xref: /openbsd/sys/dev/ic/ar9003.c (revision 6f40fd34)
1 /*	$OpenBSD: ar9003.c,v 1.46 2017/05/19 11:42:48 stsp Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2010 Atheros Communications Inc.
6  *
7  * Permission to use, copy, modify, and/or distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Atheros 802.11a/g/n chipsets.
22  * Routines for AR9003 family.
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/malloc.h>
34 #include <sys/queue.h>
35 #include <sys/timeout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/stdint.h>	/* uintptr_t */
39 #include <sys/endian.h>
40 
41 #include <machine/bus.h>
42 
43 #if NBPFILTER > 0
44 #include <net/bpf.h>
45 #endif
46 #include <net/if.h>
47 #include <net/if_media.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/if_ether.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_amrr.h>
54 #include <net80211/ieee80211_mira.h>
55 #include <net80211/ieee80211_radiotap.h>
56 
57 #include <dev/ic/athnreg.h>
58 #include <dev/ic/athnvar.h>
59 
60 #include <dev/ic/ar9003reg.h>
61 
62 int	ar9003_attach(struct athn_softc *);
63 int	ar9003_read_eep_word(struct athn_softc *, uint32_t, uint16_t *);
64 int	ar9003_read_eep_data(struct athn_softc *, uint32_t, void *, int);
65 int	ar9003_read_otp_word(struct athn_softc *, uint32_t, uint32_t *);
66 int	ar9003_read_otp_data(struct athn_softc *, uint32_t, void *, int);
67 int	ar9003_find_rom(struct athn_softc *);
68 int	ar9003_restore_rom_block(struct athn_softc *, uint8_t, uint8_t,
69 	    const uint8_t *, int);
70 int	ar9003_read_rom(struct athn_softc *);
71 int	ar9003_gpio_read(struct athn_softc *, int);
72 void	ar9003_gpio_write(struct athn_softc *, int, int);
73 void	ar9003_gpio_config_input(struct athn_softc *, int);
74 void	ar9003_gpio_config_output(struct athn_softc *, int, int);
75 void	ar9003_rfsilent_init(struct athn_softc *);
76 int	ar9003_dma_alloc(struct athn_softc *);
77 void	ar9003_dma_free(struct athn_softc *);
78 int	ar9003_tx_alloc(struct athn_softc *);
79 void	ar9003_tx_free(struct athn_softc *);
80 int	ar9003_rx_alloc(struct athn_softc *, int, int);
81 void	ar9003_rx_free(struct athn_softc *, int);
82 void	ar9003_reset_txsring(struct athn_softc *);
83 void	ar9003_rx_enable(struct athn_softc *);
84 void	ar9003_rx_radiotap(struct athn_softc *, struct mbuf *,
85 	    struct ar_rx_status *);
86 int	ar9003_rx_process(struct athn_softc *, int);
87 void	ar9003_rx_intr(struct athn_softc *, int);
88 int	ar9003_tx_process(struct athn_softc *);
89 void	ar9003_tx_intr(struct athn_softc *);
90 int	ar9003_swba_intr(struct athn_softc *);
91 int	ar9003_intr(struct athn_softc *);
92 int	ar9003_tx(struct athn_softc *, struct mbuf *, struct ieee80211_node *,
93 	    int);
94 void	ar9003_set_rf_mode(struct athn_softc *, struct ieee80211_channel *);
95 int	ar9003_rf_bus_request(struct athn_softc *);
96 void	ar9003_rf_bus_release(struct athn_softc *);
97 void	ar9003_set_phy(struct athn_softc *, struct ieee80211_channel *,
98 	    struct ieee80211_channel *);
99 void	ar9003_set_delta_slope(struct athn_softc *, struct ieee80211_channel *,
100 	    struct ieee80211_channel *);
101 void	ar9003_enable_antenna_diversity(struct athn_softc *);
102 void	ar9003_init_baseband(struct athn_softc *);
103 void	ar9003_disable_phy(struct athn_softc *);
104 void	ar9003_init_chains(struct athn_softc *);
105 void	ar9003_set_rxchains(struct athn_softc *);
106 void	ar9003_read_noisefloor(struct athn_softc *, int16_t *, int16_t *);
107 void	ar9003_write_noisefloor(struct athn_softc *, int16_t *, int16_t *);
108 void	ar9003_get_noisefloor(struct athn_softc *, struct ieee80211_channel *);
109 void	ar9003_bb_load_noisefloor(struct athn_softc *);
110 void	ar9300_noisefloor_calib(struct athn_softc *);
111 void	ar9003_do_noisefloor_calib(struct athn_softc *);
112 int	ar9003_init_calib(struct athn_softc *);
113 void	ar9003_do_calib(struct athn_softc *);
114 void	ar9003_next_calib(struct athn_softc *);
115 void	ar9003_calib_iq(struct athn_softc *);
116 int	ar9003_get_iq_corr(struct athn_softc *, int32_t[], int32_t[]);
117 int	ar9003_calib_tx_iq(struct athn_softc *);
118 void	ar9003_paprd_calib(struct athn_softc *, struct ieee80211_channel *);
119 int	ar9003_get_desired_txgain(struct athn_softc *, int, int);
120 void	ar9003_force_txgain(struct athn_softc *, uint32_t);
121 void	ar9003_set_training_gain(struct athn_softc *, int);
122 int	ar9003_paprd_tx_tone(struct athn_softc *);
123 int	ar9003_compute_predistortion(struct athn_softc *, const uint32_t *,
124 	    const uint32_t *);
125 void	ar9003_enable_predistorter(struct athn_softc *, int);
126 void	ar9003_paprd_enable(struct athn_softc *);
127 void	ar9003_paprd_tx_tone_done(struct athn_softc *);
128 void	ar9003_write_txpower(struct athn_softc *, int16_t power[]);
129 void	ar9003_reset_rx_gain(struct athn_softc *, struct ieee80211_channel *);
130 void	ar9003_reset_tx_gain(struct athn_softc *, struct ieee80211_channel *);
131 void	ar9003_hw_init(struct athn_softc *, struct ieee80211_channel *,
132 	    struct ieee80211_channel *);
133 void	ar9003_get_lg_tpow(struct athn_softc *, struct ieee80211_channel *,
134 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_leg *,
135 	    int, uint8_t[]);
136 void	ar9003_get_ht_tpow(struct athn_softc *, struct ieee80211_channel *,
137 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_ht *,
138 	    int, uint8_t[]);
139 void	ar9003_set_noise_immunity_level(struct athn_softc *, int);
140 void	ar9003_enable_ofdm_weak_signal(struct athn_softc *);
141 void	ar9003_disable_ofdm_weak_signal(struct athn_softc *);
142 void	ar9003_set_cck_weak_signal(struct athn_softc *, int);
143 void	ar9003_set_firstep_level(struct athn_softc *, int);
144 void	ar9003_set_spur_immunity_level(struct athn_softc *, int);
145 
146 /* Extern functions. */
147 void	athn_stop(struct ifnet *, int);
148 int	athn_interpolate(int, int, int, int, int);
149 int	athn_txtime(struct athn_softc *, int, int, u_int);
150 void	athn_inc_tx_trigger_level(struct athn_softc *);
151 int	athn_tx_pending(struct athn_softc *, int);
152 void	athn_stop_tx_dma(struct athn_softc *, int);
153 void	athn_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
154 void	athn_config_pcie(struct athn_softc *);
155 void	athn_config_nonpcie(struct athn_softc *);
156 uint8_t	athn_chan2fbin(struct ieee80211_channel *);
157 
158 
159 int
160 ar9003_attach(struct athn_softc *sc)
161 {
162 	struct athn_ops *ops = &sc->ops;
163 	int error;
164 
165 	/* Set callbacks for AR9003 family. */
166 	ops->gpio_read = ar9003_gpio_read;
167 	ops->gpio_write = ar9003_gpio_write;
168 	ops->gpio_config_input = ar9003_gpio_config_input;
169 	ops->gpio_config_output = ar9003_gpio_config_output;
170 	ops->rfsilent_init = ar9003_rfsilent_init;
171 
172 	ops->dma_alloc = ar9003_dma_alloc;
173 	ops->dma_free = ar9003_dma_free;
174 	ops->rx_enable = ar9003_rx_enable;
175 	ops->intr = ar9003_intr;
176 	ops->tx = ar9003_tx;
177 
178 	ops->set_rf_mode = ar9003_set_rf_mode;
179 	ops->rf_bus_request = ar9003_rf_bus_request;
180 	ops->rf_bus_release = ar9003_rf_bus_release;
181 	ops->set_phy = ar9003_set_phy;
182 	ops->set_delta_slope = ar9003_set_delta_slope;
183 	ops->enable_antenna_diversity = ar9003_enable_antenna_diversity;
184 	ops->init_baseband = ar9003_init_baseband;
185 	ops->disable_phy = ar9003_disable_phy;
186 	ops->set_rxchains = ar9003_set_rxchains;
187 	ops->noisefloor_calib = ar9003_do_noisefloor_calib;
188 	ops->do_calib = ar9003_do_calib;
189 	ops->next_calib = ar9003_next_calib;
190 	ops->hw_init = ar9003_hw_init;
191 
192 	ops->set_noise_immunity_level = ar9003_set_noise_immunity_level;
193 	ops->enable_ofdm_weak_signal = ar9003_enable_ofdm_weak_signal;
194 	ops->disable_ofdm_weak_signal = ar9003_disable_ofdm_weak_signal;
195 	ops->set_cck_weak_signal = ar9003_set_cck_weak_signal;
196 	ops->set_firstep_level = ar9003_set_firstep_level;
197 	ops->set_spur_immunity_level = ar9003_set_spur_immunity_level;
198 
199 	/* Set MAC registers offsets. */
200 	sc->obs_off = AR_OBS;
201 	sc->gpio_input_en_off = AR_GPIO_INPUT_EN_VAL;
202 
203 	if (!(sc->flags & ATHN_FLAG_PCIE))
204 		athn_config_nonpcie(sc);
205 	else
206 		athn_config_pcie(sc);
207 
208 	/* Determine ROM type and location. */
209 	if ((error = ar9003_find_rom(sc)) != 0) {
210 		printf("%s: could not find ROM\n", sc->sc_dev.dv_xname);
211 		return (error);
212 	}
213 	/* Read entire ROM content in memory. */
214 	if ((error = ar9003_read_rom(sc)) != 0) {
215 		printf("%s: could not read ROM\n", sc->sc_dev.dv_xname);
216 		return (error);
217 	}
218 
219 	/* Determine if it is a non-enterprise AR9003 card. */
220 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_MPSD)
221 		sc->flags |= ATHN_FLAG_NON_ENTERPRISE;
222 
223 	ops->setup(sc);
224 	return (0);
225 }
226 
227 /*
228  * Read 16-bit word from EEPROM.
229  */
230 int
231 ar9003_read_eep_word(struct athn_softc *sc, uint32_t addr, uint16_t *val)
232 {
233 	uint32_t reg;
234 	int ntries;
235 
236 	reg = AR_READ(sc, AR_EEPROM_OFFSET(addr));
237 	for (ntries = 0; ntries < 1000; ntries++) {
238 		reg = AR_READ(sc, AR_EEPROM_STATUS_DATA);
239 		if (!(reg & (AR_EEPROM_STATUS_DATA_BUSY |
240 		    AR_EEPROM_STATUS_DATA_PROT_ACCESS))) {
241 			*val = MS(reg, AR_EEPROM_STATUS_DATA_VAL);
242 			return (0);
243 		}
244 		DELAY(10);
245 	}
246 	*val = 0xffff;
247 	return (ETIMEDOUT);
248 }
249 
250 /*
251  * Read an arbitrary number of bytes at a specified address in EEPROM.
252  * NB: The address may not be 16-bit aligned.
253  */
254 int
255 ar9003_read_eep_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
256 {
257 	uint8_t *dst = buf;
258 	uint16_t val;
259 	int error;
260 
261 	if (len > 0 && (addr & 1)) {
262 		/* Deal with non-aligned reads. */
263 		addr >>= 1;
264 		error = ar9003_read_eep_word(sc, addr, &val);
265 		if (error != 0)
266 			return (error);
267 		*dst++ = val & 0xff;
268 		addr--;
269 		len--;
270 	} else
271 		addr >>= 1;
272 	for (; len >= 2; addr--, len -= 2) {
273 		error = ar9003_read_eep_word(sc, addr, &val);
274 		if (error != 0)
275 			return (error);
276 		*dst++ = val >> 8;
277 		*dst++ = val & 0xff;
278 	}
279 	if (len > 0) {
280 		error = ar9003_read_eep_word(sc, addr, &val);
281 		if (error != 0)
282 			return (error);
283 		*dst++ = val >> 8;
284 	}
285 	return (0);
286 }
287 
288 /*
289  * Read 32-bit word from OTPROM.
290  */
291 int
292 ar9003_read_otp_word(struct athn_softc *sc, uint32_t addr, uint32_t *val)
293 {
294 	uint32_t reg;
295 	int ntries;
296 
297 	reg = AR_READ(sc, AR_OTP_BASE(addr));
298 	for (ntries = 0; ntries < 1000; ntries++) {
299 		reg = AR_READ(sc, AR_OTP_STATUS);
300 		if (MS(reg, AR_OTP_STATUS_TYPE) == AR_OTP_STATUS_VALID) {
301 			*val = AR_READ(sc, AR_OTP_READ_DATA);
302 			return (0);
303 		}
304 		DELAY(10);
305 	}
306 	return (ETIMEDOUT);
307 }
308 
309 /*
310  * Read an arbitrary number of bytes at a specified address in OTPROM.
311  * NB: The address may not be 32-bit aligned.
312  */
313 int
314 ar9003_read_otp_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
315 {
316 	uint8_t *dst = buf;
317 	uint32_t val;
318 	int error;
319 
320 	/* NB: not optimal for non-aligned reads, but correct. */
321 	for (; len > 0; addr--, len--) {
322 		error = ar9003_read_otp_word(sc, addr >> 2, &val);
323 		if (error != 0)
324 			return (error);
325 		*dst++ = (val >> ((addr & 3) * 8)) & 0xff;
326 	}
327 	return (0);
328 }
329 
330 /*
331  * Determine if the chip has an external EEPROM or an OTPROM and its size.
332  */
333 int
334 ar9003_find_rom(struct athn_softc *sc)
335 {
336 	struct athn_ops *ops = &sc->ops;
337 	uint32_t hdr;
338 	int error;
339 
340 	/* Try EEPROM. */
341 	ops->read_rom_data = ar9003_read_eep_data;
342 
343 	sc->eep_size = AR_SREV_9485(sc) ? 4096 : 1024;
344 	sc->eep_base = sc->eep_size - 1;
345 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
346 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
347 		return (0);
348 
349 	sc->eep_size = 512;
350 	sc->eep_base = sc->eep_size - 1;
351 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
352 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
353 		return (0);
354 
355 	/* Try OTPROM. */
356 	ops->read_rom_data = ar9003_read_otp_data;
357 
358 	sc->eep_size = 1024;
359 	sc->eep_base = sc->eep_size - 1;
360 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
361 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
362 		return (0);
363 
364 	sc->eep_size = 512;
365 	sc->eep_base = sc->eep_size - 1;
366 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
367 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
368 		return (0);
369 
370 	return (EIO);	/* Not found. */
371 }
372 
373 int
374 ar9003_restore_rom_block(struct athn_softc *sc, uint8_t alg, uint8_t ref,
375     const uint8_t *buf, int len)
376 {
377 	const uint8_t *def, *ptr, *end;
378 	uint8_t *eep = sc->eep;
379 	int off, clen;
380 
381 	if (alg == AR_EEP_COMPRESS_BLOCK) {
382 		/* Block contains chunks that shadow ROM template. */
383 		def = sc->ops.get_rom_template(sc, ref);
384 		if (def == NULL) {
385 			DPRINTF(("unknown template image %d\n", ref));
386 			return (EINVAL);
387 		}
388 		/* Start with template. */
389 		memcpy(eep, def, sc->eep_size);
390 		/* Shadow template with chunks. */
391 		off = 0;	/* Offset in ROM image. */
392 		ptr = buf;	/* Offset in block. */
393 		end = buf + len;
394 		/* Process chunks. */
395 		while (ptr + 2 <= end) {
396 			off += *ptr++;	/* Gap with previous chunk. */
397 			clen = *ptr++;	/* Chunk length. */
398 			/* Make sure block is large enough. */
399 			if (ptr + clen > end)
400 				return (EINVAL);
401 			/* Make sure chunk fits in ROM image. */
402 			if (off + clen > sc->eep_size)
403 				return (EINVAL);
404 			/* Restore chunk. */
405 			DPRINTFN(2, ("ROM chunk @%d/%d\n", off, clen));
406 			memcpy(&eep[off], ptr, clen);
407 			ptr += clen;
408 			off += clen;
409 		}
410 	} else if (alg == AR_EEP_COMPRESS_NONE) {
411 		/* Block contains full ROM image. */
412 		if (len != sc->eep_size) {
413 			DPRINTF(("block length mismatch %d\n", len));
414 			return (EINVAL);
415 		}
416 		memcpy(eep, buf, len);
417 	}
418 	return (0);
419 }
420 
421 int
422 ar9003_read_rom(struct athn_softc *sc)
423 {
424 	struct athn_ops *ops = &sc->ops;
425 	uint8_t *buf, *ptr, alg, ref;
426 	uint16_t sum, rsum;
427 	uint32_t hdr;
428 	int error, addr, len, i, j;
429 
430 	/* Allocate space to store ROM in host memory. */
431 	sc->eep = malloc(sc->eep_size, M_DEVBUF, M_NOWAIT);
432 	if (sc->eep == NULL)
433 		return (ENOMEM);
434 
435 	/* Allocate temporary buffer to store ROM blocks. */
436 	buf = malloc(2048, M_DEVBUF, M_NOWAIT);
437 	if (buf == NULL)
438 		return (ENOMEM);
439 
440 	/* Restore vendor-specified ROM blocks. */
441 	addr = sc->eep_base;
442 	for (i = 0; i < 100; i++) {
443 		/* Read block header. */
444 		error = ops->read_rom_data(sc, addr, &hdr, sizeof(hdr));
445 		if (error != 0)
446 			break;
447 		if (hdr == 0 || hdr == 0xffffffff)
448 			break;
449 		addr -= sizeof(hdr);
450 
451 		/* Extract bits from header. */
452 		ptr = (uint8_t *)&hdr;
453 		alg = (ptr[0] & 0xe0) >> 5;
454 		ref = (ptr[1] & 0x80) >> 2 | (ptr[0] & 0x1f);
455 		len = (ptr[1] & 0x7f) << 4 | (ptr[2] & 0xf0) >> 4;
456 		DPRINTFN(2, ("ROM block %d: alg=%d ref=%d len=%d\n",
457 		    i, alg, ref, len));
458 
459 		/* Read block data (len <= 0x7ff). */
460 		error = ops->read_rom_data(sc, addr, buf, len);
461 		if (error != 0)
462 			break;
463 		addr -= len;
464 
465 		/* Read block checksum. */
466 		error = ops->read_rom_data(sc, addr, &sum, sizeof(sum));
467 		if (error != 0)
468 			break;
469 		addr -= sizeof(sum);
470 
471 		/* Compute block checksum. */
472 		rsum = 0;
473 		for (j = 0; j < len; j++)
474 			rsum += buf[j];
475 		/* Compare to that in ROM. */
476 		if (letoh16(sum) != rsum) {
477 			DPRINTF(("bad block checksum 0x%x/0x%x\n",
478 			    letoh16(sum), rsum));
479 			continue;	/* Skip bad block. */
480 		}
481 		/* Checksum is correct, restore block. */
482 		ar9003_restore_rom_block(sc, alg, ref, buf, len);
483 	}
484 #if BYTE_ORDER == BIG_ENDIAN
485 	/* NB: ROM is always little endian. */
486 	if (error == 0)
487 		ops->swap_rom(sc);
488 #endif
489 	free(buf, M_DEVBUF, 0);
490 	return (error);
491 }
492 
493 /*
494  * Access to General Purpose Input/Output ports.
495  */
496 int
497 ar9003_gpio_read(struct athn_softc *sc, int pin)
498 {
499 	KASSERT(pin < sc->ngpiopins);
500 	return (((AR_READ(sc, AR_GPIO_IN) & AR9300_GPIO_IN_VAL) &
501 	    (1 << pin)) != 0);
502 }
503 
504 void
505 ar9003_gpio_write(struct athn_softc *sc, int pin, int set)
506 {
507 	uint32_t reg;
508 
509 	KASSERT(pin < sc->ngpiopins);
510 	reg = AR_READ(sc, AR_GPIO_IN_OUT);
511 	if (set)
512 		reg |= 1 << pin;
513 	else
514 		reg &= ~(1 << pin);
515 	AR_WRITE(sc, AR_GPIO_IN_OUT, reg);
516 	AR_WRITE_BARRIER(sc);
517 }
518 
519 void
520 ar9003_gpio_config_input(struct athn_softc *sc, int pin)
521 {
522 	uint32_t reg;
523 
524 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
525 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
526 	reg |= AR_GPIO_OE_OUT_DRV_NO << (pin * 2);
527 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
528 	AR_WRITE_BARRIER(sc);
529 }
530 
531 void
532 ar9003_gpio_config_output(struct athn_softc *sc, int pin, int type)
533 {
534 	uint32_t reg;
535 	int mux, off;
536 
537 	mux = pin / 6;
538 	off = pin % 6;
539 
540 	reg = AR_READ(sc, AR_GPIO_OUTPUT_MUX(mux));
541 	reg &= ~(0x1f << (off * 5));
542 	reg |= (type & 0x1f) << (off * 5);
543 	AR_WRITE(sc, AR_GPIO_OUTPUT_MUX(mux), reg);
544 
545 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
546 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
547 	reg |= AR_GPIO_OE_OUT_DRV_ALL << (pin * 2);
548 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
549 	AR_WRITE_BARRIER(sc);
550 }
551 
552 void
553 ar9003_rfsilent_init(struct athn_softc *sc)
554 {
555 	uint32_t reg;
556 
557 	/* Configure hardware radio switch. */
558 	AR_SETBITS(sc, AR_GPIO_INPUT_EN_VAL, AR_GPIO_INPUT_EN_VAL_RFSILENT_BB);
559 	reg = AR_READ(sc, AR_GPIO_INPUT_MUX2);
560 	reg = RW(reg, AR_GPIO_INPUT_MUX2_RFSILENT, 0);
561 	AR_WRITE(sc, AR_GPIO_INPUT_MUX2, reg);
562 	ar9003_gpio_config_input(sc, sc->rfsilent_pin);
563 	AR_SETBITS(sc, AR_PHY_TEST, AR_PHY_TEST_RFSILENT_BB);
564 	if (!(sc->flags & ATHN_FLAG_RFSILENT_REVERSED)) {
565 		AR_SETBITS(sc, AR_GPIO_INTR_POL,
566 		    AR_GPIO_INTR_POL_PIN(sc->rfsilent_pin));
567 	}
568 	AR_WRITE_BARRIER(sc);
569 }
570 
571 int
572 ar9003_dma_alloc(struct athn_softc *sc)
573 {
574 	int error;
575 
576 	error = ar9003_tx_alloc(sc);
577 	if (error != 0)
578 		return (error);
579 
580 	error = ar9003_rx_alloc(sc, ATHN_QID_LP, AR9003_RX_LP_QDEPTH);
581 	if (error != 0)
582 		return (error);
583 
584 	error = ar9003_rx_alloc(sc, ATHN_QID_HP, AR9003_RX_HP_QDEPTH);
585 	if (error != 0)
586 		return (error);
587 
588 	return (0);
589 }
590 
591 void
592 ar9003_dma_free(struct athn_softc *sc)
593 {
594 	ar9003_tx_free(sc);
595 	ar9003_rx_free(sc, ATHN_QID_LP);
596 	ar9003_rx_free(sc, ATHN_QID_HP);
597 }
598 
599 int
600 ar9003_tx_alloc(struct athn_softc *sc)
601 {
602 	struct athn_tx_buf *bf;
603 	bus_size_t size;
604 	int error, nsegs, i;
605 
606 	/*
607 	 * Allocate Tx status ring.
608 	 */
609 	size = AR9003_NTXSTATUS * sizeof(struct ar_tx_status);
610 
611 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
612 	    BUS_DMA_NOWAIT, &sc->txsmap);
613 	if (error != 0)
614 		goto fail;
615 
616 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->txsseg, 1,
617 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
618 	if (error != 0)
619 		goto fail;
620 
621 	error = bus_dmamem_map(sc->sc_dmat, &sc->txsseg, 1, size,
622 	    (caddr_t *)&sc->txsring, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
623 	if (error != 0)
624 		goto fail;
625 
626 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->txsmap, &sc->txsseg,
627 	    1, size, BUS_DMA_NOWAIT | BUS_DMA_READ);
628 	if (error != 0)
629 		goto fail;
630 
631 	/*
632 	 * Allocate a pool of Tx descriptors shared between all Tx queues.
633 	 */
634 	size = ATHN_NTXBUFS * sizeof(struct ar_tx_desc);
635 
636 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
637 	    BUS_DMA_NOWAIT, &sc->map);
638 	if (error != 0)
639 		goto fail;
640 
641 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->seg, 1,
642 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
643 	if (error != 0)
644 		goto fail;
645 
646 	error = bus_dmamem_map(sc->sc_dmat, &sc->seg, 1, size,
647 	    (caddr_t *)&sc->descs, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
648 	if (error != 0)
649 		goto fail;
650 
651 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->map, &sc->seg, 1, size,
652 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
653 	if (error != 0)
654 		goto fail;
655 
656 	SIMPLEQ_INIT(&sc->txbufs);
657 	for (i = 0; i < ATHN_NTXBUFS; i++) {
658 		bf = &sc->txpool[i];
659 
660 		error = bus_dmamap_create(sc->sc_dmat, ATHN_TXBUFSZ,
661 		    AR9003_MAX_SCATTER, ATHN_TXBUFSZ, 0, BUS_DMA_NOWAIT,
662 		    &bf->bf_map);
663 		if (error != 0) {
664 			printf("%s: could not create Tx buf DMA map\n",
665 			    sc->sc_dev.dv_xname);
666 			goto fail;
667 		}
668 
669 		bf->bf_descs = &((struct ar_tx_desc *)sc->descs)[i];
670 		bf->bf_daddr = sc->map->dm_segs[0].ds_addr +
671 		    i * sizeof(struct ar_tx_desc);
672 
673 		SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
674 	}
675 	return (0);
676  fail:
677 	ar9003_tx_free(sc);
678 	return (error);
679 }
680 
681 void
682 ar9003_tx_free(struct athn_softc *sc)
683 {
684 	struct athn_tx_buf *bf;
685 	int i;
686 
687 	for (i = 0; i < ATHN_NTXBUFS; i++) {
688 		bf = &sc->txpool[i];
689 
690 		if (bf->bf_map != NULL)
691 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
692 	}
693 	/* Free Tx descriptors. */
694 	if (sc->map != NULL) {
695 		if (sc->descs != NULL) {
696 			bus_dmamap_unload(sc->sc_dmat, sc->map);
697 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->descs,
698 			    ATHN_NTXBUFS * sizeof(struct ar_tx_desc));
699 			bus_dmamem_free(sc->sc_dmat, &sc->seg, 1);
700 		}
701 		bus_dmamap_destroy(sc->sc_dmat, sc->map);
702 	}
703 	/* Free Tx status ring. */
704 	if (sc->txsmap != NULL) {
705 		if (sc->txsring != NULL) {
706 			bus_dmamap_unload(sc->sc_dmat, sc->txsmap);
707 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->txsring,
708 			     AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
709 			bus_dmamem_free(sc->sc_dmat, &sc->txsseg, 1);
710 		}
711 		bus_dmamap_destroy(sc->sc_dmat, sc->txsmap);
712 	}
713 }
714 
715 int
716 ar9003_rx_alloc(struct athn_softc *sc, int qid, int count)
717 {
718 	struct athn_rxq *rxq = &sc->rxq[qid];
719 	struct athn_rx_buf *bf;
720 	struct ar_rx_status *ds;
721 	int error, i;
722 
723 	rxq->bf = mallocarray(count, sizeof(*bf), M_DEVBUF,
724 	    M_NOWAIT | M_ZERO);
725 	if (rxq->bf == NULL)
726 		return (ENOMEM);
727 
728 	rxq->count = count;
729 
730 	for (i = 0; i < rxq->count; i++) {
731 		bf = &rxq->bf[i];
732 
733 		error = bus_dmamap_create(sc->sc_dmat, ATHN_RXBUFSZ, 1,
734 		    ATHN_RXBUFSZ, 0, BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW,
735 		    &bf->bf_map);
736 		if (error != 0) {
737 			printf("%s: could not create Rx buf DMA map\n",
738 			    sc->sc_dev.dv_xname);
739 			goto fail;
740 		}
741 		/*
742 		 * Assumes MCLGETI returns cache-line-size aligned buffers.
743 		 */
744 		bf->bf_m = MCLGETI(NULL, M_DONTWAIT, NULL, ATHN_RXBUFSZ);
745 		if (bf->bf_m == NULL) {
746 			printf("%s: could not allocate Rx mbuf\n",
747 			    sc->sc_dev.dv_xname);
748 			error = ENOBUFS;
749 			goto fail;
750 		}
751 
752 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
753 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
754 		    BUS_DMA_NOWAIT);
755 		if (error != 0) {
756 			printf("%s: could not DMA map Rx buffer\n",
757 			    sc->sc_dev.dv_xname);
758 			goto fail;
759 		}
760 
761 		ds = mtod(bf->bf_m, struct ar_rx_status *);
762 		memset(ds, 0, sizeof(*ds));
763 		bf->bf_desc = ds;
764 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
765 
766 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
767 		    BUS_DMASYNC_PREREAD);
768 	}
769 	return (0);
770  fail:
771 	ar9003_rx_free(sc, qid);
772 	return (error);
773 }
774 
775 void
776 ar9003_rx_free(struct athn_softc *sc, int qid)
777 {
778 	struct athn_rxq *rxq = &sc->rxq[qid];
779 	struct athn_rx_buf *bf;
780 	int i;
781 
782 	if (rxq->bf == NULL)
783 		return;
784 	for (i = 0; i < rxq->count; i++) {
785 		bf = &rxq->bf[i];
786 
787 		if (bf->bf_map != NULL)
788 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
789 		m_freem(bf->bf_m);
790 	}
791 	free(rxq->bf, M_DEVBUF, 0);
792 }
793 
794 void
795 ar9003_reset_txsring(struct athn_softc *sc)
796 {
797 	sc->txscur = 0;
798 	memset(sc->txsring, 0, AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
799 	AR_WRITE(sc, AR_Q_STATUS_RING_START,
800 	    sc->txsmap->dm_segs[0].ds_addr);
801 	AR_WRITE(sc, AR_Q_STATUS_RING_END,
802 	    sc->txsmap->dm_segs[0].ds_addr + sc->txsmap->dm_segs[0].ds_len);
803 	AR_WRITE_BARRIER(sc);
804 }
805 
806 void
807 ar9003_rx_enable(struct athn_softc *sc)
808 {
809 	struct athn_rxq *rxq;
810 	struct athn_rx_buf *bf;
811 	struct ar_rx_status *ds;
812 	uint32_t reg;
813 	int qid, i;
814 
815 	reg = AR_READ(sc, AR_RXBP_THRESH);
816 	reg = RW(reg, AR_RXBP_THRESH_HP, 1);
817 	reg = RW(reg, AR_RXBP_THRESH_LP, 1);
818 	AR_WRITE(sc, AR_RXBP_THRESH, reg);
819 
820 	/* Set Rx buffer size. */
821 	AR_WRITE(sc, AR_DATABUF_SIZE, ATHN_RXBUFSZ - sizeof(*ds));
822 
823 	for (qid = 0; qid < 2; qid++) {
824 		rxq = &sc->rxq[qid];
825 
826 		/* Setup Rx status descriptors. */
827 		SIMPLEQ_INIT(&rxq->head);
828 		for (i = 0; i < rxq->count; i++) {
829 			bf = &rxq->bf[i];
830 			ds = bf->bf_desc;
831 
832 			memset(ds, 0, sizeof(*ds));
833 			if (qid == ATHN_QID_LP)
834 				AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
835 			else
836 				AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
837 			AR_WRITE_BARRIER(sc);
838 			SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
839 		}
840 	}
841 	/* Enable Rx. */
842 	AR_WRITE(sc, AR_CR, 0);
843 	AR_WRITE_BARRIER(sc);
844 }
845 
846 #if NBPFILTER > 0
847 void
848 ar9003_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
849     struct ar_rx_status *ds)
850 {
851 #define IEEE80211_RADIOTAP_F_SHORTGI	0x80	/* XXX from FBSD */
852 
853 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
854 	struct ieee80211com *ic = &sc->sc_ic;
855 	struct mbuf mb;
856 	uint64_t tsf;
857 	uint32_t tstamp;
858 	uint8_t rate;
859 
860 	/* Extend the 15-bit timestamp from Rx status to 64-bit TSF. */
861 	tstamp = ds->ds_status3;
862 	tsf = AR_READ(sc, AR_TSF_U32);
863 	tsf = tsf << 32 | AR_READ(sc, AR_TSF_L32);
864 	if ((tsf & 0x7fff) < tstamp)
865 		tsf -= 0x8000;
866 	tsf = (tsf & ~0x7fff) | tstamp;
867 
868 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
869 	tap->wr_tsft = htole64(tsf);
870 	tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
871 	tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
872 	tap->wr_dbm_antsignal = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
873 	/* XXX noise. */
874 	tap->wr_antenna = MS(ds->ds_status4, AR_RXS4_ANTENNA);
875 	tap->wr_rate = 0;	/* In case it can't be found below. */
876 	rate = MS(ds->ds_status1, AR_RXS1_RATE);
877 	if (rate & 0x80) {		/* HT. */
878 		/* Bit 7 set means HT MCS instead of rate. */
879 		tap->wr_rate = rate;
880 		if (!(ds->ds_status4 & AR_RXS4_GI))
881 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
882 
883 	} else if (rate & 0x10) {	/* CCK. */
884 		if (rate & 0x04)
885 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
886 		switch (rate & ~0x14) {
887 		case 0xb: tap->wr_rate =   2; break;
888 		case 0xa: tap->wr_rate =   4; break;
889 		case 0x9: tap->wr_rate =  11; break;
890 		case 0x8: tap->wr_rate =  22; break;
891 		}
892 	} else {			/* OFDM. */
893 		switch (rate) {
894 		case 0xb: tap->wr_rate =  12; break;
895 		case 0xf: tap->wr_rate =  18; break;
896 		case 0xa: tap->wr_rate =  24; break;
897 		case 0xe: tap->wr_rate =  36; break;
898 		case 0x9: tap->wr_rate =  48; break;
899 		case 0xd: tap->wr_rate =  72; break;
900 		case 0x8: tap->wr_rate =  96; break;
901 		case 0xc: tap->wr_rate = 108; break;
902 		}
903 	}
904 	mb.m_data = (caddr_t)tap;
905 	mb.m_len = sc->sc_rxtap_len;
906 	mb.m_next = m;
907 	mb.m_nextpkt = NULL;
908 	mb.m_type = 0;
909 	mb.m_flags = 0;
910 	bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
911 }
912 #endif
913 
914 int
915 ar9003_rx_process(struct athn_softc *sc, int qid)
916 {
917 	struct ieee80211com *ic = &sc->sc_ic;
918 	struct ifnet *ifp = &ic->ic_if;
919 	struct athn_rxq *rxq = &sc->rxq[qid];
920 	struct athn_rx_buf *bf;
921 	struct ar_rx_status *ds;
922 	struct ieee80211_frame *wh;
923 	struct ieee80211_rxinfo rxi;
924 	struct ieee80211_node *ni;
925 	struct mbuf *m, *m1;
926 	int error, len;
927 
928 	bf = SIMPLEQ_FIRST(&rxq->head);
929 	if (__predict_false(bf == NULL)) {	/* Should not happen. */
930 		printf("%s: Rx queue is empty!\n", sc->sc_dev.dv_xname);
931 		return (ENOENT);
932 	}
933 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
934 	    BUS_DMASYNC_POSTREAD);
935 
936 	ds = mtod(bf->bf_m, struct ar_rx_status *);
937 	if (!(ds->ds_status11 & AR_RXS11_DONE))
938 		return (EBUSY);
939 
940 	/* Check that it is a valid Rx status descriptor. */
941 	if ((ds->ds_info & (AR_RXI_DESC_ID_M | AR_RXI_DESC_TX |
942 	    AR_RXI_CTRL_STAT)) != SM(AR_RXI_DESC_ID, AR_VENDOR_ATHEROS))
943 		goto skip;
944 
945 	if (!(ds->ds_status11 & AR_RXS11_FRAME_OK)) {
946 		if (ds->ds_status11 & AR_RXS11_CRC_ERR)
947 			DPRINTFN(6, ("CRC error\n"));
948 		else if (ds->ds_status11 & AR_RXS11_PHY_ERR)
949 			DPRINTFN(6, ("PHY error=0x%x\n",
950 			    MS(ds->ds_status11, AR_RXS11_PHY_ERR_CODE)));
951 		else if (ds->ds_status11 & AR_RXS11_DECRYPT_CRC_ERR)
952 			DPRINTFN(6, ("Decryption CRC error\n"));
953 		else if (ds->ds_status11 & AR_RXS11_MICHAEL_ERR) {
954 			DPRINTFN(2, ("Michael MIC failure\n"));
955 			/* Report Michael MIC failures to net80211. */
956 			ic->ic_stats.is_rx_locmicfail++;
957 			ieee80211_michael_mic_failure(ic, 0);
958 			/*
959 			 * XXX Check that it is not a control frame
960 			 * (invalid MIC failures on valid ctl frames).
961 			 */
962 		}
963 		ifp->if_ierrors++;
964 		goto skip;
965 	}
966 
967 	len = MS(ds->ds_status2, AR_RXS2_DATA_LEN);
968 	if (__predict_false(len < IEEE80211_MIN_LEN ||
969 	    len > ATHN_RXBUFSZ - sizeof(*ds))) {
970 		DPRINTF(("corrupted descriptor length=%d\n", len));
971 		ifp->if_ierrors++;
972 		goto skip;
973 	}
974 
975 	/* Allocate a new Rx buffer. */
976 	m1 = MCLGETI(NULL, M_DONTWAIT, NULL, ATHN_RXBUFSZ);
977 	if (__predict_false(m1 == NULL)) {
978 		ic->ic_stats.is_rx_nombuf++;
979 		ifp->if_ierrors++;
980 		goto skip;
981 	}
982 
983 	/* Unmap the old Rx buffer. */
984 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
985 
986 	/* Map the new Rx buffer. */
987 	error = bus_dmamap_load(sc->sc_dmat, bf->bf_map, mtod(m1, void *),
988 	    ATHN_RXBUFSZ, NULL, BUS_DMA_NOWAIT | BUS_DMA_READ);
989 	if (__predict_false(error != 0)) {
990 		m_freem(m1);
991 
992 		/* Remap the old Rx buffer or panic. */
993 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
994 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
995 		    BUS_DMA_NOWAIT | BUS_DMA_READ);
996 		KASSERT(error != 0);
997 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
998 		ifp->if_ierrors++;
999 		goto skip;
1000 	}
1001 	bf->bf_desc = mtod(m1, struct ar_rx_status *);
1002 	bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
1003 
1004 	m = bf->bf_m;
1005 	bf->bf_m = m1;
1006 
1007 	/* Finalize mbuf. */
1008 	/* Strip Rx status descriptor from head. */
1009 	m->m_data = (caddr_t)&ds[1];
1010 	m->m_pkthdr.len = m->m_len = len;
1011 
1012 	/* Grab a reference to the source node. */
1013 	wh = mtod(m, struct ieee80211_frame *);
1014 	ni = ieee80211_find_rxnode(ic, wh);
1015 
1016 	/* Remove any HW padding after the 802.11 header. */
1017 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
1018 		u_int hdrlen = ieee80211_get_hdrlen(wh);
1019 		if (hdrlen & 3) {
1020 			memmove((caddr_t)wh + 2, wh, hdrlen);
1021 			m_adj(m, 2);
1022 		}
1023 	}
1024 #if NBPFILTER > 0
1025 	if (__predict_false(sc->sc_drvbpf != NULL))
1026 		ar9003_rx_radiotap(sc, m, ds);
1027 #endif
1028 	/* Trim 802.11 FCS after radiotap. */
1029 	m_adj(m, -IEEE80211_CRC_LEN);
1030 
1031 	/* Send the frame to the 802.11 layer. */
1032 	rxi.rxi_flags = 0;	/* XXX */
1033 	rxi.rxi_rssi = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
1034 	rxi.rxi_tstamp = ds->ds_status3;
1035 	ieee80211_input(ifp, m, ni, &rxi);
1036 
1037 	/* Node is no longer needed. */
1038 	ieee80211_release_node(ic, ni);
1039 
1040  skip:
1041 	/* Unlink this descriptor from head. */
1042 	SIMPLEQ_REMOVE_HEAD(&rxq->head, bf_list);
1043 	memset(bf->bf_desc, 0, sizeof(*ds));
1044 
1045 	/* Re-use this descriptor and link it to tail. */
1046 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
1047 	    BUS_DMASYNC_PREREAD);
1048 
1049 	if (qid == ATHN_QID_LP)
1050 		AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
1051 	else
1052 		AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
1053 	AR_WRITE_BARRIER(sc);
1054 	SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
1055 
1056 	/* Re-enable Rx. */
1057 	AR_WRITE(sc, AR_CR, 0);
1058 	AR_WRITE_BARRIER(sc);
1059 	return (0);
1060 }
1061 
1062 void
1063 ar9003_rx_intr(struct athn_softc *sc, int qid)
1064 {
1065 	while (ar9003_rx_process(sc, qid) == 0);
1066 }
1067 
1068 int
1069 ar9003_tx_process(struct athn_softc *sc)
1070 {
1071 	struct ieee80211com *ic = &sc->sc_ic;
1072 	struct ifnet *ifp = &ic->ic_if;
1073 	struct athn_txq *txq;
1074 	struct athn_node *an;
1075 	struct athn_tx_buf *bf;
1076 	struct ar_tx_status *ds;
1077 	uint8_t qid, failcnt;
1078 
1079 	ds = &((struct ar_tx_status *)sc->txsring)[sc->txscur];
1080 	if (!(ds->ds_status8 & AR_TXS8_DONE))
1081 		return (EBUSY);
1082 
1083 	sc->txscur = (sc->txscur + 1) % AR9003_NTXSTATUS;
1084 
1085 	/* Check that it is a valid Tx status descriptor. */
1086 	if ((ds->ds_info & (AR_TXI_DESC_ID_M | AR_TXI_DESC_TX)) !=
1087 	    (SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) | AR_TXI_DESC_TX)) {
1088 		memset(ds, 0, sizeof(*ds));
1089 		return (0);
1090 	}
1091 	/* Retrieve the queue that was used to send this PDU. */
1092 	qid = MS(ds->ds_info, AR_TXI_QCU_NUM);
1093 	txq = &sc->txq[qid];
1094 
1095 	bf = SIMPLEQ_FIRST(&txq->head);
1096 	if (bf == NULL || bf == txq->wait) {
1097 		memset(ds, 0, sizeof(*ds));
1098 		return (0);
1099 	}
1100 	SIMPLEQ_REMOVE_HEAD(&txq->head, bf_list);
1101 
1102 	sc->sc_tx_timer = 0;
1103 
1104 	if (ds->ds_status3 & AR_TXS3_EXCESSIVE_RETRIES)
1105 		ifp->if_oerrors++;
1106 
1107 	if (ds->ds_status3 & AR_TXS3_UNDERRUN)
1108 		athn_inc_tx_trigger_level(sc);
1109 
1110 	/* Wakeup PA predistortion state machine. */
1111 	if (bf->bf_txflags & ATHN_TXFLAG_PAPRD)
1112 		ar9003_paprd_tx_tone_done(sc);
1113 
1114 	an = (struct athn_node *)bf->bf_ni;
1115 	/*
1116 	 * NB: the data fail count contains the number of un-acked tries
1117 	 * for the final series used.  We must add the number of tries for
1118 	 * each series that was fully processed.
1119 	 */
1120 	failcnt  = MS(ds->ds_status3, AR_TXS3_DATA_FAIL_CNT);
1121 	/* NB: Assume two tries per series. */
1122 	failcnt += MS(ds->ds_status8, AR_TXS8_FINAL_IDX) * 2;
1123 
1124 	/* Update rate control statistics. */
1125 	an->amn.amn_txcnt++;
1126 	if (failcnt > 0)
1127 		an->amn.amn_retrycnt++;
1128 
1129 	DPRINTFN(5, ("Tx done qid=%d status3=%d fail count=%d\n",
1130 	    qid, ds->ds_status3, failcnt));
1131 
1132 	/* Reset Tx status descriptor. */
1133 	memset(ds, 0, sizeof(*ds));
1134 
1135 	/* Unmap Tx buffer. */
1136 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1137 	    BUS_DMASYNC_POSTWRITE);
1138 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1139 
1140 	m_freem(bf->bf_m);
1141 	bf->bf_m = NULL;
1142 	ieee80211_release_node(ic, bf->bf_ni);
1143 	bf->bf_ni = NULL;
1144 
1145 	/* Link Tx buffer back to global free list. */
1146 	SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
1147 
1148 	/* Queue buffers that are waiting if there is new room. */
1149 	if (--txq->queued < AR9003_TX_QDEPTH && txq->wait != NULL) {
1150 		AR_WRITE(sc, AR_QTXDP(qid), txq->wait->bf_daddr);
1151 		AR_WRITE_BARRIER(sc);
1152 		txq->wait = SIMPLEQ_NEXT(txq->wait, bf_list);
1153 	}
1154 	return (0);
1155 }
1156 
1157 void
1158 ar9003_tx_intr(struct athn_softc *sc)
1159 {
1160 	struct ieee80211com *ic = &sc->sc_ic;
1161 	struct ifnet *ifp = &ic->ic_if;
1162 
1163 	while (ar9003_tx_process(sc) == 0);
1164 
1165 	if (!SIMPLEQ_EMPTY(&sc->txbufs)) {
1166 		ifq_clr_oactive(&ifp->if_snd);
1167 		ifp->if_start(ifp);
1168 	}
1169 }
1170 
1171 #ifndef IEEE80211_STA_ONLY
1172 /*
1173  * Process Software Beacon Alert interrupts.
1174  */
1175 int
1176 ar9003_swba_intr(struct athn_softc *sc)
1177 {
1178 	struct ieee80211com *ic = &sc->sc_ic;
1179 	struct ifnet *ifp = &ic->ic_if;
1180 	struct ieee80211_node *ni = ic->ic_bss;
1181 	struct athn_tx_buf *bf = sc->bcnbuf;
1182 	struct ieee80211_frame *wh;
1183 	struct ar_tx_desc *ds;
1184 	struct mbuf *m;
1185 	uint32_t sum;
1186 	uint8_t ridx, hwrate;
1187 	int error, totlen;
1188 
1189 	if (ic->ic_tim_mcast_pending &&
1190 	    mq_empty(&ni->ni_savedq) &&
1191 	    SIMPLEQ_EMPTY(&sc->txq[ATHN_QID_CAB].head))
1192 		ic->ic_tim_mcast_pending = 0;
1193 
1194 	if (ic->ic_dtim_count == 0)
1195 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1196 	else
1197 		ic->ic_dtim_count--;
1198 
1199 	/* Make sure previous beacon has been sent. */
1200 	if (athn_tx_pending(sc, ATHN_QID_BEACON)) {
1201 		DPRINTF(("beacon stuck\n"));
1202 		return (EBUSY);
1203 	}
1204 	/* Get new beacon. */
1205 	m = ieee80211_beacon_alloc(ic, ic->ic_bss);
1206 	if (__predict_false(m == NULL))
1207 		return (ENOBUFS);
1208 	/* Assign sequence number. */
1209 	wh = mtod(m, struct ieee80211_frame *);
1210 	*(uint16_t *)&wh->i_seq[0] =
1211 	    htole16(ic->ic_bss->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
1212 	ic->ic_bss->ni_txseq++;
1213 
1214 	/* Unmap and free old beacon if any. */
1215 	if (__predict_true(bf->bf_m != NULL)) {
1216 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0,
1217 		    bf->bf_map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1218 		bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1219 		m_freem(bf->bf_m);
1220 		bf->bf_m = NULL;
1221 	}
1222 	/* DMA map new beacon. */
1223 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1224 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1225 	if (__predict_false(error != 0)) {
1226 		m_freem(m);
1227 		return (error);
1228 	}
1229 	bf->bf_m = m;
1230 
1231 	/* Setup Tx descriptor (simplified ar9003_tx()). */
1232 	ds = bf->bf_descs;
1233 	memset(ds, 0, sizeof(*ds));
1234 
1235 	ds->ds_info =
1236 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1237 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1238 	    SM(AR_TXI_QCU_NUM, ATHN_QID_BEACON) |
1239 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1240 
1241 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1242 	ds->ds_ctl11 = SM(AR_TXC11_FRAME_LEN, totlen);
1243 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, AR_MAX_RATE_POWER);
1244 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, AR_FRAME_TYPE_BEACON);
1245 	ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1246 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, AR_ENCR_TYPE_CLEAR);
1247 
1248 	/* Write number of tries. */
1249 	ds->ds_ctl13 = SM(AR_TXC13_XMIT_DATA_TRIES0, 1);
1250 
1251 	/* Write Tx rate. */
1252 	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1253 	    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1254 	hwrate = athn_rates[ridx].hwrate;
1255 	ds->ds_ctl14 = SM(AR_TXC14_XMIT_RATE0, hwrate);
1256 
1257 	/* Write Tx chains. */
1258 	ds->ds_ctl18 = SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask);
1259 
1260 	ds->ds_segs[0].ds_data = bf->bf_map->dm_segs[0].ds_addr;
1261 	/* Segment length must be a multiple of 4. */
1262 	ds->ds_segs[0].ds_ctl |= SM(AR_TXC_BUF_LEN,
1263 	    (bf->bf_map->dm_segs[0].ds_len + 3) & ~3);
1264 	/* Compute Tx descriptor checksum. */
1265 	sum = ds->ds_info;
1266 	sum += ds->ds_segs[0].ds_data;
1267 	sum += ds->ds_segs[0].ds_ctl;
1268 	sum = (sum >> 16) + (sum & 0xffff);
1269 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1270 
1271 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1272 	    BUS_DMASYNC_PREWRITE);
1273 
1274 	/* Stop Tx DMA before putting the new beacon on the queue. */
1275 	athn_stop_tx_dma(sc, ATHN_QID_BEACON);
1276 
1277 	AR_WRITE(sc, AR_QTXDP(ATHN_QID_BEACON), bf->bf_daddr);
1278 
1279 	for(;;) {
1280 		if (SIMPLEQ_EMPTY(&sc->txbufs))
1281 			break;
1282 
1283 		m = mq_dequeue(&ni->ni_savedq);
1284 		if (m == NULL)
1285 			break;
1286 		if (!mq_empty(&ni->ni_savedq)) {
1287 			/* more queued frames, set the more data bit */
1288 			wh = mtod(m, struct ieee80211_frame *);
1289 			wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
1290 		}
1291 
1292 		if (sc->ops.tx(sc, m, ni, ATHN_TXFLAG_CAB) != 0) {
1293 			ieee80211_release_node(ic, ni);
1294 			ifp->if_oerrors++;
1295 			break;
1296 		}
1297 	}
1298 
1299 	/* Kick Tx. */
1300 	AR_WRITE(sc, AR_Q_TXE, 1 << ATHN_QID_BEACON);
1301 	AR_WRITE_BARRIER(sc);
1302 	return (0);
1303 }
1304 #endif
1305 
1306 int
1307 ar9003_intr(struct athn_softc *sc)
1308 {
1309 	uint32_t intr, intr2, intr5, sync;
1310 
1311 	/* Get pending interrupts. */
1312 	intr = AR_READ(sc, AR_INTR_ASYNC_CAUSE);
1313 	if (!(intr & AR_INTR_MAC_IRQ) || intr == AR_INTR_SPURIOUS) {
1314 		intr = AR_READ(sc, AR_INTR_SYNC_CAUSE);
1315 		if (intr == AR_INTR_SPURIOUS || (intr & sc->isync) == 0)
1316 			return (0);	/* Not for us. */
1317 	}
1318 
1319 	if ((AR_READ(sc, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) &&
1320 	    (AR_READ(sc, AR_RTC_STATUS) & AR_RTC_STATUS_M) == AR_RTC_STATUS_ON)
1321 		intr = AR_READ(sc, AR_ISR);
1322 	else
1323 		intr = 0;
1324 	sync = AR_READ(sc, AR_INTR_SYNC_CAUSE) & sc->isync;
1325 	if (intr == 0 && sync == 0)
1326 		return (0);	/* Not for us. */
1327 
1328 	if (intr != 0) {
1329 		if (intr & AR_ISR_BCNMISC) {
1330 			intr2 = AR_READ(sc, AR_ISR_S2);
1331 			if (intr2 & AR_ISR_S2_TIM)
1332 				/* TBD */;
1333 			if (intr2 & AR_ISR_S2_TSFOOR)
1334 				/* TBD */;
1335 			if (intr2 & AR_ISR_S2_BB_WATCHDOG)
1336 				/* TBD */;
1337 		}
1338 		intr = AR_READ(sc, AR_ISR_RAC);
1339 		if (intr == AR_INTR_SPURIOUS)
1340 			return (1);
1341 
1342 #ifndef IEEE80211_STA_ONLY
1343 		if (intr & AR_ISR_SWBA)
1344 			ar9003_swba_intr(sc);
1345 #endif
1346 		if (intr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
1347 			ar9003_rx_intr(sc, ATHN_QID_LP);
1348 		if (intr & (AR_ISR_LP_RXOK | AR_ISR_RXERR | AR_ISR_RXEOL))
1349 			ar9003_rx_intr(sc, ATHN_QID_LP);
1350 		if (intr & AR_ISR_HP_RXOK)
1351 			ar9003_rx_intr(sc, ATHN_QID_HP);
1352 
1353 		if (intr & (AR_ISR_TXMINTR | AR_ISR_TXINTM))
1354 			ar9003_tx_intr(sc);
1355 		if (intr & (AR_ISR_TXOK | AR_ISR_TXERR | AR_ISR_TXEOL))
1356 			ar9003_tx_intr(sc);
1357 
1358 		if (intr & AR_ISR_GENTMR) {
1359 			intr5 = AR_READ(sc, AR_ISR_S5_S);
1360 			DPRINTF(("GENTMR trigger=%d thresh=%d\n",
1361 			    MS(intr5, AR_ISR_S5_GENTIMER_TRIG),
1362 			    MS(intr5, AR_ISR_S5_GENTIMER_THRESH)));
1363 		}
1364 	}
1365 	if (sync != 0) {
1366 		if (sync & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
1367 			AR_WRITE(sc, AR_RC, AR_RC_HOSTIF);
1368 			AR_WRITE(sc, AR_RC, 0);
1369 		}
1370 
1371 		if ((sc->flags & ATHN_FLAG_RFSILENT) &&
1372 		    (sync & AR_INTR_SYNC_GPIO_PIN(sc->rfsilent_pin))) {
1373 			struct ifnet *ifp = &sc->sc_ic.ic_if;
1374 
1375 			printf("%s: radio switch turned off\n",
1376 			    sc->sc_dev.dv_xname);
1377 			/* Turn the interface down. */
1378 			athn_stop(ifp, 1);
1379 			return (1);
1380 		}
1381 
1382 		AR_WRITE(sc, AR_INTR_SYNC_CAUSE, sync);
1383 		(void)AR_READ(sc, AR_INTR_SYNC_CAUSE);
1384 	}
1385 	return (1);
1386 }
1387 
1388 int
1389 ar9003_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
1390     int txflags)
1391 {
1392 	struct ieee80211com *ic = &sc->sc_ic;
1393 	struct ieee80211_key *k = NULL;
1394 	struct ieee80211_frame *wh;
1395 	struct athn_series series[4];
1396 	struct ar_tx_desc *ds;
1397 	struct athn_txq *txq;
1398 	struct athn_tx_buf *bf;
1399 	struct athn_node *an = (void *)ni;
1400 	struct mbuf *m1;
1401 	uintptr_t entry;
1402 	uint32_t sum;
1403 	uint16_t qos = 0;
1404 	uint8_t txpower, type, encrtype, tid, ridx[4];
1405 	int i, error, totlen, hasqos, qid;
1406 
1407 	/* Grab a Tx buffer from our global free list. */
1408 	bf = SIMPLEQ_FIRST(&sc->txbufs);
1409 	KASSERT(bf != NULL);
1410 
1411 	/* Map 802.11 frame type to hardware frame type. */
1412 	wh = mtod(m, struct ieee80211_frame *);
1413 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1414 	    IEEE80211_FC0_TYPE_MGT) {
1415 		/* NB: Beacons do not use ar9003_tx(). */
1416 		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1417 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1418 			type = AR_FRAME_TYPE_PROBE_RESP;
1419 		else if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1420 		    IEEE80211_FC0_SUBTYPE_ATIM)
1421 			type = AR_FRAME_TYPE_ATIM;
1422 		else
1423 			type = AR_FRAME_TYPE_NORMAL;
1424 	} else if ((wh->i_fc[0] &
1425 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1426 	    (IEEE80211_FC0_TYPE_CTL  | IEEE80211_FC0_SUBTYPE_PS_POLL)) {
1427 		type = AR_FRAME_TYPE_PSPOLL;
1428 	} else
1429 		type = AR_FRAME_TYPE_NORMAL;
1430 
1431 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1432 		k = ieee80211_get_txkey(ic, wh, ni);
1433 		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1434 			return (ENOBUFS);
1435 		wh = mtod(m, struct ieee80211_frame *);
1436 	}
1437 
1438 	/* XXX 2-byte padding for QoS and 4-addr headers. */
1439 
1440 	/* Select the HW Tx queue to use for this frame. */
1441 	if ((hasqos = ieee80211_has_qos(wh))) {
1442 		qos = ieee80211_get_qos(wh);
1443 		tid = qos & IEEE80211_QOS_TID;
1444 		qid = athn_ac2qid[ieee80211_up_to_ac(ic, tid)];
1445 	} else if (type == AR_FRAME_TYPE_PSPOLL) {
1446 		qid = ATHN_QID_PSPOLL;
1447 	} else if (txflags & ATHN_TXFLAG_CAB) {
1448 		qid = ATHN_QID_CAB;
1449 	} else
1450 		qid = ATHN_QID_AC_BE;
1451 	txq = &sc->txq[qid];
1452 
1453 	/* Select the transmit rates to use for this frame. */
1454 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1455 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
1456 	    IEEE80211_FC0_TYPE_DATA) {
1457 		/* Use lowest rate for all tries. */
1458 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1459 		    (ic->ic_curmode == IEEE80211_MODE_11A) ?
1460 			ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1461 	} else if (ic->ic_fixed_rate != -1) {
1462 		/* Use same fixed rate for all tries. */
1463 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1464 		    sc->fixed_ridx;
1465 	} else {
1466 		int txrate = ni->ni_txrate;
1467 		/* Use fallback table of the node. */
1468 		for (i = 0; i < 4; i++) {
1469 			ridx[i] = an->ridx[txrate];
1470 			txrate = an->fallback[txrate];
1471 		}
1472 	}
1473 
1474 #if NBPFILTER > 0
1475 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1476 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
1477 		struct mbuf mb;
1478 
1479 		tap->wt_flags = 0;
1480 		/* Use initial transmit rate. */
1481 		tap->wt_rate = athn_rates[ridx[0]].rate;
1482 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1483 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1484 		tap->wt_hwqueue = qid;
1485 		if (ridx[0] != ATHN_RIDX_CCK1 &&
1486 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1487 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1488 		mb.m_data = (caddr_t)tap;
1489 		mb.m_len = sc->sc_txtap_len;
1490 		mb.m_next = m;
1491 		mb.m_nextpkt = NULL;
1492 		mb.m_type = 0;
1493 		mb.m_flags = 0;
1494 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1495 	}
1496 #endif
1497 
1498 	/* DMA map mbuf. */
1499 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1500 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1501 	if (__predict_false(error != 0)) {
1502 		if (error != EFBIG) {
1503 			printf("%s: can't map mbuf (error %d)\n",
1504 			    sc->sc_dev.dv_xname, error);
1505 			m_freem(m);
1506 			return (error);
1507 		}
1508 		/*
1509 		 * DMA mapping requires too many DMA segments; linearize
1510 		 * mbuf in kernel virtual address space and retry.
1511 		 */
1512 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1513 		if (m1 == NULL) {
1514 			m_freem(m);
1515 			return (ENOBUFS);
1516 		}
1517 		if (m->m_pkthdr.len > MHLEN) {
1518 			MCLGET(m1, M_DONTWAIT);
1519 			if (!(m1->m_flags & M_EXT)) {
1520 				m_freem(m);
1521 				m_freem(m1);
1522 				return (ENOBUFS);
1523 			}
1524 		}
1525 		m_copydata(m, 0, m->m_pkthdr.len, mtod(m1, caddr_t));
1526 		m1->m_pkthdr.len = m1->m_len = m->m_pkthdr.len;
1527 		m_freem(m);
1528 		m = m1;
1529 
1530 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1531 		    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1532 		if (error != 0) {
1533 			printf("%s: can't map mbuf (error %d)\n",
1534 			    sc->sc_dev.dv_xname, error);
1535 			m_freem(m);
1536 			return (error);
1537 		}
1538 	}
1539 	bf->bf_m = m;
1540 	bf->bf_ni = ni;
1541 	bf->bf_txflags = txflags;
1542 
1543 	wh = mtod(m, struct ieee80211_frame *);
1544 
1545 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1546 
1547 	/* Setup Tx descriptor. */
1548 	ds = bf->bf_descs;
1549 	memset(ds, 0, sizeof(*ds));
1550 
1551 	ds->ds_info =
1552 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1553 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1554 	    SM(AR_TXI_QCU_NUM, qid) |
1555 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1556 
1557 	ds->ds_ctl11 = AR_TXC11_CLR_DEST_MASK;
1558 	txpower = AR_MAX_RATE_POWER;	/* Get from per-rate registers. */
1559 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, txpower);
1560 
1561 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, type);
1562 
1563 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1564 	    (hasqos && (qos & IEEE80211_QOS_ACK_POLICY_MASK) ==
1565 	     IEEE80211_QOS_ACK_POLICY_NOACK))
1566 		ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1567 
1568 	if (0 && k != NULL) {
1569 		/*
1570 		 * Map 802.11 cipher to hardware encryption type and
1571 		 * compute MIC+ICV overhead.
1572 		 */
1573 		switch (k->k_cipher) {
1574 		case IEEE80211_CIPHER_WEP40:
1575 		case IEEE80211_CIPHER_WEP104:
1576 			encrtype = AR_ENCR_TYPE_WEP;
1577 			totlen += 4;
1578 			break;
1579 		case IEEE80211_CIPHER_TKIP:
1580 			encrtype = AR_ENCR_TYPE_TKIP;
1581 			totlen += 12;
1582 			break;
1583 		case IEEE80211_CIPHER_CCMP:
1584 			encrtype = AR_ENCR_TYPE_AES;
1585 			totlen += 8;
1586 			break;
1587 		default:
1588 			panic("unsupported cipher");
1589 		}
1590 		/*
1591 		 * NB: The key cache entry index is stored in the key
1592 		 * private field when the key is installed.
1593 		 */
1594 		entry = (uintptr_t)k->k_priv;
1595 		ds->ds_ctl12 |= SM(AR_TXC12_DEST_IDX, entry);
1596 		ds->ds_ctl11 |= AR_TXC11_DEST_IDX_VALID;
1597 	} else
1598 		encrtype = AR_ENCR_TYPE_CLEAR;
1599 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, encrtype);
1600 
1601 	/* Check if frame must be protected using RTS/CTS or CTS-to-self. */
1602 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1603 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1604 	    IEEE80211_FC0_TYPE_DATA) {
1605 		/* NB: Group frames are sent using CCK in 802.11b/g. */
1606 		if (totlen > ic->ic_rtsthreshold) {
1607 			ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1608 		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1609 		    athn_rates[ridx[0]].phy == IEEE80211_T_OFDM) {
1610 			if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1611 				ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1612 			else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1613 				ds->ds_ctl11 |= AR_TXC11_CTS_ENABLE;
1614 		}
1615 	}
1616 	/*
1617 	 * Disable multi-rate retries when protection is used.
1618 	 * The RTS/CTS frame's duration field is fixed and won't be
1619 	 * updated by hardware when the data rate changes.
1620 	 */
1621 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1622 		ridx[1] = ridx[2] = ridx[3] = ridx[0];
1623 	}
1624 	/* Setup multi-rate retries. */
1625 	for (i = 0; i < 4; i++) {
1626 		series[i].hwrate = athn_rates[ridx[i]].hwrate;
1627 		if (athn_rates[ridx[i]].phy == IEEE80211_T_DS &&
1628 		    ridx[i] != ATHN_RIDX_CCK1 &&
1629 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1630 			series[i].hwrate |= 0x04;
1631 		series[i].dur = 0;
1632 	}
1633 	if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1634 		/* Compute duration for each series. */
1635 		for (i = 0; i < 4; i++) {
1636 			series[i].dur = athn_txtime(sc, IEEE80211_ACK_LEN,
1637 			    athn_rates[ridx[i]].rspridx, ic->ic_flags);
1638 		}
1639 	}
1640 	/* If this is a PA training frame, select the Tx chain to use. */
1641 	if (__predict_false(txflags & ATHN_TXFLAG_PAPRD)) {
1642 		ds->ds_ctl12 |= SM(AR_TXC12_PAPRD_CHAIN_MASK,
1643 		    1 << sc->paprd_curchain);
1644 	}
1645 
1646 	/* Write number of tries for each series. */
1647 	ds->ds_ctl13 =
1648 	    SM(AR_TXC13_XMIT_DATA_TRIES0, 2) |
1649 	    SM(AR_TXC13_XMIT_DATA_TRIES1, 2) |
1650 	    SM(AR_TXC13_XMIT_DATA_TRIES2, 2) |
1651 	    SM(AR_TXC13_XMIT_DATA_TRIES3, 4);
1652 
1653 	/* Tell HW to update duration field in 802.11 header. */
1654 	if (type != AR_FRAME_TYPE_PSPOLL)
1655 		ds->ds_ctl13 |= AR_TXC13_DUR_UPDATE_ENA;
1656 
1657 	/* Write Tx rate for each series. */
1658 	ds->ds_ctl14 =
1659 	    SM(AR_TXC14_XMIT_RATE0, series[0].hwrate) |
1660 	    SM(AR_TXC14_XMIT_RATE1, series[1].hwrate) |
1661 	    SM(AR_TXC14_XMIT_RATE2, series[2].hwrate) |
1662 	    SM(AR_TXC14_XMIT_RATE3, series[3].hwrate);
1663 
1664 	/* Write duration for each series. */
1665 	ds->ds_ctl15 =
1666 	    SM(AR_TXC15_PACKET_DUR0, series[0].dur) |
1667 	    SM(AR_TXC15_PACKET_DUR1, series[1].dur);
1668 	ds->ds_ctl16 =
1669 	    SM(AR_TXC16_PACKET_DUR2, series[2].dur) |
1670 	    SM(AR_TXC16_PACKET_DUR3, series[3].dur);
1671 
1672 	if ((sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) &&
1673 	    ic->ic_curmode == IEEE80211_MODE_11A) {
1674 		/*
1675 		 * In order to not exceed PCIe power requirements, we only
1676 		 * use two Tx chains for MCS0~15 on 5GHz band on these chips.
1677 		 */
1678 		ds->ds_ctl18 =
1679 		    SM(AR_TXC18_CHAIN_SEL0,
1680 			(ridx[0] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1681 		    SM(AR_TXC18_CHAIN_SEL1,
1682 			(ridx[1] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1683 		    SM(AR_TXC18_CHAIN_SEL2,
1684 			(ridx[2] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1685 		    SM(AR_TXC18_CHAIN_SEL3,
1686 			(ridx[3] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask);
1687 	} else {
1688 		/* Use the same Tx chains for all tries. */
1689 		ds->ds_ctl18 =
1690 		    SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask) |
1691 		    SM(AR_TXC18_CHAIN_SEL1, sc->txchainmask) |
1692 		    SM(AR_TXC18_CHAIN_SEL2, sc->txchainmask) |
1693 		    SM(AR_TXC18_CHAIN_SEL3, sc->txchainmask);
1694 	}
1695 #ifdef notyet
1696 	/* Use the same short GI setting for all tries. */
1697 	if (ic->ic_flags & IEEE80211_F_SHGI)
1698 		ds->ds_ctl18 |= AR_TXC18_GI0123;
1699 	/* Use the same channel width for all tries. */
1700 	if (ic->ic_flags & IEEE80211_F_CBW40)
1701 		ds->ds_ctl18 |= AR_TXC18_2040_0123;
1702 #endif
1703 
1704 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1705 		uint8_t protridx, hwrate;
1706 		uint16_t dur = 0;
1707 
1708 		/* Use the same protection mode for all tries. */
1709 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1710 			ds->ds_ctl15 |= AR_TXC15_RTSCTS_QUAL01;
1711 			ds->ds_ctl16 |= AR_TXC16_RTSCTS_QUAL23;
1712 		}
1713 		/* Select protection rate (suboptimal but ok). */
1714 		protridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1715 		    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK2;
1716 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1717 			/* Account for CTS duration. */
1718 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1719 			    athn_rates[protridx].rspridx, ic->ic_flags);
1720 		}
1721 		dur += athn_txtime(sc, totlen, ridx[0], ic->ic_flags);
1722 		if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1723 			/* Account for ACK duration. */
1724 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1725 			    athn_rates[ridx[0]].rspridx, ic->ic_flags);
1726 		}
1727 		/* Write protection frame duration and rate. */
1728 		ds->ds_ctl13 |= SM(AR_TXC13_BURST_DUR, dur);
1729 		hwrate = athn_rates[protridx].hwrate;
1730 		if (protridx == ATHN_RIDX_CCK2 &&
1731 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1732 			hwrate |= 0x04;
1733 		ds->ds_ctl18 |= SM(AR_TXC18_RTSCTS_RATE, hwrate);
1734 	}
1735 
1736 	ds->ds_ctl11 |= SM(AR_TXC11_FRAME_LEN, totlen);
1737 	ds->ds_ctl19 = AR_TXC19_NOT_SOUNDING;
1738 
1739 	for (i = 0; i < bf->bf_map->dm_nsegs; i++) {
1740 		ds->ds_segs[i].ds_data = bf->bf_map->dm_segs[i].ds_addr;
1741 		ds->ds_segs[i].ds_ctl = SM(AR_TXC_BUF_LEN,
1742 		    bf->bf_map->dm_segs[i].ds_len);
1743 	}
1744 	/* Compute Tx descriptor checksum. */
1745 	sum = ds->ds_info + ds->ds_link;
1746 	for (i = 0; i < 4; i++) {
1747 		sum += ds->ds_segs[i].ds_data;
1748 		sum += ds->ds_segs[i].ds_ctl;
1749 	}
1750 	sum = (sum >> 16) + (sum & 0xffff);
1751 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1752 
1753 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1754 	    BUS_DMASYNC_PREWRITE);
1755 
1756 	DPRINTFN(6, ("Tx qid=%d nsegs=%d ctl11=0x%x ctl12=0x%x ctl14=0x%x\n",
1757 	    qid, bf->bf_map->dm_nsegs, ds->ds_ctl11, ds->ds_ctl12,
1758 	    ds->ds_ctl14));
1759 
1760 	SIMPLEQ_REMOVE_HEAD(&sc->txbufs, bf_list);
1761 	SIMPLEQ_INSERT_TAIL(&txq->head, bf, bf_list);
1762 
1763 	/* Queue buffer unless hardware FIFO is already full. */
1764 	if (++txq->queued <= AR9003_TX_QDEPTH) {
1765 		AR_WRITE(sc, AR_QTXDP(qid), bf->bf_daddr);
1766 		AR_WRITE_BARRIER(sc);
1767 	} else if (txq->wait == NULL)
1768 		txq->wait = bf;
1769 	return (0);
1770 }
1771 
1772 void
1773 ar9003_set_rf_mode(struct athn_softc *sc, struct ieee80211_channel *c)
1774 {
1775 	uint32_t reg;
1776 
1777 	reg = IEEE80211_IS_CHAN_2GHZ(c) ?
1778 	    AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
1779 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
1780 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
1781 		reg |= AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE;
1782 	}
1783 	AR_WRITE(sc, AR_PHY_MODE, reg);
1784 	AR_WRITE_BARRIER(sc);
1785 }
1786 
1787 static __inline uint32_t
1788 ar9003_synth_delay(struct athn_softc *sc)
1789 {
1790 	uint32_t delay;
1791 
1792 	delay = MS(AR_READ(sc, AR_PHY_RX_DELAY), AR_PHY_RX_DELAY_DELAY);
1793 	if (sc->sc_ic.ic_curmode == IEEE80211_MODE_11B)
1794 		delay = (delay * 4) / 22;
1795 	else
1796 		delay = delay / 10;	/* in 100ns steps */
1797 	return (delay);
1798 }
1799 
1800 int
1801 ar9003_rf_bus_request(struct athn_softc *sc)
1802 {
1803 	int ntries;
1804 
1805 	/* Request RF Bus grant. */
1806 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
1807 	for (ntries = 0; ntries < 10000; ntries++) {
1808 		if (AR_READ(sc, AR_PHY_RFBUS_GRANT) & AR_PHY_RFBUS_GRANT_EN)
1809 			return (0);
1810 		DELAY(10);
1811 	}
1812 	DPRINTF(("could not kill baseband Rx"));
1813 	return (ETIMEDOUT);
1814 }
1815 
1816 void
1817 ar9003_rf_bus_release(struct athn_softc *sc)
1818 {
1819 	/* Wait for the synthesizer to settle. */
1820 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + ar9003_synth_delay(sc));
1821 
1822 	/* Release the RF Bus grant. */
1823 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, 0);
1824 	AR_WRITE_BARRIER(sc);
1825 }
1826 
1827 void
1828 ar9003_set_phy(struct athn_softc *sc, struct ieee80211_channel *c,
1829     struct ieee80211_channel *extc)
1830 {
1831 	uint32_t phy;
1832 
1833 	phy = AR_READ(sc, AR_PHY_GEN_CTRL);
1834 	phy |= AR_PHY_GC_HT_EN | AR_PHY_GC_SHORT_GI_40 |
1835 	    AR_PHY_GC_SINGLE_HT_LTF1 | AR_PHY_GC_WALSH;
1836 	if (extc != NULL) {
1837 		phy |= AR_PHY_GC_DYN2040_EN;
1838 		if (extc > c)	/* XXX */
1839 			phy |= AR_PHY_GC_DYN2040_PRI_CH;
1840 	}
1841 	/* Turn off Green Field detection for now. */
1842 	phy &= ~AR_PHY_GC_GF_DETECT_EN;
1843 	AR_WRITE(sc, AR_PHY_GEN_CTRL, phy);
1844 
1845 	AR_WRITE(sc, AR_2040_MODE,
1846 	    (extc != NULL) ? AR_2040_JOINED_RX_CLEAR : 0);
1847 
1848 	/* Set global transmit timeout. */
1849 	AR_WRITE(sc, AR_GTXTO, SM(AR_GTXTO_TIMEOUT_LIMIT, 25));
1850 	/* Set carrier sense timeout. */
1851 	AR_WRITE(sc, AR_CST, SM(AR_CST_TIMEOUT_LIMIT, 15));
1852 	AR_WRITE_BARRIER(sc);
1853 }
1854 
1855 void
1856 ar9003_set_delta_slope(struct athn_softc *sc, struct ieee80211_channel *c,
1857     struct ieee80211_channel *extc)
1858 {
1859 	uint32_t coeff, exp, man, reg;
1860 
1861 	/* Set Delta Slope (exponent and mantissa). */
1862 	coeff = (100 << 24) / c->ic_freq;
1863 	athn_get_delta_slope(coeff, &exp, &man);
1864 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1865 
1866 	reg = AR_READ(sc, AR_PHY_TIMING3);
1867 	reg = RW(reg, AR_PHY_TIMING3_DSC_EXP, exp);
1868 	reg = RW(reg, AR_PHY_TIMING3_DSC_MAN, man);
1869 	AR_WRITE(sc, AR_PHY_TIMING3, reg);
1870 
1871 	/* For Short GI, coeff is 9/10 that of normal coeff. */
1872 	coeff = (9 * coeff) / 10;
1873 	athn_get_delta_slope(coeff, &exp, &man);
1874 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1875 
1876 	reg = AR_READ(sc, AR_PHY_SGI_DELTA);
1877 	reg = RW(reg, AR_PHY_SGI_DSC_EXP, exp);
1878 	reg = RW(reg, AR_PHY_SGI_DSC_MAN, man);
1879 	AR_WRITE(sc, AR_PHY_SGI_DELTA, reg);
1880 	AR_WRITE_BARRIER(sc);
1881 }
1882 
1883 void
1884 ar9003_enable_antenna_diversity(struct athn_softc *sc)
1885 {
1886 	AR_SETBITS(sc, AR_PHY_CCK_DETECT,
1887 	    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
1888 	AR_WRITE_BARRIER(sc);
1889 }
1890 
1891 void
1892 ar9003_init_baseband(struct athn_softc *sc)
1893 {
1894 	uint32_t synth_delay;
1895 
1896 	synth_delay = ar9003_synth_delay(sc);
1897 	/* Activate the PHY (includes baseband activate and synthesizer on). */
1898 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
1899 	AR_WRITE_BARRIER(sc);
1900 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + synth_delay);
1901 }
1902 
1903 void
1904 ar9003_disable_phy(struct athn_softc *sc)
1905 {
1906 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
1907 	AR_WRITE_BARRIER(sc);
1908 }
1909 
1910 void
1911 ar9003_init_chains(struct athn_softc *sc)
1912 {
1913 	if (sc->rxchainmask == 0x5 || sc->txchainmask == 0x5)
1914 		AR_SETBITS(sc, AR_PHY_ANALOG_SWAP, AR_PHY_SWAP_ALT_CHAIN);
1915 
1916 	/* Setup chain masks. */
1917 	AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1918 	AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1919 
1920 	if (sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) {
1921 		/*
1922 		 * All self-generated frames are sent using two Tx chains
1923 		 * on these chips to not exceed PCIe power requirements.
1924 		 */
1925 		AR_WRITE(sc, AR_SELFGEN_MASK, 0x3);
1926 	} else
1927 		AR_WRITE(sc, AR_SELFGEN_MASK, sc->txchainmask);
1928 	AR_WRITE_BARRIER(sc);
1929 }
1930 
1931 void
1932 ar9003_set_rxchains(struct athn_softc *sc)
1933 {
1934 	if (sc->rxchainmask == 0x3 || sc->rxchainmask == 0x5) {
1935 		AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1936 		AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1937 		AR_WRITE_BARRIER(sc);
1938 	}
1939 }
1940 
1941 void
1942 ar9003_read_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1943 {
1944 /* Sign-extends 9-bit value (assumes upper bits are zeroes). */
1945 #define SIGN_EXT(v)	(((v) ^ 0x100) - 0x100)
1946 	uint32_t reg;
1947 	int i;
1948 
1949 	for (i = 0; i < sc->nrxchains; i++) {
1950 		reg = AR_READ(sc, AR_PHY_CCA(i));
1951 		nf[i] = MS(reg, AR_PHY_MINCCA_PWR);
1952 		nf[i] = SIGN_EXT(nf[i]);
1953 
1954 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1955 		nf_ext[i] = MS(reg, AR_PHY_EXT_MINCCA_PWR);
1956 		nf_ext[i] = SIGN_EXT(nf_ext[i]);
1957 	}
1958 #undef SIGN_EXT
1959 }
1960 
1961 void
1962 ar9003_write_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1963 {
1964 	uint32_t reg;
1965 	int i;
1966 
1967 	for (i = 0; i < sc->nrxchains; i++) {
1968 		reg = AR_READ(sc, AR_PHY_CCA(i));
1969 		reg = RW(reg, AR_PHY_MAXCCA_PWR, nf[i]);
1970 		AR_WRITE(sc, AR_PHY_CCA(i), reg);
1971 
1972 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1973 		reg = RW(reg, AR_PHY_EXT_MAXCCA_PWR, nf_ext[i]);
1974 		AR_WRITE(sc, AR_PHY_EXT_CCA(i), reg);
1975 	}
1976 	AR_WRITE_BARRIER(sc);
1977 }
1978 
1979 void
1980 ar9003_get_noisefloor(struct athn_softc *sc, struct ieee80211_channel *c)
1981 {
1982 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
1983 	int16_t min, max;
1984 	int i;
1985 
1986 	if (AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
1987 		/* Noisefloor calibration not finished. */
1988 		return;
1989 	}
1990 	/* Noisefloor calibration is finished. */
1991 	ar9003_read_noisefloor(sc, nf, nf_ext);
1992 
1993 	if (IEEE80211_IS_CHAN_2GHZ(c)) {
1994 		min = sc->cca_min_2g;
1995 		max = sc->cca_max_2g;
1996 	} else {
1997 		min = sc->cca_min_5g;
1998 		max = sc->cca_max_5g;
1999 	}
2000 	/* Update noisefloor history. */
2001 	for (i = 0; i < sc->nrxchains; i++) {
2002 		if (nf[i] < min)
2003 			nf[i] = min;
2004 		else if (nf[i] > max)
2005 			nf[i] = max;
2006 		if (nf_ext[i] < min)
2007 			nf_ext[i] = min;
2008 		else if (nf_ext[i] > max)
2009 			nf_ext[i] = max;
2010 
2011 		sc->nf_hist[sc->nf_hist_cur].nf[i] = nf[i];
2012 		sc->nf_hist[sc->nf_hist_cur].nf_ext[i] = nf_ext[i];
2013 	}
2014 	if (++sc->nf_hist_cur >= ATHN_NF_CAL_HIST_MAX)
2015 		sc->nf_hist_cur = 0;
2016 }
2017 
2018 void
2019 ar9003_bb_load_noisefloor(struct athn_softc *sc)
2020 {
2021 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
2022 	int i, ntries;
2023 
2024 	/* Write filtered noisefloor values. */
2025 	for (i = 0; i < sc->nrxchains; i++) {
2026 		nf[i] = sc->nf_priv[i] * 2;
2027 		nf_ext[i] = sc->nf_ext_priv[i] * 2;
2028 	}
2029 	ar9003_write_noisefloor(sc, nf, nf_ext);
2030 
2031 	/* Load filtered noisefloor values into baseband. */
2032 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2033 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2034 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2035 	/* Wait for load to complete. */
2036 	for (ntries = 0; ntries < 1000; ntries++) {
2037 		if (!(AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
2038 			break;
2039 		DELAY(10);
2040 	}
2041 	if (ntries == 1000) {
2042 		DPRINTF(("failed to load noisefloor values\n"));
2043 		return;
2044 	}
2045 
2046 	/* Restore noisefloor values to initial (max) values. */
2047 	for (i = 0; i < AR_MAX_CHAINS; i++)
2048 		nf[i] = nf_ext[i] = -50 * 2;
2049 	ar9003_write_noisefloor(sc, nf, nf_ext);
2050 }
2051 
2052 void
2053 ar9300_noisefloor_calib(struct athn_softc *sc)
2054 {
2055 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2056 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2057 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2058 }
2059 
2060 void
2061 ar9003_do_noisefloor_calib(struct athn_softc *sc)
2062 {
2063 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2064 }
2065 
2066 int
2067 ar9003_init_calib(struct athn_softc *sc)
2068 {
2069 	uint8_t txchainmask, rxchainmask;
2070 	uint32_t reg;
2071 	int ntries;
2072 
2073 	/* Save chains masks. */
2074 	txchainmask = sc->txchainmask;
2075 	rxchainmask = sc->rxchainmask;
2076 	/* Configure hardware before calibration. */
2077 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_CHAIN2_DISABLE)
2078 		txchainmask = rxchainmask = 0x3;
2079 	else
2080 		txchainmask = rxchainmask = 0x7;
2081 	ar9003_init_chains(sc);
2082 
2083 	/* Perform Tx IQ calibration. */
2084 	ar9003_calib_tx_iq(sc);
2085 	/* Disable and re-enable the PHY chips. */
2086 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
2087 	AR_WRITE_BARRIER(sc);
2088 	DELAY(5);
2089 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
2090 
2091 	/* Calibrate the AGC. */
2092 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
2093 	/* Poll for offset calibration completion. */
2094 	for (ntries = 0; ntries < 10000; ntries++) {
2095 		reg = AR_READ(sc, AR_PHY_AGC_CONTROL);
2096 		if (!(reg & AR_PHY_AGC_CONTROL_CAL))
2097 			break;
2098 		DELAY(10);
2099 	}
2100 	if (ntries == 10000)
2101 		return (ETIMEDOUT);
2102 
2103 	/* Restore chains masks. */
2104 	sc->txchainmask = txchainmask;
2105 	sc->rxchainmask = rxchainmask;
2106 	ar9003_init_chains(sc);
2107 
2108 	return (0);
2109 }
2110 
2111 void
2112 ar9003_do_calib(struct athn_softc *sc)
2113 {
2114 	uint32_t reg;
2115 
2116 	if (sc->cur_calib_mask & ATHN_CAL_IQ) {
2117 		reg = AR_READ(sc, AR_PHY_TIMING4);
2118 		reg = RW(reg, AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX, 10);
2119 		AR_WRITE(sc, AR_PHY_TIMING4, reg);
2120 		AR_WRITE(sc, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
2121 		AR_SETBITS(sc, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
2122 		AR_WRITE_BARRIER(sc);
2123 	} else if (sc->cur_calib_mask & ATHN_CAL_TEMP) {
2124 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2125 		    AR_PHY_65NM_CH0_THERM_LOCAL);
2126 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2127 		    AR_PHY_65NM_CH0_THERM_START);
2128 		AR_WRITE_BARRIER(sc);
2129 	}
2130 }
2131 
2132 void
2133 ar9003_next_calib(struct athn_softc *sc)
2134 {
2135 	/* Check if we have any calibration in progress. */
2136 	if (sc->cur_calib_mask != 0) {
2137 		if (!(AR_READ(sc, AR_PHY_TIMING4) & AR_PHY_TIMING4_DO_CAL)) {
2138 			/* Calibration completed for current sample. */
2139 			ar9003_calib_iq(sc);
2140 		}
2141 	}
2142 }
2143 
2144 void
2145 ar9003_calib_iq(struct athn_softc *sc)
2146 {
2147 	struct athn_iq_cal *cal;
2148 	uint32_t reg, i_coff_denom, q_coff_denom;
2149 	int32_t i_coff, q_coff;
2150 	int i, iq_corr_neg;
2151 
2152 	for (i = 0; i < AR_MAX_CHAINS; i++) {
2153 		cal = &sc->calib.iq[i];
2154 
2155 		/* Read IQ calibration measures (clear on read). */
2156 		cal->pwr_meas_i = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_0_B(i));
2157 		cal->pwr_meas_q = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_1_B(i));
2158 		cal->iq_corr_meas =
2159 		    (int32_t)AR_READ(sc, AR_PHY_IQ_ADC_MEAS_2_B(i));
2160 	}
2161 
2162 	for (i = 0; i < sc->nrxchains; i++) {
2163 		cal = &sc->calib.iq[i];
2164 
2165 		if (cal->pwr_meas_q == 0)
2166 			continue;
2167 
2168 		if ((iq_corr_neg = cal->iq_corr_meas < 0))
2169 			cal->iq_corr_meas = -cal->iq_corr_meas;
2170 
2171 		i_coff_denom =
2172 		    (cal->pwr_meas_i / 2 + cal->pwr_meas_q / 2) / 256;
2173 		q_coff_denom = cal->pwr_meas_q / 64;
2174 
2175 		if (i_coff_denom == 0 || q_coff_denom == 0)
2176 			continue;	/* Prevents division by zero. */
2177 
2178 		i_coff = cal->iq_corr_meas / i_coff_denom;
2179 		q_coff = (cal->pwr_meas_i / q_coff_denom) - 64;
2180 
2181 		if (i_coff > 63)
2182 			i_coff = 63;
2183 		else if (i_coff < -63)
2184 			i_coff = -63;
2185 		/* Negate i_coff if iq_corr_meas is positive. */
2186 		if (!iq_corr_neg)
2187 			i_coff = -i_coff;
2188 		if (q_coff > 63)
2189 			q_coff = 63;
2190 		else if (q_coff < -63)
2191 			q_coff = -63;
2192 
2193 		DPRINTFN(2, ("IQ calibration for chain %d\n", i));
2194 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2195 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF, i_coff);
2196 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF, q_coff);
2197 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2198 	}
2199 
2200 	/* Apply new settings. */
2201 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2202 	    AR_PHY_RX_IQCAL_CORR_IQCORR_ENABLE);
2203 	AR_WRITE_BARRIER(sc);
2204 
2205 	/* IQ calibration done. */
2206 	sc->cur_calib_mask &= ~ATHN_CAL_IQ;
2207 	memset(&sc->calib, 0, sizeof(sc->calib));
2208 }
2209 
2210 #define DELPT	32
2211 int
2212 ar9003_get_iq_corr(struct athn_softc *sc, int32_t res[6], int32_t coeff[2])
2213 {
2214 /* Sign-extends 12-bit value (assumes upper bits are zeroes). */
2215 #define SIGN_EXT(v)	(((v) ^ 0x800) - 0x800)
2216 #define SCALE		(1 << 15)
2217 #define SHIFT		(1 <<  8)
2218 	struct {
2219 		int32_t	m, p, c;
2220 	} val[2][2];
2221 	int32_t mag[2][2], phs[2][2], cos[2], sin[2];
2222 	int32_t min, max, div, f1, f2, f3, m, p, c;
2223 	int32_t txmag, txphs, rxmag, rxphs;
2224 	int32_t q_coff, i_coff;
2225 	int i, j;
2226 
2227 	/* Extract our twelve signed 12-bit values from res[] array. */
2228 	val[0][0].m = res[0] & 0xfff;
2229 	val[0][0].p = (res[0] >> 12) & 0xfff;
2230 	val[0][0].c = ((res[0] >> 24) & 0xff) | (res[1] & 0xf) << 8;
2231 
2232 	val[0][1].m = (res[1] >> 4) & 0xfff;
2233 	val[0][1].p = res[2] & 0xfff;
2234 	val[0][1].c = (res[2] >> 12) & 0xfff;
2235 
2236 	val[1][0].m = ((res[2] >> 24) & 0xff) | (res[3] & 0xf) << 8;
2237 	val[1][0].p = (res[3] >> 4) & 0xfff;
2238 	val[1][0].c = res[4] & 0xfff;
2239 
2240 	val[1][1].m = (res[4] >> 12) & 0xfff;
2241 	val[1][1].p = ((res[4] >> 24) & 0xff) | (res[5] & 0xf) << 8;
2242 	val[1][1].c = (res[5] >> 4) & 0xfff;
2243 
2244 	for (i = 0; i < 2; i++) {
2245 		for (j = 0; j < 2; j++) {
2246 			m = SIGN_EXT(val[i][j].m);
2247 			p = SIGN_EXT(val[i][j].p);
2248 			c = SIGN_EXT(val[i][j].c);
2249 
2250 			if (p == 0)
2251 				return (1);	/* Prevent division by 0. */
2252 
2253 			mag[i][j] = (m * SCALE) / p;
2254 			phs[i][j] = (c * SCALE) / p;
2255 		}
2256 		sin[i] = ((mag[i][0] - mag[i][1]) * SHIFT) / DELPT;
2257 		cos[i] = ((phs[i][0] - phs[i][1]) * SHIFT) / DELPT;
2258 		/* Find magnitude by approximation. */
2259 		min = MIN(abs(sin[i]), abs(cos[i]));
2260 		max = MAX(abs(sin[i]), abs(cos[i]));
2261 		div = max - (max / 32) + (min / 8) + (min / 4);
2262 		if (div == 0)
2263 			return (1);	/* Prevent division by 0. */
2264 		/* Normalize sin and cos by magnitude. */
2265 		sin[i] = (sin[i] * SCALE) / div;
2266 		cos[i] = (cos[i] * SCALE) / div;
2267 	}
2268 
2269 	/* Compute IQ mismatch (solve 4x4 linear equation). */
2270 	f1 = cos[0] - cos[1];
2271 	f3 = sin[0] - sin[1];
2272 	f2 = (f1 * f1 + f3 * f3) / SCALE;
2273 	if (f2 == 0)
2274 		return (1);	/* Prevent division by 0. */
2275 
2276 	/* Compute Tx magnitude mismatch. */
2277 	txmag = (f1 * ( mag[0][0] - mag[1][0]) +
2278 		 f3 * ( phs[0][0] - phs[1][0])) / f2;
2279 	/* Compute Tx phase mismatch. */
2280 	txphs = (f3 * (-mag[0][0] + mag[1][0]) +
2281 		 f1 * ( phs[0][0] - phs[1][0])) / f2;
2282 
2283 	if (txmag == SCALE)
2284 		return (1);	/* Prevent division by 0. */
2285 
2286 	/* Compute Rx magnitude mismatch. */
2287 	rxmag = mag[0][0] - (cos[0] * txmag + sin[0] * txphs) / SCALE;
2288 	/* Compute Rx phase mismatch. */
2289 	rxphs = phs[0][0] + (sin[0] * txmag - cos[0] * txphs) / SCALE;
2290 
2291 	if (-rxmag == SCALE)
2292 		return (1);	/* Prevent division by 0. */
2293 
2294 	txmag = (txmag * SCALE) / (SCALE - txmag);
2295 	txphs = -txphs;
2296 
2297 	q_coff = (txmag * 128) / SCALE;
2298 	if (q_coff < -63)
2299 		q_coff = -63;
2300 	else if (q_coff > 63)
2301 		q_coff = 63;
2302 	i_coff = (txphs * 256) / SCALE;
2303 	if (i_coff < -63)
2304 		i_coff = -63;
2305 	else if (i_coff > 63)
2306 		i_coff = 63;
2307 	coeff[0] = q_coff * 128 + i_coff;
2308 
2309 	rxmag = (-rxmag * SCALE) / (SCALE + rxmag);
2310 	rxphs = -rxphs;
2311 
2312 	q_coff = (rxmag * 128) / SCALE;
2313 	if (q_coff < -63)
2314 		q_coff = -63;
2315 	else if (q_coff > 63)
2316 		q_coff = 63;
2317 	i_coff = (rxphs * 256) / SCALE;
2318 	if (i_coff < -63)
2319 		i_coff = -63;
2320 	else if (i_coff > 63)
2321 		i_coff = 63;
2322 	coeff[1] = q_coff * 128 + i_coff;
2323 
2324 	return (0);
2325 #undef SHIFT
2326 #undef SCALE
2327 #undef SIGN_EXT
2328 }
2329 
2330 int
2331 ar9003_calib_tx_iq(struct athn_softc *sc)
2332 {
2333 	uint32_t reg;
2334 	int32_t res[6], coeff[2];
2335 	int i, j, ntries;
2336 
2337 	reg = AR_READ(sc, AR_PHY_TX_IQCAL_CONTROL_1);
2338 	reg = RW(reg, AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT, DELPT);
2339 	AR_WRITE(sc, AR_PHY_TX_IQCAL_CONTROL_1, reg);
2340 
2341 	/* Start Tx IQ calibration. */
2342 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_START, AR_PHY_TX_IQCAL_START_DO_CAL);
2343 	/* Wait for completion. */
2344 	for (ntries = 0; ntries < 10000; ntries++) {
2345 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_START);
2346 		if (!(reg & AR_PHY_TX_IQCAL_START_DO_CAL))
2347 			break;
2348 		DELAY(10);
2349 	}
2350 	if (ntries == 10000)
2351 		return (ETIMEDOUT);
2352 
2353 	for (i = 0; i < sc->ntxchains; i++) {
2354 		/* Read Tx IQ calibration status for this chain. */
2355 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_STATUS_B(i));
2356 		if (reg & AR_PHY_TX_IQCAL_STATUS_FAILED)
2357 			return (EIO);
2358 		/*
2359 		 * Read Tx IQ calibration results for this chain.
2360 		 * This consists in twelve signed 12-bit values.
2361 		 */
2362 		for (j = 0; j < 3; j++) {
2363 			AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2364 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2365 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2366 			res[j * 2 + 0] = reg;
2367 
2368 			AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2369 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2370 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2371 			res[j * 2 + 1] = reg & 0xffff;
2372 		}
2373 
2374 		/* Compute Tx IQ correction. */
2375 		if (ar9003_get_iq_corr(sc, res, coeff) != 0)
2376 			return (EIO);
2377 
2378 		/* Write Tx IQ correction coefficients. */
2379 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i));
2380 		reg = RW(reg, AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE,
2381 		    coeff[0]);
2382 		AR_WRITE(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i), reg);
2383 
2384 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2385 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_Q_COFF,
2386 		    coeff[1] >> 7);
2387 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_I_COFF,
2388 		    coeff[1]);
2389 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2390 		AR_WRITE_BARRIER(sc);
2391 	}
2392 
2393 	/* Enable Tx IQ correction. */
2394 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_CONTROL_3,
2395 	    AR_PHY_TX_IQCAL_CONTROL_3_IQCORR_EN);
2396 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2397 	    AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN);
2398 	AR_WRITE_BARRIER(sc);
2399 	return (0);
2400 }
2401 #undef DELPT
2402 
2403 /*-
2404  * The power amplifier predistortion state machine works as follows:
2405  * 1) Disable digital predistorters for all Tx chains
2406  * 2) Repeat steps 3~7 for all Tx chains
2407  * 3)   Force Tx gain to that of training signal
2408  * 4)   Send training signal (asynchronous)
2409  * 5)   Wait for training signal to complete (asynchronous)
2410  * 6)   Read PA measurements (input power, output power, output phase)
2411  * 7)   Compute the predistortion function that linearizes PA output
2412  * 8) Write predistortion functions to hardware tables for all Tx chains
2413  * 9) Enable digital predistorters for all Tx chains
2414  */
2415 void
2416 ar9003_paprd_calib(struct athn_softc *sc, struct ieee80211_channel *c)
2417 {
2418 	static const int scaling[] = {
2419 		261376, 248079, 233759, 220464,
2420 		208194, 196949, 185706, 175487
2421 	};
2422 	struct athn_ops *ops = &sc->ops;
2423 	uint32_t reg, ht20mask, ht40mask;
2424 	int i;
2425 
2426 	/* Read PA predistortion masks from ROM. */
2427 	ops->get_paprd_masks(sc, c, &ht20mask, &ht40mask);
2428 
2429 	/* AM-to-AM: amplifier's amplitude characteristic. */
2430 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2AM);
2431 	reg = RW(reg, AR_PHY_PAPRD_AM2AM_MASK, ht20mask);
2432 	AR_WRITE(sc, AR_PHY_PAPRD_AM2AM, reg);
2433 
2434 	/* AM-to-PM: amplifier's phase transfer characteristic. */
2435 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2PM);
2436 	reg = RW(reg, AR_PHY_PAPRD_AM2PM_MASK, ht20mask);
2437 	AR_WRITE(sc, AR_PHY_PAPRD_AM2PM, reg);
2438 
2439 	reg = AR_READ(sc, AR_PHY_PAPRD_HT40);
2440 	reg = RW(reg, AR_PHY_PAPRD_HT40_MASK, ht40mask);
2441 	AR_WRITE(sc, AR_PHY_PAPRD_HT40, reg);
2442 
2443 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2444 		AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2445 		    AR_PHY_PAPRD_CTRL0_USE_SINGLE_TABLE);
2446 
2447 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(i));
2448 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_PA_GAIN_SCALE_FACT, 181);
2449 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_MAG_SCALE_FACT, 361);
2450 		reg &= ~AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA;
2451 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2AM_ENA;
2452 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2PM_ENA;
2453 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(i), reg);
2454 
2455 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL0_B(i));
2456 		reg = RW(reg, AR_PHY_PAPRD_CTRL0_PAPRD_MAG_THRSH, 3);
2457 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL0_B(i), reg);
2458 	}
2459 
2460 	/* Disable all digital predistorters during calibration. */
2461 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2462 		AR_CLRBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2463 		    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2464 	}
2465 	AR_WRITE_BARRIER(sc);
2466 
2467 	/*
2468 	 * Configure training signal.
2469 	 */
2470 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL1);
2471 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_AGC2_SETTLING, 28);
2472 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_LB_SKIP, 0x30);
2473 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_RX_BB_GAIN_FORCE;
2474 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_IQCORR_ENABLE;
2475 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_LB_ENABLE;
2476 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TX_GAIN_FORCE;
2477 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TRAIN_ENABLE;
2478 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL1, reg);
2479 
2480 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL2, 147);
2481 
2482 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL3);
2483 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_FINE_CORR_LEN, 4);
2484 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_COARSE_CORR_LEN, 4);
2485 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_NUM_CORR_STAGES, 7);
2486 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_MIN_LOOPBACK_DEL, 1);
2487 	if (AR_SREV_9485(sc))
2488 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -3);
2489 	else
2490 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -6);
2491 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_ADC_DESIRED_SIZE, -15);
2492 	reg |= AR_PHY_PAPRD_TRAINER_CNTL3_BBTXMIX_DISABLE;
2493 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL3, reg);
2494 
2495 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL4);
2496 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_SAFETY_DELTA, 0);
2497 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_MIN_CORR, 400);
2498 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_NUM_TRAIN_SAMPLES, 100);
2499 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL4, reg);
2500 
2501 	for (i = 0; i < nitems(scaling); i++) {
2502 		reg = AR_READ(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i));
2503 		reg = RW(reg, AR_PHY_PAPRD_PRE_POST_SCALING, scaling[i]);
2504 		AR_WRITE(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i), reg);
2505 	}
2506 
2507 	/* Save Tx gain table. */
2508 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE; i++)
2509 		sc->txgain[i] = AR_READ(sc, AR_PHY_TXGAIN_TABLE(i));
2510 
2511 	/* Set Tx power of training signal (use setting for MCS0). */
2512 	sc->trainpow = MS(AR_READ(sc, AR_PHY_PWRTX_RATE5),
2513 	    AR_PHY_PWRTX_RATE5_POWERTXHT20_0) - 4;
2514 
2515 	/*
2516 	 * Start PA predistortion calibration state machine.
2517 	 */
2518 	/* Find first available Tx chain. */
2519 	sc->paprd_curchain = 0;
2520 	while (!(sc->txchainmask & (1 << sc->paprd_curchain)))
2521 		sc->paprd_curchain++;
2522 
2523 	/* Make sure training done bit is clear. */
2524 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2525 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2526 	AR_WRITE_BARRIER(sc);
2527 
2528 	/* Transmit training signal. */
2529 	ar9003_paprd_tx_tone(sc);
2530 }
2531 
2532 int
2533 ar9003_get_desired_txgain(struct athn_softc *sc, int chain, int pow)
2534 {
2535 	int32_t scale, atemp, avolt, tempcal, voltcal, temp, volt;
2536 	int32_t tempcorr, voltcorr;
2537 	uint32_t reg;
2538 	int8_t delta;
2539 
2540 	scale = MS(AR_READ(sc, AR_PHY_TPC_12),
2541 	    AR_PHY_TPC_12_DESIRED_SCALE_HT40_5);
2542 
2543 	reg = AR_READ(sc, AR_PHY_TPC_19);
2544 	atemp = MS(reg, AR_PHY_TPC_19_ALPHA_THERM);
2545 	avolt = MS(reg, AR_PHY_TPC_19_ALPHA_VOLT);
2546 
2547 	reg = AR_READ(sc, AR_PHY_TPC_18);
2548 	tempcal = MS(reg, AR_PHY_TPC_18_THERM_CAL);
2549 	voltcal = MS(reg, AR_PHY_TPC_18_VOLT_CAL);
2550 
2551 	reg = AR_READ(sc, AR_PHY_BB_THERM_ADC_4);
2552 	temp = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_THERM);
2553 	volt = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_VOLT);
2554 
2555 	delta = (int8_t)MS(AR_READ(sc, AR_PHY_TPC_11_B(chain)),
2556 	    AR_PHY_TPC_11_OLPC_GAIN_DELTA);
2557 
2558 	/* Compute temperature and voltage correction. */
2559 	tempcorr = (atemp * (temp - tempcal) + 128) / 256;
2560 	voltcorr = (avolt * (volt - voltcal) + 64) / 128;
2561 
2562 	/* Compute desired Tx gain. */
2563 	return (pow - delta - tempcorr - voltcorr + scale);
2564 }
2565 
2566 void
2567 ar9003_force_txgain(struct athn_softc *sc, uint32_t txgain)
2568 {
2569 	uint32_t reg;
2570 
2571 	reg = AR_READ(sc, AR_PHY_TX_FORCED_GAIN);
2572 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB1DBGAIN,
2573 	    MS(txgain, AR_PHY_TXGAIN_TXBB1DBGAIN));
2574 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB6DBGAIN,
2575 	    MS(txgain, AR_PHY_TXGAIN_TXBB6DBGAIN));
2576 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXMXRGAIN,
2577 	    MS(txgain, AR_PHY_TXGAIN_TXMXRGAIN));
2578 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNA,
2579 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNA));
2580 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNB,
2581 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNB));
2582 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNC,
2583 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNC));
2584 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGND,
2585 	    MS(txgain, AR_PHY_TXGAIN_PADRVGND));
2586 	reg &= ~AR_PHY_TX_FORCED_GAIN_ENABLE_PAL;
2587 	reg &= ~AR_PHY_TX_FORCED_GAIN_FORCE_TX_GAIN;
2588 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, reg);
2589 
2590 	reg = AR_READ(sc, AR_PHY_TPC_1);
2591 	reg = RW(reg, AR_PHY_TPC_1_FORCED_DAC_GAIN, 0);
2592 	reg &= ~AR_PHY_TPC_1_FORCE_DAC_GAIN;
2593 	AR_WRITE(sc, AR_PHY_TPC_1, reg);
2594 	AR_WRITE_BARRIER(sc);
2595 }
2596 
2597 void
2598 ar9003_set_training_gain(struct athn_softc *sc, int chain)
2599 {
2600 	int i, gain;
2601 
2602 	/*
2603 	 * Get desired gain for training signal power (take into account
2604 	 * current temperature/voltage).
2605 	 */
2606 	gain = ar9003_get_desired_txgain(sc, chain, sc->trainpow);
2607 	/* Find entry in table. */
2608 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE - 1; i++)
2609 		if (MS(sc->txgain[i], AR_PHY_TXGAIN_INDEX) >= gain)
2610 			break;
2611 	ar9003_force_txgain(sc, sc->txgain[i]);
2612 }
2613 
2614 int
2615 ar9003_paprd_tx_tone(struct athn_softc *sc)
2616 {
2617 #define TONE_LEN	1800
2618 	struct ieee80211com *ic = &sc->sc_ic;
2619 	struct ieee80211_frame *wh;
2620 	struct ieee80211_node *ni;
2621 	struct mbuf *m;
2622 	int error;
2623 
2624 	/* Build a Null (no data) frame of TONE_LEN bytes. */
2625 	m = MCLGETI(NULL, M_DONTWAIT, NULL, TONE_LEN);
2626 	if (m == NULL)
2627 		return (ENOBUFS);
2628 	memset(mtod(m, caddr_t), 0, TONE_LEN);
2629 	wh = mtod(m, struct ieee80211_frame *);
2630 	wh->i_fc[0] = IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA;
2631 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2632 	*(uint16_t *)wh->i_dur = htole16(10);	/* XXX */
2633 	IEEE80211_ADDR_COPY(wh->i_addr1, ic->ic_myaddr);
2634 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
2635 	IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_myaddr);
2636 	m->m_pkthdr.len = m->m_len = TONE_LEN;
2637 
2638 	/* Set gain of training signal. */
2639 	ar9003_set_training_gain(sc, sc->paprd_curchain);
2640 
2641 	/* Transmit training signal. */
2642 	ni = ieee80211_ref_node(ic->ic_bss);
2643 	if ((error = ar9003_tx(sc, m, ni, ATHN_TXFLAG_PAPRD)) != 0)
2644 		ieee80211_release_node(ic, ni);
2645 	return (error);
2646 #undef TONE_LEN
2647 }
2648 
2649 static __inline int
2650 get_scale(int val)
2651 {
2652 	int log = 0;
2653 
2654 	/* Find the log base 2 (position of highest bit set). */
2655 	while (val >>= 1)
2656 		log++;
2657 
2658 	return ((log > 10) ? log - 10 : 0);
2659 }
2660 
2661 /*
2662  * Compute predistortion function to linearize power amplifier output based
2663  * on feedback from training signal.
2664  */
2665 int
2666 ar9003_compute_predistortion(struct athn_softc *sc, const uint32_t *lo,
2667     const uint32_t *hi)
2668 {
2669 #define NBINS	23
2670 	int chain = sc->paprd_curchain;
2671 	int x[NBINS + 1], y[NBINS + 1], t[NBINS + 1];
2672 	int b1[NBINS + 1], b2[NBINS + 1], xtilde[NBINS + 1];
2673 	int nsamples, txsum, rxsum, rosum, maxidx;
2674 	int order, order5x, order5xrem, order3x, order3xrem, y5, y3;
2675 	int icept, G, I, L, M, angle, xnonlin, y2, y4, sumy2, sumy4;
2676 	int alpha, beta, scale, Qalpha, Qbeta, Qscale, Qx, Qb1, Qb2;
2677 	int tavg, ttilde, maxb1abs, maxb2abs, maxxtildeabs, in;
2678 	int tmp, i;
2679 
2680 	/* Set values at origin. */
2681 	x[0] = y[0] = t[0] = 0;
2682 
2683 #define SCALE	32
2684 	maxidx = 0;
2685 	for (i = 0; i < NBINS; i++) {
2686 		nsamples = lo[i] & 0xffff;
2687 		/* Skip bins that contain 16 or less samples. */
2688 		if (nsamples <= 16) {
2689 			x[i + 1] = y[i + 1] = t[i + 1] = 0;
2690 			continue;
2691 		}
2692 		txsum = (hi[i] & 0x7ff) << 16 | lo[i] >> 16;
2693 		rxsum = (lo[i + NBINS] & 0xffff) << 5 |
2694 		    ((hi[i] >> 11) & 0x1f);
2695 		rosum = (hi[i + NBINS] & 0x7ff) << 16 | hi[i + NBINS] >> 16;
2696 		/* Sign-extend 27-bit value. */
2697 		rosum = (rosum ^ 0x4000000) - 0x4000000;
2698 
2699 		txsum *= SCALE;
2700 		rxsum *= SCALE;
2701 		rosum *= SCALE;
2702 
2703 		x[i + 1] = ((txsum + nsamples) / nsamples + SCALE) / SCALE;
2704 		y[i + 1] = ((rxsum + nsamples) / nsamples + SCALE) / SCALE +
2705 		    SCALE * maxidx + SCALE / 2;
2706 		t[i + 1] = (rosum + nsamples) / nsamples;
2707 		maxidx++;
2708 	}
2709 #undef SCALE
2710 
2711 #define SCALE_LOG	8
2712 #define SCALE		(1 << SCALE_LOG)
2713 	if (x[6] == x[3])
2714 		return (1);	/* Prevent division by 0. */
2715 	G = ((y[6] - y[3]) * SCALE + (x[6] - x[3])) / (x[6] - x[3]);
2716 	if (G == 0)
2717 		return (1);	/* Prevent division by 0. */
2718 
2719 	sc->gain1[chain] = G;	/* Save low signal gain. */
2720 
2721 	/* Find interception point. */
2722 	icept = (G * (x[0] - x[3]) + SCALE) / SCALE + y[3];
2723 	for (i = 0; i <= 3; i++) {
2724 		y[i] = i * 32;
2725 		x[i] = (y[i] * SCALE + G) / G;
2726 	}
2727 	for (i = 4; i <= maxidx; i++)
2728 		y[i] -= icept;
2729 
2730 	xnonlin = x[maxidx] - (y[maxidx] * SCALE + G) / G;
2731 	order = (xnonlin + y[maxidx]) / y[maxidx];
2732 	if (order == 0)
2733 		M = 10;
2734 	else if (order == 1)
2735 		M = 9;
2736 	else
2737 		M = 8;
2738 
2739 	I = (maxidx >= 16) ? 7 : maxidx / 2;
2740 	L = maxidx - I;
2741 
2742 	sumy2 = sumy4 = y2 = y4 = 0;
2743 	for (i = 0; i <= L; i++) {
2744 		if (y[i + I] == 0)
2745 			return (1);	/* Prevent division by 0. */
2746 
2747 		xnonlin = x[i + I] - ((y[i + I] * SCALE) + G) / G;
2748 		xtilde[i] = ((xnonlin << M) + y[i + I]) / y[i + I];
2749 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2750 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2751 
2752 		y2 = (y[i + I] * y[i + I] + SCALE * SCALE) / (SCALE * SCALE);
2753 
2754 		sumy2 += y2;
2755 		sumy4 += y2 * y2;
2756 
2757 		b1[i] = y2 * (L + 1);
2758 		b2[i] = y2;
2759 	}
2760 	for (i = 0; i <= L; i++) {
2761 		b1[i] -= sumy2;
2762 		b2[i] = sumy4 - sumy2 * b2[i];
2763 	}
2764 
2765 	maxxtildeabs = maxb1abs = maxb2abs = 0;
2766 	for (i = 0; i <= L; i++) {
2767 		tmp = abs(xtilde[i]);
2768 		if (tmp > maxxtildeabs)
2769 			maxxtildeabs = tmp;
2770 
2771 		tmp = abs(b1[i]);
2772 		if (tmp > maxb1abs)
2773 			maxb1abs = tmp;
2774 
2775 		tmp = abs(b2[i]);
2776 		if (tmp > maxb2abs)
2777 			maxb2abs = tmp;
2778 	}
2779 	Qx  = get_scale(maxxtildeabs);
2780 	Qb1 = get_scale(maxb1abs);
2781 	Qb2 = get_scale(maxb2abs);
2782 	for (i = 0; i <= L; i++) {
2783 		xtilde[i] /= 1 << Qx;
2784 		b1[i] /= 1 << Qb1;
2785 		b2[i] /= 1 << Qb2;
2786 	}
2787 
2788 	alpha = beta = 0;
2789 	for (i = 0; i <= L; i++) {
2790 		alpha += b1[i] * xtilde[i];
2791 		beta  += b2[i] * xtilde[i];
2792 	}
2793 
2794 	scale = ((y4 / SCALE_LOG) * (L + 1) -
2795 		 (y2 / SCALE_LOG) * sumy2) * SCALE_LOG;
2796 
2797 	Qscale = get_scale(abs(scale));
2798 	scale /= 1 << Qscale;
2799 	Qalpha = get_scale(abs(alpha));
2800 	alpha /= 1 << Qalpha;
2801 	Qbeta  = get_scale(abs(beta));
2802 	beta  /= 1 << Qbeta;
2803 
2804 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale;
2805 	order5x = 1 << (order / 5);
2806 	order5xrem = 1 << (order % 5);
2807 
2808 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale;
2809 	order3x = 1 << (order / 3);
2810 	order3xrem = 1 << (order % 3);
2811 
2812 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2813 		tmp = i * 32;
2814 
2815 		/* Fifth order. */
2816 		y5 = ((beta * tmp) / 64) / order5x;
2817 		y5 = (y5 * tmp) / order5x;
2818 		y5 = (y5 * tmp) / order5x;
2819 		y5 = (y5 * tmp) / order5x;
2820 		y5 = (y5 * tmp) / order5x;
2821 		y5 = y5 / order5xrem;
2822 
2823 		/* Third oder. */
2824 		y3 = (alpha * tmp) / order3x;
2825 		y3 = (y3 * tmp) / order3x;
2826 		y3 = (y3 * tmp) / order3x;
2827 		y3 = y3 / order3xrem;
2828 
2829 		in = y5 + y3 + (SCALE * tmp) / G;
2830 		if (i >= 2 && in < sc->pa_in[chain][i - 1]) {
2831 			in = sc->pa_in[chain][i - 1] +
2832 			    (sc->pa_in[chain][i - 1] -
2833 			     sc->pa_in[chain][i - 2]);
2834 		}
2835 		if (in > 1400)
2836 			in = 1400;
2837 		sc->pa_in[chain][i] = in;
2838 	}
2839 
2840 	/* Compute average theta of first 5 bins (linear region). */
2841 	tavg = 0;
2842 	for (i = 1; i <= 5; i++)
2843 		tavg += t[i];
2844 	tavg /= 5;
2845 	for (i = 1; i <= 5; i++)
2846 		t[i] = 0;
2847 	for (i = 6; i <= maxidx; i++)
2848 		t[i] -= tavg;
2849 
2850 	alpha = beta = 0;
2851 	for (i = 0; i <= L; i++) {
2852 		ttilde = ((t[i + I] << M) + y[i + I]) / y[i + I];
2853 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2854 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2855 
2856 		alpha += b2[i] * ttilde;
2857 		beta  += b1[i] * ttilde;
2858 	}
2859 
2860 	Qalpha = get_scale(abs(alpha));
2861 	alpha /= 1 << Qalpha;
2862 	Qbeta  = get_scale(abs(beta));
2863 	beta  /= 1 << Qbeta;
2864 
2865 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale + 5;
2866 	order5x = 1 << (order / 5);
2867 	order5xrem = 1 << (order % 5);
2868 
2869 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale + 5;
2870 	order3x = 1 << (order / 3);
2871 	order3xrem = 1 << (order % 3);
2872 
2873 	for (i = 0; i <= 4; i++)
2874 		sc->angle[chain][i] = 0;	/* Linear at that range. */
2875 	for (i = 5; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2876 		tmp = i * 32;
2877 
2878 		/* Fifth order. */
2879 		if (beta > 0)
2880 			y5 = (((beta * tmp - 64) / 64) - order5x) / order5x;
2881 		else
2882 			y5 = (((beta * tmp - 64) / 64) + order5x) / order5x;
2883 		y5 = (y5 * tmp) / order5x;
2884 		y5 = (y5 * tmp) / order5x;
2885 		y5 = (y5 * tmp) / order5x;
2886 		y5 = (y5 * tmp) / order5x;
2887 		y5 = y5 / order5xrem;
2888 
2889 		/* Third oder. */
2890 		if (beta > 0)	/* XXX alpha? */
2891 			y3 = (alpha * tmp - order3x) / order3x;
2892 		else
2893 			y3 = (alpha * tmp + order3x) / order3x;
2894 		y3 = (y3 * tmp) / order3x;
2895 		y3 = (y3 * tmp) / order3x;
2896 		y3 = y3 / order3xrem;
2897 
2898 		angle = y5 + y3;
2899 		if (angle < -150)
2900 			angle = -150;
2901 		else if (angle > 150)
2902 			angle = 150;
2903 		sc->angle[chain][i] = angle;
2904 	}
2905 	/* Angle for entry 4 is derived from angle for entry 5. */
2906 	sc->angle[chain][4] = (sc->angle[chain][5] + 2) / 2;
2907 
2908 	return (0);
2909 #undef SCALE
2910 #undef SCALE_LOG
2911 #undef NBINS
2912 }
2913 
2914 void
2915 ar9003_enable_predistorter(struct athn_softc *sc, int chain)
2916 {
2917 	uint32_t reg;
2918 	int i;
2919 
2920 	/* Write digital predistorter lookup table. */
2921 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2922 		AR_WRITE(sc, AR_PHY_PAPRD_MEM_TAB_B(chain, i),
2923 		    SM(AR_PHY_PAPRD_PA_IN, sc->pa_in[chain][i]) |
2924 		    SM(AR_PHY_PAPRD_ANGLE, sc->angle[chain][i]));
2925 	}
2926 
2927 	reg = AR_READ(sc, AR_PHY_PA_GAIN123_B(chain));
2928 	reg = RW(reg, AR_PHY_PA_GAIN123_PA_GAIN1, sc->gain1[chain]);
2929 	AR_WRITE(sc, AR_PHY_PA_GAIN123_B(chain), reg);
2930 
2931 	/* Indicate Tx power used for calibration (training signal). */
2932 	reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(chain));
2933 	reg = RW(reg, AR_PHY_PAPRD_CTRL1_POWER_AT_AM2AM_CAL, sc->trainpow);
2934 	AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(chain), reg);
2935 
2936 	/* Enable digital predistorter for this chain. */
2937 	AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(chain),
2938 	    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2939 	AR_WRITE_BARRIER(sc);
2940 }
2941 
2942 void
2943 ar9003_paprd_enable(struct athn_softc *sc)
2944 {
2945 	int i;
2946 
2947 	/* Enable digital predistorters for all Tx chains. */
2948 	for (i = 0; i < AR9003_MAX_CHAINS; i++)
2949 		if (sc->txchainmask & (1 << i))
2950 			ar9003_enable_predistorter(sc, i);
2951 }
2952 
2953 /*
2954  * This function is called when our training signal has been sent.
2955  */
2956 void
2957 ar9003_paprd_tx_tone_done(struct athn_softc *sc)
2958 {
2959 	uint32_t lo[48], hi[48];
2960 	int i;
2961 
2962 	/* Make sure training is complete. */
2963 	if (!(AR_READ(sc, AR_PHY_PAPRD_TRAINER_STAT1) &
2964 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE))
2965 		return;
2966 
2967 	/* Read feedback from training signal. */
2968 	AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2969 	for (i = 0; i < nitems(lo); i++)
2970 		lo[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2971 	AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2972 	for (i = 0; i < nitems(hi); i++)
2973 		hi[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2974 
2975 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2976 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2977 
2978 	/* Compute predistortion function based on this feedback. */
2979 	if (ar9003_compute_predistortion(sc, lo, hi) != 0)
2980 		return;
2981 
2982 	/* Get next available Tx chain. */
2983 	while (++sc->paprd_curchain < AR9003_MAX_CHAINS)
2984 		if (sc->txchainmask & (1 << sc->paprd_curchain))
2985 			break;
2986 	if (sc->paprd_curchain == AR9003_MAX_CHAINS) {
2987 		/* All Tx chains measured; enable digital predistortion. */
2988 		ar9003_paprd_enable(sc);
2989 	} else	/* Measure next Tx chain. */
2990 		ar9003_paprd_tx_tone(sc);
2991 }
2992 
2993 void
2994 ar9003_write_txpower(struct athn_softc *sc, int16_t power[ATHN_POWER_COUNT])
2995 {
2996 	/* Make sure forced gain is disabled. */
2997 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, 0);
2998 
2999 	AR_WRITE(sc, AR_PHY_PWRTX_RATE1,
3000 	    (power[ATHN_POWER_OFDM18  ] & 0x3f) << 24 |
3001 	    (power[ATHN_POWER_OFDM12  ] & 0x3f) << 16 |
3002 	    (power[ATHN_POWER_OFDM9   ] & 0x3f) <<  8 |
3003 	    (power[ATHN_POWER_OFDM6   ] & 0x3f));
3004 	AR_WRITE(sc, AR_PHY_PWRTX_RATE2,
3005 	    (power[ATHN_POWER_OFDM54  ] & 0x3f) << 24 |
3006 	    (power[ATHN_POWER_OFDM48  ] & 0x3f) << 16 |
3007 	    (power[ATHN_POWER_OFDM36  ] & 0x3f) <<  8 |
3008 	    (power[ATHN_POWER_OFDM24  ] & 0x3f));
3009 	AR_WRITE(sc, AR_PHY_PWRTX_RATE3,
3010 	    (power[ATHN_POWER_CCK2_SP ] & 0x3f) << 24 |
3011 	    (power[ATHN_POWER_CCK2_LP ] & 0x3f) << 16 |
3012 	    /* NB: No eXtended Range for AR9003. */
3013 	    (power[ATHN_POWER_CCK1_LP ] & 0x3f));
3014 	AR_WRITE(sc, AR_PHY_PWRTX_RATE4,
3015 	    (power[ATHN_POWER_CCK11_SP] & 0x3f) << 24 |
3016 	    (power[ATHN_POWER_CCK11_LP] & 0x3f) << 16 |
3017 	    (power[ATHN_POWER_CCK55_SP] & 0x3f) <<  8 |
3018 	    (power[ATHN_POWER_CCK55_LP] & 0x3f));
3019 	/*
3020 	 * NB: AR_PHY_PWRTX_RATE5 needs to be written even if HT is disabled
3021 	 * because it is read by PA predistortion functions.
3022 	 */
3023 	AR_WRITE(sc, AR_PHY_PWRTX_RATE5,
3024 	    (power[ATHN_POWER_HT20( 5)] & 0x3f) << 24 |
3025 	    (power[ATHN_POWER_HT20( 4)] & 0x3f) << 16 |
3026 	    (power[ATHN_POWER_HT20( 1)] & 0x3f) <<  8 |
3027 	    (power[ATHN_POWER_HT20( 0)] & 0x3f));
3028 	AR_WRITE(sc, AR_PHY_PWRTX_RATE6,
3029 	    (power[ATHN_POWER_HT20(13)] & 0x3f) << 24 |
3030 	    (power[ATHN_POWER_HT20(12)] & 0x3f) << 16 |
3031 	    (power[ATHN_POWER_HT20( 7)] & 0x3f) <<  8 |
3032 	    (power[ATHN_POWER_HT20( 6)] & 0x3f));
3033 	AR_WRITE(sc, AR_PHY_PWRTX_RATE7,
3034 	    (power[ATHN_POWER_HT40( 5)] & 0x3f) << 24 |
3035 	    (power[ATHN_POWER_HT40( 4)] & 0x3f) << 16 |
3036 	    (power[ATHN_POWER_HT40( 1)] & 0x3f) <<  8 |
3037 	    (power[ATHN_POWER_HT40( 0)] & 0x3f));
3038 	AR_WRITE(sc, AR_PHY_PWRTX_RATE8,
3039 	    (power[ATHN_POWER_HT40(13)] & 0x3f) << 24 |
3040 	    (power[ATHN_POWER_HT40(12)] & 0x3f) << 16 |
3041 	    (power[ATHN_POWER_HT40( 7)] & 0x3f) <<  8 |
3042 	    (power[ATHN_POWER_HT40( 6)] & 0x3f));
3043 	AR_WRITE(sc, AR_PHY_PWRTX_RATE10,
3044 	    (power[ATHN_POWER_HT20(21)] & 0x3f) << 24 |
3045 	    (power[ATHN_POWER_HT20(20)] & 0x3f) << 16 |
3046 	    (power[ATHN_POWER_HT20(15)] & 0x3f) <<  8 |
3047 	    (power[ATHN_POWER_HT20(14)] & 0x3f));
3048 	AR_WRITE(sc, AR_PHY_PWRTX_RATE11,
3049 	    (power[ATHN_POWER_HT40(23)] & 0x3f) << 24 |
3050 	    (power[ATHN_POWER_HT40(22)] & 0x3f) << 16 |
3051 	    (power[ATHN_POWER_HT20(23)] & 0x3f) <<  8 |
3052 	    (power[ATHN_POWER_HT20(22)] & 0x3f));
3053 	AR_WRITE(sc, AR_PHY_PWRTX_RATE12,
3054 	    (power[ATHN_POWER_HT40(21)] & 0x3f) << 24 |
3055 	    (power[ATHN_POWER_HT40(20)] & 0x3f) << 16 |
3056 	    (power[ATHN_POWER_HT40(15)] & 0x3f) <<  8 |
3057 	    (power[ATHN_POWER_HT40(14)] & 0x3f));
3058 	AR_WRITE_BARRIER(sc);
3059 }
3060 
3061 void
3062 ar9003_reset_rx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3063 {
3064 #define X(x)	((uint32_t)(x) << 2)
3065 	const struct athn_gain *prog = sc->rx_gain;
3066 	const uint32_t *pvals;
3067 	int i;
3068 
3069 	if (IEEE80211_IS_CHAN_2GHZ(c))
3070 		pvals = prog->vals_2g;
3071 	else
3072 		pvals = prog->vals_5g;
3073 	for (i = 0; i < prog->nregs; i++)
3074 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3075 	AR_WRITE_BARRIER(sc);
3076 #undef X
3077 }
3078 
3079 void
3080 ar9003_reset_tx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3081 {
3082 #define X(x)	((uint32_t)(x) << 2)
3083 	const struct athn_gain *prog = sc->tx_gain;
3084 	const uint32_t *pvals;
3085 	int i;
3086 
3087 	if (IEEE80211_IS_CHAN_2GHZ(c))
3088 		pvals = prog->vals_2g;
3089 	else
3090 		pvals = prog->vals_5g;
3091 	for (i = 0; i < prog->nregs; i++)
3092 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3093 	AR_WRITE_BARRIER(sc);
3094 #undef X
3095 }
3096 
3097 void
3098 ar9003_hw_init(struct athn_softc *sc, struct ieee80211_channel *c,
3099     struct ieee80211_channel *extc)
3100 {
3101 #define X(x)	((uint32_t)(x) << 2)
3102 	struct athn_ops *ops = &sc->ops;
3103 	const struct athn_ini *ini = sc->ini;
3104 	const uint32_t *pvals;
3105 	uint32_t reg;
3106 	int i;
3107 
3108 	/*
3109 	 * The common init values include the pre and core phases for the
3110 	 * SoC, MAC, BB and Radio subsystems.
3111 	 */
3112 	DPRINTFN(4, ("writing pre and core init vals\n"));
3113 	for (i = 0; i < ini->ncmregs; i++) {
3114 		AR_WRITE(sc, X(ini->cmregs[i]), ini->cmvals[i]);
3115 		if (AR_IS_ANALOG_REG(X(ini->cmregs[i])))
3116 			DELAY(100);
3117 		if ((i & 0x1f) == 0)
3118 			DELAY(1);
3119 	}
3120 
3121 	/*
3122 	 * The modal init values include the post phase for the SoC, MAC,
3123 	 * BB and Radio subsystems.
3124 	 */
3125 	if (extc != NULL) {
3126 		if (IEEE80211_IS_CHAN_2GHZ(c))
3127 			pvals = ini->vals_2g40;
3128 		else
3129 			pvals = ini->vals_5g40;
3130 	} else {
3131 		if (IEEE80211_IS_CHAN_2GHZ(c))
3132 			pvals = ini->vals_2g20;
3133 		else
3134 			pvals = ini->vals_5g20;
3135 	}
3136 	DPRINTFN(4, ("writing post init vals\n"));
3137 	for (i = 0; i < ini->nregs; i++) {
3138 		AR_WRITE(sc, X(ini->regs[i]), pvals[i]);
3139 		if (AR_IS_ANALOG_REG(X(ini->regs[i])))
3140 			DELAY(100);
3141 		if ((i & 0x1f) == 0)
3142 			DELAY(1);
3143 	}
3144 
3145 	if (sc->rx_gain != NULL)
3146 		ar9003_reset_rx_gain(sc, c);
3147 	if (sc->tx_gain != NULL)
3148 		ar9003_reset_tx_gain(sc, c);
3149 
3150 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
3151 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
3152 		/* Update modal values for fast PLL clock. */
3153 		if (extc != NULL)
3154 			pvals = ini->fastvals_5g40;
3155 		else
3156 			pvals = ini->fastvals_5g20;
3157 		DPRINTFN(4, ("writing fast pll clock init vals\n"));
3158 		for (i = 0; i < ini->nfastregs; i++) {
3159 			AR_WRITE(sc, X(ini->fastregs[i]), pvals[i]);
3160 			if (AR_IS_ANALOG_REG(X(ini->fastregs[i])))
3161 				DELAY(100);
3162 			if ((i & 0x1f) == 0)
3163 				DELAY(1);
3164 		}
3165 	}
3166 
3167 	/*
3168 	 * Set the RX_ABORT and RX_DIS bits to prevent frames with corrupted
3169 	 * descriptor status.
3170 	 */
3171 	AR_SETBITS(sc, AR_DIAG_SW, AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT);
3172 
3173 	reg = AR_READ(sc, AR_PCU_MISC_MODE2);
3174 	reg &= ~AR_PCU_MISC_MODE2_ADHOC_MCAST_KEYID_ENABLE;
3175 	reg |= AR_PCU_MISC_MODE2_AGG_WEP_ENABLE_FIX;
3176 	reg |= AR_PCU_MISC_MODE2_ENABLE_AGGWEP;
3177 	AR_WRITE(sc, AR_PCU_MISC_MODE2, reg);
3178 	AR_WRITE_BARRIER(sc);
3179 
3180 	ar9003_set_phy(sc, c, extc);
3181 	ar9003_init_chains(sc);
3182 
3183 	ops->set_txpower(sc, c, extc);
3184 #undef X
3185 }
3186 
3187 void
3188 ar9003_get_lg_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3189     uint8_t ctl, const uint8_t *fbins,
3190     const struct ar_cal_target_power_leg *tgt, int nchans, uint8_t tpow[4])
3191 {
3192 	uint8_t fbin;
3193 	int i, delta, lo, hi;
3194 
3195 	lo = hi = -1;
3196 	fbin = athn_chan2fbin(c);
3197 	for (i = 0; i < nchans; i++) {
3198 		delta = fbin - fbins[i];
3199 		/* Find the largest sample that is <= our frequency. */
3200 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3201 			lo = i;
3202 		/* Find the smallest sample that is >= our frequency. */
3203 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3204 			hi = i;
3205 	}
3206 	if (lo == -1)
3207 		lo = hi;
3208 	else if (hi == -1)
3209 		hi = lo;
3210 	/* Interpolate values. */
3211 	for (i = 0; i < 4; i++) {
3212 		tpow[i] = athn_interpolate(fbin,
3213 		    fbins[lo], tgt[lo].tPow2x[i],
3214 		    fbins[hi], tgt[hi].tPow2x[i]);
3215 	}
3216 	/* XXX Apply conformance test limit. */
3217 }
3218 
3219 void
3220 ar9003_get_ht_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3221     uint8_t ctl, const uint8_t *fbins,
3222     const struct ar_cal_target_power_ht *tgt, int nchans, uint8_t tpow[14])
3223 {
3224 	uint8_t fbin;
3225 	int i, delta, lo, hi;
3226 
3227 	lo = hi = -1;
3228 	fbin = athn_chan2fbin(c);
3229 	for (i = 0; i < nchans; i++) {
3230 		delta = fbin - fbins[i];
3231 		/* Find the largest sample that is <= our frequency. */
3232 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3233 			lo = i;
3234 		/* Find the smallest sample that is >= our frequency. */
3235 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3236 			hi = i;
3237 	}
3238 	if (lo == -1)
3239 		lo = hi;
3240 	else if (hi == -1)
3241 		hi = lo;
3242 	/* Interpolate values. */
3243 	for (i = 0; i < 14; i++) {
3244 		tpow[i] = athn_interpolate(fbin,
3245 		    fbins[lo], tgt[lo].tPow2x[i],
3246 		    fbins[hi], tgt[hi].tPow2x[i]);
3247 	}
3248 	/* XXX Apply conformance test limit. */
3249 }
3250 
3251 /*
3252  * Adaptive noise immunity.
3253  */
3254 void
3255 ar9003_set_noise_immunity_level(struct athn_softc *sc, int level)
3256 {
3257 	int high = level == 4;
3258 	uint32_t reg;
3259 
3260 	reg = AR_READ(sc, AR_PHY_DESIRED_SZ);
3261 	reg = RW(reg, AR_PHY_DESIRED_SZ_TOT_DES, high ? -62 : -55);
3262 	AR_WRITE(sc, AR_PHY_DESIRED_SZ, reg);
3263 
3264 	reg = AR_READ(sc, AR_PHY_AGC);
3265 	reg = RW(reg, AR_PHY_AGC_COARSE_LOW, high ? -70 : -64);
3266 	reg = RW(reg, AR_PHY_AGC_COARSE_HIGH, high ? -12 : -14);
3267 	AR_WRITE(sc, AR_PHY_AGC, reg);
3268 
3269 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3270 	reg = RW(reg, AR_PHY_FIND_SIG_FIRPWR, high ? -80 : -78);
3271 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3272 	AR_WRITE_BARRIER(sc);
3273 }
3274 
3275 void
3276 ar9003_enable_ofdm_weak_signal(struct athn_softc *sc)
3277 {
3278 	uint32_t reg;
3279 
3280 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3281 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 50);
3282 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 40);
3283 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 48);
3284 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3285 
3286 	reg = AR_READ(sc, AR_PHY_SFCORR);
3287 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 77);
3288 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 64);
3289 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 16);
3290 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3291 
3292 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3293 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 50);
3294 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 40);
3295 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 77);
3296 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 64);
3297 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3298 
3299 	AR_SETBITS(sc, AR_PHY_SFCORR_LOW,
3300 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3301 	AR_WRITE_BARRIER(sc);
3302 }
3303 
3304 void
3305 ar9003_disable_ofdm_weak_signal(struct athn_softc *sc)
3306 {
3307 	uint32_t reg;
3308 
3309 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3310 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 127);
3311 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 127);
3312 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 63);
3313 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3314 
3315 	reg = AR_READ(sc, AR_PHY_SFCORR);
3316 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 127);
3317 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 127);
3318 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 31);
3319 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3320 
3321 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3322 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 127);
3323 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 127);
3324 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 127);
3325 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 127);
3326 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3327 
3328 	AR_CLRBITS(sc, AR_PHY_SFCORR_LOW,
3329 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3330 	AR_WRITE_BARRIER(sc);
3331 }
3332 
3333 void
3334 ar9003_set_cck_weak_signal(struct athn_softc *sc, int high)
3335 {
3336 	uint32_t reg;
3337 
3338 	reg = AR_READ(sc, AR_PHY_CCK_DETECT);
3339 	reg = RW(reg, AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK, high ? 6 : 8);
3340 	AR_WRITE(sc, AR_PHY_CCK_DETECT, reg);
3341 	AR_WRITE_BARRIER(sc);
3342 }
3343 
3344 void
3345 ar9003_set_firstep_level(struct athn_softc *sc, int level)
3346 {
3347 	uint32_t reg;
3348 
3349 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3350 	reg = RW(reg, AR_PHY_FIND_SIG_FIRSTEP, level * 4);
3351 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3352 	AR_WRITE_BARRIER(sc);
3353 }
3354 
3355 void
3356 ar9003_set_spur_immunity_level(struct athn_softc *sc, int level)
3357 {
3358 	uint32_t reg;
3359 
3360 	reg = AR_READ(sc, AR_PHY_TIMING5);
3361 	reg = RW(reg, AR_PHY_TIMING5_CYCPWR_THR1, (level + 1) * 2);
3362 	AR_WRITE(sc, AR_PHY_TIMING5, reg);
3363 	AR_WRITE_BARRIER(sc);
3364 }
3365