1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
9  * Copyright(c) 2017 Intel Deutschland GmbH
10  * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
11  *
12  * This program is free software; you can redistribute it and/or modify
13  * it under the terms of version 2 of the GNU General Public License as
14  * published by the Free Software Foundation.
15  *
16  * This program is distributed in the hope that it will be useful, but
17  * WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19  * General Public License for more details.
20  *
21  * The full GNU General Public License is included in this distribution
22  * in the file called COPYING.
23  *
24  * Contact Information:
25  *  Intel Linux Wireless <linuxwifi@intel.com>
26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
27  *
28  * BSD LICENSE
29  *
30  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
31  * Copyright(c) 2017 Intel Deutschland GmbH
32  * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
33  * All rights reserved.
34  *
35  * Redistribution and use in source and binary forms, with or without
36  * modification, are permitted provided that the following conditions
37  * are met:
38  *
39  *  * Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  *  * Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in
43  *    the documentation and/or other materials provided with the
44  *    distribution.
45  *  * Neither the name Intel Corporation nor the names of its
46  *    contributors may be used to endorse or promote products derived
47  *    from this software without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
50  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
51  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
52  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
53  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
54  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
55  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
56  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
57  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
58  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
59  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
60  *
61  *****************************************************************************/
62 
63 #include <linux/jiffies.h>
64 #include <net/mac80211.h>
65 
66 #include "fw/notif-wait.h"
67 #include "iwl-trans.h"
68 #include "fw-api.h"
69 #include "time-event.h"
70 #include "mvm.h"
71 #include "iwl-io.h"
72 #include "iwl-prph.h"
73 
74 /*
75  * For the high priority TE use a time event type that has similar priority to
76  * the FW's action scan priority.
77  */
78 #define IWL_MVM_ROC_TE_TYPE_NORMAL TE_P2P_DEVICE_DISCOVERABLE
79 #define IWL_MVM_ROC_TE_TYPE_MGMT_TX TE_P2P_CLIENT_ASSOC
80 
81 void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
82 			   struct iwl_mvm_time_event_data *te_data)
83 {
84 	lockdep_assert_held(&mvm->time_event_lock);
85 
86 	if (!te_data || !te_data->vif)
87 		return;
88 
89 	list_del(&te_data->list);
90 	te_data->running = false;
91 	te_data->uid = 0;
92 	te_data->id = TE_MAX;
93 	te_data->vif = NULL;
94 }
95 
96 void iwl_mvm_roc_done_wk(struct work_struct *wk)
97 {
98 	struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, roc_done_wk);
99 
100 	/*
101 	 * Clear the ROC_RUNNING /ROC_AUX_RUNNING status bit.
102 	 * This will cause the TX path to drop offchannel transmissions.
103 	 * That would also be done by mac80211, but it is racy, in particular
104 	 * in the case that the time event actually completed in the firmware
105 	 * (which is handled in iwl_mvm_te_handle_notif).
106 	 */
107 	clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
108 	clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
109 
110 	synchronize_net();
111 
112 	/*
113 	 * Flush the offchannel queue -- this is called when the time
114 	 * event finishes or is canceled, so that frames queued for it
115 	 * won't get stuck on the queue and be transmitted in the next
116 	 * time event.
117 	 */
118 
119 	mutex_lock(&mvm->mutex);
120 	if (test_and_clear_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status)) {
121 		struct iwl_mvm_vif *mvmvif;
122 
123 		/*
124 		 * NB: access to this pointer would be racy, but the flush bit
125 		 * can only be set when we had a P2P-Device VIF, and we have a
126 		 * flush of this work in iwl_mvm_prepare_mac_removal() so it's
127 		 * not really racy.
128 		 */
129 
130 		if (!WARN_ON(!mvm->p2p_device_vif)) {
131 			mvmvif = iwl_mvm_vif_from_mac80211(mvm->p2p_device_vif);
132 			iwl_mvm_flush_sta(mvm, &mvmvif->bcast_sta, true);
133 		}
134 	} else {
135 		/* do the same in case of hot spot 2.0 */
136 		iwl_mvm_flush_sta(mvm, &mvm->aux_sta, true);
137 		/* In newer version of this command an aux station is added only
138 		 * in cases of dedicated tx queue and need to be removed in end
139 		 * of use */
140 		if (iwl_fw_lookup_cmd_ver(mvm->fw, LONG_GROUP,
141 					  ADD_STA, 0) >= 12)
142 			iwl_mvm_rm_aux_sta(mvm);
143 	}
144 
145 	mutex_unlock(&mvm->mutex);
146 }
147 
148 static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
149 {
150 	/*
151 	 * Of course, our status bit is just as racy as mac80211, so in
152 	 * addition, fire off the work struct which will drop all frames
153 	 * from the hardware queues that made it through the race. First
154 	 * it will of course synchronize the TX path to make sure that
155 	 * any *new* TX will be rejected.
156 	 */
157 	schedule_work(&mvm->roc_done_wk);
158 }
159 
160 static void iwl_mvm_csa_noa_start(struct iwl_mvm *mvm)
161 {
162 	struct ieee80211_vif *csa_vif;
163 
164 	rcu_read_lock();
165 
166 	csa_vif = rcu_dereference(mvm->csa_vif);
167 	if (!csa_vif || !csa_vif->csa_active)
168 		goto out_unlock;
169 
170 	IWL_DEBUG_TE(mvm, "CSA NOA started\n");
171 
172 	/*
173 	 * CSA NoA is started but we still have beacons to
174 	 * transmit on the current channel.
175 	 * So we just do nothing here and the switch
176 	 * will be performed on the last TBTT.
177 	 */
178 	if (!ieee80211_beacon_cntdwn_is_complete(csa_vif)) {
179 		IWL_WARN(mvm, "CSA NOA started too early\n");
180 		goto out_unlock;
181 	}
182 
183 	ieee80211_csa_finish(csa_vif);
184 
185 	rcu_read_unlock();
186 
187 	RCU_INIT_POINTER(mvm->csa_vif, NULL);
188 
189 	return;
190 
191 out_unlock:
192 	rcu_read_unlock();
193 }
194 
195 static bool iwl_mvm_te_check_disconnect(struct iwl_mvm *mvm,
196 					struct ieee80211_vif *vif,
197 					const char *errmsg)
198 {
199 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
200 
201 	if (vif->type != NL80211_IFTYPE_STATION)
202 		return false;
203 
204 	if (!mvmvif->csa_bcn_pending && vif->bss_conf.assoc &&
205 	    vif->bss_conf.dtim_period)
206 		return false;
207 	if (errmsg)
208 		IWL_ERR(mvm, "%s\n", errmsg);
209 
210 	iwl_mvm_connection_loss(mvm, vif, errmsg);
211 	return true;
212 }
213 
214 static void
215 iwl_mvm_te_handle_notify_csa(struct iwl_mvm *mvm,
216 			     struct iwl_mvm_time_event_data *te_data,
217 			     struct iwl_time_event_notif *notif)
218 {
219 	struct ieee80211_vif *vif = te_data->vif;
220 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
221 
222 	if (!notif->status)
223 		IWL_DEBUG_TE(mvm, "CSA time event failed to start\n");
224 
225 	switch (te_data->vif->type) {
226 	case NL80211_IFTYPE_AP:
227 		if (!notif->status)
228 			mvmvif->csa_failed = true;
229 		iwl_mvm_csa_noa_start(mvm);
230 		break;
231 	case NL80211_IFTYPE_STATION:
232 		if (!notif->status) {
233 			iwl_mvm_connection_loss(mvm, vif,
234 						"CSA TE failed to start");
235 			break;
236 		}
237 		iwl_mvm_csa_client_absent(mvm, te_data->vif);
238 		cancel_delayed_work(&mvmvif->csa_work);
239 		ieee80211_chswitch_done(te_data->vif, true);
240 		break;
241 	default:
242 		/* should never happen */
243 		WARN_ON_ONCE(1);
244 		break;
245 	}
246 
247 	/* we don't need it anymore */
248 	iwl_mvm_te_clear_data(mvm, te_data);
249 }
250 
251 static void iwl_mvm_te_check_trigger(struct iwl_mvm *mvm,
252 				     struct iwl_time_event_notif *notif,
253 				     struct iwl_mvm_time_event_data *te_data)
254 {
255 	struct iwl_fw_dbg_trigger_tlv *trig;
256 	struct iwl_fw_dbg_trigger_time_event *te_trig;
257 	int i;
258 
259 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt,
260 				     ieee80211_vif_to_wdev(te_data->vif),
261 				     FW_DBG_TRIGGER_TIME_EVENT);
262 	if (!trig)
263 		return;
264 
265 	te_trig = (void *)trig->data;
266 
267 	for (i = 0; i < ARRAY_SIZE(te_trig->time_events); i++) {
268 		u32 trig_te_id = le32_to_cpu(te_trig->time_events[i].id);
269 		u32 trig_action_bitmap =
270 			le32_to_cpu(te_trig->time_events[i].action_bitmap);
271 		u32 trig_status_bitmap =
272 			le32_to_cpu(te_trig->time_events[i].status_bitmap);
273 
274 		if (trig_te_id != te_data->id ||
275 		    !(trig_action_bitmap & le32_to_cpu(notif->action)) ||
276 		    !(trig_status_bitmap & BIT(le32_to_cpu(notif->status))))
277 			continue;
278 
279 		iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
280 					"Time event %d Action 0x%x received status: %d",
281 					te_data->id,
282 					le32_to_cpu(notif->action),
283 					le32_to_cpu(notif->status));
284 		break;
285 	}
286 }
287 
288 /*
289  * Handles a FW notification for an event that is known to the driver.
290  *
291  * @mvm: the mvm component
292  * @te_data: the time event data
293  * @notif: the notification data corresponding the time event data.
294  */
295 static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
296 				    struct iwl_mvm_time_event_data *te_data,
297 				    struct iwl_time_event_notif *notif)
298 {
299 	lockdep_assert_held(&mvm->time_event_lock);
300 
301 	IWL_DEBUG_TE(mvm, "Handle time event notif - UID = 0x%x action %d\n",
302 		     le32_to_cpu(notif->unique_id),
303 		     le32_to_cpu(notif->action));
304 
305 	iwl_mvm_te_check_trigger(mvm, notif, te_data);
306 
307 	/*
308 	 * The FW sends the start/end time event notifications even for events
309 	 * that it fails to schedule. This is indicated in the status field of
310 	 * the notification. This happens in cases that the scheduler cannot
311 	 * find a schedule that can handle the event (for example requesting a
312 	 * P2P Device discoveribility, while there are other higher priority
313 	 * events in the system).
314 	 */
315 	if (!le32_to_cpu(notif->status)) {
316 		const char *msg;
317 
318 		if (notif->action & cpu_to_le32(TE_V2_NOTIF_HOST_EVENT_START))
319 			msg = "Time Event start notification failure";
320 		else
321 			msg = "Time Event end notification failure";
322 
323 		IWL_DEBUG_TE(mvm, "%s\n", msg);
324 
325 		if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, msg)) {
326 			iwl_mvm_te_clear_data(mvm, te_data);
327 			return;
328 		}
329 	}
330 
331 	if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_END) {
332 		IWL_DEBUG_TE(mvm,
333 			     "TE ended - current time %lu, estimated end %lu\n",
334 			     jiffies, te_data->end_jiffies);
335 
336 		switch (te_data->vif->type) {
337 		case NL80211_IFTYPE_P2P_DEVICE:
338 			ieee80211_remain_on_channel_expired(mvm->hw);
339 			set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
340 			iwl_mvm_roc_finished(mvm);
341 			break;
342 		case NL80211_IFTYPE_STATION:
343 			/*
344 			 * By now, we should have finished association
345 			 * and know the dtim period.
346 			 */
347 			iwl_mvm_te_check_disconnect(mvm, te_data->vif,
348 				!te_data->vif->bss_conf.assoc ?
349 				"Not associated and the time event is over already..." :
350 				"No beacon heard and the time event is over already...");
351 			break;
352 		default:
353 			break;
354 		}
355 
356 		iwl_mvm_te_clear_data(mvm, te_data);
357 	} else if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_START) {
358 		te_data->running = true;
359 		te_data->end_jiffies = TU_TO_EXP_TIME(te_data->duration);
360 
361 		if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
362 			set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
363 			ieee80211_ready_on_channel(mvm->hw);
364 		} else if (te_data->id == TE_CHANNEL_SWITCH_PERIOD) {
365 			iwl_mvm_te_handle_notify_csa(mvm, te_data, notif);
366 		}
367 	} else {
368 		IWL_WARN(mvm, "Got TE with unknown action\n");
369 	}
370 }
371 
372 /*
373  * Handle A Aux ROC time event
374  */
375 static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,
376 					   struct iwl_time_event_notif *notif)
377 {
378 	struct iwl_mvm_time_event_data *te_data, *tmp;
379 	bool aux_roc_te = false;
380 
381 	list_for_each_entry_safe(te_data, tmp, &mvm->aux_roc_te_list, list) {
382 		if (le32_to_cpu(notif->unique_id) == te_data->uid) {
383 			aux_roc_te = true;
384 			break;
385 		}
386 	}
387 	if (!aux_roc_te) /* Not a Aux ROC time event */
388 		return -EINVAL;
389 
390 	iwl_mvm_te_check_trigger(mvm, notif, te_data);
391 
392 	IWL_DEBUG_TE(mvm,
393 		     "Aux ROC time event notification  - UID = 0x%x action %d (error = %d)\n",
394 		     le32_to_cpu(notif->unique_id),
395 		     le32_to_cpu(notif->action), le32_to_cpu(notif->status));
396 
397 	if (!le32_to_cpu(notif->status) ||
398 	    le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_END) {
399 		/* End TE, notify mac80211 */
400 		ieee80211_remain_on_channel_expired(mvm->hw);
401 		iwl_mvm_roc_finished(mvm); /* flush aux queue */
402 		list_del(&te_data->list); /* remove from list */
403 		te_data->running = false;
404 		te_data->vif = NULL;
405 		te_data->uid = 0;
406 		te_data->id = TE_MAX;
407 	} else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
408 		set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
409 		te_data->running = true;
410 		ieee80211_ready_on_channel(mvm->hw); /* Start TE */
411 	} else {
412 		IWL_DEBUG_TE(mvm,
413 			     "ERROR: Unknown Aux ROC Time Event (action = %d)\n",
414 			     le32_to_cpu(notif->action));
415 		return -EINVAL;
416 	}
417 
418 	return 0;
419 }
420 
421 /*
422  * The Rx handler for time event notifications
423  */
424 void iwl_mvm_rx_time_event_notif(struct iwl_mvm *mvm,
425 				 struct iwl_rx_cmd_buffer *rxb)
426 {
427 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
428 	struct iwl_time_event_notif *notif = (void *)pkt->data;
429 	struct iwl_mvm_time_event_data *te_data, *tmp;
430 
431 	IWL_DEBUG_TE(mvm, "Time event notification - UID = 0x%x action %d\n",
432 		     le32_to_cpu(notif->unique_id),
433 		     le32_to_cpu(notif->action));
434 
435 	spin_lock_bh(&mvm->time_event_lock);
436 	/* This time event is triggered for Aux ROC request */
437 	if (!iwl_mvm_aux_roc_te_handle_notif(mvm, notif))
438 		goto unlock;
439 
440 	list_for_each_entry_safe(te_data, tmp, &mvm->time_event_list, list) {
441 		if (le32_to_cpu(notif->unique_id) == te_data->uid)
442 			iwl_mvm_te_handle_notif(mvm, te_data, notif);
443 	}
444 unlock:
445 	spin_unlock_bh(&mvm->time_event_lock);
446 }
447 
448 static bool iwl_mvm_te_notif(struct iwl_notif_wait_data *notif_wait,
449 			     struct iwl_rx_packet *pkt, void *data)
450 {
451 	struct iwl_mvm *mvm =
452 		container_of(notif_wait, struct iwl_mvm, notif_wait);
453 	struct iwl_mvm_time_event_data *te_data = data;
454 	struct iwl_time_event_notif *resp;
455 	int resp_len = iwl_rx_packet_payload_len(pkt);
456 
457 	if (WARN_ON(pkt->hdr.cmd != TIME_EVENT_NOTIFICATION))
458 		return true;
459 
460 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
461 		IWL_ERR(mvm, "Invalid TIME_EVENT_NOTIFICATION response\n");
462 		return true;
463 	}
464 
465 	resp = (void *)pkt->data;
466 
467 	/* te_data->uid is already set in the TIME_EVENT_CMD response */
468 	if (le32_to_cpu(resp->unique_id) != te_data->uid)
469 		return false;
470 
471 	IWL_DEBUG_TE(mvm, "TIME_EVENT_NOTIFICATION response - UID = 0x%x\n",
472 		     te_data->uid);
473 	if (!resp->status)
474 		IWL_ERR(mvm,
475 			"TIME_EVENT_NOTIFICATION received but not executed\n");
476 
477 	return true;
478 }
479 
480 static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
481 					struct iwl_rx_packet *pkt, void *data)
482 {
483 	struct iwl_mvm *mvm =
484 		container_of(notif_wait, struct iwl_mvm, notif_wait);
485 	struct iwl_mvm_time_event_data *te_data = data;
486 	struct iwl_time_event_resp *resp;
487 	int resp_len = iwl_rx_packet_payload_len(pkt);
488 
489 	if (WARN_ON(pkt->hdr.cmd != TIME_EVENT_CMD))
490 		return true;
491 
492 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
493 		IWL_ERR(mvm, "Invalid TIME_EVENT_CMD response\n");
494 		return true;
495 	}
496 
497 	resp = (void *)pkt->data;
498 
499 	/* we should never get a response to another TIME_EVENT_CMD here */
500 	if (WARN_ON_ONCE(le32_to_cpu(resp->id) != te_data->id))
501 		return false;
502 
503 	te_data->uid = le32_to_cpu(resp->unique_id);
504 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
505 		     te_data->uid);
506 	return true;
507 }
508 
509 static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
510 				       struct ieee80211_vif *vif,
511 				       struct iwl_mvm_time_event_data *te_data,
512 				       struct iwl_time_event_cmd *te_cmd)
513 {
514 	static const u16 time_event_response[] = { TIME_EVENT_CMD };
515 	struct iwl_notification_wait wait_time_event;
516 	int ret;
517 
518 	lockdep_assert_held(&mvm->mutex);
519 
520 	IWL_DEBUG_TE(mvm, "Add new TE, duration %d TU\n",
521 		     le32_to_cpu(te_cmd->duration));
522 
523 	spin_lock_bh(&mvm->time_event_lock);
524 	if (WARN_ON(te_data->id != TE_MAX)) {
525 		spin_unlock_bh(&mvm->time_event_lock);
526 		return -EIO;
527 	}
528 	te_data->vif = vif;
529 	te_data->duration = le32_to_cpu(te_cmd->duration);
530 	te_data->id = le32_to_cpu(te_cmd->id);
531 	list_add_tail(&te_data->list, &mvm->time_event_list);
532 	spin_unlock_bh(&mvm->time_event_lock);
533 
534 	/*
535 	 * Use a notification wait, which really just processes the
536 	 * command response and doesn't wait for anything, in order
537 	 * to be able to process the response and get the UID inside
538 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
539 	 * stores the buffer and then wakes up this thread, by which
540 	 * time another notification (that the time event started)
541 	 * might already be processed unsuccessfully.
542 	 */
543 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
544 				   time_event_response,
545 				   ARRAY_SIZE(time_event_response),
546 				   iwl_mvm_time_event_response, te_data);
547 
548 	ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
549 					    sizeof(*te_cmd), te_cmd);
550 	if (ret) {
551 		IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
552 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
553 		goto out_clear_te;
554 	}
555 
556 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
557 	ret = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
558 	/* should never fail */
559 	WARN_ON_ONCE(ret);
560 
561 	if (ret) {
562  out_clear_te:
563 		spin_lock_bh(&mvm->time_event_lock);
564 		iwl_mvm_te_clear_data(mvm, te_data);
565 		spin_unlock_bh(&mvm->time_event_lock);
566 	}
567 	return ret;
568 }
569 
570 void iwl_mvm_protect_session(struct iwl_mvm *mvm,
571 			     struct ieee80211_vif *vif,
572 			     u32 duration, u32 min_duration,
573 			     u32 max_delay, bool wait_for_notif)
574 {
575 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
576 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
577 	const u16 te_notif_response[] = { TIME_EVENT_NOTIFICATION };
578 	struct iwl_notification_wait wait_te_notif;
579 	struct iwl_time_event_cmd time_cmd = {};
580 
581 	lockdep_assert_held(&mvm->mutex);
582 
583 	if (te_data->running &&
584 	    time_after(te_data->end_jiffies, TU_TO_EXP_TIME(min_duration))) {
585 		IWL_DEBUG_TE(mvm, "We have enough time in the current TE: %u\n",
586 			     jiffies_to_msecs(te_data->end_jiffies - jiffies));
587 		return;
588 	}
589 
590 	if (te_data->running) {
591 		IWL_DEBUG_TE(mvm, "extend 0x%x: only %u ms left\n",
592 			     te_data->uid,
593 			     jiffies_to_msecs(te_data->end_jiffies - jiffies));
594 		/*
595 		 * we don't have enough time
596 		 * cancel the current TE and issue a new one
597 		 * Of course it would be better to remove the old one only
598 		 * when the new one is added, but we don't care if we are off
599 		 * channel for a bit. All we need to do, is not to return
600 		 * before we actually begin to be on the channel.
601 		 */
602 		iwl_mvm_stop_session_protection(mvm, vif);
603 	}
604 
605 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
606 	time_cmd.id_and_color =
607 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
608 	time_cmd.id = cpu_to_le32(TE_BSS_STA_AGGRESSIVE_ASSOC);
609 
610 	time_cmd.apply_time = cpu_to_le32(0);
611 
612 	time_cmd.max_frags = TE_V2_FRAG_NONE;
613 	time_cmd.max_delay = cpu_to_le32(max_delay);
614 	/* TODO: why do we need to interval = bi if it is not periodic? */
615 	time_cmd.interval = cpu_to_le32(1);
616 	time_cmd.duration = cpu_to_le32(duration);
617 	time_cmd.repeat = 1;
618 	time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
619 				      TE_V2_NOTIF_HOST_EVENT_END |
620 				      TE_V2_START_IMMEDIATELY);
621 
622 	if (!wait_for_notif) {
623 		iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
624 		return;
625 	}
626 
627 	/*
628 	 * Create notification_wait for the TIME_EVENT_NOTIFICATION to use
629 	 * right after we send the time event
630 	 */
631 	iwl_init_notification_wait(&mvm->notif_wait, &wait_te_notif,
632 				   te_notif_response,
633 				   ARRAY_SIZE(te_notif_response),
634 				   iwl_mvm_te_notif, te_data);
635 
636 	/* If TE was sent OK - wait for the notification that started */
637 	if (iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd)) {
638 		IWL_ERR(mvm, "Failed to add TE to protect session\n");
639 		iwl_remove_notification(&mvm->notif_wait, &wait_te_notif);
640 	} else if (iwl_wait_notification(&mvm->notif_wait, &wait_te_notif,
641 					 TU_TO_JIFFIES(max_delay))) {
642 		IWL_ERR(mvm, "Failed to protect session until TE\n");
643 	}
644 }
645 
646 static void iwl_mvm_cancel_session_protection(struct iwl_mvm *mvm,
647 					      struct iwl_mvm_vif *mvmvif)
648 {
649 	struct iwl_mvm_session_prot_cmd cmd = {
650 		.id_and_color =
651 			cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
652 							mvmvif->color)),
653 		.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
654 		.conf_id = cpu_to_le32(mvmvif->time_event_data.id),
655 	};
656 	int ret;
657 
658 	ret = iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD,
659 						   MAC_CONF_GROUP, 0),
660 				   0, sizeof(cmd), &cmd);
661 	if (ret)
662 		IWL_ERR(mvm,
663 			"Couldn't send the SESSION_PROTECTION_CMD: %d\n", ret);
664 }
665 
666 static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
667 					struct iwl_mvm_time_event_data *te_data,
668 					u32 *uid)
669 {
670 	u32 id;
671 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
672 
673 	/*
674 	 * It is possible that by the time we got to this point the time
675 	 * event was already removed.
676 	 */
677 	spin_lock_bh(&mvm->time_event_lock);
678 
679 	/* Save time event uid before clearing its data */
680 	*uid = te_data->uid;
681 	id = te_data->id;
682 
683 	/*
684 	 * The clear_data function handles time events that were already removed
685 	 */
686 	iwl_mvm_te_clear_data(mvm, te_data);
687 	spin_unlock_bh(&mvm->time_event_lock);
688 
689 	/* When session protection is supported, the te_data->id field
690 	 * is reused to save session protection's configuration.
691 	 */
692 	if (fw_has_capa(&mvm->fw->ucode_capa,
693 			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
694 		if (mvmvif && id < SESSION_PROTECT_CONF_MAX_ID) {
695 			/* Session protection is still ongoing. Cancel it */
696 			iwl_mvm_cancel_session_protection(mvm, mvmvif);
697 			if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
698 				set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
699 				iwl_mvm_roc_finished(mvm);
700 			}
701 		}
702 		return false;
703 	} else {
704 		/* It is possible that by the time we try to remove it, the
705 		 * time event has already ended and removed. In such a case
706 		 * there is no need to send a removal command.
707 		 */
708 		if (id == TE_MAX) {
709 			IWL_DEBUG_TE(mvm, "TE 0x%x has already ended\n", *uid);
710 			return false;
711 		}
712 	}
713 
714 	return true;
715 }
716 
717 /*
718  * Explicit request to remove a aux roc time event. The removal of a time
719  * event needs to be synchronized with the flow of a time event's end
720  * notification, which also removes the time event from the op mode
721  * data structures.
722  */
723 static void iwl_mvm_remove_aux_roc_te(struct iwl_mvm *mvm,
724 				      struct iwl_mvm_vif *mvmvif,
725 				      struct iwl_mvm_time_event_data *te_data)
726 {
727 	struct iwl_hs20_roc_req aux_cmd = {};
728 	u16 len = sizeof(aux_cmd) - iwl_mvm_chan_info_padding(mvm);
729 
730 	u32 uid;
731 	int ret;
732 
733 	if (!__iwl_mvm_remove_time_event(mvm, te_data, &uid))
734 		return;
735 
736 	aux_cmd.event_unique_id = cpu_to_le32(uid);
737 	aux_cmd.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE);
738 	aux_cmd.id_and_color =
739 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
740 	IWL_DEBUG_TE(mvm, "Removing BSS AUX ROC TE 0x%x\n",
741 		     le32_to_cpu(aux_cmd.event_unique_id));
742 	ret = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0,
743 				   len, &aux_cmd);
744 
745 	if (WARN_ON(ret))
746 		return;
747 }
748 
749 /*
750  * Explicit request to remove a time event. The removal of a time event needs to
751  * be synchronized with the flow of a time event's end notification, which also
752  * removes the time event from the op mode data structures.
753  */
754 void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
755 			       struct iwl_mvm_vif *mvmvif,
756 			       struct iwl_mvm_time_event_data *te_data)
757 {
758 	struct iwl_time_event_cmd time_cmd = {};
759 	u32 uid;
760 	int ret;
761 
762 	if (!__iwl_mvm_remove_time_event(mvm, te_data, &uid))
763 		return;
764 
765 	/* When we remove a TE, the UID is to be set in the id field */
766 	time_cmd.id = cpu_to_le32(uid);
767 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE);
768 	time_cmd.id_and_color =
769 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
770 
771 	IWL_DEBUG_TE(mvm, "Removing TE 0x%x\n", le32_to_cpu(time_cmd.id));
772 	ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
773 				   sizeof(time_cmd), &time_cmd);
774 	if (WARN_ON(ret))
775 		return;
776 }
777 
778 /*
779  * When the firmware supports the session protection API,
780  * this is not needed since it'll automatically remove the
781  * session protection after association + beacon reception.
782  */
783 void iwl_mvm_stop_session_protection(struct iwl_mvm *mvm,
784 				     struct ieee80211_vif *vif)
785 {
786 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
787 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
788 	u32 id;
789 
790 	lockdep_assert_held(&mvm->mutex);
791 
792 	spin_lock_bh(&mvm->time_event_lock);
793 	id = te_data->id;
794 	spin_unlock_bh(&mvm->time_event_lock);
795 
796 	if (id != TE_BSS_STA_AGGRESSIVE_ASSOC) {
797 		IWL_DEBUG_TE(mvm,
798 			     "don't remove TE with id=%u (not session protection)\n",
799 			     id);
800 		return;
801 	}
802 
803 	iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
804 }
805 
806 void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
807 				      struct iwl_rx_cmd_buffer *rxb)
808 {
809 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
810 	struct iwl_mvm_session_prot_notif *notif = (void *)pkt->data;
811 	struct ieee80211_vif *vif;
812 	struct iwl_mvm_vif *mvmvif;
813 
814 	rcu_read_lock();
815 	vif = iwl_mvm_rcu_dereference_vif_id(mvm, le32_to_cpu(notif->mac_id),
816 					     true);
817 
818 	if (!vif)
819 		goto out_unlock;
820 
821 	mvmvif = iwl_mvm_vif_from_mac80211(vif);
822 
823 	/* The vif is not a P2P_DEVICE, maintain its time_event_data */
824 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE) {
825 		struct iwl_mvm_time_event_data *te_data =
826 			&mvmvif->time_event_data;
827 
828 		if (!le32_to_cpu(notif->status)) {
829 			iwl_mvm_te_check_disconnect(mvm, vif,
830 						    "Session protection failure");
831 			spin_lock_bh(&mvm->time_event_lock);
832 			iwl_mvm_te_clear_data(mvm, te_data);
833 			spin_unlock_bh(&mvm->time_event_lock);
834 		}
835 
836 		if (le32_to_cpu(notif->start)) {
837 			spin_lock_bh(&mvm->time_event_lock);
838 			te_data->running = le32_to_cpu(notif->start);
839 			te_data->end_jiffies =
840 				TU_TO_EXP_TIME(te_data->duration);
841 			spin_unlock_bh(&mvm->time_event_lock);
842 		} else {
843 			/*
844 			 * By now, we should have finished association
845 			 * and know the dtim period.
846 			 */
847 			iwl_mvm_te_check_disconnect(mvm, vif,
848 						    !vif->bss_conf.assoc ?
849 						    "Not associated and the session protection is over already..." :
850 						    "No beacon heard and the session protection is over already...");
851 			spin_lock_bh(&mvm->time_event_lock);
852 			iwl_mvm_te_clear_data(mvm, te_data);
853 			spin_unlock_bh(&mvm->time_event_lock);
854 		}
855 
856 		goto out_unlock;
857 	}
858 
859 	if (!le32_to_cpu(notif->status) || !le32_to_cpu(notif->start)) {
860 		/* End TE, notify mac80211 */
861 		mvmvif->time_event_data.id = SESSION_PROTECT_CONF_MAX_ID;
862 		ieee80211_remain_on_channel_expired(mvm->hw);
863 		set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
864 		iwl_mvm_roc_finished(mvm);
865 	} else if (le32_to_cpu(notif->start)) {
866 		if (WARN_ON(mvmvif->time_event_data.id !=
867 				le32_to_cpu(notif->conf_id)))
868 			goto out_unlock;
869 		set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
870 		ieee80211_ready_on_channel(mvm->hw); /* Start TE */
871 	}
872 
873  out_unlock:
874 	rcu_read_unlock();
875 }
876 
877 static int
878 iwl_mvm_start_p2p_roc_session_protection(struct iwl_mvm *mvm,
879 					 struct ieee80211_vif *vif,
880 					 int duration,
881 					 enum ieee80211_roc_type type)
882 {
883 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
884 	struct iwl_mvm_session_prot_cmd cmd = {
885 		.id_and_color =
886 			cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
887 							mvmvif->color)),
888 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
889 		.duration_tu = cpu_to_le32(MSEC_TO_TU(duration)),
890 	};
891 
892 	lockdep_assert_held(&mvm->mutex);
893 
894 	/* The time_event_data.id field is reused to save session
895 	 * protection's configuration.
896 	 */
897 	switch (type) {
898 	case IEEE80211_ROC_TYPE_NORMAL:
899 		mvmvif->time_event_data.id =
900 			SESSION_PROTECT_CONF_P2P_DEVICE_DISCOV;
901 		break;
902 	case IEEE80211_ROC_TYPE_MGMT_TX:
903 		mvmvif->time_event_data.id =
904 			SESSION_PROTECT_CONF_P2P_GO_NEGOTIATION;
905 		break;
906 	default:
907 		WARN_ONCE(1, "Got an invalid ROC type\n");
908 		return -EINVAL;
909 	}
910 
911 	cmd.conf_id = cpu_to_le32(mvmvif->time_event_data.id);
912 	return iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD,
913 						    MAC_CONF_GROUP, 0),
914 				    0, sizeof(cmd), &cmd);
915 }
916 
917 int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
918 			  int duration, enum ieee80211_roc_type type)
919 {
920 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
921 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
922 	struct iwl_time_event_cmd time_cmd = {};
923 
924 	lockdep_assert_held(&mvm->mutex);
925 	if (te_data->running) {
926 		IWL_WARN(mvm, "P2P_DEVICE remain on channel already running\n");
927 		return -EBUSY;
928 	}
929 
930 	if (fw_has_capa(&mvm->fw->ucode_capa,
931 			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))
932 		return iwl_mvm_start_p2p_roc_session_protection(mvm, vif,
933 								duration,
934 								type);
935 
936 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
937 	time_cmd.id_and_color =
938 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
939 
940 	switch (type) {
941 	case IEEE80211_ROC_TYPE_NORMAL:
942 		time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE_NORMAL);
943 		break;
944 	case IEEE80211_ROC_TYPE_MGMT_TX:
945 		time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE_MGMT_TX);
946 		break;
947 	default:
948 		WARN_ONCE(1, "Got an invalid ROC type\n");
949 		return -EINVAL;
950 	}
951 
952 	time_cmd.apply_time = cpu_to_le32(0);
953 	time_cmd.interval = cpu_to_le32(1);
954 
955 	/*
956 	 * The P2P Device TEs can have lower priority than other events
957 	 * that are being scheduled by the driver/fw, and thus it might not be
958 	 * scheduled. To improve the chances of it being scheduled, allow them
959 	 * to be fragmented, and in addition allow them to be delayed.
960 	 */
961 	time_cmd.max_frags = min(MSEC_TO_TU(duration)/50, TE_V2_FRAG_ENDLESS);
962 	time_cmd.max_delay = cpu_to_le32(MSEC_TO_TU(duration/2));
963 	time_cmd.duration = cpu_to_le32(MSEC_TO_TU(duration));
964 	time_cmd.repeat = 1;
965 	time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
966 				      TE_V2_NOTIF_HOST_EVENT_END |
967 				      TE_V2_START_IMMEDIATELY);
968 
969 	return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
970 }
971 
972 static struct iwl_mvm_time_event_data *iwl_mvm_get_roc_te(struct iwl_mvm *mvm)
973 {
974 	struct iwl_mvm_time_event_data *te_data;
975 
976 	lockdep_assert_held(&mvm->mutex);
977 
978 	spin_lock_bh(&mvm->time_event_lock);
979 
980 	/*
981 	 * Iterate over the list of time events and find the time event that is
982 	 * associated with a P2P_DEVICE interface.
983 	 * This assumes that a P2P_DEVICE interface can have only a single time
984 	 * event at any given time and this time event coresponds to a ROC
985 	 * request
986 	 */
987 	list_for_each_entry(te_data, &mvm->time_event_list, list) {
988 		if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE)
989 			goto out;
990 	}
991 
992 	/* There can only be at most one AUX ROC time event, we just use the
993 	 * list to simplify/unify code. Remove it if it exists.
994 	 */
995 	te_data = list_first_entry_or_null(&mvm->aux_roc_te_list,
996 					   struct iwl_mvm_time_event_data,
997 					   list);
998 out:
999 	spin_unlock_bh(&mvm->time_event_lock);
1000 	return te_data;
1001 }
1002 
1003 void iwl_mvm_cleanup_roc_te(struct iwl_mvm *mvm)
1004 {
1005 	struct iwl_mvm_time_event_data *te_data;
1006 	u32 uid;
1007 
1008 	te_data = iwl_mvm_get_roc_te(mvm);
1009 	if (te_data)
1010 		__iwl_mvm_remove_time_event(mvm, te_data, &uid);
1011 }
1012 
1013 void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
1014 {
1015 	struct iwl_mvm_vif *mvmvif;
1016 	struct iwl_mvm_time_event_data *te_data;
1017 
1018 	if (fw_has_capa(&mvm->fw->ucode_capa,
1019 			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
1020 		mvmvif = iwl_mvm_vif_from_mac80211(vif);
1021 
1022 		if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1023 			iwl_mvm_cancel_session_protection(mvm, mvmvif);
1024 			set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
1025 		} else {
1026 			iwl_mvm_remove_aux_roc_te(mvm, mvmvif,
1027 						  &mvmvif->time_event_data);
1028 		}
1029 
1030 		iwl_mvm_roc_finished(mvm);
1031 
1032 		return;
1033 	}
1034 
1035 	te_data = iwl_mvm_get_roc_te(mvm);
1036 	if (!te_data) {
1037 		IWL_WARN(mvm, "No remain on channel event\n");
1038 		return;
1039 	}
1040 
1041 	mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
1042 
1043 	if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1044 		iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
1045 		set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
1046 	} else {
1047 		iwl_mvm_remove_aux_roc_te(mvm, mvmvif, te_data);
1048 	}
1049 
1050 	iwl_mvm_roc_finished(mvm);
1051 }
1052 
1053 void iwl_mvm_remove_csa_period(struct iwl_mvm *mvm,
1054 			       struct ieee80211_vif *vif)
1055 {
1056 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1057 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
1058 	u32 id;
1059 
1060 	lockdep_assert_held(&mvm->mutex);
1061 
1062 	spin_lock_bh(&mvm->time_event_lock);
1063 	id = te_data->id;
1064 	spin_unlock_bh(&mvm->time_event_lock);
1065 
1066 	if (id != TE_CHANNEL_SWITCH_PERIOD)
1067 		return;
1068 
1069 	iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
1070 }
1071 
1072 int iwl_mvm_schedule_csa_period(struct iwl_mvm *mvm,
1073 				struct ieee80211_vif *vif,
1074 				u32 duration, u32 apply_time)
1075 {
1076 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1077 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
1078 	struct iwl_time_event_cmd time_cmd = {};
1079 
1080 	lockdep_assert_held(&mvm->mutex);
1081 
1082 	if (te_data->running) {
1083 		u32 id;
1084 
1085 		spin_lock_bh(&mvm->time_event_lock);
1086 		id = te_data->id;
1087 		spin_unlock_bh(&mvm->time_event_lock);
1088 
1089 		if (id == TE_CHANNEL_SWITCH_PERIOD) {
1090 			IWL_DEBUG_TE(mvm, "CS period is already scheduled\n");
1091 			return -EBUSY;
1092 		}
1093 
1094 		/*
1095 		 * Remove the session protection time event to allow the
1096 		 * channel switch. If we got here, we just heard a beacon so
1097 		 * the session protection is not needed anymore anyway.
1098 		 */
1099 		iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
1100 	}
1101 
1102 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
1103 	time_cmd.id_and_color =
1104 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
1105 	time_cmd.id = cpu_to_le32(TE_CHANNEL_SWITCH_PERIOD);
1106 	time_cmd.apply_time = cpu_to_le32(apply_time);
1107 	time_cmd.max_frags = TE_V2_FRAG_NONE;
1108 	time_cmd.duration = cpu_to_le32(duration);
1109 	time_cmd.repeat = 1;
1110 	time_cmd.interval = cpu_to_le32(1);
1111 	time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
1112 				      TE_V2_ABSENCE);
1113 	if (!apply_time)
1114 		time_cmd.policy |= cpu_to_le16(TE_V2_START_IMMEDIATELY);
1115 
1116 	return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
1117 }
1118 
1119 static bool iwl_mvm_session_prot_notif(struct iwl_notif_wait_data *notif_wait,
1120 				       struct iwl_rx_packet *pkt, void *data)
1121 {
1122 	struct iwl_mvm *mvm =
1123 		container_of(notif_wait, struct iwl_mvm, notif_wait);
1124 	struct iwl_mvm_session_prot_notif *resp;
1125 	int resp_len = iwl_rx_packet_payload_len(pkt);
1126 
1127 	if (WARN_ON(pkt->hdr.cmd != SESSION_PROTECTION_NOTIF ||
1128 		    pkt->hdr.group_id != MAC_CONF_GROUP))
1129 		return true;
1130 
1131 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
1132 		IWL_ERR(mvm, "Invalid SESSION_PROTECTION_NOTIF response\n");
1133 		return true;
1134 	}
1135 
1136 	resp = (void *)pkt->data;
1137 
1138 	if (!resp->status)
1139 		IWL_ERR(mvm,
1140 			"TIME_EVENT_NOTIFICATION received but not executed\n");
1141 
1142 	return true;
1143 }
1144 
1145 void iwl_mvm_schedule_session_protection(struct iwl_mvm *mvm,
1146 					 struct ieee80211_vif *vif,
1147 					 u32 duration, u32 min_duration,
1148 					 bool wait_for_notif)
1149 {
1150 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1151 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
1152 	const u16 notif[] = { iwl_cmd_id(SESSION_PROTECTION_NOTIF,
1153 					 MAC_CONF_GROUP, 0) };
1154 	struct iwl_notification_wait wait_notif;
1155 	struct iwl_mvm_session_prot_cmd cmd = {
1156 		.id_and_color =
1157 			cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1158 							mvmvif->color)),
1159 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
1160 		.duration_tu = cpu_to_le32(MSEC_TO_TU(duration)),
1161 	};
1162 
1163 	/* The time_event_data.id field is reused to save session
1164 	 * protection's configuration.
1165 	 */
1166 	mvmvif->time_event_data.id = SESSION_PROTECT_CONF_ASSOC;
1167 	cmd.conf_id = cpu_to_le32(mvmvif->time_event_data.id);
1168 
1169 	lockdep_assert_held(&mvm->mutex);
1170 
1171 	spin_lock_bh(&mvm->time_event_lock);
1172 	if (te_data->running &&
1173 	    time_after(te_data->end_jiffies, TU_TO_EXP_TIME(min_duration))) {
1174 		IWL_DEBUG_TE(mvm, "We have enough time in the current TE: %u\n",
1175 			     jiffies_to_msecs(te_data->end_jiffies - jiffies));
1176 		spin_unlock_bh(&mvm->time_event_lock);
1177 
1178 		return;
1179 	}
1180 
1181 	iwl_mvm_te_clear_data(mvm, te_data);
1182 	te_data->duration = le32_to_cpu(cmd.duration_tu);
1183 	spin_unlock_bh(&mvm->time_event_lock);
1184 
1185 	IWL_DEBUG_TE(mvm, "Add new session protection, duration %d TU\n",
1186 		     le32_to_cpu(cmd.duration_tu));
1187 
1188 	if (!wait_for_notif) {
1189 		if (iwl_mvm_send_cmd_pdu(mvm,
1190 					 iwl_cmd_id(SESSION_PROTECTION_CMD,
1191 						    MAC_CONF_GROUP, 0),
1192 					 0, sizeof(cmd), &cmd)) {
1193 			IWL_ERR(mvm,
1194 				"Couldn't send the SESSION_PROTECTION_CMD\n");
1195 			spin_lock_bh(&mvm->time_event_lock);
1196 			iwl_mvm_te_clear_data(mvm, te_data);
1197 			spin_unlock_bh(&mvm->time_event_lock);
1198 		}
1199 
1200 		return;
1201 	}
1202 
1203 	iwl_init_notification_wait(&mvm->notif_wait, &wait_notif,
1204 				   notif, ARRAY_SIZE(notif),
1205 				   iwl_mvm_session_prot_notif, NULL);
1206 
1207 	if (iwl_mvm_send_cmd_pdu(mvm,
1208 				 iwl_cmd_id(SESSION_PROTECTION_CMD,
1209 					    MAC_CONF_GROUP, 0),
1210 				 0, sizeof(cmd), &cmd)) {
1211 		IWL_ERR(mvm,
1212 			"Couldn't send the SESSION_PROTECTION_CMD\n");
1213 		iwl_remove_notification(&mvm->notif_wait, &wait_notif);
1214 	} else if (iwl_wait_notification(&mvm->notif_wait, &wait_notif,
1215 					 TU_TO_JIFFIES(100))) {
1216 		IWL_ERR(mvm,
1217 			"Failed to protect session until session protection\n");
1218 	}
1219 }
1220