RPi 4B - BCM43455 Cypress CLM database incorrect for region IN

Start with the BCM4345/6 firmware and its CLM blob, then reproduce the issue using iw reg set IN and iw phy0 channels. Compare the channel list against the wireless-regdb output, especially channel 149, and verify that the fix enables the expected Indian regulatory channels without a custom regulatory database.

Describe the bug
I am trying to connect my Raspberry Pi 4 Model B to my 5GHz AP running on channel 149. Channel 149 is supported for the country IN as per the wireless regulations (can be verified with wireless-regdb) but the Raspberry Pi fails to detect it. I am almost certain the issue is with the CLM blob file provided. Adding details below:

To reproduce

$ iw reg set IN

global
country IN: DFS-UNSET
	(2402 - 2482 @ 40), (N/A, 30), (N/A)
	(5150 - 5250 @ 80), (N/A, 30), (N/A)
	(5250 - 5350 @ 80), (N/A, 24), (0 ms), DFS
	(5470 - 5725 @ 160), (N/A, 24), (0 ms), DFS
	(5725 - 5875 @ 80), (N/A, 30), (N/A)

$ iw phy0 channels

Band 1:
	* 2412 MHz [1]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2417 MHz [2]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2422 MHz [3]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2427 MHz [4]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2432 MHz [5]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2437 MHz [6]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2442 MHz [7]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2447 MHz [8]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2452 MHz [9]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2457 MHz [10]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2462 MHz [11]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2467 MHz [12]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2472 MHz [13]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz
	* 2484 MHz [14] (disabled)
Band 2:
	* 5170 MHz [34] (disabled)
	* 5180 MHz [36]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz HT40+ VHT80
	* 5190 MHz [38] (disabled)
	* 5200 MHz [40]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz HT40- VHT80
	* 5210 MHz [42] (disabled)
	* 5220 MHz [44]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz HT40+ VHT80
	* 5230 MHz [46] (disabled)
	* 5240 MHz [48]
	  Maximum TX power: 20.0 dBm
	  Channel widths: 20MHz HT40- VHT80
	* 5260 MHz [52]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40+ VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5280 MHz [56]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40- VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5300 MHz [60]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40+ VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5320 MHz [64]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40- VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5500 MHz [100]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40+ VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5520 MHz [104]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40- VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5540 MHz [108]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40+ VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5560 MHz [112]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40- VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5580 MHz [116]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40+ VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5600 MHz [120]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40- VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5620 MHz [124]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40+ VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5640 MHz [128]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40- VHT80
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5660 MHz [132]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40+
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5680 MHz [136]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz HT40-
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5700 MHz [140]
	  Maximum TX power: 20.0 dBm
	  No IR
	  Radar detection
	  Channel widths: 20MHz
	  DFS state: usable (for 3345 sec)
	  DFS CAC time: 60000 ms
	* 5720 MHz [144] (disabled)
	* 5745 MHz [149] (disabled)
	* 5765 MHz [153] (disabled)
	* 5785 MHz [157] (disabled)
	* 5805 MHz [161] (disabled)
	* 5825 MHz [165] (disabled)

Note: that the channel 149 (5745MHz) should be enabled as per the regulatory domain of cfg80211, but it is disabled.

To make sure that the issue is not with cfg80211 and indeed with the CLM blob, I compiled wireless_regdb with custom regulatory information. Since setting the regulatory domain as US works on RPi to enable channel 149, I copied over the regulatory information of US to IN and removed the country code for US from the database to prevent any clashing issues.

Relevant diff in wireless-regdb:

diff --git a/db.txt b/db.txt
index fdc2c13..c67b1d1 100644
--- a/db.txt
+++ b/db.txt
@@ -884,11 +884,32 @@ country IL: DFS-ETSI
 # https://dot.gov.in/spectrummanagement/delicensing-24-24835-ghz-band-gsr-45-e-5150-5350-ghz-gsr-46-e-and-5725-5875-ghz
 # https://dot.gov.in/spectrummanagement/license-exemption-5-ghz-gsr-1048e-dated-22102018
 country IN:
-	(2402 - 2482 @ 40), (30)
-	(5150 - 5250 @ 80), (30)
-	(5250 - 5350 @ 80), (24), DFS
-	(5470 - 5725 @ 160), (24), DFS
-	(5725 - 5875 @ 80), (30)
+	# S1G Channel 1-3
+	(902 - 904 @ 2), (30)
+	# S1G Channel 5-35
+	(904 - 920 @ 16), (30)
+	# S1G Channel 37-51
+	(920 - 928 @ 8), (30)
+	(2400 - 2472 @ 40), (30)
+	# 5.15 ~ 5.25 GHz: 30 dBm for master mode, 23 dBm for clients
+	(5150 - 5250 @ 80), (23), AUTO-BW
+	(5250 - 5350 @ 80), (24), DFS, AUTO-BW
+	# This range ends at 5725 MHz, but channel 144 extends to 5730 MHz.
+	# Since 5725 ~ 5730 MHz belongs to the next range which has looser
+	# requirements, we can extend the range by 5 MHz to make the kernel
+	# happy and be able to use channel 144.
+	(5470 - 5730 @ 160), (24), DFS
+	(5730 - 5850 @ 80), (30), AUTO-BW
+	# https://www.federalregister.gov/documents/2021/05/03/2021-08802/use-of-the-5850-5925-ghz-band
+	# max. 33 dBm AP @ 20MHz, 36 dBm AP @ 40Mhz+, 6 dB less for clients
+	(5850 - 5895 @ 40), (27), NO-OUTDOOR, AUTO-BW, NO-IR
+	# 6g band
+	# https://www.federalregister.gov/documents/2020/05/26/2020-11236/unlicensed-use-of-the-6ghz-band
+	(5925 - 7125 @ 320), (12), NO-OUTDOOR, NO-IR
+	# 60g band
+	# reference: section IV-D https://docs.fcc.gov/public/attachments/FCC-16-89A1.pdf
+	# channels 1-6 EIRP=40dBm(43dBm peak)
+	(57240 - 71000 @ 2160), (40)

 country IR: DFS-JP
 	(2402 - 2482 @ 40), (20)
@@ -1768,40 +1789,6 @@ country UG: DFS-FCC
 	(5490 - 5730 @ 160), (24), DFS
 	(5735 - 5835 @ 80), (30)

-# https://www.ecfr.gov/cgi-bin/text-idx?SID=eed706a2c49fd9271106c3228b0615f3&mc=true&node=pt47.1.15&rgn=div5
-# Title 47 Part 15 - Radio Frequency Devices, April 2, 2020
-# Channels 12 and 13 are not forbidden, but are not normally used with full
-# power in order to avoid any potential interference in the adjacent restricted
-# frequency band, 2,483.5–2,500 MHz which is subject to strict emission limits
-# set out in 47 CFR § 15.205. TODO: reenable and specify a safe TX power here.
-country US: DFS-FCC
-	# S1G Channel 1-3
-	(902 - 904 @ 2), (30)
-	# S1G Channel 5-35
-	(904 - 920 @ 16), (30)
-	# S1G Channel 37-51
-	(920 - 928 @ 8), (30)
-	(2400 - 2472 @ 40), (30)
-	# 5.15 ~ 5.25 GHz: 30 dBm for master mode, 23 dBm for clients
-	(5150 - 5250 @ 80), (23), AUTO-BW
-	(5250 - 5350 @ 80), (24), DFS, AUTO-BW
-	# This range ends at 5725 MHz, but channel 144 extends to 5730 MHz.
-	# Since 5725 ~ 5730 MHz belongs to the next range which has looser
-	# requirements, we can extend the range by 5 MHz to make the kernel
-	# happy and be able to use channel 144.
-	(5470 - 5730 @ 160), (24), DFS
-	(5730 - 5850 @ 80), (30), AUTO-BW
-	# https://www.federalregister.gov/documents/2021/05/03/2021-08802/use-of-the-5850-5925-ghz-band
-	# max. 33 dBm AP @ 20MHz, 36 dBm AP @ 40Mhz+, 6 dB less for clients
-	(5850 - 5895 @ 40), (27), NO-OUTDOOR, AUTO-BW, NO-IR
-	# 6g band
-	# https://www.federalregister.gov/documents/2020/05/26/2020-11236/unlicensed-use-of-the-6ghz-band
-	(5925 - 7125 @ 320), (12), NO-OUTDOOR, NO-IR
-	# 60g band
-	# reference: section IV-D https://docs.fcc.gov/public/attachments/FCC-16-89A1.pdf
-	# channels 1-6 EIRP=40dBm(43dBm peak)
-	(57240 - 71000 @ 2160), (40)
-
 country UY: DFS-FCC
 	(2402 - 2482 @ 40), (20)
 	(5170 - 5250 @ 80), (23), AUTO-BW

repeat the steps with new regulatory database

$ iw reg set IN

global
country IN: DFS-UNSET
	(902 - 904 @ 2), (N/A, 30), (N/A)
	(904 - 920 @ 16), (N/A, 30), (N/A)
	(920 - 928 @ 8), (N/A, 30), (N/A)
	(2400 - 2472 @ 40), (N/A, 30), (N/A)
	(5150 - 5250 @ 80), (N/A, 23), (N/A), AUTO-BW
	(5250 - 5350 @ 80), (N/A, 24), (0 ms), DFS, AUTO-BW
	(5470 - 5730 @ 160), (N/A, 24), (0 ms), DFS
	(5730 - 5850 @ 80), (N/A, 30), (N/A), AUTO-BW
	(5850 - 5895 @ 40), (N/A, 27), (N/A), NO-OUTDOOR, AUTO-BW, PASSIVE-SCAN
	(5925 - 7125 @ 320), (N/A, 12), (N/A), NO-OUTDOOR, PASSIVE-SCAN
	(57240 - 71000 @ 2160), (N/A, 40), (N/A)

$ iw phy0 channels

...
same as before
...

I can connect to this AP from my laptop which has a self-managed wiphy.

Expected behaviour
enabled channels should be per the regulatory information in iw reg get

Actual behaviour
enabled channels are not as per the regulatory information in iw reg get

System
Copy and paste the results of the raspinfo command in to this section. Alternatively, copy and paste a pastebin link, or add answers to the following questions:

• Which model of Raspberry Pi? RPi4B
• Which OS and version? ArchLinux
• Which firmware version? kernel: brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60
• Which kernel version? 6.1.54

The firmware blobs are from the latest release of archlinux package firmware-raspberrypi

Logs
If applicable, add the relevant output from dmesg or similar.

Additional context
I have gone through some related threads, but to no avail. Adding the threads here:

• https://forums.raspberrypi.com//viewtopic.php?f=36&t=291824 - CLM blob file discussions
• https://forums.raspberrypi.com//viewtopic.php?f=117&t=291609 - CLM blob file feedback
• https://github.com/raspberrypi/linux/issues/4530 - similar problem for CN country code

I have also noticed that there is a global CLM file, which enables all channels (or, to the best of my knowledge, fixes this issue). If such a CLM blob exists, I would like to get access to it so that I can use that till a fix is available.

Please let me know if any additional data is required. I'll be happy to add more logs