xref: /linux/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c (revision c3e91403103974e8f40dc170f384c0b707fe93e4)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023, 2025 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM REGULATORY -Section offset (in words) definitions */
42 	NVM_CHANNELS_SDP = 0,
43 };
44 
45 enum ext_nvm_offsets {
46 	/* NVM HW-Section offset (in words) definitions */
47 
48 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
49 
50 	/* NVM SW-Section offset (in words) definitions */
51 	NVM_VERSION_EXT_NVM = 0,
52 	N_HW_ADDRS_FAMILY_8000 = 3,
53 
54 	/* NVM PHY_SKU-Section offset (in words) definitions */
55 	RADIO_CFG_FAMILY_EXT_NVM = 0,
56 	SKU_FAMILY_8000 = 2,
57 
58 	/* NVM REGULATORY -Section offset (in words) definitions */
59 	NVM_CHANNELS_EXTENDED = 0,
60 	NVM_LAR_OFFSET_OLD = 0x4C7,
61 	NVM_LAR_OFFSET = 0x507,
62 	NVM_LAR_ENABLED = 0x7,
63 };
64 
65 /* SKU Capabilities (actual values from NVM definition) */
66 enum nvm_sku_bits {
67 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
68 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
69 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
70 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
71 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
72 };
73 
74 /*
75  * These are the channel numbers in the order that they are stored in the NVM
76  */
77 static const u16 iwl_nvm_channels[] = {
78 	/* 2.4 GHz */
79 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
80 	/* 5 GHz */
81 	36, 40, 44, 48, 52, 56, 60, 64,
82 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
83 	149, 153, 157, 161, 165
84 };
85 
86 static const u16 iwl_ext_nvm_channels[] = {
87 	/* 2.4 GHz */
88 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
89 	/* 5 GHz */
90 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
91 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
92 	149, 153, 157, 161, 165, 169, 173, 177, 181
93 };
94 
95 static const u16 iwl_uhb_nvm_channels[] = {
96 	/* 2.4 GHz */
97 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
98 	/* 5 GHz */
99 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
100 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
101 	149, 153, 157, 161, 165, 169, 173, 177, 181,
102 	/* 6-7 GHz */
103 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
104 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
105 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
106 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
107 };
108 
109 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
110 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
111 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
112 #define NUM_2GHZ_CHANNELS		14
113 #define NUM_5GHZ_CHANNELS		37
114 #define FIRST_2GHZ_HT_MINUS		5
115 #define LAST_2GHZ_HT_PLUS		9
116 #define N_HW_ADDR_MASK			0xF
117 
118 /* rate data (static) */
119 static struct ieee80211_rate iwl_cfg80211_rates[] = {
120 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
121 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
122 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
123 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
124 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
125 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
126 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
127 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
128 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
129 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
130 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
131 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
132 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
133 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
134 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
135 };
136 #define RATES_24_OFFS	0
137 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
138 #define RATES_52_OFFS	4
139 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
140 
141 /**
142  * enum iwl_nvm_channel_flags - channel flags in NVM
143  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
144  * @NVM_CHANNEL_IBSS: usable as an IBSS channel and deprecated
145  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
146  * @NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY: active scanning allowed and
147  *	AP allowed only in 20 MHz. Valid only
148  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
149  * @NVM_CHANNEL_ACTIVE: active scanning allowed and allows IBSS
150  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
151  * @NVM_CHANNEL_RADAR: radar detection required
152  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
153  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
154  *	on same channel on 2.4 or same UNII band on 5.2
155  * @NVM_CHANNEL_UNIFORM: uniform spreading required
156  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
157  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
158  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
159  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
160  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
161  * @NVM_CHANNEL_VLP: client support connection to UHB VLP AP
162  * @NVM_CHANNEL_AFC: client support connection to UHB AFC AP
163  * @NVM_CHANNEL_VLP_AP_NOT_ALLOWED: UHB VLP AP not allowed,
164  *	Valid only when %NVM_CHANNEL_VLP is enabled.
165  */
166 enum iwl_nvm_channel_flags {
167 	NVM_CHANNEL_VALID			= BIT(0),
168 	NVM_CHANNEL_IBSS			= BIT(1),
169 	NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY	= BIT(2),
170 	NVM_CHANNEL_ACTIVE			= BIT(3),
171 	NVM_CHANNEL_RADAR			= BIT(4),
172 	NVM_CHANNEL_INDOOR_ONLY			= BIT(5),
173 	NVM_CHANNEL_GO_CONCURRENT		= BIT(6),
174 	NVM_CHANNEL_UNIFORM			= BIT(7),
175 	NVM_CHANNEL_20MHZ			= BIT(8),
176 	NVM_CHANNEL_40MHZ			= BIT(9),
177 	NVM_CHANNEL_80MHZ			= BIT(10),
178 	NVM_CHANNEL_160MHZ			= BIT(11),
179 	NVM_CHANNEL_DC_HIGH			= BIT(12),
180 	NVM_CHANNEL_VLP				= BIT(13),
181 	NVM_CHANNEL_AFC				= BIT(14),
182 	NVM_CHANNEL_VLP_AP_NOT_ALLOWED		= BIT(15),
183 };
184 
185 /**
186  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
187  * domain.
188  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
189  *	2.4Ghz band is allowed.
190  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
191  *	5Ghz band is allowed.
192  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
193  *	for this regulatory domain (valid only in 5Ghz).
194  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
195  *	for this regulatory domain (valid only in 5Ghz).
196  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
197  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
198  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
199  *	for this regulatory domain (valid only in 5Ghz).
200  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
201  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
202  */
203 enum iwl_reg_capa_flags_v1 {
204 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
205 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
206 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
207 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
208 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
209 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
210 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
211 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
212 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
213 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
214 
215 /**
216  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
217  * domain (version 2).
218  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
219  *	disabled.
220  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
221  *	2.4Ghz band is allowed.
222  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
223  *	5Ghz band is allowed.
224  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
225  *	for this regulatory domain (valid only in 5Ghz).
226  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
227  *	for this regulatory domain (valid only in 5Ghz).
228  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
229  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
230  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
231  *	126, 122) are disabled.
232  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
233  *	for this regulatory domain (uvalid only in 5Ghz).
234  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
235  */
236 enum iwl_reg_capa_flags_v2 {
237 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
238 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
239 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
240 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
241 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
242 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
243 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
244 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
245 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
246 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
247 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
248 
249 /**
250  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
251  * domain.
252  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
253  *	for this regulatory domain (valid only in 5Ghz).
254  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
255  *	for this regulatory domain (valid only in 5Ghz).
256  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
257  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
258  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
259  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
260  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
261  *	for this regulatory domain (valid only in 5GHz).
262  */
263 enum iwl_reg_capa_flags_v4 {
264 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
265 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
266 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
267 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
268 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
269 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
270 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
271 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
272 
273 /*
274 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
275 * MCC update command response.
276 */
277 #define REG_CAPA_V2_RESP_VER	6
278 
279 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
280  * MCC update command response.
281  */
282 #define REG_CAPA_V4_RESP_VER	8
283 
284 /**
285  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
286  * handling the different APIs of reg_capa_flags.
287  *
288  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
289  *	for this regulatory domain.
290  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
291  *	for this regulatory domain (valid only in 5 and 6 Ghz).
292  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
293  *	for this regulatory domain (valid only in 5 and 6 Ghz).
294  * @allow_320mhz: 11be channel with a width of 320Mhz is allowed
295  *	for this regulatory domain (valid only in 6 Ghz).
296  * @disable_11ax: 11ax is forbidden for this regulatory domain.
297  * @disable_11be: 11be is forbidden for this regulatory domain.
298  */
299 struct iwl_reg_capa {
300 	bool allow_40mhz;
301 	bool allow_80mhz;
302 	bool allow_160mhz;
303 	bool allow_320mhz;
304 	bool disable_11ax;
305 	bool disable_11be;
306 };
307 
308 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
309 					       int chan, u32 flags)
310 {
311 #define CHECK_AND_PRINT_I(x)	\
312 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
313 
314 	if (!(flags & NVM_CHANNEL_VALID)) {
315 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
316 			      chan, flags);
317 		return;
318 	}
319 
320 	/* Note: already can print up to 101 characters, 110 is the limit! */
321 	IWL_DEBUG_DEV(dev, level,
322 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
323 		      chan, flags,
324 		      CHECK_AND_PRINT_I(VALID),
325 		      CHECK_AND_PRINT_I(IBSS),
326 		      CHECK_AND_PRINT_I(ACTIVE),
327 		      CHECK_AND_PRINT_I(RADAR),
328 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
329 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
330 		      CHECK_AND_PRINT_I(UNIFORM),
331 		      CHECK_AND_PRINT_I(20MHZ),
332 		      CHECK_AND_PRINT_I(40MHZ),
333 		      CHECK_AND_PRINT_I(80MHZ),
334 		      CHECK_AND_PRINT_I(160MHZ),
335 		      CHECK_AND_PRINT_I(DC_HIGH),
336 		      CHECK_AND_PRINT_I(VLP),
337 		      CHECK_AND_PRINT_I(AFC));
338 #undef CHECK_AND_PRINT_I
339 }
340 
341 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
342 				 u32 nvm_flags, const struct iwl_rf_cfg *cfg)
343 {
344 	u32 flags = IEEE80211_CHAN_NO_HT40;
345 
346 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
347 		if (ch_num <= LAST_2GHZ_HT_PLUS)
348 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
349 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
350 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
351 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
352 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
353 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
354 		else
355 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
356 	}
357 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
358 		flags |= IEEE80211_CHAN_NO_80MHZ;
359 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
360 		flags |= IEEE80211_CHAN_NO_160MHZ;
361 
362 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
363 		flags |= IEEE80211_CHAN_NO_IR;
364 
365 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
366 		flags |= IEEE80211_CHAN_NO_IR;
367 
368 	if (nvm_flags & NVM_CHANNEL_RADAR)
369 		flags |= IEEE80211_CHAN_RADAR;
370 
371 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
372 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
373 
374 	/* Set the GO concurrent flag only in case that NO_IR is set.
375 	 * Otherwise it is meaningless
376 	 */
377 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
378 	    (flags & IEEE80211_CHAN_NO_IR))
379 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
380 
381 	/* Set the AP type for the UHB case. */
382 	if (nvm_flags & NVM_CHANNEL_VLP)
383 		flags |= IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP;
384 	else
385 		flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
386 	if (!(nvm_flags & NVM_CHANNEL_AFC))
387 		flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
388 
389 	return flags;
390 }
391 
392 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
393 {
394 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
395 		return NL80211_BAND_6GHZ;
396 	}
397 
398 	if (ch_idx >= NUM_2GHZ_CHANNELS)
399 		return NL80211_BAND_5GHZ;
400 	return NL80211_BAND_2GHZ;
401 }
402 
403 static int iwl_init_channel_map(struct iwl_trans *trans,
404 				const struct iwl_fw *fw,
405 				struct iwl_nvm_data *data,
406 				const void * const nvm_ch_flags,
407 				u32 sbands_flags, bool v4)
408 {
409 	const struct iwl_rf_cfg *cfg = trans->cfg;
410 	struct device *dev = trans->dev;
411 	int ch_idx;
412 	int n_channels = 0;
413 	struct ieee80211_channel *channel;
414 	u32 ch_flags;
415 	int num_of_ch;
416 	const u16 *nvm_chan;
417 
418 	if (cfg->uhb_supported) {
419 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
420 		nvm_chan = iwl_uhb_nvm_channels;
421 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
422 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
423 		nvm_chan = iwl_ext_nvm_channels;
424 	} else {
425 		num_of_ch = IWL_NVM_NUM_CHANNELS;
426 		nvm_chan = iwl_nvm_channels;
427 	}
428 
429 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
430 		enum nl80211_band band =
431 			iwl_nl80211_band_from_channel_idx(ch_idx);
432 
433 		if (v4)
434 			ch_flags =
435 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
436 		else
437 			ch_flags =
438 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
439 
440 		if (band == NL80211_BAND_5GHZ &&
441 		    !data->sku_cap_band_52ghz_enable)
442 			continue;
443 
444 		/* workaround to disable wide channels in 5GHz */
445 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
446 		    band == NL80211_BAND_5GHZ) {
447 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
448 				     NVM_CHANNEL_80MHZ |
449 				     NVM_CHANNEL_160MHZ);
450 		}
451 
452 		if (ch_flags & NVM_CHANNEL_160MHZ)
453 			data->vht160_supported = true;
454 
455 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
456 		    !(ch_flags & NVM_CHANNEL_VALID)) {
457 			/*
458 			 * Channels might become valid later if lar is
459 			 * supported, hence we still want to add them to
460 			 * the list of supported channels to cfg80211.
461 			 */
462 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
463 						    nvm_chan[ch_idx], ch_flags);
464 			continue;
465 		}
466 
467 		channel = &data->channels[n_channels];
468 		n_channels++;
469 
470 		channel->hw_value = nvm_chan[ch_idx];
471 		channel->band = band;
472 		channel->center_freq =
473 			ieee80211_channel_to_frequency(
474 				channel->hw_value, channel->band);
475 
476 		/* Initialize regulatory-based run-time data */
477 
478 		/*
479 		 * Default value - highest tx power value.  max_power
480 		 * is not used in mvm, and is used for backwards compatibility
481 		 */
482 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
483 
484 		/* don't put limitations in case we're using LAR */
485 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
486 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
487 							       ch_idx, band,
488 							       ch_flags, cfg);
489 		else
490 			channel->flags = 0;
491 
492 		if (fw_has_capa(&fw->ucode_capa,
493 				IWL_UCODE_TLV_CAPA_MONITOR_PASSIVE_CHANS))
494 			channel->flags |= IEEE80211_CHAN_CAN_MONITOR;
495 
496 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
497 					    channel->hw_value, ch_flags);
498 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
499 				 channel->hw_value, channel->max_power);
500 	}
501 
502 	return n_channels;
503 }
504 
505 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
506 				  struct iwl_nvm_data *data,
507 				  struct ieee80211_sta_vht_cap *vht_cap,
508 				  u8 tx_chains, u8 rx_chains)
509 {
510 	const struct iwl_rf_cfg *cfg = trans->cfg;
511 	int num_rx_ants = num_of_ant(rx_chains);
512 	int num_tx_ants = num_of_ant(tx_chains);
513 
514 	vht_cap->vht_supported = true;
515 
516 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
517 		       IEEE80211_VHT_CAP_RXSTBC_1 |
518 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
519 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
520 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
521 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
522 
523 	if (!trans->cfg->ht_params.stbc)
524 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
525 
526 	if (data->vht160_supported)
527 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
528 				IEEE80211_VHT_CAP_SHORT_GI_160;
529 
530 	if (cfg->vht_mu_mimo_supported)
531 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
532 
533 	if (cfg->ht_params.ldpc)
534 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
535 
536 	if (data->sku_cap_mimo_disabled) {
537 		num_rx_ants = 1;
538 		num_tx_ants = 1;
539 	}
540 
541 	if (trans->cfg->ht_params.stbc && num_tx_ants > 1)
542 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
543 	else
544 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
545 
546 	switch (iwlwifi_mod_params.amsdu_size) {
547 	case IWL_AMSDU_DEF:
548 		if (trans->mac_cfg->mq_rx_supported)
549 			vht_cap->cap |=
550 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
551 		else
552 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
553 		break;
554 	case IWL_AMSDU_2K:
555 		if (trans->mac_cfg->mq_rx_supported)
556 			vht_cap->cap |=
557 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
558 		else
559 			WARN(1, "RB size of 2K is not supported by this device\n");
560 		break;
561 	case IWL_AMSDU_4K:
562 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
563 		break;
564 	case IWL_AMSDU_8K:
565 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
566 		break;
567 	case IWL_AMSDU_12K:
568 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
569 		break;
570 	default:
571 		break;
572 	}
573 
574 	vht_cap->vht_mcs.rx_mcs_map =
575 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
576 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
577 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
578 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
579 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
580 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
581 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
582 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
583 
584 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
585 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
586 		/* this works because NOT_SUPPORTED == 3 */
587 		vht_cap->vht_mcs.rx_mcs_map |=
588 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
589 	}
590 
591 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
592 
593 	vht_cap->vht_mcs.tx_highest |=
594 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
595 }
596 
597 static const u8 iwl_vendor_caps[] = {
598 	0xdd,			/* vendor element */
599 	0x06,			/* length */
600 	0x00, 0x17, 0x35,	/* Intel OUI */
601 	0x08,			/* type (Intel Capabilities) */
602 	/* followed by 16 bits of capabilities */
603 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
604 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
605 	0x00
606 };
607 
608 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
609 	{
610 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
611 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
612 		.he_cap = {
613 			.has_he = true,
614 			.he_cap_elem = {
615 				.mac_cap_info[0] =
616 					IEEE80211_HE_MAC_CAP0_HTC_HE,
617 				.mac_cap_info[1] =
618 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
619 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
620 				.mac_cap_info[2] =
621 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
622 				.mac_cap_info[3] =
623 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
624 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
625 				.mac_cap_info[4] =
626 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
627 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
628 				.mac_cap_info[5] =
629 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
630 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
631 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
632 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
633 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
634 				.phy_cap_info[1] =
635 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
636 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
637 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
638 				.phy_cap_info[2] =
639 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
640 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
641 				.phy_cap_info[3] =
642 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
643 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
644 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
645 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
646 				.phy_cap_info[4] =
647 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
648 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
649 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
650 				.phy_cap_info[6] =
651 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
652 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
653 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
654 				.phy_cap_info[7] =
655 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
656 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
657 				.phy_cap_info[8] =
658 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
659 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
660 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
661 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
662 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
663 				.phy_cap_info[9] =
664 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
665 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
666 					IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
667 					IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU |
668 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
669 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
670 				.phy_cap_info[10] =
671 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
672 			},
673 			/*
674 			 * Set default Tx/Rx HE MCS NSS Support field.
675 			 * Indicate support for up to 2 spatial streams and all
676 			 * MCS, without any special cases
677 			 */
678 			.he_mcs_nss_supp = {
679 				.rx_mcs_80 = cpu_to_le16(0xfffa),
680 				.tx_mcs_80 = cpu_to_le16(0xfffa),
681 				.rx_mcs_160 = cpu_to_le16(0xfffa),
682 				.tx_mcs_160 = cpu_to_le16(0xfffa),
683 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
684 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
685 			},
686 			/*
687 			 * Set default PPE thresholds, with PPET16 set to 0,
688 			 * PPET8 set to 7
689 			 */
690 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
691 		},
692 		.eht_cap = {
693 			.has_eht = true,
694 			.eht_cap_elem = {
695 				.mac_cap_info[0] =
696 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL,
697 				.phy_cap_info[0] =
698 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
699 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
700 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
701 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
702 				.phy_cap_info[1] =
703 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
704 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
705 				.phy_cap_info[3] =
706 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK,
707 
708 				.phy_cap_info[4] =
709 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
710 				.phy_cap_info[5] =
711 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
712 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US) |
713 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
714 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
715 					IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF,
716 				.phy_cap_info[8] =
717 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
718 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
719 			},
720 
721 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
722 			 * Rx - note we don't set the only_20mhz, but due to this
723 			 * being a union, it gets set correctly anyway.
724 			 */
725 			.eht_mcs_nss_supp = {
726 				.bw._80 = {
727 					.rx_tx_mcs9_max_nss = 0x22,
728 					.rx_tx_mcs11_max_nss = 0x22,
729 					.rx_tx_mcs13_max_nss = 0x22,
730 				},
731 				.bw._160 = {
732 					.rx_tx_mcs9_max_nss = 0x22,
733 					.rx_tx_mcs11_max_nss = 0x22,
734 					.rx_tx_mcs13_max_nss = 0x22,
735 				},
736 				.bw._320 = {
737 					.rx_tx_mcs9_max_nss = 0x22,
738 					.rx_tx_mcs11_max_nss = 0x22,
739 					.rx_tx_mcs13_max_nss = 0x22,
740 				},
741 			},
742 
743 			/*
744 			 * PPE thresholds for NSS = 2, and RU index bitmap set
745 			 * to 0xc.
746 			 * Note: just for stating what we want, not present in
747 			 * the transmitted data due to not including
748 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
749 			 */
750 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
751 		},
752 	},
753 	{
754 		.types_mask = BIT(NL80211_IFTYPE_AP) |
755 			      BIT(NL80211_IFTYPE_P2P_GO),
756 		.he_cap = {
757 			.has_he = true,
758 			.he_cap_elem = {
759 				.mac_cap_info[0] =
760 					IEEE80211_HE_MAC_CAP0_HTC_HE,
761 				.mac_cap_info[1] =
762 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
763 				.mac_cap_info[3] =
764 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
765 				.phy_cap_info[1] =
766 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
767 				.phy_cap_info[2] =
768 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
769 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
770 				.phy_cap_info[3] =
771 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
772 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
773 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
774 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
775 				.phy_cap_info[6] =
776 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
777 				.phy_cap_info[7] =
778 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
779 				.phy_cap_info[8] =
780 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
781 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
782 				.phy_cap_info[9] =
783 					IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
784 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
785 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
786 			},
787 			/*
788 			 * Set default Tx/Rx HE MCS NSS Support field.
789 			 * Indicate support for up to 2 spatial streams and all
790 			 * MCS, without any special cases
791 			 */
792 			.he_mcs_nss_supp = {
793 				.rx_mcs_80 = cpu_to_le16(0xfffa),
794 				.tx_mcs_80 = cpu_to_le16(0xfffa),
795 				.rx_mcs_160 = cpu_to_le16(0xfffa),
796 				.tx_mcs_160 = cpu_to_le16(0xfffa),
797 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
798 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
799 			},
800 			/*
801 			 * Set default PPE thresholds, with PPET16 set to 0,
802 			 * PPET8 set to 7
803 			 */
804 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
805 		},
806 		.eht_cap = {
807 			.has_eht = true,
808 			.eht_cap_elem = {
809 				.mac_cap_info[0] =
810 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL,
811 				.phy_cap_info[0] =
812 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
813 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
814 				.phy_cap_info[5] =
815 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
816 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US),
817 			},
818 
819 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
820 			 * Rx - note we don't set the only_20mhz, but due to this
821 			 * being a union, it gets set correctly anyway.
822 			 */
823 			.eht_mcs_nss_supp = {
824 				.bw._80 = {
825 					.rx_tx_mcs9_max_nss = 0x22,
826 					.rx_tx_mcs11_max_nss = 0x22,
827 					.rx_tx_mcs13_max_nss = 0x22,
828 				},
829 				.bw._160 = {
830 					.rx_tx_mcs9_max_nss = 0x22,
831 					.rx_tx_mcs11_max_nss = 0x22,
832 					.rx_tx_mcs13_max_nss = 0x22,
833 				},
834 				.bw._320 = {
835 					.rx_tx_mcs9_max_nss = 0x22,
836 					.rx_tx_mcs11_max_nss = 0x22,
837 					.rx_tx_mcs13_max_nss = 0x22,
838 				},
839 			},
840 
841 			/*
842 			 * PPE thresholds for NSS = 2, and RU index bitmap set
843 			 * to 0xc.
844 			 * Note: just for stating what we want, not present in
845 			 * the transmitted data due to not including
846 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
847 			 */
848 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
849 		},
850 	},
851 };
852 
853 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
854 				  struct iwl_nvm_data *data,
855 				  struct ieee80211_supported_band *sband,
856 				  u8 tx_chains, u8 rx_chains)
857 {
858 	struct ieee80211_sta_ht_cap ht_cap;
859 	struct ieee80211_sta_vht_cap vht_cap = {};
860 	struct ieee80211_sband_iftype_data *iftype_data;
861 	u16 he_6ghz_capa = 0;
862 	u32 exp;
863 	int i;
864 
865 	if (sband->band != NL80211_BAND_6GHZ)
866 		return;
867 
868 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
869 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
870 			     tx_chains, rx_chains);
871 	WARN_ON(!ht_cap.ht_supported);
872 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
873 	WARN_ON(!vht_cap.vht_supported);
874 
875 	he_6ghz_capa |=
876 		u16_encode_bits(ht_cap.ampdu_density,
877 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
878 	exp = u32_get_bits(vht_cap.cap,
879 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
880 	he_6ghz_capa |=
881 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
882 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
883 	he_6ghz_capa |=
884 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
885 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
886 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
887 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
888 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
889 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
890 
891 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
892 
893 	/* we know it's writable - we set it before ourselves */
894 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
895 	for (i = 0; i < sband->n_iftype_data; i++)
896 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
897 }
898 
899 static void
900 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
901 			 struct iwl_nvm_data *data,
902 			 struct ieee80211_supported_band *sband,
903 			 struct ieee80211_sband_iftype_data *iftype_data,
904 			 u8 tx_chains, u8 rx_chains,
905 			 const struct iwl_fw *fw)
906 {
907 	bool is_ap = iftype_data->types_mask & (BIT(NL80211_IFTYPE_AP) |
908 						BIT(NL80211_IFTYPE_P2P_GO));
909 	bool slow_pcie = (!trans->mac_cfg->integrated &&
910 			  trans->info.pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB);
911 
912 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be)
913 		iftype_data->eht_cap.has_eht = false;
914 
915 	/* Advertise an A-MPDU exponent extension based on
916 	 * operating band
917 	 */
918 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
919 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
920 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
921 	else if (sband->band != NL80211_BAND_2GHZ)
922 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
923 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
924 	else
925 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
926 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
927 
928 	switch (sband->band) {
929 	case NL80211_BAND_2GHZ:
930 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
931 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
932 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
933 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
934 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
935 		break;
936 	case NL80211_BAND_6GHZ:
937 		if (!trans->reduced_cap_sku &&
938 		    (!trans->cfg->bw_limit || trans->cfg->bw_limit >= 320)) {
939 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
940 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
941 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
942 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
943 		}
944 		fallthrough;
945 	case NL80211_BAND_5GHZ:
946 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
947 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
948 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
949 		break;
950 	default:
951 		WARN_ON(1);
952 		break;
953 	}
954 
955 	if ((tx_chains & rx_chains) == ANT_AB) {
956 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
957 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
958 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
959 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
960 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
961 		if (!is_ap) {
962 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
963 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
964 
965 			if (iftype_data->eht_cap.has_eht) {
966 				/*
967 				 * Set the number of sounding dimensions for each
968 				 * bandwidth to 1 to indicate the maximal supported
969 				 * value of TXVECTOR parameter NUM_STS of 2
970 				 */
971 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
972 
973 				/*
974 				 * Set the MAX NC to 1 to indicate sounding feedback of
975 				 * 2 supported by the beamfomee.
976 				 */
977 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
978 			}
979 		}
980 
981 		if (slow_pcie) {
982 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
983 				&iftype_data->eht_cap.eht_mcs_nss_supp;
984 
985 			mcs_nss->bw._320.rx_tx_mcs11_max_nss = 0;
986 			mcs_nss->bw._320.rx_tx_mcs13_max_nss = 0;
987 		}
988 	} else {
989 		struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp =
990 			&iftype_data->he_cap.he_mcs_nss_supp;
991 
992 		if (iftype_data->eht_cap.has_eht) {
993 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
994 				&iftype_data->eht_cap.eht_mcs_nss_supp;
995 
996 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
997 		}
998 
999 		if (!is_ap) {
1000 			/* If not 2x2, we need to indicate 1x1 in the
1001 			 * Midamble RX Max NSTS - but not for AP mode
1002 			 */
1003 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
1004 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
1005 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1006 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
1007 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
1008 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
1009 		}
1010 
1011 		he_mcs_nss_supp->rx_mcs_80 |=
1012 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1013 		he_mcs_nss_supp->tx_mcs_80 |=
1014 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1015 		he_mcs_nss_supp->rx_mcs_160 |=
1016 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1017 		he_mcs_nss_supp->tx_mcs_160 |=
1018 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1019 		he_mcs_nss_supp->rx_mcs_80p80 |=
1020 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1021 		he_mcs_nss_supp->tx_mcs_80p80 |=
1022 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1023 	}
1024 
1025 	/* prior RFs don't have HE, HR RF doesn't have this, later have it */
1026 	if (CSR_HW_RFID_TYPE(trans->info.hw_rf_id) == IWL_CFG_RF_TYPE_HR1 ||
1027 	    CSR_HW_RFID_TYPE(trans->info.hw_rf_id) == IWL_CFG_RF_TYPE_HR2)
1028 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] &=
1029 			~(IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
1030 			  IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU);
1031 
1032 	if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
1033 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
1034 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
1035 
1036 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
1037 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
1038 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
1039 
1040 	if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1041 	    !is_ap) {
1042 		iftype_data->vendor_elems.data = iwl_vendor_caps;
1043 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
1044 	}
1045 
1046 	if (!trans->cfg->ht_params.stbc) {
1047 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1048 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
1049 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
1050 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
1051 	}
1052 
1053 	if (trans->step_urm) {
1054 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs11_max_nss = 0;
1055 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs13_max_nss = 0;
1056 	}
1057 
1058 	if (trans->cfg->bw_limit && trans->cfg->bw_limit < 160)
1059 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] &=
1060 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
1061 
1062 	if ((trans->cfg->bw_limit && trans->cfg->bw_limit < 320) ||
1063 	    trans->reduced_cap_sku) {
1064 		memset(&iftype_data->eht_cap.eht_mcs_nss_supp.bw._320, 0,
1065 		       sizeof(iftype_data->eht_cap.eht_mcs_nss_supp.bw._320));
1066 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] &=
1067 			~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
1068 	}
1069 
1070 	if (trans->reduced_cap_sku) {
1071 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._80.rx_tx_mcs13_max_nss = 0;
1072 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._160.rx_tx_mcs13_max_nss = 0;
1073 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[8] &=
1074 			~IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA;
1075 	}
1076 }
1077 
1078 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1079 				 struct iwl_nvm_data *data,
1080 				 struct ieee80211_supported_band *sband,
1081 				 u8 tx_chains, u8 rx_chains,
1082 				 const struct iwl_fw *fw)
1083 {
1084 	struct ieee80211_sband_iftype_data *iftype_data;
1085 	int i;
1086 
1087 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1088 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1089 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1090 
1091 	switch (sband->band) {
1092 	case NL80211_BAND_2GHZ:
1093 		iftype_data = data->iftd.low;
1094 		break;
1095 	case NL80211_BAND_5GHZ:
1096 		iftype_data = data->iftd.high;
1097 		break;
1098 	case NL80211_BAND_6GHZ:
1099 		iftype_data = data->iftd.uhb;
1100 		break;
1101 	default:
1102 		WARN_ON(1);
1103 		return;
1104 	}
1105 
1106 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1107 
1108 	_ieee80211_set_sband_iftype_data(sband, iftype_data,
1109 					 ARRAY_SIZE(iwl_he_eht_capa));
1110 
1111 	for (i = 0; i < sband->n_iftype_data; i++)
1112 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1113 					 tx_chains, rx_chains, fw);
1114 
1115 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1116 }
1117 
1118 void iwl_reinit_cab(struct iwl_trans *trans, struct iwl_nvm_data *data,
1119 		    u8 tx_chains, u8 rx_chains, const struct iwl_fw *fw)
1120 {
1121 	struct ieee80211_supported_band *sband;
1122 
1123 	sband = &data->bands[NL80211_BAND_2GHZ];
1124 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1125 			     tx_chains, rx_chains);
1126 
1127 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1128 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1129 				     fw);
1130 
1131 	sband = &data->bands[NL80211_BAND_5GHZ];
1132 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1133 			     tx_chains, rx_chains);
1134 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1135 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1136 				      tx_chains, rx_chains);
1137 
1138 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1139 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1140 				     fw);
1141 
1142 	sband = &data->bands[NL80211_BAND_6GHZ];
1143 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1144 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1145 				     fw);
1146 }
1147 IWL_EXPORT_SYMBOL(iwl_reinit_cab);
1148 
1149 static void iwl_init_sbands(struct iwl_trans *trans,
1150 			    struct iwl_nvm_data *data,
1151 			    const void *nvm_ch_flags, u8 tx_chains,
1152 			    u8 rx_chains, u32 sbands_flags, bool v4,
1153 			    const struct iwl_fw *fw)
1154 {
1155 	struct device *dev = trans->dev;
1156 	int n_channels;
1157 	int n_used = 0;
1158 	struct ieee80211_supported_band *sband;
1159 
1160 	n_channels = iwl_init_channel_map(trans, fw, data, nvm_ch_flags,
1161 					  sbands_flags, v4);
1162 	sband = &data->bands[NL80211_BAND_2GHZ];
1163 	sband->band = NL80211_BAND_2GHZ;
1164 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1165 	sband->n_bitrates = N_RATES_24;
1166 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1167 					  NL80211_BAND_2GHZ);
1168 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1169 			     tx_chains, rx_chains);
1170 
1171 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1172 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1173 				     fw);
1174 
1175 	sband = &data->bands[NL80211_BAND_5GHZ];
1176 	sband->band = NL80211_BAND_5GHZ;
1177 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1178 	sband->n_bitrates = N_RATES_52;
1179 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1180 					  NL80211_BAND_5GHZ);
1181 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1182 			     tx_chains, rx_chains);
1183 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1184 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1185 				      tx_chains, rx_chains);
1186 
1187 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1188 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1189 				     fw);
1190 
1191 	/* 6GHz band. */
1192 	sband = &data->bands[NL80211_BAND_6GHZ];
1193 	sband->band = NL80211_BAND_6GHZ;
1194 	/* use the same rates as 5GHz band */
1195 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1196 	sband->n_bitrates = N_RATES_52;
1197 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1198 					  NL80211_BAND_6GHZ);
1199 
1200 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1201 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1202 				     fw);
1203 	else
1204 		sband->n_channels = 0;
1205 	if (n_channels != n_used)
1206 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1207 			    n_used, n_channels);
1208 }
1209 
1210 static int iwl_get_sku(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw,
1211 		       const __le16 *phy_sku)
1212 {
1213 	if (cfg->nvm_type != IWL_NVM_EXT)
1214 		return le16_to_cpup(nvm_sw + SKU);
1215 
1216 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1217 }
1218 
1219 static int iwl_get_nvm_version(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw)
1220 {
1221 	if (cfg->nvm_type != IWL_NVM_EXT)
1222 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1223 	else
1224 		return le32_to_cpup((const __le32 *)(nvm_sw +
1225 						     NVM_VERSION_EXT_NVM));
1226 }
1227 
1228 static int iwl_get_radio_cfg(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw,
1229 			     const __le16 *phy_sku)
1230 {
1231 	if (cfg->nvm_type != IWL_NVM_EXT)
1232 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1233 
1234 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1235 
1236 }
1237 
1238 static int iwl_get_n_hw_addrs(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw)
1239 {
1240 	int n_hw_addr;
1241 
1242 	if (cfg->nvm_type != IWL_NVM_EXT)
1243 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1244 
1245 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1246 
1247 	return n_hw_addr & N_HW_ADDR_MASK;
1248 }
1249 
1250 static void iwl_set_radio_cfg(const struct iwl_rf_cfg *cfg,
1251 			      struct iwl_nvm_data *data,
1252 			      u32 radio_cfg)
1253 {
1254 	if (cfg->nvm_type != IWL_NVM_EXT) {
1255 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1256 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1257 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1258 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1259 		return;
1260 	}
1261 
1262 	/* set the radio configuration for family 8000 */
1263 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1264 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1265 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1266 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1267 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1268 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1269 }
1270 
1271 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1272 {
1273 	const u8 *hw_addr;
1274 
1275 	hw_addr = (const u8 *)&mac_addr0;
1276 	dest[0] = hw_addr[3];
1277 	dest[1] = hw_addr[2];
1278 	dest[2] = hw_addr[1];
1279 	dest[3] = hw_addr[0];
1280 
1281 	hw_addr = (const u8 *)&mac_addr1;
1282 	dest[4] = hw_addr[1];
1283 	dest[5] = hw_addr[0];
1284 }
1285 
1286 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1287 					struct iwl_nvm_data *data)
1288 {
1289 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1290 						  CSR_MAC_ADDR0_STRAP(trans)));
1291 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1292 						  CSR_MAC_ADDR1_STRAP(trans)));
1293 
1294 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1295 	/*
1296 	 * If the OEM fused a valid address, use it instead of the one in the
1297 	 * OTP
1298 	 */
1299 	if (is_valid_ether_addr(data->hw_addr))
1300 		return;
1301 
1302 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1303 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1304 
1305 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1306 }
1307 
1308 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1309 					   const struct iwl_rf_cfg *cfg,
1310 					   struct iwl_nvm_data *data,
1311 					   const __le16 *mac_override,
1312 					   const __be16 *nvm_hw)
1313 {
1314 	const u8 *hw_addr;
1315 
1316 	if (mac_override) {
1317 		static const u8 reserved_mac[] = {
1318 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1319 		};
1320 
1321 		hw_addr = (const u8 *)(mac_override +
1322 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1323 
1324 		/*
1325 		 * Store the MAC address from MAO section.
1326 		 * No byte swapping is required in MAO section
1327 		 */
1328 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1329 
1330 		/*
1331 		 * Force the use of the OTP MAC address in case of reserved MAC
1332 		 * address in the NVM, or if address is given but invalid.
1333 		 */
1334 		if (is_valid_ether_addr(data->hw_addr) &&
1335 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1336 			return;
1337 
1338 		IWL_ERR(trans,
1339 			"mac address from nvm override section is not valid\n");
1340 	}
1341 
1342 	if (nvm_hw) {
1343 		/* read the mac address from WFMP registers */
1344 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1345 						WFMP_MAC_ADDR_0));
1346 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1347 						WFMP_MAC_ADDR_1));
1348 
1349 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1350 
1351 		return;
1352 	}
1353 
1354 	IWL_ERR(trans, "mac address is not found\n");
1355 }
1356 
1357 static int iwl_set_hw_address(struct iwl_trans *trans,
1358 			      const struct iwl_rf_cfg *cfg,
1359 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1360 			      const __le16 *mac_override)
1361 {
1362 	const struct iwl_mac_cfg *mac_cfg = trans->mac_cfg;
1363 	if (mac_cfg->base->mac_addr_from_csr) {
1364 		iwl_set_hw_address_from_csr(trans, data);
1365 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1366 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1367 
1368 		/* The byte order is little endian 16 bit, meaning 214365 */
1369 		data->hw_addr[0] = hw_addr[1];
1370 		data->hw_addr[1] = hw_addr[0];
1371 		data->hw_addr[2] = hw_addr[3];
1372 		data->hw_addr[3] = hw_addr[2];
1373 		data->hw_addr[4] = hw_addr[5];
1374 		data->hw_addr[5] = hw_addr[4];
1375 	} else {
1376 		iwl_set_hw_address_family_8000(trans, cfg, data,
1377 					       mac_override, nvm_hw);
1378 	}
1379 
1380 	if (!is_valid_ether_addr(data->hw_addr)) {
1381 		IWL_ERR(trans, "no valid mac address was found\n");
1382 		return -EINVAL;
1383 	}
1384 
1385 	if (!trans->csme_own)
1386 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1387 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1388 
1389 	return 0;
1390 }
1391 
1392 static bool
1393 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1394 			const __be16 *nvm_hw)
1395 {
1396 	/*
1397 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1398 	 * some 7000-family OTPs erroneously allow wide channels in
1399 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1400 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1401 	 * 9.  In those cases, we need to force-disable wide channels
1402 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1403 	 * to use them.
1404 	 */
1405 	if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1406 		/*
1407 		 * Unlike the other sections in the NVM, the hw
1408 		 * section uses big-endian.
1409 		 */
1410 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1411 		u8 sku = (subsystem_id & 0x1e) >> 1;
1412 
1413 		if (sku == 5 || sku == 9) {
1414 			IWL_DEBUG_EEPROM(trans->dev,
1415 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1416 					 subsystem_id, sku);
1417 			return true;
1418 		}
1419 	}
1420 
1421 	return false;
1422 }
1423 
1424 struct iwl_nvm_data *
1425 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1426 		       const struct iwl_mei_nvm *mei_nvm,
1427 		       const struct iwl_fw *fw, u8 tx_ant, u8 rx_ant)
1428 {
1429 	struct iwl_nvm_data *data;
1430 	u32 sbands_flags = 0;
1431 	u8 rx_chains = fw->valid_rx_ant;
1432 	u8 tx_chains = fw->valid_rx_ant;
1433 
1434 	if (cfg->uhb_supported)
1435 		data = kzalloc(struct_size(data, channels,
1436 					   IWL_NVM_NUM_CHANNELS_UHB),
1437 					   GFP_KERNEL);
1438 	else
1439 		data = kzalloc(struct_size(data, channels,
1440 					   IWL_NVM_NUM_CHANNELS_EXT),
1441 					   GFP_KERNEL);
1442 	if (!data)
1443 		return NULL;
1444 
1445 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1446 		     IWL_NVM_NUM_CHANNELS_UHB);
1447 	data->nvm_version = mei_nvm->nvm_version;
1448 
1449 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1450 	if (data->valid_tx_ant)
1451 		tx_chains &= data->valid_tx_ant;
1452 	if (data->valid_rx_ant)
1453 		rx_chains &= data->valid_rx_ant;
1454 	if (tx_ant)
1455 		tx_chains &= tx_ant;
1456 	if (rx_ant)
1457 		rx_chains &= rx_ant;
1458 
1459 	data->sku_cap_mimo_disabled = false;
1460 	data->sku_cap_band_24ghz_enable = true;
1461 	data->sku_cap_band_52ghz_enable = true;
1462 	data->sku_cap_11n_enable =
1463 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1464 	data->sku_cap_11ac_enable = true;
1465 	data->sku_cap_11ax_enable =
1466 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1467 
1468 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1469 
1470 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1471 	/* If no valid mac address was found - bail out */
1472 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1473 		kfree(data);
1474 		return NULL;
1475 	}
1476 
1477 	if (data->lar_enabled &&
1478 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1479 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1480 
1481 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1482 			sbands_flags, true, fw);
1483 
1484 	return data;
1485 }
1486 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1487 
1488 struct iwl_nvm_data *
1489 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1490 		   const struct iwl_fw *fw,
1491 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1492 		   const __le16 *nvm_calib, const __le16 *regulatory,
1493 		   const __le16 *mac_override, const __le16 *phy_sku,
1494 		   u8 tx_chains, u8 rx_chains)
1495 {
1496 	struct iwl_nvm_data *data;
1497 	bool lar_enabled;
1498 	u32 sku, radio_cfg;
1499 	u32 sbands_flags = 0;
1500 	u16 lar_config;
1501 	const __le16 *ch_section;
1502 
1503 	if (cfg->uhb_supported)
1504 		data = kzalloc(struct_size(data, channels,
1505 					   IWL_NVM_NUM_CHANNELS_UHB),
1506 					   GFP_KERNEL);
1507 	else if (cfg->nvm_type != IWL_NVM_EXT)
1508 		data = kzalloc(struct_size(data, channels,
1509 					   IWL_NVM_NUM_CHANNELS),
1510 					   GFP_KERNEL);
1511 	else
1512 		data = kzalloc(struct_size(data, channels,
1513 					   IWL_NVM_NUM_CHANNELS_EXT),
1514 					   GFP_KERNEL);
1515 	if (!data)
1516 		return NULL;
1517 
1518 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1519 
1520 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1521 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1522 	if (data->valid_tx_ant)
1523 		tx_chains &= data->valid_tx_ant;
1524 	if (data->valid_rx_ant)
1525 		rx_chains &= data->valid_rx_ant;
1526 
1527 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1528 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1529 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1530 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1531 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1532 		data->sku_cap_11n_enable = false;
1533 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1534 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1535 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1536 
1537 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1538 
1539 	if (cfg->nvm_type != IWL_NVM_EXT) {
1540 		/* Checking for required sections */
1541 		if (!nvm_calib) {
1542 			IWL_ERR(trans,
1543 				"Can't parse empty Calib NVM sections\n");
1544 			kfree(data);
1545 			return NULL;
1546 		}
1547 
1548 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1549 			     &regulatory[NVM_CHANNELS_SDP] :
1550 			     &nvm_sw[NVM_CHANNELS];
1551 
1552 		lar_enabled = true;
1553 	} else {
1554 		u16 lar_offset = data->nvm_version < 0xE39 ?
1555 				 NVM_LAR_OFFSET_OLD :
1556 				 NVM_LAR_OFFSET;
1557 
1558 		lar_config = le16_to_cpup(regulatory + lar_offset);
1559 		data->lar_enabled = !!(lar_config &
1560 				       NVM_LAR_ENABLED);
1561 		lar_enabled = data->lar_enabled;
1562 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1563 	}
1564 
1565 	/* If no valid mac address was found - bail out */
1566 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1567 		kfree(data);
1568 		return NULL;
1569 	}
1570 
1571 	if (lar_enabled &&
1572 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1573 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1574 
1575 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1576 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1577 
1578 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1579 			sbands_flags, false, fw);
1580 	data->calib_version = 255;
1581 
1582 	return data;
1583 }
1584 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1585 
1586 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1587 				       int ch_idx, u16 nvm_flags,
1588 				       struct iwl_reg_capa reg_capa)
1589 {
1590 	u32 flags = NL80211_RRF_NO_HT40;
1591 
1592 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1593 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1594 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1595 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1596 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1597 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1598 	} else if (ch_idx < NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS &&
1599 		   nvm_flags & NVM_CHANNEL_40MHZ) {
1600 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1601 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1602 		else
1603 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1604 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1605 		flags &= ~NL80211_RRF_NO_HT40PLUS;
1606 		flags &= ~NL80211_RRF_NO_HT40MINUS;
1607 	}
1608 
1609 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1610 		flags |= NL80211_RRF_NO_80MHZ;
1611 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1612 		flags |= NL80211_RRF_NO_160MHZ;
1613 
1614 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1615 		flags |= NL80211_RRF_NO_IR;
1616 
1617 	if (nvm_flags & NVM_CHANNEL_RADAR)
1618 		flags |= NL80211_RRF_DFS;
1619 
1620 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1621 		flags |= NL80211_RRF_NO_OUTDOOR;
1622 
1623 	if (nvm_flags & NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY &&
1624 	    flags & NL80211_RRF_NO_IR)
1625 		flags |= NL80211_RRF_ALLOW_20MHZ_ACTIVITY;
1626 
1627 	/* Set the GO concurrent flag only in case that NO_IR is set.
1628 	 * Otherwise it is meaningless
1629 	 */
1630 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT)) {
1631 		if (flags & NL80211_RRF_NO_IR)
1632 			flags |= NL80211_RRF_GO_CONCURRENT;
1633 		if (flags & NL80211_RRF_DFS) {
1634 			flags |= NL80211_RRF_DFS_CONCURRENT;
1635 			/* Our device doesn't set active bit for DFS channels
1636 			 * however, once marked as DFS no-ir is not needed.
1637 			 */
1638 			flags &= ~NL80211_RRF_NO_IR;
1639 		}
1640 	}
1641 
1642 	/* Set the AP type for the UHB case. */
1643 	if (nvm_flags & NVM_CHANNEL_VLP) {
1644 		if (!(nvm_flags & NVM_CHANNEL_VLP_AP_NOT_ALLOWED))
1645 			flags |= NL80211_RRF_ALLOW_6GHZ_VLP_AP;
1646 	} else {
1647 		flags |= NL80211_RRF_NO_6GHZ_VLP_CLIENT;
1648 	}
1649 
1650 	if (!(nvm_flags & NVM_CHANNEL_AFC))
1651 		flags |= NL80211_RRF_NO_6GHZ_AFC_CLIENT;
1652 
1653 	/*
1654 	 * reg_capa is per regulatory domain so apply it for every channel
1655 	 */
1656 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1657 		if (!reg_capa.allow_40mhz)
1658 			flags |= NL80211_RRF_NO_HT40;
1659 
1660 		if (!reg_capa.allow_80mhz)
1661 			flags |= NL80211_RRF_NO_80MHZ;
1662 
1663 		if (!reg_capa.allow_160mhz)
1664 			flags |= NL80211_RRF_NO_160MHZ;
1665 
1666 		if (!reg_capa.allow_320mhz)
1667 			flags |= NL80211_RRF_NO_320MHZ;
1668 	}
1669 
1670 	if (reg_capa.disable_11ax)
1671 		flags |= NL80211_RRF_NO_HE;
1672 
1673 	if (reg_capa.disable_11be)
1674 		flags |= NL80211_RRF_NO_EHT;
1675 
1676 	return flags;
1677 }
1678 
1679 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1680 {
1681 	struct iwl_reg_capa reg_capa = {};
1682 
1683 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1684 		reg_capa.allow_40mhz = true;
1685 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1686 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1687 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1688 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1689 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1690 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1691 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1692 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1693 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1694 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1695 	} else {
1696 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1697 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1698 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1699 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1700 	}
1701 	return reg_capa;
1702 }
1703 
1704 struct ieee80211_regdomain *
1705 iwl_parse_nvm_mcc_info(struct iwl_trans *trans,
1706 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1707 		       u16 geo_info, u32 cap, u8 resp_ver)
1708 {
1709 	const struct iwl_rf_cfg *cfg = trans->cfg;
1710 	struct device *dev = trans->dev;
1711 	int ch_idx;
1712 	u16 ch_flags;
1713 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1714 	const u16 *nvm_chan;
1715 	struct ieee80211_regdomain *regd, *copy_rd;
1716 	struct ieee80211_reg_rule *rule;
1717 	int center_freq, prev_center_freq = 0;
1718 	int valid_rules = 0;
1719 	bool new_rule;
1720 	int max_num_ch;
1721 	struct iwl_reg_capa reg_capa;
1722 
1723 	if (cfg->uhb_supported) {
1724 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1725 		nvm_chan = iwl_uhb_nvm_channels;
1726 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1727 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1728 		nvm_chan = iwl_ext_nvm_channels;
1729 	} else {
1730 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1731 		nvm_chan = iwl_nvm_channels;
1732 	}
1733 
1734 	if (num_of_ch > max_num_ch) {
1735 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1736 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1737 			      num_of_ch, max_num_ch);
1738 		num_of_ch = max_num_ch;
1739 	}
1740 
1741 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1742 		return ERR_PTR(-EINVAL);
1743 
1744 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1745 		      num_of_ch);
1746 
1747 	/* build a regdomain rule for every valid channel */
1748 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1749 	if (!regd)
1750 		return ERR_PTR(-ENOMEM);
1751 
1752 	/* set alpha2 from FW. */
1753 	regd->alpha2[0] = fw_mcc >> 8;
1754 	regd->alpha2[1] = fw_mcc & 0xff;
1755 
1756 	/* parse regulatory capability flags */
1757 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1758 
1759 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1760 		enum nl80211_band band =
1761 			iwl_nl80211_band_from_channel_idx(ch_idx);
1762 
1763 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1764 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1765 							     band);
1766 		new_rule = false;
1767 
1768 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1769 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1770 						    nvm_chan[ch_idx], ch_flags);
1771 			continue;
1772 		}
1773 
1774 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1775 							     ch_flags,
1776 							     reg_capa);
1777 
1778 		/* we can't continue the same rule */
1779 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1780 		    center_freq - prev_center_freq > 20) {
1781 			valid_rules++;
1782 			new_rule = true;
1783 		}
1784 
1785 		rule = &regd->reg_rules[valid_rules - 1];
1786 
1787 		if (new_rule)
1788 			rule->freq_range.start_freq_khz =
1789 						MHZ_TO_KHZ(center_freq - 10);
1790 
1791 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1792 
1793 		/* this doesn't matter - not used by FW */
1794 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1795 		rule->power_rule.max_eirp =
1796 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1797 
1798 		rule->flags = reg_rule_flags;
1799 
1800 		/* rely on auto-calculation to merge BW of contiguous chans */
1801 		rule->flags |= NL80211_RRF_AUTO_BW;
1802 		rule->freq_range.max_bandwidth_khz = 0;
1803 
1804 		prev_center_freq = center_freq;
1805 		prev_reg_rule_flags = reg_rule_flags;
1806 
1807 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1808 					    nvm_chan[ch_idx], ch_flags);
1809 
1810 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1811 		    band == NL80211_BAND_2GHZ)
1812 			continue;
1813 
1814 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1815 	}
1816 
1817 	/*
1818 	 * Certain firmware versions might report no valid channels
1819 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1820 	 * running. We'll get out of this situation later when the
1821 	 * rfkill is removed and we update the regdomain again, but
1822 	 * since cfg80211 doesn't accept an empty regdomain, add a
1823 	 * dummy (unusable) rule here in this case so we can init.
1824 	 */
1825 	if (!valid_rules) {
1826 		valid_rules = 1;
1827 		rule = &regd->reg_rules[valid_rules - 1];
1828 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1829 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1830 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1831 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1832 		rule->power_rule.max_eirp =
1833 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1834 	}
1835 
1836 	regd->n_reg_rules = valid_rules;
1837 
1838 	/*
1839 	 * Narrow down regdom for unused regulatory rules to prevent hole
1840 	 * between reg rules to wmm rules.
1841 	 */
1842 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1843 			  GFP_KERNEL);
1844 	if (!copy_rd)
1845 		copy_rd = ERR_PTR(-ENOMEM);
1846 
1847 	kfree(regd);
1848 	return copy_rd;
1849 }
1850 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1851 
1852 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1853 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1854 #define MAX_NVM_FILE_LEN	16384
1855 
1856 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1857 		    unsigned int len)
1858 {
1859 #define IWL_4165_DEVICE_ID	0x5501
1860 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1861 
1862 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1863 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1864 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1865 		/* OTP 0x52 bug work around: it's a 1x1 device */
1866 		data[3] = ANT_B | (ANT_B << 4);
1867 }
1868 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1869 
1870 /*
1871  * Reads external NVM from a file into mvm->nvm_sections
1872  *
1873  * HOW TO CREATE THE NVM FILE FORMAT:
1874  * ------------------------------
1875  * 1. create hex file, format:
1876  *      3800 -> header
1877  *      0000 -> header
1878  *      5a40 -> data
1879  *
1880  *   rev - 6 bit (word1)
1881  *   len - 10 bit (word1)
1882  *   id - 4 bit (word2)
1883  *   rsv - 12 bit (word2)
1884  *
1885  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1886  *
1887  * 3. create binary file from the hex file
1888  *
1889  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1890  */
1891 int iwl_read_external_nvm(struct iwl_trans *trans,
1892 			  const char *nvm_file_name,
1893 			  struct iwl_nvm_section *nvm_sections)
1894 {
1895 	int ret, section_size;
1896 	u16 section_id;
1897 	const struct firmware *fw_entry;
1898 	const struct {
1899 		__le16 word1;
1900 		__le16 word2;
1901 		u8 data[];
1902 	} *file_sec;
1903 	const u8 *eof;
1904 	u8 *temp;
1905 	int max_section_size;
1906 	const __le32 *dword_buff;
1907 
1908 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1909 #define NVM_WORD2_ID(x) (x >> 12)
1910 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1911 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1912 #define NVM_HEADER_0	(0x2A504C54)
1913 #define NVM_HEADER_1	(0x4E564D2A)
1914 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1915 
1916 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1917 
1918 	/* Maximal size depends on NVM version */
1919 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1920 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1921 	else
1922 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1923 
1924 	/*
1925 	 * Obtain NVM image via request_firmware. Since we already used
1926 	 * request_firmware_nowait() for the firmware binary load and only
1927 	 * get here after that we assume the NVM request can be satisfied
1928 	 * synchronously.
1929 	 */
1930 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1931 	if (ret) {
1932 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1933 			nvm_file_name, ret);
1934 		return ret;
1935 	}
1936 
1937 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1938 		 nvm_file_name, fw_entry->size);
1939 
1940 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1941 		IWL_ERR(trans, "NVM file too large\n");
1942 		ret = -EINVAL;
1943 		goto out;
1944 	}
1945 
1946 	eof = fw_entry->data + fw_entry->size;
1947 	dword_buff = (const __le32 *)fw_entry->data;
1948 
1949 	/* some NVM file will contain a header.
1950 	 * The header is identified by 2 dwords header as follow:
1951 	 * dword[0] = 0x2A504C54
1952 	 * dword[1] = 0x4E564D2A
1953 	 *
1954 	 * This header must be skipped when providing the NVM data to the FW.
1955 	 */
1956 	if (fw_entry->size > NVM_HEADER_SIZE &&
1957 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1958 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1959 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1960 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1961 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1962 			 le32_to_cpu(dword_buff[3]));
1963 
1964 		/* nvm file validation, dword_buff[2] holds the file version */
1965 		if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1966 		    trans->info.hw_rev_step == SILICON_C_STEP &&
1967 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1968 			ret = -EFAULT;
1969 			goto out;
1970 		}
1971 	} else {
1972 		file_sec = (const void *)fw_entry->data;
1973 	}
1974 
1975 	while (true) {
1976 		if (file_sec->data > eof) {
1977 			IWL_ERR(trans,
1978 				"ERROR - NVM file too short for section header\n");
1979 			ret = -EINVAL;
1980 			break;
1981 		}
1982 
1983 		/* check for EOF marker */
1984 		if (!file_sec->word1 && !file_sec->word2) {
1985 			ret = 0;
1986 			break;
1987 		}
1988 
1989 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
1990 			section_size =
1991 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
1992 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
1993 		} else {
1994 			section_size = 2 * EXT_NVM_WORD2_LEN(
1995 						le16_to_cpu(file_sec->word2));
1996 			section_id = EXT_NVM_WORD1_ID(
1997 						le16_to_cpu(file_sec->word1));
1998 		}
1999 
2000 		if (section_size > max_section_size) {
2001 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
2002 				section_size);
2003 			ret = -EINVAL;
2004 			break;
2005 		}
2006 
2007 		if (!section_size) {
2008 			IWL_ERR(trans, "ERROR - section empty\n");
2009 			ret = -EINVAL;
2010 			break;
2011 		}
2012 
2013 		if (file_sec->data + section_size > eof) {
2014 			IWL_ERR(trans,
2015 				"ERROR - NVM file too short for section (%d bytes)\n",
2016 				section_size);
2017 			ret = -EINVAL;
2018 			break;
2019 		}
2020 
2021 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
2022 			 "Invalid NVM section ID %d\n", section_id)) {
2023 			ret = -EINVAL;
2024 			break;
2025 		}
2026 
2027 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
2028 		if (!temp) {
2029 			ret = -ENOMEM;
2030 			break;
2031 		}
2032 
2033 		iwl_nvm_fixups(trans->info.hw_id, section_id, temp, section_size);
2034 
2035 		kfree(nvm_sections[section_id].data);
2036 		nvm_sections[section_id].data = temp;
2037 		nvm_sections[section_id].length = section_size;
2038 
2039 		/* advance to the next section */
2040 		file_sec = (const void *)(file_sec->data + section_size);
2041 	}
2042 out:
2043 	release_firmware(fw_entry);
2044 	return ret;
2045 }
2046 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
2047 
2048 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
2049 				 const struct iwl_fw *fw,
2050 				 u8 set_tx_ant, u8 set_rx_ant)
2051 {
2052 	struct iwl_nvm_get_info cmd = {};
2053 	struct iwl_nvm_data *nvm;
2054 	struct iwl_host_cmd hcmd = {
2055 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
2056 		.data = { &cmd, },
2057 		.len = { sizeof(cmd) },
2058 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
2059 	};
2060 	int  ret;
2061 	bool empty_otp;
2062 	u32 mac_flags;
2063 	u32 sbands_flags = 0;
2064 	u8 tx_ant;
2065 	u8 rx_ant;
2066 
2067 	/*
2068 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
2069 	 * in v3, except for the channel profile part of the
2070 	 * regulatory.  So we can just access the new struct, with the
2071 	 * exception of the latter.
2072 	 */
2073 	struct iwl_nvm_get_info_rsp *rsp;
2074 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
2075 	bool v4 = fw_has_api(&fw->ucode_capa,
2076 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
2077 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
2078 	void *channel_profile;
2079 
2080 	ret = iwl_trans_send_cmd(trans, &hcmd);
2081 	if (ret)
2082 		return ERR_PTR(ret);
2083 
2084 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
2085 		 "Invalid payload len in NVM response from FW %d",
2086 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
2087 		ret = -EINVAL;
2088 		goto out;
2089 	}
2090 
2091 	rsp = (void *)hcmd.resp_pkt->data;
2092 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
2093 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
2094 	if (empty_otp)
2095 		IWL_INFO(trans, "OTP is empty\n");
2096 
2097 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
2098 	if (!nvm) {
2099 		ret = -ENOMEM;
2100 		goto out;
2101 	}
2102 
2103 	iwl_set_hw_address_from_csr(trans, nvm);
2104 	/* TODO: if platform NVM has MAC address - override it here */
2105 
2106 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2107 		IWL_ERR(trans, "no valid mac address was found\n");
2108 		ret = -EINVAL;
2109 		goto err_free;
2110 	}
2111 
2112 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2113 
2114 	/* Initialize general data */
2115 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2116 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2117 	if (nvm->n_hw_addrs == 0)
2118 		IWL_WARN(trans,
2119 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2120 			 empty_otp);
2121 
2122 	/* Initialize MAC sku data */
2123 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2124 	nvm->sku_cap_11ac_enable =
2125 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2126 	nvm->sku_cap_11n_enable =
2127 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2128 	nvm->sku_cap_11ax_enable =
2129 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2130 	nvm->sku_cap_band_24ghz_enable =
2131 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2132 	nvm->sku_cap_band_52ghz_enable =
2133 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2134 	nvm->sku_cap_mimo_disabled =
2135 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2136 	if (CSR_HW_RFID_TYPE(trans->info.hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
2137 		nvm->sku_cap_11be_enable = true;
2138 
2139 	/* Initialize PHY sku data */
2140 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2141 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2142 
2143 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2144 	    fw_has_capa(&fw->ucode_capa,
2145 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2146 		nvm->lar_enabled = true;
2147 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2148 	}
2149 
2150 	rsp_v3 = (void *)rsp;
2151 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2152 			  (void *)rsp_v3->regulatory.channel_profile;
2153 
2154 	tx_ant = nvm->valid_tx_ant & fw->valid_tx_ant;
2155 	rx_ant = nvm->valid_rx_ant & fw->valid_rx_ant;
2156 
2157 	if (set_tx_ant)
2158 		tx_ant &= set_tx_ant;
2159 	if (set_rx_ant)
2160 		rx_ant &= set_rx_ant;
2161 
2162 	iwl_init_sbands(trans, nvm, channel_profile, tx_ant, rx_ant,
2163 			sbands_flags, v4, fw);
2164 
2165 	iwl_free_resp(&hcmd);
2166 	return nvm;
2167 
2168 err_free:
2169 	kfree(nvm);
2170 out:
2171 	iwl_free_resp(&hcmd);
2172 	return ERR_PTR(ret);
2173 }
2174 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2175