xref: /freebsd/sys/dev/bwi/bwirf.c (revision 3b8f08459569bf0faa21473e5cec2491e95c9349)
1 /*
2  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Sepherosa Ziehau <sepherosa@gmail.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * $DragonFly: src/sys/dev/netif/bwi/bwirf.c,v 1.9 2008/08/21 12:19:33 swildner Exp $
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include "opt_inet.h"
41 #include "opt_bwi.h"
42 #include "opt_wlan.h"
43 
44 #include <sys/param.h>
45 #include <sys/endian.h>
46 #include <sys/kernel.h>
47 #include <sys/bus.h>
48 #include <sys/malloc.h>
49 #include <sys/proc.h>
50 #include <sys/rman.h>
51 #include <sys/socket.h>
52 #include <sys/sockio.h>
53 #include <sys/sysctl.h>
54 #include <sys/systm.h>
55 
56 #include <net/if.h>
57 #include <net/if_var.h>
58 #include <net/if_dl.h>
59 #include <net/if_media.h>
60 #include <net/if_types.h>
61 #include <net/if_arp.h>
62 #include <net/ethernet.h>
63 #include <net/if_llc.h>
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_radiotap.h>
67 #include <net80211/ieee80211_amrr.h>
68 
69 #include <machine/bus.h>
70 
71 #include <dev/bwi/bitops.h>
72 #include <dev/bwi/if_bwireg.h>
73 #include <dev/bwi/if_bwivar.h>
74 #include <dev/bwi/bwimac.h>
75 #include <dev/bwi/bwirf.h>
76 #include <dev/bwi/bwiphy.h>
77 
78 #define RF_LO_WRITE(mac, lo)	bwi_rf_lo_write((mac), (lo))
79 
80 #define BWI_RF_2GHZ_CHAN(chan)			\
81 	(ieee80211_ieee2mhz((chan), IEEE80211_CHAN_2GHZ) - 2400)
82 
83 #define BWI_DEFAULT_IDLE_TSSI	52
84 
85 struct rf_saveregs {
86 	uint16_t	phy_01;
87 	uint16_t	phy_03;
88 	uint16_t	phy_0a;
89 	uint16_t	phy_15;
90 	uint16_t	phy_2a;
91 	uint16_t	phy_30;
92 	uint16_t	phy_35;
93 	uint16_t	phy_60;
94 	uint16_t	phy_429;
95 	uint16_t	phy_802;
96 	uint16_t	phy_811;
97 	uint16_t	phy_812;
98 	uint16_t	phy_814;
99 	uint16_t	phy_815;
100 
101 	uint16_t	rf_43;
102 	uint16_t	rf_52;
103 	uint16_t	rf_7a;
104 };
105 
106 #define SAVE_RF_REG(mac, regs, n)	(regs)->rf_##n = RF_READ((mac), 0x##n)
107 #define RESTORE_RF_REG(mac, regs, n)	RF_WRITE((mac), 0x##n, (regs)->rf_##n)
108 
109 #define SAVE_PHY_REG(mac, regs, n)	(regs)->phy_##n = PHY_READ((mac), 0x##n)
110 #define RESTORE_PHY_REG(mac, regs, n)	PHY_WRITE((mac), 0x##n, (regs)->phy_##n)
111 
112 static int	bwi_rf_calc_txpower(int8_t *, uint8_t, const int16_t[]);
113 static void	bwi_rf_work_around(struct bwi_mac *, u_int);
114 static int	bwi_rf_gain_max_reached(struct bwi_mac *, int);
115 static uint16_t	bwi_rf_calibval(struct bwi_mac *);
116 static uint16_t	bwi_rf_get_tp_ctrl2(struct bwi_mac *);
117 
118 static void	bwi_rf_lo_update_11b(struct bwi_mac *);
119 static uint16_t	bwi_rf_lo_measure_11b(struct bwi_mac *);
120 
121 static void	bwi_rf_lo_update_11g(struct bwi_mac *);
122 static uint32_t	bwi_rf_lo_devi_measure(struct bwi_mac *, uint16_t);
123 static void	bwi_rf_lo_measure_11g(struct bwi_mac *,
124 			const struct bwi_rf_lo *, struct bwi_rf_lo *, uint8_t);
125 static uint8_t	_bwi_rf_lo_update_11g(struct bwi_mac *, uint16_t);
126 static void	bwi_rf_lo_write(struct bwi_mac *, const struct bwi_rf_lo *);
127 
128 static void	bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *);
129 static void	bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *);
130 static void	bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *);
131 static void	bwi_rf_set_nrssi_thr_11b(struct bwi_mac *);
132 static void	bwi_rf_set_nrssi_thr_11g(struct bwi_mac *);
133 
134 static void	bwi_rf_init_sw_nrssi_table(struct bwi_mac *);
135 
136 static int	bwi_rf_calc_rssi_bcm2050(struct bwi_mac *,
137 			const struct bwi_rxbuf_hdr *);
138 static int	bwi_rf_calc_rssi_bcm2053(struct bwi_mac *,
139 			const struct bwi_rxbuf_hdr *);
140 static int	bwi_rf_calc_rssi_bcm2060(struct bwi_mac *,
141 			const struct bwi_rxbuf_hdr *);
142 static int	bwi_rf_calc_noise_bcm2050(struct bwi_mac *);
143 static int	bwi_rf_calc_noise_bcm2053(struct bwi_mac *);
144 static int	bwi_rf_calc_noise_bcm2060(struct bwi_mac *);
145 
146 static void	bwi_rf_on_11a(struct bwi_mac *);
147 static void	bwi_rf_on_11bg(struct bwi_mac *);
148 
149 static void	bwi_rf_off_11a(struct bwi_mac *);
150 static void	bwi_rf_off_11bg(struct bwi_mac *);
151 static void	bwi_rf_off_11g_rev5(struct bwi_mac *);
152 
153 static const int8_t	bwi_txpower_map_11b[BWI_TSSI_MAX] =
154 	{ BWI_TXPOWER_MAP_11B };
155 static const int8_t	bwi_txpower_map_11g[BWI_TSSI_MAX] =
156 	{ BWI_TXPOWER_MAP_11G };
157 
158 static __inline int16_t
159 bwi_nrssi_11g(struct bwi_mac *mac)
160 {
161 	int16_t val;
162 
163 #define NRSSI_11G_MASK		__BITS(13, 8)
164 
165 	val = (int16_t)__SHIFTOUT(PHY_READ(mac, 0x47f), NRSSI_11G_MASK);
166 	if (val >= 32)
167 		val -= 64;
168 	return val;
169 
170 #undef NRSSI_11G_MASK
171 }
172 
173 static __inline struct bwi_rf_lo *
174 bwi_get_rf_lo(struct bwi_mac *mac, uint16_t rf_atten, uint16_t bbp_atten)
175 {
176 	int n;
177 
178 	n = rf_atten + (14 * (bbp_atten / 2));
179 	KASSERT(n < BWI_RFLO_MAX, ("n %d", n));
180 
181 	return &mac->mac_rf.rf_lo[n];
182 }
183 
184 static __inline int
185 bwi_rf_lo_isused(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
186 {
187 	struct bwi_rf *rf = &mac->mac_rf;
188 	int idx;
189 
190 	idx = lo - rf->rf_lo;
191 	KASSERT(idx >= 0 && idx < BWI_RFLO_MAX, ("idx %d", idx));
192 
193 	return isset(rf->rf_lo_used, idx);
194 }
195 
196 void
197 bwi_rf_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
198 {
199 	struct bwi_softc *sc = mac->mac_sc;
200 
201 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
202 	CSR_WRITE_2(sc, BWI_RF_DATA_LO, data);
203 }
204 
205 uint16_t
206 bwi_rf_read(struct bwi_mac *mac, uint16_t ctrl)
207 {
208 	struct bwi_rf *rf = &mac->mac_rf;
209 	struct bwi_softc *sc = mac->mac_sc;
210 
211 	ctrl |= rf->rf_ctrl_rd;
212 	if (rf->rf_ctrl_adj) {
213 		/* XXX */
214 		if (ctrl < 0x70)
215 			ctrl += 0x80;
216 		else if (ctrl < 0x80)
217 			ctrl += 0x70;
218 	}
219 
220 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
221 	return CSR_READ_2(sc, BWI_RF_DATA_LO);
222 }
223 
224 int
225 bwi_rf_attach(struct bwi_mac *mac)
226 {
227 	struct bwi_softc *sc = mac->mac_sc;
228 	struct bwi_phy *phy = &mac->mac_phy;
229 	struct bwi_rf *rf = &mac->mac_rf;
230 	uint16_t type, manu;
231 	uint8_t rev;
232 
233 	/*
234 	 * Get RF manufacture/type/revision
235 	 */
236 	if (sc->sc_bbp_id == BWI_BBPID_BCM4317) {
237 		/*
238 		 * Fake a BCM2050 RF
239 		 */
240 		manu = BWI_RF_MANUFACT_BCM;
241 		type = BWI_RF_T_BCM2050;
242 		if (sc->sc_bbp_rev == 0)
243 			rev = 3;
244 		else if (sc->sc_bbp_rev == 1)
245 			rev = 4;
246 		else
247 			rev = 5;
248 	} else {
249 		uint32_t val;
250 
251 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
252 		val = CSR_READ_2(sc, BWI_RF_DATA_HI);
253 		val <<= 16;
254 
255 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
256 		val |= CSR_READ_2(sc, BWI_RF_DATA_LO);
257 
258 		manu = __SHIFTOUT(val, BWI_RFINFO_MANUFACT_MASK);
259 		type = __SHIFTOUT(val, BWI_RFINFO_TYPE_MASK);
260 		rev = __SHIFTOUT(val, BWI_RFINFO_REV_MASK);
261 	}
262 	device_printf(sc->sc_dev, "RF: manu 0x%03x, type 0x%04x, rev %u\n",
263 		      manu, type, rev);
264 
265 	/*
266 	 * Verify whether the RF is supported
267 	 */
268 	rf->rf_ctrl_rd = 0;
269 	rf->rf_ctrl_adj = 0;
270 	switch (phy->phy_mode) {
271 	case IEEE80211_MODE_11A:
272 		if (manu != BWI_RF_MANUFACT_BCM ||
273 		    type != BWI_RF_T_BCM2060 ||
274 		    rev != 1) {
275 			device_printf(sc->sc_dev, "only BCM2060 rev 1 RF "
276 				      "is supported for 11A PHY\n");
277 			return ENXIO;
278 		}
279 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11A;
280 		rf->rf_on = bwi_rf_on_11a;
281 		rf->rf_off = bwi_rf_off_11a;
282 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2060;
283 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2060;
284 		break;
285 	case IEEE80211_MODE_11B:
286 		if (type == BWI_RF_T_BCM2050) {
287 			rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
288 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
289 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
290 		} else if (type == BWI_RF_T_BCM2053) {
291 			rf->rf_ctrl_adj = 1;
292 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2053;
293 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2053;
294 		} else {
295 			device_printf(sc->sc_dev, "only BCM2050/BCM2053 RF "
296 				      "is supported for 11B PHY\n");
297 			return ENXIO;
298 		}
299 		rf->rf_on = bwi_rf_on_11bg;
300 		rf->rf_off = bwi_rf_off_11bg;
301 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11b;
302 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11b;
303 		if (phy->phy_rev == 6)
304 			rf->rf_lo_update = bwi_rf_lo_update_11g;
305 		else
306 			rf->rf_lo_update = bwi_rf_lo_update_11b;
307 		break;
308 	case IEEE80211_MODE_11G:
309 		if (type != BWI_RF_T_BCM2050) {
310 			device_printf(sc->sc_dev, "only BCM2050 RF "
311 				      "is supported for 11G PHY\n");
312 			return ENXIO;
313 		}
314 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
315 		rf->rf_on = bwi_rf_on_11bg;
316 		if (mac->mac_rev >= 5)
317 			rf->rf_off = bwi_rf_off_11g_rev5;
318 		else
319 			rf->rf_off = bwi_rf_off_11bg;
320 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11g;
321 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11g;
322 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
323 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
324 		rf->rf_lo_update = bwi_rf_lo_update_11g;
325 		break;
326 	default:
327 		device_printf(sc->sc_dev, "unsupported PHY mode\n");
328 		return ENXIO;
329 	}
330 
331 	rf->rf_type = type;
332 	rf->rf_rev = rev;
333 	rf->rf_manu = manu;
334 	rf->rf_curchan = IEEE80211_CHAN_ANY;
335 	rf->rf_ant_mode = BWI_ANT_MODE_AUTO;
336 	return 0;
337 }
338 
339 void
340 bwi_rf_set_chan(struct bwi_mac *mac, u_int chan, int work_around)
341 {
342 	struct bwi_softc *sc = mac->mac_sc;
343 
344 	if (chan == IEEE80211_CHAN_ANY)
345 		return;
346 
347 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_CHAN, chan);
348 
349 	/* TODO: 11A */
350 
351 	if (work_around)
352 		bwi_rf_work_around(mac, chan);
353 
354 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
355 
356 	if (chan == 14) {
357 		if (sc->sc_locale == BWI_SPROM_LOCALE_JAPAN)
358 			HFLAGS_CLRBITS(mac, BWI_HFLAG_NOT_JAPAN);
359 		else
360 			HFLAGS_SETBITS(mac, BWI_HFLAG_NOT_JAPAN);
361 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, (1 << 11)); /* XXX */
362 	} else {
363 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0x840); /* XXX */
364 	}
365 	DELAY(8000);	/* DELAY(2000); */
366 
367 	mac->mac_rf.rf_curchan = chan;
368 }
369 
370 void
371 bwi_rf_get_gains(struct bwi_mac *mac)
372 {
373 #define SAVE_PHY_MAX	15
374 #define SAVE_RF_MAX	3
375 
376 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
377 	{ 0x52, 0x43, 0x7a };
378 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] = {
379 		0x0429, 0x0001, 0x0811, 0x0812,
380 		0x0814, 0x0815, 0x005a, 0x0059,
381 		0x0058, 0x000a, 0x0003, 0x080f,
382 		0x0810, 0x002b, 0x0015
383 	};
384 
385 	struct bwi_softc *sc = mac->mac_sc;
386 	struct bwi_phy *phy = &mac->mac_phy;
387 	struct bwi_rf *rf = &mac->mac_rf;
388 	uint16_t save_phy[SAVE_PHY_MAX];
389 	uint16_t save_rf[SAVE_RF_MAX];
390 	uint16_t trsw;
391 	int i, j, loop1_max, loop1, loop2;
392 
393 	/*
394 	 * Save PHY/RF registers for later restoration
395 	 */
396 	for (i = 0; i < SAVE_PHY_MAX; ++i)
397 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
398 	PHY_READ(mac, 0x2d); /* dummy read */
399 
400 	for (i = 0; i < SAVE_RF_MAX; ++i)
401 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
402 
403 	PHY_CLRBITS(mac, 0x429, 0xc000);
404 	PHY_SETBITS(mac, 0x1, 0x8000);
405 
406 	PHY_SETBITS(mac, 0x811, 0x2);
407 	PHY_CLRBITS(mac, 0x812, 0x2);
408 	PHY_SETBITS(mac, 0x811, 0x1);
409 	PHY_CLRBITS(mac, 0x812, 0x1);
410 
411 	PHY_SETBITS(mac, 0x814, 0x1);
412 	PHY_CLRBITS(mac, 0x815, 0x1);
413 	PHY_SETBITS(mac, 0x814, 0x2);
414 	PHY_CLRBITS(mac, 0x815, 0x2);
415 
416 	PHY_SETBITS(mac, 0x811, 0xc);
417 	PHY_SETBITS(mac, 0x812, 0xc);
418 	PHY_SETBITS(mac, 0x811, 0x30);
419 	PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
420 
421 	PHY_WRITE(mac, 0x5a, 0x780);
422 	PHY_WRITE(mac, 0x59, 0xc810);
423 	PHY_WRITE(mac, 0x58, 0xd);
424 	PHY_SETBITS(mac, 0xa, 0x2000);
425 
426 	PHY_SETBITS(mac, 0x814, 0x4);
427 	PHY_CLRBITS(mac, 0x815, 0x4);
428 
429 	PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
430 
431 	if (rf->rf_rev == 8) {
432 		loop1_max = 15;
433 		RF_WRITE(mac, 0x43, loop1_max);
434 	} else {
435 		loop1_max = 9;
436 	    	RF_WRITE(mac, 0x52, 0x0);
437 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, loop1_max);
438 	}
439 
440 	bwi_phy_set_bbp_atten(mac, 11);
441 
442 	if (phy->phy_rev >= 3)
443 		PHY_WRITE(mac, 0x80f, 0xc020);
444 	else
445 		PHY_WRITE(mac, 0x80f, 0x8020);
446 	PHY_WRITE(mac, 0x810, 0);
447 
448 	PHY_FILT_SETBITS(mac, 0x2b, 0xffc0, 0x1);
449 	PHY_FILT_SETBITS(mac, 0x2b, 0xc0ff, 0x800);
450 	PHY_SETBITS(mac, 0x811, 0x100);
451 	PHY_CLRBITS(mac, 0x812, 0x3000);
452 
453 	if ((sc->sc_card_flags & BWI_CARD_F_EXT_LNA) &&
454 	    phy->phy_rev >= 7) {
455 		PHY_SETBITS(mac, 0x811, 0x800);
456 		PHY_SETBITS(mac, 0x812, 0x8000);
457 	}
458 	RF_CLRBITS(mac, 0x7a, 0xff08);
459 
460 	/*
461 	 * Find out 'loop1/loop2', which will be used to calculate
462 	 * max loopback gain later
463 	 */
464 	j = 0;
465 	for (i = 0; i < loop1_max; ++i) {
466 		for (j = 0; j < 16; ++j) {
467 			RF_WRITE(mac, 0x43, i);
468 
469 			if (bwi_rf_gain_max_reached(mac, j))
470 				goto loop1_exit;
471 		}
472 	}
473 loop1_exit:
474 	loop1 = i;
475 	loop2 = j;
476 
477 	/*
478 	 * Find out 'trsw', which will be used to calculate
479 	 * TRSW(TX/RX switch) RX gain later
480 	 */
481 	if (loop2 >= 8) {
482 		PHY_SETBITS(mac, 0x812, 0x30);
483 		trsw = 0x1b;
484 		for (i = loop2 - 8; i < 16; ++i) {
485 			trsw -= 3;
486 			if (bwi_rf_gain_max_reached(mac, i))
487 				break;
488 		}
489 	} else {
490 		trsw = 0x18;
491 	}
492 
493 	/*
494 	 * Restore saved PHY/RF registers
495 	 */
496 	/* First 4 saved PHY registers need special processing */
497 	for (i = 4; i < SAVE_PHY_MAX; ++i)
498 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
499 
500 	bwi_phy_set_bbp_atten(mac, mac->mac_tpctl.bbp_atten);
501 
502 	for (i = 0; i < SAVE_RF_MAX; ++i)
503 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
504 
505 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2] | 0x3);
506 	DELAY(10);
507 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2]);
508 	PHY_WRITE(mac, save_phy_regs[3], save_phy[3]);
509 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
510 	PHY_WRITE(mac, save_phy_regs[1], save_phy[1]);
511 
512 	/*
513 	 * Calculate gains
514 	 */
515 	rf->rf_lo_gain = (loop2 * 6) - (loop1 * 4) - 11;
516 	rf->rf_rx_gain = trsw * 2;
517 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_INIT,
518 		"lo gain: %u, rx gain: %u\n",
519 		rf->rf_lo_gain, rf->rf_rx_gain);
520 
521 #undef SAVE_RF_MAX
522 #undef SAVE_PHY_MAX
523 }
524 
525 void
526 bwi_rf_init(struct bwi_mac *mac)
527 {
528 	struct bwi_rf *rf = &mac->mac_rf;
529 
530 	if (rf->rf_type == BWI_RF_T_BCM2060) {
531 		/* TODO: 11A */
532 	} else {
533 		if (rf->rf_flags & BWI_RF_F_INITED)
534 			RF_WRITE(mac, 0x78, rf->rf_calib);
535 		else
536 			bwi_rf_init_bcm2050(mac);
537 	}
538 }
539 
540 static void
541 bwi_rf_off_11a(struct bwi_mac *mac)
542 {
543 	RF_WRITE(mac, 0x4, 0xff);
544 	RF_WRITE(mac, 0x5, 0xfb);
545 
546 	PHY_SETBITS(mac, 0x10, 0x8);
547 	PHY_SETBITS(mac, 0x11, 0x8);
548 
549 	PHY_WRITE(mac, 0x15, 0xaa00);
550 }
551 
552 static void
553 bwi_rf_off_11bg(struct bwi_mac *mac)
554 {
555 	PHY_WRITE(mac, 0x15, 0xaa00);
556 }
557 
558 static void
559 bwi_rf_off_11g_rev5(struct bwi_mac *mac)
560 {
561 	PHY_SETBITS(mac, 0x811, 0x8c);
562 	PHY_CLRBITS(mac, 0x812, 0x8c);
563 }
564 
565 static void
566 bwi_rf_work_around(struct bwi_mac *mac, u_int chan)
567 {
568 	struct bwi_softc *sc = mac->mac_sc;
569 	struct bwi_rf *rf = &mac->mac_rf;
570 
571 	if (chan == IEEE80211_CHAN_ANY) {
572 		device_printf(sc->sc_dev, "%s invalid channel!!\n", __func__);
573 		return;
574 	}
575 
576 	if (rf->rf_type != BWI_RF_T_BCM2050 || rf->rf_rev >= 6)
577 		return;
578 
579 	if (chan <= 10)
580 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan + 4));
581 	else
582 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(1));
583 	DELAY(1000);
584 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
585 }
586 
587 static __inline struct bwi_rf_lo *
588 bwi_rf_lo_find(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
589 {
590 	uint16_t rf_atten, bbp_atten;
591 	int remap_rf_atten;
592 
593 	remap_rf_atten = 1;
594 	if (tpctl == NULL) {
595 		bbp_atten = 2;
596 		rf_atten = 3;
597 	} else {
598 		if (tpctl->tp_ctrl1 == 3)
599 			remap_rf_atten = 0;
600 
601 		bbp_atten = tpctl->bbp_atten;
602 		rf_atten = tpctl->rf_atten;
603 
604 		if (bbp_atten > 6)
605 			bbp_atten = 6;
606 	}
607 
608 	if (remap_rf_atten) {
609 #define MAP_MAX	10
610 		static const uint16_t map[MAP_MAX] =
611 		{ 11, 10, 11, 12, 13, 12, 13, 12, 13, 12 };
612 
613 #if 0
614 		KASSERT(rf_atten < MAP_MAX, ("rf_atten %d", rf_atten));
615 		rf_atten = map[rf_atten];
616 #else
617 		if (rf_atten >= MAP_MAX) {
618 			rf_atten = 0;	/* XXX */
619 		} else {
620 			rf_atten = map[rf_atten];
621 		}
622 #endif
623 #undef MAP_MAX
624 	}
625 
626 	return bwi_get_rf_lo(mac, rf_atten, bbp_atten);
627 }
628 
629 void
630 bwi_rf_lo_adjust(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
631 {
632 	const struct bwi_rf_lo *lo;
633 
634 	lo = bwi_rf_lo_find(mac, tpctl);
635 	RF_LO_WRITE(mac, lo);
636 }
637 
638 static void
639 bwi_rf_lo_write(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
640 {
641 	uint16_t val;
642 
643 	val = (uint8_t)lo->ctrl_lo;
644 	val |= ((uint8_t)lo->ctrl_hi) << 8;
645 
646 	PHY_WRITE(mac, BWI_PHYR_RF_LO, val);
647 }
648 
649 static int
650 bwi_rf_gain_max_reached(struct bwi_mac *mac, int idx)
651 {
652 	PHY_FILT_SETBITS(mac, 0x812, 0xf0ff, idx << 8);
653 	PHY_FILT_SETBITS(mac, 0x15, 0xfff, 0xa000);
654 	PHY_SETBITS(mac, 0x15, 0xf000);
655 
656 	DELAY(20);
657 
658 	return (PHY_READ(mac, 0x2d) >= 0xdfc);
659 }
660 
661 /* XXX use bitmap array */
662 static __inline uint16_t
663 bitswap4(uint16_t val)
664 {
665 	uint16_t ret;
666 
667 	ret = (val & 0x8) >> 3;
668 	ret |= (val & 0x4) >> 1;
669 	ret |= (val & 0x2) << 1;
670 	ret |= (val & 0x1) << 3;
671 	return ret;
672 }
673 
674 static __inline uint16_t
675 bwi_phy812_value(struct bwi_mac *mac, uint16_t lpd)
676 {
677 	struct bwi_softc *sc = mac->mac_sc;
678 	struct bwi_phy *phy = &mac->mac_phy;
679 	struct bwi_rf *rf = &mac->mac_rf;
680 	uint16_t lo_gain, ext_lna, loop;
681 
682 	if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
683 		return 0;
684 
685 	lo_gain = rf->rf_lo_gain;
686 	if (rf->rf_rev == 8)
687 		lo_gain += 0x3e;
688 	else
689 		lo_gain += 0x26;
690 
691 	if (lo_gain >= 0x46) {
692 		lo_gain -= 0x46;
693 		ext_lna = 0x3000;
694 	} else if (lo_gain >= 0x3a) {
695 		lo_gain -= 0x3a;
696 		ext_lna = 0x1000;
697 	} else if (lo_gain >= 0x2e) {
698 		lo_gain -= 0x2e;
699 		ext_lna = 0x2000;
700 	} else {
701 		lo_gain -= 0x10;
702 		ext_lna = 0;
703 	}
704 
705 	for (loop = 0; loop < 16; ++loop) {
706 		lo_gain -= (6 * loop);
707 		if (lo_gain < 6)
708 			break;
709 	}
710 
711 	if (phy->phy_rev >= 7 && (sc->sc_card_flags & BWI_CARD_F_EXT_LNA)) {
712 		if (ext_lna)
713 			ext_lna |= 0x8000;
714 		ext_lna |= (loop << 8);
715 		switch (lpd) {
716 		case 0x011:
717 			return 0x8f92;
718 		case 0x001:
719 			return (0x8092 | ext_lna);
720 		case 0x101:
721 			return (0x2092 | ext_lna);
722 		case 0x100:
723 			return (0x2093 | ext_lna);
724 		default:
725 			panic("unsupported lpd\n");
726 		}
727 	} else {
728 		ext_lna |= (loop << 8);
729 		switch (lpd) {
730 		case 0x011:
731 			return 0xf92;
732 		case 0x001:
733 		case 0x101:
734 			return (0x92 | ext_lna);
735 		case 0x100:
736 			return (0x93 | ext_lna);
737 		default:
738 			panic("unsupported lpd\n");
739 		}
740 	}
741 
742 	panic("never reached\n");
743 	return 0;
744 }
745 
746 void
747 bwi_rf_init_bcm2050(struct bwi_mac *mac)
748 {
749 #define SAVE_RF_MAX		3
750 #define SAVE_PHY_COMM_MAX	4
751 #define SAVE_PHY_11G_MAX	6
752 
753 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
754 	{ 0x0043, 0x0051, 0x0052 };
755 	static const uint16_t save_phy_regs_comm[SAVE_PHY_COMM_MAX] =
756 	{ 0x0015, 0x005a, 0x0059, 0x0058 };
757 	static const uint16_t save_phy_regs_11g[SAVE_PHY_11G_MAX] =
758 	{ 0x0811, 0x0812, 0x0814, 0x0815, 0x0429, 0x0802 };
759 
760 	uint16_t save_rf[SAVE_RF_MAX];
761 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
762 	uint16_t save_phy_11g[SAVE_PHY_11G_MAX];
763 	uint16_t phyr_35, phyr_30 = 0, rfr_78, phyr_80f = 0, phyr_810 = 0;
764 	uint16_t bphy_ctrl = 0, bbp_atten, rf_chan_ex;
765 	uint16_t phy812_val;
766 	uint16_t calib;
767 	uint32_t test_lim, test;
768 	struct bwi_softc *sc = mac->mac_sc;
769 	struct bwi_phy *phy = &mac->mac_phy;
770 	struct bwi_rf *rf = &mac->mac_rf;
771 	int i;
772 
773 	/*
774 	 * Save registers for later restoring
775 	 */
776 	for (i = 0; i < SAVE_RF_MAX; ++i)
777 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
778 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
779 		save_phy_comm[i] = PHY_READ(mac, save_phy_regs_comm[i]);
780 
781 	if (phy->phy_mode == IEEE80211_MODE_11B) {
782 		phyr_30 = PHY_READ(mac, 0x30);
783 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
784 
785 		PHY_WRITE(mac, 0x30, 0xff);
786 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x3f3f);
787 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
788 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
789 			save_phy_11g[i] =
790 				PHY_READ(mac, save_phy_regs_11g[i]);
791 		}
792 
793 		PHY_SETBITS(mac, 0x814, 0x3);
794 		PHY_CLRBITS(mac, 0x815, 0x3);
795 		PHY_CLRBITS(mac, 0x429, 0x8000);
796 		PHY_CLRBITS(mac, 0x802, 0x3);
797 
798 		phyr_80f = PHY_READ(mac, 0x80f);
799 		phyr_810 = PHY_READ(mac, 0x810);
800 
801 		if (phy->phy_rev >= 3)
802 			PHY_WRITE(mac, 0x80f, 0xc020);
803 		else
804 			PHY_WRITE(mac, 0x80f, 0x8020);
805 		PHY_WRITE(mac, 0x810, 0);
806 
807 		phy812_val = bwi_phy812_value(mac, 0x011);
808 		PHY_WRITE(mac, 0x812, phy812_val);
809 		if (phy->phy_rev < 7 ||
810 		    (sc->sc_card_flags & BWI_CARD_F_EXT_LNA) == 0)
811 			PHY_WRITE(mac, 0x811, 0x1b3);
812 		else
813 			PHY_WRITE(mac, 0x811, 0x9b3);
814 	}
815 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
816 
817 	phyr_35 = PHY_READ(mac, 0x35);
818 	PHY_CLRBITS(mac, 0x35, 0x80);
819 
820 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
821 	rf_chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
822 
823 	if (phy->phy_version == 0) {
824 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
825 	} else {
826 		if (phy->phy_version >= 2)
827 			PHY_FILT_SETBITS(mac, 0x3, 0xffbf, 0x40);
828 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
829 	}
830 
831 	calib = bwi_rf_calibval(mac);
832 
833 	if (phy->phy_mode == IEEE80211_MODE_11B)
834 		RF_WRITE(mac, 0x78, 0x26);
835 
836 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
837 		phy812_val = bwi_phy812_value(mac, 0x011);
838 		PHY_WRITE(mac, 0x812, phy812_val);
839 	}
840 
841 	PHY_WRITE(mac, 0x15, 0xbfaf);
842 	PHY_WRITE(mac, 0x2b, 0x1403);
843 
844 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
845 		phy812_val = bwi_phy812_value(mac, 0x001);
846 		PHY_WRITE(mac, 0x812, phy812_val);
847 	}
848 
849 	PHY_WRITE(mac, 0x15, 0xbfa0);
850 
851 	RF_SETBITS(mac, 0x51, 0x4);
852 	if (rf->rf_rev == 8) {
853 		RF_WRITE(mac, 0x43, 0x1f);
854 	} else {
855 		RF_WRITE(mac, 0x52, 0);
856 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
857 	}
858 
859 	test_lim = 0;
860 	PHY_WRITE(mac, 0x58, 0);
861 	for (i = 0; i < 16; ++i) {
862 		PHY_WRITE(mac, 0x5a, 0x480);
863 		PHY_WRITE(mac, 0x59, 0xc810);
864 
865 		PHY_WRITE(mac, 0x58, 0xd);
866 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
867 			phy812_val = bwi_phy812_value(mac, 0x101);
868 			PHY_WRITE(mac, 0x812, phy812_val);
869 		}
870 		PHY_WRITE(mac, 0x15, 0xafb0);
871 		DELAY(10);
872 
873 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
874 			phy812_val = bwi_phy812_value(mac, 0x101);
875 			PHY_WRITE(mac, 0x812, phy812_val);
876 		}
877 		PHY_WRITE(mac, 0x15, 0xefb0);
878 		DELAY(10);
879 
880 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
881 			phy812_val = bwi_phy812_value(mac, 0x100);
882 			PHY_WRITE(mac, 0x812, phy812_val);
883 		}
884 		PHY_WRITE(mac, 0x15, 0xfff0);
885 		DELAY(20);
886 
887 		test_lim += PHY_READ(mac, 0x2d);
888 
889 		PHY_WRITE(mac, 0x58, 0);
890 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
891 			phy812_val = bwi_phy812_value(mac, 0x101);
892 			PHY_WRITE(mac, 0x812, phy812_val);
893 		}
894 		PHY_WRITE(mac, 0x15, 0xafb0);
895 	}
896 	++test_lim;
897 	test_lim >>= 9;
898 
899 	DELAY(10);
900 
901 	test = 0;
902 	PHY_WRITE(mac, 0x58, 0);
903 	for (i = 0; i < 16; ++i) {
904 		int j;
905 
906 		rfr_78 = (bitswap4(i) << 1) | 0x20;
907 		RF_WRITE(mac, 0x78, rfr_78);
908 		DELAY(10);
909 
910 		/* NB: This block is slight different than the above one */
911 		for (j = 0; j < 16; ++j) {
912 			PHY_WRITE(mac, 0x5a, 0xd80);
913 			PHY_WRITE(mac, 0x59, 0xc810);
914 
915 			PHY_WRITE(mac, 0x58, 0xd);
916 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
917 			    phy->phy_rev >= 2) {
918 				phy812_val = bwi_phy812_value(mac, 0x101);
919 				PHY_WRITE(mac, 0x812, phy812_val);
920 			}
921 			PHY_WRITE(mac, 0x15, 0xafb0);
922 			DELAY(10);
923 
924 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
925 			    phy->phy_rev >= 2) {
926 				phy812_val = bwi_phy812_value(mac, 0x101);
927 				PHY_WRITE(mac, 0x812, phy812_val);
928 			}
929 			PHY_WRITE(mac, 0x15, 0xefb0);
930 			DELAY(10);
931 
932 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
933 			    phy->phy_rev >= 2) {
934 				phy812_val = bwi_phy812_value(mac, 0x100);
935 				PHY_WRITE(mac, 0x812, phy812_val);
936 			}
937 			PHY_WRITE(mac, 0x15, 0xfff0);
938 			DELAY(10);
939 
940 			test += PHY_READ(mac, 0x2d);
941 
942 			PHY_WRITE(mac, 0x58, 0);
943 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
944 			    phy->phy_rev >= 2) {
945 				phy812_val = bwi_phy812_value(mac, 0x101);
946 				PHY_WRITE(mac, 0x812, phy812_val);
947 			}
948 			PHY_WRITE(mac, 0x15, 0xafb0);
949 		}
950 
951 		++test;
952 		test >>= 8;
953 
954 		if (test > test_lim)
955 			break;
956 	}
957 	if (i > 15)
958 		rf->rf_calib = rfr_78;
959 	else
960 		rf->rf_calib = calib;
961 	if (rf->rf_calib != 0xffff) {
962 		DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT,
963 			"RF calibration value: 0x%04x\n", rf->rf_calib);
964 		rf->rf_flags |= BWI_RF_F_INITED;
965 	}
966 
967 	/*
968 	 * Restore trashes registers
969 	 */
970 	PHY_WRITE(mac, save_phy_regs_comm[0], save_phy_comm[0]);
971 
972 	for (i = 0; i < SAVE_RF_MAX; ++i) {
973 		int pos = (i + 1) % SAVE_RF_MAX;
974 
975 		RF_WRITE(mac, save_rf_regs[pos], save_rf[pos]);
976 	}
977 	for (i = 1; i < SAVE_PHY_COMM_MAX; ++i)
978 		PHY_WRITE(mac, save_phy_regs_comm[i], save_phy_comm[i]);
979 
980 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
981 	if (phy->phy_version != 0)
982 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, rf_chan_ex);
983 
984 	PHY_WRITE(mac, 0x35, phyr_35);
985 	bwi_rf_work_around(mac, rf->rf_curchan);
986 
987 	if (phy->phy_mode == IEEE80211_MODE_11B) {
988 		PHY_WRITE(mac, 0x30, phyr_30);
989 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
990 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
991 		/* XXX Spec only says when PHY is linked (gmode) */
992 		CSR_CLRBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
993 
994 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
995 			PHY_WRITE(mac, save_phy_regs_11g[i],
996 				  save_phy_11g[i]);
997 		}
998 
999 		PHY_WRITE(mac, 0x80f, phyr_80f);
1000 		PHY_WRITE(mac, 0x810, phyr_810);
1001 	}
1002 
1003 #undef SAVE_PHY_11G_MAX
1004 #undef SAVE_PHY_COMM_MAX
1005 #undef SAVE_RF_MAX
1006 }
1007 
1008 static uint16_t
1009 bwi_rf_calibval(struct bwi_mac *mac)
1010 {
1011 	/* http://bcm-specs.sipsolutions.net/RCCTable */
1012 	static const uint16_t rf_calibvals[] = {
1013 		0x2, 0x3, 0x1, 0xf, 0x6, 0x7, 0x5, 0xf,
1014 		0xa, 0xb, 0x9, 0xf, 0xe, 0xf, 0xd, 0xf
1015 	};
1016 	uint16_t val, calib;
1017 	int idx;
1018 
1019 	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
1020 	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
1021 	KASSERT(idx < (int)(sizeof(rf_calibvals) / sizeof(rf_calibvals[0])),
1022 	    ("idx %d", idx));
1023 
1024 	calib = rf_calibvals[idx] << 1;
1025 	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
1026 		calib |= 0x1;
1027 	calib |= 0x20;
1028 
1029 	return calib;
1030 }
1031 
1032 static __inline int32_t
1033 _bwi_adjust_devide(int32_t num, int32_t den)
1034 {
1035 	if (num < 0)
1036 		return (num / den);
1037 	else
1038 		return (num + den / 2) / den;
1039 }
1040 
1041 /*
1042  * http://bcm-specs.sipsolutions.net/TSSI_to_DBM_Table
1043  * "calculating table entries"
1044  */
1045 static int
1046 bwi_rf_calc_txpower(int8_t *txpwr, uint8_t idx, const int16_t pa_params[])
1047 {
1048 	int32_t m1, m2, f, dbm;
1049 	int i;
1050 
1051 	m1 = _bwi_adjust_devide(16 * pa_params[0] + idx * pa_params[1], 32);
1052 	m2 = imax(_bwi_adjust_devide(32768 + idx * pa_params[2], 256), 1);
1053 
1054 #define ITER_MAX	16
1055 
1056 	f = 256;
1057 	for (i = 0; i < ITER_MAX; ++i) {
1058 		int32_t q, d;
1059 
1060 		q = _bwi_adjust_devide(
1061 			f * 4096 - _bwi_adjust_devide(m2 * f, 16) * f, 2048);
1062 		d = abs(q - f);
1063 		f = q;
1064 
1065 		if (d < 2)
1066 			break;
1067 	}
1068 	if (i == ITER_MAX)
1069 		return EINVAL;
1070 
1071 #undef ITER_MAX
1072 
1073 	dbm = _bwi_adjust_devide(m1 * f, 8192);
1074 	if (dbm < -127)
1075 		dbm = -127;
1076 	else if (dbm > 128)
1077 		dbm = 128;
1078 
1079 	*txpwr = dbm;
1080 	return 0;
1081 }
1082 
1083 int
1084 bwi_rf_map_txpower(struct bwi_mac *mac)
1085 {
1086 	struct bwi_softc *sc = mac->mac_sc;
1087 	struct bwi_rf *rf = &mac->mac_rf;
1088 	struct bwi_phy *phy = &mac->mac_phy;
1089 	uint16_t sprom_ofs, val, mask;
1090 	int16_t pa_params[3];
1091 	int error = 0, i, ant_gain, reg_txpower_max;
1092 
1093 	/*
1094 	 * Find out max TX power
1095 	 */
1096 	val = bwi_read_sprom(sc, BWI_SPROM_MAX_TXPWR);
1097 	if (phy->phy_mode == IEEE80211_MODE_11A) {
1098 		rf->rf_txpower_max = __SHIFTOUT(val,
1099 				     BWI_SPROM_MAX_TXPWR_MASK_11A);
1100 	} else {
1101 		rf->rf_txpower_max = __SHIFTOUT(val,
1102 				     BWI_SPROM_MAX_TXPWR_MASK_11BG);
1103 
1104 		if ((sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) &&
1105 		    phy->phy_mode == IEEE80211_MODE_11G)
1106 			rf->rf_txpower_max -= 3;
1107 	}
1108 	if (rf->rf_txpower_max <= 0) {
1109 		device_printf(sc->sc_dev, "invalid max txpower in sprom\n");
1110 		rf->rf_txpower_max = 74;
1111 	}
1112 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1113 		"max txpower from sprom: %d dBm\n", rf->rf_txpower_max);
1114 
1115 	/*
1116 	 * Find out region/domain max TX power, which is adjusted
1117 	 * by antenna gain and 1.5 dBm fluctuation as mentioned
1118 	 * in v3 spec.
1119 	 */
1120 	val = bwi_read_sprom(sc, BWI_SPROM_ANT_GAIN);
1121 	if (phy->phy_mode == IEEE80211_MODE_11A)
1122 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11A);
1123 	else
1124 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11BG);
1125 	if (ant_gain == 0xff) {
1126 		device_printf(sc->sc_dev, "invalid antenna gain in sprom\n");
1127 		ant_gain = 2;
1128 	}
1129 	ant_gain *= 4;
1130 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1131 		"ant gain %d dBm\n", ant_gain);
1132 
1133 	reg_txpower_max = 90 - ant_gain - 6;	/* XXX magic number */
1134 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1135 		"region/domain max txpower %d dBm\n", reg_txpower_max);
1136 
1137 	/*
1138 	 * Force max TX power within region/domain TX power limit
1139 	 */
1140 	if (rf->rf_txpower_max > reg_txpower_max)
1141 		rf->rf_txpower_max = reg_txpower_max;
1142 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1143 		"max txpower %d dBm\n", rf->rf_txpower_max);
1144 
1145 	/*
1146 	 * Create TSSI to TX power mapping
1147 	 */
1148 
1149 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301 &&
1150 	    rf->rf_type != BWI_RF_T_BCM2050) {
1151 		rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1152 		bcopy(bwi_txpower_map_11b, rf->rf_txpower_map0,
1153 		      sizeof(rf->rf_txpower_map0));
1154 		goto back;
1155 	}
1156 
1157 #define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
1158 #define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
1159 
1160 	/*
1161 	 * Extract PA parameters
1162 	 */
1163 	if (phy->phy_mode == IEEE80211_MODE_11A)
1164 		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
1165 	else
1166 		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
1167 	for (i = 0; i < N(pa_params); ++i)
1168 		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
1169 
1170 	for (i = 0; i < N(pa_params); ++i) {
1171 		/*
1172 		 * If one of the PA parameters from SPROM is not valid,
1173 		 * fall back to the default values, if there are any.
1174 		 */
1175 		if (!IS_VALID_PA_PARAM(pa_params[i])) {
1176 			const int8_t *txpower_map;
1177 
1178 			if (phy->phy_mode == IEEE80211_MODE_11A) {
1179 				device_printf(sc->sc_dev,
1180 					  "no tssi2dbm table for 11a PHY\n");
1181 				return ENXIO;
1182 			}
1183 
1184 			if (phy->phy_mode == IEEE80211_MODE_11G) {
1185 				DPRINTF(sc,
1186 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1187 				"%s\n", "use default 11g TSSI map");
1188 				txpower_map = bwi_txpower_map_11g;
1189 			} else {
1190 				DPRINTF(sc,
1191 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1192 				"%s\n", "use default 11b TSSI map");
1193 				txpower_map = bwi_txpower_map_11b;
1194 			}
1195 
1196 			rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1197 			bcopy(txpower_map, rf->rf_txpower_map0,
1198 			      sizeof(rf->rf_txpower_map0));
1199 			goto back;
1200 		}
1201 	}
1202 
1203 #undef N
1204 
1205 	/*
1206 	 * All of the PA parameters from SPROM are valid.
1207 	 */
1208 
1209 	/*
1210 	 * Extract idle TSSI from SPROM.
1211 	 */
1212 	val = bwi_read_sprom(sc, BWI_SPROM_IDLE_TSSI);
1213 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1214 		"sprom idle tssi: 0x%04x\n", val);
1215 
1216 	if (phy->phy_mode == IEEE80211_MODE_11A)
1217 		mask = BWI_SPROM_IDLE_TSSI_MASK_11A;
1218 	else
1219 		mask = BWI_SPROM_IDLE_TSSI_MASK_11BG;
1220 
1221 	rf->rf_idle_tssi0 = (int)__SHIFTOUT(val, mask);
1222 	if (!IS_VALID_PA_PARAM(rf->rf_idle_tssi0))
1223 		rf->rf_idle_tssi0 = 62;
1224 
1225 #undef IS_VALID_PA_PARAM
1226 
1227 	/*
1228 	 * Calculate TX power map, which is indexed by TSSI
1229 	 */
1230 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1231 		"%s\n", "TSSI-TX power map:");
1232 	for (i = 0; i < BWI_TSSI_MAX; ++i) {
1233 		error = bwi_rf_calc_txpower(&rf->rf_txpower_map0[i], i,
1234 					    pa_params);
1235 		if (error) {
1236 			device_printf(sc->sc_dev,
1237 				  "bwi_rf_calc_txpower failed\n");
1238 			break;
1239 		}
1240 
1241 #ifdef BWI_DEBUG
1242 		if (i != 0 && i % 8 == 0) {
1243 			_DPRINTF(sc,
1244 			BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1245 			"%s\n", "");
1246 		}
1247 #endif
1248 		_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1249 			 "%d ", rf->rf_txpower_map0[i]);
1250 	}
1251 	_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1252 		 "%s\n", "");
1253 back:
1254 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1255 		"idle tssi0: %d\n", rf->rf_idle_tssi0);
1256 	return error;
1257 }
1258 
1259 static void
1260 bwi_rf_lo_update_11g(struct bwi_mac *mac)
1261 {
1262 	struct bwi_softc *sc = mac->mac_sc;
1263 	struct ifnet *ifp = sc->sc_ifp;
1264 	struct bwi_rf *rf = &mac->mac_rf;
1265 	struct bwi_phy *phy = &mac->mac_phy;
1266 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1267 	struct rf_saveregs regs;
1268 	uint16_t ant_div, chan_ex;
1269 	uint8_t devi_ctrl;
1270 	u_int orig_chan;
1271 
1272 	/*
1273 	 * Save RF/PHY registers for later restoration
1274 	 */
1275 	orig_chan = rf->rf_curchan;
1276 	bzero(&regs, sizeof(regs));
1277 
1278 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1279 		SAVE_PHY_REG(mac, &regs, 429);
1280 		SAVE_PHY_REG(mac, &regs, 802);
1281 
1282 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1283 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1284 	}
1285 
1286 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1287 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div | 0x8000);
1288 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1289 
1290 	SAVE_PHY_REG(mac, &regs, 15);
1291 	SAVE_PHY_REG(mac, &regs, 2a);
1292 	SAVE_PHY_REG(mac, &regs, 35);
1293 	SAVE_PHY_REG(mac, &regs, 60);
1294 	SAVE_RF_REG(mac, &regs, 43);
1295 	SAVE_RF_REG(mac, &regs, 7a);
1296 	SAVE_RF_REG(mac, &regs, 52);
1297 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1298 		SAVE_PHY_REG(mac, &regs, 811);
1299 		SAVE_PHY_REG(mac, &regs, 812);
1300 		SAVE_PHY_REG(mac, &regs, 814);
1301 		SAVE_PHY_REG(mac, &regs, 815);
1302 	}
1303 
1304 	/* Force to channel 6 */
1305 	bwi_rf_set_chan(mac, 6, 0);
1306 
1307 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1308 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1309 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1310 		bwi_mac_dummy_xmit(mac);
1311 	}
1312 	RF_WRITE(mac, 0x43, 0x6);
1313 
1314 	bwi_phy_set_bbp_atten(mac, 2);
1315 
1316 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0);
1317 
1318 	PHY_WRITE(mac, 0x2e, 0x7f);
1319 	PHY_WRITE(mac, 0x80f, 0x78);
1320 	PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
1321 	RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
1322 	PHY_WRITE(mac, 0x2b, 0x203);
1323 	PHY_WRITE(mac, 0x2a, 0x8a3);
1324 
1325 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1326 		PHY_WRITE(mac, 0x814, regs.phy_814 | 0x3);
1327 		PHY_WRITE(mac, 0x815, regs.phy_815 & 0xfffc);
1328 		PHY_WRITE(mac, 0x811, 0x1b3);
1329 		PHY_WRITE(mac, 0x812, 0xb2);
1330 	}
1331 
1332 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1333 		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
1334 	PHY_WRITE(mac, 0x80f, 0x8078);
1335 
1336 	/*
1337 	 * Measure all RF LO
1338 	 */
1339 	devi_ctrl = _bwi_rf_lo_update_11g(mac, regs.rf_7a);
1340 
1341 	/*
1342 	 * Restore saved RF/PHY registers
1343 	 */
1344 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1345 		PHY_WRITE(mac, 0x15, 0xe300);
1346 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa0);
1347 		DELAY(5);
1348 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa2);
1349 		DELAY(2);
1350 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa3);
1351 	} else {
1352 		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
1353 	}
1354 
1355 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1356 		tpctl = NULL;
1357 	bwi_rf_lo_adjust(mac, tpctl);
1358 
1359 	PHY_WRITE(mac, 0x2e, 0x807f);
1360 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1361 		PHY_WRITE(mac, 0x2f, 0x202);
1362 	else
1363 		PHY_WRITE(mac, 0x2f, 0x101);
1364 
1365 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1366 
1367 	RESTORE_PHY_REG(mac, &regs, 15);
1368 	RESTORE_PHY_REG(mac, &regs, 2a);
1369 	RESTORE_PHY_REG(mac, &regs, 35);
1370 	RESTORE_PHY_REG(mac, &regs, 60);
1371 
1372 	RESTORE_RF_REG(mac, &regs, 43);
1373 	RESTORE_RF_REG(mac, &regs, 7a);
1374 
1375 	regs.rf_52 &= 0xf0;
1376 	regs.rf_52 |= (RF_READ(mac, 0x52) & 0xf);
1377 	RF_WRITE(mac, 0x52, regs.rf_52);
1378 
1379 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1380 
1381 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1382 		RESTORE_PHY_REG(mac, &regs, 811);
1383 		RESTORE_PHY_REG(mac, &regs, 812);
1384 		RESTORE_PHY_REG(mac, &regs, 814);
1385 		RESTORE_PHY_REG(mac, &regs, 815);
1386 		RESTORE_PHY_REG(mac, &regs, 429);
1387 		RESTORE_PHY_REG(mac, &regs, 802);
1388 	}
1389 
1390 	bwi_rf_set_chan(mac, orig_chan, 1);
1391 }
1392 
1393 static uint32_t
1394 bwi_rf_lo_devi_measure(struct bwi_mac *mac, uint16_t ctrl)
1395 {
1396 	struct bwi_phy *phy = &mac->mac_phy;
1397 	uint32_t devi = 0;
1398 	int i;
1399 
1400 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1401 		ctrl <<= 8;
1402 
1403 	for (i = 0; i < 8; ++i) {
1404 		if (phy->phy_flags & BWI_PHY_F_LINKED) {
1405 			PHY_WRITE(mac, 0x15, 0xe300);
1406 			PHY_WRITE(mac, 0x812, ctrl | 0xb0);
1407 			DELAY(5);
1408 			PHY_WRITE(mac, 0x812, ctrl | 0xb2);
1409 			DELAY(2);
1410 			PHY_WRITE(mac, 0x812, ctrl | 0xb3);
1411 			DELAY(4);
1412 			PHY_WRITE(mac, 0x15, 0xf300);
1413 		} else {
1414 			PHY_WRITE(mac, 0x15, ctrl | 0xefa0);
1415 			DELAY(2);
1416 			PHY_WRITE(mac, 0x15, ctrl | 0xefe0);
1417 			DELAY(4);
1418 			PHY_WRITE(mac, 0x15, ctrl | 0xffe0);
1419 		}
1420 		DELAY(8);
1421 		devi += PHY_READ(mac, 0x2d);
1422 	}
1423 	return devi;
1424 }
1425 
1426 static uint16_t
1427 bwi_rf_get_tp_ctrl2(struct bwi_mac *mac)
1428 {
1429 	uint32_t devi_min;
1430 	uint16_t tp_ctrl2 = 0;
1431 	int i;
1432 
1433 	RF_WRITE(mac, 0x52, 0);
1434 	DELAY(10);
1435 	devi_min = bwi_rf_lo_devi_measure(mac, 0);
1436 
1437 	for (i = 0; i < 16; ++i) {
1438 		uint32_t devi;
1439 
1440 		RF_WRITE(mac, 0x52, i);
1441 		DELAY(10);
1442 		devi = bwi_rf_lo_devi_measure(mac, 0);
1443 
1444 		if (devi < devi_min) {
1445 			devi_min = devi;
1446 			tp_ctrl2 = i;
1447 		}
1448 	}
1449 	return tp_ctrl2;
1450 }
1451 
1452 static uint8_t
1453 _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
1454 {
1455 #define RF_ATTEN_LISTSZ	14
1456 #define BBP_ATTEN_MAX	4	/* half */
1457 
1458 	static const int rf_atten_list[RF_ATTEN_LISTSZ] =
1459 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 1, 2, 3, 4 };
1460 	static const int rf_atten_init_list[RF_ATTEN_LISTSZ] =
1461         { 0, 3, 1, 5, 7, 3, 2, 0, 4, 6, -1, -1, -1, -1 };
1462 	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
1463 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
1464 
1465 	struct ifnet *ifp = mac->mac_sc->sc_ifp;
1466 	struct bwi_rf_lo lo_save, *lo;
1467 	uint8_t devi_ctrl = 0;
1468 	int idx, adj_rf7a = 0;
1469 
1470 	bzero(&lo_save, sizeof(lo_save));
1471 	for (idx = 0; idx < RF_ATTEN_LISTSZ; ++idx) {
1472 		int init_rf_atten = rf_atten_init_list[idx];
1473 		int rf_atten = rf_atten_list[idx];
1474 		int bbp_atten;
1475 
1476 		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
1477 			uint16_t tp_ctrl2, rf7a;
1478 
1479 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1480 				if (idx == 0) {
1481 					bzero(&lo_save, sizeof(lo_save));
1482 				} else if (init_rf_atten < 0) {
1483 					lo = bwi_get_rf_lo(mac,
1484 						rf_atten, 2 * bbp_atten);
1485 					bcopy(lo, &lo_save, sizeof(lo_save));
1486 				} else {
1487 					lo = bwi_get_rf_lo(mac,
1488 						init_rf_atten, 0);
1489 					bcopy(lo, &lo_save, sizeof(lo_save));
1490 				}
1491 
1492 				devi_ctrl = 0;
1493 				adj_rf7a = 0;
1494 
1495 				/*
1496 				 * XXX
1497 				 * Linux driver overflows 'val'
1498 				 */
1499 				if (init_rf_atten >= 0) {
1500 					int val;
1501 
1502 					val = rf_atten * 2 + bbp_atten;
1503 					if (val > 14) {
1504 						adj_rf7a = 1;
1505 						if (val > 17)
1506 							devi_ctrl = 1;
1507 						if (val > 19)
1508 							devi_ctrl = 2;
1509 					}
1510 				}
1511 			} else {
1512 				lo = bwi_get_rf_lo(mac,
1513 					rf_atten, 2 * bbp_atten);
1514 				if (!bwi_rf_lo_isused(mac, lo))
1515 					continue;
1516 				bcopy(lo, &lo_save, sizeof(lo_save));
1517 
1518 				devi_ctrl = 3;
1519 				adj_rf7a = 0;
1520 			}
1521 
1522 			RF_WRITE(mac, BWI_RFR_ATTEN, rf_atten);
1523 
1524 			tp_ctrl2 = mac->mac_tpctl.tp_ctrl2;
1525 			if (init_rf_atten < 0)
1526 				tp_ctrl2 |= (3 << 4);
1527 			RF_WRITE(mac, BWI_RFR_TXPWR, tp_ctrl2);
1528 
1529 			DELAY(10);
1530 
1531 			bwi_phy_set_bbp_atten(mac, bbp_atten * 2);
1532 
1533 			rf7a = orig_rf7a & 0xfff0;
1534 			if (adj_rf7a)
1535 				rf7a |= 0x8;
1536 			RF_WRITE(mac, 0x7a, rf7a);
1537 
1538 			lo = bwi_get_rf_lo(mac,
1539 				rf_lo_measure_order[idx], bbp_atten * 2);
1540 			bwi_rf_lo_measure_11g(mac, &lo_save, lo, devi_ctrl);
1541 		}
1542 	}
1543 	return devi_ctrl;
1544 
1545 #undef RF_ATTEN_LISTSZ
1546 #undef BBP_ATTEN_MAX
1547 }
1548 
1549 static void
1550 bwi_rf_lo_measure_11g(struct bwi_mac *mac, const struct bwi_rf_lo *src_lo,
1551 	struct bwi_rf_lo *dst_lo, uint8_t devi_ctrl)
1552 {
1553 #define LO_ADJUST_MIN	1
1554 #define LO_ADJUST_MAX	8
1555 #define LO_ADJUST(hi, lo)	{ .ctrl_hi = hi, .ctrl_lo = lo }
1556 	static const struct bwi_rf_lo rf_lo_adjust[LO_ADJUST_MAX] = {
1557 		LO_ADJUST(1,	1),
1558 		LO_ADJUST(1,	0),
1559 		LO_ADJUST(1,	-1),
1560 		LO_ADJUST(0,	-1),
1561 		LO_ADJUST(-1,	-1),
1562 		LO_ADJUST(-1,	0),
1563 		LO_ADJUST(-1,	1),
1564 		LO_ADJUST(0,	1)
1565 	};
1566 #undef LO_ADJUST
1567 
1568 	struct bwi_rf_lo lo_min;
1569 	uint32_t devi_min;
1570 	int found, loop_count, adjust_state;
1571 
1572 	bcopy(src_lo, &lo_min, sizeof(lo_min));
1573 	RF_LO_WRITE(mac, &lo_min);
1574 	devi_min = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1575 
1576 	loop_count = 12;	/* XXX */
1577 	adjust_state = 0;
1578 	do {
1579 		struct bwi_rf_lo lo_base;
1580 		int i, fin;
1581 
1582 		found = 0;
1583 		if (adjust_state == 0) {
1584 			i = LO_ADJUST_MIN;
1585 			fin = LO_ADJUST_MAX;
1586 		} else if (adjust_state % 2 == 0) {
1587 			i = adjust_state - 1;
1588 			fin = adjust_state + 1;
1589 		} else {
1590 			i = adjust_state - 2;
1591 			fin = adjust_state + 2;
1592 		}
1593 
1594 		if (i < LO_ADJUST_MIN)
1595 			i += LO_ADJUST_MAX;
1596 		KASSERT(i <= LO_ADJUST_MAX && i >= LO_ADJUST_MIN, ("i %d", i));
1597 
1598 		if (fin > LO_ADJUST_MAX)
1599 			fin -= LO_ADJUST_MAX;
1600 		KASSERT(fin <= LO_ADJUST_MAX && fin >= LO_ADJUST_MIN,
1601 		    ("fin %d", fin));
1602 
1603 		bcopy(&lo_min, &lo_base, sizeof(lo_base));
1604 		for (;;) {
1605 			struct bwi_rf_lo lo;
1606 
1607 			lo.ctrl_hi = lo_base.ctrl_hi +
1608 				rf_lo_adjust[i - 1].ctrl_hi;
1609 			lo.ctrl_lo = lo_base.ctrl_lo +
1610 				rf_lo_adjust[i - 1].ctrl_lo;
1611 
1612 			if (abs(lo.ctrl_lo) < 9 && abs(lo.ctrl_hi) < 9) {
1613 				uint32_t devi;
1614 
1615 				RF_LO_WRITE(mac, &lo);
1616 				devi = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1617 				if (devi < devi_min) {
1618 					devi_min = devi;
1619 					adjust_state = i;
1620 					found = 1;
1621 					bcopy(&lo, &lo_min, sizeof(lo_min));
1622 				}
1623 			}
1624 			if (i == fin)
1625 				break;
1626 			if (i == LO_ADJUST_MAX)
1627 				i = LO_ADJUST_MIN;
1628 			else
1629 				++i;
1630 		}
1631 	} while (loop_count-- && found);
1632 
1633 	bcopy(&lo_min, dst_lo, sizeof(*dst_lo));
1634 
1635 #undef LO_ADJUST_MIN
1636 #undef LO_ADJUST_MAX
1637 }
1638 
1639 static void
1640 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *mac)
1641 {
1642 #define SAVE_RF_MAX	3
1643 #define SAVE_PHY_MAX	8
1644 
1645 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1646 	{ 0x7a, 0x52, 0x43 };
1647 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] =
1648 	{ 0x30, 0x26, 0x15, 0x2a, 0x20, 0x5a, 0x59, 0x58 };
1649 
1650 	struct bwi_softc *sc = mac->mac_sc;
1651 	struct bwi_rf *rf = &mac->mac_rf;
1652 	struct bwi_phy *phy = &mac->mac_phy;
1653 	uint16_t save_rf[SAVE_RF_MAX];
1654 	uint16_t save_phy[SAVE_PHY_MAX];
1655 	uint16_t ant_div, bbp_atten, chan_ex;
1656 	int16_t nrssi[2];
1657 	int i;
1658 
1659 	/*
1660 	 * Save RF/PHY registers for later restoration
1661 	 */
1662 	for (i = 0; i < SAVE_RF_MAX; ++i)
1663 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1664 	for (i = 0; i < SAVE_PHY_MAX; ++i)
1665 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
1666 
1667 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1668 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1669 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1670 
1671 	/*
1672 	 * Calculate nrssi0
1673 	 */
1674 	if (phy->phy_rev >= 5)
1675 		RF_CLRBITS(mac, 0x7a, 0xff80);
1676 	else
1677 		RF_CLRBITS(mac, 0x7a, 0xfff0);
1678 	PHY_WRITE(mac, 0x30, 0xff);
1679 
1680 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x7f7f);
1681 
1682 	PHY_WRITE(mac, 0x26, 0);
1683 	PHY_SETBITS(mac, 0x15, 0x20);
1684 	PHY_WRITE(mac, 0x2a, 0x8a3);
1685 	RF_SETBITS(mac, 0x7a, 0x80);
1686 
1687 	nrssi[0] = (int16_t)PHY_READ(mac, 0x27);
1688 
1689 	/*
1690 	 * Calculate nrssi1
1691 	 */
1692 	RF_CLRBITS(mac, 0x7a, 0xff80);
1693 	if (phy->phy_version >= 2)
1694 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x40);
1695 	else if (phy->phy_version == 0)
1696 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
1697 	else
1698 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0xdfff);
1699 
1700 	PHY_WRITE(mac, 0x20, 0x3f3f);
1701 	PHY_WRITE(mac, 0x15, 0xf330);
1702 
1703 	RF_WRITE(mac, 0x5a, 0x60);
1704 	RF_CLRBITS(mac, 0x43, 0xff0f);
1705 
1706 	PHY_WRITE(mac, 0x5a, 0x480);
1707 	PHY_WRITE(mac, 0x59, 0x810);
1708 	PHY_WRITE(mac, 0x58, 0xd);
1709 
1710 	DELAY(20);
1711 
1712 	nrssi[1] = (int16_t)PHY_READ(mac, 0x27);
1713 
1714 	/*
1715 	 * Restore saved RF/PHY registers
1716 	 */
1717 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
1718 	RF_WRITE(mac, save_rf_regs[0], save_rf[0]);
1719 
1720 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1721 
1722 	for (i = 1; i < 4; ++i)
1723 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1724 
1725 	bwi_rf_work_around(mac, rf->rf_curchan);
1726 
1727 	if (phy->phy_version != 0)
1728 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1729 
1730 	for (; i < SAVE_PHY_MAX; ++i)
1731 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1732 
1733 	for (i = 1; i < SAVE_RF_MAX; ++i)
1734 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1735 
1736 	/*
1737 	 * Install calculated narrow RSSI values
1738 	 */
1739 	if (nrssi[0] == nrssi[1])
1740 		rf->rf_nrssi_slope = 0x10000;
1741 	else
1742 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
1743 	if (nrssi[0] <= -4) {
1744 		rf->rf_nrssi[0] = nrssi[0];
1745 		rf->rf_nrssi[1] = nrssi[1];
1746 	}
1747 
1748 #undef SAVE_RF_MAX
1749 #undef SAVE_PHY_MAX
1750 }
1751 
1752 static void
1753 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *mac)
1754 {
1755 #define SAVE_RF_MAX		2
1756 #define SAVE_PHY_COMM_MAX	10
1757 #define SAVE_PHY6_MAX		8
1758 
1759 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1760 	{ 0x7a, 0x43 };
1761 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
1762 		0x0001, 0x0811, 0x0812, 0x0814,
1763 		0x0815, 0x005a, 0x0059, 0x0058,
1764 		0x000a, 0x0003
1765 	};
1766 	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
1767 		0x002e, 0x002f, 0x080f, 0x0810,
1768 		0x0801, 0x0060, 0x0014, 0x0478
1769 	};
1770 
1771 	struct bwi_phy *phy = &mac->mac_phy;
1772 	uint16_t save_rf[SAVE_RF_MAX];
1773 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1774 	uint16_t save_phy6[SAVE_PHY6_MAX];
1775 	uint16_t rf7b = 0xffff;
1776 	int16_t nrssi;
1777 	int i, phy6_idx = 0;
1778 
1779 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1780 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1781 	for (i = 0; i < SAVE_RF_MAX; ++i)
1782 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1783 
1784 	PHY_CLRBITS(mac, 0x429, 0x8000);
1785 	PHY_FILT_SETBITS(mac, 0x1, 0x3fff, 0x4000);
1786 	PHY_SETBITS(mac, 0x811, 0xc);
1787 	PHY_FILT_SETBITS(mac, 0x812, 0xfff3, 0x4);
1788 	PHY_CLRBITS(mac, 0x802, 0x3);
1789 
1790 	if (phy->phy_rev >= 6) {
1791 		for (i = 0; i < SAVE_PHY6_MAX; ++i)
1792 			save_phy6[i] = PHY_READ(mac, save_phy6_regs[i]);
1793 
1794 		PHY_WRITE(mac, 0x2e, 0);
1795 		PHY_WRITE(mac, 0x2f, 0);
1796 		PHY_WRITE(mac, 0x80f, 0);
1797 		PHY_WRITE(mac, 0x810, 0);
1798 		PHY_SETBITS(mac, 0x478, 0x100);
1799 		PHY_SETBITS(mac, 0x801, 0x40);
1800 		PHY_SETBITS(mac, 0x60, 0x40);
1801 		PHY_SETBITS(mac, 0x14, 0x200);
1802 	}
1803 
1804 	RF_SETBITS(mac, 0x7a, 0x70);
1805 	RF_SETBITS(mac, 0x7a, 0x80);
1806 
1807 	DELAY(30);
1808 
1809 	nrssi = bwi_nrssi_11g(mac);
1810 	if (nrssi == 31) {
1811 		for (i = 7; i >= 4; --i) {
1812 			RF_WRITE(mac, 0x7b, i);
1813 			DELAY(20);
1814 			nrssi = bwi_nrssi_11g(mac);
1815 			if (nrssi < 31 && rf7b == 0xffff)
1816 				rf7b = i;
1817 		}
1818 		if (rf7b == 0xffff)
1819 			rf7b = 4;
1820 	} else {
1821 		struct bwi_gains gains;
1822 
1823 		RF_CLRBITS(mac, 0x7a, 0xff80);
1824 
1825 		PHY_SETBITS(mac, 0x814, 0x1);
1826 		PHY_CLRBITS(mac, 0x815, 0x1);
1827 		PHY_SETBITS(mac, 0x811, 0xc);
1828 		PHY_SETBITS(mac, 0x812, 0xc);
1829 		PHY_SETBITS(mac, 0x811, 0x30);
1830 		PHY_SETBITS(mac, 0x812, 0x30);
1831 		PHY_WRITE(mac, 0x5a, 0x480);
1832 		PHY_WRITE(mac, 0x59, 0x810);
1833 		PHY_WRITE(mac, 0x58, 0xd);
1834 		if (phy->phy_version == 0)
1835 			PHY_WRITE(mac, 0x3, 0x122);
1836 		else
1837 			PHY_SETBITS(mac, 0xa, 0x2000);
1838 		PHY_SETBITS(mac, 0x814, 0x4);
1839 		PHY_CLRBITS(mac, 0x815, 0x4);
1840 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
1841 		RF_SETBITS(mac, 0x7a, 0xf);
1842 
1843 		bzero(&gains, sizeof(gains));
1844 		gains.tbl_gain1 = 3;
1845 		gains.tbl_gain2 = 0;
1846 		gains.phy_gain = 1;
1847 		bwi_set_gains(mac, &gains);
1848 
1849 		RF_FILT_SETBITS(mac, 0x43, 0xf0, 0xf);
1850 		DELAY(30);
1851 
1852 		nrssi = bwi_nrssi_11g(mac);
1853 		if (nrssi == -32) {
1854 			for (i = 0; i < 4; ++i) {
1855 				RF_WRITE(mac, 0x7b, i);
1856 				DELAY(20);
1857 				nrssi = bwi_nrssi_11g(mac);
1858 				if (nrssi > -31 && rf7b == 0xffff)
1859 					rf7b = i;
1860 			}
1861 			if (rf7b == 0xffff)
1862 				rf7b = 3;
1863 		} else {
1864 			rf7b = 0;
1865 		}
1866 	}
1867 	RF_WRITE(mac, 0x7b, rf7b);
1868 
1869 	/*
1870 	 * Restore saved RF/PHY registers
1871 	 */
1872 	if (phy->phy_rev >= 6) {
1873 		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
1874 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1875 				  save_phy6[phy6_idx]);
1876 		}
1877 	}
1878 
1879 	/* Saved PHY registers 0, 1, 2 are handled later */
1880 	for (i = 3; i < SAVE_PHY_COMM_MAX; ++i)
1881 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
1882 
1883 	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
1884 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1885 
1886 	PHY_SETBITS(mac, 0x802, 0x3);
1887 	PHY_SETBITS(mac, 0x429, 0x8000);
1888 
1889 	bwi_set_gains(mac, NULL);
1890 
1891 	if (phy->phy_rev >= 6) {
1892 		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
1893 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1894 				  save_phy6[phy6_idx]);
1895 		}
1896 	}
1897 
1898 	PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
1899 	PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
1900 	PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
1901 
1902 #undef SAVE_RF_MAX
1903 #undef SAVE_PHY_COMM_MAX
1904 #undef SAVE_PHY6_MAX
1905 }
1906 
1907 static void
1908 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *mac)
1909 {
1910 #define SAVE_RF_MAX		3
1911 #define SAVE_PHY_COMM_MAX	4
1912 #define SAVE_PHY3_MAX		8
1913 
1914 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1915 	{ 0x7a, 0x52, 0x43 };
1916 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
1917 	{ 0x15, 0x5a, 0x59, 0x58 };
1918 	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
1919 		0x002e, 0x002f, 0x080f, 0x0810,
1920 		0x0801, 0x0060, 0x0014, 0x0478
1921 	};
1922 
1923 	struct bwi_softc *sc = mac->mac_sc;
1924 	struct bwi_phy *phy = &mac->mac_phy;
1925 	struct bwi_rf *rf = &mac->mac_rf;
1926 	uint16_t save_rf[SAVE_RF_MAX];
1927 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1928 	uint16_t save_phy3[SAVE_PHY3_MAX];
1929 	uint16_t ant_div, bbp_atten, chan_ex;
1930 	struct bwi_gains gains;
1931 	int16_t nrssi[2];
1932 	int i, phy3_idx = 0;
1933 
1934 	if (rf->rf_rev >= 9)
1935 		return;
1936 	else if (rf->rf_rev == 8)
1937 		bwi_rf_set_nrssi_ofs_11g(mac);
1938 
1939 	PHY_CLRBITS(mac, 0x429, 0x8000);
1940 	PHY_CLRBITS(mac, 0x802, 0x3);
1941 
1942 	/*
1943 	 * Save RF/PHY registers for later restoration
1944 	 */
1945 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1946 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
1947 
1948 	for (i = 0; i < SAVE_RF_MAX; ++i)
1949 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1950 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1951 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1952 
1953 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1954 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1955 
1956 	if (phy->phy_rev >= 3) {
1957 		for (i = 0; i < SAVE_PHY3_MAX; ++i)
1958 			save_phy3[i] = PHY_READ(mac, save_phy3_regs[i]);
1959 
1960 		PHY_WRITE(mac, 0x2e, 0);
1961 		PHY_WRITE(mac, 0x810, 0);
1962 
1963 		if (phy->phy_rev == 4 || phy->phy_rev == 6 ||
1964 		    phy->phy_rev == 7) {
1965 			PHY_SETBITS(mac, 0x478, 0x100);
1966 			PHY_SETBITS(mac, 0x810, 0x40);
1967 		} else if (phy->phy_rev == 3 || phy->phy_rev == 5) {
1968 			PHY_CLRBITS(mac, 0x810, 0x40);
1969 		}
1970 
1971 		PHY_SETBITS(mac, 0x60, 0x40);
1972 		PHY_SETBITS(mac, 0x14, 0x200);
1973 	}
1974 
1975 	/*
1976 	 * Calculate nrssi0
1977 	 */
1978 	RF_SETBITS(mac, 0x7a, 0x70);
1979 
1980 	bzero(&gains, sizeof(gains));
1981 	gains.tbl_gain1 = 0;
1982 	gains.tbl_gain2 = 8;
1983 	gains.phy_gain = 0;
1984 	bwi_set_gains(mac, &gains);
1985 
1986 	RF_CLRBITS(mac, 0x7a, 0xff08);
1987 	if (phy->phy_rev >= 2) {
1988 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x30);
1989 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
1990 	}
1991 
1992 	RF_SETBITS(mac, 0x7a, 0x80);
1993 	DELAY(20);
1994 	nrssi[0] = bwi_nrssi_11g(mac);
1995 
1996 	/*
1997 	 * Calculate nrssi1
1998 	 */
1999 	RF_CLRBITS(mac, 0x7a, 0xff80);
2000 	if (phy->phy_version >= 2)
2001 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
2002 	CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
2003 
2004 	RF_SETBITS(mac, 0x7a, 0xf);
2005 	PHY_WRITE(mac, 0x15, 0xf330);
2006 	if (phy->phy_rev >= 2) {
2007 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x20);
2008 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x20);
2009 	}
2010 
2011 	bzero(&gains, sizeof(gains));
2012 	gains.tbl_gain1 = 3;
2013 	gains.tbl_gain2 = 0;
2014 	gains.phy_gain = 1;
2015 	bwi_set_gains(mac, &gains);
2016 
2017 	if (rf->rf_rev == 8) {
2018 		RF_WRITE(mac, 0x43, 0x1f);
2019 	} else {
2020 		RF_FILT_SETBITS(mac, 0x52, 0xff0f, 0x60);
2021 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
2022 	}
2023 	PHY_WRITE(mac, 0x5a, 0x480);
2024 	PHY_WRITE(mac, 0x59, 0x810);
2025 	PHY_WRITE(mac, 0x58, 0xd);
2026 	DELAY(20);
2027 
2028 	nrssi[1] = bwi_nrssi_11g(mac);
2029 
2030 	/*
2031 	 * Install calculated narrow RSSI values
2032 	 */
2033 	if (nrssi[1] == nrssi[0])
2034 		rf->rf_nrssi_slope = 0x10000;
2035 	else
2036 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
2037 	if (nrssi[0] >= -4) {
2038 		rf->rf_nrssi[0] = nrssi[1];
2039 		rf->rf_nrssi[1] = nrssi[0];
2040 	}
2041 
2042 	/*
2043 	 * Restore saved RF/PHY registers
2044 	 */
2045 	if (phy->phy_rev >= 3) {
2046 		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
2047 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2048 				  save_phy3[phy3_idx]);
2049 		}
2050 	}
2051 	if (phy->phy_rev >= 2) {
2052 		PHY_CLRBITS(mac, 0x812, 0x30);
2053 		PHY_CLRBITS(mac, 0x811, 0x30);
2054 	}
2055 
2056 	for (i = 0; i < SAVE_RF_MAX; ++i)
2057 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
2058 
2059 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
2060 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
2061 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
2062 
2063 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
2064 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
2065 
2066 	bwi_rf_work_around(mac, rf->rf_curchan);
2067 	PHY_SETBITS(mac, 0x802, 0x3);
2068 	bwi_set_gains(mac, NULL);
2069 	PHY_SETBITS(mac, 0x429, 0x8000);
2070 
2071 	if (phy->phy_rev >= 3) {
2072 		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
2073 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2074 				  save_phy3[phy3_idx]);
2075 		}
2076 	}
2077 
2078 	bwi_rf_init_sw_nrssi_table(mac);
2079 	bwi_rf_set_nrssi_thr_11g(mac);
2080 
2081 #undef SAVE_RF_MAX
2082 #undef SAVE_PHY_COMM_MAX
2083 #undef SAVE_PHY3_MAX
2084 }
2085 
2086 static void
2087 bwi_rf_init_sw_nrssi_table(struct bwi_mac *mac)
2088 {
2089 	struct bwi_rf *rf = &mac->mac_rf;
2090 	int d, i;
2091 
2092 	d = 0x1f - rf->rf_nrssi[0];
2093 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2094 		int val;
2095 
2096 		val = (((i - d) * rf->rf_nrssi_slope) / 0x10000) + 0x3a;
2097 		if (val < 0)
2098 			val = 0;
2099 		else if (val > 0x3f)
2100 			val = 0x3f;
2101 
2102 		rf->rf_nrssi_table[i] = val;
2103 	}
2104 }
2105 
2106 void
2107 bwi_rf_init_hw_nrssi_table(struct bwi_mac *mac, uint16_t adjust)
2108 {
2109 	int i;
2110 
2111 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2112 		int16_t val;
2113 
2114 		val = bwi_nrssi_read(mac, i);
2115 
2116 		val -= adjust;
2117 		if (val < -32)
2118 			val = -32;
2119 		else if (val > 31)
2120 			val = 31;
2121 
2122 		bwi_nrssi_write(mac, i, val);
2123 	}
2124 }
2125 
2126 static void
2127 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *mac)
2128 {
2129 	struct bwi_rf *rf = &mac->mac_rf;
2130 	int32_t thr;
2131 
2132 	if (rf->rf_type != BWI_RF_T_BCM2050 ||
2133 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0)
2134 		return;
2135 
2136 	/*
2137 	 * Calculate nrssi threshold
2138 	 */
2139 	if (rf->rf_rev >= 6) {
2140 		thr = (rf->rf_nrssi[1] - rf->rf_nrssi[0]) * 32;
2141 		thr += 20 * (rf->rf_nrssi[0] + 1);
2142 		thr /= 40;
2143 	} else {
2144 		thr = rf->rf_nrssi[1] - 5;
2145 	}
2146 	if (thr < 0)
2147 		thr = 0;
2148 	else if (thr > 0x3e)
2149 		thr = 0x3e;
2150 
2151 	PHY_READ(mac, BWI_PHYR_NRSSI_THR_11B);	/* dummy read */
2152 	PHY_WRITE(mac, BWI_PHYR_NRSSI_THR_11B, (((uint16_t)thr) << 8) | 0x1c);
2153 
2154 	if (rf->rf_rev >= 6) {
2155 		PHY_WRITE(mac, 0x87, 0xe0d);
2156 		PHY_WRITE(mac, 0x86, 0xc0b);
2157 		PHY_WRITE(mac, 0x85, 0xa09);
2158 		PHY_WRITE(mac, 0x84, 0x808);
2159 		PHY_WRITE(mac, 0x83, 0x808);
2160 		PHY_WRITE(mac, 0x82, 0x604);
2161 		PHY_WRITE(mac, 0x81, 0x302);
2162 		PHY_WRITE(mac, 0x80, 0x100);
2163 	}
2164 }
2165 
2166 static __inline int32_t
2167 _nrssi_threshold(const struct bwi_rf *rf, int32_t val)
2168 {
2169 	val *= (rf->rf_nrssi[1] - rf->rf_nrssi[0]);
2170 	val += (rf->rf_nrssi[0] << 6);
2171 	if (val < 32)
2172 		val += 31;
2173 	else
2174 		val += 32;
2175 	val >>= 6;
2176 	if (val < -31)
2177 		val = -31;
2178 	else if (val > 31)
2179 		val = 31;
2180 	return val;
2181 }
2182 
2183 static void
2184 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *mac)
2185 {
2186 	int32_t thr1, thr2;
2187 	uint16_t thr;
2188 
2189 	/*
2190 	 * Find the two nrssi thresholds
2191 	 */
2192 	if ((mac->mac_phy.phy_flags & BWI_PHY_F_LINKED) == 0 ||
2193 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
2194 	    	int16_t nrssi;
2195 
2196 		nrssi = bwi_nrssi_read(mac, 0x20);
2197 		if (nrssi >= 32)
2198 			nrssi -= 64;
2199 
2200 		if (nrssi < 3) {
2201 			thr1 = 0x2b;
2202 			thr2 = 0x27;
2203 		} else {
2204 			thr1 = 0x2d;
2205 			thr2 = 0x2b;
2206 		}
2207 	} else {
2208 		/* TODO Interfere mode */
2209 		thr1 = _nrssi_threshold(&mac->mac_rf, 0x11);
2210 		thr2 = _nrssi_threshold(&mac->mac_rf, 0xe);
2211 	}
2212 
2213 #define NRSSI_THR1_MASK	__BITS(5, 0)
2214 #define NRSSI_THR2_MASK	__BITS(11, 6)
2215 
2216 	thr = __SHIFTIN((uint32_t)thr1, NRSSI_THR1_MASK) |
2217 	      __SHIFTIN((uint32_t)thr2, NRSSI_THR2_MASK);
2218 	PHY_FILT_SETBITS(mac, BWI_PHYR_NRSSI_THR_11G, 0xf000, thr);
2219 
2220 #undef NRSSI_THR1_MASK
2221 #undef NRSSI_THR2_MASK
2222 }
2223 
2224 void
2225 bwi_rf_clear_tssi(struct bwi_mac *mac)
2226 {
2227 	/* XXX use function pointer */
2228 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
2229 		/* TODO:11A */
2230 	} else {
2231 		uint16_t val;
2232 		int i;
2233 
2234 		val = __SHIFTIN(BWI_INVALID_TSSI, BWI_LO_TSSI_MASK) |
2235 		      __SHIFTIN(BWI_INVALID_TSSI, BWI_HI_TSSI_MASK);
2236 
2237 		for (i = 0; i < 2; ++i) {
2238 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2239 				BWI_COMM_MOBJ_TSSI_DS + (i * 2), val);
2240 		}
2241 
2242 		for (i = 0; i < 2; ++i) {
2243 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2244 				BWI_COMM_MOBJ_TSSI_OFDM + (i * 2), val);
2245 		}
2246 	}
2247 }
2248 
2249 void
2250 bwi_rf_clear_state(struct bwi_rf *rf)
2251 {
2252 	int i;
2253 
2254 	rf->rf_flags &= ~BWI_RF_CLEAR_FLAGS;
2255 	bzero(rf->rf_lo, sizeof(rf->rf_lo));
2256 	bzero(rf->rf_lo_used, sizeof(rf->rf_lo_used));
2257 
2258 	rf->rf_nrssi_slope = 0;
2259 	rf->rf_nrssi[0] = BWI_INVALID_NRSSI;
2260 	rf->rf_nrssi[1] = BWI_INVALID_NRSSI;
2261 
2262 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i)
2263 		rf->rf_nrssi_table[i] = i;
2264 
2265 	rf->rf_lo_gain = 0;
2266 	rf->rf_rx_gain = 0;
2267 
2268 	bcopy(rf->rf_txpower_map0, rf->rf_txpower_map,
2269 	      sizeof(rf->rf_txpower_map));
2270 	rf->rf_idle_tssi = rf->rf_idle_tssi0;
2271 }
2272 
2273 static void
2274 bwi_rf_on_11a(struct bwi_mac *mac)
2275 {
2276 	/* TODO:11A */
2277 }
2278 
2279 static void
2280 bwi_rf_on_11bg(struct bwi_mac *mac)
2281 {
2282 	struct bwi_phy *phy = &mac->mac_phy;
2283 
2284 	PHY_WRITE(mac, 0x15, 0x8000);
2285 	PHY_WRITE(mac, 0x15, 0xcc00);
2286 	if (phy->phy_flags & BWI_PHY_F_LINKED)
2287 		PHY_WRITE(mac, 0x15, 0xc0);
2288 	else
2289 		PHY_WRITE(mac, 0x15, 0);
2290 
2291 	bwi_rf_set_chan(mac, 6 /* XXX */, 1);
2292 }
2293 
2294 void
2295 bwi_rf_set_ant_mode(struct bwi_mac *mac, int ant_mode)
2296 {
2297 	struct bwi_softc *sc = mac->mac_sc;
2298 	struct bwi_phy *phy = &mac->mac_phy;
2299 	uint16_t val;
2300 
2301 	KASSERT(ant_mode == BWI_ANT_MODE_0 ||
2302 		ant_mode == BWI_ANT_MODE_1 ||
2303 		ant_mode == BWI_ANT_MODE_AUTO, ("ant_mode %d", ant_mode));
2304 
2305 	HFLAGS_CLRBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2306 
2307 	if (phy->phy_mode == IEEE80211_MODE_11B) {
2308 		/* NOTE: v4/v3 conflicts, take v3 */
2309 		if (mac->mac_rev == 2)
2310 			val = BWI_ANT_MODE_AUTO;
2311 		else
2312 			val = ant_mode;
2313 		val <<= 7;
2314 		PHY_FILT_SETBITS(mac, 0x3e2, 0xfe7f, val);
2315 	} else {	/* 11a/g */
2316 		/* XXX reg/value naming */
2317 		val = ant_mode << 7;
2318 		PHY_FILT_SETBITS(mac, 0x401, 0x7e7f, val);
2319 
2320 		if (ant_mode == BWI_ANT_MODE_AUTO)
2321 			PHY_CLRBITS(mac, 0x42b, 0x100);
2322 
2323 		if (phy->phy_mode == IEEE80211_MODE_11A) {
2324 			/* TODO:11A */
2325 		} else {	/* 11g */
2326 			if (ant_mode == BWI_ANT_MODE_AUTO)
2327 				PHY_SETBITS(mac, 0x48c, 0x2000);
2328 			else
2329 				PHY_CLRBITS(mac, 0x48c, 0x2000);
2330 
2331 			if (phy->phy_rev >= 2) {
2332 				PHY_SETBITS(mac, 0x461, 0x10);
2333 				PHY_FILT_SETBITS(mac, 0x4ad, 0xff00, 0x15);
2334 				if (phy->phy_rev == 2) {
2335 					PHY_WRITE(mac, 0x427, 0x8);
2336 				} else {
2337 					PHY_FILT_SETBITS(mac, 0x427,
2338 							 0xff00, 0x8);
2339 				}
2340 
2341 				if (phy->phy_rev >= 6)
2342 					PHY_WRITE(mac, 0x49b, 0xdc);
2343 			}
2344 		}
2345 	}
2346 
2347 	/* XXX v4 set AUTO_ANTDIV unconditionally */
2348 	if (ant_mode == BWI_ANT_MODE_AUTO)
2349 		HFLAGS_SETBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2350 
2351 	val = ant_mode << 8;
2352 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_BEACON,
2353 			    0xfc3f, val);
2354 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_ACK,
2355 			    0xfc3f, val);
2356 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_PROBE_RESP,
2357 			    0xfc3f, val);
2358 
2359 	/* XXX what's these */
2360 	if (phy->phy_mode == IEEE80211_MODE_11B)
2361 		CSR_SETBITS_2(sc, 0x5e, 0x4);
2362 
2363 	CSR_WRITE_4(sc, 0x100, 0x1000000);
2364 	if (mac->mac_rev < 5)
2365 		CSR_WRITE_4(sc, 0x10c, 0x1000000);
2366 
2367 	mac->mac_rf.rf_ant_mode = ant_mode;
2368 }
2369 
2370 int
2371 bwi_rf_get_latest_tssi(struct bwi_mac *mac, int8_t tssi[], uint16_t ofs)
2372 {
2373 	int i;
2374 
2375 	for (i = 0; i < 4; ) {
2376 		uint16_t val;
2377 
2378 		val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs + i);
2379 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_LO_TSSI_MASK);
2380 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_HI_TSSI_MASK);
2381 	}
2382 
2383 	for (i = 0; i < 4; ++i) {
2384 		if (tssi[i] == BWI_INVALID_TSSI)
2385 			return EINVAL;
2386 	}
2387 	return 0;
2388 }
2389 
2390 int
2391 bwi_rf_tssi2dbm(struct bwi_mac *mac, int8_t tssi, int8_t *txpwr)
2392 {
2393 	struct bwi_rf *rf = &mac->mac_rf;
2394 	int pwr_idx;
2395 
2396 	pwr_idx = rf->rf_idle_tssi + (int)tssi - rf->rf_base_tssi;
2397 #if 0
2398 	if (pwr_idx < 0 || pwr_idx >= BWI_TSSI_MAX)
2399 		return EINVAL;
2400 #else
2401 	if (pwr_idx < 0)
2402 		pwr_idx = 0;
2403 	else if (pwr_idx >= BWI_TSSI_MAX)
2404 		pwr_idx = BWI_TSSI_MAX - 1;
2405 #endif
2406 
2407 	*txpwr = rf->rf_txpower_map[pwr_idx];
2408 	return 0;
2409 }
2410 
2411 static int
2412 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2413 {
2414 	uint16_t flags1, flags3;
2415 	int rssi, lna_gain;
2416 
2417 	rssi = hdr->rxh_rssi;
2418 	flags1 = le16toh(hdr->rxh_flags1);
2419 	flags3 = le16toh(hdr->rxh_flags3);
2420 
2421 	if (flags1 & BWI_RXH_F1_OFDM) {
2422 		if (rssi > 127)
2423 			rssi -= 256;
2424 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2425 			rssi += 17;
2426 		else
2427 			rssi -= 4;
2428 		return rssi;
2429 	}
2430 
2431 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2432 		struct bwi_rf *rf = &mac->mac_rf;
2433 
2434 		if (rssi >= BWI_NRSSI_TBLSZ)
2435 			rssi = BWI_NRSSI_TBLSZ - 1;
2436 
2437 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
2438 		rssi -= 67;
2439 	} else {
2440 		rssi = ((31 - rssi) * -149) / 128;
2441 		rssi -= 68;
2442 	}
2443 
2444 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
2445 		return rssi;
2446 
2447 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2448 		rssi += 20;
2449 
2450 	lna_gain = __SHIFTOUT(le16toh(hdr->rxh_phyinfo),
2451 			      BWI_RXH_PHYINFO_LNAGAIN);
2452 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_RX,
2453 		"lna_gain %d, phyinfo 0x%04x\n",
2454 		lna_gain, le16toh(hdr->rxh_phyinfo));
2455 	switch (lna_gain) {
2456 	case 0:
2457 		rssi += 27;
2458 		break;
2459 	case 1:
2460 		rssi += 6;
2461 		break;
2462 	case 2:
2463 		rssi += 12;
2464 		break;
2465 	case 3:
2466 		/*
2467 		 * XXX
2468 		 * According to v3 spec, we should do _nothing_ here,
2469 		 * but it seems that the result RSSI will be too low
2470 		 * (relative to what ath(4) says).  Raise it a little
2471 		 * bit.
2472 		 */
2473 		rssi += 5;
2474 		break;
2475 	default:
2476 		panic("impossible lna gain %d", lna_gain);
2477 	}
2478 	return rssi;
2479 }
2480 
2481 static int
2482 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2483 {
2484 	uint16_t flags1;
2485 	int rssi;
2486 
2487 	rssi = (((int)hdr->rxh_rssi - 11) * 103) / 64;
2488 
2489 	flags1 = le16toh(hdr->rxh_flags1);
2490 	if (flags1 & BWI_RXH_F1_BCM2053_RSSI)
2491 		rssi -= 109;
2492 	else
2493 		rssi -= 83;
2494 	return rssi;
2495 }
2496 
2497 static int
2498 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2499 {
2500 	int rssi;
2501 
2502 	rssi = hdr->rxh_rssi;
2503 	if (rssi > 127)
2504 		rssi -= 256;
2505 	return rssi;
2506 }
2507 
2508 static int
2509 bwi_rf_calc_noise_bcm2050(struct bwi_mac *mac)
2510 {
2511 	uint16_t val;
2512 	int noise;
2513 
2514 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2515 	noise = (int)val;	/* XXX check bounds? */
2516 
2517 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2518 		struct bwi_rf *rf = &mac->mac_rf;
2519 
2520 		if (noise >= BWI_NRSSI_TBLSZ)
2521 			noise = BWI_NRSSI_TBLSZ - 1;
2522 
2523 		noise = ((31 - (int)rf->rf_nrssi_table[noise]) * -131) / 128;
2524 		noise -= 67;
2525 	} else {
2526 		noise = ((31 - noise) * -149) / 128;
2527 		noise -= 68;
2528 	}
2529 	return noise;
2530 }
2531 
2532 static int
2533 bwi_rf_calc_noise_bcm2053(struct bwi_mac *mac)
2534 {
2535 	uint16_t val;
2536 	int noise;
2537 
2538 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2539 	noise = (int)val;	/* XXX check bounds? */
2540 
2541 	noise = ((noise - 11) * 103) / 64;
2542 	noise -= 109;
2543 	return noise;
2544 }
2545 
2546 static int
2547 bwi_rf_calc_noise_bcm2060(struct bwi_mac *mac)
2548 {
2549 	/* XXX Dont know how to calc */
2550 	return (BWI_NOISE_FLOOR);
2551 }
2552 
2553 static uint16_t
2554 bwi_rf_lo_measure_11b(struct bwi_mac *mac)
2555 {
2556 	uint16_t val;
2557 	int i;
2558 
2559 	val = 0;
2560 	for (i = 0; i < 10; ++i) {
2561 		PHY_WRITE(mac, 0x15, 0xafa0);
2562 		DELAY(1);
2563 		PHY_WRITE(mac, 0x15, 0xefa0);
2564 		DELAY(10);
2565 		PHY_WRITE(mac, 0x15, 0xffa0);
2566 		DELAY(40);
2567 
2568 		val += PHY_READ(mac, 0x2c);
2569 	}
2570 	return val;
2571 }
2572 
2573 static void
2574 bwi_rf_lo_update_11b(struct bwi_mac *mac)
2575 {
2576 	struct bwi_softc *sc = mac->mac_sc;
2577 	struct bwi_rf *rf = &mac->mac_rf;
2578 	struct rf_saveregs regs;
2579 	uint16_t rf_val, phy_val, min_val, val;
2580 	uint16_t rf52, bphy_ctrl;
2581 	int i;
2582 
2583 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT, "%s enter\n", __func__);
2584 
2585 	bzero(&regs, sizeof(regs));
2586 	bphy_ctrl = 0;
2587 
2588 	/*
2589 	 * Save RF/PHY registers for later restoration
2590 	 */
2591 	SAVE_PHY_REG(mac, &regs, 15);
2592 	rf52 = RF_READ(mac, 0x52) & 0xfff0;
2593 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2594 		SAVE_PHY_REG(mac, &regs, 0a);
2595 		SAVE_PHY_REG(mac, &regs, 2a);
2596 		SAVE_PHY_REG(mac, &regs, 35);
2597 		SAVE_PHY_REG(mac, &regs, 03);
2598 		SAVE_PHY_REG(mac, &regs, 01);
2599 		SAVE_PHY_REG(mac, &regs, 30);
2600 
2601 		SAVE_RF_REG(mac, &regs, 43);
2602 		SAVE_RF_REG(mac, &regs, 7a);
2603 
2604 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
2605 
2606 		SAVE_RF_REG(mac, &regs, 52);
2607 		regs.rf_52 &= 0xf0;
2608 
2609 		PHY_WRITE(mac, 0x30, 0xff);
2610 		CSR_WRITE_2(sc, BWI_PHY_CTRL, 0x3f3f);
2611 		PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
2612 		RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
2613 	}
2614 
2615 	PHY_WRITE(mac, 0x15, 0xb000);
2616 
2617 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2618 		PHY_WRITE(mac, 0x2b, 0x203);
2619 		PHY_WRITE(mac, 0x2a, 0x8a3);
2620 	} else {
2621 		PHY_WRITE(mac, 0x2b, 0x1402);
2622 	}
2623 
2624 	/*
2625 	 * Setup RF signal
2626 	 */
2627 	rf_val = 0;
2628 	min_val = UINT16_MAX;
2629 
2630 	for (i = 0; i < 4; ++i) {
2631 		RF_WRITE(mac, 0x52, rf52 | i);
2632 		bwi_rf_lo_measure_11b(mac);	/* Ignore return value */
2633 	}
2634 	for (i = 0; i < 10; ++i) {
2635 		RF_WRITE(mac, 0x52, rf52 | i);
2636 
2637 		val = bwi_rf_lo_measure_11b(mac) / 10;
2638 		if (val < min_val) {
2639 			min_val = val;
2640 			rf_val = i;
2641 		}
2642 	}
2643 	RF_WRITE(mac, 0x52, rf52 | rf_val);
2644 
2645 	/*
2646 	 * Setup PHY signal
2647 	 */
2648 	phy_val = 0;
2649 	min_val = UINT16_MAX;
2650 
2651 	for (i = -4; i < 5; i += 2) {
2652 		int j;
2653 
2654 		for (j = -4; j < 5; j += 2) {
2655 			uint16_t phy2f;
2656 
2657 			phy2f = (0x100 * i) + j;
2658 			if (j < 0)
2659 				phy2f += 0x100;
2660 			PHY_WRITE(mac, 0x2f, phy2f);
2661 
2662 			val = bwi_rf_lo_measure_11b(mac) / 10;
2663 			if (val < min_val) {
2664 				min_val = val;
2665 				phy_val = phy2f;
2666 			}
2667 		}
2668 	}
2669 	PHY_WRITE(mac, 0x2f, phy_val + 0x101);
2670 
2671 	/*
2672 	 * Restore saved RF/PHY registers
2673 	 */
2674 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2675 		RESTORE_PHY_REG(mac, &regs, 0a);
2676 		RESTORE_PHY_REG(mac, &regs, 2a);
2677 		RESTORE_PHY_REG(mac, &regs, 35);
2678 		RESTORE_PHY_REG(mac, &regs, 03);
2679 		RESTORE_PHY_REG(mac, &regs, 01);
2680 		RESTORE_PHY_REG(mac, &regs, 30);
2681 
2682 		RESTORE_RF_REG(mac, &regs, 43);
2683 		RESTORE_RF_REG(mac, &regs, 7a);
2684 
2685 		RF_FILT_SETBITS(mac, 0x52, 0xf, regs.rf_52);
2686 
2687 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
2688 	}
2689 	RESTORE_PHY_REG(mac, &regs, 15);
2690 
2691 	bwi_rf_work_around(mac, rf->rf_curchan);
2692 }
2693