xref: /freebsd/sys/dev/bwi/bwimac.c (revision c36e54bb328697af1e6113812caecbd3bac89fe0)
1 /*
2  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Sepherosa Ziehau <sepherosa@gmail.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * $DragonFly: src/sys/dev/netif/bwi/bwimac.c,v 1.13 2008/02/15 11:15:38 sephe Exp $
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include "opt_inet.h"
41 #include "opt_bwi.h"
42 #include "opt_wlan.h"
43 
44 #include <sys/param.h>
45 #include <sys/endian.h>
46 #include <sys/kernel.h>
47 #include <sys/bus.h>
48 #include <sys/malloc.h>
49 #include <sys/proc.h>
50 #include <sys/rman.h>
51 #include <sys/socket.h>
52 #include <sys/sockio.h>
53 #include <sys/sysctl.h>
54 #include <sys/systm.h>
55 
56 #include <sys/linker.h>
57 #include <sys/firmware.h>
58 
59 #include <net/if.h>
60 #include <net/if_var.h>
61 #include <net/if_dl.h>
62 #include <net/if_media.h>
63 #include <net/if_types.h>
64 #include <net/if_arp.h>
65 #include <net/ethernet.h>
66 #include <net/if_llc.h>
67 
68 #include <net80211/ieee80211_var.h>
69 #include <net80211/ieee80211_radiotap.h>
70 #include <net80211/ieee80211_amrr.h>
71 #include <net80211/ieee80211_phy.h>
72 
73 #include <machine/bus.h>
74 
75 #include <dev/bwi/bitops.h>
76 #include <dev/bwi/if_bwireg.h>
77 #include <dev/bwi/if_bwivar.h>
78 #include <dev/bwi/bwimac.h>
79 #include <dev/bwi/bwirf.h>
80 #include <dev/bwi/bwiphy.h>
81 
82 struct bwi_retry_lim {
83 	uint16_t	shretry;
84 	uint16_t	shretry_fb;
85 	uint16_t	lgretry;
86 	uint16_t	lgretry_fb;
87 };
88 
89 static int	bwi_mac_test(struct bwi_mac *);
90 static int	bwi_mac_get_property(struct bwi_mac *);
91 
92 static void	bwi_mac_set_retry_lim(struct bwi_mac *,
93 			const struct bwi_retry_lim *);
94 static void	bwi_mac_set_ackrates(struct bwi_mac *,
95 			const struct ieee80211_rate_table *rt,
96 			const struct ieee80211_rateset *);
97 
98 static int	bwi_mac_gpio_init(struct bwi_mac *);
99 static int	bwi_mac_gpio_fini(struct bwi_mac *);
100 static void	bwi_mac_opmode_init(struct bwi_mac *);
101 static void	bwi_mac_hostflags_init(struct bwi_mac *);
102 static void	bwi_mac_bss_param_init(struct bwi_mac *);
103 
104 static void	bwi_mac_fw_free(struct bwi_mac *);
105 static int	bwi_mac_fw_load(struct bwi_mac *);
106 static int	bwi_mac_fw_init(struct bwi_mac *);
107 static int	bwi_mac_fw_load_iv(struct bwi_mac *, const struct firmware *);
108 
109 static void	bwi_mac_setup_tpctl(struct bwi_mac *);
110 static void	bwi_mac_adjust_tpctl(struct bwi_mac *, int, int);
111 
112 static void	bwi_mac_lock(struct bwi_mac *);
113 static void	bwi_mac_unlock(struct bwi_mac *);
114 
115 static const uint8_t bwi_sup_macrev[] = { 2, 4, 5, 6, 7, 9, 10 };
116 
117 void
118 bwi_tmplt_write_4(struct bwi_mac *mac, uint32_t ofs, uint32_t val)
119 {
120 	struct bwi_softc *sc = mac->mac_sc;
121 
122 	if (mac->mac_flags & BWI_MAC_F_BSWAP)
123 		val = bswap32(val);
124 
125 	CSR_WRITE_4(sc, BWI_MAC_TMPLT_CTRL, ofs);
126 	CSR_WRITE_4(sc, BWI_MAC_TMPLT_DATA, val);
127 }
128 
129 void
130 bwi_hostflags_write(struct bwi_mac *mac, uint64_t flags)
131 {
132 	uint64_t val;
133 
134 	val = flags & 0xffff;
135 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO, val);
136 
137 	val = (flags >> 16) & 0xffff;
138 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI, val);
139 
140 	/* HI has unclear meaning, so leave it as it is */
141 }
142 
143 uint64_t
144 bwi_hostflags_read(struct bwi_mac *mac)
145 {
146 	uint64_t flags, val;
147 
148 	/* HI has unclear meaning, so don't touch it */
149 	flags = 0;
150 
151 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_MI);
152 	flags |= val << 16;
153 
154 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_HFLAGS_LO);
155 	flags |= val;
156 
157 	return flags;
158 }
159 
160 uint16_t
161 bwi_memobj_read_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
162 {
163 	struct bwi_softc *sc = mac->mac_sc;
164 	uint32_t data_reg;
165 	int ofs;
166 
167 	data_reg = BWI_MOBJ_DATA;
168 	ofs = ofs0 / 4;
169 
170 	if (ofs0 % 4 != 0)
171 		data_reg = BWI_MOBJ_DATA_UNALIGN;
172 
173 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
174 	return CSR_READ_2(sc, data_reg);
175 }
176 
177 uint32_t
178 bwi_memobj_read_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0)
179 {
180 	struct bwi_softc *sc = mac->mac_sc;
181 	int ofs;
182 
183 	ofs = ofs0 / 4;
184 	if (ofs0 % 4 != 0) {
185 		uint32_t ret;
186 
187 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
188 		ret = CSR_READ_2(sc, BWI_MOBJ_DATA_UNALIGN);
189 		ret <<= 16;
190 
191 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
192 			    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
193 		ret |= CSR_READ_2(sc, BWI_MOBJ_DATA);
194 
195 		return ret;
196 	} else {
197 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
198 		return CSR_READ_4(sc, BWI_MOBJ_DATA);
199 	}
200 }
201 
202 void
203 bwi_memobj_write_2(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
204 		   uint16_t v)
205 {
206 	struct bwi_softc *sc = mac->mac_sc;
207 	uint32_t data_reg;
208 	int ofs;
209 
210 	data_reg = BWI_MOBJ_DATA;
211 	ofs = ofs0 / 4;
212 
213 	if (ofs0 % 4 != 0)
214 		data_reg = BWI_MOBJ_DATA_UNALIGN;
215 
216 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
217 	CSR_WRITE_2(sc, data_reg, v);
218 }
219 
220 void
221 bwi_memobj_write_4(struct bwi_mac *mac, uint16_t obj_id, uint16_t ofs0,
222 		   uint32_t v)
223 {
224 	struct bwi_softc *sc = mac->mac_sc;
225 	int ofs;
226 
227 	ofs = ofs0 / 4;
228 	if (ofs0 % 4 != 0) {
229 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
230 		CSR_WRITE_2(sc, BWI_MOBJ_DATA_UNALIGN, v >> 16);
231 
232 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
233 			    BWI_MOBJ_CTRL_VAL(obj_id, ofs + 1));
234 		CSR_WRITE_2(sc, BWI_MOBJ_DATA, v & 0xffff);
235 	} else {
236 		CSR_WRITE_4(sc, BWI_MOBJ_CTRL, BWI_MOBJ_CTRL_VAL(obj_id, ofs));
237 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, v);
238 	}
239 }
240 
241 int
242 bwi_mac_lateattach(struct bwi_mac *mac)
243 {
244 	int error;
245 
246 	if (mac->mac_rev >= 5)
247 		CSR_READ_4(mac->mac_sc, BWI_STATE_HI); /* dummy read */
248 
249 	bwi_mac_reset(mac, 1);
250 
251 	error = bwi_phy_attach(mac);
252 	if (error)
253 		return error;
254 
255 	error = bwi_rf_attach(mac);
256 	if (error)
257 		return error;
258 
259 	/* Link 11B/G PHY, unlink 11A PHY */
260 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A)
261 		bwi_mac_reset(mac, 0);
262 	else
263 		bwi_mac_reset(mac, 1);
264 
265 	error = bwi_mac_test(mac);
266 	if (error)
267 		return error;
268 
269 	error = bwi_mac_get_property(mac);
270 	if (error)
271 		return error;
272 
273 	error = bwi_rf_map_txpower(mac);
274 	if (error)
275 		return error;
276 
277 	bwi_rf_off(mac);
278 	CSR_WRITE_2(mac->mac_sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
279 	bwi_regwin_disable(mac->mac_sc, &mac->mac_regwin, 0);
280 
281 	return 0;
282 }
283 
284 int
285 bwi_mac_init(struct bwi_mac *mac)
286 {
287 	struct bwi_softc *sc = mac->mac_sc;
288 	int error, i;
289 
290 	/* Clear MAC/PHY/RF states */
291 	bwi_mac_setup_tpctl(mac);
292 	bwi_rf_clear_state(&mac->mac_rf);
293 	bwi_phy_clear_state(&mac->mac_phy);
294 
295 	/* Enable MAC and linked it to PHY */
296 	if (!bwi_regwin_is_enabled(sc, &mac->mac_regwin))
297 		bwi_mac_reset(mac, 1);
298 
299 	/* Initialize backplane */
300 	error = bwi_bus_init(sc, mac);
301 	if (error)
302 		return error;
303 
304 	/* do timeout fixup */
305 	if (sc->sc_bus_regwin.rw_rev <= 5 &&
306 	    sc->sc_bus_regwin.rw_type != BWI_REGWIN_T_BUSPCIE) {
307 		CSR_SETBITS_4(sc, BWI_CONF_LO,
308 		__SHIFTIN(BWI_CONF_LO_SERVTO, BWI_CONF_LO_SERVTO_MASK) |
309 		__SHIFTIN(BWI_CONF_LO_REQTO, BWI_CONF_LO_REQTO_MASK));
310 	}
311 
312 	/* Calibrate PHY */
313 	error = bwi_phy_calibrate(mac);
314 	if (error) {
315 		device_printf(sc->sc_dev, "PHY calibrate failed\n");
316 		return error;
317 	}
318 
319 	/* Prepare to initialize firmware */
320 	CSR_WRITE_4(sc, BWI_MAC_STATUS,
321 		    BWI_MAC_STATUS_UCODE_JUMP0 |
322 		    BWI_MAC_STATUS_IHREN);
323 
324 	/*
325 	 * Load and initialize firmwares
326 	 */
327 	error = bwi_mac_fw_load(mac);
328 	if (error)
329 		return error;
330 
331 	error = bwi_mac_gpio_init(mac);
332 	if (error)
333 		return error;
334 
335 	error = bwi_mac_fw_init(mac);
336 	if (error)
337 		return error;
338 
339 	/*
340 	 * Turn on RF
341 	 */
342 	bwi_rf_on(mac);
343 
344 	/* TODO: LED, hardware rf enabled is only related to LED setting */
345 
346 	/*
347 	 * Initialize PHY
348 	 */
349 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
350 	bwi_phy_init(mac);
351 
352 	/* TODO: interference mitigation */
353 
354 	/*
355 	 * Setup antenna mode
356 	 */
357 	bwi_rf_set_ant_mode(mac, mac->mac_rf.rf_ant_mode);
358 
359 	/*
360 	 * Initialize operation mode (RX configuration)
361 	 */
362 	bwi_mac_opmode_init(mac);
363 
364 	/* set up Beacon interval */
365 	if (mac->mac_rev < 3) {
366 		CSR_WRITE_2(sc, 0x60e, 0);
367 		CSR_WRITE_2(sc, 0x610, 0x8000);
368 		CSR_WRITE_2(sc, 0x604, 0);
369 		CSR_WRITE_2(sc, 0x606, 0x200);
370 	} else {
371 		CSR_WRITE_4(sc, 0x188, 0x80000000);
372 		CSR_WRITE_4(sc, 0x18c, 0x2000000);
373 	}
374 
375 	/*
376 	 * Initialize TX/RX interrupts' mask
377 	 */
378 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_TIMER1);
379 	for (i = 0; i < BWI_TXRX_NRING; ++i) {
380 		uint32_t intrs;
381 
382 		if (BWI_TXRX_IS_RX(i))
383 			intrs = BWI_TXRX_RX_INTRS;
384 		else
385 			intrs = BWI_TXRX_TX_INTRS;
386 		CSR_WRITE_4(sc, BWI_TXRX_INTR_MASK(i), intrs);
387 	}
388 
389 	/* allow the MAC to control the PHY clock (dynamic on/off) */
390 	CSR_SETBITS_4(sc, BWI_STATE_LO, 0x100000);
391 
392 	/* Setup MAC power up delay */
393 	CSR_WRITE_2(sc, BWI_MAC_POWERUP_DELAY, sc->sc_pwron_delay);
394 
395 	/* Set MAC regwin revision */
396 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_MACREV, mac->mac_rev);
397 
398 	/*
399 	 * Initialize host flags
400 	 */
401 	bwi_mac_hostflags_init(mac);
402 
403 	/*
404 	 * Initialize BSS parameters
405 	 */
406 	bwi_mac_bss_param_init(mac);
407 
408 	/*
409 	 * Initialize TX rings
410 	 */
411 	for (i = 0; i < BWI_TX_NRING; ++i) {
412 		error = sc->sc_init_tx_ring(sc, i);
413 		if (error) {
414 			device_printf(sc->sc_dev,
415 				  "can't initialize %dth TX ring\n", i);
416 			return error;
417 		}
418 	}
419 
420 	/*
421 	 * Initialize RX ring
422 	 */
423 	error = sc->sc_init_rx_ring(sc);
424 	if (error) {
425 		device_printf(sc->sc_dev, "can't initialize RX ring\n");
426 		return error;
427 	}
428 
429 	/*
430 	 * Initialize TX stats if the current MAC uses that
431 	 */
432 	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS) {
433 		error = sc->sc_init_txstats(sc);
434 		if (error) {
435 			device_printf(sc->sc_dev,
436 				  "can't initialize TX stats ring\n");
437 			return error;
438 		}
439 	}
440 
441 	/* update PRETBTT */
442 	CSR_WRITE_2(sc, 0x612, 0x50);	/* Force Pre-TBTT to 80? */
443 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x416, 0x50);
444 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, 0x414, 0x1f4);
445 
446 	mac->mac_flags |= BWI_MAC_F_INITED;
447 	return 0;
448 }
449 
450 void
451 bwi_mac_reset(struct bwi_mac *mac, int link_phy)
452 {
453 	struct bwi_softc *sc = mac->mac_sc;
454 	uint32_t flags, state_lo, status;
455 
456 	flags = BWI_STATE_LO_FLAG_PHYRST | BWI_STATE_LO_FLAG_PHYCLKEN;
457 	if (link_phy)
458 		flags |= BWI_STATE_LO_FLAG_PHYLNK;
459 	bwi_regwin_enable(sc, &mac->mac_regwin, flags);
460 	DELAY(2000);
461 
462 	state_lo = CSR_READ_4(sc, BWI_STATE_LO);
463 	state_lo |= BWI_STATE_LO_GATED_CLOCK;
464 	state_lo &= ~__SHIFTIN(BWI_STATE_LO_FLAG_PHYRST,
465 			       BWI_STATE_LO_FLAGS_MASK);
466 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
467 	/* Flush pending bus write */
468 	CSR_READ_4(sc, BWI_STATE_LO);
469 	DELAY(1000);
470 
471 	state_lo &= ~BWI_STATE_LO_GATED_CLOCK;
472 	CSR_WRITE_4(sc, BWI_STATE_LO, state_lo);
473 	/* Flush pending bus write */
474 	CSR_READ_4(sc, BWI_STATE_LO);
475 	DELAY(1000);
476 
477 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0);
478 
479 	status = CSR_READ_4(sc, BWI_MAC_STATUS);
480 	status |= BWI_MAC_STATUS_IHREN;
481 	if (link_phy)
482 		status |= BWI_MAC_STATUS_PHYLNK;
483 	else
484 		status &= ~BWI_MAC_STATUS_PHYLNK;
485 	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
486 
487 	if (link_phy) {
488 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH | BWI_DBG_INIT,
489 			"%s\n", "PHY is linked");
490 		mac->mac_phy.phy_flags |= BWI_PHY_F_LINKED;
491 	} else {
492 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH | BWI_DBG_INIT,
493 			"%s\n", "PHY is unlinked");
494 		mac->mac_phy.phy_flags &= ~BWI_PHY_F_LINKED;
495 	}
496 }
497 
498 void
499 bwi_mac_set_tpctl_11bg(struct bwi_mac *mac, const struct bwi_tpctl *new_tpctl)
500 {
501 	struct bwi_rf *rf = &mac->mac_rf;
502 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
503 
504 	if (new_tpctl != NULL) {
505 		KASSERT(new_tpctl->bbp_atten <= BWI_BBP_ATTEN_MAX,
506 		    ("bbp_atten %d", new_tpctl->bbp_atten));
507 		KASSERT(new_tpctl->rf_atten <=
508 			 (rf->rf_rev < 6 ? BWI_RF_ATTEN_MAX0
509 			 		 : BWI_RF_ATTEN_MAX1),
510 		    ("rf_atten %d", new_tpctl->rf_atten));
511 		KASSERT(new_tpctl->tp_ctrl1 <= BWI_TPCTL1_MAX,
512 		    ("tp_ctrl1 %d", new_tpctl->tp_ctrl1));
513 
514 		tpctl->bbp_atten = new_tpctl->bbp_atten;
515 		tpctl->rf_atten = new_tpctl->rf_atten;
516 		tpctl->tp_ctrl1 = new_tpctl->tp_ctrl1;
517 	}
518 
519 	/* Set BBP attenuation */
520 	bwi_phy_set_bbp_atten(mac, tpctl->bbp_atten);
521 
522 	/* Set RF attenuation */
523 	RF_WRITE(mac, BWI_RFR_ATTEN, tpctl->rf_atten);
524 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_ATTEN,
525 		     tpctl->rf_atten);
526 
527 	/* Set TX power */
528 	if (rf->rf_type == BWI_RF_T_BCM2050) {
529 		RF_FILT_SETBITS(mac, BWI_RFR_TXPWR, ~BWI_RFR_TXPWR1_MASK,
530 			__SHIFTIN(tpctl->tp_ctrl1, BWI_RFR_TXPWR1_MASK));
531 	}
532 
533 	/* Adjust RF Local Oscillator */
534 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11G)
535 		bwi_rf_lo_adjust(mac, tpctl);
536 }
537 
538 static int
539 bwi_mac_test(struct bwi_mac *mac)
540 {
541 	struct bwi_softc *sc = mac->mac_sc;
542 	uint32_t orig_val, val;
543 
544 #define TEST_VAL1	0xaa5555aa
545 #define TEST_VAL2	0x55aaaa55
546 
547 	/* Save it for later restoring */
548 	orig_val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
549 
550 	/* Test 1 */
551 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL1);
552 	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
553 	if (val != TEST_VAL1) {
554 		device_printf(sc->sc_dev, "TEST1 failed\n");
555 		return ENXIO;
556 	}
557 
558 	/* Test 2 */
559 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, TEST_VAL2);
560 	val = MOBJ_READ_4(mac, BWI_COMM_MOBJ, 0);
561 	if (val != TEST_VAL2) {
562 		device_printf(sc->sc_dev, "TEST2 failed\n");
563 		return ENXIO;
564 	}
565 
566 	/* Restore to the original value */
567 	MOBJ_WRITE_4(mac, BWI_COMM_MOBJ, 0, orig_val);
568 
569 	val = CSR_READ_4(sc, BWI_MAC_STATUS);
570 	if ((val & ~BWI_MAC_STATUS_PHYLNK) != BWI_MAC_STATUS_IHREN) {
571 		device_printf(sc->sc_dev, "%s failed, MAC status 0x%08x\n",
572 			      __func__, val);
573 		return ENXIO;
574 	}
575 
576 	val = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
577 	if (val != 0) {
578 		device_printf(sc->sc_dev, "%s failed, intr status %08x\n",
579 			      __func__, val);
580 		return ENXIO;
581 	}
582 
583 #undef TEST_VAL2
584 #undef TEST_VAL1
585 
586 	return 0;
587 }
588 
589 static void
590 bwi_mac_setup_tpctl(struct bwi_mac *mac)
591 {
592 	struct bwi_softc *sc = mac->mac_sc;
593 	struct bwi_rf *rf = &mac->mac_rf;
594 	struct bwi_phy *phy = &mac->mac_phy;
595 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
596 
597 	/* Calc BBP attenuation */
598 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev < 6)
599 		tpctl->bbp_atten = 0;
600 	else
601 		tpctl->bbp_atten = 2;
602 
603 	/* Calc TX power CTRL1?? */
604 	tpctl->tp_ctrl1 = 0;
605 	if (rf->rf_type == BWI_RF_T_BCM2050) {
606 		if (rf->rf_rev == 1)
607 			tpctl->tp_ctrl1 = 3;
608 		else if (rf->rf_rev < 6)
609 			tpctl->tp_ctrl1 = 2;
610 		else if (rf->rf_rev == 8)
611 			tpctl->tp_ctrl1 = 1;
612 	}
613 
614 	/* Empty TX power CTRL2?? */
615 	tpctl->tp_ctrl2 = 0xffff;
616 
617 	/*
618 	 * Calc RF attenuation
619 	 */
620 	if (phy->phy_mode == IEEE80211_MODE_11A) {
621 		tpctl->rf_atten = 0x60;
622 		goto back;
623 	}
624 
625 	if (BWI_IS_BRCM_BCM4309G(sc) && sc->sc_pci_revid < 0x51) {
626 		tpctl->rf_atten = sc->sc_pci_revid < 0x43 ? 2 : 3;
627 		goto back;
628 	}
629 
630 	tpctl->rf_atten = 5;
631 
632 	if (rf->rf_type != BWI_RF_T_BCM2050) {
633 		if (rf->rf_type == BWI_RF_T_BCM2053 && rf->rf_rev == 1)
634 			tpctl->rf_atten = 6;
635 		goto back;
636 	}
637 
638 	/*
639 	 * NB: If we reaches here and the card is BRCM_BCM4309G,
640 	 *     then the card's PCI revision must >= 0x51
641 	 */
642 
643 	/* BCM2050 RF */
644 	switch (rf->rf_rev) {
645 	case 1:
646 		if (phy->phy_mode == IEEE80211_MODE_11G) {
647 			if (BWI_IS_BRCM_BCM4309G(sc) || BWI_IS_BRCM_BU4306(sc))
648 				tpctl->rf_atten = 3;
649 			else
650 				tpctl->rf_atten = 1;
651 		} else {
652 			if (BWI_IS_BRCM_BCM4309G(sc))
653 				tpctl->rf_atten = 7;
654 			else
655 				tpctl->rf_atten = 6;
656 		}
657 		break;
658 	case 2:
659 		if (phy->phy_mode == IEEE80211_MODE_11G) {
660 			/*
661 			 * NOTE: Order of following conditions is critical
662 			 */
663 			if (BWI_IS_BRCM_BCM4309G(sc))
664 				tpctl->rf_atten = 3;
665 			else if (BWI_IS_BRCM_BU4306(sc))
666 				tpctl->rf_atten = 5;
667 			else if (sc->sc_bbp_id == BWI_BBPID_BCM4320)
668 				tpctl->rf_atten = 4;
669 			else
670 				tpctl->rf_atten = 3;
671 		} else {
672 			tpctl->rf_atten = 6;
673 		}
674 		break;
675 	case 4:
676 	case 5:
677 		tpctl->rf_atten = 1;
678 		break;
679 	case 8:
680 		tpctl->rf_atten = 0x1a;
681 		break;
682 	}
683 back:
684 	DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_INIT | BWI_DBG_TXPOWER,
685 		"bbp atten: %u, rf atten: %u, ctrl1: %u, ctrl2: %u\n",
686 		tpctl->bbp_atten, tpctl->rf_atten,
687 		tpctl->tp_ctrl1, tpctl->tp_ctrl2);
688 }
689 
690 void
691 bwi_mac_dummy_xmit(struct bwi_mac *mac)
692 {
693 #define PACKET_LEN	5
694 	static const uint32_t	packet_11a[PACKET_LEN] =
695 	{ 0x000201cc, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
696 	static const uint32_t	packet_11bg[PACKET_LEN] =
697 	{ 0x000b846e, 0x00d40000, 0x00000000, 0x01000000, 0x00000000 };
698 
699 	struct bwi_softc *sc = mac->mac_sc;
700 	struct bwi_rf *rf = &mac->mac_rf;
701 	const uint32_t *packet;
702 	uint16_t val_50c;
703 	int wait_max, i;
704 
705 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
706 		wait_max = 30;
707 		packet = packet_11a;
708 		val_50c = 1;
709 	} else {
710 		wait_max = 250;
711 		packet = packet_11bg;
712 		val_50c = 0;
713 	}
714 
715 	for (i = 0; i < PACKET_LEN; ++i)
716 		TMPLT_WRITE_4(mac, i * 4, packet[i]);
717 
718 	CSR_READ_4(sc, BWI_MAC_STATUS);	/* dummy read */
719 
720 	CSR_WRITE_2(sc, 0x568, 0);
721 	CSR_WRITE_2(sc, 0x7c0, 0);
722 	CSR_WRITE_2(sc, 0x50c, val_50c);
723 	CSR_WRITE_2(sc, 0x508, 0);
724 	CSR_WRITE_2(sc, 0x50a, 0);
725 	CSR_WRITE_2(sc, 0x54c, 0);
726 	CSR_WRITE_2(sc, 0x56a, 0x14);
727 	CSR_WRITE_2(sc, 0x568, 0x826);
728 	CSR_WRITE_2(sc, 0x500, 0);
729 	CSR_WRITE_2(sc, 0x502, 0x30);
730 
731 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
732 		RF_WRITE(mac, 0x51, 0x17);
733 
734 	for (i = 0; i < wait_max; ++i) {
735 		if (CSR_READ_2(sc, 0x50e) & 0x80)
736 			break;
737 		DELAY(10);
738 	}
739 	for (i = 0; i < 10; ++i) {
740 		if (CSR_READ_2(sc, 0x50e) & 0x400)
741 			break;
742 		DELAY(10);
743 	}
744 	for (i = 0; i < 10; ++i) {
745 		if ((CSR_READ_2(sc, 0x690) & 0x100) == 0)
746 			break;
747 		DELAY(10);
748 	}
749 
750 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev <= 5)
751 		RF_WRITE(mac, 0x51, 0x37);
752 #undef PACKET_LEN
753 }
754 
755 void
756 bwi_mac_init_tpctl_11bg(struct bwi_mac *mac)
757 {
758 	struct bwi_softc *sc = mac->mac_sc;
759 	struct bwi_phy *phy = &mac->mac_phy;
760 	struct bwi_rf *rf = &mac->mac_rf;
761 	struct bwi_tpctl tpctl_orig;
762 	int restore_tpctl = 0;
763 
764 	KASSERT(phy->phy_mode != IEEE80211_MODE_11A,
765 	    ("phy_mode %d", phy->phy_mode));
766 
767 	if (BWI_IS_BRCM_BU4306(sc))
768 		return;
769 
770 	PHY_WRITE(mac, 0x28, 0x8018);
771 	CSR_CLRBITS_2(sc, BWI_BBP_ATTEN, 0x20);
772 
773 	if (phy->phy_mode == IEEE80211_MODE_11G) {
774 		if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
775 			return;
776 		PHY_WRITE(mac, 0x47a, 0xc111);
777 	}
778 	if (mac->mac_flags & BWI_MAC_F_TPCTL_INITED)
779 		return;
780 
781 	if (phy->phy_mode == IEEE80211_MODE_11B && phy->phy_rev >= 2 &&
782 	    rf->rf_type == BWI_RF_T_BCM2050) {
783 		RF_SETBITS(mac, 0x76, 0x84);
784 	} else {
785 		struct bwi_tpctl tpctl;
786 
787 		/* Backup original TX power control variables */
788 		bcopy(&mac->mac_tpctl, &tpctl_orig, sizeof(tpctl_orig));
789 		restore_tpctl = 1;
790 
791 		bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
792 		tpctl.bbp_atten = 11;
793 		tpctl.tp_ctrl1 = 0;
794 #ifdef notyet
795 		if (rf->rf_rev >= 6 && rf->rf_rev <= 8)
796 			tpctl.rf_atten = 31;
797 		else
798 #endif
799 			tpctl.rf_atten = 9;
800 
801 		bwi_mac_set_tpctl_11bg(mac, &tpctl);
802 	}
803 
804 	bwi_mac_dummy_xmit(mac);
805 
806 	mac->mac_flags |= BWI_MAC_F_TPCTL_INITED;
807 	rf->rf_base_tssi = PHY_READ(mac, 0x29);
808 	DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_INIT | BWI_DBG_TXPOWER,
809 		"base tssi %d\n", rf->rf_base_tssi);
810 
811 	if (abs(rf->rf_base_tssi - rf->rf_idle_tssi) >= 20) {
812 		device_printf(sc->sc_dev, "base tssi measure failed\n");
813 		mac->mac_flags |= BWI_MAC_F_TPCTL_ERROR;
814 	}
815 
816 	if (restore_tpctl)
817 		bwi_mac_set_tpctl_11bg(mac, &tpctl_orig);
818 	else
819 		RF_CLRBITS(mac, 0x76, 0x84);
820 
821 	bwi_rf_clear_tssi(mac);
822 }
823 
824 void
825 bwi_mac_detach(struct bwi_mac *mac)
826 {
827 	bwi_mac_fw_free(mac);
828 }
829 
830 static __inline int
831 bwi_fwimage_is_valid(struct bwi_softc *sc, const struct firmware *fw,
832 		     uint8_t fw_type)
833 {
834 	const struct bwi_fwhdr *hdr;
835 	struct ifnet *ifp = sc->sc_ifp;
836 
837 	if (fw->datasize < sizeof(*hdr)) {
838 		if_printf(ifp, "invalid firmware (%s): invalid size %zu\n",
839 			  fw->name, fw->datasize);
840 		return 0;
841 	}
842 
843 	hdr = (const struct bwi_fwhdr *)fw->data;
844 
845 	if (fw_type != BWI_FW_T_IV) {
846 		/*
847 		 * Don't verify IV's size, it has different meaning
848 		 */
849 		if (be32toh(hdr->fw_size) != fw->datasize - sizeof(*hdr)) {
850 			if_printf(ifp, "invalid firmware (%s): size mismatch, "
851 				  "fw %u, real %zu\n", fw->name,
852 				  be32toh(hdr->fw_size),
853 				  fw->datasize - sizeof(*hdr));
854 			return 0;
855 		}
856 	}
857 
858 	if (hdr->fw_type != fw_type) {
859 		if_printf(ifp, "invalid firmware (%s): type mismatch, "
860 			  "fw \'%c\', target \'%c\'\n", fw->name,
861 			  hdr->fw_type, fw_type);
862 		return 0;
863 	}
864 
865 	if (hdr->fw_gen != BWI_FW_GEN_1) {
866 		if_printf(ifp, "invalid firmware (%s): wrong generation, "
867 			  "fw %d, target %d\n", fw->name,
868 			  hdr->fw_gen, BWI_FW_GEN_1);
869 		return 0;
870 	}
871 	return 1;
872 }
873 
874 /*
875  * XXX Error cleanup
876  */
877 int
878 bwi_mac_fw_alloc(struct bwi_mac *mac)
879 {
880 	struct bwi_softc *sc = mac->mac_sc;
881 	char fwname[64];
882 	int idx;
883 
884 	/*
885 	 * Try getting the firmware stub so firmware
886 	 * module would be loaded automatically
887 	 */
888 	if (mac->mac_stub == NULL) {
889 		snprintf(fwname, sizeof(fwname), BWI_FW_STUB_PATH,
890 			 sc->sc_fw_version);
891 		mac->mac_stub = firmware_get(fwname);
892 		if (mac->mac_stub == NULL)
893 			goto no_firmware;
894 	}
895 
896 	if (mac->mac_ucode == NULL) {
897 		snprintf(fwname, sizeof(fwname), BWI_FW_UCODE_PATH,
898 			  sc->sc_fw_version,
899 			  mac->mac_rev >= 5 ? 5 : mac->mac_rev);
900 
901 		mac->mac_ucode = firmware_get(fwname);
902 		if (mac->mac_ucode == NULL)
903 			goto no_firmware;
904 		if (!bwi_fwimage_is_valid(sc, mac->mac_ucode, BWI_FW_T_UCODE))
905 			return EINVAL;
906 	}
907 
908 	if (mac->mac_pcm == NULL) {
909 		snprintf(fwname, sizeof(fwname), BWI_FW_PCM_PATH,
910 			  sc->sc_fw_version,
911 			  mac->mac_rev < 5 ? 4 : 5);
912 
913 		mac->mac_pcm = firmware_get(fwname);
914 		if (mac->mac_pcm == NULL)
915 			goto no_firmware;
916 		if (!bwi_fwimage_is_valid(sc, mac->mac_pcm, BWI_FW_T_PCM))
917 			return EINVAL;
918 	}
919 
920 	if (mac->mac_iv == NULL) {
921 		/* TODO: 11A */
922 		if (mac->mac_rev == 2 || mac->mac_rev == 4) {
923 			idx = 2;
924 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
925 			idx = 5;
926 		} else {
927 			device_printf(sc->sc_dev,
928 			    "no suitible IV for MAC rev %d\n", mac->mac_rev);
929 			return ENODEV;
930 		}
931 
932 		snprintf(fwname, sizeof(fwname), BWI_FW_IV_PATH,
933 			  sc->sc_fw_version, idx);
934 
935 		mac->mac_iv = firmware_get(fwname);
936 		if (mac->mac_iv == NULL)
937 			goto no_firmware;
938 		if (!bwi_fwimage_is_valid(sc, mac->mac_iv, BWI_FW_T_IV))
939 			return EINVAL;
940 	}
941 
942 	if (mac->mac_iv_ext == NULL) {
943 		/* TODO: 11A */
944 		if (mac->mac_rev == 2 || mac->mac_rev == 4 ||
945 		    mac->mac_rev >= 11) {
946 			/* No extended IV */
947 			return (0);
948 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
949 			idx = 5;
950 		} else {
951 			device_printf(sc->sc_dev,
952 			    "no suitible ExtIV for MAC rev %d\n", mac->mac_rev);
953 			return ENODEV;
954 		}
955 
956 		snprintf(fwname, sizeof(fwname), BWI_FW_IV_EXT_PATH,
957 			  sc->sc_fw_version, idx);
958 
959 		mac->mac_iv_ext = firmware_get(fwname);
960 		if (mac->mac_iv_ext == NULL)
961 			goto no_firmware;
962 		if (!bwi_fwimage_is_valid(sc, mac->mac_iv_ext, BWI_FW_T_IV))
963 			return EINVAL;
964 	}
965 	return (0);
966 
967 no_firmware:
968 	device_printf(sc->sc_dev, "request firmware %s failed\n", fwname);
969 	return (ENOENT);
970 }
971 
972 static void
973 bwi_mac_fw_free(struct bwi_mac *mac)
974 {
975 	if (mac->mac_ucode != NULL) {
976 		firmware_put(mac->mac_ucode, FIRMWARE_UNLOAD);
977 		mac->mac_ucode = NULL;
978 	}
979 
980 	if (mac->mac_pcm != NULL) {
981 		firmware_put(mac->mac_pcm, FIRMWARE_UNLOAD);
982 		mac->mac_pcm = NULL;
983 	}
984 
985 	if (mac->mac_iv != NULL) {
986 		firmware_put(mac->mac_iv, FIRMWARE_UNLOAD);
987 		mac->mac_iv = NULL;
988 	}
989 
990 	if (mac->mac_iv_ext != NULL) {
991 		firmware_put(mac->mac_iv_ext, FIRMWARE_UNLOAD);
992 		mac->mac_iv_ext = NULL;
993 	}
994 
995 	if (mac->mac_stub != NULL) {
996 		firmware_put(mac->mac_stub, FIRMWARE_UNLOAD);
997 		mac->mac_stub = NULL;
998 	}
999 }
1000 
1001 static int
1002 bwi_mac_fw_load(struct bwi_mac *mac)
1003 {
1004 	struct bwi_softc *sc = mac->mac_sc;
1005 	struct ifnet *ifp = sc->sc_ifp;
1006 	const uint32_t *fw;
1007 	uint16_t fw_rev;
1008 	int fw_len, i;
1009 
1010 	/*
1011 	 * Load ucode image
1012 	 */
1013 	fw = (const uint32_t *)
1014 	     ((const uint8_t *)mac->mac_ucode->data + BWI_FWHDR_SZ);
1015 	fw_len = (mac->mac_ucode->datasize - BWI_FWHDR_SZ) / sizeof(uint32_t);
1016 
1017 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1018 		    BWI_MOBJ_CTRL_VAL(
1019 		    BWI_FW_UCODE_MOBJ | BWI_WR_MOBJ_AUTOINC, 0));
1020 	for (i = 0; i < fw_len; ++i) {
1021 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, be32toh(fw[i]));
1022 		DELAY(10);
1023 	}
1024 
1025 	/*
1026 	 * Load PCM image
1027 	 */
1028 	fw = (const uint32_t *)
1029 	     ((const uint8_t *)mac->mac_pcm->data + BWI_FWHDR_SZ);
1030 	fw_len = (mac->mac_pcm->datasize - BWI_FWHDR_SZ) / sizeof(uint32_t);
1031 
1032 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1033 		    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01ea));
1034 	CSR_WRITE_4(sc, BWI_MOBJ_DATA, 0x4000);
1035 
1036 	CSR_WRITE_4(sc, BWI_MOBJ_CTRL,
1037 		    BWI_MOBJ_CTRL_VAL(BWI_FW_PCM_MOBJ, 0x01eb));
1038 	for (i = 0; i < fw_len; ++i) {
1039 		CSR_WRITE_4(sc, BWI_MOBJ_DATA, be32toh(fw[i]));
1040 		DELAY(10);
1041 	}
1042 
1043 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_ALL_INTRS);
1044 	CSR_WRITE_4(sc, BWI_MAC_STATUS,
1045 		    BWI_MAC_STATUS_UCODE_START |
1046 		    BWI_MAC_STATUS_IHREN |
1047 		    BWI_MAC_STATUS_INFRA);
1048 
1049 #define NRETRY	200
1050 
1051 	for (i = 0; i < NRETRY; ++i) {
1052 		uint32_t intr_status;
1053 
1054 		intr_status = CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1055 		if (intr_status == BWI_INTR_READY)
1056 			break;
1057 		DELAY(10);
1058 	}
1059 	if (i == NRETRY) {
1060 		if_printf(ifp, "firmware (ucode&pcm) loading timed out\n");
1061 		return ETIMEDOUT;
1062 	}
1063 
1064 #undef NRETRY
1065 
1066 	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);	/* dummy read */
1067 
1068 	fw_rev = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWREV);
1069 	if (fw_rev > BWI_FW_VERSION3_REVMAX) {
1070 		if_printf(ifp, "firmware version 4 is not supported yet\n");
1071 		return ENODEV;
1072 	}
1073 
1074 	if_printf(ifp, "firmware rev 0x%04x, patch level 0x%04x\n", fw_rev,
1075 		  MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
1076 	return 0;
1077 }
1078 
1079 static int
1080 bwi_mac_gpio_init(struct bwi_mac *mac)
1081 {
1082 	struct bwi_softc *sc = mac->mac_sc;
1083 	struct bwi_regwin *old, *gpio_rw;
1084 	uint32_t filt, bits;
1085 	int error;
1086 
1087 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_GPOSEL_MASK);
1088 	/* TODO:LED */
1089 
1090 	CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0xf);
1091 
1092 	filt = 0x1f;
1093 	bits = 0xf;
1094 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301) {
1095 		filt |= 0x60;
1096 		bits |= 0x60;
1097 	}
1098 	if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
1099 		CSR_SETBITS_2(sc, BWI_MAC_GPIO_MASK, 0x200);
1100 		filt |= 0x200;
1101 		bits |= 0x200;
1102 	}
1103 
1104 	gpio_rw = BWI_GPIO_REGWIN(sc);
1105 	error = bwi_regwin_switch(sc, gpio_rw, &old);
1106 	if (error)
1107 		return error;
1108 
1109 	CSR_FILT_SETBITS_4(sc, BWI_GPIO_CTRL, filt, bits);
1110 
1111 	return bwi_regwin_switch(sc, old, NULL);
1112 }
1113 
1114 static int
1115 bwi_mac_gpio_fini(struct bwi_mac *mac)
1116 {
1117 	struct bwi_softc *sc = mac->mac_sc;
1118 	struct bwi_regwin *old, *gpio_rw;
1119 	int error;
1120 
1121 	gpio_rw = BWI_GPIO_REGWIN(sc);
1122 	error = bwi_regwin_switch(sc, gpio_rw, &old);
1123 	if (error)
1124 		return error;
1125 
1126 	CSR_WRITE_4(sc, BWI_GPIO_CTRL, 0);
1127 
1128 	return bwi_regwin_switch(sc, old, NULL);
1129 }
1130 
1131 static int
1132 bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
1133 {
1134 	struct bwi_softc *sc = mac->mac_sc;
1135 	struct ifnet *ifp = sc->sc_ifp;
1136 	const struct bwi_fwhdr *hdr;
1137 	const struct bwi_fw_iv *iv;
1138 	int n, i, iv_img_size;
1139 
1140 	/* Get the number of IVs in the IV image */
1141 	hdr = (const struct bwi_fwhdr *)fw->data;
1142 	n = be32toh(hdr->fw_iv_cnt);
1143 	DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_INIT | BWI_DBG_FIRMWARE,
1144 		"IV count %d\n", n);
1145 
1146 	/* Calculate the IV image size, for later sanity check */
1147 	iv_img_size = fw->datasize - sizeof(*hdr);
1148 
1149 	/* Locate the first IV */
1150 	iv = (const struct bwi_fw_iv *)
1151 	     ((const uint8_t *)fw->data + sizeof(*hdr));
1152 
1153 	for (i = 0; i < n; ++i) {
1154 		uint16_t iv_ofs, ofs;
1155 		int sz = 0;
1156 
1157 		if (iv_img_size < sizeof(iv->iv_ofs)) {
1158 			if_printf(ifp, "invalid IV image, ofs\n");
1159 			return EINVAL;
1160 		}
1161 		iv_img_size -= sizeof(iv->iv_ofs);
1162 		sz += sizeof(iv->iv_ofs);
1163 
1164 		iv_ofs = be16toh(iv->iv_ofs);
1165 
1166 		ofs = __SHIFTOUT(iv_ofs, BWI_FW_IV_OFS_MASK);
1167 		if (ofs >= 0x1000) {
1168 			if_printf(ifp, "invalid ofs (0x%04x) "
1169 				  "for %dth iv\n", ofs, i);
1170 			return EINVAL;
1171 		}
1172 
1173 		if (iv_ofs & BWI_FW_IV_IS_32BIT) {
1174 			uint32_t val32;
1175 
1176 			if (iv_img_size < sizeof(iv->iv_val.val32)) {
1177 				if_printf(ifp, "invalid IV image, val32\n");
1178 				return EINVAL;
1179 			}
1180 			iv_img_size -= sizeof(iv->iv_val.val32);
1181 			sz += sizeof(iv->iv_val.val32);
1182 
1183 			val32 = be32toh(iv->iv_val.val32);
1184 			CSR_WRITE_4(sc, ofs, val32);
1185 		} else {
1186 			uint16_t val16;
1187 
1188 			if (iv_img_size < sizeof(iv->iv_val.val16)) {
1189 				if_printf(ifp, "invalid IV image, val16\n");
1190 				return EINVAL;
1191 			}
1192 			iv_img_size -= sizeof(iv->iv_val.val16);
1193 			sz += sizeof(iv->iv_val.val16);
1194 
1195 			val16 = be16toh(iv->iv_val.val16);
1196 			CSR_WRITE_2(sc, ofs, val16);
1197 		}
1198 
1199 		iv = (const struct bwi_fw_iv *)((const uint8_t *)iv + sz);
1200 	}
1201 
1202 	if (iv_img_size != 0) {
1203 		if_printf(ifp, "invalid IV image, size left %d\n", iv_img_size);
1204 		return EINVAL;
1205 	}
1206 	return 0;
1207 }
1208 
1209 static int
1210 bwi_mac_fw_init(struct bwi_mac *mac)
1211 {
1212 	struct ifnet *ifp = mac->mac_sc->sc_ifp;
1213 	int error;
1214 
1215 	error = bwi_mac_fw_load_iv(mac, mac->mac_iv);
1216 	if (error) {
1217 		if_printf(ifp, "load IV failed\n");
1218 		return error;
1219 	}
1220 
1221 	if (mac->mac_iv_ext != NULL) {
1222 		error = bwi_mac_fw_load_iv(mac, mac->mac_iv_ext);
1223 		if (error)
1224 			if_printf(ifp, "load ExtIV failed\n");
1225 	}
1226 	return error;
1227 }
1228 
1229 static void
1230 bwi_mac_opmode_init(struct bwi_mac *mac)
1231 {
1232 	struct bwi_softc *sc = mac->mac_sc;
1233 	struct ifnet *ifp = sc->sc_ifp;
1234 	struct ieee80211com *ic = ifp->if_l2com;
1235 	uint32_t mac_status;
1236 	uint16_t pre_tbtt;
1237 
1238 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
1239 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_INFRA);
1240 
1241 	/* Set probe resp timeout to infinite */
1242 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 0);
1243 
1244 	/*
1245 	 * TODO: factor out following part
1246 	 */
1247 
1248 	mac_status = CSR_READ_4(sc, BWI_MAC_STATUS);
1249 	mac_status &= ~(BWI_MAC_STATUS_OPMODE_HOSTAP |
1250 			BWI_MAC_STATUS_PASS_CTL |
1251 			BWI_MAC_STATUS_PASS_BCN |
1252 			BWI_MAC_STATUS_PASS_BADPLCP |
1253 			BWI_MAC_STATUS_PASS_BADFCS |
1254 			BWI_MAC_STATUS_PROMISC);
1255 	mac_status |= BWI_MAC_STATUS_INFRA;
1256 
1257 	/* Always turn on PROMISC on old hardware */
1258 	if (mac->mac_rev < 5)
1259 		mac_status |= BWI_MAC_STATUS_PROMISC;
1260 
1261 	switch (ic->ic_opmode) {
1262 	case IEEE80211_M_IBSS:
1263 		mac_status &= ~BWI_MAC_STATUS_INFRA;
1264 		break;
1265 	case IEEE80211_M_HOSTAP:
1266 		mac_status |= BWI_MAC_STATUS_OPMODE_HOSTAP;
1267 		break;
1268 	case IEEE80211_M_MONITOR:
1269 #if 0
1270 		/* Do you want data from your microwave oven? */
1271 		mac_status |= BWI_MAC_STATUS_PASS_CTL |
1272 			      BWI_MAC_STATUS_PASS_BADPLCP |
1273 			      BWI_MAC_STATUS_PASS_BADFCS;
1274 #else
1275 		mac_status |= BWI_MAC_STATUS_PASS_CTL;
1276 #endif
1277 		/* Promisc? */
1278 		break;
1279 	default:
1280 		break;
1281 	}
1282 
1283 	if (ic->ic_ifp->if_flags & IFF_PROMISC)
1284 		mac_status |= BWI_MAC_STATUS_PROMISC;
1285 
1286 	CSR_WRITE_4(sc, BWI_MAC_STATUS, mac_status);
1287 
1288 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1289 	    ic->ic_opmode != IEEE80211_M_HOSTAP) {
1290 		if (sc->sc_bbp_id == BWI_BBPID_BCM4306 && sc->sc_bbp_rev == 3)
1291 			pre_tbtt = 100;
1292 		else
1293 			pre_tbtt = 50;
1294 	} else {
1295 		pre_tbtt = 2;
1296 	}
1297 	CSR_WRITE_2(sc, BWI_MAC_PRE_TBTT, pre_tbtt);
1298 }
1299 
1300 static void
1301 bwi_mac_hostflags_init(struct bwi_mac *mac)
1302 {
1303 	struct bwi_softc *sc = mac->mac_sc;
1304 	struct bwi_phy *phy = &mac->mac_phy;
1305 	struct bwi_rf *rf = &mac->mac_rf;
1306 	uint64_t host_flags;
1307 
1308 	if (phy->phy_mode == IEEE80211_MODE_11A)
1309 		return;
1310 
1311 	host_flags = HFLAGS_READ(mac);
1312 	host_flags |= BWI_HFLAG_SYM_WA;
1313 
1314 	if (phy->phy_mode == IEEE80211_MODE_11G) {
1315 		if (phy->phy_rev == 1)
1316 			host_flags |= BWI_HFLAG_GDC_WA;
1317 		if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9)
1318 			host_flags |= BWI_HFLAG_OFDM_PA;
1319 	} else if (phy->phy_mode == IEEE80211_MODE_11B) {
1320 		if (phy->phy_rev >= 2 && rf->rf_type == BWI_RF_T_BCM2050)
1321 			host_flags &= ~BWI_HFLAG_GDC_WA;
1322 	} else {
1323 		panic("unknown PHY mode %u\n", phy->phy_mode);
1324 	}
1325 
1326 	HFLAGS_WRITE(mac, host_flags);
1327 }
1328 
1329 static void
1330 bwi_mac_bss_param_init(struct bwi_mac *mac)
1331 {
1332 	struct bwi_softc *sc = mac->mac_sc;
1333 	struct bwi_phy *phy = &mac->mac_phy;
1334 	struct ifnet *ifp = sc->sc_ifp;
1335 	struct ieee80211com *ic = ifp->if_l2com;
1336 	const struct ieee80211_rate_table *rt;
1337 	struct bwi_retry_lim lim;
1338 	uint16_t cw_min;
1339 
1340 	/*
1341 	 * Set short/long retry limits
1342 	 */
1343 	bzero(&lim, sizeof(lim));
1344 	lim.shretry = BWI_SHRETRY;
1345 	lim.shretry_fb = BWI_SHRETRY_FB;
1346 	lim.lgretry = BWI_LGRETRY;
1347 	lim.lgretry_fb = BWI_LGRETRY_FB;
1348 	bwi_mac_set_retry_lim(mac, &lim);
1349 
1350 	/*
1351 	 * Implicitly prevent firmware from sending probe response
1352 	 * by setting its "probe response timeout" to 1us.
1353 	 */
1354 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_PROBE_RESP_TO, 1);
1355 
1356 	/*
1357 	 * XXX MAC level acknowledge and CW min/max should depend
1358 	 * on the char rateset of the IBSS/BSS to join.
1359 	 * XXX this is all wrong; should be done on channel change
1360 	 */
1361 	if (phy->phy_mode == IEEE80211_MODE_11B) {
1362 		rt = ieee80211_get_ratetable(
1363 		    ieee80211_find_channel(ic, 2412, IEEE80211_CHAN_B));
1364 		bwi_mac_set_ackrates(mac, rt,
1365 		    &ic->ic_sup_rates[IEEE80211_MODE_11B]);
1366 	} else {
1367 		rt = ieee80211_get_ratetable(
1368 		    ieee80211_find_channel(ic, 2412, IEEE80211_CHAN_G));
1369 		bwi_mac_set_ackrates(mac, rt,
1370 		    &ic->ic_sup_rates[IEEE80211_MODE_11G]);
1371 	}
1372 
1373 	/*
1374 	 * Set CW min
1375 	 */
1376 	if (phy->phy_mode == IEEE80211_MODE_11B)
1377 		cw_min = IEEE80211_CW_MIN_0;
1378 	else
1379 		cw_min = IEEE80211_CW_MIN_1;
1380 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMIN, cw_min);
1381 
1382 	/*
1383 	 * Set CW max
1384 	 */
1385 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_CWMAX,
1386 		     IEEE80211_CW_MAX);
1387 }
1388 
1389 static void
1390 bwi_mac_set_retry_lim(struct bwi_mac *mac, const struct bwi_retry_lim *lim)
1391 {
1392 	/* Short/Long retry limit */
1393 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_SHRETRY,
1394 		     lim->shretry);
1395 	MOBJ_WRITE_2(mac, BWI_80211_MOBJ, BWI_80211_MOBJ_LGRETRY,
1396 		     lim->lgretry);
1397 
1398 	/* Short/Long retry fallback limit */
1399 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SHRETRY_FB,
1400 		     lim->shretry_fb);
1401 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_LGRETEY_FB,
1402 		     lim->lgretry_fb);
1403 }
1404 
1405 static void
1406 bwi_mac_set_ackrates(struct bwi_mac *mac, const struct ieee80211_rate_table *rt,
1407 	const struct ieee80211_rateset *rs)
1408 {
1409 	int i;
1410 
1411 	/* XXX not standard conforming */
1412 	for (i = 0; i < rs->rs_nrates; ++i) {
1413 		enum ieee80211_phytype modtype;
1414 		uint16_t ofs;
1415 
1416 		modtype = ieee80211_rate2phytype(rt,
1417 		    rs->rs_rates[i] & IEEE80211_RATE_VAL);
1418 		switch (modtype) {
1419 		case IEEE80211_T_DS:
1420 			ofs = 0x4c0;
1421 			break;
1422 		case IEEE80211_T_OFDM:
1423 			ofs = 0x480;
1424 			break;
1425 		default:
1426 			panic("unsupported modtype %u\n", modtype);
1427 		}
1428 		ofs += 2*(ieee80211_rate2plcp(
1429 		    rs->rs_rates[i] & IEEE80211_RATE_VAL,
1430 		    modtype) & 0xf);
1431 
1432 		MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, ofs + 0x20,
1433 			     MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs));
1434 	}
1435 }
1436 
1437 int
1438 bwi_mac_start(struct bwi_mac *mac)
1439 {
1440 	struct bwi_softc *sc = mac->mac_sc;
1441 
1442 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
1443 	CSR_WRITE_4(sc, BWI_MAC_INTR_STATUS, BWI_INTR_READY);
1444 
1445 	/* Flush pending bus writes */
1446 	CSR_READ_4(sc, BWI_MAC_STATUS);
1447 	CSR_READ_4(sc, BWI_MAC_INTR_STATUS);
1448 
1449 	return bwi_mac_config_ps(mac);
1450 }
1451 
1452 int
1453 bwi_mac_stop(struct bwi_mac *mac)
1454 {
1455 	struct bwi_softc *sc = mac->mac_sc;
1456 	int error, i;
1457 
1458 	error = bwi_mac_config_ps(mac);
1459 	if (error)
1460 		return error;
1461 
1462 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_ENABLE);
1463 
1464 	/* Flush pending bus write */
1465 	CSR_READ_4(sc, BWI_MAC_STATUS);
1466 
1467 #define NRETRY	10000
1468 	for (i = 0; i < NRETRY; ++i) {
1469 		if (CSR_READ_4(sc, BWI_MAC_INTR_STATUS) & BWI_INTR_READY)
1470 			break;
1471 		DELAY(1);
1472 	}
1473 	if (i == NRETRY) {
1474 		device_printf(sc->sc_dev, "can't stop MAC\n");
1475 		return ETIMEDOUT;
1476 	}
1477 #undef NRETRY
1478 
1479 	return 0;
1480 }
1481 
1482 int
1483 bwi_mac_config_ps(struct bwi_mac *mac)
1484 {
1485 	struct bwi_softc *sc = mac->mac_sc;
1486 	uint32_t status;
1487 
1488 	status = CSR_READ_4(sc, BWI_MAC_STATUS);
1489 
1490 	status &= ~BWI_MAC_STATUS_HW_PS;
1491 	status |= BWI_MAC_STATUS_WAKEUP;
1492 	CSR_WRITE_4(sc, BWI_MAC_STATUS, status);
1493 
1494 	/* Flush pending bus write */
1495 	CSR_READ_4(sc, BWI_MAC_STATUS);
1496 
1497 	if (mac->mac_rev >= 5) {
1498 		int i;
1499 
1500 #define NRETRY	100
1501 		for (i = 0; i < NRETRY; ++i) {
1502 			if (MOBJ_READ_2(mac, BWI_COMM_MOBJ,
1503 			    BWI_COMM_MOBJ_UCODE_STATE) != BWI_UCODE_STATE_PS)
1504 				break;
1505 			DELAY(10);
1506 		}
1507 		if (i == NRETRY) {
1508 			device_printf(sc->sc_dev, "config PS failed\n");
1509 			return ETIMEDOUT;
1510 		}
1511 #undef NRETRY
1512 	}
1513 	return 0;
1514 }
1515 
1516 void
1517 bwi_mac_reset_hwkeys(struct bwi_mac *mac)
1518 {
1519 	/* TODO: firmware crypto */
1520 	MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_KEYTABLE_OFS);
1521 }
1522 
1523 void
1524 bwi_mac_shutdown(struct bwi_mac *mac)
1525 {
1526 	struct bwi_softc *sc = mac->mac_sc;
1527 	int i;
1528 
1529 	if (mac->mac_flags & BWI_MAC_F_HAS_TXSTATS)
1530 		sc->sc_free_txstats(sc);
1531 
1532 	sc->sc_free_rx_ring(sc);
1533 
1534 	for (i = 0; i < BWI_TX_NRING; ++i)
1535 		sc->sc_free_tx_ring(sc, i);
1536 
1537 	bwi_rf_off(mac);
1538 
1539 	/* TODO:LED */
1540 
1541 	bwi_mac_gpio_fini(mac);
1542 
1543 	bwi_rf_off(mac); /* XXX again */
1544 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, BWI_BBP_ATTEN_MAGIC);
1545 	bwi_regwin_disable(sc, &mac->mac_regwin, 0);
1546 
1547 	mac->mac_flags &= ~BWI_MAC_F_INITED;
1548 }
1549 
1550 static int
1551 bwi_mac_get_property(struct bwi_mac *mac)
1552 {
1553 	struct bwi_softc *sc = mac->mac_sc;
1554 	enum bwi_bus_space old_bus_space;
1555 	uint32_t val;
1556 
1557 	/*
1558 	 * Byte swap
1559 	 */
1560 	val = CSR_READ_4(sc, BWI_MAC_STATUS);
1561 	if (val & BWI_MAC_STATUS_BSWAP) {
1562 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH, "%s\n",
1563 			"need byte swap");
1564 		mac->mac_flags |= BWI_MAC_F_BSWAP;
1565 	}
1566 
1567 	/*
1568 	 * DMA address space
1569 	 */
1570 	old_bus_space = sc->sc_bus_space;
1571 
1572 	val = CSR_READ_4(sc, BWI_STATE_HI);
1573 	if (__SHIFTOUT(val, BWI_STATE_HI_FLAGS_MASK) &
1574 	    BWI_STATE_HI_FLAG_64BIT) {
1575 		/* 64bit address */
1576 		sc->sc_bus_space = BWI_BUS_SPACE_64BIT;
1577 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH, "%s\n",
1578 			"64bit bus space");
1579 	} else {
1580 		uint32_t txrx_reg = BWI_TXRX_CTRL_BASE + BWI_TX32_CTRL;
1581 
1582 		CSR_WRITE_4(sc, txrx_reg, BWI_TXRX32_CTRL_ADDRHI_MASK);
1583 		if (CSR_READ_4(sc, txrx_reg) & BWI_TXRX32_CTRL_ADDRHI_MASK) {
1584 			/* 32bit address */
1585 			sc->sc_bus_space = BWI_BUS_SPACE_32BIT;
1586 			DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH, "%s\n",
1587 				"32bit bus space");
1588 		} else {
1589 			/* 30bit address */
1590 			sc->sc_bus_space = BWI_BUS_SPACE_30BIT;
1591 			DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH, "%s\n",
1592 				"30bit bus space");
1593 		}
1594 	}
1595 
1596 	if (old_bus_space != 0 && old_bus_space != sc->sc_bus_space) {
1597 		device_printf(sc->sc_dev, "MACs bus space mismatch!\n");
1598 		return ENXIO;
1599 	}
1600 	return 0;
1601 }
1602 
1603 void
1604 bwi_mac_updateslot(struct bwi_mac *mac, int shslot)
1605 {
1606 	uint16_t slot_time;
1607 
1608 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B)
1609 		return;
1610 
1611 	if (shslot)
1612 		slot_time = IEEE80211_DUR_SHSLOT;
1613 	else
1614 		slot_time = IEEE80211_DUR_SLOT;
1615 
1616 	CSR_WRITE_2(mac->mac_sc, BWI_MAC_SLOTTIME,
1617 		    slot_time + BWI_MAC_SLOTTIME_ADJUST);
1618 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_SLOTTIME, slot_time);
1619 }
1620 
1621 int
1622 bwi_mac_attach(struct bwi_softc *sc, int id, uint8_t rev)
1623 {
1624 	struct bwi_mac *mac;
1625 	int i;
1626 
1627 	KASSERT(sc->sc_nmac <= BWI_MAC_MAX && sc->sc_nmac >= 0,
1628 	    ("sc_nmac %d", sc->sc_nmac));
1629 
1630 	if (sc->sc_nmac == BWI_MAC_MAX) {
1631 		device_printf(sc->sc_dev, "too many MACs\n");
1632 		return 0;
1633 	}
1634 
1635 	/*
1636 	 * More than one MAC is only supported by BCM4309
1637 	 */
1638 	if (sc->sc_nmac != 0 &&
1639 	    sc->sc_pci_did != PCI_PRODUCT_BROADCOM_BCM4309) {
1640 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH, "%s\n",
1641 			"ignore second MAC");
1642 		return 0;
1643 	}
1644 
1645 	mac = &sc->sc_mac[sc->sc_nmac];
1646 
1647 	/* XXX will this happen? */
1648 	if (BWI_REGWIN_EXIST(&mac->mac_regwin)) {
1649 		device_printf(sc->sc_dev, "%dth MAC already attached\n",
1650 			      sc->sc_nmac);
1651 		return 0;
1652 	}
1653 
1654 	/*
1655 	 * Test whether the revision of this MAC is supported
1656 	 */
1657 #define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
1658 	for (i = 0; i < N(bwi_sup_macrev); ++i) {
1659 		if (bwi_sup_macrev[i] == rev)
1660 			break;
1661 	}
1662 	if (i == N(bwi_sup_macrev)) {
1663 		device_printf(sc->sc_dev, "MAC rev %u is "
1664 			      "not supported\n", rev);
1665 		return ENXIO;
1666 	}
1667 #undef N
1668 
1669 	BWI_CREATE_MAC(mac, sc, id, rev);
1670 	sc->sc_nmac++;
1671 
1672 	if (mac->mac_rev < 5) {
1673 		mac->mac_flags |= BWI_MAC_F_HAS_TXSTATS;
1674 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_ATTACH, "%s\n",
1675 			"has TX stats");
1676 	} else {
1677 		mac->mac_flags |= BWI_MAC_F_PHYE_RESET;
1678 	}
1679 
1680 	device_printf(sc->sc_dev, "MAC: rev %u\n", rev);
1681 	return 0;
1682 }
1683 
1684 static __inline void
1685 bwi_mac_balance_atten(int *bbp_atten0, int *rf_atten0)
1686 {
1687 	int bbp_atten, rf_atten, rf_atten_lim = -1;
1688 
1689 	bbp_atten = *bbp_atten0;
1690 	rf_atten = *rf_atten0;
1691 
1692 	/*
1693 	 * RF attenuation affects TX power BWI_RF_ATTEN_FACTOR times
1694 	 * as much as BBP attenuation, so we try our best to keep RF
1695 	 * attenuation within range.  BBP attenuation will be clamped
1696 	 * later if it is out of range during balancing.
1697 	 *
1698 	 * BWI_RF_ATTEN_MAX0 is used as RF attenuation upper limit.
1699 	 */
1700 
1701 	/*
1702 	 * Use BBP attenuation to balance RF attenuation
1703 	 */
1704 	if (rf_atten < 0)
1705 		rf_atten_lim = 0;
1706 	else if (rf_atten > BWI_RF_ATTEN_MAX0)
1707 		rf_atten_lim = BWI_RF_ATTEN_MAX0;
1708 
1709 	if (rf_atten_lim >= 0) {
1710 		bbp_atten += (BWI_RF_ATTEN_FACTOR * (rf_atten - rf_atten_lim));
1711 		rf_atten = rf_atten_lim;
1712 	}
1713 
1714 	/*
1715 	 * If possible, use RF attenuation to balance BBP attenuation
1716 	 * NOTE: RF attenuation is still kept within range.
1717 	 */
1718 	while (rf_atten < BWI_RF_ATTEN_MAX0 && bbp_atten > BWI_BBP_ATTEN_MAX) {
1719 		bbp_atten -= BWI_RF_ATTEN_FACTOR;
1720 		++rf_atten;
1721 	}
1722 	while (rf_atten > 0 && bbp_atten < 0) {
1723 		bbp_atten += BWI_RF_ATTEN_FACTOR;
1724 		--rf_atten;
1725 	}
1726 
1727 	/* RF attenuation MUST be within range */
1728 	KASSERT(rf_atten >= 0 && rf_atten <= BWI_RF_ATTEN_MAX0,
1729 	    ("rf_atten %d", rf_atten));
1730 
1731 	/*
1732 	 * Clamp BBP attenuation
1733 	 */
1734 	if (bbp_atten < 0)
1735 		bbp_atten = 0;
1736 	else if (bbp_atten > BWI_BBP_ATTEN_MAX)
1737 		bbp_atten = BWI_BBP_ATTEN_MAX;
1738 
1739 	*rf_atten0 = rf_atten;
1740 	*bbp_atten0 = bbp_atten;
1741 }
1742 
1743 static void
1744 bwi_mac_adjust_tpctl(struct bwi_mac *mac, int rf_atten_adj, int bbp_atten_adj)
1745 {
1746 	struct bwi_softc *sc = mac->mac_sc;
1747 	struct bwi_rf *rf = &mac->mac_rf;
1748 	struct bwi_tpctl tpctl;
1749 	int bbp_atten, rf_atten, tp_ctrl1;
1750 
1751 	bcopy(&mac->mac_tpctl, &tpctl, sizeof(tpctl));
1752 
1753 	/* NOTE: Use signed value to do calulation */
1754 	bbp_atten = tpctl.bbp_atten;
1755 	rf_atten = tpctl.rf_atten;
1756 	tp_ctrl1 = tpctl.tp_ctrl1;
1757 
1758 	bbp_atten += bbp_atten_adj;
1759 	rf_atten += rf_atten_adj;
1760 
1761 	bwi_mac_balance_atten(&bbp_atten, &rf_atten);
1762 
1763 	if (rf->rf_type == BWI_RF_T_BCM2050 && rf->rf_rev == 2) {
1764 		if (rf_atten <= 1) {
1765 			if (tp_ctrl1 == 0) {
1766 				tp_ctrl1 = 3;
1767 				bbp_atten += 2;
1768 				rf_atten += 2;
1769 			} else if (sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) {
1770 				bbp_atten +=
1771 				(BWI_RF_ATTEN_FACTOR * (rf_atten - 2));
1772 				rf_atten = 2;
1773 			}
1774 		} else if (rf_atten > 4 && tp_ctrl1 != 0) {
1775 			tp_ctrl1 = 0;
1776 			if (bbp_atten < 3) {
1777 				bbp_atten += 2;
1778 				rf_atten -= 3;
1779 			} else {
1780 				bbp_atten -= 2;
1781 				rf_atten -= 2;
1782 			}
1783 		}
1784 		bwi_mac_balance_atten(&bbp_atten, &rf_atten);
1785 	}
1786 
1787 	tpctl.bbp_atten = bbp_atten;
1788 	tpctl.rf_atten = rf_atten;
1789 	tpctl.tp_ctrl1 = tp_ctrl1;
1790 
1791 	bwi_mac_lock(mac);
1792 	bwi_mac_set_tpctl_11bg(mac, &tpctl);
1793 	bwi_mac_unlock(mac);
1794 }
1795 
1796 /*
1797  * http://bcm-specs.sipsolutions.net/RecalculateTransmissionPower
1798  */
1799 void
1800 bwi_mac_calibrate_txpower(struct bwi_mac *mac, enum bwi_txpwrcb_type type)
1801 {
1802 	struct bwi_softc *sc = mac->mac_sc;
1803 	struct bwi_rf *rf = &mac->mac_rf;
1804 	int8_t tssi[4], tssi_avg, cur_txpwr;
1805 	int error, i, ofdm_tssi;
1806 	int txpwr_diff, rf_atten_adj, bbp_atten_adj;
1807 
1808 	if (!sc->sc_txpwr_calib)
1809 		return;
1810 
1811 	if (mac->mac_flags & BWI_MAC_F_TPCTL_ERROR) {
1812 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER, "%s\n",
1813 			"tpctl error happened, can't set txpower");
1814 		return;
1815 	}
1816 
1817 	if (BWI_IS_BRCM_BU4306(sc)) {
1818 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER, "%s\n",
1819 			"BU4306, can't set txpower");
1820 		return;
1821 	}
1822 
1823 	/*
1824 	 * Save latest TSSI and reset the related memory objects
1825 	 */
1826 	ofdm_tssi = 0;
1827 	error = bwi_rf_get_latest_tssi(mac, tssi, BWI_COMM_MOBJ_TSSI_DS);
1828 	if (error) {
1829 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER, "%s\n",
1830 			"no DS tssi");
1831 
1832 		if (mac->mac_phy.phy_mode == IEEE80211_MODE_11B) {
1833 			if (type == BWI_TXPWR_FORCE) {
1834 				rf_atten_adj = 0;
1835 				bbp_atten_adj = 1;
1836 				goto calib;
1837 			} else {
1838 				return;
1839 			}
1840 		}
1841 
1842 		error = bwi_rf_get_latest_tssi(mac, tssi,
1843 				BWI_COMM_MOBJ_TSSI_OFDM);
1844 		if (error) {
1845 			DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER, "%s\n",
1846 				"no OFDM tssi");
1847 			if (type == BWI_TXPWR_FORCE) {
1848 				rf_atten_adj = 0;
1849 				bbp_atten_adj = 1;
1850 				goto calib;
1851 			} else {
1852 				return;
1853 			}
1854 		}
1855 
1856 		for (i = 0; i < 4; ++i) {
1857 			tssi[i] += 0x20;
1858 			tssi[i] &= 0x3f;
1859 		}
1860 		ofdm_tssi = 1;
1861 	}
1862 	bwi_rf_clear_tssi(mac);
1863 
1864 	DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER,
1865 		"tssi0 %d, tssi1 %d, tssi2 %d, tssi3 %d\n",
1866 		tssi[0], tssi[1], tssi[2], tssi[3]);
1867 
1868 	/*
1869 	 * Calculate RF/BBP attenuation adjustment based on
1870 	 * the difference between desired TX power and sampled
1871 	 * TX power.
1872 	 */
1873 	/* +8 == "each incremented by 1/2" */
1874 	tssi_avg = (tssi[0] + tssi[1] + tssi[2] + tssi[3] + 8) / 4;
1875 	if (ofdm_tssi && (HFLAGS_READ(mac) & BWI_HFLAG_PWR_BOOST_DS))
1876 		tssi_avg -= 13;
1877 
1878 	DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER, "tssi avg %d\n", tssi_avg);
1879 
1880 	error = bwi_rf_tssi2dbm(mac, tssi_avg, &cur_txpwr);
1881 	if (error)
1882 		return;
1883 	DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER, "current txpower %d\n",
1884 		cur_txpwr);
1885 
1886 	txpwr_diff = rf->rf_txpower_max - cur_txpwr; /* XXX ni_txpower */
1887 
1888 	rf_atten_adj = -howmany(txpwr_diff, 8);
1889 	if (type == BWI_TXPWR_INIT) {
1890 		/*
1891 		 * Move toward EEPROM max TX power as fast as we can
1892 		 */
1893 		bbp_atten_adj = -txpwr_diff;
1894 	} else {
1895 		bbp_atten_adj = -(txpwr_diff / 2);
1896 	}
1897 	bbp_atten_adj -= (BWI_RF_ATTEN_FACTOR * rf_atten_adj);
1898 
1899 	if (rf_atten_adj == 0 && bbp_atten_adj == 0) {
1900 		DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER, "%s\n",
1901 			"no need to adjust RF/BBP attenuation");
1902 		/* TODO: LO */
1903 		return;
1904 	}
1905 
1906 calib:
1907 	DPRINTF(sc, BWI_DBG_MAC | BWI_DBG_TXPOWER,
1908 		"rf atten adjust %d, bbp atten adjust %d\n",
1909 		rf_atten_adj, bbp_atten_adj);
1910 	bwi_mac_adjust_tpctl(mac, rf_atten_adj, bbp_atten_adj);
1911 	/* TODO: LO */
1912 }
1913 
1914 static void
1915 bwi_mac_lock(struct bwi_mac *mac)
1916 {
1917 	struct bwi_softc *sc = mac->mac_sc;
1918 	struct ifnet *ifp = sc->sc_ifp;
1919 	struct ieee80211com *ic = ifp->if_l2com;
1920 
1921 	KASSERT((mac->mac_flags & BWI_MAC_F_LOCKED) == 0,
1922 	    ("mac_flags 0x%x", mac->mac_flags));
1923 
1924 	if (mac->mac_rev < 3)
1925 		bwi_mac_stop(mac);
1926 	else if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1927 		bwi_mac_config_ps(mac);
1928 
1929 	CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
1930 
1931 	/* Flush pending bus write */
1932 	CSR_READ_4(sc, BWI_MAC_STATUS);
1933 	DELAY(10);
1934 
1935 	mac->mac_flags |= BWI_MAC_F_LOCKED;
1936 }
1937 
1938 static void
1939 bwi_mac_unlock(struct bwi_mac *mac)
1940 {
1941 	struct bwi_softc *sc = mac->mac_sc;
1942 	struct ifnet *ifp = sc->sc_ifp;
1943 	struct ieee80211com *ic = ifp->if_l2com;
1944 
1945 	KASSERT(mac->mac_flags & BWI_MAC_F_LOCKED,
1946 	    ("mac_flags 0x%x", mac->mac_flags));
1947 
1948 	CSR_READ_2(sc, BWI_PHYINFO); /* dummy read */
1949 
1950 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_RFLOCK);
1951 
1952 	if (mac->mac_rev < 3)
1953 		bwi_mac_start(mac);
1954 	else if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1955 		bwi_mac_config_ps(mac);
1956 
1957 	mac->mac_flags &= ~BWI_MAC_F_LOCKED;
1958 }
1959 
1960 void
1961 bwi_mac_set_promisc(struct bwi_mac *mac, int promisc)
1962 {
1963 	struct bwi_softc *sc = mac->mac_sc;
1964 
1965 	if (mac->mac_rev < 5) /* Promisc is always on */
1966 		return;
1967 
1968 	if (promisc)
1969 		CSR_SETBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
1970 	else
1971 		CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PROMISC);
1972 }
1973