xref: /openbsd-src/sys/dev/ic/bwi.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: bwi.c,v 1.102 2014/07/12 18:48:17 tedu Exp $	*/
2 
3 /*
4  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
5  *
6  * This code is derived from software contributed to The DragonFly Project
7  * by Sepherosa Ziehau <sepherosa@gmail.com>
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  * 3. Neither the name of The DragonFly Project nor the names of its
20  *    contributors may be used to endorse or promote products derived
21  *    from this software without specific, prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
26  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
27  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
28  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
29  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
30  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
31  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
32  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
33  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  * $DragonFly: src/sys/dev/netif/bwi/bwimac.c,v 1.1 2007/09/08 06:15:54 sephe Exp $
37  */
38 
39 #include "bpfilter.h"
40 
41 #include <sys/param.h>
42 #include <sys/types.h>
43 
44 #include <sys/device.h>
45 #include <sys/kernel.h>
46 #include <sys/malloc.h>
47 #include <sys/mbuf.h>
48 #include <sys/proc.h>
49 #include <sys/socket.h>
50 #include <sys/sockio.h>
51 #include <sys/systm.h>
52 
53 #include <machine/bus.h>
54 #include <machine/endian.h>
55 #include <machine/intr.h>
56 
57 #include <net/if.h>
58 #include <net/if_dl.h>
59 #include <net/if_media.h>
60 
61 #if NBPFILTER > 0
62 #include <net/bpf.h>
63 #endif
64 
65 #include <netinet/in.h>
66 #include <netinet/in_systm.h>
67 #include <netinet/if_ether.h>
68 
69 #include <net80211/ieee80211_var.h>
70 #include <net80211/ieee80211_amrr.h>
71 #include <net80211/ieee80211_radiotap.h>
72 
73 #include <dev/ic/bwireg.h>
74 #include <dev/ic/bwivar.h>
75 
76 #ifdef BWI_DEBUG
77 int bwi_debug = 1;
78 #define DPRINTF(l, x...)	do { if ((l) <= bwi_debug) printf(x); } while (0)
79 #else
80 #define DPRINTF(l, x...)
81 #endif
82 
83 /* XXX temporary porting goop */
84 #include <dev/pci/pcireg.h>
85 #include <dev/pci/pcivar.h>
86 #include <dev/pci/pcidevs.h>
87 
88 /* XXX does not belong here */
89 #define IEEE80211_OFDM_PLCP_RATE_MASK	0x0000000f
90 #define IEEE80211_OFDM_PLCP_LEN_MASK	0x0001ffe0
91 
92 /*
93  * Contention window (slots).
94  */
95 #define IEEE80211_CW_MAX	1023	/* aCWmax */
96 #define IEEE80211_CW_MIN_0	31	/* DS/CCK aCWmin, ERP aCWmin(0) */
97 #define IEEE80211_CW_MIN_1	15	/* OFDM aCWmin, ERP aCWmin(1) */
98 
99 #define __unused __attribute__((__unused__))
100 
101 extern int ticks;
102 
103 /* XXX end porting goop */
104 
105 /* MAC */
106 struct bwi_retry_lim {
107 	uint16_t	shretry;
108 	uint16_t	shretry_fb;
109 	uint16_t	lgretry;
110 	uint16_t	lgretry_fb;
111 };
112 
113 struct bwi_clock_freq {
114 	uint		clkfreq_min;
115 	uint		clkfreq_max;
116 };
117 
118 /* XXX does not belong here */
119 struct ieee80211_ds_plcp_hdr {
120 	uint8_t		i_signal;
121 	uint8_t		i_service;
122 	uint16_t	i_length;
123 	uint16_t	i_crc;
124 } __packed;
125 
126 enum bwi_modtype {
127 	IEEE80211_MODTYPE_DS	= 0,	/* DS/CCK modulation */
128 	IEEE80211_MODTYPE_PBCC	= 1,	/* PBCC modulation */
129 	IEEE80211_MODTYPE_OFDM	= 2	/* OFDM modulation */
130 };
131 #define IEEE80211_MODTYPE_CCK   IEEE80211_MODTYPE_DS
132 
133 /* MAC */
134 void		 bwi_tmplt_write_4(struct bwi_mac *, uint32_t, uint32_t);
135 void		 bwi_hostflags_write(struct bwi_mac *, uint64_t);
136 uint64_t	 bwi_hostflags_read(struct bwi_mac *);
137 uint16_t	 bwi_memobj_read_2(struct bwi_mac *, uint16_t, uint16_t);
138 uint32_t	 bwi_memobj_read_4(struct bwi_mac *, uint16_t, uint16_t);
139 void		 bwi_memobj_write_2(struct bwi_mac *, uint16_t, uint16_t,
140 		     uint16_t);
141 void		 bwi_memobj_write_4(struct bwi_mac *, uint16_t, uint16_t,
142 		     uint32_t);
143 int		 bwi_mac_lateattach(struct bwi_mac *);
144 int		 bwi_mac_init(struct bwi_mac *);
145 void		 bwi_mac_reset(struct bwi_mac *, int);
146 void		 bwi_mac_set_tpctl_11bg(struct bwi_mac *,
147 		     const struct bwi_tpctl *);
148 int		 bwi_mac_test(struct bwi_mac *);
149 void		 bwi_mac_setup_tpctl(struct bwi_mac *);
150 void		 bwi_mac_dummy_xmit(struct bwi_mac *);
151 void		 bwi_mac_init_tpctl_11bg(struct bwi_mac *);
152 void		 bwi_mac_detach(struct bwi_mac *);
153 int		 bwi_get_firmware(const char *, const uint8_t *, size_t,
154 		     size_t *, size_t *);
155 int		 bwi_fwimage_is_valid(struct bwi_softc *, uint8_t *,
156 		     size_t, char *, uint8_t);
157 int		 bwi_mac_fw_alloc(struct bwi_mac *);
158 void		 bwi_mac_fw_free(struct bwi_mac *);
159 int		 bwi_mac_fw_load(struct bwi_mac *);
160 int		 bwi_mac_gpio_init(struct bwi_mac *);
161 int		 bwi_mac_gpio_fini(struct bwi_mac *);
162 int		 bwi_mac_fw_load_iv(struct bwi_mac *, uint8_t *, size_t);
163 int		 bwi_mac_fw_init(struct bwi_mac *);
164 void		 bwi_mac_opmode_init(struct bwi_mac *);
165 void		 bwi_mac_hostflags_init(struct bwi_mac *);
166 void		 bwi_mac_bss_param_init(struct bwi_mac *);
167 void		 bwi_mac_set_retry_lim(struct bwi_mac *,
168 		     const struct bwi_retry_lim *);
169 void		 bwi_mac_set_ackrates(struct bwi_mac *,
170 		     const struct ieee80211_rateset *);
171 int		 bwi_mac_start(struct bwi_mac *);
172 int		 bwi_mac_stop(struct bwi_mac *);
173 int		 bwi_mac_config_ps(struct bwi_mac *);
174 void		 bwi_mac_reset_hwkeys(struct bwi_mac *);
175 void		 bwi_mac_shutdown(struct bwi_mac *);
176 int		 bwi_mac_get_property(struct bwi_mac *);
177 void		 bwi_mac_updateslot(struct bwi_mac *, int);
178 int		 bwi_mac_attach(struct bwi_softc *, int, uint8_t);
179 void		 bwi_mac_balance_atten(int *, int *);
180 void		 bwi_mac_adjust_tpctl(struct bwi_mac *, int, int);
181 void		 bwi_mac_calibrate_txpower(struct bwi_mac *,
182 		     enum bwi_txpwrcb_type);
183 void		 bwi_mac_lock(struct bwi_mac *);
184 void		 bwi_mac_unlock(struct bwi_mac *);
185 void		 bwi_mac_set_promisc(struct bwi_mac *, int);
186 
187 /* PHY */
188 void		 bwi_phy_write(struct bwi_mac *, uint16_t, uint16_t);
189 uint16_t	 bwi_phy_read(struct bwi_mac *, uint16_t);
190 int		 bwi_phy_attach(struct bwi_mac *);
191 void		 bwi_phy_set_bbp_atten(struct bwi_mac *, uint16_t);
192 int		 bwi_phy_calibrate(struct bwi_mac *);
193 void		 bwi_tbl_write_2(struct bwi_mac *mac, uint16_t, uint16_t);
194 void		 bwi_tbl_write_4(struct bwi_mac *mac, uint16_t, uint32_t);
195 void		 bwi_nrssi_write(struct bwi_mac *, uint16_t, int16_t);
196 int16_t		 bwi_nrssi_read(struct bwi_mac *, uint16_t);
197 void		 bwi_phy_init_11a(struct bwi_mac *);
198 void		 bwi_phy_init_11g(struct bwi_mac *);
199 void		 bwi_phy_init_11b_rev2(struct bwi_mac *);
200 void		 bwi_phy_init_11b_rev4(struct bwi_mac *);
201 void		 bwi_phy_init_11b_rev5(struct bwi_mac *);
202 void		 bwi_phy_init_11b_rev6(struct bwi_mac *);
203 void		 bwi_phy_config_11g(struct bwi_mac *);
204 void		 bwi_phy_config_agc(struct bwi_mac *);
205 void		 bwi_set_gains(struct bwi_mac *, const struct bwi_gains *);
206 void		 bwi_phy_clear_state(struct bwi_phy *);
207 
208 /* RF */
209 int16_t		 bwi_nrssi_11g(struct bwi_mac *);
210 struct bwi_rf_lo
211 		*bwi_get_rf_lo(struct bwi_mac *, uint16_t, uint16_t);
212 int		 bwi_rf_lo_isused(struct bwi_mac *, const struct bwi_rf_lo *);
213 void		 bwi_rf_write(struct bwi_mac *, uint16_t, uint16_t);
214 uint16_t	 bwi_rf_read(struct bwi_mac *, uint16_t);
215 int		 bwi_rf_attach(struct bwi_mac *);
216 void		 bwi_rf_set_chan(struct bwi_mac *, uint, int);
217 void		 bwi_rf_get_gains(struct bwi_mac *);
218 void		 bwi_rf_init(struct bwi_mac *);
219 void		 bwi_rf_off_11a(struct bwi_mac *);
220 void		 bwi_rf_off_11bg(struct bwi_mac *);
221 void		 bwi_rf_off_11g_rev5(struct bwi_mac *);
222 void		 bwi_rf_workaround(struct bwi_mac *, uint);
223 struct bwi_rf_lo
224 		*bwi_rf_lo_find(struct bwi_mac *, const struct bwi_tpctl *);
225 void		 bwi_rf_lo_adjust(struct bwi_mac *, const struct bwi_tpctl *);
226 void		 bwi_rf_lo_write(struct bwi_mac *, const struct bwi_rf_lo *);
227 int		 bwi_rf_gain_max_reached(struct bwi_mac *, int);
228 uint16_t	 bwi_bitswap4(uint16_t);
229 uint16_t	 bwi_phy812_value(struct bwi_mac *, uint16_t);
230 void		 bwi_rf_init_bcm2050(struct bwi_mac *);
231 uint16_t	 bwi_rf_calibval(struct bwi_mac *);
232 int32_t		 _bwi_adjust_devide(int32_t, int32_t);
233 int		 bwi_rf_calc_txpower(int8_t *, uint8_t, const int16_t[]);
234 int		 bwi_rf_map_txpower(struct bwi_mac *);
235 void		 bwi_rf_lo_update_11g(struct bwi_mac *);
236 uint32_t	 bwi_rf_lo_devi_measure(struct bwi_mac *, uint16_t);
237 uint16_t	 bwi_rf_get_tp_ctrl2(struct bwi_mac *);
238 uint8_t		 _bwi_rf_lo_update_11g(struct bwi_mac *, uint16_t);
239 void		 bwi_rf_lo_measure_11g(struct bwi_mac *,
240 		     const struct bwi_rf_lo *, struct bwi_rf_lo *, uint8_t);
241 void		 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *);
242 void		 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *);
243 void		 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *);
244 void		 bwi_rf_init_sw_nrssi_table(struct bwi_mac *);
245 void		 bwi_rf_init_hw_nrssi_table(struct bwi_mac *, uint16_t);
246 void		 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *);
247 int32_t		 _nrssi_threshold(const struct bwi_rf *, int32_t);
248 void		 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *);
249 void		 bwi_rf_clear_tssi(struct bwi_mac *);
250 void		 bwi_rf_clear_state(struct bwi_rf *);
251 void		 bwi_rf_on_11a(struct bwi_mac *);
252 void		 bwi_rf_on_11bg(struct bwi_mac *);
253 void		 bwi_rf_set_ant_mode(struct bwi_mac *, int);
254 int		 bwi_rf_get_latest_tssi(struct bwi_mac *, int8_t[], uint16_t);
255 int		 bwi_rf_tssi2dbm(struct bwi_mac *, int8_t, int8_t *);
256 int		 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *,
257 		     const struct bwi_rxbuf_hdr *);
258 int		 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *,
259 		     const struct bwi_rxbuf_hdr *);
260 int		 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *,
261 		     const struct bwi_rxbuf_hdr *);
262 uint16_t	 bwi_rf_lo_measure_11b(struct bwi_mac *);
263 void		 bwi_rf_lo_update_11b(struct bwi_mac *);
264 
265 /* INTERFACE */
266 uint16_t	 bwi_read_sprom(struct bwi_softc *, uint16_t);
267 void		 bwi_setup_desc32(struct bwi_softc *, struct bwi_desc32 *, int,
268 		     int, bus_addr_t, int, int);
269 void		 bwi_power_on(struct bwi_softc *, int);
270 int		 bwi_power_off(struct bwi_softc *, int);
271 int		 bwi_regwin_switch(struct bwi_softc *, struct bwi_regwin *,
272 		     struct bwi_regwin **);
273 int		 bwi_regwin_select(struct bwi_softc *, int);
274 void		 bwi_regwin_info(struct bwi_softc *, uint16_t *, uint8_t *);
275 void		 bwi_led_attach(struct bwi_softc *);
276 void		 bwi_led_newstate(struct bwi_softc *, enum ieee80211_state);
277 uint16_t	 bwi_led_onoff(struct bwi_led *, uint16_t, int);
278 void		 bwi_led_event(struct bwi_softc *, int);
279 void		 bwi_led_blink_start(struct bwi_softc *, int, int);
280 void		 bwi_led_blink_next(void *);
281 void		 bwi_led_blink_end(void *);
282 int		 bwi_bbp_attach(struct bwi_softc *);
283 int		 bwi_bus_init(struct bwi_softc *, struct bwi_mac *);
284 void		 bwi_get_card_flags(struct bwi_softc *);
285 void		 bwi_get_eaddr(struct bwi_softc *, uint16_t, uint8_t *);
286 void		 bwi_get_clock_freq(struct bwi_softc *,
287 		     struct bwi_clock_freq *);
288 int		 bwi_set_clock_mode(struct bwi_softc *, enum bwi_clock_mode);
289 int		 bwi_set_clock_delay(struct bwi_softc *);
290 int		 bwi_ioctl(struct ifnet *, u_long, caddr_t);
291 void		 bwi_start(struct ifnet *);
292 void		 bwi_watchdog(struct ifnet *);
293 void		 bwi_newstate_begin(struct bwi_softc *, enum ieee80211_state);
294 void		 bwi_init_statechg(struct bwi_softc *, int);
295 int		 bwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
296 int		 bwi_media_change(struct ifnet *);
297 void		 bwi_iter_func(void *, struct ieee80211_node *);
298 void		 bwi_amrr_timeout(void *);
299 void		 bwi_newassoc(struct ieee80211com *, struct ieee80211_node *,
300 		     int);
301 struct ieee80211_node
302 		*bwi_node_alloc(struct ieee80211com *ic);
303 int		 bwi_dma_alloc(struct bwi_softc *);
304 void		 bwi_dma_free(struct bwi_softc *);
305 int		 bwi_dma_ring_alloc(struct bwi_softc *,
306 		     struct bwi_ring_data *, bus_size_t, uint32_t);
307 int		 bwi_dma_txstats_alloc(struct bwi_softc *, uint32_t,
308 		     bus_size_t);
309 void		 bwi_dma_txstats_free(struct bwi_softc *);
310 int		 bwi_dma_mbuf_create(struct bwi_softc *);
311 void		 bwi_dma_mbuf_destroy(struct bwi_softc *, int, int);
312 void		 bwi_enable_intrs(struct bwi_softc *, uint32_t);
313 void		 bwi_disable_intrs(struct bwi_softc *, uint32_t);
314 int		 bwi_init_tx_ring32(struct bwi_softc *, int);
315 void		 bwi_init_rxdesc_ring32(struct bwi_softc *, uint32_t,
316 		     bus_addr_t, int, int);
317 int		 bwi_init_rx_ring32(struct bwi_softc *);
318 int		 bwi_init_txstats32(struct bwi_softc *);
319 void		 bwi_setup_rx_desc32(struct bwi_softc *, int, bus_addr_t, int);
320 void		 bwi_setup_tx_desc32(struct bwi_softc *, struct bwi_ring_data *,
321 		     int, bus_addr_t, int);
322 int		 bwi_init_tx_ring64(struct bwi_softc *, int);
323 int		 bwi_init_rx_ring64(struct bwi_softc *);
324 int		 bwi_init_txstats64(struct bwi_softc *);
325 void		 bwi_setup_rx_desc64(struct bwi_softc *, int, bus_addr_t, int);
326 void		 bwi_setup_tx_desc64(struct bwi_softc *, struct bwi_ring_data *,
327 		     int, bus_addr_t, int);
328 int		 bwi_newbuf(struct bwi_softc *, int, int);
329 void		 bwi_set_addr_filter(struct bwi_softc *, uint16_t,
330 		     const uint8_t *);
331 int		 bwi_set_chan(struct bwi_softc *, uint8_t);
332 void		 bwi_next_scan(void *);
333 int		 bwi_rxeof(struct bwi_softc *, int);
334 int		 bwi_rxeof32(struct bwi_softc *);
335 int		 bwi_rxeof64(struct bwi_softc *);
336 void		 bwi_reset_rx_ring32(struct bwi_softc *, uint32_t);
337 void		 bwi_free_txstats32(struct bwi_softc *);
338 void		 bwi_free_rx_ring32(struct bwi_softc *);
339 void		 bwi_free_tx_ring32(struct bwi_softc *, int);
340 void		 bwi_free_txstats64(struct bwi_softc *);
341 void		 bwi_free_rx_ring64(struct bwi_softc *);
342 void		 bwi_free_tx_ring64(struct bwi_softc *, int);
343 uint8_t		 bwi_plcp2rate(uint32_t, enum ieee80211_phymode);
344 void		 bwi_ofdm_plcp_header(uint32_t *, int, uint8_t);
345 void		 bwi_ds_plcp_header(struct ieee80211_ds_plcp_hdr *, int,
346 		     uint8_t);
347 void		 bwi_plcp_header(void *, int, uint8_t);
348 int		 bwi_encap(struct bwi_softc *, int, struct mbuf *,
349 		     struct ieee80211_node *);
350 void		 bwi_start_tx32(struct bwi_softc *, uint32_t, int);
351 void		 bwi_start_tx64(struct bwi_softc *, uint32_t, int);
352 void		 bwi_txeof_status32(struct bwi_softc *);
353 void		 bwi_txeof_status64(struct bwi_softc *);
354 void		 _bwi_txeof(struct bwi_softc *, uint16_t);
355 void		 bwi_txeof_status(struct bwi_softc *, int);
356 void		 bwi_txeof(struct bwi_softc *);
357 int		 bwi_bbp_power_on(struct bwi_softc *, enum bwi_clock_mode);
358 void		 bwi_bbp_power_off(struct bwi_softc *);
359 int		 bwi_get_pwron_delay(struct bwi_softc *sc);
360 int		 bwi_bus_attach(struct bwi_softc *);
361 const char 	*bwi_regwin_name(const struct bwi_regwin *);
362 int		 bwi_regwin_is_enabled(struct bwi_softc *, struct bwi_regwin *);
363 uint32_t	 bwi_regwin_disable_bits(struct bwi_softc *);
364 void		 bwi_regwin_enable(struct bwi_softc *, struct bwi_regwin *,
365 		     uint32_t);
366 void		 bwi_regwin_disable(struct bwi_softc *, struct bwi_regwin *,
367 		     uint32_t);
368 void		 bwi_set_bssid(struct bwi_softc *, const uint8_t *);
369 void		 bwi_updateslot(struct ieee80211com *);
370 void		 bwi_calibrate(void *);
371 int		 bwi_calc_rssi(struct bwi_softc *,
372 		     const struct bwi_rxbuf_hdr *);
373 uint8_t		 bwi_ack_rate(struct ieee80211_node *, uint8_t);
374 uint16_t	 bwi_txtime(struct ieee80211com *, struct ieee80211_node *,
375 		     uint, uint8_t, uint32_t);
376 enum bwi_modtype
377 		 bwi_rate2modtype(uint8_t);
378 
379 
380 static const uint8_t bwi_sup_macrev[] = { 2, 4, 5, 6, 7, 9, 10 };
381 
382 #define SUP_BPHY(num)	{ .rev = num, .init = bwi_phy_init_11b_rev##num }
383 
384 static const struct {
385 	uint8_t	rev;
386 	void	(*init)(struct bwi_mac *);
387 } bwi_sup_bphy[] = {
388 	SUP_BPHY(2),
389 	SUP_BPHY(4),
390 	SUP_BPHY(5),
391 	SUP_BPHY(6)
392 };
393 
394 #undef SUP_BPHY
395 
396 #define BWI_PHYTBL_WRSSI	0x1000
397 #define BWI_PHYTBL_NOISE_SCALE	0x1400
398 #define BWI_PHYTBL_NOISE	0x1800
399 #define BWI_PHYTBL_ROTOR	0x2000
400 #define BWI_PHYTBL_DELAY	0x2400
401 #define BWI_PHYTBL_RSSI		0x4000
402 #define BWI_PHYTBL_SIGMA_SQ	0x5000
403 #define BWI_PHYTBL_WRSSI_REV1	0x5400
404 #define BWI_PHYTBL_FREQ		0x5800
405 
406 static const uint16_t	bwi_phy_freq_11g_rev1[] =
407 	{ BWI_PHY_FREQ_11G_REV1 };
408 static const uint16_t	bwi_phy_noise_11g_rev1[] =
409 	{ BWI_PHY_NOISE_11G_REV1 };
410 static const uint16_t	bwi_phy_noise_11g[] =
411 	{ BWI_PHY_NOISE_11G };
412 static const uint32_t	bwi_phy_rotor_11g_rev1[] =
413 	{ BWI_PHY_ROTOR_11G_REV1 };
414 static const uint16_t	bwi_phy_noise_scale_11g_rev2[] =
415 	{ BWI_PHY_NOISE_SCALE_11G_REV2 };
416 static const uint16_t	bwi_phy_noise_scale_11g_rev7[] =
417 	{ BWI_PHY_NOISE_SCALE_11G_REV7 };
418 static const uint16_t	bwi_phy_noise_scale_11g[] =
419 	{ BWI_PHY_NOISE_SCALE_11G };
420 static const uint16_t	bwi_phy_sigma_sq_11g_rev2[] =
421 	{ BWI_PHY_SIGMA_SQ_11G_REV2 };
422 static const uint16_t	bwi_phy_sigma_sq_11g_rev7[] =
423 	{ BWI_PHY_SIGMA_SQ_11G_REV7 };
424 static const uint32_t	bwi_phy_delay_11g_rev1[] =
425 	{ BWI_PHY_DELAY_11G_REV1 };
426 
427 /* RF */
428 #define RF_LO_WRITE(mac, lo)	bwi_rf_lo_write((mac), (lo))
429 
430 #define BWI_RF_2GHZ_CHAN(chan) \
431 	(ieee80211_ieee2mhz((chan), IEEE80211_CHAN_2GHZ) - 2400)
432 
433 #define BWI_DEFAULT_IDLE_TSSI	52
434 
435 struct rf_saveregs {
436 	uint16_t	phy_01;
437 	uint16_t	phy_03;
438 	uint16_t	phy_0a;
439 	uint16_t	phy_15;
440 	uint16_t	phy_2a;
441 	uint16_t	phy_30;
442 	uint16_t	phy_35;
443 	uint16_t	phy_60;
444 	uint16_t	phy_429;
445 	uint16_t	phy_802;
446 	uint16_t	phy_811;
447 	uint16_t	phy_812;
448 	uint16_t	phy_814;
449 	uint16_t	phy_815;
450 
451 	uint16_t	rf_43;
452 	uint16_t	rf_52;
453 	uint16_t	rf_7a;
454 };
455 
456 #define SAVE_RF_REG(mac, regs, n)	(regs)->rf_##n = RF_READ((mac), 0x##n)
457 #define RESTORE_RF_REG(mac, regs, n)	RF_WRITE((mac), 0x##n, (regs)->rf_##n)
458 
459 #define SAVE_PHY_REG(mac, regs, n)	(regs)->phy_##n = PHY_READ((mac), 0x##n)
460 #define RESTORE_PHY_REG(mac, regs, n)	PHY_WRITE((mac), 0x##n, (regs)->phy_##n)
461 
462 static const int8_t	bwi_txpower_map_11b[BWI_TSSI_MAX] =
463 	{ BWI_TXPOWER_MAP_11B };
464 static const int8_t	bwi_txpower_map_11g[BWI_TSSI_MAX] =
465 	{ BWI_TXPOWER_MAP_11G };
466 
467 /* IF_BWI */
468 
469 struct bwi_myaddr_bssid {
470 	uint8_t		myaddr[IEEE80211_ADDR_LEN];
471 	uint8_t		bssid[IEEE80211_ADDR_LEN];
472 } __packed;
473 
474 #define IEEE80211_DS_PLCP_SERVICE_LOCKED	0x04
475 #define IEEE80211_DS_PLCL_SERVICE_PBCC		0x08
476 #define IEEE80211_DS_PLCP_SERVICE_LENEXT5	0x20
477 #define IEEE80211_DS_PLCP_SERVICE_LENEXT6	0x40
478 #define IEEE80211_DS_PLCP_SERVICE_LENEXT7	0x80
479 
480 struct cfdriver bwi_cd = {
481 	NULL, "bwi", DV_IFNET
482 };
483 
484 static const struct {
485 	uint16_t	did_min;
486 	uint16_t	did_max;
487 	uint16_t	bbp_id;
488 } bwi_bbpid_map[] = {
489 	{ 0x4301, 0x4301, 0x4301 },
490 	{ 0x4305, 0x4307, 0x4307 },
491 	{ 0x4402, 0x4403, 0x4402 },
492 	{ 0x4610, 0x4615, 0x4610 },
493 	{ 0x4710, 0x4715, 0x4710 },
494 	{ 0x4720, 0x4725, 0x4309 }
495 };
496 
497 static const struct {
498 	uint16_t	bbp_id;
499 	int		nregwin;
500 } bwi_regwin_count[] = {
501 	{ 0x4301, 5 },
502 	{ 0x4306, 6 },
503 	{ 0x4307, 5 },
504 	{ 0x4310, 8 },
505 	{ 0x4401, 3 },
506 	{ 0x4402, 3 },
507 	{ 0x4610, 9 },
508 	{ 0x4704, 9 },
509 	{ 0x4710, 9 },
510 	{ 0x5365, 7 }
511 };
512 
513 #define CLKSRC(src) 				\
514 [BWI_CLKSRC_ ## src] = {			\
515 	.freq_min = BWI_CLKSRC_ ##src## _FMIN,	\
516 	.freq_max = BWI_CLKSRC_ ##src## _FMAX	\
517 }
518 
519 static const struct {
520 	uint	freq_min;
521 	uint	freq_max;
522 } bwi_clkfreq[BWI_CLKSRC_MAX] = {
523 	CLKSRC(LP_OSC),
524 	CLKSRC(CS_OSC),
525 	CLKSRC(PCI)
526 };
527 
528 #undef CLKSRC
529 
530 #define VENDOR_LED_ACT(vendor)				\
531 {							\
532 	.vid = PCI_VENDOR_##vendor,			\
533 	.led_act = { BWI_VENDOR_LED_ACT_##vendor }	\
534 }
535 
536 const struct {
537 	uint16_t	vid;
538 	uint8_t		led_act[BWI_LED_MAX];
539 } bwi_vendor_led_act[] = {
540 	VENDOR_LED_ACT(COMPAQ),
541 	VENDOR_LED_ACT(LINKSYS)
542 };
543 
544 const uint8_t bwi_default_led_act[BWI_LED_MAX] =
545 	{ BWI_VENDOR_LED_ACT_DEFAULT };
546 
547 #undef VENDOR_LED_ACT
548 
549 const struct {
550 	int	on_dur;
551 	int	off_dur;
552 } bwi_led_duration[109] = {
553 	{ 400, 100 }, {   0,   0 }, { 150 ,  75 }, {   0,   0 }, {  90,  45 },
554 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
555 	{   0,   0 }, {  66,  34 }, {  53,   26 }, {   0,   0 }, {   0,   0 },
556 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {  42,  21 }, {   0,   0 },
557 	{   0,   0 }, {   0,   0 }, {  35,   17 }, {   0,   0 }, {  32,  16 },
558 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
559 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
560 	{   0,   0 }, {  21,  10 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
561 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
562 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {  16,   8 }, {   0,   0 },
563 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
564 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
565 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
566 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
567 	{   0,   0 }, {   0,   0 }, {  11,    5 }, {   0,   0 }, {   0,   0 },
568 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
569 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
570 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
571 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
572 	{   0,   0 }, {   9,   4 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
573 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
574 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   7,   3 }
575 };
576 
577 static const uint8_t bwi_zero_addr[IEEE80211_ADDR_LEN];
578 
579 
580 /* CODE */
581 
582 int
583 bwi_intr(void *xsc)
584 {
585 	struct bwi_softc *sc = xsc;
586 	struct bwi_mac *mac;
587 	struct ifnet *ifp = &sc->sc_ic.ic_if;
588 	uint32_t intr_status;
589 	uint32_t txrx_intr_status[BWI_TXRX_NRING];
590 	int i, txrx_error, tx = 0, rx_data = -1;
591 
592 	if ((ifp->if_flags & IFF_RUNNING) == 0)
593 		return (0);
594 
595 	/*
596 	 * Get interrupt status
597 	 */
598 	intr_status = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
599 	if (intr_status == 0xffffffff)	/* Not for us */
600 		return (0);
601 
602 	intr_status &= CSR_READ_4(sc, BWI_MAC_INTR_MASK);
603 	if (intr_status == 0)		/* Nothing is interesting */
604 		return (0);
605 
606 	DPRINTF(2, "%s: intr status 0x%08x\n",
607 	    sc->sc_dev.dv_xname, intr_status);
608 
609 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
610 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
611 
612 	txrx_error = 0;
613 
614 	for (i = 0; i < BWI_TXRX_NRING; ++i) {
615 		uint32_t mask;
616 
617 		if (BWI_TXRX_IS_RX(i))
618 			mask = BWI_TXRX_RX_INTRS;
619 		else
620 			mask = BWI_TXRX_TX_INTRS;
621 
622 		txrx_intr_status[i] =
623 		    CSR_READ_4(sc, BWI_TXRX_INTR_STATUS(i)) & mask;
624 
625 		if (txrx_intr_status[i] & BWI_TXRX_INTR_ERROR) {
626 			printf("%s: intr fatal TX/RX (%d) error 0x%08x\n",
627 			    sc->sc_dev.dv_xname, i, txrx_intr_status[i]);
628 			txrx_error = 1;
629 		}
630 	}
631 
632 	/*
633 	 * Acknowledge interrupt
634 	 */
635 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, intr_status);
636 
637 	for (i = 0; i < BWI_TXRX_NRING; ++i)
638 		CSR_WRITE_4(sc, BWI_TXRX_INTR_STATUS(i), txrx_intr_status[i]);
639 
640 	/* Disable all interrupts */
641 	bwi_disable_intrs(sc, BWI_ALL_INTRS);
642 
643 	if (intr_status & BWI_INTR_PHY_TXERR) {
644 		if (mac->mac_flags & BWI_MAC_F_PHYE_RESET) {
645 			printf("intr PHY TX error\n");
646 			/* XXX to netisr0? */
647 			bwi_init_statechg(sc, 0);
648 			return (0);
649 		}
650 	}
651 
652 	if (txrx_error) {
653 		/* TODO: reset device */
654 	}
655 
656 	if (intr_status & BWI_INTR_TBTT)
657 		bwi_mac_config_ps(mac);
658 
659 	if (intr_status & BWI_INTR_EO_ATIM)
660 		printf("%s: EO_ATIM\n", sc->sc_dev.dv_xname);
661 
662 	if (intr_status & BWI_INTR_PMQ) {
663 		for (;;) {
664 			if ((CSR_READ_4(sc, BWI_MAC_PS_STATUS) & 0x8) == 0)
665 				break;
666 		}
667 		CSR_WRITE_2(sc, BWI_MAC_PS_STATUS, 0x2);
668 	}
669 
670 	if (intr_status & BWI_INTR_NOISE)
671 		printf("%s: intr noise\n", sc->sc_dev.dv_xname);
672 
673 	if (txrx_intr_status[0] & BWI_TXRX_INTR_RX)
674 		rx_data = sc->sc_rxeof(sc);
675 
676 	if (txrx_intr_status[3] & BWI_TXRX_INTR_RX) {
677 		sc->sc_txeof_status(sc);
678 		tx = 1;
679 	}
680 
681 	if (intr_status & BWI_INTR_TX_DONE) {
682 		bwi_txeof(sc);
683 		tx = 1;
684 	}
685 
686 	/* Re-enable interrupts */
687 	bwi_enable_intrs(sc, BWI_INIT_INTRS);
688 
689 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
690 		int evt = BWI_LED_EVENT_NONE;
691 
692 		if (tx && rx_data > 0) {
693 			if (sc->sc_rx_rate > sc->sc_tx_rate)
694 				evt = BWI_LED_EVENT_RX;
695 			else
696 				evt = BWI_LED_EVENT_TX;
697 		} else if (tx) {
698 			evt = BWI_LED_EVENT_TX;
699 		} else if (rx_data > 0) {
700 			evt = BWI_LED_EVENT_RX;
701 		} else if (rx_data == 0) {
702 			evt = BWI_LED_EVENT_POLL;
703 		}
704 
705 		if (evt != BWI_LED_EVENT_NONE)
706 			bwi_led_event(sc, evt);
707 	}
708 
709 	return (1);
710 }
711 
712 int
713 bwi_attach(struct bwi_softc *sc)
714 {
715 	struct ieee80211com *ic = &sc->sc_ic;
716 	struct ifnet *ifp = &ic->ic_if;
717 	struct bwi_mac *mac;
718 	struct bwi_phy *phy;
719 	int i, error;
720 
721 	DPRINTF(1, "\n");
722 
723 	/* Initialize LED vars */
724 	sc->sc_led_idle = (2350 * hz) / 1000;
725 	sc->sc_led_blink = 1;
726 
727 	/* AMRR rate control */
728 	sc->sc_amrr.amrr_min_success_threshold = 1;
729 	sc->sc_amrr.amrr_max_success_threshold = 15;
730 	timeout_set(&sc->sc_amrr_ch, bwi_amrr_timeout, sc);
731 
732 	timeout_set(&sc->sc_scan_ch, bwi_next_scan, sc);
733 	timeout_set(&sc->sc_calib_ch, bwi_calibrate, sc);
734 
735 	bwi_power_on(sc, 1);
736 
737 	error = bwi_bbp_attach(sc);
738 	if (error)
739 		goto fail;
740 
741 	error = bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
742 	if (error)
743 		goto fail;
744 
745 	if (BWI_REGWIN_EXIST(&sc->sc_com_regwin)) {
746 		error = bwi_set_clock_delay(sc);
747 		if (error)
748 			goto fail;
749 
750 		error = bwi_set_clock_mode(sc, BWI_CLOCK_MODE_FAST);
751 		if (error)
752 			goto fail;
753 
754 		error = bwi_get_pwron_delay(sc);
755 		if (error)
756 			goto fail;
757 	}
758 
759 	error = bwi_bus_attach(sc);
760 	if (error)
761 		goto fail;
762 
763 	bwi_get_card_flags(sc);
764 
765 	bwi_led_attach(sc);
766 
767 	for (i = 0; i < sc->sc_nmac; ++i) {
768 		struct bwi_regwin *old;
769 
770 		mac = &sc->sc_mac[i];
771 		error = bwi_regwin_switch(sc, &mac->mac_regwin, &old);
772 		if (error)
773 			goto fail;
774 
775 		error = bwi_mac_lateattach(mac);
776 		if (error)
777 			goto fail;
778 
779 		error = bwi_regwin_switch(sc, old, NULL);
780 		if (error)
781 			goto fail;
782 	}
783 
784 	/*
785 	 * XXX First MAC is known to exist
786 	 * TODO2
787 	 */
788 	mac = &sc->sc_mac[0];
789 	phy = &mac->mac_phy;
790 
791 	bwi_bbp_power_off(sc);
792 
793 	error = bwi_dma_alloc(sc);
794 	if (error)
795 		goto fail;
796 
797 	/* setup interface */
798 	ifp->if_softc = sc;
799 	ifp->if_ioctl = bwi_ioctl;
800 	ifp->if_start = bwi_start;
801 	ifp->if_watchdog = bwi_watchdog;
802 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
803 	strlcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
804 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
805 	IFQ_SET_READY(&ifp->if_snd);
806 
807 	/* Get locale */
808 	sc->sc_locale = __SHIFTOUT(bwi_read_sprom(sc, BWI_SPROM_CARD_INFO),
809 	    BWI_SPROM_CARD_INFO_LOCALE);
810 	DPRINTF(1, "%s: locale: %d\n", sc->sc_dev.dv_xname, sc->sc_locale);
811 
812 	/*
813 	 * Setup ratesets, phytype, channels and get MAC address
814 	 */
815 	if (phy->phy_mode == IEEE80211_MODE_11B ||
816 	    phy->phy_mode == IEEE80211_MODE_11G) {
817 	    	uint16_t chan_flags;
818 
819 		ic->ic_sup_rates[IEEE80211_MODE_11B] =
820 		    ieee80211_std_rateset_11b;
821 
822 		if (phy->phy_mode == IEEE80211_MODE_11B) {
823 			chan_flags = IEEE80211_CHAN_B;
824 			ic->ic_phytype = IEEE80211_T_DS;
825 		} else {
826 			chan_flags = IEEE80211_CHAN_CCK |
827 			    IEEE80211_CHAN_OFDM |
828 			    IEEE80211_CHAN_DYN |
829 			    IEEE80211_CHAN_2GHZ;
830 			ic->ic_phytype = IEEE80211_T_OFDM;
831 			ic->ic_sup_rates[IEEE80211_MODE_11G] =
832 			    ieee80211_std_rateset_11g;
833 		}
834 
835 		/* XXX depend on locale */
836 		for (i = 1; i <= 14; ++i) {
837 			ic->ic_channels[i].ic_freq =
838 				ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
839 			ic->ic_channels[i].ic_flags = chan_flags;
840 		}
841 
842 		bwi_get_eaddr(sc, BWI_SPROM_11BG_EADDR, ic->ic_myaddr);
843 		if (IEEE80211_IS_MULTICAST(ic->ic_myaddr)) {
844 			bwi_get_eaddr(sc, BWI_SPROM_11A_EADDR, ic->ic_myaddr);
845 			if (IEEE80211_IS_MULTICAST(ic->ic_myaddr)) {
846 				printf("%s: invalid MAC address: %s\n",
847 				    sc->sc_dev.dv_xname,
848 				    ether_sprintf(ic->ic_myaddr));
849 			}
850 		}
851 	} else if (phy->phy_mode == IEEE80211_MODE_11A) {
852 		/* TODO: 11A */
853 		error = ENXIO;
854 		goto fail;
855 	} else
856 		panic("unknown phymode %d", phy->phy_mode);
857 
858 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
859 
860 	sc->sc_fw_version = BWI_FW_VERSION3;
861 	sc->sc_dwell_time = 200;
862 
863 	ic->ic_caps = IEEE80211_C_SHSLOT |
864 	    IEEE80211_C_SHPREAMBLE |
865 	    IEEE80211_C_WEP |
866 	    IEEE80211_C_RSN |
867 	    IEEE80211_C_MONITOR;
868 	ic->ic_state = IEEE80211_S_INIT;
869 	ic->ic_opmode = IEEE80211_M_STA;
870 
871 	ic->ic_updateslot = bwi_updateslot;
872 
873 	if_attach(ifp);
874 	ieee80211_ifattach(ifp);
875 
876 	sc->sc_newstate = ic->ic_newstate;
877 	ic->ic_newstate = bwi_newstate;
878 	ic->ic_newassoc = bwi_newassoc;
879 	ic->ic_node_alloc = bwi_node_alloc;
880 
881 	ieee80211_media_init(ifp, bwi_media_change, ieee80211_media_status);
882 
883 	if (error) {
884 		ieee80211_ifdetach(ifp);
885 		goto fail;
886 	}
887 
888 #if NBPFILTER > 0
889 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
890 	    sizeof(struct ieee80211_frame) + 64);
891 
892 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
893 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
894 	sc->sc_rxtap.wr_ihdr.it_present = htole32(BWI_RX_RADIOTAP_PRESENT);
895 
896 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
897 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
898 	sc->sc_txtap.wt_ihdr.it_present = htole32(BWI_TX_RADIOTAP_PRESENT);
899 #endif
900 
901 	return (0);
902 fail:
903 	return (error);
904 }
905 
906 int
907 bwi_detach(void *arg)
908 {
909 	struct bwi_softc *sc = arg;
910 	struct ifnet *ifp = &sc->sc_ic.ic_if;
911 	int i;
912 
913 	bwi_stop(sc, 1);
914 	ieee80211_ifdetach(ifp);
915 	if_detach(ifp);
916 
917 	for (i = 0; i < sc->sc_nmac; ++i)
918 		bwi_mac_detach(&sc->sc_mac[i]);
919 
920 	bwi_dma_free(sc);
921 
922 	return (0);
923 }
924 
925 /* MAC */
926 
927 void
928 bwi_tmplt_write_4(struct bwi_mac *mac, uint32_t ofs, uint32_t val)
929 {
930 	struct bwi_softc *sc = mac->mac_sc;
931 
932 	if (mac->mac_flags & BWI_MAC_F_BSWAP)
933 		val = swap32(val);
934 
935 	CSR_WRITE_4(sc, BWI_MAC_TMPLT_CTRL, ofs);
936 	CSR_WRITE_4(sc, BWI_MAC_TMPLT_DATA, val);
937 }
938 
939 void
940 bwi_hostflags_write(struct bwi_mac *mac, uint64_t flags)
941 {
942 	uint64_t val;
943 
944 	val = flags & 0xffff;
945 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO, val);
946 
947 	val = (flags >> 16) & 0xffff;
948 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI, val);
949 
950 	/* HI has unclear meaning, so leave it as it is */
951 }
952 
953 uint64_t
954 bwi_hostflags_read(struct bwi_mac *mac)
955 {
956 	uint64_t flags, val;
957 
958 	/* HI has unclear meaning, so don't touch it */
959 	flags = 0;
960 
961 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI);
962 	flags |= val << 16;
963 
964 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO);
965 	flags |= val;
966 
967 	return (flags);
968 }
969 
970 uint16_t
971 bwi_memobj_read_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
972 {
973 	struct bwi_softc *sc = mac->mac_sc;
974 	uint32_t data_reg;
975 	int ofs;
976 
977 	data_reg = BWI_MOBJ_DATA;
978 	ofs = ofs0 / 4;
979 
980 	if (ofs0 % 4 != 0)
981 		data_reg = BWI_MOBJ_DATA_UNALIGN;
982 
983 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
984 	return (CSR_READ_2(sc, data_reg));
985 }
986 
987 uint32_t
988 bwi_memobj_read_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
989 {
990 	struct bwi_softc *sc = mac->mac_sc;
991 	int ofs;
992 
993 	ofs = ofs0 / 4;
994 	if (ofs0 % 4 != 0) {
995 		uint32_t ret;
996 
997 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
998 		ret = CSR_READ_2(sc, BWI_MOBJ_DATA_UNALIGN);
999 		ret <<= 16;
1000 
1001 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1002 		    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
1003 		ret |= CSR_READ_2(sc, BWI_MOBJ_DATA);
1004 
1005 		return (ret);
1006 	} else {
1007 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1008 		return (CSR_READ_4(sc, BWI_MOBJ_DATA));
1009 	}
1010 }
1011 
1012 void
1013 bwi_memobj_write_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
1014     uint16_t v)
1015 {
1016 	struct bwi_softc *sc = mac->mac_sc;
1017 	uint32_t data_reg;
1018 	int ofs;
1019 
1020 	data_reg = BWI_MOBJ_DATA;
1021 	ofs = ofs0 / 4;
1022 
1023 	if (ofs0 % 4 != 0)
1024 		data_reg = BWI_MOBJ_DATA_UNALIGN;
1025 
1026 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1027 	CSR_WRITE_2(sc, data_reg, v);
1028 }
1029 
1030 void
1031 bwi_memobj_write_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
1032     uint32_t v)
1033 {
1034 	struct bwi_softc *sc = mac->mac_sc;
1035 	int ofs;
1036 
1037 	ofs = ofs0 / 4;
1038 	if (ofs0 % 4 != 0) {
1039 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1040 		CSR_WRITE_2(sc, BWI_MOBJ_DATA_UNALIGN, v >> 16);
1041 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1042 		    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
1043 		CSR_WRITE_2(sc, BWI_MOBJ_DATA, v & 0xffff);
1044 	} else {
1045 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1046 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, v);
1047 	}
1048 }
1049 
1050 int
1051 bwi_mac_lateattach(struct bwi_mac *mac)
1052 {
1053 	int error;
1054 
1055 	if (mac->mac_rev >= 5)
1056 		CSR_READ_4(mac->mac_sc, BWI_STATE_HI); /* dummy read */
1057 
1058 	bwi_mac_reset(mac, 1);
1059 
1060 	error = bwi_phy_attach(mac);
1061 	if (error)
1062 		return (error);
1063 
1064 	error = bwi_rf_attach(mac);
1065 	if (error)
1066 		return (error);
1067 
1068 	/* Link 11B/G PHY, unlink 11A PHY */
1069 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A)
1070 		bwi_mac_reset(mac, 0);
1071 	else
1072 		bwi_mac_reset(mac, 1);
1073 
1074 	error = bwi_mac_test(mac);
1075 	if (error)
1076 		return (error);
1077 
1078 	error = bwi_mac_get_property(mac);
1079 	if (error)
1080 		return (error);
1081 
1082 	error = bwi_rf_map_txpower(mac);
1083 	if (error)
1084 		return (error);
1085 
1086 	bwi_rf_off(mac);
1087 	CSR_WRITE_2(mac->mac_sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
1088 	bwi_regwin_disable(mac->mac_sc, &mac->mac_regwin, 0);
1089 
1090 	return (0);
1091 }
1092 
1093 int
1094 bwi_mac_init(struct bwi_mac *mac)
1095 {
1096 	struct bwi_softc *sc = mac->mac_sc;
1097 	int error, i;
1098 
1099 	/* Clear MAC/PHY/RF states */
1100 	bwi_mac_setup_tpctl(mac);
1101 	bwi_rf_clear_state(&mac->mac_rf);
1102 	bwi_phy_clear_state(&mac->mac_phy);
1103 
1104 	/* Enable MAC and linked it to PHY */
1105 	if (!bwi_regwin_is_enabled(sc, &mac->mac_regwin))
1106 		bwi_mac_reset(mac, 1);
1107 
1108 	/* Initialize backplane */
1109 	error = bwi_bus_init(sc, mac);
1110 	if (error)
1111 		return (error);
1112 
1113 	/* XXX work around for hardware bugs? */
1114 	if (sc->sc_bus_regwin.rw_rev <= 5 &&
1115 	    sc->sc_bus_regwin.rw_type != BWI_REGWIN_T_BUSPCIE) {
1116 		CSR_SETBITS_4(sc, BWI_CONF_LO,
1117 		__SHIFTIN(BWI_CONF_LO_SERVTO, BWI_CONF_LO_SERVTO_MASK) |
1118 		__SHIFTIN(BWI_CONF_LO_REQTO, BWI_CONF_LO_REQTO_MASK));
1119 	}
1120 
1121 	/* Calibrate PHY */
1122 	error = bwi_phy_calibrate(mac);
1123 	if (error) {
1124 		printf("%s: PHY calibrate failed\n", sc->sc_dev.dv_xname);
1125 		return (error);
1126 	}
1127 
1128 	/* Prepare to initialize firmware */
1129 	CSR_WRITE_4(sc, BWI_MAC_STATUS,
1130 	    BWI_MAC_STATUS_UCODE_JUMP0 |
1131 	    BWI_MAC_STATUS_IHREN);
1132 
1133 	/*
1134 	 * Load and initialize firmwares
1135 	 */
1136 	error = bwi_mac_fw_alloc(mac);
1137 	if (error)
1138 		return (error);
1139 
1140 	error = bwi_mac_fw_load(mac);
1141 	if (error)
1142 		return (error);
1143 
1144 	error = bwi_mac_gpio_init(mac);
1145 	if (error)
1146 		return (error);
1147 
1148 	error = bwi_mac_fw_init(mac);
1149 	if (error)
1150 		return (error);
1151 
1152 	/*
1153 	 * Turn on RF
1154 	 */
1155 	bwi_rf_on(mac);
1156 
1157 	/* TODO: LED, hardware rf enabled is only related to LED setting */
1158 
1159 	/*
1160 	 * Initialize PHY
1161 	 */
1162 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
1163 	bwi_phy_init(mac);
1164 
1165 	/* TODO: interference mitigation */
1166 
1167 	/*
1168 	 * Setup antenna mode
1169 	 */
1170 	bwi_rf_set_ant_mode(mac, mac->mac_rf.rf_ant_mode);
1171 
1172 	/*
1173 	 * Initialize operation mode (RX configuration)
1174 	 */
1175 	bwi_mac_opmode_init(mac);
1176 
1177 	/* XXX what's these */
1178 	if (mac->mac_rev < 3) {
1179 		CSR_WRITE_2(sc, 0x60e, 0);
1180 		CSR_WRITE_2(sc, 0x610, 0x8000);
1181 		CSR_WRITE_2(sc, 0x604, 0);
1182 		CSR_WRITE_2(sc, 0x606, 0x200);
1183 	} else {
1184 		CSR_WRITE_4(sc, 0x188, 0x80000000);
1185 		CSR_WRITE_4(sc, 0x18c, 0x2000000);
1186 	}
1187 
1188 	/*
1189 	 * Initialize TX/RX interrupts' mask
1190 	 */
1191 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_TIMER1);
1192 	for (i = 0; i < BWI_TXRX_NRING; ++i) {
1193 		uint32_t intrs;
1194 
1195 		if (BWI_TXRX_IS_RX(i))
1196 			intrs = BWI_TXRX_RX_INTRS;
1197 		else
1198 			intrs = BWI_TXRX_TX_INTRS;
1199 		CSR_WRITE_4(sc, BWI_TXRX_INTR_MASK(i), intrs);
1200 	}
1201 
1202 	/* XXX what's this */
1203 	CSR_SETBITS_4(sc, BWI_STATE_LO, 0x100000);
1204 
1205 	/* Setup MAC power up delay */
1206 	CSR_WRITE_2(sc, BWI_MAC_POWERUP_DELAY, sc->sc_pwron_delay);
1207 
1208 	/* Set MAC regwin revision */
1209 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_MACREV, mac->mac_rev);
1210 
1211 	/*
1212 	 * Initialize host flags
1213 	 */
1214 	bwi_mac_hostflags_init(mac);
1215 
1216 	/*
1217 	 * Initialize BSS parameters
1218 	 */
1219 	bwi_mac_bss_param_init(mac);
1220 
1221 	/*
1222 	 * Initialize TX rings
1223 	 */
1224 	for (i = 0; i < BWI_TX_NRING; ++i) {
1225 		error = sc->sc_init_tx_ring(sc, i);
1226 		if (error) {
1227 			printf("%s: can't initialize %dth TX ring\n",
1228 			    sc->sc_dev.dv_xname, i);
1229 			return (error);
1230 		}
1231 	}
1232 
1233 	/*
1234 	 * Initialize RX ring
1235 	 */
1236 	error = sc->sc_init_rx_ring(sc);
1237 	if (error) {
1238 		printf("%s: can't initialize RX ring\n", sc->sc_dev.dv_xname);
1239 		return (error);
1240 	}
1241 
1242 	/*
1243 	 * Initialize TX stats if the current MAC uses that
1244 	 */
1245 	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS) {
1246 		error = sc->sc_init_txstats(sc);
1247 		if (error) {
1248 			printf("%s: can't initialize TX stats ring\n",
1249 			    sc->sc_dev.dv_xname);
1250 			return (error);
1251 		}
1252 	}
1253 
1254 	/* XXX what's these */
1255 	CSR_WRITE_2(sc, 0x612, 0x50);	/* Force Pre-TBTT to 80? */
1256 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x416, 0x50);
1257 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x414, 0x1f4);
1258 
1259 	mac->mac_flags |= BWI_MAC_F_INITED;
1260 
1261 	return (0);
1262 }
1263 
1264 void
1265 bwi_mac_reset(struct bwi_mac *mac, int link_phy)
1266 {
1267 	struct bwi_softc *sc = mac->mac_sc;
1268 	uint32_t flags, state_lo, status;
1269 
1270 	flags = BWI_STATE_LO_FLAG_PHYRST | BWI_STATE_LO_FLAG_PHYCLKEN;
1271 	if (link_phy)
1272 		flags |= BWI_STATE_LO_FLAG_PHYLNK;
1273 	bwi_regwin_enable(sc, &mac->mac_regwin, flags);
1274 	DELAY(2000);
1275 
1276 	state_lo = CSR_READ_4(sc, BWI_STATE_LO);
1277 	state_lo |= BWI_STATE_LO_GATED_CLOCK;
1278 	state_lo &= ~__SHIFTIN(BWI_STATE_LO_FLAG_PHYRST,
1279 			       BWI_STATE_LO_FLAGS_MASK);
1280 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
1281 	/* Flush pending bus write */
1282 	CSR_READ_4(sc, BWI_STATE_LO);
1283 	DELAY(1000);
1284 
1285 	state_lo &= ~BWI_STATE_LO_GATED_CLOCK;
1286 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
1287 	/* Flush pending bus write */
1288 	CSR_READ_4(sc, BWI_STATE_LO);
1289 	DELAY(1000);
1290 
1291 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
1292 
1293 	status = CSR_READ_4(sc, BWI_MAC_STATUS);
1294 	status |= BWI_MAC_STATUS_IHREN;
1295 	if (link_phy)
1296 		status |= BWI_MAC_STATUS_PHYLNK;
1297 	else
1298 		status &= ~BWI_MAC_STATUS_PHYLNK;
1299 	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
1300 
1301 	if (link_phy) {
1302 		DPRINTF(1, "%s: PHY is linked\n", sc->sc_dev.dv_xname);
1303 		mac->mac_phy.phy_flags |= BWI_PHY_F_LINKED;
1304 	} else {
1305 		DPRINTF(1, "%s: PHY is unlinked\n", sc->sc_dev.dv_xname);
1306 		mac->mac_phy.phy_flags &= ~BWI_PHY_F_LINKED;
1307 	}
1308 }
1309 
1310 void
1311 bwi_mac_set_tpctl_11bg(struct bwi_mac *mac, const struct bwi_tpctl *new_tpctl)
1312 {
1313 	struct bwi_rf *rf = &mac->mac_rf;
1314 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1315 
1316 	if (new_tpctl != NULL) {
1317 		KASSERT(new_tpctl->bbp_atten <= BWI_BBP_ATTEN_MAX);
1318 		KASSERT(new_tpctl->rf_atten <=
1319 		    (rf->rf_rev < 6 ? BWI_RF_ATTEN_MAX0
1320 		    : BWI_RF_ATTEN_MAX1));
1321 		KASSERT(new_tpctl->tp_ctrl1 <= BWI_TPCTL1_MAX);
1322 
1323 		tpctl->bbp_atten = new_tpctl->bbp_atten;
1324 		tpctl->rf_atten = new_tpctl->rf_atten;
1325 		tpctl->tp_ctrl1 = new_tpctl->tp_ctrl1;
1326 	}
1327 
1328 	/* Set BBP attenuation */
1329 	bwi_phy_set_bbp_atten(mac, tpctl->bbp_atten);
1330 
1331 	/* Set RF attenuation */
1332 	RF_WRITE(mac, BWI_RFR_ATTEN, tpctl->rf_atten);
1333 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_ATTEN,
1334 	    tpctl->rf_atten);
1335 
1336 	/* Set TX power */
1337 	if (rf->rf_type == BWI_RF_T_BCM2050) {
1338 		RF_FILT_SETBITS(mac, BWI_RFR_TXPWR, ~BWI_RFR_TXPWR1_MASK,
1339 		    __SHIFTIN(tpctl->tp_ctrl1, BWI_RFR_TXPWR1_MASK));
1340 	}
1341 
1342 	/* Adjust RF Local Oscillator */
1343 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11G)
1344 		bwi_rf_lo_adjust(mac, tpctl);
1345 }
1346 
1347 int
1348 bwi_mac_test(struct bwi_mac *mac)
1349 {
1350 	struct bwi_softc *sc = mac->mac_sc;
1351 	uint32_t orig_val, val;
1352 
1353 #define TEST_VAL1	0xaa5555aa
1354 #define TEST_VAL2	0x55aaaa55
1355 	/* Save it for later restoring */
1356 	orig_val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1357 
1358 	/* Test 1 */
1359 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL1);
1360 	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1361 	if (val != TEST_VAL1) {
1362 		printf("%s: TEST1 failed\n", sc->sc_dev.dv_xname);
1363 		return (ENXIO);
1364 	}
1365 
1366 	/* Test 2 */
1367 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL2);
1368 	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1369 	if (val != TEST_VAL2) {
1370 		printf("%s: TEST2 failed\n", sc->sc_dev.dv_xname);
1371 		return (ENXIO);
1372 	}
1373 
1374 	/* Restore to the original value */
1375 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, orig_val);
1376 
1377 	val = CSR_READ_4(sc, BWI_MAC_STATUS);
1378 	if ((val & ~BWI_MAC_STATUS_PHYLNK) != BWI_MAC_STATUS_IHREN) {
1379 		printf("%s: %s failed, MAC status 0x%08x\n",
1380 		    sc->sc_dev.dv_xname, __func__, val);
1381 		return (ENXIO);
1382 	}
1383 
1384 	val = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1385 	if (val != 0) {
1386 		printf("%s: %s failed, intr status %08x\n",
1387 		    sc->sc_dev.dv_xname, __func__, val);
1388 		return (ENXIO);
1389 	}
1390 #undef TEST_VAL2
1391 #undef TEST_VAL1
1392 
1393 	return (0);
1394 }
1395 
1396 void
1397 bwi_mac_setup_tpctl(struct bwi_mac *mac)
1398 {
1399 	struct bwi_softc *sc = mac->mac_sc;
1400 	struct bwi_rf *rf = &mac->mac_rf;
1401 	struct bwi_phy *phy = &mac->mac_phy;
1402 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1403 
1404 	/* Calc BBP attenuation */
1405 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev < 6)
1406 		tpctl->bbp_atten = 0;
1407 	else
1408 		tpctl->bbp_atten = 2;
1409 
1410 	/* Calc TX power CTRL1?? */
1411 	tpctl->tp_ctrl1 = 0;
1412 	if (rf->rf_type == BWI_RF_T_BCM2050) {
1413 		if (rf->rf_rev == 1)
1414 			tpctl->tp_ctrl1 = 3;
1415 		else if (rf->rf_rev < 6)
1416 			tpctl->tp_ctrl1 = 2;
1417 		else if (rf->rf_rev == 8)
1418 			tpctl->tp_ctrl1 = 1;
1419 	}
1420 
1421 	/* Empty TX power CTRL2?? */
1422 	tpctl->tp_ctrl2 = 0xffff;
1423 
1424 	/*
1425 	 * Calc RF attenuation
1426 	 */
1427 	if (phy->phy_mode == IEEE80211_MODE_11A) {
1428 		tpctl->rf_atten = 0x60;
1429 		goto back;
1430 	}
1431 
1432 	if (BWI_IS_BRCM_BCM4309G(sc) && sc->sc_pci_revid < 0x51) {
1433 		tpctl->rf_atten = sc->sc_pci_revid < 0x43 ? 2 : 3;
1434 		goto back;
1435 	}
1436 
1437 	tpctl->rf_atten = 5;
1438 
1439 	if (rf->rf_type != BWI_RF_T_BCM2050) {
1440 		if (rf->rf_type == BWI_RF_T_BCM2053 && rf->rf_rev == 1)
1441 			tpctl->rf_atten = 6;
1442 		goto back;
1443 	}
1444 
1445 	/*
1446 	 * NB: If we reaches here and the card is BRCM_BCM4309G,
1447 	 *     then the card's PCI revision must >= 0x51
1448 	 */
1449 
1450 	/* BCM2050 RF */
1451 	switch (rf->rf_rev) {
1452 	case 1:
1453 		if (phy->phy_mode == IEEE80211_MODE_11G) {
1454 			if (BWI_IS_BRCM_BCM4309G(sc) || BWI_IS_BRCM_BU4306(sc))
1455 				tpctl->rf_atten = 3;
1456 			else
1457 				tpctl->rf_atten = 1;
1458 		} else {
1459 			if (BWI_IS_BRCM_BCM4309G(sc))
1460 				tpctl->rf_atten = 7;
1461 			else
1462 				tpctl->rf_atten = 6;
1463 		}
1464 		break;
1465 	case 2:
1466 		if (phy->phy_mode == IEEE80211_MODE_11G) {
1467 			/*
1468 			 * NOTE: Order of following conditions is critical
1469 			 */
1470 			if (BWI_IS_BRCM_BCM4309G(sc))
1471 				tpctl->rf_atten = 3;
1472 			else if (BWI_IS_BRCM_BU4306(sc))
1473 				tpctl->rf_atten = 5;
1474 			else if (sc->sc_bbp_id == BWI_BBPID_BCM4320)
1475 				tpctl->rf_atten = 4;
1476 			else
1477 				tpctl->rf_atten = 3;
1478 		} else {
1479 			tpctl->rf_atten = 6;
1480 		}
1481 		break;
1482 	case 4:
1483 	case 5:
1484 		tpctl->rf_atten = 1;
1485 		break;
1486 	case 8:
1487 		tpctl->rf_atten = 0x1a;
1488 		break;
1489 	}
1490 back:
1491 	DPRINTF(1, "%s: bbp atten: %u, rf atten: %u, ctrl1: %u, ctrl2: %u\n",
1492 	    sc->sc_dev.dv_xname, tpctl->bbp_atten, tpctl->rf_atten,
1493 	    tpctl->tp_ctrl1, tpctl->tp_ctrl2);
1494 }
1495 
1496 void
1497 bwi_mac_dummy_xmit(struct bwi_mac *mac)
1498 {
1499 #define PACKET_LEN	5
1500 	struct bwi_softc *sc = mac->mac_sc;
1501 	struct bwi_rf *rf = &mac->mac_rf;
1502 	const uint32_t *packet;
1503 	uint16_t val_50c;
1504 	int wait_max, i;
1505 
1506 	static const uint32_t	packet_11a[PACKET_LEN] =
1507 	    { 0x000201cc, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
1508 	static const uint32_t	packet_11bg[PACKET_LEN] =
1509 	    { 0x000b846e, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
1510 
1511 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
1512 		wait_max = 30;
1513 		packet = packet_11a;
1514 		val_50c = 1;
1515 	} else {
1516 		wait_max = 250;
1517 		packet = packet_11bg;
1518 		val_50c = 0;
1519 	}
1520 
1521 	for (i = 0; i < PACKET_LEN; ++i)
1522 		TMPLT_WRITE_4(mac, i * 4, packet[i]);
1523 
1524 	CSR_READ_4(sc, BWI_MAC_STATUS);	/* dummy read */
1525 
1526 	CSR_WRITE_2(sc, 0x568, 0);
1527 	CSR_WRITE_2(sc, 0x7c0, 0);
1528 	CSR_WRITE_2(sc, 0x50c, val_50c);
1529 	CSR_WRITE_2(sc, 0x508, 0);
1530 	CSR_WRITE_2(sc, 0x50a, 0);
1531 	CSR_WRITE_2(sc, 0x54c, 0);
1532 	CSR_WRITE_2(sc, 0x56a, 0x14);
1533 	CSR_WRITE_2(sc, 0x568, 0x826);
1534 	CSR_WRITE_2(sc, 0x500, 0);
1535 	CSR_WRITE_2(sc, 0x502, 0x30);
1536 
1537 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
1538 		RF_WRITE(mac, 0x51, 0x17);
1539 
1540 	for (i = 0; i < wait_max; ++i) {
1541 		if (CSR_READ_2(sc, 0x50e) & 0x80)
1542 			break;
1543 		DELAY(10);
1544 	}
1545 	for (i = 0; i < 10; ++i) {
1546 		if (CSR_READ_2(sc, 0x50e) & 0x400)
1547 			break;
1548 		DELAY(10);
1549 	}
1550 	for (i = 0; i < 10; ++i) {
1551 		if ((CSR_READ_2(sc, 0x690) & 0x100) == 0)
1552 			break;
1553 		DELAY(10);
1554 	}
1555 
1556 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
1557 		RF_WRITE(mac, 0x51, 0x37);
1558 #undef PACKET_LEN
1559 }
1560 
1561 void
1562 bwi_mac_init_tpctl_11bg(struct bwi_mac *mac)
1563 {
1564 	struct bwi_softc *sc = mac->mac_sc;
1565 	struct bwi_phy *phy = &mac->mac_phy;
1566 	struct bwi_rf *rf = &mac->mac_rf;
1567 	struct bwi_tpctl tpctl_orig;
1568 	int restore_tpctl = 0;
1569 
1570 	KASSERT(phy->phy_mode != IEEE80211_MODE_11A);
1571 
1572 	if (BWI_IS_BRCM_BU4306(sc))
1573 		return;
1574 
1575 	PHY_WRITE(mac, 0x28, 0x8018);
1576 	CSR_CLRBITS_2(sc, BWI_BBP_ATTEN, 0x20);
1577 
1578 	if (phy->phy_mode == IEEE80211_MODE_11G) {
1579 		if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
1580 			return;
1581 		PHY_WRITE(mac, 0x47a, 0xc111);
1582 	}
1583 	if (mac->mac_flags & BWI_MAC_F_TPCTL_INITED)
1584 		return;
1585 
1586 	if (phy->phy_mode == IEEE80211_MODE_11B && phy->phy_rev >= 2 &&
1587 	    rf->rf_type == BWI_RF_T_BCM2050) {
1588 		RF_SETBITS(mac, 0x76, 0x84);
1589 	} else {
1590 		struct bwi_tpctl tpctl;
1591 
1592 		/* Backup original TX power control variables */
1593 		bcopy(&mac->mac_tpctl, &tpctl_orig, sizeof(tpctl_orig));
1594 		restore_tpctl = 1;
1595 
1596 		bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
1597 		tpctl.bbp_atten = 11;
1598 		tpctl.tp_ctrl1 = 0;
1599 #ifdef notyet
1600 		if (rf->rf_rev >= 6 && rf->rf_rev <= 8)
1601 			tpctl.rf_atten = 31;
1602 		else
1603 #endif
1604 			tpctl.rf_atten = 9;
1605 
1606 		bwi_mac_set_tpctl_11bg(mac, &tpctl);
1607 	}
1608 
1609 	bwi_mac_dummy_xmit(mac);
1610 
1611 	mac->mac_flags |= BWI_MAC_F_TPCTL_INITED;
1612 	rf->rf_base_tssi = PHY_READ(mac, 0x29);
1613 	DPRINTF(1, "%s: base tssi %d\n", sc->sc_dev.dv_xname, rf->rf_base_tssi);
1614 
1615 	if (abs(rf->rf_base_tssi - rf->rf_idle_tssi) >= 20) {
1616 		printf("%s: base tssi measure failed\n", sc->sc_dev.dv_xname);
1617 		mac->mac_flags |= BWI_MAC_F_TPCTL_ERROR;
1618 	}
1619 
1620 	if (restore_tpctl)
1621 		bwi_mac_set_tpctl_11bg(mac, &tpctl_orig);
1622 	else
1623 		RF_CLRBITS(mac, 0x76, 0x84);
1624 
1625 	bwi_rf_clear_tssi(mac);
1626 }
1627 
1628 void
1629 bwi_mac_detach(struct bwi_mac *mac)
1630 {
1631 	bwi_mac_fw_free(mac);
1632 }
1633 
1634 int
1635 bwi_get_firmware(const char *name, const uint8_t *ucode, size_t size_ucode,
1636     size_t *size, size_t *offset)
1637 {
1638 	int i, nfiles, off = 0, ret = 1;
1639 	struct fwheader *h;
1640 
1641 	if ((h = malloc(sizeof(struct fwheader), M_DEVBUF, M_NOWAIT)) == NULL)
1642 		return (ret);
1643 
1644 	/* get number of firmware files */
1645 	bcopy(ucode, &nfiles, sizeof(nfiles));
1646 	nfiles = ntohl(nfiles);
1647 	off += sizeof(nfiles);
1648 
1649 	/* parse header and search the firmware */
1650 	for (i = 0; i < nfiles && off < size_ucode; i++) {
1651 		bzero(h, sizeof(struct fwheader));
1652 		bcopy(ucode + off, h, sizeof(struct fwheader));
1653 		off += sizeof(struct fwheader);
1654 
1655 		if (strcmp(name, h->filename) == 0) {
1656 			ret = 0;
1657 			*size = ntohl(h->filesize);
1658 			*offset = ntohl(h->fileoffset);
1659 			break;
1660 		}
1661 	}
1662 
1663 	free(h, M_DEVBUF, 0);
1664 
1665 	return (ret);
1666 }
1667 
1668 int
1669 bwi_fwimage_is_valid(struct bwi_softc *sc, uint8_t *fw, size_t fw_len,
1670     char *fw_name, uint8_t fw_type)
1671 {
1672 	const struct bwi_fwhdr *hdr;
1673 
1674 	if (fw_len < sizeof(*hdr)) {
1675 		printf("%s: invalid firmware (%s): invalid size %zu\n",
1676 		    sc->sc_dev.dv_xname, fw_name, fw_len);
1677 		return (1);
1678 	}
1679 
1680 	hdr = (const struct bwi_fwhdr *)fw;
1681 
1682 	if (fw_type != BWI_FW_T_IV) {
1683 		/*
1684 		 * Don't verify IV's size, it has different meaning
1685 		 */
1686 		if (betoh32(hdr->fw_size) != fw_len - sizeof(*hdr)) {
1687 			printf("%s: invalid firmware (%s): size mismatch, "
1688 			    "fw %u, real %zu\n",
1689 			    sc->sc_dev.dv_xname,
1690 			    fw_name,
1691 			    betoh32(hdr->fw_size),
1692 			    fw_len - sizeof(*hdr));
1693 			return (1);
1694 		}
1695 	}
1696 
1697 	if (hdr->fw_type != fw_type) {
1698 		printf("%s: invalid firmware (%s): type mismatch, "
1699 		    "fw \'%c\', target \'%c\'\n",
1700 		    sc->sc_dev.dv_xname, fw_name, hdr->fw_type, fw_type);
1701 		return (1);
1702 	}
1703 
1704 	if (hdr->fw_gen != BWI_FW_GEN_1) {
1705 		printf("%s: invalid firmware (%s): wrong generation, "
1706 		    "fw %d, target %d\n",
1707 		    sc->sc_dev.dv_xname, fw_name, hdr->fw_gen, BWI_FW_GEN_1);
1708 		return (1);
1709 	}
1710 
1711 	return (0);
1712 }
1713 
1714 int
1715 bwi_mac_fw_alloc(struct bwi_mac *mac)
1716 {
1717 	struct bwi_softc *sc = mac->mac_sc;
1718 	char *name = "bwi-airforce";
1719 	size_t offset;
1720 	char fwname[64];
1721 	int idx, error;
1722 
1723 	error = loadfirmware(name, &mac->mac_fw, &mac->mac_fw_size);
1724 	if (error != 0) {
1725 		printf("%s: error %d, could not read firmware %s\n",
1726 		    sc->sc_dev.dv_xname, error, name);
1727 		return (EIO);
1728 	}
1729 
1730 	if (mac->mac_ucode == NULL) {
1731 		snprintf(fwname, sizeof(fwname), "ucode%d.fw",
1732 		    mac->mac_rev >= 5 ? 5 : mac->mac_rev);
1733 
1734 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1735 		    &mac->mac_ucode_size, &offset);
1736 		if (error != 0) {
1737 			printf("%s: error %d, could not read firmware %s!\n",
1738 			    sc->sc_dev.dv_xname, error, fwname);
1739 			return (ENOMEM);
1740 		}
1741 		mac->mac_ucode = (mac->mac_fw + offset);
1742 		DPRINTF(1, "%s: loaded firmware file %s\n",
1743 		    sc->sc_dev.dv_xname, fwname);
1744 
1745 		if (bwi_fwimage_is_valid(sc, mac->mac_ucode,
1746 		    mac->mac_ucode_size, fwname, BWI_FW_T_UCODE))
1747 			return (EINVAL);
1748 	}
1749 
1750 	if (mac->mac_pcm == NULL) {
1751 		snprintf(fwname, sizeof(fwname), "pcm%d.fw",
1752 		    mac->mac_rev < 5 ? 4 : 5);
1753 
1754 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1755 		    &mac->mac_pcm_size, &offset);
1756 		if (error != 0) {
1757 			printf("%s: error %d, could not read firmware %s!\n",
1758 			    sc->sc_dev.dv_xname, error, fwname);
1759 			return (ENOMEM);
1760 		}
1761 		mac->mac_pcm = (mac->mac_fw + offset);
1762 		DPRINTF(1, "%s: loaded firmware file %s\n",
1763 		    sc->sc_dev.dv_xname, fwname);
1764 
1765 		if (bwi_fwimage_is_valid(sc, mac->mac_pcm,
1766 		    mac->mac_pcm_size, fwname, BWI_FW_T_PCM))
1767 			return (EINVAL);
1768 	}
1769 
1770 	if (mac->mac_iv == NULL) {
1771 		/* TODO: 11A */
1772 		if (mac->mac_rev == 2 || mac->mac_rev == 4) {
1773 			idx = 2;
1774 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
1775 			idx = 5;
1776 		} else {
1777 			printf("%s: no suitable IV for MAC rev %d\n",
1778 			    sc->sc_dev.dv_xname, mac->mac_rev);
1779 			return (ENODEV);
1780 		}
1781 
1782 		snprintf(fwname, sizeof(fwname), "b0g0initvals%d.fw", idx);
1783 
1784 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1785 		    &mac->mac_iv_size, &offset);
1786 		if (error != 0) {
1787 			printf("%s: error %d, could not read firmware %s!\n",
1788 			    sc->sc_dev.dv_xname, error, fwname);
1789 			return (ENOMEM);
1790 		}
1791 		mac->mac_iv = (mac->mac_fw + offset);
1792 		DPRINTF(1, "%s: loaded firmware file %s\n",
1793 		    sc->sc_dev.dv_xname, fwname);
1794 
1795 		if (bwi_fwimage_is_valid(sc, mac->mac_iv,
1796 		    mac->mac_iv_size, fwname, BWI_FW_T_IV))
1797 			return (EINVAL);
1798 	}
1799 
1800 	if (mac->mac_iv_ext == NULL) {
1801 		/* TODO: 11A */
1802 		if (mac->mac_rev == 2 || mac->mac_rev == 4 ||
1803 		    mac->mac_rev >= 11) {
1804 			/* No extended IV */
1805 			goto back;
1806 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
1807 			idx = 5;
1808 		} else {
1809 			printf("%s: no suitable ExtIV for MAC rev %d\n",
1810 			    sc->sc_dev.dv_xname, mac->mac_rev);
1811 			return (ENODEV);
1812 		}
1813 
1814 		snprintf(fwname, sizeof(fwname), "b0g0bsinitvals%d.fw", idx);
1815 
1816 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1817 		    &mac->mac_iv_ext_size, &offset);
1818 		if (error != 0) {
1819 			printf("%s: error %d, could not read firmware %s!\n",
1820 			    sc->sc_dev.dv_xname, error, fwname);
1821 			return (ENOMEM);
1822 		}
1823 		mac->mac_iv_ext = (mac->mac_fw + offset);
1824 		DPRINTF(1, "%s: loaded firmware file %s\n",
1825 		    sc->sc_dev.dv_xname, fwname);
1826 
1827 		if (bwi_fwimage_is_valid(sc, mac->mac_iv_ext,
1828 		    mac->mac_iv_ext_size, fwname, BWI_FW_T_IV))
1829 			return (EINVAL);
1830 	}
1831 
1832 back:
1833 	return (0);
1834 }
1835 
1836 void
1837 bwi_mac_fw_free(struct bwi_mac *mac)
1838 {
1839 	if (mac->mac_fw != NULL) {
1840 		free(mac->mac_fw, M_DEVBUF, 0);
1841 		mac->mac_fw = NULL;
1842 	}
1843 }
1844 
1845 int
1846 bwi_mac_fw_load(struct bwi_mac *mac)
1847 {
1848 	struct bwi_softc *sc = mac->mac_sc;
1849 	uint16_t fw_rev;
1850 	const uint32_t *fw;
1851 	int fw_len, i, error = 0;
1852 
1853 	/*
1854 	 * Load FW image
1855 	 */
1856 	fw = (const uint32_t *)(mac->mac_ucode + BWI_FWHDR_SZ);
1857 	fw_len = (mac->mac_ucode_size - BWI_FWHDR_SZ) / sizeof(uint32_t);
1858 
1859 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1860 	    BWI_MOBJ_CTRL_VAL(BWI_FW_UCODE_MOBJ | BWI_WR_MOBJ_AUTOINC, 0));
1861 	for (i = 0; i < fw_len; ++i) {
1862 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, betoh32(fw[i]));
1863 		DELAY(10);
1864 	}
1865 
1866 	/*
1867 	 * Load PCM image
1868 	 */
1869 	fw = (const uint32_t *)(mac->mac_pcm + BWI_FWHDR_SZ);
1870 	fw_len = (mac->mac_pcm_size - BWI_FWHDR_SZ) / sizeof(uint32_t);
1871 
1872 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1873 	    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01ea));
1874 	CSR_WRITE_4(sc, BWI_MOBJ_DATA, 0x4000);
1875 
1876 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1877 	    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01eb));
1878 	for (i = 0; i < fw_len; ++i) {
1879 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, betoh32(fw[i]));
1880 		DELAY(10);
1881 	}
1882 
1883 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_ALL_INTRS);
1884 	CSR_WRITE_4(sc, BWI_MAC_STATUS,
1885 	    BWI_MAC_STATUS_UCODE_START |
1886 	    BWI_MAC_STATUS_IHREN |
1887 	    BWI_MAC_STATUS_INFRA);
1888 
1889 #define NRETRY	200
1890 	for (i = 0; i < NRETRY; ++i) {
1891 		uint32_t intr_status;
1892 
1893 		intr_status = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1894 		if (intr_status == BWI_INTR_READY)
1895 			break;
1896 		DELAY(10);
1897 	}
1898 	if (i == NRETRY) {
1899 		printf("%s: firmware (fw & pcm) loading timed out\n",
1900 		    sc->sc_dev.dv_xname);
1901 		error = ETIMEDOUT;
1902 		goto out;
1903 	}
1904 #undef NRETRY
1905 
1906 	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);	/* dummy read */
1907 
1908 	fw_rev = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWREV);
1909 	if (fw_rev > BWI_FW_VERSION3_REVMAX) {
1910 		printf("%s: firmware version 4 is not supported yet\n",
1911 		    sc->sc_dev.dv_xname);
1912 		error = ENODEV;
1913 		goto out;
1914 	}
1915 
1916 	DPRINTF(1, "%s: firmware rev 0x%04x, patch level 0x%04x\n",
1917 	    sc->sc_dev.dv_xname, fw_rev,
1918 	    MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
1919 
1920 out:
1921 	return (error);
1922 }
1923 
1924 int
1925 bwi_mac_gpio_init(struct bwi_mac *mac)
1926 {
1927 	struct bwi_softc *sc = mac->mac_sc;
1928 	struct bwi_regwin *old, *gpio_rw;
1929 	uint32_t filt, bits;
1930 	int error;
1931 
1932 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_GPOSEL_MASK);
1933 	/* TODO: LED */
1934 
1935 	CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0xf);
1936 
1937 	filt = 0x1f;
1938 	bits = 0xf;
1939 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301) {
1940 		filt |= 0x60;
1941 		bits |= 0x60;
1942 	}
1943 	if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
1944 		CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0x200);
1945 		filt |= 0x200;
1946 		bits |= 0x200;
1947 	}
1948 
1949 	gpio_rw = BWI_GPIO_REGWIN(sc);
1950 	error = bwi_regwin_switch(sc, gpio_rw, &old);
1951 	if (error)
1952 		return (error);
1953 
1954 	CSR_FILT_SETBITS_4(sc, BWI_GPIO_CTRL, filt, bits);
1955 
1956 	return (bwi_regwin_switch(sc, old, NULL));
1957 }
1958 
1959 int
1960 bwi_mac_gpio_fini(struct bwi_mac *mac)
1961 {
1962 	struct bwi_softc *sc = mac->mac_sc;
1963 	struct bwi_regwin *old, *gpio_rw;
1964 	int error;
1965 
1966 	gpio_rw = BWI_GPIO_REGWIN(sc);
1967 	error = bwi_regwin_switch(sc, gpio_rw, &old);
1968 	if (error)
1969 		return (error);
1970 
1971 	CSR_WRITE_4(sc, BWI_GPIO_CTRL, 0);
1972 
1973 	return (bwi_regwin_switch(sc, old, NULL));
1974 }
1975 
1976 int
1977 bwi_mac_fw_load_iv(struct bwi_mac *mac, uint8_t *fw, size_t fw_len)
1978 {
1979 	struct bwi_softc *sc = mac->mac_sc;
1980 	const struct bwi_fwhdr *hdr;
1981 	const struct bwi_fw_iv *iv;
1982 	int n, i, iv_img_size;
1983 
1984 	/* Get the number of IVs in the IV image */
1985 	hdr = (const struct bwi_fwhdr *)fw;
1986 	n = betoh32(hdr->fw_iv_cnt);
1987 	DPRINTF(1, "%s: IV count %d\n", sc->sc_dev.dv_xname, n);
1988 
1989 	/* Calculate the IV image size, for later sanity check */
1990 	iv_img_size = fw_len - sizeof(*hdr);
1991 
1992 	/* Locate the first IV */
1993 	iv = (const struct bwi_fw_iv *)(fw + sizeof(*hdr));
1994 
1995 	for (i = 0; i < n; ++i) {
1996 		uint16_t iv_ofs, ofs;
1997 		int sz = 0;
1998 
1999 		if (iv_img_size < sizeof(iv->iv_ofs)) {
2000 			printf("%s: invalid IV image, ofs\n",
2001 			    sc->sc_dev.dv_xname);
2002 			return (EINVAL);
2003 		}
2004 		iv_img_size -= sizeof(iv->iv_ofs);
2005 		sz += sizeof(iv->iv_ofs);
2006 
2007 		iv_ofs = betoh16(iv->iv_ofs);
2008 
2009 		ofs = __SHIFTOUT(iv_ofs, BWI_FW_IV_OFS_MASK);
2010 		if (ofs >= 0x1000) {
2011 			printf("%s: invalid ofs (0x%04x) for %dth iv\n",
2012 			    sc->sc_dev.dv_xname, ofs, i);
2013 			return (EINVAL);
2014 		}
2015 
2016 		if (iv_ofs & BWI_FW_IV_IS_32BIT) {
2017 			uint32_t val32;
2018 
2019 			if (iv_img_size < sizeof(iv->iv_val.val32)) {
2020 				printf("%s: invalid IV image, val32\n",
2021 				    sc->sc_dev.dv_xname);
2022 				return (EINVAL);
2023 			}
2024 			iv_img_size -= sizeof(iv->iv_val.val32);
2025 			sz += sizeof(iv->iv_val.val32);
2026 
2027 			val32 = betoh32(iv->iv_val.val32);
2028 			CSR_WRITE_4(sc, ofs, val32);
2029 		} else {
2030 			uint16_t val16;
2031 
2032 			if (iv_img_size < sizeof(iv->iv_val.val16)) {
2033 				printf("%s: invalid IV image, val16\n",
2034 				    sc->sc_dev.dv_xname);
2035 				return (EINVAL);
2036 			}
2037 			iv_img_size -= sizeof(iv->iv_val.val16);
2038 			sz += sizeof(iv->iv_val.val16);
2039 
2040 			val16 = betoh16(iv->iv_val.val16);
2041 			CSR_WRITE_2(sc, ofs, val16);
2042 		}
2043 
2044 		iv = (const struct bwi_fw_iv *)((const uint8_t *)iv + sz);
2045 	}
2046 
2047 	if (iv_img_size != 0) {
2048 		printf("%s: invalid IV image, size left %d\n",
2049 		    sc->sc_dev.dv_xname, iv_img_size);
2050 		return (EINVAL);
2051 	}
2052 
2053 	return (0);
2054 }
2055 
2056 int
2057 bwi_mac_fw_init(struct bwi_mac *mac)
2058 {
2059 	struct bwi_softc *sc = mac->mac_sc;
2060 	int error;
2061 
2062 	error = bwi_mac_fw_load_iv(mac, mac->mac_iv, mac->mac_iv_size);
2063 	if (error) {
2064 		printf("%s: load IV failed\n", sc->sc_dev.dv_xname);
2065 		return (error);
2066 	}
2067 
2068 	if (mac->mac_iv_ext != NULL) {
2069 		error = bwi_mac_fw_load_iv(mac, mac->mac_iv_ext,
2070 		    mac->mac_iv_ext_size);
2071 		if (error)
2072 			printf("%s: load ExtIV failed\n", sc->sc_dev.dv_xname);
2073 	}
2074 
2075 	return (error);
2076 }
2077 
2078 void
2079 bwi_mac_opmode_init(struct bwi_mac *mac)
2080 {
2081 	struct bwi_softc *sc = mac->mac_sc;
2082 	struct ieee80211com *ic = &sc->sc_ic;
2083 	uint32_t mac_status;
2084 	uint16_t pre_tbtt;
2085 
2086 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
2087 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
2088 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PASS_BCN);
2089 
2090 	/* Set probe resp timeout to infinite */
2091 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 0);
2092 
2093 	/*
2094 	 * TODO: factor out following part
2095 	 */
2096 
2097 	mac_status = CSR_READ_4(sc, BWI_MAC_STATUS);
2098 	mac_status &= ~(BWI_MAC_STATUS_OPMODE_HOSTAP |
2099 	    BWI_MAC_STATUS_PASS_CTL |
2100 	    BWI_MAC_STATUS_PASS_BADPLCP |
2101 	    BWI_MAC_STATUS_PASS_BADFCS |
2102 	    BWI_MAC_STATUS_PROMISC);
2103 	mac_status |= BWI_MAC_STATUS_INFRA;
2104 
2105 	/* Always turn on PROMISC on old hardware */
2106 	if (mac->mac_rev < 5)
2107 		mac_status |= BWI_MAC_STATUS_PROMISC;
2108 
2109 	switch (ic->ic_opmode) {
2110 #ifndef IEEE80211_STA_ONLY
2111 	case IEEE80211_M_IBSS:
2112 		mac_status &= ~BWI_MAC_STATUS_INFRA;
2113 		break;
2114 	case IEEE80211_M_HOSTAP:
2115 		mac_status |= BWI_MAC_STATUS_OPMODE_HOSTAP;
2116 		break;
2117 #endif
2118 	case IEEE80211_M_MONITOR:
2119 #if 0
2120 		/* Do you want data from your microwave oven? */
2121 		mac_status |= BWI_MAC_STATUS_PASS_CTL |
2122 			      BWI_MAC_STATUS_PASS_BADPLCP |
2123 			      BWI_MAC_STATUS_PASS_BADFCS;
2124 #else
2125 		mac_status |= BWI_MAC_STATUS_PASS_CTL;
2126 #endif
2127 		/* Promisc? */
2128 		break;
2129 	default:
2130 		break;
2131 	}
2132 
2133 	if (ic->ic_if.if_flags & IFF_PROMISC)
2134 		mac_status |= BWI_MAC_STATUS_PROMISC;
2135 
2136 	CSR_WRITE_4(sc, BWI_MAC_STATUS, mac_status);
2137 
2138 #ifndef IEEE80211_STA_ONLY
2139 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
2140 	    ic->ic_opmode != IEEE80211_M_HOSTAP) {
2141 #endif
2142 		if (sc->sc_bbp_id == BWI_BBPID_BCM4306 && sc->sc_bbp_rev == 3)
2143 			pre_tbtt = 100;
2144 		else
2145 			pre_tbtt = 50;
2146 #ifndef IEEE80211_STA_ONLY
2147 	} else
2148 		pre_tbtt = 2;
2149 #endif
2150 	CSR_WRITE_2(sc, BWI_MAC_PRE_TBTT, pre_tbtt);
2151 }
2152 
2153 void
2154 bwi_mac_hostflags_init(struct bwi_mac *mac)
2155 {
2156 	struct bwi_softc *sc = mac->mac_sc;
2157 	struct bwi_phy *phy = &mac->mac_phy;
2158 	struct bwi_rf *rf = &mac->mac_rf;
2159 	uint64_t host_flags;
2160 
2161 	if (phy->phy_mode == IEEE80211_MODE_11A)
2162 		return;
2163 
2164 	host_flags = HFLAGS_READ(mac);
2165 	host_flags |= BWI_HFLAG_SYM_WA;
2166 
2167 	if (phy->phy_mode == IEEE80211_MODE_11G) {
2168 		if (phy->phy_rev == 1)
2169 			host_flags |= BWI_HFLAG_GDC_WA;
2170 		if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
2171 			host_flags |= BWI_HFLAG_OFDM_PA;
2172 	} else if (phy->phy_mode == IEEE80211_MODE_11B) {
2173 		if (phy->phy_rev >= 2 && rf->rf_type == BWI_RF_T_BCM2050)
2174 			host_flags &= ~BWI_HFLAG_GDC_WA;
2175 	} else {
2176 		panic("unknown PHY mode %u", phy->phy_mode);
2177 	}
2178 
2179 	HFLAGS_WRITE(mac, host_flags);
2180 }
2181 
2182 void
2183 bwi_mac_bss_param_init(struct bwi_mac *mac)
2184 {
2185 	struct bwi_softc *sc = mac->mac_sc;
2186 	struct bwi_phy *phy = &mac->mac_phy;
2187 	struct bwi_retry_lim lim;
2188 	uint16_t cw_min;
2189 
2190 	/*
2191 	 * Set short/long retry limits
2192 	 */
2193 	bzero(&lim, sizeof(lim));
2194 	lim.shretry = BWI_SHRETRY;
2195 	lim.shretry_fb = BWI_SHRETRY_FB;
2196 	lim.lgretry = BWI_LGRETRY;
2197 	lim.lgretry_fb = BWI_LGRETRY_FB;
2198 	bwi_mac_set_retry_lim(mac, &lim);
2199 
2200 	/*
2201 	 * Implicitly prevent firmware from sending probe response
2202 	 * by setting its "probe response timeout" to 1us.
2203 	 */
2204 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 1);
2205 
2206 	/*
2207 	 * XXX MAC level acknowledge and CW min/max should depend
2208 	 * on the char rateset of the IBSS/BSS to join.
2209 	 */
2210 
2211 	/*
2212 	 * Set MAC level acknowledge rates
2213 	 */
2214 	bwi_mac_set_ackrates(mac, &sc->sc_ic.ic_sup_rates[phy->phy_mode]);
2215 
2216 	/*
2217 	 * Set CW min
2218 	 */
2219 	if (phy->phy_mode == IEEE80211_MODE_11B)
2220 		cw_min = IEEE80211_CW_MIN_0;
2221 	else
2222 		cw_min = IEEE80211_CW_MIN_1;
2223 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMIN, cw_min);
2224 
2225 	/*
2226 	 * Set CW max
2227 	 */
2228 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMAX,
2229 	    IEEE80211_CW_MAX);
2230 }
2231 
2232 void
2233 bwi_mac_set_retry_lim(struct bwi_mac *mac, const struct bwi_retry_lim *lim)
2234 {
2235 	/* Short/Long retry limit */
2236 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_SHRETRY,
2237 	    lim->shretry);
2238 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_LGRETRY,
2239 	    lim->lgretry);
2240 
2241 	/* Short/Long retry fallback limit */
2242 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SHRETRY_FB,
2243 	    lim->shretry_fb);
2244 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_LGRETEY_FB,
2245 	    lim->lgretry_fb);
2246 }
2247 
2248 void
2249 bwi_mac_set_ackrates(struct bwi_mac *mac, const struct ieee80211_rateset *rs)
2250 {
2251 	struct bwi_softc *sc;
2252 	int i;
2253 
2254 	sc = mac->mac_sc;
2255 
2256 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
2257 
2258 	/* XXX not standard conforming */
2259 	for (i = 0; i < rs->rs_nrates; ++i) {
2260 		enum bwi_modtype modtype;
2261 		uint16_t ofs;
2262 
2263 		modtype = bwi_rate2modtype(rs->rs_rates[i]);
2264 		switch (modtype) {
2265 		case IEEE80211_MODTYPE_DS:
2266 			ofs = 0x4c0;
2267 			ofs += (ieee80211_rate2plcp(rs->rs_rates[i],
2268 			    IEEE80211_MODE_11B) & 0xf) * 2;
2269 			break;
2270 		case IEEE80211_MODTYPE_OFDM:
2271 			ofs = 0x480;
2272 			ofs += (ieee80211_rate2plcp(rs->rs_rates[i],
2273 			    IEEE80211_MODE_11G) & 0xf) * 2;
2274 			break;
2275 		default:
2276 			panic("unsupported modtype %u", modtype);
2277 		}
2278 
2279 		MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, ofs + 0x20,
2280 		    MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs));
2281 	}
2282 }
2283 
2284 int
2285 bwi_mac_start(struct bwi_mac *mac)
2286 {
2287 	struct bwi_softc *sc = mac->mac_sc;
2288 
2289 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
2290 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_READY);
2291 
2292 	/* Flush pending bus writes */
2293 	CSR_READ_4(sc, BWI_MAC_STATUS);
2294 	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
2295 
2296 	return (bwi_mac_config_ps(mac));
2297 }
2298 
2299 int
2300 bwi_mac_stop(struct bwi_mac *mac)
2301 {
2302 	struct bwi_softc *sc = mac->mac_sc;
2303 	int error, i;
2304 
2305 	error = bwi_mac_config_ps(mac);
2306 	if (error)
2307 		return (error);
2308 
2309 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
2310 
2311 	/* Flush pending bus write */
2312 	CSR_READ_4(sc, BWI_MAC_STATUS);
2313 
2314 #define NRETRY	10000
2315 	for (i = 0; i < NRETRY; ++i) {
2316 		if (CSR_READ_4(sc, BWI_MAC_INTR_STATUS) & BWI_INTR_READY)
2317 			break;
2318 		DELAY(1);
2319 	}
2320 	if (i == NRETRY) {
2321 		printf("%s: can't stop MAC\n", sc->sc_dev.dv_xname);
2322 		return (ETIMEDOUT);
2323 	}
2324 #undef NRETRY
2325 
2326 	return (0);
2327 }
2328 
2329 int
2330 bwi_mac_config_ps(struct bwi_mac *mac)
2331 {
2332 	struct bwi_softc *sc = mac->mac_sc;
2333 	uint32_t status;
2334 
2335 	status = CSR_READ_4(sc, BWI_MAC_STATUS);
2336 
2337 	status &= ~BWI_MAC_STATUS_HW_PS;
2338 	status |= BWI_MAC_STATUS_WAKEUP;
2339 	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
2340 
2341 	/* Flush pending bus write */
2342 	CSR_READ_4(sc, BWI_MAC_STATUS);
2343 
2344 	if (mac->mac_rev >= 5) {
2345 		int i;
2346 
2347 #define NRETRY	100
2348 		for (i = 0; i < NRETRY; ++i) {
2349 			if (MOBJ_READ_2(mac, BWI_COMM_MOBJ,
2350 			    BWI_COMM_MOBJ_UCODE_STATE) != BWI_UCODE_STATE_PS)
2351 				break;
2352 			DELAY(10);
2353 		}
2354 		if (i == NRETRY) {
2355 			printf("%s: config PS failed\n", sc->sc_dev.dv_xname);
2356 			return (ETIMEDOUT);
2357 		}
2358 #undef NRETRY
2359 	}
2360 	return (0);
2361 }
2362 
2363 void
2364 bwi_mac_reset_hwkeys(struct bwi_mac *mac)
2365 {
2366 	/* TODO: firmware crypto */
2367 	MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_KEYTABLE_OFS);
2368 }
2369 
2370 void
2371 bwi_mac_shutdown(struct bwi_mac *mac)
2372 {
2373 	struct bwi_softc *sc = mac->mac_sc;
2374 	int i;
2375 
2376 	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS)
2377 		sc->sc_free_txstats(sc);
2378 
2379 	sc->sc_free_rx_ring(sc);
2380 
2381 	for (i = 0; i < BWI_TX_NRING; ++i)
2382 		sc->sc_free_tx_ring(sc, i);
2383 
2384 	bwi_rf_off(mac);
2385 
2386 	/* TODO: LED */
2387 
2388 	bwi_mac_gpio_fini(mac);
2389 
2390 	bwi_rf_off(mac); /* XXX again */
2391 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
2392 	bwi_regwin_disable(sc, &mac->mac_regwin, 0);
2393 
2394 	mac->mac_flags &= ~BWI_MAC_F_INITED;
2395 }
2396 
2397 int
2398 bwi_mac_get_property(struct bwi_mac *mac)
2399 {
2400 	struct bwi_softc *sc = mac->mac_sc;
2401 	enum bwi_bus_space old_bus_space;
2402 	uint32_t val;
2403 
2404 	/*
2405 	 * Byte swap
2406 	 */
2407 	val = CSR_READ_4(sc, BWI_MAC_STATUS);
2408 	if (val & BWI_MAC_STATUS_BSWAP) {
2409 		DPRINTF(1, "%s: need byte swap\n", sc->sc_dev.dv_xname);
2410 		mac->mac_flags |= BWI_MAC_F_BSWAP;
2411 	}
2412 
2413 	/*
2414 	 * DMA address space
2415 	 */
2416 	old_bus_space = sc->sc_bus_space;
2417 
2418 	val = CSR_READ_4(sc, BWI_STATE_HI);
2419 	if (__SHIFTOUT(val, BWI_STATE_HI_FLAGS_MASK) &
2420 	    BWI_STATE_HI_FLAG_64BIT) {
2421 		/* 64bit address */
2422 		sc->sc_bus_space = BWI_BUS_SPACE_64BIT;
2423 		DPRINTF(1, "%s: 64bit bus space\n", sc->sc_dev.dv_xname);
2424 	} else {
2425 		uint32_t txrx_reg = BWI_TXRX_CTRL_BASE + BWI_TX32_CTRL;
2426 
2427 		CSR_WRITE_4(sc, txrx_reg, BWI_TXRX32_CTRL_ADDRHI_MASK);
2428 		if (CSR_READ_4(sc, txrx_reg) & BWI_TXRX32_CTRL_ADDRHI_MASK) {
2429 			/* 32bit address */
2430 			sc->sc_bus_space = BWI_BUS_SPACE_32BIT;
2431 			DPRINTF(1, "%s: 32bit bus space\n",
2432 			    sc->sc_dev.dv_xname);
2433 		} else {
2434 			/* 30bit address */
2435 			sc->sc_bus_space = BWI_BUS_SPACE_30BIT;
2436 			DPRINTF(1, "%s: 30bit bus space\n",
2437 			    sc->sc_dev.dv_xname);
2438 		}
2439 	}
2440 
2441 	if (old_bus_space != 0 && old_bus_space != sc->sc_bus_space) {
2442 		printf("%s: MACs bus space mismatch!\n", sc->sc_dev.dv_xname);
2443 		return (ENXIO);
2444 	}
2445 
2446 	return (0);
2447 }
2448 
2449 #define IEEE80211_DUR_SLOT	20	/* DS/CCK slottime, ERP long slottime */
2450 #define IEEE80211_DUR_SHSLOT	9	/* ERP short slottime */
2451 
2452 void
2453 bwi_mac_updateslot(struct bwi_mac *mac, int shslot)
2454 {
2455 	struct bwi_softc *sc;
2456 	uint16_t slot_time;
2457 
2458 	sc = mac->mac_sc;
2459 
2460 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
2461 
2462 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B)
2463 		return;
2464 
2465 	if (shslot)
2466 		slot_time = IEEE80211_DUR_SHSLOT;
2467 	else
2468 		slot_time = IEEE80211_DUR_SLOT;
2469 
2470 	CSR_WRITE_2(mac->mac_sc, BWI_MAC_SLOTTIME,
2471 	    slot_time + BWI_MAC_SLOTTIME_ADJUST);
2472 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SLOTTIME, slot_time);
2473 }
2474 
2475 int
2476 bwi_mac_attach(struct bwi_softc *sc, int id, uint8_t rev)
2477 {
2478 	struct bwi_mac *mac;
2479 	int i;
2480 
2481 	KASSERT(sc->sc_nmac <= BWI_MAC_MAX && sc->sc_nmac >= 0);
2482 
2483 	if (sc->sc_nmac == BWI_MAC_MAX) {
2484 		printf("%s: too many MACs\n", sc->sc_dev.dv_xname);
2485 		return (0);
2486 	}
2487 
2488 	/*
2489 	 * More than one MAC is only supported by BCM4309
2490 	 */
2491 	if (sc->sc_nmac != 0 &&
2492 	    sc->sc_pci_did != PCI_PRODUCT_BROADCOM_BCM4309) {
2493 		DPRINTF(1, "%s: ignore second MAC\n", sc->sc_dev.dv_xname);
2494 		return (0);
2495 	}
2496 
2497 	mac = &sc->sc_mac[sc->sc_nmac];
2498 
2499 	/* XXX will this happen? */
2500 	if (BWI_REGWIN_EXIST(&mac->mac_regwin)) {
2501 		printf("%s: %dth MAC already attached\n",
2502 		    sc->sc_dev.dv_xname, sc->sc_nmac);
2503 		return (0);
2504 	}
2505 
2506 	/*
2507 	 * Test whether the revision of this MAC is supported
2508 	 */
2509 	for (i = 0; i < nitems(bwi_sup_macrev); ++i) {
2510 		if (bwi_sup_macrev[i] == rev)
2511 			break;
2512 	}
2513 	if (i == nitems(bwi_sup_macrev)) {
2514 		printf("%s: MAC rev %u is not supported\n",
2515 		    sc->sc_dev.dv_xname, rev);
2516 		return (ENXIO);
2517 	}
2518 
2519 	BWI_CREATE_MAC(mac, sc, id, rev);
2520 	sc->sc_nmac++;
2521 
2522 	if (mac->mac_rev < 5) {
2523 		mac->mac_flags |= BWI_MAC_F_HAS_TXSTATS;
2524 		DPRINTF(1, "%s: has TX stats\n", sc->sc_dev.dv_xname);
2525 	} else {
2526 		mac->mac_flags |= BWI_MAC_F_PHYE_RESET;
2527 	}
2528 
2529 	return (0);
2530 }
2531 
2532 void
2533 bwi_mac_balance_atten(int *bbp_atten0, int *rf_atten0)
2534 {
2535 	int bbp_atten, rf_atten, rf_atten_lim = -1;
2536 
2537 	bbp_atten = *bbp_atten0;
2538 	rf_atten = *rf_atten0;
2539 
2540 	/*
2541 	 * RF attenuation affects TX power BWI_RF_ATTEN_FACTOR times
2542 	 * as much as BBP attenuation, so we try our best to keep RF
2543 	 * attenuation within range.  BBP attenuation will be clamped
2544 	 * later if it is out of range during balancing.
2545 	 *
2546 	 * BWI_RF_ATTEN_MAX0 is used as RF attenuation upper limit.
2547 	 */
2548 
2549 	/*
2550 	 * Use BBP attenuation to balance RF attenuation
2551 	 */
2552 	if (rf_atten < 0)
2553 		rf_atten_lim = 0;
2554 	else if (rf_atten > BWI_RF_ATTEN_MAX0)
2555 		rf_atten_lim = BWI_RF_ATTEN_MAX0;
2556 
2557 	if (rf_atten_lim >= 0) {
2558 		bbp_atten += (BWI_RF_ATTEN_FACTOR * (rf_atten - rf_atten_lim));
2559 		rf_atten = rf_atten_lim;
2560 	}
2561 
2562 	/*
2563 	 * If possible, use RF attenuation to balance BBP attenuation
2564 	 * NOTE: RF attenuation is still kept within range.
2565 	 */
2566 	while (rf_atten < BWI_RF_ATTEN_MAX0 && bbp_atten > BWI_BBP_ATTEN_MAX) {
2567 		bbp_atten -= BWI_RF_ATTEN_FACTOR;
2568 		++rf_atten;
2569 	}
2570 	while (rf_atten > 0 && bbp_atten < 0) {
2571 		bbp_atten += BWI_RF_ATTEN_FACTOR;
2572 		--rf_atten;
2573 	}
2574 
2575 	/* RF attenuation MUST be within range */
2576 	KASSERT(rf_atten >= 0 && rf_atten <= BWI_RF_ATTEN_MAX0);
2577 
2578 	/*
2579 	 * Clamp BBP attenuation
2580 	 */
2581 	if (bbp_atten < 0)
2582 		bbp_atten = 0;
2583 	else if (bbp_atten > BWI_BBP_ATTEN_MAX)
2584 		bbp_atten = BWI_BBP_ATTEN_MAX;
2585 
2586 	*rf_atten0 = rf_atten;
2587 	*bbp_atten0 = bbp_atten;
2588 }
2589 
2590 void
2591 bwi_mac_adjust_tpctl(struct bwi_mac *mac, int rf_atten_adj, int bbp_atten_adj)
2592 {
2593 	struct bwi_softc *sc = mac->mac_sc;
2594 	struct bwi_rf *rf = &mac->mac_rf;
2595 	struct bwi_tpctl tpctl;
2596 	int bbp_atten, rf_atten, tp_ctrl1;
2597 
2598 	bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
2599 
2600 	/* NOTE: Use signed value to do calculation */
2601 	bbp_atten = tpctl.bbp_atten;
2602 	rf_atten = tpctl.rf_atten;
2603 	tp_ctrl1 = tpctl.tp_ctrl1;
2604 
2605 	bbp_atten += bbp_atten_adj;
2606 	rf_atten += rf_atten_adj;
2607 
2608 	bwi_mac_balance_atten(&bbp_atten, &rf_atten);
2609 
2610 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev == 2) {
2611 		if (rf_atten <= 1) {
2612 			if (tp_ctrl1 == 0) {
2613 				tp_ctrl1 = 3;
2614 				bbp_atten += 2;
2615 				rf_atten += 2;
2616 			} else if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
2617 				bbp_atten +=
2618 				(BWI_RF_ATTEN_FACTOR * (rf_atten - 2));
2619 				rf_atten = 2;
2620 			}
2621 		} else if (rf_atten > 4 && tp_ctrl1 != 0) {
2622 			tp_ctrl1 = 0;
2623 			if (bbp_atten < 3) {
2624 				bbp_atten += 2;
2625 				rf_atten -= 3;
2626 			} else {
2627 				bbp_atten -= 2;
2628 				rf_atten -= 2;
2629 			}
2630 		}
2631 		bwi_mac_balance_atten(&bbp_atten, &rf_atten);
2632 	}
2633 
2634 	tpctl.bbp_atten = bbp_atten;
2635 	tpctl.rf_atten = rf_atten;
2636 	tpctl.tp_ctrl1 = tp_ctrl1;
2637 
2638 	bwi_mac_lock(mac);
2639 	bwi_mac_set_tpctl_11bg(mac, &tpctl);
2640 	bwi_mac_unlock(mac);
2641 }
2642 
2643 /*
2644  * http://bcm-specs.sipsolutions.net/RecalculateTransmissionPower
2645  */
2646 void
2647 bwi_mac_calibrate_txpower(struct bwi_mac *mac, enum bwi_txpwrcb_type type)
2648 {
2649 	struct bwi_softc *sc = mac->mac_sc;
2650 	struct bwi_rf *rf = &mac->mac_rf;
2651 	int8_t tssi[4], tssi_avg, cur_txpwr;
2652 	int error, i, ofdm_tssi;
2653 	int txpwr_diff, rf_atten_adj, bbp_atten_adj;
2654 
2655 	if (mac->mac_flags & BWI_MAC_F_TPCTL_ERROR) {
2656 		DPRINTF(1, "%s: tpctl error happened, can't set txpower\n",
2657 		    sc->sc_dev.dv_xname);
2658 		return;
2659 	}
2660 
2661 	if (BWI_IS_BRCM_BU4306(sc)) {
2662 		DPRINTF(1, "%s: BU4306, can't set txpower\n",
2663 		    sc->sc_dev.dv_xname);
2664 		return;
2665 	}
2666 
2667 	/*
2668 	 * Save latest TSSI and reset the related memory objects
2669 	 */
2670 	ofdm_tssi = 0;
2671 	error = bwi_rf_get_latest_tssi(mac, tssi, BWI_COMM_MOBJ_TSSI_DS);
2672 	if (error) {
2673 		DPRINTF(1, "%s: no DS tssi\n", sc->sc_dev.dv_xname);
2674 
2675 		if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B) {
2676 			if (type == BWI_TXPWR_FORCE) {
2677 				rf_atten_adj = 0;
2678 				bbp_atten_adj = 1;
2679 				goto calib;
2680 			} else {
2681 				return;
2682 			}
2683 		}
2684 
2685 		error = bwi_rf_get_latest_tssi(mac, tssi,
2686 		    BWI_COMM_MOBJ_TSSI_OFDM);
2687 		if (error) {
2688 			DPRINTF(1, "%s: no OFDM tssi\n", sc->sc_dev.dv_xname);
2689 			if (type == BWI_TXPWR_FORCE) {
2690 				rf_atten_adj = 0;
2691 				bbp_atten_adj = 1;
2692 				goto calib;
2693 			} else {
2694 				return;
2695 			}
2696 		}
2697 
2698 		for (i = 0; i < 4; ++i) {
2699 			tssi[i] += 0x20;
2700 			tssi[i] &= 0x3f;
2701 		}
2702 		ofdm_tssi = 1;
2703 	}
2704 	bwi_rf_clear_tssi(mac);
2705 
2706 	DPRINTF(1, "%s: tssi0 %d, tssi1 %d, tssi2 %d, tssi3 %d\n",
2707 	    sc->sc_dev.dv_xname, tssi[0], tssi[1], tssi[2], tssi[3]);
2708 
2709 	/*
2710 	 * Calculate RF/BBP attenuation adjustment based on
2711 	 * the difference between desired TX power and sampled
2712 	 * TX power.
2713 	 */
2714 	/* +8 == "each incremented by 1/2" */
2715 	tssi_avg = (tssi[0] + tssi[1] + tssi[2] + tssi[3] + 8) / 4;
2716 	if (ofdm_tssi && (HFLAGS_READ(mac) & BWI_HFLAG_PWR_BOOST_DS))
2717 		tssi_avg -= 13;
2718 
2719 	DPRINTF(1, "%s: tssi avg %d\n", sc->sc_dev.dv_xname, tssi_avg);
2720 
2721 	error = bwi_rf_tssi2dbm(mac, tssi_avg, &cur_txpwr);
2722 	if (error)
2723 		return;
2724 	DPRINTF(1, "%s: current txpower %d\n", sc->sc_dev.dv_xname, cur_txpwr);
2725 
2726 	txpwr_diff = rf->rf_txpower_max - cur_txpwr; /* XXX ni_txpower */
2727 
2728 	rf_atten_adj = -howmany(txpwr_diff, 8);
2729 
2730 	if (type == BWI_TXPWR_INIT) {
2731 		/*
2732 		 * Move toward EEPROM max TX power as fast as we can
2733 		 */
2734 		bbp_atten_adj = -txpwr_diff;
2735 	} else {
2736 		bbp_atten_adj = -(txpwr_diff / 2);
2737 	}
2738 	bbp_atten_adj -= (BWI_RF_ATTEN_FACTOR * rf_atten_adj);
2739 
2740 	if (rf_atten_adj == 0 && bbp_atten_adj == 0) {
2741 		DPRINTF(1, "%s: no need to adjust RF/BBP attenuation\n",
2742 		    sc->sc_dev.dv_xname);
2743 		/* TODO: LO */
2744 		return;
2745 	}
2746 
2747 calib:
2748 	DPRINTF(1, "%s: rf atten adjust %d, bbp atten adjust %d\n",
2749 	    sc->sc_dev.dv_xname, rf_atten_adj, bbp_atten_adj);
2750 	bwi_mac_adjust_tpctl(mac, rf_atten_adj, bbp_atten_adj);
2751 	/* TODO: LO */
2752 }
2753 
2754 void
2755 bwi_mac_lock(struct bwi_mac *mac)
2756 {
2757 	struct bwi_softc *sc = mac->mac_sc;
2758 
2759 	KASSERT((mac->mac_flags & BWI_MAC_F_LOCKED) == 0);
2760 
2761 	if (mac->mac_rev < 3)
2762 		bwi_mac_stop(mac);
2763 	else
2764 #ifndef IEEE80211_STA_ONLY
2765 	if (sc->sc_ic.ic_opmode != IEEE80211_M_HOSTAP)
2766 #endif
2767 		bwi_mac_config_ps(mac);
2768 
2769 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
2770 
2771 	/* Flush pending bus write */
2772 	CSR_READ_4(sc, BWI_MAC_STATUS);
2773 	DELAY(10);
2774 
2775 	mac->mac_flags |= BWI_MAC_F_LOCKED;
2776 }
2777 
2778 void
2779 bwi_mac_unlock(struct bwi_mac *mac)
2780 {
2781 	struct bwi_softc *sc = mac->mac_sc;
2782 
2783 	KASSERT(mac->mac_flags & BWI_MAC_F_LOCKED);
2784 
2785 	CSR_READ_2(sc, BWI_PHYINFO); /* dummy read */
2786 
2787 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
2788 
2789 	if (mac->mac_rev < 3)
2790 		bwi_mac_start(mac);
2791 	else
2792 #ifndef IEEE80211_STA_ONLY
2793 	if (sc->sc_ic.ic_opmode != IEEE80211_M_HOSTAP)
2794 #endif
2795 		bwi_mac_config_ps(mac);
2796 
2797 	mac->mac_flags &= ~BWI_MAC_F_LOCKED;
2798 }
2799 
2800 void
2801 bwi_mac_set_promisc(struct bwi_mac *mac, int promisc)
2802 {
2803 	struct bwi_softc *sc = mac->mac_sc;
2804 
2805 	if (mac->mac_rev < 5) /* Promisc is always on */
2806 		return;
2807 
2808 	if (promisc)
2809 		CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
2810 	else
2811 		CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
2812 }
2813 
2814 /* PHY */
2815 
2816 void
2817 bwi_phy_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
2818 {
2819 	struct bwi_softc *sc = mac->mac_sc;
2820 
2821 	/* TODO: 11A */
2822 	CSR_WRITE_2(sc, BWI_PHY_CTRL, ctrl);
2823 	CSR_WRITE_2(sc, BWI_PHY_DATA, data);
2824 }
2825 
2826 uint16_t
2827 bwi_phy_read(struct bwi_mac *mac, uint16_t ctrl)
2828 {
2829 	struct bwi_softc *sc = mac->mac_sc;
2830 
2831 	/* TODO: 11A */
2832 	CSR_WRITE_2(sc, BWI_PHY_CTRL, ctrl);
2833 	return (CSR_READ_2(sc, BWI_PHY_DATA));
2834 }
2835 
2836 int
2837 bwi_phy_attach(struct bwi_mac *mac)
2838 {
2839 	struct bwi_softc *sc = mac->mac_sc;
2840 	struct bwi_phy *phy = &mac->mac_phy;
2841 	uint8_t phyrev, phytype, phyver;
2842 	uint16_t val;
2843 	int i;
2844 
2845 	/* Get PHY type/revision/version */
2846 	val = CSR_READ_2(sc, BWI_PHYINFO);
2847 	phyrev = __SHIFTOUT(val, BWI_PHYINFO_REV_MASK);
2848 	phytype = __SHIFTOUT(val, BWI_PHYINFO_TYPE_MASK);
2849 	phyver = __SHIFTOUT(val, BWI_PHYINFO_VER_MASK);
2850 	DPRINTF(1, "%s: PHY type %d, rev %d, ver %d\n",
2851 	    sc->sc_dev.dv_xname, phytype, phyrev, phyver);
2852 
2853 	/*
2854 	 * Verify whether the revision of the PHY type is supported
2855 	 * Convert PHY type to ieee80211_phymode
2856 	 */
2857 	switch (phytype) {
2858 	case BWI_PHYINFO_TYPE_11A:
2859 		if (phyrev >= 4) {
2860 			printf("%s: unsupported 11A PHY, rev %u\n",
2861 			    sc->sc_dev.dv_xname, phyrev);
2862 			return (ENXIO);
2863 		}
2864 		phy->phy_init = bwi_phy_init_11a;
2865 		phy->phy_mode = IEEE80211_MODE_11A;
2866 		phy->phy_tbl_ctrl = BWI_PHYR_TBL_CTRL_11A;
2867 		phy->phy_tbl_data_lo = BWI_PHYR_TBL_DATA_LO_11A;
2868 		phy->phy_tbl_data_hi = BWI_PHYR_TBL_DATA_HI_11A;
2869 		break;
2870 	case BWI_PHYINFO_TYPE_11B:
2871 		for (i = 0; i < nitems(bwi_sup_bphy); ++i) {
2872 			if (phyrev == bwi_sup_bphy[i].rev) {
2873 				phy->phy_init = bwi_sup_bphy[i].init;
2874 				break;
2875 			}
2876 		}
2877 		if (i == nitems(bwi_sup_bphy)) {
2878 			printf("%s: unsupported 11B PHY, rev %u\n",
2879 			    sc->sc_dev.dv_xname, phyrev);
2880 			return (ENXIO);
2881 		}
2882 		phy->phy_mode = IEEE80211_MODE_11B;
2883 		break;
2884 	case BWI_PHYINFO_TYPE_11G:
2885 		if (phyrev > 8) {
2886 			printf("%s: unsupported 11G PHY, rev %u\n",
2887 			    sc->sc_dev.dv_xname, phyrev);
2888 			return (ENXIO);
2889 		}
2890 		phy->phy_init = bwi_phy_init_11g;
2891 		phy->phy_mode = IEEE80211_MODE_11G;
2892 		phy->phy_tbl_ctrl = BWI_PHYR_TBL_CTRL_11G;
2893 		phy->phy_tbl_data_lo = BWI_PHYR_TBL_DATA_LO_11G;
2894 		phy->phy_tbl_data_hi = BWI_PHYR_TBL_DATA_HI_11G;
2895 		break;
2896 	default:
2897 		printf("%s: unsupported PHY type %d\n",
2898 		    sc->sc_dev.dv_xname, phytype);
2899 		return (ENXIO);
2900 	}
2901 	phy->phy_rev = phyrev;
2902 	phy->phy_version = phyver;
2903 
2904 	return (0);
2905 }
2906 
2907 void
2908 bwi_phy_set_bbp_atten(struct bwi_mac *mac, uint16_t bbp_atten)
2909 {
2910 	struct bwi_phy *phy = &mac->mac_phy;
2911 	uint16_t mask = 0x000f;
2912 
2913 	if (phy->phy_version == 0) {
2914 		CSR_FILT_SETBITS_2(mac->mac_sc, BWI_BBP_ATTEN, ~mask,
2915 		    __SHIFTIN(bbp_atten, mask));
2916 	} else {
2917 		if (phy->phy_version > 1)
2918 			mask <<= 2;
2919 		else
2920 			mask <<= 3;
2921 		PHY_FILT_SETBITS(mac, BWI_PHYR_BBP_ATTEN, ~mask,
2922 		    __SHIFTIN(bbp_atten, mask));
2923 	}
2924 }
2925 
2926 int
2927 bwi_phy_calibrate(struct bwi_mac *mac)
2928 {
2929 	struct bwi_phy *phy = &mac->mac_phy;
2930 
2931 	/* Dummy read */
2932 	CSR_READ_4(mac->mac_sc, BWI_MAC_STATUS);
2933 
2934 	/* Don't re-init */
2935 	if (phy->phy_flags & BWI_PHY_F_CALIBRATED)
2936 		return (0);
2937 
2938 	if (phy->phy_mode == IEEE80211_MODE_11G && phy->phy_rev == 1) {
2939 		bwi_mac_reset(mac, 0);
2940 		bwi_phy_init_11g(mac);
2941 		bwi_mac_reset(mac, 1);
2942 	}
2943 
2944 	phy->phy_flags |= BWI_PHY_F_CALIBRATED;
2945 
2946 	return (0);
2947 }
2948 
2949 void
2950 bwi_tbl_write_2(struct bwi_mac *mac, uint16_t ofs, uint16_t data)
2951 {
2952 	struct bwi_phy *phy = &mac->mac_phy;
2953 
2954 	KASSERT(phy->phy_tbl_ctrl != 0 && phy->phy_tbl_data_lo != 0);
2955 	PHY_WRITE(mac, phy->phy_tbl_ctrl, ofs);
2956 	PHY_WRITE(mac, phy->phy_tbl_data_lo, data);
2957 }
2958 
2959 void
2960 bwi_tbl_write_4(struct bwi_mac *mac, uint16_t ofs, uint32_t data)
2961 {
2962 	struct bwi_phy *phy = &mac->mac_phy;
2963 
2964 	KASSERT(phy->phy_tbl_data_lo != 0 && phy->phy_tbl_data_hi != 0 &&
2965 	    phy->phy_tbl_ctrl != 0);
2966 
2967 	PHY_WRITE(mac, phy->phy_tbl_ctrl, ofs);
2968 	PHY_WRITE(mac, phy->phy_tbl_data_hi, data >> 16);
2969 	PHY_WRITE(mac, phy->phy_tbl_data_lo, data & 0xffff);
2970 }
2971 
2972 void
2973 bwi_nrssi_write(struct bwi_mac *mac, uint16_t ofs, int16_t data)
2974 {
2975 	PHY_WRITE(mac, BWI_PHYR_NRSSI_CTRL, ofs);
2976 	PHY_WRITE(mac, BWI_PHYR_NRSSI_DATA, (uint16_t)data);
2977 }
2978 
2979 int16_t
2980 bwi_nrssi_read(struct bwi_mac *mac, uint16_t ofs)
2981 {
2982 	PHY_WRITE(mac, BWI_PHYR_NRSSI_CTRL, ofs);
2983 	return ((int16_t)PHY_READ(mac, BWI_PHYR_NRSSI_DATA));
2984 }
2985 
2986 void
2987 bwi_phy_init_11a(struct bwi_mac *mac)
2988 {
2989 	/* TODO: 11A */
2990 }
2991 
2992 void
2993 bwi_phy_init_11g(struct bwi_mac *mac)
2994 {
2995 	struct bwi_softc *sc = mac->mac_sc;
2996 	struct bwi_phy *phy = &mac->mac_phy;
2997 	struct bwi_rf *rf = &mac->mac_rf;
2998 	const struct bwi_tpctl *tpctl = &mac->mac_tpctl;
2999 
3000 	if (phy->phy_rev == 1)
3001 		bwi_phy_init_11b_rev5(mac);
3002 	else
3003 		bwi_phy_init_11b_rev6(mac);
3004 
3005 	if (phy->phy_rev >= 2 || (phy->phy_flags & BWI_PHY_F_LINKED))
3006 		bwi_phy_config_11g(mac);
3007 
3008 	if (phy->phy_rev >= 2) {
3009 		PHY_WRITE(mac, 0x814, 0);
3010 		PHY_WRITE(mac, 0x815, 0);
3011 
3012 		if (phy->phy_rev == 2) {
3013 			PHY_WRITE(mac, 0x811, 0);
3014 			PHY_WRITE(mac, 0x15, 0xc0);
3015 		} else if (phy->phy_rev > 5) {
3016 			PHY_WRITE(mac, 0x811, 0x400);
3017 			PHY_WRITE(mac, 0x15, 0xc0);
3018 		}
3019 	}
3020 
3021 	if (phy->phy_rev >= 2 || (phy->phy_flags & BWI_PHY_F_LINKED)) {
3022 		uint16_t val;
3023 
3024 		val = PHY_READ(mac, 0x400) & 0xff;
3025 		if (val == 3 || val == 5) {
3026 			PHY_WRITE(mac, 0x4c2, 0x1816);
3027 			PHY_WRITE(mac, 0x4c3, 0x8006);
3028 			if (val == 5) {
3029 				PHY_FILT_SETBITS(mac, 0x4cc,
3030 						 0xff, 0x1f00);
3031 			}
3032 		}
3033 	}
3034 
3035 	if ((phy->phy_rev <= 2 && (phy->phy_flags & BWI_PHY_F_LINKED)) ||
3036 	    phy->phy_rev >= 2)
3037 		PHY_WRITE(mac, 0x47e, 0x78);
3038 
3039 	if (rf->rf_rev == 8) {
3040 		PHY_SETBITS(mac, 0x801, 0x80);
3041 		PHY_SETBITS(mac, 0x43e, 0x4);
3042 	}
3043 
3044 	if (phy->phy_rev >= 2 && (phy->phy_flags & BWI_PHY_F_LINKED))
3045 		bwi_rf_get_gains(mac);
3046 
3047 	if (rf->rf_rev != 8)
3048 		bwi_rf_init(mac);
3049 
3050 	if (tpctl->tp_ctrl2 == 0xffff) {
3051 		bwi_rf_lo_update(mac);
3052 	} else {
3053 		if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev == 8) {
3054 			RF_WRITE(mac, 0x52,
3055 			    (tpctl->tp_ctrl1 << 4) | tpctl->tp_ctrl2);
3056 		} else {
3057 			RF_FILT_SETBITS(mac, 0x52, 0xfff0, tpctl->tp_ctrl1);
3058 		}
3059 
3060 		if (phy->phy_rev >= 6) {
3061 			PHY_FILT_SETBITS(mac, 0x36, 0xfff,
3062 			    tpctl->tp_ctrl2 << 12);
3063 		}
3064 
3065 		if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
3066 			PHY_WRITE(mac, 0x2e, 0x8075);
3067 		else
3068 			PHY_WRITE(mac, 0x2e, 0x807f);
3069 
3070 		if (phy->phy_rev < 2)
3071 			PHY_WRITE(mac, 0x2f, 0x101);
3072 		else
3073 			PHY_WRITE(mac, 0x2f, 0x202);
3074 	}
3075 
3076 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3077 		bwi_rf_lo_adjust(mac, tpctl);
3078 		PHY_WRITE(mac, 0x80f, 0x8078);
3079 	}
3080 
3081 	if ((sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
3082 		bwi_rf_init_hw_nrssi_table(mac, 0xffff /* XXX */);
3083 		bwi_rf_set_nrssi_thr(mac);
3084 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3085 		if (rf->rf_nrssi[0] == BWI_INVALID_NRSSI) {
3086 			KASSERT(rf->rf_nrssi[1] == BWI_INVALID_NRSSI);
3087 			bwi_rf_calc_nrssi_slope(mac);
3088 		} else {
3089 			KASSERT(rf->rf_nrssi[1] != BWI_INVALID_NRSSI);
3090 			bwi_rf_set_nrssi_thr(mac);
3091 		}
3092 	}
3093 
3094 	if (rf->rf_rev == 8)
3095 		PHY_WRITE(mac, 0x805, 0x3230);
3096 
3097 	bwi_mac_init_tpctl_11bg(mac);
3098 
3099 	if (sc->sc_bbp_id == BWI_BBPID_BCM4306 && sc->sc_bbp_pkg == 2) {
3100 		PHY_CLRBITS(mac, 0x429, 0x4000);
3101 		PHY_CLRBITS(mac, 0x4c3, 0x8000);
3102 	}
3103 }
3104 
3105 void
3106 bwi_phy_init_11b_rev2(struct bwi_mac *mac)
3107 {
3108 	struct bwi_softc *sc;
3109 
3110 	sc = mac->mac_sc;
3111 
3112 	/* TODO: 11B */
3113 	printf("%s: %s is not implemented yet\n",
3114 	    sc->sc_dev.dv_xname, __func__);
3115 }
3116 
3117 void
3118 bwi_phy_init_11b_rev4(struct bwi_mac *mac)
3119 {
3120 	struct bwi_softc *sc = mac->mac_sc;
3121 	struct bwi_rf *rf = &mac->mac_rf;
3122 	uint16_t val, ofs;
3123 	u_int chan;
3124 
3125 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, BWI_BPHY_CTRL_INIT);
3126 
3127 	PHY_WRITE(mac, 0x20, 0x301c);
3128 	PHY_WRITE(mac, 0x26, 0);
3129 	PHY_WRITE(mac, 0x30, 0xc6);
3130 	PHY_WRITE(mac, 0x88, 0x3e00);
3131 
3132 	for (ofs = 0, val = 0x3c3d; ofs < 30; ++ofs, val -= 0x202)
3133 		PHY_WRITE(mac, 0x89 + ofs, val);
3134 
3135 	CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL1);
3136 
3137 	chan = rf->rf_curchan;
3138 	if (chan == IEEE80211_CHAN_ANY)
3139 		chan = 6;	/* Force to channel 6 */
3140 	bwi_rf_set_chan(mac, chan, 0);
3141 
3142 	if (rf->rf_type != BWI_RF_T_BCM2050) {
3143 		RF_WRITE(mac, 0x75, 0x80);
3144 		RF_WRITE(mac, 0x79, 0x81);
3145 	}
3146 
3147 	RF_WRITE(mac, 0x50, 0x20);
3148 	RF_WRITE(mac, 0x50, 0x23);
3149 
3150 	if (rf->rf_type == BWI_RF_T_BCM2050) {
3151 		RF_WRITE(mac, 0x50, 0x20);
3152 		RF_WRITE(mac, 0x5a, 0x70);
3153 		RF_WRITE(mac, 0x5b, 0x7b);
3154 		RF_WRITE(mac, 0x5c, 0xb0);
3155 		RF_WRITE(mac, 0x7a, 0xf);
3156 		PHY_WRITE(mac, 0x38, 0x677);
3157 		bwi_rf_init_bcm2050(mac);
3158 	}
3159 
3160 	PHY_WRITE(mac, 0x14, 0x80);
3161 	PHY_WRITE(mac, 0x32, 0xca);
3162 	if (rf->rf_type == BWI_RF_T_BCM2050)
3163 		PHY_WRITE(mac, 0x32, 0xe0);
3164 	PHY_WRITE(mac, 0x35, 0x7c2);
3165 
3166 	bwi_rf_lo_update(mac);
3167 
3168 	PHY_WRITE(mac, 0x26, 0xcc00);
3169 	if (rf->rf_type == BWI_RF_T_BCM2050)
3170 		PHY_WRITE(mac, 0x26, 0xce00);
3171 
3172 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0x1100);
3173 
3174 	PHY_WRITE(mac, 0x2a, 0x88a3);
3175 	if (rf->rf_type == BWI_RF_T_BCM2050)
3176 		PHY_WRITE(mac, 0x2a, 0x88c2);
3177 
3178 	bwi_mac_set_tpctl_11bg(mac, NULL);
3179 	if (sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
3180 		bwi_rf_calc_nrssi_slope(mac);
3181 		bwi_rf_set_nrssi_thr(mac);
3182 	}
3183 	bwi_mac_init_tpctl_11bg(mac);
3184 }
3185 
3186 void
3187 bwi_phy_init_11b_rev5(struct bwi_mac *mac)
3188 {
3189 	struct bwi_softc *sc = mac->mac_sc;
3190 	struct bwi_rf *rf = &mac->mac_rf;
3191 	struct bwi_phy *phy = &mac->mac_phy;
3192 	uint orig_chan;
3193 
3194 	if (phy->phy_version == 1)
3195 		RF_SETBITS(mac, 0x7a, 0x50);
3196 
3197 	if (sc->sc_pci_subvid != PCI_VENDOR_BROADCOM &&
3198 	    sc->sc_pci_subdid != BWI_PCI_SUBDEVICE_BU4306) {
3199 		uint16_t ofs, val;
3200 
3201 		val = 0x2120;
3202 		for (ofs = 0xa8; ofs < 0xc7; ++ofs) {
3203 			PHY_WRITE(mac, ofs, val);
3204 			val += 0x202;
3205 		}
3206 	}
3207 
3208 	PHY_FILT_SETBITS(mac, 0x35, 0xf0ff, 0x700);
3209 
3210 	if (rf->rf_type == BWI_RF_T_BCM2050)
3211 		PHY_WRITE(mac, 0x38, 0x667);
3212 
3213 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3214 		if (rf->rf_type == BWI_RF_T_BCM2050) {
3215 			RF_SETBITS(mac, 0x7a, 0x20);
3216 			RF_SETBITS(mac, 0x51, 0x4);
3217 		}
3218 
3219 		CSR_WRITE_2(sc, BWI_RF_ANTDIV, 0);
3220 
3221 		PHY_SETBITS(mac, 0x802, 0x100);
3222 		PHY_SETBITS(mac, 0x42b, 0x2000);
3223 		PHY_WRITE(mac, 0x1c, 0x186a);
3224 
3225 		PHY_FILT_SETBITS(mac, 0x13, 0xff, 0x1900);
3226 		PHY_FILT_SETBITS(mac, 0x35, 0xffc0, 0x64);
3227 		PHY_FILT_SETBITS(mac, 0x5d, 0xff80, 0xa);
3228 	}
3229 
3230 	/* TODO: bad_frame_preempt? */
3231 
3232 	if (phy->phy_version == 1) {
3233 	    	PHY_WRITE(mac, 0x26, 0xce00);
3234 		PHY_WRITE(mac, 0x21, 0x3763);
3235 		PHY_WRITE(mac, 0x22, 0x1bc3);
3236 		PHY_WRITE(mac, 0x23, 0x6f9);
3237 		PHY_WRITE(mac, 0x24, 0x37e);
3238 	} else
3239 		PHY_WRITE(mac, 0x26, 0xcc00);
3240 	PHY_WRITE(mac, 0x30, 0xc6);
3241 
3242 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, BWI_BPHY_CTRL_INIT);
3243 
3244 	if (phy->phy_version == 1)
3245 		PHY_WRITE(mac, 0x20, 0x3e1c);
3246 	else
3247 		PHY_WRITE(mac, 0x20, 0x301c);
3248 
3249 	if (phy->phy_version == 0)
3250 		CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL1);
3251 
3252 	/* Force to channel 7 */
3253 	orig_chan = rf->rf_curchan;
3254 	bwi_rf_set_chan(mac, 7, 0);
3255 
3256 	if (rf->rf_type != BWI_RF_T_BCM2050) {
3257 		RF_WRITE(mac, 0x75, 0x80);
3258 		RF_WRITE(mac, 0x79, 0x81);
3259 	}
3260 
3261 	RF_WRITE(mac, 0x50, 0x20);
3262 	RF_WRITE(mac, 0x50, 0x23);
3263 
3264 	if (rf->rf_type == BWI_RF_T_BCM2050) {
3265 		RF_WRITE(mac, 0x50, 0x20);
3266 		RF_WRITE(mac, 0x5a, 0x70);
3267 	}
3268 
3269 	RF_WRITE(mac, 0x5b, 0x7b);
3270 	RF_WRITE(mac, 0x5c, 0xb0);
3271 	RF_SETBITS(mac, 0x7a, 0x7);
3272 
3273 	bwi_rf_set_chan(mac, orig_chan, 0);
3274 
3275 	PHY_WRITE(mac, 0x14, 0x80);
3276 	PHY_WRITE(mac, 0x32, 0xca);
3277 	PHY_WRITE(mac, 0x2a, 0x88a3);
3278 
3279 	bwi_mac_set_tpctl_11bg(mac, NULL);
3280 
3281 	if (rf->rf_type == BWI_RF_T_BCM2050)
3282 		RF_WRITE(mac, 0x5d, 0xd);
3283 
3284 	CSR_FILT_SETBITS_2(sc, BWI_PHY_MAGIC_REG1, 0xffc0, 0x4);
3285 }
3286 
3287 void
3288 bwi_phy_init_11b_rev6(struct bwi_mac *mac)
3289 {
3290 	struct bwi_softc *sc = mac->mac_sc;
3291 	struct bwi_rf *rf = &mac->mac_rf;
3292 	struct bwi_phy *phy = &mac->mac_phy;
3293 	uint16_t val, ofs;
3294 	uint orig_chan;
3295 
3296 	PHY_WRITE(mac, 0x3e, 0x817a);
3297 	RF_SETBITS(mac, 0x7a, 0x58);
3298 
3299 	if (rf->rf_rev == 4 || rf->rf_rev == 5) {
3300 		RF_WRITE(mac, 0x51, 0x37);
3301 		RF_WRITE(mac, 0x52, 0x70);
3302 		RF_WRITE(mac, 0x53, 0xb3);
3303 		RF_WRITE(mac, 0x54, 0x9b);
3304 		RF_WRITE(mac, 0x5a, 0x88);
3305 		RF_WRITE(mac, 0x5b, 0x88);
3306 		RF_WRITE(mac, 0x5d, 0x88);
3307 		RF_WRITE(mac, 0x5e, 0x88);
3308 		RF_WRITE(mac, 0x7d, 0x88);
3309 		HFLAGS_SETBITS(mac, BWI_HFLAG_MAGIC1);
3310 	} else if (rf->rf_rev == 8) {
3311 		RF_WRITE(mac, 0x51, 0);
3312 		RF_WRITE(mac, 0x52, 0x40);
3313 		RF_WRITE(mac, 0x53, 0xb7);
3314 		RF_WRITE(mac, 0x54, 0x98);
3315 		RF_WRITE(mac, 0x5a, 0x88);
3316 		RF_WRITE(mac, 0x5b, 0x6b);
3317 		RF_WRITE(mac, 0x5c, 0xf);
3318 		if (sc->sc_card_flags & BWI_CARD_F_ALT_IQ) {
3319 			RF_WRITE(mac, 0x5d, 0xfa);
3320 			RF_WRITE(mac, 0x5e, 0xd8);
3321 		} else {
3322 			RF_WRITE(mac, 0x5d, 0xf5);
3323 			RF_WRITE(mac, 0x5e, 0xb8);
3324 		}
3325 		RF_WRITE(mac, 0x73, 0x3);
3326 		RF_WRITE(mac, 0x7d, 0xa8);
3327 		RF_WRITE(mac, 0x7c, 0x1);
3328 		RF_WRITE(mac, 0x7e, 0x8);
3329 	}
3330 
3331 	val = 0x1e1f;
3332 	for (ofs = 0x88; ofs < 0x98; ++ofs) {
3333 		PHY_WRITE(mac, ofs, val);
3334 		val -= 0x202;
3335 	}
3336 
3337 	val = 0x3e3f;
3338 	for (ofs = 0x98; ofs < 0xa8; ++ofs) {
3339 		PHY_WRITE(mac, ofs, val);
3340 		val -= 0x202;
3341 	}
3342 
3343 	val = 0x2120;
3344 	for (ofs = 0xa8; ofs < 0xc8; ++ofs) {
3345 		PHY_WRITE(mac, ofs, (val & 0x3f3f));
3346 		val += 0x202;
3347 	}
3348 
3349 	if (phy->phy_mode == IEEE80211_MODE_11G) {
3350 		RF_SETBITS(mac, 0x7a, 0x20);
3351 		RF_SETBITS(mac, 0x51, 0x4);
3352 		PHY_SETBITS(mac, 0x802, 0x100);
3353 		PHY_SETBITS(mac, 0x42b, 0x2000);
3354 		PHY_WRITE(mac, 0x5b, 0);
3355 		PHY_WRITE(mac, 0x5c, 0);
3356 	}
3357 
3358 	/* Force to channel 7 */
3359 	orig_chan = rf->rf_curchan;
3360 	if (orig_chan >= 8)
3361 		bwi_rf_set_chan(mac, 1, 0);
3362 	else
3363 		bwi_rf_set_chan(mac, 13, 0);
3364 
3365 	RF_WRITE(mac, 0x50, 0x20);
3366 	RF_WRITE(mac, 0x50, 0x23);
3367 
3368 	DELAY(40);
3369 
3370 	if (rf->rf_rev < 6 || rf->rf_rev == 8) {
3371 		RF_SETBITS(mac, 0x7c, 0x2);
3372 		RF_WRITE(mac, 0x50, 0x20);
3373 	}
3374 	if (rf->rf_rev <= 2) {
3375 		RF_WRITE(mac, 0x7c, 0x20);
3376 		RF_WRITE(mac, 0x5a, 0x70);
3377 		RF_WRITE(mac, 0x5b, 0x7b);
3378 		RF_WRITE(mac, 0x5c, 0xb0);
3379 	}
3380 
3381 	RF_FILT_SETBITS(mac, 0x7a, 0xf8, 0x7);
3382 
3383 	bwi_rf_set_chan(mac, orig_chan, 0);
3384 
3385 	PHY_WRITE(mac, 0x14, 0x200);
3386 	if (rf->rf_rev >= 6)
3387 		PHY_WRITE(mac, 0x2a, 0x88c2);
3388 	else
3389 		PHY_WRITE(mac, 0x2a, 0x8ac0);
3390 	PHY_WRITE(mac, 0x38, 0x668);
3391 
3392 	bwi_mac_set_tpctl_11bg(mac, NULL);
3393 
3394 	if (rf->rf_rev <= 5) {
3395 		PHY_FILT_SETBITS(mac, 0x5d, 0xff80, 0x3);
3396 		if (rf->rf_rev <= 2)
3397 			RF_WRITE(mac, 0x5d, 0xd);
3398 	}
3399 
3400 	if (phy->phy_version == 4) {
3401 		CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL2);
3402 		PHY_CLRBITS(mac, 0x61, 0xf000);
3403 	} else {
3404 		PHY_FILT_SETBITS(mac, 0x2, 0xffc0, 0x4);
3405 	}
3406 
3407 	if (phy->phy_mode == IEEE80211_MODE_11B) {
3408 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC2);
3409 		PHY_WRITE(mac, 0x16, 0x410);
3410 		PHY_WRITE(mac, 0x17, 0x820);
3411 		PHY_WRITE(mac, 0x62, 0x7);
3412 
3413 		bwi_rf_init_bcm2050(mac);
3414 		bwi_rf_lo_update(mac);
3415 		if (sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
3416 			bwi_rf_calc_nrssi_slope(mac);
3417 			bwi_rf_set_nrssi_thr(mac);
3418 		}
3419 		bwi_mac_init_tpctl_11bg(mac);
3420 	} else
3421 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
3422 }
3423 
3424 void
3425 bwi_phy_config_11g(struct bwi_mac *mac)
3426 {
3427 	struct bwi_softc *sc = mac->mac_sc;
3428 	struct bwi_phy *phy = &mac->mac_phy;
3429 	const uint16_t *tbl;
3430 	uint16_t wrd_ofs1, wrd_ofs2;
3431 	int i, n;
3432 
3433 	if (phy->phy_rev == 1) {
3434 		PHY_WRITE(mac, 0x406, 0x4f19);
3435 		PHY_FILT_SETBITS(mac, 0x429, 0xfc3f, 0x340);
3436 		PHY_WRITE(mac, 0x42c, 0x5a);
3437 		PHY_WRITE(mac, 0x427, 0x1a);
3438 
3439 		/* Fill frequency table */
3440 		for (i = 0; i < nitems(bwi_phy_freq_11g_rev1); ++i) {
3441 			bwi_tbl_write_2(mac, BWI_PHYTBL_FREQ + i,
3442 			    bwi_phy_freq_11g_rev1[i]);
3443 		}
3444 
3445 		/* Fill noise table */
3446 		for (i = 0; i < nitems(bwi_phy_noise_11g_rev1); ++i) {
3447 			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
3448 			    bwi_phy_noise_11g_rev1[i]);
3449 		}
3450 
3451 		/* Fill rotor table */
3452 		for (i = 0; i < nitems(bwi_phy_rotor_11g_rev1); ++i) {
3453 			/* NB: data length is 4 bytes */
3454 			bwi_tbl_write_4(mac, BWI_PHYTBL_ROTOR + i,
3455 			    bwi_phy_rotor_11g_rev1[i]);
3456 		}
3457 	} else {
3458 		bwi_nrssi_write(mac, 0xba98, (int16_t)0x7654); /* XXX */
3459 
3460 		if (phy->phy_rev == 2) {
3461 			PHY_WRITE(mac, 0x4c0, 0x1861);
3462 			PHY_WRITE(mac, 0x4c1, 0x271);
3463 		} else if (phy->phy_rev > 2) {
3464 			PHY_WRITE(mac, 0x4c0, 0x98);
3465 			PHY_WRITE(mac, 0x4c1, 0x70);
3466 			PHY_WRITE(mac, 0x4c9, 0x80);
3467 		}
3468 		PHY_SETBITS(mac, 0x42b, 0x800);
3469 
3470 		/* Fill RSSI table */
3471 		for (i = 0; i < 64; ++i)
3472 			bwi_tbl_write_2(mac, BWI_PHYTBL_RSSI + i, i);
3473 
3474 		/* Fill noise table */
3475 		for (i = 0; i < nitems(bwi_phy_noise_11g); ++i) {
3476 			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
3477 			    bwi_phy_noise_11g[i]);
3478 		}
3479 	}
3480 
3481 	/*
3482 	 * Fill noise scale table
3483 	 */
3484 	if (phy->phy_rev <= 2) {
3485 		tbl = bwi_phy_noise_scale_11g_rev2;
3486 		n = nitems(bwi_phy_noise_scale_11g_rev2);
3487 	} else if (phy->phy_rev >= 7 && (PHY_READ(mac, 0x449) & 0x200)) {
3488 		tbl = bwi_phy_noise_scale_11g_rev7;
3489 		n = nitems(bwi_phy_noise_scale_11g_rev7);
3490 	} else {
3491 		tbl = bwi_phy_noise_scale_11g;
3492 		n = nitems(bwi_phy_noise_scale_11g);
3493 	}
3494 	for (i = 0; i < n; ++i)
3495 		bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE_SCALE + i, tbl[i]);
3496 
3497 	/*
3498 	 * Fill sigma square table
3499 	 */
3500 	if (phy->phy_rev == 2) {
3501 		tbl = bwi_phy_sigma_sq_11g_rev2;
3502 		n = nitems(bwi_phy_sigma_sq_11g_rev2);
3503 	} else if (phy->phy_rev > 2 && phy->phy_rev <= 8) {
3504 		tbl = bwi_phy_sigma_sq_11g_rev7;
3505 		n = nitems(bwi_phy_sigma_sq_11g_rev7);
3506 	} else {
3507 		tbl = NULL;
3508 		n = 0;
3509 	}
3510 	for (i = 0; i < n; ++i)
3511 		bwi_tbl_write_2(mac, BWI_PHYTBL_SIGMA_SQ + i, tbl[i]);
3512 
3513 	if (phy->phy_rev == 1) {
3514 		/* Fill delay table */
3515 		for (i = 0; i < nitems(bwi_phy_delay_11g_rev1); ++i) {
3516 			bwi_tbl_write_4(mac, BWI_PHYTBL_DELAY + i,
3517 			    bwi_phy_delay_11g_rev1[i]);
3518 		}
3519 
3520 		/* Fill WRSSI (Wide-Band RSSI) table */
3521 		for (i = 4; i < 20; ++i)
3522 			bwi_tbl_write_2(mac, BWI_PHYTBL_WRSSI_REV1 + i, 0x20);
3523 
3524 		bwi_phy_config_agc(mac);
3525 
3526 		wrd_ofs1 = 0x5001;
3527 		wrd_ofs2 = 0x5002;
3528 	} else {
3529 		/* Fill WRSSI (Wide-Band RSSI) table */
3530 		for (i = 0; i < 0x20; ++i)
3531 			bwi_tbl_write_2(mac, BWI_PHYTBL_WRSSI + i, 0x820);
3532 
3533 		bwi_phy_config_agc(mac);
3534 
3535 		PHY_READ(mac, 0x400);	/* Dummy read */
3536 		PHY_WRITE(mac, 0x403, 0x1000);
3537 		bwi_tbl_write_2(mac, 0x3c02, 0xf);
3538 		bwi_tbl_write_2(mac, 0x3c03, 0x14);
3539 
3540 		wrd_ofs1 = 0x401;
3541 		wrd_ofs2 = 0x402;
3542 	}
3543 
3544 	if (!(BWI_IS_BRCM_BU4306(sc) && sc->sc_pci_revid == 0x17)) {
3545 		bwi_tbl_write_2(mac, wrd_ofs1, 0x2);
3546 		bwi_tbl_write_2(mac, wrd_ofs2, 0x1);
3547 	}
3548 
3549 	/* phy->phy_flags & BWI_PHY_F_LINKED ? */
3550 	if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
3551 		PHY_WRITE(mac, 0x46e, 0x3cf);
3552 }
3553 #undef N
3554 
3555 /*
3556  * Configure Automatic Gain Controller
3557  */
3558 void
3559 bwi_phy_config_agc(struct bwi_mac *mac)
3560 {
3561 	struct bwi_phy *phy = &mac->mac_phy;
3562 	uint16_t ofs;
3563 
3564 	ofs = phy->phy_rev == 1 ? 0x4c00 : 0;
3565 
3566 	bwi_tbl_write_2(mac, ofs, 0xfe);
3567 	bwi_tbl_write_2(mac, ofs + 1, 0xd);
3568 	bwi_tbl_write_2(mac, ofs + 2, 0x13);
3569 	bwi_tbl_write_2(mac, ofs + 3, 0x19);
3570 
3571 	if (phy->phy_rev == 1) {
3572 		bwi_tbl_write_2(mac, 0x1800, 0x2710);
3573 		bwi_tbl_write_2(mac, 0x1801, 0x9b83);
3574 		bwi_tbl_write_2(mac, 0x1802, 0x9b83);
3575 		bwi_tbl_write_2(mac, 0x1803, 0xf8d);
3576 		PHY_WRITE(mac, 0x455, 0x4);
3577 	}
3578 
3579 	PHY_FILT_SETBITS(mac, 0x4a5, 0xff, 0x5700);
3580 	PHY_FILT_SETBITS(mac, 0x41a, 0xff80, 0xf);
3581 	PHY_FILT_SETBITS(mac, 0x41a, 0xc07f, 0x2b80);
3582 	PHY_FILT_SETBITS(mac, 0x48c, 0xf0ff, 0x300);
3583 
3584 	RF_SETBITS(mac, 0x7a, 0x8);
3585 
3586 	PHY_FILT_SETBITS(mac, 0x4a0, 0xfff0, 0x8);
3587 	PHY_FILT_SETBITS(mac, 0x4a1, 0xf0ff, 0x600);
3588 	PHY_FILT_SETBITS(mac, 0x4a2, 0xf0ff, 0x700);
3589 	PHY_FILT_SETBITS(mac, 0x4a0, 0xf0ff, 0x100);
3590 
3591 	if (phy->phy_rev == 1)
3592 		PHY_FILT_SETBITS(mac, 0x4a2, 0xfff0, 0x7);
3593 
3594 	PHY_FILT_SETBITS(mac, 0x488, 0xff00, 0x1c);
3595 	PHY_FILT_SETBITS(mac, 0x488, 0xc0ff, 0x200);
3596 	PHY_FILT_SETBITS(mac, 0x496, 0xff00, 0x1c);
3597 	PHY_FILT_SETBITS(mac, 0x489, 0xff00, 0x20);
3598 	PHY_FILT_SETBITS(mac, 0x489, 0xc0ff, 0x200);
3599 	PHY_FILT_SETBITS(mac, 0x482, 0xff00, 0x2e);
3600 	PHY_FILT_SETBITS(mac, 0x496, 0xff, 0x1a00);
3601 	PHY_FILT_SETBITS(mac, 0x481, 0xff00, 0x28);
3602 	PHY_FILT_SETBITS(mac, 0x481, 0xff, 0x2c00);
3603 
3604 	if (phy->phy_rev == 1) {
3605 		PHY_WRITE(mac, 0x430, 0x92b);
3606 		PHY_FILT_SETBITS(mac, 0x41b, 0xffe1, 0x2);
3607 	} else {
3608 		PHY_CLRBITS(mac, 0x41b, 0x1e);
3609 		PHY_WRITE(mac, 0x41f, 0x287a);
3610 		PHY_FILT_SETBITS(mac, 0x420, 0xfff0, 0x4);
3611 
3612 		if (phy->phy_rev >= 6) {
3613 			PHY_WRITE(mac, 0x422, 0x287a);
3614 			PHY_FILT_SETBITS(mac, 0x420, 0xfff, 0x3000);
3615 		}
3616 	}
3617 
3618 	PHY_FILT_SETBITS(mac, 0x4a8, 0x8080, 0x7874);
3619 	PHY_WRITE(mac, 0x48e, 0x1c00);
3620 
3621 	if (phy->phy_rev == 1) {
3622 		PHY_FILT_SETBITS(mac, 0x4ab, 0xf0ff, 0x600);
3623 		PHY_WRITE(mac, 0x48b, 0x5e);
3624 		PHY_FILT_SETBITS(mac, 0x48c, 0xff00, 0x1e);
3625 		PHY_WRITE(mac, 0x48d, 0x2);
3626 	}
3627 
3628 	bwi_tbl_write_2(mac, ofs + 0x800, 0);
3629 	bwi_tbl_write_2(mac, ofs + 0x801, 7);
3630 	bwi_tbl_write_2(mac, ofs + 0x802, 16);
3631 	bwi_tbl_write_2(mac, ofs + 0x803, 28);
3632 
3633 	if (phy->phy_rev >= 6) {
3634 		PHY_CLRBITS(mac, 0x426, 0x3);
3635 		PHY_CLRBITS(mac, 0x426, 0x1000);
3636 	}
3637 }
3638 
3639 void
3640 bwi_set_gains(struct bwi_mac *mac, const struct bwi_gains *gains)
3641 {
3642 	struct bwi_phy *phy = &mac->mac_phy;
3643 	uint16_t tbl_gain_ofs1, tbl_gain_ofs2, tbl_gain;
3644 	int i;
3645 
3646 	if (phy->phy_rev <= 1) {
3647 		tbl_gain_ofs1 = 0x5000;
3648 		tbl_gain_ofs2 = tbl_gain_ofs1 + 16;
3649 	} else {
3650 		tbl_gain_ofs1 = 0x400;
3651 		tbl_gain_ofs2 = tbl_gain_ofs1 + 8;
3652 	}
3653 
3654 	for (i = 0; i < 4; ++i) {
3655 		if (gains != NULL) {
3656 			tbl_gain = gains->tbl_gain1;
3657 		} else {
3658 			/* Bit swap */
3659 			tbl_gain = (i & 0x1) << 1;
3660 			tbl_gain |= (i & 0x2) >> 1;
3661 		}
3662 		bwi_tbl_write_2(mac, tbl_gain_ofs1 + i, tbl_gain);
3663 	}
3664 
3665 	for (i = 0; i < 16; ++i) {
3666 		if (gains != NULL)
3667 			tbl_gain = gains->tbl_gain2;
3668 		else
3669 			tbl_gain = i;
3670 		bwi_tbl_write_2(mac, tbl_gain_ofs2 + i, tbl_gain);
3671 	}
3672 
3673 	if (gains == NULL || (gains != NULL && gains->phy_gain != -1)) {
3674 		uint16_t phy_gain1, phy_gain2;
3675 
3676 		if (gains != NULL) {
3677 			phy_gain1 =
3678 			((uint16_t)gains->phy_gain << 14) |
3679 			((uint16_t)gains->phy_gain << 6);
3680 			phy_gain2 = phy_gain1;
3681 		} else {
3682 			phy_gain1 = 0x4040;
3683 			phy_gain2 = 0x4000;
3684 		}
3685 		PHY_FILT_SETBITS(mac, 0x4a0, 0xbfbf, phy_gain1);
3686 		PHY_FILT_SETBITS(mac, 0x4a1, 0xbfbf, phy_gain1);
3687 		PHY_FILT_SETBITS(mac, 0x4a2, 0xbfbf, phy_gain2);
3688 	}
3689 	bwi_mac_dummy_xmit(mac);
3690 }
3691 
3692 void
3693 bwi_phy_clear_state(struct bwi_phy *phy)
3694 {
3695 	phy->phy_flags &= ~BWI_CLEAR_PHY_FLAGS;
3696 }
3697 
3698 /* RF */
3699 
3700 int16_t
3701 bwi_nrssi_11g(struct bwi_mac *mac)
3702 {
3703 	int16_t val;
3704 
3705 #define NRSSI_11G_MASK		0x3f00
3706 	val = (int16_t)__SHIFTOUT(PHY_READ(mac, 0x47f), NRSSI_11G_MASK);
3707 	if (val >= 32)
3708 		val -= 64;
3709 
3710 	return (val);
3711 #undef NRSSI_11G_MASK
3712 }
3713 
3714 struct bwi_rf_lo *
3715 bwi_get_rf_lo(struct bwi_mac *mac, uint16_t rf_atten, uint16_t bbp_atten)
3716 {
3717 	int n;
3718 
3719 	n = rf_atten + (14 * (bbp_atten / 2));
3720 	KASSERT(n < BWI_RFLO_MAX);
3721 
3722 	return (&mac->mac_rf.rf_lo[n]);
3723 }
3724 
3725 int
3726 bwi_rf_lo_isused(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
3727 {
3728 	struct bwi_rf *rf = &mac->mac_rf;
3729 	int idx;
3730 
3731 	idx = lo - rf->rf_lo;
3732 	KASSERT(idx >= 0 && idx < BWI_RFLO_MAX);
3733 
3734 	return (isset(rf->rf_lo_used, idx));
3735 }
3736 
3737 void
3738 bwi_rf_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
3739 {
3740 	struct bwi_softc *sc = mac->mac_sc;
3741 
3742 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
3743 	CSR_WRITE_2(sc, BWI_RF_DATA_LO, data);
3744 }
3745 
3746 uint16_t
3747 bwi_rf_read(struct bwi_mac *mac, uint16_t ctrl)
3748 {
3749 	struct bwi_rf *rf = &mac->mac_rf;
3750 	struct bwi_softc *sc = mac->mac_sc;
3751 
3752 	ctrl |= rf->rf_ctrl_rd;
3753 	if (rf->rf_ctrl_adj) {
3754 		/* XXX */
3755 		if (ctrl < 0x70)
3756 			ctrl += 0x80;
3757 		else if (ctrl < 0x80)
3758 			ctrl += 0x70;
3759 	}
3760 
3761 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
3762 	return (CSR_READ_2(sc, BWI_RF_DATA_LO));
3763 }
3764 
3765 int
3766 bwi_rf_attach(struct bwi_mac *mac)
3767 {
3768 	struct bwi_softc *sc = mac->mac_sc;
3769 	struct bwi_phy *phy = &mac->mac_phy;
3770 	struct bwi_rf *rf = &mac->mac_rf;
3771 	uint16_t type, manu;
3772 	uint8_t rev;
3773 
3774 	/*
3775 	 * Get RF manufacture/type/revision
3776 	 */
3777 	if (sc->sc_bbp_id == BWI_BBPID_BCM4317) {
3778 		/*
3779 		 * Fake a BCM2050 RF
3780 		 */
3781 		manu = BWI_RF_MANUFACT_BCM;
3782 		type = BWI_RF_T_BCM2050;
3783 		if (sc->sc_bbp_rev == 0)
3784 			rev = 3;
3785 		else if (sc->sc_bbp_rev == 1)
3786 			rev = 4;
3787 		else
3788 			rev = 5;
3789 	} else {
3790 		uint32_t val;
3791 
3792 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
3793 		val = CSR_READ_2(sc, BWI_RF_DATA_HI);
3794 		val <<= 16;
3795 
3796 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
3797 		val |= CSR_READ_2(sc, BWI_RF_DATA_LO);
3798 
3799 		manu = __SHIFTOUT(val, BWI_RFINFO_MANUFACT_MASK);
3800 		type = __SHIFTOUT(val, BWI_RFINFO_TYPE_MASK);
3801 		rev = __SHIFTOUT(val, BWI_RFINFO_REV_MASK);
3802 	}
3803 	DPRINTF(1, "%s: RF manu 0x%03x, type 0x%04x, rev %u\n",
3804 	    sc->sc_dev.dv_xname, manu, type, rev);
3805 
3806 	/*
3807 	 * Verify whether the RF is supported
3808 	 */
3809 	rf->rf_ctrl_rd = 0;
3810 	rf->rf_ctrl_adj = 0;
3811 	switch (phy->phy_mode) {
3812 	case IEEE80211_MODE_11A:
3813 		if (manu != BWI_RF_MANUFACT_BCM ||
3814 		    type != BWI_RF_T_BCM2060 ||
3815 		    rev != 1) {
3816 			printf("%s: only BCM2060 rev 1 RF is supported for "
3817 			    "11A PHY\n", sc->sc_dev.dv_xname);
3818 			return (ENXIO);
3819 		}
3820 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11A;
3821 		rf->rf_on = bwi_rf_on_11a;
3822 		rf->rf_off = bwi_rf_off_11a;
3823 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2060;
3824 		break;
3825 	case IEEE80211_MODE_11B:
3826 		if (type == BWI_RF_T_BCM2050) {
3827 			rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
3828 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
3829 		} else if (type == BWI_RF_T_BCM2053) {
3830 			rf->rf_ctrl_adj = 1;
3831 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2053;
3832 		} else {
3833 			printf("%s: only BCM2050/BCM2053 RF is supported "
3834 			    "for supported for 11B PHY\n", sc->sc_dev.dv_xname);
3835 			return (ENXIO);
3836 		}
3837 		rf->rf_on = bwi_rf_on_11bg;
3838 		rf->rf_off = bwi_rf_off_11bg;
3839 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11b;
3840 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11b;
3841 		if (phy->phy_rev == 6)
3842 			rf->rf_lo_update = bwi_rf_lo_update_11g;
3843 		else
3844 			rf->rf_lo_update = bwi_rf_lo_update_11b;
3845 		break;
3846 	case IEEE80211_MODE_11G:
3847 		if (type != BWI_RF_T_BCM2050) {
3848 			printf("%s: only BCM2050 RF is supported for 11G "
3849 			    "PHY\n", sc->sc_dev.dv_xname);
3850 			return (ENXIO);
3851 		}
3852 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
3853 		rf->rf_on = bwi_rf_on_11bg;
3854 		if (mac->mac_rev >= 5)
3855 			rf->rf_off = bwi_rf_off_11g_rev5;
3856 		else
3857 			rf->rf_off = bwi_rf_off_11bg;
3858 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11g;
3859 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11g;
3860 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
3861 		rf->rf_lo_update = bwi_rf_lo_update_11g;
3862 		break;
3863 	default:
3864 		printf("%s: unsupported PHY mode\n", sc->sc_dev.dv_xname);
3865 		return (ENXIO);
3866 	}
3867 
3868 	rf->rf_type = type;
3869 	rf->rf_rev = rev;
3870 	rf->rf_manu = manu;
3871 	rf->rf_curchan = IEEE80211_CHAN_ANY;
3872 	rf->rf_ant_mode = BWI_ANT_MODE_AUTO;
3873 
3874 	return (0);
3875 }
3876 
3877 void
3878 bwi_rf_set_chan(struct bwi_mac *mac, uint chan, int work_around)
3879 {
3880 	struct bwi_softc *sc = mac->mac_sc;
3881 
3882 	if (chan == IEEE80211_CHAN_ANY)
3883 		return;
3884 
3885 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_CHAN, chan);
3886 
3887 	/* TODO: 11A */
3888 
3889 	if (work_around)
3890 		bwi_rf_workaround(mac, chan);
3891 
3892 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
3893 
3894 	if (chan == 14) {
3895 		if (sc->sc_locale == BWI_SPROM_LOCALE_JAPAN)
3896 			HFLAGS_CLRBITS(mac, BWI_HFLAG_NOT_JAPAN);
3897 		else
3898 			HFLAGS_SETBITS(mac, BWI_HFLAG_NOT_JAPAN);
3899 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, (1 << 11)); /* XXX */
3900 	} else {
3901 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0x840); /* XXX */
3902 	}
3903 	DELAY(8000);	/* DELAY(2000); */
3904 
3905 	mac->mac_rf.rf_curchan = chan;
3906 }
3907 
3908 void
3909 bwi_rf_get_gains(struct bwi_mac *mac)
3910 {
3911 #define SAVE_PHY_MAX	15
3912 #define SAVE_RF_MAX	3
3913 	struct bwi_softc *sc;
3914 	struct bwi_phy *phy = &mac->mac_phy;
3915 	struct bwi_rf *rf = &mac->mac_rf;
3916 	uint16_t save_phy[SAVE_PHY_MAX];
3917 	uint16_t save_rf[SAVE_RF_MAX];
3918 	uint16_t trsw;
3919 	int i, j, loop1_max, loop1, loop2;
3920 
3921 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
3922 	    { 0x52, 0x43, 0x7a };
3923 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] = {
3924 	    0x0429, 0x0001, 0x0811, 0x0812,
3925 	    0x0814, 0x0815, 0x005a, 0x0059,
3926 	    0x0058, 0x000a, 0x0003, 0x080f,
3927 	    0x0810, 0x002b, 0x0015
3928 	};
3929 
3930 	sc = mac->mac_sc;
3931 
3932 	/*
3933 	 * Save PHY/RF registers for later restoration
3934 	 */
3935 	for (i = 0; i < SAVE_PHY_MAX; ++i)
3936 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
3937 	PHY_READ(mac, 0x2d); /* dummy read */
3938 
3939 	for (i = 0; i < SAVE_RF_MAX; ++i)
3940 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
3941 
3942 	PHY_CLRBITS(mac, 0x429, 0xc000);
3943 	PHY_SETBITS(mac, 0x1, 0x8000);
3944 
3945 	PHY_SETBITS(mac, 0x811, 0x2);
3946 	PHY_CLRBITS(mac, 0x812, 0x2);
3947 	PHY_SETBITS(mac, 0x811, 0x1);
3948 	PHY_CLRBITS(mac, 0x812, 0x1);
3949 
3950 	PHY_SETBITS(mac, 0x814, 0x1);
3951 	PHY_CLRBITS(mac, 0x815, 0x1);
3952 	PHY_SETBITS(mac, 0x814, 0x2);
3953 	PHY_CLRBITS(mac, 0x815, 0x2);
3954 
3955 	PHY_SETBITS(mac, 0x811, 0xc);
3956 	PHY_SETBITS(mac, 0x812, 0xc);
3957 	PHY_SETBITS(mac, 0x811, 0x30);
3958 	PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
3959 
3960 	PHY_WRITE(mac, 0x5a, 0x780);
3961 	PHY_WRITE(mac, 0x59, 0xc810);
3962 	PHY_WRITE(mac, 0x58, 0xd);
3963 	PHY_SETBITS(mac, 0xa, 0x2000);
3964 
3965 	PHY_SETBITS(mac, 0x814, 0x4);
3966 	PHY_CLRBITS(mac, 0x815, 0x4);
3967 
3968 	PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
3969 
3970 	if (rf->rf_rev == 8) {
3971 		loop1_max = 15;
3972 		RF_WRITE(mac, 0x43, loop1_max);
3973 	} else {
3974 		loop1_max = 9;
3975 	    	RF_WRITE(mac, 0x52, 0x0);
3976 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, loop1_max);
3977 	}
3978 
3979 	bwi_phy_set_bbp_atten(mac, 11);
3980 
3981 	if (phy->phy_rev >= 3)
3982 		PHY_WRITE(mac, 0x80f, 0xc020);
3983 	else
3984 		PHY_WRITE(mac, 0x80f, 0x8020);
3985 	PHY_WRITE(mac, 0x810, 0);
3986 
3987 	PHY_FILT_SETBITS(mac, 0x2b, 0xffc0, 0x1);
3988 	PHY_FILT_SETBITS(mac, 0x2b, 0xc0ff, 0x800);
3989 	PHY_SETBITS(mac, 0x811, 0x100);
3990 	PHY_CLRBITS(mac, 0x812, 0x3000);
3991 
3992 	if ((mac->mac_sc->sc_card_flags & BWI_CARD_F_EXT_LNA) &&
3993 	    phy->phy_rev >= 7) {
3994 		PHY_SETBITS(mac, 0x811, 0x800);
3995 		PHY_SETBITS(mac, 0x812, 0x8000);
3996 	}
3997 	RF_CLRBITS(mac, 0x7a, 0xff08);
3998 
3999 	/*
4000 	 * Find out 'loop1/loop2', which will be used to calculate
4001 	 * max loopback gain later
4002 	 */
4003 	j = 0;
4004 	for (i = 0; i < loop1_max; ++i) {
4005 		for (j = 0; j < 16; ++j) {
4006 			RF_WRITE(mac, 0x43, i);
4007 
4008 			if (bwi_rf_gain_max_reached(mac, j))
4009 				goto loop1_exit;
4010 		}
4011 	}
4012 loop1_exit:
4013 	loop1 = i;
4014 	loop2 = j;
4015 
4016 	/*
4017 	 * Find out 'trsw', which will be used to calculate
4018 	 * TRSW(TX/RX switch) RX gain later
4019 	 */
4020 	if (loop2 >= 8) {
4021 		PHY_SETBITS(mac, 0x812, 0x30);
4022 		trsw = 0x1b;
4023 		for (i = loop2 - 8; i < 16; ++i) {
4024 			trsw -= 3;
4025 			if (bwi_rf_gain_max_reached(mac, i))
4026 				break;
4027 		}
4028 	} else {
4029 		trsw = 0x18;
4030 	}
4031 
4032 	/*
4033 	 * Restore saved PHY/RF registers
4034 	 */
4035 	/* First 4 saved PHY registers need special processing */
4036 	for (i = 4; i < SAVE_PHY_MAX; ++i)
4037 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
4038 
4039 	bwi_phy_set_bbp_atten(mac, mac->mac_tpctl.bbp_atten);
4040 
4041 	for (i = 0; i < SAVE_RF_MAX; ++i)
4042 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
4043 
4044 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2] | 0x3);
4045 	DELAY(10);
4046 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2]);
4047 	PHY_WRITE(mac, save_phy_regs[3], save_phy[3]);
4048 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
4049 	PHY_WRITE(mac, save_phy_regs[1], save_phy[1]);
4050 
4051 	/*
4052 	 * Calculate gains
4053 	 */
4054 	rf->rf_lo_gain = (loop2 * 6) - (loop1 * 4) - 11;
4055 	rf->rf_rx_gain = trsw * 2;
4056 	DPRINTF(1, "%s: lo gain: %u, rx gain: %u\n",
4057 	    sc->sc_dev.dv_xname, rf->rf_lo_gain, rf->rf_rx_gain);
4058 
4059 #undef SAVE_RF_MAX
4060 #undef SAVE_PHY_MAX
4061 }
4062 
4063 void
4064 bwi_rf_init(struct bwi_mac *mac)
4065 {
4066 	struct bwi_rf *rf = &mac->mac_rf;
4067 
4068 	if (rf->rf_type == BWI_RF_T_BCM2060) {
4069 		/* TODO: 11A */
4070 	} else {
4071 		if (rf->rf_flags & BWI_RF_F_INITED)
4072 			RF_WRITE(mac, 0x78, rf->rf_calib);
4073 		else
4074 			bwi_rf_init_bcm2050(mac);
4075 	}
4076 }
4077 
4078 void
4079 bwi_rf_off_11a(struct bwi_mac *mac)
4080 {
4081 	RF_WRITE(mac, 0x4, 0xff);
4082 	RF_WRITE(mac, 0x5, 0xfb);
4083 
4084 	PHY_SETBITS(mac, 0x10, 0x8);
4085 	PHY_SETBITS(mac, 0x11, 0x8);
4086 
4087 	PHY_WRITE(mac, 0x15, 0xaa00);
4088 }
4089 
4090 void
4091 bwi_rf_off_11bg(struct bwi_mac *mac)
4092 {
4093 	PHY_WRITE(mac, 0x15, 0xaa00);
4094 }
4095 
4096 void
4097 bwi_rf_off_11g_rev5(struct bwi_mac *mac)
4098 {
4099 	PHY_SETBITS(mac, 0x811, 0x8c);
4100 	PHY_CLRBITS(mac, 0x812, 0x8c);
4101 }
4102 
4103 void
4104 bwi_rf_workaround(struct bwi_mac *mac, uint chan)
4105 {
4106 	struct bwi_softc *sc = mac->mac_sc;
4107 	struct bwi_rf *rf = &mac->mac_rf;
4108 
4109 	if (chan == IEEE80211_CHAN_ANY) {
4110 		printf("%s: %s invalid channel!\n",
4111 		    sc->sc_dev.dv_xname, __func__);
4112 		return;
4113 	}
4114 
4115 	if (rf->rf_type != BWI_RF_T_BCM2050 || rf->rf_rev >= 6)
4116 		return;
4117 
4118 	if (chan <= 10)
4119 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan + 4));
4120 	else
4121 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(1));
4122 	DELAY(1000);
4123 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
4124 }
4125 
4126 struct bwi_rf_lo *
4127 bwi_rf_lo_find(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
4128 {
4129 	uint16_t rf_atten, bbp_atten;
4130 	int remap_rf_atten;
4131 
4132 	remap_rf_atten = 1;
4133 	if (tpctl == NULL) {
4134 		bbp_atten = 2;
4135 		rf_atten = 3;
4136 	} else {
4137 		if (tpctl->tp_ctrl1 == 3)
4138 			remap_rf_atten = 0;
4139 
4140 		bbp_atten = tpctl->bbp_atten;
4141 		rf_atten = tpctl->rf_atten;
4142 
4143 		if (bbp_atten > 6)
4144 			bbp_atten = 6;
4145 	}
4146 
4147 	if (remap_rf_atten) {
4148 #define MAP_MAX	10
4149 		static const uint16_t map[MAP_MAX] =
4150 		{ 11, 10, 11, 12, 13, 12, 13, 12, 13, 12 };
4151 #if 0
4152 		KASSERT(rf_atten < MAP_MAX);
4153 		rf_atten = map[rf_atten];
4154 #else
4155 		if (rf_atten >= MAP_MAX) {
4156 			rf_atten = 0;	/* XXX */
4157 		} else {
4158 			rf_atten = map[rf_atten];
4159 		}
4160 #endif
4161 #undef MAP_MAX
4162 	}
4163 
4164 	return (bwi_get_rf_lo(mac, rf_atten, bbp_atten));
4165 }
4166 
4167 void
4168 bwi_rf_lo_adjust(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
4169 {
4170 	const struct bwi_rf_lo *lo;
4171 
4172 	lo = bwi_rf_lo_find(mac, tpctl);
4173 	RF_LO_WRITE(mac, lo);
4174 }
4175 
4176 void
4177 bwi_rf_lo_write(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
4178 {
4179 	uint16_t val;
4180 
4181 	val = (uint8_t)lo->ctrl_lo;
4182 	val |= ((uint8_t)lo->ctrl_hi) << 8;
4183 
4184 	PHY_WRITE(mac, BWI_PHYR_RF_LO, val);
4185 }
4186 
4187 int
4188 bwi_rf_gain_max_reached(struct bwi_mac *mac, int idx)
4189 {
4190 	PHY_FILT_SETBITS(mac, 0x812, 0xf0ff, idx << 8);
4191 	PHY_FILT_SETBITS(mac, 0x15, 0xfff, 0xa000);
4192 	PHY_SETBITS(mac, 0x15, 0xf000);
4193 
4194 	DELAY(20);
4195 
4196 	return ((PHY_READ(mac, 0x2d) >= 0xdfc));
4197 }
4198 
4199 /* XXX use bitmap array */
4200 uint16_t
4201 bwi_bitswap4(uint16_t val)
4202 {
4203 	uint16_t ret;
4204 
4205 	ret = (val & 0x8) >> 3;
4206 	ret |= (val & 0x4) >> 1;
4207 	ret |= (val & 0x2) << 1;
4208 	ret |= (val & 0x1) << 3;
4209 
4210 	return (ret);
4211 }
4212 
4213 uint16_t
4214 bwi_phy812_value(struct bwi_mac *mac, uint16_t lpd)
4215 {
4216 	struct bwi_softc *sc = mac->mac_sc;
4217 	struct bwi_phy *phy = &mac->mac_phy;
4218 	struct bwi_rf *rf = &mac->mac_rf;
4219 	uint16_t lo_gain, ext_lna, loop;
4220 
4221 	if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
4222 		return (0);
4223 
4224 	lo_gain = rf->rf_lo_gain;
4225 	if (rf->rf_rev == 8)
4226 		lo_gain += 0x3e;
4227 	else
4228 		lo_gain += 0x26;
4229 
4230 	if (lo_gain >= 0x46) {
4231 		lo_gain -= 0x46;
4232 		ext_lna = 0x3000;
4233 	} else if (lo_gain >= 0x3a) {
4234 		lo_gain -= 0x3a;
4235 		ext_lna = 0x1000;
4236 	} else if (lo_gain >= 0x2e) {
4237 		lo_gain -= 0x2e;
4238 		ext_lna = 0x2000;
4239 	} else {
4240 		lo_gain -= 0x10;
4241 		ext_lna = 0;
4242 	}
4243 
4244 	for (loop = 0; loop < 16; ++loop) {
4245 		lo_gain -= (6 * loop);
4246 		if (lo_gain < 6)
4247 			break;
4248 	}
4249 
4250 	if (phy->phy_rev >= 7 && (sc->sc_card_flags & BWI_CARD_F_EXT_LNA)) {
4251 		if (ext_lna)
4252 			ext_lna |= 0x8000;
4253 		ext_lna |= (loop << 8);
4254 		switch (lpd) {
4255 		case 0x011:
4256 			return (0x8f92);
4257 		case 0x001:
4258 			return ((0x8092 | ext_lna));
4259 		case 0x101:
4260 			return ((0x2092 | ext_lna));
4261 		case 0x100:
4262 			return ((0x2093 | ext_lna));
4263 		default:
4264 			panic("unsupported lpd");
4265 		}
4266 	} else {
4267 		ext_lna |= (loop << 8);
4268 		switch (lpd) {
4269 		case 0x011:
4270 			return (0xf92);
4271 		case 0x001:
4272 		case 0x101:
4273 			return ((0x92 | ext_lna));
4274 		case 0x100:
4275 			return ((0x93 | ext_lna));
4276 		default:
4277 			panic("unsupported lpd");
4278 		}
4279 	}
4280 
4281 	panic("never reached");
4282 
4283 	return (0);
4284 }
4285 
4286 void
4287 bwi_rf_init_bcm2050(struct bwi_mac *mac)
4288 {
4289 #define SAVE_RF_MAX		3
4290 #define SAVE_PHY_COMM_MAX	4
4291 #define SAVE_PHY_11G_MAX	6
4292 	uint16_t save_rf[SAVE_RF_MAX];
4293 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
4294 	uint16_t save_phy_11g[SAVE_PHY_11G_MAX];
4295 	uint16_t phyr_35, phyr_30 = 0, rfr_78, phyr_80f = 0, phyr_810 = 0;
4296 	uint16_t bphy_ctrl = 0, bbp_atten, rf_chan_ex;
4297 	uint16_t phy812_val;
4298 	uint16_t calib;
4299 	uint32_t test_lim, test;
4300 	struct bwi_softc *sc = mac->mac_sc;
4301 	struct bwi_phy *phy = &mac->mac_phy;
4302 	struct bwi_rf *rf = &mac->mac_rf;
4303 	int i;
4304 
4305 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
4306 	    { 0x0043, 0x0051, 0x0052 };
4307 	static const uint16_t save_phy_regs_comm[SAVE_PHY_COMM_MAX] =
4308 	    { 0x0015, 0x005a, 0x0059, 0x0058 };
4309 	static const uint16_t save_phy_regs_11g[SAVE_PHY_11G_MAX] =
4310 	    { 0x0811, 0x0812, 0x0814, 0x0815, 0x0429, 0x0802 };
4311 
4312 	/*
4313 	 * Save registers for later restoring
4314 	 */
4315 	for (i = 0; i < SAVE_RF_MAX; ++i)
4316 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
4317 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
4318 		save_phy_comm[i] = PHY_READ(mac, save_phy_regs_comm[i]);
4319 
4320 	if (phy->phy_mode == IEEE80211_MODE_11B) {
4321 		phyr_30 = PHY_READ(mac, 0x30);
4322 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
4323 
4324 		PHY_WRITE(mac, 0x30, 0xff);
4325 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x3f3f);
4326 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4327 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
4328 			save_phy_11g[i] =
4329 			    PHY_READ(mac, save_phy_regs_11g[i]);
4330 		}
4331 
4332 		PHY_SETBITS(mac, 0x814, 0x3);
4333 		PHY_CLRBITS(mac, 0x815, 0x3);
4334 		PHY_CLRBITS(mac, 0x429, 0x8000);
4335 		PHY_CLRBITS(mac, 0x802, 0x3);
4336 
4337 		phyr_80f = PHY_READ(mac, 0x80f);
4338 		phyr_810 = PHY_READ(mac, 0x810);
4339 
4340 		if (phy->phy_rev >= 3)
4341 			PHY_WRITE(mac, 0x80f, 0xc020);
4342 		else
4343 			PHY_WRITE(mac, 0x80f, 0x8020);
4344 		PHY_WRITE(mac, 0x810, 0);
4345 
4346 		phy812_val = bwi_phy812_value(mac, 0x011);
4347 		PHY_WRITE(mac, 0x812, phy812_val);
4348 		if (phy->phy_rev < 7 ||
4349 		    (sc->sc_card_flags & BWI_CARD_F_EXT_LNA) == 0)
4350 			PHY_WRITE(mac, 0x811, 0x1b3);
4351 		else
4352 			PHY_WRITE(mac, 0x811, 0x9b3);
4353 	}
4354 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
4355 
4356 	phyr_35 = PHY_READ(mac, 0x35);
4357 	PHY_CLRBITS(mac, 0x35, 0x80);
4358 
4359 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
4360 	rf_chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
4361 
4362 	if (phy->phy_version == 0) {
4363 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
4364 	} else {
4365 		if (phy->phy_version >= 2)
4366 			PHY_FILT_SETBITS(mac, 0x3, 0xffbf, 0x40);
4367 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
4368 	}
4369 
4370 	calib = bwi_rf_calibval(mac);
4371 
4372 	if (phy->phy_mode == IEEE80211_MODE_11B)
4373 		RF_WRITE(mac, 0x78, 0x26);
4374 
4375 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4376 		phy812_val = bwi_phy812_value(mac, 0x011);
4377 		PHY_WRITE(mac, 0x812, phy812_val);
4378 	}
4379 
4380 	PHY_WRITE(mac, 0x15, 0xbfaf);
4381 	PHY_WRITE(mac, 0x2b, 0x1403);
4382 
4383 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4384 		phy812_val = bwi_phy812_value(mac, 0x001);
4385 		PHY_WRITE(mac, 0x812, phy812_val);
4386 	}
4387 
4388 	PHY_WRITE(mac, 0x15, 0xbfa0);
4389 
4390 	RF_SETBITS(mac, 0x51, 0x4);
4391 	if (rf->rf_rev == 8)
4392 		RF_WRITE(mac, 0x43, 0x1f);
4393 	else {
4394 		RF_WRITE(mac, 0x52, 0);
4395 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
4396 	}
4397 
4398 	test_lim = 0;
4399 	PHY_WRITE(mac, 0x58, 0);
4400 	for (i = 0; i < 16; ++i) {
4401 		PHY_WRITE(mac, 0x5a, 0x480);
4402 		PHY_WRITE(mac, 0x59, 0xc810);
4403 
4404 		PHY_WRITE(mac, 0x58, 0xd);
4405 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4406 			phy812_val = bwi_phy812_value(mac, 0x101);
4407 			PHY_WRITE(mac, 0x812, phy812_val);
4408 		}
4409 		PHY_WRITE(mac, 0x15, 0xafb0);
4410 		DELAY(10);
4411 
4412 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4413 			phy812_val = bwi_phy812_value(mac, 0x101);
4414 			PHY_WRITE(mac, 0x812, phy812_val);
4415 		}
4416 		PHY_WRITE(mac, 0x15, 0xefb0);
4417 		DELAY(10);
4418 
4419 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4420 			phy812_val = bwi_phy812_value(mac, 0x100);
4421 			PHY_WRITE(mac, 0x812, phy812_val);
4422 		}
4423 		PHY_WRITE(mac, 0x15, 0xfff0);
4424 		DELAY(20);
4425 
4426 		test_lim += PHY_READ(mac, 0x2d);
4427 
4428 		PHY_WRITE(mac, 0x58, 0);
4429 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4430 			phy812_val = bwi_phy812_value(mac, 0x101);
4431 			PHY_WRITE(mac, 0x812, phy812_val);
4432 		}
4433 		PHY_WRITE(mac, 0x15, 0xafb0);
4434 	}
4435 	++test_lim;
4436 	test_lim >>= 9;
4437 
4438 	DELAY(10);
4439 
4440 	test = 0;
4441 	PHY_WRITE(mac, 0x58, 0);
4442 	for (i = 0; i < 16; ++i) {
4443 		int j;
4444 
4445 		rfr_78 = (bwi_bitswap4(i) << 1) | 0x20;
4446 		RF_WRITE(mac, 0x78, rfr_78);
4447 		DELAY(10);
4448 
4449 		/* NB: This block is slight different than the above one */
4450 		for (j = 0; j < 16; ++j) {
4451 			PHY_WRITE(mac, 0x5a, 0xd80);
4452 			PHY_WRITE(mac, 0x59, 0xc810);
4453 
4454 			PHY_WRITE(mac, 0x58, 0xd);
4455 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4456 			    phy->phy_rev >= 2) {
4457 				phy812_val = bwi_phy812_value(mac, 0x101);
4458 				PHY_WRITE(mac, 0x812, phy812_val);
4459 			}
4460 			PHY_WRITE(mac, 0x15, 0xafb0);
4461 			DELAY(10);
4462 
4463 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4464 			    phy->phy_rev >= 2) {
4465 				phy812_val = bwi_phy812_value(mac, 0x101);
4466 				PHY_WRITE(mac, 0x812, phy812_val);
4467 			}
4468 			PHY_WRITE(mac, 0x15, 0xefb0);
4469 			DELAY(10);
4470 
4471 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4472 			    phy->phy_rev >= 2) {
4473 				phy812_val = bwi_phy812_value(mac, 0x100);
4474 				PHY_WRITE(mac, 0x812, phy812_val);
4475 			}
4476 			PHY_WRITE(mac, 0x15, 0xfff0);
4477 			DELAY(10);
4478 
4479 			test += PHY_READ(mac, 0x2d);
4480 
4481 			PHY_WRITE(mac, 0x58, 0);
4482 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4483 			    phy->phy_rev >= 2) {
4484 				phy812_val = bwi_phy812_value(mac, 0x101);
4485 				PHY_WRITE(mac, 0x812, phy812_val);
4486 			}
4487 			PHY_WRITE(mac, 0x15, 0xafb0);
4488 		}
4489 
4490 		++test;
4491 		test >>= 8;
4492 
4493 		if (test > test_lim)
4494 			break;
4495 	}
4496 	if (i > 15)
4497 		rf->rf_calib = rfr_78;
4498 	else
4499 		rf->rf_calib = calib;
4500 	if (rf->rf_calib != 0xffff) {
4501 		DPRINTF(1, "%s: RF calibration value: 0x%04x\n",
4502 		    sc->sc_dev.dv_xname, rf->rf_calib);
4503 		rf->rf_flags |= BWI_RF_F_INITED;
4504 	}
4505 
4506 	/*
4507 	 * Restore trashes registers
4508 	 */
4509 	PHY_WRITE(mac, save_phy_regs_comm[0], save_phy_comm[0]);
4510 
4511 	for (i = 0; i < SAVE_RF_MAX; ++i) {
4512 		int pos = (i + 1) % SAVE_RF_MAX;
4513 
4514 		RF_WRITE(mac, save_rf_regs[pos], save_rf[pos]);
4515 	}
4516 	for (i = 1; i < SAVE_PHY_COMM_MAX; ++i)
4517 		PHY_WRITE(mac, save_phy_regs_comm[i], save_phy_comm[i]);
4518 
4519 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
4520 	if (phy->phy_version != 0)
4521 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, rf_chan_ex);
4522 
4523 	PHY_WRITE(mac, 0x35, phyr_35);
4524 	bwi_rf_workaround(mac, rf->rf_curchan);
4525 
4526 	if (phy->phy_mode == IEEE80211_MODE_11B) {
4527 		PHY_WRITE(mac, 0x30, phyr_30);
4528 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
4529 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4530 		/* XXX Spec only says when PHY is linked (gmode) */
4531 		CSR_CLRBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
4532 
4533 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
4534 			PHY_WRITE(mac, save_phy_regs_11g[i],
4535 				  save_phy_11g[i]);
4536 		}
4537 
4538 		PHY_WRITE(mac, 0x80f, phyr_80f);
4539 		PHY_WRITE(mac, 0x810, phyr_810);
4540 	}
4541 
4542 #undef SAVE_PHY_11G_MAX
4543 #undef SAVE_PHY_COMM_MAX
4544 #undef SAVE_RF_MAX
4545 }
4546 
4547 uint16_t
4548 bwi_rf_calibval(struct bwi_mac *mac)
4549 {
4550 	uint16_t val, calib;
4551 	int idx;
4552 
4553 	/* http://bcm-specs.sipsolutions.net/RCCTable */
4554 	static const uint16_t rf_calibvals[] = {
4555 		0x2, 0x3, 0x1, 0xf, 0x6, 0x7, 0x5, 0xf,
4556 		0xa, 0xb, 0x9, 0xf, 0xe, 0xf, 0xd, 0xf
4557 	};
4558 
4559 	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
4560 	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
4561 	KASSERT(idx < (int)(sizeof(rf_calibvals) / sizeof(rf_calibvals[0])));
4562 
4563 	calib = rf_calibvals[idx] << 1;
4564 	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
4565 		calib |= 0x1;
4566 	calib |= 0x20;
4567 
4568 	return (calib);
4569 }
4570 
4571 int32_t
4572 _bwi_adjust_devide(int32_t num, int32_t den)
4573 {
4574 	if (num < 0)
4575 		return ((num / den));
4576 	else
4577 		return ((num + den / 2) / den);
4578 }
4579 
4580 /*
4581  * http://bcm-specs.sipsolutions.net/TSSI_to_DBM_Table
4582  * "calculating table entries"
4583  */
4584 int
4585 bwi_rf_calc_txpower(int8_t *txpwr, uint8_t idx, const int16_t pa_params[])
4586 {
4587 	int32_t m1, m2, f, dbm;
4588 	int i;
4589 
4590 	m1 = _bwi_adjust_devide(16 * pa_params[0] + idx * pa_params[1], 32);
4591 	m2 = imax(_bwi_adjust_devide(32768 + idx * pa_params[2], 256), 1);
4592 
4593 #define ITER_MAX	16
4594 	f = 256;
4595 	for (i = 0; i < ITER_MAX; ++i) {
4596 		int32_t q, d;
4597 
4598 		q = _bwi_adjust_devide(
4599 		    f * 4096 - _bwi_adjust_devide(m2 * f, 16) * f, 2048);
4600 		d = abs(q - f);
4601 		f = q;
4602 
4603 		if (d < 2)
4604 			break;
4605 	}
4606 	if (i == ITER_MAX)
4607 		return (EINVAL);
4608 #undef ITER_MAX
4609 
4610 	dbm = _bwi_adjust_devide(m1 * f, 8192);
4611 	if (dbm < -127)
4612 		dbm = -127;
4613 	else if (dbm > 128)
4614 		dbm = 128;
4615 
4616 	*txpwr = dbm;
4617 
4618 	return (0);
4619 }
4620 
4621 int
4622 bwi_rf_map_txpower(struct bwi_mac *mac)
4623 {
4624 	struct bwi_softc *sc = mac->mac_sc;
4625 	struct bwi_rf *rf = &mac->mac_rf;
4626 	struct bwi_phy *phy = &mac->mac_phy;
4627 	uint16_t sprom_ofs, val, mask;
4628 	int16_t pa_params[3];
4629 	int error = 0, i, ant_gain, reg_txpower_max;
4630 
4631 	/*
4632 	 * Find out max TX power
4633 	 */
4634 	val = bwi_read_sprom(sc, BWI_SPROM_MAX_TXPWR);
4635 	if (phy->phy_mode == IEEE80211_MODE_11A) {
4636 		rf->rf_txpower_max = __SHIFTOUT(val,
4637 		    BWI_SPROM_MAX_TXPWR_MASK_11A);
4638 	} else {
4639 		rf->rf_txpower_max = __SHIFTOUT(val,
4640 		    BWI_SPROM_MAX_TXPWR_MASK_11BG);
4641 
4642 		if ((sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) &&
4643 		    phy->phy_mode == IEEE80211_MODE_11G)
4644 			rf->rf_txpower_max -= 3;
4645 	}
4646 	if (rf->rf_txpower_max <= 0) {
4647 		printf("%s: invalid max txpower in sprom\n",
4648 		    sc->sc_dev.dv_xname);
4649 		rf->rf_txpower_max = 74;
4650 	}
4651 	DPRINTF(1, "%s: max txpower from sprom: %d dBm\n",
4652 	    sc->sc_dev.dv_xname, rf->rf_txpower_max);
4653 
4654 	/*
4655 	 * Find out region/domain max TX power, which is adjusted
4656 	 * by antenna gain and 1.5 dBm fluctuation as mentioned
4657 	 * in v3 spec.
4658 	 */
4659 	val = bwi_read_sprom(sc, BWI_SPROM_ANT_GAIN);
4660 	if (phy->phy_mode == IEEE80211_MODE_11A)
4661 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11A);
4662 	else
4663 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11BG);
4664 	if (ant_gain == 0xff) {
4665 		/* XXX why this always invalid? */
4666 		DPRINTF(1, "%s: invalid antenna gain in sprom\n",
4667 		    sc->sc_dev.dv_xname);
4668 		ant_gain = 2;
4669 	}
4670 	ant_gain *= 4;
4671 	DPRINTF(1, "%s: ant gain %d dBm\n", sc->sc_dev.dv_xname, ant_gain);
4672 
4673 	reg_txpower_max = 90 - ant_gain - 6;	/* XXX magic number */
4674 	DPRINTF(1, "%s: region/domain max txpower %d dBm\n",
4675 	    sc->sc_dev.dv_xname, reg_txpower_max);
4676 
4677 	/*
4678 	 * Force max TX power within region/domain TX power limit
4679 	 */
4680 	if (rf->rf_txpower_max > reg_txpower_max)
4681 		rf->rf_txpower_max = reg_txpower_max;
4682 	DPRINTF(1, "%s: max txpower %d dBm\n",
4683 	    sc->sc_dev.dv_xname, rf->rf_txpower_max);
4684 
4685 	/*
4686 	 * Create TSSI to TX power mapping
4687 	 */
4688 
4689 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301 &&
4690 	    rf->rf_type != BWI_RF_T_BCM2050) {
4691 		rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
4692 		bcopy(bwi_txpower_map_11b, rf->rf_txpower_map0,
4693 		      sizeof(rf->rf_txpower_map0));
4694 		goto back;
4695 	}
4696 
4697 #define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
4698 	/*
4699 	 * Extract PA parameters
4700 	 */
4701 	if (phy->phy_mode == IEEE80211_MODE_11A)
4702 		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
4703 	else
4704 		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
4705 	for (i = 0; i < nitems(pa_params); ++i)
4706 		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
4707 
4708 	for (i = 0; i < nitems(pa_params); ++i) {
4709 		/*
4710 		 * If one of the PA parameters from SPROM is not valid,
4711 		 * fall back to the default values, if there are any.
4712 		 */
4713 		if (!IS_VALID_PA_PARAM(pa_params[i])) {
4714 			const int8_t *txpower_map;
4715 
4716 			if (phy->phy_mode == IEEE80211_MODE_11A) {
4717 				printf("%s: no tssi2dbm table for 11a PHY\n",
4718 				    sc->sc_dev.dv_xname);
4719 				return (ENXIO);
4720 			}
4721 
4722 			if (phy->phy_mode == IEEE80211_MODE_11G) {
4723 				DPRINTF(1, "%s: use default 11g TSSI map\n",
4724 				    sc->sc_dev.dv_xname);
4725 				txpower_map = bwi_txpower_map_11g;
4726 			} else {
4727 				txpower_map = bwi_txpower_map_11b;
4728 			}
4729 
4730 			rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
4731 			bcopy(txpower_map, rf->rf_txpower_map0,
4732 			      sizeof(rf->rf_txpower_map0));
4733 			goto back;
4734 		}
4735 	}
4736 
4737 	/*
4738 	 * All of the PA parameters from SPROM are valid.
4739 	 */
4740 
4741 	/*
4742 	 * Extract idle TSSI from SPROM.
4743 	 */
4744 	val = bwi_read_sprom(sc, BWI_SPROM_IDLE_TSSI);
4745 	DPRINTF(1, "%s: sprom idle tssi: 0x%04x\n", sc->sc_dev.dv_xname, val);
4746 
4747 	if (phy->phy_mode == IEEE80211_MODE_11A)
4748 		mask = BWI_SPROM_IDLE_TSSI_MASK_11A;
4749 	else
4750 		mask = BWI_SPROM_IDLE_TSSI_MASK_11BG;
4751 
4752 	rf->rf_idle_tssi0 = (int)__SHIFTOUT(val, mask);
4753 	if (!IS_VALID_PA_PARAM(rf->rf_idle_tssi0))
4754 		rf->rf_idle_tssi0 = 62;
4755 
4756 #undef IS_VALID_PA_PARAM
4757 
4758 	/*
4759 	 * Calculate TX power map, which is indexed by TSSI
4760 	 */
4761 	DPRINTF(1, "%s: TSSI-TX power map:\n", sc->sc_dev.dv_xname);
4762 	for (i = 0; i < BWI_TSSI_MAX; ++i) {
4763 		error = bwi_rf_calc_txpower(&rf->rf_txpower_map0[i], i,
4764 					    pa_params);
4765 		if (error) {
4766 			printf("%s: bwi_rf_calc_txpower failed\n",
4767 			    sc->sc_dev.dv_xname);
4768 			break;
4769 		}
4770 		if (i != 0 && i % 8 == 0)
4771 			DPRINTF(1, "\n");
4772 		DPRINTF(1, "%d ", rf->rf_txpower_map0[i]);
4773 	}
4774 	DPRINTF(1, "\n");
4775 back:
4776 	DPRINTF(1, "%s: idle tssi0: %d\n",
4777 	    sc->sc_dev.dv_xname, rf->rf_idle_tssi0);
4778 
4779 	return (error);
4780 }
4781 
4782 void
4783 bwi_rf_lo_update_11g(struct bwi_mac *mac)
4784 {
4785 	struct bwi_softc *sc = mac->mac_sc;
4786 	struct ifnet *ifp = &sc->sc_ic.ic_if;
4787 	struct bwi_rf *rf = &mac->mac_rf;
4788 	struct bwi_phy *phy = &mac->mac_phy;
4789 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
4790 	struct rf_saveregs regs;
4791 	uint16_t ant_div, chan_ex;
4792 	uint8_t devi_ctrl;
4793 	uint orig_chan;
4794 
4795 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
4796 
4797 	/*
4798 	 * Save RF/PHY registers for later restoration
4799 	 */
4800 	orig_chan = rf->rf_curchan;
4801 	bzero(&regs, sizeof(regs));
4802 
4803 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4804 		SAVE_PHY_REG(mac, &regs, 429);
4805 		SAVE_PHY_REG(mac, &regs, 802);
4806 
4807 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
4808 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
4809 	}
4810 
4811 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
4812 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div | 0x8000);
4813 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
4814 
4815 	SAVE_PHY_REG(mac, &regs, 15);
4816 	SAVE_PHY_REG(mac, &regs, 2a);
4817 	SAVE_PHY_REG(mac, &regs, 35);
4818 	SAVE_PHY_REG(mac, &regs, 60);
4819 	SAVE_RF_REG(mac, &regs, 43);
4820 	SAVE_RF_REG(mac, &regs, 7a);
4821 	SAVE_RF_REG(mac, &regs, 52);
4822 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4823 		SAVE_PHY_REG(mac, &regs, 811);
4824 		SAVE_PHY_REG(mac, &regs, 812);
4825 		SAVE_PHY_REG(mac, &regs, 814);
4826 		SAVE_PHY_REG(mac, &regs, 815);
4827 	}
4828 
4829 	/* Force to channel 6 */
4830 	bwi_rf_set_chan(mac, 6, 0);
4831 
4832 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4833 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
4834 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
4835 		bwi_mac_dummy_xmit(mac);
4836 	}
4837 	RF_WRITE(mac, 0x43, 0x6);
4838 
4839 	bwi_phy_set_bbp_atten(mac, 2);
4840 
4841 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0);
4842 
4843 	PHY_WRITE(mac, 0x2e, 0x7f);
4844 	PHY_WRITE(mac, 0x80f, 0x78);
4845 	PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
4846 	RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
4847 	PHY_WRITE(mac, 0x2b, 0x203);
4848 	PHY_WRITE(mac, 0x2a, 0x8a3);
4849 
4850 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4851 		PHY_WRITE(mac, 0x814, regs.phy_814 | 0x3);
4852 		PHY_WRITE(mac, 0x815, regs.phy_815 & 0xfffc);
4853 		PHY_WRITE(mac, 0x811, 0x1b3);
4854 		PHY_WRITE(mac, 0x812, 0xb2);
4855 	}
4856 
4857 	if ((ifp->if_flags & IFF_RUNNING) == 0)
4858 		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
4859 	PHY_WRITE(mac, 0x80f, 0x8078);
4860 
4861 	/*
4862 	 * Measure all RF LO
4863 	 */
4864 	devi_ctrl = _bwi_rf_lo_update_11g(mac, regs.rf_7a);
4865 
4866 	/*
4867 	 * Restore saved RF/PHY registers
4868 	 */
4869 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4870 		PHY_WRITE(mac, 0x15, 0xe300);
4871 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa0);
4872 		DELAY(5);
4873 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa2);
4874 		DELAY(2);
4875 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa3);
4876 	} else
4877 		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
4878 
4879 	if ((ifp->if_flags & IFF_RUNNING) == 0)
4880 		tpctl = NULL;
4881 	bwi_rf_lo_adjust(mac, tpctl);
4882 
4883 	PHY_WRITE(mac, 0x2e, 0x807f);
4884 	if (phy->phy_flags & BWI_PHY_F_LINKED)
4885 		PHY_WRITE(mac, 0x2f, 0x202);
4886 	else
4887 		PHY_WRITE(mac, 0x2f, 0x101);
4888 
4889 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
4890 
4891 	RESTORE_PHY_REG(mac, &regs, 15);
4892 	RESTORE_PHY_REG(mac, &regs, 2a);
4893 	RESTORE_PHY_REG(mac, &regs, 35);
4894 	RESTORE_PHY_REG(mac, &regs, 60);
4895 
4896 	RESTORE_RF_REG(mac, &regs, 43);
4897 	RESTORE_RF_REG(mac, &regs, 7a);
4898 
4899 	regs.rf_52 &= 0xf0;
4900 	regs.rf_52 |= (RF_READ(mac, 0x52) & 0xf);
4901 	RF_WRITE(mac, 0x52, regs.rf_52);
4902 
4903 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
4904 
4905 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4906 		RESTORE_PHY_REG(mac, &regs, 811);
4907 		RESTORE_PHY_REG(mac, &regs, 812);
4908 		RESTORE_PHY_REG(mac, &regs, 814);
4909 		RESTORE_PHY_REG(mac, &regs, 815);
4910 		RESTORE_PHY_REG(mac, &regs, 429);
4911 		RESTORE_PHY_REG(mac, &regs, 802);
4912 	}
4913 
4914 	bwi_rf_set_chan(mac, orig_chan, 1);
4915 }
4916 
4917 uint32_t
4918 bwi_rf_lo_devi_measure(struct bwi_mac *mac, uint16_t ctrl)
4919 {
4920 	struct bwi_phy *phy = &mac->mac_phy;
4921 	uint32_t devi = 0;
4922 	int i;
4923 
4924 	if (phy->phy_flags & BWI_PHY_F_LINKED)
4925 		ctrl <<= 8;
4926 
4927 	for (i = 0; i < 8; ++i) {
4928 		if (phy->phy_flags & BWI_PHY_F_LINKED) {
4929 			PHY_WRITE(mac, 0x15, 0xe300);
4930 			PHY_WRITE(mac, 0x812, ctrl | 0xb0);
4931 			DELAY(5);
4932 			PHY_WRITE(mac, 0x812, ctrl | 0xb2);
4933 			DELAY(2);
4934 			PHY_WRITE(mac, 0x812, ctrl | 0xb3);
4935 			DELAY(4);
4936 			PHY_WRITE(mac, 0x15, 0xf300);
4937 		} else {
4938 			PHY_WRITE(mac, 0x15, ctrl | 0xefa0);
4939 			DELAY(2);
4940 			PHY_WRITE(mac, 0x15, ctrl | 0xefe0);
4941 			DELAY(4);
4942 			PHY_WRITE(mac, 0x15, ctrl | 0xffe0);
4943 		}
4944 		DELAY(8);
4945 		devi += PHY_READ(mac, 0x2d);
4946 	}
4947 
4948 	return (devi);
4949 }
4950 
4951 uint16_t
4952 bwi_rf_get_tp_ctrl2(struct bwi_mac *mac)
4953 {
4954 	uint32_t devi_min;
4955 	uint16_t tp_ctrl2 = 0;
4956 	int i;
4957 
4958 	RF_WRITE(mac, 0x52, 0);
4959 	DELAY(10);
4960 	devi_min = bwi_rf_lo_devi_measure(mac, 0);
4961 
4962 	for (i = 0; i < 16; ++i) {
4963 		uint32_t devi;
4964 
4965 		RF_WRITE(mac, 0x52, i);
4966 		DELAY(10);
4967 		devi = bwi_rf_lo_devi_measure(mac, 0);
4968 
4969 		if (devi < devi_min) {
4970 			devi_min = devi;
4971 			tp_ctrl2 = i;
4972 		}
4973 	}
4974 
4975 	return (tp_ctrl2);
4976 }
4977 
4978 uint8_t
4979 _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
4980 {
4981 #define RF_ATTEN_LISTSZ	14
4982 #define BBP_ATTEN_MAX	4	/* half */
4983 	struct ifnet *ifp = &mac->mac_sc->sc_ic.ic_if;
4984 	struct bwi_rf_lo lo_save, *lo;
4985 	uint8_t devi_ctrl = 0;
4986 	int idx, adj_rf7a = 0;
4987 
4988 	static const int rf_atten_list[RF_ATTEN_LISTSZ] =
4989 	    { 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 1, 2, 3, 4 };
4990 	static const int rf_atten_init_list[RF_ATTEN_LISTSZ] =
4991             { 0, 3, 1, 5, 7, 3, 2, 0, 4, 6, -1, -1, -1, -1 };
4992 	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
4993 	    { 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
4994 
4995 	bzero(&lo_save, sizeof(lo_save));
4996 	for (idx = 0; idx < RF_ATTEN_LISTSZ; ++idx) {
4997 		int init_rf_atten = rf_atten_init_list[idx];
4998 		int rf_atten = rf_atten_list[idx];
4999 		int bbp_atten;
5000 
5001 		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
5002 			uint16_t tp_ctrl2, rf7a;
5003 
5004 			if ((ifp->if_flags & IFF_RUNNING) == 0) {
5005 				if (idx == 0) {
5006 					bzero(&lo_save, sizeof(lo_save));
5007 				} else if (init_rf_atten < 0) {
5008 					lo = bwi_get_rf_lo(mac,
5009 					    rf_atten, 2 * bbp_atten);
5010 					bcopy(lo, &lo_save, sizeof(lo_save));
5011 				} else {
5012 					lo = bwi_get_rf_lo(mac,
5013 					    init_rf_atten, 0);
5014 					bcopy(lo, &lo_save, sizeof(lo_save));
5015 				}
5016 
5017 				devi_ctrl = 0;
5018 				adj_rf7a = 0;
5019 
5020 				/*
5021 				 * XXX
5022 				 * Linux driver overflows 'val'
5023 				 */
5024 				if (init_rf_atten >= 0) {
5025 					int val;
5026 
5027 					val = rf_atten * 2 + bbp_atten;
5028 					if (val > 14) {
5029 						adj_rf7a = 1;
5030 						if (val > 17)
5031 							devi_ctrl = 1;
5032 						if (val > 19)
5033 							devi_ctrl = 2;
5034 					}
5035 				}
5036 			} else {
5037 				lo = bwi_get_rf_lo(mac,
5038 					rf_atten, 2 * bbp_atten);
5039 				if (!bwi_rf_lo_isused(mac, lo))
5040 					continue;
5041 				bcopy(lo, &lo_save, sizeof(lo_save));
5042 
5043 				devi_ctrl = 3;
5044 				adj_rf7a = 0;
5045 			}
5046 
5047 			RF_WRITE(mac, BWI_RFR_ATTEN, rf_atten);
5048 
5049 			tp_ctrl2 = mac->mac_tpctl.tp_ctrl2;
5050 			if (init_rf_atten < 0)
5051 				tp_ctrl2 |= (3 << 4);
5052 			RF_WRITE(mac, BWI_RFR_TXPWR, tp_ctrl2);
5053 
5054 			DELAY(10);
5055 
5056 			bwi_phy_set_bbp_atten(mac, bbp_atten * 2);
5057 
5058 			rf7a = orig_rf7a & 0xfff0;
5059 			if (adj_rf7a)
5060 				rf7a |= 0x8;
5061 			RF_WRITE(mac, 0x7a, rf7a);
5062 
5063 			lo = bwi_get_rf_lo(mac,
5064 				rf_lo_measure_order[idx], bbp_atten * 2);
5065 			bwi_rf_lo_measure_11g(mac, &lo_save, lo, devi_ctrl);
5066 		}
5067 	}
5068 
5069 	return (devi_ctrl);
5070 
5071 #undef RF_ATTEN_LISTSZ
5072 #undef BBP_ATTEN_MAX
5073 }
5074 
5075 void
5076 bwi_rf_lo_measure_11g(struct bwi_mac *mac, const struct bwi_rf_lo *src_lo,
5077     struct bwi_rf_lo *dst_lo, uint8_t devi_ctrl)
5078 {
5079 #define LO_ADJUST_MIN	1
5080 #define LO_ADJUST_MAX	8
5081 #define LO_ADJUST(hi, lo)	{ .ctrl_hi = hi, .ctrl_lo = lo }
5082 	static const struct bwi_rf_lo rf_lo_adjust[LO_ADJUST_MAX] = {
5083 		LO_ADJUST(1,	1),
5084 		LO_ADJUST(1,	0),
5085 		LO_ADJUST(1,	-1),
5086 		LO_ADJUST(0,	-1),
5087 		LO_ADJUST(-1,	-1),
5088 		LO_ADJUST(-1,	0),
5089 		LO_ADJUST(-1,	1),
5090 		LO_ADJUST(0,	1)
5091 	};
5092 #undef LO_ADJUST
5093 
5094 	struct bwi_rf_lo lo_min;
5095 	uint32_t devi_min;
5096 	int found, loop_count, adjust_state;
5097 
5098 	bcopy(src_lo, &lo_min, sizeof(lo_min));
5099 	RF_LO_WRITE(mac, &lo_min);
5100 	devi_min = bwi_rf_lo_devi_measure(mac, devi_ctrl);
5101 
5102 	loop_count = 12;	/* XXX */
5103 	adjust_state = 0;
5104 	do {
5105 		struct bwi_rf_lo lo_base;
5106 		int i, fin;
5107 
5108 		found = 0;
5109 		if (adjust_state == 0) {
5110 			i = LO_ADJUST_MIN;
5111 			fin = LO_ADJUST_MAX;
5112 		} else if (adjust_state % 2 == 0) {
5113 			i = adjust_state - 1;
5114 			fin = adjust_state + 1;
5115 		} else {
5116 			i = adjust_state - 2;
5117 			fin = adjust_state + 2;
5118 		}
5119 
5120 		if (i < LO_ADJUST_MIN)
5121 			i += LO_ADJUST_MAX;
5122 		KASSERT(i <= LO_ADJUST_MAX && i >= LO_ADJUST_MIN);
5123 
5124 		if (fin > LO_ADJUST_MAX)
5125 			fin -= LO_ADJUST_MAX;
5126 		KASSERT(fin <= LO_ADJUST_MAX && fin >= LO_ADJUST_MIN);
5127 
5128 		bcopy(&lo_min, &lo_base, sizeof(lo_base));
5129 		for (;;) {
5130 			struct bwi_rf_lo lo;
5131 
5132 			lo.ctrl_hi = lo_base.ctrl_hi +
5133 				rf_lo_adjust[i - 1].ctrl_hi;
5134 			lo.ctrl_lo = lo_base.ctrl_lo +
5135 				rf_lo_adjust[i - 1].ctrl_lo;
5136 
5137 			if (abs(lo.ctrl_lo) < 9 && abs(lo.ctrl_hi) < 9) {
5138 				uint32_t devi;
5139 
5140 				RF_LO_WRITE(mac, &lo);
5141 				devi = bwi_rf_lo_devi_measure(mac, devi_ctrl);
5142 				if (devi < devi_min) {
5143 					devi_min = devi;
5144 					adjust_state = i;
5145 					found = 1;
5146 					bcopy(&lo, &lo_min, sizeof(lo_min));
5147 				}
5148 			}
5149 			if (i == fin)
5150 				break;
5151 			if (i == LO_ADJUST_MAX)
5152 				i = LO_ADJUST_MIN;
5153 			else
5154 				++i;
5155 		}
5156 	} while (loop_count-- && found);
5157 
5158 	bcopy(&lo_min, dst_lo, sizeof(*dst_lo));
5159 
5160 #undef LO_ADJUST_MIN
5161 #undef LO_ADJUST_MAX
5162 }
5163 
5164 void
5165 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *mac)
5166 {
5167 #define SAVE_RF_MAX	3
5168 #define SAVE_PHY_MAX	8
5169 	struct bwi_softc *sc = mac->mac_sc;
5170 	struct bwi_rf *rf = &mac->mac_rf;
5171 	struct bwi_phy *phy = &mac->mac_phy;
5172 	uint16_t save_rf[SAVE_RF_MAX];
5173 	uint16_t save_phy[SAVE_PHY_MAX];
5174 	uint16_t ant_div, bbp_atten, chan_ex;
5175 	int16_t nrssi[2];
5176 	int i;
5177 
5178 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
5179 	    { 0x7a, 0x52, 0x43 };
5180 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] =
5181 	    { 0x30, 0x26, 0x15, 0x2a, 0x20, 0x5a, 0x59, 0x58 };
5182 
5183 	/*
5184 	 * Save RF/PHY registers for later restoration
5185 	 */
5186 	for (i = 0; i < SAVE_RF_MAX; ++i)
5187 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5188 	for (i = 0; i < SAVE_PHY_MAX; ++i)
5189 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
5190 
5191 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
5192 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
5193 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
5194 
5195 	/*
5196 	 * Calculate nrssi0
5197 	 */
5198 	if (phy->phy_rev >= 5)
5199 		RF_CLRBITS(mac, 0x7a, 0xff80);
5200 	else
5201 		RF_CLRBITS(mac, 0x7a, 0xfff0);
5202 	PHY_WRITE(mac, 0x30, 0xff);
5203 
5204 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x7f7f);
5205 
5206 	PHY_WRITE(mac, 0x26, 0);
5207 	PHY_SETBITS(mac, 0x15, 0x20);
5208 	PHY_WRITE(mac, 0x2a, 0x8a3);
5209 	RF_SETBITS(mac, 0x7a, 0x80);
5210 
5211 	nrssi[0] = (int16_t)PHY_READ(mac, 0x27);
5212 
5213 	/*
5214 	 * Calculate nrssi1
5215 	 */
5216 	RF_CLRBITS(mac, 0x7a, 0xff80);
5217 	if (phy->phy_version >= 2)
5218 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x40);
5219 	else if (phy->phy_version == 0)
5220 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
5221 	else
5222 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0xdfff);
5223 
5224 	PHY_WRITE(mac, 0x20, 0x3f3f);
5225 	PHY_WRITE(mac, 0x15, 0xf330);
5226 
5227 	RF_WRITE(mac, 0x5a, 0x60);
5228 	RF_CLRBITS(mac, 0x43, 0xff0f);
5229 
5230 	PHY_WRITE(mac, 0x5a, 0x480);
5231 	PHY_WRITE(mac, 0x59, 0x810);
5232 	PHY_WRITE(mac, 0x58, 0xd);
5233 
5234 	DELAY(20);
5235 
5236 	nrssi[1] = (int16_t)PHY_READ(mac, 0x27);
5237 
5238 	/*
5239 	 * Restore saved RF/PHY registers
5240 	 */
5241 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
5242 	RF_WRITE(mac, save_rf_regs[0], save_rf[0]);
5243 
5244 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
5245 
5246 	for (i = 1; i < 4; ++i)
5247 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
5248 
5249 	bwi_rf_workaround(mac, rf->rf_curchan);
5250 
5251 	if (phy->phy_version != 0)
5252 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
5253 
5254 	for (; i < SAVE_PHY_MAX; ++i)
5255 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
5256 
5257 	for (i = 1; i < SAVE_RF_MAX; ++i)
5258 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5259 
5260 	/*
5261 	 * Install calculated narrow RSSI values
5262 	 */
5263 	if (nrssi[0] == nrssi[1])
5264 		rf->rf_nrssi_slope = 0x10000;
5265 	else
5266 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
5267 	if (nrssi[0] <= -4) {
5268 		rf->rf_nrssi[0] = nrssi[0];
5269 		rf->rf_nrssi[1] = nrssi[1];
5270 	}
5271 
5272 #undef SAVE_RF_MAX
5273 #undef SAVE_PHY_MAX
5274 }
5275 
5276 void
5277 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *mac)
5278 {
5279 #define SAVE_RF_MAX		2
5280 #define SAVE_PHY_COMM_MAX	10
5281 #define SAVE_PHY6_MAX		8
5282 	struct bwi_phy *phy = &mac->mac_phy;
5283 	uint16_t save_rf[SAVE_RF_MAX];
5284 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
5285 	uint16_t save_phy6[SAVE_PHY6_MAX];
5286 	uint16_t rf7b = 0xffff;
5287 	int16_t nrssi;
5288 	int i, phy6_idx = 0;
5289 
5290 	static const uint16_t save_rf_regs[SAVE_RF_MAX] = { 0x7a, 0x43 };
5291 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
5292 		0x0001, 0x0811, 0x0812, 0x0814,
5293 		0x0815, 0x005a, 0x0059, 0x0058,
5294 		0x000a, 0x0003
5295 	};
5296 	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
5297 		0x002e, 0x002f, 0x080f, 0x0810,
5298 		0x0801, 0x0060, 0x0014, 0x0478
5299 	};
5300 
5301 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5302 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
5303 	for (i = 0; i < SAVE_RF_MAX; ++i)
5304 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5305 
5306 	PHY_CLRBITS(mac, 0x429, 0x8000);
5307 	PHY_FILT_SETBITS(mac, 0x1, 0x3fff, 0x4000);
5308 	PHY_SETBITS(mac, 0x811, 0xc);
5309 	PHY_FILT_SETBITS(mac, 0x812, 0xfff3, 0x4);
5310 	PHY_CLRBITS(mac, 0x802, 0x3);
5311 
5312 	if (phy->phy_rev >= 6) {
5313 		for (i = 0; i < SAVE_PHY6_MAX; ++i)
5314 			save_phy6[i] = PHY_READ(mac, save_phy6_regs[i]);
5315 
5316 		PHY_WRITE(mac, 0x2e, 0);
5317 		PHY_WRITE(mac, 0x2f, 0);
5318 		PHY_WRITE(mac, 0x80f, 0);
5319 		PHY_WRITE(mac, 0x810, 0);
5320 		PHY_SETBITS(mac, 0x478, 0x100);
5321 		PHY_SETBITS(mac, 0x801, 0x40);
5322 		PHY_SETBITS(mac, 0x60, 0x40);
5323 		PHY_SETBITS(mac, 0x14, 0x200);
5324 	}
5325 
5326 	RF_SETBITS(mac, 0x7a, 0x70);
5327 	RF_SETBITS(mac, 0x7a, 0x80);
5328 
5329 	DELAY(30);
5330 
5331 	nrssi = bwi_nrssi_11g(mac);
5332 	if (nrssi == 31) {
5333 		for (i = 7; i >= 4; --i) {
5334 			RF_WRITE(mac, 0x7b, i);
5335 			DELAY(20);
5336 			nrssi = bwi_nrssi_11g(mac);
5337 			if (nrssi < 31 && rf7b == 0xffff)
5338 				rf7b = i;
5339 		}
5340 		if (rf7b == 0xffff)
5341 			rf7b = 4;
5342 	} else {
5343 		struct bwi_gains gains;
5344 
5345 		RF_CLRBITS(mac, 0x7a, 0xff80);
5346 
5347 		PHY_SETBITS(mac, 0x814, 0x1);
5348 		PHY_CLRBITS(mac, 0x815, 0x1);
5349 		PHY_SETBITS(mac, 0x811, 0xc);
5350 		PHY_SETBITS(mac, 0x812, 0xc);
5351 		PHY_SETBITS(mac, 0x811, 0x30);
5352 		PHY_SETBITS(mac, 0x812, 0x30);
5353 		PHY_WRITE(mac, 0x5a, 0x480);
5354 		PHY_WRITE(mac, 0x59, 0x810);
5355 		PHY_WRITE(mac, 0x58, 0xd);
5356 		if (phy->phy_version == 0)
5357 			PHY_WRITE(mac, 0x3, 0x122);
5358 		else
5359 			PHY_SETBITS(mac, 0xa, 0x2000);
5360 		PHY_SETBITS(mac, 0x814, 0x4);
5361 		PHY_CLRBITS(mac, 0x815, 0x4);
5362 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
5363 		RF_SETBITS(mac, 0x7a, 0xf);
5364 
5365 		bzero(&gains, sizeof(gains));
5366 		gains.tbl_gain1 = 3;
5367 		gains.tbl_gain2 = 0;
5368 		gains.phy_gain = 1;
5369 		bwi_set_gains(mac, &gains);
5370 
5371 		RF_FILT_SETBITS(mac, 0x43, 0xf0, 0xf);
5372 		DELAY(30);
5373 
5374 		nrssi = bwi_nrssi_11g(mac);
5375 		if (nrssi == -32) {
5376 			for (i = 0; i < 4; ++i) {
5377 				RF_WRITE(mac, 0x7b, i);
5378 				DELAY(20);
5379 				nrssi = bwi_nrssi_11g(mac);
5380 				if (nrssi > -31 && rf7b == 0xffff)
5381 					rf7b = i;
5382 			}
5383 			if (rf7b == 0xffff)
5384 				rf7b = 3;
5385 		} else {
5386 			rf7b = 0;
5387 		}
5388 	}
5389 	RF_WRITE(mac, 0x7b, rf7b);
5390 
5391 	/*
5392 	 * Restore saved RF/PHY registers
5393 	 */
5394 	if (phy->phy_rev >= 6) {
5395 		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
5396 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
5397 			    save_phy6[phy6_idx]);
5398 		}
5399 	}
5400 
5401 	/* Saved PHY registers 0, 1, 2 are handled later */
5402 	for (i = 3; i < SAVE_PHY_COMM_MAX; ++i)
5403 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
5404 
5405 	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
5406 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5407 
5408 	PHY_SETBITS(mac, 0x802, 0x3);
5409 	PHY_SETBITS(mac, 0x429, 0x8000);
5410 
5411 	bwi_set_gains(mac, NULL);
5412 
5413 	if (phy->phy_rev >= 6) {
5414 		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
5415 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
5416 			    save_phy6[phy6_idx]);
5417 		}
5418 	}
5419 
5420 	PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
5421 	PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
5422 	PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
5423 
5424 #undef SAVE_RF_MAX
5425 #undef SAVE_PHY_COMM_MAX
5426 #undef SAVE_PHY6_MAX
5427 }
5428 
5429 void
5430 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *mac)
5431 {
5432 #define SAVE_RF_MAX		3
5433 #define SAVE_PHY_COMM_MAX	4
5434 #define SAVE_PHY3_MAX		8
5435 	struct bwi_softc *sc = mac->mac_sc;
5436 	struct bwi_phy *phy = &mac->mac_phy;
5437 	struct bwi_rf *rf = &mac->mac_rf;
5438 	uint16_t save_rf[SAVE_RF_MAX];
5439 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
5440 	uint16_t save_phy3[SAVE_PHY3_MAX];
5441 	uint16_t ant_div, bbp_atten, chan_ex;
5442 	struct bwi_gains gains;
5443 	int16_t nrssi[2];
5444 	int i, phy3_idx = 0;
5445 
5446 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
5447 	    { 0x7a, 0x52, 0x43 };
5448 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
5449 	    { 0x15, 0x5a, 0x59, 0x58 };
5450 	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
5451 		0x002e, 0x002f, 0x080f, 0x0810,
5452 		0x0801, 0x0060, 0x0014, 0x0478
5453 	};
5454 
5455 	if (rf->rf_rev >= 9)
5456 		return;
5457 	else if (rf->rf_rev == 8)
5458 		bwi_rf_set_nrssi_ofs_11g(mac);
5459 
5460 	PHY_CLRBITS(mac, 0x429, 0x8000);
5461 	PHY_CLRBITS(mac, 0x802, 0x3);
5462 
5463 	/*
5464 	 * Save RF/PHY registers for later restoration
5465 	 */
5466 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
5467 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
5468 
5469 	for (i = 0; i < SAVE_RF_MAX; ++i)
5470 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5471 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5472 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
5473 
5474 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
5475 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
5476 
5477 	if (phy->phy_rev >= 3) {
5478 		for (i = 0; i < SAVE_PHY3_MAX; ++i)
5479 			save_phy3[i] = PHY_READ(mac, save_phy3_regs[i]);
5480 
5481 		PHY_WRITE(mac, 0x2e, 0);
5482 		PHY_WRITE(mac, 0x810, 0);
5483 
5484 		if (phy->phy_rev == 4 || phy->phy_rev == 6 ||
5485 		    phy->phy_rev == 7) {
5486 			PHY_SETBITS(mac, 0x478, 0x100);
5487 			PHY_SETBITS(mac, 0x810, 0x40);
5488 		} else if (phy->phy_rev == 3 || phy->phy_rev == 5)
5489 			PHY_CLRBITS(mac, 0x810, 0x40);
5490 
5491 		PHY_SETBITS(mac, 0x60, 0x40);
5492 		PHY_SETBITS(mac, 0x14, 0x200);
5493 	}
5494 
5495 	/*
5496 	 * Calculate nrssi0
5497 	 */
5498 	RF_SETBITS(mac, 0x7a, 0x70);
5499 
5500 	bzero(&gains, sizeof(gains));
5501 	gains.tbl_gain1 = 0;
5502 	gains.tbl_gain2 = 8;
5503 	gains.phy_gain = 0;
5504 	bwi_set_gains(mac, &gains);
5505 
5506 	RF_CLRBITS(mac, 0x7a, 0xff08);
5507 	if (phy->phy_rev >= 2) {
5508 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x30);
5509 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
5510 	}
5511 
5512 	RF_SETBITS(mac, 0x7a, 0x80);
5513 	DELAY(20);
5514 	nrssi[0] = bwi_nrssi_11g(mac);
5515 
5516 	/*
5517 	 * Calculate nrssi1
5518 	 */
5519 	RF_CLRBITS(mac, 0x7a, 0xff80);
5520 	if (phy->phy_version >= 2)
5521 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
5522 	CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
5523 
5524 	RF_SETBITS(mac, 0x7a, 0xf);
5525 	PHY_WRITE(mac, 0x15, 0xf330);
5526 	if (phy->phy_rev >= 2) {
5527 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x20);
5528 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x20);
5529 	}
5530 
5531 	bzero(&gains, sizeof(gains));
5532 	gains.tbl_gain1 = 3;
5533 	gains.tbl_gain2 = 0;
5534 	gains.phy_gain = 1;
5535 	bwi_set_gains(mac, &gains);
5536 
5537 	if (rf->rf_rev == 8) {
5538 		RF_WRITE(mac, 0x43, 0x1f);
5539 	} else {
5540 		RF_FILT_SETBITS(mac, 0x52, 0xff0f, 0x60);
5541 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
5542 	}
5543 	PHY_WRITE(mac, 0x5a, 0x480);
5544 	PHY_WRITE(mac, 0x59, 0x810);
5545 	PHY_WRITE(mac, 0x58, 0xd);
5546 	DELAY(20);
5547 
5548 	nrssi[1] = bwi_nrssi_11g(mac);
5549 
5550 	/*
5551 	 * Install calculated narrow RSSI values
5552 	 */
5553 	if (nrssi[1] == nrssi[0])
5554 		rf->rf_nrssi_slope = 0x10000;
5555 	else
5556 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
5557 	if (nrssi[0] >= -4) {
5558 		rf->rf_nrssi[0] = nrssi[1];
5559 		rf->rf_nrssi[1] = nrssi[0];
5560 	}
5561 
5562 	/*
5563 	 * Restore saved RF/PHY registers
5564 	 */
5565 	if (phy->phy_rev >= 3) {
5566 		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
5567 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
5568 				  save_phy3[phy3_idx]);
5569 		}
5570 	}
5571 	if (phy->phy_rev >= 2) {
5572 		PHY_CLRBITS(mac, 0x812, 0x30);
5573 		PHY_CLRBITS(mac, 0x811, 0x30);
5574 	}
5575 
5576 	for (i = 0; i < SAVE_RF_MAX; ++i)
5577 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5578 
5579 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
5580 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
5581 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
5582 
5583 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5584 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
5585 
5586 	bwi_rf_workaround(mac, rf->rf_curchan);
5587 	PHY_SETBITS(mac, 0x802, 0x3);
5588 	bwi_set_gains(mac, NULL);
5589 	PHY_SETBITS(mac, 0x429, 0x8000);
5590 
5591 	if (phy->phy_rev >= 3) {
5592 		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
5593 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
5594 			    save_phy3[phy3_idx]);
5595 		}
5596 	}
5597 
5598 	bwi_rf_init_sw_nrssi_table(mac);
5599 	bwi_rf_set_nrssi_thr_11g(mac);
5600 
5601 #undef SAVE_RF_MAX
5602 #undef SAVE_PHY_COMM_MAX
5603 #undef SAVE_PHY3_MAX
5604 }
5605 
5606 void
5607 bwi_rf_init_sw_nrssi_table(struct bwi_mac *mac)
5608 {
5609 	struct bwi_rf *rf = &mac->mac_rf;
5610 	int d, i;
5611 
5612 	d = 0x1f - rf->rf_nrssi[0];
5613 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
5614 		int val;
5615 
5616 		val = (((i - d) * rf->rf_nrssi_slope) / 0x10000) + 0x3a;
5617 		if (val < 0)
5618 			val = 0;
5619 		else if (val > 0x3f)
5620 			val = 0x3f;
5621 
5622 		rf->rf_nrssi_table[i] = val;
5623 	}
5624 }
5625 
5626 void
5627 bwi_rf_init_hw_nrssi_table(struct bwi_mac *mac, uint16_t adjust)
5628 {
5629 	int i;
5630 
5631 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
5632 		int16_t val;
5633 
5634 		val = bwi_nrssi_read(mac, i);
5635 
5636 		val -= adjust;
5637 		if (val < -32)
5638 			val = -32;
5639 		else if (val > 31)
5640 			val = 31;
5641 
5642 		bwi_nrssi_write(mac, i, val);
5643 	}
5644 }
5645 
5646 void
5647 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *mac)
5648 {
5649 	struct bwi_rf *rf = &mac->mac_rf;
5650 	int32_t thr;
5651 
5652 	if (rf->rf_type != BWI_RF_T_BCM2050 ||
5653 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0)
5654 		return;
5655 
5656 	/*
5657 	 * Calculate nrssi threshold
5658 	 */
5659 	if (rf->rf_rev >= 6) {
5660 		thr = (rf->rf_nrssi[1] - rf->rf_nrssi[0]) * 32;
5661 		thr += 20 * (rf->rf_nrssi[0] + 1);
5662 		thr /= 40;
5663 	} else {
5664 		thr = rf->rf_nrssi[1] - 5;
5665 	}
5666 	if (thr < 0)
5667 		thr = 0;
5668 	else if (thr > 0x3e)
5669 		thr = 0x3e;
5670 
5671 	PHY_READ(mac, BWI_PHYR_NRSSI_THR_11B);	/* dummy read */
5672 	PHY_WRITE(mac, BWI_PHYR_NRSSI_THR_11B, (((uint16_t)thr) << 8) | 0x1c);
5673 
5674 	if (rf->rf_rev >= 6) {
5675 		PHY_WRITE(mac, 0x87, 0xe0d);
5676 		PHY_WRITE(mac, 0x86, 0xc0b);
5677 		PHY_WRITE(mac, 0x85, 0xa09);
5678 		PHY_WRITE(mac, 0x84, 0x808);
5679 		PHY_WRITE(mac, 0x83, 0x808);
5680 		PHY_WRITE(mac, 0x82, 0x604);
5681 		PHY_WRITE(mac, 0x81, 0x302);
5682 		PHY_WRITE(mac, 0x80, 0x100);
5683 	}
5684 }
5685 
5686 int32_t
5687 _nrssi_threshold(const struct bwi_rf *rf, int32_t val)
5688 {
5689 	val *= (rf->rf_nrssi[1] - rf->rf_nrssi[0]);
5690 	val += (rf->rf_nrssi[0] << 6);
5691 	if (val < 32)
5692 		val += 31;
5693 	else
5694 		val += 32;
5695 	val >>= 6;
5696 	if (val < -31)
5697 		val = -31;
5698 	else if (val > 31)
5699 		val = 31;
5700 
5701 	return (val);
5702 }
5703 
5704 void
5705 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *mac)
5706 {
5707 	int32_t thr1, thr2;
5708 	uint16_t thr;
5709 
5710 	/*
5711 	 * Find the two nrssi thresholds
5712 	 */
5713 	if ((mac->mac_phy.phy_flags & BWI_PHY_F_LINKED) == 0 ||
5714 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
5715 	    	int16_t nrssi;
5716 
5717 		nrssi = bwi_nrssi_read(mac, 0x20);
5718 		if (nrssi >= 32)
5719 			nrssi -= 64;
5720 
5721 		if (nrssi < 3) {
5722 			thr1 = 0x2b;
5723 			thr2 = 0x27;
5724 		} else {
5725 			thr1 = 0x2d;
5726 			thr2 = 0x2b;
5727 		}
5728 	} else {
5729 		/* TODO Interfere mode */
5730 		thr1 = _nrssi_threshold(&mac->mac_rf, 0x11);
5731 		thr2 = _nrssi_threshold(&mac->mac_rf, 0xe);
5732 	}
5733 
5734 #define NRSSI_THR1_MASK		0x003f
5735 #define NRSSI_THR2_MASK		0x0fc0
5736 	thr = __SHIFTIN((uint32_t)thr1, NRSSI_THR1_MASK) |
5737 	    __SHIFTIN((uint32_t)thr2, NRSSI_THR2_MASK);
5738 	PHY_FILT_SETBITS(mac, BWI_PHYR_NRSSI_THR_11G, 0xf000, thr);
5739 #undef NRSSI_THR1_MASK
5740 #undef NRSSI_THR2_MASK
5741 }
5742 
5743 void
5744 bwi_rf_clear_tssi(struct bwi_mac *mac)
5745 {
5746 	/* XXX use function pointer */
5747 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
5748 		/* TODO: 11A */
5749 	} else {
5750 		uint16_t val;
5751 		int i;
5752 
5753 		val = __SHIFTIN(BWI_INVALID_TSSI, BWI_LO_TSSI_MASK) |
5754 		    __SHIFTIN(BWI_INVALID_TSSI, BWI_HI_TSSI_MASK);
5755 
5756 		for (i = 0; i < 2; ++i) {
5757 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
5758 			    BWI_COMM_MOBJ_TSSI_DS + (i * 2), val);
5759 		}
5760 
5761 		for (i = 0; i < 2; ++i) {
5762 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
5763 			    BWI_COMM_MOBJ_TSSI_OFDM + (i * 2), val);
5764 		}
5765 	}
5766 }
5767 
5768 void
5769 bwi_rf_clear_state(struct bwi_rf *rf)
5770 {
5771 	int i;
5772 
5773 	rf->rf_flags &= ~BWI_RF_CLEAR_FLAGS;
5774 	bzero(rf->rf_lo, sizeof(rf->rf_lo));
5775 	bzero(rf->rf_lo_used, sizeof(rf->rf_lo_used));
5776 
5777 	rf->rf_nrssi_slope = 0;
5778 	rf->rf_nrssi[0] = BWI_INVALID_NRSSI;
5779 	rf->rf_nrssi[1] = BWI_INVALID_NRSSI;
5780 
5781 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i)
5782 		rf->rf_nrssi_table[i] = i;
5783 
5784 	rf->rf_lo_gain = 0;
5785 	rf->rf_rx_gain = 0;
5786 
5787 	bcopy(rf->rf_txpower_map0, rf->rf_txpower_map,
5788 	      sizeof(rf->rf_txpower_map));
5789 	rf->rf_idle_tssi = rf->rf_idle_tssi0;
5790 }
5791 
5792 void
5793 bwi_rf_on_11a(struct bwi_mac *mac)
5794 {
5795 	/* TODO: 11A */
5796 }
5797 
5798 void
5799 bwi_rf_on_11bg(struct bwi_mac *mac)
5800 {
5801 	struct bwi_phy *phy = &mac->mac_phy;
5802 
5803 	PHY_WRITE(mac, 0x15, 0x8000);
5804 	PHY_WRITE(mac, 0x15, 0xcc00);
5805 	if (phy->phy_flags & BWI_PHY_F_LINKED)
5806 		PHY_WRITE(mac, 0x15, 0xc0);
5807 	else
5808 		PHY_WRITE(mac, 0x15, 0);
5809 
5810 	bwi_rf_set_chan(mac, 6 /* XXX */, 1);
5811 }
5812 
5813 void
5814 bwi_rf_set_ant_mode(struct bwi_mac *mac, int ant_mode)
5815 {
5816 	struct bwi_softc *sc = mac->mac_sc;
5817 	struct bwi_phy *phy = &mac->mac_phy;
5818 	uint16_t val;
5819 
5820 	KASSERT(ant_mode == BWI_ANT_MODE_0 ||
5821 	    ant_mode == BWI_ANT_MODE_1 ||
5822 	    ant_mode == BWI_ANT_MODE_AUTO);
5823 
5824 	HFLAGS_CLRBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
5825 
5826 	if (phy->phy_mode == IEEE80211_MODE_11B) {
5827 		/* NOTE: v4/v3 conflicts, take v3 */
5828 		if (mac->mac_rev == 2)
5829 			val = BWI_ANT_MODE_AUTO;
5830 		else
5831 			val = ant_mode;
5832 		val <<= 7;
5833 		PHY_FILT_SETBITS(mac, 0x3e2, 0xfe7f, val);
5834 	} else {	/* 11a/g */
5835 		/* XXX reg/value naming */
5836 		val = ant_mode << 7;
5837 		PHY_FILT_SETBITS(mac, 0x401, 0x7e7f, val);
5838 
5839 		if (ant_mode == BWI_ANT_MODE_AUTO)
5840 			PHY_CLRBITS(mac, 0x42b, 0x100);
5841 
5842 		if (phy->phy_mode == IEEE80211_MODE_11A) {
5843 			/* TODO: 11A */
5844 		} else {	/* 11g */
5845 			if (ant_mode == BWI_ANT_MODE_AUTO)
5846 				PHY_SETBITS(mac, 0x48c, 0x2000);
5847 			else
5848 				PHY_CLRBITS(mac, 0x48c, 0x2000);
5849 
5850 			if (phy->phy_rev >= 2) {
5851 				PHY_SETBITS(mac, 0x461, 0x10);
5852 				PHY_FILT_SETBITS(mac, 0x4ad, 0xff00, 0x15);
5853 				if (phy->phy_rev == 2) {
5854 					PHY_WRITE(mac, 0x427, 0x8);
5855 				} else {
5856 					PHY_FILT_SETBITS(mac, 0x427,
5857 							 0xff00, 0x8);
5858 				}
5859 
5860 				if (phy->phy_rev >= 6)
5861 					PHY_WRITE(mac, 0x49b, 0xdc);
5862 			}
5863 		}
5864 	}
5865 
5866 	/* XXX v4 set AUTO_ANTDIV unconditionally */
5867 	if (ant_mode == BWI_ANT_MODE_AUTO)
5868 		HFLAGS_SETBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
5869 
5870 	val = ant_mode << 8;
5871 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_BEACON,
5872 	    0xfc3f, val);
5873 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_ACK,
5874 	    0xfc3f, val);
5875 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_PROBE_RESP,
5876 	    0xfc3f, val);
5877 
5878 	/* XXX what's these */
5879 	if (phy->phy_mode == IEEE80211_MODE_11B)
5880 		CSR_SETBITS_2(sc, 0x5e, 0x4);
5881 
5882 	CSR_WRITE_4(sc, 0x100, 0x1000000);
5883 	if (mac->mac_rev < 5)
5884 		CSR_WRITE_4(sc, 0x10c, 0x1000000);
5885 
5886 	mac->mac_rf.rf_ant_mode = ant_mode;
5887 }
5888 
5889 int
5890 bwi_rf_get_latest_tssi(struct bwi_mac *mac, int8_t tssi[], uint16_t ofs)
5891 {
5892 	int i;
5893 
5894 	for (i = 0; i < 4; ) {
5895 		uint16_t val;
5896 
5897 		val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs + i);
5898 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_LO_TSSI_MASK);
5899 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_HI_TSSI_MASK);
5900 	}
5901 
5902 	for (i = 0; i < 4; ++i) {
5903 		if (tssi[i] == BWI_INVALID_TSSI)
5904 			return (EINVAL);
5905 	}
5906 
5907 	return (0);
5908 }
5909 
5910 int
5911 bwi_rf_tssi2dbm(struct bwi_mac *mac, int8_t tssi, int8_t *txpwr)
5912 {
5913 	struct bwi_rf *rf = &mac->mac_rf;
5914 	int pwr_idx;
5915 
5916 	pwr_idx = rf->rf_idle_tssi + (int)tssi - rf->rf_base_tssi;
5917 #if 0
5918 	if (pwr_idx < 0 || pwr_idx >= BWI_TSSI_MAX)
5919 		return EINVAL;
5920 #else
5921 	if (pwr_idx < 0)
5922 		pwr_idx = 0;
5923 	else if (pwr_idx >= BWI_TSSI_MAX)
5924 		pwr_idx = BWI_TSSI_MAX - 1;
5925 #endif
5926 	*txpwr = rf->rf_txpower_map[pwr_idx];
5927 
5928 	return (0);
5929 }
5930 
5931 int
5932 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
5933 {
5934 	uint16_t flags1, flags3;
5935 	int rssi, lna_gain;
5936 
5937 	rssi = hdr->rxh_rssi;
5938 	flags1 = letoh16(hdr->rxh_flags1);
5939 	flags3 = letoh16(hdr->rxh_flags3);
5940 
5941 #define NEW_BCM2050_RSSI
5942 #ifdef NEW_BCM2050_RSSI
5943 	if (flags1 & BWI_RXH_F1_OFDM) {
5944 		if (rssi > 127)
5945 			rssi -= 256;
5946 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
5947 			rssi += 17;
5948 		else
5949 			rssi -= 4;
5950 		return (rssi);
5951 	}
5952 
5953 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
5954 		struct bwi_rf *rf = &mac->mac_rf;
5955 
5956 		if (rssi >= BWI_NRSSI_TBLSZ)
5957 			rssi = BWI_NRSSI_TBLSZ - 1;
5958 
5959 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
5960 		rssi -= 67;
5961 	} else {
5962 		rssi = ((31 - rssi) * -149) / 128;
5963 		rssi -= 68;
5964 	}
5965 
5966 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
5967 		return (rssi);
5968 
5969 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
5970 		rssi += 20;
5971 
5972 	lna_gain = __SHIFTOUT(letoh16(hdr->rxh_phyinfo),
5973 	    BWI_RXH_PHYINFO_LNAGAIN);
5974 	DPRINTF(3, "lna_gain %d, phyinfo 0x%04x\n",
5975 	    lna_gain, letoh16(hdr->rxh_phyinfo));
5976 	switch (lna_gain) {
5977 	case 0:
5978 		rssi += 27;
5979 		break;
5980 	case 1:
5981 		rssi += 6;
5982 		break;
5983 	case 2:
5984 		rssi += 12;
5985 		break;
5986 	case 3:
5987 		/*
5988 		 * XXX
5989 		 * According to v3 spec, we should do _nothing_ here,
5990 		 * but it seems that the result RSSI will be too low
5991 		 * (relative to what ath(4) says).  Raise it a little
5992 		 * bit.
5993 		 */
5994 		rssi += 5;
5995 		break;
5996 	default:
5997 		panic("impossible lna gain %d", lna_gain);
5998 	}
5999 #else	/* !NEW_BCM2050_RSSI */
6000 	lna_gain = 0; /* shut up gcc warning */
6001 
6002 	if (flags1 & BWI_RXH_F1_OFDM) {
6003 		if (rssi > 127)
6004 			rssi -= 256;
6005 		rssi = (rssi * 73) / 64;
6006 
6007 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
6008 			rssi += 25;
6009 		else
6010 			rssi -= 3;
6011 		return (rssi);
6012 	}
6013 
6014 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
6015 		struct bwi_rf *rf = &mac->mac_rf;
6016 
6017 		if (rssi >= BWI_NRSSI_TBLSZ)
6018 			rssi = BWI_NRSSI_TBLSZ - 1;
6019 
6020 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
6021 		rssi -= 57;
6022 	} else {
6023 		rssi = ((31 - rssi) * -149) / 128;
6024 		rssi -= 68;
6025 	}
6026 
6027 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
6028 		return (rssi);
6029 
6030 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
6031 		rssi += 25;
6032 #endif	/* NEW_BCM2050_RSSI */
6033 	return (rssi);
6034 }
6035 
6036 int
6037 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
6038 {
6039 	uint16_t flags1;
6040 	int rssi;
6041 
6042 	rssi = (((int)hdr->rxh_rssi - 11) * 103) / 64;
6043 
6044 	flags1 = letoh16(hdr->rxh_flags1);
6045 	if (flags1 & BWI_RXH_F1_BCM2053_RSSI)
6046 		rssi -= 109;
6047 	else
6048 		rssi -= 83;
6049 
6050 	return (rssi);
6051 }
6052 
6053 int
6054 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
6055 {
6056 	int rssi;
6057 
6058 	rssi = hdr->rxh_rssi;
6059 	if (rssi > 127)
6060 		rssi -= 256;
6061 
6062 	return (rssi);
6063 }
6064 
6065 uint16_t
6066 bwi_rf_lo_measure_11b(struct bwi_mac *mac)
6067 {
6068 	uint16_t val;
6069 	int i;
6070 
6071 	val = 0;
6072 	for (i = 0; i < 10; ++i) {
6073 		PHY_WRITE(mac, 0x15, 0xafa0);
6074 		DELAY(1);
6075 		PHY_WRITE(mac, 0x15, 0xefa0);
6076 		DELAY(10);
6077 		PHY_WRITE(mac, 0x15, 0xffa0);
6078 		DELAY(40);
6079 
6080 		val += PHY_READ(mac, 0x2c);
6081 	}
6082 
6083 	return (val);
6084 }
6085 
6086 void
6087 bwi_rf_lo_update_11b(struct bwi_mac *mac)
6088 {
6089 	struct bwi_softc *sc = mac->mac_sc;
6090 	struct bwi_rf *rf = &mac->mac_rf;
6091 	struct rf_saveregs regs;
6092 	uint16_t rf_val, phy_val, min_val, val;
6093 	uint16_t rf52, bphy_ctrl;
6094 	int i;
6095 
6096 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6097 
6098 	bzero(&regs, sizeof(regs));
6099 	bphy_ctrl = 0;
6100 
6101 	/*
6102 	 * Save RF/PHY registers for later restoration
6103 	 */
6104 	SAVE_PHY_REG(mac, &regs, 15);
6105 	rf52 = RF_READ(mac, 0x52) & 0xfff0;
6106 	if (rf->rf_type == BWI_RF_T_BCM2050) {
6107 		SAVE_PHY_REG(mac, &regs, 0a);
6108 		SAVE_PHY_REG(mac, &regs, 2a);
6109 		SAVE_PHY_REG(mac, &regs, 35);
6110 		SAVE_PHY_REG(mac, &regs, 03);
6111 		SAVE_PHY_REG(mac, &regs, 01);
6112 		SAVE_PHY_REG(mac, &regs, 30);
6113 
6114 		SAVE_RF_REG(mac, &regs, 43);
6115 		SAVE_RF_REG(mac, &regs, 7a);
6116 
6117 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
6118 
6119 		SAVE_RF_REG(mac, &regs, 52);
6120 		regs.rf_52 &= 0xf0;
6121 
6122 		PHY_WRITE(mac, 0x30, 0xff);
6123 		CSR_WRITE_2(sc, BWI_PHY_CTRL, 0x3f3f);
6124 		PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
6125 		RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
6126 	}
6127 
6128 	PHY_WRITE(mac, 0x15, 0xb000);
6129 
6130 	if (rf->rf_type == BWI_RF_T_BCM2050) {
6131 		PHY_WRITE(mac, 0x2b, 0x203);
6132  		PHY_WRITE(mac, 0x2a, 0x8a3);
6133  	} else {
6134 		PHY_WRITE(mac, 0x2b, 0x1402);
6135 	}
6136 
6137 	/*
6138 	 * Setup RF signal
6139 	 */
6140 	rf_val = 0;
6141 	min_val = 65535;
6142 
6143 	for (i = 0; i < 4; ++i) {
6144 		RF_WRITE(mac, 0x52, rf52 | i);
6145 		bwi_rf_lo_measure_11b(mac);	/* Ignore return value */
6146 	}
6147 	for (i = 0; i < 10; ++i) {
6148  		RF_WRITE(mac, 0x52, rf52 | i);
6149 
6150   		val = bwi_rf_lo_measure_11b(mac) / 10;
6151 		if (val < min_val) {
6152 			min_val = val;
6153 			rf_val = i;
6154 		}
6155 	}
6156 	RF_WRITE(mac, 0x52, rf52 | rf_val);
6157 
6158 	/*
6159 	 * Setup PHY signal
6160 	*/
6161 	phy_val = 0;
6162 	min_val = 65535;
6163 
6164 	for (i = -4; i < 5; i += 2) {
6165 		int j;
6166 
6167 		for (j = -4; j < 5; j += 2) {
6168 			uint16_t phy2f;
6169 
6170 			phy2f = (0x100 * i) + j;
6171 			if (j < 0)
6172 				phy2f += 0x100;
6173 			PHY_WRITE(mac, 0x2f, phy2f);
6174 
6175 			val = bwi_rf_lo_measure_11b(mac) / 10;
6176 			if (val < min_val) {
6177 				min_val = val;
6178 				phy_val = phy2f;
6179 			}
6180 		}
6181 	}
6182 	PHY_WRITE(mac, 0x2f, phy_val + 0x101);
6183 
6184 	/*
6185 	 * Restore saved RF/PHY registers
6186 	 */
6187 	if (rf->rf_type == BWI_RF_T_BCM2050) {
6188 		RESTORE_PHY_REG(mac, &regs, 0a);
6189 		RESTORE_PHY_REG(mac, &regs, 2a);
6190 		RESTORE_PHY_REG(mac, &regs, 35);
6191 		RESTORE_PHY_REG(mac, &regs, 03);
6192 		RESTORE_PHY_REG(mac, &regs, 01);
6193 		RESTORE_PHY_REG(mac, &regs, 30);
6194 
6195 		RESTORE_RF_REG(mac, &regs, 43);
6196 		RESTORE_RF_REG(mac, &regs, 7a);
6197 
6198 		RF_FILT_SETBITS(mac, 0x52, 0xf, regs.rf_52);
6199 
6200 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
6201 	}
6202 	RESTORE_PHY_REG(mac, &regs, 15);
6203 
6204 	bwi_rf_workaround(mac, rf->rf_curchan);
6205 }
6206 
6207 /* INTERFACE */
6208 
6209 uint16_t
6210 bwi_read_sprom(struct bwi_softc *sc, uint16_t ofs)
6211 {
6212 	return (CSR_READ_2(sc, ofs + BWI_SPROM_START));
6213 }
6214 
6215 void
6216 bwi_setup_desc32(struct bwi_softc *sc, struct bwi_desc32 *desc_array,
6217     int ndesc, int desc_idx, bus_addr_t paddr, int buf_len, int tx)
6218 {
6219 	struct bwi_desc32 *desc = &desc_array[desc_idx];
6220 	uint32_t ctrl, addr, addr_hi, addr_lo;
6221 
6222 	addr_lo = __SHIFTOUT(paddr, BWI_DESC32_A_ADDR_MASK);
6223 	addr_hi = __SHIFTOUT(paddr, BWI_DESC32_A_FUNC_MASK);
6224 
6225 	addr = __SHIFTIN(addr_lo, BWI_DESC32_A_ADDR_MASK) |
6226 	    __SHIFTIN(BWI_DESC32_A_FUNC_TXRX, BWI_DESC32_A_FUNC_MASK);
6227 
6228 	ctrl = __SHIFTIN(buf_len, BWI_DESC32_C_BUFLEN_MASK) |
6229 	     __SHIFTIN(addr_hi, BWI_DESC32_C_ADDRHI_MASK);
6230 	if (desc_idx == ndesc - 1)
6231 		ctrl |= BWI_DESC32_C_EOR;
6232 	if (tx) {
6233 		/* XXX */
6234 		ctrl |= BWI_DESC32_C_FRAME_START |
6235 		    BWI_DESC32_C_FRAME_END |
6236 		    BWI_DESC32_C_INTR;
6237 	}
6238 
6239 	desc->addr = htole32(addr);
6240 	desc->ctrl = htole32(ctrl);
6241 }
6242 
6243 void
6244 bwi_power_on(struct bwi_softc *sc, int with_pll)
6245 {
6246 	uint32_t gpio_in, gpio_out, gpio_en, status;
6247 
6248 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6249 
6250 	gpio_in = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_IN);
6251 	if (gpio_in & BWI_PCIM_GPIO_PWR_ON)
6252 		goto back;
6253 
6254 	gpio_out = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6255 	gpio_en = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_ENABLE);
6256 
6257 	gpio_out |= BWI_PCIM_GPIO_PWR_ON;
6258 	gpio_en |= BWI_PCIM_GPIO_PWR_ON;
6259 	if (with_pll) {
6260 		/* Turn off PLL first */
6261 		gpio_out |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6262 		gpio_en |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6263 	}
6264 
6265 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6266 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_ENABLE, gpio_en);
6267 	DELAY(1000);
6268 
6269 	if (with_pll) {
6270 		/* Turn on PLL */
6271 		gpio_out &= ~BWI_PCIM_GPIO_PLL_PWR_OFF;
6272 		(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6273 		DELAY(5000);
6274 	}
6275 
6276 back:
6277 	/* Clear "Signaled Target Abort" */
6278 	status = (sc->sc_conf_read)(sc, PCI_COMMAND_STATUS_REG);
6279 	status &= ~PCI_STATUS_TARGET_TARGET_ABORT;
6280 	(sc->sc_conf_write)(sc, PCI_COMMAND_STATUS_REG, status);
6281 }
6282 
6283 int
6284 bwi_power_off(struct bwi_softc *sc, int with_pll)
6285 {
6286 	uint32_t gpio_out, gpio_en;
6287 
6288 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6289 
6290 	(sc->sc_conf_read)(sc, BWI_PCIR_GPIO_IN); /* dummy read */
6291 	gpio_out = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6292 	gpio_en = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_ENABLE);
6293 
6294 	gpio_out &= ~BWI_PCIM_GPIO_PWR_ON;
6295 	gpio_en |= BWI_PCIM_GPIO_PWR_ON;
6296 	if (with_pll) {
6297 		gpio_out |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6298 		gpio_en |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6299 	}
6300 
6301 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6302 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_ENABLE, gpio_en);
6303 
6304 	return (0);
6305 }
6306 
6307 int
6308 bwi_regwin_switch(struct bwi_softc *sc, struct bwi_regwin *rw,
6309     struct bwi_regwin **old_rw)
6310 {
6311 	int error;
6312 
6313 	if (old_rw != NULL)
6314 		*old_rw = NULL;
6315 
6316 	if (!BWI_REGWIN_EXIST(rw))
6317 		return (EINVAL);
6318 
6319 	if (sc->sc_cur_regwin != rw) {
6320 		error = bwi_regwin_select(sc, rw->rw_id);
6321 		if (error) {
6322 			printf("%s: can't select regwin %d\n",
6323 			    sc->sc_dev.dv_xname, rw->rw_id);
6324 			return (error);
6325 		}
6326 	}
6327 
6328 	if (old_rw != NULL)
6329 		*old_rw = sc->sc_cur_regwin;
6330 	sc->sc_cur_regwin = rw;
6331 
6332 	return (0);
6333 }
6334 
6335 int
6336 bwi_regwin_select(struct bwi_softc *sc, int id)
6337 {
6338 	uint32_t win = BWI_PCIM_REGWIN(id);
6339 	int i;
6340 
6341 #define RETRY_MAX	50
6342 	for (i = 0; i < RETRY_MAX; ++i) {
6343 		(sc->sc_conf_write)(sc, BWI_PCIR_SEL_REGWIN, win);
6344 		if ((sc->sc_conf_read)(sc, BWI_PCIR_SEL_REGWIN) == win)
6345 			return (0);
6346 		DELAY(10);
6347 	}
6348 #undef RETRY_MAX
6349 
6350 	return (ENXIO);
6351 }
6352 
6353 void
6354 bwi_regwin_info(struct bwi_softc *sc, uint16_t *type, uint8_t *rev)
6355 {
6356 	uint32_t val;
6357 
6358 	val = CSR_READ_4(sc, BWI_ID_HI);
6359 	*type = BWI_ID_HI_REGWIN_TYPE(val);
6360 	*rev = BWI_ID_HI_REGWIN_REV(val);
6361 
6362 	DPRINTF(1, "%s: regwin: type 0x%03x, rev %d, vendor 0x%04x\n",
6363 	    sc->sc_dev.dv_xname,
6364 	    *type, *rev, __SHIFTOUT(val, BWI_ID_HI_REGWIN_VENDOR_MASK));
6365 }
6366 
6367 void
6368 bwi_led_attach(struct bwi_softc *sc)
6369 {
6370 	const uint8_t *led_act = NULL;
6371 	uint16_t gpio, val[BWI_LED_MAX];
6372 	int i;
6373 
6374 	for (i = 0; i < nitems(bwi_vendor_led_act); ++i) {
6375 		if (sc->sc_pci_subvid == bwi_vendor_led_act[i].vid) {
6376 			led_act = bwi_vendor_led_act[i].led_act;
6377 				break;
6378 		}
6379 	}
6380 	if (led_act == NULL)
6381 		led_act = bwi_default_led_act;
6382 
6383 	gpio = bwi_read_sprom(sc, BWI_SPROM_GPIO01);
6384 	val[0] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_0);
6385 	val[1] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_1);
6386 
6387 	gpio = bwi_read_sprom(sc, BWI_SPROM_GPIO23);
6388 	val[2] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_2);
6389 	val[3] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_3);
6390 
6391 	for (i = 0; i < BWI_LED_MAX; ++i) {
6392 		struct bwi_led *led = &sc->sc_leds[i];
6393 
6394 		if (val[i] == 0xff) {
6395 			led->l_act = led_act[i];
6396 		} else {
6397 			if (val[i] & BWI_LED_ACT_LOW)
6398 				led->l_flags |= BWI_LED_F_ACTLOW;
6399 			led->l_act = __SHIFTOUT(val[i], BWI_LED_ACT_MASK);
6400 		}
6401 		led->l_mask = (1 << i);
6402 
6403 		if (led->l_act == BWI_LED_ACT_BLINK_SLOW ||
6404 		    led->l_act == BWI_LED_ACT_BLINK_POLL ||
6405 		    led->l_act == BWI_LED_ACT_BLINK) {
6406 		    led->l_flags |= BWI_LED_F_BLINK;
6407 			if (led->l_act == BWI_LED_ACT_BLINK_POLL)
6408 				led->l_flags |= BWI_LED_F_POLLABLE;
6409 			else if (led->l_act == BWI_LED_ACT_BLINK_SLOW)
6410 				led->l_flags |= BWI_LED_F_SLOW;
6411 
6412 			if (sc->sc_blink_led == NULL) {
6413 				sc->sc_blink_led = led;
6414 				if (led->l_flags & BWI_LED_F_SLOW)
6415 					BWI_LED_SLOWDOWN(sc->sc_led_idle);
6416 			}
6417 		}
6418 
6419 		DPRINTF(1, "%s: %dth led, act %d, lowact %d\n",
6420 		    sc->sc_dev.dv_xname, i, led->l_act,
6421 		    led->l_flags & BWI_LED_F_ACTLOW);
6422 	}
6423 	timeout_set(&sc->sc_led_blink_next_ch, bwi_led_blink_next, sc);
6424 	timeout_set(&sc->sc_led_blink_end_ch, bwi_led_blink_end, sc);
6425 }
6426 
6427 uint16_t
6428 bwi_led_onoff(struct bwi_led *led, uint16_t val, int on)
6429 {
6430 	if (led->l_flags & BWI_LED_F_ACTLOW)
6431 		on = !on;
6432 	if (on)
6433 		val |= led->l_mask;
6434 	else
6435 		val &= ~led->l_mask;
6436 
6437 	return (val);
6438 }
6439 
6440 void
6441 bwi_led_newstate(struct bwi_softc *sc, enum ieee80211_state nstate)
6442 {
6443 	struct ieee80211com *ic = &sc->sc_ic;
6444 	uint16_t val;
6445 	int i;
6446 
6447 	if (nstate == IEEE80211_S_INIT) {
6448 		timeout_del(&sc->sc_led_blink_next_ch);
6449 		timeout_del(&sc->sc_led_blink_end_ch);
6450 		sc->sc_led_blinking = 0;
6451 	}
6452 
6453 	if ((ic->ic_if.if_flags & IFF_RUNNING) == 0)
6454 		return;
6455 
6456 	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6457 	for (i = 0; i < BWI_LED_MAX; ++i) {
6458 		struct bwi_led *led = &sc->sc_leds[i];
6459 		int on;
6460 
6461 		if (led->l_act == BWI_LED_ACT_UNKN ||
6462 		    led->l_act == BWI_LED_ACT_NULL)
6463 			continue;
6464 
6465 		if ((led->l_flags & BWI_LED_F_BLINK) &&
6466 			nstate != IEEE80211_S_INIT)
6467 			continue;
6468 
6469 		switch (led->l_act) {
6470 		case BWI_LED_ACT_ON:	/* Always on */
6471 			on = 1;
6472 			break;
6473 		case BWI_LED_ACT_OFF:	/* Always off */
6474 		case BWI_LED_ACT_5GHZ:	/* TODO: 11A */
6475 			on = 0;
6476 			break;
6477 		default:
6478 			on = 1;
6479 			switch (nstate) {
6480 			case IEEE80211_S_INIT:
6481 				on = 0;
6482 				break;
6483 			case IEEE80211_S_RUN:
6484 				if (led->l_act == BWI_LED_ACT_11G &&
6485 				    ic->ic_curmode != IEEE80211_MODE_11G)
6486 					on = 0;
6487 				break;
6488 			default:
6489 				if (led->l_act == BWI_LED_ACT_ASSOC)
6490 					on = 0;
6491 				break;
6492 			}
6493 			break;
6494 		}
6495 
6496 		val = bwi_led_onoff(led, val, on);
6497 	}
6498 	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6499 }
6500 
6501 void
6502 bwi_led_event(struct bwi_softc *sc, int event)
6503 {
6504 	struct bwi_led *led = sc->sc_blink_led;
6505 	int rate;
6506 
6507 	if (event == BWI_LED_EVENT_POLL) {
6508 		if ((led->l_flags & BWI_LED_F_POLLABLE) == 0)
6509 			return;
6510 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6511 			return;
6512 	}
6513 
6514 	sc->sc_led_ticks = ticks;
6515 	if (sc->sc_led_blinking)
6516 		return;
6517 
6518 	switch (event) {
6519 	case BWI_LED_EVENT_RX:
6520 		rate = sc->sc_rx_rate;
6521 		break;
6522 	case BWI_LED_EVENT_TX:
6523 		rate = sc->sc_tx_rate;
6524 		break;
6525 	case BWI_LED_EVENT_POLL:
6526 		rate = 0;
6527 		break;
6528 	default:
6529 		panic("unknown LED event %d", event);
6530 		break;
6531 	}
6532 	bwi_led_blink_start(sc, bwi_led_duration[rate].on_dur,
6533 	    bwi_led_duration[rate].off_dur);
6534 }
6535 
6536 void
6537 bwi_led_blink_start(struct bwi_softc *sc, int on_dur, int off_dur)
6538 {
6539 	struct bwi_led *led = sc->sc_blink_led;
6540 	uint16_t val;
6541 
6542 	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6543 	val = bwi_led_onoff(led, val, 1);
6544 	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6545 
6546 	if (led->l_flags & BWI_LED_F_SLOW) {
6547 		BWI_LED_SLOWDOWN(on_dur);
6548 		BWI_LED_SLOWDOWN(off_dur);
6549 	}
6550 
6551 	sc->sc_led_blinking = 1;
6552 	sc->sc_led_blink_offdur = off_dur;
6553 
6554 	timeout_add(&sc->sc_led_blink_next_ch, on_dur);
6555 }
6556 
6557 void
6558 bwi_led_blink_next(void *xsc)
6559 {
6560 	struct bwi_softc *sc = xsc;
6561 	uint16_t val;
6562 
6563 	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6564 	val = bwi_led_onoff(sc->sc_blink_led, val, 0);
6565 	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6566 
6567 	timeout_add(&sc->sc_led_blink_end_ch, sc->sc_led_blink_offdur);
6568 }
6569 
6570 void
6571 bwi_led_blink_end(void *xsc)
6572 {
6573 	struct bwi_softc *sc = xsc;
6574 
6575 	sc->sc_led_blinking = 0;
6576 }
6577 
6578 int
6579 bwi_bbp_attach(struct bwi_softc *sc)
6580 {
6581 	uint16_t bbp_id, rw_type;
6582 	uint8_t rw_rev;
6583 	uint32_t info;
6584 	int error, nregwin, i;
6585 
6586 	/*
6587 	 * Get 0th regwin information
6588 	 * NOTE: 0th regwin should exist
6589 	 */
6590 	error = bwi_regwin_select(sc, 0);
6591 	if (error) {
6592 		printf("%s: can't select regwin 0\n", sc->sc_dev.dv_xname);
6593 		return (error);
6594 	}
6595 	bwi_regwin_info(sc, &rw_type, &rw_rev);
6596 
6597 	/*
6598 	 * Find out BBP id
6599 	 */
6600 	bbp_id = 0;
6601 	info = 0;
6602 	if (rw_type == BWI_REGWIN_T_COM) {
6603 		info = CSR_READ_4(sc, BWI_INFO);
6604 		bbp_id = __SHIFTOUT(info, BWI_INFO_BBPID_MASK);
6605 
6606 		BWI_CREATE_REGWIN(&sc->sc_com_regwin, 0, rw_type, rw_rev);
6607 
6608 		sc->sc_cap = CSR_READ_4(sc, BWI_CAPABILITY);
6609 	} else {
6610 		uint16_t did = sc->sc_pci_did;
6611 		uint8_t revid = sc->sc_pci_revid;
6612 
6613 		for (i = 0; i < nitems(bwi_bbpid_map); ++i) {
6614 			if (did >= bwi_bbpid_map[i].did_min &&
6615 			    did <= bwi_bbpid_map[i].did_max) {
6616 				bbp_id = bwi_bbpid_map[i].bbp_id;
6617 				break;
6618 			}
6619 		}
6620 		if (bbp_id == 0) {
6621 			printf("%s: no BBP id for device id 0x%04x\n",
6622 			    sc->sc_dev.dv_xname, did);
6623 			return (ENXIO);
6624 		}
6625 
6626 		info = __SHIFTIN(revid, BWI_INFO_BBPREV_MASK) |
6627 		    __SHIFTIN(0, BWI_INFO_BBPPKG_MASK);
6628 	}
6629 
6630 	/*
6631 	 * Find out number of regwins
6632 	 */
6633 	nregwin = 0;
6634 	if (rw_type == BWI_REGWIN_T_COM && rw_rev >= 4) {
6635 		nregwin = __SHIFTOUT(info, BWI_INFO_NREGWIN_MASK);
6636 	} else {
6637 		for (i = 0; i < nitems(bwi_regwin_count); ++i) {
6638 			if (bwi_regwin_count[i].bbp_id == bbp_id) {
6639 				nregwin = bwi_regwin_count[i].nregwin;
6640 				break;
6641 			}
6642 		}
6643 		if (nregwin == 0) {
6644 			printf("%s: no number of win for BBP id 0x%04x\n",
6645 			    sc->sc_dev.dv_xname, bbp_id);
6646 			return (ENXIO);
6647 		}
6648 	}
6649 
6650 	/* Record BBP id/rev for later using */
6651 	sc->sc_bbp_id = bbp_id;
6652 	sc->sc_bbp_rev = __SHIFTOUT(info, BWI_INFO_BBPREV_MASK);
6653 	sc->sc_bbp_pkg = __SHIFTOUT(info, BWI_INFO_BBPPKG_MASK);
6654 	DPRINTF(1, "%s: BBP id 0x%04x, BBP rev 0x%x, BBP pkg %d\n",
6655 	    sc->sc_dev.dv_xname, sc->sc_bbp_id, sc->sc_bbp_rev, sc->sc_bbp_pkg);
6656 	DPRINTF(1, "%s: nregwin %d, cap 0x%08x\n",
6657 	    sc->sc_dev.dv_xname, nregwin, sc->sc_cap);
6658 
6659 	/*
6660 	 * Create rest of the regwins
6661 	 */
6662 
6663 	/* Don't re-create common regwin, if it is already created */
6664 	i = BWI_REGWIN_EXIST(&sc->sc_com_regwin) ? 1 : 0;
6665 
6666 	for (; i < nregwin; ++i) {
6667 		/*
6668 		 * Get regwin information
6669 		 */
6670 		error = bwi_regwin_select(sc, i);
6671 		if (error) {
6672 			printf("%s: can't select regwin %d\n",
6673 			    sc->sc_dev.dv_xname, i);
6674 			return (error);
6675 		}
6676 		bwi_regwin_info(sc, &rw_type, &rw_rev);
6677 
6678 		/*
6679 		 * Try attach:
6680 		 * 1) Bus (PCI/PCIE) regwin
6681 		 * 2) MAC regwin
6682 		 * Ignore rest types of regwin
6683 		 */
6684 		if (rw_type == BWI_REGWIN_T_BUSPCI ||
6685 		    rw_type == BWI_REGWIN_T_BUSPCIE) {
6686 			if (BWI_REGWIN_EXIST(&sc->sc_bus_regwin)) {
6687 				printf("%s: bus regwin already exists\n",
6688 				    sc->sc_dev.dv_xname);
6689 			} else {
6690 				BWI_CREATE_REGWIN(&sc->sc_bus_regwin, i,
6691 				    rw_type, rw_rev);
6692 			}
6693 		} else if (rw_type == BWI_REGWIN_T_MAC) {
6694 			/* XXX ignore return value */
6695 			bwi_mac_attach(sc, i, rw_rev);
6696 		}
6697 	}
6698 
6699 	/* At least one MAC shold exist */
6700 	if (!BWI_REGWIN_EXIST(&sc->sc_mac[0].mac_regwin)) {
6701 		printf("%s: no MAC was found\n", sc->sc_dev.dv_xname);
6702 		return (ENXIO);
6703 	}
6704 	KASSERT(sc->sc_nmac > 0);
6705 
6706 	/* Bus regwin must exist */
6707 	if (!BWI_REGWIN_EXIST(&sc->sc_bus_regwin)) {
6708 		printf("%s: no bus regwin was found\n", sc->sc_dev.dv_xname);
6709 		return (ENXIO);
6710 	}
6711 
6712 	/* Start with first MAC */
6713 	error = bwi_regwin_switch(sc, &sc->sc_mac[0].mac_regwin, NULL);
6714 	if (error)
6715 		return (error);
6716 
6717 	return (0);
6718 }
6719 
6720 int
6721 bwi_bus_init(struct bwi_softc *sc, struct bwi_mac *mac)
6722 {
6723 	struct bwi_regwin *old, *bus;
6724 	uint32_t val;
6725 	int error;
6726 
6727 	bus = &sc->sc_bus_regwin;
6728 	KASSERT(sc->sc_cur_regwin == &mac->mac_regwin);
6729 
6730 	/*
6731 	 * Tell bus to generate requested interrupts
6732 	 */
6733 	if (bus->rw_rev < 6 && bus->rw_type == BWI_REGWIN_T_BUSPCI) {
6734 		/*
6735 		 * NOTE: Read BWI_FLAGS from MAC regwin
6736 		 */
6737 		val = CSR_READ_4(sc, BWI_FLAGS);
6738 
6739 		error = bwi_regwin_switch(sc, bus, &old);
6740 		if (error)
6741 			return (error);
6742 
6743 		CSR_SETBITS_4(sc, BWI_INTRVEC, (val & BWI_FLAGS_INTR_MASK));
6744 	} else {
6745 		uint32_t mac_mask;
6746 
6747 		mac_mask = 1 << mac->mac_id;
6748 
6749 		error = bwi_regwin_switch(sc, bus, &old);
6750 		if (error)
6751 			return (error);
6752 
6753 		val = (sc->sc_conf_read)(sc, BWI_PCIR_INTCTL);
6754 		val |= mac_mask << 8;
6755 		(sc->sc_conf_write)(sc, BWI_PCIR_INTCTL, val);
6756 	}
6757 
6758 	if (sc->sc_flags & BWI_F_BUS_INITED)
6759 		goto back;
6760 
6761 	if (bus->rw_type == BWI_REGWIN_T_BUSPCI) {
6762 		/*
6763 		 * Enable prefetch and burst
6764 		 */
6765 		CSR_SETBITS_4(sc, BWI_BUS_CONFIG,
6766 		    BWI_BUS_CONFIG_PREFETCH | BWI_BUS_CONFIG_BURST);
6767 
6768 		if (bus->rw_rev < 5) {
6769 			struct bwi_regwin *com = &sc->sc_com_regwin;
6770 
6771 			/*
6772 			 * Configure timeouts for bus operation
6773 			 */
6774 
6775 			/*
6776 			 * Set service timeout and request timeout
6777 			 */
6778 			CSR_SETBITS_4(sc, BWI_CONF_LO,
6779 			    __SHIFTIN(BWI_CONF_LO_SERVTO,
6780 			    BWI_CONF_LO_SERVTO_MASK) |
6781 			    __SHIFTIN(BWI_CONF_LO_REQTO,
6782 			    BWI_CONF_LO_REQTO_MASK));
6783 
6784 			/*
6785 			 * If there is common regwin, we switch to that regwin
6786 			 * and switch back to bus regwin once we have done.
6787 			 */
6788 			if (BWI_REGWIN_EXIST(com)) {
6789 				error = bwi_regwin_switch(sc, com, NULL);
6790 				if (error)
6791 					return (error);
6792 			}
6793 
6794 			/* Let bus know what we have changed */
6795 			CSR_WRITE_4(sc, BWI_BUS_ADDR, BWI_BUS_ADDR_MAGIC);
6796 			CSR_READ_4(sc, BWI_BUS_ADDR); /* Flush */
6797 			CSR_WRITE_4(sc, BWI_BUS_DATA, 0);
6798 			CSR_READ_4(sc, BWI_BUS_DATA); /* Flush */
6799 
6800 			if (BWI_REGWIN_EXIST(com)) {
6801 				error = bwi_regwin_switch(sc, bus, NULL);
6802 				if (error)
6803 					return (error);
6804 			}
6805 		} else if (bus->rw_rev >= 11) {
6806 			/*
6807 			 * Enable memory read multiple
6808 			 */
6809 			CSR_SETBITS_4(sc, BWI_BUS_CONFIG, BWI_BUS_CONFIG_MRM);
6810 		}
6811 	} else {
6812 		/* TODO: PCIE */
6813 	}
6814 
6815 	sc->sc_flags |= BWI_F_BUS_INITED;
6816 back:
6817 	return (bwi_regwin_switch(sc, old, NULL));
6818 }
6819 
6820 void
6821 bwi_get_card_flags(struct bwi_softc *sc)
6822 {
6823 	sc->sc_card_flags = bwi_read_sprom(sc, BWI_SPROM_CARD_FLAGS);
6824 	if (sc->sc_card_flags == 0xffff)
6825 		sc->sc_card_flags = 0;
6826 
6827 	if (sc->sc_pci_subvid == PCI_VENDOR_APPLE &&
6828 	    sc->sc_pci_subdid == 0x4e && /* XXX */
6829 	    sc->sc_pci_revid > 0x40)
6830 		sc->sc_card_flags |= BWI_CARD_F_PA_GPIO9;
6831 
6832 	DPRINTF(1, "%s: card flags 0x%04x\n",
6833 	    sc->sc_dev.dv_xname, sc->sc_card_flags);
6834 }
6835 
6836 void
6837 bwi_get_eaddr(struct bwi_softc *sc, uint16_t eaddr_ofs, uint8_t *eaddr)
6838 {
6839 	int i;
6840 
6841 	for (i = 0; i < 3; ++i) {
6842 		*((uint16_t *)eaddr + i) =
6843 		    htobe16(bwi_read_sprom(sc, eaddr_ofs + 2 * i));
6844 	}
6845 }
6846 
6847 void
6848 bwi_get_clock_freq(struct bwi_softc *sc, struct bwi_clock_freq *freq)
6849 {
6850 	struct bwi_regwin *com;
6851 	uint32_t val;
6852 	uint div;
6853 	int src;
6854 
6855 	bzero(freq, sizeof(*freq));
6856 	com = &sc->sc_com_regwin;
6857 
6858 	KASSERT(BWI_REGWIN_EXIST(com));
6859 	KASSERT(sc->sc_cur_regwin == com);
6860 	KASSERT(sc->sc_cap & BWI_CAP_CLKMODE);
6861 
6862 	/*
6863 	 * Calculate clock frequency
6864 	 */
6865 	src = -1;
6866 	div = 0;
6867 	if (com->rw_rev < 6) {
6868 		val = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6869 		if (val & BWI_PCIM_GPIO_OUT_CLKSRC) {
6870 			src = BWI_CLKSRC_PCI;
6871 			div = 64;
6872 		} else {
6873 			src = BWI_CLKSRC_CS_OSC;
6874 			div = 32;
6875 		}
6876 	} else if (com->rw_rev < 10) {
6877 		val = CSR_READ_4(sc, BWI_CLOCK_CTRL);
6878 
6879 		src = __SHIFTOUT(val, BWI_CLOCK_CTRL_CLKSRC);
6880 		if (src == BWI_CLKSRC_LP_OSC)
6881 			div = 1;
6882 		else {
6883 			div = (__SHIFTOUT(val, BWI_CLOCK_CTRL_FDIV) + 1) << 2;
6884 
6885 			/* Unknown source */
6886 			if (src >= BWI_CLKSRC_MAX)
6887 				src = BWI_CLKSRC_CS_OSC;
6888 		}
6889 	} else {
6890 		val = CSR_READ_4(sc, BWI_CLOCK_INFO);
6891 
6892 		src = BWI_CLKSRC_CS_OSC;
6893 		div = (__SHIFTOUT(val, BWI_CLOCK_INFO_FDIV) + 1) << 2;
6894 	}
6895 
6896 	KASSERT(src >= 0 && src < BWI_CLKSRC_MAX);
6897 	KASSERT(div != 0);
6898 
6899 	DPRINTF(1, "%s: clksrc %s\n",
6900 	    sc->sc_dev.dv_xname,
6901 	    src == BWI_CLKSRC_PCI ? "PCI" :
6902 	    (src == BWI_CLKSRC_LP_OSC ? "LP_OSC" : "CS_OSC"));
6903 
6904 	freq->clkfreq_min = bwi_clkfreq[src].freq_min / div;
6905 	freq->clkfreq_max = bwi_clkfreq[src].freq_max / div;
6906 
6907 	DPRINTF(1, "%s: clkfreq min %u, max %u\n",
6908 	    sc->sc_dev.dv_xname, freq->clkfreq_min, freq->clkfreq_max);
6909 }
6910 
6911 int
6912 bwi_set_clock_mode(struct bwi_softc *sc, enum bwi_clock_mode clk_mode)
6913 {
6914 	struct bwi_regwin *old, *com;
6915 	uint32_t clk_ctrl, clk_src;
6916 	int error, pwr_off = 0;
6917 
6918 	com = &sc->sc_com_regwin;
6919 	if (!BWI_REGWIN_EXIST(com))
6920 		return (0);
6921 
6922 	if (com->rw_rev >= 10 || com->rw_rev < 6)
6923 		return (0);
6924 
6925 	/*
6926 	 * For common regwin whose rev is [6, 10), the chip
6927 	 * must be capable to change clock mode.
6928 	 */
6929 	if ((sc->sc_cap & BWI_CAP_CLKMODE) == 0)
6930 		return (0);
6931 
6932 	error = bwi_regwin_switch(sc, com, &old);
6933 	if (error)
6934 		return (error);
6935 
6936 	if (clk_mode == BWI_CLOCK_MODE_FAST)
6937 		bwi_power_on(sc, 0);	/* Don't turn on PLL */
6938 
6939 	clk_ctrl = CSR_READ_4(sc, BWI_CLOCK_CTRL);
6940 	clk_src = __SHIFTOUT(clk_ctrl, BWI_CLOCK_CTRL_CLKSRC);
6941 
6942 	switch (clk_mode) {
6943 	case BWI_CLOCK_MODE_FAST:
6944 		clk_ctrl &= ~BWI_CLOCK_CTRL_SLOW;
6945 		clk_ctrl |= BWI_CLOCK_CTRL_IGNPLL;
6946 		break;
6947 	case BWI_CLOCK_MODE_SLOW:
6948 		clk_ctrl |= BWI_CLOCK_CTRL_SLOW;
6949 		break;
6950 	case BWI_CLOCK_MODE_DYN:
6951 		clk_ctrl &= ~(BWI_CLOCK_CTRL_SLOW |
6952 		    BWI_CLOCK_CTRL_IGNPLL |
6953 		    BWI_CLOCK_CTRL_NODYN);
6954 		if (clk_src != BWI_CLKSRC_CS_OSC) {
6955 			clk_ctrl |= BWI_CLOCK_CTRL_NODYN;
6956 			pwr_off = 1;
6957 		}
6958 		break;
6959 	}
6960 	CSR_WRITE_4(sc, BWI_CLOCK_CTRL, clk_ctrl);
6961 
6962 	if (pwr_off)
6963 		bwi_power_off(sc, 0);	/* Leave PLL as it is */
6964 
6965 	return (bwi_regwin_switch(sc, old, NULL));
6966 }
6967 
6968 int
6969 bwi_set_clock_delay(struct bwi_softc *sc)
6970 {
6971 	struct bwi_regwin *old, *com;
6972 	int error;
6973 
6974 	com = &sc->sc_com_regwin;
6975 	if (!BWI_REGWIN_EXIST(com))
6976 		return (0);
6977 
6978 	error = bwi_regwin_switch(sc, com, &old);
6979 	if (error)
6980 		return (error);
6981 
6982 	if (sc->sc_bbp_id == BWI_BBPID_BCM4321) {
6983 		if (sc->sc_bbp_rev == 0)
6984 			CSR_WRITE_4(sc, BWI_CONTROL, BWI_CONTROL_MAGIC0);
6985 		else if (sc->sc_bbp_rev == 1)
6986 			CSR_WRITE_4(sc, BWI_CONTROL, BWI_CONTROL_MAGIC1);
6987 	}
6988 
6989 	if (sc->sc_cap & BWI_CAP_CLKMODE) {
6990 		if (com->rw_rev >= 10)
6991 			CSR_FILT_SETBITS_4(sc, BWI_CLOCK_INFO, 0xffff, 0x40000);
6992 		else {
6993 			struct bwi_clock_freq freq;
6994 
6995 			bwi_get_clock_freq(sc, &freq);
6996 			CSR_WRITE_4(sc, BWI_PLL_ON_DELAY,
6997 			    howmany(freq.clkfreq_max * 150, 1000000));
6998 			CSR_WRITE_4(sc, BWI_FREQ_SEL_DELAY,
6999 			    howmany(freq.clkfreq_max * 15, 1000000));
7000 		}
7001 	}
7002 
7003 	return (bwi_regwin_switch(sc, old, NULL));
7004 }
7005 
7006 int
7007 bwi_init(struct ifnet *ifp)
7008 {
7009 	struct bwi_softc *sc = ifp->if_softc;
7010 
7011 	bwi_init_statechg(sc, 1);
7012 
7013 	return (0);
7014 }
7015 
7016 void
7017 bwi_init_statechg(struct bwi_softc *sc, int statechg)
7018 {
7019 	struct ieee80211com *ic = &sc->sc_ic;
7020 	struct ifnet *ifp = &ic->ic_if;
7021 	struct bwi_mac *mac;
7022 	int error;
7023 
7024 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7025 
7026 	error = bwi_stop(sc, statechg);
7027 	if (error) {
7028 		DPRINTF(1, "%s: can't stop\n", sc->sc_dev.dv_xname);
7029 		return;
7030 	}
7031 
7032 	/* power on cardbus socket */
7033 	if (sc->sc_enable != NULL)
7034 		(*sc->sc_enable)(sc);
7035 
7036 	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
7037 
7038 	/* TODO: 2 MAC */
7039 
7040 	mac = &sc->sc_mac[0];
7041 	error = bwi_regwin_switch(sc, &mac->mac_regwin, NULL);
7042 	if (error)
7043 		goto back;
7044 
7045 	error = bwi_mac_init(mac);
7046 	if (error)
7047 		goto back;
7048 
7049 	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_DYN);
7050 
7051 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
7052 
7053 	bwi_set_bssid(sc, bwi_zero_addr);	/* Clear BSSID */
7054 	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_MYADDR, ic->ic_myaddr);
7055 
7056 	bwi_mac_reset_hwkeys(mac);
7057 
7058 	if ((mac->mac_flags & BWI_MAC_F_HAS_TXSTATS) == 0) {
7059 		int i;
7060 
7061 #define NRETRY	1000
7062 		/*
7063 		 * Drain any possible pending TX status
7064 		 */
7065 		for (i = 0; i < NRETRY; ++i) {
7066 			if ((CSR_READ_4(sc, BWI_TXSTATUS_0) &
7067 			     BWI_TXSTATUS_0_MORE) == 0)
7068 				break;
7069 			CSR_READ_4(sc, BWI_TXSTATUS_1);
7070 		}
7071 		if (i == NRETRY)
7072 			printf("%s: can't drain TX status\n",
7073 			    sc->sc_dev.dv_xname);
7074 #undef NRETRY
7075 	}
7076 
7077 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11G)
7078 		bwi_mac_updateslot(mac, 1);
7079 
7080 	/* Start MAC */
7081 	error = bwi_mac_start(mac);
7082 	if (error)
7083 		goto back;
7084 
7085 	/* Enable intrs */
7086 	bwi_enable_intrs(sc, BWI_INIT_INTRS);
7087 
7088 	ifp->if_flags |= IFF_RUNNING;
7089 	ifp->if_flags &= ~IFF_OACTIVE;
7090 
7091 	if (statechg) {
7092 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
7093 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
7094 		} else {
7095 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
7096 		}
7097 	} else {
7098 		ieee80211_new_state(ic, ic->ic_state, -1);
7099 	}
7100 
7101 back:
7102 	if (error)
7103 		bwi_stop(sc, 1);
7104 	else
7105 		bwi_start(ifp);
7106 }
7107 
7108 int
7109 bwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
7110 {
7111 	struct bwi_softc *sc = ifp->if_softc;
7112 	struct ieee80211com *ic = &sc->sc_ic;
7113 	struct ifaddr *ifa;
7114 	struct ifreq *ifr;
7115 	int s, error = 0;
7116 	uint8_t chan;
7117 
7118 	s = splnet();
7119 
7120 	switch (cmd) {
7121 	case SIOCSIFADDR:
7122 		ifa = (struct ifaddr *)data;
7123 		ifp->if_flags |= IFF_UP;
7124 #ifdef INET
7125 		if (ifa->ifa_addr->sa_family == AF_INET)
7126 			arp_ifinit(&ic->ic_ac, ifa);
7127 #endif
7128 		/* FALLTHROUGH */
7129 	case SIOCSIFFLAGS:
7130 		if (ifp->if_flags & IFF_UP) {
7131 			if ((ifp->if_flags & IFF_RUNNING) == 0)
7132 				bwi_init(ifp);
7133 		} else {
7134 			if (ifp->if_flags & IFF_RUNNING)
7135 				bwi_stop(sc, 1);
7136 		}
7137 		break;
7138         case SIOCADDMULTI:
7139         case SIOCDELMULTI:
7140 		ifr = (struct ifreq *)data;
7141 		error = (cmd == SIOCADDMULTI) ?
7142 		    ether_addmulti(ifr, &ic->ic_ac) :
7143 		    ether_delmulti(ifr, &ic->ic_ac);
7144 
7145 		if (error == ENETRESET)
7146 			error = 0;
7147 		break;
7148 	case SIOCS80211CHANNEL:
7149 		/* allow fast channel switching in monitor mode */
7150 		error = ieee80211_ioctl(ifp, cmd, data);
7151 		if (error == ENETRESET &&
7152 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
7153 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
7154 			    (IFF_UP | IFF_RUNNING)) {
7155 				ic->ic_bss->ni_chan = ic->ic_ibss_chan;
7156 				chan = ieee80211_chan2ieee(ic,
7157 				    ic->ic_bss->ni_chan);
7158 				bwi_set_chan(sc, chan);
7159 			}
7160 			error = 0;
7161 		}
7162 		break;
7163 	default:
7164 		error = ieee80211_ioctl(ifp, cmd, data);
7165 		break;
7166 	}
7167 
7168 	if (error == ENETRESET) {
7169 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
7170 		    (IFF_UP | IFF_RUNNING))
7171 			bwi_init(ifp);
7172 		error = 0;
7173 	}
7174 
7175 	splx(s);
7176 
7177 	return (error);
7178 }
7179 
7180 void
7181 bwi_start(struct ifnet *ifp)
7182 {
7183 	struct bwi_softc *sc = ifp->if_softc;
7184 	struct ieee80211com *ic = &sc->sc_ic;
7185 	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
7186 	int trans, idx;
7187 
7188 	if ((ifp->if_flags & IFF_OACTIVE) || (ifp->if_flags & IFF_RUNNING) == 0)
7189 		return;
7190 
7191 	trans = 0;
7192 	idx = tbd->tbd_idx;
7193 
7194 	while (tbd->tbd_buf[idx].tb_mbuf == NULL) {
7195 		struct ieee80211_frame *wh;
7196 		struct ieee80211_node *ni;
7197 		struct ieee80211_key *k;
7198 		struct mbuf *m;
7199 		int mgt_pkt = 0;
7200 
7201 		IF_POLL(&ic->ic_mgtq, m);
7202 		if (m != NULL) {
7203 			IF_DEQUEUE(&ic->ic_mgtq, m);
7204 
7205 			ni = m->m_pkthdr.ph_cookie;
7206 
7207 			mgt_pkt = 1;
7208 		} else {
7209 			struct ether_header *eh;
7210 
7211 			if (ic->ic_state != IEEE80211_S_RUN)
7212 				break;
7213 
7214 			IFQ_POLL(&ifp->if_snd, m);
7215 			if (m == NULL)
7216 				break;
7217 
7218 			IFQ_DEQUEUE(&ifp->if_snd, m);
7219 
7220 			if (m->m_len < sizeof(*eh)) {
7221 				m = m_pullup(m, sizeof(*eh));
7222 				if (m == NULL) {
7223 					ifp->if_oerrors++;
7224 					continue;
7225 				}
7226 			}
7227 			eh = mtod(m, struct ether_header *);
7228 
7229 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
7230 			if (ni == NULL) {
7231 				m_freem(m);
7232 				ifp->if_oerrors++;
7233 				continue;
7234 			}
7235 
7236 			/* TODO: PS */
7237 #if NBPFILTER > 0
7238 			if (ifp->if_bpf != NULL)
7239 				bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
7240 #endif
7241 			m = ieee80211_encap(ifp, m, &ni);
7242 			if (m == NULL)
7243 				continue;
7244 		}
7245 #if NBPFILTER > 0
7246 		if (ic->ic_rawbpf != NULL)
7247 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
7248 #endif
7249 		wh = mtod(m, struct ieee80211_frame *);
7250 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
7251 			k = ieee80211_get_txkey(ic, wh, ni);
7252 			if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
7253 				return;
7254 		}
7255 		wh = NULL;	/* Catch any invalid use */
7256 
7257 		if (mgt_pkt) {
7258 			ieee80211_release_node(ic, ni);
7259 			ni = NULL;
7260 		}
7261 
7262 		if (bwi_encap(sc, idx, m, ni) != 0) {
7263 			/* 'm' is freed in bwi_encap() if we reach here */
7264 			if (ni != NULL)
7265 				ieee80211_release_node(ic, ni);
7266 			ifp->if_oerrors++;
7267 			continue;
7268 		}
7269 
7270 		trans = 1;
7271 		tbd->tbd_used++;
7272 		idx = (idx + 1) % BWI_TX_NDESC;
7273 
7274 		if (tbd->tbd_used + BWI_TX_NSPRDESC >= BWI_TX_NDESC) {
7275 			ifp->if_flags |= IFF_OACTIVE;
7276 			break;
7277 		}
7278 	}
7279 	tbd->tbd_idx = idx;
7280 
7281 	if (trans)
7282 		sc->sc_tx_timer = 5;
7283 	ifp->if_timer = 1;
7284 }
7285 
7286 void
7287 bwi_watchdog(struct ifnet *ifp)
7288 {
7289 	struct bwi_softc *sc = ifp->if_softc;
7290 
7291 	ifp->if_timer = 0;
7292 
7293 	if ((ifp->if_flags & IFF_RUNNING) == 0)
7294 		return;
7295 
7296 	if (sc->sc_tx_timer) {
7297 		if (--sc->sc_tx_timer == 0) {
7298 			printf("%s: watchdog timeout\n",
7299 			    sc->sc_dev.dv_xname);
7300 			ifp->if_oerrors++;
7301 			/* TODO */
7302 		} else
7303 			ifp->if_timer = 1;
7304 	}
7305 
7306 	ieee80211_watchdog(ifp);
7307 }
7308 
7309 void
7310 bwi_newstate_begin(struct bwi_softc *sc, enum ieee80211_state nstate)
7311 {
7312 	timeout_del(&sc->sc_scan_ch);
7313 	timeout_del(&sc->sc_calib_ch);
7314 
7315 	bwi_led_newstate(sc, nstate);
7316 
7317 	if (nstate == IEEE80211_S_INIT)
7318 		sc->sc_txpwrcb_type = BWI_TXPWR_INIT;
7319 }
7320 
7321 int
7322 bwi_stop(struct bwi_softc *sc, int state_chg)
7323 {
7324 	struct ieee80211com *ic = &sc->sc_ic;
7325 	struct ifnet *ifp = &ic->ic_if;
7326 	struct bwi_mac *mac;
7327 	int i, error, pwr_off = 0;
7328 
7329 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7330 
7331 	if (state_chg)
7332 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
7333 	else
7334 		bwi_newstate_begin(sc, IEEE80211_S_INIT);
7335 
7336 	if (ifp->if_flags & IFF_RUNNING) {
7337 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
7338 		mac = (struct bwi_mac *)sc->sc_cur_regwin;
7339 
7340 		bwi_disable_intrs(sc, BWI_ALL_INTRS);
7341 		CSR_READ_4(sc, BWI_MAC_INTR_MASK);
7342 		bwi_mac_stop(mac);
7343 	}
7344 
7345 	for (i = 0; i < sc->sc_nmac; ++i) {
7346 		struct bwi_regwin *old_rw;
7347 
7348 		mac = &sc->sc_mac[i];
7349 		if ((mac->mac_flags & BWI_MAC_F_INITED) == 0)
7350 			continue;
7351 
7352 		error = bwi_regwin_switch(sc, &mac->mac_regwin, &old_rw);
7353 		if (error)
7354 			continue;
7355 
7356 		bwi_mac_shutdown(mac);
7357 		pwr_off = 1;
7358 
7359 		bwi_regwin_switch(sc, old_rw, NULL);
7360 	}
7361 
7362 	if (pwr_off)
7363 		bwi_bbp_power_off(sc);
7364 
7365 	sc->sc_tx_timer = 0;
7366 	ifp->if_timer = 0;
7367 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
7368 
7369 	/* power off cardbus socket */
7370 	if (sc->sc_disable)
7371 		sc->sc_disable(sc);
7372 
7373 	return (0);
7374 }
7375 
7376 int
7377 bwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
7378 {
7379 	struct bwi_softc *sc = ic->ic_if.if_softc;
7380 	struct ieee80211_node *ni;
7381 	int error;
7382 	uint8_t chan;
7383 
7384 	timeout_del(&sc->sc_amrr_ch);
7385 
7386 	bwi_newstate_begin(sc, nstate);
7387 
7388 	if (nstate == IEEE80211_S_INIT)
7389 		goto back;
7390 
7391 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
7392 	error = bwi_set_chan(sc, chan);
7393 	if (error) {
7394 		printf("%s: can't set channel to %u\n",
7395 		    sc->sc_dev.dv_xname,
7396 		    ieee80211_chan2ieee(ic, ic->ic_des_chan));
7397 		return (error);
7398 	}
7399 
7400 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
7401 		/* Nothing to do */
7402 	} else if (nstate == IEEE80211_S_RUN) {
7403 		struct bwi_mac *mac;
7404 
7405 		ni = ic->ic_bss;
7406 
7407 		bwi_set_bssid(sc, ic->ic_bss->ni_bssid);
7408 
7409 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
7410 		mac = (struct bwi_mac *)sc->sc_cur_regwin;
7411 
7412 		/* Initial TX power calibration */
7413 		bwi_mac_calibrate_txpower(mac, BWI_TXPWR_INIT);
7414 #ifdef notyet
7415 		sc->sc_txpwrcb_type = BWI_TXPWR_FORCE;
7416 #else
7417 		sc->sc_txpwrcb_type = BWI_TXPWR_CALIB;
7418 #endif
7419 		if (ic->ic_opmode == IEEE80211_M_STA) {
7420 			/* fake a join to init the tx rate */
7421 			bwi_newassoc(ic, ni, 1);
7422 		}
7423 
7424 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
7425 			/* start automatic rate control timer */
7426 			if (ic->ic_fixed_rate == -1)
7427 				timeout_add_msec(&sc->sc_amrr_ch, 500);
7428 		}
7429 	} else
7430 		bwi_set_bssid(sc, bwi_zero_addr);
7431 
7432 back:
7433 	error = sc->sc_newstate(ic, nstate, arg);
7434 
7435 	if (nstate == IEEE80211_S_SCAN) {
7436 		timeout_add_msec(&sc->sc_scan_ch, sc->sc_dwell_time);
7437 	} else if (nstate == IEEE80211_S_RUN) {
7438 		/* XXX 15 seconds */
7439 		timeout_add_sec(&sc->sc_calib_ch, 1);
7440 	}
7441 
7442 	return (error);
7443 }
7444 
7445 int
7446 bwi_media_change(struct ifnet *ifp)
7447 {
7448 	int error;
7449 
7450 	error = ieee80211_media_change(ifp);
7451 	if (error != ENETRESET)
7452 		return (error);
7453 
7454 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
7455 		bwi_init(ifp);
7456 
7457 	return (0);
7458 }
7459 
7460 void
7461 bwi_iter_func(void *arg, struct ieee80211_node *ni)
7462 {
7463 	struct bwi_softc *sc = arg;
7464 	struct bwi_node *bn = (struct bwi_node *)ni;
7465 
7466 	ieee80211_amrr_choose(&sc->sc_amrr, ni, &bn->amn);
7467 }
7468 
7469 void
7470 bwi_amrr_timeout(void *arg)
7471 {
7472 	struct bwi_softc *sc = arg;
7473 	struct ieee80211com *ic = &sc->sc_ic;
7474 
7475 	if (ic->ic_opmode == IEEE80211_M_STA)
7476 		bwi_iter_func(sc, ic->ic_bss);
7477 #ifndef IEEE80211_STA_ONLY
7478 	else
7479 		ieee80211_iterate_nodes(ic, bwi_iter_func, sc);
7480 #endif
7481 
7482 	timeout_add_msec(&sc->sc_amrr_ch, 500);
7483 }
7484 
7485 void
7486 bwi_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
7487 {
7488 	struct bwi_softc *sc = ic->ic_if.if_softc;
7489 	int i;
7490 
7491 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7492 
7493 	ieee80211_amrr_node_init(&sc->sc_amrr, &((struct bwi_node *)ni)->amn);
7494 
7495 	/* set rate to some reasonable initial value */
7496 	for (i = ni->ni_rates.rs_nrates - 1;
7497 	    i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
7498 	    i--);
7499 
7500 	ni->ni_txrate = i;
7501 }
7502 
7503 struct ieee80211_node *
7504 bwi_node_alloc(struct ieee80211com *ic)
7505 {
7506 	struct bwi_node *bn;
7507 
7508 	bn = malloc(sizeof(*bn), M_DEVBUF, M_NOWAIT | M_ZERO);
7509 	if (bn == NULL)
7510 		return (NULL);
7511 
7512 	return ((struct ieee80211_node *)bn);
7513 }
7514 
7515 int
7516 bwi_dma_alloc(struct bwi_softc *sc)
7517 {
7518 	int error, i, has_txstats;
7519 	bus_size_t tx_ring_sz, rx_ring_sz, desc_sz = 0;
7520 	uint32_t txrx_ctrl_step = 0;
7521 
7522 	has_txstats = 0;
7523 	for (i = 0; i < sc->sc_nmac; ++i) {
7524 		if (sc->sc_mac[i].mac_flags & BWI_MAC_F_HAS_TXSTATS) {
7525 			has_txstats = 1;
7526 			break;
7527 		}
7528 	}
7529 
7530 	switch (sc->sc_bus_space) {
7531 	case BWI_BUS_SPACE_30BIT:
7532 	case BWI_BUS_SPACE_32BIT:
7533 		desc_sz = sizeof(struct bwi_desc32);
7534 		txrx_ctrl_step = 0x20;
7535 
7536 		sc->sc_init_tx_ring = bwi_init_tx_ring32;
7537 		sc->sc_free_tx_ring = bwi_free_tx_ring32;
7538 		sc->sc_init_rx_ring = bwi_init_rx_ring32;
7539 		sc->sc_free_rx_ring = bwi_free_rx_ring32;
7540 		sc->sc_setup_rxdesc = bwi_setup_rx_desc32;
7541 		sc->sc_setup_txdesc = bwi_setup_tx_desc32;
7542 		sc->sc_rxeof = bwi_rxeof32;
7543 		sc->sc_start_tx = bwi_start_tx32;
7544 		if (has_txstats) {
7545 			sc->sc_init_txstats = bwi_init_txstats32;
7546 			sc->sc_free_txstats = bwi_free_txstats32;
7547 			sc->sc_txeof_status = bwi_txeof_status32;
7548 		}
7549 		break;
7550 
7551 	case BWI_BUS_SPACE_64BIT:
7552 		desc_sz = sizeof(struct bwi_desc64);
7553 		txrx_ctrl_step = 0x40;
7554 
7555 		sc->sc_init_tx_ring = bwi_init_tx_ring64;
7556 		sc->sc_free_tx_ring = bwi_free_tx_ring64;
7557 		sc->sc_init_rx_ring = bwi_init_rx_ring64;
7558 		sc->sc_free_rx_ring = bwi_free_rx_ring64;
7559 		sc->sc_setup_rxdesc = bwi_setup_rx_desc64;
7560 		sc->sc_setup_txdesc = bwi_setup_tx_desc64;
7561 		sc->sc_rxeof = bwi_rxeof64;
7562 		sc->sc_start_tx = bwi_start_tx64;
7563 		if (has_txstats) {
7564 			sc->sc_init_txstats = bwi_init_txstats64;
7565 			sc->sc_free_txstats = bwi_free_txstats64;
7566 			sc->sc_txeof_status = bwi_txeof_status64;
7567 		}
7568 		break;
7569 	}
7570 
7571 	KASSERT(desc_sz != 0);
7572 	KASSERT(txrx_ctrl_step != 0);
7573 
7574 	tx_ring_sz = roundup(desc_sz * BWI_TX_NDESC, BWI_RING_ALIGN);
7575 	rx_ring_sz = roundup(desc_sz * BWI_RX_NDESC, BWI_RING_ALIGN);
7576 
7577 #define TXRX_CTRL(idx)	(BWI_TXRX_CTRL_BASE + (idx) * txrx_ctrl_step)
7578 	/*
7579 	 * Create TX ring DMA stuffs
7580 	 */
7581 	for (i = 0; i < BWI_TX_NRING; ++i) {
7582 		error = bus_dmamap_create(sc->sc_dmat, tx_ring_sz, 1,
7583 		    tx_ring_sz, 0, BUS_DMA_NOWAIT,
7584 		    &sc->sc_tx_rdata[i].rdata_dmap);
7585 		if (error) {
7586 			printf("%s: %dth TX ring DMA create failed\n",
7587 			    sc->sc_dev.dv_xname, i);
7588 			return (error);
7589 		}
7590 		error = bwi_dma_ring_alloc(sc,
7591 		    &sc->sc_tx_rdata[i], tx_ring_sz, TXRX_CTRL(i));
7592 		if (error) {
7593 			printf("%s: %dth TX ring DMA alloc failed\n",
7594 			    sc->sc_dev.dv_xname, i);
7595 			return (error);
7596 		}
7597 	}
7598 
7599 	/*
7600 	 * Create RX ring DMA stuffs
7601 	 */
7602 	error = bus_dmamap_create(sc->sc_dmat, rx_ring_sz, 1,
7603 	    rx_ring_sz, 0, BUS_DMA_NOWAIT,
7604 	    &sc->sc_rx_rdata.rdata_dmap);
7605 	if (error) {
7606 		printf("%s: RX ring DMA create failed\n", sc->sc_dev.dv_xname);
7607 		return (error);
7608 	}
7609 
7610 	error = bwi_dma_ring_alloc(sc, &sc->sc_rx_rdata,
7611 	    rx_ring_sz, TXRX_CTRL(0));
7612 	if (error) {
7613 		printf("%s: RX ring DMA alloc failed\n", sc->sc_dev.dv_xname);
7614 		return (error);
7615 	}
7616 
7617 	if (has_txstats) {
7618 		error = bwi_dma_txstats_alloc(sc, TXRX_CTRL(3), desc_sz);
7619 		if (error) {
7620 			printf("%s: TX stats DMA alloc failed\n",
7621 			    sc->sc_dev.dv_xname);
7622 			return (error);
7623 		}
7624 	}
7625 #undef TXRX_CTRL
7626 
7627 	return (bwi_dma_mbuf_create(sc));
7628 }
7629 
7630 void
7631 bwi_dma_free(struct bwi_softc *sc)
7632 {
7633 	struct bwi_ring_data *rd;
7634 	int i;
7635 
7636 	for (i = 0; i < BWI_TX_NRING; ++i) {
7637 		rd = &sc->sc_tx_rdata[i];
7638 
7639 		if (rd->rdata_desc != NULL) {
7640 			bus_dmamap_unload(sc->sc_dmat,
7641 			    rd->rdata_dmap);
7642 			bus_dmamem_free(sc->sc_dmat,
7643 			    &rd->rdata_seg, 1);
7644 		}
7645 	}
7646 
7647 	rd = &sc->sc_rx_rdata;
7648 
7649 	if (rd->rdata_desc != NULL) {
7650 		bus_dmamap_unload(sc->sc_dmat, rd->rdata_dmap);
7651 		bus_dmamem_free(sc->sc_dmat, &rd->rdata_seg, 1);
7652 	}
7653 
7654 	bwi_dma_txstats_free(sc);
7655 	bwi_dma_mbuf_destroy(sc, BWI_TX_NRING, 1);
7656 }
7657 
7658 int
7659 bwi_dma_ring_alloc(struct bwi_softc *sc,
7660     struct bwi_ring_data *rd, bus_size_t size, uint32_t txrx_ctrl)
7661 {
7662 	int error, nsegs;
7663 
7664 	error = bus_dmamem_alloc(sc->sc_dmat, size, BWI_ALIGN, 0,
7665 	    &rd->rdata_seg, 1, &nsegs, BUS_DMA_NOWAIT);
7666 	if (error) {
7667 		printf("%s: can't allocate DMA mem\n", sc->sc_dev.dv_xname);
7668 		return (error);
7669 	}
7670 
7671 	error = bus_dmamem_map(sc->sc_dmat, &rd->rdata_seg, nsegs,
7672 	    size, (caddr_t *)&rd->rdata_desc, BUS_DMA_NOWAIT);
7673 	if (error) {
7674 		printf("%s: can't map DMA mem\n", sc->sc_dev.dv_xname);
7675 		return (error);
7676 	}
7677 
7678 	error = bus_dmamap_load(sc->sc_dmat, rd->rdata_dmap, rd->rdata_desc,
7679 	    size, NULL, BUS_DMA_WAITOK);
7680 	if (error) {
7681 		printf("%s: can't load DMA mem\n", sc->sc_dev.dv_xname);
7682 		bus_dmamem_free(sc->sc_dmat, &rd->rdata_seg, nsegs);
7683 		rd->rdata_desc = NULL;
7684 		return (error);
7685 	}
7686 
7687 	rd->rdata_paddr = rd->rdata_dmap->dm_segs[0].ds_addr;
7688 	rd->rdata_txrx_ctrl = txrx_ctrl;
7689 
7690 	return (0);
7691 }
7692 
7693 int
7694 bwi_dma_txstats_alloc(struct bwi_softc *sc, uint32_t ctrl_base,
7695     bus_size_t desc_sz)
7696 {
7697 	struct bwi_txstats_data *st;
7698 	bus_size_t dma_size;
7699 	int error, nsegs;
7700 
7701 	st = malloc(sizeof(*st), M_DEVBUF, M_WAITOK | M_ZERO);
7702 	sc->sc_txstats = st;
7703 
7704 	/*
7705 	 * Create TX stats descriptor DMA stuffs
7706 	 */
7707 	dma_size = roundup(desc_sz * BWI_TXSTATS_NDESC, BWI_RING_ALIGN);
7708 
7709 	error = bus_dmamap_create(sc->sc_dmat, dma_size, 1, dma_size, 0,
7710 	    BUS_DMA_NOWAIT, &st->stats_ring_dmap);
7711 	if (error) {
7712 		printf("%s: can't create txstats ring DMA mem\n",
7713 		    sc->sc_dev.dv_xname);
7714 		return (error);
7715 	}
7716 
7717 	error = bus_dmamem_alloc(sc->sc_dmat, dma_size, BWI_RING_ALIGN, 0,
7718 	     &st->stats_ring_seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
7719 	if (error) {
7720 		printf("%s: can't allocate txstats ring DMA mem\n",
7721 		    sc->sc_dev.dv_xname);
7722 		return (error);
7723 	}
7724 
7725 	error = bus_dmamem_map(sc->sc_dmat, &st->stats_ring_seg, nsegs,
7726 	    dma_size, (caddr_t *)&st->stats_ring, BUS_DMA_NOWAIT);
7727 	if (error) {
7728 		printf("%s: can't map txstats ring DMA mem\n",
7729 		    sc->sc_dev.dv_xname);
7730 		return (error);
7731 	}
7732 
7733 	error = bus_dmamap_load(sc->sc_dmat, st->stats_ring_dmap,
7734 	    st->stats_ring, dma_size, NULL, BUS_DMA_WAITOK);
7735 	if (error) {
7736 		printf("%s: can't load txstats ring DMA mem\n",
7737 		    sc->sc_dev.dv_xname);
7738 		bus_dmamem_free(sc->sc_dmat, &st->stats_ring_seg, nsegs);
7739 		return (error);
7740 	}
7741 
7742 	st->stats_ring_paddr = st->stats_ring_dmap->dm_segs[0].ds_addr;
7743 
7744 	/*
7745 	 * Create TX stats DMA stuffs
7746 	 */
7747 	dma_size = roundup(sizeof(struct bwi_txstats) * BWI_TXSTATS_NDESC,
7748 	    BWI_ALIGN);
7749 
7750 	error = bus_dmamap_create(sc->sc_dmat, dma_size, 1, dma_size, 0,
7751 	    BUS_DMA_NOWAIT, &st->stats_dmap);
7752 	if (error) {
7753 		printf("%s: can't create txstats ring DMA mem\n",
7754 		    sc->sc_dev.dv_xname);
7755 		return (error);
7756 	}
7757 	error = bus_dmamem_alloc(sc->sc_dmat, dma_size, BWI_ALIGN, 0,
7758 	    &st->stats_seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
7759 	if (error) {
7760 		printf("%s: can't allocate txstats DMA mem\n",
7761 		    sc->sc_dev.dv_xname);
7762 		return (error);
7763 	}
7764 
7765 	error = bus_dmamem_map(sc->sc_dmat, &st->stats_seg, nsegs,
7766 	    dma_size, (caddr_t *)&st->stats, BUS_DMA_NOWAIT);
7767 	if (error) {
7768 		printf("%s: can't map txstats DMA mem\n", sc->sc_dev.dv_xname);
7769 		return (error);
7770 	}
7771 
7772 	error = bus_dmamap_load(sc->sc_dmat, st->stats_dmap, st->stats,
7773 	    dma_size, NULL, BUS_DMA_WAITOK);
7774 	if (error) {
7775 		printf("%s: can't load txstats DMA mem\n", sc->sc_dev.dv_xname);
7776 		bus_dmamem_free(sc->sc_dmat, &st->stats_seg, nsegs);
7777 		return (error);
7778 	}
7779 
7780 	st->stats_paddr = st->stats_dmap->dm_segs[0].ds_addr;
7781 	st->stats_ctrl_base = ctrl_base;
7782 
7783 	return (0);
7784 }
7785 
7786 void
7787 bwi_dma_txstats_free(struct bwi_softc *sc)
7788 {
7789 	struct bwi_txstats_data *st;
7790 
7791 	if (sc->sc_txstats == NULL)
7792 		return;
7793 	st = sc->sc_txstats;
7794 
7795 	bus_dmamap_unload(sc->sc_dmat, st->stats_ring_dmap);
7796 	bus_dmamem_free(sc->sc_dmat, &st->stats_ring_seg, 1);
7797 
7798 	bus_dmamap_unload(sc->sc_dmat, st->stats_dmap);
7799 	bus_dmamem_free(sc->sc_dmat, &st->stats_seg, 1);
7800 
7801 	free(st, M_DEVBUF, 0);
7802 }
7803 
7804 int
7805 bwi_dma_mbuf_create(struct bwi_softc *sc)
7806 {
7807 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
7808 	int i, j, k, ntx, error;
7809 
7810 	ntx = 0;
7811 
7812 	/*
7813 	 * Create TX mbuf DMA map
7814 	 */
7815 	for (i = 0; i < BWI_TX_NRING; ++i) {
7816 		struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[i];
7817 
7818 		for (j = 0; j < BWI_TX_NDESC; ++j) {
7819 			error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
7820 			    0, BUS_DMA_NOWAIT, &tbd->tbd_buf[j].tb_dmap);
7821 			if (error) {
7822 				printf(
7823 				    "%s: can't create %dth tbd, %dth DMA map\n",
7824 				    sc->sc_dev.dv_xname, i, j);
7825 				ntx = i;
7826 				for (k = 0; k < j; ++k) {
7827 					bus_dmamap_destroy(sc->sc_dmat,
7828 					    tbd->tbd_buf[k].tb_dmap);
7829 				}
7830 				goto fail;
7831 			}
7832 		}
7833 	}
7834 	ntx = BWI_TX_NRING;
7835 
7836 	/*
7837 	 * Create RX mbuf DMA map and a spare DMA map
7838 	 */
7839 	error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0,
7840 	    BUS_DMA_NOWAIT, &rbd->rbd_tmp_dmap);
7841 	if (error) {
7842 		printf("%s: can't create spare RX buf DMA map\n",
7843 		    sc->sc_dev.dv_xname);
7844 		goto fail;
7845 	}
7846 
7847 	for (j = 0; j < BWI_RX_NDESC; ++j) {
7848 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0,
7849 		    BUS_DMA_NOWAIT, &rbd->rbd_buf[j].rb_dmap);
7850 		if (error) {
7851 			printf("%s: can't create %dth RX buf DMA map\n",
7852 			    sc->sc_dev.dv_xname, j);
7853 
7854 			for (k = 0; k < j; ++k) {
7855 				bus_dmamap_destroy(sc->sc_dmat,
7856 				    rbd->rbd_buf[j].rb_dmap);
7857 			}
7858 			bus_dmamap_destroy(sc->sc_dmat,
7859 			    rbd->rbd_tmp_dmap);
7860 			goto fail;
7861 		}
7862 	}
7863 
7864 	return 0;
7865 fail:
7866 	bwi_dma_mbuf_destroy(sc, ntx, 0);
7867 
7868 	return (error);
7869 }
7870 
7871 void
7872 bwi_dma_mbuf_destroy(struct bwi_softc *sc, int ntx, int nrx)
7873 {
7874 	struct ieee80211com *ic = &sc->sc_ic;
7875 	int i, j;
7876 
7877 	for (i = 0; i < ntx; ++i) {
7878 		struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[i];
7879 
7880 		for (j = 0; j < BWI_TX_NDESC; ++j) {
7881 			struct bwi_txbuf *tb = &tbd->tbd_buf[j];
7882 
7883 			if (tb->tb_mbuf != NULL) {
7884 				bus_dmamap_unload(sc->sc_dmat,
7885 				    tb->tb_dmap);
7886 				m_freem(tb->tb_mbuf);
7887 			}
7888 			if (tb->tb_ni != NULL)
7889 				ieee80211_release_node(ic, tb->tb_ni);
7890 			bus_dmamap_destroy(sc->sc_dmat, tb->tb_dmap);
7891 		}
7892 	}
7893 
7894 	if (nrx) {
7895 		struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
7896 
7897 		bus_dmamap_destroy(sc->sc_dmat, rbd->rbd_tmp_dmap);
7898 		for (j = 0; j < BWI_RX_NDESC; ++j) {
7899 			struct bwi_rxbuf *rb = &rbd->rbd_buf[j];
7900 
7901 			if (rb->rb_mbuf != NULL) {
7902 				bus_dmamap_unload(sc->sc_dmat,
7903 						  rb->rb_dmap);
7904 				m_freem(rb->rb_mbuf);
7905 			}
7906 			bus_dmamap_destroy(sc->sc_dmat, rb->rb_dmap);
7907 		}
7908 	}
7909 }
7910 
7911 void
7912 bwi_enable_intrs(struct bwi_softc *sc, uint32_t enable_intrs)
7913 {
7914 	CSR_SETBITS_4(sc, BWI_MAC_INTR_MASK, enable_intrs);
7915 }
7916 
7917 void
7918 bwi_disable_intrs(struct bwi_softc *sc, uint32_t disable_intrs)
7919 {
7920 	CSR_CLRBITS_4(sc, BWI_MAC_INTR_MASK, disable_intrs);
7921 }
7922 
7923 int
7924 bwi_init_tx_ring32(struct bwi_softc *sc, int ring_idx)
7925 {
7926 	struct bwi_ring_data *rd;
7927 	struct bwi_txbuf_data *tbd;
7928 	uint32_t val, addr_hi, addr_lo;
7929 
7930 	KASSERT(ring_idx < BWI_TX_NRING);
7931 	rd = &sc->sc_tx_rdata[ring_idx];
7932 	tbd = &sc->sc_tx_bdata[ring_idx];
7933 
7934 	tbd->tbd_idx = 0;
7935 	tbd->tbd_used = 0;
7936 
7937 	bzero(rd->rdata_desc, sizeof(struct bwi_desc32) * BWI_TX_NDESC);
7938 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
7939 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
7940 
7941 	addr_lo = __SHIFTOUT(rd->rdata_paddr, BWI_TXRX32_RINGINFO_ADDR_MASK);
7942 	addr_hi = __SHIFTOUT(rd->rdata_paddr, BWI_TXRX32_RINGINFO_FUNC_MASK);
7943 
7944 	val = __SHIFTIN(addr_lo, BWI_TXRX32_RINGINFO_ADDR_MASK) |
7945 	    __SHIFTIN(BWI_TXRX32_RINGINFO_FUNC_TXRX,
7946 	    BWI_TXRX32_RINGINFO_FUNC_MASK);
7947 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_RINGINFO, val);
7948 
7949 	val = __SHIFTIN(addr_hi, BWI_TXRX32_CTRL_ADDRHI_MASK) |
7950 	      BWI_TXRX32_CTRL_ENABLE;
7951 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, val);
7952 
7953 	return (0);
7954 }
7955 
7956 void
7957 bwi_init_rxdesc_ring32(struct bwi_softc *sc, uint32_t ctrl_base,
7958     bus_addr_t paddr, int hdr_size, int ndesc)
7959 {
7960 	uint32_t val, addr_hi, addr_lo;
7961 
7962 	addr_lo = __SHIFTOUT(paddr, BWI_TXRX32_RINGINFO_ADDR_MASK);
7963 	addr_hi = __SHIFTOUT(paddr, BWI_TXRX32_RINGINFO_FUNC_MASK);
7964 
7965 	val = __SHIFTIN(addr_lo, BWI_TXRX32_RINGINFO_ADDR_MASK) |
7966 	    __SHIFTIN(BWI_TXRX32_RINGINFO_FUNC_TXRX,
7967 	      		BWI_TXRX32_RINGINFO_FUNC_MASK);
7968 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_RINGINFO, val);
7969 
7970 	val = __SHIFTIN(hdr_size, BWI_RX32_CTRL_HDRSZ_MASK) |
7971 	    __SHIFTIN(addr_hi, BWI_TXRX32_CTRL_ADDRHI_MASK) |
7972 	    BWI_TXRX32_CTRL_ENABLE;
7973 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_CTRL, val);
7974 
7975 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
7976 	    (ndesc - 1) * sizeof(struct bwi_desc32));
7977 }
7978 
7979 int
7980 bwi_init_rx_ring32(struct bwi_softc *sc)
7981 {
7982 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
7983 	int i, error;
7984 
7985 	sc->sc_rx_bdata.rbd_idx = 0;
7986 
7987 	for (i = 0; i < BWI_RX_NDESC; ++i) {
7988 		error = bwi_newbuf(sc, i, 1);
7989 		if (error) {
7990 			printf("%s: can't allocate %dth RX buffer\n",
7991 			    sc->sc_dev.dv_xname, i);
7992 			return (error);
7993 		}
7994 	}
7995 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
7996 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
7997 
7998 	bwi_init_rxdesc_ring32(sc, rd->rdata_txrx_ctrl, rd->rdata_paddr,
7999 	    sizeof(struct bwi_rxbuf_hdr), BWI_RX_NDESC);
8000 	return (0);
8001 }
8002 
8003 int
8004 bwi_init_txstats32(struct bwi_softc *sc)
8005 {
8006 	struct bwi_txstats_data *st = sc->sc_txstats;
8007 	bus_addr_t stats_paddr;
8008 	int i;
8009 
8010 	bzero(st->stats, BWI_TXSTATS_NDESC * sizeof(struct bwi_txstats));
8011 	bus_dmamap_sync(sc->sc_dmat, st->stats_dmap, 0,
8012 	    st->stats_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8013 
8014 	st->stats_idx = 0;
8015 
8016 	stats_paddr = st->stats_paddr;
8017 	for (i = 0; i < BWI_TXSTATS_NDESC; ++i) {
8018 		bwi_setup_desc32(sc, st->stats_ring, BWI_TXSTATS_NDESC, i,
8019 				 stats_paddr, sizeof(struct bwi_txstats), 0);
8020 		stats_paddr += sizeof(struct bwi_txstats);
8021 	}
8022 	bus_dmamap_sync(sc->sc_dmat, st->stats_ring_dmap, 0,
8023 	    st->stats_ring_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8024 
8025 	bwi_init_rxdesc_ring32(sc, st->stats_ctrl_base,
8026 	    st->stats_ring_paddr, 0, BWI_TXSTATS_NDESC);
8027 
8028 	return (0);
8029 }
8030 
8031 void
8032 bwi_setup_rx_desc32(struct bwi_softc *sc, int buf_idx, bus_addr_t paddr,
8033     int buf_len)
8034 {
8035 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8036 
8037 	KASSERT(buf_idx < BWI_RX_NDESC);
8038 	bwi_setup_desc32(sc, rd->rdata_desc, BWI_RX_NDESC, buf_idx,
8039 	    paddr, buf_len, 0);
8040 }
8041 
8042 void
8043 bwi_setup_tx_desc32(struct bwi_softc *sc, struct bwi_ring_data *rd,
8044     int buf_idx, bus_addr_t paddr, int buf_len)
8045 {
8046 	KASSERT(buf_idx < BWI_TX_NDESC);
8047 	bwi_setup_desc32(sc, rd->rdata_desc, BWI_TX_NDESC, buf_idx,
8048 	    paddr, buf_len, 1);
8049 }
8050 
8051 int
8052 bwi_init_tx_ring64(struct bwi_softc *sc, int ring_idx)
8053 {
8054 	/* TODO: 64 */
8055 	return (EOPNOTSUPP);
8056 }
8057 
8058 int
8059 bwi_init_rx_ring64(struct bwi_softc *sc)
8060 {
8061 	/* TODO: 64 */
8062 	return (EOPNOTSUPP);
8063 }
8064 
8065 int
8066 bwi_init_txstats64(struct bwi_softc *sc)
8067 {
8068 	/* TODO: 64 */
8069 	return (EOPNOTSUPP);
8070 }
8071 
8072 void
8073 bwi_setup_rx_desc64(struct bwi_softc *sc, int buf_idx, bus_addr_t paddr,
8074     int buf_len)
8075 {
8076 	/* TODO: 64 */
8077 }
8078 
8079 void
8080 bwi_setup_tx_desc64(struct bwi_softc *sc, struct bwi_ring_data *rd,
8081     int buf_idx, bus_addr_t paddr, int buf_len)
8082 {
8083 	/* TODO: 64 */
8084 }
8085 
8086 int
8087 bwi_newbuf(struct bwi_softc *sc, int buf_idx, int init)
8088 {
8089 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8090 	struct bwi_rxbuf *rxbuf = &rbd->rbd_buf[buf_idx];
8091 	struct bwi_rxbuf_hdr *hdr;
8092 	bus_dmamap_t map;
8093 	bus_addr_t paddr;
8094 	struct mbuf *m;
8095 	int error;
8096 
8097 	KASSERT(buf_idx < BWI_RX_NDESC);
8098 
8099 	MGETHDR(m, init ? M_WAITOK : M_DONTWAIT, MT_DATA);
8100 	if (m == NULL)
8101 		return (ENOBUFS);
8102 	MCLGET(m, init ? M_WAITOK : M_DONTWAIT);
8103 	if (m == NULL) {
8104 		error = ENOBUFS;
8105 
8106 		/*
8107 		 * If the NIC is up and running, we need to:
8108 		 * - Clear RX buffer's header.
8109 		 * - Restore RX descriptor settings.
8110 		 */
8111 		if (init)
8112 			return error;
8113 		else
8114 			goto back;
8115 	}
8116 	m->m_len = m->m_pkthdr.len = MCLBYTES;
8117 
8118 	/*
8119 	 * Try to load RX buf into temporary DMA map
8120 	 */
8121 	error = bus_dmamap_load_mbuf(sc->sc_dmat, rbd->rbd_tmp_dmap, m,
8122 	    init ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
8123 	if (error) {
8124 		m_freem(m);
8125 
8126 		/*
8127 		 * See the comment above
8128 		 */
8129 		if (init)
8130 			return error;
8131 		else
8132 			goto back;
8133 	}
8134 
8135 	if (!init)
8136 		bus_dmamap_unload(sc->sc_dmat, rxbuf->rb_dmap);
8137 	rxbuf->rb_mbuf = m;
8138 
8139 	/*
8140 	 * Swap RX buf's DMA map with the loaded temporary one
8141 	 */
8142 	map = rxbuf->rb_dmap;
8143 	rxbuf->rb_dmap = rbd->rbd_tmp_dmap;
8144 	rbd->rbd_tmp_dmap = map;
8145 	paddr = rxbuf->rb_dmap->dm_segs[0].ds_addr;
8146 	rxbuf->rb_paddr = paddr;
8147 
8148 back:
8149 	/*
8150 	 * Clear RX buf header
8151 	 */
8152 	hdr = mtod(rxbuf->rb_mbuf, struct bwi_rxbuf_hdr *);
8153 	bzero(hdr, sizeof(*hdr));
8154 	bus_dmamap_sync(sc->sc_dmat, rxbuf->rb_dmap, 0,
8155 	    rxbuf->rb_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8156 
8157 	/*
8158 	 * Setup RX buf descriptor
8159 	 */
8160 	sc->sc_setup_rxdesc(sc, buf_idx, rxbuf->rb_paddr,
8161 	    rxbuf->rb_mbuf->m_len - sizeof(*hdr));
8162 	return error;
8163 }
8164 
8165 void
8166 bwi_set_addr_filter(struct bwi_softc *sc, uint16_t addr_ofs,
8167     const uint8_t *addr)
8168 {
8169 	int i;
8170 
8171 	CSR_WRITE_2(sc, BWI_ADDR_FILTER_CTRL,
8172 	    BWI_ADDR_FILTER_CTRL_SET | addr_ofs);
8173 
8174 	for (i = 0; i < (IEEE80211_ADDR_LEN / 2); ++i) {
8175 		uint16_t addr_val;
8176 
8177 		addr_val = (uint16_t)addr[i * 2] |
8178 		    (((uint16_t)addr[(i * 2) + 1]) << 8);
8179 		CSR_WRITE_2(sc, BWI_ADDR_FILTER_DATA, addr_val);
8180 	}
8181 }
8182 
8183 int
8184 bwi_set_chan(struct bwi_softc *sc, uint8_t chan)
8185 {
8186 	struct bwi_mac *mac;
8187 
8188 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
8189 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
8190 
8191 	bwi_rf_set_chan(mac, chan, 0);
8192 
8193 	return (0);
8194 }
8195 
8196 void
8197 bwi_next_scan(void *xsc)
8198 {
8199 	struct bwi_softc *sc = xsc;
8200 	struct ieee80211com *ic = &sc->sc_ic;
8201 	struct ifnet *ifp = &ic->ic_if;
8202 	int s;
8203 
8204 	s = splnet();
8205 
8206 	if (ic->ic_state == IEEE80211_S_SCAN)
8207 		ieee80211_next_scan(ifp);
8208 
8209 	splx(s);
8210 }
8211 
8212 int
8213 bwi_rxeof(struct bwi_softc *sc, int end_idx)
8214 {
8215 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8216 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8217 	struct ieee80211com *ic = &sc->sc_ic;
8218 	struct ifnet *ifp = &ic->ic_if;
8219 	int idx, rx_data = 0;
8220 
8221 	idx = rbd->rbd_idx;
8222 	while (idx != end_idx) {
8223 		struct bwi_rxbuf *rb = &rbd->rbd_buf[idx];
8224 		struct bwi_rxbuf_hdr *hdr;
8225 		struct ieee80211_frame *wh;
8226 		struct ieee80211_rxinfo rxi;
8227 		struct ieee80211_node *ni;
8228 		struct mbuf *m;
8229 		uint32_t plcp;
8230 		uint16_t flags2;
8231 		int buflen, wh_ofs, hdr_extra, rssi, type, rate;
8232 
8233 		m = rb->rb_mbuf;
8234 		bus_dmamap_sync(sc->sc_dmat, rb->rb_dmap, 0,
8235 		    rb->rb_dmap->dm_mapsize, BUS_DMASYNC_POSTREAD);
8236 
8237 		if (bwi_newbuf(sc, idx, 0)) {
8238 			ifp->if_ierrors++;
8239 			goto next;
8240 		}
8241 
8242 		hdr = mtod(m, struct bwi_rxbuf_hdr *);
8243 		flags2 = letoh16(hdr->rxh_flags2);
8244 
8245 		hdr_extra = 0;
8246 		if (flags2 & BWI_RXH_F2_TYPE2FRAME)
8247 			hdr_extra = 2;
8248 		wh_ofs = hdr_extra + 6;
8249 
8250 		buflen = letoh16(hdr->rxh_buflen);
8251 		if (buflen <= wh_ofs) {
8252 			printf("%s: zero length data, hdr_extra %d\n",
8253 			    sc->sc_dev.dv_xname, hdr_extra);
8254 			ifp->if_ierrors++;
8255 			m_freem(m);
8256 			goto next;
8257 		}
8258 
8259 		bcopy((uint8_t *)(hdr + 1) + hdr_extra, &plcp, sizeof(plcp));
8260 		rssi = bwi_calc_rssi(sc, hdr);
8261 
8262 		m->m_pkthdr.rcvif = ifp;
8263 		m->m_len = m->m_pkthdr.len = buflen + sizeof(*hdr);
8264 		m_adj(m, sizeof(*hdr) + wh_ofs);
8265 
8266 		if (htole16(hdr->rxh_flags1) & BWI_RXH_F1_OFDM)
8267 			rate = bwi_plcp2rate(plcp, IEEE80211_MODE_11G);
8268 		else
8269 			rate = bwi_plcp2rate(plcp, IEEE80211_MODE_11B);
8270 
8271 #if NBPFILTER > 0
8272 		/* RX radio tap */
8273 		if (sc->sc_drvbpf != NULL) {
8274 			struct mbuf mb;
8275 			struct bwi_rx_radiotap_hdr *tap = &sc->sc_rxtap;
8276 
8277 			tap->wr_tsf = hdr->rxh_tsf;
8278 			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
8279 			tap->wr_rate = rate;
8280 			tap->wr_chan_freq =
8281 			    htole16(ic->ic_bss->ni_chan->ic_freq);
8282 			tap->wr_chan_flags =
8283 			    htole16(ic->ic_bss->ni_chan->ic_flags);
8284 			tap->wr_antsignal = rssi;
8285 			tap->wr_antnoise = BWI_NOISE_FLOOR;
8286 
8287 			mb.m_data = (caddr_t)tap;
8288 			mb.m_len = sc->sc_rxtap_len;
8289 			mb.m_next = m;
8290 			mb.m_nextpkt = NULL;
8291 			mb.m_type = 0;
8292 			mb.m_flags = 0;
8293 			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
8294 		}
8295 #endif
8296 
8297 		m_adj(m, -IEEE80211_CRC_LEN);
8298 
8299 		wh = mtod(m, struct ieee80211_frame *);
8300 		ni = ieee80211_find_rxnode(ic, wh);
8301 		type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
8302 
8303 		rxi.rxi_rssi = hdr->rxh_rssi;
8304 		rxi.rxi_tstamp = letoh16(hdr->rxh_tsf);
8305 		ieee80211_input(ifp, m, ni, &rxi);
8306 
8307 		ieee80211_release_node(ic, ni);
8308 
8309 		if (type == IEEE80211_FC0_TYPE_DATA) {
8310 			rx_data = 1;
8311 			sc->sc_rx_rate = rate;
8312 		}
8313 next:
8314 		idx = (idx + 1) % BWI_RX_NDESC;
8315 	}
8316 
8317 	rbd->rbd_idx = idx;
8318 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
8319 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8320 
8321 	return (rx_data);
8322 }
8323 
8324 int
8325 bwi_rxeof32(struct bwi_softc *sc)
8326 {
8327 	uint32_t val, rx_ctrl;
8328 	int end_idx, rx_data;
8329 
8330 	rx_ctrl = sc->sc_rx_rdata.rdata_txrx_ctrl;
8331 
8332 	val = CSR_READ_4(sc, rx_ctrl + BWI_RX32_STATUS);
8333 	end_idx = __SHIFTOUT(val, BWI_RX32_STATUS_INDEX_MASK) /
8334 	    sizeof(struct bwi_desc32);
8335 
8336 	rx_data = bwi_rxeof(sc, end_idx);
8337 
8338 	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_INDEX,
8339 	    end_idx * sizeof(struct bwi_desc32));
8340 
8341 	return (rx_data);
8342 }
8343 
8344 int
8345 bwi_rxeof64(struct bwi_softc *sc)
8346 {
8347 	/* TODO: 64 */
8348 	return (0);
8349 }
8350 
8351 void
8352 bwi_reset_rx_ring32(struct bwi_softc *sc, uint32_t rx_ctrl)
8353 {
8354 	int i;
8355 
8356 	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_CTRL, 0);
8357 
8358 #define NRETRY 10
8359 	for (i = 0; i < NRETRY; ++i) {
8360 		uint32_t status;
8361 
8362 		status = CSR_READ_4(sc, rx_ctrl + BWI_RX32_STATUS);
8363 		if (__SHIFTOUT(status, BWI_RX32_STATUS_STATE_MASK) ==
8364 		    BWI_RX32_STATUS_STATE_DISABLED)
8365 			break;
8366 
8367 		DELAY(1000);
8368 	}
8369 	if (i == NRETRY)
8370 		printf("%s: reset rx ring timedout\n", sc->sc_dev.dv_xname);
8371 #undef NRETRY
8372 
8373 	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_RINGINFO, 0);
8374 }
8375 
8376 void
8377 bwi_free_txstats32(struct bwi_softc *sc)
8378 {
8379 	bwi_reset_rx_ring32(sc, sc->sc_txstats->stats_ctrl_base);
8380 }
8381 
8382 void
8383 bwi_free_rx_ring32(struct bwi_softc *sc)
8384 {
8385 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8386 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8387 	int i;
8388 
8389 	bwi_reset_rx_ring32(sc, rd->rdata_txrx_ctrl);
8390 
8391 	for (i = 0; i < BWI_RX_NDESC; ++i) {
8392 		struct bwi_rxbuf *rb = &rbd->rbd_buf[i];
8393 
8394 		if (rb->rb_mbuf != NULL) {
8395 			bus_dmamap_unload(sc->sc_dmat, rb->rb_dmap);
8396 			m_freem(rb->rb_mbuf);
8397 			rb->rb_mbuf = NULL;
8398 		}
8399 	}
8400 }
8401 
8402 void
8403 bwi_free_tx_ring32(struct bwi_softc *sc, int ring_idx)
8404 {
8405 	struct ieee80211com *ic = &sc->sc_ic;
8406 	struct bwi_ring_data *rd;
8407 	struct bwi_txbuf_data *tbd;
8408 	uint32_t state, val;
8409 	int i;
8410 
8411 	KASSERT(ring_idx < BWI_TX_NRING);
8412 	rd = &sc->sc_tx_rdata[ring_idx];
8413 	tbd = &sc->sc_tx_bdata[ring_idx];
8414 
8415 #define NRETRY 10
8416 	for (i = 0; i < NRETRY; ++i) {
8417 		val = CSR_READ_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_STATUS);
8418 		state = __SHIFTOUT(val, BWI_TX32_STATUS_STATE_MASK);
8419 		if (state == BWI_TX32_STATUS_STATE_DISABLED ||
8420 		    state == BWI_TX32_STATUS_STATE_IDLE ||
8421 		    state == BWI_TX32_STATUS_STATE_STOPPED)
8422 			break;
8423 
8424 		DELAY(1000);
8425 	}
8426 	if (i == NRETRY) {
8427 		printf("%s: wait for TX ring(%d) stable timed out\n",
8428 		    sc->sc_dev.dv_xname, ring_idx);
8429 	}
8430 
8431 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, 0);
8432 	for (i = 0; i < NRETRY; ++i) {
8433 		val = CSR_READ_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_STATUS);
8434 		state = __SHIFTOUT(val, BWI_TX32_STATUS_STATE_MASK);
8435 		if (state == BWI_TX32_STATUS_STATE_DISABLED)
8436 			break;
8437 
8438 		DELAY(1000);
8439 	}
8440 	if (i == NRETRY)
8441 		printf("%s: reset TX ring (%d) timed out\n",
8442 		    sc->sc_dev.dv_xname, ring_idx);
8443 #undef NRETRY
8444 
8445 	DELAY(1000);
8446 
8447 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_RINGINFO, 0);
8448 
8449 	for (i = 0; i < BWI_TX_NDESC; ++i) {
8450 		struct bwi_txbuf *tb = &tbd->tbd_buf[i];
8451 
8452 		if (tb->tb_mbuf != NULL) {
8453 			bus_dmamap_unload(sc->sc_dmat, tb->tb_dmap);
8454 			m_freem(tb->tb_mbuf);
8455 			tb->tb_mbuf = NULL;
8456 		}
8457 		if (tb->tb_ni != NULL) {
8458 			ieee80211_release_node(ic, tb->tb_ni);
8459 			tb->tb_ni = NULL;
8460 		}
8461 	}
8462 }
8463 
8464 void
8465 bwi_free_txstats64(struct bwi_softc *sc)
8466 {
8467 	/* TODO: 64 */
8468 }
8469 
8470 void
8471 bwi_free_rx_ring64(struct bwi_softc *sc)
8472 {
8473 	/* TODO: 64 */
8474 }
8475 
8476 void
8477 bwi_free_tx_ring64(struct bwi_softc *sc, int ring_idx)
8478 {
8479 	/* TODO: 64 */
8480 }
8481 
8482 uint8_t
8483 bwi_plcp2rate(uint32_t plcp0, enum ieee80211_phymode phymode)
8484 {
8485 	uint32_t plcp = letoh32(plcp0) & IEEE80211_OFDM_PLCP_RATE_MASK;
8486 	return (ieee80211_plcp2rate(plcp, phymode));
8487 }
8488 
8489 void
8490 bwi_ofdm_plcp_header(uint32_t *plcp0, int pkt_len, uint8_t rate)
8491 {
8492 	uint32_t plcp;
8493 
8494 	plcp = __SHIFTIN(ieee80211_rate2plcp(rate, IEEE80211_MODE_11G),
8495 	    IEEE80211_OFDM_PLCP_RATE_MASK) |
8496 	    __SHIFTIN(pkt_len, IEEE80211_OFDM_PLCP_LEN_MASK);
8497 	*plcp0 = htole32(plcp);
8498 }
8499 
8500 void
8501 bwi_ds_plcp_header(struct ieee80211_ds_plcp_hdr *plcp, int pkt_len,
8502     uint8_t rate)
8503 {
8504 	int len, service, pkt_bitlen;
8505 
8506 	pkt_bitlen = pkt_len * NBBY;
8507 	len = howmany(pkt_bitlen * 2, rate);
8508 
8509 	service = IEEE80211_DS_PLCP_SERVICE_LOCKED;
8510 	if (rate == (11 * 2)) {
8511 		int pkt_bitlen1;
8512 
8513 		/*
8514 		 * PLCP service field needs to be adjusted,
8515 		 * if TX rate is 11Mbytes/s
8516 		 */
8517 		pkt_bitlen1 = len * 11;
8518 		if (pkt_bitlen1 - pkt_bitlen >= NBBY)
8519 			service |= IEEE80211_DS_PLCP_SERVICE_LENEXT7;
8520 	}
8521 
8522 	plcp->i_signal = ieee80211_rate2plcp(rate, IEEE80211_MODE_11B);
8523 	plcp->i_service = service;
8524 	plcp->i_length = htole16(len);
8525 	/* NOTE: do NOT touch i_crc */
8526 }
8527 
8528 void
8529 bwi_plcp_header(void *plcp, int pkt_len, uint8_t rate)
8530 {
8531 	enum bwi_modtype modtype;
8532 
8533 	/*
8534 	 * Assume caller has zeroed 'plcp'
8535 	 */
8536 
8537 	modtype = bwi_rate2modtype(rate);
8538 	if (modtype == IEEE80211_MODTYPE_OFDM)
8539 		bwi_ofdm_plcp_header(plcp, pkt_len, rate);
8540 	else if (modtype == IEEE80211_MODTYPE_DS)
8541 		bwi_ds_plcp_header(plcp, pkt_len, rate);
8542 	else
8543 		panic("unsupport modulation type %u", modtype);
8544 }
8545 
8546 enum bwi_modtype
8547 bwi_rate2modtype(uint8_t rate)
8548 {
8549 	rate &= IEEE80211_RATE_VAL;
8550 
8551 	if (rate == 44)
8552 		return IEEE80211_MODTYPE_PBCC;
8553 	else if (rate == 22 || rate < 12)
8554 		return IEEE80211_MODTYPE_DS;
8555 	else
8556 		return IEEE80211_MODTYPE_OFDM;
8557 }
8558 
8559 uint8_t
8560 bwi_ack_rate(struct ieee80211_node *ni, uint8_t rate)
8561 {
8562 	const struct ieee80211_rateset *rs = &ni->ni_rates;
8563 	uint8_t ack_rate = 0;
8564 	enum bwi_modtype modtype;
8565 	int i;
8566 
8567 	rate &= IEEE80211_RATE_VAL;
8568 
8569 	modtype = bwi_rate2modtype(rate);
8570 
8571 	for (i = 0; i < rs->rs_nrates; ++i) {
8572 		uint8_t rate1 = rs->rs_rates[i] & IEEE80211_RATE_VAL;
8573 
8574 		if (rate1 > rate) {
8575 			if (ack_rate != 0)
8576 				return ack_rate;
8577 			else
8578 				break;
8579 		}
8580 
8581 		if ((rs->rs_rates[i] & IEEE80211_RATE_BASIC) &&
8582 		    bwi_rate2modtype(rate1) == modtype)
8583 			ack_rate = rate1;
8584 	}
8585 
8586 	switch (rate) {
8587 	/* CCK */
8588 	case 2:
8589 	case 4:
8590 	case 11:
8591 	case 22:
8592 		ack_rate = rate;
8593 		break;
8594 	/* PBCC */
8595 	case 44:
8596 		ack_rate = 22;
8597 		break;
8598 
8599 	/* OFDM */
8600 	case 12:
8601 	case 18:
8602 		ack_rate = 12;
8603 		break;
8604 	case 24:
8605 	case 36:
8606 		ack_rate = 24;
8607 		break;
8608 	case 48:
8609 	case 72:
8610 	case 96:
8611 	case 108:
8612 		ack_rate = 48;
8613 		break;
8614 	default:
8615 		panic("unsupported rate %d", rate);
8616 	}
8617 	return ack_rate;
8618 }
8619 
8620 #define IEEE80211_OFDM_TXTIME(kbps, frmlen)	\
8621 	(IEEE80211_OFDM_PREAMBLE_TIME +		\
8622 	 IEEE80211_OFDM_SIGNAL_TIME +		\
8623 	(IEEE80211_OFDM_NSYMS((kbps), (frmlen)) * IEEE80211_OFDM_SYM_TIME))
8624 
8625 #define IEEE80211_OFDM_SYM_TIME			4
8626 #define IEEE80211_OFDM_PREAMBLE_TIME		16
8627 #define IEEE80211_OFDM_SIGNAL_EXT_TIME		6
8628 #define IEEE80211_OFDM_SIGNAL_TIME		4
8629 
8630 #define IEEE80211_OFDM_PLCP_SERVICE_NBITS	16
8631 #define IEEE80211_OFDM_TAIL_NBITS		6
8632 
8633 #define IEEE80211_OFDM_NBITS(frmlen)		\
8634 	(IEEE80211_OFDM_PLCP_SERVICE_NBITS +	\
8635 	 ((frmlen) * NBBY) +			\
8636 	 IEEE80211_OFDM_TAIL_NBITS)
8637 
8638 #define IEEE80211_OFDM_NBITS_PER_SYM(kbps)	\
8639 	(((kbps) * IEEE80211_OFDM_SYM_TIME) / 1000)
8640 
8641 #define IEEE80211_OFDM_NSYMS(kbps, frmlen)	\
8642 	howmany(IEEE80211_OFDM_NBITS((frmlen)),	\
8643 	IEEE80211_OFDM_NBITS_PER_SYM((kbps)))
8644 
8645 #define IEEE80211_CCK_TXTIME(kbps, frmlen)	\
8646 	(((IEEE80211_CCK_NBITS((frmlen)) * 1000) + (kbps) - 1) / (kbps))
8647 
8648 #define IEEE80211_CCK_PREAMBLE_LEN		144
8649 #define IEEE80211_CCK_PLCP_HDR_TIME		48
8650 #define IEEE80211_CCK_SHPREAMBLE_LEN		72
8651 #define IEEE80211_CCK_SHPLCP_HDR_TIME		24
8652 
8653 #define IEEE80211_CCK_NBITS(frmlen)		((frmlen) * NBBY)
8654 
8655 uint16_t
8656 bwi_txtime(struct ieee80211com *ic, struct ieee80211_node *ni, uint len,
8657     uint8_t rs_rate, uint32_t flags)
8658 {
8659 	enum bwi_modtype modtype;
8660 	uint16_t txtime;
8661 	int rate;
8662 
8663 	rs_rate &= IEEE80211_RATE_VAL;
8664 
8665 	rate = rs_rate * 500;	/* ieee80211 rate -> kbps */
8666 
8667 	modtype = bwi_rate2modtype(rs_rate);
8668 	if (modtype == IEEE80211_MODTYPE_OFDM) {
8669 		/*
8670 		 * IEEE Std 802.11a-1999, page 37, equation (29)
8671 		 * IEEE Std 802.11g-2003, page 44, equation (42)
8672 		 */
8673 		txtime = IEEE80211_OFDM_TXTIME(rate, len);
8674 		if (ic->ic_curmode == IEEE80211_MODE_11G)
8675 			txtime += IEEE80211_OFDM_SIGNAL_EXT_TIME;
8676 	} else {
8677 		/*
8678 		 * IEEE Std 802.11b-1999, page 28, subclause 18.3.4
8679 		 * IEEE Std 802.11g-2003, page 45, equation (43)
8680 		 */
8681 		if (modtype == IEEE80211_MODTYPE_PBCC)
8682 			++len;
8683 		txtime = IEEE80211_CCK_TXTIME(rate, len);
8684 
8685 		/*
8686 		 * Short preamble is not applicable for DS 1Mbits/s
8687 		 */
8688 		if (rs_rate != 2 && (flags & IEEE80211_F_SHPREAMBLE)) {
8689 			txtime += IEEE80211_CCK_SHPREAMBLE_LEN +
8690 				  IEEE80211_CCK_SHPLCP_HDR_TIME;
8691 		} else {
8692 			txtime += IEEE80211_CCK_PREAMBLE_LEN +
8693 				  IEEE80211_CCK_PLCP_HDR_TIME;
8694 		}
8695 	}
8696 	return txtime;
8697 }
8698 
8699 int
8700 bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
8701     struct ieee80211_node *ni)
8702 {
8703 	DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
8704 
8705 	struct ieee80211com *ic = &sc->sc_ic;
8706 	struct bwi_ring_data *rd = &sc->sc_tx_rdata[BWI_TX_DATA_RING];
8707 	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
8708 	struct bwi_txbuf *tb = &tbd->tbd_buf[idx];
8709 	struct bwi_mac *mac;
8710 	struct bwi_txbuf_hdr *hdr;
8711 	struct ieee80211_frame *wh;
8712 	uint8_t rate;
8713 	uint32_t mac_ctrl;
8714 	uint16_t phy_ctrl;
8715 	bus_addr_t paddr;
8716 	int pkt_len, error;
8717 #if 0
8718 	const uint8_t *p;
8719 	int i;
8720 #endif
8721 
8722 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
8723 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
8724 
8725 	wh = mtod(m, struct ieee80211_frame *);
8726 
8727 	/* Get 802.11 frame len before prepending TX header */
8728 	pkt_len = m->m_pkthdr.len + IEEE80211_CRC_LEN;
8729 
8730 	/*
8731 	 * Find TX rate
8732 	 */
8733 	bzero(tb->tb_rate_idx, sizeof(tb->tb_rate_idx));
8734 	if (ni != NULL) {
8735 		if (ic->ic_fixed_rate != -1) {
8736 			rate = ic->ic_sup_rates[ic->ic_curmode].
8737 			    rs_rates[ic->ic_fixed_rate];
8738 		} else {
8739 			/* AMRR rate control */
8740 			rate = ni->ni_rates.rs_rates[ni->ni_txrate];
8741 		}
8742 	} else {
8743 		/* Fixed at 1Mbytes/s for mgt frames */
8744 		rate = (1 * 2);
8745 	}
8746 
8747 	rate &= IEEE80211_RATE_VAL;
8748 
8749 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
8750 		rate = (1 * 2);
8751 
8752 	if (rate == 0) {
8753 		printf("%s: invalid rate %u or fallback rate",
8754 		    sc->sc_dev.dv_xname, rate);
8755 		rate = (1 * 2); /* Force 1Mbytes/s */
8756 	}
8757 	sc->sc_tx_rate = rate;
8758 
8759 #if NBPFILTER > 0
8760 	/* TX radio tap */
8761 	if (sc->sc_drvbpf != NULL) {
8762 		struct mbuf mb;
8763 		struct bwi_tx_radiotap_hdr *tap = &sc->sc_txtap;
8764 
8765 		tap->wt_flags = 0;
8766 		tap->wt_rate = rate;
8767 		tap->wt_chan_freq =
8768 		    htole16(ic->ic_bss->ni_chan->ic_freq);
8769 		tap->wt_chan_flags =
8770 		    htole16(ic->ic_bss->ni_chan->ic_flags);
8771 
8772 		mb.m_data = (caddr_t)tap;
8773 		mb.m_len = sc->sc_txtap_len;
8774 		mb.m_next = m;
8775 		mb.m_nextpkt = NULL;
8776 		mb.m_type = 0;
8777 		mb.m_flags = 0;
8778 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
8779 	}
8780 #endif
8781 
8782 	/*
8783 	 * Setup the embedded TX header
8784 	 */
8785 	M_PREPEND(m, sizeof(*hdr), M_DONTWAIT);
8786 	if (m == NULL) {
8787 		printf("%s: prepend TX header failed\n", sc->sc_dev.dv_xname);
8788 		return (ENOBUFS);
8789 	}
8790 	hdr = mtod(m, struct bwi_txbuf_hdr *);
8791 
8792 	bzero(hdr, sizeof(*hdr));
8793 
8794 	bcopy(wh->i_fc, hdr->txh_fc, sizeof(hdr->txh_fc));
8795 	bcopy(wh->i_addr1, hdr->txh_addr1, sizeof(hdr->txh_addr1));
8796 
8797 	if (ni != NULL && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
8798 		uint16_t dur;
8799 		uint8_t ack_rate;
8800 
8801 		ack_rate = bwi_ack_rate(ni, rate);
8802 		dur = bwi_txtime(ic, ni,
8803 		    sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN,
8804 		    ack_rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
8805 
8806 		hdr->txh_fb_duration = htole16(dur);
8807 	}
8808 
8809 	hdr->txh_id = __SHIFTIN(BWI_TX_DATA_RING, BWI_TXH_ID_RING_MASK) |
8810 	    __SHIFTIN(idx, BWI_TXH_ID_IDX_MASK);
8811 
8812 	bwi_plcp_header(hdr->txh_plcp, pkt_len, rate);
8813 	bwi_plcp_header(hdr->txh_fb_plcp, pkt_len, rate);
8814 
8815 	phy_ctrl = __SHIFTIN(mac->mac_rf.rf_ant_mode,
8816 	    BWI_TXH_PHY_C_ANTMODE_MASK);
8817 	if (bwi_rate2modtype(rate) == IEEE80211_MODTYPE_OFDM)
8818 		phy_ctrl |= BWI_TXH_PHY_C_OFDM;
8819 	else if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && rate != (2 * 1))
8820 		phy_ctrl |= BWI_TXH_PHY_C_SHPREAMBLE;
8821 
8822 	mac_ctrl = BWI_TXH_MAC_C_HWSEQ | BWI_TXH_MAC_C_FIRST_FRAG;
8823 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
8824 		mac_ctrl |= BWI_TXH_MAC_C_ACK;
8825 	if (bwi_rate2modtype(rate) == IEEE80211_MODTYPE_OFDM)
8826 		mac_ctrl |= BWI_TXH_MAC_C_FB_OFDM;
8827 
8828 	hdr->txh_mac_ctrl = htole32(mac_ctrl);
8829 	hdr->txh_phy_ctrl = htole16(phy_ctrl);
8830 
8831 	/* Catch any further usage */
8832 	hdr = NULL;
8833 	wh = NULL;
8834 
8835 	/* DMA load */
8836 	error = bus_dmamap_load_mbuf(sc->sc_dmat, tb->tb_dmap, m,
8837 	    BUS_DMA_NOWAIT);
8838 	if (error && error != EFBIG) {
8839 		printf("%s: can't load TX buffer (1) %d\n",
8840 		    sc->sc_dev.dv_xname, error);
8841 		goto back;
8842 	}
8843 
8844 	if (error) {	/* error == EFBIG */
8845 		if (m_defrag(m, M_DONTWAIT)) {
8846 			printf("%s: can't defrag TX buffer\n",
8847 			    sc->sc_dev.dv_xname);
8848 			goto back;
8849 		}
8850 		error = bus_dmamap_load_mbuf(sc->sc_dmat, tb->tb_dmap, m,
8851 		    BUS_DMA_NOWAIT);
8852 		if (error) {
8853 			printf("%s: can't load TX buffer (2) %d\n",
8854 			    sc->sc_dev.dv_xname, error);
8855 			goto back;
8856 		}
8857 	}
8858 	error = 0;
8859 
8860 	bus_dmamap_sync(sc->sc_dmat, tb->tb_dmap, 0,
8861 	    tb->tb_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8862 
8863 	tb->tb_mbuf = m;
8864 	tb->tb_ni = ni;
8865 
8866 #if 0
8867 	p = mtod(m, const uint8_t *);
8868 	for (i = 0; i < m->m_pkthdr.len; ++i) {
8869 		if (i != 0 && i % 8 == 0)
8870 			printf("\n");
8871 		printf("%02x ", p[i]);
8872 	}
8873 	printf("\n");
8874 
8875 	DPRINTF(1, "%s: idx %d, pkt_len %d, buflen %d\n",
8876 	    sc->sc_dev.dv_xname, idx, pkt_len, m->m_pkthdr.len);
8877 #endif
8878 
8879 	/* Setup TX descriptor */
8880 	paddr = tb->tb_dmap->dm_segs[0].ds_addr;
8881 	sc->sc_setup_txdesc(sc, rd, idx, paddr, m->m_pkthdr.len);
8882 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
8883 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8884 
8885 	/* Kick start */
8886 	sc->sc_start_tx(sc, rd->rdata_txrx_ctrl, idx);
8887 
8888 back:
8889 	if (error)
8890 		m_freem(m);
8891 	return (error);
8892 }
8893 
8894 void
8895 bwi_start_tx32(struct bwi_softc *sc, uint32_t tx_ctrl, int idx)
8896 {
8897 	idx = (idx + 1) % BWI_TX_NDESC;
8898 	CSR_WRITE_4(sc, tx_ctrl + BWI_TX32_INDEX,
8899 	    idx * sizeof(struct bwi_desc32));
8900 }
8901 
8902 void
8903 bwi_start_tx64(struct bwi_softc *sc, uint32_t tx_ctrl, int idx)
8904 {
8905 	/* TODO: 64 */
8906 }
8907 
8908 void
8909 bwi_txeof_status32(struct bwi_softc *sc)
8910 {
8911 	struct ifnet *ifp = &sc->sc_ic.ic_if;
8912 	uint32_t val, ctrl_base;
8913 	int end_idx;
8914 
8915 	ctrl_base = sc->sc_txstats->stats_ctrl_base;
8916 
8917 	val = CSR_READ_4(sc, ctrl_base + BWI_RX32_STATUS);
8918 	end_idx = __SHIFTOUT(val, BWI_RX32_STATUS_INDEX_MASK) /
8919 	    sizeof(struct bwi_desc32);
8920 
8921 	bwi_txeof_status(sc, end_idx);
8922 
8923 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
8924 	    end_idx * sizeof(struct bwi_desc32));
8925 
8926 	if ((ifp->if_flags & IFF_OACTIVE) == 0)
8927 		ifp->if_start(ifp);
8928 }
8929 
8930 void
8931 bwi_txeof_status64(struct bwi_softc *sc)
8932 {
8933 	/* TODO: 64 */
8934 }
8935 
8936 void
8937 _bwi_txeof(struct bwi_softc *sc, uint16_t tx_id)
8938 {
8939 	struct ieee80211com *ic = &sc->sc_ic;
8940 	struct ifnet *ifp = &sc->sc_ic.ic_if;
8941 	struct bwi_txbuf_data *tbd;
8942 	struct bwi_txbuf *tb;
8943 	int ring_idx, buf_idx;
8944 
8945 	if (tx_id == 0) {
8946 		printf("%s: zero tx id\n", sc->sc_dev.dv_xname);
8947 		return;
8948 	}
8949 
8950 	ring_idx = __SHIFTOUT(tx_id, BWI_TXH_ID_RING_MASK);
8951 	buf_idx = __SHIFTOUT(tx_id, BWI_TXH_ID_IDX_MASK);
8952 
8953 	KASSERT(ring_idx == BWI_TX_DATA_RING);
8954 	KASSERT(buf_idx < BWI_TX_NDESC);
8955 #if 0
8956 	DPRINTF(1, "%s: txeof idx %d\n", sc->sc_dev.dv_xname, buf_idx);
8957 #endif
8958 	tbd = &sc->sc_tx_bdata[ring_idx];
8959 	KASSERT(tbd->tbd_used > 0);
8960 	tbd->tbd_used--;
8961 
8962 	tb = &tbd->tbd_buf[buf_idx];
8963 
8964 	bus_dmamap_unload(sc->sc_dmat, tb->tb_dmap);
8965 	m_freem(tb->tb_mbuf);
8966 	tb->tb_mbuf = NULL;
8967 
8968 	if (tb->tb_ni != NULL) {
8969 		ieee80211_release_node(ic, tb->tb_ni);
8970 		tb->tb_ni = NULL;
8971 	}
8972 
8973 	if (tbd->tbd_used == 0)
8974 		sc->sc_tx_timer = 0;
8975 
8976 	ifp->if_flags &= ~IFF_OACTIVE;
8977 }
8978 
8979 void
8980 bwi_txeof_status(struct bwi_softc *sc, int end_idx)
8981 {
8982 	struct bwi_txstats_data *st = sc->sc_txstats;
8983 	int idx;
8984 
8985 	bus_dmamap_sync(sc->sc_dmat, st->stats_dmap, 0,
8986 	    st->stats_dmap->dm_mapsize, BUS_DMASYNC_POSTREAD);
8987 
8988 	idx = st->stats_idx;
8989 	while (idx != end_idx) {
8990 		_bwi_txeof(sc, letoh16(st->stats[idx].txs_id));
8991 		idx = (idx + 1) % BWI_TXSTATS_NDESC;
8992 	}
8993 	st->stats_idx = idx;
8994 }
8995 
8996 void
8997 bwi_txeof(struct bwi_softc *sc)
8998 {
8999 	struct ifnet *ifp = &sc->sc_ic.ic_if;
9000 
9001 	for (;;) {
9002 		uint32_t tx_status0, tx_status1;
9003 		uint16_t tx_id, tx_info;
9004 
9005 		tx_status0 = CSR_READ_4(sc, BWI_TXSTATUS_0);
9006 		if (tx_status0 == 0)
9007 			break;
9008 		tx_status1 = CSR_READ_4(sc, BWI_TXSTATUS_1);
9009 
9010 		tx_id = __SHIFTOUT(tx_status0, BWI_TXSTATUS_0_TXID_MASK);
9011 		tx_info = BWI_TXSTATUS_0_INFO(tx_status0);
9012 
9013 		if (tx_info & 0x30) /* XXX */
9014 			continue;
9015 
9016 		_bwi_txeof(sc, letoh16(tx_id));
9017 
9018 		ifp->if_opackets++;
9019 	}
9020 
9021 	if ((ifp->if_flags & IFF_OACTIVE) == 0)
9022 		ifp->if_start(ifp);
9023 }
9024 
9025 int
9026 bwi_bbp_power_on(struct bwi_softc *sc, enum bwi_clock_mode clk_mode)
9027 {
9028 	bwi_power_on(sc, 1);
9029 
9030 	return (bwi_set_clock_mode(sc, clk_mode));
9031 }
9032 
9033 void
9034 bwi_bbp_power_off(struct bwi_softc *sc)
9035 {
9036 	bwi_set_clock_mode(sc, BWI_CLOCK_MODE_SLOW);
9037 	bwi_power_off(sc, 1);
9038 }
9039 
9040 int
9041 bwi_get_pwron_delay(struct bwi_softc *sc)
9042 {
9043 	struct bwi_regwin *com, *old;
9044 	struct bwi_clock_freq freq;
9045 	uint32_t val;
9046 	int error;
9047 
9048 	com = &sc->sc_com_regwin;
9049 	KASSERT(BWI_REGWIN_EXIST(com));
9050 
9051 	if ((sc->sc_cap & BWI_CAP_CLKMODE) == 0)
9052 		return (0);
9053 
9054 	error = bwi_regwin_switch(sc, com, &old);
9055 	if (error)
9056 		return (error);
9057 
9058 	bwi_get_clock_freq(sc, &freq);
9059 
9060 	val = CSR_READ_4(sc, BWI_PLL_ON_DELAY);
9061 	sc->sc_pwron_delay = howmany((val + 2) * 1000000, freq.clkfreq_min);
9062 	DPRINTF(1, "%s: power on delay %u\n",
9063 	    sc->sc_dev.dv_xname, sc->sc_pwron_delay);
9064 
9065 	return (bwi_regwin_switch(sc, old, NULL));
9066 }
9067 
9068 int
9069 bwi_bus_attach(struct bwi_softc *sc)
9070 {
9071 	struct bwi_regwin *bus, *old;
9072 	int error;
9073 
9074 	bus = &sc->sc_bus_regwin;
9075 
9076 	error = bwi_regwin_switch(sc, bus, &old);
9077 	if (error)
9078 		return (error);
9079 
9080 	if (!bwi_regwin_is_enabled(sc, bus))
9081 		bwi_regwin_enable(sc, bus, 0);
9082 
9083 	/* Disable interripts */
9084 	CSR_WRITE_4(sc, BWI_INTRVEC, 0);
9085 
9086 	return (bwi_regwin_switch(sc, old, NULL));
9087 }
9088 
9089 const char *
9090 bwi_regwin_name(const struct bwi_regwin *rw)
9091 {
9092 	switch (rw->rw_type) {
9093 	case BWI_REGWIN_T_COM:
9094 		return ("COM");
9095 	case BWI_REGWIN_T_BUSPCI:
9096 		return ("PCI");
9097 	case BWI_REGWIN_T_MAC:
9098 		return ("MAC");
9099 	case BWI_REGWIN_T_BUSPCIE:
9100 		return ("PCIE");
9101 	}
9102 	panic("unknown regwin type 0x%04x", rw->rw_type);
9103 
9104 	return (NULL);
9105 }
9106 
9107 uint32_t
9108 bwi_regwin_disable_bits(struct bwi_softc *sc)
9109 {
9110 	uint32_t busrev;
9111 
9112 	/* XXX cache this */
9113 	busrev = __SHIFTOUT(CSR_READ_4(sc, BWI_ID_LO), BWI_ID_LO_BUSREV_MASK);
9114 	DPRINTF(1, "%s: bus rev %u\n", sc->sc_dev.dv_xname, busrev);
9115 
9116 	if (busrev == BWI_BUSREV_0)
9117 		return (BWI_STATE_LO_DISABLE1);
9118 	else if (busrev == BWI_BUSREV_1)
9119 		return (BWI_STATE_LO_DISABLE2);
9120 	else
9121 		return ((BWI_STATE_LO_DISABLE1 | BWI_STATE_LO_DISABLE2));
9122 }
9123 
9124 int
9125 bwi_regwin_is_enabled(struct bwi_softc *sc, struct bwi_regwin *rw)
9126 {
9127 	uint32_t val, disable_bits;
9128 
9129 	disable_bits = bwi_regwin_disable_bits(sc);
9130 	val = CSR_READ_4(sc, BWI_STATE_LO);
9131 
9132 	if ((val & (BWI_STATE_LO_CLOCK |
9133 	    BWI_STATE_LO_RESET |
9134 	    disable_bits)) == BWI_STATE_LO_CLOCK) {
9135 		DPRINTF(1, "%s: %s is enabled\n",
9136 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9137 		return (1);
9138 	} else {
9139 		DPRINTF(1, "%s: %s is disabled\n",
9140 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9141 		return (0);
9142 	}
9143 }
9144 
9145 void
9146 bwi_regwin_disable(struct bwi_softc *sc, struct bwi_regwin *rw, uint32_t flags)
9147 {
9148 	uint32_t state_lo, disable_bits;
9149 	int i;
9150 
9151 	state_lo = CSR_READ_4(sc, BWI_STATE_LO);
9152 
9153 	/*
9154 	 * If current regwin is in 'reset' state, it was already disabled.
9155 	 */
9156 	if (state_lo & BWI_STATE_LO_RESET) {
9157 		DPRINTF(1, "%s: %s was already disabled\n",
9158 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9159 		return;
9160 	}
9161 
9162 	disable_bits = bwi_regwin_disable_bits(sc);
9163 
9164 	/*
9165 	 * Disable normal clock
9166 	 */
9167 	state_lo = BWI_STATE_LO_CLOCK | disable_bits;
9168 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9169 
9170 	/*
9171 	 * Wait until normal clock is disabled
9172 	 */
9173 #define NRETRY	1000
9174 	for (i = 0; i < NRETRY; ++i) {
9175 		state_lo = CSR_READ_4(sc, BWI_STATE_LO);
9176 		if (state_lo & disable_bits)
9177 			break;
9178 		DELAY(10);
9179 	}
9180 	if (i == NRETRY) {
9181 		printf("%s: %s disable clock timeout\n",
9182 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9183 	}
9184 
9185 	for (i = 0; i < NRETRY; ++i) {
9186 		uint32_t state_hi;
9187 
9188 		state_hi = CSR_READ_4(sc, BWI_STATE_HI);
9189 		if ((state_hi & BWI_STATE_HI_BUSY) == 0)
9190 			break;
9191 		DELAY(10);
9192 	}
9193 	if (i == NRETRY) {
9194 		printf("%s: %s wait BUSY unset timeout\n",
9195 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9196 	}
9197 #undef NRETRY
9198 
9199 	/*
9200 	 * Reset and disable regwin with gated clock
9201 	 */
9202 	state_lo = BWI_STATE_LO_RESET | disable_bits |
9203 	    BWI_STATE_LO_CLOCK | BWI_STATE_LO_GATED_CLOCK |
9204 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9205 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9206 
9207 	/* Flush pending bus write */
9208 	CSR_READ_4(sc, BWI_STATE_LO);
9209 	DELAY(1);
9210 
9211 	/* Reset and disable regwin */
9212 	state_lo = BWI_STATE_LO_RESET | disable_bits |
9213 		   __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9214 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9215 
9216 	/* Flush pending bus write */
9217 	CSR_READ_4(sc, BWI_STATE_LO);
9218 	DELAY(1);
9219 }
9220 
9221 void
9222 bwi_regwin_enable(struct bwi_softc *sc, struct bwi_regwin *rw, uint32_t flags)
9223 {
9224 	uint32_t state_lo, state_hi, imstate;
9225 
9226 	bwi_regwin_disable(sc, rw, flags);
9227 
9228 	/* Reset regwin with gated clock */
9229 	state_lo = BWI_STATE_LO_RESET |
9230 	    BWI_STATE_LO_CLOCK |
9231 	    BWI_STATE_LO_GATED_CLOCK |
9232 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9233 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9234 
9235 	/* Flush pending bus write */
9236 	CSR_READ_4(sc, BWI_STATE_LO);
9237 	DELAY(1);
9238 
9239 	state_hi = CSR_READ_4(sc, BWI_STATE_HI);
9240 	if (state_hi & BWI_STATE_HI_SERROR)
9241 		CSR_WRITE_4(sc, BWI_STATE_HI, 0);
9242 
9243 	imstate = CSR_READ_4(sc, BWI_IMSTATE);
9244 	if (imstate & (BWI_IMSTATE_INBAND_ERR | BWI_IMSTATE_TIMEOUT)) {
9245 		imstate &= ~(BWI_IMSTATE_INBAND_ERR | BWI_IMSTATE_TIMEOUT);
9246 		CSR_WRITE_4(sc, BWI_IMSTATE, imstate);
9247 	}
9248 
9249 	/* Enable regwin with gated clock */
9250 	state_lo = BWI_STATE_LO_CLOCK |
9251 	    BWI_STATE_LO_GATED_CLOCK |
9252 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9253 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9254 
9255 	/* Flush pending bus write */
9256 	CSR_READ_4(sc, BWI_STATE_LO);
9257 	DELAY(1);
9258 
9259 	/* Enable regwin with normal clock */
9260 	state_lo = BWI_STATE_LO_CLOCK |
9261 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9262 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9263 
9264 	/* Flush pending bus write */
9265 	CSR_READ_4(sc, BWI_STATE_LO);
9266 	DELAY(1);
9267 }
9268 
9269 void
9270 bwi_set_bssid(struct bwi_softc *sc, const uint8_t *bssid)
9271 {
9272 	struct ieee80211com *ic = &sc->sc_ic;
9273 	struct bwi_mac *mac;
9274 	struct bwi_myaddr_bssid buf;
9275 	const uint8_t *p;
9276 	uint32_t val;
9277 	int n, i;
9278 
9279 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9280 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9281 
9282 	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_BSSID, bssid);
9283 
9284 	bcopy(ic->ic_myaddr, buf.myaddr, sizeof(buf.myaddr));
9285 	bcopy(bssid, buf.bssid, sizeof(buf.bssid));
9286 
9287 	n = sizeof(buf) / sizeof(val);
9288 	p = (const uint8_t *)&buf;
9289 	for (i = 0; i < n; ++i) {
9290 		int j;
9291 
9292 		val = 0;
9293 		for (j = 0; j < sizeof(val); ++j)
9294 			val |= ((uint32_t)(*p++)) << (j * 8);
9295 
9296 		TMPLT_WRITE_4(mac, 0x20 + (i * sizeof(val)), val);
9297 	}
9298 }
9299 
9300 void
9301 bwi_updateslot(struct ieee80211com *ic)
9302 {
9303 	struct bwi_softc *sc = ic->ic_if.if_softc;
9304 	struct bwi_mac *mac;
9305 	struct ifnet *ifp = &ic->ic_if;
9306 
9307 	if ((ifp->if_flags & IFF_RUNNING) == 0)
9308 		return;
9309 
9310 	DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
9311 
9312 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9313 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9314 
9315 	bwi_mac_updateslot(mac, (ic->ic_flags & IEEE80211_F_SHSLOT));
9316 }
9317 
9318 void
9319 bwi_calibrate(void *xsc)
9320 {
9321 	struct bwi_softc *sc = xsc;
9322 	struct ieee80211com *ic = &sc->sc_ic;
9323 	int s;
9324 
9325 	s = splnet();
9326 
9327 	if (ic->ic_state == IEEE80211_S_RUN) {
9328 		struct bwi_mac *mac;
9329 
9330 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9331 		mac = (struct bwi_mac *)sc->sc_cur_regwin;
9332 
9333 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
9334 			bwi_mac_calibrate_txpower(mac, sc->sc_txpwrcb_type);
9335 			sc->sc_txpwrcb_type = BWI_TXPWR_CALIB;
9336 		}
9337 
9338 		/* XXX 15 seconds */
9339 		timeout_add_sec(&sc->sc_calib_ch, 15);
9340 	}
9341 
9342 	splx(s);
9343 }
9344 
9345 int
9346 bwi_calc_rssi(struct bwi_softc *sc, const struct bwi_rxbuf_hdr *hdr)
9347 {
9348 	struct bwi_mac *mac;
9349 
9350 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9351 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9352 
9353 	return (bwi_rf_calc_rssi(mac, hdr));
9354 }
9355