Merge 6f9cc1c768760952212aab350a3bdc368850e37e on remote branch

Change-Id: I5d6aa5144d1b152986d19514991aed0c6118e544

components/action_oui/core/src/wlan_action_oui_main.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2018, 2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -209,6 +209,9 @@ static void action_oui_load_config(struct action_oui_psoc_priv *psoc_priv)
 	qdf_str_lcopy(psoc_priv->action_oui_str[ACTION_OUI_DISABLE_BFORMEE],
 		      cfg_get(psoc, CFG_ACTION_OUI_DISABLE_BFORMEE),
 			      ACTION_OUI_MAX_STR_LEN);
+	qdf_str_lcopy(psoc_priv->action_oui_str[ACTION_OUI_LIMIT_BW],
+		      cfg_get(psoc, CFG_ACTION_OUI_LIMIT_BW),
+			      ACTION_OUI_MAX_STR_LEN);
 }
 
 static void action_oui_parse_config(struct wlan_objmgr_psoc *psoc)

components/action_oui/dispatcher/inc/wlan_action_oui_cfg.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -860,6 +860,34 @@
 	"8CFDF0 13 040000494c510302097201cb17000009110000 FFFFE0 01", \
 	"To restrict matching OUI APs to two link connection at max")
 
+/*
+ * <ini>
+ * CFG_ACTION_OUI_LIMIT_BW - Used to limit BW for specified AP
+ *
+ * Example OUIs: (All values in Hex)
+ * OUI 1: 00904c
+ *       OUI data Len: 04
+ *       OUI Data : 0201009C
+ *       OUI data Mask: F0 - 11110000
+ *       Info Mask : 01 - only OUI present in Info mask
+ *
+ * Refer to gEnableActionOUI for more detail about the format.
+ *
+ * Related: gEnableActionOUI
+ *
+ * Supported Feature: Action OUIs
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_ACTION_OUI_LIMIT_BW CFG_INI_STRING( \
+	"gActionOUILimitBW", \
+	0, \
+	ACTION_OUI_MAX_STR_LEN, \
+	"", \
+	"Limit BW for specified AP")
+
 #define CFG_ACTION_OUI \
 	CFG(CFG_ACTION_OUI_CCKM_1X1) \
 	CFG(CFG_ACTION_OUI_CONNECT_1X1) \
@@ -881,5 +909,6 @@
 	CFG(CFG_ACTION_OUI_SEND_SMPS_FRAME_WITH_OMN) \
 	CFG(CFG_ACTION_OUI_AUTH_ASSOC_6MBPS_2GHZ) \
 	CFG(CFG_ACTION_OUI_DISABLE_BFORMEE) \
+	CFG(CFG_ACTION_OUI_LIMIT_BW) \
 	CFG(CFG_ENABLE_ACTION_OUI)
 #endif

components/action_oui/dispatcher/inc/wlan_action_oui_public_struct.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -127,6 +127,7 @@
  * @ACTION_OUI_ENABLE_CTS2SELF: enable cts to self for specified AP's
  * @ACTION_OUI_RESTRICT_MAX_MLO_LINKS: Downgrade MLO if particular AP
  *                                     build present.
+ * @ACTION_OUI_LIMIT_BW: Limit BW if vendor OUI is received in beacon.
  * @ACTION_OUI_MAXIMUM_ID: maximum number of action oui types
  */
 enum action_oui_id {
@@ -153,6 +154,7 @@ enum action_oui_id {
 	ACTION_OUI_DISABLE_AGGRESSIVE_EDCA,
 	ACTION_OUI_ENABLE_CTS2SELF,
 	ACTION_OUI_RESTRICT_MAX_MLO_LINKS,
+	ACTION_OUI_LIMIT_BW,
 	ACTION_OUI_MAXIMUM_ID
 };
 

components/dp/core/inc/wlan_dp_priv.h

@@ -434,6 +434,7 @@ struct fisa_pkt_hist {
  * @last_accessed_ts: Timestamp when the flow was last accessed
  * @pkt_hist: FISA aggreagtion packets history
  * @same_mld_vdev_mismatch: Packets flushed after vdev_mismatch on same MLD
+ * @add_timestamp: FISA entry created timestamp
  */
 struct dp_fisa_rx_sw_ft {
 	void *hw_fse;
@@ -482,6 +483,7 @@ struct dp_fisa_rx_sw_ft {
 	struct fisa_pkt_hist pkt_hist;
 #endif
 	uint64_t same_mld_vdev_mismatch;
+	uint64_t add_timestamp;
 };
 
 #define DP_RX_GET_SW_FT_ENTRY_SIZE sizeof(struct dp_fisa_rx_sw_ft)

components/dp/core/src/wlan_dp_fisa_rx.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -579,6 +579,7 @@ dp_rx_fisa_add_ft_entry(struct dp_vdev *vdev,
 
 			sw_ft_entry->is_flow_tcp = proto_params.tcp_proto;
 			sw_ft_entry->is_flow_udp = proto_params.udp_proto;
+			sw_ft_entry->add_timestamp = qdf_get_log_timestamp();
 
 			is_fst_updated = true;
 			fisa_hdl->add_flow_count++;
@@ -755,6 +756,7 @@ dp_fisa_rx_delete_flow(struct dp_rx_fst *fisa_hdl,
 
 	sw_ft_entry->is_flow_tcp = elem->is_tcp_flow;
 	sw_ft_entry->is_flow_udp = elem->is_udp_flow;
+	sw_ft_entry->add_timestamp = qdf_get_log_timestamp();
 
 	fisa_hdl->add_flow_count++;
 	fisa_hdl->del_flow_count++;
@@ -810,6 +812,7 @@ static void dp_fisa_rx_fst_update(struct dp_rx_fst *fisa_hdl,
 	uint32_t lru_ft_entry_idx = 0;
 	uint32_t timestamp;
 	uint32_t reo_dest_indication;
+	uint64_t sw_timestamp;
 
 	/* Get the hash from TLV
 	 * FSE FT Toeplitz hash is same Common parser hash available in TLV
@@ -853,6 +856,8 @@ static void dp_fisa_rx_fst_update(struct dp_rx_fst *fisa_hdl,
 			sw_ft_entry->is_flow_tcp = elem->is_tcp_flow;
 			sw_ft_entry->is_flow_udp = elem->is_udp_flow;
 
+			sw_ft_entry->add_timestamp = qdf_get_log_timestamp();
+
 			is_fst_updated = true;
 			fisa_hdl->add_flow_count++;
 			break;
@@ -882,8 +887,19 @@ static void dp_fisa_rx_fst_update(struct dp_rx_fst *fisa_hdl,
 	if ((skid_count > max_skid_length) &&
 	    wlan_dp_cfg_is_rx_fisa_lru_del_enabled(dp_cfg)) {
 		dp_fisa_debug("Max skid length reached flow cannot be added, evict exiting flow");
-		dp_fisa_rx_delete_flow(fisa_hdl, elem, lru_ft_entry_idx);
-		is_fst_updated = true;
+
+		sw_ft_entry = &(((struct dp_fisa_rx_sw_ft *)
+				fisa_hdl->base)[lru_ft_entry_idx]);
+		sw_timestamp = qdf_get_log_timestamp();
+
+		if (qdf_log_timestamp_to_usecs(sw_timestamp - sw_ft_entry->add_timestamp) >
+			FISA_FT_ENTRY_AGING_US) {
+			qdf_spin_unlock_bh(&fisa_hdl->dp_rx_fst_lock);
+			dp_fisa_rx_delete_flow(fisa_hdl, elem, lru_ft_entry_idx);
+			qdf_spin_lock_bh(&fisa_hdl->dp_rx_fst_lock);
+			is_fst_updated = true;
+		} else
+			dp_fisa_debug("skip update due to aging not complete");
 	}
 
 	/**
@@ -1816,7 +1832,6 @@ static int dp_add_nbuf_to_fisa_flow(struct dp_rx_fst *fisa_hdl,
 		      nbuf, qdf_nbuf_next(nbuf), qdf_nbuf_data(nbuf),
 		      qdf_nbuf_len(nbuf), qdf_nbuf_get_only_data_len(nbuf));
 
-	dp_rx_fisa_acquire_ft_lock(fisa_hdl, napi_id);
 	/* Packets of the flow are arriving on a different REO than
 	 * the one configured.
 	 */
@@ -1834,14 +1849,12 @@ static int dp_add_nbuf_to_fisa_flow(struct dp_rx_fst *fisa_hdl,
 		 * currently active flow.
 		 */
 		if (cce_match) {
-			dp_rx_fisa_release_ft_lock(fisa_hdl, napi_id);
 			DP_STATS_INC(fisa_hdl, reo_mismatch.allow_cce_match,
 				     1);
 			return FISA_AGGR_NOT_ELIGIBLE;
 		}
 
 		if (fse_metadata != fisa_flow->metadata) {
-			dp_rx_fisa_release_ft_lock(fisa_hdl, napi_id);
 			DP_STATS_INC(fisa_hdl,
 				     reo_mismatch.allow_fse_metdata_mismatch,
 				     1);
@@ -1852,7 +1865,6 @@ static int dp_add_nbuf_to_fisa_flow(struct dp_rx_fst *fisa_hdl,
 		       fisa_flow, fisa_flow->napi_id, nbuf, napi_id);
 		DP_STATS_INC(fisa_hdl, reo_mismatch.allow_non_aggr, 1);
 		QDF_BUG(0);
-		dp_rx_fisa_release_ft_lock(fisa_hdl, napi_id);
 		return FISA_AGGR_NOT_ELIGIBLE;
 	}
 
@@ -1969,14 +1981,12 @@ static int dp_add_nbuf_to_fisa_flow(struct dp_rx_fst *fisa_hdl,
 		dp_rx_fisa_aggr_tcp(fisa_hdl, fisa_flow, nbuf);
 	}
 
-	dp_rx_fisa_release_ft_lock(fisa_hdl, napi_id);
 	fisa_flow->last_accessed_ts = qdf_get_log_timestamp();
 
 	return FISA_AGGR_DONE;
 
 invalid_fisa_assist:
 	/* Not eligible aggregation deliver frame without FISA */
-	dp_rx_fisa_release_ft_lock(fisa_hdl, napi_id);
 	return FISA_AGGR_NOT_ELIGIBLE;
 }
 
@@ -2073,6 +2083,7 @@ QDF_STATUS dp_fisa_rx(struct wlan_dp_psoc_context *dp_ctx,
 	int fisa_ret;
 	uint8_t rx_ctx_id = QDF_NBUF_CB_RX_CTX_ID(nbuf_list);
 	uint32_t tlv_reo_dest_ind;
+	uint8_t reo_id;
 
 	head_nbuf = nbuf_list;
 
@@ -2113,35 +2124,42 @@ QDF_STATUS dp_fisa_rx(struct wlan_dp_psoc_context *dp_ctx,
 			continue;
 		}
 
+		reo_id = QDF_NBUF_CB_RX_CTX_ID(head_nbuf);
+		dp_rx_fisa_acquire_ft_lock(dp_fisa_rx_hdl, reo_id);
+
 		/* Add new flow if the there is no ongoing flow */
 		fisa_flow = dp_rx_get_fisa_flow(dp_fisa_rx_hdl, vdev,
 						head_nbuf);
 
 		/* Do not FISA aggregate IPSec packets */
 		if (fisa_flow &&
-		    fisa_flow->rx_flow_tuple_info.is_exception)
+		    fisa_flow->rx_flow_tuple_info.is_exception) {
+			dp_rx_fisa_release_ft_lock(dp_fisa_rx_hdl, reo_id);
 			goto pull_nbuf;
+		}
 
 		/* Fragmented skb do not handle via fisa
 		 * get that flow and deliver that flow to rx_thread
 		 */
 		if (qdf_unlikely(qdf_nbuf_get_ext_list(head_nbuf))) {
 			dp_fisa_debug("Fragmented skb, will not be FISAed");
-			if (fisa_flow) {
-				dp_rx_fisa_acquire_ft_lock(dp_fisa_rx_hdl,
-							   fisa_flow->napi_id);
+			if (fisa_flow)
 				dp_rx_fisa_flush_flow(vdev, fisa_flow);
-				dp_rx_fisa_release_ft_lock(dp_fisa_rx_hdl,
-							   fisa_flow->napi_id);
-			}
+
+			dp_rx_fisa_release_ft_lock(dp_fisa_rx_hdl, reo_id);
 			goto pull_nbuf;
 		}
 
-		if (!fisa_flow)
+		if (!fisa_flow) {
+			dp_rx_fisa_release_ft_lock(dp_fisa_rx_hdl, reo_id);
 			goto pull_nbuf;
+		}
 
 		fisa_ret = dp_add_nbuf_to_fisa_flow(dp_fisa_rx_hdl, vdev,
 						    head_nbuf, fisa_flow);
+
+		dp_rx_fisa_release_ft_lock(dp_fisa_rx_hdl, reo_id);
+
 		if (fisa_ret == FISA_AGGR_DONE)
 			goto next_msdu;
 

components/dp/core/src/wlan_dp_fisa_rx.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -67,6 +67,8 @@
 
 #define DP_FT_LOCK_MAX_RECORDS 32
 
+#define FISA_FT_ENTRY_AGING_US	1000000
+
 struct dp_fisa_rx_fst_update_elem {
 	/* Do not add new entries here */
 	qdf_list_node_t node;

components/mlme/core/src/wlan_mlme_main.c

@@ -3261,6 +3261,8 @@ static void mlme_init_lfr_cfg(struct wlan_objmgr_psoc *psoc,
 	mlme_init_subnet_detection(psoc, lfr);
 	lfr->rso_user_config.cat_rssi_offset = DEFAULT_RSSI_DB_GAP;
 	mlme_init_bmiss_timeout(psoc, lfr);
+	lfr->hs20_btm_offload_disable = cfg_get(psoc,
+						CFG_HS_20_BTM_OFFLOAD_DISABLE);
 }
 
 static void mlme_init_power_cfg(struct wlan_objmgr_psoc *psoc,

components/mlme/dispatcher/inc/cfg_mlme_lfr.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -3297,6 +3297,31 @@
 		CFG_VALUE_OR_DEFAULT, \
 		"Roam information cache number in wlan driver")
 
+/*
+ * <ini>
+ * hs20_btm_offload_disable - To enable/disable BTM offload
+ * @Min: 0
+ * @Max: 1
+ * @Default: 1
+ *
+ * This ini is used to enable/disable BTM offload for Hotspot 2.0.
+ * Some solutions may not have Hotspot 2.0 certification
+ * and there is no need to forward the BTM frame to wpa_supplicant,
+ * in such solutions Let firmware handle the frame, in such cases by
+ * enabling btm_offload so that it doesn't wakeup the host.
+ * Firmware may roam to another AP upon BTM reception.
+ *
+ * Related: LFR
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_HS_20_BTM_OFFLOAD_DISABLE CFG_INI_BOOL( \
+		"hs20_btm_offload_disable", \
+		true, \
+		"To Enable/disable BTM offload for hotspot 2.0")
+
 #define CFG_LFR_ALL \
 	CFG(CFG_LFR_MAWC_ROAM_ENABLED) \
 	CFG(CFG_LFR_MAWC_ROAM_TRAFFIC_THRESHOLD) \
@@ -3398,6 +3423,7 @@
 	ROAM_REASON_VSIE_ALL \
 	CFG(CFG_LFR_BEACONLOSS_TIMEOUT_ON_WAKEUP) \
 	CFG(CFG_LFR_BEACONLOSS_TIMEOUT_ON_SLEEP) \
-	CFG(CFG_LFR3_ROAM_INFO_STATS_NUM)
+	CFG(CFG_LFR3_ROAM_INFO_STATS_NUM) \
+	CFG(CFG_HS_20_BTM_OFFLOAD_DISABLE)
 
 #endif /* CFG_MLME_LFR_H__ */

components/mlme/dispatcher/inc/wlan_mlme_api.h

@@ -4956,4 +4956,15 @@ wlan_mlme_get_ap_oper_ch_width(struct wlan_objmgr_vdev *vdev);
 QDF_STATUS
 wlan_mlme_send_csa_event_status_ind(struct wlan_objmgr_vdev *vdev,
 				    uint8_t csa_status);
+
+/**
+ * wlan_mlme_is_hs_20_btm_offload_disabled() - Get BTM offload is enable/disable
+ * @psoc: pointer to psoc object
+ * @val:  Pointer to the value which will be filled for the caller
+ *
+ * Return: QDF Status
+ */
+QDF_STATUS
+wlan_mlme_is_hs_20_btm_offload_disabled(struct wlan_objmgr_psoc *psoc,
+					bool *val);
 #endif /* _WLAN_MLME_API_H_ */

components/mlme/dispatcher/inc/wlan_mlme_public_struct.h

@@ -2089,6 +2089,8 @@ struct fw_scan_channels {
  * only on prior discovery of any 6 GHz support in the environment.
  * @disconnect_on_nud_roam_invoke_fail: indicate whether disconnect ap when
  * roam invoke fail on nud.
+ * @hs20_btm_offload_disable: indicate whether btm offload is enable/disable
+ * for Hotspot 2.0
  */
 struct wlan_mlme_lfr_cfg {
 	bool mawc_roam_enabled;
@@ -2217,6 +2219,7 @@ struct wlan_mlme_lfr_cfg {
 	uint8_t exclude_rm_partial_scan_freq;
 	uint8_t roam_full_scan_6ghz_on_disc;
 	bool disconnect_on_nud_roam_invoke_fail;
+	bool hs20_btm_offload_disable;
 };
 
 /**

components/mlme/dispatcher/src/wlan_mlme_api.c

@@ -1564,18 +1564,26 @@ QDF_STATUS wlan_mlme_set_sta_mlo_conn_max_num(struct wlan_objmgr_psoc *psoc,
 					      uint8_t value)
 {
 	struct wlan_mlme_psoc_ext_obj *mlme_obj;
+	struct target_psoc_info *tgt_hdl;
 
 	mlme_obj = mlme_get_psoc_ext_obj(psoc);
 	if (!mlme_obj)
 		return QDF_STATUS_E_FAILURE;
 
+	tgt_hdl = wlan_psoc_get_tgt_if_handle(psoc);
+	if (!tgt_hdl) {
+		mlme_err("target psoc info is NULL");
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	if (!value)
 		mlme_obj->cfg.sta.mlo_support_link_num =
-					  cfg_default(CFG_MLO_SUPPORT_LINK_NUM);
+				target_if_res_cfg_get_num_max_mlo_link(tgt_hdl);
 	else
 		mlme_obj->cfg.sta.mlo_support_link_num = value;
 
-	mlme_legacy_debug("mlo_support_link_num %d", value);
+	mlme_legacy_debug("mlo_support_link_num user input %d intersected value :%d",
+			  value, mlme_obj->cfg.sta.mlo_support_link_num);
 
 	return QDF_STATUS_SUCCESS;
 }
@@ -8338,3 +8346,21 @@ rel_pdev:
 	return status;
 }
 #endif
+
+QDF_STATUS
+wlan_mlme_is_hs_20_btm_offload_disabled(struct wlan_objmgr_psoc *psoc,
+					bool *val)
+{
+	struct wlan_mlme_psoc_ext_obj *mlme_obj;
+
+	mlme_obj = mlme_get_psoc_ext_obj(psoc);
+	if (!mlme_obj) {
+		*val = cfg_default(CFG_HS_20_BTM_OFFLOAD_DISABLE);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	*val = mlme_obj->cfg.lfr.hs20_btm_offload_disable;
+
+	return QDF_STATUS_SUCCESS;
+}
+

components/p2p/core/src/wlan_p2p_off_chan_tx.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -3168,7 +3168,6 @@ QDF_STATUS p2p_process_mgmt_tx(struct tx_action_context *tx_ctx)
 	struct wlan_objmgr_vdev *vdev;
 	QDF_STATUS status;
 	bool is_vdev_connected = false;
-	qdf_freq_t curr_op_freq;
 
 	status = p2p_tx_context_check_valid(tx_ctx);
 	if (status != QDF_STATUS_SUCCESS) {
@@ -3231,13 +3230,9 @@ QDF_STATUS p2p_process_mgmt_tx(struct tx_action_context *tx_ctx)
 	if (mode == QDF_STA_MODE)
 		is_vdev_connected = wlan_cm_is_vdev_connected(vdev);
 
-	curr_op_freq = wlan_get_operation_chan_freq(vdev);
-
 	wlan_objmgr_vdev_release_ref(vdev, WLAN_P2P_ID);
 
-	if (!tx_ctx->off_chan || !tx_ctx->chan_freq ||
-	    (curr_op_freq && curr_op_freq == tx_ctx->chan_freq &&
-	     !tx_ctx->duration)) {
+	if (!tx_ctx->off_chan || !tx_ctx->chan_freq) {
 		if (!tx_ctx->chan_freq)
 			p2p_check_and_update_channel(tx_ctx);
 		if (!tx_ctx->chan_freq && mode == QDF_STA_MODE &&

components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.c

@@ -2981,7 +2981,7 @@ cm_update_btm_offload_config(struct wlan_objmgr_psoc *psoc,
 {
 	struct wlan_mlme_psoc_ext_obj *mlme_obj;
 	struct wlan_mlme_btm *btm_cfg;
-	bool is_hs_20_ap;
+	bool is_hs_20_ap, is_hs_20_btm_offload_disabled;
 	struct cm_roam_values_copy temp;
 	uint8_t vdev_id;
 	bool abridge_flag;
@@ -3006,12 +3006,15 @@ cm_update_btm_offload_config(struct wlan_objmgr_psoc *psoc,
 	vdev_id = wlan_vdev_get_id(vdev);
 	wlan_cm_roam_cfg_get_value(psoc, vdev_id, HS_20_AP, &temp);
 	is_hs_20_ap = temp.bool_value;
+	wlan_mlme_is_hs_20_btm_offload_disabled(psoc,
+						&is_hs_20_btm_offload_disabled);
 
 	/*
 	 * For RSO Stop/Passpoint R2 cert test case 5.11(when STA is connected
 	 * to Hotspot-2.0 AP), disable BTM offload to firmware
 	 */
-	if (command == ROAM_SCAN_OFFLOAD_STOP || is_hs_20_ap) {
+	if (command == ROAM_SCAN_OFFLOAD_STOP ||
+	    (is_hs_20_ap && is_hs_20_btm_offload_disabled)) {
 		mlme_debug("RSO cmd: %d is_hs_20_ap:%d", command,
 			   is_hs_20_ap);
 		*btm_offload_config = 0;

components/umac/mlme/connection_mgr/core/src/wlan_cm_vdev_connect.c

@@ -1097,12 +1097,11 @@ QDF_STATUS cm_connect_start_ind(struct wlan_objmgr_vdev *vdev,
 	if (wlan_get_vendor_ie_ptr_from_oui(HS20_OUI_TYPE,
 					    HS20_OUI_TYPE_SIZE,
 					    req->assoc_ie.ptr,
-					    req->assoc_ie.len)) {
+					    req->assoc_ie.len))
 		src_cfg.bool_value = true;
-		wlan_cm_roam_cfg_set_value(wlan_vdev_get_psoc(vdev),
-					   wlan_vdev_get_id(vdev),
-					   HS_20_AP, &src_cfg);
-	}
+	wlan_cm_roam_cfg_set_value(wlan_vdev_get_psoc(vdev),
+				   wlan_vdev_get_id(vdev),
+				   HS_20_AP, &src_cfg);
 	if (req->source != CM_MLO_LINK_SWITCH_CONNECT)
 		ml_nlink_conn_change_notify(
 			psoc, wlan_vdev_get_id(vdev),
@@ -1163,7 +1162,7 @@ set_partner_info_for_2link_sap(struct scan_cache_entry *scan_entry,
 #endif
 
 static void
-cm_check_nontx_mbssid_partner_entries(struct cm_connect_req *conn_req)
+cm_check_ml_missing_partner_entries(struct cm_connect_req *conn_req)
 {
 	uint8_t idx;
 	struct scan_cache_entry *entry, *partner_entry;
@@ -1178,15 +1177,9 @@ cm_check_nontx_mbssid_partner_entries(struct cm_connect_req *conn_req)
 	 * If the entry is not one of following, return gracefully:
 	 *   -AP is not ML type
 	 *   -AP is SLO
-	 *   -AP is not a member of MBSSID set
-	 *   -AP BSSID equals to TxBSSID in MBSSID set
 	 */
-	if (!mld_addr || !entry->ml_info.num_links ||
-	    !entry->mbssid_info.profile_num ||
-	    !qdf_mem_cmp(entry->mbssid_info.trans_bssid, &entry->bssid,
-			 QDF_MAC_ADDR_SIZE)) {
+	if (!mld_addr || !entry->ml_info.num_links)
 		return;
-	}
 
 	for (idx = 0; idx < entry->ml_info.num_links; idx++) {
 		if (!entry->ml_info.link_info[idx].is_valid_link)
@@ -1271,7 +1264,7 @@ cm_get_ml_partner_info(struct wlan_objmgr_pdev *pdev,
 	mlme_debug("sta and ap intersect num of partner link: %d", j);
 
 	set_partner_info_for_2link_sap(scan_entry, partner_info);
-	cm_check_nontx_mbssid_partner_entries(conn_req);
+	cm_check_ml_missing_partner_entries(conn_req);
 
 	return QDF_STATUS_SUCCESS;
 }

components/umac/mlme/mlo_mgr/src/wlan_mlo_mgr_roam.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -1237,6 +1237,7 @@ mlo_roam_prepare_and_send_link_connect_req(struct wlan_objmgr_vdev *assoc_vdev,
 
 	req.ssid.length = ssid.length;
 	qdf_mem_copy(&req.ssid.ssid, &ssid.ssid, ssid.length);
+	qdf_copy_macaddr(&req.mld_addr, &rsp->mld_addr);
 
 	req.ml_parnter_info = rsp->ml_parnter_info;
 

components/wmi/src/wmi_unified_roam_tlv.c

@@ -4116,8 +4116,19 @@ extract_roam_synch_key_event_tlv(wmi_unified_t wmi_handle,
 	}
 
 	for (j = 0; j < WLAN_MAX_ML_BSS_LINKS; j++) {
-		if (key_entry[j].link_id != MLO_INVALID_LINK_IDX)
+		/*
+		 * Pairwise keys maybe copied for all the WLAN_MAX_ML_BSS_LINKS
+		 * but firmware might have roamed to AP with number of links
+		 * less than WLAN_MAX_ML_BSS_LINKS. So free the memory for those
+		 * links
+		 */
+		if (key_entry[j].link_id != MLO_INVALID_LINK_IDX) {
 			total_links++;
+		} else {
+			wmi_err_rl("Free keys for invalid entry at index:%d",
+				   j);
+			wlan_crypto_free_key(&key_entry[j].keys);
+		}
 	}
 
 	*num_entries = total_links;

configs/pineapple_gki_qca6750_defconfig

@@ -326,3 +326,4 @@ CONFIG_MULTI_IF_NAME="qca6750"
 CONFIG_CNSS_QCA6750=y
 CONFIG_BUILD_TAG=y
 CONFIG_DP_RX_DESC_COOKIE_INVALIDATE=y
+CONFIG_CFG80211_MLD_AP_STA_CONNECT_UPSTREAM_SUPPORT=y

core/hdd/src/wlan_hdd_hostapd.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -7227,6 +7227,16 @@ static int __wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 		goto exit;
 	}
 
+	/*
+	 * Reset sap mandatory channel list.If band is changed then
+	 * frequencies of new selected band can be removed in pcl
+	 * modification based on sap mandatory channel list.
+	 */
+	status = policy_mgr_reset_sap_mandatory_channels(hdd_ctx->psoc);
+	/* Don't go to exit in case of failure. Clean up & stop BSS */
+	if (QDF_IS_STATUS_ERROR(status))
+		hdd_err("failed to reset mandatory channels");
+
 	/*
 	 * For STA+SAP/GO concurrency support from GUI, In case if
 	 * STOP AP/GO request comes just before the SAE authentication

core/hdd/src/wlan_hdd_main.c

@@ -14168,6 +14168,9 @@ static int __hdd_psoc_idle_restart(struct hdd_context *hdd_ctx)
 
 	ret = hdd_wlan_start_modules(hdd_ctx, false);
 
+	if (!qdf_is_fw_down())
+		cds_set_recovery_in_progress(false);
+
 	hdd_soc_idle_restart_unlock();
 
 	return ret;

core/mac/inc/qwlan_version.h

@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            5
 #define QWLAN_VERSION_MINOR            2
 #define QWLAN_VERSION_PATCH            1
-#define QWLAN_VERSION_EXTRA            "B"
+#define QWLAN_VERSION_EXTRA            "S"
 #define QWLAN_VERSION_BUILD            86
 
-#define QWLAN_VERSIONSTR               "5.2.1.86B"
+#define QWLAN_VERSIONSTR               "5.2.1.86S"
 
 #endif /* QWLAN_VERSION_H */

core/mac/src/pe/lim/lim_api.c

@@ -89,6 +89,7 @@
 #include "wlan_tdls_api.h"
 #include "wlan_mlo_mgr_link_switch.h"
 #include "wlan_cm_api.h"
+#include "wlan_mlme_api.h"
 
 struct pe_hang_event_fixed_param {
 	uint16_t tlv_header;
@@ -4106,6 +4107,16 @@ QDF_STATUS lim_update_mlo_mgr_info(struct mac_context *mac_ctx,
 	channel.ch_phymode = cache_entry->phy_mode;
 	channel.ch_cfreq1 = cache_entry->channel.cfreq0;
 	channel.ch_cfreq2 = cache_entry->channel.cfreq1;
+	channel.ch_width =
+		wlan_mlme_get_ch_width_from_phymode(cache_entry->phy_mode);
+
+	/*
+	 * Supplicant needs non zero center_freq1 in case of 20 MHz connection
+	 * also as a response of get_channel request. In case of 20 MHz channel
+	 * width central frequency is same as channel frequency
+	 */
+	if (channel.ch_width == CH_WIDTH_20MHZ)
+		channel.ch_cfreq1 = channel.ch_freq;
 
 	util_scan_free_cache_entry(cache_entry);
 

core/mac/src/pe/lim/lim_assoc_utils.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2011-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -60,6 +60,9 @@
 #include <cdp_txrx_cfg.h>
 #include <cdp_txrx_cmn.h>
 #include <lim_mlo.h>
+#include "sir_mac_prot_def.h"
+#include "wlan_action_oui_public_struct.h"
+#include "wlan_action_oui_main.h"
 
 /**
  * lim_cmp_ssid() - utility function to compare SSIDs
@@ -3668,6 +3671,38 @@ void lim_sta_add_bss_update_ht_parameter(uint32_t bss_chan_freq,
 		add_bss->ch_width = CH_WIDTH_20MHZ;
 }
 
+/**
+ * lim_limit_bw_for_iot_ap() - limit sta vdev band width for iot ap
+ *@mac_ctx: mac context
+ *@session: pe session
+ *@bss_desc: bss descriptor
+ *
+ * When connect IoT AP, limit sta vdev band width
+ *
+ * Return: None
+ */
+static void
+lim_limit_bw_for_iot_ap(struct mac_context *mac_ctx,
+			struct pe_session *session,
+			struct bss_description *bss_desc)
+{
+	struct action_oui_search_attr vendor_ap_search_attr;
+	uint16_t ie_len;
+
+	ie_len = wlan_get_ielen_from_bss_description(bss_desc);
+
+	vendor_ap_search_attr.ie_data = (uint8_t *)&bss_desc->ieFields[0];
+	vendor_ap_search_attr.ie_length = ie_len;
+
+	if (wlan_action_oui_search(mac_ctx->psoc,
+				   &vendor_ap_search_attr,
+				   ACTION_OUI_LIMIT_BW)) {
+		pe_debug("Limit vdev %d bw to 40M for IoT AP",
+			 session->vdev_id);
+		wma_set_vdev_bw(session->vdev_id, eHT_CHANNEL_WIDTH_40MHZ);
+	}
+}
+
 QDF_STATUS lim_sta_send_add_bss(struct mac_context *mac, tpSirAssocRsp pAssocRsp,
 				   tpSchBeaconStruct pBeaconStruct,
 				   struct bss_description *bssDescription,
@@ -4119,6 +4154,8 @@ QDF_STATUS lim_sta_send_add_bss(struct mac_context *mac, tpSirAssocRsp pAssocRsp
 	}
 	qdf_mem_free(pAddBssParams);
 
+	lim_limit_bw_for_iot_ap(mac, pe_session, bssDescription);
+
 returnFailure:
 	/* Clean-up will be done by the caller... */
 	return retCode;

core/mac/src/pe/lim/lim_send_sme_rsp_messages.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1916,9 +1916,16 @@ static void update_csa_link_info(struct wlan_objmgr_vdev *vdev,
 				 uint8_t link_id,
 				 struct csa_offload_params *csa_params)
 {
+	struct wlan_objmgr_pdev *pdev;
 	uint8_t vdev_id = wlan_vdev_get_id(vdev);
 
-	mlo_mgr_update_csa_link_info(vdev->mlo_dev_ctx,
+	pdev = wlan_vdev_get_pdev(vdev);
+	if (!pdev) {
+		pe_err("pdev is null");
+		return;
+	}
+
+	mlo_mgr_update_csa_link_info(pdev, vdev->mlo_dev_ctx,
 				     csa_params, link_id);
 	pe_debug("vdev_id: %d link id %d mlo csa sta param updated ",
 		 vdev_id, link_id);

core/mac/src/sys/legacy/src/utils/src/parser_api.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -12177,11 +12177,19 @@ QDF_STATUS populate_dot11f_btm_extended_caps(struct mac_context *mac_ctx,
 	if (QDF_IS_STATUS_ERROR(status)) {
 		p_ext_cap->bss_transition = 0;
 		pe_debug("Disable btm for roaming not suppprted");
-	} else {
-		p_ext_cap->bss_transition = 1;
-		pe_debug("Enable btm for roaming suppprted");
 	}
 
+	if (!pe_session->lim_join_req)
+		goto compute_len;
+
+	if (p_ext_cap->bss_transition && !cm_is_open_mode(pe_session->vdev) &&
+	    pe_session->lim_join_req->bssDescription.mbo_oce_enabled_ap &&
+	    !pe_session->limRmfEnabled) {
+		pe_debug("Disable BTM as the MBO AP doesn't support PMF");
+		p_ext_cap->bss_transition = 0;
+	}
+
+compute_len:
 	dot11f->num_bytes = lim_compute_ext_cap_ie_length(dot11f);
 	if (!dot11f->num_bytes) {
 		dot11f->present = 0;

core/wma/inc/wma.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -2482,6 +2482,15 @@ QDF_STATUS wma_add_bss_lfr2_vdev_start(struct wlan_objmgr_vdev *vdev,
 				       struct bss_params *add_bss);
 #endif
 
+/**
+ * wma_set_vdev_bw() - wma send vdev bw
+ * @vdev_id: vdev id
+ * @bw: band width
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS wma_set_vdev_bw(uint8_t vdev_id, uint8_t bw);
+
 /**
  * wma_send_peer_assoc_req() - wma send peer assoc req when sta connect
  * @add_bss: add bss param

core/wma/src/wma_dev_if.c

@@ -4490,6 +4490,22 @@ send_fail_resp:
 }
 #endif
 
+QDF_STATUS wma_set_vdev_bw(uint8_t vdev_id, uint8_t bw)
+{
+	QDF_STATUS status;
+	tp_wma_handle wma = cds_get_context(QDF_MODULE_ID_WMA);
+
+	if (!wma)
+		return QDF_STATUS_E_INVAL;
+
+	status = wma_vdev_set_param(wma->wmi_handle, vdev_id,
+				    wmi_vdev_param_chwidth, bw);
+	if (QDF_IS_STATUS_ERROR(status))
+		wma_err("failed to set vdev bw, status: %d", status);
+
+	return status;
+}
+
 QDF_STATUS wma_send_peer_assoc_req(struct bss_params *add_bss)
 {
 	struct wma_target_req *msg;

core/wma/src/wma_features.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1416,7 +1416,7 @@ static bool handle_csa_standby_link(wmi_csa_event_fixed_param *csa_event,
 		return is_csa_standby;
 	}
 
-	mlo_mgr_update_csa_link_info(mldev, &csa_param, link_id);
+	mlo_mgr_update_csa_link_info(pdev, mldev, &csa_param, link_id);
 
 	params.link_id = link_info->link_id;
 	params.chan = qdf_mem_malloc(sizeof(struct wlan_channel));