Merge android13-gs-pixel-5.10-tm-qpr3 into android13-gs-pixel-5.10-udc

SBMerger: 516612970
Change-Id: Iee59c1ecf8c0082bfdcc9e2894393355f33ee091
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>

18 files changed, 236 insertions, 26 deletions

diff --git a/qca-wifi-host-cmn/os_if/linux/qca_vendor.h b/qca-wifi-host-cmn/os_if/linux/qca_vendor.h
index e9b0b93..66b9125 100644
--- a/qca-wifi-host-cmn/os_if/linux/qca_vendor.h
+++ b/qca-wifi-host-cmn/os_if/linux/qca_vendor.h
@@ -893,6 +893,28 @@ enum qca_wlan_vendor_hang_reason {
 	QCA_WLAN_HANG_BUS_FAILURE = 26,
 	/* tasklet/credit latency found */
 	QCA_WLAN_HANG_TASKLET_CREDIT_LATENCY_DETECT = 27,
+	/* MSDU buffers received in REO error ring, exceeding certain
+	 * threshold
+	 */
+	QCA_WLAN_HANG_RX_MSDU_BUF_RCVD_IN_ERR_RING = 28,
+	/* Vdev SM is out of sync and connect req received
+	 * when already connected
+	 */
+	QCA_WLAN_HANG_VDEV_SM_OUT_OF_SYNC = 29,
+	/* Stats request timeout */
+	QCA_WLAN_HANG_STATS_REQ_TIMEOUT = 30,
+	/* Leak in TX descriptor for a packet */
+	QCA_WLAN_HANG_TX_DESC_LEAK = 31,
+	/* Scheduler watchdog timeout */
+	QCA_WLAN_HANG_SCHED_TIMEOUT = 32,
+	/* Failed to send self peer deletion cmd to firmware */
+	QCA_WLAN_HANG_SELF_PEER_DEL_FAIL = 33,
+	/* Received del self sta without del bss */
+	QCA_WLAN_HANG_DEL_SELF_STA_FAIL = 34,
+	/* Recovery needed when sending flush completion to userspace */
+	QCA_WLAN_HANG_FLUSH_LOGS = 35,
+	/* Host wakeup because of page fault */
+	QCA_WLAN_HANG_HOST_WAKEUP_REASON_PAGE_FAULT = 36,
 };
 
 /**
diff --git a/qca-wifi-host-cmn/qdf/inc/qdf_types.h b/qca-wifi-host-cmn/qdf/inc/qdf_types.h
index 46fd3b5..b33e040 100644
--- a/qca-wifi-host-cmn/qdf/inc/qdf_types.h
+++ b/qca-wifi-host-cmn/qdf/inc/qdf_types.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1414,6 +1414,10 @@ enum qdf_suspend_type {
  * @QDF_STATS_REQ_TIMEDOUT: Stats request timedout
  * @QDF_RSO_STOP_RSP_TIMEOUT: Firmware hasn't sent RSO stop response
  * @QDF_HOST_WAKEUP_REASON_PAGEFAULT: Host wakeup because of pagefault
+ * @QDF_SCHED_TIMEOUT: Scheduler watchdog timedout
+ * @QDF_SELF_PEER_DEL_FAILED: Failed to send self peer deletion cmd to fw
+ * @QDF_DEL_SELF_STA_FAILED: Received del self sta without del bss
+ * @QDF_FLUSH_LOGS : Recovery needed when sending flush completion to userspace
  */
 enum qdf_hang_reason {
 	QDF_REASON_UNSPECIFIED,
@@ -1447,6 +1451,10 @@ enum qdf_hang_reason {
 	QDF_TX_DESC_LEAK,
 	QDF_RSO_STOP_RSP_TIMEOUT,
 	QDF_HOST_WAKEUP_REASON_PAGEFAULT,
+	QDF_SCHED_TIMEOUT,
+	QDF_SELF_PEER_DEL_FAILED,
+	QDF_DEL_SELF_STA_FAILED,
+	QDF_FLUSH_LOGS,
 };
 
 /**
diff --git a/qca-wifi-host-cmn/scheduler/src/scheduler_api.c b/qca-wifi-host-cmn/scheduler/src/scheduler_api.c
index 20a84a6..3b7951b 100644
--- a/qca-wifi-host-cmn/scheduler/src/scheduler_api.c
+++ b/qca-wifi-host-cmn/scheduler/src/scheduler_api.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -83,7 +84,8 @@ static void scheduler_watchdog_timeout(void *arg)
 	if (qdf_atomic_test_bit(MC_SHUTDOWN_EVENT_MASK, &sched->sch_event_flag))
 		return;
 
-	SCHED_DEBUG_PANIC("Going down for Scheduler Watchdog Bite!");
+	sched_err("Triggering self recovery on sheduler timeout");
+	qdf_trigger_self_recovery(NULL, QDF_SCHED_TIMEOUT);
 }
 
 QDF_STATUS scheduler_enable(void)
diff --git a/qca-wifi-host-cmn/utils/logging/src/wlan_logging_sock_svc.c b/qca-wifi-host-cmn/utils/logging/src/wlan_logging_sock_svc.c
index 58f5782..741a763 100644
--- a/qca-wifi-host-cmn/utils/logging/src/wlan_logging_sock_svc.c
+++ b/qca-wifi-host-cmn/utils/logging/src/wlan_logging_sock_svc.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -777,7 +777,7 @@ static void send_flush_completion_to_user(uint8_t ring_id)
 	wlan_report_log_completion(is_fatal, indicator, reason_code, ring_id);
 
 	if (recovery_needed)
-		cds_trigger_recovery(QDF_REASON_UNSPECIFIED);
+		cds_trigger_recovery(QDF_FLUSH_LOGS);
 }
 #endif
 
diff --git a/qcacld-3.0/components/mlme/core/src/wlan_mlme_main.c b/qcacld-3.0/components/mlme/core/src/wlan_mlme_main.c
index d524de6..ad4dafb 100644
--- a/qcacld-3.0/components/mlme/core/src/wlan_mlme_main.c
+++ b/qcacld-3.0/components/mlme/core/src/wlan_mlme_main.c
@@ -459,6 +459,8 @@ static void mlme_init_generic_cfg(struct wlan_objmgr_psoc *psoc,
 	gen->monitor_mode_concurrency =
 		cfg_get(psoc, CFG_MONITOR_MODE_CONCURRENCY);
 	gen->tx_retry_multiplier = cfg_get(psoc, CFG_TX_RETRY_MULTIPLIER);
+	gen->enable_he_mcs0_for_6ghz_mgmt =
+		cfg_get(psoc, CFG_ENABLE_HE_MCS0_MGMT_6GHZ);
 	mlme_init_wds_config_cfg(psoc, gen);
 	mlme_init_mgmt_hw_tx_retry_count_cfg(psoc, gen);
 }
diff --git a/qcacld-3.0/components/mlme/dispatcher/inc/cfg_mlme_generic.h b/qcacld-3.0/components/mlme/dispatcher/inc/cfg_mlme_generic.h
index 37ca1eb..95c0680 100644
--- a/qcacld-3.0/components/mlme/dispatcher/inc/cfg_mlme_generic.h
+++ b/qcacld-3.0/components/mlme/dispatcher/inc/cfg_mlme_generic.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -683,6 +683,26 @@ enum wlan_wds_mode {
 
 /*
  * <ini>
+ * enable_he_mcs0_for_mgmt_6ghz- if disabled FW will use 6Mbps 11A rate
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * If this ini is disabled firmware will use 6Mbps 11A rate
+ *
+ * Supported Feature: STA/SAP
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_ENABLE_HE_MCS0_MGMT_6GHZ CFG_INI_BOOL( \
+	"enable_he_mcs0_for_mgmt_6ghz", \
+	0, \
+	"MCS0 rate for 6ghz mgmt frames")
+
+/*
+ * <ini>
  * bmiss_skip_full_scan - To decide whether firmware does channel map based
  * partial scan or partial scan followed by full scan in case no candidate is
  * found in partial scan.
@@ -964,6 +984,7 @@ enum wlan_wds_mode {
 	CFG(CFG_ITO_REPEAT_COUNT) \
 	CFG(CFG_ENABLE_BEACON_RECEPTION_STATS) \
 	CFG(CFG_MGMT_RETRY_MAX) \
+	CFG(CFG_ENABLE_HE_MCS0_MGMT_6GHZ) \
 	CFG(CFG_BMISS_SKIP_FULL_SCAN) \
 	CFG(CFG_ENABLE_RING_BUFFER) \
 	CFG(CFG_DFS_CHAN_AGEOUT_TIME) \
diff --git a/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_api.h b/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_api.h
index 1e21a3b..b9a6d95 100644
--- a/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_api.h
+++ b/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_api.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -2669,6 +2669,18 @@ wlan_mlme_get_mgmt_max_retry(struct wlan_objmgr_psoc *psoc,
 			     uint8_t *max_retry);
 
 /**
+ * wlan_mlme_get_mgmt_6ghz_rate_support() - Get status of HE rates for
+ * 6GHz mgmt frames
+ * @psoc: pointer to psoc object
+ * @enable_he_mcs0_for_6ghz_mgmt: pointer to check for HE rates support
+ *
+ * Return: QDF Status
+ */
+QDF_STATUS
+wlan_mlme_get_mgmt_6ghz_rate_support(struct wlan_objmgr_psoc *psoc,
+				     bool *enable_he_mcs0_for_6ghz_mgmt);
+
+/**
  * wlan_mlme_get_status_ring_buffer() - Get the
  * status of ring buffer
  * @psoc: pointer to psoc object
diff --git a/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h b/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
index c9077b3..c46ecd1 100644
--- a/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
+++ b/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
@@ -1322,6 +1322,7 @@ enum mlme_cfg_frame_type {
  * @disable_4way_hs_offload: enable/disable 4 way handshake offload to firmware
  * @as_enabled: antenna sharing enabled or not (FW capability)
  * @mgmt_retry_max: maximum retries for management frame
+ * @enable_he_mcs0_for_6ghz_mgmt: HE MCS0 rate for mgmt frames in 6GHz band
  * @bmiss_skip_full_scan: Decide if full scan can be skipped in firmware if no
  * candidate is found in partial scan based on channel map
  * @enable_ring_buffer: Decide to enable/disable ring buffer for bug report
@@ -1373,6 +1374,7 @@ struct wlan_mlme_generic {
 	uint32_t disable_4way_hs_offload;
 	bool as_enabled;
 	uint8_t mgmt_retry_max;
+	bool enable_he_mcs0_for_6ghz_mgmt;
 	bool bmiss_skip_full_scan;
 	bool enable_ring_buffer;
 	bool enable_peer_unmap_conf_support;
diff --git a/qcacld-3.0/components/mlme/dispatcher/src/wlan_mlme_api.c b/qcacld-3.0/components/mlme/dispatcher/src/wlan_mlme_api.c
index 56dd1b0..bb348c2 100644
--- a/qcacld-3.0/components/mlme/dispatcher/src/wlan_mlme_api.c
+++ b/qcacld-3.0/components/mlme/dispatcher/src/wlan_mlme_api.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -4352,6 +4352,25 @@ wlan_mlme_get_mgmt_max_retry(struct wlan_objmgr_psoc *psoc,
 }
 
 QDF_STATUS
+wlan_mlme_get_mgmt_6ghz_rate_support(struct wlan_objmgr_psoc *psoc,
+				     bool *enable_he_mcs0_for_6ghz_mgmt)
+{
+	struct wlan_mlme_psoc_ext_obj *mlme_obj;
+
+	mlme_obj = mlme_get_psoc_ext_obj(psoc);
+
+	if (!mlme_obj) {
+		*enable_he_mcs0_for_6ghz_mgmt =
+			cfg_default(CFG_ENABLE_HE_MCS0_MGMT_6GHZ);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	*enable_he_mcs0_for_6ghz_mgmt =
+		mlme_obj->cfg.gen.enable_he_mcs0_for_6ghz_mgmt;
+	return QDF_STATUS_SUCCESS;
+}
+
+QDF_STATUS
 wlan_mlme_get_status_ring_buffer(struct wlan_objmgr_psoc *psoc,
 				 bool *enable_ring_buffer)
 {
diff --git a/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c b/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c
index 9a46c9c..760a74b 100644
--- a/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c
@@ -1188,6 +1188,33 @@ hdd_convert_hang_reason(enum qdf_hang_reason reason)
 	case QDF_TASKLET_CREDIT_LATENCY_DETECT:
 		ret_val = QCA_WLAN_HANG_TASKLET_CREDIT_LATENCY_DETECT;
 		break;
+	case QDF_RX_REG_PKT_ROUTE_ERR:
+		ret_val = QCA_WLAN_HANG_RX_MSDU_BUF_RCVD_IN_ERR_RING;
+		break;
+	case QDF_VDEV_SM_OUT_OF_SYNC:
+		ret_val = QCA_WLAN_HANG_VDEV_SM_OUT_OF_SYNC;
+		break;
+	case QDF_STATS_REQ_TIMEDOUT:
+		ret_val = QCA_WLAN_HANG_STATS_REQ_TIMEOUT;
+		break;
+	case QDF_TX_DESC_LEAK:
+		ret_val = QCA_WLAN_HANG_TX_DESC_LEAK;
+		break;
+	case QDF_SCHED_TIMEOUT:
+		ret_val = QCA_WLAN_HANG_SCHED_TIMEOUT;
+		break;
+	case QDF_SELF_PEER_DEL_FAILED:
+		ret_val = QCA_WLAN_HANG_SELF_PEER_DEL_FAIL;
+		break;
+	case QDF_DEL_SELF_STA_FAILED:
+		ret_val = QCA_WLAN_HANG_DEL_SELF_STA_FAIL;
+		break;
+	case QDF_FLUSH_LOGS:
+		ret_val = QCA_WLAN_HANG_FLUSH_LOGS;
+		break;
+	case QDF_HOST_WAKEUP_REASON_PAGEFAULT:
+		ret_val = QCA_WLAN_HANG_HOST_WAKEUP_REASON_PAGE_FAULT;
+		break;
 	case QDF_REASON_UNSPECIFIED:
 	default:
 		ret_val = QCA_WLAN_HANG_REASON_UNSPECIFIED;
diff --git a/qcacld-3.0/core/hdd/src/wlan_hdd_main.c b/qcacld-3.0/core/hdd/src/wlan_hdd_main.c
index be49650..536d080 100644
--- a/qcacld-3.0/core/hdd/src/wlan_hdd_main.c
+++ b/qcacld-3.0/core/hdd/src/wlan_hdd_main.c
@@ -320,6 +320,7 @@ static qdf_wake_lock_t wlan_wake_lock;
 #define WOW_MAX_FILTERS_PER_LIST 4
 #define WOW_MIN_PATTERN_SIZE 6
 #define WOW_MAX_PATTERN_SIZE 64
+#define MGMT_DEFAULT_DATA_RATE_6GHZ 0x400 /* This maps to 8.6Mbps data rate */
 
 #define IS_IDLE_STOP (!cds_is_driver_unloading() && \
 		      !cds_is_driver_recovering() && !cds_is_driver_loading())
@@ -14543,6 +14544,7 @@ static int hdd_pre_enable_configure(struct hdd_context *hdd_ctx)
 	int ret;
 	uint8_t val = 0;
 	uint8_t max_retry = 0;
+	bool enable_he_mcs0_for_6ghz_mgmt = false;
 	uint32_t tx_retry_multiplier;
 	QDF_STATUS status;
 	void *soc = cds_get_context(QDF_MODULE_ID_SOC);
@@ -14594,6 +14596,20 @@ static int hdd_pre_enable_configure(struct hdd_context *hdd_ctx)
 		goto out;
 	}
 
+	wlan_mlme_get_mgmt_6ghz_rate_support(hdd_ctx->psoc,
+					     &enable_he_mcs0_for_6ghz_mgmt);
+	if (enable_he_mcs0_for_6ghz_mgmt) {
+		hdd_debug("HE rates for 6GHz mgmt frames are supported");
+		ret = sme_cli_set_command(0, WMI_PDEV_PARAM_DEFAULT_6GHZ_RATE,
+					  MGMT_DEFAULT_DATA_RATE_6GHZ,
+					  PDEV_CMD);
+		if (0 != ret) {
+			hdd_err("WMI_PDEV_PARAM_DEFAULT_6GHZ_RATE failed %d",
+				ret);
+			goto out;
+		}
+	}
+
 	wlan_mlme_get_tx_retry_multiplier(hdd_ctx->psoc,
 					  &tx_retry_multiplier);
 	ret = sme_cli_set_command(0, WMI_PDEV_PARAM_PDEV_STATS_TX_XRETRY_EXT,
diff --git a/qcacld-3.0/core/mac/src/pe/include/lim_api.h b/qcacld-3.0/core/mac/src/pe/include/lim_api.h
index a553dca..8054ec2 100644
--- a/qcacld-3.0/core/mac/src/pe/include/lim_api.h
+++ b/qcacld-3.0/core/mac/src/pe/include/lim_api.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2011-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -534,6 +534,17 @@ void lim_set_twt_peer_capabilities(struct mac_context *mac_ctx,
 #endif
 
 /**
+ * lim_get_basic_rates() - Get basic rates for the given frequency
+ * @b_rates: Pointer to rates
+ * @chan_freq: frequency for which rates are required
+ *
+ * This api will get basic rates for the given frequency
+ *
+ * Return: void
+ */
+void lim_get_basic_rates(tSirMacRateSet *b_rates, uint32_t chan_freq);
+
+/**
  * lim_fill_pe_session() - Lim fill pe session
  * @mac_ctx: Pointer to mac context
  * @session: pe session
diff --git a/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index bba298f..0451464 100644
--- a/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -2708,7 +2708,7 @@ lim_fill_ese_params(struct mac_context *mac_ctx, struct pe_session *session,
 }
 #endif
 
-static void lim_get_basic_rates(tSirMacRateSet *b_rates, uint32_t chan_freq)
+void lim_get_basic_rates(tSirMacRateSet *b_rates, uint32_t chan_freq)
 {
 	/*
 	 * Some IOT APs don't send supported rates in
diff --git a/qcacld-3.0/core/mac/src/pe/lim/lim_send_management_frames.c b/qcacld-3.0/core/mac/src/pe/lim/lim_send_management_frames.c
index e35404a..dab9190 100644
--- a/qcacld-3.0/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/qcacld-3.0/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -2836,7 +2836,7 @@ lim_send_assoc_req_mgmt_frame(struct mac_context *mac_ctx,
 	QDF_TRACE_HEX_DUMP(QDF_MODULE_ID_PE, QDF_TRACE_LEVEL_DEBUG,
 			  frame, (uint16_t)(sizeof(tSirMacMgmtHdr) + payload));
 
-	min_rid = lim_get_min_session_txrate(pe_session);
+	min_rid = lim_get_min_session_txrate(pe_session, NULL);
 	lim_diag_event_report(mac_ctx, WLAN_PE_DIAG_ASSOC_START_EVENT,
 			      pe_session, QDF_STATUS_SUCCESS, QDF_STATUS_SUCCESS);
 	lim_diag_mgmt_tx_event_report(mac_ctx, mac_hdr,
@@ -3392,7 +3392,7 @@ alloc_packet:
 			 session->peSessionId, mac_hdr->fc.subType));
 
 	mac_ctx->auth_ack_status = LIM_ACK_NOT_RCD;
-	min_rid = lim_get_min_session_txrate(session);
+	min_rid = lim_get_min_session_txrate(session, NULL);
 	peer_rssi = mac_ctx->lim.bss_rssi;
 	lim_diag_mgmt_tx_event_report(mac_ctx, mac_hdr,
 				      session, QDF_STATUS_SUCCESS, QDF_STATUS_SUCCESS);
@@ -6051,6 +6051,8 @@ static void lim_tx_mgmt_frame(struct mac_context *mac_ctx, uint8_t vdev_id,
 	struct pe_session *session;
 	uint16_t auth_ack_status;
 	enum rateid min_rid = RATEID_DEFAULT;
+	qdf_freq_t *pre_auth_freq = NULL;
+	qdf_freq_t ch_freq = 0;
 
 	session = pe_find_session_by_vdev_id(mac_ctx, vdev_id);
 	if (!session) {
@@ -6063,7 +6065,23 @@ static void lim_tx_mgmt_frame(struct mac_context *mac_ctx, uint8_t vdev_id,
 	qdf_mtrace(QDF_MODULE_ID_PE, QDF_MODULE_ID_WMA, TRACE_CODE_TX_MGMT,
 		   session->peSessionId, 0);
 
-	min_rid = lim_get_min_session_txrate(session);
+	if (fc->subType == SIR_MAC_MGMT_AUTH) {
+		tpSirFTPreAuthReq pre_auth_req;
+		uint16_t auth_algo = *(uint16_t *)(frame +
+						   sizeof(tSirMacMgmtHdr));
+
+		if (auth_algo == eSIR_AUTH_TYPE_SAE) {
+			if (session->ftPEContext.pFTPreAuthReq) {
+				pre_auth_req =
+					     session->ftPEContext.pFTPreAuthReq;
+				ch_freq = pre_auth_req->pre_auth_channel_freq;
+			}
+			pre_auth_freq = &ch_freq;
+		}
+		pe_debug("TX SAE pre-auth frame on freq %d", ch_freq);
+	}
+
+	min_rid = lim_get_min_session_txrate(session, pre_auth_freq);
 
 	qdf_status = wma_tx_frameWithTxComplete(mac_ctx, packet,
 					 (uint16_t)msg_len,
diff --git a/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c b/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c
index bfd4fab..58a0f6a 100644
--- a/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c
+++ b/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2011-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -8874,21 +8874,69 @@ QDF_STATUS lim_util_get_type_subtype(void *pkt, uint8_t *type,
 	return QDF_STATUS_SUCCESS;
 }
 
-enum rateid lim_get_min_session_txrate(struct pe_session *session)
+static void lim_get_min_rate(uint8_t *min_rate, tSirMacRateSet *rateset)
+{
+	uint8_t curr_rate, i;
+
+	for (i = 0; i < rateset->numRates; i++) {
+		/* Ignore MSB - set to indicate basic rate */
+		curr_rate = rateset->rate[i] & 0x7F;
+		*min_rate = (curr_rate < *min_rate) ? curr_rate :
+			    *min_rate;
+	}
+
+	pe_debug("supported min_rate: %0x(%d)", *min_rate, *min_rate);
+}
+
+static bool lim_is_enable_he_mcs0_for_6ghz_mgmt(struct pe_session *session,
+						qdf_freq_t freq)
+{
+	bool enable_he_mcs0_for_6ghz_mgmt = false;
+
+	if (!wlan_reg_is_6ghz_chan_freq(freq))
+		return enable_he_mcs0_for_6ghz_mgmt;
+
+	/*
+	 * For 6GHz freq and if enable_he_mcs0_for_mgmt_6ghz INI is
+	 * enabled then FW will use rate of MCS0 for 11AX and configured
+	 * via WMI_MGMT_TX_SEND_CMDID
+	 */
+	wlan_mlme_get_mgmt_6ghz_rate_support(
+			session->mac_ctx->psoc,
+			&enable_he_mcs0_for_6ghz_mgmt);
+
+	return enable_he_mcs0_for_6ghz_mgmt;
+}
+
+enum rateid lim_get_min_session_txrate(struct pe_session *session,
+				       qdf_freq_t *pre_auth_freq)
 {
 	enum rateid rid = RATEID_DEFAULT;
-	uint8_t min_rate = SIR_MAC_RATE_54, curr_rate, i;
-	tSirMacRateSet *rateset = &session->rateSet;
+	uint8_t min_rate = SIR_MAC_RATE_54;
+	tSirMacRateSet *rateset;
+	qdf_freq_t op_freq;
 
 	if (!session)
 		return rid;
 
-	for (i = 0; i < rateset->numRates; i++) {
-		/* Ignore MSB - set to indicate basic rate */
-		curr_rate = rateset->rate[i] & 0x7F;
-		min_rate =  (curr_rate < min_rate) ? curr_rate : min_rate;
+	rateset = &session->rateSet;
+
+	if (pre_auth_freq) {
+		pe_debug("updated rateset to pre auth freq %d",
+			 *pre_auth_freq);
+		if (*pre_auth_freq &&
+		    !lim_is_enable_he_mcs0_for_6ghz_mgmt(session,
+							*pre_auth_freq))
+				lim_get_basic_rates(rateset, *pre_auth_freq);
+		else
+			return rid;
 	}
-	pe_debug("supported min_rate: %0x(%d)", min_rate, min_rate);
+
+	op_freq = wlan_get_operation_chan_freq(session->vdev);
+	if (lim_is_enable_he_mcs0_for_6ghz_mgmt(session, op_freq))
+		return rid;
+
+	lim_get_min_rate(&min_rate, rateset);
 
 	switch (min_rate) {
 	case SIR_MAC_RATE_1:
diff --git a/qcacld-3.0/core/mac/src/pe/lim/lim_utils.h b/qcacld-3.0/core/mac/src/pe/lim/lim_utils.h
index b3876d3..c726842 100644
--- a/qcacld-3.0/core/mac/src/pe/lim/lim_utils.h
+++ b/qcacld-3.0/core/mac/src/pe/lim/lim_utils.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -2199,13 +2199,15 @@ QDF_STATUS lim_util_get_type_subtype(void *pkt, uint8_t *type,
 /**
  * lim_get_min_session_txrate() - Get the minimum rate supported in the session
  * @session: Pointer to PE session
+ * @pre_auth_freq: Pointer to pre_auth_freq
  *
  * This API will find the minimum rate supported by the given PE session and
  * return the enum rateid corresponding to the rate.
  *
  * Return: enum rateid
  */
-enum rateid lim_get_min_session_txrate(struct pe_session *session);
+enum rateid lim_get_min_session_txrate(struct pe_session *session,
+				       qdf_freq_t *pre_auth_freq);
 
 /**
  * lim_send_dfs_chan_sw_ie_update() - updates the channel switch IE in beacon
diff --git a/qcacld-3.0/core/wma/src/wma_dev_if.c b/qcacld-3.0/core/wma/src/wma_dev_if.c
index 17e60dc..358b028 100644
--- a/qcacld-3.0/core/wma/src/wma_dev_if.c
+++ b/qcacld-3.0/core/wma/src/wma_dev_if.c
@@ -688,7 +688,7 @@ static QDF_STATUS wma_vdev_self_peer_delete(tp_wma_handle wma_handle,
 				vdev_id);
 			wma_handle_vdev_detach(wma_handle, pdel_vdev_req_param);
 			mlme_vdev_self_peer_delete_resp(pdel_vdev_req_param);
-			cds_trigger_recovery(QDF_REASON_UNSPECIFIED);
+			cds_trigger_recovery(QDF_SELF_PEER_DEL_FAILED);
 			return status;
 		}
 	} else if (iface->type == WMI_VDEV_TYPE_STA) {
@@ -751,7 +751,7 @@ QDF_STATUS wma_vdev_detach(struct del_vdev_params *pdel_vdev_req_param)
 
 send_fail_rsp:
 	wma_err("rcvd del_self_sta without del_bss; vdev_id:%d", vdev_id);
-	cds_trigger_recovery(QDF_REASON_UNSPECIFIED);
+	cds_trigger_recovery(QDF_DEL_SELF_STA_FAILED);
 	status = QDF_STATUS_E_FAILURE;
 	return status;
 }
diff --git a/qcacld-3.0/core/wma/src/wma_scan_roam.c b/qcacld-3.0/core/wma/src/wma_scan_roam.c
index 548ad52..9b0fd2f 100644
--- a/qcacld-3.0/core/wma/src/wma_scan_roam.c
+++ b/qcacld-3.0/core/wma/src/wma_scan_roam.c
@@ -1583,7 +1583,7 @@ int wma_extscan_hotlist_match_event_handler(void *handle,
 		return -ENOMEM;
 
 	dest_ap = &dest_hotlist->ap[0];
-	dest_hotlist->numOfAps = event->total_entries;
+	dest_hotlist->numOfAps = numap;
 	dest_hotlist->requestId = event->config_request_id;
 
 	if (event->first_entry_index +