xref: /openbsd-src/sys/dev/ic/bwi.c (revision d13be5d47e4149db2549a9828e244d59dbc43f15)
1 /*	$OpenBSD: bwi.c,v 1.95 2010/08/27 17:08:00 jsg Exp $	*/
2 
3 /*
4  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
5  *
6  * This code is derived from software contributed to The DragonFly Project
7  * by Sepherosa Ziehau <sepherosa@gmail.com>
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  * 3. Neither the name of The DragonFly Project nor the names of its
20  *    contributors may be used to endorse or promote products derived
21  *    from this software without specific, prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
26  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
27  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
28  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
29  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
30  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
31  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
32  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
33  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  * $DragonFly: src/sys/dev/netif/bwi/bwimac.c,v 1.1 2007/09/08 06:15:54 sephe Exp $
37  */
38 
39 #include "bpfilter.h"
40 
41 #include <sys/cdefs.h>
42 #include <sys/param.h>
43 #include <sys/types.h>
44 
45 #include <sys/device.h>
46 #include <sys/kernel.h>
47 #include <sys/malloc.h>
48 #include <sys/workq.h>
49 #include <sys/mbuf.h>
50 #include <sys/proc.h>
51 #include <sys/socket.h>
52 #include <sys/sockio.h>
53 #include <sys/systm.h>
54 
55 #include <machine/bus.h>
56 #include <machine/endian.h>
57 #include <machine/intr.h>
58 
59 #include <net/if.h>
60 #include <net/if_dl.h>
61 #include <net/if_media.h>
62 
63 #if NBPFILTER > 0
64 #include <net/bpf.h>
65 #endif
66 
67 #include <netinet/in.h>
68 #include <netinet/in_systm.h>
69 #include <netinet/if_ether.h>
70 
71 #include <net80211/ieee80211_var.h>
72 #include <net80211/ieee80211_amrr.h>
73 #include <net80211/ieee80211_radiotap.h>
74 
75 #include <dev/ic/bwireg.h>
76 #include <dev/ic/bwivar.h>
77 
78 #ifdef BWI_DEBUG
79 int bwi_debug = 1;
80 #define DPRINTF(l, x...)	do { if ((l) <= bwi_debug) printf(x); } while (0)
81 #else
82 #define DPRINTF(l, x...)
83 #endif
84 
85 /* XXX temporary porting goop */
86 #include <dev/pci/pcireg.h>
87 #include <dev/pci/pcivar.h>
88 #include <dev/pci/pcidevs.h>
89 
90 /* XXX does not belong here */
91 #define IEEE80211_OFDM_PLCP_RATE_MASK	0x0000000f
92 #define IEEE80211_OFDM_PLCP_LEN_MASK	0x0001ffe0
93 
94 /*
95  * Contention window (slots).
96  */
97 #define IEEE80211_CW_MAX	1023	/* aCWmax */
98 #define IEEE80211_CW_MIN_0	31	/* DS/CCK aCWmin, ERP aCWmin(0) */
99 #define IEEE80211_CW_MIN_1	15	/* OFDM aCWmin, ERP aCWmin(1) */
100 
101 #define __unused __attribute__((__unused__))
102 
103 extern int ticks;
104 
105 /* XXX end porting goop */
106 
107 /* MAC */
108 struct bwi_retry_lim {
109 	uint16_t	shretry;
110 	uint16_t	shretry_fb;
111 	uint16_t	lgretry;
112 	uint16_t	lgretry_fb;
113 };
114 
115 struct bwi_clock_freq {
116 	uint		clkfreq_min;
117 	uint		clkfreq_max;
118 };
119 
120 /* XXX does not belong here */
121 struct ieee80211_ds_plcp_hdr {
122 	uint8_t		i_signal;
123 	uint8_t		i_service;
124 	uint16_t	i_length;
125 	uint16_t	i_crc;
126 } __packed;
127 
128 enum bwi_modtype {
129 	IEEE80211_MODTYPE_DS	= 0,	/* DS/CCK modulation */
130 	IEEE80211_MODTYPE_PBCC	= 1,	/* PBCC modulation */
131 	IEEE80211_MODTYPE_OFDM	= 2	/* OFDM modulation */
132 };
133 #define IEEE80211_MODTYPE_CCK   IEEE80211_MODTYPE_DS
134 
135 /* MAC */
136 void		 bwi_tmplt_write_4(struct bwi_mac *, uint32_t, uint32_t);
137 void		 bwi_hostflags_write(struct bwi_mac *, uint64_t);
138 uint64_t	 bwi_hostflags_read(struct bwi_mac *);
139 uint16_t	 bwi_memobj_read_2(struct bwi_mac *, uint16_t, uint16_t);
140 uint32_t	 bwi_memobj_read_4(struct bwi_mac *, uint16_t, uint16_t);
141 void		 bwi_memobj_write_2(struct bwi_mac *, uint16_t, uint16_t,
142 		     uint16_t);
143 void		 bwi_memobj_write_4(struct bwi_mac *, uint16_t, uint16_t,
144 		     uint32_t);
145 int		 bwi_mac_lateattach(struct bwi_mac *);
146 int		 bwi_mac_init(struct bwi_mac *);
147 void		 bwi_mac_reset(struct bwi_mac *, int);
148 void		 bwi_mac_set_tpctl_11bg(struct bwi_mac *,
149 		     const struct bwi_tpctl *);
150 int		 bwi_mac_test(struct bwi_mac *);
151 void		 bwi_mac_setup_tpctl(struct bwi_mac *);
152 void		 bwi_mac_dummy_xmit(struct bwi_mac *);
153 void		 bwi_mac_init_tpctl_11bg(struct bwi_mac *);
154 void		 bwi_mac_detach(struct bwi_mac *);
155 int		 bwi_get_firmware(const char *, const uint8_t *, size_t,
156 		     size_t *, size_t *);
157 int		 bwi_fwimage_is_valid(struct bwi_softc *, uint8_t *,
158 		     size_t, char *, uint8_t);
159 int		 bwi_mac_fw_alloc(struct bwi_mac *);
160 void		 bwi_mac_fw_free(struct bwi_mac *);
161 int		 bwi_mac_fw_load(struct bwi_mac *);
162 int		 bwi_mac_gpio_init(struct bwi_mac *);
163 int		 bwi_mac_gpio_fini(struct bwi_mac *);
164 int		 bwi_mac_fw_load_iv(struct bwi_mac *, uint8_t *, size_t);
165 int		 bwi_mac_fw_init(struct bwi_mac *);
166 void		 bwi_mac_opmode_init(struct bwi_mac *);
167 void		 bwi_mac_hostflags_init(struct bwi_mac *);
168 void		 bwi_mac_bss_param_init(struct bwi_mac *);
169 void		 bwi_mac_set_retry_lim(struct bwi_mac *,
170 		     const struct bwi_retry_lim *);
171 void		 bwi_mac_set_ackrates(struct bwi_mac *,
172 		     const struct ieee80211_rateset *);
173 int		 bwi_mac_start(struct bwi_mac *);
174 int		 bwi_mac_stop(struct bwi_mac *);
175 int		 bwi_mac_config_ps(struct bwi_mac *);
176 void		 bwi_mac_reset_hwkeys(struct bwi_mac *);
177 void		 bwi_mac_shutdown(struct bwi_mac *);
178 int		 bwi_mac_get_property(struct bwi_mac *);
179 void		 bwi_mac_updateslot(struct bwi_mac *, int);
180 int		 bwi_mac_attach(struct bwi_softc *, int, uint8_t);
181 void		 bwi_mac_balance_atten(int *, int *);
182 void		 bwi_mac_adjust_tpctl(struct bwi_mac *, int, int);
183 void		 bwi_mac_calibrate_txpower(struct bwi_mac *,
184 		     enum bwi_txpwrcb_type);
185 void		 bwi_mac_lock(struct bwi_mac *);
186 void		 bwi_mac_unlock(struct bwi_mac *);
187 void		 bwi_mac_set_promisc(struct bwi_mac *, int);
188 
189 /* PHY */
190 void		 bwi_phy_write(struct bwi_mac *, uint16_t, uint16_t);
191 uint16_t	 bwi_phy_read(struct bwi_mac *, uint16_t);
192 int		 bwi_phy_attach(struct bwi_mac *);
193 void		 bwi_phy_set_bbp_atten(struct bwi_mac *, uint16_t);
194 int		 bwi_phy_calibrate(struct bwi_mac *);
195 void		 bwi_tbl_write_2(struct bwi_mac *mac, uint16_t, uint16_t);
196 void		 bwi_tbl_write_4(struct bwi_mac *mac, uint16_t, uint32_t);
197 void		 bwi_nrssi_write(struct bwi_mac *, uint16_t, int16_t);
198 int16_t		 bwi_nrssi_read(struct bwi_mac *, uint16_t);
199 void		 bwi_phy_init_11a(struct bwi_mac *);
200 void		 bwi_phy_init_11g(struct bwi_mac *);
201 void		 bwi_phy_init_11b_rev2(struct bwi_mac *);
202 void		 bwi_phy_init_11b_rev4(struct bwi_mac *);
203 void		 bwi_phy_init_11b_rev5(struct bwi_mac *);
204 void		 bwi_phy_init_11b_rev6(struct bwi_mac *);
205 void		 bwi_phy_config_11g(struct bwi_mac *);
206 void		 bwi_phy_config_agc(struct bwi_mac *);
207 void		 bwi_set_gains(struct bwi_mac *, const struct bwi_gains *);
208 void		 bwi_phy_clear_state(struct bwi_phy *);
209 
210 /* RF */
211 int16_t		 bwi_nrssi_11g(struct bwi_mac *);
212 struct bwi_rf_lo
213 		*bwi_get_rf_lo(struct bwi_mac *, uint16_t, uint16_t);
214 int		 bwi_rf_lo_isused(struct bwi_mac *, const struct bwi_rf_lo *);
215 void		 bwi_rf_write(struct bwi_mac *, uint16_t, uint16_t);
216 uint16_t	 bwi_rf_read(struct bwi_mac *, uint16_t);
217 int		 bwi_rf_attach(struct bwi_mac *);
218 void		 bwi_rf_set_chan(struct bwi_mac *, uint, int);
219 void		 bwi_rf_get_gains(struct bwi_mac *);
220 void		 bwi_rf_init(struct bwi_mac *);
221 void		 bwi_rf_off_11a(struct bwi_mac *);
222 void		 bwi_rf_off_11bg(struct bwi_mac *);
223 void		 bwi_rf_off_11g_rev5(struct bwi_mac *);
224 void		 bwi_rf_workaround(struct bwi_mac *, uint);
225 struct bwi_rf_lo
226 		*bwi_rf_lo_find(struct bwi_mac *, const struct bwi_tpctl *);
227 void		 bwi_rf_lo_adjust(struct bwi_mac *, const struct bwi_tpctl *);
228 void		 bwi_rf_lo_write(struct bwi_mac *, const struct bwi_rf_lo *);
229 int		 bwi_rf_gain_max_reached(struct bwi_mac *, int);
230 uint16_t	 bwi_bitswap4(uint16_t);
231 uint16_t	 bwi_phy812_value(struct bwi_mac *, uint16_t);
232 void		 bwi_rf_init_bcm2050(struct bwi_mac *);
233 uint16_t	 bwi_rf_calibval(struct bwi_mac *);
234 int32_t		 _bwi_adjust_devide(int32_t, int32_t);
235 int		 bwi_rf_calc_txpower(int8_t *, uint8_t, const int16_t[]);
236 int		 bwi_rf_map_txpower(struct bwi_mac *);
237 void		 bwi_rf_lo_update_11g(struct bwi_mac *);
238 uint32_t	 bwi_rf_lo_devi_measure(struct bwi_mac *, uint16_t);
239 uint16_t	 bwi_rf_get_tp_ctrl2(struct bwi_mac *);
240 uint8_t		 _bwi_rf_lo_update_11g(struct bwi_mac *, uint16_t);
241 void		 bwi_rf_lo_measure_11g(struct bwi_mac *,
242 		     const struct bwi_rf_lo *, struct bwi_rf_lo *, uint8_t);
243 void		 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *);
244 void		 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *);
245 void		 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *);
246 void		 bwi_rf_init_sw_nrssi_table(struct bwi_mac *);
247 void		 bwi_rf_init_hw_nrssi_table(struct bwi_mac *, uint16_t);
248 void		 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *);
249 int32_t		 _nrssi_threshold(const struct bwi_rf *, int32_t);
250 void		 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *);
251 void		 bwi_rf_clear_tssi(struct bwi_mac *);
252 void		 bwi_rf_clear_state(struct bwi_rf *);
253 void		 bwi_rf_on_11a(struct bwi_mac *);
254 void		 bwi_rf_on_11bg(struct bwi_mac *);
255 void		 bwi_rf_set_ant_mode(struct bwi_mac *, int);
256 int		 bwi_rf_get_latest_tssi(struct bwi_mac *, int8_t[], uint16_t);
257 int		 bwi_rf_tssi2dbm(struct bwi_mac *, int8_t, int8_t *);
258 int		 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *,
259 		     const struct bwi_rxbuf_hdr *);
260 int		 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *,
261 		     const struct bwi_rxbuf_hdr *);
262 int		 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *,
263 		     const struct bwi_rxbuf_hdr *);
264 uint16_t	 bwi_rf_lo_measure_11b(struct bwi_mac *);
265 void		 bwi_rf_lo_update_11b(struct bwi_mac *);
266 
267 /* INTERFACE */
268 uint16_t	 bwi_read_sprom(struct bwi_softc *, uint16_t);
269 void		 bwi_setup_desc32(struct bwi_softc *, struct bwi_desc32 *, int,
270 		     int, bus_addr_t, int, int);
271 void		 bwi_power_on(struct bwi_softc *, int);
272 int		 bwi_power_off(struct bwi_softc *, int);
273 int		 bwi_regwin_switch(struct bwi_softc *, struct bwi_regwin *,
274 		     struct bwi_regwin **);
275 int		 bwi_regwin_select(struct bwi_softc *, int);
276 void		 bwi_regwin_info(struct bwi_softc *, uint16_t *, uint8_t *);
277 void		 bwi_led_attach(struct bwi_softc *);
278 void		 bwi_led_newstate(struct bwi_softc *, enum ieee80211_state);
279 uint16_t	 bwi_led_onoff(struct bwi_led *, uint16_t, int);
280 void		 bwi_led_event(struct bwi_softc *, int);
281 void		 bwi_led_blink_start(struct bwi_softc *, int, int);
282 void		 bwi_led_blink_next(void *);
283 void		 bwi_led_blink_end(void *);
284 int		 bwi_bbp_attach(struct bwi_softc *);
285 int		 bwi_bus_init(struct bwi_softc *, struct bwi_mac *);
286 void		 bwi_get_card_flags(struct bwi_softc *);
287 void		 bwi_get_eaddr(struct bwi_softc *, uint16_t, uint8_t *);
288 void		 bwi_get_clock_freq(struct bwi_softc *,
289 		     struct bwi_clock_freq *);
290 int		 bwi_set_clock_mode(struct bwi_softc *, enum bwi_clock_mode);
291 int		 bwi_set_clock_delay(struct bwi_softc *);
292 int		 bwi_ioctl(struct ifnet *, u_long, caddr_t);
293 void		 bwi_start(struct ifnet *);
294 void		 bwi_watchdog(struct ifnet *);
295 void		 bwi_newstate_begin(struct bwi_softc *, enum ieee80211_state);
296 void		 bwi_init_statechg(struct bwi_softc *, int);
297 int		 bwi_newstate(struct ieee80211com *, enum ieee80211_state, int);
298 int		 bwi_media_change(struct ifnet *);
299 void		 bwi_iter_func(void *, struct ieee80211_node *);
300 void		 bwi_amrr_timeout(void *);
301 void		 bwi_newassoc(struct ieee80211com *, struct ieee80211_node *,
302 		     int);
303 struct ieee80211_node
304 		*bwi_node_alloc(struct ieee80211com *ic);
305 int		 bwi_dma_alloc(struct bwi_softc *);
306 void		 bwi_dma_free(struct bwi_softc *);
307 int		 bwi_dma_ring_alloc(struct bwi_softc *,
308 		     struct bwi_ring_data *, bus_size_t, uint32_t);
309 int		 bwi_dma_txstats_alloc(struct bwi_softc *, uint32_t,
310 		     bus_size_t);
311 void		 bwi_dma_txstats_free(struct bwi_softc *);
312 int		 bwi_dma_mbuf_create(struct bwi_softc *);
313 void		 bwi_dma_mbuf_destroy(struct bwi_softc *, int, int);
314 void		 bwi_enable_intrs(struct bwi_softc *, uint32_t);
315 void		 bwi_disable_intrs(struct bwi_softc *, uint32_t);
316 int		 bwi_init_tx_ring32(struct bwi_softc *, int);
317 void		 bwi_init_rxdesc_ring32(struct bwi_softc *, uint32_t,
318 		     bus_addr_t, int, int);
319 int		 bwi_init_rx_ring32(struct bwi_softc *);
320 int		 bwi_init_txstats32(struct bwi_softc *);
321 void		 bwi_setup_rx_desc32(struct bwi_softc *, int, bus_addr_t, int);
322 void		 bwi_setup_tx_desc32(struct bwi_softc *, struct bwi_ring_data *,
323 		     int, bus_addr_t, int);
324 int		 bwi_init_tx_ring64(struct bwi_softc *, int);
325 int		 bwi_init_rx_ring64(struct bwi_softc *);
326 int		 bwi_init_txstats64(struct bwi_softc *);
327 void		 bwi_setup_rx_desc64(struct bwi_softc *, int, bus_addr_t, int);
328 void		 bwi_setup_tx_desc64(struct bwi_softc *, struct bwi_ring_data *,
329 		     int, bus_addr_t, int);
330 int		 bwi_newbuf(struct bwi_softc *, int, int);
331 void		 bwi_set_addr_filter(struct bwi_softc *, uint16_t,
332 		     const uint8_t *);
333 int		 bwi_set_chan(struct bwi_softc *, uint8_t);
334 void		 bwi_next_scan(void *);
335 int		 bwi_rxeof(struct bwi_softc *, int);
336 int		 bwi_rxeof32(struct bwi_softc *);
337 int		 bwi_rxeof64(struct bwi_softc *);
338 void		 bwi_reset_rx_ring32(struct bwi_softc *, uint32_t);
339 void		 bwi_free_txstats32(struct bwi_softc *);
340 void		 bwi_free_rx_ring32(struct bwi_softc *);
341 void		 bwi_free_tx_ring32(struct bwi_softc *, int);
342 void		 bwi_free_txstats64(struct bwi_softc *);
343 void		 bwi_free_rx_ring64(struct bwi_softc *);
344 void		 bwi_free_tx_ring64(struct bwi_softc *, int);
345 uint8_t		 bwi_plcp2rate(uint32_t, enum ieee80211_phymode);
346 void		 bwi_ofdm_plcp_header(uint32_t *, int, uint8_t);
347 void		 bwi_ds_plcp_header(struct ieee80211_ds_plcp_hdr *, int,
348 		     uint8_t);
349 void		 bwi_plcp_header(void *, int, uint8_t);
350 int		 bwi_encap(struct bwi_softc *, int, struct mbuf *,
351 		     struct ieee80211_node *);
352 void		 bwi_start_tx32(struct bwi_softc *, uint32_t, int);
353 void		 bwi_start_tx64(struct bwi_softc *, uint32_t, int);
354 void		 bwi_txeof_status32(struct bwi_softc *);
355 void		 bwi_txeof_status64(struct bwi_softc *);
356 void		 _bwi_txeof(struct bwi_softc *, uint16_t);
357 void		 bwi_txeof_status(struct bwi_softc *, int);
358 void		 bwi_txeof(struct bwi_softc *);
359 int		 bwi_bbp_power_on(struct bwi_softc *, enum bwi_clock_mode);
360 void		 bwi_bbp_power_off(struct bwi_softc *);
361 int		 bwi_get_pwron_delay(struct bwi_softc *sc);
362 int		 bwi_bus_attach(struct bwi_softc *);
363 const char 	*bwi_regwin_name(const struct bwi_regwin *);
364 int		 bwi_regwin_is_enabled(struct bwi_softc *, struct bwi_regwin *);
365 uint32_t	 bwi_regwin_disable_bits(struct bwi_softc *);
366 void		 bwi_regwin_enable(struct bwi_softc *, struct bwi_regwin *,
367 		     uint32_t);
368 void		 bwi_regwin_disable(struct bwi_softc *, struct bwi_regwin *,
369 		     uint32_t);
370 void		 bwi_set_bssid(struct bwi_softc *, const uint8_t *);
371 void		 bwi_updateslot(struct ieee80211com *);
372 void		 bwi_calibrate(void *);
373 int		 bwi_calc_rssi(struct bwi_softc *,
374 		     const struct bwi_rxbuf_hdr *);
375 uint8_t		 bwi_ack_rate(struct ieee80211_node *, uint8_t);
376 uint16_t	 bwi_txtime(struct ieee80211com *, struct ieee80211_node *,
377 		     uint, uint8_t, uint32_t);
378 enum bwi_modtype
379 		 bwi_rate2modtype(uint8_t);
380 
381 
382 static const uint8_t bwi_sup_macrev[] = { 2, 4, 5, 6, 7, 9, 10 };
383 
384 #define SUP_BPHY(num)	{ .rev = num, .init = bwi_phy_init_11b_rev##num }
385 
386 static const struct {
387 	uint8_t	rev;
388 	void	(*init)(struct bwi_mac *);
389 } bwi_sup_bphy[] = {
390 	SUP_BPHY(2),
391 	SUP_BPHY(4),
392 	SUP_BPHY(5),
393 	SUP_BPHY(6)
394 };
395 
396 #undef SUP_BPHY
397 
398 #define BWI_PHYTBL_WRSSI	0x1000
399 #define BWI_PHYTBL_NOISE_SCALE	0x1400
400 #define BWI_PHYTBL_NOISE	0x1800
401 #define BWI_PHYTBL_ROTOR	0x2000
402 #define BWI_PHYTBL_DELAY	0x2400
403 #define BWI_PHYTBL_RSSI		0x4000
404 #define BWI_PHYTBL_SIGMA_SQ	0x5000
405 #define BWI_PHYTBL_WRSSI_REV1	0x5400
406 #define BWI_PHYTBL_FREQ		0x5800
407 
408 static const uint16_t	bwi_phy_freq_11g_rev1[] =
409 	{ BWI_PHY_FREQ_11G_REV1 };
410 static const uint16_t	bwi_phy_noise_11g_rev1[] =
411 	{ BWI_PHY_NOISE_11G_REV1 };
412 static const uint16_t	bwi_phy_noise_11g[] =
413 	{ BWI_PHY_NOISE_11G };
414 static const uint32_t	bwi_phy_rotor_11g_rev1[] =
415 	{ BWI_PHY_ROTOR_11G_REV1 };
416 static const uint16_t	bwi_phy_noise_scale_11g_rev2[] =
417 	{ BWI_PHY_NOISE_SCALE_11G_REV2 };
418 static const uint16_t	bwi_phy_noise_scale_11g_rev7[] =
419 	{ BWI_PHY_NOISE_SCALE_11G_REV7 };
420 static const uint16_t	bwi_phy_noise_scale_11g[] =
421 	{ BWI_PHY_NOISE_SCALE_11G };
422 static const uint16_t	bwi_phy_sigma_sq_11g_rev2[] =
423 	{ BWI_PHY_SIGMA_SQ_11G_REV2 };
424 static const uint16_t	bwi_phy_sigma_sq_11g_rev7[] =
425 	{ BWI_PHY_SIGMA_SQ_11G_REV7 };
426 static const uint32_t	bwi_phy_delay_11g_rev1[] =
427 	{ BWI_PHY_DELAY_11G_REV1 };
428 
429 /* RF */
430 #define RF_LO_WRITE(mac, lo)	bwi_rf_lo_write((mac), (lo))
431 
432 #define BWI_RF_2GHZ_CHAN(chan) \
433 	(ieee80211_ieee2mhz((chan), IEEE80211_CHAN_2GHZ) - 2400)
434 
435 #define BWI_DEFAULT_IDLE_TSSI	52
436 
437 struct rf_saveregs {
438 	uint16_t	phy_01;
439 	uint16_t	phy_03;
440 	uint16_t	phy_0a;
441 	uint16_t	phy_15;
442 	uint16_t	phy_2a;
443 	uint16_t	phy_30;
444 	uint16_t	phy_35;
445 	uint16_t	phy_60;
446 	uint16_t	phy_429;
447 	uint16_t	phy_802;
448 	uint16_t	phy_811;
449 	uint16_t	phy_812;
450 	uint16_t	phy_814;
451 	uint16_t	phy_815;
452 
453 	uint16_t	rf_43;
454 	uint16_t	rf_52;
455 	uint16_t	rf_7a;
456 };
457 
458 #define SAVE_RF_REG(mac, regs, n)	(regs)->rf_##n = RF_READ((mac), 0x##n)
459 #define RESTORE_RF_REG(mac, regs, n)	RF_WRITE((mac), 0x##n, (regs)->rf_##n)
460 
461 #define SAVE_PHY_REG(mac, regs, n)	(regs)->phy_##n = PHY_READ((mac), 0x##n)
462 #define RESTORE_PHY_REG(mac, regs, n)	PHY_WRITE((mac), 0x##n, (regs)->phy_##n)
463 
464 static const int8_t	bwi_txpower_map_11b[BWI_TSSI_MAX] =
465 	{ BWI_TXPOWER_MAP_11B };
466 static const int8_t	bwi_txpower_map_11g[BWI_TSSI_MAX] =
467 	{ BWI_TXPOWER_MAP_11G };
468 
469 /* IF_BWI */
470 
471 struct bwi_myaddr_bssid {
472 	uint8_t		myaddr[IEEE80211_ADDR_LEN];
473 	uint8_t		bssid[IEEE80211_ADDR_LEN];
474 } __packed;
475 
476 #define IEEE80211_DS_PLCP_SERVICE_LOCKED	0x04
477 #define IEEE80211_DS_PLCL_SERVICE_PBCC		0x08
478 #define IEEE80211_DS_PLCP_SERVICE_LENEXT5	0x20
479 #define IEEE80211_DS_PLCP_SERVICE_LENEXT6	0x40
480 #define IEEE80211_DS_PLCP_SERVICE_LENEXT7	0x80
481 
482 struct cfdriver bwi_cd = {
483 	NULL, "bwi", DV_IFNET
484 };
485 
486 static const struct {
487 	uint16_t	did_min;
488 	uint16_t	did_max;
489 	uint16_t	bbp_id;
490 } bwi_bbpid_map[] = {
491 	{ 0x4301, 0x4301, 0x4301 },
492 	{ 0x4305, 0x4307, 0x4307 },
493 	{ 0x4402, 0x4403, 0x4402 },
494 	{ 0x4610, 0x4615, 0x4610 },
495 	{ 0x4710, 0x4715, 0x4710 },
496 	{ 0x4720, 0x4725, 0x4309 }
497 };
498 
499 static const struct {
500 	uint16_t	bbp_id;
501 	int		nregwin;
502 } bwi_regwin_count[] = {
503 	{ 0x4301, 5 },
504 	{ 0x4306, 6 },
505 	{ 0x4307, 5 },
506 	{ 0x4310, 8 },
507 	{ 0x4401, 3 },
508 	{ 0x4402, 3 },
509 	{ 0x4610, 9 },
510 	{ 0x4704, 9 },
511 	{ 0x4710, 9 },
512 	{ 0x5365, 7 }
513 };
514 
515 #define CLKSRC(src) 				\
516 [BWI_CLKSRC_ ## src] = {			\
517 	.freq_min = BWI_CLKSRC_ ##src## _FMIN,	\
518 	.freq_max = BWI_CLKSRC_ ##src## _FMAX	\
519 }
520 
521 static const struct {
522 	uint	freq_min;
523 	uint	freq_max;
524 } bwi_clkfreq[BWI_CLKSRC_MAX] = {
525 	CLKSRC(LP_OSC),
526 	CLKSRC(CS_OSC),
527 	CLKSRC(PCI)
528 };
529 
530 #undef CLKSRC
531 
532 #define VENDOR_LED_ACT(vendor)				\
533 {							\
534 	.vid = PCI_VENDOR_##vendor,			\
535 	.led_act = { BWI_VENDOR_LED_ACT_##vendor }	\
536 }
537 
538 const struct {
539 	uint16_t	vid;
540 	uint8_t		led_act[BWI_LED_MAX];
541 } bwi_vendor_led_act[] = {
542 	VENDOR_LED_ACT(COMPAQ),
543 	VENDOR_LED_ACT(LINKSYS)
544 };
545 
546 const uint8_t bwi_default_led_act[BWI_LED_MAX] =
547 	{ BWI_VENDOR_LED_ACT_DEFAULT };
548 
549 #undef VENDOR_LED_ACT
550 
551 const struct {
552 	int	on_dur;
553 	int	off_dur;
554 } bwi_led_duration[109] = {
555 	{ 400, 100 }, {   0,   0 }, { 150 ,  75 }, {   0,   0 }, {  90,  45 },
556 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
557 	{   0,   0 }, {  66,  34 }, {  53,   26 }, {   0,   0 }, {   0,   0 },
558 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {  42,  21 }, {   0,   0 },
559 	{   0,   0 }, {   0,   0 }, {  35,   17 }, {   0,   0 }, {  32,  16 },
560 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
561 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
562 	{   0,   0 }, {  21,  10 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
563 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
564 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {  16,   8 }, {   0,   0 },
565 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
566 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
567 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
568 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
569 	{   0,   0 }, {   0,   0 }, {  11,    5 }, {   0,   0 }, {   0,   0 },
570 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
571 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
572 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
573 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
574 	{   0,   0 }, {   9,   4 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
575 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   0,   0 }, {   0,   0 },
576 	{   0,   0 }, {   0,   0 }, {   0,    0 }, {   7,   3 }
577 };
578 
579 static const uint8_t bwi_zero_addr[IEEE80211_ADDR_LEN];
580 
581 
582 /* CODE */
583 
584 int
585 bwi_intr(void *xsc)
586 {
587 	struct bwi_softc *sc = xsc;
588 	struct bwi_mac *mac;
589 	struct ifnet *ifp = &sc->sc_ic.ic_if;
590 	uint32_t intr_status;
591 	uint32_t txrx_intr_status[BWI_TXRX_NRING];
592 	int i, txrx_error, tx = 0, rx_data = -1;
593 
594 	if ((ifp->if_flags & IFF_RUNNING) == 0)
595 		return (0);
596 
597 	/*
598 	 * Get interrupt status
599 	 */
600 	intr_status = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
601 	if (intr_status == 0xffffffff)	/* Not for us */
602 		return (0);
603 
604 	intr_status &= CSR_READ_4(sc, BWI_MAC_INTR_MASK);
605 	if (intr_status == 0)		/* Nothing is interesting */
606 		return (0);
607 
608 	DPRINTF(2, "%s: intr status 0x%08x\n",
609 	    sc->sc_dev.dv_xname, intr_status);
610 
611 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
612 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
613 
614 	txrx_error = 0;
615 
616 	for (i = 0; i < BWI_TXRX_NRING; ++i) {
617 		uint32_t mask;
618 
619 		if (BWI_TXRX_IS_RX(i))
620 			mask = BWI_TXRX_RX_INTRS;
621 		else
622 			mask = BWI_TXRX_TX_INTRS;
623 
624 		txrx_intr_status[i] =
625 		    CSR_READ_4(sc, BWI_TXRX_INTR_STATUS(i)) & mask;
626 
627 		if (txrx_intr_status[i] & BWI_TXRX_INTR_ERROR) {
628 			printf("%s: intr fatal TX/RX (%d) error 0x%08x\n",
629 			    sc->sc_dev.dv_xname, i, txrx_intr_status[i]);
630 			txrx_error = 1;
631 		}
632 	}
633 
634 	/*
635 	 * Acknowledge interrupt
636 	 */
637 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, intr_status);
638 
639 	for (i = 0; i < BWI_TXRX_NRING; ++i)
640 		CSR_WRITE_4(sc, BWI_TXRX_INTR_STATUS(i), txrx_intr_status[i]);
641 
642 	/* Disable all interrupts */
643 	bwi_disable_intrs(sc, BWI_ALL_INTRS);
644 
645 	if (intr_status & BWI_INTR_PHY_TXERR) {
646 		if (mac->mac_flags & BWI_MAC_F_PHYE_RESET) {
647 			printf("intr PHY TX error\n");
648 			/* XXX to netisr0? */
649 			bwi_init_statechg(sc, 0);
650 			return (0);
651 		}
652 	}
653 
654 	if (txrx_error) {
655 		/* TODO: reset device */
656 	}
657 
658 	if (intr_status & BWI_INTR_TBTT)
659 		bwi_mac_config_ps(mac);
660 
661 	if (intr_status & BWI_INTR_EO_ATIM)
662 		printf("%s: EO_ATIM\n", sc->sc_dev.dv_xname);
663 
664 	if (intr_status & BWI_INTR_PMQ) {
665 		for (;;) {
666 			if ((CSR_READ_4(sc, BWI_MAC_PS_STATUS) & 0x8) == 0)
667 				break;
668 		}
669 		CSR_WRITE_2(sc, BWI_MAC_PS_STATUS, 0x2);
670 	}
671 
672 	if (intr_status & BWI_INTR_NOISE)
673 		printf("%s: intr noise\n", sc->sc_dev.dv_xname);
674 
675 	if (txrx_intr_status[0] & BWI_TXRX_INTR_RX)
676 		rx_data = sc->sc_rxeof(sc);
677 
678 	if (txrx_intr_status[3] & BWI_TXRX_INTR_RX) {
679 		sc->sc_txeof_status(sc);
680 		tx = 1;
681 	}
682 
683 	if (intr_status & BWI_INTR_TX_DONE) {
684 		bwi_txeof(sc);
685 		tx = 1;
686 	}
687 
688 	/* Re-enable interrupts */
689 	bwi_enable_intrs(sc, BWI_INIT_INTRS);
690 
691 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
692 		int evt = BWI_LED_EVENT_NONE;
693 
694 		if (tx && rx_data > 0) {
695 			if (sc->sc_rx_rate > sc->sc_tx_rate)
696 				evt = BWI_LED_EVENT_RX;
697 			else
698 				evt = BWI_LED_EVENT_TX;
699 		} else if (tx) {
700 			evt = BWI_LED_EVENT_TX;
701 		} else if (rx_data > 0) {
702 			evt = BWI_LED_EVENT_RX;
703 		} else if (rx_data == 0) {
704 			evt = BWI_LED_EVENT_POLL;
705 		}
706 
707 		if (evt != BWI_LED_EVENT_NONE)
708 			bwi_led_event(sc, evt);
709 	}
710 
711 	return (1);
712 }
713 
714 int
715 bwi_attach(struct bwi_softc *sc)
716 {
717 	struct ieee80211com *ic = &sc->sc_ic;
718 	struct ifnet *ifp = &ic->ic_if;
719 	struct bwi_mac *mac;
720 	struct bwi_phy *phy;
721 	int i, error;
722 
723 	DPRINTF(1, "\n");
724 
725 	/* Initialize LED vars */
726 	sc->sc_led_idle = (2350 * hz) / 1000;
727 	sc->sc_led_blink = 1;
728 
729 	/* AMRR rate control */
730 	sc->sc_amrr.amrr_min_success_threshold = 1;
731 	sc->sc_amrr.amrr_max_success_threshold = 15;
732 	timeout_set(&sc->sc_amrr_ch, bwi_amrr_timeout, sc);
733 
734 	timeout_set(&sc->sc_scan_ch, bwi_next_scan, sc);
735 	timeout_set(&sc->sc_calib_ch, bwi_calibrate, sc);
736 
737 	bwi_power_on(sc, 1);
738 
739 	error = bwi_bbp_attach(sc);
740 	if (error)
741 		goto fail;
742 
743 	error = bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
744 	if (error)
745 		goto fail;
746 
747 	if (BWI_REGWIN_EXIST(&sc->sc_com_regwin)) {
748 		error = bwi_set_clock_delay(sc);
749 		if (error)
750 			goto fail;
751 
752 		error = bwi_set_clock_mode(sc, BWI_CLOCK_MODE_FAST);
753 		if (error)
754 			goto fail;
755 
756 		error = bwi_get_pwron_delay(sc);
757 		if (error)
758 			goto fail;
759 	}
760 
761 	error = bwi_bus_attach(sc);
762 	if (error)
763 		goto fail;
764 
765 	bwi_get_card_flags(sc);
766 
767 	bwi_led_attach(sc);
768 
769 	for (i = 0; i < sc->sc_nmac; ++i) {
770 		struct bwi_regwin *old;
771 
772 		mac = &sc->sc_mac[i];
773 		error = bwi_regwin_switch(sc, &mac->mac_regwin, &old);
774 		if (error)
775 			goto fail;
776 
777 		error = bwi_mac_lateattach(mac);
778 		if (error)
779 			goto fail;
780 
781 		error = bwi_regwin_switch(sc, old, NULL);
782 		if (error)
783 			goto fail;
784 	}
785 
786 	/*
787 	 * XXX First MAC is known to exist
788 	 * TODO2
789 	 */
790 	mac = &sc->sc_mac[0];
791 	phy = &mac->mac_phy;
792 
793 	bwi_bbp_power_off(sc);
794 
795 	error = bwi_dma_alloc(sc);
796 	if (error)
797 		goto fail;
798 
799 	/* setup interface */
800 	ifp->if_softc = sc;
801 	ifp->if_ioctl = bwi_ioctl;
802 	ifp->if_start = bwi_start;
803 	ifp->if_watchdog = bwi_watchdog;
804 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
805 	strlcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
806 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
807 	IFQ_SET_READY(&ifp->if_snd);
808 
809 	/* Get locale */
810 	sc->sc_locale = __SHIFTOUT(bwi_read_sprom(sc, BWI_SPROM_CARD_INFO),
811 	    BWI_SPROM_CARD_INFO_LOCALE);
812 	DPRINTF(1, "%s: locale: %d\n", sc->sc_dev.dv_xname, sc->sc_locale);
813 
814 	/*
815 	 * Setup ratesets, phytype, channels and get MAC address
816 	 */
817 	if (phy->phy_mode == IEEE80211_MODE_11B ||
818 	    phy->phy_mode == IEEE80211_MODE_11G) {
819 	    	uint16_t chan_flags;
820 
821 		ic->ic_sup_rates[IEEE80211_MODE_11B] =
822 		    ieee80211_std_rateset_11b;
823 
824 		if (phy->phy_mode == IEEE80211_MODE_11B) {
825 			chan_flags = IEEE80211_CHAN_B;
826 			ic->ic_phytype = IEEE80211_T_DS;
827 		} else {
828 			chan_flags = IEEE80211_CHAN_CCK |
829 			    IEEE80211_CHAN_OFDM |
830 			    IEEE80211_CHAN_DYN |
831 			    IEEE80211_CHAN_2GHZ;
832 			ic->ic_phytype = IEEE80211_T_OFDM;
833 			ic->ic_sup_rates[IEEE80211_MODE_11G] =
834 			    ieee80211_std_rateset_11g;
835 		}
836 
837 		/* XXX depend on locale */
838 		for (i = 1; i <= 14; ++i) {
839 			ic->ic_channels[i].ic_freq =
840 				ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
841 			ic->ic_channels[i].ic_flags = chan_flags;
842 		}
843 
844 		bwi_get_eaddr(sc, BWI_SPROM_11BG_EADDR, ic->ic_myaddr);
845 		if (IEEE80211_IS_MULTICAST(ic->ic_myaddr)) {
846 			bwi_get_eaddr(sc, BWI_SPROM_11A_EADDR, ic->ic_myaddr);
847 			if (IEEE80211_IS_MULTICAST(ic->ic_myaddr)) {
848 				printf("%s: invalid MAC address: %s\n",
849 				    sc->sc_dev.dv_xname,
850 				    ether_sprintf(ic->ic_myaddr));
851 			}
852 		}
853 	} else if (phy->phy_mode == IEEE80211_MODE_11A) {
854 		/* TODO: 11A */
855 		error = ENXIO;
856 		goto fail;
857 	} else
858 		panic("unknown phymode %d", phy->phy_mode);
859 
860 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
861 
862 	sc->sc_fw_version = BWI_FW_VERSION3;
863 	sc->sc_dwell_time = 200;
864 
865 	ic->ic_caps = IEEE80211_C_SHSLOT |
866 	    IEEE80211_C_SHPREAMBLE |
867 	    IEEE80211_C_WEP |
868 	    IEEE80211_C_RSN |
869 	    IEEE80211_C_MONITOR;
870 	ic->ic_state = IEEE80211_S_INIT;
871 	ic->ic_opmode = IEEE80211_M_STA;
872 
873 	ic->ic_updateslot = bwi_updateslot;
874 
875 	if_attach(ifp);
876 	ieee80211_ifattach(ifp);
877 
878 	sc->sc_newstate = ic->ic_newstate;
879 	ic->ic_newstate = bwi_newstate;
880 	ic->ic_newassoc = bwi_newassoc;
881 	ic->ic_node_alloc = bwi_node_alloc;
882 
883 	ieee80211_media_init(ifp, bwi_media_change, ieee80211_media_status);
884 
885 	if (error) {
886 		ieee80211_ifdetach(ifp);
887 		goto fail;
888 	}
889 
890 #if NBPFILTER > 0
891 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
892 	    sizeof(struct ieee80211_frame) + 64);
893 
894 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
895 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
896 	sc->sc_rxtap.wr_ihdr.it_present = htole32(BWI_RX_RADIOTAP_PRESENT);
897 
898 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
899 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
900 	sc->sc_txtap.wt_ihdr.it_present = htole32(BWI_TX_RADIOTAP_PRESENT);
901 #endif
902 
903 	return (0);
904 fail:
905 	return (error);
906 }
907 
908 int
909 bwi_detach(void *arg)
910 {
911 	struct bwi_softc *sc = arg;
912 	struct ifnet *ifp = &sc->sc_ic.ic_if;
913 	int i;
914 
915 	bwi_stop(sc, 1);
916 	ieee80211_ifdetach(ifp);
917 	if_detach(ifp);
918 
919 	for (i = 0; i < sc->sc_nmac; ++i)
920 		bwi_mac_detach(&sc->sc_mac[i]);
921 
922 	bwi_dma_free(sc);
923 
924 	return (0);
925 }
926 
927 /* MAC */
928 
929 void
930 bwi_tmplt_write_4(struct bwi_mac *mac, uint32_t ofs, uint32_t val)
931 {
932 	struct bwi_softc *sc = mac->mac_sc;
933 
934 	if (mac->mac_flags & BWI_MAC_F_BSWAP)
935 		val = swap32(val);
936 
937 	CSR_WRITE_4(sc, BWI_MAC_TMPLT_CTRL, ofs);
938 	CSR_WRITE_4(sc, BWI_MAC_TMPLT_DATA, val);
939 }
940 
941 void
942 bwi_hostflags_write(struct bwi_mac *mac, uint64_t flags)
943 {
944 	uint64_t val;
945 
946 	val = flags & 0xffff;
947 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO, val);
948 
949 	val = (flags >> 16) & 0xffff;
950 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI, val);
951 
952 	/* HI has unclear meaning, so leave it as it is */
953 }
954 
955 uint64_t
956 bwi_hostflags_read(struct bwi_mac *mac)
957 {
958 	uint64_t flags, val;
959 
960 	/* HI has unclear meaning, so don't touch it */
961 	flags = 0;
962 
963 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI);
964 	flags |= val << 16;
965 
966 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO);
967 	flags |= val;
968 
969 	return (flags);
970 }
971 
972 uint16_t
973 bwi_memobj_read_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
974 {
975 	struct bwi_softc *sc = mac->mac_sc;
976 	uint32_t data_reg;
977 	int ofs;
978 
979 	data_reg = BWI_MOBJ_DATA;
980 	ofs = ofs0 / 4;
981 
982 	if (ofs0 % 4 != 0)
983 		data_reg = BWI_MOBJ_DATA_UNALIGN;
984 
985 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
986 	return (CSR_READ_2(sc, data_reg));
987 }
988 
989 uint32_t
990 bwi_memobj_read_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
991 {
992 	struct bwi_softc *sc = mac->mac_sc;
993 	int ofs;
994 
995 	ofs = ofs0 / 4;
996 	if (ofs0 % 4 != 0) {
997 		uint32_t ret;
998 
999 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1000 		ret = CSR_READ_2(sc, BWI_MOBJ_DATA_UNALIGN);
1001 		ret <<= 16;
1002 
1003 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1004 		    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
1005 		ret |= CSR_READ_2(sc, BWI_MOBJ_DATA);
1006 
1007 		return (ret);
1008 	} else {
1009 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1010 		return (CSR_READ_4(sc, BWI_MOBJ_DATA));
1011 	}
1012 }
1013 
1014 void
1015 bwi_memobj_write_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
1016     uint16_t v)
1017 {
1018 	struct bwi_softc *sc = mac->mac_sc;
1019 	uint32_t data_reg;
1020 	int ofs;
1021 
1022 	data_reg = BWI_MOBJ_DATA;
1023 	ofs = ofs0 / 4;
1024 
1025 	if (ofs0 % 4 != 0)
1026 		data_reg = BWI_MOBJ_DATA_UNALIGN;
1027 
1028 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1029 	CSR_WRITE_2(sc, data_reg, v);
1030 }
1031 
1032 void
1033 bwi_memobj_write_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
1034     uint32_t v)
1035 {
1036 	struct bwi_softc *sc = mac->mac_sc;
1037 	int ofs;
1038 
1039 	ofs = ofs0 / 4;
1040 	if (ofs0 % 4 != 0) {
1041 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1042 		CSR_WRITE_2(sc, BWI_MOBJ_DATA_UNALIGN, v >> 16);
1043 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1044 		    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
1045 		CSR_WRITE_2(sc, BWI_MOBJ_DATA, v & 0xffff);
1046 	} else {
1047 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
1048 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, v);
1049 	}
1050 }
1051 
1052 int
1053 bwi_mac_lateattach(struct bwi_mac *mac)
1054 {
1055 	int error;
1056 
1057 	if (mac->mac_rev >= 5)
1058 		CSR_READ_4(mac->mac_sc, BWI_STATE_HI); /* dummy read */
1059 
1060 	bwi_mac_reset(mac, 1);
1061 
1062 	error = bwi_phy_attach(mac);
1063 	if (error)
1064 		return (error);
1065 
1066 	error = bwi_rf_attach(mac);
1067 	if (error)
1068 		return (error);
1069 
1070 	/* Link 11B/G PHY, unlink 11A PHY */
1071 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A)
1072 		bwi_mac_reset(mac, 0);
1073 	else
1074 		bwi_mac_reset(mac, 1);
1075 
1076 	error = bwi_mac_test(mac);
1077 	if (error)
1078 		return (error);
1079 
1080 	error = bwi_mac_get_property(mac);
1081 	if (error)
1082 		return (error);
1083 
1084 	error = bwi_rf_map_txpower(mac);
1085 	if (error)
1086 		return (error);
1087 
1088 	bwi_rf_off(mac);
1089 	CSR_WRITE_2(mac->mac_sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
1090 	bwi_regwin_disable(mac->mac_sc, &mac->mac_regwin, 0);
1091 
1092 	return (0);
1093 }
1094 
1095 int
1096 bwi_mac_init(struct bwi_mac *mac)
1097 {
1098 	struct bwi_softc *sc = mac->mac_sc;
1099 	int error, i;
1100 
1101 	/* Clear MAC/PHY/RF states */
1102 	bwi_mac_setup_tpctl(mac);
1103 	bwi_rf_clear_state(&mac->mac_rf);
1104 	bwi_phy_clear_state(&mac->mac_phy);
1105 
1106 	/* Enable MAC and linked it to PHY */
1107 	if (!bwi_regwin_is_enabled(sc, &mac->mac_regwin))
1108 		bwi_mac_reset(mac, 1);
1109 
1110 	/* Initialize backplane */
1111 	error = bwi_bus_init(sc, mac);
1112 	if (error)
1113 		return (error);
1114 
1115 	/* XXX work around for hardware bugs? */
1116 	if (sc->sc_bus_regwin.rw_rev <= 5 &&
1117 	    sc->sc_bus_regwin.rw_type != BWI_REGWIN_T_BUSPCIE) {
1118 		CSR_SETBITS_4(sc, BWI_CONF_LO,
1119 		__SHIFTIN(BWI_CONF_LO_SERVTO, BWI_CONF_LO_SERVTO_MASK) |
1120 		__SHIFTIN(BWI_CONF_LO_REQTO, BWI_CONF_LO_REQTO_MASK));
1121 	}
1122 
1123 	/* Calibrate PHY */
1124 	error = bwi_phy_calibrate(mac);
1125 	if (error) {
1126 		printf("%s: PHY calibrate failed\n", sc->sc_dev.dv_xname);
1127 		return (error);
1128 	}
1129 
1130 	/* Prepare to initialize firmware */
1131 	CSR_WRITE_4(sc, BWI_MAC_STATUS,
1132 	    BWI_MAC_STATUS_UCODE_JUMP0 |
1133 	    BWI_MAC_STATUS_IHREN);
1134 
1135 	/*
1136 	 * Load and initialize firmwares
1137 	 */
1138 	error = bwi_mac_fw_alloc(mac);
1139 	if (error)
1140 		return (error);
1141 
1142 	error = bwi_mac_fw_load(mac);
1143 	if (error)
1144 		return (error);
1145 
1146 	error = bwi_mac_gpio_init(mac);
1147 	if (error)
1148 		return (error);
1149 
1150 	error = bwi_mac_fw_init(mac);
1151 	if (error)
1152 		return (error);
1153 
1154 	/*
1155 	 * Turn on RF
1156 	 */
1157 	bwi_rf_on(mac);
1158 
1159 	/* TODO: LED, hardware rf enabled is only related to LED setting */
1160 
1161 	/*
1162 	 * Initialize PHY
1163 	 */
1164 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
1165 	bwi_phy_init(mac);
1166 
1167 	/* TODO: interference mitigation */
1168 
1169 	/*
1170 	 * Setup antenna mode
1171 	 */
1172 	bwi_rf_set_ant_mode(mac, mac->mac_rf.rf_ant_mode);
1173 
1174 	/*
1175 	 * Initialize operation mode (RX configuration)
1176 	 */
1177 	bwi_mac_opmode_init(mac);
1178 
1179 	/* XXX what's these */
1180 	if (mac->mac_rev < 3) {
1181 		CSR_WRITE_2(sc, 0x60e, 0);
1182 		CSR_WRITE_2(sc, 0x610, 0x8000);
1183 		CSR_WRITE_2(sc, 0x604, 0);
1184 		CSR_WRITE_2(sc, 0x606, 0x200);
1185 	} else {
1186 		CSR_WRITE_4(sc, 0x188, 0x80000000);
1187 		CSR_WRITE_4(sc, 0x18c, 0x2000000);
1188 	}
1189 
1190 	/*
1191 	 * Initialize TX/RX interrupts' mask
1192 	 */
1193 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_TIMER1);
1194 	for (i = 0; i < BWI_TXRX_NRING; ++i) {
1195 		uint32_t intrs;
1196 
1197 		if (BWI_TXRX_IS_RX(i))
1198 			intrs = BWI_TXRX_RX_INTRS;
1199 		else
1200 			intrs = BWI_TXRX_TX_INTRS;
1201 		CSR_WRITE_4(sc, BWI_TXRX_INTR_MASK(i), intrs);
1202 	}
1203 
1204 	/* XXX what's this */
1205 	CSR_SETBITS_4(sc, BWI_STATE_LO, 0x100000);
1206 
1207 	/* Setup MAC power up delay */
1208 	CSR_WRITE_2(sc, BWI_MAC_POWERUP_DELAY, sc->sc_pwron_delay);
1209 
1210 	/* Set MAC regwin revision */
1211 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_MACREV, mac->mac_rev);
1212 
1213 	/*
1214 	 * Initialize host flags
1215 	 */
1216 	bwi_mac_hostflags_init(mac);
1217 
1218 	/*
1219 	 * Initialize BSS parameters
1220 	 */
1221 	bwi_mac_bss_param_init(mac);
1222 
1223 	/*
1224 	 * Initialize TX rings
1225 	 */
1226 	for (i = 0; i < BWI_TX_NRING; ++i) {
1227 		error = sc->sc_init_tx_ring(sc, i);
1228 		if (error) {
1229 			printf("%s: can't initialize %dth TX ring\n",
1230 			    sc->sc_dev.dv_xname, i);
1231 			return (error);
1232 		}
1233 	}
1234 
1235 	/*
1236 	 * Initialize RX ring
1237 	 */
1238 	error = sc->sc_init_rx_ring(sc);
1239 	if (error) {
1240 		printf("%s: can't initialize RX ring\n", sc->sc_dev.dv_xname);
1241 		return (error);
1242 	}
1243 
1244 	/*
1245 	 * Initialize TX stats if the current MAC uses that
1246 	 */
1247 	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS) {
1248 		error = sc->sc_init_txstats(sc);
1249 		if (error) {
1250 			printf("%s: can't initialize TX stats ring\n",
1251 			    sc->sc_dev.dv_xname);
1252 			return (error);
1253 		}
1254 	}
1255 
1256 	/* XXX what's these */
1257 	CSR_WRITE_2(sc, 0x612, 0x50);	/* Force Pre-TBTT to 80? */
1258 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x416, 0x50);
1259 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x414, 0x1f4);
1260 
1261 	mac->mac_flags |= BWI_MAC_F_INITED;
1262 
1263 	return (0);
1264 }
1265 
1266 void
1267 bwi_mac_reset(struct bwi_mac *mac, int link_phy)
1268 {
1269 	struct bwi_softc *sc = mac->mac_sc;
1270 	uint32_t flags, state_lo, status;
1271 
1272 	flags = BWI_STATE_LO_FLAG_PHYRST | BWI_STATE_LO_FLAG_PHYCLKEN;
1273 	if (link_phy)
1274 		flags |= BWI_STATE_LO_FLAG_PHYLNK;
1275 	bwi_regwin_enable(sc, &mac->mac_regwin, flags);
1276 	DELAY(2000);
1277 
1278 	state_lo = CSR_READ_4(sc, BWI_STATE_LO);
1279 	state_lo |= BWI_STATE_LO_GATED_CLOCK;
1280 	state_lo &= ~__SHIFTIN(BWI_STATE_LO_FLAG_PHYRST,
1281 			       BWI_STATE_LO_FLAGS_MASK);
1282 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
1283 	/* Flush pending bus write */
1284 	CSR_READ_4(sc, BWI_STATE_LO);
1285 	DELAY(1000);
1286 
1287 	state_lo &= ~BWI_STATE_LO_GATED_CLOCK;
1288 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
1289 	/* Flush pending bus write */
1290 	CSR_READ_4(sc, BWI_STATE_LO);
1291 	DELAY(1000);
1292 
1293 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
1294 
1295 	status = CSR_READ_4(sc, BWI_MAC_STATUS);
1296 	status |= BWI_MAC_STATUS_IHREN;
1297 	if (link_phy)
1298 		status |= BWI_MAC_STATUS_PHYLNK;
1299 	else
1300 		status &= ~BWI_MAC_STATUS_PHYLNK;
1301 	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
1302 
1303 	if (link_phy) {
1304 		DPRINTF(1, "%s: PHY is linked\n", sc->sc_dev.dv_xname);
1305 		mac->mac_phy.phy_flags |= BWI_PHY_F_LINKED;
1306 	} else {
1307 		DPRINTF(1, "%s: PHY is unlinked\n", sc->sc_dev.dv_xname);
1308 		mac->mac_phy.phy_flags &= ~BWI_PHY_F_LINKED;
1309 	}
1310 }
1311 
1312 void
1313 bwi_mac_set_tpctl_11bg(struct bwi_mac *mac, const struct bwi_tpctl *new_tpctl)
1314 {
1315 	struct bwi_rf *rf = &mac->mac_rf;
1316 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1317 
1318 	if (new_tpctl != NULL) {
1319 		KASSERT(new_tpctl->bbp_atten <= BWI_BBP_ATTEN_MAX);
1320 		KASSERT(new_tpctl->rf_atten <=
1321 		    (rf->rf_rev < 6 ? BWI_RF_ATTEN_MAX0
1322 		    : BWI_RF_ATTEN_MAX1));
1323 		KASSERT(new_tpctl->tp_ctrl1 <= BWI_TPCTL1_MAX);
1324 
1325 		tpctl->bbp_atten = new_tpctl->bbp_atten;
1326 		tpctl->rf_atten = new_tpctl->rf_atten;
1327 		tpctl->tp_ctrl1 = new_tpctl->tp_ctrl1;
1328 	}
1329 
1330 	/* Set BBP attenuation */
1331 	bwi_phy_set_bbp_atten(mac, tpctl->bbp_atten);
1332 
1333 	/* Set RF attenuation */
1334 	RF_WRITE(mac, BWI_RFR_ATTEN, tpctl->rf_atten);
1335 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_ATTEN,
1336 	    tpctl->rf_atten);
1337 
1338 	/* Set TX power */
1339 	if (rf->rf_type == BWI_RF_T_BCM2050) {
1340 		RF_FILT_SETBITS(mac, BWI_RFR_TXPWR, ~BWI_RFR_TXPWR1_MASK,
1341 		    __SHIFTIN(tpctl->tp_ctrl1, BWI_RFR_TXPWR1_MASK));
1342 	}
1343 
1344 	/* Adjust RF Local Oscillator */
1345 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11G)
1346 		bwi_rf_lo_adjust(mac, tpctl);
1347 }
1348 
1349 int
1350 bwi_mac_test(struct bwi_mac *mac)
1351 {
1352 	struct bwi_softc *sc = mac->mac_sc;
1353 	uint32_t orig_val, val;
1354 
1355 #define TEST_VAL1	0xaa5555aa
1356 #define TEST_VAL2	0x55aaaa55
1357 	/* Save it for later restoring */
1358 	orig_val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1359 
1360 	/* Test 1 */
1361 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL1);
1362 	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1363 	if (val != TEST_VAL1) {
1364 		printf("%s: TEST1 failed\n", sc->sc_dev.dv_xname);
1365 		return (ENXIO);
1366 	}
1367 
1368 	/* Test 2 */
1369 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL2);
1370 	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
1371 	if (val != TEST_VAL2) {
1372 		printf("%s: TEST2 failed\n", sc->sc_dev.dv_xname);
1373 		return (ENXIO);
1374 	}
1375 
1376 	/* Restore to the original value */
1377 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, orig_val);
1378 
1379 	val = CSR_READ_4(sc, BWI_MAC_STATUS);
1380 	if ((val & ~BWI_MAC_STATUS_PHYLNK) != BWI_MAC_STATUS_IHREN) {
1381 		printf("%s: %s failed, MAC status 0x%08x\n",
1382 		    sc->sc_dev.dv_xname, __func__, val);
1383 		return (ENXIO);
1384 	}
1385 
1386 	val = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1387 	if (val != 0) {
1388 		printf("%s: %s failed, intr status %08x\n",
1389 		    sc->sc_dev.dv_xname, __func__, val);
1390 		return (ENXIO);
1391 	}
1392 #undef TEST_VAL2
1393 #undef TEST_VAL1
1394 
1395 	return (0);
1396 }
1397 
1398 void
1399 bwi_mac_setup_tpctl(struct bwi_mac *mac)
1400 {
1401 	struct bwi_softc *sc = mac->mac_sc;
1402 	struct bwi_rf *rf = &mac->mac_rf;
1403 	struct bwi_phy *phy = &mac->mac_phy;
1404 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1405 
1406 	/* Calc BBP attenuation */
1407 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev < 6)
1408 		tpctl->bbp_atten = 0;
1409 	else
1410 		tpctl->bbp_atten = 2;
1411 
1412 	/* Calc TX power CTRL1?? */
1413 	tpctl->tp_ctrl1 = 0;
1414 	if (rf->rf_type == BWI_RF_T_BCM2050) {
1415 		if (rf->rf_rev == 1)
1416 			tpctl->tp_ctrl1 = 3;
1417 		else if (rf->rf_rev < 6)
1418 			tpctl->tp_ctrl1 = 2;
1419 		else if (rf->rf_rev == 8)
1420 			tpctl->tp_ctrl1 = 1;
1421 	}
1422 
1423 	/* Empty TX power CTRL2?? */
1424 	tpctl->tp_ctrl2 = 0xffff;
1425 
1426 	/*
1427 	 * Calc RF attenuation
1428 	 */
1429 	if (phy->phy_mode == IEEE80211_MODE_11A) {
1430 		tpctl->rf_atten = 0x60;
1431 		goto back;
1432 	}
1433 
1434 	if (BWI_IS_BRCM_BCM4309G(sc) && sc->sc_pci_revid < 0x51) {
1435 		tpctl->rf_atten = sc->sc_pci_revid < 0x43 ? 2 : 3;
1436 		goto back;
1437 	}
1438 
1439 	tpctl->rf_atten = 5;
1440 
1441 	if (rf->rf_type != BWI_RF_T_BCM2050) {
1442 		if (rf->rf_type == BWI_RF_T_BCM2053 && rf->rf_rev == 1)
1443 			tpctl->rf_atten = 6;
1444 		goto back;
1445 	}
1446 
1447 	/*
1448 	 * NB: If we reaches here and the card is BRCM_BCM4309G,
1449 	 *     then the card's PCI revision must >= 0x51
1450 	 */
1451 
1452 	/* BCM2050 RF */
1453 	switch (rf->rf_rev) {
1454 	case 1:
1455 		if (phy->phy_mode == IEEE80211_MODE_11G) {
1456 			if (BWI_IS_BRCM_BCM4309G(sc) || BWI_IS_BRCM_BU4306(sc))
1457 				tpctl->rf_atten = 3;
1458 			else
1459 				tpctl->rf_atten = 1;
1460 		} else {
1461 			if (BWI_IS_BRCM_BCM4309G(sc))
1462 				tpctl->rf_atten = 7;
1463 			else
1464 				tpctl->rf_atten = 6;
1465 		}
1466 		break;
1467 	case 2:
1468 		if (phy->phy_mode == IEEE80211_MODE_11G) {
1469 			/*
1470 			 * NOTE: Order of following conditions is critical
1471 			 */
1472 			if (BWI_IS_BRCM_BCM4309G(sc))
1473 				tpctl->rf_atten = 3;
1474 			else if (BWI_IS_BRCM_BU4306(sc))
1475 				tpctl->rf_atten = 5;
1476 			else if (sc->sc_bbp_id == BWI_BBPID_BCM4320)
1477 				tpctl->rf_atten = 4;
1478 			else
1479 				tpctl->rf_atten = 3;
1480 		} else {
1481 			tpctl->rf_atten = 6;
1482 		}
1483 		break;
1484 	case 4:
1485 	case 5:
1486 		tpctl->rf_atten = 1;
1487 		break;
1488 	case 8:
1489 		tpctl->rf_atten = 0x1a;
1490 		break;
1491 	}
1492 back:
1493 	DPRINTF(1, "%s: bbp atten: %u, rf atten: %u, ctrl1: %u, ctrl2: %u\n",
1494 	    sc->sc_dev.dv_xname, tpctl->bbp_atten, tpctl->rf_atten,
1495 	    tpctl->tp_ctrl1, tpctl->tp_ctrl2);
1496 }
1497 
1498 void
1499 bwi_mac_dummy_xmit(struct bwi_mac *mac)
1500 {
1501 #define PACKET_LEN	5
1502 	struct bwi_softc *sc = mac->mac_sc;
1503 	struct bwi_rf *rf = &mac->mac_rf;
1504 	const uint32_t *packet;
1505 	uint16_t val_50c;
1506 	int wait_max, i;
1507 
1508 	static const uint32_t	packet_11a[PACKET_LEN] =
1509 	    { 0x000201cc, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
1510 	static const uint32_t	packet_11bg[PACKET_LEN] =
1511 	    { 0x000b846e, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
1512 
1513 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
1514 		wait_max = 30;
1515 		packet = packet_11a;
1516 		val_50c = 1;
1517 	} else {
1518 		wait_max = 250;
1519 		packet = packet_11bg;
1520 		val_50c = 0;
1521 	}
1522 
1523 	for (i = 0; i < PACKET_LEN; ++i)
1524 		TMPLT_WRITE_4(mac, i * 4, packet[i]);
1525 
1526 	CSR_READ_4(sc, BWI_MAC_STATUS);	/* dummy read */
1527 
1528 	CSR_WRITE_2(sc, 0x568, 0);
1529 	CSR_WRITE_2(sc, 0x7c0, 0);
1530 	CSR_WRITE_2(sc, 0x50c, val_50c);
1531 	CSR_WRITE_2(sc, 0x508, 0);
1532 	CSR_WRITE_2(sc, 0x50a, 0);
1533 	CSR_WRITE_2(sc, 0x54c, 0);
1534 	CSR_WRITE_2(sc, 0x56a, 0x14);
1535 	CSR_WRITE_2(sc, 0x568, 0x826);
1536 	CSR_WRITE_2(sc, 0x500, 0);
1537 	CSR_WRITE_2(sc, 0x502, 0x30);
1538 
1539 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
1540 		RF_WRITE(mac, 0x51, 0x17);
1541 
1542 	for (i = 0; i < wait_max; ++i) {
1543 		if (CSR_READ_2(sc, 0x50e) & 0x80)
1544 			break;
1545 		DELAY(10);
1546 	}
1547 	for (i = 0; i < 10; ++i) {
1548 		if (CSR_READ_2(sc, 0x50e) & 0x400)
1549 			break;
1550 		DELAY(10);
1551 	}
1552 	for (i = 0; i < 10; ++i) {
1553 		if ((CSR_READ_2(sc, 0x690) & 0x100) == 0)
1554 			break;
1555 		DELAY(10);
1556 	}
1557 
1558 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
1559 		RF_WRITE(mac, 0x51, 0x37);
1560 #undef PACKET_LEN
1561 }
1562 
1563 void
1564 bwi_mac_init_tpctl_11bg(struct bwi_mac *mac)
1565 {
1566 	struct bwi_softc *sc = mac->mac_sc;
1567 	struct bwi_phy *phy = &mac->mac_phy;
1568 	struct bwi_rf *rf = &mac->mac_rf;
1569 	struct bwi_tpctl tpctl_orig;
1570 	int restore_tpctl = 0;
1571 
1572 	KASSERT(phy->phy_mode != IEEE80211_MODE_11A);
1573 
1574 	if (BWI_IS_BRCM_BU4306(sc))
1575 		return;
1576 
1577 	PHY_WRITE(mac, 0x28, 0x8018);
1578 	CSR_CLRBITS_2(sc, BWI_BBP_ATTEN, 0x20);
1579 
1580 	if (phy->phy_mode == IEEE80211_MODE_11G) {
1581 		if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
1582 			return;
1583 		PHY_WRITE(mac, 0x47a, 0xc111);
1584 	}
1585 	if (mac->mac_flags & BWI_MAC_F_TPCTL_INITED)
1586 		return;
1587 
1588 	if (phy->phy_mode == IEEE80211_MODE_11B && phy->phy_rev >= 2 &&
1589 	    rf->rf_type == BWI_RF_T_BCM2050) {
1590 		RF_SETBITS(mac, 0x76, 0x84);
1591 	} else {
1592 		struct bwi_tpctl tpctl;
1593 
1594 		/* Backup original TX power control variables */
1595 		bcopy(&mac->mac_tpctl, &tpctl_orig, sizeof(tpctl_orig));
1596 		restore_tpctl = 1;
1597 
1598 		bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
1599 		tpctl.bbp_atten = 11;
1600 		tpctl.tp_ctrl1 = 0;
1601 #ifdef notyet
1602 		if (rf->rf_rev >= 6 && rf->rf_rev <= 8)
1603 			tpctl.rf_atten = 31;
1604 		else
1605 #endif
1606 			tpctl.rf_atten = 9;
1607 
1608 		bwi_mac_set_tpctl_11bg(mac, &tpctl);
1609 	}
1610 
1611 	bwi_mac_dummy_xmit(mac);
1612 
1613 	mac->mac_flags |= BWI_MAC_F_TPCTL_INITED;
1614 	rf->rf_base_tssi = PHY_READ(mac, 0x29);
1615 	DPRINTF(1, "%s: base tssi %d\n", sc->sc_dev.dv_xname, rf->rf_base_tssi);
1616 
1617 	if (abs(rf->rf_base_tssi - rf->rf_idle_tssi) >= 20) {
1618 		printf("%s: base tssi measure failed\n", sc->sc_dev.dv_xname);
1619 		mac->mac_flags |= BWI_MAC_F_TPCTL_ERROR;
1620 	}
1621 
1622 	if (restore_tpctl)
1623 		bwi_mac_set_tpctl_11bg(mac, &tpctl_orig);
1624 	else
1625 		RF_CLRBITS(mac, 0x76, 0x84);
1626 
1627 	bwi_rf_clear_tssi(mac);
1628 }
1629 
1630 void
1631 bwi_mac_detach(struct bwi_mac *mac)
1632 {
1633 	bwi_mac_fw_free(mac);
1634 }
1635 
1636 int
1637 bwi_get_firmware(const char *name, const uint8_t *ucode, size_t size_ucode,
1638     size_t *size, size_t *offset)
1639 {
1640 	int i, nfiles, off = 0, ret = 1;
1641 	struct fwheader *h;
1642 
1643 	if ((h = malloc(sizeof(struct fwheader), M_DEVBUF, M_NOWAIT)) == NULL)
1644 		return (ret);
1645 
1646 	/* get number of firmware files */
1647 	bcopy(ucode, &nfiles, sizeof(nfiles));
1648 	nfiles = ntohl(nfiles);
1649 	off += sizeof(nfiles);
1650 
1651 	/* parse header and search the firmware */
1652 	for (i = 0; i < nfiles && off < size_ucode; i++) {
1653 		bzero(h, sizeof(struct fwheader));
1654 		bcopy(ucode + off, h, sizeof(struct fwheader));
1655 		off += sizeof(struct fwheader);
1656 
1657 		if (strcmp(name, h->filename) == 0) {
1658 			ret = 0;
1659 			*size = ntohl(h->filesize);
1660 			*offset = ntohl(h->fileoffset);
1661 			break;
1662 		}
1663 	}
1664 
1665 	free(h, M_DEVBUF);
1666 
1667 	return (ret);
1668 }
1669 
1670 int
1671 bwi_fwimage_is_valid(struct bwi_softc *sc, uint8_t *fw, size_t fw_len,
1672     char *fw_name, uint8_t fw_type)
1673 {
1674 	const struct bwi_fwhdr *hdr;
1675 
1676 	if (fw_len < sizeof(*hdr)) {
1677 		printf("%s: invalid firmware (%s): invalid size %u\n",
1678 		    sc->sc_dev.dv_xname, fw_name, fw_len);
1679 		return (1);
1680 	}
1681 
1682 	hdr = (const struct bwi_fwhdr *)fw;
1683 
1684 	if (fw_type != BWI_FW_T_IV) {
1685 		/*
1686 		 * Don't verify IV's size, it has different meaning
1687 		 */
1688 		if (betoh32(hdr->fw_size) != fw_len - sizeof(*hdr)) {
1689 			printf("%s: invalid firmware (%s): size mismatch, "
1690 			    "fw %u, real %u\n",
1691 			    sc->sc_dev.dv_xname,
1692 			    fw_name,
1693 			    betoh32(hdr->fw_size),
1694 			    fw_len - sizeof(*hdr));
1695 			return (1);
1696 		}
1697 	}
1698 
1699 	if (hdr->fw_type != fw_type) {
1700 		printf("%s: invalid firmware (%s): type mismatch, "
1701 		    "fw \'%c\', target \'%c\'\n",
1702 		    sc->sc_dev.dv_xname, fw_name, hdr->fw_type, fw_type);
1703 		return (1);
1704 	}
1705 
1706 	if (hdr->fw_gen != BWI_FW_GEN_1) {
1707 		printf("%s: invalid firmware (%s): wrong generation, "
1708 		    "fw %d, target %d\n",
1709 		    sc->sc_dev.dv_xname, fw_name, hdr->fw_gen, BWI_FW_GEN_1);
1710 		return (1);
1711 	}
1712 
1713 	return (0);
1714 }
1715 
1716 int
1717 bwi_mac_fw_alloc(struct bwi_mac *mac)
1718 {
1719 	struct bwi_softc *sc = mac->mac_sc;
1720 	char *name = "bwi-airforce";
1721 	size_t offset;
1722 	char fwname[64];
1723 	int idx, error;
1724 
1725 	error = loadfirmware(name, &mac->mac_fw, &mac->mac_fw_size);
1726 	if (error != 0) {
1727 		printf("%s: error %d, could not read firmware %s\n",
1728 		    sc->sc_dev.dv_xname, error, name);
1729 		return (EIO);
1730 	}
1731 
1732 	if (mac->mac_ucode == NULL) {
1733 		snprintf(fwname, sizeof(fwname), "ucode%d.fw",
1734 		    mac->mac_rev >= 5 ? 5 : mac->mac_rev);
1735 
1736 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1737 		    &mac->mac_ucode_size, &offset);
1738 		if (error != 0) {
1739 			printf("%s: error %d, could not read firmware %s!\n",
1740 			    sc->sc_dev.dv_xname, error, fwname);
1741 			return (ENOMEM);
1742 		}
1743 		mac->mac_ucode = (mac->mac_fw + offset);
1744 		DPRINTF(1, "%s: loaded firmware file %s\n",
1745 		    sc->sc_dev.dv_xname, fwname);
1746 
1747 		if (bwi_fwimage_is_valid(sc, mac->mac_ucode,
1748 		    mac->mac_ucode_size, fwname, BWI_FW_T_UCODE))
1749 			return (EINVAL);
1750 	}
1751 
1752 	if (mac->mac_pcm == NULL) {
1753 		snprintf(fwname, sizeof(fwname), "pcm%d.fw",
1754 		    mac->mac_rev < 5 ? 4 : 5);
1755 
1756 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1757 		    &mac->mac_pcm_size, &offset);
1758 		if (error != 0) {
1759 			printf("%s: error %d, could not read firmware %s!\n",
1760 			    sc->sc_dev.dv_xname, error, fwname);
1761 			return (ENOMEM);
1762 		}
1763 		mac->mac_pcm = (mac->mac_fw + offset);
1764 		DPRINTF(1, "%s: loaded firmware file %s\n",
1765 		    sc->sc_dev.dv_xname, fwname);
1766 
1767 		if (bwi_fwimage_is_valid(sc, mac->mac_pcm,
1768 		    mac->mac_pcm_size, fwname, BWI_FW_T_PCM))
1769 			return (EINVAL);
1770 	}
1771 
1772 	if (mac->mac_iv == NULL) {
1773 		/* TODO: 11A */
1774 		if (mac->mac_rev == 2 || mac->mac_rev == 4) {
1775 			idx = 2;
1776 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
1777 			idx = 5;
1778 		} else {
1779 			printf("%s: no suitable IV for MAC rev %d\n",
1780 			    sc->sc_dev.dv_xname, mac->mac_rev);
1781 			return (ENODEV);
1782 		}
1783 
1784 		snprintf(fwname, sizeof(fwname), "b0g0initvals%d.fw", idx);
1785 
1786 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1787 		    &mac->mac_iv_size, &offset);
1788 		if (error != 0) {
1789 			printf("%s: error %d, could not read firmware %s!\n",
1790 			    sc->sc_dev.dv_xname, error, fwname);
1791 			return (ENOMEM);
1792 		}
1793 		mac->mac_iv = (mac->mac_fw + offset);
1794 		DPRINTF(1, "%s: loaded firmware file %s\n",
1795 		    sc->sc_dev.dv_xname, fwname);
1796 
1797 		if (bwi_fwimage_is_valid(sc, mac->mac_iv,
1798 		    mac->mac_iv_size, fwname, BWI_FW_T_IV))
1799 			return (EINVAL);
1800 	}
1801 
1802 	if (mac->mac_iv_ext == NULL) {
1803 		/* TODO: 11A */
1804 		if (mac->mac_rev == 2 || mac->mac_rev == 4 ||
1805 		    mac->mac_rev >= 11) {
1806 			/* No extended IV */
1807 			goto back;
1808 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
1809 			idx = 5;
1810 		} else {
1811 			printf("%s: no suitable ExtIV for MAC rev %d\n",
1812 			    sc->sc_dev.dv_xname, mac->mac_rev);
1813 			return (ENODEV);
1814 		}
1815 
1816 		snprintf(fwname, sizeof(fwname), "b0g0bsinitvals%d.fw", idx);
1817 
1818 		error = bwi_get_firmware(fwname, mac->mac_fw, mac->mac_fw_size,
1819 		    &mac->mac_iv_ext_size, &offset);
1820 		if (error != 0) {
1821 			printf("%s: error %d, could not read firmware %s!\n",
1822 			    sc->sc_dev.dv_xname, error, fwname);
1823 			return (ENOMEM);
1824 		}
1825 		mac->mac_iv_ext = (mac->mac_fw + offset);
1826 		DPRINTF(1, "%s: loaded firmware file %s\n",
1827 		    sc->sc_dev.dv_xname, fwname);
1828 
1829 		if (bwi_fwimage_is_valid(sc, mac->mac_iv_ext,
1830 		    mac->mac_iv_ext_size, fwname, BWI_FW_T_IV))
1831 			return (EINVAL);
1832 	}
1833 
1834 back:
1835 	return (0);
1836 }
1837 
1838 void
1839 bwi_mac_fw_free(struct bwi_mac *mac)
1840 {
1841 	if (mac->mac_fw != NULL) {
1842 		free(mac->mac_fw, M_DEVBUF);
1843 		mac->mac_fw = NULL;
1844 	}
1845 }
1846 
1847 int
1848 bwi_mac_fw_load(struct bwi_mac *mac)
1849 {
1850 	struct bwi_softc *sc = mac->mac_sc;
1851 	uint16_t fw_rev;
1852 	const uint32_t *fw;
1853 	int fw_len, i, error = 0;
1854 
1855 	/*
1856 	 * Load FW image
1857 	 */
1858 	fw = (const uint32_t *)(mac->mac_ucode + BWI_FWHDR_SZ);
1859 	fw_len = (mac->mac_ucode_size - BWI_FWHDR_SZ) / sizeof(uint32_t);
1860 
1861 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1862 	    BWI_MOBJ_CTRL_VAL(BWI_FW_UCODE_MOBJ | BWI_WR_MOBJ_AUTOINC, 0));
1863 	for (i = 0; i < fw_len; ++i) {
1864 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, betoh32(fw[i]));
1865 		DELAY(10);
1866 	}
1867 
1868 	/*
1869 	 * Load PCM image
1870 	 */
1871 	fw = (const uint32_t *)(mac->mac_pcm + BWI_FWHDR_SZ);
1872 	fw_len = (mac->mac_pcm_size - BWI_FWHDR_SZ) / sizeof(uint32_t);
1873 
1874 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1875 	    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01ea));
1876 	CSR_WRITE_4(sc, BWI_MOBJ_DATA, 0x4000);
1877 
1878 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1879 	    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01eb));
1880 	for (i = 0; i < fw_len; ++i) {
1881 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, betoh32(fw[i]));
1882 		DELAY(10);
1883 	}
1884 
1885 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_ALL_INTRS);
1886 	CSR_WRITE_4(sc, BWI_MAC_STATUS,
1887 	    BWI_MAC_STATUS_UCODE_START |
1888 	    BWI_MAC_STATUS_IHREN |
1889 	    BWI_MAC_STATUS_INFRA);
1890 
1891 #define NRETRY	200
1892 	for (i = 0; i < NRETRY; ++i) {
1893 		uint32_t intr_status;
1894 
1895 		intr_status = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1896 		if (intr_status == BWI_INTR_READY)
1897 			break;
1898 		DELAY(10);
1899 	}
1900 	if (i == NRETRY) {
1901 		printf("%s: firmware (fw & pcm) loading timed out\n",
1902 		    sc->sc_dev.dv_xname);
1903 		error = ETIMEDOUT;
1904 		goto out;
1905 	}
1906 #undef NRETRY
1907 
1908 	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);	/* dummy read */
1909 
1910 	fw_rev = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWREV);
1911 	if (fw_rev > BWI_FW_VERSION3_REVMAX) {
1912 		printf("%s: firmware version 4 is not supported yet\n",
1913 		    sc->sc_dev.dv_xname);
1914 		error = ENODEV;
1915 		goto out;
1916 	}
1917 
1918 	DPRINTF(1, "%s: firmware rev 0x%04x, patch level 0x%04x\n",
1919 	    sc->sc_dev.dv_xname, fw_rev,
1920 	    MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
1921 
1922 out:
1923 	return (error);
1924 }
1925 
1926 int
1927 bwi_mac_gpio_init(struct bwi_mac *mac)
1928 {
1929 	struct bwi_softc *sc = mac->mac_sc;
1930 	struct bwi_regwin *old, *gpio_rw;
1931 	uint32_t filt, bits;
1932 	int error;
1933 
1934 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_GPOSEL_MASK);
1935 	/* TODO: LED */
1936 
1937 	CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0xf);
1938 
1939 	filt = 0x1f;
1940 	bits = 0xf;
1941 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301) {
1942 		filt |= 0x60;
1943 		bits |= 0x60;
1944 	}
1945 	if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
1946 		CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0x200);
1947 		filt |= 0x200;
1948 		bits |= 0x200;
1949 	}
1950 
1951 	gpio_rw = BWI_GPIO_REGWIN(sc);
1952 	error = bwi_regwin_switch(sc, gpio_rw, &old);
1953 	if (error)
1954 		return (error);
1955 
1956 	CSR_FILT_SETBITS_4(sc, BWI_GPIO_CTRL, filt, bits);
1957 
1958 	return (bwi_regwin_switch(sc, old, NULL));
1959 }
1960 
1961 int
1962 bwi_mac_gpio_fini(struct bwi_mac *mac)
1963 {
1964 	struct bwi_softc *sc = mac->mac_sc;
1965 	struct bwi_regwin *old, *gpio_rw;
1966 	int error;
1967 
1968 	gpio_rw = BWI_GPIO_REGWIN(sc);
1969 	error = bwi_regwin_switch(sc, gpio_rw, &old);
1970 	if (error)
1971 		return (error);
1972 
1973 	CSR_WRITE_4(sc, BWI_GPIO_CTRL, 0);
1974 
1975 	return (bwi_regwin_switch(sc, old, NULL));
1976 }
1977 
1978 int
1979 bwi_mac_fw_load_iv(struct bwi_mac *mac, uint8_t *fw, size_t fw_len)
1980 {
1981 	struct bwi_softc *sc = mac->mac_sc;
1982 	const struct bwi_fwhdr *hdr;
1983 	const struct bwi_fw_iv *iv;
1984 	int n, i, iv_img_size;
1985 
1986 	/* Get the number of IVs in the IV image */
1987 	hdr = (const struct bwi_fwhdr *)fw;
1988 	n = betoh32(hdr->fw_iv_cnt);
1989 	DPRINTF(1, "%s: IV count %d\n", sc->sc_dev.dv_xname, n);
1990 
1991 	/* Calculate the IV image size, for later sanity check */
1992 	iv_img_size = fw_len - sizeof(*hdr);
1993 
1994 	/* Locate the first IV */
1995 	iv = (const struct bwi_fw_iv *)(fw + sizeof(*hdr));
1996 
1997 	for (i = 0; i < n; ++i) {
1998 		uint16_t iv_ofs, ofs;
1999 		int sz = 0;
2000 
2001 		if (iv_img_size < sizeof(iv->iv_ofs)) {
2002 			printf("%s: invalid IV image, ofs\n",
2003 			    sc->sc_dev.dv_xname);
2004 			return (EINVAL);
2005 		}
2006 		iv_img_size -= sizeof(iv->iv_ofs);
2007 		sz += sizeof(iv->iv_ofs);
2008 
2009 		iv_ofs = betoh16(iv->iv_ofs);
2010 
2011 		ofs = __SHIFTOUT(iv_ofs, BWI_FW_IV_OFS_MASK);
2012 		if (ofs >= 0x1000) {
2013 			printf("%s: invalid ofs (0x%04x) for %dth iv\n",
2014 			    sc->sc_dev.dv_xname, ofs, i);
2015 			return (EINVAL);
2016 		}
2017 
2018 		if (iv_ofs & BWI_FW_IV_IS_32BIT) {
2019 			uint32_t val32;
2020 
2021 			if (iv_img_size < sizeof(iv->iv_val.val32)) {
2022 				printf("%s: invalid IV image, val32\n",
2023 				    sc->sc_dev.dv_xname);
2024 				return (EINVAL);
2025 			}
2026 			iv_img_size -= sizeof(iv->iv_val.val32);
2027 			sz += sizeof(iv->iv_val.val32);
2028 
2029 			val32 = betoh32(iv->iv_val.val32);
2030 			CSR_WRITE_4(sc, ofs, val32);
2031 		} else {
2032 			uint16_t val16;
2033 
2034 			if (iv_img_size < sizeof(iv->iv_val.val16)) {
2035 				printf("%s: invalid IV image, val16\n",
2036 				    sc->sc_dev.dv_xname);
2037 				return (EINVAL);
2038 			}
2039 			iv_img_size -= sizeof(iv->iv_val.val16);
2040 			sz += sizeof(iv->iv_val.val16);
2041 
2042 			val16 = betoh16(iv->iv_val.val16);
2043 			CSR_WRITE_2(sc, ofs, val16);
2044 		}
2045 
2046 		iv = (const struct bwi_fw_iv *)((const uint8_t *)iv + sz);
2047 	}
2048 
2049 	if (iv_img_size != 0) {
2050 		printf("%s: invalid IV image, size left %d\n",
2051 		    sc->sc_dev.dv_xname, iv_img_size);
2052 		return (EINVAL);
2053 	}
2054 
2055 	return (0);
2056 }
2057 
2058 int
2059 bwi_mac_fw_init(struct bwi_mac *mac)
2060 {
2061 	struct bwi_softc *sc = mac->mac_sc;
2062 	int error;
2063 
2064 	error = bwi_mac_fw_load_iv(mac, mac->mac_iv, mac->mac_iv_size);
2065 	if (error) {
2066 		printf("%s: load IV failed\n", sc->sc_dev.dv_xname);
2067 		return (error);
2068 	}
2069 
2070 	if (mac->mac_iv_ext != NULL) {
2071 		error = bwi_mac_fw_load_iv(mac, mac->mac_iv_ext,
2072 		    mac->mac_iv_ext_size);
2073 		if (error)
2074 			printf("%s: load ExtIV failed\n", sc->sc_dev.dv_xname);
2075 	}
2076 
2077 	return (error);
2078 }
2079 
2080 void
2081 bwi_mac_opmode_init(struct bwi_mac *mac)
2082 {
2083 	struct bwi_softc *sc = mac->mac_sc;
2084 	struct ieee80211com *ic = &sc->sc_ic;
2085 	uint32_t mac_status;
2086 	uint16_t pre_tbtt;
2087 
2088 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
2089 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
2090 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PASS_BCN);
2091 
2092 	/* Set probe resp timeout to infinite */
2093 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 0);
2094 
2095 	/*
2096 	 * TODO: factor out following part
2097 	 */
2098 
2099 	mac_status = CSR_READ_4(sc, BWI_MAC_STATUS);
2100 	mac_status &= ~(BWI_MAC_STATUS_OPMODE_HOSTAP |
2101 	    BWI_MAC_STATUS_PASS_CTL |
2102 	    BWI_MAC_STATUS_PASS_BADPLCP |
2103 	    BWI_MAC_STATUS_PASS_BADFCS |
2104 	    BWI_MAC_STATUS_PROMISC);
2105 	mac_status |= BWI_MAC_STATUS_INFRA;
2106 
2107 	/* Always turn on PROMISC on old hardware */
2108 	if (mac->mac_rev < 5)
2109 		mac_status |= BWI_MAC_STATUS_PROMISC;
2110 
2111 	switch (ic->ic_opmode) {
2112 #ifndef IEEE80211_STA_ONLY
2113 	case IEEE80211_M_IBSS:
2114 		mac_status &= ~BWI_MAC_STATUS_INFRA;
2115 		break;
2116 	case IEEE80211_M_HOSTAP:
2117 		mac_status |= BWI_MAC_STATUS_OPMODE_HOSTAP;
2118 		break;
2119 #endif
2120 	case IEEE80211_M_MONITOR:
2121 #if 0
2122 		/* Do you want data from your microwave oven? */
2123 		mac_status |= BWI_MAC_STATUS_PASS_CTL |
2124 			      BWI_MAC_STATUS_PASS_BADPLCP |
2125 			      BWI_MAC_STATUS_PASS_BADFCS;
2126 #else
2127 		mac_status |= BWI_MAC_STATUS_PASS_CTL;
2128 #endif
2129 		/* Promisc? */
2130 		break;
2131 	default:
2132 		break;
2133 	}
2134 
2135 	if (ic->ic_if.if_flags & IFF_PROMISC)
2136 		mac_status |= BWI_MAC_STATUS_PROMISC;
2137 
2138 	CSR_WRITE_4(sc, BWI_MAC_STATUS, mac_status);
2139 
2140 #ifndef IEEE80211_STA_ONLY
2141 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
2142 	    ic->ic_opmode != IEEE80211_M_HOSTAP) {
2143 #endif
2144 		if (sc->sc_bbp_id == BWI_BBPID_BCM4306 && sc->sc_bbp_rev == 3)
2145 			pre_tbtt = 100;
2146 		else
2147 			pre_tbtt = 50;
2148 #ifndef IEEE80211_STA_ONLY
2149 	} else
2150 		pre_tbtt = 2;
2151 #endif
2152 	CSR_WRITE_2(sc, BWI_MAC_PRE_TBTT, pre_tbtt);
2153 }
2154 
2155 void
2156 bwi_mac_hostflags_init(struct bwi_mac *mac)
2157 {
2158 	struct bwi_softc *sc = mac->mac_sc;
2159 	struct bwi_phy *phy = &mac->mac_phy;
2160 	struct bwi_rf *rf = &mac->mac_rf;
2161 	uint64_t host_flags;
2162 
2163 	if (phy->phy_mode == IEEE80211_MODE_11A)
2164 		return;
2165 
2166 	host_flags = HFLAGS_READ(mac);
2167 	host_flags |= BWI_HFLAG_SYM_WA;
2168 
2169 	if (phy->phy_mode == IEEE80211_MODE_11G) {
2170 		if (phy->phy_rev == 1)
2171 			host_flags |= BWI_HFLAG_GDC_WA;
2172 		if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
2173 			host_flags |= BWI_HFLAG_OFDM_PA;
2174 	} else if (phy->phy_mode == IEEE80211_MODE_11B) {
2175 		if (phy->phy_rev >= 2 && rf->rf_type == BWI_RF_T_BCM2050)
2176 			host_flags &= ~BWI_HFLAG_GDC_WA;
2177 	} else {
2178 		panic("unknown PHY mode %u", phy->phy_mode);
2179 	}
2180 
2181 	HFLAGS_WRITE(mac, host_flags);
2182 }
2183 
2184 void
2185 bwi_mac_bss_param_init(struct bwi_mac *mac)
2186 {
2187 	struct bwi_softc *sc = mac->mac_sc;
2188 	struct bwi_phy *phy = &mac->mac_phy;
2189 	struct bwi_retry_lim lim;
2190 	uint16_t cw_min;
2191 
2192 	/*
2193 	 * Set short/long retry limits
2194 	 */
2195 	bzero(&lim, sizeof(lim));
2196 	lim.shretry = BWI_SHRETRY;
2197 	lim.shretry_fb = BWI_SHRETRY_FB;
2198 	lim.lgretry = BWI_LGRETRY;
2199 	lim.lgretry_fb = BWI_LGRETRY_FB;
2200 	bwi_mac_set_retry_lim(mac, &lim);
2201 
2202 	/*
2203 	 * Implicitly prevent firmware from sending probe response
2204 	 * by setting its "probe response timeout" to 1us.
2205 	 */
2206 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 1);
2207 
2208 	/*
2209 	 * XXX MAC level acknowledge and CW min/max should depend
2210 	 * on the char rateset of the IBSS/BSS to join.
2211 	 */
2212 
2213 	/*
2214 	 * Set MAC level acknowledge rates
2215 	 */
2216 	bwi_mac_set_ackrates(mac, &sc->sc_ic.ic_sup_rates[phy->phy_mode]);
2217 
2218 	/*
2219 	 * Set CW min
2220 	 */
2221 	if (phy->phy_mode == IEEE80211_MODE_11B)
2222 		cw_min = IEEE80211_CW_MIN_0;
2223 	else
2224 		cw_min = IEEE80211_CW_MIN_1;
2225 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMIN, cw_min);
2226 
2227 	/*
2228 	 * Set CW max
2229 	 */
2230 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMAX,
2231 	    IEEE80211_CW_MAX);
2232 }
2233 
2234 void
2235 bwi_mac_set_retry_lim(struct bwi_mac *mac, const struct bwi_retry_lim *lim)
2236 {
2237 	/* Short/Long retry limit */
2238 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_SHRETRY,
2239 	    lim->shretry);
2240 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_LGRETRY,
2241 	    lim->lgretry);
2242 
2243 	/* Short/Long retry fallback limit */
2244 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SHRETRY_FB,
2245 	    lim->shretry_fb);
2246 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_LGRETEY_FB,
2247 	    lim->lgretry_fb);
2248 }
2249 
2250 void
2251 bwi_mac_set_ackrates(struct bwi_mac *mac, const struct ieee80211_rateset *rs)
2252 {
2253 	struct bwi_softc *sc;
2254 	int i;
2255 
2256 	sc = mac->mac_sc;
2257 
2258 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
2259 
2260 	/* XXX not standard conforming */
2261 	for (i = 0; i < rs->rs_nrates; ++i) {
2262 		enum bwi_modtype modtype;
2263 		uint16_t ofs;
2264 
2265 		modtype = bwi_rate2modtype(rs->rs_rates[i]);
2266 		switch (modtype) {
2267 		case IEEE80211_MODTYPE_DS:
2268 			ofs = 0x4c0;
2269 			ofs += (ieee80211_rate2plcp(rs->rs_rates[i],
2270 			    IEEE80211_MODE_11B) & 0xf) * 2;
2271 			break;
2272 		case IEEE80211_MODTYPE_OFDM:
2273 			ofs = 0x480;
2274 			ofs += (ieee80211_rate2plcp(rs->rs_rates[i],
2275 			    IEEE80211_MODE_11G) & 0xf) * 2;
2276 			break;
2277 		default:
2278 			panic("unsupported modtype %u", modtype);
2279 		}
2280 
2281 		MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, ofs + 0x20,
2282 		    MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs));
2283 	}
2284 }
2285 
2286 int
2287 bwi_mac_start(struct bwi_mac *mac)
2288 {
2289 	struct bwi_softc *sc = mac->mac_sc;
2290 
2291 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
2292 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_READY);
2293 
2294 	/* Flush pending bus writes */
2295 	CSR_READ_4(sc, BWI_MAC_STATUS);
2296 	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
2297 
2298 	return (bwi_mac_config_ps(mac));
2299 }
2300 
2301 int
2302 bwi_mac_stop(struct bwi_mac *mac)
2303 {
2304 	struct bwi_softc *sc = mac->mac_sc;
2305 	int error, i;
2306 
2307 	error = bwi_mac_config_ps(mac);
2308 	if (error)
2309 		return (error);
2310 
2311 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
2312 
2313 	/* Flush pending bus write */
2314 	CSR_READ_4(sc, BWI_MAC_STATUS);
2315 
2316 #define NRETRY	10000
2317 	for (i = 0; i < NRETRY; ++i) {
2318 		if (CSR_READ_4(sc, BWI_MAC_INTR_STATUS) & BWI_INTR_READY)
2319 			break;
2320 		DELAY(1);
2321 	}
2322 	if (i == NRETRY) {
2323 		printf("%s: can't stop MAC\n", sc->sc_dev.dv_xname);
2324 		return (ETIMEDOUT);
2325 	}
2326 #undef NRETRY
2327 
2328 	return (0);
2329 }
2330 
2331 int
2332 bwi_mac_config_ps(struct bwi_mac *mac)
2333 {
2334 	struct bwi_softc *sc = mac->mac_sc;
2335 	uint32_t status;
2336 
2337 	status = CSR_READ_4(sc, BWI_MAC_STATUS);
2338 
2339 	status &= ~BWI_MAC_STATUS_HW_PS;
2340 	status |= BWI_MAC_STATUS_WAKEUP;
2341 	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
2342 
2343 	/* Flush pending bus write */
2344 	CSR_READ_4(sc, BWI_MAC_STATUS);
2345 
2346 	if (mac->mac_rev >= 5) {
2347 		int i;
2348 
2349 #define NRETRY	100
2350 		for (i = 0; i < NRETRY; ++i) {
2351 			if (MOBJ_READ_2(mac, BWI_COMM_MOBJ,
2352 			    BWI_COMM_MOBJ_UCODE_STATE) != BWI_UCODE_STATE_PS)
2353 				break;
2354 			DELAY(10);
2355 		}
2356 		if (i == NRETRY) {
2357 			printf("%s: config PS failed\n", sc->sc_dev.dv_xname);
2358 			return (ETIMEDOUT);
2359 		}
2360 #undef NRETRY
2361 	}
2362 	return (0);
2363 }
2364 
2365 void
2366 bwi_mac_reset_hwkeys(struct bwi_mac *mac)
2367 {
2368 	/* TODO: firmware crypto */
2369 	MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_KEYTABLE_OFS);
2370 }
2371 
2372 void
2373 bwi_mac_shutdown(struct bwi_mac *mac)
2374 {
2375 	struct bwi_softc *sc = mac->mac_sc;
2376 	int i;
2377 
2378 	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS)
2379 		sc->sc_free_txstats(sc);
2380 
2381 	sc->sc_free_rx_ring(sc);
2382 
2383 	for (i = 0; i < BWI_TX_NRING; ++i)
2384 		sc->sc_free_tx_ring(sc, i);
2385 
2386 	bwi_rf_off(mac);
2387 
2388 	/* TODO: LED */
2389 
2390 	bwi_mac_gpio_fini(mac);
2391 
2392 	bwi_rf_off(mac); /* XXX again */
2393 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
2394 	bwi_regwin_disable(sc, &mac->mac_regwin, 0);
2395 
2396 	mac->mac_flags &= ~BWI_MAC_F_INITED;
2397 }
2398 
2399 int
2400 bwi_mac_get_property(struct bwi_mac *mac)
2401 {
2402 	struct bwi_softc *sc = mac->mac_sc;
2403 	enum bwi_bus_space old_bus_space;
2404 	uint32_t val;
2405 
2406 	/*
2407 	 * Byte swap
2408 	 */
2409 	val = CSR_READ_4(sc, BWI_MAC_STATUS);
2410 	if (val & BWI_MAC_STATUS_BSWAP) {
2411 		DPRINTF(1, "%s: need byte swap\n", sc->sc_dev.dv_xname);
2412 		mac->mac_flags |= BWI_MAC_F_BSWAP;
2413 	}
2414 
2415 	/*
2416 	 * DMA address space
2417 	 */
2418 	old_bus_space = sc->sc_bus_space;
2419 
2420 	val = CSR_READ_4(sc, BWI_STATE_HI);
2421 	if (__SHIFTOUT(val, BWI_STATE_HI_FLAGS_MASK) &
2422 	    BWI_STATE_HI_FLAG_64BIT) {
2423 		/* 64bit address */
2424 		sc->sc_bus_space = BWI_BUS_SPACE_64BIT;
2425 		DPRINTF(1, "%s: 64bit bus space\n", sc->sc_dev.dv_xname);
2426 	} else {
2427 		uint32_t txrx_reg = BWI_TXRX_CTRL_BASE + BWI_TX32_CTRL;
2428 
2429 		CSR_WRITE_4(sc, txrx_reg, BWI_TXRX32_CTRL_ADDRHI_MASK);
2430 		if (CSR_READ_4(sc, txrx_reg) & BWI_TXRX32_CTRL_ADDRHI_MASK) {
2431 			/* 32bit address */
2432 			sc->sc_bus_space = BWI_BUS_SPACE_32BIT;
2433 			DPRINTF(1, "%s: 32bit bus space\n",
2434 			    sc->sc_dev.dv_xname);
2435 		} else {
2436 			/* 30bit address */
2437 			sc->sc_bus_space = BWI_BUS_SPACE_30BIT;
2438 			DPRINTF(1, "%s: 30bit bus space\n",
2439 			    sc->sc_dev.dv_xname);
2440 		}
2441 	}
2442 
2443 	if (old_bus_space != 0 && old_bus_space != sc->sc_bus_space) {
2444 		printf("%s: MACs bus space mismatch!\n", sc->sc_dev.dv_xname);
2445 		return (ENXIO);
2446 	}
2447 
2448 	return (0);
2449 }
2450 
2451 #define IEEE80211_DUR_SLOT	20	/* DS/CCK slottime, ERP long slottime */
2452 #define IEEE80211_DUR_SHSLOT	9	/* ERP short slottime */
2453 
2454 void
2455 bwi_mac_updateslot(struct bwi_mac *mac, int shslot)
2456 {
2457 	struct bwi_softc *sc;
2458 	uint16_t slot_time;
2459 
2460 	sc = mac->mac_sc;
2461 
2462 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
2463 
2464 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B)
2465 		return;
2466 
2467 	if (shslot)
2468 		slot_time = IEEE80211_DUR_SHSLOT;
2469 	else
2470 		slot_time = IEEE80211_DUR_SLOT;
2471 
2472 	CSR_WRITE_2(mac->mac_sc, BWI_MAC_SLOTTIME,
2473 	    slot_time + BWI_MAC_SLOTTIME_ADJUST);
2474 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SLOTTIME, slot_time);
2475 }
2476 
2477 int
2478 bwi_mac_attach(struct bwi_softc *sc, int id, uint8_t rev)
2479 {
2480 	struct bwi_mac *mac;
2481 	int i;
2482 
2483 	KASSERT(sc->sc_nmac <= BWI_MAC_MAX && sc->sc_nmac >= 0);
2484 
2485 	if (sc->sc_nmac == BWI_MAC_MAX) {
2486 		printf("%s: too many MACs\n", sc->sc_dev.dv_xname);
2487 		return (0);
2488 	}
2489 
2490 	/*
2491 	 * More than one MAC is only supported by BCM4309
2492 	 */
2493 	if (sc->sc_nmac != 0 &&
2494 	    sc->sc_pci_did != PCI_PRODUCT_BROADCOM_BCM4309) {
2495 		DPRINTF(1, "%s: ignore second MAC\n", sc->sc_dev.dv_xname);
2496 		return (0);
2497 	}
2498 
2499 	mac = &sc->sc_mac[sc->sc_nmac];
2500 
2501 	/* XXX will this happen? */
2502 	if (BWI_REGWIN_EXIST(&mac->mac_regwin)) {
2503 		printf("%s: %dth MAC already attached\n",
2504 		    sc->sc_dev.dv_xname, sc->sc_nmac);
2505 		return (0);
2506 	}
2507 
2508 	/*
2509 	 * Test whether the revision of this MAC is supported
2510 	 */
2511 	for (i = 0; i < nitems(bwi_sup_macrev); ++i) {
2512 		if (bwi_sup_macrev[i] == rev)
2513 			break;
2514 	}
2515 	if (i == nitems(bwi_sup_macrev)) {
2516 		printf("%s: MAC rev %u is not supported\n",
2517 		    sc->sc_dev.dv_xname, rev);
2518 		return (ENXIO);
2519 	}
2520 
2521 	BWI_CREATE_MAC(mac, sc, id, rev);
2522 	sc->sc_nmac++;
2523 
2524 	if (mac->mac_rev < 5) {
2525 		mac->mac_flags |= BWI_MAC_F_HAS_TXSTATS;
2526 		DPRINTF(1, "%s: has TX stats\n", sc->sc_dev.dv_xname);
2527 	} else {
2528 		mac->mac_flags |= BWI_MAC_F_PHYE_RESET;
2529 	}
2530 
2531 	return (0);
2532 }
2533 
2534 void
2535 bwi_mac_balance_atten(int *bbp_atten0, int *rf_atten0)
2536 {
2537 	int bbp_atten, rf_atten, rf_atten_lim = -1;
2538 
2539 	bbp_atten = *bbp_atten0;
2540 	rf_atten = *rf_atten0;
2541 
2542 	/*
2543 	 * RF attenuation affects TX power BWI_RF_ATTEN_FACTOR times
2544 	 * as much as BBP attenuation, so we try our best to keep RF
2545 	 * attenuation within range.  BBP attenuation will be clamped
2546 	 * later if it is out of range during balancing.
2547 	 *
2548 	 * BWI_RF_ATTEN_MAX0 is used as RF attenuation upper limit.
2549 	 */
2550 
2551 	/*
2552 	 * Use BBP attenuation to balance RF attenuation
2553 	 */
2554 	if (rf_atten < 0)
2555 		rf_atten_lim = 0;
2556 	else if (rf_atten > BWI_RF_ATTEN_MAX0)
2557 		rf_atten_lim = BWI_RF_ATTEN_MAX0;
2558 
2559 	if (rf_atten_lim >= 0) {
2560 		bbp_atten += (BWI_RF_ATTEN_FACTOR * (rf_atten - rf_atten_lim));
2561 		rf_atten = rf_atten_lim;
2562 	}
2563 
2564 	/*
2565 	 * If possible, use RF attenuation to balance BBP attenuation
2566 	 * NOTE: RF attenuation is still kept within range.
2567 	 */
2568 	while (rf_atten < BWI_RF_ATTEN_MAX0 && bbp_atten > BWI_BBP_ATTEN_MAX) {
2569 		bbp_atten -= BWI_RF_ATTEN_FACTOR;
2570 		++rf_atten;
2571 	}
2572 	while (rf_atten > 0 && bbp_atten < 0) {
2573 		bbp_atten += BWI_RF_ATTEN_FACTOR;
2574 		--rf_atten;
2575 	}
2576 
2577 	/* RF attenuation MUST be within range */
2578 	KASSERT(rf_atten >= 0 && rf_atten <= BWI_RF_ATTEN_MAX0);
2579 
2580 	/*
2581 	 * Clamp BBP attenuation
2582 	 */
2583 	if (bbp_atten < 0)
2584 		bbp_atten = 0;
2585 	else if (bbp_atten > BWI_BBP_ATTEN_MAX)
2586 		bbp_atten = BWI_BBP_ATTEN_MAX;
2587 
2588 	*rf_atten0 = rf_atten;
2589 	*bbp_atten0 = bbp_atten;
2590 }
2591 
2592 void
2593 bwi_mac_adjust_tpctl(struct bwi_mac *mac, int rf_atten_adj, int bbp_atten_adj)
2594 {
2595 	struct bwi_softc *sc = mac->mac_sc;
2596 	struct bwi_rf *rf = &mac->mac_rf;
2597 	struct bwi_tpctl tpctl;
2598 	int bbp_atten, rf_atten, tp_ctrl1;
2599 
2600 	bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
2601 
2602 	/* NOTE: Use signed value to do calulation */
2603 	bbp_atten = tpctl.bbp_atten;
2604 	rf_atten = tpctl.rf_atten;
2605 	tp_ctrl1 = tpctl.tp_ctrl1;
2606 
2607 	bbp_atten += bbp_atten_adj;
2608 	rf_atten += rf_atten_adj;
2609 
2610 	bwi_mac_balance_atten(&bbp_atten, &rf_atten);
2611 
2612 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev == 2) {
2613 		if (rf_atten <= 1) {
2614 			if (tp_ctrl1 == 0) {
2615 				tp_ctrl1 = 3;
2616 				bbp_atten += 2;
2617 				rf_atten += 2;
2618 			} else if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
2619 				bbp_atten +=
2620 				(BWI_RF_ATTEN_FACTOR * (rf_atten - 2));
2621 				rf_atten = 2;
2622 			}
2623 		} else if (rf_atten > 4 && tp_ctrl1 != 0) {
2624 			tp_ctrl1 = 0;
2625 			if (bbp_atten < 3) {
2626 				bbp_atten += 2;
2627 				rf_atten -= 3;
2628 			} else {
2629 				bbp_atten -= 2;
2630 				rf_atten -= 2;
2631 			}
2632 		}
2633 		bwi_mac_balance_atten(&bbp_atten, &rf_atten);
2634 	}
2635 
2636 	tpctl.bbp_atten = bbp_atten;
2637 	tpctl.rf_atten = rf_atten;
2638 	tpctl.tp_ctrl1 = tp_ctrl1;
2639 
2640 	bwi_mac_lock(mac);
2641 	bwi_mac_set_tpctl_11bg(mac, &tpctl);
2642 	bwi_mac_unlock(mac);
2643 }
2644 
2645 /*
2646  * http://bcm-specs.sipsolutions.net/RecalculateTransmissionPower
2647  */
2648 void
2649 bwi_mac_calibrate_txpower(struct bwi_mac *mac, enum bwi_txpwrcb_type type)
2650 {
2651 	struct bwi_softc *sc = mac->mac_sc;
2652 	struct bwi_rf *rf = &mac->mac_rf;
2653 	int8_t tssi[4], tssi_avg, cur_txpwr;
2654 	int error, i, ofdm_tssi;
2655 	int txpwr_diff, rf_atten_adj, bbp_atten_adj;
2656 
2657 	if (mac->mac_flags & BWI_MAC_F_TPCTL_ERROR) {
2658 		DPRINTF(1, "%s: tpctl error happened, can't set txpower\n",
2659 		    sc->sc_dev.dv_xname);
2660 		return;
2661 	}
2662 
2663 	if (BWI_IS_BRCM_BU4306(sc)) {
2664 		DPRINTF(1, "%s: BU4306, can't set txpower\n",
2665 		    sc->sc_dev.dv_xname);
2666 		return;
2667 	}
2668 
2669 	/*
2670 	 * Save latest TSSI and reset the related memory objects
2671 	 */
2672 	ofdm_tssi = 0;
2673 	error = bwi_rf_get_latest_tssi(mac, tssi, BWI_COMM_MOBJ_TSSI_DS);
2674 	if (error) {
2675 		DPRINTF(1, "%s: no DS tssi\n", sc->sc_dev.dv_xname);
2676 
2677 		if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B) {
2678 			if (type == BWI_TXPWR_FORCE) {
2679 				rf_atten_adj = 0;
2680 				bbp_atten_adj = 1;
2681 				goto calib;
2682 			} else {
2683 				return;
2684 			}
2685 		}
2686 
2687 		error = bwi_rf_get_latest_tssi(mac, tssi,
2688 		    BWI_COMM_MOBJ_TSSI_OFDM);
2689 		if (error) {
2690 			DPRINTF(1, "%s: no OFDM tssi\n", sc->sc_dev.dv_xname);
2691 			if (type == BWI_TXPWR_FORCE) {
2692 				rf_atten_adj = 0;
2693 				bbp_atten_adj = 1;
2694 				goto calib;
2695 			} else {
2696 				return;
2697 			}
2698 		}
2699 
2700 		for (i = 0; i < 4; ++i) {
2701 			tssi[i] += 0x20;
2702 			tssi[i] &= 0x3f;
2703 		}
2704 		ofdm_tssi = 1;
2705 	}
2706 	bwi_rf_clear_tssi(mac);
2707 
2708 	DPRINTF(1, "%s: tssi0 %d, tssi1 %d, tssi2 %d, tssi3 %d\n",
2709 	    sc->sc_dev.dv_xname, tssi[0], tssi[1], tssi[2], tssi[3]);
2710 
2711 	/*
2712 	 * Calculate RF/BBP attenuation adjustment based on
2713 	 * the difference between desired TX power and sampled
2714 	 * TX power.
2715 	 */
2716 	/* +8 == "each incremented by 1/2" */
2717 	tssi_avg = (tssi[0] + tssi[1] + tssi[2] + tssi[3] + 8) / 4;
2718 	if (ofdm_tssi && (HFLAGS_READ(mac) & BWI_HFLAG_PWR_BOOST_DS))
2719 		tssi_avg -= 13;
2720 
2721 	DPRINTF(1, "%s: tssi avg %d\n", sc->sc_dev.dv_xname, tssi_avg);
2722 
2723 	error = bwi_rf_tssi2dbm(mac, tssi_avg, &cur_txpwr);
2724 	if (error)
2725 		return;
2726 	DPRINTF(1, "%s: current txpower %d\n", sc->sc_dev.dv_xname, cur_txpwr);
2727 
2728 	txpwr_diff = rf->rf_txpower_max - cur_txpwr; /* XXX ni_txpower */
2729 
2730 	rf_atten_adj = -howmany(txpwr_diff, 8);
2731 
2732 	if (type == BWI_TXPWR_INIT) {
2733 		/*
2734 		 * Move toward EEPROM max TX power as fast as we can
2735 		 */
2736 		bbp_atten_adj = -txpwr_diff;
2737 	} else {
2738 		bbp_atten_adj = -(txpwr_diff / 2);
2739 	}
2740 	bbp_atten_adj -= (BWI_RF_ATTEN_FACTOR * rf_atten_adj);
2741 
2742 	if (rf_atten_adj == 0 && bbp_atten_adj == 0) {
2743 		DPRINTF(1, "%s: no need to adjust RF/BBP attenuation\n",
2744 		    sc->sc_dev.dv_xname);
2745 		/* TODO: LO */
2746 		return;
2747 	}
2748 
2749 calib:
2750 	DPRINTF(1, "%s: rf atten adjust %d, bbp atten adjust %d\n",
2751 	    sc->sc_dev.dv_xname, rf_atten_adj, bbp_atten_adj);
2752 	bwi_mac_adjust_tpctl(mac, rf_atten_adj, bbp_atten_adj);
2753 	/* TODO: LO */
2754 }
2755 
2756 void
2757 bwi_mac_lock(struct bwi_mac *mac)
2758 {
2759 	struct bwi_softc *sc = mac->mac_sc;
2760 
2761 	KASSERT((mac->mac_flags & BWI_MAC_F_LOCKED) == 0);
2762 
2763 	if (mac->mac_rev < 3)
2764 		bwi_mac_stop(mac);
2765 	else
2766 #ifndef IEEE80211_STA_ONLY
2767 	if (sc->sc_ic.ic_opmode != IEEE80211_M_HOSTAP)
2768 #endif
2769 		bwi_mac_config_ps(mac);
2770 
2771 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
2772 
2773 	/* Flush pending bus write */
2774 	CSR_READ_4(sc, BWI_MAC_STATUS);
2775 	DELAY(10);
2776 
2777 	mac->mac_flags |= BWI_MAC_F_LOCKED;
2778 }
2779 
2780 void
2781 bwi_mac_unlock(struct bwi_mac *mac)
2782 {
2783 	struct bwi_softc *sc = mac->mac_sc;
2784 
2785 	KASSERT(mac->mac_flags & BWI_MAC_F_LOCKED);
2786 
2787 	CSR_READ_2(sc, BWI_PHYINFO); /* dummy read */
2788 
2789 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
2790 
2791 	if (mac->mac_rev < 3)
2792 		bwi_mac_start(mac);
2793 	else
2794 #ifndef IEEE80211_STA_ONLY
2795 	if (sc->sc_ic.ic_opmode != IEEE80211_M_HOSTAP)
2796 #endif
2797 		bwi_mac_config_ps(mac);
2798 
2799 	mac->mac_flags &= ~BWI_MAC_F_LOCKED;
2800 }
2801 
2802 void
2803 bwi_mac_set_promisc(struct bwi_mac *mac, int promisc)
2804 {
2805 	struct bwi_softc *sc = mac->mac_sc;
2806 
2807 	if (mac->mac_rev < 5) /* Promisc is always on */
2808 		return;
2809 
2810 	if (promisc)
2811 		CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
2812 	else
2813 		CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
2814 }
2815 
2816 /* PHY */
2817 
2818 void
2819 bwi_phy_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
2820 {
2821 	struct bwi_softc *sc = mac->mac_sc;
2822 
2823 	/* TODO: 11A */
2824 	CSR_WRITE_2(sc, BWI_PHY_CTRL, ctrl);
2825 	CSR_WRITE_2(sc, BWI_PHY_DATA, data);
2826 }
2827 
2828 uint16_t
2829 bwi_phy_read(struct bwi_mac *mac, uint16_t ctrl)
2830 {
2831 	struct bwi_softc *sc = mac->mac_sc;
2832 
2833 	/* TODO: 11A */
2834 	CSR_WRITE_2(sc, BWI_PHY_CTRL, ctrl);
2835 	return (CSR_READ_2(sc, BWI_PHY_DATA));
2836 }
2837 
2838 int
2839 bwi_phy_attach(struct bwi_mac *mac)
2840 {
2841 	struct bwi_softc *sc = mac->mac_sc;
2842 	struct bwi_phy *phy = &mac->mac_phy;
2843 	uint8_t phyrev, phytype, phyver;
2844 	uint16_t val;
2845 	int i;
2846 
2847 	/* Get PHY type/revision/version */
2848 	val = CSR_READ_2(sc, BWI_PHYINFO);
2849 	phyrev = __SHIFTOUT(val, BWI_PHYINFO_REV_MASK);
2850 	phytype = __SHIFTOUT(val, BWI_PHYINFO_TYPE_MASK);
2851 	phyver = __SHIFTOUT(val, BWI_PHYINFO_VER_MASK);
2852 	DPRINTF(1, "%s: PHY type %d, rev %d, ver %d\n",
2853 	    sc->sc_dev.dv_xname, phytype, phyrev, phyver);
2854 
2855 	/*
2856 	 * Verify whether the revision of the PHY type is supported
2857 	 * Convert PHY type to ieee80211_phymode
2858 	 */
2859 	switch (phytype) {
2860 	case BWI_PHYINFO_TYPE_11A:
2861 		if (phyrev >= 4) {
2862 			printf("%s: unsupported 11A PHY, rev %u\n",
2863 			    sc->sc_dev.dv_xname, phyrev);
2864 			return (ENXIO);
2865 		}
2866 		phy->phy_init = bwi_phy_init_11a;
2867 		phy->phy_mode = IEEE80211_MODE_11A;
2868 		phy->phy_tbl_ctrl = BWI_PHYR_TBL_CTRL_11A;
2869 		phy->phy_tbl_data_lo = BWI_PHYR_TBL_DATA_LO_11A;
2870 		phy->phy_tbl_data_hi = BWI_PHYR_TBL_DATA_HI_11A;
2871 		break;
2872 	case BWI_PHYINFO_TYPE_11B:
2873 		for (i = 0; i < nitems(bwi_sup_bphy); ++i) {
2874 			if (phyrev == bwi_sup_bphy[i].rev) {
2875 				phy->phy_init = bwi_sup_bphy[i].init;
2876 				break;
2877 			}
2878 		}
2879 		if (i == nitems(bwi_sup_bphy)) {
2880 			printf("%s: unsupported 11B PHY, rev %u\n",
2881 			    sc->sc_dev.dv_xname, phyrev);
2882 			return (ENXIO);
2883 		}
2884 		phy->phy_mode = IEEE80211_MODE_11B;
2885 		break;
2886 	case BWI_PHYINFO_TYPE_11G:
2887 		if (phyrev > 8) {
2888 			printf("%s: unsupported 11G PHY, rev %u\n",
2889 			    sc->sc_dev.dv_xname, phyrev);
2890 			return (ENXIO);
2891 		}
2892 		phy->phy_init = bwi_phy_init_11g;
2893 		phy->phy_mode = IEEE80211_MODE_11G;
2894 		phy->phy_tbl_ctrl = BWI_PHYR_TBL_CTRL_11G;
2895 		phy->phy_tbl_data_lo = BWI_PHYR_TBL_DATA_LO_11G;
2896 		phy->phy_tbl_data_hi = BWI_PHYR_TBL_DATA_HI_11G;
2897 		break;
2898 	default:
2899 		printf("%s: unsupported PHY type %d\n",
2900 		    sc->sc_dev.dv_xname, phytype);
2901 		return (ENXIO);
2902 	}
2903 	phy->phy_rev = phyrev;
2904 	phy->phy_version = phyver;
2905 
2906 	return (0);
2907 }
2908 
2909 void
2910 bwi_phy_set_bbp_atten(struct bwi_mac *mac, uint16_t bbp_atten)
2911 {
2912 	struct bwi_phy *phy = &mac->mac_phy;
2913 	uint16_t mask = 0x000f;
2914 
2915 	if (phy->phy_version == 0) {
2916 		CSR_FILT_SETBITS_2(mac->mac_sc, BWI_BBP_ATTEN, ~mask,
2917 		    __SHIFTIN(bbp_atten, mask));
2918 	} else {
2919 		if (phy->phy_version > 1)
2920 			mask <<= 2;
2921 		else
2922 			mask <<= 3;
2923 		PHY_FILT_SETBITS(mac, BWI_PHYR_BBP_ATTEN, ~mask,
2924 		    __SHIFTIN(bbp_atten, mask));
2925 	}
2926 }
2927 
2928 int
2929 bwi_phy_calibrate(struct bwi_mac *mac)
2930 {
2931 	struct bwi_phy *phy = &mac->mac_phy;
2932 
2933 	/* Dummy read */
2934 	CSR_READ_4(mac->mac_sc, BWI_MAC_STATUS);
2935 
2936 	/* Don't re-init */
2937 	if (phy->phy_flags & BWI_PHY_F_CALIBRATED)
2938 		return (0);
2939 
2940 	if (phy->phy_mode == IEEE80211_MODE_11G && phy->phy_rev == 1) {
2941 		bwi_mac_reset(mac, 0);
2942 		bwi_phy_init_11g(mac);
2943 		bwi_mac_reset(mac, 1);
2944 	}
2945 
2946 	phy->phy_flags |= BWI_PHY_F_CALIBRATED;
2947 
2948 	return (0);
2949 }
2950 
2951 void
2952 bwi_tbl_write_2(struct bwi_mac *mac, uint16_t ofs, uint16_t data)
2953 {
2954 	struct bwi_phy *phy = &mac->mac_phy;
2955 
2956 	KASSERT(phy->phy_tbl_ctrl != 0 && phy->phy_tbl_data_lo != 0);
2957 	PHY_WRITE(mac, phy->phy_tbl_ctrl, ofs);
2958 	PHY_WRITE(mac, phy->phy_tbl_data_lo, data);
2959 }
2960 
2961 void
2962 bwi_tbl_write_4(struct bwi_mac *mac, uint16_t ofs, uint32_t data)
2963 {
2964 	struct bwi_phy *phy = &mac->mac_phy;
2965 
2966 	KASSERT(phy->phy_tbl_data_lo != 0 && phy->phy_tbl_data_hi != 0 &&
2967 	    phy->phy_tbl_ctrl != 0);
2968 
2969 	PHY_WRITE(mac, phy->phy_tbl_ctrl, ofs);
2970 	PHY_WRITE(mac, phy->phy_tbl_data_hi, data >> 16);
2971 	PHY_WRITE(mac, phy->phy_tbl_data_lo, data & 0xffff);
2972 }
2973 
2974 void
2975 bwi_nrssi_write(struct bwi_mac *mac, uint16_t ofs, int16_t data)
2976 {
2977 	PHY_WRITE(mac, BWI_PHYR_NRSSI_CTRL, ofs);
2978 	PHY_WRITE(mac, BWI_PHYR_NRSSI_DATA, (uint16_t)data);
2979 }
2980 
2981 int16_t
2982 bwi_nrssi_read(struct bwi_mac *mac, uint16_t ofs)
2983 {
2984 	PHY_WRITE(mac, BWI_PHYR_NRSSI_CTRL, ofs);
2985 	return ((int16_t)PHY_READ(mac, BWI_PHYR_NRSSI_DATA));
2986 }
2987 
2988 void
2989 bwi_phy_init_11a(struct bwi_mac *mac)
2990 {
2991 	/* TODO: 11A */
2992 }
2993 
2994 void
2995 bwi_phy_init_11g(struct bwi_mac *mac)
2996 {
2997 	struct bwi_softc *sc = mac->mac_sc;
2998 	struct bwi_phy *phy = &mac->mac_phy;
2999 	struct bwi_rf *rf = &mac->mac_rf;
3000 	const struct bwi_tpctl *tpctl = &mac->mac_tpctl;
3001 
3002 	if (phy->phy_rev == 1)
3003 		bwi_phy_init_11b_rev5(mac);
3004 	else
3005 		bwi_phy_init_11b_rev6(mac);
3006 
3007 	if (phy->phy_rev >= 2 || (phy->phy_flags & BWI_PHY_F_LINKED))
3008 		bwi_phy_config_11g(mac);
3009 
3010 	if (phy->phy_rev >= 2) {
3011 		PHY_WRITE(mac, 0x814, 0);
3012 		PHY_WRITE(mac, 0x815, 0);
3013 
3014 		if (phy->phy_rev == 2) {
3015 			PHY_WRITE(mac, 0x811, 0);
3016 			PHY_WRITE(mac, 0x15, 0xc0);
3017 		} else if (phy->phy_rev > 5) {
3018 			PHY_WRITE(mac, 0x811, 0x400);
3019 			PHY_WRITE(mac, 0x15, 0xc0);
3020 		}
3021 	}
3022 
3023 	if (phy->phy_rev >= 2 || (phy->phy_flags & BWI_PHY_F_LINKED)) {
3024 		uint16_t val;
3025 
3026 		val = PHY_READ(mac, 0x400) & 0xff;
3027 		if (val == 3 || val == 5) {
3028 			PHY_WRITE(mac, 0x4c2, 0x1816);
3029 			PHY_WRITE(mac, 0x4c3, 0x8006);
3030 			if (val == 5) {
3031 				PHY_FILT_SETBITS(mac, 0x4cc,
3032 						 0xff, 0x1f00);
3033 			}
3034 		}
3035 	}
3036 
3037 	if ((phy->phy_rev <= 2 && (phy->phy_flags & BWI_PHY_F_LINKED)) ||
3038 	    phy->phy_rev >= 2)
3039 		PHY_WRITE(mac, 0x47e, 0x78);
3040 
3041 	if (rf->rf_rev == 8) {
3042 		PHY_SETBITS(mac, 0x801, 0x80);
3043 		PHY_SETBITS(mac, 0x43e, 0x4);
3044 	}
3045 
3046 	if (phy->phy_rev >= 2 && (phy->phy_flags & BWI_PHY_F_LINKED))
3047 		bwi_rf_get_gains(mac);
3048 
3049 	if (rf->rf_rev != 8)
3050 		bwi_rf_init(mac);
3051 
3052 	if (tpctl->tp_ctrl2 == 0xffff) {
3053 		bwi_rf_lo_update(mac);
3054 	} else {
3055 		if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev == 8) {
3056 			RF_WRITE(mac, 0x52,
3057 			    (tpctl->tp_ctrl1 << 4) | tpctl->tp_ctrl2);
3058 		} else {
3059 			RF_FILT_SETBITS(mac, 0x52, 0xfff0, tpctl->tp_ctrl1);
3060 		}
3061 
3062 		if (phy->phy_rev >= 6) {
3063 			PHY_FILT_SETBITS(mac, 0x36, 0xfff,
3064 			    tpctl->tp_ctrl2 << 12);
3065 		}
3066 
3067 		if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
3068 			PHY_WRITE(mac, 0x2e, 0x8075);
3069 		else
3070 			PHY_WRITE(mac, 0x2e, 0x807f);
3071 
3072 		if (phy->phy_rev < 2)
3073 			PHY_WRITE(mac, 0x2f, 0x101);
3074 		else
3075 			PHY_WRITE(mac, 0x2f, 0x202);
3076 	}
3077 
3078 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3079 		bwi_rf_lo_adjust(mac, tpctl);
3080 		PHY_WRITE(mac, 0x80f, 0x8078);
3081 	}
3082 
3083 	if ((sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
3084 		bwi_rf_init_hw_nrssi_table(mac, 0xffff /* XXX */);
3085 		bwi_rf_set_nrssi_thr(mac);
3086 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3087 		if (rf->rf_nrssi[0] == BWI_INVALID_NRSSI) {
3088 			KASSERT(rf->rf_nrssi[1] == BWI_INVALID_NRSSI);
3089 			bwi_rf_calc_nrssi_slope(mac);
3090 		} else {
3091 			KASSERT(rf->rf_nrssi[1] != BWI_INVALID_NRSSI);
3092 			bwi_rf_set_nrssi_thr(mac);
3093 		}
3094 	}
3095 
3096 	if (rf->rf_rev == 8)
3097 		PHY_WRITE(mac, 0x805, 0x3230);
3098 
3099 	bwi_mac_init_tpctl_11bg(mac);
3100 
3101 	if (sc->sc_bbp_id == BWI_BBPID_BCM4306 && sc->sc_bbp_pkg == 2) {
3102 		PHY_CLRBITS(mac, 0x429, 0x4000);
3103 		PHY_CLRBITS(mac, 0x4c3, 0x8000);
3104 	}
3105 }
3106 
3107 void
3108 bwi_phy_init_11b_rev2(struct bwi_mac *mac)
3109 {
3110 	struct bwi_softc *sc;
3111 
3112 	sc = mac->mac_sc;
3113 
3114 	/* TODO: 11B */
3115 	printf("%s: %s is not implemented yet\n",
3116 	    sc->sc_dev.dv_xname, __func__);
3117 }
3118 
3119 void
3120 bwi_phy_init_11b_rev4(struct bwi_mac *mac)
3121 {
3122 	struct bwi_softc *sc = mac->mac_sc;
3123 	struct bwi_rf *rf = &mac->mac_rf;
3124 	uint16_t val, ofs;
3125 	u_int chan;
3126 
3127 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, BWI_BPHY_CTRL_INIT);
3128 
3129 	PHY_WRITE(mac, 0x20, 0x301c);
3130 	PHY_WRITE(mac, 0x26, 0);
3131 	PHY_WRITE(mac, 0x30, 0xc6);
3132 	PHY_WRITE(mac, 0x88, 0x3e00);
3133 
3134 	for (ofs = 0, val = 0x3c3d; ofs < 30; ++ofs, val -= 0x202)
3135 		PHY_WRITE(mac, 0x89 + ofs, val);
3136 
3137 	CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL1);
3138 
3139 	chan = rf->rf_curchan;
3140 	if (chan == IEEE80211_CHAN_ANY)
3141 		chan = 6;	/* Force to channel 6 */
3142 	bwi_rf_set_chan(mac, chan, 0);
3143 
3144 	if (rf->rf_type != BWI_RF_T_BCM2050) {
3145 		RF_WRITE(mac, 0x75, 0x80);
3146 		RF_WRITE(mac, 0x79, 0x81);
3147 	}
3148 
3149 	RF_WRITE(mac, 0x50, 0x20);
3150 	RF_WRITE(mac, 0x50, 0x23);
3151 
3152 	if (rf->rf_type == BWI_RF_T_BCM2050) {
3153 		RF_WRITE(mac, 0x50, 0x20);
3154 		RF_WRITE(mac, 0x5a, 0x70);
3155 		RF_WRITE(mac, 0x5b, 0x7b);
3156 		RF_WRITE(mac, 0x5c, 0xb0);
3157 		RF_WRITE(mac, 0x7a, 0xf);
3158 		PHY_WRITE(mac, 0x38, 0x677);
3159 		bwi_rf_init_bcm2050(mac);
3160 	}
3161 
3162 	PHY_WRITE(mac, 0x14, 0x80);
3163 	PHY_WRITE(mac, 0x32, 0xca);
3164 	if (rf->rf_type == BWI_RF_T_BCM2050)
3165 		PHY_WRITE(mac, 0x32, 0xe0);
3166 	PHY_WRITE(mac, 0x35, 0x7c2);
3167 
3168 	bwi_rf_lo_update(mac);
3169 
3170 	PHY_WRITE(mac, 0x26, 0xcc00);
3171 	if (rf->rf_type == BWI_RF_T_BCM2050)
3172 		PHY_WRITE(mac, 0x26, 0xce00);
3173 
3174 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0x1100);
3175 
3176 	PHY_WRITE(mac, 0x2a, 0x88a3);
3177 	if (rf->rf_type == BWI_RF_T_BCM2050)
3178 		PHY_WRITE(mac, 0x2a, 0x88c2);
3179 
3180 	bwi_mac_set_tpctl_11bg(mac, NULL);
3181 	if (sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
3182 		bwi_rf_calc_nrssi_slope(mac);
3183 		bwi_rf_set_nrssi_thr(mac);
3184 	}
3185 	bwi_mac_init_tpctl_11bg(mac);
3186 }
3187 
3188 void
3189 bwi_phy_init_11b_rev5(struct bwi_mac *mac)
3190 {
3191 	struct bwi_softc *sc = mac->mac_sc;
3192 	struct bwi_rf *rf = &mac->mac_rf;
3193 	struct bwi_phy *phy = &mac->mac_phy;
3194 	uint orig_chan;
3195 
3196 	if (phy->phy_version == 1)
3197 		RF_SETBITS(mac, 0x7a, 0x50);
3198 
3199 	if (sc->sc_pci_subvid != PCI_VENDOR_BROADCOM &&
3200 	    sc->sc_pci_subdid != BWI_PCI_SUBDEVICE_BU4306) {
3201 		uint16_t ofs, val;
3202 
3203 		val = 0x2120;
3204 		for (ofs = 0xa8; ofs < 0xc7; ++ofs) {
3205 			PHY_WRITE(mac, ofs, val);
3206 			val += 0x202;
3207 		}
3208 	}
3209 
3210 	PHY_FILT_SETBITS(mac, 0x35, 0xf0ff, 0x700);
3211 
3212 	if (rf->rf_type == BWI_RF_T_BCM2050)
3213 		PHY_WRITE(mac, 0x38, 0x667);
3214 
3215 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
3216 		if (rf->rf_type == BWI_RF_T_BCM2050) {
3217 			RF_SETBITS(mac, 0x7a, 0x20);
3218 			RF_SETBITS(mac, 0x51, 0x4);
3219 		}
3220 
3221 		CSR_WRITE_2(sc, BWI_RF_ANTDIV, 0);
3222 
3223 		PHY_SETBITS(mac, 0x802, 0x100);
3224 		PHY_SETBITS(mac, 0x42b, 0x2000);
3225 		PHY_WRITE(mac, 0x1c, 0x186a);
3226 
3227 		PHY_FILT_SETBITS(mac, 0x13, 0xff, 0x1900);
3228 		PHY_FILT_SETBITS(mac, 0x35, 0xffc0, 0x64);
3229 		PHY_FILT_SETBITS(mac, 0x5d, 0xff80, 0xa);
3230 	}
3231 
3232 	/* TODO: bad_frame_preempt? */
3233 
3234 	if (phy->phy_version == 1) {
3235 	    	PHY_WRITE(mac, 0x26, 0xce00);
3236 		PHY_WRITE(mac, 0x21, 0x3763);
3237 		PHY_WRITE(mac, 0x22, 0x1bc3);
3238 		PHY_WRITE(mac, 0x23, 0x6f9);
3239 		PHY_WRITE(mac, 0x24, 0x37e);
3240 	} else
3241 		PHY_WRITE(mac, 0x26, 0xcc00);
3242 	PHY_WRITE(mac, 0x30, 0xc6);
3243 
3244 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, BWI_BPHY_CTRL_INIT);
3245 
3246 	if (phy->phy_version == 1)
3247 		PHY_WRITE(mac, 0x20, 0x3e1c);
3248 	else
3249 		PHY_WRITE(mac, 0x20, 0x301c);
3250 
3251 	if (phy->phy_version == 0)
3252 		CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL1);
3253 
3254 	/* Force to channel 7 */
3255 	orig_chan = rf->rf_curchan;
3256 	bwi_rf_set_chan(mac, 7, 0);
3257 
3258 	if (rf->rf_type != BWI_RF_T_BCM2050) {
3259 		RF_WRITE(mac, 0x75, 0x80);
3260 		RF_WRITE(mac, 0x79, 0x81);
3261 	}
3262 
3263 	RF_WRITE(mac, 0x50, 0x20);
3264 	RF_WRITE(mac, 0x50, 0x23);
3265 
3266 	if (rf->rf_type == BWI_RF_T_BCM2050) {
3267 		RF_WRITE(mac, 0x50, 0x20);
3268 		RF_WRITE(mac, 0x5a, 0x70);
3269 	}
3270 
3271 	RF_WRITE(mac, 0x5b, 0x7b);
3272 	RF_WRITE(mac, 0x5c, 0xb0);
3273 	RF_SETBITS(mac, 0x7a, 0x7);
3274 
3275 	bwi_rf_set_chan(mac, orig_chan, 0);
3276 
3277 	PHY_WRITE(mac, 0x14, 0x80);
3278 	PHY_WRITE(mac, 0x32, 0xca);
3279 	PHY_WRITE(mac, 0x2a, 0x88a3);
3280 
3281 	bwi_mac_set_tpctl_11bg(mac, NULL);
3282 
3283 	if (rf->rf_type == BWI_RF_T_BCM2050)
3284 		RF_WRITE(mac, 0x5d, 0xd);
3285 
3286 	CSR_FILT_SETBITS_2(sc, BWI_PHY_MAGIC_REG1, 0xffc0, 0x4);
3287 }
3288 
3289 void
3290 bwi_phy_init_11b_rev6(struct bwi_mac *mac)
3291 {
3292 	struct bwi_softc *sc = mac->mac_sc;
3293 	struct bwi_rf *rf = &mac->mac_rf;
3294 	struct bwi_phy *phy = &mac->mac_phy;
3295 	uint16_t val, ofs;
3296 	uint orig_chan;
3297 
3298 	PHY_WRITE(mac, 0x3e, 0x817a);
3299 	RF_SETBITS(mac, 0x7a, 0x58);
3300 
3301 	if (rf->rf_rev == 4 || rf->rf_rev == 5) {
3302 		RF_WRITE(mac, 0x51, 0x37);
3303 		RF_WRITE(mac, 0x52, 0x70);
3304 		RF_WRITE(mac, 0x53, 0xb3);
3305 		RF_WRITE(mac, 0x54, 0x9b);
3306 		RF_WRITE(mac, 0x5a, 0x88);
3307 		RF_WRITE(mac, 0x5b, 0x88);
3308 		RF_WRITE(mac, 0x5d, 0x88);
3309 		RF_WRITE(mac, 0x5e, 0x88);
3310 		RF_WRITE(mac, 0x7d, 0x88);
3311 		HFLAGS_SETBITS(mac, BWI_HFLAG_MAGIC1);
3312 	} else if (rf->rf_rev == 8) {
3313 		RF_WRITE(mac, 0x51, 0);
3314 		RF_WRITE(mac, 0x52, 0x40);
3315 		RF_WRITE(mac, 0x53, 0xb7);
3316 		RF_WRITE(mac, 0x54, 0x98);
3317 		RF_WRITE(mac, 0x5a, 0x88);
3318 		RF_WRITE(mac, 0x5b, 0x6b);
3319 		RF_WRITE(mac, 0x5c, 0xf);
3320 		if (sc->sc_card_flags & BWI_CARD_F_ALT_IQ) {
3321 			RF_WRITE(mac, 0x5d, 0xfa);
3322 			RF_WRITE(mac, 0x5e, 0xd8);
3323 		} else {
3324 			RF_WRITE(mac, 0x5d, 0xf5);
3325 			RF_WRITE(mac, 0x5e, 0xb8);
3326 		}
3327 		RF_WRITE(mac, 0x73, 0x3);
3328 		RF_WRITE(mac, 0x7d, 0xa8);
3329 		RF_WRITE(mac, 0x7c, 0x1);
3330 		RF_WRITE(mac, 0x7e, 0x8);
3331 	}
3332 
3333 	val = 0x1e1f;
3334 	for (ofs = 0x88; ofs < 0x98; ++ofs) {
3335 		PHY_WRITE(mac, ofs, val);
3336 		val -= 0x202;
3337 	}
3338 
3339 	val = 0x3e3f;
3340 	for (ofs = 0x98; ofs < 0xa8; ++ofs) {
3341 		PHY_WRITE(mac, ofs, val);
3342 		val -= 0x202;
3343 	}
3344 
3345 	val = 0x2120;
3346 	for (ofs = 0xa8; ofs < 0xc8; ++ofs) {
3347 		PHY_WRITE(mac, ofs, (val & 0x3f3f));
3348 		val += 0x202;
3349 	}
3350 
3351 	if (phy->phy_mode == IEEE80211_MODE_11G) {
3352 		RF_SETBITS(mac, 0x7a, 0x20);
3353 		RF_SETBITS(mac, 0x51, 0x4);
3354 		PHY_SETBITS(mac, 0x802, 0x100);
3355 		PHY_SETBITS(mac, 0x42b, 0x2000);
3356 		PHY_WRITE(mac, 0x5b, 0);
3357 		PHY_WRITE(mac, 0x5c, 0);
3358 	}
3359 
3360 	/* Force to channel 7 */
3361 	orig_chan = rf->rf_curchan;
3362 	if (orig_chan >= 8)
3363 		bwi_rf_set_chan(mac, 1, 0);
3364 	else
3365 		bwi_rf_set_chan(mac, 13, 0);
3366 
3367 	RF_WRITE(mac, 0x50, 0x20);
3368 	RF_WRITE(mac, 0x50, 0x23);
3369 
3370 	DELAY(40);
3371 
3372 	if (rf->rf_rev < 6 || rf->rf_rev == 8) {
3373 		RF_SETBITS(mac, 0x7c, 0x2);
3374 		RF_WRITE(mac, 0x50, 0x20);
3375 	}
3376 	if (rf->rf_rev <= 2) {
3377 		RF_WRITE(mac, 0x7c, 0x20);
3378 		RF_WRITE(mac, 0x5a, 0x70);
3379 		RF_WRITE(mac, 0x5b, 0x7b);
3380 		RF_WRITE(mac, 0x5c, 0xb0);
3381 	}
3382 
3383 	RF_FILT_SETBITS(mac, 0x7a, 0xf8, 0x7);
3384 
3385 	bwi_rf_set_chan(mac, orig_chan, 0);
3386 
3387 	PHY_WRITE(mac, 0x14, 0x200);
3388 	if (rf->rf_rev >= 6)
3389 		PHY_WRITE(mac, 0x2a, 0x88c2);
3390 	else
3391 		PHY_WRITE(mac, 0x2a, 0x8ac0);
3392 	PHY_WRITE(mac, 0x38, 0x668);
3393 
3394 	bwi_mac_set_tpctl_11bg(mac, NULL);
3395 
3396 	if (rf->rf_rev <= 5) {
3397 		PHY_FILT_SETBITS(mac, 0x5d, 0xff80, 0x3);
3398 		if (rf->rf_rev <= 2)
3399 			RF_WRITE(mac, 0x5d, 0xd);
3400 	}
3401 
3402 	if (phy->phy_version == 4) {
3403 		CSR_WRITE_2(sc, BWI_PHY_MAGIC_REG1, BWI_PHY_MAGIC_REG1_VAL2);
3404 		PHY_CLRBITS(mac, 0x61, 0xf000);
3405 	} else {
3406 		PHY_FILT_SETBITS(mac, 0x2, 0xffc0, 0x4);
3407 	}
3408 
3409 	if (phy->phy_mode == IEEE80211_MODE_11B) {
3410 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC2);
3411 		PHY_WRITE(mac, 0x16, 0x410);
3412 		PHY_WRITE(mac, 0x17, 0x820);
3413 		PHY_WRITE(mac, 0x62, 0x7);
3414 
3415 		bwi_rf_init_bcm2050(mac);
3416 		bwi_rf_lo_update(mac);
3417 		if (sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
3418 			bwi_rf_calc_nrssi_slope(mac);
3419 			bwi_rf_set_nrssi_thr(mac);
3420 		}
3421 		bwi_mac_init_tpctl_11bg(mac);
3422 	} else
3423 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
3424 }
3425 
3426 void
3427 bwi_phy_config_11g(struct bwi_mac *mac)
3428 {
3429 	struct bwi_softc *sc = mac->mac_sc;
3430 	struct bwi_phy *phy = &mac->mac_phy;
3431 	const uint16_t *tbl;
3432 	uint16_t wrd_ofs1, wrd_ofs2;
3433 	int i, n;
3434 
3435 	if (phy->phy_rev == 1) {
3436 		PHY_WRITE(mac, 0x406, 0x4f19);
3437 		PHY_FILT_SETBITS(mac, 0x429, 0xfc3f, 0x340);
3438 		PHY_WRITE(mac, 0x42c, 0x5a);
3439 		PHY_WRITE(mac, 0x427, 0x1a);
3440 
3441 		/* Fill frequency table */
3442 		for (i = 0; i < nitems(bwi_phy_freq_11g_rev1); ++i) {
3443 			bwi_tbl_write_2(mac, BWI_PHYTBL_FREQ + i,
3444 			    bwi_phy_freq_11g_rev1[i]);
3445 		}
3446 
3447 		/* Fill noise table */
3448 		for (i = 0; i < nitems(bwi_phy_noise_11g_rev1); ++i) {
3449 			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
3450 			    bwi_phy_noise_11g_rev1[i]);
3451 		}
3452 
3453 		/* Fill rotor table */
3454 		for (i = 0; i < nitems(bwi_phy_rotor_11g_rev1); ++i) {
3455 			/* NB: data length is 4 bytes */
3456 			bwi_tbl_write_4(mac, BWI_PHYTBL_ROTOR + i,
3457 			    bwi_phy_rotor_11g_rev1[i]);
3458 		}
3459 	} else {
3460 		bwi_nrssi_write(mac, 0xba98, (int16_t)0x7654); /* XXX */
3461 
3462 		if (phy->phy_rev == 2) {
3463 			PHY_WRITE(mac, 0x4c0, 0x1861);
3464 			PHY_WRITE(mac, 0x4c1, 0x271);
3465 		} else if (phy->phy_rev > 2) {
3466 			PHY_WRITE(mac, 0x4c0, 0x98);
3467 			PHY_WRITE(mac, 0x4c1, 0x70);
3468 			PHY_WRITE(mac, 0x4c9, 0x80);
3469 		}
3470 		PHY_SETBITS(mac, 0x42b, 0x800);
3471 
3472 		/* Fill RSSI table */
3473 		for (i = 0; i < 64; ++i)
3474 			bwi_tbl_write_2(mac, BWI_PHYTBL_RSSI + i, i);
3475 
3476 		/* Fill noise table */
3477 		for (i = 0; i < nitems(bwi_phy_noise_11g); ++i) {
3478 			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
3479 			    bwi_phy_noise_11g[i]);
3480 		}
3481 	}
3482 
3483 	/*
3484 	 * Fill noise scale table
3485 	 */
3486 	if (phy->phy_rev <= 2) {
3487 		tbl = bwi_phy_noise_scale_11g_rev2;
3488 		n = nitems(bwi_phy_noise_scale_11g_rev2);
3489 	} else if (phy->phy_rev >= 7 && (PHY_READ(mac, 0x449) & 0x200)) {
3490 		tbl = bwi_phy_noise_scale_11g_rev7;
3491 		n = nitems(bwi_phy_noise_scale_11g_rev7);
3492 	} else {
3493 		tbl = bwi_phy_noise_scale_11g;
3494 		n = nitems(bwi_phy_noise_scale_11g);
3495 	}
3496 	for (i = 0; i < n; ++i)
3497 		bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE_SCALE + i, tbl[i]);
3498 
3499 	/*
3500 	 * Fill sigma square table
3501 	 */
3502 	if (phy->phy_rev == 2) {
3503 		tbl = bwi_phy_sigma_sq_11g_rev2;
3504 		n = nitems(bwi_phy_sigma_sq_11g_rev2);
3505 	} else if (phy->phy_rev > 2 && phy->phy_rev <= 8) {
3506 		tbl = bwi_phy_sigma_sq_11g_rev7;
3507 		n = nitems(bwi_phy_sigma_sq_11g_rev7);
3508 	} else {
3509 		tbl = NULL;
3510 		n = 0;
3511 	}
3512 	for (i = 0; i < n; ++i)
3513 		bwi_tbl_write_2(mac, BWI_PHYTBL_SIGMA_SQ + i, tbl[i]);
3514 
3515 	if (phy->phy_rev == 1) {
3516 		/* Fill delay table */
3517 		for (i = 0; i < nitems(bwi_phy_delay_11g_rev1); ++i) {
3518 			bwi_tbl_write_4(mac, BWI_PHYTBL_DELAY + i,
3519 			    bwi_phy_delay_11g_rev1[i]);
3520 		}
3521 
3522 		/* Fill WRSSI (Wide-Band RSSI) table */
3523 		for (i = 4; i < 20; ++i)
3524 			bwi_tbl_write_2(mac, BWI_PHYTBL_WRSSI_REV1 + i, 0x20);
3525 
3526 		bwi_phy_config_agc(mac);
3527 
3528 		wrd_ofs1 = 0x5001;
3529 		wrd_ofs2 = 0x5002;
3530 	} else {
3531 		/* Fill WRSSI (Wide-Band RSSI) table */
3532 		for (i = 0; i < 0x20; ++i)
3533 			bwi_tbl_write_2(mac, BWI_PHYTBL_WRSSI + i, 0x820);
3534 
3535 		bwi_phy_config_agc(mac);
3536 
3537 		PHY_READ(mac, 0x400);	/* Dummy read */
3538 		PHY_WRITE(mac, 0x403, 0x1000);
3539 		bwi_tbl_write_2(mac, 0x3c02, 0xf);
3540 		bwi_tbl_write_2(mac, 0x3c03, 0x14);
3541 
3542 		wrd_ofs1 = 0x401;
3543 		wrd_ofs2 = 0x402;
3544 	}
3545 
3546 	if (!(BWI_IS_BRCM_BU4306(sc) && sc->sc_pci_revid == 0x17)) {
3547 		bwi_tbl_write_2(mac, wrd_ofs1, 0x2);
3548 		bwi_tbl_write_2(mac, wrd_ofs2, 0x1);
3549 	}
3550 
3551 	/* phy->phy_flags & BWI_PHY_F_LINKED ? */
3552 	if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
3553 		PHY_WRITE(mac, 0x46e, 0x3cf);
3554 }
3555 #undef N
3556 
3557 /*
3558  * Configure Automatic Gain Controller
3559  */
3560 void
3561 bwi_phy_config_agc(struct bwi_mac *mac)
3562 {
3563 	struct bwi_phy *phy = &mac->mac_phy;
3564 	uint16_t ofs;
3565 
3566 	ofs = phy->phy_rev == 1 ? 0x4c00 : 0;
3567 
3568 	bwi_tbl_write_2(mac, ofs, 0xfe);
3569 	bwi_tbl_write_2(mac, ofs + 1, 0xd);
3570 	bwi_tbl_write_2(mac, ofs + 2, 0x13);
3571 	bwi_tbl_write_2(mac, ofs + 3, 0x19);
3572 
3573 	if (phy->phy_rev == 1) {
3574 		bwi_tbl_write_2(mac, 0x1800, 0x2710);
3575 		bwi_tbl_write_2(mac, 0x1801, 0x9b83);
3576 		bwi_tbl_write_2(mac, 0x1802, 0x9b83);
3577 		bwi_tbl_write_2(mac, 0x1803, 0xf8d);
3578 		PHY_WRITE(mac, 0x455, 0x4);
3579 	}
3580 
3581 	PHY_FILT_SETBITS(mac, 0x4a5, 0xff, 0x5700);
3582 	PHY_FILT_SETBITS(mac, 0x41a, 0xff80, 0xf);
3583 	PHY_FILT_SETBITS(mac, 0x41a, 0xc07f, 0x2b80);
3584 	PHY_FILT_SETBITS(mac, 0x48c, 0xf0ff, 0x300);
3585 
3586 	RF_SETBITS(mac, 0x7a, 0x8);
3587 
3588 	PHY_FILT_SETBITS(mac, 0x4a0, 0xfff0, 0x8);
3589 	PHY_FILT_SETBITS(mac, 0x4a1, 0xf0ff, 0x600);
3590 	PHY_FILT_SETBITS(mac, 0x4a2, 0xf0ff, 0x700);
3591 	PHY_FILT_SETBITS(mac, 0x4a0, 0xf0ff, 0x100);
3592 
3593 	if (phy->phy_rev == 1)
3594 		PHY_FILT_SETBITS(mac, 0x4a2, 0xfff0, 0x7);
3595 
3596 	PHY_FILT_SETBITS(mac, 0x488, 0xff00, 0x1c);
3597 	PHY_FILT_SETBITS(mac, 0x488, 0xc0ff, 0x200);
3598 	PHY_FILT_SETBITS(mac, 0x496, 0xff00, 0x1c);
3599 	PHY_FILT_SETBITS(mac, 0x489, 0xff00, 0x20);
3600 	PHY_FILT_SETBITS(mac, 0x489, 0xc0ff, 0x200);
3601 	PHY_FILT_SETBITS(mac, 0x482, 0xff00, 0x2e);
3602 	PHY_FILT_SETBITS(mac, 0x496, 0xff, 0x1a00);
3603 	PHY_FILT_SETBITS(mac, 0x481, 0xff00, 0x28);
3604 	PHY_FILT_SETBITS(mac, 0x481, 0xff, 0x2c00);
3605 
3606 	if (phy->phy_rev == 1) {
3607 		PHY_WRITE(mac, 0x430, 0x92b);
3608 		PHY_FILT_SETBITS(mac, 0x41b, 0xffe1, 0x2);
3609 	} else {
3610 		PHY_CLRBITS(mac, 0x41b, 0x1e);
3611 		PHY_WRITE(mac, 0x41f, 0x287a);
3612 		PHY_FILT_SETBITS(mac, 0x420, 0xfff0, 0x4);
3613 
3614 		if (phy->phy_rev >= 6) {
3615 			PHY_WRITE(mac, 0x422, 0x287a);
3616 			PHY_FILT_SETBITS(mac, 0x420, 0xfff, 0x3000);
3617 		}
3618 	}
3619 
3620 	PHY_FILT_SETBITS(mac, 0x4a8, 0x8080, 0x7874);
3621 	PHY_WRITE(mac, 0x48e, 0x1c00);
3622 
3623 	if (phy->phy_rev == 1) {
3624 		PHY_FILT_SETBITS(mac, 0x4ab, 0xf0ff, 0x600);
3625 		PHY_WRITE(mac, 0x48b, 0x5e);
3626 		PHY_FILT_SETBITS(mac, 0x48c, 0xff00, 0x1e);
3627 		PHY_WRITE(mac, 0x48d, 0x2);
3628 	}
3629 
3630 	bwi_tbl_write_2(mac, ofs + 0x800, 0);
3631 	bwi_tbl_write_2(mac, ofs + 0x801, 7);
3632 	bwi_tbl_write_2(mac, ofs + 0x802, 16);
3633 	bwi_tbl_write_2(mac, ofs + 0x803, 28);
3634 
3635 	if (phy->phy_rev >= 6) {
3636 		PHY_CLRBITS(mac, 0x426, 0x3);
3637 		PHY_CLRBITS(mac, 0x426, 0x1000);
3638 	}
3639 }
3640 
3641 void
3642 bwi_set_gains(struct bwi_mac *mac, const struct bwi_gains *gains)
3643 {
3644 	struct bwi_phy *phy = &mac->mac_phy;
3645 	uint16_t tbl_gain_ofs1, tbl_gain_ofs2, tbl_gain;
3646 	int i;
3647 
3648 	if (phy->phy_rev <= 1) {
3649 		tbl_gain_ofs1 = 0x5000;
3650 		tbl_gain_ofs2 = tbl_gain_ofs1 + 16;
3651 	} else {
3652 		tbl_gain_ofs1 = 0x400;
3653 		tbl_gain_ofs2 = tbl_gain_ofs1 + 8;
3654 	}
3655 
3656 	for (i = 0; i < 4; ++i) {
3657 		if (gains != NULL) {
3658 			tbl_gain = gains->tbl_gain1;
3659 		} else {
3660 			/* Bit swap */
3661 			tbl_gain = (i & 0x1) << 1;
3662 			tbl_gain |= (i & 0x2) >> 1;
3663 		}
3664 		bwi_tbl_write_2(mac, tbl_gain_ofs1 + i, tbl_gain);
3665 	}
3666 
3667 	for (i = 0; i < 16; ++i) {
3668 		if (gains != NULL)
3669 			tbl_gain = gains->tbl_gain2;
3670 		else
3671 			tbl_gain = i;
3672 		bwi_tbl_write_2(mac, tbl_gain_ofs2 + i, tbl_gain);
3673 	}
3674 
3675 	if (gains == NULL || (gains != NULL && gains->phy_gain != -1)) {
3676 		uint16_t phy_gain1, phy_gain2;
3677 
3678 		if (gains != NULL) {
3679 			phy_gain1 =
3680 			((uint16_t)gains->phy_gain << 14) |
3681 			((uint16_t)gains->phy_gain << 6);
3682 			phy_gain2 = phy_gain1;
3683 		} else {
3684 			phy_gain1 = 0x4040;
3685 			phy_gain2 = 0x4000;
3686 		}
3687 		PHY_FILT_SETBITS(mac, 0x4a0, 0xbfbf, phy_gain1);
3688 		PHY_FILT_SETBITS(mac, 0x4a1, 0xbfbf, phy_gain1);
3689 		PHY_FILT_SETBITS(mac, 0x4a2, 0xbfbf, phy_gain2);
3690 	}
3691 	bwi_mac_dummy_xmit(mac);
3692 }
3693 
3694 void
3695 bwi_phy_clear_state(struct bwi_phy *phy)
3696 {
3697 	phy->phy_flags &= ~BWI_CLEAR_PHY_FLAGS;
3698 }
3699 
3700 /* RF */
3701 
3702 int16_t
3703 bwi_nrssi_11g(struct bwi_mac *mac)
3704 {
3705 	int16_t val;
3706 
3707 #define NRSSI_11G_MASK		0x3f00
3708 	val = (int16_t)__SHIFTOUT(PHY_READ(mac, 0x47f), NRSSI_11G_MASK);
3709 	if (val >= 32)
3710 		val -= 64;
3711 
3712 	return (val);
3713 #undef NRSSI_11G_MASK
3714 }
3715 
3716 struct bwi_rf_lo *
3717 bwi_get_rf_lo(struct bwi_mac *mac, uint16_t rf_atten, uint16_t bbp_atten)
3718 {
3719 	int n;
3720 
3721 	n = rf_atten + (14 * (bbp_atten / 2));
3722 	KASSERT(n < BWI_RFLO_MAX);
3723 
3724 	return (&mac->mac_rf.rf_lo[n]);
3725 }
3726 
3727 int
3728 bwi_rf_lo_isused(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
3729 {
3730 	struct bwi_rf *rf = &mac->mac_rf;
3731 	int idx;
3732 
3733 	idx = lo - rf->rf_lo;
3734 	KASSERT(idx >= 0 && idx < BWI_RFLO_MAX);
3735 
3736 	return (isset(rf->rf_lo_used, idx));
3737 }
3738 
3739 void
3740 bwi_rf_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
3741 {
3742 	struct bwi_softc *sc = mac->mac_sc;
3743 
3744 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
3745 	CSR_WRITE_2(sc, BWI_RF_DATA_LO, data);
3746 }
3747 
3748 uint16_t
3749 bwi_rf_read(struct bwi_mac *mac, uint16_t ctrl)
3750 {
3751 	struct bwi_rf *rf = &mac->mac_rf;
3752 	struct bwi_softc *sc = mac->mac_sc;
3753 
3754 	ctrl |= rf->rf_ctrl_rd;
3755 	if (rf->rf_ctrl_adj) {
3756 		/* XXX */
3757 		if (ctrl < 0x70)
3758 			ctrl += 0x80;
3759 		else if (ctrl < 0x80)
3760 			ctrl += 0x70;
3761 	}
3762 
3763 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
3764 	return (CSR_READ_2(sc, BWI_RF_DATA_LO));
3765 }
3766 
3767 int
3768 bwi_rf_attach(struct bwi_mac *mac)
3769 {
3770 	struct bwi_softc *sc = mac->mac_sc;
3771 	struct bwi_phy *phy = &mac->mac_phy;
3772 	struct bwi_rf *rf = &mac->mac_rf;
3773 	uint16_t type, manu;
3774 	uint8_t rev;
3775 
3776 	/*
3777 	 * Get RF manufacture/type/revision
3778 	 */
3779 	if (sc->sc_bbp_id == BWI_BBPID_BCM4317) {
3780 		/*
3781 		 * Fake a BCM2050 RF
3782 		 */
3783 		manu = BWI_RF_MANUFACT_BCM;
3784 		type = BWI_RF_T_BCM2050;
3785 		if (sc->sc_bbp_rev == 0)
3786 			rev = 3;
3787 		else if (sc->sc_bbp_rev == 1)
3788 			rev = 4;
3789 		else
3790 			rev = 5;
3791 	} else {
3792 		uint32_t val;
3793 
3794 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
3795 		val = CSR_READ_2(sc, BWI_RF_DATA_HI);
3796 		val <<= 16;
3797 
3798 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
3799 		val |= CSR_READ_2(sc, BWI_RF_DATA_LO);
3800 
3801 		manu = __SHIFTOUT(val, BWI_RFINFO_MANUFACT_MASK);
3802 		type = __SHIFTOUT(val, BWI_RFINFO_TYPE_MASK);
3803 		rev = __SHIFTOUT(val, BWI_RFINFO_REV_MASK);
3804 	}
3805 	DPRINTF(1, "%s: RF manu 0x%03x, type 0x%04x, rev %u\n",
3806 	    sc->sc_dev.dv_xname, manu, type, rev);
3807 
3808 	/*
3809 	 * Verify whether the RF is supported
3810 	 */
3811 	rf->rf_ctrl_rd = 0;
3812 	rf->rf_ctrl_adj = 0;
3813 	switch (phy->phy_mode) {
3814 	case IEEE80211_MODE_11A:
3815 		if (manu != BWI_RF_MANUFACT_BCM ||
3816 		    type != BWI_RF_T_BCM2060 ||
3817 		    rev != 1) {
3818 			printf("%s: only BCM2060 rev 1 RF is supported for "
3819 			    "11A PHY\n", sc->sc_dev.dv_xname);
3820 			return (ENXIO);
3821 		}
3822 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11A;
3823 		rf->rf_on = bwi_rf_on_11a;
3824 		rf->rf_off = bwi_rf_off_11a;
3825 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2060;
3826 		break;
3827 	case IEEE80211_MODE_11B:
3828 		if (type == BWI_RF_T_BCM2050) {
3829 			rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
3830 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
3831 		} else if (type == BWI_RF_T_BCM2053) {
3832 			rf->rf_ctrl_adj = 1;
3833 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2053;
3834 		} else {
3835 			printf("%s: only BCM2050/BCM2053 RF is supported "
3836 			    "for supported for 11B PHY\n", sc->sc_dev.dv_xname);
3837 			return (ENXIO);
3838 		}
3839 		rf->rf_on = bwi_rf_on_11bg;
3840 		rf->rf_off = bwi_rf_off_11bg;
3841 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11b;
3842 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11b;
3843 		if (phy->phy_rev == 6)
3844 			rf->rf_lo_update = bwi_rf_lo_update_11g;
3845 		else
3846 			rf->rf_lo_update = bwi_rf_lo_update_11b;
3847 		break;
3848 	case IEEE80211_MODE_11G:
3849 		if (type != BWI_RF_T_BCM2050) {
3850 			printf("%s: only BCM2050 RF is supported for 11G "
3851 			    "PHY\n", sc->sc_dev.dv_xname);
3852 			return (ENXIO);
3853 		}
3854 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
3855 		rf->rf_on = bwi_rf_on_11bg;
3856 		if (mac->mac_rev >= 5)
3857 			rf->rf_off = bwi_rf_off_11g_rev5;
3858 		else
3859 			rf->rf_off = bwi_rf_off_11bg;
3860 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11g;
3861 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11g;
3862 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
3863 		rf->rf_lo_update = bwi_rf_lo_update_11g;
3864 		break;
3865 	default:
3866 		printf("%s: unsupported PHY mode\n", sc->sc_dev.dv_xname);
3867 		return (ENXIO);
3868 	}
3869 
3870 	rf->rf_type = type;
3871 	rf->rf_rev = rev;
3872 	rf->rf_manu = manu;
3873 	rf->rf_curchan = IEEE80211_CHAN_ANY;
3874 	rf->rf_ant_mode = BWI_ANT_MODE_AUTO;
3875 
3876 	return (0);
3877 }
3878 
3879 void
3880 bwi_rf_set_chan(struct bwi_mac *mac, uint chan, int work_around)
3881 {
3882 	struct bwi_softc *sc = mac->mac_sc;
3883 
3884 	if (chan == IEEE80211_CHAN_ANY)
3885 		return;
3886 
3887 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_CHAN, chan);
3888 
3889 	/* TODO: 11A */
3890 
3891 	if (work_around)
3892 		bwi_rf_workaround(mac, chan);
3893 
3894 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
3895 
3896 	if (chan == 14) {
3897 		if (sc->sc_locale == BWI_SPROM_LOCALE_JAPAN)
3898 			HFLAGS_CLRBITS(mac, BWI_HFLAG_NOT_JAPAN);
3899 		else
3900 			HFLAGS_SETBITS(mac, BWI_HFLAG_NOT_JAPAN);
3901 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, (1 << 11)); /* XXX */
3902 	} else {
3903 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0x840); /* XXX */
3904 	}
3905 	DELAY(8000);	/* DELAY(2000); */
3906 
3907 	mac->mac_rf.rf_curchan = chan;
3908 }
3909 
3910 void
3911 bwi_rf_get_gains(struct bwi_mac *mac)
3912 {
3913 #define SAVE_PHY_MAX	15
3914 #define SAVE_RF_MAX	3
3915 	struct bwi_softc *sc;
3916 	struct bwi_phy *phy = &mac->mac_phy;
3917 	struct bwi_rf *rf = &mac->mac_rf;
3918 	uint16_t save_phy[SAVE_PHY_MAX];
3919 	uint16_t save_rf[SAVE_RF_MAX];
3920 	uint16_t trsw;
3921 	int i, j, loop1_max, loop1, loop2;
3922 
3923 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
3924 	    { 0x52, 0x43, 0x7a };
3925 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] = {
3926 	    0x0429, 0x0001, 0x0811, 0x0812,
3927 	    0x0814, 0x0815, 0x005a, 0x0059,
3928 	    0x0058, 0x000a, 0x0003, 0x080f,
3929 	    0x0810, 0x002b, 0x0015
3930 	};
3931 
3932 	sc = mac->mac_sc;
3933 
3934 	/*
3935 	 * Save PHY/RF registers for later restoration
3936 	 */
3937 	for (i = 0; i < SAVE_PHY_MAX; ++i)
3938 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
3939 	PHY_READ(mac, 0x2d); /* dummy read */
3940 
3941 	for (i = 0; i < SAVE_RF_MAX; ++i)
3942 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
3943 
3944 	PHY_CLRBITS(mac, 0x429, 0xc000);
3945 	PHY_SETBITS(mac, 0x1, 0x8000);
3946 
3947 	PHY_SETBITS(mac, 0x811, 0x2);
3948 	PHY_CLRBITS(mac, 0x812, 0x2);
3949 	PHY_SETBITS(mac, 0x811, 0x1);
3950 	PHY_CLRBITS(mac, 0x812, 0x1);
3951 
3952 	PHY_SETBITS(mac, 0x814, 0x1);
3953 	PHY_CLRBITS(mac, 0x815, 0x1);
3954 	PHY_SETBITS(mac, 0x814, 0x2);
3955 	PHY_CLRBITS(mac, 0x815, 0x2);
3956 
3957 	PHY_SETBITS(mac, 0x811, 0xc);
3958 	PHY_SETBITS(mac, 0x812, 0xc);
3959 	PHY_SETBITS(mac, 0x811, 0x30);
3960 	PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
3961 
3962 	PHY_WRITE(mac, 0x5a, 0x780);
3963 	PHY_WRITE(mac, 0x59, 0xc810);
3964 	PHY_WRITE(mac, 0x58, 0xd);
3965 	PHY_SETBITS(mac, 0xa, 0x2000);
3966 
3967 	PHY_SETBITS(mac, 0x814, 0x4);
3968 	PHY_CLRBITS(mac, 0x815, 0x4);
3969 
3970 	PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
3971 
3972 	if (rf->rf_rev == 8) {
3973 		loop1_max = 15;
3974 		RF_WRITE(mac, 0x43, loop1_max);
3975 	} else {
3976 		loop1_max = 9;
3977 	    	RF_WRITE(mac, 0x52, 0x0);
3978 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, loop1_max);
3979 	}
3980 
3981 	bwi_phy_set_bbp_atten(mac, 11);
3982 
3983 	if (phy->phy_rev >= 3)
3984 		PHY_WRITE(mac, 0x80f, 0xc020);
3985 	else
3986 		PHY_WRITE(mac, 0x80f, 0x8020);
3987 	PHY_WRITE(mac, 0x810, 0);
3988 
3989 	PHY_FILT_SETBITS(mac, 0x2b, 0xffc0, 0x1);
3990 	PHY_FILT_SETBITS(mac, 0x2b, 0xc0ff, 0x800);
3991 	PHY_SETBITS(mac, 0x811, 0x100);
3992 	PHY_CLRBITS(mac, 0x812, 0x3000);
3993 
3994 	if ((mac->mac_sc->sc_card_flags & BWI_CARD_F_EXT_LNA) &&
3995 	    phy->phy_rev >= 7) {
3996 		PHY_SETBITS(mac, 0x811, 0x800);
3997 		PHY_SETBITS(mac, 0x812, 0x8000);
3998 	}
3999 	RF_CLRBITS(mac, 0x7a, 0xff08);
4000 
4001 	/*
4002 	 * Find out 'loop1/loop2', which will be used to calculate
4003 	 * max loopback gain later
4004 	 */
4005 	j = 0;
4006 	for (i = 0; i < loop1_max; ++i) {
4007 		for (j = 0; j < 16; ++j) {
4008 			RF_WRITE(mac, 0x43, i);
4009 
4010 			if (bwi_rf_gain_max_reached(mac, j))
4011 				goto loop1_exit;
4012 		}
4013 	}
4014 loop1_exit:
4015 	loop1 = i;
4016 	loop2 = j;
4017 
4018 	/*
4019 	 * Find out 'trsw', which will be used to calculate
4020 	 * TRSW(TX/RX switch) RX gain later
4021 	 */
4022 	if (loop2 >= 8) {
4023 		PHY_SETBITS(mac, 0x812, 0x30);
4024 		trsw = 0x1b;
4025 		for (i = loop2 - 8; i < 16; ++i) {
4026 			trsw -= 3;
4027 			if (bwi_rf_gain_max_reached(mac, i))
4028 				break;
4029 		}
4030 	} else {
4031 		trsw = 0x18;
4032 	}
4033 
4034 	/*
4035 	 * Restore saved PHY/RF registers
4036 	 */
4037 	/* First 4 saved PHY registers need special processing */
4038 	for (i = 4; i < SAVE_PHY_MAX; ++i)
4039 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
4040 
4041 	bwi_phy_set_bbp_atten(mac, mac->mac_tpctl.bbp_atten);
4042 
4043 	for (i = 0; i < SAVE_RF_MAX; ++i)
4044 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
4045 
4046 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2] | 0x3);
4047 	DELAY(10);
4048 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2]);
4049 	PHY_WRITE(mac, save_phy_regs[3], save_phy[3]);
4050 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
4051 	PHY_WRITE(mac, save_phy_regs[1], save_phy[1]);
4052 
4053 	/*
4054 	 * Calculate gains
4055 	 */
4056 	rf->rf_lo_gain = (loop2 * 6) - (loop1 * 4) - 11;
4057 	rf->rf_rx_gain = trsw * 2;
4058 	DPRINTF(1, "%s: lo gain: %u, rx gain: %u\n",
4059 	    sc->sc_dev.dv_xname, rf->rf_lo_gain, rf->rf_rx_gain);
4060 
4061 #undef SAVE_RF_MAX
4062 #undef SAVE_PHY_MAX
4063 }
4064 
4065 void
4066 bwi_rf_init(struct bwi_mac *mac)
4067 {
4068 	struct bwi_rf *rf = &mac->mac_rf;
4069 
4070 	if (rf->rf_type == BWI_RF_T_BCM2060) {
4071 		/* TODO: 11A */
4072 	} else {
4073 		if (rf->rf_flags & BWI_RF_F_INITED)
4074 			RF_WRITE(mac, 0x78, rf->rf_calib);
4075 		else
4076 			bwi_rf_init_bcm2050(mac);
4077 	}
4078 }
4079 
4080 void
4081 bwi_rf_off_11a(struct bwi_mac *mac)
4082 {
4083 	RF_WRITE(mac, 0x4, 0xff);
4084 	RF_WRITE(mac, 0x5, 0xfb);
4085 
4086 	PHY_SETBITS(mac, 0x10, 0x8);
4087 	PHY_SETBITS(mac, 0x11, 0x8);
4088 
4089 	PHY_WRITE(mac, 0x15, 0xaa00);
4090 }
4091 
4092 void
4093 bwi_rf_off_11bg(struct bwi_mac *mac)
4094 {
4095 	PHY_WRITE(mac, 0x15, 0xaa00);
4096 }
4097 
4098 void
4099 bwi_rf_off_11g_rev5(struct bwi_mac *mac)
4100 {
4101 	PHY_SETBITS(mac, 0x811, 0x8c);
4102 	PHY_CLRBITS(mac, 0x812, 0x8c);
4103 }
4104 
4105 void
4106 bwi_rf_workaround(struct bwi_mac *mac, uint chan)
4107 {
4108 	struct bwi_softc *sc = mac->mac_sc;
4109 	struct bwi_rf *rf = &mac->mac_rf;
4110 
4111 	if (chan == IEEE80211_CHAN_ANY) {
4112 		printf("%s: %s invalid channel!\n",
4113 		    sc->sc_dev.dv_xname, __func__);
4114 		return;
4115 	}
4116 
4117 	if (rf->rf_type != BWI_RF_T_BCM2050 || rf->rf_rev >= 6)
4118 		return;
4119 
4120 	if (chan <= 10)
4121 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan + 4));
4122 	else
4123 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(1));
4124 	DELAY(1000);
4125 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
4126 }
4127 
4128 struct bwi_rf_lo *
4129 bwi_rf_lo_find(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
4130 {
4131 	uint16_t rf_atten, bbp_atten;
4132 	int remap_rf_atten;
4133 
4134 	remap_rf_atten = 1;
4135 	if (tpctl == NULL) {
4136 		bbp_atten = 2;
4137 		rf_atten = 3;
4138 	} else {
4139 		if (tpctl->tp_ctrl1 == 3)
4140 			remap_rf_atten = 0;
4141 
4142 		bbp_atten = tpctl->bbp_atten;
4143 		rf_atten = tpctl->rf_atten;
4144 
4145 		if (bbp_atten > 6)
4146 			bbp_atten = 6;
4147 	}
4148 
4149 	if (remap_rf_atten) {
4150 #define MAP_MAX	10
4151 		static const uint16_t map[MAP_MAX] =
4152 		{ 11, 10, 11, 12, 13, 12, 13, 12, 13, 12 };
4153 #if 0
4154 		KASSERT(rf_atten < MAP_MAX);
4155 		rf_atten = map[rf_atten];
4156 #else
4157 		if (rf_atten >= MAP_MAX) {
4158 			rf_atten = 0;	/* XXX */
4159 		} else {
4160 			rf_atten = map[rf_atten];
4161 		}
4162 #endif
4163 #undef MAP_MAX
4164 	}
4165 
4166 	return (bwi_get_rf_lo(mac, rf_atten, bbp_atten));
4167 }
4168 
4169 void
4170 bwi_rf_lo_adjust(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
4171 {
4172 	const struct bwi_rf_lo *lo;
4173 
4174 	lo = bwi_rf_lo_find(mac, tpctl);
4175 	RF_LO_WRITE(mac, lo);
4176 }
4177 
4178 void
4179 bwi_rf_lo_write(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
4180 {
4181 	uint16_t val;
4182 
4183 	val = (uint8_t)lo->ctrl_lo;
4184 	val |= ((uint8_t)lo->ctrl_hi) << 8;
4185 
4186 	PHY_WRITE(mac, BWI_PHYR_RF_LO, val);
4187 }
4188 
4189 int
4190 bwi_rf_gain_max_reached(struct bwi_mac *mac, int idx)
4191 {
4192 	PHY_FILT_SETBITS(mac, 0x812, 0xf0ff, idx << 8);
4193 	PHY_FILT_SETBITS(mac, 0x15, 0xfff, 0xa000);
4194 	PHY_SETBITS(mac, 0x15, 0xf000);
4195 
4196 	DELAY(20);
4197 
4198 	return ((PHY_READ(mac, 0x2d) >= 0xdfc));
4199 }
4200 
4201 /* XXX use bitmap array */
4202 uint16_t
4203 bwi_bitswap4(uint16_t val)
4204 {
4205 	uint16_t ret;
4206 
4207 	ret = (val & 0x8) >> 3;
4208 	ret |= (val & 0x4) >> 1;
4209 	ret |= (val & 0x2) << 1;
4210 	ret |= (val & 0x1) << 3;
4211 
4212 	return (ret);
4213 }
4214 
4215 uint16_t
4216 bwi_phy812_value(struct bwi_mac *mac, uint16_t lpd)
4217 {
4218 	struct bwi_softc *sc = mac->mac_sc;
4219 	struct bwi_phy *phy = &mac->mac_phy;
4220 	struct bwi_rf *rf = &mac->mac_rf;
4221 	uint16_t lo_gain, ext_lna, loop;
4222 
4223 	if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
4224 		return (0);
4225 
4226 	lo_gain = rf->rf_lo_gain;
4227 	if (rf->rf_rev == 8)
4228 		lo_gain += 0x3e;
4229 	else
4230 		lo_gain += 0x26;
4231 
4232 	if (lo_gain >= 0x46) {
4233 		lo_gain -= 0x46;
4234 		ext_lna = 0x3000;
4235 	} else if (lo_gain >= 0x3a) {
4236 		lo_gain -= 0x3a;
4237 		ext_lna = 0x1000;
4238 	} else if (lo_gain >= 0x2e) {
4239 		lo_gain -= 0x2e;
4240 		ext_lna = 0x2000;
4241 	} else {
4242 		lo_gain -= 0x10;
4243 		ext_lna = 0;
4244 	}
4245 
4246 	for (loop = 0; loop < 16; ++loop) {
4247 		lo_gain -= (6 * loop);
4248 		if (lo_gain < 6)
4249 			break;
4250 	}
4251 
4252 	if (phy->phy_rev >= 7 && (sc->sc_card_flags & BWI_CARD_F_EXT_LNA)) {
4253 		if (ext_lna)
4254 			ext_lna |= 0x8000;
4255 		ext_lna |= (loop << 8);
4256 		switch (lpd) {
4257 		case 0x011:
4258 			return (0x8f92);
4259 		case 0x001:
4260 			return ((0x8092 | ext_lna));
4261 		case 0x101:
4262 			return ((0x2092 | ext_lna));
4263 		case 0x100:
4264 			return ((0x2093 | ext_lna));
4265 		default:
4266 			panic("unsupported lpd");
4267 		}
4268 	} else {
4269 		ext_lna |= (loop << 8);
4270 		switch (lpd) {
4271 		case 0x011:
4272 			return (0xf92);
4273 		case 0x001:
4274 		case 0x101:
4275 			return ((0x92 | ext_lna));
4276 		case 0x100:
4277 			return ((0x93 | ext_lna));
4278 		default:
4279 			panic("unsupported lpd");
4280 		}
4281 	}
4282 
4283 	panic("never reached");
4284 
4285 	return (0);
4286 }
4287 
4288 void
4289 bwi_rf_init_bcm2050(struct bwi_mac *mac)
4290 {
4291 #define SAVE_RF_MAX		3
4292 #define SAVE_PHY_COMM_MAX	4
4293 #define SAVE_PHY_11G_MAX	6
4294 	uint16_t save_rf[SAVE_RF_MAX];
4295 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
4296 	uint16_t save_phy_11g[SAVE_PHY_11G_MAX];
4297 	uint16_t phyr_35, phyr_30 = 0, rfr_78, phyr_80f = 0, phyr_810 = 0;
4298 	uint16_t bphy_ctrl = 0, bbp_atten, rf_chan_ex;
4299 	uint16_t phy812_val;
4300 	uint16_t calib;
4301 	uint32_t test_lim, test;
4302 	struct bwi_softc *sc = mac->mac_sc;
4303 	struct bwi_phy *phy = &mac->mac_phy;
4304 	struct bwi_rf *rf = &mac->mac_rf;
4305 	int i;
4306 
4307 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
4308 	    { 0x0043, 0x0051, 0x0052 };
4309 	static const uint16_t save_phy_regs_comm[SAVE_PHY_COMM_MAX] =
4310 	    { 0x0015, 0x005a, 0x0059, 0x0058 };
4311 	static const uint16_t save_phy_regs_11g[SAVE_PHY_11G_MAX] =
4312 	    { 0x0811, 0x0812, 0x0814, 0x0815, 0x0429, 0x0802 };
4313 
4314 	/*
4315 	 * Save registers for later restoring
4316 	 */
4317 	for (i = 0; i < SAVE_RF_MAX; ++i)
4318 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
4319 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
4320 		save_phy_comm[i] = PHY_READ(mac, save_phy_regs_comm[i]);
4321 
4322 	if (phy->phy_mode == IEEE80211_MODE_11B) {
4323 		phyr_30 = PHY_READ(mac, 0x30);
4324 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
4325 
4326 		PHY_WRITE(mac, 0x30, 0xff);
4327 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x3f3f);
4328 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4329 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
4330 			save_phy_11g[i] =
4331 			    PHY_READ(mac, save_phy_regs_11g[i]);
4332 		}
4333 
4334 		PHY_SETBITS(mac, 0x814, 0x3);
4335 		PHY_CLRBITS(mac, 0x815, 0x3);
4336 		PHY_CLRBITS(mac, 0x429, 0x8000);
4337 		PHY_CLRBITS(mac, 0x802, 0x3);
4338 
4339 		phyr_80f = PHY_READ(mac, 0x80f);
4340 		phyr_810 = PHY_READ(mac, 0x810);
4341 
4342 		if (phy->phy_rev >= 3)
4343 			PHY_WRITE(mac, 0x80f, 0xc020);
4344 		else
4345 			PHY_WRITE(mac, 0x80f, 0x8020);
4346 		PHY_WRITE(mac, 0x810, 0);
4347 
4348 		phy812_val = bwi_phy812_value(mac, 0x011);
4349 		PHY_WRITE(mac, 0x812, phy812_val);
4350 		if (phy->phy_rev < 7 ||
4351 		    (sc->sc_card_flags & BWI_CARD_F_EXT_LNA) == 0)
4352 			PHY_WRITE(mac, 0x811, 0x1b3);
4353 		else
4354 			PHY_WRITE(mac, 0x811, 0x9b3);
4355 	}
4356 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
4357 
4358 	phyr_35 = PHY_READ(mac, 0x35);
4359 	PHY_CLRBITS(mac, 0x35, 0x80);
4360 
4361 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
4362 	rf_chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
4363 
4364 	if (phy->phy_version == 0) {
4365 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
4366 	} else {
4367 		if (phy->phy_version >= 2)
4368 			PHY_FILT_SETBITS(mac, 0x3, 0xffbf, 0x40);
4369 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
4370 	}
4371 
4372 	calib = bwi_rf_calibval(mac);
4373 
4374 	if (phy->phy_mode == IEEE80211_MODE_11B)
4375 		RF_WRITE(mac, 0x78, 0x26);
4376 
4377 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4378 		phy812_val = bwi_phy812_value(mac, 0x011);
4379 		PHY_WRITE(mac, 0x812, phy812_val);
4380 	}
4381 
4382 	PHY_WRITE(mac, 0x15, 0xbfaf);
4383 	PHY_WRITE(mac, 0x2b, 0x1403);
4384 
4385 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4386 		phy812_val = bwi_phy812_value(mac, 0x001);
4387 		PHY_WRITE(mac, 0x812, phy812_val);
4388 	}
4389 
4390 	PHY_WRITE(mac, 0x15, 0xbfa0);
4391 
4392 	RF_SETBITS(mac, 0x51, 0x4);
4393 	if (rf->rf_rev == 8)
4394 		RF_WRITE(mac, 0x43, 0x1f);
4395 	else {
4396 		RF_WRITE(mac, 0x52, 0);
4397 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
4398 	}
4399 
4400 	test_lim = 0;
4401 	PHY_WRITE(mac, 0x58, 0);
4402 	for (i = 0; i < 16; ++i) {
4403 		PHY_WRITE(mac, 0x5a, 0x480);
4404 		PHY_WRITE(mac, 0x59, 0xc810);
4405 
4406 		PHY_WRITE(mac, 0x58, 0xd);
4407 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4408 			phy812_val = bwi_phy812_value(mac, 0x101);
4409 			PHY_WRITE(mac, 0x812, phy812_val);
4410 		}
4411 		PHY_WRITE(mac, 0x15, 0xafb0);
4412 		DELAY(10);
4413 
4414 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4415 			phy812_val = bwi_phy812_value(mac, 0x101);
4416 			PHY_WRITE(mac, 0x812, phy812_val);
4417 		}
4418 		PHY_WRITE(mac, 0x15, 0xefb0);
4419 		DELAY(10);
4420 
4421 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4422 			phy812_val = bwi_phy812_value(mac, 0x100);
4423 			PHY_WRITE(mac, 0x812, phy812_val);
4424 		}
4425 		PHY_WRITE(mac, 0x15, 0xfff0);
4426 		DELAY(20);
4427 
4428 		test_lim += PHY_READ(mac, 0x2d);
4429 
4430 		PHY_WRITE(mac, 0x58, 0);
4431 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4432 			phy812_val = bwi_phy812_value(mac, 0x101);
4433 			PHY_WRITE(mac, 0x812, phy812_val);
4434 		}
4435 		PHY_WRITE(mac, 0x15, 0xafb0);
4436 	}
4437 	++test_lim;
4438 	test_lim >>= 9;
4439 
4440 	DELAY(10);
4441 
4442 	test = 0;
4443 	PHY_WRITE(mac, 0x58, 0);
4444 	for (i = 0; i < 16; ++i) {
4445 		int j;
4446 
4447 		rfr_78 = (bwi_bitswap4(i) << 1) | 0x20;
4448 		RF_WRITE(mac, 0x78, rfr_78);
4449 		DELAY(10);
4450 
4451 		/* NB: This block is slight different than the above one */
4452 		for (j = 0; j < 16; ++j) {
4453 			PHY_WRITE(mac, 0x5a, 0xd80);
4454 			PHY_WRITE(mac, 0x59, 0xc810);
4455 
4456 			PHY_WRITE(mac, 0x58, 0xd);
4457 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4458 			    phy->phy_rev >= 2) {
4459 				phy812_val = bwi_phy812_value(mac, 0x101);
4460 				PHY_WRITE(mac, 0x812, phy812_val);
4461 			}
4462 			PHY_WRITE(mac, 0x15, 0xafb0);
4463 			DELAY(10);
4464 
4465 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4466 			    phy->phy_rev >= 2) {
4467 				phy812_val = bwi_phy812_value(mac, 0x101);
4468 				PHY_WRITE(mac, 0x812, phy812_val);
4469 			}
4470 			PHY_WRITE(mac, 0x15, 0xefb0);
4471 			DELAY(10);
4472 
4473 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4474 			    phy->phy_rev >= 2) {
4475 				phy812_val = bwi_phy812_value(mac, 0x100);
4476 				PHY_WRITE(mac, 0x812, phy812_val);
4477 			}
4478 			PHY_WRITE(mac, 0x15, 0xfff0);
4479 			DELAY(10);
4480 
4481 			test += PHY_READ(mac, 0x2d);
4482 
4483 			PHY_WRITE(mac, 0x58, 0);
4484 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
4485 			    phy->phy_rev >= 2) {
4486 				phy812_val = bwi_phy812_value(mac, 0x101);
4487 				PHY_WRITE(mac, 0x812, phy812_val);
4488 			}
4489 			PHY_WRITE(mac, 0x15, 0xafb0);
4490 		}
4491 
4492 		++test;
4493 		test >>= 8;
4494 
4495 		if (test > test_lim)
4496 			break;
4497 	}
4498 	if (i > 15)
4499 		rf->rf_calib = rfr_78;
4500 	else
4501 		rf->rf_calib = calib;
4502 	if (rf->rf_calib != 0xffff) {
4503 		DPRINTF(1, "%s: RF calibration value: 0x%04x\n",
4504 		    sc->sc_dev.dv_xname, rf->rf_calib);
4505 		rf->rf_flags |= BWI_RF_F_INITED;
4506 	}
4507 
4508 	/*
4509 	 * Restore trashes registers
4510 	 */
4511 	PHY_WRITE(mac, save_phy_regs_comm[0], save_phy_comm[0]);
4512 
4513 	for (i = 0; i < SAVE_RF_MAX; ++i) {
4514 		int pos = (i + 1) % SAVE_RF_MAX;
4515 
4516 		RF_WRITE(mac, save_rf_regs[pos], save_rf[pos]);
4517 	}
4518 	for (i = 1; i < SAVE_PHY_COMM_MAX; ++i)
4519 		PHY_WRITE(mac, save_phy_regs_comm[i], save_phy_comm[i]);
4520 
4521 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
4522 	if (phy->phy_version != 0)
4523 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, rf_chan_ex);
4524 
4525 	PHY_WRITE(mac, 0x35, phyr_35);
4526 	bwi_rf_workaround(mac, rf->rf_curchan);
4527 
4528 	if (phy->phy_mode == IEEE80211_MODE_11B) {
4529 		PHY_WRITE(mac, 0x30, phyr_30);
4530 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
4531 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
4532 		/* XXX Spec only says when PHY is linked (gmode) */
4533 		CSR_CLRBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
4534 
4535 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
4536 			PHY_WRITE(mac, save_phy_regs_11g[i],
4537 				  save_phy_11g[i]);
4538 		}
4539 
4540 		PHY_WRITE(mac, 0x80f, phyr_80f);
4541 		PHY_WRITE(mac, 0x810, phyr_810);
4542 	}
4543 
4544 #undef SAVE_PHY_11G_MAX
4545 #undef SAVE_PHY_COMM_MAX
4546 #undef SAVE_RF_MAX
4547 }
4548 
4549 uint16_t
4550 bwi_rf_calibval(struct bwi_mac *mac)
4551 {
4552 	uint16_t val, calib;
4553 	int idx;
4554 
4555 	/* http://bcm-specs.sipsolutions.net/RCCTable */
4556 	static const uint16_t rf_calibvals[] = {
4557 		0x2, 0x3, 0x1, 0xf, 0x6, 0x7, 0x5, 0xf,
4558 		0xa, 0xb, 0x9, 0xf, 0xe, 0xf, 0xd, 0xf
4559 	};
4560 
4561 	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
4562 	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
4563 	KASSERT(idx < (int)(sizeof(rf_calibvals) / sizeof(rf_calibvals[0])));
4564 
4565 	calib = rf_calibvals[idx] << 1;
4566 	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
4567 		calib |= 0x1;
4568 	calib |= 0x20;
4569 
4570 	return (calib);
4571 }
4572 
4573 int32_t
4574 _bwi_adjust_devide(int32_t num, int32_t den)
4575 {
4576 	if (num < 0)
4577 		return ((num / den));
4578 	else
4579 		return ((num + den / 2) / den);
4580 }
4581 
4582 /*
4583  * http://bcm-specs.sipsolutions.net/TSSI_to_DBM_Table
4584  * "calculating table entries"
4585  */
4586 int
4587 bwi_rf_calc_txpower(int8_t *txpwr, uint8_t idx, const int16_t pa_params[])
4588 {
4589 	int32_t m1, m2, f, dbm;
4590 	int i;
4591 
4592 	m1 = _bwi_adjust_devide(16 * pa_params[0] + idx * pa_params[1], 32);
4593 	m2 = imax(_bwi_adjust_devide(32768 + idx * pa_params[2], 256), 1);
4594 
4595 #define ITER_MAX	16
4596 	f = 256;
4597 	for (i = 0; i < ITER_MAX; ++i) {
4598 		int32_t q, d;
4599 
4600 		q = _bwi_adjust_devide(
4601 		    f * 4096 - _bwi_adjust_devide(m2 * f, 16) * f, 2048);
4602 		d = abs(q - f);
4603 		f = q;
4604 
4605 		if (d < 2)
4606 			break;
4607 	}
4608 	if (i == ITER_MAX)
4609 		return (EINVAL);
4610 #undef ITER_MAX
4611 
4612 	dbm = _bwi_adjust_devide(m1 * f, 8192);
4613 	if (dbm < -127)
4614 		dbm = -127;
4615 	else if (dbm > 128)
4616 		dbm = 128;
4617 
4618 	*txpwr = dbm;
4619 
4620 	return (0);
4621 }
4622 
4623 int
4624 bwi_rf_map_txpower(struct bwi_mac *mac)
4625 {
4626 	struct bwi_softc *sc = mac->mac_sc;
4627 	struct bwi_rf *rf = &mac->mac_rf;
4628 	struct bwi_phy *phy = &mac->mac_phy;
4629 	uint16_t sprom_ofs, val, mask;
4630 	int16_t pa_params[3];
4631 	int error = 0, i, ant_gain, reg_txpower_max;
4632 
4633 	/*
4634 	 * Find out max TX power
4635 	 */
4636 	val = bwi_read_sprom(sc, BWI_SPROM_MAX_TXPWR);
4637 	if (phy->phy_mode == IEEE80211_MODE_11A) {
4638 		rf->rf_txpower_max = __SHIFTOUT(val,
4639 		    BWI_SPROM_MAX_TXPWR_MASK_11A);
4640 	} else {
4641 		rf->rf_txpower_max = __SHIFTOUT(val,
4642 		    BWI_SPROM_MAX_TXPWR_MASK_11BG);
4643 
4644 		if ((sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) &&
4645 		    phy->phy_mode == IEEE80211_MODE_11G)
4646 			rf->rf_txpower_max -= 3;
4647 	}
4648 	if (rf->rf_txpower_max <= 0) {
4649 		printf("%s: invalid max txpower in sprom\n",
4650 		    sc->sc_dev.dv_xname);
4651 		rf->rf_txpower_max = 74;
4652 	}
4653 	DPRINTF(1, "%s: max txpower from sprom: %d dBm\n",
4654 	    sc->sc_dev.dv_xname, rf->rf_txpower_max);
4655 
4656 	/*
4657 	 * Find out region/domain max TX power, which is adjusted
4658 	 * by antenna gain and 1.5 dBm fluctuation as mentioned
4659 	 * in v3 spec.
4660 	 */
4661 	val = bwi_read_sprom(sc, BWI_SPROM_ANT_GAIN);
4662 	if (phy->phy_mode == IEEE80211_MODE_11A)
4663 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11A);
4664 	else
4665 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11BG);
4666 	if (ant_gain == 0xff) {
4667 		/* XXX why this always invalid? */
4668 		DPRINTF(1, "%s: invalid antenna gain in sprom\n",
4669 		    sc->sc_dev.dv_xname);
4670 		ant_gain = 2;
4671 	}
4672 	ant_gain *= 4;
4673 	DPRINTF(1, "%s: ant gain %d dBm\n", sc->sc_dev.dv_xname, ant_gain);
4674 
4675 	reg_txpower_max = 90 - ant_gain - 6;	/* XXX magic number */
4676 	DPRINTF(1, "%s: region/domain max txpower %d dBm\n",
4677 	    sc->sc_dev.dv_xname, reg_txpower_max);
4678 
4679 	/*
4680 	 * Force max TX power within region/domain TX power limit
4681 	 */
4682 	if (rf->rf_txpower_max > reg_txpower_max)
4683 		rf->rf_txpower_max = reg_txpower_max;
4684 	DPRINTF(1, "%s: max txpower %d dBm\n",
4685 	    sc->sc_dev.dv_xname, rf->rf_txpower_max);
4686 
4687 	/*
4688 	 * Create TSSI to TX power mapping
4689 	 */
4690 
4691 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301 &&
4692 	    rf->rf_type != BWI_RF_T_BCM2050) {
4693 		rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
4694 		bcopy(bwi_txpower_map_11b, rf->rf_txpower_map0,
4695 		      sizeof(rf->rf_txpower_map0));
4696 		goto back;
4697 	}
4698 
4699 #define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
4700 	/*
4701 	 * Extract PA parameters
4702 	 */
4703 	if (phy->phy_mode == IEEE80211_MODE_11A)
4704 		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
4705 	else
4706 		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
4707 	for (i = 0; i < nitems(pa_params); ++i)
4708 		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
4709 
4710 	for (i = 0; i < nitems(pa_params); ++i) {
4711 		/*
4712 		 * If one of the PA parameters from SPROM is not valid,
4713 		 * fall back to the default values, if there are any.
4714 		 */
4715 		if (!IS_VALID_PA_PARAM(pa_params[i])) {
4716 			const int8_t *txpower_map;
4717 
4718 			if (phy->phy_mode == IEEE80211_MODE_11A) {
4719 				printf("%s: no tssi2dbm table for 11a PHY\n",
4720 				    sc->sc_dev.dv_xname);
4721 				return (ENXIO);
4722 			}
4723 
4724 			if (phy->phy_mode == IEEE80211_MODE_11G) {
4725 				DPRINTF(1, "%s: use default 11g TSSI map\n",
4726 				    sc->sc_dev.dv_xname);
4727 				txpower_map = bwi_txpower_map_11g;
4728 			} else {
4729 				txpower_map = bwi_txpower_map_11b;
4730 			}
4731 
4732 			rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
4733 			bcopy(txpower_map, rf->rf_txpower_map0,
4734 			      sizeof(rf->rf_txpower_map0));
4735 			goto back;
4736 		}
4737 	}
4738 
4739 	/*
4740 	 * All of the PA parameters from SPROM are valid.
4741 	 */
4742 
4743 	/*
4744 	 * Extract idle TSSI from SPROM.
4745 	 */
4746 	val = bwi_read_sprom(sc, BWI_SPROM_IDLE_TSSI);
4747 	DPRINTF(1, "%s: sprom idle tssi: 0x%04x\n", sc->sc_dev.dv_xname, val);
4748 
4749 	if (phy->phy_mode == IEEE80211_MODE_11A)
4750 		mask = BWI_SPROM_IDLE_TSSI_MASK_11A;
4751 	else
4752 		mask = BWI_SPROM_IDLE_TSSI_MASK_11BG;
4753 
4754 	rf->rf_idle_tssi0 = (int)__SHIFTOUT(val, mask);
4755 	if (!IS_VALID_PA_PARAM(rf->rf_idle_tssi0))
4756 		rf->rf_idle_tssi0 = 62;
4757 
4758 #undef IS_VALID_PA_PARAM
4759 
4760 	/*
4761 	 * Calculate TX power map, which is indexed by TSSI
4762 	 */
4763 	DPRINTF(1, "%s: TSSI-TX power map:\n", sc->sc_dev.dv_xname);
4764 	for (i = 0; i < BWI_TSSI_MAX; ++i) {
4765 		error = bwi_rf_calc_txpower(&rf->rf_txpower_map0[i], i,
4766 					    pa_params);
4767 		if (error) {
4768 			printf("%s: bwi_rf_calc_txpower failed\n",
4769 			    sc->sc_dev.dv_xname);
4770 			break;
4771 		}
4772 		if (i != 0 && i % 8 == 0)
4773 			DPRINTF(1, "\n");
4774 		DPRINTF(1, "%d ", rf->rf_txpower_map0[i]);
4775 	}
4776 	DPRINTF(1, "\n");
4777 back:
4778 	DPRINTF(1, "%s: idle tssi0: %d\n",
4779 	    sc->sc_dev.dv_xname, rf->rf_idle_tssi0);
4780 
4781 	return (error);
4782 }
4783 
4784 void
4785 bwi_rf_lo_update_11g(struct bwi_mac *mac)
4786 {
4787 	struct bwi_softc *sc = mac->mac_sc;
4788 	struct ifnet *ifp = &sc->sc_ic.ic_if;
4789 	struct bwi_rf *rf = &mac->mac_rf;
4790 	struct bwi_phy *phy = &mac->mac_phy;
4791 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
4792 	struct rf_saveregs regs;
4793 	uint16_t ant_div, chan_ex;
4794 	uint8_t devi_ctrl;
4795 	uint orig_chan;
4796 
4797 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
4798 
4799 	/*
4800 	 * Save RF/PHY registers for later restoration
4801 	 */
4802 	orig_chan = rf->rf_curchan;
4803 	bzero(&regs, sizeof(regs));
4804 
4805 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4806 		SAVE_PHY_REG(mac, &regs, 429);
4807 		SAVE_PHY_REG(mac, &regs, 802);
4808 
4809 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
4810 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
4811 	}
4812 
4813 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
4814 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div | 0x8000);
4815 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
4816 
4817 	SAVE_PHY_REG(mac, &regs, 15);
4818 	SAVE_PHY_REG(mac, &regs, 2a);
4819 	SAVE_PHY_REG(mac, &regs, 35);
4820 	SAVE_PHY_REG(mac, &regs, 60);
4821 	SAVE_RF_REG(mac, &regs, 43);
4822 	SAVE_RF_REG(mac, &regs, 7a);
4823 	SAVE_RF_REG(mac, &regs, 52);
4824 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4825 		SAVE_PHY_REG(mac, &regs, 811);
4826 		SAVE_PHY_REG(mac, &regs, 812);
4827 		SAVE_PHY_REG(mac, &regs, 814);
4828 		SAVE_PHY_REG(mac, &regs, 815);
4829 	}
4830 
4831 	/* Force to channel 6 */
4832 	bwi_rf_set_chan(mac, 6, 0);
4833 
4834 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4835 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
4836 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
4837 		bwi_mac_dummy_xmit(mac);
4838 	}
4839 	RF_WRITE(mac, 0x43, 0x6);
4840 
4841 	bwi_phy_set_bbp_atten(mac, 2);
4842 
4843 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0);
4844 
4845 	PHY_WRITE(mac, 0x2e, 0x7f);
4846 	PHY_WRITE(mac, 0x80f, 0x78);
4847 	PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
4848 	RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
4849 	PHY_WRITE(mac, 0x2b, 0x203);
4850 	PHY_WRITE(mac, 0x2a, 0x8a3);
4851 
4852 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4853 		PHY_WRITE(mac, 0x814, regs.phy_814 | 0x3);
4854 		PHY_WRITE(mac, 0x815, regs.phy_815 & 0xfffc);
4855 		PHY_WRITE(mac, 0x811, 0x1b3);
4856 		PHY_WRITE(mac, 0x812, 0xb2);
4857 	}
4858 
4859 	if ((ifp->if_flags & IFF_RUNNING) == 0)
4860 		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
4861 	PHY_WRITE(mac, 0x80f, 0x8078);
4862 
4863 	/*
4864 	 * Measure all RF LO
4865 	 */
4866 	devi_ctrl = _bwi_rf_lo_update_11g(mac, regs.rf_7a);
4867 
4868 	/*
4869 	 * Restore saved RF/PHY registers
4870 	 */
4871 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4872 		PHY_WRITE(mac, 0x15, 0xe300);
4873 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa0);
4874 		DELAY(5);
4875 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa2);
4876 		DELAY(2);
4877 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa3);
4878 	} else
4879 		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
4880 
4881 	if ((ifp->if_flags & IFF_RUNNING) == 0)
4882 		tpctl = NULL;
4883 	bwi_rf_lo_adjust(mac, tpctl);
4884 
4885 	PHY_WRITE(mac, 0x2e, 0x807f);
4886 	if (phy->phy_flags & BWI_PHY_F_LINKED)
4887 		PHY_WRITE(mac, 0x2f, 0x202);
4888 	else
4889 		PHY_WRITE(mac, 0x2f, 0x101);
4890 
4891 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
4892 
4893 	RESTORE_PHY_REG(mac, &regs, 15);
4894 	RESTORE_PHY_REG(mac, &regs, 2a);
4895 	RESTORE_PHY_REG(mac, &regs, 35);
4896 	RESTORE_PHY_REG(mac, &regs, 60);
4897 
4898 	RESTORE_RF_REG(mac, &regs, 43);
4899 	RESTORE_RF_REG(mac, &regs, 7a);
4900 
4901 	regs.rf_52 &= 0xf0;
4902 	regs.rf_52 |= (RF_READ(mac, 0x52) & 0xf);
4903 	RF_WRITE(mac, 0x52, regs.rf_52);
4904 
4905 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
4906 
4907 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
4908 		RESTORE_PHY_REG(mac, &regs, 811);
4909 		RESTORE_PHY_REG(mac, &regs, 812);
4910 		RESTORE_PHY_REG(mac, &regs, 814);
4911 		RESTORE_PHY_REG(mac, &regs, 815);
4912 		RESTORE_PHY_REG(mac, &regs, 429);
4913 		RESTORE_PHY_REG(mac, &regs, 802);
4914 	}
4915 
4916 	bwi_rf_set_chan(mac, orig_chan, 1);
4917 }
4918 
4919 uint32_t
4920 bwi_rf_lo_devi_measure(struct bwi_mac *mac, uint16_t ctrl)
4921 {
4922 	struct bwi_phy *phy = &mac->mac_phy;
4923 	uint32_t devi = 0;
4924 	int i;
4925 
4926 	if (phy->phy_flags & BWI_PHY_F_LINKED)
4927 		ctrl <<= 8;
4928 
4929 	for (i = 0; i < 8; ++i) {
4930 		if (phy->phy_flags & BWI_PHY_F_LINKED) {
4931 			PHY_WRITE(mac, 0x15, 0xe300);
4932 			PHY_WRITE(mac, 0x812, ctrl | 0xb0);
4933 			DELAY(5);
4934 			PHY_WRITE(mac, 0x812, ctrl | 0xb2);
4935 			DELAY(2);
4936 			PHY_WRITE(mac, 0x812, ctrl | 0xb3);
4937 			DELAY(4);
4938 			PHY_WRITE(mac, 0x15, 0xf300);
4939 		} else {
4940 			PHY_WRITE(mac, 0x15, ctrl | 0xefa0);
4941 			DELAY(2);
4942 			PHY_WRITE(mac, 0x15, ctrl | 0xefe0);
4943 			DELAY(4);
4944 			PHY_WRITE(mac, 0x15, ctrl | 0xffe0);
4945 		}
4946 		DELAY(8);
4947 		devi += PHY_READ(mac, 0x2d);
4948 	}
4949 
4950 	return (devi);
4951 }
4952 
4953 uint16_t
4954 bwi_rf_get_tp_ctrl2(struct bwi_mac *mac)
4955 {
4956 	uint32_t devi_min;
4957 	uint16_t tp_ctrl2 = 0;
4958 	int i;
4959 
4960 	RF_WRITE(mac, 0x52, 0);
4961 	DELAY(10);
4962 	devi_min = bwi_rf_lo_devi_measure(mac, 0);
4963 
4964 	for (i = 0; i < 16; ++i) {
4965 		uint32_t devi;
4966 
4967 		RF_WRITE(mac, 0x52, i);
4968 		DELAY(10);
4969 		devi = bwi_rf_lo_devi_measure(mac, 0);
4970 
4971 		if (devi < devi_min) {
4972 			devi_min = devi;
4973 			tp_ctrl2 = i;
4974 		}
4975 	}
4976 
4977 	return (tp_ctrl2);
4978 }
4979 
4980 uint8_t
4981 _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
4982 {
4983 #define RF_ATTEN_LISTSZ	14
4984 #define BBP_ATTEN_MAX	4	/* half */
4985 	struct ifnet *ifp = &mac->mac_sc->sc_ic.ic_if;
4986 	struct bwi_rf_lo lo_save, *lo;
4987 	uint8_t devi_ctrl = 0;
4988 	int idx, adj_rf7a = 0;
4989 
4990 	static const int rf_atten_list[RF_ATTEN_LISTSZ] =
4991 	    { 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 1, 2, 3, 4 };
4992 	static const int rf_atten_init_list[RF_ATTEN_LISTSZ] =
4993             { 0, 3, 1, 5, 7, 3, 2, 0, 4, 6, -1, -1, -1, -1 };
4994 	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
4995 	    { 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
4996 
4997 	bzero(&lo_save, sizeof(lo_save));
4998 	for (idx = 0; idx < RF_ATTEN_LISTSZ; ++idx) {
4999 		int init_rf_atten = rf_atten_init_list[idx];
5000 		int rf_atten = rf_atten_list[idx];
5001 		int bbp_atten;
5002 
5003 		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
5004 			uint16_t tp_ctrl2, rf7a;
5005 
5006 			if ((ifp->if_flags & IFF_RUNNING) == 0) {
5007 				if (idx == 0) {
5008 					bzero(&lo_save, sizeof(lo_save));
5009 				} else if (init_rf_atten < 0) {
5010 					lo = bwi_get_rf_lo(mac,
5011 					    rf_atten, 2 * bbp_atten);
5012 					bcopy(lo, &lo_save, sizeof(lo_save));
5013 				} else {
5014 					lo = bwi_get_rf_lo(mac,
5015 					    init_rf_atten, 0);
5016 					bcopy(lo, &lo_save, sizeof(lo_save));
5017 				}
5018 
5019 				devi_ctrl = 0;
5020 				adj_rf7a = 0;
5021 
5022 				/*
5023 				 * XXX
5024 				 * Linux driver overflows 'val'
5025 				 */
5026 				if (init_rf_atten >= 0) {
5027 					int val;
5028 
5029 					val = rf_atten * 2 + bbp_atten;
5030 					if (val > 14) {
5031 						adj_rf7a = 1;
5032 						if (val > 17)
5033 							devi_ctrl = 1;
5034 						if (val > 19)
5035 							devi_ctrl = 2;
5036 					}
5037 				}
5038 			} else {
5039 				lo = bwi_get_rf_lo(mac,
5040 					rf_atten, 2 * bbp_atten);
5041 				if (!bwi_rf_lo_isused(mac, lo))
5042 					continue;
5043 				bcopy(lo, &lo_save, sizeof(lo_save));
5044 
5045 				devi_ctrl = 3;
5046 				adj_rf7a = 0;
5047 			}
5048 
5049 			RF_WRITE(mac, BWI_RFR_ATTEN, rf_atten);
5050 
5051 			tp_ctrl2 = mac->mac_tpctl.tp_ctrl2;
5052 			if (init_rf_atten < 0)
5053 				tp_ctrl2 |= (3 << 4);
5054 			RF_WRITE(mac, BWI_RFR_TXPWR, tp_ctrl2);
5055 
5056 			DELAY(10);
5057 
5058 			bwi_phy_set_bbp_atten(mac, bbp_atten * 2);
5059 
5060 			rf7a = orig_rf7a & 0xfff0;
5061 			if (adj_rf7a)
5062 				rf7a |= 0x8;
5063 			RF_WRITE(mac, 0x7a, rf7a);
5064 
5065 			lo = bwi_get_rf_lo(mac,
5066 				rf_lo_measure_order[idx], bbp_atten * 2);
5067 			bwi_rf_lo_measure_11g(mac, &lo_save, lo, devi_ctrl);
5068 		}
5069 	}
5070 
5071 	return (devi_ctrl);
5072 
5073 #undef RF_ATTEN_LISTSZ
5074 #undef BBP_ATTEN_MAX
5075 }
5076 
5077 void
5078 bwi_rf_lo_measure_11g(struct bwi_mac *mac, const struct bwi_rf_lo *src_lo,
5079     struct bwi_rf_lo *dst_lo, uint8_t devi_ctrl)
5080 {
5081 #define LO_ADJUST_MIN	1
5082 #define LO_ADJUST_MAX	8
5083 #define LO_ADJUST(hi, lo)	{ .ctrl_hi = hi, .ctrl_lo = lo }
5084 	static const struct bwi_rf_lo rf_lo_adjust[LO_ADJUST_MAX] = {
5085 		LO_ADJUST(1,	1),
5086 		LO_ADJUST(1,	0),
5087 		LO_ADJUST(1,	-1),
5088 		LO_ADJUST(0,	-1),
5089 		LO_ADJUST(-1,	-1),
5090 		LO_ADJUST(-1,	0),
5091 		LO_ADJUST(-1,	1),
5092 		LO_ADJUST(0,	1)
5093 	};
5094 #undef LO_ADJUST
5095 
5096 	struct bwi_rf_lo lo_min;
5097 	uint32_t devi_min;
5098 	int found, loop_count, adjust_state;
5099 
5100 	bcopy(src_lo, &lo_min, sizeof(lo_min));
5101 	RF_LO_WRITE(mac, &lo_min);
5102 	devi_min = bwi_rf_lo_devi_measure(mac, devi_ctrl);
5103 
5104 	loop_count = 12;	/* XXX */
5105 	adjust_state = 0;
5106 	do {
5107 		struct bwi_rf_lo lo_base;
5108 		int i, fin;
5109 
5110 		found = 0;
5111 		if (adjust_state == 0) {
5112 			i = LO_ADJUST_MIN;
5113 			fin = LO_ADJUST_MAX;
5114 		} else if (adjust_state % 2 == 0) {
5115 			i = adjust_state - 1;
5116 			fin = adjust_state + 1;
5117 		} else {
5118 			i = adjust_state - 2;
5119 			fin = adjust_state + 2;
5120 		}
5121 
5122 		if (i < LO_ADJUST_MIN)
5123 			i += LO_ADJUST_MAX;
5124 		KASSERT(i <= LO_ADJUST_MAX && i >= LO_ADJUST_MIN);
5125 
5126 		if (fin > LO_ADJUST_MAX)
5127 			fin -= LO_ADJUST_MAX;
5128 		KASSERT(fin <= LO_ADJUST_MAX && fin >= LO_ADJUST_MIN);
5129 
5130 		bcopy(&lo_min, &lo_base, sizeof(lo_base));
5131 		for (;;) {
5132 			struct bwi_rf_lo lo;
5133 
5134 			lo.ctrl_hi = lo_base.ctrl_hi +
5135 				rf_lo_adjust[i - 1].ctrl_hi;
5136 			lo.ctrl_lo = lo_base.ctrl_lo +
5137 				rf_lo_adjust[i - 1].ctrl_lo;
5138 
5139 			if (abs(lo.ctrl_lo) < 9 && abs(lo.ctrl_hi) < 9) {
5140 				uint32_t devi;
5141 
5142 				RF_LO_WRITE(mac, &lo);
5143 				devi = bwi_rf_lo_devi_measure(mac, devi_ctrl);
5144 				if (devi < devi_min) {
5145 					devi_min = devi;
5146 					adjust_state = i;
5147 					found = 1;
5148 					bcopy(&lo, &lo_min, sizeof(lo_min));
5149 				}
5150 			}
5151 			if (i == fin)
5152 				break;
5153 			if (i == LO_ADJUST_MAX)
5154 				i = LO_ADJUST_MIN;
5155 			else
5156 				++i;
5157 		}
5158 	} while (loop_count-- && found);
5159 
5160 	bcopy(&lo_min, dst_lo, sizeof(*dst_lo));
5161 
5162 #undef LO_ADJUST_MIN
5163 #undef LO_ADJUST_MAX
5164 }
5165 
5166 void
5167 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *mac)
5168 {
5169 #define SAVE_RF_MAX	3
5170 #define SAVE_PHY_MAX	8
5171 	struct bwi_softc *sc = mac->mac_sc;
5172 	struct bwi_rf *rf = &mac->mac_rf;
5173 	struct bwi_phy *phy = &mac->mac_phy;
5174 	uint16_t save_rf[SAVE_RF_MAX];
5175 	uint16_t save_phy[SAVE_PHY_MAX];
5176 	uint16_t ant_div, bbp_atten, chan_ex;
5177 	int16_t nrssi[2];
5178 	int i;
5179 
5180 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
5181 	    { 0x7a, 0x52, 0x43 };
5182 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] =
5183 	    { 0x30, 0x26, 0x15, 0x2a, 0x20, 0x5a, 0x59, 0x58 };
5184 
5185 	/*
5186 	 * Save RF/PHY registers for later restoration
5187 	 */
5188 	for (i = 0; i < SAVE_RF_MAX; ++i)
5189 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5190 	for (i = 0; i < SAVE_PHY_MAX; ++i)
5191 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
5192 
5193 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
5194 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
5195 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
5196 
5197 	/*
5198 	 * Calculate nrssi0
5199 	 */
5200 	if (phy->phy_rev >= 5)
5201 		RF_CLRBITS(mac, 0x7a, 0xff80);
5202 	else
5203 		RF_CLRBITS(mac, 0x7a, 0xfff0);
5204 	PHY_WRITE(mac, 0x30, 0xff);
5205 
5206 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x7f7f);
5207 
5208 	PHY_WRITE(mac, 0x26, 0);
5209 	PHY_SETBITS(mac, 0x15, 0x20);
5210 	PHY_WRITE(mac, 0x2a, 0x8a3);
5211 	RF_SETBITS(mac, 0x7a, 0x80);
5212 
5213 	nrssi[0] = (int16_t)PHY_READ(mac, 0x27);
5214 
5215 	/*
5216 	 * Calculate nrssi1
5217 	 */
5218 	RF_CLRBITS(mac, 0x7a, 0xff80);
5219 	if (phy->phy_version >= 2)
5220 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x40);
5221 	else if (phy->phy_version == 0)
5222 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
5223 	else
5224 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0xdfff);
5225 
5226 	PHY_WRITE(mac, 0x20, 0x3f3f);
5227 	PHY_WRITE(mac, 0x15, 0xf330);
5228 
5229 	RF_WRITE(mac, 0x5a, 0x60);
5230 	RF_CLRBITS(mac, 0x43, 0xff0f);
5231 
5232 	PHY_WRITE(mac, 0x5a, 0x480);
5233 	PHY_WRITE(mac, 0x59, 0x810);
5234 	PHY_WRITE(mac, 0x58, 0xd);
5235 
5236 	DELAY(20);
5237 
5238 	nrssi[1] = (int16_t)PHY_READ(mac, 0x27);
5239 
5240 	/*
5241 	 * Restore saved RF/PHY registers
5242 	 */
5243 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
5244 	RF_WRITE(mac, save_rf_regs[0], save_rf[0]);
5245 
5246 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
5247 
5248 	for (i = 1; i < 4; ++i)
5249 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
5250 
5251 	bwi_rf_workaround(mac, rf->rf_curchan);
5252 
5253 	if (phy->phy_version != 0)
5254 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
5255 
5256 	for (; i < SAVE_PHY_MAX; ++i)
5257 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
5258 
5259 	for (i = 1; i < SAVE_RF_MAX; ++i)
5260 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5261 
5262 	/*
5263 	 * Install calculated narrow RSSI values
5264 	 */
5265 	if (nrssi[0] == nrssi[1])
5266 		rf->rf_nrssi_slope = 0x10000;
5267 	else
5268 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
5269 	if (nrssi[0] <= -4) {
5270 		rf->rf_nrssi[0] = nrssi[0];
5271 		rf->rf_nrssi[1] = nrssi[1];
5272 	}
5273 
5274 #undef SAVE_RF_MAX
5275 #undef SAVE_PHY_MAX
5276 }
5277 
5278 void
5279 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *mac)
5280 {
5281 #define SAVE_RF_MAX		2
5282 #define SAVE_PHY_COMM_MAX	10
5283 #define SAVE_PHY6_MAX		8
5284 	struct bwi_phy *phy = &mac->mac_phy;
5285 	uint16_t save_rf[SAVE_RF_MAX];
5286 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
5287 	uint16_t save_phy6[SAVE_PHY6_MAX];
5288 	uint16_t rf7b = 0xffff;
5289 	int16_t nrssi;
5290 	int i, phy6_idx = 0;
5291 
5292 	static const uint16_t save_rf_regs[SAVE_RF_MAX] = { 0x7a, 0x43 };
5293 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
5294 		0x0001, 0x0811, 0x0812, 0x0814,
5295 		0x0815, 0x005a, 0x0059, 0x0058,
5296 		0x000a, 0x0003
5297 	};
5298 	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
5299 		0x002e, 0x002f, 0x080f, 0x0810,
5300 		0x0801, 0x0060, 0x0014, 0x0478
5301 	};
5302 
5303 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5304 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
5305 	for (i = 0; i < SAVE_RF_MAX; ++i)
5306 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5307 
5308 	PHY_CLRBITS(mac, 0x429, 0x8000);
5309 	PHY_FILT_SETBITS(mac, 0x1, 0x3fff, 0x4000);
5310 	PHY_SETBITS(mac, 0x811, 0xc);
5311 	PHY_FILT_SETBITS(mac, 0x812, 0xfff3, 0x4);
5312 	PHY_CLRBITS(mac, 0x802, 0x3);
5313 
5314 	if (phy->phy_rev >= 6) {
5315 		for (i = 0; i < SAVE_PHY6_MAX; ++i)
5316 			save_phy6[i] = PHY_READ(mac, save_phy6_regs[i]);
5317 
5318 		PHY_WRITE(mac, 0x2e, 0);
5319 		PHY_WRITE(mac, 0x2f, 0);
5320 		PHY_WRITE(mac, 0x80f, 0);
5321 		PHY_WRITE(mac, 0x810, 0);
5322 		PHY_SETBITS(mac, 0x478, 0x100);
5323 		PHY_SETBITS(mac, 0x801, 0x40);
5324 		PHY_SETBITS(mac, 0x60, 0x40);
5325 		PHY_SETBITS(mac, 0x14, 0x200);
5326 	}
5327 
5328 	RF_SETBITS(mac, 0x7a, 0x70);
5329 	RF_SETBITS(mac, 0x7a, 0x80);
5330 
5331 	DELAY(30);
5332 
5333 	nrssi = bwi_nrssi_11g(mac);
5334 	if (nrssi == 31) {
5335 		for (i = 7; i >= 4; --i) {
5336 			RF_WRITE(mac, 0x7b, i);
5337 			DELAY(20);
5338 			nrssi = bwi_nrssi_11g(mac);
5339 			if (nrssi < 31 && rf7b == 0xffff)
5340 				rf7b = i;
5341 		}
5342 		if (rf7b == 0xffff)
5343 			rf7b = 4;
5344 	} else {
5345 		struct bwi_gains gains;
5346 
5347 		RF_CLRBITS(mac, 0x7a, 0xff80);
5348 
5349 		PHY_SETBITS(mac, 0x814, 0x1);
5350 		PHY_CLRBITS(mac, 0x815, 0x1);
5351 		PHY_SETBITS(mac, 0x811, 0xc);
5352 		PHY_SETBITS(mac, 0x812, 0xc);
5353 		PHY_SETBITS(mac, 0x811, 0x30);
5354 		PHY_SETBITS(mac, 0x812, 0x30);
5355 		PHY_WRITE(mac, 0x5a, 0x480);
5356 		PHY_WRITE(mac, 0x59, 0x810);
5357 		PHY_WRITE(mac, 0x58, 0xd);
5358 		if (phy->phy_version == 0)
5359 			PHY_WRITE(mac, 0x3, 0x122);
5360 		else
5361 			PHY_SETBITS(mac, 0xa, 0x2000);
5362 		PHY_SETBITS(mac, 0x814, 0x4);
5363 		PHY_CLRBITS(mac, 0x815, 0x4);
5364 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
5365 		RF_SETBITS(mac, 0x7a, 0xf);
5366 
5367 		bzero(&gains, sizeof(gains));
5368 		gains.tbl_gain1 = 3;
5369 		gains.tbl_gain2 = 0;
5370 		gains.phy_gain = 1;
5371 		bwi_set_gains(mac, &gains);
5372 
5373 		RF_FILT_SETBITS(mac, 0x43, 0xf0, 0xf);
5374 		DELAY(30);
5375 
5376 		nrssi = bwi_nrssi_11g(mac);
5377 		if (nrssi == -32) {
5378 			for (i = 0; i < 4; ++i) {
5379 				RF_WRITE(mac, 0x7b, i);
5380 				DELAY(20);
5381 				nrssi = bwi_nrssi_11g(mac);
5382 				if (nrssi > -31 && rf7b == 0xffff)
5383 					rf7b = i;
5384 			}
5385 			if (rf7b == 0xffff)
5386 				rf7b = 3;
5387 		} else {
5388 			rf7b = 0;
5389 		}
5390 	}
5391 	RF_WRITE(mac, 0x7b, rf7b);
5392 
5393 	/*
5394 	 * Restore saved RF/PHY registers
5395 	 */
5396 	if (phy->phy_rev >= 6) {
5397 		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
5398 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
5399 			    save_phy6[phy6_idx]);
5400 		}
5401 	}
5402 
5403 	/* Saved PHY registers 0, 1, 2 are handled later */
5404 	for (i = 3; i < SAVE_PHY_COMM_MAX; ++i)
5405 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
5406 
5407 	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
5408 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5409 
5410 	PHY_SETBITS(mac, 0x802, 0x3);
5411 	PHY_SETBITS(mac, 0x429, 0x8000);
5412 
5413 	bwi_set_gains(mac, NULL);
5414 
5415 	if (phy->phy_rev >= 6) {
5416 		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
5417 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
5418 			    save_phy6[phy6_idx]);
5419 		}
5420 	}
5421 
5422 	PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
5423 	PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
5424 	PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
5425 
5426 #undef SAVE_RF_MAX
5427 #undef SAVE_PHY_COMM_MAX
5428 #undef SAVE_PHY6_MAX
5429 }
5430 
5431 void
5432 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *mac)
5433 {
5434 #define SAVE_RF_MAX		3
5435 #define SAVE_PHY_COMM_MAX	4
5436 #define SAVE_PHY3_MAX		8
5437 	struct bwi_softc *sc = mac->mac_sc;
5438 	struct bwi_phy *phy = &mac->mac_phy;
5439 	struct bwi_rf *rf = &mac->mac_rf;
5440 	uint16_t save_rf[SAVE_RF_MAX];
5441 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
5442 	uint16_t save_phy3[SAVE_PHY3_MAX];
5443 	uint16_t ant_div, bbp_atten, chan_ex;
5444 	struct bwi_gains gains;
5445 	int16_t nrssi[2];
5446 	int i, phy3_idx = 0;
5447 
5448 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
5449 	    { 0x7a, 0x52, 0x43 };
5450 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
5451 	    { 0x15, 0x5a, 0x59, 0x58 };
5452 	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
5453 		0x002e, 0x002f, 0x080f, 0x0810,
5454 		0x0801, 0x0060, 0x0014, 0x0478
5455 	};
5456 
5457 	if (rf->rf_rev >= 9)
5458 		return;
5459 	else if (rf->rf_rev == 8)
5460 		bwi_rf_set_nrssi_ofs_11g(mac);
5461 
5462 	PHY_CLRBITS(mac, 0x429, 0x8000);
5463 	PHY_CLRBITS(mac, 0x802, 0x3);
5464 
5465 	/*
5466 	 * Save RF/PHY registers for later restoration
5467 	 */
5468 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
5469 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
5470 
5471 	for (i = 0; i < SAVE_RF_MAX; ++i)
5472 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
5473 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5474 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
5475 
5476 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
5477 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
5478 
5479 	if (phy->phy_rev >= 3) {
5480 		for (i = 0; i < SAVE_PHY3_MAX; ++i)
5481 			save_phy3[i] = PHY_READ(mac, save_phy3_regs[i]);
5482 
5483 		PHY_WRITE(mac, 0x2e, 0);
5484 		PHY_WRITE(mac, 0x810, 0);
5485 
5486 		if (phy->phy_rev == 4 || phy->phy_rev == 6 ||
5487 		    phy->phy_rev == 7) {
5488 			PHY_SETBITS(mac, 0x478, 0x100);
5489 			PHY_SETBITS(mac, 0x810, 0x40);
5490 		} else if (phy->phy_rev == 3 || phy->phy_rev == 5)
5491 			PHY_CLRBITS(mac, 0x810, 0x40);
5492 
5493 		PHY_SETBITS(mac, 0x60, 0x40);
5494 		PHY_SETBITS(mac, 0x14, 0x200);
5495 	}
5496 
5497 	/*
5498 	 * Calculate nrssi0
5499 	 */
5500 	RF_SETBITS(mac, 0x7a, 0x70);
5501 
5502 	bzero(&gains, sizeof(gains));
5503 	gains.tbl_gain1 = 0;
5504 	gains.tbl_gain2 = 8;
5505 	gains.phy_gain = 0;
5506 	bwi_set_gains(mac, &gains);
5507 
5508 	RF_CLRBITS(mac, 0x7a, 0xff08);
5509 	if (phy->phy_rev >= 2) {
5510 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x30);
5511 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
5512 	}
5513 
5514 	RF_SETBITS(mac, 0x7a, 0x80);
5515 	DELAY(20);
5516 	nrssi[0] = bwi_nrssi_11g(mac);
5517 
5518 	/*
5519 	 * Calculate nrssi1
5520 	 */
5521 	RF_CLRBITS(mac, 0x7a, 0xff80);
5522 	if (phy->phy_version >= 2)
5523 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
5524 	CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
5525 
5526 	RF_SETBITS(mac, 0x7a, 0xf);
5527 	PHY_WRITE(mac, 0x15, 0xf330);
5528 	if (phy->phy_rev >= 2) {
5529 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x20);
5530 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x20);
5531 	}
5532 
5533 	bzero(&gains, sizeof(gains));
5534 	gains.tbl_gain1 = 3;
5535 	gains.tbl_gain2 = 0;
5536 	gains.phy_gain = 1;
5537 	bwi_set_gains(mac, &gains);
5538 
5539 	if (rf->rf_rev == 8) {
5540 		RF_WRITE(mac, 0x43, 0x1f);
5541 	} else {
5542 		RF_FILT_SETBITS(mac, 0x52, 0xff0f, 0x60);
5543 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
5544 	}
5545 	PHY_WRITE(mac, 0x5a, 0x480);
5546 	PHY_WRITE(mac, 0x59, 0x810);
5547 	PHY_WRITE(mac, 0x58, 0xd);
5548 	DELAY(20);
5549 
5550 	nrssi[1] = bwi_nrssi_11g(mac);
5551 
5552 	/*
5553 	 * Install calculated narrow RSSI values
5554 	 */
5555 	if (nrssi[1] == nrssi[0])
5556 		rf->rf_nrssi_slope = 0x10000;
5557 	else
5558 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
5559 	if (nrssi[0] >= -4) {
5560 		rf->rf_nrssi[0] = nrssi[1];
5561 		rf->rf_nrssi[1] = nrssi[0];
5562 	}
5563 
5564 	/*
5565 	 * Restore saved RF/PHY registers
5566 	 */
5567 	if (phy->phy_rev >= 3) {
5568 		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
5569 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
5570 				  save_phy3[phy3_idx]);
5571 		}
5572 	}
5573 	if (phy->phy_rev >= 2) {
5574 		PHY_CLRBITS(mac, 0x812, 0x30);
5575 		PHY_CLRBITS(mac, 0x811, 0x30);
5576 	}
5577 
5578 	for (i = 0; i < SAVE_RF_MAX; ++i)
5579 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
5580 
5581 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
5582 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
5583 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
5584 
5585 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
5586 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
5587 
5588 	bwi_rf_workaround(mac, rf->rf_curchan);
5589 	PHY_SETBITS(mac, 0x802, 0x3);
5590 	bwi_set_gains(mac, NULL);
5591 	PHY_SETBITS(mac, 0x429, 0x8000);
5592 
5593 	if (phy->phy_rev >= 3) {
5594 		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
5595 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
5596 			    save_phy3[phy3_idx]);
5597 		}
5598 	}
5599 
5600 	bwi_rf_init_sw_nrssi_table(mac);
5601 	bwi_rf_set_nrssi_thr_11g(mac);
5602 
5603 #undef SAVE_RF_MAX
5604 #undef SAVE_PHY_COMM_MAX
5605 #undef SAVE_PHY3_MAX
5606 }
5607 
5608 void
5609 bwi_rf_init_sw_nrssi_table(struct bwi_mac *mac)
5610 {
5611 	struct bwi_rf *rf = &mac->mac_rf;
5612 	int d, i;
5613 
5614 	d = 0x1f - rf->rf_nrssi[0];
5615 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
5616 		int val;
5617 
5618 		val = (((i - d) * rf->rf_nrssi_slope) / 0x10000) + 0x3a;
5619 		if (val < 0)
5620 			val = 0;
5621 		else if (val > 0x3f)
5622 			val = 0x3f;
5623 
5624 		rf->rf_nrssi_table[i] = val;
5625 	}
5626 }
5627 
5628 void
5629 bwi_rf_init_hw_nrssi_table(struct bwi_mac *mac, uint16_t adjust)
5630 {
5631 	int i;
5632 
5633 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
5634 		int16_t val;
5635 
5636 		val = bwi_nrssi_read(mac, i);
5637 
5638 		val -= adjust;
5639 		if (val < -32)
5640 			val = -32;
5641 		else if (val > 31)
5642 			val = 31;
5643 
5644 		bwi_nrssi_write(mac, i, val);
5645 	}
5646 }
5647 
5648 void
5649 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *mac)
5650 {
5651 	struct bwi_rf *rf = &mac->mac_rf;
5652 	int32_t thr;
5653 
5654 	if (rf->rf_type != BWI_RF_T_BCM2050 ||
5655 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0)
5656 		return;
5657 
5658 	/*
5659 	 * Calculate nrssi threshold
5660 	 */
5661 	if (rf->rf_rev >= 6) {
5662 		thr = (rf->rf_nrssi[1] - rf->rf_nrssi[0]) * 32;
5663 		thr += 20 * (rf->rf_nrssi[0] + 1);
5664 		thr /= 40;
5665 	} else {
5666 		thr = rf->rf_nrssi[1] - 5;
5667 	}
5668 	if (thr < 0)
5669 		thr = 0;
5670 	else if (thr > 0x3e)
5671 		thr = 0x3e;
5672 
5673 	PHY_READ(mac, BWI_PHYR_NRSSI_THR_11B);	/* dummy read */
5674 	PHY_WRITE(mac, BWI_PHYR_NRSSI_THR_11B, (((uint16_t)thr) << 8) | 0x1c);
5675 
5676 	if (rf->rf_rev >= 6) {
5677 		PHY_WRITE(mac, 0x87, 0xe0d);
5678 		PHY_WRITE(mac, 0x86, 0xc0b);
5679 		PHY_WRITE(mac, 0x85, 0xa09);
5680 		PHY_WRITE(mac, 0x84, 0x808);
5681 		PHY_WRITE(mac, 0x83, 0x808);
5682 		PHY_WRITE(mac, 0x82, 0x604);
5683 		PHY_WRITE(mac, 0x81, 0x302);
5684 		PHY_WRITE(mac, 0x80, 0x100);
5685 	}
5686 }
5687 
5688 int32_t
5689 _nrssi_threshold(const struct bwi_rf *rf, int32_t val)
5690 {
5691 	val *= (rf->rf_nrssi[1] - rf->rf_nrssi[0]);
5692 	val += (rf->rf_nrssi[0] << 6);
5693 	if (val < 32)
5694 		val += 31;
5695 	else
5696 		val += 32;
5697 	val >>= 6;
5698 	if (val < -31)
5699 		val = -31;
5700 	else if (val > 31)
5701 		val = 31;
5702 
5703 	return (val);
5704 }
5705 
5706 void
5707 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *mac)
5708 {
5709 	int32_t thr1, thr2;
5710 	uint16_t thr;
5711 
5712 	/*
5713 	 * Find the two nrssi thresholds
5714 	 */
5715 	if ((mac->mac_phy.phy_flags & BWI_PHY_F_LINKED) == 0 ||
5716 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
5717 	    	int16_t nrssi;
5718 
5719 		nrssi = bwi_nrssi_read(mac, 0x20);
5720 		if (nrssi >= 32)
5721 			nrssi -= 64;
5722 
5723 		if (nrssi < 3) {
5724 			thr1 = 0x2b;
5725 			thr2 = 0x27;
5726 		} else {
5727 			thr1 = 0x2d;
5728 			thr2 = 0x2b;
5729 		}
5730 	} else {
5731 		/* TODO Interfere mode */
5732 		thr1 = _nrssi_threshold(&mac->mac_rf, 0x11);
5733 		thr2 = _nrssi_threshold(&mac->mac_rf, 0xe);
5734 	}
5735 
5736 #define NRSSI_THR1_MASK		0x003f
5737 #define NRSSI_THR2_MASK		0x0fc0
5738 	thr = __SHIFTIN((uint32_t)thr1, NRSSI_THR1_MASK) |
5739 	    __SHIFTIN((uint32_t)thr2, NRSSI_THR2_MASK);
5740 	PHY_FILT_SETBITS(mac, BWI_PHYR_NRSSI_THR_11G, 0xf000, thr);
5741 #undef NRSSI_THR1_MASK
5742 #undef NRSSI_THR2_MASK
5743 }
5744 
5745 void
5746 bwi_rf_clear_tssi(struct bwi_mac *mac)
5747 {
5748 	/* XXX use function pointer */
5749 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
5750 		/* TODO: 11A */
5751 	} else {
5752 		uint16_t val;
5753 		int i;
5754 
5755 		val = __SHIFTIN(BWI_INVALID_TSSI, BWI_LO_TSSI_MASK) |
5756 		    __SHIFTIN(BWI_INVALID_TSSI, BWI_HI_TSSI_MASK);
5757 
5758 		for (i = 0; i < 2; ++i) {
5759 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
5760 			    BWI_COMM_MOBJ_TSSI_DS + (i * 2), val);
5761 		}
5762 
5763 		for (i = 0; i < 2; ++i) {
5764 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
5765 			    BWI_COMM_MOBJ_TSSI_OFDM + (i * 2), val);
5766 		}
5767 	}
5768 }
5769 
5770 void
5771 bwi_rf_clear_state(struct bwi_rf *rf)
5772 {
5773 	int i;
5774 
5775 	rf->rf_flags &= ~BWI_RF_CLEAR_FLAGS;
5776 	bzero(rf->rf_lo, sizeof(rf->rf_lo));
5777 	bzero(rf->rf_lo_used, sizeof(rf->rf_lo_used));
5778 
5779 	rf->rf_nrssi_slope = 0;
5780 	rf->rf_nrssi[0] = BWI_INVALID_NRSSI;
5781 	rf->rf_nrssi[1] = BWI_INVALID_NRSSI;
5782 
5783 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i)
5784 		rf->rf_nrssi_table[i] = i;
5785 
5786 	rf->rf_lo_gain = 0;
5787 	rf->rf_rx_gain = 0;
5788 
5789 	bcopy(rf->rf_txpower_map0, rf->rf_txpower_map,
5790 	      sizeof(rf->rf_txpower_map));
5791 	rf->rf_idle_tssi = rf->rf_idle_tssi0;
5792 }
5793 
5794 void
5795 bwi_rf_on_11a(struct bwi_mac *mac)
5796 {
5797 	/* TODO: 11A */
5798 }
5799 
5800 void
5801 bwi_rf_on_11bg(struct bwi_mac *mac)
5802 {
5803 	struct bwi_phy *phy = &mac->mac_phy;
5804 
5805 	PHY_WRITE(mac, 0x15, 0x8000);
5806 	PHY_WRITE(mac, 0x15, 0xcc00);
5807 	if (phy->phy_flags & BWI_PHY_F_LINKED)
5808 		PHY_WRITE(mac, 0x15, 0xc0);
5809 	else
5810 		PHY_WRITE(mac, 0x15, 0);
5811 
5812 	bwi_rf_set_chan(mac, 6 /* XXX */, 1);
5813 }
5814 
5815 void
5816 bwi_rf_set_ant_mode(struct bwi_mac *mac, int ant_mode)
5817 {
5818 	struct bwi_softc *sc = mac->mac_sc;
5819 	struct bwi_phy *phy = &mac->mac_phy;
5820 	uint16_t val;
5821 
5822 	KASSERT(ant_mode == BWI_ANT_MODE_0 ||
5823 	    ant_mode == BWI_ANT_MODE_1 ||
5824 	    ant_mode == BWI_ANT_MODE_AUTO);
5825 
5826 	HFLAGS_CLRBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
5827 
5828 	if (phy->phy_mode == IEEE80211_MODE_11B) {
5829 		/* NOTE: v4/v3 conflicts, take v3 */
5830 		if (mac->mac_rev == 2)
5831 			val = BWI_ANT_MODE_AUTO;
5832 		else
5833 			val = ant_mode;
5834 		val <<= 7;
5835 		PHY_FILT_SETBITS(mac, 0x3e2, 0xfe7f, val);
5836 	} else {	/* 11a/g */
5837 		/* XXX reg/value naming */
5838 		val = ant_mode << 7;
5839 		PHY_FILT_SETBITS(mac, 0x401, 0x7e7f, val);
5840 
5841 		if (ant_mode == BWI_ANT_MODE_AUTO)
5842 			PHY_CLRBITS(mac, 0x42b, 0x100);
5843 
5844 		if (phy->phy_mode == IEEE80211_MODE_11A) {
5845 			/* TODO: 11A */
5846 		} else {	/* 11g */
5847 			if (ant_mode == BWI_ANT_MODE_AUTO)
5848 				PHY_SETBITS(mac, 0x48c, 0x2000);
5849 			else
5850 				PHY_CLRBITS(mac, 0x48c, 0x2000);
5851 
5852 			if (phy->phy_rev >= 2) {
5853 				PHY_SETBITS(mac, 0x461, 0x10);
5854 				PHY_FILT_SETBITS(mac, 0x4ad, 0xff00, 0x15);
5855 				if (phy->phy_rev == 2) {
5856 					PHY_WRITE(mac, 0x427, 0x8);
5857 				} else {
5858 					PHY_FILT_SETBITS(mac, 0x427,
5859 							 0xff00, 0x8);
5860 				}
5861 
5862 				if (phy->phy_rev >= 6)
5863 					PHY_WRITE(mac, 0x49b, 0xdc);
5864 			}
5865 		}
5866 	}
5867 
5868 	/* XXX v4 set AUTO_ANTDIV unconditionally */
5869 	if (ant_mode == BWI_ANT_MODE_AUTO)
5870 		HFLAGS_SETBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
5871 
5872 	val = ant_mode << 8;
5873 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_BEACON,
5874 	    0xfc3f, val);
5875 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_ACK,
5876 	    0xfc3f, val);
5877 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_PROBE_RESP,
5878 	    0xfc3f, val);
5879 
5880 	/* XXX what's these */
5881 	if (phy->phy_mode == IEEE80211_MODE_11B)
5882 		CSR_SETBITS_2(sc, 0x5e, 0x4);
5883 
5884 	CSR_WRITE_4(sc, 0x100, 0x1000000);
5885 	if (mac->mac_rev < 5)
5886 		CSR_WRITE_4(sc, 0x10c, 0x1000000);
5887 
5888 	mac->mac_rf.rf_ant_mode = ant_mode;
5889 }
5890 
5891 int
5892 bwi_rf_get_latest_tssi(struct bwi_mac *mac, int8_t tssi[], uint16_t ofs)
5893 {
5894 	int i;
5895 
5896 	for (i = 0; i < 4; ) {
5897 		uint16_t val;
5898 
5899 		val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs + i);
5900 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_LO_TSSI_MASK);
5901 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_HI_TSSI_MASK);
5902 	}
5903 
5904 	for (i = 0; i < 4; ++i) {
5905 		if (tssi[i] == BWI_INVALID_TSSI)
5906 			return (EINVAL);
5907 	}
5908 
5909 	return (0);
5910 }
5911 
5912 int
5913 bwi_rf_tssi2dbm(struct bwi_mac *mac, int8_t tssi, int8_t *txpwr)
5914 {
5915 	struct bwi_rf *rf = &mac->mac_rf;
5916 	int pwr_idx;
5917 
5918 	pwr_idx = rf->rf_idle_tssi + (int)tssi - rf->rf_base_tssi;
5919 #if 0
5920 	if (pwr_idx < 0 || pwr_idx >= BWI_TSSI_MAX)
5921 		return EINVAL;
5922 #else
5923 	if (pwr_idx < 0)
5924 		pwr_idx = 0;
5925 	else if (pwr_idx >= BWI_TSSI_MAX)
5926 		pwr_idx = BWI_TSSI_MAX - 1;
5927 #endif
5928 	*txpwr = rf->rf_txpower_map[pwr_idx];
5929 
5930 	return (0);
5931 }
5932 
5933 int
5934 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
5935 {
5936 	uint16_t flags1, flags3;
5937 	int rssi, lna_gain;
5938 
5939 	rssi = hdr->rxh_rssi;
5940 	flags1 = letoh16(hdr->rxh_flags1);
5941 	flags3 = letoh16(hdr->rxh_flags3);
5942 
5943 #define NEW_BCM2050_RSSI
5944 #ifdef NEW_BCM2050_RSSI
5945 	if (flags1 & BWI_RXH_F1_OFDM) {
5946 		if (rssi > 127)
5947 			rssi -= 256;
5948 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
5949 			rssi += 17;
5950 		else
5951 			rssi -= 4;
5952 		return (rssi);
5953 	}
5954 
5955 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
5956 		struct bwi_rf *rf = &mac->mac_rf;
5957 
5958 		if (rssi >= BWI_NRSSI_TBLSZ)
5959 			rssi = BWI_NRSSI_TBLSZ - 1;
5960 
5961 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
5962 		rssi -= 67;
5963 	} else {
5964 		rssi = ((31 - rssi) * -149) / 128;
5965 		rssi -= 68;
5966 	}
5967 
5968 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
5969 		return (rssi);
5970 
5971 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
5972 		rssi += 20;
5973 
5974 	lna_gain = __SHIFTOUT(letoh16(hdr->rxh_phyinfo),
5975 	    BWI_RXH_PHYINFO_LNAGAIN);
5976 	DPRINTF(3, "lna_gain %d, phyinfo 0x%04x\n",
5977 	    lna_gain, letoh16(hdr->rxh_phyinfo));
5978 	switch (lna_gain) {
5979 	case 0:
5980 		rssi += 27;
5981 		break;
5982 	case 1:
5983 		rssi += 6;
5984 		break;
5985 	case 2:
5986 		rssi += 12;
5987 		break;
5988 	case 3:
5989 		/*
5990 		 * XXX
5991 		 * According to v3 spec, we should do _nothing_ here,
5992 		 * but it seems that the result RSSI will be too low
5993 		 * (relative to what ath(4) says).  Raise it a little
5994 		 * bit.
5995 		 */
5996 		rssi += 5;
5997 		break;
5998 	default:
5999 		panic("impossible lna gain %d", lna_gain);
6000 	}
6001 #else	/* !NEW_BCM2050_RSSI */
6002 	lna_gain = 0; /* shut up gcc warning */
6003 
6004 	if (flags1 & BWI_RXH_F1_OFDM) {
6005 		if (rssi > 127)
6006 			rssi -= 256;
6007 		rssi = (rssi * 73) / 64;
6008 
6009 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
6010 			rssi += 25;
6011 		else
6012 			rssi -= 3;
6013 		return (rssi);
6014 	}
6015 
6016 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
6017 		struct bwi_rf *rf = &mac->mac_rf;
6018 
6019 		if (rssi >= BWI_NRSSI_TBLSZ)
6020 			rssi = BWI_NRSSI_TBLSZ - 1;
6021 
6022 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
6023 		rssi -= 57;
6024 	} else {
6025 		rssi = ((31 - rssi) * -149) / 128;
6026 		rssi -= 68;
6027 	}
6028 
6029 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
6030 		return (rssi);
6031 
6032 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
6033 		rssi += 25;
6034 #endif	/* NEW_BCM2050_RSSI */
6035 	return (rssi);
6036 }
6037 
6038 int
6039 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
6040 {
6041 	uint16_t flags1;
6042 	int rssi;
6043 
6044 	rssi = (((int)hdr->rxh_rssi - 11) * 103) / 64;
6045 
6046 	flags1 = letoh16(hdr->rxh_flags1);
6047 	if (flags1 & BWI_RXH_F1_BCM2053_RSSI)
6048 		rssi -= 109;
6049 	else
6050 		rssi -= 83;
6051 
6052 	return (rssi);
6053 }
6054 
6055 int
6056 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
6057 {
6058 	int rssi;
6059 
6060 	rssi = hdr->rxh_rssi;
6061 	if (rssi > 127)
6062 		rssi -= 256;
6063 
6064 	return (rssi);
6065 }
6066 
6067 uint16_t
6068 bwi_rf_lo_measure_11b(struct bwi_mac *mac)
6069 {
6070 	uint16_t val;
6071 	int i;
6072 
6073 	val = 0;
6074 	for (i = 0; i < 10; ++i) {
6075 		PHY_WRITE(mac, 0x15, 0xafa0);
6076 		DELAY(1);
6077 		PHY_WRITE(mac, 0x15, 0xefa0);
6078 		DELAY(10);
6079 		PHY_WRITE(mac, 0x15, 0xffa0);
6080 		DELAY(40);
6081 
6082 		val += PHY_READ(mac, 0x2c);
6083 	}
6084 
6085 	return (val);
6086 }
6087 
6088 void
6089 bwi_rf_lo_update_11b(struct bwi_mac *mac)
6090 {
6091 	struct bwi_softc *sc = mac->mac_sc;
6092 	struct bwi_rf *rf = &mac->mac_rf;
6093 	struct rf_saveregs regs;
6094 	uint16_t rf_val, phy_val, min_val, val;
6095 	uint16_t rf52, bphy_ctrl;
6096 	int i;
6097 
6098 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6099 
6100 	bzero(&regs, sizeof(regs));
6101 	bphy_ctrl = 0;
6102 
6103 	/*
6104 	 * Save RF/PHY registers for later restoration
6105 	 */
6106 	SAVE_PHY_REG(mac, &regs, 15);
6107 	rf52 = RF_READ(mac, 0x52) & 0xfff0;
6108 	if (rf->rf_type == BWI_RF_T_BCM2050) {
6109 		SAVE_PHY_REG(mac, &regs, 0a);
6110 		SAVE_PHY_REG(mac, &regs, 2a);
6111 		SAVE_PHY_REG(mac, &regs, 35);
6112 		SAVE_PHY_REG(mac, &regs, 03);
6113 		SAVE_PHY_REG(mac, &regs, 01);
6114 		SAVE_PHY_REG(mac, &regs, 30);
6115 
6116 		SAVE_RF_REG(mac, &regs, 43);
6117 		SAVE_RF_REG(mac, &regs, 7a);
6118 
6119 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
6120 
6121 		SAVE_RF_REG(mac, &regs, 52);
6122 		regs.rf_52 &= 0xf0;
6123 
6124 		PHY_WRITE(mac, 0x30, 0xff);
6125 		CSR_WRITE_2(sc, BWI_PHY_CTRL, 0x3f3f);
6126 		PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
6127 		RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
6128 	}
6129 
6130 	PHY_WRITE(mac, 0x15, 0xb000);
6131 
6132 	if (rf->rf_type == BWI_RF_T_BCM2050) {
6133 		PHY_WRITE(mac, 0x2b, 0x203);
6134  		PHY_WRITE(mac, 0x2a, 0x8a3);
6135  	} else {
6136 		PHY_WRITE(mac, 0x2b, 0x1402);
6137 	}
6138 
6139 	/*
6140 	 * Setup RF signal
6141 	 */
6142 	rf_val = 0;
6143 	min_val = 65535;
6144 
6145 	for (i = 0; i < 4; ++i) {
6146 		RF_WRITE(mac, 0x52, rf52 | i);
6147 		bwi_rf_lo_measure_11b(mac);	/* Ignore return value */
6148 	}
6149 	for (i = 0; i < 10; ++i) {
6150  		RF_WRITE(mac, 0x52, rf52 | i);
6151 
6152   		val = bwi_rf_lo_measure_11b(mac) / 10;
6153 		if (val < min_val) {
6154 			min_val = val;
6155 			rf_val = i;
6156 		}
6157 	}
6158 	RF_WRITE(mac, 0x52, rf52 | rf_val);
6159 
6160 	/*
6161 	 * Setup PHY signal
6162 	*/
6163 	phy_val = 0;
6164 	min_val = 65535;
6165 
6166 	for (i = -4; i < 5; i += 2) {
6167 		int j;
6168 
6169 		for (j = -4; j < 5; j += 2) {
6170 			uint16_t phy2f;
6171 
6172 			phy2f = (0x100 * i) + j;
6173 			if (j < 0)
6174 				phy2f += 0x100;
6175 			PHY_WRITE(mac, 0x2f, phy2f);
6176 
6177 			val = bwi_rf_lo_measure_11b(mac) / 10;
6178 			if (val < min_val) {
6179 				min_val = val;
6180 				phy_val = phy2f;
6181 			}
6182 		}
6183 	}
6184 	PHY_WRITE(mac, 0x2f, phy_val + 0x101);
6185 
6186 	/*
6187 	 * Restore saved RF/PHY registers
6188 	 */
6189 	if (rf->rf_type == BWI_RF_T_BCM2050) {
6190 		RESTORE_PHY_REG(mac, &regs, 0a);
6191 		RESTORE_PHY_REG(mac, &regs, 2a);
6192 		RESTORE_PHY_REG(mac, &regs, 35);
6193 		RESTORE_PHY_REG(mac, &regs, 03);
6194 		RESTORE_PHY_REG(mac, &regs, 01);
6195 		RESTORE_PHY_REG(mac, &regs, 30);
6196 
6197 		RESTORE_RF_REG(mac, &regs, 43);
6198 		RESTORE_RF_REG(mac, &regs, 7a);
6199 
6200 		RF_FILT_SETBITS(mac, 0x52, 0xf, regs.rf_52);
6201 
6202 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
6203 	}
6204 	RESTORE_PHY_REG(mac, &regs, 15);
6205 
6206 	bwi_rf_workaround(mac, rf->rf_curchan);
6207 }
6208 
6209 /* INTERFACE */
6210 
6211 uint16_t
6212 bwi_read_sprom(struct bwi_softc *sc, uint16_t ofs)
6213 {
6214 	return (CSR_READ_2(sc, ofs + BWI_SPROM_START));
6215 }
6216 
6217 void
6218 bwi_setup_desc32(struct bwi_softc *sc, struct bwi_desc32 *desc_array,
6219     int ndesc, int desc_idx, bus_addr_t paddr, int buf_len, int tx)
6220 {
6221 	struct bwi_desc32 *desc = &desc_array[desc_idx];
6222 	uint32_t ctrl, addr, addr_hi, addr_lo;
6223 
6224 	addr_lo = __SHIFTOUT(paddr, BWI_DESC32_A_ADDR_MASK);
6225 	addr_hi = __SHIFTOUT(paddr, BWI_DESC32_A_FUNC_MASK);
6226 
6227 	addr = __SHIFTIN(addr_lo, BWI_DESC32_A_ADDR_MASK) |
6228 	    __SHIFTIN(BWI_DESC32_A_FUNC_TXRX, BWI_DESC32_A_FUNC_MASK);
6229 
6230 	ctrl = __SHIFTIN(buf_len, BWI_DESC32_C_BUFLEN_MASK) |
6231 	     __SHIFTIN(addr_hi, BWI_DESC32_C_ADDRHI_MASK);
6232 	if (desc_idx == ndesc - 1)
6233 		ctrl |= BWI_DESC32_C_EOR;
6234 	if (tx) {
6235 		/* XXX */
6236 		ctrl |= BWI_DESC32_C_FRAME_START |
6237 		    BWI_DESC32_C_FRAME_END |
6238 		    BWI_DESC32_C_INTR;
6239 	}
6240 
6241 	desc->addr = htole32(addr);
6242 	desc->ctrl = htole32(ctrl);
6243 }
6244 
6245 void
6246 bwi_power_on(struct bwi_softc *sc, int with_pll)
6247 {
6248 	uint32_t gpio_in, gpio_out, gpio_en, status;
6249 
6250 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6251 
6252 	gpio_in = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_IN);
6253 	if (gpio_in & BWI_PCIM_GPIO_PWR_ON)
6254 		goto back;
6255 
6256 	gpio_out = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6257 	gpio_en = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_ENABLE);
6258 
6259 	gpio_out |= BWI_PCIM_GPIO_PWR_ON;
6260 	gpio_en |= BWI_PCIM_GPIO_PWR_ON;
6261 	if (with_pll) {
6262 		/* Turn off PLL first */
6263 		gpio_out |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6264 		gpio_en |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6265 	}
6266 
6267 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6268 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_ENABLE, gpio_en);
6269 	DELAY(1000);
6270 
6271 	if (with_pll) {
6272 		/* Turn on PLL */
6273 		gpio_out &= ~BWI_PCIM_GPIO_PLL_PWR_OFF;
6274 		(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6275 		DELAY(5000);
6276 	}
6277 
6278 back:
6279 	/* Clear "Signaled Target Abort" */
6280 	status = (sc->sc_conf_read)(sc, PCI_COMMAND_STATUS_REG);
6281 	status &= ~PCI_STATUS_TARGET_TARGET_ABORT;
6282 	(sc->sc_conf_write)(sc, PCI_COMMAND_STATUS_REG, status);
6283 }
6284 
6285 int
6286 bwi_power_off(struct bwi_softc *sc, int with_pll)
6287 {
6288 	uint32_t gpio_out, gpio_en;
6289 
6290 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
6291 
6292 	(sc->sc_conf_read)(sc, BWI_PCIR_GPIO_IN); /* dummy read */
6293 	gpio_out = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6294 	gpio_en = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_ENABLE);
6295 
6296 	gpio_out &= ~BWI_PCIM_GPIO_PWR_ON;
6297 	gpio_en |= BWI_PCIM_GPIO_PWR_ON;
6298 	if (with_pll) {
6299 		gpio_out |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6300 		gpio_en |= BWI_PCIM_GPIO_PLL_PWR_OFF;
6301 	}
6302 
6303 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_OUT, gpio_out);
6304 	(sc->sc_conf_write)(sc, BWI_PCIR_GPIO_ENABLE, gpio_en);
6305 
6306 	return (0);
6307 }
6308 
6309 int
6310 bwi_regwin_switch(struct bwi_softc *sc, struct bwi_regwin *rw,
6311     struct bwi_regwin **old_rw)
6312 {
6313 	int error;
6314 
6315 	if (old_rw != NULL)
6316 		*old_rw = NULL;
6317 
6318 	if (!BWI_REGWIN_EXIST(rw))
6319 		return (EINVAL);
6320 
6321 	if (sc->sc_cur_regwin != rw) {
6322 		error = bwi_regwin_select(sc, rw->rw_id);
6323 		if (error) {
6324 			printf("%s: can't select regwin %d\n",
6325 			    sc->sc_dev.dv_xname, rw->rw_id);
6326 			return (error);
6327 		}
6328 	}
6329 
6330 	if (old_rw != NULL)
6331 		*old_rw = sc->sc_cur_regwin;
6332 	sc->sc_cur_regwin = rw;
6333 
6334 	return (0);
6335 }
6336 
6337 int
6338 bwi_regwin_select(struct bwi_softc *sc, int id)
6339 {
6340 	uint32_t win = BWI_PCIM_REGWIN(id);
6341 	int i;
6342 
6343 #define RETRY_MAX	50
6344 	for (i = 0; i < RETRY_MAX; ++i) {
6345 		(sc->sc_conf_write)(sc, BWI_PCIR_SEL_REGWIN, win);
6346 		if ((sc->sc_conf_read)(sc, BWI_PCIR_SEL_REGWIN) == win)
6347 			return (0);
6348 		DELAY(10);
6349 	}
6350 #undef RETRY_MAX
6351 
6352 	return (ENXIO);
6353 }
6354 
6355 void
6356 bwi_regwin_info(struct bwi_softc *sc, uint16_t *type, uint8_t *rev)
6357 {
6358 	uint32_t val;
6359 
6360 	val = CSR_READ_4(sc, BWI_ID_HI);
6361 	*type = BWI_ID_HI_REGWIN_TYPE(val);
6362 	*rev = BWI_ID_HI_REGWIN_REV(val);
6363 
6364 	DPRINTF(1, "%s: regwin: type 0x%03x, rev %d, vendor 0x%04x\n",
6365 	    sc->sc_dev.dv_xname,
6366 	    *type, *rev, __SHIFTOUT(val, BWI_ID_HI_REGWIN_VENDOR_MASK));
6367 }
6368 
6369 void
6370 bwi_led_attach(struct bwi_softc *sc)
6371 {
6372 	const uint8_t *led_act = NULL;
6373 	uint16_t gpio, val[BWI_LED_MAX];
6374 	int i;
6375 
6376 	for (i = 0; i < nitems(bwi_vendor_led_act); ++i) {
6377 		if (sc->sc_pci_subvid == bwi_vendor_led_act[i].vid) {
6378 			led_act = bwi_vendor_led_act[i].led_act;
6379 				break;
6380 		}
6381 	}
6382 	if (led_act == NULL)
6383 		led_act = bwi_default_led_act;
6384 
6385 	gpio = bwi_read_sprom(sc, BWI_SPROM_GPIO01);
6386 	val[0] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_0);
6387 	val[1] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_1);
6388 
6389 	gpio = bwi_read_sprom(sc, BWI_SPROM_GPIO23);
6390 	val[2] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_2);
6391 	val[3] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_3);
6392 
6393 	for (i = 0; i < BWI_LED_MAX; ++i) {
6394 		struct bwi_led *led = &sc->sc_leds[i];
6395 
6396 		if (val[i] == 0xff) {
6397 			led->l_act = led_act[i];
6398 		} else {
6399 			if (val[i] & BWI_LED_ACT_LOW)
6400 				led->l_flags |= BWI_LED_F_ACTLOW;
6401 			led->l_act = __SHIFTOUT(val[i], BWI_LED_ACT_MASK);
6402 		}
6403 		led->l_mask = (1 << i);
6404 
6405 		if (led->l_act == BWI_LED_ACT_BLINK_SLOW ||
6406 		    led->l_act == BWI_LED_ACT_BLINK_POLL ||
6407 		    led->l_act == BWI_LED_ACT_BLINK) {
6408 		    led->l_flags |= BWI_LED_F_BLINK;
6409 			if (led->l_act == BWI_LED_ACT_BLINK_POLL)
6410 				led->l_flags |= BWI_LED_F_POLLABLE;
6411 			else if (led->l_act == BWI_LED_ACT_BLINK_SLOW)
6412 				led->l_flags |= BWI_LED_F_SLOW;
6413 
6414 			if (sc->sc_blink_led == NULL) {
6415 				sc->sc_blink_led = led;
6416 				if (led->l_flags & BWI_LED_F_SLOW)
6417 					BWI_LED_SLOWDOWN(sc->sc_led_idle);
6418 			}
6419 		}
6420 
6421 		DPRINTF(1, "%s: %dth led, act %d, lowact %d\n",
6422 		    sc->sc_dev.dv_xname, i, led->l_act,
6423 		    led->l_flags & BWI_LED_F_ACTLOW);
6424 	}
6425 	timeout_set(&sc->sc_led_blink_next_ch, bwi_led_blink_next, sc);
6426 	timeout_set(&sc->sc_led_blink_end_ch, bwi_led_blink_end, sc);
6427 }
6428 
6429 uint16_t
6430 bwi_led_onoff(struct bwi_led *led, uint16_t val, int on)
6431 {
6432 	if (led->l_flags & BWI_LED_F_ACTLOW)
6433 		on = !on;
6434 	if (on)
6435 		val |= led->l_mask;
6436 	else
6437 		val &= ~led->l_mask;
6438 
6439 	return (val);
6440 }
6441 
6442 void
6443 bwi_led_newstate(struct bwi_softc *sc, enum ieee80211_state nstate)
6444 {
6445 	struct ieee80211com *ic = &sc->sc_ic;
6446 	uint16_t val;
6447 	int i;
6448 
6449 	if (nstate == IEEE80211_S_INIT) {
6450 		timeout_del(&sc->sc_led_blink_next_ch);
6451 		timeout_del(&sc->sc_led_blink_end_ch);
6452 		sc->sc_led_blinking = 0;
6453 	}
6454 
6455 	if ((ic->ic_if.if_flags & IFF_RUNNING) == 0)
6456 		return;
6457 
6458 	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6459 	for (i = 0; i < BWI_LED_MAX; ++i) {
6460 		struct bwi_led *led = &sc->sc_leds[i];
6461 		int on;
6462 
6463 		if (led->l_act == BWI_LED_ACT_UNKN ||
6464 		    led->l_act == BWI_LED_ACT_NULL)
6465 			continue;
6466 
6467 		if ((led->l_flags & BWI_LED_F_BLINK) &&
6468 			nstate != IEEE80211_S_INIT)
6469 			continue;
6470 
6471 		switch (led->l_act) {
6472 		case BWI_LED_ACT_ON:	/* Always on */
6473 			on = 1;
6474 			break;
6475 		case BWI_LED_ACT_OFF:	/* Always off */
6476 		case BWI_LED_ACT_5GHZ:	/* TODO: 11A */
6477 			on = 0;
6478 			break;
6479 		default:
6480 			on = 1;
6481 			switch (nstate) {
6482 			case IEEE80211_S_INIT:
6483 				on = 0;
6484 				break;
6485 			case IEEE80211_S_RUN:
6486 				if (led->l_act == BWI_LED_ACT_11G &&
6487 				    ic->ic_curmode != IEEE80211_MODE_11G)
6488 					on = 0;
6489 				break;
6490 			default:
6491 				if (led->l_act == BWI_LED_ACT_ASSOC)
6492 					on = 0;
6493 				break;
6494 			}
6495 			break;
6496 		}
6497 
6498 		val = bwi_led_onoff(led, val, on);
6499 	}
6500 	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6501 }
6502 
6503 void
6504 bwi_led_event(struct bwi_softc *sc, int event)
6505 {
6506 	struct bwi_led *led = sc->sc_blink_led;
6507 	int rate;
6508 
6509 	if (event == BWI_LED_EVENT_POLL) {
6510 		if ((led->l_flags & BWI_LED_F_POLLABLE) == 0)
6511 			return;
6512 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
6513 			return;
6514 	}
6515 
6516 	sc->sc_led_ticks = ticks;
6517 	if (sc->sc_led_blinking)
6518 		return;
6519 
6520 	switch (event) {
6521 	case BWI_LED_EVENT_RX:
6522 		rate = sc->sc_rx_rate;
6523 		break;
6524 	case BWI_LED_EVENT_TX:
6525 		rate = sc->sc_tx_rate;
6526 		break;
6527 	case BWI_LED_EVENT_POLL:
6528 		rate = 0;
6529 		break;
6530 	default:
6531 		panic("unknown LED event %d", event);
6532 		break;
6533 	}
6534 	bwi_led_blink_start(sc, bwi_led_duration[rate].on_dur,
6535 	    bwi_led_duration[rate].off_dur);
6536 }
6537 
6538 void
6539 bwi_led_blink_start(struct bwi_softc *sc, int on_dur, int off_dur)
6540 {
6541 	struct bwi_led *led = sc->sc_blink_led;
6542 	uint16_t val;
6543 
6544 	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6545 	val = bwi_led_onoff(led, val, 1);
6546 	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6547 
6548 	if (led->l_flags & BWI_LED_F_SLOW) {
6549 		BWI_LED_SLOWDOWN(on_dur);
6550 		BWI_LED_SLOWDOWN(off_dur);
6551 	}
6552 
6553 	sc->sc_led_blinking = 1;
6554 	sc->sc_led_blink_offdur = off_dur;
6555 
6556 	timeout_add(&sc->sc_led_blink_next_ch, on_dur);
6557 }
6558 
6559 void
6560 bwi_led_blink_next(void *xsc)
6561 {
6562 	struct bwi_softc *sc = xsc;
6563 	uint16_t val;
6564 
6565 	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
6566 	val = bwi_led_onoff(sc->sc_blink_led, val, 0);
6567 	CSR_WRITE_2(sc, BWI_MAC_GPIO_CTRL, val);
6568 
6569 	timeout_add(&sc->sc_led_blink_end_ch, sc->sc_led_blink_offdur);
6570 }
6571 
6572 void
6573 bwi_led_blink_end(void *xsc)
6574 {
6575 	struct bwi_softc *sc = xsc;
6576 
6577 	sc->sc_led_blinking = 0;
6578 }
6579 
6580 int
6581 bwi_bbp_attach(struct bwi_softc *sc)
6582 {
6583 	uint16_t bbp_id, rw_type;
6584 	uint8_t rw_rev;
6585 	uint32_t info;
6586 	int error, nregwin, i;
6587 
6588 	/*
6589 	 * Get 0th regwin information
6590 	 * NOTE: 0th regwin should exist
6591 	 */
6592 	error = bwi_regwin_select(sc, 0);
6593 	if (error) {
6594 		printf("%s: can't select regwin 0\n", sc->sc_dev.dv_xname);
6595 		return (error);
6596 	}
6597 	bwi_regwin_info(sc, &rw_type, &rw_rev);
6598 
6599 	/*
6600 	 * Find out BBP id
6601 	 */
6602 	bbp_id = 0;
6603 	info = 0;
6604 	if (rw_type == BWI_REGWIN_T_COM) {
6605 		info = CSR_READ_4(sc, BWI_INFO);
6606 		bbp_id = __SHIFTOUT(info, BWI_INFO_BBPID_MASK);
6607 
6608 		BWI_CREATE_REGWIN(&sc->sc_com_regwin, 0, rw_type, rw_rev);
6609 
6610 		sc->sc_cap = CSR_READ_4(sc, BWI_CAPABILITY);
6611 	} else {
6612 		uint16_t did = sc->sc_pci_did;
6613 		uint8_t revid = sc->sc_pci_revid;
6614 
6615 		for (i = 0; i < nitems(bwi_bbpid_map); ++i) {
6616 			if (did >= bwi_bbpid_map[i].did_min &&
6617 			    did <= bwi_bbpid_map[i].did_max) {
6618 				bbp_id = bwi_bbpid_map[i].bbp_id;
6619 				break;
6620 			}
6621 		}
6622 		if (bbp_id == 0) {
6623 			printf("%s: no BBP id for device id 0x%04x\n",
6624 			    sc->sc_dev.dv_xname, did);
6625 			return (ENXIO);
6626 		}
6627 
6628 		info = __SHIFTIN(revid, BWI_INFO_BBPREV_MASK) |
6629 		    __SHIFTIN(0, BWI_INFO_BBPPKG_MASK);
6630 	}
6631 
6632 	/*
6633 	 * Find out number of regwins
6634 	 */
6635 	nregwin = 0;
6636 	if (rw_type == BWI_REGWIN_T_COM && rw_rev >= 4) {
6637 		nregwin = __SHIFTOUT(info, BWI_INFO_NREGWIN_MASK);
6638 	} else {
6639 		for (i = 0; i < nitems(bwi_regwin_count); ++i) {
6640 			if (bwi_regwin_count[i].bbp_id == bbp_id) {
6641 				nregwin = bwi_regwin_count[i].nregwin;
6642 				break;
6643 			}
6644 		}
6645 		if (nregwin == 0) {
6646 			printf("%s: no number of win for BBP id 0x%04x\n",
6647 			    sc->sc_dev.dv_xname, bbp_id);
6648 			return (ENXIO);
6649 		}
6650 	}
6651 
6652 	/* Record BBP id/rev for later using */
6653 	sc->sc_bbp_id = bbp_id;
6654 	sc->sc_bbp_rev = __SHIFTOUT(info, BWI_INFO_BBPREV_MASK);
6655 	sc->sc_bbp_pkg = __SHIFTOUT(info, BWI_INFO_BBPPKG_MASK);
6656 	DPRINTF(1, "%s: BBP id 0x%04x, BBP rev 0x%x, BBP pkg %d\n",
6657 	    sc->sc_dev.dv_xname, sc->sc_bbp_id, sc->sc_bbp_rev, sc->sc_bbp_pkg);
6658 	DPRINTF(1, "%s: nregwin %d, cap 0x%08x\n",
6659 	    sc->sc_dev.dv_xname, nregwin, sc->sc_cap);
6660 
6661 	/*
6662 	 * Create rest of the regwins
6663 	 */
6664 
6665 	/* Don't re-create common regwin, if it is already created */
6666 	i = BWI_REGWIN_EXIST(&sc->sc_com_regwin) ? 1 : 0;
6667 
6668 	for (; i < nregwin; ++i) {
6669 		/*
6670 		 * Get regwin information
6671 		 */
6672 		error = bwi_regwin_select(sc, i);
6673 		if (error) {
6674 			printf("%s: can't select regwin %d\n",
6675 			    sc->sc_dev.dv_xname, i);
6676 			return (error);
6677 		}
6678 		bwi_regwin_info(sc, &rw_type, &rw_rev);
6679 
6680 		/*
6681 		 * Try attach:
6682 		 * 1) Bus (PCI/PCIE) regwin
6683 		 * 2) MAC regwin
6684 		 * Ignore rest types of regwin
6685 		 */
6686 		if (rw_type == BWI_REGWIN_T_BUSPCI ||
6687 		    rw_type == BWI_REGWIN_T_BUSPCIE) {
6688 			if (BWI_REGWIN_EXIST(&sc->sc_bus_regwin)) {
6689 				printf("%s: bus regwin already exists\n",
6690 				    sc->sc_dev.dv_xname);
6691 			} else {
6692 				BWI_CREATE_REGWIN(&sc->sc_bus_regwin, i,
6693 				    rw_type, rw_rev);
6694 			}
6695 		} else if (rw_type == BWI_REGWIN_T_MAC) {
6696 			/* XXX ignore return value */
6697 			bwi_mac_attach(sc, i, rw_rev);
6698 		}
6699 	}
6700 
6701 	/* At least one MAC shold exist */
6702 	if (!BWI_REGWIN_EXIST(&sc->sc_mac[0].mac_regwin)) {
6703 		printf("%s: no MAC was found\n", sc->sc_dev.dv_xname);
6704 		return (ENXIO);
6705 	}
6706 	KASSERT(sc->sc_nmac > 0);
6707 
6708 	/* Bus regwin must exist */
6709 	if (!BWI_REGWIN_EXIST(&sc->sc_bus_regwin)) {
6710 		printf("%s: no bus regwin was found\n", sc->sc_dev.dv_xname);
6711 		return (ENXIO);
6712 	}
6713 
6714 	/* Start with first MAC */
6715 	error = bwi_regwin_switch(sc, &sc->sc_mac[0].mac_regwin, NULL);
6716 	if (error)
6717 		return (error);
6718 
6719 	return (0);
6720 }
6721 
6722 int
6723 bwi_bus_init(struct bwi_softc *sc, struct bwi_mac *mac)
6724 {
6725 	struct bwi_regwin *old, *bus;
6726 	uint32_t val;
6727 	int error;
6728 
6729 	bus = &sc->sc_bus_regwin;
6730 	KASSERT(sc->sc_cur_regwin == &mac->mac_regwin);
6731 
6732 	/*
6733 	 * Tell bus to generate requested interrupts
6734 	 */
6735 	if (bus->rw_rev < 6 && bus->rw_type == BWI_REGWIN_T_BUSPCI) {
6736 		/*
6737 		 * NOTE: Read BWI_FLAGS from MAC regwin
6738 		 */
6739 		val = CSR_READ_4(sc, BWI_FLAGS);
6740 
6741 		error = bwi_regwin_switch(sc, bus, &old);
6742 		if (error)
6743 			return (error);
6744 
6745 		CSR_SETBITS_4(sc, BWI_INTRVEC, (val & BWI_FLAGS_INTR_MASK));
6746 	} else {
6747 		uint32_t mac_mask;
6748 
6749 		mac_mask = 1 << mac->mac_id;
6750 
6751 		error = bwi_regwin_switch(sc, bus, &old);
6752 		if (error)
6753 			return (error);
6754 
6755 		val = (sc->sc_conf_read)(sc, BWI_PCIR_INTCTL);
6756 		val |= mac_mask << 8;
6757 		(sc->sc_conf_write)(sc, BWI_PCIR_INTCTL, val);
6758 	}
6759 
6760 	if (sc->sc_flags & BWI_F_BUS_INITED)
6761 		goto back;
6762 
6763 	if (bus->rw_type == BWI_REGWIN_T_BUSPCI) {
6764 		/*
6765 		 * Enable prefetch and burst
6766 		 */
6767 		CSR_SETBITS_4(sc, BWI_BUS_CONFIG,
6768 		    BWI_BUS_CONFIG_PREFETCH | BWI_BUS_CONFIG_BURST);
6769 
6770 		if (bus->rw_rev < 5) {
6771 			struct bwi_regwin *com = &sc->sc_com_regwin;
6772 
6773 			/*
6774 			 * Configure timeouts for bus operation
6775 			 */
6776 
6777 			/*
6778 			 * Set service timeout and request timeout
6779 			 */
6780 			CSR_SETBITS_4(sc, BWI_CONF_LO,
6781 			    __SHIFTIN(BWI_CONF_LO_SERVTO,
6782 			    BWI_CONF_LO_SERVTO_MASK) |
6783 			    __SHIFTIN(BWI_CONF_LO_REQTO,
6784 			    BWI_CONF_LO_REQTO_MASK));
6785 
6786 			/*
6787 			 * If there is common regwin, we switch to that regwin
6788 			 * and switch back to bus regwin once we have done.
6789 			 */
6790 			if (BWI_REGWIN_EXIST(com)) {
6791 				error = bwi_regwin_switch(sc, com, NULL);
6792 				if (error)
6793 					return (error);
6794 			}
6795 
6796 			/* Let bus know what we have changed */
6797 			CSR_WRITE_4(sc, BWI_BUS_ADDR, BWI_BUS_ADDR_MAGIC);
6798 			CSR_READ_4(sc, BWI_BUS_ADDR); /* Flush */
6799 			CSR_WRITE_4(sc, BWI_BUS_DATA, 0);
6800 			CSR_READ_4(sc, BWI_BUS_DATA); /* Flush */
6801 
6802 			if (BWI_REGWIN_EXIST(com)) {
6803 				error = bwi_regwin_switch(sc, bus, NULL);
6804 				if (error)
6805 					return (error);
6806 			}
6807 		} else if (bus->rw_rev >= 11) {
6808 			/*
6809 			 * Enable memory read multiple
6810 			 */
6811 			CSR_SETBITS_4(sc, BWI_BUS_CONFIG, BWI_BUS_CONFIG_MRM);
6812 		}
6813 	} else {
6814 		/* TODO: PCIE */
6815 	}
6816 
6817 	sc->sc_flags |= BWI_F_BUS_INITED;
6818 back:
6819 	return (bwi_regwin_switch(sc, old, NULL));
6820 }
6821 
6822 void
6823 bwi_get_card_flags(struct bwi_softc *sc)
6824 {
6825 	sc->sc_card_flags = bwi_read_sprom(sc, BWI_SPROM_CARD_FLAGS);
6826 	if (sc->sc_card_flags == 0xffff)
6827 		sc->sc_card_flags = 0;
6828 
6829 	if (sc->sc_pci_subvid == PCI_VENDOR_APPLE &&
6830 	    sc->sc_pci_subdid == 0x4e && /* XXX */
6831 	    sc->sc_pci_revid > 0x40)
6832 		sc->sc_card_flags |= BWI_CARD_F_PA_GPIO9;
6833 
6834 	DPRINTF(1, "%s: card flags 0x%04x\n",
6835 	    sc->sc_dev.dv_xname, sc->sc_card_flags);
6836 }
6837 
6838 void
6839 bwi_get_eaddr(struct bwi_softc *sc, uint16_t eaddr_ofs, uint8_t *eaddr)
6840 {
6841 	int i;
6842 
6843 	for (i = 0; i < 3; ++i) {
6844 		*((uint16_t *)eaddr + i) =
6845 		    htobe16(bwi_read_sprom(sc, eaddr_ofs + 2 * i));
6846 	}
6847 }
6848 
6849 void
6850 bwi_get_clock_freq(struct bwi_softc *sc, struct bwi_clock_freq *freq)
6851 {
6852 	struct bwi_regwin *com;
6853 	uint32_t val;
6854 	uint div;
6855 	int src;
6856 
6857 	bzero(freq, sizeof(*freq));
6858 	com = &sc->sc_com_regwin;
6859 
6860 	KASSERT(BWI_REGWIN_EXIST(com));
6861 	KASSERT(sc->sc_cur_regwin == com);
6862 	KASSERT(sc->sc_cap & BWI_CAP_CLKMODE);
6863 
6864 	/*
6865 	 * Calculate clock frequency
6866 	 */
6867 	src = -1;
6868 	div = 0;
6869 	if (com->rw_rev < 6) {
6870 		val = (sc->sc_conf_read)(sc, BWI_PCIR_GPIO_OUT);
6871 		if (val & BWI_PCIM_GPIO_OUT_CLKSRC) {
6872 			src = BWI_CLKSRC_PCI;
6873 			div = 64;
6874 		} else {
6875 			src = BWI_CLKSRC_CS_OSC;
6876 			div = 32;
6877 		}
6878 	} else if (com->rw_rev < 10) {
6879 		val = CSR_READ_4(sc, BWI_CLOCK_CTRL);
6880 
6881 		src = __SHIFTOUT(val, BWI_CLOCK_CTRL_CLKSRC);
6882 		if (src == BWI_CLKSRC_LP_OSC)
6883 			div = 1;
6884 		else {
6885 			div = (__SHIFTOUT(val, BWI_CLOCK_CTRL_FDIV) + 1) << 2;
6886 
6887 			/* Unknown source */
6888 			if (src >= BWI_CLKSRC_MAX)
6889 				src = BWI_CLKSRC_CS_OSC;
6890 		}
6891 	} else {
6892 		val = CSR_READ_4(sc, BWI_CLOCK_INFO);
6893 
6894 		src = BWI_CLKSRC_CS_OSC;
6895 		div = (__SHIFTOUT(val, BWI_CLOCK_INFO_FDIV) + 1) << 2;
6896 	}
6897 
6898 	KASSERT(src >= 0 && src < BWI_CLKSRC_MAX);
6899 	KASSERT(div != 0);
6900 
6901 	DPRINTF(1, "%s: clksrc %s\n",
6902 	    sc->sc_dev.dv_xname,
6903 	    src == BWI_CLKSRC_PCI ? "PCI" :
6904 	    (src == BWI_CLKSRC_LP_OSC ? "LP_OSC" : "CS_OSC"));
6905 
6906 	freq->clkfreq_min = bwi_clkfreq[src].freq_min / div;
6907 	freq->clkfreq_max = bwi_clkfreq[src].freq_max / div;
6908 
6909 	DPRINTF(1, "%s: clkfreq min %u, max %u\n",
6910 	    sc->sc_dev.dv_xname, freq->clkfreq_min, freq->clkfreq_max);
6911 }
6912 
6913 int
6914 bwi_set_clock_mode(struct bwi_softc *sc, enum bwi_clock_mode clk_mode)
6915 {
6916 	struct bwi_regwin *old, *com;
6917 	uint32_t clk_ctrl, clk_src;
6918 	int error, pwr_off = 0;
6919 
6920 	com = &sc->sc_com_regwin;
6921 	if (!BWI_REGWIN_EXIST(com))
6922 		return (0);
6923 
6924 	if (com->rw_rev >= 10 || com->rw_rev < 6)
6925 		return (0);
6926 
6927 	/*
6928 	 * For common regwin whose rev is [6, 10), the chip
6929 	 * must be capable to change clock mode.
6930 	 */
6931 	if ((sc->sc_cap & BWI_CAP_CLKMODE) == 0)
6932 		return (0);
6933 
6934 	error = bwi_regwin_switch(sc, com, &old);
6935 	if (error)
6936 		return (error);
6937 
6938 	if (clk_mode == BWI_CLOCK_MODE_FAST)
6939 		bwi_power_on(sc, 0);	/* Don't turn on PLL */
6940 
6941 	clk_ctrl = CSR_READ_4(sc, BWI_CLOCK_CTRL);
6942 	clk_src = __SHIFTOUT(clk_ctrl, BWI_CLOCK_CTRL_CLKSRC);
6943 
6944 	switch (clk_mode) {
6945 	case BWI_CLOCK_MODE_FAST:
6946 		clk_ctrl &= ~BWI_CLOCK_CTRL_SLOW;
6947 		clk_ctrl |= BWI_CLOCK_CTRL_IGNPLL;
6948 		break;
6949 	case BWI_CLOCK_MODE_SLOW:
6950 		clk_ctrl |= BWI_CLOCK_CTRL_SLOW;
6951 		break;
6952 	case BWI_CLOCK_MODE_DYN:
6953 		clk_ctrl &= ~(BWI_CLOCK_CTRL_SLOW |
6954 		    BWI_CLOCK_CTRL_IGNPLL |
6955 		    BWI_CLOCK_CTRL_NODYN);
6956 		if (clk_src != BWI_CLKSRC_CS_OSC) {
6957 			clk_ctrl |= BWI_CLOCK_CTRL_NODYN;
6958 			pwr_off = 1;
6959 		}
6960 		break;
6961 	}
6962 	CSR_WRITE_4(sc, BWI_CLOCK_CTRL, clk_ctrl);
6963 
6964 	if (pwr_off)
6965 		bwi_power_off(sc, 0);	/* Leave PLL as it is */
6966 
6967 	return (bwi_regwin_switch(sc, old, NULL));
6968 }
6969 
6970 int
6971 bwi_set_clock_delay(struct bwi_softc *sc)
6972 {
6973 	struct bwi_regwin *old, *com;
6974 	int error;
6975 
6976 	com = &sc->sc_com_regwin;
6977 	if (!BWI_REGWIN_EXIST(com))
6978 		return (0);
6979 
6980 	error = bwi_regwin_switch(sc, com, &old);
6981 	if (error)
6982 		return (error);
6983 
6984 	if (sc->sc_bbp_id == BWI_BBPID_BCM4321) {
6985 		if (sc->sc_bbp_rev == 0)
6986 			CSR_WRITE_4(sc, BWI_CONTROL, BWI_CONTROL_MAGIC0);
6987 		else if (sc->sc_bbp_rev == 1)
6988 			CSR_WRITE_4(sc, BWI_CONTROL, BWI_CONTROL_MAGIC1);
6989 	}
6990 
6991 	if (sc->sc_cap & BWI_CAP_CLKMODE) {
6992 		if (com->rw_rev >= 10)
6993 			CSR_FILT_SETBITS_4(sc, BWI_CLOCK_INFO, 0xffff, 0x40000);
6994 		else {
6995 			struct bwi_clock_freq freq;
6996 
6997 			bwi_get_clock_freq(sc, &freq);
6998 			CSR_WRITE_4(sc, BWI_PLL_ON_DELAY,
6999 			    howmany(freq.clkfreq_max * 150, 1000000));
7000 			CSR_WRITE_4(sc, BWI_FREQ_SEL_DELAY,
7001 			    howmany(freq.clkfreq_max * 15, 1000000));
7002 		}
7003 	}
7004 
7005 	return (bwi_regwin_switch(sc, old, NULL));
7006 }
7007 
7008 int
7009 bwi_init(struct ifnet *ifp)
7010 {
7011 	struct bwi_softc *sc = ifp->if_softc;
7012 
7013 	bwi_init_statechg(sc, 1);
7014 
7015 	return (0);
7016 }
7017 
7018 void
7019 bwi_init_statechg(struct bwi_softc *sc, int statechg)
7020 {
7021 	struct ieee80211com *ic = &sc->sc_ic;
7022 	struct ifnet *ifp = &ic->ic_if;
7023 	struct bwi_mac *mac;
7024 	int error;
7025 
7026 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7027 
7028 	error = bwi_stop(sc, statechg);
7029 	if (error) {
7030 		DPRINTF(1, "%s: can't stop\n", sc->sc_dev.dv_xname);
7031 		return;
7032 	}
7033 
7034 	/* power on cardbus socket */
7035 	if (sc->sc_enable != NULL)
7036 		(*sc->sc_enable)(sc);
7037 
7038 	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
7039 
7040 	/* TODO: 2 MAC */
7041 
7042 	mac = &sc->sc_mac[0];
7043 	error = bwi_regwin_switch(sc, &mac->mac_regwin, NULL);
7044 	if (error)
7045 		goto back;
7046 
7047 	error = bwi_mac_init(mac);
7048 	if (error)
7049 		goto back;
7050 
7051 	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_DYN);
7052 
7053 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
7054 
7055 	bwi_set_bssid(sc, bwi_zero_addr);	/* Clear BSSID */
7056 	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_MYADDR, ic->ic_myaddr);
7057 
7058 	bwi_mac_reset_hwkeys(mac);
7059 
7060 	if ((mac->mac_flags & BWI_MAC_F_HAS_TXSTATS) == 0) {
7061 		int i;
7062 
7063 #define NRETRY	1000
7064 		/*
7065 		 * Drain any possible pending TX status
7066 		 */
7067 		for (i = 0; i < NRETRY; ++i) {
7068 			if ((CSR_READ_4(sc, BWI_TXSTATUS_0) &
7069 			     BWI_TXSTATUS_0_MORE) == 0)
7070 				break;
7071 			CSR_READ_4(sc, BWI_TXSTATUS_1);
7072 		}
7073 		if (i == NRETRY)
7074 			printf("%s: can't drain TX status\n",
7075 			    sc->sc_dev.dv_xname);
7076 #undef NRETRY
7077 	}
7078 
7079 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11G)
7080 		bwi_mac_updateslot(mac, 1);
7081 
7082 	/* Start MAC */
7083 	error = bwi_mac_start(mac);
7084 	if (error)
7085 		goto back;
7086 
7087 	/* Enable intrs */
7088 	bwi_enable_intrs(sc, BWI_INIT_INTRS);
7089 
7090 	ifp->if_flags |= IFF_RUNNING;
7091 	ifp->if_flags &= ~IFF_OACTIVE;
7092 
7093 	if (statechg) {
7094 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
7095 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
7096 		} else {
7097 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
7098 		}
7099 	} else {
7100 		ieee80211_new_state(ic, ic->ic_state, -1);
7101 	}
7102 
7103 back:
7104 	if (error)
7105 		bwi_stop(sc, 1);
7106 	else
7107 		bwi_start(ifp);
7108 }
7109 
7110 int
7111 bwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
7112 {
7113 	struct bwi_softc *sc = ifp->if_softc;
7114 	struct ieee80211com *ic = &sc->sc_ic;
7115 	struct ifaddr *ifa;
7116 	struct ifreq *ifr;
7117 	int s, error = 0;
7118 	uint8_t chan;
7119 
7120 	s = splnet();
7121 
7122 	switch (cmd) {
7123 	case SIOCSIFADDR:
7124 		ifa = (struct ifaddr *)data;
7125 		ifp->if_flags |= IFF_UP;
7126 #ifdef INET
7127 		if (ifa->ifa_addr->sa_family == AF_INET)
7128 			arp_ifinit(&ic->ic_ac, ifa);
7129 #endif
7130 		/* FALLTHROUGH */
7131 	case SIOCSIFFLAGS:
7132 		if (ifp->if_flags & IFF_UP) {
7133 			if ((ifp->if_flags & IFF_RUNNING) == 0)
7134 				bwi_init(ifp);
7135 		} else {
7136 			if (ifp->if_flags & IFF_RUNNING)
7137 				bwi_stop(sc, 1);
7138 		}
7139 		break;
7140         case SIOCADDMULTI:
7141         case SIOCDELMULTI:
7142 		ifr = (struct ifreq *)data;
7143 		error = (cmd == SIOCADDMULTI) ?
7144 		    ether_addmulti(ifr, &ic->ic_ac) :
7145 		    ether_delmulti(ifr, &ic->ic_ac);
7146 
7147 		if (error == ENETRESET)
7148 			error = 0;
7149 		break;
7150 	case SIOCS80211CHANNEL:
7151 		/* allow fast channel switching in monitor mode */
7152 		error = ieee80211_ioctl(ifp, cmd, data);
7153 		if (error == ENETRESET &&
7154 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
7155 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
7156 			    (IFF_UP | IFF_RUNNING)) {
7157 				ic->ic_bss->ni_chan = ic->ic_ibss_chan;
7158 				chan = ieee80211_chan2ieee(ic,
7159 				    ic->ic_bss->ni_chan);
7160 				bwi_set_chan(sc, chan);
7161 			}
7162 			error = 0;
7163 		}
7164 		break;
7165 	default:
7166 		error = ieee80211_ioctl(ifp, cmd, data);
7167 		break;
7168 	}
7169 
7170 	if (error == ENETRESET) {
7171 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
7172 		    (IFF_UP | IFF_RUNNING))
7173 			bwi_init(ifp);
7174 		error = 0;
7175 	}
7176 
7177 	splx(s);
7178 
7179 	return (error);
7180 }
7181 
7182 void
7183 bwi_start(struct ifnet *ifp)
7184 {
7185 	struct bwi_softc *sc = ifp->if_softc;
7186 	struct ieee80211com *ic = &sc->sc_ic;
7187 	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
7188 	int trans, idx;
7189 
7190 	if ((ifp->if_flags & IFF_OACTIVE) || (ifp->if_flags & IFF_RUNNING) == 0)
7191 		return;
7192 
7193 	trans = 0;
7194 	idx = tbd->tbd_idx;
7195 
7196 	while (tbd->tbd_buf[idx].tb_mbuf == NULL) {
7197 		struct ieee80211_frame *wh;
7198 		struct ieee80211_node *ni;
7199 		struct ieee80211_key *k;
7200 		struct mbuf *m;
7201 		int mgt_pkt = 0;
7202 
7203 		IF_POLL(&ic->ic_mgtq, m);
7204 		if (m != NULL) {
7205 			IF_DEQUEUE(&ic->ic_mgtq, m);
7206 
7207 			ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
7208 			m->m_pkthdr.rcvif = NULL;
7209 
7210 			mgt_pkt = 1;
7211 		} else {
7212 			struct ether_header *eh;
7213 
7214 			if (ic->ic_state != IEEE80211_S_RUN)
7215 				break;
7216 
7217 			IFQ_POLL(&ifp->if_snd, m);
7218 			if (m == NULL)
7219 				break;
7220 
7221 			IFQ_DEQUEUE(&ifp->if_snd, m);
7222 
7223 			if (m->m_len < sizeof(*eh)) {
7224 				m = m_pullup(m, sizeof(*eh));
7225 				if (m == NULL) {
7226 					ifp->if_oerrors++;
7227 					continue;
7228 				}
7229 			}
7230 			eh = mtod(m, struct ether_header *);
7231 
7232 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
7233 			if (ni == NULL) {
7234 				m_freem(m);
7235 				ifp->if_oerrors++;
7236 				continue;
7237 			}
7238 
7239 			/* TODO: PS */
7240 #if NBPFILTER > 0
7241 			if (ifp->if_bpf != NULL)
7242 				bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
7243 #endif
7244 			m = ieee80211_encap(ifp, m, &ni);
7245 			if (m == NULL)
7246 				continue;
7247 		}
7248 #if NBPFILTER > 0
7249 		if (ic->ic_rawbpf != NULL)
7250 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
7251 #endif
7252 		wh = mtod(m, struct ieee80211_frame *);
7253 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
7254 			k = ieee80211_get_txkey(ic, wh, ni);
7255 			if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
7256 				return;
7257 		}
7258 		wh = NULL;	/* Catch any invalid use */
7259 
7260 		if (mgt_pkt) {
7261 			ieee80211_release_node(ic, ni);
7262 			ni = NULL;
7263 		}
7264 
7265 		if (bwi_encap(sc, idx, m, ni) != 0) {
7266 			/* 'm' is freed in bwi_encap() if we reach here */
7267 			if (ni != NULL)
7268 				ieee80211_release_node(ic, ni);
7269 			ifp->if_oerrors++;
7270 			continue;
7271 		}
7272 
7273 		trans = 1;
7274 		tbd->tbd_used++;
7275 		idx = (idx + 1) % BWI_TX_NDESC;
7276 
7277 		if (tbd->tbd_used + BWI_TX_NSPRDESC >= BWI_TX_NDESC) {
7278 			ifp->if_flags |= IFF_OACTIVE;
7279 			break;
7280 		}
7281 	}
7282 	tbd->tbd_idx = idx;
7283 
7284 	if (trans)
7285 		sc->sc_tx_timer = 5;
7286 	ifp->if_timer = 1;
7287 }
7288 
7289 void
7290 bwi_watchdog(struct ifnet *ifp)
7291 {
7292 	struct bwi_softc *sc = ifp->if_softc;
7293 
7294 	ifp->if_timer = 0;
7295 
7296 	if ((ifp->if_flags & IFF_RUNNING) == 0)
7297 		return;
7298 
7299 	if (sc->sc_tx_timer) {
7300 		if (--sc->sc_tx_timer == 0) {
7301 			printf("%s: watchdog timeout\n",
7302 			    sc->sc_dev.dv_xname);
7303 			ifp->if_oerrors++;
7304 			/* TODO */
7305 		} else
7306 			ifp->if_timer = 1;
7307 	}
7308 
7309 	ieee80211_watchdog(ifp);
7310 }
7311 
7312 void
7313 bwi_newstate_begin(struct bwi_softc *sc, enum ieee80211_state nstate)
7314 {
7315 	timeout_del(&sc->sc_scan_ch);
7316 	timeout_del(&sc->sc_calib_ch);
7317 
7318 	bwi_led_newstate(sc, nstate);
7319 
7320 	if (nstate == IEEE80211_S_INIT)
7321 		sc->sc_txpwrcb_type = BWI_TXPWR_INIT;
7322 }
7323 
7324 int
7325 bwi_stop(struct bwi_softc *sc, int state_chg)
7326 {
7327 	struct ieee80211com *ic = &sc->sc_ic;
7328 	struct ifnet *ifp = &ic->ic_if;
7329 	struct bwi_mac *mac;
7330 	int i, error, pwr_off = 0;
7331 
7332 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7333 
7334 	if (state_chg)
7335 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
7336 	else
7337 		bwi_newstate_begin(sc, IEEE80211_S_INIT);
7338 
7339 	if (ifp->if_flags & IFF_RUNNING) {
7340 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
7341 		mac = (struct bwi_mac *)sc->sc_cur_regwin;
7342 
7343 		bwi_disable_intrs(sc, BWI_ALL_INTRS);
7344 		CSR_READ_4(sc, BWI_MAC_INTR_MASK);
7345 		bwi_mac_stop(mac);
7346 	}
7347 
7348 	for (i = 0; i < sc->sc_nmac; ++i) {
7349 		struct bwi_regwin *old_rw;
7350 
7351 		mac = &sc->sc_mac[i];
7352 		if ((mac->mac_flags & BWI_MAC_F_INITED) == 0)
7353 			continue;
7354 
7355 		error = bwi_regwin_switch(sc, &mac->mac_regwin, &old_rw);
7356 		if (error)
7357 			continue;
7358 
7359 		bwi_mac_shutdown(mac);
7360 		pwr_off = 1;
7361 
7362 		bwi_regwin_switch(sc, old_rw, NULL);
7363 	}
7364 
7365 	if (pwr_off)
7366 		bwi_bbp_power_off(sc);
7367 
7368 	sc->sc_tx_timer = 0;
7369 	ifp->if_timer = 0;
7370 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
7371 
7372 	/* power off cardbus socket */
7373 	if (sc->sc_disable)
7374 		sc->sc_disable(sc);
7375 
7376 	return (0);
7377 }
7378 
7379 int
7380 bwi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
7381 {
7382 	struct bwi_softc *sc = ic->ic_if.if_softc;
7383 	struct ieee80211_node *ni;
7384 	int error;
7385 	uint8_t chan;
7386 
7387 	timeout_del(&sc->sc_amrr_ch);
7388 
7389 	bwi_newstate_begin(sc, nstate);
7390 
7391 	if (nstate == IEEE80211_S_INIT)
7392 		goto back;
7393 
7394 	chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
7395 	error = bwi_set_chan(sc, chan);
7396 	if (error) {
7397 		printf("%s: can't set channel to %u\n",
7398 		    sc->sc_dev.dv_xname,
7399 		    ieee80211_chan2ieee(ic, ic->ic_des_chan));
7400 		return (error);
7401 	}
7402 
7403 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
7404 		/* Nothing to do */
7405 	} else if (nstate == IEEE80211_S_RUN) {
7406 		struct bwi_mac *mac;
7407 
7408 		ni = ic->ic_bss;
7409 
7410 		bwi_set_bssid(sc, ic->ic_bss->ni_bssid);
7411 
7412 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
7413 		mac = (struct bwi_mac *)sc->sc_cur_regwin;
7414 
7415 		/* Initial TX power calibration */
7416 		bwi_mac_calibrate_txpower(mac, BWI_TXPWR_INIT);
7417 #ifdef notyet
7418 		sc->sc_txpwrcb_type = BWI_TXPWR_FORCE;
7419 #else
7420 		sc->sc_txpwrcb_type = BWI_TXPWR_CALIB;
7421 #endif
7422 		if (ic->ic_opmode == IEEE80211_M_STA) {
7423 			/* fake a join to init the tx rate */
7424 			bwi_newassoc(ic, ni, 1);
7425 		}
7426 
7427 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
7428 			/* start automatic rate control timer */
7429 			if (ic->ic_fixed_rate == -1)
7430 				timeout_add_msec(&sc->sc_amrr_ch, 500);
7431 		}
7432 	} else
7433 		bwi_set_bssid(sc, bwi_zero_addr);
7434 
7435 back:
7436 	error = sc->sc_newstate(ic, nstate, arg);
7437 
7438 	if (nstate == IEEE80211_S_SCAN) {
7439 		timeout_add_msec(&sc->sc_scan_ch, sc->sc_dwell_time);
7440 	} else if (nstate == IEEE80211_S_RUN) {
7441 		/* XXX 15 seconds */
7442 		timeout_add_sec(&sc->sc_calib_ch, 1);
7443 	}
7444 
7445 	return (error);
7446 }
7447 
7448 int
7449 bwi_media_change(struct ifnet *ifp)
7450 {
7451 	int error;
7452 
7453 	error = ieee80211_media_change(ifp);
7454 	if (error != ENETRESET)
7455 		return (error);
7456 
7457 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
7458 		bwi_init(ifp);
7459 
7460 	return (0);
7461 }
7462 
7463 void
7464 bwi_iter_func(void *arg, struct ieee80211_node *ni)
7465 {
7466 	struct bwi_softc *sc = arg;
7467 	struct bwi_node *bn = (struct bwi_node *)ni;
7468 
7469 	ieee80211_amrr_choose(&sc->sc_amrr, ni, &bn->amn);
7470 }
7471 
7472 void
7473 bwi_amrr_timeout(void *arg)
7474 {
7475 	struct bwi_softc *sc = arg;
7476 	struct ieee80211com *ic = &sc->sc_ic;
7477 
7478 	if (ic->ic_opmode == IEEE80211_M_STA)
7479 		bwi_iter_func(sc, ic->ic_bss);
7480 #ifndef IEEE80211_STA_ONLY
7481 	else
7482 		ieee80211_iterate_nodes(ic, bwi_iter_func, sc);
7483 #endif
7484 
7485 	timeout_add_msec(&sc->sc_amrr_ch, 500);
7486 }
7487 
7488 void
7489 bwi_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
7490 {
7491 	struct bwi_softc *sc = ic->ic_if.if_softc;
7492 	int i;
7493 
7494 	DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
7495 
7496 	ieee80211_amrr_node_init(&sc->sc_amrr, &((struct bwi_node *)ni)->amn);
7497 
7498 	/* set rate to some reasonable initial value */
7499 	for (i = ni->ni_rates.rs_nrates - 1;
7500 	    i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
7501 	    i--);
7502 
7503 	ni->ni_txrate = i;
7504 }
7505 
7506 struct ieee80211_node *
7507 bwi_node_alloc(struct ieee80211com *ic)
7508 {
7509 	struct bwi_node *bn;
7510 
7511 	bn = malloc(sizeof(*bn), M_DEVBUF, M_NOWAIT | M_ZERO);
7512 	if (bn == NULL)
7513 		return (NULL);
7514 
7515 	return ((struct ieee80211_node *)bn);
7516 }
7517 
7518 int
7519 bwi_dma_alloc(struct bwi_softc *sc)
7520 {
7521 	int error, i, has_txstats;
7522 	bus_size_t tx_ring_sz, rx_ring_sz, desc_sz = 0;
7523 	uint32_t txrx_ctrl_step = 0;
7524 
7525 	has_txstats = 0;
7526 	for (i = 0; i < sc->sc_nmac; ++i) {
7527 		if (sc->sc_mac[i].mac_flags & BWI_MAC_F_HAS_TXSTATS) {
7528 			has_txstats = 1;
7529 			break;
7530 		}
7531 	}
7532 
7533 	switch (sc->sc_bus_space) {
7534 	case BWI_BUS_SPACE_30BIT:
7535 	case BWI_BUS_SPACE_32BIT:
7536 		desc_sz = sizeof(struct bwi_desc32);
7537 		txrx_ctrl_step = 0x20;
7538 
7539 		sc->sc_init_tx_ring = bwi_init_tx_ring32;
7540 		sc->sc_free_tx_ring = bwi_free_tx_ring32;
7541 		sc->sc_init_rx_ring = bwi_init_rx_ring32;
7542 		sc->sc_free_rx_ring = bwi_free_rx_ring32;
7543 		sc->sc_setup_rxdesc = bwi_setup_rx_desc32;
7544 		sc->sc_setup_txdesc = bwi_setup_tx_desc32;
7545 		sc->sc_rxeof = bwi_rxeof32;
7546 		sc->sc_start_tx = bwi_start_tx32;
7547 		if (has_txstats) {
7548 			sc->sc_init_txstats = bwi_init_txstats32;
7549 			sc->sc_free_txstats = bwi_free_txstats32;
7550 			sc->sc_txeof_status = bwi_txeof_status32;
7551 		}
7552 		break;
7553 
7554 	case BWI_BUS_SPACE_64BIT:
7555 		desc_sz = sizeof(struct bwi_desc64);
7556 		txrx_ctrl_step = 0x40;
7557 
7558 		sc->sc_init_tx_ring = bwi_init_tx_ring64;
7559 		sc->sc_free_tx_ring = bwi_free_tx_ring64;
7560 		sc->sc_init_rx_ring = bwi_init_rx_ring64;
7561 		sc->sc_free_rx_ring = bwi_free_rx_ring64;
7562 		sc->sc_setup_rxdesc = bwi_setup_rx_desc64;
7563 		sc->sc_setup_txdesc = bwi_setup_tx_desc64;
7564 		sc->sc_rxeof = bwi_rxeof64;
7565 		sc->sc_start_tx = bwi_start_tx64;
7566 		if (has_txstats) {
7567 			sc->sc_init_txstats = bwi_init_txstats64;
7568 			sc->sc_free_txstats = bwi_free_txstats64;
7569 			sc->sc_txeof_status = bwi_txeof_status64;
7570 		}
7571 		break;
7572 	}
7573 
7574 	KASSERT(desc_sz != 0);
7575 	KASSERT(txrx_ctrl_step != 0);
7576 
7577 	tx_ring_sz = roundup(desc_sz * BWI_TX_NDESC, BWI_RING_ALIGN);
7578 	rx_ring_sz = roundup(desc_sz * BWI_RX_NDESC, BWI_RING_ALIGN);
7579 
7580 #define TXRX_CTRL(idx)	(BWI_TXRX_CTRL_BASE + (idx) * txrx_ctrl_step)
7581 	/*
7582 	 * Create TX ring DMA stuffs
7583 	 */
7584 	for (i = 0; i < BWI_TX_NRING; ++i) {
7585 		error = bus_dmamap_create(sc->sc_dmat, tx_ring_sz, 1,
7586 		    tx_ring_sz, 0, BUS_DMA_NOWAIT,
7587 		    &sc->sc_tx_rdata[i].rdata_dmap);
7588 		if (error) {
7589 			printf("%s: %dth TX ring DMA create failed\n",
7590 			    sc->sc_dev.dv_xname, i);
7591 			return (error);
7592 		}
7593 		error = bwi_dma_ring_alloc(sc,
7594 		    &sc->sc_tx_rdata[i], tx_ring_sz, TXRX_CTRL(i));
7595 		if (error) {
7596 			printf("%s: %dth TX ring DMA alloc failed\n",
7597 			    sc->sc_dev.dv_xname, i);
7598 			return (error);
7599 		}
7600 	}
7601 
7602 	/*
7603 	 * Create RX ring DMA stuffs
7604 	 */
7605 	error = bus_dmamap_create(sc->sc_dmat, rx_ring_sz, 1,
7606 	    rx_ring_sz, 0, BUS_DMA_NOWAIT,
7607 	    &sc->sc_rx_rdata.rdata_dmap);
7608 	if (error) {
7609 		printf("%s: RX ring DMA create failed\n", sc->sc_dev.dv_xname);
7610 		return (error);
7611 	}
7612 
7613 	error = bwi_dma_ring_alloc(sc, &sc->sc_rx_rdata,
7614 	    rx_ring_sz, TXRX_CTRL(0));
7615 	if (error) {
7616 		printf("%s: RX ring DMA alloc failed\n", sc->sc_dev.dv_xname);
7617 		return (error);
7618 	}
7619 
7620 	if (has_txstats) {
7621 		error = bwi_dma_txstats_alloc(sc, TXRX_CTRL(3), desc_sz);
7622 		if (error) {
7623 			printf("%s: TX stats DMA alloc failed\n",
7624 			    sc->sc_dev.dv_xname);
7625 			return (error);
7626 		}
7627 	}
7628 #undef TXRX_CTRL
7629 
7630 	return (bwi_dma_mbuf_create(sc));
7631 }
7632 
7633 void
7634 bwi_dma_free(struct bwi_softc *sc)
7635 {
7636 	struct bwi_ring_data *rd;
7637 	int i;
7638 
7639 	for (i = 0; i < BWI_TX_NRING; ++i) {
7640 		rd = &sc->sc_tx_rdata[i];
7641 
7642 		if (rd->rdata_desc != NULL) {
7643 			bus_dmamap_unload(sc->sc_dmat,
7644 			    rd->rdata_dmap);
7645 			bus_dmamem_free(sc->sc_dmat,
7646 			    &rd->rdata_seg, 1);
7647 		}
7648 	}
7649 
7650 	rd = &sc->sc_rx_rdata;
7651 
7652 	if (rd->rdata_desc != NULL) {
7653 		bus_dmamap_unload(sc->sc_dmat, rd->rdata_dmap);
7654 		bus_dmamem_free(sc->sc_dmat, &rd->rdata_seg, 1);
7655 	}
7656 
7657 	bwi_dma_txstats_free(sc);
7658 	bwi_dma_mbuf_destroy(sc, BWI_TX_NRING, 1);
7659 }
7660 
7661 int
7662 bwi_dma_ring_alloc(struct bwi_softc *sc,
7663     struct bwi_ring_data *rd, bus_size_t size, uint32_t txrx_ctrl)
7664 {
7665 	int error, nsegs;
7666 
7667 	error = bus_dmamem_alloc(sc->sc_dmat, size, BWI_ALIGN, 0,
7668 	    &rd->rdata_seg, 1, &nsegs, BUS_DMA_NOWAIT);
7669 	if (error) {
7670 		printf("%s: can't allocate DMA mem\n", sc->sc_dev.dv_xname);
7671 		return (error);
7672 	}
7673 
7674 	error = bus_dmamem_map(sc->sc_dmat, &rd->rdata_seg, nsegs,
7675 	    size, (caddr_t *)&rd->rdata_desc, BUS_DMA_NOWAIT);
7676 	if (error) {
7677 		printf("%s: can't map DMA mem\n", sc->sc_dev.dv_xname);
7678 		return (error);
7679 	}
7680 
7681 	error = bus_dmamap_load(sc->sc_dmat, rd->rdata_dmap, rd->rdata_desc,
7682 	    size, NULL, BUS_DMA_WAITOK);
7683 	if (error) {
7684 		printf("%s: can't load DMA mem\n", sc->sc_dev.dv_xname);
7685 		bus_dmamem_free(sc->sc_dmat, &rd->rdata_seg, nsegs);
7686 		rd->rdata_desc = NULL;
7687 		return (error);
7688 	}
7689 
7690 	rd->rdata_paddr = rd->rdata_dmap->dm_segs[0].ds_addr;
7691 	rd->rdata_txrx_ctrl = txrx_ctrl;
7692 
7693 	return (0);
7694 }
7695 
7696 int
7697 bwi_dma_txstats_alloc(struct bwi_softc *sc, uint32_t ctrl_base,
7698     bus_size_t desc_sz)
7699 {
7700 	struct bwi_txstats_data *st;
7701 	bus_size_t dma_size;
7702 	int error, nsegs;
7703 
7704 	st = malloc(sizeof(*st), M_DEVBUF, M_WAITOK | M_ZERO);
7705 	sc->sc_txstats = st;
7706 
7707 	/*
7708 	 * Create TX stats descriptor DMA stuffs
7709 	 */
7710 	dma_size = roundup(desc_sz * BWI_TXSTATS_NDESC, BWI_RING_ALIGN);
7711 
7712 	error = bus_dmamap_create(sc->sc_dmat, dma_size, 1, dma_size, 0,
7713 	    BUS_DMA_NOWAIT, &st->stats_ring_dmap);
7714 	if (error) {
7715 		printf("%s: can't create txstats ring DMA mem\n",
7716 		    sc->sc_dev.dv_xname);
7717 		return (error);
7718 	}
7719 
7720 	error = bus_dmamem_alloc(sc->sc_dmat, dma_size, BWI_RING_ALIGN, 0,
7721 	     &st->stats_ring_seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
7722 	if (error) {
7723 		printf("%s: can't allocate txstats ring DMA mem\n",
7724 		    sc->sc_dev.dv_xname);
7725 		return (error);
7726 	}
7727 
7728 	error = bus_dmamem_map(sc->sc_dmat, &st->stats_ring_seg, nsegs,
7729 	    dma_size, (caddr_t *)&st->stats_ring, BUS_DMA_NOWAIT);
7730 	if (error) {
7731 		printf("%s: can't map txstats ring DMA mem\n",
7732 		    sc->sc_dev.dv_xname);
7733 		return (error);
7734 	}
7735 
7736 	error = bus_dmamap_load(sc->sc_dmat, st->stats_ring_dmap,
7737 	    st->stats_ring, dma_size, NULL, BUS_DMA_WAITOK);
7738 	if (error) {
7739 		printf("%s: can't load txstats ring DMA mem\n",
7740 		    sc->sc_dev.dv_xname);
7741 		bus_dmamem_free(sc->sc_dmat, &st->stats_ring_seg, nsegs);
7742 		return (error);
7743 	}
7744 
7745 	st->stats_ring_paddr = st->stats_ring_dmap->dm_segs[0].ds_addr;
7746 
7747 	/*
7748 	 * Create TX stats DMA stuffs
7749 	 */
7750 	dma_size = roundup(sizeof(struct bwi_txstats) * BWI_TXSTATS_NDESC,
7751 	    BWI_ALIGN);
7752 
7753 	error = bus_dmamap_create(sc->sc_dmat, dma_size, 1, dma_size, 0,
7754 	    BUS_DMA_NOWAIT, &st->stats_dmap);
7755 	if (error) {
7756 		printf("%s: can't create txstats ring DMA mem\n",
7757 		    sc->sc_dev.dv_xname);
7758 		return (error);
7759 	}
7760 	error = bus_dmamem_alloc(sc->sc_dmat, dma_size, BWI_ALIGN, 0,
7761 	    &st->stats_seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
7762 	if (error) {
7763 		printf("%s: can't allocate txstats DMA mem\n",
7764 		    sc->sc_dev.dv_xname);
7765 		return (error);
7766 	}
7767 
7768 	error = bus_dmamem_map(sc->sc_dmat, &st->stats_seg, nsegs,
7769 	    dma_size, (caddr_t *)&st->stats, BUS_DMA_NOWAIT);
7770 	if (error) {
7771 		printf("%s: can't map txstats DMA mem\n", sc->sc_dev.dv_xname);
7772 		return (error);
7773 	}
7774 
7775 	error = bus_dmamap_load(sc->sc_dmat, st->stats_dmap, st->stats,
7776 	    dma_size, NULL, BUS_DMA_WAITOK);
7777 	if (error) {
7778 		printf("%s: can't load txstats DMA mem\n", sc->sc_dev.dv_xname);
7779 		bus_dmamem_free(sc->sc_dmat, &st->stats_seg, nsegs);
7780 		return (error);
7781 	}
7782 
7783 	st->stats_paddr = st->stats_dmap->dm_segs[0].ds_addr;
7784 	st->stats_ctrl_base = ctrl_base;
7785 
7786 	return (0);
7787 }
7788 
7789 void
7790 bwi_dma_txstats_free(struct bwi_softc *sc)
7791 {
7792 	struct bwi_txstats_data *st;
7793 
7794 	if (sc->sc_txstats == NULL)
7795 		return;
7796 	st = sc->sc_txstats;
7797 
7798 	bus_dmamap_unload(sc->sc_dmat, st->stats_ring_dmap);
7799 	bus_dmamem_free(sc->sc_dmat, &st->stats_ring_seg, 1);
7800 
7801 	bus_dmamap_unload(sc->sc_dmat, st->stats_dmap);
7802 	bus_dmamem_free(sc->sc_dmat, &st->stats_seg, 1);
7803 
7804 	free(st, M_DEVBUF);
7805 }
7806 
7807 int
7808 bwi_dma_mbuf_create(struct bwi_softc *sc)
7809 {
7810 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
7811 	int i, j, k, ntx, error;
7812 
7813 	ntx = 0;
7814 
7815 	/*
7816 	 * Create TX mbuf DMA map
7817 	 */
7818 	for (i = 0; i < BWI_TX_NRING; ++i) {
7819 		struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[i];
7820 
7821 		for (j = 0; j < BWI_TX_NDESC; ++j) {
7822 			error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
7823 			    0, BUS_DMA_NOWAIT, &tbd->tbd_buf[j].tb_dmap);
7824 			if (error) {
7825 				printf(
7826 				    "%s: can't create %dth tbd, %dth DMA map\n",
7827 				    sc->sc_dev.dv_xname, i, j);
7828 				ntx = i;
7829 				for (k = 0; k < j; ++k) {
7830 					bus_dmamap_destroy(sc->sc_dmat,
7831 					    tbd->tbd_buf[k].tb_dmap);
7832 				}
7833 				goto fail;
7834 			}
7835 		}
7836 	}
7837 	ntx = BWI_TX_NRING;
7838 
7839 	/*
7840 	 * Create RX mbuf DMA map and a spare DMA map
7841 	 */
7842 	error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0,
7843 	    BUS_DMA_NOWAIT, &rbd->rbd_tmp_dmap);
7844 	if (error) {
7845 		printf("%s: can't create spare RX buf DMA map\n",
7846 		    sc->sc_dev.dv_xname);
7847 		goto fail;
7848 	}
7849 
7850 	for (j = 0; j < BWI_RX_NDESC; ++j) {
7851 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0,
7852 		    BUS_DMA_NOWAIT, &rbd->rbd_buf[j].rb_dmap);
7853 		if (error) {
7854 			printf("%s: can't create %dth RX buf DMA map\n",
7855 			    sc->sc_dev.dv_xname, j);
7856 
7857 			for (k = 0; k < j; ++k) {
7858 				bus_dmamap_destroy(sc->sc_dmat,
7859 				    rbd->rbd_buf[j].rb_dmap);
7860 			}
7861 			bus_dmamap_destroy(sc->sc_dmat,
7862 			    rbd->rbd_tmp_dmap);
7863 			goto fail;
7864 		}
7865 	}
7866 
7867 	return 0;
7868 fail:
7869 	bwi_dma_mbuf_destroy(sc, ntx, 0);
7870 
7871 	return (error);
7872 }
7873 
7874 void
7875 bwi_dma_mbuf_destroy(struct bwi_softc *sc, int ntx, int nrx)
7876 {
7877 	struct ieee80211com *ic = &sc->sc_ic;
7878 	int i, j;
7879 
7880 	for (i = 0; i < ntx; ++i) {
7881 		struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[i];
7882 
7883 		for (j = 0; j < BWI_TX_NDESC; ++j) {
7884 			struct bwi_txbuf *tb = &tbd->tbd_buf[j];
7885 
7886 			if (tb->tb_mbuf != NULL) {
7887 				bus_dmamap_unload(sc->sc_dmat,
7888 				    tb->tb_dmap);
7889 				m_freem(tb->tb_mbuf);
7890 			}
7891 			if (tb->tb_ni != NULL)
7892 				ieee80211_release_node(ic, tb->tb_ni);
7893 			bus_dmamap_destroy(sc->sc_dmat, tb->tb_dmap);
7894 		}
7895 	}
7896 
7897 	if (nrx) {
7898 		struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
7899 
7900 		bus_dmamap_destroy(sc->sc_dmat, rbd->rbd_tmp_dmap);
7901 		for (j = 0; j < BWI_RX_NDESC; ++j) {
7902 			struct bwi_rxbuf *rb = &rbd->rbd_buf[j];
7903 
7904 			if (rb->rb_mbuf != NULL) {
7905 				bus_dmamap_unload(sc->sc_dmat,
7906 						  rb->rb_dmap);
7907 				m_freem(rb->rb_mbuf);
7908 			}
7909 			bus_dmamap_destroy(sc->sc_dmat, rb->rb_dmap);
7910 		}
7911 	}
7912 }
7913 
7914 void
7915 bwi_enable_intrs(struct bwi_softc *sc, uint32_t enable_intrs)
7916 {
7917 	CSR_SETBITS_4(sc, BWI_MAC_INTR_MASK, enable_intrs);
7918 }
7919 
7920 void
7921 bwi_disable_intrs(struct bwi_softc *sc, uint32_t disable_intrs)
7922 {
7923 	CSR_CLRBITS_4(sc, BWI_MAC_INTR_MASK, disable_intrs);
7924 }
7925 
7926 int
7927 bwi_init_tx_ring32(struct bwi_softc *sc, int ring_idx)
7928 {
7929 	struct bwi_ring_data *rd;
7930 	struct bwi_txbuf_data *tbd;
7931 	uint32_t val, addr_hi, addr_lo;
7932 
7933 	KASSERT(ring_idx < BWI_TX_NRING);
7934 	rd = &sc->sc_tx_rdata[ring_idx];
7935 	tbd = &sc->sc_tx_bdata[ring_idx];
7936 
7937 	tbd->tbd_idx = 0;
7938 	tbd->tbd_used = 0;
7939 
7940 	bzero(rd->rdata_desc, sizeof(struct bwi_desc32) * BWI_TX_NDESC);
7941 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
7942 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
7943 
7944 	addr_lo = __SHIFTOUT(rd->rdata_paddr, BWI_TXRX32_RINGINFO_ADDR_MASK);
7945 	addr_hi = __SHIFTOUT(rd->rdata_paddr, BWI_TXRX32_RINGINFO_FUNC_MASK);
7946 
7947 	val = __SHIFTIN(addr_lo, BWI_TXRX32_RINGINFO_ADDR_MASK) |
7948 	    __SHIFTIN(BWI_TXRX32_RINGINFO_FUNC_TXRX,
7949 	    BWI_TXRX32_RINGINFO_FUNC_MASK);
7950 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_RINGINFO, val);
7951 
7952 	val = __SHIFTIN(addr_hi, BWI_TXRX32_CTRL_ADDRHI_MASK) |
7953 	      BWI_TXRX32_CTRL_ENABLE;
7954 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, val);
7955 
7956 	return (0);
7957 }
7958 
7959 void
7960 bwi_init_rxdesc_ring32(struct bwi_softc *sc, uint32_t ctrl_base,
7961     bus_addr_t paddr, int hdr_size, int ndesc)
7962 {
7963 	uint32_t val, addr_hi, addr_lo;
7964 
7965 	addr_lo = __SHIFTOUT(paddr, BWI_TXRX32_RINGINFO_ADDR_MASK);
7966 	addr_hi = __SHIFTOUT(paddr, BWI_TXRX32_RINGINFO_FUNC_MASK);
7967 
7968 	val = __SHIFTIN(addr_lo, BWI_TXRX32_RINGINFO_ADDR_MASK) |
7969 	    __SHIFTIN(BWI_TXRX32_RINGINFO_FUNC_TXRX,
7970 	      		BWI_TXRX32_RINGINFO_FUNC_MASK);
7971 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_RINGINFO, val);
7972 
7973 	val = __SHIFTIN(hdr_size, BWI_RX32_CTRL_HDRSZ_MASK) |
7974 	    __SHIFTIN(addr_hi, BWI_TXRX32_CTRL_ADDRHI_MASK) |
7975 	    BWI_TXRX32_CTRL_ENABLE;
7976 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_CTRL, val);
7977 
7978 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
7979 	    (ndesc - 1) * sizeof(struct bwi_desc32));
7980 }
7981 
7982 int
7983 bwi_init_rx_ring32(struct bwi_softc *sc)
7984 {
7985 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
7986 	int i, error;
7987 
7988 	sc->sc_rx_bdata.rbd_idx = 0;
7989 
7990 	for (i = 0; i < BWI_RX_NDESC; ++i) {
7991 		error = bwi_newbuf(sc, i, 1);
7992 		if (error) {
7993 			printf("%s: can't allocate %dth RX buffer\n",
7994 			    sc->sc_dev.dv_xname, i);
7995 			return (error);
7996 		}
7997 	}
7998 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
7999 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8000 
8001 	bwi_init_rxdesc_ring32(sc, rd->rdata_txrx_ctrl, rd->rdata_paddr,
8002 	    sizeof(struct bwi_rxbuf_hdr), BWI_RX_NDESC);
8003 	return (0);
8004 }
8005 
8006 int
8007 bwi_init_txstats32(struct bwi_softc *sc)
8008 {
8009 	struct bwi_txstats_data *st = sc->sc_txstats;
8010 	bus_addr_t stats_paddr;
8011 	int i;
8012 
8013 	bzero(st->stats, BWI_TXSTATS_NDESC * sizeof(struct bwi_txstats));
8014 	bus_dmamap_sync(sc->sc_dmat, st->stats_dmap, 0,
8015 	    st->stats_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8016 
8017 	st->stats_idx = 0;
8018 
8019 	stats_paddr = st->stats_paddr;
8020 	for (i = 0; i < BWI_TXSTATS_NDESC; ++i) {
8021 		bwi_setup_desc32(sc, st->stats_ring, BWI_TXSTATS_NDESC, i,
8022 				 stats_paddr, sizeof(struct bwi_txstats), 0);
8023 		stats_paddr += sizeof(struct bwi_txstats);
8024 	}
8025 	bus_dmamap_sync(sc->sc_dmat, st->stats_ring_dmap, 0,
8026 	    st->stats_ring_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8027 
8028 	bwi_init_rxdesc_ring32(sc, st->stats_ctrl_base,
8029 	    st->stats_ring_paddr, 0, BWI_TXSTATS_NDESC);
8030 
8031 	return (0);
8032 }
8033 
8034 void
8035 bwi_setup_rx_desc32(struct bwi_softc *sc, int buf_idx, bus_addr_t paddr,
8036     int buf_len)
8037 {
8038 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8039 
8040 	KASSERT(buf_idx < BWI_RX_NDESC);
8041 	bwi_setup_desc32(sc, rd->rdata_desc, BWI_RX_NDESC, buf_idx,
8042 	    paddr, buf_len, 0);
8043 }
8044 
8045 void
8046 bwi_setup_tx_desc32(struct bwi_softc *sc, struct bwi_ring_data *rd,
8047     int buf_idx, bus_addr_t paddr, int buf_len)
8048 {
8049 	KASSERT(buf_idx < BWI_TX_NDESC);
8050 	bwi_setup_desc32(sc, rd->rdata_desc, BWI_TX_NDESC, buf_idx,
8051 	    paddr, buf_len, 1);
8052 }
8053 
8054 int
8055 bwi_init_tx_ring64(struct bwi_softc *sc, int ring_idx)
8056 {
8057 	/* TODO: 64 */
8058 	return (EOPNOTSUPP);
8059 }
8060 
8061 int
8062 bwi_init_rx_ring64(struct bwi_softc *sc)
8063 {
8064 	/* TODO: 64 */
8065 	return (EOPNOTSUPP);
8066 }
8067 
8068 int
8069 bwi_init_txstats64(struct bwi_softc *sc)
8070 {
8071 	/* TODO: 64 */
8072 	return (EOPNOTSUPP);
8073 }
8074 
8075 void
8076 bwi_setup_rx_desc64(struct bwi_softc *sc, int buf_idx, bus_addr_t paddr,
8077     int buf_len)
8078 {
8079 	/* TODO: 64 */
8080 }
8081 
8082 void
8083 bwi_setup_tx_desc64(struct bwi_softc *sc, struct bwi_ring_data *rd,
8084     int buf_idx, bus_addr_t paddr, int buf_len)
8085 {
8086 	/* TODO: 64 */
8087 }
8088 
8089 int
8090 bwi_newbuf(struct bwi_softc *sc, int buf_idx, int init)
8091 {
8092 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8093 	struct bwi_rxbuf *rxbuf = &rbd->rbd_buf[buf_idx];
8094 	struct bwi_rxbuf_hdr *hdr;
8095 	bus_dmamap_t map;
8096 	bus_addr_t paddr;
8097 	struct mbuf *m;
8098 	int error;
8099 
8100 	KASSERT(buf_idx < BWI_RX_NDESC);
8101 
8102 	MGETHDR(m, init ? M_WAITOK : M_DONTWAIT, MT_DATA);
8103 	if (m == NULL)
8104 		return (ENOBUFS);
8105 	MCLGET(m, init ? M_WAITOK : M_DONTWAIT);
8106 	if (m == NULL) {
8107 		error = ENOBUFS;
8108 
8109 		/*
8110 		 * If the NIC is up and running, we need to:
8111 		 * - Clear RX buffer's header.
8112 		 * - Restore RX descriptor settings.
8113 		 */
8114 		if (init)
8115 			return error;
8116 		else
8117 			goto back;
8118 	}
8119 	m->m_len = m->m_pkthdr.len = MCLBYTES;
8120 
8121 	/*
8122 	 * Try to load RX buf into temporary DMA map
8123 	 */
8124 	error = bus_dmamap_load_mbuf(sc->sc_dmat, rbd->rbd_tmp_dmap, m,
8125 	    init ? BUS_DMA_WAITOK : BUS_DMA_NOWAIT);
8126 	if (error) {
8127 		m_freem(m);
8128 
8129 		/*
8130 		 * See the comment above
8131 		 */
8132 		if (init)
8133 			return error;
8134 		else
8135 			goto back;
8136 	}
8137 
8138 	if (!init)
8139 		bus_dmamap_unload(sc->sc_dmat, rxbuf->rb_dmap);
8140 	rxbuf->rb_mbuf = m;
8141 
8142 	/*
8143 	 * Swap RX buf's DMA map with the loaded temporary one
8144 	 */
8145 	map = rxbuf->rb_dmap;
8146 	rxbuf->rb_dmap = rbd->rbd_tmp_dmap;
8147 	rbd->rbd_tmp_dmap = map;
8148 	paddr = rxbuf->rb_dmap->dm_segs[0].ds_addr;
8149 	rxbuf->rb_paddr = paddr;
8150 
8151 back:
8152 	/*
8153 	 * Clear RX buf header
8154 	 */
8155 	hdr = mtod(rxbuf->rb_mbuf, struct bwi_rxbuf_hdr *);
8156 	bzero(hdr, sizeof(*hdr));
8157 	bus_dmamap_sync(sc->sc_dmat, rxbuf->rb_dmap, 0,
8158 	    rxbuf->rb_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8159 
8160 	/*
8161 	 * Setup RX buf descriptor
8162 	 */
8163 	sc->sc_setup_rxdesc(sc, buf_idx, rxbuf->rb_paddr,
8164 	    rxbuf->rb_mbuf->m_len - sizeof(*hdr));
8165 	return error;
8166 }
8167 
8168 void
8169 bwi_set_addr_filter(struct bwi_softc *sc, uint16_t addr_ofs,
8170     const uint8_t *addr)
8171 {
8172 	int i;
8173 
8174 	CSR_WRITE_2(sc, BWI_ADDR_FILTER_CTRL,
8175 	    BWI_ADDR_FILTER_CTRL_SET | addr_ofs);
8176 
8177 	for (i = 0; i < (IEEE80211_ADDR_LEN / 2); ++i) {
8178 		uint16_t addr_val;
8179 
8180 		addr_val = (uint16_t)addr[i * 2] |
8181 		    (((uint16_t)addr[(i * 2) + 1]) << 8);
8182 		CSR_WRITE_2(sc, BWI_ADDR_FILTER_DATA, addr_val);
8183 	}
8184 }
8185 
8186 int
8187 bwi_set_chan(struct bwi_softc *sc, uint8_t chan)
8188 {
8189 	struct bwi_mac *mac;
8190 
8191 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
8192 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
8193 
8194 	bwi_rf_set_chan(mac, chan, 0);
8195 
8196 	return (0);
8197 }
8198 
8199 void
8200 bwi_next_scan(void *xsc)
8201 {
8202 	struct bwi_softc *sc = xsc;
8203 	struct ieee80211com *ic = &sc->sc_ic;
8204 	struct ifnet *ifp = &ic->ic_if;
8205 	int s;
8206 
8207 	s = splnet();
8208 
8209 	if (ic->ic_state == IEEE80211_S_SCAN)
8210 		ieee80211_next_scan(ifp);
8211 
8212 	splx(s);
8213 }
8214 
8215 int
8216 bwi_rxeof(struct bwi_softc *sc, int end_idx)
8217 {
8218 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8219 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8220 	struct ieee80211com *ic = &sc->sc_ic;
8221 	struct ifnet *ifp = &ic->ic_if;
8222 	int idx, rx_data = 0;
8223 
8224 	idx = rbd->rbd_idx;
8225 	while (idx != end_idx) {
8226 		struct bwi_rxbuf *rb = &rbd->rbd_buf[idx];
8227 		struct bwi_rxbuf_hdr *hdr;
8228 		struct ieee80211_frame *wh;
8229 		struct ieee80211_rxinfo rxi;
8230 		struct ieee80211_node *ni;
8231 		struct mbuf *m;
8232 		uint32_t plcp;
8233 		uint16_t flags2;
8234 		int buflen, wh_ofs, hdr_extra, rssi, type, rate;
8235 
8236 		m = rb->rb_mbuf;
8237 		bus_dmamap_sync(sc->sc_dmat, rb->rb_dmap, 0,
8238 		    rb->rb_dmap->dm_mapsize, BUS_DMASYNC_POSTREAD);
8239 
8240 		if (bwi_newbuf(sc, idx, 0)) {
8241 			ifp->if_ierrors++;
8242 			goto next;
8243 		}
8244 
8245 		hdr = mtod(m, struct bwi_rxbuf_hdr *);
8246 		flags2 = letoh16(hdr->rxh_flags2);
8247 
8248 		hdr_extra = 0;
8249 		if (flags2 & BWI_RXH_F2_TYPE2FRAME)
8250 			hdr_extra = 2;
8251 		wh_ofs = hdr_extra + 6;
8252 
8253 		buflen = letoh16(hdr->rxh_buflen);
8254 		if (buflen <= wh_ofs) {
8255 			printf("%s: zero length data, hdr_extra %d\n",
8256 			    sc->sc_dev.dv_xname, hdr_extra);
8257 			ifp->if_ierrors++;
8258 			m_freem(m);
8259 			goto next;
8260 		}
8261 
8262 		bcopy((uint8_t *)(hdr + 1) + hdr_extra, &plcp, sizeof(plcp));
8263 		rssi = bwi_calc_rssi(sc, hdr);
8264 
8265 		m->m_pkthdr.rcvif = ifp;
8266 		m->m_len = m->m_pkthdr.len = buflen + sizeof(*hdr);
8267 		m_adj(m, sizeof(*hdr) + wh_ofs);
8268 
8269 		if (htole16(hdr->rxh_flags1) & BWI_RXH_F1_OFDM)
8270 			rate = bwi_plcp2rate(plcp, IEEE80211_MODE_11G);
8271 		else
8272 			rate = bwi_plcp2rate(plcp, IEEE80211_MODE_11B);
8273 
8274 #if NBPFILTER > 0
8275 		/* RX radio tap */
8276 		if (sc->sc_drvbpf != NULL) {
8277 			struct mbuf mb;
8278 			struct bwi_rx_radiotap_hdr *tap = &sc->sc_rxtap;
8279 
8280 			tap->wr_tsf = hdr->rxh_tsf;
8281 			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
8282 			tap->wr_rate = rate;
8283 			tap->wr_chan_freq =
8284 			    htole16(ic->ic_bss->ni_chan->ic_freq);
8285 			tap->wr_chan_flags =
8286 			    htole16(ic->ic_bss->ni_chan->ic_flags);
8287 			tap->wr_antsignal = rssi;
8288 			tap->wr_antnoise = BWI_NOISE_FLOOR;
8289 
8290 			mb.m_data = (caddr_t)tap;
8291 			mb.m_len = sc->sc_rxtap_len;
8292 			mb.m_next = m;
8293 			mb.m_nextpkt = NULL;
8294 			mb.m_type = 0;
8295 			mb.m_flags = 0;
8296 			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
8297 		}
8298 #endif
8299 
8300 		m_adj(m, -IEEE80211_CRC_LEN);
8301 
8302 		wh = mtod(m, struct ieee80211_frame *);
8303 		ni = ieee80211_find_rxnode(ic, wh);
8304 		type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
8305 
8306 		rxi.rxi_rssi = hdr->rxh_rssi;
8307 		rxi.rxi_tstamp = letoh16(hdr->rxh_tsf);
8308 		ieee80211_input(ifp, m, ni, &rxi);
8309 
8310 		ieee80211_release_node(ic, ni);
8311 
8312 		if (type == IEEE80211_FC0_TYPE_DATA) {
8313 			rx_data = 1;
8314 			sc->sc_rx_rate = rate;
8315 		}
8316 next:
8317 		idx = (idx + 1) % BWI_RX_NDESC;
8318 	}
8319 
8320 	rbd->rbd_idx = idx;
8321 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
8322 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8323 
8324 	return (rx_data);
8325 }
8326 
8327 int
8328 bwi_rxeof32(struct bwi_softc *sc)
8329 {
8330 	uint32_t val, rx_ctrl;
8331 	int end_idx, rx_data;
8332 
8333 	rx_ctrl = sc->sc_rx_rdata.rdata_txrx_ctrl;
8334 
8335 	val = CSR_READ_4(sc, rx_ctrl + BWI_RX32_STATUS);
8336 	end_idx = __SHIFTOUT(val, BWI_RX32_STATUS_INDEX_MASK) /
8337 	    sizeof(struct bwi_desc32);
8338 
8339 	rx_data = bwi_rxeof(sc, end_idx);
8340 
8341 	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_INDEX,
8342 	    end_idx * sizeof(struct bwi_desc32));
8343 
8344 	return (rx_data);
8345 }
8346 
8347 int
8348 bwi_rxeof64(struct bwi_softc *sc)
8349 {
8350 	/* TODO: 64 */
8351 	return (0);
8352 }
8353 
8354 void
8355 bwi_reset_rx_ring32(struct bwi_softc *sc, uint32_t rx_ctrl)
8356 {
8357 	int i;
8358 
8359 	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_CTRL, 0);
8360 
8361 #define NRETRY 10
8362 	for (i = 0; i < NRETRY; ++i) {
8363 		uint32_t status;
8364 
8365 		status = CSR_READ_4(sc, rx_ctrl + BWI_RX32_STATUS);
8366 		if (__SHIFTOUT(status, BWI_RX32_STATUS_STATE_MASK) ==
8367 		    BWI_RX32_STATUS_STATE_DISABLED)
8368 			break;
8369 
8370 		DELAY(1000);
8371 	}
8372 	if (i == NRETRY)
8373 		printf("%s: reset rx ring timedout\n", sc->sc_dev.dv_xname);
8374 #undef NRETRY
8375 
8376 	CSR_WRITE_4(sc, rx_ctrl + BWI_RX32_RINGINFO, 0);
8377 }
8378 
8379 void
8380 bwi_free_txstats32(struct bwi_softc *sc)
8381 {
8382 	bwi_reset_rx_ring32(sc, sc->sc_txstats->stats_ctrl_base);
8383 }
8384 
8385 void
8386 bwi_free_rx_ring32(struct bwi_softc *sc)
8387 {
8388 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
8389 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
8390 	int i;
8391 
8392 	bwi_reset_rx_ring32(sc, rd->rdata_txrx_ctrl);
8393 
8394 	for (i = 0; i < BWI_RX_NDESC; ++i) {
8395 		struct bwi_rxbuf *rb = &rbd->rbd_buf[i];
8396 
8397 		if (rb->rb_mbuf != NULL) {
8398 			bus_dmamap_unload(sc->sc_dmat, rb->rb_dmap);
8399 			m_freem(rb->rb_mbuf);
8400 			rb->rb_mbuf = NULL;
8401 		}
8402 	}
8403 }
8404 
8405 void
8406 bwi_free_tx_ring32(struct bwi_softc *sc, int ring_idx)
8407 {
8408 	struct ieee80211com *ic = &sc->sc_ic;
8409 	struct bwi_ring_data *rd;
8410 	struct bwi_txbuf_data *tbd;
8411 	uint32_t state, val;
8412 	int i;
8413 
8414 	KASSERT(ring_idx < BWI_TX_NRING);
8415 	rd = &sc->sc_tx_rdata[ring_idx];
8416 	tbd = &sc->sc_tx_bdata[ring_idx];
8417 
8418 #define NRETRY 10
8419 	for (i = 0; i < NRETRY; ++i) {
8420 		val = CSR_READ_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_STATUS);
8421 		state = __SHIFTOUT(val, BWI_TX32_STATUS_STATE_MASK);
8422 		if (state == BWI_TX32_STATUS_STATE_DISABLED ||
8423 		    state == BWI_TX32_STATUS_STATE_IDLE ||
8424 		    state == BWI_TX32_STATUS_STATE_STOPPED)
8425 			break;
8426 
8427 		DELAY(1000);
8428 	}
8429 	if (i == NRETRY) {
8430 		printf("%s: wait for TX ring(%d) stable timed out\n",
8431 		    sc->sc_dev.dv_xname, ring_idx);
8432 	}
8433 
8434 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, 0);
8435 	for (i = 0; i < NRETRY; ++i) {
8436 		val = CSR_READ_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_STATUS);
8437 		state = __SHIFTOUT(val, BWI_TX32_STATUS_STATE_MASK);
8438 		if (state == BWI_TX32_STATUS_STATE_DISABLED)
8439 			break;
8440 
8441 		DELAY(1000);
8442 	}
8443 	if (i == NRETRY)
8444 		printf("%s: reset TX ring (%d) timed out\n",
8445 		    sc->sc_dev.dv_xname, ring_idx);
8446 #undef NRETRY
8447 
8448 	DELAY(1000);
8449 
8450 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_RINGINFO, 0);
8451 
8452 	for (i = 0; i < BWI_TX_NDESC; ++i) {
8453 		struct bwi_txbuf *tb = &tbd->tbd_buf[i];
8454 
8455 		if (tb->tb_mbuf != NULL) {
8456 			bus_dmamap_unload(sc->sc_dmat, tb->tb_dmap);
8457 			m_freem(tb->tb_mbuf);
8458 			tb->tb_mbuf = NULL;
8459 		}
8460 		if (tb->tb_ni != NULL) {
8461 			ieee80211_release_node(ic, tb->tb_ni);
8462 			tb->tb_ni = NULL;
8463 		}
8464 	}
8465 }
8466 
8467 void
8468 bwi_free_txstats64(struct bwi_softc *sc)
8469 {
8470 	/* TODO: 64 */
8471 }
8472 
8473 void
8474 bwi_free_rx_ring64(struct bwi_softc *sc)
8475 {
8476 	/* TODO: 64 */
8477 }
8478 
8479 void
8480 bwi_free_tx_ring64(struct bwi_softc *sc, int ring_idx)
8481 {
8482 	/* TODO: 64 */
8483 }
8484 
8485 uint8_t
8486 bwi_plcp2rate(uint32_t plcp0, enum ieee80211_phymode phymode)
8487 {
8488 	uint32_t plcp = letoh32(plcp0) & IEEE80211_OFDM_PLCP_RATE_MASK;
8489 	return (ieee80211_plcp2rate(plcp, phymode));
8490 }
8491 
8492 void
8493 bwi_ofdm_plcp_header(uint32_t *plcp0, int pkt_len, uint8_t rate)
8494 {
8495 	uint32_t plcp;
8496 
8497 	plcp = __SHIFTIN(ieee80211_rate2plcp(rate, IEEE80211_MODE_11G),
8498 	    IEEE80211_OFDM_PLCP_RATE_MASK) |
8499 	    __SHIFTIN(pkt_len, IEEE80211_OFDM_PLCP_LEN_MASK);
8500 	*plcp0 = htole32(plcp);
8501 }
8502 
8503 void
8504 bwi_ds_plcp_header(struct ieee80211_ds_plcp_hdr *plcp, int pkt_len,
8505     uint8_t rate)
8506 {
8507 	int len, service, pkt_bitlen;
8508 
8509 	pkt_bitlen = pkt_len * NBBY;
8510 	len = howmany(pkt_bitlen * 2, rate);
8511 
8512 	service = IEEE80211_DS_PLCP_SERVICE_LOCKED;
8513 	if (rate == (11 * 2)) {
8514 		int pkt_bitlen1;
8515 
8516 		/*
8517 		 * PLCP service field needs to be adjusted,
8518 		 * if TX rate is 11Mbytes/s
8519 		 */
8520 		pkt_bitlen1 = len * 11;
8521 		if (pkt_bitlen1 - pkt_bitlen >= NBBY)
8522 			service |= IEEE80211_DS_PLCP_SERVICE_LENEXT7;
8523 	}
8524 
8525 	plcp->i_signal = ieee80211_rate2plcp(rate, IEEE80211_MODE_11B);
8526 	plcp->i_service = service;
8527 	plcp->i_length = htole16(len);
8528 	/* NOTE: do NOT touch i_crc */
8529 }
8530 
8531 void
8532 bwi_plcp_header(void *plcp, int pkt_len, uint8_t rate)
8533 {
8534 	enum bwi_modtype modtype;
8535 
8536 	/*
8537 	 * Assume caller has zeroed 'plcp'
8538 	 */
8539 
8540 	modtype = bwi_rate2modtype(rate);
8541 	if (modtype == IEEE80211_MODTYPE_OFDM)
8542 		bwi_ofdm_plcp_header(plcp, pkt_len, rate);
8543 	else if (modtype == IEEE80211_MODTYPE_DS)
8544 		bwi_ds_plcp_header(plcp, pkt_len, rate);
8545 	else
8546 		panic("unsupport modulation type %u", modtype);
8547 }
8548 
8549 enum bwi_modtype
8550 bwi_rate2modtype(uint8_t rate)
8551 {
8552 	rate &= IEEE80211_RATE_VAL;
8553 
8554 	if (rate == 44)
8555 		return IEEE80211_MODTYPE_PBCC;
8556 	else if (rate == 22 || rate < 12)
8557 		return IEEE80211_MODTYPE_DS;
8558 	else
8559 		return IEEE80211_MODTYPE_OFDM;
8560 }
8561 
8562 uint8_t
8563 bwi_ack_rate(struct ieee80211_node *ni, uint8_t rate)
8564 {
8565 	const struct ieee80211_rateset *rs = &ni->ni_rates;
8566 	uint8_t ack_rate = 0;
8567 	enum bwi_modtype modtype;
8568 	int i;
8569 
8570 	rate &= IEEE80211_RATE_VAL;
8571 
8572 	modtype = bwi_rate2modtype(rate);
8573 
8574 	for (i = 0; i < rs->rs_nrates; ++i) {
8575 		uint8_t rate1 = rs->rs_rates[i] & IEEE80211_RATE_VAL;
8576 
8577 		if (rate1 > rate) {
8578 			if (ack_rate != 0)
8579 				return ack_rate;
8580 			else
8581 				break;
8582 		}
8583 
8584 		if ((rs->rs_rates[i] & IEEE80211_RATE_BASIC) &&
8585 		    bwi_rate2modtype(rate1) == modtype)
8586 			ack_rate = rate1;
8587 	}
8588 
8589 	switch (rate) {
8590 	/* CCK */
8591 	case 2:
8592 	case 4:
8593 	case 11:
8594 	case 22:
8595 		ack_rate = rate;
8596 		break;
8597 	/* PBCC */
8598 	case 44:
8599 		ack_rate = 22;
8600 		break;
8601 
8602 	/* OFDM */
8603 	case 12:
8604 	case 18:
8605 		ack_rate = 12;
8606 		break;
8607 	case 24:
8608 	case 36:
8609 		ack_rate = 24;
8610 		break;
8611 	case 48:
8612 	case 72:
8613 	case 96:
8614 	case 108:
8615 		ack_rate = 48;
8616 		break;
8617 	default:
8618 		panic("unsupported rate %d", rate);
8619 	}
8620 	return ack_rate;
8621 }
8622 
8623 #define IEEE80211_OFDM_TXTIME(kbps, frmlen)	\
8624 	(IEEE80211_OFDM_PREAMBLE_TIME +		\
8625 	 IEEE80211_OFDM_SIGNAL_TIME +		\
8626 	(IEEE80211_OFDM_NSYMS((kbps), (frmlen)) * IEEE80211_OFDM_SYM_TIME))
8627 
8628 #define IEEE80211_OFDM_SYM_TIME			4
8629 #define IEEE80211_OFDM_PREAMBLE_TIME		16
8630 #define IEEE80211_OFDM_SIGNAL_EXT_TIME		6
8631 #define IEEE80211_OFDM_SIGNAL_TIME		4
8632 
8633 #define IEEE80211_OFDM_PLCP_SERVICE_NBITS	16
8634 #define IEEE80211_OFDM_TAIL_NBITS		6
8635 
8636 #define IEEE80211_OFDM_NBITS(frmlen)		\
8637 	(IEEE80211_OFDM_PLCP_SERVICE_NBITS +	\
8638 	 ((frmlen) * NBBY) +			\
8639 	 IEEE80211_OFDM_TAIL_NBITS)
8640 
8641 #define IEEE80211_OFDM_NBITS_PER_SYM(kbps)	\
8642 	(((kbps) * IEEE80211_OFDM_SYM_TIME) / 1000)
8643 
8644 #define IEEE80211_OFDM_NSYMS(kbps, frmlen)	\
8645 	howmany(IEEE80211_OFDM_NBITS((frmlen)),	\
8646 	IEEE80211_OFDM_NBITS_PER_SYM((kbps)))
8647 
8648 #define IEEE80211_CCK_TXTIME(kbps, frmlen)	\
8649 	(((IEEE80211_CCK_NBITS((frmlen)) * 1000) + (kbps) - 1) / (kbps))
8650 
8651 #define IEEE80211_CCK_PREAMBLE_LEN		144
8652 #define IEEE80211_CCK_PLCP_HDR_TIME		48
8653 #define IEEE80211_CCK_SHPREAMBLE_LEN		72
8654 #define IEEE80211_CCK_SHPLCP_HDR_TIME		24
8655 
8656 #define IEEE80211_CCK_NBITS(frmlen)		((frmlen) * NBBY)
8657 
8658 uint16_t
8659 bwi_txtime(struct ieee80211com *ic, struct ieee80211_node *ni, uint len,
8660     uint8_t rs_rate, uint32_t flags)
8661 {
8662 	enum bwi_modtype modtype;
8663 	uint16_t txtime;
8664 	int rate;
8665 
8666 	rs_rate &= IEEE80211_RATE_VAL;
8667 
8668 	rate = rs_rate * 500;	/* ieee80211 rate -> kbps */
8669 
8670 	modtype = bwi_rate2modtype(rs_rate);
8671 	if (modtype == IEEE80211_MODTYPE_OFDM) {
8672 		/*
8673 		 * IEEE Std 802.11a-1999, page 37, equation (29)
8674 		 * IEEE Std 802.11g-2003, page 44, equation (42)
8675 		 */
8676 		txtime = IEEE80211_OFDM_TXTIME(rate, len);
8677 		if (ic->ic_curmode == IEEE80211_MODE_11G)
8678 			txtime += IEEE80211_OFDM_SIGNAL_EXT_TIME;
8679 	} else {
8680 		/*
8681 		 * IEEE Std 802.11b-1999, page 28, subclause 18.3.4
8682 		 * IEEE Std 802.11g-2003, page 45, equation (43)
8683 		 */
8684 		if (modtype == IEEE80211_MODTYPE_PBCC)
8685 			++len;
8686 		txtime = IEEE80211_CCK_TXTIME(rate, len);
8687 
8688 		/*
8689 		 * Short preamble is not applicable for DS 1Mbits/s
8690 		 */
8691 		if (rs_rate != 2 && (flags & IEEE80211_F_SHPREAMBLE)) {
8692 			txtime += IEEE80211_CCK_SHPREAMBLE_LEN +
8693 				  IEEE80211_CCK_SHPLCP_HDR_TIME;
8694 		} else {
8695 			txtime += IEEE80211_CCK_PREAMBLE_LEN +
8696 				  IEEE80211_CCK_PLCP_HDR_TIME;
8697 		}
8698 	}
8699 	return txtime;
8700 }
8701 
8702 int
8703 bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
8704     struct ieee80211_node *ni)
8705 {
8706 	DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
8707 
8708 	struct ieee80211com *ic = &sc->sc_ic;
8709 	struct bwi_ring_data *rd = &sc->sc_tx_rdata[BWI_TX_DATA_RING];
8710 	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
8711 	struct bwi_txbuf *tb = &tbd->tbd_buf[idx];
8712 	struct bwi_mac *mac;
8713 	struct bwi_txbuf_hdr *hdr;
8714 	struct ieee80211_frame *wh;
8715 	uint8_t rate;
8716 	uint32_t mac_ctrl;
8717 	uint16_t phy_ctrl;
8718 	bus_addr_t paddr;
8719 	int pkt_len, error;
8720 #if 0
8721 	const uint8_t *p;
8722 	int i;
8723 #endif
8724 
8725 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
8726 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
8727 
8728 	wh = mtod(m, struct ieee80211_frame *);
8729 
8730 	/* Get 802.11 frame len before prepending TX header */
8731 	pkt_len = m->m_pkthdr.len + IEEE80211_CRC_LEN;
8732 
8733 	/*
8734 	 * Find TX rate
8735 	 */
8736 	bzero(tb->tb_rate_idx, sizeof(tb->tb_rate_idx));
8737 	if (ni != NULL) {
8738 		if (ic->ic_fixed_rate != -1) {
8739 			rate = ic->ic_sup_rates[ic->ic_curmode].
8740 			    rs_rates[ic->ic_fixed_rate];
8741 		} else {
8742 			/* AMRR rate control */
8743 			rate = ni->ni_rates.rs_rates[ni->ni_txrate];
8744 		}
8745 	} else {
8746 		/* Fixed at 1Mbytes/s for mgt frames */
8747 		rate = (1 * 2);
8748 	}
8749 
8750 	rate &= IEEE80211_RATE_VAL;
8751 
8752 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
8753 		rate = (1 * 2);
8754 
8755 	if (rate == 0) {
8756 		printf("%s: invalid rate %u or fallback rate",
8757 		    sc->sc_dev.dv_xname, rate);
8758 		rate = (1 * 2); /* Force 1Mbytes/s */
8759 	}
8760 	sc->sc_tx_rate = rate;
8761 
8762 #if NBPFILTER > 0
8763 	/* TX radio tap */
8764 	if (sc->sc_drvbpf != NULL) {
8765 		struct mbuf mb;
8766 		struct bwi_tx_radiotap_hdr *tap = &sc->sc_txtap;
8767 
8768 		tap->wt_flags = 0;
8769 		tap->wt_rate = rate;
8770 		tap->wt_chan_freq =
8771 		    htole16(ic->ic_bss->ni_chan->ic_freq);
8772 		tap->wt_chan_flags =
8773 		    htole16(ic->ic_bss->ni_chan->ic_flags);
8774 
8775 		mb.m_data = (caddr_t)tap;
8776 		mb.m_len = sc->sc_txtap_len;
8777 		mb.m_next = m;
8778 		mb.m_nextpkt = NULL;
8779 		mb.m_type = 0;
8780 		mb.m_flags = 0;
8781 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
8782 	}
8783 #endif
8784 
8785 	/*
8786 	 * Setup the embedded TX header
8787 	 */
8788 	M_PREPEND(m, sizeof(*hdr), M_DONTWAIT);
8789 	if (m == NULL) {
8790 		printf("%s: prepend TX header failed\n", sc->sc_dev.dv_xname);
8791 		return (ENOBUFS);
8792 	}
8793 	hdr = mtod(m, struct bwi_txbuf_hdr *);
8794 
8795 	bzero(hdr, sizeof(*hdr));
8796 
8797 	bcopy(wh->i_fc, hdr->txh_fc, sizeof(hdr->txh_fc));
8798 	bcopy(wh->i_addr1, hdr->txh_addr1, sizeof(hdr->txh_addr1));
8799 
8800 	if (ni != NULL && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
8801 		uint16_t dur;
8802 		uint8_t ack_rate;
8803 
8804 		ack_rate = bwi_ack_rate(ni, rate);
8805 		dur = bwi_txtime(ic, ni,
8806 		    sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN,
8807 		    ack_rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
8808 
8809 		hdr->txh_fb_duration = htole16(dur);
8810 	}
8811 
8812 	hdr->txh_id = __SHIFTIN(BWI_TX_DATA_RING, BWI_TXH_ID_RING_MASK) |
8813 	    __SHIFTIN(idx, BWI_TXH_ID_IDX_MASK);
8814 
8815 	bwi_plcp_header(hdr->txh_plcp, pkt_len, rate);
8816 	bwi_plcp_header(hdr->txh_fb_plcp, pkt_len, rate);
8817 
8818 	phy_ctrl = __SHIFTIN(mac->mac_rf.rf_ant_mode,
8819 	    BWI_TXH_PHY_C_ANTMODE_MASK);
8820 	if (bwi_rate2modtype(rate) == IEEE80211_MODTYPE_OFDM)
8821 		phy_ctrl |= BWI_TXH_PHY_C_OFDM;
8822 	else if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && rate != (2 * 1))
8823 		phy_ctrl |= BWI_TXH_PHY_C_SHPREAMBLE;
8824 
8825 	mac_ctrl = BWI_TXH_MAC_C_HWSEQ | BWI_TXH_MAC_C_FIRST_FRAG;
8826 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
8827 		mac_ctrl |= BWI_TXH_MAC_C_ACK;
8828 	if (bwi_rate2modtype(rate) == IEEE80211_MODTYPE_OFDM)
8829 		mac_ctrl |= BWI_TXH_MAC_C_FB_OFDM;
8830 
8831 	hdr->txh_mac_ctrl = htole32(mac_ctrl);
8832 	hdr->txh_phy_ctrl = htole16(phy_ctrl);
8833 
8834 	/* Catch any further usage */
8835 	hdr = NULL;
8836 	wh = NULL;
8837 
8838 	/* DMA load */
8839 	error = bus_dmamap_load_mbuf(sc->sc_dmat, tb->tb_dmap, m,
8840 	    BUS_DMA_NOWAIT);
8841 	if (error && error != EFBIG) {
8842 		printf("%s: can't load TX buffer (1) %d\n",
8843 		    sc->sc_dev.dv_xname, error);
8844 		goto back;
8845 	}
8846 
8847 	if (error) {	/* error == EFBIG */
8848 		if (m_defrag(m, M_DONTWAIT)) {
8849 			printf("%s: can't defrag TX buffer\n",
8850 			    sc->sc_dev.dv_xname);
8851 			goto back;
8852 		}
8853 		error = bus_dmamap_load_mbuf(sc->sc_dmat, tb->tb_dmap, m,
8854 		    BUS_DMA_NOWAIT);
8855 		if (error) {
8856 			printf("%s: can't load TX buffer (2) %d\n",
8857 			    sc->sc_dev.dv_xname, error);
8858 			goto back;
8859 		}
8860 	}
8861 	error = 0;
8862 
8863 	bus_dmamap_sync(sc->sc_dmat, tb->tb_dmap, 0,
8864 	    tb->tb_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8865 
8866 	tb->tb_mbuf = m;
8867 	tb->tb_ni = ni;
8868 
8869 #if 0
8870 	p = mtod(m, const uint8_t *);
8871 	for (i = 0; i < m->m_pkthdr.len; ++i) {
8872 		if (i != 0 && i % 8 == 0)
8873 			printf("\n");
8874 		printf("%02x ", p[i]);
8875 	}
8876 	printf("\n");
8877 
8878 	DPRINTF(1, "%s: idx %d, pkt_len %d, buflen %d\n",
8879 	    sc->sc_dev.dv_xname, idx, pkt_len, m->m_pkthdr.len);
8880 #endif
8881 
8882 	/* Setup TX descriptor */
8883 	paddr = tb->tb_dmap->dm_segs[0].ds_addr;
8884 	sc->sc_setup_txdesc(sc, rd, idx, paddr, m->m_pkthdr.len);
8885 	bus_dmamap_sync(sc->sc_dmat, rd->rdata_dmap, 0,
8886 	    rd->rdata_dmap->dm_mapsize, BUS_DMASYNC_PREWRITE);
8887 
8888 	/* Kick start */
8889 	sc->sc_start_tx(sc, rd->rdata_txrx_ctrl, idx);
8890 
8891 back:
8892 	if (error)
8893 		m_freem(m);
8894 	return (error);
8895 }
8896 
8897 void
8898 bwi_start_tx32(struct bwi_softc *sc, uint32_t tx_ctrl, int idx)
8899 {
8900 	idx = (idx + 1) % BWI_TX_NDESC;
8901 	CSR_WRITE_4(sc, tx_ctrl + BWI_TX32_INDEX,
8902 	    idx * sizeof(struct bwi_desc32));
8903 }
8904 
8905 void
8906 bwi_start_tx64(struct bwi_softc *sc, uint32_t tx_ctrl, int idx)
8907 {
8908 	/* TODO: 64 */
8909 }
8910 
8911 void
8912 bwi_txeof_status32(struct bwi_softc *sc)
8913 {
8914 	struct ifnet *ifp = &sc->sc_ic.ic_if;
8915 	uint32_t val, ctrl_base;
8916 	int end_idx;
8917 
8918 	ctrl_base = sc->sc_txstats->stats_ctrl_base;
8919 
8920 	val = CSR_READ_4(sc, ctrl_base + BWI_RX32_STATUS);
8921 	end_idx = __SHIFTOUT(val, BWI_RX32_STATUS_INDEX_MASK) /
8922 	    sizeof(struct bwi_desc32);
8923 
8924 	bwi_txeof_status(sc, end_idx);
8925 
8926 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
8927 	    end_idx * sizeof(struct bwi_desc32));
8928 
8929 	if ((ifp->if_flags & IFF_OACTIVE) == 0)
8930 		ifp->if_start(ifp);
8931 }
8932 
8933 void
8934 bwi_txeof_status64(struct bwi_softc *sc)
8935 {
8936 	/* TODO: 64 */
8937 }
8938 
8939 void
8940 _bwi_txeof(struct bwi_softc *sc, uint16_t tx_id)
8941 {
8942 	struct ieee80211com *ic = &sc->sc_ic;
8943 	struct ifnet *ifp = &sc->sc_ic.ic_if;
8944 	struct bwi_txbuf_data *tbd;
8945 	struct bwi_txbuf *tb;
8946 	int ring_idx, buf_idx;
8947 
8948 	if (tx_id == 0) {
8949 		printf("%s: zero tx id\n", sc->sc_dev.dv_xname);
8950 		return;
8951 	}
8952 
8953 	ring_idx = __SHIFTOUT(tx_id, BWI_TXH_ID_RING_MASK);
8954 	buf_idx = __SHIFTOUT(tx_id, BWI_TXH_ID_IDX_MASK);
8955 
8956 	KASSERT(ring_idx == BWI_TX_DATA_RING);
8957 	KASSERT(buf_idx < BWI_TX_NDESC);
8958 #if 0
8959 	DPRINTF(1, "%s: txeof idx %d\n", sc->sc_dev.dv_xname, buf_idx);
8960 #endif
8961 	tbd = &sc->sc_tx_bdata[ring_idx];
8962 	KASSERT(tbd->tbd_used > 0);
8963 	tbd->tbd_used--;
8964 
8965 	tb = &tbd->tbd_buf[buf_idx];
8966 
8967 	bus_dmamap_unload(sc->sc_dmat, tb->tb_dmap);
8968 	m_freem(tb->tb_mbuf);
8969 	tb->tb_mbuf = NULL;
8970 
8971 	if (tb->tb_ni != NULL) {
8972 		ieee80211_release_node(ic, tb->tb_ni);
8973 		tb->tb_ni = NULL;
8974 	}
8975 
8976 	if (tbd->tbd_used == 0)
8977 		sc->sc_tx_timer = 0;
8978 
8979 	ifp->if_flags &= ~IFF_OACTIVE;
8980 }
8981 
8982 void
8983 bwi_txeof_status(struct bwi_softc *sc, int end_idx)
8984 {
8985 	struct bwi_txstats_data *st = sc->sc_txstats;
8986 	int idx;
8987 
8988 	bus_dmamap_sync(sc->sc_dmat, st->stats_dmap, 0,
8989 	    st->stats_dmap->dm_mapsize, BUS_DMASYNC_POSTREAD);
8990 
8991 	idx = st->stats_idx;
8992 	while (idx != end_idx) {
8993 		_bwi_txeof(sc, letoh16(st->stats[idx].txs_id));
8994 		idx = (idx + 1) % BWI_TXSTATS_NDESC;
8995 	}
8996 	st->stats_idx = idx;
8997 }
8998 
8999 void
9000 bwi_txeof(struct bwi_softc *sc)
9001 {
9002 	struct ifnet *ifp = &sc->sc_ic.ic_if;
9003 
9004 	for (;;) {
9005 		uint32_t tx_status0, tx_status1;
9006 		uint16_t tx_id, tx_info;
9007 
9008 		tx_status0 = CSR_READ_4(sc, BWI_TXSTATUS_0);
9009 		if (tx_status0 == 0)
9010 			break;
9011 		tx_status1 = CSR_READ_4(sc, BWI_TXSTATUS_1);
9012 
9013 		tx_id = __SHIFTOUT(tx_status0, BWI_TXSTATUS_0_TXID_MASK);
9014 		tx_info = BWI_TXSTATUS_0_INFO(tx_status0);
9015 
9016 		if (tx_info & 0x30) /* XXX */
9017 			continue;
9018 
9019 		_bwi_txeof(sc, letoh16(tx_id));
9020 
9021 		ifp->if_opackets++;
9022 	}
9023 
9024 	if ((ifp->if_flags & IFF_OACTIVE) == 0)
9025 		ifp->if_start(ifp);
9026 }
9027 
9028 int
9029 bwi_bbp_power_on(struct bwi_softc *sc, enum bwi_clock_mode clk_mode)
9030 {
9031 	bwi_power_on(sc, 1);
9032 
9033 	return (bwi_set_clock_mode(sc, clk_mode));
9034 }
9035 
9036 void
9037 bwi_bbp_power_off(struct bwi_softc *sc)
9038 {
9039 	bwi_set_clock_mode(sc, BWI_CLOCK_MODE_SLOW);
9040 	bwi_power_off(sc, 1);
9041 }
9042 
9043 int
9044 bwi_get_pwron_delay(struct bwi_softc *sc)
9045 {
9046 	struct bwi_regwin *com, *old;
9047 	struct bwi_clock_freq freq;
9048 	uint32_t val;
9049 	int error;
9050 
9051 	com = &sc->sc_com_regwin;
9052 	KASSERT(BWI_REGWIN_EXIST(com));
9053 
9054 	if ((sc->sc_cap & BWI_CAP_CLKMODE) == 0)
9055 		return (0);
9056 
9057 	error = bwi_regwin_switch(sc, com, &old);
9058 	if (error)
9059 		return (error);
9060 
9061 	bwi_get_clock_freq(sc, &freq);
9062 
9063 	val = CSR_READ_4(sc, BWI_PLL_ON_DELAY);
9064 	sc->sc_pwron_delay = howmany((val + 2) * 1000000, freq.clkfreq_min);
9065 	DPRINTF(1, "%s: power on delay %u\n",
9066 	    sc->sc_dev.dv_xname, sc->sc_pwron_delay);
9067 
9068 	return (bwi_regwin_switch(sc, old, NULL));
9069 }
9070 
9071 int
9072 bwi_bus_attach(struct bwi_softc *sc)
9073 {
9074 	struct bwi_regwin *bus, *old;
9075 	int error;
9076 
9077 	bus = &sc->sc_bus_regwin;
9078 
9079 	error = bwi_regwin_switch(sc, bus, &old);
9080 	if (error)
9081 		return (error);
9082 
9083 	if (!bwi_regwin_is_enabled(sc, bus))
9084 		bwi_regwin_enable(sc, bus, 0);
9085 
9086 	/* Disable interripts */
9087 	CSR_WRITE_4(sc, BWI_INTRVEC, 0);
9088 
9089 	return (bwi_regwin_switch(sc, old, NULL));
9090 }
9091 
9092 const char *
9093 bwi_regwin_name(const struct bwi_regwin *rw)
9094 {
9095 	switch (rw->rw_type) {
9096 	case BWI_REGWIN_T_COM:
9097 		return ("COM");
9098 	case BWI_REGWIN_T_BUSPCI:
9099 		return ("PCI");
9100 	case BWI_REGWIN_T_MAC:
9101 		return ("MAC");
9102 	case BWI_REGWIN_T_BUSPCIE:
9103 		return ("PCIE");
9104 	}
9105 	panic("unknown regwin type 0x%04x", rw->rw_type);
9106 
9107 	return (NULL);
9108 }
9109 
9110 uint32_t
9111 bwi_regwin_disable_bits(struct bwi_softc *sc)
9112 {
9113 	uint32_t busrev;
9114 
9115 	/* XXX cache this */
9116 	busrev = __SHIFTOUT(CSR_READ_4(sc, BWI_ID_LO), BWI_ID_LO_BUSREV_MASK);
9117 	DPRINTF(1, "%s: bus rev %u\n", sc->sc_dev.dv_xname, busrev);
9118 
9119 	if (busrev == BWI_BUSREV_0)
9120 		return (BWI_STATE_LO_DISABLE1);
9121 	else if (busrev == BWI_BUSREV_1)
9122 		return (BWI_STATE_LO_DISABLE2);
9123 	else
9124 		return ((BWI_STATE_LO_DISABLE1 | BWI_STATE_LO_DISABLE2));
9125 }
9126 
9127 int
9128 bwi_regwin_is_enabled(struct bwi_softc *sc, struct bwi_regwin *rw)
9129 {
9130 	uint32_t val, disable_bits;
9131 
9132 	disable_bits = bwi_regwin_disable_bits(sc);
9133 	val = CSR_READ_4(sc, BWI_STATE_LO);
9134 
9135 	if ((val & (BWI_STATE_LO_CLOCK |
9136 	    BWI_STATE_LO_RESET |
9137 	    disable_bits)) == BWI_STATE_LO_CLOCK) {
9138 		DPRINTF(1, "%s: %s is enabled\n",
9139 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9140 		return (1);
9141 	} else {
9142 		DPRINTF(1, "%s: %s is disabled\n",
9143 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9144 		return (0);
9145 	}
9146 }
9147 
9148 void
9149 bwi_regwin_disable(struct bwi_softc *sc, struct bwi_regwin *rw, uint32_t flags)
9150 {
9151 	uint32_t state_lo, disable_bits;
9152 	int i;
9153 
9154 	state_lo = CSR_READ_4(sc, BWI_STATE_LO);
9155 
9156 	/*
9157 	 * If current regwin is in 'reset' state, it was already disabled.
9158 	 */
9159 	if (state_lo & BWI_STATE_LO_RESET) {
9160 		DPRINTF(1, "%s: %s was already disabled\n",
9161 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9162 		return;
9163 	}
9164 
9165 	disable_bits = bwi_regwin_disable_bits(sc);
9166 
9167 	/*
9168 	 * Disable normal clock
9169 	 */
9170 	state_lo = BWI_STATE_LO_CLOCK | disable_bits;
9171 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9172 
9173 	/*
9174 	 * Wait until normal clock is disabled
9175 	 */
9176 #define NRETRY	1000
9177 	for (i = 0; i < NRETRY; ++i) {
9178 		state_lo = CSR_READ_4(sc, BWI_STATE_LO);
9179 		if (state_lo & disable_bits)
9180 			break;
9181 		DELAY(10);
9182 	}
9183 	if (i == NRETRY) {
9184 		printf("%s: %s disable clock timeout\n",
9185 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9186 	}
9187 
9188 	for (i = 0; i < NRETRY; ++i) {
9189 		uint32_t state_hi;
9190 
9191 		state_hi = CSR_READ_4(sc, BWI_STATE_HI);
9192 		if ((state_hi & BWI_STATE_HI_BUSY) == 0)
9193 			break;
9194 		DELAY(10);
9195 	}
9196 	if (i == NRETRY) {
9197 		printf("%s: %s wait BUSY unset timeout\n",
9198 		    sc->sc_dev.dv_xname, bwi_regwin_name(rw));
9199 	}
9200 #undef NRETRY
9201 
9202 	/*
9203 	 * Reset and disable regwin with gated clock
9204 	 */
9205 	state_lo = BWI_STATE_LO_RESET | disable_bits |
9206 	    BWI_STATE_LO_CLOCK | BWI_STATE_LO_GATED_CLOCK |
9207 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9208 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9209 
9210 	/* Flush pending bus write */
9211 	CSR_READ_4(sc, BWI_STATE_LO);
9212 	DELAY(1);
9213 
9214 	/* Reset and disable regwin */
9215 	state_lo = BWI_STATE_LO_RESET | disable_bits |
9216 		   __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9217 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9218 
9219 	/* Flush pending bus write */
9220 	CSR_READ_4(sc, BWI_STATE_LO);
9221 	DELAY(1);
9222 }
9223 
9224 void
9225 bwi_regwin_enable(struct bwi_softc *sc, struct bwi_regwin *rw, uint32_t flags)
9226 {
9227 	uint32_t state_lo, state_hi, imstate;
9228 
9229 	bwi_regwin_disable(sc, rw, flags);
9230 
9231 	/* Reset regwin with gated clock */
9232 	state_lo = BWI_STATE_LO_RESET |
9233 	    BWI_STATE_LO_CLOCK |
9234 	    BWI_STATE_LO_GATED_CLOCK |
9235 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9236 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9237 
9238 	/* Flush pending bus write */
9239 	CSR_READ_4(sc, BWI_STATE_LO);
9240 	DELAY(1);
9241 
9242 	state_hi = CSR_READ_4(sc, BWI_STATE_HI);
9243 	if (state_hi & BWI_STATE_HI_SERROR)
9244 		CSR_WRITE_4(sc, BWI_STATE_HI, 0);
9245 
9246 	imstate = CSR_READ_4(sc, BWI_IMSTATE);
9247 	if (imstate & (BWI_IMSTATE_INBAND_ERR | BWI_IMSTATE_TIMEOUT)) {
9248 		imstate &= ~(BWI_IMSTATE_INBAND_ERR | BWI_IMSTATE_TIMEOUT);
9249 		CSR_WRITE_4(sc, BWI_IMSTATE, imstate);
9250 	}
9251 
9252 	/* Enable regwin with gated clock */
9253 	state_lo = BWI_STATE_LO_CLOCK |
9254 	    BWI_STATE_LO_GATED_CLOCK |
9255 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9256 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9257 
9258 	/* Flush pending bus write */
9259 	CSR_READ_4(sc, BWI_STATE_LO);
9260 	DELAY(1);
9261 
9262 	/* Enable regwin with normal clock */
9263 	state_lo = BWI_STATE_LO_CLOCK |
9264 	    __SHIFTIN(flags, BWI_STATE_LO_FLAGS_MASK);
9265 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
9266 
9267 	/* Flush pending bus write */
9268 	CSR_READ_4(sc, BWI_STATE_LO);
9269 	DELAY(1);
9270 }
9271 
9272 void
9273 bwi_set_bssid(struct bwi_softc *sc, const uint8_t *bssid)
9274 {
9275 	struct ieee80211com *ic = &sc->sc_ic;
9276 	struct bwi_mac *mac;
9277 	struct bwi_myaddr_bssid buf;
9278 	const uint8_t *p;
9279 	uint32_t val;
9280 	int n, i;
9281 
9282 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9283 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9284 
9285 	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_BSSID, bssid);
9286 
9287 	bcopy(ic->ic_myaddr, buf.myaddr, sizeof(buf.myaddr));
9288 	bcopy(bssid, buf.bssid, sizeof(buf.bssid));
9289 
9290 	n = sizeof(buf) / sizeof(val);
9291 	p = (const uint8_t *)&buf;
9292 	for (i = 0; i < n; ++i) {
9293 		int j;
9294 
9295 		val = 0;
9296 		for (j = 0; j < sizeof(val); ++j)
9297 			val |= ((uint32_t)(*p++)) << (j * 8);
9298 
9299 		TMPLT_WRITE_4(mac, 0x20 + (i * sizeof(val)), val);
9300 	}
9301 }
9302 
9303 void
9304 bwi_updateslot(struct ieee80211com *ic)
9305 {
9306 	struct bwi_softc *sc = ic->ic_if.if_softc;
9307 	struct bwi_mac *mac;
9308 	struct ifnet *ifp = &ic->ic_if;
9309 
9310 	if ((ifp->if_flags & IFF_RUNNING) == 0)
9311 		return;
9312 
9313 	DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
9314 
9315 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9316 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9317 
9318 	bwi_mac_updateslot(mac, (ic->ic_flags & IEEE80211_F_SHSLOT));
9319 }
9320 
9321 void
9322 bwi_calibrate(void *xsc)
9323 {
9324 	struct bwi_softc *sc = xsc;
9325 	struct ieee80211com *ic = &sc->sc_ic;
9326 	int s;
9327 
9328 	s = splnet();
9329 
9330 	if (ic->ic_state == IEEE80211_S_RUN) {
9331 		struct bwi_mac *mac;
9332 
9333 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9334 		mac = (struct bwi_mac *)sc->sc_cur_regwin;
9335 
9336 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
9337 			bwi_mac_calibrate_txpower(mac, sc->sc_txpwrcb_type);
9338 			sc->sc_txpwrcb_type = BWI_TXPWR_CALIB;
9339 		}
9340 
9341 		/* XXX 15 seconds */
9342 		timeout_add_sec(&sc->sc_calib_ch, 15);
9343 	}
9344 
9345 	splx(s);
9346 }
9347 
9348 int
9349 bwi_calc_rssi(struct bwi_softc *sc, const struct bwi_rxbuf_hdr *hdr)
9350 {
9351 	struct bwi_mac *mac;
9352 
9353 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC);
9354 	mac = (struct bwi_mac *)sc->sc_cur_regwin;
9355 
9356 	return (bwi_rf_calc_rssi(mac, hdr));
9357 }
9358