1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright (C) 2005-2014, 2018-2022 Intel Corporation
4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
6  */
7 #include <linux/types.h>
8 #include <linux/slab.h>
9 #include <linux/export.h>
10 #include <linux/etherdevice.h>
11 #include <linux/pci.h>
12 #include <linux/firmware.h>
13 
14 #include "iwl-drv.h"
15 #include "iwl-modparams.h"
16 #include "iwl-nvm-parse.h"
17 #include "iwl-prph.h"
18 #include "iwl-io.h"
19 #include "iwl-csr.h"
20 #include "fw/acpi.h"
21 #include "fw/api/nvm-reg.h"
22 #include "fw/api/commands.h"
23 #include "fw/api/cmdhdr.h"
24 #include "fw/img.h"
25 #include "mei/iwl-mei.h"
26 
27 /* NVM offsets (in words) definitions */
28 enum nvm_offsets {
29 	/* NVM HW-Section offset (in words) definitions */
30 	SUBSYSTEM_ID = 0x0A,
31 	HW_ADDR = 0x15,
32 
33 	/* NVM SW-Section offset (in words) definitions */
34 	NVM_SW_SECTION = 0x1C0,
35 	NVM_VERSION = 0,
36 	RADIO_CFG = 1,
37 	SKU = 2,
38 	N_HW_ADDRS = 3,
39 	NVM_CHANNELS = 0x1E0 - NVM_SW_SECTION,
40 
41 	/* NVM calibration section offset (in words) definitions */
42 	NVM_CALIB_SECTION = 0x2B8,
43 	XTAL_CALIB = 0x316 - NVM_CALIB_SECTION,
44 
45 	/* NVM REGULATORY -Section offset (in words) definitions */
46 	NVM_CHANNELS_SDP = 0,
47 };
48 
49 enum ext_nvm_offsets {
50 	/* NVM HW-Section offset (in words) definitions */
51 	MAC_ADDRESS_OVERRIDE_EXT_NVM = 1,
52 
53 	/* NVM SW-Section offset (in words) definitions */
54 	NVM_VERSION_EXT_NVM = 0,
55 	N_HW_ADDRS_FAMILY_8000 = 3,
56 
57 	/* NVM PHY_SKU-Section offset (in words) definitions */
58 	RADIO_CFG_FAMILY_EXT_NVM = 0,
59 	SKU_FAMILY_8000 = 2,
60 
61 	/* NVM REGULATORY -Section offset (in words) definitions */
62 	NVM_CHANNELS_EXTENDED = 0,
63 	NVM_LAR_OFFSET_OLD = 0x4C7,
64 	NVM_LAR_OFFSET = 0x507,
65 	NVM_LAR_ENABLED = 0x7,
66 };
67 
68 /* SKU Capabilities (actual values from NVM definition) */
69 enum nvm_sku_bits {
70 	NVM_SKU_CAP_BAND_24GHZ		= BIT(0),
71 	NVM_SKU_CAP_BAND_52GHZ		= BIT(1),
72 	NVM_SKU_CAP_11N_ENABLE		= BIT(2),
73 	NVM_SKU_CAP_11AC_ENABLE		= BIT(3),
74 	NVM_SKU_CAP_MIMO_DISABLE	= BIT(5),
75 };
76 
77 /*
78  * These are the channel numbers in the order that they are stored in the NVM
79  */
80 static const u16 iwl_nvm_channels[] = {
81 	/* 2.4 GHz */
82 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
83 	/* 5 GHz */
84 	36, 40, 44, 48, 52, 56, 60, 64,
85 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
86 	149, 153, 157, 161, 165
87 };
88 
89 static const u16 iwl_ext_nvm_channels[] = {
90 	/* 2.4 GHz */
91 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
92 	/* 5 GHz */
93 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
94 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
95 	149, 153, 157, 161, 165, 169, 173, 177, 181
96 };
97 
98 static const u16 iwl_uhb_nvm_channels[] = {
99 	/* 2.4 GHz */
100 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
101 	/* 5 GHz */
102 	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
103 	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
104 	149, 153, 157, 161, 165, 169, 173, 177, 181,
105 	/* 6-7 GHz */
106 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
107 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
108 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
109 	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
110 };
111 
112 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
113 #define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
114 #define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
115 #define NUM_2GHZ_CHANNELS		14
116 #define NUM_5GHZ_CHANNELS		37
117 #define FIRST_2GHZ_HT_MINUS		5
118 #define LAST_2GHZ_HT_PLUS		9
119 #define N_HW_ADDR_MASK			0xF
120 
121 /* rate data (static) */
122 static struct ieee80211_rate iwl_cfg80211_rates[] = {
123 	{ .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
124 	{ .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
125 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
126 	{ .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
127 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
128 	{ .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
129 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
130 	{ .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
131 	{ .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
132 	{ .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
133 	{ .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
134 	{ .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
135 	{ .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
136 	{ .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
137 	{ .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
138 };
139 #define RATES_24_OFFS	0
140 #define N_RATES_24	ARRAY_SIZE(iwl_cfg80211_rates)
141 #define RATES_52_OFFS	4
142 #define N_RATES_52	(N_RATES_24 - RATES_52_OFFS)
143 
144 /**
145  * enum iwl_nvm_channel_flags - channel flags in NVM
146  * @NVM_CHANNEL_VALID: channel is usable for this SKU/geo
147  * @NVM_CHANNEL_IBSS: usable as an IBSS channel
148  * @NVM_CHANNEL_ACTIVE: active scanning allowed
149  * @NVM_CHANNEL_RADAR: radar detection required
150  * @NVM_CHANNEL_INDOOR_ONLY: only indoor use is allowed
151  * @NVM_CHANNEL_GO_CONCURRENT: GO operation is allowed when connected to BSS
152  *	on same channel on 2.4 or same UNII band on 5.2
153  * @NVM_CHANNEL_UNIFORM: uniform spreading required
154  * @NVM_CHANNEL_20MHZ: 20 MHz channel okay
155  * @NVM_CHANNEL_40MHZ: 40 MHz channel okay
156  * @NVM_CHANNEL_80MHZ: 80 MHz channel okay
157  * @NVM_CHANNEL_160MHZ: 160 MHz channel okay
158  * @NVM_CHANNEL_DC_HIGH: DC HIGH required/allowed (?)
159  */
160 enum iwl_nvm_channel_flags {
161 	NVM_CHANNEL_VALID		= BIT(0),
162 	NVM_CHANNEL_IBSS		= BIT(1),
163 	NVM_CHANNEL_ACTIVE		= BIT(3),
164 	NVM_CHANNEL_RADAR		= BIT(4),
165 	NVM_CHANNEL_INDOOR_ONLY		= BIT(5),
166 	NVM_CHANNEL_GO_CONCURRENT	= BIT(6),
167 	NVM_CHANNEL_UNIFORM		= BIT(7),
168 	NVM_CHANNEL_20MHZ		= BIT(8),
169 	NVM_CHANNEL_40MHZ		= BIT(9),
170 	NVM_CHANNEL_80MHZ		= BIT(10),
171 	NVM_CHANNEL_160MHZ		= BIT(11),
172 	NVM_CHANNEL_DC_HIGH		= BIT(12),
173 };
174 
175 /**
176  * enum iwl_reg_capa_flags - global flags applied for the whole regulatory
177  * domain.
178  * @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
179  *	2.4Ghz band is allowed.
180  * @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
181  *	5Ghz band is allowed.
182  * @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
183  *	for this regulatory domain (valid only in 5Ghz).
184  * @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
185  *	for this regulatory domain (valid only in 5Ghz).
186  * @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
187  * @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
188  * @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
189  *	for this regulatory domain (valid only in 5Ghz).
190  * @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed.
191  * @REG_CAPA_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
192  */
193 enum iwl_reg_capa_flags {
194 	REG_CAPA_BF_CCD_LOW_BAND	= BIT(0),
195 	REG_CAPA_BF_CCD_HIGH_BAND	= BIT(1),
196 	REG_CAPA_160MHZ_ALLOWED		= BIT(2),
197 	REG_CAPA_80MHZ_ALLOWED		= BIT(3),
198 	REG_CAPA_MCS_8_ALLOWED		= BIT(4),
199 	REG_CAPA_MCS_9_ALLOWED		= BIT(5),
200 	REG_CAPA_40MHZ_FORBIDDEN	= BIT(7),
201 	REG_CAPA_DC_HIGH_ENABLED	= BIT(9),
202 	REG_CAPA_11AX_DISABLED		= BIT(10),
203 };
204 
205 /**
206  * enum iwl_reg_capa_flags_v2 - global flags applied for the whole regulatory
207  * domain (version 2).
208  * @REG_CAPA_V2_STRADDLE_DISABLED: Straddle channels (144, 142, 138) are
209  *	disabled.
210  * @REG_CAPA_V2_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
211  *	2.4Ghz band is allowed.
212  * @REG_CAPA_V2_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
213  *	5Ghz band is allowed.
214  * @REG_CAPA_V2_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
215  *	for this regulatory domain (valid only in 5Ghz).
216  * @REG_CAPA_V2_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
217  *	for this regulatory domain (valid only in 5Ghz).
218  * @REG_CAPA_V2_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
219  * @REG_CAPA_V2_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
220  * @REG_CAPA_V2_WEATHER_DISABLED: Weather radar channels (120, 124, 128, 118,
221  *	126, 122) are disabled.
222  * @REG_CAPA_V2_40MHZ_ALLOWED: 11n channel with a width of 40Mhz is allowed
223  *	for this regulatory domain (uvalid only in 5Ghz).
224  * @REG_CAPA_V2_11AX_DISABLED: 11ax is forbidden for this regulatory domain.
225  */
226 enum iwl_reg_capa_flags_v2 {
227 	REG_CAPA_V2_STRADDLE_DISABLED	= BIT(0),
228 	REG_CAPA_V2_BF_CCD_LOW_BAND	= BIT(1),
229 	REG_CAPA_V2_BF_CCD_HIGH_BAND	= BIT(2),
230 	REG_CAPA_V2_160MHZ_ALLOWED	= BIT(3),
231 	REG_CAPA_V2_80MHZ_ALLOWED	= BIT(4),
232 	REG_CAPA_V2_MCS_8_ALLOWED	= BIT(5),
233 	REG_CAPA_V2_MCS_9_ALLOWED	= BIT(6),
234 	REG_CAPA_V2_WEATHER_DISABLED	= BIT(7),
235 	REG_CAPA_V2_40MHZ_ALLOWED	= BIT(8),
236 	REG_CAPA_V2_11AX_DISABLED	= BIT(10),
237 };
238 
239 /*
240 * API v2 for reg_capa_flags is relevant from version 6 and onwards of the
241 * MCC update command response.
242 */
243 #define REG_CAPA_V2_RESP_VER	6
244 
245 /**
246  * struct iwl_reg_capa - struct for global regulatory capabilities, Used for
247  * handling the different APIs of reg_capa_flags.
248  *
249  * @allow_40mhz: 11n channel with a width of 40Mhz is allowed
250  *	for this regulatory domain (valid only in 5Ghz).
251  * @allow_80mhz: 11ac channel with a width of 80Mhz is allowed
252  *	for this regulatory domain (valid only in 5Ghz).
253  * @allow_160mhz: 11ac channel with a width of 160Mhz is allowed
254  *	for this regulatory domain (valid only in 5Ghz).
255  * @disable_11ax: 11ax is forbidden for this regulatory domain.
256  */
257 struct iwl_reg_capa {
258 	u16 allow_40mhz;
259 	u16 allow_80mhz;
260 	u16 allow_160mhz;
261 	u16 disable_11ax;
262 };
263 
264 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
265 					       int chan, u32 flags)
266 {
267 #define CHECK_AND_PRINT_I(x)	\
268 	((flags & NVM_CHANNEL_##x) ? " " #x : "")
269 
270 	if (!(flags & NVM_CHANNEL_VALID)) {
271 		IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
272 			      chan, flags);
273 		return;
274 	}
275 
276 	/* Note: already can print up to 101 characters, 110 is the limit! */
277 	IWL_DEBUG_DEV(dev, level,
278 		      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s\n",
279 		      chan, flags,
280 		      CHECK_AND_PRINT_I(VALID),
281 		      CHECK_AND_PRINT_I(IBSS),
282 		      CHECK_AND_PRINT_I(ACTIVE),
283 		      CHECK_AND_PRINT_I(RADAR),
284 		      CHECK_AND_PRINT_I(INDOOR_ONLY),
285 		      CHECK_AND_PRINT_I(GO_CONCURRENT),
286 		      CHECK_AND_PRINT_I(UNIFORM),
287 		      CHECK_AND_PRINT_I(20MHZ),
288 		      CHECK_AND_PRINT_I(40MHZ),
289 		      CHECK_AND_PRINT_I(80MHZ),
290 		      CHECK_AND_PRINT_I(160MHZ),
291 		      CHECK_AND_PRINT_I(DC_HIGH));
292 #undef CHECK_AND_PRINT_I
293 }
294 
295 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, enum nl80211_band band,
296 				 u32 nvm_flags, const struct iwl_cfg *cfg)
297 {
298 	u32 flags = IEEE80211_CHAN_NO_HT40;
299 
300 	if (band == NL80211_BAND_2GHZ && (nvm_flags & NVM_CHANNEL_40MHZ)) {
301 		if (ch_num <= LAST_2GHZ_HT_PLUS)
302 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
303 		if (ch_num >= FIRST_2GHZ_HT_MINUS)
304 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
305 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
306 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
307 			flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
308 		else
309 			flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
310 	}
311 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
312 		flags |= IEEE80211_CHAN_NO_80MHZ;
313 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
314 		flags |= IEEE80211_CHAN_NO_160MHZ;
315 
316 	if (!(nvm_flags & NVM_CHANNEL_IBSS))
317 		flags |= IEEE80211_CHAN_NO_IR;
318 
319 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
320 		flags |= IEEE80211_CHAN_NO_IR;
321 
322 	if (nvm_flags & NVM_CHANNEL_RADAR)
323 		flags |= IEEE80211_CHAN_RADAR;
324 
325 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
326 		flags |= IEEE80211_CHAN_INDOOR_ONLY;
327 
328 	/* Set the GO concurrent flag only in case that NO_IR is set.
329 	 * Otherwise it is meaningless
330 	 */
331 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
332 	    (flags & IEEE80211_CHAN_NO_IR))
333 		flags |= IEEE80211_CHAN_IR_CONCURRENT;
334 
335 	return flags;
336 }
337 
338 static enum nl80211_band iwl_nl80211_band_from_channel_idx(int ch_idx)
339 {
340 	if (ch_idx >= NUM_2GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
341 		return NL80211_BAND_6GHZ;
342 	}
343 
344 	if (ch_idx >= NUM_2GHZ_CHANNELS)
345 		return NL80211_BAND_5GHZ;
346 	return NL80211_BAND_2GHZ;
347 }
348 
349 static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
350 				struct iwl_nvm_data *data,
351 				const void * const nvm_ch_flags,
352 				u32 sbands_flags, bool v4)
353 {
354 	int ch_idx;
355 	int n_channels = 0;
356 	struct ieee80211_channel *channel;
357 	u32 ch_flags;
358 	int num_of_ch;
359 	const u16 *nvm_chan;
360 
361 	if (cfg->uhb_supported) {
362 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
363 		nvm_chan = iwl_uhb_nvm_channels;
364 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
365 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
366 		nvm_chan = iwl_ext_nvm_channels;
367 	} else {
368 		num_of_ch = IWL_NVM_NUM_CHANNELS;
369 		nvm_chan = iwl_nvm_channels;
370 	}
371 
372 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
373 		enum nl80211_band band =
374 			iwl_nl80211_band_from_channel_idx(ch_idx);
375 
376 		if (v4)
377 			ch_flags =
378 				__le32_to_cpup((const __le32 *)nvm_ch_flags + ch_idx);
379 		else
380 			ch_flags =
381 				__le16_to_cpup((const __le16 *)nvm_ch_flags + ch_idx);
382 
383 		if (band == NL80211_BAND_5GHZ &&
384 		    !data->sku_cap_band_52ghz_enable)
385 			continue;
386 
387 		/* workaround to disable wide channels in 5GHz */
388 		if ((sbands_flags & IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ) &&
389 		    band == NL80211_BAND_5GHZ) {
390 			ch_flags &= ~(NVM_CHANNEL_40MHZ |
391 				     NVM_CHANNEL_80MHZ |
392 				     NVM_CHANNEL_160MHZ);
393 		}
394 
395 		if (ch_flags & NVM_CHANNEL_160MHZ)
396 			data->vht160_supported = true;
397 
398 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR) &&
399 		    !(ch_flags & NVM_CHANNEL_VALID)) {
400 			/*
401 			 * Channels might become valid later if lar is
402 			 * supported, hence we still want to add them to
403 			 * the list of supported channels to cfg80211.
404 			 */
405 			iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
406 						    nvm_chan[ch_idx], ch_flags);
407 			continue;
408 		}
409 
410 		channel = &data->channels[n_channels];
411 		n_channels++;
412 
413 		channel->hw_value = nvm_chan[ch_idx];
414 		channel->band = band;
415 		channel->center_freq =
416 			ieee80211_channel_to_frequency(
417 				channel->hw_value, channel->band);
418 
419 		/* Initialize regulatory-based run-time data */
420 
421 		/*
422 		 * Default value - highest tx power value.  max_power
423 		 * is not used in mvm, and is used for backwards compatibility
424 		 */
425 		channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
426 
427 		/* don't put limitations in case we're using LAR */
428 		if (!(sbands_flags & IWL_NVM_SBANDS_FLAGS_LAR))
429 			channel->flags = iwl_get_channel_flags(nvm_chan[ch_idx],
430 							       ch_idx, band,
431 							       ch_flags, cfg);
432 		else
433 			channel->flags = 0;
434 
435 		/* TODO: Don't put limitations on UHB devices as we still don't
436 		 * have NVM for them
437 		 */
438 		if (cfg->uhb_supported)
439 			channel->flags = 0;
440 		iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
441 					    channel->hw_value, ch_flags);
442 		IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
443 				 channel->hw_value, channel->max_power);
444 	}
445 
446 	return n_channels;
447 }
448 
449 static void iwl_init_vht_hw_capab(struct iwl_trans *trans,
450 				  struct iwl_nvm_data *data,
451 				  struct ieee80211_sta_vht_cap *vht_cap,
452 				  u8 tx_chains, u8 rx_chains)
453 {
454 	const struct iwl_cfg *cfg = trans->cfg;
455 	int num_rx_ants = num_of_ant(rx_chains);
456 	int num_tx_ants = num_of_ant(tx_chains);
457 
458 	vht_cap->vht_supported = true;
459 
460 	vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
461 		       IEEE80211_VHT_CAP_RXSTBC_1 |
462 		       IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
463 		       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
464 		       IEEE80211_VHT_MAX_AMPDU_1024K <<
465 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
466 
467 	if (data->vht160_supported)
468 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
469 				IEEE80211_VHT_CAP_SHORT_GI_160;
470 
471 	if (cfg->vht_mu_mimo_supported)
472 		vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
473 
474 	if (cfg->ht_params->ldpc)
475 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
476 
477 	if (data->sku_cap_mimo_disabled) {
478 		num_rx_ants = 1;
479 		num_tx_ants = 1;
480 	}
481 
482 	if (num_tx_ants > 1)
483 		vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
484 	else
485 		vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
486 
487 	switch (iwlwifi_mod_params.amsdu_size) {
488 	case IWL_AMSDU_DEF:
489 		if (trans->trans_cfg->mq_rx_supported)
490 			vht_cap->cap |=
491 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
492 		else
493 			vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
494 		break;
495 	case IWL_AMSDU_2K:
496 		if (trans->trans_cfg->mq_rx_supported)
497 			vht_cap->cap |=
498 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
499 		else
500 			WARN(1, "RB size of 2K is not supported by this device\n");
501 		break;
502 	case IWL_AMSDU_4K:
503 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
504 		break;
505 	case IWL_AMSDU_8K:
506 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
507 		break;
508 	case IWL_AMSDU_12K:
509 		vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
510 		break;
511 	default:
512 		break;
513 	}
514 
515 	vht_cap->vht_mcs.rx_mcs_map =
516 		cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
517 			    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
518 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
519 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
520 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
521 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
522 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
523 			    IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
524 
525 	if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
526 		vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
527 		/* this works because NOT_SUPPORTED == 3 */
528 		vht_cap->vht_mcs.rx_mcs_map |=
529 			cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
530 	}
531 
532 	vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
533 
534 	vht_cap->vht_mcs.tx_highest |=
535 		cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
536 }
537 
538 static const u8 iwl_vendor_caps[] = {
539 	0xdd,			/* vendor element */
540 	0x06,			/* length */
541 	0x00, 0x17, 0x35,	/* Intel OUI */
542 	0x08,			/* type (Intel Capabilities) */
543 	/* followed by 16 bits of capabilities */
544 #define IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE	BIT(0)
545 	IWL_VENDOR_CAP_IMPROVED_BF_FDBK_HE,
546 	0x00
547 };
548 
549 static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = {
550 	{
551 		.types_mask = BIT(NL80211_IFTYPE_STATION),
552 		.he_cap = {
553 			.has_he = true,
554 			.he_cap_elem = {
555 				.mac_cap_info[0] =
556 					IEEE80211_HE_MAC_CAP0_HTC_HE,
557 				.mac_cap_info[1] =
558 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
559 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
560 				.mac_cap_info[2] =
561 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
562 				.mac_cap_info[3] =
563 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
564 					IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS,
565 				.mac_cap_info[4] =
566 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
567 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
568 				.mac_cap_info[5] =
569 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
570 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41 |
571 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
572 					IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS |
573 					IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX,
574 				.phy_cap_info[1] =
575 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
576 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
577 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
578 				.phy_cap_info[2] =
579 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
580 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ,
581 				.phy_cap_info[3] =
582 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
583 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
584 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
585 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
586 				.phy_cap_info[4] =
587 					IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
588 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8 |
589 					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8,
590 				.phy_cap_info[6] =
591 					IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
592 					IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
593 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
594 				.phy_cap_info[7] =
595 					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
596 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
597 				.phy_cap_info[8] =
598 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
599 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
600 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
601 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU |
602 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
603 				.phy_cap_info[9] =
604 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
605 					IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
606 					(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED <<
607 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS),
608 				.phy_cap_info[10] =
609 					IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF,
610 			},
611 			/*
612 			 * Set default Tx/Rx HE MCS NSS Support field.
613 			 * Indicate support for up to 2 spatial streams and all
614 			 * MCS, without any special cases
615 			 */
616 			.he_mcs_nss_supp = {
617 				.rx_mcs_80 = cpu_to_le16(0xfffa),
618 				.tx_mcs_80 = cpu_to_le16(0xfffa),
619 				.rx_mcs_160 = cpu_to_le16(0xfffa),
620 				.tx_mcs_160 = cpu_to_le16(0xfffa),
621 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
622 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
623 			},
624 			/*
625 			 * Set default PPE thresholds, with PPET16 set to 0,
626 			 * PPET8 set to 7
627 			 */
628 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
629 		},
630 		.eht_cap = {
631 			.has_eht = true,
632 			.eht_cap_elem = {
633 				.mac_cap_info[0] =
634 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
635 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
636 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
637 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
638 				.phy_cap_info[0] =
639 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
640 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
641 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
642 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
643 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
644 				.phy_cap_info[1] =
645 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK  |
646 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
647 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
648 				.phy_cap_info[3] =
649 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
650 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
651 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
652 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
653 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
654 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
655 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
656 
657 				.phy_cap_info[4] =
658 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
659 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
660 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI,
661 				.phy_cap_info[5] =
662 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
663 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
664 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
665 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT,
666 				.phy_cap_info[6] =
667 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
668 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
669 				.phy_cap_info[8] =
670 					IEEE80211_EHT_PHY_CAP8_RX_1024QAM_WIDER_BW_DL_OFDMA |
671 					IEEE80211_EHT_PHY_CAP8_RX_4096QAM_WIDER_BW_DL_OFDMA,
672 			},
673 
674 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
675 			 * Rx - note we don't set the only_20mhz, but due to this
676 			 * being a union, it gets set correctly anyway.
677 			 */
678 			.eht_mcs_nss_supp = {
679 				.bw._80 = {
680 					.rx_tx_mcs9_max_nss = 0x22,
681 					.rx_tx_mcs11_max_nss = 0x22,
682 					.rx_tx_mcs13_max_nss = 0x22,
683 				},
684 				.bw._160 = {
685 					.rx_tx_mcs9_max_nss = 0x22,
686 					.rx_tx_mcs11_max_nss = 0x22,
687 					.rx_tx_mcs13_max_nss = 0x22,
688 				},
689 				.bw._320 = {
690 					.rx_tx_mcs9_max_nss = 0x22,
691 					.rx_tx_mcs11_max_nss = 0x22,
692 					.rx_tx_mcs13_max_nss = 0x22,
693 				},
694 			},
695 
696 			/*
697 			 * PPE thresholds for NSS = 2, and RU index bitmap set
698 			 * to 0xc.
699 			 */
700 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
701 		},
702 	},
703 	{
704 		.types_mask = BIT(NL80211_IFTYPE_AP),
705 		.he_cap = {
706 			.has_he = true,
707 			.he_cap_elem = {
708 				.mac_cap_info[0] =
709 					IEEE80211_HE_MAC_CAP0_HTC_HE,
710 				.mac_cap_info[1] =
711 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
712 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
713 				.mac_cap_info[3] =
714 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL,
715 				.phy_cap_info[1] =
716 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD,
717 				.phy_cap_info[2] =
718 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
719 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US,
720 				.phy_cap_info[3] =
721 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK |
722 					IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1 |
723 					IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK |
724 					IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1,
725 				.phy_cap_info[6] =
726 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
727 				.phy_cap_info[7] =
728 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
729 				.phy_cap_info[8] =
730 					IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
731 					IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242,
732 				.phy_cap_info[9] =
733 					IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED
734 					<< IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS,
735 			},
736 			/*
737 			 * Set default Tx/Rx HE MCS NSS Support field.
738 			 * Indicate support for up to 2 spatial streams and all
739 			 * MCS, without any special cases
740 			 */
741 			.he_mcs_nss_supp = {
742 				.rx_mcs_80 = cpu_to_le16(0xfffa),
743 				.tx_mcs_80 = cpu_to_le16(0xfffa),
744 				.rx_mcs_160 = cpu_to_le16(0xfffa),
745 				.tx_mcs_160 = cpu_to_le16(0xfffa),
746 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
747 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
748 			},
749 			/*
750 			 * Set default PPE thresholds, with PPET16 set to 0,
751 			 * PPET8 set to 7
752 			 */
753 			.ppe_thres = {0x61, 0x1c, 0xc7, 0x71},
754 		},
755 		.eht_cap = {
756 			.has_eht = true,
757 			.eht_cap_elem = {
758 				.mac_cap_info[0] =
759 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
760 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
761 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
762 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2,
763 				.phy_cap_info[0] =
764 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
765 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI,
766 				.phy_cap_info[5] =
767 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT,
768 			},
769 
770 			/* For all MCS and bandwidth, set 2 NSS for both Tx and
771 			 * Rx - note we don't set the only_20mhz, but due to this
772 			 * being a union, it gets set correctly anyway.
773 			 */
774 			.eht_mcs_nss_supp = {
775 				.bw._80 = {
776 					.rx_tx_mcs9_max_nss = 0x22,
777 					.rx_tx_mcs11_max_nss = 0x22,
778 					.rx_tx_mcs13_max_nss = 0x22,
779 				},
780 				.bw._160 = {
781 					.rx_tx_mcs9_max_nss = 0x22,
782 					.rx_tx_mcs11_max_nss = 0x22,
783 					.rx_tx_mcs13_max_nss = 0x22,
784 				},
785 				.bw._320 = {
786 					.rx_tx_mcs9_max_nss = 0x22,
787 					.rx_tx_mcs11_max_nss = 0x22,
788 					.rx_tx_mcs13_max_nss = 0x22,
789 				},
790 			},
791 
792 			/*
793 			 * PPE thresholds for NSS = 2, and RU index bitmap set
794 			 * to 0xc.
795 			 */
796 			.eht_ppe_thres = {0xc1, 0x0e, 0xe0 }
797 		},
798 	},
799 };
800 
801 static void iwl_init_he_6ghz_capa(struct iwl_trans *trans,
802 				  struct iwl_nvm_data *data,
803 				  struct ieee80211_supported_band *sband,
804 				  u8 tx_chains, u8 rx_chains)
805 {
806 	struct ieee80211_sta_ht_cap ht_cap;
807 	struct ieee80211_sta_vht_cap vht_cap = {};
808 	struct ieee80211_sband_iftype_data *iftype_data;
809 	u16 he_6ghz_capa = 0;
810 	u32 exp;
811 	int i;
812 
813 	if (sband->band != NL80211_BAND_6GHZ)
814 		return;
815 
816 	/* grab HT/VHT capabilities and calculate HE 6 GHz capabilities */
817 	iwl_init_ht_hw_capab(trans, data, &ht_cap, NL80211_BAND_5GHZ,
818 			     tx_chains, rx_chains);
819 	WARN_ON(!ht_cap.ht_supported);
820 	iwl_init_vht_hw_capab(trans, data, &vht_cap, tx_chains, rx_chains);
821 	WARN_ON(!vht_cap.vht_supported);
822 
823 	he_6ghz_capa |=
824 		u16_encode_bits(ht_cap.ampdu_density,
825 				IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
826 	exp = u32_get_bits(vht_cap.cap,
827 			   IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
828 	he_6ghz_capa |=
829 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
830 	exp = u32_get_bits(vht_cap.cap, IEEE80211_VHT_CAP_MAX_MPDU_MASK);
831 	he_6ghz_capa |=
832 		u16_encode_bits(exp, IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
833 	/* we don't support extended_ht_cap_info anywhere, so no RD_RESPONDER */
834 	if (vht_cap.cap & IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN)
835 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS;
836 	if (vht_cap.cap & IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN)
837 		he_6ghz_capa |= IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
838 
839 	IWL_DEBUG_EEPROM(trans->dev, "he_6ghz_capa=0x%x\n", he_6ghz_capa);
840 
841 	/* we know it's writable - we set it before ourselves */
842 	iftype_data = (void *)(uintptr_t)sband->iftype_data;
843 	for (i = 0; i < sband->n_iftype_data; i++)
844 		iftype_data[i].he_6ghz_capa.capa = cpu_to_le16(he_6ghz_capa);
845 }
846 
847 static void
848 iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
849 			 struct iwl_nvm_data *data,
850 			 struct ieee80211_supported_band *sband,
851 			 struct ieee80211_sband_iftype_data *iftype_data,
852 			 u8 tx_chains, u8 rx_chains,
853 			 const struct iwl_fw *fw)
854 {
855 	bool is_ap = iftype_data->types_mask & BIT(NL80211_IFTYPE_AP);
856 
857 	if (!data->sku_cap_11be_enable || iwlwifi_mod_params.disable_11be)
858 		iftype_data->eht_cap.has_eht = false;
859 
860 	/* Advertise an A-MPDU exponent extension based on
861 	 * operating band
862 	 */
863 	if (sband->band == NL80211_BAND_6GHZ && iftype_data->eht_cap.has_eht)
864 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
865 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
866 	else if (sband->band != NL80211_BAND_2GHZ)
867 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
868 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1;
869 	else
870 		iftype_data->he_cap.he_cap_elem.mac_cap_info[3] |=
871 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
872 
873 	switch (sband->band) {
874 	case NL80211_BAND_2GHZ:
875 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
876 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
877 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] |=
878 			u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
879 				       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
880 		break;
881 	case NL80211_BAND_6GHZ:
882 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[0] |=
883 			IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
884 		fallthrough;
885 	case NL80211_BAND_5GHZ:
886 		iftype_data->he_cap.he_cap_elem.phy_cap_info[0] |=
887 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
888 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
889 		break;
890 	default:
891 		WARN_ON(1);
892 		break;
893 	}
894 
895 	if ((tx_chains & rx_chains) == ANT_AB) {
896 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
897 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ;
898 		iftype_data->he_cap.he_cap_elem.phy_cap_info[5] |=
899 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2 |
900 			IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2;
901 		if (!is_ap) {
902 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
903 				IEEE80211_HE_PHY_CAP7_MAX_NC_2;
904 
905 			if (iftype_data->eht_cap.has_eht) {
906 				/*
907 				 * Set the number of sounding dimensions for each
908 				 * bandwidth to 1 to indicate the maximal supported
909 				 * value of TXVECTOR parameter NUM_STS of 2
910 				 */
911 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[2] |= 0x49;
912 
913 				/*
914 				 * Set the MAX NC to 1 to indicate sounding feedback of
915 				 * 2 supported by the beamfomee.
916 				 */
917 				iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] |= 0x10;
918 			}
919 		}
920 	} else {
921 		if (iftype_data->eht_cap.has_eht) {
922 			struct ieee80211_eht_mcs_nss_supp *mcs_nss =
923 				&iftype_data->eht_cap.eht_mcs_nss_supp;
924 
925 			memset(mcs_nss, 0x11, sizeof(*mcs_nss));
926 		}
927 
928 		if (!is_ap) {
929 			/* If not 2x2, we need to indicate 1x1 in the
930 			 * Midamble RX Max NSTS - but not for AP mode
931 			 */
932 			iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &=
933 				~IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS;
934 			iftype_data->he_cap.he_cap_elem.phy_cap_info[2] &=
935 				~IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS;
936 			iftype_data->he_cap.he_cap_elem.phy_cap_info[7] |=
937 				IEEE80211_HE_PHY_CAP7_MAX_NC_1;
938 		}
939 	}
940 
941 	if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210 && !is_ap)
942 		iftype_data->he_cap.he_cap_elem.phy_cap_info[2] |=
943 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
944 
945 	switch (CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
946 	case IWL_CFG_RF_TYPE_GF:
947 	case IWL_CFG_RF_TYPE_MR:
948 	case IWL_CFG_RF_TYPE_MS:
949 		iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
950 			IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
951 		if (!is_ap)
952 			iftype_data->he_cap.he_cap_elem.phy_cap_info[9] |=
953 				IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
954 		break;
955 	}
956 
957 	if (CSR_HW_REV_TYPE(trans->hw_rev) == IWL_CFG_MAC_TYPE_GL &&
958 	    iftype_data->eht_cap.has_eht) {
959 		iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] &=
960 			~(IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
961 			  IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 |
962 			  IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2);
963 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[3] &=
964 			~(IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
965 			  IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
966 			  IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
967 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
968 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
969 			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK);
970 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &=
971 			~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
972 			  IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP);
973 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[5] &=
974 			~IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK;
975 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[6] &=
976 			~(IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
977 			  IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP);
978 	}
979 
980 	if (fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_BROADCAST_TWT))
981 		iftype_data->he_cap.he_cap_elem.mac_cap_info[2] |=
982 			IEEE80211_HE_MAC_CAP2_BCAST_TWT;
983 
984 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
985 	    !is_ap) {
986 		iftype_data->vendor_elems.data = iwl_vendor_caps;
987 		iftype_data->vendor_elems.len = ARRAY_SIZE(iwl_vendor_caps);
988 	}
989 }
990 
991 static void iwl_init_he_hw_capab(struct iwl_trans *trans,
992 				 struct iwl_nvm_data *data,
993 				 struct ieee80211_supported_band *sband,
994 				 u8 tx_chains, u8 rx_chains,
995 				 const struct iwl_fw *fw)
996 {
997 	struct ieee80211_sband_iftype_data *iftype_data;
998 	int i;
999 
1000 	/* should only initialize once */
1001 	if (WARN_ON(sband->iftype_data))
1002 		return;
1003 
1004 	BUILD_BUG_ON(sizeof(data->iftd.low) != sizeof(iwl_he_eht_capa));
1005 	BUILD_BUG_ON(sizeof(data->iftd.high) != sizeof(iwl_he_eht_capa));
1006 	BUILD_BUG_ON(sizeof(data->iftd.uhb) != sizeof(iwl_he_eht_capa));
1007 
1008 	switch (sband->band) {
1009 	case NL80211_BAND_2GHZ:
1010 		iftype_data = data->iftd.low;
1011 		break;
1012 	case NL80211_BAND_5GHZ:
1013 		iftype_data = data->iftd.high;
1014 		break;
1015 	case NL80211_BAND_6GHZ:
1016 		iftype_data = data->iftd.uhb;
1017 		break;
1018 	default:
1019 		WARN_ON(1);
1020 		return;
1021 	}
1022 
1023 	memcpy(iftype_data, iwl_he_eht_capa, sizeof(iwl_he_eht_capa));
1024 
1025 	sband->iftype_data = iftype_data;
1026 	sband->n_iftype_data = ARRAY_SIZE(iwl_he_eht_capa);
1027 
1028 	for (i = 0; i < sband->n_iftype_data; i++)
1029 		iwl_nvm_fixup_sband_iftd(trans, data, sband, &iftype_data[i],
1030 					 tx_chains, rx_chains, fw);
1031 
1032 	iwl_init_he_6ghz_capa(trans, data, sband, tx_chains, rx_chains);
1033 }
1034 
1035 static void iwl_init_sbands(struct iwl_trans *trans,
1036 			    struct iwl_nvm_data *data,
1037 			    const void *nvm_ch_flags, u8 tx_chains,
1038 			    u8 rx_chains, u32 sbands_flags, bool v4,
1039 			    const struct iwl_fw *fw)
1040 {
1041 	struct device *dev = trans->dev;
1042 	const struct iwl_cfg *cfg = trans->cfg;
1043 	int n_channels;
1044 	int n_used = 0;
1045 	struct ieee80211_supported_band *sband;
1046 
1047 	n_channels = iwl_init_channel_map(dev, cfg, data, nvm_ch_flags,
1048 					  sbands_flags, v4);
1049 	sband = &data->bands[NL80211_BAND_2GHZ];
1050 	sband->band = NL80211_BAND_2GHZ;
1051 	sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
1052 	sband->n_bitrates = N_RATES_24;
1053 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1054 					  NL80211_BAND_2GHZ);
1055 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_2GHZ,
1056 			     tx_chains, rx_chains);
1057 
1058 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1059 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1060 				     fw);
1061 
1062 	sband = &data->bands[NL80211_BAND_5GHZ];
1063 	sband->band = NL80211_BAND_5GHZ;
1064 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1065 	sband->n_bitrates = N_RATES_52;
1066 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1067 					  NL80211_BAND_5GHZ);
1068 	iwl_init_ht_hw_capab(trans, data, &sband->ht_cap, NL80211_BAND_5GHZ,
1069 			     tx_chains, rx_chains);
1070 	if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
1071 		iwl_init_vht_hw_capab(trans, data, &sband->vht_cap,
1072 				      tx_chains, rx_chains);
1073 
1074 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1075 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1076 				     fw);
1077 
1078 	/* 6GHz band. */
1079 	sband = &data->bands[NL80211_BAND_6GHZ];
1080 	sband->band = NL80211_BAND_6GHZ;
1081 	/* use the same rates as 5GHz band */
1082 	sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
1083 	sband->n_bitrates = N_RATES_52;
1084 	n_used += iwl_init_sband_channels(data, sband, n_channels,
1085 					  NL80211_BAND_6GHZ);
1086 
1087 	if (data->sku_cap_11ax_enable && !iwlwifi_mod_params.disable_11ax)
1088 		iwl_init_he_hw_capab(trans, data, sband, tx_chains, rx_chains,
1089 				     fw);
1090 	else
1091 		sband->n_channels = 0;
1092 	if (n_channels != n_used)
1093 		IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
1094 			    n_used, n_channels);
1095 }
1096 
1097 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1098 		       const __le16 *phy_sku)
1099 {
1100 	if (cfg->nvm_type != IWL_NVM_EXT)
1101 		return le16_to_cpup(nvm_sw + SKU);
1102 
1103 	return le32_to_cpup((const __le32 *)(phy_sku + SKU_FAMILY_8000));
1104 }
1105 
1106 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1107 {
1108 	if (cfg->nvm_type != IWL_NVM_EXT)
1109 		return le16_to_cpup(nvm_sw + NVM_VERSION);
1110 	else
1111 		return le32_to_cpup((const __le32 *)(nvm_sw +
1112 						     NVM_VERSION_EXT_NVM));
1113 }
1114 
1115 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
1116 			     const __le16 *phy_sku)
1117 {
1118 	if (cfg->nvm_type != IWL_NVM_EXT)
1119 		return le16_to_cpup(nvm_sw + RADIO_CFG);
1120 
1121 	return le32_to_cpup((const __le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
1122 
1123 }
1124 
1125 static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
1126 {
1127 	int n_hw_addr;
1128 
1129 	if (cfg->nvm_type != IWL_NVM_EXT)
1130 		return le16_to_cpup(nvm_sw + N_HW_ADDRS);
1131 
1132 	n_hw_addr = le32_to_cpup((const __le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
1133 
1134 	return n_hw_addr & N_HW_ADDR_MASK;
1135 }
1136 
1137 static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
1138 			      struct iwl_nvm_data *data,
1139 			      u32 radio_cfg)
1140 {
1141 	if (cfg->nvm_type != IWL_NVM_EXT) {
1142 		data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
1143 		data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
1144 		data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
1145 		data->radio_cfg_pnum = NVM_RF_CFG_PNUM_MSK(radio_cfg);
1146 		return;
1147 	}
1148 
1149 	/* set the radio configuration for family 8000 */
1150 	data->radio_cfg_type = EXT_NVM_RF_CFG_TYPE_MSK(radio_cfg);
1151 	data->radio_cfg_step = EXT_NVM_RF_CFG_STEP_MSK(radio_cfg);
1152 	data->radio_cfg_dash = EXT_NVM_RF_CFG_DASH_MSK(radio_cfg);
1153 	data->radio_cfg_pnum = EXT_NVM_RF_CFG_FLAVOR_MSK(radio_cfg);
1154 	data->valid_tx_ant = EXT_NVM_RF_CFG_TX_ANT_MSK(radio_cfg);
1155 	data->valid_rx_ant = EXT_NVM_RF_CFG_RX_ANT_MSK(radio_cfg);
1156 }
1157 
1158 static void iwl_flip_hw_address(__le32 mac_addr0, __le32 mac_addr1, u8 *dest)
1159 {
1160 	const u8 *hw_addr;
1161 
1162 	hw_addr = (const u8 *)&mac_addr0;
1163 	dest[0] = hw_addr[3];
1164 	dest[1] = hw_addr[2];
1165 	dest[2] = hw_addr[1];
1166 	dest[3] = hw_addr[0];
1167 
1168 	hw_addr = (const u8 *)&mac_addr1;
1169 	dest[4] = hw_addr[1];
1170 	dest[5] = hw_addr[0];
1171 }
1172 
1173 static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
1174 					struct iwl_nvm_data *data)
1175 {
1176 	__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans,
1177 						  CSR_MAC_ADDR0_STRAP(trans)));
1178 	__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans,
1179 						  CSR_MAC_ADDR1_STRAP(trans)));
1180 
1181 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1182 	/*
1183 	 * If the OEM fused a valid address, use it instead of the one in the
1184 	 * OTP
1185 	 */
1186 	if (is_valid_ether_addr(data->hw_addr))
1187 		return;
1188 
1189 	mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP(trans)));
1190 	mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP(trans)));
1191 
1192 	iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1193 }
1194 
1195 static void iwl_set_hw_address_family_8000(struct iwl_trans *trans,
1196 					   const struct iwl_cfg *cfg,
1197 					   struct iwl_nvm_data *data,
1198 					   const __le16 *mac_override,
1199 					   const __be16 *nvm_hw)
1200 {
1201 	const u8 *hw_addr;
1202 
1203 	if (mac_override) {
1204 		static const u8 reserved_mac[] = {
1205 			0x02, 0xcc, 0xaa, 0xff, 0xee, 0x00
1206 		};
1207 
1208 		hw_addr = (const u8 *)(mac_override +
1209 				 MAC_ADDRESS_OVERRIDE_EXT_NVM);
1210 
1211 		/*
1212 		 * Store the MAC address from MAO section.
1213 		 * No byte swapping is required in MAO section
1214 		 */
1215 		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
1216 
1217 		/*
1218 		 * Force the use of the OTP MAC address in case of reserved MAC
1219 		 * address in the NVM, or if address is given but invalid.
1220 		 */
1221 		if (is_valid_ether_addr(data->hw_addr) &&
1222 		    memcmp(reserved_mac, hw_addr, ETH_ALEN) != 0)
1223 			return;
1224 
1225 		IWL_ERR(trans,
1226 			"mac address from nvm override section is not valid\n");
1227 	}
1228 
1229 	if (nvm_hw) {
1230 		/* read the mac address from WFMP registers */
1231 		__le32 mac_addr0 = cpu_to_le32(iwl_trans_read_prph(trans,
1232 						WFMP_MAC_ADDR_0));
1233 		__le32 mac_addr1 = cpu_to_le32(iwl_trans_read_prph(trans,
1234 						WFMP_MAC_ADDR_1));
1235 
1236 		iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
1237 
1238 		return;
1239 	}
1240 
1241 	IWL_ERR(trans, "mac address is not found\n");
1242 }
1243 
1244 static int iwl_set_hw_address(struct iwl_trans *trans,
1245 			      const struct iwl_cfg *cfg,
1246 			      struct iwl_nvm_data *data, const __be16 *nvm_hw,
1247 			      const __le16 *mac_override)
1248 {
1249 	if (cfg->mac_addr_from_csr) {
1250 		iwl_set_hw_address_from_csr(trans, data);
1251 	} else if (cfg->nvm_type != IWL_NVM_EXT) {
1252 		const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
1253 
1254 		/* The byte order is little endian 16 bit, meaning 214365 */
1255 		data->hw_addr[0] = hw_addr[1];
1256 		data->hw_addr[1] = hw_addr[0];
1257 		data->hw_addr[2] = hw_addr[3];
1258 		data->hw_addr[3] = hw_addr[2];
1259 		data->hw_addr[4] = hw_addr[5];
1260 		data->hw_addr[5] = hw_addr[4];
1261 	} else {
1262 		iwl_set_hw_address_family_8000(trans, cfg, data,
1263 					       mac_override, nvm_hw);
1264 	}
1265 
1266 	if (!is_valid_ether_addr(data->hw_addr)) {
1267 		IWL_ERR(trans, "no valid mac address was found\n");
1268 		return -EINVAL;
1269 	}
1270 
1271 	if (!trans->csme_own)
1272 		IWL_INFO(trans, "base HW address: %pM, OTP minor version: 0x%x\n",
1273 			 data->hw_addr, iwl_read_prph(trans, REG_OTP_MINOR));
1274 
1275 	return 0;
1276 }
1277 
1278 static bool
1279 iwl_nvm_no_wide_in_5ghz(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1280 			const __be16 *nvm_hw)
1281 {
1282 	/*
1283 	 * Workaround a bug in Indonesia SKUs where the regulatory in
1284 	 * some 7000-family OTPs erroneously allow wide channels in
1285 	 * 5GHz.  To check for Indonesia, we take the SKU value from
1286 	 * bits 1-4 in the subsystem ID and check if it is either 5 or
1287 	 * 9.  In those cases, we need to force-disable wide channels
1288 	 * in 5GHz otherwise the FW will throw a sysassert when we try
1289 	 * to use them.
1290 	 */
1291 	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_7000) {
1292 		/*
1293 		 * Unlike the other sections in the NVM, the hw
1294 		 * section uses big-endian.
1295 		 */
1296 		u16 subsystem_id = be16_to_cpup(nvm_hw + SUBSYSTEM_ID);
1297 		u8 sku = (subsystem_id & 0x1e) >> 1;
1298 
1299 		if (sku == 5 || sku == 9) {
1300 			IWL_DEBUG_EEPROM(trans->dev,
1301 					 "disabling wide channels in 5GHz (0x%0x %d)\n",
1302 					 subsystem_id, sku);
1303 			return true;
1304 		}
1305 	}
1306 
1307 	return false;
1308 }
1309 
1310 struct iwl_nvm_data *
1311 iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1312 		       const struct iwl_mei_nvm *mei_nvm,
1313 		       const struct iwl_fw *fw)
1314 {
1315 	struct iwl_nvm_data *data;
1316 	u32 sbands_flags = 0;
1317 	u8 rx_chains = fw->valid_rx_ant;
1318 	u8 tx_chains = fw->valid_rx_ant;
1319 
1320 	if (cfg->uhb_supported)
1321 		data = kzalloc(struct_size(data, channels,
1322 					   IWL_NVM_NUM_CHANNELS_UHB),
1323 					   GFP_KERNEL);
1324 	else
1325 		data = kzalloc(struct_size(data, channels,
1326 					   IWL_NVM_NUM_CHANNELS_EXT),
1327 					   GFP_KERNEL);
1328 	if (!data)
1329 		return NULL;
1330 
1331 	BUILD_BUG_ON(ARRAY_SIZE(mei_nvm->channels) !=
1332 		     IWL_NVM_NUM_CHANNELS_UHB);
1333 	data->nvm_version = mei_nvm->nvm_version;
1334 
1335 	iwl_set_radio_cfg(cfg, data, mei_nvm->radio_cfg);
1336 	if (data->valid_tx_ant)
1337 		tx_chains &= data->valid_tx_ant;
1338 	if (data->valid_rx_ant)
1339 		rx_chains &= data->valid_rx_ant;
1340 
1341 	data->sku_cap_mimo_disabled = false;
1342 	data->sku_cap_band_24ghz_enable = true;
1343 	data->sku_cap_band_52ghz_enable = true;
1344 	data->sku_cap_11n_enable =
1345 		!(iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL);
1346 	data->sku_cap_11ac_enable = true;
1347 	data->sku_cap_11ax_enable =
1348 		mei_nvm->caps & MEI_NVM_CAPS_11AX_SUPPORT;
1349 
1350 	data->lar_enabled = mei_nvm->caps & MEI_NVM_CAPS_LARI_SUPPORT;
1351 
1352 	data->n_hw_addrs = mei_nvm->n_hw_addrs;
1353 	/* If no valid mac address was found - bail out */
1354 	if (iwl_set_hw_address(trans, cfg, data, NULL, NULL)) {
1355 		kfree(data);
1356 		return NULL;
1357 	}
1358 
1359 	if (data->lar_enabled &&
1360 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1361 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1362 
1363 	iwl_init_sbands(trans, data, mei_nvm->channels, tx_chains, rx_chains,
1364 			sbands_flags, true, fw);
1365 
1366 	return data;
1367 }
1368 IWL_EXPORT_SYMBOL(iwl_parse_mei_nvm_data);
1369 
1370 struct iwl_nvm_data *
1371 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
1372 		   const struct iwl_fw *fw,
1373 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
1374 		   const __le16 *nvm_calib, const __le16 *regulatory,
1375 		   const __le16 *mac_override, const __le16 *phy_sku,
1376 		   u8 tx_chains, u8 rx_chains)
1377 {
1378 	struct iwl_nvm_data *data;
1379 	bool lar_enabled;
1380 	u32 sku, radio_cfg;
1381 	u32 sbands_flags = 0;
1382 	u16 lar_config;
1383 	const __le16 *ch_section;
1384 
1385 	if (cfg->uhb_supported)
1386 		data = kzalloc(struct_size(data, channels,
1387 					   IWL_NVM_NUM_CHANNELS_UHB),
1388 					   GFP_KERNEL);
1389 	else if (cfg->nvm_type != IWL_NVM_EXT)
1390 		data = kzalloc(struct_size(data, channels,
1391 					   IWL_NVM_NUM_CHANNELS),
1392 					   GFP_KERNEL);
1393 	else
1394 		data = kzalloc(struct_size(data, channels,
1395 					   IWL_NVM_NUM_CHANNELS_EXT),
1396 					   GFP_KERNEL);
1397 	if (!data)
1398 		return NULL;
1399 
1400 	data->nvm_version = iwl_get_nvm_version(cfg, nvm_sw);
1401 
1402 	radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw, phy_sku);
1403 	iwl_set_radio_cfg(cfg, data, radio_cfg);
1404 	if (data->valid_tx_ant)
1405 		tx_chains &= data->valid_tx_ant;
1406 	if (data->valid_rx_ant)
1407 		rx_chains &= data->valid_rx_ant;
1408 
1409 	sku = iwl_get_sku(cfg, nvm_sw, phy_sku);
1410 	data->sku_cap_band_24ghz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
1411 	data->sku_cap_band_52ghz_enable = sku & NVM_SKU_CAP_BAND_52GHZ;
1412 	data->sku_cap_11n_enable = sku & NVM_SKU_CAP_11N_ENABLE;
1413 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL)
1414 		data->sku_cap_11n_enable = false;
1415 	data->sku_cap_11ac_enable = data->sku_cap_11n_enable &&
1416 				    (sku & NVM_SKU_CAP_11AC_ENABLE);
1417 	data->sku_cap_mimo_disabled = sku & NVM_SKU_CAP_MIMO_DISABLE;
1418 
1419 	data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
1420 
1421 	if (cfg->nvm_type != IWL_NVM_EXT) {
1422 		/* Checking for required sections */
1423 		if (!nvm_calib) {
1424 			IWL_ERR(trans,
1425 				"Can't parse empty Calib NVM sections\n");
1426 			kfree(data);
1427 			return NULL;
1428 		}
1429 
1430 		ch_section = cfg->nvm_type == IWL_NVM_SDP ?
1431 			     &regulatory[NVM_CHANNELS_SDP] :
1432 			     &nvm_sw[NVM_CHANNELS];
1433 
1434 		/* in family 8000 Xtal calibration values moved to OTP */
1435 		data->xtal_calib[0] = *(nvm_calib + XTAL_CALIB);
1436 		data->xtal_calib[1] = *(nvm_calib + XTAL_CALIB + 1);
1437 		lar_enabled = true;
1438 	} else {
1439 		u16 lar_offset = data->nvm_version < 0xE39 ?
1440 				 NVM_LAR_OFFSET_OLD :
1441 				 NVM_LAR_OFFSET;
1442 
1443 		lar_config = le16_to_cpup(regulatory + lar_offset);
1444 		data->lar_enabled = !!(lar_config &
1445 				       NVM_LAR_ENABLED);
1446 		lar_enabled = data->lar_enabled;
1447 		ch_section = &regulatory[NVM_CHANNELS_EXTENDED];
1448 	}
1449 
1450 	/* If no valid mac address was found - bail out */
1451 	if (iwl_set_hw_address(trans, cfg, data, nvm_hw, mac_override)) {
1452 		kfree(data);
1453 		return NULL;
1454 	}
1455 
1456 	if (lar_enabled &&
1457 	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
1458 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1459 
1460 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
1461 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_NO_WIDE_IN_5GHZ;
1462 
1463 	iwl_init_sbands(trans, data, ch_section, tx_chains, rx_chains,
1464 			sbands_flags, false, fw);
1465 	data->calib_version = 255;
1466 
1467 	return data;
1468 }
1469 IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
1470 
1471 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
1472 				       int ch_idx, u16 nvm_flags,
1473 				       struct iwl_reg_capa reg_capa,
1474 				       const struct iwl_cfg *cfg)
1475 {
1476 	u32 flags = NL80211_RRF_NO_HT40;
1477 
1478 	if (ch_idx < NUM_2GHZ_CHANNELS &&
1479 	    (nvm_flags & NVM_CHANNEL_40MHZ)) {
1480 		if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
1481 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1482 		if (nvm_chan[ch_idx] >= FIRST_2GHZ_HT_MINUS)
1483 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1484 	} else if (nvm_flags & NVM_CHANNEL_40MHZ) {
1485 		if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
1486 			flags &= ~NL80211_RRF_NO_HT40PLUS;
1487 		else
1488 			flags &= ~NL80211_RRF_NO_HT40MINUS;
1489 	}
1490 
1491 	if (!(nvm_flags & NVM_CHANNEL_80MHZ))
1492 		flags |= NL80211_RRF_NO_80MHZ;
1493 	if (!(nvm_flags & NVM_CHANNEL_160MHZ))
1494 		flags |= NL80211_RRF_NO_160MHZ;
1495 
1496 	if (!(nvm_flags & NVM_CHANNEL_ACTIVE))
1497 		flags |= NL80211_RRF_NO_IR;
1498 
1499 	if (nvm_flags & NVM_CHANNEL_RADAR)
1500 		flags |= NL80211_RRF_DFS;
1501 
1502 	if (nvm_flags & NVM_CHANNEL_INDOOR_ONLY)
1503 		flags |= NL80211_RRF_NO_OUTDOOR;
1504 
1505 	/* Set the GO concurrent flag only in case that NO_IR is set.
1506 	 * Otherwise it is meaningless
1507 	 */
1508 	if ((nvm_flags & NVM_CHANNEL_GO_CONCURRENT) &&
1509 	    (flags & NL80211_RRF_NO_IR))
1510 		flags |= NL80211_RRF_GO_CONCURRENT;
1511 
1512 	/*
1513 	 * reg_capa is per regulatory domain so apply it for every channel
1514 	 */
1515 	if (ch_idx >= NUM_2GHZ_CHANNELS) {
1516 		if (!reg_capa.allow_40mhz)
1517 			flags |= NL80211_RRF_NO_HT40;
1518 
1519 		if (!reg_capa.allow_80mhz)
1520 			flags |= NL80211_RRF_NO_80MHZ;
1521 
1522 		if (!reg_capa.allow_160mhz)
1523 			flags |= NL80211_RRF_NO_160MHZ;
1524 	}
1525 	if (reg_capa.disable_11ax)
1526 		flags |= NL80211_RRF_NO_HE;
1527 
1528 	return flags;
1529 }
1530 
1531 static struct iwl_reg_capa iwl_get_reg_capa(u16 flags, u8 resp_ver)
1532 {
1533 	struct iwl_reg_capa reg_capa;
1534 
1535 	if (resp_ver >= REG_CAPA_V2_RESP_VER) {
1536 		reg_capa.allow_40mhz = flags & REG_CAPA_V2_40MHZ_ALLOWED;
1537 		reg_capa.allow_80mhz = flags & REG_CAPA_V2_80MHZ_ALLOWED;
1538 		reg_capa.allow_160mhz = flags & REG_CAPA_V2_160MHZ_ALLOWED;
1539 		reg_capa.disable_11ax = flags & REG_CAPA_V2_11AX_DISABLED;
1540 	} else {
1541 		reg_capa.allow_40mhz = !(flags & REG_CAPA_40MHZ_FORBIDDEN);
1542 		reg_capa.allow_80mhz = flags & REG_CAPA_80MHZ_ALLOWED;
1543 		reg_capa.allow_160mhz = flags & REG_CAPA_160MHZ_ALLOWED;
1544 		reg_capa.disable_11ax = flags & REG_CAPA_11AX_DISABLED;
1545 	}
1546 	return reg_capa;
1547 }
1548 
1549 struct ieee80211_regdomain *
1550 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
1551 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
1552 		       u16 geo_info, u16 cap, u8 resp_ver)
1553 {
1554 	int ch_idx;
1555 	u16 ch_flags;
1556 	u32 reg_rule_flags, prev_reg_rule_flags = 0;
1557 	const u16 *nvm_chan;
1558 	struct ieee80211_regdomain *regd, *copy_rd;
1559 	struct ieee80211_reg_rule *rule;
1560 	enum nl80211_band band;
1561 	int center_freq, prev_center_freq = 0;
1562 	int valid_rules = 0;
1563 	bool new_rule;
1564 	int max_num_ch;
1565 	struct iwl_reg_capa reg_capa;
1566 
1567 	if (cfg->uhb_supported) {
1568 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
1569 		nvm_chan = iwl_uhb_nvm_channels;
1570 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
1571 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
1572 		nvm_chan = iwl_ext_nvm_channels;
1573 	} else {
1574 		max_num_ch = IWL_NVM_NUM_CHANNELS;
1575 		nvm_chan = iwl_nvm_channels;
1576 	}
1577 
1578 	if (num_of_ch > max_num_ch) {
1579 		IWL_DEBUG_DEV(dev, IWL_DL_LAR,
1580 			      "Num of channels (%d) is greater than expected. Truncating to %d\n",
1581 			      num_of_ch, max_num_ch);
1582 		num_of_ch = max_num_ch;
1583 	}
1584 
1585 	if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
1586 		return ERR_PTR(-EINVAL);
1587 
1588 	IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
1589 		      num_of_ch);
1590 
1591 	/* build a regdomain rule for every valid channel */
1592 	regd = kzalloc(struct_size(regd, reg_rules, num_of_ch), GFP_KERNEL);
1593 	if (!regd)
1594 		return ERR_PTR(-ENOMEM);
1595 
1596 	/* set alpha2 from FW. */
1597 	regd->alpha2[0] = fw_mcc >> 8;
1598 	regd->alpha2[1] = fw_mcc & 0xff;
1599 
1600 	/* parse regulatory capability flags */
1601 	reg_capa = iwl_get_reg_capa(cap, resp_ver);
1602 
1603 	for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
1604 		ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
1605 		band = iwl_nl80211_band_from_channel_idx(ch_idx);
1606 		center_freq = ieee80211_channel_to_frequency(nvm_chan[ch_idx],
1607 							     band);
1608 		new_rule = false;
1609 
1610 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
1611 			iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1612 						    nvm_chan[ch_idx], ch_flags);
1613 			continue;
1614 		}
1615 
1616 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
1617 							     ch_flags, reg_capa,
1618 							     cfg);
1619 
1620 		/* we can't continue the same rule */
1621 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
1622 		    center_freq - prev_center_freq > 20) {
1623 			valid_rules++;
1624 			new_rule = true;
1625 		}
1626 
1627 		rule = &regd->reg_rules[valid_rules - 1];
1628 
1629 		if (new_rule)
1630 			rule->freq_range.start_freq_khz =
1631 						MHZ_TO_KHZ(center_freq - 10);
1632 
1633 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(center_freq + 10);
1634 
1635 		/* this doesn't matter - not used by FW */
1636 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1637 		rule->power_rule.max_eirp =
1638 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1639 
1640 		rule->flags = reg_rule_flags;
1641 
1642 		/* rely on auto-calculation to merge BW of contiguous chans */
1643 		rule->flags |= NL80211_RRF_AUTO_BW;
1644 		rule->freq_range.max_bandwidth_khz = 0;
1645 
1646 		prev_center_freq = center_freq;
1647 		prev_reg_rule_flags = reg_rule_flags;
1648 
1649 		iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
1650 					    nvm_chan[ch_idx], ch_flags);
1651 
1652 		if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
1653 		    band == NL80211_BAND_2GHZ)
1654 			continue;
1655 
1656 		reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
1657 	}
1658 
1659 	/*
1660 	 * Certain firmware versions might report no valid channels
1661 	 * if booted in RF-kill, i.e. not all calibrations etc. are
1662 	 * running. We'll get out of this situation later when the
1663 	 * rfkill is removed and we update the regdomain again, but
1664 	 * since cfg80211 doesn't accept an empty regdomain, add a
1665 	 * dummy (unusable) rule here in this case so we can init.
1666 	 */
1667 	if (!valid_rules) {
1668 		valid_rules = 1;
1669 		rule = &regd->reg_rules[valid_rules - 1];
1670 		rule->freq_range.start_freq_khz = MHZ_TO_KHZ(2412);
1671 		rule->freq_range.end_freq_khz = MHZ_TO_KHZ(2413);
1672 		rule->freq_range.max_bandwidth_khz = MHZ_TO_KHZ(1);
1673 		rule->power_rule.max_antenna_gain = DBI_TO_MBI(6);
1674 		rule->power_rule.max_eirp =
1675 			DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
1676 	}
1677 
1678 	regd->n_reg_rules = valid_rules;
1679 
1680 	/*
1681 	 * Narrow down regdom for unused regulatory rules to prevent hole
1682 	 * between reg rules to wmm rules.
1683 	 */
1684 	copy_rd = kmemdup(regd, struct_size(regd, reg_rules, valid_rules),
1685 			  GFP_KERNEL);
1686 	if (!copy_rd)
1687 		copy_rd = ERR_PTR(-ENOMEM);
1688 
1689 	kfree(regd);
1690 	return copy_rd;
1691 }
1692 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
1693 
1694 #define IWL_MAX_NVM_SECTION_SIZE	0x1b58
1695 #define IWL_MAX_EXT_NVM_SECTION_SIZE	0x1ffc
1696 #define MAX_NVM_FILE_LEN	16384
1697 
1698 void iwl_nvm_fixups(u32 hw_id, unsigned int section, u8 *data,
1699 		    unsigned int len)
1700 {
1701 #define IWL_4165_DEVICE_ID	0x5501
1702 #define NVM_SKU_CAP_MIMO_DISABLE BIT(5)
1703 
1704 	if (section == NVM_SECTION_TYPE_PHY_SKU &&
1705 	    hw_id == IWL_4165_DEVICE_ID && data && len >= 5 &&
1706 	    (data[4] & NVM_SKU_CAP_MIMO_DISABLE))
1707 		/* OTP 0x52 bug work around: it's a 1x1 device */
1708 		data[3] = ANT_B | (ANT_B << 4);
1709 }
1710 IWL_EXPORT_SYMBOL(iwl_nvm_fixups);
1711 
1712 /*
1713  * Reads external NVM from a file into mvm->nvm_sections
1714  *
1715  * HOW TO CREATE THE NVM FILE FORMAT:
1716  * ------------------------------
1717  * 1. create hex file, format:
1718  *      3800 -> header
1719  *      0000 -> header
1720  *      5a40 -> data
1721  *
1722  *   rev - 6 bit (word1)
1723  *   len - 10 bit (word1)
1724  *   id - 4 bit (word2)
1725  *   rsv - 12 bit (word2)
1726  *
1727  * 2. flip 8bits with 8 bits per line to get the right NVM file format
1728  *
1729  * 3. create binary file from the hex file
1730  *
1731  * 4. save as "iNVM_xxx.bin" under /lib/firmware
1732  */
1733 int iwl_read_external_nvm(struct iwl_trans *trans,
1734 			  const char *nvm_file_name,
1735 			  struct iwl_nvm_section *nvm_sections)
1736 {
1737 	int ret, section_size;
1738 	u16 section_id;
1739 	const struct firmware *fw_entry;
1740 	const struct {
1741 		__le16 word1;
1742 		__le16 word2;
1743 		u8 data[];
1744 	} *file_sec;
1745 	const u8 *eof;
1746 	u8 *temp;
1747 	int max_section_size;
1748 	const __le32 *dword_buff;
1749 
1750 #define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
1751 #define NVM_WORD2_ID(x) (x >> 12)
1752 #define EXT_NVM_WORD2_LEN(x) (2 * (((x) & 0xFF) << 8 | (x) >> 8))
1753 #define EXT_NVM_WORD1_ID(x) ((x) >> 4)
1754 #define NVM_HEADER_0	(0x2A504C54)
1755 #define NVM_HEADER_1	(0x4E564D2A)
1756 #define NVM_HEADER_SIZE	(4 * sizeof(u32))
1757 
1758 	IWL_DEBUG_EEPROM(trans->dev, "Read from external NVM\n");
1759 
1760 	/* Maximal size depends on NVM version */
1761 	if (trans->cfg->nvm_type != IWL_NVM_EXT)
1762 		max_section_size = IWL_MAX_NVM_SECTION_SIZE;
1763 	else
1764 		max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
1765 
1766 	/*
1767 	 * Obtain NVM image via request_firmware. Since we already used
1768 	 * request_firmware_nowait() for the firmware binary load and only
1769 	 * get here after that we assume the NVM request can be satisfied
1770 	 * synchronously.
1771 	 */
1772 	ret = request_firmware(&fw_entry, nvm_file_name, trans->dev);
1773 	if (ret) {
1774 		IWL_ERR(trans, "ERROR: %s isn't available %d\n",
1775 			nvm_file_name, ret);
1776 		return ret;
1777 	}
1778 
1779 	IWL_INFO(trans, "Loaded NVM file %s (%zu bytes)\n",
1780 		 nvm_file_name, fw_entry->size);
1781 
1782 	if (fw_entry->size > MAX_NVM_FILE_LEN) {
1783 		IWL_ERR(trans, "NVM file too large\n");
1784 		ret = -EINVAL;
1785 		goto out;
1786 	}
1787 
1788 	eof = fw_entry->data + fw_entry->size;
1789 	dword_buff = (const __le32 *)fw_entry->data;
1790 
1791 	/* some NVM file will contain a header.
1792 	 * The header is identified by 2 dwords header as follow:
1793 	 * dword[0] = 0x2A504C54
1794 	 * dword[1] = 0x4E564D2A
1795 	 *
1796 	 * This header must be skipped when providing the NVM data to the FW.
1797 	 */
1798 	if (fw_entry->size > NVM_HEADER_SIZE &&
1799 	    dword_buff[0] == cpu_to_le32(NVM_HEADER_0) &&
1800 	    dword_buff[1] == cpu_to_le32(NVM_HEADER_1)) {
1801 		file_sec = (const void *)(fw_entry->data + NVM_HEADER_SIZE);
1802 		IWL_INFO(trans, "NVM Version %08X\n", le32_to_cpu(dword_buff[2]));
1803 		IWL_INFO(trans, "NVM Manufacturing date %08X\n",
1804 			 le32_to_cpu(dword_buff[3]));
1805 
1806 		/* nvm file validation, dword_buff[2] holds the file version */
1807 		if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
1808 		    trans->hw_rev_step == SILICON_C_STEP &&
1809 		    le32_to_cpu(dword_buff[2]) < 0xE4A) {
1810 			ret = -EFAULT;
1811 			goto out;
1812 		}
1813 	} else {
1814 		file_sec = (const void *)fw_entry->data;
1815 	}
1816 
1817 	while (true) {
1818 		if (file_sec->data > eof) {
1819 			IWL_ERR(trans,
1820 				"ERROR - NVM file too short for section header\n");
1821 			ret = -EINVAL;
1822 			break;
1823 		}
1824 
1825 		/* check for EOF marker */
1826 		if (!file_sec->word1 && !file_sec->word2) {
1827 			ret = 0;
1828 			break;
1829 		}
1830 
1831 		if (trans->cfg->nvm_type != IWL_NVM_EXT) {
1832 			section_size =
1833 				2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
1834 			section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
1835 		} else {
1836 			section_size = 2 * EXT_NVM_WORD2_LEN(
1837 						le16_to_cpu(file_sec->word2));
1838 			section_id = EXT_NVM_WORD1_ID(
1839 						le16_to_cpu(file_sec->word1));
1840 		}
1841 
1842 		if (section_size > max_section_size) {
1843 			IWL_ERR(trans, "ERROR - section too large (%d)\n",
1844 				section_size);
1845 			ret = -EINVAL;
1846 			break;
1847 		}
1848 
1849 		if (!section_size) {
1850 			IWL_ERR(trans, "ERROR - section empty\n");
1851 			ret = -EINVAL;
1852 			break;
1853 		}
1854 
1855 		if (file_sec->data + section_size > eof) {
1856 			IWL_ERR(trans,
1857 				"ERROR - NVM file too short for section (%d bytes)\n",
1858 				section_size);
1859 			ret = -EINVAL;
1860 			break;
1861 		}
1862 
1863 		if (WARN(section_id >= NVM_MAX_NUM_SECTIONS,
1864 			 "Invalid NVM section ID %d\n", section_id)) {
1865 			ret = -EINVAL;
1866 			break;
1867 		}
1868 
1869 		temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
1870 		if (!temp) {
1871 			ret = -ENOMEM;
1872 			break;
1873 		}
1874 
1875 		iwl_nvm_fixups(trans->hw_id, section_id, temp, section_size);
1876 
1877 		kfree(nvm_sections[section_id].data);
1878 		nvm_sections[section_id].data = temp;
1879 		nvm_sections[section_id].length = section_size;
1880 
1881 		/* advance to the next section */
1882 		file_sec = (const void *)(file_sec->data + section_size);
1883 	}
1884 out:
1885 	release_firmware(fw_entry);
1886 	return ret;
1887 }
1888 IWL_EXPORT_SYMBOL(iwl_read_external_nvm);
1889 
1890 struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
1891 				 const struct iwl_fw *fw)
1892 {
1893 	struct iwl_nvm_get_info cmd = {};
1894 	struct iwl_nvm_data *nvm;
1895 	struct iwl_host_cmd hcmd = {
1896 		.flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
1897 		.data = { &cmd, },
1898 		.len = { sizeof(cmd) },
1899 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
1900 	};
1901 	int  ret;
1902 	bool empty_otp;
1903 	u32 mac_flags;
1904 	u32 sbands_flags = 0;
1905 	/*
1906 	 * All the values in iwl_nvm_get_info_rsp v4 are the same as
1907 	 * in v3, except for the channel profile part of the
1908 	 * regulatory.  So we can just access the new struct, with the
1909 	 * exception of the latter.
1910 	 */
1911 	struct iwl_nvm_get_info_rsp *rsp;
1912 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
1913 	bool v4 = fw_has_api(&fw->ucode_capa,
1914 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
1915 	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
1916 	void *channel_profile;
1917 
1918 	ret = iwl_trans_send_cmd(trans, &hcmd);
1919 	if (ret)
1920 		return ERR_PTR(ret);
1921 
1922 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
1923 		 "Invalid payload len in NVM response from FW %d",
1924 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
1925 		ret = -EINVAL;
1926 		goto out;
1927 	}
1928 
1929 	rsp = (void *)hcmd.resp_pkt->data;
1930 	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
1931 		       NVM_GENERAL_FLAGS_EMPTY_OTP);
1932 	if (empty_otp)
1933 		IWL_INFO(trans, "OTP is empty\n");
1934 
1935 	nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
1936 	if (!nvm) {
1937 		ret = -ENOMEM;
1938 		goto out;
1939 	}
1940 
1941 	iwl_set_hw_address_from_csr(trans, nvm);
1942 	/* TODO: if platform NVM has MAC address - override it here */
1943 
1944 	if (!is_valid_ether_addr(nvm->hw_addr)) {
1945 		IWL_ERR(trans, "no valid mac address was found\n");
1946 		ret = -EINVAL;
1947 		goto err_free;
1948 	}
1949 
1950 	IWL_INFO(trans, "base HW address: %pM\n", nvm->hw_addr);
1951 
1952 	/* Initialize general data */
1953 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
1954 	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
1955 	if (nvm->n_hw_addrs == 0)
1956 		IWL_WARN(trans,
1957 			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
1958 			 empty_otp);
1959 
1960 	/* Initialize MAC sku data */
1961 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
1962 	nvm->sku_cap_11ac_enable =
1963 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AC_ENABLED);
1964 	nvm->sku_cap_11n_enable =
1965 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11N_ENABLED);
1966 	nvm->sku_cap_11ax_enable =
1967 		!!(mac_flags & NVM_MAC_SKU_FLAGS_802_11AX_ENABLED);
1968 	nvm->sku_cap_band_24ghz_enable =
1969 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED);
1970 	nvm->sku_cap_band_52ghz_enable =
1971 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
1972 	nvm->sku_cap_mimo_disabled =
1973 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
1974 	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) == IWL_CFG_RF_TYPE_FM)
1975 		nvm->sku_cap_11be_enable = true;
1976 
1977 	/* Initialize PHY sku data */
1978 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
1979 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
1980 
1981 	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
1982 	    fw_has_capa(&fw->ucode_capa,
1983 			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
1984 		nvm->lar_enabled = true;
1985 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
1986 	}
1987 
1988 	rsp_v3 = (void *)rsp;
1989 	channel_profile = v4 ? (void *)rsp->regulatory.channel_profile :
1990 			  (void *)rsp_v3->regulatory.channel_profile;
1991 
1992 	iwl_init_sbands(trans, nvm,
1993 			channel_profile,
1994 			nvm->valid_tx_ant & fw->valid_tx_ant,
1995 			nvm->valid_rx_ant & fw->valid_rx_ant,
1996 			sbands_flags, v4, fw);
1997 
1998 	iwl_free_resp(&hcmd);
1999 	return nvm;
2000 
2001 err_free:
2002 	kfree(nvm);
2003 out:
2004 	iwl_free_resp(&hcmd);
2005 	return ERR_PTR(ret);
2006 }
2007 IWL_EXPORT_SYMBOL(iwl_get_nvm);
2008