xref: /freebsd/sys/dev/bwi/bwirf.c (revision 80ff58b89dcacfe07fe20b045890df9db5ca0af0)
1 /*
2  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Sepherosa Ziehau <sepherosa@gmail.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * $DragonFly: src/sys/dev/netif/bwi/bwirf.c,v 1.9 2008/08/21 12:19:33 swildner Exp $
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include "opt_inet.h"
41 #include "opt_bwi.h"
42 #include "opt_wlan.h"
43 
44 #include <sys/param.h>
45 #include <sys/endian.h>
46 #include <sys/kernel.h>
47 #include <sys/bus.h>
48 #include <sys/malloc.h>
49 #include <sys/proc.h>
50 #include <sys/rman.h>
51 #include <sys/socket.h>
52 #include <sys/sockio.h>
53 #include <sys/sysctl.h>
54 #include <sys/systm.h>
55 
56 #include <net/if.h>
57 #include <net/if_dl.h>
58 #include <net/if_media.h>
59 #include <net/if_types.h>
60 #include <net/if_arp.h>
61 #include <net/ethernet.h>
62 #include <net/if_llc.h>
63 
64 #include <net80211/ieee80211_var.h>
65 #include <net80211/ieee80211_radiotap.h>
66 #include <net80211/ieee80211_amrr.h>
67 
68 #include <machine/bus.h>
69 
70 #include <dev/bwi/bitops.h>
71 #include <dev/bwi/if_bwireg.h>
72 #include <dev/bwi/if_bwivar.h>
73 #include <dev/bwi/bwimac.h>
74 #include <dev/bwi/bwirf.h>
75 #include <dev/bwi/bwiphy.h>
76 
77 #define RF_LO_WRITE(mac, lo)	bwi_rf_lo_write((mac), (lo))
78 
79 #define BWI_RF_2GHZ_CHAN(chan)			\
80 	(ieee80211_ieee2mhz((chan), IEEE80211_CHAN_2GHZ) - 2400)
81 
82 #define BWI_DEFAULT_IDLE_TSSI	52
83 
84 struct rf_saveregs {
85 	uint16_t	phy_01;
86 	uint16_t	phy_03;
87 	uint16_t	phy_0a;
88 	uint16_t	phy_15;
89 	uint16_t	phy_2a;
90 	uint16_t	phy_30;
91 	uint16_t	phy_35;
92 	uint16_t	phy_60;
93 	uint16_t	phy_429;
94 	uint16_t	phy_802;
95 	uint16_t	phy_811;
96 	uint16_t	phy_812;
97 	uint16_t	phy_814;
98 	uint16_t	phy_815;
99 
100 	uint16_t	rf_43;
101 	uint16_t	rf_52;
102 	uint16_t	rf_7a;
103 };
104 
105 #define SAVE_RF_REG(mac, regs, n)	(regs)->rf_##n = RF_READ((mac), 0x##n)
106 #define RESTORE_RF_REG(mac, regs, n)	RF_WRITE((mac), 0x##n, (regs)->rf_##n)
107 
108 #define SAVE_PHY_REG(mac, regs, n)	(regs)->phy_##n = PHY_READ((mac), 0x##n)
109 #define RESTORE_PHY_REG(mac, regs, n)	PHY_WRITE((mac), 0x##n, (regs)->phy_##n)
110 
111 static int	bwi_rf_calc_txpower(int8_t *, uint8_t, const int16_t[]);
112 static void	bwi_rf_work_around(struct bwi_mac *, u_int);
113 static int	bwi_rf_gain_max_reached(struct bwi_mac *, int);
114 static uint16_t	bwi_rf_calibval(struct bwi_mac *);
115 static uint16_t	bwi_rf_get_tp_ctrl2(struct bwi_mac *);
116 
117 static void	bwi_rf_lo_update_11b(struct bwi_mac *);
118 static uint16_t	bwi_rf_lo_measure_11b(struct bwi_mac *);
119 
120 static void	bwi_rf_lo_update_11g(struct bwi_mac *);
121 static uint32_t	bwi_rf_lo_devi_measure(struct bwi_mac *, uint16_t);
122 static void	bwi_rf_lo_measure_11g(struct bwi_mac *,
123 			const struct bwi_rf_lo *, struct bwi_rf_lo *, uint8_t);
124 static uint8_t	_bwi_rf_lo_update_11g(struct bwi_mac *, uint16_t);
125 static void	bwi_rf_lo_write(struct bwi_mac *, const struct bwi_rf_lo *);
126 
127 static void	bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *);
128 static void	bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *);
129 static void	bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *);
130 static void	bwi_rf_set_nrssi_thr_11b(struct bwi_mac *);
131 static void	bwi_rf_set_nrssi_thr_11g(struct bwi_mac *);
132 
133 static void	bwi_rf_init_sw_nrssi_table(struct bwi_mac *);
134 
135 static int	bwi_rf_calc_rssi_bcm2050(struct bwi_mac *,
136 			const struct bwi_rxbuf_hdr *);
137 static int	bwi_rf_calc_rssi_bcm2053(struct bwi_mac *,
138 			const struct bwi_rxbuf_hdr *);
139 static int	bwi_rf_calc_rssi_bcm2060(struct bwi_mac *,
140 			const struct bwi_rxbuf_hdr *);
141 static int	bwi_rf_calc_noise_bcm2050(struct bwi_mac *);
142 static int	bwi_rf_calc_noise_bcm2053(struct bwi_mac *);
143 static int	bwi_rf_calc_noise_bcm2060(struct bwi_mac *);
144 
145 static void	bwi_rf_on_11a(struct bwi_mac *);
146 static void	bwi_rf_on_11bg(struct bwi_mac *);
147 
148 static void	bwi_rf_off_11a(struct bwi_mac *);
149 static void	bwi_rf_off_11bg(struct bwi_mac *);
150 static void	bwi_rf_off_11g_rev5(struct bwi_mac *);
151 
152 static const int8_t	bwi_txpower_map_11b[BWI_TSSI_MAX] =
153 	{ BWI_TXPOWER_MAP_11B };
154 static const int8_t	bwi_txpower_map_11g[BWI_TSSI_MAX] =
155 	{ BWI_TXPOWER_MAP_11G };
156 
157 static __inline int16_t
158 bwi_nrssi_11g(struct bwi_mac *mac)
159 {
160 	int16_t val;
161 
162 #define NRSSI_11G_MASK		__BITS(13, 8)
163 
164 	val = (int16_t)__SHIFTOUT(PHY_READ(mac, 0x47f), NRSSI_11G_MASK);
165 	if (val >= 32)
166 		val -= 64;
167 	return val;
168 
169 #undef NRSSI_11G_MASK
170 }
171 
172 static __inline struct bwi_rf_lo *
173 bwi_get_rf_lo(struct bwi_mac *mac, uint16_t rf_atten, uint16_t bbp_atten)
174 {
175 	int n;
176 
177 	n = rf_atten + (14 * (bbp_atten / 2));
178 	KASSERT(n < BWI_RFLO_MAX, ("n %d", n));
179 
180 	return &mac->mac_rf.rf_lo[n];
181 }
182 
183 static __inline int
184 bwi_rf_lo_isused(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
185 {
186 	struct bwi_rf *rf = &mac->mac_rf;
187 	int idx;
188 
189 	idx = lo - rf->rf_lo;
190 	KASSERT(idx >= 0 && idx < BWI_RFLO_MAX, ("idx %d", idx));
191 
192 	return isset(rf->rf_lo_used, idx);
193 }
194 
195 void
196 bwi_rf_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
197 {
198 	struct bwi_softc *sc = mac->mac_sc;
199 
200 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
201 	CSR_WRITE_2(sc, BWI_RF_DATA_LO, data);
202 }
203 
204 uint16_t
205 bwi_rf_read(struct bwi_mac *mac, uint16_t ctrl)
206 {
207 	struct bwi_rf *rf = &mac->mac_rf;
208 	struct bwi_softc *sc = mac->mac_sc;
209 
210 	ctrl |= rf->rf_ctrl_rd;
211 	if (rf->rf_ctrl_adj) {
212 		/* XXX */
213 		if (ctrl < 0x70)
214 			ctrl += 0x80;
215 		else if (ctrl < 0x80)
216 			ctrl += 0x70;
217 	}
218 
219 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
220 	return CSR_READ_2(sc, BWI_RF_DATA_LO);
221 }
222 
223 int
224 bwi_rf_attach(struct bwi_mac *mac)
225 {
226 	struct bwi_softc *sc = mac->mac_sc;
227 	struct bwi_phy *phy = &mac->mac_phy;
228 	struct bwi_rf *rf = &mac->mac_rf;
229 	uint16_t type, manu;
230 	uint8_t rev;
231 
232 	/*
233 	 * Get RF manufacture/type/revision
234 	 */
235 	if (sc->sc_bbp_id == BWI_BBPID_BCM4317) {
236 		/*
237 		 * Fake a BCM2050 RF
238 		 */
239 		manu = BWI_RF_MANUFACT_BCM;
240 		type = BWI_RF_T_BCM2050;
241 		if (sc->sc_bbp_rev == 0)
242 			rev = 3;
243 		else if (sc->sc_bbp_rev == 1)
244 			rev = 4;
245 		else
246 			rev = 5;
247 	} else {
248 		uint32_t val;
249 
250 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
251 		val = CSR_READ_2(sc, BWI_RF_DATA_HI);
252 		val <<= 16;
253 
254 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
255 		val |= CSR_READ_2(sc, BWI_RF_DATA_LO);
256 
257 		manu = __SHIFTOUT(val, BWI_RFINFO_MANUFACT_MASK);
258 		type = __SHIFTOUT(val, BWI_RFINFO_TYPE_MASK);
259 		rev = __SHIFTOUT(val, BWI_RFINFO_REV_MASK);
260 	}
261 	device_printf(sc->sc_dev, "RF: manu 0x%03x, type 0x%04x, rev %u\n",
262 		      manu, type, rev);
263 
264 	/*
265 	 * Verify whether the RF is supported
266 	 */
267 	rf->rf_ctrl_rd = 0;
268 	rf->rf_ctrl_adj = 0;
269 	switch (phy->phy_mode) {
270 	case IEEE80211_MODE_11A:
271 		if (manu != BWI_RF_MANUFACT_BCM ||
272 		    type != BWI_RF_T_BCM2060 ||
273 		    rev != 1) {
274 			device_printf(sc->sc_dev, "only BCM2060 rev 1 RF "
275 				      "is supported for 11A PHY\n");
276 			return ENXIO;
277 		}
278 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11A;
279 		rf->rf_on = bwi_rf_on_11a;
280 		rf->rf_off = bwi_rf_off_11a;
281 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2060;
282 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2060;
283 		break;
284 	case IEEE80211_MODE_11B:
285 		if (type == BWI_RF_T_BCM2050) {
286 			rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
287 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
288 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
289 		} else if (type == BWI_RF_T_BCM2053) {
290 			rf->rf_ctrl_adj = 1;
291 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2053;
292 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2053;
293 		} else {
294 			device_printf(sc->sc_dev, "only BCM2050/BCM2053 RF "
295 				      "is supported for 11B PHY\n");
296 			return ENXIO;
297 		}
298 		rf->rf_on = bwi_rf_on_11bg;
299 		rf->rf_off = bwi_rf_off_11bg;
300 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11b;
301 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11b;
302 		if (phy->phy_rev == 6)
303 			rf->rf_lo_update = bwi_rf_lo_update_11g;
304 		else
305 			rf->rf_lo_update = bwi_rf_lo_update_11b;
306 		break;
307 	case IEEE80211_MODE_11G:
308 		if (type != BWI_RF_T_BCM2050) {
309 			device_printf(sc->sc_dev, "only BCM2050 RF "
310 				      "is supported for 11G PHY\n");
311 			return ENXIO;
312 		}
313 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
314 		rf->rf_on = bwi_rf_on_11bg;
315 		if (mac->mac_rev >= 5)
316 			rf->rf_off = bwi_rf_off_11g_rev5;
317 		else
318 			rf->rf_off = bwi_rf_off_11bg;
319 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11g;
320 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11g;
321 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
322 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
323 		rf->rf_lo_update = bwi_rf_lo_update_11g;
324 		break;
325 	default:
326 		device_printf(sc->sc_dev, "unsupported PHY mode\n");
327 		return ENXIO;
328 	}
329 
330 	rf->rf_type = type;
331 	rf->rf_rev = rev;
332 	rf->rf_manu = manu;
333 	rf->rf_curchan = IEEE80211_CHAN_ANY;
334 	rf->rf_ant_mode = BWI_ANT_MODE_AUTO;
335 	return 0;
336 }
337 
338 void
339 bwi_rf_set_chan(struct bwi_mac *mac, u_int chan, int work_around)
340 {
341 	struct bwi_softc *sc = mac->mac_sc;
342 
343 	if (chan == IEEE80211_CHAN_ANY)
344 		return;
345 
346 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_CHAN, chan);
347 
348 	/* TODO: 11A */
349 
350 	if (work_around)
351 		bwi_rf_work_around(mac, chan);
352 
353 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
354 
355 	if (chan == 14) {
356 		if (sc->sc_locale == BWI_SPROM_LOCALE_JAPAN)
357 			HFLAGS_CLRBITS(mac, BWI_HFLAG_NOT_JAPAN);
358 		else
359 			HFLAGS_SETBITS(mac, BWI_HFLAG_NOT_JAPAN);
360 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, (1 << 11)); /* XXX */
361 	} else {
362 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0x840); /* XXX */
363 	}
364 	DELAY(8000);	/* DELAY(2000); */
365 
366 	mac->mac_rf.rf_curchan = chan;
367 }
368 
369 void
370 bwi_rf_get_gains(struct bwi_mac *mac)
371 {
372 #define SAVE_PHY_MAX	15
373 #define SAVE_RF_MAX	3
374 
375 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
376 	{ 0x52, 0x43, 0x7a };
377 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] = {
378 		0x0429, 0x0001, 0x0811, 0x0812,
379 		0x0814, 0x0815, 0x005a, 0x0059,
380 		0x0058, 0x000a, 0x0003, 0x080f,
381 		0x0810, 0x002b, 0x0015
382 	};
383 
384 	struct bwi_softc *sc = mac->mac_sc;
385 	struct bwi_phy *phy = &mac->mac_phy;
386 	struct bwi_rf *rf = &mac->mac_rf;
387 	uint16_t save_phy[SAVE_PHY_MAX];
388 	uint16_t save_rf[SAVE_RF_MAX];
389 	uint16_t trsw;
390 	int i, j, loop1_max, loop1, loop2;
391 
392 	/*
393 	 * Save PHY/RF registers for later restoration
394 	 */
395 	for (i = 0; i < SAVE_PHY_MAX; ++i)
396 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
397 	PHY_READ(mac, 0x2d); /* dummy read */
398 
399 	for (i = 0; i < SAVE_RF_MAX; ++i)
400 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
401 
402 	PHY_CLRBITS(mac, 0x429, 0xc000);
403 	PHY_SETBITS(mac, 0x1, 0x8000);
404 
405 	PHY_SETBITS(mac, 0x811, 0x2);
406 	PHY_CLRBITS(mac, 0x812, 0x2);
407 	PHY_SETBITS(mac, 0x811, 0x1);
408 	PHY_CLRBITS(mac, 0x812, 0x1);
409 
410 	PHY_SETBITS(mac, 0x814, 0x1);
411 	PHY_CLRBITS(mac, 0x815, 0x1);
412 	PHY_SETBITS(mac, 0x814, 0x2);
413 	PHY_CLRBITS(mac, 0x815, 0x2);
414 
415 	PHY_SETBITS(mac, 0x811, 0xc);
416 	PHY_SETBITS(mac, 0x812, 0xc);
417 	PHY_SETBITS(mac, 0x811, 0x30);
418 	PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
419 
420 	PHY_WRITE(mac, 0x5a, 0x780);
421 	PHY_WRITE(mac, 0x59, 0xc810);
422 	PHY_WRITE(mac, 0x58, 0xd);
423 	PHY_SETBITS(mac, 0xa, 0x2000);
424 
425 	PHY_SETBITS(mac, 0x814, 0x4);
426 	PHY_CLRBITS(mac, 0x815, 0x4);
427 
428 	PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
429 
430 	if (rf->rf_rev == 8) {
431 		loop1_max = 15;
432 		RF_WRITE(mac, 0x43, loop1_max);
433 	} else {
434 		loop1_max = 9;
435 	    	RF_WRITE(mac, 0x52, 0x0);
436 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, loop1_max);
437 	}
438 
439 	bwi_phy_set_bbp_atten(mac, 11);
440 
441 	if (phy->phy_rev >= 3)
442 		PHY_WRITE(mac, 0x80f, 0xc020);
443 	else
444 		PHY_WRITE(mac, 0x80f, 0x8020);
445 	PHY_WRITE(mac, 0x810, 0);
446 
447 	PHY_FILT_SETBITS(mac, 0x2b, 0xffc0, 0x1);
448 	PHY_FILT_SETBITS(mac, 0x2b, 0xc0ff, 0x800);
449 	PHY_SETBITS(mac, 0x811, 0x100);
450 	PHY_CLRBITS(mac, 0x812, 0x3000);
451 
452 	if ((sc->sc_card_flags & BWI_CARD_F_EXT_LNA) &&
453 	    phy->phy_rev >= 7) {
454 		PHY_SETBITS(mac, 0x811, 0x800);
455 		PHY_SETBITS(mac, 0x812, 0x8000);
456 	}
457 	RF_CLRBITS(mac, 0x7a, 0xff08);
458 
459 	/*
460 	 * Find out 'loop1/loop2', which will be used to calculate
461 	 * max loopback gain later
462 	 */
463 	j = 0;
464 	for (i = 0; i < loop1_max; ++i) {
465 		for (j = 0; j < 16; ++j) {
466 			RF_WRITE(mac, 0x43, i);
467 
468 			if (bwi_rf_gain_max_reached(mac, j))
469 				goto loop1_exit;
470 		}
471 	}
472 loop1_exit:
473 	loop1 = i;
474 	loop2 = j;
475 
476 	/*
477 	 * Find out 'trsw', which will be used to calculate
478 	 * TRSW(TX/RX switch) RX gain later
479 	 */
480 	if (loop2 >= 8) {
481 		PHY_SETBITS(mac, 0x812, 0x30);
482 		trsw = 0x1b;
483 		for (i = loop2 - 8; i < 16; ++i) {
484 			trsw -= 3;
485 			if (bwi_rf_gain_max_reached(mac, i))
486 				break;
487 		}
488 	} else {
489 		trsw = 0x18;
490 	}
491 
492 	/*
493 	 * Restore saved PHY/RF registers
494 	 */
495 	/* First 4 saved PHY registers need special processing */
496 	for (i = 4; i < SAVE_PHY_MAX; ++i)
497 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
498 
499 	bwi_phy_set_bbp_atten(mac, mac->mac_tpctl.bbp_atten);
500 
501 	for (i = 0; i < SAVE_RF_MAX; ++i)
502 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
503 
504 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2] | 0x3);
505 	DELAY(10);
506 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2]);
507 	PHY_WRITE(mac, save_phy_regs[3], save_phy[3]);
508 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
509 	PHY_WRITE(mac, save_phy_regs[1], save_phy[1]);
510 
511 	/*
512 	 * Calculate gains
513 	 */
514 	rf->rf_lo_gain = (loop2 * 6) - (loop1 * 4) - 11;
515 	rf->rf_rx_gain = trsw * 2;
516 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_INIT,
517 		"lo gain: %u, rx gain: %u\n",
518 		rf->rf_lo_gain, rf->rf_rx_gain);
519 
520 #undef SAVE_RF_MAX
521 #undef SAVE_PHY_MAX
522 }
523 
524 void
525 bwi_rf_init(struct bwi_mac *mac)
526 {
527 	struct bwi_rf *rf = &mac->mac_rf;
528 
529 	if (rf->rf_type == BWI_RF_T_BCM2060) {
530 		/* TODO: 11A */
531 	} else {
532 		if (rf->rf_flags & BWI_RF_F_INITED)
533 			RF_WRITE(mac, 0x78, rf->rf_calib);
534 		else
535 			bwi_rf_init_bcm2050(mac);
536 	}
537 }
538 
539 static void
540 bwi_rf_off_11a(struct bwi_mac *mac)
541 {
542 	RF_WRITE(mac, 0x4, 0xff);
543 	RF_WRITE(mac, 0x5, 0xfb);
544 
545 	PHY_SETBITS(mac, 0x10, 0x8);
546 	PHY_SETBITS(mac, 0x11, 0x8);
547 
548 	PHY_WRITE(mac, 0x15, 0xaa00);
549 }
550 
551 static void
552 bwi_rf_off_11bg(struct bwi_mac *mac)
553 {
554 	PHY_WRITE(mac, 0x15, 0xaa00);
555 }
556 
557 static void
558 bwi_rf_off_11g_rev5(struct bwi_mac *mac)
559 {
560 	PHY_SETBITS(mac, 0x811, 0x8c);
561 	PHY_CLRBITS(mac, 0x812, 0x8c);
562 }
563 
564 static void
565 bwi_rf_work_around(struct bwi_mac *mac, u_int chan)
566 {
567 	struct bwi_softc *sc = mac->mac_sc;
568 	struct bwi_rf *rf = &mac->mac_rf;
569 
570 	if (chan == IEEE80211_CHAN_ANY) {
571 		device_printf(sc->sc_dev, "%s invalid channel!!\n", __func__);
572 		return;
573 	}
574 
575 	if (rf->rf_type != BWI_RF_T_BCM2050 || rf->rf_rev >= 6)
576 		return;
577 
578 	if (chan <= 10)
579 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan + 4));
580 	else
581 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(1));
582 	DELAY(1000);
583 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
584 }
585 
586 static __inline struct bwi_rf_lo *
587 bwi_rf_lo_find(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
588 {
589 	uint16_t rf_atten, bbp_atten;
590 	int remap_rf_atten;
591 
592 	remap_rf_atten = 1;
593 	if (tpctl == NULL) {
594 		bbp_atten = 2;
595 		rf_atten = 3;
596 	} else {
597 		if (tpctl->tp_ctrl1 == 3)
598 			remap_rf_atten = 0;
599 
600 		bbp_atten = tpctl->bbp_atten;
601 		rf_atten = tpctl->rf_atten;
602 
603 		if (bbp_atten > 6)
604 			bbp_atten = 6;
605 	}
606 
607 	if (remap_rf_atten) {
608 #define MAP_MAX	10
609 		static const uint16_t map[MAP_MAX] =
610 		{ 11, 10, 11, 12, 13, 12, 13, 12, 13, 12 };
611 
612 #if 0
613 		KASSERT(rf_atten < MAP_MAX, ("rf_atten %d", rf_atten));
614 		rf_atten = map[rf_atten];
615 #else
616 		if (rf_atten >= MAP_MAX) {
617 			rf_atten = 0;	/* XXX */
618 		} else {
619 			rf_atten = map[rf_atten];
620 		}
621 #endif
622 #undef MAP_MAX
623 	}
624 
625 	return bwi_get_rf_lo(mac, rf_atten, bbp_atten);
626 }
627 
628 void
629 bwi_rf_lo_adjust(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
630 {
631 	const struct bwi_rf_lo *lo;
632 
633 	lo = bwi_rf_lo_find(mac, tpctl);
634 	RF_LO_WRITE(mac, lo);
635 }
636 
637 static void
638 bwi_rf_lo_write(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
639 {
640 	uint16_t val;
641 
642 	val = (uint8_t)lo->ctrl_lo;
643 	val |= ((uint8_t)lo->ctrl_hi) << 8;
644 
645 	PHY_WRITE(mac, BWI_PHYR_RF_LO, val);
646 }
647 
648 static int
649 bwi_rf_gain_max_reached(struct bwi_mac *mac, int idx)
650 {
651 	PHY_FILT_SETBITS(mac, 0x812, 0xf0ff, idx << 8);
652 	PHY_FILT_SETBITS(mac, 0x15, 0xfff, 0xa000);
653 	PHY_SETBITS(mac, 0x15, 0xf000);
654 
655 	DELAY(20);
656 
657 	return (PHY_READ(mac, 0x2d) >= 0xdfc);
658 }
659 
660 /* XXX use bitmap array */
661 static __inline uint16_t
662 bitswap4(uint16_t val)
663 {
664 	uint16_t ret;
665 
666 	ret = (val & 0x8) >> 3;
667 	ret |= (val & 0x4) >> 1;
668 	ret |= (val & 0x2) << 1;
669 	ret |= (val & 0x1) << 3;
670 	return ret;
671 }
672 
673 static __inline uint16_t
674 bwi_phy812_value(struct bwi_mac *mac, uint16_t lpd)
675 {
676 	struct bwi_softc *sc = mac->mac_sc;
677 	struct bwi_phy *phy = &mac->mac_phy;
678 	struct bwi_rf *rf = &mac->mac_rf;
679 	uint16_t lo_gain, ext_lna, loop;
680 
681 	if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
682 		return 0;
683 
684 	lo_gain = rf->rf_lo_gain;
685 	if (rf->rf_rev == 8)
686 		lo_gain += 0x3e;
687 	else
688 		lo_gain += 0x26;
689 
690 	if (lo_gain >= 0x46) {
691 		lo_gain -= 0x46;
692 		ext_lna = 0x3000;
693 	} else if (lo_gain >= 0x3a) {
694 		lo_gain -= 0x3a;
695 		ext_lna = 0x1000;
696 	} else if (lo_gain >= 0x2e) {
697 		lo_gain -= 0x2e;
698 		ext_lna = 0x2000;
699 	} else {
700 		lo_gain -= 0x10;
701 		ext_lna = 0;
702 	}
703 
704 	for (loop = 0; loop < 16; ++loop) {
705 		lo_gain -= (6 * loop);
706 		if (lo_gain < 6)
707 			break;
708 	}
709 
710 	if (phy->phy_rev >= 7 && (sc->sc_card_flags & BWI_CARD_F_EXT_LNA)) {
711 		if (ext_lna)
712 			ext_lna |= 0x8000;
713 		ext_lna |= (loop << 8);
714 		switch (lpd) {
715 		case 0x011:
716 			return 0x8f92;
717 		case 0x001:
718 			return (0x8092 | ext_lna);
719 		case 0x101:
720 			return (0x2092 | ext_lna);
721 		case 0x100:
722 			return (0x2093 | ext_lna);
723 		default:
724 			panic("unsupported lpd\n");
725 		}
726 	} else {
727 		ext_lna |= (loop << 8);
728 		switch (lpd) {
729 		case 0x011:
730 			return 0xf92;
731 		case 0x001:
732 		case 0x101:
733 			return (0x92 | ext_lna);
734 		case 0x100:
735 			return (0x93 | ext_lna);
736 		default:
737 			panic("unsupported lpd\n");
738 		}
739 	}
740 
741 	panic("never reached\n");
742 	return 0;
743 }
744 
745 void
746 bwi_rf_init_bcm2050(struct bwi_mac *mac)
747 {
748 #define SAVE_RF_MAX		3
749 #define SAVE_PHY_COMM_MAX	4
750 #define SAVE_PHY_11G_MAX	6
751 
752 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
753 	{ 0x0043, 0x0051, 0x0052 };
754 	static const uint16_t save_phy_regs_comm[SAVE_PHY_COMM_MAX] =
755 	{ 0x0015, 0x005a, 0x0059, 0x0058 };
756 	static const uint16_t save_phy_regs_11g[SAVE_PHY_11G_MAX] =
757 	{ 0x0811, 0x0812, 0x0814, 0x0815, 0x0429, 0x0802 };
758 
759 	uint16_t save_rf[SAVE_RF_MAX];
760 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
761 	uint16_t save_phy_11g[SAVE_PHY_11G_MAX];
762 	uint16_t phyr_35, phyr_30 = 0, rfr_78, phyr_80f = 0, phyr_810 = 0;
763 	uint16_t bphy_ctrl = 0, bbp_atten, rf_chan_ex;
764 	uint16_t phy812_val;
765 	uint16_t calib;
766 	uint32_t test_lim, test;
767 	struct bwi_softc *sc = mac->mac_sc;
768 	struct bwi_phy *phy = &mac->mac_phy;
769 	struct bwi_rf *rf = &mac->mac_rf;
770 	int i;
771 
772 	/*
773 	 * Save registers for later restoring
774 	 */
775 	for (i = 0; i < SAVE_RF_MAX; ++i)
776 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
777 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
778 		save_phy_comm[i] = PHY_READ(mac, save_phy_regs_comm[i]);
779 
780 	if (phy->phy_mode == IEEE80211_MODE_11B) {
781 		phyr_30 = PHY_READ(mac, 0x30);
782 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
783 
784 		PHY_WRITE(mac, 0x30, 0xff);
785 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x3f3f);
786 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
787 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
788 			save_phy_11g[i] =
789 				PHY_READ(mac, save_phy_regs_11g[i]);
790 		}
791 
792 		PHY_SETBITS(mac, 0x814, 0x3);
793 		PHY_CLRBITS(mac, 0x815, 0x3);
794 		PHY_CLRBITS(mac, 0x429, 0x8000);
795 		PHY_CLRBITS(mac, 0x802, 0x3);
796 
797 		phyr_80f = PHY_READ(mac, 0x80f);
798 		phyr_810 = PHY_READ(mac, 0x810);
799 
800 		if (phy->phy_rev >= 3)
801 			PHY_WRITE(mac, 0x80f, 0xc020);
802 		else
803 			PHY_WRITE(mac, 0x80f, 0x8020);
804 		PHY_WRITE(mac, 0x810, 0);
805 
806 		phy812_val = bwi_phy812_value(mac, 0x011);
807 		PHY_WRITE(mac, 0x812, phy812_val);
808 		if (phy->phy_rev < 7 ||
809 		    (sc->sc_card_flags & BWI_CARD_F_EXT_LNA) == 0)
810 			PHY_WRITE(mac, 0x811, 0x1b3);
811 		else
812 			PHY_WRITE(mac, 0x811, 0x9b3);
813 	}
814 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
815 
816 	phyr_35 = PHY_READ(mac, 0x35);
817 	PHY_CLRBITS(mac, 0x35, 0x80);
818 
819 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
820 	rf_chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
821 
822 	if (phy->phy_version == 0) {
823 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
824 	} else {
825 		if (phy->phy_version >= 2)
826 			PHY_FILT_SETBITS(mac, 0x3, 0xffbf, 0x40);
827 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
828 	}
829 
830 	calib = bwi_rf_calibval(mac);
831 
832 	if (phy->phy_mode == IEEE80211_MODE_11B)
833 		RF_WRITE(mac, 0x78, 0x26);
834 
835 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
836 		phy812_val = bwi_phy812_value(mac, 0x011);
837 		PHY_WRITE(mac, 0x812, phy812_val);
838 	}
839 
840 	PHY_WRITE(mac, 0x15, 0xbfaf);
841 	PHY_WRITE(mac, 0x2b, 0x1403);
842 
843 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
844 		phy812_val = bwi_phy812_value(mac, 0x001);
845 		PHY_WRITE(mac, 0x812, phy812_val);
846 	}
847 
848 	PHY_WRITE(mac, 0x15, 0xbfa0);
849 
850 	RF_SETBITS(mac, 0x51, 0x4);
851 	if (rf->rf_rev == 8) {
852 		RF_WRITE(mac, 0x43, 0x1f);
853 	} else {
854 		RF_WRITE(mac, 0x52, 0);
855 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
856 	}
857 
858 	test_lim = 0;
859 	PHY_WRITE(mac, 0x58, 0);
860 	for (i = 0; i < 16; ++i) {
861 		PHY_WRITE(mac, 0x5a, 0x480);
862 		PHY_WRITE(mac, 0x59, 0xc810);
863 
864 		PHY_WRITE(mac, 0x58, 0xd);
865 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
866 			phy812_val = bwi_phy812_value(mac, 0x101);
867 			PHY_WRITE(mac, 0x812, phy812_val);
868 		}
869 		PHY_WRITE(mac, 0x15, 0xafb0);
870 		DELAY(10);
871 
872 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
873 			phy812_val = bwi_phy812_value(mac, 0x101);
874 			PHY_WRITE(mac, 0x812, phy812_val);
875 		}
876 		PHY_WRITE(mac, 0x15, 0xefb0);
877 		DELAY(10);
878 
879 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
880 			phy812_val = bwi_phy812_value(mac, 0x100);
881 			PHY_WRITE(mac, 0x812, phy812_val);
882 		}
883 		PHY_WRITE(mac, 0x15, 0xfff0);
884 		DELAY(20);
885 
886 		test_lim += PHY_READ(mac, 0x2d);
887 
888 		PHY_WRITE(mac, 0x58, 0);
889 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
890 			phy812_val = bwi_phy812_value(mac, 0x101);
891 			PHY_WRITE(mac, 0x812, phy812_val);
892 		}
893 		PHY_WRITE(mac, 0x15, 0xafb0);
894 	}
895 	++test_lim;
896 	test_lim >>= 9;
897 
898 	DELAY(10);
899 
900 	test = 0;
901 	PHY_WRITE(mac, 0x58, 0);
902 	for (i = 0; i < 16; ++i) {
903 		int j;
904 
905 		rfr_78 = (bitswap4(i) << 1) | 0x20;
906 		RF_WRITE(mac, 0x78, rfr_78);
907 		DELAY(10);
908 
909 		/* NB: This block is slight different than the above one */
910 		for (j = 0; j < 16; ++j) {
911 			PHY_WRITE(mac, 0x5a, 0xd80);
912 			PHY_WRITE(mac, 0x59, 0xc810);
913 
914 			PHY_WRITE(mac, 0x58, 0xd);
915 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
916 			    phy->phy_rev >= 2) {
917 				phy812_val = bwi_phy812_value(mac, 0x101);
918 				PHY_WRITE(mac, 0x812, phy812_val);
919 			}
920 			PHY_WRITE(mac, 0x15, 0xafb0);
921 			DELAY(10);
922 
923 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
924 			    phy->phy_rev >= 2) {
925 				phy812_val = bwi_phy812_value(mac, 0x101);
926 				PHY_WRITE(mac, 0x812, phy812_val);
927 			}
928 			PHY_WRITE(mac, 0x15, 0xefb0);
929 			DELAY(10);
930 
931 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
932 			    phy->phy_rev >= 2) {
933 				phy812_val = bwi_phy812_value(mac, 0x100);
934 				PHY_WRITE(mac, 0x812, phy812_val);
935 			}
936 			PHY_WRITE(mac, 0x15, 0xfff0);
937 			DELAY(10);
938 
939 			test += PHY_READ(mac, 0x2d);
940 
941 			PHY_WRITE(mac, 0x58, 0);
942 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
943 			    phy->phy_rev >= 2) {
944 				phy812_val = bwi_phy812_value(mac, 0x101);
945 				PHY_WRITE(mac, 0x812, phy812_val);
946 			}
947 			PHY_WRITE(mac, 0x15, 0xafb0);
948 		}
949 
950 		++test;
951 		test >>= 8;
952 
953 		if (test > test_lim)
954 			break;
955 	}
956 	if (i > 15)
957 		rf->rf_calib = rfr_78;
958 	else
959 		rf->rf_calib = calib;
960 	if (rf->rf_calib != 0xffff) {
961 		DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT,
962 			"RF calibration value: 0x%04x\n", rf->rf_calib);
963 		rf->rf_flags |= BWI_RF_F_INITED;
964 	}
965 
966 	/*
967 	 * Restore trashes registers
968 	 */
969 	PHY_WRITE(mac, save_phy_regs_comm[0], save_phy_comm[0]);
970 
971 	for (i = 0; i < SAVE_RF_MAX; ++i) {
972 		int pos = (i + 1) % SAVE_RF_MAX;
973 
974 		RF_WRITE(mac, save_rf_regs[pos], save_rf[pos]);
975 	}
976 	for (i = 1; i < SAVE_PHY_COMM_MAX; ++i)
977 		PHY_WRITE(mac, save_phy_regs_comm[i], save_phy_comm[i]);
978 
979 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
980 	if (phy->phy_version != 0)
981 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, rf_chan_ex);
982 
983 	PHY_WRITE(mac, 0x35, phyr_35);
984 	bwi_rf_work_around(mac, rf->rf_curchan);
985 
986 	if (phy->phy_mode == IEEE80211_MODE_11B) {
987 		PHY_WRITE(mac, 0x30, phyr_30);
988 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
989 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
990 		/* XXX Spec only says when PHY is linked (gmode) */
991 		CSR_CLRBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
992 
993 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
994 			PHY_WRITE(mac, save_phy_regs_11g[i],
995 				  save_phy_11g[i]);
996 		}
997 
998 		PHY_WRITE(mac, 0x80f, phyr_80f);
999 		PHY_WRITE(mac, 0x810, phyr_810);
1000 	}
1001 
1002 #undef SAVE_PHY_11G_MAX
1003 #undef SAVE_PHY_COMM_MAX
1004 #undef SAVE_RF_MAX
1005 }
1006 
1007 static uint16_t
1008 bwi_rf_calibval(struct bwi_mac *mac)
1009 {
1010 	/* http://bcm-specs.sipsolutions.net/RCCTable */
1011 	static const uint16_t rf_calibvals[] = {
1012 		0x2, 0x3, 0x1, 0xf, 0x6, 0x7, 0x5, 0xf,
1013 		0xa, 0xb, 0x9, 0xf, 0xe, 0xf, 0xd, 0xf
1014 	};
1015 	uint16_t val, calib;
1016 	int idx;
1017 
1018 	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
1019 	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
1020 	KASSERT(idx < (int)(sizeof(rf_calibvals) / sizeof(rf_calibvals[0])),
1021 	    ("idx %d", idx));
1022 
1023 	calib = rf_calibvals[idx] << 1;
1024 	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
1025 		calib |= 0x1;
1026 	calib |= 0x20;
1027 
1028 	return calib;
1029 }
1030 
1031 static __inline int32_t
1032 _bwi_adjust_devide(int32_t num, int32_t den)
1033 {
1034 	if (num < 0)
1035 		return (num / den);
1036 	else
1037 		return (num + den / 2) / den;
1038 }
1039 
1040 /*
1041  * http://bcm-specs.sipsolutions.net/TSSI_to_DBM_Table
1042  * "calculating table entries"
1043  */
1044 static int
1045 bwi_rf_calc_txpower(int8_t *txpwr, uint8_t idx, const int16_t pa_params[])
1046 {
1047 	int32_t m1, m2, f, dbm;
1048 	int i;
1049 
1050 	m1 = _bwi_adjust_devide(16 * pa_params[0] + idx * pa_params[1], 32);
1051 	m2 = imax(_bwi_adjust_devide(32768 + idx * pa_params[2], 256), 1);
1052 
1053 #define ITER_MAX	16
1054 
1055 	f = 256;
1056 	for (i = 0; i < ITER_MAX; ++i) {
1057 		int32_t q, d;
1058 
1059 		q = _bwi_adjust_devide(
1060 			f * 4096 - _bwi_adjust_devide(m2 * f, 16) * f, 2048);
1061 		d = abs(q - f);
1062 		f = q;
1063 
1064 		if (d < 2)
1065 			break;
1066 	}
1067 	if (i == ITER_MAX)
1068 		return EINVAL;
1069 
1070 #undef ITER_MAX
1071 
1072 	dbm = _bwi_adjust_devide(m1 * f, 8192);
1073 	if (dbm < -127)
1074 		dbm = -127;
1075 	else if (dbm > 128)
1076 		dbm = 128;
1077 
1078 	*txpwr = dbm;
1079 	return 0;
1080 }
1081 
1082 int
1083 bwi_rf_map_txpower(struct bwi_mac *mac)
1084 {
1085 	struct bwi_softc *sc = mac->mac_sc;
1086 	struct bwi_rf *rf = &mac->mac_rf;
1087 	struct bwi_phy *phy = &mac->mac_phy;
1088 	uint16_t sprom_ofs, val, mask;
1089 	int16_t pa_params[3];
1090 	int error = 0, i, ant_gain, reg_txpower_max;
1091 
1092 	/*
1093 	 * Find out max TX power
1094 	 */
1095 	val = bwi_read_sprom(sc, BWI_SPROM_MAX_TXPWR);
1096 	if (phy->phy_mode == IEEE80211_MODE_11A) {
1097 		rf->rf_txpower_max = __SHIFTOUT(val,
1098 				     BWI_SPROM_MAX_TXPWR_MASK_11A);
1099 	} else {
1100 		rf->rf_txpower_max = __SHIFTOUT(val,
1101 				     BWI_SPROM_MAX_TXPWR_MASK_11BG);
1102 
1103 		if ((sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) &&
1104 		    phy->phy_mode == IEEE80211_MODE_11G)
1105 			rf->rf_txpower_max -= 3;
1106 	}
1107 	if (rf->rf_txpower_max <= 0) {
1108 		device_printf(sc->sc_dev, "invalid max txpower in sprom\n");
1109 		rf->rf_txpower_max = 74;
1110 	}
1111 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1112 		"max txpower from sprom: %d dBm\n", rf->rf_txpower_max);
1113 
1114 	/*
1115 	 * Find out region/domain max TX power, which is adjusted
1116 	 * by antenna gain and 1.5 dBm fluctuation as mentioned
1117 	 * in v3 spec.
1118 	 */
1119 	val = bwi_read_sprom(sc, BWI_SPROM_ANT_GAIN);
1120 	if (phy->phy_mode == IEEE80211_MODE_11A)
1121 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11A);
1122 	else
1123 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11BG);
1124 	if (ant_gain == 0xff) {
1125 		device_printf(sc->sc_dev, "invalid antenna gain in sprom\n");
1126 		ant_gain = 2;
1127 	}
1128 	ant_gain *= 4;
1129 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1130 		"ant gain %d dBm\n", ant_gain);
1131 
1132 	reg_txpower_max = 90 - ant_gain - 6;	/* XXX magic number */
1133 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1134 		"region/domain max txpower %d dBm\n", reg_txpower_max);
1135 
1136 	/*
1137 	 * Force max TX power within region/domain TX power limit
1138 	 */
1139 	if (rf->rf_txpower_max > reg_txpower_max)
1140 		rf->rf_txpower_max = reg_txpower_max;
1141 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1142 		"max txpower %d dBm\n", rf->rf_txpower_max);
1143 
1144 	/*
1145 	 * Create TSSI to TX power mapping
1146 	 */
1147 
1148 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301 &&
1149 	    rf->rf_type != BWI_RF_T_BCM2050) {
1150 		rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1151 		bcopy(bwi_txpower_map_11b, rf->rf_txpower_map0,
1152 		      sizeof(rf->rf_txpower_map0));
1153 		goto back;
1154 	}
1155 
1156 #define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
1157 #define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
1158 
1159 	/*
1160 	 * Extract PA parameters
1161 	 */
1162 	if (phy->phy_mode == IEEE80211_MODE_11A)
1163 		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
1164 	else
1165 		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
1166 	for (i = 0; i < N(pa_params); ++i)
1167 		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
1168 
1169 	for (i = 0; i < N(pa_params); ++i) {
1170 		/*
1171 		 * If one of the PA parameters from SPROM is not valid,
1172 		 * fall back to the default values, if there are any.
1173 		 */
1174 		if (!IS_VALID_PA_PARAM(pa_params[i])) {
1175 			const int8_t *txpower_map;
1176 
1177 			if (phy->phy_mode == IEEE80211_MODE_11A) {
1178 				device_printf(sc->sc_dev,
1179 					  "no tssi2dbm table for 11a PHY\n");
1180 				return ENXIO;
1181 			}
1182 
1183 			if (phy->phy_mode == IEEE80211_MODE_11G) {
1184 				DPRINTF(sc,
1185 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1186 				"%s\n", "use default 11g TSSI map");
1187 				txpower_map = bwi_txpower_map_11g;
1188 			} else {
1189 				DPRINTF(sc,
1190 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1191 				"%s\n", "use default 11b TSSI map");
1192 				txpower_map = bwi_txpower_map_11b;
1193 			}
1194 
1195 			rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1196 			bcopy(txpower_map, rf->rf_txpower_map0,
1197 			      sizeof(rf->rf_txpower_map0));
1198 			goto back;
1199 		}
1200 	}
1201 
1202 #undef N
1203 
1204 	/*
1205 	 * All of the PA parameters from SPROM are valid.
1206 	 */
1207 
1208 	/*
1209 	 * Extract idle TSSI from SPROM.
1210 	 */
1211 	val = bwi_read_sprom(sc, BWI_SPROM_IDLE_TSSI);
1212 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1213 		"sprom idle tssi: 0x%04x\n", val);
1214 
1215 	if (phy->phy_mode == IEEE80211_MODE_11A)
1216 		mask = BWI_SPROM_IDLE_TSSI_MASK_11A;
1217 	else
1218 		mask = BWI_SPROM_IDLE_TSSI_MASK_11BG;
1219 
1220 	rf->rf_idle_tssi0 = (int)__SHIFTOUT(val, mask);
1221 	if (!IS_VALID_PA_PARAM(rf->rf_idle_tssi0))
1222 		rf->rf_idle_tssi0 = 62;
1223 
1224 #undef IS_VALID_PA_PARAM
1225 
1226 	/*
1227 	 * Calculate TX power map, which is indexed by TSSI
1228 	 */
1229 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1230 		"%s\n", "TSSI-TX power map:");
1231 	for (i = 0; i < BWI_TSSI_MAX; ++i) {
1232 		error = bwi_rf_calc_txpower(&rf->rf_txpower_map0[i], i,
1233 					    pa_params);
1234 		if (error) {
1235 			device_printf(sc->sc_dev,
1236 				  "bwi_rf_calc_txpower failed\n");
1237 			break;
1238 		}
1239 
1240 #ifdef BWI_DEBUG
1241 		if (i != 0 && i % 8 == 0) {
1242 			_DPRINTF(sc,
1243 			BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1244 			"%s\n", "");
1245 		}
1246 #endif
1247 		_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1248 			 "%d ", rf->rf_txpower_map0[i]);
1249 	}
1250 	_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1251 		 "%s\n", "");
1252 back:
1253 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1254 		"idle tssi0: %d\n", rf->rf_idle_tssi0);
1255 	return error;
1256 }
1257 
1258 static void
1259 bwi_rf_lo_update_11g(struct bwi_mac *mac)
1260 {
1261 	struct bwi_softc *sc = mac->mac_sc;
1262 	struct ifnet *ifp = sc->sc_ifp;
1263 	struct bwi_rf *rf = &mac->mac_rf;
1264 	struct bwi_phy *phy = &mac->mac_phy;
1265 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1266 	struct rf_saveregs regs;
1267 	uint16_t ant_div, chan_ex;
1268 	uint8_t devi_ctrl;
1269 	u_int orig_chan;
1270 
1271 	/*
1272 	 * Save RF/PHY registers for later restoration
1273 	 */
1274 	orig_chan = rf->rf_curchan;
1275 	bzero(&regs, sizeof(regs));
1276 
1277 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1278 		SAVE_PHY_REG(mac, &regs, 429);
1279 		SAVE_PHY_REG(mac, &regs, 802);
1280 
1281 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1282 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1283 	}
1284 
1285 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1286 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div | 0x8000);
1287 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1288 
1289 	SAVE_PHY_REG(mac, &regs, 15);
1290 	SAVE_PHY_REG(mac, &regs, 2a);
1291 	SAVE_PHY_REG(mac, &regs, 35);
1292 	SAVE_PHY_REG(mac, &regs, 60);
1293 	SAVE_RF_REG(mac, &regs, 43);
1294 	SAVE_RF_REG(mac, &regs, 7a);
1295 	SAVE_RF_REG(mac, &regs, 52);
1296 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1297 		SAVE_PHY_REG(mac, &regs, 811);
1298 		SAVE_PHY_REG(mac, &regs, 812);
1299 		SAVE_PHY_REG(mac, &regs, 814);
1300 		SAVE_PHY_REG(mac, &regs, 815);
1301 	}
1302 
1303 	/* Force to channel 6 */
1304 	bwi_rf_set_chan(mac, 6, 0);
1305 
1306 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1307 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1308 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1309 		bwi_mac_dummy_xmit(mac);
1310 	}
1311 	RF_WRITE(mac, 0x43, 0x6);
1312 
1313 	bwi_phy_set_bbp_atten(mac, 2);
1314 
1315 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0);
1316 
1317 	PHY_WRITE(mac, 0x2e, 0x7f);
1318 	PHY_WRITE(mac, 0x80f, 0x78);
1319 	PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
1320 	RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
1321 	PHY_WRITE(mac, 0x2b, 0x203);
1322 	PHY_WRITE(mac, 0x2a, 0x8a3);
1323 
1324 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1325 		PHY_WRITE(mac, 0x814, regs.phy_814 | 0x3);
1326 		PHY_WRITE(mac, 0x815, regs.phy_815 & 0xfffc);
1327 		PHY_WRITE(mac, 0x811, 0x1b3);
1328 		PHY_WRITE(mac, 0x812, 0xb2);
1329 	}
1330 
1331 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1332 		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
1333 	PHY_WRITE(mac, 0x80f, 0x8078);
1334 
1335 	/*
1336 	 * Measure all RF LO
1337 	 */
1338 	devi_ctrl = _bwi_rf_lo_update_11g(mac, regs.rf_7a);
1339 
1340 	/*
1341 	 * Restore saved RF/PHY registers
1342 	 */
1343 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1344 		PHY_WRITE(mac, 0x15, 0xe300);
1345 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa0);
1346 		DELAY(5);
1347 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa2);
1348 		DELAY(2);
1349 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa3);
1350 	} else {
1351 		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
1352 	}
1353 
1354 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1355 		tpctl = NULL;
1356 	bwi_rf_lo_adjust(mac, tpctl);
1357 
1358 	PHY_WRITE(mac, 0x2e, 0x807f);
1359 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1360 		PHY_WRITE(mac, 0x2f, 0x202);
1361 	else
1362 		PHY_WRITE(mac, 0x2f, 0x101);
1363 
1364 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1365 
1366 	RESTORE_PHY_REG(mac, &regs, 15);
1367 	RESTORE_PHY_REG(mac, &regs, 2a);
1368 	RESTORE_PHY_REG(mac, &regs, 35);
1369 	RESTORE_PHY_REG(mac, &regs, 60);
1370 
1371 	RESTORE_RF_REG(mac, &regs, 43);
1372 	RESTORE_RF_REG(mac, &regs, 7a);
1373 
1374 	regs.rf_52 &= 0xf0;
1375 	regs.rf_52 |= (RF_READ(mac, 0x52) & 0xf);
1376 	RF_WRITE(mac, 0x52, regs.rf_52);
1377 
1378 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1379 
1380 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1381 		RESTORE_PHY_REG(mac, &regs, 811);
1382 		RESTORE_PHY_REG(mac, &regs, 812);
1383 		RESTORE_PHY_REG(mac, &regs, 814);
1384 		RESTORE_PHY_REG(mac, &regs, 815);
1385 		RESTORE_PHY_REG(mac, &regs, 429);
1386 		RESTORE_PHY_REG(mac, &regs, 802);
1387 	}
1388 
1389 	bwi_rf_set_chan(mac, orig_chan, 1);
1390 }
1391 
1392 static uint32_t
1393 bwi_rf_lo_devi_measure(struct bwi_mac *mac, uint16_t ctrl)
1394 {
1395 	struct bwi_phy *phy = &mac->mac_phy;
1396 	uint32_t devi = 0;
1397 	int i;
1398 
1399 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1400 		ctrl <<= 8;
1401 
1402 	for (i = 0; i < 8; ++i) {
1403 		if (phy->phy_flags & BWI_PHY_F_LINKED) {
1404 			PHY_WRITE(mac, 0x15, 0xe300);
1405 			PHY_WRITE(mac, 0x812, ctrl | 0xb0);
1406 			DELAY(5);
1407 			PHY_WRITE(mac, 0x812, ctrl | 0xb2);
1408 			DELAY(2);
1409 			PHY_WRITE(mac, 0x812, ctrl | 0xb3);
1410 			DELAY(4);
1411 			PHY_WRITE(mac, 0x15, 0xf300);
1412 		} else {
1413 			PHY_WRITE(mac, 0x15, ctrl | 0xefa0);
1414 			DELAY(2);
1415 			PHY_WRITE(mac, 0x15, ctrl | 0xefe0);
1416 			DELAY(4);
1417 			PHY_WRITE(mac, 0x15, ctrl | 0xffe0);
1418 		}
1419 		DELAY(8);
1420 		devi += PHY_READ(mac, 0x2d);
1421 	}
1422 	return devi;
1423 }
1424 
1425 static uint16_t
1426 bwi_rf_get_tp_ctrl2(struct bwi_mac *mac)
1427 {
1428 	uint32_t devi_min;
1429 	uint16_t tp_ctrl2 = 0;
1430 	int i;
1431 
1432 	RF_WRITE(mac, 0x52, 0);
1433 	DELAY(10);
1434 	devi_min = bwi_rf_lo_devi_measure(mac, 0);
1435 
1436 	for (i = 0; i < 16; ++i) {
1437 		uint32_t devi;
1438 
1439 		RF_WRITE(mac, 0x52, i);
1440 		DELAY(10);
1441 		devi = bwi_rf_lo_devi_measure(mac, 0);
1442 
1443 		if (devi < devi_min) {
1444 			devi_min = devi;
1445 			tp_ctrl2 = i;
1446 		}
1447 	}
1448 	return tp_ctrl2;
1449 }
1450 
1451 static uint8_t
1452 _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
1453 {
1454 #define RF_ATTEN_LISTSZ	14
1455 #define BBP_ATTEN_MAX	4	/* half */
1456 
1457 	static const int rf_atten_list[RF_ATTEN_LISTSZ] =
1458 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 1, 2, 3, 4 };
1459 	static const int rf_atten_init_list[RF_ATTEN_LISTSZ] =
1460         { 0, 3, 1, 5, 7, 3, 2, 0, 4, 6, -1, -1, -1, -1 };
1461 	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
1462 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
1463 
1464 	struct ifnet *ifp = mac->mac_sc->sc_ifp;
1465 	struct bwi_rf_lo lo_save, *lo;
1466 	uint8_t devi_ctrl = 0;
1467 	int idx, adj_rf7a = 0;
1468 
1469 	bzero(&lo_save, sizeof(lo_save));
1470 	for (idx = 0; idx < RF_ATTEN_LISTSZ; ++idx) {
1471 		int init_rf_atten = rf_atten_init_list[idx];
1472 		int rf_atten = rf_atten_list[idx];
1473 		int bbp_atten;
1474 
1475 		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
1476 			uint16_t tp_ctrl2, rf7a;
1477 
1478 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1479 				if (idx == 0) {
1480 					bzero(&lo_save, sizeof(lo_save));
1481 				} else if (init_rf_atten < 0) {
1482 					lo = bwi_get_rf_lo(mac,
1483 						rf_atten, 2 * bbp_atten);
1484 					bcopy(lo, &lo_save, sizeof(lo_save));
1485 				} else {
1486 					lo = bwi_get_rf_lo(mac,
1487 						init_rf_atten, 0);
1488 					bcopy(lo, &lo_save, sizeof(lo_save));
1489 				}
1490 
1491 				devi_ctrl = 0;
1492 				adj_rf7a = 0;
1493 
1494 				/*
1495 				 * XXX
1496 				 * Linux driver overflows 'val'
1497 				 */
1498 				if (init_rf_atten >= 0) {
1499 					int val;
1500 
1501 					val = rf_atten * 2 + bbp_atten;
1502 					if (val > 14) {
1503 						adj_rf7a = 1;
1504 						if (val > 17)
1505 							devi_ctrl = 1;
1506 						if (val > 19)
1507 							devi_ctrl = 2;
1508 					}
1509 				}
1510 			} else {
1511 				lo = bwi_get_rf_lo(mac,
1512 					rf_atten, 2 * bbp_atten);
1513 				if (!bwi_rf_lo_isused(mac, lo))
1514 					continue;
1515 				bcopy(lo, &lo_save, sizeof(lo_save));
1516 
1517 				devi_ctrl = 3;
1518 				adj_rf7a = 0;
1519 			}
1520 
1521 			RF_WRITE(mac, BWI_RFR_ATTEN, rf_atten);
1522 
1523 			tp_ctrl2 = mac->mac_tpctl.tp_ctrl2;
1524 			if (init_rf_atten < 0)
1525 				tp_ctrl2 |= (3 << 4);
1526 			RF_WRITE(mac, BWI_RFR_TXPWR, tp_ctrl2);
1527 
1528 			DELAY(10);
1529 
1530 			bwi_phy_set_bbp_atten(mac, bbp_atten * 2);
1531 
1532 			rf7a = orig_rf7a & 0xfff0;
1533 			if (adj_rf7a)
1534 				rf7a |= 0x8;
1535 			RF_WRITE(mac, 0x7a, rf7a);
1536 
1537 			lo = bwi_get_rf_lo(mac,
1538 				rf_lo_measure_order[idx], bbp_atten * 2);
1539 			bwi_rf_lo_measure_11g(mac, &lo_save, lo, devi_ctrl);
1540 		}
1541 	}
1542 	return devi_ctrl;
1543 
1544 #undef RF_ATTEN_LISTSZ
1545 #undef BBP_ATTEN_MAX
1546 }
1547 
1548 static void
1549 bwi_rf_lo_measure_11g(struct bwi_mac *mac, const struct bwi_rf_lo *src_lo,
1550 	struct bwi_rf_lo *dst_lo, uint8_t devi_ctrl)
1551 {
1552 #define LO_ADJUST_MIN	1
1553 #define LO_ADJUST_MAX	8
1554 #define LO_ADJUST(hi, lo)	{ .ctrl_hi = hi, .ctrl_lo = lo }
1555 	static const struct bwi_rf_lo rf_lo_adjust[LO_ADJUST_MAX] = {
1556 		LO_ADJUST(1,	1),
1557 		LO_ADJUST(1,	0),
1558 		LO_ADJUST(1,	-1),
1559 		LO_ADJUST(0,	-1),
1560 		LO_ADJUST(-1,	-1),
1561 		LO_ADJUST(-1,	0),
1562 		LO_ADJUST(-1,	1),
1563 		LO_ADJUST(0,	1)
1564 	};
1565 #undef LO_ADJUST
1566 
1567 	struct bwi_rf_lo lo_min;
1568 	uint32_t devi_min;
1569 	int found, loop_count, adjust_state;
1570 
1571 	bcopy(src_lo, &lo_min, sizeof(lo_min));
1572 	RF_LO_WRITE(mac, &lo_min);
1573 	devi_min = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1574 
1575 	loop_count = 12;	/* XXX */
1576 	adjust_state = 0;
1577 	do {
1578 		struct bwi_rf_lo lo_base;
1579 		int i, fin;
1580 
1581 		found = 0;
1582 		if (adjust_state == 0) {
1583 			i = LO_ADJUST_MIN;
1584 			fin = LO_ADJUST_MAX;
1585 		} else if (adjust_state % 2 == 0) {
1586 			i = adjust_state - 1;
1587 			fin = adjust_state + 1;
1588 		} else {
1589 			i = adjust_state - 2;
1590 			fin = adjust_state + 2;
1591 		}
1592 
1593 		if (i < LO_ADJUST_MIN)
1594 			i += LO_ADJUST_MAX;
1595 		KASSERT(i <= LO_ADJUST_MAX && i >= LO_ADJUST_MIN, ("i %d", i));
1596 
1597 		if (fin > LO_ADJUST_MAX)
1598 			fin -= LO_ADJUST_MAX;
1599 		KASSERT(fin <= LO_ADJUST_MAX && fin >= LO_ADJUST_MIN,
1600 		    ("fin %d", fin));
1601 
1602 		bcopy(&lo_min, &lo_base, sizeof(lo_base));
1603 		for (;;) {
1604 			struct bwi_rf_lo lo;
1605 
1606 			lo.ctrl_hi = lo_base.ctrl_hi +
1607 				rf_lo_adjust[i - 1].ctrl_hi;
1608 			lo.ctrl_lo = lo_base.ctrl_lo +
1609 				rf_lo_adjust[i - 1].ctrl_lo;
1610 
1611 			if (abs(lo.ctrl_lo) < 9 && abs(lo.ctrl_hi) < 9) {
1612 				uint32_t devi;
1613 
1614 				RF_LO_WRITE(mac, &lo);
1615 				devi = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1616 				if (devi < devi_min) {
1617 					devi_min = devi;
1618 					adjust_state = i;
1619 					found = 1;
1620 					bcopy(&lo, &lo_min, sizeof(lo_min));
1621 				}
1622 			}
1623 			if (i == fin)
1624 				break;
1625 			if (i == LO_ADJUST_MAX)
1626 				i = LO_ADJUST_MIN;
1627 			else
1628 				++i;
1629 		}
1630 	} while (loop_count-- && found);
1631 
1632 	bcopy(&lo_min, dst_lo, sizeof(*dst_lo));
1633 
1634 #undef LO_ADJUST_MIN
1635 #undef LO_ADJUST_MAX
1636 }
1637 
1638 static void
1639 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *mac)
1640 {
1641 #define SAVE_RF_MAX	3
1642 #define SAVE_PHY_MAX	8
1643 
1644 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1645 	{ 0x7a, 0x52, 0x43 };
1646 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] =
1647 	{ 0x30, 0x26, 0x15, 0x2a, 0x20, 0x5a, 0x59, 0x58 };
1648 
1649 	struct bwi_softc *sc = mac->mac_sc;
1650 	struct bwi_rf *rf = &mac->mac_rf;
1651 	struct bwi_phy *phy = &mac->mac_phy;
1652 	uint16_t save_rf[SAVE_RF_MAX];
1653 	uint16_t save_phy[SAVE_PHY_MAX];
1654 	uint16_t ant_div, bbp_atten, chan_ex;
1655 	int16_t nrssi[2];
1656 	int i;
1657 
1658 	/*
1659 	 * Save RF/PHY registers for later restoration
1660 	 */
1661 	for (i = 0; i < SAVE_RF_MAX; ++i)
1662 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1663 	for (i = 0; i < SAVE_PHY_MAX; ++i)
1664 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
1665 
1666 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1667 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1668 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1669 
1670 	/*
1671 	 * Calculate nrssi0
1672 	 */
1673 	if (phy->phy_rev >= 5)
1674 		RF_CLRBITS(mac, 0x7a, 0xff80);
1675 	else
1676 		RF_CLRBITS(mac, 0x7a, 0xfff0);
1677 	PHY_WRITE(mac, 0x30, 0xff);
1678 
1679 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x7f7f);
1680 
1681 	PHY_WRITE(mac, 0x26, 0);
1682 	PHY_SETBITS(mac, 0x15, 0x20);
1683 	PHY_WRITE(mac, 0x2a, 0x8a3);
1684 	RF_SETBITS(mac, 0x7a, 0x80);
1685 
1686 	nrssi[0] = (int16_t)PHY_READ(mac, 0x27);
1687 
1688 	/*
1689 	 * Calculate nrssi1
1690 	 */
1691 	RF_CLRBITS(mac, 0x7a, 0xff80);
1692 	if (phy->phy_version >= 2)
1693 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x40);
1694 	else if (phy->phy_version == 0)
1695 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
1696 	else
1697 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0xdfff);
1698 
1699 	PHY_WRITE(mac, 0x20, 0x3f3f);
1700 	PHY_WRITE(mac, 0x15, 0xf330);
1701 
1702 	RF_WRITE(mac, 0x5a, 0x60);
1703 	RF_CLRBITS(mac, 0x43, 0xff0f);
1704 
1705 	PHY_WRITE(mac, 0x5a, 0x480);
1706 	PHY_WRITE(mac, 0x59, 0x810);
1707 	PHY_WRITE(mac, 0x58, 0xd);
1708 
1709 	DELAY(20);
1710 
1711 	nrssi[1] = (int16_t)PHY_READ(mac, 0x27);
1712 
1713 	/*
1714 	 * Restore saved RF/PHY registers
1715 	 */
1716 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
1717 	RF_WRITE(mac, save_rf_regs[0], save_rf[0]);
1718 
1719 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1720 
1721 	for (i = 1; i < 4; ++i)
1722 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1723 
1724 	bwi_rf_work_around(mac, rf->rf_curchan);
1725 
1726 	if (phy->phy_version != 0)
1727 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1728 
1729 	for (; i < SAVE_PHY_MAX; ++i)
1730 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1731 
1732 	for (i = 1; i < SAVE_RF_MAX; ++i)
1733 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1734 
1735 	/*
1736 	 * Install calculated narrow RSSI values
1737 	 */
1738 	if (nrssi[0] == nrssi[1])
1739 		rf->rf_nrssi_slope = 0x10000;
1740 	else
1741 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
1742 	if (nrssi[0] <= -4) {
1743 		rf->rf_nrssi[0] = nrssi[0];
1744 		rf->rf_nrssi[1] = nrssi[1];
1745 	}
1746 
1747 #undef SAVE_RF_MAX
1748 #undef SAVE_PHY_MAX
1749 }
1750 
1751 static void
1752 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *mac)
1753 {
1754 #define SAVE_RF_MAX		2
1755 #define SAVE_PHY_COMM_MAX	10
1756 #define SAVE_PHY6_MAX		8
1757 
1758 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1759 	{ 0x7a, 0x43 };
1760 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
1761 		0x0001, 0x0811, 0x0812, 0x0814,
1762 		0x0815, 0x005a, 0x0059, 0x0058,
1763 		0x000a, 0x0003
1764 	};
1765 	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
1766 		0x002e, 0x002f, 0x080f, 0x0810,
1767 		0x0801, 0x0060, 0x0014, 0x0478
1768 	};
1769 
1770 	struct bwi_phy *phy = &mac->mac_phy;
1771 	uint16_t save_rf[SAVE_RF_MAX];
1772 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1773 	uint16_t save_phy6[SAVE_PHY6_MAX];
1774 	uint16_t rf7b = 0xffff;
1775 	int16_t nrssi;
1776 	int i, phy6_idx = 0;
1777 
1778 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1779 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1780 	for (i = 0; i < SAVE_RF_MAX; ++i)
1781 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1782 
1783 	PHY_CLRBITS(mac, 0x429, 0x8000);
1784 	PHY_FILT_SETBITS(mac, 0x1, 0x3fff, 0x4000);
1785 	PHY_SETBITS(mac, 0x811, 0xc);
1786 	PHY_FILT_SETBITS(mac, 0x812, 0xfff3, 0x4);
1787 	PHY_CLRBITS(mac, 0x802, 0x3);
1788 
1789 	if (phy->phy_rev >= 6) {
1790 		for (i = 0; i < SAVE_PHY6_MAX; ++i)
1791 			save_phy6[i] = PHY_READ(mac, save_phy6_regs[i]);
1792 
1793 		PHY_WRITE(mac, 0x2e, 0);
1794 		PHY_WRITE(mac, 0x2f, 0);
1795 		PHY_WRITE(mac, 0x80f, 0);
1796 		PHY_WRITE(mac, 0x810, 0);
1797 		PHY_SETBITS(mac, 0x478, 0x100);
1798 		PHY_SETBITS(mac, 0x801, 0x40);
1799 		PHY_SETBITS(mac, 0x60, 0x40);
1800 		PHY_SETBITS(mac, 0x14, 0x200);
1801 	}
1802 
1803 	RF_SETBITS(mac, 0x7a, 0x70);
1804 	RF_SETBITS(mac, 0x7a, 0x80);
1805 
1806 	DELAY(30);
1807 
1808 	nrssi = bwi_nrssi_11g(mac);
1809 	if (nrssi == 31) {
1810 		for (i = 7; i >= 4; --i) {
1811 			RF_WRITE(mac, 0x7b, i);
1812 			DELAY(20);
1813 			nrssi = bwi_nrssi_11g(mac);
1814 			if (nrssi < 31 && rf7b == 0xffff)
1815 				rf7b = i;
1816 		}
1817 		if (rf7b == 0xffff)
1818 			rf7b = 4;
1819 	} else {
1820 		struct bwi_gains gains;
1821 
1822 		RF_CLRBITS(mac, 0x7a, 0xff80);
1823 
1824 		PHY_SETBITS(mac, 0x814, 0x1);
1825 		PHY_CLRBITS(mac, 0x815, 0x1);
1826 		PHY_SETBITS(mac, 0x811, 0xc);
1827 		PHY_SETBITS(mac, 0x812, 0xc);
1828 		PHY_SETBITS(mac, 0x811, 0x30);
1829 		PHY_SETBITS(mac, 0x812, 0x30);
1830 		PHY_WRITE(mac, 0x5a, 0x480);
1831 		PHY_WRITE(mac, 0x59, 0x810);
1832 		PHY_WRITE(mac, 0x58, 0xd);
1833 		if (phy->phy_version == 0)
1834 			PHY_WRITE(mac, 0x3, 0x122);
1835 		else
1836 			PHY_SETBITS(mac, 0xa, 0x2000);
1837 		PHY_SETBITS(mac, 0x814, 0x4);
1838 		PHY_CLRBITS(mac, 0x815, 0x4);
1839 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
1840 		RF_SETBITS(mac, 0x7a, 0xf);
1841 
1842 		bzero(&gains, sizeof(gains));
1843 		gains.tbl_gain1 = 3;
1844 		gains.tbl_gain2 = 0;
1845 		gains.phy_gain = 1;
1846 		bwi_set_gains(mac, &gains);
1847 
1848 		RF_FILT_SETBITS(mac, 0x43, 0xf0, 0xf);
1849 		DELAY(30);
1850 
1851 		nrssi = bwi_nrssi_11g(mac);
1852 		if (nrssi == -32) {
1853 			for (i = 0; i < 4; ++i) {
1854 				RF_WRITE(mac, 0x7b, i);
1855 				DELAY(20);
1856 				nrssi = bwi_nrssi_11g(mac);
1857 				if (nrssi > -31 && rf7b == 0xffff)
1858 					rf7b = i;
1859 			}
1860 			if (rf7b == 0xffff)
1861 				rf7b = 3;
1862 		} else {
1863 			rf7b = 0;
1864 		}
1865 	}
1866 	RF_WRITE(mac, 0x7b, rf7b);
1867 
1868 	/*
1869 	 * Restore saved RF/PHY registers
1870 	 */
1871 	if (phy->phy_rev >= 6) {
1872 		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
1873 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1874 				  save_phy6[phy6_idx]);
1875 		}
1876 	}
1877 
1878 	/* Saved PHY registers 0, 1, 2 are handled later */
1879 	for (i = 3; i < SAVE_PHY_COMM_MAX; ++i)
1880 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
1881 
1882 	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
1883 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1884 
1885 	PHY_SETBITS(mac, 0x802, 0x3);
1886 	PHY_SETBITS(mac, 0x429, 0x8000);
1887 
1888 	bwi_set_gains(mac, NULL);
1889 
1890 	if (phy->phy_rev >= 6) {
1891 		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
1892 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1893 				  save_phy6[phy6_idx]);
1894 		}
1895 	}
1896 
1897 	PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
1898 	PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
1899 	PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
1900 
1901 #undef SAVE_RF_MAX
1902 #undef SAVE_PHY_COMM_MAX
1903 #undef SAVE_PHY6_MAX
1904 }
1905 
1906 static void
1907 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *mac)
1908 {
1909 #define SAVE_RF_MAX		3
1910 #define SAVE_PHY_COMM_MAX	4
1911 #define SAVE_PHY3_MAX		8
1912 
1913 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1914 	{ 0x7a, 0x52, 0x43 };
1915 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
1916 	{ 0x15, 0x5a, 0x59, 0x58 };
1917 	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
1918 		0x002e, 0x002f, 0x080f, 0x0810,
1919 		0x0801, 0x0060, 0x0014, 0x0478
1920 	};
1921 
1922 	struct bwi_softc *sc = mac->mac_sc;
1923 	struct bwi_phy *phy = &mac->mac_phy;
1924 	struct bwi_rf *rf = &mac->mac_rf;
1925 	uint16_t save_rf[SAVE_RF_MAX];
1926 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1927 	uint16_t save_phy3[SAVE_PHY3_MAX];
1928 	uint16_t ant_div, bbp_atten, chan_ex;
1929 	struct bwi_gains gains;
1930 	int16_t nrssi[2];
1931 	int i, phy3_idx = 0;
1932 
1933 	if (rf->rf_rev >= 9)
1934 		return;
1935 	else if (rf->rf_rev == 8)
1936 		bwi_rf_set_nrssi_ofs_11g(mac);
1937 
1938 	PHY_CLRBITS(mac, 0x429, 0x8000);
1939 	PHY_CLRBITS(mac, 0x802, 0x3);
1940 
1941 	/*
1942 	 * Save RF/PHY registers for later restoration
1943 	 */
1944 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1945 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
1946 
1947 	for (i = 0; i < SAVE_RF_MAX; ++i)
1948 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1949 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1950 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1951 
1952 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1953 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1954 
1955 	if (phy->phy_rev >= 3) {
1956 		for (i = 0; i < SAVE_PHY3_MAX; ++i)
1957 			save_phy3[i] = PHY_READ(mac, save_phy3_regs[i]);
1958 
1959 		PHY_WRITE(mac, 0x2e, 0);
1960 		PHY_WRITE(mac, 0x810, 0);
1961 
1962 		if (phy->phy_rev == 4 || phy->phy_rev == 6 ||
1963 		    phy->phy_rev == 7) {
1964 			PHY_SETBITS(mac, 0x478, 0x100);
1965 			PHY_SETBITS(mac, 0x810, 0x40);
1966 		} else if (phy->phy_rev == 3 || phy->phy_rev == 5) {
1967 			PHY_CLRBITS(mac, 0x810, 0x40);
1968 		}
1969 
1970 		PHY_SETBITS(mac, 0x60, 0x40);
1971 		PHY_SETBITS(mac, 0x14, 0x200);
1972 	}
1973 
1974 	/*
1975 	 * Calculate nrssi0
1976 	 */
1977 	RF_SETBITS(mac, 0x7a, 0x70);
1978 
1979 	bzero(&gains, sizeof(gains));
1980 	gains.tbl_gain1 = 0;
1981 	gains.tbl_gain2 = 8;
1982 	gains.phy_gain = 0;
1983 	bwi_set_gains(mac, &gains);
1984 
1985 	RF_CLRBITS(mac, 0x7a, 0xff08);
1986 	if (phy->phy_rev >= 2) {
1987 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x30);
1988 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
1989 	}
1990 
1991 	RF_SETBITS(mac, 0x7a, 0x80);
1992 	DELAY(20);
1993 	nrssi[0] = bwi_nrssi_11g(mac);
1994 
1995 	/*
1996 	 * Calculate nrssi1
1997 	 */
1998 	RF_CLRBITS(mac, 0x7a, 0xff80);
1999 	if (phy->phy_version >= 2)
2000 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
2001 	CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
2002 
2003 	RF_SETBITS(mac, 0x7a, 0xf);
2004 	PHY_WRITE(mac, 0x15, 0xf330);
2005 	if (phy->phy_rev >= 2) {
2006 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x20);
2007 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x20);
2008 	}
2009 
2010 	bzero(&gains, sizeof(gains));
2011 	gains.tbl_gain1 = 3;
2012 	gains.tbl_gain2 = 0;
2013 	gains.phy_gain = 1;
2014 	bwi_set_gains(mac, &gains);
2015 
2016 	if (rf->rf_rev == 8) {
2017 		RF_WRITE(mac, 0x43, 0x1f);
2018 	} else {
2019 		RF_FILT_SETBITS(mac, 0x52, 0xff0f, 0x60);
2020 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
2021 	}
2022 	PHY_WRITE(mac, 0x5a, 0x480);
2023 	PHY_WRITE(mac, 0x59, 0x810);
2024 	PHY_WRITE(mac, 0x58, 0xd);
2025 	DELAY(20);
2026 
2027 	nrssi[1] = bwi_nrssi_11g(mac);
2028 
2029 	/*
2030 	 * Install calculated narrow RSSI values
2031 	 */
2032 	if (nrssi[1] == nrssi[0])
2033 		rf->rf_nrssi_slope = 0x10000;
2034 	else
2035 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
2036 	if (nrssi[0] >= -4) {
2037 		rf->rf_nrssi[0] = nrssi[1];
2038 		rf->rf_nrssi[1] = nrssi[0];
2039 	}
2040 
2041 	/*
2042 	 * Restore saved RF/PHY registers
2043 	 */
2044 	if (phy->phy_rev >= 3) {
2045 		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
2046 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2047 				  save_phy3[phy3_idx]);
2048 		}
2049 	}
2050 	if (phy->phy_rev >= 2) {
2051 		PHY_CLRBITS(mac, 0x812, 0x30);
2052 		PHY_CLRBITS(mac, 0x811, 0x30);
2053 	}
2054 
2055 	for (i = 0; i < SAVE_RF_MAX; ++i)
2056 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
2057 
2058 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
2059 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
2060 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
2061 
2062 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
2063 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
2064 
2065 	bwi_rf_work_around(mac, rf->rf_curchan);
2066 	PHY_SETBITS(mac, 0x802, 0x3);
2067 	bwi_set_gains(mac, NULL);
2068 	PHY_SETBITS(mac, 0x429, 0x8000);
2069 
2070 	if (phy->phy_rev >= 3) {
2071 		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
2072 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2073 				  save_phy3[phy3_idx]);
2074 		}
2075 	}
2076 
2077 	bwi_rf_init_sw_nrssi_table(mac);
2078 	bwi_rf_set_nrssi_thr_11g(mac);
2079 
2080 #undef SAVE_RF_MAX
2081 #undef SAVE_PHY_COMM_MAX
2082 #undef SAVE_PHY3_MAX
2083 }
2084 
2085 static void
2086 bwi_rf_init_sw_nrssi_table(struct bwi_mac *mac)
2087 {
2088 	struct bwi_rf *rf = &mac->mac_rf;
2089 	int d, i;
2090 
2091 	d = 0x1f - rf->rf_nrssi[0];
2092 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2093 		int val;
2094 
2095 		val = (((i - d) * rf->rf_nrssi_slope) / 0x10000) + 0x3a;
2096 		if (val < 0)
2097 			val = 0;
2098 		else if (val > 0x3f)
2099 			val = 0x3f;
2100 
2101 		rf->rf_nrssi_table[i] = val;
2102 	}
2103 }
2104 
2105 void
2106 bwi_rf_init_hw_nrssi_table(struct bwi_mac *mac, uint16_t adjust)
2107 {
2108 	int i;
2109 
2110 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2111 		int16_t val;
2112 
2113 		val = bwi_nrssi_read(mac, i);
2114 
2115 		val -= adjust;
2116 		if (val < -32)
2117 			val = -32;
2118 		else if (val > 31)
2119 			val = 31;
2120 
2121 		bwi_nrssi_write(mac, i, val);
2122 	}
2123 }
2124 
2125 static void
2126 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *mac)
2127 {
2128 	struct bwi_rf *rf = &mac->mac_rf;
2129 	int32_t thr;
2130 
2131 	if (rf->rf_type != BWI_RF_T_BCM2050 ||
2132 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0)
2133 		return;
2134 
2135 	/*
2136 	 * Calculate nrssi threshold
2137 	 */
2138 	if (rf->rf_rev >= 6) {
2139 		thr = (rf->rf_nrssi[1] - rf->rf_nrssi[0]) * 32;
2140 		thr += 20 * (rf->rf_nrssi[0] + 1);
2141 		thr /= 40;
2142 	} else {
2143 		thr = rf->rf_nrssi[1] - 5;
2144 	}
2145 	if (thr < 0)
2146 		thr = 0;
2147 	else if (thr > 0x3e)
2148 		thr = 0x3e;
2149 
2150 	PHY_READ(mac, BWI_PHYR_NRSSI_THR_11B);	/* dummy read */
2151 	PHY_WRITE(mac, BWI_PHYR_NRSSI_THR_11B, (((uint16_t)thr) << 8) | 0x1c);
2152 
2153 	if (rf->rf_rev >= 6) {
2154 		PHY_WRITE(mac, 0x87, 0xe0d);
2155 		PHY_WRITE(mac, 0x86, 0xc0b);
2156 		PHY_WRITE(mac, 0x85, 0xa09);
2157 		PHY_WRITE(mac, 0x84, 0x808);
2158 		PHY_WRITE(mac, 0x83, 0x808);
2159 		PHY_WRITE(mac, 0x82, 0x604);
2160 		PHY_WRITE(mac, 0x81, 0x302);
2161 		PHY_WRITE(mac, 0x80, 0x100);
2162 	}
2163 }
2164 
2165 static __inline int32_t
2166 _nrssi_threshold(const struct bwi_rf *rf, int32_t val)
2167 {
2168 	val *= (rf->rf_nrssi[1] - rf->rf_nrssi[0]);
2169 	val += (rf->rf_nrssi[0] << 6);
2170 	if (val < 32)
2171 		val += 31;
2172 	else
2173 		val += 32;
2174 	val >>= 6;
2175 	if (val < -31)
2176 		val = -31;
2177 	else if (val > 31)
2178 		val = 31;
2179 	return val;
2180 }
2181 
2182 static void
2183 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *mac)
2184 {
2185 	int32_t thr1, thr2;
2186 	uint16_t thr;
2187 
2188 	/*
2189 	 * Find the two nrssi thresholds
2190 	 */
2191 	if ((mac->mac_phy.phy_flags & BWI_PHY_F_LINKED) == 0 ||
2192 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
2193 	    	int16_t nrssi;
2194 
2195 		nrssi = bwi_nrssi_read(mac, 0x20);
2196 		if (nrssi >= 32)
2197 			nrssi -= 64;
2198 
2199 		if (nrssi < 3) {
2200 			thr1 = 0x2b;
2201 			thr2 = 0x27;
2202 		} else {
2203 			thr1 = 0x2d;
2204 			thr2 = 0x2b;
2205 		}
2206 	} else {
2207 		/* TODO Interfere mode */
2208 		thr1 = _nrssi_threshold(&mac->mac_rf, 0x11);
2209 		thr2 = _nrssi_threshold(&mac->mac_rf, 0xe);
2210 	}
2211 
2212 #define NRSSI_THR1_MASK	__BITS(5, 0)
2213 #define NRSSI_THR2_MASK	__BITS(11, 6)
2214 
2215 	thr = __SHIFTIN((uint32_t)thr1, NRSSI_THR1_MASK) |
2216 	      __SHIFTIN((uint32_t)thr2, NRSSI_THR2_MASK);
2217 	PHY_FILT_SETBITS(mac, BWI_PHYR_NRSSI_THR_11G, 0xf000, thr);
2218 
2219 #undef NRSSI_THR1_MASK
2220 #undef NRSSI_THR2_MASK
2221 }
2222 
2223 void
2224 bwi_rf_clear_tssi(struct bwi_mac *mac)
2225 {
2226 	/* XXX use function pointer */
2227 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
2228 		/* TODO:11A */
2229 	} else {
2230 		uint16_t val;
2231 		int i;
2232 
2233 		val = __SHIFTIN(BWI_INVALID_TSSI, BWI_LO_TSSI_MASK) |
2234 		      __SHIFTIN(BWI_INVALID_TSSI, BWI_HI_TSSI_MASK);
2235 
2236 		for (i = 0; i < 2; ++i) {
2237 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2238 				BWI_COMM_MOBJ_TSSI_DS + (i * 2), val);
2239 		}
2240 
2241 		for (i = 0; i < 2; ++i) {
2242 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2243 				BWI_COMM_MOBJ_TSSI_OFDM + (i * 2), val);
2244 		}
2245 	}
2246 }
2247 
2248 void
2249 bwi_rf_clear_state(struct bwi_rf *rf)
2250 {
2251 	int i;
2252 
2253 	rf->rf_flags &= ~BWI_RF_CLEAR_FLAGS;
2254 	bzero(rf->rf_lo, sizeof(rf->rf_lo));
2255 	bzero(rf->rf_lo_used, sizeof(rf->rf_lo_used));
2256 
2257 	rf->rf_nrssi_slope = 0;
2258 	rf->rf_nrssi[0] = BWI_INVALID_NRSSI;
2259 	rf->rf_nrssi[1] = BWI_INVALID_NRSSI;
2260 
2261 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i)
2262 		rf->rf_nrssi_table[i] = i;
2263 
2264 	rf->rf_lo_gain = 0;
2265 	rf->rf_rx_gain = 0;
2266 
2267 	bcopy(rf->rf_txpower_map0, rf->rf_txpower_map,
2268 	      sizeof(rf->rf_txpower_map));
2269 	rf->rf_idle_tssi = rf->rf_idle_tssi0;
2270 }
2271 
2272 static void
2273 bwi_rf_on_11a(struct bwi_mac *mac)
2274 {
2275 	/* TODO:11A */
2276 }
2277 
2278 static void
2279 bwi_rf_on_11bg(struct bwi_mac *mac)
2280 {
2281 	struct bwi_phy *phy = &mac->mac_phy;
2282 
2283 	PHY_WRITE(mac, 0x15, 0x8000);
2284 	PHY_WRITE(mac, 0x15, 0xcc00);
2285 	if (phy->phy_flags & BWI_PHY_F_LINKED)
2286 		PHY_WRITE(mac, 0x15, 0xc0);
2287 	else
2288 		PHY_WRITE(mac, 0x15, 0);
2289 
2290 	bwi_rf_set_chan(mac, 6 /* XXX */, 1);
2291 }
2292 
2293 void
2294 bwi_rf_set_ant_mode(struct bwi_mac *mac, int ant_mode)
2295 {
2296 	struct bwi_softc *sc = mac->mac_sc;
2297 	struct bwi_phy *phy = &mac->mac_phy;
2298 	uint16_t val;
2299 
2300 	KASSERT(ant_mode == BWI_ANT_MODE_0 ||
2301 		ant_mode == BWI_ANT_MODE_1 ||
2302 		ant_mode == BWI_ANT_MODE_AUTO, ("ant_mode %d", ant_mode));
2303 
2304 	HFLAGS_CLRBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2305 
2306 	if (phy->phy_mode == IEEE80211_MODE_11B) {
2307 		/* NOTE: v4/v3 conflicts, take v3 */
2308 		if (mac->mac_rev == 2)
2309 			val = BWI_ANT_MODE_AUTO;
2310 		else
2311 			val = ant_mode;
2312 		val <<= 7;
2313 		PHY_FILT_SETBITS(mac, 0x3e2, 0xfe7f, val);
2314 	} else {	/* 11a/g */
2315 		/* XXX reg/value naming */
2316 		val = ant_mode << 7;
2317 		PHY_FILT_SETBITS(mac, 0x401, 0x7e7f, val);
2318 
2319 		if (ant_mode == BWI_ANT_MODE_AUTO)
2320 			PHY_CLRBITS(mac, 0x42b, 0x100);
2321 
2322 		if (phy->phy_mode == IEEE80211_MODE_11A) {
2323 			/* TODO:11A */
2324 		} else {	/* 11g */
2325 			if (ant_mode == BWI_ANT_MODE_AUTO)
2326 				PHY_SETBITS(mac, 0x48c, 0x2000);
2327 			else
2328 				PHY_CLRBITS(mac, 0x48c, 0x2000);
2329 
2330 			if (phy->phy_rev >= 2) {
2331 				PHY_SETBITS(mac, 0x461, 0x10);
2332 				PHY_FILT_SETBITS(mac, 0x4ad, 0xff00, 0x15);
2333 				if (phy->phy_rev == 2) {
2334 					PHY_WRITE(mac, 0x427, 0x8);
2335 				} else {
2336 					PHY_FILT_SETBITS(mac, 0x427,
2337 							 0xff00, 0x8);
2338 				}
2339 
2340 				if (phy->phy_rev >= 6)
2341 					PHY_WRITE(mac, 0x49b, 0xdc);
2342 			}
2343 		}
2344 	}
2345 
2346 	/* XXX v4 set AUTO_ANTDIV unconditionally */
2347 	if (ant_mode == BWI_ANT_MODE_AUTO)
2348 		HFLAGS_SETBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2349 
2350 	val = ant_mode << 8;
2351 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_BEACON,
2352 			    0xfc3f, val);
2353 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_ACK,
2354 			    0xfc3f, val);
2355 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_PROBE_RESP,
2356 			    0xfc3f, val);
2357 
2358 	/* XXX what's these */
2359 	if (phy->phy_mode == IEEE80211_MODE_11B)
2360 		CSR_SETBITS_2(sc, 0x5e, 0x4);
2361 
2362 	CSR_WRITE_4(sc, 0x100, 0x1000000);
2363 	if (mac->mac_rev < 5)
2364 		CSR_WRITE_4(sc, 0x10c, 0x1000000);
2365 
2366 	mac->mac_rf.rf_ant_mode = ant_mode;
2367 }
2368 
2369 int
2370 bwi_rf_get_latest_tssi(struct bwi_mac *mac, int8_t tssi[], uint16_t ofs)
2371 {
2372 	int i;
2373 
2374 	for (i = 0; i < 4; ) {
2375 		uint16_t val;
2376 
2377 		val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs + i);
2378 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_LO_TSSI_MASK);
2379 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_HI_TSSI_MASK);
2380 	}
2381 
2382 	for (i = 0; i < 4; ++i) {
2383 		if (tssi[i] == BWI_INVALID_TSSI)
2384 			return EINVAL;
2385 	}
2386 	return 0;
2387 }
2388 
2389 int
2390 bwi_rf_tssi2dbm(struct bwi_mac *mac, int8_t tssi, int8_t *txpwr)
2391 {
2392 	struct bwi_rf *rf = &mac->mac_rf;
2393 	int pwr_idx;
2394 
2395 	pwr_idx = rf->rf_idle_tssi + (int)tssi - rf->rf_base_tssi;
2396 #if 0
2397 	if (pwr_idx < 0 || pwr_idx >= BWI_TSSI_MAX)
2398 		return EINVAL;
2399 #else
2400 	if (pwr_idx < 0)
2401 		pwr_idx = 0;
2402 	else if (pwr_idx >= BWI_TSSI_MAX)
2403 		pwr_idx = BWI_TSSI_MAX - 1;
2404 #endif
2405 
2406 	*txpwr = rf->rf_txpower_map[pwr_idx];
2407 	return 0;
2408 }
2409 
2410 static int
2411 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2412 {
2413 	uint16_t flags1, flags3;
2414 	int rssi, lna_gain;
2415 
2416 	rssi = hdr->rxh_rssi;
2417 	flags1 = le16toh(hdr->rxh_flags1);
2418 	flags3 = le16toh(hdr->rxh_flags3);
2419 
2420 	if (flags1 & BWI_RXH_F1_OFDM) {
2421 		if (rssi > 127)
2422 			rssi -= 256;
2423 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2424 			rssi += 17;
2425 		else
2426 			rssi -= 4;
2427 		return rssi;
2428 	}
2429 
2430 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2431 		struct bwi_rf *rf = &mac->mac_rf;
2432 
2433 		if (rssi >= BWI_NRSSI_TBLSZ)
2434 			rssi = BWI_NRSSI_TBLSZ - 1;
2435 
2436 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
2437 		rssi -= 67;
2438 	} else {
2439 		rssi = ((31 - rssi) * -149) / 128;
2440 		rssi -= 68;
2441 	}
2442 
2443 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
2444 		return rssi;
2445 
2446 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2447 		rssi += 20;
2448 
2449 	lna_gain = __SHIFTOUT(le16toh(hdr->rxh_phyinfo),
2450 			      BWI_RXH_PHYINFO_LNAGAIN);
2451 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_RX,
2452 		"lna_gain %d, phyinfo 0x%04x\n",
2453 		lna_gain, le16toh(hdr->rxh_phyinfo));
2454 	switch (lna_gain) {
2455 	case 0:
2456 		rssi += 27;
2457 		break;
2458 	case 1:
2459 		rssi += 6;
2460 		break;
2461 	case 2:
2462 		rssi += 12;
2463 		break;
2464 	case 3:
2465 		/*
2466 		 * XXX
2467 		 * According to v3 spec, we should do _nothing_ here,
2468 		 * but it seems that the result RSSI will be too low
2469 		 * (relative to what ath(4) says).  Raise it a little
2470 		 * bit.
2471 		 */
2472 		rssi += 5;
2473 		break;
2474 	default:
2475 		panic("impossible lna gain %d", lna_gain);
2476 	}
2477 	return rssi;
2478 }
2479 
2480 static int
2481 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2482 {
2483 	uint16_t flags1;
2484 	int rssi;
2485 
2486 	rssi = (((int)hdr->rxh_rssi - 11) * 103) / 64;
2487 
2488 	flags1 = le16toh(hdr->rxh_flags1);
2489 	if (flags1 & BWI_RXH_F1_BCM2053_RSSI)
2490 		rssi -= 109;
2491 	else
2492 		rssi -= 83;
2493 	return rssi;
2494 }
2495 
2496 static int
2497 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2498 {
2499 	int rssi;
2500 
2501 	rssi = hdr->rxh_rssi;
2502 	if (rssi > 127)
2503 		rssi -= 256;
2504 	return rssi;
2505 }
2506 
2507 static int
2508 bwi_rf_calc_noise_bcm2050(struct bwi_mac *mac)
2509 {
2510 	uint16_t val;
2511 	int noise;
2512 
2513 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2514 	noise = (int)val;	/* XXX check bounds? */
2515 
2516 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2517 		struct bwi_rf *rf = &mac->mac_rf;
2518 
2519 		if (noise >= BWI_NRSSI_TBLSZ)
2520 			noise = BWI_NRSSI_TBLSZ - 1;
2521 
2522 		noise = ((31 - (int)rf->rf_nrssi_table[noise]) * -131) / 128;
2523 		noise -= 67;
2524 	} else {
2525 		noise = ((31 - noise) * -149) / 128;
2526 		noise -= 68;
2527 	}
2528 	return noise;
2529 }
2530 
2531 static int
2532 bwi_rf_calc_noise_bcm2053(struct bwi_mac *mac)
2533 {
2534 	uint16_t val;
2535 	int noise;
2536 
2537 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2538 	noise = (int)val;	/* XXX check bounds? */
2539 
2540 	noise = ((noise - 11) * 103) / 64;
2541 	noise -= 109;
2542 	return noise;
2543 }
2544 
2545 static int
2546 bwi_rf_calc_noise_bcm2060(struct bwi_mac *mac)
2547 {
2548 	/* XXX Dont know how to calc */
2549 	return (BWI_NOISE_FLOOR);
2550 }
2551 
2552 static uint16_t
2553 bwi_rf_lo_measure_11b(struct bwi_mac *mac)
2554 {
2555 	uint16_t val;
2556 	int i;
2557 
2558 	val = 0;
2559 	for (i = 0; i < 10; ++i) {
2560 		PHY_WRITE(mac, 0x15, 0xafa0);
2561 		DELAY(1);
2562 		PHY_WRITE(mac, 0x15, 0xefa0);
2563 		DELAY(10);
2564 		PHY_WRITE(mac, 0x15, 0xffa0);
2565 		DELAY(40);
2566 
2567 		val += PHY_READ(mac, 0x2c);
2568 	}
2569 	return val;
2570 }
2571 
2572 static void
2573 bwi_rf_lo_update_11b(struct bwi_mac *mac)
2574 {
2575 	struct bwi_softc *sc = mac->mac_sc;
2576 	struct bwi_rf *rf = &mac->mac_rf;
2577 	struct rf_saveregs regs;
2578 	uint16_t rf_val, phy_val, min_val, val;
2579 	uint16_t rf52, bphy_ctrl;
2580 	int i;
2581 
2582 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT, "%s enter\n", __func__);
2583 
2584 	bzero(&regs, sizeof(regs));
2585 	bphy_ctrl = 0;
2586 
2587 	/*
2588 	 * Save RF/PHY registers for later restoration
2589 	 */
2590 	SAVE_PHY_REG(mac, &regs, 15);
2591 	rf52 = RF_READ(mac, 0x52) & 0xfff0;
2592 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2593 		SAVE_PHY_REG(mac, &regs, 0a);
2594 		SAVE_PHY_REG(mac, &regs, 2a);
2595 		SAVE_PHY_REG(mac, &regs, 35);
2596 		SAVE_PHY_REG(mac, &regs, 03);
2597 		SAVE_PHY_REG(mac, &regs, 01);
2598 		SAVE_PHY_REG(mac, &regs, 30);
2599 
2600 		SAVE_RF_REG(mac, &regs, 43);
2601 		SAVE_RF_REG(mac, &regs, 7a);
2602 
2603 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
2604 
2605 		SAVE_RF_REG(mac, &regs, 52);
2606 		regs.rf_52 &= 0xf0;
2607 
2608 		PHY_WRITE(mac, 0x30, 0xff);
2609 		CSR_WRITE_2(sc, BWI_PHY_CTRL, 0x3f3f);
2610 		PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
2611 		RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
2612 	}
2613 
2614 	PHY_WRITE(mac, 0x15, 0xb000);
2615 
2616 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2617 		PHY_WRITE(mac, 0x2b, 0x203);
2618 		PHY_WRITE(mac, 0x2a, 0x8a3);
2619 	} else {
2620 		PHY_WRITE(mac, 0x2b, 0x1402);
2621 	}
2622 
2623 	/*
2624 	 * Setup RF signal
2625 	 */
2626 	rf_val = 0;
2627 	min_val = UINT16_MAX;
2628 
2629 	for (i = 0; i < 4; ++i) {
2630 		RF_WRITE(mac, 0x52, rf52 | i);
2631 		bwi_rf_lo_measure_11b(mac);	/* Ignore return value */
2632 	}
2633 	for (i = 0; i < 10; ++i) {
2634 		RF_WRITE(mac, 0x52, rf52 | i);
2635 
2636 		val = bwi_rf_lo_measure_11b(mac) / 10;
2637 		if (val < min_val) {
2638 			min_val = val;
2639 			rf_val = i;
2640 		}
2641 	}
2642 	RF_WRITE(mac, 0x52, rf52 | rf_val);
2643 
2644 	/*
2645 	 * Setup PHY signal
2646 	 */
2647 	phy_val = 0;
2648 	min_val = UINT16_MAX;
2649 
2650 	for (i = -4; i < 5; i += 2) {
2651 		int j;
2652 
2653 		for (j = -4; j < 5; j += 2) {
2654 			uint16_t phy2f;
2655 
2656 			phy2f = (0x100 * i) + j;
2657 			if (j < 0)
2658 				phy2f += 0x100;
2659 			PHY_WRITE(mac, 0x2f, phy2f);
2660 
2661 			val = bwi_rf_lo_measure_11b(mac) / 10;
2662 			if (val < min_val) {
2663 				min_val = val;
2664 				phy_val = phy2f;
2665 			}
2666 		}
2667 	}
2668 	PHY_WRITE(mac, 0x2f, phy_val + 0x101);
2669 
2670 	/*
2671 	 * Restore saved RF/PHY registers
2672 	 */
2673 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2674 		RESTORE_PHY_REG(mac, &regs, 0a);
2675 		RESTORE_PHY_REG(mac, &regs, 2a);
2676 		RESTORE_PHY_REG(mac, &regs, 35);
2677 		RESTORE_PHY_REG(mac, &regs, 03);
2678 		RESTORE_PHY_REG(mac, &regs, 01);
2679 		RESTORE_PHY_REG(mac, &regs, 30);
2680 
2681 		RESTORE_RF_REG(mac, &regs, 43);
2682 		RESTORE_RF_REG(mac, &regs, 7a);
2683 
2684 		RF_FILT_SETBITS(mac, 0x52, 0xf, regs.rf_52);
2685 
2686 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
2687 	}
2688 	RESTORE_PHY_REG(mac, &regs, 15);
2689 
2690 	bwi_rf_work_around(mac, rf->rf_curchan);
2691 }
2692