Merge "Release 1.0.0.194 QCACLD WLAN Driver"

20 files changed, 504 insertions, 36 deletions

diff --git a/CORE/HDD/inc/qc_sap_ioctl.h b/CORE/HDD/inc/qc_sap_ioctl.h
index 2f4391804287..60ab9b92baf3 100644
--- a/CORE/HDD/inc/qc_sap_ioctl.h
+++ b/CORE/HDD/inc/qc_sap_ioctl.h
@@ -241,6 +241,7 @@ enum {
     QCASAP_NSS_CMD,
     QCSAP_IPA_UC_STAT,
     QCASAP_SET_PHYMODE,
+    QCASAP_GET_TEMP_CMD,
 };
 
 int iw_softap_get_channel_list(struct net_device *dev,
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index 2401b6cbbf02..b5be5c184620 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -284,6 +284,7 @@ extern spinlock_t hdd_context_lock;
 #define SNR_CONTEXT_MAGIC   0x534E5200   //SNR
 #define LINK_CONTEXT_MAGIC  0x4C494E4B   //LINKSPEED
 #define LINK_STATUS_MAGIC   0x4C4B5354   //LINKSTATUS(LNST)
+#define TEMP_CONTEXT_MAGIC 0x74656d70   // TEMP (temperature)
 
 #ifdef FEATURE_WLAN_BATCH_SCAN
 #define HDD_BATCH_SCAN_VERSION (17)
@@ -1103,6 +1104,9 @@ struct hdd_adapter_s
    v_BOOL_t isLinkLayerStatsSet;
 #endif
    v_U8_t linkStatus;
+
+   /* variable for temperature in Celsius */
+   int temperature;
 };
 
 #define WLAN_HDD_GET_STATION_CTX_PTR(pAdapter) (&(pAdapter)->sessionCtx.station)
diff --git a/CORE/HDD/inc/wlan_hdd_wext.h b/CORE/HDD/inc/wlan_hdd_wext.h
index b522f830fa95..f4b73f78b1b3 100644
--- a/CORE/HDD/inc/wlan_hdd_wext.h
+++ b/CORE/HDD/inc/wlan_hdd_wext.h
@@ -441,4 +441,8 @@ int wlan_hdd_update_phymode(struct net_device *net, tHalHandle hal,
 
 int process_wma_set_command_twoargs(int sessid, int paramid,
                                     int sval, int ssecval, int vpdev);
+
+void hdd_GetTemperatureCB(int temperature, void *pContext);
+VOS_STATUS wlan_hdd_get_temperature(hdd_adapter_t *pAdapter,
+        union iwreq_data *wrqu, char *extra);
 #endif // __WEXT_IW_H__
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 8dee6a9d7057..502948901ea6 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -11325,12 +11325,18 @@ static int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
 
     if ((WLAN_HDD_SOFTAP == pAdapter->device_mode) ||
         (WLAN_HDD_P2P_GO == pAdapter->device_mode)) {
-        if (NULL == mac) {
+        if ((NULL == mac) || (vos_is_macaddr_broadcast((v_MACADDR_t *)mac))) {
             v_U16_t i;
             for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
                 if ((pAdapter->aStaInfo[i].isUsed) &&
                     (!pAdapter->aStaInfo[i].isDeauthInProgress)) {
                     u8 *macAddr = pAdapter->aStaInfo[i].macAddrSTA.bytes;
+#ifdef IPA_UC_OFFLOAD
+                    if (pHddCtx->cfg_ini->IpaUcOffloadEnabled) {
+                       hdd_ipa_wlan_evt(pAdapter, pAdapter->aStaInfo[i].ucSTAId,
+                          WLAN_CLIENT_DISCONNECT, macAddr);
+                    }
+#endif /* IPA_UC_OFFLOAD */
                     hddLog(VOS_TRACE_LEVEL_INFO,
                            FL("Delete STA with MAC::"MAC_ADDRESS_STR),
                            MAC_ADDR_ARRAY(macAddr));
@@ -11351,6 +11357,13 @@ static int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
                 return -ENOENT;
             }
 
+#ifdef IPA_UC_OFFLOAD
+            if (pHddCtx->cfg_ini->IpaUcOffloadEnabled) {
+               hdd_ipa_wlan_evt(pAdapter, staId,
+                  WLAN_CLIENT_DISCONNECT, mac);
+            }
+#endif /* IPA_UC_OFFLOAD */
+
             if (pAdapter->aStaInfo[staId].isDeauthInProgress == TRUE) {
                 hddLog(VOS_TRACE_LEVEL_INFO,
                        FL("Skip DEL STA as deauth is in progress::"
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index ea47cc878509..ef542f96d445 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -3024,7 +3024,12 @@ static iw_softap_getparam(struct net_device *dev,
                         VDEV_CMD);
             break;
         }
-
+    case QCASAP_GET_TEMP_CMD:
+        {
+            hddLog(VOS_TRACE_LEVEL_INFO, "QCASAP_GET_TEMP_CMD");
+            ret = wlan_hdd_get_temperature(pHostapdAdapter, wrqu, extra);
+            break;
+        }
     default:
         hddLog(LOGE, FL("Invalid getparam command %d"), sub_cmd);
         ret = -EINVAL;
@@ -4873,6 +4878,8 @@ static const struct iw_priv_args hostapd_private_args[] = {
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "get_rxchainmask" },
   { QCASAP_NSS_CMD, 0,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "get_nss" },
+  { QCASAP_GET_TEMP_CMD, 0,
+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "get_temp" },
 
   { QCSAP_IOCTL_GET_STAWPAIE,
       IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "get_staWPAIE" },
diff --git a/CORE/HDD/src/wlan_hdd_ipa.c b/CORE/HDD/src/wlan_hdd_ipa.c
index 2f37f3c257d9..cd920ecece87 100644
--- a/CORE/HDD/src/wlan_hdd_ipa.c
+++ b/CORE/HDD/src/wlan_hdd_ipa.c
@@ -285,6 +285,11 @@ struct hdd_ipa_stats {
 };
 
 #ifdef IPA_UC_OFFLOAD
+struct ipa_uc_stas_map {
+	v_BOOL_t is_reserved;
+	uint8_t sta_id;
+};
+
 struct op_msg_type {
 	uint8_t msg_t;
 	uint8_t rsvd;
@@ -370,12 +375,14 @@ struct hdd_ipa_priv {
 	uint32_t curr_cons_bw;
 
 #ifdef IPA_UC_OFFLOAD
+	uint8_t activated_fw_pipe;
 	uint8_t sap_num_connected_sta;
 	uint32_t tx_pipe_handle;
 	uint32_t rx_pipe_handle;
 	v_BOOL_t resource_loading;
 	v_BOOL_t resource_unloading;
 	v_BOOL_t pending_cons_req;
+	struct ipa_uc_stas_map  assoc_stas_map[WLAN_MAX_STA_COUNT];
 #endif /* IPA_UC_OFFLOAD */
 };
 
@@ -536,6 +543,68 @@ static bool hdd_ipa_can_send_to_ipa(hdd_adapter_t *adapter, struct hdd_ipa_priv
 }
 
 #ifdef IPA_UC_OFFLOAD
+static v_BOOL_t hdd_ipa_uc_find_add_assoc_sta(
+	struct hdd_ipa_priv *hdd_ipa,
+	v_BOOL_t sta_add,
+	uint8_t sta_id)
+{
+	/* Found associated sta */
+	v_BOOL_t sta_found = VOS_FALSE;
+	uint8_t idx;
+
+	for (idx = 0; idx < WLAN_MAX_STA_COUNT; idx++) {
+		if ((hdd_ipa->assoc_stas_map[idx].is_reserved) &&
+			(hdd_ipa->assoc_stas_map[idx].sta_id == sta_id)) {
+			sta_found = VOS_TRUE;
+			break;
+		}
+	}
+
+	/* Try to add sta which is already in
+	 * If the sta is already in, just return sta_found */
+	if (sta_add && sta_found) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"%s: STA ID %d already exist, cannot add",
+			__func__, sta_id);
+		return sta_found;
+	}
+
+	if (sta_add) {
+		/* Find first empty slot */
+		for (idx = 0; idx < WLAN_MAX_STA_COUNT; idx++) {
+			if (!hdd_ipa->assoc_stas_map[idx].is_reserved) {
+				hdd_ipa->assoc_stas_map[idx].is_reserved =
+					VOS_TRUE;
+				hdd_ipa->assoc_stas_map[idx].sta_id = sta_id;
+				return sta_found;
+			}
+		}
+	}
+
+	/* Delete STA from map, but could not find STA within the map
+	 * Error case, add error log */
+	if (!sta_add && !sta_found) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"%s: STA ID %d does not exist, cannot delete",
+			__func__, sta_id);
+		return sta_found;
+	}
+
+	if (!sta_add) {
+		for (idx = 0; idx < WLAN_MAX_STA_COUNT; idx++) {
+			if ((hdd_ipa->assoc_stas_map[idx].is_reserved) &&
+			(hdd_ipa->assoc_stas_map[idx].sta_id == sta_id)) {
+				hdd_ipa->assoc_stas_map[idx].is_reserved =
+					VOS_FALSE;
+				hdd_ipa->assoc_stas_map[idx].sta_id = 0xFF;
+				return sta_found;
+			}
+		}
+	}
+
+	return sta_found;
+}
+
 static int hdd_ipa_uc_enable_pipes(struct hdd_ipa_priv *hdd_ipa)
 {
 	int result;
@@ -630,11 +699,8 @@ static int hdd_ipa_uc_disable_pipes(struct hdd_ipa_priv *hdd_ipa)
 		return result;
 	}
 
-
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
 		"%s: Disable RX PIPE", __func__);
-	WLANTL_SetUcActive(hdd_ipa->hdd_ctx->pvosContext,
-		VOS_FALSE, VOS_FALSE);
 	result = ipa_suspend_wdi_pipe(hdd_ipa->rx_pipe_handle);
 	if (result) {
 		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
@@ -652,8 +718,6 @@ static int hdd_ipa_uc_disable_pipes(struct hdd_ipa_priv *hdd_ipa)
 
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
 		"%s: Disable TX PIPE", __func__);
-	WLANTL_SetUcActive(hdd_ipa->hdd_ctx->pvosContext,
-		VOS_FALSE, VOS_TRUE);
 	result = ipa_suspend_wdi_pipe(hdd_ipa->tx_pipe_handle);
 	if (result) {
 		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
@@ -674,6 +738,7 @@ static int hdd_ipa_uc_disable_pipes(struct hdd_ipa_priv *hdd_ipa)
 
 static int hdd_ipa_uc_handle_first_con(struct hdd_ipa_priv *hdd_ipa)
 {
+	hdd_ipa->activated_fw_pipe = 0;
 	hdd_ipa->resource_loading = VOS_TRUE;
 	/* If RM feature enabled
 	 * Request PROD Resource first
@@ -704,15 +769,14 @@ static int hdd_ipa_uc_handle_first_con(struct hdd_ipa_priv *hdd_ipa)
 static int hdd_ipa_uc_handle_last_discon(struct hdd_ipa_priv *hdd_ipa)
 {
 	hdd_ipa->resource_unloading = VOS_TRUE;
-	hdd_ipa_uc_disable_pipes(hdd_ipa);
-	if ((hdd_ipa_is_rm_enabled(hdd_ipa)) &&
-		(!ipa_rm_release_resource(IPA_RM_RESOURCE_WLAN_PROD))) {
-		/* Sync return success from IPA
-		 * Enable/resume all the PIPEs */
-		hdd_ipa->resource_unloading = VOS_FALSE;
-	} else {
-		hdd_ipa->resource_unloading = VOS_FALSE;
-	}
+	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
+		"%s: Disable FW RX PIPE", __func__);
+	WLANTL_SetUcActive(hdd_ipa->hdd_ctx->pvosContext,
+		VOS_FALSE, VOS_FALSE);
+	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
+		"%s: Disable FW TX PIPE", __func__);
+	WLANTL_SetUcActive(hdd_ipa->hdd_ctx->pvosContext,
+		VOS_FALSE, VOS_TRUE);
 	return 0;
 }
 
@@ -812,6 +876,28 @@ static void hdd_ipa_uc_op_cb(v_U8_t *op_msg, void *usr_ctxt)
 	hdd_ipa = (struct hdd_ipa_priv *)hdd_ctx->hdd_ipa;
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_DEBUG,
 		"%s, OPCODE %s", __func__, op_string[msg->op_code]);
+
+	if ((HDD_IPA_UC_OPCODE_TX_RESUME == msg->op_code) ||
+		(HDD_IPA_UC_OPCODE_RX_RESUME == msg->op_code)) {
+		ghdd_ipa->activated_fw_pipe++;
+	}
+
+	if ((HDD_IPA_UC_OPCODE_TX_SUSPEND == msg->op_code) ||
+		(HDD_IPA_UC_OPCODE_RX_SUSPEND == msg->op_code)) {
+		ghdd_ipa->activated_fw_pipe--;
+		if (!ghdd_ipa->activated_fw_pipe) {
+			hdd_ipa_uc_disable_pipes(ghdd_ipa);
+			if ((hdd_ipa_is_rm_enabled(ghdd_ipa)) &&
+			(!ipa_rm_release_resource(IPA_RM_RESOURCE_WLAN_PROD))) {
+				/* Sync return success from IPA
+				 * Enable/resume all the PIPEs */
+				ghdd_ipa->resource_unloading = VOS_FALSE;
+			} else {
+				ghdd_ipa->resource_unloading = VOS_FALSE;
+			}
+		}
+	}
+
 	if (HDD_IPA_UC_OPCODE_STATS == msg->op_code) {
 
 		/* STATs from host */
@@ -2679,6 +2765,14 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 				"%s: Evt: %d, IPA UC OFFLOAD NOT ENABLED",
 				msg_ex->name, meta.msg_type);
 		} else {
+			if (hdd_ipa_uc_find_add_assoc_sta(hdd_ipa,
+					VOS_TRUE,
+					sta_id)) {
+				HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+					"%s: STA ID %d found, not valid",
+					msg_ex->name, sta_id);
+				return 0;
+			}
 			hdd_ipa->sap_num_connected_sta++;
 			hdd_ipa->pending_cons_req = VOS_FALSE;
 			/* Enable IPA UC Data PIPEs when first STA connected */
@@ -2702,6 +2796,15 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 				msg_ex->name);
 			return 0;
 		}
+
+		if (!hdd_ipa_uc_find_add_assoc_sta(hdd_ipa,
+					VOS_FALSE,
+					sta_id)) {
+			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+				"%s: STA ID %d NOT found, not valid",
+				msg_ex->name, sta_id);
+			return 0;
+		}
 		hdd_ipa->sap_num_connected_sta--;
 		/* Disable IPA UC TX PIPE when last STA disconnected */
 		if (!hdd_ipa->sap_num_connected_sta) {
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index c6f2ecfd14d5..31a9753782a7 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -298,6 +298,7 @@ static const hdd_freq_chan_map_t freq_chan_map[] = { {2412, 1}, {2417, 2},
 #define WE_GET_GTX_MINTPC               53
 #define WE_GET_GTX_BWMASK               54
 #define WE_GET_SCAN_BAND_PREFERENCE     55
+#define WE_GET_TEMPERATURE              56
 
 /* Private ioctls and their sub-ioctls */
 #define WLAN_PRIV_SET_INT_GET_INT     (SIOCIWFIRSTPRIV + 2)
@@ -4561,6 +4562,113 @@ int wlan_hdd_update_phymode(struct net_device *net, tHalHandle hal,
     return 0;
 }
 
+void hdd_GetTemperatureCB(int temperature, void *pContext)
+{
+    struct statsContext *pTempContext;
+    hdd_adapter_t *pAdapter;
+
+    ENTER();
+
+    if (NULL == pContext) {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("pContext is NULL"));
+        return;
+    }
+
+    pTempContext = pContext;
+    pAdapter     = pTempContext->pAdapter;
+
+    /* there is a race condition that exists between this callback
+       function and the caller since the caller could time out either
+       before or while this code is executing.  we use a spinlock to
+       serialize these actions */
+    spin_lock(&hdd_context_lock);
+
+    if ((NULL == pAdapter) ||
+            (TEMP_CONTEXT_MAGIC != pTempContext->magic))
+    {
+        /* the caller presumably timed out so there is nothing we can do */
+        spin_unlock(&hdd_context_lock);
+        hddLog(VOS_TRACE_LEVEL_WARN,
+                FL("Invalid context, pAdapter [%p] magic [%08x]"),
+                pAdapter, pTempContext->magic);
+        return;
+    }
+
+    /* context is valid, update the temperature, ignore it if this was 0 */
+    if (temperature != 0) {
+        pAdapter->temperature = temperature;
+    }
+
+    /* notify the caller */
+    complete(&pTempContext->completion);
+
+    /* serialization is complete */
+    spin_unlock(&hdd_context_lock);
+
+    EXIT();
+}
+
+VOS_STATUS wlan_hdd_get_temperature(hdd_adapter_t *pAdapter,
+        union iwreq_data *wrqu, char *extra)
+{
+    eHalStatus hstatus;
+    struct statsContext tempContext;
+    unsigned long rc;
+    A_INT32 *pData = (A_INT32 *)extra;
+
+    ENTER();
+
+    if (NULL == pAdapter)
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("pAdapter is NULL"));
+        return VOS_STATUS_E_FAULT;
+    }
+
+    /* prepare callback context and magic pattern */
+    init_completion(&tempContext.completion);
+    tempContext.pAdapter = pAdapter;
+    tempContext.magic = TEMP_CONTEXT_MAGIC;
+
+    /* send get temperature request to sme */
+    hstatus = sme_GetTemperature(
+            WLAN_HDD_GET_HAL_CTX(pAdapter),
+            &tempContext,
+            hdd_GetTemperatureCB);
+
+    if (eHAL_STATUS_SUCCESS != hstatus) {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("Unable to retrieve temperature"));
+    } else {
+        /* request was sent -- wait for the response */
+        rc = wait_for_completion_timeout(&tempContext.completion,
+                msecs_to_jiffies(WLAN_WAIT_TIME_STATS));
+        if (!rc) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+                FL("SME timed out while retrieving temperature"));
+        }
+    }
+
+    /* either we never sent a request, we sent a request and received a
+       response or we sent a request and timed out.  if we never sent a
+       request or if we sent a request and got a response, we want to
+       clear the magic out of paranoia.  if we timed out there is a
+       race condition such that the callback function could be
+       executing at the same time we are. of primary concern is if the
+       callback function had already verified the "magic" but had not
+       yet set the completion variable when a timeout occurred. we
+       serialize these activities by invalidating the magic while
+       holding a shared spinlock which will cause us to block if the
+       callback is currently executing */
+    spin_lock(&hdd_context_lock);
+    tempContext.magic = 0;
+    spin_unlock(&hdd_context_lock);
+
+    /* update temperature */
+    *pData = pAdapter->temperature;
+
+    EXIT();
+    return VOS_STATUS_SUCCESS;
+}
+
 /* set param sub-ioctls */
 static int iw_setint_getnone(struct net_device *dev, struct iw_request_info *info,
                        union iwreq_data *wrqu, char *extra)
@@ -6590,6 +6698,13 @@ static int iw_setnone_getint(struct net_device *dev, struct iw_request_info *inf
             break;
         }
 
+        case WE_GET_TEMPERATURE:
+        {
+            hddLog(VOS_TRACE_LEVEL_INFO, "WE_GET_TEMPERATURE");
+            ret = wlan_hdd_get_temperature(pAdapter, wrqu, extra);
+            break;
+        }
+
         default:
         {
            hddLog(LOGE, "Invalid IOCTL get_value command %d", value[0]);
@@ -10301,6 +10416,11 @@ static const struct iw_priv_args we_private_args[] = {
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
         "get_scan_pref"},
 
+    {   WE_GET_TEMPERATURE,
+        0,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        "get_temp"},
+
     /* handlers for main ioctl */
     {   WLAN_PRIV_SET_CHAR_GET_NONE,
         IW_PRIV_TYPE_CHAR| 512,
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 33f9849d104c..878ac876c92e 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            193
+#define QWLAN_VERSION_BUILD            194
 
-#define QWLAN_VERSIONSTR               "1.0.0.193"
+#define QWLAN_VERSIONSTR               "1.0.0.194"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/inc/wniApi.h b/CORE/MAC/inc/wniApi.h
index 8134d1666e65..146c7a1f6469 100644
--- a/CORE/MAC/inc/wniApi.h
+++ b/CORE/MAC/inc/wniApi.h
@@ -399,6 +399,8 @@ enum eWniMsgTypes
 #ifdef WLAN_FEATURE_EXTWOW_SUPPORT
     eWNI_SME_READY_TO_EXTWOW_IND,
 #endif
+    eWNI_SME_MSG_GET_TEMPERATURE_IND,
+
     eWNI_SME_MSG_TYPES_END
 };
 
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index 0161f484d649..280a18bbc157 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -645,6 +645,8 @@ typedef struct sSirMbMsgP2p
 #define SIR_HAL_CONFIG_APP_TYPE2_PARAMS    (SIR_HAL_ITC_MSG_TYPES_BEGIN + 289)
 #endif
 
+#define SIR_HAL_GET_TEMPERATURE_REQ        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 290)
+
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 // CFG message types
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index d25b63e56d58..442bbb2442fa 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -5956,6 +5956,19 @@ limProcessSmeChannelChangeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
                     {
                         limLog(pMac, LOGP, FL("could not set  WNI_CFG_CHANNEL_BONDING_MODE at CFG"));
                     }
+                    /*
+                     * In case of DFS operation, If AP falls back to lower
+                     * bandwidth [< 80Mhz] then there is no need of
+                     * Center freq segment. So reset it to zero.
+                     */
+                    if (cfgSetInt(pMac,
+                                  WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1,
+                                  0)
+                                  != eSIR_SUCCESS)
+                    {
+                        limLog(pMac, LOGP,
+                        FL("couldn't reset center freq seg 0 in beacon"));
+                    }
                 }
                 if (chanWidth == eHT_CHANNEL_WIDTH_80MHZ)
                 {
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index 17f7a7857da0..41a6643ca34c 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -727,6 +727,17 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
         return;
     }
 
+    /*
+     * In case when cac timer is running for this SAP session then
+     * avoid sending probe rsp out. It is violation of dfs specification.
+     */
+    if ((psessionEntry->pePersona == VOS_STA_SAP_MODE) &&
+        (VOS_TRUE == pMac->sap.SapDfsInfo.is_dfs_cac_timer_running))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                  FL("CAC timer is running, dropping the probe response"));
+        return;
+    }
     smeSessionId = psessionEntry->smeSessionId;
     pFrm = vos_mem_malloc(sizeof(tDot11fProbeResponse));
     if ( NULL == pFrm )
@@ -3945,6 +3956,17 @@ limSendDisassocMgmtFrame(tpAniSirGlobal pMac,
         return;
     }
 
+    /*
+     * In case when cac timer is running for this SAP session then
+     * avoid sending disassoc out. It is violation of dfs specification.
+     */
+    if ((psessionEntry->pePersona == VOS_STA_SAP_MODE) &&
+        (VOS_TRUE == pMac->sap.SapDfsInfo.is_dfs_cac_timer_running))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                  FL("CAC timer is running, drop disassoc from going out"));
+        return;
+    }
     smeSessionId = psessionEntry->smeSessionId;
 
     vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0);
@@ -4139,6 +4161,17 @@ limSendDeauthMgmtFrame(tpAniSirGlobal pMac,
         return;
     }
 
+    /*
+     * In case when cac timer is running for this SAP session then
+     * avoid deauth frame out. It is violation of dfs specification.
+     */
+    if ((psessionEntry->pePersona == VOS_STA_SAP_MODE) &&
+        (VOS_TRUE == pMac->sap.SapDfsInfo.is_dfs_cac_timer_running))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                  FL("CAC timer is running, drop the deauth from going out"));
+        return;
+    }
     smeSessionId = psessionEntry->smeSessionId;
 
     vos_mem_set( ( tANI_U8* ) &frm, sizeof( frm ), 0 );
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index dc633b46f2d8..6ca1f903669b 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -1657,7 +1657,7 @@ sapGotoChannelSel
         }
 
         if (sapContext->skip_acs_scan_status == eSAP_SKIP_ACS_SCAN) {
-            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                    "## %s SKIPPED ACS SCAN", __func__);
             WLANSAP_ScanCallback(hHal, sapContext, sapContext->sessionId, 0,
                 eCSR_SCAN_SUCCESS);
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index ea48d87119bb..1c4139781b59 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -57,9 +57,6 @@
 #include "qwlan_version.h"
 
 #ifdef FEATURE_SECURE_FIRMWARE
-#define MAX_FIRMWARE_SIZE (1*1024*1024)
-
-static u8 fw_mem[MAX_FIRMWARE_SIZE];
 static struct hash_fw fw_hash;
 #endif
 
@@ -366,8 +363,9 @@ exit:
 }
 
 #ifdef FEATURE_SECURE_FIRMWARE
-static int ol_check_fw_hash(const u8* data, u32 data_size, ATH_BIN_FILE file)
+static int ol_check_fw_hash(const u8* data, u32 fw_size, ATH_BIN_FILE file)
 {
+	u8 *fw_mem = NULL;
 	u8 *hash = NULL;
 #ifdef CONFIG_CNSS
 	u8 digest[SHA256_DIGEST_SIZE];
@@ -404,8 +402,18 @@ static int ol_check_fw_hash(const u8* data, u32 data_size, ATH_BIN_FILE file)
 		goto end;
 	}
 
+	fw_mem = (u8 *)cnss_get_fw_ptr();
+
+	if (!fw_mem || (fw_size > MAX_FIRMWARE_SIZE)) {
+		pr_err("No enough memory to copy FW data\n");
+		ret = A_ERROR;
+		goto end;
+	}
+
+	OS_MEMCPY(fw_mem, data, fw_size);
+
 #ifdef CONFIG_CNSS
-	ret = cnss_get_sha_hash(data, data_size, "sha256", digest);
+	ret = cnss_get_sha_hash(fw_mem, fw_size, "sha256", digest);
 
 	if (ret) {
 		pr_err("Sha256 Hash computation fialed err:%d\n", ret);
@@ -596,15 +604,8 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 	tempEeprom = NULL;
 
 #ifdef FEATURE_SECURE_FIRMWARE
-	if (fw_entry_size <= MAX_FIRMWARE_SIZE) {
-		OS_MEMCPY(fw_mem, fw_entry->data, fw_entry_size);
-	} else {
-		pr_err("%s: No enough memory to copy FW data!", __func__);
-		status = A_ERROR;
-		goto end;
-	}
 
-	if (ol_check_fw_hash(fw_mem, fw_entry_size, file)) {
+	if (ol_check_fw_hash(fw_entry->data, fw_entry_size, file)) {
 		pr_err("Hash Check failed for file:%s\n", filename);
 		status = A_ERROR;
 		goto end;
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 652f252c41d3..a849c5ad2f17 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -16451,6 +16451,81 @@ static int wma_d0_wow_disable_ack_event(void *handle, u_int8_t *event,
 }
 #endif
 
+/* function   : wma_get_temperature
+ * Descriptin : Function is used to send get pdev temperature req
+ * Args       : wma_handle, request data which will be non-null
+ * Returns    : SUCCESS or FAILURE
+ */
+VOS_STATUS wma_get_temperature(tp_wma_handle wma_handle)
+{
+	wmi_pdev_get_temperature_cmd_fixed_param *cmd;
+	wmi_buf_t wmi_buf;
+	uint32_t   len = sizeof(wmi_pdev_get_temperature_cmd_fixed_param);
+	u_int8_t *buf_ptr;
+
+	if (!wma_handle) {
+		WMA_LOGE(FL("WMA is closed, can not issue cmd"));
+		return VOS_STATUS_E_INVAL;
+	}
+
+	wmi_buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!wmi_buf) {
+		WMA_LOGE(FL("wmi_buf_alloc failed"));
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	buf_ptr = (u_int8_t*)wmi_buf_data(wmi_buf);
+
+	cmd = (wmi_pdev_get_temperature_cmd_fixed_param *)buf_ptr;
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		WMITLV_TAG_STRUC_wmi_pdev_get_temperature_cmd_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(wmi_pdev_get_temperature_cmd_fixed_param));
+
+	if (wmi_unified_cmd_send(wma_handle->wmi_handle, wmi_buf, len,
+				WMI_PDEV_GET_TEMPERATURE_CMDID)) {
+		WMA_LOGE(FL("failed to send get temperature command"));
+		wmi_buf_free(wmi_buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
+/* function    : wma_pdev_temperature_evt_handler
+ * Description : Handler for WMI_PDEV_TEMPERATURE_EVENTID event from firmware
+ *             : This event reports the chip temperature
+ *  Returns    :
+ */
+static int wma_pdev_temperature_evt_handler(void *handle, u_int8_t *event,
+		u_int32_t len)
+{
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	vos_msg_t sme_msg = {0};
+	WMI_PDEV_TEMPERATURE_EVENTID_param_tlvs *param_buf;
+	wmi_pdev_temperature_event_fixed_param *wmi_event;
+
+	param_buf = (WMI_PDEV_TEMPERATURE_EVENTID_param_tlvs *) event;
+	if (!param_buf)
+	{
+		WMA_LOGE("Invalid pdev_temperature event buffer");
+		return -EINVAL;
+	}
+
+	wmi_event = param_buf->fixed_param;
+	WMA_LOGI(FL("temperature: %d"), wmi_event->value);
+
+	sme_msg.type = eWNI_SME_MSG_GET_TEMPERATURE_IND;
+	sme_msg.bodyptr = NULL;
+	sme_msg.bodyval = wmi_event->value;
+
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_SME, &sme_msg);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status) )
+	{
+		WMA_LOGE(FL("Fail to post get temperature ind msg"));
+	}
+
+	return 0;
+}
+
 /*
  * Handler to catch wow wakeup host event. This event will have
  * reason why the firmware has woken the host.
@@ -22212,6 +22287,10 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			wma_link_status_rsp(wma_handle, msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
+		case WDA_GET_TEMPERATURE_REQ:
+			wma_get_temperature(wma_handle);
+			vos_mem_free(msg->bodyptr);
+			break;
 		default:
 			WMA_LOGD("unknow msg type %x", msg->type);
 			/* Do Nothing? MSG Body should be freed at here */
@@ -23601,6 +23680,17 @@ VOS_STATUS wma_start(v_VOID_t *vos_ctx)
 		goto end;
 	}
 
+	/* Initialize the get temperature event handler */
+	status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
+				WMI_PDEV_TEMPERATURE_EVENTID,
+				wma_pdev_temperature_evt_handler);
+	if (status != VOS_STATUS_SUCCESS)
+	{
+		WMA_LOGE("Failed to register get_temperature event cb");
+		vos_status = VOS_STATUS_E_FAILURE;
+		goto end;
+	}
+
 end:
 	WMA_LOGD("%s: Exit", __func__);
 	return vos_status;
diff --git a/CORE/SME/inc/smeInternal.h b/CORE/SME/inc/smeInternal.h
index 3eae0e11e84f..dcdbcdaf2169 100644
--- a/CORE/SME/inc/smeInternal.h
+++ b/CORE/SME/inc/smeInternal.h
@@ -177,6 +177,10 @@ typedef struct tagSmeStruct
     v_BOOL_t enableSelfRecovery;
     tCsrLinkStatusCallback linkStatusCallback;
     void *linkStatusContext;
+
+    /* get temperature event context and callback */
+    void *pTemperatureCbContext;
+    void (*pGetTemperatureCb)(int temperature, void *context);
 } tSmeStruct, *tpSmeStruct;
 
 
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index 0514fc63f366..c3807e15c49c 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -4045,4 +4045,16 @@ eHalStatus sme_getLinkStatus(tHalHandle hHal,
                              tCsrLinkStatusCallback callback,
                              void *pContext,
                              tANI_U8 sessionId);
+
+/* ---------------------------------------------------------------------------
+   \fn sme_GetTemperature
+   \brief SME API to get the pdev temperature
+   \param hHal
+   \param temperature context
+   \param pCallbackfn: callback fn with response (temperature)
+   \- return eHalStatus
+   -------------------------------------------------------------------------*/
+eHalStatus sme_GetTemperature(tHalHandle hHal,
+        void *tempContext,
+        void (*pCallbackfn)(int temperature, void *pContext));
 #endif //#if !defined( __SME_API_H )
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 402518eae2aa..80093088fe40 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -2789,6 +2789,15 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
                 }
                 break;
           }
+
+          case eWNI_SME_MSG_GET_TEMPERATURE_IND:
+               if (pMac->sme.pGetTemperatureCb)
+               {
+                   pMac->sme.pGetTemperatureCb(pMsg->bodyval,
+                           pMac->sme.pTemperatureCbContext);
+               }
+               break;
+
           default:
 
              if ( ( pMsg->type >= eWNI_SME_MSG_TYPES_BEGIN )
@@ -13972,4 +13981,52 @@ eHalStatus sme_UpdateRoamKeyMgmtOffloadEnabled(tHalHandle hHal,
 
     return status ;
 }
+
+/* ---------------------------------------------------------------------------
+   \fn sme_GetTemperature
+   \brief SME API to get the pdev temperature
+   \param hHal
+   \param temperature context
+   \param pCallbackfn: callback fn with response (temperature)
+   \- return eHalStatus
+   -------------------------------------------------------------------------*/
+eHalStatus sme_GetTemperature(tHalHandle hHal,
+        void *tempContext,
+        void (*pCallbackfn)(int temperature, void *pContext))
+{
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+    VOS_STATUS          vosStatus = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal      pMac      = PMAC_STRUCT(hHal);
+    vos_msg_t           vosMessage;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (eHAL_STATUS_SUCCESS == status)
+    {
+        if ( (NULL == pCallbackfn) &&
+                (NULL == pMac->sme.pGetTemperatureCb))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                FL("Indication Call back did not registered"));
+            sme_ReleaseGlobalLock(&pMac->sme);
+            return eHAL_STATUS_FAILURE;
+        }
+        else if (NULL != pCallbackfn)
+        {
+            pMac->sme.pTemperatureCbContext = tempContext;
+            pMac->sme.pGetTemperatureCb = pCallbackfn;
+        }
+        /* serialize the req through MC thread */
+        vosMessage.bodyptr = NULL;
+        vosMessage.type    = WDA_GET_TEMPERATURE_REQ;
+        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage);
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                FL("Post Get Temperature msg fail"));
+            status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    return(status);
+}
 #endif
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 5c107078ea3d..6e04487c63a0 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -951,6 +951,8 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 
 #define WDA_TBTT_UPDATE_IND         SIR_HAL_TBTT_UPDATE_IND
 
+#define WDA_GET_TEMPERATURE_REQ     SIR_HAL_GET_TEMPERATURE_REQ
+
 #ifdef FEATURE_WLAN_EXTSCAN
 #define WDA_EXTSCAN_GET_CAPABILITIES_REQ    SIR_HAL_EXTSCAN_GET_CAPABILITIES_REQ
 #define WDA_EXTSCAN_START_REQ               SIR_HAL_EXTSCAN_START_REQ
diff --git a/Kbuild b/Kbuild
index ef958c973514..996d10676824 100644
--- a/Kbuild
+++ b/Kbuild
@@ -228,9 +228,6 @@ CONFIG_QCA_SINGLE_BINARY_SUPPORT := 0
 #Enable collecting target RAM dump after kernel panic
 CONFIG_TARGET_RAMDUMP_AFTER_KERNEL_PANIC := 1
 
-#Flag to enable/disable secure firmware feature
-CONFIG_FEATURE_SECURE_FIRMWARE := 0
-
 #Flag to enable Stats Ext implementation
 CONFIG_FEATURE_STATS_EXT := 1
 
@@ -1220,6 +1217,9 @@ CDEFINES += -DFEATURE_WLAN_AUTO_SHUTDOWN
 #enable for MBSSID
 CDEFINES += -DWLAN_FEATURE_MBSSID
 
+#enable AP-AP ACS Optimization for MDM
+CDEFINES += -DFEATURE_WLAN_AP_AP_ACS_OPTIMIZE
+
 #Green AP feature
 CDEFINES += -DFEATURE_GREEN_AP
 
@@ -1262,7 +1262,7 @@ CDEFINES += -DTARGET_RAMDUMP_AFTER_KERNEL_PANIC
 endif
 
 #Enable/disable secure firmware feature
-ifeq ($(CONFIG_FEATURE_SECURE_FIRMWARE), 1)
+ifeq ($(CONFIG_CNSS_SECURE_FW), y)
 CDEFINES += -DFEATURE_SECURE_FIRMWARE
 endif