xref: /openbsd-src/sys/dev/ic/ar9003.c (revision 9f11ffb7133c203312a01e4b986886bc88c7d74b)
1 /*	$OpenBSD: ar9003.c,v 1.47 2019/02/01 16:15:07 stsp Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2010 Atheros Communications Inc.
6  *
7  * Permission to use, copy, modify, and/or distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Atheros 802.11a/g/n chipsets.
22  * Routines for AR9003 family.
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/malloc.h>
34 #include <sys/queue.h>
35 #include <sys/timeout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/stdint.h>	/* uintptr_t */
39 #include <sys/endian.h>
40 
41 #include <machine/bus.h>
42 
43 #if NBPFILTER > 0
44 #include <net/bpf.h>
45 #endif
46 #include <net/if.h>
47 #include <net/if_media.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/if_ether.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_amrr.h>
54 #include <net80211/ieee80211_mira.h>
55 #include <net80211/ieee80211_radiotap.h>
56 
57 #include <dev/ic/athnreg.h>
58 #include <dev/ic/athnvar.h>
59 
60 #include <dev/ic/ar9003reg.h>
61 
62 int	ar9003_attach(struct athn_softc *);
63 int	ar9003_read_eep_word(struct athn_softc *, uint32_t, uint16_t *);
64 int	ar9003_read_eep_data(struct athn_softc *, uint32_t, void *, int);
65 int	ar9003_read_otp_word(struct athn_softc *, uint32_t, uint32_t *);
66 int	ar9003_read_otp_data(struct athn_softc *, uint32_t, void *, int);
67 int	ar9003_find_rom(struct athn_softc *);
68 int	ar9003_restore_rom_block(struct athn_softc *, uint8_t, uint8_t,
69 	    const uint8_t *, int);
70 int	ar9003_read_rom(struct athn_softc *);
71 int	ar9003_gpio_read(struct athn_softc *, int);
72 void	ar9003_gpio_write(struct athn_softc *, int, int);
73 void	ar9003_gpio_config_input(struct athn_softc *, int);
74 void	ar9003_gpio_config_output(struct athn_softc *, int, int);
75 void	ar9003_rfsilent_init(struct athn_softc *);
76 int	ar9003_dma_alloc(struct athn_softc *);
77 void	ar9003_dma_free(struct athn_softc *);
78 int	ar9003_tx_alloc(struct athn_softc *);
79 void	ar9003_tx_free(struct athn_softc *);
80 int	ar9003_rx_alloc(struct athn_softc *, int, int);
81 void	ar9003_rx_free(struct athn_softc *, int);
82 void	ar9003_reset_txsring(struct athn_softc *);
83 void	ar9003_rx_enable(struct athn_softc *);
84 void	ar9003_rx_radiotap(struct athn_softc *, struct mbuf *,
85 	    struct ar_rx_status *);
86 int	ar9003_rx_process(struct athn_softc *, int);
87 void	ar9003_rx_intr(struct athn_softc *, int);
88 int	ar9003_tx_process(struct athn_softc *);
89 void	ar9003_tx_intr(struct athn_softc *);
90 int	ar9003_swba_intr(struct athn_softc *);
91 int	ar9003_intr(struct athn_softc *);
92 int	ar9003_tx(struct athn_softc *, struct mbuf *, struct ieee80211_node *,
93 	    int);
94 void	ar9003_set_rf_mode(struct athn_softc *, struct ieee80211_channel *);
95 int	ar9003_rf_bus_request(struct athn_softc *);
96 void	ar9003_rf_bus_release(struct athn_softc *);
97 void	ar9003_set_phy(struct athn_softc *, struct ieee80211_channel *,
98 	    struct ieee80211_channel *);
99 void	ar9003_set_delta_slope(struct athn_softc *, struct ieee80211_channel *,
100 	    struct ieee80211_channel *);
101 void	ar9003_enable_antenna_diversity(struct athn_softc *);
102 void	ar9003_init_baseband(struct athn_softc *);
103 void	ar9003_disable_phy(struct athn_softc *);
104 void	ar9003_init_chains(struct athn_softc *);
105 void	ar9003_set_rxchains(struct athn_softc *);
106 void	ar9003_read_noisefloor(struct athn_softc *, int16_t *, int16_t *);
107 void	ar9003_write_noisefloor(struct athn_softc *, int16_t *, int16_t *);
108 int	ar9003_get_noisefloor(struct athn_softc *);
109 void	ar9003_apply_noisefloor(struct athn_softc *);
110 void	ar9003_bb_load_noisefloor(struct athn_softc *);
111 void	ar9003_do_noisefloor_calib(struct athn_softc *);
112 void	ar9003_init_noisefloor_calib(struct athn_softc *);
113 int	ar9003_init_calib(struct athn_softc *);
114 void	ar9003_do_calib(struct athn_softc *);
115 void	ar9003_next_calib(struct athn_softc *);
116 void	ar9003_calib_iq(struct athn_softc *);
117 int	ar9003_get_iq_corr(struct athn_softc *, int32_t[], int32_t[]);
118 int	ar9003_calib_tx_iq(struct athn_softc *);
119 void	ar9003_paprd_calib(struct athn_softc *, struct ieee80211_channel *);
120 int	ar9003_get_desired_txgain(struct athn_softc *, int, int);
121 void	ar9003_force_txgain(struct athn_softc *, uint32_t);
122 void	ar9003_set_training_gain(struct athn_softc *, int);
123 int	ar9003_paprd_tx_tone(struct athn_softc *);
124 int	ar9003_compute_predistortion(struct athn_softc *, const uint32_t *,
125 	    const uint32_t *);
126 void	ar9003_enable_predistorter(struct athn_softc *, int);
127 void	ar9003_paprd_enable(struct athn_softc *);
128 void	ar9003_paprd_tx_tone_done(struct athn_softc *);
129 void	ar9003_write_txpower(struct athn_softc *, int16_t power[]);
130 void	ar9003_reset_rx_gain(struct athn_softc *, struct ieee80211_channel *);
131 void	ar9003_reset_tx_gain(struct athn_softc *, struct ieee80211_channel *);
132 void	ar9003_hw_init(struct athn_softc *, struct ieee80211_channel *,
133 	    struct ieee80211_channel *);
134 void	ar9003_get_lg_tpow(struct athn_softc *, struct ieee80211_channel *,
135 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_leg *,
136 	    int, uint8_t[]);
137 void	ar9003_get_ht_tpow(struct athn_softc *, struct ieee80211_channel *,
138 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_ht *,
139 	    int, uint8_t[]);
140 void	ar9003_set_noise_immunity_level(struct athn_softc *, int);
141 void	ar9003_enable_ofdm_weak_signal(struct athn_softc *);
142 void	ar9003_disable_ofdm_weak_signal(struct athn_softc *);
143 void	ar9003_set_cck_weak_signal(struct athn_softc *, int);
144 void	ar9003_set_firstep_level(struct athn_softc *, int);
145 void	ar9003_set_spur_immunity_level(struct athn_softc *, int);
146 
147 /* Extern functions. */
148 void	athn_stop(struct ifnet *, int);
149 int	athn_interpolate(int, int, int, int, int);
150 int	athn_txtime(struct athn_softc *, int, int, u_int);
151 void	athn_inc_tx_trigger_level(struct athn_softc *);
152 int	athn_tx_pending(struct athn_softc *, int);
153 void	athn_stop_tx_dma(struct athn_softc *, int);
154 void	athn_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
155 void	athn_config_pcie(struct athn_softc *);
156 void	athn_config_nonpcie(struct athn_softc *);
157 uint8_t	athn_chan2fbin(struct ieee80211_channel *);
158 
159 
160 int
161 ar9003_attach(struct athn_softc *sc)
162 {
163 	struct athn_ops *ops = &sc->ops;
164 	int error;
165 
166 	/* Set callbacks for AR9003 family. */
167 	ops->gpio_read = ar9003_gpio_read;
168 	ops->gpio_write = ar9003_gpio_write;
169 	ops->gpio_config_input = ar9003_gpio_config_input;
170 	ops->gpio_config_output = ar9003_gpio_config_output;
171 	ops->rfsilent_init = ar9003_rfsilent_init;
172 
173 	ops->dma_alloc = ar9003_dma_alloc;
174 	ops->dma_free = ar9003_dma_free;
175 	ops->rx_enable = ar9003_rx_enable;
176 	ops->intr = ar9003_intr;
177 	ops->tx = ar9003_tx;
178 
179 	ops->set_rf_mode = ar9003_set_rf_mode;
180 	ops->rf_bus_request = ar9003_rf_bus_request;
181 	ops->rf_bus_release = ar9003_rf_bus_release;
182 	ops->set_phy = ar9003_set_phy;
183 	ops->set_delta_slope = ar9003_set_delta_slope;
184 	ops->enable_antenna_diversity = ar9003_enable_antenna_diversity;
185 	ops->init_baseband = ar9003_init_baseband;
186 	ops->disable_phy = ar9003_disable_phy;
187 	ops->set_rxchains = ar9003_set_rxchains;
188 	ops->noisefloor_calib = ar9003_do_noisefloor_calib;
189 	ops->init_noisefloor_calib = ar9003_init_noisefloor_calib;
190 	ops->get_noisefloor = ar9003_get_noisefloor;
191 	ops->apply_noisefloor = ar9003_apply_noisefloor;
192 	ops->do_calib = ar9003_do_calib;
193 	ops->next_calib = ar9003_next_calib;
194 	ops->hw_init = ar9003_hw_init;
195 
196 	ops->set_noise_immunity_level = ar9003_set_noise_immunity_level;
197 	ops->enable_ofdm_weak_signal = ar9003_enable_ofdm_weak_signal;
198 	ops->disable_ofdm_weak_signal = ar9003_disable_ofdm_weak_signal;
199 	ops->set_cck_weak_signal = ar9003_set_cck_weak_signal;
200 	ops->set_firstep_level = ar9003_set_firstep_level;
201 	ops->set_spur_immunity_level = ar9003_set_spur_immunity_level;
202 
203 	/* Set MAC registers offsets. */
204 	sc->obs_off = AR_OBS;
205 	sc->gpio_input_en_off = AR_GPIO_INPUT_EN_VAL;
206 
207 	if (!(sc->flags & ATHN_FLAG_PCIE))
208 		athn_config_nonpcie(sc);
209 	else
210 		athn_config_pcie(sc);
211 
212 	/* Determine ROM type and location. */
213 	if ((error = ar9003_find_rom(sc)) != 0) {
214 		printf("%s: could not find ROM\n", sc->sc_dev.dv_xname);
215 		return (error);
216 	}
217 	/* Read entire ROM content in memory. */
218 	if ((error = ar9003_read_rom(sc)) != 0) {
219 		printf("%s: could not read ROM\n", sc->sc_dev.dv_xname);
220 		return (error);
221 	}
222 
223 	/* Determine if it is a non-enterprise AR9003 card. */
224 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_MPSD)
225 		sc->flags |= ATHN_FLAG_NON_ENTERPRISE;
226 
227 	ops->setup(sc);
228 	return (0);
229 }
230 
231 /*
232  * Read 16-bit word from EEPROM.
233  */
234 int
235 ar9003_read_eep_word(struct athn_softc *sc, uint32_t addr, uint16_t *val)
236 {
237 	uint32_t reg;
238 	int ntries;
239 
240 	reg = AR_READ(sc, AR_EEPROM_OFFSET(addr));
241 	for (ntries = 0; ntries < 1000; ntries++) {
242 		reg = AR_READ(sc, AR_EEPROM_STATUS_DATA);
243 		if (!(reg & (AR_EEPROM_STATUS_DATA_BUSY |
244 		    AR_EEPROM_STATUS_DATA_PROT_ACCESS))) {
245 			*val = MS(reg, AR_EEPROM_STATUS_DATA_VAL);
246 			return (0);
247 		}
248 		DELAY(10);
249 	}
250 	*val = 0xffff;
251 	return (ETIMEDOUT);
252 }
253 
254 /*
255  * Read an arbitrary number of bytes at a specified address in EEPROM.
256  * NB: The address may not be 16-bit aligned.
257  */
258 int
259 ar9003_read_eep_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
260 {
261 	uint8_t *dst = buf;
262 	uint16_t val;
263 	int error;
264 
265 	if (len > 0 && (addr & 1)) {
266 		/* Deal with non-aligned reads. */
267 		addr >>= 1;
268 		error = ar9003_read_eep_word(sc, addr, &val);
269 		if (error != 0)
270 			return (error);
271 		*dst++ = val & 0xff;
272 		addr--;
273 		len--;
274 	} else
275 		addr >>= 1;
276 	for (; len >= 2; addr--, len -= 2) {
277 		error = ar9003_read_eep_word(sc, addr, &val);
278 		if (error != 0)
279 			return (error);
280 		*dst++ = val >> 8;
281 		*dst++ = val & 0xff;
282 	}
283 	if (len > 0) {
284 		error = ar9003_read_eep_word(sc, addr, &val);
285 		if (error != 0)
286 			return (error);
287 		*dst++ = val >> 8;
288 	}
289 	return (0);
290 }
291 
292 /*
293  * Read 32-bit word from OTPROM.
294  */
295 int
296 ar9003_read_otp_word(struct athn_softc *sc, uint32_t addr, uint32_t *val)
297 {
298 	uint32_t reg;
299 	int ntries;
300 
301 	reg = AR_READ(sc, AR_OTP_BASE(addr));
302 	for (ntries = 0; ntries < 1000; ntries++) {
303 		reg = AR_READ(sc, AR_OTP_STATUS);
304 		if (MS(reg, AR_OTP_STATUS_TYPE) == AR_OTP_STATUS_VALID) {
305 			*val = AR_READ(sc, AR_OTP_READ_DATA);
306 			return (0);
307 		}
308 		DELAY(10);
309 	}
310 	return (ETIMEDOUT);
311 }
312 
313 /*
314  * Read an arbitrary number of bytes at a specified address in OTPROM.
315  * NB: The address may not be 32-bit aligned.
316  */
317 int
318 ar9003_read_otp_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
319 {
320 	uint8_t *dst = buf;
321 	uint32_t val;
322 	int error;
323 
324 	/* NB: not optimal for non-aligned reads, but correct. */
325 	for (; len > 0; addr--, len--) {
326 		error = ar9003_read_otp_word(sc, addr >> 2, &val);
327 		if (error != 0)
328 			return (error);
329 		*dst++ = (val >> ((addr & 3) * 8)) & 0xff;
330 	}
331 	return (0);
332 }
333 
334 /*
335  * Determine if the chip has an external EEPROM or an OTPROM and its size.
336  */
337 int
338 ar9003_find_rom(struct athn_softc *sc)
339 {
340 	struct athn_ops *ops = &sc->ops;
341 	uint32_t hdr;
342 	int error;
343 
344 	/* Try EEPROM. */
345 	ops->read_rom_data = ar9003_read_eep_data;
346 
347 	sc->eep_size = AR_SREV_9485(sc) ? 4096 : 1024;
348 	sc->eep_base = sc->eep_size - 1;
349 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
350 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
351 		return (0);
352 
353 	sc->eep_size = 512;
354 	sc->eep_base = sc->eep_size - 1;
355 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
356 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
357 		return (0);
358 
359 	/* Try OTPROM. */
360 	ops->read_rom_data = ar9003_read_otp_data;
361 
362 	sc->eep_size = 1024;
363 	sc->eep_base = sc->eep_size - 1;
364 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
365 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
366 		return (0);
367 
368 	sc->eep_size = 512;
369 	sc->eep_base = sc->eep_size - 1;
370 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
371 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
372 		return (0);
373 
374 	return (EIO);	/* Not found. */
375 }
376 
377 int
378 ar9003_restore_rom_block(struct athn_softc *sc, uint8_t alg, uint8_t ref,
379     const uint8_t *buf, int len)
380 {
381 	const uint8_t *def, *ptr, *end;
382 	uint8_t *eep = sc->eep;
383 	int off, clen;
384 
385 	if (alg == AR_EEP_COMPRESS_BLOCK) {
386 		/* Block contains chunks that shadow ROM template. */
387 		def = sc->ops.get_rom_template(sc, ref);
388 		if (def == NULL) {
389 			DPRINTF(("unknown template image %d\n", ref));
390 			return (EINVAL);
391 		}
392 		/* Start with template. */
393 		memcpy(eep, def, sc->eep_size);
394 		/* Shadow template with chunks. */
395 		off = 0;	/* Offset in ROM image. */
396 		ptr = buf;	/* Offset in block. */
397 		end = buf + len;
398 		/* Process chunks. */
399 		while (ptr + 2 <= end) {
400 			off += *ptr++;	/* Gap with previous chunk. */
401 			clen = *ptr++;	/* Chunk length. */
402 			/* Make sure block is large enough. */
403 			if (ptr + clen > end)
404 				return (EINVAL);
405 			/* Make sure chunk fits in ROM image. */
406 			if (off + clen > sc->eep_size)
407 				return (EINVAL);
408 			/* Restore chunk. */
409 			DPRINTFN(2, ("ROM chunk @%d/%d\n", off, clen));
410 			memcpy(&eep[off], ptr, clen);
411 			ptr += clen;
412 			off += clen;
413 		}
414 	} else if (alg == AR_EEP_COMPRESS_NONE) {
415 		/* Block contains full ROM image. */
416 		if (len != sc->eep_size) {
417 			DPRINTF(("block length mismatch %d\n", len));
418 			return (EINVAL);
419 		}
420 		memcpy(eep, buf, len);
421 	}
422 	return (0);
423 }
424 
425 int
426 ar9003_read_rom(struct athn_softc *sc)
427 {
428 	struct athn_ops *ops = &sc->ops;
429 	uint8_t *buf, *ptr, alg, ref;
430 	uint16_t sum, rsum;
431 	uint32_t hdr;
432 	int error, addr, len, i, j;
433 
434 	/* Allocate space to store ROM in host memory. */
435 	sc->eep = malloc(sc->eep_size, M_DEVBUF, M_NOWAIT);
436 	if (sc->eep == NULL)
437 		return (ENOMEM);
438 
439 	/* Allocate temporary buffer to store ROM blocks. */
440 	buf = malloc(2048, M_DEVBUF, M_NOWAIT);
441 	if (buf == NULL)
442 		return (ENOMEM);
443 
444 	/* Restore vendor-specified ROM blocks. */
445 	addr = sc->eep_base;
446 	for (i = 0; i < 100; i++) {
447 		/* Read block header. */
448 		error = ops->read_rom_data(sc, addr, &hdr, sizeof(hdr));
449 		if (error != 0)
450 			break;
451 		if (hdr == 0 || hdr == 0xffffffff)
452 			break;
453 		addr -= sizeof(hdr);
454 
455 		/* Extract bits from header. */
456 		ptr = (uint8_t *)&hdr;
457 		alg = (ptr[0] & 0xe0) >> 5;
458 		ref = (ptr[1] & 0x80) >> 2 | (ptr[0] & 0x1f);
459 		len = (ptr[1] & 0x7f) << 4 | (ptr[2] & 0xf0) >> 4;
460 		DPRINTFN(2, ("ROM block %d: alg=%d ref=%d len=%d\n",
461 		    i, alg, ref, len));
462 
463 		/* Read block data (len <= 0x7ff). */
464 		error = ops->read_rom_data(sc, addr, buf, len);
465 		if (error != 0)
466 			break;
467 		addr -= len;
468 
469 		/* Read block checksum. */
470 		error = ops->read_rom_data(sc, addr, &sum, sizeof(sum));
471 		if (error != 0)
472 			break;
473 		addr -= sizeof(sum);
474 
475 		/* Compute block checksum. */
476 		rsum = 0;
477 		for (j = 0; j < len; j++)
478 			rsum += buf[j];
479 		/* Compare to that in ROM. */
480 		if (letoh16(sum) != rsum) {
481 			DPRINTF(("bad block checksum 0x%x/0x%x\n",
482 			    letoh16(sum), rsum));
483 			continue;	/* Skip bad block. */
484 		}
485 		/* Checksum is correct, restore block. */
486 		ar9003_restore_rom_block(sc, alg, ref, buf, len);
487 	}
488 #if BYTE_ORDER == BIG_ENDIAN
489 	/* NB: ROM is always little endian. */
490 	if (error == 0)
491 		ops->swap_rom(sc);
492 #endif
493 	free(buf, M_DEVBUF, 0);
494 	return (error);
495 }
496 
497 /*
498  * Access to General Purpose Input/Output ports.
499  */
500 int
501 ar9003_gpio_read(struct athn_softc *sc, int pin)
502 {
503 	KASSERT(pin < sc->ngpiopins);
504 	return (((AR_READ(sc, AR_GPIO_IN) & AR9300_GPIO_IN_VAL) &
505 	    (1 << pin)) != 0);
506 }
507 
508 void
509 ar9003_gpio_write(struct athn_softc *sc, int pin, int set)
510 {
511 	uint32_t reg;
512 
513 	KASSERT(pin < sc->ngpiopins);
514 	reg = AR_READ(sc, AR_GPIO_IN_OUT);
515 	if (set)
516 		reg |= 1 << pin;
517 	else
518 		reg &= ~(1 << pin);
519 	AR_WRITE(sc, AR_GPIO_IN_OUT, reg);
520 	AR_WRITE_BARRIER(sc);
521 }
522 
523 void
524 ar9003_gpio_config_input(struct athn_softc *sc, int pin)
525 {
526 	uint32_t reg;
527 
528 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
529 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
530 	reg |= AR_GPIO_OE_OUT_DRV_NO << (pin * 2);
531 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
532 	AR_WRITE_BARRIER(sc);
533 }
534 
535 void
536 ar9003_gpio_config_output(struct athn_softc *sc, int pin, int type)
537 {
538 	uint32_t reg;
539 	int mux, off;
540 
541 	mux = pin / 6;
542 	off = pin % 6;
543 
544 	reg = AR_READ(sc, AR_GPIO_OUTPUT_MUX(mux));
545 	reg &= ~(0x1f << (off * 5));
546 	reg |= (type & 0x1f) << (off * 5);
547 	AR_WRITE(sc, AR_GPIO_OUTPUT_MUX(mux), reg);
548 
549 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
550 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
551 	reg |= AR_GPIO_OE_OUT_DRV_ALL << (pin * 2);
552 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
553 	AR_WRITE_BARRIER(sc);
554 }
555 
556 void
557 ar9003_rfsilent_init(struct athn_softc *sc)
558 {
559 	uint32_t reg;
560 
561 	/* Configure hardware radio switch. */
562 	AR_SETBITS(sc, AR_GPIO_INPUT_EN_VAL, AR_GPIO_INPUT_EN_VAL_RFSILENT_BB);
563 	reg = AR_READ(sc, AR_GPIO_INPUT_MUX2);
564 	reg = RW(reg, AR_GPIO_INPUT_MUX2_RFSILENT, 0);
565 	AR_WRITE(sc, AR_GPIO_INPUT_MUX2, reg);
566 	ar9003_gpio_config_input(sc, sc->rfsilent_pin);
567 	AR_SETBITS(sc, AR_PHY_TEST, AR_PHY_TEST_RFSILENT_BB);
568 	if (!(sc->flags & ATHN_FLAG_RFSILENT_REVERSED)) {
569 		AR_SETBITS(sc, AR_GPIO_INTR_POL,
570 		    AR_GPIO_INTR_POL_PIN(sc->rfsilent_pin));
571 	}
572 	AR_WRITE_BARRIER(sc);
573 }
574 
575 int
576 ar9003_dma_alloc(struct athn_softc *sc)
577 {
578 	int error;
579 
580 	error = ar9003_tx_alloc(sc);
581 	if (error != 0)
582 		return (error);
583 
584 	error = ar9003_rx_alloc(sc, ATHN_QID_LP, AR9003_RX_LP_QDEPTH);
585 	if (error != 0)
586 		return (error);
587 
588 	error = ar9003_rx_alloc(sc, ATHN_QID_HP, AR9003_RX_HP_QDEPTH);
589 	if (error != 0)
590 		return (error);
591 
592 	return (0);
593 }
594 
595 void
596 ar9003_dma_free(struct athn_softc *sc)
597 {
598 	ar9003_tx_free(sc);
599 	ar9003_rx_free(sc, ATHN_QID_LP);
600 	ar9003_rx_free(sc, ATHN_QID_HP);
601 }
602 
603 int
604 ar9003_tx_alloc(struct athn_softc *sc)
605 {
606 	struct athn_tx_buf *bf;
607 	bus_size_t size;
608 	int error, nsegs, i;
609 
610 	/*
611 	 * Allocate Tx status ring.
612 	 */
613 	size = AR9003_NTXSTATUS * sizeof(struct ar_tx_status);
614 
615 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
616 	    BUS_DMA_NOWAIT, &sc->txsmap);
617 	if (error != 0)
618 		goto fail;
619 
620 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->txsseg, 1,
621 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
622 	if (error != 0)
623 		goto fail;
624 
625 	error = bus_dmamem_map(sc->sc_dmat, &sc->txsseg, 1, size,
626 	    (caddr_t *)&sc->txsring, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
627 	if (error != 0)
628 		goto fail;
629 
630 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->txsmap, &sc->txsseg,
631 	    1, size, BUS_DMA_NOWAIT | BUS_DMA_READ);
632 	if (error != 0)
633 		goto fail;
634 
635 	/*
636 	 * Allocate a pool of Tx descriptors shared between all Tx queues.
637 	 */
638 	size = ATHN_NTXBUFS * sizeof(struct ar_tx_desc);
639 
640 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
641 	    BUS_DMA_NOWAIT, &sc->map);
642 	if (error != 0)
643 		goto fail;
644 
645 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->seg, 1,
646 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
647 	if (error != 0)
648 		goto fail;
649 
650 	error = bus_dmamem_map(sc->sc_dmat, &sc->seg, 1, size,
651 	    (caddr_t *)&sc->descs, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
652 	if (error != 0)
653 		goto fail;
654 
655 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->map, &sc->seg, 1, size,
656 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
657 	if (error != 0)
658 		goto fail;
659 
660 	SIMPLEQ_INIT(&sc->txbufs);
661 	for (i = 0; i < ATHN_NTXBUFS; i++) {
662 		bf = &sc->txpool[i];
663 
664 		error = bus_dmamap_create(sc->sc_dmat, ATHN_TXBUFSZ,
665 		    AR9003_MAX_SCATTER, ATHN_TXBUFSZ, 0, BUS_DMA_NOWAIT,
666 		    &bf->bf_map);
667 		if (error != 0) {
668 			printf("%s: could not create Tx buf DMA map\n",
669 			    sc->sc_dev.dv_xname);
670 			goto fail;
671 		}
672 
673 		bf->bf_descs = &((struct ar_tx_desc *)sc->descs)[i];
674 		bf->bf_daddr = sc->map->dm_segs[0].ds_addr +
675 		    i * sizeof(struct ar_tx_desc);
676 
677 		SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
678 	}
679 	return (0);
680  fail:
681 	ar9003_tx_free(sc);
682 	return (error);
683 }
684 
685 void
686 ar9003_tx_free(struct athn_softc *sc)
687 {
688 	struct athn_tx_buf *bf;
689 	int i;
690 
691 	for (i = 0; i < ATHN_NTXBUFS; i++) {
692 		bf = &sc->txpool[i];
693 
694 		if (bf->bf_map != NULL)
695 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
696 	}
697 	/* Free Tx descriptors. */
698 	if (sc->map != NULL) {
699 		if (sc->descs != NULL) {
700 			bus_dmamap_unload(sc->sc_dmat, sc->map);
701 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->descs,
702 			    ATHN_NTXBUFS * sizeof(struct ar_tx_desc));
703 			bus_dmamem_free(sc->sc_dmat, &sc->seg, 1);
704 		}
705 		bus_dmamap_destroy(sc->sc_dmat, sc->map);
706 	}
707 	/* Free Tx status ring. */
708 	if (sc->txsmap != NULL) {
709 		if (sc->txsring != NULL) {
710 			bus_dmamap_unload(sc->sc_dmat, sc->txsmap);
711 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->txsring,
712 			     AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
713 			bus_dmamem_free(sc->sc_dmat, &sc->txsseg, 1);
714 		}
715 		bus_dmamap_destroy(sc->sc_dmat, sc->txsmap);
716 	}
717 }
718 
719 int
720 ar9003_rx_alloc(struct athn_softc *sc, int qid, int count)
721 {
722 	struct athn_rxq *rxq = &sc->rxq[qid];
723 	struct athn_rx_buf *bf;
724 	struct ar_rx_status *ds;
725 	int error, i;
726 
727 	rxq->bf = mallocarray(count, sizeof(*bf), M_DEVBUF,
728 	    M_NOWAIT | M_ZERO);
729 	if (rxq->bf == NULL)
730 		return (ENOMEM);
731 
732 	rxq->count = count;
733 
734 	for (i = 0; i < rxq->count; i++) {
735 		bf = &rxq->bf[i];
736 
737 		error = bus_dmamap_create(sc->sc_dmat, ATHN_RXBUFSZ, 1,
738 		    ATHN_RXBUFSZ, 0, BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW,
739 		    &bf->bf_map);
740 		if (error != 0) {
741 			printf("%s: could not create Rx buf DMA map\n",
742 			    sc->sc_dev.dv_xname);
743 			goto fail;
744 		}
745 		/*
746 		 * Assumes MCLGETI returns cache-line-size aligned buffers.
747 		 */
748 		bf->bf_m = MCLGETI(NULL, M_DONTWAIT, NULL, ATHN_RXBUFSZ);
749 		if (bf->bf_m == NULL) {
750 			printf("%s: could not allocate Rx mbuf\n",
751 			    sc->sc_dev.dv_xname);
752 			error = ENOBUFS;
753 			goto fail;
754 		}
755 
756 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
757 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
758 		    BUS_DMA_NOWAIT);
759 		if (error != 0) {
760 			printf("%s: could not DMA map Rx buffer\n",
761 			    sc->sc_dev.dv_xname);
762 			goto fail;
763 		}
764 
765 		ds = mtod(bf->bf_m, struct ar_rx_status *);
766 		memset(ds, 0, sizeof(*ds));
767 		bf->bf_desc = ds;
768 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
769 
770 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
771 		    BUS_DMASYNC_PREREAD);
772 	}
773 	return (0);
774  fail:
775 	ar9003_rx_free(sc, qid);
776 	return (error);
777 }
778 
779 void
780 ar9003_rx_free(struct athn_softc *sc, int qid)
781 {
782 	struct athn_rxq *rxq = &sc->rxq[qid];
783 	struct athn_rx_buf *bf;
784 	int i;
785 
786 	if (rxq->bf == NULL)
787 		return;
788 	for (i = 0; i < rxq->count; i++) {
789 		bf = &rxq->bf[i];
790 
791 		if (bf->bf_map != NULL)
792 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
793 		m_freem(bf->bf_m);
794 	}
795 	free(rxq->bf, M_DEVBUF, 0);
796 }
797 
798 void
799 ar9003_reset_txsring(struct athn_softc *sc)
800 {
801 	sc->txscur = 0;
802 	memset(sc->txsring, 0, AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
803 	AR_WRITE(sc, AR_Q_STATUS_RING_START,
804 	    sc->txsmap->dm_segs[0].ds_addr);
805 	AR_WRITE(sc, AR_Q_STATUS_RING_END,
806 	    sc->txsmap->dm_segs[0].ds_addr + sc->txsmap->dm_segs[0].ds_len);
807 	AR_WRITE_BARRIER(sc);
808 }
809 
810 void
811 ar9003_rx_enable(struct athn_softc *sc)
812 {
813 	struct athn_rxq *rxq;
814 	struct athn_rx_buf *bf;
815 	struct ar_rx_status *ds;
816 	uint32_t reg;
817 	int qid, i;
818 
819 	reg = AR_READ(sc, AR_RXBP_THRESH);
820 	reg = RW(reg, AR_RXBP_THRESH_HP, 1);
821 	reg = RW(reg, AR_RXBP_THRESH_LP, 1);
822 	AR_WRITE(sc, AR_RXBP_THRESH, reg);
823 
824 	/* Set Rx buffer size. */
825 	AR_WRITE(sc, AR_DATABUF_SIZE, ATHN_RXBUFSZ - sizeof(*ds));
826 
827 	for (qid = 0; qid < 2; qid++) {
828 		rxq = &sc->rxq[qid];
829 
830 		/* Setup Rx status descriptors. */
831 		SIMPLEQ_INIT(&rxq->head);
832 		for (i = 0; i < rxq->count; i++) {
833 			bf = &rxq->bf[i];
834 			ds = bf->bf_desc;
835 
836 			memset(ds, 0, sizeof(*ds));
837 			if (qid == ATHN_QID_LP)
838 				AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
839 			else
840 				AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
841 			AR_WRITE_BARRIER(sc);
842 			SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
843 		}
844 	}
845 	/* Enable Rx. */
846 	AR_WRITE(sc, AR_CR, 0);
847 	AR_WRITE_BARRIER(sc);
848 }
849 
850 #if NBPFILTER > 0
851 void
852 ar9003_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
853     struct ar_rx_status *ds)
854 {
855 #define IEEE80211_RADIOTAP_F_SHORTGI	0x80	/* XXX from FBSD */
856 
857 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
858 	struct ieee80211com *ic = &sc->sc_ic;
859 	struct mbuf mb;
860 	uint64_t tsf;
861 	uint32_t tstamp;
862 	uint8_t rate;
863 
864 	/* Extend the 15-bit timestamp from Rx status to 64-bit TSF. */
865 	tstamp = ds->ds_status3;
866 	tsf = AR_READ(sc, AR_TSF_U32);
867 	tsf = tsf << 32 | AR_READ(sc, AR_TSF_L32);
868 	if ((tsf & 0x7fff) < tstamp)
869 		tsf -= 0x8000;
870 	tsf = (tsf & ~0x7fff) | tstamp;
871 
872 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
873 	tap->wr_tsft = htole64(tsf);
874 	tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
875 	tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
876 	tap->wr_dbm_antsignal = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
877 	/* XXX noise. */
878 	tap->wr_antenna = MS(ds->ds_status4, AR_RXS4_ANTENNA);
879 	tap->wr_rate = 0;	/* In case it can't be found below. */
880 	rate = MS(ds->ds_status1, AR_RXS1_RATE);
881 	if (rate & 0x80) {		/* HT. */
882 		/* Bit 7 set means HT MCS instead of rate. */
883 		tap->wr_rate = rate;
884 		if (!(ds->ds_status4 & AR_RXS4_GI))
885 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
886 
887 	} else if (rate & 0x10) {	/* CCK. */
888 		if (rate & 0x04)
889 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
890 		switch (rate & ~0x14) {
891 		case 0xb: tap->wr_rate =   2; break;
892 		case 0xa: tap->wr_rate =   4; break;
893 		case 0x9: tap->wr_rate =  11; break;
894 		case 0x8: tap->wr_rate =  22; break;
895 		}
896 	} else {			/* OFDM. */
897 		switch (rate) {
898 		case 0xb: tap->wr_rate =  12; break;
899 		case 0xf: tap->wr_rate =  18; break;
900 		case 0xa: tap->wr_rate =  24; break;
901 		case 0xe: tap->wr_rate =  36; break;
902 		case 0x9: tap->wr_rate =  48; break;
903 		case 0xd: tap->wr_rate =  72; break;
904 		case 0x8: tap->wr_rate =  96; break;
905 		case 0xc: tap->wr_rate = 108; break;
906 		}
907 	}
908 	mb.m_data = (caddr_t)tap;
909 	mb.m_len = sc->sc_rxtap_len;
910 	mb.m_next = m;
911 	mb.m_nextpkt = NULL;
912 	mb.m_type = 0;
913 	mb.m_flags = 0;
914 	bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
915 }
916 #endif
917 
918 int
919 ar9003_rx_process(struct athn_softc *sc, int qid)
920 {
921 	struct ieee80211com *ic = &sc->sc_ic;
922 	struct ifnet *ifp = &ic->ic_if;
923 	struct athn_rxq *rxq = &sc->rxq[qid];
924 	struct athn_rx_buf *bf;
925 	struct ar_rx_status *ds;
926 	struct ieee80211_frame *wh;
927 	struct ieee80211_rxinfo rxi;
928 	struct ieee80211_node *ni;
929 	struct mbuf *m, *m1;
930 	int error, len;
931 
932 	bf = SIMPLEQ_FIRST(&rxq->head);
933 	if (__predict_false(bf == NULL)) {	/* Should not happen. */
934 		printf("%s: Rx queue is empty!\n", sc->sc_dev.dv_xname);
935 		return (ENOENT);
936 	}
937 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
938 	    BUS_DMASYNC_POSTREAD);
939 
940 	ds = mtod(bf->bf_m, struct ar_rx_status *);
941 	if (!(ds->ds_status11 & AR_RXS11_DONE))
942 		return (EBUSY);
943 
944 	/* Check that it is a valid Rx status descriptor. */
945 	if ((ds->ds_info & (AR_RXI_DESC_ID_M | AR_RXI_DESC_TX |
946 	    AR_RXI_CTRL_STAT)) != SM(AR_RXI_DESC_ID, AR_VENDOR_ATHEROS))
947 		goto skip;
948 
949 	if (!(ds->ds_status11 & AR_RXS11_FRAME_OK)) {
950 		if (ds->ds_status11 & AR_RXS11_CRC_ERR)
951 			DPRINTFN(6, ("CRC error\n"));
952 		else if (ds->ds_status11 & AR_RXS11_PHY_ERR)
953 			DPRINTFN(6, ("PHY error=0x%x\n",
954 			    MS(ds->ds_status11, AR_RXS11_PHY_ERR_CODE)));
955 		else if (ds->ds_status11 & AR_RXS11_DECRYPT_CRC_ERR)
956 			DPRINTFN(6, ("Decryption CRC error\n"));
957 		else if (ds->ds_status11 & AR_RXS11_MICHAEL_ERR) {
958 			DPRINTFN(2, ("Michael MIC failure\n"));
959 			/* Report Michael MIC failures to net80211. */
960 			ic->ic_stats.is_rx_locmicfail++;
961 			ieee80211_michael_mic_failure(ic, 0);
962 			/*
963 			 * XXX Check that it is not a control frame
964 			 * (invalid MIC failures on valid ctl frames).
965 			 */
966 		}
967 		ifp->if_ierrors++;
968 		goto skip;
969 	}
970 
971 	len = MS(ds->ds_status2, AR_RXS2_DATA_LEN);
972 	if (__predict_false(len < IEEE80211_MIN_LEN ||
973 	    len > ATHN_RXBUFSZ - sizeof(*ds))) {
974 		DPRINTF(("corrupted descriptor length=%d\n", len));
975 		ifp->if_ierrors++;
976 		goto skip;
977 	}
978 
979 	/* Allocate a new Rx buffer. */
980 	m1 = MCLGETI(NULL, M_DONTWAIT, NULL, ATHN_RXBUFSZ);
981 	if (__predict_false(m1 == NULL)) {
982 		ic->ic_stats.is_rx_nombuf++;
983 		ifp->if_ierrors++;
984 		goto skip;
985 	}
986 
987 	/* Unmap the old Rx buffer. */
988 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
989 
990 	/* Map the new Rx buffer. */
991 	error = bus_dmamap_load(sc->sc_dmat, bf->bf_map, mtod(m1, void *),
992 	    ATHN_RXBUFSZ, NULL, BUS_DMA_NOWAIT | BUS_DMA_READ);
993 	if (__predict_false(error != 0)) {
994 		m_freem(m1);
995 
996 		/* Remap the old Rx buffer or panic. */
997 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
998 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
999 		    BUS_DMA_NOWAIT | BUS_DMA_READ);
1000 		KASSERT(error != 0);
1001 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
1002 		ifp->if_ierrors++;
1003 		goto skip;
1004 	}
1005 	bf->bf_desc = mtod(m1, struct ar_rx_status *);
1006 	bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
1007 
1008 	m = bf->bf_m;
1009 	bf->bf_m = m1;
1010 
1011 	/* Finalize mbuf. */
1012 	/* Strip Rx status descriptor from head. */
1013 	m->m_data = (caddr_t)&ds[1];
1014 	m->m_pkthdr.len = m->m_len = len;
1015 
1016 	/* Grab a reference to the source node. */
1017 	wh = mtod(m, struct ieee80211_frame *);
1018 	ni = ieee80211_find_rxnode(ic, wh);
1019 
1020 	/* Remove any HW padding after the 802.11 header. */
1021 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
1022 		u_int hdrlen = ieee80211_get_hdrlen(wh);
1023 		if (hdrlen & 3) {
1024 			memmove((caddr_t)wh + 2, wh, hdrlen);
1025 			m_adj(m, 2);
1026 		}
1027 	}
1028 #if NBPFILTER > 0
1029 	if (__predict_false(sc->sc_drvbpf != NULL))
1030 		ar9003_rx_radiotap(sc, m, ds);
1031 #endif
1032 	/* Trim 802.11 FCS after radiotap. */
1033 	m_adj(m, -IEEE80211_CRC_LEN);
1034 
1035 	/* Send the frame to the 802.11 layer. */
1036 	rxi.rxi_flags = 0;	/* XXX */
1037 	rxi.rxi_rssi = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
1038 	rxi.rxi_tstamp = ds->ds_status3;
1039 	ieee80211_input(ifp, m, ni, &rxi);
1040 
1041 	/* Node is no longer needed. */
1042 	ieee80211_release_node(ic, ni);
1043 
1044  skip:
1045 	/* Unlink this descriptor from head. */
1046 	SIMPLEQ_REMOVE_HEAD(&rxq->head, bf_list);
1047 	memset(bf->bf_desc, 0, sizeof(*ds));
1048 
1049 	/* Re-use this descriptor and link it to tail. */
1050 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
1051 	    BUS_DMASYNC_PREREAD);
1052 
1053 	if (qid == ATHN_QID_LP)
1054 		AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
1055 	else
1056 		AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
1057 	AR_WRITE_BARRIER(sc);
1058 	SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
1059 
1060 	/* Re-enable Rx. */
1061 	AR_WRITE(sc, AR_CR, 0);
1062 	AR_WRITE_BARRIER(sc);
1063 	return (0);
1064 }
1065 
1066 void
1067 ar9003_rx_intr(struct athn_softc *sc, int qid)
1068 {
1069 	while (ar9003_rx_process(sc, qid) == 0);
1070 }
1071 
1072 int
1073 ar9003_tx_process(struct athn_softc *sc)
1074 {
1075 	struct ieee80211com *ic = &sc->sc_ic;
1076 	struct ifnet *ifp = &ic->ic_if;
1077 	struct athn_txq *txq;
1078 	struct athn_node *an;
1079 	struct athn_tx_buf *bf;
1080 	struct ar_tx_status *ds;
1081 	uint8_t qid, failcnt;
1082 
1083 	ds = &((struct ar_tx_status *)sc->txsring)[sc->txscur];
1084 	if (!(ds->ds_status8 & AR_TXS8_DONE))
1085 		return (EBUSY);
1086 
1087 	sc->txscur = (sc->txscur + 1) % AR9003_NTXSTATUS;
1088 
1089 	/* Check that it is a valid Tx status descriptor. */
1090 	if ((ds->ds_info & (AR_TXI_DESC_ID_M | AR_TXI_DESC_TX)) !=
1091 	    (SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) | AR_TXI_DESC_TX)) {
1092 		memset(ds, 0, sizeof(*ds));
1093 		return (0);
1094 	}
1095 	/* Retrieve the queue that was used to send this PDU. */
1096 	qid = MS(ds->ds_info, AR_TXI_QCU_NUM);
1097 	txq = &sc->txq[qid];
1098 
1099 	bf = SIMPLEQ_FIRST(&txq->head);
1100 	if (bf == NULL || bf == txq->wait) {
1101 		memset(ds, 0, sizeof(*ds));
1102 		return (0);
1103 	}
1104 	SIMPLEQ_REMOVE_HEAD(&txq->head, bf_list);
1105 
1106 	sc->sc_tx_timer = 0;
1107 
1108 	if (ds->ds_status3 & AR_TXS3_EXCESSIVE_RETRIES)
1109 		ifp->if_oerrors++;
1110 
1111 	if (ds->ds_status3 & AR_TXS3_UNDERRUN)
1112 		athn_inc_tx_trigger_level(sc);
1113 
1114 	/* Wakeup PA predistortion state machine. */
1115 	if (bf->bf_txflags & ATHN_TXFLAG_PAPRD)
1116 		ar9003_paprd_tx_tone_done(sc);
1117 
1118 	an = (struct athn_node *)bf->bf_ni;
1119 	/*
1120 	 * NB: the data fail count contains the number of un-acked tries
1121 	 * for the final series used.  We must add the number of tries for
1122 	 * each series that was fully processed.
1123 	 */
1124 	failcnt  = MS(ds->ds_status3, AR_TXS3_DATA_FAIL_CNT);
1125 	/* NB: Assume two tries per series. */
1126 	failcnt += MS(ds->ds_status8, AR_TXS8_FINAL_IDX) * 2;
1127 
1128 	/* Update rate control statistics. */
1129 	an->amn.amn_txcnt++;
1130 	if (failcnt > 0)
1131 		an->amn.amn_retrycnt++;
1132 
1133 	DPRINTFN(5, ("Tx done qid=%d status3=%d fail count=%d\n",
1134 	    qid, ds->ds_status3, failcnt));
1135 
1136 	/* Reset Tx status descriptor. */
1137 	memset(ds, 0, sizeof(*ds));
1138 
1139 	/* Unmap Tx buffer. */
1140 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1141 	    BUS_DMASYNC_POSTWRITE);
1142 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1143 
1144 	m_freem(bf->bf_m);
1145 	bf->bf_m = NULL;
1146 	ieee80211_release_node(ic, bf->bf_ni);
1147 	bf->bf_ni = NULL;
1148 
1149 	/* Link Tx buffer back to global free list. */
1150 	SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
1151 
1152 	/* Queue buffers that are waiting if there is new room. */
1153 	if (--txq->queued < AR9003_TX_QDEPTH && txq->wait != NULL) {
1154 		AR_WRITE(sc, AR_QTXDP(qid), txq->wait->bf_daddr);
1155 		AR_WRITE_BARRIER(sc);
1156 		txq->wait = SIMPLEQ_NEXT(txq->wait, bf_list);
1157 	}
1158 	return (0);
1159 }
1160 
1161 void
1162 ar9003_tx_intr(struct athn_softc *sc)
1163 {
1164 	struct ieee80211com *ic = &sc->sc_ic;
1165 	struct ifnet *ifp = &ic->ic_if;
1166 
1167 	while (ar9003_tx_process(sc) == 0);
1168 
1169 	if (!SIMPLEQ_EMPTY(&sc->txbufs)) {
1170 		ifq_clr_oactive(&ifp->if_snd);
1171 		ifp->if_start(ifp);
1172 	}
1173 }
1174 
1175 #ifndef IEEE80211_STA_ONLY
1176 /*
1177  * Process Software Beacon Alert interrupts.
1178  */
1179 int
1180 ar9003_swba_intr(struct athn_softc *sc)
1181 {
1182 	struct ieee80211com *ic = &sc->sc_ic;
1183 	struct ifnet *ifp = &ic->ic_if;
1184 	struct ieee80211_node *ni = ic->ic_bss;
1185 	struct athn_tx_buf *bf = sc->bcnbuf;
1186 	struct ieee80211_frame *wh;
1187 	struct ar_tx_desc *ds;
1188 	struct mbuf *m;
1189 	uint32_t sum;
1190 	uint8_t ridx, hwrate;
1191 	int error, totlen;
1192 
1193 	if (ic->ic_tim_mcast_pending &&
1194 	    mq_empty(&ni->ni_savedq) &&
1195 	    SIMPLEQ_EMPTY(&sc->txq[ATHN_QID_CAB].head))
1196 		ic->ic_tim_mcast_pending = 0;
1197 
1198 	if (ic->ic_dtim_count == 0)
1199 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1200 	else
1201 		ic->ic_dtim_count--;
1202 
1203 	/* Make sure previous beacon has been sent. */
1204 	if (athn_tx_pending(sc, ATHN_QID_BEACON)) {
1205 		DPRINTF(("beacon stuck\n"));
1206 		return (EBUSY);
1207 	}
1208 	/* Get new beacon. */
1209 	m = ieee80211_beacon_alloc(ic, ic->ic_bss);
1210 	if (__predict_false(m == NULL))
1211 		return (ENOBUFS);
1212 	/* Assign sequence number. */
1213 	wh = mtod(m, struct ieee80211_frame *);
1214 	*(uint16_t *)&wh->i_seq[0] =
1215 	    htole16(ic->ic_bss->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
1216 	ic->ic_bss->ni_txseq++;
1217 
1218 	/* Unmap and free old beacon if any. */
1219 	if (__predict_true(bf->bf_m != NULL)) {
1220 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0,
1221 		    bf->bf_map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1222 		bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1223 		m_freem(bf->bf_m);
1224 		bf->bf_m = NULL;
1225 	}
1226 	/* DMA map new beacon. */
1227 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1228 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1229 	if (__predict_false(error != 0)) {
1230 		m_freem(m);
1231 		return (error);
1232 	}
1233 	bf->bf_m = m;
1234 
1235 	/* Setup Tx descriptor (simplified ar9003_tx()). */
1236 	ds = bf->bf_descs;
1237 	memset(ds, 0, sizeof(*ds));
1238 
1239 	ds->ds_info =
1240 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1241 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1242 	    SM(AR_TXI_QCU_NUM, ATHN_QID_BEACON) |
1243 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1244 
1245 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1246 	ds->ds_ctl11 = SM(AR_TXC11_FRAME_LEN, totlen);
1247 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, AR_MAX_RATE_POWER);
1248 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, AR_FRAME_TYPE_BEACON);
1249 	ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1250 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, AR_ENCR_TYPE_CLEAR);
1251 
1252 	/* Write number of tries. */
1253 	ds->ds_ctl13 = SM(AR_TXC13_XMIT_DATA_TRIES0, 1);
1254 
1255 	/* Write Tx rate. */
1256 	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1257 	    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1258 	hwrate = athn_rates[ridx].hwrate;
1259 	ds->ds_ctl14 = SM(AR_TXC14_XMIT_RATE0, hwrate);
1260 
1261 	/* Write Tx chains. */
1262 	ds->ds_ctl18 = SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask);
1263 
1264 	ds->ds_segs[0].ds_data = bf->bf_map->dm_segs[0].ds_addr;
1265 	/* Segment length must be a multiple of 4. */
1266 	ds->ds_segs[0].ds_ctl |= SM(AR_TXC_BUF_LEN,
1267 	    (bf->bf_map->dm_segs[0].ds_len + 3) & ~3);
1268 	/* Compute Tx descriptor checksum. */
1269 	sum = ds->ds_info;
1270 	sum += ds->ds_segs[0].ds_data;
1271 	sum += ds->ds_segs[0].ds_ctl;
1272 	sum = (sum >> 16) + (sum & 0xffff);
1273 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1274 
1275 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1276 	    BUS_DMASYNC_PREWRITE);
1277 
1278 	/* Stop Tx DMA before putting the new beacon on the queue. */
1279 	athn_stop_tx_dma(sc, ATHN_QID_BEACON);
1280 
1281 	AR_WRITE(sc, AR_QTXDP(ATHN_QID_BEACON), bf->bf_daddr);
1282 
1283 	for(;;) {
1284 		if (SIMPLEQ_EMPTY(&sc->txbufs))
1285 			break;
1286 
1287 		m = mq_dequeue(&ni->ni_savedq);
1288 		if (m == NULL)
1289 			break;
1290 		if (!mq_empty(&ni->ni_savedq)) {
1291 			/* more queued frames, set the more data bit */
1292 			wh = mtod(m, struct ieee80211_frame *);
1293 			wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
1294 		}
1295 
1296 		if (sc->ops.tx(sc, m, ni, ATHN_TXFLAG_CAB) != 0) {
1297 			ieee80211_release_node(ic, ni);
1298 			ifp->if_oerrors++;
1299 			break;
1300 		}
1301 	}
1302 
1303 	/* Kick Tx. */
1304 	AR_WRITE(sc, AR_Q_TXE, 1 << ATHN_QID_BEACON);
1305 	AR_WRITE_BARRIER(sc);
1306 	return (0);
1307 }
1308 #endif
1309 
1310 int
1311 ar9003_intr(struct athn_softc *sc)
1312 {
1313 	uint32_t intr, intr2, intr5, sync;
1314 
1315 	/* Get pending interrupts. */
1316 	intr = AR_READ(sc, AR_INTR_ASYNC_CAUSE);
1317 	if (!(intr & AR_INTR_MAC_IRQ) || intr == AR_INTR_SPURIOUS) {
1318 		intr = AR_READ(sc, AR_INTR_SYNC_CAUSE);
1319 		if (intr == AR_INTR_SPURIOUS || (intr & sc->isync) == 0)
1320 			return (0);	/* Not for us. */
1321 	}
1322 
1323 	if ((AR_READ(sc, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) &&
1324 	    (AR_READ(sc, AR_RTC_STATUS) & AR_RTC_STATUS_M) == AR_RTC_STATUS_ON)
1325 		intr = AR_READ(sc, AR_ISR);
1326 	else
1327 		intr = 0;
1328 	sync = AR_READ(sc, AR_INTR_SYNC_CAUSE) & sc->isync;
1329 	if (intr == 0 && sync == 0)
1330 		return (0);	/* Not for us. */
1331 
1332 	if (intr != 0) {
1333 		if (intr & AR_ISR_BCNMISC) {
1334 			intr2 = AR_READ(sc, AR_ISR_S2);
1335 			if (intr2 & AR_ISR_S2_TIM)
1336 				/* TBD */;
1337 			if (intr2 & AR_ISR_S2_TSFOOR)
1338 				/* TBD */;
1339 			if (intr2 & AR_ISR_S2_BB_WATCHDOG)
1340 				/* TBD */;
1341 		}
1342 		intr = AR_READ(sc, AR_ISR_RAC);
1343 		if (intr == AR_INTR_SPURIOUS)
1344 			return (1);
1345 
1346 #ifndef IEEE80211_STA_ONLY
1347 		if (intr & AR_ISR_SWBA)
1348 			ar9003_swba_intr(sc);
1349 #endif
1350 		if (intr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
1351 			ar9003_rx_intr(sc, ATHN_QID_LP);
1352 		if (intr & (AR_ISR_LP_RXOK | AR_ISR_RXERR | AR_ISR_RXEOL))
1353 			ar9003_rx_intr(sc, ATHN_QID_LP);
1354 		if (intr & AR_ISR_HP_RXOK)
1355 			ar9003_rx_intr(sc, ATHN_QID_HP);
1356 
1357 		if (intr & (AR_ISR_TXMINTR | AR_ISR_TXINTM))
1358 			ar9003_tx_intr(sc);
1359 		if (intr & (AR_ISR_TXOK | AR_ISR_TXERR | AR_ISR_TXEOL))
1360 			ar9003_tx_intr(sc);
1361 
1362 		if (intr & AR_ISR_GENTMR) {
1363 			intr5 = AR_READ(sc, AR_ISR_S5_S);
1364 			DPRINTF(("GENTMR trigger=%d thresh=%d\n",
1365 			    MS(intr5, AR_ISR_S5_GENTIMER_TRIG),
1366 			    MS(intr5, AR_ISR_S5_GENTIMER_THRESH)));
1367 		}
1368 	}
1369 	if (sync != 0) {
1370 		if (sync & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
1371 			AR_WRITE(sc, AR_RC, AR_RC_HOSTIF);
1372 			AR_WRITE(sc, AR_RC, 0);
1373 		}
1374 
1375 		if ((sc->flags & ATHN_FLAG_RFSILENT) &&
1376 		    (sync & AR_INTR_SYNC_GPIO_PIN(sc->rfsilent_pin))) {
1377 			struct ifnet *ifp = &sc->sc_ic.ic_if;
1378 
1379 			printf("%s: radio switch turned off\n",
1380 			    sc->sc_dev.dv_xname);
1381 			/* Turn the interface down. */
1382 			athn_stop(ifp, 1);
1383 			return (1);
1384 		}
1385 
1386 		AR_WRITE(sc, AR_INTR_SYNC_CAUSE, sync);
1387 		(void)AR_READ(sc, AR_INTR_SYNC_CAUSE);
1388 	}
1389 	return (1);
1390 }
1391 
1392 int
1393 ar9003_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
1394     int txflags)
1395 {
1396 	struct ieee80211com *ic = &sc->sc_ic;
1397 	struct ieee80211_key *k = NULL;
1398 	struct ieee80211_frame *wh;
1399 	struct athn_series series[4];
1400 	struct ar_tx_desc *ds;
1401 	struct athn_txq *txq;
1402 	struct athn_tx_buf *bf;
1403 	struct athn_node *an = (void *)ni;
1404 	struct mbuf *m1;
1405 	uintptr_t entry;
1406 	uint32_t sum;
1407 	uint16_t qos = 0;
1408 	uint8_t txpower, type, encrtype, tid, ridx[4];
1409 	int i, error, totlen, hasqos, qid;
1410 
1411 	/* Grab a Tx buffer from our global free list. */
1412 	bf = SIMPLEQ_FIRST(&sc->txbufs);
1413 	KASSERT(bf != NULL);
1414 
1415 	/* Map 802.11 frame type to hardware frame type. */
1416 	wh = mtod(m, struct ieee80211_frame *);
1417 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1418 	    IEEE80211_FC0_TYPE_MGT) {
1419 		/* NB: Beacons do not use ar9003_tx(). */
1420 		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1421 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1422 			type = AR_FRAME_TYPE_PROBE_RESP;
1423 		else if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1424 		    IEEE80211_FC0_SUBTYPE_ATIM)
1425 			type = AR_FRAME_TYPE_ATIM;
1426 		else
1427 			type = AR_FRAME_TYPE_NORMAL;
1428 	} else if ((wh->i_fc[0] &
1429 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1430 	    (IEEE80211_FC0_TYPE_CTL  | IEEE80211_FC0_SUBTYPE_PS_POLL)) {
1431 		type = AR_FRAME_TYPE_PSPOLL;
1432 	} else
1433 		type = AR_FRAME_TYPE_NORMAL;
1434 
1435 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1436 		k = ieee80211_get_txkey(ic, wh, ni);
1437 		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1438 			return (ENOBUFS);
1439 		wh = mtod(m, struct ieee80211_frame *);
1440 	}
1441 
1442 	/* XXX 2-byte padding for QoS and 4-addr headers. */
1443 
1444 	/* Select the HW Tx queue to use for this frame. */
1445 	if ((hasqos = ieee80211_has_qos(wh))) {
1446 		qos = ieee80211_get_qos(wh);
1447 		tid = qos & IEEE80211_QOS_TID;
1448 		qid = athn_ac2qid[ieee80211_up_to_ac(ic, tid)];
1449 	} else if (type == AR_FRAME_TYPE_PSPOLL) {
1450 		qid = ATHN_QID_PSPOLL;
1451 	} else if (txflags & ATHN_TXFLAG_CAB) {
1452 		qid = ATHN_QID_CAB;
1453 	} else
1454 		qid = ATHN_QID_AC_BE;
1455 	txq = &sc->txq[qid];
1456 
1457 	/* Select the transmit rates to use for this frame. */
1458 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1459 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
1460 	    IEEE80211_FC0_TYPE_DATA) {
1461 		/* Use lowest rate for all tries. */
1462 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1463 		    (ic->ic_curmode == IEEE80211_MODE_11A) ?
1464 			ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1465 	} else if (ic->ic_fixed_rate != -1) {
1466 		/* Use same fixed rate for all tries. */
1467 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1468 		    sc->fixed_ridx;
1469 	} else {
1470 		int txrate = ni->ni_txrate;
1471 		/* Use fallback table of the node. */
1472 		for (i = 0; i < 4; i++) {
1473 			ridx[i] = an->ridx[txrate];
1474 			txrate = an->fallback[txrate];
1475 		}
1476 	}
1477 
1478 #if NBPFILTER > 0
1479 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1480 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
1481 		struct mbuf mb;
1482 
1483 		tap->wt_flags = 0;
1484 		/* Use initial transmit rate. */
1485 		tap->wt_rate = athn_rates[ridx[0]].rate;
1486 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1487 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1488 		tap->wt_hwqueue = qid;
1489 		if (ridx[0] != ATHN_RIDX_CCK1 &&
1490 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1491 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1492 		mb.m_data = (caddr_t)tap;
1493 		mb.m_len = sc->sc_txtap_len;
1494 		mb.m_next = m;
1495 		mb.m_nextpkt = NULL;
1496 		mb.m_type = 0;
1497 		mb.m_flags = 0;
1498 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1499 	}
1500 #endif
1501 
1502 	/* DMA map mbuf. */
1503 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1504 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1505 	if (__predict_false(error != 0)) {
1506 		if (error != EFBIG) {
1507 			printf("%s: can't map mbuf (error %d)\n",
1508 			    sc->sc_dev.dv_xname, error);
1509 			m_freem(m);
1510 			return (error);
1511 		}
1512 		/*
1513 		 * DMA mapping requires too many DMA segments; linearize
1514 		 * mbuf in kernel virtual address space and retry.
1515 		 */
1516 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1517 		if (m1 == NULL) {
1518 			m_freem(m);
1519 			return (ENOBUFS);
1520 		}
1521 		if (m->m_pkthdr.len > MHLEN) {
1522 			MCLGET(m1, M_DONTWAIT);
1523 			if (!(m1->m_flags & M_EXT)) {
1524 				m_freem(m);
1525 				m_freem(m1);
1526 				return (ENOBUFS);
1527 			}
1528 		}
1529 		m_copydata(m, 0, m->m_pkthdr.len, mtod(m1, caddr_t));
1530 		m1->m_pkthdr.len = m1->m_len = m->m_pkthdr.len;
1531 		m_freem(m);
1532 		m = m1;
1533 
1534 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1535 		    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1536 		if (error != 0) {
1537 			printf("%s: can't map mbuf (error %d)\n",
1538 			    sc->sc_dev.dv_xname, error);
1539 			m_freem(m);
1540 			return (error);
1541 		}
1542 	}
1543 	bf->bf_m = m;
1544 	bf->bf_ni = ni;
1545 	bf->bf_txflags = txflags;
1546 
1547 	wh = mtod(m, struct ieee80211_frame *);
1548 
1549 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1550 
1551 	/* Setup Tx descriptor. */
1552 	ds = bf->bf_descs;
1553 	memset(ds, 0, sizeof(*ds));
1554 
1555 	ds->ds_info =
1556 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1557 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1558 	    SM(AR_TXI_QCU_NUM, qid) |
1559 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1560 
1561 	ds->ds_ctl11 = AR_TXC11_CLR_DEST_MASK;
1562 	txpower = AR_MAX_RATE_POWER;	/* Get from per-rate registers. */
1563 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, txpower);
1564 
1565 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, type);
1566 
1567 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1568 	    (hasqos && (qos & IEEE80211_QOS_ACK_POLICY_MASK) ==
1569 	     IEEE80211_QOS_ACK_POLICY_NOACK))
1570 		ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1571 
1572 	if (0 && k != NULL) {
1573 		/*
1574 		 * Map 802.11 cipher to hardware encryption type and
1575 		 * compute MIC+ICV overhead.
1576 		 */
1577 		switch (k->k_cipher) {
1578 		case IEEE80211_CIPHER_WEP40:
1579 		case IEEE80211_CIPHER_WEP104:
1580 			encrtype = AR_ENCR_TYPE_WEP;
1581 			totlen += 4;
1582 			break;
1583 		case IEEE80211_CIPHER_TKIP:
1584 			encrtype = AR_ENCR_TYPE_TKIP;
1585 			totlen += 12;
1586 			break;
1587 		case IEEE80211_CIPHER_CCMP:
1588 			encrtype = AR_ENCR_TYPE_AES;
1589 			totlen += 8;
1590 			break;
1591 		default:
1592 			panic("unsupported cipher");
1593 		}
1594 		/*
1595 		 * NB: The key cache entry index is stored in the key
1596 		 * private field when the key is installed.
1597 		 */
1598 		entry = (uintptr_t)k->k_priv;
1599 		ds->ds_ctl12 |= SM(AR_TXC12_DEST_IDX, entry);
1600 		ds->ds_ctl11 |= AR_TXC11_DEST_IDX_VALID;
1601 	} else
1602 		encrtype = AR_ENCR_TYPE_CLEAR;
1603 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, encrtype);
1604 
1605 	/* Check if frame must be protected using RTS/CTS or CTS-to-self. */
1606 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1607 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1608 	    IEEE80211_FC0_TYPE_DATA) {
1609 		/* NB: Group frames are sent using CCK in 802.11b/g. */
1610 		if (totlen > ic->ic_rtsthreshold) {
1611 			ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1612 		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1613 		    athn_rates[ridx[0]].phy == IEEE80211_T_OFDM) {
1614 			if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1615 				ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1616 			else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1617 				ds->ds_ctl11 |= AR_TXC11_CTS_ENABLE;
1618 		}
1619 	}
1620 	/*
1621 	 * Disable multi-rate retries when protection is used.
1622 	 * The RTS/CTS frame's duration field is fixed and won't be
1623 	 * updated by hardware when the data rate changes.
1624 	 */
1625 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1626 		ridx[1] = ridx[2] = ridx[3] = ridx[0];
1627 	}
1628 	/* Setup multi-rate retries. */
1629 	for (i = 0; i < 4; i++) {
1630 		series[i].hwrate = athn_rates[ridx[i]].hwrate;
1631 		if (athn_rates[ridx[i]].phy == IEEE80211_T_DS &&
1632 		    ridx[i] != ATHN_RIDX_CCK1 &&
1633 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1634 			series[i].hwrate |= 0x04;
1635 		series[i].dur = 0;
1636 	}
1637 	if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1638 		/* Compute duration for each series. */
1639 		for (i = 0; i < 4; i++) {
1640 			series[i].dur = athn_txtime(sc, IEEE80211_ACK_LEN,
1641 			    athn_rates[ridx[i]].rspridx, ic->ic_flags);
1642 		}
1643 	}
1644 	/* If this is a PA training frame, select the Tx chain to use. */
1645 	if (__predict_false(txflags & ATHN_TXFLAG_PAPRD)) {
1646 		ds->ds_ctl12 |= SM(AR_TXC12_PAPRD_CHAIN_MASK,
1647 		    1 << sc->paprd_curchain);
1648 	}
1649 
1650 	/* Write number of tries for each series. */
1651 	ds->ds_ctl13 =
1652 	    SM(AR_TXC13_XMIT_DATA_TRIES0, 2) |
1653 	    SM(AR_TXC13_XMIT_DATA_TRIES1, 2) |
1654 	    SM(AR_TXC13_XMIT_DATA_TRIES2, 2) |
1655 	    SM(AR_TXC13_XMIT_DATA_TRIES3, 4);
1656 
1657 	/* Tell HW to update duration field in 802.11 header. */
1658 	if (type != AR_FRAME_TYPE_PSPOLL)
1659 		ds->ds_ctl13 |= AR_TXC13_DUR_UPDATE_ENA;
1660 
1661 	/* Write Tx rate for each series. */
1662 	ds->ds_ctl14 =
1663 	    SM(AR_TXC14_XMIT_RATE0, series[0].hwrate) |
1664 	    SM(AR_TXC14_XMIT_RATE1, series[1].hwrate) |
1665 	    SM(AR_TXC14_XMIT_RATE2, series[2].hwrate) |
1666 	    SM(AR_TXC14_XMIT_RATE3, series[3].hwrate);
1667 
1668 	/* Write duration for each series. */
1669 	ds->ds_ctl15 =
1670 	    SM(AR_TXC15_PACKET_DUR0, series[0].dur) |
1671 	    SM(AR_TXC15_PACKET_DUR1, series[1].dur);
1672 	ds->ds_ctl16 =
1673 	    SM(AR_TXC16_PACKET_DUR2, series[2].dur) |
1674 	    SM(AR_TXC16_PACKET_DUR3, series[3].dur);
1675 
1676 	if ((sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) &&
1677 	    ic->ic_curmode == IEEE80211_MODE_11A) {
1678 		/*
1679 		 * In order to not exceed PCIe power requirements, we only
1680 		 * use two Tx chains for MCS0~15 on 5GHz band on these chips.
1681 		 */
1682 		ds->ds_ctl18 =
1683 		    SM(AR_TXC18_CHAIN_SEL0,
1684 			(ridx[0] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1685 		    SM(AR_TXC18_CHAIN_SEL1,
1686 			(ridx[1] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1687 		    SM(AR_TXC18_CHAIN_SEL2,
1688 			(ridx[2] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1689 		    SM(AR_TXC18_CHAIN_SEL3,
1690 			(ridx[3] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask);
1691 	} else {
1692 		/* Use the same Tx chains for all tries. */
1693 		ds->ds_ctl18 =
1694 		    SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask) |
1695 		    SM(AR_TXC18_CHAIN_SEL1, sc->txchainmask) |
1696 		    SM(AR_TXC18_CHAIN_SEL2, sc->txchainmask) |
1697 		    SM(AR_TXC18_CHAIN_SEL3, sc->txchainmask);
1698 	}
1699 #ifdef notyet
1700 	/* Use the same short GI setting for all tries. */
1701 	if (ic->ic_flags & IEEE80211_F_SHGI)
1702 		ds->ds_ctl18 |= AR_TXC18_GI0123;
1703 	/* Use the same channel width for all tries. */
1704 	if (ic->ic_flags & IEEE80211_F_CBW40)
1705 		ds->ds_ctl18 |= AR_TXC18_2040_0123;
1706 #endif
1707 
1708 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1709 		uint8_t protridx, hwrate;
1710 		uint16_t dur = 0;
1711 
1712 		/* Use the same protection mode for all tries. */
1713 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1714 			ds->ds_ctl15 |= AR_TXC15_RTSCTS_QUAL01;
1715 			ds->ds_ctl16 |= AR_TXC16_RTSCTS_QUAL23;
1716 		}
1717 		/* Select protection rate (suboptimal but ok). */
1718 		protridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1719 		    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK2;
1720 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1721 			/* Account for CTS duration. */
1722 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1723 			    athn_rates[protridx].rspridx, ic->ic_flags);
1724 		}
1725 		dur += athn_txtime(sc, totlen, ridx[0], ic->ic_flags);
1726 		if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1727 			/* Account for ACK duration. */
1728 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1729 			    athn_rates[ridx[0]].rspridx, ic->ic_flags);
1730 		}
1731 		/* Write protection frame duration and rate. */
1732 		ds->ds_ctl13 |= SM(AR_TXC13_BURST_DUR, dur);
1733 		hwrate = athn_rates[protridx].hwrate;
1734 		if (protridx == ATHN_RIDX_CCK2 &&
1735 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1736 			hwrate |= 0x04;
1737 		ds->ds_ctl18 |= SM(AR_TXC18_RTSCTS_RATE, hwrate);
1738 	}
1739 
1740 	ds->ds_ctl11 |= SM(AR_TXC11_FRAME_LEN, totlen);
1741 	ds->ds_ctl19 = AR_TXC19_NOT_SOUNDING;
1742 
1743 	for (i = 0; i < bf->bf_map->dm_nsegs; i++) {
1744 		ds->ds_segs[i].ds_data = bf->bf_map->dm_segs[i].ds_addr;
1745 		ds->ds_segs[i].ds_ctl = SM(AR_TXC_BUF_LEN,
1746 		    bf->bf_map->dm_segs[i].ds_len);
1747 	}
1748 	/* Compute Tx descriptor checksum. */
1749 	sum = ds->ds_info + ds->ds_link;
1750 	for (i = 0; i < 4; i++) {
1751 		sum += ds->ds_segs[i].ds_data;
1752 		sum += ds->ds_segs[i].ds_ctl;
1753 	}
1754 	sum = (sum >> 16) + (sum & 0xffff);
1755 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1756 
1757 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1758 	    BUS_DMASYNC_PREWRITE);
1759 
1760 	DPRINTFN(6, ("Tx qid=%d nsegs=%d ctl11=0x%x ctl12=0x%x ctl14=0x%x\n",
1761 	    qid, bf->bf_map->dm_nsegs, ds->ds_ctl11, ds->ds_ctl12,
1762 	    ds->ds_ctl14));
1763 
1764 	SIMPLEQ_REMOVE_HEAD(&sc->txbufs, bf_list);
1765 	SIMPLEQ_INSERT_TAIL(&txq->head, bf, bf_list);
1766 
1767 	/* Queue buffer unless hardware FIFO is already full. */
1768 	if (++txq->queued <= AR9003_TX_QDEPTH) {
1769 		AR_WRITE(sc, AR_QTXDP(qid), bf->bf_daddr);
1770 		AR_WRITE_BARRIER(sc);
1771 	} else if (txq->wait == NULL)
1772 		txq->wait = bf;
1773 	return (0);
1774 }
1775 
1776 void
1777 ar9003_set_rf_mode(struct athn_softc *sc, struct ieee80211_channel *c)
1778 {
1779 	uint32_t reg;
1780 
1781 	reg = IEEE80211_IS_CHAN_2GHZ(c) ?
1782 	    AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
1783 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
1784 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
1785 		reg |= AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE;
1786 	}
1787 	AR_WRITE(sc, AR_PHY_MODE, reg);
1788 	AR_WRITE_BARRIER(sc);
1789 }
1790 
1791 static __inline uint32_t
1792 ar9003_synth_delay(struct athn_softc *sc)
1793 {
1794 	uint32_t delay;
1795 
1796 	delay = MS(AR_READ(sc, AR_PHY_RX_DELAY), AR_PHY_RX_DELAY_DELAY);
1797 	if (sc->sc_ic.ic_curmode == IEEE80211_MODE_11B)
1798 		delay = (delay * 4) / 22;
1799 	else
1800 		delay = delay / 10;	/* in 100ns steps */
1801 	return (delay);
1802 }
1803 
1804 int
1805 ar9003_rf_bus_request(struct athn_softc *sc)
1806 {
1807 	int ntries;
1808 
1809 	/* Request RF Bus grant. */
1810 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
1811 	for (ntries = 0; ntries < 10000; ntries++) {
1812 		if (AR_READ(sc, AR_PHY_RFBUS_GRANT) & AR_PHY_RFBUS_GRANT_EN)
1813 			return (0);
1814 		DELAY(10);
1815 	}
1816 	DPRINTF(("could not kill baseband Rx"));
1817 	return (ETIMEDOUT);
1818 }
1819 
1820 void
1821 ar9003_rf_bus_release(struct athn_softc *sc)
1822 {
1823 	/* Wait for the synthesizer to settle. */
1824 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + ar9003_synth_delay(sc));
1825 
1826 	/* Release the RF Bus grant. */
1827 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, 0);
1828 	AR_WRITE_BARRIER(sc);
1829 }
1830 
1831 void
1832 ar9003_set_phy(struct athn_softc *sc, struct ieee80211_channel *c,
1833     struct ieee80211_channel *extc)
1834 {
1835 	uint32_t phy;
1836 
1837 	phy = AR_READ(sc, AR_PHY_GEN_CTRL);
1838 	phy |= AR_PHY_GC_HT_EN | AR_PHY_GC_SHORT_GI_40 |
1839 	    AR_PHY_GC_SINGLE_HT_LTF1 | AR_PHY_GC_WALSH;
1840 	if (extc != NULL) {
1841 		phy |= AR_PHY_GC_DYN2040_EN;
1842 		if (extc > c)	/* XXX */
1843 			phy |= AR_PHY_GC_DYN2040_PRI_CH;
1844 	}
1845 	/* Turn off Green Field detection for now. */
1846 	phy &= ~AR_PHY_GC_GF_DETECT_EN;
1847 	AR_WRITE(sc, AR_PHY_GEN_CTRL, phy);
1848 
1849 	AR_WRITE(sc, AR_2040_MODE,
1850 	    (extc != NULL) ? AR_2040_JOINED_RX_CLEAR : 0);
1851 
1852 	/* Set global transmit timeout. */
1853 	AR_WRITE(sc, AR_GTXTO, SM(AR_GTXTO_TIMEOUT_LIMIT, 25));
1854 	/* Set carrier sense timeout. */
1855 	AR_WRITE(sc, AR_CST, SM(AR_CST_TIMEOUT_LIMIT, 15));
1856 	AR_WRITE_BARRIER(sc);
1857 }
1858 
1859 void
1860 ar9003_set_delta_slope(struct athn_softc *sc, struct ieee80211_channel *c,
1861     struct ieee80211_channel *extc)
1862 {
1863 	uint32_t coeff, exp, man, reg;
1864 
1865 	/* Set Delta Slope (exponent and mantissa). */
1866 	coeff = (100 << 24) / c->ic_freq;
1867 	athn_get_delta_slope(coeff, &exp, &man);
1868 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1869 
1870 	reg = AR_READ(sc, AR_PHY_TIMING3);
1871 	reg = RW(reg, AR_PHY_TIMING3_DSC_EXP, exp);
1872 	reg = RW(reg, AR_PHY_TIMING3_DSC_MAN, man);
1873 	AR_WRITE(sc, AR_PHY_TIMING3, reg);
1874 
1875 	/* For Short GI, coeff is 9/10 that of normal coeff. */
1876 	coeff = (9 * coeff) / 10;
1877 	athn_get_delta_slope(coeff, &exp, &man);
1878 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1879 
1880 	reg = AR_READ(sc, AR_PHY_SGI_DELTA);
1881 	reg = RW(reg, AR_PHY_SGI_DSC_EXP, exp);
1882 	reg = RW(reg, AR_PHY_SGI_DSC_MAN, man);
1883 	AR_WRITE(sc, AR_PHY_SGI_DELTA, reg);
1884 	AR_WRITE_BARRIER(sc);
1885 }
1886 
1887 void
1888 ar9003_enable_antenna_diversity(struct athn_softc *sc)
1889 {
1890 	AR_SETBITS(sc, AR_PHY_CCK_DETECT,
1891 	    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
1892 	AR_WRITE_BARRIER(sc);
1893 }
1894 
1895 void
1896 ar9003_init_baseband(struct athn_softc *sc)
1897 {
1898 	uint32_t synth_delay;
1899 
1900 	synth_delay = ar9003_synth_delay(sc);
1901 	/* Activate the PHY (includes baseband activate and synthesizer on). */
1902 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
1903 	AR_WRITE_BARRIER(sc);
1904 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + synth_delay);
1905 }
1906 
1907 void
1908 ar9003_disable_phy(struct athn_softc *sc)
1909 {
1910 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
1911 	AR_WRITE_BARRIER(sc);
1912 }
1913 
1914 void
1915 ar9003_init_chains(struct athn_softc *sc)
1916 {
1917 	if (sc->rxchainmask == 0x5 || sc->txchainmask == 0x5)
1918 		AR_SETBITS(sc, AR_PHY_ANALOG_SWAP, AR_PHY_SWAP_ALT_CHAIN);
1919 
1920 	/* Setup chain masks. */
1921 	AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1922 	AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1923 
1924 	if (sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) {
1925 		/*
1926 		 * All self-generated frames are sent using two Tx chains
1927 		 * on these chips to not exceed PCIe power requirements.
1928 		 */
1929 		AR_WRITE(sc, AR_SELFGEN_MASK, 0x3);
1930 	} else
1931 		AR_WRITE(sc, AR_SELFGEN_MASK, sc->txchainmask);
1932 	AR_WRITE_BARRIER(sc);
1933 }
1934 
1935 void
1936 ar9003_set_rxchains(struct athn_softc *sc)
1937 {
1938 	if (sc->rxchainmask == 0x3 || sc->rxchainmask == 0x5) {
1939 		AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1940 		AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1941 		AR_WRITE_BARRIER(sc);
1942 	}
1943 }
1944 
1945 void
1946 ar9003_read_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1947 {
1948 /* Sign-extends 9-bit value (assumes upper bits are zeroes). */
1949 #define SIGN_EXT(v)	(((v) ^ 0x100) - 0x100)
1950 	uint32_t reg;
1951 	int i;
1952 
1953 	for (i = 0; i < sc->nrxchains; i++) {
1954 		reg = AR_READ(sc, AR_PHY_CCA(i));
1955 		nf[i] = MS(reg, AR_PHY_MINCCA_PWR);
1956 		nf[i] = SIGN_EXT(nf[i]);
1957 
1958 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1959 		nf_ext[i] = MS(reg, AR_PHY_EXT_MINCCA_PWR);
1960 		nf_ext[i] = SIGN_EXT(nf_ext[i]);
1961 	}
1962 #undef SIGN_EXT
1963 }
1964 
1965 void
1966 ar9003_write_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1967 {
1968 	uint32_t reg;
1969 	int i;
1970 
1971 	for (i = 0; i < sc->nrxchains; i++) {
1972 		reg = AR_READ(sc, AR_PHY_CCA(i));
1973 		reg = RW(reg, AR_PHY_MAXCCA_PWR, nf[i]);
1974 		AR_WRITE(sc, AR_PHY_CCA(i), reg);
1975 
1976 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1977 		reg = RW(reg, AR_PHY_EXT_MAXCCA_PWR, nf_ext[i]);
1978 		AR_WRITE(sc, AR_PHY_EXT_CCA(i), reg);
1979 	}
1980 	AR_WRITE_BARRIER(sc);
1981 }
1982 
1983 int
1984 ar9003_get_noisefloor(struct athn_softc *sc)
1985 {
1986 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
1987 	int i;
1988 
1989 	if (AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
1990 		/* Noisefloor calibration not finished. */
1991 		return 0;
1992 	}
1993 	/* Noisefloor calibration is finished. */
1994 	ar9003_read_noisefloor(sc, nf, nf_ext);
1995 
1996 	/* Update noisefloor history. */
1997 	for (i = 0; i < sc->nrxchains; i++) {
1998 		sc->nf_hist[sc->nf_hist_cur].nf[i] = nf[i];
1999 		sc->nf_hist[sc->nf_hist_cur].nf_ext[i] = nf_ext[i];
2000 	}
2001 	if (++sc->nf_hist_cur >= ATHN_NF_CAL_HIST_MAX)
2002 		sc->nf_hist_cur = 0;
2003 	return 1;
2004 }
2005 
2006 void
2007 ar9003_bb_load_noisefloor(struct athn_softc *sc)
2008 {
2009 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
2010 	int i, ntries;
2011 
2012 	/* Write filtered noisefloor values. */
2013 	for (i = 0; i < sc->nrxchains; i++) {
2014 		nf[i] = sc->nf_priv[i] * 2;
2015 		nf_ext[i] = sc->nf_ext_priv[i] * 2;
2016 	}
2017 	ar9003_write_noisefloor(sc, nf, nf_ext);
2018 
2019 	/* Load filtered noisefloor values into baseband. */
2020 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2021 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2022 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2023 	/* Wait for load to complete. */
2024 	for (ntries = 0; ntries < 1000; ntries++) {
2025 		if (!(AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
2026 			break;
2027 		DELAY(10);
2028 	}
2029 	if (ntries == 1000) {
2030 		DPRINTF(("failed to load noisefloor values\n"));
2031 		return;
2032 	}
2033 
2034 	/* Restore noisefloor values to initial (max) values. */
2035 	for (i = 0; i < AR_MAX_CHAINS; i++)
2036 		nf[i] = nf_ext[i] = -50 * 2;
2037 	ar9003_write_noisefloor(sc, nf, nf_ext);
2038 }
2039 
2040 void
2041 ar9003_apply_noisefloor(struct athn_softc *sc)
2042 {
2043 	uint32_t agc_nfcal;
2044 
2045 	agc_nfcal = AR_READ(sc, AR_PHY_AGC_CONTROL) &
2046 	    (AR_PHY_AGC_CONTROL_NF | AR_PHY_AGC_CONTROL_ENABLE_NF |
2047 	    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2048 
2049 	if (agc_nfcal & AR_PHY_AGC_CONTROL_NF) {
2050 		/* Pause running NF calibration while values are updated. */
2051 		AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2052 		AR_WRITE_BARRIER(sc);
2053 	}
2054 
2055 	ar9003_bb_load_noisefloor(sc);
2056 
2057 	if (agc_nfcal & AR_PHY_AGC_CONTROL_NF) {
2058 		/* Restart interrupted NF calibration. */
2059 		AR_SETBITS(sc, AR_PHY_AGC_CONTROL, agc_nfcal);
2060 		AR_WRITE_BARRIER(sc);
2061 	}
2062 }
2063 
2064 void
2065 ar9003_do_noisefloor_calib(struct athn_softc *sc)
2066 {
2067 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2068 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2069 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2070 	AR_WRITE_BARRIER(sc);
2071 }
2072 
2073 void
2074 ar9003_init_noisefloor_calib(struct athn_softc *sc)
2075 {
2076 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2077 	AR_WRITE_BARRIER(sc);
2078 }
2079 
2080 int
2081 ar9003_init_calib(struct athn_softc *sc)
2082 {
2083 	uint8_t txchainmask, rxchainmask;
2084 	uint32_t reg;
2085 	int ntries;
2086 
2087 	/* Save chains masks. */
2088 	txchainmask = sc->txchainmask;
2089 	rxchainmask = sc->rxchainmask;
2090 	/* Configure hardware before calibration. */
2091 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_CHAIN2_DISABLE)
2092 		txchainmask = rxchainmask = 0x3;
2093 	else
2094 		txchainmask = rxchainmask = 0x7;
2095 	ar9003_init_chains(sc);
2096 
2097 	/* Perform Tx IQ calibration. */
2098 	ar9003_calib_tx_iq(sc);
2099 	/* Disable and re-enable the PHY chips. */
2100 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
2101 	AR_WRITE_BARRIER(sc);
2102 	DELAY(5);
2103 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
2104 
2105 	/* Calibrate the AGC. */
2106 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
2107 	/* Poll for offset calibration completion. */
2108 	for (ntries = 0; ntries < 10000; ntries++) {
2109 		reg = AR_READ(sc, AR_PHY_AGC_CONTROL);
2110 		if (!(reg & AR_PHY_AGC_CONTROL_CAL))
2111 			break;
2112 		DELAY(10);
2113 	}
2114 	if (ntries == 10000)
2115 		return (ETIMEDOUT);
2116 
2117 	/* Restore chains masks. */
2118 	sc->txchainmask = txchainmask;
2119 	sc->rxchainmask = rxchainmask;
2120 	ar9003_init_chains(sc);
2121 
2122 	return (0);
2123 }
2124 
2125 void
2126 ar9003_do_calib(struct athn_softc *sc)
2127 {
2128 	uint32_t reg;
2129 
2130 	if (sc->cur_calib_mask & ATHN_CAL_IQ) {
2131 		reg = AR_READ(sc, AR_PHY_TIMING4);
2132 		reg = RW(reg, AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX, 10);
2133 		AR_WRITE(sc, AR_PHY_TIMING4, reg);
2134 		AR_WRITE(sc, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
2135 		AR_SETBITS(sc, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
2136 		AR_WRITE_BARRIER(sc);
2137 	} else if (sc->cur_calib_mask & ATHN_CAL_TEMP) {
2138 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2139 		    AR_PHY_65NM_CH0_THERM_LOCAL);
2140 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2141 		    AR_PHY_65NM_CH0_THERM_START);
2142 		AR_WRITE_BARRIER(sc);
2143 	}
2144 }
2145 
2146 void
2147 ar9003_next_calib(struct athn_softc *sc)
2148 {
2149 	/* Check if we have any calibration in progress. */
2150 	if (sc->cur_calib_mask != 0) {
2151 		if (!(AR_READ(sc, AR_PHY_TIMING4) & AR_PHY_TIMING4_DO_CAL)) {
2152 			/* Calibration completed for current sample. */
2153 			ar9003_calib_iq(sc);
2154 		}
2155 	}
2156 }
2157 
2158 void
2159 ar9003_calib_iq(struct athn_softc *sc)
2160 {
2161 	struct athn_iq_cal *cal;
2162 	uint32_t reg, i_coff_denom, q_coff_denom;
2163 	int32_t i_coff, q_coff;
2164 	int i, iq_corr_neg;
2165 
2166 	for (i = 0; i < AR_MAX_CHAINS; i++) {
2167 		cal = &sc->calib.iq[i];
2168 
2169 		/* Read IQ calibration measures (clear on read). */
2170 		cal->pwr_meas_i = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_0_B(i));
2171 		cal->pwr_meas_q = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_1_B(i));
2172 		cal->iq_corr_meas =
2173 		    (int32_t)AR_READ(sc, AR_PHY_IQ_ADC_MEAS_2_B(i));
2174 	}
2175 
2176 	for (i = 0; i < sc->nrxchains; i++) {
2177 		cal = &sc->calib.iq[i];
2178 
2179 		if (cal->pwr_meas_q == 0)
2180 			continue;
2181 
2182 		if ((iq_corr_neg = cal->iq_corr_meas < 0))
2183 			cal->iq_corr_meas = -cal->iq_corr_meas;
2184 
2185 		i_coff_denom =
2186 		    (cal->pwr_meas_i / 2 + cal->pwr_meas_q / 2) / 256;
2187 		q_coff_denom = cal->pwr_meas_q / 64;
2188 
2189 		if (i_coff_denom == 0 || q_coff_denom == 0)
2190 			continue;	/* Prevents division by zero. */
2191 
2192 		i_coff = cal->iq_corr_meas / i_coff_denom;
2193 		q_coff = (cal->pwr_meas_i / q_coff_denom) - 64;
2194 
2195 		if (i_coff > 63)
2196 			i_coff = 63;
2197 		else if (i_coff < -63)
2198 			i_coff = -63;
2199 		/* Negate i_coff if iq_corr_meas is positive. */
2200 		if (!iq_corr_neg)
2201 			i_coff = -i_coff;
2202 		if (q_coff > 63)
2203 			q_coff = 63;
2204 		else if (q_coff < -63)
2205 			q_coff = -63;
2206 
2207 		DPRINTFN(2, ("IQ calibration for chain %d\n", i));
2208 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2209 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF, i_coff);
2210 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF, q_coff);
2211 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2212 	}
2213 
2214 	/* Apply new settings. */
2215 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2216 	    AR_PHY_RX_IQCAL_CORR_IQCORR_ENABLE);
2217 	AR_WRITE_BARRIER(sc);
2218 
2219 	/* IQ calibration done. */
2220 	sc->cur_calib_mask &= ~ATHN_CAL_IQ;
2221 	memset(&sc->calib, 0, sizeof(sc->calib));
2222 }
2223 
2224 #define DELPT	32
2225 int
2226 ar9003_get_iq_corr(struct athn_softc *sc, int32_t res[6], int32_t coeff[2])
2227 {
2228 /* Sign-extends 12-bit value (assumes upper bits are zeroes). */
2229 #define SIGN_EXT(v)	(((v) ^ 0x800) - 0x800)
2230 #define SCALE		(1 << 15)
2231 #define SHIFT		(1 <<  8)
2232 	struct {
2233 		int32_t	m, p, c;
2234 	} val[2][2];
2235 	int32_t mag[2][2], phs[2][2], cos[2], sin[2];
2236 	int32_t min, max, div, f1, f2, f3, m, p, c;
2237 	int32_t txmag, txphs, rxmag, rxphs;
2238 	int32_t q_coff, i_coff;
2239 	int i, j;
2240 
2241 	/* Extract our twelve signed 12-bit values from res[] array. */
2242 	val[0][0].m = res[0] & 0xfff;
2243 	val[0][0].p = (res[0] >> 12) & 0xfff;
2244 	val[0][0].c = ((res[0] >> 24) & 0xff) | (res[1] & 0xf) << 8;
2245 
2246 	val[0][1].m = (res[1] >> 4) & 0xfff;
2247 	val[0][1].p = res[2] & 0xfff;
2248 	val[0][1].c = (res[2] >> 12) & 0xfff;
2249 
2250 	val[1][0].m = ((res[2] >> 24) & 0xff) | (res[3] & 0xf) << 8;
2251 	val[1][0].p = (res[3] >> 4) & 0xfff;
2252 	val[1][0].c = res[4] & 0xfff;
2253 
2254 	val[1][1].m = (res[4] >> 12) & 0xfff;
2255 	val[1][1].p = ((res[4] >> 24) & 0xff) | (res[5] & 0xf) << 8;
2256 	val[1][1].c = (res[5] >> 4) & 0xfff;
2257 
2258 	for (i = 0; i < 2; i++) {
2259 		for (j = 0; j < 2; j++) {
2260 			m = SIGN_EXT(val[i][j].m);
2261 			p = SIGN_EXT(val[i][j].p);
2262 			c = SIGN_EXT(val[i][j].c);
2263 
2264 			if (p == 0)
2265 				return (1);	/* Prevent division by 0. */
2266 
2267 			mag[i][j] = (m * SCALE) / p;
2268 			phs[i][j] = (c * SCALE) / p;
2269 		}
2270 		sin[i] = ((mag[i][0] - mag[i][1]) * SHIFT) / DELPT;
2271 		cos[i] = ((phs[i][0] - phs[i][1]) * SHIFT) / DELPT;
2272 		/* Find magnitude by approximation. */
2273 		min = MIN(abs(sin[i]), abs(cos[i]));
2274 		max = MAX(abs(sin[i]), abs(cos[i]));
2275 		div = max - (max / 32) + (min / 8) + (min / 4);
2276 		if (div == 0)
2277 			return (1);	/* Prevent division by 0. */
2278 		/* Normalize sin and cos by magnitude. */
2279 		sin[i] = (sin[i] * SCALE) / div;
2280 		cos[i] = (cos[i] * SCALE) / div;
2281 	}
2282 
2283 	/* Compute IQ mismatch (solve 4x4 linear equation). */
2284 	f1 = cos[0] - cos[1];
2285 	f3 = sin[0] - sin[1];
2286 	f2 = (f1 * f1 + f3 * f3) / SCALE;
2287 	if (f2 == 0)
2288 		return (1);	/* Prevent division by 0. */
2289 
2290 	/* Compute Tx magnitude mismatch. */
2291 	txmag = (f1 * ( mag[0][0] - mag[1][0]) +
2292 		 f3 * ( phs[0][0] - phs[1][0])) / f2;
2293 	/* Compute Tx phase mismatch. */
2294 	txphs = (f3 * (-mag[0][0] + mag[1][0]) +
2295 		 f1 * ( phs[0][0] - phs[1][0])) / f2;
2296 
2297 	if (txmag == SCALE)
2298 		return (1);	/* Prevent division by 0. */
2299 
2300 	/* Compute Rx magnitude mismatch. */
2301 	rxmag = mag[0][0] - (cos[0] * txmag + sin[0] * txphs) / SCALE;
2302 	/* Compute Rx phase mismatch. */
2303 	rxphs = phs[0][0] + (sin[0] * txmag - cos[0] * txphs) / SCALE;
2304 
2305 	if (-rxmag == SCALE)
2306 		return (1);	/* Prevent division by 0. */
2307 
2308 	txmag = (txmag * SCALE) / (SCALE - txmag);
2309 	txphs = -txphs;
2310 
2311 	q_coff = (txmag * 128) / SCALE;
2312 	if (q_coff < -63)
2313 		q_coff = -63;
2314 	else if (q_coff > 63)
2315 		q_coff = 63;
2316 	i_coff = (txphs * 256) / SCALE;
2317 	if (i_coff < -63)
2318 		i_coff = -63;
2319 	else if (i_coff > 63)
2320 		i_coff = 63;
2321 	coeff[0] = q_coff * 128 + i_coff;
2322 
2323 	rxmag = (-rxmag * SCALE) / (SCALE + rxmag);
2324 	rxphs = -rxphs;
2325 
2326 	q_coff = (rxmag * 128) / SCALE;
2327 	if (q_coff < -63)
2328 		q_coff = -63;
2329 	else if (q_coff > 63)
2330 		q_coff = 63;
2331 	i_coff = (rxphs * 256) / SCALE;
2332 	if (i_coff < -63)
2333 		i_coff = -63;
2334 	else if (i_coff > 63)
2335 		i_coff = 63;
2336 	coeff[1] = q_coff * 128 + i_coff;
2337 
2338 	return (0);
2339 #undef SHIFT
2340 #undef SCALE
2341 #undef SIGN_EXT
2342 }
2343 
2344 int
2345 ar9003_calib_tx_iq(struct athn_softc *sc)
2346 {
2347 	uint32_t reg;
2348 	int32_t res[6], coeff[2];
2349 	int i, j, ntries;
2350 
2351 	reg = AR_READ(sc, AR_PHY_TX_IQCAL_CONTROL_1);
2352 	reg = RW(reg, AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT, DELPT);
2353 	AR_WRITE(sc, AR_PHY_TX_IQCAL_CONTROL_1, reg);
2354 
2355 	/* Start Tx IQ calibration. */
2356 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_START, AR_PHY_TX_IQCAL_START_DO_CAL);
2357 	/* Wait for completion. */
2358 	for (ntries = 0; ntries < 10000; ntries++) {
2359 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_START);
2360 		if (!(reg & AR_PHY_TX_IQCAL_START_DO_CAL))
2361 			break;
2362 		DELAY(10);
2363 	}
2364 	if (ntries == 10000)
2365 		return (ETIMEDOUT);
2366 
2367 	for (i = 0; i < sc->ntxchains; i++) {
2368 		/* Read Tx IQ calibration status for this chain. */
2369 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_STATUS_B(i));
2370 		if (reg & AR_PHY_TX_IQCAL_STATUS_FAILED)
2371 			return (EIO);
2372 		/*
2373 		 * Read Tx IQ calibration results for this chain.
2374 		 * This consists in twelve signed 12-bit values.
2375 		 */
2376 		for (j = 0; j < 3; j++) {
2377 			AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2378 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2379 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2380 			res[j * 2 + 0] = reg;
2381 
2382 			AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2383 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2384 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2385 			res[j * 2 + 1] = reg & 0xffff;
2386 		}
2387 
2388 		/* Compute Tx IQ correction. */
2389 		if (ar9003_get_iq_corr(sc, res, coeff) != 0)
2390 			return (EIO);
2391 
2392 		/* Write Tx IQ correction coefficients. */
2393 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i));
2394 		reg = RW(reg, AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE,
2395 		    coeff[0]);
2396 		AR_WRITE(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i), reg);
2397 
2398 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2399 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_Q_COFF,
2400 		    coeff[1] >> 7);
2401 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_I_COFF,
2402 		    coeff[1]);
2403 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2404 		AR_WRITE_BARRIER(sc);
2405 	}
2406 
2407 	/* Enable Tx IQ correction. */
2408 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_CONTROL_3,
2409 	    AR_PHY_TX_IQCAL_CONTROL_3_IQCORR_EN);
2410 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2411 	    AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN);
2412 	AR_WRITE_BARRIER(sc);
2413 	return (0);
2414 }
2415 #undef DELPT
2416 
2417 /*-
2418  * The power amplifier predistortion state machine works as follows:
2419  * 1) Disable digital predistorters for all Tx chains
2420  * 2) Repeat steps 3~7 for all Tx chains
2421  * 3)   Force Tx gain to that of training signal
2422  * 4)   Send training signal (asynchronous)
2423  * 5)   Wait for training signal to complete (asynchronous)
2424  * 6)   Read PA measurements (input power, output power, output phase)
2425  * 7)   Compute the predistortion function that linearizes PA output
2426  * 8) Write predistortion functions to hardware tables for all Tx chains
2427  * 9) Enable digital predistorters for all Tx chains
2428  */
2429 void
2430 ar9003_paprd_calib(struct athn_softc *sc, struct ieee80211_channel *c)
2431 {
2432 	static const int scaling[] = {
2433 		261376, 248079, 233759, 220464,
2434 		208194, 196949, 185706, 175487
2435 	};
2436 	struct athn_ops *ops = &sc->ops;
2437 	uint32_t reg, ht20mask, ht40mask;
2438 	int i;
2439 
2440 	/* Read PA predistortion masks from ROM. */
2441 	ops->get_paprd_masks(sc, c, &ht20mask, &ht40mask);
2442 
2443 	/* AM-to-AM: amplifier's amplitude characteristic. */
2444 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2AM);
2445 	reg = RW(reg, AR_PHY_PAPRD_AM2AM_MASK, ht20mask);
2446 	AR_WRITE(sc, AR_PHY_PAPRD_AM2AM, reg);
2447 
2448 	/* AM-to-PM: amplifier's phase transfer characteristic. */
2449 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2PM);
2450 	reg = RW(reg, AR_PHY_PAPRD_AM2PM_MASK, ht20mask);
2451 	AR_WRITE(sc, AR_PHY_PAPRD_AM2PM, reg);
2452 
2453 	reg = AR_READ(sc, AR_PHY_PAPRD_HT40);
2454 	reg = RW(reg, AR_PHY_PAPRD_HT40_MASK, ht40mask);
2455 	AR_WRITE(sc, AR_PHY_PAPRD_HT40, reg);
2456 
2457 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2458 		AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2459 		    AR_PHY_PAPRD_CTRL0_USE_SINGLE_TABLE);
2460 
2461 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(i));
2462 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_PA_GAIN_SCALE_FACT, 181);
2463 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_MAG_SCALE_FACT, 361);
2464 		reg &= ~AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA;
2465 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2AM_ENA;
2466 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2PM_ENA;
2467 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(i), reg);
2468 
2469 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL0_B(i));
2470 		reg = RW(reg, AR_PHY_PAPRD_CTRL0_PAPRD_MAG_THRSH, 3);
2471 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL0_B(i), reg);
2472 	}
2473 
2474 	/* Disable all digital predistorters during calibration. */
2475 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2476 		AR_CLRBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2477 		    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2478 	}
2479 	AR_WRITE_BARRIER(sc);
2480 
2481 	/*
2482 	 * Configure training signal.
2483 	 */
2484 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL1);
2485 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_AGC2_SETTLING, 28);
2486 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_LB_SKIP, 0x30);
2487 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_RX_BB_GAIN_FORCE;
2488 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_IQCORR_ENABLE;
2489 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_LB_ENABLE;
2490 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TX_GAIN_FORCE;
2491 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TRAIN_ENABLE;
2492 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL1, reg);
2493 
2494 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL2, 147);
2495 
2496 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL3);
2497 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_FINE_CORR_LEN, 4);
2498 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_COARSE_CORR_LEN, 4);
2499 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_NUM_CORR_STAGES, 7);
2500 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_MIN_LOOPBACK_DEL, 1);
2501 	if (AR_SREV_9485(sc))
2502 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -3);
2503 	else
2504 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -6);
2505 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_ADC_DESIRED_SIZE, -15);
2506 	reg |= AR_PHY_PAPRD_TRAINER_CNTL3_BBTXMIX_DISABLE;
2507 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL3, reg);
2508 
2509 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL4);
2510 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_SAFETY_DELTA, 0);
2511 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_MIN_CORR, 400);
2512 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_NUM_TRAIN_SAMPLES, 100);
2513 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL4, reg);
2514 
2515 	for (i = 0; i < nitems(scaling); i++) {
2516 		reg = AR_READ(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i));
2517 		reg = RW(reg, AR_PHY_PAPRD_PRE_POST_SCALING, scaling[i]);
2518 		AR_WRITE(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i), reg);
2519 	}
2520 
2521 	/* Save Tx gain table. */
2522 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE; i++)
2523 		sc->txgain[i] = AR_READ(sc, AR_PHY_TXGAIN_TABLE(i));
2524 
2525 	/* Set Tx power of training signal (use setting for MCS0). */
2526 	sc->trainpow = MS(AR_READ(sc, AR_PHY_PWRTX_RATE5),
2527 	    AR_PHY_PWRTX_RATE5_POWERTXHT20_0) - 4;
2528 
2529 	/*
2530 	 * Start PA predistortion calibration state machine.
2531 	 */
2532 	/* Find first available Tx chain. */
2533 	sc->paprd_curchain = 0;
2534 	while (!(sc->txchainmask & (1 << sc->paprd_curchain)))
2535 		sc->paprd_curchain++;
2536 
2537 	/* Make sure training done bit is clear. */
2538 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2539 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2540 	AR_WRITE_BARRIER(sc);
2541 
2542 	/* Transmit training signal. */
2543 	ar9003_paprd_tx_tone(sc);
2544 }
2545 
2546 int
2547 ar9003_get_desired_txgain(struct athn_softc *sc, int chain, int pow)
2548 {
2549 	int32_t scale, atemp, avolt, tempcal, voltcal, temp, volt;
2550 	int32_t tempcorr, voltcorr;
2551 	uint32_t reg;
2552 	int8_t delta;
2553 
2554 	scale = MS(AR_READ(sc, AR_PHY_TPC_12),
2555 	    AR_PHY_TPC_12_DESIRED_SCALE_HT40_5);
2556 
2557 	reg = AR_READ(sc, AR_PHY_TPC_19);
2558 	atemp = MS(reg, AR_PHY_TPC_19_ALPHA_THERM);
2559 	avolt = MS(reg, AR_PHY_TPC_19_ALPHA_VOLT);
2560 
2561 	reg = AR_READ(sc, AR_PHY_TPC_18);
2562 	tempcal = MS(reg, AR_PHY_TPC_18_THERM_CAL);
2563 	voltcal = MS(reg, AR_PHY_TPC_18_VOLT_CAL);
2564 
2565 	reg = AR_READ(sc, AR_PHY_BB_THERM_ADC_4);
2566 	temp = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_THERM);
2567 	volt = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_VOLT);
2568 
2569 	delta = (int8_t)MS(AR_READ(sc, AR_PHY_TPC_11_B(chain)),
2570 	    AR_PHY_TPC_11_OLPC_GAIN_DELTA);
2571 
2572 	/* Compute temperature and voltage correction. */
2573 	tempcorr = (atemp * (temp - tempcal) + 128) / 256;
2574 	voltcorr = (avolt * (volt - voltcal) + 64) / 128;
2575 
2576 	/* Compute desired Tx gain. */
2577 	return (pow - delta - tempcorr - voltcorr + scale);
2578 }
2579 
2580 void
2581 ar9003_force_txgain(struct athn_softc *sc, uint32_t txgain)
2582 {
2583 	uint32_t reg;
2584 
2585 	reg = AR_READ(sc, AR_PHY_TX_FORCED_GAIN);
2586 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB1DBGAIN,
2587 	    MS(txgain, AR_PHY_TXGAIN_TXBB1DBGAIN));
2588 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB6DBGAIN,
2589 	    MS(txgain, AR_PHY_TXGAIN_TXBB6DBGAIN));
2590 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXMXRGAIN,
2591 	    MS(txgain, AR_PHY_TXGAIN_TXMXRGAIN));
2592 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNA,
2593 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNA));
2594 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNB,
2595 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNB));
2596 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNC,
2597 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNC));
2598 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGND,
2599 	    MS(txgain, AR_PHY_TXGAIN_PADRVGND));
2600 	reg &= ~AR_PHY_TX_FORCED_GAIN_ENABLE_PAL;
2601 	reg &= ~AR_PHY_TX_FORCED_GAIN_FORCE_TX_GAIN;
2602 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, reg);
2603 
2604 	reg = AR_READ(sc, AR_PHY_TPC_1);
2605 	reg = RW(reg, AR_PHY_TPC_1_FORCED_DAC_GAIN, 0);
2606 	reg &= ~AR_PHY_TPC_1_FORCE_DAC_GAIN;
2607 	AR_WRITE(sc, AR_PHY_TPC_1, reg);
2608 	AR_WRITE_BARRIER(sc);
2609 }
2610 
2611 void
2612 ar9003_set_training_gain(struct athn_softc *sc, int chain)
2613 {
2614 	int i, gain;
2615 
2616 	/*
2617 	 * Get desired gain for training signal power (take into account
2618 	 * current temperature/voltage).
2619 	 */
2620 	gain = ar9003_get_desired_txgain(sc, chain, sc->trainpow);
2621 	/* Find entry in table. */
2622 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE - 1; i++)
2623 		if (MS(sc->txgain[i], AR_PHY_TXGAIN_INDEX) >= gain)
2624 			break;
2625 	ar9003_force_txgain(sc, sc->txgain[i]);
2626 }
2627 
2628 int
2629 ar9003_paprd_tx_tone(struct athn_softc *sc)
2630 {
2631 #define TONE_LEN	1800
2632 	struct ieee80211com *ic = &sc->sc_ic;
2633 	struct ieee80211_frame *wh;
2634 	struct ieee80211_node *ni;
2635 	struct mbuf *m;
2636 	int error;
2637 
2638 	/* Build a Null (no data) frame of TONE_LEN bytes. */
2639 	m = MCLGETI(NULL, M_DONTWAIT, NULL, TONE_LEN);
2640 	if (m == NULL)
2641 		return (ENOBUFS);
2642 	memset(mtod(m, caddr_t), 0, TONE_LEN);
2643 	wh = mtod(m, struct ieee80211_frame *);
2644 	wh->i_fc[0] = IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA;
2645 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2646 	*(uint16_t *)wh->i_dur = htole16(10);	/* XXX */
2647 	IEEE80211_ADDR_COPY(wh->i_addr1, ic->ic_myaddr);
2648 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
2649 	IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_myaddr);
2650 	m->m_pkthdr.len = m->m_len = TONE_LEN;
2651 
2652 	/* Set gain of training signal. */
2653 	ar9003_set_training_gain(sc, sc->paprd_curchain);
2654 
2655 	/* Transmit training signal. */
2656 	ni = ieee80211_ref_node(ic->ic_bss);
2657 	if ((error = ar9003_tx(sc, m, ni, ATHN_TXFLAG_PAPRD)) != 0)
2658 		ieee80211_release_node(ic, ni);
2659 	return (error);
2660 #undef TONE_LEN
2661 }
2662 
2663 static __inline int
2664 get_scale(int val)
2665 {
2666 	int log = 0;
2667 
2668 	/* Find the log base 2 (position of highest bit set). */
2669 	while (val >>= 1)
2670 		log++;
2671 
2672 	return ((log > 10) ? log - 10 : 0);
2673 }
2674 
2675 /*
2676  * Compute predistortion function to linearize power amplifier output based
2677  * on feedback from training signal.
2678  */
2679 int
2680 ar9003_compute_predistortion(struct athn_softc *sc, const uint32_t *lo,
2681     const uint32_t *hi)
2682 {
2683 #define NBINS	23
2684 	int chain = sc->paprd_curchain;
2685 	int x[NBINS + 1], y[NBINS + 1], t[NBINS + 1];
2686 	int b1[NBINS + 1], b2[NBINS + 1], xtilde[NBINS + 1];
2687 	int nsamples, txsum, rxsum, rosum, maxidx;
2688 	int order, order5x, order5xrem, order3x, order3xrem, y5, y3;
2689 	int icept, G, I, L, M, angle, xnonlin, y2, y4, sumy2, sumy4;
2690 	int alpha, beta, scale, Qalpha, Qbeta, Qscale, Qx, Qb1, Qb2;
2691 	int tavg, ttilde, maxb1abs, maxb2abs, maxxtildeabs, in;
2692 	int tmp, i;
2693 
2694 	/* Set values at origin. */
2695 	x[0] = y[0] = t[0] = 0;
2696 
2697 #define SCALE	32
2698 	maxidx = 0;
2699 	for (i = 0; i < NBINS; i++) {
2700 		nsamples = lo[i] & 0xffff;
2701 		/* Skip bins that contain 16 or less samples. */
2702 		if (nsamples <= 16) {
2703 			x[i + 1] = y[i + 1] = t[i + 1] = 0;
2704 			continue;
2705 		}
2706 		txsum = (hi[i] & 0x7ff) << 16 | lo[i] >> 16;
2707 		rxsum = (lo[i + NBINS] & 0xffff) << 5 |
2708 		    ((hi[i] >> 11) & 0x1f);
2709 		rosum = (hi[i + NBINS] & 0x7ff) << 16 | hi[i + NBINS] >> 16;
2710 		/* Sign-extend 27-bit value. */
2711 		rosum = (rosum ^ 0x4000000) - 0x4000000;
2712 
2713 		txsum *= SCALE;
2714 		rxsum *= SCALE;
2715 		rosum *= SCALE;
2716 
2717 		x[i + 1] = ((txsum + nsamples) / nsamples + SCALE) / SCALE;
2718 		y[i + 1] = ((rxsum + nsamples) / nsamples + SCALE) / SCALE +
2719 		    SCALE * maxidx + SCALE / 2;
2720 		t[i + 1] = (rosum + nsamples) / nsamples;
2721 		maxidx++;
2722 	}
2723 #undef SCALE
2724 
2725 #define SCALE_LOG	8
2726 #define SCALE		(1 << SCALE_LOG)
2727 	if (x[6] == x[3])
2728 		return (1);	/* Prevent division by 0. */
2729 	G = ((y[6] - y[3]) * SCALE + (x[6] - x[3])) / (x[6] - x[3]);
2730 	if (G == 0)
2731 		return (1);	/* Prevent division by 0. */
2732 
2733 	sc->gain1[chain] = G;	/* Save low signal gain. */
2734 
2735 	/* Find interception point. */
2736 	icept = (G * (x[0] - x[3]) + SCALE) / SCALE + y[3];
2737 	for (i = 0; i <= 3; i++) {
2738 		y[i] = i * 32;
2739 		x[i] = (y[i] * SCALE + G) / G;
2740 	}
2741 	for (i = 4; i <= maxidx; i++)
2742 		y[i] -= icept;
2743 
2744 	xnonlin = x[maxidx] - (y[maxidx] * SCALE + G) / G;
2745 	order = (xnonlin + y[maxidx]) / y[maxidx];
2746 	if (order == 0)
2747 		M = 10;
2748 	else if (order == 1)
2749 		M = 9;
2750 	else
2751 		M = 8;
2752 
2753 	I = (maxidx >= 16) ? 7 : maxidx / 2;
2754 	L = maxidx - I;
2755 
2756 	sumy2 = sumy4 = y2 = y4 = 0;
2757 	for (i = 0; i <= L; i++) {
2758 		if (y[i + I] == 0)
2759 			return (1);	/* Prevent division by 0. */
2760 
2761 		xnonlin = x[i + I] - ((y[i + I] * SCALE) + G) / G;
2762 		xtilde[i] = ((xnonlin << M) + y[i + I]) / y[i + I];
2763 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2764 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2765 
2766 		y2 = (y[i + I] * y[i + I] + SCALE * SCALE) / (SCALE * SCALE);
2767 
2768 		sumy2 += y2;
2769 		sumy4 += y2 * y2;
2770 
2771 		b1[i] = y2 * (L + 1);
2772 		b2[i] = y2;
2773 	}
2774 	for (i = 0; i <= L; i++) {
2775 		b1[i] -= sumy2;
2776 		b2[i] = sumy4 - sumy2 * b2[i];
2777 	}
2778 
2779 	maxxtildeabs = maxb1abs = maxb2abs = 0;
2780 	for (i = 0; i <= L; i++) {
2781 		tmp = abs(xtilde[i]);
2782 		if (tmp > maxxtildeabs)
2783 			maxxtildeabs = tmp;
2784 
2785 		tmp = abs(b1[i]);
2786 		if (tmp > maxb1abs)
2787 			maxb1abs = tmp;
2788 
2789 		tmp = abs(b2[i]);
2790 		if (tmp > maxb2abs)
2791 			maxb2abs = tmp;
2792 	}
2793 	Qx  = get_scale(maxxtildeabs);
2794 	Qb1 = get_scale(maxb1abs);
2795 	Qb2 = get_scale(maxb2abs);
2796 	for (i = 0; i <= L; i++) {
2797 		xtilde[i] /= 1 << Qx;
2798 		b1[i] /= 1 << Qb1;
2799 		b2[i] /= 1 << Qb2;
2800 	}
2801 
2802 	alpha = beta = 0;
2803 	for (i = 0; i <= L; i++) {
2804 		alpha += b1[i] * xtilde[i];
2805 		beta  += b2[i] * xtilde[i];
2806 	}
2807 
2808 	scale = ((y4 / SCALE_LOG) * (L + 1) -
2809 		 (y2 / SCALE_LOG) * sumy2) * SCALE_LOG;
2810 
2811 	Qscale = get_scale(abs(scale));
2812 	scale /= 1 << Qscale;
2813 	Qalpha = get_scale(abs(alpha));
2814 	alpha /= 1 << Qalpha;
2815 	Qbeta  = get_scale(abs(beta));
2816 	beta  /= 1 << Qbeta;
2817 
2818 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale;
2819 	order5x = 1 << (order / 5);
2820 	order5xrem = 1 << (order % 5);
2821 
2822 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale;
2823 	order3x = 1 << (order / 3);
2824 	order3xrem = 1 << (order % 3);
2825 
2826 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2827 		tmp = i * 32;
2828 
2829 		/* Fifth order. */
2830 		y5 = ((beta * tmp) / 64) / order5x;
2831 		y5 = (y5 * tmp) / order5x;
2832 		y5 = (y5 * tmp) / order5x;
2833 		y5 = (y5 * tmp) / order5x;
2834 		y5 = (y5 * tmp) / order5x;
2835 		y5 = y5 / order5xrem;
2836 
2837 		/* Third oder. */
2838 		y3 = (alpha * tmp) / order3x;
2839 		y3 = (y3 * tmp) / order3x;
2840 		y3 = (y3 * tmp) / order3x;
2841 		y3 = y3 / order3xrem;
2842 
2843 		in = y5 + y3 + (SCALE * tmp) / G;
2844 		if (i >= 2 && in < sc->pa_in[chain][i - 1]) {
2845 			in = sc->pa_in[chain][i - 1] +
2846 			    (sc->pa_in[chain][i - 1] -
2847 			     sc->pa_in[chain][i - 2]);
2848 		}
2849 		if (in > 1400)
2850 			in = 1400;
2851 		sc->pa_in[chain][i] = in;
2852 	}
2853 
2854 	/* Compute average theta of first 5 bins (linear region). */
2855 	tavg = 0;
2856 	for (i = 1; i <= 5; i++)
2857 		tavg += t[i];
2858 	tavg /= 5;
2859 	for (i = 1; i <= 5; i++)
2860 		t[i] = 0;
2861 	for (i = 6; i <= maxidx; i++)
2862 		t[i] -= tavg;
2863 
2864 	alpha = beta = 0;
2865 	for (i = 0; i <= L; i++) {
2866 		ttilde = ((t[i + I] << M) + y[i + I]) / y[i + I];
2867 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2868 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2869 
2870 		alpha += b2[i] * ttilde;
2871 		beta  += b1[i] * ttilde;
2872 	}
2873 
2874 	Qalpha = get_scale(abs(alpha));
2875 	alpha /= 1 << Qalpha;
2876 	Qbeta  = get_scale(abs(beta));
2877 	beta  /= 1 << Qbeta;
2878 
2879 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale + 5;
2880 	order5x = 1 << (order / 5);
2881 	order5xrem = 1 << (order % 5);
2882 
2883 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale + 5;
2884 	order3x = 1 << (order / 3);
2885 	order3xrem = 1 << (order % 3);
2886 
2887 	for (i = 0; i <= 4; i++)
2888 		sc->angle[chain][i] = 0;	/* Linear at that range. */
2889 	for (i = 5; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2890 		tmp = i * 32;
2891 
2892 		/* Fifth order. */
2893 		if (beta > 0)
2894 			y5 = (((beta * tmp - 64) / 64) - order5x) / order5x;
2895 		else
2896 			y5 = (((beta * tmp - 64) / 64) + order5x) / order5x;
2897 		y5 = (y5 * tmp) / order5x;
2898 		y5 = (y5 * tmp) / order5x;
2899 		y5 = (y5 * tmp) / order5x;
2900 		y5 = (y5 * tmp) / order5x;
2901 		y5 = y5 / order5xrem;
2902 
2903 		/* Third oder. */
2904 		if (beta > 0)	/* XXX alpha? */
2905 			y3 = (alpha * tmp - order3x) / order3x;
2906 		else
2907 			y3 = (alpha * tmp + order3x) / order3x;
2908 		y3 = (y3 * tmp) / order3x;
2909 		y3 = (y3 * tmp) / order3x;
2910 		y3 = y3 / order3xrem;
2911 
2912 		angle = y5 + y3;
2913 		if (angle < -150)
2914 			angle = -150;
2915 		else if (angle > 150)
2916 			angle = 150;
2917 		sc->angle[chain][i] = angle;
2918 	}
2919 	/* Angle for entry 4 is derived from angle for entry 5. */
2920 	sc->angle[chain][4] = (sc->angle[chain][5] + 2) / 2;
2921 
2922 	return (0);
2923 #undef SCALE
2924 #undef SCALE_LOG
2925 #undef NBINS
2926 }
2927 
2928 void
2929 ar9003_enable_predistorter(struct athn_softc *sc, int chain)
2930 {
2931 	uint32_t reg;
2932 	int i;
2933 
2934 	/* Write digital predistorter lookup table. */
2935 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2936 		AR_WRITE(sc, AR_PHY_PAPRD_MEM_TAB_B(chain, i),
2937 		    SM(AR_PHY_PAPRD_PA_IN, sc->pa_in[chain][i]) |
2938 		    SM(AR_PHY_PAPRD_ANGLE, sc->angle[chain][i]));
2939 	}
2940 
2941 	reg = AR_READ(sc, AR_PHY_PA_GAIN123_B(chain));
2942 	reg = RW(reg, AR_PHY_PA_GAIN123_PA_GAIN1, sc->gain1[chain]);
2943 	AR_WRITE(sc, AR_PHY_PA_GAIN123_B(chain), reg);
2944 
2945 	/* Indicate Tx power used for calibration (training signal). */
2946 	reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(chain));
2947 	reg = RW(reg, AR_PHY_PAPRD_CTRL1_POWER_AT_AM2AM_CAL, sc->trainpow);
2948 	AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(chain), reg);
2949 
2950 	/* Enable digital predistorter for this chain. */
2951 	AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(chain),
2952 	    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2953 	AR_WRITE_BARRIER(sc);
2954 }
2955 
2956 void
2957 ar9003_paprd_enable(struct athn_softc *sc)
2958 {
2959 	int i;
2960 
2961 	/* Enable digital predistorters for all Tx chains. */
2962 	for (i = 0; i < AR9003_MAX_CHAINS; i++)
2963 		if (sc->txchainmask & (1 << i))
2964 			ar9003_enable_predistorter(sc, i);
2965 }
2966 
2967 /*
2968  * This function is called when our training signal has been sent.
2969  */
2970 void
2971 ar9003_paprd_tx_tone_done(struct athn_softc *sc)
2972 {
2973 	uint32_t lo[48], hi[48];
2974 	int i;
2975 
2976 	/* Make sure training is complete. */
2977 	if (!(AR_READ(sc, AR_PHY_PAPRD_TRAINER_STAT1) &
2978 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE))
2979 		return;
2980 
2981 	/* Read feedback from training signal. */
2982 	AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2983 	for (i = 0; i < nitems(lo); i++)
2984 		lo[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2985 	AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2986 	for (i = 0; i < nitems(hi); i++)
2987 		hi[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2988 
2989 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2990 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2991 
2992 	/* Compute predistortion function based on this feedback. */
2993 	if (ar9003_compute_predistortion(sc, lo, hi) != 0)
2994 		return;
2995 
2996 	/* Get next available Tx chain. */
2997 	while (++sc->paprd_curchain < AR9003_MAX_CHAINS)
2998 		if (sc->txchainmask & (1 << sc->paprd_curchain))
2999 			break;
3000 	if (sc->paprd_curchain == AR9003_MAX_CHAINS) {
3001 		/* All Tx chains measured; enable digital predistortion. */
3002 		ar9003_paprd_enable(sc);
3003 	} else	/* Measure next Tx chain. */
3004 		ar9003_paprd_tx_tone(sc);
3005 }
3006 
3007 void
3008 ar9003_write_txpower(struct athn_softc *sc, int16_t power[ATHN_POWER_COUNT])
3009 {
3010 	/* Make sure forced gain is disabled. */
3011 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, 0);
3012 
3013 	AR_WRITE(sc, AR_PHY_PWRTX_RATE1,
3014 	    (power[ATHN_POWER_OFDM18  ] & 0x3f) << 24 |
3015 	    (power[ATHN_POWER_OFDM12  ] & 0x3f) << 16 |
3016 	    (power[ATHN_POWER_OFDM9   ] & 0x3f) <<  8 |
3017 	    (power[ATHN_POWER_OFDM6   ] & 0x3f));
3018 	AR_WRITE(sc, AR_PHY_PWRTX_RATE2,
3019 	    (power[ATHN_POWER_OFDM54  ] & 0x3f) << 24 |
3020 	    (power[ATHN_POWER_OFDM48  ] & 0x3f) << 16 |
3021 	    (power[ATHN_POWER_OFDM36  ] & 0x3f) <<  8 |
3022 	    (power[ATHN_POWER_OFDM24  ] & 0x3f));
3023 	AR_WRITE(sc, AR_PHY_PWRTX_RATE3,
3024 	    (power[ATHN_POWER_CCK2_SP ] & 0x3f) << 24 |
3025 	    (power[ATHN_POWER_CCK2_LP ] & 0x3f) << 16 |
3026 	    /* NB: No eXtended Range for AR9003. */
3027 	    (power[ATHN_POWER_CCK1_LP ] & 0x3f));
3028 	AR_WRITE(sc, AR_PHY_PWRTX_RATE4,
3029 	    (power[ATHN_POWER_CCK11_SP] & 0x3f) << 24 |
3030 	    (power[ATHN_POWER_CCK11_LP] & 0x3f) << 16 |
3031 	    (power[ATHN_POWER_CCK55_SP] & 0x3f) <<  8 |
3032 	    (power[ATHN_POWER_CCK55_LP] & 0x3f));
3033 	/*
3034 	 * NB: AR_PHY_PWRTX_RATE5 needs to be written even if HT is disabled
3035 	 * because it is read by PA predistortion functions.
3036 	 */
3037 	AR_WRITE(sc, AR_PHY_PWRTX_RATE5,
3038 	    (power[ATHN_POWER_HT20( 5)] & 0x3f) << 24 |
3039 	    (power[ATHN_POWER_HT20( 4)] & 0x3f) << 16 |
3040 	    (power[ATHN_POWER_HT20( 1)] & 0x3f) <<  8 |
3041 	    (power[ATHN_POWER_HT20( 0)] & 0x3f));
3042 	AR_WRITE(sc, AR_PHY_PWRTX_RATE6,
3043 	    (power[ATHN_POWER_HT20(13)] & 0x3f) << 24 |
3044 	    (power[ATHN_POWER_HT20(12)] & 0x3f) << 16 |
3045 	    (power[ATHN_POWER_HT20( 7)] & 0x3f) <<  8 |
3046 	    (power[ATHN_POWER_HT20( 6)] & 0x3f));
3047 	AR_WRITE(sc, AR_PHY_PWRTX_RATE7,
3048 	    (power[ATHN_POWER_HT40( 5)] & 0x3f) << 24 |
3049 	    (power[ATHN_POWER_HT40( 4)] & 0x3f) << 16 |
3050 	    (power[ATHN_POWER_HT40( 1)] & 0x3f) <<  8 |
3051 	    (power[ATHN_POWER_HT40( 0)] & 0x3f));
3052 	AR_WRITE(sc, AR_PHY_PWRTX_RATE8,
3053 	    (power[ATHN_POWER_HT40(13)] & 0x3f) << 24 |
3054 	    (power[ATHN_POWER_HT40(12)] & 0x3f) << 16 |
3055 	    (power[ATHN_POWER_HT40( 7)] & 0x3f) <<  8 |
3056 	    (power[ATHN_POWER_HT40( 6)] & 0x3f));
3057 	AR_WRITE(sc, AR_PHY_PWRTX_RATE10,
3058 	    (power[ATHN_POWER_HT20(21)] & 0x3f) << 24 |
3059 	    (power[ATHN_POWER_HT20(20)] & 0x3f) << 16 |
3060 	    (power[ATHN_POWER_HT20(15)] & 0x3f) <<  8 |
3061 	    (power[ATHN_POWER_HT20(14)] & 0x3f));
3062 	AR_WRITE(sc, AR_PHY_PWRTX_RATE11,
3063 	    (power[ATHN_POWER_HT40(23)] & 0x3f) << 24 |
3064 	    (power[ATHN_POWER_HT40(22)] & 0x3f) << 16 |
3065 	    (power[ATHN_POWER_HT20(23)] & 0x3f) <<  8 |
3066 	    (power[ATHN_POWER_HT20(22)] & 0x3f));
3067 	AR_WRITE(sc, AR_PHY_PWRTX_RATE12,
3068 	    (power[ATHN_POWER_HT40(21)] & 0x3f) << 24 |
3069 	    (power[ATHN_POWER_HT40(20)] & 0x3f) << 16 |
3070 	    (power[ATHN_POWER_HT40(15)] & 0x3f) <<  8 |
3071 	    (power[ATHN_POWER_HT40(14)] & 0x3f));
3072 	AR_WRITE_BARRIER(sc);
3073 }
3074 
3075 void
3076 ar9003_reset_rx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3077 {
3078 #define X(x)	((uint32_t)(x) << 2)
3079 	const struct athn_gain *prog = sc->rx_gain;
3080 	const uint32_t *pvals;
3081 	int i;
3082 
3083 	if (IEEE80211_IS_CHAN_2GHZ(c))
3084 		pvals = prog->vals_2g;
3085 	else
3086 		pvals = prog->vals_5g;
3087 	for (i = 0; i < prog->nregs; i++)
3088 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3089 	AR_WRITE_BARRIER(sc);
3090 #undef X
3091 }
3092 
3093 void
3094 ar9003_reset_tx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3095 {
3096 #define X(x)	((uint32_t)(x) << 2)
3097 	const struct athn_gain *prog = sc->tx_gain;
3098 	const uint32_t *pvals;
3099 	int i;
3100 
3101 	if (IEEE80211_IS_CHAN_2GHZ(c))
3102 		pvals = prog->vals_2g;
3103 	else
3104 		pvals = prog->vals_5g;
3105 	for (i = 0; i < prog->nregs; i++)
3106 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3107 	AR_WRITE_BARRIER(sc);
3108 #undef X
3109 }
3110 
3111 void
3112 ar9003_hw_init(struct athn_softc *sc, struct ieee80211_channel *c,
3113     struct ieee80211_channel *extc)
3114 {
3115 #define X(x)	((uint32_t)(x) << 2)
3116 	struct athn_ops *ops = &sc->ops;
3117 	const struct athn_ini *ini = sc->ini;
3118 	const uint32_t *pvals;
3119 	uint32_t reg;
3120 	int i;
3121 
3122 	/*
3123 	 * The common init values include the pre and core phases for the
3124 	 * SoC, MAC, BB and Radio subsystems.
3125 	 */
3126 	DPRINTFN(4, ("writing pre and core init vals\n"));
3127 	for (i = 0; i < ini->ncmregs; i++) {
3128 		AR_WRITE(sc, X(ini->cmregs[i]), ini->cmvals[i]);
3129 		if (AR_IS_ANALOG_REG(X(ini->cmregs[i])))
3130 			DELAY(100);
3131 		if ((i & 0x1f) == 0)
3132 			DELAY(1);
3133 	}
3134 
3135 	/*
3136 	 * The modal init values include the post phase for the SoC, MAC,
3137 	 * BB and Radio subsystems.
3138 	 */
3139 	if (extc != NULL) {
3140 		if (IEEE80211_IS_CHAN_2GHZ(c))
3141 			pvals = ini->vals_2g40;
3142 		else
3143 			pvals = ini->vals_5g40;
3144 	} else {
3145 		if (IEEE80211_IS_CHAN_2GHZ(c))
3146 			pvals = ini->vals_2g20;
3147 		else
3148 			pvals = ini->vals_5g20;
3149 	}
3150 	DPRINTFN(4, ("writing post init vals\n"));
3151 	for (i = 0; i < ini->nregs; i++) {
3152 		AR_WRITE(sc, X(ini->regs[i]), pvals[i]);
3153 		if (AR_IS_ANALOG_REG(X(ini->regs[i])))
3154 			DELAY(100);
3155 		if ((i & 0x1f) == 0)
3156 			DELAY(1);
3157 	}
3158 
3159 	if (sc->rx_gain != NULL)
3160 		ar9003_reset_rx_gain(sc, c);
3161 	if (sc->tx_gain != NULL)
3162 		ar9003_reset_tx_gain(sc, c);
3163 
3164 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
3165 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
3166 		/* Update modal values for fast PLL clock. */
3167 		if (extc != NULL)
3168 			pvals = ini->fastvals_5g40;
3169 		else
3170 			pvals = ini->fastvals_5g20;
3171 		DPRINTFN(4, ("writing fast pll clock init vals\n"));
3172 		for (i = 0; i < ini->nfastregs; i++) {
3173 			AR_WRITE(sc, X(ini->fastregs[i]), pvals[i]);
3174 			if (AR_IS_ANALOG_REG(X(ini->fastregs[i])))
3175 				DELAY(100);
3176 			if ((i & 0x1f) == 0)
3177 				DELAY(1);
3178 		}
3179 	}
3180 
3181 	/*
3182 	 * Set the RX_ABORT and RX_DIS bits to prevent frames with corrupted
3183 	 * descriptor status.
3184 	 */
3185 	AR_SETBITS(sc, AR_DIAG_SW, AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT);
3186 
3187 	reg = AR_READ(sc, AR_PCU_MISC_MODE2);
3188 	reg &= ~AR_PCU_MISC_MODE2_ADHOC_MCAST_KEYID_ENABLE;
3189 	reg |= AR_PCU_MISC_MODE2_AGG_WEP_ENABLE_FIX;
3190 	reg |= AR_PCU_MISC_MODE2_ENABLE_AGGWEP;
3191 	AR_WRITE(sc, AR_PCU_MISC_MODE2, reg);
3192 	AR_WRITE_BARRIER(sc);
3193 
3194 	ar9003_set_phy(sc, c, extc);
3195 	ar9003_init_chains(sc);
3196 
3197 	ops->set_txpower(sc, c, extc);
3198 #undef X
3199 }
3200 
3201 void
3202 ar9003_get_lg_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3203     uint8_t ctl, const uint8_t *fbins,
3204     const struct ar_cal_target_power_leg *tgt, int nchans, uint8_t tpow[4])
3205 {
3206 	uint8_t fbin;
3207 	int i, delta, lo, hi;
3208 
3209 	lo = hi = -1;
3210 	fbin = athn_chan2fbin(c);
3211 	for (i = 0; i < nchans; i++) {
3212 		delta = fbin - fbins[i];
3213 		/* Find the largest sample that is <= our frequency. */
3214 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3215 			lo = i;
3216 		/* Find the smallest sample that is >= our frequency. */
3217 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3218 			hi = i;
3219 	}
3220 	if (lo == -1)
3221 		lo = hi;
3222 	else if (hi == -1)
3223 		hi = lo;
3224 	/* Interpolate values. */
3225 	for (i = 0; i < 4; i++) {
3226 		tpow[i] = athn_interpolate(fbin,
3227 		    fbins[lo], tgt[lo].tPow2x[i],
3228 		    fbins[hi], tgt[hi].tPow2x[i]);
3229 	}
3230 	/* XXX Apply conformance test limit. */
3231 }
3232 
3233 void
3234 ar9003_get_ht_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3235     uint8_t ctl, const uint8_t *fbins,
3236     const struct ar_cal_target_power_ht *tgt, int nchans, uint8_t tpow[14])
3237 {
3238 	uint8_t fbin;
3239 	int i, delta, lo, hi;
3240 
3241 	lo = hi = -1;
3242 	fbin = athn_chan2fbin(c);
3243 	for (i = 0; i < nchans; i++) {
3244 		delta = fbin - fbins[i];
3245 		/* Find the largest sample that is <= our frequency. */
3246 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3247 			lo = i;
3248 		/* Find the smallest sample that is >= our frequency. */
3249 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3250 			hi = i;
3251 	}
3252 	if (lo == -1)
3253 		lo = hi;
3254 	else if (hi == -1)
3255 		hi = lo;
3256 	/* Interpolate values. */
3257 	for (i = 0; i < 14; i++) {
3258 		tpow[i] = athn_interpolate(fbin,
3259 		    fbins[lo], tgt[lo].tPow2x[i],
3260 		    fbins[hi], tgt[hi].tPow2x[i]);
3261 	}
3262 	/* XXX Apply conformance test limit. */
3263 }
3264 
3265 /*
3266  * Adaptive noise immunity.
3267  */
3268 void
3269 ar9003_set_noise_immunity_level(struct athn_softc *sc, int level)
3270 {
3271 	int high = level == 4;
3272 	uint32_t reg;
3273 
3274 	reg = AR_READ(sc, AR_PHY_DESIRED_SZ);
3275 	reg = RW(reg, AR_PHY_DESIRED_SZ_TOT_DES, high ? -62 : -55);
3276 	AR_WRITE(sc, AR_PHY_DESIRED_SZ, reg);
3277 
3278 	reg = AR_READ(sc, AR_PHY_AGC);
3279 	reg = RW(reg, AR_PHY_AGC_COARSE_LOW, high ? -70 : -64);
3280 	reg = RW(reg, AR_PHY_AGC_COARSE_HIGH, high ? -12 : -14);
3281 	AR_WRITE(sc, AR_PHY_AGC, reg);
3282 
3283 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3284 	reg = RW(reg, AR_PHY_FIND_SIG_FIRPWR, high ? -80 : -78);
3285 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3286 	AR_WRITE_BARRIER(sc);
3287 }
3288 
3289 void
3290 ar9003_enable_ofdm_weak_signal(struct athn_softc *sc)
3291 {
3292 	uint32_t reg;
3293 
3294 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3295 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 50);
3296 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 40);
3297 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 48);
3298 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3299 
3300 	reg = AR_READ(sc, AR_PHY_SFCORR);
3301 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 77);
3302 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 64);
3303 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 16);
3304 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3305 
3306 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3307 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 50);
3308 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 40);
3309 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 77);
3310 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 64);
3311 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3312 
3313 	AR_SETBITS(sc, AR_PHY_SFCORR_LOW,
3314 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3315 	AR_WRITE_BARRIER(sc);
3316 }
3317 
3318 void
3319 ar9003_disable_ofdm_weak_signal(struct athn_softc *sc)
3320 {
3321 	uint32_t reg;
3322 
3323 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3324 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 127);
3325 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 127);
3326 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 63);
3327 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3328 
3329 	reg = AR_READ(sc, AR_PHY_SFCORR);
3330 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 127);
3331 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 127);
3332 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 31);
3333 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3334 
3335 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3336 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 127);
3337 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 127);
3338 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 127);
3339 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 127);
3340 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3341 
3342 	AR_CLRBITS(sc, AR_PHY_SFCORR_LOW,
3343 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3344 	AR_WRITE_BARRIER(sc);
3345 }
3346 
3347 void
3348 ar9003_set_cck_weak_signal(struct athn_softc *sc, int high)
3349 {
3350 	uint32_t reg;
3351 
3352 	reg = AR_READ(sc, AR_PHY_CCK_DETECT);
3353 	reg = RW(reg, AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK, high ? 6 : 8);
3354 	AR_WRITE(sc, AR_PHY_CCK_DETECT, reg);
3355 	AR_WRITE_BARRIER(sc);
3356 }
3357 
3358 void
3359 ar9003_set_firstep_level(struct athn_softc *sc, int level)
3360 {
3361 	uint32_t reg;
3362 
3363 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3364 	reg = RW(reg, AR_PHY_FIND_SIG_FIRSTEP, level * 4);
3365 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3366 	AR_WRITE_BARRIER(sc);
3367 }
3368 
3369 void
3370 ar9003_set_spur_immunity_level(struct athn_softc *sc, int level)
3371 {
3372 	uint32_t reg;
3373 
3374 	reg = AR_READ(sc, AR_PHY_TIMING5);
3375 	reg = RW(reg, AR_PHY_TIMING5_CYCPWR_THR1, (level + 1) * 2);
3376 	AR_WRITE(sc, AR_PHY_TIMING5, reg);
3377 	AR_WRITE_BARRIER(sc);
3378 }
3379