xref: /freebsd/sys/dev/bwi/bwirf.c (revision 7cc42f6d)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
5  *
6  * This code is derived from software contributed to The DragonFly Project
7  * by Sepherosa Ziehau <sepherosa@gmail.com>
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  * 3. Neither the name of The DragonFly Project nor the names of its
20  *    contributors may be used to endorse or promote products derived
21  *    from this software without specific, prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
26  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
27  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
28  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
29  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
30  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
31  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
32  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
33  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  * $DragonFly: src/sys/dev/netif/bwi/bwirf.c,v 1.9 2008/08/21 12:19:33 swildner Exp $
37  */
38 
39 #include <sys/cdefs.h>
40 __FBSDID("$FreeBSD$");
41 
42 #include "opt_inet.h"
43 #include "opt_bwi.h"
44 #include "opt_wlan.h"
45 
46 #include <sys/param.h>
47 #include <sys/endian.h>
48 #include <sys/kernel.h>
49 #include <sys/bus.h>
50 #include <sys/malloc.h>
51 #include <sys/proc.h>
52 #include <sys/rman.h>
53 #include <sys/socket.h>
54 #include <sys/sockio.h>
55 #include <sys/sysctl.h>
56 #include <sys/systm.h>
57 
58 #include <net/if.h>
59 #include <net/if_var.h>
60 #include <net/if_dl.h>
61 #include <net/if_media.h>
62 #include <net/if_types.h>
63 #include <net/if_arp.h>
64 #include <net/ethernet.h>
65 #include <net/if_llc.h>
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_radiotap.h>
69 #include <net80211/ieee80211_amrr.h>
70 
71 #include <machine/bus.h>
72 
73 #include <dev/bwi/bitops.h>
74 #include <dev/bwi/if_bwireg.h>
75 #include <dev/bwi/if_bwivar.h>
76 #include <dev/bwi/bwimac.h>
77 #include <dev/bwi/bwirf.h>
78 #include <dev/bwi/bwiphy.h>
79 
80 #define RF_LO_WRITE(mac, lo)	bwi_rf_lo_write((mac), (lo))
81 
82 #define BWI_RF_2GHZ_CHAN(chan)			\
83 	(ieee80211_ieee2mhz((chan), IEEE80211_CHAN_2GHZ) - 2400)
84 
85 #define BWI_DEFAULT_IDLE_TSSI	52
86 
87 struct rf_saveregs {
88 	uint16_t	phy_01;
89 	uint16_t	phy_03;
90 	uint16_t	phy_0a;
91 	uint16_t	phy_15;
92 	uint16_t	phy_2a;
93 	uint16_t	phy_30;
94 	uint16_t	phy_35;
95 	uint16_t	phy_60;
96 	uint16_t	phy_429;
97 	uint16_t	phy_802;
98 	uint16_t	phy_811;
99 	uint16_t	phy_812;
100 	uint16_t	phy_814;
101 	uint16_t	phy_815;
102 
103 	uint16_t	rf_43;
104 	uint16_t	rf_52;
105 	uint16_t	rf_7a;
106 };
107 
108 #define SAVE_RF_REG(mac, regs, n)	(regs)->rf_##n = RF_READ((mac), 0x##n)
109 #define RESTORE_RF_REG(mac, regs, n)	RF_WRITE((mac), 0x##n, (regs)->rf_##n)
110 
111 #define SAVE_PHY_REG(mac, regs, n)	(regs)->phy_##n = PHY_READ((mac), 0x##n)
112 #define RESTORE_PHY_REG(mac, regs, n)	PHY_WRITE((mac), 0x##n, (regs)->phy_##n)
113 
114 static int	bwi_rf_calc_txpower(int8_t *, uint8_t, const int16_t[]);
115 static void	bwi_rf_work_around(struct bwi_mac *, u_int);
116 static int	bwi_rf_gain_max_reached(struct bwi_mac *, int);
117 static uint16_t	bwi_rf_calibval(struct bwi_mac *);
118 static uint16_t	bwi_rf_get_tp_ctrl2(struct bwi_mac *);
119 
120 static void	bwi_rf_lo_update_11b(struct bwi_mac *);
121 static uint16_t	bwi_rf_lo_measure_11b(struct bwi_mac *);
122 
123 static void	bwi_rf_lo_update_11g(struct bwi_mac *);
124 static uint32_t	bwi_rf_lo_devi_measure(struct bwi_mac *, uint16_t);
125 static void	bwi_rf_lo_measure_11g(struct bwi_mac *,
126 			const struct bwi_rf_lo *, struct bwi_rf_lo *, uint8_t);
127 static uint8_t	_bwi_rf_lo_update_11g(struct bwi_mac *, uint16_t);
128 static void	bwi_rf_lo_write(struct bwi_mac *, const struct bwi_rf_lo *);
129 
130 static void	bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *);
131 static void	bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *);
132 static void	bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *);
133 static void	bwi_rf_set_nrssi_thr_11b(struct bwi_mac *);
134 static void	bwi_rf_set_nrssi_thr_11g(struct bwi_mac *);
135 
136 static void	bwi_rf_init_sw_nrssi_table(struct bwi_mac *);
137 
138 static int	bwi_rf_calc_rssi_bcm2050(struct bwi_mac *,
139 			const struct bwi_rxbuf_hdr *);
140 static int	bwi_rf_calc_rssi_bcm2053(struct bwi_mac *,
141 			const struct bwi_rxbuf_hdr *);
142 static int	bwi_rf_calc_rssi_bcm2060(struct bwi_mac *,
143 			const struct bwi_rxbuf_hdr *);
144 static int	bwi_rf_calc_noise_bcm2050(struct bwi_mac *);
145 static int	bwi_rf_calc_noise_bcm2053(struct bwi_mac *);
146 static int	bwi_rf_calc_noise_bcm2060(struct bwi_mac *);
147 
148 static void	bwi_rf_on_11a(struct bwi_mac *);
149 static void	bwi_rf_on_11bg(struct bwi_mac *);
150 
151 static void	bwi_rf_off_11a(struct bwi_mac *);
152 static void	bwi_rf_off_11bg(struct bwi_mac *);
153 static void	bwi_rf_off_11g_rev5(struct bwi_mac *);
154 
155 static const int8_t	bwi_txpower_map_11b[BWI_TSSI_MAX] =
156 	{ BWI_TXPOWER_MAP_11B };
157 static const int8_t	bwi_txpower_map_11g[BWI_TSSI_MAX] =
158 	{ BWI_TXPOWER_MAP_11G };
159 
160 static __inline int16_t
161 bwi_nrssi_11g(struct bwi_mac *mac)
162 {
163 	int16_t val;
164 
165 #define NRSSI_11G_MASK		__BITS(13, 8)
166 
167 	val = (int16_t)__SHIFTOUT(PHY_READ(mac, 0x47f), NRSSI_11G_MASK);
168 	if (val >= 32)
169 		val -= 64;
170 	return val;
171 
172 #undef NRSSI_11G_MASK
173 }
174 
175 static __inline struct bwi_rf_lo *
176 bwi_get_rf_lo(struct bwi_mac *mac, uint16_t rf_atten, uint16_t bbp_atten)
177 {
178 	int n;
179 
180 	n = rf_atten + (14 * (bbp_atten / 2));
181 	KASSERT(n < BWI_RFLO_MAX, ("n %d", n));
182 
183 	return &mac->mac_rf.rf_lo[n];
184 }
185 
186 static __inline int
187 bwi_rf_lo_isused(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
188 {
189 	struct bwi_rf *rf = &mac->mac_rf;
190 	int idx;
191 
192 	idx = lo - rf->rf_lo;
193 	KASSERT(idx >= 0 && idx < BWI_RFLO_MAX, ("idx %d", idx));
194 
195 	return isset(rf->rf_lo_used, idx);
196 }
197 
198 void
199 bwi_rf_write(struct bwi_mac *mac, uint16_t ctrl, uint16_t data)
200 {
201 	struct bwi_softc *sc = mac->mac_sc;
202 
203 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
204 	CSR_WRITE_2(sc, BWI_RF_DATA_LO, data);
205 }
206 
207 uint16_t
208 bwi_rf_read(struct bwi_mac *mac, uint16_t ctrl)
209 {
210 	struct bwi_rf *rf = &mac->mac_rf;
211 	struct bwi_softc *sc = mac->mac_sc;
212 
213 	ctrl |= rf->rf_ctrl_rd;
214 	if (rf->rf_ctrl_adj) {
215 		/* XXX */
216 		if (ctrl < 0x70)
217 			ctrl += 0x80;
218 		else if (ctrl < 0x80)
219 			ctrl += 0x70;
220 	}
221 
222 	CSR_WRITE_2(sc, BWI_RF_CTRL, ctrl);
223 	return CSR_READ_2(sc, BWI_RF_DATA_LO);
224 }
225 
226 int
227 bwi_rf_attach(struct bwi_mac *mac)
228 {
229 	struct bwi_softc *sc = mac->mac_sc;
230 	struct bwi_phy *phy = &mac->mac_phy;
231 	struct bwi_rf *rf = &mac->mac_rf;
232 	uint16_t type, manu;
233 	uint8_t rev;
234 
235 	/*
236 	 * Get RF manufacture/type/revision
237 	 */
238 	if (sc->sc_bbp_id == BWI_BBPID_BCM4317) {
239 		/*
240 		 * Fake a BCM2050 RF
241 		 */
242 		manu = BWI_RF_MANUFACT_BCM;
243 		type = BWI_RF_T_BCM2050;
244 		if (sc->sc_bbp_rev == 0)
245 			rev = 3;
246 		else if (sc->sc_bbp_rev == 1)
247 			rev = 4;
248 		else
249 			rev = 5;
250 	} else {
251 		uint32_t val;
252 
253 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
254 		val = CSR_READ_2(sc, BWI_RF_DATA_HI);
255 		val <<= 16;
256 
257 		CSR_WRITE_2(sc, BWI_RF_CTRL, BWI_RF_CTRL_RFINFO);
258 		val |= CSR_READ_2(sc, BWI_RF_DATA_LO);
259 
260 		manu = __SHIFTOUT(val, BWI_RFINFO_MANUFACT_MASK);
261 		type = __SHIFTOUT(val, BWI_RFINFO_TYPE_MASK);
262 		rev = __SHIFTOUT(val, BWI_RFINFO_REV_MASK);
263 	}
264 	device_printf(sc->sc_dev, "RF: manu 0x%03x, type 0x%04x, rev %u\n",
265 		      manu, type, rev);
266 
267 	/*
268 	 * Verify whether the RF is supported
269 	 */
270 	rf->rf_ctrl_rd = 0;
271 	rf->rf_ctrl_adj = 0;
272 	switch (phy->phy_mode) {
273 	case IEEE80211_MODE_11A:
274 		if (manu != BWI_RF_MANUFACT_BCM ||
275 		    type != BWI_RF_T_BCM2060 ||
276 		    rev != 1) {
277 			device_printf(sc->sc_dev, "only BCM2060 rev 1 RF "
278 				      "is supported for 11A PHY\n");
279 			return ENXIO;
280 		}
281 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11A;
282 		rf->rf_on = bwi_rf_on_11a;
283 		rf->rf_off = bwi_rf_off_11a;
284 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2060;
285 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2060;
286 		break;
287 	case IEEE80211_MODE_11B:
288 		if (type == BWI_RF_T_BCM2050) {
289 			rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
290 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
291 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
292 		} else if (type == BWI_RF_T_BCM2053) {
293 			rf->rf_ctrl_adj = 1;
294 			rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2053;
295 			rf->rf_calc_noise = bwi_rf_calc_noise_bcm2053;
296 		} else {
297 			device_printf(sc->sc_dev, "only BCM2050/BCM2053 RF "
298 				      "is supported for 11B PHY\n");
299 			return ENXIO;
300 		}
301 		rf->rf_on = bwi_rf_on_11bg;
302 		rf->rf_off = bwi_rf_off_11bg;
303 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11b;
304 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11b;
305 		if (phy->phy_rev == 6)
306 			rf->rf_lo_update = bwi_rf_lo_update_11g;
307 		else
308 			rf->rf_lo_update = bwi_rf_lo_update_11b;
309 		break;
310 	case IEEE80211_MODE_11G:
311 		if (type != BWI_RF_T_BCM2050) {
312 			device_printf(sc->sc_dev, "only BCM2050 RF "
313 				      "is supported for 11G PHY\n");
314 			return ENXIO;
315 		}
316 		rf->rf_ctrl_rd = BWI_RF_CTRL_RD_11BG;
317 		rf->rf_on = bwi_rf_on_11bg;
318 		if (mac->mac_rev >= 5)
319 			rf->rf_off = bwi_rf_off_11g_rev5;
320 		else
321 			rf->rf_off = bwi_rf_off_11bg;
322 		rf->rf_calc_nrssi_slope = bwi_rf_calc_nrssi_slope_11g;
323 		rf->rf_set_nrssi_thr = bwi_rf_set_nrssi_thr_11g;
324 		rf->rf_calc_rssi = bwi_rf_calc_rssi_bcm2050;
325 		rf->rf_calc_noise = bwi_rf_calc_noise_bcm2050;
326 		rf->rf_lo_update = bwi_rf_lo_update_11g;
327 		break;
328 	default:
329 		device_printf(sc->sc_dev, "unsupported PHY mode\n");
330 		return ENXIO;
331 	}
332 
333 	rf->rf_type = type;
334 	rf->rf_rev = rev;
335 	rf->rf_manu = manu;
336 	rf->rf_curchan = IEEE80211_CHAN_ANY;
337 	rf->rf_ant_mode = BWI_ANT_MODE_AUTO;
338 	return 0;
339 }
340 
341 void
342 bwi_rf_set_chan(struct bwi_mac *mac, u_int chan, int work_around)
343 {
344 	struct bwi_softc *sc = mac->mac_sc;
345 
346 	if (chan == IEEE80211_CHAN_ANY)
347 		return;
348 
349 	MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_CHAN, chan);
350 
351 	/* TODO: 11A */
352 
353 	if (work_around)
354 		bwi_rf_work_around(mac, chan);
355 
356 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
357 
358 	if (chan == 14) {
359 		if (sc->sc_locale == BWI_SPROM_LOCALE_JAPAN)
360 			HFLAGS_CLRBITS(mac, BWI_HFLAG_NOT_JAPAN);
361 		else
362 			HFLAGS_SETBITS(mac, BWI_HFLAG_NOT_JAPAN);
363 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, (1 << 11)); /* XXX */
364 	} else {
365 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0x840); /* XXX */
366 	}
367 	DELAY(8000);	/* DELAY(2000); */
368 
369 	mac->mac_rf.rf_curchan = chan;
370 }
371 
372 void
373 bwi_rf_get_gains(struct bwi_mac *mac)
374 {
375 #define SAVE_PHY_MAX	15
376 #define SAVE_RF_MAX	3
377 
378 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
379 	{ 0x52, 0x43, 0x7a };
380 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] = {
381 		0x0429, 0x0001, 0x0811, 0x0812,
382 		0x0814, 0x0815, 0x005a, 0x0059,
383 		0x0058, 0x000a, 0x0003, 0x080f,
384 		0x0810, 0x002b, 0x0015
385 	};
386 
387 	struct bwi_softc *sc = mac->mac_sc;
388 	struct bwi_phy *phy = &mac->mac_phy;
389 	struct bwi_rf *rf = &mac->mac_rf;
390 	uint16_t save_phy[SAVE_PHY_MAX];
391 	uint16_t save_rf[SAVE_RF_MAX];
392 	uint16_t trsw;
393 	int i, j, loop1_max, loop1, loop2;
394 
395 	/*
396 	 * Save PHY/RF registers for later restoration
397 	 */
398 	for (i = 0; i < SAVE_PHY_MAX; ++i)
399 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
400 	PHY_READ(mac, 0x2d); /* dummy read */
401 
402 	for (i = 0; i < SAVE_RF_MAX; ++i)
403 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
404 
405 	PHY_CLRBITS(mac, 0x429, 0xc000);
406 	PHY_SETBITS(mac, 0x1, 0x8000);
407 
408 	PHY_SETBITS(mac, 0x811, 0x2);
409 	PHY_CLRBITS(mac, 0x812, 0x2);
410 	PHY_SETBITS(mac, 0x811, 0x1);
411 	PHY_CLRBITS(mac, 0x812, 0x1);
412 
413 	PHY_SETBITS(mac, 0x814, 0x1);
414 	PHY_CLRBITS(mac, 0x815, 0x1);
415 	PHY_SETBITS(mac, 0x814, 0x2);
416 	PHY_CLRBITS(mac, 0x815, 0x2);
417 
418 	PHY_SETBITS(mac, 0x811, 0xc);
419 	PHY_SETBITS(mac, 0x812, 0xc);
420 	PHY_SETBITS(mac, 0x811, 0x30);
421 	PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
422 
423 	PHY_WRITE(mac, 0x5a, 0x780);
424 	PHY_WRITE(mac, 0x59, 0xc810);
425 	PHY_WRITE(mac, 0x58, 0xd);
426 	PHY_SETBITS(mac, 0xa, 0x2000);
427 
428 	PHY_SETBITS(mac, 0x814, 0x4);
429 	PHY_CLRBITS(mac, 0x815, 0x4);
430 
431 	PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
432 
433 	if (rf->rf_rev == 8) {
434 		loop1_max = 15;
435 		RF_WRITE(mac, 0x43, loop1_max);
436 	} else {
437 		loop1_max = 9;
438 	    	RF_WRITE(mac, 0x52, 0x0);
439 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, loop1_max);
440 	}
441 
442 	bwi_phy_set_bbp_atten(mac, 11);
443 
444 	if (phy->phy_rev >= 3)
445 		PHY_WRITE(mac, 0x80f, 0xc020);
446 	else
447 		PHY_WRITE(mac, 0x80f, 0x8020);
448 	PHY_WRITE(mac, 0x810, 0);
449 
450 	PHY_FILT_SETBITS(mac, 0x2b, 0xffc0, 0x1);
451 	PHY_FILT_SETBITS(mac, 0x2b, 0xc0ff, 0x800);
452 	PHY_SETBITS(mac, 0x811, 0x100);
453 	PHY_CLRBITS(mac, 0x812, 0x3000);
454 
455 	if ((sc->sc_card_flags & BWI_CARD_F_EXT_LNA) &&
456 	    phy->phy_rev >= 7) {
457 		PHY_SETBITS(mac, 0x811, 0x800);
458 		PHY_SETBITS(mac, 0x812, 0x8000);
459 	}
460 	RF_CLRBITS(mac, 0x7a, 0xff08);
461 
462 	/*
463 	 * Find out 'loop1/loop2', which will be used to calculate
464 	 * max loopback gain later
465 	 */
466 	j = 0;
467 	for (i = 0; i < loop1_max; ++i) {
468 		for (j = 0; j < 16; ++j) {
469 			RF_WRITE(mac, 0x43, i);
470 
471 			if (bwi_rf_gain_max_reached(mac, j))
472 				goto loop1_exit;
473 		}
474 	}
475 loop1_exit:
476 	loop1 = i;
477 	loop2 = j;
478 
479 	/*
480 	 * Find out 'trsw', which will be used to calculate
481 	 * TRSW(TX/RX switch) RX gain later
482 	 */
483 	if (loop2 >= 8) {
484 		PHY_SETBITS(mac, 0x812, 0x30);
485 		trsw = 0x1b;
486 		for (i = loop2 - 8; i < 16; ++i) {
487 			trsw -= 3;
488 			if (bwi_rf_gain_max_reached(mac, i))
489 				break;
490 		}
491 	} else {
492 		trsw = 0x18;
493 	}
494 
495 	/*
496 	 * Restore saved PHY/RF registers
497 	 */
498 	/* First 4 saved PHY registers need special processing */
499 	for (i = 4; i < SAVE_PHY_MAX; ++i)
500 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
501 
502 	bwi_phy_set_bbp_atten(mac, mac->mac_tpctl.bbp_atten);
503 
504 	for (i = 0; i < SAVE_RF_MAX; ++i)
505 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
506 
507 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2] | 0x3);
508 	DELAY(10);
509 	PHY_WRITE(mac, save_phy_regs[2], save_phy[2]);
510 	PHY_WRITE(mac, save_phy_regs[3], save_phy[3]);
511 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
512 	PHY_WRITE(mac, save_phy_regs[1], save_phy[1]);
513 
514 	/*
515 	 * Calculate gains
516 	 */
517 	rf->rf_lo_gain = (loop2 * 6) - (loop1 * 4) - 11;
518 	rf->rf_rx_gain = trsw * 2;
519 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_INIT,
520 		"lo gain: %u, rx gain: %u\n",
521 		rf->rf_lo_gain, rf->rf_rx_gain);
522 
523 #undef SAVE_RF_MAX
524 #undef SAVE_PHY_MAX
525 }
526 
527 void
528 bwi_rf_init(struct bwi_mac *mac)
529 {
530 	struct bwi_rf *rf = &mac->mac_rf;
531 
532 	if (rf->rf_type == BWI_RF_T_BCM2060) {
533 		/* TODO: 11A */
534 	} else {
535 		if (rf->rf_flags & BWI_RF_F_INITED)
536 			RF_WRITE(mac, 0x78, rf->rf_calib);
537 		else
538 			bwi_rf_init_bcm2050(mac);
539 	}
540 }
541 
542 static void
543 bwi_rf_off_11a(struct bwi_mac *mac)
544 {
545 	RF_WRITE(mac, 0x4, 0xff);
546 	RF_WRITE(mac, 0x5, 0xfb);
547 
548 	PHY_SETBITS(mac, 0x10, 0x8);
549 	PHY_SETBITS(mac, 0x11, 0x8);
550 
551 	PHY_WRITE(mac, 0x15, 0xaa00);
552 }
553 
554 static void
555 bwi_rf_off_11bg(struct bwi_mac *mac)
556 {
557 	PHY_WRITE(mac, 0x15, 0xaa00);
558 }
559 
560 static void
561 bwi_rf_off_11g_rev5(struct bwi_mac *mac)
562 {
563 	PHY_SETBITS(mac, 0x811, 0x8c);
564 	PHY_CLRBITS(mac, 0x812, 0x8c);
565 }
566 
567 static void
568 bwi_rf_work_around(struct bwi_mac *mac, u_int chan)
569 {
570 	struct bwi_softc *sc = mac->mac_sc;
571 	struct bwi_rf *rf = &mac->mac_rf;
572 
573 	if (chan == IEEE80211_CHAN_ANY) {
574 		device_printf(sc->sc_dev, "%s invalid channel!!\n", __func__);
575 		return;
576 	}
577 
578 	if (rf->rf_type != BWI_RF_T_BCM2050 || rf->rf_rev >= 6)
579 		return;
580 
581 	if (chan <= 10)
582 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan + 4));
583 	else
584 		CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(1));
585 	DELAY(1000);
586 	CSR_WRITE_2(sc, BWI_RF_CHAN, BWI_RF_2GHZ_CHAN(chan));
587 }
588 
589 static __inline struct bwi_rf_lo *
590 bwi_rf_lo_find(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
591 {
592 	uint16_t rf_atten, bbp_atten;
593 	int remap_rf_atten;
594 
595 	remap_rf_atten = 1;
596 	if (tpctl == NULL) {
597 		bbp_atten = 2;
598 		rf_atten = 3;
599 	} else {
600 		if (tpctl->tp_ctrl1 == 3)
601 			remap_rf_atten = 0;
602 
603 		bbp_atten = tpctl->bbp_atten;
604 		rf_atten = tpctl->rf_atten;
605 
606 		if (bbp_atten > 6)
607 			bbp_atten = 6;
608 	}
609 
610 	if (remap_rf_atten) {
611 #define MAP_MAX	10
612 		static const uint16_t map[MAP_MAX] =
613 		{ 11, 10, 11, 12, 13, 12, 13, 12, 13, 12 };
614 
615 #if 0
616 		KASSERT(rf_atten < MAP_MAX, ("rf_atten %d", rf_atten));
617 		rf_atten = map[rf_atten];
618 #else
619 		if (rf_atten >= MAP_MAX) {
620 			rf_atten = 0;	/* XXX */
621 		} else {
622 			rf_atten = map[rf_atten];
623 		}
624 #endif
625 #undef MAP_MAX
626 	}
627 
628 	return bwi_get_rf_lo(mac, rf_atten, bbp_atten);
629 }
630 
631 void
632 bwi_rf_lo_adjust(struct bwi_mac *mac, const struct bwi_tpctl *tpctl)
633 {
634 	const struct bwi_rf_lo *lo;
635 
636 	lo = bwi_rf_lo_find(mac, tpctl);
637 	RF_LO_WRITE(mac, lo);
638 }
639 
640 static void
641 bwi_rf_lo_write(struct bwi_mac *mac, const struct bwi_rf_lo *lo)
642 {
643 	uint16_t val;
644 
645 	val = (uint8_t)lo->ctrl_lo;
646 	val |= ((uint8_t)lo->ctrl_hi) << 8;
647 
648 	PHY_WRITE(mac, BWI_PHYR_RF_LO, val);
649 }
650 
651 static int
652 bwi_rf_gain_max_reached(struct bwi_mac *mac, int idx)
653 {
654 	PHY_FILT_SETBITS(mac, 0x812, 0xf0ff, idx << 8);
655 	PHY_FILT_SETBITS(mac, 0x15, 0xfff, 0xa000);
656 	PHY_SETBITS(mac, 0x15, 0xf000);
657 
658 	DELAY(20);
659 
660 	return (PHY_READ(mac, 0x2d) >= 0xdfc);
661 }
662 
663 /* XXX use bitmap array */
664 static __inline uint16_t
665 bitswap4(uint16_t val)
666 {
667 	uint16_t ret;
668 
669 	ret = (val & 0x8) >> 3;
670 	ret |= (val & 0x4) >> 1;
671 	ret |= (val & 0x2) << 1;
672 	ret |= (val & 0x1) << 3;
673 	return ret;
674 }
675 
676 static __inline uint16_t
677 bwi_phy812_value(struct bwi_mac *mac, uint16_t lpd)
678 {
679 	struct bwi_softc *sc = mac->mac_sc;
680 	struct bwi_phy *phy = &mac->mac_phy;
681 	struct bwi_rf *rf = &mac->mac_rf;
682 	uint16_t lo_gain, ext_lna, loop;
683 
684 	if ((phy->phy_flags & BWI_PHY_F_LINKED) == 0)
685 		return 0;
686 
687 	lo_gain = rf->rf_lo_gain;
688 	if (rf->rf_rev == 8)
689 		lo_gain += 0x3e;
690 	else
691 		lo_gain += 0x26;
692 
693 	if (lo_gain >= 0x46) {
694 		lo_gain -= 0x46;
695 		ext_lna = 0x3000;
696 	} else if (lo_gain >= 0x3a) {
697 		lo_gain -= 0x3a;
698 		ext_lna = 0x1000;
699 	} else if (lo_gain >= 0x2e) {
700 		lo_gain -= 0x2e;
701 		ext_lna = 0x2000;
702 	} else {
703 		lo_gain -= 0x10;
704 		ext_lna = 0;
705 	}
706 
707 	for (loop = 0; loop < 16; ++loop) {
708 		lo_gain -= (6 * loop);
709 		if (lo_gain < 6)
710 			break;
711 	}
712 
713 	if (phy->phy_rev >= 7 && (sc->sc_card_flags & BWI_CARD_F_EXT_LNA)) {
714 		if (ext_lna)
715 			ext_lna |= 0x8000;
716 		ext_lna |= (loop << 8);
717 		switch (lpd) {
718 		case 0x011:
719 			return 0x8f92;
720 		case 0x001:
721 			return (0x8092 | ext_lna);
722 		case 0x101:
723 			return (0x2092 | ext_lna);
724 		case 0x100:
725 			return (0x2093 | ext_lna);
726 		default:
727 			panic("unsupported lpd\n");
728 		}
729 	} else {
730 		ext_lna |= (loop << 8);
731 		switch (lpd) {
732 		case 0x011:
733 			return 0xf92;
734 		case 0x001:
735 		case 0x101:
736 			return (0x92 | ext_lna);
737 		case 0x100:
738 			return (0x93 | ext_lna);
739 		default:
740 			panic("unsupported lpd\n");
741 		}
742 	}
743 
744 	panic("never reached\n");
745 	return 0;
746 }
747 
748 void
749 bwi_rf_init_bcm2050(struct bwi_mac *mac)
750 {
751 #define SAVE_RF_MAX		3
752 #define SAVE_PHY_COMM_MAX	4
753 #define SAVE_PHY_11G_MAX	6
754 
755 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
756 	{ 0x0043, 0x0051, 0x0052 };
757 	static const uint16_t save_phy_regs_comm[SAVE_PHY_COMM_MAX] =
758 	{ 0x0015, 0x005a, 0x0059, 0x0058 };
759 	static const uint16_t save_phy_regs_11g[SAVE_PHY_11G_MAX] =
760 	{ 0x0811, 0x0812, 0x0814, 0x0815, 0x0429, 0x0802 };
761 
762 	uint16_t save_rf[SAVE_RF_MAX];
763 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
764 	uint16_t save_phy_11g[SAVE_PHY_11G_MAX];
765 	uint16_t phyr_35, phyr_30 = 0, rfr_78, phyr_80f = 0, phyr_810 = 0;
766 	uint16_t bphy_ctrl = 0, bbp_atten, rf_chan_ex;
767 	uint16_t phy812_val;
768 	uint16_t calib;
769 	uint32_t test_lim, test;
770 	struct bwi_softc *sc = mac->mac_sc;
771 	struct bwi_phy *phy = &mac->mac_phy;
772 	struct bwi_rf *rf = &mac->mac_rf;
773 	int i;
774 
775 	/*
776 	 * Save registers for later restoring
777 	 */
778 	for (i = 0; i < SAVE_RF_MAX; ++i)
779 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
780 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
781 		save_phy_comm[i] = PHY_READ(mac, save_phy_regs_comm[i]);
782 
783 	if (phy->phy_mode == IEEE80211_MODE_11B) {
784 		phyr_30 = PHY_READ(mac, 0x30);
785 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
786 
787 		PHY_WRITE(mac, 0x30, 0xff);
788 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x3f3f);
789 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
790 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
791 			save_phy_11g[i] =
792 				PHY_READ(mac, save_phy_regs_11g[i]);
793 		}
794 
795 		PHY_SETBITS(mac, 0x814, 0x3);
796 		PHY_CLRBITS(mac, 0x815, 0x3);
797 		PHY_CLRBITS(mac, 0x429, 0x8000);
798 		PHY_CLRBITS(mac, 0x802, 0x3);
799 
800 		phyr_80f = PHY_READ(mac, 0x80f);
801 		phyr_810 = PHY_READ(mac, 0x810);
802 
803 		if (phy->phy_rev >= 3)
804 			PHY_WRITE(mac, 0x80f, 0xc020);
805 		else
806 			PHY_WRITE(mac, 0x80f, 0x8020);
807 		PHY_WRITE(mac, 0x810, 0);
808 
809 		phy812_val = bwi_phy812_value(mac, 0x011);
810 		PHY_WRITE(mac, 0x812, phy812_val);
811 		if (phy->phy_rev < 7 ||
812 		    (sc->sc_card_flags & BWI_CARD_F_EXT_LNA) == 0)
813 			PHY_WRITE(mac, 0x811, 0x1b3);
814 		else
815 			PHY_WRITE(mac, 0x811, 0x9b3);
816 	}
817 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
818 
819 	phyr_35 = PHY_READ(mac, 0x35);
820 	PHY_CLRBITS(mac, 0x35, 0x80);
821 
822 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
823 	rf_chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
824 
825 	if (phy->phy_version == 0) {
826 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
827 	} else {
828 		if (phy->phy_version >= 2)
829 			PHY_FILT_SETBITS(mac, 0x3, 0xffbf, 0x40);
830 		CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
831 	}
832 
833 	calib = bwi_rf_calibval(mac);
834 
835 	if (phy->phy_mode == IEEE80211_MODE_11B)
836 		RF_WRITE(mac, 0x78, 0x26);
837 
838 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
839 		phy812_val = bwi_phy812_value(mac, 0x011);
840 		PHY_WRITE(mac, 0x812, phy812_val);
841 	}
842 
843 	PHY_WRITE(mac, 0x15, 0xbfaf);
844 	PHY_WRITE(mac, 0x2b, 0x1403);
845 
846 	if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
847 		phy812_val = bwi_phy812_value(mac, 0x001);
848 		PHY_WRITE(mac, 0x812, phy812_val);
849 	}
850 
851 	PHY_WRITE(mac, 0x15, 0xbfa0);
852 
853 	RF_SETBITS(mac, 0x51, 0x4);
854 	if (rf->rf_rev == 8) {
855 		RF_WRITE(mac, 0x43, 0x1f);
856 	} else {
857 		RF_WRITE(mac, 0x52, 0);
858 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
859 	}
860 
861 	test_lim = 0;
862 	PHY_WRITE(mac, 0x58, 0);
863 	for (i = 0; i < 16; ++i) {
864 		PHY_WRITE(mac, 0x5a, 0x480);
865 		PHY_WRITE(mac, 0x59, 0xc810);
866 
867 		PHY_WRITE(mac, 0x58, 0xd);
868 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
869 			phy812_val = bwi_phy812_value(mac, 0x101);
870 			PHY_WRITE(mac, 0x812, phy812_val);
871 		}
872 		PHY_WRITE(mac, 0x15, 0xafb0);
873 		DELAY(10);
874 
875 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
876 			phy812_val = bwi_phy812_value(mac, 0x101);
877 			PHY_WRITE(mac, 0x812, phy812_val);
878 		}
879 		PHY_WRITE(mac, 0x15, 0xefb0);
880 		DELAY(10);
881 
882 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
883 			phy812_val = bwi_phy812_value(mac, 0x100);
884 			PHY_WRITE(mac, 0x812, phy812_val);
885 		}
886 		PHY_WRITE(mac, 0x15, 0xfff0);
887 		DELAY(20);
888 
889 		test_lim += PHY_READ(mac, 0x2d);
890 
891 		PHY_WRITE(mac, 0x58, 0);
892 		if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
893 			phy812_val = bwi_phy812_value(mac, 0x101);
894 			PHY_WRITE(mac, 0x812, phy812_val);
895 		}
896 		PHY_WRITE(mac, 0x15, 0xafb0);
897 	}
898 	++test_lim;
899 	test_lim >>= 9;
900 
901 	DELAY(10);
902 
903 	test = 0;
904 	PHY_WRITE(mac, 0x58, 0);
905 	for (i = 0; i < 16; ++i) {
906 		int j;
907 
908 		rfr_78 = (bitswap4(i) << 1) | 0x20;
909 		RF_WRITE(mac, 0x78, rfr_78);
910 		DELAY(10);
911 
912 		/* NB: This block is slight different than the above one */
913 		for (j = 0; j < 16; ++j) {
914 			PHY_WRITE(mac, 0x5a, 0xd80);
915 			PHY_WRITE(mac, 0x59, 0xc810);
916 
917 			PHY_WRITE(mac, 0x58, 0xd);
918 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
919 			    phy->phy_rev >= 2) {
920 				phy812_val = bwi_phy812_value(mac, 0x101);
921 				PHY_WRITE(mac, 0x812, phy812_val);
922 			}
923 			PHY_WRITE(mac, 0x15, 0xafb0);
924 			DELAY(10);
925 
926 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
927 			    phy->phy_rev >= 2) {
928 				phy812_val = bwi_phy812_value(mac, 0x101);
929 				PHY_WRITE(mac, 0x812, phy812_val);
930 			}
931 			PHY_WRITE(mac, 0x15, 0xefb0);
932 			DELAY(10);
933 
934 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
935 			    phy->phy_rev >= 2) {
936 				phy812_val = bwi_phy812_value(mac, 0x100);
937 				PHY_WRITE(mac, 0x812, phy812_val);
938 			}
939 			PHY_WRITE(mac, 0x15, 0xfff0);
940 			DELAY(10);
941 
942 			test += PHY_READ(mac, 0x2d);
943 
944 			PHY_WRITE(mac, 0x58, 0);
945 			if ((phy->phy_flags & BWI_PHY_F_LINKED) ||
946 			    phy->phy_rev >= 2) {
947 				phy812_val = bwi_phy812_value(mac, 0x101);
948 				PHY_WRITE(mac, 0x812, phy812_val);
949 			}
950 			PHY_WRITE(mac, 0x15, 0xafb0);
951 		}
952 
953 		++test;
954 		test >>= 8;
955 
956 		if (test > test_lim)
957 			break;
958 	}
959 	if (i > 15)
960 		rf->rf_calib = rfr_78;
961 	else
962 		rf->rf_calib = calib;
963 	if (rf->rf_calib != 0xffff) {
964 		DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT,
965 			"RF calibration value: 0x%04x\n", rf->rf_calib);
966 		rf->rf_flags |= BWI_RF_F_INITED;
967 	}
968 
969 	/*
970 	 * Restore trashes registers
971 	 */
972 	PHY_WRITE(mac, save_phy_regs_comm[0], save_phy_comm[0]);
973 
974 	for (i = 0; i < SAVE_RF_MAX; ++i) {
975 		int pos = (i + 1) % SAVE_RF_MAX;
976 
977 		RF_WRITE(mac, save_rf_regs[pos], save_rf[pos]);
978 	}
979 	for (i = 1; i < SAVE_PHY_COMM_MAX; ++i)
980 		PHY_WRITE(mac, save_phy_regs_comm[i], save_phy_comm[i]);
981 
982 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
983 	if (phy->phy_version != 0)
984 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, rf_chan_ex);
985 
986 	PHY_WRITE(mac, 0x35, phyr_35);
987 	bwi_rf_work_around(mac, rf->rf_curchan);
988 
989 	if (phy->phy_mode == IEEE80211_MODE_11B) {
990 		PHY_WRITE(mac, 0x30, phyr_30);
991 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
992 	} else if ((phy->phy_flags & BWI_PHY_F_LINKED) || phy->phy_rev >= 2) {
993 		/* XXX Spec only says when PHY is linked (gmode) */
994 		CSR_CLRBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
995 
996 		for (i = 0; i < SAVE_PHY_11G_MAX; ++i) {
997 			PHY_WRITE(mac, save_phy_regs_11g[i],
998 				  save_phy_11g[i]);
999 		}
1000 
1001 		PHY_WRITE(mac, 0x80f, phyr_80f);
1002 		PHY_WRITE(mac, 0x810, phyr_810);
1003 	}
1004 
1005 #undef SAVE_PHY_11G_MAX
1006 #undef SAVE_PHY_COMM_MAX
1007 #undef SAVE_RF_MAX
1008 }
1009 
1010 static uint16_t
1011 bwi_rf_calibval(struct bwi_mac *mac)
1012 {
1013 	/* http://bcm-specs.sipsolutions.net/RCCTable */
1014 	static const uint16_t rf_calibvals[] = {
1015 		0x2, 0x3, 0x1, 0xf, 0x6, 0x7, 0x5, 0xf,
1016 		0xa, 0xb, 0x9, 0xf, 0xe, 0xf, 0xd, 0xf
1017 	};
1018 	uint16_t val, calib;
1019 	int idx;
1020 
1021 	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
1022 	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
1023 	KASSERT(idx < (int)nitems(rf_calibvals), ("idx %d", idx));
1024 
1025 	calib = rf_calibvals[idx] << 1;
1026 	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
1027 		calib |= 0x1;
1028 	calib |= 0x20;
1029 
1030 	return calib;
1031 }
1032 
1033 static __inline int32_t
1034 _bwi_adjust_devide(int32_t num, int32_t den)
1035 {
1036 	if (num < 0)
1037 		return (num / den);
1038 	else
1039 		return (num + den / 2) / den;
1040 }
1041 
1042 /*
1043  * http://bcm-specs.sipsolutions.net/TSSI_to_DBM_Table
1044  * "calculating table entries"
1045  */
1046 static int
1047 bwi_rf_calc_txpower(int8_t *txpwr, uint8_t idx, const int16_t pa_params[])
1048 {
1049 	int32_t m1, m2, f, dbm;
1050 	int i;
1051 
1052 	m1 = _bwi_adjust_devide(16 * pa_params[0] + idx * pa_params[1], 32);
1053 	m2 = imax(_bwi_adjust_devide(32768 + idx * pa_params[2], 256), 1);
1054 
1055 #define ITER_MAX	16
1056 
1057 	f = 256;
1058 	for (i = 0; i < ITER_MAX; ++i) {
1059 		int32_t q, d;
1060 
1061 		q = _bwi_adjust_devide(
1062 			f * 4096 - _bwi_adjust_devide(m2 * f, 16) * f, 2048);
1063 		d = abs(q - f);
1064 		f = q;
1065 
1066 		if (d < 2)
1067 			break;
1068 	}
1069 	if (i == ITER_MAX)
1070 		return EINVAL;
1071 
1072 #undef ITER_MAX
1073 
1074 	dbm = _bwi_adjust_devide(m1 * f, 8192);
1075 	if (dbm < -127)
1076 		dbm = -127;
1077 	else if (dbm > 128)
1078 		dbm = 128;
1079 
1080 	*txpwr = dbm;
1081 	return 0;
1082 }
1083 
1084 int
1085 bwi_rf_map_txpower(struct bwi_mac *mac)
1086 {
1087 	struct bwi_softc *sc = mac->mac_sc;
1088 	struct bwi_rf *rf = &mac->mac_rf;
1089 	struct bwi_phy *phy = &mac->mac_phy;
1090 	uint16_t sprom_ofs, val, mask;
1091 	int16_t pa_params[3];
1092 	int error = 0, i, ant_gain, reg_txpower_max;
1093 
1094 	/*
1095 	 * Find out max TX power
1096 	 */
1097 	val = bwi_read_sprom(sc, BWI_SPROM_MAX_TXPWR);
1098 	if (phy->phy_mode == IEEE80211_MODE_11A) {
1099 		rf->rf_txpower_max = __SHIFTOUT(val,
1100 				     BWI_SPROM_MAX_TXPWR_MASK_11A);
1101 	} else {
1102 		rf->rf_txpower_max = __SHIFTOUT(val,
1103 				     BWI_SPROM_MAX_TXPWR_MASK_11BG);
1104 
1105 		if ((sc->sc_card_flags & BWI_CARD_F_PA_GPIO9) &&
1106 		    phy->phy_mode == IEEE80211_MODE_11G)
1107 			rf->rf_txpower_max -= 3;
1108 	}
1109 	if (rf->rf_txpower_max <= 0) {
1110 		device_printf(sc->sc_dev, "invalid max txpower in sprom\n");
1111 		rf->rf_txpower_max = 74;
1112 	}
1113 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1114 		"max txpower from sprom: %d dBm\n", rf->rf_txpower_max);
1115 
1116 	/*
1117 	 * Find out region/domain max TX power, which is adjusted
1118 	 * by antenna gain and 1.5 dBm fluctuation as mentioned
1119 	 * in v3 spec.
1120 	 */
1121 	val = bwi_read_sprom(sc, BWI_SPROM_ANT_GAIN);
1122 	if (phy->phy_mode == IEEE80211_MODE_11A)
1123 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11A);
1124 	else
1125 		ant_gain = __SHIFTOUT(val, BWI_SPROM_ANT_GAIN_MASK_11BG);
1126 	if (ant_gain == 0xff) {
1127 		device_printf(sc->sc_dev, "invalid antenna gain in sprom\n");
1128 		ant_gain = 2;
1129 	}
1130 	ant_gain *= 4;
1131 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1132 		"ant gain %d dBm\n", ant_gain);
1133 
1134 	reg_txpower_max = 90 - ant_gain - 6;	/* XXX magic number */
1135 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1136 		"region/domain max txpower %d dBm\n", reg_txpower_max);
1137 
1138 	/*
1139 	 * Force max TX power within region/domain TX power limit
1140 	 */
1141 	if (rf->rf_txpower_max > reg_txpower_max)
1142 		rf->rf_txpower_max = reg_txpower_max;
1143 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1144 		"max txpower %d dBm\n", rf->rf_txpower_max);
1145 
1146 	/*
1147 	 * Create TSSI to TX power mapping
1148 	 */
1149 
1150 	if (sc->sc_bbp_id == BWI_BBPID_BCM4301 &&
1151 	    rf->rf_type != BWI_RF_T_BCM2050) {
1152 		rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1153 		bcopy(bwi_txpower_map_11b, rf->rf_txpower_map0,
1154 		      sizeof(rf->rf_txpower_map0));
1155 		goto back;
1156 	}
1157 
1158 #define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
1159 
1160 	/*
1161 	 * Extract PA parameters
1162 	 */
1163 	if (phy->phy_mode == IEEE80211_MODE_11A)
1164 		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
1165 	else
1166 		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
1167 	for (i = 0; i < nitems(pa_params); ++i)
1168 		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
1169 
1170 	for (i = 0; i < nitems(pa_params); ++i) {
1171 		/*
1172 		 * If one of the PA parameters from SPROM is not valid,
1173 		 * fall back to the default values, if there are any.
1174 		 */
1175 		if (!IS_VALID_PA_PARAM(pa_params[i])) {
1176 			const int8_t *txpower_map;
1177 
1178 			if (phy->phy_mode == IEEE80211_MODE_11A) {
1179 				device_printf(sc->sc_dev,
1180 					  "no tssi2dbm table for 11a PHY\n");
1181 				return ENXIO;
1182 			}
1183 
1184 			if (phy->phy_mode == IEEE80211_MODE_11G) {
1185 				DPRINTF(sc,
1186 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1187 				"%s\n", "use default 11g TSSI map");
1188 				txpower_map = bwi_txpower_map_11g;
1189 			} else {
1190 				DPRINTF(sc,
1191 				BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1192 				"%s\n", "use default 11b TSSI map");
1193 				txpower_map = bwi_txpower_map_11b;
1194 			}
1195 
1196 			rf->rf_idle_tssi0 = BWI_DEFAULT_IDLE_TSSI;
1197 			bcopy(txpower_map, rf->rf_txpower_map0,
1198 			      sizeof(rf->rf_txpower_map0));
1199 			goto back;
1200 		}
1201 	}
1202 
1203 	/*
1204 	 * All of the PA parameters from SPROM are valid.
1205 	 */
1206 
1207 	/*
1208 	 * Extract idle TSSI from SPROM.
1209 	 */
1210 	val = bwi_read_sprom(sc, BWI_SPROM_IDLE_TSSI);
1211 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1212 		"sprom idle tssi: 0x%04x\n", val);
1213 
1214 	if (phy->phy_mode == IEEE80211_MODE_11A)
1215 		mask = BWI_SPROM_IDLE_TSSI_MASK_11A;
1216 	else
1217 		mask = BWI_SPROM_IDLE_TSSI_MASK_11BG;
1218 
1219 	rf->rf_idle_tssi0 = (int)__SHIFTOUT(val, mask);
1220 	if (!IS_VALID_PA_PARAM(rf->rf_idle_tssi0))
1221 		rf->rf_idle_tssi0 = 62;
1222 
1223 #undef IS_VALID_PA_PARAM
1224 
1225 	/*
1226 	 * Calculate TX power map, which is indexed by TSSI
1227 	 */
1228 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1229 		"%s\n", "TSSI-TX power map:");
1230 	for (i = 0; i < BWI_TSSI_MAX; ++i) {
1231 		error = bwi_rf_calc_txpower(&rf->rf_txpower_map0[i], i,
1232 					    pa_params);
1233 		if (error) {
1234 			device_printf(sc->sc_dev,
1235 				  "bwi_rf_calc_txpower failed\n");
1236 			break;
1237 		}
1238 
1239 #ifdef BWI_DEBUG
1240 		if (i != 0 && i % 8 == 0) {
1241 			_DPRINTF(sc,
1242 			BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1243 			"%s\n", "");
1244 		}
1245 #endif
1246 		_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1247 			 "%d ", rf->rf_txpower_map0[i]);
1248 	}
1249 	_DPRINTF(sc, BWI_DBG_RF | BWI_DBG_ATTACH | BWI_DBG_TXPOWER,
1250 		 "%s\n", "");
1251 back:
1252 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_TXPOWER | BWI_DBG_ATTACH,
1253 		"idle tssi0: %d\n", rf->rf_idle_tssi0);
1254 	return error;
1255 }
1256 
1257 static void
1258 bwi_rf_lo_update_11g(struct bwi_mac *mac)
1259 {
1260 	struct bwi_softc *sc = mac->mac_sc;
1261 	struct bwi_rf *rf = &mac->mac_rf;
1262 	struct bwi_phy *phy = &mac->mac_phy;
1263 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
1264 	struct rf_saveregs regs;
1265 	uint16_t ant_div, chan_ex;
1266 	uint8_t devi_ctrl;
1267 	u_int orig_chan;
1268 
1269 	/*
1270 	 * Save RF/PHY registers for later restoration
1271 	 */
1272 	orig_chan = rf->rf_curchan;
1273 	bzero(&regs, sizeof(regs));
1274 
1275 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1276 		SAVE_PHY_REG(mac, &regs, 429);
1277 		SAVE_PHY_REG(mac, &regs, 802);
1278 
1279 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1280 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1281 	}
1282 
1283 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1284 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div | 0x8000);
1285 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1286 
1287 	SAVE_PHY_REG(mac, &regs, 15);
1288 	SAVE_PHY_REG(mac, &regs, 2a);
1289 	SAVE_PHY_REG(mac, &regs, 35);
1290 	SAVE_PHY_REG(mac, &regs, 60);
1291 	SAVE_RF_REG(mac, &regs, 43);
1292 	SAVE_RF_REG(mac, &regs, 7a);
1293 	SAVE_RF_REG(mac, &regs, 52);
1294 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1295 		SAVE_PHY_REG(mac, &regs, 811);
1296 		SAVE_PHY_REG(mac, &regs, 812);
1297 		SAVE_PHY_REG(mac, &regs, 814);
1298 		SAVE_PHY_REG(mac, &regs, 815);
1299 	}
1300 
1301 	/* Force to channel 6 */
1302 	bwi_rf_set_chan(mac, 6, 0);
1303 
1304 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1305 		PHY_WRITE(mac, 0x429, regs.phy_429 & 0x7fff);
1306 		PHY_WRITE(mac, 0x802, regs.phy_802 & 0xfffc);
1307 		bwi_mac_dummy_xmit(mac);
1308 	}
1309 	RF_WRITE(mac, 0x43, 0x6);
1310 
1311 	bwi_phy_set_bbp_atten(mac, 2);
1312 
1313 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, 0);
1314 
1315 	PHY_WRITE(mac, 0x2e, 0x7f);
1316 	PHY_WRITE(mac, 0x80f, 0x78);
1317 	PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
1318 	RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
1319 	PHY_WRITE(mac, 0x2b, 0x203);
1320 	PHY_WRITE(mac, 0x2a, 0x8a3);
1321 
1322 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1323 		PHY_WRITE(mac, 0x814, regs.phy_814 | 0x3);
1324 		PHY_WRITE(mac, 0x815, regs.phy_815 & 0xfffc);
1325 		PHY_WRITE(mac, 0x811, 0x1b3);
1326 		PHY_WRITE(mac, 0x812, 0xb2);
1327 	}
1328 
1329 	if ((sc->sc_flags & BWI_F_RUNNING) == 0)
1330 		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
1331 	PHY_WRITE(mac, 0x80f, 0x8078);
1332 
1333 	/*
1334 	 * Measure all RF LO
1335 	 */
1336 	devi_ctrl = _bwi_rf_lo_update_11g(mac, regs.rf_7a);
1337 
1338 	/*
1339 	 * Restore saved RF/PHY registers
1340 	 */
1341 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1342 		PHY_WRITE(mac, 0x15, 0xe300);
1343 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa0);
1344 		DELAY(5);
1345 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa2);
1346 		DELAY(2);
1347 		PHY_WRITE(mac, 0x812, (devi_ctrl << 8) | 0xa3);
1348 	} else {
1349 		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
1350 	}
1351 
1352 	if ((sc->sc_flags & BWI_F_RUNNING) == 0)
1353 		tpctl = NULL;
1354 	bwi_rf_lo_adjust(mac, tpctl);
1355 
1356 	PHY_WRITE(mac, 0x2e, 0x807f);
1357 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1358 		PHY_WRITE(mac, 0x2f, 0x202);
1359 	else
1360 		PHY_WRITE(mac, 0x2f, 0x101);
1361 
1362 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1363 
1364 	RESTORE_PHY_REG(mac, &regs, 15);
1365 	RESTORE_PHY_REG(mac, &regs, 2a);
1366 	RESTORE_PHY_REG(mac, &regs, 35);
1367 	RESTORE_PHY_REG(mac, &regs, 60);
1368 
1369 	RESTORE_RF_REG(mac, &regs, 43);
1370 	RESTORE_RF_REG(mac, &regs, 7a);
1371 
1372 	regs.rf_52 &= 0xf0;
1373 	regs.rf_52 |= (RF_READ(mac, 0x52) & 0xf);
1374 	RF_WRITE(mac, 0x52, regs.rf_52);
1375 
1376 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1377 
1378 	if (phy->phy_flags & BWI_PHY_F_LINKED) {
1379 		RESTORE_PHY_REG(mac, &regs, 811);
1380 		RESTORE_PHY_REG(mac, &regs, 812);
1381 		RESTORE_PHY_REG(mac, &regs, 814);
1382 		RESTORE_PHY_REG(mac, &regs, 815);
1383 		RESTORE_PHY_REG(mac, &regs, 429);
1384 		RESTORE_PHY_REG(mac, &regs, 802);
1385 	}
1386 
1387 	bwi_rf_set_chan(mac, orig_chan, 1);
1388 }
1389 
1390 static uint32_t
1391 bwi_rf_lo_devi_measure(struct bwi_mac *mac, uint16_t ctrl)
1392 {
1393 	struct bwi_phy *phy = &mac->mac_phy;
1394 	uint32_t devi = 0;
1395 	int i;
1396 
1397 	if (phy->phy_flags & BWI_PHY_F_LINKED)
1398 		ctrl <<= 8;
1399 
1400 	for (i = 0; i < 8; ++i) {
1401 		if (phy->phy_flags & BWI_PHY_F_LINKED) {
1402 			PHY_WRITE(mac, 0x15, 0xe300);
1403 			PHY_WRITE(mac, 0x812, ctrl | 0xb0);
1404 			DELAY(5);
1405 			PHY_WRITE(mac, 0x812, ctrl | 0xb2);
1406 			DELAY(2);
1407 			PHY_WRITE(mac, 0x812, ctrl | 0xb3);
1408 			DELAY(4);
1409 			PHY_WRITE(mac, 0x15, 0xf300);
1410 		} else {
1411 			PHY_WRITE(mac, 0x15, ctrl | 0xefa0);
1412 			DELAY(2);
1413 			PHY_WRITE(mac, 0x15, ctrl | 0xefe0);
1414 			DELAY(4);
1415 			PHY_WRITE(mac, 0x15, ctrl | 0xffe0);
1416 		}
1417 		DELAY(8);
1418 		devi += PHY_READ(mac, 0x2d);
1419 	}
1420 	return devi;
1421 }
1422 
1423 static uint16_t
1424 bwi_rf_get_tp_ctrl2(struct bwi_mac *mac)
1425 {
1426 	uint32_t devi_min;
1427 	uint16_t tp_ctrl2 = 0;
1428 	int i;
1429 
1430 	RF_WRITE(mac, 0x52, 0);
1431 	DELAY(10);
1432 	devi_min = bwi_rf_lo_devi_measure(mac, 0);
1433 
1434 	for (i = 0; i < 16; ++i) {
1435 		uint32_t devi;
1436 
1437 		RF_WRITE(mac, 0x52, i);
1438 		DELAY(10);
1439 		devi = bwi_rf_lo_devi_measure(mac, 0);
1440 
1441 		if (devi < devi_min) {
1442 			devi_min = devi;
1443 			tp_ctrl2 = i;
1444 		}
1445 	}
1446 	return tp_ctrl2;
1447 }
1448 
1449 static uint8_t
1450 _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
1451 {
1452 #define RF_ATTEN_LISTSZ	14
1453 #define BBP_ATTEN_MAX	4	/* half */
1454 
1455 	static const int rf_atten_list[RF_ATTEN_LISTSZ] =
1456 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 1, 2, 3, 4 };
1457 	static const int rf_atten_init_list[RF_ATTEN_LISTSZ] =
1458         { 0, 3, 1, 5, 7, 3, 2, 0, 4, 6, -1, -1, -1, -1 };
1459 	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
1460 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
1461 
1462 	struct bwi_softc *sc = mac->mac_sc;
1463 	struct bwi_rf_lo lo_save, *lo;
1464 	uint8_t devi_ctrl = 0;
1465 	int idx, adj_rf7a = 0;
1466 
1467 	bzero(&lo_save, sizeof(lo_save));
1468 	for (idx = 0; idx < RF_ATTEN_LISTSZ; ++idx) {
1469 		int init_rf_atten = rf_atten_init_list[idx];
1470 		int rf_atten = rf_atten_list[idx];
1471 		int bbp_atten;
1472 
1473 		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
1474 			uint16_t tp_ctrl2, rf7a;
1475 
1476 			if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
1477 				if (idx == 0) {
1478 					bzero(&lo_save, sizeof(lo_save));
1479 				} else if (init_rf_atten < 0) {
1480 					lo = bwi_get_rf_lo(mac,
1481 						rf_atten, 2 * bbp_atten);
1482 					bcopy(lo, &lo_save, sizeof(lo_save));
1483 				} else {
1484 					lo = bwi_get_rf_lo(mac,
1485 						init_rf_atten, 0);
1486 					bcopy(lo, &lo_save, sizeof(lo_save));
1487 				}
1488 
1489 				devi_ctrl = 0;
1490 				adj_rf7a = 0;
1491 
1492 				/*
1493 				 * XXX
1494 				 * Linux driver overflows 'val'
1495 				 */
1496 				if (init_rf_atten >= 0) {
1497 					int val;
1498 
1499 					val = rf_atten * 2 + bbp_atten;
1500 					if (val > 14) {
1501 						adj_rf7a = 1;
1502 						if (val > 17)
1503 							devi_ctrl = 1;
1504 						if (val > 19)
1505 							devi_ctrl = 2;
1506 					}
1507 				}
1508 			} else {
1509 				lo = bwi_get_rf_lo(mac,
1510 					rf_atten, 2 * bbp_atten);
1511 				if (!bwi_rf_lo_isused(mac, lo))
1512 					continue;
1513 				bcopy(lo, &lo_save, sizeof(lo_save));
1514 
1515 				devi_ctrl = 3;
1516 				adj_rf7a = 0;
1517 			}
1518 
1519 			RF_WRITE(mac, BWI_RFR_ATTEN, rf_atten);
1520 
1521 			tp_ctrl2 = mac->mac_tpctl.tp_ctrl2;
1522 			if (init_rf_atten < 0)
1523 				tp_ctrl2 |= (3 << 4);
1524 			RF_WRITE(mac, BWI_RFR_TXPWR, tp_ctrl2);
1525 
1526 			DELAY(10);
1527 
1528 			bwi_phy_set_bbp_atten(mac, bbp_atten * 2);
1529 
1530 			rf7a = orig_rf7a & 0xfff0;
1531 			if (adj_rf7a)
1532 				rf7a |= 0x8;
1533 			RF_WRITE(mac, 0x7a, rf7a);
1534 
1535 			lo = bwi_get_rf_lo(mac,
1536 				rf_lo_measure_order[idx], bbp_atten * 2);
1537 			bwi_rf_lo_measure_11g(mac, &lo_save, lo, devi_ctrl);
1538 		}
1539 	}
1540 	return devi_ctrl;
1541 
1542 #undef RF_ATTEN_LISTSZ
1543 #undef BBP_ATTEN_MAX
1544 }
1545 
1546 static void
1547 bwi_rf_lo_measure_11g(struct bwi_mac *mac, const struct bwi_rf_lo *src_lo,
1548 	struct bwi_rf_lo *dst_lo, uint8_t devi_ctrl)
1549 {
1550 #define LO_ADJUST_MIN	1
1551 #define LO_ADJUST_MAX	8
1552 #define LO_ADJUST(hi, lo)	{ .ctrl_hi = hi, .ctrl_lo = lo }
1553 	static const struct bwi_rf_lo rf_lo_adjust[LO_ADJUST_MAX] = {
1554 		LO_ADJUST(1,	1),
1555 		LO_ADJUST(1,	0),
1556 		LO_ADJUST(1,	-1),
1557 		LO_ADJUST(0,	-1),
1558 		LO_ADJUST(-1,	-1),
1559 		LO_ADJUST(-1,	0),
1560 		LO_ADJUST(-1,	1),
1561 		LO_ADJUST(0,	1)
1562 	};
1563 #undef LO_ADJUST
1564 
1565 	struct bwi_rf_lo lo_min;
1566 	uint32_t devi_min;
1567 	int found, loop_count, adjust_state;
1568 
1569 	bcopy(src_lo, &lo_min, sizeof(lo_min));
1570 	RF_LO_WRITE(mac, &lo_min);
1571 	devi_min = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1572 
1573 	loop_count = 12;	/* XXX */
1574 	adjust_state = 0;
1575 	do {
1576 		struct bwi_rf_lo lo_base;
1577 		int i, fin;
1578 
1579 		found = 0;
1580 		if (adjust_state == 0) {
1581 			i = LO_ADJUST_MIN;
1582 			fin = LO_ADJUST_MAX;
1583 		} else if (adjust_state % 2 == 0) {
1584 			i = adjust_state - 1;
1585 			fin = adjust_state + 1;
1586 		} else {
1587 			i = adjust_state - 2;
1588 			fin = adjust_state + 2;
1589 		}
1590 
1591 		if (i < LO_ADJUST_MIN)
1592 			i += LO_ADJUST_MAX;
1593 		KASSERT(i <= LO_ADJUST_MAX && i >= LO_ADJUST_MIN, ("i %d", i));
1594 
1595 		if (fin > LO_ADJUST_MAX)
1596 			fin -= LO_ADJUST_MAX;
1597 		KASSERT(fin <= LO_ADJUST_MAX && fin >= LO_ADJUST_MIN,
1598 		    ("fin %d", fin));
1599 
1600 		bcopy(&lo_min, &lo_base, sizeof(lo_base));
1601 		for (;;) {
1602 			struct bwi_rf_lo lo;
1603 
1604 			lo.ctrl_hi = lo_base.ctrl_hi +
1605 				rf_lo_adjust[i - 1].ctrl_hi;
1606 			lo.ctrl_lo = lo_base.ctrl_lo +
1607 				rf_lo_adjust[i - 1].ctrl_lo;
1608 
1609 			if (abs(lo.ctrl_lo) < 9 && abs(lo.ctrl_hi) < 9) {
1610 				uint32_t devi;
1611 
1612 				RF_LO_WRITE(mac, &lo);
1613 				devi = bwi_rf_lo_devi_measure(mac, devi_ctrl);
1614 				if (devi < devi_min) {
1615 					devi_min = devi;
1616 					adjust_state = i;
1617 					found = 1;
1618 					bcopy(&lo, &lo_min, sizeof(lo_min));
1619 				}
1620 			}
1621 			if (i == fin)
1622 				break;
1623 			if (i == LO_ADJUST_MAX)
1624 				i = LO_ADJUST_MIN;
1625 			else
1626 				++i;
1627 		}
1628 	} while (loop_count-- && found);
1629 
1630 	bcopy(&lo_min, dst_lo, sizeof(*dst_lo));
1631 
1632 #undef LO_ADJUST_MIN
1633 #undef LO_ADJUST_MAX
1634 }
1635 
1636 static void
1637 bwi_rf_calc_nrssi_slope_11b(struct bwi_mac *mac)
1638 {
1639 #define SAVE_RF_MAX	3
1640 #define SAVE_PHY_MAX	8
1641 
1642 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1643 	{ 0x7a, 0x52, 0x43 };
1644 	static const uint16_t save_phy_regs[SAVE_PHY_MAX] =
1645 	{ 0x30, 0x26, 0x15, 0x2a, 0x20, 0x5a, 0x59, 0x58 };
1646 
1647 	struct bwi_softc *sc = mac->mac_sc;
1648 	struct bwi_rf *rf = &mac->mac_rf;
1649 	struct bwi_phy *phy = &mac->mac_phy;
1650 	uint16_t save_rf[SAVE_RF_MAX];
1651 	uint16_t save_phy[SAVE_PHY_MAX];
1652 	uint16_t ant_div, bbp_atten, chan_ex;
1653 	int16_t nrssi[2];
1654 	int i;
1655 
1656 	/*
1657 	 * Save RF/PHY registers for later restoration
1658 	 */
1659 	for (i = 0; i < SAVE_RF_MAX; ++i)
1660 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1661 	for (i = 0; i < SAVE_PHY_MAX; ++i)
1662 		save_phy[i] = PHY_READ(mac, save_phy_regs[i]);
1663 
1664 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1665 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1666 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1667 
1668 	/*
1669 	 * Calculate nrssi0
1670 	 */
1671 	if (phy->phy_rev >= 5)
1672 		RF_CLRBITS(mac, 0x7a, 0xff80);
1673 	else
1674 		RF_CLRBITS(mac, 0x7a, 0xfff0);
1675 	PHY_WRITE(mac, 0x30, 0xff);
1676 
1677 	CSR_WRITE_2(sc, BWI_BPHY_CTRL, 0x7f7f);
1678 
1679 	PHY_WRITE(mac, 0x26, 0);
1680 	PHY_SETBITS(mac, 0x15, 0x20);
1681 	PHY_WRITE(mac, 0x2a, 0x8a3);
1682 	RF_SETBITS(mac, 0x7a, 0x80);
1683 
1684 	nrssi[0] = (int16_t)PHY_READ(mac, 0x27);
1685 
1686 	/*
1687 	 * Calculate nrssi1
1688 	 */
1689 	RF_CLRBITS(mac, 0x7a, 0xff80);
1690 	if (phy->phy_version >= 2)
1691 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x40);
1692 	else if (phy->phy_version == 0)
1693 		CSR_WRITE_2(sc, BWI_BBP_ATTEN, 0x122);
1694 	else
1695 		CSR_CLRBITS_2(sc, BWI_RF_CHAN_EX, 0xdfff);
1696 
1697 	PHY_WRITE(mac, 0x20, 0x3f3f);
1698 	PHY_WRITE(mac, 0x15, 0xf330);
1699 
1700 	RF_WRITE(mac, 0x5a, 0x60);
1701 	RF_CLRBITS(mac, 0x43, 0xff0f);
1702 
1703 	PHY_WRITE(mac, 0x5a, 0x480);
1704 	PHY_WRITE(mac, 0x59, 0x810);
1705 	PHY_WRITE(mac, 0x58, 0xd);
1706 
1707 	DELAY(20);
1708 
1709 	nrssi[1] = (int16_t)PHY_READ(mac, 0x27);
1710 
1711 	/*
1712 	 * Restore saved RF/PHY registers
1713 	 */
1714 	PHY_WRITE(mac, save_phy_regs[0], save_phy[0]);
1715 	RF_WRITE(mac, save_rf_regs[0], save_rf[0]);
1716 
1717 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
1718 
1719 	for (i = 1; i < 4; ++i)
1720 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1721 
1722 	bwi_rf_work_around(mac, rf->rf_curchan);
1723 
1724 	if (phy->phy_version != 0)
1725 		CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
1726 
1727 	for (; i < SAVE_PHY_MAX; ++i)
1728 		PHY_WRITE(mac, save_phy_regs[i], save_phy[i]);
1729 
1730 	for (i = 1; i < SAVE_RF_MAX; ++i)
1731 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1732 
1733 	/*
1734 	 * Install calculated narrow RSSI values
1735 	 */
1736 	if (nrssi[0] == nrssi[1])
1737 		rf->rf_nrssi_slope = 0x10000;
1738 	else
1739 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
1740 	if (nrssi[0] <= -4) {
1741 		rf->rf_nrssi[0] = nrssi[0];
1742 		rf->rf_nrssi[1] = nrssi[1];
1743 	}
1744 
1745 #undef SAVE_RF_MAX
1746 #undef SAVE_PHY_MAX
1747 }
1748 
1749 static void
1750 bwi_rf_set_nrssi_ofs_11g(struct bwi_mac *mac)
1751 {
1752 #define SAVE_RF_MAX		2
1753 #define SAVE_PHY_COMM_MAX	10
1754 #define SAVE_PHY6_MAX		8
1755 
1756 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1757 	{ 0x7a, 0x43 };
1758 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] = {
1759 		0x0001, 0x0811, 0x0812, 0x0814,
1760 		0x0815, 0x005a, 0x0059, 0x0058,
1761 		0x000a, 0x0003
1762 	};
1763 	static const uint16_t save_phy6_regs[SAVE_PHY6_MAX] = {
1764 		0x002e, 0x002f, 0x080f, 0x0810,
1765 		0x0801, 0x0060, 0x0014, 0x0478
1766 	};
1767 
1768 	struct bwi_phy *phy = &mac->mac_phy;
1769 	uint16_t save_rf[SAVE_RF_MAX];
1770 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1771 	uint16_t save_phy6[SAVE_PHY6_MAX];
1772 	uint16_t rf7b = 0xffff;
1773 	int16_t nrssi;
1774 	int i, phy6_idx = 0;
1775 
1776 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1777 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1778 	for (i = 0; i < SAVE_RF_MAX; ++i)
1779 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1780 
1781 	PHY_CLRBITS(mac, 0x429, 0x8000);
1782 	PHY_FILT_SETBITS(mac, 0x1, 0x3fff, 0x4000);
1783 	PHY_SETBITS(mac, 0x811, 0xc);
1784 	PHY_FILT_SETBITS(mac, 0x812, 0xfff3, 0x4);
1785 	PHY_CLRBITS(mac, 0x802, 0x3);
1786 
1787 	if (phy->phy_rev >= 6) {
1788 		for (i = 0; i < SAVE_PHY6_MAX; ++i)
1789 			save_phy6[i] = PHY_READ(mac, save_phy6_regs[i]);
1790 
1791 		PHY_WRITE(mac, 0x2e, 0);
1792 		PHY_WRITE(mac, 0x2f, 0);
1793 		PHY_WRITE(mac, 0x80f, 0);
1794 		PHY_WRITE(mac, 0x810, 0);
1795 		PHY_SETBITS(mac, 0x478, 0x100);
1796 		PHY_SETBITS(mac, 0x801, 0x40);
1797 		PHY_SETBITS(mac, 0x60, 0x40);
1798 		PHY_SETBITS(mac, 0x14, 0x200);
1799 	}
1800 
1801 	RF_SETBITS(mac, 0x7a, 0x70);
1802 	RF_SETBITS(mac, 0x7a, 0x80);
1803 
1804 	DELAY(30);
1805 
1806 	nrssi = bwi_nrssi_11g(mac);
1807 	if (nrssi == 31) {
1808 		for (i = 7; i >= 4; --i) {
1809 			RF_WRITE(mac, 0x7b, i);
1810 			DELAY(20);
1811 			nrssi = bwi_nrssi_11g(mac);
1812 			if (nrssi < 31 && rf7b == 0xffff)
1813 				rf7b = i;
1814 		}
1815 		if (rf7b == 0xffff)
1816 			rf7b = 4;
1817 	} else {
1818 		struct bwi_gains gains;
1819 
1820 		RF_CLRBITS(mac, 0x7a, 0xff80);
1821 
1822 		PHY_SETBITS(mac, 0x814, 0x1);
1823 		PHY_CLRBITS(mac, 0x815, 0x1);
1824 		PHY_SETBITS(mac, 0x811, 0xc);
1825 		PHY_SETBITS(mac, 0x812, 0xc);
1826 		PHY_SETBITS(mac, 0x811, 0x30);
1827 		PHY_SETBITS(mac, 0x812, 0x30);
1828 		PHY_WRITE(mac, 0x5a, 0x480);
1829 		PHY_WRITE(mac, 0x59, 0x810);
1830 		PHY_WRITE(mac, 0x58, 0xd);
1831 		if (phy->phy_version == 0)
1832 			PHY_WRITE(mac, 0x3, 0x122);
1833 		else
1834 			PHY_SETBITS(mac, 0xa, 0x2000);
1835 		PHY_SETBITS(mac, 0x814, 0x4);
1836 		PHY_CLRBITS(mac, 0x815, 0x4);
1837 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
1838 		RF_SETBITS(mac, 0x7a, 0xf);
1839 
1840 		bzero(&gains, sizeof(gains));
1841 		gains.tbl_gain1 = 3;
1842 		gains.tbl_gain2 = 0;
1843 		gains.phy_gain = 1;
1844 		bwi_set_gains(mac, &gains);
1845 
1846 		RF_FILT_SETBITS(mac, 0x43, 0xf0, 0xf);
1847 		DELAY(30);
1848 
1849 		nrssi = bwi_nrssi_11g(mac);
1850 		if (nrssi == -32) {
1851 			for (i = 0; i < 4; ++i) {
1852 				RF_WRITE(mac, 0x7b, i);
1853 				DELAY(20);
1854 				nrssi = bwi_nrssi_11g(mac);
1855 				if (nrssi > -31 && rf7b == 0xffff)
1856 					rf7b = i;
1857 			}
1858 			if (rf7b == 0xffff)
1859 				rf7b = 3;
1860 		} else {
1861 			rf7b = 0;
1862 		}
1863 	}
1864 	RF_WRITE(mac, 0x7b, rf7b);
1865 
1866 	/*
1867 	 * Restore saved RF/PHY registers
1868 	 */
1869 	if (phy->phy_rev >= 6) {
1870 		for (phy6_idx = 0; phy6_idx < 4; ++phy6_idx) {
1871 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1872 				  save_phy6[phy6_idx]);
1873 		}
1874 	}
1875 
1876 	/* Saved PHY registers 0, 1, 2 are handled later */
1877 	for (i = 3; i < SAVE_PHY_COMM_MAX; ++i)
1878 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
1879 
1880 	for (i = SAVE_RF_MAX - 1; i >= 0; --i)
1881 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
1882 
1883 	PHY_SETBITS(mac, 0x802, 0x3);
1884 	PHY_SETBITS(mac, 0x429, 0x8000);
1885 
1886 	bwi_set_gains(mac, NULL);
1887 
1888 	if (phy->phy_rev >= 6) {
1889 		for (; phy6_idx < SAVE_PHY6_MAX; ++phy6_idx) {
1890 			PHY_WRITE(mac, save_phy6_regs[phy6_idx],
1891 				  save_phy6[phy6_idx]);
1892 		}
1893 	}
1894 
1895 	PHY_WRITE(mac, save_phy_comm_regs[0], save_phy_comm[0]);
1896 	PHY_WRITE(mac, save_phy_comm_regs[2], save_phy_comm[2]);
1897 	PHY_WRITE(mac, save_phy_comm_regs[1], save_phy_comm[1]);
1898 
1899 #undef SAVE_RF_MAX
1900 #undef SAVE_PHY_COMM_MAX
1901 #undef SAVE_PHY6_MAX
1902 }
1903 
1904 static void
1905 bwi_rf_calc_nrssi_slope_11g(struct bwi_mac *mac)
1906 {
1907 #define SAVE_RF_MAX		3
1908 #define SAVE_PHY_COMM_MAX	4
1909 #define SAVE_PHY3_MAX		8
1910 
1911 	static const uint16_t save_rf_regs[SAVE_RF_MAX] =
1912 	{ 0x7a, 0x52, 0x43 };
1913 	static const uint16_t save_phy_comm_regs[SAVE_PHY_COMM_MAX] =
1914 	{ 0x15, 0x5a, 0x59, 0x58 };
1915 	static const uint16_t save_phy3_regs[SAVE_PHY3_MAX] = {
1916 		0x002e, 0x002f, 0x080f, 0x0810,
1917 		0x0801, 0x0060, 0x0014, 0x0478
1918 	};
1919 
1920 	struct bwi_softc *sc = mac->mac_sc;
1921 	struct bwi_phy *phy = &mac->mac_phy;
1922 	struct bwi_rf *rf = &mac->mac_rf;
1923 	uint16_t save_rf[SAVE_RF_MAX];
1924 	uint16_t save_phy_comm[SAVE_PHY_COMM_MAX];
1925 	uint16_t save_phy3[SAVE_PHY3_MAX];
1926 	uint16_t ant_div, bbp_atten, chan_ex;
1927 	struct bwi_gains gains;
1928 	int16_t nrssi[2];
1929 	int i, phy3_idx = 0;
1930 
1931 	if (rf->rf_rev >= 9)
1932 		return;
1933 	else if (rf->rf_rev == 8)
1934 		bwi_rf_set_nrssi_ofs_11g(mac);
1935 
1936 	PHY_CLRBITS(mac, 0x429, 0x8000);
1937 	PHY_CLRBITS(mac, 0x802, 0x3);
1938 
1939 	/*
1940 	 * Save RF/PHY registers for later restoration
1941 	 */
1942 	ant_div = CSR_READ_2(sc, BWI_RF_ANTDIV);
1943 	CSR_SETBITS_2(sc, BWI_RF_ANTDIV, 0x8000);
1944 
1945 	for (i = 0; i < SAVE_RF_MAX; ++i)
1946 		save_rf[i] = RF_READ(mac, save_rf_regs[i]);
1947 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
1948 		save_phy_comm[i] = PHY_READ(mac, save_phy_comm_regs[i]);
1949 
1950 	bbp_atten = CSR_READ_2(sc, BWI_BBP_ATTEN);
1951 	chan_ex = CSR_READ_2(sc, BWI_RF_CHAN_EX);
1952 
1953 	if (phy->phy_rev >= 3) {
1954 		for (i = 0; i < SAVE_PHY3_MAX; ++i)
1955 			save_phy3[i] = PHY_READ(mac, save_phy3_regs[i]);
1956 
1957 		PHY_WRITE(mac, 0x2e, 0);
1958 		PHY_WRITE(mac, 0x810, 0);
1959 
1960 		if (phy->phy_rev == 4 || phy->phy_rev == 6 ||
1961 		    phy->phy_rev == 7) {
1962 			PHY_SETBITS(mac, 0x478, 0x100);
1963 			PHY_SETBITS(mac, 0x810, 0x40);
1964 		} else if (phy->phy_rev == 3 || phy->phy_rev == 5) {
1965 			PHY_CLRBITS(mac, 0x810, 0x40);
1966 		}
1967 
1968 		PHY_SETBITS(mac, 0x60, 0x40);
1969 		PHY_SETBITS(mac, 0x14, 0x200);
1970 	}
1971 
1972 	/*
1973 	 * Calculate nrssi0
1974 	 */
1975 	RF_SETBITS(mac, 0x7a, 0x70);
1976 
1977 	bzero(&gains, sizeof(gains));
1978 	gains.tbl_gain1 = 0;
1979 	gains.tbl_gain2 = 8;
1980 	gains.phy_gain = 0;
1981 	bwi_set_gains(mac, &gains);
1982 
1983 	RF_CLRBITS(mac, 0x7a, 0xff08);
1984 	if (phy->phy_rev >= 2) {
1985 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x30);
1986 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x10);
1987 	}
1988 
1989 	RF_SETBITS(mac, 0x7a, 0x80);
1990 	DELAY(20);
1991 	nrssi[0] = bwi_nrssi_11g(mac);
1992 
1993 	/*
1994 	 * Calculate nrssi1
1995 	 */
1996 	RF_CLRBITS(mac, 0x7a, 0xff80);
1997 	if (phy->phy_version >= 2)
1998 		PHY_FILT_SETBITS(mac, 0x3, 0xff9f, 0x40);
1999 	CSR_SETBITS_2(sc, BWI_RF_CHAN_EX, 0x2000);
2000 
2001 	RF_SETBITS(mac, 0x7a, 0xf);
2002 	PHY_WRITE(mac, 0x15, 0xf330);
2003 	if (phy->phy_rev >= 2) {
2004 		PHY_FILT_SETBITS(mac, 0x812, 0xffcf, 0x20);
2005 		PHY_FILT_SETBITS(mac, 0x811, 0xffcf, 0x20);
2006 	}
2007 
2008 	bzero(&gains, sizeof(gains));
2009 	gains.tbl_gain1 = 3;
2010 	gains.tbl_gain2 = 0;
2011 	gains.phy_gain = 1;
2012 	bwi_set_gains(mac, &gains);
2013 
2014 	if (rf->rf_rev == 8) {
2015 		RF_WRITE(mac, 0x43, 0x1f);
2016 	} else {
2017 		RF_FILT_SETBITS(mac, 0x52, 0xff0f, 0x60);
2018 		RF_FILT_SETBITS(mac, 0x43, 0xfff0, 0x9);
2019 	}
2020 	PHY_WRITE(mac, 0x5a, 0x480);
2021 	PHY_WRITE(mac, 0x59, 0x810);
2022 	PHY_WRITE(mac, 0x58, 0xd);
2023 	DELAY(20);
2024 
2025 	nrssi[1] = bwi_nrssi_11g(mac);
2026 
2027 	/*
2028 	 * Install calculated narrow RSSI values
2029 	 */
2030 	if (nrssi[1] == nrssi[0])
2031 		rf->rf_nrssi_slope = 0x10000;
2032 	else
2033 		rf->rf_nrssi_slope = 0x400000 / (nrssi[0] - nrssi[1]);
2034 	if (nrssi[0] >= -4) {
2035 		rf->rf_nrssi[0] = nrssi[1];
2036 		rf->rf_nrssi[1] = nrssi[0];
2037 	}
2038 
2039 	/*
2040 	 * Restore saved RF/PHY registers
2041 	 */
2042 	if (phy->phy_rev >= 3) {
2043 		for (phy3_idx = 0; phy3_idx < 4; ++phy3_idx) {
2044 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2045 				  save_phy3[phy3_idx]);
2046 		}
2047 	}
2048 	if (phy->phy_rev >= 2) {
2049 		PHY_CLRBITS(mac, 0x812, 0x30);
2050 		PHY_CLRBITS(mac, 0x811, 0x30);
2051 	}
2052 
2053 	for (i = 0; i < SAVE_RF_MAX; ++i)
2054 		RF_WRITE(mac, save_rf_regs[i], save_rf[i]);
2055 
2056 	CSR_WRITE_2(sc, BWI_RF_ANTDIV, ant_div);
2057 	CSR_WRITE_2(sc, BWI_BBP_ATTEN, bbp_atten);
2058 	CSR_WRITE_2(sc, BWI_RF_CHAN_EX, chan_ex);
2059 
2060 	for (i = 0; i < SAVE_PHY_COMM_MAX; ++i)
2061 		PHY_WRITE(mac, save_phy_comm_regs[i], save_phy_comm[i]);
2062 
2063 	bwi_rf_work_around(mac, rf->rf_curchan);
2064 	PHY_SETBITS(mac, 0x802, 0x3);
2065 	bwi_set_gains(mac, NULL);
2066 	PHY_SETBITS(mac, 0x429, 0x8000);
2067 
2068 	if (phy->phy_rev >= 3) {
2069 		for (; phy3_idx < SAVE_PHY3_MAX; ++phy3_idx) {
2070 			PHY_WRITE(mac, save_phy3_regs[phy3_idx],
2071 				  save_phy3[phy3_idx]);
2072 		}
2073 	}
2074 
2075 	bwi_rf_init_sw_nrssi_table(mac);
2076 	bwi_rf_set_nrssi_thr_11g(mac);
2077 
2078 #undef SAVE_RF_MAX
2079 #undef SAVE_PHY_COMM_MAX
2080 #undef SAVE_PHY3_MAX
2081 }
2082 
2083 static void
2084 bwi_rf_init_sw_nrssi_table(struct bwi_mac *mac)
2085 {
2086 	struct bwi_rf *rf = &mac->mac_rf;
2087 	int d, i;
2088 
2089 	d = 0x1f - rf->rf_nrssi[0];
2090 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2091 		int val;
2092 
2093 		val = (((i - d) * rf->rf_nrssi_slope) / 0x10000) + 0x3a;
2094 		if (val < 0)
2095 			val = 0;
2096 		else if (val > 0x3f)
2097 			val = 0x3f;
2098 
2099 		rf->rf_nrssi_table[i] = val;
2100 	}
2101 }
2102 
2103 void
2104 bwi_rf_init_hw_nrssi_table(struct bwi_mac *mac, uint16_t adjust)
2105 {
2106 	int i;
2107 
2108 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i) {
2109 		int16_t val;
2110 
2111 		val = bwi_nrssi_read(mac, i);
2112 
2113 		val -= adjust;
2114 		if (val < -32)
2115 			val = -32;
2116 		else if (val > 31)
2117 			val = 31;
2118 
2119 		bwi_nrssi_write(mac, i, val);
2120 	}
2121 }
2122 
2123 static void
2124 bwi_rf_set_nrssi_thr_11b(struct bwi_mac *mac)
2125 {
2126 	struct bwi_rf *rf = &mac->mac_rf;
2127 	int32_t thr;
2128 
2129 	if (rf->rf_type != BWI_RF_T_BCM2050 ||
2130 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0)
2131 		return;
2132 
2133 	/*
2134 	 * Calculate nrssi threshold
2135 	 */
2136 	if (rf->rf_rev >= 6) {
2137 		thr = (rf->rf_nrssi[1] - rf->rf_nrssi[0]) * 32;
2138 		thr += 20 * (rf->rf_nrssi[0] + 1);
2139 		thr /= 40;
2140 	} else {
2141 		thr = rf->rf_nrssi[1] - 5;
2142 	}
2143 	if (thr < 0)
2144 		thr = 0;
2145 	else if (thr > 0x3e)
2146 		thr = 0x3e;
2147 
2148 	PHY_READ(mac, BWI_PHYR_NRSSI_THR_11B);	/* dummy read */
2149 	PHY_WRITE(mac, BWI_PHYR_NRSSI_THR_11B, (((uint16_t)thr) << 8) | 0x1c);
2150 
2151 	if (rf->rf_rev >= 6) {
2152 		PHY_WRITE(mac, 0x87, 0xe0d);
2153 		PHY_WRITE(mac, 0x86, 0xc0b);
2154 		PHY_WRITE(mac, 0x85, 0xa09);
2155 		PHY_WRITE(mac, 0x84, 0x808);
2156 		PHY_WRITE(mac, 0x83, 0x808);
2157 		PHY_WRITE(mac, 0x82, 0x604);
2158 		PHY_WRITE(mac, 0x81, 0x302);
2159 		PHY_WRITE(mac, 0x80, 0x100);
2160 	}
2161 }
2162 
2163 static __inline int32_t
2164 _nrssi_threshold(const struct bwi_rf *rf, int32_t val)
2165 {
2166 	val *= (rf->rf_nrssi[1] - rf->rf_nrssi[0]);
2167 	val += (rf->rf_nrssi[0] << 6);
2168 	if (val < 32)
2169 		val += 31;
2170 	else
2171 		val += 32;
2172 	val >>= 6;
2173 	if (val < -31)
2174 		val = -31;
2175 	else if (val > 31)
2176 		val = 31;
2177 	return val;
2178 }
2179 
2180 static void
2181 bwi_rf_set_nrssi_thr_11g(struct bwi_mac *mac)
2182 {
2183 	int32_t thr1, thr2;
2184 	uint16_t thr;
2185 
2186 	/*
2187 	 * Find the two nrssi thresholds
2188 	 */
2189 	if ((mac->mac_phy.phy_flags & BWI_PHY_F_LINKED) == 0 ||
2190 	    (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) == 0) {
2191 	    	int16_t nrssi;
2192 
2193 		nrssi = bwi_nrssi_read(mac, 0x20);
2194 		if (nrssi >= 32)
2195 			nrssi -= 64;
2196 
2197 		if (nrssi < 3) {
2198 			thr1 = 0x2b;
2199 			thr2 = 0x27;
2200 		} else {
2201 			thr1 = 0x2d;
2202 			thr2 = 0x2b;
2203 		}
2204 	} else {
2205 		/* TODO Interfere mode */
2206 		thr1 = _nrssi_threshold(&mac->mac_rf, 0x11);
2207 		thr2 = _nrssi_threshold(&mac->mac_rf, 0xe);
2208 	}
2209 
2210 #define NRSSI_THR1_MASK	__BITS(5, 0)
2211 #define NRSSI_THR2_MASK	__BITS(11, 6)
2212 
2213 	thr = __SHIFTIN((uint32_t)thr1, NRSSI_THR1_MASK) |
2214 	      __SHIFTIN((uint32_t)thr2, NRSSI_THR2_MASK);
2215 	PHY_FILT_SETBITS(mac, BWI_PHYR_NRSSI_THR_11G, 0xf000, thr);
2216 
2217 #undef NRSSI_THR1_MASK
2218 #undef NRSSI_THR2_MASK
2219 }
2220 
2221 void
2222 bwi_rf_clear_tssi(struct bwi_mac *mac)
2223 {
2224 	/* XXX use function pointer */
2225 	if (mac->mac_phy.phy_mode == IEEE80211_MODE_11A) {
2226 		/* TODO:11A */
2227 	} else {
2228 		uint16_t val;
2229 		int i;
2230 
2231 		val = __SHIFTIN(BWI_INVALID_TSSI, BWI_LO_TSSI_MASK) |
2232 		      __SHIFTIN(BWI_INVALID_TSSI, BWI_HI_TSSI_MASK);
2233 
2234 		for (i = 0; i < 2; ++i) {
2235 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2236 				BWI_COMM_MOBJ_TSSI_DS + (i * 2), val);
2237 		}
2238 
2239 		for (i = 0; i < 2; ++i) {
2240 			MOBJ_WRITE_2(mac, BWI_COMM_MOBJ,
2241 				BWI_COMM_MOBJ_TSSI_OFDM + (i * 2), val);
2242 		}
2243 	}
2244 }
2245 
2246 void
2247 bwi_rf_clear_state(struct bwi_rf *rf)
2248 {
2249 	int i;
2250 
2251 	rf->rf_flags &= ~BWI_RF_CLEAR_FLAGS;
2252 	bzero(rf->rf_lo, sizeof(rf->rf_lo));
2253 	bzero(rf->rf_lo_used, sizeof(rf->rf_lo_used));
2254 
2255 	rf->rf_nrssi_slope = 0;
2256 	rf->rf_nrssi[0] = BWI_INVALID_NRSSI;
2257 	rf->rf_nrssi[1] = BWI_INVALID_NRSSI;
2258 
2259 	for (i = 0; i < BWI_NRSSI_TBLSZ; ++i)
2260 		rf->rf_nrssi_table[i] = i;
2261 
2262 	rf->rf_lo_gain = 0;
2263 	rf->rf_rx_gain = 0;
2264 
2265 	bcopy(rf->rf_txpower_map0, rf->rf_txpower_map,
2266 	      sizeof(rf->rf_txpower_map));
2267 	rf->rf_idle_tssi = rf->rf_idle_tssi0;
2268 }
2269 
2270 static void
2271 bwi_rf_on_11a(struct bwi_mac *mac)
2272 {
2273 	/* TODO:11A */
2274 }
2275 
2276 static void
2277 bwi_rf_on_11bg(struct bwi_mac *mac)
2278 {
2279 	struct bwi_phy *phy = &mac->mac_phy;
2280 
2281 	PHY_WRITE(mac, 0x15, 0x8000);
2282 	PHY_WRITE(mac, 0x15, 0xcc00);
2283 	if (phy->phy_flags & BWI_PHY_F_LINKED)
2284 		PHY_WRITE(mac, 0x15, 0xc0);
2285 	else
2286 		PHY_WRITE(mac, 0x15, 0);
2287 
2288 	bwi_rf_set_chan(mac, 6 /* XXX */, 1);
2289 }
2290 
2291 void
2292 bwi_rf_set_ant_mode(struct bwi_mac *mac, int ant_mode)
2293 {
2294 	struct bwi_softc *sc = mac->mac_sc;
2295 	struct bwi_phy *phy = &mac->mac_phy;
2296 	uint16_t val;
2297 
2298 	KASSERT(ant_mode == BWI_ANT_MODE_0 ||
2299 		ant_mode == BWI_ANT_MODE_1 ||
2300 		ant_mode == BWI_ANT_MODE_AUTO, ("ant_mode %d", ant_mode));
2301 
2302 	HFLAGS_CLRBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2303 
2304 	if (phy->phy_mode == IEEE80211_MODE_11B) {
2305 		/* NOTE: v4/v3 conflicts, take v3 */
2306 		if (mac->mac_rev == 2)
2307 			val = BWI_ANT_MODE_AUTO;
2308 		else
2309 			val = ant_mode;
2310 		val <<= 7;
2311 		PHY_FILT_SETBITS(mac, 0x3e2, 0xfe7f, val);
2312 	} else {	/* 11a/g */
2313 		/* XXX reg/value naming */
2314 		val = ant_mode << 7;
2315 		PHY_FILT_SETBITS(mac, 0x401, 0x7e7f, val);
2316 
2317 		if (ant_mode == BWI_ANT_MODE_AUTO)
2318 			PHY_CLRBITS(mac, 0x42b, 0x100);
2319 
2320 		if (phy->phy_mode == IEEE80211_MODE_11A) {
2321 			/* TODO:11A */
2322 		} else {	/* 11g */
2323 			if (ant_mode == BWI_ANT_MODE_AUTO)
2324 				PHY_SETBITS(mac, 0x48c, 0x2000);
2325 			else
2326 				PHY_CLRBITS(mac, 0x48c, 0x2000);
2327 
2328 			if (phy->phy_rev >= 2) {
2329 				PHY_SETBITS(mac, 0x461, 0x10);
2330 				PHY_FILT_SETBITS(mac, 0x4ad, 0xff00, 0x15);
2331 				if (phy->phy_rev == 2) {
2332 					PHY_WRITE(mac, 0x427, 0x8);
2333 				} else {
2334 					PHY_FILT_SETBITS(mac, 0x427,
2335 							 0xff00, 0x8);
2336 				}
2337 
2338 				if (phy->phy_rev >= 6)
2339 					PHY_WRITE(mac, 0x49b, 0xdc);
2340 			}
2341 		}
2342 	}
2343 
2344 	/* XXX v4 set AUTO_ANTDIV unconditionally */
2345 	if (ant_mode == BWI_ANT_MODE_AUTO)
2346 		HFLAGS_SETBITS(mac, BWI_HFLAG_AUTO_ANTDIV);
2347 
2348 	val = ant_mode << 8;
2349 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_BEACON,
2350 			    0xfc3f, val);
2351 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_ACK,
2352 			    0xfc3f, val);
2353 	MOBJ_FILT_SETBITS_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_TX_PROBE_RESP,
2354 			    0xfc3f, val);
2355 
2356 	/* XXX what's these */
2357 	if (phy->phy_mode == IEEE80211_MODE_11B)
2358 		CSR_SETBITS_2(sc, 0x5e, 0x4);
2359 
2360 	CSR_WRITE_4(sc, 0x100, 0x1000000);
2361 	if (mac->mac_rev < 5)
2362 		CSR_WRITE_4(sc, 0x10c, 0x1000000);
2363 
2364 	mac->mac_rf.rf_ant_mode = ant_mode;
2365 }
2366 
2367 int
2368 bwi_rf_get_latest_tssi(struct bwi_mac *mac, int8_t tssi[], uint16_t ofs)
2369 {
2370 	int i;
2371 
2372 	for (i = 0; i < 4; ) {
2373 		uint16_t val;
2374 
2375 		val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs + i);
2376 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_LO_TSSI_MASK);
2377 		tssi[i++] = (int8_t)__SHIFTOUT(val, BWI_HI_TSSI_MASK);
2378 	}
2379 
2380 	for (i = 0; i < 4; ++i) {
2381 		if (tssi[i] == BWI_INVALID_TSSI)
2382 			return EINVAL;
2383 	}
2384 	return 0;
2385 }
2386 
2387 int
2388 bwi_rf_tssi2dbm(struct bwi_mac *mac, int8_t tssi, int8_t *txpwr)
2389 {
2390 	struct bwi_rf *rf = &mac->mac_rf;
2391 	int pwr_idx;
2392 
2393 	pwr_idx = rf->rf_idle_tssi + (int)tssi - rf->rf_base_tssi;
2394 #if 0
2395 	if (pwr_idx < 0 || pwr_idx >= BWI_TSSI_MAX)
2396 		return EINVAL;
2397 #else
2398 	if (pwr_idx < 0)
2399 		pwr_idx = 0;
2400 	else if (pwr_idx >= BWI_TSSI_MAX)
2401 		pwr_idx = BWI_TSSI_MAX - 1;
2402 #endif
2403 
2404 	*txpwr = rf->rf_txpower_map[pwr_idx];
2405 	return 0;
2406 }
2407 
2408 static int
2409 bwi_rf_calc_rssi_bcm2050(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2410 {
2411 	uint16_t flags1, flags3;
2412 	int rssi, lna_gain;
2413 
2414 	rssi = hdr->rxh_rssi;
2415 	flags1 = le16toh(hdr->rxh_flags1);
2416 	flags3 = le16toh(hdr->rxh_flags3);
2417 
2418 	if (flags1 & BWI_RXH_F1_OFDM) {
2419 		if (rssi > 127)
2420 			rssi -= 256;
2421 		if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2422 			rssi += 17;
2423 		else
2424 			rssi -= 4;
2425 		return rssi;
2426 	}
2427 
2428 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2429 		struct bwi_rf *rf = &mac->mac_rf;
2430 
2431 		if (rssi >= BWI_NRSSI_TBLSZ)
2432 			rssi = BWI_NRSSI_TBLSZ - 1;
2433 
2434 		rssi = ((31 - (int)rf->rf_nrssi_table[rssi]) * -131) / 128;
2435 		rssi -= 67;
2436 	} else {
2437 		rssi = ((31 - rssi) * -149) / 128;
2438 		rssi -= 68;
2439 	}
2440 
2441 	if (mac->mac_phy.phy_mode != IEEE80211_MODE_11G)
2442 		return rssi;
2443 
2444 	if (flags3 & BWI_RXH_F3_BCM2050_RSSI)
2445 		rssi += 20;
2446 
2447 	lna_gain = __SHIFTOUT(le16toh(hdr->rxh_phyinfo),
2448 			      BWI_RXH_PHYINFO_LNAGAIN);
2449 	DPRINTF(mac->mac_sc, BWI_DBG_RF | BWI_DBG_RX,
2450 		"lna_gain %d, phyinfo 0x%04x\n",
2451 		lna_gain, le16toh(hdr->rxh_phyinfo));
2452 	switch (lna_gain) {
2453 	case 0:
2454 		rssi += 27;
2455 		break;
2456 	case 1:
2457 		rssi += 6;
2458 		break;
2459 	case 2:
2460 		rssi += 12;
2461 		break;
2462 	case 3:
2463 		/*
2464 		 * XXX
2465 		 * According to v3 spec, we should do _nothing_ here,
2466 		 * but it seems that the result RSSI will be too low
2467 		 * (relative to what ath(4) says).  Raise it a little
2468 		 * bit.
2469 		 */
2470 		rssi += 5;
2471 		break;
2472 	default:
2473 		panic("impossible lna gain %d", lna_gain);
2474 	}
2475 	return rssi;
2476 }
2477 
2478 static int
2479 bwi_rf_calc_rssi_bcm2053(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2480 {
2481 	uint16_t flags1;
2482 	int rssi;
2483 
2484 	rssi = (((int)hdr->rxh_rssi - 11) * 103) / 64;
2485 
2486 	flags1 = le16toh(hdr->rxh_flags1);
2487 	if (flags1 & BWI_RXH_F1_BCM2053_RSSI)
2488 		rssi -= 109;
2489 	else
2490 		rssi -= 83;
2491 	return rssi;
2492 }
2493 
2494 static int
2495 bwi_rf_calc_rssi_bcm2060(struct bwi_mac *mac, const struct bwi_rxbuf_hdr *hdr)
2496 {
2497 	int rssi;
2498 
2499 	rssi = hdr->rxh_rssi;
2500 	if (rssi > 127)
2501 		rssi -= 256;
2502 	return rssi;
2503 }
2504 
2505 static int
2506 bwi_rf_calc_noise_bcm2050(struct bwi_mac *mac)
2507 {
2508 	uint16_t val;
2509 	int noise;
2510 
2511 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2512 	noise = (int)val;	/* XXX check bounds? */
2513 
2514 	if (mac->mac_sc->sc_card_flags & BWI_CARD_F_SW_NRSSI) {
2515 		struct bwi_rf *rf = &mac->mac_rf;
2516 
2517 		if (noise >= BWI_NRSSI_TBLSZ)
2518 			noise = BWI_NRSSI_TBLSZ - 1;
2519 
2520 		noise = ((31 - (int)rf->rf_nrssi_table[noise]) * -131) / 128;
2521 		noise -= 67;
2522 	} else {
2523 		noise = ((31 - noise) * -149) / 128;
2524 		noise -= 68;
2525 	}
2526 	return noise;
2527 }
2528 
2529 static int
2530 bwi_rf_calc_noise_bcm2053(struct bwi_mac *mac)
2531 {
2532 	uint16_t val;
2533 	int noise;
2534 
2535 	val = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_RF_NOISE);
2536 	noise = (int)val;	/* XXX check bounds? */
2537 
2538 	noise = ((noise - 11) * 103) / 64;
2539 	noise -= 109;
2540 	return noise;
2541 }
2542 
2543 static int
2544 bwi_rf_calc_noise_bcm2060(struct bwi_mac *mac)
2545 {
2546 	/* XXX Dont know how to calc */
2547 	return (BWI_NOISE_FLOOR);
2548 }
2549 
2550 static uint16_t
2551 bwi_rf_lo_measure_11b(struct bwi_mac *mac)
2552 {
2553 	uint16_t val;
2554 	int i;
2555 
2556 	val = 0;
2557 	for (i = 0; i < 10; ++i) {
2558 		PHY_WRITE(mac, 0x15, 0xafa0);
2559 		DELAY(1);
2560 		PHY_WRITE(mac, 0x15, 0xefa0);
2561 		DELAY(10);
2562 		PHY_WRITE(mac, 0x15, 0xffa0);
2563 		DELAY(40);
2564 
2565 		val += PHY_READ(mac, 0x2c);
2566 	}
2567 	return val;
2568 }
2569 
2570 static void
2571 bwi_rf_lo_update_11b(struct bwi_mac *mac)
2572 {
2573 	struct bwi_softc *sc = mac->mac_sc;
2574 	struct bwi_rf *rf = &mac->mac_rf;
2575 	struct rf_saveregs regs;
2576 	uint16_t rf_val, phy_val, min_val, val;
2577 	uint16_t rf52, bphy_ctrl;
2578 	int i;
2579 
2580 	DPRINTF(sc, BWI_DBG_RF | BWI_DBG_INIT, "%s enter\n", __func__);
2581 
2582 	bzero(&regs, sizeof(regs));
2583 	bphy_ctrl = 0;
2584 
2585 	/*
2586 	 * Save RF/PHY registers for later restoration
2587 	 */
2588 	SAVE_PHY_REG(mac, &regs, 15);
2589 	rf52 = RF_READ(mac, 0x52) & 0xfff0;
2590 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2591 		SAVE_PHY_REG(mac, &regs, 0a);
2592 		SAVE_PHY_REG(mac, &regs, 2a);
2593 		SAVE_PHY_REG(mac, &regs, 35);
2594 		SAVE_PHY_REG(mac, &regs, 03);
2595 		SAVE_PHY_REG(mac, &regs, 01);
2596 		SAVE_PHY_REG(mac, &regs, 30);
2597 
2598 		SAVE_RF_REG(mac, &regs, 43);
2599 		SAVE_RF_REG(mac, &regs, 7a);
2600 
2601 		bphy_ctrl = CSR_READ_2(sc, BWI_BPHY_CTRL);
2602 
2603 		SAVE_RF_REG(mac, &regs, 52);
2604 		regs.rf_52 &= 0xf0;
2605 
2606 		PHY_WRITE(mac, 0x30, 0xff);
2607 		CSR_WRITE_2(sc, BWI_PHY_CTRL, 0x3f3f);
2608 		PHY_WRITE(mac, 0x35, regs.phy_35 & 0xff7f);
2609 		RF_WRITE(mac, 0x7a, regs.rf_7a & 0xfff0);
2610 	}
2611 
2612 	PHY_WRITE(mac, 0x15, 0xb000);
2613 
2614 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2615 		PHY_WRITE(mac, 0x2b, 0x203);
2616 		PHY_WRITE(mac, 0x2a, 0x8a3);
2617 	} else {
2618 		PHY_WRITE(mac, 0x2b, 0x1402);
2619 	}
2620 
2621 	/*
2622 	 * Setup RF signal
2623 	 */
2624 	rf_val = 0;
2625 	min_val = UINT16_MAX;
2626 
2627 	for (i = 0; i < 4; ++i) {
2628 		RF_WRITE(mac, 0x52, rf52 | i);
2629 		bwi_rf_lo_measure_11b(mac);	/* Ignore return value */
2630 	}
2631 	for (i = 0; i < 10; ++i) {
2632 		RF_WRITE(mac, 0x52, rf52 | i);
2633 
2634 		val = bwi_rf_lo_measure_11b(mac) / 10;
2635 		if (val < min_val) {
2636 			min_val = val;
2637 			rf_val = i;
2638 		}
2639 	}
2640 	RF_WRITE(mac, 0x52, rf52 | rf_val);
2641 
2642 	/*
2643 	 * Setup PHY signal
2644 	 */
2645 	phy_val = 0;
2646 	min_val = UINT16_MAX;
2647 
2648 	for (i = -4; i < 5; i += 2) {
2649 		int j;
2650 
2651 		for (j = -4; j < 5; j += 2) {
2652 			uint16_t phy2f;
2653 
2654 			phy2f = (0x100 * i) + j;
2655 			if (j < 0)
2656 				phy2f += 0x100;
2657 			PHY_WRITE(mac, 0x2f, phy2f);
2658 
2659 			val = bwi_rf_lo_measure_11b(mac) / 10;
2660 			if (val < min_val) {
2661 				min_val = val;
2662 				phy_val = phy2f;
2663 			}
2664 		}
2665 	}
2666 	PHY_WRITE(mac, 0x2f, phy_val + 0x101);
2667 
2668 	/*
2669 	 * Restore saved RF/PHY registers
2670 	 */
2671 	if (rf->rf_type == BWI_RF_T_BCM2050) {
2672 		RESTORE_PHY_REG(mac, &regs, 0a);
2673 		RESTORE_PHY_REG(mac, &regs, 2a);
2674 		RESTORE_PHY_REG(mac, &regs, 35);
2675 		RESTORE_PHY_REG(mac, &regs, 03);
2676 		RESTORE_PHY_REG(mac, &regs, 01);
2677 		RESTORE_PHY_REG(mac, &regs, 30);
2678 
2679 		RESTORE_RF_REG(mac, &regs, 43);
2680 		RESTORE_RF_REG(mac, &regs, 7a);
2681 
2682 		RF_FILT_SETBITS(mac, 0x52, 0xf, regs.rf_52);
2683 
2684 		CSR_WRITE_2(sc, BWI_BPHY_CTRL, bphy_ctrl);
2685 	}
2686 	RESTORE_PHY_REG(mac, &regs, 15);
2687 
2688 	bwi_rf_work_around(mac, rf->rf_curchan);
2689 }
2690