xref: /linux/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c (revision c40e28c47fc4e55e5f523f295f7096e5d9428608)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023, 2025 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/fips.h>
9 #include <linux/slab.h>
10 #include <linux/export.h>
11 #include <linux/etherdevice.h>
12 #include <linux/pci.h>
13 #include <linux/firmware.h>
14 
15 #include "iwl-drv.h"
16 #include "iwl-modparams.h"
17 #include "iwl-nvm-parse.h"
18 #include "iwl-prph.h"
19 #include "iwl-io.h"
20 #include "iwl-csr.h"
21 #include "fw/acpi.h"
22 #include "fw/api/nvm-reg.h"
23 #include "fw/api/commands.h"
24 #include "fw/api/cmdhdr.h"
25 #include "fw/img.h"
26 #include "mei/iwl-mei.h"
27 
28 /* NVM offsets (in words) definitions */
29 enum nvm_offsets {
30 	/* NVM HW-Section offset (in words) definitions */
31 	SUBSYSTEM_ID = 0x0A,
32 	HW_ADDR = 0x15,
33 
34 	/* NVM SW-Section offset (in words) definitions */
35 	NVM_SW_SECTION = 0x1C0,
36 	NVM_VERSION = 0,
37 	RADIO_CFG = 1,
38 	SKU = 2,
39 	N_HW_ADDRS = 3,
40 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
41 
42 	/* NVM REGULATORY -Section offset (in words) definitions */
43 	NVM_CHANNELS_SDP = 0,
44 };
45 
46 enum ext_nvm_offsets {
47 	/* NVM HW-Section offset (in words) definitions */
48 
49 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
50 
51 	/* NVM SW-Section offset (in words) definitions */
52 	NVM_VERSION_EXT_NVM = 0,
53 	N_HW_ADDRS_FAMILY_8000 = 3,
54 
55 	/* NVM PHY_SKU-Section offset (in words) definitions */
56 	RADIO_CFG_FAMILY_EXT_NVM = 0,
57 	SKU_FAMILY_8000 = 2,
58 
59 	/* NVM REGULATORY -Section offset (in words) definitions */
60 	NVM_CHANNELS_EXTENDED = 0,
61 	NVM_LAR_OFFSET_OLD = 0x4C7,
62 	NVM_LAR_OFFSET = 0x507,
63 	NVM_LAR_ENABLED = 0x7,
64 };
65 
66 /* SKU Capabilities (actual values from NVM definition) */
67 enum nvm_sku_bits {
68 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
69 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
70 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
71 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
72 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
73 };
74 
75 /*
76  * These are the channel numbers in the order that they are stored in the NVM
77  */
78 static const u16 iwl_nvm_channels[] = {
79 	/* 2.4 GHz */
80 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
81 	/* 5 GHz */
82 	36, 40, 44, 48, 52, 56, 60, 64,
83 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
84 	149, 153, 157, 161, 165
85 };
86 
87 static const u16 iwl_ext_nvm_channels[] = {
88 	/* 2.4 GHz */
89 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
90 	/* 5 GHz */
91 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
92 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
93 	149, 153, 157, 161, 165, 169, 173, 177, 181
94 };
95 
96 static const u16 iwl_uhb_nvm_channels[] = {
97 	/* 2.4 GHz */
98 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
99 	/* 5 GHz */
100 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
101 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
102 	149, 153, 157, 161, 165, 169, 173, 177, 181,
103 	/* 6-7 GHz */
104 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
105 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
106 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
107 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
108 };
109 
110 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
111 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
112 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
113 #define NUM_2GHZ_CHANNELS		14
114 #define NUM_5GHZ_CHANNELS		37
115 #define FIRST_2GHZ_HT_MINUS		5
116 #define LAST_2GHZ_HT_PLUS		9
117 #define N_HW_ADDR_MASK			0xF
118 
119 /* rate data (static) */
120 static struct ieee80211_rate iwl_cfg80211_rates[] = {
121 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
122 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
123 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
124 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
125 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
126 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
127 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
128 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
129 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
130 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
131 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
132 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
133 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
134 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
135 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
136 };
137 #define RATES_24_OFFS	0
138 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
139 #define RATES_52_OFFS	4
140 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
141 
142 /**
143  * enum iwl_nvm_channel_flags - channel flags in NVM
144  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
145  * @NVM_CHANNEL_IBSS: usable as an IBSS channel and deprecated
146  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
147  * @NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY: active scanning allowed and
148  *	AP allowed only in 20 MHz. Valid only
149  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
150  * @NVM_CHANNEL_ACTIVE: active scanning allowed and allows IBSS
151  *	when %IWL_NVM_SBANDS_FLAGS_LAR enabled.
152  * @NVM_CHANNEL_RADAR: radar detection required
153  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
154  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
155  *	on same channel on 2.4 or same UNII band on 5.2
156  * @NVM_CHANNEL_UNIFORM: uniform spreading required
157  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
158  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
159  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
160  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
161  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
162  * @NVM_CHANNEL_VLP: client support connection to UHB VLP AP
163  * @NVM_CHANNEL_AFC: client support connection to UHB AFC AP
164  * @NVM_CHANNEL_VLP_AP_NOT_ALLOWED: UHB VLP AP not allowed,
165  *	Valid only when %NVM_CHANNEL_VLP is enabled.
166  */
167 enum iwl_nvm_channel_flags {
168 	NVM_CHANNEL_VALID			= BIT(0),
169 	NVM_CHANNEL_IBSS			= BIT(1),
170 	NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY	= BIT(2),
171 	NVM_CHANNEL_ACTIVE			= BIT(3),
172 	NVM_CHANNEL_RADAR			= BIT(4),
173 	NVM_CHANNEL_INDOOR_ONLY			= BIT(5),
174 	NVM_CHANNEL_GO_CONCURRENT		= BIT(6),
175 	NVM_CHANNEL_UNIFORM			= BIT(7),
176 	NVM_CHANNEL_20MHZ			= BIT(8),
177 	NVM_CHANNEL_40MHZ			= BIT(9),
178 	NVM_CHANNEL_80MHZ			= BIT(10),
179 	NVM_CHANNEL_160MHZ			= BIT(11),
180 	NVM_CHANNEL_DC_HIGH			= BIT(12),
181 	NVM_CHANNEL_VLP				= BIT(13),
182 	NVM_CHANNEL_AFC				= BIT(14),
183 	NVM_CHANNEL_VLP_AP_NOT_ALLOWED		= BIT(15),
184 };
185 
186 /**
187  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
188  * domain.
189  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
190  *	2.4Ghz band is allowed.
191  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
192  *	5Ghz band is allowed.
193  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
194  *	for this regulatory domain (valid only in 5Ghz).
195  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
196  *	for this regulatory domain (valid only in 5Ghz).
197  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
198  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
199  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
200  *	for this regulatory domain (valid only in 5Ghz).
201  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
202  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
203  */
204 enum iwl_reg_capa_flags_v1 {
205 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
206 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
207 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
208 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
209 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
210 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
211 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
212 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
213 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
214 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
215 
216 /**
217  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
218  * domain (version 2).
219  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
220  *	disabled.
221  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
222  *	2.4Ghz band is allowed.
223  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
224  *	5Ghz band is allowed.
225  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
226  *	for this regulatory domain (valid only in 5Ghz).
227  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
228  *	for this regulatory domain (valid only in 5Ghz).
229  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
230  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
231  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
232  *	126, 122) are disabled.
233  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
234  *	for this regulatory domain (uvalid only in 5Ghz).
235  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
236  */
237 enum iwl_reg_capa_flags_v2 {
238 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
239 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
240 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
241 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
242 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
243 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
244 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
245 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
246 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
247 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
248 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
249 
250 /**
251  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
252  * domain.
253  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
254  *	for this regulatory domain (valid only in 5Ghz).
255  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
256  *	for this regulatory domain (valid only in 5Ghz).
257  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
258  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
259  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
260  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
261  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
262  *	for this regulatory domain (valid only in 5GHz).
263  */
264 enum iwl_reg_capa_flags_v4 {
265 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
266 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
267 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
268 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
269 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
270 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
271 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
272 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
273 
274 /*
275 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
276 * MCC update command response.
277 */
278 #define REG_CAPA_V2_RESP_VER	6
279 
280 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
281  * MCC update command response.
282  */
283 #define REG_CAPA_V4_RESP_VER	8
284 
285 /**
286  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
287  * handling the different APIs of reg_capa_flags.
288  *
289  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
290  *	for this regulatory domain.
291  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
292  *	for this regulatory domain (valid only in 5 and 6 Ghz).
293  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
294  *	for this regulatory domain (valid only in 5 and 6 Ghz).
295  * @allow_320mhz: 11be channel with a width of 320Mhz is allowed
296  *	for this regulatory domain (valid only in 6 Ghz).
297  * @disable_11ax: 11ax is forbidden for this regulatory domain.
298  * @disable_11be: 11be is forbidden for this regulatory domain.
299  */
300 struct iwl_reg_capa {
301 	bool allow_40mhz;
302 	bool allow_80mhz;
303 	bool allow_160mhz;
304 	bool allow_320mhz;
305 	bool disable_11ax;
306 	bool disable_11be;
307 };
308 
309 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
310 					       int chan, u32 flags)
311 {
312 #define CHECK_AND_PRINT_I(x)	\
313 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
314 
315 	if (!(flags & NVM_CHANNEL_VALID)) {
316 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
317 			      chan, flags);
318 		return;
319 	}
320 
321 	/* Note: already can print up to 101 characters, 110 is the limit! */
322 	IWL_DEBUG_DEV(dev, level,
323 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
324 		      chan, flags,
325 		      CHECK_AND_PRINT_I(VALID),
326 		      CHECK_AND_PRINT_I(IBSS),
327 		      CHECK_AND_PRINT_I(ACTIVE),
328 		      CHECK_AND_PRINT_I(RADAR),
329 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
330 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
331 		      CHECK_AND_PRINT_I(UNIFORM),
332 		      CHECK_AND_PRINT_I(20MHZ),
333 		      CHECK_AND_PRINT_I(40MHZ),
334 		      CHECK_AND_PRINT_I(80MHZ),
335 		      CHECK_AND_PRINT_I(160MHZ),
336 		      CHECK_AND_PRINT_I(DC_HIGH),
337 		      CHECK_AND_PRINT_I(VLP),
338 		      CHECK_AND_PRINT_I(AFC));
339 #undef CHECK_AND_PRINT_I
340 }
341 
342 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
343 				 u32 nvm_flags, const struct iwl_rf_cfg *cfg)
344 {
345 	u32 flags = IEEE80211_CHAN_NO_HT40;
346 
347 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
348 		if (ch_num <= LAST_2GHZ_HT_PLUS)
349 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
350 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
351 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
352 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
353 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
354 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
355 		else
356 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
357 	}
358 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
359 		flags |= IEEE80211_CHAN_NO_80MHZ;
360 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
361 		flags |= IEEE80211_CHAN_NO_160MHZ;
362 
363 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
364 		flags |= IEEE80211_CHAN_NO_IR;
365 
366 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
367 		flags |= IEEE80211_CHAN_NO_IR;
368 
369 	if (nvm_flags & NVM_CHANNEL_RADAR)
370 		flags |= IEEE80211_CHAN_RADAR;
371 
372 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
373 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
374 
375 	/* Set the GO concurrent flag only in case that NO_IR is set.
376 	 * Otherwise it is meaningless
377 	 */
378 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
379 	    (flags & IEEE80211_CHAN_NO_IR))
380 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
381 
382 	/* Set the AP type for the UHB case. */
383 	if (nvm_flags & NVM_CHANNEL_VLP)
384 		flags |= IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP;
385 	else
386 		flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
387 	if (!(nvm_flags & NVM_CHANNEL_AFC))
388 		flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
389 
390 	return flags;
391 }
392 
393 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
394 {
395 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
396 		return NL80211_BAND_6GHZ;
397 	}
398 
399 	if (ch_idx >= NUM_2GHZ_CHANNELS)
400 		return NL80211_BAND_5GHZ;
401 	return NL80211_BAND_2GHZ;
402 }
403 
404 static int iwl_init_channel_map(struct iwl_trans *trans,
405 				const struct iwl_fw *fw,
406 				struct iwl_nvm_data *data,
407 				const void * const nvm_ch_flags,
408 				u32 sbands_flags, bool v4)
409 {
410 	const struct iwl_rf_cfg *cfg = trans->cfg;
411 	struct device *dev = trans->dev;
412 	int ch_idx;
413 	int n_channels = 0;
414 	struct ieee80211_channel *channel;
415 	u32 ch_flags;
416 	int num_of_ch;
417 	const u16 *nvm_chan;
418 
419 	if (cfg->uhb_supported) {
420 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
421 		nvm_chan = iwl_uhb_nvm_channels;
422 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
423 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
424 		nvm_chan = iwl_ext_nvm_channels;
425 	} else {
426 		num_of_ch = IWL_NVM_NUM_CHANNELS;
427 		nvm_chan = iwl_nvm_channels;
428 	}
429 
430 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
431 		enum nl80211_band band =
432 			iwl_nl80211_band_from_channel_idx(ch_idx);
433 
434 		if (v4)
435 			ch_flags =
436 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
437 		else
438 			ch_flags =
439 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
440 
441 		if (band == NL80211_BAND_5GHZ &&
442 		    !data->sku_cap_band_52ghz_enable)
443 			continue;
444 
445 		/* workaround to disable wide channels in 5GHz */
446 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
447 		    band == NL80211_BAND_5GHZ) {
448 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
449 				     NVM_CHANNEL_80MHZ |
450 				     NVM_CHANNEL_160MHZ);
451 		}
452 
453 		if (ch_flags & NVM_CHANNEL_160MHZ)
454 			data->vht160_supported = true;
455 
456 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
457 		    !(ch_flags & NVM_CHANNEL_VALID)) {
458 			/*
459 			 * Channels might become valid later if lar is
460 			 * supported, hence we still want to add them to
461 			 * the list of supported channels to cfg80211.
462 			 */
463 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
464 						    nvm_chan[ch_idx], ch_flags);
465 			continue;
466 		}
467 
468 		channel = &data->channels[n_channels];
469 		n_channels++;
470 
471 		channel->hw_value = nvm_chan[ch_idx];
472 		channel->band = band;
473 		channel->center_freq =
474 			ieee80211_channel_to_frequency(
475 				channel->hw_value, channel->band);
476 
477 		/* Initialize regulatory-based run-time data */
478 
479 		/*
480 		 * Default value - highest tx power value.  max_power
481 		 * is not used in mvm, and is used for backwards compatibility
482 		 */
483 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
484 
485 		/* don't put limitations in case we're using LAR */
486 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
487 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
488 							       ch_idx, band,
489 							       ch_flags, cfg);
490 		else
491 			channel->flags = 0;
492 
493 		if (fw_has_capa(&fw->ucode_capa,
494 				IWL_UCODE_TLV_CAPA_MONITOR_PASSIVE_CHANS))
495 			channel->flags |= IEEE80211_CHAN_CAN_MONITOR;
496 
497 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
498 					    channel->hw_value, ch_flags);
499 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
500 				 channel->hw_value, channel->max_power);
501 	}
502 
503 	return n_channels;
504 }
505 
506 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
507 				  struct iwl_nvm_data *data,
508 				  struct ieee80211_sta_vht_cap *vht_cap,
509 				  u8 tx_chains, u8 rx_chains)
510 {
511 	const struct iwl_rf_cfg *cfg = trans->cfg;
512 	int num_rx_ants = num_of_ant(rx_chains);
513 	int num_tx_ants = num_of_ant(tx_chains);
514 
515 	vht_cap->vht_supported = true;
516 
517 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
518 		       IEEE80211_VHT_CAP_RXSTBC_1 |
519 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
520 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
521 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
522 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
523 
524 	if (!trans->cfg->ht_params.stbc)
525 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
526 
527 	if (data->vht160_supported)
528 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
529 				IEEE80211_VHT_CAP_SHORT_GI_160;
530 
531 	if (cfg->vht_mu_mimo_supported)
532 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
533 
534 	if (cfg->ht_params.ldpc)
535 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
536 
537 	if (data->sku_cap_mimo_disabled) {
538 		num_rx_ants = 1;
539 		num_tx_ants = 1;
540 	}
541 
542 	if (trans->cfg->ht_params.stbc && num_tx_ants > 1)
543 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
544 	else
545 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
546 
547 	/*
548 	 * With fips_enabled crypto is done by software, so the HW cannot
549 	 * split up A-MSDUs and the real limit that was set applies.
550 	 * Note that EHT doesn't honour this (HE copies the VHT value),
551 	 * but EHT is also entirely disabled for fips_enabled.
552 	 */
553 	switch (iwlwifi_mod_params.amsdu_size) {
554 	case IWL_AMSDU_DEF:
555 		if (trans->mac_cfg->mq_rx_supported && !fips_enabled)
556 			vht_cap->cap |=
557 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
558 		else
559 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
560 		break;
561 	case IWL_AMSDU_2K:
562 		if (trans->mac_cfg->mq_rx_supported && !fips_enabled)
563 			vht_cap->cap |=
564 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
565 		else
566 			WARN(1, "RB size of 2K is not supported by this device\n");
567 		break;
568 	case IWL_AMSDU_4K:
569 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
570 		break;
571 	case IWL_AMSDU_8K:
572 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
573 		break;
574 	case IWL_AMSDU_12K:
575 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
576 		break;
577 	default:
578 		break;
579 	}
580 
581 	vht_cap->vht_mcs.rx_mcs_map =
582 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
583 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
584 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
585 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
586 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
587 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
588 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
589 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
590 
591 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
592 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
593 		/* this works because NOT_SUPPORTED == 3 */
594 		vht_cap->vht_mcs.rx_mcs_map |=
595 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
596 	}
597 
598 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
599 
600 	vht_cap->vht_mcs.tx_highest |=
601 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
602 }
603 
604 static const u8 iwl_vendor_caps[] = {
605 	0xdd,			/* vendor element */
606 	0x06,			/* length */
607 	0x00, 0x17, 0x35,	/* Intel OUI */
608 	0x08,			/* type (Intel Capabilities) */
609 	/* followed by 16 bits of capabilities */
610 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
611 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
612 	0x00
613 };
614 
615 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
616 	{
617 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
618 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
619 		.he_cap = {
620 			.has_he = true,
621 			.he_cap_elem = {
622 				.mac_cap_info[0] =
623 					IEEE80211_HE_MAC_CAP0_HTC_HE,
624 				.mac_cap_info[1] =
625 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
626 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
627 				.mac_cap_info[2] =
628 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
629 				.mac_cap_info[3] =
630 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
631 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
632 				.mac_cap_info[4] =
633 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
634 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
635 				.mac_cap_info[5] =
636 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
637 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
638 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
639 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
640 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
641 				.phy_cap_info[1] =
642 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
643 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
644 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
645 				.phy_cap_info[2] =
646 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
647 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
648 				.phy_cap_info[3] =
649 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
650 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
651 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
652 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
653 				.phy_cap_info[4] =
654 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
655 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
656 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
657 				.phy_cap_info[6] =
658 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
659 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
660 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
661 				.phy_cap_info[7] =
662 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
663 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
664 				.phy_cap_info[8] =
665 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
666 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
667 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
668 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
669 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
670 				.phy_cap_info[9] =
671 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
672 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
673 					IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
674 					IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU |
675 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
676 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
677 				.phy_cap_info[10] =
678 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
679 			},
680 			/*
681 			 * Set default Tx/Rx HE MCS NSS Support field.
682 			 * Indicate support for up to 2 spatial streams and all
683 			 * MCS, without any special cases
684 			 */
685 			.he_mcs_nss_supp = {
686 				.rx_mcs_80 = cpu_to_le16(0xfffa),
687 				.tx_mcs_80 = cpu_to_le16(0xfffa),
688 				.rx_mcs_160 = cpu_to_le16(0xfffa),
689 				.tx_mcs_160 = cpu_to_le16(0xfffa),
690 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
691 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
692 			},
693 			/*
694 			 * Set default PPE thresholds, with PPET16 set to 0,
695 			 * PPET8 set to 7
696 			 */
697 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
698 		},
699 		.eht_cap = {
700 			.has_eht = true,
701 			.eht_cap_elem = {
702 				.mac_cap_info[0] =
703 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL,
704 				.phy_cap_info[0] =
705 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
706 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
707 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
708 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
709 				.phy_cap_info[1] =
710 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
711 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
712 				.phy_cap_info[3] =
713 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK,
714 
715 				.phy_cap_info[4] =
716 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
717 				.phy_cap_info[5] =
718 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
719 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US) |
720 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
721 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
722 					IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF,
723 				.phy_cap_info[8] =
724 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
725 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
726 			},
727 
728 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
729 			 * Rx - note we don't set the only_20mhz, but due to this
730 			 * being a union, it gets set correctly anyway.
731 			 */
732 			.eht_mcs_nss_supp = {
733 				.bw._80 = {
734 					.rx_tx_mcs9_max_nss = 0x22,
735 					.rx_tx_mcs11_max_nss = 0x22,
736 					.rx_tx_mcs13_max_nss = 0x22,
737 				},
738 				.bw._160 = {
739 					.rx_tx_mcs9_max_nss = 0x22,
740 					.rx_tx_mcs11_max_nss = 0x22,
741 					.rx_tx_mcs13_max_nss = 0x22,
742 				},
743 				.bw._320 = {
744 					.rx_tx_mcs9_max_nss = 0x22,
745 					.rx_tx_mcs11_max_nss = 0x22,
746 					.rx_tx_mcs13_max_nss = 0x22,
747 				},
748 			},
749 
750 			/*
751 			 * PPE thresholds for NSS = 2, and RU index bitmap set
752 			 * to 0xc.
753 			 * Note: just for stating what we want, not present in
754 			 * the transmitted data due to not including
755 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
756 			 */
757 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
758 		},
759 	},
760 	{
761 		.types_mask = BIT(NL80211_IFTYPE_AP) |
762 			      BIT(NL80211_IFTYPE_P2P_GO),
763 		.he_cap = {
764 			.has_he = true,
765 			.he_cap_elem = {
766 				.mac_cap_info[0] =
767 					IEEE80211_HE_MAC_CAP0_HTC_HE,
768 				.mac_cap_info[1] =
769 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
770 				.mac_cap_info[3] =
771 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
772 				.phy_cap_info[1] =
773 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
774 				.phy_cap_info[2] =
775 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
776 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
777 				.phy_cap_info[3] =
778 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
779 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
780 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
781 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
782 				.phy_cap_info[6] =
783 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
784 				.phy_cap_info[7] =
785 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
786 				.phy_cap_info[8] =
787 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
788 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
789 				.phy_cap_info[9] =
790 					IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
791 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
792 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
793 			},
794 			/*
795 			 * Set default Tx/Rx HE MCS NSS Support field.
796 			 * Indicate support for up to 2 spatial streams and all
797 			 * MCS, without any special cases
798 			 */
799 			.he_mcs_nss_supp = {
800 				.rx_mcs_80 = cpu_to_le16(0xfffa),
801 				.tx_mcs_80 = cpu_to_le16(0xfffa),
802 				.rx_mcs_160 = cpu_to_le16(0xfffa),
803 				.tx_mcs_160 = cpu_to_le16(0xfffa),
804 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
805 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
806 			},
807 			/*
808 			 * Set default PPE thresholds, with PPET16 set to 0,
809 			 * PPET8 set to 7
810 			 */
811 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
812 		},
813 		.eht_cap = {
814 			.has_eht = true,
815 			.eht_cap_elem = {
816 				.mac_cap_info[0] =
817 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL,
818 				.phy_cap_info[0] =
819 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
820 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
821 				.phy_cap_info[5] =
822 					FIELD_PREP_CONST(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK,
823 							 IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US),
824 			},
825 
826 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
827 			 * Rx - note we don't set the only_20mhz, but due to this
828 			 * being a union, it gets set correctly anyway.
829 			 */
830 			.eht_mcs_nss_supp = {
831 				.bw._80 = {
832 					.rx_tx_mcs9_max_nss = 0x22,
833 					.rx_tx_mcs11_max_nss = 0x22,
834 					.rx_tx_mcs13_max_nss = 0x22,
835 				},
836 				.bw._160 = {
837 					.rx_tx_mcs9_max_nss = 0x22,
838 					.rx_tx_mcs11_max_nss = 0x22,
839 					.rx_tx_mcs13_max_nss = 0x22,
840 				},
841 				.bw._320 = {
842 					.rx_tx_mcs9_max_nss = 0x22,
843 					.rx_tx_mcs11_max_nss = 0x22,
844 					.rx_tx_mcs13_max_nss = 0x22,
845 				},
846 			},
847 
848 			/*
849 			 * PPE thresholds for NSS = 2, and RU index bitmap set
850 			 * to 0xc.
851 			 * Note: just for stating what we want, not present in
852 			 * the transmitted data due to not including
853 			 * IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT.
854 			 */
855 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
856 		},
857 	},
858 };
859 
860 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
861 				  struct iwl_nvm_data *data,
862 				  struct ieee80211_supported_band *sband,
863 				  u8 tx_chains, u8 rx_chains)
864 {
865 	struct ieee80211_sta_ht_cap ht_cap;
866 	struct ieee80211_sta_vht_cap vht_cap = {};
867 	struct ieee80211_sband_iftype_data *iftype_data;
868 	u16 he_6ghz_capa = 0;
869 	u32 exp;
870 	int i;
871 
872 	if (sband->band != NL80211_BAND_6GHZ)
873 		return;
874 
875 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
876 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
877 			     tx_chains, rx_chains);
878 	WARN_ON(!ht_cap.ht_supported);
879 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
880 	WARN_ON(!vht_cap.vht_supported);
881 
882 	he_6ghz_capa |=
883 		u16_encode_bits(ht_cap.ampdu_density,
884 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
885 	exp = u32_get_bits(vht_cap.cap,
886 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
887 	he_6ghz_capa |=
888 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
889 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
890 	he_6ghz_capa |=
891 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
892 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
893 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
894 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
895 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
896 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
897 
898 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
899 
900 	/* we know it's writable - we set it before ourselves */
901 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
902 	for (i = 0; i < sband->n_iftype_data; i++)
903 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
904 }
905 
906 static void
907 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
908 			 struct iwl_nvm_data *data,
909 			 struct ieee80211_supported_band *sband,
910 			 struct ieee80211_sband_iftype_data *iftype_data,
911 			 u8 tx_chains, u8 rx_chains,
912 			 const struct iwl_fw *fw)
913 {
914 	bool is_ap = iftype_data->types_mask & (BIT(NL80211_IFTYPE_AP) |
915 						BIT(NL80211_IFTYPE_P2P_GO));
916 	bool slow_pcie = (!trans->mac_cfg->integrated &&
917 			  trans->info.pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB);
918 
919 	/* EHT needs WPA3/MFP so cannot do it for fips_enabled */
920 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be ||
921 	    fips_enabled)
922 		iftype_data->eht_cap.has_eht = false;
923 
924 	/* Advertise an A-MPDU exponent extension based on
925 	 * operating band
926 	 */
927 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
928 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
929 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
930 	else if (sband->band != NL80211_BAND_2GHZ)
931 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
932 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
933 	else
934 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
935 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
936 
937 	switch (sband->band) {
938 	case NL80211_BAND_2GHZ:
939 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
940 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
941 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
942 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
943 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
944 		break;
945 	case NL80211_BAND_6GHZ:
946 		if (!trans->reduced_cap_sku &&
947 		    (!trans->cfg->bw_limit || trans->cfg->bw_limit >= 320)) {
948 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
949 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
950 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
951 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
952 		}
953 		fallthrough;
954 	case NL80211_BAND_5GHZ:
955 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
956 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
957 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
958 		break;
959 	default:
960 		WARN_ON(1);
961 		break;
962 	}
963 
964 	if ((tx_chains & rx_chains) == ANT_AB) {
965 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
966 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
967 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
968 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
969 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
970 		if (!is_ap) {
971 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
972 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
973 
974 			if (iftype_data->eht_cap.has_eht) {
975 				/*
976 				 * Set the number of sounding dimensions for each
977 				 * bandwidth to 1 to indicate the maximal supported
978 				 * value of TXVECTOR parameter NUM_STS of 2
979 				 */
980 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
981 
982 				/*
983 				 * Set the MAX NC to 1 to indicate sounding feedback of
984 				 * 2 supported by the beamfomee.
985 				 */
986 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
987 			}
988 		}
989 
990 		if (slow_pcie) {
991 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
992 				&iftype_data->eht_cap.eht_mcs_nss_supp;
993 
994 			mcs_nss->bw._320.rx_tx_mcs11_max_nss = 0;
995 			mcs_nss->bw._320.rx_tx_mcs13_max_nss = 0;
996 		}
997 	} else {
998 		struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp =
999 			&iftype_data->he_cap.he_mcs_nss_supp;
1000 
1001 		if (iftype_data->eht_cap.has_eht) {
1002 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
1003 				&iftype_data->eht_cap.eht_mcs_nss_supp;
1004 
1005 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
1006 		}
1007 
1008 		if (!is_ap) {
1009 			/* If not 2x2, we need to indicate 1x1 in the
1010 			 * Midamble RX Max NSTS - but not for AP mode
1011 			 */
1012 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
1013 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
1014 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1015 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
1016 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
1017 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
1018 		}
1019 
1020 		he_mcs_nss_supp->rx_mcs_80 |=
1021 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1022 		he_mcs_nss_supp->tx_mcs_80 |=
1023 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1024 		he_mcs_nss_supp->rx_mcs_160 |=
1025 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1026 		he_mcs_nss_supp->tx_mcs_160 |=
1027 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1028 		he_mcs_nss_supp->rx_mcs_80p80 |=
1029 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1030 		he_mcs_nss_supp->tx_mcs_80p80 |=
1031 			cpu_to_le16(IEEE80211_HE_MCS_NOT_SUPPORTED << 2);
1032 	}
1033 
1034 	/* prior RFs don't have HE, HR RF doesn't have this, later have it */
1035 	if (CSR_HW_RFID_TYPE(trans->info.hw_rf_id) == IWL_CFG_RF_TYPE_HR1 ||
1036 	    CSR_HW_RFID_TYPE(trans->info.hw_rf_id) == IWL_CFG_RF_TYPE_HR2)
1037 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] &=
1038 			~(IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
1039 			  IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU);
1040 
1041 	if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
1042 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
1043 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
1044 
1045 	if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1046 	    !is_ap) {
1047 		iftype_data->vendor_elems.data = iwl_vendor_caps;
1048 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
1049 	}
1050 
1051 	if (!trans->cfg->ht_params.stbc) {
1052 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1053 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
1054 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
1055 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
1056 	}
1057 
1058 	if (trans->step_urm) {
1059 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs11_max_nss = 0;
1060 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._320.rx_tx_mcs13_max_nss = 0;
1061 	}
1062 
1063 	if (trans->cfg->bw_limit && trans->cfg->bw_limit < 160)
1064 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] &=
1065 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
1066 
1067 	if ((trans->cfg->bw_limit && trans->cfg->bw_limit < 320) ||
1068 	    trans->reduced_cap_sku) {
1069 		memset(&iftype_data->eht_cap.eht_mcs_nss_supp.bw._320, 0,
1070 		       sizeof(iftype_data->eht_cap.eht_mcs_nss_supp.bw._320));
1071 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] &=
1072 			~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
1073 	}
1074 
1075 	if (trans->reduced_cap_sku) {
1076 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._80.rx_tx_mcs13_max_nss = 0;
1077 		iftype_data->eht_cap.eht_mcs_nss_supp.bw._160.rx_tx_mcs13_max_nss = 0;
1078 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[8] &=
1079 			~IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA;
1080 	}
1081 }
1082 
1083 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1084 				 struct iwl_nvm_data *data,
1085 				 struct ieee80211_supported_band *sband,
1086 				 u8 tx_chains, u8 rx_chains,
1087 				 const struct iwl_fw *fw)
1088 {
1089 	struct ieee80211_sband_iftype_data *iftype_data;
1090 	int i;
1091 
1092 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1093 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1094 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1095 
1096 	switch (sband->band) {
1097 	case NL80211_BAND_2GHZ:
1098 		iftype_data = data->iftd.low;
1099 		break;
1100 	case NL80211_BAND_5GHZ:
1101 		iftype_data = data->iftd.high;
1102 		break;
1103 	case NL80211_BAND_6GHZ:
1104 		iftype_data = data->iftd.uhb;
1105 		break;
1106 	default:
1107 		WARN_ON(1);
1108 		return;
1109 	}
1110 
1111 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1112 
1113 	_ieee80211_set_sband_iftype_data(sband, iftype_data,
1114 					 ARRAY_SIZE(iwl_he_eht_capa));
1115 
1116 	for (i = 0; i < sband->n_iftype_data; i++)
1117 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1118 					 tx_chains, rx_chains, fw);
1119 
1120 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1121 }
1122 
1123 void iwl_reinit_cab(struct iwl_trans *trans, struct iwl_nvm_data *data,
1124 		    u8 tx_chains, u8 rx_chains, const struct iwl_fw *fw)
1125 {
1126 	struct ieee80211_supported_band *sband;
1127 
1128 	sband = &data->bands[NL80211_BAND_2GHZ];
1129 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1130 			     tx_chains, rx_chains);
1131 
1132 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1133 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1134 				     fw);
1135 
1136 	sband = &data->bands[NL80211_BAND_5GHZ];
1137 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1138 			     tx_chains, rx_chains);
1139 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1140 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1141 				      tx_chains, rx_chains);
1142 
1143 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1144 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1145 				     fw);
1146 
1147 	sband = &data->bands[NL80211_BAND_6GHZ];
1148 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1149 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1150 				     fw);
1151 }
1152 IWL_EXPORT_SYMBOL(iwl_reinit_cab);
1153 
1154 static void iwl_init_sbands(struct iwl_trans *trans,
1155 			    struct iwl_nvm_data *data,
1156 			    const void *nvm_ch_flags, u8 tx_chains,
1157 			    u8 rx_chains, u32 sbands_flags, bool v4,
1158 			    const struct iwl_fw *fw)
1159 {
1160 	struct device *dev = trans->dev;
1161 	int n_channels;
1162 	int n_used = 0;
1163 	struct ieee80211_supported_band *sband;
1164 
1165 	n_channels = iwl_init_channel_map(trans, fw, data, nvm_ch_flags,
1166 					  sbands_flags, v4);
1167 	sband = &data->bands[NL80211_BAND_2GHZ];
1168 	sband->band = NL80211_BAND_2GHZ;
1169 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1170 	sband->n_bitrates = N_RATES_24;
1171 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1172 					  NL80211_BAND_2GHZ);
1173 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1174 			     tx_chains, rx_chains);
1175 
1176 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1177 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1178 				     fw);
1179 
1180 	sband = &data->bands[NL80211_BAND_5GHZ];
1181 	sband->band = NL80211_BAND_5GHZ;
1182 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1183 	sband->n_bitrates = N_RATES_52;
1184 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1185 					  NL80211_BAND_5GHZ);
1186 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1187 			     tx_chains, rx_chains);
1188 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1189 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1190 				      tx_chains, rx_chains);
1191 
1192 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1193 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1194 				     fw);
1195 
1196 	/* 6GHz band. */
1197 	sband = &data->bands[NL80211_BAND_6GHZ];
1198 	sband->band = NL80211_BAND_6GHZ;
1199 	/* use the same rates as 5GHz band */
1200 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1201 	sband->n_bitrates = N_RATES_52;
1202 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1203 					  NL80211_BAND_6GHZ);
1204 
1205 	/*
1206 	 * 6 GHz requires WPA3 which requires MFP, which FW cannot do
1207 	 * when fips_enabled, so don't advertise any 6 GHz channels to
1208 	 * avoid spending time on scanning those channels and perhaps
1209 	 * even finding APs there that cannot be used.
1210 	 */
1211 	if (!fips_enabled && data->sku_cap_11ax_enable &&
1212 	    !iwlwifi_mod_params.disable_11ax)
1213 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1214 				     fw);
1215 	else
1216 		sband->n_channels = 0;
1217 
1218 	if (n_channels != n_used)
1219 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1220 			    n_used, n_channels);
1221 }
1222 
1223 static int iwl_get_sku(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw,
1224 		       const __le16 *phy_sku)
1225 {
1226 	if (cfg->nvm_type != IWL_NVM_EXT)
1227 		return le16_to_cpup(nvm_sw + SKU);
1228 
1229 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1230 }
1231 
1232 static int iwl_get_nvm_version(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw)
1233 {
1234 	if (cfg->nvm_type != IWL_NVM_EXT)
1235 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1236 	else
1237 		return le32_to_cpup((const __le32 *)(nvm_sw +
1238 						     NVM_VERSION_EXT_NVM));
1239 }
1240 
1241 static int iwl_get_radio_cfg(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw,
1242 			     const __le16 *phy_sku)
1243 {
1244 	if (cfg->nvm_type != IWL_NVM_EXT)
1245 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1246 
1247 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1248 
1249 }
1250 
1251 static int iwl_get_n_hw_addrs(const struct iwl_rf_cfg *cfg, const __le16 *nvm_sw)
1252 {
1253 	int n_hw_addr;
1254 
1255 	if (cfg->nvm_type != IWL_NVM_EXT)
1256 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1257 
1258 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1259 
1260 	return n_hw_addr & N_HW_ADDR_MASK;
1261 }
1262 
1263 static void iwl_set_radio_cfg(const struct iwl_rf_cfg *cfg,
1264 			      struct iwl_nvm_data *data,
1265 			      u32 radio_cfg)
1266 {
1267 	if (cfg->nvm_type != IWL_NVM_EXT) {
1268 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1269 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1270 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1271 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1272 		return;
1273 	}
1274 
1275 	/* set the radio configuration for family 8000 */
1276 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1277 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1278 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1279 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1280 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1281 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1282 }
1283 
1284 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1285 {
1286 	const u8 *hw_addr;
1287 
1288 	hw_addr = (const u8 *)&mac_addr0;
1289 	dest[0] = hw_addr[3];
1290 	dest[1] = hw_addr[2];
1291 	dest[2] = hw_addr[1];
1292 	dest[3] = hw_addr[0];
1293 
1294 	hw_addr = (const u8 *)&mac_addr1;
1295 	dest[4] = hw_addr[1];
1296 	dest[5] = hw_addr[0];
1297 }
1298 
1299 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1300 					struct iwl_nvm_data *data)
1301 {
1302 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1303 						  CSR_MAC_ADDR0_STRAP(trans)));
1304 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1305 						  CSR_MAC_ADDR1_STRAP(trans)));
1306 
1307 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1308 	/*
1309 	 * If the OEM fused a valid address, use it instead of the one in the
1310 	 * OTP
1311 	 */
1312 	if (is_valid_ether_addr(data->hw_addr))
1313 		return;
1314 
1315 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1316 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1317 
1318 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1319 }
1320 
1321 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1322 					   const struct iwl_rf_cfg *cfg,
1323 					   struct iwl_nvm_data *data,
1324 					   const __le16 *mac_override,
1325 					   const __be16 *nvm_hw)
1326 {
1327 	const u8 *hw_addr;
1328 
1329 	if (mac_override) {
1330 		static const u8 reserved_mac[] = {
1331 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1332 		};
1333 
1334 		hw_addr = (const u8 *)(mac_override +
1335 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1336 
1337 		/*
1338 		 * Store the MAC address from MAO section.
1339 		 * No byte swapping is required in MAO section
1340 		 */
1341 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1342 
1343 		/*
1344 		 * Force the use of the OTP MAC address in case of reserved MAC
1345 		 * address in the NVM, or if address is given but invalid.
1346 		 */
1347 		if (is_valid_ether_addr(data->hw_addr) &&
1348 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1349 			return;
1350 
1351 		IWL_ERR(trans,
1352 			"mac address from nvm override section is not valid\n");
1353 	}
1354 
1355 	if (nvm_hw) {
1356 		/* read the mac address from WFMP registers */
1357 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1358 						WFMP_MAC_ADDR_0));
1359 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1360 						WFMP_MAC_ADDR_1));
1361 
1362 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1363 
1364 		return;
1365 	}
1366 
1367 	IWL_ERR(trans, "mac address is not found\n");
1368 }
1369 
1370 static int iwl_set_hw_address(struct iwl_trans *trans,
1371 			      const struct iwl_rf_cfg *cfg,
1372 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1373 			      const __le16 *mac_override)
1374 {
1375 	const struct iwl_mac_cfg *mac_cfg = trans->mac_cfg;
1376 	if (mac_cfg->base->mac_addr_from_csr) {
1377 		iwl_set_hw_address_from_csr(trans, data);
1378 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1379 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1380 
1381 		/* The byte order is little endian 16 bit, meaning 214365 */
1382 		data->hw_addr[0] = hw_addr[1];
1383 		data->hw_addr[1] = hw_addr[0];
1384 		data->hw_addr[2] = hw_addr[3];
1385 		data->hw_addr[3] = hw_addr[2];
1386 		data->hw_addr[4] = hw_addr[5];
1387 		data->hw_addr[5] = hw_addr[4];
1388 	} else {
1389 		iwl_set_hw_address_family_8000(trans, cfg, data,
1390 					       mac_override, nvm_hw);
1391 	}
1392 
1393 	if (!is_valid_ether_addr(data->hw_addr)) {
1394 		IWL_ERR(trans, "no valid mac address was found\n");
1395 		return -EINVAL;
1396 	}
1397 
1398 	if (!trans->csme_own)
1399 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1400 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1401 
1402 	return 0;
1403 }
1404 
1405 static bool
1406 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1407 			const __be16 *nvm_hw)
1408 {
1409 	/*
1410 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1411 	 * some 7000-family OTPs erroneously allow wide channels in
1412 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1413 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1414 	 * 9.  In those cases, we need to force-disable wide channels
1415 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1416 	 * to use them.
1417 	 */
1418 	if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1419 		/*
1420 		 * Unlike the other sections in the NVM, the hw
1421 		 * section uses big-endian.
1422 		 */
1423 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1424 		u8 sku = (subsystem_id & 0x1e) >> 1;
1425 
1426 		if (sku == 5 || sku == 9) {
1427 			IWL_DEBUG_EEPROM(trans->dev,
1428 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1429 					 subsystem_id, sku);
1430 			return true;
1431 		}
1432 	}
1433 
1434 	return false;
1435 }
1436 
1437 struct iwl_nvm_data *
1438 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1439 		       const struct iwl_mei_nvm *mei_nvm,
1440 		       const struct iwl_fw *fw, u8 tx_ant, u8 rx_ant)
1441 {
1442 	struct iwl_nvm_data *data;
1443 	u32 sbands_flags = 0;
1444 	u8 rx_chains = fw->valid_rx_ant;
1445 	u8 tx_chains = fw->valid_rx_ant;
1446 
1447 	if (cfg->uhb_supported)
1448 		data = kzalloc(struct_size(data, channels,
1449 					   IWL_NVM_NUM_CHANNELS_UHB),
1450 					   GFP_KERNEL);
1451 	else
1452 		data = kzalloc(struct_size(data, channels,
1453 					   IWL_NVM_NUM_CHANNELS_EXT),
1454 					   GFP_KERNEL);
1455 	if (!data)
1456 		return NULL;
1457 
1458 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1459 		     IWL_NVM_NUM_CHANNELS_UHB);
1460 	data->nvm_version = mei_nvm->nvm_version;
1461 
1462 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1463 	if (data->valid_tx_ant)
1464 		tx_chains &= data->valid_tx_ant;
1465 	if (data->valid_rx_ant)
1466 		rx_chains &= data->valid_rx_ant;
1467 	if (tx_ant)
1468 		tx_chains &= tx_ant;
1469 	if (rx_ant)
1470 		rx_chains &= rx_ant;
1471 
1472 	data->sku_cap_mimo_disabled = false;
1473 	data->sku_cap_band_24ghz_enable = true;
1474 	data->sku_cap_band_52ghz_enable = true;
1475 	data->sku_cap_11n_enable =
1476 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1477 	data->sku_cap_11ac_enable = true;
1478 	data->sku_cap_11ax_enable =
1479 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1480 
1481 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1482 
1483 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1484 	/* If no valid mac address was found - bail out */
1485 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1486 		kfree(data);
1487 		return NULL;
1488 	}
1489 
1490 	if (data->lar_enabled &&
1491 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1492 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1493 
1494 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1495 			sbands_flags, true, fw);
1496 
1497 	return data;
1498 }
1499 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1500 
1501 struct iwl_nvm_data *
1502 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
1503 		   const struct iwl_fw *fw,
1504 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1505 		   const __le16 *nvm_calib, const __le16 *regulatory,
1506 		   const __le16 *mac_override, const __le16 *phy_sku,
1507 		   u8 tx_chains, u8 rx_chains)
1508 {
1509 	struct iwl_nvm_data *data;
1510 	bool lar_enabled;
1511 	u32 sku, radio_cfg;
1512 	u32 sbands_flags = 0;
1513 	u16 lar_config;
1514 	const __le16 *ch_section;
1515 
1516 	if (cfg->uhb_supported)
1517 		data = kzalloc(struct_size(data, channels,
1518 					   IWL_NVM_NUM_CHANNELS_UHB),
1519 					   GFP_KERNEL);
1520 	else if (cfg->nvm_type != IWL_NVM_EXT)
1521 		data = kzalloc(struct_size(data, channels,
1522 					   IWL_NVM_NUM_CHANNELS),
1523 					   GFP_KERNEL);
1524 	else
1525 		data = kzalloc(struct_size(data, channels,
1526 					   IWL_NVM_NUM_CHANNELS_EXT),
1527 					   GFP_KERNEL);
1528 	if (!data)
1529 		return NULL;
1530 
1531 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1532 
1533 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1534 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1535 	if (data->valid_tx_ant)
1536 		tx_chains &= data->valid_tx_ant;
1537 	if (data->valid_rx_ant)
1538 		rx_chains &= data->valid_rx_ant;
1539 
1540 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1541 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1542 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1543 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1544 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1545 		data->sku_cap_11n_enable = false;
1546 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1547 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1548 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1549 
1550 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1551 
1552 	if (cfg->nvm_type != IWL_NVM_EXT) {
1553 		/* Checking for required sections */
1554 		if (!nvm_calib) {
1555 			IWL_ERR(trans,
1556 				"Can't parse empty Calib NVM sections\n");
1557 			kfree(data);
1558 			return NULL;
1559 		}
1560 
1561 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1562 			     &regulatory[NVM_CHANNELS_SDP] :
1563 			     &nvm_sw[NVM_CHANNELS];
1564 
1565 		lar_enabled = true;
1566 	} else {
1567 		u16 lar_offset = data->nvm_version < 0xE39 ?
1568 				 NVM_LAR_OFFSET_OLD :
1569 				 NVM_LAR_OFFSET;
1570 
1571 		lar_config = le16_to_cpup(regulatory + lar_offset);
1572 		data->lar_enabled = !!(lar_config &
1573 				       NVM_LAR_ENABLED);
1574 		lar_enabled = data->lar_enabled;
1575 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1576 	}
1577 
1578 	/* If no valid mac address was found - bail out */
1579 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1580 		kfree(data);
1581 		return NULL;
1582 	}
1583 
1584 	if (lar_enabled &&
1585 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1586 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1587 
1588 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1589 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1590 
1591 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1592 			sbands_flags, false, fw);
1593 	data->calib_version = 255;
1594 
1595 	return data;
1596 }
1597 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1598 
1599 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1600 				       int ch_idx, u16 nvm_flags,
1601 				       struct iwl_reg_capa reg_capa)
1602 {
1603 	u32 flags = NL80211_RRF_NO_HT40;
1604 
1605 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1606 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1607 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1608 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1609 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1610 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1611 	} else if (ch_idx < NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS &&
1612 		   nvm_flags & NVM_CHANNEL_40MHZ) {
1613 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1614 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1615 		else
1616 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1617 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1618 		flags &= ~NL80211_RRF_NO_HT40PLUS;
1619 		flags &= ~NL80211_RRF_NO_HT40MINUS;
1620 	}
1621 
1622 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1623 		flags |= NL80211_RRF_NO_80MHZ;
1624 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1625 		flags |= NL80211_RRF_NO_160MHZ;
1626 
1627 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1628 		flags |= NL80211_RRF_NO_IR;
1629 
1630 	if (nvm_flags & NVM_CHANNEL_RADAR)
1631 		flags |= NL80211_RRF_DFS;
1632 
1633 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1634 		flags |= NL80211_RRF_NO_OUTDOOR;
1635 
1636 	if (nvm_flags & NVM_CHANNEL_ALLOW_20MHZ_ACTIVITY &&
1637 	    flags & NL80211_RRF_NO_IR)
1638 		flags |= NL80211_RRF_ALLOW_20MHZ_ACTIVITY;
1639 
1640 	/* Set the GO concurrent flag only in case that NO_IR is set.
1641 	 * Otherwise it is meaningless
1642 	 */
1643 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT)) {
1644 		if (flags & NL80211_RRF_NO_IR)
1645 			flags |= NL80211_RRF_GO_CONCURRENT;
1646 		if (flags & NL80211_RRF_DFS) {
1647 			flags |= NL80211_RRF_DFS_CONCURRENT;
1648 			/* Our device doesn't set active bit for DFS channels
1649 			 * however, once marked as DFS no-ir is not needed.
1650 			 */
1651 			flags &= ~NL80211_RRF_NO_IR;
1652 		}
1653 	}
1654 
1655 	/* Set the AP type for the UHB case. */
1656 	if (nvm_flags & NVM_CHANNEL_VLP) {
1657 		if (!(nvm_flags & NVM_CHANNEL_VLP_AP_NOT_ALLOWED))
1658 			flags |= NL80211_RRF_ALLOW_6GHZ_VLP_AP;
1659 	} else {
1660 		flags |= NL80211_RRF_NO_6GHZ_VLP_CLIENT;
1661 	}
1662 
1663 	if (!(nvm_flags & NVM_CHANNEL_AFC))
1664 		flags |= NL80211_RRF_NO_6GHZ_AFC_CLIENT;
1665 
1666 	/*
1667 	 * reg_capa is per regulatory domain so apply it for every channel
1668 	 */
1669 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1670 		if (!reg_capa.allow_40mhz)
1671 			flags |= NL80211_RRF_NO_HT40;
1672 
1673 		if (!reg_capa.allow_80mhz)
1674 			flags |= NL80211_RRF_NO_80MHZ;
1675 
1676 		if (!reg_capa.allow_160mhz)
1677 			flags |= NL80211_RRF_NO_160MHZ;
1678 
1679 		if (!reg_capa.allow_320mhz)
1680 			flags |= NL80211_RRF_NO_320MHZ;
1681 	}
1682 
1683 	if (reg_capa.disable_11ax)
1684 		flags |= NL80211_RRF_NO_HE;
1685 
1686 	if (reg_capa.disable_11be)
1687 		flags |= NL80211_RRF_NO_EHT;
1688 
1689 	return flags;
1690 }
1691 
1692 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1693 {
1694 	struct iwl_reg_capa reg_capa = {};
1695 
1696 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1697 		reg_capa.allow_40mhz = true;
1698 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1699 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1700 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1701 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1702 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1703 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1704 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1705 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1706 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1707 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1708 	} else {
1709 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1710 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1711 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1712 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1713 	}
1714 	return reg_capa;
1715 }
1716 
1717 struct ieee80211_regdomain *
1718 iwl_parse_nvm_mcc_info(struct iwl_trans *trans,
1719 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1720 		       u16 geo_info, u32 cap, u8 resp_ver)
1721 {
1722 	const struct iwl_rf_cfg *cfg = trans->cfg;
1723 	struct device *dev = trans->dev;
1724 	int ch_idx;
1725 	u16 ch_flags;
1726 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1727 	const u16 *nvm_chan;
1728 	struct ieee80211_regdomain *regd, *copy_rd;
1729 	struct ieee80211_reg_rule *rule;
1730 	int center_freq, prev_center_freq = 0;
1731 	int valid_rules = 0;
1732 	bool new_rule;
1733 	int max_num_ch;
1734 	struct iwl_reg_capa reg_capa;
1735 
1736 	if (cfg->uhb_supported) {
1737 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1738 		nvm_chan = iwl_uhb_nvm_channels;
1739 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1740 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1741 		nvm_chan = iwl_ext_nvm_channels;
1742 	} else {
1743 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1744 		nvm_chan = iwl_nvm_channels;
1745 	}
1746 
1747 	if (num_of_ch > max_num_ch) {
1748 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1749 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1750 			      num_of_ch, max_num_ch);
1751 		num_of_ch = max_num_ch;
1752 	}
1753 
1754 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1755 		return ERR_PTR(-EINVAL);
1756 
1757 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1758 		      num_of_ch);
1759 
1760 	/* build a regdomain rule for every valid channel */
1761 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1762 	if (!regd)
1763 		return ERR_PTR(-ENOMEM);
1764 
1765 	/* set alpha2 from FW. */
1766 	regd->alpha2[0] = fw_mcc >> 8;
1767 	regd->alpha2[1] = fw_mcc & 0xff;
1768 
1769 	/* parse regulatory capability flags */
1770 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1771 
1772 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1773 		enum nl80211_band band =
1774 			iwl_nl80211_band_from_channel_idx(ch_idx);
1775 
1776 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1777 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1778 							     band);
1779 		new_rule = false;
1780 
1781 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1782 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1783 						    nvm_chan[ch_idx], ch_flags);
1784 			continue;
1785 		}
1786 
1787 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1788 							     ch_flags,
1789 							     reg_capa);
1790 
1791 		/* we can't continue the same rule */
1792 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1793 		    center_freq - prev_center_freq > 20) {
1794 			valid_rules++;
1795 			new_rule = true;
1796 		}
1797 
1798 		rule = &regd->reg_rules[valid_rules - 1];
1799 
1800 		if (new_rule)
1801 			rule->freq_range.start_freq_khz =
1802 						MHZ_TO_KHZ(center_freq - 10);
1803 
1804 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1805 
1806 		/* this doesn't matter - not used by FW */
1807 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1808 		rule->power_rule.max_eirp =
1809 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1810 
1811 		rule->flags = reg_rule_flags;
1812 
1813 		/* rely on auto-calculation to merge BW of contiguous chans */
1814 		rule->flags |= NL80211_RRF_AUTO_BW;
1815 		rule->freq_range.max_bandwidth_khz = 0;
1816 
1817 		prev_center_freq = center_freq;
1818 		prev_reg_rule_flags = reg_rule_flags;
1819 
1820 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1821 					    nvm_chan[ch_idx], ch_flags);
1822 
1823 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1824 		    band == NL80211_BAND_2GHZ)
1825 			continue;
1826 
1827 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1828 	}
1829 
1830 	/*
1831 	 * Certain firmware versions might report no valid channels
1832 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1833 	 * running. We'll get out of this situation later when the
1834 	 * rfkill is removed and we update the regdomain again, but
1835 	 * since cfg80211 doesn't accept an empty regdomain, add a
1836 	 * dummy (unusable) rule here in this case so we can init.
1837 	 */
1838 	if (!valid_rules) {
1839 		valid_rules = 1;
1840 		rule = &regd->reg_rules[valid_rules - 1];
1841 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1842 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1843 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1844 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1845 		rule->power_rule.max_eirp =
1846 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1847 	}
1848 
1849 	regd->n_reg_rules = valid_rules;
1850 
1851 	/*
1852 	 * Narrow down regdom for unused regulatory rules to prevent hole
1853 	 * between reg rules to wmm rules.
1854 	 */
1855 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1856 			  GFP_KERNEL);
1857 	if (!copy_rd)
1858 		copy_rd = ERR_PTR(-ENOMEM);
1859 
1860 	kfree(regd);
1861 	return copy_rd;
1862 }
1863 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1864 
1865 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1866 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1867 #define MAX_NVM_FILE_LEN	16384
1868 
1869 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1870 		    unsigned int len)
1871 {
1872 #define IWL_4165_DEVICE_ID	0x5501
1873 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1874 
1875 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1876 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1877 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1878 		/* OTP 0x52 bug work around: it's a 1x1 device */
1879 		data[3] = ANT_B | (ANT_B << 4);
1880 }
1881 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1882 
1883 /*
1884  * Reads external NVM from a file into mvm->nvm_sections
1885  *
1886  * HOW TO CREATE THE NVM FILE FORMAT:
1887  * ------------------------------
1888  * 1. create hex file, format:
1889  *      3800 -> header
1890  *      0000 -> header
1891  *      5a40 -> data
1892  *
1893  *   rev - 6 bit (word1)
1894  *   len - 10 bit (word1)
1895  *   id - 4 bit (word2)
1896  *   rsv - 12 bit (word2)
1897  *
1898  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1899  *
1900  * 3. create binary file from the hex file
1901  *
1902  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1903  */
1904 int iwl_read_external_nvm(struct iwl_trans *trans,
1905 			  const char *nvm_file_name,
1906 			  struct iwl_nvm_section *nvm_sections)
1907 {
1908 	int ret, section_size;
1909 	u16 section_id;
1910 	const struct firmware *fw_entry;
1911 	const struct {
1912 		__le16 word1;
1913 		__le16 word2;
1914 		u8 data[];
1915 	} *file_sec;
1916 	const u8 *eof;
1917 	u8 *temp;
1918 	int max_section_size;
1919 	const __le32 *dword_buff;
1920 
1921 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1922 #define NVM_WORD2_ID(x) (x >> 12)
1923 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1924 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1925 #define NVM_HEADER_0	(0x2A504C54)
1926 #define NVM_HEADER_1	(0x4E564D2A)
1927 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1928 
1929 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1930 
1931 	/* Maximal size depends on NVM version */
1932 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1933 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1934 	else
1935 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1936 
1937 	/*
1938 	 * Obtain NVM image via request_firmware. Since we already used
1939 	 * request_firmware_nowait() for the firmware binary load and only
1940 	 * get here after that we assume the NVM request can be satisfied
1941 	 * synchronously.
1942 	 */
1943 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1944 	if (ret) {
1945 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1946 			nvm_file_name, ret);
1947 		return ret;
1948 	}
1949 
1950 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1951 		 nvm_file_name, fw_entry->size);
1952 
1953 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1954 		IWL_ERR(trans, "NVM file too large\n");
1955 		ret = -EINVAL;
1956 		goto out;
1957 	}
1958 
1959 	eof = fw_entry->data + fw_entry->size;
1960 	dword_buff = (const __le32 *)fw_entry->data;
1961 
1962 	/* some NVM file will contain a header.
1963 	 * The header is identified by 2 dwords header as follow:
1964 	 * dword[0] = 0x2A504C54
1965 	 * dword[1] = 0x4E564D2A
1966 	 *
1967 	 * This header must be skipped when providing the NVM data to the FW.
1968 	 */
1969 	if (fw_entry->size > NVM_HEADER_SIZE &&
1970 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1971 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1972 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1973 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1974 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1975 			 le32_to_cpu(dword_buff[3]));
1976 
1977 		/* nvm file validation, dword_buff[2] holds the file version */
1978 		if (trans->mac_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1979 		    trans->info.hw_rev_step == SILICON_C_STEP &&
1980 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1981 			ret = -EFAULT;
1982 			goto out;
1983 		}
1984 	} else {
1985 		file_sec = (const void *)fw_entry->data;
1986 	}
1987 
1988 	while (true) {
1989 		if (file_sec->data > eof) {
1990 			IWL_ERR(trans,
1991 				"ERROR - NVM file too short for section header\n");
1992 			ret = -EINVAL;
1993 			break;
1994 		}
1995 
1996 		/* check for EOF marker */
1997 		if (!file_sec->word1 && !file_sec->word2) {
1998 			ret = 0;
1999 			break;
2000 		}
2001 
2002 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
2003 			section_size =
2004 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
2005 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
2006 		} else {
2007 			section_size = 2 * EXT_NVM_WORD2_LEN(
2008 						le16_to_cpu(file_sec->word2));
2009 			section_id = EXT_NVM_WORD1_ID(
2010 						le16_to_cpu(file_sec->word1));
2011 		}
2012 
2013 		if (section_size > max_section_size) {
2014 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
2015 				section_size);
2016 			ret = -EINVAL;
2017 			break;
2018 		}
2019 
2020 		if (!section_size) {
2021 			IWL_ERR(trans, "ERROR - section empty\n");
2022 			ret = -EINVAL;
2023 			break;
2024 		}
2025 
2026 		if (file_sec->data + section_size > eof) {
2027 			IWL_ERR(trans,
2028 				"ERROR - NVM file too short for section (%d bytes)\n",
2029 				section_size);
2030 			ret = -EINVAL;
2031 			break;
2032 		}
2033 
2034 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
2035 			 "Invalid NVM section ID %d\n", section_id)) {
2036 			ret = -EINVAL;
2037 			break;
2038 		}
2039 
2040 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
2041 		if (!temp) {
2042 			ret = -ENOMEM;
2043 			break;
2044 		}
2045 
2046 		iwl_nvm_fixups(trans->info.hw_id, section_id, temp, section_size);
2047 
2048 		kfree(nvm_sections[section_id].data);
2049 		nvm_sections[section_id].data = temp;
2050 		nvm_sections[section_id].length = section_size;
2051 
2052 		/* advance to the next section */
2053 		file_sec = (const void *)(file_sec->data + section_size);
2054 	}
2055 out:
2056 	release_firmware(fw_entry);
2057 	return ret;
2058 }
2059 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
2060 
2061 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
2062 				 const struct iwl_fw *fw,
2063 				 u8 set_tx_ant, u8 set_rx_ant)
2064 {
2065 	struct iwl_nvm_get_info cmd = {};
2066 	struct iwl_nvm_data *nvm;
2067 	struct iwl_host_cmd hcmd = {
2068 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
2069 		.data = { &cmd, },
2070 		.len = { sizeof(cmd) },
2071 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
2072 	};
2073 	int  ret;
2074 	bool empty_otp;
2075 	u32 mac_flags;
2076 	u32 sbands_flags = 0;
2077 	u8 tx_ant;
2078 	u8 rx_ant;
2079 
2080 	/*
2081 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
2082 	 * in v3, except for the channel profile part of the
2083 	 * regulatory.  So we can just access the new struct, with the
2084 	 * exception of the latter.
2085 	 */
2086 	struct iwl_nvm_get_info_rsp *rsp;
2087 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
2088 	bool v4 = fw_has_api(&fw->ucode_capa,
2089 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
2090 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
2091 	void *channel_profile;
2092 
2093 	ret = iwl_trans_send_cmd(trans, &hcmd);
2094 	if (ret)
2095 		return ERR_PTR(ret);
2096 
2097 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
2098 		 "Invalid payload len in NVM response from FW %d",
2099 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
2100 		ret = -EINVAL;
2101 		goto out;
2102 	}
2103 
2104 	rsp = (void *)hcmd.resp_pkt->data;
2105 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
2106 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
2107 	if (empty_otp)
2108 		IWL_INFO(trans, "OTP is empty\n");
2109 
2110 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
2111 	if (!nvm) {
2112 		ret = -ENOMEM;
2113 		goto out;
2114 	}
2115 
2116 	iwl_set_hw_address_from_csr(trans, nvm);
2117 	/* TODO: if platform NVM has MAC address - override it here */
2118 
2119 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2120 		IWL_ERR(trans, "no valid mac address was found\n");
2121 		ret = -EINVAL;
2122 		goto err_free;
2123 	}
2124 
2125 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2126 
2127 	/* Initialize general data */
2128 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2129 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2130 	if (nvm->n_hw_addrs == 0)
2131 		IWL_WARN(trans,
2132 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2133 			 empty_otp);
2134 
2135 	/* Initialize MAC sku data */
2136 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2137 	nvm->sku_cap_11ac_enable =
2138 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2139 	nvm->sku_cap_11n_enable =
2140 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2141 	nvm->sku_cap_11ax_enable =
2142 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2143 	nvm->sku_cap_band_24ghz_enable =
2144 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2145 	nvm->sku_cap_band_52ghz_enable =
2146 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2147 	nvm->sku_cap_mimo_disabled =
2148 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2149 	if (CSR_HW_RFID_TYPE(trans->info.hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
2150 		nvm->sku_cap_11be_enable = true;
2151 
2152 	/* Initialize PHY sku data */
2153 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2154 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2155 
2156 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2157 	    fw_has_capa(&fw->ucode_capa,
2158 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2159 		nvm->lar_enabled = true;
2160 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2161 	}
2162 
2163 	rsp_v3 = (void *)rsp;
2164 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2165 			  (void *)rsp_v3->regulatory.channel_profile;
2166 
2167 	tx_ant = nvm->valid_tx_ant & fw->valid_tx_ant;
2168 	rx_ant = nvm->valid_rx_ant & fw->valid_rx_ant;
2169 
2170 	if (set_tx_ant)
2171 		tx_ant &= set_tx_ant;
2172 	if (set_rx_ant)
2173 		rx_ant &= set_rx_ant;
2174 
2175 	iwl_init_sbands(trans, nvm, channel_profile, tx_ant, rx_ant,
2176 			sbands_flags, v4, fw);
2177 
2178 	iwl_free_resp(&hcmd);
2179 	return nvm;
2180 
2181 err_free:
2182 	kfree(nvm);
2183 out:
2184 	iwl_free_resp(&hcmd);
2185 	return ERR_PTR(ret);
2186 }
2187 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2188