xref: /linux/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c (revision 001821b0e79716c4e17c71d8e053a23599a7a508)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM calibration section offset (in words) definitions */
42 	NVM_CALIB_SECTION = 0x2B8,
43 	XTAL_CALIB = 0x316 - NVM_CALIB_SECTION,
44 
45 	/* NVM REGULATORY -Section offset (in words) definitions */
46 	NVM_CHANNELS_SDP = 0,
47 };
48 
49 enum ext_nvm_offsets {
50 	/* NVM HW-Section offset (in words) definitions */
51 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
52 
53 	/* NVM SW-Section offset (in words) definitions */
54 	NVM_VERSION_EXT_NVM = 0,
55 	N_HW_ADDRS_FAMILY_8000 = 3,
56 
57 	/* NVM PHY_SKU-Section offset (in words) definitions */
58 	RADIO_CFG_FAMILY_EXT_NVM = 0,
59 	SKU_FAMILY_8000 = 2,
60 
61 	/* NVM REGULATORY -Section offset (in words) definitions */
62 	NVM_CHANNELS_EXTENDED = 0,
63 	NVM_LAR_OFFSET_OLD = 0x4C7,
64 	NVM_LAR_OFFSET = 0x507,
65 	NVM_LAR_ENABLED = 0x7,
66 };
67 
68 /* SKU Capabilities (actual values from NVM definition) */
69 enum nvm_sku_bits {
70 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
71 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
72 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
73 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
74 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
75 };
76 
77 /*
78  * These are the channel numbers in the order that they are stored in the NVM
79  */
80 static const u16 iwl_nvm_channels[] = {
81 	/* 2.4 GHz */
82 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
83 	/* 5 GHz */
84 	36, 40, 44, 48, 52, 56, 60, 64,
85 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
86 	149, 153, 157, 161, 165
87 };
88 
89 static const u16 iwl_ext_nvm_channels[] = {
90 	/* 2.4 GHz */
91 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
92 	/* 5 GHz */
93 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
94 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
95 	149, 153, 157, 161, 165, 169, 173, 177, 181
96 };
97 
98 static const u16 iwl_uhb_nvm_channels[] = {
99 	/* 2.4 GHz */
100 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
101 	/* 5 GHz */
102 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
103 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
104 	149, 153, 157, 161, 165, 169, 173, 177, 181,
105 	/* 6-7 GHz */
106 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
107 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
108 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
109 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
110 };
111 
112 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
113 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
114 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
115 #define NUM_2GHZ_CHANNELS		14
116 #define NUM_5GHZ_CHANNELS		37
117 #define FIRST_2GHZ_HT_MINUS		5
118 #define LAST_2GHZ_HT_PLUS		9
119 #define N_HW_ADDR_MASK			0xF
120 
121 /* rate data (static) */
122 static struct ieee80211_rate iwl_cfg80211_rates[] = {
123 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
124 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
125 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
126 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
127 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
128 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
129 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
130 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
131 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
132 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
133 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
134 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
135 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
136 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
137 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
138 };
139 #define RATES_24_OFFS	0
140 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
141 #define RATES_52_OFFS	4
142 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
143 
144 /**
145  * enum iwl_nvm_channel_flags - channel flags in NVM
146  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
147  * @NVM_CHANNEL_IBSS: usable as an IBSS channel
148  * @NVM_CHANNEL_ACTIVE: active scanning allowed
149  * @NVM_CHANNEL_RADAR: radar detection required
150  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
151  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
152  *	on same channel on 2.4 or same UNII band on 5.2
153  * @NVM_CHANNEL_UNIFORM: uniform spreading required
154  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
155  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
156  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
157  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
158  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
159  * @NVM_CHANNEL_VLP: client support connection to UHB VLP AP
160  * @NVM_CHANNEL_AFC: client support connection to UHB AFC AP
161  */
162 enum iwl_nvm_channel_flags {
163 	NVM_CHANNEL_VALID		= BIT(0),
164 	NVM_CHANNEL_IBSS		= BIT(1),
165 	NVM_CHANNEL_ACTIVE		= BIT(3),
166 	NVM_CHANNEL_RADAR		= BIT(4),
167 	NVM_CHANNEL_INDOOR_ONLY		= BIT(5),
168 	NVM_CHANNEL_GO_CONCURRENT	= BIT(6),
169 	NVM_CHANNEL_UNIFORM		= BIT(7),
170 	NVM_CHANNEL_20MHZ		= BIT(8),
171 	NVM_CHANNEL_40MHZ		= BIT(9),
172 	NVM_CHANNEL_80MHZ		= BIT(10),
173 	NVM_CHANNEL_160MHZ		= BIT(11),
174 	NVM_CHANNEL_DC_HIGH		= BIT(12),
175 	NVM_CHANNEL_VLP			= BIT(13),
176 	NVM_CHANNEL_AFC			= BIT(14),
177 };
178 
179 /**
180  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
181  * domain.
182  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
183  *	2.4Ghz band is allowed.
184  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
185  *	5Ghz band is allowed.
186  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
187  *	for this regulatory domain (valid only in 5Ghz).
188  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
189  *	for this regulatory domain (valid only in 5Ghz).
190  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
191  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
192  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
193  *	for this regulatory domain (valid only in 5Ghz).
194  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
195  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
196  */
197 enum iwl_reg_capa_flags_v1 {
198 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
199 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
200 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
201 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
202 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
203 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
204 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
205 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
206 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
207 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
208 
209 /**
210  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
211  * domain (version 2).
212  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
213  *	disabled.
214  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
215  *	2.4Ghz band is allowed.
216  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
217  *	5Ghz band is allowed.
218  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
219  *	for this regulatory domain (valid only in 5Ghz).
220  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
221  *	for this regulatory domain (valid only in 5Ghz).
222  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
223  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
224  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
225  *	126, 122) are disabled.
226  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
227  *	for this regulatory domain (uvalid only in 5Ghz).
228  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
229  */
230 enum iwl_reg_capa_flags_v2 {
231 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
232 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
233 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
234 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
235 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
236 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
237 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
238 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
239 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
240 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
241 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
242 
243 /**
244  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
245  * domain.
246  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
247  *	for this regulatory domain (valid only in 5Ghz).
248  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
249  *	for this regulatory domain (valid only in 5Ghz).
250  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
251  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
252  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
253  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
254  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
255  *	for this regulatory domain (valid only in 5GHz).
256  */
257 enum iwl_reg_capa_flags_v4 {
258 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
259 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
260 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
261 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
262 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
263 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
264 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
265 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
266 
267 /*
268 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
269 * MCC update command response.
270 */
271 #define REG_CAPA_V2_RESP_VER	6
272 
273 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
274  * MCC update command response.
275  */
276 #define REG_CAPA_V4_RESP_VER	8
277 
278 /**
279  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
280  * handling the different APIs of reg_capa_flags.
281  *
282  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
283  *	for this regulatory domain.
284  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
285  *	for this regulatory domain (valid only in 5 and 6 Ghz).
286  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
287  *	for this regulatory domain (valid only in 5 and 6 Ghz).
288  * @allow_320mhz: 11be channel with a width of 320Mhz is allowed
289  *	for this regulatory domain (valid only in 6 Ghz).
290  * @disable_11ax: 11ax is forbidden for this regulatory domain.
291  * @disable_11be: 11be is forbidden for this regulatory domain.
292  */
293 struct iwl_reg_capa {
294 	bool allow_40mhz;
295 	bool allow_80mhz;
296 	bool allow_160mhz;
297 	bool allow_320mhz;
298 	bool disable_11ax;
299 	bool disable_11be;
300 };
301 
302 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
303 					       int chan, u32 flags)
304 {
305 #define CHECK_AND_PRINT_I(x)	\
306 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
307 
308 	if (!(flags & NVM_CHANNEL_VALID)) {
309 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
310 			      chan, flags);
311 		return;
312 	}
313 
314 	/* Note: already can print up to 101 characters, 110 is the limit! */
315 	IWL_DEBUG_DEV(dev, level,
316 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
317 		      chan, flags,
318 		      CHECK_AND_PRINT_I(VALID),
319 		      CHECK_AND_PRINT_I(IBSS),
320 		      CHECK_AND_PRINT_I(ACTIVE),
321 		      CHECK_AND_PRINT_I(RADAR),
322 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
323 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
324 		      CHECK_AND_PRINT_I(UNIFORM),
325 		      CHECK_AND_PRINT_I(20MHZ),
326 		      CHECK_AND_PRINT_I(40MHZ),
327 		      CHECK_AND_PRINT_I(80MHZ),
328 		      CHECK_AND_PRINT_I(160MHZ),
329 		      CHECK_AND_PRINT_I(DC_HIGH),
330 		      CHECK_AND_PRINT_I(VLP),
331 		      CHECK_AND_PRINT_I(AFC));
332 #undef CHECK_AND_PRINT_I
333 }
334 
335 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
336 				 u32 nvm_flags, const struct iwl_cfg *cfg)
337 {
338 	u32 flags = IEEE80211_CHAN_NO_HT40;
339 
340 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
341 		if (ch_num <= LAST_2GHZ_HT_PLUS)
342 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
343 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
344 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
345 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
346 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
347 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
348 		else
349 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
350 	}
351 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
352 		flags |= IEEE80211_CHAN_NO_80MHZ;
353 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
354 		flags |= IEEE80211_CHAN_NO_160MHZ;
355 
356 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
357 		flags |= IEEE80211_CHAN_NO_IR;
358 
359 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
360 		flags |= IEEE80211_CHAN_NO_IR;
361 
362 	if (nvm_flags & NVM_CHANNEL_RADAR)
363 		flags |= IEEE80211_CHAN_RADAR;
364 
365 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
366 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
367 
368 	/* Set the GO concurrent flag only in case that NO_IR is set.
369 	 * Otherwise it is meaningless
370 	 */
371 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
372 	    (flags & IEEE80211_CHAN_NO_IR))
373 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
374 
375 	/* Set the AP type for the UHB case. */
376 	if (!(nvm_flags & NVM_CHANNEL_VLP))
377 		flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
378 	if (!(nvm_flags & NVM_CHANNEL_AFC))
379 		flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
380 
381 	return flags;
382 }
383 
384 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
385 {
386 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
387 		return NL80211_BAND_6GHZ;
388 	}
389 
390 	if (ch_idx >= NUM_2GHZ_CHANNELS)
391 		return NL80211_BAND_5GHZ;
392 	return NL80211_BAND_2GHZ;
393 }
394 
395 static int iwl_init_channel_map(struct iwl_trans *trans,
396 				const struct iwl_fw *fw,
397 				struct iwl_nvm_data *data,
398 				const void * const nvm_ch_flags,
399 				u32 sbands_flags, bool v4)
400 {
401 	const struct iwl_cfg *cfg = trans->cfg;
402 	struct device *dev = trans->dev;
403 	int ch_idx;
404 	int n_channels = 0;
405 	struct ieee80211_channel *channel;
406 	u32 ch_flags;
407 	int num_of_ch;
408 	const u16 *nvm_chan;
409 
410 	if (cfg->uhb_supported) {
411 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
412 		nvm_chan = iwl_uhb_nvm_channels;
413 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
414 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
415 		nvm_chan = iwl_ext_nvm_channels;
416 	} else {
417 		num_of_ch = IWL_NVM_NUM_CHANNELS;
418 		nvm_chan = iwl_nvm_channels;
419 	}
420 
421 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
422 		enum nl80211_band band =
423 			iwl_nl80211_band_from_channel_idx(ch_idx);
424 
425 		if (v4)
426 			ch_flags =
427 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
428 		else
429 			ch_flags =
430 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
431 
432 		if (band == NL80211_BAND_5GHZ &&
433 		    !data->sku_cap_band_52ghz_enable)
434 			continue;
435 
436 		/* workaround to disable wide channels in 5GHz */
437 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
438 		    band == NL80211_BAND_5GHZ) {
439 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
440 				     NVM_CHANNEL_80MHZ |
441 				     NVM_CHANNEL_160MHZ);
442 		}
443 
444 		if (ch_flags & NVM_CHANNEL_160MHZ)
445 			data->vht160_supported = true;
446 
447 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
448 		    !(ch_flags & NVM_CHANNEL_VALID)) {
449 			/*
450 			 * Channels might become valid later if lar is
451 			 * supported, hence we still want to add them to
452 			 * the list of supported channels to cfg80211.
453 			 */
454 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
455 						    nvm_chan[ch_idx], ch_flags);
456 			continue;
457 		}
458 
459 		channel = &data->channels[n_channels];
460 		n_channels++;
461 
462 		channel->hw_value = nvm_chan[ch_idx];
463 		channel->band = band;
464 		channel->center_freq =
465 			ieee80211_channel_to_frequency(
466 				channel->hw_value, channel->band);
467 
468 		/* Initialize regulatory-based run-time data */
469 
470 		/*
471 		 * Default value - highest tx power value.  max_power
472 		 * is not used in mvm, and is used for backwards compatibility
473 		 */
474 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
475 
476 		/* don't put limitations in case we're using LAR */
477 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
478 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
479 							       ch_idx, band,
480 							       ch_flags, cfg);
481 		else
482 			channel->flags = 0;
483 
484 		if (fw_has_capa(&fw->ucode_capa,
485 				IWL_UCODE_TLV_CAPA_MONITOR_PASSIVE_CHANS))
486 			channel->flags |= IEEE80211_CHAN_CAN_MONITOR;
487 
488 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
489 					    channel->hw_value, ch_flags);
490 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
491 				 channel->hw_value, channel->max_power);
492 	}
493 
494 	return n_channels;
495 }
496 
497 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
498 				  struct iwl_nvm_data *data,
499 				  struct ieee80211_sta_vht_cap *vht_cap,
500 				  u8 tx_chains, u8 rx_chains)
501 {
502 	const struct iwl_cfg *cfg = trans->cfg;
503 	int num_rx_ants = num_of_ant(rx_chains);
504 	int num_tx_ants = num_of_ant(tx_chains);
505 
506 	vht_cap->vht_supported = true;
507 
508 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
509 		       IEEE80211_VHT_CAP_RXSTBC_1 |
510 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
511 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
512 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
513 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
514 
515 	if (!trans->cfg->ht_params->stbc)
516 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
517 
518 	if (data->vht160_supported)
519 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
520 				IEEE80211_VHT_CAP_SHORT_GI_160;
521 
522 	if (cfg->vht_mu_mimo_supported)
523 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
524 
525 	if (cfg->ht_params->ldpc)
526 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
527 
528 	if (data->sku_cap_mimo_disabled) {
529 		num_rx_ants = 1;
530 		num_tx_ants = 1;
531 	}
532 
533 	if (trans->cfg->ht_params->stbc && num_tx_ants > 1)
534 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
535 	else
536 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
537 
538 	switch (iwlwifi_mod_params.amsdu_size) {
539 	case IWL_AMSDU_DEF:
540 		if (trans->trans_cfg->mq_rx_supported)
541 			vht_cap->cap |=
542 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
543 		else
544 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
545 		break;
546 	case IWL_AMSDU_2K:
547 		if (trans->trans_cfg->mq_rx_supported)
548 			vht_cap->cap |=
549 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
550 		else
551 			WARN(1, "RB size of 2K is not supported by this device\n");
552 		break;
553 	case IWL_AMSDU_4K:
554 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
555 		break;
556 	case IWL_AMSDU_8K:
557 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
558 		break;
559 	case IWL_AMSDU_12K:
560 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
561 		break;
562 	default:
563 		break;
564 	}
565 
566 	vht_cap->vht_mcs.rx_mcs_map =
567 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
568 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
569 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
570 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
571 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
572 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
573 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
574 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
575 
576 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
577 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
578 		/* this works because NOT_SUPPORTED == 3 */
579 		vht_cap->vht_mcs.rx_mcs_map |=
580 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
581 	}
582 
583 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
584 
585 	vht_cap->vht_mcs.tx_highest |=
586 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
587 }
588 
589 static const u8 iwl_vendor_caps[] = {
590 	0xdd,			/* vendor element */
591 	0x06,			/* length */
592 	0x00, 0x17, 0x35,	/* Intel OUI */
593 	0x08,			/* type (Intel Capabilities) */
594 	/* followed by 16 bits of capabilities */
595 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
596 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
597 	0x00
598 };
599 
600 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
601 	{
602 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
603 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
604 		.he_cap = {
605 			.has_he = true,
606 			.he_cap_elem = {
607 				.mac_cap_info[0] =
608 					IEEE80211_HE_MAC_CAP0_HTC_HE,
609 				.mac_cap_info[1] =
610 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
611 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
612 				.mac_cap_info[2] =
613 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
614 				.mac_cap_info[3] =
615 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
616 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
617 				.mac_cap_info[4] =
618 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
619 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
620 				.mac_cap_info[5] =
621 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
622 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
623 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
624 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
625 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
626 				.phy_cap_info[1] =
627 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
628 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
629 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
630 				.phy_cap_info[2] =
631 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
632 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
633 				.phy_cap_info[3] =
634 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
635 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
636 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
637 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
638 				.phy_cap_info[4] =
639 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
640 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
641 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
642 				.phy_cap_info[6] =
643 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
644 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
645 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
646 				.phy_cap_info[7] =
647 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
648 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
649 				.phy_cap_info[8] =
650 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
651 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
652 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
653 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
654 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
655 				.phy_cap_info[9] =
656 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
657 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
658 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
659 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
660 				.phy_cap_info[10] =
661 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
662 			},
663 			/*
664 			 * Set default Tx/Rx HE MCS NSS Support field.
665 			 * Indicate support for up to 2 spatial streams and all
666 			 * MCS, without any special cases
667 			 */
668 			.he_mcs_nss_supp = {
669 				.rx_mcs_80 = cpu_to_le16(0xfffa),
670 				.tx_mcs_80 = cpu_to_le16(0xfffa),
671 				.rx_mcs_160 = cpu_to_le16(0xfffa),
672 				.tx_mcs_160 = cpu_to_le16(0xfffa),
673 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
674 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
675 			},
676 			/*
677 			 * Set default PPE thresholds, with PPET16 set to 0,
678 			 * PPET8 set to 7
679 			 */
680 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
681 		},
682 		.eht_cap = {
683 			.has_eht = true,
684 			.eht_cap_elem = {
685 				.mac_cap_info[0] =
686 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
687 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
688 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2 |
689 					IEEE80211_EHT_MAC_CAP0_SCS_TRAFFIC_DESC,
690 				.phy_cap_info[0] =
691 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
692 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
693 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
694 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
695 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
696 				.phy_cap_info[1] =
697 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
698 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
699 				.phy_cap_info[3] =
700 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
701 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
702 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
703 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
704 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
705 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
706 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
707 
708 				.phy_cap_info[4] =
709 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
710 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
711 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
712 				.phy_cap_info[5] =
713 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
714 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US) |
715 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
716 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
717 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP,
718 				.phy_cap_info[6] =
719 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
720 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
721 				.phy_cap_info[8] =
722 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
723 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
724 			},
725 
726 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
727 			 * Rx - note we don't set the only_20mhz, but due to this
728 			 * being a union, it gets set correctly anyway.
729 			 */
730 			.eht_mcs_nss_supp = {
731 				.bw._80 = {
732 					.rx_tx_mcs9_max_nss = 0x22,
733 					.rx_tx_mcs11_max_nss = 0x22,
734 					.rx_tx_mcs13_max_nss = 0x22,
735 				},
736 				.bw._160 = {
737 					.rx_tx_mcs9_max_nss = 0x22,
738 					.rx_tx_mcs11_max_nss = 0x22,
739 					.rx_tx_mcs13_max_nss = 0x22,
740 				},
741 				.bw._320 = {
742 					.rx_tx_mcs9_max_nss = 0x22,
743 					.rx_tx_mcs11_max_nss = 0x22,
744 					.rx_tx_mcs13_max_nss = 0x22,
745 				},
746 			},
747 
748 			/*
749 			 * PPE thresholds for NSS = 2, and RU index bitmap set
750 			 * to 0xc.
751 			 * Note: just for stating what we want, not present in
752 			 * the transmitted data due to not including
753 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
754 			 */
755 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
756 		},
757 	},
758 	{
759 		.types_mask = BIT(NL80211_IFTYPE_AP) |
760 			      BIT(NL80211_IFTYPE_P2P_GO),
761 		.he_cap = {
762 			.has_he = true,
763 			.he_cap_elem = {
764 				.mac_cap_info[0] =
765 					IEEE80211_HE_MAC_CAP0_HTC_HE,
766 				.mac_cap_info[1] =
767 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
768 				.mac_cap_info[3] =
769 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
770 				.phy_cap_info[1] =
771 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
772 				.phy_cap_info[2] =
773 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
774 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
775 				.phy_cap_info[3] =
776 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
777 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
778 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
779 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
780 				.phy_cap_info[6] =
781 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
782 				.phy_cap_info[7] =
783 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
784 				.phy_cap_info[8] =
785 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
786 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
787 				.phy_cap_info[9] =
788 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
789 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
790 			},
791 			/*
792 			 * Set default Tx/Rx HE MCS NSS Support field.
793 			 * Indicate support for up to 2 spatial streams and all
794 			 * MCS, without any special cases
795 			 */
796 			.he_mcs_nss_supp = {
797 				.rx_mcs_80 = cpu_to_le16(0xfffa),
798 				.tx_mcs_80 = cpu_to_le16(0xfffa),
799 				.rx_mcs_160 = cpu_to_le16(0xfffa),
800 				.tx_mcs_160 = cpu_to_le16(0xfffa),
801 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
802 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
803 			},
804 			/*
805 			 * Set default PPE thresholds, with PPET16 set to 0,
806 			 * PPET8 set to 7
807 			 */
808 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
809 		},
810 		.eht_cap = {
811 			.has_eht = true,
812 			.eht_cap_elem = {
813 				.mac_cap_info[0] =
814 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
815 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
816 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
817 				.phy_cap_info[0] =
818 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
819 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
820 				.phy_cap_info[5] =
821 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
822 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US),
823 			},
824 
825 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
826 			 * Rx - note we don't set the only_20mhz, but due to this
827 			 * being a union, it gets set correctly anyway.
828 			 */
829 			.eht_mcs_nss_supp = {
830 				.bw._80 = {
831 					.rx_tx_mcs9_max_nss = 0x22,
832 					.rx_tx_mcs11_max_nss = 0x22,
833 					.rx_tx_mcs13_max_nss = 0x22,
834 				},
835 				.bw._160 = {
836 					.rx_tx_mcs9_max_nss = 0x22,
837 					.rx_tx_mcs11_max_nss = 0x22,
838 					.rx_tx_mcs13_max_nss = 0x22,
839 				},
840 				.bw._320 = {
841 					.rx_tx_mcs9_max_nss = 0x22,
842 					.rx_tx_mcs11_max_nss = 0x22,
843 					.rx_tx_mcs13_max_nss = 0x22,
844 				},
845 			},
846 
847 			/*
848 			 * PPE thresholds for NSS = 2, and RU index bitmap set
849 			 * to 0xc.
850 			 * Note: just for stating what we want, not present in
851 			 * the transmitted data due to not including
852 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
853 			 */
854 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
855 		},
856 	},
857 };
858 
859 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
860 				  struct iwl_nvm_data *data,
861 				  struct ieee80211_supported_band *sband,
862 				  u8 tx_chains, u8 rx_chains)
863 {
864 	struct ieee80211_sta_ht_cap ht_cap;
865 	struct ieee80211_sta_vht_cap vht_cap = {};
866 	struct ieee80211_sband_iftype_data *iftype_data;
867 	u16 he_6ghz_capa = 0;
868 	u32 exp;
869 	int i;
870 
871 	if (sband->band != NL80211_BAND_6GHZ)
872 		return;
873 
874 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
875 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
876 			     tx_chains, rx_chains);
877 	WARN_ON(!ht_cap.ht_supported);
878 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
879 	WARN_ON(!vht_cap.vht_supported);
880 
881 	he_6ghz_capa |=
882 		u16_encode_bits(ht_cap.ampdu_density,
883 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
884 	exp = u32_get_bits(vht_cap.cap,
885 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
886 	he_6ghz_capa |=
887 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
888 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
889 	he_6ghz_capa |=
890 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
891 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
892 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
893 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
894 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
895 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
896 
897 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
898 
899 	/* we know it's writable - we set it before ourselves */
900 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
901 	for (i = 0; i < sband->n_iftype_data; i++)
902 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
903 }
904 
905 static void
906 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
907 			 struct iwl_nvm_data *data,
908 			 struct ieee80211_supported_band *sband,
909 			 struct ieee80211_sband_iftype_data *iftype_data,
910 			 u8 tx_chains, u8 rx_chains,
911 			 const struct iwl_fw *fw)
912 {
913 	bool is_ap = iftype_data->types_mask & (BIT(NL80211_IFTYPE_AP) |
914 						BIT(NL80211_IFTYPE_P2P_GO));
915 	bool no_320;
916 
917 	no_320 = (!trans->trans_cfg->integrated &&
918 		 trans->pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB) ||
919 		 trans->reduced_cap_sku;
920 
921 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be)
922 		iftype_data->eht_cap.has_eht = false;
923 
924 	/* Advertise an A-MPDU exponent extension based on
925 	 * operating band
926 	 */
927 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
928 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
929 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
930 	else if (sband->band != NL80211_BAND_2GHZ)
931 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
932 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
933 	else
934 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
935 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
936 
937 	switch (sband->band) {
938 	case NL80211_BAND_2GHZ:
939 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
940 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
941 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
942 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
943 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
944 		break;
945 	case NL80211_BAND_6GHZ:
946 		if (!no_320) {
947 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
948 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
949 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
950 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
951 		}
952 		fallthrough;
953 	case NL80211_BAND_5GHZ:
954 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
955 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
956 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
957 		break;
958 	default:
959 		WARN_ON(1);
960 		break;
961 	}
962 
963 	if ((tx_chains & rx_chains) == ANT_AB) {
964 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
965 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
966 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
967 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
968 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
969 		if (!is_ap) {
970 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
971 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
972 
973 			if (iftype_data->eht_cap.has_eht) {
974 				/*
975 				 * Set the number of sounding dimensions for each
976 				 * bandwidth to 1 to indicate the maximal supported
977 				 * value of TXVECTOR parameter NUM_STS of 2
978 				 */
979 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
980 
981 				/*
982 				 * Set the MAX NC to 1 to indicate sounding feedback of
983 				 * 2 supported by the beamfomee.
984 				 */
985 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
986 			}
987 		}
988 	} else {
989 		struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp =
990 			&iftype_data->he_cap.he_mcs_nss_supp;
991 
992 		if (iftype_data->eht_cap.has_eht) {
993 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
994 				&iftype_data->eht_cap.eht_mcs_nss_supp;
995 
996 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
997 		}
998 
999 		if (!is_ap) {
1000 			/* If not 2x2, we need to indicate 1x1 in the
1001 			 * Midamble RX Max NSTS - but not for AP mode
1002 			 */
1003 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
1004 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
1005 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1006 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
1007 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
1008 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
1009 		}
1010 
1011 		he_mcs_nss_supp->rx_mcs_80 |=
1012 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1013 		he_mcs_nss_supp->tx_mcs_80 |=
1014 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1015 		he_mcs_nss_supp->rx_mcs_160 |=
1016 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1017 		he_mcs_nss_supp->tx_mcs_160 |=
1018 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1019 		he_mcs_nss_supp->rx_mcs_80p80 |=
1020 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1021 		he_mcs_nss_supp->tx_mcs_80p80 |=
1022 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1023 	}
1024 
1025 	if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
1026 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
1027 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
1028 
1029 	switch (CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
1030 	case IWL_CFG_RF_TYPE_GF:
1031 	case IWL_CFG_RF_TYPE_FM:
1032 	case IWL_CFG_RF_TYPE_WH:
1033 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1034 			IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
1035 		if (!is_ap)
1036 			iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1037 				IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
1038 		break;
1039 	}
1040 
1041 	if (CSR_HW_REV_TYPE(trans->hw_rev) == IWL_CFG_MAC_TYPE_GL &&
1042 	    iftype_data->eht_cap.has_eht) {
1043 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] &=
1044 			~(IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
1045 			  IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2);
1046 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[3] &=
1047 			~(IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
1048 			  IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
1049 			  IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
1050 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
1051 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
1052 			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
1053 			  IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK);
1054 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &=
1055 			~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
1056 			  IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP);
1057 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] &=
1058 			~IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK;
1059 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[6] &=
1060 			~(IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
1061 			  IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP);
1062 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] |=
1063 			IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF;
1064 	}
1065 
1066 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
1067 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
1068 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
1069 
1070 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1071 	    !is_ap) {
1072 		iftype_data->vendor_elems.data = iwl_vendor_caps;
1073 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
1074 	}
1075 
1076 	if (!trans->cfg->ht_params->stbc) {
1077 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1078 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
1079 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
1080 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
1081 	}
1082 
1083 	if (trans->step_urm) {
1084 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs11_max_nss = 0;
1085 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs13_max_nss = 0;
1086 	}
1087 
1088 	if (trans->no_160)
1089 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] &=
1090 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
1091 
1092 	if (trans->reduced_cap_sku) {
1093 		memset(&iftype_data->eht_cap.eht_mcs_nss_supp.bw._320, 0,
1094 		       sizeof(iftype_data->eht_cap.eht_mcs_nss_supp.bw._320));
1095 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._80.rx_tx_mcs13_max_nss = 0;
1096 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._160.rx_tx_mcs13_max_nss = 0;
1097 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[8] &=
1098 			~IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA;
1099 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] &=
1100 			~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
1101 	}
1102 }
1103 
1104 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1105 				 struct iwl_nvm_data *data,
1106 				 struct ieee80211_supported_band *sband,
1107 				 u8 tx_chains, u8 rx_chains,
1108 				 const struct iwl_fw *fw)
1109 {
1110 	struct ieee80211_sband_iftype_data *iftype_data;
1111 	int i;
1112 
1113 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1114 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1115 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1116 
1117 	switch (sband->band) {
1118 	case NL80211_BAND_2GHZ:
1119 		iftype_data = data->iftd.low;
1120 		break;
1121 	case NL80211_BAND_5GHZ:
1122 		iftype_data = data->iftd.high;
1123 		break;
1124 	case NL80211_BAND_6GHZ:
1125 		iftype_data = data->iftd.uhb;
1126 		break;
1127 	default:
1128 		WARN_ON(1);
1129 		return;
1130 	}
1131 
1132 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1133 
1134 	_ieee80211_set_sband_iftype_data(sband, iftype_data,
1135 					 ARRAY_SIZE(iwl_he_eht_capa));
1136 
1137 	for (i = 0; i < sband->n_iftype_data; i++)
1138 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1139 					 tx_chains, rx_chains, fw);
1140 
1141 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1142 }
1143 
1144 void iwl_reinit_cab(struct iwl_trans *trans, struct iwl_nvm_data *data,
1145 		    u8 tx_chains, u8 rx_chains, const struct iwl_fw *fw)
1146 {
1147 	struct ieee80211_supported_band *sband;
1148 
1149 	sband = &data->bands[NL80211_BAND_2GHZ];
1150 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1151 			     tx_chains, rx_chains);
1152 
1153 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1154 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1155 				     fw);
1156 
1157 	sband = &data->bands[NL80211_BAND_5GHZ];
1158 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1159 			     tx_chains, rx_chains);
1160 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1161 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1162 				      tx_chains, rx_chains);
1163 
1164 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1165 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1166 				     fw);
1167 
1168 	sband = &data->bands[NL80211_BAND_6GHZ];
1169 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1170 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1171 				     fw);
1172 }
1173 IWL_EXPORT_SYMBOL(iwl_reinit_cab);
1174 
1175 static void iwl_init_sbands(struct iwl_trans *trans,
1176 			    struct iwl_nvm_data *data,
1177 			    const void *nvm_ch_flags, u8 tx_chains,
1178 			    u8 rx_chains, u32 sbands_flags, bool v4,
1179 			    const struct iwl_fw *fw)
1180 {
1181 	struct device *dev = trans->dev;
1182 	int n_channels;
1183 	int n_used = 0;
1184 	struct ieee80211_supported_band *sband;
1185 
1186 	n_channels = iwl_init_channel_map(trans, fw, data, nvm_ch_flags,
1187 					  sbands_flags, v4);
1188 	sband = &data->bands[NL80211_BAND_2GHZ];
1189 	sband->band = NL80211_BAND_2GHZ;
1190 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1191 	sband->n_bitrates = N_RATES_24;
1192 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1193 					  NL80211_BAND_2GHZ);
1194 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1195 			     tx_chains, rx_chains);
1196 
1197 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1198 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1199 				     fw);
1200 
1201 	sband = &data->bands[NL80211_BAND_5GHZ];
1202 	sband->band = NL80211_BAND_5GHZ;
1203 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1204 	sband->n_bitrates = N_RATES_52;
1205 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1206 					  NL80211_BAND_5GHZ);
1207 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1208 			     tx_chains, rx_chains);
1209 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1210 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1211 				      tx_chains, rx_chains);
1212 
1213 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1214 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1215 				     fw);
1216 
1217 	/* 6GHz band. */
1218 	sband = &data->bands[NL80211_BAND_6GHZ];
1219 	sband->band = NL80211_BAND_6GHZ;
1220 	/* use the same rates as 5GHz band */
1221 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1222 	sband->n_bitrates = N_RATES_52;
1223 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1224 					  NL80211_BAND_6GHZ);
1225 
1226 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1227 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1228 				     fw);
1229 	else
1230 		sband->n_channels = 0;
1231 	if (n_channels != n_used)
1232 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1233 			    n_used, n_channels);
1234 }
1235 
1236 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1237 		       const __le16 *phy_sku)
1238 {
1239 	if (cfg->nvm_type != IWL_NVM_EXT)
1240 		return le16_to_cpup(nvm_sw + SKU);
1241 
1242 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1243 }
1244 
1245 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1246 {
1247 	if (cfg->nvm_type != IWL_NVM_EXT)
1248 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1249 	else
1250 		return le32_to_cpup((const __le32 *)(nvm_sw +
1251 						     NVM_VERSION_EXT_NVM));
1252 }
1253 
1254 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1255 			     const __le16 *phy_sku)
1256 {
1257 	if (cfg->nvm_type != IWL_NVM_EXT)
1258 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1259 
1260 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1261 
1262 }
1263 
1264 static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1265 {
1266 	int n_hw_addr;
1267 
1268 	if (cfg->nvm_type != IWL_NVM_EXT)
1269 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1270 
1271 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1272 
1273 	return n_hw_addr & N_HW_ADDR_MASK;
1274 }
1275 
1276 static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
1277 			      struct iwl_nvm_data *data,
1278 			      u32 radio_cfg)
1279 {
1280 	if (cfg->nvm_type != IWL_NVM_EXT) {
1281 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1282 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1283 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1284 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1285 		return;
1286 	}
1287 
1288 	/* set the radio configuration for family 8000 */
1289 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1290 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1291 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1292 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1293 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1294 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1295 }
1296 
1297 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1298 {
1299 	const u8 *hw_addr;
1300 
1301 	hw_addr = (const u8 *)&mac_addr0;
1302 	dest[0] = hw_addr[3];
1303 	dest[1] = hw_addr[2];
1304 	dest[2] = hw_addr[1];
1305 	dest[3] = hw_addr[0];
1306 
1307 	hw_addr = (const u8 *)&mac_addr1;
1308 	dest[4] = hw_addr[1];
1309 	dest[5] = hw_addr[0];
1310 }
1311 
1312 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1313 					struct iwl_nvm_data *data)
1314 {
1315 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1316 						  CSR_MAC_ADDR0_STRAP(trans)));
1317 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1318 						  CSR_MAC_ADDR1_STRAP(trans)));
1319 
1320 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1321 	/*
1322 	 * If the OEM fused a valid address, use it instead of the one in the
1323 	 * OTP
1324 	 */
1325 	if (is_valid_ether_addr(data->hw_addr))
1326 		return;
1327 
1328 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1329 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1330 
1331 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1332 }
1333 
1334 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1335 					   const struct iwl_cfg *cfg,
1336 					   struct iwl_nvm_data *data,
1337 					   const __le16 *mac_override,
1338 					   const __be16 *nvm_hw)
1339 {
1340 	const u8 *hw_addr;
1341 
1342 	if (mac_override) {
1343 		static const u8 reserved_mac[] = {
1344 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1345 		};
1346 
1347 		hw_addr = (const u8 *)(mac_override +
1348 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1349 
1350 		/*
1351 		 * Store the MAC address from MAO section.
1352 		 * No byte swapping is required in MAO section
1353 		 */
1354 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1355 
1356 		/*
1357 		 * Force the use of the OTP MAC address in case of reserved MAC
1358 		 * address in the NVM, or if address is given but invalid.
1359 		 */
1360 		if (is_valid_ether_addr(data->hw_addr) &&
1361 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1362 			return;
1363 
1364 		IWL_ERR(trans,
1365 			"mac address from nvm override section is not valid\n");
1366 	}
1367 
1368 	if (nvm_hw) {
1369 		/* read the mac address from WFMP registers */
1370 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1371 						WFMP_MAC_ADDR_0));
1372 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1373 						WFMP_MAC_ADDR_1));
1374 
1375 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1376 
1377 		return;
1378 	}
1379 
1380 	IWL_ERR(trans, "mac address is not found\n");
1381 }
1382 
1383 static int iwl_set_hw_address(struct iwl_trans *trans,
1384 			      const struct iwl_cfg *cfg,
1385 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1386 			      const __le16 *mac_override)
1387 {
1388 	if (cfg->mac_addr_from_csr) {
1389 		iwl_set_hw_address_from_csr(trans, data);
1390 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1391 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1392 
1393 		/* The byte order is little endian 16 bit, meaning 214365 */
1394 		data->hw_addr[0] = hw_addr[1];
1395 		data->hw_addr[1] = hw_addr[0];
1396 		data->hw_addr[2] = hw_addr[3];
1397 		data->hw_addr[3] = hw_addr[2];
1398 		data->hw_addr[4] = hw_addr[5];
1399 		data->hw_addr[5] = hw_addr[4];
1400 	} else {
1401 		iwl_set_hw_address_family_8000(trans, cfg, data,
1402 					       mac_override, nvm_hw);
1403 	}
1404 
1405 	if (!is_valid_ether_addr(data->hw_addr)) {
1406 		IWL_ERR(trans, "no valid mac address was found\n");
1407 		return -EINVAL;
1408 	}
1409 
1410 	if (!trans->csme_own)
1411 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1412 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1413 
1414 	return 0;
1415 }
1416 
1417 static bool
1418 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1419 			const __be16 *nvm_hw)
1420 {
1421 	/*
1422 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1423 	 * some 7000-family OTPs erroneously allow wide channels in
1424 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1425 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1426 	 * 9.  In those cases, we need to force-disable wide channels
1427 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1428 	 * to use them.
1429 	 */
1430 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1431 		/*
1432 		 * Unlike the other sections in the NVM, the hw
1433 		 * section uses big-endian.
1434 		 */
1435 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1436 		u8 sku = (subsystem_id & 0x1e) >> 1;
1437 
1438 		if (sku == 5 || sku == 9) {
1439 			IWL_DEBUG_EEPROM(trans->dev,
1440 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1441 					 subsystem_id, sku);
1442 			return true;
1443 		}
1444 	}
1445 
1446 	return false;
1447 }
1448 
1449 struct iwl_nvm_data *
1450 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1451 		       const struct iwl_mei_nvm *mei_nvm,
1452 		       const struct iwl_fw *fw, u8 tx_ant, u8 rx_ant)
1453 {
1454 	struct iwl_nvm_data *data;
1455 	u32 sbands_flags = 0;
1456 	u8 rx_chains = fw->valid_rx_ant;
1457 	u8 tx_chains = fw->valid_rx_ant;
1458 
1459 	if (cfg->uhb_supported)
1460 		data = kzalloc(struct_size(data, channels,
1461 					   IWL_NVM_NUM_CHANNELS_UHB),
1462 					   GFP_KERNEL);
1463 	else
1464 		data = kzalloc(struct_size(data, channels,
1465 					   IWL_NVM_NUM_CHANNELS_EXT),
1466 					   GFP_KERNEL);
1467 	if (!data)
1468 		return NULL;
1469 
1470 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1471 		     IWL_NVM_NUM_CHANNELS_UHB);
1472 	data->nvm_version = mei_nvm->nvm_version;
1473 
1474 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1475 	if (data->valid_tx_ant)
1476 		tx_chains &= data->valid_tx_ant;
1477 	if (data->valid_rx_ant)
1478 		rx_chains &= data->valid_rx_ant;
1479 	if (tx_ant)
1480 		tx_chains &= tx_ant;
1481 	if (rx_ant)
1482 		rx_chains &= rx_ant;
1483 
1484 	data->sku_cap_mimo_disabled = false;
1485 	data->sku_cap_band_24ghz_enable = true;
1486 	data->sku_cap_band_52ghz_enable = true;
1487 	data->sku_cap_11n_enable =
1488 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1489 	data->sku_cap_11ac_enable = true;
1490 	data->sku_cap_11ax_enable =
1491 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1492 
1493 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1494 
1495 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1496 	/* If no valid mac address was found - bail out */
1497 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1498 		kfree(data);
1499 		return NULL;
1500 	}
1501 
1502 	if (data->lar_enabled &&
1503 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1504 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1505 
1506 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1507 			sbands_flags, true, fw);
1508 
1509 	return data;
1510 }
1511 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1512 
1513 struct iwl_nvm_data *
1514 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1515 		   const struct iwl_fw *fw,
1516 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1517 		   const __le16 *nvm_calib, const __le16 *regulatory,
1518 		   const __le16 *mac_override, const __le16 *phy_sku,
1519 		   u8 tx_chains, u8 rx_chains)
1520 {
1521 	struct iwl_nvm_data *data;
1522 	bool lar_enabled;
1523 	u32 sku, radio_cfg;
1524 	u32 sbands_flags = 0;
1525 	u16 lar_config;
1526 	const __le16 *ch_section;
1527 
1528 	if (cfg->uhb_supported)
1529 		data = kzalloc(struct_size(data, channels,
1530 					   IWL_NVM_NUM_CHANNELS_UHB),
1531 					   GFP_KERNEL);
1532 	else if (cfg->nvm_type != IWL_NVM_EXT)
1533 		data = kzalloc(struct_size(data, channels,
1534 					   IWL_NVM_NUM_CHANNELS),
1535 					   GFP_KERNEL);
1536 	else
1537 		data = kzalloc(struct_size(data, channels,
1538 					   IWL_NVM_NUM_CHANNELS_EXT),
1539 					   GFP_KERNEL);
1540 	if (!data)
1541 		return NULL;
1542 
1543 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1544 
1545 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1546 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1547 	if (data->valid_tx_ant)
1548 		tx_chains &= data->valid_tx_ant;
1549 	if (data->valid_rx_ant)
1550 		rx_chains &= data->valid_rx_ant;
1551 
1552 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1553 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1554 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1555 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1556 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1557 		data->sku_cap_11n_enable = false;
1558 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1559 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1560 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1561 
1562 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1563 
1564 	if (cfg->nvm_type != IWL_NVM_EXT) {
1565 		/* Checking for required sections */
1566 		if (!nvm_calib) {
1567 			IWL_ERR(trans,
1568 				"Can't parse empty Calib NVM sections\n");
1569 			kfree(data);
1570 			return NULL;
1571 		}
1572 
1573 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1574 			     &regulatory[NVM_CHANNELS_SDP] :
1575 			     &nvm_sw[NVM_CHANNELS];
1576 
1577 		/* in family 8000 Xtal calibration values moved to OTP */
1578 		data->xtal_calib[0] = *(nvm_calib + XTAL_CALIB);
1579 		data->xtal_calib[1] = *(nvm_calib + XTAL_CALIB + 1);
1580 		lar_enabled = true;
1581 	} else {
1582 		u16 lar_offset = data->nvm_version < 0xE39 ?
1583 				 NVM_LAR_OFFSET_OLD :
1584 				 NVM_LAR_OFFSET;
1585 
1586 		lar_config = le16_to_cpup(regulatory + lar_offset);
1587 		data->lar_enabled = !!(lar_config &
1588 				       NVM_LAR_ENABLED);
1589 		lar_enabled = data->lar_enabled;
1590 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1591 	}
1592 
1593 	/* If no valid mac address was found - bail out */
1594 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1595 		kfree(data);
1596 		return NULL;
1597 	}
1598 
1599 	if (lar_enabled &&
1600 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1601 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1602 
1603 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1604 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1605 
1606 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1607 			sbands_flags, false, fw);
1608 	data->calib_version = 255;
1609 
1610 	return data;
1611 }
1612 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1613 
1614 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1615 				       int ch_idx, u16 nvm_flags,
1616 				       struct iwl_reg_capa reg_capa,
1617 				       const struct iwl_cfg *cfg,
1618 				       bool uats_enabled)
1619 {
1620 	u32 flags = NL80211_RRF_NO_HT40;
1621 
1622 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1623 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1624 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1625 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1626 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1627 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1628 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1629 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1630 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1631 		else
1632 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1633 	}
1634 
1635 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1636 		flags |= NL80211_RRF_NO_80MHZ;
1637 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1638 		flags |= NL80211_RRF_NO_160MHZ;
1639 
1640 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1641 		flags |= NL80211_RRF_NO_IR;
1642 
1643 	if (nvm_flags & NVM_CHANNEL_RADAR)
1644 		flags |= NL80211_RRF_DFS;
1645 
1646 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1647 		flags |= NL80211_RRF_NO_OUTDOOR;
1648 
1649 	/* Set the GO concurrent flag only in case that NO_IR is set.
1650 	 * Otherwise it is meaningless
1651 	 */
1652 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT)) {
1653 		if (flags & NL80211_RRF_NO_IR)
1654 			flags |= NL80211_RRF_GO_CONCURRENT;
1655 		if (flags & NL80211_RRF_DFS) {
1656 			flags |= NL80211_RRF_DFS_CONCURRENT;
1657 			/* Our device doesn't set active bit for DFS channels
1658 			 * however, once marked as DFS no-ir is not needed.
1659 			 */
1660 			flags &= ~NL80211_RRF_NO_IR;
1661 		}
1662 	}
1663 
1664 	/* Set the AP type for the UHB case. */
1665 	if (uats_enabled) {
1666 		if (!(nvm_flags & NVM_CHANNEL_VLP))
1667 			flags |= NL80211_RRF_NO_6GHZ_VLP_CLIENT;
1668 
1669 		if (!(nvm_flags & NVM_CHANNEL_AFC))
1670 			flags |= NL80211_RRF_NO_6GHZ_AFC_CLIENT;
1671 	}
1672 
1673 	/*
1674 	 * reg_capa is per regulatory domain so apply it for every channel
1675 	 */
1676 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1677 		if (!reg_capa.allow_40mhz)
1678 			flags |= NL80211_RRF_NO_HT40;
1679 
1680 		if (!reg_capa.allow_80mhz)
1681 			flags |= NL80211_RRF_NO_80MHZ;
1682 
1683 		if (!reg_capa.allow_160mhz)
1684 			flags |= NL80211_RRF_NO_160MHZ;
1685 
1686 		if (!reg_capa.allow_320mhz)
1687 			flags |= NL80211_RRF_NO_320MHZ;
1688 	}
1689 
1690 	if (reg_capa.disable_11ax)
1691 		flags |= NL80211_RRF_NO_HE;
1692 
1693 	if (reg_capa.disable_11be)
1694 		flags |= NL80211_RRF_NO_EHT;
1695 
1696 	return flags;
1697 }
1698 
1699 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1700 {
1701 	struct iwl_reg_capa reg_capa = {};
1702 
1703 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1704 		reg_capa.allow_40mhz = true;
1705 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1706 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1707 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1708 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1709 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1710 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1711 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1712 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1713 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1714 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1715 	} else {
1716 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1717 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1718 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1719 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1720 	}
1721 	return reg_capa;
1722 }
1723 
1724 struct ieee80211_regdomain *
1725 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
1726 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1727 		       u16 geo_info, u32 cap, u8 resp_ver, bool uats_enabled)
1728 {
1729 	int ch_idx;
1730 	u16 ch_flags;
1731 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1732 	const u16 *nvm_chan;
1733 	struct ieee80211_regdomain *regd, *copy_rd;
1734 	struct ieee80211_reg_rule *rule;
1735 	enum nl80211_band band;
1736 	int center_freq, prev_center_freq = 0;
1737 	int valid_rules = 0;
1738 	bool new_rule;
1739 	int max_num_ch;
1740 	struct iwl_reg_capa reg_capa;
1741 
1742 	if (cfg->uhb_supported) {
1743 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1744 		nvm_chan = iwl_uhb_nvm_channels;
1745 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1746 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1747 		nvm_chan = iwl_ext_nvm_channels;
1748 	} else {
1749 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1750 		nvm_chan = iwl_nvm_channels;
1751 	}
1752 
1753 	if (num_of_ch > max_num_ch) {
1754 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1755 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1756 			      num_of_ch, max_num_ch);
1757 		num_of_ch = max_num_ch;
1758 	}
1759 
1760 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1761 		return ERR_PTR(-EINVAL);
1762 
1763 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1764 		      num_of_ch);
1765 
1766 	/* build a regdomain rule for every valid channel */
1767 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1768 	if (!regd)
1769 		return ERR_PTR(-ENOMEM);
1770 
1771 	/* set alpha2 from FW. */
1772 	regd->alpha2[0] = fw_mcc >> 8;
1773 	regd->alpha2[1] = fw_mcc & 0xff;
1774 
1775 	/* parse regulatory capability flags */
1776 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1777 
1778 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1779 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1780 		band = iwl_nl80211_band_from_channel_idx(ch_idx);
1781 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1782 							     band);
1783 		new_rule = false;
1784 
1785 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1786 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1787 						    nvm_chan[ch_idx], ch_flags);
1788 			continue;
1789 		}
1790 
1791 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1792 							     ch_flags, reg_capa,
1793 							     cfg, uats_enabled);
1794 
1795 		/* we can't continue the same rule */
1796 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1797 		    center_freq - prev_center_freq > 20) {
1798 			valid_rules++;
1799 			new_rule = true;
1800 		}
1801 
1802 		rule = &regd->reg_rules[valid_rules - 1];
1803 
1804 		if (new_rule)
1805 			rule->freq_range.start_freq_khz =
1806 						MHZ_TO_KHZ(center_freq - 10);
1807 
1808 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1809 
1810 		/* this doesn't matter - not used by FW */
1811 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1812 		rule->power_rule.max_eirp =
1813 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1814 
1815 		rule->flags = reg_rule_flags;
1816 
1817 		/* rely on auto-calculation to merge BW of contiguous chans */
1818 		rule->flags |= NL80211_RRF_AUTO_BW;
1819 		rule->freq_range.max_bandwidth_khz = 0;
1820 
1821 		prev_center_freq = center_freq;
1822 		prev_reg_rule_flags = reg_rule_flags;
1823 
1824 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1825 					    nvm_chan[ch_idx], ch_flags);
1826 
1827 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1828 		    band == NL80211_BAND_2GHZ)
1829 			continue;
1830 
1831 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1832 	}
1833 
1834 	/*
1835 	 * Certain firmware versions might report no valid channels
1836 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1837 	 * running. We'll get out of this situation later when the
1838 	 * rfkill is removed and we update the regdomain again, but
1839 	 * since cfg80211 doesn't accept an empty regdomain, add a
1840 	 * dummy (unusable) rule here in this case so we can init.
1841 	 */
1842 	if (!valid_rules) {
1843 		valid_rules = 1;
1844 		rule = &regd->reg_rules[valid_rules - 1];
1845 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1846 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1847 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1848 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1849 		rule->power_rule.max_eirp =
1850 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1851 	}
1852 
1853 	regd->n_reg_rules = valid_rules;
1854 
1855 	/*
1856 	 * Narrow down regdom for unused regulatory rules to prevent hole
1857 	 * between reg rules to wmm rules.
1858 	 */
1859 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1860 			  GFP_KERNEL);
1861 	if (!copy_rd)
1862 		copy_rd = ERR_PTR(-ENOMEM);
1863 
1864 	kfree(regd);
1865 	return copy_rd;
1866 }
1867 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1868 
1869 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1870 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1871 #define MAX_NVM_FILE_LEN	16384
1872 
1873 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1874 		    unsigned int len)
1875 {
1876 #define IWL_4165_DEVICE_ID	0x5501
1877 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1878 
1879 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1880 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1881 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1882 		/* OTP 0x52 bug work around: it's a 1x1 device */
1883 		data[3] = ANT_B | (ANT_B << 4);
1884 }
1885 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1886 
1887 /*
1888  * Reads external NVM from a file into mvm->nvm_sections
1889  *
1890  * HOW TO CREATE THE NVM FILE FORMAT:
1891  * ------------------------------
1892  * 1. create hex file, format:
1893  *      3800 -> header
1894  *      0000 -> header
1895  *      5a40 -> data
1896  *
1897  *   rev - 6 bit (word1)
1898  *   len - 10 bit (word1)
1899  *   id - 4 bit (word2)
1900  *   rsv - 12 bit (word2)
1901  *
1902  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1903  *
1904  * 3. create binary file from the hex file
1905  *
1906  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1907  */
1908 int iwl_read_external_nvm(struct iwl_trans *trans,
1909 			  const char *nvm_file_name,
1910 			  struct iwl_nvm_section *nvm_sections)
1911 {
1912 	int ret, section_size;
1913 	u16 section_id;
1914 	const struct firmware *fw_entry;
1915 	const struct {
1916 		__le16 word1;
1917 		__le16 word2;
1918 		u8 data[];
1919 	} *file_sec;
1920 	const u8 *eof;
1921 	u8 *temp;
1922 	int max_section_size;
1923 	const __le32 *dword_buff;
1924 
1925 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1926 #define NVM_WORD2_ID(x) (x >> 12)
1927 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1928 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1929 #define NVM_HEADER_0	(0x2A504C54)
1930 #define NVM_HEADER_1	(0x4E564D2A)
1931 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1932 
1933 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1934 
1935 	/* Maximal size depends on NVM version */
1936 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1937 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1938 	else
1939 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1940 
1941 	/*
1942 	 * Obtain NVM image via request_firmware. Since we already used
1943 	 * request_firmware_nowait() for the firmware binary load and only
1944 	 * get here after that we assume the NVM request can be satisfied
1945 	 * synchronously.
1946 	 */
1947 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1948 	if (ret) {
1949 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1950 			nvm_file_name, ret);
1951 		return ret;
1952 	}
1953 
1954 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1955 		 nvm_file_name, fw_entry->size);
1956 
1957 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1958 		IWL_ERR(trans, "NVM file too large\n");
1959 		ret = -EINVAL;
1960 		goto out;
1961 	}
1962 
1963 	eof = fw_entry->data + fw_entry->size;
1964 	dword_buff = (const __le32 *)fw_entry->data;
1965 
1966 	/* some NVM file will contain a header.
1967 	 * The header is identified by 2 dwords header as follow:
1968 	 * dword[0] = 0x2A504C54
1969 	 * dword[1] = 0x4E564D2A
1970 	 *
1971 	 * This header must be skipped when providing the NVM data to the FW.
1972 	 */
1973 	if (fw_entry->size > NVM_HEADER_SIZE &&
1974 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1975 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1976 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1977 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1978 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1979 			 le32_to_cpu(dword_buff[3]));
1980 
1981 		/* nvm file validation, dword_buff[2] holds the file version */
1982 		if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1983 		    trans->hw_rev_step == SILICON_C_STEP &&
1984 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1985 			ret = -EFAULT;
1986 			goto out;
1987 		}
1988 	} else {
1989 		file_sec = (const void *)fw_entry->data;
1990 	}
1991 
1992 	while (true) {
1993 		if (file_sec->data > eof) {
1994 			IWL_ERR(trans,
1995 				"ERROR - NVM file too short for section header\n");
1996 			ret = -EINVAL;
1997 			break;
1998 		}
1999 
2000 		/* check for EOF marker */
2001 		if (!file_sec->word1 && !file_sec->word2) {
2002 			ret = 0;
2003 			break;
2004 		}
2005 
2006 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
2007 			section_size =
2008 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
2009 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
2010 		} else {
2011 			section_size = 2 * EXT_NVM_WORD2_LEN(
2012 						le16_to_cpu(file_sec->word2));
2013 			section_id = EXT_NVM_WORD1_ID(
2014 						le16_to_cpu(file_sec->word1));
2015 		}
2016 
2017 		if (section_size > max_section_size) {
2018 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
2019 				section_size);
2020 			ret = -EINVAL;
2021 			break;
2022 		}
2023 
2024 		if (!section_size) {
2025 			IWL_ERR(trans, "ERROR - section empty\n");
2026 			ret = -EINVAL;
2027 			break;
2028 		}
2029 
2030 		if (file_sec->data + section_size > eof) {
2031 			IWL_ERR(trans,
2032 				"ERROR - NVM file too short for section (%d bytes)\n",
2033 				section_size);
2034 			ret = -EINVAL;
2035 			break;
2036 		}
2037 
2038 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
2039 			 "Invalid NVM section ID %d\n", section_id)) {
2040 			ret = -EINVAL;
2041 			break;
2042 		}
2043 
2044 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
2045 		if (!temp) {
2046 			ret = -ENOMEM;
2047 			break;
2048 		}
2049 
2050 		iwl_nvm_fixups(trans->hw_id, section_id, temp, section_size);
2051 
2052 		kfree(nvm_sections[section_id].data);
2053 		nvm_sections[section_id].data = temp;
2054 		nvm_sections[section_id].length = section_size;
2055 
2056 		/* advance to the next section */
2057 		file_sec = (const void *)(file_sec->data + section_size);
2058 	}
2059 out:
2060 	release_firmware(fw_entry);
2061 	return ret;
2062 }
2063 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
2064 
2065 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
2066 				 const struct iwl_fw *fw,
2067 				 u8 set_tx_ant, u8 set_rx_ant)
2068 {
2069 	struct iwl_nvm_get_info cmd = {};
2070 	struct iwl_nvm_data *nvm;
2071 	struct iwl_host_cmd hcmd = {
2072 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
2073 		.data = { &cmd, },
2074 		.len = { sizeof(cmd) },
2075 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
2076 	};
2077 	int  ret;
2078 	bool empty_otp;
2079 	u32 mac_flags;
2080 	u32 sbands_flags = 0;
2081 	u8 tx_ant;
2082 	u8 rx_ant;
2083 
2084 	/*
2085 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
2086 	 * in v3, except for the channel profile part of the
2087 	 * regulatory.  So we can just access the new struct, with the
2088 	 * exception of the latter.
2089 	 */
2090 	struct iwl_nvm_get_info_rsp *rsp;
2091 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
2092 	bool v4 = fw_has_api(&fw->ucode_capa,
2093 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
2094 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
2095 	void *channel_profile;
2096 
2097 	ret = iwl_trans_send_cmd(trans, &hcmd);
2098 	if (ret)
2099 		return ERR_PTR(ret);
2100 
2101 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
2102 		 "Invalid payload len in NVM response from FW %d",
2103 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
2104 		ret = -EINVAL;
2105 		goto out;
2106 	}
2107 
2108 	rsp = (void *)hcmd.resp_pkt->data;
2109 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
2110 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
2111 	if (empty_otp)
2112 		IWL_INFO(trans, "OTP is empty\n");
2113 
2114 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
2115 	if (!nvm) {
2116 		ret = -ENOMEM;
2117 		goto out;
2118 	}
2119 
2120 	iwl_set_hw_address_from_csr(trans, nvm);
2121 	/* TODO: if platform NVM has MAC address - override it here */
2122 
2123 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2124 		IWL_ERR(trans, "no valid mac address was found\n");
2125 		ret = -EINVAL;
2126 		goto err_free;
2127 	}
2128 
2129 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2130 
2131 	/* Initialize general data */
2132 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2133 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2134 	if (nvm->n_hw_addrs == 0)
2135 		IWL_WARN(trans,
2136 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2137 			 empty_otp);
2138 
2139 	/* Initialize MAC sku data */
2140 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2141 	nvm->sku_cap_11ac_enable =
2142 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2143 	nvm->sku_cap_11n_enable =
2144 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2145 	nvm->sku_cap_11ax_enable =
2146 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2147 	nvm->sku_cap_band_24ghz_enable =
2148 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2149 	nvm->sku_cap_band_52ghz_enable =
2150 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2151 	nvm->sku_cap_mimo_disabled =
2152 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2153 	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
2154 		nvm->sku_cap_11be_enable = true;
2155 
2156 	/* Initialize PHY sku data */
2157 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2158 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2159 
2160 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2161 	    fw_has_capa(&fw->ucode_capa,
2162 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2163 		nvm->lar_enabled = true;
2164 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2165 	}
2166 
2167 	rsp_v3 = (void *)rsp;
2168 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2169 			  (void *)rsp_v3->regulatory.channel_profile;
2170 
2171 	tx_ant = nvm->valid_tx_ant & fw->valid_tx_ant;
2172 	rx_ant = nvm->valid_rx_ant & fw->valid_rx_ant;
2173 
2174 	if (set_tx_ant)
2175 		tx_ant &= set_tx_ant;
2176 	if (set_rx_ant)
2177 		rx_ant &= set_rx_ant;
2178 
2179 	iwl_init_sbands(trans, nvm, channel_profile, tx_ant, rx_ant,
2180 			sbands_flags, v4, fw);
2181 
2182 	iwl_free_resp(&hcmd);
2183 	return nvm;
2184 
2185 err_free:
2186 	kfree(nvm);
2187 out:
2188 	iwl_free_resp(&hcmd);
2189 	return ERR_PTR(ret);
2190 }
2191 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2192