bwi.c revision 1.77
1/*	$OpenBSD: bwi.c,v 1.77 2008/07/21 18:43:19 damien Exp $	*/
2
3/*
4 * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
5 *
6 * This code is derived from software contributed to The DragonFly Project
7 * by Sepherosa Ziehau <sepherosa@gmail.com>
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in
17 *    the documentation and/or other materials provided with the
18 *    distribution.
19 * 3. Neither the name of The DragonFly Project nor the names of its
20 *    contributors may be used to endorse or promote products derived
21 *    from this software without specific, prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
26 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
27 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
28 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
29 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
30 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
31 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
32 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
33 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 *
36 * $DragonFly: src/sys/dev/netif/bwi/bwimac.c,v 1.1 2007/09/08 06:15:54 sephe Exp $
37 */
38
39#include "bpfilter.h"
40
41#include <sys/cdefs.h>
42#include <sys/param.h>
43#include <sys/types.h>
44
45#include <sys/device.h>
46#include <sys/kernel.h>
47#include <sys/malloc.h>
48#include <sys/mbuf.h>
49#include <sys/proc.h>
50#include <sys/socket.h>
51#include <sys/sockio.h>
52#include <sys/systm.h>
53
54#include <machine/bus.h>
55#include <machine/endian.h>
56#include <machine/intr.h>
57
58#include <net/if.h>
59#include <net/if_dl.h>
60#include <net/if_media.h>
61
62#if NBPFILTER > 0
63#include <net/bpf.h>
64#endif
65
66#include <netinet/in.h>
67#include <netinet/in_systm.h>
68#include <netinet/if_ether.h>
69
70#include <net80211/ieee80211_var.h>
71#include <net80211/ieee80211_amrr.h>
72#include <net80211/ieee80211_radiotap.h>
73
74#include <dev/ic/bwireg.h>
75#include <dev/ic/bwivar.h>
76
77#ifdef BWI_DEBUG
78int bwi_debug = 1;
79#define DPRINTF(l, x...)	do { if ((l) <= bwi_debug) printf(x); } while (0)
80#else
81#define DPRINTF(l, x...)
82#endif
83
84/* XXX temporary porting goop */
85#include <dev/pci/pcireg.h>
86#include <dev/pci/pcivar.h>
87#include <dev/pci/pcidevs.h>
88
89/* XXX does not belong here */
90#define IEEE80211_OFDM_PLCP_RATE_MASK	0x0000000f
91#define IEEE80211_OFDM_PLCP_LEN_MASK	0x0001ffe0
92
93/*
94 * Contention window (slots).
95 */
96#define IEEE80211_CW_MAX	1023	/* aCWmax */
97#define IEEE80211_CW_MIN_0	31	/* DS/CCK aCWmin, ERP aCWmin(0) */
98#define IEEE80211_CW_MIN_1	15	/* OFDM aCWmin, ERP aCWmin(1) */
99
100#define __unused __attribute__((__unused__))
101
102/* XXX end porting goop */
103
104/* MAC */
105struct bwi_retry_lim {
106	uint16_t	shretry;
107	uint16_t	shretry_fb;
108	uint16_t	lgretry;
109	uint16_t	lgretry_fb;
110};
111
112struct bwi_clock_freq {
113	uint		clkfreq_min;
114	uint		clkfreq_max;
115};
116
117/* XXX does not belong here */
118struct ieee80211_ds_plcp_hdr {
119	uint8_t		i_signal;
120	uint8_t		i_service;
121	uint16_t	i_length;
122	uint16_t	i_crc;
123} __packed;
124
125/* MAC */
126void		 bwi_tmplt_write_4(struct bwi_mac *, uint32_t, uint32_t);
127void		 bwi_hostflags_write(struct bwi_mac *, uint64_t);
128uint64_t	 bwi_hostflags_read(struct bwi_mac *);
129uint16_t	 bwi_memobj_read_2(struct bwi_mac *, uint16_t, uint16_t);
130uint32_t	 bwi_memobj_read_4(struct bwi_mac *, uint16_t, uint16_t);
131void		 bwi_memobj_write_2(struct bwi_mac *, uint16_t, uint16_t,
132		     uint16_t);
133void		 bwi_memobj_write_4(struct bwi_mac *, uint16_t, uint16_t,
134		     uint32_t);
135int		 bwi_mac_lateattach(struct bwi_mac *);
136int		 bwi_mac_init(struct bwi_mac *);
137void		 bwi_mac_reset(struct bwi_mac *, int);
138void		 bwi_mac_set_tpctl_11bg(struct bwi_mac *,
139		     const struct bwi_tpctl *);
140int		 bwi_mac_test(struct bwi_mac *);
141void		 bwi_mac_setup_tpctl(struct bwi_mac *);
142void		 bwi_mac_dummy_xmit(struct bwi_mac *);
143void		 bwi_mac_init_tpctl_11bg(struct bwi_mac *);
144void		 bwi_mac_detach(struct bwi_mac *);
145int		 bwi_get_firmware(const char *, const uint8_t *, size_t,
146		     size_t *, size_t *);
147int		 bwi_fwimage_is_valid(struct bwi_softc *, uint8_t *,
148		     size_t, char *, uint8_t);
149int		 bwi_mac_fw_alloc(struct bwi_mac *);
150void		 bwi_mac_fw_free(struct bwi_mac *);
151int		 bwi_mac_fw_load(struct bwi_mac *);
152int		 bwi_mac_gpio_init(struct bwi_mac *);
153int		 bwi_mac_gpio_fini(struct bwi_mac *);
154int		 bwi_mac_fw_load_iv(struct bwi_mac *, uint8_t *, size_t);
155int		 bwi_mac_fw_init(struct bwi_mac *);
156void		 bwi_mac_opmode_init(struct bwi_mac *);
157void		 bwi_mac_hostflags_init(struct bwi_mac *);
158void		 bwi_mac_bss_param_init(struct bwi_mac *);
159void		 bwi_mac_set_retry_lim(struct bwi_mac *,
160		     const struct bwi_retry_lim *);
161void		 bwi_mac_set_ackrates(struct bwi_mac *,
162		     const struct ieee80211_rateset *);
163int		 bwi_mac_start(struct bwi_mac *);
164int		 bwi_mac_stop(struct bwi_mac *);
165int		 bwi_mac_config_ps(struct bwi_mac *);
166void		 bwi_mac_reset_hwkeys(struct bwi_mac *);
167void		 bwi_mac_shutdown(struct bwi_mac *);
168int		 bwi_mac_get_property(struct bwi_mac *);
169void		 bwi_mac_updateslot(struct bwi_mac *, int);
170int		 bwi_mac_attach(struct bwi_softc *, int, uint8_t);
171void		 bwi_mac_balance_atten(int *, int *);
172void		 bwi_mac_adjust_tpctl(struct bwi_mac *, int, int);
173void		 bwi_mac_calibrate_txpower(struct bwi_mac *,
174		     enum bwi_txpwrcb_type);
175void		 bwi_mac_lock(struct bwi_mac *);
176void		 bwi_mac_unlock(struct bwi_mac *);
177void		 bwi_mac_set_promisc(struct bwi_mac *, int);
178
179/* PHY */
180void		 bwi_phy_write(struct bwi_mac *, uint16_t, uint16_t);
181uint16_t	 bwi_phy_read(struct bwi_mac *, uint16_t);
182int		 bwi_phy_attach(struct bwi_mac *);
183void		 bwi_phy_set_bbp_atten(struct bwi_mac *, uint16_t);
184int		 bwi_phy_calibrate(struct bwi_mac *);
185void		 bwi_tbl_write_2(struct bwi_mac *mac, uint16_t, uint16_t);
186void		 bwi_tbl_write_4(struct bwi_mac *mac, uint16_t, uint32_t);
187void		 bwi_nrssi_write(struct bwi_mac *, uint16_t, int16_t);
188int16_t		 bwi_nrssi_read(struct bwi_mac *, uint16_t);
189void		 bwi_phy_init_11a(struct bwi_mac *);
190void		 bwi_phy_init_11g(struct bwi_mac *);
191void		 bwi_phy_init_11b_rev2(struct bwi_mac *);
192void		 bwi_phy_init_11b_rev4(struct bwi_mac *);
193void		 bwi_phy_init_11b_rev5(struct bwi_mac *);
194void		 bwi_phy_init_11b_rev6(struct bwi_mac *);
195void		 bwi_phy_config_11g(struct bwi_mac *);
196void		 bwi_phy_config_agc(struct bwi_mac *);
197void		 bwi_set_gains(struct bwi_mac *, const struct bwi_gains *);
198void		 bwi_phy_clear_state(struct bwi_phy *);
199
200/* RF */
201int16_t		 bwi_nrssi_11g(struct bwi_mac *);
202struct bwi_rf_lo
203		*bwi_get_rf_lo(struct bwi_mac *, uint16_t, uint16_t);
204int		 bwi_rf_lo_isused(struct bwi_mac *, const struct bwi_rf_lo *);
205void		 bwi_rf_write(struct bwi_mac *, uint16_t, uint16_t);
206uint16_t	 bwi_rf_read(struct bwi_mac *, uint16_t);
207int		 bwi_rf_attach(struct bwi_mac *);
208void		 bwi_rf_set_chan(struct bwi_mac *, uint, int);
209void		 bwi_rf_get_gains(struct bwi_mac *);
210void		 bwi_rf_init(struct bwi_mac *);
211void		 bwi_rf_off_11a(struct bwi_mac *);
212void		 bwi_rf_off_11bg(struct bwi_mac *);
213void		 bwi_rf_off_11g_rev5(struct bwi_mac *);
214void		 bwi_rf_workaround(struct bwi_mac *, uint);
215struct bwi_rf_lo
216		*bwi_rf_lo_find(struct bwi_mac *, const struct bwi_tpctl *);
217void		 bwi_rf_lo_adjust(struct bwi_mac *, const struct bwi_tpctl *);
218void		 bwi_rf_lo_write(struct bwi_mac *, const struct bwi_rf_lo *);
219int		 bwi_rf_gain_max_reached(struct bwi_mac *, int);
220uint16_t	 bwi_bitswap4(uint16_t);
221uint16_t	 bwi_phy812_value(struct bwi_mac *, uint16_t);
222void		 bwi_rf_init_bcm2050(struct bwi_mac *);
223uint16_t	 bwi_rf_calibval(struct bwi_mac *);
224int32_t		 _bwi_adjust_devide(int32_t, int32_t);
225int		 bwi_rf_calc_txpower(int8_t *, uint8_t, const int16_t[]);
226int		 bwi_rf_map_txpower(struct bwi_mac *);
227void		 bwi_rf_lo_update_11g(struct bwi_mac *);
228uint32_t	 bwi_rf_lo_devi_measure(struct bwi_mac *, uint16_t);
229uint16_t	 bwi_rf_get_tp_ctrl2(struct bwi_mac *);
230uint8_t		 _bwi_rf_lo_update_11g(struct bwi_mac *, uint16_t);
231void		 bwi_rf_lo_measure_11g(struct bwi_mac *,
232		     const struct bwi_rf_lo *, struct bwi_rf_lo *, uint8_t);
233void		 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *);
234void		 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *);
235void		 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *);
236void		 bwi_rf_init_sw_nrssi_table(struct bwi_mac *);
237void		 bwi_rf_init_hw_nrssi_table(struct bwi_mac *, uint16_t);
238void		 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *);
239int32_t		 _nrssi_threshold(const struct bwi_rf *, int32_t);
240void		 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *);
241void		 bwi_rf_clear_tssi(struct bwi_mac *);
242void		 bwi_rf_clear_state(struct bwi_rf *);
243void		 bwi_rf_on_11a(struct bwi_mac *);
244void		 bwi_rf_on_11bg(struct bwi_mac *);
245void		 bwi_rf_set_ant_mode(struct bwi_mac *, int);
246int		 bwi_rf_get_latest_tssi(struct bwi_mac *, int8_t[], uint16_t);
247int		 bwi_rf_tssi2dbm(struct bwi_mac *, int8_t, int8_t *);
248int		 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *,
249		     const struct bwi_rxbuf_hdr *);
250int		 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *,
251		     const struct bwi_rxbuf_hdr *);
252int		 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *,
253		     const struct bwi_rxbuf_hdr *);
254uint16_t	 bwi_rf_lo_measure_11b(struct bwi_mac *);
255void		 bwi_rf_lo_update_11b(struct bwi_mac *);
256
257/* INTERFACE */
258uint16_t	 bwi_read_sprom(struct bwi_softc *, uint16_t);
259void		 bwi_setup_desc32(struct bwi_softc *, struct bwi_desc32 *, int,
260		     int, bus_addr_t, int, int);
261void		 bwi_power_on(struct bwi_softc *, int);
262int		 bwi_power_off(struct bwi_softc *, int);
263int		 bwi_regwin_switch(struct bwi_softc *, struct bwi_regwin *,
264		     struct bwi_regwin **);
265int		 bwi_regwin_select(struct bwi_softc *, int);
266void		 bwi_regwin_info(struct bwi_softc *, uint16_t *, uint8_t *);
267void		 bwi_led_attach(struct bwi_softc *);
268void		 bwi_led_newstate(struct bwi_softc *, enum ieee80211_state);
269uint16_t	 bwi_led_onoff(struct bwi_led *, uint16_t, int);
270void		 bwi_led_event(struct bwi_softc *, int);
271void		 bwi_led_blink_start(struct bwi_softc *, int, int);
272void		 bwi_led_blink_next(void *);
273void		 bwi_led_blink_end(void *);
274int		 bwi_bbp_attach(struct bwi_softc *);
275int		 bwi_bus_init(struct bwi_softc *, struct bwi_mac *);
276void		 bwi_get_card_flags(struct bwi_softc *);
277void		 bwi_get_eaddr(struct bwi_softc *, uint16_t, uint8_t *);
278void		 bwi_get_clock_freq(struct bwi_softc *,
279		     struct bwi_clock_freq *);
280int		 bwi_set_clock_mode(struct bwi_softc *, enum bwi_clock_mode);
281int		 bwi_set_clock_delay(struct bwi_softc *);
282int		 bwi_init(struct ifnet *);
283int		 bwi_ioctl(struct ifnet *, u_long, caddr_t);
284void		 bwi_start(struct ifnet *);
285void		 bwi_watchdog(struct ifnet *);
286void		 bwi_newstate_begin(struct bwi_softc *, enum ieee80211_state);
287void		 bwi_init_statechg(struct bwi_softc *, int);
288int		 bwi_stop(struct bwi_softc *, int);
289int		 bwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
290int		 bwi_media_change(struct ifnet *);
291void		 bwi_iter_func(void *, struct ieee80211_node *);
292void		 bwi_amrr_timeout(void *);
293void		 bwi_newassoc(struct ieee80211com *, struct ieee80211_node *,
294		     int);
295int		 bwi_dma_alloc(struct bwi_softc *);
296void		 bwi_dma_free(struct bwi_softc *);
297int		 bwi_dma_ring_alloc(struct bwi_softc *,
298		     struct bwi_ring_data *, bus_size_t, uint32_t);
299int		 bwi_dma_txstats_alloc(struct bwi_softc *, uint32_t,
300		     bus_size_t);
301void		 bwi_dma_txstats_free(struct bwi_softc *);
302int		 bwi_dma_mbuf_create(struct bwi_softc *);
303void		 bwi_dma_mbuf_destroy(struct bwi_softc *, int, int);
304void		 bwi_enable_intrs(struct bwi_softc *, uint32_t);
305void		 bwi_disable_intrs(struct bwi_softc *, uint32_t);
306int		 bwi_init_tx_ring32(struct bwi_softc *, int);
307void		 bwi_init_rxdesc_ring32(struct bwi_softc *, uint32_t,
308		     bus_addr_t, int, int);
309int		 bwi_init_rx_ring32(struct bwi_softc *);
310int		 bwi_init_txstats32(struct bwi_softc *);
311void		 bwi_setup_rx_desc32(struct bwi_softc *, int, bus_addr_t, int);
312void		 bwi_setup_tx_desc32(struct bwi_softc *, struct bwi_ring_data *,
313		     int, bus_addr_t, int);
314int		 bwi_init_tx_ring64(struct bwi_softc *, int);
315int		 bwi_init_rx_ring64(struct bwi_softc *);
316int		 bwi_init_txstats64(struct bwi_softc *);
317void		 bwi_setup_rx_desc64(struct bwi_softc *, int, bus_addr_t, int);
318void		 bwi_setup_tx_desc64(struct bwi_softc *, struct bwi_ring_data *,
319		     int, bus_addr_t, int);
320int		 bwi_newbuf(struct bwi_softc *, int, int);
321void		 bwi_set_addr_filter(struct bwi_softc *, uint16_t,
322		     const uint8_t *);
323int		 bwi_set_chan(struct bwi_softc *, uint8_t);
324void		 bwi_next_scan(void *);
325int		 bwi_rxeof(struct bwi_softc *, int);
326int		 bwi_rxeof32(struct bwi_softc *);
327int		 bwi_rxeof64(struct bwi_softc *);
328void		 bwi_reset_rx_ring32(struct bwi_softc *, uint32_t);
329void		 bwi_free_txstats32(struct bwi_softc *);
330void		 bwi_free_rx_ring32(struct bwi_softc *);
331void		 bwi_free_tx_ring32(struct bwi_softc *, int);
332void		 bwi_free_txstats64(struct bwi_softc *);
333void		 bwi_free_rx_ring64(struct bwi_softc *);
334void		 bwi_free_tx_ring64(struct bwi_softc *, int);
335uint8_t		 bwi_ofdm_plcp2rate(uint32_t *);
336uint8_t		 bwi_ds_plcp2rate(struct ieee80211_ds_plcp_hdr *);
337void		 bwi_ofdm_plcp_header(uint32_t *, int, uint8_t);
338void		 bwi_ds_plcp_header(struct ieee80211_ds_plcp_hdr *, int,
339		     uint8_t);
340void		 bwi_plcp_header(void *, int, uint8_t);
341int		 bwi_encap(struct bwi_softc *, int, struct mbuf *,
342		     struct ieee80211_node *);
343void		 bwi_start_tx32(struct bwi_softc *, uint32_t, int);
344void		 bwi_start_tx64(struct bwi_softc *, uint32_t, int);
345void		 bwi_txeof_status32(struct bwi_softc *);
346void		 bwi_txeof_status64(struct bwi_softc *);
347void		 _bwi_txeof(struct bwi_softc *, uint16_t);
348void		 bwi_txeof_status(struct bwi_softc *, int);
349void		 bwi_txeof(struct bwi_softc *);
350int		 bwi_bbp_power_on(struct bwi_softc *, enum bwi_clock_mode);
351void		 bwi_bbp_power_off(struct bwi_softc *);
352int		 bwi_get_pwron_delay(struct bwi_softc *sc);
353int		 bwi_bus_attach(struct bwi_softc *);
354const char 	*bwi_regwin_name(const struct bwi_regwin *);
355int		 bwi_regwin_is_enabled(struct bwi_softc *, struct bwi_regwin *);
356uint32_t	 bwi_regwin_disable_bits(struct bwi_softc *);
357void		 bwi_regwin_enable(struct bwi_softc *, struct bwi_regwin *,
358		     uint32_t);
359void		 bwi_regwin_disable(struct bwi_softc *, struct bwi_regwin *,
360		     uint32_t);
361void		 bwi_set_bssid(struct bwi_softc *, const uint8_t *);
362void		 bwi_updateslot(struct ieee80211com *);
363void		 bwi_calibrate(void *);
364int		 bwi_calc_rssi(struct bwi_softc *,
365		     const struct bwi_rxbuf_hdr *);
366uint8_t		 bwi_ack_rate(struct ieee80211_node *, uint8_t);
367uint16_t	 bwi_txtime(struct ieee80211com *, struct ieee80211_node *,
368		     uint, uint8_t, uint32_t);
369enum bwi_modtype
370		 bwi_rate2modtype(uint8_t);
371
372
373static const uint8_t bwi_sup_macrev[] = { 2, 4, 5, 6, 7, 9, 10 };
374
375#define SUP_BPHY(num)	{ .rev = num, .init = bwi_phy_init_11b_rev##num }
376
377static const struct {
378	uint8_t	rev;
379	void	(*init)(struct bwi_mac *);
380} bwi_sup_bphy[] = {
381	SUP_BPHY(2),
382	SUP_BPHY(4),
383	SUP_BPHY(5),
384	SUP_BPHY(6)
385};
386
387#undef SUP_BPHY
388
389#define BWI_PHYTBL_WRSSI	0x1000
390#define BWI_PHYTBL_NOISE_SCALE	0x1400
391#define BWI_PHYTBL_NOISE	0x1800
392#define BWI_PHYTBL_ROTOR	0x2000
393#define BWI_PHYTBL_DELAY	0x2400
394#define BWI_PHYTBL_RSSI		0x4000
395#define BWI_PHYTBL_SIGMA_SQ	0x5000
396#define BWI_PHYTBL_WRSSI_REV1	0x5400
397#define BWI_PHYTBL_FREQ		0x5800
398
399static const uint16_t	bwi_phy_freq_11g_rev1[] =
400	{ BWI_PHY_FREQ_11G_REV1 };
401static const uint16_t	bwi_phy_noise_11g_rev1[] =
402	{ BWI_PHY_NOISE_11G_REV1 };
403static const uint16_t	bwi_phy_noise_11g[] =
404	{ BWI_PHY_NOISE_11G };
405static const uint32_t	bwi_phy_rotor_11g_rev1[] =
406	{ BWI_PHY_ROTOR_11G_REV1 };
407static const uint16_t	bwi_phy_noise_scale_11g_rev2[] =
408	{ BWI_PHY_NOISE_SCALE_11G_REV2 };
409static const uint16_t	bwi_phy_noise_scale_11g_rev7[] =
410	{ BWI_PHY_NOISE_SCALE_11G_REV7 };
411static const uint16_t	bwi_phy_noise_scale_11g[] =
412	{ BWI_PHY_NOISE_SCALE_11G };
413static const uint16_t	bwi_phy_sigma_sq_11g_rev2[] =
414	{ BWI_PHY_SIGMA_SQ_11G_REV2 };
415static const uint16_t	bwi_phy_sigma_sq_11g_rev7[] =
416	{ BWI_PHY_SIGMA_SQ_11G_REV7 };
417static const uint32_t	bwi_phy_delay_11g_rev1[] =
418	{ BWI_PHY_DELAY_11G_REV1 };
419
420/* RF */
421#define RF_LO_WRITE(mac, lo)	bwi_rf_lo_write((mac), (lo))
422
423#define BWI_RF_2GHZ_CHAN(chan) \
424	(ieee80211_ieee2mhz((chan), IEEE80211_CHAN_2GHZ) - 2400)
425
426#define BWI_DEFAULT_IDLE_TSSI	52
427
428struct rf_saveregs {
429	uint16_t	phy_01;
430	uint16_t	phy_03;
431	uint16_t	phy_0a;
432	uint16_t	phy_15;
433	uint16_t	phy_2a;
434	uint16_t	phy_30;
435	uint16_t	phy_35;
436	uint16_t	phy_60;
437	uint16_t	phy_429;
438	uint16_t	phy_802;
439	uint16_t	phy_811;
440	uint16_t	phy_812;
441	uint16_t	phy_814;
442	uint16_t	phy_815;
443
444	uint16_t	rf_43;
445	uint16_t	rf_52;
446	uint16_t	rf_7a;
447};
448
449#define SAVE_RF_REG(mac, regs, n)	(regs)->rf_##n = RF_READ((mac), 0x##n)
450#define RESTORE_RF_REG(mac, regs, n)	RF_WRITE((mac), 0x##n, (regs)->rf_##n)
451
452#define SAVE_PHY_REG(mac, regs, n)	(regs)->phy_##n = PHY_READ((mac), 0x##n)
453#define RESTORE_PHY_REG(mac, regs, n)	PHY_WRITE((mac), 0x##n, (regs)->phy_##n)
454
455static const int8_t	bwi_txpower_map_11b[BWI_TSSI_MAX] =
456	{ BWI_TXPOWER_MAP_11B };
457static const int8_t	bwi_txpower_map_11g[BWI_TSSI_MAX] =
458	{ BWI_TXPOWER_MAP_11G };
459
460/* IF_BWI */
461
462struct bwi_myaddr_bssid {
463	uint8_t		myaddr[IEEE80211_ADDR_LEN];
464	uint8_t		bssid[IEEE80211_ADDR_LEN];
465} __packed;
466
467#define IEEE80211_DS_PLCP_SERVICE_LOCKED	0x04
468#define IEEE80211_DS_PLCL_SERVICE_PBCC		0x08
469#define IEEE80211_DS_PLCP_SERVICE_LENEXT5	0x20
470#define IEEE80211_DS_PLCP_SERVICE_LENEXT6	0x40
471#define IEEE80211_DS_PLCP_SERVICE_LENEXT7	0x80
472
473struct cfdriver bwi_cd = {
474	NULL, "bwi", DV_IFNET
475};
476
477static const struct {
478	uint16_t	did_min;
479	uint16_t	did_max;
480	uint16_t	bbp_id;
481} bwi_bbpid_map[] = {
482	{ 0x4301, 0x4301, 0x4301 },
483	{ 0x4305, 0x4307, 0x4307 },
484	{ 0x4403, 0x4403, 0x4402 },
485	{ 0x4610, 0x4615, 0x4610 },
486	{ 0x4710, 0x4715, 0x4710 },
487	{ 0x4720, 0x4725, 0x4309 }
488};
489
490static const struct {
491	uint16_t	bbp_id;
492	int		nregwin;
493} bwi_regwin_count[] = {
494	{ 0x4301, 5 },
495	{ 0x4306, 6 },
496	{ 0x4307, 5 },
497	{ 0x4310, 8 },
498	{ 0x4401, 3 },
499	{ 0x4402, 3 },
500	{ 0x4610, 9 },
501	{ 0x4704, 9 },
502	{ 0x4710, 9 },
503	{ 0x5365, 7 }
504};
505
506#define CLKSRC(src) 				\
507[BWI_CLKSRC_ ## src] = {			\
508	.freq_min = BWI_CLKSRC_ ##src## _FMIN,	\
509	.freq_max = BWI_CLKSRC_ ##src## _FMAX	\
510}
511
512static const struct {
513	uint	freq_min;
514	uint	freq_max;
515} bwi_clkfreq[BWI_CLKSRC_MAX] = {
516	CLKSRC(LP_OSC),
517	CLKSRC(CS_OSC),
518	CLKSRC(PCI)
519};
520
521#undef CLKSRC
522
523#define VENDOR_LED_ACT(vendor)				\
524{							\
525	.vid = PCI_VENDOR_##vendor,			\
526	.led_act = { BWI_VENDOR_LED_ACT_##vendor }	\
527}
528
529const struct {
530	uint16_t	vid;
531	uint8_t		led_act[BWI_LED_MAX];
532} bwi_vendor_led_act[] = {
533	VENDOR_LED_ACT(COMPAQ),
534	VENDOR_LED_ACT(LINKSYS)
535};
536
537const uint8_t bwi_default_led_act[BWI_LED_MAX] =
538	{ BWI_VENDOR_LED_ACT_DEFAULT };
539
540#undef VENDOR_LED_ACT
541
542const struct {
543	int	on_dur;
544	int	off_dur;
545} bwi_led_duration[109] = {
546	{ 400, 100 }, {   0,   0 }, { 150 ,  75 }, {   0,   0 }, {  90,  45 },
547	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
548	{   0,   0 }, {  66,  34 }, {  53,   26 }, {   0,   0 }, {   0,   0 },
549	{   0,   0 }, {   0,   0 }, {   0,    0 }, {  42,  21 }, {   0,   0 },
550	{   0,   0 }, {   0,   0 }, {  35,   17 }, {   0,   0 }, {  32,  16 },
551	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
552	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
553	{   0,   0 }, {  21,  10 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
554	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
555	{   0,   0 }, {   0,   0 }, {   0,    0 }, {  16,   8 }, {   0,   0 },
556	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
557	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
558	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
559	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
560	{   0,   0 }, {   0,   0 }, {  11,    5 }, {   0,   0 }, {   0,   0 },
561	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
562	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
563	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
564	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
565	{   0,   0 }, {   9,   4 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
566	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
567	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   7,   3 }
568};
569
570static const uint8_t bwi_zero_addr[IEEE80211_ADDR_LEN];
571
572
573enum bwi_modtype {
574	IEEE80211_MODTYPE_DS	= 0,	/* DS/CCK modulation */
575	IEEE80211_MODTYPE_PBCC	= 1,	/* PBCC modulation */
576	IEEE80211_MODTYPE_OFDM	= 2	/* OFDM modulation */
577};
578#define IEEE80211_MODTYPE_CCK   IEEE80211_MODTYPE_DS
579
580/* CODE */
581
582int
583bwi_intr(void *xsc)
584{
585	struct bwi_softc *sc = xsc;
586	struct bwi_mac *mac;
587	struct ifnet *ifp = &sc->sc_ic.ic_if;
588	uint32_t intr_status;
589	uint32_t txrx_intr_status[BWI_TXRX_NRING];
590	int i, txrx_error, tx = 0, rx_data = -1;
591
592	if ((ifp->if_flags & IFF_RUNNING) == 0)
593		return (0);
594
595	/*
596	 * Get interrupt status
597	 */
598	intr_status = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
599	if (intr_status == 0xffffffff)	/* Not for us */
600		return (0);
601
602	intr_status &= CSR_READ_4(sc, BWI_MAC_INTR_MASK);
603	if (intr_status == 0)		/* Nothing is interesting */
604		return (0);
605
606	DPRINTF(2, "%s: intr status 0x%08x\n",
607	    sc->sc_dev.dv_xname, intr_status);
608
609	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
610	mac = (struct bwi_mac *)sc->sc_cur_regwin;
611
612	txrx_error = 0;
613
614	for (i = 0; i < BWI_TXRX_NRING; ++i) {
615		uint32_t mask;
616
617		if (BWI_TXRX_IS_RX(i))
618			mask = BWI_TXRX_RX_INTRS;
619		else
620			mask = BWI_TXRX_TX_INTRS;
621
622		txrx_intr_status[i] =
623		    CSR_READ_4(sc, BWI_TXRX_INTR_STATUS(i)) & mask;
624
625		if (txrx_intr_status[i] & BWI_TXRX_INTR_ERROR) {
626			printf("%s: intr fatal TX/RX (%d) error 0x%08x\n",
627			    sc->sc_dev.dv_xname, i, txrx_intr_status[i]);
628			txrx_error = 1;
629		}
630	}
631
632	/*
633	 * Acknowledge interrupt
634	 */
635	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, intr_status);
636
637	for (i = 0; i < BWI_TXRX_NRING; ++i)
638		CSR_WRITE_4(sc, BWI_TXRX_INTR_STATUS(i), txrx_intr_status[i]);
639
640	/* Disable all interrupts */
641	bwi_disable_intrs(sc, BWI_ALL_INTRS);
642
643	if (intr_status & BWI_INTR_PHY_TXERR) {
644		if (mac->mac_flags & BWI_MAC_F_PHYE_RESET) {
645			printf("intr PHY TX error\n");
646			/* XXX to netisr0? */
647			bwi_init_statechg(sc, 0);
648			return (0);
649		}
650	}
651
652	if (txrx_error) {
653		/* TODO: reset device */
654	}
655
656	if (intr_status & BWI_INTR_TBTT)
657		bwi_mac_config_ps(mac);
658
659	if (intr_status & BWI_INTR_EO_ATIM)
660		printf("%s: EO_ATIM\n", sc->sc_dev.dv_xname);
661
662	if (intr_status & BWI_INTR_PMQ) {
663		for (;;) {
664			if ((CSR_READ_4(sc, BWI_MAC_PS_STATUS) & 0x8) == 0)
665				break;
666		}
667		CSR_WRITE_2(sc, BWI_MAC_PS_STATUS, 0x2);
668	}
669
670	if (intr_status & BWI_INTR_NOISE)
671		printf("%s: intr noise\n", sc->sc_dev.dv_xname);
672
673	if (txrx_intr_status[0] & BWI_TXRX_INTR_RX)
674		rx_data = sc->sc_rxeof(sc);
675
676	if (txrx_intr_status[3] & BWI_TXRX_INTR_RX) {
677		sc->sc_txeof_status(sc);
678		tx = 1;
679	}
680
681	if (intr_status & BWI_INTR_TX_DONE) {
682		bwi_txeof(sc);
683		tx = 1;
684	}
685
686	/* Re-enable interrupts */
687	bwi_enable_intrs(sc, BWI_INIT_INTRS);
688
689	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
690		int evt = BWI_LED_EVENT_NONE;
691
692		if (tx && rx_data > 0) {
693			if (sc->sc_rx_rate > sc->sc_tx_rate)
694				evt = BWI_LED_EVENT_RX;
695			else
696				evt = BWI_LED_EVENT_TX;
697		} else if (tx) {
698			evt = BWI_LED_EVENT_TX;
699		} else if (rx_data > 0) {
700			evt = BWI_LED_EVENT_RX;
701		} else if (rx_data == 0) {
702			evt = BWI_LED_EVENT_POLL;
703		}
704
705		if (evt != BWI_LED_EVENT_NONE)
706			bwi_led_event(sc, evt);
707	}
708
709	return (1);
710}
711
712int
713bwi_attach(struct bwi_softc *sc)
714{
715	struct ieee80211com *ic = &sc->sc_ic;
716	struct ifnet *ifp = &ic->ic_if;
717	struct bwi_mac *mac;
718	struct bwi_phy *phy;
719	int i, error;
720
721	DPRINTF(1, "\n");
722
723	/* Initialize LED vars */
724	sc->sc_led_idle = (2350 * hz) / 1000;
725	sc->sc_led_blink = 1;
726
727	/* AMRR rate control */
728	sc->sc_amrr.amrr_min_success_threshold = 1;
729	sc->sc_amrr.amrr_max_success_threshold = 15;
730	timeout_set(&sc->sc_amrr_ch, bwi_amrr_timeout, sc);
731
732	timeout_set(&sc->sc_scan_ch, bwi_next_scan, sc);
733	timeout_set(&sc->sc_calib_ch, bwi_calibrate, sc);
734
735	bwi_power_on(sc, 1);
736
737	error = bwi_bbp_attach(sc);
738	if (error)
739		goto fail;
740
741	error = bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
742	if (error)
743		goto fail;
744
745	if (BWI_REGWIN_EXIST(&sc->sc_com_regwin)) {
746		error = bwi_set_clock_delay(sc);
747		if (error)
748			goto fail;
749
750		error = bwi_set_clock_mode(sc, BWI_CLOCK_MODE_FAST);
751		if (error)
752			goto fail;
753
754		error = bwi_get_pwron_delay(sc);
755		if (error)
756			goto fail;
757	}
758
759	error = bwi_bus_attach(sc);
760	if (error)
761		goto fail;
762
763	bwi_get_card_flags(sc);
764
765	bwi_led_attach(sc);
766
767	for (i = 0; i < sc->sc_nmac; ++i) {
768		struct bwi_regwin *old;
769
770		mac = &sc->sc_mac[i];
771		error = bwi_regwin_switch(sc, &mac->mac_regwin, &old);
772		if (error)
773			goto fail;
774
775		error = bwi_mac_lateattach(mac);
776		if (error)
777			goto fail;
778
779		error = bwi_regwin_switch(sc, old, NULL);
780		if (error)
781			goto fail;
782	}
783
784	/*
785	 * XXX First MAC is known to exist
786	 * TODO2
787	 */
788	mac = &sc->sc_mac[0];
789	phy = &mac->mac_phy;
790
791	bwi_bbp_power_off(sc);
792
793	error = bwi_dma_alloc(sc);
794	if (error)
795		goto fail;
796
797	/* setup interface */
798	ifp->if_softc = sc;
799	ifp->if_init = bwi_init;
800	ifp->if_ioctl = bwi_ioctl;
801	ifp->if_start = bwi_start;
802	ifp->if_watchdog = bwi_watchdog;
803	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
804	strlcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
805	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
806	IFQ_SET_READY(&ifp->if_snd);
807
808	/* Get locale */
809	sc->sc_locale = __SHIFTOUT(bwi_read_sprom(sc, BWI_SPROM_CARD_INFO),
810	    BWI_SPROM_CARD_INFO_LOCALE);
811	DPRINTF(1, "%s: locale: %d\n", sc->sc_dev.dv_xname, sc->sc_locale);
812
813	/*
814	 * Setup ratesets, phytype, channels and get MAC address
815	 */
816	if (phy->phy_mode == IEEE80211_MODE_11B ||
817	    phy->phy_mode == IEEE80211_MODE_11G) {
818	    	uint16_t chan_flags;
819
820		ic->ic_sup_rates[IEEE80211_MODE_11B] =
821		    ieee80211_std_rateset_11b;
822
823		if (phy->phy_mode == IEEE80211_MODE_11B) {
824			chan_flags = IEEE80211_CHAN_B;
825			ic->ic_phytype = IEEE80211_T_DS;
826		} else {
827			chan_flags = IEEE80211_CHAN_CCK |
828			    IEEE80211_CHAN_OFDM |
829			    IEEE80211_CHAN_DYN |
830			    IEEE80211_CHAN_2GHZ;
831			ic->ic_phytype = IEEE80211_T_OFDM;
832			ic->ic_sup_rates[IEEE80211_MODE_11G] =
833			    ieee80211_std_rateset_11g;
834		}
835
836		/* XXX depend on locale */
837		for (i = 1; i <= 14; ++i) {
838			ic->ic_channels[i].ic_freq =
839				ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
840			ic->ic_channels[i].ic_flags = chan_flags;
841		}
842
843		bwi_get_eaddr(sc, BWI_SPROM_11BG_EADDR, ic->ic_myaddr);
844		if (IEEE80211_IS_MULTICAST(ic->ic_myaddr)) {
845			bwi_get_eaddr(sc, BWI_SPROM_11A_EADDR, ic->ic_myaddr);
846			if (IEEE80211_IS_MULTICAST(ic->ic_myaddr)) {
847				printf("%s: invalid MAC address: %s\n",
848				    sc->sc_dev.dv_xname,
849				    ether_sprintf(ic->ic_myaddr));
850			}
851		}
852	} else if (phy->phy_mode == IEEE80211_MODE_11A) {
853		/* TODO: 11A */
854		error = ENXIO;
855		goto fail;
856	} else
857		panic("unknown phymode %d\n", phy->phy_mode);
858
859	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
860
861	sc->sc_fw_version = BWI_FW_VERSION3;
862	sc->sc_dwell_time = 200;
863
864	ic->ic_caps = IEEE80211_C_SHSLOT |
865	    IEEE80211_C_SHPREAMBLE |
866	    IEEE80211_C_WEP |
867	    IEEE80211_C_RSN |
868	    IEEE80211_C_MONITOR;
869	ic->ic_state = IEEE80211_S_INIT;
870	ic->ic_opmode = IEEE80211_M_STA;
871
872	ic->ic_updateslot = bwi_updateslot;
873
874	if_attach(ifp);
875	ieee80211_ifattach(ifp);
876
877	sc->sc_newstate = ic->ic_newstate;
878	ic->ic_newstate = bwi_newstate;
879	ic->ic_newassoc = bwi_newassoc;
880
881	ieee80211_media_init(ifp, bwi_media_change, ieee80211_media_status);
882
883	if (error) {
884		ieee80211_ifdetach(ifp);
885		goto fail;
886	}
887
888#if NBPFILTER > 0
889	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
890	    sizeof(struct ieee80211_frame) + 64);
891
892	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
893	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
894	sc->sc_rxtap.wr_ihdr.it_present = htole32(BWI_RX_RADIOTAP_PRESENT);
895
896	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
897	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
898	sc->sc_txtap.wt_ihdr.it_present = htole32(BWI_TX_RADIOTAP_PRESENT);
899#endif
900
901	return (0);
902fail:
903	return (error);
904}
905
906int
907bwi_detach(void *arg)
908{
909	struct bwi_softc *sc = arg;
910	struct ifnet *ifp = &sc->sc_ic.ic_if;
911	int i;
912
913	bwi_stop(sc, 1);
914	ieee80211_ifdetach(ifp);
915	if_detach(ifp);
916
917	for (i = 0; i < sc->sc_nmac; ++i)
918		bwi_mac_detach(&sc->sc_mac[i]);
919
920	bwi_dma_free(sc);
921
922	return (0);
923}
924
925/* MAC */
926
927void
928bwi_tmplt_write_4(struct bwi_mac *mac, uint32_t ofs, uint32_t val)
929{
930	struct bwi_softc *sc = mac->mac_sc;
931
932	if (mac->mac_flags & BWI_MAC_F_BSWAP)
933		val = swap32(val);
934
935	CSR_WRITE_4(sc, BWI_MAC_TMPLT_CTRL, ofs);
936	CSR_WRITE_4(sc, BWI_MAC_TMPLT_DATA, val);
937}
938
939void
940bwi_hostflags_write(struct bwi_mac *mac, uint64_t flags)
941{
942	uint64_t val;
943
944	val = flags & 0xffff;
945	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO, val);
946
947	val = (flags >> 16) & 0xffff;
948	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI, val);
949
950	/* HI has unclear meaning, so leave it as it is */
951}
952
953uint64_t
954bwi_hostflags_read(struct bwi_mac *mac)
955{
956	uint64_t flags, val;
957
958	/* HI has unclear meaning, so don't touch it */
959	flags = 0;
960
961	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI);
962	flags |= val << 16;
963
964	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO);
965	flags |= val;
966
967	return (flags);
968}
969
970uint16_t
971bwi_memobj_read_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
972{
973	struct bwi_softc *sc = mac->mac_sc;
974	uint32_t data_reg;
975	int ofs;
976
977	data_reg = BWI_MOBJ_DATA;
978	ofs = ofs0 / 4;
979
980	if (ofs0 % 4 != 0)
981		data_reg = BWI_MOBJ_DATA_UNALIGN;
982
983	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
984	return (CSR_READ_2(sc, data_reg));
985}
986
987uint32_t
988bwi_memobj_read_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
989{
990	struct bwi_softc *sc = mac->mac_sc;
991	int ofs;
992
993	ofs = ofs0 / 4;
994	if (ofs0 % 4 != 0) {
995		uint32_t ret;
996
997		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
998		ret = CSR_READ_2(sc, BWI_MOBJ_DATA_UNALIGN);
999		ret <<= 16;
1000
1001		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1002		    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
1003		ret |= CSR_READ_2(sc, BWI_MOBJ_DATA);
1004
1005		return (ret);
1006	} else {
1007		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1008		return (CSR_READ_4(sc, BWI_MOBJ_DATA));
1009	}
1010}
1011
1012void
1013bwi_memobj_write_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
1014    uint16_t v)
1015{
1016	struct bwi_softc *sc = mac->mac_sc;
1017	uint32_t data_reg;
1018	int ofs;
1019
1020	data_reg = BWI_MOBJ_DATA;
1021	ofs = ofs0 / 4;
1022
1023	if (ofs0 % 4 != 0)
1024		data_reg = BWI_MOBJ_DATA_UNALIGN;
1025
1026	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1027	CSR_WRITE_2(sc, data_reg, v);
1028}
1029
1030void
1031bwi_memobj_write_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
1032    uint32_t v)
1033{
1034	struct bwi_softc *sc = mac->mac_sc;
1035	int ofs;
1036
1037	ofs = ofs0 / 4;
1038	if (ofs0 % 4 != 0) {
1039		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1040		CSR_WRITE_2(sc, BWI_MOBJ_DATA_UNALIGN, v >> 16);
1041		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1042		    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
1043		CSR_WRITE_2(sc, BWI_MOBJ_DATA, v & 0xffff);
1044	} else {
1045		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1046		CSR_WRITE_4(sc, BWI_MOBJ_DATA, v);
1047	}
1048}
1049
1050int
1051bwi_mac_lateattach(struct bwi_mac *mac)
1052{
1053	int error;
1054
1055	if (mac->mac_rev >= 5)
1056		CSR_READ_4(mac->mac_sc, BWI_STATE_HI); /* dummy read */
1057
1058	bwi_mac_reset(mac, 1);
1059
1060	error = bwi_phy_attach(mac);
1061	if (error)
1062		return (error);
1063
1064	error = bwi_rf_attach(mac);
1065	if (error)
1066		return (error);
1067
1068	/* Link 11B/G PHY, unlink 11A PHY */
1069	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A)
1070		bwi_mac_reset(mac, 0);
1071	else
1072		bwi_mac_reset(mac, 1);
1073
1074	error = bwi_mac_test(mac);
1075	if (error)
1076		return (error);
1077
1078	error = bwi_mac_get_property(mac);
1079	if (error)
1080		return (error);
1081
1082	error = bwi_rf_map_txpower(mac);
1083	if (error)
1084		return (error);
1085
1086	bwi_rf_off(mac);
1087	CSR_WRITE_2(mac->mac_sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
1088	bwi_regwin_disable(mac->mac_sc, &mac->mac_regwin, 0);
1089
1090	return (0);
1091}
1092
1093int
1094bwi_mac_init(struct bwi_mac *mac)
1095{
1096	struct bwi_softc *sc = mac->mac_sc;
1097	int error, i;
1098
1099	/* Clear MAC/PHY/RF states */
1100	bwi_mac_setup_tpctl(mac);
1101	bwi_rf_clear_state(&mac->mac_rf);
1102	bwi_phy_clear_state(&mac->mac_phy);
1103
1104	/* Enable MAC and linked it to PHY */
1105	if (!bwi_regwin_is_enabled(sc, &mac->mac_regwin))
1106		bwi_mac_reset(mac, 1);
1107
1108	/* Initialize backplane */
1109	error = bwi_bus_init(sc, mac);
1110	if (error)
1111		return (error);
1112
1113	/* XXX work around for hardware bugs? */
1114	if (sc->sc_bus_regwin.rw_rev <= 5 &&
1115	    sc->sc_bus_regwin.rw_type != BWI_REGWIN_T_BUSPCIE) {
1116		CSR_SETBITS_4(sc, BWI_CONF_LO,
1117		__SHIFTIN(BWI_CONF_LO_SERVTO, BWI_CONF_LO_SERVTO_MASK) |
1118		__SHIFTIN(BWI_CONF_LO_REQTO, BWI_CONF_LO_REQTO_MASK));
1119	}
1120
1121	/* Calibrate PHY */
1122	error = bwi_phy_calibrate(mac);
1123	if (error) {
1124		printf("%s: PHY calibrate failed\n", sc->sc_dev.dv_xname);
1125		return (error);
1126	}
1127
1128	/* Prepare to initialize firmware */
1129	CSR_WRITE_4(sc, BWI_MAC_STATUS,
1130	    BWI_MAC_STATUS_UCODE_JUMP0 |
1131	    BWI_MAC_STATUS_IHREN);
1132
1133	/*
1134	 * Load and initialize firmwares
1135	 */
1136	error = bwi_mac_fw_alloc(mac);
1137	if (error)
1138		return (error);
1139
1140	error = bwi_mac_fw_load(mac);
1141	if (error)
1142		return (error);
1143
1144	error = bwi_mac_gpio_init(mac);
1145	if (error)
1146		return (error);
1147
1148	error = bwi_mac_fw_init(mac);
1149	if (error)
1150		return (error);
1151
1152	/*
1153	 * Turn on RF
1154	 */
1155	bwi_rf_on(mac);
1156
1157	/* TODO: LED, hardware rf enabled is only related to LED setting */
1158
1159	/*
1160	 * Initialize PHY
1161	 */
1162	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
1163	bwi_phy_init(mac);
1164
1165	/* TODO: interference mitigation */
1166
1167	/*
1168	 * Setup antenna mode
1169	 */
1170	bwi_rf_set_ant_mode(mac, mac->mac_rf.rf_ant_mode);
1171
1172	/*
1173	 * Initialize operation mode (RX configuration)
1174	 */
1175	bwi_mac_opmode_init(mac);
1176
1177	/* XXX what's these */
1178	if (mac->mac_rev < 3) {
1179		CSR_WRITE_2(sc, 0x60e, 0);
1180		CSR_WRITE_2(sc, 0x610, 0x8000);
1181		CSR_WRITE_2(sc, 0x604, 0);
1182		CSR_WRITE_2(sc, 0x606, 0x200);
1183	} else {
1184		CSR_WRITE_4(sc, 0x188, 0x80000000);
1185		CSR_WRITE_4(sc, 0x18c, 0x2000000);
1186	}
1187
1188	/*
1189	 * Initialize TX/RX interrupts' mask
1190	 */
1191	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_TIMER1);
1192	for (i = 0; i < BWI_TXRX_NRING; ++i) {
1193		uint32_t intrs;
1194
1195		if (BWI_TXRX_IS_RX(i))
1196			intrs = BWI_TXRX_RX_INTRS;
1197		else
1198			intrs = BWI_TXRX_TX_INTRS;
1199		CSR_WRITE_4(sc, BWI_TXRX_INTR_MASK(i), intrs);
1200	}
1201
1202	/* XXX what's this */
1203	CSR_SETBITS_4(sc, BWI_STATE_LO, 0x100000);
1204
1205	/* Setup MAC power up delay */
1206	CSR_WRITE_2(sc, BWI_MAC_POWERUP_DELAY, sc->sc_pwron_delay);
1207
1208	/* Set MAC regwin revision */
1209	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_MACREV, mac->mac_rev);
1210
1211	/*
1212	 * Initialize host flags
1213	 */
1214	bwi_mac_hostflags_init(mac);
1215
1216	/*
1217	 * Initialize BSS parameters
1218	 */
1219	bwi_mac_bss_param_init(mac);
1220
1221	/*
1222	 * Initialize TX rings
1223	 */
1224	for (i = 0; i < BWI_TX_NRING; ++i) {
1225		error = sc->sc_init_tx_ring(sc, i);
1226		if (error) {
1227			printf("%s: can't initialize %dth TX ring\n",
1228			    sc->sc_dev.dv_xname, i);
1229			return (error);
1230		}
1231	}
1232
1233	/*
1234	 * Initialize RX ring
1235	 */
1236	error = sc->sc_init_rx_ring(sc);
1237	if (error) {
1238		printf("%s: can't initialize RX ring\n", sc->sc_dev.dv_xname);
1239		return (error);
1240	}
1241
1242	/*
1243	 * Initialize TX stats if the current MAC uses that
1244	 */
1245	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS) {
1246		error = sc->sc_init_txstats(sc);
1247		if (error) {
1248			printf("%s: can't initialize TX stats ring\n",
1249			    sc->sc_dev.dv_xname);
1250			return (error);
1251		}
1252	}
1253
1254	/* XXX what's these */
1255	CSR_WRITE_2(sc, 0x612, 0x50);	/* Force Pre-TBTT to 80? */
1256	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x416, 0x50);
1257	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x414, 0x1f4);
1258
1259	mac->mac_flags |= BWI_MAC_F_INITED;
1260
1261	return (0);
1262}
1263
1264void
1265bwi_mac_reset(struct bwi_mac *mac, int link_phy)
1266{
1267	struct bwi_softc *sc = mac->mac_sc;
1268	uint32_t flags, state_lo, status;
1269
1270	flags = BWI_STATE_LO_FLAG_PHYRST | BWI_STATE_LO_FLAG_PHYCLKEN;
1271	if (link_phy)
1272		flags |= BWI_STATE_LO_FLAG_PHYLNK;
1273	bwi_regwin_enable(sc, &mac->mac_regwin, flags);
1274	DELAY(2000);
1275
1276	state_lo = CSR_READ_4(sc, BWI_STATE_LO);
1277	state_lo |= BWI_STATE_LO_GATED_CLOCK;
1278	state_lo &= ~__SHIFTIN(BWI_STATE_LO_FLAG_PHYRST,
1279			       BWI_STATE_LO_FLAGS_MASK);
1280	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
1281	/* Flush pending bus write */
1282	CSR_READ_4(sc, BWI_STATE_LO);
1283	DELAY(1000);
1284
1285	state_lo &= ~BWI_STATE_LO_GATED_CLOCK;
1286	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
1287	/* Flush pending bus write */
1288	CSR_READ_4(sc, BWI_STATE_LO);
1289	DELAY(1000);
1290
1291	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
1292
1293	status = CSR_READ_4(sc, BWI_MAC_STATUS);
1294	status |= BWI_MAC_STATUS_IHREN;
1295	if (link_phy)
1296		status |= BWI_MAC_STATUS_PHYLNK;
1297	else
1298		status &= ~BWI_MAC_STATUS_PHYLNK;
1299	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
1300
1301	if (link_phy) {
1302		DPRINTF(1, "%s: PHY is linked\n", sc->sc_dev.dv_xname);
1303		mac->mac_phy.phy_flags |= BWI_PHY_F_LINKED;
1304	} else {
1305		DPRINTF(1, "%s: PHY is unlinked\n", sc->sc_dev.dv_xname);
1306		mac->mac_phy.phy_flags &= ~BWI_PHY_F_LINKED;
1307	}
1308}
1309
1310void
1311bwi_mac_set_tpctl_11bg(struct bwi_mac *mac, const struct bwi_tpctl *new_tpctl)
1312{
1313	struct bwi_rf *rf = &mac->mac_rf;
1314	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1315
1316	if (new_tpctl != NULL) {
1317		KASSERT(new_tpctl->bbp_atten <= BWI_BBP_ATTEN_MAX);
1318		KASSERT(new_tpctl->rf_atten <=
1319		    (rf->rf_rev < 6 ? BWI_RF_ATTEN_MAX0
1320		    : BWI_RF_ATTEN_MAX1));
1321		KASSERT(new_tpctl->tp_ctrl1 <= BWI_TPCTL1_MAX);
1322
1323		tpctl->bbp_atten = new_tpctl->bbp_atten;
1324		tpctl->rf_atten = new_tpctl->rf_atten;
1325		tpctl->tp_ctrl1 = new_tpctl->tp_ctrl1;
1326	}
1327
1328	/* Set BBP attenuation */
1329	bwi_phy_set_bbp_atten(mac, tpctl->bbp_atten);
1330
1331	/* Set RF attenuation */
1332	RF_WRITE(mac, BWI_RFR_ATTEN, tpctl->rf_atten);
1333	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_ATTEN,
1334	    tpctl->rf_atten);
1335
1336	/* Set TX power */
1337	if (rf->rf_type == BWI_RF_T_BCM2050) {
1338		RF_FILT_SETBITS(mac, BWI_RFR_TXPWR, ~BWI_RFR_TXPWR1_MASK,
1339		    __SHIFTIN(tpctl->tp_ctrl1, BWI_RFR_TXPWR1_MASK));
1340	}
1341
1342	/* Adjust RF Local Oscillator */
1343	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11G)
1344		bwi_rf_lo_adjust(mac, tpctl);
1345}
1346
1347int
1348bwi_mac_test(struct bwi_mac *mac)
1349{
1350	struct bwi_softc *sc = mac->mac_sc;
1351	uint32_t orig_val, val;
1352
1353#define TEST_VAL1	0xaa5555aa
1354#define TEST_VAL2	0x55aaaa55
1355	/* Save it for later restoring */
1356	orig_val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1357
1358	/* Test 1 */
1359	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL1);
1360	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1361	if (val != TEST_VAL1) {
1362		printf("%s: TEST1 failed\n", sc->sc_dev.dv_xname);
1363		return (ENXIO);
1364	}
1365
1366	/* Test 2 */
1367	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL2);
1368	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1369	if (val != TEST_VAL2) {
1370		printf("%s: TEST2 failed\n", sc->sc_dev.dv_xname);
1371		return (ENXIO);
1372	}
1373
1374	/* Restore to the original value */
1375	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, orig_val);
1376
1377	val = CSR_READ_4(sc, BWI_MAC_STATUS);
1378	if ((val & ~BWI_MAC_STATUS_PHYLNK) != BWI_MAC_STATUS_IHREN) {
1379		printf("%s: %s failed, MAC status 0x%08x\n",
1380		    sc->sc_dev.dv_xname, __func__, val);
1381		return (ENXIO);
1382	}
1383
1384	val = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1385	if (val != 0) {
1386		printf("%s: %s failed, intr status %08x\n",
1387		    sc->sc_dev.dv_xname, __func__, val);
1388		return (ENXIO);
1389	}
1390#undef TEST_VAL2
1391#undef TEST_VAL1
1392
1393	return (0);
1394}
1395
1396void
1397bwi_mac_setup_tpctl(struct bwi_mac *mac)
1398{
1399	struct bwi_softc *sc = mac->mac_sc;
1400	struct bwi_rf *rf = &mac->mac_rf;
1401	struct bwi_phy *phy = &mac->mac_phy;
1402	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1403
1404	/* Calc BBP attenuation */
1405	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev < 6)
1406		tpctl->bbp_atten = 0;
1407	else
1408		tpctl->bbp_atten = 2;
1409
1410	/* Calc TX power CTRL1?? */
1411	tpctl->tp_ctrl1 = 0;
1412	if (rf->rf_type == BWI_RF_T_BCM2050) {
1413		if (rf->rf_rev == 1)
1414			tpctl->tp_ctrl1 = 3;
1415		else if (rf->rf_rev < 6)
1416			tpctl->tp_ctrl1 = 2;
1417		else if (rf->rf_rev == 8)
1418			tpctl->tp_ctrl1 = 1;
1419	}
1420
1421	/* Empty TX power CTRL2?? */
1422	tpctl->tp_ctrl2 = 0xffff;
1423
1424	/*
1425	 * Calc RF attenuation
1426	 */
1427	if (phy->phy_mode == IEEE80211_MODE_11A) {
1428		tpctl->rf_atten = 0x60;
1429		goto back;
1430	}
1431
1432	if (BWI_IS_BRCM_BCM4309G(sc) && sc->sc_pci_revid < 0x51) {
1433		tpctl->rf_atten = sc->sc_pci_revid < 0x43 ? 2 : 3;
1434		goto back;
1435	}
1436
1437	tpctl->rf_atten = 5;
1438
1439	if (rf->rf_type != BWI_RF_T_BCM2050) {
1440		if (rf->rf_type == BWI_RF_T_BCM2053 && rf->rf_rev == 1)
1441			tpctl->rf_atten = 6;
1442		goto back;
1443	}
1444
1445	/*
1446	 * NB: If we reaches here and the card is BRCM_BCM4309G,
1447	 *     then the card's PCI revision must >= 0x51
1448	 */
1449
1450	/* BCM2050 RF */
1451	switch (rf->rf_rev) {
1452	case 1:
1453		if (phy->phy_mode == IEEE80211_MODE_11G) {
1454			if (BWI_IS_BRCM_BCM4309G(sc) || BWI_IS_BRCM_BU4306(sc))
1455				tpctl->rf_atten = 3;
1456			else
1457				tpctl->rf_atten = 1;
1458		} else {
1459			if (BWI_IS_BRCM_BCM4309G(sc))
1460				tpctl->rf_atten = 7;
1461			else
1462				tpctl->rf_atten = 6;
1463		}
1464		break;
1465	case 2:
1466		if (phy->phy_mode == IEEE80211_MODE_11G) {
1467			/*
1468			 * NOTE: Order of following conditions is critical
1469			 */
1470			if (BWI_IS_BRCM_BCM4309G(sc))
1471				tpctl->rf_atten = 3;
1472			else if (BWI_IS_BRCM_BU4306(sc))
1473				tpctl->rf_atten = 5;
1474			else if (sc->sc_bbp_id == BWI_BBPID_BCM4320)
1475				tpctl->rf_atten = 4;
1476			else
1477				tpctl->rf_atten = 3;
1478		} else {
1479			tpctl->rf_atten = 6;
1480		}
1481		break;
1482	case 4:
1483	case 5:
1484		tpctl->rf_atten = 1;
1485		break;
1486	case 8:
1487		tpctl->rf_atten = 0x1a;
1488		break;
1489	}
1490back:
1491	DPRINTF(1, "%s: bbp atten: %u, rf atten: %u, ctrl1: %u, ctrl2: %u\n",
1492	    sc->sc_dev.dv_xname, tpctl->bbp_atten, tpctl->rf_atten,
1493	    tpctl->tp_ctrl1, tpctl->tp_ctrl2);
1494}
1495
1496void
1497bwi_mac_dummy_xmit(struct bwi_mac *mac)
1498{
1499#define PACKET_LEN	5
1500	struct bwi_softc *sc = mac->mac_sc;
1501	struct bwi_rf *rf = &mac->mac_rf;
1502	const uint32_t *packet;
1503	uint16_t val_50c;
1504	int wait_max, i;
1505
1506	static const uint32_t	packet_11a[PACKET_LEN] =
1507	    { 0x000201cc, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
1508	static const uint32_t	packet_11bg[PACKET_LEN] =
1509	    { 0x000b846e, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
1510
1511	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
1512		wait_max = 30;
1513		packet = packet_11a;
1514		val_50c = 1;
1515	} else {
1516		wait_max = 250;
1517		packet = packet_11bg;
1518		val_50c = 0;
1519	}
1520
1521	for (i = 0; i < PACKET_LEN; ++i)
1522		TMPLT_WRITE_4(mac, i * 4, packet[i]);
1523
1524	CSR_READ_4(sc, BWI_MAC_STATUS);	/* dummy read */
1525
1526	CSR_WRITE_2(sc, 0x568, 0);
1527	CSR_WRITE_2(sc, 0x7c0, 0);
1528	CSR_WRITE_2(sc, 0x50c, val_50c);
1529	CSR_WRITE_2(sc, 0x508, 0);
1530	CSR_WRITE_2(sc, 0x50a, 0);
1531	CSR_WRITE_2(sc, 0x54c, 0);
1532	CSR_WRITE_2(sc, 0x56a, 0x14);
1533	CSR_WRITE_2(sc, 0x568, 0x826);
1534	CSR_WRITE_2(sc, 0x500, 0);
1535	CSR_WRITE_2(sc, 0x502, 0x30);
1536
1537	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
1538		RF_WRITE(mac, 0x51, 0x17);
1539
1540	for (i = 0; i < wait_max; ++i) {
1541		if (CSR_READ_2(sc, 0x50e) & 0x80)
1542			break;
1543		DELAY(10);
1544	}
1545	for (i = 0; i < 10; ++i) {
1546		if (CSR_READ_2(sc, 0x50e) & 0x400)
1547			break;
1548		DELAY(10);
1549	}
1550	for (i = 0; i < 10; ++i) {
1551		if ((CSR_READ_2(sc, 0x690) & 0x100) == 0)
1552			break;
1553		DELAY(10);
1554	}
1555
1556	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
1557		RF_WRITE(mac, 0x51, 0x37);
1558#undef PACKET_LEN
1559}
1560
1561void
1562bwi_mac_init_tpctl_11bg(struct bwi_mac *mac)
1563{
1564	struct bwi_softc *sc = mac->mac_sc;
1565	struct bwi_phy *phy = &mac->mac_phy;
1566	struct bwi_rf *rf = &mac->mac_rf;
1567	struct bwi_tpctl tpctl_orig;
1568	int restore_tpctl = 0;
1569
1570	KASSERT(phy->phy_mode != IEEE80211_MODE_11A);
1571
1572	if (BWI_IS_BRCM_BU4306(sc))
1573		return;
1574
1575	PHY_WRITE(mac, 0x28, 0x8018);
1576	CSR_CLRBITS_2(sc, BWI_BBP_ATTEN, 0x20);
1577
1578	if (phy->phy_mode == IEEE80211_MODE_11G) {
1579		if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
1580			return;
1581		PHY_WRITE(mac, 0x47a, 0xc111);
1582	}
1583	if (mac->mac_flags & BWI_MAC_F_TPCTL_INITED)
1584		return;
1585
1586	if (phy->phy_mode == IEEE80211_MODE_11B && phy->phy_rev >= 2 &&
1587	    rf->rf_type == BWI_RF_T_BCM2050) {
1588		RF_SETBITS(mac, 0x76, 0x84);
1589	} else {
1590		struct bwi_tpctl tpctl;
1591
1592		/* Backup original TX power control variables */
1593		bcopy(&mac->mac_tpctl, &tpctl_orig, sizeof(tpctl_orig));
1594		restore_tpctl = 1;
1595
1596		bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
1597		tpctl.bbp_atten = 11;
1598		tpctl.tp_ctrl1 = 0;
1599#ifdef notyet
1600		if (rf->rf_rev >= 6 && rf->rf_rev <= 8)
1601			tpctl.rf_atten = 31;
1602		else
1603#endif
1604			tpctl.rf_atten = 9;
1605
1606		bwi_mac_set_tpctl_11bg(mac, &tpctl);
1607	}
1608
1609	bwi_mac_dummy_xmit(mac);
1610
1611	mac->mac_flags |= BWI_MAC_F_TPCTL_INITED;
1612	rf->rf_base_tssi = PHY_READ(mac, 0x29);
1613	DPRINTF(1, "%s: base tssi %d\n", sc->sc_dev.dv_xname, rf->rf_base_tssi);
1614
1615	if (abs(rf->rf_base_tssi - rf->rf_idle_tssi) >= 20) {
1616		printf("%s: base tssi measure failed\n", sc->sc_dev.dv_xname);
1617		mac->mac_flags |= BWI_MAC_F_TPCTL_ERROR;
1618	}
1619
1620	if (restore_tpctl)
1621		bwi_mac_set_tpctl_11bg(mac, &tpctl_orig);
1622	else
1623		RF_CLRBITS(mac, 0x76, 0x84);
1624
1625	bwi_rf_clear_tssi(mac);
1626}
1627
1628void
1629bwi_mac_detach(struct bwi_mac *mac)
1630{
1631	bwi_mac_fw_free(mac);
1632}
1633
1634int
1635bwi_get_firmware(const char *name, const uint8_t *ucode, size_t size_ucode,
1636    size_t *size, size_t *offset)
1637{
1638	int i, nfiles, off = 0, ret = 1;
1639	struct fwheader *h;
1640
1641	if ((h = malloc(sizeof(struct fwheader), M_DEVBUF, M_NOWAIT)) == NULL)
1642		return (ret);
1643
1644	/* get number of firmware files */
1645	bcopy(ucode, &nfiles, sizeof(nfiles));
1646	nfiles = ntohl(nfiles);
1647	off += sizeof(nfiles);
1648
1649	/* parse header and search the firmware */
1650	for (i = 0; i < nfiles && off < size_ucode; i++) {
1651		bzero(h, sizeof(struct fwheader));
1652		bcopy(ucode + off, h, sizeof(struct fwheader));
1653		off += sizeof(struct fwheader);
1654
1655		if (strcmp(name, h->filename) == 0) {
1656			ret = 0;
1657			*size = ntohl(h->filesize);
1658			*offset = ntohl(h->fileoffset);
1659			break;
1660		}
1661	}
1662
1663	free(h, M_DEVBUF);
1664
1665	return (ret);
1666}
1667
1668int
1669bwi_fwimage_is_valid(struct bwi_softc *sc, uint8_t *fw, size_t fw_len,
1670    char *fw_name, uint8_t fw_type)
1671{
1672	const struct bwi_fwhdr *hdr;
1673
1674	if (fw_len < sizeof(*hdr)) {
1675		printf("%s: invalid firmware (%s): invalid size %u\n",
1676		    sc->sc_dev.dv_xname, fw_name, fw_len);
1677		return (1);
1678	}
1679
1680	hdr = (const struct bwi_fwhdr *)fw;
1681
1682	if (fw_type != BWI_FW_T_IV) {
1683		/*
1684		 * Don't verify IV's size, it has different meaning
1685		 */
1686		if (betoh32(hdr->fw_size) != fw_len - sizeof(*hdr)) {
1687			printf("%s: invalid firmware (%s): size mismatch, "
1688			    "fw %u, real %u\n",
1689			    sc->sc_dev.dv_xname,
1690			    fw_name,
1691			    betoh32(hdr->fw_size),
1692			    fw_len - sizeof(*hdr));
1693			return (1);
1694		}
1695	}
1696
1697	if (hdr->fw_type != fw_type) {
1698		printf("%s: invalid firmware (%s): type mismatch, "
1699		    "fw \'%c\', target \'%c\'\n",
1700		    sc->sc_dev.dv_xname, fw_name, hdr->fw_type, fw_type);
1701		return (1);
1702	}
1703
1704	if (hdr->fw_gen != BWI_FW_GEN_1) {
1705		printf("%s: invalid firmware (%s): wrong generation, "
1706		    "fw %d, target %d\n",
1707		    sc->sc_dev.dv_xname, fw_name, hdr->fw_gen, BWI_FW_GEN_1);
1708		return (1);
1709	}
1710
1711	return (0);
1712}
1713
1714int
1715bwi_mac_fw_alloc(struct bwi_mac *mac)
1716{
1717	struct bwi_softc *sc = mac->mac_sc;
1718	char *name = "bwi-airforce";
1719	size_t offset;
1720	char fwname[64];
1721	int idx, error;
1722
1723	error = loadfirmware(name, &mac->mac_fw, &mac->mac_fw_size);
1724	if (error != 0) {
1725		printf("%s: error %d, could not read firmware %s\n",
1726		    sc->sc_dev.dv_xname, error, name);
1727		return (EIO);
1728	}
1729
1730	if (mac->mac_ucode == NULL) {
1731		snprintf(fwname, sizeof(fwname), "ucode%d.fw",
1732		    mac->mac_rev >= 5 ? 5 : mac->mac_rev);
1733
1734		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1735		    &mac->mac_ucode_size, &offset);
1736		if (error != 0) {
1737			printf("%s: error %d, could not read firmware %s!\n",
1738			    sc->sc_dev.dv_xname, error, fwname);
1739			return (ENOMEM);
1740		}
1741		mac->mac_ucode = (mac->mac_fw + offset);
1742		DPRINTF(1, "%s: loaded firmware file %s\n",
1743		    sc->sc_dev.dv_xname, fwname);
1744
1745		if (bwi_fwimage_is_valid(sc, mac->mac_ucode,
1746		    mac->mac_ucode_size, fwname, BWI_FW_T_UCODE))
1747			return (EINVAL);
1748	}
1749
1750	if (mac->mac_pcm == NULL) {
1751		snprintf(fwname, sizeof(fwname), "pcm%d.fw",
1752		    mac->mac_rev < 5 ? 4 : 5);
1753
1754		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1755		    &mac->mac_pcm_size, &offset);
1756		if (error != 0) {
1757			printf("%s: error %d, could not read firmware %s!\n",
1758			    sc->sc_dev.dv_xname, error, fwname);
1759			return (ENOMEM);
1760		}
1761		mac->mac_pcm = (mac->mac_fw + offset);
1762		DPRINTF(1, "%s: loaded firmware file %s\n",
1763		    sc->sc_dev.dv_xname, fwname);
1764
1765		if (bwi_fwimage_is_valid(sc, mac->mac_pcm,
1766		    mac->mac_pcm_size, fwname, BWI_FW_T_PCM))
1767			return (EINVAL);
1768	}
1769
1770	if (mac->mac_iv == NULL) {
1771		/* TODO: 11A */
1772		if (mac->mac_rev == 2 || mac->mac_rev == 4) {
1773			idx = 2;
1774		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
1775			idx = 5;
1776		} else {
1777			printf("%s: no suitable IV for MAC rev %d\n",
1778			    sc->sc_dev.dv_xname, mac->mac_rev);
1779			return (ENODEV);
1780		}
1781
1782		snprintf(fwname, sizeof(fwname), "b0g0initvals%d.fw", idx);
1783
1784		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1785		    &mac->mac_iv_size, &offset);
1786		if (error != 0) {
1787			printf("%s: error %d, could not read firmware %s!\n",
1788			    sc->sc_dev.dv_xname, error, fwname);
1789			return (ENOMEM);
1790		}
1791		mac->mac_iv = (mac->mac_fw + offset);
1792		DPRINTF(1, "%s: loaded firmware file %s\n",
1793		    sc->sc_dev.dv_xname, fwname);
1794
1795		if (bwi_fwimage_is_valid(sc, mac->mac_iv,
1796		    mac->mac_iv_size, fwname, BWI_FW_T_IV))
1797			return (EINVAL);
1798	}
1799
1800	if (mac->mac_iv_ext == NULL) {
1801		/* TODO: 11A */
1802		if (mac->mac_rev == 2 || mac->mac_rev == 4 ||
1803		    mac->mac_rev >= 11) {
1804			/* No extended IV */
1805			goto back;
1806		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
1807			idx = 5;
1808		} else {
1809			printf("%s: no suitable ExtIV for MAC rev %d\n",
1810			    sc->sc_dev.dv_xname, mac->mac_rev);
1811			return (ENODEV);
1812		}
1813
1814		snprintf(fwname, sizeof(fwname), "b0g0bsinitvals%d.fw", idx);
1815
1816		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1817		    &mac->mac_iv_ext_size, &offset);
1818		if (error != 0) {
1819			printf("%s: error %d, could not read firmware %s!\n",
1820			    sc->sc_dev.dv_xname, error, fwname);
1821			return (ENOMEM);
1822		}
1823		mac->mac_iv_ext = (mac->mac_fw + offset);
1824		DPRINTF(1, "%s: loaded firmware file %s\n",
1825		    sc->sc_dev.dv_xname, fwname);
1826
1827		if (bwi_fwimage_is_valid(sc, mac->mac_iv_ext,
1828		    mac->mac_iv_ext_size, fwname, BWI_FW_T_IV))
1829			return (EINVAL);
1830	}
1831
1832back:
1833	return (0);
1834}
1835
1836void
1837bwi_mac_fw_free(struct bwi_mac *mac)
1838{
1839	if (mac->mac_fw != NULL) {
1840		free(mac->mac_fw, M_DEVBUF);
1841		mac->mac_fw = NULL;
1842	}
1843}
1844
1845int
1846bwi_mac_fw_load(struct bwi_mac *mac)
1847{
1848	struct bwi_softc *sc = mac->mac_sc;
1849	uint16_t fw_rev;
1850	const uint32_t *fw;
1851	int fw_len, i, error = 0;
1852
1853	/*
1854	 * Load FW image
1855	 */
1856	fw = (const uint32_t *)(mac->mac_ucode + BWI_FWHDR_SZ);
1857	fw_len = (mac->mac_ucode_size - BWI_FWHDR_SZ) / sizeof(uint32_t);
1858
1859	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1860	    BWI_MOBJ_CTRL_VAL(BWI_FW_UCODE_MOBJ | BWI_WR_MOBJ_AUTOINC, 0));
1861	for (i = 0; i < fw_len; ++i) {
1862		CSR_WRITE_4(sc, BWI_MOBJ_DATA, betoh32(fw[i]));
1863		DELAY(10);
1864	}
1865
1866	/*
1867	 * Load PCM image
1868	 */
1869	fw = (const uint32_t *)(mac->mac_pcm + BWI_FWHDR_SZ);
1870	fw_len = (mac->mac_pcm_size - BWI_FWHDR_SZ) / sizeof(uint32_t);
1871
1872	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1873	    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01ea));
1874	CSR_WRITE_4(sc, BWI_MOBJ_DATA, 0x4000);
1875
1876	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1877	    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01eb));
1878	for (i = 0; i < fw_len; ++i) {
1879		CSR_WRITE_4(sc, BWI_MOBJ_DATA, betoh32(fw[i]));
1880		DELAY(10);
1881	}
1882
1883	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_ALL_INTRS);
1884	CSR_WRITE_4(sc, BWI_MAC_STATUS,
1885	    BWI_MAC_STATUS_UCODE_START |
1886	    BWI_MAC_STATUS_IHREN |
1887	    BWI_MAC_STATUS_INFRA);
1888
1889#define NRETRY	200
1890	for (i = 0; i < NRETRY; ++i) {
1891		uint32_t intr_status;
1892
1893		intr_status = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1894		if (intr_status == BWI_INTR_READY)
1895			break;
1896		DELAY(10);
1897	}
1898	if (i == NRETRY) {
1899		printf("%s: firmware (fw & pcm) loading timed out\n",
1900		    sc->sc_dev.dv_xname);
1901		error = ETIMEDOUT;
1902		goto out;
1903	}
1904#undef NRETRY
1905
1906	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);	/* dummy read */
1907
1908	fw_rev = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWREV);
1909	if (fw_rev > BWI_FW_VERSION3_REVMAX) {
1910		printf("%s: firmware version 4 is not supported yet\n",
1911		    sc->sc_dev.dv_xname);
1912		error = ENODEV;
1913		goto out;
1914	}
1915
1916	DPRINTF(1, "%s: firmware rev 0x%04x, patch level 0x%04x\n",
1917	    sc->sc_dev.dv_xname, fw_rev,
1918	    MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
1919
1920out:
1921	return (error);
1922}
1923
1924int
1925bwi_mac_gpio_init(struct bwi_mac *mac)
1926{
1927	struct bwi_softc *sc = mac->mac_sc;
1928	struct bwi_regwin *old, *gpio_rw;
1929	uint32_t filt, bits;
1930	int error;
1931
1932	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_GPOSEL_MASK);
1933	/* TODO: LED */
1934
1935	CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0xf);
1936
1937	filt = 0x1f;
1938	bits = 0xf;
1939	if (sc->sc_bbp_id == BWI_BBPID_BCM4301) {
1940		filt |= 0x60;
1941		bits |= 0x60;
1942	}
1943	if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
1944		CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0x200);
1945		filt |= 0x200;
1946		bits |= 0x200;
1947	}
1948
1949	gpio_rw = BWI_GPIO_REGWIN(sc);
1950	error = bwi_regwin_switch(sc, gpio_rw, &old);
1951	if (error)
1952		return (error);
1953
1954	CSR_FILT_SETBITS_4(sc, BWI_GPIO_CTRL, filt, bits);
1955
1956	return (bwi_regwin_switch(sc, old, NULL));
1957}
1958
1959int
1960bwi_mac_gpio_fini(struct bwi_mac *mac)
1961{
1962	struct bwi_softc *sc = mac->mac_sc;
1963	struct bwi_regwin *old, *gpio_rw;
1964	int error;
1965
1966	gpio_rw = BWI_GPIO_REGWIN(sc);
1967	error = bwi_regwin_switch(sc, gpio_rw, &old);
1968	if (error)
1969		return (error);
1970
1971	CSR_WRITE_4(sc, BWI_GPIO_CTRL, 0);
1972
1973	return (bwi_regwin_switch(sc, old, NULL));
1974}
1975
1976int
1977bwi_mac_fw_load_iv(struct bwi_mac *mac, uint8_t *fw, size_t fw_len)
1978{
1979	struct bwi_softc *sc = mac->mac_sc;
1980	const struct bwi_fwhdr *hdr;
1981	const struct bwi_fw_iv *iv;
1982	int n, i, iv_img_size;
1983
1984	/* Get the number of IVs in the IV image */
1985	hdr = (const struct bwi_fwhdr *)fw;
1986	n = betoh32(hdr->fw_iv_cnt);
1987	DPRINTF(1, "%s: IV count %d\n", sc->sc_dev.dv_xname, n);
1988
1989	/* Calculate the IV image size, for later sanity check */
1990	iv_img_size = fw_len - sizeof(*hdr);
1991
1992	/* Locate the first IV */
1993	iv = (const struct bwi_fw_iv *)(fw + sizeof(*hdr));
1994
1995	for (i = 0; i < n; ++i) {
1996		uint16_t iv_ofs, ofs;
1997		int sz = 0;
1998
1999		if (iv_img_size < sizeof(iv->iv_ofs)) {
2000			printf("%s: invalid IV image, ofs\n",
2001			    sc->sc_dev.dv_xname);
2002			return (EINVAL);
2003		}
2004		iv_img_size -= sizeof(iv->iv_ofs);
2005		sz += sizeof(iv->iv_ofs);
2006
2007		iv_ofs = betoh16(iv->iv_ofs);
2008
2009		ofs = __SHIFTOUT(iv_ofs, BWI_FW_IV_OFS_MASK);
2010		if (ofs >= 0x1000) {
2011			printf("%s: invalid ofs (0x%04x) for %dth iv\n",
2012			    sc->sc_dev.dv_xname, ofs, i);
2013			return (EINVAL);
2014		}
2015
2016		if (iv_ofs & BWI_FW_IV_IS_32BIT) {
2017			uint32_t val32;
2018
2019			if (iv_img_size < sizeof(iv->iv_val.val32)) {
2020				printf("%s: invalid IV image, val32\n",
2021				    sc->sc_dev.dv_xname);
2022				return (EINVAL);
2023			}
2024			iv_img_size -= sizeof(iv->iv_val.val32);
2025			sz += sizeof(iv->iv_val.val32);
2026
2027			val32 = betoh32(iv->iv_val.val32);
2028			CSR_WRITE_4(sc, ofs, val32);
2029		} else {
2030			uint16_t val16;
2031
2032			if (iv_img_size < sizeof(iv->iv_val.val16)) {
2033				printf("%s: invalid IV image, val16\n",
2034				    sc->sc_dev.dv_xname);
2035				return (EINVAL);
2036			}
2037			iv_img_size -= sizeof(iv->iv_val.val16);
2038			sz += sizeof(iv->iv_val.val16);
2039
2040			val16 = betoh16(iv->iv_val.val16);
2041			CSR_WRITE_2(sc, ofs, val16);
2042		}
2043
2044		iv = (const struct bwi_fw_iv *)((const uint8_t *)iv + sz);
2045	}
2046
2047	if (iv_img_size != 0) {
2048		printf("%s: invalid IV image, size left %d\n",
2049		    sc->sc_dev.dv_xname, iv_img_size);
2050		return (EINVAL);
2051	}
2052
2053	return (0);
2054}
2055
2056int
2057bwi_mac_fw_init(struct bwi_mac *mac)
2058{
2059	struct bwi_softc *sc = mac->mac_sc;
2060	int error;
2061
2062	error = bwi_mac_fw_load_iv(mac, mac->mac_iv, mac->mac_iv_size);
2063	if (error) {
2064		printf("%s: load IV failed\n", sc->sc_dev.dv_xname);
2065		return (error);
2066	}
2067
2068	if (mac->mac_iv_ext != NULL) {
2069		error = bwi_mac_fw_load_iv(mac, mac->mac_iv_ext,
2070		    mac->mac_iv_ext_size);
2071		if (error)
2072			printf("%s: load ExtIV failed\n", sc->sc_dev.dv_xname);
2073	}
2074
2075	return (error);
2076}
2077
2078void
2079bwi_mac_opmode_init(struct bwi_mac *mac)
2080{
2081	struct bwi_softc *sc = mac->mac_sc;
2082	struct ieee80211com *ic = &sc->sc_ic;
2083	uint32_t mac_status;
2084	uint16_t pre_tbtt;
2085
2086	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
2087	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
2088	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PASS_BCN);
2089
2090	/* Set probe resp timeout to infinite */
2091	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 0);
2092
2093	/*
2094	 * TODO: factor out following part
2095	 */
2096
2097	mac_status = CSR_READ_4(sc, BWI_MAC_STATUS);
2098	mac_status &= ~(BWI_MAC_STATUS_OPMODE_HOSTAP |
2099	    BWI_MAC_STATUS_PASS_CTL |
2100	    BWI_MAC_STATUS_PASS_BADPLCP |
2101	    BWI_MAC_STATUS_PASS_BADFCS |
2102	    BWI_MAC_STATUS_PROMISC);
2103	mac_status |= BWI_MAC_STATUS_INFRA;
2104
2105	/* Always turn on PROMISC on old hardware */
2106	if (mac->mac_rev < 5)
2107		mac_status |= BWI_MAC_STATUS_PROMISC;
2108
2109	switch (ic->ic_opmode) {
2110	case IEEE80211_M_IBSS:
2111		mac_status &= ~BWI_MAC_STATUS_INFRA;
2112		break;
2113	case IEEE80211_M_HOSTAP:
2114		mac_status |= BWI_MAC_STATUS_OPMODE_HOSTAP;
2115		break;
2116	case IEEE80211_M_MONITOR:
2117#if 0
2118		/* Do you want data from your microwave oven? */
2119		mac_status |= BWI_MAC_STATUS_PASS_CTL |
2120			      BWI_MAC_STATUS_PASS_BADPLCP |
2121			      BWI_MAC_STATUS_PASS_BADFCS;
2122#else
2123		mac_status |= BWI_MAC_STATUS_PASS_CTL;
2124#endif
2125		/* Promisc? */
2126		break;
2127	default:
2128		break;
2129	}
2130
2131	if (ic->ic_if.if_flags & IFF_PROMISC)
2132		mac_status |= BWI_MAC_STATUS_PROMISC;
2133
2134	CSR_WRITE_4(sc, BWI_MAC_STATUS, mac_status);
2135
2136	if (ic->ic_opmode != IEEE80211_M_IBSS &&
2137	    ic->ic_opmode != IEEE80211_M_HOSTAP) {
2138		if (sc->sc_bbp_id == BWI_BBPID_BCM4306 && sc->sc_bbp_rev == 3)
2139			pre_tbtt = 100;
2140		else
2141			pre_tbtt = 50;
2142	} else
2143		pre_tbtt = 2;
2144	CSR_WRITE_2(sc, BWI_MAC_PRE_TBTT, pre_tbtt);
2145}
2146
2147void
2148bwi_mac_hostflags_init(struct bwi_mac *mac)
2149{
2150	struct bwi_softc *sc = mac->mac_sc;
2151	struct bwi_phy *phy = &mac->mac_phy;
2152	struct bwi_rf *rf = &mac->mac_rf;
2153	uint64_t host_flags;
2154
2155	if (phy->phy_mode == IEEE80211_MODE_11A)
2156		return;
2157
2158	host_flags = HFLAGS_READ(mac);
2159	host_flags |= BWI_HFLAG_SYM_WA;
2160
2161	if (phy->phy_mode == IEEE80211_MODE_11G) {
2162		if (phy->phy_rev == 1)
2163			host_flags |= BWI_HFLAG_GDC_WA;
2164		if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
2165			host_flags |= BWI_HFLAG_OFDM_PA;
2166	} else if (phy->phy_mode == IEEE80211_MODE_11B) {
2167		if (phy->phy_rev >= 2 && rf->rf_type == BWI_RF_T_BCM2050)
2168			host_flags &= ~BWI_HFLAG_GDC_WA;
2169	} else {
2170		panic("unknown PHY mode %u\n", phy->phy_mode);
2171	}
2172
2173	HFLAGS_WRITE(mac, host_flags);
2174}
2175
2176void
2177bwi_mac_bss_param_init(struct bwi_mac *mac)
2178{
2179	struct bwi_softc *sc = mac->mac_sc;
2180	struct bwi_phy *phy = &mac->mac_phy;
2181	struct bwi_retry_lim lim;
2182	uint16_t cw_min;
2183
2184	/*
2185	 * Set short/long retry limits
2186	 */
2187	bzero(&lim, sizeof(lim));
2188	lim.shretry = BWI_SHRETRY;
2189	lim.shretry_fb = BWI_SHRETRY_FB;
2190	lim.lgretry = BWI_LGRETRY;
2191	lim.lgretry_fb = BWI_LGRETRY_FB;
2192	bwi_mac_set_retry_lim(mac, &lim);
2193
2194	/*
2195	 * Implicitly prevent firmware from sending probe response
2196	 * by setting its "probe response timeout" to 1us.
2197	 */
2198	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 1);
2199
2200	/*
2201	 * XXX MAC level acknowledge and CW min/max should depend
2202	 * on the char rateset of the IBSS/BSS to join.
2203	 */
2204
2205	/*
2206	 * Set MAC level acknowledge rates
2207	 */
2208	bwi_mac_set_ackrates(mac, &sc->sc_ic.ic_sup_rates[phy->phy_mode]);
2209
2210	/*
2211	 * Set CW min
2212	 */
2213	if (phy->phy_mode == IEEE80211_MODE_11B)
2214		cw_min = IEEE80211_CW_MIN_0;
2215	else
2216		cw_min = IEEE80211_CW_MIN_1;
2217	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMIN, cw_min);
2218
2219	/*
2220	 * Set CW max
2221	 */
2222	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMAX,
2223	    IEEE80211_CW_MAX);
2224}
2225
2226void
2227bwi_mac_set_retry_lim(struct bwi_mac *mac, const struct bwi_retry_lim *lim)
2228{
2229	/* Short/Long retry limit */
2230	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_SHRETRY,
2231	    lim->shretry);
2232	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_LGRETRY,
2233	    lim->lgretry);
2234
2235	/* Short/Long retry fallback limit */
2236	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SHRETRY_FB,
2237	    lim->shretry_fb);
2238	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_LGRETEY_FB,
2239	    lim->lgretry_fb);
2240}
2241
2242void
2243bwi_mac_set_ackrates(struct bwi_mac *mac, const struct ieee80211_rateset *rs)
2244{
2245	struct bwi_softc *sc;
2246	int i;
2247
2248	sc = mac->mac_sc;
2249
2250	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
2251
2252	/* XXX not standard conforming */
2253	for (i = 0; i < rs->rs_nrates; ++i) {
2254		enum bwi_modtype modtype;
2255		uint16_t ofs;
2256
2257		modtype = bwi_rate2modtype(rs->rs_rates[i]);
2258		switch (modtype) {
2259		case IEEE80211_MODTYPE_DS:
2260			ofs = 0x4c0;
2261			ofs += (ieee80211_rate2plcp(rs->rs_rates[i],
2262			    IEEE80211_MODE_11B) & 0xf) * 2;
2263			break;
2264		case IEEE80211_MODTYPE_OFDM:
2265			ofs = 0x480;
2266			ofs += (ieee80211_rate2plcp(rs->rs_rates[i],
2267			    IEEE80211_MODE_11G) & 0xf) * 2;
2268			break;
2269		default:
2270			panic("unsupported modtype %u\n", modtype);
2271		}
2272
2273		MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, ofs + 0x20,
2274		    MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs));
2275	}
2276}
2277
2278int
2279bwi_mac_start(struct bwi_mac *mac)
2280{
2281	struct bwi_softc *sc = mac->mac_sc;
2282
2283	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
2284	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_READY);
2285
2286	/* Flush pending bus writes */
2287	CSR_READ_4(sc, BWI_MAC_STATUS);
2288	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
2289
2290	return (bwi_mac_config_ps(mac));
2291}
2292
2293int
2294bwi_mac_stop(struct bwi_mac *mac)
2295{
2296	struct bwi_softc *sc = mac->mac_sc;
2297	int error, i;
2298
2299	error = bwi_mac_config_ps(mac);
2300	if (error)
2301		return (error);
2302
2303	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
2304
2305	/* Flush pending bus write */
2306	CSR_READ_4(sc, BWI_MAC_STATUS);
2307
2308#define NRETRY	10000
2309	for (i = 0; i < NRETRY; ++i) {
2310		if (CSR_READ_4(sc, BWI_MAC_INTR_STATUS) & BWI_INTR_READY)
2311			break;
2312		DELAY(1);
2313	}
2314	if (i == NRETRY) {
2315		printf("%s: can't stop MAC\n", sc->sc_dev.dv_xname);
2316		return (ETIMEDOUT);
2317	}
2318#undef NRETRY
2319
2320	return (0);
2321}
2322
2323int
2324bwi_mac_config_ps(struct bwi_mac *mac)
2325{
2326	struct bwi_softc *sc = mac->mac_sc;
2327	uint32_t status;
2328
2329	status = CSR_READ_4(sc, BWI_MAC_STATUS);
2330
2331	status &= ~BWI_MAC_STATUS_HW_PS;
2332	status |= BWI_MAC_STATUS_WAKEUP;
2333	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
2334
2335	/* Flush pending bus write */
2336	CSR_READ_4(sc, BWI_MAC_STATUS);
2337
2338	if (mac->mac_rev >= 5) {
2339		int i;
2340
2341#define NRETRY	100
2342		for (i = 0; i < NRETRY; ++i) {
2343			if (MOBJ_READ_2(mac, BWI_COMM_MOBJ,
2344			    BWI_COMM_MOBJ_UCODE_STATE) != BWI_UCODE_STATE_PS)
2345				break;
2346			DELAY(10);
2347		}
2348		if (i == NRETRY) {
2349			printf("%s: config PS failed\n", sc->sc_dev.dv_xname);
2350			return (ETIMEDOUT);
2351		}
2352#undef NRETRY
2353	}
2354	return (0);
2355}
2356
2357void
2358bwi_mac_reset_hwkeys(struct bwi_mac *mac)
2359{
2360	/* TODO: firmware crypto */
2361	MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_KEYTABLE_OFS);
2362}
2363
2364void
2365bwi_mac_shutdown(struct bwi_mac *mac)
2366{
2367	struct bwi_softc *sc = mac->mac_sc;
2368	int i;
2369
2370	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS)
2371		sc->sc_free_txstats(sc);
2372
2373	sc->sc_free_rx_ring(sc);
2374
2375	for (i = 0; i < BWI_TX_NRING; ++i)
2376		sc->sc_free_tx_ring(sc, i);
2377
2378	bwi_rf_off(mac);
2379
2380	/* TODO: LED */
2381
2382	bwi_mac_gpio_fini(mac);
2383
2384	bwi_rf_off(mac); /* XXX again */
2385	CSR_WRITE_2(sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
2386	bwi_regwin_disable(sc, &mac->mac_regwin, 0);
2387
2388	mac->mac_flags &= ~BWI_MAC_F_INITED;
2389}
2390
2391int
2392bwi_mac_get_property(struct bwi_mac *mac)
2393{
2394	struct bwi_softc *sc = mac->mac_sc;
2395	enum bwi_bus_space old_bus_space;
2396	uint32_t val;
2397
2398	/*
2399	 * Byte swap
2400	 */
2401	val = CSR_READ_4(sc, BWI_MAC_STATUS);
2402	if (val & BWI_MAC_STATUS_BSWAP) {
2403		DPRINTF(1, "%s: need byte swap\n", sc->sc_dev.dv_xname);
2404		mac->mac_flags |= BWI_MAC_F_BSWAP;
2405	}
2406
2407	/*
2408	 * DMA address space
2409	 */
2410	old_bus_space = sc->sc_bus_space;
2411
2412	val = CSR_READ_4(sc, BWI_STATE_HI);
2413	if (__SHIFTOUT(val, BWI_STATE_HI_FLAGS_MASK) &
2414	    BWI_STATE_HI_FLAG_64BIT) {
2415		/* 64bit address */
2416		sc->sc_bus_space = BWI_BUS_SPACE_64BIT;
2417		DPRINTF(1, "%s: 64bit bus space\n", sc->sc_dev.dv_xname);
2418	} else {
2419		uint32_t txrx_reg = BWI_TXRX_CTRL_BASE + BWI_TX32_CTRL;
2420
2421		CSR_WRITE_4(sc, txrx_reg, BWI_TXRX32_CTRL_ADDRHI_MASK);
2422		if (CSR_READ_4(sc, txrx_reg) & BWI_TXRX32_CTRL_ADDRHI_MASK) {
2423			/* 32bit address */
2424			sc->sc_bus_space = BWI_BUS_SPACE_32BIT;
2425			DPRINTF(1, "%s: 32bit bus space\n",
2426			    sc->sc_dev.dv_xname);
2427		} else {
2428			/* 30bit address */
2429			sc->sc_bus_space = BWI_BUS_SPACE_30BIT;
2430			DPRINTF(1, "%s: 30bit bus space\n",
2431			    sc->sc_dev.dv_xname);
2432		}
2433	}
2434
2435	if (old_bus_space != 0 && old_bus_space != sc->sc_bus_space) {
2436		printf("%s: MACs bus space mismatch!\n", sc->sc_dev.dv_xname);
2437		return (ENXIO);
2438	}
2439
2440	return (0);
2441}
2442
2443#define IEEE80211_DUR_SLOT	20	/* DS/CCK slottime, ERP long slottime */
2444#define IEEE80211_DUR_SHSLOT	9	/* ERP short slottime */
2445
2446void
2447bwi_mac_updateslot(struct bwi_mac *mac, int shslot)
2448{
2449	struct bwi_softc *sc;
2450	uint16_t slot_time;
2451
2452	sc = mac->mac_sc;
2453
2454	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
2455
2456	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B)
2457		return;
2458
2459	if (shslot)
2460		slot_time = IEEE80211_DUR_SHSLOT;
2461	else
2462		slot_time = IEEE80211_DUR_SLOT;
2463
2464	CSR_WRITE_2(mac->mac_sc, BWI_MAC_SLOTTIME,
2465	    slot_time + BWI_MAC_SLOTTIME_ADJUST);
2466	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SLOTTIME, slot_time);
2467}
2468
2469int
2470bwi_mac_attach(struct bwi_softc *sc, int id, uint8_t rev)
2471{
2472	struct bwi_mac *mac;
2473	int i;
2474
2475	KASSERT(sc->sc_nmac <= BWI_MAC_MAX && sc->sc_nmac >= 0);
2476
2477	if (sc->sc_nmac == BWI_MAC_MAX) {
2478		printf("%s: too many MACs\n", sc->sc_dev.dv_xname);
2479		return (0);
2480	}
2481
2482	/*
2483	 * More than one MAC is only supported by BCM4309
2484	 */
2485	if (sc->sc_nmac != 0 &&
2486	    sc->sc_pci_did != PCI_PRODUCT_BROADCOM_BCM4309) {
2487		DPRINTF(1, "%s: ignore second MAC\n", sc->sc_dev.dv_xname);
2488		return (0);
2489	}
2490
2491	mac = &sc->sc_mac[sc->sc_nmac];
2492
2493	/* XXX will this happen? */
2494	if (BWI_REGWIN_EXIST(&mac->mac_regwin)) {
2495		printf("%s: %dth MAC already attached\n",
2496		    sc->sc_dev.dv_xname, sc->sc_nmac);
2497		return (0);
2498	}
2499
2500	/*
2501	 * Test whether the revision of this MAC is supported
2502	 */
2503#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
2504	for (i = 0; i < N(bwi_sup_macrev); ++i) {
2505		if (bwi_sup_macrev[i] == rev)
2506			break;
2507	}
2508	if (i == N(bwi_sup_macrev)) {
2509		printf("%s: MAC rev %u is not supported\n",
2510		    sc->sc_dev.dv_xname, rev);
2511		return (ENXIO);
2512	}
2513#undef N
2514
2515	BWI_CREATE_MAC(mac, sc, id, rev);
2516	sc->sc_nmac++;
2517
2518	if (mac->mac_rev < 5) {
2519		mac->mac_flags |= BWI_MAC_F_HAS_TXSTATS;
2520		DPRINTF(1, "%s: has TX stats\n", sc->sc_dev.dv_xname);
2521	} else {
2522		mac->mac_flags |= BWI_MAC_F_PHYE_RESET;
2523	}
2524
2525	return (0);
2526}
2527
2528void
2529bwi_mac_balance_atten(int *bbp_atten0, int *rf_atten0)
2530{
2531	int bbp_atten, rf_atten, rf_atten_lim = -1;
2532
2533	bbp_atten = *bbp_atten0;
2534	rf_atten = *rf_atten0;
2535
2536	/*
2537	 * RF attenuation affects TX power BWI_RF_ATTEN_FACTOR times
2538	 * as much as BBP attenuation, so we try our best to keep RF
2539	 * attenuation within range.  BBP attenuation will be clamped
2540	 * later if it is out of range during balancing.
2541	 *
2542	 * BWI_RF_ATTEN_MAX0 is used as RF attenuation upper limit.
2543	 */
2544
2545	/*
2546	 * Use BBP attenuation to balance RF attenuation
2547	 */
2548	if (rf_atten < 0)
2549		rf_atten_lim = 0;
2550	else if (rf_atten > BWI_RF_ATTEN_MAX0)
2551		rf_atten_lim = BWI_RF_ATTEN_MAX0;
2552
2553	if (rf_atten_lim >= 0) {
2554		bbp_atten += (BWI_RF_ATTEN_FACTOR * (rf_atten - rf_atten_lim));
2555		rf_atten = rf_atten_lim;
2556	}
2557
2558	/*
2559	 * If possible, use RF attenuation to balance BBP attenuation
2560	 * NOTE: RF attenuation is still kept within range.
2561	 */
2562	while (rf_atten < BWI_RF_ATTEN_MAX0 && bbp_atten > BWI_BBP_ATTEN_MAX) {
2563		bbp_atten -= BWI_RF_ATTEN_FACTOR;
2564		++rf_atten;
2565	}
2566	while (rf_atten > 0 && bbp_atten < 0) {
2567		bbp_atten += BWI_RF_ATTEN_FACTOR;
2568		--rf_atten;
2569	}
2570
2571	/* RF attenuation MUST be within range */
2572	KASSERT(rf_atten >= 0 && rf_atten <= BWI_RF_ATTEN_MAX0);
2573
2574	/*
2575	 * Clamp BBP attenuation
2576	 */
2577	if (bbp_atten < 0)
2578		bbp_atten = 0;
2579	else if (bbp_atten > BWI_BBP_ATTEN_MAX)
2580		bbp_atten = BWI_BBP_ATTEN_MAX;
2581
2582	*rf_atten0 = rf_atten;
2583	*bbp_atten0 = bbp_atten;
2584}
2585
2586void
2587bwi_mac_adjust_tpctl(struct bwi_mac *mac, int rf_atten_adj, int bbp_atten_adj)
2588{
2589	struct bwi_softc *sc = mac->mac_sc;
2590	struct bwi_rf *rf = &mac->mac_rf;
2591	struct bwi_tpctl tpctl;
2592	int bbp_atten, rf_atten, tp_ctrl1;
2593
2594	bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
2595
2596	/* NOTE: Use signed value to do calulation */
2597	bbp_atten = tpctl.bbp_atten;
2598	rf_atten = tpctl.rf_atten;
2599	tp_ctrl1 = tpctl.tp_ctrl1;
2600
2601	bbp_atten += bbp_atten_adj;
2602	rf_atten += rf_atten_adj;
2603
2604	bwi_mac_balance_atten(&bbp_atten, &rf_atten);
2605
2606	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev == 2) {
2607		if (rf_atten <= 1) {
2608			if (tp_ctrl1 == 0) {
2609				tp_ctrl1 = 3;
2610				bbp_atten += 2;
2611				rf_atten += 2;
2612			} else if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
2613				bbp_atten +=
2614				(BWI_RF_ATTEN_FACTOR * (rf_atten - 2));
2615				rf_atten = 2;
2616			}
2617		} else if (rf_atten > 4 && tp_ctrl1 != 0) {
2618			tp_ctrl1 = 0;
2619			if (bbp_atten < 3) {
2620				bbp_atten += 2;
2621				rf_atten -= 3;
2622			} else {
2623				bbp_atten -= 2;
2624				rf_atten -= 2;
2625			}
2626		}
2627		bwi_mac_balance_atten(&bbp_atten, &rf_atten);
2628	}
2629
2630	tpctl.bbp_atten = bbp_atten;
2631	tpctl.rf_atten = rf_atten;
2632	tpctl.tp_ctrl1 = tp_ctrl1;
2633
2634	bwi_mac_lock(mac);
2635	bwi_mac_set_tpctl_11bg(mac, &tpctl);
2636	bwi_mac_unlock(mac);
2637}
2638
2639/*
2640 * http://bcm-specs.sipsolutions.net/RecalculateTransmissionPower
2641 */
2642void
2643bwi_mac_calibrate_txpower(struct bwi_mac *mac, enum bwi_txpwrcb_type type)
2644{
2645	struct bwi_softc *sc = mac->mac_sc;
2646	struct bwi_rf *rf = &mac->mac_rf;
2647	int8_t tssi[4], tssi_avg, cur_txpwr;
2648	int error, i, ofdm_tssi;
2649	int txpwr_diff, rf_atten_adj, bbp_atten_adj;
2650
2651	if (mac->mac_flags & BWI_MAC_F_TPCTL_ERROR) {
2652		DPRINTF(1, "%s: tpctl error happened, can't set txpower\n",
2653		    sc->sc_dev.dv_xname);
2654		return;
2655	}
2656
2657	if (BWI_IS_BRCM_BU4306(sc)) {
2658		DPRINTF(1, "%s: BU4306, can't set txpower\n",
2659		    sc->sc_dev.dv_xname);
2660		return;
2661	}
2662
2663	/*
2664	 * Save latest TSSI and reset the related memory objects
2665	 */
2666	ofdm_tssi = 0;
2667	error = bwi_rf_get_latest_tssi(mac, tssi, BWI_COMM_MOBJ_TSSI_DS);
2668	if (error) {
2669		DPRINTF(1, "%s: no DS tssi\n", sc->sc_dev.dv_xname);
2670
2671		if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B) {
2672			if (type == BWI_TXPWR_FORCE) {
2673				rf_atten_adj = 0;
2674				bbp_atten_adj = 1;
2675				goto calib;
2676			} else {
2677				return;
2678			}
2679		}
2680
2681		error = bwi_rf_get_latest_tssi(mac, tssi,
2682		    BWI_COMM_MOBJ_TSSI_OFDM);
2683		if (error) {
2684			DPRINTF(1, "%s: no OFDM tssi\n", sc->sc_dev.dv_xname);
2685			if (type == BWI_TXPWR_FORCE) {
2686				rf_atten_adj = 0;
2687				bbp_atten_adj = 1;
2688				goto calib;
2689			} else {
2690				return;
2691			}
2692		}
2693
2694		for (i = 0; i < 4; ++i) {
2695			tssi[i] += 0x20;
2696			tssi[i] &= 0x3f;
2697		}
2698		ofdm_tssi = 1;
2699	}
2700	bwi_rf_clear_tssi(mac);
2701
2702	DPRINTF(1, "%s: tssi0 %d, tssi1 %d, tssi2 %d, tssi3 %d\n",
2703	    sc->sc_dev.dv_xname, tssi[0], tssi[1], tssi[2], tssi[3]);
2704
2705	/*
2706	 * Calculate RF/BBP attenuation adjustment based on
2707	 * the difference between desired TX power and sampled
2708	 * TX power.
2709	 */
2710	/* +8 == "each incremented by 1/2" */
2711	tssi_avg = (tssi[0] + tssi[1] + tssi[2] + tssi[3] + 8) / 4;
2712	if (ofdm_tssi && (HFLAGS_READ(mac) & BWI_HFLAG_PWR_BOOST_DS))
2713		tssi_avg -= 13;
2714
2715	DPRINTF(1, "%s: tssi avg %d\n", sc->sc_dev.dv_xname, tssi_avg);
2716
2717	error = bwi_rf_tssi2dbm(mac, tssi_avg, &cur_txpwr);
2718	if (error)
2719		return;
2720	DPRINTF(1, "%s: current txpower %d\n", sc->sc_dev.dv_xname, cur_txpwr);
2721
2722	txpwr_diff = rf->rf_txpower_max - cur_txpwr; /* XXX ni_txpower */
2723
2724	rf_atten_adj = -howmany(txpwr_diff, 8);
2725
2726	if (type == BWI_TXPWR_INIT) {
2727		/*
2728		 * Move toward EEPROM max TX power as fast as we can
2729		 */
2730		bbp_atten_adj = -txpwr_diff;
2731	} else {
2732		bbp_atten_adj = -(txpwr_diff / 2);
2733	}
2734	bbp_atten_adj -= (BWI_RF_ATTEN_FACTOR * rf_atten_adj);
2735
2736	if (rf_atten_adj == 0 && bbp_atten_adj == 0) {
2737		DPRINTF(1, "%s: no need to adjust RF/BBP attenuation\n",
2738		    sc->sc_dev.dv_xname);
2739		/* TODO: LO */
2740		return;
2741	}
2742
2743calib:
2744	DPRINTF(1, "%s: rf atten adjust %d, bbp atten adjust %d\n",
2745	    sc->sc_dev.dv_xname, rf_atten_adj, bbp_atten_adj);
2746	bwi_mac_adjust_tpctl(mac, rf_atten_adj, bbp_atten_adj);
2747	/* TODO: LO */
2748}
2749
2750void
2751bwi_mac_lock(struct bwi_mac *mac)
2752{
2753	struct bwi_softc *sc = mac->mac_sc;
2754	struct ieee80211com *ic = &sc->sc_ic;
2755
2756	KASSERT((mac->mac_flags & BWI_MAC_F_LOCKED) == 0);
2757
2758	if (mac->mac_rev < 3)
2759		bwi_mac_stop(mac);
2760	else if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2761		bwi_mac_config_ps(mac);
2762
2763	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
2764
2765	/* Flush pending bus write */
2766	CSR_READ_4(sc, BWI_MAC_STATUS);
2767	DELAY(10);
2768
2769	mac->mac_flags |= BWI_MAC_F_LOCKED;
2770}
2771
2772void
2773bwi_mac_unlock(struct bwi_mac *mac)
2774{
2775	struct bwi_softc *sc = mac->mac_sc;
2776	struct ieee80211com *ic = &sc->sc_ic;
2777
2778	KASSERT(mac->mac_flags & BWI_MAC_F_LOCKED);
2779
2780	CSR_READ_2(sc, BWI_PHYINFO); /* dummy read */
2781
2782	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
2783
2784	if (mac->mac_rev < 3)
2785		bwi_mac_start(mac);
2786	else if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2787		bwi_mac_config_ps(mac);
2788
2789	mac->mac_flags &= ~BWI_MAC_F_LOCKED;
2790}
2791
2792void
2793bwi_mac_set_promisc(struct bwi_mac *mac, int promisc)
2794{
2795	struct bwi_softc *sc = mac->mac_sc;
2796
2797	if (mac->mac_rev < 5) /* Promisc is always on */
2798		return;
2799
2800	if (promisc)
2801		CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
2802	else
2803		CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
2804}
2805
2806/* PHY */
2807
2808void
2809bwi_phy_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
2810{
2811	struct bwi_softc *sc = mac->mac_sc;
2812
2813	/* TODO: 11A */
2814	CSR_WRITE_2(sc, BWI_PHY_CTRL, ctrl);
2815	CSR_WRITE_2(sc, BWI_PHY_DATA, data);
2816}
2817
2818uint16_t
2819bwi_phy_read(struct bwi_mac *mac, uint16_t ctrl)
2820{
2821	struct bwi_softc *sc = mac->mac_sc;
2822
2823	/* TODO: 11A */
2824	CSR_WRITE_2(sc, BWI_PHY_CTRL, ctrl);
2825	return (CSR_READ_2(sc, BWI_PHY_DATA));
2826}
2827
2828int
2829bwi_phy_attach(struct bwi_mac *mac)
2830{
2831	struct bwi_softc *sc = mac->mac_sc;
2832	struct bwi_phy *phy = &mac->mac_phy;
2833	uint8_t phyrev, phytype, phyver;
2834	uint16_t val;
2835	int i;
2836
2837	/* Get PHY type/revision/version */
2838	val = CSR_READ_2(sc, BWI_PHYINFO);
2839	phyrev = __SHIFTOUT(val, BWI_PHYINFO_REV_MASK);
2840	phytype = __SHIFTOUT(val, BWI_PHYINFO_TYPE_MASK);
2841	phyver = __SHIFTOUT(val, BWI_PHYINFO_VER_MASK);
2842	DPRINTF(1, "%s: PHY type %d, rev %d, ver %d\n",
2843	    sc->sc_dev.dv_xname, phytype, phyrev, phyver);
2844
2845	/*
2846	 * Verify whether the revision of the PHY type is supported
2847	 * Convert PHY type to ieee80211_phymode
2848	 */
2849	switch (phytype) {
2850	case BWI_PHYINFO_TYPE_11A:
2851		if (phyrev >= 4) {
2852			printf("%s: unsupported 11A PHY, rev %u\n",
2853			    sc->sc_dev.dv_xname, phyrev);
2854			return (ENXIO);
2855		}
2856		phy->phy_init = bwi_phy_init_11a;
2857		phy->phy_mode = IEEE80211_MODE_11A;
2858		phy->phy_tbl_ctrl = BWI_PHYR_TBL_CTRL_11A;
2859		phy->phy_tbl_data_lo = BWI_PHYR_TBL_DATA_LO_11A;
2860		phy->phy_tbl_data_hi = BWI_PHYR_TBL_DATA_HI_11A;
2861		break;
2862	case BWI_PHYINFO_TYPE_11B:
2863#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
2864		for (i = 0; i < N(bwi_sup_bphy); ++i) {
2865			if (phyrev == bwi_sup_bphy[i].rev) {
2866				phy->phy_init = bwi_sup_bphy[i].init;
2867				break;
2868			}
2869		}
2870		if (i == N(bwi_sup_bphy)) {
2871			printf("%s: unsupported 11B PHY, rev %u\n",
2872			    sc->sc_dev.dv_xname, phyrev);
2873			return (ENXIO);
2874		}
2875#undef N
2876		phy->phy_mode = IEEE80211_MODE_11B;
2877		break;
2878	case BWI_PHYINFO_TYPE_11G:
2879		if (phyrev > 8) {
2880			printf("%s: unsupported 11G PHY, rev %u\n",
2881			    sc->sc_dev.dv_xname, phyrev);
2882			return (ENXIO);
2883		}
2884		phy->phy_init = bwi_phy_init_11g;
2885		phy->phy_mode = IEEE80211_MODE_11G;
2886		phy->phy_tbl_ctrl = BWI_PHYR_TBL_CTRL_11G;
2887		phy->phy_tbl_data_lo = BWI_PHYR_TBL_DATA_LO_11G;
2888		phy->phy_tbl_data_hi = BWI_PHYR_TBL_DATA_HI_11G;
2889		break;
2890	default:
2891		printf("%s: unsupported PHY type %d\n",
2892		    sc->sc_dev.dv_xname, phytype);
2893		return (ENXIO);
2894	}
2895	phy->phy_rev = phyrev;
2896	phy->phy_version = phyver;
2897
2898	return (0);
2899}
2900
2901void
2902bwi_phy_set_bbp_atten(struct bwi_mac *mac, uint16_t bbp_atten)
2903{
2904	struct bwi_phy *phy = &mac->mac_phy;
2905	uint16_t mask = 0x000f;
2906
2907	if (phy->phy_version == 0) {
2908		CSR_FILT_SETBITS_2(mac->mac_sc, BWI_BBP_ATTEN, ~mask,
2909		    __SHIFTIN(bbp_atten, mask));
2910	} else {
2911		if (phy->phy_version > 1)
2912			mask <<= 2;
2913		else
2914			mask <<= 3;
2915		PHY_FILT_SETBITS(mac, BWI_PHYR_BBP_ATTEN, ~mask,
2916		    __SHIFTIN(bbp_atten, mask));
2917	}
2918}
2919
2920int
2921bwi_phy_calibrate(struct bwi_mac *mac)
2922{
2923	struct bwi_phy *phy = &mac->mac_phy;
2924
2925	/* Dummy read */
2926	CSR_READ_4(mac->mac_sc, BWI_MAC_STATUS);
2927
2928	/* Don't re-init */
2929	if (phy->phy_flags & BWI_PHY_F_CALIBRATED)
2930		return (0);
2931
2932	if (phy->phy_mode == IEEE80211_MODE_11G && phy->phy_rev == 1) {
2933		bwi_mac_reset(mac, 0);
2934		bwi_phy_init_11g(mac);
2935		bwi_mac_reset(mac, 1);
2936	}
2937
2938	phy->phy_flags |= BWI_PHY_F_CALIBRATED;
2939
2940	return (0);
2941}
2942
2943void
2944bwi_tbl_write_2(struct bwi_mac *mac, uint16_t ofs, uint16_t data)
2945{
2946	struct bwi_phy *phy = &mac->mac_phy;
2947
2948	KASSERT(phy->phy_tbl_ctrl != 0 && phy->phy_tbl_data_lo != 0);
2949	PHY_WRITE(mac, phy->phy_tbl_ctrl, ofs);
2950	PHY_WRITE(mac, phy->phy_tbl_data_lo, data);
2951}
2952
2953void
2954bwi_tbl_write_4(struct bwi_mac *mac, uint16_t ofs, uint32_t data)
2955{
2956	struct bwi_phy *phy = &mac->mac_phy;
2957
2958	KASSERT(phy->phy_tbl_data_lo != 0 && phy->phy_tbl_data_hi != 0 &&
2959	    phy->phy_tbl_ctrl != 0);
2960
2961	PHY_WRITE(mac, phy->phy_tbl_ctrl, ofs);
2962	PHY_WRITE(mac, phy->phy_tbl_data_hi, data >> 16);
2963	PHY_WRITE(mac, phy->phy_tbl_data_lo, data & 0xffff);
2964}
2965
2966void
2967bwi_nrssi_write(struct bwi_mac *mac, uint16_t ofs, int16_t data)
2968{
2969	PHY_WRITE(mac, BWI_PHYR_NRSSI_CTRL, ofs);
2970	PHY_WRITE(mac, BWI_PHYR_NRSSI_DATA, (uint16_t)data);
2971}
2972
2973int16_t
2974bwi_nrssi_read(struct bwi_mac *mac, uint16_t ofs)
2975{
2976	PHY_WRITE(mac, BWI_PHYR_NRSSI_CTRL, ofs);
2977	return ((int16_t)PHY_READ(mac, BWI_PHYR_NRSSI_DATA));
2978}
2979
2980void
2981bwi_phy_init_11a(struct bwi_mac *mac)
2982{
2983	/* TODO: 11A */
2984}
2985
2986void
2987bwi_phy_init_11g(struct bwi_mac *mac)
2988{
2989	struct bwi_softc *sc = mac->mac_sc;
2990	struct bwi_phy *phy = &mac->mac_phy;
2991	struct bwi_rf *rf = &mac->mac_rf;
2992	const struct bwi_tpctl *tpctl = &mac->mac_tpctl;
2993
2994	if (phy->phy_rev == 1)
2995		bwi_phy_init_11b_rev5(mac);
2996	else
2997		bwi_phy_init_11b_rev6(mac);
2998
2999	if (phy->phy_rev >= 2 || (phy->phy_flags & BWI_PHY_F_LINKED))
3000		bwi_phy_config_11g(mac);
3001
3002	if (phy->phy_rev >= 2) {
3003		PHY_WRITE(mac, 0x814, 0);
3004		PHY_WRITE(mac, 0x815, 0);
3005
3006		if (phy->phy_rev == 2) {
3007			PHY_WRITE(mac, 0x811, 0);
3008			PHY_WRITE(mac, 0x15, 0xc0);
3009		} else if (phy->phy_rev > 5) {
3010			PHY_WRITE(mac, 0x811, 0x400);
3011			PHY_WRITE(mac, 0x15, 0xc0);
3012		}
3013	}
3014
3015	if (phy->phy_rev >= 2 || (phy->phy_flags & BWI_PHY_F_LINKED)) {
3016		uint16_t val;
3017
3018		val = PHY_READ(mac, 0x400) & 0xff;
3019		if (val == 3 || val == 5) {
3020			PHY_WRITE(mac, 0x4c2, 0x1816);
3021			PHY_WRITE(mac, 0x4c3, 0x8006);
3022			if (val == 5) {
3023				PHY_FILT_SETBITS(mac, 0x4cc,
3024						 0xff, 0x1f00);
3025			}
3026		}
3027	}
3028
3029	if ((phy->phy_rev <= 2 && (phy->phy_flags & BWI_PHY_F_LINKED)) ||
3030	    phy->phy_rev >= 2)
3031		PHY_WRITE(mac, 0x47e, 0x78);
3032
3033	if (rf->rf_rev == 8) {
3034		PHY_SETBITS(mac, 0x801, 0x80);
3035		PHY_SETBITS(mac, 0x43e, 0x4);
3036	}
3037
3038	if (phy->phy_rev >= 2 && (phy->phy_flags & BWI_PHY_F_LINKED))
3039		bwi_rf_get_gains(mac);
3040
3041	if (rf->rf_rev != 8)
3042		bwi_rf_init(mac);
3043
3044	if (tpctl->tp_ctrl2 == 0xffff) {
3045		bwi_rf_lo_update(mac);
3046	} else {
3047		if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev == 8) {
3048			RF_WRITE(mac, 0x52,
3049			    (tpctl->tp_ctrl1 << 4) | tpctl->tp_ctrl2);
3050		} else {
3051			RF_FILT_SETBITS(mac, 0x52, 0xfff0, tpctl->tp_ctrl1);
3052		}
3053
3054		if (phy->phy_rev >= 6) {
3055			PHY_FILT_SETBITS(mac, 0x36, 0xfff,
3056			    tpctl->tp_ctrl2 << 12);
3057		}
3058
3059		if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
3060			PHY_WRITE(mac, 0x2e, 0x8075);
3061		else
3062			PHY_WRITE(mac, 0x2e, 0x807f);
3063
3064		if (phy->phy_rev < 2)
3065			PHY_WRITE(mac, 0x2f, 0x101);
3066		else
3067			PHY_WRITE(mac, 0x2f, 0x202);
3068	}
3069
3070	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3071		bwi_rf_lo_adjust(mac, tpctl);
3072		PHY_WRITE(mac, 0x80f, 0x8078);
3073	}
3074
3075	if ((sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
3076		bwi_rf_init_hw_nrssi_table(mac, 0xffff /* XXX */);
3077		bwi_rf_set_nrssi_thr(mac);
3078	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3079		if (rf->rf_nrssi[0] == BWI_INVALID_NRSSI) {
3080			KASSERT(rf->rf_nrssi[1] == BWI_INVALID_NRSSI);
3081			bwi_rf_calc_nrssi_slope(mac);
3082		} else {
3083			KASSERT(rf->rf_nrssi[1] != BWI_INVALID_NRSSI);
3084			bwi_rf_set_nrssi_thr(mac);
3085		}
3086	}
3087
3088	if (rf->rf_rev == 8)
3089		PHY_WRITE(mac, 0x805, 0x3230);
3090
3091	bwi_mac_init_tpctl_11bg(mac);
3092
3093	if (sc->sc_bbp_id == BWI_BBPID_BCM4306 && sc->sc_bbp_pkg == 2) {
3094		PHY_CLRBITS(mac, 0x429, 0x4000);
3095		PHY_CLRBITS(mac, 0x4c3, 0x8000);
3096	}
3097}
3098
3099void
3100bwi_phy_init_11b_rev2(struct bwi_mac *mac)
3101{
3102	struct bwi_softc *sc;
3103
3104	sc = mac->mac_sc;
3105
3106	/* TODO: 11B */
3107	printf("%s: %s is not implemented yet\n",
3108	    sc->sc_dev.dv_xname, __func__);
3109}
3110
3111void
3112bwi_phy_init_11b_rev4(struct bwi_mac *mac)
3113{
3114	struct bwi_softc *sc = mac->mac_sc;
3115	struct bwi_rf *rf = &mac->mac_rf;
3116	uint16_t val, ofs;
3117	u_int chan;
3118
3119	CSR_WRITE_2(sc, BWI_BPHY_CTRL, BWI_BPHY_CTRL_INIT);
3120
3121	PHY_WRITE(mac, 0x20, 0x301c);
3122	PHY_WRITE(mac, 0x26, 0);
3123	PHY_WRITE(mac, 0x30, 0xc6);
3124	PHY_WRITE(mac, 0x88, 0x3e00);
3125
3126	for (ofs = 0, val = 0x3c3d; ofs < 30; ++ofs, val -= 0x202)
3127		PHY_WRITE(mac, 0x89 + ofs, val);
3128
3129	CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL1);
3130
3131	chan = rf->rf_curchan;
3132	if (chan == IEEE80211_CHAN_ANY)
3133		chan = 6;	/* Force to channel 6 */
3134	bwi_rf_set_chan(mac, chan, 0);
3135
3136	if (rf->rf_type != BWI_RF_T_BCM2050) {
3137		RF_WRITE(mac, 0x75, 0x80);
3138		RF_WRITE(mac, 0x79, 0x81);
3139	}
3140
3141	RF_WRITE(mac, 0x50, 0x20);
3142	RF_WRITE(mac, 0x50, 0x23);
3143
3144	if (rf->rf_type == BWI_RF_T_BCM2050) {
3145		RF_WRITE(mac, 0x50, 0x20);
3146		RF_WRITE(mac, 0x5a, 0x70);
3147		RF_WRITE(mac, 0x5b, 0x7b);
3148		RF_WRITE(mac, 0x5c, 0xb0);
3149		RF_WRITE(mac, 0x7a, 0xf);
3150		PHY_WRITE(mac, 0x38, 0x677);
3151		bwi_rf_init_bcm2050(mac);
3152	}
3153
3154	PHY_WRITE(mac, 0x14, 0x80);
3155	PHY_WRITE(mac, 0x32, 0xca);
3156	if (rf->rf_type == BWI_RF_T_BCM2050)
3157		PHY_WRITE(mac, 0x32, 0xe0);
3158	PHY_WRITE(mac, 0x35, 0x7c2);
3159
3160	bwi_rf_lo_update(mac);
3161
3162	PHY_WRITE(mac, 0x26, 0xcc00);
3163	if (rf->rf_type == BWI_RF_T_BCM2050)
3164		PHY_WRITE(mac, 0x26, 0xce00);
3165
3166	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0x1100);
3167
3168	PHY_WRITE(mac, 0x2a, 0x88a3);
3169	if (rf->rf_type == BWI_RF_T_BCM2050)
3170		PHY_WRITE(mac, 0x2a, 0x88c2);
3171
3172	bwi_mac_set_tpctl_11bg(mac, NULL);
3173	if (sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
3174		bwi_rf_calc_nrssi_slope(mac);
3175		bwi_rf_set_nrssi_thr(mac);
3176	}
3177	bwi_mac_init_tpctl_11bg(mac);
3178}
3179
3180void
3181bwi_phy_init_11b_rev5(struct bwi_mac *mac)
3182{
3183	struct bwi_softc *sc = mac->mac_sc;
3184	struct bwi_rf *rf = &mac->mac_rf;
3185	struct bwi_phy *phy = &mac->mac_phy;
3186	uint orig_chan;
3187
3188	if (phy->phy_version == 1)
3189		RF_SETBITS(mac, 0x7a, 0x50);
3190
3191	if (sc->sc_pci_subvid != PCI_VENDOR_BROADCOM &&
3192	    sc->sc_pci_subdid != BWI_PCI_SUBDEVICE_BU4306) {
3193		uint16_t ofs, val;
3194
3195		val = 0x2120;
3196		for (ofs = 0xa8; ofs < 0xc7; ++ofs) {
3197			PHY_WRITE(mac, ofs, val);
3198			val += 0x202;
3199		}
3200	}
3201
3202	PHY_FILT_SETBITS(mac, 0x35, 0xf0ff, 0x700);
3203
3204	if (rf->rf_type == BWI_RF_T_BCM2050)
3205		PHY_WRITE(mac, 0x38, 0x667);
3206
3207	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3208		if (rf->rf_type == BWI_RF_T_BCM2050) {
3209			RF_SETBITS(mac, 0x7a, 0x20);
3210			RF_SETBITS(mac, 0x51, 0x4);
3211		}
3212
3213		CSR_WRITE_2(sc, BWI_RF_ANTDIV, 0);
3214
3215		PHY_SETBITS(mac, 0x802, 0x100);
3216		PHY_SETBITS(mac, 0x42b, 0x2000);
3217		PHY_WRITE(mac, 0x1c, 0x186a);
3218
3219		PHY_FILT_SETBITS(mac, 0x13, 0xff, 0x1900);
3220		PHY_FILT_SETBITS(mac, 0x35, 0xffc0, 0x64);
3221		PHY_FILT_SETBITS(mac, 0x5d, 0xff80, 0xa);
3222	}
3223
3224	/* TODO: bad_frame_preempt? */
3225
3226	if (phy->phy_version == 1) {
3227	    	PHY_WRITE(mac, 0x26, 0xce00);
3228		PHY_WRITE(mac, 0x21, 0x3763);
3229		PHY_WRITE(mac, 0x22, 0x1bc3);
3230		PHY_WRITE(mac, 0x23, 0x6f9);
3231		PHY_WRITE(mac, 0x24, 0x37e);
3232	} else
3233		PHY_WRITE(mac, 0x26, 0xcc00);
3234	PHY_WRITE(mac, 0x30, 0xc6);
3235
3236	CSR_WRITE_2(sc, BWI_BPHY_CTRL, BWI_BPHY_CTRL_INIT);
3237
3238	if (phy->phy_version == 1)
3239		PHY_WRITE(mac, 0x20, 0x3e1c);
3240	else
3241		PHY_WRITE(mac, 0x20, 0x301c);
3242
3243	if (phy->phy_version == 0)
3244		CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL1);
3245
3246	/* Force to channel 7 */
3247	orig_chan = rf->rf_curchan;
3248	bwi_rf_set_chan(mac, 7, 0);
3249
3250	if (rf->rf_type != BWI_RF_T_BCM2050) {
3251		RF_WRITE(mac, 0x75, 0x80);
3252		RF_WRITE(mac, 0x79, 0x81);
3253	}
3254
3255	RF_WRITE(mac, 0x50, 0x20);
3256	RF_WRITE(mac, 0x50, 0x23);
3257
3258	if (rf->rf_type == BWI_RF_T_BCM2050) {
3259		RF_WRITE(mac, 0x50, 0x20);
3260		RF_WRITE(mac, 0x5a, 0x70);
3261	}
3262
3263	RF_WRITE(mac, 0x5b, 0x7b);
3264	RF_WRITE(mac, 0x5c, 0xb0);
3265	RF_SETBITS(mac, 0x7a, 0x7);
3266
3267	bwi_rf_set_chan(mac, orig_chan, 0);
3268
3269	PHY_WRITE(mac, 0x14, 0x80);
3270	PHY_WRITE(mac, 0x32, 0xca);
3271	PHY_WRITE(mac, 0x2a, 0x88a3);
3272
3273	bwi_mac_set_tpctl_11bg(mac, NULL);
3274
3275	if (rf->rf_type == BWI_RF_T_BCM2050)
3276		RF_WRITE(mac, 0x5d, 0xd);
3277
3278	CSR_FILT_SETBITS_2(sc, BWI_PHY_MAGIC_REG1, 0xffc0, 0x4);
3279}
3280
3281void
3282bwi_phy_init_11b_rev6(struct bwi_mac *mac)
3283{
3284	struct bwi_softc *sc = mac->mac_sc;
3285	struct bwi_rf *rf = &mac->mac_rf;
3286	struct bwi_phy *phy = &mac->mac_phy;
3287	uint16_t val, ofs;
3288	uint orig_chan;
3289
3290	PHY_WRITE(mac, 0x3e, 0x817a);
3291	RF_SETBITS(mac, 0x7a, 0x58);
3292
3293	if (rf->rf_rev == 4 || rf->rf_rev == 5) {
3294		RF_WRITE(mac, 0x51, 0x37);
3295		RF_WRITE(mac, 0x52, 0x70);
3296		RF_WRITE(mac, 0x53, 0xb3);
3297		RF_WRITE(mac, 0x54, 0x9b);
3298		RF_WRITE(mac, 0x5a, 0x88);
3299		RF_WRITE(mac, 0x5b, 0x88);
3300		RF_WRITE(mac, 0x5d, 0x88);
3301		RF_WRITE(mac, 0x5e, 0x88);
3302		RF_WRITE(mac, 0x7d, 0x88);
3303		HFLAGS_SETBITS(mac, BWI_HFLAG_MAGIC1);
3304	} else if (rf->rf_rev == 8) {
3305		RF_WRITE(mac, 0x51, 0);
3306		RF_WRITE(mac, 0x52, 0x40);
3307		RF_WRITE(mac, 0x53, 0xb7);
3308		RF_WRITE(mac, 0x54, 0x98);
3309		RF_WRITE(mac, 0x5a, 0x88);
3310		RF_WRITE(mac, 0x5b, 0x6b);
3311		RF_WRITE(mac, 0x5c, 0xf);
3312		if (sc->sc_card_flags & BWI_CARD_F_ALT_IQ) {
3313			RF_WRITE(mac, 0x5d, 0xfa);
3314			RF_WRITE(mac, 0x5e, 0xd8);
3315		} else {
3316			RF_WRITE(mac, 0x5d, 0xf5);
3317			RF_WRITE(mac, 0x5e, 0xb8);
3318		}
3319		RF_WRITE(mac, 0x73, 0x3);
3320		RF_WRITE(mac, 0x7d, 0xa8);
3321		RF_WRITE(mac, 0x7c, 0x1);
3322		RF_WRITE(mac, 0x7e, 0x8);
3323	}
3324
3325	val = 0x1e1f;
3326	for (ofs = 0x88; ofs < 0x98; ++ofs) {
3327		PHY_WRITE(mac, ofs, val);
3328		val -= 0x202;
3329	}
3330
3331	val = 0x3e3f;
3332	for (ofs = 0x98; ofs < 0xa8; ++ofs) {
3333		PHY_WRITE(mac, ofs, val);
3334		val -= 0x202;
3335	}
3336
3337	val = 0x2120;
3338	for (ofs = 0xa8; ofs < 0xc8; ++ofs) {
3339		PHY_WRITE(mac, ofs, (val & 0x3f3f));
3340		val += 0x202;
3341	}
3342
3343	if (phy->phy_mode == IEEE80211_MODE_11G) {
3344		RF_SETBITS(mac, 0x7a, 0x20);
3345		RF_SETBITS(mac, 0x51, 0x4);
3346		PHY_SETBITS(mac, 0x802, 0x100);
3347		PHY_SETBITS(mac, 0x42b, 0x2000);
3348		PHY_WRITE(mac, 0x5b, 0);
3349		PHY_WRITE(mac, 0x5c, 0);
3350	}
3351
3352	/* Force to channel 7 */
3353	orig_chan = rf->rf_curchan;
3354	if (orig_chan >= 8)
3355		bwi_rf_set_chan(mac, 1, 0);
3356	else
3357		bwi_rf_set_chan(mac, 13, 0);
3358
3359	RF_WRITE(mac, 0x50, 0x20);
3360	RF_WRITE(mac, 0x50, 0x23);
3361
3362	DELAY(40);
3363
3364	if (rf->rf_rev < 6 || rf->rf_rev == 8) {
3365		RF_SETBITS(mac, 0x7c, 0x2);
3366		RF_WRITE(mac, 0x50, 0x20);
3367	}
3368	if (rf->rf_rev <= 2) {
3369		RF_WRITE(mac, 0x7c, 0x20);
3370		RF_WRITE(mac, 0x5a, 0x70);
3371		RF_WRITE(mac, 0x5b, 0x7b);
3372		RF_WRITE(mac, 0x5c, 0xb0);
3373	}
3374
3375	RF_FILT_SETBITS(mac, 0x7a, 0xf8, 0x7);
3376
3377	bwi_rf_set_chan(mac, orig_chan, 0);
3378
3379	PHY_WRITE(mac, 0x14, 0x200);
3380	if (rf->rf_rev >= 6)
3381		PHY_WRITE(mac, 0x2a, 0x88c2);
3382	else
3383		PHY_WRITE(mac, 0x2a, 0x8ac0);
3384	PHY_WRITE(mac, 0x38, 0x668);
3385
3386	bwi_mac_set_tpctl_11bg(mac, NULL);
3387
3388	if (rf->rf_rev <= 5) {
3389		PHY_FILT_SETBITS(mac, 0x5d, 0xff80, 0x3);
3390		if (rf->rf_rev <= 2)
3391			RF_WRITE(mac, 0x5d, 0xd);
3392	}
3393
3394	if (phy->phy_version == 4) {
3395		CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL2);
3396		PHY_CLRBITS(mac, 0x61, 0xf000);
3397	} else {
3398		PHY_FILT_SETBITS(mac, 0x2, 0xffc0, 0x4);
3399	}
3400
3401	if (phy->phy_mode == IEEE80211_MODE_11B) {
3402		CSR_WRITE_2(sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC2);
3403		PHY_WRITE(mac, 0x16, 0x410);
3404		PHY_WRITE(mac, 0x17, 0x820);
3405		PHY_WRITE(mac, 0x62, 0x7);
3406
3407		bwi_rf_init_bcm2050(mac);
3408		bwi_rf_lo_update(mac);
3409		if (sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
3410			bwi_rf_calc_nrssi_slope(mac);
3411			bwi_rf_set_nrssi_thr(mac);
3412		}
3413		bwi_mac_init_tpctl_11bg(mac);
3414	} else
3415		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
3416}
3417
3418#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
3419void
3420bwi_phy_config_11g(struct bwi_mac *mac)
3421{
3422	struct bwi_softc *sc = mac->mac_sc;
3423	struct bwi_phy *phy = &mac->mac_phy;
3424	const uint16_t *tbl;
3425	uint16_t wrd_ofs1, wrd_ofs2;
3426	int i, n;
3427
3428	if (phy->phy_rev == 1) {
3429		PHY_WRITE(mac, 0x406, 0x4f19);
3430		PHY_FILT_SETBITS(mac, 0x429, 0xfc3f, 0x340);
3431		PHY_WRITE(mac, 0x42c, 0x5a);
3432		PHY_WRITE(mac, 0x427, 0x1a);
3433
3434		/* Fill frequency table */
3435		for (i = 0; i < N(bwi_phy_freq_11g_rev1); ++i) {
3436			bwi_tbl_write_2(mac, BWI_PHYTBL_FREQ + i,
3437			    bwi_phy_freq_11g_rev1[i]);
3438		}
3439
3440		/* Fill noise table */
3441		for (i = 0; i < N(bwi_phy_noise_11g_rev1); ++i) {
3442			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
3443			    bwi_phy_noise_11g_rev1[i]);
3444		}
3445
3446		/* Fill rotor table */
3447		for (i = 0; i < N(bwi_phy_rotor_11g_rev1); ++i) {
3448			/* NB: data length is 4 bytes */
3449			bwi_tbl_write_4(mac, BWI_PHYTBL_ROTOR + i,
3450			    bwi_phy_rotor_11g_rev1[i]);
3451		}
3452	} else {
3453		bwi_nrssi_write(mac, 0xba98, (int16_t)0x7654); /* XXX */
3454
3455		if (phy->phy_rev == 2) {
3456			PHY_WRITE(mac, 0x4c0, 0x1861);
3457			PHY_WRITE(mac, 0x4c1, 0x271);
3458		} else if (phy->phy_rev > 2) {
3459			PHY_WRITE(mac, 0x4c0, 0x98);
3460			PHY_WRITE(mac, 0x4c1, 0x70);
3461			PHY_WRITE(mac, 0x4c9, 0x80);
3462		}
3463		PHY_SETBITS(mac, 0x42b, 0x800);
3464
3465		/* Fill RSSI table */
3466		for (i = 0; i < 64; ++i)
3467			bwi_tbl_write_2(mac, BWI_PHYTBL_RSSI + i, i);
3468
3469		/* Fill noise table */
3470		for (i = 0; i < sizeof(bwi_phy_noise_11g); ++i) {
3471			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
3472			    bwi_phy_noise_11g[i]);
3473		}
3474	}
3475
3476	/*
3477	 * Fill noise scale table
3478	 */
3479	if (phy->phy_rev <= 2) {
3480		tbl = bwi_phy_noise_scale_11g_rev2;
3481		n = N(bwi_phy_noise_scale_11g_rev2);
3482	} else if (phy->phy_rev >= 7 && (PHY_READ(mac, 0x449) & 0x200)) {
3483		tbl = bwi_phy_noise_scale_11g_rev7;
3484		n = N(bwi_phy_noise_scale_11g_rev7);
3485	} else {
3486		tbl = bwi_phy_noise_scale_11g;
3487		n = N(bwi_phy_noise_scale_11g);
3488	}
3489	for (i = 0; i < n; ++i)
3490		bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE_SCALE + i, tbl[i]);
3491
3492	/*
3493	 * Fill sigma square table
3494	 */
3495	if (phy->phy_rev == 2) {
3496		tbl = bwi_phy_sigma_sq_11g_rev2;
3497		n = N(bwi_phy_sigma_sq_11g_rev2);
3498	} else if (phy->phy_rev > 2 && phy->phy_rev <= 8) {
3499		tbl = bwi_phy_sigma_sq_11g_rev7;
3500		n = N(bwi_phy_sigma_sq_11g_rev7);
3501	} else {
3502		tbl = NULL;
3503		n = 0;
3504	}
3505	for (i = 0; i < n; ++i)
3506		bwi_tbl_write_2(mac, BWI_PHYTBL_SIGMA_SQ + i, tbl[i]);
3507
3508	if (phy->phy_rev == 1) {
3509		/* Fill delay table */
3510		for (i = 0; i < N(bwi_phy_delay_11g_rev1); ++i) {
3511			bwi_tbl_write_4(mac, BWI_PHYTBL_DELAY + i,
3512			    bwi_phy_delay_11g_rev1[i]);
3513		}
3514
3515		/* Fill WRSSI (Wide-Band RSSI) table */
3516		for (i = 4; i < 20; ++i)
3517			bwi_tbl_write_2(mac, BWI_PHYTBL_WRSSI_REV1 + i, 0x20);
3518
3519		bwi_phy_config_agc(mac);
3520
3521		wrd_ofs1 = 0x5001;
3522		wrd_ofs2 = 0x5002;
3523	} else {
3524		/* Fill WRSSI (Wide-Band RSSI) table */
3525		for (i = 0; i < 0x20; ++i)
3526			bwi_tbl_write_2(mac, BWI_PHYTBL_WRSSI + i, 0x820);
3527
3528		bwi_phy_config_agc(mac);
3529
3530		PHY_READ(mac, 0x400);	/* Dummy read */
3531		PHY_WRITE(mac, 0x403, 0x1000);
3532		bwi_tbl_write_2(mac, 0x3c02, 0xf);
3533		bwi_tbl_write_2(mac, 0x3c03, 0x14);
3534
3535		wrd_ofs1 = 0x401;
3536		wrd_ofs2 = 0x402;
3537	}
3538
3539	if (!(BWI_IS_BRCM_BU4306(sc) && sc->sc_pci_revid == 0x17)) {
3540		bwi_tbl_write_2(mac, wrd_ofs1, 0x2);
3541		bwi_tbl_write_2(mac, wrd_ofs2, 0x1);
3542	}
3543
3544	/* phy->phy_flags & BWI_PHY_F_LINKED ? */
3545	if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
3546		PHY_WRITE(mac, 0x46e, 0x3cf);
3547}
3548#undef N
3549
3550/*
3551 * Configure Automatic Gain Controller
3552 */
3553void
3554bwi_phy_config_agc(struct bwi_mac *mac)
3555{
3556	struct bwi_phy *phy = &mac->mac_phy;
3557	uint16_t ofs;
3558
3559	ofs = phy->phy_rev == 1 ? 0x4c00 : 0;
3560
3561	bwi_tbl_write_2(mac, ofs, 0xfe);
3562	bwi_tbl_write_2(mac, ofs + 1, 0xd);
3563	bwi_tbl_write_2(mac, ofs + 2, 0x13);
3564	bwi_tbl_write_2(mac, ofs + 3, 0x19);
3565
3566	if (phy->phy_rev == 1) {
3567		bwi_tbl_write_2(mac, 0x1800, 0x2710);
3568		bwi_tbl_write_2(mac, 0x1801, 0x9b83);
3569		bwi_tbl_write_2(mac, 0x1802, 0x9b83);
3570		bwi_tbl_write_2(mac, 0x1803, 0xf8d);
3571		PHY_WRITE(mac, 0x455, 0x4);
3572	}
3573
3574	PHY_FILT_SETBITS(mac, 0x4a5, 0xff, 0x5700);
3575	PHY_FILT_SETBITS(mac, 0x41a, 0xff80, 0xf);
3576	PHY_FILT_SETBITS(mac, 0x41a, 0xc07f, 0x2b80);
3577	PHY_FILT_SETBITS(mac, 0x48c, 0xf0ff, 0x300);
3578
3579	RF_SETBITS(mac, 0x7a, 0x8);
3580
3581	PHY_FILT_SETBITS(mac, 0x4a0, 0xfff0, 0x8);
3582	PHY_FILT_SETBITS(mac, 0x4a1, 0xf0ff, 0x600);
3583	PHY_FILT_SETBITS(mac, 0x4a2, 0xf0ff, 0x700);
3584	PHY_FILT_SETBITS(mac, 0x4a0, 0xf0ff, 0x100);
3585
3586	if (phy->phy_rev == 1)
3587		PHY_FILT_SETBITS(mac, 0x4a2, 0xfff0, 0x7);
3588
3589	PHY_FILT_SETBITS(mac, 0x488, 0xff00, 0x1c);
3590	PHY_FILT_SETBITS(mac, 0x488, 0xc0ff, 0x200);
3591	PHY_FILT_SETBITS(mac, 0x496, 0xff00, 0x1c);
3592	PHY_FILT_SETBITS(mac, 0x489, 0xff00, 0x20);
3593	PHY_FILT_SETBITS(mac, 0x489, 0xc0ff, 0x200);
3594	PHY_FILT_SETBITS(mac, 0x482, 0xff00, 0x2e);
3595	PHY_FILT_SETBITS(mac, 0x496, 0xff, 0x1a00);
3596	PHY_FILT_SETBITS(mac, 0x481, 0xff00, 0x28);
3597	PHY_FILT_SETBITS(mac, 0x481, 0xff, 0x2c00);
3598
3599	if (phy->phy_rev == 1) {
3600		PHY_WRITE(mac, 0x430, 0x92b);
3601		PHY_FILT_SETBITS(mac, 0x41b, 0xffe1, 0x2);
3602	} else {
3603		PHY_CLRBITS(mac, 0x41b, 0x1e);
3604		PHY_WRITE(mac, 0x41f, 0x287a);
3605		PHY_FILT_SETBITS(mac, 0x420, 0xfff0, 0x4);
3606
3607		if (phy->phy_rev >= 6) {
3608			PHY_WRITE(mac, 0x422, 0x287a);
3609			PHY_FILT_SETBITS(mac, 0x420, 0xfff, 0x3000);
3610		}
3611	}
3612
3613	PHY_FILT_SETBITS(mac, 0x4a8, 0x8080, 0x7874);
3614	PHY_WRITE(mac, 0x48e, 0x1c00);
3615
3616	if (phy->phy_rev == 1) {
3617		PHY_FILT_SETBITS(mac, 0x4ab, 0xf0ff, 0x600);
3618		PHY_WRITE(mac, 0x48b, 0x5e);
3619		PHY_FILT_SETBITS(mac, 0x48c, 0xff00, 0x1e);
3620		PHY_WRITE(mac, 0x48d, 0x2);
3621	}
3622
3623	bwi_tbl_write_2(mac, ofs + 0x800, 0);
3624	bwi_tbl_write_2(mac, ofs + 0x801, 7);
3625	bwi_tbl_write_2(mac, ofs + 0x802, 16);
3626	bwi_tbl_write_2(mac, ofs + 0x803, 28);
3627
3628	if (phy->phy_rev >= 6) {
3629		PHY_CLRBITS(mac, 0x426, 0x3);
3630		PHY_CLRBITS(mac, 0x426, 0x1000);
3631	}
3632}
3633
3634void
3635bwi_set_gains(struct bwi_mac *mac, const struct bwi_gains *gains)
3636{
3637	struct bwi_phy *phy = &mac->mac_phy;
3638	uint16_t tbl_gain_ofs1, tbl_gain_ofs2, tbl_gain;
3639	int i;
3640
3641	if (phy->phy_rev <= 1) {
3642		tbl_gain_ofs1 = 0x5000;
3643		tbl_gain_ofs2 = tbl_gain_ofs1 + 16;
3644	} else {
3645		tbl_gain_ofs1 = 0x400;
3646		tbl_gain_ofs2 = tbl_gain_ofs1 + 8;
3647	}
3648
3649	for (i = 0; i < 4; ++i) {
3650		if (gains != NULL) {
3651			tbl_gain = gains->tbl_gain1;
3652		} else {
3653			/* Bit swap */
3654			tbl_gain = (i & 0x1) << 1;
3655			tbl_gain |= (i & 0x2) >> 1;
3656		}
3657		bwi_tbl_write_2(mac, tbl_gain_ofs1 + i, tbl_gain);
3658	}
3659
3660	for (i = 0; i < 16; ++i) {
3661		if (gains != NULL)
3662			tbl_gain = gains->tbl_gain2;
3663		else
3664			tbl_gain = i;
3665		bwi_tbl_write_2(mac, tbl_gain_ofs2 + i, tbl_gain);
3666	}
3667
3668	if (gains == NULL || (gains != NULL && gains->phy_gain != -1)) {
3669		uint16_t phy_gain1, phy_gain2;
3670
3671		if (gains != NULL) {
3672			phy_gain1 =
3673			((uint16_t)gains->phy_gain << 14) |
3674			((uint16_t)gains->phy_gain << 6);
3675			phy_gain2 = phy_gain1;
3676		} else {
3677			phy_gain1 = 0x4040;
3678			phy_gain2 = 0x4000;
3679		}
3680		PHY_FILT_SETBITS(mac, 0x4a0, 0xbfbf, phy_gain1);
3681		PHY_FILT_SETBITS(mac, 0x4a1, 0xbfbf, phy_gain1);
3682		PHY_FILT_SETBITS(mac, 0x4a2, 0xbfbf, phy_gain2);
3683	}
3684	bwi_mac_dummy_xmit(mac);
3685}
3686
3687void
3688bwi_phy_clear_state(struct bwi_phy *phy)
3689{
3690	phy->phy_flags &= ~BWI_CLEAR_PHY_FLAGS;
3691}
3692
3693/* RF */
3694
3695int16_t
3696bwi_nrssi_11g(struct bwi_mac *mac)
3697{
3698	int16_t val;
3699
3700#define NRSSI_11G_MASK		0x3f00
3701	val = (int16_t)__SHIFTOUT(PHY_READ(mac, 0x47f), NRSSI_11G_MASK);
3702	if (val >= 32)
3703		val -= 64;
3704
3705	return (val);
3706#undef NRSSI_11G_MASK
3707}
3708
3709struct bwi_rf_lo *
3710bwi_get_rf_lo(struct bwi_mac *mac, uint16_t rf_atten, uint16_t bbp_atten)
3711{
3712	int n;
3713
3714	n = rf_atten + (14 * (bbp_atten / 2));
3715	KASSERT(n < BWI_RFLO_MAX);
3716
3717	return (&mac->mac_rf.rf_lo[n]);
3718}
3719
3720int
3721bwi_rf_lo_isused(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
3722{
3723	struct bwi_rf *rf = &mac->mac_rf;
3724	int idx;
3725
3726	idx = lo - rf->rf_lo;
3727	KASSERT(idx >= 0 && idx < BWI_RFLO_MAX);
3728
3729	return (isset(rf->rf_lo_used, idx));
3730}
3731
3732void
3733bwi_rf_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
3734{
3735	struct bwi_softc *sc = mac->mac_sc;
3736
3737	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
3738	CSR_WRITE_2(sc, BWI_RF_DATA_LO, data);
3739}
3740
3741uint16_t
3742bwi_rf_read(struct bwi_mac *mac, uint16_t ctrl)
3743{
3744	struct bwi_rf *rf = &mac->mac_rf;
3745	struct bwi_softc *sc = mac->mac_sc;
3746
3747	ctrl |= rf->rf_ctrl_rd;
3748	if (rf->rf_ctrl_adj) {
3749		/* XXX */
3750		if (ctrl < 0x70)
3751			ctrl += 0x80;
3752		else if (ctrl < 0x80)
3753			ctrl += 0x70;
3754	}
3755
3756	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
3757	return (CSR_READ_2(sc, BWI_RF_DATA_LO));
3758}
3759
3760int
3761bwi_rf_attach(struct bwi_mac *mac)
3762{
3763	struct bwi_softc *sc = mac->mac_sc;
3764	struct bwi_phy *phy = &mac->mac_phy;
3765	struct bwi_rf *rf = &mac->mac_rf;
3766	uint16_t type, manu;
3767	uint8_t rev;
3768
3769	/*
3770	 * Get RF manufacture/type/revision
3771	 */
3772	if (sc->sc_bbp_id == BWI_BBPID_BCM4317) {
3773		/*
3774		 * Fake a BCM2050 RF
3775		 */
3776		manu = BWI_RF_MANUFACT_BCM;
3777		type = BWI_RF_T_BCM2050;
3778		if (sc->sc_bbp_rev == 0)
3779			rev = 3;
3780		else if (sc->sc_bbp_rev == 1)
3781			rev = 4;
3782		else
3783			rev = 5;
3784	} else {
3785		uint32_t val;
3786
3787		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
3788		val = CSR_READ_2(sc, BWI_RF_DATA_HI);
3789		val <<= 16;
3790
3791		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
3792		val |= CSR_READ_2(sc, BWI_RF_DATA_LO);
3793
3794		manu = __SHIFTOUT(val, BWI_RFINFO_MANUFACT_MASK);
3795		type = __SHIFTOUT(val, BWI_RFINFO_TYPE_MASK);
3796		rev = __SHIFTOUT(val, BWI_RFINFO_REV_MASK);
3797	}
3798	DPRINTF(1, "%s: RF manu 0x%03x, type 0x%04x, rev %u\n",
3799	    sc->sc_dev.dv_xname, manu, type, rev);
3800
3801	/*
3802	 * Verify whether the RF is supported
3803	 */
3804	rf->rf_ctrl_rd = 0;
3805	rf->rf_ctrl_adj = 0;
3806	switch (phy->phy_mode) {
3807	case IEEE80211_MODE_11A:
3808		if (manu != BWI_RF_MANUFACT_BCM ||
3809		    type != BWI_RF_T_BCM2060 ||
3810		    rev != 1) {
3811			printf("%s: only BCM2060 rev 1 RF is supported for "
3812			    "11A PHY\n", sc->sc_dev.dv_xname);
3813			return (ENXIO);
3814		}
3815		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11A;
3816		rf->rf_on = bwi_rf_on_11a;
3817		rf->rf_off = bwi_rf_off_11a;
3818		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2060;
3819		break;
3820	case IEEE80211_MODE_11B:
3821		if (type == BWI_RF_T_BCM2050) {
3822			rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
3823			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
3824		} else if (type == BWI_RF_T_BCM2053) {
3825			rf->rf_ctrl_adj = 1;
3826			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2053;
3827		} else {
3828			printf("%s: only BCM2050/BCM2053 RF is supported "
3829			    "for supported for 11B PHY\n", sc->sc_dev.dv_xname);
3830			return (ENXIO);
3831		}
3832		rf->rf_on = bwi_rf_on_11bg;
3833		rf->rf_off = bwi_rf_off_11bg;
3834		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11b;
3835		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11b;
3836		if (phy->phy_rev == 6)
3837			rf->rf_lo_update = bwi_rf_lo_update_11g;
3838		else
3839			rf->rf_lo_update = bwi_rf_lo_update_11b;
3840		break;
3841	case IEEE80211_MODE_11G:
3842		if (type != BWI_RF_T_BCM2050) {
3843			printf("%s: only BCM2050 RF is supported for 11G "
3844			    "PHY\n", sc->sc_dev.dv_xname);
3845			return (ENXIO);
3846		}
3847		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
3848		rf->rf_on = bwi_rf_on_11bg;
3849		if (mac->mac_rev >= 5)
3850			rf->rf_off = bwi_rf_off_11g_rev5;
3851		else
3852			rf->rf_off = bwi_rf_off_11bg;
3853		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11g;
3854		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11g;
3855		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
3856		rf->rf_lo_update = bwi_rf_lo_update_11g;
3857		break;
3858	default:
3859		printf("%s: unsupported PHY mode\n", sc->sc_dev.dv_xname);
3860		return (ENXIO);
3861	}
3862
3863	rf->rf_type = type;
3864	rf->rf_rev = rev;
3865	rf->rf_manu = manu;
3866	rf->rf_curchan = IEEE80211_CHAN_ANY;
3867	rf->rf_ant_mode = BWI_ANT_MODE_AUTO;
3868
3869	return (0);
3870}
3871
3872void
3873bwi_rf_set_chan(struct bwi_mac *mac, uint chan, int work_around)
3874{
3875	struct bwi_softc *sc = mac->mac_sc;
3876
3877	if (chan == IEEE80211_CHAN_ANY)
3878		return;
3879
3880	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_CHAN, chan);
3881
3882	/* TODO: 11A */
3883
3884	if (work_around)
3885		bwi_rf_workaround(mac, chan);
3886
3887	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
3888
3889	if (chan == 14) {
3890		if (sc->sc_locale == BWI_SPROM_LOCALE_JAPAN)
3891			HFLAGS_CLRBITS(mac, BWI_HFLAG_NOT_JAPAN);
3892		else
3893			HFLAGS_SETBITS(mac, BWI_HFLAG_NOT_JAPAN);
3894		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, (1 << 11)); /* XXX */
3895	} else {
3896		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0x840); /* XXX */
3897	}
3898	DELAY(8000);	/* DELAY(2000); */
3899
3900	mac->mac_rf.rf_curchan = chan;
3901}
3902
3903void
3904bwi_rf_get_gains(struct bwi_mac *mac)
3905{
3906#define SAVE_PHY_MAX	15
3907#define SAVE_RF_MAX	3
3908	struct bwi_softc *sc;
3909	struct bwi_phy *phy = &mac->mac_phy;
3910	struct bwi_rf *rf = &mac->mac_rf;
3911	uint16_t save_phy[SAVE_PHY_MAX];
3912	uint16_t save_rf[SAVE_RF_MAX];
3913	uint16_t trsw;
3914	int i, j, loop1_max, loop1, loop2;
3915
3916	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
3917	    { 0x52, 0x43, 0x7a };
3918	static const uint16_t save_phy_regs[SAVE_PHY_MAX] = {
3919	    0x0429, 0x0001, 0x0811, 0x0812,
3920	    0x0814, 0x0815, 0x005a, 0x0059,
3921	    0x0058, 0x000a, 0x0003, 0x080f,
3922	    0x0810, 0x002b, 0x0015
3923	};
3924
3925	sc = mac->mac_sc;
3926
3927	/*
3928	 * Save PHY/RF registers for later restoration
3929	 */
3930	for (i = 0; i < SAVE_PHY_MAX; ++i)
3931		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
3932	PHY_READ(mac, 0x2d); /* dummy read */
3933
3934	for (i = 0; i < SAVE_RF_MAX; ++i)
3935		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
3936
3937	PHY_CLRBITS(mac, 0x429, 0xc000);
3938	PHY_SETBITS(mac, 0x1, 0x8000);
3939
3940	PHY_SETBITS(mac, 0x811, 0x2);
3941	PHY_CLRBITS(mac, 0x812, 0x2);
3942	PHY_SETBITS(mac, 0x811, 0x1);
3943	PHY_CLRBITS(mac, 0x812, 0x1);
3944
3945	PHY_SETBITS(mac, 0x814, 0x1);
3946	PHY_CLRBITS(mac, 0x815, 0x1);
3947	PHY_SETBITS(mac, 0x814, 0x2);
3948	PHY_CLRBITS(mac, 0x815, 0x2);
3949
3950	PHY_SETBITS(mac, 0x811, 0xc);
3951	PHY_SETBITS(mac, 0x812, 0xc);
3952	PHY_SETBITS(mac, 0x811, 0x30);
3953	PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
3954
3955	PHY_WRITE(mac, 0x5a, 0x780);
3956	PHY_WRITE(mac, 0x59, 0xc810);
3957	PHY_WRITE(mac, 0x58, 0xd);
3958	PHY_SETBITS(mac, 0xa, 0x2000);
3959
3960	PHY_SETBITS(mac, 0x814, 0x4);
3961	PHY_CLRBITS(mac, 0x815, 0x4);
3962
3963	PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
3964
3965	if (rf->rf_rev == 8) {
3966		loop1_max = 15;
3967		RF_WRITE(mac, 0x43, loop1_max);
3968	} else {
3969		loop1_max = 9;
3970	    	RF_WRITE(mac, 0x52, 0x0);
3971		RF_FILT_SETBITS(mac, 0x43, 0xfff0, loop1_max);
3972	}
3973
3974	bwi_phy_set_bbp_atten(mac, 11);
3975
3976	if (phy->phy_rev >= 3)
3977		PHY_WRITE(mac, 0x80f, 0xc020);
3978	else
3979		PHY_WRITE(mac, 0x80f, 0x8020);
3980	PHY_WRITE(mac, 0x810, 0);
3981
3982	PHY_FILT_SETBITS(mac, 0x2b, 0xffc0, 0x1);
3983	PHY_FILT_SETBITS(mac, 0x2b, 0xc0ff, 0x800);
3984	PHY_SETBITS(mac, 0x811, 0x100);
3985	PHY_CLRBITS(mac, 0x812, 0x3000);
3986
3987	if ((mac->mac_sc->sc_card_flags & BWI_CARD_F_EXT_LNA) &&
3988	    phy->phy_rev >= 7) {
3989		PHY_SETBITS(mac, 0x811, 0x800);
3990		PHY_SETBITS(mac, 0x812, 0x8000);
3991	}
3992	RF_CLRBITS(mac, 0x7a, 0xff08);
3993
3994	/*
3995	 * Find out 'loop1/loop2', which will be used to calculate
3996	 * max loopback gain later
3997	 */
3998	j = 0;
3999	for (i = 0; i < loop1_max; ++i) {
4000		for (j = 0; j < 16; ++j) {
4001			RF_WRITE(mac, 0x43, i);
4002
4003			if (bwi_rf_gain_max_reached(mac, j))
4004				goto loop1_exit;
4005		}
4006	}
4007loop1_exit:
4008	loop1 = i;
4009	loop2 = j;
4010
4011	/*
4012	 * Find out 'trsw', which will be used to calculate
4013	 * TRSW(TX/RX switch) RX gain later
4014	 */
4015	if (loop2 >= 8) {
4016		PHY_SETBITS(mac, 0x812, 0x30);
4017		trsw = 0x1b;
4018		for (i = loop2 - 8; i < 16; ++i) {
4019			trsw -= 3;
4020			if (bwi_rf_gain_max_reached(mac, i))
4021				break;
4022		}
4023	} else {
4024		trsw = 0x18;
4025	}
4026
4027	/*
4028	 * Restore saved PHY/RF registers
4029	 */
4030	/* First 4 saved PHY registers need special processing */
4031	for (i = 4; i < SAVE_PHY_MAX; ++i)
4032		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
4033
4034	bwi_phy_set_bbp_atten(mac, mac->mac_tpctl.bbp_atten);
4035
4036	for (i = 0; i < SAVE_RF_MAX; ++i)
4037		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
4038
4039	PHY_WRITE(mac, save_phy_regs[2], save_phy[2] | 0x3);
4040	DELAY(10);
4041	PHY_WRITE(mac, save_phy_regs[2], save_phy[2]);
4042	PHY_WRITE(mac, save_phy_regs[3], save_phy[3]);
4043	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
4044	PHY_WRITE(mac, save_phy_regs[1], save_phy[1]);
4045
4046	/*
4047	 * Calculate gains
4048	 */
4049	rf->rf_lo_gain = (loop2 * 6) - (loop1 * 4) - 11;
4050	rf->rf_rx_gain = trsw * 2;
4051	DPRINTF(1, "%s: lo gain: %u, rx gain: %u\n",
4052	    sc->sc_dev.dv_xname, rf->rf_lo_gain, rf->rf_rx_gain);
4053
4054#undef SAVE_RF_MAX
4055#undef SAVE_PHY_MAX
4056}
4057
4058void
4059bwi_rf_init(struct bwi_mac *mac)
4060{
4061	struct bwi_rf *rf = &mac->mac_rf;
4062
4063	if (rf->rf_type == BWI_RF_T_BCM2060) {
4064		/* TODO: 11A */
4065	} else {
4066		if (rf->rf_flags & BWI_RF_F_INITED)
4067			RF_WRITE(mac, 0x78, rf->rf_calib);
4068		else
4069			bwi_rf_init_bcm2050(mac);
4070	}
4071}
4072
4073void
4074bwi_rf_off_11a(struct bwi_mac *mac)
4075{
4076	RF_WRITE(mac, 0x4, 0xff);
4077	RF_WRITE(mac, 0x5, 0xfb);
4078
4079	PHY_SETBITS(mac, 0x10, 0x8);
4080	PHY_SETBITS(mac, 0x11, 0x8);
4081
4082	PHY_WRITE(mac, 0x15, 0xaa00);
4083}
4084
4085void
4086bwi_rf_off_11bg(struct bwi_mac *mac)
4087{
4088	PHY_WRITE(mac, 0x15, 0xaa00);
4089}
4090
4091void
4092bwi_rf_off_11g_rev5(struct bwi_mac *mac)
4093{
4094	PHY_SETBITS(mac, 0x811, 0x8c);
4095	PHY_CLRBITS(mac, 0x812, 0x8c);
4096}
4097
4098void
4099bwi_rf_workaround(struct bwi_mac *mac, uint chan)
4100{
4101	struct bwi_softc *sc = mac->mac_sc;
4102	struct bwi_rf *rf = &mac->mac_rf;
4103
4104	if (chan == IEEE80211_CHAN_ANY) {
4105		printf("%s: %s invalid channel!\n",
4106		    sc->sc_dev.dv_xname, __func__);
4107		return;
4108	}
4109
4110	if (rf->rf_type != BWI_RF_T_BCM2050 || rf->rf_rev >= 6)
4111		return;
4112
4113	if (chan <= 10)
4114		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan + 4));
4115	else
4116		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(1));
4117	DELAY(1000);
4118	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
4119}
4120
4121struct bwi_rf_lo *
4122bwi_rf_lo_find(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
4123{
4124	uint16_t rf_atten, bbp_atten;
4125	int remap_rf_atten;
4126
4127	remap_rf_atten = 1;
4128	if (tpctl == NULL) {
4129		bbp_atten = 2;
4130		rf_atten = 3;
4131	} else {
4132		if (tpctl->tp_ctrl1 == 3)
4133			remap_rf_atten = 0;
4134
4135		bbp_atten = tpctl->bbp_atten;
4136		rf_atten = tpctl->rf_atten;
4137
4138		if (bbp_atten > 6)
4139			bbp_atten = 6;
4140	}
4141
4142	if (remap_rf_atten) {
4143#define MAP_MAX	10
4144		static const uint16_t map[MAP_MAX] =
4145		{ 11, 10, 11, 12, 13, 12, 13, 12, 13, 12 };
4146#if 0
4147		KASSERT(rf_atten < MAP_MAX);
4148		rf_atten = map[rf_atten];
4149#else
4150		if (rf_atten >= MAP_MAX) {
4151			rf_atten = 0;	/* XXX */
4152		} else {
4153			rf_atten = map[rf_atten];
4154		}
4155#endif
4156#undef MAP_MAX
4157	}
4158
4159	return (bwi_get_rf_lo(mac, rf_atten, bbp_atten));
4160}
4161
4162void
4163bwi_rf_lo_adjust(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
4164{
4165	const struct bwi_rf_lo *lo;
4166
4167	lo = bwi_rf_lo_find(mac, tpctl);
4168	RF_LO_WRITE(mac, lo);
4169}
4170
4171void
4172bwi_rf_lo_write(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
4173{
4174	uint16_t val;
4175
4176	val = (uint8_t)lo->ctrl_lo;
4177	val |= ((uint8_t)lo->ctrl_hi) << 8;
4178
4179	PHY_WRITE(mac, BWI_PHYR_RF_LO, val);
4180}
4181
4182int
4183bwi_rf_gain_max_reached(struct bwi_mac *mac, int idx)
4184{
4185	PHY_FILT_SETBITS(mac, 0x812, 0xf0ff, idx << 8);
4186	PHY_FILT_SETBITS(mac, 0x15, 0xfff, 0xa000);
4187	PHY_SETBITS(mac, 0x15, 0xf000);
4188
4189	DELAY(20);
4190
4191	return ((PHY_READ(mac, 0x2d) >= 0xdfc));
4192}
4193
4194/* XXX use bitmap array */
4195uint16_t
4196bwi_bitswap4(uint16_t val)
4197{
4198	uint16_t ret;
4199
4200	ret = (val & 0x8) >> 3;
4201	ret |= (val & 0x4) >> 1;
4202	ret |= (val & 0x2) << 1;
4203	ret |= (val & 0x1) << 3;
4204
4205	return (ret);
4206}
4207
4208uint16_t
4209bwi_phy812_value(struct bwi_mac *mac, uint16_t lpd)
4210{
4211	struct bwi_softc *sc = mac->mac_sc;
4212	struct bwi_phy *phy = &mac->mac_phy;
4213	struct bwi_rf *rf = &mac->mac_rf;
4214	uint16_t lo_gain, ext_lna, loop;
4215
4216	if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
4217		return (0);
4218
4219	lo_gain = rf->rf_lo_gain;
4220	if (rf->rf_rev == 8)
4221		lo_gain += 0x3e;
4222	else
4223		lo_gain += 0x26;
4224
4225	if (lo_gain >= 0x46) {
4226		lo_gain -= 0x46;
4227		ext_lna = 0x3000;
4228	} else if (lo_gain >= 0x3a) {
4229		lo_gain -= 0x3a;
4230		ext_lna = 0x1000;
4231	} else if (lo_gain >= 0x2e) {
4232		lo_gain -= 0x2e;
4233		ext_lna = 0x2000;
4234	} else {
4235		lo_gain -= 0x10;
4236		ext_lna = 0;
4237	}
4238
4239	for (loop = 0; loop < 16; ++loop) {
4240		lo_gain -= (6 * loop);
4241		if (lo_gain < 6)
4242			break;
4243	}
4244
4245	if (phy->phy_rev >= 7 && (sc->sc_card_flags & BWI_CARD_F_EXT_LNA)) {
4246		if (ext_lna)
4247			ext_lna |= 0x8000;
4248		ext_lna |= (loop << 8);
4249		switch (lpd) {
4250		case 0x011:
4251			return (0x8f92);
4252		case 0x001:
4253			return ((0x8092 | ext_lna));
4254		case 0x101:
4255			return ((0x2092 | ext_lna));
4256		case 0x100:
4257			return ((0x2093 | ext_lna));
4258		default:
4259			panic("unsupported lpd\n");
4260		}
4261	} else {
4262		ext_lna |= (loop << 8);
4263		switch (lpd) {
4264		case 0x011:
4265			return (0xf92);
4266		case 0x001:
4267		case 0x101:
4268			return ((0x92 | ext_lna));
4269		case 0x100:
4270			return ((0x93 | ext_lna));
4271		default:
4272			panic("unsupported lpd\n");
4273		}
4274	}
4275
4276	panic("never reached\n");
4277
4278	return (0);
4279}
4280
4281void
4282bwi_rf_init_bcm2050(struct bwi_mac *mac)
4283{
4284#define SAVE_RF_MAX		3
4285#define SAVE_PHY_COMM_MAX	4
4286#define SAVE_PHY_11G_MAX	6
4287	uint16_t save_rf[SAVE_RF_MAX];
4288	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
4289	uint16_t save_phy_11g[SAVE_PHY_11G_MAX];
4290	uint16_t phyr_35, phyr_30 = 0, rfr_78, phyr_80f = 0, phyr_810 = 0;
4291	uint16_t bphy_ctrl = 0, bbp_atten, rf_chan_ex;
4292	uint16_t phy812_val;
4293	uint16_t calib;
4294	uint32_t test_lim, test;
4295	struct bwi_softc *sc = mac->mac_sc;
4296	struct bwi_phy *phy = &mac->mac_phy;
4297	struct bwi_rf *rf = &mac->mac_rf;
4298	int i;
4299
4300	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
4301	    { 0x0043, 0x0051, 0x0052 };
4302	static const uint16_t save_phy_regs_comm[SAVE_PHY_COMM_MAX] =
4303	    { 0x0015, 0x005a, 0x0059, 0x0058 };
4304	static const uint16_t save_phy_regs_11g[SAVE_PHY_11G_MAX] =
4305	    { 0x0811, 0x0812, 0x0814, 0x0815, 0x0429, 0x0802 };
4306
4307	/*
4308	 * Save registers for later restoring
4309	 */
4310	for (i = 0; i < SAVE_RF_MAX; ++i)
4311		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
4312	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
4313		save_phy_comm[i] = PHY_READ(mac, save_phy_regs_comm[i]);
4314
4315	if (phy->phy_mode == IEEE80211_MODE_11B) {
4316		phyr_30 = PHY_READ(mac, 0x30);
4317		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
4318
4319		PHY_WRITE(mac, 0x30, 0xff);
4320		CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x3f3f);
4321	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4322		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
4323			save_phy_11g[i] =
4324			    PHY_READ(mac, save_phy_regs_11g[i]);
4325		}
4326
4327		PHY_SETBITS(mac, 0x814, 0x3);
4328		PHY_CLRBITS(mac, 0x815, 0x3);
4329		PHY_CLRBITS(mac, 0x429, 0x8000);
4330		PHY_CLRBITS(mac, 0x802, 0x3);
4331
4332		phyr_80f = PHY_READ(mac, 0x80f);
4333		phyr_810 = PHY_READ(mac, 0x810);
4334
4335		if (phy->phy_rev >= 3)
4336			PHY_WRITE(mac, 0x80f, 0xc020);
4337		else
4338			PHY_WRITE(mac, 0x80f, 0x8020);
4339		PHY_WRITE(mac, 0x810, 0);
4340
4341		phy812_val = bwi_phy812_value(mac, 0x011);
4342		PHY_WRITE(mac, 0x812, phy812_val);
4343		if (phy->phy_rev < 7 ||
4344		    (sc->sc_card_flags & BWI_CARD_F_EXT_LNA) == 0)
4345			PHY_WRITE(mac, 0x811, 0x1b3);
4346		else
4347			PHY_WRITE(mac, 0x811, 0x9b3);
4348	}
4349	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
4350
4351	phyr_35 = PHY_READ(mac, 0x35);
4352	PHY_CLRBITS(mac, 0x35, 0x80);
4353
4354	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
4355	rf_chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
4356
4357	if (phy->phy_version == 0) {
4358		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
4359	} else {
4360		if (phy->phy_version >= 2)
4361			PHY_FILT_SETBITS(mac, 0x3, 0xffbf, 0x40);
4362		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
4363	}
4364
4365	calib = bwi_rf_calibval(mac);
4366
4367	if (phy->phy_mode == IEEE80211_MODE_11B)
4368		RF_WRITE(mac, 0x78, 0x26);
4369
4370	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4371		phy812_val = bwi_phy812_value(mac, 0x011);
4372		PHY_WRITE(mac, 0x812, phy812_val);
4373	}
4374
4375	PHY_WRITE(mac, 0x15, 0xbfaf);
4376	PHY_WRITE(mac, 0x2b, 0x1403);
4377
4378	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4379		phy812_val = bwi_phy812_value(mac, 0x001);
4380		PHY_WRITE(mac, 0x812, phy812_val);
4381	}
4382
4383	PHY_WRITE(mac, 0x15, 0xbfa0);
4384
4385	RF_SETBITS(mac, 0x51, 0x4);
4386	if (rf->rf_rev == 8)
4387		RF_WRITE(mac, 0x43, 0x1f);
4388	else {
4389		RF_WRITE(mac, 0x52, 0);
4390		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
4391	}
4392
4393	test_lim = 0;
4394	PHY_WRITE(mac, 0x58, 0);
4395	for (i = 0; i < 16; ++i) {
4396		PHY_WRITE(mac, 0x5a, 0x480);
4397		PHY_WRITE(mac, 0x59, 0xc810);
4398
4399		PHY_WRITE(mac, 0x58, 0xd);
4400		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4401			phy812_val = bwi_phy812_value(mac, 0x101);
4402			PHY_WRITE(mac, 0x812, phy812_val);
4403		}
4404		PHY_WRITE(mac, 0x15, 0xafb0);
4405		DELAY(10);
4406
4407		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4408			phy812_val = bwi_phy812_value(mac, 0x101);
4409			PHY_WRITE(mac, 0x812, phy812_val);
4410		}
4411		PHY_WRITE(mac, 0x15, 0xefb0);
4412		DELAY(10);
4413
4414		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4415			phy812_val = bwi_phy812_value(mac, 0x100);
4416			PHY_WRITE(mac, 0x812, phy812_val);
4417		}
4418		PHY_WRITE(mac, 0x15, 0xfff0);
4419		DELAY(20);
4420
4421		test_lim += PHY_READ(mac, 0x2d);
4422
4423		PHY_WRITE(mac, 0x58, 0);
4424		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4425			phy812_val = bwi_phy812_value(mac, 0x101);
4426			PHY_WRITE(mac, 0x812, phy812_val);
4427		}
4428		PHY_WRITE(mac, 0x15, 0xafb0);
4429	}
4430	++test_lim;
4431	test_lim >>= 9;
4432
4433	DELAY(10);
4434
4435	test = 0;
4436	PHY_WRITE(mac, 0x58, 0);
4437	for (i = 0; i < 16; ++i) {
4438		int j;
4439
4440		rfr_78 = (bwi_bitswap4(i) << 1) | 0x20;
4441		RF_WRITE(mac, 0x78, rfr_78);
4442		DELAY(10);
4443
4444		/* NB: This block is slight different than the above one */
4445		for (j = 0; j < 16; ++j) {
4446			PHY_WRITE(mac, 0x5a, 0xd80);
4447			PHY_WRITE(mac, 0x59, 0xc810);
4448
4449			PHY_WRITE(mac, 0x58, 0xd);
4450			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4451			    phy->phy_rev >= 2) {
4452				phy812_val = bwi_phy812_value(mac, 0x101);
4453				PHY_WRITE(mac, 0x812, phy812_val);
4454			}
4455			PHY_WRITE(mac, 0x15, 0xafb0);
4456			DELAY(10);
4457
4458			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4459			    phy->phy_rev >= 2) {
4460				phy812_val = bwi_phy812_value(mac, 0x101);
4461				PHY_WRITE(mac, 0x812, phy812_val);
4462			}
4463			PHY_WRITE(mac, 0x15, 0xefb0);
4464			DELAY(10);
4465
4466			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4467			    phy->phy_rev >= 2) {
4468				phy812_val = bwi_phy812_value(mac, 0x100);
4469				PHY_WRITE(mac, 0x812, phy812_val);
4470			}
4471			PHY_WRITE(mac, 0x15, 0xfff0);
4472			DELAY(10);
4473
4474			test += PHY_READ(mac, 0x2d);
4475
4476			PHY_WRITE(mac, 0x58, 0);
4477			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4478			    phy->phy_rev >= 2) {
4479				phy812_val = bwi_phy812_value(mac, 0x101);
4480				PHY_WRITE(mac, 0x812, phy812_val);
4481			}
4482			PHY_WRITE(mac, 0x15, 0xafb0);
4483		}
4484
4485		++test;
4486		test >>= 8;
4487
4488		if (test > test_lim)
4489			break;
4490	}
4491	if (i > 15)
4492		rf->rf_calib = rfr_78;
4493	else
4494		rf->rf_calib = calib;
4495	if (rf->rf_calib != 0xffff) {
4496		DPRINTF(1, "%s: RF calibration value: 0x%04x\n",
4497		    sc->sc_dev.dv_xname, rf->rf_calib);
4498		rf->rf_flags |= BWI_RF_F_INITED;
4499	}
4500
4501	/*
4502	 * Restore trashes registers
4503	 */
4504	PHY_WRITE(mac, save_phy_regs_comm[0], save_phy_comm[0]);
4505
4506	for (i = 0; i < SAVE_RF_MAX; ++i) {
4507		int pos = (i + 1) % SAVE_RF_MAX;
4508
4509		RF_WRITE(mac, save_rf_regs[pos], save_rf[pos]);
4510	}
4511	for (i = 1; i < SAVE_PHY_COMM_MAX; ++i)
4512		PHY_WRITE(mac, save_phy_regs_comm[i], save_phy_comm[i]);
4513
4514	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
4515	if (phy->phy_version != 0)
4516		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, rf_chan_ex);
4517
4518	PHY_WRITE(mac, 0x35, phyr_35);
4519	bwi_rf_workaround(mac, rf->rf_curchan);
4520
4521	if (phy->phy_mode == IEEE80211_MODE_11B) {
4522		PHY_WRITE(mac, 0x30, phyr_30);
4523		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
4524	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4525		/* XXX Spec only says when PHY is linked (gmode) */
4526		CSR_CLRBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
4527
4528		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
4529			PHY_WRITE(mac, save_phy_regs_11g[i],
4530				  save_phy_11g[i]);
4531		}
4532
4533		PHY_WRITE(mac, 0x80f, phyr_80f);
4534		PHY_WRITE(mac, 0x810, phyr_810);
4535	}
4536
4537#undef SAVE_PHY_11G_MAX
4538#undef SAVE_PHY_COMM_MAX
4539#undef SAVE_RF_MAX
4540}
4541
4542uint16_t
4543bwi_rf_calibval(struct bwi_mac *mac)
4544{
4545	uint16_t val, calib;
4546	int idx;
4547
4548	/* http://bcm-specs.sipsolutions.net/RCCTable */
4549	static const uint16_t rf_calibvals[] = {
4550		0x2, 0x3, 0x1, 0xf, 0x6, 0x7, 0x5, 0xf,
4551		0xa, 0xb, 0x9, 0xf, 0xe, 0xf, 0xd, 0xf
4552	};
4553
4554	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
4555	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
4556	KASSERT(idx < (int)(sizeof(rf_calibvals) / sizeof(rf_calibvals[0])));
4557
4558	calib = rf_calibvals[idx] << 1;
4559	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
4560		calib |= 0x1;
4561	calib |= 0x20;
4562
4563	return (calib);
4564}
4565
4566int32_t
4567_bwi_adjust_devide(int32_t num, int32_t den)
4568{
4569	if (num < 0)
4570		return ((num / den));
4571	else
4572		return ((num + den / 2) / den);
4573}
4574
4575/*
4576 * http://bcm-specs.sipsolutions.net/TSSI_to_DBM_Table
4577 * "calculating table entries"
4578 */
4579int
4580bwi_rf_calc_txpower(int8_t *txpwr, uint8_t idx, const int16_t pa_params[])
4581{
4582	int32_t m1, m2, f, dbm;
4583	int i;
4584
4585	m1 = _bwi_adjust_devide(16 * pa_params[0] + idx * pa_params[1], 32);
4586	m2 = imax(_bwi_adjust_devide(32768 + idx * pa_params[2], 256), 1);
4587
4588#define ITER_MAX	16
4589	f = 256;
4590	for (i = 0; i < ITER_MAX; ++i) {
4591		int32_t q, d;
4592
4593		q = _bwi_adjust_devide(
4594		    f * 4096 - _bwi_adjust_devide(m2 * f, 16) * f, 2048);
4595		d = abs(q - f);
4596		f = q;
4597
4598		if (d < 2)
4599			break;
4600	}
4601	if (i == ITER_MAX)
4602		return (EINVAL);
4603#undef ITER_MAX
4604
4605	dbm = _bwi_adjust_devide(m1 * f, 8192);
4606	if (dbm < -127)
4607		dbm = -127;
4608	else if (dbm > 128)
4609		dbm = 128;
4610
4611	*txpwr = dbm;
4612
4613	return (0);
4614}
4615
4616int
4617bwi_rf_map_txpower(struct bwi_mac *mac)
4618{
4619	struct bwi_softc *sc = mac->mac_sc;
4620	struct bwi_rf *rf = &mac->mac_rf;
4621	struct bwi_phy *phy = &mac->mac_phy;
4622	uint16_t sprom_ofs, val, mask;
4623	int16_t pa_params[3];
4624	int error = 0, i, ant_gain, reg_txpower_max;
4625
4626	/*
4627	 * Find out max TX power
4628	 */
4629	val = bwi_read_sprom(sc, BWI_SPROM_MAX_TXPWR);
4630	if (phy->phy_mode == IEEE80211_MODE_11A) {
4631		rf->rf_txpower_max = __SHIFTOUT(val,
4632		    BWI_SPROM_MAX_TXPWR_MASK_11A);
4633	} else {
4634		rf->rf_txpower_max = __SHIFTOUT(val,
4635		    BWI_SPROM_MAX_TXPWR_MASK_11BG);
4636
4637		if ((sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) &&
4638		    phy->phy_mode == IEEE80211_MODE_11G)
4639			rf->rf_txpower_max -= 3;
4640	}
4641	if (rf->rf_txpower_max <= 0) {
4642		printf("%s: invalid max txpower in sprom\n",
4643		    sc->sc_dev.dv_xname);
4644		rf->rf_txpower_max = 74;
4645	}
4646	DPRINTF(1, "%s: max txpower from sprom: %d dBm\n",
4647	    sc->sc_dev.dv_xname, rf->rf_txpower_max);
4648
4649	/*
4650	 * Find out region/domain max TX power, which is adjusted
4651	 * by antenna gain and 1.5 dBm fluctuation as mentioned
4652	 * in v3 spec.
4653	 */
4654	val = bwi_read_sprom(sc, BWI_SPROM_ANT_GAIN);
4655	if (phy->phy_mode == IEEE80211_MODE_11A)
4656		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11A);
4657	else
4658		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11BG);
4659	if (ant_gain == 0xff) {
4660		/* XXX why this always invalid? */
4661		DPRINTF(1, "%s: invalid antenna gain in sprom\n",
4662		    sc->sc_dev.dv_xname);
4663		ant_gain = 2;
4664	}
4665	ant_gain *= 4;
4666	DPRINTF(1, "%s: ant gain %d dBm\n", sc->sc_dev.dv_xname, ant_gain);
4667
4668	reg_txpower_max = 90 - ant_gain - 6;	/* XXX magic number */
4669	DPRINTF(1, "%s: region/domain max txpower %d dBm\n",
4670	    sc->sc_dev.dv_xname, reg_txpower_max);
4671
4672	/*
4673	 * Force max TX power within region/domain TX power limit
4674	 */
4675	if (rf->rf_txpower_max > reg_txpower_max)
4676		rf->rf_txpower_max = reg_txpower_max;
4677	DPRINTF(1, "%s: max txpower %d dBm\n",
4678	    sc->sc_dev.dv_xname, rf->rf_txpower_max);
4679
4680	/*
4681	 * Create TSSI to TX power mapping
4682	 */
4683
4684	if (sc->sc_bbp_id == BWI_BBPID_BCM4301 &&
4685	    rf->rf_type != BWI_RF_T_BCM2050) {
4686		rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
4687		bcopy(bwi_txpower_map_11b, rf->rf_txpower_map0,
4688		      sizeof(rf->rf_txpower_map0));
4689		goto back;
4690	}
4691
4692#define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
4693#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
4694	/*
4695	 * Extract PA parameters
4696	 */
4697	if (phy->phy_mode == IEEE80211_MODE_11A)
4698		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
4699	else
4700		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
4701	for (i = 0; i < N(pa_params); ++i)
4702		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
4703
4704	for (i = 0; i < N(pa_params); ++i) {
4705		/*
4706		 * If one of the PA parameters from SPROM is not valid,
4707		 * fall back to the default values, if there are any.
4708		 */
4709		if (!IS_VALID_PA_PARAM(pa_params[i])) {
4710			const int8_t *txpower_map;
4711
4712			if (phy->phy_mode == IEEE80211_MODE_11A) {
4713				printf("%s: no tssi2dbm table for 11a PHY\n",
4714				    sc->sc_dev.dv_xname);
4715				return (ENXIO);
4716			}
4717
4718			if (phy->phy_mode == IEEE80211_MODE_11G) {
4719				DPRINTF(1, "%s: use default 11g TSSI map\n",
4720				    sc->sc_dev.dv_xname);
4721				txpower_map = bwi_txpower_map_11g;
4722			} else {
4723				txpower_map = bwi_txpower_map_11b;
4724			}
4725
4726			rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
4727			bcopy(txpower_map, rf->rf_txpower_map0,
4728			      sizeof(rf->rf_txpower_map0));
4729			goto back;
4730		}
4731	}
4732#undef N
4733
4734	/*
4735	 * All of the PA parameters from SPROM are valid.
4736	 */
4737
4738	/*
4739	 * Extract idle TSSI from SPROM.
4740	 */
4741	val = bwi_read_sprom(sc, BWI_SPROM_IDLE_TSSI);
4742	DPRINTF(1, "%s: sprom idle tssi: 0x%04x\n", sc->sc_dev.dv_xname, val);
4743
4744	if (phy->phy_mode == IEEE80211_MODE_11A)
4745		mask = BWI_SPROM_IDLE_TSSI_MASK_11A;
4746	else
4747		mask = BWI_SPROM_IDLE_TSSI_MASK_11BG;
4748
4749	rf->rf_idle_tssi0 = (int)__SHIFTOUT(val, mask);
4750	if (!IS_VALID_PA_PARAM(rf->rf_idle_tssi0))
4751		rf->rf_idle_tssi0 = 62;
4752
4753#undef IS_VALID_PA_PARAM
4754
4755	/*
4756	 * Calculate TX power map, which is indexed by TSSI
4757	 */
4758	DPRINTF(1, "%s: TSSI-TX power map:\n", sc->sc_dev.dv_xname);
4759	for (i = 0; i < BWI_TSSI_MAX; ++i) {
4760		error = bwi_rf_calc_txpower(&rf->rf_txpower_map0[i], i,
4761					    pa_params);
4762		if (error) {
4763			printf("%s: bwi_rf_calc_txpower failed\n",
4764			    sc->sc_dev.dv_xname);
4765			break;
4766		}
4767		if (i != 0 && i % 8 == 0)
4768			DPRINTF(1, "\n");
4769		DPRINTF(1, "%d ", rf->rf_txpower_map0[i]);
4770	}
4771	DPRINTF(1, "\n");
4772back:
4773	DPRINTF(1, "%s: idle tssi0: %d\n",
4774	    sc->sc_dev.dv_xname, rf->rf_idle_tssi0);
4775
4776	return (error);
4777}
4778
4779void
4780bwi_rf_lo_update_11g(struct bwi_mac *mac)
4781{
4782	struct bwi_softc *sc = mac->mac_sc;
4783	struct ifnet *ifp = &sc->sc_ic.ic_if;
4784	struct bwi_rf *rf = &mac->mac_rf;
4785	struct bwi_phy *phy = &mac->mac_phy;
4786	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
4787	struct rf_saveregs regs;
4788	uint16_t ant_div, chan_ex;
4789	uint8_t devi_ctrl;
4790	uint orig_chan;
4791
4792	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
4793
4794	/*
4795	 * Save RF/PHY registers for later restoration
4796	 */
4797	orig_chan = rf->rf_curchan;
4798	bzero(&regs, sizeof(regs));
4799
4800	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4801		SAVE_PHY_REG(mac, &regs, 429);
4802		SAVE_PHY_REG(mac, &regs, 802);
4803
4804		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
4805		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
4806	}
4807
4808	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
4809	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div | 0x8000);
4810	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
4811
4812	SAVE_PHY_REG(mac, &regs, 15);
4813	SAVE_PHY_REG(mac, &regs, 2a);
4814	SAVE_PHY_REG(mac, &regs, 35);
4815	SAVE_PHY_REG(mac, &regs, 60);
4816	SAVE_RF_REG(mac, &regs, 43);
4817	SAVE_RF_REG(mac, &regs, 7a);
4818	SAVE_RF_REG(mac, &regs, 52);
4819	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4820		SAVE_PHY_REG(mac, &regs, 811);
4821		SAVE_PHY_REG(mac, &regs, 812);
4822		SAVE_PHY_REG(mac, &regs, 814);
4823		SAVE_PHY_REG(mac, &regs, 815);
4824	}
4825
4826	/* Force to channel 6 */
4827	bwi_rf_set_chan(mac, 6, 0);
4828
4829	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4830		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
4831		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
4832		bwi_mac_dummy_xmit(mac);
4833	}
4834	RF_WRITE(mac, 0x43, 0x6);
4835
4836	bwi_phy_set_bbp_atten(mac, 2);
4837
4838	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0);
4839
4840	PHY_WRITE(mac, 0x2e, 0x7f);
4841	PHY_WRITE(mac, 0x80f, 0x78);
4842	PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
4843	RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
4844	PHY_WRITE(mac, 0x2b, 0x203);
4845	PHY_WRITE(mac, 0x2a, 0x8a3);
4846
4847	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4848		PHY_WRITE(mac, 0x814, regs.phy_814 | 0x3);
4849		PHY_WRITE(mac, 0x815, regs.phy_815 & 0xfffc);
4850		PHY_WRITE(mac, 0x811, 0x1b3);
4851		PHY_WRITE(mac, 0x812, 0xb2);
4852	}
4853
4854	if ((ifp->if_flags & IFF_RUNNING) == 0)
4855		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
4856	PHY_WRITE(mac, 0x80f, 0x8078);
4857
4858	/*
4859	 * Measure all RF LO
4860	 */
4861	devi_ctrl = _bwi_rf_lo_update_11g(mac, regs.rf_7a);
4862
4863	/*
4864	 * Restore saved RF/PHY registers
4865	 */
4866	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4867		PHY_WRITE(mac, 0x15, 0xe300);
4868		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa0);
4869		DELAY(5);
4870		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa2);
4871		DELAY(2);
4872		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa3);
4873	} else
4874		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
4875
4876	if ((ifp->if_flags & IFF_RUNNING) == 0)
4877		tpctl = NULL;
4878	bwi_rf_lo_adjust(mac, tpctl);
4879
4880	PHY_WRITE(mac, 0x2e, 0x807f);
4881	if (phy->phy_flags & BWI_PHY_F_LINKED)
4882		PHY_WRITE(mac, 0x2f, 0x202);
4883	else
4884		PHY_WRITE(mac, 0x2f, 0x101);
4885
4886	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
4887
4888	RESTORE_PHY_REG(mac, &regs, 15);
4889	RESTORE_PHY_REG(mac, &regs, 2a);
4890	RESTORE_PHY_REG(mac, &regs, 35);
4891	RESTORE_PHY_REG(mac, &regs, 60);
4892
4893	RESTORE_RF_REG(mac, &regs, 43);
4894	RESTORE_RF_REG(mac, &regs, 7a);
4895
4896	regs.rf_52 &= 0xf0;
4897	regs.rf_52 |= (RF_READ(mac, 0x52) & 0xf);
4898	RF_WRITE(mac, 0x52, regs.rf_52);
4899
4900	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
4901
4902	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4903		RESTORE_PHY_REG(mac, &regs, 811);
4904		RESTORE_PHY_REG(mac, &regs, 812);
4905		RESTORE_PHY_REG(mac, &regs, 814);
4906		RESTORE_PHY_REG(mac, &regs, 815);
4907		RESTORE_PHY_REG(mac, &regs, 429);
4908		RESTORE_PHY_REG(mac, &regs, 802);
4909	}
4910
4911	bwi_rf_set_chan(mac, orig_chan, 1);
4912}
4913
4914uint32_t
4915bwi_rf_lo_devi_measure(struct bwi_mac *mac, uint16_t ctrl)
4916{
4917	struct bwi_phy *phy = &mac->mac_phy;
4918	uint32_t devi = 0;
4919	int i;
4920
4921	if (phy->phy_flags & BWI_PHY_F_LINKED)
4922		ctrl <<= 8;
4923
4924	for (i = 0; i < 8; ++i) {
4925		if (phy->phy_flags & BWI_PHY_F_LINKED) {
4926			PHY_WRITE(mac, 0x15, 0xe300);
4927			PHY_WRITE(mac, 0x812, ctrl | 0xb0);
4928			DELAY(5);
4929			PHY_WRITE(mac, 0x812, ctrl | 0xb2);
4930			DELAY(2);
4931			PHY_WRITE(mac, 0x812, ctrl | 0xb3);
4932			DELAY(4);
4933			PHY_WRITE(mac, 0x15, 0xf300);
4934		} else {
4935			PHY_WRITE(mac, 0x15, ctrl | 0xefa0);
4936			DELAY(2);
4937			PHY_WRITE(mac, 0x15, ctrl | 0xefe0);
4938			DELAY(4);
4939			PHY_WRITE(mac, 0x15, ctrl | 0xffe0);
4940		}
4941		DELAY(8);
4942		devi += PHY_READ(mac, 0x2d);
4943	}
4944
4945	return (devi);
4946}
4947
4948uint16_t
4949bwi_rf_get_tp_ctrl2(struct bwi_mac *mac)
4950{
4951	uint32_t devi_min;
4952	uint16_t tp_ctrl2 = 0;
4953	int i;
4954
4955	RF_WRITE(mac, 0x52, 0);
4956	DELAY(10);
4957	devi_min = bwi_rf_lo_devi_measure(mac, 0);
4958
4959	for (i = 0; i < 16; ++i) {
4960		uint32_t devi;
4961
4962		RF_WRITE(mac, 0x52, i);
4963		DELAY(10);
4964		devi = bwi_rf_lo_devi_measure(mac, 0);
4965
4966		if (devi < devi_min) {
4967			devi_min = devi;
4968			tp_ctrl2 = i;
4969		}
4970	}
4971
4972	return (tp_ctrl2);
4973}
4974
4975uint8_t
4976_bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
4977{
4978#define RF_ATTEN_LISTSZ	14
4979#define BBP_ATTEN_MAX	4	/* half */
4980	struct ifnet *ifp = &mac->mac_sc->sc_ic.ic_if;
4981	struct bwi_rf_lo lo_save, *lo;
4982	uint8_t devi_ctrl = 0;
4983	int idx, adj_rf7a = 0;
4984
4985	static const int rf_atten_list[RF_ATTEN_LISTSZ] =
4986	    { 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 1, 2, 3, 4 };
4987	static const int rf_atten_init_list[RF_ATTEN_LISTSZ] =
4988            { 0, 3, 1, 5, 7, 3, 2, 0, 4, 6, -1, -1, -1, -1 };
4989	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
4990	    { 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
4991
4992	bzero(&lo_save, sizeof(lo_save));
4993	for (idx = 0; idx < RF_ATTEN_LISTSZ; ++idx) {
4994		int init_rf_atten = rf_atten_init_list[idx];
4995		int rf_atten = rf_atten_list[idx];
4996		int bbp_atten;
4997
4998		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
4999			uint16_t tp_ctrl2, rf7a;
5000
5001			if ((ifp->if_flags & IFF_RUNNING) == 0) {
5002				if (idx == 0) {
5003					bzero(&lo_save, sizeof(lo_save));
5004				} else if (init_rf_atten < 0) {
5005					lo = bwi_get_rf_lo(mac,
5006					    rf_atten, 2 * bbp_atten);
5007					bcopy(lo, &lo_save, sizeof(lo_save));
5008				} else {
5009					lo = bwi_get_rf_lo(mac,
5010					    init_rf_atten, 0);
5011					bcopy(lo, &lo_save, sizeof(lo_save));
5012				}
5013
5014				devi_ctrl = 0;
5015				adj_rf7a = 0;
5016
5017				/*
5018				 * XXX
5019				 * Linux driver overflows 'val'
5020				 */
5021				if (init_rf_atten >= 0) {
5022					int val;
5023
5024					val = rf_atten * 2 + bbp_atten;
5025					if (val > 14) {
5026						adj_rf7a = 1;
5027						if (val > 17)
5028							devi_ctrl = 1;
5029						if (val > 19)
5030							devi_ctrl = 2;
5031					}
5032				}
5033			} else {
5034				lo = bwi_get_rf_lo(mac,
5035					rf_atten, 2 * bbp_atten);
5036				if (!bwi_rf_lo_isused(mac, lo))
5037					continue;
5038				bcopy(lo, &lo_save, sizeof(lo_save));
5039
5040				devi_ctrl = 3;
5041				adj_rf7a = 0;
5042			}
5043
5044			RF_WRITE(mac, BWI_RFR_ATTEN, rf_atten);
5045
5046			tp_ctrl2 = mac->mac_tpctl.tp_ctrl2;
5047			if (init_rf_atten < 0)
5048				tp_ctrl2 |= (3 << 4);
5049			RF_WRITE(mac, BWI_RFR_TXPWR, tp_ctrl2);
5050
5051			DELAY(10);
5052
5053			bwi_phy_set_bbp_atten(mac, bbp_atten * 2);
5054
5055			rf7a = orig_rf7a & 0xfff0;
5056			if (adj_rf7a)
5057				rf7a |= 0x8;
5058			RF_WRITE(mac, 0x7a, rf7a);
5059
5060			lo = bwi_get_rf_lo(mac,
5061				rf_lo_measure_order[idx], bbp_atten * 2);
5062			bwi_rf_lo_measure_11g(mac, &lo_save, lo, devi_ctrl);
5063		}
5064	}
5065
5066	return (devi_ctrl);
5067
5068#undef RF_ATTEN_LISTSZ
5069#undef BBP_ATTEN_MAX
5070}
5071
5072void
5073bwi_rf_lo_measure_11g(struct bwi_mac *mac, const struct bwi_rf_lo *src_lo,
5074    struct bwi_rf_lo *dst_lo, uint8_t devi_ctrl)
5075{
5076#define LO_ADJUST_MIN	1
5077#define LO_ADJUST_MAX	8
5078#define LO_ADJUST(hi, lo)	{ .ctrl_hi = hi, .ctrl_lo = lo }
5079	static const struct bwi_rf_lo rf_lo_adjust[LO_ADJUST_MAX] = {
5080		LO_ADJUST(1,	1),
5081		LO_ADJUST(1,	0),
5082		LO_ADJUST(1,	-1),
5083		LO_ADJUST(0,	-1),
5084		LO_ADJUST(-1,	-1),
5085		LO_ADJUST(-1,	0),
5086		LO_ADJUST(-1,	1),
5087		LO_ADJUST(0,	1)
5088	};
5089#undef LO_ADJUST
5090
5091	struct bwi_rf_lo lo_min;
5092	uint32_t devi_min;
5093	int found, loop_count, adjust_state;
5094
5095	bcopy(src_lo, &lo_min, sizeof(lo_min));
5096	RF_LO_WRITE(mac, &lo_min);
5097	devi_min = bwi_rf_lo_devi_measure(mac, devi_ctrl);
5098
5099	loop_count = 12;	/* XXX */
5100	adjust_state = 0;
5101	do {
5102		struct bwi_rf_lo lo_base;
5103		int i, fin;
5104
5105		found = 0;
5106		if (adjust_state == 0) {
5107			i = LO_ADJUST_MIN;
5108			fin = LO_ADJUST_MAX;
5109		} else if (adjust_state % 2 == 0) {
5110			i = adjust_state - 1;
5111			fin = adjust_state + 1;
5112		} else {
5113			i = adjust_state - 2;
5114			fin = adjust_state + 2;
5115		}
5116
5117		if (i < LO_ADJUST_MIN)
5118			i += LO_ADJUST_MAX;
5119		KASSERT(i <= LO_ADJUST_MAX && i >= LO_ADJUST_MIN);
5120
5121		if (fin > LO_ADJUST_MAX)
5122			fin -= LO_ADJUST_MAX;
5123		KASSERT(fin <= LO_ADJUST_MAX && fin >= LO_ADJUST_MIN);
5124
5125		bcopy(&lo_min, &lo_base, sizeof(lo_base));
5126		for (;;) {
5127			struct bwi_rf_lo lo;
5128
5129			lo.ctrl_hi = lo_base.ctrl_hi +
5130				rf_lo_adjust[i - 1].ctrl_hi;
5131			lo.ctrl_lo = lo_base.ctrl_lo +
5132				rf_lo_adjust[i - 1].ctrl_lo;
5133
5134			if (abs(lo.ctrl_lo) < 9 && abs(lo.ctrl_hi) < 9) {
5135				uint32_t devi;
5136
5137				RF_LO_WRITE(mac, &lo);
5138				devi = bwi_rf_lo_devi_measure(mac, devi_ctrl);
5139				if (devi < devi_min) {
5140					devi_min = devi;
5141					adjust_state = i;
5142					found = 1;
5143					bcopy(&lo, &lo_min, sizeof(lo_min));
5144				}
5145			}
5146			if (i == fin)
5147				break;
5148			if (i == LO_ADJUST_MAX)
5149				i = LO_ADJUST_MIN;
5150			else
5151				++i;
5152		}
5153	} while (loop_count-- && found);
5154
5155	bcopy(&lo_min, dst_lo, sizeof(*dst_lo));
5156
5157#undef LO_ADJUST_MIN
5158#undef LO_ADJUST_MAX
5159}
5160
5161void
5162bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *mac)
5163{
5164#define SAVE_RF_MAX	3
5165#define SAVE_PHY_MAX	8
5166	struct bwi_softc *sc = mac->mac_sc;
5167	struct bwi_rf *rf = &mac->mac_rf;
5168	struct bwi_phy *phy = &mac->mac_phy;
5169	uint16_t save_rf[SAVE_RF_MAX];
5170	uint16_t save_phy[SAVE_PHY_MAX];
5171	uint16_t ant_div, bbp_atten, chan_ex;
5172	int16_t nrssi[2];
5173	int i;
5174
5175	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
5176	    { 0x7a, 0x52, 0x43 };
5177	static const uint16_t save_phy_regs[SAVE_PHY_MAX] =
5178	    { 0x30, 0x26, 0x15, 0x2a, 0x20, 0x5a, 0x59, 0x58 };
5179
5180	/*
5181	 * Save RF/PHY registers for later restoration
5182	 */
5183	for (i = 0; i < SAVE_RF_MAX; ++i)
5184		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5185	for (i = 0; i < SAVE_PHY_MAX; ++i)
5186		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
5187
5188	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
5189	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
5190	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
5191
5192	/*
5193	 * Calculate nrssi0
5194	 */
5195	if (phy->phy_rev >= 5)
5196		RF_CLRBITS(mac, 0x7a, 0xff80);
5197	else
5198		RF_CLRBITS(mac, 0x7a, 0xfff0);
5199	PHY_WRITE(mac, 0x30, 0xff);
5200
5201	CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x7f7f);
5202
5203	PHY_WRITE(mac, 0x26, 0);
5204	PHY_SETBITS(mac, 0x15, 0x20);
5205	PHY_WRITE(mac, 0x2a, 0x8a3);
5206	RF_SETBITS(mac, 0x7a, 0x80);
5207
5208	nrssi[0] = (int16_t)PHY_READ(mac, 0x27);
5209
5210	/*
5211	 * Calculate nrssi1
5212	 */
5213	RF_CLRBITS(mac, 0x7a, 0xff80);
5214	if (phy->phy_version >= 2)
5215		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x40);
5216	else if (phy->phy_version == 0)
5217		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
5218	else
5219		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0xdfff);
5220
5221	PHY_WRITE(mac, 0x20, 0x3f3f);
5222	PHY_WRITE(mac, 0x15, 0xf330);
5223
5224	RF_WRITE(mac, 0x5a, 0x60);
5225	RF_CLRBITS(mac, 0x43, 0xff0f);
5226
5227	PHY_WRITE(mac, 0x5a, 0x480);
5228	PHY_WRITE(mac, 0x59, 0x810);
5229	PHY_WRITE(mac, 0x58, 0xd);
5230
5231	DELAY(20);
5232
5233	nrssi[1] = (int16_t)PHY_READ(mac, 0x27);
5234
5235	/*
5236	 * Restore saved RF/PHY registers
5237	 */
5238	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
5239	RF_WRITE(mac, save_rf_regs[0], save_rf[0]);
5240
5241	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
5242
5243	for (i = 1; i < 4; ++i)
5244		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
5245
5246	bwi_rf_workaround(mac, rf->rf_curchan);
5247
5248	if (phy->phy_version != 0)
5249		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
5250
5251	for (; i < SAVE_PHY_MAX; ++i)
5252		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
5253
5254	for (i = 1; i < SAVE_RF_MAX; ++i)
5255		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5256
5257	/*
5258	 * Install calculated narrow RSSI values
5259	 */
5260	if (nrssi[0] == nrssi[1])
5261		rf->rf_nrssi_slope = 0x10000;
5262	else
5263		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
5264	if (nrssi[0] <= -4) {
5265		rf->rf_nrssi[0] = nrssi[0];
5266		rf->rf_nrssi[1] = nrssi[1];
5267	}
5268
5269#undef SAVE_RF_MAX
5270#undef SAVE_PHY_MAX
5271}
5272
5273void
5274bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *mac)
5275{
5276#define SAVE_RF_MAX		2
5277#define SAVE_PHY_COMM_MAX	10
5278#define SAVE_PHY6_MAX		8
5279	struct bwi_phy *phy = &mac->mac_phy;
5280	uint16_t save_rf[SAVE_RF_MAX];
5281	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
5282	uint16_t save_phy6[SAVE_PHY6_MAX];
5283	uint16_t rf7b = 0xffff;
5284	int16_t nrssi;
5285	int i, phy6_idx = 0;
5286
5287	static const uint16_t save_rf_regs[SAVE_RF_MAX] = { 0x7a, 0x43 };
5288	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
5289		0x0001, 0x0811, 0x0812, 0x0814,
5290		0x0815, 0x005a, 0x0059, 0x0058,
5291		0x000a, 0x0003
5292	};
5293	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
5294		0x002e, 0x002f, 0x080f, 0x0810,
5295		0x0801, 0x0060, 0x0014, 0x0478
5296	};
5297
5298	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5299		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
5300	for (i = 0; i < SAVE_RF_MAX; ++i)
5301		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5302
5303	PHY_CLRBITS(mac, 0x429, 0x8000);
5304	PHY_FILT_SETBITS(mac, 0x1, 0x3fff, 0x4000);
5305	PHY_SETBITS(mac, 0x811, 0xc);
5306	PHY_FILT_SETBITS(mac, 0x812, 0xfff3, 0x4);
5307	PHY_CLRBITS(mac, 0x802, 0x3);
5308
5309	if (phy->phy_rev >= 6) {
5310		for (i = 0; i < SAVE_PHY6_MAX; ++i)
5311			save_phy6[i] = PHY_READ(mac, save_phy6_regs[i]);
5312
5313		PHY_WRITE(mac, 0x2e, 0);
5314		PHY_WRITE(mac, 0x2f, 0);
5315		PHY_WRITE(mac, 0x80f, 0);
5316		PHY_WRITE(mac, 0x810, 0);
5317		PHY_SETBITS(mac, 0x478, 0x100);
5318		PHY_SETBITS(mac, 0x801, 0x40);
5319		PHY_SETBITS(mac, 0x60, 0x40);
5320		PHY_SETBITS(mac, 0x14, 0x200);
5321	}
5322
5323	RF_SETBITS(mac, 0x7a, 0x70);
5324	RF_SETBITS(mac, 0x7a, 0x80);
5325
5326	DELAY(30);
5327
5328	nrssi = bwi_nrssi_11g(mac);
5329	if (nrssi == 31) {
5330		for (i = 7; i >= 4; --i) {
5331			RF_WRITE(mac, 0x7b, i);
5332			DELAY(20);
5333			nrssi = bwi_nrssi_11g(mac);
5334			if (nrssi < 31 && rf7b == 0xffff)
5335				rf7b = i;
5336		}
5337		if (rf7b == 0xffff)
5338			rf7b = 4;
5339	} else {
5340		struct bwi_gains gains;
5341
5342		RF_CLRBITS(mac, 0x7a, 0xff80);
5343
5344		PHY_SETBITS(mac, 0x814, 0x1);
5345		PHY_CLRBITS(mac, 0x815, 0x1);
5346		PHY_SETBITS(mac, 0x811, 0xc);
5347		PHY_SETBITS(mac, 0x812, 0xc);
5348		PHY_SETBITS(mac, 0x811, 0x30);
5349		PHY_SETBITS(mac, 0x812, 0x30);
5350		PHY_WRITE(mac, 0x5a, 0x480);
5351		PHY_WRITE(mac, 0x59, 0x810);
5352		PHY_WRITE(mac, 0x58, 0xd);
5353		if (phy->phy_version == 0)
5354			PHY_WRITE(mac, 0x3, 0x122);
5355		else
5356			PHY_SETBITS(mac, 0xa, 0x2000);
5357		PHY_SETBITS(mac, 0x814, 0x4);
5358		PHY_CLRBITS(mac, 0x815, 0x4);
5359		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
5360		RF_SETBITS(mac, 0x7a, 0xf);
5361
5362		bzero(&gains, sizeof(gains));
5363		gains.tbl_gain1 = 3;
5364		gains.tbl_gain2 = 0;
5365		gains.phy_gain = 1;
5366		bwi_set_gains(mac, &gains);
5367
5368		RF_FILT_SETBITS(mac, 0x43, 0xf0, 0xf);
5369		DELAY(30);
5370
5371		nrssi = bwi_nrssi_11g(mac);
5372		if (nrssi == -32) {
5373			for (i = 0; i < 4; ++i) {
5374				RF_WRITE(mac, 0x7b, i);
5375				DELAY(20);
5376				nrssi = bwi_nrssi_11g(mac);
5377				if (nrssi > -31 && rf7b == 0xffff)
5378					rf7b = i;
5379			}
5380			if (rf7b == 0xffff)
5381				rf7b = 3;
5382		} else {
5383			rf7b = 0;
5384		}
5385	}
5386	RF_WRITE(mac, 0x7b, rf7b);
5387
5388	/*
5389	 * Restore saved RF/PHY registers
5390	 */
5391	if (phy->phy_rev >= 6) {
5392		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
5393			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
5394			    save_phy6[phy6_idx]);
5395		}
5396	}
5397
5398	/* Saved PHY registers 0, 1, 2 are handled later */
5399	for (i = 3; i < SAVE_PHY_COMM_MAX; ++i)
5400		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
5401
5402	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
5403		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5404
5405	PHY_SETBITS(mac, 0x802, 0x3);
5406	PHY_SETBITS(mac, 0x429, 0x8000);
5407
5408	bwi_set_gains(mac, NULL);
5409
5410	if (phy->phy_rev >= 6) {
5411		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
5412			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
5413			    save_phy6[phy6_idx]);
5414		}
5415	}
5416
5417	PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
5418	PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
5419	PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
5420
5421#undef SAVE_RF_MAX
5422#undef SAVE_PHY_COMM_MAX
5423#undef SAVE_PHY6_MAX
5424}
5425
5426void
5427bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *mac)
5428{
5429#define SAVE_RF_MAX		3
5430#define SAVE_PHY_COMM_MAX	4
5431#define SAVE_PHY3_MAX		8
5432	struct bwi_softc *sc = mac->mac_sc;
5433	struct bwi_phy *phy = &mac->mac_phy;
5434	struct bwi_rf *rf = &mac->mac_rf;
5435	uint16_t save_rf[SAVE_RF_MAX];
5436	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
5437	uint16_t save_phy3[SAVE_PHY3_MAX];
5438	uint16_t ant_div, bbp_atten, chan_ex;
5439	struct bwi_gains gains;
5440	int16_t nrssi[2];
5441	int i, phy3_idx = 0;
5442
5443	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
5444	    { 0x7a, 0x52, 0x43 };
5445	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
5446	    { 0x15, 0x5a, 0x59, 0x58 };
5447	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
5448		0x002e, 0x002f, 0x080f, 0x0810,
5449		0x0801, 0x0060, 0x0014, 0x0478
5450	};
5451
5452	if (rf->rf_rev >= 9)
5453		return;
5454	else if (rf->rf_rev == 8)
5455		bwi_rf_set_nrssi_ofs_11g(mac);
5456
5457	PHY_CLRBITS(mac, 0x429, 0x8000);
5458	PHY_CLRBITS(mac, 0x802, 0x3);
5459
5460	/*
5461	 * Save RF/PHY registers for later restoration
5462	 */
5463	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
5464	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
5465
5466	for (i = 0; i < SAVE_RF_MAX; ++i)
5467		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5468	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5469		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
5470
5471	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
5472	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
5473
5474	if (phy->phy_rev >= 3) {
5475		for (i = 0; i < SAVE_PHY3_MAX; ++i)
5476			save_phy3[i] = PHY_READ(mac, save_phy3_regs[i]);
5477
5478		PHY_WRITE(mac, 0x2e, 0);
5479		PHY_WRITE(mac, 0x810, 0);
5480
5481		if (phy->phy_rev == 4 || phy->phy_rev == 6 ||
5482		    phy->phy_rev == 7) {
5483			PHY_SETBITS(mac, 0x478, 0x100);
5484			PHY_SETBITS(mac, 0x810, 0x40);
5485		} else if (phy->phy_rev == 3 || phy->phy_rev == 5)
5486			PHY_CLRBITS(mac, 0x810, 0x40);
5487
5488		PHY_SETBITS(mac, 0x60, 0x40);
5489		PHY_SETBITS(mac, 0x14, 0x200);
5490	}
5491
5492	/*
5493	 * Calculate nrssi0
5494	 */
5495	RF_SETBITS(mac, 0x7a, 0x70);
5496
5497	bzero(&gains, sizeof(gains));
5498	gains.tbl_gain1 = 0;
5499	gains.tbl_gain2 = 8;
5500	gains.phy_gain = 0;
5501	bwi_set_gains(mac, &gains);
5502
5503	RF_CLRBITS(mac, 0x7a, 0xff08);
5504	if (phy->phy_rev >= 2) {
5505		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x30);
5506		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
5507	}
5508
5509	RF_SETBITS(mac, 0x7a, 0x80);
5510	DELAY(20);
5511	nrssi[0] = bwi_nrssi_11g(mac);
5512
5513	/*
5514	 * Calculate nrssi1
5515	 */
5516	RF_CLRBITS(mac, 0x7a, 0xff80);
5517	if (phy->phy_version >= 2)
5518		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
5519	CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
5520
5521	RF_SETBITS(mac, 0x7a, 0xf);
5522	PHY_WRITE(mac, 0x15, 0xf330);
5523	if (phy->phy_rev >= 2) {
5524		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x20);
5525		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x20);
5526	}
5527
5528	bzero(&gains, sizeof(gains));
5529	gains.tbl_gain1 = 3;
5530	gains.tbl_gain2 = 0;
5531	gains.phy_gain = 1;
5532	bwi_set_gains(mac, &gains);
5533
5534	if (rf->rf_rev == 8) {
5535		RF_WRITE(mac, 0x43, 0x1f);
5536	} else {
5537		RF_FILT_SETBITS(mac, 0x52, 0xff0f, 0x60);
5538		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
5539	}
5540	PHY_WRITE(mac, 0x5a, 0x480);
5541	PHY_WRITE(mac, 0x59, 0x810);
5542	PHY_WRITE(mac, 0x58, 0xd);
5543	DELAY(20);
5544
5545	nrssi[1] = bwi_nrssi_11g(mac);
5546
5547	/*
5548	 * Install calculated narrow RSSI values
5549	 */
5550	if (nrssi[1] == nrssi[0])
5551		rf->rf_nrssi_slope = 0x10000;
5552	else
5553		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
5554	if (nrssi[0] >= -4) {
5555		rf->rf_nrssi[0] = nrssi[1];
5556		rf->rf_nrssi[1] = nrssi[0];
5557	}
5558
5559	/*
5560	 * Restore saved RF/PHY registers
5561	 */
5562	if (phy->phy_rev >= 3) {
5563		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
5564			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
5565				  save_phy3[phy3_idx]);
5566		}
5567	}
5568	if (phy->phy_rev >= 2) {
5569		PHY_CLRBITS(mac, 0x812, 0x30);
5570		PHY_CLRBITS(mac, 0x811, 0x30);
5571	}
5572
5573	for (i = 0; i < SAVE_RF_MAX; ++i)
5574		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5575
5576	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
5577	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
5578	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
5579
5580	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5581		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
5582
5583	bwi_rf_workaround(mac, rf->rf_curchan);
5584	PHY_SETBITS(mac, 0x802, 0x3);
5585	bwi_set_gains(mac, NULL);
5586	PHY_SETBITS(mac, 0x429, 0x8000);
5587
5588	if (phy->phy_rev >= 3) {
5589		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
5590			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
5591			    save_phy3[phy3_idx]);
5592		}
5593	}
5594
5595	bwi_rf_init_sw_nrssi_table(mac);
5596	bwi_rf_set_nrssi_thr_11g(mac);
5597
5598#undef SAVE_RF_MAX
5599#undef SAVE_PHY_COMM_MAX
5600#undef SAVE_PHY3_MAX
5601}
5602
5603void
5604bwi_rf_init_sw_nrssi_table(struct bwi_mac *mac)
5605{
5606	struct bwi_rf *rf = &mac->mac_rf;
5607	int d, i;
5608
5609	d = 0x1f - rf->rf_nrssi[0];
5610	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
5611		int val;
5612
5613		val = (((i - d) * rf->rf_nrssi_slope) / 0x10000) + 0x3a;
5614		if (val < 0)
5615			val = 0;
5616		else if (val > 0x3f)
5617			val = 0x3f;
5618
5619		rf->rf_nrssi_table[i] = val;
5620	}
5621}
5622
5623void
5624bwi_rf_init_hw_nrssi_table(struct bwi_mac *mac, uint16_t adjust)
5625{
5626	int i;
5627
5628	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
5629		int16_t val;
5630
5631		val = bwi_nrssi_read(mac, i);
5632
5633		val -= adjust;
5634		if (val < -32)
5635			val = -32;
5636		else if (val > 31);
5637			val = 31;
5638
5639		bwi_nrssi_write(mac, i, val);
5640	}
5641}
5642
5643void
5644bwi_rf_set_nrssi_thr_11b(struct bwi_mac *mac)
5645{
5646	struct bwi_rf *rf = &mac->mac_rf;
5647	int32_t thr;
5648
5649	if (rf->rf_type != BWI_RF_T_BCM2050 ||
5650	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0)
5651		return;
5652
5653	/*
5654	 * Calculate nrssi threshold
5655	 */
5656	if (rf->rf_rev >= 6) {
5657		thr = (rf->rf_nrssi[1] - rf->rf_nrssi[0]) * 32;
5658		thr += 20 * (rf->rf_nrssi[0] + 1);
5659		thr /= 40;
5660	} else {
5661		thr = rf->rf_nrssi[1] - 5;
5662	}
5663	if (thr < 0)
5664		thr = 0;
5665	else if (thr > 0x3e)
5666		thr = 0x3e;
5667
5668	PHY_READ(mac, BWI_PHYR_NRSSI_THR_11B);	/* dummy read */
5669	PHY_WRITE(mac, BWI_PHYR_NRSSI_THR_11B, (((uint16_t)thr) << 8) | 0x1c);
5670
5671	if (rf->rf_rev >= 6) {
5672		PHY_WRITE(mac, 0x87, 0xe0d);
5673		PHY_WRITE(mac, 0x86, 0xc0b);
5674		PHY_WRITE(mac, 0x85, 0xa09);
5675		PHY_WRITE(mac, 0x84, 0x808);
5676		PHY_WRITE(mac, 0x83, 0x808);
5677		PHY_WRITE(mac, 0x82, 0x604);
5678		PHY_WRITE(mac, 0x81, 0x302);
5679		PHY_WRITE(mac, 0x80, 0x100);
5680	}
5681}
5682
5683int32_t
5684_nrssi_threshold(const struct bwi_rf *rf, int32_t val)
5685{
5686	val *= (rf->rf_nrssi[1] - rf->rf_nrssi[0]);
5687	val += (rf->rf_nrssi[0] << 6);
5688	if (val < 32)
5689		val += 31;
5690	else
5691		val += 32;
5692	val >>= 6;
5693	if (val < -31)
5694		val = -31;
5695	else if (val > 31)
5696		val = 31;
5697
5698	return (val);
5699}
5700
5701void
5702bwi_rf_set_nrssi_thr_11g(struct bwi_mac *mac)
5703{
5704	int32_t thr1, thr2;
5705	uint16_t thr;
5706
5707	/*
5708	 * Find the two nrssi thresholds
5709	 */
5710	if ((mac->mac_phy.phy_flags & BWI_PHY_F_LINKED) == 0 ||
5711	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
5712	    	int16_t nrssi;
5713
5714		nrssi = bwi_nrssi_read(mac, 0x20);
5715		if (nrssi >= 32)
5716			nrssi -= 64;
5717
5718		if (nrssi < 3) {
5719			thr1 = 0x2b;
5720			thr2 = 0x27;
5721		} else {
5722			thr1 = 0x2d;
5723			thr2 = 0x2b;
5724		}
5725	} else {
5726		/* TODO Interfere mode */
5727		thr1 = _nrssi_threshold(&mac->mac_rf, 0x11);
5728		thr2 = _nrssi_threshold(&mac->mac_rf, 0xe);
5729	}
5730
5731#define NRSSI_THR1_MASK		0x003f
5732#define NRSSI_THR2_MASK		0x0fc0
5733	thr = __SHIFTIN((uint32_t)thr1, NRSSI_THR1_MASK) |
5734	    __SHIFTIN((uint32_t)thr2, NRSSI_THR2_MASK);
5735	PHY_FILT_SETBITS(mac, BWI_PHYR_NRSSI_THR_11G, 0xf000, thr);
5736#undef NRSSI_THR1_MASK
5737#undef NRSSI_THR2_MASK
5738}
5739
5740void
5741bwi_rf_clear_tssi(struct bwi_mac *mac)
5742{
5743	/* XXX use function pointer */
5744	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
5745		/* TODO: 11A */
5746	} else {
5747		uint16_t val;
5748		int i;
5749
5750		val = __SHIFTIN(BWI_INVALID_TSSI, BWI_LO_TSSI_MASK) |
5751		    __SHIFTIN(BWI_INVALID_TSSI, BWI_HI_TSSI_MASK);
5752
5753		for (i = 0; i < 2; ++i) {
5754			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
5755			    BWI_COMM_MOBJ_TSSI_DS + (i * 2), val);
5756		}
5757
5758		for (i = 0; i < 2; ++i) {
5759			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
5760			    BWI_COMM_MOBJ_TSSI_OFDM + (i * 2), val);
5761		}
5762	}
5763}
5764
5765void
5766bwi_rf_clear_state(struct bwi_rf *rf)
5767{
5768	int i;
5769
5770	rf->rf_flags &= ~BWI_RF_CLEAR_FLAGS;
5771	bzero(rf->rf_lo, sizeof(rf->rf_lo));
5772	bzero(rf->rf_lo_used, sizeof(rf->rf_lo_used));
5773
5774	rf->rf_nrssi_slope = 0;
5775	rf->rf_nrssi[0] = BWI_INVALID_NRSSI;
5776	rf->rf_nrssi[1] = BWI_INVALID_NRSSI;
5777
5778	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i)
5779		rf->rf_nrssi_table[i] = i;
5780
5781	rf->rf_lo_gain = 0;
5782	rf->rf_rx_gain = 0;
5783
5784	bcopy(rf->rf_txpower_map0, rf->rf_txpower_map,
5785	      sizeof(rf->rf_txpower_map));
5786	rf->rf_idle_tssi = rf->rf_idle_tssi0;
5787}
5788
5789void
5790bwi_rf_on_11a(struct bwi_mac *mac)
5791{
5792	/* TODO: 11A */
5793}
5794
5795void
5796bwi_rf_on_11bg(struct bwi_mac *mac)
5797{
5798	struct bwi_phy *phy = &mac->mac_phy;
5799
5800	PHY_WRITE(mac, 0x15, 0x8000);
5801	PHY_WRITE(mac, 0x15, 0xcc00);
5802	if (phy->phy_flags & BWI_PHY_F_LINKED)
5803		PHY_WRITE(mac, 0x15, 0xc0);
5804	else
5805		PHY_WRITE(mac, 0x15, 0);
5806
5807	bwi_rf_set_chan(mac, 6 /* XXX */, 1);
5808}
5809
5810void
5811bwi_rf_set_ant_mode(struct bwi_mac *mac, int ant_mode)
5812{
5813	struct bwi_softc *sc = mac->mac_sc;
5814	struct bwi_phy *phy = &mac->mac_phy;
5815	uint16_t val;
5816
5817	KASSERT(ant_mode == BWI_ANT_MODE_0 ||
5818	    ant_mode == BWI_ANT_MODE_1 ||
5819	    ant_mode == BWI_ANT_MODE_AUTO);
5820
5821	HFLAGS_CLRBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
5822
5823	if (phy->phy_mode == IEEE80211_MODE_11B) {
5824		/* NOTE: v4/v3 conflicts, take v3 */
5825		if (mac->mac_rev == 2)
5826			val = BWI_ANT_MODE_AUTO;
5827		else
5828			val = ant_mode;
5829		val <<= 7;
5830		PHY_FILT_SETBITS(mac, 0x3e2, 0xfe7f, val);
5831	} else {	/* 11a/g */
5832		/* XXX reg/value naming */
5833		val = ant_mode << 7;
5834		PHY_FILT_SETBITS(mac, 0x401, 0x7e7f, val);
5835
5836		if (ant_mode == BWI_ANT_MODE_AUTO)
5837			PHY_CLRBITS(mac, 0x42b, 0x100);
5838
5839		if (phy->phy_mode == IEEE80211_MODE_11A) {
5840			/* TODO: 11A */
5841		} else {	/* 11g */
5842			if (ant_mode == BWI_ANT_MODE_AUTO)
5843				PHY_SETBITS(mac, 0x48c, 0x2000);
5844			else
5845				PHY_CLRBITS(mac, 0x48c, 0x2000);
5846
5847			if (phy->phy_rev >= 2) {
5848				PHY_SETBITS(mac, 0x461, 0x10);
5849				PHY_FILT_SETBITS(mac, 0x4ad, 0xff00, 0x15);
5850				if (phy->phy_rev == 2) {
5851					PHY_WRITE(mac, 0x427, 0x8);
5852				} else {
5853					PHY_FILT_SETBITS(mac, 0x427,
5854							 0xff00, 0x8);
5855				}
5856
5857				if (phy->phy_rev >= 6)
5858					PHY_WRITE(mac, 0x49b, 0xdc);
5859			}
5860		}
5861	}
5862
5863	/* XXX v4 set AUTO_ANTDIV unconditionally */
5864	if (ant_mode == BWI_ANT_MODE_AUTO)
5865		HFLAGS_SETBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
5866
5867	val = ant_mode << 8;
5868	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_BEACON,
5869	    0xfc3f, val);
5870	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_ACK,
5871	    0xfc3f, val);
5872	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_PROBE_RESP,
5873	    0xfc3f, val);
5874
5875	/* XXX what's these */
5876	if (phy->phy_mode == IEEE80211_MODE_11B)
5877		CSR_SETBITS_2(sc, 0x5e, 0x4);
5878
5879	CSR_WRITE_4(sc, 0x100, 0x1000000);
5880	if (mac->mac_rev < 5)
5881		CSR_WRITE_4(sc, 0x10c, 0x1000000);
5882
5883	mac->mac_rf.rf_ant_mode = ant_mode;
5884}
5885
5886int
5887bwi_rf_get_latest_tssi(struct bwi_mac *mac, int8_t tssi[], uint16_t ofs)
5888{
5889	int i;
5890
5891	for (i = 0; i < 4; ) {
5892		uint16_t val;
5893
5894		val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs + i);
5895		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_LO_TSSI_MASK);
5896		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_HI_TSSI_MASK);
5897	}
5898
5899	for (i = 0; i < 4; ++i) {
5900		if (tssi[i] == BWI_INVALID_TSSI)
5901			return (EINVAL);
5902	}
5903
5904	return (0);
5905}
5906
5907int
5908bwi_rf_tssi2dbm(struct bwi_mac *mac, int8_t tssi, int8_t *txpwr)
5909{
5910	struct bwi_rf *rf = &mac->mac_rf;
5911	int pwr_idx;
5912
5913	pwr_idx = rf->rf_idle_tssi + (int)tssi - rf->rf_base_tssi;
5914#if 0
5915	if (pwr_idx < 0 || pwr_idx >= BWI_TSSI_MAX)
5916		return EINVAL;
5917#else
5918	if (pwr_idx < 0)
5919		pwr_idx = 0;
5920	else if (pwr_idx >= BWI_TSSI_MAX)
5921		pwr_idx = BWI_TSSI_MAX - 1;
5922#endif
5923	*txpwr = rf->rf_txpower_map[pwr_idx];
5924
5925	return (0);
5926}
5927
5928int
5929bwi_rf_calc_rssi_bcm2050(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
5930{
5931	uint16_t flags1, flags3;
5932	int rssi, lna_gain;
5933
5934	rssi = hdr->rxh_rssi;
5935	flags1 = letoh16(hdr->rxh_flags1);
5936	flags3 = letoh16(hdr->rxh_flags3);
5937
5938#define NEW_BCM2050_RSSI
5939#ifdef NEW_BCM2050_RSSI
5940	if (flags1 & BWI_RXH_F1_OFDM) {
5941		if (rssi > 127)
5942			rssi -= 256;
5943		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
5944			rssi += 17;
5945		else
5946			rssi -= 4;
5947		return (rssi);
5948	}
5949
5950	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
5951		struct bwi_rf *rf = &mac->mac_rf;
5952
5953		if (rssi >= BWI_NRSSI_TBLSZ)
5954			rssi = BWI_NRSSI_TBLSZ - 1;
5955
5956		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
5957		rssi -= 67;
5958	} else {
5959		rssi = ((31 - rssi) * -149) / 128;
5960		rssi -= 68;
5961	}
5962
5963	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
5964		return (rssi);
5965
5966	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
5967		rssi += 20;
5968
5969	lna_gain = __SHIFTOUT(letoh16(hdr->rxh_phyinfo),
5970	    BWI_RXH_PHYINFO_LNAGAIN);
5971	DPRINTF(3, "lna_gain %d, phyinfo 0x%04x\n",
5972	    lna_gain, letoh16(hdr->rxh_phyinfo));
5973	switch (lna_gain) {
5974	case 0:
5975		rssi += 27;
5976		break;
5977	case 1:
5978		rssi += 6;
5979		break;
5980	case 2:
5981		rssi += 12;
5982		break;
5983	case 3:
5984		/*
5985		 * XXX
5986		 * According to v3 spec, we should do _nothing_ here,
5987		 * but it seems that the result RSSI will be too low
5988		 * (relative to what ath(4) says).  Raise it a little
5989		 * bit.
5990		 */
5991		rssi += 5;
5992		break;
5993	default:
5994		panic("impossible lna gain %d", lna_gain);
5995	}
5996#else	/* !NEW_BCM2050_RSSI */
5997	lna_gain = 0; /* shut up gcc warning */
5998
5999	if (flags1 & BWI_RXH_F1_OFDM) {
6000		if (rssi > 127)
6001			rssi -= 256;
6002		rssi = (rssi * 73) / 64;
6003
6004		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
6005			rssi += 25;
6006		else
6007			rssi -= 3;
6008		return (rssi);
6009	}
6010
6011	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
6012		struct bwi_rf *rf = &mac->mac_rf;
6013
6014		if (rssi >= BWI_NRSSI_TBLSZ)
6015			rssi = BWI_NRSSI_TBLSZ - 1;
6016
6017		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
6018		rssi -= 57;
6019	} else {
6020		rssi = ((31 - rssi) * -149) / 128;
6021		rssi -= 68;
6022	}
6023
6024	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
6025		return (rssi);
6026
6027	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
6028		rssi += 25;
6029#endif	/* NEW_BCM2050_RSSI */
6030	return (rssi);
6031}
6032
6033int
6034bwi_rf_calc_rssi_bcm2053(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
6035{
6036	uint16_t flags1;
6037	int rssi;
6038
6039	rssi = (((int)hdr->rxh_rssi - 11) * 103) / 64;
6040
6041	flags1 = letoh16(hdr->rxh_flags1);
6042	if (flags1 & BWI_RXH_F1_BCM2053_RSSI)
6043		rssi -= 109;
6044	else
6045		rssi -= 83;
6046
6047	return (rssi);
6048}
6049
6050int
6051bwi_rf_calc_rssi_bcm2060(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
6052{
6053	int rssi;
6054
6055	rssi = hdr->rxh_rssi;
6056	if (rssi > 127)
6057		rssi -= 256;
6058
6059	return (rssi);
6060}
6061
6062uint16_t
6063bwi_rf_lo_measure_11b(struct bwi_mac *mac)
6064{
6065	uint16_t val;
6066	int i;
6067
6068	val = 0;
6069	for (i = 0; i < 10; ++i) {
6070		PHY_WRITE(mac, 0x15, 0xafa0);
6071		DELAY(1);
6072		PHY_WRITE(mac, 0x15, 0xefa0);
6073		DELAY(10);
6074		PHY_WRITE(mac, 0x15, 0xffa0);
6075		DELAY(40);
6076
6077		val += PHY_READ(mac, 0x2c);
6078	}
6079
6080	return (val);
6081}
6082
6083void
6084bwi_rf_lo_update_11b(struct bwi_mac *mac)
6085{
6086	struct bwi_softc *sc = mac->mac_sc;
6087	struct bwi_rf *rf = &mac->mac_rf;
6088	struct rf_saveregs regs;
6089	uint16_t rf_val, phy_val, min_val, val;
6090	uint16_t rf52, bphy_ctrl;
6091	int i;
6092
6093	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6094
6095	bzero(&regs, sizeof(regs));
6096	bphy_ctrl = 0;
6097
6098	/*
6099	 * Save RF/PHY registers for later restoration
6100	 */
6101	SAVE_PHY_REG(mac, &regs, 15);
6102	rf52 = RF_READ(mac, 0x52) & 0xfff0;
6103	if (rf->rf_type == BWI_RF_T_BCM2050) {
6104		SAVE_PHY_REG(mac, &regs, 0a);
6105		SAVE_PHY_REG(mac, &regs, 2a);
6106		SAVE_PHY_REG(mac, &regs, 35);
6107		SAVE_PHY_REG(mac, &regs, 03);
6108		SAVE_PHY_REG(mac, &regs, 01);
6109		SAVE_PHY_REG(mac, &regs, 30);
6110
6111		SAVE_RF_REG(mac, &regs, 43);
6112		SAVE_RF_REG(mac, &regs, 7a);
6113
6114		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
6115
6116		SAVE_RF_REG(mac, &regs, 52);
6117		regs.rf_52 &= 0xf0;
6118
6119		PHY_WRITE(mac, 0x30, 0xff);
6120		CSR_WRITE_2(sc, BWI_PHY_CTRL, 0x3f3f);
6121		PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
6122		RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
6123	}
6124
6125	PHY_WRITE(mac, 0x15, 0xb000);
6126
6127	if (rf->rf_type == BWI_RF_T_BCM2050) {
6128		PHY_WRITE(mac, 0x2b, 0x203);
6129 		PHY_WRITE(mac, 0x2a, 0x8a3);
6130 	} else {
6131		PHY_WRITE(mac, 0x2b, 0x1402);
6132	}
6133
6134	/*
6135	 * Setup RF signal
6136	 */
6137	rf_val = 0;
6138	min_val = 65535;
6139
6140	for (i = 0; i < 4; ++i) {
6141		RF_WRITE(mac, 0x52, rf52 | i);
6142		bwi_rf_lo_measure_11b(mac);	/* Ignore return value */
6143	}
6144	for (i = 0; i < 10; ++i) {
6145 		RF_WRITE(mac, 0x52, rf52 | i);
6146
6147  		val = bwi_rf_lo_measure_11b(mac) / 10;
6148		if (val < min_val) {
6149			min_val = val;
6150			rf_val = i;
6151		}
6152	}
6153	RF_WRITE(mac, 0x52, rf52 | rf_val);
6154
6155	/*
6156	 * Setup PHY signal
6157	*/
6158	phy_val = 0;
6159	min_val = 65535;
6160
6161	for (i = -4; i < 5; i += 2) {
6162		int j;
6163
6164		for (j = -4; j < 5; j += 2) {
6165			uint16_t phy2f;
6166
6167			phy2f = (0x100 * i) + j;
6168			if (j < 0)
6169				phy2f += 0x100;
6170			PHY_WRITE(mac, 0x2f, phy2f);
6171
6172			val = bwi_rf_lo_measure_11b(mac) / 10;
6173			if (val < min_val) {
6174				min_val = val;
6175				phy_val = phy2f;
6176			}
6177		}
6178	}
6179	PHY_WRITE(mac, 0x2f, phy_val + 0x101);
6180
6181	/*
6182	 * Restore saved RF/PHY registers
6183	 */
6184	if (rf->rf_type == BWI_RF_T_BCM2050) {
6185		RESTORE_PHY_REG(mac, &regs, 0a);
6186		RESTORE_PHY_REG(mac, &regs, 2a);
6187		RESTORE_PHY_REG(mac, &regs, 35);
6188		RESTORE_PHY_REG(mac, &regs, 03);
6189		RESTORE_PHY_REG(mac, &regs, 01);
6190		RESTORE_PHY_REG(mac, &regs, 30);
6191
6192		RESTORE_RF_REG(mac, &regs, 43);
6193		RESTORE_RF_REG(mac, &regs, 7a);
6194
6195		RF_FILT_SETBITS(mac, 0x52, 0xf, regs.rf_52);
6196
6197		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
6198	}
6199	RESTORE_PHY_REG(mac, &regs, 15);
6200
6201	bwi_rf_workaround(mac, rf->rf_curchan);
6202}
6203
6204/* INTERFACE */
6205
6206uint16_t
6207bwi_read_sprom(struct bwi_softc *sc, uint16_t ofs)
6208{
6209	return (CSR_READ_2(sc, ofs + BWI_SPROM_START));
6210}
6211
6212void
6213bwi_setup_desc32(struct bwi_softc *sc, struct bwi_desc32 *desc_array,
6214    int ndesc, int desc_idx, bus_addr_t paddr, int buf_len, int tx)
6215{
6216	struct bwi_desc32 *desc = &desc_array[desc_idx];
6217	uint32_t ctrl, addr, addr_hi, addr_lo;
6218
6219	addr_lo = __SHIFTOUT(paddr, BWI_DESC32_A_ADDR_MASK);
6220	addr_hi = __SHIFTOUT(paddr, BWI_DESC32_A_FUNC_MASK);
6221
6222	addr = __SHIFTIN(addr_lo, BWI_DESC32_A_ADDR_MASK) |
6223	    __SHIFTIN(BWI_DESC32_A_FUNC_TXRX, BWI_DESC32_A_FUNC_MASK);
6224
6225	ctrl = __SHIFTIN(buf_len, BWI_DESC32_C_BUFLEN_MASK) |
6226	     __SHIFTIN(addr_hi, BWI_DESC32_C_ADDRHI_MASK);
6227	if (desc_idx == ndesc - 1)
6228		ctrl |= BWI_DESC32_C_EOR;
6229	if (tx) {
6230		/* XXX */
6231		ctrl |= BWI_DESC32_C_FRAME_START |
6232		    BWI_DESC32_C_FRAME_END |
6233		    BWI_DESC32_C_INTR;
6234	}
6235
6236	desc->addr = htole32(addr);
6237	desc->ctrl = htole32(ctrl);
6238}
6239
6240void
6241bwi_power_on(struct bwi_softc *sc, int with_pll)
6242{
6243	uint32_t gpio_in, gpio_out, gpio_en, status;
6244
6245	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6246
6247	gpio_in = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_IN);
6248	if (gpio_in & BWI_PCIM_GPIO_PWR_ON)
6249		goto back;
6250
6251	gpio_out = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6252	gpio_en = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_ENABLE);
6253
6254	gpio_out |= BWI_PCIM_GPIO_PWR_ON;
6255	gpio_en |= BWI_PCIM_GPIO_PWR_ON;
6256	if (with_pll) {
6257		/* Turn off PLL first */
6258		gpio_out |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6259		gpio_en |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6260	}
6261
6262	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6263	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_ENABLE, gpio_en);
6264	DELAY(1000);
6265
6266	if (with_pll) {
6267		/* Turn on PLL */
6268		gpio_out &= ~BWI_PCIM_GPIO_PLL_PWR_OFF;
6269		(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6270		DELAY(5000);
6271	}
6272
6273back:
6274	/* Clear "Signaled Target Abort" */
6275	status = (sc->sc_conf_read)(sc, PCI_COMMAND_STATUS_REG);
6276	status &= ~PCI_STATUS_TARGET_TARGET_ABORT;
6277	(sc->sc_conf_write)(sc, PCI_COMMAND_STATUS_REG, status);
6278}
6279
6280int
6281bwi_power_off(struct bwi_softc *sc, int with_pll)
6282{
6283	uint32_t gpio_out, gpio_en;
6284
6285	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6286
6287	(sc->sc_conf_read)(sc, BWI_PCIR_GPIO_IN); /* dummy read */
6288	gpio_out = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6289	gpio_en = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_ENABLE);
6290
6291	gpio_out &= ~BWI_PCIM_GPIO_PWR_ON;
6292	gpio_en |= BWI_PCIM_GPIO_PWR_ON;
6293	if (with_pll) {
6294		gpio_out |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6295		gpio_en |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6296	}
6297
6298	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6299	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_ENABLE, gpio_en);
6300
6301	return (0);
6302}
6303
6304int
6305bwi_regwin_switch(struct bwi_softc *sc, struct bwi_regwin *rw,
6306    struct bwi_regwin **old_rw)
6307{
6308	int error;
6309
6310	if (old_rw != NULL)
6311		*old_rw = NULL;
6312
6313	if (!BWI_REGWIN_EXIST(rw))
6314		return (EINVAL);
6315
6316	if (sc->sc_cur_regwin != rw) {
6317		error = bwi_regwin_select(sc, rw->rw_id);
6318		if (error) {
6319			printf("%s: can't select regwin %d\n",
6320			    sc->sc_dev.dv_xname, rw->rw_id);
6321			return (error);
6322		}
6323	}
6324
6325	if (old_rw != NULL)
6326		*old_rw = sc->sc_cur_regwin;
6327	sc->sc_cur_regwin = rw;
6328
6329	return (0);
6330}
6331
6332int
6333bwi_regwin_select(struct bwi_softc *sc, int id)
6334{
6335	uint32_t win = BWI_PCIM_REGWIN(id);
6336	int i;
6337
6338#define RETRY_MAX	50
6339	for (i = 0; i < RETRY_MAX; ++i) {
6340		(sc->sc_conf_write)(sc, BWI_PCIR_SEL_REGWIN, win);
6341		if ((sc->sc_conf_read)(sc, BWI_PCIR_SEL_REGWIN) == win)
6342			return (0);
6343		DELAY(10);
6344	}
6345#undef RETRY_MAX
6346
6347	return (ENXIO);
6348}
6349
6350void
6351bwi_regwin_info(struct bwi_softc *sc, uint16_t *type, uint8_t *rev)
6352{
6353	uint32_t val;
6354
6355	val = CSR_READ_4(sc, BWI_ID_HI);
6356	*type = BWI_ID_HI_REGWIN_TYPE(val);
6357	*rev = BWI_ID_HI_REGWIN_REV(val);
6358
6359	DPRINTF(1, "%s: regwin: type 0x%03x, rev %d, vendor 0x%04x\n",
6360	    sc->sc_dev.dv_xname,
6361	    *type, *rev, __SHIFTOUT(val, BWI_ID_HI_REGWIN_VENDOR_MASK));
6362}
6363
6364void
6365bwi_led_attach(struct bwi_softc *sc)
6366{
6367	const uint8_t *led_act = NULL;
6368	uint16_t gpio, val[BWI_LED_MAX];
6369	int i;
6370
6371#define N(arr) (int)(sizeof(arr) / sizeof(arr[0]))
6372
6373	for (i = 0; i < N(bwi_vendor_led_act); ++i) {
6374		if (sc->sc_pci_subvid == bwi_vendor_led_act[i].vid) {
6375			led_act = bwi_vendor_led_act[i].led_act;
6376				break;
6377		}
6378	}
6379	if (led_act == NULL)
6380		led_act = bwi_default_led_act;
6381
6382#undef N
6383
6384	gpio = bwi_read_sprom(sc, BWI_SPROM_GPIO01);
6385	val[0] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_0);
6386	val[1] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_1);
6387
6388	gpio = bwi_read_sprom(sc, BWI_SPROM_GPIO23);
6389	val[2] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_2);
6390	val[3] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_3);
6391
6392	for (i = 0; i < BWI_LED_MAX; ++i) {
6393		struct bwi_led *led = &sc->sc_leds[i];
6394
6395		if (val[i] == 0xff) {
6396			led->l_act = led_act[i];
6397		} else {
6398			if (val[i] & BWI_LED_ACT_LOW)
6399				led->l_flags |= BWI_LED_F_ACTLOW;
6400			led->l_act = __SHIFTOUT(val[i], BWI_LED_ACT_MASK);
6401		}
6402		led->l_mask = (1 << i);
6403
6404		if (led->l_act == BWI_LED_ACT_BLINK_SLOW ||
6405		    led->l_act == BWI_LED_ACT_BLINK_POLL ||
6406		    led->l_act == BWI_LED_ACT_BLINK) {
6407		    led->l_flags |= BWI_LED_F_BLINK;
6408			if (led->l_act == BWI_LED_ACT_BLINK_POLL)
6409				led->l_flags |= BWI_LED_F_POLLABLE;
6410			else if (led->l_act == BWI_LED_ACT_BLINK_SLOW)
6411				led->l_flags |= BWI_LED_F_SLOW;
6412
6413			if (sc->sc_blink_led == NULL) {
6414				sc->sc_blink_led = led;
6415				if (led->l_flags & BWI_LED_F_SLOW)
6416					BWI_LED_SLOWDOWN(sc->sc_led_idle);
6417			}
6418		}
6419
6420		DPRINTF(1, "%s: %dth led, act %d, lowact %d\n",
6421		    sc->sc_dev.dv_xname, i, led->l_act,
6422		    led->l_flags & BWI_LED_F_ACTLOW);
6423	}
6424	timeout_set(&sc->sc_led_blink_next_ch, bwi_led_blink_next, sc);
6425	timeout_set(&sc->sc_led_blink_end_ch, bwi_led_blink_end, sc);
6426}
6427
6428uint16_t
6429bwi_led_onoff(struct bwi_led *led, uint16_t val, int on)
6430{
6431	if (led->l_flags & BWI_LED_F_ACTLOW)
6432		on = !on;
6433	if (on)
6434		val |= led->l_mask;
6435	else
6436		val &= ~led->l_mask;
6437
6438	return (val);
6439}
6440
6441void
6442bwi_led_newstate(struct bwi_softc *sc, enum ieee80211_state nstate)
6443{
6444	struct ieee80211com *ic = &sc->sc_ic;
6445	uint16_t val;
6446	int i;
6447
6448	if (nstate == IEEE80211_S_INIT) {
6449		timeout_del(&sc->sc_led_blink_next_ch);
6450		timeout_del(&sc->sc_led_blink_end_ch);
6451		sc->sc_led_blinking = 0;
6452	}
6453
6454	if ((ic->ic_if.if_flags & IFF_RUNNING) == 0)
6455		return;
6456
6457	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6458	for (i = 0; i < BWI_LED_MAX; ++i) {
6459		struct bwi_led *led = &sc->sc_leds[i];
6460		int on;
6461
6462		if (led->l_act == BWI_LED_ACT_UNKN ||
6463		    led->l_act == BWI_LED_ACT_NULL)
6464			continue;
6465
6466		if ((led->l_flags & BWI_LED_F_BLINK) &&
6467			nstate != IEEE80211_S_INIT)
6468			continue;
6469
6470		switch (led->l_act) {
6471		case BWI_LED_ACT_ON:	/* Always on */
6472			on = 1;
6473			break;
6474		case BWI_LED_ACT_OFF:	/* Always off */
6475		case BWI_LED_ACT_5GHZ:	/* TODO: 11A */
6476			on = 0;
6477			break;
6478		default:
6479			on = 1;
6480			switch (nstate) {
6481			case IEEE80211_S_INIT:
6482				on = 0;
6483				break;
6484			case IEEE80211_S_RUN:
6485				if (led->l_act == BWI_LED_ACT_11G &&
6486				    ic->ic_curmode != IEEE80211_MODE_11G)
6487					on = 0;
6488				break;
6489			default:
6490				if (led->l_act == BWI_LED_ACT_ASSOC)
6491					on = 0;
6492				break;
6493			}
6494			break;
6495		}
6496
6497		val = bwi_led_onoff(led, val, on);
6498	}
6499	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6500}
6501
6502void
6503bwi_led_event(struct bwi_softc *sc, int event)
6504{
6505	struct bwi_led *led = sc->sc_blink_led;
6506	int rate;
6507
6508	if (event == BWI_LED_EVENT_POLL) {
6509		if ((led->l_flags & BWI_LED_F_POLLABLE) == 0)
6510			return;
6511		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6512			return;
6513	}
6514
6515	sc->sc_led_ticks = ticks;
6516	if (sc->sc_led_blinking)
6517		return;
6518
6519	switch (event) {
6520	case BWI_LED_EVENT_RX:
6521		rate = sc->sc_rx_rate;
6522		break;
6523	case BWI_LED_EVENT_TX:
6524		rate = sc->sc_tx_rate;
6525		break;
6526	case BWI_LED_EVENT_POLL:
6527		rate = 0;
6528		break;
6529	default:
6530		panic("unknown LED event %d\n", event);
6531		break;
6532	}
6533	bwi_led_blink_start(sc, bwi_led_duration[rate].on_dur,
6534	    bwi_led_duration[rate].off_dur);
6535}
6536
6537void
6538bwi_led_blink_start(struct bwi_softc *sc, int on_dur, int off_dur)
6539{
6540	struct bwi_led *led = sc->sc_blink_led;
6541	uint16_t val;
6542
6543	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6544	val = bwi_led_onoff(led, val, 1);
6545	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6546
6547	if (led->l_flags & BWI_LED_F_SLOW) {
6548		BWI_LED_SLOWDOWN(on_dur);
6549		BWI_LED_SLOWDOWN(off_dur);
6550	}
6551
6552	sc->sc_led_blinking = 1;
6553	sc->sc_led_blink_offdur = off_dur;
6554
6555	timeout_add(&sc->sc_led_blink_next_ch, on_dur);
6556}
6557
6558void
6559bwi_led_blink_next(void *xsc)
6560{
6561	struct bwi_softc *sc = xsc;
6562	uint16_t val;
6563
6564	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6565	val = bwi_led_onoff(sc->sc_blink_led, val, 0);
6566	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6567
6568	timeout_add(&sc->sc_led_blink_end_ch, sc->sc_led_blink_offdur);
6569}
6570
6571void
6572bwi_led_blink_end(void *xsc)
6573{
6574	struct bwi_softc *sc = xsc;
6575
6576	sc->sc_led_blinking = 0;
6577}
6578
6579int
6580bwi_bbp_attach(struct bwi_softc *sc)
6581{
6582#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
6583	uint16_t bbp_id, rw_type;
6584	uint8_t rw_rev;
6585	uint32_t info;
6586	int error, nregwin, i;
6587
6588	/*
6589	 * Get 0th regwin information
6590	 * NOTE: 0th regwin should exist
6591	 */
6592	error = bwi_regwin_select(sc, 0);
6593	if (error) {
6594		printf("%s: can't select regwin 0\n", sc->sc_dev.dv_xname);
6595		return (error);
6596	}
6597	bwi_regwin_info(sc, &rw_type, &rw_rev);
6598
6599	/*
6600	 * Find out BBP id
6601	 */
6602	bbp_id = 0;
6603	info = 0;
6604	if (rw_type == BWI_REGWIN_T_COM) {
6605		info = CSR_READ_4(sc, BWI_INFO);
6606		bbp_id = __SHIFTOUT(info, BWI_INFO_BBPID_MASK);
6607
6608		BWI_CREATE_REGWIN(&sc->sc_com_regwin, 0, rw_type, rw_rev);
6609
6610		sc->sc_cap = CSR_READ_4(sc, BWI_CAPABILITY);
6611	} else {
6612		uint16_t did = sc->sc_pci_did;
6613		uint8_t revid = sc->sc_pci_revid;
6614
6615		for (i = 0; i < N(bwi_bbpid_map); ++i) {
6616			if (did >= bwi_bbpid_map[i].did_min &&
6617			    did <= bwi_bbpid_map[i].did_max) {
6618				bbp_id = bwi_bbpid_map[i].bbp_id;
6619				break;
6620			}
6621		}
6622		if (bbp_id == 0) {
6623			printf("%s: no BBP id for device id 0x%04x\n",
6624			    sc->sc_dev.dv_xname, did);
6625			return (ENXIO);
6626		}
6627
6628		info = __SHIFTIN(revid, BWI_INFO_BBPREV_MASK) |
6629		    __SHIFTIN(0, BWI_INFO_BBPPKG_MASK);
6630	}
6631
6632	/*
6633	 * Find out number of regwins
6634	 */
6635	nregwin = 0;
6636	if (rw_type == BWI_REGWIN_T_COM && rw_rev >= 4) {
6637		nregwin = __SHIFTOUT(info, BWI_INFO_NREGWIN_MASK);
6638	} else {
6639		for (i = 0; i < N(bwi_regwin_count); ++i) {
6640			if (bwi_regwin_count[i].bbp_id == bbp_id) {
6641				nregwin = bwi_regwin_count[i].nregwin;
6642				break;
6643			}
6644		}
6645		if (nregwin == 0) {
6646			printf("%s: no number of win for BBP id 0x%04x\n",
6647			    sc->sc_dev.dv_xname, bbp_id);
6648			return (ENXIO);
6649		}
6650	}
6651
6652	/* Record BBP id/rev for later using */
6653	sc->sc_bbp_id = bbp_id;
6654	sc->sc_bbp_rev = __SHIFTOUT(info, BWI_INFO_BBPREV_MASK);
6655	sc->sc_bbp_pkg = __SHIFTOUT(info, BWI_INFO_BBPPKG_MASK);
6656	DPRINTF(1, "%s: BBP id 0x%04x, BBP rev 0x%x, BBP pkg %d\n",
6657	    sc->sc_dev.dv_xname, sc->sc_bbp_id, sc->sc_bbp_rev, sc->sc_bbp_pkg);
6658	DPRINTF(1, "%s: nregwin %d, cap 0x%08x\n",
6659	    sc->sc_dev.dv_xname, nregwin, sc->sc_cap);
6660
6661	/*
6662	 * Create rest of the regwins
6663	 */
6664
6665	/* Don't re-create common regwin, if it is already created */
6666	i = BWI_REGWIN_EXIST(&sc->sc_com_regwin) ? 1 : 0;
6667
6668	for (; i < nregwin; ++i) {
6669		/*
6670		 * Get regwin information
6671		 */
6672		error = bwi_regwin_select(sc, i);
6673		if (error) {
6674			printf("%s: can't select regwin %d\n",
6675			    sc->sc_dev.dv_xname, i);
6676			return (error);
6677		}
6678		bwi_regwin_info(sc, &rw_type, &rw_rev);
6679
6680		/*
6681		 * Try attach:
6682		 * 1) Bus (PCI/PCIE) regwin
6683		 * 2) MAC regwin
6684		 * Ignore rest types of regwin
6685		 */
6686		if (rw_type == BWI_REGWIN_T_BUSPCI ||
6687		    rw_type == BWI_REGWIN_T_BUSPCIE) {
6688			if (BWI_REGWIN_EXIST(&sc->sc_bus_regwin)) {
6689				printf("%s: bus regwin already exists\n",
6690				    sc->sc_dev.dv_xname);
6691			} else {
6692				BWI_CREATE_REGWIN(&sc->sc_bus_regwin, i,
6693				    rw_type, rw_rev);
6694			}
6695		} else if (rw_type == BWI_REGWIN_T_MAC) {
6696			/* XXX ignore return value */
6697			bwi_mac_attach(sc, i, rw_rev);
6698		}
6699	}
6700
6701	/* At least one MAC shold exist */
6702	if (!BWI_REGWIN_EXIST(&sc->sc_mac[0].mac_regwin)) {
6703		printf("%s: no MAC was found\n", sc->sc_dev.dv_xname);
6704		return (ENXIO);
6705	}
6706	KASSERT(sc->sc_nmac > 0);
6707
6708	/* Bus regwin must exist */
6709	if (!BWI_REGWIN_EXIST(&sc->sc_bus_regwin)) {
6710		printf("%s: no bus regwin was found\n", sc->sc_dev.dv_xname);
6711		return (ENXIO);
6712	}
6713
6714	/* Start with first MAC */
6715	error = bwi_regwin_switch(sc, &sc->sc_mac[0].mac_regwin, NULL);
6716	if (error)
6717		return (error);
6718
6719	return (0);
6720#undef N
6721}
6722
6723int
6724bwi_bus_init(struct bwi_softc *sc, struct bwi_mac *mac)
6725{
6726	struct bwi_regwin *old, *bus;
6727	uint32_t val;
6728	int error;
6729
6730	bus = &sc->sc_bus_regwin;
6731	KASSERT(sc->sc_cur_regwin == &mac->mac_regwin);
6732
6733	/*
6734	 * Tell bus to generate requested interrupts
6735	 */
6736	if (bus->rw_rev < 6 && bus->rw_type == BWI_REGWIN_T_BUSPCI) {
6737		/*
6738		 * NOTE: Read BWI_FLAGS from MAC regwin
6739		 */
6740		val = CSR_READ_4(sc, BWI_FLAGS);
6741
6742		error = bwi_regwin_switch(sc, bus, &old);
6743		if (error)
6744			return (error);
6745
6746		CSR_SETBITS_4(sc, BWI_INTRVEC, (val & BWI_FLAGS_INTR_MASK));
6747	} else {
6748		uint32_t mac_mask;
6749
6750		mac_mask = 1 << mac->mac_id;
6751
6752		error = bwi_regwin_switch(sc, bus, &old);
6753		if (error)
6754			return (error);
6755
6756		val = (sc->sc_conf_read)(sc, BWI_PCIR_INTCTL);
6757		val |= mac_mask << 8;
6758		(sc->sc_conf_write)(sc, BWI_PCIR_INTCTL, val);
6759	}
6760
6761	if (sc->sc_flags & BWI_F_BUS_INITED)
6762		goto back;
6763
6764	if (bus->rw_type == BWI_REGWIN_T_BUSPCI) {
6765		/*
6766		 * Enable prefetch and burst
6767		 */
6768		CSR_SETBITS_4(sc, BWI_BUS_CONFIG,
6769		    BWI_BUS_CONFIG_PREFETCH | BWI_BUS_CONFIG_BURST);
6770
6771		if (bus->rw_rev < 5) {
6772			struct bwi_regwin *com = &sc->sc_com_regwin;
6773
6774			/*
6775			 * Configure timeouts for bus operation
6776			 */
6777
6778			/*
6779			 * Set service timeout and request timeout
6780			 */
6781			CSR_SETBITS_4(sc, BWI_CONF_LO,
6782			    __SHIFTIN(BWI_CONF_LO_SERVTO,
6783			    BWI_CONF_LO_SERVTO_MASK) |
6784			    __SHIFTIN(BWI_CONF_LO_REQTO,
6785			    BWI_CONF_LO_REQTO_MASK));
6786
6787			/*
6788			 * If there is common regwin, we switch to that regwin
6789			 * and switch back to bus regwin once we have done.
6790			 */
6791			if (BWI_REGWIN_EXIST(com)) {
6792				error = bwi_regwin_switch(sc, com, NULL);
6793				if (error)
6794					return (error);
6795			}
6796
6797			/* Let bus know what we have changed */
6798			CSR_WRITE_4(sc, BWI_BUS_ADDR, BWI_BUS_ADDR_MAGIC);
6799			CSR_READ_4(sc, BWI_BUS_ADDR); /* Flush */
6800			CSR_WRITE_4(sc, BWI_BUS_DATA, 0);
6801			CSR_READ_4(sc, BWI_BUS_DATA); /* Flush */
6802
6803			if (BWI_REGWIN_EXIST(com)) {
6804				error = bwi_regwin_switch(sc, bus, NULL);
6805				if (error)
6806					return (error);
6807			}
6808		} else if (bus->rw_rev >= 11) {
6809			/*
6810			 * Enable memory read multiple
6811			 */
6812			CSR_SETBITS_4(sc, BWI_BUS_CONFIG, BWI_BUS_CONFIG_MRM);
6813		}
6814	} else {
6815		/* TODO: PCIE */
6816	}
6817
6818	sc->sc_flags |= BWI_F_BUS_INITED;
6819back:
6820	return (bwi_regwin_switch(sc, old, NULL));
6821}
6822
6823void
6824bwi_get_card_flags(struct bwi_softc *sc)
6825{
6826	sc->sc_card_flags = bwi_read_sprom(sc, BWI_SPROM_CARD_FLAGS);
6827	if (sc->sc_card_flags == 0xffff)
6828		sc->sc_card_flags = 0;
6829
6830	if (sc->sc_pci_subvid == PCI_VENDOR_APPLE &&
6831	    sc->sc_pci_subdid == 0x4e && /* XXX */
6832	    sc->sc_pci_revid > 0x40)
6833		sc->sc_card_flags |= BWI_CARD_F_PA_GPIO9;
6834
6835	DPRINTF(1, "%s: card flags 0x%04x\n",
6836	    sc->sc_dev.dv_xname, sc->sc_card_flags);
6837}
6838
6839void
6840bwi_get_eaddr(struct bwi_softc *sc, uint16_t eaddr_ofs, uint8_t *eaddr)
6841{
6842	int i;
6843
6844	for (i = 0; i < 3; ++i) {
6845		*((uint16_t *)eaddr + i) =
6846		    htobe16(bwi_read_sprom(sc, eaddr_ofs + 2 * i));
6847	}
6848}
6849
6850void
6851bwi_get_clock_freq(struct bwi_softc *sc, struct bwi_clock_freq *freq)
6852{
6853	struct bwi_regwin *com;
6854	uint32_t val;
6855	uint div;
6856	int src;
6857
6858	bzero(freq, sizeof(*freq));
6859	com = &sc->sc_com_regwin;
6860
6861	KASSERT(BWI_REGWIN_EXIST(com));
6862	KASSERT(sc->sc_cur_regwin == com);
6863	KASSERT(sc->sc_cap & BWI_CAP_CLKMODE);
6864
6865	/*
6866	 * Calculate clock frequency
6867	 */
6868	src = -1;
6869	div = 0;
6870	if (com->rw_rev < 6) {
6871		val = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6872		if (val & BWI_PCIM_GPIO_OUT_CLKSRC) {
6873			src = BWI_CLKSRC_PCI;
6874			div = 64;
6875		} else {
6876			src = BWI_CLKSRC_CS_OSC;
6877			div = 32;
6878		}
6879	} else if (com->rw_rev < 10) {
6880		val = CSR_READ_4(sc, BWI_CLOCK_CTRL);
6881
6882		src = __SHIFTOUT(val, BWI_CLOCK_CTRL_CLKSRC);
6883		if (src == BWI_CLKSRC_LP_OSC)
6884			div = 1;
6885		else {
6886			div = (__SHIFTOUT(val, BWI_CLOCK_CTRL_FDIV) + 1) << 2;
6887
6888			/* Unknown source */
6889			if (src >= BWI_CLKSRC_MAX)
6890				src = BWI_CLKSRC_CS_OSC;
6891		}
6892	} else {
6893		val = CSR_READ_4(sc, BWI_CLOCK_INFO);
6894
6895		src = BWI_CLKSRC_CS_OSC;
6896		div = (__SHIFTOUT(val, BWI_CLOCK_INFO_FDIV) + 1) << 2;
6897	}
6898
6899	KASSERT(src >= 0 && src < BWI_CLKSRC_MAX);
6900	KASSERT(div != 0);
6901
6902	DPRINTF(1, "%s: clksrc %s\n",
6903	    sc->sc_dev.dv_xname,
6904	    src == BWI_CLKSRC_PCI ? "PCI" :
6905	    (src == BWI_CLKSRC_LP_OSC ? "LP_OSC" : "CS_OSC"));
6906
6907	freq->clkfreq_min = bwi_clkfreq[src].freq_min / div;
6908	freq->clkfreq_max = bwi_clkfreq[src].freq_max / div;
6909
6910	DPRINTF(1, "%s: clkfreq min %u, max %u\n",
6911	    sc->sc_dev.dv_xname, freq->clkfreq_min, freq->clkfreq_max);
6912}
6913
6914int
6915bwi_set_clock_mode(struct bwi_softc *sc, enum bwi_clock_mode clk_mode)
6916{
6917	struct bwi_regwin *old, *com;
6918	uint32_t clk_ctrl, clk_src;
6919	int error, pwr_off = 0;
6920
6921	com = &sc->sc_com_regwin;
6922	if (!BWI_REGWIN_EXIST(com))
6923		return (0);
6924
6925	if (com->rw_rev >= 10 || com->rw_rev < 6)
6926		return (0);
6927
6928	/*
6929	 * For common regwin whose rev is [6, 10), the chip
6930	 * must be capable to change clock mode.
6931	 */
6932	if ((sc->sc_cap & BWI_CAP_CLKMODE) == 0)
6933		return (0);
6934
6935	error = bwi_regwin_switch(sc, com, &old);
6936	if (error)
6937		return (error);
6938
6939	if (clk_mode == BWI_CLOCK_MODE_FAST)
6940		bwi_power_on(sc, 0);	/* Don't turn on PLL */
6941
6942	clk_ctrl = CSR_READ_4(sc, BWI_CLOCK_CTRL);
6943	clk_src = __SHIFTOUT(clk_ctrl, BWI_CLOCK_CTRL_CLKSRC);
6944
6945	switch (clk_mode) {
6946	case BWI_CLOCK_MODE_FAST:
6947		clk_ctrl &= ~BWI_CLOCK_CTRL_SLOW;
6948		clk_ctrl |= BWI_CLOCK_CTRL_IGNPLL;
6949		break;
6950	case BWI_CLOCK_MODE_SLOW:
6951		clk_ctrl |= BWI_CLOCK_CTRL_SLOW;
6952		break;
6953	case BWI_CLOCK_MODE_DYN:
6954		clk_ctrl &= ~(BWI_CLOCK_CTRL_SLOW |
6955		    BWI_CLOCK_CTRL_IGNPLL |
6956		    BWI_CLOCK_CTRL_NODYN);
6957		if (clk_src != BWI_CLKSRC_CS_OSC) {
6958			clk_ctrl |= BWI_CLOCK_CTRL_NODYN;
6959			pwr_off = 1;
6960		}
6961		break;
6962	}
6963	CSR_WRITE_4(sc, BWI_CLOCK_CTRL, clk_ctrl);
6964
6965	if (pwr_off)
6966		bwi_power_off(sc, 0);	/* Leave PLL as it is */
6967
6968	return (bwi_regwin_switch(sc, old, NULL));
6969}
6970
6971int
6972bwi_set_clock_delay(struct bwi_softc *sc)
6973{
6974	struct bwi_regwin *old, *com;
6975	int error;
6976
6977	com = &sc->sc_com_regwin;
6978	if (!BWI_REGWIN_EXIST(com))
6979		return (0);
6980
6981	error = bwi_regwin_switch(sc, com, &old);
6982	if (error)
6983		return (error);
6984
6985	if (sc->sc_bbp_id == BWI_BBPID_BCM4321) {
6986		if (sc->sc_bbp_rev == 0)
6987			CSR_WRITE_4(sc, BWI_CONTROL, BWI_CONTROL_MAGIC0);
6988		else if (sc->sc_bbp_rev == 1)
6989			CSR_WRITE_4(sc, BWI_CONTROL, BWI_CONTROL_MAGIC1);
6990	}
6991
6992	if (sc->sc_cap & BWI_CAP_CLKMODE) {
6993		if (com->rw_rev >= 10)
6994			CSR_FILT_SETBITS_4(sc, BWI_CLOCK_INFO, 0xffff, 0x40000);
6995		else {
6996			struct bwi_clock_freq freq;
6997
6998			bwi_get_clock_freq(sc, &freq);
6999			CSR_WRITE_4(sc, BWI_PLL_ON_DELAY,
7000			    howmany(freq.clkfreq_max * 150, 1000000));
7001			CSR_WRITE_4(sc, BWI_FREQ_SEL_DELAY,
7002			    howmany(freq.clkfreq_max * 15, 1000000));
7003		}
7004	}
7005
7006	return (bwi_regwin_switch(sc, old, NULL));
7007}
7008
7009int
7010bwi_init(struct ifnet *ifp)
7011{
7012	struct bwi_softc *sc = ifp->if_softc;
7013
7014	bwi_init_statechg(sc, 1);
7015
7016	return (0);
7017}
7018
7019void
7020bwi_init_statechg(struct bwi_softc *sc, int statechg)
7021{
7022	struct ieee80211com *ic = &sc->sc_ic;
7023	struct ifnet *ifp = &ic->ic_if;
7024	struct bwi_mac *mac;
7025	int error;
7026
7027	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7028
7029	error = bwi_stop(sc, statechg);
7030	if (error) {
7031		DPRINTF(1, "%s: can't stop\n", sc->sc_dev.dv_xname);
7032		return;
7033	}
7034
7035	/* power on cardbus socket */
7036	if (sc->sc_enable != NULL)
7037		(*sc->sc_enable)(sc);
7038
7039	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
7040
7041	/* TODO: 2 MAC */
7042
7043	mac = &sc->sc_mac[0];
7044	error = bwi_regwin_switch(sc, &mac->mac_regwin, NULL);
7045	if (error)
7046		goto back;
7047
7048	error = bwi_mac_init(mac);
7049	if (error)
7050		goto back;
7051
7052	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_DYN);
7053
7054	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
7055
7056	bwi_set_bssid(sc, bwi_zero_addr);	/* Clear BSSID */
7057	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_MYADDR, ic->ic_myaddr);
7058
7059	bwi_mac_reset_hwkeys(mac);
7060
7061	if ((mac->mac_flags & BWI_MAC_F_HAS_TXSTATS) == 0) {
7062		int i;
7063
7064#define NRETRY	1000
7065		/*
7066		 * Drain any possible pending TX status
7067		 */
7068		for (i = 0; i < NRETRY; ++i) {
7069			if ((CSR_READ_4(sc, BWI_TXSTATUS_0) &
7070			     BWI_TXSTATUS_0_MORE) == 0)
7071				break;
7072			CSR_READ_4(sc, BWI_TXSTATUS_1);
7073		}
7074		if (i == NRETRY)
7075			printf("%s: can't drain TX status\n",
7076			    sc->sc_dev.dv_xname);
7077#undef NRETRY
7078	}
7079
7080	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11G)
7081		bwi_mac_updateslot(mac, 1);
7082
7083	/* Start MAC */
7084	error = bwi_mac_start(mac);
7085	if (error)
7086		goto back;
7087
7088	/* Enable intrs */
7089	bwi_enable_intrs(sc, BWI_INIT_INTRS);
7090
7091	ifp->if_flags |= IFF_RUNNING;
7092	ifp->if_flags &= ~IFF_OACTIVE;
7093
7094	if (statechg) {
7095		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
7096			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
7097		} else {
7098			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
7099		}
7100	} else {
7101		ieee80211_new_state(ic, ic->ic_state, -1);
7102	}
7103
7104back:
7105	if (error)
7106		bwi_stop(sc, 1);
7107	else
7108		bwi_start(ifp);
7109}
7110
7111int
7112bwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
7113{
7114	struct bwi_softc *sc = ifp->if_softc;
7115	struct ieee80211com *ic = &sc->sc_ic;
7116	struct ifaddr *ifa;
7117	struct ifreq *ifr;
7118	int s, error = 0;
7119	uint8_t chan;
7120
7121	s = splnet();
7122
7123	switch (cmd) {
7124	case SIOCSIFADDR:
7125		ifa = (struct ifaddr *)data;
7126		ifp->if_flags |= IFF_UP;
7127#ifdef INET
7128		if (ifa->ifa_addr->sa_family == AF_INET)
7129			arp_ifinit(&ic->ic_ac, ifa);
7130#endif
7131		/* FALLTHROUGH */
7132	case SIOCSIFFLAGS:
7133		if (ifp->if_flags & IFF_UP) {
7134			if ((ifp->if_flags & IFF_RUNNING) == 0)
7135				bwi_init(ifp);
7136		} else {
7137			if (ifp->if_flags & IFF_RUNNING)
7138				bwi_stop(sc, 1);
7139		}
7140		break;
7141        case SIOCADDMULTI:
7142        case SIOCDELMULTI:
7143		ifr = (struct ifreq *)data;
7144		error = (cmd == SIOCADDMULTI) ?
7145		    ether_addmulti(ifr, &ic->ic_ac) :
7146		    ether_delmulti(ifr, &ic->ic_ac);
7147
7148		if (error == ENETRESET)
7149			error = 0;
7150		break;
7151	case SIOCS80211CHANNEL:
7152		/* allow fast channel switching in monitor mode */
7153		error = ieee80211_ioctl(ifp, cmd, data);
7154		if (error == ENETRESET &&
7155		    ic->ic_opmode == IEEE80211_M_MONITOR) {
7156			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
7157			    (IFF_UP | IFF_RUNNING)) {
7158				ic->ic_bss->ni_chan = ic->ic_ibss_chan;
7159				chan = ieee80211_chan2ieee(ic,
7160				    ic->ic_bss->ni_chan);
7161				bwi_set_chan(sc, chan);
7162			}
7163			error = 0;
7164		}
7165		break;
7166	default:
7167		error = ieee80211_ioctl(ifp, cmd, data);
7168		break;
7169	}
7170
7171	if (error == ENETRESET) {
7172		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
7173		    (IFF_UP | IFF_RUNNING))
7174			bwi_init(ifp);
7175		error = 0;
7176	}
7177
7178	splx(s);
7179
7180	return (error);
7181}
7182
7183void
7184bwi_start(struct ifnet *ifp)
7185{
7186	struct bwi_softc *sc = ifp->if_softc;
7187	struct ieee80211com *ic = &sc->sc_ic;
7188	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
7189	int trans, idx;
7190
7191	if ((ifp->if_flags & IFF_OACTIVE) || (ifp->if_flags & IFF_RUNNING) == 0)
7192		return;
7193
7194	trans = 0;
7195	idx = tbd->tbd_idx;
7196
7197	while (tbd->tbd_buf[idx].tb_mbuf == NULL) {
7198		struct ieee80211_frame *wh;
7199		struct ieee80211_node *ni;
7200		struct ieee80211_key *k;
7201		struct mbuf *m;
7202		int mgt_pkt = 0;
7203
7204		IF_POLL(&ic->ic_mgtq, m);
7205		if (m != NULL) {
7206			IF_DEQUEUE(&ic->ic_mgtq, m);
7207
7208			ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
7209			m->m_pkthdr.rcvif = NULL;
7210
7211			mgt_pkt = 1;
7212		} else {
7213			struct ether_header *eh;
7214
7215			if (ic->ic_state != IEEE80211_S_RUN)
7216				break;
7217
7218			IFQ_POLL(&ifp->if_snd, m);
7219			if (m == NULL)
7220				break;
7221
7222			IFQ_DEQUEUE(&ifp->if_snd, m);
7223
7224			if (m->m_len < sizeof(*eh)) {
7225				m = m_pullup(m, sizeof(*eh));
7226				if (m == NULL) {
7227					ifp->if_oerrors++;
7228					continue;
7229				}
7230			}
7231			eh = mtod(m, struct ether_header *);
7232
7233			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
7234			if (ni == NULL) {
7235				m_freem(m);
7236				ifp->if_oerrors++;
7237				continue;
7238			}
7239
7240			/* TODO: PS */
7241#if NBPFILTER > 0
7242			if (ifp->if_bpf != NULL)
7243				bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
7244#endif
7245			m = ieee80211_encap(ifp, m, &ni);
7246			if (m == NULL)
7247				continue;
7248		}
7249#if NBPFILTER > 0
7250		if (ic->ic_rawbpf != NULL)
7251			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
7252#endif
7253		wh = mtod(m, struct ieee80211_frame *);
7254		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
7255			k = ieee80211_get_txkey(ic, wh, ni);
7256			if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
7257				return;
7258		}
7259		wh = NULL;	/* Catch any invalid use */
7260
7261		if (mgt_pkt) {
7262			ieee80211_release_node(ic, ni);
7263			ni = NULL;
7264		}
7265
7266		if (bwi_encap(sc, idx, m, ni) != 0) {
7267			/* 'm' is freed in bwi_encap() if we reach here */
7268			if (ni != NULL)
7269				ieee80211_release_node(ic, ni);
7270			ifp->if_oerrors++;
7271			continue;
7272		}
7273
7274		trans = 1;
7275		tbd->tbd_used++;
7276		idx = (idx + 1) % BWI_TX_NDESC;
7277
7278		if (tbd->tbd_used + BWI_TX_NSPRDESC >= BWI_TX_NDESC) {
7279			ifp->if_flags |= IFF_OACTIVE;
7280			break;
7281		}
7282	}
7283	tbd->tbd_idx = idx;
7284
7285	if (trans)
7286		sc->sc_tx_timer = 5;
7287	ifp->if_timer = 1;
7288}
7289
7290void
7291bwi_watchdog(struct ifnet *ifp)
7292{
7293	struct bwi_softc *sc = ifp->if_softc;
7294
7295	ifp->if_timer = 0;
7296
7297	if ((ifp->if_flags & IFF_RUNNING) == 0)
7298		return;
7299
7300	if (sc->sc_tx_timer) {
7301		if (--sc->sc_tx_timer == 0) {
7302			printf("%s: watchdog timeout\n",
7303			    sc->sc_dev.dv_xname);
7304			ifp->if_oerrors++;
7305			/* TODO */
7306		} else
7307			ifp->if_timer = 1;
7308	}
7309
7310	ieee80211_watchdog(ifp);
7311}
7312
7313void
7314bwi_newstate_begin(struct bwi_softc *sc, enum ieee80211_state nstate)
7315{
7316	timeout_del(&sc->sc_scan_ch);
7317	timeout_del(&sc->sc_calib_ch);
7318
7319	bwi_led_newstate(sc, nstate);
7320
7321	if (nstate == IEEE80211_S_INIT)
7322		sc->sc_txpwrcb_type = BWI_TXPWR_INIT;
7323}
7324
7325int
7326bwi_stop(struct bwi_softc *sc, int state_chg)
7327{
7328	struct ieee80211com *ic = &sc->sc_ic;
7329	struct ifnet *ifp = &ic->ic_if;
7330	struct bwi_mac *mac;
7331	int i, error, pwr_off = 0;
7332
7333	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7334
7335	if (state_chg)
7336		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
7337	else
7338		bwi_newstate_begin(sc, IEEE80211_S_INIT);
7339
7340	if (ifp->if_flags & IFF_RUNNING) {
7341		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
7342		mac = (struct bwi_mac *)sc->sc_cur_regwin;
7343
7344		bwi_disable_intrs(sc, BWI_ALL_INTRS);
7345		CSR_READ_4(sc, BWI_MAC_INTR_MASK);
7346		bwi_mac_stop(mac);
7347	}
7348
7349	for (i = 0; i < sc->sc_nmac; ++i) {
7350		struct bwi_regwin *old_rw;
7351
7352		mac = &sc->sc_mac[i];
7353		if ((mac->mac_flags & BWI_MAC_F_INITED) == 0)
7354			continue;
7355
7356		error = bwi_regwin_switch(sc, &mac->mac_regwin, &old_rw);
7357		if (error)
7358			continue;
7359
7360		bwi_mac_shutdown(mac);
7361		pwr_off = 1;
7362
7363		bwi_regwin_switch(sc, old_rw, NULL);
7364	}
7365
7366	if (pwr_off)
7367		bwi_bbp_power_off(sc);
7368
7369	sc->sc_tx_timer = 0;
7370	ifp->if_timer = 0;
7371	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
7372
7373	/* power off cardbus socket */
7374	if (sc->sc_disable)
7375		sc->sc_disable(sc);
7376
7377	return (0);
7378}
7379
7380int
7381bwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
7382{
7383	struct bwi_softc *sc = ic->ic_if.if_softc;
7384	struct ieee80211_node *ni;
7385	int error;
7386	uint8_t chan;
7387
7388	timeout_del(&sc->sc_amrr_ch);
7389
7390	bwi_newstate_begin(sc, nstate);
7391
7392	if (nstate == IEEE80211_S_INIT)
7393		goto back;
7394
7395	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
7396	error = bwi_set_chan(sc, chan);
7397	if (error) {
7398		printf("%s: can't set channel to %u\n",
7399		    sc->sc_dev.dv_xname,
7400		    ieee80211_chan2ieee(ic, ic->ic_des_chan));
7401		return (error);
7402	}
7403
7404	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
7405		/* Nothing to do */
7406	} else if (nstate == IEEE80211_S_RUN) {
7407		struct bwi_mac *mac;
7408
7409		ni = ic->ic_bss;
7410
7411		bwi_set_bssid(sc, ic->ic_bss->ni_bssid);
7412
7413		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
7414		mac = (struct bwi_mac *)sc->sc_cur_regwin;
7415
7416		/* Initial TX power calibration */
7417		bwi_mac_calibrate_txpower(mac, BWI_TXPWR_INIT);
7418#ifdef notyet
7419		sc->sc_txpwrcb_type = BWI_TXPWR_FORCE;
7420#else
7421		sc->sc_txpwrcb_type = BWI_TXPWR_CALIB;
7422#endif
7423		if (ic->ic_opmode == IEEE80211_M_STA) {
7424			/* fake a join to init the tx rate */
7425			bwi_newassoc(ic, ni, 1);
7426		}
7427
7428		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
7429			/* start automatic rate control timer */
7430			if (ic->ic_fixed_rate == -1)
7431				timeout_add(&sc->sc_amrr_ch, hz / 2);
7432		}
7433	} else
7434		bwi_set_bssid(sc, bwi_zero_addr);
7435
7436back:
7437	error = sc->sc_newstate(ic, nstate, arg);
7438
7439	if (nstate == IEEE80211_S_SCAN) {
7440		timeout_add(&sc->sc_scan_ch, (sc->sc_dwell_time * hz) / 1000);
7441	} else if (nstate == IEEE80211_S_RUN) {
7442		/* XXX 15 seconds */
7443		timeout_add(&sc->sc_calib_ch, hz);
7444	}
7445
7446	return (error);
7447}
7448
7449int
7450bwi_media_change(struct ifnet *ifp)
7451{
7452	int error;
7453
7454	error = ieee80211_media_change(ifp);
7455	if (error != ENETRESET)
7456		return (error);
7457
7458	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
7459		bwi_init(ifp);
7460
7461	return (0);
7462}
7463
7464void
7465bwi_iter_func(void *arg, struct ieee80211_node *ni)
7466{
7467	struct bwi_softc *sc = arg;
7468	struct bwi_node *bn = (struct bwi_node *)ni;
7469
7470	ieee80211_amrr_choose(&sc->sc_amrr, ni, &bn->amn);
7471}
7472
7473void
7474bwi_amrr_timeout(void *arg)
7475{
7476	struct bwi_softc *sc = arg;
7477	struct ieee80211com *ic = &sc->sc_ic;
7478
7479	if (ic->ic_opmode == IEEE80211_M_STA)
7480		bwi_iter_func(sc, ic->ic_bss);
7481	else
7482		ieee80211_iterate_nodes(ic, bwi_iter_func, sc);
7483
7484	timeout_add(&sc->sc_amrr_ch, hz / 2);
7485}
7486
7487void
7488bwi_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
7489{
7490	struct bwi_softc *sc = ic->ic_if.if_softc;
7491	int i;
7492
7493	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7494
7495	ieee80211_amrr_node_init(&sc->sc_amrr, &((struct bwi_node *)ni)->amn);
7496
7497	/* set rate to some reasonable initial value */
7498	for (i = ni->ni_rates.rs_nrates - 1;
7499	    i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
7500	    i--);
7501
7502	ni->ni_txrate = i;
7503}
7504
7505int
7506bwi_dma_alloc(struct bwi_softc *sc)
7507{
7508	int error, i, has_txstats;
7509	bus_size_t tx_ring_sz, rx_ring_sz, desc_sz = 0;
7510	uint32_t txrx_ctrl_step = 0;
7511
7512	has_txstats = 0;
7513	for (i = 0; i < sc->sc_nmac; ++i) {
7514		if (sc->sc_mac[i].mac_flags & BWI_MAC_F_HAS_TXSTATS) {
7515			has_txstats = 1;
7516			break;
7517		}
7518	}
7519
7520	switch (sc->sc_bus_space) {
7521	case BWI_BUS_SPACE_30BIT:
7522	case BWI_BUS_SPACE_32BIT:
7523		desc_sz = sizeof(struct bwi_desc32);
7524		txrx_ctrl_step = 0x20;
7525
7526		sc->sc_init_tx_ring = bwi_init_tx_ring32;
7527		sc->sc_free_tx_ring = bwi_free_tx_ring32;
7528		sc->sc_init_rx_ring = bwi_init_rx_ring32;
7529		sc->sc_free_rx_ring = bwi_free_rx_ring32;
7530		sc->sc_setup_rxdesc = bwi_setup_rx_desc32;
7531		sc->sc_setup_txdesc = bwi_setup_tx_desc32;
7532		sc->sc_rxeof = bwi_rxeof32;
7533		sc->sc_start_tx = bwi_start_tx32;
7534		if (has_txstats) {
7535			sc->sc_init_txstats = bwi_init_txstats32;
7536			sc->sc_free_txstats = bwi_free_txstats32;
7537			sc->sc_txeof_status = bwi_txeof_status32;
7538		}
7539		break;
7540
7541	case BWI_BUS_SPACE_64BIT:
7542		desc_sz = sizeof(struct bwi_desc64);
7543		txrx_ctrl_step = 0x40;
7544
7545		sc->sc_init_tx_ring = bwi_init_tx_ring64;
7546		sc->sc_free_tx_ring = bwi_free_tx_ring64;
7547		sc->sc_init_rx_ring = bwi_init_rx_ring64;
7548		sc->sc_free_rx_ring = bwi_free_rx_ring64;
7549		sc->sc_setup_rxdesc = bwi_setup_rx_desc64;
7550		sc->sc_setup_txdesc = bwi_setup_tx_desc64;
7551		sc->sc_rxeof = bwi_rxeof64;
7552		sc->sc_start_tx = bwi_start_tx64;
7553		if (has_txstats) {
7554			sc->sc_init_txstats = bwi_init_txstats64;
7555			sc->sc_free_txstats = bwi_free_txstats64;
7556			sc->sc_txeof_status = bwi_txeof_status64;
7557		}
7558		break;
7559	}
7560
7561	KASSERT(desc_sz != 0);
7562	KASSERT(txrx_ctrl_step != 0);
7563
7564	tx_ring_sz = roundup(desc_sz * BWI_TX_NDESC, BWI_RING_ALIGN);
7565	rx_ring_sz = roundup(desc_sz * BWI_RX_NDESC, BWI_RING_ALIGN);
7566
7567#define TXRX_CTRL(idx)	(BWI_TXRX_CTRL_BASE + (idx) * txrx_ctrl_step)
7568	/*
7569	 * Create TX ring DMA stuffs
7570	 */
7571	for (i = 0; i < BWI_TX_NRING; ++i) {
7572		error = bus_dmamap_create(sc->sc_dmat, tx_ring_sz, 1,
7573		    tx_ring_sz, 0, BUS_DMA_NOWAIT,
7574		    &sc->sc_tx_rdata[i].rdata_dmap);
7575		if (error) {
7576			printf("%s: %dth TX ring DMA create failed\n",
7577			    sc->sc_dev.dv_xname, i);
7578			return (error);
7579		}
7580		error = bwi_dma_ring_alloc(sc,
7581		    &sc->sc_tx_rdata[i], tx_ring_sz, TXRX_CTRL(i));
7582		if (error) {
7583			printf("%s: %dth TX ring DMA alloc failed\n",
7584			    sc->sc_dev.dv_xname, i);
7585			return (error);
7586		}
7587	}
7588
7589	/*
7590	 * Create RX ring DMA stuffs
7591	 */
7592	error = bus_dmamap_create(sc->sc_dmat, rx_ring_sz, 1,
7593	    rx_ring_sz, 0, BUS_DMA_NOWAIT,
7594	    &sc->sc_rx_rdata.rdata_dmap);
7595	if (error) {
7596		printf("%s: RX ring DMA create failed\n", sc->sc_dev.dv_xname);
7597		return (error);
7598	}
7599
7600	error = bwi_dma_ring_alloc(sc, &sc->sc_rx_rdata,
7601	    rx_ring_sz, TXRX_CTRL(0));
7602	if (error) {
7603		printf("%s: RX ring DMA alloc failed\n", sc->sc_dev.dv_xname);
7604		return (error);
7605	}
7606
7607	if (has_txstats) {
7608		error = bwi_dma_txstats_alloc(sc, TXRX_CTRL(3), desc_sz);
7609		if (error) {
7610			printf("%s: TX stats DMA alloc failed\n",
7611			    sc->sc_dev.dv_xname);
7612			return (error);
7613		}
7614	}
7615#undef TXRX_CTRL
7616
7617	return (bwi_dma_mbuf_create(sc));
7618}
7619
7620void
7621bwi_dma_free(struct bwi_softc *sc)
7622{
7623	int i;
7624
7625	for (i = 0; i < BWI_TX_NRING; ++i) {
7626		struct bwi_ring_data *rd = &sc->sc_tx_rdata[i];
7627
7628		if (rd->rdata_desc != NULL) {
7629			bus_dmamap_unload(sc->sc_dmat,
7630			    rd->rdata_dmap);
7631			bus_dmamem_free(sc->sc_dmat,
7632			    &rd->rdata_seg, 1);
7633		}
7634	}
7635
7636	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
7637
7638	if (rd->rdata_desc != NULL) {
7639		bus_dmamap_unload(sc->sc_dmat, rd->rdata_dmap);
7640		bus_dmamem_free(sc->sc_dmat, &rd->rdata_seg, 1);
7641	}
7642
7643	bwi_dma_txstats_free(sc);
7644	bwi_dma_mbuf_destroy(sc, BWI_TX_NRING, 1);
7645}
7646
7647int
7648bwi_dma_ring_alloc(struct bwi_softc *sc,
7649    struct bwi_ring_data *rd, bus_size_t size, uint32_t txrx_ctrl)
7650{
7651	int error, nsegs;
7652
7653	error = bus_dmamem_alloc(sc->sc_dmat, size, BWI_ALIGN, 0,
7654	    &rd->rdata_seg, 1, &nsegs, BUS_DMA_NOWAIT);
7655	if (error) {
7656		printf("%s: can't allocate DMA mem\n", sc->sc_dev.dv_xname);
7657		return (error);
7658	}
7659
7660	error = bus_dmamem_map(sc->sc_dmat, &rd->rdata_seg, nsegs,
7661	    size, (caddr_t *)&rd->rdata_desc, BUS_DMA_NOWAIT);
7662	if (error) {
7663		printf("%s: can't map DMA mem\n", sc->sc_dev.dv_xname);
7664		return (error);
7665	}
7666
7667	error = bus_dmamap_load(sc->sc_dmat, rd->rdata_dmap, rd->rdata_desc,
7668	    size, NULL, BUS_DMA_WAITOK);
7669	if (error) {
7670		printf("%s: can't load DMA mem\n", sc->sc_dev.dv_xname);
7671		bus_dmamem_free(sc->sc_dmat, &rd->rdata_seg, nsegs);
7672		rd->rdata_desc = NULL;
7673		return (error);
7674	}
7675
7676	rd->rdata_paddr = rd->rdata_dmap->dm_segs[0].ds_addr;
7677	rd->rdata_txrx_ctrl = txrx_ctrl;
7678
7679	return (0);
7680}
7681
7682int
7683bwi_dma_txstats_alloc(struct bwi_softc *sc, uint32_t ctrl_base,
7684    bus_size_t desc_sz)
7685{
7686	struct bwi_txstats_data *st;
7687	bus_size_t dma_size;
7688	int error, nsegs;
7689
7690	st = malloc(sizeof(*st), M_DEVBUF, M_WAITOK | M_ZERO);
7691	sc->sc_txstats = st;
7692
7693	/*
7694	 * Create TX stats descriptor DMA stuffs
7695	 */
7696	dma_size = roundup(desc_sz * BWI_TXSTATS_NDESC, BWI_RING_ALIGN);
7697
7698	error = bus_dmamap_create(sc->sc_dmat, dma_size, 1, dma_size, 0,
7699	    BUS_DMA_NOWAIT, &st->stats_ring_dmap);
7700	if (error) {
7701		printf("%s: can't create txstats ring DMA mem\n",
7702		    sc->sc_dev.dv_xname);
7703		return (error);
7704	}
7705
7706	error = bus_dmamem_alloc(sc->sc_dmat, dma_size, BWI_RING_ALIGN, 0,
7707	     &st->stats_ring_seg, 1, &nsegs, BUS_DMA_NOWAIT);
7708	if (error) {
7709		printf("%s: can't allocate txstats ring DMA mem\n",
7710		    sc->sc_dev.dv_xname);
7711		return (error);
7712	}
7713
7714	error = bus_dmamem_map(sc->sc_dmat, &st->stats_ring_seg, nsegs,
7715	    dma_size, (caddr_t *)&st->stats_ring, BUS_DMA_NOWAIT);
7716	if (error) {
7717		printf("%s: can't map txstats ring DMA mem\n",
7718		    sc->sc_dev.dv_xname);
7719		return (error);
7720	}
7721
7722	error = bus_dmamap_load(sc->sc_dmat, st->stats_ring_dmap,
7723	    st->stats_ring, dma_size, NULL, BUS_DMA_WAITOK);
7724	if (error) {
7725		printf("%s: can't load txstats ring DMA mem\n",
7726		    sc->sc_dev.dv_xname);
7727		bus_dmamem_free(sc->sc_dmat, &st->stats_ring_seg, nsegs);
7728		return (error);
7729	}
7730
7731	bzero(st->stats_ring, dma_size);
7732	st->stats_ring_paddr = st->stats_ring_dmap->dm_segs[0].ds_addr;
7733
7734	/*
7735	 * Create TX stats DMA stuffs
7736	 */
7737	dma_size = roundup(sizeof(struct bwi_txstats) * BWI_TXSTATS_NDESC,
7738	    BWI_ALIGN);
7739
7740	error = bus_dmamap_create(sc->sc_dmat, dma_size, 1, dma_size, 0,
7741	    BUS_DMA_NOWAIT, &st->stats_dmap);
7742	if (error) {
7743		printf("%s: can't create txstats ring DMA mem\n",
7744		    sc->sc_dev.dv_xname);
7745		return (error);
7746	}
7747	error = bus_dmamem_alloc(sc->sc_dmat, dma_size, BWI_ALIGN, 0,
7748	    &st->stats_seg, 1, &nsegs, BUS_DMA_NOWAIT);
7749	if (error) {
7750		printf("%s: can't allocate txstats DMA mem\n",
7751		    sc->sc_dev.dv_xname);
7752		return (error);
7753	}
7754
7755	error = bus_dmamem_map(sc->sc_dmat, &st->stats_seg, nsegs,
7756	    dma_size, (caddr_t *)&st->stats, BUS_DMA_NOWAIT);
7757	if (error) {
7758		printf("%s: can't map txstats DMA mem\n", sc->sc_dev.dv_xname);
7759		return (error);
7760	}
7761
7762	error = bus_dmamap_load(sc->sc_dmat, st->stats_dmap, st->stats,
7763	    dma_size, NULL, BUS_DMA_WAITOK);
7764	if (error) {
7765		printf("%s: can't load txstats DMA mem\n", sc->sc_dev.dv_xname);
7766		bus_dmamem_free(sc->sc_dmat, &st->stats_seg, nsegs);
7767		return (error);
7768	}
7769
7770	bzero(st->stats, dma_size);
7771	st->stats_paddr = st->stats_dmap->dm_segs[0].ds_addr;
7772	st->stats_ctrl_base = ctrl_base;
7773
7774	return (0);
7775}
7776
7777void
7778bwi_dma_txstats_free(struct bwi_softc *sc)
7779{
7780	struct bwi_txstats_data *st;
7781
7782	if (sc->sc_txstats == NULL)
7783		return;
7784	st = sc->sc_txstats;
7785
7786	bus_dmamap_unload(sc->sc_dmat, st->stats_ring_dmap);
7787	bus_dmamem_free(sc->sc_dmat, &st->stats_ring_seg, 1);
7788
7789	bus_dmamap_unload(sc->sc_dmat, st->stats_dmap);
7790	bus_dmamem_free(sc->sc_dmat, &st->stats_seg, 1);
7791
7792	free(st, M_DEVBUF);
7793}
7794
7795int
7796bwi_dma_mbuf_create(struct bwi_softc *sc)
7797{
7798	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
7799	int i, j, k, ntx, error;
7800
7801	ntx = 0;
7802
7803	/*
7804	 * Create TX mbuf DMA map
7805	 */
7806	for (i = 0; i < BWI_TX_NRING; ++i) {
7807		struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[i];
7808
7809		for (j = 0; j < BWI_TX_NDESC; ++j) {
7810			error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
7811			    0, BUS_DMA_NOWAIT, &tbd->tbd_buf[j].tb_dmap);
7812			if (error) {
7813				printf(
7814				    "%s: can't create %dth tbd, %dth DMA map\n",
7815				    sc->sc_dev.dv_xname, i, j);
7816				ntx = i;
7817				for (k = 0; k < j; ++k) {
7818					bus_dmamap_destroy(sc->sc_dmat,
7819					    tbd->tbd_buf[k].tb_dmap);
7820				}
7821				goto fail;
7822			}
7823		}
7824	}
7825	ntx = BWI_TX_NRING;
7826
7827	/*
7828	 * Create RX mbuf DMA map and a spare DMA map
7829	 */
7830	error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0,
7831	    BUS_DMA_NOWAIT, &rbd->rbd_tmp_dmap);
7832	if (error) {
7833		printf("%s: can't create spare RX buf DMA map\n",
7834		    sc->sc_dev.dv_xname);
7835		goto fail;
7836	}
7837
7838	for (j = 0; j < BWI_RX_NDESC; ++j) {
7839		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0,
7840		    BUS_DMA_NOWAIT, &rbd->rbd_buf[j].rb_dmap);
7841		if (error) {
7842			printf("%s: can't create %dth RX buf DMA map\n",
7843			    sc->sc_dev.dv_xname, j);
7844
7845			for (k = 0; k < j; ++k) {
7846				bus_dmamap_destroy(sc->sc_dmat,
7847				    rbd->rbd_buf[j].rb_dmap);
7848			}
7849			bus_dmamap_destroy(sc->sc_dmat,
7850			    rbd->rbd_tmp_dmap);
7851			goto fail;
7852		}
7853	}
7854
7855	return 0;
7856fail:
7857	bwi_dma_mbuf_destroy(sc, ntx, 0);
7858
7859	return (error);
7860}
7861
7862void
7863bwi_dma_mbuf_destroy(struct bwi_softc *sc, int ntx, int nrx)
7864{
7865	struct ieee80211com *ic = &sc->sc_ic;
7866	int i, j;
7867
7868	for (i = 0; i < ntx; ++i) {
7869		struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[i];
7870
7871		for (j = 0; j < BWI_TX_NDESC; ++j) {
7872			struct bwi_txbuf *tb = &tbd->tbd_buf[j];
7873
7874			if (tb->tb_mbuf != NULL) {
7875				bus_dmamap_unload(sc->sc_dmat,
7876				    tb->tb_dmap);
7877				m_freem(tb->tb_mbuf);
7878			}
7879			if (tb->tb_ni != NULL)
7880				ieee80211_release_node(ic, tb->tb_ni);
7881			bus_dmamap_destroy(sc->sc_dmat, tb->tb_dmap);
7882		}
7883	}
7884
7885	if (nrx) {
7886		struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
7887
7888		bus_dmamap_destroy(sc->sc_dmat, rbd->rbd_tmp_dmap);
7889		for (j = 0; j < BWI_RX_NDESC; ++j) {
7890			struct bwi_rxbuf *rb = &rbd->rbd_buf[j];
7891
7892			if (rb->rb_mbuf != NULL) {
7893				bus_dmamap_unload(sc->sc_dmat,
7894						  rb->rb_dmap);
7895				m_freem(rb->rb_mbuf);
7896			}
7897			bus_dmamap_destroy(sc->sc_dmat, rb->rb_dmap);
7898		}
7899	}
7900}
7901
7902void
7903bwi_enable_intrs(struct bwi_softc *sc, uint32_t enable_intrs)
7904{
7905	CSR_SETBITS_4(sc, BWI_MAC_INTR_MASK, enable_intrs);
7906}
7907
7908void
7909bwi_disable_intrs(struct bwi_softc *sc, uint32_t disable_intrs)
7910{
7911	CSR_CLRBITS_4(sc, BWI_MAC_INTR_MASK, disable_intrs);
7912}
7913
7914int
7915bwi_init_tx_ring32(struct bwi_softc *sc, int ring_idx)
7916{
7917	struct bwi_ring_data *rd;
7918	struct bwi_txbuf_data *tbd;
7919	uint32_t val, addr_hi, addr_lo;
7920
7921	KASSERT(ring_idx < BWI_TX_NRING);
7922	rd = &sc->sc_tx_rdata[ring_idx];
7923	tbd = &sc->sc_tx_bdata[ring_idx];
7924
7925	tbd->tbd_idx = 0;
7926	tbd->tbd_used = 0;
7927
7928	bzero(rd->rdata_desc, sizeof(struct bwi_desc32) * BWI_TX_NDESC);
7929	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
7930	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
7931
7932	addr_lo = __SHIFTOUT(rd->rdata_paddr, BWI_TXRX32_RINGINFO_ADDR_MASK);
7933	addr_hi = __SHIFTOUT(rd->rdata_paddr, BWI_TXRX32_RINGINFO_FUNC_MASK);
7934
7935	val = __SHIFTIN(addr_lo, BWI_TXRX32_RINGINFO_ADDR_MASK) |
7936	    __SHIFTIN(BWI_TXRX32_RINGINFO_FUNC_TXRX,
7937	    BWI_TXRX32_RINGINFO_FUNC_MASK);
7938	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_RINGINFO, val);
7939
7940	val = __SHIFTIN(addr_hi, BWI_TXRX32_CTRL_ADDRHI_MASK) |
7941	      BWI_TXRX32_CTRL_ENABLE;
7942	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, val);
7943
7944	return (0);
7945}
7946
7947void
7948bwi_init_rxdesc_ring32(struct bwi_softc *sc, uint32_t ctrl_base,
7949    bus_addr_t paddr, int hdr_size, int ndesc)
7950{
7951	uint32_t val, addr_hi, addr_lo;
7952
7953	addr_lo = __SHIFTOUT(paddr, BWI_TXRX32_RINGINFO_ADDR_MASK);
7954	addr_hi = __SHIFTOUT(paddr, BWI_TXRX32_RINGINFO_FUNC_MASK);
7955
7956	val = __SHIFTIN(addr_lo, BWI_TXRX32_RINGINFO_ADDR_MASK) |
7957	    __SHIFTIN(BWI_TXRX32_RINGINFO_FUNC_TXRX,
7958	      		BWI_TXRX32_RINGINFO_FUNC_MASK);
7959	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_RINGINFO, val);
7960
7961	val = __SHIFTIN(hdr_size, BWI_RX32_CTRL_HDRSZ_MASK) |
7962	    __SHIFTIN(addr_hi, BWI_TXRX32_CTRL_ADDRHI_MASK) |
7963	    BWI_TXRX32_CTRL_ENABLE;
7964	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_CTRL, val);
7965
7966	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
7967	    (ndesc - 1) * sizeof(struct bwi_desc32));
7968}
7969
7970int
7971bwi_init_rx_ring32(struct bwi_softc *sc)
7972{
7973	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
7974	int i, error;
7975
7976	sc->sc_rx_bdata.rbd_idx = 0;
7977
7978	for (i = 0; i < BWI_RX_NDESC; ++i) {
7979		error = bwi_newbuf(sc, i, 1);
7980		if (error) {
7981			printf("%s: can't allocate %dth RX buffer\n",
7982			    sc->sc_dev.dv_xname, i);
7983			return (error);
7984		}
7985	}
7986	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
7987	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
7988
7989	bwi_init_rxdesc_ring32(sc, rd->rdata_txrx_ctrl, rd->rdata_paddr,
7990	    sizeof(struct bwi_rxbuf_hdr), BWI_RX_NDESC);
7991	return (0);
7992}
7993
7994int
7995bwi_init_txstats32(struct bwi_softc *sc)
7996{
7997	struct bwi_txstats_data *st = sc->sc_txstats;
7998	bus_addr_t stats_paddr;
7999	int i;
8000
8001	bzero(st->stats, BWI_TXSTATS_NDESC * sizeof(struct bwi_txstats));
8002	bus_dmamap_sync(sc->sc_dmat, st->stats_dmap, 0,
8003	    st->stats_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8004
8005	st->stats_idx = 0;
8006
8007	stats_paddr = st->stats_paddr;
8008	for (i = 0; i < BWI_TXSTATS_NDESC; ++i) {
8009		bwi_setup_desc32(sc, st->stats_ring, BWI_TXSTATS_NDESC, i,
8010				 stats_paddr, sizeof(struct bwi_txstats), 0);
8011		stats_paddr += sizeof(struct bwi_txstats);
8012	}
8013	bus_dmamap_sync(sc->sc_dmat, st->stats_ring_dmap, 0,
8014	    st->stats_ring_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8015
8016	bwi_init_rxdesc_ring32(sc, st->stats_ctrl_base,
8017	    st->stats_ring_paddr, 0, BWI_TXSTATS_NDESC);
8018
8019	return (0);
8020}
8021
8022void
8023bwi_setup_rx_desc32(struct bwi_softc *sc, int buf_idx, bus_addr_t paddr,
8024    int buf_len)
8025{
8026	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8027
8028	KASSERT(buf_idx < BWI_RX_NDESC);
8029	bwi_setup_desc32(sc, rd->rdata_desc, BWI_RX_NDESC, buf_idx,
8030	    paddr, buf_len, 0);
8031}
8032
8033void
8034bwi_setup_tx_desc32(struct bwi_softc *sc, struct bwi_ring_data *rd,
8035    int buf_idx, bus_addr_t paddr, int buf_len)
8036{
8037	KASSERT(buf_idx < BWI_TX_NDESC);
8038	bwi_setup_desc32(sc, rd->rdata_desc, BWI_TX_NDESC, buf_idx,
8039	    paddr, buf_len, 1);
8040}
8041
8042int
8043bwi_init_tx_ring64(struct bwi_softc *sc, int ring_idx)
8044{
8045	/* TODO: 64 */
8046	return (EOPNOTSUPP);
8047}
8048
8049int
8050bwi_init_rx_ring64(struct bwi_softc *sc)
8051{
8052	/* TODO: 64 */
8053	return (EOPNOTSUPP);
8054}
8055
8056int
8057bwi_init_txstats64(struct bwi_softc *sc)
8058{
8059	/* TODO: 64 */
8060	return (EOPNOTSUPP);
8061}
8062
8063void
8064bwi_setup_rx_desc64(struct bwi_softc *sc, int buf_idx, bus_addr_t paddr,
8065    int buf_len)
8066{
8067	/* TODO: 64 */
8068}
8069
8070void
8071bwi_setup_tx_desc64(struct bwi_softc *sc, struct bwi_ring_data *rd,
8072    int buf_idx, bus_addr_t paddr, int buf_len)
8073{
8074	/* TODO: 64 */
8075}
8076
8077int
8078bwi_newbuf(struct bwi_softc *sc, int buf_idx, int init)
8079{
8080	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8081	struct bwi_rxbuf *rxbuf = &rbd->rbd_buf[buf_idx];
8082	struct bwi_rxbuf_hdr *hdr;
8083	bus_dmamap_t map;
8084	bus_addr_t paddr;
8085	struct mbuf *m;
8086	int error;
8087
8088	KASSERT(buf_idx < BWI_RX_NDESC);
8089
8090	MGETHDR(m, init ? M_WAITOK : M_DONTWAIT, MT_DATA);
8091	if (m == NULL)
8092		return (ENOBUFS);
8093	MCLGET(m, init ? M_WAITOK : M_DONTWAIT);
8094	if (m == NULL) {
8095		error = ENOBUFS;
8096
8097		/*
8098		 * If the NIC is up and running, we need to:
8099		 * - Clear RX buffer's header.
8100		 * - Restore RX descriptor settings.
8101		 */
8102		if (init)
8103			return error;
8104		else
8105			goto back;
8106	}
8107	m->m_len = m->m_pkthdr.len = MCLBYTES;
8108
8109	/*
8110	 * Try to load RX buf into temporary DMA map
8111	 */
8112	error = bus_dmamap_load_mbuf(sc->sc_dmat, rbd->rbd_tmp_dmap, m,
8113	    init ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
8114	if (error) {
8115		m_freem(m);
8116
8117		/*
8118		 * See the comment above
8119		 */
8120		if (init)
8121			return error;
8122		else
8123			goto back;
8124	}
8125
8126	if (!init)
8127		bus_dmamap_unload(sc->sc_dmat, rxbuf->rb_dmap);
8128	rxbuf->rb_mbuf = m;
8129
8130	/*
8131	 * Swap RX buf's DMA map with the loaded temporary one
8132	 */
8133	map = rxbuf->rb_dmap;
8134	rxbuf->rb_dmap = rbd->rbd_tmp_dmap;
8135	rbd->rbd_tmp_dmap = map;
8136	paddr = rxbuf->rb_dmap->dm_segs[0].ds_addr;
8137	rxbuf->rb_paddr = paddr;
8138
8139back:
8140	/*
8141	 * Clear RX buf header
8142	 */
8143	hdr = mtod(rxbuf->rb_mbuf, struct bwi_rxbuf_hdr *);
8144	bzero(hdr, sizeof(*hdr));
8145	bus_dmamap_sync(sc->sc_dmat, rxbuf->rb_dmap, 0,
8146	    rxbuf->rb_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8147
8148	/*
8149	 * Setup RX buf descriptor
8150	 */
8151	sc->sc_setup_rxdesc(sc, buf_idx, rxbuf->rb_paddr,
8152	    rxbuf->rb_mbuf->m_len - sizeof(*hdr));
8153	return error;
8154}
8155
8156void
8157bwi_set_addr_filter(struct bwi_softc *sc, uint16_t addr_ofs,
8158    const uint8_t *addr)
8159{
8160	int i;
8161
8162	CSR_WRITE_2(sc, BWI_ADDR_FILTER_CTRL,
8163	    BWI_ADDR_FILTER_CTRL_SET | addr_ofs);
8164
8165	for (i = 0; i < (IEEE80211_ADDR_LEN / 2); ++i) {
8166		uint16_t addr_val;
8167
8168		addr_val = (uint16_t)addr[i * 2] |
8169		    (((uint16_t)addr[(i * 2) + 1]) << 8);
8170		CSR_WRITE_2(sc, BWI_ADDR_FILTER_DATA, addr_val);
8171	}
8172}
8173
8174int
8175bwi_set_chan(struct bwi_softc *sc, uint8_t chan)
8176{
8177	struct bwi_mac *mac;
8178
8179	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
8180	mac = (struct bwi_mac *)sc->sc_cur_regwin;
8181
8182	bwi_rf_set_chan(mac, chan, 0);
8183
8184	return (0);
8185}
8186
8187void
8188bwi_next_scan(void *xsc)
8189{
8190	struct bwi_softc *sc = xsc;
8191	struct ieee80211com *ic = &sc->sc_ic;
8192	struct ifnet *ifp = &ic->ic_if;
8193	int s;
8194
8195	s = splnet();
8196
8197	if (ic->ic_state == IEEE80211_S_SCAN)
8198		ieee80211_next_scan(ifp);
8199
8200	splx(s);
8201}
8202
8203int
8204bwi_rxeof(struct bwi_softc *sc, int end_idx)
8205{
8206	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8207	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8208	struct ieee80211com *ic = &sc->sc_ic;
8209	struct ifnet *ifp = &ic->ic_if;
8210	int idx, rx_data = 0;
8211
8212	idx = rbd->rbd_idx;
8213	while (idx != end_idx) {
8214		struct bwi_rxbuf *rb = &rbd->rbd_buf[idx];
8215		struct bwi_rxbuf_hdr *hdr;
8216		struct ieee80211_frame *wh;
8217		struct ieee80211_rxinfo rxi;
8218		struct ieee80211_node *ni;
8219		struct mbuf *m;
8220		void *plcp;
8221		uint16_t flags2;
8222		int buflen, wh_ofs, hdr_extra, rssi, type, rate;
8223
8224		m = rb->rb_mbuf;
8225		bus_dmamap_sync(sc->sc_dmat, rb->rb_dmap, 0,
8226		    rb->rb_dmap->dm_mapsize, BUS_DMASYNC_POSTREAD);
8227
8228		if (bwi_newbuf(sc, idx, 0)) {
8229			ifp->if_ierrors++;
8230			goto next;
8231		}
8232
8233		hdr = mtod(m, struct bwi_rxbuf_hdr *);
8234		flags2 = letoh16(hdr->rxh_flags2);
8235
8236		hdr_extra = 0;
8237		if (flags2 & BWI_RXH_F2_TYPE2FRAME)
8238			hdr_extra = 2;
8239		wh_ofs = hdr_extra + 6;
8240
8241		buflen = letoh16(hdr->rxh_buflen);
8242		if (buflen <= wh_ofs) {
8243			printf("%s: zero length data, hdr_extra %d\n",
8244			    sc->sc_dev.dv_xname, hdr_extra);
8245			ifp->if_ierrors++;
8246			m_freem(m);
8247			goto next;
8248		}
8249
8250		plcp = ((uint8_t *)(hdr + 1) + hdr_extra);
8251		rssi = bwi_calc_rssi(sc, hdr);
8252
8253		m->m_pkthdr.rcvif = ifp;
8254		m->m_len = m->m_pkthdr.len = buflen + sizeof(*hdr);
8255		m_adj(m, sizeof(*hdr) + wh_ofs);
8256
8257		if (htole16(hdr->rxh_flags1) & BWI_RXH_F1_OFDM)
8258			rate = bwi_ofdm_plcp2rate(plcp);
8259		else
8260			rate = bwi_ds_plcp2rate(plcp);
8261
8262#if NBPFILTER > 0
8263		/* RX radio tap */
8264		if (sc->sc_drvbpf != NULL) {
8265			struct mbuf mb;
8266			struct bwi_rx_radiotap_hdr *tap = &sc->sc_rxtap;
8267
8268			tap->wr_tsf = hdr->rxh_tsf;
8269			tap->wr_flags = 0;
8270			tap->wr_rate = rate;
8271			tap->wr_chan_freq =
8272			    htole16(ic->ic_bss->ni_chan->ic_freq);
8273			tap->wr_chan_flags =
8274			    htole16(ic->ic_bss->ni_chan->ic_flags);
8275			tap->wr_antsignal = rssi;
8276			tap->wr_antnoise = BWI_NOISE_FLOOR;
8277
8278			mb.m_data = (caddr_t)tap;
8279			mb.m_len = sc->sc_rxtap_len;
8280			mb.m_next = m;
8281			mb.m_nextpkt = NULL;
8282			mb.m_type = 0;
8283			mb.m_flags = 0;
8284			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
8285		}
8286#endif
8287
8288		m_adj(m, -IEEE80211_CRC_LEN);
8289
8290		wh = mtod(m, struct ieee80211_frame *);
8291		ni = ieee80211_find_rxnode(ic, wh);
8292		type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
8293
8294		rxi.rxi_rssi = hdr->rxh_rssi;
8295		rxi.rxi_tstamp = letoh16(hdr->rxh_tsf);
8296		ieee80211_input(ifp, m, ni, &rxi);
8297
8298		ieee80211_release_node(ic, ni);
8299
8300		if (type == IEEE80211_FC0_TYPE_DATA) {
8301			rx_data = 1;
8302			sc->sc_rx_rate = rate;
8303		}
8304next:
8305		idx = (idx + 1) % BWI_RX_NDESC;
8306	}
8307
8308	rbd->rbd_idx = idx;
8309	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
8310	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8311
8312	return (rx_data);
8313}
8314
8315int
8316bwi_rxeof32(struct bwi_softc *sc)
8317{
8318	uint32_t val, rx_ctrl;
8319	int end_idx, rx_data;
8320
8321	rx_ctrl = sc->sc_rx_rdata.rdata_txrx_ctrl;
8322
8323	val = CSR_READ_4(sc, rx_ctrl + BWI_RX32_STATUS);
8324	end_idx = __SHIFTOUT(val, BWI_RX32_STATUS_INDEX_MASK) /
8325	    sizeof(struct bwi_desc32);
8326
8327	rx_data = bwi_rxeof(sc, end_idx);
8328
8329	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_INDEX,
8330	    end_idx * sizeof(struct bwi_desc32));
8331
8332	return (rx_data);
8333}
8334
8335int
8336bwi_rxeof64(struct bwi_softc *sc)
8337{
8338	/* TODO: 64 */
8339	return (0);
8340}
8341
8342void
8343bwi_reset_rx_ring32(struct bwi_softc *sc, uint32_t rx_ctrl)
8344{
8345	int i;
8346
8347	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_CTRL, 0);
8348
8349#define NRETRY 10
8350	for (i = 0; i < NRETRY; ++i) {
8351		uint32_t status;
8352
8353		status = CSR_READ_4(sc, rx_ctrl + BWI_RX32_STATUS);
8354		if (__SHIFTOUT(status, BWI_RX32_STATUS_STATE_MASK) ==
8355		    BWI_RX32_STATUS_STATE_DISABLED)
8356			break;
8357
8358		DELAY(1000);
8359	}
8360	if (i == NRETRY)
8361		printf("%s: reset rx ring timedout\n", sc->sc_dev.dv_xname);
8362#undef NRETRY
8363
8364	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_RINGINFO, 0);
8365}
8366
8367void
8368bwi_free_txstats32(struct bwi_softc *sc)
8369{
8370	bwi_reset_rx_ring32(sc, sc->sc_txstats->stats_ctrl_base);
8371}
8372
8373void
8374bwi_free_rx_ring32(struct bwi_softc *sc)
8375{
8376	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8377	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8378	int i;
8379
8380	bwi_reset_rx_ring32(sc, rd->rdata_txrx_ctrl);
8381
8382	for (i = 0; i < BWI_RX_NDESC; ++i) {
8383		struct bwi_rxbuf *rb = &rbd->rbd_buf[i];
8384
8385		if (rb->rb_mbuf != NULL) {
8386			bus_dmamap_unload(sc->sc_dmat, rb->rb_dmap);
8387			m_freem(rb->rb_mbuf);
8388			rb->rb_mbuf = NULL;
8389		}
8390	}
8391}
8392
8393void
8394bwi_free_tx_ring32(struct bwi_softc *sc, int ring_idx)
8395{
8396	struct ieee80211com *ic = &sc->sc_ic;
8397	struct bwi_ring_data *rd;
8398	struct bwi_txbuf_data *tbd;
8399	uint32_t state, val;
8400	int i;
8401
8402	KASSERT(ring_idx < BWI_TX_NRING);
8403	rd = &sc->sc_tx_rdata[ring_idx];
8404	tbd = &sc->sc_tx_bdata[ring_idx];
8405
8406#define NRETRY 10
8407	for (i = 0; i < NRETRY; ++i) {
8408		val = CSR_READ_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_STATUS);
8409		state = __SHIFTOUT(val, BWI_TX32_STATUS_STATE_MASK);
8410		if (state == BWI_TX32_STATUS_STATE_DISABLED ||
8411		    state == BWI_TX32_STATUS_STATE_IDLE ||
8412		    state == BWI_TX32_STATUS_STATE_STOPPED)
8413			break;
8414
8415		DELAY(1000);
8416	}
8417	if (i == NRETRY) {
8418		printf("%s: wait for TX ring(%d) stable timed out\n",
8419		    sc->sc_dev.dv_xname, ring_idx);
8420	}
8421
8422	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, 0);
8423	for (i = 0; i < NRETRY; ++i) {
8424		val = CSR_READ_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_STATUS);
8425		state = __SHIFTOUT(val, BWI_TX32_STATUS_STATE_MASK);
8426		if (state == BWI_TX32_STATUS_STATE_DISABLED)
8427			break;
8428
8429		DELAY(1000);
8430	}
8431	if (i == NRETRY)
8432		printf("%s: reset TX ring (%d) timed out\n",
8433		    sc->sc_dev.dv_xname, ring_idx);
8434#undef NRETRY
8435
8436	DELAY(1000);
8437
8438	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_RINGINFO, 0);
8439
8440	for (i = 0; i < BWI_TX_NDESC; ++i) {
8441		struct bwi_txbuf *tb = &tbd->tbd_buf[i];
8442
8443		if (tb->tb_mbuf != NULL) {
8444			bus_dmamap_unload(sc->sc_dmat, tb->tb_dmap);
8445			m_freem(tb->tb_mbuf);
8446			tb->tb_mbuf = NULL;
8447		}
8448		if (tb->tb_ni != NULL) {
8449			ieee80211_release_node(ic, tb->tb_ni);
8450			tb->tb_ni = NULL;
8451		}
8452	}
8453}
8454
8455void
8456bwi_free_txstats64(struct bwi_softc *sc)
8457{
8458	/* TODO: 64 */
8459}
8460
8461void
8462bwi_free_rx_ring64(struct bwi_softc *sc)
8463{
8464	/* TODO: 64 */
8465}
8466
8467void
8468bwi_free_tx_ring64(struct bwi_softc *sc, int ring_idx)
8469{
8470	/* TODO: 64 */
8471}
8472
8473uint8_t
8474bwi_ofdm_plcp2rate(uint32_t *plcp0)
8475{
8476	uint32_t plcp;
8477	uint8_t plcp_rate;
8478
8479	plcp = letoh32(*plcp0);
8480	plcp_rate = __SHIFTOUT(plcp, IEEE80211_OFDM_PLCP_RATE_MASK);
8481
8482	return (ieee80211_plcp2rate(plcp_rate, IEEE80211_MODE_11G));
8483}
8484
8485uint8_t
8486bwi_ds_plcp2rate(struct ieee80211_ds_plcp_hdr *hdr)
8487{
8488	return (ieee80211_plcp2rate(hdr->i_signal, IEEE80211_MODE_11B));
8489}
8490
8491void
8492bwi_ofdm_plcp_header(uint32_t *plcp0, int pkt_len, uint8_t rate)
8493{
8494	uint32_t plcp;
8495
8496	plcp = __SHIFTIN(ieee80211_rate2plcp(rate, IEEE80211_MODE_11G),
8497	    IEEE80211_OFDM_PLCP_RATE_MASK) |
8498	    __SHIFTIN(pkt_len, IEEE80211_OFDM_PLCP_LEN_MASK);
8499	*plcp0 = htole32(plcp);
8500}
8501
8502void
8503bwi_ds_plcp_header(struct ieee80211_ds_plcp_hdr *plcp, int pkt_len,
8504    uint8_t rate)
8505{
8506	int len, service, pkt_bitlen;
8507
8508	pkt_bitlen = pkt_len * NBBY;
8509	len = howmany(pkt_bitlen * 2, rate);
8510
8511	service = IEEE80211_DS_PLCP_SERVICE_LOCKED;
8512	if (rate == (11 * 2)) {
8513		int pkt_bitlen1;
8514
8515		/*
8516		 * PLCP service field needs to be adjusted,
8517		 * if TX rate is 11Mbytes/s
8518		 */
8519		pkt_bitlen1 = len * 11;
8520		if (pkt_bitlen1 - pkt_bitlen >= NBBY)
8521			service |= IEEE80211_DS_PLCP_SERVICE_LENEXT7;
8522	}
8523
8524	plcp->i_signal = ieee80211_rate2plcp(rate, IEEE80211_MODE_11B);
8525	plcp->i_service = service;
8526	plcp->i_length = htole16(len);
8527	/* NOTE: do NOT touch i_crc */
8528}
8529
8530void
8531bwi_plcp_header(void *plcp, int pkt_len, uint8_t rate)
8532{
8533	enum bwi_modtype modtype;
8534
8535	/*
8536	 * Assume caller has zeroed 'plcp'
8537	 */
8538
8539	modtype = bwi_rate2modtype(rate);
8540	if (modtype == IEEE80211_MODTYPE_OFDM)
8541		bwi_ofdm_plcp_header(plcp, pkt_len, rate);
8542	else if (modtype == IEEE80211_MODTYPE_DS)
8543		bwi_ds_plcp_header(plcp, pkt_len, rate);
8544	else
8545		panic("unsupport modulation type %u\n", modtype);
8546}
8547
8548enum bwi_modtype
8549bwi_rate2modtype(uint8_t rate)
8550{
8551	rate &= IEEE80211_RATE_VAL;
8552
8553	if (rate == 44)
8554		return IEEE80211_MODTYPE_PBCC;
8555	else if (rate == 22 || rate < 12)
8556		return IEEE80211_MODTYPE_DS;
8557	else
8558		return IEEE80211_MODTYPE_OFDM;
8559}
8560
8561uint8_t
8562bwi_ack_rate(struct ieee80211_node *ni, uint8_t rate)
8563{
8564	const struct ieee80211_rateset *rs = &ni->ni_rates;
8565	uint8_t ack_rate = 0;
8566	enum bwi_modtype modtype;
8567	int i;
8568
8569	rate &= IEEE80211_RATE_VAL;
8570
8571	modtype = bwi_rate2modtype(rate);
8572
8573	for (i = 0; i < rs->rs_nrates; ++i) {
8574		uint8_t rate1 = rs->rs_rates[i] & IEEE80211_RATE_VAL;
8575
8576		if (rate1 > rate) {
8577			if (ack_rate != 0)
8578				return ack_rate;
8579			else
8580				break;
8581		}
8582
8583		if ((rs->rs_rates[i] & IEEE80211_RATE_BASIC) &&
8584		    bwi_rate2modtype(rate1) == modtype)
8585			ack_rate = rate1;
8586	}
8587
8588	switch (rate) {
8589	/* CCK */
8590	case 2:
8591	case 4:
8592	case 11:
8593	case 22:
8594		ack_rate = rate;
8595		break;
8596	/* PBCC */
8597	case 44:
8598		ack_rate = 22;
8599		break;
8600
8601	/* OFDM */
8602	case 12:
8603	case 18:
8604		ack_rate = 12;
8605		break;
8606	case 24:
8607	case 36:
8608		ack_rate = 24;
8609		break;
8610	case 48:
8611	case 72:
8612	case 96:
8613	case 108:
8614		ack_rate = 48;
8615		break;
8616	default:
8617		panic("unsupported rate %d\n", rate);
8618	}
8619	return ack_rate;
8620}
8621
8622#define IEEE80211_OFDM_TXTIME(kbps, frmlen)	\
8623	(IEEE80211_OFDM_PREAMBLE_TIME +		\
8624	 IEEE80211_OFDM_SIGNAL_TIME +		\
8625	(IEEE80211_OFDM_NSYMS((kbps), (frmlen)) * IEEE80211_OFDM_SYM_TIME))
8626
8627#define IEEE80211_OFDM_SYM_TIME			4
8628#define IEEE80211_OFDM_PREAMBLE_TIME		16
8629#define IEEE80211_OFDM_SIGNAL_EXT_TIME		6
8630#define IEEE80211_OFDM_SIGNAL_TIME		4
8631
8632#define IEEE80211_OFDM_PLCP_SERVICE_NBITS	16
8633#define IEEE80211_OFDM_TAIL_NBITS		6
8634
8635#define IEEE80211_OFDM_NBITS(frmlen)		\
8636	(IEEE80211_OFDM_PLCP_SERVICE_NBITS +	\
8637	 ((frmlen) * NBBY) +			\
8638	 IEEE80211_OFDM_TAIL_NBITS)
8639
8640#define IEEE80211_OFDM_NBITS_PER_SYM(kbps)	\
8641	(((kbps) * IEEE80211_OFDM_SYM_TIME) / 1000)
8642
8643#define IEEE80211_OFDM_NSYMS(kbps, frmlen)	\
8644	howmany(IEEE80211_OFDM_NBITS((frmlen)),	\
8645	IEEE80211_OFDM_NBITS_PER_SYM((kbps)))
8646
8647#define IEEE80211_CCK_TXTIME(kbps, frmlen)	\
8648	(((IEEE80211_CCK_NBITS((frmlen)) * 1000) + (kbps) - 1) / (kbps))
8649
8650#define IEEE80211_CCK_PREAMBLE_LEN		144
8651#define IEEE80211_CCK_PLCP_HDR_TIME		48
8652#define IEEE80211_CCK_SHPREAMBLE_LEN		72
8653#define IEEE80211_CCK_SHPLCP_HDR_TIME		24
8654
8655#define IEEE80211_CCK_NBITS(frmlen)		((frmlen) * NBBY)
8656
8657uint16_t
8658bwi_txtime(struct ieee80211com *ic, struct ieee80211_node *ni, uint len,
8659    uint8_t rs_rate, uint32_t flags)
8660{
8661	enum bwi_modtype modtype;
8662	uint16_t txtime;
8663	int rate;
8664
8665	rs_rate &= IEEE80211_RATE_VAL;
8666
8667	rate = rs_rate * 500;	/* ieee80211 rate -> kbps */
8668
8669	modtype = bwi_rate2modtype(rs_rate);
8670	if (modtype == IEEE80211_MODTYPE_OFDM) {
8671		/*
8672		 * IEEE Std 802.11a-1999, page 37, equation (29)
8673		 * IEEE Std 802.11g-2003, page 44, equation (42)
8674		 */
8675		txtime = IEEE80211_OFDM_TXTIME(rate, len);
8676		if (ic->ic_curmode == IEEE80211_MODE_11G)
8677			txtime += IEEE80211_OFDM_SIGNAL_EXT_TIME;
8678	} else {
8679		/*
8680		 * IEEE Std 802.11b-1999, page 28, subclause 18.3.4
8681		 * IEEE Std 802.11g-2003, page 45, equation (43)
8682		 */
8683		if (modtype == IEEE80211_MODTYPE_PBCC)
8684			++len;
8685		txtime = IEEE80211_CCK_TXTIME(rate, len);
8686
8687		/*
8688		 * Short preamble is not applicable for DS 1Mbits/s
8689		 */
8690		if (rs_rate != 2 && (flags & IEEE80211_F_SHPREAMBLE)) {
8691			txtime += IEEE80211_CCK_SHPREAMBLE_LEN +
8692				  IEEE80211_CCK_SHPLCP_HDR_TIME;
8693		} else {
8694			txtime += IEEE80211_CCK_PREAMBLE_LEN +
8695				  IEEE80211_CCK_PLCP_HDR_TIME;
8696		}
8697	}
8698	return txtime;
8699}
8700
8701int
8702bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
8703    struct ieee80211_node *ni)
8704{
8705	DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
8706
8707	struct ieee80211com *ic = &sc->sc_ic;
8708	struct bwi_ring_data *rd = &sc->sc_tx_rdata[BWI_TX_DATA_RING];
8709	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
8710	struct bwi_txbuf *tb = &tbd->tbd_buf[idx];
8711	struct bwi_mac *mac;
8712	struct bwi_txbuf_hdr *hdr;
8713	struct ieee80211_frame *wh;
8714	uint8_t rate;
8715	uint32_t mac_ctrl;
8716	uint16_t phy_ctrl;
8717	bus_addr_t paddr;
8718	int pkt_len, error;
8719#if 0
8720	const uint8_t *p;
8721	int i;
8722#endif
8723
8724	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
8725	mac = (struct bwi_mac *)sc->sc_cur_regwin;
8726
8727	wh = mtod(m, struct ieee80211_frame *);
8728
8729	/* Get 802.11 frame len before prepending TX header */
8730	pkt_len = m->m_pkthdr.len + IEEE80211_CRC_LEN;
8731
8732	/*
8733	 * Find TX rate
8734	 */
8735	bzero(tb->tb_rate_idx, sizeof(tb->tb_rate_idx));
8736	if (ni != NULL) {
8737		if (ic->ic_fixed_rate != -1) {
8738			rate = ic->ic_sup_rates[ic->ic_curmode].
8739			    rs_rates[ic->ic_fixed_rate];
8740		} else {
8741			/* AMRR rate control */
8742			rate = ni->ni_rates.rs_rates[ni->ni_txrate];
8743		}
8744	} else {
8745		/* Fixed at 1Mbytes/s for mgt frames */
8746		rate = (1 * 2);
8747	}
8748
8749	rate &= IEEE80211_RATE_VAL;
8750
8751	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
8752		rate = (1 * 2);
8753
8754	if (rate == 0) {
8755		printf("%s: invalid rate %u or fallback rate",
8756		    sc->sc_dev.dv_xname, rate);
8757		rate = (1 * 2); /* Force 1Mbytes/s */
8758	}
8759	sc->sc_tx_rate = rate;
8760
8761#if NBPFILTER > 0
8762	/* TX radio tap */
8763	if (sc->sc_drvbpf != NULL) {
8764		struct mbuf mb;
8765		struct bwi_tx_radiotap_hdr *tap = &sc->sc_txtap;
8766
8767		tap->wt_flags = 0;
8768		tap->wt_rate = rate;
8769		tap->wt_chan_freq =
8770		    htole16(ic->ic_bss->ni_chan->ic_freq);
8771		tap->wt_chan_flags =
8772		    htole16(ic->ic_bss->ni_chan->ic_flags);
8773
8774		mb.m_data = (caddr_t)tap;
8775		mb.m_len = sc->sc_txtap_len;
8776		mb.m_next = m;
8777		mb.m_nextpkt = NULL;
8778		mb.m_type = 0;
8779		mb.m_flags = 0;
8780		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
8781	}
8782#endif
8783
8784	/*
8785	 * Setup the embedded TX header
8786	 */
8787	M_PREPEND(m, sizeof(*hdr), M_DONTWAIT);
8788	if (m == NULL) {
8789		printf("%s: prepend TX header failed\n", sc->sc_dev.dv_xname);
8790		return (ENOBUFS);
8791	}
8792	hdr = mtod(m, struct bwi_txbuf_hdr *);
8793
8794	bzero(hdr, sizeof(*hdr));
8795
8796	bcopy(wh->i_fc, hdr->txh_fc, sizeof(hdr->txh_fc));
8797	bcopy(wh->i_addr1, hdr->txh_addr1, sizeof(hdr->txh_addr1));
8798
8799	if (ni != NULL && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
8800		uint16_t dur;
8801		uint8_t ack_rate;
8802
8803		ack_rate = bwi_ack_rate(ni, rate);
8804		dur = bwi_txtime(ic, ni,
8805		    sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN,
8806		    ack_rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
8807
8808		hdr->txh_fb_duration = htole16(dur);
8809	}
8810
8811	hdr->txh_id = __SHIFTIN(BWI_TX_DATA_RING, BWI_TXH_ID_RING_MASK) |
8812	    __SHIFTIN(idx, BWI_TXH_ID_IDX_MASK);
8813
8814	bwi_plcp_header(hdr->txh_plcp, pkt_len, rate);
8815	bwi_plcp_header(hdr->txh_fb_plcp, pkt_len, rate);
8816
8817	phy_ctrl = __SHIFTIN(mac->mac_rf.rf_ant_mode,
8818	    BWI_TXH_PHY_C_ANTMODE_MASK);
8819	if (bwi_rate2modtype(rate) == IEEE80211_MODTYPE_OFDM)
8820		phy_ctrl |= BWI_TXH_PHY_C_OFDM;
8821	else if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && rate != (2 * 1))
8822		phy_ctrl |= BWI_TXH_PHY_C_SHPREAMBLE;
8823
8824	mac_ctrl = BWI_TXH_MAC_C_HWSEQ | BWI_TXH_MAC_C_FIRST_FRAG;
8825	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
8826		mac_ctrl |= BWI_TXH_MAC_C_ACK;
8827	if (bwi_rate2modtype(rate) == IEEE80211_MODTYPE_OFDM)
8828		mac_ctrl |= BWI_TXH_MAC_C_FB_OFDM;
8829
8830	hdr->txh_mac_ctrl = htole32(mac_ctrl);
8831	hdr->txh_phy_ctrl = htole16(phy_ctrl);
8832
8833	/* Catch any further usage */
8834	hdr = NULL;
8835	wh = NULL;
8836
8837	/* DMA load */
8838	error = bus_dmamap_load_mbuf(sc->sc_dmat, tb->tb_dmap, m,
8839	    BUS_DMA_NOWAIT);
8840	if (error && error != EFBIG) {
8841		printf("%s: can't load TX buffer (1) %d\n",
8842		    sc->sc_dev.dv_xname, error);
8843		goto back;
8844	}
8845
8846	if (error) {	/* error == EFBIG */
8847		struct mbuf *m_new;
8848
8849		error = 0;
8850
8851		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
8852		if (m_new == NULL) {
8853			m_freem(m);
8854			error = ENOBUFS;
8855			printf("%s: can't defrag TX buffer\n",
8856			    sc->sc_dev.dv_xname);
8857			goto back;
8858		}
8859
8860		M_DUP_PKTHDR(m_new, m);
8861		if (m->m_pkthdr.len > MHLEN) {
8862			MCLGET(m_new, M_DONTWAIT);
8863			if (!(m_new->m_flags & M_EXT)) {
8864				m_freem(m);
8865				m_freem(m_new);
8866				error = ENOBUFS;
8867			}
8868		}
8869
8870		if (error) {
8871			printf("%s: can't defrag TX buffer\n",
8872			    sc->sc_dev.dv_xname);
8873			goto back;
8874		}
8875
8876		m_copydata(m, 0, m->m_pkthdr.len, mtod(m_new, caddr_t));
8877		m_freem(m);
8878		m_new->m_len = m_new->m_pkthdr.len;
8879		m = m_new;
8880
8881		error = bus_dmamap_load_mbuf(sc->sc_dmat, tb->tb_dmap, m,
8882		    BUS_DMA_NOWAIT);
8883		if (error) {
8884			printf("%s: can't load TX buffer (2) %d\n",
8885			    sc->sc_dev.dv_xname, error);
8886			goto back;
8887		}
8888	}
8889	error = 0;
8890
8891	bus_dmamap_sync(sc->sc_dmat, tb->tb_dmap, 0,
8892	    tb->tb_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8893
8894	tb->tb_mbuf = m;
8895	tb->tb_ni = ni;
8896
8897#if 0
8898	p = mtod(m, const uint8_t *);
8899	for (i = 0; i < m->m_pkthdr.len; ++i) {
8900		if (i != 0 && i % 8 == 0)
8901			printf("\n");
8902		printf("%02x ", p[i]);
8903	}
8904	printf("\n");
8905
8906	DPRINTF(1, "%s: idx %d, pkt_len %d, buflen %d\n",
8907	    sc->sc_dev.dv_xname, idx, pkt_len, m->m_pkthdr.len);
8908#endif
8909
8910	/* Setup TX descriptor */
8911	paddr = tb->tb_dmap->dm_segs[0].ds_addr;
8912	sc->sc_setup_txdesc(sc, rd, idx, paddr, m->m_pkthdr.len);
8913	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
8914	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8915
8916	/* Kick start */
8917	sc->sc_start_tx(sc, rd->rdata_txrx_ctrl, idx);
8918
8919back:
8920	if (error)
8921		m_freem(m);
8922	return (error);
8923}
8924
8925void
8926bwi_start_tx32(struct bwi_softc *sc, uint32_t tx_ctrl, int idx)
8927{
8928	idx = (idx + 1) % BWI_TX_NDESC;
8929	CSR_WRITE_4(sc, tx_ctrl + BWI_TX32_INDEX,
8930	    idx * sizeof(struct bwi_desc32));
8931}
8932
8933void
8934bwi_start_tx64(struct bwi_softc *sc, uint32_t tx_ctrl, int idx)
8935{
8936	/* TODO: 64 */
8937}
8938
8939void
8940bwi_txeof_status32(struct bwi_softc *sc)
8941{
8942	struct ifnet *ifp = &sc->sc_ic.ic_if;
8943	uint32_t val, ctrl_base;
8944	int end_idx;
8945
8946	ctrl_base = sc->sc_txstats->stats_ctrl_base;
8947
8948	val = CSR_READ_4(sc, ctrl_base + BWI_RX32_STATUS);
8949	end_idx = __SHIFTOUT(val, BWI_RX32_STATUS_INDEX_MASK) /
8950	    sizeof(struct bwi_desc32);
8951
8952	bwi_txeof_status(sc, end_idx);
8953
8954	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
8955	    end_idx * sizeof(struct bwi_desc32));
8956
8957	if ((ifp->if_flags & IFF_OACTIVE) == 0)
8958		ifp->if_start(ifp);
8959}
8960
8961void
8962bwi_txeof_status64(struct bwi_softc *sc)
8963{
8964	/* TODO: 64 */
8965}
8966
8967void
8968_bwi_txeof(struct bwi_softc *sc, uint16_t tx_id)
8969{
8970	struct ieee80211com *ic = &sc->sc_ic;
8971	struct ifnet *ifp = &sc->sc_ic.ic_if;
8972	struct bwi_txbuf_data *tbd;
8973	struct bwi_txbuf *tb;
8974	int ring_idx, buf_idx;
8975
8976	if (tx_id == 0) {
8977		printf("%s: zero tx id\n", sc->sc_dev.dv_xname);
8978		return;
8979	}
8980
8981	ring_idx = __SHIFTOUT(tx_id, BWI_TXH_ID_RING_MASK);
8982	buf_idx = __SHIFTOUT(tx_id, BWI_TXH_ID_IDX_MASK);
8983
8984	KASSERT(ring_idx == BWI_TX_DATA_RING);
8985	KASSERT(buf_idx < BWI_TX_NDESC);
8986#if 0
8987	DPRINTF(1, "%s: txeof idx %d\n", sc->sc_dev.dv_xname, buf_idx);
8988#endif
8989	tbd = &sc->sc_tx_bdata[ring_idx];
8990	KASSERT(tbd->tbd_used > 0);
8991	tbd->tbd_used--;
8992
8993	tb = &tbd->tbd_buf[buf_idx];
8994
8995	bus_dmamap_unload(sc->sc_dmat, tb->tb_dmap);
8996	m_freem(tb->tb_mbuf);
8997	tb->tb_mbuf = NULL;
8998
8999	if (tb->tb_ni != NULL) {
9000		ieee80211_release_node(ic, tb->tb_ni);
9001		tb->tb_ni = NULL;
9002	}
9003
9004	if (tbd->tbd_used == 0)
9005		sc->sc_tx_timer = 0;
9006
9007	ifp->if_flags &= ~IFF_OACTIVE;
9008}
9009
9010void
9011bwi_txeof_status(struct bwi_softc *sc, int end_idx)
9012{
9013	struct bwi_txstats_data *st = sc->sc_txstats;
9014	int idx;
9015
9016	bus_dmamap_sync(sc->sc_dmat, st->stats_dmap, 0,
9017	    st->stats_dmap->dm_mapsize, BUS_DMASYNC_POSTREAD);
9018
9019	idx = st->stats_idx;
9020	while (idx != end_idx) {
9021		_bwi_txeof(sc, letoh16(st->stats[idx].txs_id));
9022		idx = (idx + 1) % BWI_TXSTATS_NDESC;
9023	}
9024	st->stats_idx = idx;
9025}
9026
9027void
9028bwi_txeof(struct bwi_softc *sc)
9029{
9030	struct ifnet *ifp = &sc->sc_ic.ic_if;
9031
9032	for (;;) {
9033		uint32_t tx_status0, tx_status1;
9034		uint16_t tx_id, tx_info;
9035
9036		tx_status0 = CSR_READ_4(sc, BWI_TXSTATUS_0);
9037		if (tx_status0 == 0)
9038			break;
9039		tx_status1 = CSR_READ_4(sc, BWI_TXSTATUS_1);
9040
9041		tx_id = __SHIFTOUT(tx_status0, BWI_TXSTATUS_0_TXID_MASK);
9042		tx_info = BWI_TXSTATUS_0_INFO(tx_status0);
9043
9044		if (tx_info & 0x30) /* XXX */
9045			continue;
9046
9047		_bwi_txeof(sc, letoh16(tx_id));
9048
9049		ifp->if_opackets++;
9050	}
9051
9052	if ((ifp->if_flags & IFF_OACTIVE) == 0)
9053		ifp->if_start(ifp);
9054}
9055
9056int
9057bwi_bbp_power_on(struct bwi_softc *sc, enum bwi_clock_mode clk_mode)
9058{
9059	bwi_power_on(sc, 1);
9060
9061	return (bwi_set_clock_mode(sc, clk_mode));
9062}
9063
9064void
9065bwi_bbp_power_off(struct bwi_softc *sc)
9066{
9067	bwi_set_clock_mode(sc, BWI_CLOCK_MODE_SLOW);
9068	bwi_power_off(sc, 1);
9069}
9070
9071int
9072bwi_get_pwron_delay(struct bwi_softc *sc)
9073{
9074	struct bwi_regwin *com, *old;
9075	struct bwi_clock_freq freq;
9076	uint32_t val;
9077	int error;
9078
9079	com = &sc->sc_com_regwin;
9080	KASSERT(BWI_REGWIN_EXIST(com));
9081
9082	if ((sc->sc_cap & BWI_CAP_CLKMODE) == 0)
9083		return (0);
9084
9085	error = bwi_regwin_switch(sc, com, &old);
9086	if (error)
9087		return (error);
9088
9089	bwi_get_clock_freq(sc, &freq);
9090
9091	val = CSR_READ_4(sc, BWI_PLL_ON_DELAY);
9092	sc->sc_pwron_delay = howmany((val + 2) * 1000000, freq.clkfreq_min);
9093	DPRINTF(1, "%s: power on delay %u\n",
9094	    sc->sc_dev.dv_xname, sc->sc_pwron_delay);
9095
9096	return (bwi_regwin_switch(sc, old, NULL));
9097}
9098
9099int
9100bwi_bus_attach(struct bwi_softc *sc)
9101{
9102	struct bwi_regwin *bus, *old;
9103	int error;
9104
9105	bus = &sc->sc_bus_regwin;
9106
9107	error = bwi_regwin_switch(sc, bus, &old);
9108	if (error)
9109		return (error);
9110
9111	if (!bwi_regwin_is_enabled(sc, bus))
9112		bwi_regwin_enable(sc, bus, 0);
9113
9114	/* Disable interripts */
9115	CSR_WRITE_4(sc, BWI_INTRVEC, 0);
9116
9117	return (bwi_regwin_switch(sc, old, NULL));
9118}
9119
9120const char *
9121bwi_regwin_name(const struct bwi_regwin *rw)
9122{
9123	switch (rw->rw_type) {
9124	case BWI_REGWIN_T_COM:
9125		return ("COM");
9126	case BWI_REGWIN_T_BUSPCI:
9127		return ("PCI");
9128	case BWI_REGWIN_T_MAC:
9129		return ("MAC");
9130	case BWI_REGWIN_T_BUSPCIE:
9131		return ("PCIE");
9132	}
9133	panic("unknown regwin type 0x%04x\n", rw->rw_type);
9134
9135	return (NULL);
9136}
9137
9138uint32_t
9139bwi_regwin_disable_bits(struct bwi_softc *sc)
9140{
9141	uint32_t busrev;
9142
9143	/* XXX cache this */
9144	busrev = __SHIFTOUT(CSR_READ_4(sc, BWI_ID_LO), BWI_ID_LO_BUSREV_MASK);
9145	DPRINTF(1, "%s: bus rev %u\n", sc->sc_dev.dv_xname, busrev);
9146
9147	if (busrev == BWI_BUSREV_0)
9148		return (BWI_STATE_LO_DISABLE1);
9149	else if (busrev == BWI_BUSREV_1)
9150		return (BWI_STATE_LO_DISABLE2);
9151	else
9152		return ((BWI_STATE_LO_DISABLE1 | BWI_STATE_LO_DISABLE2));
9153}
9154
9155int
9156bwi_regwin_is_enabled(struct bwi_softc *sc, struct bwi_regwin *rw)
9157{
9158	uint32_t val, disable_bits;
9159
9160	disable_bits = bwi_regwin_disable_bits(sc);
9161	val = CSR_READ_4(sc, BWI_STATE_LO);
9162
9163	if ((val & (BWI_STATE_LO_CLOCK |
9164	    BWI_STATE_LO_RESET |
9165	    disable_bits)) == BWI_STATE_LO_CLOCK) {
9166		DPRINTF(1, "%s: %s is enabled\n",
9167		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9168		return (1);
9169	} else {
9170		DPRINTF(1, "%s: %s is disabled\n",
9171		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9172		return (0);
9173	}
9174}
9175
9176void
9177bwi_regwin_disable(struct bwi_softc *sc, struct bwi_regwin *rw, uint32_t flags)
9178{
9179	uint32_t state_lo, disable_bits;
9180	int i;
9181
9182	state_lo = CSR_READ_4(sc, BWI_STATE_LO);
9183
9184	/*
9185	 * If current regwin is in 'reset' state, it was already disabled.
9186	 */
9187	if (state_lo & BWI_STATE_LO_RESET) {
9188		DPRINTF(1, "%s: %s was already disabled\n",
9189		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9190		return;
9191	}
9192
9193	disable_bits = bwi_regwin_disable_bits(sc);
9194
9195	/*
9196	 * Disable normal clock
9197	 */
9198	state_lo = BWI_STATE_LO_CLOCK | disable_bits;
9199	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9200
9201	/*
9202	 * Wait until normal clock is disabled
9203	 */
9204#define NRETRY	1000
9205	for (i = 0; i < NRETRY; ++i) {
9206		state_lo = CSR_READ_4(sc, BWI_STATE_LO);
9207		if (state_lo & disable_bits)
9208			break;
9209		DELAY(10);
9210	}
9211	if (i == NRETRY) {
9212		printf("%s: %s disable clock timeout\n",
9213		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9214	}
9215
9216	for (i = 0; i < NRETRY; ++i) {
9217		uint32_t state_hi;
9218
9219		state_hi = CSR_READ_4(sc, BWI_STATE_HI);
9220		if ((state_hi & BWI_STATE_HI_BUSY) == 0)
9221			break;
9222		DELAY(10);
9223	}
9224	if (i == NRETRY) {
9225		printf("%s: %s wait BUSY unset timeout\n",
9226		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9227	}
9228#undef NRETRY
9229
9230	/*
9231	 * Reset and disable regwin with gated clock
9232	 */
9233	state_lo = BWI_STATE_LO_RESET | disable_bits |
9234	    BWI_STATE_LO_CLOCK | BWI_STATE_LO_GATED_CLOCK |
9235	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9236	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9237
9238	/* Flush pending bus write */
9239	CSR_READ_4(sc, BWI_STATE_LO);
9240	DELAY(1);
9241
9242	/* Reset and disable regwin */
9243	state_lo = BWI_STATE_LO_RESET | disable_bits |
9244		   __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9245	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9246
9247	/* Flush pending bus write */
9248	CSR_READ_4(sc, BWI_STATE_LO);
9249	DELAY(1);
9250}
9251
9252void
9253bwi_regwin_enable(struct bwi_softc *sc, struct bwi_regwin *rw, uint32_t flags)
9254{
9255	uint32_t state_lo, state_hi, imstate;
9256
9257	bwi_regwin_disable(sc, rw, flags);
9258
9259	/* Reset regwin with gated clock */
9260	state_lo = BWI_STATE_LO_RESET |
9261	    BWI_STATE_LO_CLOCK |
9262	    BWI_STATE_LO_GATED_CLOCK |
9263	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9264	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9265
9266	/* Flush pending bus write */
9267	CSR_READ_4(sc, BWI_STATE_LO);
9268	DELAY(1);
9269
9270	state_hi = CSR_READ_4(sc, BWI_STATE_HI);
9271	if (state_hi & BWI_STATE_HI_SERROR)
9272		CSR_WRITE_4(sc, BWI_STATE_HI, 0);
9273
9274	imstate = CSR_READ_4(sc, BWI_IMSTATE);
9275	if (imstate & (BWI_IMSTATE_INBAND_ERR | BWI_IMSTATE_TIMEOUT)) {
9276		imstate &= ~(BWI_IMSTATE_INBAND_ERR | BWI_IMSTATE_TIMEOUT);
9277		CSR_WRITE_4(sc, BWI_IMSTATE, imstate);
9278	}
9279
9280	/* Enable regwin with gated clock */
9281	state_lo = BWI_STATE_LO_CLOCK |
9282	    BWI_STATE_LO_GATED_CLOCK |
9283	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9284	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9285
9286	/* Flush pending bus write */
9287	CSR_READ_4(sc, BWI_STATE_LO);
9288	DELAY(1);
9289
9290	/* Enable regwin with normal clock */
9291	state_lo = BWI_STATE_LO_CLOCK |
9292	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9293	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9294
9295	/* Flush pending bus write */
9296	CSR_READ_4(sc, BWI_STATE_LO);
9297	DELAY(1);
9298}
9299
9300void
9301bwi_set_bssid(struct bwi_softc *sc, const uint8_t *bssid)
9302{
9303	struct ieee80211com *ic = &sc->sc_ic;
9304	struct bwi_mac *mac;
9305	struct bwi_myaddr_bssid buf;
9306	const uint8_t *p;
9307	uint32_t val;
9308	int n, i;
9309
9310	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9311	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9312
9313	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_BSSID, bssid);
9314
9315	bcopy(ic->ic_myaddr, buf.myaddr, sizeof(buf.myaddr));
9316	bcopy(bssid, buf.bssid, sizeof(buf.bssid));
9317
9318	n = sizeof(buf) / sizeof(val);
9319	p = (const uint8_t *)&buf;
9320	for (i = 0; i < n; ++i) {
9321		int j;
9322
9323		val = 0;
9324		for (j = 0; j < sizeof(val); ++j)
9325			val |= ((uint32_t)(*p++)) << (j * 8);
9326
9327		TMPLT_WRITE_4(mac, 0x20 + (i * sizeof(val)), val);
9328	}
9329}
9330
9331void
9332bwi_updateslot(struct ieee80211com *ic)
9333{
9334	struct bwi_softc *sc = ic->ic_if.if_softc;
9335	struct bwi_mac *mac;
9336	struct ifnet *ifp = &ic->ic_if;
9337
9338	if ((ifp->if_flags & IFF_RUNNING) == 0)
9339		return;
9340
9341	DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
9342
9343	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9344	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9345
9346	bwi_mac_updateslot(mac, (ic->ic_flags & IEEE80211_F_SHSLOT));
9347}
9348
9349void
9350bwi_calibrate(void *xsc)
9351{
9352	struct bwi_softc *sc = xsc;
9353	struct ieee80211com *ic = &sc->sc_ic;
9354	int s;
9355
9356	s = splnet();
9357
9358	if (ic->ic_state == IEEE80211_S_RUN) {
9359		struct bwi_mac *mac;
9360
9361		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9362		mac = (struct bwi_mac *)sc->sc_cur_regwin;
9363
9364		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
9365			bwi_mac_calibrate_txpower(mac, sc->sc_txpwrcb_type);
9366			sc->sc_txpwrcb_type = BWI_TXPWR_CALIB;
9367		}
9368
9369		/* XXX 15 seconds */
9370		timeout_add(&sc->sc_calib_ch, hz * 15);
9371	}
9372
9373	splx(s);
9374}
9375
9376int
9377bwi_calc_rssi(struct bwi_softc *sc, const struct bwi_rxbuf_hdr *hdr)
9378{
9379	struct bwi_mac *mac;
9380
9381	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9382	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9383
9384	return (bwi_rf_calc_rssi(mac, hdr));
9385}
9386