Snap for 10566483 from 5150ec184015e5bd67420675a0425f52ee34e9bb to android13-gs-pixel-5.10-releaseandroid-u-beta-5_r0.7android-u-beta-5_r0.5android-u-beta-5_r0.4android-u-beta-5_r0.3android-u-beta-5_r0.2android-u-beta-5_r0.1android-u-beta-5.2_r0.7android-u-beta-5.2_r0.6android-u-beta-5.2_r0.5android-u-beta-5.2_r0.3android-u-beta-5.2_r0.1android-gs-tangorpro-5.10-u-beta5.2android-gs-tangorpro-5.10-u-beta5android-gs-raviole-5.10-u-beta5.2android-gs-raviole-5.10-u-beta5android-gs-pantah-5.10-u-beta5android-gs-lynx-5.10-u-beta5.2android-gs-lynx-5.10-u-beta5android-gs-felix-5.10-u-beta5.2android-gs-felix-5.10-u-beta5android-gs-bluejay-5.10-u-beta5.2android-gs-bluejay-5.10-u-beta5

Change-Id: Ib565ce14e6d3ffa4294d4b55b0577b86fe832d15

3 files changed, 25 insertions, 12 deletions

diff --git a/qcacld-3.0/core/hdd/src/wlan_hdd_driver_ops.c b/qcacld-3.0/core/hdd/src/wlan_hdd_driver_ops.c
index 2c8498e..a2dd000 100644
--- a/qcacld-3.0/core/hdd/src/wlan_hdd_driver_ops.c
+++ b/qcacld-3.0/core/hdd/src/wlan_hdd_driver_ops.c
@@ -2058,6 +2058,7 @@ wlan_hdd_pld_uevent(struct device *dev, struct pld_uevent_data *event_data)
 	struct qdf_notifer_data hang_evt_data;
 	enum qdf_hang_reason reason = QDF_REASON_UNSPECIFIED;
 	uint8_t bus_type;
+	void *hif_ctx = cds_get_context(QDF_MODULE_ID_HIF);
 
 	bus_type = pld_get_bus_type(dev);
 
@@ -2098,6 +2099,12 @@ wlan_hdd_pld_uevent(struct device *dev, struct pld_uevent_data *event_data)
 	case PLD_FW_HANG_EVENT:
 		cds_get_recovery_reason(&reason);
 		hdd_info("Received firmware hang event, reason: %d", reason);
+
+		if ((reason == QDF_REASON_UNSPECIFIED) && hif_ctx) {
+			hif_display_ctrl_traffic_pipes_state(hif_ctx);
+			hif_display_latest_desc_hist(hif_ctx);
+		}
+
 		qdf_mem_zero(&g_fw_host_hang_event, QDF_HANG_EVENT_DATA_SIZE);
 		hang_evt_data.hang_data = g_fw_host_hang_event;
 		hang_evt_data.offset = 0;
diff --git a/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index 0451464..7fd0e8f 100644
--- a/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/qcacld-3.0/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -5156,7 +5156,7 @@ void lim_calculate_tpc(struct mac_context *mac,
 	qdf_freq_t oper_freq, start_freq = 0;
 	struct ch_params ch_params;
 	struct vdev_mlme_obj *mlme_obj;
-	uint8_t tpe_power;
+	int8_t tpe_power;
 	bool skip_tpe = false;
 	bool rf_test_mode = false;
 	bool safe_mode_enable = false;
@@ -5287,7 +5287,14 @@ void lim_calculate_tpc(struct mac_context *mac,
 				tpe_power =  mlme_obj->reg_tpc_obj.eirp_power;
 			else
 				tpe_power = mlme_obj->reg_tpc_obj.tpe[i];
-			max_tx_power = QDF_MIN(max_tx_power, (int8_t)tpe_power);
+			/**
+			 * AP advertises TPE IE tx power as 8-bit unsigned int.
+			 * STA needs to convert it into an 8-bit 2s complement
+			 * signed integer in the range –64 dBm to 63 dBm with a
+			 * 0.5 dB step
+			 */
+			tpe_power /= 2;
+			max_tx_power = QDF_MIN(max_tx_power, tpe_power);
 			pe_debug("TPE: %d", tpe_power);
 		}
 
diff --git a/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c b/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c
index 58a0f6a..0689898 100644
--- a/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c
+++ b/qcacld-3.0/core/mac/src/pe/lim/lim_utils.c
@@ -1874,17 +1874,16 @@ static void __lim_process_channel_switch_timeout(struct pe_session *pe_session)
 		}
 
 		/*
-		 * If the channel-list that AP is asking us to switch is invalid
-		 * then we cannot switch the channel. Just disassociate from AP.
-		 * We will find a better AP !!!
+		 * The channel switch request received from AP is carrying
+		 * invalid channel. It's ok to ignore this channel switch
+		 * request as it might be from spoof AP. If it's from genuine
+		 * AP, it may lead to heart beat failure and result in
+		 * disconnection. DUT can go ahead and reconnect to it/any
+		 * other AP once it disconnects.
 		 */
-		if (lim_is_sb_disconnect_allowed(pe_session)) {
-			pe_err("Invalid channel! Disconnect");
-			lim_tear_down_link_with_ap(mac, pe_session->peSessionId,
-					   REASON_UNSUPPORTED_CHANNEL_CSA,
-					   eLIM_LINK_MONITORING_DISASSOC);
-			return;
-		}
+		pe_err("Invalid channel freq %u Ignore CSA request",
+		       channel_freq);
+		return;
 	}
 	switch (pe_session->gLimChannelSwitch.state) {
 	case eLIM_CHANNEL_SWITCH_PRIMARY_ONLY: