xref: /linux/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c (revision 6e6d8f344dbb00f232e73dbd0813cfabdd35b15f)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023, 2025 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/fips.h>
9 #include <linux/slab.h>
10 #include <linux/export.h>
11 #include <linux/etherdevice.h>
12 #include <linux/pci.h>
13 #include <linux/firmware.h>
14 
15 #include "iwl-drv.h"
16 #include "iwl-modparams.h"
17 #include "iwl-nvm-parse.h"
18 #include "iwl-prph.h"
19 #include "iwl-io.h"
20 #include "iwl-csr.h"
21 #include "fw/acpi.h"
22 #include "fw/api/nvm-reg.h"
23 #include "fw/api/commands.h"
24 #include "fw/api/cmdhdr.h"
25 #include "fw/img.h"
26 #include "fw/dbg.h"
27 
28 #include "mei/iwl-mei.h"
29 
30 /* NVM offsets (in words) definitions */
31 enum nvm_offsets {
32 	/* NVM HW-Section offset (in words) definitions */
33 	SUBSYSTEM_ID = 0x0A,
34 	HW_ADDR = 0x15,
35 
36 	/* NVM SW-Section offset (in words) definitions */
37 	NVM_SW_SECTION = 0x1C0,
38 	NVM_VERSION = 0,
39 	RADIO_CFG = 1,
40 	SKU = 2,
41 	N_HW_ADDRS = 3,
42 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
43 
44 	/* NVM REGULATORY -Section offset (in words) definitions */
45 	NVM_CHANNELS_SDP = 0,
46 };
47 
48 enum ext_nvm_offsets {
49 	/* NVM HW-Section offset (in words) definitions */
50 
51 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
52 
53 	/* NVM SW-Section offset (in words) definitions */
54 	NVM_VERSION_EXT_NVM = 0,
55 	N_HW_ADDRS_FAMILY_8000 = 3,
56 
57 	/* NVM PHY_SKU-Section offset (in words) definitions */
58 	RADIO_CFG_FAMILY_EXT_NVM = 0,
59 	SKU_FAMILY_8000 = 2,
60 
61 	/* NVM REGULATORY -Section offset (in words) definitions */
62 	NVM_CHANNELS_EXTENDED = 0,
63 	NVM_LAR_OFFSET_OLD = 0x4C7,
64 	NVM_LAR_OFFSET = 0x507,
65 	NVM_LAR_ENABLED = 0x7,
66 };
67 
68 /* SKU Capabilities (actual values from NVM definition) */
69 enum nvm_sku_bits {
70 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
71 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
72 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
73 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
74 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
75 };
76 
77 /*
78  * These are the channel numbers in the order that they are stored in the NVM
79  */
80 static const u16 iwl_nvm_channels[] = {
81 	/* 2.4 GHz */
82 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
83 	/* 5 GHz */
84 	36, 40, 44, 48, 52, 56, 60, 64,
85 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
86 	149, 153, 157, 161, 165
87 };
88 
89 static const u16 iwl_ext_nvm_channels[] = {
90 	/* 2.4 GHz */
91 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
92 	/* 5 GHz */
93 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
94 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
95 	149, 153, 157, 161, 165, 169, 173, 177, 181
96 };
97 
98 static const u16 iwl_uhb_nvm_channels[] = {
99 	/* 2.4 GHz */
100 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
101 	/* 5 GHz */
102 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
103 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
104 	149, 153, 157, 161, 165, 169, 173, 177, 181,
105 	/* 6-7 GHz */
106 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
107 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
108 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
109 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
110 };
111 
112 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
113 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
114 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
115 #define NUM_2GHZ_CHANNELS		14
116 #define NUM_5GHZ_CHANNELS		37
117 #define FIRST_2GHZ_HT_MINUS		5
118 #define LAST_2GHZ_HT_PLUS		9
119 #define N_HW_ADDR_MASK			0xF
120 
121 /* rate data (static) */
122 static struct ieee80211_rate iwl_cfg80211_rates[] = {
123 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
124 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
125 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
126 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
127 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
128 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
129 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
130 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
131 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
132 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
133 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
134 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
135 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
136 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
137 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
138 };
139 #define RATES_24_OFFS	0
140 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
141 #define RATES_52_OFFS	4
142 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
143 
144 /**
145  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
146  * domain.
147  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
148  *	2.4Ghz band is allowed.
149  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
150  *	5Ghz band is allowed.
151  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
152  *	for this regulatory domain (valid only in 5Ghz).
153  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
154  *	for this regulatory domain (valid only in 5Ghz).
155  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
156  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
157  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
158  *	for this regulatory domain (valid only in 5Ghz).
159  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
160  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
161  */
162 enum iwl_reg_capa_flags_v1 {
163 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
164 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
165 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
166 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
167 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
168 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
169 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
170 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
171 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
172 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
173 
174 /**
175  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
176  * domain (version 2).
177  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
178  *	disabled.
179  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
180  *	2.4Ghz band is allowed.
181  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
182  *	5Ghz band is allowed.
183  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
184  *	for this regulatory domain (valid only in 5Ghz).
185  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
186  *	for this regulatory domain (valid only in 5Ghz).
187  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
188  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
189  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
190  *	126, 122) are disabled.
191  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
192  *	for this regulatory domain (uvalid only in 5Ghz).
193  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
194  */
195 enum iwl_reg_capa_flags_v2 {
196 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
197 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
198 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
199 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
200 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
201 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
202 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
203 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
204 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
205 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
206 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
207 
208 /**
209  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
210  * domain.
211  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
212  *	for this regulatory domain (valid only in 5Ghz).
213  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
214  *	for this regulatory domain (valid only in 5Ghz).
215  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
216  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
217  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
218  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
219  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
220  *	for this regulatory domain (valid only in 5GHz).
221  */
222 enum iwl_reg_capa_flags_v4 {
223 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
224 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
225 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
226 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
227 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
228 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
229 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
230 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
231 
232 /*
233 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
234 * MCC update command response.
235 */
236 #define REG_CAPA_V2_RESP_VER	6
237 
238 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
239  * MCC update command response.
240  */
241 #define REG_CAPA_V4_RESP_VER	8
242 
243 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
244 					       int chan, u32 flags)
245 {
246 #define CHECK_AND_PRINT_I(x)	\
247 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
248 
249 	if (!(flags & NVM_CHANNEL_VALID)) {
250 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
251 			      chan, flags);
252 		return;
253 	}
254 
255 	/* Note: already can print up to 101 characters, 110 is the limit! */
256 	IWL_DEBUG_DEV(dev, level,
257 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
258 		      chan, flags,
259 		      CHECK_AND_PRINT_I(VALID),
260 		      CHECK_AND_PRINT_I(IBSS),
261 		      CHECK_AND_PRINT_I(ACTIVE),
262 		      CHECK_AND_PRINT_I(RADAR),
263 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
264 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
265 		      CHECK_AND_PRINT_I(UNIFORM),
266 		      CHECK_AND_PRINT_I(20MHZ),
267 		      CHECK_AND_PRINT_I(40MHZ),
268 		      CHECK_AND_PRINT_I(80MHZ),
269 		      CHECK_AND_PRINT_I(160MHZ),
270 		      CHECK_AND_PRINT_I(DC_HIGH),
271 		      CHECK_AND_PRINT_I(VLP),
272 		      CHECK_AND_PRINT_I(AFC));
273 #undef CHECK_AND_PRINT_I
274 }
275 
276 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
277 				 u32 nvm_flags, const struct iwl_rf_cfg *cfg)
278 {
279 	u32 flags = IEEE80211_CHAN_NO_HT40;
280 
281 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
282 		if (ch_num <= LAST_2GHZ_HT_PLUS)
283 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
284 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
285 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
286 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
287 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
288 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
289 		else
290 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
291 	}
292 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
293 		flags |= IEEE80211_CHAN_NO_80MHZ;
294 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
295 		flags |= IEEE80211_CHAN_NO_160MHZ;
296 
297 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
298 		flags |= IEEE80211_CHAN_NO_IR;
299 
300 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
301 		flags |= IEEE80211_CHAN_NO_IR;
302 
303 	if (nvm_flags & NVM_CHANNEL_RADAR)
304 		flags |= IEEE80211_CHAN_RADAR;
305 
306 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
307 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
308 
309 	/* Set the GO concurrent flag only in case that NO_IR is set.
310 	 * Otherwise it is meaningless
311 	 */
312 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
313 	    (flags & IEEE80211_CHAN_NO_IR))
314 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
315 
316 	/* Set the AP type for the UHB case. */
317 	if (nvm_flags & NVM_CHANNEL_VLP)
318 		flags |= IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP;
319 	else
320 		flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
321 	if (!(nvm_flags & NVM_CHANNEL_AFC))
322 		flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
323 
324 	return flags;
325 }
326 
327 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
328 {
329 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
330 		return NL80211_BAND_6GHZ;
331 	}
332 
333 	if (ch_idx >= NUM_2GHZ_CHANNELS)
334 		return NL80211_BAND_5GHZ;
335 	return NL80211_BAND_2GHZ;
336 }
337 
338 static int iwl_init_channel_map(struct iwl_trans *trans,
339 				const struct iwl_fw *fw,
340 				struct iwl_nvm_data *data,
341 				const void * const nvm_ch_flags,
342 				u32 sbands_flags, bool v4)
343 {
344 	const struct iwl_rf_cfg *cfg = trans->cfg;
345 	struct device *dev = trans->dev;
346 	int ch_idx;
347 	int n_channels = 0;
348 	struct ieee80211_channel *channel;
349 	u32 ch_flags;
350 	int num_of_ch;
351 	const u16 *nvm_chan;
352 
353 	if (cfg->uhb_supported) {
354 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
355 		nvm_chan = iwl_uhb_nvm_channels;
356 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
357 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
358 		nvm_chan = iwl_ext_nvm_channels;
359 	} else {
360 		num_of_ch = IWL_NVM_NUM_CHANNELS;
361 		nvm_chan = iwl_nvm_channels;
362 	}
363 
364 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
365 		enum nl80211_band band =
366 			iwl_nl80211_band_from_channel_idx(ch_idx);
367 
368 		if (v4)
369 			ch_flags =
370 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
371 		else
372 			ch_flags =
373 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
374 
375 		if (band == NL80211_BAND_5GHZ &&
376 		    !data->sku_cap_band_52ghz_enable)
377 			continue;
378 
379 		/* workaround to disable wide channels in 5GHz */
380 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
381 		    band == NL80211_BAND_5GHZ) {
382 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
383 				     NVM_CHANNEL_80MHZ |
384 				     NVM_CHANNEL_160MHZ);
385 		}
386 
387 		if (ch_flags & NVM_CHANNEL_160MHZ)
388 			data->vht160_supported = true;
389 
390 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
391 		    !(ch_flags & NVM_CHANNEL_VALID)) {
392 			/*
393 			 * Channels might become valid later if lar is
394 			 * supported, hence we still want to add them to
395 			 * the list of supported channels to cfg80211.
396 			 */
397 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
398 						    nvm_chan[ch_idx], ch_flags);
399 			continue;
400 		}
401 
402 		channel = &data->channels[n_channels];
403 		n_channels++;
404 
405 		channel->hw_value = nvm_chan[ch_idx];
406 		channel->band = band;
407 		channel->center_freq =
408 			ieee80211_channel_to_frequency(
409 				channel->hw_value, channel->band);
410 
411 		/* Initialize regulatory-based run-time data */
412 
413 		/*
414 		 * Default value - highest tx power value.  max_power
415 		 * is not used in mvm, and is used for backwards compatibility
416 		 */
417 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
418 
419 		/* don't put limitations in case we're using LAR */
420 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
421 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
422 							       ch_idx, band,
423 							       ch_flags, cfg);
424 		else
425 			channel->flags = 0;
426 
427 		if (fw_has_capa(&fw->ucode_capa,
428 				IWL_UCODE_TLV_CAPA_MONITOR_PASSIVE_CHANS))
429 			channel->flags |= IEEE80211_CHAN_CAN_MONITOR;
430 
431 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
432 					    channel->hw_value, ch_flags);
433 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
434 				 channel->hw_value, channel->max_power);
435 	}
436 
437 	return n_channels;
438 }
439 
440 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
441 				  struct iwl_nvm_data *data,
442 				  struct ieee80211_sta_vht_cap *vht_cap,
443 				  u8 tx_chains, u8 rx_chains)
444 {
445 	const struct iwl_rf_cfg *cfg = trans->cfg;
446 	int num_rx_ants = num_of_ant(rx_chains);
447 	int num_tx_ants = num_of_ant(tx_chains);
448 
449 	vht_cap->vht_supported = true;
450 
451 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
452 		       IEEE80211_VHT_CAP_RXSTBC_1 |
453 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
454 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
455 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
456 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
457 
458 	if (!trans->cfg->ht_params.stbc)
459 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
460 
461 	if (data->vht160_supported)
462 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
463 				IEEE80211_VHT_CAP_SHORT_GI_160;
464 
465 	if (cfg->vht_mu_mimo_supported)
466 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
467 
468 	if (cfg->ht_params.ldpc)
469 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
470 
471 	if (data->sku_cap_mimo_disabled) {
472 		num_rx_ants = 1;
473 		num_tx_ants = 1;
474 	}
475 
476 	if (trans->cfg->ht_params.stbc && num_tx_ants > 1)
477 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
478 	else
479 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
480 
481 	/*
482 	 * With fips_enabled crypto is done by software, so the HW cannot
483 	 * split up A-MSDUs and the real limit that was set applies.
484 	 * Note that EHT doesn't honour this (HE copies the VHT value),
485 	 * but EHT is also entirely disabled for fips_enabled.
486 	 */
487 	switch (iwlwifi_mod_params.amsdu_size) {
488 	case IWL_AMSDU_DEF:
489 		if (trans->mac_cfg->mq_rx_supported && !fips_enabled)
490 			vht_cap->cap |=
491 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
492 		else
493 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
494 		break;
495 	case IWL_AMSDU_2K:
496 		if (trans->mac_cfg->mq_rx_supported && !fips_enabled)
497 			vht_cap->cap |=
498 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
499 		else
500 			WARN(1, "RB size of 2K is not supported by this device\n");
501 		break;
502 	case IWL_AMSDU_4K:
503 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
504 		break;
505 	case IWL_AMSDU_8K:
506 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
507 		break;
508 	case IWL_AMSDU_12K:
509 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
510 		break;
511 	default:
512 		break;
513 	}
514 
515 	vht_cap->vht_mcs.rx_mcs_map =
516 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
517 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
518 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
519 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
520 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
521 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
522 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
523 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
524 
525 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
526 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
527 		/* this works because NOT_SUPPORTED == 3 */
528 		vht_cap->vht_mcs.rx_mcs_map |=
529 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
530 	}
531 
532 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
533 
534 	vht_cap->vht_mcs.tx_highest |=
535 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
536 }
537 
538 static const u8 iwl_vendor_caps[] = {
539 	0xdd,			/* vendor element */
540 	0x06,			/* length */
541 	0x00, 0x17, 0x35,	/* Intel OUI */
542 	0x08,			/* type (Intel Capabilities) */
543 	/* followed by 16 bits of capabilities */
544 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
545 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
546 	0x00
547 };
548 
549 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
550 	{
551 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
552 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
553 		.he_cap = {
554 			.has_he = true,
555 			.he_cap_elem = {
556 				.mac_cap_info[0] =
557 					IEEE80211_HE_MAC_CAP0_HTC_HE,
558 				.mac_cap_info[1] =
559 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
560 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
561 				.mac_cap_info[2] =
562 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
563 				.mac_cap_info[3] =
564 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
565 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
566 				.mac_cap_info[4] =
567 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
568 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
569 				.mac_cap_info[5] =
570 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
571 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
572 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
573 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
574 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
575 				.phy_cap_info[1] =
576 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
577 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
578 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
579 				.phy_cap_info[2] =
580 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
581 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
582 				.phy_cap_info[3] =
583 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
584 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
585 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
586 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
587 				.phy_cap_info[4] =
588 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
589 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
590 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
591 				.phy_cap_info[6] =
592 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
593 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
594 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
595 				.phy_cap_info[7] =
596 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
597 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
598 				.phy_cap_info[8] =
599 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
600 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
601 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
602 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
603 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
604 				.phy_cap_info[9] =
605 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
606 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
607 					IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
608 					IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU |
609 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
610 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
611 				.phy_cap_info[10] =
612 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
613 			},
614 			/*
615 			 * Set default Tx/Rx HE MCS NSS Support field.
616 			 * Indicate support for up to 2 spatial streams and all
617 			 * MCS, without any special cases
618 			 */
619 			.he_mcs_nss_supp = {
620 				.rx_mcs_80 = cpu_to_le16(0xfffa),
621 				.tx_mcs_80 = cpu_to_le16(0xfffa),
622 				.rx_mcs_160 = cpu_to_le16(0xfffa),
623 				.tx_mcs_160 = cpu_to_le16(0xfffa),
624 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
625 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
626 			},
627 			/*
628 			 * Set default PPE thresholds, with PPET16 set to 0,
629 			 * PPET8 set to 7
630 			 */
631 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
632 		},
633 		.eht_cap = {
634 			.has_eht = true,
635 			.eht_cap_elem = {
636 				.mac_cap_info[0] =
637 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL,
638 				.phy_cap_info[0] =
639 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
640 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
641 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
642 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
643 				.phy_cap_info[1] =
644 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
645 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
646 				.phy_cap_info[3] =
647 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK,
648 
649 				.phy_cap_info[4] =
650 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
651 				.phy_cap_info[5] =
652 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
653 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US) |
654 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
655 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
656 					IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF,
657 				.phy_cap_info[8] =
658 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
659 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
660 			},
661 
662 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
663 			 * Rx - note we don't set the only_20mhz, but due to this
664 			 * being a union, it gets set correctly anyway.
665 			 */
666 			.eht_mcs_nss_supp = {
667 				.bw._80 = {
668 					.rx_tx_mcs9_max_nss = 0x22,
669 					.rx_tx_mcs11_max_nss = 0x22,
670 					.rx_tx_mcs13_max_nss = 0x22,
671 				},
672 				.bw._160 = {
673 					.rx_tx_mcs9_max_nss = 0x22,
674 					.rx_tx_mcs11_max_nss = 0x22,
675 					.rx_tx_mcs13_max_nss = 0x22,
676 				},
677 				.bw._320 = {
678 					.rx_tx_mcs9_max_nss = 0x22,
679 					.rx_tx_mcs11_max_nss = 0x22,
680 					.rx_tx_mcs13_max_nss = 0x22,
681 				},
682 			},
683 
684 			/*
685 			 * PPE thresholds for NSS = 2, and RU index bitmap set
686 			 * to 0xc.
687 			 * Note: just for stating what we want, not present in
688 			 * the transmitted data due to not including
689 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
690 			 */
691 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
692 		},
693 	},
694 	{
695 		.types_mask = BIT(NL80211_IFTYPE_AP) |
696 			      BIT(NL80211_IFTYPE_P2P_GO),
697 		.he_cap = {
698 			.has_he = true,
699 			.he_cap_elem = {
700 				.mac_cap_info[0] =
701 					IEEE80211_HE_MAC_CAP0_HTC_HE,
702 				.mac_cap_info[1] =
703 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
704 				.mac_cap_info[3] =
705 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
706 				.phy_cap_info[1] =
707 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
708 				.phy_cap_info[2] =
709 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
710 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
711 				.phy_cap_info[3] =
712 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
713 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
714 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
715 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
716 				.phy_cap_info[6] =
717 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
718 				.phy_cap_info[7] =
719 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
720 				.phy_cap_info[8] =
721 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
722 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
723 				.phy_cap_info[9] =
724 					IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
725 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
726 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
727 			},
728 			/*
729 			 * Set default Tx/Rx HE MCS NSS Support field.
730 			 * Indicate support for up to 2 spatial streams and all
731 			 * MCS, without any special cases
732 			 */
733 			.he_mcs_nss_supp = {
734 				.rx_mcs_80 = cpu_to_le16(0xfffa),
735 				.tx_mcs_80 = cpu_to_le16(0xfffa),
736 				.rx_mcs_160 = cpu_to_le16(0xfffa),
737 				.tx_mcs_160 = cpu_to_le16(0xfffa),
738 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
739 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
740 			},
741 			/*
742 			 * Set default PPE thresholds, with PPET16 set to 0,
743 			 * PPET8 set to 7
744 			 */
745 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
746 		},
747 		.eht_cap = {
748 			.has_eht = true,
749 			.eht_cap_elem = {
750 				.mac_cap_info[0] =
751 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL,
752 				.phy_cap_info[0] =
753 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
754 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
755 				.phy_cap_info[5] =
756 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
757 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US),
758 			},
759 
760 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
761 			 * Rx - note we don't set the only_20mhz, but due to this
762 			 * being a union, it gets set correctly anyway.
763 			 */
764 			.eht_mcs_nss_supp = {
765 				.bw._80 = {
766 					.rx_tx_mcs9_max_nss = 0x22,
767 					.rx_tx_mcs11_max_nss = 0x22,
768 					.rx_tx_mcs13_max_nss = 0x22,
769 				},
770 				.bw._160 = {
771 					.rx_tx_mcs9_max_nss = 0x22,
772 					.rx_tx_mcs11_max_nss = 0x22,
773 					.rx_tx_mcs13_max_nss = 0x22,
774 				},
775 				.bw._320 = {
776 					.rx_tx_mcs9_max_nss = 0x22,
777 					.rx_tx_mcs11_max_nss = 0x22,
778 					.rx_tx_mcs13_max_nss = 0x22,
779 				},
780 			},
781 
782 			/*
783 			 * PPE thresholds for NSS = 2, and RU index bitmap set
784 			 * to 0xc.
785 			 * Note: just for stating what we want, not present in
786 			 * the transmitted data due to not including
787 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
788 			 */
789 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
790 		},
791 	},
792 };
793 
794 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
795 				  struct iwl_nvm_data *data,
796 				  struct ieee80211_supported_band *sband,
797 				  u8 tx_chains, u8 rx_chains)
798 {
799 	struct ieee80211_sta_ht_cap ht_cap;
800 	struct ieee80211_sta_vht_cap vht_cap = {};
801 	struct ieee80211_sband_iftype_data *iftype_data;
802 	u16 he_6ghz_capa = 0;
803 	u32 exp;
804 	int i;
805 
806 	if (sband->band != NL80211_BAND_6GHZ)
807 		return;
808 
809 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
810 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
811 			     tx_chains, rx_chains);
812 	WARN_ON(!ht_cap.ht_supported);
813 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
814 	WARN_ON(!vht_cap.vht_supported);
815 
816 	he_6ghz_capa |=
817 		u16_encode_bits(ht_cap.ampdu_density,
818 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
819 	exp = u32_get_bits(vht_cap.cap,
820 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
821 	he_6ghz_capa |=
822 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
823 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
824 	he_6ghz_capa |=
825 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
826 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
827 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
828 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
829 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
830 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
831 
832 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
833 
834 	/* we know it's writable - we set it before ourselves */
835 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
836 	for (i = 0; i < sband->n_iftype_data; i++)
837 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
838 }
839 
840 static void
841 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
842 			 struct iwl_nvm_data *data,
843 			 struct ieee80211_supported_band *sband,
844 			 struct ieee80211_sband_iftype_data *iftype_data,
845 			 u8 tx_chains, u8 rx_chains,
846 			 const struct iwl_fw *fw)
847 {
848 	bool is_ap = iftype_data->types_mask & (BIT(NL80211_IFTYPE_AP) |
849 						BIT(NL80211_IFTYPE_P2P_GO));
850 	bool slow_pcie = (!trans->mac_cfg->integrated &&
851 			  trans->info.pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB);
852 
853 	/* EHT needs WPA3/MFP so cannot do it for fips_enabled */
854 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be ||
855 	    fips_enabled)
856 		iftype_data->eht_cap.has_eht = false;
857 
858 	/* Advertise an A-MPDU exponent extension based on
859 	 * operating band
860 	 */
861 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
862 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
863 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
864 	else if (sband->band != NL80211_BAND_2GHZ)
865 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
866 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
867 	else
868 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
869 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
870 
871 	switch (sband->band) {
872 	case NL80211_BAND_2GHZ:
873 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
874 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
875 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
876 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
877 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
878 		break;
879 	case NL80211_BAND_6GHZ:
880 		if (!trans->reduced_cap_sku &&
881 		    (!trans->cfg->bw_limit || trans->cfg->bw_limit >= 320)) {
882 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
883 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
884 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
885 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
886 		}
887 		fallthrough;
888 	case NL80211_BAND_5GHZ:
889 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
890 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
891 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
892 		break;
893 	default:
894 		WARN_ON(1);
895 		break;
896 	}
897 
898 	if ((tx_chains & rx_chains) == ANT_AB) {
899 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
900 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
901 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
902 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
903 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
904 		if (!is_ap) {
905 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
906 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
907 
908 			if (iftype_data->eht_cap.has_eht) {
909 				/*
910 				 * Set the number of sounding dimensions for each
911 				 * bandwidth to 1 to indicate the maximal supported
912 				 * value of TXVECTOR parameter NUM_STS of 2
913 				 */
914 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
915 
916 				/*
917 				 * Set the MAX NC to 1 to indicate sounding feedback of
918 				 * 2 supported by the beamfomee.
919 				 */
920 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
921 			}
922 		}
923 
924 		if (slow_pcie) {
925 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
926 				&iftype_data->eht_cap.eht_mcs_nss_supp;
927 
928 			mcs_nss->bw._320.rx_tx_mcs11_max_nss = 0;
929 			mcs_nss->bw._320.rx_tx_mcs13_max_nss = 0;
930 		}
931 	} else {
932 		struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp =
933 			&iftype_data->he_cap.he_mcs_nss_supp;
934 
935 		if (iftype_data->eht_cap.has_eht) {
936 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
937 				&iftype_data->eht_cap.eht_mcs_nss_supp;
938 
939 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
940 		}
941 
942 		if (!is_ap) {
943 			/* If not 2x2, we need to indicate 1x1 in the
944 			 * Midamble RX Max NSTS - but not for AP mode
945 			 */
946 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
947 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
948 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
949 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
950 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
951 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
952 		}
953 
954 		he_mcs_nss_supp->rx_mcs_80 |=
955 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
956 		he_mcs_nss_supp->tx_mcs_80 |=
957 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
958 		he_mcs_nss_supp->rx_mcs_160 |=
959 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
960 		he_mcs_nss_supp->tx_mcs_160 |=
961 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
962 		he_mcs_nss_supp->rx_mcs_80p80 |=
963 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
964 		he_mcs_nss_supp->tx_mcs_80p80 |=
965 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
966 	}
967 
968 	/* prior RFs don't have HE, HR RF doesn't have this, later have it */
969 	if (CSR_HW_RFID_TYPE(trans->info.hw_rf_id) == IWL_CFG_RF_TYPE_HR1 ||
970 	    CSR_HW_RFID_TYPE(trans->info.hw_rf_id) == IWL_CFG_RF_TYPE_HR2)
971 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] &=
972 			~(IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
973 			  IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU);
974 
975 	if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
976 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
977 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
978 
979 	if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
980 	    !is_ap) {
981 		iftype_data->vendor_elems.data = iwl_vendor_caps;
982 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
983 	}
984 
985 	if (!trans->cfg->ht_params.stbc) {
986 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
987 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
988 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
989 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
990 	}
991 
992 	if (trans->step_urm) {
993 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs11_max_nss = 0;
994 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs13_max_nss = 0;
995 	}
996 
997 	if (trans->cfg->bw_limit && trans->cfg->bw_limit < 160)
998 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] &=
999 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
1000 
1001 	if ((trans->cfg->bw_limit && trans->cfg->bw_limit < 320) ||
1002 	    trans->reduced_cap_sku) {
1003 		memset(&iftype_data->eht_cap.eht_mcs_nss_supp.bw._320, 0,
1004 		       sizeof(iftype_data->eht_cap.eht_mcs_nss_supp.bw._320));
1005 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] &=
1006 			~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
1007 	}
1008 
1009 	if (trans->reduced_cap_sku) {
1010 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._80.rx_tx_mcs13_max_nss = 0;
1011 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._160.rx_tx_mcs13_max_nss = 0;
1012 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[8] &=
1013 			~IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA;
1014 	}
1015 }
1016 
1017 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1018 				 struct iwl_nvm_data *data,
1019 				 struct ieee80211_supported_band *sband,
1020 				 u8 tx_chains, u8 rx_chains,
1021 				 const struct iwl_fw *fw)
1022 {
1023 	struct ieee80211_sband_iftype_data *iftype_data;
1024 	int i;
1025 
1026 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1027 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1028 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1029 
1030 	switch (sband->band) {
1031 	case NL80211_BAND_2GHZ:
1032 		iftype_data = data->iftd.low;
1033 		break;
1034 	case NL80211_BAND_5GHZ:
1035 		iftype_data = data->iftd.high;
1036 		break;
1037 	case NL80211_BAND_6GHZ:
1038 		iftype_data = data->iftd.uhb;
1039 		break;
1040 	default:
1041 		WARN_ON(1);
1042 		return;
1043 	}
1044 
1045 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1046 
1047 	_ieee80211_set_sband_iftype_data(sband, iftype_data,
1048 					 ARRAY_SIZE(iwl_he_eht_capa));
1049 
1050 	for (i = 0; i < sband->n_iftype_data; i++)
1051 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1052 					 tx_chains, rx_chains, fw);
1053 
1054 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1055 }
1056 
1057 void iwl_reinit_cab(struct iwl_trans *trans, struct iwl_nvm_data *data,
1058 		    u8 tx_chains, u8 rx_chains, const struct iwl_fw *fw)
1059 {
1060 	struct ieee80211_supported_band *sband;
1061 
1062 	sband = &data->bands[NL80211_BAND_2GHZ];
1063 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1064 			     tx_chains, rx_chains);
1065 
1066 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1067 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1068 				     fw);
1069 
1070 	sband = &data->bands[NL80211_BAND_5GHZ];
1071 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1072 			     tx_chains, rx_chains);
1073 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1074 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1075 				      tx_chains, rx_chains);
1076 
1077 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1078 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1079 				     fw);
1080 
1081 	sband = &data->bands[NL80211_BAND_6GHZ];
1082 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1083 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1084 				     fw);
1085 }
1086 IWL_EXPORT_SYMBOL(iwl_reinit_cab);
1087 
1088 static void iwl_init_sbands(struct iwl_trans *trans,
1089 			    struct iwl_nvm_data *data,
1090 			    const void *nvm_ch_flags, u8 tx_chains,
1091 			    u8 rx_chains, u32 sbands_flags, bool v4,
1092 			    const struct iwl_fw *fw)
1093 {
1094 	struct device *dev = trans->dev;
1095 	int n_channels;
1096 	int n_used = 0;
1097 	struct ieee80211_supported_band *sband;
1098 
1099 	n_channels = iwl_init_channel_map(trans, fw, data, nvm_ch_flags,
1100 					  sbands_flags, v4);
1101 	sband = &data->bands[NL80211_BAND_2GHZ];
1102 	sband->band = NL80211_BAND_2GHZ;
1103 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1104 	sband->n_bitrates = N_RATES_24;
1105 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1106 					  NL80211_BAND_2GHZ);
1107 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1108 			     tx_chains, rx_chains);
1109 
1110 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1111 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1112 				     fw);
1113 
1114 	sband = &data->bands[NL80211_BAND_5GHZ];
1115 	sband->band = NL80211_BAND_5GHZ;
1116 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1117 	sband->n_bitrates = N_RATES_52;
1118 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1119 					  NL80211_BAND_5GHZ);
1120 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1121 			     tx_chains, rx_chains);
1122 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1123 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1124 				      tx_chains, rx_chains);
1125 
1126 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1127 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1128 				     fw);
1129 
1130 	/* 6GHz band. */
1131 	sband = &data->bands[NL80211_BAND_6GHZ];
1132 	sband->band = NL80211_BAND_6GHZ;
1133 	/* use the same rates as 5GHz band */
1134 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1135 	sband->n_bitrates = N_RATES_52;
1136 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1137 					  NL80211_BAND_6GHZ);
1138 
1139 	/*
1140 	 * 6 GHz requires WPA3 which requires MFP, which FW cannot do
1141 	 * when fips_enabled, so don't advertise any 6 GHz channels to
1142 	 * avoid spending time on scanning those channels and perhaps
1143 	 * even finding APs there that cannot be used.
1144 	 */
1145 	if (!fips_enabled && data->sku_cap_11ax_enable &&
1146 	    !iwlwifi_mod_params.disable_11ax)
1147 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1148 				     fw);
1149 	else
1150 		sband->n_channels = 0;
1151 
1152 	if (n_channels != n_used)
1153 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1154 			    n_used, n_channels);
1155 }
1156 
1157 static int iwl_get_sku(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw,
1158 		       const __le16 *phy_sku)
1159 {
1160 	if (cfg->nvm_type != IWL_NVM_EXT)
1161 		return le16_to_cpup(nvm_sw + SKU);
1162 
1163 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1164 }
1165 
1166 static int iwl_get_nvm_version(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw)
1167 {
1168 	if (cfg->nvm_type != IWL_NVM_EXT)
1169 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1170 	else
1171 		return le32_to_cpup((const __le32 *)(nvm_sw +
1172 						     NVM_VERSION_EXT_NVM));
1173 }
1174 
1175 static int iwl_get_radio_cfg(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw,
1176 			     const __le16 *phy_sku)
1177 {
1178 	if (cfg->nvm_type != IWL_NVM_EXT)
1179 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1180 
1181 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1182 
1183 }
1184 
1185 static int iwl_get_n_hw_addrs(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw)
1186 {
1187 	int n_hw_addr;
1188 
1189 	if (cfg->nvm_type != IWL_NVM_EXT)
1190 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1191 
1192 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1193 
1194 	return n_hw_addr & N_HW_ADDR_MASK;
1195 }
1196 
1197 static void iwl_set_radio_cfg(const struct iwl_rf_cfg *cfg,
1198 			      struct iwl_nvm_data *data,
1199 			      u32 radio_cfg)
1200 {
1201 	if (cfg->nvm_type != IWL_NVM_EXT) {
1202 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1203 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1204 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1205 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1206 		return;
1207 	}
1208 
1209 	/* set the radio configuration for family 8000 */
1210 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1211 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1212 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1213 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1214 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1215 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1216 }
1217 
1218 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1219 {
1220 	const u8 *hw_addr;
1221 
1222 	hw_addr = (const u8 *)&mac_addr0;
1223 	dest[0] = hw_addr[3];
1224 	dest[1] = hw_addr[2];
1225 	dest[2] = hw_addr[1];
1226 	dest[3] = hw_addr[0];
1227 
1228 	hw_addr = (const u8 *)&mac_addr1;
1229 	dest[4] = hw_addr[1];
1230 	dest[5] = hw_addr[0];
1231 }
1232 
1233 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1234 					struct iwl_nvm_data *data)
1235 {
1236 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1237 						  CSR_MAC_ADDR0_STRAP(trans)));
1238 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1239 						  CSR_MAC_ADDR1_STRAP(trans)));
1240 
1241 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1242 	/*
1243 	 * If the OEM fused a valid address, use it instead of the one in the
1244 	 * OTP
1245 	 */
1246 	if (is_valid_ether_addr(data->hw_addr))
1247 		return;
1248 
1249 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1250 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1251 
1252 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1253 }
1254 
1255 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1256 					   const struct iwl_rf_cfg *cfg,
1257 					   struct iwl_nvm_data *data,
1258 					   const __le16 *mac_override,
1259 					   const __be16 *nvm_hw)
1260 {
1261 	const u8 *hw_addr;
1262 
1263 	if (mac_override) {
1264 		static const u8 reserved_mac[] = {
1265 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1266 		};
1267 
1268 		hw_addr = (const u8 *)(mac_override +
1269 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1270 
1271 		/*
1272 		 * Store the MAC address from MAO section.
1273 		 * No byte swapping is required in MAO section
1274 		 */
1275 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1276 
1277 		/*
1278 		 * Force the use of the OTP MAC address in case of reserved MAC
1279 		 * address in the NVM, or if address is given but invalid.
1280 		 */
1281 		if (is_valid_ether_addr(data->hw_addr) &&
1282 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1283 			return;
1284 
1285 		IWL_ERR(trans,
1286 			"mac address from nvm override section is not valid\n");
1287 	}
1288 
1289 	if (nvm_hw) {
1290 		/* read the mac address from WFMP registers */
1291 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1292 						WFMP_MAC_ADDR_0));
1293 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1294 						WFMP_MAC_ADDR_1));
1295 
1296 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1297 
1298 		return;
1299 	}
1300 
1301 	IWL_ERR(trans, "mac address is not found\n");
1302 }
1303 
1304 static int iwl_set_hw_address(struct iwl_trans *trans,
1305 			      const struct iwl_rf_cfg *cfg,
1306 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1307 			      const __le16 *mac_override)
1308 {
1309 	const struct iwl_mac_cfg *mac_cfg = trans->mac_cfg;
1310 	if (mac_cfg->base->mac_addr_from_csr) {
1311 		iwl_set_hw_address_from_csr(trans, data);
1312 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1313 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1314 
1315 		/* The byte order is little endian 16 bit, meaning 214365 */
1316 		data->hw_addr[0] = hw_addr[1];
1317 		data->hw_addr[1] = hw_addr[0];
1318 		data->hw_addr[2] = hw_addr[3];
1319 		data->hw_addr[3] = hw_addr[2];
1320 		data->hw_addr[4] = hw_addr[5];
1321 		data->hw_addr[5] = hw_addr[4];
1322 	} else {
1323 		iwl_set_hw_address_family_8000(trans, cfg, data,
1324 					       mac_override, nvm_hw);
1325 	}
1326 
1327 	if (!is_valid_ether_addr(data->hw_addr)) {
1328 		IWL_ERR(trans, "no valid mac address was found\n");
1329 		return -EINVAL;
1330 	}
1331 
1332 	if (!trans->csme_own)
1333 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1334 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1335 
1336 	return 0;
1337 }
1338 
1339 static bool
1340 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1341 			const __be16 *nvm_hw)
1342 {
1343 	/*
1344 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1345 	 * some 7000-family OTPs erroneously allow wide channels in
1346 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1347 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1348 	 * 9.  In those cases, we need to force-disable wide channels
1349 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1350 	 * to use them.
1351 	 */
1352 	if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1353 		/*
1354 		 * Unlike the other sections in the NVM, the hw
1355 		 * section uses big-endian.
1356 		 */
1357 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1358 		u8 sku = (subsystem_id & 0x1e) >> 1;
1359 
1360 		if (sku == 5 || sku == 9) {
1361 			IWL_DEBUG_EEPROM(trans->dev,
1362 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1363 					 subsystem_id, sku);
1364 			return true;
1365 		}
1366 	}
1367 
1368 	return false;
1369 }
1370 
1371 struct iwl_nvm_data *
1372 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1373 		       const struct iwl_mei_nvm *mei_nvm,
1374 		       const struct iwl_fw *fw, u8 tx_ant, u8 rx_ant)
1375 {
1376 	struct iwl_nvm_data *data;
1377 	u32 sbands_flags = 0;
1378 	u8 rx_chains = fw->valid_rx_ant;
1379 	u8 tx_chains = fw->valid_rx_ant;
1380 
1381 	if (cfg->uhb_supported)
1382 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UHB);
1383 	else
1384 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_EXT);
1385 	if (!data)
1386 		return NULL;
1387 
1388 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1389 		     IWL_NVM_NUM_CHANNELS_UHB);
1390 	data->nvm_version = mei_nvm->nvm_version;
1391 
1392 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1393 	if (data->valid_tx_ant)
1394 		tx_chains &= data->valid_tx_ant;
1395 	if (data->valid_rx_ant)
1396 		rx_chains &= data->valid_rx_ant;
1397 	if (tx_ant)
1398 		tx_chains &= tx_ant;
1399 	if (rx_ant)
1400 		rx_chains &= rx_ant;
1401 
1402 	data->sku_cap_mimo_disabled = false;
1403 	data->sku_cap_band_24ghz_enable = true;
1404 	data->sku_cap_band_52ghz_enable = true;
1405 	data->sku_cap_11n_enable =
1406 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1407 	data->sku_cap_11ac_enable = true;
1408 	data->sku_cap_11ax_enable =
1409 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1410 
1411 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1412 
1413 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1414 	/* If no valid mac address was found - bail out */
1415 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1416 		kfree(data);
1417 		return NULL;
1418 	}
1419 
1420 	if (data->lar_enabled &&
1421 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1422 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1423 
1424 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1425 			sbands_flags, true, fw);
1426 
1427 	return data;
1428 }
1429 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1430 
1431 struct iwl_nvm_data *
1432 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1433 		   const struct iwl_fw *fw,
1434 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1435 		   const __le16 *nvm_calib, const __le16 *regulatory,
1436 		   const __le16 *mac_override, const __le16 *phy_sku,
1437 		   u8 tx_chains, u8 rx_chains)
1438 {
1439 	struct iwl_nvm_data *data;
1440 	bool lar_enabled;
1441 	u32 sku, radio_cfg;
1442 	u32 sbands_flags = 0;
1443 	u16 lar_config;
1444 	const __le16 *ch_section;
1445 
1446 	if (cfg->uhb_supported)
1447 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UHB);
1448 	else if (cfg->nvm_type != IWL_NVM_EXT)
1449 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS);
1450 	else
1451 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_EXT);
1452 	if (!data)
1453 		return NULL;
1454 
1455 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1456 
1457 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1458 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1459 	if (data->valid_tx_ant)
1460 		tx_chains &= data->valid_tx_ant;
1461 	if (data->valid_rx_ant)
1462 		rx_chains &= data->valid_rx_ant;
1463 
1464 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1465 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1466 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1467 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1468 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1469 		data->sku_cap_11n_enable = false;
1470 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1471 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1472 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1473 
1474 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1475 
1476 	if (cfg->nvm_type != IWL_NVM_EXT) {
1477 		/* Checking for required sections */
1478 		if (!nvm_calib) {
1479 			IWL_ERR(trans,
1480 				"Can't parse empty Calib NVM sections\n");
1481 			kfree(data);
1482 			return NULL;
1483 		}
1484 
1485 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1486 			     &regulatory[NVM_CHANNELS_SDP] :
1487 			     &nvm_sw[NVM_CHANNELS];
1488 
1489 		lar_enabled = true;
1490 	} else {
1491 		u16 lar_offset = data->nvm_version < 0xE39 ?
1492 				 NVM_LAR_OFFSET_OLD :
1493 				 NVM_LAR_OFFSET;
1494 
1495 		lar_config = le16_to_cpup(regulatory + lar_offset);
1496 		data->lar_enabled = !!(lar_config &
1497 				       NVM_LAR_ENABLED);
1498 		lar_enabled = data->lar_enabled;
1499 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1500 	}
1501 
1502 	/* If no valid mac address was found - bail out */
1503 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1504 		kfree(data);
1505 		return NULL;
1506 	}
1507 
1508 	if (lar_enabled &&
1509 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1510 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1511 
1512 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1513 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1514 
1515 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1516 			sbands_flags, false, fw);
1517 	data->calib_version = 255;
1518 
1519 	return data;
1520 }
1521 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1522 
1523 VISIBLE_IF_IWLWIFI_KUNIT
1524 u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1525 				int ch_idx, u16 nvm_flags,
1526 				struct iwl_reg_capa reg_capa)
1527 {
1528 	u32 flags = NL80211_RRF_NO_HT40;
1529 
1530 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1531 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1532 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1533 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1534 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1535 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1536 	} else if (ch_idx < NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS &&
1537 		   nvm_flags & NVM_CHANNEL_40MHZ) {
1538 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1539 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1540 		else
1541 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1542 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1543 		flags &= ~NL80211_RRF_NO_HT40PLUS;
1544 		flags &= ~NL80211_RRF_NO_HT40MINUS;
1545 	}
1546 
1547 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1548 		flags |= NL80211_RRF_NO_80MHZ;
1549 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1550 		flags |= NL80211_RRF_NO_160MHZ;
1551 
1552 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1553 		flags |= NL80211_RRF_NO_IR;
1554 
1555 	if (nvm_flags & NVM_CHANNEL_RADAR)
1556 		flags |= NL80211_RRF_DFS;
1557 
1558 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1559 		flags |= NL80211_RRF_NO_OUTDOOR;
1560 
1561 	if (nvm_flags & NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY &&
1562 	    flags & NL80211_RRF_NO_IR)
1563 		flags |= NL80211_RRF_ALLOW_20MHZ_ACTIVITY;
1564 
1565 	/* Set the GO concurrent flag only in case that NO_IR is set.
1566 	 * Otherwise it is meaningless
1567 	 */
1568 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT)) {
1569 		if (flags & NL80211_RRF_NO_IR)
1570 			flags |= NL80211_RRF_GO_CONCURRENT;
1571 		if (flags & NL80211_RRF_DFS) {
1572 			flags |= NL80211_RRF_DFS_CONCURRENT;
1573 			/* Our device doesn't set active bit for DFS channels
1574 			 * however, once marked as DFS no-ir is not needed.
1575 			 */
1576 			flags &= ~NL80211_RRF_NO_IR;
1577 		}
1578 	}
1579 
1580 	/* Set the AP type for the UHB case. */
1581 	if (nvm_flags & NVM_CHANNEL_VLP) {
1582 		if (!(nvm_flags & NVM_CHANNEL_VLP_AP_NOT_ALLOWED))
1583 			flags |= NL80211_RRF_ALLOW_6GHZ_VLP_AP;
1584 	} else {
1585 		flags |= NL80211_RRF_NO_6GHZ_VLP_CLIENT;
1586 	}
1587 
1588 	if (!(nvm_flags & NVM_CHANNEL_AFC))
1589 		flags |= NL80211_RRF_NO_6GHZ_AFC_CLIENT;
1590 
1591 	/*
1592 	 * reg_capa is per regulatory domain so apply it for every channel
1593 	 */
1594 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1595 		if (!reg_capa.allow_40mhz)
1596 			flags |= NL80211_RRF_NO_HT40;
1597 
1598 		if (!reg_capa.allow_80mhz)
1599 			flags |= NL80211_RRF_NO_80MHZ;
1600 
1601 		if (!reg_capa.allow_160mhz)
1602 			flags |= NL80211_RRF_NO_160MHZ;
1603 
1604 		if (!reg_capa.allow_320mhz)
1605 			flags |= NL80211_RRF_NO_320MHZ;
1606 	}
1607 
1608 	if (reg_capa.disable_11ax)
1609 		flags |= NL80211_RRF_NO_HE;
1610 
1611 	if (reg_capa.disable_11be)
1612 		flags |= NL80211_RRF_NO_EHT;
1613 
1614 	return flags;
1615 }
1616 EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_nvm_get_regdom_bw_flags);
1617 
1618 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1619 {
1620 	struct iwl_reg_capa reg_capa = {};
1621 
1622 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1623 		reg_capa.allow_40mhz = true;
1624 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1625 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1626 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1627 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1628 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1629 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1630 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1631 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1632 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1633 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1634 	} else {
1635 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1636 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1637 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1638 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1639 	}
1640 	return reg_capa;
1641 }
1642 
1643 struct ieee80211_regdomain *
1644 iwl_parse_nvm_mcc_info(struct iwl_trans *trans,
1645 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1646 		       u16 geo_info, u32 cap, u8 resp_ver)
1647 {
1648 	const struct iwl_rf_cfg *cfg = trans->cfg;
1649 	struct device *dev = trans->dev;
1650 	int ch_idx;
1651 	u16 ch_flags;
1652 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1653 	const u16 *nvm_chan;
1654 	struct ieee80211_regdomain *regd, *copy_rd;
1655 	struct ieee80211_reg_rule *rule;
1656 	int center_freq, prev_center_freq = 0;
1657 	int valid_rules = 0;
1658 	bool new_rule;
1659 	int max_num_ch;
1660 	struct iwl_reg_capa reg_capa;
1661 
1662 	if (cfg->uhb_supported) {
1663 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1664 		nvm_chan = iwl_uhb_nvm_channels;
1665 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1666 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1667 		nvm_chan = iwl_ext_nvm_channels;
1668 	} else {
1669 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1670 		nvm_chan = iwl_nvm_channels;
1671 	}
1672 
1673 	if (num_of_ch > max_num_ch) {
1674 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1675 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1676 			      num_of_ch, max_num_ch);
1677 		num_of_ch = max_num_ch;
1678 	}
1679 
1680 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1681 		return ERR_PTR(-EINVAL);
1682 
1683 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1684 		      num_of_ch);
1685 
1686 	/* build a regdomain rule for every valid channel */
1687 	regd = kzalloc_flex(*regd, reg_rules, num_of_ch);
1688 	if (!regd)
1689 		return ERR_PTR(-ENOMEM);
1690 
1691 	/* set alpha2 from FW. */
1692 	regd->alpha2[0] = fw_mcc >> 8;
1693 	regd->alpha2[1] = fw_mcc & 0xff;
1694 
1695 	/* parse regulatory capability flags */
1696 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1697 
1698 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1699 		enum nl80211_band band =
1700 			iwl_nl80211_band_from_channel_idx(ch_idx);
1701 
1702 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1703 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1704 							     band);
1705 		new_rule = false;
1706 
1707 		if (IWL_FW_CHECK(trans, !center_freq,
1708 				 "Invalid channel %d (idx %d) in NVM\n",
1709 				 nvm_chan[ch_idx], ch_idx))
1710 			continue;
1711 
1712 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1713 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1714 						    nvm_chan[ch_idx], ch_flags);
1715 			continue;
1716 		}
1717 
1718 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1719 							     ch_flags,
1720 							     reg_capa);
1721 
1722 		/* we can't continue the same rule */
1723 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1724 		    center_freq - prev_center_freq > 20) {
1725 			valid_rules++;
1726 			new_rule = true;
1727 		}
1728 
1729 		rule = &regd->reg_rules[valid_rules - 1];
1730 
1731 		if (new_rule)
1732 			rule->freq_range.start_freq_khz =
1733 						MHZ_TO_KHZ(center_freq - 10);
1734 
1735 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1736 
1737 		/* this doesn't matter - not used by FW */
1738 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1739 		rule->power_rule.max_eirp =
1740 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1741 
1742 		rule->flags = reg_rule_flags;
1743 
1744 		/* rely on auto-calculation to merge BW of contiguous chans */
1745 		rule->flags |= NL80211_RRF_AUTO_BW;
1746 		rule->freq_range.max_bandwidth_khz = 0;
1747 
1748 		prev_center_freq = center_freq;
1749 		prev_reg_rule_flags = reg_rule_flags;
1750 
1751 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1752 					    nvm_chan[ch_idx], ch_flags);
1753 
1754 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1755 		    band == NL80211_BAND_2GHZ)
1756 			continue;
1757 
1758 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1759 	}
1760 
1761 	/*
1762 	 * Certain firmware versions might report no valid channels
1763 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1764 	 * running. We'll get out of this situation later when the
1765 	 * rfkill is removed and we update the regdomain again, but
1766 	 * since cfg80211 doesn't accept an empty regdomain, add a
1767 	 * dummy (unusable) rule here in this case so we can init.
1768 	 */
1769 	if (!valid_rules) {
1770 		valid_rules = 1;
1771 		rule = &regd->reg_rules[valid_rules - 1];
1772 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1773 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1774 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1775 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1776 		rule->power_rule.max_eirp =
1777 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1778 	}
1779 
1780 	regd->n_reg_rules = valid_rules;
1781 
1782 	/*
1783 	 * Narrow down regdom for unused regulatory rules to prevent hole
1784 	 * between reg rules to wmm rules.
1785 	 */
1786 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1787 			  GFP_KERNEL);
1788 	if (!copy_rd)
1789 		copy_rd = ERR_PTR(-ENOMEM);
1790 
1791 	kfree(regd);
1792 	return copy_rd;
1793 }
1794 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1795 
1796 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1797 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1798 #define MAX_NVM_FILE_LEN	16384
1799 
1800 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1801 		    unsigned int len)
1802 {
1803 #define IWL_4165_DEVICE_ID	0x5501
1804 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1805 
1806 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1807 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1808 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1809 		/* OTP 0x52 bug work around: it's a 1x1 device */
1810 		data[3] = ANT_B | (ANT_B << 4);
1811 }
1812 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1813 
1814 /*
1815  * Reads external NVM from a file into mvm->nvm_sections
1816  *
1817  * HOW TO CREATE THE NVM FILE FORMAT:
1818  * ------------------------------
1819  * 1. create hex file, format:
1820  *      3800 -> header
1821  *      0000 -> header
1822  *      5a40 -> data
1823  *
1824  *   rev - 6 bit (word1)
1825  *   len - 10 bit (word1)
1826  *   id - 4 bit (word2)
1827  *   rsv - 12 bit (word2)
1828  *
1829  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1830  *
1831  * 3. create binary file from the hex file
1832  *
1833  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1834  */
1835 int iwl_read_external_nvm(struct iwl_trans *trans,
1836 			  const char *nvm_file_name,
1837 			  struct iwl_nvm_section *nvm_sections)
1838 {
1839 	int ret, section_size;
1840 	u16 section_id;
1841 	const struct firmware *fw_entry;
1842 	const struct {
1843 		__le16 word1;
1844 		__le16 word2;
1845 		u8 data[];
1846 	} *file_sec;
1847 	const u8 *eof;
1848 	u8 *temp;
1849 	int max_section_size;
1850 	const __le32 *dword_buff;
1851 
1852 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1853 #define NVM_WORD2_ID(x) (x >> 12)
1854 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1855 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1856 #define NVM_HEADER_0	(0x2A504C54)
1857 #define NVM_HEADER_1	(0x4E564D2A)
1858 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1859 
1860 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1861 
1862 	/* Maximal size depends on NVM version */
1863 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1864 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1865 	else
1866 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1867 
1868 	/*
1869 	 * Obtain NVM image via request_firmware. Since we already used
1870 	 * request_firmware_nowait() for the firmware binary load and only
1871 	 * get here after that we assume the NVM request can be satisfied
1872 	 * synchronously.
1873 	 */
1874 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1875 	if (ret) {
1876 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1877 			nvm_file_name, ret);
1878 		return ret;
1879 	}
1880 
1881 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1882 		 nvm_file_name, fw_entry->size);
1883 
1884 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1885 		IWL_ERR(trans, "NVM file too large\n");
1886 		ret = -EINVAL;
1887 		goto out;
1888 	}
1889 
1890 	eof = fw_entry->data + fw_entry->size;
1891 	dword_buff = (const __le32 *)fw_entry->data;
1892 
1893 	/* some NVM file will contain a header.
1894 	 * The header is identified by 2 dwords header as follow:
1895 	 * dword[0] = 0x2A504C54
1896 	 * dword[1] = 0x4E564D2A
1897 	 *
1898 	 * This header must be skipped when providing the NVM data to the FW.
1899 	 */
1900 	if (fw_entry->size > NVM_HEADER_SIZE &&
1901 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1902 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1903 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1904 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1905 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1906 			 le32_to_cpu(dword_buff[3]));
1907 
1908 		/* nvm file validation, dword_buff[2] holds the file version */
1909 		if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1910 		    trans->info.hw_rev_step == SILICON_C_STEP &&
1911 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1912 			ret = -EFAULT;
1913 			goto out;
1914 		}
1915 	} else {
1916 		file_sec = (const void *)fw_entry->data;
1917 	}
1918 
1919 	while (true) {
1920 		if (file_sec->data > eof) {
1921 			IWL_ERR(trans,
1922 				"ERROR - NVM file too short for section header\n");
1923 			ret = -EINVAL;
1924 			break;
1925 		}
1926 
1927 		/* check for EOF marker */
1928 		if (!file_sec->word1 && !file_sec->word2) {
1929 			ret = 0;
1930 			break;
1931 		}
1932 
1933 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
1934 			section_size =
1935 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
1936 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
1937 		} else {
1938 			section_size = 2 * EXT_NVM_WORD2_LEN(
1939 						le16_to_cpu(file_sec->word2));
1940 			section_id = EXT_NVM_WORD1_ID(
1941 						le16_to_cpu(file_sec->word1));
1942 		}
1943 
1944 		if (section_size > max_section_size) {
1945 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
1946 				section_size);
1947 			ret = -EINVAL;
1948 			break;
1949 		}
1950 
1951 		if (!section_size) {
1952 			IWL_ERR(trans, "ERROR - section empty\n");
1953 			ret = -EINVAL;
1954 			break;
1955 		}
1956 
1957 		if (file_sec->data + section_size > eof) {
1958 			IWL_ERR(trans,
1959 				"ERROR - NVM file too short for section (%d bytes)\n",
1960 				section_size);
1961 			ret = -EINVAL;
1962 			break;
1963 		}
1964 
1965 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
1966 			 "Invalid NVM section ID %d\n", section_id)) {
1967 			ret = -EINVAL;
1968 			break;
1969 		}
1970 
1971 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
1972 		if (!temp) {
1973 			ret = -ENOMEM;
1974 			break;
1975 		}
1976 
1977 		iwl_nvm_fixups(trans->info.hw_id, section_id, temp, section_size);
1978 
1979 		kfree(nvm_sections[section_id].data);
1980 		nvm_sections[section_id].data = temp;
1981 		nvm_sections[section_id].length = section_size;
1982 
1983 		/* advance to the next section */
1984 		file_sec = (const void *)(file_sec->data + section_size);
1985 	}
1986 out:
1987 	release_firmware(fw_entry);
1988 	return ret;
1989 }
1990 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
1991 
1992 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
1993 				 const struct iwl_fw *fw,
1994 				 u8 set_tx_ant, u8 set_rx_ant)
1995 {
1996 	struct iwl_nvm_get_info cmd = {};
1997 	struct iwl_nvm_data *nvm;
1998 	struct iwl_host_cmd hcmd = {
1999 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
2000 		.data = { &cmd, },
2001 		.len = { sizeof(cmd) },
2002 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
2003 	};
2004 	int  ret;
2005 	bool empty_otp;
2006 	u32 mac_flags;
2007 	u32 sbands_flags = 0;
2008 	u8 tx_ant;
2009 	u8 rx_ant;
2010 
2011 	/*
2012 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
2013 	 * in v3, except for the channel profile part of the
2014 	 * regulatory.  So we can just access the new struct, with the
2015 	 * exception of the latter.
2016 	 */
2017 	struct iwl_nvm_get_info_rsp *rsp;
2018 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
2019 	bool v4 = fw_has_api(&fw->ucode_capa,
2020 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
2021 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
2022 	void *channel_profile;
2023 
2024 	ret = iwl_trans_send_cmd(trans, &hcmd);
2025 	if (ret)
2026 		return ERR_PTR(ret);
2027 
2028 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
2029 		 "Invalid payload len in NVM response from FW %d",
2030 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
2031 		ret = -EINVAL;
2032 		goto out;
2033 	}
2034 
2035 	rsp = (void *)hcmd.resp_pkt->data;
2036 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
2037 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
2038 	if (empty_otp)
2039 		IWL_INFO(trans, "OTP is empty\n");
2040 
2041 	nvm = kzalloc_flex(*nvm, channels, IWL_NUM_CHANNELS_V2);
2042 	if (!nvm) {
2043 		ret = -ENOMEM;
2044 		goto out;
2045 	}
2046 
2047 	iwl_set_hw_address_from_csr(trans, nvm);
2048 	/* TODO: if platform NVM has MAC address - override it here */
2049 
2050 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2051 		IWL_ERR(trans, "no valid mac address was found\n");
2052 		ret = -EINVAL;
2053 		goto err_free;
2054 	}
2055 
2056 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2057 
2058 	/* Initialize general data */
2059 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2060 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2061 	if (nvm->n_hw_addrs == 0)
2062 		IWL_WARN(trans,
2063 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2064 			 empty_otp);
2065 
2066 	/* Initialize MAC sku data */
2067 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2068 	nvm->sku_cap_11ac_enable =
2069 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2070 	nvm->sku_cap_11n_enable =
2071 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2072 	nvm->sku_cap_11ax_enable =
2073 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2074 	nvm->sku_cap_band_24ghz_enable =
2075 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2076 	nvm->sku_cap_band_52ghz_enable =
2077 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2078 	nvm->sku_cap_mimo_disabled =
2079 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2080 	if (trans->cfg->eht_supported)
2081 		nvm->sku_cap_11be_enable = true;
2082 
2083 	/* Initialize PHY sku data */
2084 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2085 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2086 
2087 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2088 	    fw_has_capa(&fw->ucode_capa,
2089 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2090 		nvm->lar_enabled = true;
2091 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2092 	}
2093 
2094 	rsp_v3 = (void *)rsp;
2095 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2096 			  (void *)rsp_v3->regulatory.channel_profile;
2097 
2098 	tx_ant = nvm->valid_tx_ant & fw->valid_tx_ant;
2099 	rx_ant = nvm->valid_rx_ant & fw->valid_rx_ant;
2100 
2101 	if (set_tx_ant)
2102 		tx_ant &= set_tx_ant;
2103 	if (set_rx_ant)
2104 		rx_ant &= set_rx_ant;
2105 
2106 	iwl_init_sbands(trans, nvm, channel_profile, tx_ant, rx_ant,
2107 			sbands_flags, v4, fw);
2108 
2109 	iwl_free_resp(&hcmd);
2110 	return nvm;
2111 
2112 err_free:
2113 	kfree(nvm);
2114 out:
2115 	iwl_free_resp(&hcmd);
2116 	return ERR_PTR(ret);
2117 }
2118 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2119