From 10e437e63d4d0d0caadd46ea6bf412dafcd068e8 Mon Sep 17 00:00:00 2001
From: Will Huang <quic_wilhuang@quicinc.com>
Date: Mon, 6 Sep 2021 17:07:50 +0800
Subject: [PATCH 01/12] qcacld-3.0: Fix mgmt tx from supplicant failed on 6 GHz
 chan

Currently wlan_hdd_mgmt_tx path is still using legacy API to convert
channel frequency to number, it is not applicable for 6 GHz channel if
convert it back from number to frequency.

Fix it by replace all places where using legacy API to convert channel
and use channel frequency from supplicant directly. It can fix mgmt tx
from supplicant on 6 GHz channel.

Change-Id: I60fe37d7d716eeaceaa00f3fb59c77b629ebacac
CRs-Fixed: 3024898
---
 components/p2p/core/src/wlan_p2p_off_chan_tx.c  |  5 +++--
 components/p2p/core/src/wlan_p2p_off_chan_tx.h  |  4 ++--
 components/p2p/core/src/wlan_p2p_roc.c          |  4 ++--
 components/p2p/core/src/wlan_p2p_roc.h          |  4 ++--
 .../p2p/dispatcher/inc/wlan_p2p_public_struct.h |  5 +++--
 core/hdd/src/wlan_hdd_p2p.c                     | 11 ++++++-----
 os_if/p2p/src/wlan_cfg80211_p2p.c               | 17 ++++++++---------
 7 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/components/p2p/core/src/wlan_p2p_off_chan_tx.c b/components/p2p/core/src/wlan_p2p_off_chan_tx.c
index 1478df85dce7..2d1417271ddf 100644
--- a/components/p2p/core/src/wlan_p2p_off_chan_tx.c
+++ b/components/p2p/core/src/wlan_p2p_off_chan_tx.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1076,7 +1076,8 @@ static QDF_STATUS p2p_mgmt_tx(struct tx_action_context *tx_ctx,
 	mgmt_param.vdev_id = tx_ctx->vdev_id;
 	mgmt_param.pdata = frame;
 	if (tx_ctx->chan)
-		chanfreq = (uint16_t)wlan_chan_to_freq(tx_ctx->chan);
+		chanfreq = tx_ctx->chan;
+
 	mgmt_param.chanfreq = chanfreq;
 
 	mgmt_param.qdf_ctx = wlan_psoc_get_qdf_dev(psoc);
diff --git a/components/p2p/core/src/wlan_p2p_off_chan_tx.h b/components/p2p/core/src/wlan_p2p_off_chan_tx.h
index 46e80fca5a33..00a7929c6484 100644
--- a/components/p2p/core/src/wlan_p2p_off_chan_tx.h
+++ b/components/p2p/core/src/wlan_p2p_off_chan_tx.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -174,7 +174,7 @@ struct tx_action_context {
 	int scan_id;
 	uint64_t roc_cookie;
 	int32_t id;
-	uint8_t chan;
+	qdf_freq_t chan;
 	uint8_t *buf;
 	int buf_len;
 	bool off_chan;
diff --git a/components/p2p/core/src/wlan_p2p_roc.c b/components/p2p/core/src/wlan_p2p_roc.c
index 7146367eae62..f0c9881f3ff2 100644
--- a/components/p2p/core/src/wlan_p2p_roc.c
+++ b/components/p2p/core/src/wlan_p2p_roc.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023, 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -114,7 +114,7 @@ static QDF_STATUS p2p_scan_start(struct p2p_roc_context *roc_ctx)
 	req->scan_req.scan_type = SCAN_TYPE_P2P_LISTEN;
 	req->scan_req.scan_req_id = p2p_soc_obj->scan_req_id;
 	req->scan_req.chan_list.num_chan = 1;
-	req->scan_req.chan_list.chan[0].freq = wlan_chan_to_freq(roc_ctx->chan);
+	req->scan_req.chan_list.chan[0].freq = roc_ctx->chan;
 	req->scan_req.dwell_time_passive = roc_ctx->duration;
 	req->scan_req.dwell_time_active = 0;
 	req->scan_req.scan_priority = SCAN_PRIORITY_HIGH;
diff --git a/components/p2p/core/src/wlan_p2p_roc.h b/components/p2p/core/src/wlan_p2p_roc.h
index 143e01726a8f..f1f27364ac7b 100644
--- a/components/p2p/core/src/wlan_p2p_roc.h
+++ b/components/p2p/core/src/wlan_p2p_roc.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023, 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -95,7 +95,7 @@ struct p2p_roc_context {
 	uint32_t vdev_id;
 	uint32_t scan_id;
 	void *tx_ctx;
-	uint8_t chan;
+	qdf_freq_t chan;
 	uint8_t phy_mode;
 	uint32_t duration;
 	enum roc_type roc_type;
diff --git a/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h b/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h
index 33fd71c70b40..1f09757a868b 100644
--- a/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h
+++ b/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2019 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -67,7 +68,7 @@ struct p2p_ps_params {
  */
 struct p2p_roc_req {
 	uint32_t vdev_id;
-	uint32_t chan;
+	qdf_freq_t chan;
 	uint32_t phy_mode;
 	uint32_t duration;
 };
@@ -96,7 +97,7 @@ struct p2p_event {
 	uint32_t vdev_id;
 	enum p2p_roc_event roc_event;
 	uint64_t cookie;
-	uint32_t chan;
+	qdf_freq_t chan;
 	uint32_t duration;
 };
 
diff --git a/core/hdd/src/wlan_hdd_p2p.c b/core/hdd/src/wlan_hdd_p2p.c
index 4743ce81ba2a..d8aee3c9ee21 100644
--- a/core/hdd/src/wlan_hdd_p2p.c
+++ b/core/hdd/src/wlan_hdd_p2p.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023, 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -286,15 +286,16 @@ wlan_hdd_validate_and_override_offchan(struct hdd_adapter *adapter,
 				       struct ieee80211_channel *chan,
 				       bool *offchan)
 {
-	uint8_t home_ch;
+	qdf_freq_t home_ch_freq;
 
 	if (!offchan || !chan || !(*offchan))
 		return;
 
-	home_ch = hdd_get_adapter_home_channel(adapter);
+	home_ch_freq = hdd_get_adapter_home_channel(adapter);
 
-	if (ieee80211_frequency_to_channel(chan->center_freq) == home_ch) {
-		hdd_debug("override offchan to 0 at home channel %d", home_ch);
+	if (chan->center_freq == home_ch_freq) {
+		hdd_debug("override offchan to 0 at home channel %d",
+			  home_ch_freq);
 		*offchan = false;
 	}
 }
diff --git a/os_if/p2p/src/wlan_cfg80211_p2p.c b/os_if/p2p/src/wlan_cfg80211_p2p.c
index ddeba7bf0d51..4db1500f65fa 100644
--- a/os_if/p2p/src/wlan_cfg80211_p2p.c
+++ b/os_if/p2p/src/wlan_cfg80211_p2p.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -281,8 +282,7 @@ static void wlan_p2p_event_callback(void *user_data,
 		goto fail;
 	}
 
-	chan = ieee80211_get_channel(wdev->wiphy,
-				     wlan_chan_to_freq(p2p_event->chan));
+	chan = ieee80211_get_channel(wdev->wiphy, p2p_event->chan);
 	if (!chan) {
 		osif_err("channel conversion failed");
 		goto fail;
@@ -360,7 +360,7 @@ int wlan_cfg80211_roc(struct wlan_objmgr_vdev *vdev,
 		return -EINVAL;
 	}
 
-	roc_req.chan = (uint32_t)wlan_freq_to_chan(chan->center_freq);
+	roc_req.chan = chan->center_freq;
 	roc_req.duration = duration;
 	roc_req.vdev_id = (uint32_t)vdev_id;
 
@@ -409,7 +409,7 @@ int wlan_cfg80211_mgmt_tx(struct wlan_objmgr_vdev *vdev,
 	struct p2p_mgmt_tx mgmt_tx = {0};
 	struct wlan_objmgr_psoc *psoc;
 	uint8_t vdev_id;
-	uint32_t channel = 0;
+	qdf_freq_t chan_freq = 0;
 
 	if (!vdev) {
 		osif_err("invalid vdev object");
@@ -417,7 +417,7 @@ int wlan_cfg80211_mgmt_tx(struct wlan_objmgr_vdev *vdev,
 	}
 
 	if (chan)
-		channel = (uint32_t)wlan_freq_to_chan(chan->center_freq);
+		chan_freq = chan->center_freq;
 	else
 		osif_debug("NULL chan, set channel to 0");
 
@@ -436,8 +436,7 @@ int wlan_cfg80211_mgmt_tx(struct wlan_objmgr_vdev *vdev,
 		int ret;
 		bool ok;
 
-		ret = policy_mgr_is_chan_ok_for_dnbs(
-				psoc, wlan_chan_to_freq(channel), &ok);
+		ret = policy_mgr_is_chan_ok_for_dnbs(psoc, chan_freq, &ok);
 		if (QDF_IS_STATUS_ERROR(ret)) {
 			osif_err("policy_mgr_is_chan_ok_for_dnbs():ret:%d",
 				 ret);
@@ -445,13 +444,13 @@ int wlan_cfg80211_mgmt_tx(struct wlan_objmgr_vdev *vdev,
 		}
 		if (!ok) {
 			osif_err("Rejecting mgmt_tx for channel:%d as DNSC is set",
-				 channel);
+				 chan_freq);
 			return -EINVAL;
 		}
 	}
 
 	mgmt_tx.vdev_id = (uint32_t)vdev_id;
-	mgmt_tx.chan = channel;
+	mgmt_tx.chan = chan_freq;
 	mgmt_tx.wait = wait;
 	mgmt_tx.len = len;
 	mgmt_tx.no_cck = (uint32_t)no_cck;

From fda10761df20c96ac7540fcd21f49eefeca24798 Mon Sep 17 00:00:00 2001
From: Will Huang <quic_wilhuang@quicinc.com>
Date: Fri, 10 Sep 2021 10:40:22 +0800
Subject: [PATCH 02/12] qcacld-3.0: Rename variables name chan to chan_freq of
 wlan_hdd_mgmt_tx

We have fixed using channel number as internal parameter instead of
chan frequency with change I60fe37d7d716eeaceaa00f3fb59c77b629ebacac,
but variables name are still chan which might cause confused to reader.

Rename all places where "chan" to "chan_freq", which actually channel
frequency used. And alter miss APIs which still expect channel number.

Change-Id: I948cbad133a17093f49384b563966d2c53b51707
CRs-Fixed: 3033951
---
 .../p2p/core/src/wlan_p2p_off_chan_tx.c       | 77 ++++++++--------
 .../p2p/core/src/wlan_p2p_off_chan_tx.h       |  4 +-
 components/p2p/core/src/wlan_p2p_roc.c        | 88 +++++++++++--------
 components/p2p/core/src/wlan_p2p_roc.h        | 12 +--
 .../dispatcher/inc/wlan_p2p_public_struct.h   | 12 +--
 .../p2p/dispatcher/src/wlan_p2p_ucfg_api.c    | 20 +++--
 os_if/p2p/src/wlan_cfg80211_p2p.c             |  8 +-
 7 files changed, 120 insertions(+), 101 deletions(-)

diff --git a/components/p2p/core/src/wlan_p2p_off_chan_tx.c b/components/p2p/core/src/wlan_p2p_off_chan_tx.c
index 2d1417271ddf..857e619900a8 100644
--- a/components/p2p/core/src/wlan_p2p_off_chan_tx.c
+++ b/components/p2p/core/src/wlan_p2p_off_chan_tx.c
@@ -211,7 +211,7 @@ static QDF_STATUS p2p_check_and_update_channel(struct tx_action_context *tx_ctx)
 	struct p2p_soc_priv_obj *p2p_soc_obj;
 	struct p2p_roc_context *curr_roc_ctx;
 
-	if (!tx_ctx || tx_ctx->chan) {
+	if (!tx_ctx || tx_ctx->chan_freq) {
 		p2p_err("NULL tx ctx or channel valid");
 		return QDF_STATUS_E_INVAL;
 	}
@@ -232,7 +232,7 @@ static QDF_STATUS p2p_check_and_update_channel(struct tx_action_context *tx_ctx)
 	    (mode == QDF_P2P_DEVICE_MODE ||
 	     mode == QDF_P2P_CLIENT_MODE ||
 	     mode == QDF_P2P_GO_MODE))
-		tx_ctx->chan = curr_roc_ctx->chan;
+		tx_ctx->chan_freq = curr_roc_ctx->chan_freq;
 
 	wlan_objmgr_vdev_release_ref(vdev, WLAN_P2P_ID);
 
@@ -1068,17 +1068,13 @@ static QDF_STATUS p2p_mgmt_tx(struct tx_action_context *tx_ctx,
 	void *mac_addr;
 	uint8_t pdev_id;
 	struct wlan_objmgr_vdev *vdev;
-	uint16_t chanfreq = 0;
 
 	psoc = tx_ctx->p2p_soc_obj->soc;
 	mgmt_param.tx_frame = packet;
 	mgmt_param.frm_len = buf_len;
 	mgmt_param.vdev_id = tx_ctx->vdev_id;
 	mgmt_param.pdata = frame;
-	if (tx_ctx->chan)
-		chanfreq = tx_ctx->chan;
-
-	mgmt_param.chanfreq = chanfreq;
+	mgmt_param.chanfreq = tx_ctx->chan_freq;
 
 	mgmt_param.qdf_ctx = wlan_psoc_get_qdf_dev(psoc);
 	if (!(mgmt_param.qdf_ctx)) {
@@ -1162,7 +1158,7 @@ static QDF_STATUS p2p_roc_req_for_tx_action(
 	p2p_soc_obj = tx_ctx->p2p_soc_obj;
 	roc_ctx->p2p_soc_obj = p2p_soc_obj;
 	roc_ctx->vdev_id = tx_ctx->vdev_id;
-	roc_ctx->chan = tx_ctx->chan;
+	roc_ctx->chan_freq = tx_ctx->chan_freq;
 	roc_ctx->duration = tx_ctx->duration;
 	roc_ctx->roc_state = ROC_STATE_IDLE;
 	roc_ctx->roc_type = OFF_CHANNEL_TX;
@@ -1805,13 +1801,15 @@ void p2p_dump_tx_queue(struct p2p_soc_priv_obj *p2p_soc_obj)
 	while (QDF_IS_STATUS_SUCCESS(status)) {
 		tx_ctx = qdf_container_of(p_node,
 				struct tx_action_context, node);
-		p2p_debug("p2p soc object:%pK, tx ctx:%pK, vdev_id:%d, scan_id:%d, roc_cookie:%llx, chan:%d, buf:%pK, len:%d, off_chan:%d, cck:%d, ack:%d, duration:%d",
-			p2p_soc_obj, tx_ctx,
-			tx_ctx->vdev_id, tx_ctx->scan_id,
-			tx_ctx->roc_cookie, tx_ctx->chan,
-			tx_ctx->buf, tx_ctx->buf_len,
-			tx_ctx->off_chan, tx_ctx->no_cck,
-			tx_ctx->no_ack, tx_ctx->duration);
+		p2p_debug("p2p soc object:%pK, tx ctx:%pK, vdev_id:%d, "
+			  "scan_id:%d, roc_cookie:%llx, freq:%d, buf:%pK, "
+			  "len:%d, off_chan:%d, cck:%d, ack:%d, duration:%d",
+			  p2p_soc_obj, tx_ctx,
+			  tx_ctx->vdev_id, tx_ctx->scan_id,
+			  tx_ctx->roc_cookie, tx_ctx->chan_freq,
+			  tx_ctx->buf, tx_ctx->buf_len,
+			  tx_ctx->off_chan, tx_ctx->no_cck,
+			  tx_ctx->no_ack, tx_ctx->duration);
 
 		status = qdf_list_peek_next(&p2p_soc_obj->tx_q_roc,
 						p_node, &p_node);
@@ -1823,13 +1821,15 @@ void p2p_dump_tx_queue(struct p2p_soc_priv_obj *p2p_soc_obj)
 	while (QDF_IS_STATUS_SUCCESS(status)) {
 		tx_ctx = qdf_container_of(p_node,
 				struct tx_action_context, node);
-		p2p_debug("p2p soc object:%pK, tx_ctx:%pK, vdev_id:%d, scan_id:%d, roc_cookie:%llx, chan:%d, buf:%pK, len:%d, off_chan:%d, cck:%d, ack:%d, duration:%d",
-			p2p_soc_obj, tx_ctx,
-			tx_ctx->vdev_id, tx_ctx->scan_id,
-			tx_ctx->roc_cookie, tx_ctx->chan,
-			tx_ctx->buf, tx_ctx->buf_len,
-			tx_ctx->off_chan, tx_ctx->no_cck,
-			tx_ctx->no_ack, tx_ctx->duration);
+		p2p_debug("p2p soc object:%pK, tx_ctx:%pK, vdev_id:%d, "
+			  "scan_id:%d, roc_cookie:%llx, freq:%d, buf:%pK, "
+			  "len:%d, off_chan:%d, cck:%d, ack:%d, duration:%d",
+			  p2p_soc_obj, tx_ctx,
+			  tx_ctx->vdev_id, tx_ctx->scan_id,
+			  tx_ctx->roc_cookie, tx_ctx->chan_freq,
+			  tx_ctx->buf, tx_ctx->buf_len,
+			  tx_ctx->off_chan, tx_ctx->no_cck,
+			  tx_ctx->no_ack, tx_ctx->duration);
 
 		status = qdf_list_peek_next(&p2p_soc_obj->tx_q_ack,
 						p_node, &p_node);
@@ -2919,17 +2919,17 @@ void p2p_rand_mac_tx(struct  tx_action_context *tx_action)
 		return;
 	soc = tx_action->p2p_soc_obj->soc;
 
-	if (!tx_action->no_ack && tx_action->chan &&
+	if (!tx_action->no_ack && tx_action->chan_freq &&
 	    tx_action->buf_len > MIN_MAC_HEADER_LEN &&
 	    p2p_is_vdev_support_rand_mac_by_id(soc, tx_action->vdev_id) &&
 	    p2p_is_random_mac(soc, tx_action->vdev_id,
 			      &tx_action->buf[SRC_MAC_ADDR_OFFSET])) {
 		status = p2p_request_random_mac(
-					soc, tx_action->vdev_id,
-					&tx_action->buf[SRC_MAC_ADDR_OFFSET],
-					wlan_chan_to_freq(tx_action->chan),
-					tx_action->id,
-					tx_action->duration);
+			soc, tx_action->vdev_id,
+			&tx_action->buf[SRC_MAC_ADDR_OFFSET],
+			tx_action->chan_freq,
+			tx_action->id,
+			tx_action->duration);
 		if (status == QDF_STATUS_SUCCESS)
 			tx_action->rand_mac_tx = true;
 		else
@@ -2999,11 +2999,13 @@ QDF_STATUS p2p_process_mgmt_tx(struct tx_action_context *tx_ctx)
 
 	p2p_soc_obj = tx_ctx->p2p_soc_obj;
 
-	p2p_debug("soc:%pK, tx_ctx:%pK, vdev_id:%d, scan_id:%d, roc_cookie:%llx, chan:%d, buf:%pK, len:%d, off_chan:%d, cck:%d, ack:%d, duration:%d",
-		p2p_soc_obj->soc, tx_ctx, tx_ctx->vdev_id,
-		tx_ctx->scan_id, tx_ctx->roc_cookie, tx_ctx->chan,
-		tx_ctx->buf, tx_ctx->buf_len, tx_ctx->off_chan,
-		tx_ctx->no_cck, tx_ctx->no_ack, tx_ctx->duration);
+	p2p_debug("soc:%pK, tx_ctx:%pK, vdev_id:%d, scan_id:%d, "
+		  "roc_cookie:%llx, freq:%d, buf:%pK, len:%d, "
+		  "off_chan:%d, cck:%d, ack:%d, duration:%d",
+		  p2p_soc_obj->soc, tx_ctx, tx_ctx->vdev_id,
+		  tx_ctx->scan_id, tx_ctx->roc_cookie, tx_ctx->chan_freq,
+		  tx_ctx->buf, tx_ctx->buf_len, tx_ctx->off_chan,
+		  tx_ctx->no_cck, tx_ctx->no_ack, tx_ctx->duration);
 
 	status = p2p_get_frame_info(tx_ctx->buf, tx_ctx->buf_len,
 			&(tx_ctx->frame_info));
@@ -3032,8 +3034,8 @@ QDF_STATUS p2p_process_mgmt_tx(struct tx_action_context *tx_ctx)
 		tx_ctx->no_ack = 1;
 	}
 
-	if (!tx_ctx->off_chan || !tx_ctx->chan) {
-		if (!tx_ctx->chan)
+	if (!tx_ctx->off_chan || !tx_ctx->chan_freq) {
+		if (!tx_ctx->chan_freq)
 			p2p_check_and_update_channel(tx_ctx);
 		status = p2p_execute_tx_action_frame(tx_ctx);
 		if (status != QDF_STATUS_SUCCESS) {
@@ -3045,7 +3047,7 @@ QDF_STATUS p2p_process_mgmt_tx(struct tx_action_context *tx_ctx)
 
 	/* For off channel tx case */
 	curr_roc_ctx = p2p_find_current_roc_ctx(p2p_soc_obj);
-	if (curr_roc_ctx && (curr_roc_ctx->chan == tx_ctx->chan)) {
+	if (curr_roc_ctx && (curr_roc_ctx->chan_freq == tx_ctx->chan_freq)) {
 		if ((curr_roc_ctx->roc_state == ROC_STATE_REQUESTED) ||
 		    (curr_roc_ctx->roc_state == ROC_STATE_STARTED)) {
 			tx_ctx->roc_cookie = (uintptr_t)curr_roc_ctx;
@@ -3076,7 +3078,8 @@ QDF_STATUS p2p_process_mgmt_tx(struct tx_action_context *tx_ctx)
 		}
 	}
 
-	curr_roc_ctx = p2p_find_roc_by_chan(p2p_soc_obj, tx_ctx->chan);
+	curr_roc_ctx = p2p_find_roc_by_chan_freq(p2p_soc_obj,
+						 tx_ctx->chan_freq);
 	if (curr_roc_ctx && (curr_roc_ctx->roc_state == ROC_STATE_IDLE)) {
 		tx_ctx->roc_cookie = (uintptr_t)curr_roc_ctx;
 		status = qdf_list_insert_back(
diff --git a/components/p2p/core/src/wlan_p2p_off_chan_tx.h b/components/p2p/core/src/wlan_p2p_off_chan_tx.h
index 00a7929c6484..5b98ccbc7066 100644
--- a/components/p2p/core/src/wlan_p2p_off_chan_tx.h
+++ b/components/p2p/core/src/wlan_p2p_off_chan_tx.h
@@ -157,7 +157,7 @@ struct p2p_frame_info {
  * @scan_id:        Scan id given by scan component for this roc req
  * @roc_cookie:     Cookie for remain on channel request
  * @id:             Identifier of this tx context
- * @chan:           Chan for which this tx has been requested
+ * @chan_freq:      Chan frequency for which this tx has been requested
  * @buf:            tx buffer
  * @buf_len:        Length of tx buffer
  * @off_chan:       Is this off channel tx
@@ -174,7 +174,7 @@ struct tx_action_context {
 	int scan_id;
 	uint64_t roc_cookie;
 	int32_t id;
-	qdf_freq_t chan;
+	qdf_freq_t chan_freq;
 	uint8_t *buf;
 	int buf_len;
 	bool off_chan;
diff --git a/components/p2p/core/src/wlan_p2p_roc.c b/components/p2p/core/src/wlan_p2p_roc.c
index f0c9881f3ff2..643d54a1a428 100644
--- a/components/p2p/core/src/wlan_p2p_roc.c
+++ b/components/p2p/core/src/wlan_p2p_roc.c
@@ -114,7 +114,7 @@ static QDF_STATUS p2p_scan_start(struct p2p_roc_context *roc_ctx)
 	req->scan_req.scan_type = SCAN_TYPE_P2P_LISTEN;
 	req->scan_req.scan_req_id = p2p_soc_obj->scan_req_id;
 	req->scan_req.chan_list.num_chan = 1;
-	req->scan_req.chan_list.chan[0].freq = roc_ctx->chan;
+	req->scan_req.chan_list.chan[0].freq = roc_ctx->chan_freq;
 	req->scan_req.dwell_time_passive = roc_ctx->duration;
 	req->scan_req.dwell_time_active = 0;
 	req->scan_req.scan_priority = SCAN_PRIORITY_HIGH;
@@ -278,7 +278,7 @@ static QDF_STATUS p2p_send_roc_event(
 	p2p_evt.vdev_id = roc_ctx->vdev_id;
 	p2p_evt.roc_event = evt;
 	p2p_evt.cookie = (uint64_t)roc_ctx->id;
-	p2p_evt.chan = roc_ctx->chan;
+	p2p_evt.chan_freq = roc_ctx->chan_freq;
 	p2p_evt.duration = roc_ctx->duration;
 
 	p2p_debug("roc_event: %d, cookie:%llx", p2p_evt.roc_event,
@@ -305,9 +305,10 @@ static QDF_STATUS p2p_destroy_roc_ctx(struct p2p_roc_context *roc_ctx,
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 	struct p2p_soc_priv_obj *p2p_soc_obj = roc_ctx->p2p_soc_obj;
 
-	p2p_debug("p2p_soc_obj:%pK, roc_ctx:%pK, up_layer_event:%d, in_roc_queue:%d vdev_id:%d chan:%d duration:%d",
-		p2p_soc_obj, roc_ctx, up_layer_event, in_roc_queue,
-		roc_ctx->vdev_id, roc_ctx->chan, roc_ctx->duration);
+	p2p_debug("p2p_soc_obj:%pK, roc_ctx:%pK, up_layer_event:%d,"
+		  " in_roc_queue:%d vdev_id:%d freq:%d duration:%d",
+		  p2p_soc_obj, roc_ctx, up_layer_event, in_roc_queue,
+		  roc_ctx->vdev_id, roc_ctx->chan_freq, roc_ctx->duration);
 
 	if (up_layer_event) {
 		if (roc_ctx->roc_state < ROC_STATE_ON_CHAN)
@@ -391,11 +392,13 @@ static void p2p_roc_timeout(void *pdata)
 		return;
 	}
 
-	p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d, tx ctx:%pK, chan:%d, phy_mode:%d, duration:%d, roc_type:%d, roc_state:%d",
-		roc_ctx->p2p_soc_obj, roc_ctx, roc_ctx->vdev_id,
-		roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan,
-		roc_ctx->phy_mode, roc_ctx->duration,
-		roc_ctx->roc_type, roc_ctx->roc_state);
+	p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d,"
+		  " tx ctx:%pK, freq:%d, phy_mode:%d, duration:%d,"
+		  " roc_type:%d, roc_state:%d",
+		  roc_ctx->p2p_soc_obj, roc_ctx, roc_ctx->vdev_id,
+		  roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan_freq,
+		  roc_ctx->phy_mode, roc_ctx->duration,
+		  roc_ctx->roc_type, roc_ctx->roc_state);
 
 	if (roc_ctx->roc_state == ROC_STATE_CANCEL_IN_PROG) {
 		p2p_err("Cancellation already in progress");
@@ -418,11 +421,13 @@ static QDF_STATUS p2p_execute_roc_req(struct p2p_roc_context *roc_ctx)
 	QDF_STATUS status;
 	struct p2p_soc_priv_obj *p2p_soc_obj = roc_ctx->p2p_soc_obj;
 
-	p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d, tx ctx:%pK, chan:%d, phy_mode:%d, duration:%d, roc_type:%d, roc_state:%d",
-		p2p_soc_obj, roc_ctx, roc_ctx->vdev_id,
-		roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan,
-		roc_ctx->phy_mode, roc_ctx->duration,
-		roc_ctx->roc_type, roc_ctx->roc_state);
+	p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d,"
+		  " tx ctx:%pK, freq:%d, phy_mode:%d, duration:%d,"
+		  " roc_type:%d, roc_state:%d",
+		  p2p_soc_obj, roc_ctx, roc_ctx->vdev_id,
+		  roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan_freq,
+		  roc_ctx->phy_mode, roc_ctx->duration,
+		  roc_ctx->roc_type, roc_ctx->roc_state);
 
 	/* prevent runtime suspend */
 	qdf_runtime_pm_prevent_suspend(&p2p_soc_obj->roc_runtime_lock);
@@ -645,14 +650,14 @@ struct p2p_roc_context *p2p_find_current_roc_ctx(
 				struct p2p_roc_context, node);
 		if (roc_ctx->roc_state != ROC_STATE_IDLE) {
 			p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id"
-				":%d, scan_id:%d, tx ctx:%pK, chan:"
-				"%d, phy_mode:%d, duration:%d, "
-				"roc_type:%d, roc_state:%d",
-				roc_ctx->p2p_soc_obj, roc_ctx,
-				roc_ctx->vdev_id, roc_ctx->scan_id,
-				roc_ctx->tx_ctx, roc_ctx->chan,
-				roc_ctx->phy_mode, roc_ctx->duration,
-				roc_ctx->roc_type, roc_ctx->roc_state);
+				  ":%d, scan_id:%d, tx ctx:%pK, freq:"
+				  "%d, phy_mode:%d, duration:%d, "
+				  "roc_type:%d, roc_state:%d",
+				  roc_ctx->p2p_soc_obj, roc_ctx,
+				  roc_ctx->vdev_id, roc_ctx->scan_id,
+				  roc_ctx->tx_ctx, roc_ctx->chan_freq,
+				  roc_ctx->phy_mode, roc_ctx->duration,
+				  roc_ctx->roc_type, roc_ctx->roc_state);
 
 			return roc_ctx;
 		}
@@ -685,8 +690,8 @@ struct p2p_roc_context *p2p_find_roc_by_tx_ctx(
 	return NULL;
 }
 
-struct p2p_roc_context *p2p_find_roc_by_chan(
-	struct p2p_soc_priv_obj *p2p_soc_obj, uint8_t chan)
+struct p2p_roc_context *p2p_find_roc_by_chan_freq(
+	struct p2p_soc_priv_obj *p2p_soc_obj, qdf_freq_t chan_freq)
 {
 	struct p2p_roc_context *roc_ctx;
 	qdf_list_node_t *p_node;
@@ -697,11 +702,14 @@ struct p2p_roc_context *p2p_find_roc_by_chan(
 		roc_ctx = qdf_container_of(p_node,
 					   struct p2p_roc_context,
 					   node);
-		if (roc_ctx->chan == chan) {
-			p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d, tx ctx:%pK, chan:%d, phy_mode:%d, duration:%d, roc_type:%d, roc_state:%d",
+		if (roc_ctx->chan_freq == chan_freq) {
+			p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d,"
+				  " scan_id:%d, tx ctx:%pK, freq:%d,"
+				  " phy_mode:%d, duration:%d,"
+				  " roc_type:%d, roc_state:%d",
 				  roc_ctx->p2p_soc_obj, roc_ctx,
 				  roc_ctx->vdev_id, roc_ctx->scan_id,
-				  roc_ctx->tx_ctx, roc_ctx->chan,
+				  roc_ctx->tx_ctx, roc_ctx->chan_freq,
 				  roc_ctx->phy_mode, roc_ctx->duration,
 				  roc_ctx->roc_type, roc_ctx->roc_state);
 
@@ -808,10 +816,12 @@ QDF_STATUS p2p_process_cleanup_roc_queue(
 		roc_ctx = qdf_container_of(p_node,
 				struct p2p_roc_context, node);
 
-		p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d, tx ctx:%pK, chan:%d, phy_mode:%d, duration:%d, roc_type:%d, roc_state:%d",
+		p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, "
+			  "scan_id:%d, tx ctx:%pK, freq:%d, phy_mode:%d, "
+			  "duration:%d, roc_type:%d, roc_state:%d",
 			  roc_ctx->p2p_soc_obj, roc_ctx,
 			  roc_ctx->vdev_id, roc_ctx->scan_id,
-			  roc_ctx->tx_ctx, roc_ctx->chan,
+			  roc_ctx->tx_ctx, roc_ctx->chan_freq,
 			  roc_ctx->phy_mode, roc_ctx->duration,
 			  roc_ctx->roc_type, roc_ctx->roc_state);
 		status = qdf_list_peek_next(&p2p_soc_obj->roc_q,
@@ -836,9 +846,11 @@ QDF_STATUS p2p_process_cleanup_roc_queue(
 		roc_ctx = qdf_container_of(p_node,
 				struct p2p_roc_context, node);
 
-		p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d, tx ctx:%pK, chan:%d, phy_mode:%d, duration:%d, roc_type:%d, roc_state:%d",
+		p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, "
+			  "scan_id:%d, tx ctx:%pK, freq:%d, phy_mode:%d, "
+			  "duration:%d, roc_type:%d, roc_state:%d",
 			  roc_ctx->p2p_soc_obj, roc_ctx, roc_ctx->vdev_id,
-			  roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan,
+			  roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan_freq,
 			  roc_ctx->phy_mode, roc_ctx->duration,
 			  roc_ctx->roc_type, roc_ctx->roc_state);
 
@@ -871,11 +883,13 @@ QDF_STATUS p2p_process_roc_req(struct p2p_roc_context *roc_ctx)
 
 	p2p_soc_obj = roc_ctx->p2p_soc_obj;
 
-	p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d, tx_ctx:%pK, chan:%d, phy_mode:%d, duration:%d, roc_type:%d, roc_state:%d",
-		p2p_soc_obj, roc_ctx, roc_ctx->vdev_id,
-		roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan,
-		roc_ctx->phy_mode, roc_ctx->duration,
-		roc_ctx->roc_type, roc_ctx->roc_state);
+	p2p_debug("p2p soc obj:%pK, roc ctx:%pK, vdev_id:%d, scan_id:%d, "
+		  "tx_ctx:%pK, freq:%d, phy_mode:%d, duration:%d, "
+		  "roc_type:%d, roc_state:%d",
+		  p2p_soc_obj, roc_ctx, roc_ctx->vdev_id,
+		  roc_ctx->scan_id, roc_ctx->tx_ctx, roc_ctx->chan_freq,
+		  roc_ctx->phy_mode, roc_ctx->duration,
+		  roc_ctx->roc_type, roc_ctx->roc_state);
 
 	status = qdf_list_insert_back(&p2p_soc_obj->roc_q,
 			&roc_ctx->node);
diff --git a/components/p2p/core/src/wlan_p2p_roc.h b/components/p2p/core/src/wlan_p2p_roc.h
index f1f27364ac7b..b800b20174b4 100644
--- a/components/p2p/core/src/wlan_p2p_roc.h
+++ b/components/p2p/core/src/wlan_p2p_roc.h
@@ -81,7 +81,7 @@ enum roc_state {
  * @vdev_id:     Vdev id on which this request has come
  * @scan_id:     Scan id given by scan component for this roc req
  * @tx_ctx:      TX context if this ROC is for tx MGMT
- * @chan:        Chan for which this RoC has been requested
+ * @chan_freq:   Chan frequency for which this RoC has been requested
  * @phy_mode:    PHY mode
  * @duration:    Duration for the RoC
  * @roc_type:    RoC type  User requested or internal
@@ -95,7 +95,7 @@ struct p2p_roc_context {
 	uint32_t vdev_id;
 	uint32_t scan_id;
 	void *tx_ctx;
-	qdf_freq_t chan;
+	qdf_freq_t chan_freq;
 	uint8_t phy_mode;
 	uint32_t duration;
 	enum roc_type roc_type;
@@ -165,9 +165,9 @@ struct p2p_roc_context *p2p_find_roc_by_tx_ctx(
 	struct p2p_soc_priv_obj *p2p_soc_obj, uint64_t cookie);
 
 /**
- * p2p_find_roc_by_chan() - Find out roc context by channel
+ * p2p_find_roc_by_chan_freq() - Find out roc context by channel
  * @p2p_soc_obj: p2p psoc private object
- * @chan: channel of the ROC
+ * @chan_freq: channel frequency of the ROC
  *
  * This function finds out roc context by channel from p2p psoc
  * private object
@@ -175,8 +175,8 @@ struct p2p_roc_context *p2p_find_roc_by_tx_ctx(
  * Return: Pointer to roc context - success
  *         NULL                   - failure
  */
-struct p2p_roc_context *p2p_find_roc_by_chan(
-	struct p2p_soc_priv_obj *p2p_soc_obj, uint8_t chan);
+struct p2p_roc_context *p2p_find_roc_by_chan_freq(
+	struct p2p_soc_priv_obj *p2p_soc_obj, qdf_freq_t chan_freq);
 
 /**
  * p2p_restart_roc_timer() - Restarts roc timer
diff --git a/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h b/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h
index 1f09757a868b..060f0df3ba8b 100644
--- a/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h
+++ b/components/p2p/dispatcher/inc/wlan_p2p_public_struct.h
@@ -62,13 +62,13 @@ struct p2p_ps_params {
 /**
  * struct p2p_roc_req - P2P roc request
  * @vdev_id:     Vdev id on which this request has come
- * @chan:        Chan for which this RoC has been requested
+ * @chan_freq:   Chan frequency for which this RoC has been requested
  * @phy_mode:    PHY mode
  * @duration:    Duration for the RoC
  */
 struct p2p_roc_req {
 	uint32_t vdev_id;
-	qdf_freq_t chan;
+	qdf_freq_t chan_freq;
 	uint32_t phy_mode;
 	uint32_t duration;
 };
@@ -90,14 +90,14 @@ enum p2p_roc_event {
  * @vdev_id:     Vdev id
  * @roc_event:   RoC event
  * @cookie:      Cookie which is given to supplicant for this roc req
- * @chan:        Chan for which this RoC has been requested
+ * @chan_freq:   Chan frequency for which this RoC has been requested
  * @duration:    Duration for the RoC
   */
 struct p2p_event {
 	uint32_t vdev_id;
 	enum p2p_roc_event roc_event;
 	uint64_t cookie;
-	qdf_freq_t chan;
+	qdf_freq_t chan_freq;
 	uint32_t duration;
 };
 
@@ -138,7 +138,7 @@ struct p2p_tx_cnf {
 /**
  * struct p2p_mgmt_tx - p2p mgmt tx structure
  * @vdev_id:             Vdev id
- * @chan:                Chan for which this RoC has been requested
+ * @chan_freq:           Chan frequency for which this RoC has been requested
  * @wait:                Duration for the RoC
  * @len:                 Length of tx buffer
  * @no_cck:              Required cck or not
@@ -148,7 +148,7 @@ struct p2p_tx_cnf {
  */
 struct p2p_mgmt_tx {
 	uint32_t vdev_id;
-	uint32_t chan;
+	qdf_freq_t chan_freq;
 	uint32_t wait;
 	uint32_t len;
 	uint32_t no_cck;
diff --git a/components/p2p/dispatcher/src/wlan_p2p_ucfg_api.c b/components/p2p/dispatcher/src/wlan_p2p_ucfg_api.c
index 50444dc6d8e4..3b862f62d3de 100644
--- a/components/p2p/dispatcher/src/wlan_p2p_ucfg_api.c
+++ b/components/p2p/dispatcher/src/wlan_p2p_ucfg_api.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -118,9 +119,9 @@ QDF_STATUS ucfg_p2p_roc_req(struct wlan_objmgr_psoc *soc,
 	QDF_STATUS status;
 	int32_t id;
 
-	p2p_debug("soc:%pK, vdev_id:%d, chan:%d, phy_mode:%d, duration:%d",
-		soc, roc_req->vdev_id, roc_req->chan,
-		roc_req->phy_mode, roc_req->duration);
+	p2p_debug("soc:%pK, vdev_id:%d, chanfreq:%d, phy_mode:%d, duration:%d",
+		  soc, roc_req->vdev_id, roc_req->chan_freq,
+		  roc_req->phy_mode, roc_req->duration);
 
 	if (!soc) {
 		p2p_err("psoc context passed is NULL");
@@ -148,7 +149,7 @@ QDF_STATUS ucfg_p2p_roc_req(struct wlan_objmgr_psoc *soc,
 	*cookie = (uint64_t)id;
 	roc_ctx->p2p_soc_obj = p2p_soc_obj;
 	roc_ctx->vdev_id = roc_req->vdev_id;
-	roc_ctx->chan = roc_req->chan;
+	roc_ctx->chan_freq = roc_req->chan_freq;
 	roc_ctx->phy_mode = roc_req->phy_mode;
 	roc_ctx->duration = roc_req->duration;
 	roc_ctx->roc_state = ROC_STATE_IDLE;
@@ -324,10 +325,11 @@ QDF_STATUS ucfg_p2p_mgmt_tx(struct wlan_objmgr_psoc *soc,
 	QDF_STATUS status;
 	int32_t id;
 
-	p2p_debug("soc:%pK, vdev_id:%d, chan:%d, wait:%d, buf_len:%d, cck:%d, no ack:%d, off chan:%d",
-		soc, mgmt_frm->vdev_id, mgmt_frm->chan,
-		mgmt_frm->wait, mgmt_frm->len, mgmt_frm->no_cck,
-		mgmt_frm->dont_wait_for_ack, mgmt_frm->off_chan);
+	p2p_debug("soc:%pK, vdev_id:%d, freq:%d, wait:%d, buf_len:%d,"
+		  " cck:%d, no ack:%d, off chan:%d",
+		  soc, mgmt_frm->vdev_id, mgmt_frm->chan_freq,
+		  mgmt_frm->wait, mgmt_frm->len, mgmt_frm->no_cck,
+		  mgmt_frm->dont_wait_for_ack, mgmt_frm->off_chan);
 
 	if (!soc) {
 		p2p_err("psoc context passed is NULL");
@@ -361,7 +363,7 @@ QDF_STATUS ucfg_p2p_mgmt_tx(struct wlan_objmgr_psoc *soc,
 	*cookie = (uint64_t)id;
 	tx_action->p2p_soc_obj = p2p_soc_obj;
 	tx_action->vdev_id = mgmt_frm->vdev_id;
-	tx_action->chan = mgmt_frm->chan;
+	tx_action->chan_freq = mgmt_frm->chan_freq;
 	tx_action->duration = mgmt_frm->wait;
 	tx_action->buf_len = mgmt_frm->len;
 	tx_action->no_cck = mgmt_frm->no_cck;
diff --git a/os_if/p2p/src/wlan_cfg80211_p2p.c b/os_if/p2p/src/wlan_cfg80211_p2p.c
index 4db1500f65fa..8363fbe52a80 100644
--- a/os_if/p2p/src/wlan_cfg80211_p2p.c
+++ b/os_if/p2p/src/wlan_cfg80211_p2p.c
@@ -282,7 +282,7 @@ static void wlan_p2p_event_callback(void *user_data,
 		goto fail;
 	}
 
-	chan = ieee80211_get_channel(wdev->wiphy, p2p_event->chan);
+	chan = ieee80211_get_channel(wdev->wiphy, p2p_event->chan_freq);
 	if (!chan) {
 		osif_err("channel conversion failed");
 		goto fail;
@@ -360,7 +360,7 @@ int wlan_cfg80211_roc(struct wlan_objmgr_vdev *vdev,
 		return -EINVAL;
 	}
 
-	roc_req.chan = chan->center_freq;
+	roc_req.chan_freq = chan->center_freq;
 	roc_req.duration = duration;
 	roc_req.vdev_id = (uint32_t)vdev_id;
 
@@ -372,7 +372,7 @@ int wlan_cfg80211_roc(struct wlan_objmgr_vdev *vdev,
 	}
 
 	if (!ok) {
-		osif_err("channel%d not OK for DNBS", roc_req.chan);
+		osif_err("channel%d not OK for DNBS", roc_req.chan_freq);
 		return -EINVAL;
 	}
 
@@ -450,7 +450,7 @@ int wlan_cfg80211_mgmt_tx(struct wlan_objmgr_vdev *vdev,
 	}
 
 	mgmt_tx.vdev_id = (uint32_t)vdev_id;
-	mgmt_tx.chan = chan_freq;
+	mgmt_tx.chan_freq = chan_freq;
 	mgmt_tx.wait = wait;
 	mgmt_tx.len = len;
 	mgmt_tx.no_cck = (uint32_t)no_cck;

From d6e1ed30e5bd70090f15ccd40fcfa26e8dbb9914 Mon Sep 17 00:00:00 2001
From: Ravindra Konda <quic_konda@quicinc.com>
Date: Thu, 10 Apr 2025 01:07:24 -0700
Subject: [PATCH 03/12] Release 2.0.8.35B

Release 2.0.8.35B

Change-Id: Id320fd9d156ae0f075b050ba530da1bce5bb2a69
CRs-Fixed: 774533
---
 core/mac/inc/qwlan_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 5a0f26d5d2fc..d27763477199 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            2
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            8
-#define QWLAN_VERSION_EXTRA            "A"
+#define QWLAN_VERSION_EXTRA            "B"
 #define QWLAN_VERSION_BUILD            35
 
-#define QWLAN_VERSIONSTR               "2.0.8.35A"
+#define QWLAN_VERSIONSTR               "2.0.8.35B"
 
 #endif /* QWLAN_VERSION_H */

From 251ec89b59f1760acaf71e256895f8804a922c95 Mon Sep 17 00:00:00 2001
From: Krupali Dhanvijay <quic_kdhanvij@quicinc.com>
Date: Wed, 19 Mar 2025 14:41:55 +0530
Subject: [PATCH 04/12] qcacld-3.0: Update PMK from firmware for FT-SAE AKM
 also

When roaming happens with full SAE for FT-SAE AKMs host doesn't
update the PMK received from firmware into its global cache.
This causes stale PMK to be sent to firmware when full SAE
happens when roaming to below AKM's:
WLAN_CRYPTO_KEY_MGMT_FT_SAE
WLAN_CRYPTO_KEY_MGMT_FT_SAE_EXT_KEY

So update the PMK sent from firmware for above AKM's when
auth status is connected (full SAE happens at host).

CRs-Fixed: 3807689
Change-Id: I25d1a253de37481952c41f54697521285a0ccf92
---
 core/sme/src/csr/csr_api_roam.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 262b4f292c30..c67bbe35827c 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -21586,11 +21586,12 @@ csr_process_roam_sync_callback(struct mac_context *mac_ctx,
 	 * eapol. So the session->psk_pmk will be stale in PMKSA cached
 	 * SAE/OWE roaming case.
 	 */
+	akm_type = session->connectedProfile.AuthType;
+
 	if (roam_synch_data->authStatus == CSR_ROAM_AUTH_STATUS_AUTHENTICATED ||
-	    session->pCurRoamProfile->negotiatedAuthType ==
-	    eCSR_AUTH_TYPE_SAE ||
-	    session->pCurRoamProfile->negotiatedAuthType ==
-	    eCSR_AUTH_TYPE_OWE) {
+	    akm_type == eCSR_AUTH_TYPE_SAE ||
+	    akm_type == eCSR_AUTH_TYPE_FT_SAE ||
+	    akm_type == eCSR_AUTH_TYPE_OWE) {
 		csr_roam_substate_change(mac_ctx,
 				eCSR_ROAM_SUBSTATE_NONE, session_id);
 		/*
@@ -21615,8 +21616,7 @@ csr_process_roam_sync_callback(struct mac_context *mac_ctx,
 				 &session->connectedProfile.bssid);
 		sme_debug("Trying to find PMKID for " QDF_MAC_ADDR_FMT " AKM Type:%d",
 			  QDF_MAC_ADDR_REF(pmkid_cache->BSSID.bytes),
-			  session->pCurRoamProfile->negotiatedAuthType);
-		akm_type = session->connectedProfile.AuthType;
+			  akm_type);
 		mdie_present = session->connectedProfile.mdid.mdie_present;
 
 		if (csr_lookup_pmkid_using_bssid(mac_ctx, session,
@@ -21696,6 +21696,8 @@ csr_process_roam_sync_callback(struct mac_context *mac_ctx,
 					qdf_mem_zero(pmksa, sizeof(*pmksa));
 					qdf_mem_free(pmksa);
 				}
+			} else {
+				sme_debug("PMK not received from fw");
 			}
 			sme_debug("pmkid found for " QDF_MAC_ADDR_FMT " len %d",
 				  QDF_MAC_ADDR_REF(pmkid_cache->BSSID.bytes),

From 2db179ead0b8274d64f36ef05d0e14748fe657d5 Mon Sep 17 00:00:00 2001
From: Ravindra Konda <quic_konda@quicinc.com>
Date: Thu, 29 May 2025 01:11:39 -0700
Subject: [PATCH 05/12] Release 2.0.8.35C

Release 2.0.8.35C

Change-Id: I6d812e6d4eadfd09a9c6f39761446e73bf207c7f
CRs-Fixed: 774533
---
 core/mac/inc/qwlan_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index d27763477199..8b118e5e2c21 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            2
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            8
-#define QWLAN_VERSION_EXTRA            "B"
+#define QWLAN_VERSION_EXTRA            "C"
 #define QWLAN_VERSION_BUILD            35
 
-#define QWLAN_VERSIONSTR               "2.0.8.35B"
+#define QWLAN_VERSIONSTR               "2.0.8.35C"
 
 #endif /* QWLAN_VERSION_H */

From 1879db349b12c562330bd695942a1bb713d60135 Mon Sep 17 00:00:00 2001
From: Eswar Kesavalu <ekesaval@qti.qualcomm.com>
Date: Fri, 2 May 2025 15:56:44 +0530
Subject: [PATCH 06/12] qcacld-3.0: Add ini to apply RSSI delta for 6 GHz roam

Introduce a new ini parameter, to apply an RSSI penalty
to non-6 GHz candidate APs during roaming from 6 GHz AP.
This ensures roaming to non-6 GHz AP occurs only if it
offers significantly better signal quality.

Change-Id: I02482c37c56c44d3d1804282abd09deaefb8eed3
CRs-Fixed: 4141300
---
 components/mlme/core/src/wlan_mlme_main.c     |  3 ++
 components/mlme/dispatcher/inc/cfg_mlme_lfr.h | 34 +++++++++++++
 .../dispatcher/inc/wlan_mlme_public_struct.h  |  8 ++-
 .../src/target_if_cm_roam_offload.c           | 50 +++++++++++++++++++
 .../core/src/wlan_cm_roam_offload.c           |  8 +++
 .../inc/wlan_cm_roam_public_struct.h          | 12 +++++
 .../dispatcher/src/wlan_cm_roam_api.c         |  9 ++++
 core/sme/src/csr/csr_neighbor_roam.c          |  3 ++
 8 files changed, 125 insertions(+), 2 deletions(-)

diff --git a/components/mlme/core/src/wlan_mlme_main.c b/components/mlme/core/src/wlan_mlme_main.c
index 66f4ef140432..131518cc5cd9 100644
--- a/components/mlme/core/src/wlan_mlme_main.c
+++ b/components/mlme/core/src/wlan_mlme_main.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2018-2020 The Linux Foundation. All rights reserved.
  * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1846,6 +1847,8 @@ static void mlme_init_lfr_cfg(struct wlan_objmgr_psoc *psoc,
 		cfg_get(psoc, CFG_LFR3_ROAM_PREAUTH_RETRY_COUNT);
 	lfr->roam_rssi_diff = cfg_get(psoc, CFG_LFR_ROAM_RSSI_DIFF);
 	lfr->roam_rssi_diff_6ghz = cfg_get(psoc, CFG_LFR_ROAM_RSSI_DIFF_6GHZ);
+	lfr->roam_rssi_delta_6ghz_to_non_6ghz =
+		cfg_get(psoc, CFG_LFR_ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ);
 	lfr->bg_rssi_threshold = cfg_get(psoc, CFG_LFR_ROAM_BG_RSSI_TH);
 	lfr->roam_scan_offload_enabled =
 		cfg_get(psoc, CFG_LFR_ROAM_SCAN_OFFLOAD_ENABLED);
diff --git a/components/mlme/dispatcher/inc/cfg_mlme_lfr.h b/components/mlme/dispatcher/inc/cfg_mlme_lfr.h
index 6ad5d7011e58..135eb7597a3c 100644
--- a/components/mlme/dispatcher/inc/cfg_mlme_lfr.h
+++ b/components/mlme/dispatcher/inc/cfg_mlme_lfr.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved.
  * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1280,6 +1281,38 @@
 	CFG_VALUE_OR_DEFAULT, \
 	"Enable 6 GHz roam based on rssi")
 
+/*
+ * <ini>
+ * roam_rssi_delta_from_6ghz_to_non_6ghz - Enable roam to  Non 6 GHz AP based
+ * on rssi
+ * @Min: 0
+ * @Max: 100
+ * @Default: 0
+ *
+ * This INI is used to decide whether to roam to Non 6 GHz AP or not based on
+ * RSSI. AP1 is the currently associated AP(6 GHz) and AP2(2.4 GHz / 5 GHz) is
+ * chosen for roaming. The Roaming will happen only if AP2 has better Signal
+ * Quality and it has a RSSI better than AP1.
+ * roam_rssi_delta_from_6ghz_to_non_6ghz is the number of dB units AP2 is
+ * better than AP1.
+ *
+ *
+ * Related: None
+ *
+ * Supported Feature: Roaming
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_LFR_ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ CFG_INI_UINT( \
+	"roam_rssi_delta_from_6ghz_to_non_6ghz", \
+	0, \
+	100, \
+	0, \
+	CFG_VALUE_OR_DEFAULT, \
+	"Enable 6 GHz to non 6 GHz roam based on rssi")
+
 /*
  * <ini>
  * bg_rssi_threshold - To set RSSI Threshold for BG scan roaming
@@ -2930,6 +2963,7 @@
 	CFG(CFG_LFR_FAST_TRANSITION_ENABLED) \
 	CFG(CFG_LFR_ROAM_RSSI_DIFF) \
 	CFG(CFG_LFR_ROAM_RSSI_DIFF_6GHZ) \
+	CFG(CFG_LFR_ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ) \
 	CFG(CFG_LFR_ROAM_BG_RSSI_TH) \
 	CFG(CFG_LFR_ENABLE_WES_MODE) \
 	CFG(CFG_LFR_ROAM_SCAN_OFFLOAD_ENABLED) \
diff --git a/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h b/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
index ad48cd35c0cd..9ca94e78d468 100644
--- a/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
+++ b/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2018-2020 The Linux Foundation. All rights reserved.
  * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1680,8 +1681,10 @@ struct fw_scan_channels {
  * @roam_preauth_no_ack_timeout:    Configure the no ack timeout period
  * @roam_rssi_diff:                 Enable roam based on rssi
  * @roam_rssi_diff_6ghz: RSSI diff value to be used for roaming to 6 GHz AP.
- * @roam_scan_offload_enabled:      Enable Roam Scan Offload
- * @neighbor_scan_timer_period:     Neighbor scan timer period
+ * @roam_rssi_delta_6ghz_to_non_6ghz: RSSI diff value to be used for
+ * roaming from 6 GHz to Non 6GHz AP.
+ * @roam_scan_offload_enabled: Enable Roam Scan Offload
+ * @neighbor_scan_timer_period: Neighbor scan timer period
  * @neighbor_scan_min_timer_period: Min neighbor scan timer period
  * @neighbor_lookup_rssi_threshold: Neighbor lookup rssi threshold
  * @opportunistic_scan_threshold_diff: Set oppurtunistic threshold diff
@@ -1804,6 +1807,7 @@ struct wlan_mlme_lfr_cfg {
 	uint32_t roam_preauth_no_ack_timeout;
 	uint8_t roam_rssi_diff;
 	uint8_t roam_rssi_diff_6ghz;
+	uint8_t roam_rssi_delta_6ghz_to_non_6ghz;
 	uint8_t bg_rssi_threshold;
 	bool roam_scan_offload_enabled;
 	uint32_t neighbor_scan_timer_period;
diff --git a/components/target_if/connection_mgr/src/target_if_cm_roam_offload.c b/components/target_if/connection_mgr/src/target_if_cm_roam_offload.c
index 46e1cab26484..970d0429f1b7 100644
--- a/components/target_if/connection_mgr/src/target_if_cm_roam_offload.c
+++ b/components/target_if/connection_mgr/src/target_if_cm_roam_offload.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
  * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -264,6 +265,41 @@ target_if_cm_roam_rssi_diff_6ghz(struct wlan_objmgr_vdev *vdev,
 	return status;
 }
 
+/**
+ * target_if_cm_roam_rssi_delta_6ghz_to_non_6ghz() - Sends the roam RSSI
+ * diff value to the FW. This value is used to determine how much better
+ * the RSSI of the new/roamable non-6 GHz AP must be for roaming.
+ *
+ * @vdev: vdev object
+ * @roam_rssi_delta_6ghz_to_non_6ghz: RSSI diff value to be used for roaming to
+ * Non 6 GHz AP
+ *
+ * Return: QDF_STATUS
+ */
+static QDF_STATUS
+target_if_cm_roam_rssi_delta_6ghz_to_non_6ghz(struct wlan_objmgr_vdev *vdev,
+					      uint8_t roam_rssi_delta_6ghz_to_non_6ghz)
+{
+	QDF_STATUS status = QDF_STATUS_E_FAILURE;
+	uint8_t vdev_id;
+	wmi_unified_t wmi_handle;
+
+	wmi_handle = target_if_cm_roam_get_wmi_handle_from_vdev(vdev);
+	if (!wmi_handle)
+		return status;
+
+	vdev_id = wlan_vdev_get_id(vdev);
+	status = target_if_roam_set_param(
+			wmi_handle, vdev_id,
+			WMI_ROAM_PARAM_ROAM_RSSI_PENALTY_FOR_NON_6GHZ_CAND_AP,
+			roam_rssi_delta_6ghz_to_non_6ghz);
+
+	if (QDF_IS_STATUS_ERROR(status))
+		target_if_err("Failed to set WMI_ROAM_PARAM_ROAM_RSSI_PENALTY_FOR_NON_6GHZ_CAND_AP");
+
+	return status;
+}
+
 static QDF_STATUS
 target_if_cm_roam_scan_offload_rssi_thresh(
 				wmi_unified_t wmi_handle,
@@ -367,6 +403,13 @@ target_if_cm_roam_rssi_diff_6ghz(struct wlan_objmgr_vdev *vdev,
 	return QDF_STATUS_E_NOSUPPORT;
 }
 
+static QDF_STATUS
+target_if_cm_roam_rssi_delta_6ghz_to_non_6ghz(struct wlan_objmgr_vdev *vdev,
+					      uint8_t roam_rssi_diff_6ghz)
+{
+	return QDF_STATUS_E_NOSUPPORT;
+}
+
 static inline void
 target_if_check_hi_rssi_5ghz_support(
 		wmi_unified_t wmi_handle,
@@ -1276,6 +1319,9 @@ target_if_cm_roam_send_start(struct wlan_objmgr_vdev *vdev,
 	if (req->wlan_roam_rssi_diff_6ghz)
 		target_if_cm_roam_rssi_diff_6ghz(vdev,
 						 req->wlan_roam_rssi_diff_6ghz);
+	if (req->wlan_roam_rssi_delta_6ghz_to_non_6ghz)
+		target_if_cm_roam_rssi_delta_6ghz_to_non_6ghz(
+			vdev, req->wlan_roam_rssi_delta_6ghz_to_non_6ghz);
 
 	/* add other wmi commands */
 end:
@@ -1516,6 +1562,10 @@ target_if_cm_roam_send_update_config(struct wlan_objmgr_vdev *vdev,
 		if (req->wlan_roam_rssi_diff_6ghz)
 			target_if_cm_roam_rssi_diff_6ghz(
 					vdev, req->wlan_roam_rssi_diff_6ghz);
+
+		if (req->wlan_roam_rssi_delta_6ghz_to_non_6ghz)
+			target_if_cm_roam_rssi_delta_6ghz_to_non_6ghz(
+			vdev, req->wlan_roam_rssi_delta_6ghz_to_non_6ghz);
 	}
 end:
 	return status;
diff --git a/components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.c b/components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.c
index 647f5e0229b2..8f5e5272d77c 100644
--- a/components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.c
+++ b/components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.c
@@ -629,6 +629,10 @@ cm_roam_start_req(struct wlan_objmgr_psoc *psoc, uint8_t vdev_id,
 	wlan_cm_roam_cfg_get_value(psoc, vdev_id, ROAM_RSSI_DIFF_6GHZ, &temp);
 	start_req->wlan_roam_rssi_diff_6ghz = temp.uint_value;
 
+	wlan_cm_roam_cfg_get_value(psoc, vdev_id,
+				   ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ, &temp);
+	start_req->wlan_roam_rssi_delta_6ghz_to_non_6ghz = temp.uint_value;
+
 	status = wlan_cm_tgt_send_roam_start_req(psoc, vdev_id, start_req);
 	if (QDF_IS_STATUS_ERROR(status))
 		mlme_debug("fail to send roam start");
@@ -691,6 +695,10 @@ cm_roam_update_config_req(struct wlan_objmgr_psoc *psoc, uint8_t vdev_id,
 	wlan_cm_roam_cfg_get_value(psoc, vdev_id, ROAM_RSSI_DIFF_6GHZ, &temp);
 	update_req->wlan_roam_rssi_diff_6ghz = temp.uint_value;
 
+	wlan_cm_roam_cfg_get_value(psoc, vdev_id,
+				   ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ, &temp);
+	update_req->wlan_roam_rssi_delta_6ghz_to_non_6ghz  = temp.uint_value;
+
 	status = wlan_cm_tgt_send_roam_update_req(psoc, vdev_id, update_req);
 	if (QDF_IS_STATUS_ERROR(status))
 		mlme_debug("fail to send update config");
diff --git a/components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_roam_public_struct.h b/components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_roam_public_struct.h
index 9a027bc6a11f..b4d17e9c04fe 100644
--- a/components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_roam_public_struct.h
+++ b/components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_roam_public_struct.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
  * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -120,12 +121,14 @@
  * @BEACON_RSSI_WEIGHT: Beacon Rssi weight parameter
  * @HI_RSSI_DELAY_BTW_SCANS: High Rssi delay between scans
  * @ROAM_RSSI_DIFF_6GHZ: roam rssi diff for 6 GHz AP
+ * @ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ: roam rssi diff for Non 6 GHz AP
  */
 enum roam_cfg_param {
 	RSSI_CHANGE_THRESHOLD,
 	BEACON_RSSI_WEIGHT,
 	HI_RSSI_DELAY_BTW_SCANS,
 	ROAM_RSSI_DIFF_6GHZ,
+	ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ,
 };
 
 /**
@@ -1206,6 +1209,8 @@ enum roam_rt_stats_params {
  * scan only on prior discovery of any 6 GHz support in the environment.
  * @wlan_roam_rssi_diff_6ghz: This value is used as to how better the RSSI of
  * the new/roamable 6GHz AP should be for roaming.
+ * @wlan_roam_rssi_delta_6ghz_to_non_6ghz: This value is used as to how better
+ * the RSSI of the new/roamable non 6GHz AP should be for roaming.
  */
 struct wlan_roam_start_config {
 	struct wlan_roam_offload_scan_rssi_params rssi_params;
@@ -1229,6 +1234,7 @@ struct wlan_roam_start_config {
 	uint8_t wlan_exclude_rm_partial_scan_freq;
 	uint8_t wlan_roam_full_scan_6ghz_on_disc;
 	uint8_t wlan_roam_rssi_diff_6ghz;
+	uint8_t wlan_roam_rssi_delta_6ghz_to_non_6ghz;
 	/* other wmi cmd structures */
 };
 
@@ -1281,6 +1287,8 @@ struct wlan_roam_stop_config {
  * scan only on prior discovery of any 6 GHz support in the environment.
  * @wlan_roam_rssi_diff_6ghz: This value is used as to how better the RSSI of
  * the new/roamable 6GHz AP should be for roaming.
+ * @wlan_roam_rssi_delta_6ghz_to_non_6ghz: This value is used as to how better
+ * the RSSI of the new/roamable non 6GHz AP should be for roaming.
  */
 struct wlan_roam_update_config {
 	struct wlan_roam_beacon_miss_cnt beacon_miss_cnt;
@@ -1299,6 +1307,7 @@ struct wlan_roam_update_config {
 	uint8_t wlan_exclude_rm_partial_scan_freq;
 	uint8_t wlan_roam_full_scan_6ghz_on_disc;
 	uint8_t wlan_roam_rssi_diff_6ghz;
+	uint8_t wlan_roam_rssi_delta_6ghz_to_non_6ghz;
 };
 
 #if defined(WLAN_FEATURE_HOST_ROAM) || defined(WLAN_FEATURE_ROAM_OFFLOAD)
@@ -1522,6 +1531,8 @@ enum roam_fail_params {
  * @roam_invoke_fail_reason: One of reason id from enum
  * wmi_roam_invoke_status_error in case of forced roam
  * @roam_rssi_diff_6ghz: roam rssi diff for 6 GHz AP
+ * @roam_rssi_delta_6ghz_to_non_6ghz: RSSI Delta value to be used for roaming
+ * from 6 GHz to Non 6GHz AP.
  */
 struct wlan_cm_rso_configs {
 	uint8_t rescan_rssi_delta;
@@ -1532,6 +1543,7 @@ struct wlan_cm_rso_configs {
 	uint32_t roam_trigger_reason;
 	uint32_t roam_invoke_fail_reason;
 	uint8_t roam_rssi_diff_6ghz;
+	uint8_t roam_rssi_delta_6ghz_to_non_6ghz;
 };
 
 /**
diff --git a/components/umac/mlme/connection_mgr/dispatcher/src/wlan_cm_roam_api.c b/components/umac/mlme/connection_mgr/dispatcher/src/wlan_cm_roam_api.c
index 53fce94e29c3..8ad4cef25e38 100644
--- a/components/umac/mlme/connection_mgr/dispatcher/src/wlan_cm_roam_api.c
+++ b/components/umac/mlme/connection_mgr/dispatcher/src/wlan_cm_roam_api.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
  * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -519,6 +520,10 @@ QDF_STATUS wlan_cm_roam_cfg_get_value(struct wlan_objmgr_psoc *psoc,
 	case ROAM_RSSI_DIFF_6GHZ:
 		dst_config->uint_value = src_config->roam_rssi_diff_6ghz;
 		break;
+	case ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ:
+		dst_config->uint_value =
+			src_config->roam_rssi_delta_6ghz_to_non_6ghz;
+		break;
 	default:
 		mlme_err("Invalid roam config requested:%d", roam_cfg_type);
 		status = QDF_STATUS_E_FAILURE;
@@ -568,6 +573,10 @@ wlan_cm_roam_cfg_set_value(struct wlan_objmgr_psoc *psoc, uint8_t vdev_id,
 	case ROAM_RSSI_DIFF_6GHZ:
 		dst_config->roam_rssi_diff_6ghz = src_config->uint_value;
 		break;
+	case ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ:
+		dst_config->roam_rssi_delta_6ghz_to_non_6ghz  =
+						src_config->uint_value;
+		break;
 	default:
 		mlme_err("Invalid roam config requested:%d", roam_cfg_type);
 		status = QDF_STATUS_E_FAILURE;
diff --git a/core/sme/src/csr/csr_neighbor_roam.c b/core/sme/src/csr/csr_neighbor_roam.c
index df8c0cfabee5..199c4352952f 100644
--- a/core/sme/src/csr/csr_neighbor_roam.c
+++ b/core/sme/src/csr/csr_neighbor_roam.c
@@ -848,6 +848,9 @@ static void csr_neighbor_roam_info_ctx_init(struct mac_context *mac,
 	wlan_cm_roam_cfg_set_value(mac->psoc, session_id,
 				   ROAM_RSSI_DIFF_6GHZ, &src_cfg);
 
+	src_cfg.uint_value = mac->mlme_cfg->lfr.roam_rssi_delta_6ghz_to_non_6ghz;
+	wlan_cm_roam_cfg_set_value(mac->psoc, session_id,
+				   ROAM_RSSI_DELTA_6GHZ_TO_NON_6GHZ, &src_cfg);
 	/*
 	 * Now we can clear the preauthDone that
 	 * was saved as we are connected afresh

From f3f95c51abbe5f02fa34e64cf96d2a79ede7dcb2 Mon Sep 17 00:00:00 2001
From: Ravindra Konda <quic_konda@quicinc.com>
Date: Thu, 5 Jun 2025 01:33:58 -0700
Subject: [PATCH 07/12] Release 2.0.8.35D

Release 2.0.8.35D

Change-Id: I3b0c1f0536f0ef1278181c95747928037ea12311
CRs-Fixed: 774533
---
 core/mac/inc/qwlan_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 8b118e5e2c21..0e3eaa97f81d 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            2
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            8
-#define QWLAN_VERSION_EXTRA            "C"
+#define QWLAN_VERSION_EXTRA            "D"
 #define QWLAN_VERSION_BUILD            35
 
-#define QWLAN_VERSIONSTR               "2.0.8.35C"
+#define QWLAN_VERSIONSTR               "2.0.8.35D"
 
 #endif /* QWLAN_VERSION_H */

From fed91e16d8019d54b98c0b999126456d2d172ef8 Mon Sep 17 00:00:00 2001
From: Surya Prakash Sivaraj <suryapra@qti.qualcomm.com>
Date: Thu, 28 Apr 2022 15:25:15 +0530
Subject: [PATCH 08/12] qcacld-3.0: Validate bw in lim calculate tpc

Currently host driver does not validate bw in lim calculate
tpc api before is it gets next higher bw, there is a possiblity
that this bw becomes invalid and driver ends up with out of bound
access for get higher bw array.

In current scenario when host driver tries to start vdev on
frequency 2472 for country IN and executes this API for frequency
2472, at the same time country is changed to US and this frequency
becomes invalid. so in the execution of this API host driver gets
invalid bw from reg set param and ends up with out of bound access
for get higher bw array.

TO address above issue, add a check to validate bw before driver
acceses get higher bw array.

Change-Id: Ibd6a2ff44a7928bb2fd461e6c49d4e306e4de7f7
CRs-Fixed: 3186084
---
 core/mac/src/pe/lim/lim_process_sme_req_messages.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index 49113c9529e4..41842fe17ead 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -2223,7 +2223,9 @@ void lim_calculate_tpc(struct mac_context *mac,
 
 	ch_params.ch_width = CH_WIDTH_20MHZ;
 
-	for (i = 0; i < num_pwr_levels; i++) {
+	for (i = 0;
+		i < num_pwr_levels && (ch_params.ch_width != CH_WIDTH_INVALID);
+		i++) {
 		if (is_tpe_present) {
 			if (is_6ghz_freq) {
 				wlan_reg_get_client_power_for_connecting_ap(
@@ -2241,8 +2243,9 @@ void lim_calculate_tpc(struct mac_context *mac,
 					mac->pdev, oper_freq, 0, &ch_params);
 				mlme_obj->reg_tpc_obj.frequency[i] =
 					ch_params.mhz_freq_seg0;
-				ch_params.ch_width =
-					get_next_higher_bw[ch_params.ch_width];
+				if (ch_params.ch_width != CH_WIDTH_INVALID)
+					ch_params.ch_width =
+						get_next_higher_bw[ch_params.ch_width];
 			}
 			if (is_6ghz_freq) {
 				if (LIM_IS_STA_ROLE(session)) {

From ad3eca7060b622d9985ccff785d776f2883fc3c9 Mon Sep 17 00:00:00 2001
From: Ravindra Konda <quic_konda@quicinc.com>
Date: Tue, 22 Jul 2025 12:55:06 -0700
Subject: [PATCH 09/12] Release 2.0.8.35E

Release 2.0.8.35E

Change-Id: I831554185675089d3055c9e071c39944fe5c8f68
CRs-Fixed: 774533
---
 core/mac/inc/qwlan_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 0e3eaa97f81d..212336852d5f 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            2
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            8
-#define QWLAN_VERSION_EXTRA            "D"
+#define QWLAN_VERSION_EXTRA            "E"
 #define QWLAN_VERSION_BUILD            35
 
-#define QWLAN_VERSIONSTR               "2.0.8.35D"
+#define QWLAN_VERSIONSTR               "2.0.8.35E"
 
 #endif /* QWLAN_VERSION_H */

From 1c5657681bfefeb006bc92b9b55aad16249218a6 Mon Sep 17 00:00:00 2001
From: Surya Prakash Sivaraj <suryapra@qti.qualcomm.com>
Date: Wed, 18 Jun 2025 12:17:24 +0530
Subject: [PATCH 10/12] qcacld-3.0: Add TPE IE EIRP power support for 6 GHz
 band

Add TPE IE EIRP power parsing support for 6 GHz channels.
1) Currently, is_psd_power flag is derived from current
channel list chan flag which returns true if corresponding
channel supports PSD power. Normally, all 6 GHz channels
support PSD, so this flag is usually set to 1. But, AP
can transmit EIRP power in TPE IE for 6 GHz channels,
thus derive this flag based on tx_power interpretation
field in TPE IE for accurate value.
2) The calculated center freq is passed as argument to
retrieve regulatory power from reg channel list
but this logic works only for PSD. E.g. In case of EIRP,
center freq can be 6125 MHz for oper freq 6115 and BW
40 MHz, and causing reg APIs to return reg power as 0.
Thus, pass operating freq as argument in case of EIRP.

Change-Id: If1ad3870a866592d970adad218e507c9c756f615
CRs-Fixed: 3266393
---
 .../src/pe/lim/lim_process_sme_req_messages.c | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index 41842fe17ead..a48c6c707fa7 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -2059,6 +2059,7 @@ void lim_parse_tpe_ie(struct mac_context *mac, struct pe_session *session,
 		single_tpe = tpe_ies[non_psd_index];
 		vdev_mlme->reg_tpc_obj.eirp_power =
 			single_tpe.tx_power[single_tpe.max_tx_pwr_count];
+		vdev_mlme->reg_tpc_obj.is_psd_power = false;
 	}
 }
 
@@ -2202,7 +2203,6 @@ void lim_calculate_tpc(struct mac_context *mac,
 		skip_tpe = wlan_mlme_skip_tpe(mac->psoc);
 	} else {
 		is_6ghz_freq = true;
-		is_psd_power = wlan_reg_is_6g_psd_power(mac->pdev);
 		if (LIM_IS_STA_ROLE(session))
 			ap_power_type_6g = session->best_6g_power_type;
 	}
@@ -2210,6 +2210,7 @@ void lim_calculate_tpc(struct mac_context *mac,
 	if (mlme_obj->reg_tpc_obj.num_pwr_levels) {
 		is_tpe_present = true;
 		num_pwr_levels = mlme_obj->reg_tpc_obj.num_pwr_levels;
+		is_psd_power = mlme_obj->reg_tpc_obj.is_psd_power;
 	} else {
 		num_pwr_levels = lim_get_num_pwr_levels(is_psd_power,
 							session->ch_width);
@@ -2228,10 +2229,16 @@ void lim_calculate_tpc(struct mac_context *mac,
 		i++) {
 		if (is_tpe_present) {
 			if (is_6ghz_freq) {
-				wlan_reg_get_client_power_for_connecting_ap(
-				mac->pdev, ap_power_type_6g,
-				mlme_obj->reg_tpc_obj.frequency[i],
-				&is_psd_power, &reg_max, &psd_power);
+				if (is_psd_power) {
+					wlan_reg_get_client_power_for_connecting_ap(
+						mac->pdev, ap_power_type_6g,
+						mlme_obj->reg_tpc_obj.frequency[i],
+						is_psd_power, &reg_max, &psd_power);
+				} else {
+					wlan_reg_get_client_power_for_connecting_ap(
+						mac->pdev, ap_power_type_6g, oper_freq,
+						is_psd_power, &reg_max, &psd_power);
+				}
 			}
 		} else {
 			/* center frequency calculation */
@@ -2252,10 +2259,9 @@ void lim_calculate_tpc(struct mac_context *mac,
 					wlan_reg_get_client_power_for_connecting_ap
 					(mac->pdev, ap_power_type_6g,
 					 mlme_obj->reg_tpc_obj.frequency[i],
-					 &is_psd_power, &reg_max, &psd_power);
+					 is_psd_power, &reg_max, &psd_power);
 				} else {
-					ap_power_type_6g =
-						wlan_reg_get_cur_6g_ap_pwr_type(
+					wlan_reg_get_cur_6g_ap_pwr_type(
 							mac->pdev,
 							&ap_power_type_6g);
 					wlan_reg_get_6g_chan_ap_power(
@@ -2321,7 +2327,6 @@ void lim_calculate_tpc(struct mac_context *mac,
 	}
 
 	mlme_obj->reg_tpc_obj.num_pwr_levels = num_pwr_levels;
-	mlme_obj->reg_tpc_obj.is_psd_power = is_psd_power;
 	mlme_obj->reg_tpc_obj.eirp_power = reg_max;
 	mlme_obj->reg_tpc_obj.power_type_6g = ap_power_type_6g;
 

From 1eea4bab119a5e3bbb078ba4bf9d1f3a6b37a6ab Mon Sep 17 00:00:00 2001
From: Surya Prakash Sivaraj <suryapra@qti.qualcomm.com>
Date: Wed, 18 Jun 2025 12:23:26 +0530
Subject: [PATCH 11/12] qcacld-3.0: don't overwrite psd_power flag if psd_set
 is true

When both EIRP and PSD TPE IEs are advertised by 6 GHz AP, we need
to use PSD power. We need to keep the psd_power true if psd_set
is true (means PSD TPE IE present) when driver processes the EIRP
TPE IE.
If reg rules don't support psd power, ignore PSD TPE IE.

Change-Id: I96cf8f08ffd0aa143f0f0f453eed3c8b8e5d2382
CRs-Fixed: 3693350
---
 .../src/pe/lim/lim_process_sme_req_messages.c | 25 ++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index a48c6c707fa7..0ac96d900386 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -1903,6 +1903,8 @@ void lim_parse_tpe_ie(struct mac_context *mac, struct pe_session *session,
 	uint16_t bw_val, ch_width;
 	qdf_freq_t curr_op_freq, curr_freq;
 	enum reg_6g_client_type client_mobility_type;
+	enum reg_6g_ap_type ap_power_type_6g;
+	uint16_t reg_max = 0, psd_power = 0;
 	struct ch_params ch_params = {0};
 	tDot11fIEtransmit_power_env single_tpe;
 	/*
@@ -1979,6 +1981,25 @@ void lim_parse_tpe_ie(struct mac_context *mac, struct pe_session *session,
 	curr_op_freq = session->curr_op_freq;
 	bw_val = wlan_reg_get_bw_value(session->ch_width);
 
+	if (psd_set) {
+		if (wlan_reg_is_6ghz_chan_freq(curr_op_freq)) {
+			ap_power_type_6g = session->best_6g_power_type;
+
+			wlan_reg_get_client_power_for_connecting_ap(
+						mac->pdev, ap_power_type_6g,
+						curr_op_freq, true, &reg_max, &psd_power);
+
+			/* If reg rules don't support psd power, ignore PSD
+			 * TPE IE
+			 */
+			if (!psd_power) {
+				pe_debug_rl("reg rule doesn't support psd for %d ap type %d",
+					    curr_op_freq, ap_power_type_6g);
+				psd_set = false;
+			}
+		}
+	}
+
 	if (non_psd_set && !psd_set) {
 		single_tpe = tpe_ies[non_psd_index];
 		vdev_mlme->reg_tpc_obj.is_psd_power = false;
@@ -2059,7 +2080,9 @@ void lim_parse_tpe_ie(struct mac_context *mac, struct pe_session *session,
 		single_tpe = tpe_ies[non_psd_index];
 		vdev_mlme->reg_tpc_obj.eirp_power =
 			single_tpe.tx_power[single_tpe.max_tx_pwr_count];
-		vdev_mlme->reg_tpc_obj.is_psd_power = false;
+		pe_debug("eirp_power %d", vdev_mlme->reg_tpc_obj.eirp_power);
+		if (!psd_set)
+			vdev_mlme->reg_tpc_obj.is_psd_power = false;
 	}
 }
 

From 7604d08f894532472b9dce5ecca083eb57b69594 Mon Sep 17 00:00:00 2001
From: Ravindra Konda <quic_konda@quicinc.com>
Date: Tue, 22 Jul 2025 15:20:49 -0700
Subject: [PATCH 12/12] Release 2.0.8.35F

Release 2.0.8.35F

Change-Id: I8d4a6dabef540cd4594e32e3131bd508b4dd7ea9
CRs-Fixed: 774533
---
 core/mac/inc/qwlan_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 212336852d5f..7c707bd54fb8 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            2
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            8
-#define QWLAN_VERSION_EXTRA            "E"
+#define QWLAN_VERSION_EXTRA            "F"
 #define QWLAN_VERSION_BUILD            35
 
-#define QWLAN_VERSIONSTR               "2.0.8.35E"
+#define QWLAN_VERSIONSTR               "2.0.8.35F"
 
 #endif /* QWLAN_VERSION_H */