xref: /freebsd/sys/contrib/dev/iwlwifi/iwl-nvm-parse.c (revision 5036d9652a5701d00e9e40ea942c278e9f77d33d)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM REGULATORY -Section offset (in words) definitions */
42 	NVM_CHANNELS_SDP = 0,
43 };
44 
45 enum ext_nvm_offsets {
46 	/* NVM HW-Section offset (in words) definitions */
47 
48 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
49 
50 	/* NVM SW-Section offset (in words) definitions */
51 	NVM_VERSION_EXT_NVM = 0,
52 	N_HW_ADDRS_FAMILY_8000 = 3,
53 
54 	/* NVM PHY_SKU-Section offset (in words) definitions */
55 	RADIO_CFG_FAMILY_EXT_NVM = 0,
56 	SKU_FAMILY_8000 = 2,
57 
58 	/* NVM REGULATORY -Section offset (in words) definitions */
59 	NVM_CHANNELS_EXTENDED = 0,
60 	NVM_LAR_OFFSET_OLD = 0x4C7,
61 	NVM_LAR_OFFSET = 0x507,
62 	NVM_LAR_ENABLED = 0x7,
63 };
64 
65 /* SKU Capabilities (actual values from NVM definition) */
66 enum nvm_sku_bits {
67 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
68 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
69 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
70 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
71 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
72 };
73 
74 /*
75  * These are the channel numbers in the order that they are stored in the NVM
76  */
77 static const u16 iwl_nvm_channels[] = {
78 	/* 2.4 GHz */
79 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
80 	/* 5 GHz */
81 	36, 40, 44, 48, 52, 56, 60, 64,
82 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
83 	149, 153, 157, 161, 165
84 };
85 
86 static const u16 iwl_ext_nvm_channels[] = {
87 	/* 2.4 GHz */
88 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
89 	/* 5 GHz */
90 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
91 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
92 	149, 153, 157, 161, 165, 169, 173, 177, 181
93 };
94 
95 static const u16 iwl_uhb_nvm_channels[] = {
96 	/* 2.4 GHz */
97 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
98 	/* 5 GHz */
99 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
100 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
101 	149, 153, 157, 161, 165, 169, 173, 177, 181,
102 	/* 6-7 GHz */
103 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
104 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
105 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
106 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
107 };
108 
109 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
110 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
111 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
112 #define NUM_2GHZ_CHANNELS		14
113 #define NUM_5GHZ_CHANNELS		37
114 #define FIRST_2GHZ_HT_MINUS		5
115 #define LAST_2GHZ_HT_PLUS		9
116 #define N_HW_ADDR_MASK			0xF
117 
118 /* rate data (static) */
119 static struct ieee80211_rate iwl_cfg80211_rates[] = {
120 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
121 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
122 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
123 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
124 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
125 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
126 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
127 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
128 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
129 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
130 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
131 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
132 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
133 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
134 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
135 };
136 #define RATES_24_OFFS	0
137 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
138 #define RATES_52_OFFS	4
139 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
140 
141 /**
142  * enum iwl_nvm_channel_flags - channel flags in NVM
143  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
144  * @NVM_CHANNEL_IBSS: usable as an IBSS channel
145  * @NVM_CHANNEL_ACTIVE: active scanning allowed
146  * @NVM_CHANNEL_RADAR: radar detection required
147  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
148  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
149  *	on same channel on 2.4 or same UNII band on 5.2
150  * @NVM_CHANNEL_UNIFORM: uniform spreading required
151  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
152  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
153  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
154  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
155  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
156  * @NVM_CHANNEL_VLP: client support connection to UHB VLP AP
157  * @NVM_CHANNEL_AFC: client support connection to UHB AFC AP
158  */
159 enum iwl_nvm_channel_flags {
160 	NVM_CHANNEL_VALID		= BIT(0),
161 	NVM_CHANNEL_IBSS		= BIT(1),
162 	NVM_CHANNEL_ACTIVE		= BIT(3),
163 	NVM_CHANNEL_RADAR		= BIT(4),
164 	NVM_CHANNEL_INDOOR_ONLY		= BIT(5),
165 	NVM_CHANNEL_GO_CONCURRENT	= BIT(6),
166 	NVM_CHANNEL_UNIFORM		= BIT(7),
167 	NVM_CHANNEL_20MHZ		= BIT(8),
168 	NVM_CHANNEL_40MHZ		= BIT(9),
169 	NVM_CHANNEL_80MHZ		= BIT(10),
170 	NVM_CHANNEL_160MHZ		= BIT(11),
171 	NVM_CHANNEL_DC_HIGH		= BIT(12),
172 	NVM_CHANNEL_VLP			= BIT(13),
173 	NVM_CHANNEL_AFC			= BIT(14),
174 };
175 
176 /**
177  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
178  * domain.
179  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
180  *	2.4Ghz band is allowed.
181  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
182  *	5Ghz band is allowed.
183  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
184  *	for this regulatory domain (valid only in 5Ghz).
185  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
186  *	for this regulatory domain (valid only in 5Ghz).
187  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
188  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
189  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
190  *	for this regulatory domain (valid only in 5Ghz).
191  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
192  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
193  */
194 enum iwl_reg_capa_flags_v1 {
195 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
196 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
197 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
198 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
199 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
200 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
201 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
202 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
203 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
204 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
205 
206 /**
207  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
208  * domain (version 2).
209  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
210  *	disabled.
211  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
212  *	2.4Ghz band is allowed.
213  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
214  *	5Ghz band is allowed.
215  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
216  *	for this regulatory domain (valid only in 5Ghz).
217  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
218  *	for this regulatory domain (valid only in 5Ghz).
219  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
220  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
221  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
222  *	126, 122) are disabled.
223  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
224  *	for this regulatory domain (uvalid only in 5Ghz).
225  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
226  */
227 enum iwl_reg_capa_flags_v2 {
228 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
229 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
230 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
231 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
232 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
233 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
234 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
235 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
236 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
237 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
238 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
239 
240 /**
241  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
242  * domain.
243  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
244  *	for this regulatory domain (valid only in 5Ghz).
245  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
246  *	for this regulatory domain (valid only in 5Ghz).
247  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
248  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
249  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
250  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
251  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
252  *	for this regulatory domain (valid only in 5GHz).
253  */
254 enum iwl_reg_capa_flags_v4 {
255 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
256 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
257 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
258 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
259 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
260 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
261 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
262 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
263 
264 /*
265 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
266 * MCC update command response.
267 */
268 #define REG_CAPA_V2_RESP_VER	6
269 
270 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
271  * MCC update command response.
272  */
273 #define REG_CAPA_V4_RESP_VER	8
274 
275 /**
276  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
277  * handling the different APIs of reg_capa_flags.
278  *
279  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
280  *	for this regulatory domain.
281  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
282  *	for this regulatory domain (valid only in 5 and 6 Ghz).
283  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
284  *	for this regulatory domain (valid only in 5 and 6 Ghz).
285  * @allow_320mhz: 11be channel with a width of 320Mhz is allowed
286  *	for this regulatory domain (valid only in 6 Ghz).
287  * @disable_11ax: 11ax is forbidden for this regulatory domain.
288  * @disable_11be: 11be is forbidden for this regulatory domain.
289  */
290 struct iwl_reg_capa {
291 	bool allow_40mhz;
292 	bool allow_80mhz;
293 	bool allow_160mhz;
294 	bool allow_320mhz;
295 	bool disable_11ax;
296 	bool disable_11be;
297 };
298 
299 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
300 					       int chan, u32 flags)
301 {
302 #define CHECK_AND_PRINT_I(x)	\
303 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
304 
305 	if (!(flags & NVM_CHANNEL_VALID)) {
306 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
307 			      chan, flags);
308 		return;
309 	}
310 
311 	/* Note: already can print up to 101 characters, 110 is the limit! */
312 	IWL_DEBUG_DEV(dev, level,
313 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
314 		      chan, flags,
315 		      CHECK_AND_PRINT_I(VALID),
316 		      CHECK_AND_PRINT_I(IBSS),
317 		      CHECK_AND_PRINT_I(ACTIVE),
318 		      CHECK_AND_PRINT_I(RADAR),
319 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
320 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
321 		      CHECK_AND_PRINT_I(UNIFORM),
322 		      CHECK_AND_PRINT_I(20MHZ),
323 		      CHECK_AND_PRINT_I(40MHZ),
324 		      CHECK_AND_PRINT_I(80MHZ),
325 		      CHECK_AND_PRINT_I(160MHZ),
326 		      CHECK_AND_PRINT_I(DC_HIGH),
327 		      CHECK_AND_PRINT_I(VLP),
328 		      CHECK_AND_PRINT_I(AFC));
329 #undef CHECK_AND_PRINT_I
330 }
331 
332 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
333 				 u32 nvm_flags, const struct iwl_cfg *cfg)
334 {
335 	u32 flags = IEEE80211_CHAN_NO_HT40;
336 
337 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
338 		if (ch_num <= LAST_2GHZ_HT_PLUS)
339 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
340 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
341 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
342 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
343 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
344 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
345 		else
346 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
347 	}
348 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
349 		flags |= IEEE80211_CHAN_NO_80MHZ;
350 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
351 		flags |= IEEE80211_CHAN_NO_160MHZ;
352 
353 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
354 		flags |= IEEE80211_CHAN_NO_IR;
355 
356 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
357 		flags |= IEEE80211_CHAN_NO_IR;
358 
359 	if (nvm_flags & NVM_CHANNEL_RADAR)
360 		flags |= IEEE80211_CHAN_RADAR;
361 
362 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
363 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
364 
365 	/* Set the GO concurrent flag only in case that NO_IR is set.
366 	 * Otherwise it is meaningless
367 	 */
368 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
369 	    (flags & IEEE80211_CHAN_NO_IR))
370 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
371 
372 	/* Set the AP type for the UHB case. */
373 	if (nvm_flags & NVM_CHANNEL_VLP)
374 		flags |= IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP;
375 	else
376 		flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
377 	if (!(nvm_flags & NVM_CHANNEL_AFC))
378 		flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
379 
380 	return flags;
381 }
382 
383 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
384 {
385 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
386 		return NL80211_BAND_6GHZ;
387 	}
388 
389 	if (ch_idx >= NUM_2GHZ_CHANNELS)
390 		return NL80211_BAND_5GHZ;
391 	return NL80211_BAND_2GHZ;
392 }
393 
394 static int iwl_init_channel_map(struct iwl_trans *trans,
395 				const struct iwl_fw *fw,
396 				struct iwl_nvm_data *data,
397 				const void * const nvm_ch_flags,
398 				u32 sbands_flags, bool v4)
399 {
400 	const struct iwl_cfg *cfg = trans->cfg;
401 	struct device *dev = trans->dev;
402 	int ch_idx;
403 	int n_channels = 0;
404 	struct ieee80211_channel *channel;
405 	u32 ch_flags;
406 	int num_of_ch;
407 	const u16 *nvm_chan;
408 
409 	if (cfg->uhb_supported) {
410 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
411 		nvm_chan = iwl_uhb_nvm_channels;
412 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
413 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
414 		nvm_chan = iwl_ext_nvm_channels;
415 	} else {
416 		num_of_ch = IWL_NVM_NUM_CHANNELS;
417 		nvm_chan = iwl_nvm_channels;
418 	}
419 
420 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
421 		enum nl80211_band band =
422 			iwl_nl80211_band_from_channel_idx(ch_idx);
423 
424 		if (v4)
425 			ch_flags =
426 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
427 		else
428 			ch_flags =
429 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
430 
431 		if (band == NL80211_BAND_5GHZ &&
432 		    !data->sku_cap_band_52ghz_enable)
433 			continue;
434 
435 		/* workaround to disable wide channels in 5GHz */
436 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
437 		    band == NL80211_BAND_5GHZ) {
438 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
439 				     NVM_CHANNEL_80MHZ |
440 				     NVM_CHANNEL_160MHZ);
441 		}
442 
443 		if (ch_flags & NVM_CHANNEL_160MHZ)
444 			data->vht160_supported = true;
445 
446 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
447 		    !(ch_flags & NVM_CHANNEL_VALID)) {
448 			/*
449 			 * Channels might become valid later if lar is
450 			 * supported, hence we still want to add them to
451 			 * the list of supported channels to cfg80211.
452 			 */
453 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
454 						    nvm_chan[ch_idx], ch_flags);
455 			continue;
456 		}
457 
458 		channel = &data->channels[n_channels];
459 		n_channels++;
460 
461 		channel->hw_value = nvm_chan[ch_idx];
462 		channel->band = band;
463 		channel->center_freq =
464 			ieee80211_channel_to_frequency(
465 				channel->hw_value, channel->band);
466 
467 		/* Initialize regulatory-based run-time data */
468 
469 		/*
470 		 * Default value - highest tx power value.  max_power
471 		 * is not used in mvm, and is used for backwards compatibility
472 		 */
473 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
474 
475 		/* don't put limitations in case we're using LAR */
476 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
477 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
478 							       ch_idx, band,
479 							       ch_flags, cfg);
480 		else
481 			channel->flags = 0;
482 
483 		if (fw_has_capa(&fw->ucode_capa,
484 				IWL_UCODE_TLV_CAPA_MONITOR_PASSIVE_CHANS))
485 			channel->flags |= IEEE80211_CHAN_CAN_MONITOR;
486 
487 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
488 					    channel->hw_value, ch_flags);
489 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
490 				 channel->hw_value, channel->max_power);
491 	}
492 
493 	return n_channels;
494 }
495 
496 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
497 				  struct iwl_nvm_data *data,
498 				  struct ieee80211_sta_vht_cap *vht_cap,
499 				  u8 tx_chains, u8 rx_chains)
500 {
501 	const struct iwl_cfg *cfg = trans->cfg;
502 	int num_rx_ants = num_of_ant(rx_chains);
503 	int num_tx_ants = num_of_ant(tx_chains);
504 
505 	vht_cap->vht_supported = true;
506 
507 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
508 		       IEEE80211_VHT_CAP_RXSTBC_1 |
509 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
510 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
511 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
512 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
513 
514 	if (!trans->cfg->ht_params->stbc)
515 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
516 
517 	if (data->vht160_supported)
518 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
519 				IEEE80211_VHT_CAP_SHORT_GI_160;
520 
521 	if (cfg->vht_mu_mimo_supported)
522 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
523 
524 	if (cfg->ht_params->ldpc)
525 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
526 
527 	if (data->sku_cap_mimo_disabled) {
528 		num_rx_ants = 1;
529 		num_tx_ants = 1;
530 	}
531 
532 	if (trans->cfg->ht_params->stbc && num_tx_ants > 1)
533 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
534 	else
535 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
536 
537 	switch (iwlwifi_mod_params.amsdu_size) {
538 	case IWL_AMSDU_DEF:
539 		if (trans->trans_cfg->mq_rx_supported)
540 			vht_cap->cap |=
541 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
542 		else
543 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
544 		break;
545 	case IWL_AMSDU_2K:
546 		if (trans->trans_cfg->mq_rx_supported)
547 			vht_cap->cap |=
548 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
549 		else
550 			WARN(1, "RB size of 2K is not supported by this device\n");
551 		break;
552 	case IWL_AMSDU_4K:
553 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
554 		break;
555 	case IWL_AMSDU_8K:
556 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
557 		break;
558 	case IWL_AMSDU_12K:
559 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
560 		break;
561 	default:
562 		break;
563 	}
564 
565 	vht_cap->vht_mcs.rx_mcs_map =
566 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
567 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
568 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
569 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
570 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
571 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
572 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
573 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
574 
575 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
576 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
577 		/* this works because NOT_SUPPORTED == 3 */
578 		vht_cap->vht_mcs.rx_mcs_map |=
579 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
580 	}
581 
582 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
583 
584 	vht_cap->vht_mcs.tx_highest |=
585 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
586 }
587 
588 static const u8 iwl_vendor_caps[] = {
589 	0xdd,			/* vendor element */
590 	0x06,			/* length */
591 	0x00, 0x17, 0x35,	/* Intel OUI */
592 	0x08,			/* type (Intel Capabilities) */
593 	/* followed by 16 bits of capabilities */
594 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
595 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
596 	0x00
597 };
598 
599 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
600 	{
601 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
602 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
603 		.he_cap = {
604 			.has_he = true,
605 			.he_cap_elem = {
606 				.mac_cap_info[0] =
607 					IEEE80211_HE_MAC_CAP0_HTC_HE,
608 				.mac_cap_info[1] =
609 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
610 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
611 				.mac_cap_info[2] =
612 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
613 				.mac_cap_info[3] =
614 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
615 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
616 				.mac_cap_info[4] =
617 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
618 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
619 				.mac_cap_info[5] =
620 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
621 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
622 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
623 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
624 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
625 				.phy_cap_info[1] =
626 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
627 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
628 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
629 				.phy_cap_info[2] =
630 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
631 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
632 				.phy_cap_info[3] =
633 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
634 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
635 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
636 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
637 				.phy_cap_info[4] =
638 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
639 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
640 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
641 				.phy_cap_info[6] =
642 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
643 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
644 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
645 				.phy_cap_info[7] =
646 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
647 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
648 				.phy_cap_info[8] =
649 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
650 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
651 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
652 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
653 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
654 				.phy_cap_info[9] =
655 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
656 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
657 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
658 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
659 				.phy_cap_info[10] =
660 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
661 			},
662 			/*
663 			 * Set default Tx/Rx HE MCS NSS Support field.
664 			 * Indicate support for up to 2 spatial streams and all
665 			 * MCS, without any special cases
666 			 */
667 			.he_mcs_nss_supp = {
668 				.rx_mcs_80 = cpu_to_le16(0xfffa),
669 				.tx_mcs_80 = cpu_to_le16(0xfffa),
670 				.rx_mcs_160 = cpu_to_le16(0xfffa),
671 				.tx_mcs_160 = cpu_to_le16(0xfffa),
672 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
673 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
674 			},
675 			/*
676 			 * Set default PPE thresholds, with PPET16 set to 0,
677 			 * PPET8 set to 7
678 			 */
679 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
680 		},
681 		.eht_cap = {
682 			.has_eht = true,
683 			.eht_cap_elem = {
684 				.mac_cap_info[0] =
685 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
686 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
687 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2 |
688 					IEEE80211_EHT_MAC_CAP0_SCS_TRAFFIC_DESC,
689 				.phy_cap_info[0] =
690 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
691 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
692 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
693 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
694 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
695 				.phy_cap_info[1] =
696 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
697 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
698 				.phy_cap_info[3] =
699 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
700 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
701 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
702 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
703 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
704 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
705 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
706 
707 				.phy_cap_info[4] =
708 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
709 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
710 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
711 				.phy_cap_info[5] =
712 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
713 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US) |
714 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
715 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
716 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP,
717 				.phy_cap_info[6] =
718 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
719 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
720 				.phy_cap_info[8] =
721 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
722 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
723 			},
724 
725 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
726 			 * Rx - note we don't set the only_20mhz, but due to this
727 			 * being a union, it gets set correctly anyway.
728 			 */
729 			.eht_mcs_nss_supp = {
730 				.bw._80 = {
731 					.rx_tx_mcs9_max_nss = 0x22,
732 					.rx_tx_mcs11_max_nss = 0x22,
733 					.rx_tx_mcs13_max_nss = 0x22,
734 				},
735 				.bw._160 = {
736 					.rx_tx_mcs9_max_nss = 0x22,
737 					.rx_tx_mcs11_max_nss = 0x22,
738 					.rx_tx_mcs13_max_nss = 0x22,
739 				},
740 				.bw._320 = {
741 					.rx_tx_mcs9_max_nss = 0x22,
742 					.rx_tx_mcs11_max_nss = 0x22,
743 					.rx_tx_mcs13_max_nss = 0x22,
744 				},
745 			},
746 
747 			/*
748 			 * PPE thresholds for NSS = 2, and RU index bitmap set
749 			 * to 0xc.
750 			 * Note: just for stating what we want, not present in
751 			 * the transmitted data due to not including
752 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
753 			 */
754 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
755 		},
756 	},
757 	{
758 		.types_mask = BIT(NL80211_IFTYPE_AP) |
759 			      BIT(NL80211_IFTYPE_P2P_GO),
760 		.he_cap = {
761 			.has_he = true,
762 			.he_cap_elem = {
763 				.mac_cap_info[0] =
764 					IEEE80211_HE_MAC_CAP0_HTC_HE,
765 				.mac_cap_info[1] =
766 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
767 				.mac_cap_info[3] =
768 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
769 				.phy_cap_info[1] =
770 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
771 				.phy_cap_info[2] =
772 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
773 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
774 				.phy_cap_info[3] =
775 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
776 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
777 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
778 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
779 				.phy_cap_info[6] =
780 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
781 				.phy_cap_info[7] =
782 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
783 				.phy_cap_info[8] =
784 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
785 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
786 				.phy_cap_info[9] =
787 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
788 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
789 			},
790 			/*
791 			 * Set default Tx/Rx HE MCS NSS Support field.
792 			 * Indicate support for up to 2 spatial streams and all
793 			 * MCS, without any special cases
794 			 */
795 			.he_mcs_nss_supp = {
796 				.rx_mcs_80 = cpu_to_le16(0xfffa),
797 				.tx_mcs_80 = cpu_to_le16(0xfffa),
798 				.rx_mcs_160 = cpu_to_le16(0xfffa),
799 				.tx_mcs_160 = cpu_to_le16(0xfffa),
800 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
801 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
802 			},
803 			/*
804 			 * Set default PPE thresholds, with PPET16 set to 0,
805 			 * PPET8 set to 7
806 			 */
807 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
808 		},
809 		.eht_cap = {
810 			.has_eht = true,
811 			.eht_cap_elem = {
812 				.mac_cap_info[0] =
813 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
814 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
815 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
816 				.phy_cap_info[0] =
817 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
818 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
819 				.phy_cap_info[5] =
820 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
821 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US),
822 			},
823 
824 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
825 			 * Rx - note we don't set the only_20mhz, but due to this
826 			 * being a union, it gets set correctly anyway.
827 			 */
828 			.eht_mcs_nss_supp = {
829 				.bw._80 = {
830 					.rx_tx_mcs9_max_nss = 0x22,
831 					.rx_tx_mcs11_max_nss = 0x22,
832 					.rx_tx_mcs13_max_nss = 0x22,
833 				},
834 				.bw._160 = {
835 					.rx_tx_mcs9_max_nss = 0x22,
836 					.rx_tx_mcs11_max_nss = 0x22,
837 					.rx_tx_mcs13_max_nss = 0x22,
838 				},
839 				.bw._320 = {
840 					.rx_tx_mcs9_max_nss = 0x22,
841 					.rx_tx_mcs11_max_nss = 0x22,
842 					.rx_tx_mcs13_max_nss = 0x22,
843 				},
844 			},
845 
846 			/*
847 			 * PPE thresholds for NSS = 2, and RU index bitmap set
848 			 * to 0xc.
849 			 * Note: just for stating what we want, not present in
850 			 * the transmitted data due to not including
851 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
852 			 */
853 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
854 		},
855 	},
856 };
857 
858 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
859 				  struct iwl_nvm_data *data,
860 				  struct ieee80211_supported_band *sband,
861 				  u8 tx_chains, u8 rx_chains)
862 {
863 	struct ieee80211_sta_ht_cap ht_cap;
864 	struct ieee80211_sta_vht_cap vht_cap = {};
865 	struct ieee80211_sband_iftype_data *iftype_data;
866 	u16 he_6ghz_capa = 0;
867 	u32 exp;
868 	int i;
869 
870 	if (sband->band != NL80211_BAND_6GHZ)
871 		return;
872 
873 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
874 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
875 			     tx_chains, rx_chains);
876 	WARN_ON(!ht_cap.ht_supported);
877 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
878 	WARN_ON(!vht_cap.vht_supported);
879 
880 	he_6ghz_capa |=
881 		u16_encode_bits(ht_cap.ampdu_density,
882 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
883 	exp = u32_get_bits(vht_cap.cap,
884 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
885 	he_6ghz_capa |=
886 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
887 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
888 	he_6ghz_capa |=
889 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
890 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
891 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
892 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
893 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
894 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
895 
896 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
897 
898 	/* we know it's writable - we set it before ourselves */
899 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
900 	for (i = 0; i < sband->n_iftype_data; i++)
901 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
902 }
903 
904 static void
905 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
906 			 struct iwl_nvm_data *data,
907 			 struct ieee80211_supported_band *sband,
908 			 struct ieee80211_sband_iftype_data *iftype_data,
909 			 u8 tx_chains, u8 rx_chains,
910 			 const struct iwl_fw *fw)
911 {
912 	bool is_ap = iftype_data->types_mask & (BIT(NL80211_IFTYPE_AP) |
913 						BIT(NL80211_IFTYPE_P2P_GO));
914 	bool no_320;
915 
916 	no_320 = (!trans->trans_cfg->integrated &&
917 		 trans->pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB) ||
918 		 trans->reduced_cap_sku;
919 
920 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be)
921 		iftype_data->eht_cap.has_eht = false;
922 
923 	/* Advertise an A-MPDU exponent extension based on
924 	 * operating band
925 	 */
926 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
927 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
928 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
929 	else if (sband->band != NL80211_BAND_2GHZ)
930 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
931 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
932 	else
933 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
934 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
935 
936 	switch (sband->band) {
937 	case NL80211_BAND_2GHZ:
938 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
939 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
940 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
941 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
942 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
943 		break;
944 	case NL80211_BAND_6GHZ:
945 		if (!no_320) {
946 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
947 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
948 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
949 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
950 		}
951 		fallthrough;
952 	case NL80211_BAND_5GHZ:
953 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
954 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
955 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
956 		break;
957 	default:
958 		WARN_ON(1);
959 		break;
960 	}
961 
962 	if ((tx_chains & rx_chains) == ANT_AB) {
963 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
964 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
965 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
966 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
967 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
968 		if (!is_ap) {
969 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
970 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
971 
972 			if (iftype_data->eht_cap.has_eht) {
973 				/*
974 				 * Set the number of sounding dimensions for each
975 				 * bandwidth to 1 to indicate the maximal supported
976 				 * value of TXVECTOR parameter NUM_STS of 2
977 				 */
978 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
979 
980 				/*
981 				 * Set the MAX NC to 1 to indicate sounding feedback of
982 				 * 2 supported by the beamfomee.
983 				 */
984 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
985 			}
986 		}
987 	} else {
988 		struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp =
989 			&iftype_data->he_cap.he_mcs_nss_supp;
990 
991 		if (iftype_data->eht_cap.has_eht) {
992 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
993 				&iftype_data->eht_cap.eht_mcs_nss_supp;
994 
995 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
996 		}
997 
998 		if (!is_ap) {
999 			/* If not 2x2, we need to indicate 1x1 in the
1000 			 * Midamble RX Max NSTS - but not for AP mode
1001 			 */
1002 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
1003 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
1004 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1005 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
1006 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
1007 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
1008 		}
1009 
1010 		he_mcs_nss_supp->rx_mcs_80 |=
1011 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1012 		he_mcs_nss_supp->tx_mcs_80 |=
1013 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1014 		he_mcs_nss_supp->rx_mcs_160 |=
1015 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1016 		he_mcs_nss_supp->tx_mcs_160 |=
1017 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1018 		he_mcs_nss_supp->rx_mcs_80p80 |=
1019 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1020 		he_mcs_nss_supp->tx_mcs_80p80 |=
1021 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1022 	}
1023 
1024 	if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
1025 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
1026 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
1027 
1028 	switch (CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
1029 	case IWL_CFG_RF_TYPE_GF:
1030 	case IWL_CFG_RF_TYPE_FM:
1031 	case IWL_CFG_RF_TYPE_WH:
1032 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1033 			IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
1034 		if (!is_ap)
1035 			iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1036 				IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
1037 		break;
1038 	}
1039 
1040 	if (CSR_HW_REV_TYPE(trans->hw_rev) == IWL_CFG_MAC_TYPE_GL &&
1041 	    iftype_data->eht_cap.has_eht) {
1042 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] &=
1043 			~(IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
1044 			  IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2);
1045 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[3] &=
1046 			~(IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
1047 			  IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
1048 			  IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
1049 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
1050 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
1051 			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
1052 			  IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK);
1053 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &=
1054 			~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
1055 			  IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP);
1056 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] &=
1057 			~IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK;
1058 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[6] &=
1059 			~(IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
1060 			  IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP);
1061 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] |=
1062 			IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF;
1063 	}
1064 
1065 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
1066 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
1067 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
1068 
1069 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1070 	    !is_ap) {
1071 		iftype_data->vendor_elems.data = iwl_vendor_caps;
1072 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
1073 	}
1074 
1075 	if (!trans->cfg->ht_params->stbc) {
1076 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1077 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
1078 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
1079 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
1080 	}
1081 
1082 	if (trans->step_urm) {
1083 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs11_max_nss = 0;
1084 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs13_max_nss = 0;
1085 	}
1086 
1087 	if (trans->no_160)
1088 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] &=
1089 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
1090 
1091 	if (trans->reduced_cap_sku) {
1092 		memset(&iftype_data->eht_cap.eht_mcs_nss_supp.bw._320, 0,
1093 		       sizeof(iftype_data->eht_cap.eht_mcs_nss_supp.bw._320));
1094 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._80.rx_tx_mcs13_max_nss = 0;
1095 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._160.rx_tx_mcs13_max_nss = 0;
1096 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[8] &=
1097 			~IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA;
1098 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] &=
1099 			~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
1100 	}
1101 }
1102 
1103 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1104 				 struct iwl_nvm_data *data,
1105 				 struct ieee80211_supported_band *sband,
1106 				 u8 tx_chains, u8 rx_chains,
1107 				 const struct iwl_fw *fw)
1108 {
1109 	struct ieee80211_sband_iftype_data *iftype_data;
1110 	int i;
1111 
1112 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1113 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1114 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1115 
1116 	switch (sband->band) {
1117 	case NL80211_BAND_2GHZ:
1118 		iftype_data = data->iftd.low;
1119 		break;
1120 	case NL80211_BAND_5GHZ:
1121 		iftype_data = data->iftd.high;
1122 		break;
1123 	case NL80211_BAND_6GHZ:
1124 		iftype_data = data->iftd.uhb;
1125 		break;
1126 	default:
1127 		WARN_ON(1);
1128 		return;
1129 	}
1130 
1131 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1132 
1133 	_ieee80211_set_sband_iftype_data(sband, iftype_data,
1134 					 ARRAY_SIZE(iwl_he_eht_capa));
1135 
1136 	for (i = 0; i < sband->n_iftype_data; i++)
1137 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1138 					 tx_chains, rx_chains, fw);
1139 
1140 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1141 }
1142 
1143 void iwl_reinit_cab(struct iwl_trans *trans, struct iwl_nvm_data *data,
1144 		    u8 tx_chains, u8 rx_chains, const struct iwl_fw *fw)
1145 {
1146 	struct ieee80211_supported_band *sband;
1147 
1148 	sband = &data->bands[NL80211_BAND_2GHZ];
1149 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1150 			     tx_chains, rx_chains);
1151 
1152 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1153 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1154 				     fw);
1155 
1156 	sband = &data->bands[NL80211_BAND_5GHZ];
1157 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1158 			     tx_chains, rx_chains);
1159 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1160 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1161 				      tx_chains, rx_chains);
1162 
1163 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1164 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1165 				     fw);
1166 
1167 	sband = &data->bands[NL80211_BAND_6GHZ];
1168 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1169 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1170 				     fw);
1171 }
1172 IWL_EXPORT_SYMBOL(iwl_reinit_cab);
1173 
1174 static void iwl_init_sbands(struct iwl_trans *trans,
1175 			    struct iwl_nvm_data *data,
1176 			    const void *nvm_ch_flags, u8 tx_chains,
1177 			    u8 rx_chains, u32 sbands_flags, bool v4,
1178 			    const struct iwl_fw *fw)
1179 {
1180 	struct device *dev = trans->dev;
1181 	int n_channels;
1182 	int n_used = 0;
1183 	struct ieee80211_supported_band *sband;
1184 
1185 	n_channels = iwl_init_channel_map(trans, fw, data, nvm_ch_flags,
1186 					  sbands_flags, v4);
1187 	sband = &data->bands[NL80211_BAND_2GHZ];
1188 	sband->band = NL80211_BAND_2GHZ;
1189 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1190 	sband->n_bitrates = N_RATES_24;
1191 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1192 					  NL80211_BAND_2GHZ);
1193 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1194 			     tx_chains, rx_chains);
1195 
1196 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1197 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1198 				     fw);
1199 
1200 	sband = &data->bands[NL80211_BAND_5GHZ];
1201 	sband->band = NL80211_BAND_5GHZ;
1202 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1203 	sband->n_bitrates = N_RATES_52;
1204 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1205 					  NL80211_BAND_5GHZ);
1206 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1207 			     tx_chains, rx_chains);
1208 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1209 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1210 				      tx_chains, rx_chains);
1211 
1212 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1213 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1214 				     fw);
1215 
1216 	/* 6GHz band. */
1217 	sband = &data->bands[NL80211_BAND_6GHZ];
1218 	sband->band = NL80211_BAND_6GHZ;
1219 	/* use the same rates as 5GHz band */
1220 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1221 	sband->n_bitrates = N_RATES_52;
1222 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1223 					  NL80211_BAND_6GHZ);
1224 
1225 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1226 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1227 				     fw);
1228 	else
1229 		sband->n_channels = 0;
1230 	if (n_channels != n_used)
1231 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1232 			    n_used, n_channels);
1233 }
1234 
1235 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1236 		       const __le16 *phy_sku)
1237 {
1238 	if (cfg->nvm_type != IWL_NVM_EXT)
1239 		return le16_to_cpup(nvm_sw + SKU);
1240 
1241 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1242 }
1243 
1244 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1245 {
1246 	if (cfg->nvm_type != IWL_NVM_EXT)
1247 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1248 	else
1249 		return le32_to_cpup((const __le32 *)(nvm_sw +
1250 						     NVM_VERSION_EXT_NVM));
1251 }
1252 
1253 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1254 			     const __le16 *phy_sku)
1255 {
1256 	if (cfg->nvm_type != IWL_NVM_EXT)
1257 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1258 
1259 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1260 
1261 }
1262 
1263 static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1264 {
1265 	int n_hw_addr;
1266 
1267 	if (cfg->nvm_type != IWL_NVM_EXT)
1268 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1269 
1270 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1271 
1272 	return n_hw_addr & N_HW_ADDR_MASK;
1273 }
1274 
1275 static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
1276 			      struct iwl_nvm_data *data,
1277 			      u32 radio_cfg)
1278 {
1279 	if (cfg->nvm_type != IWL_NVM_EXT) {
1280 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1281 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1282 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1283 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1284 		return;
1285 	}
1286 
1287 	/* set the radio configuration for family 8000 */
1288 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1289 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1290 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1291 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1292 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1293 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1294 }
1295 
1296 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1297 {
1298 	const u8 *hw_addr;
1299 
1300 	hw_addr = (const u8 *)&mac_addr0;
1301 	dest[0] = hw_addr[3];
1302 	dest[1] = hw_addr[2];
1303 	dest[2] = hw_addr[1];
1304 	dest[3] = hw_addr[0];
1305 
1306 	hw_addr = (const u8 *)&mac_addr1;
1307 	dest[4] = hw_addr[1];
1308 	dest[5] = hw_addr[0];
1309 }
1310 
1311 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1312 					struct iwl_nvm_data *data)
1313 {
1314 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1315 						  CSR_MAC_ADDR0_STRAP(trans)));
1316 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1317 						  CSR_MAC_ADDR1_STRAP(trans)));
1318 
1319 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1320 	/*
1321 	 * If the OEM fused a valid address, use it instead of the one in the
1322 	 * OTP
1323 	 */
1324 	if (is_valid_ether_addr(data->hw_addr))
1325 		return;
1326 
1327 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1328 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1329 
1330 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1331 }
1332 
1333 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1334 					   const struct iwl_cfg *cfg,
1335 					   struct iwl_nvm_data *data,
1336 					   const __le16 *mac_override,
1337 					   const __be16 *nvm_hw)
1338 {
1339 	const u8 *hw_addr;
1340 
1341 	if (mac_override) {
1342 		static const u8 reserved_mac[] = {
1343 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1344 		};
1345 
1346 		hw_addr = (const u8 *)(mac_override +
1347 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1348 
1349 		/*
1350 		 * Store the MAC address from MAO section.
1351 		 * No byte swapping is required in MAO section
1352 		 */
1353 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1354 
1355 		/*
1356 		 * Force the use of the OTP MAC address in case of reserved MAC
1357 		 * address in the NVM, or if address is given but invalid.
1358 		 */
1359 		if (is_valid_ether_addr(data->hw_addr) &&
1360 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1361 			return;
1362 
1363 		IWL_ERR(trans,
1364 			"mac address from nvm override section is not valid\n");
1365 	}
1366 
1367 	if (nvm_hw) {
1368 		/* read the mac address from WFMP registers */
1369 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1370 						WFMP_MAC_ADDR_0));
1371 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1372 						WFMP_MAC_ADDR_1));
1373 
1374 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1375 
1376 		return;
1377 	}
1378 
1379 	IWL_ERR(trans, "mac address is not found\n");
1380 }
1381 
1382 static int iwl_set_hw_address(struct iwl_trans *trans,
1383 			      const struct iwl_cfg *cfg,
1384 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1385 			      const __le16 *mac_override)
1386 {
1387 	if (cfg->mac_addr_from_csr) {
1388 		iwl_set_hw_address_from_csr(trans, data);
1389 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1390 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1391 
1392 		/* The byte order is little endian 16 bit, meaning 214365 */
1393 		data->hw_addr[0] = hw_addr[1];
1394 		data->hw_addr[1] = hw_addr[0];
1395 		data->hw_addr[2] = hw_addr[3];
1396 		data->hw_addr[3] = hw_addr[2];
1397 		data->hw_addr[4] = hw_addr[5];
1398 		data->hw_addr[5] = hw_addr[4];
1399 	} else {
1400 		iwl_set_hw_address_family_8000(trans, cfg, data,
1401 					       mac_override, nvm_hw);
1402 	}
1403 
1404 	if (!is_valid_ether_addr(data->hw_addr)) {
1405 		IWL_ERR(trans, "no valid mac address was found\n");
1406 		return -EINVAL;
1407 	}
1408 
1409 	if (!trans->csme_own)
1410 #if defined(__linux__)
1411 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1412 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1413 #elif defined(__FreeBSD__)
1414 		IWL_INFO(trans, "base HW address: %6D, OTP minor version: 0x%x\n",
1415 			 data->hw_addr, ":", iwl_read_prph(trans, REG_OTP_MINOR));
1416 #endif
1417 
1418 	return 0;
1419 }
1420 
1421 static bool
1422 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1423 			const __be16 *nvm_hw)
1424 {
1425 	/*
1426 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1427 	 * some 7000-family OTPs erroneously allow wide channels in
1428 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1429 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1430 	 * 9.  In those cases, we need to force-disable wide channels
1431 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1432 	 * to use them.
1433 	 */
1434 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1435 		/*
1436 		 * Unlike the other sections in the NVM, the hw
1437 		 * section uses big-endian.
1438 		 */
1439 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1440 		u8 sku = (subsystem_id & 0x1e) >> 1;
1441 
1442 		if (sku == 5 || sku == 9) {
1443 			IWL_DEBUG_EEPROM(trans->dev,
1444 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1445 					 subsystem_id, sku);
1446 			return true;
1447 		}
1448 	}
1449 
1450 	return false;
1451 }
1452 
1453 struct iwl_nvm_data *
1454 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1455 		       const struct iwl_mei_nvm *mei_nvm,
1456 		       const struct iwl_fw *fw, u8 tx_ant, u8 rx_ant)
1457 {
1458 	struct iwl_nvm_data *data;
1459 	u32 sbands_flags = 0;
1460 	u8 rx_chains = fw->valid_rx_ant;
1461 	u8 tx_chains = fw->valid_rx_ant;
1462 
1463 	if (cfg->uhb_supported)
1464 		data = kzalloc(struct_size(data, channels,
1465 					   IWL_NVM_NUM_CHANNELS_UHB),
1466 					   GFP_KERNEL);
1467 	else
1468 		data = kzalloc(struct_size(data, channels,
1469 					   IWL_NVM_NUM_CHANNELS_EXT),
1470 					   GFP_KERNEL);
1471 	if (!data)
1472 		return NULL;
1473 
1474 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1475 		     IWL_NVM_NUM_CHANNELS_UHB);
1476 	data->nvm_version = mei_nvm->nvm_version;
1477 
1478 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1479 	if (data->valid_tx_ant)
1480 		tx_chains &= data->valid_tx_ant;
1481 	if (data->valid_rx_ant)
1482 		rx_chains &= data->valid_rx_ant;
1483 	if (tx_ant)
1484 		tx_chains &= tx_ant;
1485 	if (rx_ant)
1486 		rx_chains &= rx_ant;
1487 
1488 	data->sku_cap_mimo_disabled = false;
1489 	data->sku_cap_band_24ghz_enable = true;
1490 	data->sku_cap_band_52ghz_enable = true;
1491 	data->sku_cap_11n_enable =
1492 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1493 	data->sku_cap_11ac_enable = true;
1494 	data->sku_cap_11ax_enable =
1495 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1496 
1497 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1498 
1499 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1500 	/* If no valid mac address was found - bail out */
1501 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1502 		kfree(data);
1503 		return NULL;
1504 	}
1505 
1506 	if (data->lar_enabled &&
1507 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1508 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1509 
1510 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1511 			sbands_flags, true, fw);
1512 
1513 	return data;
1514 }
1515 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1516 
1517 struct iwl_nvm_data *
1518 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1519 		   const struct iwl_fw *fw,
1520 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1521 		   const __le16 *nvm_calib, const __le16 *regulatory,
1522 		   const __le16 *mac_override, const __le16 *phy_sku,
1523 		   u8 tx_chains, u8 rx_chains)
1524 {
1525 	struct iwl_nvm_data *data;
1526 	bool lar_enabled;
1527 	u32 sku, radio_cfg;
1528 	u32 sbands_flags = 0;
1529 	u16 lar_config;
1530 	const __le16 *ch_section;
1531 
1532 	if (cfg->uhb_supported)
1533 		data = kzalloc(struct_size(data, channels,
1534 					   IWL_NVM_NUM_CHANNELS_UHB),
1535 					   GFP_KERNEL);
1536 	else if (cfg->nvm_type != IWL_NVM_EXT)
1537 		data = kzalloc(struct_size(data, channels,
1538 					   IWL_NVM_NUM_CHANNELS),
1539 					   GFP_KERNEL);
1540 	else
1541 		data = kzalloc(struct_size(data, channels,
1542 					   IWL_NVM_NUM_CHANNELS_EXT),
1543 					   GFP_KERNEL);
1544 	if (!data)
1545 		return NULL;
1546 
1547 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1548 
1549 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1550 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1551 	if (data->valid_tx_ant)
1552 		tx_chains &= data->valid_tx_ant;
1553 	if (data->valid_rx_ant)
1554 		rx_chains &= data->valid_rx_ant;
1555 
1556 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1557 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1558 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1559 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1560 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1561 		data->sku_cap_11n_enable = false;
1562 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1563 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1564 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1565 
1566 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1567 
1568 	if (cfg->nvm_type != IWL_NVM_EXT) {
1569 		/* Checking for required sections */
1570 		if (!nvm_calib) {
1571 			IWL_ERR(trans,
1572 				"Can't parse empty Calib NVM sections\n");
1573 			kfree(data);
1574 			return NULL;
1575 		}
1576 
1577 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1578 			     &regulatory[NVM_CHANNELS_SDP] :
1579 			     &nvm_sw[NVM_CHANNELS];
1580 
1581 		lar_enabled = true;
1582 	} else {
1583 		u16 lar_offset = data->nvm_version < 0xE39 ?
1584 				 NVM_LAR_OFFSET_OLD :
1585 				 NVM_LAR_OFFSET;
1586 
1587 		lar_config = le16_to_cpup(regulatory + lar_offset);
1588 		data->lar_enabled = !!(lar_config &
1589 				       NVM_LAR_ENABLED);
1590 		lar_enabled = data->lar_enabled;
1591 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1592 	}
1593 
1594 	/* If no valid mac address was found - bail out */
1595 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1596 		kfree(data);
1597 		return NULL;
1598 	}
1599 
1600 	if (lar_enabled &&
1601 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1602 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1603 
1604 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1605 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1606 
1607 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1608 			sbands_flags, false, fw);
1609 	data->calib_version = 255;
1610 
1611 	return data;
1612 }
1613 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1614 
1615 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1616 				       int ch_idx, u16 nvm_flags,
1617 				       struct iwl_reg_capa reg_capa,
1618 				       const struct iwl_cfg *cfg)
1619 {
1620 	u32 flags = NL80211_RRF_NO_HT40;
1621 
1622 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1623 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1624 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1625 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1626 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1627 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1628 	} else if (ch_idx < NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS &&
1629 		   nvm_flags & NVM_CHANNEL_40MHZ) {
1630 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1631 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1632 		else
1633 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1634 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1635 		flags &= ~NL80211_RRF_NO_HT40PLUS;
1636 		flags &= ~NL80211_RRF_NO_HT40MINUS;
1637 	}
1638 
1639 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1640 		flags |= NL80211_RRF_NO_80MHZ;
1641 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1642 		flags |= NL80211_RRF_NO_160MHZ;
1643 
1644 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1645 		flags |= NL80211_RRF_NO_IR;
1646 
1647 	if (nvm_flags & NVM_CHANNEL_RADAR)
1648 		flags |= NL80211_RRF_DFS;
1649 
1650 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1651 		flags |= NL80211_RRF_NO_OUTDOOR;
1652 
1653 	/* Set the GO concurrent flag only in case that NO_IR is set.
1654 	 * Otherwise it is meaningless
1655 	 */
1656 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT)) {
1657 		if (flags & NL80211_RRF_NO_IR)
1658 			flags |= NL80211_RRF_GO_CONCURRENT;
1659 		if (flags & NL80211_RRF_DFS) {
1660 			flags |= NL80211_RRF_DFS_CONCURRENT;
1661 			/* Our device doesn't set active bit for DFS channels
1662 			 * however, once marked as DFS no-ir is not needed.
1663 			 */
1664 			flags &= ~NL80211_RRF_NO_IR;
1665 		}
1666 	}
1667 
1668 	/* Set the AP type for the UHB case. */
1669 	if (nvm_flags & NVM_CHANNEL_VLP)
1670 		flags |= NL80211_RRF_ALLOW_6GHZ_VLP_AP;
1671 	else
1672 		flags |= NL80211_RRF_NO_6GHZ_VLP_CLIENT;
1673 
1674 	if (!(nvm_flags & NVM_CHANNEL_AFC))
1675 		flags |= NL80211_RRF_NO_6GHZ_AFC_CLIENT;
1676 
1677 	/*
1678 	 * reg_capa is per regulatory domain so apply it for every channel
1679 	 */
1680 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1681 		if (!reg_capa.allow_40mhz)
1682 			flags |= NL80211_RRF_NO_HT40;
1683 
1684 		if (!reg_capa.allow_80mhz)
1685 			flags |= NL80211_RRF_NO_80MHZ;
1686 
1687 		if (!reg_capa.allow_160mhz)
1688 			flags |= NL80211_RRF_NO_160MHZ;
1689 
1690 		if (!reg_capa.allow_320mhz)
1691 			flags |= NL80211_RRF_NO_320MHZ;
1692 	}
1693 
1694 	if (reg_capa.disable_11ax)
1695 		flags |= NL80211_RRF_NO_HE;
1696 
1697 	if (reg_capa.disable_11be)
1698 		flags |= NL80211_RRF_NO_EHT;
1699 
1700 	return flags;
1701 }
1702 
1703 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1704 {
1705 	struct iwl_reg_capa reg_capa = {};
1706 
1707 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1708 		reg_capa.allow_40mhz = true;
1709 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1710 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1711 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1712 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1713 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1714 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1715 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1716 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1717 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1718 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1719 	} else {
1720 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1721 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1722 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1723 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1724 	}
1725 	return reg_capa;
1726 }
1727 
1728 struct ieee80211_regdomain *
1729 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
1730 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1731 		       u16 geo_info, u32 cap, u8 resp_ver)
1732 {
1733 	int ch_idx;
1734 	u16 ch_flags;
1735 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1736 	const u16 *nvm_chan;
1737 	struct ieee80211_regdomain *regd, *copy_rd;
1738 	struct ieee80211_reg_rule *rule;
1739 	int center_freq, prev_center_freq = 0;
1740 	int valid_rules = 0;
1741 	bool new_rule;
1742 	int max_num_ch;
1743 	struct iwl_reg_capa reg_capa;
1744 
1745 	if (cfg->uhb_supported) {
1746 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1747 		nvm_chan = iwl_uhb_nvm_channels;
1748 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1749 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1750 		nvm_chan = iwl_ext_nvm_channels;
1751 	} else {
1752 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1753 		nvm_chan = iwl_nvm_channels;
1754 	}
1755 
1756 	if (num_of_ch > max_num_ch) {
1757 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1758 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1759 			      num_of_ch, max_num_ch);
1760 		num_of_ch = max_num_ch;
1761 	}
1762 
1763 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1764 		return ERR_PTR(-EINVAL);
1765 
1766 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1767 		      num_of_ch);
1768 
1769 	/* build a regdomain rule for every valid channel */
1770 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1771 	if (!regd)
1772 		return ERR_PTR(-ENOMEM);
1773 
1774 	/* set alpha2 from FW. */
1775 	regd->alpha2[0] = fw_mcc >> 8;
1776 	regd->alpha2[1] = fw_mcc & 0xff;
1777 
1778 	/* parse regulatory capability flags */
1779 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1780 
1781 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1782 		enum nl80211_band band =
1783 			iwl_nl80211_band_from_channel_idx(ch_idx);
1784 
1785 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1786 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1787 							     band);
1788 		new_rule = false;
1789 
1790 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1791 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1792 						    nvm_chan[ch_idx], ch_flags);
1793 			continue;
1794 		}
1795 
1796 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1797 							     ch_flags, reg_capa,
1798 							     cfg);
1799 
1800 		/* we can't continue the same rule */
1801 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1802 		    center_freq - prev_center_freq > 20) {
1803 			valid_rules++;
1804 			new_rule = true;
1805 		}
1806 
1807 		rule = &regd->reg_rules[valid_rules - 1];
1808 
1809 		if (new_rule)
1810 			rule->freq_range.start_freq_khz =
1811 						MHZ_TO_KHZ(center_freq - 10);
1812 
1813 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1814 
1815 		/* this doesn't matter - not used by FW */
1816 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1817 		rule->power_rule.max_eirp =
1818 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1819 
1820 		rule->flags = reg_rule_flags;
1821 
1822 		/* rely on auto-calculation to merge BW of contiguous chans */
1823 		rule->flags |= NL80211_RRF_AUTO_BW;
1824 		rule->freq_range.max_bandwidth_khz = 0;
1825 
1826 		prev_center_freq = center_freq;
1827 		prev_reg_rule_flags = reg_rule_flags;
1828 
1829 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1830 					    nvm_chan[ch_idx], ch_flags);
1831 
1832 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1833 		    band == NL80211_BAND_2GHZ)
1834 			continue;
1835 
1836 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1837 	}
1838 
1839 	/*
1840 	 * Certain firmware versions might report no valid channels
1841 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1842 	 * running. We'll get out of this situation later when the
1843 	 * rfkill is removed and we update the regdomain again, but
1844 	 * since cfg80211 doesn't accept an empty regdomain, add a
1845 	 * dummy (unusable) rule here in this case so we can init.
1846 	 */
1847 	if (!valid_rules) {
1848 		valid_rules = 1;
1849 		rule = &regd->reg_rules[valid_rules - 1];
1850 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1851 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1852 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1853 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1854 		rule->power_rule.max_eirp =
1855 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1856 	}
1857 
1858 	regd->n_reg_rules = valid_rules;
1859 
1860 	/*
1861 	 * Narrow down regdom for unused regulatory rules to prevent hole
1862 	 * between reg rules to wmm rules.
1863 	 */
1864 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1865 			  GFP_KERNEL);
1866 	if (!copy_rd)
1867 		copy_rd = ERR_PTR(-ENOMEM);
1868 
1869 	kfree(regd);
1870 	return copy_rd;
1871 }
1872 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1873 
1874 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1875 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1876 #define MAX_NVM_FILE_LEN	16384
1877 
1878 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1879 		    unsigned int len)
1880 {
1881 #define IWL_4165_DEVICE_ID	0x5501
1882 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1883 
1884 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1885 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1886 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1887 		/* OTP 0x52 bug work around: it's a 1x1 device */
1888 		data[3] = ANT_B | (ANT_B << 4);
1889 }
1890 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1891 
1892 /*
1893  * Reads external NVM from a file into mvm->nvm_sections
1894  *
1895  * HOW TO CREATE THE NVM FILE FORMAT:
1896  * ------------------------------
1897  * 1. create hex file, format:
1898  *      3800 -> header
1899  *      0000 -> header
1900  *      5a40 -> data
1901  *
1902  *   rev - 6 bit (word1)
1903  *   len - 10 bit (word1)
1904  *   id - 4 bit (word2)
1905  *   rsv - 12 bit (word2)
1906  *
1907  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1908  *
1909  * 3. create binary file from the hex file
1910  *
1911  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1912  */
1913 int iwl_read_external_nvm(struct iwl_trans *trans,
1914 			  const char *nvm_file_name,
1915 			  struct iwl_nvm_section *nvm_sections)
1916 {
1917 	int ret, section_size;
1918 	u16 section_id;
1919 	const struct firmware *fw_entry;
1920 	const struct {
1921 		__le16 word1;
1922 		__le16 word2;
1923 		u8 data[];
1924 	} *file_sec;
1925 	const u8 *eof;
1926 	u8 *temp;
1927 	int max_section_size;
1928 	const __le32 *dword_buff;
1929 
1930 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1931 #define NVM_WORD2_ID(x) (x >> 12)
1932 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1933 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1934 #define NVM_HEADER_0	(0x2A504C54)
1935 #define NVM_HEADER_1	(0x4E564D2A)
1936 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1937 
1938 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1939 
1940 	/* Maximal size depends on NVM version */
1941 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1942 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1943 	else
1944 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1945 
1946 	/*
1947 	 * Obtain NVM image via request_firmware. Since we already used
1948 	 * request_firmware_nowait() for the firmware binary load and only
1949 	 * get here after that we assume the NVM request can be satisfied
1950 	 * synchronously.
1951 	 */
1952 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1953 	if (ret) {
1954 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1955 			nvm_file_name, ret);
1956 		return ret;
1957 	}
1958 
1959 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1960 		 nvm_file_name, fw_entry->size);
1961 
1962 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1963 		IWL_ERR(trans, "NVM file too large\n");
1964 		ret = -EINVAL;
1965 		goto out;
1966 	}
1967 
1968 	eof = fw_entry->data + fw_entry->size;
1969 	dword_buff = (const __le32 *)fw_entry->data;
1970 
1971 	/* some NVM file will contain a header.
1972 	 * The header is identified by 2 dwords header as follow:
1973 	 * dword[0] = 0x2A504C54
1974 	 * dword[1] = 0x4E564D2A
1975 	 *
1976 	 * This header must be skipped when providing the NVM data to the FW.
1977 	 */
1978 	if (fw_entry->size > NVM_HEADER_SIZE &&
1979 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1980 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1981 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1982 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1983 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1984 			 le32_to_cpu(dword_buff[3]));
1985 
1986 		/* nvm file validation, dword_buff[2] holds the file version */
1987 		if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1988 		    trans->hw_rev_step == SILICON_C_STEP &&
1989 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1990 			ret = -EFAULT;
1991 			goto out;
1992 		}
1993 	} else {
1994 		file_sec = (const void *)fw_entry->data;
1995 	}
1996 
1997 	while (true) {
1998 		if (file_sec->data > eof) {
1999 			IWL_ERR(trans,
2000 				"ERROR - NVM file too short for section header\n");
2001 			ret = -EINVAL;
2002 			break;
2003 		}
2004 
2005 		/* check for EOF marker */
2006 		if (!file_sec->word1 && !file_sec->word2) {
2007 			ret = 0;
2008 			break;
2009 		}
2010 
2011 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
2012 			section_size =
2013 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
2014 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
2015 		} else {
2016 			section_size = 2 * EXT_NVM_WORD2_LEN(
2017 						le16_to_cpu(file_sec->word2));
2018 			section_id = EXT_NVM_WORD1_ID(
2019 						le16_to_cpu(file_sec->word1));
2020 		}
2021 
2022 		if (section_size > max_section_size) {
2023 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
2024 				section_size);
2025 			ret = -EINVAL;
2026 			break;
2027 		}
2028 
2029 		if (!section_size) {
2030 			IWL_ERR(trans, "ERROR - section empty\n");
2031 			ret = -EINVAL;
2032 			break;
2033 		}
2034 
2035 		if (file_sec->data + section_size > eof) {
2036 			IWL_ERR(trans,
2037 				"ERROR - NVM file too short for section (%d bytes)\n",
2038 				section_size);
2039 			ret = -EINVAL;
2040 			break;
2041 		}
2042 
2043 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
2044 			 "Invalid NVM section ID %d\n", section_id)) {
2045 			ret = -EINVAL;
2046 			break;
2047 		}
2048 
2049 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
2050 		if (!temp) {
2051 			ret = -ENOMEM;
2052 			break;
2053 		}
2054 
2055 		iwl_nvm_fixups(trans->hw_id, section_id, temp, section_size);
2056 
2057 		kfree(nvm_sections[section_id].data);
2058 		nvm_sections[section_id].data = temp;
2059 		nvm_sections[section_id].length = section_size;
2060 
2061 		/* advance to the next section */
2062 		file_sec = (const void *)(file_sec->data + section_size);
2063 	}
2064 out:
2065 	release_firmware(fw_entry);
2066 	return ret;
2067 }
2068 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
2069 
2070 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
2071 				 const struct iwl_fw *fw,
2072 				 u8 set_tx_ant, u8 set_rx_ant)
2073 {
2074 	struct iwl_nvm_get_info cmd = {};
2075 	struct iwl_nvm_data *nvm;
2076 	struct iwl_host_cmd hcmd = {
2077 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
2078 		.data = { &cmd, },
2079 		.len = { sizeof(cmd) },
2080 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
2081 	};
2082 	int  ret;
2083 	bool empty_otp;
2084 	u32 mac_flags;
2085 	u32 sbands_flags = 0;
2086 	u8 tx_ant;
2087 	u8 rx_ant;
2088 
2089 	/*
2090 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
2091 	 * in v3, except for the channel profile part of the
2092 	 * regulatory.  So we can just access the new struct, with the
2093 	 * exception of the latter.
2094 	 */
2095 	struct iwl_nvm_get_info_rsp *rsp;
2096 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
2097 	bool v4 = fw_has_api(&fw->ucode_capa,
2098 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
2099 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
2100 	void *channel_profile;
2101 
2102 	ret = iwl_trans_send_cmd(trans, &hcmd);
2103 	if (ret)
2104 		return ERR_PTR(ret);
2105 
2106 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
2107 		 "Invalid payload len in NVM response from FW %d",
2108 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
2109 		ret = -EINVAL;
2110 		goto out;
2111 	}
2112 
2113 	rsp = (void *)hcmd.resp_pkt->data;
2114 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
2115 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
2116 	if (empty_otp)
2117 		IWL_INFO(trans, "OTP is empty\n");
2118 
2119 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
2120 	if (!nvm) {
2121 		ret = -ENOMEM;
2122 		goto out;
2123 	}
2124 
2125 	iwl_set_hw_address_from_csr(trans, nvm);
2126 	/* TODO: if platform NVM has MAC address - override it here */
2127 
2128 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2129 		IWL_ERR(trans, "no valid mac address was found\n");
2130 		ret = -EINVAL;
2131 		goto err_free;
2132 	}
2133 
2134 #if defined(__linux__)
2135 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2136 #elif defined(__FreeBSD__)
2137 	IWL_INFO(trans, "base HW address: %6D\n", nvm->hw_addr, ":");
2138 #endif
2139 
2140 	/* Initialize general data */
2141 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2142 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2143 	if (nvm->n_hw_addrs == 0)
2144 		IWL_WARN(trans,
2145 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2146 			 empty_otp);
2147 
2148 	/* Initialize MAC sku data */
2149 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2150 	nvm->sku_cap_11ac_enable =
2151 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2152 	nvm->sku_cap_11n_enable =
2153 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2154 	nvm->sku_cap_11ax_enable =
2155 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2156 	nvm->sku_cap_band_24ghz_enable =
2157 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2158 	nvm->sku_cap_band_52ghz_enable =
2159 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2160 	nvm->sku_cap_mimo_disabled =
2161 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2162 	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
2163 		nvm->sku_cap_11be_enable = true;
2164 
2165 	/* Initialize PHY sku data */
2166 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2167 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2168 
2169 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2170 	    fw_has_capa(&fw->ucode_capa,
2171 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2172 		nvm->lar_enabled = true;
2173 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2174 	}
2175 
2176 	rsp_v3 = (void *)rsp;
2177 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2178 			  (void *)rsp_v3->regulatory.channel_profile;
2179 
2180 	tx_ant = nvm->valid_tx_ant & fw->valid_tx_ant;
2181 	rx_ant = nvm->valid_rx_ant & fw->valid_rx_ant;
2182 
2183 	if (set_tx_ant)
2184 		tx_ant &= set_tx_ant;
2185 	if (set_rx_ant)
2186 		rx_ant &= set_rx_ant;
2187 
2188 	iwl_init_sbands(trans, nvm, channel_profile, tx_ant, rx_ant,
2189 			sbands_flags, v4, fw);
2190 
2191 	iwl_free_resp(&hcmd);
2192 	return nvm;
2193 
2194 err_free:
2195 	kfree(nvm);
2196 out:
2197 	iwl_free_resp(&hcmd);
2198 	return ERR_PTR(ret);
2199 }
2200 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2201