Merge AU_LINUX_ANDROID_LW.UM.2.1.R1.11.00.00.200.040

This updates our sources to CodeLinaro release
AU_LINUX_ANDROID_LW.UM.2.1.R1.11.00.00.200.040 (LW.UM.2.1.r1-04000-SW5100.0),
which corresponds to ChipCode LW 2.0 r00078.3a.

Bug: 280095980
Change-Id: I31d33098e7c742877b5719e5167b8a9ecead8fbe
Signed-off-by: Daniel Price <danielprice@google.com>
diff --git a/cfg/src/cfg.c b/cfg/src/cfg.c
index 86bb1a4..309a090 100644
--- a/cfg/src/cfg.c
+++ b/cfg/src/cfg.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -619,7 +620,7 @@
 		case CFG_MAC_ITEM:
 			cfg_nofl_debug("%pK %s " QDF_MAC_ADDR_FMT,
 				       offset, meta->name,
-				       QDF_MAC_ADDR_REF(offset));
+				       QDF_MAC_ADDR_REF((uint8_t *)offset));
 			break;
 		case CFG_IPV4_ITEM:
 			cfg_nofl_debug("%pK %s %pI4",
@@ -694,7 +695,8 @@
 			len = qdf_scnprintf(buf, buflen,
 					    "%s " QDF_MAC_ADDR_FMT "\n",
 					    meta->name,
-					    QDF_MAC_ADDR_REF(offset));
+					    QDF_MAC_ADDR_REF(
+						(uint8_t *)offset));
 			buf += len;
 			buflen -= len;
 			break;
diff --git a/dp/wifi3.0/dp_htt.c b/dp/wifi3.0/dp_htt.c
index ae788a9..cfc93ef 100644
--- a/dp/wifi3.0/dp_htt.c
+++ b/dp/wifi3.0/dp_htt.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -3049,9 +3049,7 @@
 				 */
 				dp_peer_unref_delete(peer, DP_MOD_ID_HTT);
 
-				QDF_TRACE(QDF_MODULE_ID_TXRX,
-					QDF_TRACE_LEVEL_INFO,
-					FL("PeerID %d BAW %d TID %d stat %d"),
+				dp_info("PeerID %d BAW %d TID %d stat %d",
 					peer_id, win_sz, tid, status);
 
 			} else {
diff --git a/dp/wifi3.0/dp_rx.h b/dp/wifi3.0/dp_rx.h
index 26dac89..75b2fdf 100644
--- a/dp/wifi3.0/dp_rx.h
+++ b/dp/wifi3.0/dp_rx.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1997,13 +1997,33 @@
 	hal_rx_tlv_csum_err_get(pdev->soc->hal_soc, rx_tlv_hdr, &ip_csum_err,
 				&tcp_udp_csum_er);
 
-	if (qdf_likely(!ip_csum_err && !tcp_udp_csum_er)) {
-		cksum.l4_result = QDF_NBUF_RX_CKSUM_TCP_UDP_UNNECESSARY;
-		qdf_nbuf_set_rx_cksum(nbuf, &cksum);
+	if (qdf_nbuf_is_ipv4_pkt(nbuf)) {
+		if (qdf_likely(!ip_csum_err)) {
+			cksum.l4_result = QDF_NBUF_RX_CKSUM_TCP_UDP_UNNECESSARY;
+			if (qdf_nbuf_is_ipv4_udp_pkt(nbuf) ||
+			    qdf_nbuf_is_ipv4_tcp_pkt(nbuf)) {
+				if (qdf_likely(!tcp_udp_csum_er))
+					cksum.csum_level = 1;
+				else
+					DP_STATS_INCC(pdev,
+						      err.tcp_udp_csum_err, 1,
+						      tcp_udp_csum_er);
+			}
+		} else {
+			DP_STATS_INCC(pdev, err.ip_csum_err, 1, ip_csum_err);
+		}
+	} else if (qdf_nbuf_is_ipv6_udp_pkt(nbuf) ||
+		   qdf_nbuf_is_ipv6_tcp_pkt(nbuf)) {
+		if (qdf_likely(!tcp_udp_csum_er))
+			cksum.l4_result = QDF_NBUF_RX_CKSUM_TCP_UDP_UNNECESSARY;
+		else
+			DP_STATS_INCC(pdev, err.tcp_udp_csum_err, 1,
+				      tcp_udp_csum_er);
 	} else {
-		DP_STATS_INCC(pdev, err.ip_csum_err, 1, ip_csum_err);
-		DP_STATS_INCC(pdev, err.tcp_udp_csum_err, 1, tcp_udp_csum_er);
+		cksum.l4_result = QDF_NBUF_RX_CKSUM_NONE;
 	}
+
+	qdf_nbuf_set_rx_cksum(nbuf, &cksum);
 }
 
 #endif /* QCA_HOST_MODE_WIFI_DISABLED */
diff --git a/dp/wifi3.0/dp_stats.c b/dp/wifi3.0/dp_stats.c
index b53ee37..ad4b9d2 100644
--- a/dp/wifi3.0/dp_stats.c
+++ b/dp/wifi3.0/dp_stats.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -3800,7 +3800,7 @@
 
 	uint8_t i;
 	uint16_t index = 0;
-	char rxdma_err_cnt[DP_MAX_STRING_LEN];
+	char rxdma_err_cnt[DP_MAX_STRING_LEN] = {'\0'};
 	uint32_t tag_len = (HTT_STATS_TLV_LENGTH_GET(*tag_buf) >> 2);
 
 	tag_len = qdf_min(tag_len, (uint32_t)HTT_RX_RXDMA_MAX_ERR_CODE);
@@ -3831,7 +3831,7 @@
 
 	uint8_t i;
 	uint16_t index = 0;
-	char reo_err_cnt[DP_MAX_STRING_LEN];
+	char reo_err_cnt[DP_MAX_STRING_LEN] = {'\0'};
 	uint32_t tag_len = (HTT_STATS_TLV_LENGTH_GET(*tag_buf) >> 2);
 
 	tag_len = qdf_min(tag_len, (uint32_t)HTT_RX_REO_MAX_ERR_CODE);
@@ -4948,7 +4948,7 @@
 {
 	struct wlan_cfg_dp_soc_ctxt *soc_cfg_ctx;
 	uint8_t index = 0, i = 0;
-	char ring_mask[DP_MAX_INT_CONTEXTS_STRING_LENGTH];
+	char ring_mask[DP_MAX_INT_CONTEXTS_STRING_LENGTH] = {'\0'};
 	int num_of_int_contexts;
 
 	if (!soc) {
diff --git a/dp/wifi3.0/dp_types.h b/dp/wifi3.0/dp_types.h
index 34b72a1..598bce1 100644
--- a/dp/wifi3.0/dp_types.h
+++ b/dp/wifi3.0/dp_types.h
@@ -3592,6 +3592,7 @@
 	/* flow index invalid from RX HW TLV */
 	uint32_t invalid_flow_index;
 	uint32_t reo_mismatch;
+	uint32_t incorrect_rdi;
 };
 
 enum fisa_aggr_ret {
diff --git a/hif/src/ce/ce_main.c b/hif/src/ce/ce_main.c
index 55a9640..f09b2a9 100644
--- a/hif/src/ce/ce_main.c
+++ b/hif/src/ce/ce_main.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1957,23 +1957,28 @@
  */
 #if defined(CONFIG_SLUB_DEBUG_ON)
 #define CE_DESC_HISTORY_BUFF_CNT  CE_COUNT_MAX
-#define IS_CE_DEBUG_ONLY_FOR_CE2_CE3  FALSE
+#define IS_CE_DEBUG_ONLY_FOR_CRIT_CE  0
 #else
-#define CE_DESC_HISTORY_BUFF_CNT  2
-#define IS_CE_DEBUG_ONLY_FOR_CE2_CE3  TRUE
+/* CE2, CE3, CE7 */
+#define CE_DESC_HISTORY_BUFF_CNT  3
+#define IS_CE_DEBUG_ONLY_FOR_CRIT_CE (BIT(2) | BIT(3) | BIT(7))
 #endif
 struct hif_ce_desc_event
 	hif_ce_desc_history_buff[CE_DESC_HISTORY_BUFF_CNT][HIF_CE_HISTORY_MAX];
 
 static struct hif_ce_desc_event *
-	hif_ce_debug_history_buf_get(unsigned int ce_id)
+	hif_ce_debug_history_buf_get(struct hif_softc *scn, unsigned int ce_id)
 {
-	hif_debug("get ce debug buffer ce_id %u, only_ce2/ce3=%d",
-		  ce_id, IS_CE_DEBUG_ONLY_FOR_CE2_CE3);
-	if (IS_CE_DEBUG_ONLY_FOR_CE2_CE3 &&
-	    (ce_id == CE_ID_2 || ce_id == CE_ID_3)) {
-		hif_ce_desc_history[ce_id] =
-			hif_ce_desc_history_buff[ce_id - CE_ID_2];
+	struct ce_desc_hist *ce_hist = &scn->hif_ce_desc_hist;
+
+	hif_debug("get ce debug buffer ce_id %u, only_ce2/ce3=%d, idx=%u",
+		  ce_id, IS_CE_DEBUG_ONLY_FOR_CRIT_CE,
+		  ce_hist->ce_id_hist_map[ce_id]);
+	if (IS_CE_DEBUG_ONLY_FOR_CRIT_CE &&
+	    (ce_id == CE_ID_2 || ce_id == CE_ID_3 || ce_id == CE_ID_7)) {
+		uint8_t idx = ce_hist->ce_id_hist_map[ce_id];
+
+		hif_ce_desc_history[ce_id] = hif_ce_desc_history_buff[idx];
 	} else {
 		hif_ce_desc_history[ce_id] =
 			hif_ce_desc_history_buff[ce_id];
@@ -1997,15 +2002,16 @@
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 
 	/* For perf build, return directly for non ce2/ce3 */
-	if (IS_CE_DEBUG_ONLY_FOR_CE2_CE3 &&
+	if (IS_CE_DEBUG_ONLY_FOR_CRIT_CE &&
 	    ce_id != CE_ID_2 &&
-	    ce_id != CE_ID_3) {
+	    ce_id != CE_ID_3 &&
+	    ce_id != CE_ID_7) {
 		ce_hist->enable[ce_id] = false;
 		ce_hist->data_enable[ce_id] = false;
 		return QDF_STATUS_SUCCESS;
 	}
 
-	ce_hist->hist_ev[ce_id] = hif_ce_debug_history_buf_get(ce_id);
+	ce_hist->hist_ev[ce_id] = hif_ce_debug_history_buf_get(scn, ce_id);
 	ce_hist->enable[ce_id] = true;
 
 	if (src_nentries) {
@@ -4271,6 +4277,25 @@
 	return rv;
 }
 
+#if defined(HIF_CONFIG_SLUB_DEBUG_ON) || defined(HIF_CE_DEBUG_DATA_BUF)
+static inline void hif_gen_ce_id_history_idx_mapping(struct hif_softc *scn)
+{
+	struct ce_desc_hist *ce_hist = &scn->hif_ce_desc_hist;
+	uint8_t ce_id, hist_idx = 0;
+
+	for (ce_id = 0; ce_id < scn->ce_count; ce_id++) {
+		if (IS_CE_DEBUG_ONLY_FOR_CRIT_CE & (1 << ce_id))
+			ce_hist->ce_id_hist_map[ce_id] = hist_idx++;
+		else
+			ce_hist->ce_id_hist_map[ce_id] = -1;
+	}
+}
+#else
+static inline void hif_gen_ce_id_history_idx_mapping(struct hif_softc *scn)
+{
+}
+#endif
+
 /**
  * hif_config_ce() - configure copy engines
  * @scn: hif context
@@ -4310,6 +4335,7 @@
 	 * index. Disable data storing
 	 */
 	reset_ce_debug_history(scn);
+	hif_gen_ce_id_history_idx_mapping(scn);
 
 	for (pipe_num = 0; pipe_num < scn->ce_count; pipe_num++) {
 		struct CE_attr *attr;
diff --git a/hif/src/hif_exec.c b/hif/src/hif_exec.c
index c5765fd..c003f06 100644
--- a/hif/src/hif_exec.c
+++ b/hif/src/hif_exec.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021, 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -625,6 +625,7 @@
 	int actual_dones;
 	int shift = hif_ext_group->scale_bin_shift;
 	int cpu = smp_processor_id();
+	bool force_complete = false;
 
 	hif_record_event(hif_ext_group->hif, hif_ext_group->grp_id,
 			 0, 0, 0, HIF_EVENT_BH_SCHED);
@@ -642,7 +643,13 @@
 
 	actual_dones = work_done;
 
-	if (hif_is_force_napi_complete_required(hif_ext_group) ||
+	if (hif_is_force_napi_complete_required(hif_ext_group)) {
+		force_complete = true;
+		if (work_done >= normalized_budget)
+			work_done = normalized_budget - 1;
+	}
+
+	if (qdf_unlikely(force_complete) ||
 	    (!hif_ext_group->force_break && work_done < normalized_budget)) {
 		hif_record_event(hif_ext_group->hif, hif_ext_group->grp_id,
 				 0, 0, 0, HIF_EVENT_BH_COMPLETE);
diff --git a/hif/src/hif_hw_version.h b/hif/src/hif_hw_version.h
index 3bcb2ac..0bdcafc 100644
--- a/hif/src/hif_hw_version.h
+++ b/hif/src/hif_hw_version.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2018, 2020-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -43,7 +43,6 @@
 #define KIWI_V2                         0x40170200
 #define QCA6490_v2_1                    0x400c1211
 #define QCA6490_v2                      0x400c0200
-#define WCN3990_v2_2                    0x400f0000
 #define WCN6750_V1                      0x40140110
 #define WCN3990_TALOS                   0x40670000
 #define WCN3990_MOOREA                  0x40090000
diff --git a/hif/src/hif_main.c b/hif/src/hif_main.c
index dc031d3..e7a05fb 100644
--- a/hif/src/hif_main.c
+++ b/hif/src/hif_main.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2015-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -386,11 +386,6 @@
 		.name = "QCA6490",
 	},
 	{
-		.id = WCN3990_v2_2,
-		.subid = 0,
-		.name = "WCN3990_v2_2",
-	},
-	{
 		.id = WCN3990_TALOS,
 		.subid = 0,
 		.name = "WCN3990",
diff --git a/hif/src/hif_main.h b/hif/src/hif_main.h
index b9519d1..8f74549 100644
--- a/hif/src/hif_main.h
+++ b/hif/src/hif_main.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -200,6 +200,7 @@
 
 struct ce_desc_hist {
 	qdf_atomic_t history_index[CE_COUNT_MAX];
+	uint8_t ce_id_hist_map[CE_COUNT_MAX];
 	bool enable[CE_COUNT_MAX];
 	bool data_enable[CE_COUNT_MAX];
 	qdf_mutex_t ce_dbg_datamem_lock[CE_COUNT_MAX];
diff --git a/init_deinit/dispatcher/src/dispatcher_init_deinit.c b/init_deinit/dispatcher/src/dispatcher_init_deinit.c
index 33d3894..faa0be3 100644
--- a/init_deinit/dispatcher/src/dispatcher_init_deinit.c
+++ b/init_deinit/dispatcher/src/dispatcher_init_deinit.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -85,6 +85,10 @@
 
 #include <wlan_twt_api.h>
 
+#ifdef WLAN_FEATURE_COAP
+#include <wlan_coap_main.h>
+#endif
+
 /**
  * DOC: This file provides various init/deinit trigger point for new
  * components.
@@ -983,6 +987,48 @@
 }
 #endif
 
+#ifdef WLAN_FEATURE_COAP
+static QDF_STATUS dispatcher_coap_init(void)
+{
+	return wlan_coap_init();
+}
+
+static QDF_STATUS dispatcher_coap_deinit(void)
+{
+	return wlan_coap_deinit();
+}
+
+static QDF_STATUS coap_psoc_enable(struct wlan_objmgr_psoc *psoc)
+{
+	return wlan_coap_enable(psoc);
+}
+
+static QDF_STATUS coap_psoc_disable(struct wlan_objmgr_psoc *psoc)
+{
+	return wlan_coap_disable(psoc);
+}
+#else
+static QDF_STATUS dispatcher_coap_init(void)
+{
+	return QDF_STATUS_SUCCESS;
+}
+
+static QDF_STATUS dispatcher_coap_deinit(void)
+{
+	return QDF_STATUS_SUCCESS;
+}
+
+static QDF_STATUS coap_psoc_enable(struct wlan_objmgr_psoc *psoc)
+{
+	return QDF_STATUS_SUCCESS;
+}
+
+static QDF_STATUS coap_psoc_disable(struct wlan_objmgr_psoc *psoc)
+{
+	return QDF_STATUS_SUCCESS;
+}
+#endif
+
 QDF_STATUS dispatcher_init(void)
 {
 	if (QDF_STATUS_SUCCESS != wlan_objmgr_global_obj_init())
@@ -1066,6 +1112,9 @@
 	if (QDF_STATUS_SUCCESS != dispatcher_twt_init())
 		goto twt_init_fail;
 
+	if (QDF_STATUS_SUCCESS != dispatcher_coap_init())
+		goto coap_init_fail;
+
 	/*
 	 * scheduler INIT has to be the last as each component's
 	 * initialization has to happen first and then at the end
@@ -1077,6 +1126,8 @@
 	return QDF_STATUS_SUCCESS;
 
 scheduler_init_fail:
+	dispatcher_coap_deinit();
+coap_init_fail:
 	dispatcher_twt_deinit();
 twt_init_fail:
 	wlan_gpio_deinit();
@@ -1142,6 +1193,8 @@
 
 	QDF_BUG(QDF_STATUS_SUCCESS == scheduler_deinit());
 
+	QDF_BUG(QDF_STATUS_SUCCESS == dispatcher_coap_deinit());
+
 	QDF_BUG(QDF_STATUS_SUCCESS == dispatcher_twt_deinit());
 
 	QDF_BUG(QDF_STATUS_SUCCESS == wlan_gpio_deinit());
@@ -1370,8 +1423,13 @@
 	if (QDF_STATUS_SUCCESS != dispatcher_twt_psoc_enable(psoc))
 		goto twt_psoc_enable_fail;
 
+	if (QDF_STATUS_SUCCESS != coap_psoc_enable(psoc))
+		goto coap_psoc_enable_fail;
+
 	return QDF_STATUS_SUCCESS;
 
+coap_psoc_enable_fail:
+	dispatcher_twt_psoc_disable(psoc);
 twt_psoc_enable_fail:
 	mlo_mgr_psoc_disable(psoc);
 mlo_mgr_psoc_enable_fail:
@@ -1411,6 +1469,8 @@
 {
 	QDF_STATUS status;
 
+	QDF_BUG(QDF_STATUS_SUCCESS == coap_psoc_disable(psoc));
+
 	QDF_BUG(QDF_STATUS_SUCCESS == dispatcher_twt_psoc_disable(psoc));
 
 	QDF_BUG(QDF_STATUS_SUCCESS == mlo_mgr_psoc_disable(psoc));
diff --git a/os_if/linux/mlme/inc/osif_cm_req.h b/os_if/linux/mlme/inc/osif_cm_req.h
index 000a6cf..f181273 100644
--- a/os_if/linux/mlme/inc/osif_cm_req.h
+++ b/os_if/linux/mlme/inc/osif_cm_req.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2015,2020-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -30,6 +30,12 @@
 #include <net/cfg80211.h>
 #include "wlan_objmgr_vdev_obj.h"
 
+#define FEATURE_DRIVER_DISCONNECT_REASON				\
+	[QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON_INDEX] = {	\
+	.vendor_id = QCA_NL80211_VENDOR_ID,				\
+	.subcmd = QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON,	\
+},
+
 /**
  * struct osif_connect_params - extra connect params
  * @scan_ie: default scan ie to be used in connect scan and unicast probe req
diff --git a/os_if/linux/mlme/inc/osif_cm_util.h b/os_if/linux/mlme/inc/osif_cm_util.h
index e60bec3..e555952 100644
--- a/os_if/linux/mlme/inc/osif_cm_util.h
+++ b/os_if/linux/mlme/inc/osif_cm_util.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012-2015, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -27,6 +28,9 @@
 #include <qca_vendor.h>
 #include "wlan_cm_ucfg_api.h"
 #include "wlan_cm_public_struct.h"
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+#include "wlan_cm_roam_public_struct.h"
+#endif
 #ifdef CONN_MGR_ADV_FEATURE
 #include <cdp_txrx_mob_def.h>
 #endif
@@ -234,26 +238,36 @@
  * osif_cm_unlink_bss() - function to unlink bss from kernel and scan database
  * on connect timeouts reasons
  * @vdev: vdev pointer
- * @osif_priv: Pointer to vdev osif priv
  * @bssid: bssid to flush
- * @ssid: optional ssid to flush
- * @ssid_len: optional ssid length
  *
  * This function flush the bss from scan db of kernel and driver matching the
- * bssid. ssid is optional to pass to match the bss.
+ * bssid.
  *
  * Return: void
  */
 void osif_cm_unlink_bss(struct wlan_objmgr_vdev *vdev,
-			struct vdev_osif_priv *osif_priv,
-			struct qdf_mac_addr *bssid,
-			uint8_t *ssid, uint8_t ssid_len);
+			struct qdf_mac_addr *bssid);
 #else
 static inline
 void osif_cm_unlink_bss(struct wlan_objmgr_vdev *vdev,
-			struct vdev_osif_priv *osif_priv,
-			struct qdf_mac_addr *bssid,
-			uint8_t *ssid, uint8_t ssid_len) {}
+			struct qdf_mac_addr *bssid) {}
+#endif
+
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+/**
+ * typedef osif_cm_roam_rt_stats_cb: Callback to send roam
+ * stats event
+ * @roam_stats: roam_stats_event pointer
+ * @idx: TLV idx for roam stats event
+ *
+ * This callback sends roam_stats_event to userspace
+ *
+ * Context: Any context.
+ * Return: void
+ */
+typedef void
+	(*osif_cm_roam_rt_stats_cb)(struct roam_stats_event *roam_stats,
+				    uint8_t idx);
 #endif
 
 #ifdef WLAN_FEATURE_PREAUTH_ENABLE
@@ -302,6 +316,7 @@
  * actions on napi serialization
  * @save_gtk_cb : callback to legacy module to save gtk
  * @set_hlp_data_cb: callback to legacy module to save hlp data
+ * @roam_rt_stats_event_cb: callback to send roam stats to userspace
  * @ft_preauth_complete_cb: callback to legacy module to send fast
  * transition event
  * @cckm_preauth_complete_cb: callback to legacy module to send cckm
@@ -318,6 +333,9 @@
 #ifdef WLAN_FEATURE_FILS_SK
 	osif_cm_set_hlp_data_cb set_hlp_data_cb;
 #endif
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+	osif_cm_roam_rt_stats_cb roam_rt_stats_event_cb;
+#endif
 #ifdef WLAN_FEATURE_PREAUTH_ENABLE
 	osif_cm_ft_preauth_complete_cb ft_preauth_complete_cb;
 #ifdef FEATURE_WLAN_ESE
diff --git a/os_if/linux/mlme/src/osif_cm_connect_rsp.c b/os_if/linux/mlme/src/osif_cm_connect_rsp.c
index 7a04c82..574a1fc 100644
--- a/os_if/linux/mlme/src/osif_cm_connect_rsp.c
+++ b/os_if/linux/mlme/src/osif_cm_connect_rsp.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2015, 2020-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -838,16 +838,13 @@
 	return false;
 }
 static inline void osif_check_and_unlink_bss(struct wlan_objmgr_vdev *vdev,
-					     struct vdev_osif_priv *osif_priv,
 					     struct wlan_cm_connect_resp *rsp)
 {
 	if (osif_cm_is_unlink_bss_required(rsp))
-		osif_cm_unlink_bss(vdev, osif_priv, &rsp->bssid, rsp->ssid.ssid,
-				   rsp->ssid.length);
+		osif_cm_unlink_bss(vdev, &rsp->bssid);
 }
 #else
 static inline void osif_check_and_unlink_bss(struct wlan_objmgr_vdev *vdev,
-					     struct vdev_osif_priv *osif_priv,
 					     struct wlan_cm_connect_resp *rsp)
 {}
 #endif
@@ -866,7 +863,7 @@
 		       rsp->connect_status ? "FAILURE" : "SUCCESS", rsp->cm_id,
 		       rsp->reason, rsp->status_code, rsp->is_reassoc);
 
-	osif_check_and_unlink_bss(vdev, osif_priv, rsp);
+	osif_check_and_unlink_bss(vdev, rsp);
 
 	status = osif_validate_connect_and_reset_src_id(osif_priv, rsp);
 	if (QDF_IS_STATUS_ERROR(status)) {
@@ -902,7 +899,7 @@
 	 * connection on other links.
 	 */
 	if (!wlan_vdev_mlme_is_mlo_vdev(vdev))
-		osif_check_and_unlink_bss(vdev, osif_priv, rsp);
+		osif_check_and_unlink_bss(vdev, rsp);
 
 	return QDF_STATUS_SUCCESS;
 }
diff --git a/os_if/linux/mlme/src/osif_cm_disconnect_rsp.c b/os_if/linux/mlme/src/osif_cm_disconnect_rsp.c
index 6999dbc..65022d3 100644
--- a/os_if/linux/mlme/src/osif_cm_disconnect_rsp.c
+++ b/os_if/linux/mlme/src/osif_cm_disconnect_rsp.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012-2015, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -28,6 +29,10 @@
 #include "osif_cm_util.h"
 #include "wlan_mlo_mgr_sta.h"
 
+#define DRIVER_DISCONNECT_REASON \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_DRIVER_DISCONNECT_REASON
+#define DRIVER_DISCONNECT_REASON_INDEX \
+	QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON_INDEX
 /**
  * osif_validate_disconnect_and_reset_src_id() - Validate disconnection
  * and resets source and id
@@ -188,6 +193,46 @@
 }
 #endif
 
+#ifdef CONN_MGR_ADV_FEATURE
+/**
+ * osif_cm_indicate_qca_reason: Send driver disconnect reason to user space
+ * @osif_priv: osif_priv pointer
+ * @qca_reason: qca disconnect reason codes
+ *
+ * Return: void
+ */
+static void
+osif_cm_indicate_qca_reason(struct vdev_osif_priv *osif_priv,
+			    enum qca_disconnect_reason_codes qca_reason)
+{
+	struct sk_buff *vendor_event;
+
+	vendor_event = wlan_cfg80211_vendor_event_alloc(
+					osif_priv->wdev->wiphy, osif_priv->wdev,
+					NLMSG_HDRLEN + sizeof(qca_reason) +
+					NLMSG_HDRLEN,
+					DRIVER_DISCONNECT_REASON_INDEX,
+					GFP_KERNEL);
+	if (!vendor_event) {
+		osif_err("cfg80211_vendor_event_alloc failed");
+		return;
+	}
+	if (nla_put_u32(vendor_event, DRIVER_DISCONNECT_REASON, qca_reason)) {
+		osif_err("DISCONNECT_REASON put fail");
+		kfree_skb(vendor_event);
+		return;
+	}
+
+	wlan_cfg80211_vendor_event(vendor_event, GFP_KERNEL);
+}
+#else
+static inline void
+osif_cm_indicate_qca_reason(struct vdev_osif_priv *osif_priv,
+			    enum qca_disconnect_reason_codes qca_reason)
+{
+}
+#endif
+
 QDF_STATUS osif_disconnect_handler(struct wlan_objmgr_vdev *vdev,
 				   struct wlan_cm_discon_rsp *rsp)
 {
@@ -218,8 +263,7 @@
 	/* Unlink bss if disconnect is from peer or south bound */
 	if (rsp->req.req.source == CM_PEER_DISCONNECT ||
 	    rsp->req.req.source == CM_SB_DISCONNECT)
-		osif_cm_unlink_bss(vdev, osif_priv, &rsp->req.req.bssid,
-				   NULL, 0);
+		osif_cm_unlink_bss(vdev, &rsp->req.req.bssid);
 
 	status = osif_validate_disconnect_and_reset_src_id(osif_priv, rsp);
 	if (QDF_IS_STATUS_ERROR(status)) {
@@ -227,6 +271,9 @@
 		return status;
 	}
 
+	/* Send driver disconnect Reason */
+	osif_cm_indicate_qca_reason(osif_priv, qca_reason);
+
 	osif_cm_disconnect_comp_ind(vdev, rsp, OSIF_PRE_USERSPACE_UPDATE);
 	osif_cm_indicate_disconnect(vdev, osif_priv->wdev->netdev,
 				    ieee80211_reason,
diff --git a/os_if/linux/mlme/src/osif_cm_util.c b/os_if/linux/mlme/src/osif_cm_util.c
index 45dd404..f1e31ed 100644
--- a/os_if/linux/mlme/src/osif_cm_util.c
+++ b/os_if/linux/mlme/src/osif_cm_util.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012-2015, 2020-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -258,19 +259,10 @@
 
 #ifdef CONN_MGR_ADV_FEATURE
 void osif_cm_unlink_bss(struct wlan_objmgr_vdev *vdev,
-			struct vdev_osif_priv *osif_priv,
-			struct qdf_mac_addr *bssid,
-			uint8_t *ssid, uint8_t ssid_len)
+			struct qdf_mac_addr *bssid)
 {
-	struct wiphy *wiphy = osif_priv->wdev->wiphy;
 	struct scan_filter *filter;
-	QDF_STATUS status;
 
-	status = __wlan_cfg80211_unlink_bss_list(wiphy, wlan_vdev_get_pdev(vdev),
-					bssid->bytes, ssid_len ? ssid : NULL,
-					ssid_len);
-	if (QDF_IS_STATUS_ERROR(status))
-		return;
 	filter = qdf_mem_malloc(sizeof(*filter));
 	if (!filter)
 		return;
@@ -399,6 +391,26 @@
 {
 	return osif_cm_napi_serialize(false);
 }
+
+/**
+ * osif_cm_roam_rt_stats_evt_cb() - Roam stats callback
+ * @roam_stats: roam_stats_event pointer
+ * @idx: TLV idx for roam_stats_event
+ *
+ * This callback indicates os_if that roam stats event is received
+ * so that os_if can send the event
+ *
+ * Return: void
+ */
+
+static void
+osif_cm_roam_rt_stats_evt_cb(struct roam_stats_event *roam_stats,
+			     uint8_t idx)
+{
+	if (osif_cm_legacy_ops &&
+	    osif_cm_legacy_ops->roam_rt_stats_event_cb)
+		osif_cm_legacy_ops->roam_rt_stats_event_cb(roam_stats, idx);
+}
 #endif
 
 #ifdef WLAN_FEATURE_PREAUTH_ENABLE
@@ -472,6 +484,7 @@
 	.mlme_cm_roam_start_cb = osif_cm_roam_start_cb,
 	.mlme_cm_roam_abort_cb = osif_cm_roam_abort_cb,
 	.mlme_cm_roam_cmpl_cb = osif_cm_roam_cmpl_cb,
+	.mlme_cm_roam_rt_stats_cb = osif_cm_roam_rt_stats_evt_cb,
 #endif
 #ifdef WLAN_FEATURE_PREAUTH_ENABLE
 	.mlme_cm_ft_preauth_cmpl_cb = osif_cm_ft_preauth_cmpl_cb,
diff --git a/os_if/linux/qca_vendor.h b/os_if/linux/qca_vendor.h
index 5489041..8cd4032 100644
--- a/os_if/linux/qca_vendor.h
+++ b/os_if/linux/qca_vendor.h
@@ -551,6 +551,15 @@
  *     an array of the vendor attributes defined in
  *     enum QCA_WLAN_VENDOR_ATTR_RATEMASK_PARAMS.
  *
+ * @QCA_NL80211_VENDOR_SUBCMD_COAP_OFFLOAD: This vendor subcommand is used to
+ *	enable/disable offload processing in firmware during system/runtime
+ *	suspend for CoAP messages (see RFC7252: The Constrained Application
+ *	Protocol) and fetch information of the CoAP messages cached during
+ *	offload processing.
+ *
+ *	The attributes used with this command are defined in
+ *	enum qca_wlan_vendor_attr_coap_offload.
+ *
  * @QCA_NL80211_VENDOR_SUBCMD_GET_SAR_CAPABILITY: Fetch SAR capabilities
  *	supported by the WLAN firmware.
  *
@@ -796,6 +805,9 @@
 	QCA_NL80211_VENDOR_SUBCMD_SET_MONITOR_MODE = 202,
 	QCA_NL80211_VENDOR_SUBCMD_ROAM_EVENTS = 203,
 	QCA_NL80211_VENDOR_SUBCMD_RATEMASK_CONFIG = 204,
+	/* 205..216 - reserved for QCA */
+	QCA_NL80211_VENDOR_SUBCMD_COAP_OFFLOAD = 217,
+	/* 218 - reserved for QCA */
 	QCA_NL80211_VENDOR_SUBCMD_GET_SAR_CAPABILITY = 219,
 };
 
@@ -13003,4 +13015,401 @@
 	QCA_WLAN_VENDOR_ATTR_SAR_CAPABILITY_MAX =
 	QCA_WLAN_VENDOR_ATTR_SAR_CAPABILITY_AFTER_LAST - 1,
 };
+
+/**
+ * enum qca_wlan_vendor_attr_coap_offload_filter - Attributes used
+ * inside %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_FILTER
+ * nested attribute. The packets that match a filter will be replied with
+ * attributes configured in %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV4:
+ * u32 attribute. Destination IPv4 address in network byte order, the
+ * IPv4 packets with different address will be filtered out.
+ * This attribute is optional.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV4_IS_BC:
+ * Flag attribute. If it's present, indicates that
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV4 is a broadcast
+ * address; while if not, indicates that the address is a unicast/multicast
+ * address.
+ * This attribute is optional.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV6:
+ * NLA_BINARY attribute, length is 16 bytes.
+ * Destination IPv6 address in network byte order, the IPv6 packets
+ * with different destination address will be filtered out.
+ * This attribute is optional.
+ *
+ * At least one of %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV4 and
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV6 must be configured.
+ * Packets on both IPv4 and IPv6 will be processed if both are configured.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_PORT:
+ * u16 attribute. Destination UDP port, the packets with different destination
+ * UDP port will be filtered out.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_MATCH_OFFSET:
+ * u32 attribute. Represents the offset (in UDP payload) of the data
+ * to be matched.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_MATCH_DATA:
+ * NLA_BINARY attribute, the maximum allowed size is 16 bytes.
+ * Binary data that is compared bit-by-bit against the data (specified
+ * by %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_MATCH_OFFSET) in UDP
+ * payload, the packets don't match will be filtered out.
+ * This attribute is mandatory.
+ */
+enum qca_wlan_vendor_attr_coap_offload_filter {
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV4 = 1,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV4_IS_BC = 2,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_IPV6 = 3,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_DEST_PORT = 4,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_MATCH_OFFSET = 5,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_MATCH_DATA = 6,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_MAX =
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_FILTER_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_coap_offload_reply - Attributes used
+ * inside %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY nested attribute.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_SRC_IPV4:
+ * u32 attribute. Source address (in network byte order) for replying
+ * the matching broadcast/multicast IPv4 packets.
+ * This attribute is optional.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_SRC_IPV6:
+ * NLA_BINARY attribute, length is 16 bytes.
+ * Source address (in network byte order) for replying the matching
+ * multicast IPv6 packets.
+ * This attribute is optional.
+ *
+ * For broadcast/multicast offload reply, one of
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_SRC_IPV4 and
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_SRC_IPV6 or both must be
+ * configured according to version of the IP address(es) configured in
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_FILTER;
+ * while for unicast case, firmware will take the destination IP address
+ * in the received matching packet as the source address for replying.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_FILTER:
+ * Nested attribute. Filter for the received UDP packets, only the matching
+ * packets will be replied and cached.
+ * See enum qca_wlan_vendor_attr_coap_offload_filter for list of supported
+ * attributes.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_MSG:
+ * NLA_BINARY attribute, the maximum allowed size is 1152 bytes.
+ * CoAP message (UDP payload) to be sent upon receiving matching packets.
+ * Firmware is responsible for adding any necessary protocol headers.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_CACHE_EXPTIME:
+ * u32 attribute. Expiration time in milliseconds of the cached CoAP messages.
+ * A cached message will be dropped by firmware if it's expired.
+ * This attribute is optional. A default value of 40000 will be used in the
+ * absence of it.
+ */
+enum qca_wlan_vendor_attr_coap_offload_reply {
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_SRC_IPV4 = 1,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_SRC_IPV6 = 2,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_FILTER = 3,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_MSG = 4,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_CACHE_EXPTIME = 5,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_MAX =
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_coap_offload_tx_ipv4 - Represents parameters for
+ * CoAP message (UDP) transmitting on IPv4.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_SRC_ADDR:
+ * u32 attribute. Source address (in network byte order) for transmitting
+ * packets on IPv4.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_SRC_PORT:
+ * u16 attribute. Source UDP port.
+ * This attribute is optional, a random port is taken if it's not present.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_DEST_ADDR:
+ * u32 attribute. Destination IPv4 address (in network byte order).
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_DEST_IS_BC:
+ * Flag attribute. If it's present, indicates that
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_DEST_ADDR is a broadcast
+ * address; while if not, indicates that the address is unicast/multicast
+ * address.
+ * This attribute is optional.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_DEST_PORT:
+ * u16 attribute. Destination UDP port.
+ * This attribute is mandatory.
+ */
+enum qca_wlan_vendor_attr_coap_offload_tx_ipv4 {
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_SRC_ADDR = 1,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_SRC_PORT = 2,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_DEST_ADDR = 3,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_DEST_IS_BC = 4,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_DEST_PORT = 5,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_MAX =
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV4_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_coap_offload_tx_ipv6 - Represents parameters for
+ * CoAP message (UDP) transmitting on IPv6.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_SRC_ADDR:
+ * NLA_BINARY attribute, length is 16 bytes.
+ * Source address (in network byte order) for transmitting packets on IPv6.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_SRC_PORT:
+ * u16 attribute. Source UDP port.
+ * This attribute is optional, a random port is taken if it's not present.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_DEST_ADDR:
+ * NLA_BINARY attribute, length is 16 bytes.
+ * Destination IPv6 address (in network byte order).
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_DEST_PORT:
+ * u16 attribute. Destination UDP port.
+ * This attribute is mandatory.
+ */
+enum qca_wlan_vendor_attr_coap_offload_tx_ipv6 {
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_SRC_ADDR = 1,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_SRC_PORT = 2,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_DEST_ADDR = 3,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_DEST_PORT = 4,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_MAX =
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_TX_IPV6_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_coap_offload_periodic_tx - Attributes used
+ * inside %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX nested attribute.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_IPV4:
+ * Nested attribute. The IPv4 source/destination address/port for offload
+ * transmitting. See enum qca_wlan_vendor_attr_coap_offload_tx_ipv4 for the list
+ * of supported attributes.
+ * This attribute is optional.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_IPV6:
+ * Nested attribute. The IPv6 source/destination address/port for offload
+ * transmitting. See enum qca_wlan_vendor_attr_coap_offload_tx_ipv6 for the list
+ * of supported attributes.
+ * This attribute is optional.
+ *
+ * At least one of %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_IPV4 and
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_IPV6 must be configured.
+ * Firmware will transmit the packets on both IPv4 and IPv6 if both are
+ * configured.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_PERIOD:
+ * u32 attribute. Period in milliseconds for the periodic transmitting.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_MSG:
+ * NLA_BINARY attribute, the maximum allowed size is 1152 bytes.
+ * CoAP message (UDP payload) to be periodically transmitted. Firmware
+ * is responsible for adding any necessary protocol headers.
+ * This attribute is mandatory.
+ */
+enum qca_wlan_vendor_attr_coap_offload_periodic_tx {
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_IPV4 = 1,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_IPV6 = 2,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_PERIOD = 3,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_MSG = 4,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_MAX =
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_coap_offload_cache_info - Attributes used
+ * inside %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHES nested attribute.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_TS:
+ * u64 attribute. Received time (since system booted in microseconds) of
+ * the cached CoAP message.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_SRC_IPV4:
+ * u32 attribute. Source IPv4 address (in network byte order) of the cached
+ * CoAP message.
+ * This attribute is optional.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_SRC_IPV6:
+ * NLA_BINARY attribute, length is 16 bytes.
+ * Source IPv6 address (in network byte order) of the cached CoAP message.
+ * This attribute is optional.
+ *
+ * At most and at least one of
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_SRC_IPV4 and
+ * %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_SRC_IPV6 is given for
+ * an entry.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_MSG:
+ * NLA_BINARY attribute, the maximum allowed size is 1152 bytes.
+ * The cached CoAP message (UDP payload). If the actual message size is
+ * greater than the maximum size, it will be truncated and leaving only
+ * the first 1152 bytes.
+ * This attribute is mandatory.
+ */
+enum qca_wlan_vendor_attr_coap_offload_cache_info {
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_TS = 1,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_SRC_IPV4 = 2,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_SRC_IPV6 = 3,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_MSG = 4,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_MAX =
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHE_INFO_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_coap_offload_action - Actions for
+ * vendor command QCA_NL80211_VENDOR_SUBCMD_COAP_OFFLOAD.
+ *
+ * @QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_REPLY_ENABLE:
+ * Enable CoAP offload reply.
+ * If it's enabled, firmware will start offload processing on each suspend
+ * and stop on each resume.
+ *
+ * Offload reply on match works as follows:
+ * Reply the packets that match the filter with the given CoAP
+ * message (with necessary protocol headers), increase the CoAP message
+ * ID in the given CoAP message by one for the next use after each successful
+ * transmission, and try to store the information of the received packet,
+ * including the received time, source IP address, and CoAP message (UDP
+ * payload).
+ *
+ * Firmware has a limit to the maximum stored entries, it takes the source IP
+ * address as the key of an entry, and keeps at most one entry for each key.
+ * A packet won't be stored if no entry for the same key is present and the
+ * total number of the existing unexpired entries reaches the maximum value.
+ *
+ * If any configured item is changed, user space should disable offload reply
+ * first and then issue a new enable request.
+ *
+ * @QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_REPLY_DISABLE:
+ * Disable CoAP offload reply and return information of any cached CoAP
+ * messages.
+ *
+ * @QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_PERIODIC_TX_ENABLE:
+ * Enable CoAP offload periodic transmitting.
+ * If it's enabled, firmware will start offload periodic transmitting on
+ * each suspend and stop on each resume.
+ *
+ * Offload periodic transmitting works as follows:
+ * Send the given CoAP message (with necessary protocol headers) with the given
+ * source/destination IP address/UDP port periodically based on the given
+ * period and increase the CoAP message ID in the given CoAP message by one
+ * for the next use after each successful transmission.
+ *
+ * If any configured item is changed, user space should disable offload
+ * periodic transmitting first and then issue a new enable request.
+ *
+ * @QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_PERIODIC_TX_DISABLE:
+ * Disable CoAP offload periodic transmitting.
+ *
+ * @QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_CACHE_GET:
+ * Get information of the CoAP messages cached during offload reply
+ * processing. The cache is cleared after retrieval.
+ */
+enum qca_wlan_vendor_coap_offload_action {
+	QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_REPLY_ENABLE = 0,
+	QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_REPLY_DISABLE = 1,
+	QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_PERIODIC_TX_ENABLE = 2,
+	QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_PERIODIC_TX_DISABLE = 3,
+	QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_CACHE_GET = 4,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_coap_offload - Used by the
+ * vendor command QCA_NL80211_VENDOR_SUBCMD_COAP_OFFLOAD.
+ * This is used to set parameters for CoAP offload processing, or get
+ * cached CoAP messages from firmware.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_ACTION:
+ * u32 attribute. Action to take in this vendor command.
+ * See enum qca_wlan_vendor_coap_offload_action for supported actions.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REQ_ID:
+ * u32 attribute. Represents the Request ID for the CoAP offload
+ * configuration, which can help to identify the user entity starting
+ * the CoAP offload processing and accordingly stop the respective
+ * ones/get the cached CoAP messages with the matching ID.
+ * This attribute is mandatory.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY:
+ * Nested attribute. Parameters for offload reply.
+ * See enum qca_wlan_vendor_attr_coap_offload_reply for the list of
+ * supported attributes.
+ * This attribute is mandatory if %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_ACTION
+ * is QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_REPLY_ENABLE, and is ignored
+ * otherwise.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX:
+ * Nested attribute. Parameters for offload periodic transmitting.
+ * See enum qca_wlan_vendor_attr_coap_offload_periodic_tx for the list of
+ * supported attributes.
+ * This attribute is mandatory if %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_ACTION is
+ * QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_PERIODIC_TX_ENABLE, and is ignored
+ * otherwise.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHES:
+ * Array of nested attributes. Information of the cached CoAP messages,
+ * where each entry is taken from
+ * enum qca_wlan_vendor_attr_coap_offload_cache_info.
+ * This attribute is used for reporting the cached CoAP messages
+ * in reply for command in which %QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_ACTION
+ * is QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_CACHE_GET or
+ * QCA_WLAN_VENDOR_COAP_OFFLOAD_ACTION_REPLY_DISABLE. It means there is no
+ * cached item if this attribute is not present.
+ */
+enum qca_wlan_vendor_attr_coap_offload {
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_ACTION = 1,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REQ_ID = 2,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_REPLY = 3,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_PERIODIC_TX = 4,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_CACHES = 5,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_MAX =
+	QCA_WLAN_VENDOR_ATTR_COAP_OFFLOAD_AFTER_LAST - 1,
+};
 #endif
diff --git a/os_if/linux/wlan_cfg80211.h b/os_if/linux/wlan_cfg80211.h
index ec1960c..6c9b1de 100644
--- a/os_if/linux/wlan_cfg80211.h
+++ b/os_if/linux/wlan_cfg80211.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -145,6 +145,8 @@
  * @QCA_NL80211_VENDOR_SUBCMD_THERMAL_INDEX: Report thermal event index
  * @QCA_NL80211_VENDOR_SUBCMD_CONFIG_TWT_INDEX: TWT config index
  * @QCA_NL80211_VENDOR_SUBCMD_PEER_CFR_CAPTURE_CFG_INDEX: CFR data event index
+ * @QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON_INDEX:
+ *	Driver disconnect reason index
  */
 
 enum qca_nl80211_vendor_subcmds_index {
@@ -238,6 +240,7 @@
 	QCA_NL80211_VENDOR_SUBCMD_WIFI_FW_STATS_INDEX,
 	QCA_NL80211_VENDOR_SUBCMD_MBSSID_TX_VDEV_STATUS_INDEX,
 	QCA_NL80211_VENDOR_SUBCMD_THERMAL_INDEX,
+	QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON_INDEX,
 #ifdef WLAN_SUPPORT_TWT
 	QCA_NL80211_VENDOR_SUBCMD_CONFIG_TWT_INDEX,
 #endif
diff --git a/qdf/inc/qdf_nbuf.h b/qdf/inc/qdf_nbuf.h
index 27e6805..0bb5728 100644
--- a/qdf/inc/qdf_nbuf.h
+++ b/qdf/inc/qdf_nbuf.h
@@ -196,6 +196,8 @@
 #define MAX_CHAIN 8
 #define QDF_MON_STATUS_MPDU_FCS_BMAP_NWORDS 8
 
+#define EHT_USER_INFO_LEN 4
+
 /**
  * This is the length for radiotap, combined length
  * (Mandatory part struct ieee80211_radiotap_header + RADIOTAP_HEADER_LEN)
@@ -420,7 +422,7 @@
 	uint32_t usig_mask;
 	uint32_t eht_known;
 	uint32_t eht_data[6];
-	uint32_t eht_user_info[4];
+	uint32_t eht_user_info[EHT_USER_INFO_LEN];
 };
 
 /**
diff --git a/qdf/inc/qdf_net_types.h b/qdf/inc/qdf_net_types.h
index 7205116..372aa9a 100644
--- a/qdf/inc/qdf_net_types.h
+++ b/qdf/inc/qdf_net_types.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2014-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -274,11 +275,13 @@
  * typedef qdf_nbuf_rx_cksum_t - receive checksum type
  * @l4_type: L4 type
  * @l4_result: L4 result
+ * @csum_level: indicates number of checksum are calculated
  */
 typedef struct {
 	qdf_nbuf_l4_rx_cksum_type_t l4_type;
 	qdf_nbuf_l4_rx_cksum_result_t l4_result;
 	uint32_t val;
+	uint32_t csum_level;
 } qdf_nbuf_rx_cksum_t;
 
 #define QDF_ARP_REQ       1 /* ARP request */
diff --git a/qdf/inc/qdf_types.h b/qdf/inc/qdf_types.h
index b33e040..c3c3d90 100644
--- a/qdf/inc/qdf_types.h
+++ b/qdf/inc/qdf_types.h
@@ -422,6 +422,7 @@
  * @QDF_MODULE_ID_AFC: AFC module ID
  * @QDF_MODULE_ID_WIFI_RADAR: WIFI RADAR module ID
  * @QDF_MODULE_ID_TWT: TWT module ID
+ * @QDF_MODULE_ID_COAP: Constrained Application Protocol module ID
  * @QDF_MODULE_ID_ANY: anything
  * @QDF_MODULE_ID_MAX: Max place holder module ID
  *
@@ -580,6 +581,7 @@
 	QDF_MODULE_ID_AFC,
 	QDF_MODULE_ID_WIFI_RADAR,
 	QDF_MODULE_ID_TWT,
+	QDF_MODULE_ID_COAP,
 	QDF_MODULE_ID_ANY,
 	QDF_MODULE_ID_MAX,
 } QDF_MODULE_ID;
diff --git a/qdf/linux/src/qdf_nbuf.c b/qdf/linux/src/qdf_nbuf.c
index f9d34f6..5b4eb82 100644
--- a/qdf/linux/src/qdf_nbuf.c
+++ b/qdf/linux/src/qdf_nbuf.c
@@ -1198,6 +1198,7 @@
 		break;
 	case QDF_NBUF_RX_CKSUM_TCP_UDP_UNNECESSARY:
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
+		skb->csum_level = cksum->csum_level;
 		break;
 	case QDF_NBUF_RX_CKSUM_TCP_UDP_HW:
 		skb->ip_summed = CHECKSUM_PARTIAL;
@@ -4700,7 +4701,9 @@
 	put_unaligned_le32(rx_status->eht_data[5], &rtap_buf[rtap_len]);
 	rtap_len += 4;
 
-	for (user = 0; user < rx_status->num_eht_user_info_valid; user++) {
+	for (user = 0; user < EHT_USER_INFO_LEN &&
+	     rx_status->num_eht_user_info_valid &&
+	     user < rx_status->num_eht_user_info_valid; user++) {
 		put_unaligned_le32(rx_status->eht_user_info[user],
 				   &rtap_buf[rtap_len]);
 		rtap_len += 4;
diff --git a/qdf/linux/src/qdf_trace.c b/qdf/linux/src/qdf_trace.c
index b5ba709..f305d73 100644
--- a/qdf/linux/src/qdf_trace.c
+++ b/qdf/linux/src/qdf_trace.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -3420,6 +3420,7 @@
 	[QDF_MODULE_ID_MON] = {"MONITOR"},
 	[QDF_MODULE_ID_AFC] = {"AFC"},
 	[QDF_MODULE_ID_TWT] = {"TWT"},
+	[QDF_MODULE_ID_COAP] = {"COAP"},
 	[QDF_MODULE_ID_ANY] = {"ANY"},
 };
 qdf_export_symbol(g_qdf_category_name);
@@ -3994,6 +3995,7 @@
 		[QDF_MODULE_ID_MON] = QDF_TRACE_LEVEL_ERROR,
 		[QDF_MODULE_ID_MGMT_RX_REO] = QDF_TRACE_LEVEL_ERROR,
 		[QDF_MODULE_ID_TWT] = QDF_TRACE_LEVEL_ERROR,
+		[QDF_MODULE_ID_COAP] = QDF_TRACE_LEVEL_ERROR,
 		[QDF_MODULE_ID_ANY] = QDF_TRACE_LEVEL_INFO,
 	};
 
diff --git a/target_if/core/src/target_if_main.c b/target_if/core/src/target_if_main.c
index 35d6be0..91b4125 100644
--- a/target_if/core/src/target_if_main.c
+++ b/target_if/core/src/target_if_main.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -107,6 +107,10 @@
 #include <target_if_mlo_mgr.h>
 #endif
 
+#ifdef WLAN_FEATURE_COAP
+#include <target_if_coap.h>
+#endif
+
 static struct target_if_ctx *g_target_if_ctx;
 
 struct target_if_ctx *target_if_get_ctx()
@@ -392,6 +396,20 @@
 }
 #endif
 
+#ifdef WLAN_FEATURE_COAP
+static QDF_STATUS
+target_if_coap_tx_ops_register(struct wlan_lmac_if_tx_ops *tx_ops)
+{
+	return target_if_coap_register_tx_ops(tx_ops);
+}
+#else
+static inline QDF_STATUS
+target_if_coap_tx_ops_register(struct wlan_lmac_if_tx_ops *tx_ops)
+{
+	return QDF_STATUS_SUCCESS;
+}
+#endif
+
 static void target_if_target_tx_ops_register(
 		struct wlan_lmac_if_tx_ops *tx_ops)
 {
@@ -584,6 +602,8 @@
 
 	target_if_twt_tx_ops_register(tx_ops);
 
+	target_if_coap_tx_ops_register(tx_ops);
+
 	/* Converged UMAC components to register their TX-ops here */
 	return QDF_STATUS_SUCCESS;
 }
diff --git a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h
index b256253..cd68f22 100644
--- a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h
+++ b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h
@@ -2859,7 +2859,6 @@
 		(frm[5] == P2P_WFA_VER);
 }
 
-#define WLAN_VENDOR_SON_IE_LEN 31
 /**
  * is_qca_son_oui() - If vendor IE is QCA WHC type
  * @frm: vendor IE pointer
diff --git a/umac/cmn_services/inc/wlan_cmn.h b/umac/cmn_services/inc/wlan_cmn.h
index 86a8304..97d91ca 100644
--- a/umac/cmn_services/inc/wlan_cmn.h
+++ b/umac/cmn_services/inc/wlan_cmn.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -293,6 +293,7 @@
  * @WLAN_UMAC_COMP_MBSS:          MBSS Framework
  * @WLAN_UMAC_COMP_WIFI_RADAR:    WIFI RADAR component
  * @WLAN_UMAC_COMP_TWT:           Target Wake Time (TWT) Component
+ * @WLAN_UMAC_COMP_COAP:          Constrained Application Protocol component
  * @WLAN_UMAC_COMP_ID_MAX:        Maximum components in UMAC
  *
  * This id is static.
@@ -344,6 +345,7 @@
 	WLAN_UMAC_COMP_MBSS               = 42,
 	WLAN_UMAC_COMP_WIFI_RADAR         = 43,
 	WLAN_UMAC_COMP_TWT                = 44,
+	WLAN_UMAC_COMP_COAP               = 48,
 	WLAN_UMAC_COMP_ID_MAX,
 };
 
diff --git a/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h b/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h
index 0389cc4..7542b73 100644
--- a/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h
+++ b/umac/cmn_services/obj_mgr/inc/wlan_objmgr_cmn.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -285,6 +285,7 @@
  * @WLAN_MLO_MGR_ID:            MLO manager reference id
  * @WLAN_MGMT_RX_REO_ID:        Management rx reorder reference id
  * @WLAN_MGMT_RX_REO_SIM_ID:    Management rx reorder simulation reference id
+ * @WLAN_COAP_ID:               Constrained Application Protocol reference id
  * @WLAN_REF_ID_MAX:            Max id used to generate ref count tracking array
  */
  /* New value added to the enum must also be reflected in function
@@ -387,6 +388,7 @@
 	WLAN_MGMT_RX_REO_ID   = 92,
 	WLAN_MGMT_RX_REO_SIM_ID   = 93,
 	WLAN_TWT_ID           = 94,
+	WLAN_COAP_ID          = 99,
 	WLAN_REF_ID_MAX,
 } wlan_objmgr_ref_dbgid;
 
@@ -494,7 +496,8 @@
 					"WLAN_MBSS_ID",
 					"WLAN_MGMT_RX_REO_ID",
 					"WLAN_MGMT_RX_REO_SIM_ID",
-					"WLAN_TWT_ID"
+					"WLAN_TWT_ID",
+					"WLAN_COAP_ID"
 					};
 
 	if (id >= WLAN_REF_ID_MAX)
diff --git a/umac/global_umac_dispatcher/lmac_if/inc/wlan_lmac_if_def.h b/umac/global_umac_dispatcher/lmac_if/inc/wlan_lmac_if_def.h
index 5be9f3f..e5e6325 100644
--- a/umac/global_umac_dispatcher/lmac_if/inc/wlan_lmac_if_def.h
+++ b/umac/global_umac_dispatcher/lmac_if/inc/wlan_lmac_if_def.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  *
  * Permission to use, copy, modify, and/or distribute this software for
@@ -93,6 +93,10 @@
 #ifdef QCA_SUPPORT_CP_STATS
 #include <wlan_cp_stats_public_structs.h>
 
+#ifdef WLAN_FEATURE_COAP
+#include "wlan_coap_public_structs.h"
+#endif
+
 /**
  * typedef cp_stats_event - Definition of cp stats event
  * Define stats_event from external cp stats component to cp_stats_event
@@ -1369,6 +1373,35 @@
 };
 #endif
 
+#ifdef WLAN_FEATURE_COAP
+/**
+ * struct wlan_lmac_if_coap_tx_ops - south bound tx function pointers for CoAP
+ * @attach: function pointer to attach CoAP component
+ * @detach: function pointer to detach CoAP component
+ * @offload_reply_enable: function pointer to enable CoAP offload reply
+ * @offload_reply_disable: function pointer to disable CoAP offload reply
+ * @offload_periodic_tx_enable: function pointer to enable CoAP offload
+ * periodic transmitting
+ * @offload_periodic_tx_disable: function pointer to disable CoAP offload
+ * periodic transmitting
+ * @offload_cache_get: function pointer to get cached CoAP messages
+ */
+struct wlan_lmac_if_coap_tx_ops {
+	QDF_STATUS (*attach)(struct wlan_objmgr_psoc *psoc);
+	QDF_STATUS (*detach)(struct wlan_objmgr_psoc *psoc);
+	QDF_STATUS (*offload_reply_enable)(struct wlan_objmgr_vdev *vdev,
+			struct coap_offload_reply_param *param);
+	QDF_STATUS (*offload_reply_disable)(struct wlan_objmgr_vdev *vdev,
+					    uint32_t req_id);
+	QDF_STATUS (*offload_periodic_tx_enable)(struct wlan_objmgr_vdev *vdev,
+			struct coap_offload_periodic_tx_param *param);
+	QDF_STATUS (*offload_periodic_tx_disable)(struct wlan_objmgr_vdev *vdev,
+						  uint32_t req_id);
+	QDF_STATUS (*offload_cache_get)(struct wlan_objmgr_vdev *vdev,
+					uint32_t req_id);
+};
+#endif
+
 /**
  * struct wlan_lmac_if_tx_ops - south bound tx function pointers
  * @mgmt_txrx_tx_ops: mgmt txrx tx ops
@@ -1468,6 +1501,10 @@
 #if defined(WLAN_SUPPORT_TWT) && defined(WLAN_TWT_CONV_SUPPORTED)
 	struct wlan_lmac_if_twt_tx_ops twt_tx_ops;
 #endif
+
+#ifdef WLAN_FEATURE_COAP
+	struct wlan_lmac_if_coap_tx_ops coap_ops;
+#endif
 };
 
 /**
diff --git a/umac/mlme/connection_mgr/core/src/wlan_cm_bss_scoring.c b/umac/mlme/connection_mgr/core/src/wlan_cm_bss_scoring.c
index db43dad..63af67c 100644
--- a/umac/mlme/connection_mgr/core/src/wlan_cm_bss_scoring.c
+++ b/umac/mlme/connection_mgr/core/src/wlan_cm_bss_scoring.c
@@ -2187,6 +2187,19 @@
 	return mlme_psoc_obj->psoc_cfg.score_config.check_6ghz_security;
 }
 
+void wlan_cm_set_standard_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc,
+					   bool value)
+{
+	struct psoc_mlme_obj *mlme_psoc_obj;
+
+	mlme_psoc_obj = wlan_psoc_mlme_get_cmpt_obj(psoc);
+	if (!mlme_psoc_obj)
+		return;
+
+	mlme_debug("6ghz standard connection policy val %x", value);
+	mlme_psoc_obj->psoc_cfg.score_config.standard_6ghz_conn_policy = value;
+}
+
 void wlan_cm_set_relaxed_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc,
 					  bool value)
 {
@@ -2211,6 +2224,17 @@
 	return mlme_psoc_obj->psoc_cfg.score_config.relaxed_6ghz_conn_policy;
 }
 
+bool wlan_cm_get_standard_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc)
+{
+	struct psoc_mlme_obj *mlme_psoc_obj;
+
+	mlme_psoc_obj = wlan_psoc_mlme_get_cmpt_obj(psoc);
+	if (!mlme_psoc_obj)
+		return false;
+
+	return mlme_psoc_obj->psoc_cfg.score_config.standard_6ghz_conn_policy;
+}
+
 void wlan_cm_set_6ghz_key_mgmt_mask(struct wlan_objmgr_psoc *psoc,
 				     uint32_t value)
 {
diff --git a/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_bss_score_param.h b/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_bss_score_param.h
index f8901e5..d53d4b3 100644
--- a/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_bss_score_param.h
+++ b/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_bss_score_param.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -232,6 +232,7 @@
  * @vendor_roam_score_algorithm: Preferred ETP vendor roam score algorithm
  * @check_6ghz_security: check security for 6Ghz candidate
  * @relaxed_6ghz_conn_policy: check for 6Ghz relaxed connection policy
+ * @standard_6ghz_conn_policy: check for 6 GHz standard connection policy
  * @key_mgmt_mask_6ghz: user configurable mask for 6ghz AKM
  * @mlsr_link_selection: MLSR link selection config
  * @roam_tgt_score_cap: Roam score capability
@@ -249,7 +250,9 @@
 		 check_assoc_disallowed:1,
 		 vendor_roam_score_algorithm:1,
 		 check_6ghz_security:1,
-		 relaxed_6ghz_conn_policy:1;
+		 relaxed_6ghz_conn_policy:1,
+		 standard_6ghz_conn_policy:1;
+
 	uint32_t key_mgmt_mask_6ghz;
 #ifdef WLAN_FEATURE_11BE_MLO
 	uint8_t mlsr_link_selection;
@@ -421,6 +424,26 @@
  */
 bool wlan_cm_get_relaxed_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc);
 
+/**
+ * wlan_cm_set_standard_6ghz_conn_policy() - Set 6 GHz standard connection
+ *					     policy
+ * @psoc: pointer to psoc object
+ * @value: value to be set
+ *
+ * Return: void
+ */
+void wlan_cm_set_standard_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc,
+					   bool value);
+
+/**
+ * wlan_cm_get_standard_6ghz_conn_policy() - Get 6Ghz standard connection
+ *					     policy
+ * @psoc: pointer to psoc object
+ *
+ * Return: value
+ */
+bool wlan_cm_get_standard_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc);
+
 #else
 static inline bool
 wlan_cm_6ghz_allowed_for_akm(struct wlan_objmgr_psoc *psoc,
@@ -445,6 +468,18 @@
 }
 
 static inline
+void wlan_cm_set_standard_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc,
+					   uint32_t value)
+{
+}
+
+static inline
+bool wlan_cm_get_standard_6ghz_conn_policy(struct wlan_objmgr_psoc *psoc)
+{
+	return false;
+}
+
+static inline
 void wlan_cm_set_6ghz_key_mgmt_mask(struct wlan_objmgr_psoc *psoc,
 				    uint32_t value) {}
 
diff --git a/umac/mlme/include/wlan_mlme_cmn.h b/umac/mlme/include/wlan_mlme_cmn.h
index 75a0ce1..511474c 100644
--- a/umac/mlme/include/wlan_mlme_cmn.h
+++ b/umac/mlme/include/wlan_mlme_cmn.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2019-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -25,6 +25,9 @@
 #include <include/wlan_pdev_mlme.h>
 #include <include/wlan_vdev_mlme.h>
 #include "wlan_cm_public_struct.h"
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+#include "wlan_cm_roam_public_struct.h"
+#endif
 #include "wlan_twt_public_structs.h"
 
 /**
@@ -68,6 +71,10 @@
  * @mlme_cm_roam_cmpl_cb: Roam sync complete cb
  * @vdev: vdev pointer
  *
+ * @mlme_cm_roam_rt_stats_cb: Roam stats cb
+ * @roam_stats_event: roam_stats_event pointer
+ * @idx: TLV idx for roam_stats_event
+ *
  * @mlme_cm_ft_preauth_cmpl_cb: Roam ft preauth complete cb
  * @vdev: vdev pointer
  * @rsp: preauth response pointer
@@ -103,6 +110,8 @@
 	QDF_STATUS (*mlme_cm_roam_start_cb)(struct wlan_objmgr_vdev *vdev);
 	QDF_STATUS (*mlme_cm_roam_abort_cb)(struct wlan_objmgr_vdev *vdev);
 	QDF_STATUS (*mlme_cm_roam_cmpl_cb)(struct wlan_objmgr_vdev *vdev);
+	void (*mlme_cm_roam_rt_stats_cb)(struct roam_stats_event *roam_stats,
+					 uint8_t idx);
 #endif
 #ifdef WLAN_FEATURE_PREAUTH_ENABLE
 	QDF_STATUS (*mlme_cm_ft_preauth_cmpl_cb)(
@@ -815,6 +824,15 @@
  * Return: QDF_STATUS
  */
 QDF_STATUS mlme_cm_osif_roam_complete(struct wlan_objmgr_vdev *vdev);
+
+/**
+ * mlme_cm_osif_roam_rt_stats() - osif Roam stats callback
+ * @roam_stats: roam_stats_event pointer
+ * @idx: TLV idx for roam_stats_event
+ *
+ * Return: void
+ */
+void mlme_cm_osif_roam_rt_stats(struct roam_stats_event *roam_stats, uint8_t idx);
 #endif
 
 #ifdef WLAN_FEATURE_PREAUTH_ENABLE
diff --git a/umac/mlme/mlme_objmgr/dispatcher/src/wlan_cmn_mlme_main.c b/umac/mlme/mlme_objmgr/dispatcher/src/wlan_cmn_mlme_main.c
index 0e4682b..cedcbb7 100644
--- a/umac/mlme/mlme_objmgr/dispatcher/src/wlan_cmn_mlme_main.c
+++ b/umac/mlme/mlme_objmgr/dispatcher/src/wlan_cmn_mlme_main.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2019-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -563,6 +563,17 @@
 
 	return ret;
 }
+
+void
+mlme_cm_osif_roam_rt_stats(struct roam_stats_event *roam_stats,
+			   uint8_t idx)
+{
+	if (glbl_cm_ops &&
+	    glbl_cm_ops->mlme_cm_roam_rt_stats_cb)
+		glbl_cm_ops->mlme_cm_roam_rt_stats_cb(roam_stats,
+						      idx);
+}
+
 #endif
 
 #ifdef WLAN_FEATURE_PREAUTH_ENABLE
diff --git a/umac/scan/core/src/wlan_scan_cache_db.c b/umac/scan/core/src/wlan_scan_cache_db.c
index 199f4d9..8bd1de6 100644
--- a/umac/scan/core/src/wlan_scan_cache_db.c
+++ b/umac/scan/core/src/wlan_scan_cache_db.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1193,7 +1193,8 @@
 		 * enabled. wlan_cm_get_check_6ghz_security API returns true if
 		 * neither Safe mode nor RF test mode are enabled.
 		 */
-		if (!scm_is_bss_allowed_for_country(psoc, scan_entry) &&
+		if (!wlan_cm_get_standard_6ghz_conn_policy(psoc) &&
+		    !scm_is_bss_allowed_for_country(psoc, scan_entry) &&
 		    wlan_cm_get_check_6ghz_security(psoc)) {
 			scm_info_rl(
 				"Drop frame from "QDF_MAC_ADDR_FMT
diff --git a/umac/scan/dispatcher/inc/wlan_scan_api.h b/umac/scan/dispatcher/inc/wlan_scan_api.h
index c9ee50d..2d5ed15 100644
--- a/umac/scan/dispatcher/inc/wlan_scan_api.h
+++ b/umac/scan/dispatcher/inc/wlan_scan_api.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -90,6 +90,22 @@
  */
 QDF_STATUS wlan_scan_cfg_get_passive_6g_dwelltime(struct wlan_objmgr_psoc *psoc,
 						  uint32_t *dwell_time);
+
+/**
+ * wlan_scan_cfg_get_min_dwelltime_6g() - API to get minimum 6g dwelltime
+ * @psoc: pointer to psoc object
+ * @min_dwell_time_6ghz: minimum dwelltime 6g
+ *
+ * Return: QDF_STATUS
+ */
+void wlan_scan_cfg_get_min_dwelltime_6g(struct wlan_objmgr_psoc *psoc,
+					uint32_t *min_dwell_time_6ghz);
+#else
+static inline
+void wlan_scan_cfg_get_min_dwelltime_6g(struct wlan_objmgr_psoc *psoc,
+					uint32_t *min_dwell_time_6ghz)
+{
+}
 #endif
 
 /**
diff --git a/umac/scan/dispatcher/src/wlan_scan_api.c b/umac/scan/dispatcher/src/wlan_scan_api.c
index e53b152..90d3674 100644
--- a/umac/scan/dispatcher/src/wlan_scan_api.c
+++ b/umac/scan/dispatcher/src/wlan_scan_api.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -152,6 +152,17 @@
 
 	return QDF_STATUS_SUCCESS;
 }
+
+void wlan_scan_cfg_get_min_dwelltime_6g(struct wlan_objmgr_psoc *psoc,
+					uint32_t *min_dwell_time_6ghz)
+{
+	struct wlan_scan_obj *scan_obj;
+
+	scan_obj = wlan_psoc_get_scan_obj(psoc);
+	if (!scan_obj)
+		return;
+	*min_dwell_time_6ghz = scan_obj->scan_def.min_dwell_time_6g;
+}
 #endif
 
 #ifdef WLAN_POLICY_MGR_ENABLE
diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c
index e9e1aa5..820e7ba 100644
--- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c
+++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1026,8 +1026,6 @@
 		scan_params->ie_list.p2p = (uint8_t *)ie;
 	} else if (is_qca_son_oui((uint8_t *)ie,
 				  QCA_OUI_WHC_AP_INFO_SUBTYPE)) {
-		if (ie->ie_len > WLAN_VENDOR_SON_IE_LEN)
-			return QDF_STATUS_E_INVAL;
 
 		scan_params->ie_list.sonadv = (uint8_t *)ie;
 	} else if (is_ht_cap((uint8_t *)ie)) {
@@ -2614,7 +2612,7 @@
 	 */
 	tmp_new = sub_copy;
 	while (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <=
-	       subie_len) {
+	       (subie_len - 1)) {
 		if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP ||
 		      tmp_new[0] == WLAN_ELEMID_SSID ||
 		      tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX ||
@@ -2628,7 +2626,7 @@
 			}
 		}
 		if (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) >=
-		    subie_len)
+		    (subie_len - 1))
 			break;
 		tmp_new += tmp_new[1] + MIN_IE_LEN;
 	}
diff --git a/umac/twt/core/src/wlan_twt_common.c b/umac/twt/core/src/wlan_twt_common.c
index 353a249..9ac2e14 100644
--- a/umac/twt/core/src/wlan_twt_common.c
+++ b/umac/twt/core/src/wlan_twt_common.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -408,8 +408,8 @@
 	peer = wlan_objmgr_get_peer_by_mac(psoc, peer_mac->bytes,
 					   WLAN_TWT_ID);
 	if (!peer) {
-		twt_err("Peer object not found "QDF_MAC_ADDR_FMT,
-			QDF_MAC_ADDR_REF(peer_mac));
+		twt_debug("Peer object not found " QDF_MAC_ADDR_FMT,
+			  QDF_MAC_ADDR_REF(peer_mac->bytes));
 		return QDF_STATUS_E_FAILURE;
 	}
 
@@ -442,7 +442,7 @@
 					   WLAN_TWT_ID);
 	if (!peer) {
 		twt_err("Peer object not found "QDF_MAC_ADDR_FMT,
-			QDF_MAC_ADDR_REF(peer_mac));
+			QDF_MAC_ADDR_REF(peer_mac->bytes));
 		*peer_cap = 0;
 		return QDF_STATUS_E_FAILURE;
 	}
diff --git a/wmi/inc/wmi_unified_param.h b/wmi/inc/wmi_unified_param.h
index 76fe045..7a8582b 100644
--- a/wmi/inc/wmi_unified_param.h
+++ b/wmi/inc/wmi_unified_param.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -4749,6 +4749,9 @@
 #ifdef MULTI_CLIENT_LL_SUPPORT
 	wmi_vdev_latency_event_id,
 #endif
+#ifdef WLAN_FEATURE_COAP
+	wmi_wow_coap_buf_info_eventid,
+#endif
 	wmi_events_max,
 } wmi_conv_event_id;
 
diff --git a/wmi/inc/wmi_unified_priv.h b/wmi/inc/wmi_unified_priv.h
index aec5693..d653908 100644
--- a/wmi/inc/wmi_unified_priv.h
+++ b/wmi/inc/wmi_unified_priv.h
@@ -103,6 +103,10 @@
 #include <wlan_twt_public_structs.h>
 #endif
 
+#ifdef WLAN_FEATURE_COAP
+#include "wlan_coap_public_structs.h"
+#endif
+
 #define WMI_UNIFIED_MAX_EVENT 0x100
 
 #ifdef WMI_EXT_DBG
@@ -2901,6 +2905,31 @@
 				wmi_unified_t wmi_handle, void *evt_buf,
 				struct vdev_sta_quiet_event *quiet_event);
 #endif
+
+#ifdef WLAN_FEATURE_COAP
+QDF_STATUS
+(*send_coap_add_pattern_cmd)(wmi_unified_t wmi_handle,
+			     struct coap_offload_reply_param *param);
+
+QDF_STATUS
+(*send_coap_del_pattern_cmd)(wmi_unified_t wmi_handle,
+			     uint8_t vdev_id, uint32_t pattern_id);
+
+QDF_STATUS
+(*send_coap_add_keepalive_pattern_cmd)(wmi_unified_t wmi_handle,
+		struct coap_offload_periodic_tx_param *param);
+
+QDF_STATUS
+(*send_coap_del_keepalive_pattern_cmd)(wmi_unified_t wmi_handle,
+				       uint8_t vdev_id, uint32_t pattern_id);
+
+QDF_STATUS
+(*send_coap_cache_get_cmd)(wmi_unified_t wmi_handle,
+			   uint8_t vdev_id, uint32_t pattern_id);
+
+QDF_STATUS (*extract_coap_buf_info)(wmi_unified_t wmi_handle, void *evt_buf,
+				    struct coap_buf_info *info);
+#endif
 };
 
 /* Forward declartion for psoc*/
@@ -3486,6 +3515,14 @@
 }
 #endif /* QCA_SUPPORT_MC_CP_STATS */
 
+#ifdef WLAN_FEATURE_COAP
+void wmi_coap_attach_tlv(wmi_unified_t wmi_handle);
+#else
+static inline void wmi_coap_attach_tlv(wmi_unified_t wmi_handle)
+{
+}
+#endif
+
 /*
  * wmi_map_ch_width() - map wmi channel width to host channel width
  * @wmi_width: wmi channel width
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c
index 51c5bfd..e2f248a 100644
--- a/wmi/src/wmi_unified_tlv.c
+++ b/wmi/src/wmi_unified_tlv.c
@@ -5693,6 +5693,7 @@
 	wmi_buf_t buf;
 	uint8_t *buf_ptr;
 	int ret;
+	bool is_link_stats_over_qmi;
 
 	len = sizeof(*cmd);
 	buf = wmi_buf_alloc(wmi_handle, len);
@@ -5721,8 +5722,20 @@
 		 QDF_MAC_ADDR_REF(get_req->peer_macaddr.bytes));
 
 	wmi_mtrace(WMI_REQUEST_LINK_STATS_CMDID, cmd->vdev_id, 0);
-	ret = wmi_unified_cmd_send_pm_chk(wmi_handle, buf, len,
-					  WMI_REQUEST_LINK_STATS_CMDID, true);
+	is_link_stats_over_qmi = is_service_enabled_tlv(
+			wmi_handle,
+			WMI_SERVICE_UNIFIED_LL_GET_STA_OVER_QMI_SUPPORT);
+
+	if (is_link_stats_over_qmi) {
+		ret = wmi_unified_cmd_send_over_qmi(
+					wmi_handle, buf, len,
+					WMI_REQUEST_LINK_STATS_CMDID);
+	} else {
+		ret = wmi_unified_cmd_send_pm_chk(
+					wmi_handle, buf, len,
+					WMI_REQUEST_LINK_STATS_CMDID, true);
+	}
+
 	if (ret) {
 		wmi_buf_free(buf);
 		return QDF_STATUS_E_FAILURE;
@@ -16011,6 +16024,15 @@
 			dst->num_chan = MAX_ROAM_SCAN_CHAN;
 
 		src_chan = &param_buf->roam_scan_chan_info[chan_idx];
+
+		if ((dst->num_chan + chan_idx) >
+		    param_buf->num_roam_scan_chan_info) {
+			wmi_err("Invalid TLV. num_chan %d chan_idx %d num_roam_scan_chan_info %d",
+				dst->num_chan, chan_idx,
+				param_buf->num_roam_scan_chan_info);
+			return QDF_STATUS_SUCCESS;
+		}
+
 		for (i = 0; i < dst->num_chan; i++) {
 			dst->chan_freq[i] = src_chan->channel;
 			src_chan++;
@@ -16201,6 +16223,14 @@
 	if (dst->num_freq > MAX_ROAM_SCAN_CHAN)
 		dst->num_freq = MAX_ROAM_SCAN_CHAN;
 
+	if ((dst->num_freq + rpt_idx) >
+	    param_buf->num_roam_neighbor_report_chan_info) {
+		wmi_err("Invalid TLV. num_freq %d rpt_idx %d num_roam_neighbor_report_chan_info %d",
+			dst->num_freq, rpt_idx,
+			param_buf->num_roam_scan_chan_info);
+		return QDF_STATUS_SUCCESS;
+	}
+
 	for (i = 0; i < dst->num_freq; i++) {
 		dst->freq[i] = src_freq->channel;
 		src_freq++;
@@ -17919,6 +17949,10 @@
 #ifdef MULTI_CLIENT_LL_SUPPORT
 	event_ids[wmi_vdev_latency_event_id] = WMI_VDEV_LATENCY_LEVEL_EVENTID;
 #endif
+#ifdef WLAN_FEATURE_COAP
+	event_ids[wmi_wow_coap_buf_info_eventid] =
+		WMI_WOW_COAP_BUF_INFO_EVENTID;
+#endif
 }
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -18445,6 +18479,7 @@
 	wmi_cp_stats_attach_tlv(wmi_handle);
 	wmi_gpio_attach_tlv(wmi_handle);
 	wmi_11be_attach_tlv(wmi_handle);
+	wmi_coap_attach_tlv(wmi_handle);
 }
 qdf_export_symbol(wmi_tlv_attach);