1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2023 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM calibration section offset (in words) definitions */
42 	NVM_CALIB_SECTION = 0x2B8,
43 	XTAL_CALIB = 0x316 - NVM_CALIB_SECTION,
44 
45 	/* NVM REGULATORY -Section offset (in words) definitions */
46 	NVM_CHANNELS_SDP = 0,
47 };
48 
49 enum ext_nvm_offsets {
50 	/* NVM HW-Section offset (in words) definitions */
51 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
52 
53 	/* NVM SW-Section offset (in words) definitions */
54 	NVM_VERSION_EXT_NVM = 0,
55 	N_HW_ADDRS_FAMILY_8000 = 3,
56 
57 	/* NVM PHY_SKU-Section offset (in words) definitions */
58 	RADIO_CFG_FAMILY_EXT_NVM = 0,
59 	SKU_FAMILY_8000 = 2,
60 
61 	/* NVM REGULATORY -Section offset (in words) definitions */
62 	NVM_CHANNELS_EXTENDED = 0,
63 	NVM_LAR_OFFSET_OLD = 0x4C7,
64 	NVM_LAR_OFFSET = 0x507,
65 	NVM_LAR_ENABLED = 0x7,
66 };
67 
68 /* SKU Capabilities (actual values from NVM definition) */
69 enum nvm_sku_bits {
70 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
71 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
72 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
73 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
74 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
75 };
76 
77 /*
78  * These are the channel numbers in the order that they are stored in the NVM
79  */
80 static const u16 iwl_nvm_channels[] = {
81 	/* 2.4 GHz */
82 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
83 	/* 5 GHz */
84 	36, 40, 44, 48, 52, 56, 60, 64,
85 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
86 	149, 153, 157, 161, 165
87 };
88 
89 static const u16 iwl_ext_nvm_channels[] = {
90 	/* 2.4 GHz */
91 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
92 	/* 5 GHz */
93 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
94 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
95 	149, 153, 157, 161, 165, 169, 173, 177, 181
96 };
97 
98 static const u16 iwl_uhb_nvm_channels[] = {
99 	/* 2.4 GHz */
100 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
101 	/* 5 GHz */
102 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
103 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
104 	149, 153, 157, 161, 165, 169, 173, 177, 181,
105 	/* 6-7 GHz */
106 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
107 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
108 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
109 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
110 };
111 
112 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
113 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
114 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
115 #define NUM_2GHZ_CHANNELS		14
116 #define NUM_5GHZ_CHANNELS		37
117 #define FIRST_2GHZ_HT_MINUS		5
118 #define LAST_2GHZ_HT_PLUS		9
119 #define N_HW_ADDR_MASK			0xF
120 
121 /* rate data (static) */
122 static struct ieee80211_rate iwl_cfg80211_rates[] = {
123 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
124 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
125 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
126 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
127 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
128 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
129 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
130 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
131 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
132 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
133 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
134 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
135 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
136 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
137 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
138 };
139 #define RATES_24_OFFS	0
140 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
141 #define RATES_52_OFFS	4
142 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
143 
144 /**
145  * enum iwl_nvm_channel_flags - channel flags in NVM
146  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
147  * @NVM_CHANNEL_IBSS: usable as an IBSS channel
148  * @NVM_CHANNEL_ACTIVE: active scanning allowed
149  * @NVM_CHANNEL_RADAR: radar detection required
150  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
151  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
152  *	on same channel on 2.4 or same UNII band on 5.2
153  * @NVM_CHANNEL_UNIFORM: uniform spreading required
154  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
155  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
156  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
157  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
158  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
159  */
160 enum iwl_nvm_channel_flags {
161 	NVM_CHANNEL_VALID		= BIT(0),
162 	NVM_CHANNEL_IBSS		= BIT(1),
163 	NVM_CHANNEL_ACTIVE		= BIT(3),
164 	NVM_CHANNEL_RADAR		= BIT(4),
165 	NVM_CHANNEL_INDOOR_ONLY		= BIT(5),
166 	NVM_CHANNEL_GO_CONCURRENT	= BIT(6),
167 	NVM_CHANNEL_UNIFORM		= BIT(7),
168 	NVM_CHANNEL_20MHZ		= BIT(8),
169 	NVM_CHANNEL_40MHZ		= BIT(9),
170 	NVM_CHANNEL_80MHZ		= BIT(10),
171 	NVM_CHANNEL_160MHZ		= BIT(11),
172 	NVM_CHANNEL_DC_HIGH		= BIT(12),
173 };
174 
175 /**
176  * enum iwl_reg_capa_flags_v1 - global flags applied for the whole regulatory
177  * domain.
178  * @REG_CAPA_V1_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
179  *	2.4Ghz band is allowed.
180  * @REG_CAPA_V1_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
181  *	5Ghz band is allowed.
182  * @REG_CAPA_V1_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
183  *	for this regulatory domain (valid only in 5Ghz).
184  * @REG_CAPA_V1_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
185  *	for this regulatory domain (valid only in 5Ghz).
186  * @REG_CAPA_V1_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
187  * @REG_CAPA_V1_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
188  * @REG_CAPA_V1_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
189  *	for this regulatory domain (valid only in 5Ghz).
190  * @REG_CAPA_V1_DC_HIGH_ENABLED: DC HIGH allowed.
191  * @REG_CAPA_V1_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
192  */
193 enum iwl_reg_capa_flags_v1 {
194 	REG_CAPA_V1_BF_CCD_LOW_BAND	= BIT(0),
195 	REG_CAPA_V1_BF_CCD_HIGH_BAND	= BIT(1),
196 	REG_CAPA_V1_160MHZ_ALLOWED	= BIT(2),
197 	REG_CAPA_V1_80MHZ_ALLOWED	= BIT(3),
198 	REG_CAPA_V1_MCS_8_ALLOWED	= BIT(4),
199 	REG_CAPA_V1_MCS_9_ALLOWED	= BIT(5),
200 	REG_CAPA_V1_40MHZ_FORBIDDEN	= BIT(7),
201 	REG_CAPA_V1_DC_HIGH_ENABLED	= BIT(9),
202 	REG_CAPA_V1_11AX_DISABLED	= BIT(10),
203 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_1 */
204 
205 /**
206  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
207  * domain (version 2).
208  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
209  *	disabled.
210  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
211  *	2.4Ghz band is allowed.
212  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
213  *	5Ghz band is allowed.
214  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
215  *	for this regulatory domain (valid only in 5Ghz).
216  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
217  *	for this regulatory domain (valid only in 5Ghz).
218  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
219  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
220  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
221  *	126, 122) are disabled.
222  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
223  *	for this regulatory domain (uvalid only in 5Ghz).
224  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
225  */
226 enum iwl_reg_capa_flags_v2 {
227 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
228 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
229 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
230 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
231 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
232 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
233 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
234 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
235 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
236 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
237 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_2 */
238 
239 /**
240  * enum iwl_reg_capa_flags_v4 - global flags applied for the whole regulatory
241  * domain.
242  * @REG_CAPA_V4_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
243  *	for this regulatory domain (valid only in 5Ghz).
244  * @REG_CAPA_V4_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
245  *	for this regulatory domain (valid only in 5Ghz).
246  * @REG_CAPA_V4_MCS_12_ALLOWED: 11ac with MCS 12 is allowed.
247  * @REG_CAPA_V4_MCS_13_ALLOWED: 11ac with MCS 13 is allowed.
248  * @REG_CAPA_V4_11BE_DISABLED: 11be is forbidden for this regulatory domain.
249  * @REG_CAPA_V4_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
250  * @REG_CAPA_V4_320MHZ_ALLOWED: 11be channel with a width of 320Mhz is allowed
251  *	for this regulatory domain (valid only in 5GHz).
252  */
253 enum iwl_reg_capa_flags_v4 {
254 	REG_CAPA_V4_160MHZ_ALLOWED		= BIT(3),
255 	REG_CAPA_V4_80MHZ_ALLOWED		= BIT(4),
256 	REG_CAPA_V4_MCS_12_ALLOWED		= BIT(5),
257 	REG_CAPA_V4_MCS_13_ALLOWED		= BIT(6),
258 	REG_CAPA_V4_11BE_DISABLED		= BIT(8),
259 	REG_CAPA_V4_11AX_DISABLED		= BIT(13),
260 	REG_CAPA_V4_320MHZ_ALLOWED		= BIT(16),
261 }; /* GEO_CHANNEL_CAPABILITIES_API_S_VER_4 */
262 
263 /*
264 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
265 * MCC update command response.
266 */
267 #define REG_CAPA_V2_RESP_VER	6
268 
269 /* API v4 for reg_capa_flags is relevant from version 8 and onwards of the
270  * MCC update command response.
271  */
272 #define REG_CAPA_V4_RESP_VER	8
273 
274 /**
275  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
276  * handling the different APIs of reg_capa_flags.
277  *
278  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
279  *	for this regulatory domain.
280  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
281  *	for this regulatory domain (valid only in 5 and 6 Ghz).
282  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
283  *	for this regulatory domain (valid only in 5 and 6 Ghz).
284  * @allow_320mhz: 11be channel with a width of 320Mhz is allowed
285  *	for this regulatory domain (valid only in 6 Ghz).
286  * @disable_11ax: 11ax is forbidden for this regulatory domain.
287  * @disable_11be: 11be is forbidden for this regulatory domain.
288  */
289 struct iwl_reg_capa {
290 	bool allow_40mhz;
291 	bool allow_80mhz;
292 	bool allow_160mhz;
293 	bool allow_320mhz;
294 	bool disable_11ax;
295 	bool disable_11be;
296 };
297 
298 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
299 					       int chan, u32 flags)
300 {
301 #define CHECK_AND_PRINT_I(x)	\
302 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
303 
304 	if (!(flags & NVM_CHANNEL_VALID)) {
305 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
306 			      chan, flags);
307 		return;
308 	}
309 
310 	/* Note: already can print up to 101 characters, 110 is the limit! */
311 	IWL_DEBUG_DEV(dev, level,
312 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s\n",
313 		      chan, flags,
314 		      CHECK_AND_PRINT_I(VALID),
315 		      CHECK_AND_PRINT_I(IBSS),
316 		      CHECK_AND_PRINT_I(ACTIVE),
317 		      CHECK_AND_PRINT_I(RADAR),
318 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
319 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
320 		      CHECK_AND_PRINT_I(UNIFORM),
321 		      CHECK_AND_PRINT_I(20MHZ),
322 		      CHECK_AND_PRINT_I(40MHZ),
323 		      CHECK_AND_PRINT_I(80MHZ),
324 		      CHECK_AND_PRINT_I(160MHZ),
325 		      CHECK_AND_PRINT_I(DC_HIGH));
326 #undef CHECK_AND_PRINT_I
327 }
328 
329 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
330 				 u32 nvm_flags, const struct iwl_cfg *cfg)
331 {
332 	u32 flags = IEEE80211_CHAN_NO_HT40;
333 
334 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
335 		if (ch_num <= LAST_2GHZ_HT_PLUS)
336 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
337 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
338 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
339 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
340 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
341 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
342 		else
343 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
344 	}
345 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
346 		flags |= IEEE80211_CHAN_NO_80MHZ;
347 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
348 		flags |= IEEE80211_CHAN_NO_160MHZ;
349 
350 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
351 		flags |= IEEE80211_CHAN_NO_IR;
352 
353 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
354 		flags |= IEEE80211_CHAN_NO_IR;
355 
356 	if (nvm_flags & NVM_CHANNEL_RADAR)
357 		flags |= IEEE80211_CHAN_RADAR;
358 
359 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
360 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
361 
362 	/* Set the GO concurrent flag only in case that NO_IR is set.
363 	 * Otherwise it is meaningless
364 	 */
365 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
366 	    (flags & IEEE80211_CHAN_NO_IR))
367 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
368 
369 	return flags;
370 }
371 
372 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
373 {
374 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
375 		return NL80211_BAND_6GHZ;
376 	}
377 
378 	if (ch_idx >= NUM_2GHZ_CHANNELS)
379 		return NL80211_BAND_5GHZ;
380 	return NL80211_BAND_2GHZ;
381 }
382 
383 static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
384 				struct iwl_nvm_data *data,
385 				const void * const nvm_ch_flags,
386 				u32 sbands_flags, bool v4)
387 {
388 	int ch_idx;
389 	int n_channels = 0;
390 	struct ieee80211_channel *channel;
391 	u32 ch_flags;
392 	int num_of_ch;
393 	const u16 *nvm_chan;
394 
395 	if (cfg->uhb_supported) {
396 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
397 		nvm_chan = iwl_uhb_nvm_channels;
398 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
399 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
400 		nvm_chan = iwl_ext_nvm_channels;
401 	} else {
402 		num_of_ch = IWL_NVM_NUM_CHANNELS;
403 		nvm_chan = iwl_nvm_channels;
404 	}
405 
406 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
407 		enum nl80211_band band =
408 			iwl_nl80211_band_from_channel_idx(ch_idx);
409 
410 		if (v4)
411 			ch_flags =
412 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
413 		else
414 			ch_flags =
415 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
416 
417 		if (band == NL80211_BAND_5GHZ &&
418 		    !data->sku_cap_band_52ghz_enable)
419 			continue;
420 
421 		/* workaround to disable wide channels in 5GHz */
422 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
423 		    band == NL80211_BAND_5GHZ) {
424 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
425 				     NVM_CHANNEL_80MHZ |
426 				     NVM_CHANNEL_160MHZ);
427 		}
428 
429 		if (ch_flags & NVM_CHANNEL_160MHZ)
430 			data->vht160_supported = true;
431 
432 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
433 		    !(ch_flags & NVM_CHANNEL_VALID)) {
434 			/*
435 			 * Channels might become valid later if lar is
436 			 * supported, hence we still want to add them to
437 			 * the list of supported channels to cfg80211.
438 			 */
439 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
440 						    nvm_chan[ch_idx], ch_flags);
441 			continue;
442 		}
443 
444 		channel = &data->channels[n_channels];
445 		n_channels++;
446 
447 		channel->hw_value = nvm_chan[ch_idx];
448 		channel->band = band;
449 		channel->center_freq =
450 			ieee80211_channel_to_frequency(
451 				channel->hw_value, channel->band);
452 
453 		/* Initialize regulatory-based run-time data */
454 
455 		/*
456 		 * Default value - highest tx power value.  max_power
457 		 * is not used in mvm, and is used for backwards compatibility
458 		 */
459 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
460 
461 		/* don't put limitations in case we're using LAR */
462 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
463 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
464 							       ch_idx, band,
465 							       ch_flags, cfg);
466 		else
467 			channel->flags = 0;
468 
469 		/* TODO: Don't put limitations on UHB devices as we still don't
470 		 * have NVM for them
471 		 */
472 		if (cfg->uhb_supported)
473 			channel->flags = 0;
474 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
475 					    channel->hw_value, ch_flags);
476 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
477 				 channel->hw_value, channel->max_power);
478 	}
479 
480 	return n_channels;
481 }
482 
483 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
484 				  struct iwl_nvm_data *data,
485 				  struct ieee80211_sta_vht_cap *vht_cap,
486 				  u8 tx_chains, u8 rx_chains)
487 {
488 	const struct iwl_cfg *cfg = trans->cfg;
489 	int num_rx_ants = num_of_ant(rx_chains);
490 	int num_tx_ants = num_of_ant(tx_chains);
491 
492 	vht_cap->vht_supported = true;
493 
494 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
495 		       IEEE80211_VHT_CAP_RXSTBC_1 |
496 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
497 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
498 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
499 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
500 
501 	if (!trans->cfg->ht_params->stbc)
502 		vht_cap->cap &= ~IEEE80211_VHT_CAP_RXSTBC_MASK;
503 
504 	if (data->vht160_supported)
505 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
506 				IEEE80211_VHT_CAP_SHORT_GI_160;
507 
508 	if (cfg->vht_mu_mimo_supported)
509 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
510 
511 	if (cfg->ht_params->ldpc)
512 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
513 
514 	if (data->sku_cap_mimo_disabled) {
515 		num_rx_ants = 1;
516 		num_tx_ants = 1;
517 	}
518 
519 	if (trans->cfg->ht_params->stbc && num_tx_ants > 1)
520 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
521 	else
522 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
523 
524 	switch (iwlwifi_mod_params.amsdu_size) {
525 	case IWL_AMSDU_DEF:
526 		if (trans->trans_cfg->mq_rx_supported)
527 			vht_cap->cap |=
528 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
529 		else
530 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
531 		break;
532 	case IWL_AMSDU_2K:
533 		if (trans->trans_cfg->mq_rx_supported)
534 			vht_cap->cap |=
535 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
536 		else
537 			WARN(1, "RB size of 2K is not supported by this device\n");
538 		break;
539 	case IWL_AMSDU_4K:
540 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
541 		break;
542 	case IWL_AMSDU_8K:
543 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
544 		break;
545 	case IWL_AMSDU_12K:
546 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
547 		break;
548 	default:
549 		break;
550 	}
551 
552 	vht_cap->vht_mcs.rx_mcs_map =
553 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
554 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
555 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
556 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
557 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
558 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
559 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
560 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
561 
562 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
563 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
564 		/* this works because NOT_SUPPORTED == 3 */
565 		vht_cap->vht_mcs.rx_mcs_map |=
566 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
567 	}
568 
569 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
570 
571 	vht_cap->vht_mcs.tx_highest |=
572 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
573 }
574 
575 static const u8 iwl_vendor_caps[] = {
576 	0xdd,			/* vendor element */
577 	0x06,			/* length */
578 	0x00, 0x17, 0x35,	/* Intel OUI */
579 	0x08,			/* type (Intel Capabilities) */
580 	/* followed by 16 bits of capabilities */
581 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
582 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
583 	0x00
584 };
585 
586 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
587 	{
588 		.types_mask = BIT(NL80211_IFTYPE_STATION),
589 		.he_cap = {
590 			.has_he = true,
591 			.he_cap_elem = {
592 				.mac_cap_info[0] =
593 					IEEE80211_HE_MAC_CAP0_HTC_HE,
594 				.mac_cap_info[1] =
595 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
596 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
597 				.mac_cap_info[2] =
598 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
599 				.mac_cap_info[3] =
600 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
601 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
602 				.mac_cap_info[4] =
603 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
604 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
605 				.mac_cap_info[5] =
606 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
607 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
608 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
609 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
610 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
611 				.phy_cap_info[1] =
612 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
613 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
614 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
615 				.phy_cap_info[2] =
616 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
617 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
618 				.phy_cap_info[3] =
619 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
620 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
621 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
622 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
623 				.phy_cap_info[4] =
624 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
625 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
626 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
627 				.phy_cap_info[6] =
628 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
629 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
630 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
631 				.phy_cap_info[7] =
632 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
633 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
634 				.phy_cap_info[8] =
635 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
636 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
637 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
638 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
639 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
640 				.phy_cap_info[9] =
641 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
642 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
643 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
644 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
645 				.phy_cap_info[10] =
646 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
647 			},
648 			/*
649 			 * Set default Tx/Rx HE MCS NSS Support field.
650 			 * Indicate support for up to 2 spatial streams and all
651 			 * MCS, without any special cases
652 			 */
653 			.he_mcs_nss_supp = {
654 				.rx_mcs_80 = cpu_to_le16(0xfffa),
655 				.tx_mcs_80 = cpu_to_le16(0xfffa),
656 				.rx_mcs_160 = cpu_to_le16(0xfffa),
657 				.tx_mcs_160 = cpu_to_le16(0xfffa),
658 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
659 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
660 			},
661 			/*
662 			 * Set default PPE thresholds, with PPET16 set to 0,
663 			 * PPET8 set to 7
664 			 */
665 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
666 		},
667 		.eht_cap = {
668 			.has_eht = true,
669 			.eht_cap_elem = {
670 				.mac_cap_info[0] =
671 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
672 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
673 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
674 				.phy_cap_info[0] =
675 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
676 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
677 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
678 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
679 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
680 				.phy_cap_info[1] =
681 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
682 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
683 				.phy_cap_info[3] =
684 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
685 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
686 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
687 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
688 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
689 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
690 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
691 
692 				.phy_cap_info[4] =
693 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
694 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
695 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
696 				.phy_cap_info[5] =
697 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
698 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
699 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
700 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT,
701 				.phy_cap_info[6] =
702 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
703 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
704 				.phy_cap_info[8] =
705 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
706 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
707 			},
708 
709 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
710 			 * Rx - note we don't set the only_20mhz, but due to this
711 			 * being a union, it gets set correctly anyway.
712 			 */
713 			.eht_mcs_nss_supp = {
714 				.bw._80 = {
715 					.rx_tx_mcs9_max_nss = 0x22,
716 					.rx_tx_mcs11_max_nss = 0x22,
717 					.rx_tx_mcs13_max_nss = 0x22,
718 				},
719 				.bw._160 = {
720 					.rx_tx_mcs9_max_nss = 0x22,
721 					.rx_tx_mcs11_max_nss = 0x22,
722 					.rx_tx_mcs13_max_nss = 0x22,
723 				},
724 				.bw._320 = {
725 					.rx_tx_mcs9_max_nss = 0x22,
726 					.rx_tx_mcs11_max_nss = 0x22,
727 					.rx_tx_mcs13_max_nss = 0x22,
728 				},
729 			},
730 
731 			/*
732 			 * PPE thresholds for NSS = 2, and RU index bitmap set
733 			 * to 0xc.
734 			 */
735 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
736 		},
737 	},
738 	{
739 		.types_mask = BIT(NL80211_IFTYPE_AP),
740 		.he_cap = {
741 			.has_he = true,
742 			.he_cap_elem = {
743 				.mac_cap_info[0] =
744 					IEEE80211_HE_MAC_CAP0_HTC_HE,
745 				.mac_cap_info[1] =
746 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
747 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
748 				.mac_cap_info[3] =
749 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
750 				.phy_cap_info[1] =
751 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
752 				.phy_cap_info[2] =
753 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
754 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
755 				.phy_cap_info[3] =
756 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
757 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
758 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
759 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
760 				.phy_cap_info[6] =
761 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
762 				.phy_cap_info[7] =
763 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
764 				.phy_cap_info[8] =
765 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
766 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
767 				.phy_cap_info[9] =
768 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
769 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
770 			},
771 			/*
772 			 * Set default Tx/Rx HE MCS NSS Support field.
773 			 * Indicate support for up to 2 spatial streams and all
774 			 * MCS, without any special cases
775 			 */
776 			.he_mcs_nss_supp = {
777 				.rx_mcs_80 = cpu_to_le16(0xfffa),
778 				.tx_mcs_80 = cpu_to_le16(0xfffa),
779 				.rx_mcs_160 = cpu_to_le16(0xfffa),
780 				.tx_mcs_160 = cpu_to_le16(0xfffa),
781 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
782 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
783 			},
784 			/*
785 			 * Set default PPE thresholds, with PPET16 set to 0,
786 			 * PPET8 set to 7
787 			 */
788 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
789 		},
790 		.eht_cap = {
791 			.has_eht = true,
792 			.eht_cap_elem = {
793 				.mac_cap_info[0] =
794 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
795 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
796 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
797 				.phy_cap_info[0] =
798 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
799 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
800 				.phy_cap_info[5] =
801 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT,
802 			},
803 
804 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
805 			 * Rx - note we don't set the only_20mhz, but due to this
806 			 * being a union, it gets set correctly anyway.
807 			 */
808 			.eht_mcs_nss_supp = {
809 				.bw._80 = {
810 					.rx_tx_mcs9_max_nss = 0x22,
811 					.rx_tx_mcs11_max_nss = 0x22,
812 					.rx_tx_mcs13_max_nss = 0x22,
813 				},
814 				.bw._160 = {
815 					.rx_tx_mcs9_max_nss = 0x22,
816 					.rx_tx_mcs11_max_nss = 0x22,
817 					.rx_tx_mcs13_max_nss = 0x22,
818 				},
819 				.bw._320 = {
820 					.rx_tx_mcs9_max_nss = 0x22,
821 					.rx_tx_mcs11_max_nss = 0x22,
822 					.rx_tx_mcs13_max_nss = 0x22,
823 				},
824 			},
825 
826 			/*
827 			 * PPE thresholds for NSS = 2, and RU index bitmap set
828 			 * to 0xc.
829 			 */
830 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
831 		},
832 	},
833 };
834 
835 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
836 				  struct iwl_nvm_data *data,
837 				  struct ieee80211_supported_band *sband,
838 				  u8 tx_chains, u8 rx_chains)
839 {
840 	struct ieee80211_sta_ht_cap ht_cap;
841 	struct ieee80211_sta_vht_cap vht_cap = {};
842 	struct ieee80211_sband_iftype_data *iftype_data;
843 	u16 he_6ghz_capa = 0;
844 	u32 exp;
845 	int i;
846 
847 	if (sband->band != NL80211_BAND_6GHZ)
848 		return;
849 
850 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
851 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
852 			     tx_chains, rx_chains);
853 	WARN_ON(!ht_cap.ht_supported);
854 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
855 	WARN_ON(!vht_cap.vht_supported);
856 
857 	he_6ghz_capa |=
858 		u16_encode_bits(ht_cap.ampdu_density,
859 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
860 	exp = u32_get_bits(vht_cap.cap,
861 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
862 	he_6ghz_capa |=
863 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
864 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
865 	he_6ghz_capa |=
866 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
867 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
868 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
869 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
870 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
871 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
872 
873 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
874 
875 	/* we know it's writable - we set it before ourselves */
876 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
877 	for (i = 0; i < sband->n_iftype_data; i++)
878 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
879 }
880 
881 static void
882 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
883 			 struct iwl_nvm_data *data,
884 			 struct ieee80211_supported_band *sband,
885 			 struct ieee80211_sband_iftype_data *iftype_data,
886 			 u8 tx_chains, u8 rx_chains,
887 			 const struct iwl_fw *fw)
888 {
889 	bool is_ap = iftype_data->types_mask & BIT(NL80211_IFTYPE_AP);
890 	bool no_320;
891 
892 	no_320 = !trans->trans_cfg->integrated &&
893 		 trans->pcie_link_speed < PCI_EXP_LNKSTA_CLS_8_0GB;
894 
895 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be)
896 		iftype_data->eht_cap.has_eht = false;
897 
898 	/* Advertise an A-MPDU exponent extension based on
899 	 * operating band
900 	 */
901 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
902 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
903 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
904 	else if (sband->band != NL80211_BAND_2GHZ)
905 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
906 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
907 	else
908 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
909 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
910 
911 	switch (sband->band) {
912 	case NL80211_BAND_2GHZ:
913 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
914 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
915 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
916 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
917 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
918 		break;
919 	case NL80211_BAND_6GHZ:
920 		if (!no_320) {
921 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
922 				IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
923 			iftype_data->eht_cap.eht_cap_elem.phy_cap_info[1] |=
924 				IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
925 		}
926 		fallthrough;
927 	case NL80211_BAND_5GHZ:
928 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
929 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
930 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
931 		break;
932 	default:
933 		WARN_ON(1);
934 		break;
935 	}
936 
937 	if ((tx_chains & rx_chains) == ANT_AB) {
938 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
939 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
940 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
941 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
942 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
943 		if (!is_ap) {
944 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
945 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
946 
947 			if (iftype_data->eht_cap.has_eht) {
948 				/*
949 				 * Set the number of sounding dimensions for each
950 				 * bandwidth to 1 to indicate the maximal supported
951 				 * value of TXVECTOR parameter NUM_STS of 2
952 				 */
953 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
954 
955 				/*
956 				 * Set the MAX NC to 1 to indicate sounding feedback of
957 				 * 2 supported by the beamfomee.
958 				 */
959 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
960 			}
961 		}
962 	} else {
963 		if (iftype_data->eht_cap.has_eht) {
964 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
965 				&iftype_data->eht_cap.eht_mcs_nss_supp;
966 
967 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
968 		}
969 
970 		if (!is_ap) {
971 			/* If not 2x2, we need to indicate 1x1 in the
972 			 * Midamble RX Max NSTS - but not for AP mode
973 			 */
974 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
975 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
976 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
977 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
978 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
979 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
980 		}
981 	}
982 
983 	if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
984 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
985 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
986 
987 	switch (CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
988 	case IWL_CFG_RF_TYPE_GF:
989 	case IWL_CFG_RF_TYPE_MR:
990 	case IWL_CFG_RF_TYPE_MS:
991 	case IWL_CFG_RF_TYPE_FM:
992 	case IWL_CFG_RF_TYPE_WH:
993 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
994 			IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
995 		if (!is_ap)
996 			iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
997 				IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
998 		break;
999 	}
1000 
1001 	if (CSR_HW_REV_TYPE(trans->hw_rev) == IWL_CFG_MAC_TYPE_GL &&
1002 	    iftype_data->eht_cap.has_eht) {
1003 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] &=
1004 			~(IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
1005 			  IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2);
1006 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[3] &=
1007 			~(IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
1008 			  IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
1009 			  IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
1010 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
1011 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
1012 			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
1013 			  IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK);
1014 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &=
1015 			~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
1016 			  IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP);
1017 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] &=
1018 			~IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK;
1019 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[6] &=
1020 			~(IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
1021 			  IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP);
1022 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] |=
1023 			IEEE80211_EHT_PHY_CAP5_SUPP_EXTRA_EHT_LTF;
1024 	}
1025 
1026 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
1027 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
1028 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
1029 
1030 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1031 	    !is_ap) {
1032 		iftype_data->vendor_elems.data = iwl_vendor_caps;
1033 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
1034 	}
1035 
1036 	if (!trans->cfg->ht_params->stbc) {
1037 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
1038 			~IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
1039 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] &=
1040 			~IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
1041 	}
1042 }
1043 
1044 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
1045 				 struct iwl_nvm_data *data,
1046 				 struct ieee80211_supported_band *sband,
1047 				 u8 tx_chains, u8 rx_chains,
1048 				 const struct iwl_fw *fw)
1049 {
1050 	struct ieee80211_sband_iftype_data *iftype_data;
1051 	int i;
1052 
1053 	/* should only initialize once */
1054 	if (WARN_ON(sband->iftype_data))
1055 		return;
1056 
1057 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1058 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1059 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1060 
1061 	switch (sband->band) {
1062 	case NL80211_BAND_2GHZ:
1063 		iftype_data = data->iftd.low;
1064 		break;
1065 	case NL80211_BAND_5GHZ:
1066 		iftype_data = data->iftd.high;
1067 		break;
1068 	case NL80211_BAND_6GHZ:
1069 		iftype_data = data->iftd.uhb;
1070 		break;
1071 	default:
1072 		WARN_ON(1);
1073 		return;
1074 	}
1075 
1076 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1077 
1078 	sband->iftype_data = iftype_data;
1079 	sband->n_iftype_data = ARRAY_SIZE(iwl_he_eht_capa);
1080 
1081 	for (i = 0; i < sband->n_iftype_data; i++)
1082 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1083 					 tx_chains, rx_chains, fw);
1084 
1085 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1086 }
1087 
1088 static void iwl_init_sbands(struct iwl_trans *trans,
1089 			    struct iwl_nvm_data *data,
1090 			    const void *nvm_ch_flags, u8 tx_chains,
1091 			    u8 rx_chains, u32 sbands_flags, bool v4,
1092 			    const struct iwl_fw *fw)
1093 {
1094 	struct device *dev = trans->dev;
1095 	const struct iwl_cfg *cfg = trans->cfg;
1096 	int n_channels;
1097 	int n_used = 0;
1098 	struct ieee80211_supported_band *sband;
1099 
1100 	n_channels = iwl_init_channel_map(dev, cfg, data, nvm_ch_flags,
1101 					  sbands_flags, v4);
1102 	sband = &data->bands[NL80211_BAND_2GHZ];
1103 	sband->band = NL80211_BAND_2GHZ;
1104 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1105 	sband->n_bitrates = N_RATES_24;
1106 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1107 					  NL80211_BAND_2GHZ);
1108 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1109 			     tx_chains, rx_chains);
1110 
1111 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1112 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1113 				     fw);
1114 
1115 	sband = &data->bands[NL80211_BAND_5GHZ];
1116 	sband->band = NL80211_BAND_5GHZ;
1117 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1118 	sband->n_bitrates = N_RATES_52;
1119 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1120 					  NL80211_BAND_5GHZ);
1121 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1122 			     tx_chains, rx_chains);
1123 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1124 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1125 				      tx_chains, rx_chains);
1126 
1127 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1128 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1129 				     fw);
1130 
1131 	/* 6GHz band. */
1132 	sband = &data->bands[NL80211_BAND_6GHZ];
1133 	sband->band = NL80211_BAND_6GHZ;
1134 	/* use the same rates as 5GHz band */
1135 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1136 	sband->n_bitrates = N_RATES_52;
1137 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1138 					  NL80211_BAND_6GHZ);
1139 
1140 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1141 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1142 				     fw);
1143 	else
1144 		sband->n_channels = 0;
1145 	if (n_channels != n_used)
1146 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1147 			    n_used, n_channels);
1148 }
1149 
1150 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1151 		       const __le16 *phy_sku)
1152 {
1153 	if (cfg->nvm_type != IWL_NVM_EXT)
1154 		return le16_to_cpup(nvm_sw + SKU);
1155 
1156 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1157 }
1158 
1159 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1160 {
1161 	if (cfg->nvm_type != IWL_NVM_EXT)
1162 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1163 	else
1164 		return le32_to_cpup((const __le32 *)(nvm_sw +
1165 						     NVM_VERSION_EXT_NVM));
1166 }
1167 
1168 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1169 			     const __le16 *phy_sku)
1170 {
1171 	if (cfg->nvm_type != IWL_NVM_EXT)
1172 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1173 
1174 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1175 
1176 }
1177 
1178 static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1179 {
1180 	int n_hw_addr;
1181 
1182 	if (cfg->nvm_type != IWL_NVM_EXT)
1183 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1184 
1185 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1186 
1187 	return n_hw_addr & N_HW_ADDR_MASK;
1188 }
1189 
1190 static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
1191 			      struct iwl_nvm_data *data,
1192 			      u32 radio_cfg)
1193 {
1194 	if (cfg->nvm_type != IWL_NVM_EXT) {
1195 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1196 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1197 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1198 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1199 		return;
1200 	}
1201 
1202 	/* set the radio configuration for family 8000 */
1203 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1204 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1205 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1206 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1207 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1208 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1209 }
1210 
1211 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1212 {
1213 	const u8 *hw_addr;
1214 
1215 	hw_addr = (const u8 *)&mac_addr0;
1216 	dest[0] = hw_addr[3];
1217 	dest[1] = hw_addr[2];
1218 	dest[2] = hw_addr[1];
1219 	dest[3] = hw_addr[0];
1220 
1221 	hw_addr = (const u8 *)&mac_addr1;
1222 	dest[4] = hw_addr[1];
1223 	dest[5] = hw_addr[0];
1224 }
1225 
1226 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1227 					struct iwl_nvm_data *data)
1228 {
1229 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1230 						  CSR_MAC_ADDR0_STRAP(trans)));
1231 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1232 						  CSR_MAC_ADDR1_STRAP(trans)));
1233 
1234 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1235 	/*
1236 	 * If the OEM fused a valid address, use it instead of the one in the
1237 	 * OTP
1238 	 */
1239 	if (is_valid_ether_addr(data->hw_addr))
1240 		return;
1241 
1242 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1243 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1244 
1245 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1246 }
1247 
1248 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1249 					   const struct iwl_cfg *cfg,
1250 					   struct iwl_nvm_data *data,
1251 					   const __le16 *mac_override,
1252 					   const __be16 *nvm_hw)
1253 {
1254 	const u8 *hw_addr;
1255 
1256 	if (mac_override) {
1257 		static const u8 reserved_mac[] = {
1258 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1259 		};
1260 
1261 		hw_addr = (const u8 *)(mac_override +
1262 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1263 
1264 		/*
1265 		 * Store the MAC address from MAO section.
1266 		 * No byte swapping is required in MAO section
1267 		 */
1268 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1269 
1270 		/*
1271 		 * Force the use of the OTP MAC address in case of reserved MAC
1272 		 * address in the NVM, or if address is given but invalid.
1273 		 */
1274 		if (is_valid_ether_addr(data->hw_addr) &&
1275 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1276 			return;
1277 
1278 		IWL_ERR(trans,
1279 			"mac address from nvm override section is not valid\n");
1280 	}
1281 
1282 	if (nvm_hw) {
1283 		/* read the mac address from WFMP registers */
1284 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1285 						WFMP_MAC_ADDR_0));
1286 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1287 						WFMP_MAC_ADDR_1));
1288 
1289 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1290 
1291 		return;
1292 	}
1293 
1294 	IWL_ERR(trans, "mac address is not found\n");
1295 }
1296 
1297 static int iwl_set_hw_address(struct iwl_trans *trans,
1298 			      const struct iwl_cfg *cfg,
1299 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1300 			      const __le16 *mac_override)
1301 {
1302 	if (cfg->mac_addr_from_csr) {
1303 		iwl_set_hw_address_from_csr(trans, data);
1304 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1305 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1306 
1307 		/* The byte order is little endian 16 bit, meaning 214365 */
1308 		data->hw_addr[0] = hw_addr[1];
1309 		data->hw_addr[1] = hw_addr[0];
1310 		data->hw_addr[2] = hw_addr[3];
1311 		data->hw_addr[3] = hw_addr[2];
1312 		data->hw_addr[4] = hw_addr[5];
1313 		data->hw_addr[5] = hw_addr[4];
1314 	} else {
1315 		iwl_set_hw_address_family_8000(trans, cfg, data,
1316 					       mac_override, nvm_hw);
1317 	}
1318 
1319 	if (!is_valid_ether_addr(data->hw_addr)) {
1320 		IWL_ERR(trans, "no valid mac address was found\n");
1321 		return -EINVAL;
1322 	}
1323 
1324 	if (!trans->csme_own)
1325 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1326 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1327 
1328 	return 0;
1329 }
1330 
1331 static bool
1332 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1333 			const __be16 *nvm_hw)
1334 {
1335 	/*
1336 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1337 	 * some 7000-family OTPs erroneously allow wide channels in
1338 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1339 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1340 	 * 9.  In those cases, we need to force-disable wide channels
1341 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1342 	 * to use them.
1343 	 */
1344 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1345 		/*
1346 		 * Unlike the other sections in the NVM, the hw
1347 		 * section uses big-endian.
1348 		 */
1349 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1350 		u8 sku = (subsystem_id & 0x1e) >> 1;
1351 
1352 		if (sku == 5 || sku == 9) {
1353 			IWL_DEBUG_EEPROM(trans->dev,
1354 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1355 					 subsystem_id, sku);
1356 			return true;
1357 		}
1358 	}
1359 
1360 	return false;
1361 }
1362 
1363 struct iwl_nvm_data *
1364 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1365 		       const struct iwl_mei_nvm *mei_nvm,
1366 		       const struct iwl_fw *fw)
1367 {
1368 	struct iwl_nvm_data *data;
1369 	u32 sbands_flags = 0;
1370 	u8 rx_chains = fw->valid_rx_ant;
1371 	u8 tx_chains = fw->valid_rx_ant;
1372 
1373 	if (cfg->uhb_supported)
1374 		data = kzalloc(struct_size(data, channels,
1375 					   IWL_NVM_NUM_CHANNELS_UHB),
1376 					   GFP_KERNEL);
1377 	else
1378 		data = kzalloc(struct_size(data, channels,
1379 					   IWL_NVM_NUM_CHANNELS_EXT),
1380 					   GFP_KERNEL);
1381 	if (!data)
1382 		return NULL;
1383 
1384 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1385 		     IWL_NVM_NUM_CHANNELS_UHB);
1386 	data->nvm_version = mei_nvm->nvm_version;
1387 
1388 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1389 	if (data->valid_tx_ant)
1390 		tx_chains &= data->valid_tx_ant;
1391 	if (data->valid_rx_ant)
1392 		rx_chains &= data->valid_rx_ant;
1393 
1394 	data->sku_cap_mimo_disabled = false;
1395 	data->sku_cap_band_24ghz_enable = true;
1396 	data->sku_cap_band_52ghz_enable = true;
1397 	data->sku_cap_11n_enable =
1398 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1399 	data->sku_cap_11ac_enable = true;
1400 	data->sku_cap_11ax_enable =
1401 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1402 
1403 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1404 
1405 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1406 	/* If no valid mac address was found - bail out */
1407 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1408 		kfree(data);
1409 		return NULL;
1410 	}
1411 
1412 	if (data->lar_enabled &&
1413 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1414 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1415 
1416 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1417 			sbands_flags, true, fw);
1418 
1419 	return data;
1420 }
1421 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1422 
1423 struct iwl_nvm_data *
1424 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1425 		   const struct iwl_fw *fw,
1426 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1427 		   const __le16 *nvm_calib, const __le16 *regulatory,
1428 		   const __le16 *mac_override, const __le16 *phy_sku,
1429 		   u8 tx_chains, u8 rx_chains)
1430 {
1431 	struct iwl_nvm_data *data;
1432 	bool lar_enabled;
1433 	u32 sku, radio_cfg;
1434 	u32 sbands_flags = 0;
1435 	u16 lar_config;
1436 	const __le16 *ch_section;
1437 
1438 	if (cfg->uhb_supported)
1439 		data = kzalloc(struct_size(data, channels,
1440 					   IWL_NVM_NUM_CHANNELS_UHB),
1441 					   GFP_KERNEL);
1442 	else if (cfg->nvm_type != IWL_NVM_EXT)
1443 		data = kzalloc(struct_size(data, channels,
1444 					   IWL_NVM_NUM_CHANNELS),
1445 					   GFP_KERNEL);
1446 	else
1447 		data = kzalloc(struct_size(data, channels,
1448 					   IWL_NVM_NUM_CHANNELS_EXT),
1449 					   GFP_KERNEL);
1450 	if (!data)
1451 		return NULL;
1452 
1453 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1454 
1455 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1456 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1457 	if (data->valid_tx_ant)
1458 		tx_chains &= data->valid_tx_ant;
1459 	if (data->valid_rx_ant)
1460 		rx_chains &= data->valid_rx_ant;
1461 
1462 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1463 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1464 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1465 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1466 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1467 		data->sku_cap_11n_enable = false;
1468 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1469 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1470 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1471 
1472 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1473 
1474 	if (cfg->nvm_type != IWL_NVM_EXT) {
1475 		/* Checking for required sections */
1476 		if (!nvm_calib) {
1477 			IWL_ERR(trans,
1478 				"Can't parse empty Calib NVM sections\n");
1479 			kfree(data);
1480 			return NULL;
1481 		}
1482 
1483 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1484 			     &regulatory[NVM_CHANNELS_SDP] :
1485 			     &nvm_sw[NVM_CHANNELS];
1486 
1487 		/* in family 8000 Xtal calibration values moved to OTP */
1488 		data->xtal_calib[0] = *(nvm_calib + XTAL_CALIB);
1489 		data->xtal_calib[1] = *(nvm_calib + XTAL_CALIB + 1);
1490 		lar_enabled = true;
1491 	} else {
1492 		u16 lar_offset = data->nvm_version < 0xE39 ?
1493 				 NVM_LAR_OFFSET_OLD :
1494 				 NVM_LAR_OFFSET;
1495 
1496 		lar_config = le16_to_cpup(regulatory + lar_offset);
1497 		data->lar_enabled = !!(lar_config &
1498 				       NVM_LAR_ENABLED);
1499 		lar_enabled = data->lar_enabled;
1500 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1501 	}
1502 
1503 	/* If no valid mac address was found - bail out */
1504 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1505 		kfree(data);
1506 		return NULL;
1507 	}
1508 
1509 	if (lar_enabled &&
1510 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1511 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1512 
1513 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1514 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1515 
1516 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1517 			sbands_flags, false, fw);
1518 	data->calib_version = 255;
1519 
1520 	return data;
1521 }
1522 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1523 
1524 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1525 				       int ch_idx, u16 nvm_flags,
1526 				       struct iwl_reg_capa reg_capa,
1527 				       const struct iwl_cfg *cfg)
1528 {
1529 	u32 flags = NL80211_RRF_NO_HT40;
1530 
1531 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1532 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1533 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1534 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1535 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1536 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1537 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1538 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1539 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1540 		else
1541 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1542 	}
1543 
1544 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1545 		flags |= NL80211_RRF_NO_80MHZ;
1546 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1547 		flags |= NL80211_RRF_NO_160MHZ;
1548 
1549 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1550 		flags |= NL80211_RRF_NO_IR;
1551 
1552 	if (nvm_flags & NVM_CHANNEL_RADAR)
1553 		flags |= NL80211_RRF_DFS;
1554 
1555 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1556 		flags |= NL80211_RRF_NO_OUTDOOR;
1557 
1558 	/* Set the GO concurrent flag only in case that NO_IR is set.
1559 	 * Otherwise it is meaningless
1560 	 */
1561 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
1562 	    (flags & NL80211_RRF_NO_IR))
1563 		flags |= NL80211_RRF_GO_CONCURRENT;
1564 
1565 	/*
1566 	 * reg_capa is per regulatory domain so apply it for every channel
1567 	 */
1568 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1569 		if (!reg_capa.allow_40mhz)
1570 			flags |= NL80211_RRF_NO_HT40;
1571 
1572 		if (!reg_capa.allow_80mhz)
1573 			flags |= NL80211_RRF_NO_80MHZ;
1574 
1575 		if (!reg_capa.allow_160mhz)
1576 			flags |= NL80211_RRF_NO_160MHZ;
1577 
1578 		if (!reg_capa.allow_320mhz)
1579 			flags |= NL80211_RRF_NO_320MHZ;
1580 	}
1581 
1582 	if (reg_capa.disable_11ax)
1583 		flags |= NL80211_RRF_NO_HE;
1584 
1585 	if (reg_capa.disable_11be)
1586 		flags |= NL80211_RRF_NO_EHT;
1587 
1588 	return flags;
1589 }
1590 
1591 static struct iwl_reg_capa iwl_get_reg_capa(u32 flags, u8 resp_ver)
1592 {
1593 	struct iwl_reg_capa reg_capa = {};
1594 
1595 	if (resp_ver >= REG_CAPA_V4_RESP_VER) {
1596 		reg_capa.allow_40mhz = true;
1597 		reg_capa.allow_80mhz = flags & REG_CAPA_V4_80MHZ_ALLOWED;
1598 		reg_capa.allow_160mhz = flags & REG_CAPA_V4_160MHZ_ALLOWED;
1599 		reg_capa.allow_320mhz = flags & REG_CAPA_V4_320MHZ_ALLOWED;
1600 		reg_capa.disable_11ax = flags & REG_CAPA_V4_11AX_DISABLED;
1601 		reg_capa.disable_11be = flags & REG_CAPA_V4_11BE_DISABLED;
1602 	} else if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1603 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1604 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1605 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1606 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1607 	} else {
1608 		reg_capa.allow_40mhz = !(flags & REG_CAPA_V1_40MHZ_FORBIDDEN);
1609 		reg_capa.allow_80mhz = flags & REG_CAPA_V1_80MHZ_ALLOWED;
1610 		reg_capa.allow_160mhz = flags & REG_CAPA_V1_160MHZ_ALLOWED;
1611 		reg_capa.disable_11ax = flags & REG_CAPA_V1_11AX_DISABLED;
1612 	}
1613 	return reg_capa;
1614 }
1615 
1616 struct ieee80211_regdomain *
1617 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
1618 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1619 		       u16 geo_info, u32 cap, u8 resp_ver)
1620 {
1621 	int ch_idx;
1622 	u16 ch_flags;
1623 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1624 	const u16 *nvm_chan;
1625 	struct ieee80211_regdomain *regd, *copy_rd;
1626 	struct ieee80211_reg_rule *rule;
1627 	enum nl80211_band band;
1628 	int center_freq, prev_center_freq = 0;
1629 	int valid_rules = 0;
1630 	bool new_rule;
1631 	int max_num_ch;
1632 	struct iwl_reg_capa reg_capa;
1633 
1634 	if (cfg->uhb_supported) {
1635 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1636 		nvm_chan = iwl_uhb_nvm_channels;
1637 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1638 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1639 		nvm_chan = iwl_ext_nvm_channels;
1640 	} else {
1641 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1642 		nvm_chan = iwl_nvm_channels;
1643 	}
1644 
1645 	if (num_of_ch > max_num_ch) {
1646 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1647 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1648 			      num_of_ch, max_num_ch);
1649 		num_of_ch = max_num_ch;
1650 	}
1651 
1652 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1653 		return ERR_PTR(-EINVAL);
1654 
1655 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1656 		      num_of_ch);
1657 
1658 	/* build a regdomain rule for every valid channel */
1659 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1660 	if (!regd)
1661 		return ERR_PTR(-ENOMEM);
1662 
1663 	/* set alpha2 from FW. */
1664 	regd->alpha2[0] = fw_mcc >> 8;
1665 	regd->alpha2[1] = fw_mcc & 0xff;
1666 
1667 	/* parse regulatory capability flags */
1668 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1669 
1670 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1671 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1672 		band = iwl_nl80211_band_from_channel_idx(ch_idx);
1673 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1674 							     band);
1675 		new_rule = false;
1676 
1677 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1678 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1679 						    nvm_chan[ch_idx], ch_flags);
1680 			continue;
1681 		}
1682 
1683 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1684 							     ch_flags, reg_capa,
1685 							     cfg);
1686 
1687 		/* we can't continue the same rule */
1688 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1689 		    center_freq - prev_center_freq > 20) {
1690 			valid_rules++;
1691 			new_rule = true;
1692 		}
1693 
1694 		rule = &regd->reg_rules[valid_rules - 1];
1695 
1696 		if (new_rule)
1697 			rule->freq_range.start_freq_khz =
1698 						MHZ_TO_KHZ(center_freq - 10);
1699 
1700 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1701 
1702 		/* this doesn't matter - not used by FW */
1703 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1704 		rule->power_rule.max_eirp =
1705 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1706 
1707 		rule->flags = reg_rule_flags;
1708 
1709 		/* rely on auto-calculation to merge BW of contiguous chans */
1710 		rule->flags |= NL80211_RRF_AUTO_BW;
1711 		rule->freq_range.max_bandwidth_khz = 0;
1712 
1713 		prev_center_freq = center_freq;
1714 		prev_reg_rule_flags = reg_rule_flags;
1715 
1716 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1717 					    nvm_chan[ch_idx], ch_flags);
1718 
1719 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1720 		    band == NL80211_BAND_2GHZ)
1721 			continue;
1722 
1723 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1724 	}
1725 
1726 	/*
1727 	 * Certain firmware versions might report no valid channels
1728 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1729 	 * running. We'll get out of this situation later when the
1730 	 * rfkill is removed and we update the regdomain again, but
1731 	 * since cfg80211 doesn't accept an empty regdomain, add a
1732 	 * dummy (unusable) rule here in this case so we can init.
1733 	 */
1734 	if (!valid_rules) {
1735 		valid_rules = 1;
1736 		rule = &regd->reg_rules[valid_rules - 1];
1737 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1738 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1739 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1740 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1741 		rule->power_rule.max_eirp =
1742 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1743 	}
1744 
1745 	regd->n_reg_rules = valid_rules;
1746 
1747 	/*
1748 	 * Narrow down regdom for unused regulatory rules to prevent hole
1749 	 * between reg rules to wmm rules.
1750 	 */
1751 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1752 			  GFP_KERNEL);
1753 	if (!copy_rd)
1754 		copy_rd = ERR_PTR(-ENOMEM);
1755 
1756 	kfree(regd);
1757 	return copy_rd;
1758 }
1759 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1760 
1761 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1762 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1763 #define MAX_NVM_FILE_LEN	16384
1764 
1765 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1766 		    unsigned int len)
1767 {
1768 #define IWL_4165_DEVICE_ID	0x5501
1769 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1770 
1771 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1772 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1773 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1774 		/* OTP 0x52 bug work around: it's a 1x1 device */
1775 		data[3] = ANT_B | (ANT_B << 4);
1776 }
1777 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1778 
1779 /*
1780  * Reads external NVM from a file into mvm->nvm_sections
1781  *
1782  * HOW TO CREATE THE NVM FILE FORMAT:
1783  * ------------------------------
1784  * 1. create hex file, format:
1785  *      3800 -> header
1786  *      0000 -> header
1787  *      5a40 -> data
1788  *
1789  *   rev - 6 bit (word1)
1790  *   len - 10 bit (word1)
1791  *   id - 4 bit (word2)
1792  *   rsv - 12 bit (word2)
1793  *
1794  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1795  *
1796  * 3. create binary file from the hex file
1797  *
1798  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1799  */
1800 int iwl_read_external_nvm(struct iwl_trans *trans,
1801 			  const char *nvm_file_name,
1802 			  struct iwl_nvm_section *nvm_sections)
1803 {
1804 	int ret, section_size;
1805 	u16 section_id;
1806 	const struct firmware *fw_entry;
1807 	const struct {
1808 		__le16 word1;
1809 		__le16 word2;
1810 		u8 data[];
1811 	} *file_sec;
1812 	const u8 *eof;
1813 	u8 *temp;
1814 	int max_section_size;
1815 	const __le32 *dword_buff;
1816 
1817 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1818 #define NVM_WORD2_ID(x) (x >> 12)
1819 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1820 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1821 #define NVM_HEADER_0	(0x2A504C54)
1822 #define NVM_HEADER_1	(0x4E564D2A)
1823 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1824 
1825 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1826 
1827 	/* Maximal size depends on NVM version */
1828 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1829 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1830 	else
1831 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1832 
1833 	/*
1834 	 * Obtain NVM image via request_firmware. Since we already used
1835 	 * request_firmware_nowait() for the firmware binary load and only
1836 	 * get here after that we assume the NVM request can be satisfied
1837 	 * synchronously.
1838 	 */
1839 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1840 	if (ret) {
1841 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1842 			nvm_file_name, ret);
1843 		return ret;
1844 	}
1845 
1846 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1847 		 nvm_file_name, fw_entry->size);
1848 
1849 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1850 		IWL_ERR(trans, "NVM file too large\n");
1851 		ret = -EINVAL;
1852 		goto out;
1853 	}
1854 
1855 	eof = fw_entry->data + fw_entry->size;
1856 	dword_buff = (const __le32 *)fw_entry->data;
1857 
1858 	/* some NVM file will contain a header.
1859 	 * The header is identified by 2 dwords header as follow:
1860 	 * dword[0] = 0x2A504C54
1861 	 * dword[1] = 0x4E564D2A
1862 	 *
1863 	 * This header must be skipped when providing the NVM data to the FW.
1864 	 */
1865 	if (fw_entry->size > NVM_HEADER_SIZE &&
1866 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1867 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1868 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1869 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1870 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1871 			 le32_to_cpu(dword_buff[3]));
1872 
1873 		/* nvm file validation, dword_buff[2] holds the file version */
1874 		if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1875 		    trans->hw_rev_step == SILICON_C_STEP &&
1876 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1877 			ret = -EFAULT;
1878 			goto out;
1879 		}
1880 	} else {
1881 		file_sec = (const void *)fw_entry->data;
1882 	}
1883 
1884 	while (true) {
1885 		if (file_sec->data > eof) {
1886 			IWL_ERR(trans,
1887 				"ERROR - NVM file too short for section header\n");
1888 			ret = -EINVAL;
1889 			break;
1890 		}
1891 
1892 		/* check for EOF marker */
1893 		if (!file_sec->word1 && !file_sec->word2) {
1894 			ret = 0;
1895 			break;
1896 		}
1897 
1898 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
1899 			section_size =
1900 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
1901 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
1902 		} else {
1903 			section_size = 2 * EXT_NVM_WORD2_LEN(
1904 						le16_to_cpu(file_sec->word2));
1905 			section_id = EXT_NVM_WORD1_ID(
1906 						le16_to_cpu(file_sec->word1));
1907 		}
1908 
1909 		if (section_size > max_section_size) {
1910 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
1911 				section_size);
1912 			ret = -EINVAL;
1913 			break;
1914 		}
1915 
1916 		if (!section_size) {
1917 			IWL_ERR(trans, "ERROR - section empty\n");
1918 			ret = -EINVAL;
1919 			break;
1920 		}
1921 
1922 		if (file_sec->data + section_size > eof) {
1923 			IWL_ERR(trans,
1924 				"ERROR - NVM file too short for section (%d bytes)\n",
1925 				section_size);
1926 			ret = -EINVAL;
1927 			break;
1928 		}
1929 
1930 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
1931 			 "Invalid NVM section ID %d\n", section_id)) {
1932 			ret = -EINVAL;
1933 			break;
1934 		}
1935 
1936 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
1937 		if (!temp) {
1938 			ret = -ENOMEM;
1939 			break;
1940 		}
1941 
1942 		iwl_nvm_fixups(trans->hw_id, section_id, temp, section_size);
1943 
1944 		kfree(nvm_sections[section_id].data);
1945 		nvm_sections[section_id].data = temp;
1946 		nvm_sections[section_id].length = section_size;
1947 
1948 		/* advance to the next section */
1949 		file_sec = (const void *)(file_sec->data + section_size);
1950 	}
1951 out:
1952 	release_firmware(fw_entry);
1953 	return ret;
1954 }
1955 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
1956 
1957 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
1958 				 const struct iwl_fw *fw)
1959 {
1960 	struct iwl_nvm_get_info cmd = {};
1961 	struct iwl_nvm_data *nvm;
1962 	struct iwl_host_cmd hcmd = {
1963 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
1964 		.data = { &cmd, },
1965 		.len = { sizeof(cmd) },
1966 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
1967 	};
1968 	int  ret;
1969 	bool empty_otp;
1970 	u32 mac_flags;
1971 	u32 sbands_flags = 0;
1972 	/*
1973 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
1974 	 * in v3, except for the channel profile part of the
1975 	 * regulatory.  So we can just access the new struct, with the
1976 	 * exception of the latter.
1977 	 */
1978 	struct iwl_nvm_get_info_rsp *rsp;
1979 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
1980 	bool v4 = fw_has_api(&fw->ucode_capa,
1981 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
1982 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
1983 	void *channel_profile;
1984 
1985 	ret = iwl_trans_send_cmd(trans, &hcmd);
1986 	if (ret)
1987 		return ERR_PTR(ret);
1988 
1989 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
1990 		 "Invalid payload len in NVM response from FW %d",
1991 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
1992 		ret = -EINVAL;
1993 		goto out;
1994 	}
1995 
1996 	rsp = (void *)hcmd.resp_pkt->data;
1997 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
1998 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
1999 	if (empty_otp)
2000 		IWL_INFO(trans, "OTP is empty\n");
2001 
2002 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
2003 	if (!nvm) {
2004 		ret = -ENOMEM;
2005 		goto out;
2006 	}
2007 
2008 	iwl_set_hw_address_from_csr(trans, nvm);
2009 	/* TODO: if platform NVM has MAC address - override it here */
2010 
2011 	if (!is_valid_ether_addr(nvm->hw_addr)) {
2012 		IWL_ERR(trans, "no valid mac address was found\n");
2013 		ret = -EINVAL;
2014 		goto err_free;
2015 	}
2016 
2017 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
2018 
2019 	/* Initialize general data */
2020 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
2021 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
2022 	if (nvm->n_hw_addrs == 0)
2023 		IWL_WARN(trans,
2024 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
2025 			 empty_otp);
2026 
2027 	/* Initialize MAC sku data */
2028 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
2029 	nvm->sku_cap_11ac_enable =
2030 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
2031 	nvm->sku_cap_11n_enable =
2032 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
2033 	nvm->sku_cap_11ax_enable =
2034 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
2035 	nvm->sku_cap_band_24ghz_enable =
2036 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
2037 	nvm->sku_cap_band_52ghz_enable =
2038 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
2039 	nvm->sku_cap_mimo_disabled =
2040 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
2041 	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
2042 		nvm->sku_cap_11be_enable = true;
2043 
2044 	/* Initialize PHY sku data */
2045 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
2046 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
2047 
2048 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
2049 	    fw_has_capa(&fw->ucode_capa,
2050 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
2051 		nvm->lar_enabled = true;
2052 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
2053 	}
2054 
2055 	rsp_v3 = (void *)rsp;
2056 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
2057 			  (void *)rsp_v3->regulatory.channel_profile;
2058 
2059 	iwl_init_sbands(trans, nvm,
2060 			channel_profile,
2061 			nvm->valid_tx_ant & fw->valid_tx_ant,
2062 			nvm->valid_rx_ant & fw->valid_rx_ant,
2063 			sbands_flags, v4, fw);
2064 
2065 	iwl_free_resp(&hcmd);
2066 	return nvm;
2067 
2068 err_free:
2069 	kfree(nvm);
2070 out:
2071 	iwl_free_resp(&hcmd);
2072 	return ERR_PTR(ret);
2073 }
2074 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2075