xref: /linux/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c (revision 3186a8e55ae3428ec1e06af09075e20885376e4e)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM REGULATORY -Section offset (in words) definitions */
42 	NVM_CHANNELS_SDP = 0,
43 };
44 
45 enum ext_nvm_offsets {
46 	/* NVM HW-Section offset (in words) definitions */
47 
48 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
49 
50 	/* NVM SW-Section offset (in words) definitions */
51 	NVM_VERSION_EXT_NVM = 0,
52 	N_HW_ADDRS_FAMILY_8000 = 3,
53 
54 	/* NVM PHY_SKU-Section offset (in words) definitions */
55 	RADIO_CFG_FAMILY_EXT_NVM = 0,
56 	SKU_FAMILY_8000 = 2,
57 
58 	/* NVM REGULATORY -Section offset (in words) definitions */
59 	NVM_CHANNELS_EXTENDED = 0,
60 	NVM_LAR_OFFSET_OLD = 0x4C7,
61 	NVM_LAR_OFFSET = 0x507,
62 	NVM_LAR_ENABLED = 0x7,
63 };
64 
65 /* SKU Capabilities (actual values from NVM definition) */
66 enum nvm_sku_bits {
67 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
68 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
69 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
70 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
71 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
72 };
73 
74 /*
75  * These are the channel numbers in the order that they are stored in the NVM
76  */
77 static const u16 iwl_nvm_channels[] = {
78 	/* 2.4 GHz */
79 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
80 	/* 5 GHz */
81 	36, 40, 44, 48, 52, 56, 60, 64,
82 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
83 	149, 153, 157, 161, 165
84 };
85 
86 static const u16 iwl_ext_nvm_channels[] = {
87 	/* 2.4 GHz */
88 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
89 	/* 5 GHz */
90 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
91 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
92 	149, 153, 157, 161, 165, 169, 173, 177, 181
93 };
94 
95 static const u16 iwl_uhb_nvm_channels[] = {
96 	/* 2.4 GHz */
97 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
98 	/* 5 GHz */
99 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
100 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
101 	149, 153, 157, 161, 165, 169, 173, 177, 181,
102 	/* 6-7 GHz */
103 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
104 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
105 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
106 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
107 };
108 
109 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
110 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
111 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
112 #define NUM_2GHZ_CHANNELS		14
113 #define NUM_5GHZ_CHANNELS		37
114 #define FIRST_2GHZ_HT_MINUS		5
115 #define LAST_2GHZ_HT_PLUS		9
116 #define N_HW_ADDR_MASK			0xF
117 
118 /* rate data (static) */
119 static struct ieee80211_rate iwl_cfg80211_rates[] = {
120 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
121 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
122 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
123 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
124 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
125 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
126 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
127 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
128 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
129 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
130 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
131 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
132 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
133 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
134 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
135 };
136 #define RATES_24_OFFS	0
137 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
138 #define RATES_52_OFFS	4
139 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
140 
141 /**
142  * enum iwl_nvm_channel_flags - channel flags in NVM
143  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
144  * @NVM_CHANNEL_IBSS: usable as an IBSS channel and deprecated
145  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
146  * @NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY: active scanning allowed and
147  *	AP allowed only in 20 MHz. Valid only
148  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
149  * @NVM_CHANNEL_ACTIVE: active scanning allowed and allows IBSS
150  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
151  * @NVM_CHANNEL_RADAR: radar detection required
152  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
153  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
154  *	on same channel on 2.4 or same UNII band on 5.2
155  * @NVM_CHANNEL_UNIFORM: uniform spreading required
156  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
157  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
158  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
159  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
160  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
161  * @NVM_CHANNEL_VLP: client support connection to UHB VLP AP
162  * @NVM_CHANNEL_AFC: client support connection to UHB AFC AP
163  */
164 enum iwl_nvm_channel_flags {
165 	NVM_CHANNEL_VALID                   = BIT(0),
166 	NVM_CHANNEL_IBSS                    = BIT(1),
167 	NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY    = BIT(2),
168 	NVM_CHANNEL_ACTIVE                  = BIT(3),
169 	NVM_CHANNEL_RADAR                   = BIT(4),
170 	NVM_CHANNEL_INDOOR_ONLY             = BIT(5),
171 	NVM_CHANNEL_GO_CONCURRENT           = BIT(6),
172 	NVM_CHANNEL_UNIFORM                 = BIT(7),
173 	NVM_CHANNEL_20MHZ                   = BIT(8),
174 	NVM_CHANNEL_40MHZ                   = BIT(9),
175 	NVM_CHANNEL_80MHZ                   = BIT(10),
176 	NVM_CHANNEL_160MHZ                  = BIT(11),
177 	NVM_CHANNEL_DC_HIGH                 = BIT(12),
178 	NVM_CHANNEL_VLP                     = BIT(13),
179 	NVM_CHANNEL_AFC                     = BIT(14),
180 };
181 
182 /**
183  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
184  * domain.
185  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
186  *	2.4Ghz band is allowed.
187  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
188  *	5Ghz band is allowed.
189  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
190  *	for this regulatory domain (valid only in 5Ghz).
191  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
192  *	for this regulatory domain (valid only in 5Ghz).
193  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
194  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
195  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
196  *	for this regulatory domain (valid only in 5Ghz).
197  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
198  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
199  */
200 enum iwl_reg_capa_flags_v1 {
201 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
202 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
203 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
204 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
205 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
206 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
207 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
208 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
209 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
210 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
211 
212 /**
213  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
214  * domain (version 2).
215  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
216  *	disabled.
217  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
218  *	2.4Ghz band is allowed.
219  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
220  *	5Ghz band is allowed.
221  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
222  *	for this regulatory domain (valid only in 5Ghz).
223  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
224  *	for this regulatory domain (valid only in 5Ghz).
225  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
226  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
227  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
228  *	126, 122) are disabled.
229  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
230  *	for this regulatory domain (uvalid only in 5Ghz).
231  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
232  */
233 enum iwl_reg_capa_flags_v2 {
234 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
235 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
236 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
237 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
238 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
239 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
240 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
241 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
242 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
243 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
244 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
245 
246 /**
247  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
248  * domain.
249  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
250  *	for this regulatory domain (valid only in 5Ghz).
251  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
252  *	for this regulatory domain (valid only in 5Ghz).
253  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
254  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
255  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
256  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
257  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
258  *	for this regulatory domain (valid only in 5GHz).
259  */
260 enum iwl_reg_capa_flags_v4 {
261 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
262 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
263 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
264 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
265 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
266 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
267 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
268 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
269 
270 /*
271 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
272 * MCC update command response.
273 */
274 #define REG_CAPA_V2_RESP_VER	6
275 
276 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
277  * MCC update command response.
278  */
279 #define REG_CAPA_V4_RESP_VER	8
280 
281 /**
282  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
283  * handling the different APIs of reg_capa_flags.
284  *
285  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
286  *	for this regulatory domain.
287  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
288  *	for this regulatory domain (valid only in 5 and 6 Ghz).
289  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
290  *	for this regulatory domain (valid only in 5 and 6 Ghz).
291  * @allow_320mhz: 11be channel with a width of 320Mhz is allowed
292  *	for this regulatory domain (valid only in 6 Ghz).
293  * @disable_11ax: 11ax is forbidden for this regulatory domain.
294  * @disable_11be: 11be is forbidden for this regulatory domain.
295  */
296 struct iwl_reg_capa {
297 	bool allow_40mhz;
298 	bool allow_80mhz;
299 	bool allow_160mhz;
300 	bool allow_320mhz;
301 	bool disable_11ax;
302 	bool disable_11be;
303 };
304 
305 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
306 					       int chan, u32 flags)
307 {
308 #define CHECK_AND_PRINT_I(x)	\
309 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
310 
311 	if (!(flags & NVM_CHANNEL_VALID)) {
312 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
313 			      chan, flags);
314 		return;
315 	}
316 
317 	/* Note: already can print up to 101 characters, 110 is the limit! */
318 	IWL_DEBUG_DEV(dev, level,
319 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
320 		      chan, flags,
321 		      CHECK_AND_PRINT_I(VALID),
322 		      CHECK_AND_PRINT_I(IBSS),
323 		      CHECK_AND_PRINT_I(ACTIVE),
324 		      CHECK_AND_PRINT_I(RADAR),
325 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
326 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
327 		      CHECK_AND_PRINT_I(UNIFORM),
328 		      CHECK_AND_PRINT_I(20MHZ),
329 		      CHECK_AND_PRINT_I(40MHZ),
330 		      CHECK_AND_PRINT_I(80MHZ),
331 		      CHECK_AND_PRINT_I(160MHZ),
332 		      CHECK_AND_PRINT_I(DC_HIGH),
333 		      CHECK_AND_PRINT_I(VLP),
334 		      CHECK_AND_PRINT_I(AFC));
335 #undef CHECK_AND_PRINT_I
336 }
337 
338 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
339 				 u32 nvm_flags, const struct iwl_cfg *cfg)
340 {
341 	u32 flags = IEEE80211_CHAN_NO_HT40;
342 
343 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
344 		if (ch_num <= LAST_2GHZ_HT_PLUS)
345 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
346 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
347 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
348 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
349 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
350 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
351 		else
352 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
353 	}
354 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
355 		flags |= IEEE80211_CHAN_NO_80MHZ;
356 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
357 		flags |= IEEE80211_CHAN_NO_160MHZ;
358 
359 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
360 		flags |= IEEE80211_CHAN_NO_IR;
361 
362 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
363 		flags |= IEEE80211_CHAN_NO_IR;
364 
365 	if (nvm_flags & NVM_CHANNEL_RADAR)
366 		flags |= IEEE80211_CHAN_RADAR;
367 
368 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
369 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
370 
371 	/* Set the GO concurrent flag only in case that NO_IR is set.
372 	 * Otherwise it is meaningless
373 	 */
374 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
375 	    (flags & IEEE80211_CHAN_NO_IR))
376 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
377 
378 	/* Set the AP type for the UHB case. */
379 	if (nvm_flags & NVM_CHANNEL_VLP)
380 		flags |= IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP;
381 	else
382 		flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
383 	if (!(nvm_flags & NVM_CHANNEL_AFC))
384 		flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
385 
386 	return flags;
387 }
388 
389 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
390 {
391 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
392 		return NL80211_BAND_6GHZ;
393 	}
394 
395 	if (ch_idx >= NUM_2GHZ_CHANNELS)
396 		return NL80211_BAND_5GHZ;
397 	return NL80211_BAND_2GHZ;
398 }
399 
400 static int iwl_init_channel_map(struct iwl_trans *trans,
401 				const struct iwl_fw *fw,
402 				struct iwl_nvm_data *data,
403 				const void * const nvm_ch_flags,
404 				u32 sbands_flags, bool v4)
405 {
406 	const struct iwl_cfg *cfg = trans->cfg;
407 	struct device *dev = trans->dev;
408 	int ch_idx;
409 	int n_channels = 0;
410 	struct ieee80211_channel *channel;
411 	u32 ch_flags;
412 	int num_of_ch;
413 	const u16 *nvm_chan;
414 
415 	if (cfg->uhb_supported) {
416 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
417 		nvm_chan = iwl_uhb_nvm_channels;
418 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
419 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
420 		nvm_chan = iwl_ext_nvm_channels;
421 	} else {
422 		num_of_ch = IWL_NVM_NUM_CHANNELS;
423 		nvm_chan = iwl_nvm_channels;
424 	}
425 
426 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
427 		enum nl80211_band band =
428 			iwl_nl80211_band_from_channel_idx(ch_idx);
429 
430 		if (v4)
431 			ch_flags =
432 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
433 		else
434 			ch_flags =
435 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
436 
437 		if (band == NL80211_BAND_5GHZ &&
438 		    !data->sku_cap_band_52ghz_enable)
439 			continue;
440 
441 		/* workaround to disable wide channels in 5GHz */
442 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
443 		    band == NL80211_BAND_5GHZ) {
444 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
445 				     NVM_CHANNEL_80MHZ |
446 				     NVM_CHANNEL_160MHZ);
447 		}
448 
449 		if (ch_flags & NVM_CHANNEL_160MHZ)
450 			data->vht160_supported = true;
451 
452 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
453 		    !(ch_flags & NVM_CHANNEL_VALID)) {
454 			/*
455 			 * Channels might become valid later if lar is
456 			 * supported, hence we still want to add them to
457 			 * the list of supported channels to cfg80211.
458 			 */
459 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
460 						    nvm_chan[ch_idx], ch_flags);
461 			continue;
462 		}
463 
464 		channel = &data->channels[n_channels];
465 		n_channels++;
466 
467 		channel->hw_value = nvm_chan[ch_idx];
468 		channel->band = band;
469 		channel->center_freq =
470 			ieee80211_channel_to_frequency(
471 				channel->hw_value, channel->band);
472 
473 		/* Initialize regulatory-based run-time data */
474 
475 		/*
476 		 * Default value - highest tx power value.  max_power
477 		 * is not used in mvm, and is used for backwards compatibility
478 		 */
479 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
480 
481 		/* don't put limitations in case we're using LAR */
482 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
483 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
484 							       ch_idx, band,
485 							       ch_flags, cfg);
486 		else
487 			channel->flags = 0;
488 
489 		if (fw_has_capa(&fw->ucode_capa,
490 				IWL_UCODE_TLV_CAPA_MONITOR_PASSIVE_CHANS))
491 			channel->flags |= IEEE80211_CHAN_CAN_MONITOR;
492 
493 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
494 					    channel->hw_value, ch_flags);
495 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
496 				 channel->hw_value, channel->max_power);
497 	}
498 
499 	return n_channels;
500 }
501 
502 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
503 				  struct iwl_nvm_data *data,
504 				  struct ieee80211_sta_vht_cap *vht_cap,
505 				  u8 tx_chains, u8 rx_chains)
506 {
507 	const struct iwl_cfg *cfg = trans->cfg;
508 	int num_rx_ants = num_of_ant(rx_chains);
509 	int num_tx_ants = num_of_ant(tx_chains);
510 
511 	vht_cap->vht_supported = true;
512 
513 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
514 		       IEEE80211_VHT_CAP_RXSTBC_1 |
515 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
516 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
517 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
518 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
519 
520 	if (!trans->cfg->ht_params->stbc)
521 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
522 
523 	if (data->vht160_supported)
524 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
525 				IEEE80211_VHT_CAP_SHORT_GI_160;
526 
527 	if (cfg->vht_mu_mimo_supported)
528 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
529 
530 	if (cfg->ht_params->ldpc)
531 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
532 
533 	if (data->sku_cap_mimo_disabled) {
534 		num_rx_ants = 1;
535 		num_tx_ants = 1;
536 	}
537 
538 	if (trans->cfg->ht_params->stbc && num_tx_ants > 1)
539 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
540 	else
541 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
542 
543 	switch (iwlwifi_mod_params.amsdu_size) {
544 	case IWL_AMSDU_DEF:
545 		if (trans->trans_cfg->mq_rx_supported)
546 			vht_cap->cap |=
547 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
548 		else
549 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
550 		break;
551 	case IWL_AMSDU_2K:
552 		if (trans->trans_cfg->mq_rx_supported)
553 			vht_cap->cap |=
554 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
555 		else
556 			WARN(1, "RB size of 2K is not supported by this device\n");
557 		break;
558 	case IWL_AMSDU_4K:
559 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
560 		break;
561 	case IWL_AMSDU_8K:
562 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
563 		break;
564 	case IWL_AMSDU_12K:
565 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
566 		break;
567 	default:
568 		break;
569 	}
570 
571 	vht_cap->vht_mcs.rx_mcs_map =
572 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
573 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
574 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
575 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
576 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
577 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
578 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
579 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
580 
581 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
582 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
583 		/* this works because NOT_SUPPORTED == 3 */
584 		vht_cap->vht_mcs.rx_mcs_map |=
585 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
586 	}
587 
588 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
589 
590 	vht_cap->vht_mcs.tx_highest |=
591 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
592 }
593 
594 static const u8 iwl_vendor_caps[] = {
595 	0xdd,			/* vendor element */
596 	0x06,			/* length */
597 	0x00, 0x17, 0x35,	/* Intel OUI */
598 	0x08,			/* type (Intel Capabilities) */
599 	/* followed by 16 bits of capabilities */
600 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
601 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
602 	0x00
603 };
604 
605 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
606 	{
607 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
608 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
609 		.he_cap = {
610 			.has_he = true,
611 			.he_cap_elem = {
612 				.mac_cap_info[0] =
613 					IEEE80211_HE_MAC_CAP0_HTC_HE,
614 				.mac_cap_info[1] =
615 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
616 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
617 				.mac_cap_info[2] =
618 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
619 				.mac_cap_info[3] =
620 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
621 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
622 				.mac_cap_info[4] =
623 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
624 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
625 				.mac_cap_info[5] =
626 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
627 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
628 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
629 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
630 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
631 				.phy_cap_info[1] =
632 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
633 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
634 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
635 				.phy_cap_info[2] =
636 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
637 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
638 				.phy_cap_info[3] =
639 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
640 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
641 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
642 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
643 				.phy_cap_info[4] =
644 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
645 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
646 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
647 				.phy_cap_info[6] =
648 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
649 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
650 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
651 				.phy_cap_info[7] =
652 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
653 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
654 				.phy_cap_info[8] =
655 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
656 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
657 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
658 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
659 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
660 				.phy_cap_info[9] =
661 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
662 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
663 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
664 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
665 				.phy_cap_info[10] =
666 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
667 			},
668 			/*
669 			 * Set default Tx/Rx HE MCS NSS Support field.
670 			 * Indicate support for up to 2 spatial streams and all
671 			 * MCS, without any special cases
672 			 */
673 			.he_mcs_nss_supp = {
674 				.rx_mcs_80 = cpu_to_le16(0xfffa),
675 				.tx_mcs_80 = cpu_to_le16(0xfffa),
676 				.rx_mcs_160 = cpu_to_le16(0xfffa),
677 				.tx_mcs_160 = cpu_to_le16(0xfffa),
678 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
679 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
680 			},
681 			/*
682 			 * Set default PPE thresholds, with PPET16 set to 0,
683 			 * PPET8 set to 7
684 			 */
685 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
686 		},
687 		.eht_cap = {
688 			.has_eht = true,
689 			.eht_cap_elem = {
690 				.mac_cap_info[0] =
691 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
692 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
693 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
694 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2 |
695 					IEEE80211_EHT_MAC_CAP0_SCS_TRAFFIC_DESC,
696 				.mac_cap_info[1] =
697 					IEEE80211_EHT_MAC_CAP1_UNSOL_EPCS_PRIO_ACCESS,
698 				.phy_cap_info[0] =
699 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
700 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
701 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
702 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
703 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
704 				.phy_cap_info[1] =
705 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
706 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
707 				.phy_cap_info[3] =
708 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
709 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
710 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
711 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
712 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
713 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
714 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
715 
716 				.phy_cap_info[4] =
717 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
718 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
719 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
720 				.phy_cap_info[5] =
721 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
722 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US) |
723 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
724 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
725 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP,
726 				.phy_cap_info[6] =
727 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
728 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
729 				.phy_cap_info[8] =
730 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
731 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
732 			},
733 
734 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
735 			 * Rx - note we don't set the only_20mhz, but due to this
736 			 * being a union, it gets set correctly anyway.
737 			 */
738 			.eht_mcs_nss_supp = {
739 				.bw._80 = {
740 					.rx_tx_mcs9_max_nss = 0x22,
741 					.rx_tx_mcs11_max_nss = 0x22,
742 					.rx_tx_mcs13_max_nss = 0x22,
743 				},
744 				.bw._160 = {
745 					.rx_tx_mcs9_max_nss = 0x22,
746 					.rx_tx_mcs11_max_nss = 0x22,
747 					.rx_tx_mcs13_max_nss = 0x22,
748 				},
749 				.bw._320 = {
750 					.rx_tx_mcs9_max_nss = 0x22,
751 					.rx_tx_mcs11_max_nss = 0x22,
752 					.rx_tx_mcs13_max_nss = 0x22,
753 				},
754 			},
755 
756 			/*
757 			 * PPE thresholds for NSS = 2, and RU index bitmap set
758 			 * to 0xc.
759 			 * Note: just for stating what we want, not present in
760 			 * the transmitted data due to not including
761 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
762 			 */
763 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
764 		},
765 	},
766 	{
767 		.types_mask = BIT(NL80211_IFTYPE_AP) |
768 			      BIT(NL80211_IFTYPE_P2P_GO),
769 		.he_cap = {
770 			.has_he = true,
771 			.he_cap_elem = {
772 				.mac_cap_info[0] =
773 					IEEE80211_HE_MAC_CAP0_HTC_HE,
774 				.mac_cap_info[1] =
775 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
776 				.mac_cap_info[3] =
777 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
778 				.phy_cap_info[1] =
779 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
780 				.phy_cap_info[2] =
781 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
782 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
783 				.phy_cap_info[3] =
784 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
785 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
786 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
787 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
788 				.phy_cap_info[6] =
789 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
790 				.phy_cap_info[7] =
791 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
792 				.phy_cap_info[8] =
793 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
794 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
795 				.phy_cap_info[9] =
796 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
797 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
798 			},
799 			/*
800 			 * Set default Tx/Rx HE MCS NSS Support field.
801 			 * Indicate support for up to 2 spatial streams and all
802 			 * MCS, without any special cases
803 			 */
804 			.he_mcs_nss_supp = {
805 				.rx_mcs_80 = cpu_to_le16(0xfffa),
806 				.tx_mcs_80 = cpu_to_le16(0xfffa),
807 				.rx_mcs_160 = cpu_to_le16(0xfffa),
808 				.tx_mcs_160 = cpu_to_le16(0xfffa),
809 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
810 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
811 			},
812 			/*
813 			 * Set default PPE thresholds, with PPET16 set to 0,
814 			 * PPET8 set to 7
815 			 */
816 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
817 		},
818 		.eht_cap = {
819 			.has_eht = true,
820 			.eht_cap_elem = {
821 				.mac_cap_info[0] =
822 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
823 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
824 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
825 				.phy_cap_info[0] =
826 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
827 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
828 				.phy_cap_info[5] =
829 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
830 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US),
831 			},
832 
833 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
834 			 * Rx - note we don't set the only_20mhz, but due to this
835 			 * being a union, it gets set correctly anyway.
836 			 */
837 			.eht_mcs_nss_supp = {
838 				.bw._80 = {
839 					.rx_tx_mcs9_max_nss = 0x22,
840 					.rx_tx_mcs11_max_nss = 0x22,
841 					.rx_tx_mcs13_max_nss = 0x22,
842 				},
843 				.bw._160 = {
844 					.rx_tx_mcs9_max_nss = 0x22,
845 					.rx_tx_mcs11_max_nss = 0x22,
846 					.rx_tx_mcs13_max_nss = 0x22,
847 				},
848 				.bw._320 = {
849 					.rx_tx_mcs9_max_nss = 0x22,
850 					.rx_tx_mcs11_max_nss = 0x22,
851 					.rx_tx_mcs13_max_nss = 0x22,
852 				},
853 			},
854 
855 			/*
856 			 * PPE thresholds for NSS = 2, and RU index bitmap set
857 			 * to 0xc.
858 			 * Note: just for stating what we want, not present in
859 			 * the transmitted data due to not including
860 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
861 			 */
862 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
863 		},
864 	},
865 };
866 
867 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
868 				  struct iwl_nvm_data *data,
869 				  struct ieee80211_supported_band *sband,
870 				  u8 tx_chains, u8 rx_chains)
871 {
872 	struct ieee80211_sta_ht_cap ht_cap;
873 	struct ieee80211_sta_vht_cap vht_cap = {};
874 	struct ieee80211_sband_iftype_data *iftype_data;
875 	u16 he_6ghz_capa = 0;
876 	u32 exp;
877 	int i;
878 
879 	if (sband->band != NL80211_BAND_6GHZ)
880 		return;
881 
882 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
883 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
884 			     tx_chains, rx_chains);
885 	WARN_ON(!ht_cap.ht_supported);
886 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
887 	WARN_ON(!vht_cap.vht_supported);
888 
889 	he_6ghz_capa |=
890 		u16_encode_bits(ht_cap.ampdu_density,
891 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
892 	exp = u32_get_bits(vht_cap.cap,
893 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
894 	he_6ghz_capa |=
895 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
896 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
897 	he_6ghz_capa |=
898 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
899 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
900 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
901 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
902 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
903 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
904 
905 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
906 
907 	/* we know it's writable - we set it before ourselves */
908 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
909 	for (i = 0; i < sband->n_iftype_data; i++)
910 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
911 }
912 
913 static void
914 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
915 			 struct iwl_nvm_data *data,
916 			 struct ieee80211_supported_band *sband,
917 			 struct ieee80211_sband_iftype_data *iftype_data,
918 			 u8 tx_chains, u8 rx_chains,
919 			 const struct iwl_fw *fw)
920 {
921 	bool is_ap = iftype_data->types_mask & (BIT(NL80211_IFTYPE_AP) |
922 						BIT(NL80211_IFTYPE_P2P_GO));
923 	bool slow_pcie = (!trans->trans_cfg->integrated &&
924 			  trans->pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB);
925 
926 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be)
927 		iftype_data->eht_cap.has_eht = false;
928 
929 	/* Advertise an A-MPDU exponent extension based on
930 	 * operating band
931 	 */
932 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
933 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
934 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
935 	else if (sband->band != NL80211_BAND_2GHZ)
936 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
937 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
938 	else
939 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
940 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
941 
942 	switch (sband->band) {
943 	case NL80211_BAND_2GHZ:
944 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
945 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
946 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
947 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
948 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
949 		break;
950 	case NL80211_BAND_6GHZ:
951 		if (!trans->reduced_cap_sku) {
952 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
953 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
954 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
955 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
956 		}
957 		fallthrough;
958 	case NL80211_BAND_5GHZ:
959 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
960 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
961 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
962 		break;
963 	default:
964 		WARN_ON(1);
965 		break;
966 	}
967 
968 	if ((tx_chains & rx_chains) == ANT_AB) {
969 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
970 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
971 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
972 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
973 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
974 		if (!is_ap) {
975 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
976 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
977 
978 			if (iftype_data->eht_cap.has_eht) {
979 				/*
980 				 * Set the number of sounding dimensions for each
981 				 * bandwidth to 1 to indicate the maximal supported
982 				 * value of TXVECTOR parameter NUM_STS of 2
983 				 */
984 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
985 
986 				/*
987 				 * Set the MAX NC to 1 to indicate sounding feedback of
988 				 * 2 supported by the beamfomee.
989 				 */
990 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
991 			}
992 		}
993 
994 		if (slow_pcie) {
995 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
996 				&iftype_data->eht_cap.eht_mcs_nss_supp;
997 
998 			mcs_nss->bw._320.rx_tx_mcs11_max_nss = 0;
999 			mcs_nss->bw._320.rx_tx_mcs13_max_nss = 0;
1000 		}
1001 	} else {
1002 		struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp =
1003 			&iftype_data->he_cap.he_mcs_nss_supp;
1004 
1005 		if (iftype_data->eht_cap.has_eht) {
1006 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
1007 				&iftype_data->eht_cap.eht_mcs_nss_supp;
1008 
1009 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
1010 		}
1011 
1012 		if (!is_ap) {
1013 			/* If not 2x2, we need to indicate 1x1 in the
1014 			 * Midamble RX Max NSTS - but not for AP mode
1015 			 */
1016 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
1017 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
1018 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1019 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
1020 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
1021 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
1022 		}
1023 
1024 		he_mcs_nss_supp->rx_mcs_80 |=
1025 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1026 		he_mcs_nss_supp->tx_mcs_80 |=
1027 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1028 		he_mcs_nss_supp->rx_mcs_160 |=
1029 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1030 		he_mcs_nss_supp->tx_mcs_160 |=
1031 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1032 		he_mcs_nss_supp->rx_mcs_80p80 |=
1033 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1034 		he_mcs_nss_supp->tx_mcs_80p80 |=
1035 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1036 	}
1037 
1038 	if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
1039 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
1040 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
1041 
1042 	switch (CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
1043 	case IWL_CFG_RF_TYPE_GF:
1044 	case IWL_CFG_RF_TYPE_FM:
1045 	case IWL_CFG_RF_TYPE_WH:
1046 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1047 			IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
1048 		if (!is_ap)
1049 			iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
1050 				IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
1051 		break;
1052 	}
1053 
1054 	if (CSR_HW_REV_TYPE(trans->hw_rev) == IWL_CFG_MAC_TYPE_GL &&
1055 	    iftype_data->eht_cap.has_eht) {
1056 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] &=
1057 			~(IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
1058 			  IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2);
1059 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[3] &=
1060 			~(IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
1061 			  IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
1062 			  IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
1063 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
1064 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
1065 			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
1066 			  IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK);
1067 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &=
1068 			~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
1069 			  IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP);
1070 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] &=
1071 			~IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK;
1072 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[6] &=
1073 			~(IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
1074 			  IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP);
1075 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] |=
1076 			IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF;
1077 	}
1078 
1079 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
1080 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
1081 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
1082 
1083 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1084 	    !is_ap) {
1085 		iftype_data->vendor_elems.data = iwl_vendor_caps;
1086 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
1087 	}
1088 
1089 	if (!trans->cfg->ht_params->stbc) {
1090 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1091 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
1092 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
1093 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
1094 	}
1095 
1096 	if (trans->step_urm) {
1097 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs11_max_nss = 0;
1098 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs13_max_nss = 0;
1099 	}
1100 
1101 	if (trans->no_160)
1102 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] &=
1103 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
1104 
1105 	if (trans->reduced_cap_sku) {
1106 		memset(&iftype_data->eht_cap.eht_mcs_nss_supp.bw._320, 0,
1107 		       sizeof(iftype_data->eht_cap.eht_mcs_nss_supp.bw._320));
1108 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._80.rx_tx_mcs13_max_nss = 0;
1109 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._160.rx_tx_mcs13_max_nss = 0;
1110 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[8] &=
1111 			~IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA;
1112 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] &=
1113 			~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
1114 	}
1115 }
1116 
1117 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1118 				 struct iwl_nvm_data *data,
1119 				 struct ieee80211_supported_band *sband,
1120 				 u8 tx_chains, u8 rx_chains,
1121 				 const struct iwl_fw *fw)
1122 {
1123 	struct ieee80211_sband_iftype_data *iftype_data;
1124 	int i;
1125 
1126 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1127 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1128 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1129 
1130 	switch (sband->band) {
1131 	case NL80211_BAND_2GHZ:
1132 		iftype_data = data->iftd.low;
1133 		break;
1134 	case NL80211_BAND_5GHZ:
1135 		iftype_data = data->iftd.high;
1136 		break;
1137 	case NL80211_BAND_6GHZ:
1138 		iftype_data = data->iftd.uhb;
1139 		break;
1140 	default:
1141 		WARN_ON(1);
1142 		return;
1143 	}
1144 
1145 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1146 
1147 	_ieee80211_set_sband_iftype_data(sband, iftype_data,
1148 					 ARRAY_SIZE(iwl_he_eht_capa));
1149 
1150 	for (i = 0; i < sband->n_iftype_data; i++)
1151 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1152 					 tx_chains, rx_chains, fw);
1153 
1154 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1155 }
1156 
1157 void iwl_reinit_cab(struct iwl_trans *trans, struct iwl_nvm_data *data,
1158 		    u8 tx_chains, u8 rx_chains, const struct iwl_fw *fw)
1159 {
1160 	struct ieee80211_supported_band *sband;
1161 
1162 	sband = &data->bands[NL80211_BAND_2GHZ];
1163 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1164 			     tx_chains, rx_chains);
1165 
1166 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1167 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1168 				     fw);
1169 
1170 	sband = &data->bands[NL80211_BAND_5GHZ];
1171 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1172 			     tx_chains, rx_chains);
1173 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1174 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1175 				      tx_chains, rx_chains);
1176 
1177 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1178 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1179 				     fw);
1180 
1181 	sband = &data->bands[NL80211_BAND_6GHZ];
1182 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1183 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1184 				     fw);
1185 }
1186 IWL_EXPORT_SYMBOL(iwl_reinit_cab);
1187 
1188 static void iwl_init_sbands(struct iwl_trans *trans,
1189 			    struct iwl_nvm_data *data,
1190 			    const void *nvm_ch_flags, u8 tx_chains,
1191 			    u8 rx_chains, u32 sbands_flags, bool v4,
1192 			    const struct iwl_fw *fw)
1193 {
1194 	struct device *dev = trans->dev;
1195 	int n_channels;
1196 	int n_used = 0;
1197 	struct ieee80211_supported_band *sband;
1198 
1199 	n_channels = iwl_init_channel_map(trans, fw, data, nvm_ch_flags,
1200 					  sbands_flags, v4);
1201 	sband = &data->bands[NL80211_BAND_2GHZ];
1202 	sband->band = NL80211_BAND_2GHZ;
1203 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1204 	sband->n_bitrates = N_RATES_24;
1205 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1206 					  NL80211_BAND_2GHZ);
1207 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1208 			     tx_chains, rx_chains);
1209 
1210 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1211 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1212 				     fw);
1213 
1214 	sband = &data->bands[NL80211_BAND_5GHZ];
1215 	sband->band = NL80211_BAND_5GHZ;
1216 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1217 	sband->n_bitrates = N_RATES_52;
1218 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1219 					  NL80211_BAND_5GHZ);
1220 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1221 			     tx_chains, rx_chains);
1222 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1223 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1224 				      tx_chains, rx_chains);
1225 
1226 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1227 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1228 				     fw);
1229 
1230 	/* 6GHz band. */
1231 	sband = &data->bands[NL80211_BAND_6GHZ];
1232 	sband->band = NL80211_BAND_6GHZ;
1233 	/* use the same rates as 5GHz band */
1234 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1235 	sband->n_bitrates = N_RATES_52;
1236 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1237 					  NL80211_BAND_6GHZ);
1238 
1239 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1240 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1241 				     fw);
1242 	else
1243 		sband->n_channels = 0;
1244 	if (n_channels != n_used)
1245 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1246 			    n_used, n_channels);
1247 }
1248 
1249 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1250 		       const __le16 *phy_sku)
1251 {
1252 	if (cfg->nvm_type != IWL_NVM_EXT)
1253 		return le16_to_cpup(nvm_sw + SKU);
1254 
1255 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1256 }
1257 
1258 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1259 {
1260 	if (cfg->nvm_type != IWL_NVM_EXT)
1261 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1262 	else
1263 		return le32_to_cpup((const __le32 *)(nvm_sw +
1264 						     NVM_VERSION_EXT_NVM));
1265 }
1266 
1267 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1268 			     const __le16 *phy_sku)
1269 {
1270 	if (cfg->nvm_type != IWL_NVM_EXT)
1271 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1272 
1273 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1274 
1275 }
1276 
1277 static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1278 {
1279 	int n_hw_addr;
1280 
1281 	if (cfg->nvm_type != IWL_NVM_EXT)
1282 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1283 
1284 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1285 
1286 	return n_hw_addr & N_HW_ADDR_MASK;
1287 }
1288 
1289 static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
1290 			      struct iwl_nvm_data *data,
1291 			      u32 radio_cfg)
1292 {
1293 	if (cfg->nvm_type != IWL_NVM_EXT) {
1294 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1295 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1296 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1297 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1298 		return;
1299 	}
1300 
1301 	/* set the radio configuration for family 8000 */
1302 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1303 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1304 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1305 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1306 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1307 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1308 }
1309 
1310 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1311 {
1312 	const u8 *hw_addr;
1313 
1314 	hw_addr = (const u8 *)&mac_addr0;
1315 	dest[0] = hw_addr[3];
1316 	dest[1] = hw_addr[2];
1317 	dest[2] = hw_addr[1];
1318 	dest[3] = hw_addr[0];
1319 
1320 	hw_addr = (const u8 *)&mac_addr1;
1321 	dest[4] = hw_addr[1];
1322 	dest[5] = hw_addr[0];
1323 }
1324 
1325 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1326 					struct iwl_nvm_data *data)
1327 {
1328 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1329 						  CSR_MAC_ADDR0_STRAP(trans)));
1330 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1331 						  CSR_MAC_ADDR1_STRAP(trans)));
1332 
1333 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1334 	/*
1335 	 * If the OEM fused a valid address, use it instead of the one in the
1336 	 * OTP
1337 	 */
1338 	if (is_valid_ether_addr(data->hw_addr))
1339 		return;
1340 
1341 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1342 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1343 
1344 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1345 }
1346 
1347 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1348 					   const struct iwl_cfg *cfg,
1349 					   struct iwl_nvm_data *data,
1350 					   const __le16 *mac_override,
1351 					   const __be16 *nvm_hw)
1352 {
1353 	const u8 *hw_addr;
1354 
1355 	if (mac_override) {
1356 		static const u8 reserved_mac[] = {
1357 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1358 		};
1359 
1360 		hw_addr = (const u8 *)(mac_override +
1361 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1362 
1363 		/*
1364 		 * Store the MAC address from MAO section.
1365 		 * No byte swapping is required in MAO section
1366 		 */
1367 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1368 
1369 		/*
1370 		 * Force the use of the OTP MAC address in case of reserved MAC
1371 		 * address in the NVM, or if address is given but invalid.
1372 		 */
1373 		if (is_valid_ether_addr(data->hw_addr) &&
1374 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1375 			return;
1376 
1377 		IWL_ERR(trans,
1378 			"mac address from nvm override section is not valid\n");
1379 	}
1380 
1381 	if (nvm_hw) {
1382 		/* read the mac address from WFMP registers */
1383 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1384 						WFMP_MAC_ADDR_0));
1385 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1386 						WFMP_MAC_ADDR_1));
1387 
1388 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1389 
1390 		return;
1391 	}
1392 
1393 	IWL_ERR(trans, "mac address is not found\n");
1394 }
1395 
1396 static int iwl_set_hw_address(struct iwl_trans *trans,
1397 			      const struct iwl_cfg *cfg,
1398 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1399 			      const __le16 *mac_override)
1400 {
1401 	if (cfg->mac_addr_from_csr) {
1402 		iwl_set_hw_address_from_csr(trans, data);
1403 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1404 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1405 
1406 		/* The byte order is little endian 16 bit, meaning 214365 */
1407 		data->hw_addr[0] = hw_addr[1];
1408 		data->hw_addr[1] = hw_addr[0];
1409 		data->hw_addr[2] = hw_addr[3];
1410 		data->hw_addr[3] = hw_addr[2];
1411 		data->hw_addr[4] = hw_addr[5];
1412 		data->hw_addr[5] = hw_addr[4];
1413 	} else {
1414 		iwl_set_hw_address_family_8000(trans, cfg, data,
1415 					       mac_override, nvm_hw);
1416 	}
1417 
1418 	if (!is_valid_ether_addr(data->hw_addr)) {
1419 		IWL_ERR(trans, "no valid mac address was found\n");
1420 		return -EINVAL;
1421 	}
1422 
1423 	if (!trans->csme_own)
1424 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1425 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1426 
1427 	return 0;
1428 }
1429 
1430 static bool
1431 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1432 			const __be16 *nvm_hw)
1433 {
1434 	/*
1435 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1436 	 * some 7000-family OTPs erroneously allow wide channels in
1437 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1438 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1439 	 * 9.  In those cases, we need to force-disable wide channels
1440 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1441 	 * to use them.
1442 	 */
1443 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1444 		/*
1445 		 * Unlike the other sections in the NVM, the hw
1446 		 * section uses big-endian.
1447 		 */
1448 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1449 		u8 sku = (subsystem_id & 0x1e) >> 1;
1450 
1451 		if (sku == 5 || sku == 9) {
1452 			IWL_DEBUG_EEPROM(trans->dev,
1453 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1454 					 subsystem_id, sku);
1455 			return true;
1456 		}
1457 	}
1458 
1459 	return false;
1460 }
1461 
1462 struct iwl_nvm_data *
1463 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1464 		       const struct iwl_mei_nvm *mei_nvm,
1465 		       const struct iwl_fw *fw, u8 tx_ant, u8 rx_ant)
1466 {
1467 	struct iwl_nvm_data *data;
1468 	u32 sbands_flags = 0;
1469 	u8 rx_chains = fw->valid_rx_ant;
1470 	u8 tx_chains = fw->valid_rx_ant;
1471 
1472 	if (cfg->uhb_supported)
1473 		data = kzalloc(struct_size(data, channels,
1474 					   IWL_NVM_NUM_CHANNELS_UHB),
1475 					   GFP_KERNEL);
1476 	else
1477 		data = kzalloc(struct_size(data, channels,
1478 					   IWL_NVM_NUM_CHANNELS_EXT),
1479 					   GFP_KERNEL);
1480 	if (!data)
1481 		return NULL;
1482 
1483 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1484 		     IWL_NVM_NUM_CHANNELS_UHB);
1485 	data->nvm_version = mei_nvm->nvm_version;
1486 
1487 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1488 	if (data->valid_tx_ant)
1489 		tx_chains &= data->valid_tx_ant;
1490 	if (data->valid_rx_ant)
1491 		rx_chains &= data->valid_rx_ant;
1492 	if (tx_ant)
1493 		tx_chains &= tx_ant;
1494 	if (rx_ant)
1495 		rx_chains &= rx_ant;
1496 
1497 	data->sku_cap_mimo_disabled = false;
1498 	data->sku_cap_band_24ghz_enable = true;
1499 	data->sku_cap_band_52ghz_enable = true;
1500 	data->sku_cap_11n_enable =
1501 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1502 	data->sku_cap_11ac_enable = true;
1503 	data->sku_cap_11ax_enable =
1504 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1505 
1506 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1507 
1508 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1509 	/* If no valid mac address was found - bail out */
1510 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1511 		kfree(data);
1512 		return NULL;
1513 	}
1514 
1515 	if (data->lar_enabled &&
1516 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1517 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1518 
1519 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1520 			sbands_flags, true, fw);
1521 
1522 	return data;
1523 }
1524 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1525 
1526 struct iwl_nvm_data *
1527 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1528 		   const struct iwl_fw *fw,
1529 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1530 		   const __le16 *nvm_calib, const __le16 *regulatory,
1531 		   const __le16 *mac_override, const __le16 *phy_sku,
1532 		   u8 tx_chains, u8 rx_chains)
1533 {
1534 	struct iwl_nvm_data *data;
1535 	bool lar_enabled;
1536 	u32 sku, radio_cfg;
1537 	u32 sbands_flags = 0;
1538 	u16 lar_config;
1539 	const __le16 *ch_section;
1540 
1541 	if (cfg->uhb_supported)
1542 		data = kzalloc(struct_size(data, channels,
1543 					   IWL_NVM_NUM_CHANNELS_UHB),
1544 					   GFP_KERNEL);
1545 	else if (cfg->nvm_type != IWL_NVM_EXT)
1546 		data = kzalloc(struct_size(data, channels,
1547 					   IWL_NVM_NUM_CHANNELS),
1548 					   GFP_KERNEL);
1549 	else
1550 		data = kzalloc(struct_size(data, channels,
1551 					   IWL_NVM_NUM_CHANNELS_EXT),
1552 					   GFP_KERNEL);
1553 	if (!data)
1554 		return NULL;
1555 
1556 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1557 
1558 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1559 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1560 	if (data->valid_tx_ant)
1561 		tx_chains &= data->valid_tx_ant;
1562 	if (data->valid_rx_ant)
1563 		rx_chains &= data->valid_rx_ant;
1564 
1565 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1566 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1567 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1568 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1569 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1570 		data->sku_cap_11n_enable = false;
1571 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1572 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1573 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1574 
1575 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1576 
1577 	if (cfg->nvm_type != IWL_NVM_EXT) {
1578 		/* Checking for required sections */
1579 		if (!nvm_calib) {
1580 			IWL_ERR(trans,
1581 				"Can't parse empty Calib NVM sections\n");
1582 			kfree(data);
1583 			return NULL;
1584 		}
1585 
1586 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1587 			     &regulatory[NVM_CHANNELS_SDP] :
1588 			     &nvm_sw[NVM_CHANNELS];
1589 
1590 		lar_enabled = true;
1591 	} else {
1592 		u16 lar_offset = data->nvm_version < 0xE39 ?
1593 				 NVM_LAR_OFFSET_OLD :
1594 				 NVM_LAR_OFFSET;
1595 
1596 		lar_config = le16_to_cpup(regulatory + lar_offset);
1597 		data->lar_enabled = !!(lar_config &
1598 				       NVM_LAR_ENABLED);
1599 		lar_enabled = data->lar_enabled;
1600 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1601 	}
1602 
1603 	/* If no valid mac address was found - bail out */
1604 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1605 		kfree(data);
1606 		return NULL;
1607 	}
1608 
1609 	if (lar_enabled &&
1610 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1611 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1612 
1613 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1614 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1615 
1616 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1617 			sbands_flags, false, fw);
1618 	data->calib_version = 255;
1619 
1620 	return data;
1621 }
1622 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1623 
1624 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1625 				       int ch_idx, u16 nvm_flags,
1626 				       struct iwl_reg_capa reg_capa,
1627 				       const struct iwl_cfg *cfg)
1628 {
1629 	u32 flags = NL80211_RRF_NO_HT40;
1630 
1631 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1632 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1633 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1634 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1635 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1636 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1637 	} else if (ch_idx < NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS &&
1638 		   nvm_flags & NVM_CHANNEL_40MHZ) {
1639 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1640 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1641 		else
1642 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1643 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1644 		flags &= ~NL80211_RRF_NO_HT40PLUS;
1645 		flags &= ~NL80211_RRF_NO_HT40MINUS;
1646 	}
1647 
1648 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1649 		flags |= NL80211_RRF_NO_80MHZ;
1650 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1651 		flags |= NL80211_RRF_NO_160MHZ;
1652 
1653 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1654 		flags |= NL80211_RRF_NO_IR;
1655 
1656 	if (nvm_flags & NVM_CHANNEL_RADAR)
1657 		flags |= NL80211_RRF_DFS;
1658 
1659 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1660 		flags |= NL80211_RRF_NO_OUTDOOR;
1661 
1662 	if (nvm_flags & NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY &&
1663 	    flags & NL80211_RRF_NO_IR)
1664 		flags |= NL80211_RRF_ALLOW_20MHZ_ACTIVITY;
1665 
1666 	/* Set the GO concurrent flag only in case that NO_IR is set.
1667 	 * Otherwise it is meaningless
1668 	 */
1669 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT)) {
1670 		if (flags & NL80211_RRF_NO_IR)
1671 			flags |= NL80211_RRF_GO_CONCURRENT;
1672 		if (flags & NL80211_RRF_DFS) {
1673 			flags |= NL80211_RRF_DFS_CONCURRENT;
1674 			/* Our device doesn't set active bit for DFS channels
1675 			 * however, once marked as DFS no-ir is not needed.
1676 			 */
1677 			flags &= ~NL80211_RRF_NO_IR;
1678 		}
1679 	}
1680 
1681 	/* Set the AP type for the UHB case. */
1682 	if (nvm_flags & NVM_CHANNEL_VLP)
1683 		flags |= NL80211_RRF_ALLOW_6GHZ_VLP_AP;
1684 	else
1685 		flags |= NL80211_RRF_NO_6GHZ_VLP_CLIENT;
1686 
1687 	if (!(nvm_flags & NVM_CHANNEL_AFC))
1688 		flags |= NL80211_RRF_NO_6GHZ_AFC_CLIENT;
1689 
1690 	/*
1691 	 * reg_capa is per regulatory domain so apply it for every channel
1692 	 */
1693 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1694 		if (!reg_capa.allow_40mhz)
1695 			flags |= NL80211_RRF_NO_HT40;
1696 
1697 		if (!reg_capa.allow_80mhz)
1698 			flags |= NL80211_RRF_NO_80MHZ;
1699 
1700 		if (!reg_capa.allow_160mhz)
1701 			flags |= NL80211_RRF_NO_160MHZ;
1702 
1703 		if (!reg_capa.allow_320mhz)
1704 			flags |= NL80211_RRF_NO_320MHZ;
1705 	}
1706 
1707 	if (reg_capa.disable_11ax)
1708 		flags |= NL80211_RRF_NO_HE;
1709 
1710 	if (reg_capa.disable_11be)
1711 		flags |= NL80211_RRF_NO_EHT;
1712 
1713 	return flags;
1714 }
1715 
1716 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1717 {
1718 	struct iwl_reg_capa reg_capa = {};
1719 
1720 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1721 		reg_capa.allow_40mhz = true;
1722 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1723 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1724 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1725 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1726 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1727 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1728 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1729 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1730 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1731 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1732 	} else {
1733 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1734 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1735 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1736 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1737 	}
1738 	return reg_capa;
1739 }
1740 
1741 struct ieee80211_regdomain *
1742 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
1743 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1744 		       u16 geo_info, u32 cap, u8 resp_ver)
1745 {
1746 	int ch_idx;
1747 	u16 ch_flags;
1748 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1749 	const u16 *nvm_chan;
1750 	struct ieee80211_regdomain *regd, *copy_rd;
1751 	struct ieee80211_reg_rule *rule;
1752 	int center_freq, prev_center_freq = 0;
1753 	int valid_rules = 0;
1754 	bool new_rule;
1755 	int max_num_ch;
1756 	struct iwl_reg_capa reg_capa;
1757 
1758 	if (cfg->uhb_supported) {
1759 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1760 		nvm_chan = iwl_uhb_nvm_channels;
1761 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1762 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1763 		nvm_chan = iwl_ext_nvm_channels;
1764 	} else {
1765 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1766 		nvm_chan = iwl_nvm_channels;
1767 	}
1768 
1769 	if (num_of_ch > max_num_ch) {
1770 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1771 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1772 			      num_of_ch, max_num_ch);
1773 		num_of_ch = max_num_ch;
1774 	}
1775 
1776 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1777 		return ERR_PTR(-EINVAL);
1778 
1779 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1780 		      num_of_ch);
1781 
1782 	/* build a regdomain rule for every valid channel */
1783 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1784 	if (!regd)
1785 		return ERR_PTR(-ENOMEM);
1786 
1787 	/* set alpha2 from FW. */
1788 	regd->alpha2[0] = fw_mcc >> 8;
1789 	regd->alpha2[1] = fw_mcc & 0xff;
1790 
1791 	/* parse regulatory capability flags */
1792 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1793 
1794 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1795 		enum nl80211_band band =
1796 			iwl_nl80211_band_from_channel_idx(ch_idx);
1797 
1798 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1799 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1800 							     band);
1801 		new_rule = false;
1802 
1803 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1804 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1805 						    nvm_chan[ch_idx], ch_flags);
1806 			continue;
1807 		}
1808 
1809 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1810 							     ch_flags, reg_capa,
1811 							     cfg);
1812 
1813 		/* we can't continue the same rule */
1814 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1815 		    center_freq - prev_center_freq > 20) {
1816 			valid_rules++;
1817 			new_rule = true;
1818 		}
1819 
1820 		rule = &regd->reg_rules[valid_rules - 1];
1821 
1822 		if (new_rule)
1823 			rule->freq_range.start_freq_khz =
1824 						MHZ_TO_KHZ(center_freq - 10);
1825 
1826 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1827 
1828 		/* this doesn't matter - not used by FW */
1829 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1830 		rule->power_rule.max_eirp =
1831 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1832 
1833 		rule->flags = reg_rule_flags;
1834 
1835 		/* rely on auto-calculation to merge BW of contiguous chans */
1836 		rule->flags |= NL80211_RRF_AUTO_BW;
1837 		rule->freq_range.max_bandwidth_khz = 0;
1838 
1839 		prev_center_freq = center_freq;
1840 		prev_reg_rule_flags = reg_rule_flags;
1841 
1842 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1843 					    nvm_chan[ch_idx], ch_flags);
1844 
1845 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1846 		    band == NL80211_BAND_2GHZ)
1847 			continue;
1848 
1849 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1850 	}
1851 
1852 	/*
1853 	 * Certain firmware versions might report no valid channels
1854 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1855 	 * running. We'll get out of this situation later when the
1856 	 * rfkill is removed and we update the regdomain again, but
1857 	 * since cfg80211 doesn't accept an empty regdomain, add a
1858 	 * dummy (unusable) rule here in this case so we can init.
1859 	 */
1860 	if (!valid_rules) {
1861 		valid_rules = 1;
1862 		rule = &regd->reg_rules[valid_rules - 1];
1863 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1864 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1865 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1866 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1867 		rule->power_rule.max_eirp =
1868 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1869 	}
1870 
1871 	regd->n_reg_rules = valid_rules;
1872 
1873 	/*
1874 	 * Narrow down regdom for unused regulatory rules to prevent hole
1875 	 * between reg rules to wmm rules.
1876 	 */
1877 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1878 			  GFP_KERNEL);
1879 	if (!copy_rd)
1880 		copy_rd = ERR_PTR(-ENOMEM);
1881 
1882 	kfree(regd);
1883 	return copy_rd;
1884 }
1885 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1886 
1887 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1888 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1889 #define MAX_NVM_FILE_LEN	16384
1890 
1891 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1892 		    unsigned int len)
1893 {
1894 #define IWL_4165_DEVICE_ID	0x5501
1895 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1896 
1897 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1898 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1899 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1900 		/* OTP 0x52 bug work around: it's a 1x1 device */
1901 		data[3] = ANT_B | (ANT_B << 4);
1902 }
1903 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1904 
1905 /*
1906  * Reads external NVM from a file into mvm->nvm_sections
1907  *
1908  * HOW TO CREATE THE NVM FILE FORMAT:
1909  * ------------------------------
1910  * 1. create hex file, format:
1911  *      3800 -> header
1912  *      0000 -> header
1913  *      5a40 -> data
1914  *
1915  *   rev - 6 bit (word1)
1916  *   len - 10 bit (word1)
1917  *   id - 4 bit (word2)
1918  *   rsv - 12 bit (word2)
1919  *
1920  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1921  *
1922  * 3. create binary file from the hex file
1923  *
1924  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1925  */
1926 int iwl_read_external_nvm(struct iwl_trans *trans,
1927 			  const char *nvm_file_name,
1928 			  struct iwl_nvm_section *nvm_sections)
1929 {
1930 	int ret, section_size;
1931 	u16 section_id;
1932 	const struct firmware *fw_entry;
1933 	const struct {
1934 		__le16 word1;
1935 		__le16 word2;
1936 		u8 data[];
1937 	} *file_sec;
1938 	const u8 *eof;
1939 	u8 *temp;
1940 	int max_section_size;
1941 	const __le32 *dword_buff;
1942 
1943 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1944 #define NVM_WORD2_ID(x) (x >> 12)
1945 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1946 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1947 #define NVM_HEADER_0	(0x2A504C54)
1948 #define NVM_HEADER_1	(0x4E564D2A)
1949 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1950 
1951 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1952 
1953 	/* Maximal size depends on NVM version */
1954 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1955 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1956 	else
1957 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1958 
1959 	/*
1960 	 * Obtain NVM image via request_firmware. Since we already used
1961 	 * request_firmware_nowait() for the firmware binary load and only
1962 	 * get here after that we assume the NVM request can be satisfied
1963 	 * synchronously.
1964 	 */
1965 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1966 	if (ret) {
1967 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1968 			nvm_file_name, ret);
1969 		return ret;
1970 	}
1971 
1972 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1973 		 nvm_file_name, fw_entry->size);
1974 
1975 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1976 		IWL_ERR(trans, "NVM file too large\n");
1977 		ret = -EINVAL;
1978 		goto out;
1979 	}
1980 
1981 	eof = fw_entry->data + fw_entry->size;
1982 	dword_buff = (const __le32 *)fw_entry->data;
1983 
1984 	/* some NVM file will contain a header.
1985 	 * The header is identified by 2 dwords header as follow:
1986 	 * dword[0] = 0x2A504C54
1987 	 * dword[1] = 0x4E564D2A
1988 	 *
1989 	 * This header must be skipped when providing the NVM data to the FW.
1990 	 */
1991 	if (fw_entry->size > NVM_HEADER_SIZE &&
1992 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1993 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1994 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1995 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1996 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1997 			 le32_to_cpu(dword_buff[3]));
1998 
1999 		/* nvm file validation, dword_buff[2] holds the file version */
2000 		if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
2001 		    trans->hw_rev_step == SILICON_C_STEP &&
2002 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
2003 			ret = -EFAULT;
2004 			goto out;
2005 		}
2006 	} else {
2007 		file_sec = (const void *)fw_entry->data;
2008 	}
2009 
2010 	while (true) {
2011 		if (file_sec->data > eof) {
2012 			IWL_ERR(trans,
2013 				"ERROR - NVM file too short for section header\n");
2014 			ret = -EINVAL;
2015 			break;
2016 		}
2017 
2018 		/* check for EOF marker */
2019 		if (!file_sec->word1 && !file_sec->word2) {
2020 			ret = 0;
2021 			break;
2022 		}
2023 
2024 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
2025 			section_size =
2026 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
2027 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
2028 		} else {
2029 			section_size = 2 * EXT_NVM_WORD2_LEN(
2030 						le16_to_cpu(file_sec->word2));
2031 			section_id = EXT_NVM_WORD1_ID(
2032 						le16_to_cpu(file_sec->word1));
2033 		}
2034 
2035 		if (section_size > max_section_size) {
2036 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
2037 				section_size);
2038 			ret = -EINVAL;
2039 			break;
2040 		}
2041 
2042 		if (!section_size) {
2043 			IWL_ERR(trans, "ERROR - section empty\n");
2044 			ret = -EINVAL;
2045 			break;
2046 		}
2047 
2048 		if (file_sec->data + section_size > eof) {
2049 			IWL_ERR(trans,
2050 				"ERROR - NVM file too short for section (%d bytes)\n",
2051 				section_size);
2052 			ret = -EINVAL;
2053 			break;
2054 		}
2055 
2056 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
2057 			 "Invalid NVM section ID %d\n", section_id)) {
2058 			ret = -EINVAL;
2059 			break;
2060 		}
2061 
2062 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
2063 		if (!temp) {
2064 			ret = -ENOMEM;
2065 			break;
2066 		}
2067 
2068 		iwl_nvm_fixups(trans->hw_id, section_id, temp, section_size);
2069 
2070 		kfree(nvm_sections[section_id].data);
2071 		nvm_sections[section_id].data = temp;
2072 		nvm_sections[section_id].length = section_size;
2073 
2074 		/* advance to the next section */
2075 		file_sec = (const void *)(file_sec->data + section_size);
2076 	}
2077 out:
2078 	release_firmware(fw_entry);
2079 	return ret;
2080 }
2081 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
2082 
2083 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
2084 				 const struct iwl_fw *fw,
2085 				 u8 set_tx_ant, u8 set_rx_ant)
2086 {
2087 	struct iwl_nvm_get_info cmd = {};
2088 	struct iwl_nvm_data *nvm;
2089 	struct iwl_host_cmd hcmd = {
2090 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
2091 		.data = { &cmd, },
2092 		.len = { sizeof(cmd) },
2093 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
2094 	};
2095 	int  ret;
2096 	bool empty_otp;
2097 	u32 mac_flags;
2098 	u32 sbands_flags = 0;
2099 	u8 tx_ant;
2100 	u8 rx_ant;
2101 
2102 	/*
2103 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
2104 	 * in v3, except for the channel profile part of the
2105 	 * regulatory.  So we can just access the new struct, with the
2106 	 * exception of the latter.
2107 	 */
2108 	struct iwl_nvm_get_info_rsp *rsp;
2109 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
2110 	bool v4 = fw_has_api(&fw->ucode_capa,
2111 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
2112 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
2113 	void *channel_profile;
2114 
2115 	ret = iwl_trans_send_cmd(trans, &hcmd);
2116 	if (ret)
2117 		return ERR_PTR(ret);
2118 
2119 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
2120 		 "Invalid payload len in NVM response from FW %d",
2121 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
2122 		ret = -EINVAL;
2123 		goto out;
2124 	}
2125 
2126 	rsp = (void *)hcmd.resp_pkt->data;
2127 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
2128 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
2129 	if (empty_otp)
2130 		IWL_INFO(trans, "OTP is empty\n");
2131 
2132 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
2133 	if (!nvm) {
2134 		ret = -ENOMEM;
2135 		goto out;
2136 	}
2137 
2138 	iwl_set_hw_address_from_csr(trans, nvm);
2139 	/* TODO: if platform NVM has MAC address - override it here */
2140 
2141 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2142 		IWL_ERR(trans, "no valid mac address was found\n");
2143 		ret = -EINVAL;
2144 		goto err_free;
2145 	}
2146 
2147 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2148 
2149 	/* Initialize general data */
2150 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2151 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2152 	if (nvm->n_hw_addrs == 0)
2153 		IWL_WARN(trans,
2154 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2155 			 empty_otp);
2156 
2157 	/* Initialize MAC sku data */
2158 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2159 	nvm->sku_cap_11ac_enable =
2160 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2161 	nvm->sku_cap_11n_enable =
2162 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2163 	nvm->sku_cap_11ax_enable =
2164 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2165 	nvm->sku_cap_band_24ghz_enable =
2166 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2167 	nvm->sku_cap_band_52ghz_enable =
2168 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2169 	nvm->sku_cap_mimo_disabled =
2170 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2171 	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
2172 		nvm->sku_cap_11be_enable = true;
2173 
2174 	/* Initialize PHY sku data */
2175 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2176 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2177 
2178 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2179 	    fw_has_capa(&fw->ucode_capa,
2180 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2181 		nvm->lar_enabled = true;
2182 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2183 	}
2184 
2185 	rsp_v3 = (void *)rsp;
2186 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2187 			  (void *)rsp_v3->regulatory.channel_profile;
2188 
2189 	tx_ant = nvm->valid_tx_ant & fw->valid_tx_ant;
2190 	rx_ant = nvm->valid_rx_ant & fw->valid_rx_ant;
2191 
2192 	if (set_tx_ant)
2193 		tx_ant &= set_tx_ant;
2194 	if (set_rx_ant)
2195 		rx_ant &= set_rx_ant;
2196 
2197 	iwl_init_sbands(trans, nvm, channel_profile, tx_ant, rx_ant,
2198 			sbands_flags, v4, fw);
2199 
2200 	iwl_free_resp(&hcmd);
2201 	return nvm;
2202 
2203 err_free:
2204 	kfree(nvm);
2205 out:
2206 	iwl_free_resp(&hcmd);
2207 	return ERR_PTR(ret);
2208 }
2209 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2210