear_debug_dump_time(dhd->debug_dump_time_str);
+	}
+}
+
+void
+wl_copy_hang_info_if_falure(struct net_device *dev, u16 reason, s32 ret)
+{
+	struct bcm_cfg80211 *cfg = NULL;
+	dhd_pub_t *dhd;
+	s32 err = 0;
+	char ioctl_buf[WLC_IOCTL_SMLEN];
+	memuse_info_t mu;
+	int bytes_written = 0;
+	int remain_len = 0;
+
+	if (!dev) {
+		WL_ERR(("dev is null"));
+		return;
+
+	}
+
+	cfg = wl_get_cfg(dev);
+	if (!cfg) {
+		WL_ERR(("dev=%p cfg=%p\n", dev, cfg));
+		return;
+	}
+
+	dhd = (dhd_pub_t *)(cfg->pub);
+
+	if (!dhd || !dhd->hang_info) {
+		WL_ERR(("%s dhd=%p hang_info=%p\n", __FUNCTION__,
+			dhd, (dhd ? dhd->hang_info : NULL)));
+		return;
+	}
+
+	err = wldev_iovar_getbuf_bsscfg(dev, "memuse",
+			NULL, 0, ioctl_buf, WLC_IOCTL_SMLEN, 0, NULL);
+	if (unlikely(err)) {
+		WL_ERR(("error (%d)\n", err));
+		return;
+	}
+
+	memcpy(&mu, ioctl_buf, sizeof(memuse_info_t));
+
+	if (mu.len >= sizeof(memuse_info_t)) {
+		WL_ERR(("Heap Total: %d(%dK)\n", mu.arena_size, KB(mu.arena_size)));
+		WL_ERR(("Free: %d(%dK), LWM: %d(%dK)\n",
+			mu.arena_free, KB(mu.arena_free),
+			mu.free_lwm, KB(mu.free_lwm)));
+		WL_ERR(("In use: %d(%dK), HWM: %d(%dK)\n",
+			mu.inuse_size, KB(mu.inuse_size),
+			mu.inuse_hwm, KB(mu.inuse_hwm)));
+		WL_ERR(("Malloc failure count: %d\n", mu.mf_count));
+	}
+
+	memset(dhd->hang_info, 0, VENDOR_SEND_HANG_EXT_INFO_LEN);
+	remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+
+	get_debug_dump_time(dhd->debug_dump_time_hang_str);
+	copy_debug_dump_time(dhd->debug_dump_time_str, dhd->debug_dump_time_hang_str);
+
+	bytes_written += scnprintf(&dhd->hang_info[bytes_written], remain_len,
+			"%d %d %s %d %d %d %d %d %08x %08x",
+			reason, VENDOR_SEND_HANG_EXT_INFO_VER,
+			dhd->debug_dump_time_hang_str,
+			ret, mu.arena_size, mu.arena_free, mu.inuse_size, mu.mf_count, 0, 0);
+
+	dhd->hang_info_cnt = HANG_FIELD_IF_FAILURE_CNT;
+
+	clear_debug_dump_time(dhd->debug_dump_time_hang_str);
+
+	return;
+}
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
diff --git a/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.h b/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.h
index 782b4dcbf1f3..f4db53686d9d 100644
--- a/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.h
+++ b/drivers/net/wireless/bcmdhd4361/wl_cfgvendor.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wl_cfgvendor.h 740003 2018-01-10 10:47:17Z $
+ * $Id: wl_cfgvendor.h 818247 2019-05-07 04:15:13Z $
  */
 
 #ifndef _wl_cfgvendor_h_
@@ -447,7 +447,9 @@ typedef enum wl_vendor_event {
 
 	GOOGLE_ROAM_EVENT_START			= 32,
 
-	BRCM_VENDOR_EVENT_HANGED		= 33
+	BRCM_VENDOR_EVENT_HANGED		= 33,
+	BRCM_VENDOR_EVENT_SAE_KEY               = 34,
+	BRCM_VENDOR_EVENT_BEACON_RECV           = 35
 } wl_vendor_event_t;
 
 enum andr_wifi_attr {
@@ -603,4 +605,22 @@ extern int wl_cfgvendor_send_supp_eventstring(const char *func, const char *fmt,
 	normal_structure.member = value;
 #endif /* CONFIG_COMPAT */
 
+#ifdef WL_BCNRECV
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+	LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+#define CFG80211_VENDOR_EVENT_ALLOC(wiphy, wdev, len, type, kflags) \
+	cfg80211_vendor_event_alloc(wiphy, ndev_to_wdev(ndev), len, \
+			BRCM_VENDOR_EVENT_BEACON_RECV, kflags);
+#else
+#define CFG80211_VENDOR_EVENT_ALLOC(wiphy, wdev, len, type, kflags) \
+	cfg80211_vendor_event_alloc(wiphy, len, BRCM_VENDOR_EVENT_BEACON_RECV, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+		/* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+#endif /* WL_BCNRECV */
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+void wl_cfgvendor_send_hang_event(struct net_device *dev, u16 reason,
+	char *string, int hang_info_cnt);
+void wl_copy_hang_info_if_falure(struct net_device *dev, u16 reason, s32 ret);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
 #endif /* _wl_cfgvendor_h_ */
diff --git a/drivers/net/wireless/bcmdhd4361/wldev_common.h b/drivers/net/wireless/bcmdhd4361/wldev_common.h
index 0c5191e173f9..f42652fc3cc9 100644
--- a/drivers/net/wireless/bcmdhd4361/wldev_common.h
+++ b/drivers/net/wireless/bcmdhd4361/wldev_common.h
@@ -24,7 +24,7 @@
  *
  * <<Broadcom-WL-IPTag/Open:>>
  *
- * $Id: wldev_common.h 776904 2018-08-16 05:57:39Z $
+ * $Id: wldev_common.h 812480 2019-04-01 07:43:53Z $
  */
 #ifndef __WLDEV_COMMON_H__
 #define __WLDEV_COMMON_H__
@@ -111,6 +111,7 @@ extern int net_os_set_suspend_disable(struct net_device *dev, int val);
 extern int net_os_set_suspend(struct net_device *dev, int val, int force);
 extern int net_os_set_suspend_bcn_li_dtim(struct net_device *dev, int val);
 extern int net_os_set_max_dtim_enable(struct net_device *dev, int val);
+extern int net_os_set_disable_dtim_in_suspend(struct net_device *dev, int val);
 extern int wl_parse_ssid_list_tlv(char** list_str, wlc_ssid_ext_t* ssid,
 	int max, int *bytes_left);
 
diff --git a/drivers/staging/sti/abc/abc_common.c b/drivers/staging/sti/abc/abc_common.c
index 8a54e73f64a0..813a6e379454 100644
--- a/drivers/staging/sti/abc/abc_common.c
+++ b/drivers/staging/sti/abc/abc_common.c
@@ -219,6 +219,8 @@ static ssize_t store_abc_log(struct device *dev,
 	struct abc_info *pinfo = dev_get_drvdata(sec_abc);
 	struct abc_log_entry *abc_log;
 
+	mutex_lock(&pinfo->log_mutex);
+
 	pinfo->log_list_cnt = 0;
 
 	while (!list_empty(&pinfo->log_list)) {
@@ -227,6 +229,8 @@ static ssize_t store_abc_log(struct device *dev,
 		kfree(abc_log);
 	}
 
+	mutex_unlock(&pinfo->log_mutex);
+
 	return count;
 }
 
@@ -239,10 +243,14 @@ static ssize_t show_abc_log(struct device *dev,
 	struct abc_log_entry *abc_log;
 	int count = 0;
 
+	mutex_lock(&pinfo->log_mutex);
+
 	list_for_each_entry(abc_log, &pinfo->log_list, node) {
-		count += sprintf(buf + count, "%s\n", abc_log->abc_log_str);
+		count += snprintf(buf + count, PAGE_SIZE - count, "%s\n", abc_log->abc_log_str);
 	}
 
+	mutex_unlock(&pinfo->log_mutex);
+
 	return count;
 }
 static DEVICE_ATTR(log, 0644, show_abc_log, store_abc_log);
@@ -359,6 +367,8 @@ static void sec_abc_work_func(struct work_struct *work)
 #endif
 
 	/* Add abc log_list */
+	mutex_lock(&pinfo->log_mutex);
+
 	abc_log = kzalloc(sizeof(*abc_log), GFP_KERNEL);
 	if (abc_log) {
 		snprintf(abc_log->abc_log_str, ABC_LOG_STR_LEN, "[%5lu.%03d][%02d:%02d:%02d.%03lu]%s_%s",
@@ -377,6 +387,8 @@ static void sec_abc_work_func(struct work_struct *work)
 		ABC_PRINT("failed to allocate abc_log\n");
 	}
 
+	mutex_unlock(&pinfo->log_mutex);
+
 	if (abc_enabled == ABC_TYPE1_ENABLED) {
 		pgpu = pinfo->pdata->gpu_items;
 		paicl = pinfo->pdata->aicl_items;
@@ -577,6 +589,8 @@ static int sec_abc_probe(struct platform_device *pdev)
 
 	init_completion(&pinfo->enable_done);
 
+	mutex_init(&pinfo->log_mutex);
+
 	sec_abc = pinfo->dev;
 	pinfo->pdata = pdata;
 
diff --git a/include/linux/sti/abc_common.h b/include/linux/sti/abc_common.h
index e0fdde982e9e..ddb47ed1d8df 100644
--- a/include/linux/sti/abc_common.h
+++ b/include/linux/sti/abc_common.h
@@ -104,6 +104,7 @@ struct abc_info {
 	int log_list_cnt;
 	char abc_str[ABC_BUFFER_MAX];
 	struct abc_platform_data *pdata;
+	struct mutex log_mutex;
 };
 
 extern void sec_abc_send_event(char *str);
diff --git a/security/defex_lsm/file_list b/security/defex_lsm/file_list
index 554e597b2f58..4968e195cad9 100644
--- a/security/defex_lsm/file_list
+++ b/security/defex_lsm/file_list
@@ -1,349 +1,350 @@
-ad8ba192e8db2ecc66096961be9b5b357aa6914419cc606d23100ac4b44cd582  ./root/init
+5ab08537cf0e9fe55c44c422eb5cec22ec9500a4ddbc50fd3764132185d2edc2  ./root/init
+f9f0eb86ea6f35877da1a411dbf0275bd91eef022d8badf9f0e07e1574662ee5  ./system/bin/fsck.vfat
+078360b23c7284e328f46ac32f0bfc9119394d9c823f98ef055a9cca2919382a  ./system/bin/bsd
+7aaa4ede5935cb24ee67285f8948b7f099e30e03a9a2838521aee9c107214801  ./system/bin/app_process64
+e436edeb6770ba29b03adcb1e1a56d7c5c17f1ed6740755659b5651bb19a7eca  ./system/bin/samsungpowersoundplay
+9e8d9598a0c2d57bbe4d98b0ad3d6baeeab7c16b8fbf72b3b6636c3857d5dfbe  ./system/bin/bugreport
+6518fd161d41986619cb4c56cec65a30b36e944798fa2a354cf0622f3fdfd385  ./system/bin/atrace
+6a3ecf21f4614a0d9f615ebfceec57b46107b7d953c16fdc019c89bf50e87e3a  ./system/bin/media
+5d2f0f940e4512fe920df673a7b2c1ddf36ab5fcd87ff7dcf22dccffce01bff2  ./system/bin/bootchecker
 39529b065e7278f78f056de6936244f9fc0c155f450f16cfb865fec2596e708c  ./system/bin/screenrecord
-b1f47f37bc5d9f7655f5d3ca4798f437d582c2e8f11b8983a45c3f1249fe830e  ./system/bin/insthk
+6aa95202ca1b2a691737daffc979bfd81dd497f2493cb37dc0972faf6af3fae2  ./system/bin/wm
+7eb6f8812ea81b6b37bdc9ad4451d54e3fdb67f9ac97d70f8a971db3b25646f0  ./system/bin/fsck.f2fs
+34574fae55b1fb257dd9ee100e6d15805ffc7699bcb7c17e7f685f9e644e7646  ./system/bin/faced
+8319029afaf2e008d67d13e9145a6991ab64f27f90c7bedabc8d02f88c1aad8f  ./system/bin/ddexe
+1a704290dda86f5ec5a2057890d60ec33e550705bdd6d90382aa271c4cf45456  ./system/bin/awk
+2331bc252df4ac5f02518bdf5ed7abfffbab4c82ee190eb06cd7fb3e868ad0c4  ./system/bin/ikev2-client
+4a647bc9c3e061614565bbe359d4b8475e26bbe5bd9b7cc7e094f80078ae8ea1  ./system/bin/applypatch
 4da897b697987b4de052901be2425513964c2e8b4fd689bc2fbd667b272e3633  ./system/bin/ld.mc
+4147308f5aa017fd0f5e6cc5a598e4267db99c391ac6b557b719ca831957826c  ./system/bin/vdc
+35d4f2339b80b87eb0bf7bac80d78bb6b1a0ba0e9b4a360554ee8644a8dde329  ./system/bin/ping
+9318fb4f866c0ac5434916da0a10c09462be87d521829a4ae2d6f3fc5acbfc40  ./system/bin/mdf_fota
+7be280c40f74cb511a78de182a76e139e5829d0f85b0aab6a67baa30b6c9543d  ./system/bin/storkd
+1a61c1e5d9829f234cc916c2790942c004cfed9ec5bfd2aa826b6faf82dc03db  ./system/bin/dpm
+a0e36f5f9ecb152697fe814e5e091e4d41d36ff2540c2fc7a62e3da7b0f6397d  ./system/bin/dm_verity_tz_cmd_exynos
+ed8b5c33dc90a6e17a206f1df9d2984c8eddfc028c509d7bd733640f805368dd  ./system/bin/dsms
+c48e660b628b5e5147a1ffa3d8e5642ed5e04eb3ce6846647339f77d020688e9  ./system/bin/racoon
+2baf015b6fee2c9669e1ebfa414f08daaca6abd3398696cdea09b0fda8d823ee  ./system/bin/incident_helper
+7ac9931fab04bb68d137f99e166445059146345f1050a1570eabff32949e13e9  ./system/bin/telecom
+39dfdd4a43ad6fc436a4db97671c06e926d0ef6568424e994530764867569751  ./system/bin/traced
+58e0620f6755eb29905c9b0b4bb5a68b2e9aee73e33e2dd4b640d15da31927e9  ./system/bin/fsck.exfat
+e8739f888079e0b8797c9a6967624061cfca0db57881f3696e1a16570fb063e2  ./system/bin/bugreportz
+3133e1e36ff66391887480d9ddff4f7eef37349dbab3c3f6736498c535904c4f  ./system/bin/secure_storage_pm
+6d33c5c7f84e7d3ab5af5a217fc2b86193e168bf7d4a322b6ca659a2efa24560  ./system/bin/dalvikvm64
+6d62f019755642c8dc9c34ed18fc0df143ea0475155e147b8c740fa1ea0b1998  ./system/bin/debuggerd
+c5d345498b63220a4b4d79066d1195cfaf9f9ab994c0356620f7202a3866cfe8  ./system/bin/appwidget
+26f4d84f31c974a7ee12d7cffd76b1269d66f8da90596cd33da62ffe042fed4a  ./system/bin/crash_dump32
+cbfaa371cad1c8829c409869fcdf97c8b8bd17aa2bbb348826c3f75b1e68bee8  ./system/bin/at_distributor
+d36ddb2aa83f94759a9baa0241b5a8790bdd225ad9a9dbb339d61ad56cccca9d  ./system/bin/tombstoned
+e496b3279a2c0b50e8f6ccecdbf8d83f6484342a263a13695c1adfa5e74a9913  ./system/bin/mediametrics
+9010ee25d82748bbdb48fa98763e14e6674b1be7099882b5fab327b02a3b53a2  ./system/bin/linker64
+a1986b5318b627581092ac9933a8d3c082ccc7d544a3cad3a44821d36dfee1be  ./system/bin/surfaceflinger
+6db43545f02b197d0e030b1d276d3ec763fa44e7d9c053b4468d0822cb2c048f  ./system/bin/blank_screen
+4d333940375771099253f7c8dd465b074cc3c82b5bd1ac0de73818115b7bfe9b  ./system/bin/hid
+d190e1d1d43a9657efcecffc77eec1c9e9b3e92809a0a174c9f25d8655bcc6c4  ./system/bin/dumpstate
+469d5fd600a9c226466929aedd595f8802e6dfd9890e324593430422f6224816  ./system/bin/redsocks
+13e40f00f037bc2cf3a9dfba35ab0c369e6b55ab60204683093f6618c9c01b1c  ./system/bin/ping6
 524163c841d29842ee1e29051c74df8ae6b02023d083aa187e659558e0bae6d3  ./system/bin/ip6tables
-5738945166978ecd57a4eea2a9660a3cb97c4acd816749d379b5eb1a662ec4ac  ./system/bin/statsd
-e609bb56b4cc978eb88175e67207d456e649bfa700abc636f97a720e7913009b  ./system/bin/tune2fs
-d8c0b19be46c87598e0c3291e97472012c23faadf013ec0afd769d429d1f7f2d  ./system/bin/incidentd
-79b129b1e57cd24f356230d41134afe302cff21469e4f25141a3a13dc29369a5  ./system/bin/ccm_gen_cert
-2140b2d414d5cc74b1f3ac54d811ee6ebfc5b635737866ed0722ffc52419f8a6  ./system/bin/sload_f2fs
-e75a66e52ab152a2b178cfd1088b1cbcf04ab2b623e5f00ffa01cb71cbdbfcf7  ./system/bin/toybox
-0b2bb8a1f45aead8dc5f3529b2cff1ac381daddf26355a31eb3feafc3cbb00af  ./system/bin/bootanimation
-5f8f4945fe542907d125832756072fd3e6293c35da73994136ede820419c0940  ./system/bin/blank_screen
-62cb633397d20e16924400d46930497cb4ca076aa31f75c0dd3bc7761a224e7b  ./system/bin/lpm
+13ca1aca38dd3f73ed693e7b9d5a6db6dea42974d7f221c5e2556e83a4b30f9d  ./system/bin/mke2fs
+c92aab352456caaa6f422903f7b922190937cad7791fd1009597d3c5c2597fdf  ./system/bin/traced_probes
+a09864d0c62a4bbf2dd2f731fbf80672880729807881503056f6173d3a2bec98  ./system/bin/run-as
+635b3195aa550e5a0f78360e42f3b257e25dad86a71ef54c336665a8bd6da574  ./system/bin/mkfs.vfat
 1db5dd2e6b805970474c3e58b170aacfa137b9575b233f0d7d3fc69ff9583c97  ./system/bin/am
-2f76b22b65396e545384e3f03bb994251621fc53743cfdb57f9a3b5e27197217  ./system/bin/freecessmonitor
-d8c83c5476b5e9a6bf77b470dd4547faf826904556dddf930b4ff400cfe319eb  ./system/bin/netutils-wrapper-1.0
-fd672e946b5bb678b364bb8ea1c9de811013749c04c03c797014eec70b37ffe5  ./system/bin/idledefrag
-cbfaa371cad1c8829c409869fcdf97c8b8bd17aa2bbb348826c3f75b1e68bee8  ./system/bin/at_distributor
-5dfc07f20a5b819fc0ceb6692cf6bc1d123ae6679e6fa7d128a6794697e24501  ./system/bin/patchoat
-6571ffd1fb0bb0d8174af014e8eff55a25bdf9420d493a8697545c4c4ae56a21  ./system/bin/vr
-19a2cbb36d90c19da9bc680d7fc87480fe2ccb442673e067b40b418a2d1b995f  ./system/bin/sh
-1814756c49b0a8529ef5113e70a8a3d3cbc8467fcd03767a0a431f6e6d797280  ./system/bin/surfaceflinger
-2f53ff45fe5d074496afa31473856bcfd2cff39fe6c1805ab666120e1612b9f5  ./system/bin/dex2oat
-9e8d9598a0c2d57bbe4d98b0ad3d6baeeab7c16b8fbf72b3b6636c3857d5dfbe  ./system/bin/bugreport
-e6c0941a5994d4ab2ad4cd111e1f0c5072e81ce431029ccf33e7eb71063d7b5d  ./system/bin/bootstat
-9aa115de669a5441bfcc806f68cd09e887a18fe101d4f4e8388c22655f829438  ./system/bin/lshal
-f6e0ba7527d218fdfb74d23ae123780d29c3956ad569dc69bc02a79f9c011429  ./system/bin/pppd
+998cecfb5e9c7ace015ab21c7b5231b786b614aeb4e2c7c570d271e1942979d0  ./system/bin/cmd
 841ecb72877cafb5cafa136872c3d44a20ed7099ba0714c9eb75dd92bfb0b140  ./system/bin/logcat
+5c447700471b694854e201453d8a588505e9a0913ca9583429dc6c9bfcef4dde  ./system/bin/settings
+dd81ddbb37599f6bc27655d62f292c3b0ad950ee38b34330320d6cb8883be647  ./system/bin/wlandutservice
+735ce4130149059a4a38328f2771040e92d7b08b719a16359675c3d14974e2ea  ./system/bin/input
+5dfc07f20a5b819fc0ceb6692cf6bc1d123ae6679e6fa7d128a6794697e24501  ./system/bin/patchoat
+40f61ce0f51e3b2d843b612651f48cb706331e6efbaee669ad904cfd4760a59a  ./system/bin/service
+9102ca0ce2d28ce47ff8d141a0a1b58ea08626af3a6b84c0b89b89947513a764  ./system/bin/wificond
+9e81ca6d2fde1880a3a97c65d5361dfe81e93f8e5430911921c05830024951c1  ./system/bin/dexdiag
+db21b5fdff05805f51cbbf62888b2ec0bc2dbff448082ac1077b3504e3b64494  ./system/bin/bcc
+fc0b887b54fca6c9d093fe31cbc912ceffb400af5671a494361adbefec4349e2  ./system/bin/linker
+dd72d37dbc93761224e07a92be8a6075eb82f74dfe534714cd8652d467d23203  ./system/bin/remotedisplay
 c0105d45ccc2c518de7acc293ff5f9627889aecdb8c98c5488e74ea8c751dd79  ./system/bin/charon
-a09864d0c62a4bbf2dd2f731fbf80672880729807881503056f6173d3a2bec98  ./system/bin/run-as
-e496b3279a2c0b50e8f6ccecdbf8d83f6484342a263a13695c1adfa5e74a9913  ./system/bin/mediametrics
-8319029afaf2e008d67d13e9145a6991ab64f27f90c7bedabc8d02f88c1aad8f  ./system/bin/ddexe
-26f4d84f31c974a7ee12d7cffd76b1269d66f8da90596cd33da62ffe042fed4a  ./system/bin/crash_dump32
+8485b4e08abd3e2812877cc3746506e3a70a9c0afa5e4f537e5b49b134e2a221  ./system/bin/edmaudit
+41bc09db578b0f70735637f10605e502c61054a49177bf42e922851822e860af  ./system/bin/mediaextractor
 ee6bd158a817f3907632d438152a39be1e03e588fa7668499906e1200239b4f7  ./system/bin/fsdbg
-846d448cb27abb9c50cd9fd522d0cd4d846eff306a1a310747a2b280b5311cea  ./system/bin/profman
+2140b2d414d5cc74b1f3ac54d811ee6ebfc5b635737866ed0722ffc52419f8a6  ./system/bin/sload_f2fs
+6571ffd1fb0bb0d8174af014e8eff55a25bdf9420d493a8697545c4c4ae56a21  ./system/bin/vr
 84c1b97dbffa5d6c52f35400e7f57d10f3630d2d0f52ac2d4fc02819f1aabe37  ./system/bin/installd
-a0c6a0d113a973c47bfd69b5aebdc9fe932de179411ad0d76f813bc197a1afd2  ./system/bin/lmkd
-2c7eb0fa3da455b89428bbf90f6c67a17b6b38677d1b60c192b13ff93848882a  ./system/bin/appops
-252f20db263b1dbe67143549d3a1eddcf41379540a510b5ac2c1e61424ccb270  ./system/bin/uncrypt
-c411a2a4ad99af9f73385505357d9e4be222e666b64dea14e873b309130a4de5  ./system/bin/cameraserver
-bba5c868c89c14d6e7d2233ab38af8ca207c4ab2a1525df3cb2f7fbeedd57dc7  ./system/bin/atrace
-40f61ce0f51e3b2d843b612651f48cb706331e6efbaee669ad904cfd4760a59a  ./system/bin/service
-e667417f0aafad8209b0e0e4242eb0be8ec7af2ed4c88468d360a489f1c9aef3  ./system/bin/apexserver
-46b05967807b7c341fc0cccef5b86d66a88f39790dea12fdc866802ab3bf5821  ./system/bin/ss_conn_daemon
-df7da16d1d2a37ef4fcbb481c49e0f8daff645a930b07841483c27c3b3cee9ff  ./system/bin/oatdump
-7308619107fb493233291a5117df5cddbe776ded11d2c58afeb1aa5f68984894  ./system/bin/app_process32
-dd72d37dbc93761224e07a92be8a6075eb82f74dfe534714cd8652d467d23203  ./system/bin/remotedisplay
+49b158cf363155b33f133ebc7a953cb563704fb3e9ab377156b29a7e0b335d9e  ./system/bin/requestsync
+8312ae40085b99c656e2aa1dcbb22ee69e72e7ed4f25bf79a7a1c0f817f5fad4  ./system/bin/tzdatacheck
+d34066a213dc1ff00ae30dee95da9874e4a81de71445ea2f12eb8d06f3ee1ce7  ./system/bin/tlc_server
+90e04476b07d535f332ac2ca89f46ac42560578328b5444aa24202afc7ca5c99  ./system/bin/smdexe
+a262bedd9699c5abb616d05a309c766a4ddaefc4720bf260437379ebaf377add  ./system/bin/reboot
+7174dfdade656ea0cd60b13181ffe09022bac6f4e838b089afde557333c6d969  ./system/bin/move_widevine_data.sh
+79b129b1e57cd24f356230d41134afe302cff21469e4f25141a3a13dc29369a5  ./system/bin/ccm_gen_cert
+0b2bb8a1f45aead8dc5f3529b2cff1ac381daddf26355a31eb3feafc3cbb00af  ./system/bin/bootanimation
+2e0581b53edd96e737fc86cfe11f92e9f950adfe6ed303ea3361f0b5cea22e53  ./system/bin/dumpsys
+1311936a87515dd79fd8a80b7d4c1b200d95471f43d83d6687c4eb2d94af3c53  ./system/bin/clatd
+e17c99176326e4ca332f50e53abb5f6e68b802543ba10416eb460940e35b7977  ./system/bin/locksettings
+38d8e9c1b0e61752ebfda327dfba40588a3bad422ecb08702953ab9a9cf703a7  ./system/bin/logwrapper
+c220078e68c7505d3c7696222c4c65e4fbc13064d67c685242785873d1677a7a  ./system/bin/bzip2
+e609bb56b4cc978eb88175e67207d456e649bfa700abc636f97a720e7913009b  ./system/bin/tune2fs
+5642f05d9009312287b4b98dbe376be743d779c195ee6aaa607abe9d0741bf95  ./system/bin/auditd
+9ea181c0450aafcc7acc3a9153e3783c4fc4b8f3d29c68df5f586e89a7e71208  ./system/bin/mediaserver
+8747322bccf1a826bad00e4f2d57acc24e7eee536c0fcbe23d371b46ac137a08  ./system/bin/bmgr
+f0c34cfca62c3f8dde9068c69ad1e02406370e51e4039e80736a9196dbb95bd0  ./system/bin/scs
+67dc2dfb770751701a5361008c2b969da42b62e691d14e6816e415bc9281abd9  ./system/bin/logd
+d62c969421aded9aea9d5219a4d9500463d0a6254ef933fc50aa156583ace104  ./system/bin/resize2fs
 a9c18385418406cf8cf3718704b0007d2475f7a853713603e4e6973c2b8c2a3d  ./system/bin/make_f2fs
-fc0b887b54fca6c9d093fe31cbc912ceffb400af5671a494361adbefec4349e2  ./system/bin/linker
-078360b23c7284e328f46ac32f0bfc9119394d9c823f98ef055a9cca2919382a  ./system/bin/bsd
-d1e60272d201994b190192ab18464bf779893b024f7841e32f06daa9f3ea4070  ./system/bin/e2fsck
-5c447700471b694854e201453d8a588505e9a0913ca9583429dc6c9bfcef4dde  ./system/bin/settings
-e50b9a6a2dffadc2833449b141a7248c71aeb0737ef330d0d35626743ed3cac9  ./system/bin/srm.bin
-d127b368d29b21d530337e99215510d6e3f1c8c9d9ba4d7fdd1dd8a99c832aa0  ./system/bin/resetreason
-c5d345498b63220a4b4d79066d1195cfaf9f9ab994c0356620f7202a3866cfe8  ./system/bin/appwidget
-7be280c40f74cb511a78de182a76e139e5829d0f85b0aab6a67baa30b6c9543d  ./system/bin/storkd
-435b62950ae0f5cdd5e6b8e35bb898fdd4bb2ad6f8a1d0060672c35db85957df  ./system/bin/multiclientd
-f84adc0396732ad372b03b329cfeeddf51dc9ba68ee2fe0b5bee2eba4ef6ceb8  ./system/bin/tc
-a0e36f5f9ecb152697fe814e5e091e4d41d36ff2540c2fc7a62e3da7b0f6397d  ./system/bin/dm_verity_tz_cmd_exynos
-1a704290dda86f5ec5a2057890d60ec33e550705bdd6d90382aa271c4cf45456  ./system/bin/awk
-12d399740e7ea9f1594f3be80e51370282c5f42fa47c904b9bfdf2c46bd266fe  ./system/bin/imsd
-90ff6b324af17803804c81be3bf9b1fb058bec521e4c20fef3581be8b5daef37  ./system/bin/wait_for_keymaster
-2baf015b6fee2c9669e1ebfa414f08daaca6abd3398696cdea09b0fda8d823ee  ./system/bin/incident_helper
+7cf94cdaa5e7f8762e5ea96d3656bddeef3a2099e37962fca908f90c86be2211  ./system/bin/incident
+6d2a3126eccb5d6c89e920863aee91ed43886f08fbc59b0e501ee7829b335cd6  ./system/bin/screencap
+148e85cce90f23acde88d8e7adefb727578a39c7e0d53460891c47947538df24  ./system/bin/toolbox
 4e9917e8b816ee794ab307a528c59b8707180ee3112453337c05c5bc5520f404  ./system/bin/mdnsd
-65ef94255890560059651737ca1fe88b5f5e45ce35c83de3275c715967d2fd08  ./system/bin/audioserver
-74053ee14430f59da257a8b4082fb452cf8a1b91a094e7670f94bf28f96d4f97  ./system/bin/vdc
-718371bfbc1f12579f51bba15371c2fd0719df35a31c77652dad82fbc811c75d  ./system/bin/adbd
-ed8b5c33dc90a6e17a206f1df9d2984c8eddfc028c509d7bd733640f805368dd  ./system/bin/dsms
+1ba2f003f49b4e2acc98daa617badfe37b1e7844c43861aa213cfeb9377c6d03  ./system/bin/eris
+b4f0cccfa68ee05bb30b1fa681a9c7a16c1078798c51206ba2f449fbba6ab07c  ./system/bin/statsd
+9a8605dbdd8e6219cea4ee412b46e91a1191e6e950ea4c06664993236dc8c46a  ./system/bin/storaged
+fac0be1069023ce302bf33fdf23ea8b55f0695cecc60d4bd3ca9885a6aa7dbf7  ./system/bin/lpm
+c38aee25d16c76acfc7ea466753ca68322c98842be7c4a667d1fd43ca00f5e54  ./system/bin/iptables
+5ea8ff67e680812f14e244246857a066c879316c4cf7782ef9ccc83a3eff692c  ./system/bin/multiclientd
+b1f47f37bc5d9f7655f5d3ca4798f437d582c2e8f11b8983a45c3f1249fe830e  ./system/bin/insthk
+d9923b6b841e438ff62de5429e4d04c6e76fdac3b7546284ff02961982aa631b  ./system/bin/dnsmasq
+ba6257dd83b8f0bc8977f26013e7a2d2a7922e10b405b6e7924f4c75958b2b49  ./system/bin/dalvikvm32
+d127b368d29b21d530337e99215510d6e3f1c8c9d9ba4d7fdd1dd8a99c832aa0  ./system/bin/resetreason
+7068c7044da661ef800a4608d1510e2a9d889e2b42317e695c9a71c77b5be539  ./system/bin/netd
+9aa115de669a5441bfcc806f68cd09e887a18fe101d4f4e8388c22655f829438  ./system/bin/lshal
+cd2b09b3d5b6978d9cda77cdb053c294a0014ea297dc9ebecfbd10f10e1af364  ./system/bin/servicemanager
+737bf28c6337e34551ae26252d23802dbb453d1ec805867f47c0101003d18fea  ./system/bin/mtpd
+b273c0507e86b0328578481462a501c5e3458ab4d34a423b006476139ed38407  ./system/bin/pm
+68642e08b7acab255cc192e30c1302ca3d0c0431f2e0227655c10f8915de04eb  ./system/bin/mediadrmserver
+c4986826c4a9fcca8776a181e3bc61a7a9f3f8afa2baf18a63818b9ef091b0a1  ./system/bin/lmkd
+d8c83c5476b5e9a6bf77b470dd4547faf826904556dddf930b4ff400cfe319eb  ./system/bin/netutils-wrapper-1.0
+81d7b4f153e17816a4be319f1b8eb6e6a78e40a0c4bb54737f3db7b7e30cd106  ./system/bin/thermalserviced
+e667417f0aafad8209b0e0e4242eb0be8ec7af2ed4c88468d360a489f1c9aef3  ./system/bin/apexserver
+f6e0ba7527d218fdfb74d23ae123780d29c3956ad569dc69bc02a79f9c011429  ./system/bin/pppd
+4c79c02e6b0d13c47c16353fc0f26725a49ea818418670403805bac96b437876  ./system/bin/iod
+add0353ad9b85f4d90a7c19c4ef11cd5ac0bbff3139bb530ced45a5cf32ae69d  ./system/bin/wait_for_keymaster
+05f6b98ff3a0c5d81b2ae412ff5ac76d5e5bc7f25f3e63e4c43e88f4b2643a3c  ./system/bin/blkid
+e415515df52a4ef15e876d3ba378c24f9f6e473b019f8501ac37633b92ad0231  ./system/bin/vold_prepare_subdirs
+a7b5331386613aa4f2741633cd5edf6db902a9d0f66c34a5d19eca308e19d99c  ./system/bin/prepare_param.sh
+7a95bb39384040bc4a61aacf537bc285293195f150c2fe0c319233f6d2f19757  ./system/bin/bu
+64d38e8f13f5718528d90a7ea50b2ec6cd0e0ca29c60c88a32d3f337e8833138  ./system/bin/crash_dump64
+6bc9765f317d0f30c1903e310cc4cf9b24fbba197f9f5b430c78f01b08179e3e  ./system/bin/keystore_cli_v2
 85504ed8aaff00986e6342d4b4d4d7a21c05cde98c409b2863f5436d5b64bd3f  ./system/bin/bpfloader
-643e1a066df19d86d7539435fa81c27cb90892c1f9fef5e5b50f089554f7191c  ./system/bin/e2fsdroid
 936cf8f33eb63b43ce84f36653919b3bb2087ac6c46e4a86e7c0b439c5714e89  ./system/bin/freecessmod
-c38346a5e7abc7af059dda75baa9bf641ebcd6546c79cf055d5a803f4655ffc7  ./system/bin/diagexe
+588f4e89975e626c1ae185c350389e4fad005b2cb9525834a42dfa7dfd548545  ./system/bin/uiautomator
+c09e3b1981bb5e49999fc1ffa15b678329bf8c43525eaf69b52380d5ef5c81a2  ./system/bin/e2fsck
+729b3fe95cabf324ffea751d43a351017e656ee38ba89824894fa327620475c1  ./system/bin/usbd
+4bb2584cbdde05809405024caae5b146dca4c2d1099b0bff1a8eb83eeaac4ac4  ./system/bin/secilc
+2b0da39f3c8b61047abba6170c92895ce0053a6d4a960259d799acdbe655ada8  ./system/bin/sem_daemon
+f5dd547155686ce3c85664a3942f681fe3bd279d1caea6c8dba2e59c34c170af  ./system/bin/e4defrag
+7308619107fb493233291a5117df5cddbe776ded11d2c58afeb1aa5f68984894  ./system/bin/app_process32
+9101c06b4bbd79e638841f407d8be934d8842e15b6fa59a1da426a6be88d5378  ./system/bin/drmserver
+4a1e287caabce6a774978a9b6c1a1e902b0b7dc409975889b6c4e956160605d2  ./system/bin/adbd
 7282585164a320016785ffd01bb27fc53dc9893b00d8a5b7c3bacdbda3e21bd5  ./system/bin/ndc
-549346bff303d1baa1d46c12bf9e40fee593a1ba47afa88e4f6c98c619f94d10  ./system/bin/vold
-7a95bb39384040bc4a61aacf537bc285293195f150c2fe0c319233f6d2f19757  ./system/bin/bu
+fd672e946b5bb678b364bb8ea1c9de811013749c04c03c797014eec70b37ffe5  ./system/bin/idledefrag
 1cde380f3deaf3a8a075c96f8342a444ba96d12a6ea5773c882c31fe3a68b310  ./system/bin/monkey
-b4c9111f9bec34659d34fbe1a28bc276bd2f701764873d3a67033ff5b3281655  ./system/bin/connfwexe
+7a83ff74f265d17d450156d52959eccc1b5707c68e9ab0856c87ac2310e4b7e5  ./system/bin/bootstat
+926a1b11b366d185a5816b79dd5e37f01eb43a078053a51b9facc47c53b09d88  ./system/bin/imsd
+252f20db263b1dbe67143549d3a1eddcf41379540a510b5ac2c1e61424ccb270  ./system/bin/uncrypt
+e517017ceb88e2e9b473dcd7aeca60ab141c112217f31bc7e9353f5852f0dcae  ./system/bin/svc
+7d0a0d2d290556d444d045caae0c2a23e96954e3b3b7d7c022113b353cf28c00  ./system/bin/irisd
+2d5d7d17c060938bfdb4b56c214d1c76aed66c94585496275300c5bd88f3bc78  ./system/bin/vold
+c411a2a4ad99af9f73385505357d9e4be222e666b64dea14e873b309130a4de5  ./system/bin/cameraserver
+e1e86a2207d0ae8071c66b200813ea2cd98ab59663ceb47cab04f42f5348a5fb  ./system/bin/schedtest
 32b69cf7f5da2ccc6a7c1f30fe038f08b7f2bb152b8a657eaec8f2f8dfe55339  ./system/bin/dexdump
-c7d44238836ac830ecd22ce3785a8640366a340bc9ae21d22faace7693a6e4d6  ./system/bin/keystore
-cae2953866ba79675d44d8be966b9efd36ed259144e10d65ad806bb741ab9576  ./system/bin/hw/android.hidl.allocator@1.0-service
-7cf94cdaa5e7f8762e5ea96d3656bddeef3a2099e37962fca908f90c86be2211  ./system/bin/incident
-58e0620f6755eb29905c9b0b4bb5a68b2e9aee73e33e2dd4b640d15da31927e9  ./system/bin/fsck.exfat
-f94b938432690dcdab7c2c3d7980ad9c53d8b36b2964e2e81d9ebe704f401ef7  ./system/bin/mediadrmserver
-635b3195aa550e5a0f78360e42f3b257e25dad86a71ef54c336665a8bd6da574  ./system/bin/mkfs.vfat
-469d5fd600a9c226466929aedd595f8802e6dfd9890e324593430422f6224816  ./system/bin/redsocks
-6d2a3126eccb5d6c89e920863aee91ed43886f08fbc59b0e501ee7829b335cd6  ./system/bin/screencap
-1311936a87515dd79fd8a80b7d4c1b200d95471f43d83d6687c4eb2d94af3c53  ./system/bin/clatd
-49ada3d3a7e0eb91ec50abc2b96b62019eb49dd20c9bf4e511275206b87dc34b  ./system/bin/secure_storage_daemon
-9101c06b4bbd79e638841f407d8be934d8842e15b6fa59a1da426a6be88d5378  ./system/bin/drmserver
-998cecfb5e9c7ace015ab21c7b5231b786b614aeb4e2c7c570d271e1942979d0  ./system/bin/cmd
-9badc29e80f001d85c329f511eb6109ee93a921316d3d33f660529dc3ebaed31  ./system/bin/secdiscard
-2e0581b53edd96e737fc86cfe11f92e9f950adfe6ed303ea3361f0b5cea22e53  ./system/bin/dumpsys
-d34066a213dc1ff00ae30dee95da9874e4a81de71445ea2f12eb8d06f3ee1ce7  ./system/bin/tlc_server
-471b1bc524cc51e4368d90fd970850c0175377e7afbf2683abd3850f9000bef2  ./system/bin/app_process64
-c92aab352456caaa6f422903f7b922190937cad7791fd1009597d3c5c2597fdf  ./system/bin/traced_probes
-9ea181c0450aafcc7acc3a9153e3783c4fc4b8f3d29c68df5f586e89a7e71208  ./system/bin/mediaserver
-6a3ecf21f4614a0d9f615ebfceec57b46107b7d953c16fdc019c89bf50e87e3a  ./system/bin/media
+d8c0b19be46c87598e0c3291e97472012c23faadf013ec0afd769d429d1f7f2d  ./system/bin/incidentd
+b4c9111f9bec34659d34fbe1a28bc276bd2f701764873d3a67033ff5b3281655  ./system/bin/connfwexe
 38f26832ed3564399424a7e2b28e319dad9a7ad3dadc91494c312beee69162fe  ./system/bin/dexlist
-aee5affa71b505d59ae5206f3674e5ccadcd332b04b5158a96504494958abc9c  ./system/bin/sem_daemon
-735ce4130149059a4a38328f2771040e92d7b08b719a16359675c3d14974e2ea  ./system/bin/input
-dafd522c3300b7ed552e6cbcfcfe757d6fb18ac138a8bfaeb61bdb7c9db2657e  ./system/bin/content
-3886ded4d0fbdb059fcab1c84920b54ee45bc9df5b4fcff3aeaa11838b13000a  ./system/bin/hwservicemanager
-2331bc252df4ac5f02518bdf5ed7abfffbab4c82ee190eb06cd7fb3e868ad0c4  ./system/bin/ikev2-client
-e1e86a2207d0ae8071c66b200813ea2cd98ab59663ceb47cab04f42f5348a5fb  ./system/bin/schedtest
-6d62f019755642c8dc9c34ed18fc0df143ea0475155e147b8c740fa1ea0b1998  ./system/bin/debuggerd
-4bb2584cbdde05809405024caae5b146dca4c2d1099b0bff1a8eb83eeaac4ac4  ./system/bin/secilc
-35d4f2339b80b87eb0bf7bac80d78bb6b1a0ba0e9b4a360554ee8644a8dde329  ./system/bin/ping
-a7b5331386613aa4f2741633cd5edf6db902a9d0f66c34a5d19eca308e19d99c  ./system/bin/prepare_param.sh
-c38aee25d16c76acfc7ea466753ca68322c98842be7c4a667d1fd43ca00f5e54  ./system/bin/iptables
-5309b3fde799636c969637bdb5c91a158d8386aaad8f571bc80e28644d2323df  ./system/bin/ip
-467afc9f64758f976a7e8189b0e9627d7f39726ac494692ff86ccf2860b40af3  ./system/bin/netd
-cd2b09b3d5b6978d9cda77cdb053c294a0014ea297dc9ebecfbd10f10e1af364  ./system/bin/servicemanager
-b273c0507e86b0328578481462a501c5e3458ab4d34a423b006476139ed38407  ./system/bin/pm
-e415515df52a4ef15e876d3ba378c24f9f6e473b019f8501ac37633b92ad0231  ./system/bin/vold_prepare_subdirs
-3133e1e36ff66391887480d9ddff4f7eef37349dbab3c3f6736498c535904c4f  ./system/bin/secure_storage_pm
+933ec6dd4476af3a5a603808f35c7c379f8ace744bc79b1bf939021b7af29cbf  ./system/bin/gatekeeperd
+19a2cbb36d90c19da9bc680d7fc87480fe2ccb442673e067b40b418a2d1b995f  ./system/bin/sh
+2f53ff45fe5d074496afa31473856bcfd2cff39fe6c1805ab666120e1612b9f5  ./system/bin/dex2oat
+1d254ac628f5dd96ba0ca1aa6eb86416b9c0e4241ad4982a498f93aed1a2bf15  ./system/bin/dexoptanalyzer
+f999033ee9f37eeeb7e4ee4c7bed7572516ac0cb2920f823021ad0ba8d7e5732  ./system/bin/hw/android.hidl.allocator@1.0-service
+e8b4b954cdc569fe2957fb0747ac10a6e2678849259d1249f485b8bcdfbdb615  ./system/bin/sdp_cryptod
+2c7eb0fa3da455b89428bbf90f6c67a17b6b38677d1b60c192b13ff93848882a  ./system/bin/appops
+4a36fba4e224bd4e8071f9959cb25224cf209f8bbc66c5caea760c71fbe400f1  ./system/bin/hwservicemanager
+d0959c12d988f12b92b075a2222a0df1b66e1764f64ce75ef3d4bd9eacb282b7  ./system/bin/ime
+e50b9a6a2dffadc2833449b141a7248c71aeb0737ef330d0d35626743ed3cac9  ./system/bin/srm.bin
 dc7cfa6ab7bf9b54d8bdf17a60c7e93d5ac09b290bfc6794b2fb352f93a1201f  ./system/bin/mlchecker
-3783b60e9afa4eaa917455aa808aee7eff472130a65fceabbf77d3afd1b5957e  ./system/bin/logd
-d62c969421aded9aea9d5219a4d9500463d0a6254ef933fc50aa156583ace104  ./system/bin/resize2fs
-6d33c5c7f84e7d3ab5af5a217fc2b86193e168bf7d4a322b6ca659a2efa24560  ./system/bin/dalvikvm64
-4a647bc9c3e061614565bbe359d4b8475e26bbe5bd9b7cc7e094f80078ae8ea1  ./system/bin/applypatch
-4c79c02e6b0d13c47c16353fc0f26725a49ea818418670403805bac96b437876  ./system/bin/iod
-13e40f00f037bc2cf3a9dfba35ab0c369e6b55ab60204683093f6618c9c01b1c  ./system/bin/ping6
-6aa95202ca1b2a691737daffc979bfd81dd497f2493cb37dc0972faf6af3fae2  ./system/bin/wm
-ecbc526cdd57a485f835cdbb030e67c956f6370432b53d35184fbb2af6e6565e  ./system/bin/sdp_cryptod
-9010ee25d82748bbdb48fa98763e14e6674b1be7099882b5fab327b02a3b53a2  ./system/bin/linker64
-ba6257dd83b8f0bc8977f26013e7a2d2a7922e10b405b6e7924f4c75958b2b49  ./system/bin/dalvikvm32
-7ac9931fab04bb68d137f99e166445059146345f1050a1570eabff32949e13e9  ./system/bin/telecom
-7234ae155c444dff269556f0826762010aba1a25281e46ba024ad1cfb8ec4041  ./system/bin/thermalserviced
-75ef30135564abb4089ffda82d374e812327ed54155bc46e3df1d2c8e23bb48b  ./system/bin/grep
-0a01c65738b5ad01c7faebbbe61dac29a607a3b49ec569e172daba03f6681959  ./system/bin/wificond
-db21b5fdff05805f51cbbf62888b2ec0bc2dbff448082ac1077b3504e3b64494  ./system/bin/bcc
-091819bab5d6a22e31e7d605a573032562ff3171100fdb8ad40378e627feeab6  ./system/bin/gatekeeperd
-e517017ceb88e2e9b473dcd7aeca60ab141c112217f31bc7e9353f5852f0dcae  ./system/bin/svc
-38d8e9c1b0e61752ebfda327dfba40588a3bad422ecb08702953ab9a9cf703a7  ./system/bin/logwrapper
-f9f0eb86ea6f35877da1a411dbf0275bd91eef022d8badf9f0e07e1574662ee5  ./system/bin/fsck.vfat
-41bc09db578b0f70735637f10605e502c61054a49177bf42e922851822e860af  ./system/bin/mediaextractor
-4d333940375771099253f7c8dd465b074cc3c82b5bd1ac0de73818115b7bfe9b  ./system/bin/hid
+93fdfb670956418473e203b6545d899b665c19227c6bdb1f98c7ff375a47eeba  ./system/bin/sensorservice
+2f76b22b65396e545384e3f03bb994251621fc53743cfdb57f9a3b5e27197217  ./system/bin/freecessmonitor
 73ad500675e3668e8c49bd4be736e2af129b6b558e76ff952157bd68b0fb07fc  ./system/bin/idmap
-737bf28c6337e34551ae26252d23802dbb453d1ec805867f47c0101003d18fea  ./system/bin/mtpd
-e8739f888079e0b8797c9a6967624061cfca0db57881f3696e1a16570fb063e2  ./system/bin/bugreportz
+46b05967807b7c341fc0cccef5b86d66a88f39790dea12fdc866802ab3bf5821  ./system/bin/ss_conn_daemon
+f84adc0396732ad372b03b329cfeeddf51dc9ba68ee2fe0b5bee2eba4ef6ceb8  ./system/bin/tc
+49ada3d3a7e0eb91ec50abc2b96b62019eb49dd20c9bf4e511275206b87dc34b  ./system/bin/secure_storage_daemon
+c38346a5e7abc7af059dda75baa9bf641ebcd6546c79cf055d5a803f4655ffc7  ./system/bin/diagexe
+972ae0d1af6569e59167716ebd5cefb5648efff83c090b818800a5b8af53b1e9  ./system/bin/sdcard
+dafd522c3300b7ed552e6cbcfcfe757d6fb18ac138a8bfaeb61bdb7c9db2657e  ./system/bin/content
+5309b3fde799636c969637bdb5c91a158d8386aaad8f571bc80e28644d2323df  ./system/bin/ip
+d9089960353c271fe8af45ebe6c344723823e0591fddc0117fe6ebb8d8861dec  ./system/bin/audioserver
 32125a2541dc3345420feadf70b5df41c8483e74e75c650092458e0339b45a6e  ./system/bin/sgdisk
+7616516e407d297b057350bdf55534cabcaff58a36c30bca48dcf1609bbabad3  ./system/bin/sm
+a37bce47f0efc308f74080144de33952889a2cf1f762a0ac746ddc029a72a6db  ./system/bin/keystore
+846d448cb27abb9c50cd9fd522d0cd4d846eff306a1a310747a2b280b5311cea  ./system/bin/profman
+e75a66e52ab152a2b178cfd1088b1cbcf04ab2b623e5f00ffa01cb71cbdbfcf7  ./system/bin/toybox
+df7da16d1d2a37ef4fcbb481c49e0f8daff645a930b07841483c27c3b3cee9ff  ./system/bin/oatdump
+643e1a066df19d86d7539435fa81c27cb90892c1f9fef5e5b50f089554f7191c  ./system/bin/e2fsdroid
+9badc29e80f001d85c329f511eb6109ee93a921316d3d33f660529dc3ebaed31  ./system/bin/secdiscard
 d0c76f33c369f4dfa85f9f68ba86f350f56cda5a255e4d1473fe9c258b470a67  ./system/bin/perfetto
-cd22ada0ba23a0c52af1178b17b975a0ceb8756a96f70c1793e03faf26c88b97  ./system/bin/eris
-7d0a0d2d290556d444d045caae0c2a23e96954e3b3b7d7c022113b353cf28c00  ./system/bin/irisd
-c48e660b628b5e5147a1ffa3d8e5642ed5e04eb3ce6846647339f77d020688e9  ./system/bin/racoon
-588f4e89975e626c1ae185c350389e4fad005b2cb9525834a42dfa7dfd548545  ./system/bin/uiautomator
+75ef30135564abb4089ffda82d374e812327ed54155bc46e3df1d2c8e23bb48b  ./system/bin/grep
 3714b8c7e7441a9d644caf6ecfe5c760b1217b63f8532c5a5d48d096f4f72fa9  ./system/bin/mkfs.exfat
-90e04476b07d535f332ac2ca89f46ac42560578328b5444aa24202afc7ca5c99  ./system/bin/smdexe
-39dfdd4a43ad6fc436a4db97671c06e926d0ef6568424e994530764867569751  ./system/bin/traced
-f5dd547155686ce3c85664a3942f681fe3bd279d1caea6c8dba2e59c34c170af  ./system/bin/e4defrag
-1a61c1e5d9829f234cc916c2790942c004cfed9ec5bfd2aa826b6faf82dc03db  ./system/bin/dpm
-729b3fe95cabf324ffea751d43a351017e656ee38ba89824894fa327620475c1  ./system/bin/usbd
-d36ddb2aa83f94759a9baa0241b5a8790bdd225ad9a9dbb339d61ad56cccca9d  ./system/bin/tombstoned
-9e81ca6d2fde1880a3a97c65d5361dfe81e93f8e5430911921c05830024951c1  ./system/bin/dexdiag
-e17c99176326e4ca332f50e53abb5f6e68b802543ba10416eb460940e35b7977  ./system/bin/locksettings
-05f6b98ff3a0c5d81b2ae412ff5ac76d5e5bc7f25f3e63e4c43e88f4b2643a3c  ./system/bin/blkid
-c220078e68c7505d3c7696222c4c65e4fbc13064d67c685242785873d1677a7a  ./system/bin/bzip2
-661a3f143795271574144e5efb6b5df34e6dec87599f3e6b7d39c7472d1dafcf  ./system/bin/storaged
-1d254ac628f5dd96ba0ca1aa6eb86416b9c0e4241ad4982a498f93aed1a2bf15  ./system/bin/dexoptanalyzer
-dd81ddbb37599f6bc27655d62f292c3b0ad950ee38b34330320d6cb8883be647  ./system/bin/wlandutservice
-8485b4e08abd3e2812877cc3746506e3a70a9c0afa5e4f537e5b49b134e2a221  ./system/bin/edmaudit
-93fdfb670956418473e203b6545d899b665c19227c6bdb1f98c7ff375a47eeba  ./system/bin/sensorservice
-5d2f0f940e4512fe920df673a7b2c1ddf36ab5fcd87ff7dcf22dccffce01bff2  ./system/bin/bootchecker
-f0c34cfca62c3f8dde9068c69ad1e02406370e51e4039e80736a9196dbb95bd0  ./system/bin/scs
-49b158cf363155b33f133ebc7a953cb563704fb3e9ab377156b29a7e0b335d9e  ./system/bin/requestsync
-d9923b6b841e438ff62de5429e4d04c6e76fdac3b7546284ff02961982aa631b  ./system/bin/dnsmasq
-d6d70f63cab5a6f4328a6f6c5dc3e4857aefb9a333f1fae154b9a00ae96eed10  ./system/bin/dumpstate
-5642f05d9009312287b4b98dbe376be743d779c195ee6aaa607abe9d0741bf95  ./system/bin/auditd
-64d38e8f13f5718528d90a7ea50b2ec6cd0e0ca29c60c88a32d3f337e8833138  ./system/bin/crash_dump64
-a262bedd9699c5abb616d05a309c766a4ddaefc4720bf260437379ebaf377add  ./system/bin/reboot
-9318fb4f866c0ac5434916da0a10c09462be87d521829a4ae2d6f3fc5acbfc40  ./system/bin/mdf_fota
-7616516e407d297b057350bdf55534cabcaff58a36c30bca48dcf1609bbabad3  ./system/bin/sm
-148e85cce90f23acde88d8e7adefb727578a39c7e0d53460891c47947538df24  ./system/bin/toolbox
-d9d2e8939abd95bfd023272e93937cd314b19ae2c393b518a92db680f77457f6  ./system/bin/keystore_cli_v2
-8312ae40085b99c656e2aa1dcbb22ee69e72e7ed4f25bf79a7a1c0f817f5fad4  ./system/bin/tzdatacheck
-13ca1aca38dd3f73ed693e7b9d5a6db6dea42974d7f221c5e2556e83a4b30f9d  ./system/bin/mke2fs
-972ae0d1af6569e59167716ebd5cefb5648efff83c090b818800a5b8af53b1e9  ./system/bin/sdcard
-d0959c12d988f12b92b075a2222a0df1b66e1764f64ce75ef3d4bd9eacb282b7  ./system/bin/ime
-8747322bccf1a826bad00e4f2d57acc24e7eee536c0fcbe23d371b46ac137a08  ./system/bin/bmgr
-e436edeb6770ba29b03adcb1e1a56d7c5c17f1ed6740755659b5651bb19a7eca  ./system/bin/samsungpowersoundplay
-7eb6f8812ea81b6b37bdc9ad4451d54e3fdb67f9ac97d70f8a971db3b25646f0  ./system/bin/fsck.f2fs
-34574fae55b1fb257dd9ee100e6d15805ffc7699bcb7c17e7f685f9e644e7646  ./system/bin/faced
 aae9f3a39cdda7a791703d743f1b8f13fe0995b721c266c50543991510092ba4  ./system/xbin/cpustats
-5eaec5790dfef5015a40bba17489bc7bafc75149282b3585cb25fd6e85467c3b  ./root/sbin/knox_changer
 34bba842f95758bbc9702b83e61dbeadf3d7a9885ff1b7cba2baf0f8a81db4bc  ./root/sbin/sswap
 c258f4be15970da1e658fcf097e2c95fc46e80f6582bd033c87a65b131c3141b  ./root/sbin/dm_verity_signature_checker
-8beeb022beeb6cddf59750a08582e2068e27688b67ddec1e9b91d152105b17b3  ./root/sbin/charger
-8af15238f049b12f98625504d850b33d02a6ea3f7c96c30dadce51c1c874747c  ./recovery/root/vndservice_contexts
+5eaec5790dfef5015a40bba17489bc7bafc75149282b3585cb25fd6e85467c3b  ./root/sbin/knox_changer
+76b6f9f8f17dffde3ab06588d79178f17ab61704f6ec35ea8a0c0d929af35d01  ./root/sbin/charger
 4f49704f32b81282acb818356737c4a759aae3252b84f516e1768b873f093939  ./recovery/root/plat_property_contexts
-5593b7960b46a1157615b7fda90f35c53c1bb18d2413b5beceebd5dc6f26466d  ./recovery/root/res/keys
-47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00004.png
-001c41070cb3f96fd95e93dcef2ea1a6c7f241bd11a3653f87f0eecea2da6dd1  ./recovery/root/res/images/erasing_text.png
-2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00003.png
-0120840477638d72370e3e3988f648fe2eeaf592a32dc96535c797bbcdff1741  ./recovery/root/res/images/poc_change00007.png
-6e6a249f1c75baaa2138bbe9240f041276bda475936bdf0714a816193327506d  ./recovery/root/res/images/poc_change00012.png
-6db4380f569cc461d175872f1e55648a081df7147a895e7cff295e51d2be3d8d  ./recovery/root/res/images/simple00010.png
-28485d8ef79ca83e6f56b2c919b898251151cc1cebbde1f3ffc31d83ee52dc7e  ./recovery/root/res/images/change00009.png
-958efbe2c47e15cd1d8c8121cdb018cbce1f9e6b2c14f7ee618dcfd9d12d61e0  ./recovery/root/res/images/poc_change00000.png
-3dd9717af3c2b008db3b3b2a57d33890d72fbfac425249a8ac152ca30bd3d5b8  ./recovery/root/res/images/indicator_off.png
-a488ec9c04f7535cad1110e2c3650708a00309923139e99689f9724190706559  ./recovery/root/res/images/progress_simple_empty.png
-2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00000.png
-3fb2c94ff89874a6a452ab2f24cd3cab3696b44411113b42172bd04f36df3ac4  ./recovery/root/res/images/icon_simple_error.png
-b4dd8baa8a9339c3cfbc2ee79141f95c0222e5605011b0cc5c6a493351e0823c  ./recovery/root/res/images/poc_change00005.png
-745e2981d8042f984c5c6942fc29270a9b60fa98170c269f41d0bdbd5c67e623  ./recovery/root/res/images/progress_empty.png
-8d3b4c627de34ceb0a48039dfc9c54ec33822562e7e6e8a898cd0576c91ab979  ./recovery/root/res/images/installing_text.png
-2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00002.png
-4eae88e6d6a5443d162736a86481afddbb735617048f2b976f49df872a663e31  ./recovery/root/res/images/simple00001.png
-fd84b1c971c80f1eaf9d1cdf1320ea47df94485c2ea12dd9df26e974d8edb5f3  ./recovery/root/res/images/stage_fill.png
-30a89ef3b58a5561d324148e07263a6d780bd26b27c9f8905b77e6f5339a3dfc  ./recovery/root/res/images/indicator_on.png
+4c1fa145fad89570980d71b496731a018de302e6456e24376c219c44c536f0db  ./recovery/root/res/images/stage_empty.png
+47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00007.png
+b7ed040ebe8e4801fb258a4c4a99257c725c4e35689ec4da107f54887efc1ec1  ./recovery/root/res/images/simple00000.png
 23237ac83ce5483656226ad39e6cb3b5ccb5b852b8b6dac7c538a5df398cfa85  ./recovery/root/res/images/poc_change00008.png
-47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00005.png
-559b36f43e5552cd5d5767a78de437f63c635e86498b574f0c5a3ea095808ad1  ./recovery/root/res/images/simple00011.png
+47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00006.png
 dab327d8d4965eba64e0e7b257c32866187434f14f868ce588fb3d96c9f2e998  ./recovery/root/res/images/poc_change00006.png
-9c23a78638158ff34acdb29ff7e9b6005623c2d21ea42d41223d14bc1bb2c467  ./recovery/root/res/images/poc_change00002.png
-28485d8ef79ca83e6f56b2c919b898251151cc1cebbde1f3ffc31d83ee52dc7e  ./recovery/root/res/images/change00011.png
-fec501aab0b89adf0ca0751e619ac4a294c05e9633c9b50ea88c634b40640d7f  ./recovery/root/res/images/res_info
+4eae88e6d6a5443d162736a86481afddbb735617048f2b976f49df872a663e31  ./recovery/root/res/images/simple00001.png
 e60ab702201a8086eaf99b619386eed5b6ba8b4e350ed8b819b48b6977a6fd1a  ./recovery/root/res/images/simple00013.png
+28485d8ef79ca83e6f56b2c919b898251151cc1cebbde1f3ffc31d83ee52dc7e  ./recovery/root/res/images/change00011.png
 28485d8ef79ca83e6f56b2c919b898251151cc1cebbde1f3ffc31d83ee52dc7e  ./recovery/root/res/images/change00008.png
+2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00000.png
+f7f1c3efed3139a14649915806c86bdb20531c3a2d1c833d9d4366650d130d5e  ./recovery/root/res/images/poc_change00009.png
+3dd9717af3c2b008db3b3b2a57d33890d72fbfac425249a8ac152ca30bd3d5b8  ./recovery/root/res/images/indicator_off.png
+af11460f8463943befc9bed4eba90e45ae4b9af3ca26396dab53acb39f59bad3  ./recovery/root/res/images/icon_change_simcard.png
+28485d8ef79ca83e6f56b2c919b898251151cc1cebbde1f3ffc31d83ee52dc7e  ./recovery/root/res/images/change00010.png
+fd84b1c971c80f1eaf9d1cdf1320ea47df94485c2ea12dd9df26e974d8edb5f3  ./recovery/root/res/images/stage_fill.png
+6a910bbb77d0942e7ff8c9dee414db3da159bb0683cb031ee790b095254e1b35  ./recovery/root/res/images/simple00012.png
 4d3c890b6c0225a89925142e7f34882b8acbbeb08cb15c98a09abb75e2de2947  ./recovery/root/res/images/simple00008.png
-9d4df95e86676b949f7b2718d3abc40c8ff4adab9617f0d7e9d693e0ef010ea1  ./recovery/root/res/images/font_percentage.png
-9247e466a4bdff143188c253c92b2176c0836f5dd1b133134595bd56b2260c3a  ./recovery/root/res/images/simple00002.png
-4c1fa145fad89570980d71b496731a018de302e6456e24376c219c44c536f0db  ./recovery/root/res/images/stage_empty.png
+2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00003.png
+2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00002.png
+7a41a626f054f5974a5fbe6c93bbe2785bf4f50153d87d98700ea7c96a24748c  ./recovery/root/res/images/poc_change00004.png
+748123c5a8c6766333ae98e5a1e77eae9652fb9741b6601b20c49c03b7d0ddf5  ./recovery/root/res/images/installing_security_text.png
+b4dd8baa8a9339c3cfbc2ee79141f95c0222e5605011b0cc5c6a493351e0823c  ./recovery/root/res/images/poc_change00005.png
+9440c9f63c5cc03b90d8435b3e459a5dc499308b3120fd2aa7ec1735cd5a0be9  ./recovery/root/res/images/font.png
+dfed67ccbec7c1b3a12efbb185ee925d8cf8279920dd629484f415daf4099803  ./recovery/root/res/images/simple00014.png
 c183703265e5bf780969e37d5e3fc60c20215c42cbcf0f49b3f052cd0a8f0416  ./recovery/root/res/images/simple00009.png
+958efbe2c47e15cd1d8c8121cdb018cbce1f9e6b2c14f7ee618dcfd9d12d61e0  ./recovery/root/res/images/poc_change00000.png
+3fb2c94ff89874a6a452ab2f24cd3cab3696b44411113b42172bd04f36df3ac4  ./recovery/root/res/images/icon_simple_error.png
+9f7f72554190524f6da9bbed5dede9ab5ee45b1505e672dfe50eebb19f99d7ee  ./recovery/root/res/images/icon_simple_android.png
+30a89ef3b58a5561d324148e07263a6d780bd26b27c9f8905b77e6f5339a3dfc  ./recovery/root/res/images/indicator_on.png
+5f7a8592b9511040367a18a36045c06abfce8fd90e4603921be954bd10aadf30  ./recovery/root/res/images/poc_change00013.png
+6db4380f569cc461d175872f1e55648a081df7147a895e7cff295e51d2be3d8d  ./recovery/root/res/images/simple00010.png
+28485d8ef79ca83e6f56b2c919b898251151cc1cebbde1f3ffc31d83ee52dc7e  ./recovery/root/res/images/change00009.png
+7aca0e83ba846e7b6bb33ef82bc5374ef9a0536b198b5b3a3a38e89d562b165c  ./recovery/root/res/images/simple00007.png
+cfa94f8af03399c3ccd0522a3610eeba079fc64c99d724e9235d8bb030a337b3  ./recovery/root/res/images/simple00005.png
+fec501aab0b89adf0ca0751e619ac4a294c05e9633c9b50ea88c634b40640d7f  ./recovery/root/res/images/res_info
+a11150c8a73789e2d7fcef9489d28a75f588dd4c78b1984553e2e2a63996e836  ./recovery/root/res/images/poc_change00003.png
+9c23a78638158ff34acdb29ff7e9b6005623c2d21ea42d41223d14bc1bb2c467  ./recovery/root/res/images/poc_change00002.png
+47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00004.png
+c229c76130976a1df9a91057f855aab14620a9a1a39719ef32367b17218a5d82  ./recovery/root/res/images/simple00004.png
+8d3b4c627de34ceb0a48039dfc9c54ec33822562e7e6e8a898cd0576c91ab979  ./recovery/root/res/images/installing_text.png
 b4b0d7fbee5563e184f09a85b5c7faa9d28fd604ff2df43e7cb5f4db05802fc9  ./recovery/root/res/images/error_text.png
-4adf5a8a6871c9fc5af4424e902d78e94e3ac60b28f0bb0eb8ffd9074246badf  ./recovery/root/res/images/poc_change00014.png
-6a910bbb77d0942e7ff8c9dee414db3da159bb0683cb031ee790b095254e1b35  ./recovery/root/res/images/simple00012.png
+a488ec9c04f7535cad1110e2c3650708a00309923139e99689f9724190706559  ./recovery/root/res/images/progress_simple_empty.png
+2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00001.png
+47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00005.png
+6e6a249f1c75baaa2138bbe9240f041276bda475936bdf0714a816193327506d  ./recovery/root/res/images/poc_change00012.png
+980b3fa6936f88604ebd62f84663a8f2fe1430e0354906cc5e90f3db77080bea  ./recovery/root/res/images/progress_fill.png
+fb92d2fbcb1ea4ad3c601b067492647671c82f570c707d7a2c28703a52d722bf  ./recovery/root/res/images/no_command_text.png
+9247e466a4bdff143188c253c92b2176c0836f5dd1b133134595bd56b2260c3a  ./recovery/root/res/images/simple00002.png
 c279514056a68e6b31193562d3a19b5320589de6331ff0248e0065ea41def363  ./recovery/root/res/images/poc_change00011.png
+0120840477638d72370e3e3988f648fe2eeaf592a32dc96535c797bbcdff1741  ./recovery/root/res/images/poc_change00007.png
+4adf5a8a6871c9fc5af4424e902d78e94e3ac60b28f0bb0eb8ffd9074246badf  ./recovery/root/res/images/poc_change00014.png
 702f8c92f60bfc2c13ca55a74944f6ed4a1748df3b7b100879bd5c174dc74206  ./recovery/root/res/images/poc_change00010.png
-7aca0e83ba846e7b6bb33ef82bc5374ef9a0536b198b5b3a3a38e89d562b165c  ./recovery/root/res/images/simple00007.png
-dfed67ccbec7c1b3a12efbb185ee925d8cf8279920dd629484f415daf4099803  ./recovery/root/res/images/simple00014.png
-5f7a8592b9511040367a18a36045c06abfce8fd90e4603921be954bd10aadf30  ./recovery/root/res/images/poc_change00013.png
-7a41a626f054f5974a5fbe6c93bbe2785bf4f50153d87d98700ea7c96a24748c  ./recovery/root/res/images/poc_change00004.png
-f7f1c3efed3139a14649915806c86bdb20531c3a2d1c833d9d4366650d130d5e  ./recovery/root/res/images/poc_change00009.png
-9440c9f63c5cc03b90d8435b3e459a5dc499308b3120fd2aa7ec1735cd5a0be9  ./recovery/root/res/images/font.png
-47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00006.png
 36ad0f5f0fe17ca781a34397216c28ca6c17b5b4c8a53785ec795cc2565a494d  ./recovery/root/res/images/simple00006.png
-a11150c8a73789e2d7fcef9489d28a75f588dd4c78b1984553e2e2a63996e836  ./recovery/root/res/images/poc_change00003.png
 176416596ee4c4bb7c0fa0d78b295b968962332903a5a07d789ebd0f8fa9a0ad  ./recovery/root/res/images/progress_simple_fill.png
-980b3fa6936f88604ebd62f84663a8f2fe1430e0354906cc5e90f3db77080bea  ./recovery/root/res/images/progress_fill.png
-af11460f8463943befc9bed4eba90e45ae4b9af3ca26396dab53acb39f59bad3  ./recovery/root/res/images/icon_change_simcard.png
-28485d8ef79ca83e6f56b2c919b898251151cc1cebbde1f3ffc31d83ee52dc7e  ./recovery/root/res/images/change00010.png
-fb92d2fbcb1ea4ad3c601b067492647671c82f570c707d7a2c28703a52d722bf  ./recovery/root/res/images/no_command_text.png
-cfa94f8af03399c3ccd0522a3610eeba079fc64c99d724e9235d8bb030a337b3  ./recovery/root/res/images/simple00005.png
-b7ed040ebe8e4801fb258a4c4a99257c725c4e35689ec4da107f54887efc1ec1  ./recovery/root/res/images/simple00000.png
-47ccbc6a446d1bf939c79f2669ca186733b5dffbdaff5af808b0c776436cf17b  ./recovery/root/res/images/change00007.png
+001c41070cb3f96fd95e93dcef2ea1a6c7f241bd11a3653f87f0eecea2da6dd1  ./recovery/root/res/images/erasing_text.png
+559b36f43e5552cd5d5767a78de437f63c635e86498b574f0c5a3ea095808ad1  ./recovery/root/res/images/simple00011.png
 1c733b6fb841334226cdfd43def94e2ddc25ba2bdc5e5fee7021b7dd7de5883c  ./recovery/root/res/images/simple00003.png
-2051f6ee5437ba392e19ba95d2c8a302bd2671623b91896e47b4aab521d8ddac  ./recovery/root/res/images/change00001.png
-748123c5a8c6766333ae98e5a1e77eae9652fb9741b6601b20c49c03b7d0ddf5  ./recovery/root/res/images/installing_security_text.png
-9f7f72554190524f6da9bbed5dede9ab5ee45b1505e672dfe50eebb19f99d7ee  ./recovery/root/res/images/icon_simple_android.png
+9d4df95e86676b949f7b2718d3abc40c8ff4adab9617f0d7e9d693e0ef010ea1  ./recovery/root/res/images/font_percentage.png
+745e2981d8042f984c5c6942fc29270a9b60fa98170c269f41d0bdbd5c67e623  ./recovery/root/res/images/progress_empty.png
 4e67c262bf019047fc746720cb71f8c700e1125a0e6dd19f532610d4240611b4  ./recovery/root/res/images/poc_change00001.png
-c229c76130976a1df9a91057f855aab14620a9a1a39719ef32367b17218a5d82  ./recovery/root/res/images/simple00004.png
 3bb5249931fb973fea8cf31ac582d6b9ad53d4e90b9e38878856736f7ed8802b  ./recovery/root/res/recovery.do
-629f64f534991ec923dc4e66b3b308ef7ea94874b006cbb42b0dc73424b945fa  ./recovery/root/prop.default
-75e32f537e4d8064bbaa18b5b5f18b1ea4ffaa884b92546c3f1d0191a0a1f577  ./recovery/root/vendor_service_contexts
-985fe8f3e4466dc73b4b1ec981732a266a5cd8db2518b958b40a64328e2921ae  ./recovery/root/sbin/mke2fs_static
-5eaec5790dfef5015a40bba17489bc7bafc75149282b3585cb25fd6e85467c3b  ./recovery/root/sbin/knox_changer
+5593b7960b46a1157615b7fda90f35c53c1bb18d2413b5beceebd5dc6f26466d  ./recovery/root/res/keys
+0c1471d080d64fd83875db80b8e99b0f73f76071cd6a12a1293f17e2e00abe04  ./recovery/root/vendor_hwservice_contexts
+7e1e97fd432c8f553253fd5a035c9832f0152689f596cca905e8c63ff8b5f64b  ./recovery/root/vendor_seapp_contexts
+117d3610a1651d0fc88860bed8c4d5861b19325fc4449e5cf7b22911884e92f8  ./recovery/root/fstab.samsungexynos8895
+7bdff387f8ef141c44974dce34f7b543be328f1ff09125a101064e49fb7a8aac  ./recovery/root/vendor_file_contexts
+95fa81794bef792968f7e511bdfd5089f4a555ffe99421e31e323ee526d2bf73  ./recovery/root/sepolicy_version
+1c6ad1c270126132a14078be8e5662bc643788f12561e782c3ca6e024c150fa0  ./recovery/root/init.rc
+6e87de3d4146c1e296b8a55fce3c2e7c3717f5b8ff2ce18e63f14d82c503f098  ./recovery/root/plat_file_contexts
+ff6e9c2fa0f118eeea5acc1d1a5f0858c14081f9e843ecfd56faca3ffa4eb37d  ./recovery/root/mcRegistry/ffffffffd0000000000000000000000a.tlbin
+5949cd0e0df1a35fe5e1190703ba7962a10e8bc5742e0c6f876b210432dc046e  ./recovery/root/mcRegistry/ffffffff000000000000000000000019.tlbin
+a713f037b605b235700127c5a2e71d0864ca9c113e2a331d2df706f5608ce018  ./recovery/root/mcRegistry/ffffffff00000000000000000000000d.tlbin
+36b51f8817dcb5ffe5288187a67e4e2c60cbae305270418cf0cee8c489e2897e  ./recovery/root/publiccert.pem
 34bba842f95758bbc9702b83e61dbeadf3d7a9885ff1b7cba2baf0f8a81db4bc  ./recovery/root/sbin/sswap
-be63c6a266bd5bd870cc6572354f4eef66a0e1c986c1c7e1d3aebf9f8cfa54c1  ./recovery/root/sbin/recovery
-eb78d371fa3ba5da9a334292e993a083d9700b171656716b300caa3fa5fa8b3b  ./recovery/root/sbin/e2fsdroid_static
-718371bfbc1f12579f51bba15371c2fd0719df35a31c77652dad82fbc811c75d  ./recovery/root/sbin/adbd
+a5c12dbf9b3072d09d63cdc80ba6c20ed41165a0628b2fa9e0d846cfe7973814  ./recovery/root/sbin/dm_verity_hash
 c258f4be15970da1e658fcf097e2c95fc46e80f6582bd033c87a65b131c3141b  ./recovery/root/sbin/dm_verity_signature_checker
+3a69699c095edcd2cfff85233730c131b3c1d85b353f0b4075021daa94b48397  ./recovery/root/sbin/e2fsdroid_static
+985fe8f3e4466dc73b4b1ec981732a266a5cd8db2518b958b40a64328e2921ae  ./recovery/root/sbin/mke2fs_static
 4f784e837137517999300322146460cd12166be25dff70bdfe2f08b6ecda36c6  ./recovery/root/sbin/mcDriverDaemon_static
-8beeb022beeb6cddf59750a08582e2068e27688b67ddec1e9b91d152105b17b3  ./recovery/root/sbin/charger
+5eaec5790dfef5015a40bba17489bc7bafc75149282b3585cb25fd6e85467c3b  ./recovery/root/sbin/knox_changer
+4a1e287caabce6a774978a9b6c1a1e902b0b7dc409975889b6c4e956160605d2  ./recovery/root/sbin/adbd
+76b6f9f8f17dffde3ab06588d79178f17ab61704f6ec35ea8a0c0d929af35d01  ./recovery/root/sbin/charger
+a6501d92595bc06bb6f9be0729e351f6c97167db7ad3be9fefe4a202c5463a2e  ./recovery/root/sbin/recovery
 a0e36f5f9ecb152697fe814e5e091e4d41d36ff2540c2fc7a62e3da7b0f6397d  ./recovery/root/sbin/dm_verity_tz_cmd
-a5c12dbf9b3072d09d63cdc80ba6c20ed41165a0628b2fa9e0d846cfe7973814  ./recovery/root/sbin/dm_verity_hash
-47eb8cac3011cd149d27344fd698d1703ad0dab56ccc625ab6c6bc1eb5631348  ./recovery/root/audit_filter_table
-697fc32a726f454278424225370f12d9fb69a6c260391799cb7a15205f637054  ./recovery/root/vendor_seapp_contexts
-87949e52279a51d5c3de68093ea98b0630be24f435525ea21466a9c0251670ec  ./recovery/root/plat_service_contexts
-5949cd0e0df1a35fe5e1190703ba7962a10e8bc5742e0c6f876b210432dc046e  ./recovery/root/mcRegistry/ffffffff000000000000000000000019.tlbin
-ff6e9c2fa0f118eeea5acc1d1a5f0858c14081f9e843ecfd56faca3ffa4eb37d  ./recovery/root/mcRegistry/ffffffffd0000000000000000000000a.tlbin
-a713f037b605b235700127c5a2e71d0864ca9c113e2a331d2df706f5608ce018  ./recovery/root/mcRegistry/ffffffff00000000000000000000000d.tlbin
-49fb8bb30a2fe2c3a85584b8567d3f7d007fef2d805f3f0271e90bf686150c17  ./recovery/root/vendor_hwservice_contexts
-60312cc1419f438481ae0de375b4d147a88d436754a7e39a4fec78e37da3ad7c  ./recovery/root/plat_seapp_contexts
+852ec77ce415d58b891876eb65cfdcfb2eaedc56302a55630670437282a3fbe7  ./recovery/root/plat_hwservice_contexts
 906c402804f3bfb5ccc10ceeeeb84383682232686a294b19d35a7c41afc88615  ./recovery/root/etc/mke2fs.conf
 52441e7b11de9b12706bd50b2a2a7cf2525f57b7bf243b711d9458e6d46c05d8  ./recovery/root/etc/recovery.fstab
-0383ae8a83117582d49015ed77fd498c8da2144828b7103d7f7f1ea8535e08cb  ./recovery/root/vendor_property_contexts
-d7ef2b86ecd75047c2914a8d24bd9f690079cd280b510893919092e86cdd2612  ./recovery/root/vendor_file_contexts
-36b51f8817dcb5ffe5288187a67e4e2c60cbae305270418cf0cee8c489e2897e  ./recovery/root/publiccert.pem
-852ec77ce415d58b891876eb65cfdcfb2eaedc56302a55630670437282a3fbe7  ./recovery/root/plat_hwservice_contexts
-46e6d61c2f1d314fe44d644d7511ecc9fe16b6f43ec61fdae72ddbda29742c9f  ./recovery/root/sepolicy
-ad8ba192e8db2ecc66096961be9b5b357aa6914419cc606d23100ac4b44cd582  ./recovery/root/init
-f3d96eca897124530ef90171821cb68b9b849564e06983bdd7b9515ae9acb205  ./recovery/root/sepolicy_version
+75e32f537e4d8064bbaa18b5b5f18b1ea4ffaa884b92546c3f1d0191a0a1f577  ./recovery/root/vendor_service_contexts
+4932714de34e22ab86c4657cbf59dd96f8659f27b6884c4a5f373aba8110e96e  ./recovery/root/plat_service_contexts
 4c94b8657cb4f7558497cb1a47f7c60ca7274e4a729cb0a921cda14efdaa227e  ./recovery/root/ueventd.samsungexynos8895.rc
+b8ef339c67859dfaeb8f1bf0ba368e2443d58a4fa28b2965a093bebacf207ec2  ./recovery/root/audit_filter_table
+ee110e30f722cc49f3e03e7e05b8b84b937743f5569b85333542341739761a61  ./recovery/root/vendor_property_contexts
+b9c8d705269c7f53eced93d36917f681e513a21ee5c003eabe5dce30659f569e  ./recovery/root/prop.default
+8af15238f049b12f98625504d850b33d02a6ea3f7c96c30dadce51c1c874747c  ./recovery/root/vndservice_contexts
+5ab08537cf0e9fe55c44c422eb5cec22ec9500a4ddbc50fd3764132185d2edc2  ./recovery/root/init
 4dfd8860be6d10b31db525c56972c3b85617f1779b3b36b44984d4f99fbcdf40  ./recovery/root/ueventd.rc
 ca8e348081c2a9b325dd40ca296ec9697f0687dae028c3b1a7310f9a7557474d  ./recovery/root/atrace.rc
-1c6ad1c270126132a14078be8e5662bc643788f12561e782c3ca6e024c150fa0  ./recovery/root/init.rc
-6e87de3d4146c1e296b8a55fce3c2e7c3717f5b8ff2ce18e63f14d82c503f098  ./recovery/root/plat_file_contexts
-117d3610a1651d0fc88860bed8c4d5861b19325fc4449e5cf7b22911884e92f8  ./recovery/root/fstab.samsungexynos8895
-fa48525def04b26023fbf84f67b8a9ad34c4b2ef36e839511242395d50495ad8  ./system/vendor/bin/pm_proxy_helper
-5c53ff66fef4ad7be9200aabe3c30287f1c0fba71325aa0bdf2315ba0378f60d  ./system/vendor/bin/sh
-2a2ab067003fad715f9798ef23ebf227ddce9e8c712563c2e6833043d7410178  ./system/vendor/bin/vendor.samsung.security.skpm@1.0-service
+60312cc1419f438481ae0de375b4d147a88d436754a7e39a4fec78e37da3ad7c  ./recovery/root/plat_seapp_contexts
+67dafb9ef8800d942bfcb2b3e18262ad6447f776b3635b37f6291f66f88e4eac  ./recovery/root/sepolicy
+80b2b244c85a6ee3408ce304d2ffeaea5af3796cf7d817555efa3fd40c9b0e9a  ./system/vendor/bin/toybox_vendor
 201d83a1c12bdc8d71b372c4694cf0f39c17eec8c626a50c97ebe7fb70409b4b  ./system/vendor/bin/awk
+fa48525def04b26023fbf84f67b8a9ad34c4b2ef36e839511242395d50495ad8  ./system/vendor/bin/pm_proxy_helper
+994d0af60ae43ff172a5c074ed5fed8fdde326716ed9ed6468af12ce4ef30e9b  ./system/vendor/bin/vendor.samsung.security.skpm@1.0-service
+a334246f53bd614ea3530baf49acec645ae37c7ed4f62f7d73c8d071db789671  ./system/vendor/bin/vendor.samsung.security.wsm@1.0-service
+d21c268af1a1c5d1468758edb504c94c755094a7feef4d36fa20c3559f1e241d  ./system/vendor/bin/argosd
+38d8e9c1b0e61752ebfda327dfba40588a3bad422ecb08702953ab9a9cf703a7  ./system/vendor/bin/logwrapper
+148e85cce90f23acde88d8e7adefb727578a39c7e0d53460891c47947538df24  ./system/vendor/bin/toolbox
 896a18e5989e1fb5eebaf1e3ed2c350360a0fe2c3ab6db40d0cce903c2b1eeda  ./system/vendor/bin/mcDriverDaemon
-146a4573c417679164271eef8e934a4c9028845bcce05f63aebee2c5d0084675  ./system/vendor/bin/vendor.samsung.security.wsm@1.0-service
-506c07e4c8dd8ff9eaaf720b879a2ca0c002c7c8b5d19ec4deef3f176721dd15  ./system/vendor/bin/hw/vendor.samsung_slsi.hardware.ExynosHWCServiceTW@1.0-service
-5eaaec9cba821c88e010653925dfca00a6903925d00d29c17f586a8513db79f2  ./system/vendor/bin/hw/gpsd
-e78465a549f87897193a83939b939e641dcd76d57b5ffd4d564df708ee1b11d5  ./system/vendor/bin/hw/vendor.trustonic.tee@1.0-service
-3480c8cebf4f9fd0346558d9884425311c1674f4faebdec0c81f5af398a32ccb  ./system/vendor/bin/hw/android.hardware.sensors@1.0-service
-7fecbd0fdc37f6d1015b4c091175c0fb413d3eb41d30781a1512a68990779e0c  ./system/vendor/bin/hw/android.hardware.usb@1.1-service.samsung
-d73a26431398328f192c4de9e82e4bcb7ea8eea56de74333d3cb47f0bb0f9c11  ./system/vendor/bin/hw/android.hardware.health@2.0-service.samsung
-33fac3bc221dd27ce42031d4623e5d284b4c4da7a952eb8fd9215f0c98c84136  ./system/vendor/bin/hw/vendor.samsung.hardware.radio.configsvc@1.0-service
-4c56490169c629e296e8e61ce6ce7a839daf3a9395e5aefccf8e63f032912147  ./system/vendor/bin/hw/android.hardware.gatekeeper@1.0-service
-e73f2c89ba9b2c9c46510c325e1d82a4bcf8dd3fe0eda660559e12b71fd72de7  ./system/vendor/bin/hw/android.hardware.drm@1.0-service
+39e2bbbc8b12b6abe23a3636ba52517cb7f8ea3cb7bd0597ecdd5f67bd15b0da  ./system/vendor/bin/vendor.samsung.security.wvkprov_server@1.0-service
+843eb90df083da5f33999177eea7f12dac7cd9a465cd4d574cb821bc40820427  ./system/vendor/bin/wvkprov
+586d43914301c010831b5665a10f4b9159a2af1dd7c9b27047a9be3b27d965df  ./system/vendor/bin/vndservicemanager
+5c53ff66fef4ad7be9200aabe3c30287f1c0fba71325aa0bdf2315ba0378f60d  ./system/vendor/bin/sh
+6c08deb7f66e91a137c97503c5d58ce8ea8c3e73f53ced08e046e01b5dda27dd  ./system/vendor/bin/hw/vendor.trustonic.teeregistry@1.0-service
 faa5b57f8a1efbd7cbe94a57fed2efa00246745a89e7ca511d68779d0fb6861a  ./system/vendor/bin/hw/lhd
-2940e018c9376d0a0b589b86ff61585b145c21ee102095dc4c20da0f0c05e439  ./system/vendor/bin/hw/mfgloader
-0f996815451b905364f471880762b7109c505039131763d9042dfa84f60eaa63  ./system/vendor/bin/hw/android.hardware.configstore@1.1-service
-19755849f9016fa9391cf17d6adbd618996d9a6b6e53e08fb8ffcb8cab5ee66c  ./system/vendor/bin/hw/sec.android.hardware.nfc@1.1-service
-b1675207f4c3f6320fc17a8006fa9f8a1748c4b6efacbe4ba77c0c1d98db02e3  ./system/vendor/bin/hw/hostapd
-f056c4c0419f5254f13bd1339063fb1411b53497311a192cac1694d0cc004e14  ./system/vendor/bin/hw/android.hardware.power@1.0-service
-cf4e2dd238699ffda81b3d67cffc464ee4b1117337f1787828034257b7894bca  ./system/vendor/bin/hw/android.hardware.bluetooth@1.0-service
-fccbf60a60f77eab2be9a162e7be71bbfc095629a5825ee6ff68419da3594da7  ./system/vendor/bin/hw/vendor.samsung.hardware.vibrator@1.0-service
+2b21ea22e35a6854c4aa6224eefc8c074905fce2b2318b76c833c8fe92602e68  ./system/vendor/bin/hw/android.hardware.bluetooth@1.0-service
+a2fbf057720baff2848281faaf8c692b5839d53c8eede2b9a72f9310e427ab11  ./system/vendor/bin/hw/android.hardware.audio@2.0-service
+6087aa955a1b03c3aabda9b85b85d3cfb35379887815781a7e41a95177ec8cda  ./system/vendor/bin/hw/android.hardware.drm@1.1-service.clearkey
+78e6bda29fc47dfa9a3319a07139bcb92d3ce93ce18d47124d7413b388b6a1b0  ./system/vendor/bin/hw/vendor.samsung_slsi.hardware.configstore@1.0-service
+71a17e039de8ffcd678f8d4b2e934528b7363b4b59a1799da84d3d456310e779  ./system/vendor/bin/hw/android.hardware.graphics.composer@2.1-service
+ff700cda481177ef20cb321b23d793f339ba677ef23e737b6ae8051ce6ed76b9  ./system/vendor/bin/hw/wldu
+4c56490169c629e296e8e61ce6ce7a839daf3a9395e5aefccf8e63f032912147  ./system/vendor/bin/hw/android.hardware.gatekeeper@1.0-service
+192e927a04c2adcdd3b422deb90fd32d677c2f918d57dc484b85c9063b9d03c5  ./system/vendor/bin/hw/android.hardware.health@2.0-service.samsung
+3480c8cebf4f9fd0346558d9884425311c1674f4faebdec0c81f5af398a32ccb  ./system/vendor/bin/hw/android.hardware.sensors@1.0-service
 efa5f0430f74cb2a5220c751be4b337e19be88bb48bb511d91d69a6d36de78d8  ./system/vendor/bin/hw/android.hardware.memtrack@1.0-service
-2a9376bd06552564de5ccd29e29ab7869ae4958cc51255cbeb0bbd0f225b68e0  ./system/vendor/bin/hw/android.hardware.drm@1.1-service.clearkey
-6c00a40ed8efd9bca664c1ec77a1242af25064d6a442b4d4ea7c25bd105bcc93  ./system/vendor/bin/hw/android.hardware.wifi@1.0-service
-450412811d940a24fb6b206bedede0b9cccf95c949a09723bd028b3d118acaf7  ./system/vendor/bin/hw/vendor.samsung.hardware.light@2.0-service
-dd17d33ecf33caa1195bea525bfa2930662e8e71cab400d17e445bacb6e71b18  ./system/vendor/bin/hw/wpa_supplicant
+cfd3dd89ed5bb10f94cad335de38b2ad84bcd6f21de305b7f424c5e693ee4bd9  ./system/vendor/bin/hw/android.hardware.usb@1.1-service.samsung
+dc57f1028a046260595bd90d0ab4dd4603c4b256bf02adde47b56f6904760587  ./system/vendor/bin/hw/vendor.samsung.hardware.miscpower@1.0-service
+efcee404cccba9f980474e5b7cef5ea074b2c6ada4997201aec09978a1a7f3ca  ./system/vendor/bin/hw/android.hardware.drm@1.0-service
+7135958d2fbc1bfc1b2b41f2681a26392adb1fb24d027feb00f1d879471c8b4f  ./system/vendor/bin/hw/android.hardware.cas@1.0-service
 6c01ccaacd0af53b7f4b5de5b5171f1e326de75948d2101e648cbf6cc724ab19  ./system/vendor/bin/hw/android.hardware.light@2.0-service
-ba8d835ee14e6b42cd645df88d32079ca3f08076167285d3b5a44eda775ec0ae  ./system/vendor/bin/hw/vendor.samsung.hardware.gnss@1.0-service
-a2fbf057720baff2848281faaf8c692b5839d53c8eede2b9a72f9310e427ab11  ./system/vendor/bin/hw/android.hardware.audio@2.0-service
-b61e1f1e69100162e10e1e765da782fa3beebcde30a797c0ac31724be06cf3d4  ./system/vendor/bin/hw/vendor.samsung.hardware.miscpower@1.0-service
+e1412077f5e12cab4c7b9051c849b179e5cc536083d7fd6a985bd23d34543f28  ./system/vendor/bin/hw/android.hardware.media.omx@1.0-service
+f056c4c0419f5254f13bd1339063fb1411b53497311a192cac1694d0cc004e14  ./system/vendor/bin/hw/android.hardware.power@1.0-service
+450412811d940a24fb6b206bedede0b9cccf95c949a09723bd028b3d118acaf7  ./system/vendor/bin/hw/vendor.samsung.hardware.light@2.0-service
 803905f7b97e6897e34fdf20575ded85dcec2b5fc29df9e256573c3cd6d4aa56  ./system/vendor/bin/hw/android.hardware.keymaster@3.0-service
-e581f906631db317afe5ae391bf314751dfa9cc78c7ccb01f2ce7a55246b2cbd  ./system/vendor/bin/hw/android.hardware.thermal@1.0-service
-fb4254e6f4a1701147615f2f4cfdf6ebcfe41e9fa2c6fe9ee2b7e697811b0c45  ./system/vendor/bin/hw/android.hardware.vr@1.0-service
-eecfec1c37e55629f6d0266d7f1e106b780d8c4e29a47b802f5b1bb5f9189c99  ./system/vendor/bin/hw/vendor.samsung_slsi.hardware.configstore@1.0-service
+486a931ccb31af2ce656b1994f3d70ae04f1a82d7c71293ee69a5f0200becc36  ./system/vendor/bin/hw/hostapd
 b048dfcc3063718b49e04a69dbd84bc7d25157fd3ced0b64e75723eaf02cd0f9  ./system/vendor/bin/hw/rild
-71a17e039de8ffcd678f8d4b2e934528b7363b4b59a1799da84d3d456310e779  ./system/vendor/bin/hw/android.hardware.graphics.composer@2.1-service
-914a664cadd18da7ebd7417749242e5458e0d6334eecad9cec687057b393d4d6  ./system/vendor/bin/hw/android.hardware.cas@1.0-service
+d7cb6ae97f652c7ec1a7d7ba2e48eadea4dad431cd5b60e31815de9c38f5c9da  ./system/vendor/bin/hw/vendor.samsung.hardware.radio.configsvc@1.0-service
+e65e1f8277daba6536163f61333091fe07165bb6cd57defa8d0c284a3a07a17f  ./system/vendor/bin/hw/vendor.samsung.hardware.biometrics.fingerprint@2.1-service
+2b385406f7b257d896b4d3ba4c4adcbf717ec2ed7fddec60ce0449f45533ba64  ./system/vendor/bin/hw/vendor.samsung.hardware.vibrator@1.0-service
+ba8d835ee14e6b42cd645df88d32079ca3f08076167285d3b5a44eda775ec0ae  ./system/vendor/bin/hw/vendor.samsung.hardware.gnss@1.0-service
+0f996815451b905364f471880762b7109c505039131763d9042dfa84f60eaa63  ./system/vendor/bin/hw/android.hardware.configstore@1.1-service
+939af2ece6f69a9fb828953ef54c06e4ea5312dd918f3e545d6d8869f30763ae  ./system/vendor/bin/hw/android.hardware.wifi@1.0-service
+2940e018c9376d0a0b589b86ff61585b145c21ee102095dc4c20da0f0c05e439  ./system/vendor/bin/hw/mfgloader
+5eaaec9cba821c88e010653925dfca00a6903925d00d29c17f586a8513db79f2  ./system/vendor/bin/hw/gpsd
+e581f906631db317afe5ae391bf314751dfa9cc78c7ccb01f2ce7a55246b2cbd  ./system/vendor/bin/hw/android.hardware.thermal@1.0-service
 c83ac1a315b41e9ce1a022338f7f6635ed59a0661268fefd2903cb371060d513  ./system/vendor/bin/hw/android.hardware.graphics.allocator@2.0-service
-8e0c0e08ab864321c2608723701e1e4dbbc777c2e18535078b7b16814d30024b  ./system/vendor/bin/hw/android.hardware.drm@1.1-service.widevine
-6c2415e9f590aa44ae13d9b9d9d2c514e82d7906cec9542cb1405fd8ed73b81f  ./system/vendor/bin/hw/vendor.trustonic.teeregistry@1.0-service
-ff700cda481177ef20cb321b23d793f339ba677ef23e737b6ae8051ce6ed76b9  ./system/vendor/bin/hw/wldu
-57e966e024d054dd5819b141936042741c128d16e5058ba1716892d60a5e4184  ./system/vendor/bin/hw/android.hardware.media.omx@1.0-service
+a45483a3ad7ca43fc246a052112e0e349241b75bccc0e65b550245a1991ec7bc  ./system/vendor/bin/hw/vendor.trustonic.tee@1.0-service
+7098c5325a079d04f8a1f38e0577a6209f7fc513998c237e8d270d83916c5347  ./system/vendor/bin/hw/sec.android.hardware.nfc@1.1-service
+19af0e27cc30251e3a03fa5eceb273bf1c37288993200163a51018baf051180c  ./system/vendor/bin/hw/android.hardware.drm@1.1-service.widevine
+fd58fb76cb3c20c65139e157685449a8ca89e6588826067dfa8fe8d6573248f0  ./system/vendor/bin/hw/vendor.samsung_slsi.hardware.ExynosHWCServiceTW@1.0-service
+fb4254e6f4a1701147615f2f4cfdf6ebcfe41e9fa2c6fe9ee2b7e697811b0c45  ./system/vendor/bin/hw/android.hardware.vr@1.0-service
 f597d4d71d39dba36d0dbd7e76048716a95589b1bc81a97cda3ba6203e7557d6  ./system/vendor/bin/hw/macloader
-22ad1aa70aebbb910b0ee2c394f15dd8fc7db2482c0c8eed405e3d59e74dc586  ./system/vendor/bin/hw/vendor.samsung.hardware.biometrics.fingerprint@2.1-service
-ba894b2956614b7f4e115f18f3d657c8c9f1a97c6da2b2610808022ac78011c0  ./system/vendor/bin/vndservice
-80b2b244c85a6ee3408ce304d2ffeaea5af3796cf7d817555efa3fd40c9b0e9a  ./system/vendor/bin/toybox_vendor
-586d43914301c010831b5665a10f4b9159a2af1dd7c9b27047a9be3b27d965df  ./system/vendor/bin/vndservicemanager
+619abd593e3f6d397f073d3bfc4eee476757438ffcd0bec01ec5f62248186113  ./system/vendor/bin/hw/wpa_supplicant
+b7f90c1a87e778c35c39ebd5a4f7b7421a2f87303b918addc967b282294207c2  ./system/vendor/bin/icd
 a32de4a2fb5adf359805230ce96e42fa809879191e7e6714386d1a4bb7e3eb98  ./system/vendor/bin/cbd
+8a64aec180bafbbd861d1c3d1b43ae9d913da223168e6f9352fb8017737411d4  ./system/vendor/bin/vendor.samsung.security.sem@1.0-service
+ba894b2956614b7f4e115f18f3d657c8c9f1a97c6da2b2610808022ac78011c0  ./system/vendor/bin/vndservice
 75ef30135564abb4089ffda82d374e812327ed54155bc46e3df1d2c8e23bb48b  ./system/vendor/bin/grep
-38d8e9c1b0e61752ebfda327dfba40588a3bad422ecb08702953ab9a9cf703a7  ./system/vendor/bin/logwrapper
-d21c268af1a1c5d1468758edb504c94c755094a7feef4d36fa20c3559f1e241d  ./system/vendor/bin/argosd
-843eb90df083da5f33999177eea7f12dac7cd9a465cd4d574cb821bc40820427  ./system/vendor/bin/wvkprov
-d5c2c181bc5e61bcbbf99c4411d3acd371d7f0dc1a9e6a6a221ab0674eaa6083  ./system/vendor/bin/vendor.samsung.security.wvkprov_server@1.0-service
-148e85cce90f23acde88d8e7adefb727578a39c7e0d53460891c47947538df24  ./system/vendor/bin/toolbox
-b7f90c1a87e778c35c39ebd5a4f7b7421a2f87303b918addc967b282294207c2  ./system/vendor/bin/icd
-dece896892a9f29432e2ad060436dc98c9b92acf64c1c715ddf72316963df974  ./system/vendor/bin/vendor.samsung.security.sem@1.0-service
-2af4e17e087a7018c6c600f4d9a4cbe386879afcbef6c864c1183c8832f58169  ./tmp/update_binary
-22461ad2981d678dd8a85433dd685219c1c6a52dc1c5d168174a1ba4eb85ff85  ./system/bin/install-recovery.sh
+50325da06bb17a1fbfa35ffebaf132bc5f76857b4bb50c53f575eb58f30d85dd  ./tmp/update_binary
+1a59ae8de53d98448c3bc8cdcdd5bfefb2dbdf5992a4b0b56b7aff3b756f431d  ./system/bin/install-recovery.sh
diff --git a/tools/dtbtool b/tools/dtbtool
index 0777cba669e0e193c75f6fafa3f7e0337d709e99..7bd0bdba49b0df3f2145178be64c490a1ba3634f 100755
GIT binary patch
delta 91
zcmV-h0Hpu#&jY{D1CS^Ih_NYK0u<e3=0<ZNhmmV^tbCZ^Wb*E@fE2Ts0^YB)p|Vl|
xv-q=M1_3LRvAq+MY`P=?f0L2AKLH4n(YikYK(i6M!W;rOGn25_7PITu1Q5TvDcb-5

delta 104
zcmV-u0GI#2&jatz1CS^IxUnf)0u))9?Fpw6ey#E+K(`|{`((19i&(Rm0^Y9(G$|l7
zE;ueUvs1El0h8bX1+&PrU<LtJlYzYxlRUa40jiT>x<3IplcBml0dTY7y22a+I5Lxf
K*A}z8*8~s=P%E|o

-- 
2.20.1