xref: /freebsd/sys/dev/bwi/bwirf.c (revision 8fc257994d0ce2396196d7a06d50d20c8015f4b7)
1 /*
2  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Sepherosa Ziehau <sepherosa@gmail.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * $DragonFly: src/sys/dev/netif/bwi/bwirf.c,v 1.9 2008/08/21 12:19:33 swildner Exp $
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include "opt_inet.h"
41 #include "opt_bwi.h"
42 
43 #include <sys/param.h>
44 #include <sys/endian.h>
45 #include <sys/kernel.h>
46 #include <sys/bus.h>
47 #include <sys/malloc.h>
48 #include <sys/proc.h>
49 #include <sys/rman.h>
50 #include <sys/socket.h>
51 #include <sys/sockio.h>
52 #include <sys/sysctl.h>
53 #include <sys/systm.h>
54 
55 #include <net/if.h>
56 #include <net/if_dl.h>
57 #include <net/if_media.h>
58 #include <net/if_types.h>
59 #include <net/if_arp.h>
60 #include <net/ethernet.h>
61 #include <net/if_llc.h>
62 
63 #include <net80211/ieee80211_var.h>
64 #include <net80211/ieee80211_radiotap.h>
65 #include <net80211/ieee80211_amrr.h>
66 
67 #include <machine/bus.h>
68 
69 #include <dev/bwi/bitops.h>
70 #include <dev/bwi/if_bwireg.h>
71 #include <dev/bwi/if_bwivar.h>
72 #include <dev/bwi/bwimac.h>
73 #include <dev/bwi/bwirf.h>
74 #include <dev/bwi/bwiphy.h>
75 
76 #define RF_LO_WRITE(mac, lo)	bwi_rf_lo_write((mac), (lo))
77 
78 #define BWI_RF_2GHZ_CHAN(chan)			\
79 	(ieee80211_ieee2mhz((chan), IEEE80211_CHAN_2GHZ) - 2400)
80 
81 #define BWI_DEFAULT_IDLE_TSSI	52
82 
83 struct rf_saveregs {
84 	uint16_t	phy_01;
85 	uint16_t	phy_03;
86 	uint16_t	phy_0a;
87 	uint16_t	phy_15;
88 	uint16_t	phy_2a;
89 	uint16_t	phy_30;
90 	uint16_t	phy_35;
91 	uint16_t	phy_60;
92 	uint16_t	phy_429;
93 	uint16_t	phy_802;
94 	uint16_t	phy_811;
95 	uint16_t	phy_812;
96 	uint16_t	phy_814;
97 	uint16_t	phy_815;
98 
99 	uint16_t	rf_43;
100 	uint16_t	rf_52;
101 	uint16_t	rf_7a;
102 };
103 
104 #define SAVE_RF_REG(mac, regs, n)	(regs)->rf_##n = RF_READ((mac), 0x##n)
105 #define RESTORE_RF_REG(mac, regs, n)	RF_WRITE((mac), 0x##n, (regs)->rf_##n)
106 
107 #define SAVE_PHY_REG(mac, regs, n)	(regs)->phy_##n = PHY_READ((mac), 0x##n)
108 #define RESTORE_PHY_REG(mac, regs, n)	PHY_WRITE((mac), 0x##n, (regs)->phy_##n)
109 
110 static int	bwi_rf_calc_txpower(int8_t *, uint8_t, const int16_t[]);
111 static void	bwi_rf_work_around(struct bwi_mac *, u_int);
112 static int	bwi_rf_gain_max_reached(struct bwi_mac *, int);
113 static uint16_t	bwi_rf_calibval(struct bwi_mac *);
114 static uint16_t	bwi_rf_get_tp_ctrl2(struct bwi_mac *);
115 
116 static void	bwi_rf_lo_update_11b(struct bwi_mac *);
117 static uint16_t	bwi_rf_lo_measure_11b(struct bwi_mac *);
118 
119 static void	bwi_rf_lo_update_11g(struct bwi_mac *);
120 static uint32_t	bwi_rf_lo_devi_measure(struct bwi_mac *, uint16_t);
121 static void	bwi_rf_lo_measure_11g(struct bwi_mac *,
122 			const struct bwi_rf_lo *, struct bwi_rf_lo *, uint8_t);
123 static uint8_t	_bwi_rf_lo_update_11g(struct bwi_mac *, uint16_t);
124 static void	bwi_rf_lo_write(struct bwi_mac *, const struct bwi_rf_lo *);
125 
126 static void	bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *);
127 static void	bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *);
128 static void	bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *);
129 static void	bwi_rf_set_nrssi_thr_11b(struct bwi_mac *);
130 static void	bwi_rf_set_nrssi_thr_11g(struct bwi_mac *);
131 
132 static void	bwi_rf_init_sw_nrssi_table(struct bwi_mac *);
133 
134 static int	bwi_rf_calc_rssi_bcm2050(struct bwi_mac *,
135 			const struct bwi_rxbuf_hdr *);
136 static int	bwi_rf_calc_rssi_bcm2053(struct bwi_mac *,
137 			const struct bwi_rxbuf_hdr *);
138 static int	bwi_rf_calc_rssi_bcm2060(struct bwi_mac *,
139 			const struct bwi_rxbuf_hdr *);
140 static int	bwi_rf_calc_noise_bcm2050(struct bwi_mac *);
141 static int	bwi_rf_calc_noise_bcm2053(struct bwi_mac *);
142 static int	bwi_rf_calc_noise_bcm2060(struct bwi_mac *);
143 
144 static void	bwi_rf_on_11a(struct bwi_mac *);
145 static void	bwi_rf_on_11bg(struct bwi_mac *);
146 
147 static void	bwi_rf_off_11a(struct bwi_mac *);
148 static void	bwi_rf_off_11bg(struct bwi_mac *);
149 static void	bwi_rf_off_11g_rev5(struct bwi_mac *);
150 
151 static const int8_t	bwi_txpower_map_11b[BWI_TSSI_MAX] =
152 	{ BWI_TXPOWER_MAP_11B };
153 static const int8_t	bwi_txpower_map_11g[BWI_TSSI_MAX] =
154 	{ BWI_TXPOWER_MAP_11G };
155 
156 static __inline int16_t
157 bwi_nrssi_11g(struct bwi_mac *mac)
158 {
159 	int16_t val;
160 
161 #define NRSSI_11G_MASK		__BITS(13, 8)
162 
163 	val = (int16_t)__SHIFTOUT(PHY_READ(mac, 0x47f), NRSSI_11G_MASK);
164 	if (val >= 32)
165 		val -= 64;
166 	return val;
167 
168 #undef NRSSI_11G_MASK
169 }
170 
171 static __inline struct bwi_rf_lo *
172 bwi_get_rf_lo(struct bwi_mac *mac, uint16_t rf_atten, uint16_t bbp_atten)
173 {
174 	int n;
175 
176 	n = rf_atten + (14 * (bbp_atten / 2));
177 	KASSERT(n < BWI_RFLO_MAX, ("n %d", n));
178 
179 	return &mac->mac_rf.rf_lo[n];
180 }
181 
182 static __inline int
183 bwi_rf_lo_isused(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
184 {
185 	struct bwi_rf *rf = &mac->mac_rf;
186 	int idx;
187 
188 	idx = lo - rf->rf_lo;
189 	KASSERT(idx >= 0 && idx < BWI_RFLO_MAX, ("idx %d", idx));
190 
191 	return isset(rf->rf_lo_used, idx);
192 }
193 
194 void
195 bwi_rf_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
196 {
197 	struct bwi_softc *sc = mac->mac_sc;
198 
199 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
200 	CSR_WRITE_2(sc, BWI_RF_DATA_LO, data);
201 }
202 
203 uint16_t
204 bwi_rf_read(struct bwi_mac *mac, uint16_t ctrl)
205 {
206 	struct bwi_rf *rf = &mac->mac_rf;
207 	struct bwi_softc *sc = mac->mac_sc;
208 
209 	ctrl |= rf->rf_ctrl_rd;
210 	if (rf->rf_ctrl_adj) {
211 		/* XXX */
212 		if (ctrl < 0x70)
213 			ctrl += 0x80;
214 		else if (ctrl < 0x80)
215 			ctrl += 0x70;
216 	}
217 
218 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
219 	return CSR_READ_2(sc, BWI_RF_DATA_LO);
220 }
221 
222 int
223 bwi_rf_attach(struct bwi_mac *mac)
224 {
225 	struct bwi_softc *sc = mac->mac_sc;
226 	struct bwi_phy *phy = &mac->mac_phy;
227 	struct bwi_rf *rf = &mac->mac_rf;
228 	uint16_t type, manu;
229 	uint8_t rev;
230 
231 	/*
232 	 * Get RF manufacture/type/revision
233 	 */
234 	if (sc->sc_bbp_id == BWI_BBPID_BCM4317) {
235 		/*
236 		 * Fake a BCM2050 RF
237 		 */
238 		manu = BWI_RF_MANUFACT_BCM;
239 		type = BWI_RF_T_BCM2050;
240 		if (sc->sc_bbp_rev == 0)
241 			rev = 3;
242 		else if (sc->sc_bbp_rev == 1)
243 			rev = 4;
244 		else
245 			rev = 5;
246 	} else {
247 		uint32_t val;
248 
249 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
250 		val = CSR_READ_2(sc, BWI_RF_DATA_HI);
251 		val <<= 16;
252 
253 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
254 		val |= CSR_READ_2(sc, BWI_RF_DATA_LO);
255 
256 		manu = __SHIFTOUT(val, BWI_RFINFO_MANUFACT_MASK);
257 		type = __SHIFTOUT(val, BWI_RFINFO_TYPE_MASK);
258 		rev = __SHIFTOUT(val, BWI_RFINFO_REV_MASK);
259 	}
260 	device_printf(sc->sc_dev, "RF: manu 0x%03x, type 0x%04x, rev %u\n",
261 		      manu, type, rev);
262 
263 	/*
264 	 * Verify whether the RF is supported
265 	 */
266 	rf->rf_ctrl_rd = 0;
267 	rf->rf_ctrl_adj = 0;
268 	switch (phy->phy_mode) {
269 	case IEEE80211_MODE_11A:
270 		if (manu != BWI_RF_MANUFACT_BCM ||
271 		    type != BWI_RF_T_BCM2060 ||
272 		    rev != 1) {
273 			device_printf(sc->sc_dev, "only BCM2060 rev 1 RF "
274 				      "is supported for 11A PHY\n");
275 			return ENXIO;
276 		}
277 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11A;
278 		rf->rf_on = bwi_rf_on_11a;
279 		rf->rf_off = bwi_rf_off_11a;
280 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2060;
281 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2060;
282 		break;
283 	case IEEE80211_MODE_11B:
284 		if (type == BWI_RF_T_BCM2050) {
285 			rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
286 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
287 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
288 		} else if (type == BWI_RF_T_BCM2053) {
289 			rf->rf_ctrl_adj = 1;
290 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2053;
291 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2053;
292 		} else {
293 			device_printf(sc->sc_dev, "only BCM2050/BCM2053 RF "
294 				      "is supported for 11B PHY\n");
295 			return ENXIO;
296 		}
297 		rf->rf_on = bwi_rf_on_11bg;
298 		rf->rf_off = bwi_rf_off_11bg;
299 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11b;
300 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11b;
301 		if (phy->phy_rev == 6)
302 			rf->rf_lo_update = bwi_rf_lo_update_11g;
303 		else
304 			rf->rf_lo_update = bwi_rf_lo_update_11b;
305 		break;
306 	case IEEE80211_MODE_11G:
307 		if (type != BWI_RF_T_BCM2050) {
308 			device_printf(sc->sc_dev, "only BCM2050 RF "
309 				      "is supported for 11G PHY\n");
310 			return ENXIO;
311 		}
312 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
313 		rf->rf_on = bwi_rf_on_11bg;
314 		if (mac->mac_rev >= 5)
315 			rf->rf_off = bwi_rf_off_11g_rev5;
316 		else
317 			rf->rf_off = bwi_rf_off_11bg;
318 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11g;
319 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11g;
320 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
321 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
322 		rf->rf_lo_update = bwi_rf_lo_update_11g;
323 		break;
324 	default:
325 		device_printf(sc->sc_dev, "unsupported PHY mode\n");
326 		return ENXIO;
327 	}
328 
329 	rf->rf_type = type;
330 	rf->rf_rev = rev;
331 	rf->rf_manu = manu;
332 	rf->rf_curchan = IEEE80211_CHAN_ANY;
333 	rf->rf_ant_mode = BWI_ANT_MODE_AUTO;
334 	return 0;
335 }
336 
337 void
338 bwi_rf_set_chan(struct bwi_mac *mac, u_int chan, int work_around)
339 {
340 	struct bwi_softc *sc = mac->mac_sc;
341 
342 	if (chan == IEEE80211_CHAN_ANY)
343 		return;
344 
345 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_CHAN, chan);
346 
347 	/* TODO: 11A */
348 
349 	if (work_around)
350 		bwi_rf_work_around(mac, chan);
351 
352 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
353 
354 	if (chan == 14) {
355 		if (sc->sc_locale == BWI_SPROM_LOCALE_JAPAN)
356 			HFLAGS_CLRBITS(mac, BWI_HFLAG_NOT_JAPAN);
357 		else
358 			HFLAGS_SETBITS(mac, BWI_HFLAG_NOT_JAPAN);
359 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, (1 << 11)); /* XXX */
360 	} else {
361 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0x840); /* XXX */
362 	}
363 	DELAY(8000);	/* DELAY(2000); */
364 
365 	mac->mac_rf.rf_curchan = chan;
366 }
367 
368 void
369 bwi_rf_get_gains(struct bwi_mac *mac)
370 {
371 #define SAVE_PHY_MAX	15
372 #define SAVE_RF_MAX	3
373 
374 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
375 	{ 0x52, 0x43, 0x7a };
376 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] = {
377 		0x0429, 0x0001, 0x0811, 0x0812,
378 		0x0814, 0x0815, 0x005a, 0x0059,
379 		0x0058, 0x000a, 0x0003, 0x080f,
380 		0x0810, 0x002b, 0x0015
381 	};
382 
383 	struct bwi_softc *sc = mac->mac_sc;
384 	struct bwi_phy *phy = &mac->mac_phy;
385 	struct bwi_rf *rf = &mac->mac_rf;
386 	uint16_t save_phy[SAVE_PHY_MAX];
387 	uint16_t save_rf[SAVE_RF_MAX];
388 	uint16_t trsw;
389 	int i, j, loop1_max, loop1, loop2;
390 
391 	/*
392 	 * Save PHY/RF registers for later restoration
393 	 */
394 	for (i = 0; i < SAVE_PHY_MAX; ++i)
395 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
396 	PHY_READ(mac, 0x2d); /* dummy read */
397 
398 	for (i = 0; i < SAVE_RF_MAX; ++i)
399 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
400 
401 	PHY_CLRBITS(mac, 0x429, 0xc000);
402 	PHY_SETBITS(mac, 0x1, 0x8000);
403 
404 	PHY_SETBITS(mac, 0x811, 0x2);
405 	PHY_CLRBITS(mac, 0x812, 0x2);
406 	PHY_SETBITS(mac, 0x811, 0x1);
407 	PHY_CLRBITS(mac, 0x812, 0x1);
408 
409 	PHY_SETBITS(mac, 0x814, 0x1);
410 	PHY_CLRBITS(mac, 0x815, 0x1);
411 	PHY_SETBITS(mac, 0x814, 0x2);
412 	PHY_CLRBITS(mac, 0x815, 0x2);
413 
414 	PHY_SETBITS(mac, 0x811, 0xc);
415 	PHY_SETBITS(mac, 0x812, 0xc);
416 	PHY_SETBITS(mac, 0x811, 0x30);
417 	PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
418 
419 	PHY_WRITE(mac, 0x5a, 0x780);
420 	PHY_WRITE(mac, 0x59, 0xc810);
421 	PHY_WRITE(mac, 0x58, 0xd);
422 	PHY_SETBITS(mac, 0xa, 0x2000);
423 
424 	PHY_SETBITS(mac, 0x814, 0x4);
425 	PHY_CLRBITS(mac, 0x815, 0x4);
426 
427 	PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
428 
429 	if (rf->rf_rev == 8) {
430 		loop1_max = 15;
431 		RF_WRITE(mac, 0x43, loop1_max);
432 	} else {
433 		loop1_max = 9;
434 	    	RF_WRITE(mac, 0x52, 0x0);
435 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, loop1_max);
436 	}
437 
438 	bwi_phy_set_bbp_atten(mac, 11);
439 
440 	if (phy->phy_rev >= 3)
441 		PHY_WRITE(mac, 0x80f, 0xc020);
442 	else
443 		PHY_WRITE(mac, 0x80f, 0x8020);
444 	PHY_WRITE(mac, 0x810, 0);
445 
446 	PHY_FILT_SETBITS(mac, 0x2b, 0xffc0, 0x1);
447 	PHY_FILT_SETBITS(mac, 0x2b, 0xc0ff, 0x800);
448 	PHY_SETBITS(mac, 0x811, 0x100);
449 	PHY_CLRBITS(mac, 0x812, 0x3000);
450 
451 	if ((sc->sc_card_flags & BWI_CARD_F_EXT_LNA) &&
452 	    phy->phy_rev >= 7) {
453 		PHY_SETBITS(mac, 0x811, 0x800);
454 		PHY_SETBITS(mac, 0x812, 0x8000);
455 	}
456 	RF_CLRBITS(mac, 0x7a, 0xff08);
457 
458 	/*
459 	 * Find out 'loop1/loop2', which will be used to calculate
460 	 * max loopback gain later
461 	 */
462 	j = 0;
463 	for (i = 0; i < loop1_max; ++i) {
464 		for (j = 0; j < 16; ++j) {
465 			RF_WRITE(mac, 0x43, i);
466 
467 			if (bwi_rf_gain_max_reached(mac, j))
468 				goto loop1_exit;
469 		}
470 	}
471 loop1_exit:
472 	loop1 = i;
473 	loop2 = j;
474 
475 	/*
476 	 * Find out 'trsw', which will be used to calculate
477 	 * TRSW(TX/RX switch) RX gain later
478 	 */
479 	if (loop2 >= 8) {
480 		PHY_SETBITS(mac, 0x812, 0x30);
481 		trsw = 0x1b;
482 		for (i = loop2 - 8; i < 16; ++i) {
483 			trsw -= 3;
484 			if (bwi_rf_gain_max_reached(mac, i))
485 				break;
486 		}
487 	} else {
488 		trsw = 0x18;
489 	}
490 
491 	/*
492 	 * Restore saved PHY/RF registers
493 	 */
494 	/* First 4 saved PHY registers need special processing */
495 	for (i = 4; i < SAVE_PHY_MAX; ++i)
496 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
497 
498 	bwi_phy_set_bbp_atten(mac, mac->mac_tpctl.bbp_atten);
499 
500 	for (i = 0; i < SAVE_RF_MAX; ++i)
501 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
502 
503 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2] | 0x3);
504 	DELAY(10);
505 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2]);
506 	PHY_WRITE(mac, save_phy_regs[3], save_phy[3]);
507 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
508 	PHY_WRITE(mac, save_phy_regs[1], save_phy[1]);
509 
510 	/*
511 	 * Calculate gains
512 	 */
513 	rf->rf_lo_gain = (loop2 * 6) - (loop1 * 4) - 11;
514 	rf->rf_rx_gain = trsw * 2;
515 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_INIT,
516 		"lo gain: %u, rx gain: %u\n",
517 		rf->rf_lo_gain, rf->rf_rx_gain);
518 
519 #undef SAVE_RF_MAX
520 #undef SAVE_PHY_MAX
521 }
522 
523 void
524 bwi_rf_init(struct bwi_mac *mac)
525 {
526 	struct bwi_rf *rf = &mac->mac_rf;
527 
528 	if (rf->rf_type == BWI_RF_T_BCM2060) {
529 		/* TODO: 11A */
530 	} else {
531 		if (rf->rf_flags & BWI_RF_F_INITED)
532 			RF_WRITE(mac, 0x78, rf->rf_calib);
533 		else
534 			bwi_rf_init_bcm2050(mac);
535 	}
536 }
537 
538 static void
539 bwi_rf_off_11a(struct bwi_mac *mac)
540 {
541 	RF_WRITE(mac, 0x4, 0xff);
542 	RF_WRITE(mac, 0x5, 0xfb);
543 
544 	PHY_SETBITS(mac, 0x10, 0x8);
545 	PHY_SETBITS(mac, 0x11, 0x8);
546 
547 	PHY_WRITE(mac, 0x15, 0xaa00);
548 }
549 
550 static void
551 bwi_rf_off_11bg(struct bwi_mac *mac)
552 {
553 	PHY_WRITE(mac, 0x15, 0xaa00);
554 }
555 
556 static void
557 bwi_rf_off_11g_rev5(struct bwi_mac *mac)
558 {
559 	PHY_SETBITS(mac, 0x811, 0x8c);
560 	PHY_CLRBITS(mac, 0x812, 0x8c);
561 }
562 
563 static void
564 bwi_rf_work_around(struct bwi_mac *mac, u_int chan)
565 {
566 	struct bwi_softc *sc = mac->mac_sc;
567 	struct bwi_rf *rf = &mac->mac_rf;
568 
569 	if (chan == IEEE80211_CHAN_ANY) {
570 		device_printf(sc->sc_dev, "%s invalid channel!!\n", __func__);
571 		return;
572 	}
573 
574 	if (rf->rf_type != BWI_RF_T_BCM2050 || rf->rf_rev >= 6)
575 		return;
576 
577 	if (chan <= 10)
578 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan + 4));
579 	else
580 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(1));
581 	DELAY(1000);
582 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
583 }
584 
585 static __inline struct bwi_rf_lo *
586 bwi_rf_lo_find(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
587 {
588 	uint16_t rf_atten, bbp_atten;
589 	int remap_rf_atten;
590 
591 	remap_rf_atten = 1;
592 	if (tpctl == NULL) {
593 		bbp_atten = 2;
594 		rf_atten = 3;
595 	} else {
596 		if (tpctl->tp_ctrl1 == 3)
597 			remap_rf_atten = 0;
598 
599 		bbp_atten = tpctl->bbp_atten;
600 		rf_atten = tpctl->rf_atten;
601 
602 		if (bbp_atten > 6)
603 			bbp_atten = 6;
604 	}
605 
606 	if (remap_rf_atten) {
607 #define MAP_MAX	10
608 		static const uint16_t map[MAP_MAX] =
609 		{ 11, 10, 11, 12, 13, 12, 13, 12, 13, 12 };
610 
611 #if 0
612 		KASSERT(rf_atten < MAP_MAX, ("rf_atten %d", rf_atten));
613 		rf_atten = map[rf_atten];
614 #else
615 		if (rf_atten >= MAP_MAX) {
616 			rf_atten = 0;	/* XXX */
617 		} else {
618 			rf_atten = map[rf_atten];
619 		}
620 #endif
621 #undef MAP_MAX
622 	}
623 
624 	return bwi_get_rf_lo(mac, rf_atten, bbp_atten);
625 }
626 
627 void
628 bwi_rf_lo_adjust(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
629 {
630 	const struct bwi_rf_lo *lo;
631 
632 	lo = bwi_rf_lo_find(mac, tpctl);
633 	RF_LO_WRITE(mac, lo);
634 }
635 
636 static void
637 bwi_rf_lo_write(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
638 {
639 	uint16_t val;
640 
641 	val = (uint8_t)lo->ctrl_lo;
642 	val |= ((uint8_t)lo->ctrl_hi) << 8;
643 
644 	PHY_WRITE(mac, BWI_PHYR_RF_LO, val);
645 }
646 
647 static int
648 bwi_rf_gain_max_reached(struct bwi_mac *mac, int idx)
649 {
650 	PHY_FILT_SETBITS(mac, 0x812, 0xf0ff, idx << 8);
651 	PHY_FILT_SETBITS(mac, 0x15, 0xfff, 0xa000);
652 	PHY_SETBITS(mac, 0x15, 0xf000);
653 
654 	DELAY(20);
655 
656 	return (PHY_READ(mac, 0x2d) >= 0xdfc);
657 }
658 
659 /* XXX use bitmap array */
660 static __inline uint16_t
661 bitswap4(uint16_t val)
662 {
663 	uint16_t ret;
664 
665 	ret = (val & 0x8) >> 3;
666 	ret |= (val & 0x4) >> 1;
667 	ret |= (val & 0x2) << 1;
668 	ret |= (val & 0x1) << 3;
669 	return ret;
670 }
671 
672 static __inline uint16_t
673 bwi_phy812_value(struct bwi_mac *mac, uint16_t lpd)
674 {
675 	struct bwi_softc *sc = mac->mac_sc;
676 	struct bwi_phy *phy = &mac->mac_phy;
677 	struct bwi_rf *rf = &mac->mac_rf;
678 	uint16_t lo_gain, ext_lna, loop;
679 
680 	if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
681 		return 0;
682 
683 	lo_gain = rf->rf_lo_gain;
684 	if (rf->rf_rev == 8)
685 		lo_gain += 0x3e;
686 	else
687 		lo_gain += 0x26;
688 
689 	if (lo_gain >= 0x46) {
690 		lo_gain -= 0x46;
691 		ext_lna = 0x3000;
692 	} else if (lo_gain >= 0x3a) {
693 		lo_gain -= 0x3a;
694 		ext_lna = 0x1000;
695 	} else if (lo_gain >= 0x2e) {
696 		lo_gain -= 0x2e;
697 		ext_lna = 0x2000;
698 	} else {
699 		lo_gain -= 0x10;
700 		ext_lna = 0;
701 	}
702 
703 	for (loop = 0; loop < 16; ++loop) {
704 		lo_gain -= (6 * loop);
705 		if (lo_gain < 6)
706 			break;
707 	}
708 
709 	if (phy->phy_rev >= 7 && (sc->sc_card_flags & BWI_CARD_F_EXT_LNA)) {
710 		if (ext_lna)
711 			ext_lna |= 0x8000;
712 		ext_lna |= (loop << 8);
713 		switch (lpd) {
714 		case 0x011:
715 			return 0x8f92;
716 		case 0x001:
717 			return (0x8092 | ext_lna);
718 		case 0x101:
719 			return (0x2092 | ext_lna);
720 		case 0x100:
721 			return (0x2093 | ext_lna);
722 		default:
723 			panic("unsupported lpd\n");
724 		}
725 	} else {
726 		ext_lna |= (loop << 8);
727 		switch (lpd) {
728 		case 0x011:
729 			return 0xf92;
730 		case 0x001:
731 		case 0x101:
732 			return (0x92 | ext_lna);
733 		case 0x100:
734 			return (0x93 | ext_lna);
735 		default:
736 			panic("unsupported lpd\n");
737 		}
738 	}
739 
740 	panic("never reached\n");
741 	return 0;
742 }
743 
744 void
745 bwi_rf_init_bcm2050(struct bwi_mac *mac)
746 {
747 #define SAVE_RF_MAX		3
748 #define SAVE_PHY_COMM_MAX	4
749 #define SAVE_PHY_11G_MAX	6
750 
751 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
752 	{ 0x0043, 0x0051, 0x0052 };
753 	static const uint16_t save_phy_regs_comm[SAVE_PHY_COMM_MAX] =
754 	{ 0x0015, 0x005a, 0x0059, 0x0058 };
755 	static const uint16_t save_phy_regs_11g[SAVE_PHY_11G_MAX] =
756 	{ 0x0811, 0x0812, 0x0814, 0x0815, 0x0429, 0x0802 };
757 
758 	uint16_t save_rf[SAVE_RF_MAX];
759 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
760 	uint16_t save_phy_11g[SAVE_PHY_11G_MAX];
761 	uint16_t phyr_35, phyr_30 = 0, rfr_78, phyr_80f = 0, phyr_810 = 0;
762 	uint16_t bphy_ctrl = 0, bbp_atten, rf_chan_ex;
763 	uint16_t phy812_val;
764 	uint16_t calib;
765 	uint32_t test_lim, test;
766 	struct bwi_softc *sc = mac->mac_sc;
767 	struct bwi_phy *phy = &mac->mac_phy;
768 	struct bwi_rf *rf = &mac->mac_rf;
769 	int i;
770 
771 	/*
772 	 * Save registers for later restoring
773 	 */
774 	for (i = 0; i < SAVE_RF_MAX; ++i)
775 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
776 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
777 		save_phy_comm[i] = PHY_READ(mac, save_phy_regs_comm[i]);
778 
779 	if (phy->phy_mode == IEEE80211_MODE_11B) {
780 		phyr_30 = PHY_READ(mac, 0x30);
781 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
782 
783 		PHY_WRITE(mac, 0x30, 0xff);
784 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x3f3f);
785 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
786 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
787 			save_phy_11g[i] =
788 				PHY_READ(mac, save_phy_regs_11g[i]);
789 		}
790 
791 		PHY_SETBITS(mac, 0x814, 0x3);
792 		PHY_CLRBITS(mac, 0x815, 0x3);
793 		PHY_CLRBITS(mac, 0x429, 0x8000);
794 		PHY_CLRBITS(mac, 0x802, 0x3);
795 
796 		phyr_80f = PHY_READ(mac, 0x80f);
797 		phyr_810 = PHY_READ(mac, 0x810);
798 
799 		if (phy->phy_rev >= 3)
800 			PHY_WRITE(mac, 0x80f, 0xc020);
801 		else
802 			PHY_WRITE(mac, 0x80f, 0x8020);
803 		PHY_WRITE(mac, 0x810, 0);
804 
805 		phy812_val = bwi_phy812_value(mac, 0x011);
806 		PHY_WRITE(mac, 0x812, phy812_val);
807 		if (phy->phy_rev < 7 ||
808 		    (sc->sc_card_flags & BWI_CARD_F_EXT_LNA) == 0)
809 			PHY_WRITE(mac, 0x811, 0x1b3);
810 		else
811 			PHY_WRITE(mac, 0x811, 0x9b3);
812 	}
813 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
814 
815 	phyr_35 = PHY_READ(mac, 0x35);
816 	PHY_CLRBITS(mac, 0x35, 0x80);
817 
818 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
819 	rf_chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
820 
821 	if (phy->phy_version == 0) {
822 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
823 	} else {
824 		if (phy->phy_version >= 2)
825 			PHY_FILT_SETBITS(mac, 0x3, 0xffbf, 0x40);
826 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
827 	}
828 
829 	calib = bwi_rf_calibval(mac);
830 
831 	if (phy->phy_mode == IEEE80211_MODE_11B)
832 		RF_WRITE(mac, 0x78, 0x26);
833 
834 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
835 		phy812_val = bwi_phy812_value(mac, 0x011);
836 		PHY_WRITE(mac, 0x812, phy812_val);
837 	}
838 
839 	PHY_WRITE(mac, 0x15, 0xbfaf);
840 	PHY_WRITE(mac, 0x2b, 0x1403);
841 
842 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
843 		phy812_val = bwi_phy812_value(mac, 0x001);
844 		PHY_WRITE(mac, 0x812, phy812_val);
845 	}
846 
847 	PHY_WRITE(mac, 0x15, 0xbfa0);
848 
849 	RF_SETBITS(mac, 0x51, 0x4);
850 	if (rf->rf_rev == 8) {
851 		RF_WRITE(mac, 0x43, 0x1f);
852 	} else {
853 		RF_WRITE(mac, 0x52, 0);
854 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
855 	}
856 
857 	test_lim = 0;
858 	PHY_WRITE(mac, 0x58, 0);
859 	for (i = 0; i < 16; ++i) {
860 		PHY_WRITE(mac, 0x5a, 0x480);
861 		PHY_WRITE(mac, 0x59, 0xc810);
862 
863 		PHY_WRITE(mac, 0x58, 0xd);
864 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
865 			phy812_val = bwi_phy812_value(mac, 0x101);
866 			PHY_WRITE(mac, 0x812, phy812_val);
867 		}
868 		PHY_WRITE(mac, 0x15, 0xafb0);
869 		DELAY(10);
870 
871 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
872 			phy812_val = bwi_phy812_value(mac, 0x101);
873 			PHY_WRITE(mac, 0x812, phy812_val);
874 		}
875 		PHY_WRITE(mac, 0x15, 0xefb0);
876 		DELAY(10);
877 
878 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
879 			phy812_val = bwi_phy812_value(mac, 0x100);
880 			PHY_WRITE(mac, 0x812, phy812_val);
881 		}
882 		PHY_WRITE(mac, 0x15, 0xfff0);
883 		DELAY(20);
884 
885 		test_lim += PHY_READ(mac, 0x2d);
886 
887 		PHY_WRITE(mac, 0x58, 0);
888 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
889 			phy812_val = bwi_phy812_value(mac, 0x101);
890 			PHY_WRITE(mac, 0x812, phy812_val);
891 		}
892 		PHY_WRITE(mac, 0x15, 0xafb0);
893 	}
894 	++test_lim;
895 	test_lim >>= 9;
896 
897 	DELAY(10);
898 
899 	test = 0;
900 	PHY_WRITE(mac, 0x58, 0);
901 	for (i = 0; i < 16; ++i) {
902 		int j;
903 
904 		rfr_78 = (bitswap4(i) << 1) | 0x20;
905 		RF_WRITE(mac, 0x78, rfr_78);
906 		DELAY(10);
907 
908 		/* NB: This block is slight different than the above one */
909 		for (j = 0; j < 16; ++j) {
910 			PHY_WRITE(mac, 0x5a, 0xd80);
911 			PHY_WRITE(mac, 0x59, 0xc810);
912 
913 			PHY_WRITE(mac, 0x58, 0xd);
914 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
915 			    phy->phy_rev >= 2) {
916 				phy812_val = bwi_phy812_value(mac, 0x101);
917 				PHY_WRITE(mac, 0x812, phy812_val);
918 			}
919 			PHY_WRITE(mac, 0x15, 0xafb0);
920 			DELAY(10);
921 
922 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
923 			    phy->phy_rev >= 2) {
924 				phy812_val = bwi_phy812_value(mac, 0x101);
925 				PHY_WRITE(mac, 0x812, phy812_val);
926 			}
927 			PHY_WRITE(mac, 0x15, 0xefb0);
928 			DELAY(10);
929 
930 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
931 			    phy->phy_rev >= 2) {
932 				phy812_val = bwi_phy812_value(mac, 0x100);
933 				PHY_WRITE(mac, 0x812, phy812_val);
934 			}
935 			PHY_WRITE(mac, 0x15, 0xfff0);
936 			DELAY(10);
937 
938 			test += PHY_READ(mac, 0x2d);
939 
940 			PHY_WRITE(mac, 0x58, 0);
941 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
942 			    phy->phy_rev >= 2) {
943 				phy812_val = bwi_phy812_value(mac, 0x101);
944 				PHY_WRITE(mac, 0x812, phy812_val);
945 			}
946 			PHY_WRITE(mac, 0x15, 0xafb0);
947 		}
948 
949 		++test;
950 		test >>= 8;
951 
952 		if (test > test_lim)
953 			break;
954 	}
955 	if (i > 15)
956 		rf->rf_calib = rfr_78;
957 	else
958 		rf->rf_calib = calib;
959 	if (rf->rf_calib != 0xffff) {
960 		DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT,
961 			"RF calibration value: 0x%04x\n", rf->rf_calib);
962 		rf->rf_flags |= BWI_RF_F_INITED;
963 	}
964 
965 	/*
966 	 * Restore trashes registers
967 	 */
968 	PHY_WRITE(mac, save_phy_regs_comm[0], save_phy_comm[0]);
969 
970 	for (i = 0; i < SAVE_RF_MAX; ++i) {
971 		int pos = (i + 1) % SAVE_RF_MAX;
972 
973 		RF_WRITE(mac, save_rf_regs[pos], save_rf[pos]);
974 	}
975 	for (i = 1; i < SAVE_PHY_COMM_MAX; ++i)
976 		PHY_WRITE(mac, save_phy_regs_comm[i], save_phy_comm[i]);
977 
978 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
979 	if (phy->phy_version != 0)
980 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, rf_chan_ex);
981 
982 	PHY_WRITE(mac, 0x35, phyr_35);
983 	bwi_rf_work_around(mac, rf->rf_curchan);
984 
985 	if (phy->phy_mode == IEEE80211_MODE_11B) {
986 		PHY_WRITE(mac, 0x30, phyr_30);
987 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
988 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
989 		/* XXX Spec only says when PHY is linked (gmode) */
990 		CSR_CLRBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
991 
992 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
993 			PHY_WRITE(mac, save_phy_regs_11g[i],
994 				  save_phy_11g[i]);
995 		}
996 
997 		PHY_WRITE(mac, 0x80f, phyr_80f);
998 		PHY_WRITE(mac, 0x810, phyr_810);
999 	}
1000 
1001 #undef SAVE_PHY_11G_MAX
1002 #undef SAVE_PHY_COMM_MAX
1003 #undef SAVE_RF_MAX
1004 }
1005 
1006 static uint16_t
1007 bwi_rf_calibval(struct bwi_mac *mac)
1008 {
1009 	/* http://bcm-specs.sipsolutions.net/RCCTable */
1010 	static const uint16_t rf_calibvals[] = {
1011 		0x2, 0x3, 0x1, 0xf, 0x6, 0x7, 0x5, 0xf,
1012 		0xa, 0xb, 0x9, 0xf, 0xe, 0xf, 0xd, 0xf
1013 	};
1014 	uint16_t val, calib;
1015 	int idx;
1016 
1017 	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
1018 	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
1019 	KASSERT(idx < (int)(sizeof(rf_calibvals) / sizeof(rf_calibvals[0])),
1020 	    ("idx %d", idx));
1021 
1022 	calib = rf_calibvals[idx] << 1;
1023 	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
1024 		calib |= 0x1;
1025 	calib |= 0x20;
1026 
1027 	return calib;
1028 }
1029 
1030 static __inline int32_t
1031 _bwi_adjust_devide(int32_t num, int32_t den)
1032 {
1033 	if (num < 0)
1034 		return (num / den);
1035 	else
1036 		return (num + den / 2) / den;
1037 }
1038 
1039 /*
1040  * http://bcm-specs.sipsolutions.net/TSSI_to_DBM_Table
1041  * "calculating table entries"
1042  */
1043 static int
1044 bwi_rf_calc_txpower(int8_t *txpwr, uint8_t idx, const int16_t pa_params[])
1045 {
1046 	int32_t m1, m2, f, dbm;
1047 	int i;
1048 
1049 	m1 = _bwi_adjust_devide(16 * pa_params[0] + idx * pa_params[1], 32);
1050 	m2 = imax(_bwi_adjust_devide(32768 + idx * pa_params[2], 256), 1);
1051 
1052 #define ITER_MAX	16
1053 
1054 	f = 256;
1055 	for (i = 0; i < ITER_MAX; ++i) {
1056 		int32_t q, d;
1057 
1058 		q = _bwi_adjust_devide(
1059 			f * 4096 - _bwi_adjust_devide(m2 * f, 16) * f, 2048);
1060 		d = abs(q - f);
1061 		f = q;
1062 
1063 		if (d < 2)
1064 			break;
1065 	}
1066 	if (i == ITER_MAX)
1067 		return EINVAL;
1068 
1069 #undef ITER_MAX
1070 
1071 	dbm = _bwi_adjust_devide(m1 * f, 8192);
1072 	if (dbm < -127)
1073 		dbm = -127;
1074 	else if (dbm > 128)
1075 		dbm = 128;
1076 
1077 	*txpwr = dbm;
1078 	return 0;
1079 }
1080 
1081 int
1082 bwi_rf_map_txpower(struct bwi_mac *mac)
1083 {
1084 	struct bwi_softc *sc = mac->mac_sc;
1085 	struct bwi_rf *rf = &mac->mac_rf;
1086 	struct bwi_phy *phy = &mac->mac_phy;
1087 	uint16_t sprom_ofs, val, mask;
1088 	int16_t pa_params[3];
1089 	int error = 0, i, ant_gain, reg_txpower_max;
1090 
1091 	/*
1092 	 * Find out max TX power
1093 	 */
1094 	val = bwi_read_sprom(sc, BWI_SPROM_MAX_TXPWR);
1095 	if (phy->phy_mode == IEEE80211_MODE_11A) {
1096 		rf->rf_txpower_max = __SHIFTOUT(val,
1097 				     BWI_SPROM_MAX_TXPWR_MASK_11A);
1098 	} else {
1099 		rf->rf_txpower_max = __SHIFTOUT(val,
1100 				     BWI_SPROM_MAX_TXPWR_MASK_11BG);
1101 
1102 		if ((sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) &&
1103 		    phy->phy_mode == IEEE80211_MODE_11G)
1104 			rf->rf_txpower_max -= 3;
1105 	}
1106 	if (rf->rf_txpower_max <= 0) {
1107 		device_printf(sc->sc_dev, "invalid max txpower in sprom\n");
1108 		rf->rf_txpower_max = 74;
1109 	}
1110 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1111 		"max txpower from sprom: %d dBm\n", rf->rf_txpower_max);
1112 
1113 	/*
1114 	 * Find out region/domain max TX power, which is adjusted
1115 	 * by antenna gain and 1.5 dBm fluctuation as mentioned
1116 	 * in v3 spec.
1117 	 */
1118 	val = bwi_read_sprom(sc, BWI_SPROM_ANT_GAIN);
1119 	if (phy->phy_mode == IEEE80211_MODE_11A)
1120 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11A);
1121 	else
1122 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11BG);
1123 	if (ant_gain == 0xff) {
1124 		device_printf(sc->sc_dev, "invalid antenna gain in sprom\n");
1125 		ant_gain = 2;
1126 	}
1127 	ant_gain *= 4;
1128 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1129 		"ant gain %d dBm\n", ant_gain);
1130 
1131 	reg_txpower_max = 90 - ant_gain - 6;	/* XXX magic number */
1132 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1133 		"region/domain max txpower %d dBm\n", reg_txpower_max);
1134 
1135 	/*
1136 	 * Force max TX power within region/domain TX power limit
1137 	 */
1138 	if (rf->rf_txpower_max > reg_txpower_max)
1139 		rf->rf_txpower_max = reg_txpower_max;
1140 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1141 		"max txpower %d dBm\n", rf->rf_txpower_max);
1142 
1143 	/*
1144 	 * Create TSSI to TX power mapping
1145 	 */
1146 
1147 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301 &&
1148 	    rf->rf_type != BWI_RF_T_BCM2050) {
1149 		rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1150 		bcopy(bwi_txpower_map_11b, rf->rf_txpower_map0,
1151 		      sizeof(rf->rf_txpower_map0));
1152 		goto back;
1153 	}
1154 
1155 #define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
1156 #define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
1157 
1158 	/*
1159 	 * Extract PA parameters
1160 	 */
1161 	if (phy->phy_mode == IEEE80211_MODE_11A)
1162 		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
1163 	else
1164 		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
1165 	for (i = 0; i < N(pa_params); ++i)
1166 		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
1167 
1168 	for (i = 0; i < N(pa_params); ++i) {
1169 		/*
1170 		 * If one of the PA parameters from SPROM is not valid,
1171 		 * fall back to the default values, if there are any.
1172 		 */
1173 		if (!IS_VALID_PA_PARAM(pa_params[i])) {
1174 			const int8_t *txpower_map;
1175 
1176 			if (phy->phy_mode == IEEE80211_MODE_11A) {
1177 				device_printf(sc->sc_dev,
1178 					  "no tssi2dbm table for 11a PHY\n");
1179 				return ENXIO;
1180 			}
1181 
1182 			if (phy->phy_mode == IEEE80211_MODE_11G) {
1183 				DPRINTF(sc,
1184 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1185 				"%s\n", "use default 11g TSSI map");
1186 				txpower_map = bwi_txpower_map_11g;
1187 			} else {
1188 				DPRINTF(sc,
1189 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1190 				"%s\n", "use default 11b TSSI map");
1191 				txpower_map = bwi_txpower_map_11b;
1192 			}
1193 
1194 			rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1195 			bcopy(txpower_map, rf->rf_txpower_map0,
1196 			      sizeof(rf->rf_txpower_map0));
1197 			goto back;
1198 		}
1199 	}
1200 
1201 #undef N
1202 
1203 	/*
1204 	 * All of the PA parameters from SPROM are valid.
1205 	 */
1206 
1207 	/*
1208 	 * Extract idle TSSI from SPROM.
1209 	 */
1210 	val = bwi_read_sprom(sc, BWI_SPROM_IDLE_TSSI);
1211 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1212 		"sprom idle tssi: 0x%04x\n", val);
1213 
1214 	if (phy->phy_mode == IEEE80211_MODE_11A)
1215 		mask = BWI_SPROM_IDLE_TSSI_MASK_11A;
1216 	else
1217 		mask = BWI_SPROM_IDLE_TSSI_MASK_11BG;
1218 
1219 	rf->rf_idle_tssi0 = (int)__SHIFTOUT(val, mask);
1220 	if (!IS_VALID_PA_PARAM(rf->rf_idle_tssi0))
1221 		rf->rf_idle_tssi0 = 62;
1222 
1223 #undef IS_VALID_PA_PARAM
1224 
1225 	/*
1226 	 * Calculate TX power map, which is indexed by TSSI
1227 	 */
1228 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1229 		"%s\n", "TSSI-TX power map:");
1230 	for (i = 0; i < BWI_TSSI_MAX; ++i) {
1231 		error = bwi_rf_calc_txpower(&rf->rf_txpower_map0[i], i,
1232 					    pa_params);
1233 		if (error) {
1234 			device_printf(sc->sc_dev,
1235 				  "bwi_rf_calc_txpower failed\n");
1236 			break;
1237 		}
1238 
1239 #ifdef BWI_DEBUG
1240 		if (i != 0 && i % 8 == 0) {
1241 			_DPRINTF(sc,
1242 			BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1243 			"%s\n", "");
1244 		}
1245 #endif
1246 		_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1247 			 "%d ", rf->rf_txpower_map0[i]);
1248 	}
1249 	_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1250 		 "%s\n", "");
1251 back:
1252 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1253 		"idle tssi0: %d\n", rf->rf_idle_tssi0);
1254 	return error;
1255 }
1256 
1257 static void
1258 bwi_rf_lo_update_11g(struct bwi_mac *mac)
1259 {
1260 	struct bwi_softc *sc = mac->mac_sc;
1261 	struct ifnet *ifp = sc->sc_ifp;
1262 	struct bwi_rf *rf = &mac->mac_rf;
1263 	struct bwi_phy *phy = &mac->mac_phy;
1264 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1265 	struct rf_saveregs regs;
1266 	uint16_t ant_div, chan_ex;
1267 	uint8_t devi_ctrl;
1268 	u_int orig_chan;
1269 
1270 	/*
1271 	 * Save RF/PHY registers for later restoration
1272 	 */
1273 	orig_chan = rf->rf_curchan;
1274 	bzero(&regs, sizeof(regs));
1275 
1276 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1277 		SAVE_PHY_REG(mac, &regs, 429);
1278 		SAVE_PHY_REG(mac, &regs, 802);
1279 
1280 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1281 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1282 	}
1283 
1284 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1285 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div | 0x8000);
1286 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1287 
1288 	SAVE_PHY_REG(mac, &regs, 15);
1289 	SAVE_PHY_REG(mac, &regs, 2a);
1290 	SAVE_PHY_REG(mac, &regs, 35);
1291 	SAVE_PHY_REG(mac, &regs, 60);
1292 	SAVE_RF_REG(mac, &regs, 43);
1293 	SAVE_RF_REG(mac, &regs, 7a);
1294 	SAVE_RF_REG(mac, &regs, 52);
1295 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1296 		SAVE_PHY_REG(mac, &regs, 811);
1297 		SAVE_PHY_REG(mac, &regs, 812);
1298 		SAVE_PHY_REG(mac, &regs, 814);
1299 		SAVE_PHY_REG(mac, &regs, 815);
1300 	}
1301 
1302 	/* Force to channel 6 */
1303 	bwi_rf_set_chan(mac, 6, 0);
1304 
1305 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1306 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1307 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1308 		bwi_mac_dummy_xmit(mac);
1309 	}
1310 	RF_WRITE(mac, 0x43, 0x6);
1311 
1312 	bwi_phy_set_bbp_atten(mac, 2);
1313 
1314 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0);
1315 
1316 	PHY_WRITE(mac, 0x2e, 0x7f);
1317 	PHY_WRITE(mac, 0x80f, 0x78);
1318 	PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
1319 	RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
1320 	PHY_WRITE(mac, 0x2b, 0x203);
1321 	PHY_WRITE(mac, 0x2a, 0x8a3);
1322 
1323 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1324 		PHY_WRITE(mac, 0x814, regs.phy_814 | 0x3);
1325 		PHY_WRITE(mac, 0x815, regs.phy_815 & 0xfffc);
1326 		PHY_WRITE(mac, 0x811, 0x1b3);
1327 		PHY_WRITE(mac, 0x812, 0xb2);
1328 	}
1329 
1330 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1331 		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
1332 	PHY_WRITE(mac, 0x80f, 0x8078);
1333 
1334 	/*
1335 	 * Measure all RF LO
1336 	 */
1337 	devi_ctrl = _bwi_rf_lo_update_11g(mac, regs.rf_7a);
1338 
1339 	/*
1340 	 * Restore saved RF/PHY registers
1341 	 */
1342 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1343 		PHY_WRITE(mac, 0x15, 0xe300);
1344 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa0);
1345 		DELAY(5);
1346 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa2);
1347 		DELAY(2);
1348 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa3);
1349 	} else {
1350 		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
1351 	}
1352 
1353 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1354 		tpctl = NULL;
1355 	bwi_rf_lo_adjust(mac, tpctl);
1356 
1357 	PHY_WRITE(mac, 0x2e, 0x807f);
1358 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1359 		PHY_WRITE(mac, 0x2f, 0x202);
1360 	else
1361 		PHY_WRITE(mac, 0x2f, 0x101);
1362 
1363 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1364 
1365 	RESTORE_PHY_REG(mac, &regs, 15);
1366 	RESTORE_PHY_REG(mac, &regs, 2a);
1367 	RESTORE_PHY_REG(mac, &regs, 35);
1368 	RESTORE_PHY_REG(mac, &regs, 60);
1369 
1370 	RESTORE_RF_REG(mac, &regs, 43);
1371 	RESTORE_RF_REG(mac, &regs, 7a);
1372 
1373 	regs.rf_52 &= 0xf0;
1374 	regs.rf_52 |= (RF_READ(mac, 0x52) & 0xf);
1375 	RF_WRITE(mac, 0x52, regs.rf_52);
1376 
1377 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1378 
1379 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1380 		RESTORE_PHY_REG(mac, &regs, 811);
1381 		RESTORE_PHY_REG(mac, &regs, 812);
1382 		RESTORE_PHY_REG(mac, &regs, 814);
1383 		RESTORE_PHY_REG(mac, &regs, 815);
1384 		RESTORE_PHY_REG(mac, &regs, 429);
1385 		RESTORE_PHY_REG(mac, &regs, 802);
1386 	}
1387 
1388 	bwi_rf_set_chan(mac, orig_chan, 1);
1389 }
1390 
1391 static uint32_t
1392 bwi_rf_lo_devi_measure(struct bwi_mac *mac, uint16_t ctrl)
1393 {
1394 	struct bwi_phy *phy = &mac->mac_phy;
1395 	uint32_t devi = 0;
1396 	int i;
1397 
1398 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1399 		ctrl <<= 8;
1400 
1401 	for (i = 0; i < 8; ++i) {
1402 		if (phy->phy_flags & BWI_PHY_F_LINKED) {
1403 			PHY_WRITE(mac, 0x15, 0xe300);
1404 			PHY_WRITE(mac, 0x812, ctrl | 0xb0);
1405 			DELAY(5);
1406 			PHY_WRITE(mac, 0x812, ctrl | 0xb2);
1407 			DELAY(2);
1408 			PHY_WRITE(mac, 0x812, ctrl | 0xb3);
1409 			DELAY(4);
1410 			PHY_WRITE(mac, 0x15, 0xf300);
1411 		} else {
1412 			PHY_WRITE(mac, 0x15, ctrl | 0xefa0);
1413 			DELAY(2);
1414 			PHY_WRITE(mac, 0x15, ctrl | 0xefe0);
1415 			DELAY(4);
1416 			PHY_WRITE(mac, 0x15, ctrl | 0xffe0);
1417 		}
1418 		DELAY(8);
1419 		devi += PHY_READ(mac, 0x2d);
1420 	}
1421 	return devi;
1422 }
1423 
1424 static uint16_t
1425 bwi_rf_get_tp_ctrl2(struct bwi_mac *mac)
1426 {
1427 	uint32_t devi_min;
1428 	uint16_t tp_ctrl2 = 0;
1429 	int i;
1430 
1431 	RF_WRITE(mac, 0x52, 0);
1432 	DELAY(10);
1433 	devi_min = bwi_rf_lo_devi_measure(mac, 0);
1434 
1435 	for (i = 0; i < 16; ++i) {
1436 		uint32_t devi;
1437 
1438 		RF_WRITE(mac, 0x52, i);
1439 		DELAY(10);
1440 		devi = bwi_rf_lo_devi_measure(mac, 0);
1441 
1442 		if (devi < devi_min) {
1443 			devi_min = devi;
1444 			tp_ctrl2 = i;
1445 		}
1446 	}
1447 	return tp_ctrl2;
1448 }
1449 
1450 static uint8_t
1451 _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
1452 {
1453 #define RF_ATTEN_LISTSZ	14
1454 #define BBP_ATTEN_MAX	4	/* half */
1455 
1456 	static const int rf_atten_list[RF_ATTEN_LISTSZ] =
1457 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 1, 2, 3, 4 };
1458 	static const int rf_atten_init_list[RF_ATTEN_LISTSZ] =
1459         { 0, 3, 1, 5, 7, 3, 2, 0, 4, 6, -1, -1, -1, -1 };
1460 	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
1461 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
1462 
1463 	struct ifnet *ifp = mac->mac_sc->sc_ifp;
1464 	struct bwi_rf_lo lo_save, *lo;
1465 	uint8_t devi_ctrl = 0;
1466 	int idx, adj_rf7a = 0;
1467 
1468 	bzero(&lo_save, sizeof(lo_save));
1469 	for (idx = 0; idx < RF_ATTEN_LISTSZ; ++idx) {
1470 		int init_rf_atten = rf_atten_init_list[idx];
1471 		int rf_atten = rf_atten_list[idx];
1472 		int bbp_atten;
1473 
1474 		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
1475 			uint16_t tp_ctrl2, rf7a;
1476 
1477 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1478 				if (idx == 0) {
1479 					bzero(&lo_save, sizeof(lo_save));
1480 				} else if (init_rf_atten < 0) {
1481 					lo = bwi_get_rf_lo(mac,
1482 						rf_atten, 2 * bbp_atten);
1483 					bcopy(lo, &lo_save, sizeof(lo_save));
1484 				} else {
1485 					lo = bwi_get_rf_lo(mac,
1486 						init_rf_atten, 0);
1487 					bcopy(lo, &lo_save, sizeof(lo_save));
1488 				}
1489 
1490 				devi_ctrl = 0;
1491 				adj_rf7a = 0;
1492 
1493 				/*
1494 				 * XXX
1495 				 * Linux driver overflows 'val'
1496 				 */
1497 				if (init_rf_atten >= 0) {
1498 					int val;
1499 
1500 					val = rf_atten * 2 + bbp_atten;
1501 					if (val > 14) {
1502 						adj_rf7a = 1;
1503 						if (val > 17)
1504 							devi_ctrl = 1;
1505 						if (val > 19)
1506 							devi_ctrl = 2;
1507 					}
1508 				}
1509 			} else {
1510 				lo = bwi_get_rf_lo(mac,
1511 					rf_atten, 2 * bbp_atten);
1512 				if (!bwi_rf_lo_isused(mac, lo))
1513 					continue;
1514 				bcopy(lo, &lo_save, sizeof(lo_save));
1515 
1516 				devi_ctrl = 3;
1517 				adj_rf7a = 0;
1518 			}
1519 
1520 			RF_WRITE(mac, BWI_RFR_ATTEN, rf_atten);
1521 
1522 			tp_ctrl2 = mac->mac_tpctl.tp_ctrl2;
1523 			if (init_rf_atten < 0)
1524 				tp_ctrl2 |= (3 << 4);
1525 			RF_WRITE(mac, BWI_RFR_TXPWR, tp_ctrl2);
1526 
1527 			DELAY(10);
1528 
1529 			bwi_phy_set_bbp_atten(mac, bbp_atten * 2);
1530 
1531 			rf7a = orig_rf7a & 0xfff0;
1532 			if (adj_rf7a)
1533 				rf7a |= 0x8;
1534 			RF_WRITE(mac, 0x7a, rf7a);
1535 
1536 			lo = bwi_get_rf_lo(mac,
1537 				rf_lo_measure_order[idx], bbp_atten * 2);
1538 			bwi_rf_lo_measure_11g(mac, &lo_save, lo, devi_ctrl);
1539 		}
1540 	}
1541 	return devi_ctrl;
1542 
1543 #undef RF_ATTEN_LISTSZ
1544 #undef BBP_ATTEN_MAX
1545 }
1546 
1547 static void
1548 bwi_rf_lo_measure_11g(struct bwi_mac *mac, const struct bwi_rf_lo *src_lo,
1549 	struct bwi_rf_lo *dst_lo, uint8_t devi_ctrl)
1550 {
1551 #define LO_ADJUST_MIN	1
1552 #define LO_ADJUST_MAX	8
1553 #define LO_ADJUST(hi, lo)	{ .ctrl_hi = hi, .ctrl_lo = lo }
1554 	static const struct bwi_rf_lo rf_lo_adjust[LO_ADJUST_MAX] = {
1555 		LO_ADJUST(1,	1),
1556 		LO_ADJUST(1,	0),
1557 		LO_ADJUST(1,	-1),
1558 		LO_ADJUST(0,	-1),
1559 		LO_ADJUST(-1,	-1),
1560 		LO_ADJUST(-1,	0),
1561 		LO_ADJUST(-1,	1),
1562 		LO_ADJUST(0,	1)
1563 	};
1564 #undef LO_ADJUST
1565 
1566 	struct bwi_rf_lo lo_min;
1567 	uint32_t devi_min;
1568 	int found, loop_count, adjust_state;
1569 
1570 	bcopy(src_lo, &lo_min, sizeof(lo_min));
1571 	RF_LO_WRITE(mac, &lo_min);
1572 	devi_min = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1573 
1574 	loop_count = 12;	/* XXX */
1575 	adjust_state = 0;
1576 	do {
1577 		struct bwi_rf_lo lo_base;
1578 		int i, fin;
1579 
1580 		found = 0;
1581 		if (adjust_state == 0) {
1582 			i = LO_ADJUST_MIN;
1583 			fin = LO_ADJUST_MAX;
1584 		} else if (adjust_state % 2 == 0) {
1585 			i = adjust_state - 1;
1586 			fin = adjust_state + 1;
1587 		} else {
1588 			i = adjust_state - 2;
1589 			fin = adjust_state + 2;
1590 		}
1591 
1592 		if (i < LO_ADJUST_MIN)
1593 			i += LO_ADJUST_MAX;
1594 		KASSERT(i <= LO_ADJUST_MAX && i >= LO_ADJUST_MIN, ("i %d", i));
1595 
1596 		if (fin > LO_ADJUST_MAX)
1597 			fin -= LO_ADJUST_MAX;
1598 		KASSERT(fin <= LO_ADJUST_MAX && fin >= LO_ADJUST_MIN,
1599 		    ("fin %d", fin));
1600 
1601 		bcopy(&lo_min, &lo_base, sizeof(lo_base));
1602 		for (;;) {
1603 			struct bwi_rf_lo lo;
1604 
1605 			lo.ctrl_hi = lo_base.ctrl_hi +
1606 				rf_lo_adjust[i - 1].ctrl_hi;
1607 			lo.ctrl_lo = lo_base.ctrl_lo +
1608 				rf_lo_adjust[i - 1].ctrl_lo;
1609 
1610 			if (abs(lo.ctrl_lo) < 9 && abs(lo.ctrl_hi) < 9) {
1611 				uint32_t devi;
1612 
1613 				RF_LO_WRITE(mac, &lo);
1614 				devi = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1615 				if (devi < devi_min) {
1616 					devi_min = devi;
1617 					adjust_state = i;
1618 					found = 1;
1619 					bcopy(&lo, &lo_min, sizeof(lo_min));
1620 				}
1621 			}
1622 			if (i == fin)
1623 				break;
1624 			if (i == LO_ADJUST_MAX)
1625 				i = LO_ADJUST_MIN;
1626 			else
1627 				++i;
1628 		}
1629 	} while (loop_count-- && found);
1630 
1631 	bcopy(&lo_min, dst_lo, sizeof(*dst_lo));
1632 
1633 #undef LO_ADJUST_MIN
1634 #undef LO_ADJUST_MAX
1635 }
1636 
1637 static void
1638 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *mac)
1639 {
1640 #define SAVE_RF_MAX	3
1641 #define SAVE_PHY_MAX	8
1642 
1643 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1644 	{ 0x7a, 0x52, 0x43 };
1645 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] =
1646 	{ 0x30, 0x26, 0x15, 0x2a, 0x20, 0x5a, 0x59, 0x58 };
1647 
1648 	struct bwi_softc *sc = mac->mac_sc;
1649 	struct bwi_rf *rf = &mac->mac_rf;
1650 	struct bwi_phy *phy = &mac->mac_phy;
1651 	uint16_t save_rf[SAVE_RF_MAX];
1652 	uint16_t save_phy[SAVE_PHY_MAX];
1653 	uint16_t ant_div, bbp_atten, chan_ex;
1654 	int16_t nrssi[2];
1655 	int i;
1656 
1657 	/*
1658 	 * Save RF/PHY registers for later restoration
1659 	 */
1660 	for (i = 0; i < SAVE_RF_MAX; ++i)
1661 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1662 	for (i = 0; i < SAVE_PHY_MAX; ++i)
1663 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
1664 
1665 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1666 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1667 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1668 
1669 	/*
1670 	 * Calculate nrssi0
1671 	 */
1672 	if (phy->phy_rev >= 5)
1673 		RF_CLRBITS(mac, 0x7a, 0xff80);
1674 	else
1675 		RF_CLRBITS(mac, 0x7a, 0xfff0);
1676 	PHY_WRITE(mac, 0x30, 0xff);
1677 
1678 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x7f7f);
1679 
1680 	PHY_WRITE(mac, 0x26, 0);
1681 	PHY_SETBITS(mac, 0x15, 0x20);
1682 	PHY_WRITE(mac, 0x2a, 0x8a3);
1683 	RF_SETBITS(mac, 0x7a, 0x80);
1684 
1685 	nrssi[0] = (int16_t)PHY_READ(mac, 0x27);
1686 
1687 	/*
1688 	 * Calculate nrssi1
1689 	 */
1690 	RF_CLRBITS(mac, 0x7a, 0xff80);
1691 	if (phy->phy_version >= 2)
1692 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x40);
1693 	else if (phy->phy_version == 0)
1694 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
1695 	else
1696 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0xdfff);
1697 
1698 	PHY_WRITE(mac, 0x20, 0x3f3f);
1699 	PHY_WRITE(mac, 0x15, 0xf330);
1700 
1701 	RF_WRITE(mac, 0x5a, 0x60);
1702 	RF_CLRBITS(mac, 0x43, 0xff0f);
1703 
1704 	PHY_WRITE(mac, 0x5a, 0x480);
1705 	PHY_WRITE(mac, 0x59, 0x810);
1706 	PHY_WRITE(mac, 0x58, 0xd);
1707 
1708 	DELAY(20);
1709 
1710 	nrssi[1] = (int16_t)PHY_READ(mac, 0x27);
1711 
1712 	/*
1713 	 * Restore saved RF/PHY registers
1714 	 */
1715 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
1716 	RF_WRITE(mac, save_rf_regs[0], save_rf[0]);
1717 
1718 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1719 
1720 	for (i = 1; i < 4; ++i)
1721 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1722 
1723 	bwi_rf_work_around(mac, rf->rf_curchan);
1724 
1725 	if (phy->phy_version != 0)
1726 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1727 
1728 	for (; i < SAVE_PHY_MAX; ++i)
1729 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1730 
1731 	for (i = 1; i < SAVE_RF_MAX; ++i)
1732 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1733 
1734 	/*
1735 	 * Install calculated narrow RSSI values
1736 	 */
1737 	if (nrssi[0] == nrssi[1])
1738 		rf->rf_nrssi_slope = 0x10000;
1739 	else
1740 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
1741 	if (nrssi[0] <= -4) {
1742 		rf->rf_nrssi[0] = nrssi[0];
1743 		rf->rf_nrssi[1] = nrssi[1];
1744 	}
1745 
1746 #undef SAVE_RF_MAX
1747 #undef SAVE_PHY_MAX
1748 }
1749 
1750 static void
1751 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *mac)
1752 {
1753 #define SAVE_RF_MAX		2
1754 #define SAVE_PHY_COMM_MAX	10
1755 #define SAVE_PHY6_MAX		8
1756 
1757 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1758 	{ 0x7a, 0x43 };
1759 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
1760 		0x0001, 0x0811, 0x0812, 0x0814,
1761 		0x0815, 0x005a, 0x0059, 0x0058,
1762 		0x000a, 0x0003
1763 	};
1764 	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
1765 		0x002e, 0x002f, 0x080f, 0x0810,
1766 		0x0801, 0x0060, 0x0014, 0x0478
1767 	};
1768 
1769 	struct bwi_phy *phy = &mac->mac_phy;
1770 	uint16_t save_rf[SAVE_RF_MAX];
1771 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1772 	uint16_t save_phy6[SAVE_PHY6_MAX];
1773 	uint16_t rf7b = 0xffff;
1774 	int16_t nrssi;
1775 	int i, phy6_idx = 0;
1776 
1777 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1778 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1779 	for (i = 0; i < SAVE_RF_MAX; ++i)
1780 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1781 
1782 	PHY_CLRBITS(mac, 0x429, 0x8000);
1783 	PHY_FILT_SETBITS(mac, 0x1, 0x3fff, 0x4000);
1784 	PHY_SETBITS(mac, 0x811, 0xc);
1785 	PHY_FILT_SETBITS(mac, 0x812, 0xfff3, 0x4);
1786 	PHY_CLRBITS(mac, 0x802, 0x3);
1787 
1788 	if (phy->phy_rev >= 6) {
1789 		for (i = 0; i < SAVE_PHY6_MAX; ++i)
1790 			save_phy6[i] = PHY_READ(mac, save_phy6_regs[i]);
1791 
1792 		PHY_WRITE(mac, 0x2e, 0);
1793 		PHY_WRITE(mac, 0x2f, 0);
1794 		PHY_WRITE(mac, 0x80f, 0);
1795 		PHY_WRITE(mac, 0x810, 0);
1796 		PHY_SETBITS(mac, 0x478, 0x100);
1797 		PHY_SETBITS(mac, 0x801, 0x40);
1798 		PHY_SETBITS(mac, 0x60, 0x40);
1799 		PHY_SETBITS(mac, 0x14, 0x200);
1800 	}
1801 
1802 	RF_SETBITS(mac, 0x7a, 0x70);
1803 	RF_SETBITS(mac, 0x7a, 0x80);
1804 
1805 	DELAY(30);
1806 
1807 	nrssi = bwi_nrssi_11g(mac);
1808 	if (nrssi == 31) {
1809 		for (i = 7; i >= 4; --i) {
1810 			RF_WRITE(mac, 0x7b, i);
1811 			DELAY(20);
1812 			nrssi = bwi_nrssi_11g(mac);
1813 			if (nrssi < 31 && rf7b == 0xffff)
1814 				rf7b = i;
1815 		}
1816 		if (rf7b == 0xffff)
1817 			rf7b = 4;
1818 	} else {
1819 		struct bwi_gains gains;
1820 
1821 		RF_CLRBITS(mac, 0x7a, 0xff80);
1822 
1823 		PHY_SETBITS(mac, 0x814, 0x1);
1824 		PHY_CLRBITS(mac, 0x815, 0x1);
1825 		PHY_SETBITS(mac, 0x811, 0xc);
1826 		PHY_SETBITS(mac, 0x812, 0xc);
1827 		PHY_SETBITS(mac, 0x811, 0x30);
1828 		PHY_SETBITS(mac, 0x812, 0x30);
1829 		PHY_WRITE(mac, 0x5a, 0x480);
1830 		PHY_WRITE(mac, 0x59, 0x810);
1831 		PHY_WRITE(mac, 0x58, 0xd);
1832 		if (phy->phy_version == 0)
1833 			PHY_WRITE(mac, 0x3, 0x122);
1834 		else
1835 			PHY_SETBITS(mac, 0xa, 0x2000);
1836 		PHY_SETBITS(mac, 0x814, 0x4);
1837 		PHY_CLRBITS(mac, 0x815, 0x4);
1838 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
1839 		RF_SETBITS(mac, 0x7a, 0xf);
1840 
1841 		bzero(&gains, sizeof(gains));
1842 		gains.tbl_gain1 = 3;
1843 		gains.tbl_gain2 = 0;
1844 		gains.phy_gain = 1;
1845 		bwi_set_gains(mac, &gains);
1846 
1847 		RF_FILT_SETBITS(mac, 0x43, 0xf0, 0xf);
1848 		DELAY(30);
1849 
1850 		nrssi = bwi_nrssi_11g(mac);
1851 		if (nrssi == -32) {
1852 			for (i = 0; i < 4; ++i) {
1853 				RF_WRITE(mac, 0x7b, i);
1854 				DELAY(20);
1855 				nrssi = bwi_nrssi_11g(mac);
1856 				if (nrssi > -31 && rf7b == 0xffff)
1857 					rf7b = i;
1858 			}
1859 			if (rf7b == 0xffff)
1860 				rf7b = 3;
1861 		} else {
1862 			rf7b = 0;
1863 		}
1864 	}
1865 	RF_WRITE(mac, 0x7b, rf7b);
1866 
1867 	/*
1868 	 * Restore saved RF/PHY registers
1869 	 */
1870 	if (phy->phy_rev >= 6) {
1871 		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
1872 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1873 				  save_phy6[phy6_idx]);
1874 		}
1875 	}
1876 
1877 	/* Saved PHY registers 0, 1, 2 are handled later */
1878 	for (i = 3; i < SAVE_PHY_COMM_MAX; ++i)
1879 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
1880 
1881 	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
1882 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1883 
1884 	PHY_SETBITS(mac, 0x802, 0x3);
1885 	PHY_SETBITS(mac, 0x429, 0x8000);
1886 
1887 	bwi_set_gains(mac, NULL);
1888 
1889 	if (phy->phy_rev >= 6) {
1890 		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
1891 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1892 				  save_phy6[phy6_idx]);
1893 		}
1894 	}
1895 
1896 	PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
1897 	PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
1898 	PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
1899 
1900 #undef SAVE_RF_MAX
1901 #undef SAVE_PHY_COMM_MAX
1902 #undef SAVE_PHY6_MAX
1903 }
1904 
1905 static void
1906 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *mac)
1907 {
1908 #define SAVE_RF_MAX		3
1909 #define SAVE_PHY_COMM_MAX	4
1910 #define SAVE_PHY3_MAX		8
1911 
1912 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1913 	{ 0x7a, 0x52, 0x43 };
1914 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
1915 	{ 0x15, 0x5a, 0x59, 0x58 };
1916 	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
1917 		0x002e, 0x002f, 0x080f, 0x0810,
1918 		0x0801, 0x0060, 0x0014, 0x0478
1919 	};
1920 
1921 	struct bwi_softc *sc = mac->mac_sc;
1922 	struct bwi_phy *phy = &mac->mac_phy;
1923 	struct bwi_rf *rf = &mac->mac_rf;
1924 	uint16_t save_rf[SAVE_RF_MAX];
1925 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1926 	uint16_t save_phy3[SAVE_PHY3_MAX];
1927 	uint16_t ant_div, bbp_atten, chan_ex;
1928 	struct bwi_gains gains;
1929 	int16_t nrssi[2];
1930 	int i, phy3_idx = 0;
1931 
1932 	if (rf->rf_rev >= 9)
1933 		return;
1934 	else if (rf->rf_rev == 8)
1935 		bwi_rf_set_nrssi_ofs_11g(mac);
1936 
1937 	PHY_CLRBITS(mac, 0x429, 0x8000);
1938 	PHY_CLRBITS(mac, 0x802, 0x3);
1939 
1940 	/*
1941 	 * Save RF/PHY registers for later restoration
1942 	 */
1943 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1944 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
1945 
1946 	for (i = 0; i < SAVE_RF_MAX; ++i)
1947 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1948 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1949 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1950 
1951 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1952 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1953 
1954 	if (phy->phy_rev >= 3) {
1955 		for (i = 0; i < SAVE_PHY3_MAX; ++i)
1956 			save_phy3[i] = PHY_READ(mac, save_phy3_regs[i]);
1957 
1958 		PHY_WRITE(mac, 0x2e, 0);
1959 		PHY_WRITE(mac, 0x810, 0);
1960 
1961 		if (phy->phy_rev == 4 || phy->phy_rev == 6 ||
1962 		    phy->phy_rev == 7) {
1963 			PHY_SETBITS(mac, 0x478, 0x100);
1964 			PHY_SETBITS(mac, 0x810, 0x40);
1965 		} else if (phy->phy_rev == 3 || phy->phy_rev == 5) {
1966 			PHY_CLRBITS(mac, 0x810, 0x40);
1967 		}
1968 
1969 		PHY_SETBITS(mac, 0x60, 0x40);
1970 		PHY_SETBITS(mac, 0x14, 0x200);
1971 	}
1972 
1973 	/*
1974 	 * Calculate nrssi0
1975 	 */
1976 	RF_SETBITS(mac, 0x7a, 0x70);
1977 
1978 	bzero(&gains, sizeof(gains));
1979 	gains.tbl_gain1 = 0;
1980 	gains.tbl_gain2 = 8;
1981 	gains.phy_gain = 0;
1982 	bwi_set_gains(mac, &gains);
1983 
1984 	RF_CLRBITS(mac, 0x7a, 0xff08);
1985 	if (phy->phy_rev >= 2) {
1986 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x30);
1987 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
1988 	}
1989 
1990 	RF_SETBITS(mac, 0x7a, 0x80);
1991 	DELAY(20);
1992 	nrssi[0] = bwi_nrssi_11g(mac);
1993 
1994 	/*
1995 	 * Calculate nrssi1
1996 	 */
1997 	RF_CLRBITS(mac, 0x7a, 0xff80);
1998 	if (phy->phy_version >= 2)
1999 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
2000 	CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
2001 
2002 	RF_SETBITS(mac, 0x7a, 0xf);
2003 	PHY_WRITE(mac, 0x15, 0xf330);
2004 	if (phy->phy_rev >= 2) {
2005 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x20);
2006 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x20);
2007 	}
2008 
2009 	bzero(&gains, sizeof(gains));
2010 	gains.tbl_gain1 = 3;
2011 	gains.tbl_gain2 = 0;
2012 	gains.phy_gain = 1;
2013 	bwi_set_gains(mac, &gains);
2014 
2015 	if (rf->rf_rev == 8) {
2016 		RF_WRITE(mac, 0x43, 0x1f);
2017 	} else {
2018 		RF_FILT_SETBITS(mac, 0x52, 0xff0f, 0x60);
2019 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
2020 	}
2021 	PHY_WRITE(mac, 0x5a, 0x480);
2022 	PHY_WRITE(mac, 0x59, 0x810);
2023 	PHY_WRITE(mac, 0x58, 0xd);
2024 	DELAY(20);
2025 
2026 	nrssi[1] = bwi_nrssi_11g(mac);
2027 
2028 	/*
2029 	 * Install calculated narrow RSSI values
2030 	 */
2031 	if (nrssi[1] == nrssi[0])
2032 		rf->rf_nrssi_slope = 0x10000;
2033 	else
2034 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
2035 	if (nrssi[0] >= -4) {
2036 		rf->rf_nrssi[0] = nrssi[1];
2037 		rf->rf_nrssi[1] = nrssi[0];
2038 	}
2039 
2040 	/*
2041 	 * Restore saved RF/PHY registers
2042 	 */
2043 	if (phy->phy_rev >= 3) {
2044 		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
2045 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2046 				  save_phy3[phy3_idx]);
2047 		}
2048 	}
2049 	if (phy->phy_rev >= 2) {
2050 		PHY_CLRBITS(mac, 0x812, 0x30);
2051 		PHY_CLRBITS(mac, 0x811, 0x30);
2052 	}
2053 
2054 	for (i = 0; i < SAVE_RF_MAX; ++i)
2055 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
2056 
2057 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
2058 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
2059 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
2060 
2061 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
2062 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
2063 
2064 	bwi_rf_work_around(mac, rf->rf_curchan);
2065 	PHY_SETBITS(mac, 0x802, 0x3);
2066 	bwi_set_gains(mac, NULL);
2067 	PHY_SETBITS(mac, 0x429, 0x8000);
2068 
2069 	if (phy->phy_rev >= 3) {
2070 		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
2071 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2072 				  save_phy3[phy3_idx]);
2073 		}
2074 	}
2075 
2076 	bwi_rf_init_sw_nrssi_table(mac);
2077 	bwi_rf_set_nrssi_thr_11g(mac);
2078 
2079 #undef SAVE_RF_MAX
2080 #undef SAVE_PHY_COMM_MAX
2081 #undef SAVE_PHY3_MAX
2082 }
2083 
2084 static void
2085 bwi_rf_init_sw_nrssi_table(struct bwi_mac *mac)
2086 {
2087 	struct bwi_rf *rf = &mac->mac_rf;
2088 	int d, i;
2089 
2090 	d = 0x1f - rf->rf_nrssi[0];
2091 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2092 		int val;
2093 
2094 		val = (((i - d) * rf->rf_nrssi_slope) / 0x10000) + 0x3a;
2095 		if (val < 0)
2096 			val = 0;
2097 		else if (val > 0x3f)
2098 			val = 0x3f;
2099 
2100 		rf->rf_nrssi_table[i] = val;
2101 	}
2102 }
2103 
2104 void
2105 bwi_rf_init_hw_nrssi_table(struct bwi_mac *mac, uint16_t adjust)
2106 {
2107 	int i;
2108 
2109 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2110 		int16_t val;
2111 
2112 		val = bwi_nrssi_read(mac, i);
2113 
2114 		val -= adjust;
2115 		if (val < -32)
2116 			val = -32;
2117 		else if (val > 31)
2118 			val = 31;
2119 
2120 		bwi_nrssi_write(mac, i, val);
2121 	}
2122 }
2123 
2124 static void
2125 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *mac)
2126 {
2127 	struct bwi_rf *rf = &mac->mac_rf;
2128 	int32_t thr;
2129 
2130 	if (rf->rf_type != BWI_RF_T_BCM2050 ||
2131 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0)
2132 		return;
2133 
2134 	/*
2135 	 * Calculate nrssi threshold
2136 	 */
2137 	if (rf->rf_rev >= 6) {
2138 		thr = (rf->rf_nrssi[1] - rf->rf_nrssi[0]) * 32;
2139 		thr += 20 * (rf->rf_nrssi[0] + 1);
2140 		thr /= 40;
2141 	} else {
2142 		thr = rf->rf_nrssi[1] - 5;
2143 	}
2144 	if (thr < 0)
2145 		thr = 0;
2146 	else if (thr > 0x3e)
2147 		thr = 0x3e;
2148 
2149 	PHY_READ(mac, BWI_PHYR_NRSSI_THR_11B);	/* dummy read */
2150 	PHY_WRITE(mac, BWI_PHYR_NRSSI_THR_11B, (((uint16_t)thr) << 8) | 0x1c);
2151 
2152 	if (rf->rf_rev >= 6) {
2153 		PHY_WRITE(mac, 0x87, 0xe0d);
2154 		PHY_WRITE(mac, 0x86, 0xc0b);
2155 		PHY_WRITE(mac, 0x85, 0xa09);
2156 		PHY_WRITE(mac, 0x84, 0x808);
2157 		PHY_WRITE(mac, 0x83, 0x808);
2158 		PHY_WRITE(mac, 0x82, 0x604);
2159 		PHY_WRITE(mac, 0x81, 0x302);
2160 		PHY_WRITE(mac, 0x80, 0x100);
2161 	}
2162 }
2163 
2164 static __inline int32_t
2165 _nrssi_threshold(const struct bwi_rf *rf, int32_t val)
2166 {
2167 	val *= (rf->rf_nrssi[1] - rf->rf_nrssi[0]);
2168 	val += (rf->rf_nrssi[0] << 6);
2169 	if (val < 32)
2170 		val += 31;
2171 	else
2172 		val += 32;
2173 	val >>= 6;
2174 	if (val < -31)
2175 		val = -31;
2176 	else if (val > 31)
2177 		val = 31;
2178 	return val;
2179 }
2180 
2181 static void
2182 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *mac)
2183 {
2184 	int32_t thr1, thr2;
2185 	uint16_t thr;
2186 
2187 	/*
2188 	 * Find the two nrssi thresholds
2189 	 */
2190 	if ((mac->mac_phy.phy_flags & BWI_PHY_F_LINKED) == 0 ||
2191 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
2192 	    	int16_t nrssi;
2193 
2194 		nrssi = bwi_nrssi_read(mac, 0x20);
2195 		if (nrssi >= 32)
2196 			nrssi -= 64;
2197 
2198 		if (nrssi < 3) {
2199 			thr1 = 0x2b;
2200 			thr2 = 0x27;
2201 		} else {
2202 			thr1 = 0x2d;
2203 			thr2 = 0x2b;
2204 		}
2205 	} else {
2206 		/* TODO Interfere mode */
2207 		thr1 = _nrssi_threshold(&mac->mac_rf, 0x11);
2208 		thr2 = _nrssi_threshold(&mac->mac_rf, 0xe);
2209 	}
2210 
2211 #define NRSSI_THR1_MASK	__BITS(5, 0)
2212 #define NRSSI_THR2_MASK	__BITS(11, 6)
2213 
2214 	thr = __SHIFTIN((uint32_t)thr1, NRSSI_THR1_MASK) |
2215 	      __SHIFTIN((uint32_t)thr2, NRSSI_THR2_MASK);
2216 	PHY_FILT_SETBITS(mac, BWI_PHYR_NRSSI_THR_11G, 0xf000, thr);
2217 
2218 #undef NRSSI_THR1_MASK
2219 #undef NRSSI_THR2_MASK
2220 }
2221 
2222 void
2223 bwi_rf_clear_tssi(struct bwi_mac *mac)
2224 {
2225 	/* XXX use function pointer */
2226 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
2227 		/* TODO:11A */
2228 	} else {
2229 		uint16_t val;
2230 		int i;
2231 
2232 		val = __SHIFTIN(BWI_INVALID_TSSI, BWI_LO_TSSI_MASK) |
2233 		      __SHIFTIN(BWI_INVALID_TSSI, BWI_HI_TSSI_MASK);
2234 
2235 		for (i = 0; i < 2; ++i) {
2236 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2237 				BWI_COMM_MOBJ_TSSI_DS + (i * 2), val);
2238 		}
2239 
2240 		for (i = 0; i < 2; ++i) {
2241 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2242 				BWI_COMM_MOBJ_TSSI_OFDM + (i * 2), val);
2243 		}
2244 	}
2245 }
2246 
2247 void
2248 bwi_rf_clear_state(struct bwi_rf *rf)
2249 {
2250 	int i;
2251 
2252 	rf->rf_flags &= ~BWI_RF_CLEAR_FLAGS;
2253 	bzero(rf->rf_lo, sizeof(rf->rf_lo));
2254 	bzero(rf->rf_lo_used, sizeof(rf->rf_lo_used));
2255 
2256 	rf->rf_nrssi_slope = 0;
2257 	rf->rf_nrssi[0] = BWI_INVALID_NRSSI;
2258 	rf->rf_nrssi[1] = BWI_INVALID_NRSSI;
2259 
2260 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i)
2261 		rf->rf_nrssi_table[i] = i;
2262 
2263 	rf->rf_lo_gain = 0;
2264 	rf->rf_rx_gain = 0;
2265 
2266 	bcopy(rf->rf_txpower_map0, rf->rf_txpower_map,
2267 	      sizeof(rf->rf_txpower_map));
2268 	rf->rf_idle_tssi = rf->rf_idle_tssi0;
2269 }
2270 
2271 static void
2272 bwi_rf_on_11a(struct bwi_mac *mac)
2273 {
2274 	/* TODO:11A */
2275 }
2276 
2277 static void
2278 bwi_rf_on_11bg(struct bwi_mac *mac)
2279 {
2280 	struct bwi_phy *phy = &mac->mac_phy;
2281 
2282 	PHY_WRITE(mac, 0x15, 0x8000);
2283 	PHY_WRITE(mac, 0x15, 0xcc00);
2284 	if (phy->phy_flags & BWI_PHY_F_LINKED)
2285 		PHY_WRITE(mac, 0x15, 0xc0);
2286 	else
2287 		PHY_WRITE(mac, 0x15, 0);
2288 
2289 	bwi_rf_set_chan(mac, 6 /* XXX */, 1);
2290 }
2291 
2292 void
2293 bwi_rf_set_ant_mode(struct bwi_mac *mac, int ant_mode)
2294 {
2295 	struct bwi_softc *sc = mac->mac_sc;
2296 	struct bwi_phy *phy = &mac->mac_phy;
2297 	uint16_t val;
2298 
2299 	KASSERT(ant_mode == BWI_ANT_MODE_0 ||
2300 		ant_mode == BWI_ANT_MODE_1 ||
2301 		ant_mode == BWI_ANT_MODE_AUTO, ("ant_mode %d", ant_mode));
2302 
2303 	HFLAGS_CLRBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2304 
2305 	if (phy->phy_mode == IEEE80211_MODE_11B) {
2306 		/* NOTE: v4/v3 conflicts, take v3 */
2307 		if (mac->mac_rev == 2)
2308 			val = BWI_ANT_MODE_AUTO;
2309 		else
2310 			val = ant_mode;
2311 		val <<= 7;
2312 		PHY_FILT_SETBITS(mac, 0x3e2, 0xfe7f, val);
2313 	} else {	/* 11a/g */
2314 		/* XXX reg/value naming */
2315 		val = ant_mode << 7;
2316 		PHY_FILT_SETBITS(mac, 0x401, 0x7e7f, val);
2317 
2318 		if (ant_mode == BWI_ANT_MODE_AUTO)
2319 			PHY_CLRBITS(mac, 0x42b, 0x100);
2320 
2321 		if (phy->phy_mode == IEEE80211_MODE_11A) {
2322 			/* TODO:11A */
2323 		} else {	/* 11g */
2324 			if (ant_mode == BWI_ANT_MODE_AUTO)
2325 				PHY_SETBITS(mac, 0x48c, 0x2000);
2326 			else
2327 				PHY_CLRBITS(mac, 0x48c, 0x2000);
2328 
2329 			if (phy->phy_rev >= 2) {
2330 				PHY_SETBITS(mac, 0x461, 0x10);
2331 				PHY_FILT_SETBITS(mac, 0x4ad, 0xff00, 0x15);
2332 				if (phy->phy_rev == 2) {
2333 					PHY_WRITE(mac, 0x427, 0x8);
2334 				} else {
2335 					PHY_FILT_SETBITS(mac, 0x427,
2336 							 0xff00, 0x8);
2337 				}
2338 
2339 				if (phy->phy_rev >= 6)
2340 					PHY_WRITE(mac, 0x49b, 0xdc);
2341 			}
2342 		}
2343 	}
2344 
2345 	/* XXX v4 set AUTO_ANTDIV unconditionally */
2346 	if (ant_mode == BWI_ANT_MODE_AUTO)
2347 		HFLAGS_SETBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2348 
2349 	val = ant_mode << 8;
2350 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_BEACON,
2351 			    0xfc3f, val);
2352 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_ACK,
2353 			    0xfc3f, val);
2354 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_PROBE_RESP,
2355 			    0xfc3f, val);
2356 
2357 	/* XXX what's these */
2358 	if (phy->phy_mode == IEEE80211_MODE_11B)
2359 		CSR_SETBITS_2(sc, 0x5e, 0x4);
2360 
2361 	CSR_WRITE_4(sc, 0x100, 0x1000000);
2362 	if (mac->mac_rev < 5)
2363 		CSR_WRITE_4(sc, 0x10c, 0x1000000);
2364 
2365 	mac->mac_rf.rf_ant_mode = ant_mode;
2366 }
2367 
2368 int
2369 bwi_rf_get_latest_tssi(struct bwi_mac *mac, int8_t tssi[], uint16_t ofs)
2370 {
2371 	int i;
2372 
2373 	for (i = 0; i < 4; ) {
2374 		uint16_t val;
2375 
2376 		val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs + i);
2377 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_LO_TSSI_MASK);
2378 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_HI_TSSI_MASK);
2379 	}
2380 
2381 	for (i = 0; i < 4; ++i) {
2382 		if (tssi[i] == BWI_INVALID_TSSI)
2383 			return EINVAL;
2384 	}
2385 	return 0;
2386 }
2387 
2388 int
2389 bwi_rf_tssi2dbm(struct bwi_mac *mac, int8_t tssi, int8_t *txpwr)
2390 {
2391 	struct bwi_rf *rf = &mac->mac_rf;
2392 	int pwr_idx;
2393 
2394 	pwr_idx = rf->rf_idle_tssi + (int)tssi - rf->rf_base_tssi;
2395 #if 0
2396 	if (pwr_idx < 0 || pwr_idx >= BWI_TSSI_MAX)
2397 		return EINVAL;
2398 #else
2399 	if (pwr_idx < 0)
2400 		pwr_idx = 0;
2401 	else if (pwr_idx >= BWI_TSSI_MAX)
2402 		pwr_idx = BWI_TSSI_MAX - 1;
2403 #endif
2404 
2405 	*txpwr = rf->rf_txpower_map[pwr_idx];
2406 	return 0;
2407 }
2408 
2409 static int
2410 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2411 {
2412 	uint16_t flags1, flags3;
2413 	int rssi, lna_gain;
2414 
2415 	rssi = hdr->rxh_rssi;
2416 	flags1 = le16toh(hdr->rxh_flags1);
2417 	flags3 = le16toh(hdr->rxh_flags3);
2418 
2419 	if (flags1 & BWI_RXH_F1_OFDM) {
2420 		if (rssi > 127)
2421 			rssi -= 256;
2422 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2423 			rssi += 17;
2424 		else
2425 			rssi -= 4;
2426 		return rssi;
2427 	}
2428 
2429 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2430 		struct bwi_rf *rf = &mac->mac_rf;
2431 
2432 		if (rssi >= BWI_NRSSI_TBLSZ)
2433 			rssi = BWI_NRSSI_TBLSZ - 1;
2434 
2435 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
2436 		rssi -= 67;
2437 	} else {
2438 		rssi = ((31 - rssi) * -149) / 128;
2439 		rssi -= 68;
2440 	}
2441 
2442 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
2443 		return rssi;
2444 
2445 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2446 		rssi += 20;
2447 
2448 	lna_gain = __SHIFTOUT(le16toh(hdr->rxh_phyinfo),
2449 			      BWI_RXH_PHYINFO_LNAGAIN);
2450 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_RX,
2451 		"lna_gain %d, phyinfo 0x%04x\n",
2452 		lna_gain, le16toh(hdr->rxh_phyinfo));
2453 	switch (lna_gain) {
2454 	case 0:
2455 		rssi += 27;
2456 		break;
2457 	case 1:
2458 		rssi += 6;
2459 		break;
2460 	case 2:
2461 		rssi += 12;
2462 		break;
2463 	case 3:
2464 		/*
2465 		 * XXX
2466 		 * According to v3 spec, we should do _nothing_ here,
2467 		 * but it seems that the result RSSI will be too low
2468 		 * (relative to what ath(4) says).  Raise it a little
2469 		 * bit.
2470 		 */
2471 		rssi += 5;
2472 		break;
2473 	default:
2474 		panic("impossible lna gain %d", lna_gain);
2475 	}
2476 	return rssi;
2477 }
2478 
2479 static int
2480 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2481 {
2482 	uint16_t flags1;
2483 	int rssi;
2484 
2485 	rssi = (((int)hdr->rxh_rssi - 11) * 103) / 64;
2486 
2487 	flags1 = le16toh(hdr->rxh_flags1);
2488 	if (flags1 & BWI_RXH_F1_BCM2053_RSSI)
2489 		rssi -= 109;
2490 	else
2491 		rssi -= 83;
2492 	return rssi;
2493 }
2494 
2495 static int
2496 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2497 {
2498 	int rssi;
2499 
2500 	rssi = hdr->rxh_rssi;
2501 	if (rssi > 127)
2502 		rssi -= 256;
2503 	return rssi;
2504 }
2505 
2506 static int
2507 bwi_rf_calc_noise_bcm2050(struct bwi_mac *mac)
2508 {
2509 	uint16_t val;
2510 	int noise;
2511 
2512 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2513 	noise = (int)val;	/* XXX check bounds? */
2514 
2515 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2516 		struct bwi_rf *rf = &mac->mac_rf;
2517 
2518 		if (noise >= BWI_NRSSI_TBLSZ)
2519 			noise = BWI_NRSSI_TBLSZ - 1;
2520 
2521 		noise = ((31 - (int)rf->rf_nrssi_table[noise]) * -131) / 128;
2522 		noise -= 67;
2523 	} else {
2524 		noise = ((31 - noise) * -149) / 128;
2525 		noise -= 68;
2526 	}
2527 	return noise;
2528 }
2529 
2530 static int
2531 bwi_rf_calc_noise_bcm2053(struct bwi_mac *mac)
2532 {
2533 	uint16_t val;
2534 	int noise;
2535 
2536 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2537 	noise = (int)val;	/* XXX check bounds? */
2538 
2539 	noise = ((noise - 11) * 103) / 64;
2540 	noise -= 109;
2541 	return noise;
2542 }
2543 
2544 static int
2545 bwi_rf_calc_noise_bcm2060(struct bwi_mac *mac)
2546 {
2547 	/* XXX Dont know how to calc */
2548 	return (BWI_NOISE_FLOOR);
2549 }
2550 
2551 static uint16_t
2552 bwi_rf_lo_measure_11b(struct bwi_mac *mac)
2553 {
2554 	uint16_t val;
2555 	int i;
2556 
2557 	val = 0;
2558 	for (i = 0; i < 10; ++i) {
2559 		PHY_WRITE(mac, 0x15, 0xafa0);
2560 		DELAY(1);
2561 		PHY_WRITE(mac, 0x15, 0xefa0);
2562 		DELAY(10);
2563 		PHY_WRITE(mac, 0x15, 0xffa0);
2564 		DELAY(40);
2565 
2566 		val += PHY_READ(mac, 0x2c);
2567 	}
2568 	return val;
2569 }
2570 
2571 static void
2572 bwi_rf_lo_update_11b(struct bwi_mac *mac)
2573 {
2574 	struct bwi_softc *sc = mac->mac_sc;
2575 	struct bwi_rf *rf = &mac->mac_rf;
2576 	struct rf_saveregs regs;
2577 	uint16_t rf_val, phy_val, min_val, val;
2578 	uint16_t rf52, bphy_ctrl;
2579 	int i;
2580 
2581 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT, "%s enter\n", __func__);
2582 
2583 	bzero(&regs, sizeof(regs));
2584 	bphy_ctrl = 0;
2585 
2586 	/*
2587 	 * Save RF/PHY registers for later restoration
2588 	 */
2589 	SAVE_PHY_REG(mac, &regs, 15);
2590 	rf52 = RF_READ(mac, 0x52) & 0xfff0;
2591 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2592 		SAVE_PHY_REG(mac, &regs, 0a);
2593 		SAVE_PHY_REG(mac, &regs, 2a);
2594 		SAVE_PHY_REG(mac, &regs, 35);
2595 		SAVE_PHY_REG(mac, &regs, 03);
2596 		SAVE_PHY_REG(mac, &regs, 01);
2597 		SAVE_PHY_REG(mac, &regs, 30);
2598 
2599 		SAVE_RF_REG(mac, &regs, 43);
2600 		SAVE_RF_REG(mac, &regs, 7a);
2601 
2602 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
2603 
2604 		SAVE_RF_REG(mac, &regs, 52);
2605 		regs.rf_52 &= 0xf0;
2606 
2607 		PHY_WRITE(mac, 0x30, 0xff);
2608 		CSR_WRITE_2(sc, BWI_PHY_CTRL, 0x3f3f);
2609 		PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
2610 		RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
2611 	}
2612 
2613 	PHY_WRITE(mac, 0x15, 0xb000);
2614 
2615 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2616 		PHY_WRITE(mac, 0x2b, 0x203);
2617 		PHY_WRITE(mac, 0x2a, 0x8a3);
2618 	} else {
2619 		PHY_WRITE(mac, 0x2b, 0x1402);
2620 	}
2621 
2622 	/*
2623 	 * Setup RF signal
2624 	 */
2625 	rf_val = 0;
2626 	min_val = UINT16_MAX;
2627 
2628 	for (i = 0; i < 4; ++i) {
2629 		RF_WRITE(mac, 0x52, rf52 | i);
2630 		bwi_rf_lo_measure_11b(mac);	/* Ignore return value */
2631 	}
2632 	for (i = 0; i < 10; ++i) {
2633 		RF_WRITE(mac, 0x52, rf52 | i);
2634 
2635 		val = bwi_rf_lo_measure_11b(mac) / 10;
2636 		if (val < min_val) {
2637 			min_val = val;
2638 			rf_val = i;
2639 		}
2640 	}
2641 	RF_WRITE(mac, 0x52, rf52 | rf_val);
2642 
2643 	/*
2644 	 * Setup PHY signal
2645 	 */
2646 	phy_val = 0;
2647 	min_val = UINT16_MAX;
2648 
2649 	for (i = -4; i < 5; i += 2) {
2650 		int j;
2651 
2652 		for (j = -4; j < 5; j += 2) {
2653 			uint16_t phy2f;
2654 
2655 			phy2f = (0x100 * i) + j;
2656 			if (j < 0)
2657 				phy2f += 0x100;
2658 			PHY_WRITE(mac, 0x2f, phy2f);
2659 
2660 			val = bwi_rf_lo_measure_11b(mac) / 10;
2661 			if (val < min_val) {
2662 				min_val = val;
2663 				phy_val = phy2f;
2664 			}
2665 		}
2666 	}
2667 	PHY_WRITE(mac, 0x2f, phy_val + 0x101);
2668 
2669 	/*
2670 	 * Restore saved RF/PHY registers
2671 	 */
2672 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2673 		RESTORE_PHY_REG(mac, &regs, 0a);
2674 		RESTORE_PHY_REG(mac, &regs, 2a);
2675 		RESTORE_PHY_REG(mac, &regs, 35);
2676 		RESTORE_PHY_REG(mac, &regs, 03);
2677 		RESTORE_PHY_REG(mac, &regs, 01);
2678 		RESTORE_PHY_REG(mac, &regs, 30);
2679 
2680 		RESTORE_RF_REG(mac, &regs, 43);
2681 		RESTORE_RF_REG(mac, &regs, 7a);
2682 
2683 		RF_FILT_SETBITS(mac, 0x52, 0xf, regs.rf_52);
2684 
2685 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
2686 	}
2687 	RESTORE_PHY_REG(mac, &regs, 15);
2688 
2689 	bwi_rf_work_around(mac, rf->rf_curchan);
2690 }
2691