xref: /openbsd/sys/dev/ic/ar9003.c (revision 09467b48)
1 /*	$OpenBSD: ar9003.c,v 1.50 2020/02/17 20:57:58 claudio Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2010 Atheros Communications Inc.
6  *
7  * Permission to use, copy, modify, and/or distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Atheros 802.11a/g/n chipsets.
22  * Routines for AR9003 family.
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/malloc.h>
34 #include <sys/queue.h>
35 #include <sys/timeout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/stdint.h>	/* uintptr_t */
39 #include <sys/endian.h>
40 
41 #include <machine/bus.h>
42 
43 #if NBPFILTER > 0
44 #include <net/bpf.h>
45 #endif
46 #include <net/if.h>
47 #include <net/if_media.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/if_ether.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_amrr.h>
54 #include <net80211/ieee80211_mira.h>
55 #include <net80211/ieee80211_radiotap.h>
56 
57 #include <dev/ic/athnreg.h>
58 #include <dev/ic/athnvar.h>
59 
60 #include <dev/ic/ar9003reg.h>
61 
62 int	ar9003_attach(struct athn_softc *);
63 int	ar9003_read_eep_word(struct athn_softc *, uint32_t, uint16_t *);
64 int	ar9003_read_eep_data(struct athn_softc *, uint32_t, void *, int);
65 int	ar9003_read_otp_word(struct athn_softc *, uint32_t, uint32_t *);
66 int	ar9003_read_otp_data(struct athn_softc *, uint32_t, void *, int);
67 int	ar9003_find_rom(struct athn_softc *);
68 int	ar9003_restore_rom_block(struct athn_softc *, uint8_t, uint8_t,
69 	    const uint8_t *, int);
70 int	ar9003_read_rom(struct athn_softc *);
71 int	ar9003_gpio_read(struct athn_softc *, int);
72 void	ar9003_gpio_write(struct athn_softc *, int, int);
73 void	ar9003_gpio_config_input(struct athn_softc *, int);
74 void	ar9003_gpio_config_output(struct athn_softc *, int, int);
75 void	ar9003_rfsilent_init(struct athn_softc *);
76 int	ar9003_dma_alloc(struct athn_softc *);
77 void	ar9003_dma_free(struct athn_softc *);
78 int	ar9003_tx_alloc(struct athn_softc *);
79 void	ar9003_tx_free(struct athn_softc *);
80 int	ar9003_rx_alloc(struct athn_softc *, int, int);
81 void	ar9003_rx_free(struct athn_softc *, int);
82 void	ar9003_reset_txsring(struct athn_softc *);
83 void	ar9003_rx_enable(struct athn_softc *);
84 void	ar9003_rx_radiotap(struct athn_softc *, struct mbuf *,
85 	    struct ar_rx_status *);
86 int	ar9003_rx_process(struct athn_softc *, int, struct mbuf_list *);
87 void	ar9003_rx_intr(struct athn_softc *, int);
88 int	ar9003_tx_process(struct athn_softc *);
89 void	ar9003_tx_intr(struct athn_softc *);
90 int	ar9003_swba_intr(struct athn_softc *);
91 int	ar9003_intr(struct athn_softc *);
92 int	ar9003_tx(struct athn_softc *, struct mbuf *, struct ieee80211_node *,
93 	    int);
94 void	ar9003_set_rf_mode(struct athn_softc *, struct ieee80211_channel *);
95 int	ar9003_rf_bus_request(struct athn_softc *);
96 void	ar9003_rf_bus_release(struct athn_softc *);
97 void	ar9003_set_phy(struct athn_softc *, struct ieee80211_channel *,
98 	    struct ieee80211_channel *);
99 void	ar9003_set_delta_slope(struct athn_softc *, struct ieee80211_channel *,
100 	    struct ieee80211_channel *);
101 void	ar9003_enable_antenna_diversity(struct athn_softc *);
102 void	ar9003_init_baseband(struct athn_softc *);
103 void	ar9003_disable_phy(struct athn_softc *);
104 void	ar9003_init_chains(struct athn_softc *);
105 void	ar9003_set_rxchains(struct athn_softc *);
106 void	ar9003_read_noisefloor(struct athn_softc *, int16_t *, int16_t *);
107 void	ar9003_write_noisefloor(struct athn_softc *, int16_t *, int16_t *);
108 int	ar9003_get_noisefloor(struct athn_softc *);
109 void	ar9003_apply_noisefloor(struct athn_softc *);
110 void	ar9003_bb_load_noisefloor(struct athn_softc *);
111 void	ar9003_do_noisefloor_calib(struct athn_softc *);
112 void	ar9003_init_noisefloor_calib(struct athn_softc *);
113 int	ar9003_init_calib(struct athn_softc *);
114 void	ar9003_do_calib(struct athn_softc *);
115 void	ar9003_next_calib(struct athn_softc *);
116 void	ar9003_calib_iq(struct athn_softc *);
117 int	ar9003_get_iq_corr(struct athn_softc *, int32_t[], int32_t[]);
118 int	ar9003_calib_tx_iq(struct athn_softc *);
119 void	ar9003_paprd_calib(struct athn_softc *, struct ieee80211_channel *);
120 int	ar9003_get_desired_txgain(struct athn_softc *, int, int);
121 void	ar9003_force_txgain(struct athn_softc *, uint32_t);
122 void	ar9003_set_training_gain(struct athn_softc *, int);
123 int	ar9003_paprd_tx_tone(struct athn_softc *);
124 int	ar9003_compute_predistortion(struct athn_softc *, const uint32_t *,
125 	    const uint32_t *);
126 void	ar9003_enable_predistorter(struct athn_softc *, int);
127 void	ar9003_paprd_enable(struct athn_softc *);
128 void	ar9003_paprd_tx_tone_done(struct athn_softc *);
129 void	ar9003_write_txpower(struct athn_softc *, int16_t power[]);
130 void	ar9003_reset_rx_gain(struct athn_softc *, struct ieee80211_channel *);
131 void	ar9003_reset_tx_gain(struct athn_softc *, struct ieee80211_channel *);
132 void	ar9003_hw_init(struct athn_softc *, struct ieee80211_channel *,
133 	    struct ieee80211_channel *);
134 void	ar9003_get_lg_tpow(struct athn_softc *, struct ieee80211_channel *,
135 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_leg *,
136 	    int, uint8_t[]);
137 void	ar9003_get_ht_tpow(struct athn_softc *, struct ieee80211_channel *,
138 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_ht *,
139 	    int, uint8_t[]);
140 void	ar9003_set_noise_immunity_level(struct athn_softc *, int);
141 void	ar9003_enable_ofdm_weak_signal(struct athn_softc *);
142 void	ar9003_disable_ofdm_weak_signal(struct athn_softc *);
143 void	ar9003_set_cck_weak_signal(struct athn_softc *, int);
144 void	ar9003_set_firstep_level(struct athn_softc *, int);
145 void	ar9003_set_spur_immunity_level(struct athn_softc *, int);
146 
147 /* Extern functions. */
148 void	athn_stop(struct ifnet *, int);
149 int	athn_interpolate(int, int, int, int, int);
150 int	athn_txtime(struct athn_softc *, int, int, u_int);
151 void	athn_inc_tx_trigger_level(struct athn_softc *);
152 int	athn_tx_pending(struct athn_softc *, int);
153 void	athn_stop_tx_dma(struct athn_softc *, int);
154 void	athn_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
155 void	athn_config_pcie(struct athn_softc *);
156 void	athn_config_nonpcie(struct athn_softc *);
157 uint8_t	athn_chan2fbin(struct ieee80211_channel *);
158 
159 
160 int
161 ar9003_attach(struct athn_softc *sc)
162 {
163 	struct athn_ops *ops = &sc->ops;
164 	int error;
165 
166 	/* Set callbacks for AR9003 family. */
167 	ops->gpio_read = ar9003_gpio_read;
168 	ops->gpio_write = ar9003_gpio_write;
169 	ops->gpio_config_input = ar9003_gpio_config_input;
170 	ops->gpio_config_output = ar9003_gpio_config_output;
171 	ops->rfsilent_init = ar9003_rfsilent_init;
172 
173 	ops->dma_alloc = ar9003_dma_alloc;
174 	ops->dma_free = ar9003_dma_free;
175 	ops->rx_enable = ar9003_rx_enable;
176 	ops->intr = ar9003_intr;
177 	ops->tx = ar9003_tx;
178 
179 	ops->set_rf_mode = ar9003_set_rf_mode;
180 	ops->rf_bus_request = ar9003_rf_bus_request;
181 	ops->rf_bus_release = ar9003_rf_bus_release;
182 	ops->set_phy = ar9003_set_phy;
183 	ops->set_delta_slope = ar9003_set_delta_slope;
184 	ops->enable_antenna_diversity = ar9003_enable_antenna_diversity;
185 	ops->init_baseband = ar9003_init_baseband;
186 	ops->disable_phy = ar9003_disable_phy;
187 	ops->set_rxchains = ar9003_set_rxchains;
188 	ops->noisefloor_calib = ar9003_do_noisefloor_calib;
189 	ops->init_noisefloor_calib = ar9003_init_noisefloor_calib;
190 	ops->get_noisefloor = ar9003_get_noisefloor;
191 	ops->apply_noisefloor = ar9003_apply_noisefloor;
192 	ops->do_calib = ar9003_do_calib;
193 	ops->next_calib = ar9003_next_calib;
194 	ops->hw_init = ar9003_hw_init;
195 
196 	ops->set_noise_immunity_level = ar9003_set_noise_immunity_level;
197 	ops->enable_ofdm_weak_signal = ar9003_enable_ofdm_weak_signal;
198 	ops->disable_ofdm_weak_signal = ar9003_disable_ofdm_weak_signal;
199 	ops->set_cck_weak_signal = ar9003_set_cck_weak_signal;
200 	ops->set_firstep_level = ar9003_set_firstep_level;
201 	ops->set_spur_immunity_level = ar9003_set_spur_immunity_level;
202 
203 	/* Set MAC registers offsets. */
204 	sc->obs_off = AR_OBS;
205 	sc->gpio_input_en_off = AR_GPIO_INPUT_EN_VAL;
206 
207 	if (!(sc->flags & ATHN_FLAG_PCIE))
208 		athn_config_nonpcie(sc);
209 	else
210 		athn_config_pcie(sc);
211 
212 	/* Determine ROM type and location. */
213 	if ((error = ar9003_find_rom(sc)) != 0) {
214 		printf("%s: could not find ROM\n", sc->sc_dev.dv_xname);
215 		return (error);
216 	}
217 	/* Read entire ROM content in memory. */
218 	if ((error = ar9003_read_rom(sc)) != 0) {
219 		printf("%s: could not read ROM\n", sc->sc_dev.dv_xname);
220 		return (error);
221 	}
222 
223 	/* Determine if it is a non-enterprise AR9003 card. */
224 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_MPSD)
225 		sc->flags |= ATHN_FLAG_NON_ENTERPRISE;
226 
227 	ops->setup(sc);
228 	return (0);
229 }
230 
231 /*
232  * Read 16-bit word from EEPROM.
233  */
234 int
235 ar9003_read_eep_word(struct athn_softc *sc, uint32_t addr, uint16_t *val)
236 {
237 	uint32_t reg;
238 	int ntries;
239 
240 	reg = AR_READ(sc, AR_EEPROM_OFFSET(addr));
241 	for (ntries = 0; ntries < 1000; ntries++) {
242 		reg = AR_READ(sc, AR_EEPROM_STATUS_DATA);
243 		if (!(reg & (AR_EEPROM_STATUS_DATA_BUSY |
244 		    AR_EEPROM_STATUS_DATA_PROT_ACCESS))) {
245 			*val = MS(reg, AR_EEPROM_STATUS_DATA_VAL);
246 			return (0);
247 		}
248 		DELAY(10);
249 	}
250 	*val = 0xffff;
251 	return (ETIMEDOUT);
252 }
253 
254 /*
255  * Read an arbitrary number of bytes at a specified address in EEPROM.
256  * NB: The address may not be 16-bit aligned.
257  */
258 int
259 ar9003_read_eep_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
260 {
261 	uint8_t *dst = buf;
262 	uint16_t val;
263 	int error;
264 
265 	if (len > 0 && (addr & 1)) {
266 		/* Deal with non-aligned reads. */
267 		addr >>= 1;
268 		error = ar9003_read_eep_word(sc, addr, &val);
269 		if (error != 0)
270 			return (error);
271 		*dst++ = val & 0xff;
272 		addr--;
273 		len--;
274 	} else
275 		addr >>= 1;
276 	for (; len >= 2; addr--, len -= 2) {
277 		error = ar9003_read_eep_word(sc, addr, &val);
278 		if (error != 0)
279 			return (error);
280 		*dst++ = val >> 8;
281 		*dst++ = val & 0xff;
282 	}
283 	if (len > 0) {
284 		error = ar9003_read_eep_word(sc, addr, &val);
285 		if (error != 0)
286 			return (error);
287 		*dst++ = val >> 8;
288 	}
289 	return (0);
290 }
291 
292 /*
293  * Read 32-bit word from OTPROM.
294  */
295 int
296 ar9003_read_otp_word(struct athn_softc *sc, uint32_t addr, uint32_t *val)
297 {
298 	uint32_t reg;
299 	int ntries;
300 
301 	reg = AR_READ(sc, AR_OTP_BASE(addr));
302 	for (ntries = 0; ntries < 1000; ntries++) {
303 		reg = AR_READ(sc, AR_OTP_STATUS);
304 		if (MS(reg, AR_OTP_STATUS_TYPE) == AR_OTP_STATUS_VALID) {
305 			*val = AR_READ(sc, AR_OTP_READ_DATA);
306 			return (0);
307 		}
308 		DELAY(10);
309 	}
310 	return (ETIMEDOUT);
311 }
312 
313 /*
314  * Read an arbitrary number of bytes at a specified address in OTPROM.
315  * NB: The address may not be 32-bit aligned.
316  */
317 int
318 ar9003_read_otp_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
319 {
320 	uint8_t *dst = buf;
321 	uint32_t val;
322 	int error;
323 
324 	/* NB: not optimal for non-aligned reads, but correct. */
325 	for (; len > 0; addr--, len--) {
326 		error = ar9003_read_otp_word(sc, addr >> 2, &val);
327 		if (error != 0)
328 			return (error);
329 		*dst++ = (val >> ((addr & 3) * 8)) & 0xff;
330 	}
331 	return (0);
332 }
333 
334 /*
335  * Determine if the chip has an external EEPROM or an OTPROM and its size.
336  */
337 int
338 ar9003_find_rom(struct athn_softc *sc)
339 {
340 	struct athn_ops *ops = &sc->ops;
341 	uint32_t hdr;
342 	int error;
343 
344 	/* Try EEPROM. */
345 	ops->read_rom_data = ar9003_read_eep_data;
346 
347 	sc->eep_size = AR_SREV_9485(sc) ? 4096 : 1024;
348 	sc->eep_base = sc->eep_size - 1;
349 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
350 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
351 		return (0);
352 
353 	sc->eep_size = 512;
354 	sc->eep_base = sc->eep_size - 1;
355 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
356 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
357 		return (0);
358 
359 	/* Try OTPROM. */
360 	ops->read_rom_data = ar9003_read_otp_data;
361 
362 	sc->eep_size = 1024;
363 	sc->eep_base = sc->eep_size - 1;
364 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
365 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
366 		return (0);
367 
368 	sc->eep_size = 512;
369 	sc->eep_base = sc->eep_size - 1;
370 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
371 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
372 		return (0);
373 
374 	return (EIO);	/* Not found. */
375 }
376 
377 int
378 ar9003_restore_rom_block(struct athn_softc *sc, uint8_t alg, uint8_t ref,
379     const uint8_t *buf, int len)
380 {
381 	const uint8_t *def, *ptr, *end;
382 	uint8_t *eep = sc->eep;
383 	int off, clen;
384 
385 	if (alg == AR_EEP_COMPRESS_BLOCK) {
386 		/* Block contains chunks that shadow ROM template. */
387 		def = sc->ops.get_rom_template(sc, ref);
388 		if (def == NULL) {
389 			DPRINTF(("unknown template image %d\n", ref));
390 			return (EINVAL);
391 		}
392 		/* Start with template. */
393 		memcpy(eep, def, sc->eep_size);
394 		/* Shadow template with chunks. */
395 		off = 0;	/* Offset in ROM image. */
396 		ptr = buf;	/* Offset in block. */
397 		end = buf + len;
398 		/* Process chunks. */
399 		while (ptr + 2 <= end) {
400 			off += *ptr++;	/* Gap with previous chunk. */
401 			clen = *ptr++;	/* Chunk length. */
402 			/* Make sure block is large enough. */
403 			if (ptr + clen > end)
404 				return (EINVAL);
405 			/* Make sure chunk fits in ROM image. */
406 			if (off + clen > sc->eep_size)
407 				return (EINVAL);
408 			/* Restore chunk. */
409 			DPRINTFN(2, ("ROM chunk @%d/%d\n", off, clen));
410 			memcpy(&eep[off], ptr, clen);
411 			ptr += clen;
412 			off += clen;
413 		}
414 	} else if (alg == AR_EEP_COMPRESS_NONE) {
415 		/* Block contains full ROM image. */
416 		if (len != sc->eep_size) {
417 			DPRINTF(("block length mismatch %d\n", len));
418 			return (EINVAL);
419 		}
420 		memcpy(eep, buf, len);
421 	}
422 	return (0);
423 }
424 
425 int
426 ar9003_read_rom(struct athn_softc *sc)
427 {
428 	struct athn_ops *ops = &sc->ops;
429 	uint8_t *buf, *ptr, alg, ref;
430 	uint16_t sum, rsum;
431 	uint32_t hdr;
432 	int error, addr, len, i, j;
433 
434 	/* Allocate space to store ROM in host memory. */
435 	sc->eep = malloc(sc->eep_size, M_DEVBUF, M_NOWAIT);
436 	if (sc->eep == NULL)
437 		return (ENOMEM);
438 
439 	/* Allocate temporary buffer to store ROM blocks. */
440 	buf = malloc(2048, M_DEVBUF, M_NOWAIT);
441 	if (buf == NULL)
442 		return (ENOMEM);
443 
444 	/* Restore vendor-specified ROM blocks. */
445 	addr = sc->eep_base;
446 	for (i = 0; i < 100; i++) {
447 		/* Read block header. */
448 		error = ops->read_rom_data(sc, addr, &hdr, sizeof(hdr));
449 		if (error != 0)
450 			break;
451 		if (hdr == 0 || hdr == 0xffffffff)
452 			break;
453 		addr -= sizeof(hdr);
454 
455 		/* Extract bits from header. */
456 		ptr = (uint8_t *)&hdr;
457 		alg = (ptr[0] & 0xe0) >> 5;
458 		ref = (ptr[1] & 0x80) >> 2 | (ptr[0] & 0x1f);
459 		len = (ptr[1] & 0x7f) << 4 | (ptr[2] & 0xf0) >> 4;
460 		DPRINTFN(2, ("ROM block %d: alg=%d ref=%d len=%d\n",
461 		    i, alg, ref, len));
462 
463 		/* Read block data (len <= 0x7ff). */
464 		error = ops->read_rom_data(sc, addr, buf, len);
465 		if (error != 0)
466 			break;
467 		addr -= len;
468 
469 		/* Read block checksum. */
470 		error = ops->read_rom_data(sc, addr, &sum, sizeof(sum));
471 		if (error != 0)
472 			break;
473 		addr -= sizeof(sum);
474 
475 		/* Compute block checksum. */
476 		rsum = 0;
477 		for (j = 0; j < len; j++)
478 			rsum += buf[j];
479 		/* Compare to that in ROM. */
480 		if (letoh16(sum) != rsum) {
481 			DPRINTF(("bad block checksum 0x%x/0x%x\n",
482 			    letoh16(sum), rsum));
483 			continue;	/* Skip bad block. */
484 		}
485 		/* Checksum is correct, restore block. */
486 		ar9003_restore_rom_block(sc, alg, ref, buf, len);
487 	}
488 #if BYTE_ORDER == BIG_ENDIAN
489 	/* NB: ROM is always little endian. */
490 	if (error == 0)
491 		ops->swap_rom(sc);
492 #endif
493 	free(buf, M_DEVBUF, 0);
494 	return (error);
495 }
496 
497 /*
498  * Access to General Purpose Input/Output ports.
499  */
500 int
501 ar9003_gpio_read(struct athn_softc *sc, int pin)
502 {
503 	KASSERT(pin < sc->ngpiopins);
504 	return (((AR_READ(sc, AR_GPIO_IN) & AR9300_GPIO_IN_VAL) &
505 	    (1 << pin)) != 0);
506 }
507 
508 void
509 ar9003_gpio_write(struct athn_softc *sc, int pin, int set)
510 {
511 	uint32_t reg;
512 
513 	KASSERT(pin < sc->ngpiopins);
514 	reg = AR_READ(sc, AR_GPIO_IN_OUT);
515 	if (set)
516 		reg |= 1 << pin;
517 	else
518 		reg &= ~(1 << pin);
519 	AR_WRITE(sc, AR_GPIO_IN_OUT, reg);
520 	AR_WRITE_BARRIER(sc);
521 }
522 
523 void
524 ar9003_gpio_config_input(struct athn_softc *sc, int pin)
525 {
526 	uint32_t reg;
527 
528 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
529 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
530 	reg |= AR_GPIO_OE_OUT_DRV_NO << (pin * 2);
531 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
532 	AR_WRITE_BARRIER(sc);
533 }
534 
535 void
536 ar9003_gpio_config_output(struct athn_softc *sc, int pin, int type)
537 {
538 	uint32_t reg;
539 	int mux, off;
540 
541 	mux = pin / 6;
542 	off = pin % 6;
543 
544 	reg = AR_READ(sc, AR_GPIO_OUTPUT_MUX(mux));
545 	reg &= ~(0x1f << (off * 5));
546 	reg |= (type & 0x1f) << (off * 5);
547 	AR_WRITE(sc, AR_GPIO_OUTPUT_MUX(mux), reg);
548 
549 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
550 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
551 	reg |= AR_GPIO_OE_OUT_DRV_ALL << (pin * 2);
552 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
553 	AR_WRITE_BARRIER(sc);
554 }
555 
556 void
557 ar9003_rfsilent_init(struct athn_softc *sc)
558 {
559 	uint32_t reg;
560 
561 	/* Configure hardware radio switch. */
562 	AR_SETBITS(sc, AR_GPIO_INPUT_EN_VAL, AR_GPIO_INPUT_EN_VAL_RFSILENT_BB);
563 	reg = AR_READ(sc, AR_GPIO_INPUT_MUX2);
564 	reg = RW(reg, AR_GPIO_INPUT_MUX2_RFSILENT, 0);
565 	AR_WRITE(sc, AR_GPIO_INPUT_MUX2, reg);
566 	ar9003_gpio_config_input(sc, sc->rfsilent_pin);
567 	AR_SETBITS(sc, AR_PHY_TEST, AR_PHY_TEST_RFSILENT_BB);
568 	if (!(sc->flags & ATHN_FLAG_RFSILENT_REVERSED)) {
569 		AR_SETBITS(sc, AR_GPIO_INTR_POL,
570 		    AR_GPIO_INTR_POL_PIN(sc->rfsilent_pin));
571 	}
572 	AR_WRITE_BARRIER(sc);
573 }
574 
575 int
576 ar9003_dma_alloc(struct athn_softc *sc)
577 {
578 	int error;
579 
580 	error = ar9003_tx_alloc(sc);
581 	if (error != 0)
582 		return (error);
583 
584 	error = ar9003_rx_alloc(sc, ATHN_QID_LP, AR9003_RX_LP_QDEPTH);
585 	if (error != 0)
586 		return (error);
587 
588 	error = ar9003_rx_alloc(sc, ATHN_QID_HP, AR9003_RX_HP_QDEPTH);
589 	if (error != 0)
590 		return (error);
591 
592 	return (0);
593 }
594 
595 void
596 ar9003_dma_free(struct athn_softc *sc)
597 {
598 	ar9003_tx_free(sc);
599 	ar9003_rx_free(sc, ATHN_QID_LP);
600 	ar9003_rx_free(sc, ATHN_QID_HP);
601 }
602 
603 int
604 ar9003_tx_alloc(struct athn_softc *sc)
605 {
606 	struct athn_tx_buf *bf;
607 	bus_size_t size;
608 	int error, nsegs, i;
609 
610 	/*
611 	 * Allocate Tx status ring.
612 	 */
613 	size = AR9003_NTXSTATUS * sizeof(struct ar_tx_status);
614 
615 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
616 	    BUS_DMA_NOWAIT, &sc->txsmap);
617 	if (error != 0)
618 		goto fail;
619 
620 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->txsseg, 1,
621 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
622 	if (error != 0)
623 		goto fail;
624 
625 	error = bus_dmamem_map(sc->sc_dmat, &sc->txsseg, 1, size,
626 	    (caddr_t *)&sc->txsring, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
627 	if (error != 0)
628 		goto fail;
629 
630 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->txsmap, &sc->txsseg,
631 	    1, size, BUS_DMA_NOWAIT | BUS_DMA_READ);
632 	if (error != 0)
633 		goto fail;
634 
635 	/*
636 	 * Allocate a pool of Tx descriptors shared between all Tx queues.
637 	 */
638 	size = ATHN_NTXBUFS * sizeof(struct ar_tx_desc);
639 
640 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
641 	    BUS_DMA_NOWAIT, &sc->map);
642 	if (error != 0)
643 		goto fail;
644 
645 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->seg, 1,
646 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
647 	if (error != 0)
648 		goto fail;
649 
650 	error = bus_dmamem_map(sc->sc_dmat, &sc->seg, 1, size,
651 	    (caddr_t *)&sc->descs, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
652 	if (error != 0)
653 		goto fail;
654 
655 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->map, &sc->seg, 1, size,
656 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
657 	if (error != 0)
658 		goto fail;
659 
660 	SIMPLEQ_INIT(&sc->txbufs);
661 	for (i = 0; i < ATHN_NTXBUFS; i++) {
662 		bf = &sc->txpool[i];
663 
664 		error = bus_dmamap_create(sc->sc_dmat, ATHN_TXBUFSZ,
665 		    AR9003_MAX_SCATTER, ATHN_TXBUFSZ, 0, BUS_DMA_NOWAIT,
666 		    &bf->bf_map);
667 		if (error != 0) {
668 			printf("%s: could not create Tx buf DMA map\n",
669 			    sc->sc_dev.dv_xname);
670 			goto fail;
671 		}
672 
673 		bf->bf_descs = &((struct ar_tx_desc *)sc->descs)[i];
674 		bf->bf_daddr = sc->map->dm_segs[0].ds_addr +
675 		    i * sizeof(struct ar_tx_desc);
676 
677 		SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
678 	}
679 	return (0);
680  fail:
681 	ar9003_tx_free(sc);
682 	return (error);
683 }
684 
685 void
686 ar9003_tx_free(struct athn_softc *sc)
687 {
688 	struct athn_tx_buf *bf;
689 	int i;
690 
691 	for (i = 0; i < ATHN_NTXBUFS; i++) {
692 		bf = &sc->txpool[i];
693 
694 		if (bf->bf_map != NULL)
695 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
696 	}
697 	/* Free Tx descriptors. */
698 	if (sc->map != NULL) {
699 		if (sc->descs != NULL) {
700 			bus_dmamap_unload(sc->sc_dmat, sc->map);
701 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->descs,
702 			    ATHN_NTXBUFS * sizeof(struct ar_tx_desc));
703 			bus_dmamem_free(sc->sc_dmat, &sc->seg, 1);
704 		}
705 		bus_dmamap_destroy(sc->sc_dmat, sc->map);
706 	}
707 	/* Free Tx status ring. */
708 	if (sc->txsmap != NULL) {
709 		if (sc->txsring != NULL) {
710 			bus_dmamap_unload(sc->sc_dmat, sc->txsmap);
711 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->txsring,
712 			     AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
713 			bus_dmamem_free(sc->sc_dmat, &sc->txsseg, 1);
714 		}
715 		bus_dmamap_destroy(sc->sc_dmat, sc->txsmap);
716 	}
717 }
718 
719 int
720 ar9003_rx_alloc(struct athn_softc *sc, int qid, int count)
721 {
722 	struct athn_rxq *rxq = &sc->rxq[qid];
723 	struct athn_rx_buf *bf;
724 	struct ar_rx_status *ds;
725 	int error, i;
726 
727 	rxq->bf = mallocarray(count, sizeof(*bf), M_DEVBUF,
728 	    M_NOWAIT | M_ZERO);
729 	if (rxq->bf == NULL)
730 		return (ENOMEM);
731 
732 	rxq->count = count;
733 
734 	for (i = 0; i < rxq->count; i++) {
735 		bf = &rxq->bf[i];
736 
737 		error = bus_dmamap_create(sc->sc_dmat, ATHN_RXBUFSZ, 1,
738 		    ATHN_RXBUFSZ, 0, BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW,
739 		    &bf->bf_map);
740 		if (error != 0) {
741 			printf("%s: could not create Rx buf DMA map\n",
742 			    sc->sc_dev.dv_xname);
743 			goto fail;
744 		}
745 		/*
746 		 * Assumes MCLGETI returns cache-line-size aligned buffers.
747 		 */
748 		bf->bf_m = MCLGETI(NULL, M_DONTWAIT, NULL, ATHN_RXBUFSZ);
749 		if (bf->bf_m == NULL) {
750 			printf("%s: could not allocate Rx mbuf\n",
751 			    sc->sc_dev.dv_xname);
752 			error = ENOBUFS;
753 			goto fail;
754 		}
755 
756 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
757 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
758 		    BUS_DMA_NOWAIT);
759 		if (error != 0) {
760 			printf("%s: could not DMA map Rx buffer\n",
761 			    sc->sc_dev.dv_xname);
762 			goto fail;
763 		}
764 
765 		ds = mtod(bf->bf_m, struct ar_rx_status *);
766 		memset(ds, 0, sizeof(*ds));
767 		bf->bf_desc = ds;
768 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
769 
770 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
771 		    BUS_DMASYNC_PREREAD);
772 	}
773 	return (0);
774  fail:
775 	ar9003_rx_free(sc, qid);
776 	return (error);
777 }
778 
779 void
780 ar9003_rx_free(struct athn_softc *sc, int qid)
781 {
782 	struct athn_rxq *rxq = &sc->rxq[qid];
783 	struct athn_rx_buf *bf;
784 	int i;
785 
786 	if (rxq->bf == NULL)
787 		return;
788 	for (i = 0; i < rxq->count; i++) {
789 		bf = &rxq->bf[i];
790 
791 		if (bf->bf_map != NULL)
792 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
793 		m_freem(bf->bf_m);
794 	}
795 	free(rxq->bf, M_DEVBUF, 0);
796 }
797 
798 void
799 ar9003_reset_txsring(struct athn_softc *sc)
800 {
801 	sc->txscur = 0;
802 	memset(sc->txsring, 0, AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
803 	AR_WRITE(sc, AR_Q_STATUS_RING_START,
804 	    sc->txsmap->dm_segs[0].ds_addr);
805 	AR_WRITE(sc, AR_Q_STATUS_RING_END,
806 	    sc->txsmap->dm_segs[0].ds_addr + sc->txsmap->dm_segs[0].ds_len);
807 	AR_WRITE_BARRIER(sc);
808 }
809 
810 void
811 ar9003_rx_enable(struct athn_softc *sc)
812 {
813 	struct athn_rxq *rxq;
814 	struct athn_rx_buf *bf;
815 	struct ar_rx_status *ds;
816 	uint32_t reg;
817 	int qid, i;
818 
819 	reg = AR_READ(sc, AR_RXBP_THRESH);
820 	reg = RW(reg, AR_RXBP_THRESH_HP, 1);
821 	reg = RW(reg, AR_RXBP_THRESH_LP, 1);
822 	AR_WRITE(sc, AR_RXBP_THRESH, reg);
823 
824 	/* Set Rx buffer size. */
825 	AR_WRITE(sc, AR_DATABUF_SIZE, ATHN_RXBUFSZ - sizeof(*ds));
826 
827 	for (qid = 0; qid < 2; qid++) {
828 		rxq = &sc->rxq[qid];
829 
830 		/* Setup Rx status descriptors. */
831 		SIMPLEQ_INIT(&rxq->head);
832 		for (i = 0; i < rxq->count; i++) {
833 			bf = &rxq->bf[i];
834 			ds = bf->bf_desc;
835 
836 			memset(ds, 0, sizeof(*ds));
837 			if (qid == ATHN_QID_LP)
838 				AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
839 			else
840 				AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
841 			AR_WRITE_BARRIER(sc);
842 			SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
843 		}
844 	}
845 	/* Enable Rx. */
846 	AR_WRITE(sc, AR_CR, 0);
847 	AR_WRITE_BARRIER(sc);
848 }
849 
850 #if NBPFILTER > 0
851 void
852 ar9003_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
853     struct ar_rx_status *ds)
854 {
855 #define IEEE80211_RADIOTAP_F_SHORTGI	0x80	/* XXX from FBSD */
856 
857 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
858 	struct ieee80211com *ic = &sc->sc_ic;
859 	uint64_t tsf;
860 	uint32_t tstamp;
861 	uint8_t rate;
862 
863 	/* Extend the 15-bit timestamp from Rx status to 64-bit TSF. */
864 	tstamp = ds->ds_status3;
865 	tsf = AR_READ(sc, AR_TSF_U32);
866 	tsf = tsf << 32 | AR_READ(sc, AR_TSF_L32);
867 	if ((tsf & 0x7fff) < tstamp)
868 		tsf -= 0x8000;
869 	tsf = (tsf & ~0x7fff) | tstamp;
870 
871 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
872 	tap->wr_tsft = htole64(tsf);
873 	tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
874 	tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
875 	tap->wr_dbm_antsignal = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
876 	/* XXX noise. */
877 	tap->wr_antenna = MS(ds->ds_status4, AR_RXS4_ANTENNA);
878 	tap->wr_rate = 0;	/* In case it can't be found below. */
879 	rate = MS(ds->ds_status1, AR_RXS1_RATE);
880 	if (rate & 0x80) {		/* HT. */
881 		/* Bit 7 set means HT MCS instead of rate. */
882 		tap->wr_rate = rate;
883 		if (!(ds->ds_status4 & AR_RXS4_GI))
884 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
885 
886 	} else if (rate & 0x10) {	/* CCK. */
887 		if (rate & 0x04)
888 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
889 		switch (rate & ~0x14) {
890 		case 0xb: tap->wr_rate =   2; break;
891 		case 0xa: tap->wr_rate =   4; break;
892 		case 0x9: tap->wr_rate =  11; break;
893 		case 0x8: tap->wr_rate =  22; break;
894 		}
895 	} else {			/* OFDM. */
896 		switch (rate) {
897 		case 0xb: tap->wr_rate =  12; break;
898 		case 0xf: tap->wr_rate =  18; break;
899 		case 0xa: tap->wr_rate =  24; break;
900 		case 0xe: tap->wr_rate =  36; break;
901 		case 0x9: tap->wr_rate =  48; break;
902 		case 0xd: tap->wr_rate =  72; break;
903 		case 0x8: tap->wr_rate =  96; break;
904 		case 0xc: tap->wr_rate = 108; break;
905 		}
906 	}
907 	bpf_mtap_hdr(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_DIRECTION_IN);
908 }
909 #endif
910 
911 int
912 ar9003_rx_process(struct athn_softc *sc, int qid, struct mbuf_list *ml)
913 {
914 	struct ieee80211com *ic = &sc->sc_ic;
915 	struct ifnet *ifp = &ic->ic_if;
916 	struct athn_rxq *rxq = &sc->rxq[qid];
917 	struct athn_rx_buf *bf;
918 	struct ar_rx_status *ds;
919 	struct ieee80211_frame *wh;
920 	struct ieee80211_rxinfo rxi;
921 	struct ieee80211_node *ni;
922 	struct mbuf *m, *m1;
923 	int error, len;
924 
925 	bf = SIMPLEQ_FIRST(&rxq->head);
926 	if (__predict_false(bf == NULL)) {	/* Should not happen. */
927 		printf("%s: Rx queue is empty!\n", sc->sc_dev.dv_xname);
928 		return (ENOENT);
929 	}
930 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
931 	    BUS_DMASYNC_POSTREAD);
932 
933 	ds = mtod(bf->bf_m, struct ar_rx_status *);
934 	if (!(ds->ds_status11 & AR_RXS11_DONE))
935 		return (EBUSY);
936 
937 	/* Check that it is a valid Rx status descriptor. */
938 	if ((ds->ds_info & (AR_RXI_DESC_ID_M | AR_RXI_DESC_TX |
939 	    AR_RXI_CTRL_STAT)) != SM(AR_RXI_DESC_ID, AR_VENDOR_ATHEROS))
940 		goto skip;
941 
942 	if (!(ds->ds_status11 & AR_RXS11_FRAME_OK)) {
943 		if (ds->ds_status11 & AR_RXS11_CRC_ERR)
944 			DPRINTFN(6, ("CRC error\n"));
945 		else if (ds->ds_status11 & AR_RXS11_PHY_ERR)
946 			DPRINTFN(6, ("PHY error=0x%x\n",
947 			    MS(ds->ds_status11, AR_RXS11_PHY_ERR_CODE)));
948 		else if (ds->ds_status11 & AR_RXS11_DECRYPT_CRC_ERR)
949 			DPRINTFN(6, ("Decryption CRC error\n"));
950 		else if (ds->ds_status11 & AR_RXS11_MICHAEL_ERR) {
951 			DPRINTFN(2, ("Michael MIC failure\n"));
952 			/* Report Michael MIC failures to net80211. */
953 			ic->ic_stats.is_rx_locmicfail++;
954 			ieee80211_michael_mic_failure(ic, 0);
955 			/*
956 			 * XXX Check that it is not a control frame
957 			 * (invalid MIC failures on valid ctl frames).
958 			 */
959 		}
960 		ifp->if_ierrors++;
961 		goto skip;
962 	}
963 
964 	len = MS(ds->ds_status2, AR_RXS2_DATA_LEN);
965 	if (__predict_false(len < IEEE80211_MIN_LEN ||
966 	    len > ATHN_RXBUFSZ - sizeof(*ds))) {
967 		DPRINTF(("corrupted descriptor length=%d\n", len));
968 		ifp->if_ierrors++;
969 		goto skip;
970 	}
971 
972 	/* Allocate a new Rx buffer. */
973 	m1 = MCLGETI(NULL, M_DONTWAIT, NULL, ATHN_RXBUFSZ);
974 	if (__predict_false(m1 == NULL)) {
975 		ic->ic_stats.is_rx_nombuf++;
976 		ifp->if_ierrors++;
977 		goto skip;
978 	}
979 
980 	/* Unmap the old Rx buffer. */
981 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
982 
983 	/* Map the new Rx buffer. */
984 	error = bus_dmamap_load(sc->sc_dmat, bf->bf_map, mtod(m1, void *),
985 	    ATHN_RXBUFSZ, NULL, BUS_DMA_NOWAIT | BUS_DMA_READ);
986 	if (__predict_false(error != 0)) {
987 		m_freem(m1);
988 
989 		/* Remap the old Rx buffer or panic. */
990 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
991 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
992 		    BUS_DMA_NOWAIT | BUS_DMA_READ);
993 		KASSERT(error != 0);
994 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
995 		ifp->if_ierrors++;
996 		goto skip;
997 	}
998 	bf->bf_desc = mtod(m1, struct ar_rx_status *);
999 	bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
1000 
1001 	m = bf->bf_m;
1002 	bf->bf_m = m1;
1003 
1004 	/* Finalize mbuf. */
1005 	/* Strip Rx status descriptor from head. */
1006 	m->m_data = (caddr_t)&ds[1];
1007 	m->m_pkthdr.len = m->m_len = len;
1008 
1009 	/* Grab a reference to the source node. */
1010 	wh = mtod(m, struct ieee80211_frame *);
1011 	ni = ieee80211_find_rxnode(ic, wh);
1012 
1013 	/* Remove any HW padding after the 802.11 header. */
1014 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
1015 		u_int hdrlen = ieee80211_get_hdrlen(wh);
1016 		if (hdrlen & 3) {
1017 			memmove((caddr_t)wh + 2, wh, hdrlen);
1018 			m_adj(m, 2);
1019 		}
1020 	}
1021 #if NBPFILTER > 0
1022 	if (__predict_false(sc->sc_drvbpf != NULL))
1023 		ar9003_rx_radiotap(sc, m, ds);
1024 #endif
1025 	/* Trim 802.11 FCS after radiotap. */
1026 	m_adj(m, -IEEE80211_CRC_LEN);
1027 
1028 	/* Send the frame to the 802.11 layer. */
1029 	rxi.rxi_flags = 0;	/* XXX */
1030 	rxi.rxi_rssi = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
1031 	rxi.rxi_tstamp = ds->ds_status3;
1032 	ieee80211_inputm(ifp, m, ni, &rxi, ml);
1033 
1034 	/* Node is no longer needed. */
1035 	ieee80211_release_node(ic, ni);
1036 
1037  skip:
1038 	/* Unlink this descriptor from head. */
1039 	SIMPLEQ_REMOVE_HEAD(&rxq->head, bf_list);
1040 	memset(bf->bf_desc, 0, sizeof(*ds));
1041 
1042 	/* Re-use this descriptor and link it to tail. */
1043 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
1044 	    BUS_DMASYNC_PREREAD);
1045 
1046 	if (qid == ATHN_QID_LP)
1047 		AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
1048 	else
1049 		AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
1050 	AR_WRITE_BARRIER(sc);
1051 	SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
1052 
1053 	/* Re-enable Rx. */
1054 	AR_WRITE(sc, AR_CR, 0);
1055 	AR_WRITE_BARRIER(sc);
1056 	return (0);
1057 }
1058 
1059 void
1060 ar9003_rx_intr(struct athn_softc *sc, int qid)
1061 {
1062 	struct mbuf_list ml = MBUF_LIST_INITIALIZER();
1063 	struct ieee80211com *ic = &sc->sc_ic;
1064 	struct ifnet *ifp = &ic->ic_if;
1065 
1066 	while (ar9003_rx_process(sc, qid, &ml) == 0);
1067 
1068 	if_input(ifp, &ml);
1069 }
1070 
1071 int
1072 ar9003_tx_process(struct athn_softc *sc)
1073 {
1074 	struct ieee80211com *ic = &sc->sc_ic;
1075 	struct ifnet *ifp = &ic->ic_if;
1076 	struct athn_txq *txq;
1077 	struct athn_node *an;
1078 	struct athn_tx_buf *bf;
1079 	struct ar_tx_status *ds;
1080 	uint8_t qid, failcnt;
1081 
1082 	ds = &((struct ar_tx_status *)sc->txsring)[sc->txscur];
1083 	if (!(ds->ds_status8 & AR_TXS8_DONE))
1084 		return (EBUSY);
1085 
1086 	sc->txscur = (sc->txscur + 1) % AR9003_NTXSTATUS;
1087 
1088 	/* Check that it is a valid Tx status descriptor. */
1089 	if ((ds->ds_info & (AR_TXI_DESC_ID_M | AR_TXI_DESC_TX)) !=
1090 	    (SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) | AR_TXI_DESC_TX)) {
1091 		memset(ds, 0, sizeof(*ds));
1092 		return (0);
1093 	}
1094 	/* Retrieve the queue that was used to send this PDU. */
1095 	qid = MS(ds->ds_info, AR_TXI_QCU_NUM);
1096 	txq = &sc->txq[qid];
1097 
1098 	bf = SIMPLEQ_FIRST(&txq->head);
1099 	if (bf == NULL || bf == txq->wait) {
1100 		memset(ds, 0, sizeof(*ds));
1101 		return (0);
1102 	}
1103 	SIMPLEQ_REMOVE_HEAD(&txq->head, bf_list);
1104 
1105 	sc->sc_tx_timer = 0;
1106 
1107 	if (ds->ds_status3 & AR_TXS3_EXCESSIVE_RETRIES)
1108 		ifp->if_oerrors++;
1109 
1110 	if (ds->ds_status3 & AR_TXS3_UNDERRUN)
1111 		athn_inc_tx_trigger_level(sc);
1112 
1113 	/* Wakeup PA predistortion state machine. */
1114 	if (bf->bf_txflags & ATHN_TXFLAG_PAPRD)
1115 		ar9003_paprd_tx_tone_done(sc);
1116 
1117 	an = (struct athn_node *)bf->bf_ni;
1118 	/*
1119 	 * NB: the data fail count contains the number of un-acked tries
1120 	 * for the final series used.  We must add the number of tries for
1121 	 * each series that was fully processed.
1122 	 */
1123 	failcnt  = MS(ds->ds_status3, AR_TXS3_DATA_FAIL_CNT);
1124 	/* NB: Assume two tries per series. */
1125 	failcnt += MS(ds->ds_status8, AR_TXS8_FINAL_IDX) * 2;
1126 
1127 	/* Update rate control statistics. */
1128 	an->amn.amn_txcnt++;
1129 	if (failcnt > 0)
1130 		an->amn.amn_retrycnt++;
1131 
1132 	DPRINTFN(5, ("Tx done qid=%d status3=%d fail count=%d\n",
1133 	    qid, ds->ds_status3, failcnt));
1134 
1135 	/* Reset Tx status descriptor. */
1136 	memset(ds, 0, sizeof(*ds));
1137 
1138 	/* Unmap Tx buffer. */
1139 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1140 	    BUS_DMASYNC_POSTWRITE);
1141 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1142 
1143 	m_freem(bf->bf_m);
1144 	bf->bf_m = NULL;
1145 	ieee80211_release_node(ic, bf->bf_ni);
1146 	bf->bf_ni = NULL;
1147 
1148 	/* Link Tx buffer back to global free list. */
1149 	SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
1150 
1151 	/* Queue buffers that are waiting if there is new room. */
1152 	if (--txq->queued < AR9003_TX_QDEPTH && txq->wait != NULL) {
1153 		AR_WRITE(sc, AR_QTXDP(qid), txq->wait->bf_daddr);
1154 		AR_WRITE_BARRIER(sc);
1155 		txq->wait = SIMPLEQ_NEXT(txq->wait, bf_list);
1156 	}
1157 	return (0);
1158 }
1159 
1160 void
1161 ar9003_tx_intr(struct athn_softc *sc)
1162 {
1163 	struct ieee80211com *ic = &sc->sc_ic;
1164 	struct ifnet *ifp = &ic->ic_if;
1165 
1166 	while (ar9003_tx_process(sc) == 0);
1167 
1168 	if (!SIMPLEQ_EMPTY(&sc->txbufs)) {
1169 		ifq_clr_oactive(&ifp->if_snd);
1170 		ifp->if_start(ifp);
1171 	}
1172 }
1173 
1174 #ifndef IEEE80211_STA_ONLY
1175 /*
1176  * Process Software Beacon Alert interrupts.
1177  */
1178 int
1179 ar9003_swba_intr(struct athn_softc *sc)
1180 {
1181 	struct ieee80211com *ic = &sc->sc_ic;
1182 	struct ifnet *ifp = &ic->ic_if;
1183 	struct ieee80211_node *ni = ic->ic_bss;
1184 	struct athn_tx_buf *bf = sc->bcnbuf;
1185 	struct ieee80211_frame *wh;
1186 	struct ar_tx_desc *ds;
1187 	struct mbuf *m;
1188 	uint32_t sum;
1189 	uint8_t ridx, hwrate;
1190 	int error, totlen;
1191 
1192 	if (ic->ic_tim_mcast_pending &&
1193 	    mq_empty(&ni->ni_savedq) &&
1194 	    SIMPLEQ_EMPTY(&sc->txq[ATHN_QID_CAB].head))
1195 		ic->ic_tim_mcast_pending = 0;
1196 
1197 	if (ic->ic_dtim_count == 0)
1198 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1199 	else
1200 		ic->ic_dtim_count--;
1201 
1202 	/* Make sure previous beacon has been sent. */
1203 	if (athn_tx_pending(sc, ATHN_QID_BEACON)) {
1204 		DPRINTF(("beacon stuck\n"));
1205 		return (EBUSY);
1206 	}
1207 	/* Get new beacon. */
1208 	m = ieee80211_beacon_alloc(ic, ic->ic_bss);
1209 	if (__predict_false(m == NULL))
1210 		return (ENOBUFS);
1211 	/* Assign sequence number. */
1212 	wh = mtod(m, struct ieee80211_frame *);
1213 	*(uint16_t *)&wh->i_seq[0] =
1214 	    htole16(ic->ic_bss->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
1215 	ic->ic_bss->ni_txseq++;
1216 
1217 	/* Unmap and free old beacon if any. */
1218 	if (__predict_true(bf->bf_m != NULL)) {
1219 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0,
1220 		    bf->bf_map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1221 		bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1222 		m_freem(bf->bf_m);
1223 		bf->bf_m = NULL;
1224 	}
1225 	/* DMA map new beacon. */
1226 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1227 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1228 	if (__predict_false(error != 0)) {
1229 		m_freem(m);
1230 		return (error);
1231 	}
1232 	bf->bf_m = m;
1233 
1234 	/* Setup Tx descriptor (simplified ar9003_tx()). */
1235 	ds = bf->bf_descs;
1236 	memset(ds, 0, sizeof(*ds));
1237 
1238 	ds->ds_info =
1239 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1240 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1241 	    SM(AR_TXI_QCU_NUM, ATHN_QID_BEACON) |
1242 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1243 
1244 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1245 	ds->ds_ctl11 = SM(AR_TXC11_FRAME_LEN, totlen);
1246 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, AR_MAX_RATE_POWER);
1247 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, AR_FRAME_TYPE_BEACON);
1248 	ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1249 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, AR_ENCR_TYPE_CLEAR);
1250 
1251 	/* Write number of tries. */
1252 	ds->ds_ctl13 = SM(AR_TXC13_XMIT_DATA_TRIES0, 1);
1253 
1254 	/* Write Tx rate. */
1255 	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1256 	    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1257 	hwrate = athn_rates[ridx].hwrate;
1258 	ds->ds_ctl14 = SM(AR_TXC14_XMIT_RATE0, hwrate);
1259 
1260 	/* Write Tx chains. */
1261 	ds->ds_ctl18 = SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask);
1262 
1263 	ds->ds_segs[0].ds_data = bf->bf_map->dm_segs[0].ds_addr;
1264 	/* Segment length must be a multiple of 4. */
1265 	ds->ds_segs[0].ds_ctl |= SM(AR_TXC_BUF_LEN,
1266 	    (bf->bf_map->dm_segs[0].ds_len + 3) & ~3);
1267 	/* Compute Tx descriptor checksum. */
1268 	sum = ds->ds_info;
1269 	sum += ds->ds_segs[0].ds_data;
1270 	sum += ds->ds_segs[0].ds_ctl;
1271 	sum = (sum >> 16) + (sum & 0xffff);
1272 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1273 
1274 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1275 	    BUS_DMASYNC_PREWRITE);
1276 
1277 	/* Stop Tx DMA before putting the new beacon on the queue. */
1278 	athn_stop_tx_dma(sc, ATHN_QID_BEACON);
1279 
1280 	AR_WRITE(sc, AR_QTXDP(ATHN_QID_BEACON), bf->bf_daddr);
1281 
1282 	for(;;) {
1283 		if (SIMPLEQ_EMPTY(&sc->txbufs))
1284 			break;
1285 
1286 		m = mq_dequeue(&ni->ni_savedq);
1287 		if (m == NULL)
1288 			break;
1289 		if (!mq_empty(&ni->ni_savedq)) {
1290 			/* more queued frames, set the more data bit */
1291 			wh = mtod(m, struct ieee80211_frame *);
1292 			wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
1293 		}
1294 
1295 		if (sc->ops.tx(sc, m, ni, ATHN_TXFLAG_CAB) != 0) {
1296 			ieee80211_release_node(ic, ni);
1297 			ifp->if_oerrors++;
1298 			break;
1299 		}
1300 	}
1301 
1302 	/* Kick Tx. */
1303 	AR_WRITE(sc, AR_Q_TXE, 1 << ATHN_QID_BEACON);
1304 	AR_WRITE_BARRIER(sc);
1305 	return (0);
1306 }
1307 #endif
1308 
1309 int
1310 ar9003_intr(struct athn_softc *sc)
1311 {
1312 	uint32_t intr, intr2, intr5, sync;
1313 
1314 	/* Get pending interrupts. */
1315 	intr = AR_READ(sc, AR_INTR_ASYNC_CAUSE);
1316 	if (!(intr & AR_INTR_MAC_IRQ) || intr == AR_INTR_SPURIOUS) {
1317 		intr = AR_READ(sc, AR_INTR_SYNC_CAUSE);
1318 		if (intr == AR_INTR_SPURIOUS || (intr & sc->isync) == 0)
1319 			return (0);	/* Not for us. */
1320 	}
1321 
1322 	if ((AR_READ(sc, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) &&
1323 	    (AR_READ(sc, AR_RTC_STATUS) & AR_RTC_STATUS_M) == AR_RTC_STATUS_ON)
1324 		intr = AR_READ(sc, AR_ISR);
1325 	else
1326 		intr = 0;
1327 	sync = AR_READ(sc, AR_INTR_SYNC_CAUSE) & sc->isync;
1328 	if (intr == 0 && sync == 0)
1329 		return (0);	/* Not for us. */
1330 
1331 	if (intr != 0) {
1332 		if (intr & AR_ISR_BCNMISC) {
1333 			intr2 = AR_READ(sc, AR_ISR_S2);
1334 			if (intr2 & AR_ISR_S2_TIM)
1335 				/* TBD */;
1336 			if (intr2 & AR_ISR_S2_TSFOOR)
1337 				/* TBD */;
1338 			if (intr2 & AR_ISR_S2_BB_WATCHDOG)
1339 				/* TBD */;
1340 		}
1341 		intr = AR_READ(sc, AR_ISR_RAC);
1342 		if (intr == AR_INTR_SPURIOUS)
1343 			return (1);
1344 
1345 #ifndef IEEE80211_STA_ONLY
1346 		if (intr & AR_ISR_SWBA)
1347 			ar9003_swba_intr(sc);
1348 #endif
1349 		if (intr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
1350 			ar9003_rx_intr(sc, ATHN_QID_LP);
1351 		if (intr & (AR_ISR_LP_RXOK | AR_ISR_RXERR | AR_ISR_RXEOL))
1352 			ar9003_rx_intr(sc, ATHN_QID_LP);
1353 		if (intr & AR_ISR_HP_RXOK)
1354 			ar9003_rx_intr(sc, ATHN_QID_HP);
1355 
1356 		if (intr & (AR_ISR_TXMINTR | AR_ISR_TXINTM))
1357 			ar9003_tx_intr(sc);
1358 		if (intr & (AR_ISR_TXOK | AR_ISR_TXERR | AR_ISR_TXEOL))
1359 			ar9003_tx_intr(sc);
1360 
1361 		if (intr & AR_ISR_GENTMR) {
1362 			intr5 = AR_READ(sc, AR_ISR_S5_S);
1363 			DPRINTF(("GENTMR trigger=%d thresh=%d\n",
1364 			    MS(intr5, AR_ISR_S5_GENTIMER_TRIG),
1365 			    MS(intr5, AR_ISR_S5_GENTIMER_THRESH)));
1366 		}
1367 	}
1368 	if (sync != 0) {
1369 		if (sync & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
1370 			AR_WRITE(sc, AR_RC, AR_RC_HOSTIF);
1371 			AR_WRITE(sc, AR_RC, 0);
1372 		}
1373 
1374 		if ((sc->flags & ATHN_FLAG_RFSILENT) &&
1375 		    (sync & AR_INTR_SYNC_GPIO_PIN(sc->rfsilent_pin))) {
1376 			struct ifnet *ifp = &sc->sc_ic.ic_if;
1377 
1378 			printf("%s: radio switch turned off\n",
1379 			    sc->sc_dev.dv_xname);
1380 			/* Turn the interface down. */
1381 			athn_stop(ifp, 1);
1382 			return (1);
1383 		}
1384 
1385 		AR_WRITE(sc, AR_INTR_SYNC_CAUSE, sync);
1386 		(void)AR_READ(sc, AR_INTR_SYNC_CAUSE);
1387 	}
1388 	return (1);
1389 }
1390 
1391 int
1392 ar9003_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
1393     int txflags)
1394 {
1395 	struct ieee80211com *ic = &sc->sc_ic;
1396 	struct ieee80211_key *k = NULL;
1397 	struct ieee80211_frame *wh;
1398 	struct athn_series series[4];
1399 	struct ar_tx_desc *ds;
1400 	struct athn_txq *txq;
1401 	struct athn_tx_buf *bf;
1402 	struct athn_node *an = (void *)ni;
1403 	struct mbuf *m1;
1404 	uintptr_t entry;
1405 	uint32_t sum;
1406 	uint16_t qos = 0;
1407 	uint8_t txpower, type, encrtype, tid, ridx[4];
1408 	int i, error, totlen, hasqos, qid;
1409 
1410 	/* Grab a Tx buffer from our global free list. */
1411 	bf = SIMPLEQ_FIRST(&sc->txbufs);
1412 	KASSERT(bf != NULL);
1413 
1414 	/* Map 802.11 frame type to hardware frame type. */
1415 	wh = mtod(m, struct ieee80211_frame *);
1416 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1417 	    IEEE80211_FC0_TYPE_MGT) {
1418 		/* NB: Beacons do not use ar9003_tx(). */
1419 		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1420 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1421 			type = AR_FRAME_TYPE_PROBE_RESP;
1422 		else if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1423 		    IEEE80211_FC0_SUBTYPE_ATIM)
1424 			type = AR_FRAME_TYPE_ATIM;
1425 		else
1426 			type = AR_FRAME_TYPE_NORMAL;
1427 	} else if ((wh->i_fc[0] &
1428 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1429 	    (IEEE80211_FC0_TYPE_CTL  | IEEE80211_FC0_SUBTYPE_PS_POLL)) {
1430 		type = AR_FRAME_TYPE_PSPOLL;
1431 	} else
1432 		type = AR_FRAME_TYPE_NORMAL;
1433 
1434 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1435 		k = ieee80211_get_txkey(ic, wh, ni);
1436 		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1437 			return (ENOBUFS);
1438 		wh = mtod(m, struct ieee80211_frame *);
1439 	}
1440 
1441 	/* XXX 2-byte padding for QoS and 4-addr headers. */
1442 
1443 	/* Select the HW Tx queue to use for this frame. */
1444 	if ((hasqos = ieee80211_has_qos(wh))) {
1445 		qos = ieee80211_get_qos(wh);
1446 		tid = qos & IEEE80211_QOS_TID;
1447 		qid = athn_ac2qid[ieee80211_up_to_ac(ic, tid)];
1448 	} else if (type == AR_FRAME_TYPE_PSPOLL) {
1449 		qid = ATHN_QID_PSPOLL;
1450 	} else if (txflags & ATHN_TXFLAG_CAB) {
1451 		qid = ATHN_QID_CAB;
1452 	} else
1453 		qid = ATHN_QID_AC_BE;
1454 	txq = &sc->txq[qid];
1455 
1456 	/* Select the transmit rates to use for this frame. */
1457 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1458 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
1459 	    IEEE80211_FC0_TYPE_DATA) {
1460 		/* Use lowest rate for all tries. */
1461 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1462 		    (ic->ic_curmode == IEEE80211_MODE_11A) ?
1463 			ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1464 	} else if (ic->ic_fixed_rate != -1) {
1465 		/* Use same fixed rate for all tries. */
1466 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1467 		    sc->fixed_ridx;
1468 	} else {
1469 		int txrate = ni->ni_txrate;
1470 		/* Use fallback table of the node. */
1471 		for (i = 0; i < 4; i++) {
1472 			ridx[i] = an->ridx[txrate];
1473 			txrate = an->fallback[txrate];
1474 		}
1475 	}
1476 
1477 #if NBPFILTER > 0
1478 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1479 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
1480 
1481 		tap->wt_flags = 0;
1482 		/* Use initial transmit rate. */
1483 		tap->wt_rate = athn_rates[ridx[0]].rate;
1484 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1485 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1486 		tap->wt_hwqueue = qid;
1487 		if (athn_rates[ridx[0]].phy == IEEE80211_T_DS &&
1488 		    ridx[0] != ATHN_RIDX_CCK1 &&
1489 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1490 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1491 		bpf_mtap_hdr(sc->sc_drvbpf, tap, sc->sc_txtap_len, m,
1492 		    BPF_DIRECTION_OUT);
1493 	}
1494 #endif
1495 
1496 	/* DMA map mbuf. */
1497 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1498 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1499 	if (__predict_false(error != 0)) {
1500 		if (error != EFBIG) {
1501 			printf("%s: can't map mbuf (error %d)\n",
1502 			    sc->sc_dev.dv_xname, error);
1503 			m_freem(m);
1504 			return (error);
1505 		}
1506 		/*
1507 		 * DMA mapping requires too many DMA segments; linearize
1508 		 * mbuf in kernel virtual address space and retry.
1509 		 */
1510 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1511 		if (m1 == NULL) {
1512 			m_freem(m);
1513 			return (ENOBUFS);
1514 		}
1515 		if (m->m_pkthdr.len > MHLEN) {
1516 			MCLGET(m1, M_DONTWAIT);
1517 			if (!(m1->m_flags & M_EXT)) {
1518 				m_freem(m);
1519 				m_freem(m1);
1520 				return (ENOBUFS);
1521 			}
1522 		}
1523 		m_copydata(m, 0, m->m_pkthdr.len, mtod(m1, caddr_t));
1524 		m1->m_pkthdr.len = m1->m_len = m->m_pkthdr.len;
1525 		m_freem(m);
1526 		m = m1;
1527 
1528 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1529 		    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1530 		if (error != 0) {
1531 			printf("%s: can't map mbuf (error %d)\n",
1532 			    sc->sc_dev.dv_xname, error);
1533 			m_freem(m);
1534 			return (error);
1535 		}
1536 	}
1537 	bf->bf_m = m;
1538 	bf->bf_ni = ni;
1539 	bf->bf_txflags = txflags;
1540 
1541 	wh = mtod(m, struct ieee80211_frame *);
1542 
1543 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1544 
1545 	/* Setup Tx descriptor. */
1546 	ds = bf->bf_descs;
1547 	memset(ds, 0, sizeof(*ds));
1548 
1549 	ds->ds_info =
1550 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1551 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1552 	    SM(AR_TXI_QCU_NUM, qid) |
1553 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1554 
1555 	ds->ds_ctl11 = AR_TXC11_CLR_DEST_MASK;
1556 	txpower = AR_MAX_RATE_POWER;	/* Get from per-rate registers. */
1557 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, txpower);
1558 
1559 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, type);
1560 
1561 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1562 	    (hasqos && (qos & IEEE80211_QOS_ACK_POLICY_MASK) ==
1563 	     IEEE80211_QOS_ACK_POLICY_NOACK))
1564 		ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1565 
1566 	if (0 && k != NULL) {
1567 		/*
1568 		 * Map 802.11 cipher to hardware encryption type and
1569 		 * compute MIC+ICV overhead.
1570 		 */
1571 		switch (k->k_cipher) {
1572 		case IEEE80211_CIPHER_WEP40:
1573 		case IEEE80211_CIPHER_WEP104:
1574 			encrtype = AR_ENCR_TYPE_WEP;
1575 			totlen += 4;
1576 			break;
1577 		case IEEE80211_CIPHER_TKIP:
1578 			encrtype = AR_ENCR_TYPE_TKIP;
1579 			totlen += 12;
1580 			break;
1581 		case IEEE80211_CIPHER_CCMP:
1582 			encrtype = AR_ENCR_TYPE_AES;
1583 			totlen += 8;
1584 			break;
1585 		default:
1586 			panic("unsupported cipher");
1587 		}
1588 		/*
1589 		 * NB: The key cache entry index is stored in the key
1590 		 * private field when the key is installed.
1591 		 */
1592 		entry = (uintptr_t)k->k_priv;
1593 		ds->ds_ctl12 |= SM(AR_TXC12_DEST_IDX, entry);
1594 		ds->ds_ctl11 |= AR_TXC11_DEST_IDX_VALID;
1595 	} else
1596 		encrtype = AR_ENCR_TYPE_CLEAR;
1597 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, encrtype);
1598 
1599 	/* Check if frame must be protected using RTS/CTS or CTS-to-self. */
1600 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1601 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1602 	    IEEE80211_FC0_TYPE_DATA) {
1603 		/* NB: Group frames are sent using CCK in 802.11b/g. */
1604 		if (totlen > ic->ic_rtsthreshold) {
1605 			ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1606 		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1607 		    athn_rates[ridx[0]].phy == IEEE80211_T_OFDM) {
1608 			if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1609 				ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1610 			else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1611 				ds->ds_ctl11 |= AR_TXC11_CTS_ENABLE;
1612 		}
1613 	}
1614 	/*
1615 	 * Disable multi-rate retries when protection is used.
1616 	 * The RTS/CTS frame's duration field is fixed and won't be
1617 	 * updated by hardware when the data rate changes.
1618 	 */
1619 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1620 		ridx[1] = ridx[2] = ridx[3] = ridx[0];
1621 	}
1622 	/* Setup multi-rate retries. */
1623 	for (i = 0; i < 4; i++) {
1624 		series[i].hwrate = athn_rates[ridx[i]].hwrate;
1625 		if (athn_rates[ridx[i]].phy == IEEE80211_T_DS &&
1626 		    ridx[i] != ATHN_RIDX_CCK1 &&
1627 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1628 			series[i].hwrate |= 0x04;
1629 		series[i].dur = 0;
1630 	}
1631 	if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1632 		/* Compute duration for each series. */
1633 		for (i = 0; i < 4; i++) {
1634 			series[i].dur = athn_txtime(sc, IEEE80211_ACK_LEN,
1635 			    athn_rates[ridx[i]].rspridx, ic->ic_flags);
1636 		}
1637 	}
1638 	/* If this is a PA training frame, select the Tx chain to use. */
1639 	if (__predict_false(txflags & ATHN_TXFLAG_PAPRD)) {
1640 		ds->ds_ctl12 |= SM(AR_TXC12_PAPRD_CHAIN_MASK,
1641 		    1 << sc->paprd_curchain);
1642 	}
1643 
1644 	/* Write number of tries for each series. */
1645 	ds->ds_ctl13 =
1646 	    SM(AR_TXC13_XMIT_DATA_TRIES0, 2) |
1647 	    SM(AR_TXC13_XMIT_DATA_TRIES1, 2) |
1648 	    SM(AR_TXC13_XMIT_DATA_TRIES2, 2) |
1649 	    SM(AR_TXC13_XMIT_DATA_TRIES3, 4);
1650 
1651 	/* Tell HW to update duration field in 802.11 header. */
1652 	if (type != AR_FRAME_TYPE_PSPOLL)
1653 		ds->ds_ctl13 |= AR_TXC13_DUR_UPDATE_ENA;
1654 
1655 	/* Write Tx rate for each series. */
1656 	ds->ds_ctl14 =
1657 	    SM(AR_TXC14_XMIT_RATE0, series[0].hwrate) |
1658 	    SM(AR_TXC14_XMIT_RATE1, series[1].hwrate) |
1659 	    SM(AR_TXC14_XMIT_RATE2, series[2].hwrate) |
1660 	    SM(AR_TXC14_XMIT_RATE3, series[3].hwrate);
1661 
1662 	/* Write duration for each series. */
1663 	ds->ds_ctl15 =
1664 	    SM(AR_TXC15_PACKET_DUR0, series[0].dur) |
1665 	    SM(AR_TXC15_PACKET_DUR1, series[1].dur);
1666 	ds->ds_ctl16 =
1667 	    SM(AR_TXC16_PACKET_DUR2, series[2].dur) |
1668 	    SM(AR_TXC16_PACKET_DUR3, series[3].dur);
1669 
1670 	if ((sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) &&
1671 	    ic->ic_curmode == IEEE80211_MODE_11A) {
1672 		/*
1673 		 * In order to not exceed PCIe power requirements, we only
1674 		 * use two Tx chains for MCS0~15 on 5GHz band on these chips.
1675 		 */
1676 		ds->ds_ctl18 =
1677 		    SM(AR_TXC18_CHAIN_SEL0,
1678 			(ridx[0] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1679 		    SM(AR_TXC18_CHAIN_SEL1,
1680 			(ridx[1] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1681 		    SM(AR_TXC18_CHAIN_SEL2,
1682 			(ridx[2] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1683 		    SM(AR_TXC18_CHAIN_SEL3,
1684 			(ridx[3] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask);
1685 	} else {
1686 		/* Use the same Tx chains for all tries. */
1687 		ds->ds_ctl18 =
1688 		    SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask) |
1689 		    SM(AR_TXC18_CHAIN_SEL1, sc->txchainmask) |
1690 		    SM(AR_TXC18_CHAIN_SEL2, sc->txchainmask) |
1691 		    SM(AR_TXC18_CHAIN_SEL3, sc->txchainmask);
1692 	}
1693 #ifdef notyet
1694 	/* Use the same short GI setting for all tries. */
1695 	if (ic->ic_flags & IEEE80211_F_SHGI)
1696 		ds->ds_ctl18 |= AR_TXC18_GI0123;
1697 	/* Use the same channel width for all tries. */
1698 	if (ic->ic_flags & IEEE80211_F_CBW40)
1699 		ds->ds_ctl18 |= AR_TXC18_2040_0123;
1700 #endif
1701 
1702 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1703 		uint8_t protridx, hwrate;
1704 		uint16_t dur = 0;
1705 
1706 		/* Use the same protection mode for all tries. */
1707 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1708 			ds->ds_ctl15 |= AR_TXC15_RTSCTS_QUAL01;
1709 			ds->ds_ctl16 |= AR_TXC16_RTSCTS_QUAL23;
1710 		}
1711 		/* Select protection rate (suboptimal but ok). */
1712 		protridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1713 		    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK2;
1714 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1715 			/* Account for CTS duration. */
1716 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1717 			    athn_rates[protridx].rspridx, ic->ic_flags);
1718 		}
1719 		dur += athn_txtime(sc, totlen, ridx[0], ic->ic_flags);
1720 		if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1721 			/* Account for ACK duration. */
1722 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1723 			    athn_rates[ridx[0]].rspridx, ic->ic_flags);
1724 		}
1725 		/* Write protection frame duration and rate. */
1726 		ds->ds_ctl13 |= SM(AR_TXC13_BURST_DUR, dur);
1727 		hwrate = athn_rates[protridx].hwrate;
1728 		if (protridx == ATHN_RIDX_CCK2 &&
1729 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1730 			hwrate |= 0x04;
1731 		ds->ds_ctl18 |= SM(AR_TXC18_RTSCTS_RATE, hwrate);
1732 	}
1733 
1734 	ds->ds_ctl11 |= SM(AR_TXC11_FRAME_LEN, totlen);
1735 	ds->ds_ctl19 = AR_TXC19_NOT_SOUNDING;
1736 
1737 	for (i = 0; i < bf->bf_map->dm_nsegs; i++) {
1738 		ds->ds_segs[i].ds_data = bf->bf_map->dm_segs[i].ds_addr;
1739 		ds->ds_segs[i].ds_ctl = SM(AR_TXC_BUF_LEN,
1740 		    bf->bf_map->dm_segs[i].ds_len);
1741 	}
1742 	/* Compute Tx descriptor checksum. */
1743 	sum = ds->ds_info + ds->ds_link;
1744 	for (i = 0; i < 4; i++) {
1745 		sum += ds->ds_segs[i].ds_data;
1746 		sum += ds->ds_segs[i].ds_ctl;
1747 	}
1748 	sum = (sum >> 16) + (sum & 0xffff);
1749 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1750 
1751 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1752 	    BUS_DMASYNC_PREWRITE);
1753 
1754 	DPRINTFN(6, ("Tx qid=%d nsegs=%d ctl11=0x%x ctl12=0x%x ctl14=0x%x\n",
1755 	    qid, bf->bf_map->dm_nsegs, ds->ds_ctl11, ds->ds_ctl12,
1756 	    ds->ds_ctl14));
1757 
1758 	SIMPLEQ_REMOVE_HEAD(&sc->txbufs, bf_list);
1759 	SIMPLEQ_INSERT_TAIL(&txq->head, bf, bf_list);
1760 
1761 	/* Queue buffer unless hardware FIFO is already full. */
1762 	if (++txq->queued <= AR9003_TX_QDEPTH) {
1763 		AR_WRITE(sc, AR_QTXDP(qid), bf->bf_daddr);
1764 		AR_WRITE_BARRIER(sc);
1765 	} else if (txq->wait == NULL)
1766 		txq->wait = bf;
1767 	return (0);
1768 }
1769 
1770 void
1771 ar9003_set_rf_mode(struct athn_softc *sc, struct ieee80211_channel *c)
1772 {
1773 	uint32_t reg;
1774 
1775 	reg = IEEE80211_IS_CHAN_2GHZ(c) ?
1776 	    AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
1777 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
1778 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
1779 		reg |= AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE;
1780 	}
1781 	AR_WRITE(sc, AR_PHY_MODE, reg);
1782 	AR_WRITE_BARRIER(sc);
1783 }
1784 
1785 static __inline uint32_t
1786 ar9003_synth_delay(struct athn_softc *sc)
1787 {
1788 	uint32_t delay;
1789 
1790 	delay = MS(AR_READ(sc, AR_PHY_RX_DELAY), AR_PHY_RX_DELAY_DELAY);
1791 	if (sc->sc_ic.ic_curmode == IEEE80211_MODE_11B)
1792 		delay = (delay * 4) / 22;
1793 	else
1794 		delay = delay / 10;	/* in 100ns steps */
1795 	return (delay);
1796 }
1797 
1798 int
1799 ar9003_rf_bus_request(struct athn_softc *sc)
1800 {
1801 	int ntries;
1802 
1803 	/* Request RF Bus grant. */
1804 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
1805 	for (ntries = 0; ntries < 10000; ntries++) {
1806 		if (AR_READ(sc, AR_PHY_RFBUS_GRANT) & AR_PHY_RFBUS_GRANT_EN)
1807 			return (0);
1808 		DELAY(10);
1809 	}
1810 	DPRINTF(("could not kill baseband Rx"));
1811 	return (ETIMEDOUT);
1812 }
1813 
1814 void
1815 ar9003_rf_bus_release(struct athn_softc *sc)
1816 {
1817 	/* Wait for the synthesizer to settle. */
1818 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + ar9003_synth_delay(sc));
1819 
1820 	/* Release the RF Bus grant. */
1821 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, 0);
1822 	AR_WRITE_BARRIER(sc);
1823 }
1824 
1825 void
1826 ar9003_set_phy(struct athn_softc *sc, struct ieee80211_channel *c,
1827     struct ieee80211_channel *extc)
1828 {
1829 	uint32_t phy;
1830 
1831 	phy = AR_READ(sc, AR_PHY_GEN_CTRL);
1832 	phy |= AR_PHY_GC_HT_EN | AR_PHY_GC_SHORT_GI_40 |
1833 	    AR_PHY_GC_SINGLE_HT_LTF1 | AR_PHY_GC_WALSH;
1834 	if (extc != NULL) {
1835 		phy |= AR_PHY_GC_DYN2040_EN;
1836 		if (extc > c)	/* XXX */
1837 			phy |= AR_PHY_GC_DYN2040_PRI_CH;
1838 	}
1839 	/* Turn off Green Field detection for now. */
1840 	phy &= ~AR_PHY_GC_GF_DETECT_EN;
1841 	AR_WRITE(sc, AR_PHY_GEN_CTRL, phy);
1842 
1843 	AR_WRITE(sc, AR_2040_MODE,
1844 	    (extc != NULL) ? AR_2040_JOINED_RX_CLEAR : 0);
1845 
1846 	/* Set global transmit timeout. */
1847 	AR_WRITE(sc, AR_GTXTO, SM(AR_GTXTO_TIMEOUT_LIMIT, 25));
1848 	/* Set carrier sense timeout. */
1849 	AR_WRITE(sc, AR_CST, SM(AR_CST_TIMEOUT_LIMIT, 15));
1850 	AR_WRITE_BARRIER(sc);
1851 }
1852 
1853 void
1854 ar9003_set_delta_slope(struct athn_softc *sc, struct ieee80211_channel *c,
1855     struct ieee80211_channel *extc)
1856 {
1857 	uint32_t coeff, exp, man, reg;
1858 
1859 	/* Set Delta Slope (exponent and mantissa). */
1860 	coeff = (100 << 24) / c->ic_freq;
1861 	athn_get_delta_slope(coeff, &exp, &man);
1862 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1863 
1864 	reg = AR_READ(sc, AR_PHY_TIMING3);
1865 	reg = RW(reg, AR_PHY_TIMING3_DSC_EXP, exp);
1866 	reg = RW(reg, AR_PHY_TIMING3_DSC_MAN, man);
1867 	AR_WRITE(sc, AR_PHY_TIMING3, reg);
1868 
1869 	/* For Short GI, coeff is 9/10 that of normal coeff. */
1870 	coeff = (9 * coeff) / 10;
1871 	athn_get_delta_slope(coeff, &exp, &man);
1872 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1873 
1874 	reg = AR_READ(sc, AR_PHY_SGI_DELTA);
1875 	reg = RW(reg, AR_PHY_SGI_DSC_EXP, exp);
1876 	reg = RW(reg, AR_PHY_SGI_DSC_MAN, man);
1877 	AR_WRITE(sc, AR_PHY_SGI_DELTA, reg);
1878 	AR_WRITE_BARRIER(sc);
1879 }
1880 
1881 void
1882 ar9003_enable_antenna_diversity(struct athn_softc *sc)
1883 {
1884 	AR_SETBITS(sc, AR_PHY_CCK_DETECT,
1885 	    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
1886 	AR_WRITE_BARRIER(sc);
1887 }
1888 
1889 void
1890 ar9003_init_baseband(struct athn_softc *sc)
1891 {
1892 	uint32_t synth_delay;
1893 
1894 	synth_delay = ar9003_synth_delay(sc);
1895 	/* Activate the PHY (includes baseband activate and synthesizer on). */
1896 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
1897 	AR_WRITE_BARRIER(sc);
1898 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + synth_delay);
1899 }
1900 
1901 void
1902 ar9003_disable_phy(struct athn_softc *sc)
1903 {
1904 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
1905 	AR_WRITE_BARRIER(sc);
1906 }
1907 
1908 void
1909 ar9003_init_chains(struct athn_softc *sc)
1910 {
1911 	if (sc->rxchainmask == 0x5 || sc->txchainmask == 0x5)
1912 		AR_SETBITS(sc, AR_PHY_ANALOG_SWAP, AR_PHY_SWAP_ALT_CHAIN);
1913 
1914 	/* Setup chain masks. */
1915 	AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1916 	AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1917 
1918 	if (sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) {
1919 		/*
1920 		 * All self-generated frames are sent using two Tx chains
1921 		 * on these chips to not exceed PCIe power requirements.
1922 		 */
1923 		AR_WRITE(sc, AR_SELFGEN_MASK, 0x3);
1924 	} else
1925 		AR_WRITE(sc, AR_SELFGEN_MASK, sc->txchainmask);
1926 	AR_WRITE_BARRIER(sc);
1927 }
1928 
1929 void
1930 ar9003_set_rxchains(struct athn_softc *sc)
1931 {
1932 	if (sc->rxchainmask == 0x3 || sc->rxchainmask == 0x5) {
1933 		AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1934 		AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1935 		AR_WRITE_BARRIER(sc);
1936 	}
1937 }
1938 
1939 void
1940 ar9003_read_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1941 {
1942 /* Sign-extends 9-bit value (assumes upper bits are zeroes). */
1943 #define SIGN_EXT(v)	(((v) ^ 0x100) - 0x100)
1944 	uint32_t reg;
1945 	int i;
1946 
1947 	for (i = 0; i < sc->nrxchains; i++) {
1948 		reg = AR_READ(sc, AR_PHY_CCA(i));
1949 		nf[i] = MS(reg, AR_PHY_MINCCA_PWR);
1950 		nf[i] = SIGN_EXT(nf[i]);
1951 
1952 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1953 		nf_ext[i] = MS(reg, AR_PHY_EXT_MINCCA_PWR);
1954 		nf_ext[i] = SIGN_EXT(nf_ext[i]);
1955 	}
1956 #undef SIGN_EXT
1957 }
1958 
1959 void
1960 ar9003_write_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1961 {
1962 	uint32_t reg;
1963 	int i;
1964 
1965 	for (i = 0; i < sc->nrxchains; i++) {
1966 		reg = AR_READ(sc, AR_PHY_CCA(i));
1967 		reg = RW(reg, AR_PHY_MAXCCA_PWR, nf[i]);
1968 		AR_WRITE(sc, AR_PHY_CCA(i), reg);
1969 
1970 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1971 		reg = RW(reg, AR_PHY_EXT_MAXCCA_PWR, nf_ext[i]);
1972 		AR_WRITE(sc, AR_PHY_EXT_CCA(i), reg);
1973 	}
1974 	AR_WRITE_BARRIER(sc);
1975 }
1976 
1977 int
1978 ar9003_get_noisefloor(struct athn_softc *sc)
1979 {
1980 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
1981 	int i;
1982 
1983 	if (AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
1984 		/* Noisefloor calibration not finished. */
1985 		return 0;
1986 	}
1987 	/* Noisefloor calibration is finished. */
1988 	ar9003_read_noisefloor(sc, nf, nf_ext);
1989 
1990 	/* Update noisefloor history. */
1991 	for (i = 0; i < sc->nrxchains; i++) {
1992 		sc->nf_hist[sc->nf_hist_cur].nf[i] = nf[i];
1993 		sc->nf_hist[sc->nf_hist_cur].nf_ext[i] = nf_ext[i];
1994 	}
1995 	if (++sc->nf_hist_cur >= ATHN_NF_CAL_HIST_MAX)
1996 		sc->nf_hist_cur = 0;
1997 	return 1;
1998 }
1999 
2000 void
2001 ar9003_bb_load_noisefloor(struct athn_softc *sc)
2002 {
2003 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
2004 	int i, ntries;
2005 
2006 	/* Write filtered noisefloor values. */
2007 	for (i = 0; i < sc->nrxchains; i++) {
2008 		nf[i] = sc->nf_priv[i] * 2;
2009 		nf_ext[i] = sc->nf_ext_priv[i] * 2;
2010 	}
2011 	ar9003_write_noisefloor(sc, nf, nf_ext);
2012 
2013 	/* Load filtered noisefloor values into baseband. */
2014 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2015 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2016 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2017 	/* Wait for load to complete. */
2018 	for (ntries = 0; ntries < 1000; ntries++) {
2019 		if (!(AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
2020 			break;
2021 		DELAY(10);
2022 	}
2023 	if (ntries == 1000) {
2024 		DPRINTF(("failed to load noisefloor values\n"));
2025 		return;
2026 	}
2027 
2028 	/* Restore noisefloor values to initial (max) values. */
2029 	for (i = 0; i < AR_MAX_CHAINS; i++)
2030 		nf[i] = nf_ext[i] = -50 * 2;
2031 	ar9003_write_noisefloor(sc, nf, nf_ext);
2032 }
2033 
2034 void
2035 ar9003_apply_noisefloor(struct athn_softc *sc)
2036 {
2037 	uint32_t agc_nfcal;
2038 
2039 	agc_nfcal = AR_READ(sc, AR_PHY_AGC_CONTROL) &
2040 	    (AR_PHY_AGC_CONTROL_NF | AR_PHY_AGC_CONTROL_ENABLE_NF |
2041 	    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2042 
2043 	if (agc_nfcal & AR_PHY_AGC_CONTROL_NF) {
2044 		/* Pause running NF calibration while values are updated. */
2045 		AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2046 		AR_WRITE_BARRIER(sc);
2047 	}
2048 
2049 	ar9003_bb_load_noisefloor(sc);
2050 
2051 	if (agc_nfcal & AR_PHY_AGC_CONTROL_NF) {
2052 		/* Restart interrupted NF calibration. */
2053 		AR_SETBITS(sc, AR_PHY_AGC_CONTROL, agc_nfcal);
2054 		AR_WRITE_BARRIER(sc);
2055 	}
2056 }
2057 
2058 void
2059 ar9003_do_noisefloor_calib(struct athn_softc *sc)
2060 {
2061 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2062 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2063 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2064 	AR_WRITE_BARRIER(sc);
2065 }
2066 
2067 void
2068 ar9003_init_noisefloor_calib(struct athn_softc *sc)
2069 {
2070 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2071 	AR_WRITE_BARRIER(sc);
2072 }
2073 
2074 int
2075 ar9003_init_calib(struct athn_softc *sc)
2076 {
2077 	uint8_t txchainmask, rxchainmask;
2078 	uint32_t reg;
2079 	int ntries;
2080 
2081 	/* Save chains masks. */
2082 	txchainmask = sc->txchainmask;
2083 	rxchainmask = sc->rxchainmask;
2084 	/* Configure hardware before calibration. */
2085 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_CHAIN2_DISABLE)
2086 		txchainmask = rxchainmask = 0x3;
2087 	else
2088 		txchainmask = rxchainmask = 0x7;
2089 	ar9003_init_chains(sc);
2090 
2091 	/* Perform Tx IQ calibration. */
2092 	ar9003_calib_tx_iq(sc);
2093 	/* Disable and re-enable the PHY chips. */
2094 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
2095 	AR_WRITE_BARRIER(sc);
2096 	DELAY(5);
2097 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
2098 
2099 	/* Calibrate the AGC. */
2100 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
2101 	/* Poll for offset calibration completion. */
2102 	for (ntries = 0; ntries < 10000; ntries++) {
2103 		reg = AR_READ(sc, AR_PHY_AGC_CONTROL);
2104 		if (!(reg & AR_PHY_AGC_CONTROL_CAL))
2105 			break;
2106 		DELAY(10);
2107 	}
2108 	if (ntries == 10000)
2109 		return (ETIMEDOUT);
2110 
2111 	/* Restore chains masks. */
2112 	sc->txchainmask = txchainmask;
2113 	sc->rxchainmask = rxchainmask;
2114 	ar9003_init_chains(sc);
2115 
2116 	return (0);
2117 }
2118 
2119 void
2120 ar9003_do_calib(struct athn_softc *sc)
2121 {
2122 	uint32_t reg;
2123 
2124 	if (sc->cur_calib_mask & ATHN_CAL_IQ) {
2125 		reg = AR_READ(sc, AR_PHY_TIMING4);
2126 		reg = RW(reg, AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX, 10);
2127 		AR_WRITE(sc, AR_PHY_TIMING4, reg);
2128 		AR_WRITE(sc, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
2129 		AR_SETBITS(sc, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
2130 		AR_WRITE_BARRIER(sc);
2131 	} else if (sc->cur_calib_mask & ATHN_CAL_TEMP) {
2132 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2133 		    AR_PHY_65NM_CH0_THERM_LOCAL);
2134 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2135 		    AR_PHY_65NM_CH0_THERM_START);
2136 		AR_WRITE_BARRIER(sc);
2137 	}
2138 }
2139 
2140 void
2141 ar9003_next_calib(struct athn_softc *sc)
2142 {
2143 	/* Check if we have any calibration in progress. */
2144 	if (sc->cur_calib_mask != 0) {
2145 		if (!(AR_READ(sc, AR_PHY_TIMING4) & AR_PHY_TIMING4_DO_CAL)) {
2146 			/* Calibration completed for current sample. */
2147 			ar9003_calib_iq(sc);
2148 		}
2149 	}
2150 }
2151 
2152 void
2153 ar9003_calib_iq(struct athn_softc *sc)
2154 {
2155 	struct athn_iq_cal *cal;
2156 	uint32_t reg, i_coff_denom, q_coff_denom;
2157 	int32_t i_coff, q_coff;
2158 	int i, iq_corr_neg;
2159 
2160 	for (i = 0; i < AR_MAX_CHAINS; i++) {
2161 		cal = &sc->calib.iq[i];
2162 
2163 		/* Read IQ calibration measures (clear on read). */
2164 		cal->pwr_meas_i = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_0_B(i));
2165 		cal->pwr_meas_q = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_1_B(i));
2166 		cal->iq_corr_meas =
2167 		    (int32_t)AR_READ(sc, AR_PHY_IQ_ADC_MEAS_2_B(i));
2168 	}
2169 
2170 	for (i = 0; i < sc->nrxchains; i++) {
2171 		cal = &sc->calib.iq[i];
2172 
2173 		if (cal->pwr_meas_q == 0)
2174 			continue;
2175 
2176 		if ((iq_corr_neg = cal->iq_corr_meas < 0))
2177 			cal->iq_corr_meas = -cal->iq_corr_meas;
2178 
2179 		i_coff_denom =
2180 		    (cal->pwr_meas_i / 2 + cal->pwr_meas_q / 2) / 256;
2181 		q_coff_denom = cal->pwr_meas_q / 64;
2182 
2183 		if (i_coff_denom == 0 || q_coff_denom == 0)
2184 			continue;	/* Prevents division by zero. */
2185 
2186 		i_coff = cal->iq_corr_meas / i_coff_denom;
2187 		q_coff = (cal->pwr_meas_i / q_coff_denom) - 64;
2188 
2189 		if (i_coff > 63)
2190 			i_coff = 63;
2191 		else if (i_coff < -63)
2192 			i_coff = -63;
2193 		/* Negate i_coff if iq_corr_meas is positive. */
2194 		if (!iq_corr_neg)
2195 			i_coff = -i_coff;
2196 		if (q_coff > 63)
2197 			q_coff = 63;
2198 		else if (q_coff < -63)
2199 			q_coff = -63;
2200 
2201 		DPRINTFN(2, ("IQ calibration for chain %d\n", i));
2202 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2203 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF, i_coff);
2204 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF, q_coff);
2205 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2206 	}
2207 
2208 	/* Apply new settings. */
2209 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2210 	    AR_PHY_RX_IQCAL_CORR_IQCORR_ENABLE);
2211 	AR_WRITE_BARRIER(sc);
2212 
2213 	/* IQ calibration done. */
2214 	sc->cur_calib_mask &= ~ATHN_CAL_IQ;
2215 	memset(&sc->calib, 0, sizeof(sc->calib));
2216 }
2217 
2218 #define DELPT	32
2219 int
2220 ar9003_get_iq_corr(struct athn_softc *sc, int32_t res[6], int32_t coeff[2])
2221 {
2222 /* Sign-extends 12-bit value (assumes upper bits are zeroes). */
2223 #define SIGN_EXT(v)	(((v) ^ 0x800) - 0x800)
2224 #define SCALE		(1 << 15)
2225 #define SHIFT		(1 <<  8)
2226 	struct {
2227 		int32_t	m, p, c;
2228 	} val[2][2];
2229 	int32_t mag[2][2], phs[2][2], cos[2], sin[2];
2230 	int32_t min, max, div, f1, f2, f3, m, p, c;
2231 	int32_t txmag, txphs, rxmag, rxphs;
2232 	int32_t q_coff, i_coff;
2233 	int i, j;
2234 
2235 	/* Extract our twelve signed 12-bit values from res[] array. */
2236 	val[0][0].m = res[0] & 0xfff;
2237 	val[0][0].p = (res[0] >> 12) & 0xfff;
2238 	val[0][0].c = ((res[0] >> 24) & 0xff) | (res[1] & 0xf) << 8;
2239 
2240 	val[0][1].m = (res[1] >> 4) & 0xfff;
2241 	val[0][1].p = res[2] & 0xfff;
2242 	val[0][1].c = (res[2] >> 12) & 0xfff;
2243 
2244 	val[1][0].m = ((res[2] >> 24) & 0xff) | (res[3] & 0xf) << 8;
2245 	val[1][0].p = (res[3] >> 4) & 0xfff;
2246 	val[1][0].c = res[4] & 0xfff;
2247 
2248 	val[1][1].m = (res[4] >> 12) & 0xfff;
2249 	val[1][1].p = ((res[4] >> 24) & 0xff) | (res[5] & 0xf) << 8;
2250 	val[1][1].c = (res[5] >> 4) & 0xfff;
2251 
2252 	for (i = 0; i < 2; i++) {
2253 		for (j = 0; j < 2; j++) {
2254 			m = SIGN_EXT(val[i][j].m);
2255 			p = SIGN_EXT(val[i][j].p);
2256 			c = SIGN_EXT(val[i][j].c);
2257 
2258 			if (p == 0)
2259 				return (1);	/* Prevent division by 0. */
2260 
2261 			mag[i][j] = (m * SCALE) / p;
2262 			phs[i][j] = (c * SCALE) / p;
2263 		}
2264 		sin[i] = ((mag[i][0] - mag[i][1]) * SHIFT) / DELPT;
2265 		cos[i] = ((phs[i][0] - phs[i][1]) * SHIFT) / DELPT;
2266 		/* Find magnitude by approximation. */
2267 		min = MIN(abs(sin[i]), abs(cos[i]));
2268 		max = MAX(abs(sin[i]), abs(cos[i]));
2269 		div = max - (max / 32) + (min / 8) + (min / 4);
2270 		if (div == 0)
2271 			return (1);	/* Prevent division by 0. */
2272 		/* Normalize sin and cos by magnitude. */
2273 		sin[i] = (sin[i] * SCALE) / div;
2274 		cos[i] = (cos[i] * SCALE) / div;
2275 	}
2276 
2277 	/* Compute IQ mismatch (solve 4x4 linear equation). */
2278 	f1 = cos[0] - cos[1];
2279 	f3 = sin[0] - sin[1];
2280 	f2 = (f1 * f1 + f3 * f3) / SCALE;
2281 	if (f2 == 0)
2282 		return (1);	/* Prevent division by 0. */
2283 
2284 	/* Compute Tx magnitude mismatch. */
2285 	txmag = (f1 * ( mag[0][0] - mag[1][0]) +
2286 		 f3 * ( phs[0][0] - phs[1][0])) / f2;
2287 	/* Compute Tx phase mismatch. */
2288 	txphs = (f3 * (-mag[0][0] + mag[1][0]) +
2289 		 f1 * ( phs[0][0] - phs[1][0])) / f2;
2290 
2291 	if (txmag == SCALE)
2292 		return (1);	/* Prevent division by 0. */
2293 
2294 	/* Compute Rx magnitude mismatch. */
2295 	rxmag = mag[0][0] - (cos[0] * txmag + sin[0] * txphs) / SCALE;
2296 	/* Compute Rx phase mismatch. */
2297 	rxphs = phs[0][0] + (sin[0] * txmag - cos[0] * txphs) / SCALE;
2298 
2299 	if (-rxmag == SCALE)
2300 		return (1);	/* Prevent division by 0. */
2301 
2302 	txmag = (txmag * SCALE) / (SCALE - txmag);
2303 	txphs = -txphs;
2304 
2305 	q_coff = (txmag * 128) / SCALE;
2306 	if (q_coff < -63)
2307 		q_coff = -63;
2308 	else if (q_coff > 63)
2309 		q_coff = 63;
2310 	i_coff = (txphs * 256) / SCALE;
2311 	if (i_coff < -63)
2312 		i_coff = -63;
2313 	else if (i_coff > 63)
2314 		i_coff = 63;
2315 	coeff[0] = q_coff * 128 + i_coff;
2316 
2317 	rxmag = (-rxmag * SCALE) / (SCALE + rxmag);
2318 	rxphs = -rxphs;
2319 
2320 	q_coff = (rxmag * 128) / SCALE;
2321 	if (q_coff < -63)
2322 		q_coff = -63;
2323 	else if (q_coff > 63)
2324 		q_coff = 63;
2325 	i_coff = (rxphs * 256) / SCALE;
2326 	if (i_coff < -63)
2327 		i_coff = -63;
2328 	else if (i_coff > 63)
2329 		i_coff = 63;
2330 	coeff[1] = q_coff * 128 + i_coff;
2331 
2332 	return (0);
2333 #undef SHIFT
2334 #undef SCALE
2335 #undef SIGN_EXT
2336 }
2337 
2338 int
2339 ar9003_calib_tx_iq(struct athn_softc *sc)
2340 {
2341 	uint32_t reg;
2342 	int32_t res[6], coeff[2];
2343 	int i, j, ntries;
2344 
2345 	reg = AR_READ(sc, AR_PHY_TX_IQCAL_CONTROL_1);
2346 	reg = RW(reg, AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT, DELPT);
2347 	AR_WRITE(sc, AR_PHY_TX_IQCAL_CONTROL_1, reg);
2348 
2349 	/* Start Tx IQ calibration. */
2350 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_START, AR_PHY_TX_IQCAL_START_DO_CAL);
2351 	/* Wait for completion. */
2352 	for (ntries = 0; ntries < 10000; ntries++) {
2353 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_START);
2354 		if (!(reg & AR_PHY_TX_IQCAL_START_DO_CAL))
2355 			break;
2356 		DELAY(10);
2357 	}
2358 	if (ntries == 10000)
2359 		return (ETIMEDOUT);
2360 
2361 	for (i = 0; i < sc->ntxchains; i++) {
2362 		/* Read Tx IQ calibration status for this chain. */
2363 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_STATUS_B(i));
2364 		if (reg & AR_PHY_TX_IQCAL_STATUS_FAILED)
2365 			return (EIO);
2366 		/*
2367 		 * Read Tx IQ calibration results for this chain.
2368 		 * This consists in twelve signed 12-bit values.
2369 		 */
2370 		for (j = 0; j < 3; j++) {
2371 			AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2372 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2373 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2374 			res[j * 2 + 0] = reg;
2375 
2376 			AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2377 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2378 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2379 			res[j * 2 + 1] = reg & 0xffff;
2380 		}
2381 
2382 		/* Compute Tx IQ correction. */
2383 		if (ar9003_get_iq_corr(sc, res, coeff) != 0)
2384 			return (EIO);
2385 
2386 		/* Write Tx IQ correction coefficients. */
2387 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i));
2388 		reg = RW(reg, AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE,
2389 		    coeff[0]);
2390 		AR_WRITE(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i), reg);
2391 
2392 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2393 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_Q_COFF,
2394 		    coeff[1] >> 7);
2395 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_I_COFF,
2396 		    coeff[1]);
2397 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2398 		AR_WRITE_BARRIER(sc);
2399 	}
2400 
2401 	/* Enable Tx IQ correction. */
2402 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_CONTROL_3,
2403 	    AR_PHY_TX_IQCAL_CONTROL_3_IQCORR_EN);
2404 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2405 	    AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN);
2406 	AR_WRITE_BARRIER(sc);
2407 	return (0);
2408 }
2409 #undef DELPT
2410 
2411 /*-
2412  * The power amplifier predistortion state machine works as follows:
2413  * 1) Disable digital predistorters for all Tx chains
2414  * 2) Repeat steps 3~7 for all Tx chains
2415  * 3)   Force Tx gain to that of training signal
2416  * 4)   Send training signal (asynchronous)
2417  * 5)   Wait for training signal to complete (asynchronous)
2418  * 6)   Read PA measurements (input power, output power, output phase)
2419  * 7)   Compute the predistortion function that linearizes PA output
2420  * 8) Write predistortion functions to hardware tables for all Tx chains
2421  * 9) Enable digital predistorters for all Tx chains
2422  */
2423 void
2424 ar9003_paprd_calib(struct athn_softc *sc, struct ieee80211_channel *c)
2425 {
2426 	static const int scaling[] = {
2427 		261376, 248079, 233759, 220464,
2428 		208194, 196949, 185706, 175487
2429 	};
2430 	struct athn_ops *ops = &sc->ops;
2431 	uint32_t reg, ht20mask, ht40mask;
2432 	int i;
2433 
2434 	/* Read PA predistortion masks from ROM. */
2435 	ops->get_paprd_masks(sc, c, &ht20mask, &ht40mask);
2436 
2437 	/* AM-to-AM: amplifier's amplitude characteristic. */
2438 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2AM);
2439 	reg = RW(reg, AR_PHY_PAPRD_AM2AM_MASK, ht20mask);
2440 	AR_WRITE(sc, AR_PHY_PAPRD_AM2AM, reg);
2441 
2442 	/* AM-to-PM: amplifier's phase transfer characteristic. */
2443 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2PM);
2444 	reg = RW(reg, AR_PHY_PAPRD_AM2PM_MASK, ht20mask);
2445 	AR_WRITE(sc, AR_PHY_PAPRD_AM2PM, reg);
2446 
2447 	reg = AR_READ(sc, AR_PHY_PAPRD_HT40);
2448 	reg = RW(reg, AR_PHY_PAPRD_HT40_MASK, ht40mask);
2449 	AR_WRITE(sc, AR_PHY_PAPRD_HT40, reg);
2450 
2451 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2452 		AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2453 		    AR_PHY_PAPRD_CTRL0_USE_SINGLE_TABLE);
2454 
2455 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(i));
2456 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_PA_GAIN_SCALE_FACT, 181);
2457 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_MAG_SCALE_FACT, 361);
2458 		reg &= ~AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA;
2459 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2AM_ENA;
2460 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2PM_ENA;
2461 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(i), reg);
2462 
2463 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL0_B(i));
2464 		reg = RW(reg, AR_PHY_PAPRD_CTRL0_PAPRD_MAG_THRSH, 3);
2465 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL0_B(i), reg);
2466 	}
2467 
2468 	/* Disable all digital predistorters during calibration. */
2469 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2470 		AR_CLRBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2471 		    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2472 	}
2473 	AR_WRITE_BARRIER(sc);
2474 
2475 	/*
2476 	 * Configure training signal.
2477 	 */
2478 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL1);
2479 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_AGC2_SETTLING, 28);
2480 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_LB_SKIP, 0x30);
2481 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_RX_BB_GAIN_FORCE;
2482 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_IQCORR_ENABLE;
2483 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_LB_ENABLE;
2484 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TX_GAIN_FORCE;
2485 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TRAIN_ENABLE;
2486 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL1, reg);
2487 
2488 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL2, 147);
2489 
2490 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL3);
2491 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_FINE_CORR_LEN, 4);
2492 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_COARSE_CORR_LEN, 4);
2493 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_NUM_CORR_STAGES, 7);
2494 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_MIN_LOOPBACK_DEL, 1);
2495 	if (AR_SREV_9485(sc))
2496 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -3);
2497 	else
2498 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -6);
2499 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_ADC_DESIRED_SIZE, -15);
2500 	reg |= AR_PHY_PAPRD_TRAINER_CNTL3_BBTXMIX_DISABLE;
2501 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL3, reg);
2502 
2503 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL4);
2504 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_SAFETY_DELTA, 0);
2505 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_MIN_CORR, 400);
2506 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_NUM_TRAIN_SAMPLES, 100);
2507 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL4, reg);
2508 
2509 	for (i = 0; i < nitems(scaling); i++) {
2510 		reg = AR_READ(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i));
2511 		reg = RW(reg, AR_PHY_PAPRD_PRE_POST_SCALING, scaling[i]);
2512 		AR_WRITE(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i), reg);
2513 	}
2514 
2515 	/* Save Tx gain table. */
2516 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE; i++)
2517 		sc->txgain[i] = AR_READ(sc, AR_PHY_TXGAIN_TABLE(i));
2518 
2519 	/* Set Tx power of training signal (use setting for MCS0). */
2520 	sc->trainpow = MS(AR_READ(sc, AR_PHY_PWRTX_RATE5),
2521 	    AR_PHY_PWRTX_RATE5_POWERTXHT20_0) - 4;
2522 
2523 	/*
2524 	 * Start PA predistortion calibration state machine.
2525 	 */
2526 	/* Find first available Tx chain. */
2527 	sc->paprd_curchain = 0;
2528 	while (!(sc->txchainmask & (1 << sc->paprd_curchain)))
2529 		sc->paprd_curchain++;
2530 
2531 	/* Make sure training done bit is clear. */
2532 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2533 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2534 	AR_WRITE_BARRIER(sc);
2535 
2536 	/* Transmit training signal. */
2537 	ar9003_paprd_tx_tone(sc);
2538 }
2539 
2540 int
2541 ar9003_get_desired_txgain(struct athn_softc *sc, int chain, int pow)
2542 {
2543 	int32_t scale, atemp, avolt, tempcal, voltcal, temp, volt;
2544 	int32_t tempcorr, voltcorr;
2545 	uint32_t reg;
2546 	int8_t delta;
2547 
2548 	scale = MS(AR_READ(sc, AR_PHY_TPC_12),
2549 	    AR_PHY_TPC_12_DESIRED_SCALE_HT40_5);
2550 
2551 	reg = AR_READ(sc, AR_PHY_TPC_19);
2552 	atemp = MS(reg, AR_PHY_TPC_19_ALPHA_THERM);
2553 	avolt = MS(reg, AR_PHY_TPC_19_ALPHA_VOLT);
2554 
2555 	reg = AR_READ(sc, AR_PHY_TPC_18);
2556 	tempcal = MS(reg, AR_PHY_TPC_18_THERM_CAL);
2557 	voltcal = MS(reg, AR_PHY_TPC_18_VOLT_CAL);
2558 
2559 	reg = AR_READ(sc, AR_PHY_BB_THERM_ADC_4);
2560 	temp = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_THERM);
2561 	volt = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_VOLT);
2562 
2563 	delta = (int8_t)MS(AR_READ(sc, AR_PHY_TPC_11_B(chain)),
2564 	    AR_PHY_TPC_11_OLPC_GAIN_DELTA);
2565 
2566 	/* Compute temperature and voltage correction. */
2567 	tempcorr = (atemp * (temp - tempcal) + 128) / 256;
2568 	voltcorr = (avolt * (volt - voltcal) + 64) / 128;
2569 
2570 	/* Compute desired Tx gain. */
2571 	return (pow - delta - tempcorr - voltcorr + scale);
2572 }
2573 
2574 void
2575 ar9003_force_txgain(struct athn_softc *sc, uint32_t txgain)
2576 {
2577 	uint32_t reg;
2578 
2579 	reg = AR_READ(sc, AR_PHY_TX_FORCED_GAIN);
2580 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB1DBGAIN,
2581 	    MS(txgain, AR_PHY_TXGAIN_TXBB1DBGAIN));
2582 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB6DBGAIN,
2583 	    MS(txgain, AR_PHY_TXGAIN_TXBB6DBGAIN));
2584 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXMXRGAIN,
2585 	    MS(txgain, AR_PHY_TXGAIN_TXMXRGAIN));
2586 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNA,
2587 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNA));
2588 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNB,
2589 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNB));
2590 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNC,
2591 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNC));
2592 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGND,
2593 	    MS(txgain, AR_PHY_TXGAIN_PADRVGND));
2594 	reg &= ~AR_PHY_TX_FORCED_GAIN_ENABLE_PAL;
2595 	reg &= ~AR_PHY_TX_FORCED_GAIN_FORCE_TX_GAIN;
2596 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, reg);
2597 
2598 	reg = AR_READ(sc, AR_PHY_TPC_1);
2599 	reg = RW(reg, AR_PHY_TPC_1_FORCED_DAC_GAIN, 0);
2600 	reg &= ~AR_PHY_TPC_1_FORCE_DAC_GAIN;
2601 	AR_WRITE(sc, AR_PHY_TPC_1, reg);
2602 	AR_WRITE_BARRIER(sc);
2603 }
2604 
2605 void
2606 ar9003_set_training_gain(struct athn_softc *sc, int chain)
2607 {
2608 	int i, gain;
2609 
2610 	/*
2611 	 * Get desired gain for training signal power (take into account
2612 	 * current temperature/voltage).
2613 	 */
2614 	gain = ar9003_get_desired_txgain(sc, chain, sc->trainpow);
2615 	/* Find entry in table. */
2616 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE - 1; i++)
2617 		if (MS(sc->txgain[i], AR_PHY_TXGAIN_INDEX) >= gain)
2618 			break;
2619 	ar9003_force_txgain(sc, sc->txgain[i]);
2620 }
2621 
2622 int
2623 ar9003_paprd_tx_tone(struct athn_softc *sc)
2624 {
2625 #define TONE_LEN	1800
2626 	struct ieee80211com *ic = &sc->sc_ic;
2627 	struct ieee80211_frame *wh;
2628 	struct ieee80211_node *ni;
2629 	struct mbuf *m;
2630 	int error;
2631 
2632 	/* Build a Null (no data) frame of TONE_LEN bytes. */
2633 	m = MCLGETI(NULL, M_DONTWAIT, NULL, TONE_LEN);
2634 	if (m == NULL)
2635 		return (ENOBUFS);
2636 	memset(mtod(m, caddr_t), 0, TONE_LEN);
2637 	wh = mtod(m, struct ieee80211_frame *);
2638 	wh->i_fc[0] = IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA;
2639 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2640 	*(uint16_t *)wh->i_dur = htole16(10);	/* XXX */
2641 	IEEE80211_ADDR_COPY(wh->i_addr1, ic->ic_myaddr);
2642 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
2643 	IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_myaddr);
2644 	m->m_pkthdr.len = m->m_len = TONE_LEN;
2645 
2646 	/* Set gain of training signal. */
2647 	ar9003_set_training_gain(sc, sc->paprd_curchain);
2648 
2649 	/* Transmit training signal. */
2650 	ni = ieee80211_ref_node(ic->ic_bss);
2651 	if ((error = ar9003_tx(sc, m, ni, ATHN_TXFLAG_PAPRD)) != 0)
2652 		ieee80211_release_node(ic, ni);
2653 	return (error);
2654 #undef TONE_LEN
2655 }
2656 
2657 static __inline int
2658 get_scale(int val)
2659 {
2660 	int log = 0;
2661 
2662 	/* Find the log base 2 (position of highest bit set). */
2663 	while (val >>= 1)
2664 		log++;
2665 
2666 	return ((log > 10) ? log - 10 : 0);
2667 }
2668 
2669 /*
2670  * Compute predistortion function to linearize power amplifier output based
2671  * on feedback from training signal.
2672  */
2673 int
2674 ar9003_compute_predistortion(struct athn_softc *sc, const uint32_t *lo,
2675     const uint32_t *hi)
2676 {
2677 #define NBINS	23
2678 	int chain = sc->paprd_curchain;
2679 	int x[NBINS + 1], y[NBINS + 1], t[NBINS + 1];
2680 	int b1[NBINS + 1], b2[NBINS + 1], xtilde[NBINS + 1];
2681 	int nsamples, txsum, rxsum, rosum, maxidx;
2682 	int order, order5x, order5xrem, order3x, order3xrem, y5, y3;
2683 	int icept, G, I, L, M, angle, xnonlin, y2, y4, sumy2, sumy4;
2684 	int alpha, beta, scale, Qalpha, Qbeta, Qscale, Qx, Qb1, Qb2;
2685 	int tavg, ttilde, maxb1abs, maxb2abs, maxxtildeabs, in;
2686 	int tmp, i;
2687 
2688 	/* Set values at origin. */
2689 	x[0] = y[0] = t[0] = 0;
2690 
2691 #define SCALE	32
2692 	maxidx = 0;
2693 	for (i = 0; i < NBINS; i++) {
2694 		nsamples = lo[i] & 0xffff;
2695 		/* Skip bins that contain 16 or less samples. */
2696 		if (nsamples <= 16) {
2697 			x[i + 1] = y[i + 1] = t[i + 1] = 0;
2698 			continue;
2699 		}
2700 		txsum = (hi[i] & 0x7ff) << 16 | lo[i] >> 16;
2701 		rxsum = (lo[i + NBINS] & 0xffff) << 5 |
2702 		    ((hi[i] >> 11) & 0x1f);
2703 		rosum = (hi[i + NBINS] & 0x7ff) << 16 | hi[i + NBINS] >> 16;
2704 		/* Sign-extend 27-bit value. */
2705 		rosum = (rosum ^ 0x4000000) - 0x4000000;
2706 
2707 		txsum *= SCALE;
2708 		rxsum *= SCALE;
2709 		rosum *= SCALE;
2710 
2711 		x[i + 1] = ((txsum + nsamples) / nsamples + SCALE) / SCALE;
2712 		y[i + 1] = ((rxsum + nsamples) / nsamples + SCALE) / SCALE +
2713 		    SCALE * maxidx + SCALE / 2;
2714 		t[i + 1] = (rosum + nsamples) / nsamples;
2715 		maxidx++;
2716 	}
2717 #undef SCALE
2718 
2719 #define SCALE_LOG	8
2720 #define SCALE		(1 << SCALE_LOG)
2721 	if (x[6] == x[3])
2722 		return (1);	/* Prevent division by 0. */
2723 	G = ((y[6] - y[3]) * SCALE + (x[6] - x[3])) / (x[6] - x[3]);
2724 	if (G == 0)
2725 		return (1);	/* Prevent division by 0. */
2726 
2727 	sc->gain1[chain] = G;	/* Save low signal gain. */
2728 
2729 	/* Find interception point. */
2730 	icept = (G * (x[0] - x[3]) + SCALE) / SCALE + y[3];
2731 	for (i = 0; i <= 3; i++) {
2732 		y[i] = i * 32;
2733 		x[i] = (y[i] * SCALE + G) / G;
2734 	}
2735 	for (i = 4; i <= maxidx; i++)
2736 		y[i] -= icept;
2737 
2738 	xnonlin = x[maxidx] - (y[maxidx] * SCALE + G) / G;
2739 	order = (xnonlin + y[maxidx]) / y[maxidx];
2740 	if (order == 0)
2741 		M = 10;
2742 	else if (order == 1)
2743 		M = 9;
2744 	else
2745 		M = 8;
2746 
2747 	I = (maxidx >= 16) ? 7 : maxidx / 2;
2748 	L = maxidx - I;
2749 
2750 	sumy2 = sumy4 = y2 = y4 = 0;
2751 	for (i = 0; i <= L; i++) {
2752 		if (y[i + I] == 0)
2753 			return (1);	/* Prevent division by 0. */
2754 
2755 		xnonlin = x[i + I] - ((y[i + I] * SCALE) + G) / G;
2756 		xtilde[i] = ((xnonlin << M) + y[i + I]) / y[i + I];
2757 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2758 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2759 
2760 		y2 = (y[i + I] * y[i + I] + SCALE * SCALE) / (SCALE * SCALE);
2761 
2762 		sumy2 += y2;
2763 		sumy4 += y2 * y2;
2764 
2765 		b1[i] = y2 * (L + 1);
2766 		b2[i] = y2;
2767 	}
2768 	for (i = 0; i <= L; i++) {
2769 		b1[i] -= sumy2;
2770 		b2[i] = sumy4 - sumy2 * b2[i];
2771 	}
2772 
2773 	maxxtildeabs = maxb1abs = maxb2abs = 0;
2774 	for (i = 0; i <= L; i++) {
2775 		tmp = abs(xtilde[i]);
2776 		if (tmp > maxxtildeabs)
2777 			maxxtildeabs = tmp;
2778 
2779 		tmp = abs(b1[i]);
2780 		if (tmp > maxb1abs)
2781 			maxb1abs = tmp;
2782 
2783 		tmp = abs(b2[i]);
2784 		if (tmp > maxb2abs)
2785 			maxb2abs = tmp;
2786 	}
2787 	Qx  = get_scale(maxxtildeabs);
2788 	Qb1 = get_scale(maxb1abs);
2789 	Qb2 = get_scale(maxb2abs);
2790 	for (i = 0; i <= L; i++) {
2791 		xtilde[i] /= 1 << Qx;
2792 		b1[i] /= 1 << Qb1;
2793 		b2[i] /= 1 << Qb2;
2794 	}
2795 
2796 	alpha = beta = 0;
2797 	for (i = 0; i <= L; i++) {
2798 		alpha += b1[i] * xtilde[i];
2799 		beta  += b2[i] * xtilde[i];
2800 	}
2801 
2802 	scale = ((y4 / SCALE_LOG) * (L + 1) -
2803 		 (y2 / SCALE_LOG) * sumy2) * SCALE_LOG;
2804 
2805 	Qscale = get_scale(abs(scale));
2806 	scale /= 1 << Qscale;
2807 	Qalpha = get_scale(abs(alpha));
2808 	alpha /= 1 << Qalpha;
2809 	Qbeta  = get_scale(abs(beta));
2810 	beta  /= 1 << Qbeta;
2811 
2812 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale;
2813 	order5x = 1 << (order / 5);
2814 	order5xrem = 1 << (order % 5);
2815 
2816 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale;
2817 	order3x = 1 << (order / 3);
2818 	order3xrem = 1 << (order % 3);
2819 
2820 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2821 		tmp = i * 32;
2822 
2823 		/* Fifth order. */
2824 		y5 = ((beta * tmp) / 64) / order5x;
2825 		y5 = (y5 * tmp) / order5x;
2826 		y5 = (y5 * tmp) / order5x;
2827 		y5 = (y5 * tmp) / order5x;
2828 		y5 = (y5 * tmp) / order5x;
2829 		y5 = y5 / order5xrem;
2830 
2831 		/* Third oder. */
2832 		y3 = (alpha * tmp) / order3x;
2833 		y3 = (y3 * tmp) / order3x;
2834 		y3 = (y3 * tmp) / order3x;
2835 		y3 = y3 / order3xrem;
2836 
2837 		in = y5 + y3 + (SCALE * tmp) / G;
2838 		if (i >= 2 && in < sc->pa_in[chain][i - 1]) {
2839 			in = sc->pa_in[chain][i - 1] +
2840 			    (sc->pa_in[chain][i - 1] -
2841 			     sc->pa_in[chain][i - 2]);
2842 		}
2843 		if (in > 1400)
2844 			in = 1400;
2845 		sc->pa_in[chain][i] = in;
2846 	}
2847 
2848 	/* Compute average theta of first 5 bins (linear region). */
2849 	tavg = 0;
2850 	for (i = 1; i <= 5; i++)
2851 		tavg += t[i];
2852 	tavg /= 5;
2853 	for (i = 1; i <= 5; i++)
2854 		t[i] = 0;
2855 	for (i = 6; i <= maxidx; i++)
2856 		t[i] -= tavg;
2857 
2858 	alpha = beta = 0;
2859 	for (i = 0; i <= L; i++) {
2860 		ttilde = ((t[i + I] << M) + y[i + I]) / y[i + I];
2861 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2862 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2863 
2864 		alpha += b2[i] * ttilde;
2865 		beta  += b1[i] * ttilde;
2866 	}
2867 
2868 	Qalpha = get_scale(abs(alpha));
2869 	alpha /= 1 << Qalpha;
2870 	Qbeta  = get_scale(abs(beta));
2871 	beta  /= 1 << Qbeta;
2872 
2873 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale + 5;
2874 	order5x = 1 << (order / 5);
2875 	order5xrem = 1 << (order % 5);
2876 
2877 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale + 5;
2878 	order3x = 1 << (order / 3);
2879 	order3xrem = 1 << (order % 3);
2880 
2881 	for (i = 0; i <= 4; i++)
2882 		sc->angle[chain][i] = 0;	/* Linear at that range. */
2883 	for (i = 5; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2884 		tmp = i * 32;
2885 
2886 		/* Fifth order. */
2887 		if (beta > 0)
2888 			y5 = (((beta * tmp - 64) / 64) - order5x) / order5x;
2889 		else
2890 			y5 = (((beta * tmp - 64) / 64) + order5x) / order5x;
2891 		y5 = (y5 * tmp) / order5x;
2892 		y5 = (y5 * tmp) / order5x;
2893 		y5 = (y5 * tmp) / order5x;
2894 		y5 = (y5 * tmp) / order5x;
2895 		y5 = y5 / order5xrem;
2896 
2897 		/* Third oder. */
2898 		if (beta > 0)	/* XXX alpha? */
2899 			y3 = (alpha * tmp - order3x) / order3x;
2900 		else
2901 			y3 = (alpha * tmp + order3x) / order3x;
2902 		y3 = (y3 * tmp) / order3x;
2903 		y3 = (y3 * tmp) / order3x;
2904 		y3 = y3 / order3xrem;
2905 
2906 		angle = y5 + y3;
2907 		if (angle < -150)
2908 			angle = -150;
2909 		else if (angle > 150)
2910 			angle = 150;
2911 		sc->angle[chain][i] = angle;
2912 	}
2913 	/* Angle for entry 4 is derived from angle for entry 5. */
2914 	sc->angle[chain][4] = (sc->angle[chain][5] + 2) / 2;
2915 
2916 	return (0);
2917 #undef SCALE
2918 #undef SCALE_LOG
2919 #undef NBINS
2920 }
2921 
2922 void
2923 ar9003_enable_predistorter(struct athn_softc *sc, int chain)
2924 {
2925 	uint32_t reg;
2926 	int i;
2927 
2928 	/* Write digital predistorter lookup table. */
2929 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2930 		AR_WRITE(sc, AR_PHY_PAPRD_MEM_TAB_B(chain, i),
2931 		    SM(AR_PHY_PAPRD_PA_IN, sc->pa_in[chain][i]) |
2932 		    SM(AR_PHY_PAPRD_ANGLE, sc->angle[chain][i]));
2933 	}
2934 
2935 	reg = AR_READ(sc, AR_PHY_PA_GAIN123_B(chain));
2936 	reg = RW(reg, AR_PHY_PA_GAIN123_PA_GAIN1, sc->gain1[chain]);
2937 	AR_WRITE(sc, AR_PHY_PA_GAIN123_B(chain), reg);
2938 
2939 	/* Indicate Tx power used for calibration (training signal). */
2940 	reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(chain));
2941 	reg = RW(reg, AR_PHY_PAPRD_CTRL1_POWER_AT_AM2AM_CAL, sc->trainpow);
2942 	AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(chain), reg);
2943 
2944 	/* Enable digital predistorter for this chain. */
2945 	AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(chain),
2946 	    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2947 	AR_WRITE_BARRIER(sc);
2948 }
2949 
2950 void
2951 ar9003_paprd_enable(struct athn_softc *sc)
2952 {
2953 	int i;
2954 
2955 	/* Enable digital predistorters for all Tx chains. */
2956 	for (i = 0; i < AR9003_MAX_CHAINS; i++)
2957 		if (sc->txchainmask & (1 << i))
2958 			ar9003_enable_predistorter(sc, i);
2959 }
2960 
2961 /*
2962  * This function is called when our training signal has been sent.
2963  */
2964 void
2965 ar9003_paprd_tx_tone_done(struct athn_softc *sc)
2966 {
2967 	uint32_t lo[48], hi[48];
2968 	int i;
2969 
2970 	/* Make sure training is complete. */
2971 	if (!(AR_READ(sc, AR_PHY_PAPRD_TRAINER_STAT1) &
2972 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE))
2973 		return;
2974 
2975 	/* Read feedback from training signal. */
2976 	AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2977 	for (i = 0; i < nitems(lo); i++)
2978 		lo[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2979 	AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2980 	for (i = 0; i < nitems(hi); i++)
2981 		hi[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2982 
2983 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2984 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2985 
2986 	/* Compute predistortion function based on this feedback. */
2987 	if (ar9003_compute_predistortion(sc, lo, hi) != 0)
2988 		return;
2989 
2990 	/* Get next available Tx chain. */
2991 	while (++sc->paprd_curchain < AR9003_MAX_CHAINS)
2992 		if (sc->txchainmask & (1 << sc->paprd_curchain))
2993 			break;
2994 	if (sc->paprd_curchain == AR9003_MAX_CHAINS) {
2995 		/* All Tx chains measured; enable digital predistortion. */
2996 		ar9003_paprd_enable(sc);
2997 	} else	/* Measure next Tx chain. */
2998 		ar9003_paprd_tx_tone(sc);
2999 }
3000 
3001 void
3002 ar9003_write_txpower(struct athn_softc *sc, int16_t power[ATHN_POWER_COUNT])
3003 {
3004 	/* Make sure forced gain is disabled. */
3005 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, 0);
3006 
3007 	AR_WRITE(sc, AR_PHY_PWRTX_RATE1,
3008 	    (power[ATHN_POWER_OFDM18  ] & 0x3f) << 24 |
3009 	    (power[ATHN_POWER_OFDM12  ] & 0x3f) << 16 |
3010 	    (power[ATHN_POWER_OFDM9   ] & 0x3f) <<  8 |
3011 	    (power[ATHN_POWER_OFDM6   ] & 0x3f));
3012 	AR_WRITE(sc, AR_PHY_PWRTX_RATE2,
3013 	    (power[ATHN_POWER_OFDM54  ] & 0x3f) << 24 |
3014 	    (power[ATHN_POWER_OFDM48  ] & 0x3f) << 16 |
3015 	    (power[ATHN_POWER_OFDM36  ] & 0x3f) <<  8 |
3016 	    (power[ATHN_POWER_OFDM24  ] & 0x3f));
3017 	AR_WRITE(sc, AR_PHY_PWRTX_RATE3,
3018 	    (power[ATHN_POWER_CCK2_SP ] & 0x3f) << 24 |
3019 	    (power[ATHN_POWER_CCK2_LP ] & 0x3f) << 16 |
3020 	    /* NB: No eXtended Range for AR9003. */
3021 	    (power[ATHN_POWER_CCK1_LP ] & 0x3f));
3022 	AR_WRITE(sc, AR_PHY_PWRTX_RATE4,
3023 	    (power[ATHN_POWER_CCK11_SP] & 0x3f) << 24 |
3024 	    (power[ATHN_POWER_CCK11_LP] & 0x3f) << 16 |
3025 	    (power[ATHN_POWER_CCK55_SP] & 0x3f) <<  8 |
3026 	    (power[ATHN_POWER_CCK55_LP] & 0x3f));
3027 	/*
3028 	 * NB: AR_PHY_PWRTX_RATE5 needs to be written even if HT is disabled
3029 	 * because it is read by PA predistortion functions.
3030 	 */
3031 	AR_WRITE(sc, AR_PHY_PWRTX_RATE5,
3032 	    (power[ATHN_POWER_HT20( 5)] & 0x3f) << 24 |
3033 	    (power[ATHN_POWER_HT20( 4)] & 0x3f) << 16 |
3034 	    (power[ATHN_POWER_HT20( 1)] & 0x3f) <<  8 |
3035 	    (power[ATHN_POWER_HT20( 0)] & 0x3f));
3036 	AR_WRITE(sc, AR_PHY_PWRTX_RATE6,
3037 	    (power[ATHN_POWER_HT20(13)] & 0x3f) << 24 |
3038 	    (power[ATHN_POWER_HT20(12)] & 0x3f) << 16 |
3039 	    (power[ATHN_POWER_HT20( 7)] & 0x3f) <<  8 |
3040 	    (power[ATHN_POWER_HT20( 6)] & 0x3f));
3041 	AR_WRITE(sc, AR_PHY_PWRTX_RATE7,
3042 	    (power[ATHN_POWER_HT40( 5)] & 0x3f) << 24 |
3043 	    (power[ATHN_POWER_HT40( 4)] & 0x3f) << 16 |
3044 	    (power[ATHN_POWER_HT40( 1)] & 0x3f) <<  8 |
3045 	    (power[ATHN_POWER_HT40( 0)] & 0x3f));
3046 	AR_WRITE(sc, AR_PHY_PWRTX_RATE8,
3047 	    (power[ATHN_POWER_HT40(13)] & 0x3f) << 24 |
3048 	    (power[ATHN_POWER_HT40(12)] & 0x3f) << 16 |
3049 	    (power[ATHN_POWER_HT40( 7)] & 0x3f) <<  8 |
3050 	    (power[ATHN_POWER_HT40( 6)] & 0x3f));
3051 	AR_WRITE(sc, AR_PHY_PWRTX_RATE10,
3052 	    (power[ATHN_POWER_HT20(21)] & 0x3f) << 24 |
3053 	    (power[ATHN_POWER_HT20(20)] & 0x3f) << 16 |
3054 	    (power[ATHN_POWER_HT20(15)] & 0x3f) <<  8 |
3055 	    (power[ATHN_POWER_HT20(14)] & 0x3f));
3056 	AR_WRITE(sc, AR_PHY_PWRTX_RATE11,
3057 	    (power[ATHN_POWER_HT40(23)] & 0x3f) << 24 |
3058 	    (power[ATHN_POWER_HT40(22)] & 0x3f) << 16 |
3059 	    (power[ATHN_POWER_HT20(23)] & 0x3f) <<  8 |
3060 	    (power[ATHN_POWER_HT20(22)] & 0x3f));
3061 	AR_WRITE(sc, AR_PHY_PWRTX_RATE12,
3062 	    (power[ATHN_POWER_HT40(21)] & 0x3f) << 24 |
3063 	    (power[ATHN_POWER_HT40(20)] & 0x3f) << 16 |
3064 	    (power[ATHN_POWER_HT40(15)] & 0x3f) <<  8 |
3065 	    (power[ATHN_POWER_HT40(14)] & 0x3f));
3066 	AR_WRITE_BARRIER(sc);
3067 }
3068 
3069 void
3070 ar9003_reset_rx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3071 {
3072 #define X(x)	((uint32_t)(x) << 2)
3073 	const struct athn_gain *prog = sc->rx_gain;
3074 	const uint32_t *pvals;
3075 	int i;
3076 
3077 	if (IEEE80211_IS_CHAN_2GHZ(c))
3078 		pvals = prog->vals_2g;
3079 	else
3080 		pvals = prog->vals_5g;
3081 	for (i = 0; i < prog->nregs; i++)
3082 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3083 	AR_WRITE_BARRIER(sc);
3084 #undef X
3085 }
3086 
3087 void
3088 ar9003_reset_tx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3089 {
3090 #define X(x)	((uint32_t)(x) << 2)
3091 	const struct athn_gain *prog = sc->tx_gain;
3092 	const uint32_t *pvals;
3093 	int i;
3094 
3095 	if (IEEE80211_IS_CHAN_2GHZ(c))
3096 		pvals = prog->vals_2g;
3097 	else
3098 		pvals = prog->vals_5g;
3099 	for (i = 0; i < prog->nregs; i++)
3100 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3101 	AR_WRITE_BARRIER(sc);
3102 #undef X
3103 }
3104 
3105 void
3106 ar9003_hw_init(struct athn_softc *sc, struct ieee80211_channel *c,
3107     struct ieee80211_channel *extc)
3108 {
3109 #define X(x)	((uint32_t)(x) << 2)
3110 	struct athn_ops *ops = &sc->ops;
3111 	const struct athn_ini *ini = sc->ini;
3112 	const uint32_t *pvals;
3113 	uint32_t reg;
3114 	int i;
3115 
3116 	/*
3117 	 * The common init values include the pre and core phases for the
3118 	 * SoC, MAC, BB and Radio subsystems.
3119 	 */
3120 	DPRINTFN(4, ("writing pre and core init vals\n"));
3121 	for (i = 0; i < ini->ncmregs; i++) {
3122 		AR_WRITE(sc, X(ini->cmregs[i]), ini->cmvals[i]);
3123 		if (AR_IS_ANALOG_REG(X(ini->cmregs[i])))
3124 			DELAY(100);
3125 		if ((i & 0x1f) == 0)
3126 			DELAY(1);
3127 	}
3128 
3129 	/*
3130 	 * The modal init values include the post phase for the SoC, MAC,
3131 	 * BB and Radio subsystems.
3132 	 */
3133 	if (extc != NULL) {
3134 		if (IEEE80211_IS_CHAN_2GHZ(c))
3135 			pvals = ini->vals_2g40;
3136 		else
3137 			pvals = ini->vals_5g40;
3138 	} else {
3139 		if (IEEE80211_IS_CHAN_2GHZ(c))
3140 			pvals = ini->vals_2g20;
3141 		else
3142 			pvals = ini->vals_5g20;
3143 	}
3144 	DPRINTFN(4, ("writing post init vals\n"));
3145 	for (i = 0; i < ini->nregs; i++) {
3146 		AR_WRITE(sc, X(ini->regs[i]), pvals[i]);
3147 		if (AR_IS_ANALOG_REG(X(ini->regs[i])))
3148 			DELAY(100);
3149 		if ((i & 0x1f) == 0)
3150 			DELAY(1);
3151 	}
3152 
3153 	if (sc->rx_gain != NULL)
3154 		ar9003_reset_rx_gain(sc, c);
3155 	if (sc->tx_gain != NULL)
3156 		ar9003_reset_tx_gain(sc, c);
3157 
3158 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
3159 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
3160 		/* Update modal values for fast PLL clock. */
3161 		if (extc != NULL)
3162 			pvals = ini->fastvals_5g40;
3163 		else
3164 			pvals = ini->fastvals_5g20;
3165 		DPRINTFN(4, ("writing fast pll clock init vals\n"));
3166 		for (i = 0; i < ini->nfastregs; i++) {
3167 			AR_WRITE(sc, X(ini->fastregs[i]), pvals[i]);
3168 			if (AR_IS_ANALOG_REG(X(ini->fastregs[i])))
3169 				DELAY(100);
3170 			if ((i & 0x1f) == 0)
3171 				DELAY(1);
3172 		}
3173 	}
3174 
3175 	/*
3176 	 * Set the RX_ABORT and RX_DIS bits to prevent frames with corrupted
3177 	 * descriptor status.
3178 	 */
3179 	AR_SETBITS(sc, AR_DIAG_SW, AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT);
3180 
3181 	reg = AR_READ(sc, AR_PCU_MISC_MODE2);
3182 	reg &= ~AR_PCU_MISC_MODE2_ADHOC_MCAST_KEYID_ENABLE;
3183 	reg |= AR_PCU_MISC_MODE2_AGG_WEP_ENABLE_FIX;
3184 	reg |= AR_PCU_MISC_MODE2_ENABLE_AGGWEP;
3185 	AR_WRITE(sc, AR_PCU_MISC_MODE2, reg);
3186 	AR_WRITE_BARRIER(sc);
3187 
3188 	ar9003_set_phy(sc, c, extc);
3189 	ar9003_init_chains(sc);
3190 
3191 	ops->set_txpower(sc, c, extc);
3192 #undef X
3193 }
3194 
3195 void
3196 ar9003_get_lg_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3197     uint8_t ctl, const uint8_t *fbins,
3198     const struct ar_cal_target_power_leg *tgt, int nchans, uint8_t tpow[4])
3199 {
3200 	uint8_t fbin;
3201 	int i, delta, lo, hi;
3202 
3203 	lo = hi = -1;
3204 	fbin = athn_chan2fbin(c);
3205 	for (i = 0; i < nchans; i++) {
3206 		delta = fbin - fbins[i];
3207 		/* Find the largest sample that is <= our frequency. */
3208 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3209 			lo = i;
3210 		/* Find the smallest sample that is >= our frequency. */
3211 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3212 			hi = i;
3213 	}
3214 	if (lo == -1)
3215 		lo = hi;
3216 	else if (hi == -1)
3217 		hi = lo;
3218 	/* Interpolate values. */
3219 	for (i = 0; i < 4; i++) {
3220 		tpow[i] = athn_interpolate(fbin,
3221 		    fbins[lo], tgt[lo].tPow2x[i],
3222 		    fbins[hi], tgt[hi].tPow2x[i]);
3223 	}
3224 	/* XXX Apply conformance test limit. */
3225 }
3226 
3227 void
3228 ar9003_get_ht_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3229     uint8_t ctl, const uint8_t *fbins,
3230     const struct ar_cal_target_power_ht *tgt, int nchans, uint8_t tpow[14])
3231 {
3232 	uint8_t fbin;
3233 	int i, delta, lo, hi;
3234 
3235 	lo = hi = -1;
3236 	fbin = athn_chan2fbin(c);
3237 	for (i = 0; i < nchans; i++) {
3238 		delta = fbin - fbins[i];
3239 		/* Find the largest sample that is <= our frequency. */
3240 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3241 			lo = i;
3242 		/* Find the smallest sample that is >= our frequency. */
3243 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3244 			hi = i;
3245 	}
3246 	if (lo == -1)
3247 		lo = hi;
3248 	else if (hi == -1)
3249 		hi = lo;
3250 	/* Interpolate values. */
3251 	for (i = 0; i < 14; i++) {
3252 		tpow[i] = athn_interpolate(fbin,
3253 		    fbins[lo], tgt[lo].tPow2x[i],
3254 		    fbins[hi], tgt[hi].tPow2x[i]);
3255 	}
3256 	/* XXX Apply conformance test limit. */
3257 }
3258 
3259 /*
3260  * Adaptive noise immunity.
3261  */
3262 void
3263 ar9003_set_noise_immunity_level(struct athn_softc *sc, int level)
3264 {
3265 	int high = level == 4;
3266 	uint32_t reg;
3267 
3268 	reg = AR_READ(sc, AR_PHY_DESIRED_SZ);
3269 	reg = RW(reg, AR_PHY_DESIRED_SZ_TOT_DES, high ? -62 : -55);
3270 	AR_WRITE(sc, AR_PHY_DESIRED_SZ, reg);
3271 
3272 	reg = AR_READ(sc, AR_PHY_AGC);
3273 	reg = RW(reg, AR_PHY_AGC_COARSE_LOW, high ? -70 : -64);
3274 	reg = RW(reg, AR_PHY_AGC_COARSE_HIGH, high ? -12 : -14);
3275 	AR_WRITE(sc, AR_PHY_AGC, reg);
3276 
3277 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3278 	reg = RW(reg, AR_PHY_FIND_SIG_FIRPWR, high ? -80 : -78);
3279 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3280 	AR_WRITE_BARRIER(sc);
3281 }
3282 
3283 void
3284 ar9003_enable_ofdm_weak_signal(struct athn_softc *sc)
3285 {
3286 	uint32_t reg;
3287 
3288 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3289 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 50);
3290 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 40);
3291 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 48);
3292 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3293 
3294 	reg = AR_READ(sc, AR_PHY_SFCORR);
3295 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 77);
3296 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 64);
3297 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 16);
3298 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3299 
3300 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3301 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 50);
3302 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 40);
3303 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 77);
3304 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 64);
3305 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3306 
3307 	AR_SETBITS(sc, AR_PHY_SFCORR_LOW,
3308 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3309 	AR_WRITE_BARRIER(sc);
3310 }
3311 
3312 void
3313 ar9003_disable_ofdm_weak_signal(struct athn_softc *sc)
3314 {
3315 	uint32_t reg;
3316 
3317 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3318 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 127);
3319 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 127);
3320 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 63);
3321 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3322 
3323 	reg = AR_READ(sc, AR_PHY_SFCORR);
3324 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 127);
3325 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 127);
3326 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 31);
3327 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3328 
3329 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3330 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 127);
3331 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 127);
3332 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 127);
3333 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 127);
3334 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3335 
3336 	AR_CLRBITS(sc, AR_PHY_SFCORR_LOW,
3337 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3338 	AR_WRITE_BARRIER(sc);
3339 }
3340 
3341 void
3342 ar9003_set_cck_weak_signal(struct athn_softc *sc, int high)
3343 {
3344 	uint32_t reg;
3345 
3346 	reg = AR_READ(sc, AR_PHY_CCK_DETECT);
3347 	reg = RW(reg, AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK, high ? 6 : 8);
3348 	AR_WRITE(sc, AR_PHY_CCK_DETECT, reg);
3349 	AR_WRITE_BARRIER(sc);
3350 }
3351 
3352 void
3353 ar9003_set_firstep_level(struct athn_softc *sc, int level)
3354 {
3355 	uint32_t reg;
3356 
3357 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3358 	reg = RW(reg, AR_PHY_FIND_SIG_FIRSTEP, level * 4);
3359 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3360 	AR_WRITE_BARRIER(sc);
3361 }
3362 
3363 void
3364 ar9003_set_spur_immunity_level(struct athn_softc *sc, int level)
3365 {
3366 	uint32_t reg;
3367 
3368 	reg = AR_READ(sc, AR_PHY_TIMING5);
3369 	reg = RW(reg, AR_PHY_TIMING5_CYCPWR_THR1, (level + 1) * 2);
3370 	AR_WRITE(sc, AR_PHY_TIMING5, reg);
3371 	AR_WRITE_BARRIER(sc);
3372 }
3373