1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2021 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM calibration section offset (in words) definitions */
42 	NVM_CALIB_SECTION = 0x2B8,
43 	XTAL_CALIB = 0x316 - NVM_CALIB_SECTION,
44 
45 	/* NVM REGULATORY -Section offset (in words) definitions */
46 	NVM_CHANNELS_SDP = 0,
47 };
48 
49 enum ext_nvm_offsets {
50 	/* NVM HW-Section offset (in words) definitions */
51 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
52 
53 	/* NVM SW-Section offset (in words) definitions */
54 	NVM_VERSION_EXT_NVM = 0,
55 	N_HW_ADDRS_FAMILY_8000 = 3,
56 
57 	/* NVM PHY_SKU-Section offset (in words) definitions */
58 	RADIO_CFG_FAMILY_EXT_NVM = 0,
59 	SKU_FAMILY_8000 = 2,
60 
61 	/* NVM REGULATORY -Section offset (in words) definitions */
62 	NVM_CHANNELS_EXTENDED = 0,
63 	NVM_LAR_OFFSET_OLD = 0x4C7,
64 	NVM_LAR_OFFSET = 0x507,
65 	NVM_LAR_ENABLED = 0x7,
66 };
67 
68 /* SKU Capabilities (actual values from NVM definition) */
69 enum nvm_sku_bits {
70 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
71 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
72 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
73 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
74 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
75 };
76 
77 /*
78  * These are the channel numbers in the order that they are stored in the NVM
79  */
80 static const u16 iwl_nvm_channels[] = {
81 	/* 2.4 GHz */
82 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
83 	/* 5 GHz */
84 	36, 40, 44 , 48, 52, 56, 60, 64,
85 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
86 	149, 153, 157, 161, 165
87 };
88 
89 static const u16 iwl_ext_nvm_channels[] = {
90 	/* 2.4 GHz */
91 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
92 	/* 5 GHz */
93 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
94 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
95 	149, 153, 157, 161, 165, 169, 173, 177, 181
96 };
97 
98 static const u16 iwl_uhb_nvm_channels[] = {
99 	/* 2.4 GHz */
100 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
101 	/* 5 GHz */
102 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
103 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
104 	149, 153, 157, 161, 165, 169, 173, 177, 181,
105 	/* 6-7 GHz */
106 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
107 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
108 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
109 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
110 };
111 
112 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
113 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
114 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
115 #define NUM_2GHZ_CHANNELS		14
116 #define NUM_5GHZ_CHANNELS		37
117 #define FIRST_2GHZ_HT_MINUS		5
118 #define LAST_2GHZ_HT_PLUS		9
119 #define N_HW_ADDR_MASK			0xF
120 
121 /* rate data (static) */
122 static struct ieee80211_rate iwl_cfg80211_rates[] = {
123 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
124 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
125 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
126 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
127 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
128 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
129 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
130 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
131 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
132 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
133 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
134 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
135 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
136 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
137 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
138 };
139 #define RATES_24_OFFS	0
140 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
141 #define RATES_52_OFFS	4
142 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
143 
144 /**
145  * enum iwl_nvm_channel_flags - channel flags in NVM
146  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
147  * @NVM_CHANNEL_IBSS: usable as an IBSS channel
148  * @NVM_CHANNEL_ACTIVE: active scanning allowed
149  * @NVM_CHANNEL_RADAR: radar detection required
150  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
151  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
152  *	on same channel on 2.4 or same UNII band on 5.2
153  * @NVM_CHANNEL_UNIFORM: uniform spreading required
154  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
155  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
156  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
157  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
158  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
159  */
160 enum iwl_nvm_channel_flags {
161 	NVM_CHANNEL_VALID		= BIT(0),
162 	NVM_CHANNEL_IBSS		= BIT(1),
163 	NVM_CHANNEL_ACTIVE		= BIT(3),
164 	NVM_CHANNEL_RADAR		= BIT(4),
165 	NVM_CHANNEL_INDOOR_ONLY		= BIT(5),
166 	NVM_CHANNEL_GO_CONCURRENT	= BIT(6),
167 	NVM_CHANNEL_UNIFORM		= BIT(7),
168 	NVM_CHANNEL_20MHZ		= BIT(8),
169 	NVM_CHANNEL_40MHZ		= BIT(9),
170 	NVM_CHANNEL_80MHZ		= BIT(10),
171 	NVM_CHANNEL_160MHZ		= BIT(11),
172 	NVM_CHANNEL_DC_HIGH		= BIT(12),
173 };
174 
175 /**
176  * enum iwl_reg_capa_flags - global flags applied for the whole regulatory
177  * domain.
178  * @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
179  *	2.4Ghz band is allowed.
180  * @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
181  *	5Ghz band is allowed.
182  * @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
183  *	for this regulatory domain (valid only in 5Ghz).
184  * @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
185  *	for this regulatory domain (valid only in 5Ghz).
186  * @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
187  * @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
188  * @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
189  *	for this regulatory domain (valid only in 5Ghz).
190  * @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed.
191  * @REG_CAPA_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
192  */
193 enum iwl_reg_capa_flags {
194 	REG_CAPA_BF_CCD_LOW_BAND	= BIT(0),
195 	REG_CAPA_BF_CCD_HIGH_BAND	= BIT(1),
196 	REG_CAPA_160MHZ_ALLOWED		= BIT(2),
197 	REG_CAPA_80MHZ_ALLOWED		= BIT(3),
198 	REG_CAPA_MCS_8_ALLOWED		= BIT(4),
199 	REG_CAPA_MCS_9_ALLOWED		= BIT(5),
200 	REG_CAPA_40MHZ_FORBIDDEN	= BIT(7),
201 	REG_CAPA_DC_HIGH_ENABLED	= BIT(9),
202 	REG_CAPA_11AX_DISABLED		= BIT(10),
203 };
204 
205 /**
206  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
207  * domain (version 2).
208  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
209  *	disabled.
210  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
211  *	2.4Ghz band is allowed.
212  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
213  *	5Ghz band is allowed.
214  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
215  *	for this regulatory domain (valid only in 5Ghz).
216  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
217  *	for this regulatory domain (valid only in 5Ghz).
218  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
219  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
220  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
221  *	126, 122) are disabled.
222  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
223  *	for this regulatory domain (uvalid only in 5Ghz).
224  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
225  */
226 enum iwl_reg_capa_flags_v2 {
227 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
228 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
229 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
230 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
231 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
232 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
233 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
234 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
235 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
236 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
237 };
238 
239 /*
240 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
241 * MCC update command response.
242 */
243 #define REG_CAPA_V2_RESP_VER	6
244 
245 /**
246  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
247  * handling the different APIs of reg_capa_flags.
248  *
249  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
250  *	for this regulatory domain (valid only in 5Ghz).
251  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
252  *	for this regulatory domain (valid only in 5Ghz).
253  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
254  *	for this regulatory domain (valid only in 5Ghz).
255  * @disable_11ax: 11ax is forbidden for this regulatory domain.
256  */
257 struct iwl_reg_capa {
258 	u16 allow_40mhz;
259 	u16 allow_80mhz;
260 	u16 allow_160mhz;
261 	u16 disable_11ax;
262 };
263 
264 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
265 					       int chan, u32 flags)
266 {
267 #define CHECK_AND_PRINT_I(x)	\
268 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
269 
270 	if (!(flags & NVM_CHANNEL_VALID)) {
271 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
272 			      chan, flags);
273 		return;
274 	}
275 
276 	/* Note: already can print up to 101 characters, 110 is the limit! */
277 	IWL_DEBUG_DEV(dev, level,
278 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s\n",
279 		      chan, flags,
280 		      CHECK_AND_PRINT_I(VALID),
281 		      CHECK_AND_PRINT_I(IBSS),
282 		      CHECK_AND_PRINT_I(ACTIVE),
283 		      CHECK_AND_PRINT_I(RADAR),
284 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
285 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
286 		      CHECK_AND_PRINT_I(UNIFORM),
287 		      CHECK_AND_PRINT_I(20MHZ),
288 		      CHECK_AND_PRINT_I(40MHZ),
289 		      CHECK_AND_PRINT_I(80MHZ),
290 		      CHECK_AND_PRINT_I(160MHZ),
291 		      CHECK_AND_PRINT_I(DC_HIGH));
292 #undef CHECK_AND_PRINT_I
293 }
294 
295 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
296 				 u32 nvm_flags, const struct iwl_cfg *cfg)
297 {
298 	u32 flags = IEEE80211_CHAN_NO_HT40;
299 
300 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
301 		if (ch_num <= LAST_2GHZ_HT_PLUS)
302 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
303 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
304 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
305 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
306 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
307 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
308 		else
309 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
310 	}
311 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
312 		flags |= IEEE80211_CHAN_NO_80MHZ;
313 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
314 		flags |= IEEE80211_CHAN_NO_160MHZ;
315 
316 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
317 		flags |= IEEE80211_CHAN_NO_IR;
318 
319 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
320 		flags |= IEEE80211_CHAN_NO_IR;
321 
322 	if (nvm_flags & NVM_CHANNEL_RADAR)
323 		flags |= IEEE80211_CHAN_RADAR;
324 
325 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
326 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
327 
328 	/* Set the GO concurrent flag only in case that NO_IR is set.
329 	 * Otherwise it is meaningless
330 	 */
331 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
332 	    (flags & IEEE80211_CHAN_NO_IR))
333 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
334 
335 	return flags;
336 }
337 
338 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
339 {
340 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
341 		return NL80211_BAND_6GHZ;
342 	}
343 
344 	if (ch_idx >= NUM_2GHZ_CHANNELS)
345 		return NL80211_BAND_5GHZ;
346 	return NL80211_BAND_2GHZ;
347 }
348 
349 static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
350 				struct iwl_nvm_data *data,
351 				const void * const nvm_ch_flags,
352 				u32 sbands_flags, bool v4)
353 {
354 	int ch_idx;
355 	int n_channels = 0;
356 	struct ieee80211_channel *channel;
357 	u32 ch_flags;
358 	int num_of_ch;
359 	const u16 *nvm_chan;
360 
361 	if (cfg->uhb_supported) {
362 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
363 		nvm_chan = iwl_uhb_nvm_channels;
364 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
365 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
366 		nvm_chan = iwl_ext_nvm_channels;
367 	} else {
368 		num_of_ch = IWL_NVM_NUM_CHANNELS;
369 		nvm_chan = iwl_nvm_channels;
370 	}
371 
372 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
373 		enum nl80211_band band =
374 			iwl_nl80211_band_from_channel_idx(ch_idx);
375 
376 		if (v4)
377 			ch_flags =
378 				__le32_to_cpup((__le32 *)nvm_ch_flags + ch_idx);
379 		else
380 			ch_flags =
381 				__le16_to_cpup((__le16 *)nvm_ch_flags + ch_idx);
382 
383 		if (band == NL80211_BAND_5GHZ &&
384 		    !data->sku_cap_band_52ghz_enable)
385 			continue;
386 
387 		/* workaround to disable wide channels in 5GHz */
388 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
389 		    band == NL80211_BAND_5GHZ) {
390 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
391 				     NVM_CHANNEL_80MHZ |
392 				     NVM_CHANNEL_160MHZ);
393 		}
394 
395 		if (ch_flags & NVM_CHANNEL_160MHZ)
396 			data->vht160_supported = true;
397 
398 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
399 		    !(ch_flags & NVM_CHANNEL_VALID)) {
400 			/*
401 			 * Channels might become valid later if lar is
402 			 * supported, hence we still want to add them to
403 			 * the list of supported channels to cfg80211.
404 			 */
405 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
406 						    nvm_chan[ch_idx], ch_flags);
407 			continue;
408 		}
409 
410 		channel = &data->channels[n_channels];
411 		n_channels++;
412 
413 		channel->hw_value = nvm_chan[ch_idx];
414 		channel->band = band;
415 		channel->center_freq =
416 			ieee80211_channel_to_frequency(
417 				channel->hw_value, channel->band);
418 
419 		/* Initialize regulatory-based run-time data */
420 
421 		/*
422 		 * Default value - highest tx power value.  max_power
423 		 * is not used in mvm, and is used for backwards compatibility
424 		 */
425 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
426 
427 		/* don't put limitations in case we're using LAR */
428 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
429 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
430 							       ch_idx, band,
431 							       ch_flags, cfg);
432 		else
433 			channel->flags = 0;
434 
435 		/* TODO: Don't put limitations on UHB devices as we still don't
436 		 * have NVM for them
437 		 */
438 		if (cfg->uhb_supported)
439 			channel->flags = 0;
440 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
441 					    channel->hw_value, ch_flags);
442 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
443 				 channel->hw_value, channel->max_power);
444 	}
445 
446 	return n_channels;
447 }
448 
449 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
450 				  struct iwl_nvm_data *data,
451 				  struct ieee80211_sta_vht_cap *vht_cap,
452 				  u8 tx_chains, u8 rx_chains)
453 {
454 	const struct iwl_cfg *cfg = trans->cfg;
455 	int num_rx_ants = num_of_ant(rx_chains);
456 	int num_tx_ants = num_of_ant(tx_chains);
457 
458 	vht_cap->vht_supported = true;
459 
460 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
461 		       IEEE80211_VHT_CAP_RXSTBC_1 |
462 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
463 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
464 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
465 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
466 
467 	if (data->vht160_supported)
468 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
469 				IEEE80211_VHT_CAP_SHORT_GI_160;
470 
471 	if (cfg->vht_mu_mimo_supported)
472 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
473 
474 	if (cfg->ht_params->ldpc)
475 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
476 
477 	if (data->sku_cap_mimo_disabled) {
478 		num_rx_ants = 1;
479 		num_tx_ants = 1;
480 	}
481 
482 	if (num_tx_ants > 1)
483 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
484 	else
485 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
486 
487 	switch (iwlwifi_mod_params.amsdu_size) {
488 	case IWL_AMSDU_DEF:
489 		if (trans->trans_cfg->mq_rx_supported)
490 			vht_cap->cap |=
491 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
492 		else
493 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
494 		break;
495 	case IWL_AMSDU_2K:
496 		if (trans->trans_cfg->mq_rx_supported)
497 			vht_cap->cap |=
498 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
499 		else
500 			WARN(1, "RB size of 2K is not supported by this device\n");
501 		break;
502 	case IWL_AMSDU_4K:
503 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
504 		break;
505 	case IWL_AMSDU_8K:
506 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
507 		break;
508 	case IWL_AMSDU_12K:
509 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
510 		break;
511 	default:
512 		break;
513 	}
514 
515 	vht_cap->vht_mcs.rx_mcs_map =
516 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
517 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
518 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
519 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
520 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
521 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
522 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
523 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
524 
525 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
526 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
527 		/* this works because NOT_SUPPORTED == 3 */
528 		vht_cap->vht_mcs.rx_mcs_map |=
529 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
530 	}
531 
532 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
533 
534 	vht_cap->vht_mcs.tx_highest |=
535 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
536 }
537 
538 static const u8 iwl_vendor_caps[] = {
539 	0xdd,			/* vendor element */
540 	0x06,			/* length */
541 	0x00, 0x17, 0x35,	/* Intel OUI */
542 	0x08,			/* type (Intel Capabilities) */
543 	/* followed by 16 bits of capabilities */
544 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
545 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
546 	0x00
547 };
548 
549 static const struct ieee80211_sband_iftype_data iwl_he_capa[] = {
550 	{
551 		.types_mask = BIT(NL80211_IFTYPE_STATION),
552 		.he_cap = {
553 			.has_he = true,
554 			.he_cap_elem = {
555 				.mac_cap_info[0] =
556 					IEEE80211_HE_MAC_CAP0_HTC_HE,
557 				.mac_cap_info[1] =
558 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
559 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
560 				.mac_cap_info[2] =
561 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
562 				.mac_cap_info[3] =
563 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
564 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
565 				.mac_cap_info[4] =
566 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
567 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
568 				.mac_cap_info[5] =
569 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
570 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
571 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
572 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
573 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
574 				.phy_cap_info[0] =
575 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
576 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
577 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G,
578 				.phy_cap_info[1] =
579 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
580 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
581 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
582 				.phy_cap_info[2] =
583 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
584 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
585 				.phy_cap_info[3] =
586 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_NO_DCM |
587 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
588 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_NO_DCM |
589 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
590 				.phy_cap_info[4] =
591 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
592 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
593 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
594 				.phy_cap_info[6] =
595 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
596 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
597 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
598 				.phy_cap_info[7] =
599 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
600 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
601 				.phy_cap_info[8] =
602 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
603 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
604 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
605 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
606 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
607 				.phy_cap_info[9] =
608 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
609 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
610 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
611 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
612 				.phy_cap_info[10] =
613 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
614 			},
615 			/*
616 			 * Set default Tx/Rx HE MCS NSS Support field.
617 			 * Indicate support for up to 2 spatial streams and all
618 			 * MCS, without any special cases
619 			 */
620 			.he_mcs_nss_supp = {
621 				.rx_mcs_80 = cpu_to_le16(0xfffa),
622 				.tx_mcs_80 = cpu_to_le16(0xfffa),
623 				.rx_mcs_160 = cpu_to_le16(0xfffa),
624 				.tx_mcs_160 = cpu_to_le16(0xfffa),
625 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
626 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
627 			},
628 			/*
629 			 * Set default PPE thresholds, with PPET16 set to 0,
630 			 * PPET8 set to 7
631 			 */
632 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
633 		},
634 	},
635 	{
636 		.types_mask = BIT(NL80211_IFTYPE_AP),
637 		.he_cap = {
638 			.has_he = true,
639 			.he_cap_elem = {
640 				.mac_cap_info[0] =
641 					IEEE80211_HE_MAC_CAP0_HTC_HE,
642 				.mac_cap_info[1] =
643 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
644 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
645 				.mac_cap_info[3] =
646 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
647 				.phy_cap_info[0] =
648 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
649 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G,
650 				.phy_cap_info[1] =
651 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
652 				.phy_cap_info[2] =
653 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
654 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
655 				.phy_cap_info[3] =
656 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_NO_DCM |
657 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
658 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_NO_DCM |
659 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
660 				.phy_cap_info[6] =
661 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
662 				.phy_cap_info[7] =
663 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
664 				.phy_cap_info[8] =
665 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
666 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
667 				.phy_cap_info[9] =
668 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
669 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
670 			},
671 			/*
672 			 * Set default Tx/Rx HE MCS NSS Support field.
673 			 * Indicate support for up to 2 spatial streams and all
674 			 * MCS, without any special cases
675 			 */
676 			.he_mcs_nss_supp = {
677 				.rx_mcs_80 = cpu_to_le16(0xfffa),
678 				.tx_mcs_80 = cpu_to_le16(0xfffa),
679 				.rx_mcs_160 = cpu_to_le16(0xfffa),
680 				.tx_mcs_160 = cpu_to_le16(0xfffa),
681 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
682 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
683 			},
684 			/*
685 			 * Set default PPE thresholds, with PPET16 set to 0,
686 			 * PPET8 set to 7
687 			 */
688 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
689 		},
690 	},
691 };
692 
693 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
694 				  struct iwl_nvm_data *data,
695 				  struct ieee80211_supported_band *sband,
696 				  u8 tx_chains, u8 rx_chains)
697 {
698 	struct ieee80211_sta_ht_cap ht_cap;
699 	struct ieee80211_sta_vht_cap vht_cap = {};
700 	struct ieee80211_sband_iftype_data *iftype_data;
701 	u16 he_6ghz_capa = 0;
702 	u32 exp;
703 	int i;
704 
705 	if (sband->band != NL80211_BAND_6GHZ)
706 		return;
707 
708 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
709 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
710 			     tx_chains, rx_chains);
711 	WARN_ON(!ht_cap.ht_supported);
712 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
713 	WARN_ON(!vht_cap.vht_supported);
714 
715 	he_6ghz_capa |=
716 		u16_encode_bits(ht_cap.ampdu_density,
717 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
718 	exp = u32_get_bits(vht_cap.cap,
719 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
720 	he_6ghz_capa |=
721 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
722 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
723 	he_6ghz_capa |=
724 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
725 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
726 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
727 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
728 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
729 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
730 
731 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
732 
733 	/* we know it's writable - we set it before ourselves */
734 	iftype_data = (void *)sband->iftype_data;
735 	for (i = 0; i < sband->n_iftype_data; i++)
736 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
737 }
738 
739 static void
740 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
741 			 struct ieee80211_supported_band *sband,
742 			 struct ieee80211_sband_iftype_data *iftype_data,
743 			 u8 tx_chains, u8 rx_chains,
744 			 const struct iwl_fw *fw)
745 {
746 	bool is_ap = iftype_data->types_mask & BIT(NL80211_IFTYPE_AP);
747 
748 	/* Advertise an A-MPDU exponent extension based on
749 	 * operating band
750 	 */
751 	if (sband->band != NL80211_BAND_2GHZ)
752 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
753 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
754 	else
755 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
756 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
757 
758 	if (is_ap && iwlwifi_mod_params.nvm_file)
759 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
760 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
761 
762 	if ((tx_chains & rx_chains) == ANT_AB) {
763 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
764 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
765 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
766 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
767 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
768 		if (!is_ap)
769 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
770 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
771 	} else if (!is_ap) {
772 		/* If not 2x2, we need to indicate 1x1 in the
773 		 * Midamble RX Max NSTS - but not for AP mode
774 		 */
775 		iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
776 			~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
777 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
778 			~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
779 		iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
780 			IEEE80211_HE_PHY_CAP7_MAX_NC_1;
781 	}
782 
783 	switch (CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
784 	case IWL_CFG_RF_TYPE_GF:
785 	case IWL_CFG_RF_TYPE_MR:
786 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
787 			IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
788 		if (!is_ap)
789 			iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
790 				IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
791 		break;
792 	}
793 
794 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
795 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
796 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
797 
798 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
799 	    !is_ap) {
800 		iftype_data->vendor_elems.data = iwl_vendor_caps;
801 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
802 	}
803 }
804 
805 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
806 				 struct iwl_nvm_data *data,
807 				 struct ieee80211_supported_band *sband,
808 				 u8 tx_chains, u8 rx_chains,
809 				 const struct iwl_fw *fw)
810 {
811 	struct ieee80211_sband_iftype_data *iftype_data;
812 	int i;
813 
814 	/* should only initialize once */
815 	if (WARN_ON(sband->iftype_data))
816 		return;
817 
818 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_capa));
819 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_capa));
820 
821 	switch (sband->band) {
822 	case NL80211_BAND_2GHZ:
823 		iftype_data = data->iftd.low;
824 		break;
825 	case NL80211_BAND_5GHZ:
826 	case NL80211_BAND_6GHZ:
827 		iftype_data = data->iftd.high;
828 		break;
829 	default:
830 		WARN_ON(1);
831 		return;
832 	}
833 
834 	memcpy(iftype_data, iwl_he_capa, sizeof(iwl_he_capa));
835 
836 	sband->iftype_data = iftype_data;
837 	sband->n_iftype_data = ARRAY_SIZE(iwl_he_capa);
838 
839 	for (i = 0; i < sband->n_iftype_data; i++)
840 		iwl_nvm_fixup_sband_iftd(trans, sband, &iftype_data[i],
841 					 tx_chains, rx_chains, fw);
842 
843 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
844 }
845 
846 static void iwl_init_sbands(struct iwl_trans *trans,
847 			    struct iwl_nvm_data *data,
848 			    const void *nvm_ch_flags, u8 tx_chains,
849 			    u8 rx_chains, u32 sbands_flags, bool v4,
850 			    const struct iwl_fw *fw)
851 {
852 	struct device *dev = trans->dev;
853 	const struct iwl_cfg *cfg = trans->cfg;
854 	int n_channels;
855 	int n_used = 0;
856 	struct ieee80211_supported_band *sband;
857 
858 	n_channels = iwl_init_channel_map(dev, cfg, data, nvm_ch_flags,
859 					  sbands_flags, v4);
860 	sband = &data->bands[NL80211_BAND_2GHZ];
861 	sband->band = NL80211_BAND_2GHZ;
862 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
863 	sband->n_bitrates = N_RATES_24;
864 	n_used += iwl_init_sband_channels(data, sband, n_channels,
865 					  NL80211_BAND_2GHZ);
866 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
867 			     tx_chains, rx_chains);
868 
869 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
870 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
871 				     fw);
872 
873 	sband = &data->bands[NL80211_BAND_5GHZ];
874 	sband->band = NL80211_BAND_5GHZ;
875 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
876 	sband->n_bitrates = N_RATES_52;
877 	n_used += iwl_init_sband_channels(data, sband, n_channels,
878 					  NL80211_BAND_5GHZ);
879 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
880 			     tx_chains, rx_chains);
881 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
882 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
883 				      tx_chains, rx_chains);
884 
885 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
886 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
887 				     fw);
888 
889 	/* 6GHz band. */
890 	sband = &data->bands[NL80211_BAND_6GHZ];
891 	sband->band = NL80211_BAND_6GHZ;
892 	/* use the same rates as 5GHz band */
893 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
894 	sband->n_bitrates = N_RATES_52;
895 	n_used += iwl_init_sband_channels(data, sband, n_channels,
896 					  NL80211_BAND_6GHZ);
897 
898 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
899 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
900 				     fw);
901 	else
902 		sband->n_channels = 0;
903 	if (n_channels != n_used)
904 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
905 			    n_used, n_channels);
906 }
907 
908 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
909 		       const __le16 *phy_sku)
910 {
911 	if (cfg->nvm_type != IWL_NVM_EXT)
912 		return le16_to_cpup(nvm_sw + SKU);
913 
914 	return le32_to_cpup((__le32 *)(phy_sku + SKU_FAMILY_8000));
915 }
916 
917 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
918 {
919 	if (cfg->nvm_type != IWL_NVM_EXT)
920 		return le16_to_cpup(nvm_sw + NVM_VERSION);
921 	else
922 		return le32_to_cpup((__le32 *)(nvm_sw +
923 					       NVM_VERSION_EXT_NVM));
924 }
925 
926 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
927 			     const __le16 *phy_sku)
928 {
929 	if (cfg->nvm_type != IWL_NVM_EXT)
930 		return le16_to_cpup(nvm_sw + RADIO_CFG);
931 
932 	return le32_to_cpup((__le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
933 
934 }
935 
936 static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
937 {
938 	int n_hw_addr;
939 
940 	if (cfg->nvm_type != IWL_NVM_EXT)
941 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
942 
943 	n_hw_addr = le32_to_cpup((__le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
944 
945 	return n_hw_addr & N_HW_ADDR_MASK;
946 }
947 
948 static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
949 			      struct iwl_nvm_data *data,
950 			      u32 radio_cfg)
951 {
952 	if (cfg->nvm_type != IWL_NVM_EXT) {
953 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
954 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
955 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
956 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
957 		return;
958 	}
959 
960 	/* set the radio configuration for family 8000 */
961 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
962 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
963 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
964 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
965 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
966 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
967 }
968 
969 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
970 {
971 	const u8 *hw_addr;
972 
973 	hw_addr = (const u8 *)&mac_addr0;
974 	dest[0] = hw_addr[3];
975 	dest[1] = hw_addr[2];
976 	dest[2] = hw_addr[1];
977 	dest[3] = hw_addr[0];
978 
979 	hw_addr = (const u8 *)&mac_addr1;
980 	dest[4] = hw_addr[1];
981 	dest[5] = hw_addr[0];
982 }
983 
984 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
985 					struct iwl_nvm_data *data)
986 {
987 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
988 						  CSR_MAC_ADDR0_STRAP(trans)));
989 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
990 						  CSR_MAC_ADDR1_STRAP(trans)));
991 
992 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
993 	/*
994 	 * If the OEM fused a valid address, use it instead of the one in the
995 	 * OTP
996 	 */
997 	if (is_valid_ether_addr(data->hw_addr))
998 		return;
999 
1000 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1001 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1002 
1003 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1004 }
1005 
1006 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1007 					   const struct iwl_cfg *cfg,
1008 					   struct iwl_nvm_data *data,
1009 					   const __le16 *mac_override,
1010 					   const __be16 *nvm_hw)
1011 {
1012 	const u8 *hw_addr;
1013 
1014 	if (mac_override) {
1015 		static const u8 reserved_mac[] = {
1016 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1017 		};
1018 
1019 		hw_addr = (const u8 *)(mac_override +
1020 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1021 
1022 		/*
1023 		 * Store the MAC address from MAO section.
1024 		 * No byte swapping is required in MAO section
1025 		 */
1026 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1027 
1028 		/*
1029 		 * Force the use of the OTP MAC address in case of reserved MAC
1030 		 * address in the NVM, or if address is given but invalid.
1031 		 */
1032 		if (is_valid_ether_addr(data->hw_addr) &&
1033 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1034 			return;
1035 
1036 		IWL_ERR(trans,
1037 			"mac address from nvm override section is not valid\n");
1038 	}
1039 
1040 	if (nvm_hw) {
1041 		/* read the mac address from WFMP registers */
1042 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1043 						WFMP_MAC_ADDR_0));
1044 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1045 						WFMP_MAC_ADDR_1));
1046 
1047 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1048 
1049 		return;
1050 	}
1051 
1052 	IWL_ERR(trans, "mac address is not found\n");
1053 }
1054 
1055 static int iwl_set_hw_address(struct iwl_trans *trans,
1056 			      const struct iwl_cfg *cfg,
1057 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1058 			      const __le16 *mac_override)
1059 {
1060 	if (cfg->mac_addr_from_csr) {
1061 		iwl_set_hw_address_from_csr(trans, data);
1062 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1063 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1064 
1065 		/* The byte order is little endian 16 bit, meaning 214365 */
1066 		data->hw_addr[0] = hw_addr[1];
1067 		data->hw_addr[1] = hw_addr[0];
1068 		data->hw_addr[2] = hw_addr[3];
1069 		data->hw_addr[3] = hw_addr[2];
1070 		data->hw_addr[4] = hw_addr[5];
1071 		data->hw_addr[5] = hw_addr[4];
1072 	} else {
1073 		iwl_set_hw_address_family_8000(trans, cfg, data,
1074 					       mac_override, nvm_hw);
1075 	}
1076 
1077 	if (!is_valid_ether_addr(data->hw_addr)) {
1078 		IWL_ERR(trans, "no valid mac address was found\n");
1079 		return -EINVAL;
1080 	}
1081 
1082 	IWL_INFO(trans, "base HW address: %pM\n", data->hw_addr);
1083 
1084 	return 0;
1085 }
1086 
1087 static bool
1088 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1089 			const __be16 *nvm_hw)
1090 {
1091 	/*
1092 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1093 	 * some 7000-family OTPs erroneously allow wide channels in
1094 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1095 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1096 	 * 9.  In those cases, we need to force-disable wide channels
1097 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1098 	 * to use them.
1099 	 */
1100 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1101 		/*
1102 		 * Unlike the other sections in the NVM, the hw
1103 		 * section uses big-endian.
1104 		 */
1105 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1106 		u8 sku = (subsystem_id & 0x1e) >> 1;
1107 
1108 		if (sku == 5 || sku == 9) {
1109 			IWL_DEBUG_EEPROM(trans->dev,
1110 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1111 					 subsystem_id, sku);
1112 			return true;
1113 		}
1114 	}
1115 
1116 	return false;
1117 }
1118 
1119 struct iwl_nvm_data *
1120 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1121 		       const struct iwl_mei_nvm *mei_nvm,
1122 		       const struct iwl_fw *fw)
1123 {
1124 	struct iwl_nvm_data *data;
1125 	u32 sbands_flags = 0;
1126 	u8 rx_chains = fw->valid_rx_ant;
1127 	u8 tx_chains = fw->valid_rx_ant;
1128 
1129 	if (cfg->uhb_supported)
1130 		data = kzalloc(struct_size(data, channels,
1131 					   IWL_NVM_NUM_CHANNELS_UHB),
1132 					   GFP_KERNEL);
1133 	else
1134 		data = kzalloc(struct_size(data, channels,
1135 					   IWL_NVM_NUM_CHANNELS_EXT),
1136 					   GFP_KERNEL);
1137 	if (!data)
1138 		return NULL;
1139 
1140 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1141 		     IWL_NVM_NUM_CHANNELS_UHB);
1142 	data->nvm_version = mei_nvm->nvm_version;
1143 
1144 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1145 	if (data->valid_tx_ant)
1146 		tx_chains &= data->valid_tx_ant;
1147 	if (data->valid_rx_ant)
1148 		rx_chains &= data->valid_rx_ant;
1149 
1150 	data->sku_cap_mimo_disabled = false;
1151 	data->sku_cap_band_24ghz_enable = true;
1152 	data->sku_cap_band_52ghz_enable = true;
1153 	data->sku_cap_11n_enable =
1154 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1155 	data->sku_cap_11ac_enable = true;
1156 	data->sku_cap_11ax_enable =
1157 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1158 
1159 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1160 
1161 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1162 	/* If no valid mac address was found - bail out */
1163 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1164 		kfree(data);
1165 		return NULL;
1166 	}
1167 
1168 	if (data->lar_enabled &&
1169 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1170 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1171 
1172 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1173 			sbands_flags, true, fw);
1174 
1175 	return data;
1176 }
1177 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1178 
1179 struct iwl_nvm_data *
1180 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1181 		   const struct iwl_fw *fw,
1182 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1183 		   const __le16 *nvm_calib, const __le16 *regulatory,
1184 		   const __le16 *mac_override, const __le16 *phy_sku,
1185 		   u8 tx_chains, u8 rx_chains)
1186 {
1187 	struct iwl_nvm_data *data;
1188 	bool lar_enabled;
1189 	u32 sku, radio_cfg;
1190 	u32 sbands_flags = 0;
1191 	u16 lar_config;
1192 	const __le16 *ch_section;
1193 
1194 	if (cfg->uhb_supported)
1195 		data = kzalloc(struct_size(data, channels,
1196 					   IWL_NVM_NUM_CHANNELS_UHB),
1197 					   GFP_KERNEL);
1198 	else if (cfg->nvm_type != IWL_NVM_EXT)
1199 		data = kzalloc(struct_size(data, channels,
1200 					   IWL_NVM_NUM_CHANNELS),
1201 					   GFP_KERNEL);
1202 	else
1203 		data = kzalloc(struct_size(data, channels,
1204 					   IWL_NVM_NUM_CHANNELS_EXT),
1205 					   GFP_KERNEL);
1206 	if (!data)
1207 		return NULL;
1208 
1209 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1210 
1211 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1212 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1213 	if (data->valid_tx_ant)
1214 		tx_chains &= data->valid_tx_ant;
1215 	if (data->valid_rx_ant)
1216 		rx_chains &= data->valid_rx_ant;
1217 
1218 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1219 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1220 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1221 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1222 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1223 		data->sku_cap_11n_enable = false;
1224 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1225 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1226 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1227 
1228 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1229 
1230 	if (cfg->nvm_type != IWL_NVM_EXT) {
1231 		/* Checking for required sections */
1232 		if (!nvm_calib) {
1233 			IWL_ERR(trans,
1234 				"Can't parse empty Calib NVM sections\n");
1235 			kfree(data);
1236 			return NULL;
1237 		}
1238 
1239 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1240 			     &regulatory[NVM_CHANNELS_SDP] :
1241 			     &nvm_sw[NVM_CHANNELS];
1242 
1243 		/* in family 8000 Xtal calibration values moved to OTP */
1244 		data->xtal_calib[0] = *(nvm_calib + XTAL_CALIB);
1245 		data->xtal_calib[1] = *(nvm_calib + XTAL_CALIB + 1);
1246 		lar_enabled = true;
1247 	} else {
1248 		u16 lar_offset = data->nvm_version < 0xE39 ?
1249 				 NVM_LAR_OFFSET_OLD :
1250 				 NVM_LAR_OFFSET;
1251 
1252 		lar_config = le16_to_cpup(regulatory + lar_offset);
1253 		data->lar_enabled = !!(lar_config &
1254 				       NVM_LAR_ENABLED);
1255 		lar_enabled = data->lar_enabled;
1256 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1257 	}
1258 
1259 	/* If no valid mac address was found - bail out */
1260 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1261 		kfree(data);
1262 		return NULL;
1263 	}
1264 
1265 	if (lar_enabled &&
1266 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1267 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1268 
1269 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1270 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1271 
1272 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1273 			sbands_flags, false, fw);
1274 	data->calib_version = 255;
1275 
1276 	return data;
1277 }
1278 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1279 
1280 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1281 				       int ch_idx, u16 nvm_flags,
1282 				       struct iwl_reg_capa reg_capa,
1283 				       const struct iwl_cfg *cfg)
1284 {
1285 	u32 flags = NL80211_RRF_NO_HT40;
1286 
1287 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1288 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1289 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1290 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1291 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1292 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1293 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1294 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1295 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1296 		else
1297 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1298 	}
1299 
1300 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1301 		flags |= NL80211_RRF_NO_80MHZ;
1302 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1303 		flags |= NL80211_RRF_NO_160MHZ;
1304 
1305 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1306 		flags |= NL80211_RRF_NO_IR;
1307 
1308 	if (nvm_flags & NVM_CHANNEL_RADAR)
1309 		flags |= NL80211_RRF_DFS;
1310 
1311 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1312 		flags |= NL80211_RRF_NO_OUTDOOR;
1313 
1314 	/* Set the GO concurrent flag only in case that NO_IR is set.
1315 	 * Otherwise it is meaningless
1316 	 */
1317 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
1318 	    (flags & NL80211_RRF_NO_IR))
1319 		flags |= NL80211_RRF_GO_CONCURRENT;
1320 
1321 	/*
1322 	 * reg_capa is per regulatory domain so apply it for every channel
1323 	 */
1324 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1325 		if (!reg_capa.allow_40mhz)
1326 			flags |= NL80211_RRF_NO_HT40;
1327 
1328 		if (!reg_capa.allow_80mhz)
1329 			flags |= NL80211_RRF_NO_80MHZ;
1330 
1331 		if (!reg_capa.allow_160mhz)
1332 			flags |= NL80211_RRF_NO_160MHZ;
1333 	}
1334 	if (reg_capa.disable_11ax)
1335 		flags |= NL80211_RRF_NO_HE;
1336 
1337 	return flags;
1338 }
1339 
1340 static struct iwl_reg_capa iwl_get_reg_capa(u16 flags, u8 resp_ver)
1341 {
1342 	struct iwl_reg_capa reg_capa;
1343 
1344 	if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1345 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1346 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1347 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1348 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1349 	} else {
1350 		reg_capa.allow_40mhz = !(flags & REG_CAPA_40MHZ_FORBIDDEN);
1351 		reg_capa.allow_80mhz = flags & REG_CAPA_80MHZ_ALLOWED;
1352 		reg_capa.allow_160mhz = flags & REG_CAPA_160MHZ_ALLOWED;
1353 		reg_capa.disable_11ax = flags & REG_CAPA_11AX_DISABLED;
1354 	}
1355 	return reg_capa;
1356 }
1357 
1358 struct ieee80211_regdomain *
1359 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
1360 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1361 		       u16 geo_info, u16 cap, u8 resp_ver)
1362 {
1363 	int ch_idx;
1364 	u16 ch_flags;
1365 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1366 	const u16 *nvm_chan;
1367 	struct ieee80211_regdomain *regd, *copy_rd;
1368 	struct ieee80211_reg_rule *rule;
1369 	enum nl80211_band band;
1370 	int center_freq, prev_center_freq = 0;
1371 	int valid_rules = 0;
1372 	bool new_rule;
1373 	int max_num_ch;
1374 	struct iwl_reg_capa reg_capa;
1375 
1376 	if (cfg->uhb_supported) {
1377 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1378 		nvm_chan = iwl_uhb_nvm_channels;
1379 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1380 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1381 		nvm_chan = iwl_ext_nvm_channels;
1382 	} else {
1383 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1384 		nvm_chan = iwl_nvm_channels;
1385 	}
1386 
1387 	if (WARN_ON(num_of_ch > max_num_ch))
1388 		num_of_ch = max_num_ch;
1389 
1390 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1391 		return ERR_PTR(-EINVAL);
1392 
1393 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1394 		      num_of_ch);
1395 
1396 	/* build a regdomain rule for every valid channel */
1397 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1398 	if (!regd)
1399 		return ERR_PTR(-ENOMEM);
1400 
1401 	/* set alpha2 from FW. */
1402 	regd->alpha2[0] = fw_mcc >> 8;
1403 	regd->alpha2[1] = fw_mcc & 0xff;
1404 
1405 	/* parse regulatory capability flags */
1406 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1407 
1408 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1409 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1410 		band = iwl_nl80211_band_from_channel_idx(ch_idx);
1411 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1412 							     band);
1413 		new_rule = false;
1414 
1415 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1416 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1417 						    nvm_chan[ch_idx], ch_flags);
1418 			continue;
1419 		}
1420 
1421 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1422 							     ch_flags, reg_capa,
1423 							     cfg);
1424 
1425 		/* we can't continue the same rule */
1426 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1427 		    center_freq - prev_center_freq > 20) {
1428 			valid_rules++;
1429 			new_rule = true;
1430 		}
1431 
1432 		rule = &regd->reg_rules[valid_rules - 1];
1433 
1434 		if (new_rule)
1435 			rule->freq_range.start_freq_khz =
1436 						MHZ_TO_KHZ(center_freq - 10);
1437 
1438 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1439 
1440 		/* this doesn't matter - not used by FW */
1441 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1442 		rule->power_rule.max_eirp =
1443 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1444 
1445 		rule->flags = reg_rule_flags;
1446 
1447 		/* rely on auto-calculation to merge BW of contiguous chans */
1448 		rule->flags |= NL80211_RRF_AUTO_BW;
1449 		rule->freq_range.max_bandwidth_khz = 0;
1450 
1451 		prev_center_freq = center_freq;
1452 		prev_reg_rule_flags = reg_rule_flags;
1453 
1454 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1455 					    nvm_chan[ch_idx], ch_flags);
1456 
1457 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1458 		    band == NL80211_BAND_2GHZ)
1459 			continue;
1460 
1461 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1462 	}
1463 
1464 	/*
1465 	 * Certain firmware versions might report no valid channels
1466 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1467 	 * running. We'll get out of this situation later when the
1468 	 * rfkill is removed and we update the regdomain again, but
1469 	 * since cfg80211 doesn't accept an empty regdomain, add a
1470 	 * dummy (unusable) rule here in this case so we can init.
1471 	 */
1472 	if (!valid_rules) {
1473 		valid_rules = 1;
1474 		rule = &regd->reg_rules[valid_rules - 1];
1475 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1476 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1477 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1478 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1479 		rule->power_rule.max_eirp =
1480 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1481 	}
1482 
1483 	regd->n_reg_rules = valid_rules;
1484 
1485 	/*
1486 	 * Narrow down regdom for unused regulatory rules to prevent hole
1487 	 * between reg rules to wmm rules.
1488 	 */
1489 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1490 			  GFP_KERNEL);
1491 	if (!copy_rd)
1492 		copy_rd = ERR_PTR(-ENOMEM);
1493 
1494 	kfree(regd);
1495 	return copy_rd;
1496 }
1497 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1498 
1499 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1500 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1501 #define MAX_NVM_FILE_LEN	16384
1502 
1503 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1504 		    unsigned int len)
1505 {
1506 #define IWL_4165_DEVICE_ID	0x5501
1507 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1508 
1509 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1510 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1511 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1512 		/* OTP 0x52 bug work around: it's a 1x1 device */
1513 		data[3] = ANT_B | (ANT_B << 4);
1514 }
1515 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1516 
1517 /*
1518  * Reads external NVM from a file into mvm->nvm_sections
1519  *
1520  * HOW TO CREATE THE NVM FILE FORMAT:
1521  * ------------------------------
1522  * 1. create hex file, format:
1523  *      3800 -> header
1524  *      0000 -> header
1525  *      5a40 -> data
1526  *
1527  *   rev - 6 bit (word1)
1528  *   len - 10 bit (word1)
1529  *   id - 4 bit (word2)
1530  *   rsv - 12 bit (word2)
1531  *
1532  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1533  *
1534  * 3. create binary file from the hex file
1535  *
1536  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1537  */
1538 int iwl_read_external_nvm(struct iwl_trans *trans,
1539 			  const char *nvm_file_name,
1540 			  struct iwl_nvm_section *nvm_sections)
1541 {
1542 	int ret, section_size;
1543 	u16 section_id;
1544 	const struct firmware *fw_entry;
1545 	const struct {
1546 		__le16 word1;
1547 		__le16 word2;
1548 		u8 data[];
1549 	} *file_sec;
1550 	const u8 *eof;
1551 	u8 *temp;
1552 	int max_section_size;
1553 	const __le32 *dword_buff;
1554 
1555 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1556 #define NVM_WORD2_ID(x) (x >> 12)
1557 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1558 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1559 #define NVM_HEADER_0	(0x2A504C54)
1560 #define NVM_HEADER_1	(0x4E564D2A)
1561 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1562 
1563 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1564 
1565 	/* Maximal size depends on NVM version */
1566 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1567 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1568 	else
1569 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1570 
1571 	/*
1572 	 * Obtain NVM image via request_firmware. Since we already used
1573 	 * request_firmware_nowait() for the firmware binary load and only
1574 	 * get here after that we assume the NVM request can be satisfied
1575 	 * synchronously.
1576 	 */
1577 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1578 	if (ret) {
1579 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1580 			nvm_file_name, ret);
1581 		return ret;
1582 	}
1583 
1584 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1585 		 nvm_file_name, fw_entry->size);
1586 
1587 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1588 		IWL_ERR(trans, "NVM file too large\n");
1589 		ret = -EINVAL;
1590 		goto out;
1591 	}
1592 
1593 	eof = fw_entry->data + fw_entry->size;
1594 	dword_buff = (__le32 *)fw_entry->data;
1595 
1596 	/* some NVM file will contain a header.
1597 	 * The header is identified by 2 dwords header as follow:
1598 	 * dword[0] = 0x2A504C54
1599 	 * dword[1] = 0x4E564D2A
1600 	 *
1601 	 * This header must be skipped when providing the NVM data to the FW.
1602 	 */
1603 	if (fw_entry->size > NVM_HEADER_SIZE &&
1604 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1605 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1606 		file_sec = (void *)(fw_entry->data + NVM_HEADER_SIZE);
1607 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1608 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1609 			 le32_to_cpu(dword_buff[3]));
1610 
1611 		/* nvm file validation, dword_buff[2] holds the file version */
1612 		if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1613 		    trans->hw_rev_step == SILICON_C_STEP &&
1614 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1615 			ret = -EFAULT;
1616 			goto out;
1617 		}
1618 	} else {
1619 		file_sec = (void *)fw_entry->data;
1620 	}
1621 
1622 	while (true) {
1623 		if (file_sec->data > eof) {
1624 			IWL_ERR(trans,
1625 				"ERROR - NVM file too short for section header\n");
1626 			ret = -EINVAL;
1627 			break;
1628 		}
1629 
1630 		/* check for EOF marker */
1631 		if (!file_sec->word1 && !file_sec->word2) {
1632 			ret = 0;
1633 			break;
1634 		}
1635 
1636 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
1637 			section_size =
1638 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
1639 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
1640 		} else {
1641 			section_size = 2 * EXT_NVM_WORD2_LEN(
1642 						le16_to_cpu(file_sec->word2));
1643 			section_id = EXT_NVM_WORD1_ID(
1644 						le16_to_cpu(file_sec->word1));
1645 		}
1646 
1647 		if (section_size > max_section_size) {
1648 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
1649 				section_size);
1650 			ret = -EINVAL;
1651 			break;
1652 		}
1653 
1654 		if (!section_size) {
1655 			IWL_ERR(trans, "ERROR - section empty\n");
1656 			ret = -EINVAL;
1657 			break;
1658 		}
1659 
1660 		if (file_sec->data + section_size > eof) {
1661 			IWL_ERR(trans,
1662 				"ERROR - NVM file too short for section (%d bytes)\n",
1663 				section_size);
1664 			ret = -EINVAL;
1665 			break;
1666 		}
1667 
1668 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
1669 			 "Invalid NVM section ID %d\n", section_id)) {
1670 			ret = -EINVAL;
1671 			break;
1672 		}
1673 
1674 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
1675 		if (!temp) {
1676 			ret = -ENOMEM;
1677 			break;
1678 		}
1679 
1680 		iwl_nvm_fixups(trans->hw_id, section_id, temp, section_size);
1681 
1682 		kfree(nvm_sections[section_id].data);
1683 		nvm_sections[section_id].data = temp;
1684 		nvm_sections[section_id].length = section_size;
1685 
1686 		/* advance to the next section */
1687 		file_sec = (void *)(file_sec->data + section_size);
1688 	}
1689 out:
1690 	release_firmware(fw_entry);
1691 	return ret;
1692 }
1693 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
1694 
1695 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
1696 				 const struct iwl_fw *fw)
1697 {
1698 	struct iwl_nvm_get_info cmd = {};
1699 	struct iwl_nvm_data *nvm;
1700 	struct iwl_host_cmd hcmd = {
1701 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
1702 		.data = { &cmd, },
1703 		.len = { sizeof(cmd) },
1704 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
1705 	};
1706 	int  ret;
1707 	bool empty_otp;
1708 	u32 mac_flags;
1709 	u32 sbands_flags = 0;
1710 	/*
1711 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
1712 	 * in v3, except for the channel profile part of the
1713 	 * regulatory.  So we can just access the new struct, with the
1714 	 * exception of the latter.
1715 	 */
1716 	struct iwl_nvm_get_info_rsp *rsp;
1717 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
1718 	bool v4 = fw_has_api(&fw->ucode_capa,
1719 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
1720 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
1721 	void *channel_profile;
1722 
1723 	ret = iwl_trans_send_cmd(trans, &hcmd);
1724 	if (ret)
1725 		return ERR_PTR(ret);
1726 
1727 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
1728 		 "Invalid payload len in NVM response from FW %d",
1729 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
1730 		ret = -EINVAL;
1731 		goto out;
1732 	}
1733 
1734 	rsp = (void *)hcmd.resp_pkt->data;
1735 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
1736 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
1737 	if (empty_otp)
1738 		IWL_INFO(trans, "OTP is empty\n");
1739 
1740 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
1741 	if (!nvm) {
1742 		ret = -ENOMEM;
1743 		goto out;
1744 	}
1745 
1746 	iwl_set_hw_address_from_csr(trans, nvm);
1747 	/* TODO: if platform NVM has MAC address - override it here */
1748 
1749 	if (!is_valid_ether_addr(nvm->hw_addr)) {
1750 		IWL_ERR(trans, "no valid mac address was found\n");
1751 		ret = -EINVAL;
1752 		goto err_free;
1753 	}
1754 
1755 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
1756 
1757 	/* Initialize general data */
1758 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
1759 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
1760 	if (nvm->n_hw_addrs == 0)
1761 		IWL_WARN(trans,
1762 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
1763 			 empty_otp);
1764 
1765 	/* Initialize MAC sku data */
1766 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
1767 	nvm->sku_cap_11ac_enable =
1768 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
1769 	nvm->sku_cap_11n_enable =
1770 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
1771 	nvm->sku_cap_11ax_enable =
1772 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
1773 	nvm->sku_cap_band_24ghz_enable =
1774 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
1775 	nvm->sku_cap_band_52ghz_enable =
1776 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
1777 	nvm->sku_cap_mimo_disabled =
1778 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
1779 
1780 	/* Initialize PHY sku data */
1781 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
1782 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
1783 
1784 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
1785 	    fw_has_capa(&fw->ucode_capa,
1786 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
1787 		nvm->lar_enabled = true;
1788 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1789 	}
1790 
1791 	rsp_v3 = (void *)rsp;
1792 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
1793 			  (void *)rsp_v3->regulatory.channel_profile;
1794 
1795 	iwl_init_sbands(trans, nvm,
1796 			channel_profile,
1797 			nvm->valid_tx_ant & fw->valid_tx_ant,
1798 			nvm->valid_rx_ant & fw->valid_rx_ant,
1799 			sbands_flags, v4, fw);
1800 
1801 	iwl_free_resp(&hcmd);
1802 	return nvm;
1803 
1804 err_free:
1805 	kfree(nvm);
1806 out:
1807 	iwl_free_resp(&hcmd);
1808 	return ERR_PTR(ret);
1809 }
1810 IWL_EXPORT_SYMBOL(iwl_get_nvm);
1811