xref: /linux/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c (revision 08e77d5edf7063e206096474ead1ed210eae0338)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023, 2025 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM REGULATORY -Section offset (in words) definitions */
42 	NVM_CHANNELS_SDP = 0,
43 };
44 
45 enum ext_nvm_offsets {
46 	/* NVM HW-Section offset (in words) definitions */
47 
48 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
49 
50 	/* NVM SW-Section offset (in words) definitions */
51 	NVM_VERSION_EXT_NVM = 0,
52 	N_HW_ADDRS_FAMILY_8000 = 3,
53 
54 	/* NVM PHY_SKU-Section offset (in words) definitions */
55 	RADIO_CFG_FAMILY_EXT_NVM = 0,
56 	SKU_FAMILY_8000 = 2,
57 
58 	/* NVM REGULATORY -Section offset (in words) definitions */
59 	NVM_CHANNELS_EXTENDED = 0,
60 	NVM_LAR_OFFSET_OLD = 0x4C7,
61 	NVM_LAR_OFFSET = 0x507,
62 	NVM_LAR_ENABLED = 0x7,
63 };
64 
65 /* SKU Capabilities (actual values from NVM definition) */
66 enum nvm_sku_bits {
67 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
68 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
69 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
70 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
71 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
72 };
73 
74 /*
75  * These are the channel numbers in the order that they are stored in the NVM
76  */
77 static const u16 iwl_nvm_channels[] = {
78 	/* 2.4 GHz */
79 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
80 	/* 5 GHz */
81 	36, 40, 44, 48, 52, 56, 60, 64,
82 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
83 	149, 153, 157, 161, 165
84 };
85 
86 static const u16 iwl_ext_nvm_channels[] = {
87 	/* 2.4 GHz */
88 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
89 	/* 5 GHz */
90 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
91 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
92 	149, 153, 157, 161, 165, 169, 173, 177, 181
93 };
94 
95 static const u16 iwl_uhb_nvm_channels[] = {
96 	/* 2.4 GHz */
97 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
98 	/* 5 GHz */
99 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
100 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
101 	149, 153, 157, 161, 165, 169, 173, 177, 181,
102 	/* 6-7 GHz */
103 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
104 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
105 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
106 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
107 };
108 
109 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
110 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
111 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
112 #define NUM_2GHZ_CHANNELS		14
113 #define NUM_5GHZ_CHANNELS		37
114 #define FIRST_2GHZ_HT_MINUS		5
115 #define LAST_2GHZ_HT_PLUS		9
116 #define N_HW_ADDR_MASK			0xF
117 
118 /* rate data (static) */
119 static struct ieee80211_rate iwl_cfg80211_rates[] = {
120 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
121 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
122 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
123 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
124 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
125 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
126 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
127 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
128 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
129 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
130 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
131 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
132 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
133 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
134 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
135 };
136 #define RATES_24_OFFS	0
137 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
138 #define RATES_52_OFFS	4
139 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
140 
141 /**
142  * enum iwl_nvm_channel_flags - channel flags in NVM
143  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
144  * @NVM_CHANNEL_IBSS: usable as an IBSS channel and deprecated
145  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
146  * @NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY: active scanning allowed and
147  *	AP allowed only in 20 MHz. Valid only
148  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
149  * @NVM_CHANNEL_ACTIVE: active scanning allowed and allows IBSS
150  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
151  * @NVM_CHANNEL_RADAR: radar detection required
152  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
153  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
154  *	on same channel on 2.4 or same UNII band on 5.2
155  * @NVM_CHANNEL_UNIFORM: uniform spreading required
156  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
157  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
158  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
159  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
160  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
161  * @NVM_CHANNEL_VLP: client support connection to UHB VLP AP
162  * @NVM_CHANNEL_AFC: client support connection to UHB AFC AP
163  */
164 enum iwl_nvm_channel_flags {
165 	NVM_CHANNEL_VALID                   = BIT(0),
166 	NVM_CHANNEL_IBSS                    = BIT(1),
167 	NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY    = BIT(2),
168 	NVM_CHANNEL_ACTIVE                  = BIT(3),
169 	NVM_CHANNEL_RADAR                   = BIT(4),
170 	NVM_CHANNEL_INDOOR_ONLY             = BIT(5),
171 	NVM_CHANNEL_GO_CONCURRENT           = BIT(6),
172 	NVM_CHANNEL_UNIFORM                 = BIT(7),
173 	NVM_CHANNEL_20MHZ                   = BIT(8),
174 	NVM_CHANNEL_40MHZ                   = BIT(9),
175 	NVM_CHANNEL_80MHZ                   = BIT(10),
176 	NVM_CHANNEL_160MHZ                  = BIT(11),
177 	NVM_CHANNEL_DC_HIGH                 = BIT(12),
178 	NVM_CHANNEL_VLP                     = BIT(13),
179 	NVM_CHANNEL_AFC                     = BIT(14),
180 };
181 
182 /**
183  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
184  * domain.
185  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
186  *	2.4Ghz band is allowed.
187  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
188  *	5Ghz band is allowed.
189  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
190  *	for this regulatory domain (valid only in 5Ghz).
191  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
192  *	for this regulatory domain (valid only in 5Ghz).
193  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
194  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
195  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
196  *	for this regulatory domain (valid only in 5Ghz).
197  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
198  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
199  */
200 enum iwl_reg_capa_flags_v1 {
201 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
202 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
203 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
204 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
205 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
206 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
207 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
208 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
209 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
210 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
211 
212 /**
213  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
214  * domain (version 2).
215  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
216  *	disabled.
217  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
218  *	2.4Ghz band is allowed.
219  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
220  *	5Ghz band is allowed.
221  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
222  *	for this regulatory domain (valid only in 5Ghz).
223  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
224  *	for this regulatory domain (valid only in 5Ghz).
225  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
226  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
227  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
228  *	126, 122) are disabled.
229  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
230  *	for this regulatory domain (uvalid only in 5Ghz).
231  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
232  */
233 enum iwl_reg_capa_flags_v2 {
234 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
235 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
236 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
237 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
238 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
239 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
240 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
241 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
242 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
243 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
244 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
245 
246 /**
247  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
248  * domain.
249  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
250  *	for this regulatory domain (valid only in 5Ghz).
251  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
252  *	for this regulatory domain (valid only in 5Ghz).
253  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
254  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
255  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
256  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
257  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
258  *	for this regulatory domain (valid only in 5GHz).
259  */
260 enum iwl_reg_capa_flags_v4 {
261 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
262 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
263 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
264 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
265 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
266 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
267 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
268 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
269 
270 /*
271 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
272 * MCC update command response.
273 */
274 #define REG_CAPA_V2_RESP_VER	6
275 
276 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
277  * MCC update command response.
278  */
279 #define REG_CAPA_V4_RESP_VER	8
280 
281 /**
282  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
283  * handling the different APIs of reg_capa_flags.
284  *
285  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
286  *	for this regulatory domain.
287  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
288  *	for this regulatory domain (valid only in 5 and 6 Ghz).
289  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
290  *	for this regulatory domain (valid only in 5 and 6 Ghz).
291  * @allow_320mhz: 11be channel with a width of 320Mhz is allowed
292  *	for this regulatory domain (valid only in 6 Ghz).
293  * @disable_11ax: 11ax is forbidden for this regulatory domain.
294  * @disable_11be: 11be is forbidden for this regulatory domain.
295  */
296 struct iwl_reg_capa {
297 	bool allow_40mhz;
298 	bool allow_80mhz;
299 	bool allow_160mhz;
300 	bool allow_320mhz;
301 	bool disable_11ax;
302 	bool disable_11be;
303 };
304 
305 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
306 					       int chan, u32 flags)
307 {
308 #define CHECK_AND_PRINT_I(x)	\
309 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
310 
311 	if (!(flags & NVM_CHANNEL_VALID)) {
312 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
313 			      chan, flags);
314 		return;
315 	}
316 
317 	/* Note: already can print up to 101 characters, 110 is the limit! */
318 	IWL_DEBUG_DEV(dev, level,
319 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
320 		      chan, flags,
321 		      CHECK_AND_PRINT_I(VALID),
322 		      CHECK_AND_PRINT_I(IBSS),
323 		      CHECK_AND_PRINT_I(ACTIVE),
324 		      CHECK_AND_PRINT_I(RADAR),
325 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
326 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
327 		      CHECK_AND_PRINT_I(UNIFORM),
328 		      CHECK_AND_PRINT_I(20MHZ),
329 		      CHECK_AND_PRINT_I(40MHZ),
330 		      CHECK_AND_PRINT_I(80MHZ),
331 		      CHECK_AND_PRINT_I(160MHZ),
332 		      CHECK_AND_PRINT_I(DC_HIGH),
333 		      CHECK_AND_PRINT_I(VLP),
334 		      CHECK_AND_PRINT_I(AFC));
335 #undef CHECK_AND_PRINT_I
336 }
337 
338 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
339 				 u32 nvm_flags, const struct iwl_cfg *cfg)
340 {
341 	u32 flags = IEEE80211_CHAN_NO_HT40;
342 
343 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
344 		if (ch_num <= LAST_2GHZ_HT_PLUS)
345 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
346 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
347 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
348 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
349 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
350 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
351 		else
352 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
353 	}
354 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
355 		flags |= IEEE80211_CHAN_NO_80MHZ;
356 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
357 		flags |= IEEE80211_CHAN_NO_160MHZ;
358 
359 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
360 		flags |= IEEE80211_CHAN_NO_IR;
361 
362 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
363 		flags |= IEEE80211_CHAN_NO_IR;
364 
365 	if (nvm_flags & NVM_CHANNEL_RADAR)
366 		flags |= IEEE80211_CHAN_RADAR;
367 
368 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
369 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
370 
371 	/* Set the GO concurrent flag only in case that NO_IR is set.
372 	 * Otherwise it is meaningless
373 	 */
374 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
375 	    (flags & IEEE80211_CHAN_NO_IR))
376 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
377 
378 	/* Set the AP type for the UHB case. */
379 	if (nvm_flags & NVM_CHANNEL_VLP)
380 		flags |= IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP;
381 	else
382 		flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
383 	if (!(nvm_flags & NVM_CHANNEL_AFC))
384 		flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
385 
386 	return flags;
387 }
388 
389 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
390 {
391 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
392 		return NL80211_BAND_6GHZ;
393 	}
394 
395 	if (ch_idx >= NUM_2GHZ_CHANNELS)
396 		return NL80211_BAND_5GHZ;
397 	return NL80211_BAND_2GHZ;
398 }
399 
400 static int iwl_init_channel_map(struct iwl_trans *trans,
401 				const struct iwl_fw *fw,
402 				struct iwl_nvm_data *data,
403 				const void * const nvm_ch_flags,
404 				u32 sbands_flags, bool v4)
405 {
406 	const struct iwl_cfg *cfg = trans->cfg;
407 	struct device *dev = trans->dev;
408 	int ch_idx;
409 	int n_channels = 0;
410 	struct ieee80211_channel *channel;
411 	u32 ch_flags;
412 	int num_of_ch;
413 	const u16 *nvm_chan;
414 
415 	if (cfg->uhb_supported) {
416 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
417 		nvm_chan = iwl_uhb_nvm_channels;
418 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
419 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
420 		nvm_chan = iwl_ext_nvm_channels;
421 	} else {
422 		num_of_ch = IWL_NVM_NUM_CHANNELS;
423 		nvm_chan = iwl_nvm_channels;
424 	}
425 
426 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
427 		enum nl80211_band band =
428 			iwl_nl80211_band_from_channel_idx(ch_idx);
429 
430 		if (v4)
431 			ch_flags =
432 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
433 		else
434 			ch_flags =
435 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
436 
437 		if (band == NL80211_BAND_5GHZ &&
438 		    !data->sku_cap_band_52ghz_enable)
439 			continue;
440 
441 		/* workaround to disable wide channels in 5GHz */
442 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
443 		    band == NL80211_BAND_5GHZ) {
444 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
445 				     NVM_CHANNEL_80MHZ |
446 				     NVM_CHANNEL_160MHZ);
447 		}
448 
449 		if (ch_flags & NVM_CHANNEL_160MHZ)
450 			data->vht160_supported = true;
451 
452 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
453 		    !(ch_flags & NVM_CHANNEL_VALID)) {
454 			/*
455 			 * Channels might become valid later if lar is
456 			 * supported, hence we still want to add them to
457 			 * the list of supported channels to cfg80211.
458 			 */
459 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
460 						    nvm_chan[ch_idx], ch_flags);
461 			continue;
462 		}
463 
464 		channel = &data->channels[n_channels];
465 		n_channels++;
466 
467 		channel->hw_value = nvm_chan[ch_idx];
468 		channel->band = band;
469 		channel->center_freq =
470 			ieee80211_channel_to_frequency(
471 				channel->hw_value, channel->band);
472 
473 		/* Initialize regulatory-based run-time data */
474 
475 		/*
476 		 * Default value - highest tx power value.  max_power
477 		 * is not used in mvm, and is used for backwards compatibility
478 		 */
479 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
480 
481 		/* don't put limitations in case we're using LAR */
482 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
483 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
484 							       ch_idx, band,
485 							       ch_flags, cfg);
486 		else
487 			channel->flags = 0;
488 
489 		if (fw_has_capa(&fw->ucode_capa,
490 				IWL_UCODE_TLV_CAPA_MONITOR_PASSIVE_CHANS))
491 			channel->flags |= IEEE80211_CHAN_CAN_MONITOR;
492 
493 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
494 					    channel->hw_value, ch_flags);
495 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
496 				 channel->hw_value, channel->max_power);
497 	}
498 
499 	return n_channels;
500 }
501 
502 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
503 				  struct iwl_nvm_data *data,
504 				  struct ieee80211_sta_vht_cap *vht_cap,
505 				  u8 tx_chains, u8 rx_chains)
506 {
507 	const struct iwl_cfg *cfg = trans->cfg;
508 	int num_rx_ants = num_of_ant(rx_chains);
509 	int num_tx_ants = num_of_ant(tx_chains);
510 
511 	vht_cap->vht_supported = true;
512 
513 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
514 		       IEEE80211_VHT_CAP_RXSTBC_1 |
515 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
516 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
517 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
518 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
519 
520 	if (!trans->cfg->ht_params->stbc)
521 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
522 
523 	if (data->vht160_supported)
524 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
525 				IEEE80211_VHT_CAP_SHORT_GI_160;
526 
527 	if (cfg->vht_mu_mimo_supported)
528 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
529 
530 	if (cfg->ht_params->ldpc)
531 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
532 
533 	if (data->sku_cap_mimo_disabled) {
534 		num_rx_ants = 1;
535 		num_tx_ants = 1;
536 	}
537 
538 	if (trans->cfg->ht_params->stbc && num_tx_ants > 1)
539 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
540 	else
541 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
542 
543 	switch (iwlwifi_mod_params.amsdu_size) {
544 	case IWL_AMSDU_DEF:
545 		if (trans->trans_cfg->mq_rx_supported)
546 			vht_cap->cap |=
547 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
548 		else
549 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
550 		break;
551 	case IWL_AMSDU_2K:
552 		if (trans->trans_cfg->mq_rx_supported)
553 			vht_cap->cap |=
554 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
555 		else
556 			WARN(1, "RB size of 2K is not supported by this device\n");
557 		break;
558 	case IWL_AMSDU_4K:
559 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
560 		break;
561 	case IWL_AMSDU_8K:
562 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
563 		break;
564 	case IWL_AMSDU_12K:
565 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
566 		break;
567 	default:
568 		break;
569 	}
570 
571 	vht_cap->vht_mcs.rx_mcs_map =
572 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
573 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
574 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
575 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
576 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
577 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
578 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
579 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
580 
581 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
582 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
583 		/* this works because NOT_SUPPORTED == 3 */
584 		vht_cap->vht_mcs.rx_mcs_map |=
585 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
586 	}
587 
588 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
589 
590 	vht_cap->vht_mcs.tx_highest |=
591 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
592 }
593 
594 static const u8 iwl_vendor_caps[] = {
595 	0xdd,			/* vendor element */
596 	0x06,			/* length */
597 	0x00, 0x17, 0x35,	/* Intel OUI */
598 	0x08,			/* type (Intel Capabilities) */
599 	/* followed by 16 bits of capabilities */
600 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
601 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
602 	0x00
603 };
604 
605 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
606 	{
607 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
608 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
609 		.he_cap = {
610 			.has_he = true,
611 			.he_cap_elem = {
612 				.mac_cap_info[0] =
613 					IEEE80211_HE_MAC_CAP0_HTC_HE,
614 				.mac_cap_info[1] =
615 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
616 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
617 				.mac_cap_info[2] =
618 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
619 				.mac_cap_info[3] =
620 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
621 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
622 				.mac_cap_info[4] =
623 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
624 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
625 				.mac_cap_info[5] =
626 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
627 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
628 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
629 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
630 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
631 				.phy_cap_info[1] =
632 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
633 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
634 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
635 				.phy_cap_info[2] =
636 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
637 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
638 				.phy_cap_info[3] =
639 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
640 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
641 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
642 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
643 				.phy_cap_info[4] =
644 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
645 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
646 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
647 				.phy_cap_info[6] =
648 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
649 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
650 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
651 				.phy_cap_info[7] =
652 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
653 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
654 				.phy_cap_info[8] =
655 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
656 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
657 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
658 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
659 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
660 				.phy_cap_info[9] =
661 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
662 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
663 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
664 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
665 				.phy_cap_info[10] =
666 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
667 			},
668 			/*
669 			 * Set default Tx/Rx HE MCS NSS Support field.
670 			 * Indicate support for up to 2 spatial streams and all
671 			 * MCS, without any special cases
672 			 */
673 			.he_mcs_nss_supp = {
674 				.rx_mcs_80 = cpu_to_le16(0xfffa),
675 				.tx_mcs_80 = cpu_to_le16(0xfffa),
676 				.rx_mcs_160 = cpu_to_le16(0xfffa),
677 				.tx_mcs_160 = cpu_to_le16(0xfffa),
678 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
679 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
680 			},
681 			/*
682 			 * Set default PPE thresholds, with PPET16 set to 0,
683 			 * PPET8 set to 7
684 			 */
685 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
686 		},
687 		.eht_cap = {
688 			.has_eht = true,
689 			.eht_cap_elem = {
690 				.mac_cap_info[0] =
691 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
692 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
693 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
694 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2 |
695 					IEEE80211_EHT_MAC_CAP0_SCS_TRAFFIC_DESC,
696 				.mac_cap_info[1] =
697 					IEEE80211_EHT_MAC_CAP1_UNSOL_EPCS_PRIO_ACCESS,
698 				.phy_cap_info[0] =
699 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
700 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
701 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
702 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
703 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
704 				.phy_cap_info[1] =
705 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
706 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
707 				.phy_cap_info[3] =
708 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
709 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
710 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
711 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
712 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
713 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
714 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
715 
716 				.phy_cap_info[4] =
717 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
718 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
719 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
720 				.phy_cap_info[5] =
721 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
722 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US) |
723 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
724 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
725 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP,
726 				.phy_cap_info[6] =
727 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
728 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
729 				.phy_cap_info[8] =
730 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
731 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
732 			},
733 
734 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
735 			 * Rx - note we don't set the only_20mhz, but due to this
736 			 * being a union, it gets set correctly anyway.
737 			 */
738 			.eht_mcs_nss_supp = {
739 				.bw._80 = {
740 					.rx_tx_mcs9_max_nss = 0x22,
741 					.rx_tx_mcs11_max_nss = 0x22,
742 					.rx_tx_mcs13_max_nss = 0x22,
743 				},
744 				.bw._160 = {
745 					.rx_tx_mcs9_max_nss = 0x22,
746 					.rx_tx_mcs11_max_nss = 0x22,
747 					.rx_tx_mcs13_max_nss = 0x22,
748 				},
749 				.bw._320 = {
750 					.rx_tx_mcs9_max_nss = 0x22,
751 					.rx_tx_mcs11_max_nss = 0x22,
752 					.rx_tx_mcs13_max_nss = 0x22,
753 				},
754 			},
755 
756 			/*
757 			 * PPE thresholds for NSS = 2, and RU index bitmap set
758 			 * to 0xc.
759 			 * Note: just for stating what we want, not present in
760 			 * the transmitted data due to not including
761 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
762 			 */
763 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
764 		},
765 	},
766 	{
767 		.types_mask = BIT(NL80211_IFTYPE_AP) |
768 			      BIT(NL80211_IFTYPE_P2P_GO),
769 		.he_cap = {
770 			.has_he = true,
771 			.he_cap_elem = {
772 				.mac_cap_info[0] =
773 					IEEE80211_HE_MAC_CAP0_HTC_HE,
774 				.mac_cap_info[1] =
775 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
776 				.mac_cap_info[3] =
777 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
778 				.phy_cap_info[1] =
779 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
780 				.phy_cap_info[2] =
781 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
782 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
783 				.phy_cap_info[3] =
784 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
785 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
786 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
787 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
788 				.phy_cap_info[6] =
789 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
790 				.phy_cap_info[7] =
791 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
792 				.phy_cap_info[8] =
793 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
794 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
795 				.phy_cap_info[9] =
796 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
797 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
798 			},
799 			/*
800 			 * Set default Tx/Rx HE MCS NSS Support field.
801 			 * Indicate support for up to 2 spatial streams and all
802 			 * MCS, without any special cases
803 			 */
804 			.he_mcs_nss_supp = {
805 				.rx_mcs_80 = cpu_to_le16(0xfffa),
806 				.tx_mcs_80 = cpu_to_le16(0xfffa),
807 				.rx_mcs_160 = cpu_to_le16(0xfffa),
808 				.tx_mcs_160 = cpu_to_le16(0xfffa),
809 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
810 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
811 			},
812 			/*
813 			 * Set default PPE thresholds, with PPET16 set to 0,
814 			 * PPET8 set to 7
815 			 */
816 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
817 		},
818 		.eht_cap = {
819 			.has_eht = true,
820 			.eht_cap_elem = {
821 				.mac_cap_info[0] =
822 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
823 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
824 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
825 				.phy_cap_info[0] =
826 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
827 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
828 				.phy_cap_info[5] =
829 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
830 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US),
831 			},
832 
833 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
834 			 * Rx - note we don't set the only_20mhz, but due to this
835 			 * being a union, it gets set correctly anyway.
836 			 */
837 			.eht_mcs_nss_supp = {
838 				.bw._80 = {
839 					.rx_tx_mcs9_max_nss = 0x22,
840 					.rx_tx_mcs11_max_nss = 0x22,
841 					.rx_tx_mcs13_max_nss = 0x22,
842 				},
843 				.bw._160 = {
844 					.rx_tx_mcs9_max_nss = 0x22,
845 					.rx_tx_mcs11_max_nss = 0x22,
846 					.rx_tx_mcs13_max_nss = 0x22,
847 				},
848 				.bw._320 = {
849 					.rx_tx_mcs9_max_nss = 0x22,
850 					.rx_tx_mcs11_max_nss = 0x22,
851 					.rx_tx_mcs13_max_nss = 0x22,
852 				},
853 			},
854 
855 			/*
856 			 * PPE thresholds for NSS = 2, and RU index bitmap set
857 			 * to 0xc.
858 			 * Note: just for stating what we want, not present in
859 			 * the transmitted data due to not including
860 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
861 			 */
862 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
863 		},
864 	},
865 };
866 
867 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
868 				  struct iwl_nvm_data *data,
869 				  struct ieee80211_supported_band *sband,
870 				  u8 tx_chains, u8 rx_chains)
871 {
872 	struct ieee80211_sta_ht_cap ht_cap;
873 	struct ieee80211_sta_vht_cap vht_cap = {};
874 	struct ieee80211_sband_iftype_data *iftype_data;
875 	u16 he_6ghz_capa = 0;
876 	u32 exp;
877 	int i;
878 
879 	if (sband->band != NL80211_BAND_6GHZ)
880 		return;
881 
882 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
883 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
884 			     tx_chains, rx_chains);
885 	WARN_ON(!ht_cap.ht_supported);
886 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
887 	WARN_ON(!vht_cap.vht_supported);
888 
889 	he_6ghz_capa |=
890 		u16_encode_bits(ht_cap.ampdu_density,
891 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
892 	exp = u32_get_bits(vht_cap.cap,
893 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
894 	he_6ghz_capa |=
895 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
896 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
897 	he_6ghz_capa |=
898 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
899 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
900 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
901 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
902 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
903 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
904 
905 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
906 
907 	/* we know it's writable - we set it before ourselves */
908 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
909 	for (i = 0; i < sband->n_iftype_data; i++)
910 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
911 }
912 
913 static void
914 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
915 			 struct iwl_nvm_data *data,
916 			 struct ieee80211_supported_band *sband,
917 			 struct ieee80211_sband_iftype_data *iftype_data,
918 			 u8 tx_chains, u8 rx_chains,
919 			 const struct iwl_fw *fw)
920 {
921 	bool is_ap = iftype_data->types_mask & (BIT(NL80211_IFTYPE_AP) |
922 						BIT(NL80211_IFTYPE_P2P_GO));
923 	bool slow_pcie = (!trans->trans_cfg->integrated &&
924 			  trans->info.pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB);
925 
926 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be)
927 		iftype_data->eht_cap.has_eht = false;
928 
929 	/* Advertise an A-MPDU exponent extension based on
930 	 * operating band
931 	 */
932 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
933 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
934 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
935 	else if (sband->band != NL80211_BAND_2GHZ)
936 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
937 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
938 	else
939 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
940 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
941 
942 	switch (sband->band) {
943 	case NL80211_BAND_2GHZ:
944 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
945 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
946 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
947 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
948 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
949 		break;
950 	case NL80211_BAND_6GHZ:
951 		if (!trans->reduced_cap_sku &&
952 		    (!trans->cfg->bw_limit || trans->cfg->bw_limit >= 320)) {
953 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
954 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
955 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
956 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
957 		}
958 		fallthrough;
959 	case NL80211_BAND_5GHZ:
960 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
961 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
962 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
963 		break;
964 	default:
965 		WARN_ON(1);
966 		break;
967 	}
968 
969 	if ((tx_chains & rx_chains) == ANT_AB) {
970 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
971 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
972 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
973 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
974 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
975 		if (!is_ap) {
976 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
977 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
978 
979 			if (iftype_data->eht_cap.has_eht) {
980 				/*
981 				 * Set the number of sounding dimensions for each
982 				 * bandwidth to 1 to indicate the maximal supported
983 				 * value of TXVECTOR parameter NUM_STS of 2
984 				 */
985 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
986 
987 				/*
988 				 * Set the MAX NC to 1 to indicate sounding feedback of
989 				 * 2 supported by the beamfomee.
990 				 */
991 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
992 			}
993 		}
994 
995 		if (slow_pcie) {
996 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
997 				&iftype_data->eht_cap.eht_mcs_nss_supp;
998 
999 			mcs_nss->bw._320.rx_tx_mcs11_max_nss = 0;
1000 			mcs_nss->bw._320.rx_tx_mcs13_max_nss = 0;
1001 		}
1002 	} else {
1003 		struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp =
1004 			&iftype_data->he_cap.he_mcs_nss_supp;
1005 
1006 		if (iftype_data->eht_cap.has_eht) {
1007 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
1008 				&iftype_data->eht_cap.eht_mcs_nss_supp;
1009 
1010 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
1011 		}
1012 
1013 		if (!is_ap) {
1014 			/* If not 2x2, we need to indicate 1x1 in the
1015 			 * Midamble RX Max NSTS - but not for AP mode
1016 			 */
1017 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
1018 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
1019 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1020 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
1021 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
1022 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
1023 		}
1024 
1025 		he_mcs_nss_supp->rx_mcs_80 |=
1026 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1027 		he_mcs_nss_supp->tx_mcs_80 |=
1028 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1029 		he_mcs_nss_supp->rx_mcs_160 |=
1030 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1031 		he_mcs_nss_supp->tx_mcs_160 |=
1032 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1033 		he_mcs_nss_supp->rx_mcs_80p80 |=
1034 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1035 		he_mcs_nss_supp->tx_mcs_80p80 |=
1036 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1037 	}
1038 
1039 	if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
1040 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
1041 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
1042 
1043 	switch (CSR_HW_RFID_TYPE(trans->info.hw_rf_id)) {
1044 	case IWL_CFG_RF_TYPE_GF:
1045 	case IWL_CFG_RF_TYPE_FM:
1046 	case IWL_CFG_RF_TYPE_WH:
1047 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1048 			IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
1049 		if (!is_ap)
1050 			iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1051 				IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
1052 		break;
1053 	}
1054 
1055 	if (CSR_HW_REV_TYPE(trans->info.hw_rev) == IWL_CFG_MAC_TYPE_GL &&
1056 	    iftype_data->eht_cap.has_eht) {
1057 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] &=
1058 			~(IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
1059 			  IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2);
1060 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[3] &=
1061 			~(IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
1062 			  IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
1063 			  IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
1064 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
1065 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
1066 			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
1067 			  IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK);
1068 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &=
1069 			~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
1070 			  IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP);
1071 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] &=
1072 			~IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK;
1073 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[6] &=
1074 			~(IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
1075 			  IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP);
1076 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] |=
1077 			IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF;
1078 	}
1079 
1080 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
1081 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
1082 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
1083 
1084 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1085 	    !is_ap) {
1086 		iftype_data->vendor_elems.data = iwl_vendor_caps;
1087 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
1088 	}
1089 
1090 	if (!trans->cfg->ht_params->stbc) {
1091 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1092 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
1093 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
1094 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
1095 	}
1096 
1097 	if (trans->step_urm) {
1098 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs11_max_nss = 0;
1099 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs13_max_nss = 0;
1100 	}
1101 
1102 	if (trans->cfg->bw_limit && trans->cfg->bw_limit < 160)
1103 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] &=
1104 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
1105 
1106 	if ((trans->cfg->bw_limit && trans->cfg->bw_limit < 320) ||
1107 	    trans->reduced_cap_sku) {
1108 		memset(&iftype_data->eht_cap.eht_mcs_nss_supp.bw._320, 0,
1109 		       sizeof(iftype_data->eht_cap.eht_mcs_nss_supp.bw._320));
1110 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] &=
1111 			~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
1112 	}
1113 
1114 	if (trans->reduced_cap_sku) {
1115 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._80.rx_tx_mcs13_max_nss = 0;
1116 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._160.rx_tx_mcs13_max_nss = 0;
1117 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[8] &=
1118 			~IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA;
1119 	}
1120 }
1121 
1122 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1123 				 struct iwl_nvm_data *data,
1124 				 struct ieee80211_supported_band *sband,
1125 				 u8 tx_chains, u8 rx_chains,
1126 				 const struct iwl_fw *fw)
1127 {
1128 	struct ieee80211_sband_iftype_data *iftype_data;
1129 	int i;
1130 
1131 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1132 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1133 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1134 
1135 	switch (sband->band) {
1136 	case NL80211_BAND_2GHZ:
1137 		iftype_data = data->iftd.low;
1138 		break;
1139 	case NL80211_BAND_5GHZ:
1140 		iftype_data = data->iftd.high;
1141 		break;
1142 	case NL80211_BAND_6GHZ:
1143 		iftype_data = data->iftd.uhb;
1144 		break;
1145 	default:
1146 		WARN_ON(1);
1147 		return;
1148 	}
1149 
1150 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1151 
1152 	_ieee80211_set_sband_iftype_data(sband, iftype_data,
1153 					 ARRAY_SIZE(iwl_he_eht_capa));
1154 
1155 	for (i = 0; i < sband->n_iftype_data; i++)
1156 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1157 					 tx_chains, rx_chains, fw);
1158 
1159 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1160 }
1161 
1162 void iwl_reinit_cab(struct iwl_trans *trans, struct iwl_nvm_data *data,
1163 		    u8 tx_chains, u8 rx_chains, const struct iwl_fw *fw)
1164 {
1165 	struct ieee80211_supported_band *sband;
1166 
1167 	sband = &data->bands[NL80211_BAND_2GHZ];
1168 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1169 			     tx_chains, rx_chains);
1170 
1171 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1172 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1173 				     fw);
1174 
1175 	sband = &data->bands[NL80211_BAND_5GHZ];
1176 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1177 			     tx_chains, rx_chains);
1178 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1179 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1180 				      tx_chains, rx_chains);
1181 
1182 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1183 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1184 				     fw);
1185 
1186 	sband = &data->bands[NL80211_BAND_6GHZ];
1187 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1188 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1189 				     fw);
1190 }
1191 IWL_EXPORT_SYMBOL(iwl_reinit_cab);
1192 
1193 static void iwl_init_sbands(struct iwl_trans *trans,
1194 			    struct iwl_nvm_data *data,
1195 			    const void *nvm_ch_flags, u8 tx_chains,
1196 			    u8 rx_chains, u32 sbands_flags, bool v4,
1197 			    const struct iwl_fw *fw)
1198 {
1199 	struct device *dev = trans->dev;
1200 	int n_channels;
1201 	int n_used = 0;
1202 	struct ieee80211_supported_band *sband;
1203 
1204 	n_channels = iwl_init_channel_map(trans, fw, data, nvm_ch_flags,
1205 					  sbands_flags, v4);
1206 	sband = &data->bands[NL80211_BAND_2GHZ];
1207 	sband->band = NL80211_BAND_2GHZ;
1208 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1209 	sband->n_bitrates = N_RATES_24;
1210 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1211 					  NL80211_BAND_2GHZ);
1212 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1213 			     tx_chains, rx_chains);
1214 
1215 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1216 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1217 				     fw);
1218 
1219 	sband = &data->bands[NL80211_BAND_5GHZ];
1220 	sband->band = NL80211_BAND_5GHZ;
1221 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1222 	sband->n_bitrates = N_RATES_52;
1223 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1224 					  NL80211_BAND_5GHZ);
1225 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1226 			     tx_chains, rx_chains);
1227 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1228 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1229 				      tx_chains, rx_chains);
1230 
1231 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1232 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1233 				     fw);
1234 
1235 	/* 6GHz band. */
1236 	sband = &data->bands[NL80211_BAND_6GHZ];
1237 	sband->band = NL80211_BAND_6GHZ;
1238 	/* use the same rates as 5GHz band */
1239 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1240 	sband->n_bitrates = N_RATES_52;
1241 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1242 					  NL80211_BAND_6GHZ);
1243 
1244 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1245 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1246 				     fw);
1247 	else
1248 		sband->n_channels = 0;
1249 	if (n_channels != n_used)
1250 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1251 			    n_used, n_channels);
1252 }
1253 
1254 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1255 		       const __le16 *phy_sku)
1256 {
1257 	if (cfg->nvm_type != IWL_NVM_EXT)
1258 		return le16_to_cpup(nvm_sw + SKU);
1259 
1260 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1261 }
1262 
1263 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1264 {
1265 	if (cfg->nvm_type != IWL_NVM_EXT)
1266 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1267 	else
1268 		return le32_to_cpup((const __le32 *)(nvm_sw +
1269 						     NVM_VERSION_EXT_NVM));
1270 }
1271 
1272 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1273 			     const __le16 *phy_sku)
1274 {
1275 	if (cfg->nvm_type != IWL_NVM_EXT)
1276 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1277 
1278 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1279 
1280 }
1281 
1282 static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1283 {
1284 	int n_hw_addr;
1285 
1286 	if (cfg->nvm_type != IWL_NVM_EXT)
1287 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1288 
1289 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1290 
1291 	return n_hw_addr & N_HW_ADDR_MASK;
1292 }
1293 
1294 static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
1295 			      struct iwl_nvm_data *data,
1296 			      u32 radio_cfg)
1297 {
1298 	if (cfg->nvm_type != IWL_NVM_EXT) {
1299 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1300 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1301 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1302 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1303 		return;
1304 	}
1305 
1306 	/* set the radio configuration for family 8000 */
1307 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1308 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1309 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1310 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1311 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1312 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1313 }
1314 
1315 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1316 {
1317 	const u8 *hw_addr;
1318 
1319 	hw_addr = (const u8 *)&mac_addr0;
1320 	dest[0] = hw_addr[3];
1321 	dest[1] = hw_addr[2];
1322 	dest[2] = hw_addr[1];
1323 	dest[3] = hw_addr[0];
1324 
1325 	hw_addr = (const u8 *)&mac_addr1;
1326 	dest[4] = hw_addr[1];
1327 	dest[5] = hw_addr[0];
1328 }
1329 
1330 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1331 					struct iwl_nvm_data *data)
1332 {
1333 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1334 						  CSR_MAC_ADDR0_STRAP(trans)));
1335 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1336 						  CSR_MAC_ADDR1_STRAP(trans)));
1337 
1338 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1339 	/*
1340 	 * If the OEM fused a valid address, use it instead of the one in the
1341 	 * OTP
1342 	 */
1343 	if (is_valid_ether_addr(data->hw_addr))
1344 		return;
1345 
1346 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1347 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1348 
1349 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1350 }
1351 
1352 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1353 					   const struct iwl_cfg *cfg,
1354 					   struct iwl_nvm_data *data,
1355 					   const __le16 *mac_override,
1356 					   const __be16 *nvm_hw)
1357 {
1358 	const u8 *hw_addr;
1359 
1360 	if (mac_override) {
1361 		static const u8 reserved_mac[] = {
1362 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1363 		};
1364 
1365 		hw_addr = (const u8 *)(mac_override +
1366 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1367 
1368 		/*
1369 		 * Store the MAC address from MAO section.
1370 		 * No byte swapping is required in MAO section
1371 		 */
1372 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1373 
1374 		/*
1375 		 * Force the use of the OTP MAC address in case of reserved MAC
1376 		 * address in the NVM, or if address is given but invalid.
1377 		 */
1378 		if (is_valid_ether_addr(data->hw_addr) &&
1379 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1380 			return;
1381 
1382 		IWL_ERR(trans,
1383 			"mac address from nvm override section is not valid\n");
1384 	}
1385 
1386 	if (nvm_hw) {
1387 		/* read the mac address from WFMP registers */
1388 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1389 						WFMP_MAC_ADDR_0));
1390 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1391 						WFMP_MAC_ADDR_1));
1392 
1393 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1394 
1395 		return;
1396 	}
1397 
1398 	IWL_ERR(trans, "mac address is not found\n");
1399 }
1400 
1401 static int iwl_set_hw_address(struct iwl_trans *trans,
1402 			      const struct iwl_cfg *cfg,
1403 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1404 			      const __le16 *mac_override)
1405 {
1406 	if (cfg->mac_addr_from_csr) {
1407 		iwl_set_hw_address_from_csr(trans, data);
1408 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1409 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1410 
1411 		/* The byte order is little endian 16 bit, meaning 214365 */
1412 		data->hw_addr[0] = hw_addr[1];
1413 		data->hw_addr[1] = hw_addr[0];
1414 		data->hw_addr[2] = hw_addr[3];
1415 		data->hw_addr[3] = hw_addr[2];
1416 		data->hw_addr[4] = hw_addr[5];
1417 		data->hw_addr[5] = hw_addr[4];
1418 	} else {
1419 		iwl_set_hw_address_family_8000(trans, cfg, data,
1420 					       mac_override, nvm_hw);
1421 	}
1422 
1423 	if (!is_valid_ether_addr(data->hw_addr)) {
1424 		IWL_ERR(trans, "no valid mac address was found\n");
1425 		return -EINVAL;
1426 	}
1427 
1428 	if (!trans->csme_own)
1429 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1430 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1431 
1432 	return 0;
1433 }
1434 
1435 static bool
1436 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1437 			const __be16 *nvm_hw)
1438 {
1439 	/*
1440 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1441 	 * some 7000-family OTPs erroneously allow wide channels in
1442 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1443 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1444 	 * 9.  In those cases, we need to force-disable wide channels
1445 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1446 	 * to use them.
1447 	 */
1448 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1449 		/*
1450 		 * Unlike the other sections in the NVM, the hw
1451 		 * section uses big-endian.
1452 		 */
1453 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1454 		u8 sku = (subsystem_id & 0x1e) >> 1;
1455 
1456 		if (sku == 5 || sku == 9) {
1457 			IWL_DEBUG_EEPROM(trans->dev,
1458 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1459 					 subsystem_id, sku);
1460 			return true;
1461 		}
1462 	}
1463 
1464 	return false;
1465 }
1466 
1467 struct iwl_nvm_data *
1468 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1469 		       const struct iwl_mei_nvm *mei_nvm,
1470 		       const struct iwl_fw *fw, u8 tx_ant, u8 rx_ant)
1471 {
1472 	struct iwl_nvm_data *data;
1473 	u32 sbands_flags = 0;
1474 	u8 rx_chains = fw->valid_rx_ant;
1475 	u8 tx_chains = fw->valid_rx_ant;
1476 
1477 	if (cfg->uhb_supported)
1478 		data = kzalloc(struct_size(data, channels,
1479 					   IWL_NVM_NUM_CHANNELS_UHB),
1480 					   GFP_KERNEL);
1481 	else
1482 		data = kzalloc(struct_size(data, channels,
1483 					   IWL_NVM_NUM_CHANNELS_EXT),
1484 					   GFP_KERNEL);
1485 	if (!data)
1486 		return NULL;
1487 
1488 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1489 		     IWL_NVM_NUM_CHANNELS_UHB);
1490 	data->nvm_version = mei_nvm->nvm_version;
1491 
1492 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1493 	if (data->valid_tx_ant)
1494 		tx_chains &= data->valid_tx_ant;
1495 	if (data->valid_rx_ant)
1496 		rx_chains &= data->valid_rx_ant;
1497 	if (tx_ant)
1498 		tx_chains &= tx_ant;
1499 	if (rx_ant)
1500 		rx_chains &= rx_ant;
1501 
1502 	data->sku_cap_mimo_disabled = false;
1503 	data->sku_cap_band_24ghz_enable = true;
1504 	data->sku_cap_band_52ghz_enable = true;
1505 	data->sku_cap_11n_enable =
1506 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1507 	data->sku_cap_11ac_enable = true;
1508 	data->sku_cap_11ax_enable =
1509 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1510 
1511 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1512 
1513 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1514 	/* If no valid mac address was found - bail out */
1515 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1516 		kfree(data);
1517 		return NULL;
1518 	}
1519 
1520 	if (data->lar_enabled &&
1521 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1522 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1523 
1524 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1525 			sbands_flags, true, fw);
1526 
1527 	return data;
1528 }
1529 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1530 
1531 struct iwl_nvm_data *
1532 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1533 		   const struct iwl_fw *fw,
1534 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1535 		   const __le16 *nvm_calib, const __le16 *regulatory,
1536 		   const __le16 *mac_override, const __le16 *phy_sku,
1537 		   u8 tx_chains, u8 rx_chains)
1538 {
1539 	struct iwl_nvm_data *data;
1540 	bool lar_enabled;
1541 	u32 sku, radio_cfg;
1542 	u32 sbands_flags = 0;
1543 	u16 lar_config;
1544 	const __le16 *ch_section;
1545 
1546 	if (cfg->uhb_supported)
1547 		data = kzalloc(struct_size(data, channels,
1548 					   IWL_NVM_NUM_CHANNELS_UHB),
1549 					   GFP_KERNEL);
1550 	else if (cfg->nvm_type != IWL_NVM_EXT)
1551 		data = kzalloc(struct_size(data, channels,
1552 					   IWL_NVM_NUM_CHANNELS),
1553 					   GFP_KERNEL);
1554 	else
1555 		data = kzalloc(struct_size(data, channels,
1556 					   IWL_NVM_NUM_CHANNELS_EXT),
1557 					   GFP_KERNEL);
1558 	if (!data)
1559 		return NULL;
1560 
1561 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1562 
1563 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1564 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1565 	if (data->valid_tx_ant)
1566 		tx_chains &= data->valid_tx_ant;
1567 	if (data->valid_rx_ant)
1568 		rx_chains &= data->valid_rx_ant;
1569 
1570 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1571 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1572 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1573 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1574 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1575 		data->sku_cap_11n_enable = false;
1576 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1577 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1578 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1579 
1580 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1581 
1582 	if (cfg->nvm_type != IWL_NVM_EXT) {
1583 		/* Checking for required sections */
1584 		if (!nvm_calib) {
1585 			IWL_ERR(trans,
1586 				"Can't parse empty Calib NVM sections\n");
1587 			kfree(data);
1588 			return NULL;
1589 		}
1590 
1591 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1592 			     &regulatory[NVM_CHANNELS_SDP] :
1593 			     &nvm_sw[NVM_CHANNELS];
1594 
1595 		lar_enabled = true;
1596 	} else {
1597 		u16 lar_offset = data->nvm_version < 0xE39 ?
1598 				 NVM_LAR_OFFSET_OLD :
1599 				 NVM_LAR_OFFSET;
1600 
1601 		lar_config = le16_to_cpup(regulatory + lar_offset);
1602 		data->lar_enabled = !!(lar_config &
1603 				       NVM_LAR_ENABLED);
1604 		lar_enabled = data->lar_enabled;
1605 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1606 	}
1607 
1608 	/* If no valid mac address was found - bail out */
1609 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1610 		kfree(data);
1611 		return NULL;
1612 	}
1613 
1614 	if (lar_enabled &&
1615 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1616 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1617 
1618 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1619 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1620 
1621 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1622 			sbands_flags, false, fw);
1623 	data->calib_version = 255;
1624 
1625 	return data;
1626 }
1627 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1628 
1629 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1630 				       int ch_idx, u16 nvm_flags,
1631 				       struct iwl_reg_capa reg_capa,
1632 				       const struct iwl_cfg *cfg)
1633 {
1634 	u32 flags = NL80211_RRF_NO_HT40;
1635 
1636 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1637 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1638 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1639 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1640 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1641 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1642 	} else if (ch_idx < NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS &&
1643 		   nvm_flags & NVM_CHANNEL_40MHZ) {
1644 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1645 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1646 		else
1647 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1648 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1649 		flags &= ~NL80211_RRF_NO_HT40PLUS;
1650 		flags &= ~NL80211_RRF_NO_HT40MINUS;
1651 	}
1652 
1653 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1654 		flags |= NL80211_RRF_NO_80MHZ;
1655 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1656 		flags |= NL80211_RRF_NO_160MHZ;
1657 
1658 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1659 		flags |= NL80211_RRF_NO_IR;
1660 
1661 	if (nvm_flags & NVM_CHANNEL_RADAR)
1662 		flags |= NL80211_RRF_DFS;
1663 
1664 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1665 		flags |= NL80211_RRF_NO_OUTDOOR;
1666 
1667 	if (nvm_flags & NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY &&
1668 	    flags & NL80211_RRF_NO_IR)
1669 		flags |= NL80211_RRF_ALLOW_20MHZ_ACTIVITY;
1670 
1671 	/* Set the GO concurrent flag only in case that NO_IR is set.
1672 	 * Otherwise it is meaningless
1673 	 */
1674 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT)) {
1675 		if (flags & NL80211_RRF_NO_IR)
1676 			flags |= NL80211_RRF_GO_CONCURRENT;
1677 		if (flags & NL80211_RRF_DFS) {
1678 			flags |= NL80211_RRF_DFS_CONCURRENT;
1679 			/* Our device doesn't set active bit for DFS channels
1680 			 * however, once marked as DFS no-ir is not needed.
1681 			 */
1682 			flags &= ~NL80211_RRF_NO_IR;
1683 		}
1684 	}
1685 
1686 	/* Set the AP type for the UHB case. */
1687 	if (nvm_flags & NVM_CHANNEL_VLP)
1688 		flags |= NL80211_RRF_ALLOW_6GHZ_VLP_AP;
1689 	else
1690 		flags |= NL80211_RRF_NO_6GHZ_VLP_CLIENT;
1691 
1692 	if (!(nvm_flags & NVM_CHANNEL_AFC))
1693 		flags |= NL80211_RRF_NO_6GHZ_AFC_CLIENT;
1694 
1695 	/*
1696 	 * reg_capa is per regulatory domain so apply it for every channel
1697 	 */
1698 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1699 		if (!reg_capa.allow_40mhz)
1700 			flags |= NL80211_RRF_NO_HT40;
1701 
1702 		if (!reg_capa.allow_80mhz)
1703 			flags |= NL80211_RRF_NO_80MHZ;
1704 
1705 		if (!reg_capa.allow_160mhz)
1706 			flags |= NL80211_RRF_NO_160MHZ;
1707 
1708 		if (!reg_capa.allow_320mhz)
1709 			flags |= NL80211_RRF_NO_320MHZ;
1710 	}
1711 
1712 	if (reg_capa.disable_11ax)
1713 		flags |= NL80211_RRF_NO_HE;
1714 
1715 	if (reg_capa.disable_11be)
1716 		flags |= NL80211_RRF_NO_EHT;
1717 
1718 	return flags;
1719 }
1720 
1721 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1722 {
1723 	struct iwl_reg_capa reg_capa = {};
1724 
1725 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1726 		reg_capa.allow_40mhz = true;
1727 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1728 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1729 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1730 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1731 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1732 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1733 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1734 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1735 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1736 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1737 	} else {
1738 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1739 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1740 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1741 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1742 	}
1743 	return reg_capa;
1744 }
1745 
1746 struct ieee80211_regdomain *
1747 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
1748 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1749 		       u16 geo_info, u32 cap, u8 resp_ver)
1750 {
1751 	int ch_idx;
1752 	u16 ch_flags;
1753 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1754 	const u16 *nvm_chan;
1755 	struct ieee80211_regdomain *regd, *copy_rd;
1756 	struct ieee80211_reg_rule *rule;
1757 	int center_freq, prev_center_freq = 0;
1758 	int valid_rules = 0;
1759 	bool new_rule;
1760 	int max_num_ch;
1761 	struct iwl_reg_capa reg_capa;
1762 
1763 	if (cfg->uhb_supported) {
1764 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1765 		nvm_chan = iwl_uhb_nvm_channels;
1766 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1767 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1768 		nvm_chan = iwl_ext_nvm_channels;
1769 	} else {
1770 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1771 		nvm_chan = iwl_nvm_channels;
1772 	}
1773 
1774 	if (num_of_ch > max_num_ch) {
1775 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1776 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1777 			      num_of_ch, max_num_ch);
1778 		num_of_ch = max_num_ch;
1779 	}
1780 
1781 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1782 		return ERR_PTR(-EINVAL);
1783 
1784 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1785 		      num_of_ch);
1786 
1787 	/* build a regdomain rule for every valid channel */
1788 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1789 	if (!regd)
1790 		return ERR_PTR(-ENOMEM);
1791 
1792 	/* set alpha2 from FW. */
1793 	regd->alpha2[0] = fw_mcc >> 8;
1794 	regd->alpha2[1] = fw_mcc & 0xff;
1795 
1796 	/* parse regulatory capability flags */
1797 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1798 
1799 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1800 		enum nl80211_band band =
1801 			iwl_nl80211_band_from_channel_idx(ch_idx);
1802 
1803 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1804 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1805 							     band);
1806 		new_rule = false;
1807 
1808 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1809 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1810 						    nvm_chan[ch_idx], ch_flags);
1811 			continue;
1812 		}
1813 
1814 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1815 							     ch_flags, reg_capa,
1816 							     cfg);
1817 
1818 		/* we can't continue the same rule */
1819 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1820 		    center_freq - prev_center_freq > 20) {
1821 			valid_rules++;
1822 			new_rule = true;
1823 		}
1824 
1825 		rule = &regd->reg_rules[valid_rules - 1];
1826 
1827 		if (new_rule)
1828 			rule->freq_range.start_freq_khz =
1829 						MHZ_TO_KHZ(center_freq - 10);
1830 
1831 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1832 
1833 		/* this doesn't matter - not used by FW */
1834 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1835 		rule->power_rule.max_eirp =
1836 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1837 
1838 		rule->flags = reg_rule_flags;
1839 
1840 		/* rely on auto-calculation to merge BW of contiguous chans */
1841 		rule->flags |= NL80211_RRF_AUTO_BW;
1842 		rule->freq_range.max_bandwidth_khz = 0;
1843 
1844 		prev_center_freq = center_freq;
1845 		prev_reg_rule_flags = reg_rule_flags;
1846 
1847 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1848 					    nvm_chan[ch_idx], ch_flags);
1849 
1850 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1851 		    band == NL80211_BAND_2GHZ)
1852 			continue;
1853 
1854 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1855 	}
1856 
1857 	/*
1858 	 * Certain firmware versions might report no valid channels
1859 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1860 	 * running. We'll get out of this situation later when the
1861 	 * rfkill is removed and we update the regdomain again, but
1862 	 * since cfg80211 doesn't accept an empty regdomain, add a
1863 	 * dummy (unusable) rule here in this case so we can init.
1864 	 */
1865 	if (!valid_rules) {
1866 		valid_rules = 1;
1867 		rule = &regd->reg_rules[valid_rules - 1];
1868 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1869 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1870 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1871 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1872 		rule->power_rule.max_eirp =
1873 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1874 	}
1875 
1876 	regd->n_reg_rules = valid_rules;
1877 
1878 	/*
1879 	 * Narrow down regdom for unused regulatory rules to prevent hole
1880 	 * between reg rules to wmm rules.
1881 	 */
1882 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1883 			  GFP_KERNEL);
1884 	if (!copy_rd)
1885 		copy_rd = ERR_PTR(-ENOMEM);
1886 
1887 	kfree(regd);
1888 	return copy_rd;
1889 }
1890 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1891 
1892 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1893 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1894 #define MAX_NVM_FILE_LEN	16384
1895 
1896 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1897 		    unsigned int len)
1898 {
1899 #define IWL_4165_DEVICE_ID	0x5501
1900 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1901 
1902 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1903 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1904 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1905 		/* OTP 0x52 bug work around: it's a 1x1 device */
1906 		data[3] = ANT_B | (ANT_B << 4);
1907 }
1908 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1909 
1910 /*
1911  * Reads external NVM from a file into mvm->nvm_sections
1912  *
1913  * HOW TO CREATE THE NVM FILE FORMAT:
1914  * ------------------------------
1915  * 1. create hex file, format:
1916  *      3800 -> header
1917  *      0000 -> header
1918  *      5a40 -> data
1919  *
1920  *   rev - 6 bit (word1)
1921  *   len - 10 bit (word1)
1922  *   id - 4 bit (word2)
1923  *   rsv - 12 bit (word2)
1924  *
1925  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1926  *
1927  * 3. create binary file from the hex file
1928  *
1929  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1930  */
1931 int iwl_read_external_nvm(struct iwl_trans *trans,
1932 			  const char *nvm_file_name,
1933 			  struct iwl_nvm_section *nvm_sections)
1934 {
1935 	int ret, section_size;
1936 	u16 section_id;
1937 	const struct firmware *fw_entry;
1938 	const struct {
1939 		__le16 word1;
1940 		__le16 word2;
1941 		u8 data[];
1942 	} *file_sec;
1943 	const u8 *eof;
1944 	u8 *temp;
1945 	int max_section_size;
1946 	const __le32 *dword_buff;
1947 
1948 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1949 #define NVM_WORD2_ID(x) (x >> 12)
1950 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1951 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1952 #define NVM_HEADER_0	(0x2A504C54)
1953 #define NVM_HEADER_1	(0x4E564D2A)
1954 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1955 
1956 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1957 
1958 	/* Maximal size depends on NVM version */
1959 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1960 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1961 	else
1962 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1963 
1964 	/*
1965 	 * Obtain NVM image via request_firmware. Since we already used
1966 	 * request_firmware_nowait() for the firmware binary load and only
1967 	 * get here after that we assume the NVM request can be satisfied
1968 	 * synchronously.
1969 	 */
1970 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1971 	if (ret) {
1972 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1973 			nvm_file_name, ret);
1974 		return ret;
1975 	}
1976 
1977 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1978 		 nvm_file_name, fw_entry->size);
1979 
1980 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1981 		IWL_ERR(trans, "NVM file too large\n");
1982 		ret = -EINVAL;
1983 		goto out;
1984 	}
1985 
1986 	eof = fw_entry->data + fw_entry->size;
1987 	dword_buff = (const __le32 *)fw_entry->data;
1988 
1989 	/* some NVM file will contain a header.
1990 	 * The header is identified by 2 dwords header as follow:
1991 	 * dword[0] = 0x2A504C54
1992 	 * dword[1] = 0x4E564D2A
1993 	 *
1994 	 * This header must be skipped when providing the NVM data to the FW.
1995 	 */
1996 	if (fw_entry->size > NVM_HEADER_SIZE &&
1997 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1998 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1999 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
2000 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
2001 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
2002 			 le32_to_cpu(dword_buff[3]));
2003 
2004 		/* nvm file validation, dword_buff[2] holds the file version */
2005 		if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
2006 		    trans->info.hw_rev_step == SILICON_C_STEP &&
2007 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
2008 			ret = -EFAULT;
2009 			goto out;
2010 		}
2011 	} else {
2012 		file_sec = (const void *)fw_entry->data;
2013 	}
2014 
2015 	while (true) {
2016 		if (file_sec->data > eof) {
2017 			IWL_ERR(trans,
2018 				"ERROR - NVM file too short for section header\n");
2019 			ret = -EINVAL;
2020 			break;
2021 		}
2022 
2023 		/* check for EOF marker */
2024 		if (!file_sec->word1 && !file_sec->word2) {
2025 			ret = 0;
2026 			break;
2027 		}
2028 
2029 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
2030 			section_size =
2031 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
2032 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
2033 		} else {
2034 			section_size = 2 * EXT_NVM_WORD2_LEN(
2035 						le16_to_cpu(file_sec->word2));
2036 			section_id = EXT_NVM_WORD1_ID(
2037 						le16_to_cpu(file_sec->word1));
2038 		}
2039 
2040 		if (section_size > max_section_size) {
2041 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
2042 				section_size);
2043 			ret = -EINVAL;
2044 			break;
2045 		}
2046 
2047 		if (!section_size) {
2048 			IWL_ERR(trans, "ERROR - section empty\n");
2049 			ret = -EINVAL;
2050 			break;
2051 		}
2052 
2053 		if (file_sec->data + section_size > eof) {
2054 			IWL_ERR(trans,
2055 				"ERROR - NVM file too short for section (%d bytes)\n",
2056 				section_size);
2057 			ret = -EINVAL;
2058 			break;
2059 		}
2060 
2061 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
2062 			 "Invalid NVM section ID %d\n", section_id)) {
2063 			ret = -EINVAL;
2064 			break;
2065 		}
2066 
2067 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
2068 		if (!temp) {
2069 			ret = -ENOMEM;
2070 			break;
2071 		}
2072 
2073 		iwl_nvm_fixups(trans->info.hw_id, section_id, temp, section_size);
2074 
2075 		kfree(nvm_sections[section_id].data);
2076 		nvm_sections[section_id].data = temp;
2077 		nvm_sections[section_id].length = section_size;
2078 
2079 		/* advance to the next section */
2080 		file_sec = (const void *)(file_sec->data + section_size);
2081 	}
2082 out:
2083 	release_firmware(fw_entry);
2084 	return ret;
2085 }
2086 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
2087 
2088 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
2089 				 const struct iwl_fw *fw,
2090 				 u8 set_tx_ant, u8 set_rx_ant)
2091 {
2092 	struct iwl_nvm_get_info cmd = {};
2093 	struct iwl_nvm_data *nvm;
2094 	struct iwl_host_cmd hcmd = {
2095 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
2096 		.data = { &cmd, },
2097 		.len = { sizeof(cmd) },
2098 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
2099 	};
2100 	int  ret;
2101 	bool empty_otp;
2102 	u32 mac_flags;
2103 	u32 sbands_flags = 0;
2104 	u8 tx_ant;
2105 	u8 rx_ant;
2106 
2107 	/*
2108 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
2109 	 * in v3, except for the channel profile part of the
2110 	 * regulatory.  So we can just access the new struct, with the
2111 	 * exception of the latter.
2112 	 */
2113 	struct iwl_nvm_get_info_rsp *rsp;
2114 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
2115 	bool v4 = fw_has_api(&fw->ucode_capa,
2116 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
2117 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
2118 	void *channel_profile;
2119 
2120 	ret = iwl_trans_send_cmd(trans, &hcmd);
2121 	if (ret)
2122 		return ERR_PTR(ret);
2123 
2124 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
2125 		 "Invalid payload len in NVM response from FW %d",
2126 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
2127 		ret = -EINVAL;
2128 		goto out;
2129 	}
2130 
2131 	rsp = (void *)hcmd.resp_pkt->data;
2132 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
2133 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
2134 	if (empty_otp)
2135 		IWL_INFO(trans, "OTP is empty\n");
2136 
2137 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
2138 	if (!nvm) {
2139 		ret = -ENOMEM;
2140 		goto out;
2141 	}
2142 
2143 	iwl_set_hw_address_from_csr(trans, nvm);
2144 	/* TODO: if platform NVM has MAC address - override it here */
2145 
2146 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2147 		IWL_ERR(trans, "no valid mac address was found\n");
2148 		ret = -EINVAL;
2149 		goto err_free;
2150 	}
2151 
2152 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2153 
2154 	/* Initialize general data */
2155 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2156 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2157 	if (nvm->n_hw_addrs == 0)
2158 		IWL_WARN(trans,
2159 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2160 			 empty_otp);
2161 
2162 	/* Initialize MAC sku data */
2163 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2164 	nvm->sku_cap_11ac_enable =
2165 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2166 	nvm->sku_cap_11n_enable =
2167 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2168 	nvm->sku_cap_11ax_enable =
2169 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2170 	nvm->sku_cap_band_24ghz_enable =
2171 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2172 	nvm->sku_cap_band_52ghz_enable =
2173 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2174 	nvm->sku_cap_mimo_disabled =
2175 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2176 	if (CSR_HW_RFID_TYPE(trans->info.hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
2177 		nvm->sku_cap_11be_enable = true;
2178 
2179 	/* Initialize PHY sku data */
2180 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2181 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2182 
2183 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2184 	    fw_has_capa(&fw->ucode_capa,
2185 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2186 		nvm->lar_enabled = true;
2187 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2188 	}
2189 
2190 	rsp_v3 = (void *)rsp;
2191 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2192 			  (void *)rsp_v3->regulatory.channel_profile;
2193 
2194 	tx_ant = nvm->valid_tx_ant & fw->valid_tx_ant;
2195 	rx_ant = nvm->valid_rx_ant & fw->valid_rx_ant;
2196 
2197 	if (set_tx_ant)
2198 		tx_ant &= set_tx_ant;
2199 	if (set_rx_ant)
2200 		rx_ant &= set_rx_ant;
2201 
2202 	iwl_init_sbands(trans, nvm, channel_profile, tx_ant, rx_ant,
2203 			sbands_flags, v4, fw);
2204 
2205 	iwl_free_resp(&hcmd);
2206 	return nvm;
2207 
2208 err_free:
2209 	kfree(nvm);
2210 out:
2211 	iwl_free_resp(&hcmd);
2212 	return ERR_PTR(ret);
2213 }
2214 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2215