1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of version 2 of the GNU General Public License as
13  * published by the Free Software Foundation.
14  *
15  * This program is distributed in the hope that it will be useful, but
16  * WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18  * General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
23  * USA
24  *
25  * The full GNU General Public License is included in this distribution
26  * in the file called COPYING.
27  *
28  * Contact Information:
29  *  Intel Linux Wireless <linuxwifi@intel.com>
30  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
31  *
32  * BSD LICENSE
33  *
34  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
35  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
36  * All rights reserved.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  *
42  *  * Redistributions of source code must retain the above copyright
43  *    notice, this list of conditions and the following disclaimer.
44  *  * Redistributions in binary form must reproduce the above copyright
45  *    notice, this list of conditions and the following disclaimer in
46  *    the documentation and/or other materials provided with the
47  *    distribution.
48  *  * Neither the name Intel Corporation nor the names of its
49  *    contributors may be used to endorse or promote products derived
50  *    from this software without specific prior written permission.
51  *
52  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
53  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
54  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
55  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
56  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
57  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
58  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
59  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
60  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
61  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
62  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
63  *
64  *****************************************************************************/
65 
66 #include <linux/jiffies.h>
67 #include <net/mac80211.h>
68 
69 #include "iwl-notif-wait.h"
70 #include "iwl-trans.h"
71 #include "fw-api.h"
72 #include "time-event.h"
73 #include "mvm.h"
74 #include "iwl-io.h"
75 #include "iwl-prph.h"
76 #include "fw-dbg.h"
77 
78 /*
79  * For the high priority TE use a time event type that has similar priority to
80  * the FW's action scan priority.
81  */
82 #define IWL_MVM_ROC_TE_TYPE_NORMAL TE_P2P_DEVICE_DISCOVERABLE
83 #define IWL_MVM_ROC_TE_TYPE_MGMT_TX TE_P2P_CLIENT_ASSOC
84 
85 void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
86 			   struct iwl_mvm_time_event_data *te_data)
87 {
88 	lockdep_assert_held(&mvm->time_event_lock);
89 
90 	if (!te_data->vif)
91 		return;
92 
93 	list_del(&te_data->list);
94 	te_data->running = false;
95 	te_data->uid = 0;
96 	te_data->id = TE_MAX;
97 	te_data->vif = NULL;
98 }
99 
100 void iwl_mvm_roc_done_wk(struct work_struct *wk)
101 {
102 	struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, roc_done_wk);
103 	u32 queues = 0;
104 
105 	/*
106 	 * Clear the ROC_RUNNING /ROC_AUX_RUNNING status bit.
107 	 * This will cause the TX path to drop offchannel transmissions.
108 	 * That would also be done by mac80211, but it is racy, in particular
109 	 * in the case that the time event actually completed in the firmware
110 	 * (which is handled in iwl_mvm_te_handle_notif).
111 	 */
112 	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status)) {
113 		queues |= BIT(IWL_MVM_OFFCHANNEL_QUEUE);
114 		iwl_mvm_unref(mvm, IWL_MVM_REF_ROC);
115 	}
116 	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status)) {
117 		queues |= BIT(mvm->aux_queue);
118 		iwl_mvm_unref(mvm, IWL_MVM_REF_ROC_AUX);
119 	}
120 
121 	synchronize_net();
122 
123 	/*
124 	 * Flush the offchannel queue -- this is called when the time
125 	 * event finishes or is canceled, so that frames queued for it
126 	 * won't get stuck on the queue and be transmitted in the next
127 	 * time event.
128 	 * We have to send the command asynchronously since this cannot
129 	 * be under the mutex for locking reasons, but that's not an
130 	 * issue as it will have to complete before the next command is
131 	 * executed, and a new time event means a new command.
132 	 */
133 	iwl_mvm_flush_tx_path(mvm, queues, CMD_ASYNC);
134 }
135 
136 static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
137 {
138 	/*
139 	 * Of course, our status bit is just as racy as mac80211, so in
140 	 * addition, fire off the work struct which will drop all frames
141 	 * from the hardware queues that made it through the race. First
142 	 * it will of course synchronize the TX path to make sure that
143 	 * any *new* TX will be rejected.
144 	 */
145 	schedule_work(&mvm->roc_done_wk);
146 }
147 
148 static void iwl_mvm_csa_noa_start(struct iwl_mvm *mvm)
149 {
150 	struct ieee80211_vif *csa_vif;
151 
152 	rcu_read_lock();
153 
154 	csa_vif = rcu_dereference(mvm->csa_vif);
155 	if (!csa_vif || !csa_vif->csa_active)
156 		goto out_unlock;
157 
158 	IWL_DEBUG_TE(mvm, "CSA NOA started\n");
159 
160 	/*
161 	 * CSA NoA is started but we still have beacons to
162 	 * transmit on the current channel.
163 	 * So we just do nothing here and the switch
164 	 * will be performed on the last TBTT.
165 	 */
166 	if (!ieee80211_csa_is_complete(csa_vif)) {
167 		IWL_WARN(mvm, "CSA NOA started too early\n");
168 		goto out_unlock;
169 	}
170 
171 	ieee80211_csa_finish(csa_vif);
172 
173 	rcu_read_unlock();
174 
175 	RCU_INIT_POINTER(mvm->csa_vif, NULL);
176 
177 	return;
178 
179 out_unlock:
180 	rcu_read_unlock();
181 }
182 
183 static bool iwl_mvm_te_check_disconnect(struct iwl_mvm *mvm,
184 					struct ieee80211_vif *vif,
185 					const char *errmsg)
186 {
187 	if (vif->type != NL80211_IFTYPE_STATION)
188 		return false;
189 	if (vif->bss_conf.assoc && vif->bss_conf.dtim_period)
190 		return false;
191 	if (errmsg)
192 		IWL_ERR(mvm, "%s\n", errmsg);
193 
194 	iwl_mvm_connection_loss(mvm, vif, errmsg);
195 	return true;
196 }
197 
198 static void
199 iwl_mvm_te_handle_notify_csa(struct iwl_mvm *mvm,
200 			     struct iwl_mvm_time_event_data *te_data,
201 			     struct iwl_time_event_notif *notif)
202 {
203 	struct ieee80211_vif *vif = te_data->vif;
204 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
205 
206 	if (!notif->status)
207 		IWL_DEBUG_TE(mvm, "CSA time event failed to start\n");
208 
209 	switch (te_data->vif->type) {
210 	case NL80211_IFTYPE_AP:
211 		if (!notif->status)
212 			mvmvif->csa_failed = true;
213 		iwl_mvm_csa_noa_start(mvm);
214 		break;
215 	case NL80211_IFTYPE_STATION:
216 		if (!notif->status) {
217 			iwl_mvm_connection_loss(mvm, vif,
218 						"CSA TE failed to start");
219 			break;
220 		}
221 		iwl_mvm_csa_client_absent(mvm, te_data->vif);
222 		ieee80211_chswitch_done(te_data->vif, true);
223 		break;
224 	default:
225 		/* should never happen */
226 		WARN_ON_ONCE(1);
227 		break;
228 	}
229 
230 	/* we don't need it anymore */
231 	iwl_mvm_te_clear_data(mvm, te_data);
232 }
233 
234 static void iwl_mvm_te_check_trigger(struct iwl_mvm *mvm,
235 				     struct iwl_time_event_notif *notif,
236 				     struct iwl_mvm_time_event_data *te_data)
237 {
238 	struct iwl_fw_dbg_trigger_tlv *trig;
239 	struct iwl_fw_dbg_trigger_time_event *te_trig;
240 	int i;
241 
242 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TIME_EVENT))
243 		return;
244 
245 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_TIME_EVENT);
246 	te_trig = (void *)trig->data;
247 
248 	if (!iwl_fw_dbg_trigger_check_stop(mvm, te_data->vif, trig))
249 		return;
250 
251 	for (i = 0; i < ARRAY_SIZE(te_trig->time_events); i++) {
252 		u32 trig_te_id = le32_to_cpu(te_trig->time_events[i].id);
253 		u32 trig_action_bitmap =
254 			le32_to_cpu(te_trig->time_events[i].action_bitmap);
255 		u32 trig_status_bitmap =
256 			le32_to_cpu(te_trig->time_events[i].status_bitmap);
257 
258 		if (trig_te_id != te_data->id ||
259 		    !(trig_action_bitmap & le32_to_cpu(notif->action)) ||
260 		    !(trig_status_bitmap & BIT(le32_to_cpu(notif->status))))
261 			continue;
262 
263 		iwl_mvm_fw_dbg_collect_trig(mvm, trig,
264 					    "Time event %d Action 0x%x received status: %d",
265 					    te_data->id,
266 					    le32_to_cpu(notif->action),
267 					    le32_to_cpu(notif->status));
268 		break;
269 	}
270 }
271 
272 /*
273  * Handles a FW notification for an event that is known to the driver.
274  *
275  * @mvm: the mvm component
276  * @te_data: the time event data
277  * @notif: the notification data corresponding the time event data.
278  */
279 static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
280 				    struct iwl_mvm_time_event_data *te_data,
281 				    struct iwl_time_event_notif *notif)
282 {
283 	lockdep_assert_held(&mvm->time_event_lock);
284 
285 	IWL_DEBUG_TE(mvm, "Handle time event notif - UID = 0x%x action %d\n",
286 		     le32_to_cpu(notif->unique_id),
287 		     le32_to_cpu(notif->action));
288 
289 	iwl_mvm_te_check_trigger(mvm, notif, te_data);
290 
291 	/*
292 	 * The FW sends the start/end time event notifications even for events
293 	 * that it fails to schedule. This is indicated in the status field of
294 	 * the notification. This happens in cases that the scheduler cannot
295 	 * find a schedule that can handle the event (for example requesting a
296 	 * P2P Device discoveribility, while there are other higher priority
297 	 * events in the system).
298 	 */
299 	if (!le32_to_cpu(notif->status)) {
300 		const char *msg;
301 
302 		if (notif->action & cpu_to_le32(TE_V2_NOTIF_HOST_EVENT_START))
303 			msg = "Time Event start notification failure";
304 		else
305 			msg = "Time Event end notification failure";
306 
307 		IWL_DEBUG_TE(mvm, "%s\n", msg);
308 
309 		if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, msg)) {
310 			iwl_mvm_te_clear_data(mvm, te_data);
311 			return;
312 		}
313 	}
314 
315 	if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_END) {
316 		IWL_DEBUG_TE(mvm,
317 			     "TE ended - current time %lu, estimated end %lu\n",
318 			     jiffies, te_data->end_jiffies);
319 
320 		switch (te_data->vif->type) {
321 		case NL80211_IFTYPE_P2P_DEVICE:
322 			ieee80211_remain_on_channel_expired(mvm->hw);
323 			iwl_mvm_roc_finished(mvm);
324 			break;
325 		case NL80211_IFTYPE_STATION:
326 			/*
327 			 * By now, we should have finished association
328 			 * and know the dtim period.
329 			 */
330 			iwl_mvm_te_check_disconnect(mvm, te_data->vif,
331 				"No association and the time event is over already...");
332 			break;
333 		default:
334 			break;
335 		}
336 
337 		iwl_mvm_te_clear_data(mvm, te_data);
338 	} else if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_START) {
339 		te_data->running = true;
340 		te_data->end_jiffies = TU_TO_EXP_TIME(te_data->duration);
341 
342 		if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
343 			set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
344 			iwl_mvm_ref(mvm, IWL_MVM_REF_ROC);
345 			ieee80211_ready_on_channel(mvm->hw);
346 		} else if (te_data->id == TE_CHANNEL_SWITCH_PERIOD) {
347 			iwl_mvm_te_handle_notify_csa(mvm, te_data, notif);
348 		}
349 	} else {
350 		IWL_WARN(mvm, "Got TE with unknown action\n");
351 	}
352 }
353 
354 /*
355  * Handle A Aux ROC time event
356  */
357 static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,
358 					   struct iwl_time_event_notif *notif)
359 {
360 	struct iwl_mvm_time_event_data *te_data, *tmp;
361 	bool aux_roc_te = false;
362 
363 	list_for_each_entry_safe(te_data, tmp, &mvm->aux_roc_te_list, list) {
364 		if (le32_to_cpu(notif->unique_id) == te_data->uid) {
365 			aux_roc_te = true;
366 			break;
367 		}
368 	}
369 	if (!aux_roc_te) /* Not a Aux ROC time event */
370 		return -EINVAL;
371 
372 	iwl_mvm_te_check_trigger(mvm, notif, te_data);
373 
374 	if (!le32_to_cpu(notif->status)) {
375 		IWL_DEBUG_TE(mvm,
376 			     "ERROR: Aux ROC Time Event %s notification failure\n",
377 			     (le32_to_cpu(notif->action) &
378 			      TE_V2_NOTIF_HOST_EVENT_START) ? "start" : "end");
379 		return -EINVAL;
380 	}
381 
382 	IWL_DEBUG_TE(mvm,
383 		     "Aux ROC time event notification  - UID = 0x%x action %d\n",
384 		     le32_to_cpu(notif->unique_id),
385 		     le32_to_cpu(notif->action));
386 
387 	if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_END) {
388 		/* End TE, notify mac80211 */
389 		ieee80211_remain_on_channel_expired(mvm->hw);
390 		iwl_mvm_roc_finished(mvm); /* flush aux queue */
391 		list_del(&te_data->list); /* remove from list */
392 		te_data->running = false;
393 		te_data->vif = NULL;
394 		te_data->uid = 0;
395 		te_data->id = TE_MAX;
396 	} else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
397 		set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
398 		te_data->running = true;
399 		iwl_mvm_ref(mvm, IWL_MVM_REF_ROC_AUX);
400 		ieee80211_ready_on_channel(mvm->hw); /* Start TE */
401 	} else {
402 		IWL_DEBUG_TE(mvm,
403 			     "ERROR: Unknown Aux ROC Time Event (action = %d)\n",
404 			     le32_to_cpu(notif->action));
405 		return -EINVAL;
406 	}
407 
408 	return 0;
409 }
410 
411 /*
412  * The Rx handler for time event notifications
413  */
414 void iwl_mvm_rx_time_event_notif(struct iwl_mvm *mvm,
415 				 struct iwl_rx_cmd_buffer *rxb)
416 {
417 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
418 	struct iwl_time_event_notif *notif = (void *)pkt->data;
419 	struct iwl_mvm_time_event_data *te_data, *tmp;
420 
421 	IWL_DEBUG_TE(mvm, "Time event notification - UID = 0x%x action %d\n",
422 		     le32_to_cpu(notif->unique_id),
423 		     le32_to_cpu(notif->action));
424 
425 	spin_lock_bh(&mvm->time_event_lock);
426 	/* This time event is triggered for Aux ROC request */
427 	if (!iwl_mvm_aux_roc_te_handle_notif(mvm, notif))
428 		goto unlock;
429 
430 	list_for_each_entry_safe(te_data, tmp, &mvm->time_event_list, list) {
431 		if (le32_to_cpu(notif->unique_id) == te_data->uid)
432 			iwl_mvm_te_handle_notif(mvm, te_data, notif);
433 	}
434 unlock:
435 	spin_unlock_bh(&mvm->time_event_lock);
436 }
437 
438 static bool iwl_mvm_te_notif(struct iwl_notif_wait_data *notif_wait,
439 			     struct iwl_rx_packet *pkt, void *data)
440 {
441 	struct iwl_mvm *mvm =
442 		container_of(notif_wait, struct iwl_mvm, notif_wait);
443 	struct iwl_mvm_time_event_data *te_data = data;
444 	struct iwl_time_event_notif *resp;
445 	int resp_len = iwl_rx_packet_payload_len(pkt);
446 
447 	if (WARN_ON(pkt->hdr.cmd != TIME_EVENT_NOTIFICATION))
448 		return true;
449 
450 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
451 		IWL_ERR(mvm, "Invalid TIME_EVENT_NOTIFICATION response\n");
452 		return true;
453 	}
454 
455 	resp = (void *)pkt->data;
456 
457 	/* te_data->uid is already set in the TIME_EVENT_CMD response */
458 	if (le32_to_cpu(resp->unique_id) != te_data->uid)
459 		return false;
460 
461 	IWL_DEBUG_TE(mvm, "TIME_EVENT_NOTIFICATION response - UID = 0x%x\n",
462 		     te_data->uid);
463 	if (!resp->status)
464 		IWL_ERR(mvm,
465 			"TIME_EVENT_NOTIFICATION received but not executed\n");
466 
467 	return true;
468 }
469 
470 static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
471 					struct iwl_rx_packet *pkt, void *data)
472 {
473 	struct iwl_mvm *mvm =
474 		container_of(notif_wait, struct iwl_mvm, notif_wait);
475 	struct iwl_mvm_time_event_data *te_data = data;
476 	struct iwl_time_event_resp *resp;
477 	int resp_len = iwl_rx_packet_payload_len(pkt);
478 
479 	if (WARN_ON(pkt->hdr.cmd != TIME_EVENT_CMD))
480 		return true;
481 
482 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
483 		IWL_ERR(mvm, "Invalid TIME_EVENT_CMD response\n");
484 		return true;
485 	}
486 
487 	resp = (void *)pkt->data;
488 
489 	/* we should never get a response to another TIME_EVENT_CMD here */
490 	if (WARN_ON_ONCE(le32_to_cpu(resp->id) != te_data->id))
491 		return false;
492 
493 	te_data->uid = le32_to_cpu(resp->unique_id);
494 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
495 		     te_data->uid);
496 	return true;
497 }
498 
499 static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
500 				       struct ieee80211_vif *vif,
501 				       struct iwl_mvm_time_event_data *te_data,
502 				       struct iwl_time_event_cmd *te_cmd)
503 {
504 	static const u16 time_event_response[] = { TIME_EVENT_CMD };
505 	struct iwl_notification_wait wait_time_event;
506 	int ret;
507 
508 	lockdep_assert_held(&mvm->mutex);
509 
510 	IWL_DEBUG_TE(mvm, "Add new TE, duration %d TU\n",
511 		     le32_to_cpu(te_cmd->duration));
512 
513 	spin_lock_bh(&mvm->time_event_lock);
514 	if (WARN_ON(te_data->id != TE_MAX)) {
515 		spin_unlock_bh(&mvm->time_event_lock);
516 		return -EIO;
517 	}
518 	te_data->vif = vif;
519 	te_data->duration = le32_to_cpu(te_cmd->duration);
520 	te_data->id = le32_to_cpu(te_cmd->id);
521 	list_add_tail(&te_data->list, &mvm->time_event_list);
522 	spin_unlock_bh(&mvm->time_event_lock);
523 
524 	/*
525 	 * Use a notification wait, which really just processes the
526 	 * command response and doesn't wait for anything, in order
527 	 * to be able to process the response and get the UID inside
528 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
529 	 * stores the buffer and then wakes up this thread, by which
530 	 * time another notification (that the time event started)
531 	 * might already be processed unsuccessfully.
532 	 */
533 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
534 				   time_event_response,
535 				   ARRAY_SIZE(time_event_response),
536 				   iwl_mvm_time_event_response, te_data);
537 
538 	ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
539 					    sizeof(*te_cmd), te_cmd);
540 	if (ret) {
541 		IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
542 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
543 		goto out_clear_te;
544 	}
545 
546 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
547 	ret = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
548 	/* should never fail */
549 	WARN_ON_ONCE(ret);
550 
551 	if (ret) {
552  out_clear_te:
553 		spin_lock_bh(&mvm->time_event_lock);
554 		iwl_mvm_te_clear_data(mvm, te_data);
555 		spin_unlock_bh(&mvm->time_event_lock);
556 	}
557 	return ret;
558 }
559 
560 void iwl_mvm_protect_session(struct iwl_mvm *mvm,
561 			     struct ieee80211_vif *vif,
562 			     u32 duration, u32 min_duration,
563 			     u32 max_delay, bool wait_for_notif)
564 {
565 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
566 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
567 	const u16 te_notif_response[] = { TIME_EVENT_NOTIFICATION };
568 	struct iwl_notification_wait wait_te_notif;
569 	struct iwl_time_event_cmd time_cmd = {};
570 
571 	lockdep_assert_held(&mvm->mutex);
572 
573 	if (te_data->running &&
574 	    time_after(te_data->end_jiffies, TU_TO_EXP_TIME(min_duration))) {
575 		IWL_DEBUG_TE(mvm, "We have enough time in the current TE: %u\n",
576 			     jiffies_to_msecs(te_data->end_jiffies - jiffies));
577 		return;
578 	}
579 
580 	if (te_data->running) {
581 		IWL_DEBUG_TE(mvm, "extend 0x%x: only %u ms left\n",
582 			     te_data->uid,
583 			     jiffies_to_msecs(te_data->end_jiffies - jiffies));
584 		/*
585 		 * we don't have enough time
586 		 * cancel the current TE and issue a new one
587 		 * Of course it would be better to remove the old one only
588 		 * when the new one is added, but we don't care if we are off
589 		 * channel for a bit. All we need to do, is not to return
590 		 * before we actually begin to be on the channel.
591 		 */
592 		iwl_mvm_stop_session_protection(mvm, vif);
593 	}
594 
595 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
596 	time_cmd.id_and_color =
597 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
598 	time_cmd.id = cpu_to_le32(TE_BSS_STA_AGGRESSIVE_ASSOC);
599 
600 	time_cmd.apply_time = cpu_to_le32(0);
601 
602 	time_cmd.max_frags = TE_V2_FRAG_NONE;
603 	time_cmd.max_delay = cpu_to_le32(max_delay);
604 	/* TODO: why do we need to interval = bi if it is not periodic? */
605 	time_cmd.interval = cpu_to_le32(1);
606 	time_cmd.duration = cpu_to_le32(duration);
607 	time_cmd.repeat = 1;
608 	time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
609 				      TE_V2_NOTIF_HOST_EVENT_END |
610 				      T2_V2_START_IMMEDIATELY);
611 
612 	if (!wait_for_notif) {
613 		iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
614 		return;
615 	}
616 
617 	/*
618 	 * Create notification_wait for the TIME_EVENT_NOTIFICATION to use
619 	 * right after we send the time event
620 	 */
621 	iwl_init_notification_wait(&mvm->notif_wait, &wait_te_notif,
622 				   te_notif_response,
623 				   ARRAY_SIZE(te_notif_response),
624 				   iwl_mvm_te_notif, te_data);
625 
626 	/* If TE was sent OK - wait for the notification that started */
627 	if (iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd)) {
628 		IWL_ERR(mvm, "Failed to add TE to protect session\n");
629 		iwl_remove_notification(&mvm->notif_wait, &wait_te_notif);
630 	} else if (iwl_wait_notification(&mvm->notif_wait, &wait_te_notif,
631 					 TU_TO_JIFFIES(max_delay))) {
632 		IWL_ERR(mvm, "Failed to protect session until TE\n");
633 	}
634 }
635 
636 static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
637 					struct iwl_mvm_time_event_data *te_data,
638 					u32 *uid)
639 {
640 	u32 id;
641 
642 	/*
643 	 * It is possible that by the time we got to this point the time
644 	 * event was already removed.
645 	 */
646 	spin_lock_bh(&mvm->time_event_lock);
647 
648 	/* Save time event uid before clearing its data */
649 	*uid = te_data->uid;
650 	id = te_data->id;
651 
652 	/*
653 	 * The clear_data function handles time events that were already removed
654 	 */
655 	iwl_mvm_te_clear_data(mvm, te_data);
656 	spin_unlock_bh(&mvm->time_event_lock);
657 
658 	/*
659 	 * It is possible that by the time we try to remove it, the time event
660 	 * has already ended and removed. In such a case there is no need to
661 	 * send a removal command.
662 	 */
663 	if (id == TE_MAX) {
664 		IWL_DEBUG_TE(mvm, "TE 0x%x has already ended\n", *uid);
665 		return false;
666 	}
667 
668 	return true;
669 }
670 
671 /*
672  * Explicit request to remove a aux roc time event. The removal of a time
673  * event needs to be synchronized with the flow of a time event's end
674  * notification, which also removes the time event from the op mode
675  * data structures.
676  */
677 static void iwl_mvm_remove_aux_roc_te(struct iwl_mvm *mvm,
678 				      struct iwl_mvm_vif *mvmvif,
679 				      struct iwl_mvm_time_event_data *te_data)
680 {
681 	struct iwl_hs20_roc_req aux_cmd = {};
682 	u32 uid;
683 	int ret;
684 
685 	if (!__iwl_mvm_remove_time_event(mvm, te_data, &uid))
686 		return;
687 
688 	aux_cmd.event_unique_id = cpu_to_le32(uid);
689 	aux_cmd.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE);
690 	aux_cmd.id_and_color =
691 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
692 	IWL_DEBUG_TE(mvm, "Removing BSS AUX ROC TE 0x%x\n",
693 		     le32_to_cpu(aux_cmd.event_unique_id));
694 	ret = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0,
695 				   sizeof(aux_cmd), &aux_cmd);
696 
697 	if (WARN_ON(ret))
698 		return;
699 }
700 
701 /*
702  * Explicit request to remove a time event. The removal of a time event needs to
703  * be synchronized with the flow of a time event's end notification, which also
704  * removes the time event from the op mode data structures.
705  */
706 void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
707 			       struct iwl_mvm_vif *mvmvif,
708 			       struct iwl_mvm_time_event_data *te_data)
709 {
710 	struct iwl_time_event_cmd time_cmd = {};
711 	u32 uid;
712 	int ret;
713 
714 	if (!__iwl_mvm_remove_time_event(mvm, te_data, &uid))
715 		return;
716 
717 	/* When we remove a TE, the UID is to be set in the id field */
718 	time_cmd.id = cpu_to_le32(uid);
719 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE);
720 	time_cmd.id_and_color =
721 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
722 
723 	IWL_DEBUG_TE(mvm, "Removing TE 0x%x\n", le32_to_cpu(time_cmd.id));
724 	ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
725 				   sizeof(time_cmd), &time_cmd);
726 	if (WARN_ON(ret))
727 		return;
728 }
729 
730 void iwl_mvm_stop_session_protection(struct iwl_mvm *mvm,
731 				     struct ieee80211_vif *vif)
732 {
733 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
734 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
735 
736 	lockdep_assert_held(&mvm->mutex);
737 	iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
738 }
739 
740 int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
741 			  int duration, enum ieee80211_roc_type type)
742 {
743 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
744 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
745 	struct iwl_time_event_cmd time_cmd = {};
746 
747 	lockdep_assert_held(&mvm->mutex);
748 	if (te_data->running) {
749 		IWL_WARN(mvm, "P2P_DEVICE remain on channel already running\n");
750 		return -EBUSY;
751 	}
752 
753 	/*
754 	 * Flush the done work, just in case it's still pending, so that
755 	 * the work it does can complete and we can accept new frames.
756 	 */
757 	flush_work(&mvm->roc_done_wk);
758 
759 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
760 	time_cmd.id_and_color =
761 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
762 
763 	switch (type) {
764 	case IEEE80211_ROC_TYPE_NORMAL:
765 		time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE_NORMAL);
766 		break;
767 	case IEEE80211_ROC_TYPE_MGMT_TX:
768 		time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE_MGMT_TX);
769 		break;
770 	default:
771 		WARN_ONCE(1, "Got an invalid ROC type\n");
772 		return -EINVAL;
773 	}
774 
775 	time_cmd.apply_time = cpu_to_le32(0);
776 	time_cmd.interval = cpu_to_le32(1);
777 
778 	/*
779 	 * The P2P Device TEs can have lower priority than other events
780 	 * that are being scheduled by the driver/fw, and thus it might not be
781 	 * scheduled. To improve the chances of it being scheduled, allow them
782 	 * to be fragmented, and in addition allow them to be delayed.
783 	 */
784 	time_cmd.max_frags = min(MSEC_TO_TU(duration)/50, TE_V2_FRAG_ENDLESS);
785 	time_cmd.max_delay = cpu_to_le32(MSEC_TO_TU(duration/2));
786 	time_cmd.duration = cpu_to_le32(MSEC_TO_TU(duration));
787 	time_cmd.repeat = 1;
788 	time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
789 				      TE_V2_NOTIF_HOST_EVENT_END |
790 				      T2_V2_START_IMMEDIATELY);
791 
792 	return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
793 }
794 
795 void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
796 {
797 	struct iwl_mvm_vif *mvmvif = NULL;
798 	struct iwl_mvm_time_event_data *te_data;
799 	bool is_p2p = false;
800 
801 	lockdep_assert_held(&mvm->mutex);
802 
803 	spin_lock_bh(&mvm->time_event_lock);
804 
805 	/*
806 	 * Iterate over the list of time events and find the time event that is
807 	 * associated with a P2P_DEVICE interface.
808 	 * This assumes that a P2P_DEVICE interface can have only a single time
809 	 * event at any given time and this time event coresponds to a ROC
810 	 * request
811 	 */
812 	list_for_each_entry(te_data, &mvm->time_event_list, list) {
813 		if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
814 			mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
815 			is_p2p = true;
816 			goto remove_te;
817 		}
818 	}
819 
820 	/* There can only be at most one AUX ROC time event, we just use the
821 	 * list to simplify/unify code. Remove it if it exists.
822 	 */
823 	te_data = list_first_entry_or_null(&mvm->aux_roc_te_list,
824 					   struct iwl_mvm_time_event_data,
825 					   list);
826 	if (te_data)
827 		mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
828 
829 remove_te:
830 	spin_unlock_bh(&mvm->time_event_lock);
831 
832 	if (!mvmvif) {
833 		IWL_WARN(mvm, "No remain on channel event\n");
834 		return;
835 	}
836 
837 	if (is_p2p)
838 		iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
839 	else
840 		iwl_mvm_remove_aux_roc_te(mvm, mvmvif, te_data);
841 
842 	iwl_mvm_roc_finished(mvm);
843 }
844 
845 int iwl_mvm_schedule_csa_period(struct iwl_mvm *mvm,
846 				struct ieee80211_vif *vif,
847 				u32 duration, u32 apply_time)
848 {
849 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
850 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
851 	struct iwl_time_event_cmd time_cmd = {};
852 
853 	lockdep_assert_held(&mvm->mutex);
854 
855 	if (te_data->running) {
856 		IWL_DEBUG_TE(mvm, "CS period is already scheduled\n");
857 		return -EBUSY;
858 	}
859 
860 	time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
861 	time_cmd.id_and_color =
862 		cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
863 	time_cmd.id = cpu_to_le32(TE_CHANNEL_SWITCH_PERIOD);
864 	time_cmd.apply_time = cpu_to_le32(apply_time);
865 	time_cmd.max_frags = TE_V2_FRAG_NONE;
866 	time_cmd.duration = cpu_to_le32(duration);
867 	time_cmd.repeat = 1;
868 	time_cmd.interval = cpu_to_le32(1);
869 	time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
870 				      TE_V2_ABSENCE);
871 
872 	return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
873 }
874