qcacld-3.0: Handle vendor control command and event

WMI_ROAM_GET_VENDOR_CONTROL_PARAM_CMDID: Add support
for a new roam command to get vendor control parameters
from FW. Host needs to send proper param ID in command
(from enum WMI_ROAM_GET_VENDOR_CONTROL_PARAM_ID)
to get corresponding INI value from FW.

WMI_ROAM_GET_VENDOR_CONTROL_PARAM_EVENTID:
Add support for a new roam event to get param value
from FW. FW sends this event upon receiving
WMI_ROAM_GET_VENDOR_CONTROL_PARAM_CMDID command.

Change-Id: I03679bcf359a0f425aab7b9ea1c3cb6d84fbb0ca
CRs-Fixed: 3225160

components/mlme/core/src/wlan_mlme_main.c

@@ -2024,6 +2024,8 @@ static void mlme_init_lfr_cfg(struct wlan_objmgr_psoc *psoc,
 		cfg_get(psoc, CFG_LFR_NEIGHBOR_SCAN_MIN_CHAN_TIME);
 	lfr->neighbor_scan_max_chan_time =
 		cfg_get(psoc, CFG_LFR_NEIGHBOR_SCAN_MAX_CHAN_TIME);
+	lfr->passive_max_channel_time =
+		cfg_get(psoc, CFG_PASSIVE_MAX_CHANNEL_TIME);
 	lfr->neighbor_scan_results_refresh_period =
 		cfg_get(psoc, CFG_LFR_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD);
 

components/mlme/dispatcher/inc/wlan_mlme_public_struct.h

@@ -1957,6 +1957,7 @@ struct wlan_mlme_lfr_cfg {
 	uint32_t roam_rescan_rssi_diff;
 	uint16_t neighbor_scan_min_chan_time;
 	uint16_t neighbor_scan_max_chan_time;
+	uint32_t passive_max_channel_time;
 	uint32_t neighbor_scan_results_refresh_period;
 	uint32_t empty_scan_refresh_period;
 	uint8_t roam_bmiss_first_bcnt;

components/target_if/connection_mgr/inc/target_if_cm_roam_event.h

@@ -211,4 +211,27 @@ target_if_roam_frame_event_handler(ol_scn_t scn, uint8_t *event,
 	return 0;
 }
 #endif /* WLAN_FEATURE_ROAM_OFFLOAD */
+
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * target_if_get_roam_vendor_control_param_event_handler - event handler for
+ * vendor control params event
+ * @scn: target handle
+ * @event: event buffer
+ * @len: event buffer length
+ *
+ * Return: int for success or error code
+ */
+int target_if_get_roam_vendor_control_param_event_handler(ol_scn_t scn,
+							  uint8_t *event,
+							  uint32_t len);
+#else
+static inline int
+target_if_get_roam_vendor_control_param_event_handler(ol_scn_t scn,
+						      uint8_t *event,
+						      uint32_t len)
+{
+	return 0;
+}
+#endif
 #endif

components/target_if/connection_mgr/src/target_if_cm_roam_event.c

@@ -52,6 +52,21 @@ target_if_cm_get_roam_rx_ops(struct wlan_objmgr_psoc *psoc)
 	return rx_ops;
 }
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+static void target_if_cm_roam_register_vendor_handoff_rx_ops(
+					struct wlan_cm_roam_rx_ops *rx_ops)
+{
+	rx_ops->roam_vendor_handoff_event =
+					cm_roam_vendor_handoff_event_handler;
+}
+#else
+static inline void
+target_if_cm_roam_register_vendor_handoff_rx_ops(
+					struct wlan_cm_roam_rx_ops *rx_ops)
+{
+}
+#endif
+
 void
 target_if_cm_roam_register_rx_ops(struct wlan_cm_roam_rx_ops *rx_ops)
 {
@@ -65,6 +80,7 @@ target_if_cm_roam_register_rx_ops(struct wlan_cm_roam_rx_ops *rx_ops)
 	rx_ops->roam_auth_offload_event = cm_roam_auth_offload_event_handler;
 	rx_ops->roam_pmkid_request_event_rx = cm_roam_pmkid_request_handler;
 	rx_ops->roam_candidate_frame_event = cm_roam_candidate_event_handler;
+	target_if_cm_roam_register_vendor_handoff_rx_ops(rx_ops);
 }
 
 int target_if_cm_roam_event(ol_scn_t scn, uint8_t *event, uint32_t len)
@@ -624,6 +640,80 @@ target_if_roam_frame_event_handler(ol_scn_t scn, uint8_t *event,
 	return QDF_STATUS_SUCCESS;
 }
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+int target_if_get_roam_vendor_control_param_event_handler(ol_scn_t scn,
+							  uint8_t *event,
+							  uint32_t len)
+{
+	struct wlan_objmgr_psoc *psoc;
+	struct wmi_unified *wmi_handle;
+	struct roam_vendor_handoff_params *vendor_handoff_params = NULL;
+	struct wlan_cm_roam_rx_ops *roam_rx_ops;
+	QDF_STATUS qdf_status;
+	int ret = 0;
+
+	psoc = target_if_get_psoc_from_scn_hdl(scn);
+	if (!psoc) {
+		target_if_err("psoc is null");
+		ret = -EINVAL;
+	}
+
+	wmi_handle = get_wmi_unified_hdl_from_psoc(psoc);
+	if (!wmi_handle) {
+		target_if_err("wmi_handle is null");
+		ret = -EINVAL;
+	}
+
+	qdf_status = wmi_extract_roam_vendor_control_param_event(wmi_handle,
+							event, len,
+							&vendor_handoff_params);
+	if (QDF_IS_STATUS_ERROR(qdf_status)) {
+		target_if_err("parsing of event failed, %d", qdf_status);
+		ret = -EINVAL;
+		goto done;
+	}
+
+	roam_rx_ops = target_if_cm_get_roam_rx_ops(psoc);
+	if (!roam_rx_ops || !roam_rx_ops->roam_vendor_handoff_event) {
+		target_if_err("No valid roam rx ops");
+		ret = -EINVAL;
+		goto done;
+	}
+
+	roam_rx_ops->roam_vendor_handoff_event(psoc, vendor_handoff_params);
+
+done:
+	if (vendor_handoff_params)
+		qdf_mem_free(vendor_handoff_params);
+
+	return ret;
+}
+
+static QDF_STATUS
+target_if_register_roam_vendor_control_param_event(wmi_unified_t handle)
+{
+	QDF_STATUS ret;
+
+	ret = wmi_unified_register_event_handler(handle,
+			wmi_get_roam_vendor_control_param_event_id,
+			target_if_get_roam_vendor_control_param_event_handler,
+			WMI_RX_SERIALIZER_CTX);
+	if (QDF_IS_STATUS_ERROR(ret)) {
+		target_if_err("wmi event(%u) registration failed, ret: %d",
+			      wmi_get_roam_vendor_control_param_event_id, ret);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+#else
+static inline QDF_STATUS
+target_if_register_roam_vendor_control_param_event(wmi_unified_t handle)
+{
+	return QDF_STATUS_SUCCESS;
+}
+#endif
+
 QDF_STATUS
 target_if_roam_offload_register_events(struct wlan_objmgr_psoc *psoc)
 {
@@ -714,6 +804,8 @@ target_if_roam_offload_register_events(struct wlan_objmgr_psoc *psoc)
 		return QDF_STATUS_E_FAILURE;
 	}
 
+	target_if_register_roam_vendor_control_param_event(handle);
+
 	ret = wmi_unified_register_event_handler(handle,
 				wmi_roam_frame_event_id,
 				target_if_roam_frame_event_handler,

components/target_if/connection_mgr/src/target_if_cm_roam_offload.c

@@ -172,6 +172,50 @@ target_if_cm_roam_rt_stats_config(struct wlan_objmgr_vdev *vdev,
 	return status;
 }
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * target_if_cm_roam_vendor_handoff_config() - Send vendor handoff config
+ * command to fw
+ * @vdev: vdev object
+ * @vdev_id: vdev id
+ * @param_id: param id
+ *
+ * Return: QDF_STATUS
+ */
+static QDF_STATUS
+target_if_cm_roam_vendor_handoff_config(struct wlan_objmgr_vdev *vdev,
+					uint8_t vdev_id, uint32_t param_id)
+{
+	wmi_unified_t wmi_handle;
+
+	wmi_handle = target_if_cm_roam_get_wmi_handle_from_vdev(vdev);
+	if (!wmi_handle)
+		return QDF_STATUS_E_FAILURE;
+
+	return wmi_unified_roam_vendor_handoff_req_cmd(wmi_handle,
+						       vdev_id, param_id);
+}
+
+/**
+ * target_if_cm_roam_register_vendor_handoff_ops() - Register tx ops to send
+ * vendor handoff config command to fw
+ * @tx_ops: structure of tx function pointers for roaming related commands
+ *
+ * Return: none
+ */
+static void target_if_cm_roam_register_vendor_handoff_ops(
+					struct wlan_cm_roam_tx_ops *tx_ops)
+{
+	tx_ops->send_roam_vendor_handoff_config =
+				target_if_cm_roam_vendor_handoff_config;
+}
+#else
+static inline void target_if_cm_roam_register_vendor_handoff_ops(
+					struct wlan_cm_roam_tx_ops *tx_ops)
+{
+}
+#endif
+
 static void
 target_if_cm_roam_register_lfr3_ops(struct wlan_cm_roam_tx_ops *tx_ops)
 {
@@ -179,6 +223,7 @@ target_if_cm_roam_register_lfr3_ops(struct wlan_cm_roam_tx_ops *tx_ops)
 	tx_ops->send_roam_invoke_cmd = target_if_cm_roam_send_roam_invoke_cmd;
 	tx_ops->send_roam_sync_complete_cmd = target_if_cm_roam_send_roam_sync_complete;
 	tx_ops->send_roam_rt_stats_config = target_if_cm_roam_rt_stats_config;
+	target_if_cm_roam_register_vendor_handoff_ops(tx_ops);
 }
 #else
 static inline void

components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.c

@@ -725,6 +725,173 @@ cm_roam_send_rt_stats_config(struct wlan_objmgr_psoc *psoc,
 	return status;
 }
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * cm_roam_is_vendor_handoff_control_enable() - check whether vendor handoff
+ * control feature is enable or not in driver
+ * @psoc: psoc pointer
+ *
+ * Return: true if feature supports
+ */
+static bool
+cm_roam_is_vendor_handoff_control_enable(struct wlan_objmgr_psoc *psoc)
+{
+	bool ini_flag, handoff_control_support;
+	struct wlan_mlme_psoc_ext_obj *mlme_obj;
+
+	mlme_obj = mlme_get_psoc_ext_obj(psoc);
+
+	if (!mlme_obj)
+		return false;
+
+	ini_flag = mlme_obj->cfg.connection_roaming_ini_flag;
+
+	handoff_control_support =
+	      wlan_mlme_get_vendor_handoff_control_caps(psoc);
+
+	mlme_debug("ini flag:%d, fw caps:%d", ini_flag,
+		   handoff_control_support);
+
+	if (ini_flag && handoff_control_support)
+		return true;
+
+	return false;
+}
+
+QDF_STATUS
+cm_roam_send_vendor_handoff_param_req(struct wlan_objmgr_psoc *psoc,
+				      uint8_t vdev_id,
+				      uint32_t param_id,
+				      void *vendor_handoff_context)
+{
+	struct vendor_handoff_cfg *req;
+	QDF_STATUS status;
+	struct mlme_legacy_priv *mlme_priv;
+	struct wlan_objmgr_vdev *vdev;
+
+	if (!cm_roam_is_vendor_handoff_control_enable(psoc)) {
+		mlme_debug("vendor handoff control feature is not enabled");
+		return QDF_STATUS_E_NOSUPPORT;
+	}
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, vdev_id,
+						    WLAN_MLME_CM_ID);
+	if (!vdev) {
+		mlme_err("get vdev failed");
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	mlme_priv = wlan_vdev_mlme_get_ext_hdl(vdev);
+	if (!mlme_priv) {
+		status = QDF_STATUS_E_FAILURE;
+		goto error;
+	}
+
+	if (mlme_priv->cm_roam.vendor_handoff_param.req_in_progress) {
+		mlme_debug("vendor handoff request is already in progress");
+		status = QDF_STATUS_E_FAILURE;
+		goto error;
+	} else {
+		mlme_debug("Set vendor handoff req in progress context");
+		mlme_priv->cm_roam.vendor_handoff_param.req_in_progress = true;
+		mlme_priv->cm_roam.vendor_handoff_param.vendor_handoff_context =
+							vendor_handoff_context;
+	}
+
+	req = qdf_mem_malloc(sizeof(*req));
+	if (!req) {
+		status = QDF_STATUS_E_NOMEM;
+		goto error;
+	}
+
+	req->vdev_id = vdev_id;
+	req->param_id = param_id;
+
+	status = wlan_cm_tgt_send_roam_vendor_handoff_config(psoc, req);
+	if (QDF_IS_STATUS_ERROR(status))
+		mlme_debug("fail to send roam rt stats config");
+
+	qdf_mem_free(req);
+
+error:
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_MLME_CM_ID);
+	return status;
+}
+
+QDF_STATUS cm_roam_update_vendor_handoff_config(struct wlan_objmgr_psoc *psoc,
+				     struct roam_vendor_handoff_params *list)
+{
+	struct wlan_objmgr_vdev *vdev;
+	struct rso_config *rso_cfg;
+	struct rso_cfg_params *cfg_params;
+	uint8_t vdev_id;
+	QDF_STATUS status = QDF_STATUS_SUCCESS;
+	uint32_t param_id, param_value, i;
+
+	vdev_id = list->vdev_id;
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, vdev_id,
+						    WLAN_MLME_SB_ID);
+	if (!vdev) {
+		mlme_err("vdev object is NULL");
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	rso_cfg = wlan_cm_get_rso_config(vdev);
+	if (!rso_cfg) {
+		status = QDF_STATUS_E_FAILURE;
+		goto error;
+	}
+
+	cfg_params = &rso_cfg->cfg_param;
+
+	mlme_debug("received vendor handoff event from FW with num_entries %d",
+		   list->num_entries);
+
+	for (i = 0; i < list->num_entries; i++) {
+		param_id = list->param_info[i].param_id;
+		param_value = list->param_info[i].param_value;
+		mlme_debug("param id:%d, param value:%d", param_id,
+			   param_value);
+		switch (param_id) {
+		case ROAM_VENDOR_CONTROL_PARAM_TRIGGER:
+			cfg_params->neighbor_lookup_threshold =
+							abs(param_value);
+			break;
+		case ROAM_VENDOR_CONTROL_PARAM_DELTA:
+			cfg_params->roam_rssi_diff = param_value;
+			break;
+		case ROAM_VENDOR_CONTROL_PARAM_FULL_SCANPERIOD:
+			cfg_params->full_roam_scan_period = param_value;
+			break;
+		case ROAM_VENDOR_CONTROL_PARAM_PARTIAL_SCANPERIOD:
+			cfg_params->empty_scan_refresh_period =
+							param_value * 1000;
+			break;
+		case ROAM_VENDOR_CONTROL_PARAM_ACTIVE_CH_DWELLTIME:
+			cfg_params->max_chan_scan_time = param_value;
+			break;
+		case ROAM_VENDOR_CONTROL_PARAM_PASSIVE_CH_DWELLTIME:
+			cfg_params->passive_max_chan_time = param_value;
+			break;
+		case ROAM_VENDOR_CONTROL_PARAM_HOME_CH_TIME:
+			cfg_params->neighbor_scan_period = param_value;
+			break;
+		case ROAM_VENDOR_CONTROL_PARAM_AWAY_TIME:
+			cfg_params->roam_scan_home_away_time = param_value;
+			break;
+		default:
+			mlme_debug("Invalid param id");
+			status = QDF_STATUS_E_FAILURE;
+			goto error;
+		}
+	}
+error:
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_MLME_SB_ID);
+	return status;
+}
+
+#endif
 #else
 static inline void
 cm_roam_reason_vsie(struct wlan_objmgr_psoc *psoc, uint8_t vdev_id,
@@ -1007,12 +1174,15 @@ cm_roam_scan_offload_rssi_thresh(struct wlan_objmgr_psoc *psoc, uint8_t vdev_id,
 
 	lfr_cfg = &mlme_obj->cfg.lfr;
 
-	if (rso_config->alert_rssi_threshold)
+	if (rso_config->alert_rssi_threshold) {
 		params->rssi_thresh = rso_config->alert_rssi_threshold;
-	else
+	} else {
+		mlme_debug("lookup_threshold:%d",
+			   rso_cfg->cfg_param.neighbor_lookup_threshold);
 		params->rssi_thresh =
 			(int8_t)rso_cfg->cfg_param.neighbor_lookup_threshold *
 			(-1);
+	}
 
 	params->vdev_id = vdev_id;
 	params->rssi_thresh_diff =
@@ -1108,6 +1278,8 @@ cm_roam_scan_offload_scan_period(uint8_t vdev_id,
 			cfg_params->roam_scan_period_after_inactivity;
 	params->full_scan_period =
 			cfg_params->full_roam_scan_period;
+	mlme_debug("full_scan_period:%d, empty_scan_refresh_period:%d",
+		   params->full_scan_period, params->empty_scan_refresh_period);
 }
 
 static void
@@ -1579,6 +1751,7 @@ cm_roam_scan_offload_ap_profile(struct wlan_objmgr_psoc *psoc,
 	cm_update_crypto_params(vdev, profile);
 
 	profile->rssi_threshold = rso_cfg->cfg_param.roam_rssi_diff;
+	mlme_debug("profile->rssi_threshold:%d", profile->rssi_threshold);
 	profile->bg_rssi_threshold = rso_cfg->cfg_param.bg_rssi_threshold;
 	/*
 	 * rssi_diff which is updated via framework is equivalent to the
@@ -2256,8 +2429,8 @@ cm_roam_scan_offload_fill_scan_params(struct wlan_objmgr_psoc *psoc,
 	cfg_params = &rso_cfg->cfg_param;
 
 	/* Parameters updated after association is complete */
-	wlan_scan_cfg_get_passive_dwelltime(psoc,
+	scan_params->dwell_time_passive = cfg_params->passive_max_chan_time;
-					    &scan_params->dwell_time_passive);
+
 	wlan_scan_cfg_get_min_dwelltime_6g(psoc,
 					   &scan_params->min_dwell_time_6ghz);
 	/*
@@ -2268,6 +2441,7 @@ cm_roam_scan_offload_fill_scan_params(struct wlan_objmgr_psoc *psoc,
 	scan_params->dwell_time_active = cfg_params->max_chan_scan_time;
 
 	roam_scan_home_away_time = cfg_params->roam_scan_home_away_time;
+
 	if (roam_scan_home_away_time <
 	    (scan_params->dwell_time_active +
 	     (2 * ROAM_SCAN_CHANNEL_SWITCH_TIME))) {
@@ -2355,6 +2529,11 @@ cm_roam_scan_offload_fill_scan_params(struct wlan_objmgr_psoc *psoc,
 		mlme_obj->cfg.lfr.adaptive_roamscan_dwell_mode;
 
 	cm_fill_6ghz_dwell_times(psoc, scan_params);
+
+	mlme_debug("dwell time passive:%d, active:%d, home_away_time:%d, burst_duration:%d, max_rest_time:%d",
+		   scan_params->dwell_time_passive,
+		   scan_params->dwell_time_active, roam_scan_home_away_time,
+		   scan_params->burst_duration, scan_params->max_rest_time);
 }
 
 void wlan_cm_append_assoc_ies(struct wlan_roam_scan_offload_params *rso_mode_cfg,
@@ -4722,6 +4901,8 @@ cm_restore_default_roaming_params(struct wlan_mlme_psoc_ext_obj *mlme_obj,
 
 	cfg_params->max_chan_scan_time =
 			mlme_obj->cfg.lfr.neighbor_scan_max_chan_time;
+	cfg_params->passive_max_chan_time =
+			mlme_obj->cfg.lfr.passive_max_channel_time;
 	cfg_params->roam_scan_home_away_time =
 			mlme_obj->cfg.lfr.roam_scan_home_away_time;
 	cfg_params->roam_scan_n_probes =

components/umac/mlme/connection_mgr/core/src/wlan_cm_roam_offload.h

@@ -315,6 +315,35 @@ QDF_STATUS
 cm_roam_send_disable_config(struct wlan_objmgr_psoc *psoc,
 			    uint8_t vdev_id, uint8_t cfg);
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * cm_roam_send_vendor_handoff_param_req() - send vendor handoff param cmd
+ * @psoc: psoc pointer
+ * @vdev_id: vdev id
+ * @param_value: roam stats param value
+ * @vendor_handoff_context: vendor handoff context request
+ *
+ * This function is used to send vendor handoff param cmd
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS
+cm_roam_send_vendor_handoff_param_req(struct wlan_objmgr_psoc *psoc,
+				      uint8_t vdev_id,
+				      uint32_t param_value,
+				      void *vendor_handoff_context);
+/**
+ * cm_roam_update_vendor_handoff_config() - update vendor handoff param to
+ * rso config structure
+ * @psoc: psoc pointer
+ * @list: vendor handoff parameters to be updated
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS cm_roam_update_vendor_handoff_config(struct wlan_objmgr_psoc *psoc,
+				     struct roam_vendor_handoff_params *list);
+#endif
+
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 /**
  * cm_roam_send_rt_stats_config() - Send roam event stats cfg value to FW

components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_roam_api.h

@@ -1467,6 +1467,19 @@ cm_roam_auth_offload_event_handler(struct auth_offload_event *auth_event);
 QDF_STATUS
 cm_roam_pmkid_request_handler(struct roam_pmkid_req_event *data);
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * cm_roam_vendor_handoff_event_handler() - vendor handoff event handler
+ * @psoc: psoc object
+ * @data: vendor handoff params
+ *
+ * Return: None
+ */
+void
+cm_roam_vendor_handoff_event_handler(struct wlan_objmgr_psoc *psoc,
+				     struct roam_vendor_handoff_params *data);
+#endif
+
 /**
  * cm_roam_update_vdev() - Update the STA and BSS
  * @sync_ind: Information needed for roam sync propagation

components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_roam_public_struct.h

@@ -278,6 +278,7 @@ struct rso_cfg_params {
 	int8_t rssi_thresh_offset_5g;
 	uint32_t min_chan_scan_time;
 	uint32_t max_chan_scan_time;
+	uint32_t passive_max_chan_time;
 	uint16_t neighbor_results_refresh_period;
 	uint16_t empty_scan_refresh_period;
 	uint8_t opportunistic_threshold_diff;
@@ -1161,6 +1162,18 @@ struct roam_disable_cfg {
 	uint8_t cfg;
 };
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * struct vendor_handoff_cfg - vendor handoff command params
+ * @vdev_id: vdev for which host sends vendor handoff command
+ * @param_id:  parameter id
+ */
+struct vendor_handoff_cfg {
+	uint32_t vdev_id;
+	uint32_t param_id;
+};
+#endif
+
 /**
  * struct wlan_roam_disconnect_params - Emergency deauth/disconnect roam params
  * @vdev_id: VDEV on which the parameters should be applied
@@ -2280,6 +2293,7 @@ struct roam_pmkid_req_event {
  * @send_roam_abort: send roam abort
  * @send_roam_disable_config: send roam disable config
  * @send_roam_rt_stats_config: Send roam events vendor command param value to FW
+ * @send_roam_vendor_handoff_config: send vendor handoff config command to FW
  */
 struct wlan_cm_roam_tx_ops {
 	QDF_STATUS (*send_vdev_set_pcl_cmd)(struct wlan_objmgr_vdev *vdev,
@@ -2311,6 +2325,11 @@ struct wlan_cm_roam_tx_ops {
 	QDF_STATUS (*send_roam_rt_stats_config)(struct wlan_objmgr_vdev *vdev,
 						uint8_t vdev_id, uint8_t value);
 #endif
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+	QDF_STATUS (*send_roam_vendor_handoff_config)(
+					struct wlan_objmgr_vdev *vdev,
+					uint8_t vdev_id, uint32_t param_id);
+#endif
 };
 
 /**
@@ -2329,14 +2348,31 @@ enum roam_scan_freq_scheme {
 	ROAM_SCAN_FREQ_SCHEME_NONE = 3,
 };
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * struct wlan_cm_vendor_handoff_param - vendor handoff configuration
+ * structure
+ * @vendor_handoff_context_cb: vendor handoff context
+ * @req_in_progress: to check whether vendor handoff reqest in progress or not
+ */
+struct wlan_cm_vendor_handoff_param {
+	void *vendor_handoff_context;
+	bool req_in_progress;
+};
+#endif
+
 /**
  * struct wlan_cm_roam  - Connection manager roam configs, state and roam
  * data related structure
  * @pcl_vdev_cmd_active:  Flag to check if vdev level pcl command needs to be
  * sent or PDEV level PCL command needs to be sent
+ * @vendor_handoff_param: vendor handoff params
  */
 struct wlan_cm_roam {
 	bool pcl_vdev_cmd_active;
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+	struct wlan_cm_vendor_handoff_param vendor_handoff_param;
+#endif
 };
 
 /**
@@ -2535,6 +2571,7 @@ struct roam_scan_candidate_frame {
  * @roam_auth_offload_event: Rx ops function pointer for auth offload event
  * @roam_pmkid_request_event_rx: Rx ops function pointer for roam pmkid event
  * @roam_candidate_frame_event : Rx ops function pointer for roam frame event
+ * @roam_vendor_handoff_event: Rx ops function pointer for vendor handoff event
  */
 struct wlan_cm_roam_rx_ops {
 	QDF_STATUS (*roam_sync_event)(struct wlan_objmgr_psoc *psoc,
@@ -2560,5 +2597,10 @@ struct wlan_cm_roam_rx_ops {
 	QDF_STATUS
 	(*roam_candidate_frame_event)(struct wlan_objmgr_psoc *psoc,
 				      struct roam_scan_candidate_frame *frame);
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+	void
+	(*roam_vendor_handoff_event)(struct wlan_objmgr_psoc *psoc,
+				     struct roam_vendor_handoff_params *data);
+#endif
 };
 #endif

components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_roam_ucfg_api.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -336,4 +336,21 @@ ucfg_cm_roam_send_rt_stats_config(struct wlan_objmgr_pdev *pdev,
 }
 #endif /* WLAN_FEATURE_ROAM_OFFLOAD */
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * ucfg_cm_roam_send_vendor_handoff_param_req() - send vendor handoff params
+ * command request to FW
+ * @pdev: Pointer to pdev
+ * @vdev_id: vdev id
+ * @param_id: Vendor Control Param ID from
+ * enum WMI_ROAM_GET_VENDOR_CONTROL_PARAM_ID
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS
+ucfg_cm_roam_send_vendor_handoff_param_req(struct wlan_objmgr_psoc *psoc,
+					   uint8_t vdev_id, uint32_t param_id,
+					   void *vendor_handoff_context);
+#endif
+
 #endif /* _WLAN_CM_ROAM_UCFG_API_H_ */

components/umac/mlme/connection_mgr/dispatcher/inc/wlan_cm_tgt_if_tx_api.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -64,6 +64,20 @@ wlan_cm_tgt_send_roam_rt_stats_config(struct wlan_objmgr_psoc *psoc,
 }
 #endif /* WLAN_FEATURE_ROAM_OFFLOAD */
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * wlan_cm_tgt_send_roam_vendor_handoff_config()  - Send vendor handoff config
+ * command to firmware
+ * @psoc: PSOC pointer
+ * @req: vendor handoff command params
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS
+wlan_cm_tgt_send_roam_vendor_handoff_config(struct wlan_objmgr_psoc *psoc,
+					    struct vendor_handoff_cfg *req);
+#endif
+
 #if defined(WLAN_FEATURE_HOST_ROAM) || defined(WLAN_FEATURE_ROAM_OFFLOAD)
 
 #define CFG_DISABLE_4WAY_HS_OFFLOAD_DEFAULT BIT(0)

components/umac/mlme/connection_mgr/dispatcher/src/wlan_cm_roam_api.c

@@ -1420,6 +1420,8 @@ QDF_STATUS wlan_cm_rso_config_init(struct wlan_objmgr_vdev *vdev,
 	cfg_params = &rso_cfg->cfg_param;
 	cfg_params->max_chan_scan_time =
 		mlme_obj->cfg.lfr.neighbor_scan_max_chan_time;
+	cfg_params->passive_max_chan_time =
+		mlme_obj->cfg.lfr.passive_max_channel_time;
 	cfg_params->min_chan_scan_time =
 		mlme_obj->cfg.lfr.neighbor_scan_min_chan_time;
 	cfg_params->neighbor_lookup_threshold =
@@ -2416,6 +2418,49 @@ cm_roam_pmkid_request_handler(struct roam_pmkid_req_event *data)
 }
 #endif
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+void
+cm_roam_vendor_handoff_event_handler(struct wlan_objmgr_psoc *psoc,
+				     struct roam_vendor_handoff_params *data)
+{
+	struct wlan_objmgr_vdev *vdev;
+	struct mlme_legacy_priv *mlme_priv;
+	void *vendor_handoff_context;
+	QDF_STATUS status;
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, data->vdev_id,
+						    WLAN_MLME_OBJMGR_ID);
+	if (!vdev) {
+		mlme_err("vdev object is NULL for vdev %d", data->vdev_id);
+		return;
+	}
+
+	mlme_priv = wlan_vdev_mlme_get_ext_hdl(vdev);
+	if (!mlme_priv)
+		return;
+
+	vendor_handoff_context =
+		mlme_priv->cm_roam.vendor_handoff_param.vendor_handoff_context;
+
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_MLME_OBJMGR_ID);
+
+	status = mlme_cm_osif_get_vendor_handoff_params(psoc,
+							vendor_handoff_context);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		mlme_debug("Failed to free vendor handoff request");
+		return;
+	}
+
+	mlme_debug("Reset vendor handoff req in progress context");
+	mlme_priv->cm_roam.vendor_handoff_param.req_in_progress = false;
+	mlme_priv->cm_roam.vendor_handoff_param.vendor_handoff_context = NULL;
+
+	status = cm_roam_update_vendor_handoff_config(psoc, data);
+	if (QDF_IS_STATUS_ERROR(status))
+		mlme_debug("Failed to update params in rso_config struct");
+}
+#endif
+
 QDF_STATUS
 cm_roam_event_handler(struct roam_offload_roam_event *roam_event)
 {

components/umac/mlme/connection_mgr/dispatcher/src/wlan_cm_roam_ucfg_api.c

@@ -486,4 +486,16 @@ ucfg_cm_roam_send_rt_stats_config(struct wlan_objmgr_pdev *pdev,
 
 	return cm_roam_send_rt_stats_config(psoc, vdev_id, param_value);
 }
+
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+QDF_STATUS
+ucfg_cm_roam_send_vendor_handoff_param_req(struct wlan_objmgr_psoc *psoc,
+					   uint8_t vdev_id,
+					   uint32_t param_id,
+					   void *vendor_handoff_context)
+{
+	return cm_roam_send_vendor_handoff_param_req(psoc, vdev_id, param_id,
+						     vendor_handoff_context);
+}
+#endif
 #endif /* WLAN_FEATURE_ROAM_OFFLOAD */

components/umac/mlme/connection_mgr/dispatcher/src/wlan_cm_tgt_if_tx_api.c

@@ -208,6 +208,41 @@ QDF_STATUS wlan_cm_tgt_send_roam_rt_stats_config(struct wlan_objmgr_psoc *psoc,
 }
 #endif
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+QDF_STATUS
+wlan_cm_tgt_send_roam_vendor_handoff_config(struct wlan_objmgr_psoc *psoc,
+					    struct vendor_handoff_cfg *req)
+{
+	QDF_STATUS status;
+	struct wlan_cm_roam_tx_ops *roam_tx_ops;
+	struct wlan_objmgr_vdev *vdev;
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, req->vdev_id,
+						    WLAN_MLME_NB_ID);
+	if (!vdev)
+		return QDF_STATUS_E_INVAL;
+
+	roam_tx_ops = wlan_cm_roam_get_tx_ops_from_vdev(vdev);
+	if (!roam_tx_ops || !roam_tx_ops->send_roam_vendor_handoff_config) {
+		mlme_err("vdev %d send_roam_vendor_handoff_config is NULL",
+			 req->vdev_id);
+		wlan_objmgr_vdev_release_ref(vdev, WLAN_MLME_NB_ID);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	status = roam_tx_ops->send_roam_vendor_handoff_config(vdev,
+							      req->vdev_id,
+							      req->param_id);
+	if (QDF_IS_STATUS_ERROR(status))
+		mlme_debug("vdev %d fail to send roam vendor handoff config",
+			   req->vdev_id);
+
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_MLME_NB_ID);
+
+	return status;
+}
+#endif
+
 #if defined(WLAN_FEATURE_HOST_ROAM) || defined(WLAN_FEATURE_ROAM_OFFLOAD)
 QDF_STATUS wlan_cm_tgt_send_roam_offload_init(struct wlan_objmgr_psoc *psoc,
 					      uint8_t vdev_id, bool is_init)

components/wmi/inc/wmi_unified_roam_api.h

@@ -100,6 +100,25 @@ QDF_STATUS
 wmi_unified_roam_mawc_params_cmd(wmi_unified_t wmi_handle,
 				 struct wlan_roam_mawc_params *params);
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * wmi_extract_roam_vendor_control_param_event() - extract vendor handoff param
+ * event coming from fw
+ * @wmi_handle: wmi handle
+ * @event: vendor handoff param event pointer
+ * @len: event len
+ * @data: vendor handoff related parameters
+ *
+ * Return: QDF_STATUS_SUCCESS on success and QDF_STATUS_E_FAILURE for failure
+ */
+
+QDF_STATUS
+wmi_extract_roam_vendor_control_param_event(wmi_unified_t wmi_handle,
+				uint8_t *event, uint32_t len,
+				struct roam_vendor_handoff_params **data);
+
+#endif
+
 /**
  * wmi_unified_roam_scan_filter_cmd() - send roam scan allowlist,
  *                                      denylist and preferred list
@@ -219,6 +238,22 @@ QDF_STATUS
 wmi_unified_send_disconnect_roam_params(wmi_unified_t wmi_handle,
 				struct wlan_roam_disconnect_params *req);
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * wmi_unified_roam_vendor_handoff_req_cmd() - Send vendor handoff request
+ * command to fw
+ * @wmi_handle:  wmi handle
+ * @vdev_id: vdev id
+ * @param_id: Vendor Control Param ID from enum
+ * WMI_ROAM_GET_VENDOR_CONTROL_PARAM_ID
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS wmi_unified_roam_vendor_handoff_req_cmd(wmi_unified_t wmi_handle,
+						   uint8_t vdev_id,
+						   uint32_t param_id);
+#endif
+
 /**
  * wmi_unified_send_idle_roam_params() - Send idle roam trigger params to fw
  * @wmi_hdl:  wmi handle

components/wmi/src/wmi_unified_roam_api.c

@@ -133,6 +133,30 @@ QDF_STATUS wmi_unified_roam_synch_complete_cmd(wmi_unified_t wmi_handle,
 	return QDF_STATUS_E_FAILURE;
 }
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+QDF_STATUS
+wmi_unified_roam_vendor_handoff_req_cmd(wmi_unified_t wmi_handle,
+					uint8_t vdev_id, uint32_t param_id)
+{
+	if (wmi_handle->ops->send_process_roam_vendor_handoff_req_cmd)
+	      return wmi_handle->ops->send_process_roam_vendor_handoff_req_cmd(
+				wmi_handle, vdev_id, param_id);
+
+	return QDF_STATUS_E_FAILURE;
+}
+
+QDF_STATUS
+wmi_extract_roam_vendor_control_param_event(wmi_unified_t wmi_handle,
+				uint8_t *event, uint32_t len,
+				struct roam_vendor_handoff_params **data)
+{
+	if (wmi_handle->ops->extract_roam_vendor_control_param_event)
+		return wmi_handle->ops->extract_roam_vendor_control_param_event(
+					wmi_handle, event, len, data);
+	return QDF_STATUS_E_FAILURE;
+}
+#endif
+
 QDF_STATUS wmi_unified_roam_invoke_cmd(wmi_unified_t wmi_handle,
 				       struct roam_invoke_req *roaminvoke)
 {

components/wmi/src/wmi_unified_roam_tlv.c

@@ -314,11 +314,12 @@ static QDF_STATUS send_roam_scan_offload_rssi_thresh_cmd_tlv(
 		       WMITLV_TAG_STRUC_wmi_roam_data_rssi_roaming_param,
 		       WMITLV_GET_STRUCT_TLVLEN
 		       (wmi_roam_data_rssi_roaming_param));
-	wmi_debug("vdev %d Data rssi threshold: %d, triggers: 0x%x, rx time: %d",
+	wmi_debug("vdev %d Data rssi threshold: %d, triggers: 0x%x, rx time: %d, rssi_thresh:%d",
 		  rssi_threshold_fp->vdev_id,
 		  data_rssi_param->roam_data_rssi_thres,
 		  data_rssi_param->flags,
-		  data_rssi_param->rx_inactivity_ms);
+		  data_rssi_param->rx_inactivity_ms,
+		  rssi_threshold_fp->roam_scan_rssi_thresh);
 
 	wmi_mtrace(WMI_ROAM_SCAN_RSSI_THRESHOLD, NO_SESSION, 0);
 	status = wmi_unified_cmd_send(wmi_handle, buf,
@@ -3375,6 +3376,142 @@ extract_roam_candidate_frame_tlv(wmi_unified_t wmi_handle, uint8_t *event,
 	return QDF_STATUS_SUCCESS;
 }
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+static QDF_STATUS
+extract_roam_vendor_control_param_event_tlv(wmi_unified_t wmi_handle,
+				uint8_t *event, uint32_t len,
+				struct roam_vendor_handoff_params **list)
+{
+	WMI_ROAM_GET_VENDOR_CONTROL_PARAM_EVENTID_param_tlvs *param_buf = NULL;
+	wmi_roam_get_vendor_control_param_event_fixed_param *fixed_param = NULL;
+	uint32_t num_entries, i;
+	wmi_vendor_control_param *src_list;
+	struct roam_vendor_handoff_params *dst_list;
+	struct roam_param_info *param_info;
+
+	if (!event || !len) {
+		wmi_debug("Empty roam vendor control param event");
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	param_buf =
+		(WMI_ROAM_GET_VENDOR_CONTROL_PARAM_EVENTID_param_tlvs *)event;
+	if (!param_buf) {
+		wmi_err("received null buf from target");
+		return QDF_STATUS_E_INVAL;
+	}
+
+	fixed_param = (wmi_roam_get_vendor_control_param_event_fixed_param *)
+					param_buf->fixed_param;
+	if (!fixed_param) {
+		wmi_err("received null event data from target");
+		return QDF_STATUS_E_INVAL;
+	}
+
+	if (fixed_param->vdev_id >= WLAN_MAX_VDEVS) {
+		wmi_debug("Invalid VDEV id %d", fixed_param->vdev_id);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	num_entries = param_buf->num_vendor_control_param;
+	src_list = param_buf->vendor_control_param;
+
+	if (len < (sizeof(*fixed_param) + (num_entries * sizeof(*src_list)))) {
+		wmi_err("Invalid length: %d", len);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	dst_list = qdf_mem_malloc(sizeof(struct roam_vendor_handoff_params));
+	if (!dst_list)
+		return QDF_STATUS_E_FAILURE;
+
+	dst_list->vdev_id = fixed_param->vdev_id;
+	wmi_debug("vdev_id:%d, num_tlv:%d", dst_list->vdev_id, num_entries);
+
+	param_info = &dst_list->param_info[0];
+	for (i = 0; i < num_entries; i++) {
+		param_info->param_id = src_list->param_id;
+		param_info->param_value = src_list->param_value;
+		wmi_debug("param_info->param_id:%d, param_info->param_value:%d",
+			  param_info->param_id, param_info->param_value);
+		param_info++;
+		src_list++;
+	}
+
+	dst_list->num_entries = num_entries;
+	*list = dst_list;
+
+	return QDF_STATUS_SUCCESS;
+}
+
+/**
+ * send_process_roam_vendor_handoff_req_cmd_tlv() - Send vendor handoff command
+ * to fw.
+ * @wmi_handle: wmi handle
+ * @vdev_id: vdev id
+ *
+ * Return: QDF STATUS
+ */
+static QDF_STATUS
+send_process_roam_vendor_handoff_req_cmd_tlv(wmi_unified_t wmi_handle,
+					     uint8_t vdev_id,
+					     uint32_t param_id)
+{
+	wmi_roam_get_vendor_control_param_cmd_fixed_param *cmd;
+	wmi_buf_t wmi_buf;
+	uint8_t *buf_ptr;
+	uint16_t len;
+
+	len = sizeof(wmi_roam_get_vendor_control_param_cmd_fixed_param);
+
+	wmi_buf = wmi_buf_alloc(wmi_handle, len);
+	if (!wmi_buf)
+		return QDF_STATUS_E_NOMEM;
+
+	cmd = (wmi_roam_get_vendor_control_param_cmd_fixed_param *)wmi_buf_data(
+								wmi_buf);
+	buf_ptr = (uint8_t *)cmd;
+	WMITLV_SET_HDR(&cmd->tlv_header,
+	     WMITLV_TAG_STRUC_wmi_roam_get_vendor_control_param_cmd_fixed_param,
+	     WMITLV_GET_STRUCT_TLVLEN
+		       (wmi_roam_get_vendor_control_param_cmd_fixed_param));
+	cmd->vdev_id = vdev_id;
+	cmd->param_id = param_id;
+	wmi_debug("Send GET_VENDOR_CONTROL_PARAM cmd vdev_id:%d, param_id:0x%x",
+		cmd->vdev_id, cmd->param_id);
+	wmi_mtrace(WMI_ROAM_GET_VENDOR_CONTROL_PARAM_CMDID, cmd->vdev_id, 0);
+	if (wmi_unified_cmd_send(wmi_handle, wmi_buf, len,
+				 WMI_ROAM_GET_VENDOR_CONTROL_PARAM_CMDID)) {
+		wmi_err("Failed to send get vendor control param command");
+		wmi_buf_free(wmi_buf);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+
+/**
+ * wmi_roam_offload_attach_vendor_handoff_tlv() - register wmi ops for vendor
+ * handoff related command and event
+ * @ops: wmi ops
+ *
+ * Return: none
+ */
+static inline void
+wmi_roam_offload_attach_vendor_handoff_tlv(struct wmi_ops *ops)
+{
+	ops->extract_roam_vendor_control_param_event =
+				extract_roam_vendor_control_param_event_tlv;
+	ops->send_process_roam_vendor_handoff_req_cmd =
+			send_process_roam_vendor_handoff_req_cmd_tlv;
+}
+#else
+static inline void
+wmi_roam_offload_attach_vendor_handoff_tlv(struct wmi_ops *ops)
+{
+}
+#endif
+
 void wmi_roam_offload_attach_tlv(wmi_unified_t wmi_handle)
 {
 	struct wmi_ops *ops = wmi_handle->ops;
@@ -3400,6 +3537,7 @@ void wmi_roam_offload_attach_tlv(wmi_unified_t wmi_handle)
 	ops->send_vdev_set_pcl_cmd = send_vdev_set_pcl_cmd_tlv;
 	ops->send_set_roam_trigger_cmd = send_set_roam_trigger_cmd_tlv;
 	ops->extract_roam_candidate_frame = extract_roam_candidate_frame_tlv;
+	wmi_roam_offload_attach_vendor_handoff_tlv(ops);
 }
 #else
 static inline QDF_STATUS
@@ -4099,8 +4237,9 @@ wmi_fill_rso_start_scan_tlv(struct wlan_roam_scan_offload_params *rso_req,
 		scan_tlv->scan_ctrl_flags_ext |=
 			WMI_SCAN_DBS_POLICY_DEFAULT;
 
-	wmi_debug("RSO_CFG: dwell time: active %d passive %d, active 6g %d passive 6g %d, minrest %d max rest %d repeat probe time %d probe_spacing:%d",
+	wmi_debug("RSO_CFG: dwell time: active %d passive %d, burst_duration:%d, active 6g %d passive 6g %d, min_rest_time %d max rest %d repeat probe time %d probe_spacing:%d",
 		  scan_tlv->dwell_time_active, scan_tlv->dwell_time_passive,
+		  scan_tlv->burst_duration,
 		  scan_tlv->dwell_time_active_6ghz,
 		  scan_tlv->dwell_time_passive_6ghz,
 		  scan_tlv->min_rest_time, scan_tlv->max_rest_time,

core/hdd/src/wlan_hdd_assoc.c

@@ -2492,6 +2492,9 @@ struct osif_cm_ops osif_ops = {
 	.cckm_preauth_complete_cb = hdd_cm_cckm_preauth_complete,
 #endif
 #endif
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+	.vendor_handoff_params_cb = hdd_cm_get_vendor_handoff_params,
+#endif
 };
 
 QDF_STATUS hdd_cm_register_cb(void)

core/hdd/src/wlan_hdd_cfg80211.c

@@ -5363,8 +5363,15 @@ hdd_set_roam_with_control_config(struct hdd_context *hdd_ctx,
 	struct wlan_cm_roam_vendor_btm_params param = {0};
 	bool is_wtc_param_updated = false;
 	uint32_t band_mask;
+	struct hdd_adapter *adapter;
+	uint8_t roam_control_enable = false;
 
 	hdd_enter();
+
+	adapter = hdd_get_adapter_by_vdev(hdd_ctx, vdev_id);
+	if (hdd_validate_adapter(adapter))
+		return QDF_STATUS_E_FAILURE;
+
 	/* The command must carry PARAM_ROAM_CONTROL_CONFIG */
 	if (!tb[PARAM_ROAM_CONTROL_CONFIG]) {
 		hdd_err("Attribute CONTROL_CONFIG is not present");
@@ -5399,15 +5406,27 @@ hdd_set_roam_with_control_config(struct hdd_context *hdd_ctx,
 
 	attr = tb2[QCA_ATTR_ROAM_CONTROL_ENABLE];
 	if (attr) {
+		roam_control_enable = nla_get_u8(attr);
+		if (roam_control_enable) {
+			status =
+				hdd_cm_get_handoff_param(hdd_ctx->psoc, adapter,
+						adapter->vdev_id,
+						ROAM_VENDOR_CONTROL_PARAM_ALL);
+			if (QDF_IS_STATUS_ERROR(status)) {
+				hdd_err("failed to get vendor handoff params");
+				return qdf_status_to_os_return(status);
+			}
+		}
+
+		hdd_debug("Parse and send roam control to FW: %s",
+			  roam_control_enable ? "Enable" : "Disable");
+
 		status = sme_set_roam_config_enable(hdd_ctx->mac_handle,
 						    vdev_id,
-						    nla_get_u8(attr));
+						    roam_control_enable);
 		if (QDF_IS_STATUS_ERROR(status))
 			hdd_err("failed to enable/disable roam control config");
 
-		hdd_debug("Parse and send roam control %s:",
-			  nla_get_u8(attr) ? "Enable" : "Disable");
-
 		attr = tb2[QCA_ATTR_ROAM_CONTROL_SCAN_PERIOD];
 		if (attr) {
 			/* Default value received as part of Roam control enable

core/hdd/src/wlan_hdd_cm_api.h

@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -83,6 +84,41 @@ QDF_STATUS hdd_cm_netif_queue_control(struct wlan_objmgr_vdev *vdev,
 QDF_STATUS hdd_cm_connect_complete(struct wlan_objmgr_vdev *vdev,
 				   struct wlan_cm_connect_resp *rsp,
 				   enum osif_cb_type type);
+
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+/**
+ * hdd_cm_get_vendor_handoff_params() - to get vendor handoff params from fw
+ * @psoc: Pointer to psoc object
+ * @event_data: Pointer to vendor handoff event rsp
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS
+hdd_cm_get_vendor_handoff_params(struct wlan_objmgr_psoc *psoc,
+				 void *vendor_handoff_context);
+
+/**
+ * hdd_cm_get_handoff_param() - send get vendor handoff param request to fw
+ * @pdev: pdev common object
+ * @hdd_adapter: adapter context
+ * @vdev_id: vdev id
+ * @param_id: Param ID from enum WMI_ROAM_GET_VENDOR_CONTROL_PARAM_ID
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS hdd_cm_get_handoff_param(struct wlan_objmgr_psoc *psoc,
+				    struct hdd_adapter *hdd_adapter,
+				    uint8_t vdev_id, uint32_t param_id);
+#else
+static inline QDF_STATUS
+hdd_cm_get_handoff_param(struct wlan_objmgr_psoc *psoc,
+			 struct hdd_adapter *hdd_adapter,
+			 uint8_t vdev_id, uint32_t param_value)
+{
+	return QDF_STATUS_E_FAILURE;
+}
+#endif
+
 /**
  * hdd_cm_napi_serialize_control() - NAPI serialize hdd cb
  * @action: serialize or de-serialize NAPI activities

core/hdd/src/wlan_hdd_cm_connect.c

@@ -53,6 +53,7 @@
 #include <wlan_twt_ucfg_ext_api.h>
 #include <osif_twt_internal.h>
 #include "wlan_osif_features.h"
+#include "wlan_osif_request_manager.h"
 
 bool hdd_cm_is_vdev_associated(struct hdd_adapter *adapter)
 {
@@ -1381,6 +1382,75 @@ QDF_STATUS hdd_cm_connect_complete(struct wlan_objmgr_vdev *vdev,
 	return QDF_STATUS_SUCCESS;
 }
 
+#ifdef WLAN_VENDOR_HANDOFF_CONTROL
+#define WLAN_WAIT_TIME_HANDOFF_PARAMS 1000
+
+QDF_STATUS hdd_cm_get_handoff_param(struct wlan_objmgr_psoc *psoc,
+				    struct hdd_adapter *adapter,
+				    uint8_t vdev_id, uint32_t param_id)
+{
+	QDF_STATUS status;
+	int retval;
+	void *vendor_handoff_context;
+	struct osif_request *request;
+	static const struct osif_request_params params = {
+		.priv_size = 0,
+		.timeout_ms = WLAN_WAIT_TIME_HANDOFF_PARAMS,
+	};
+
+	request = osif_request_alloc(&params);
+	if (!request) {
+		hdd_err("Request allocation failure");
+		status = QDF_STATUS_E_NOMEM;
+		goto error;
+	}
+
+	vendor_handoff_context = osif_request_cookie(request);
+
+	hdd_debug("sending vendor handoff param request for :0x%x", param_id);
+	status = ucfg_cm_roam_send_vendor_handoff_param_req(psoc, vdev_id,
+							param_id,
+							vendor_handoff_context);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		hdd_err("Unable to get vendor handoff param");
+		goto error;
+	}
+
+	retval = osif_request_wait_for_response(request);
+	if (retval) {
+		hdd_err("Target response timed out");
+		status = qdf_status_from_os_return(retval);
+	}
+error:
+	if (request)
+		osif_request_put(request);
+
+	return status;
+}
+
+QDF_STATUS
+hdd_cm_get_vendor_handoff_params(struct wlan_objmgr_psoc *psoc,
+				 void *vendor_handoff_context)
+{
+	struct osif_request *request;
+
+	hdd_debug("Received vendor handoff event from FW");
+
+	request = osif_request_get(vendor_handoff_context);
+	if (!request) {
+		hdd_err("Invalid request");
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	osif_request_complete(request);
+	osif_request_put(request);
+
+	hdd_exit();
+
+	return QDF_STATUS_SUCCESS;
+}
+#endif
+
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 #ifdef WLAN_FEATURE_FILS_SK
 QDF_STATUS hdd_cm_save_gtk(struct wlan_objmgr_vdev *vdev,